Email: 285668 Autolearn: 0 AvgScore: 1.57 AvgScanTime: 1.36 sec Spam: 77798 Autolearn: 0 AvgScore: 15.15 AvgScanTime: 1.53 sec Ham: 207870 Autolearn: 0 AvgScore: -3.52 AvgScanTime: 1.30 sec Time Spent Running SA: 108.26 hours Time Spent Processing Spam: 33.10 hours Time Spent Processing Ham: 75.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 73520 86.01 94.50 82.84 2 DKIM_SIGNED 64582 77.60 83.01 75.58 3 DCC_CHECK 63788 58.18 81.99 49.26 4 XM_DK_Pass 61993 75.84 79.68 74.40 5 DKIM_VALID 60727 74.41 78.06 73.05 6 XM_B_Unicode 57947 72.15 74.48 71.28 7 RELAYCOUNTRY_US 56915 78.64 73.16 80.69 8 XMListUnsubscribeExists 53089 57.33 68.24 53.25 9 XM_B_SpammyWords 49073 51.15 63.08 46.69 10 DKIM_VALID_AU 47202 59.69 60.67 59.32 11 XM_DK_Undo_02 37471 19.90 48.16 9.32 12 XM_B_Unicode3 32726 43.92 42.07 44.62 13 BAYES_99 28698 15.27 36.89 7.18 14 BAYES_50 28302 49.68 36.38 54.65 15 TR_XM_DKIM_Undo 27727 14.68 35.64 6.84 16 XM_B_SpammyWords2 27417 24.02 35.24 19.82 17 LOC_TINY_FONT_1 27378 30.25 35.19 28.40 18 HTML_FONT_LOW_CONTRAST 26589 31.03 34.18 29.85 19 MIME_HTML_ONLY 24576 24.31 31.59 21.59 20 DKIM_VALID_EF 24472 29.14 31.46 28.28 21 TR_DCC_Bayes_99 22583 11.12 29.03 4.42 22 T_KAM_HTML_FONT_INVALID 22268 20.83 28.62 17.91 23 BAYES_999 21994 11.94 28.27 5.83 24 FVGT_m_MULTI_ODD 20674 25.05 26.57 24.48 25 RCVD_IN_MSPIKE_H2 19874 23.68 25.55 22.99 26 RELAYCOUNTRY_META 19376 9.48 24.91 3.71 27 XMSubLong 18325 23.10 23.55 22.94 28 RCVD_IN_MSPIKE_WL 16555 30.53 21.28 33.99 29 XM_Body_Dirty_Words 16357 14.73 21.02 12.38 30 XM_UncommonTLD01 15838 8.68 20.36 4.31 31 UNTRUSTED_Relay 15022 6.36 19.31 1.51 32 BOTNET 14786 6.31 19.01 1.55 33 DCC_CHECK_NEGATIVE 13953 41.78 17.93 50.71 34 T_TM2_M_HEADER_IN_MSG 13711 23.27 17.62 25.38 35 FSL_BULK_SIG 12389 11.07 15.92 9.25 36 XM_Multi_Part_URI 11396 14.37 14.65 14.27 37 BOTNET_IPINHOSTNAME 11168 7.85 14.36 5.42 38 XM_B_Unsub 10802 11.62 13.88 10.77 39 MPART_ALT_DIFF 10423 7.08 13.40 4.71 40 TR_XM_SpammyWords2 10241 4.87 13.16 1.77 41 XM_B_SpammyWords3 9968 6.45 12.81 4.08 42 XMSubMetaSx_00 9605 8.98 12.35 7.72 43 XMSexyCombo_05 9320 6.84 11.98 4.92 44 UNPARSEABLE_RELAY 9103 9.46 11.70 8.62 45 TR_XM_UnparsRelay 8963 8.44 11.52 7.28 46 HTML_IMAGE_RATIO_02 8681 9.25 11.16 8.53 47 MIME_HTML_MOSTLY 8460 4.90 10.87 2.66 48 RCVD_IN_MSPIKE_H3 8406 15.09 10.80 16.69 49 LOTS_OF_MONEY 7540 6.88 9.69 5.83 50 RCVD_IN_MSPIKE_H4 7429 13.21 9.55 14.58 51 BAYES_80 7428 6.20 9.55 4.95 52 SpammyFromTLD_01 7205 2.80 9.26 0.38 53 SpammyFromTLD_02 7150 2.62 9.19 0.16 54 TR_XM_SpammyWords4 6598 5.05 8.48 3.76 55 BAYES_60 6508 10.32 8.37 11.05 56 XM_Evil_Numbers_Gen 6475 9.40 8.32 9.80 57 RCVD_IN_BL_SPAMCOP_NET 6397 2.77 8.22 0.72 58 XM_SendGrid 6142 7.48 7.89 7.33 59 XM_UB50 5938 2.79 7.63 0.98 60 KHOP_HELO_FCRDNS 5620 4.13 7.22 2.98 61 JH_SPAMMY_HEADERS 5579 1.95 7.17 0.00 62 RCVD_IN_MSPIKE_BL 5537 2.18 7.12 0.34 63 T_REMOTE_IMAGE 5209 4.08 6.70 3.10 64 TR_XM_MSPIKECOMBO 5139 2.02 6.61 0.31 65 TooManyTo_001 4976 6.49 6.40 6.52 66 URI_NOVOWEL 4931 3.26 6.34 2.11 67 RCVD_IN_RP_SAFE 4713 9.35 6.06 10.59 68 HTML_MIME_NO_HTML_TAG 4575 2.73 5.88 1.55 69 XM_B_Phish_Phrases 4549 4.52 5.85 4.02 70 HTML_TAG_BALANCE_CENTER 4325 1.59 5.56 0.11 71 XM_H_Long_From01 4289 5.55 5.51 5.56 72 LotsOfNums_01 4234 8.04 5.44 9.01 73 BAYES_95 4181 3.74 5.37 3.13 74 HTML_IMAGE_ONLY_08 4165 1.64 5.35 0.25 75 RELAYCOUNTRY_CA 4081 2.31 5.25 1.21 76 HTML_IMAGE_RATIO_04 4009 6.10 5.15 6.45 77 XMNumbers 3986 4.01 5.12 3.59 78 XM_B_SpammyTLD 3977 2.92 5.11 2.10 79 GOOG_STO_IMG_HTML 3891 1.36 5.00 0.00 80 DKIM_INVALID 3855 3.19 4.96 2.53 81 MIXED_FONT_CASE 3831 1.34 4.92 0.00 82 BODY_URI_ONLY 3668 1.29 4.71 0.01 83 TR_XM_PhishingBody 3597 4.10 4.62 3.90 84 RCVD_IN_RP_CERTIFIED 3490 8.21 4.49 9.60 85 TR_XM_DK_SendGrid 3344 4.36 4.30 4.38 86 XM_UB99 3331 1.17 4.28 0.01 87 RCVD_IN_MSPIKE_L5 3231 1.17 4.15 0.06 88 MIXED_CENTER_CASE 3227 1.13 4.15 0.00 89 MIXED_HREF_CASE 3224 1.13 4.14 0.00 90 MIXED_IMG_CASE 3217 1.13 4.14 0.01 91 MIXED_AREA_CASE 3211 1.12 4.13 0.00 92 XMStrtUSub 3135 5.27 4.03 5.73 93 XM_DIRTYINTL 3066 1.29 3.94 0.30 94 TR_XM_SpammyWords3 3061 1.25 3.93 0.24 95 RELAYCOUNTRY_IN 3053 1.13 3.92 0.09 96 HTML_FONT_SIZE_LARGE 3001 1.14 3.86 0.13 97 URI_PHP_REDIR 2818 0.99 3.62 0.00 98 XMSexyCombo_01 2812 1.75 3.61 1.05 99 HTML_IMAGE_RATIO_06 2640 3.68 3.39 3.79 100 TM2_M_URI_OPT_OUT 2603 3.85 3.35 4.03 101 RELAYCOUNTRY_FR 2599 1.07 3.34 0.22 102 T_TooManySym_01 2578 5.85 3.31 6.80 103 XM_SPF_SoftFail 2535 3.24 3.26 3.24 104 PDS_OTHER_BAD_TLD 2524 1.23 3.24 0.47 105 XM_B_SpammyWords4 2465 1.27 3.17 0.56 106 MIME_HTML_ONLY_MULTI 2317 3.04 2.98 3.06 107 XM_UB999 2257 0.79 2.90 0.00 108 HTML_FONT_SIZE_HUGE 2246 0.88 2.89 0.13 109 FROM_EXCESS_BASE64 2206 3.38 2.84 3.58 110 HTML_IMAGE_RATIO_08 2197 2.49 2.82 2.36 111 TM2_M_VERY_LONG_WORD 2174 1.83 2.79 1.48 112 DIET_1 2149 1.07 2.76 0.44 113 XMSlimDrugH 2149 0.96 2.76 0.29 114 XM_UB80 2142 0.77 2.75 0.03 115 XMBody_17 2134 1.16 2.74 0.57 116 TR_XM_SpammyWords5 2133 1.62 2.74 1.20 117 XM_UB60 2107 0.83 2.71 0.13 118 T_XMHurry_00 2064 1.16 2.65 0.60 119 RCVD_IN_RP_RNBL 2058 0.75 2.65 0.04 120 BOTNET_NORDNS 2025 0.72 2.60 0.01 121 XM_CamelCaseFrm001 1973 2.16 2.54 2.01 122 RELAYCOUNTRY_DE 1970 0.99 2.53 0.42 123 T_XMDrugObfuBody_14 1924 2.51 2.47 2.53 124 XM_OfRef6 1861 1.45 2.39 1.10 125 USER_IN_DEF_DKIM_WL 1768 12.43 2.27 16.23 126 TR_LOTS_OF_MONEY3 1673 0.76 2.15 0.23 127 XMBdyGiftCard01 1664 1.39 2.14 1.11 128 TR_XM_BayesRelay 1663 0.59 2.14 0.01 129 MIME_QP_LONG_LINE 1631 3.50 2.10 4.03 130 URIBL_DBL_SPAM 1611 0.57 2.07 0.00 131 TR_Mismatch_TLD_02 1567 0.60 2.01 0.07 132 RCVD_IN_PSBL 1567 0.60 2.01 0.08 133 XM_B_Phish66 1503 1.59 1.93 1.47 134 T_XMDrugObfuBody_08 1470 1.51 1.89 1.37 135 TR_XM_PHPDW 1395 0.69 1.79 0.28 136 T_FILL_THIS_FORM_SHORT 1389 0.84 1.79 0.49 137 URI_GOOG_STO_SPAMMY 1360 0.48 1.75 0.00 138 THIS_AD 1355 0.90 1.74 0.58 139 URIBL_DBL_ABUSE_SPAM 1312 0.49 1.69 0.04 140 XMBrknScrpt_02 1290 1.58 1.66 1.55 141 TR_XM_PHPForged 1221 0.59 1.57 0.22 142 FROM_SUSPICIOUS_NTLD 1219 0.46 1.57 0.05 143 BAYES_40 1215 3.80 1.56 4.64 144 TR_XM_FormFill2 1210 0.59 1.56 0.23 145 FROM_SUSPICIOUS_NTLD_FP 1200 0.45 1.54 0.04 146 XM_H_PHPOS 1198 0.57 1.54 0.21 147 XM_UB95 1191 0.43 1.53 0.01 148 URI_HEX 1185 1.55 1.52 1.55 149 HTTPS_HTTP_MISMATCH 1180 0.77 1.52 0.49 150 RCVD_IN_IADB_LISTED 1159 3.21 1.49 3.85 151 XM_B_COVIDMETA 1143 0.97 1.47 0.78 152 SHOPIFY_IMG_NOT_RCVD_SFY 1142 0.58 1.47 0.25 153 SUBJ_ALL_CAPS 1141 1.20 1.47 1.10 154 XM_JunkDunk 1129 0.40 1.45 0.00 155 XMDiploma_00 1122 1.25 1.44 1.18 156 XMStockSpam_06 1116 1.66 1.43 1.75 157 XM_DK_Undo_01 1110 1.34 1.43 1.31 158 MIXED_CTYPE_CASE 1088 0.38 1.40 0.00 159 RCVD_IN_MSPIKE_L4 1082 0.50 1.39 0.17 160 XM_B_Unsub2 1047 1.29 1.35 1.27 161 RCVD_IN_IADB_SPF 1037 2.86 1.33 3.43 162 T_XMDrugObfuBody_00 1024 0.92 1.32 0.77 163 MAILING_LIST_MULTI 1022 2.07 1.31 2.36 164 XM_URI_RBL 1019 0.47 1.31 0.16 165 URIBL_BLACK 1011 0.37 1.30 0.03 166 XMSubMetaI_00 1004 1.05 1.29 0.97 167 T_Symld_Words_02 996 0.54 1.28 0.26 168 URI_NO_WWW_BIZ_CGI 989 0.36 1.27 0.01 169 RCVD_IN_IADB_DK 984 2.55 1.26 3.02 170 ALL_TRUSTED 978 12.27 1.26 16.40 171 LongTLD 977 0.43 1.26 0.11 172 RELAYCOUNTRY_GB 974 0.79 1.25 0.61 173 RCVD_IN_IADB_SENDERID 972 2.61 1.25 3.12 174 TR_Mismatch_TLD_01 937 0.56 1.20 0.32 175 XM_Body_Dirty_Words_01 930 0.49 1.20 0.23 176 XM_BadFromFormat 921 0.44 1.18 0.16 177 XMPhish30 914 1.33 1.17 1.39 178 XM_H_Long_From02 908 1.06 1.17 1.02 179 XMSexyCombo_04 888 0.39 1.14 0.11 180 TR_XM_SB_Phish 880 1.49 1.13 1.63 181 T_HTML_TAG_BALANCE_CENTER 869 0.34 1.12 0.06 182 TR_XM_INV_DKIM 868 0.37 1.12 0.09 183 TR_XM_FormFill 860 0.32 1.11 0.02 184 XMSubPhish11 829 1.47 1.07 1.62 185 RCVD_IN_MSPIKE_L3 826 0.35 1.06 0.08 186 XMReplyNow 820 0.33 1.05 0.05 187 URIBL_SBL_A 817 0.57 1.05 0.40 188 HTML_IMAGE_ONLY_20 815 0.69 1.05 0.55 189 DATE_IN_PAST_03_06 805 0.65 1.03 0.51 190 RELAYCOUNTRY_AU 795 0.44 1.02 0.23 191 HDRS_MISSP 790 0.35 1.02 0.11 192 MPART_ALT_DIFF_COUNT 776 0.64 1.00 0.50 193 XMPhish08 767 0.40 0.99 0.17 194 RELAYCOUNTRY_CH 763 0.31 0.98 0.06 195 GOOG_STO_NOIMG_HTML 757 0.26 0.97 0.00 196 HTML_SHORT_LINK_IMG_3 754 0.29 0.97 0.04 197 HK_RANDOM_REPLYTO 746 0.41 0.96 0.20 198 XMHTMLBadTable_001 735 0.81 0.94 0.77 199 URI_TRY_3LD 723 0.83 0.93 0.80 200 RCVD_IN_MSPIKE_H5 720 2.23 0.93 2.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172197 86.01 94.50 82.84 2 RELAYCOUNTRY_US 167721 78.64 73.16 80.69 3 DKIM_SIGNED 157102 77.60 83.01 75.58 4 XM_DK_Pass 154657 75.84 79.68 74.40 5 DKIM_VALID 151842 74.41 78.06 73.05 6 XM_B_Unicode 148175 72.15 74.48 71.28 7 DKIM_VALID_AU 123306 59.69 60.67 59.32 8 BAYES_50 113610 49.68 36.38 54.65 9 XMListUnsubscribeExists 110682 57.33 68.24 53.25 10 DCC_CHECK_NEGATIVE 105402 41.78 17.93 50.71 11 DCC_CHECK 102404 58.18 81.99 49.26 12 XM_B_SpammyWords 97053 51.15 63.08 46.69 13 XM_B_Unicode3 92752 43.92 42.07 44.62 14 RCVD_IN_MSPIKE_WL 70653 30.53 21.28 33.99 15 HTML_FONT_LOW_CONTRAST 62044 31.03 34.18 29.85 16 LOC_TINY_FONT_1 59043 30.25 35.19 28.40 17 DKIM_VALID_EF 58784 29.14 31.46 28.28 18 T_TM2_M_HEADER_IN_MSG 52761 23.27 17.62 25.38 19 FVGT_m_MULTI_ODD 50896 25.05 26.57 24.48 20 RCVD_IN_MSPIKE_H2 47782 23.68 25.55 22.99 21 XMSubLong 47675 23.10 23.55 22.94 22 MIME_HTML_ONLY 44882 24.31 31.59 21.59 23 XM_B_SpammyWords2 41194 24.02 35.24 19.82 24 T_KAM_HTML_FONT_INVALID 37225 20.83 28.62 17.91 25 RCVD_IN_MSPIKE_H3 34694 15.09 10.80 16.69 26 ALL_TRUSTED 34087 12.27 1.26 16.40 27 USER_IN_DEF_DKIM_WL 33733 12.43 2.27 16.23 28 RCVD_IN_MSPIKE_H4 30308 13.21 9.55 14.58 29 XM_Multi_Part_URI 29662 14.37 14.65 14.27 30 XM_Body_Dirty_Words 25735 14.73 21.02 12.38 31 BAYES_60 22974 10.32 8.37 11.05 32 XM_B_Unsub 22380 11.62 13.88 10.77 33 XM_DKIMWhitelistDomains 22262 7.83 0.14 10.71 34 RCVD_IN_RP_SAFE 22004 9.35 6.06 10.59 35 XM_Evil_Numbers_Gen 20373 9.40 8.32 9.80 36 BAYES_00 20025 7.14 0.49 9.63 37 RCVD_IN_RP_CERTIFIED 19963 8.21 4.49 9.60 38 XM_DK_Undo_02 19376 19.90 48.16 9.32 39 FSL_BULK_SIG 19231 11.07 15.92 9.25 40 LotsOfNums_01 18720 8.04 5.44 9.01 41 UNPARSEABLE_RELAY 17926 9.46 11.70 8.62 42 HTML_IMAGE_RATIO_02 17740 9.25 11.16 8.53 43 XMSubMetaSx_00 16041 8.98 12.35 7.72 44 XM_SendGrid 15234 7.48 7.89 7.33 45 TR_XM_UnparsRelay 15138 8.44 11.52 7.28 46 BAYES_99 14915 15.27 36.89 7.18 47 TR_XM_DKIM_Undo 14213 14.68 35.64 6.84 48 T_TooManySym_01 14134 5.85 3.31 6.80 49 TooManyTo_001 13554 6.49 6.40 6.52 50 HTML_IMAGE_RATIO_04 13406 6.10 5.15 6.45 51 TR_XM_DK_Bayes 12738 4.57 0.40 6.13 52 TR_XM_DK_Bayes1 12445 4.46 0.40 5.99 53 LOTS_OF_MONEY 12128 6.88 9.69 5.83 54 BAYES_999 12122 11.94 28.27 5.83 55 XMStrtUSub 11917 5.27 4.03 5.73 56 XM_H_Long_From01 11553 5.55 5.51 5.56 57 TR_XM_DK_Bayes2 11476 4.10 0.29 5.52 58 BOTNET_IPINHOSTNAME 11259 7.85 14.36 5.42 59 IN_ZIMBRA_NJ_WHITELIST 10319 3.63 0.06 4.96 60 BAYES_80 10296 6.20 9.55 4.95 61 XMSexyCombo_05 10224 6.84 11.98 4.92 62 MPART_ALT_DIFF 9796 7.08 13.40 4.71 63 BAYES_40 9637 3.80 1.56 4.64 64 TR_DCC_Bayes_99 9187 11.12 29.03 4.42 65 TR_XM_DK_SendGrid 9100 4.36 4.30 4.38 66 TVD_RCVD_IP 9024 3.28 0.43 4.34 67 XM_UncommonTLD01 8968 8.68 20.36 4.31 68 XM_B_SpammyWords3 8471 6.45 12.81 4.08 69 T_TooManySym_02 8392 3.13 0.71 4.04 70 TM2_M_URI_OPT_OUT 8387 3.85 3.35 4.03 71 MIME_QP_LONG_LINE 8376 3.50 2.10 4.03 72 XM_B_Phish_Phrases 8350 4.52 5.85 4.02 73 TR_XM_PhishingBody 8111 4.10 4.62 3.90 74 RCVD_IN_IADB_LISTED 8011 3.21 1.49 3.85 75 HTML_IMAGE_RATIO_06 7882 3.68 3.39 3.79 76 TR_XM_SpammyWords4 7824 5.05 8.48 3.76 77 RELAYCOUNTRY_META 7704 9.48 24.91 3.71 78 INVALID_MSGID 7493 2.68 0.22 3.60 79 XMNumbers 7456 4.01 5.12 3.59 80 FROM_EXCESS_BASE64 7448 3.38 2.84 3.58 81 RCVD_IN_IADB_SPF 7121 2.86 1.33 3.43 82 XM_H_Trusted_IP 6866 2.40 0.00 3.30 83 XM_SPF_SoftFail 6727 3.24 3.26 3.24 84 BAYES_95 6505 3.74 5.37 3.13 85 RCVD_IN_IADB_SENDERID 6477 2.61 1.25 3.12 86 T_REMOTE_IMAGE 6436 4.08 6.70 3.10 87 MIME_HTML_ONLY_MULTI 6358 3.04 2.98 3.06 88 RCVD_IN_IADB_DK 6287 2.55 1.26 3.02 89 KHOP_HELO_FCRDNS 6188 4.13 7.22 2.98 90 TO_MALFORMED 6063 2.12 0.00 2.92 91 BAYES_20 5897 2.30 0.88 2.84 92 RCVD_IN_MSPIKE_H5 5651 2.23 0.93 2.72 93 MIME_HTML_MOSTLY 5527 4.90 10.87 2.66 94 DKIM_INVALID 5260 3.19 4.96 2.53 95 T_XMDrugObfuBody_14 5258 2.51 2.47 2.53 96 ANY_BOUNCE_MESSAGE 5220 1.95 0.45 2.51 97 BOUNCE_MESSAGE 5219 1.95 0.44 2.51 98 HTML_IMAGE_RATIO_08 4908 2.49 2.82 2.36 99 MAILING_LIST_MULTI 4900 2.07 1.31 2.36 100 RCVD_IN_IADB_VOUCHED 4653 1.81 0.65 2.24 101 XM_shorewaves_Whitelist 4516 1.58 0.00 2.17 102 IN_HORDE_ADDRESS_BOOK 4455 1.63 0.28 2.14 103 XM_PDF 4436 1.65 0.37 2.13 104 URI_NOVOWEL 4395 3.26 6.34 2.11 105 XM_B_SpammyTLD 4355 2.92 5.11 2.10 106 XM_CamelCaseFrm001 4187 2.16 2.54 2.01 107 BAYES_05 4010 1.54 0.52 1.93 108 TR_XM_SpammyWords2 3674 4.87 13.16 1.77 109 XMStockSpam_06 3639 1.66 1.43 1.75 110 TR_XM_SB_Phish 3385 1.49 1.13 1.63 111 XMSubPhish11 3368 1.47 1.07 1.62 112 URI_HEX 3230 1.55 1.52 1.55 113 BOTNET 3226 6.31 19.01 1.55 114 XMBrknScrpt_02 3223 1.58 1.66 1.55 115 HTML_MIME_NO_HTML_TAG 3214 2.73 5.88 1.55 116 UNTRUSTED_Relay 3137 6.36 19.31 1.51 117 TM2_M_VERY_LONG_WORD 3067 1.83 2.79 1.48 118 XM_B_Phish66 3046 1.59 1.93 1.47 119 XMBSHREFv2 3023 1.09 0.12 1.45 120 RCVD_IN_IADB_OPTIN 2989 1.20 0.56 1.44 121 XMGappySubj_01 2978 1.07 0.11 1.43 122 T_TooManySym_03 2976 1.08 0.15 1.43 123 TooManyTo_002 2897 1.18 0.61 1.39 124 XMPhish30 2886 1.33 1.17 1.39 125 T_XMDrugObfuBody_08 2850 1.51 1.89 1.37 126 TR_Symld_Words 2758 1.16 0.72 1.33 127 XM_DK_Undo_01 2718 1.34 1.43 1.31 128 XM_GoogleGroups 2677 1.12 0.66 1.29 129 XM_B_Unsub2 2649 1.29 1.35 1.27 130 HTML_FONT_FACE_BAD 2548 1.06 0.61 1.23 131 RELAYCOUNTRY_CA 2508 2.31 5.25 1.21 132 MSGID_NOFQDN1 2503 0.88 0.02 1.20 133 TR_XM_SpammyWords5 2486 1.62 2.74 1.20 134 XMDiploma_00 2459 1.25 1.44 1.18 135 XMBdyGiftCard01 2304 1.39 2.14 1.11 136 SUBJ_ALL_CAPS 2291 1.20 1.47 1.10 137 XM_OfRef6 2279 1.45 2.39 1.10 138 XMSexyCombo_01 2193 1.75 3.61 1.05 139 XM_H_Long_From02 2122 1.06 1.17 1.02 140 XM_UB50 2038 2.79 7.63 0.98 141 XMSubMetaI_00 2009 1.05 1.29 0.97 142 XMBody_95 2000 0.76 0.23 0.96 143 TooManyTo_003 1995 0.84 0.51 0.96 144 XM_ProductURIs 1994 0.93 0.84 0.96 145 DKIM_ADSP_CUSTOM_MED 1945 0.89 0.75 0.94 146 XMSubNoVowel 1897 0.81 0.54 0.91 147 XM_B_COPY_HTML 1833 0.83 0.68 0.88 148 XMHTML_After_End 1808 0.79 0.57 0.87 149 XM_H_PHPMailer 1755 0.84 0.82 0.84 150 T_MANY_PILL_PRICE 1747 0.61 0.00 0.84 151 XMGenDplmaNmb 1698 0.78 0.69 0.82 152 XMPhish14 1693 0.72 0.48 0.81 153 XM_B_REG_HTML 1686 0.78 0.69 0.81 154 URI_TRY_3LD 1653 0.83 0.93 0.80 155 XM_B_COVIDMETA 1625 0.97 1.47 0.78 156 T_XMDrugObfuBody_00 1598 0.92 1.32 0.77 157 XMHTMLBadTable_001 1592 0.81 0.94 0.77 158 TR_MSPIKEBAYES00 1564 0.56 0.05 0.75 159 TooManyTo_004 1562 0.67 0.47 0.75 160 RCVD_IN_BL_SPAMCOP_NET 1505 2.77 8.22 0.72 161 XMSubMetaSxObfu_02 1442 0.60 0.37 0.69 162 XMLngstWrd_00 1404 0.65 0.59 0.68 163 TR_MetaPhish_Combo_01 1397 0.66 0.62 0.67 164 USER_IN_WHITELIST 1372 0.48 0.00 0.66 165 USER_IN_WELCOMELIST 1372 0.48 0.00 0.66 166 TooManyTo_005 1361 0.60 0.44 0.65 167 T_TooManySym_04 1346 0.49 0.06 0.65 168 RDNS_DYNAMIC 1330 0.68 0.79 0.64 169 XMOemUri 1307 0.54 0.29 0.63 170 XMLngstWrd_01 1291 0.60 0.53 0.62 171 NML_ADSP_CUSTOM_MED 1277 0.62 0.63 0.61 172 RELAYCOUNTRY_GB 1271 0.79 1.25 0.61 173 T_XMHurry_00 1237 1.16 2.65 0.60 174 THIS_AD 1210 0.90 1.74 0.58 175 TVD_SPACE_RATIO 1192 0.44 0.08 0.57 176 XMBody_17 1178 1.16 2.74 0.57 177 XM_B_SpammyWords4 1164 1.27 3.17 0.56 178 HTML_IMAGE_ONLY_20 1150 0.69 1.05 0.55 179 XMLngstWrd_02 1095 0.52 0.49 0.53 180 DATE_IN_PAST_03_06 1061 0.65 1.03 0.51 181 XM_SPF_Unknown 1055 0.54 0.63 0.51 182 FORGED_GMAIL_RCVD 1051 0.52 0.57 0.51 183 MPART_ALT_DIFF_COUNT 1044 0.64 1.00 0.50 184 HELO_NODOT 1038 0.41 0.16 0.50 185 HELO_NO_DOMAIN 1038 0.41 0.16 0.50 186 HTTPS_HTTP_MISMATCH 1028 0.77 1.52 0.49 187 XMSubMetaSSx_00 1024 0.57 0.76 0.49 188 PLING_QUERY 1013 0.54 0.69 0.49 189 T_FILL_THIS_FORM_SHORT 1012 0.84 1.79 0.49 190 XMCapTrack 1004 0.42 0.24 0.48 191 XM_RXBody 986 0.52 0.65 0.47 192 PDS_OTHER_BAD_TLD 985 1.23 3.24 0.47 193 XMBody_78 943 0.46 0.48 0.45 194 XMLngstWrd_03 927 0.45 0.47 0.45 195 DIET_1 912 1.07 2.76 0.44 196 T_OBFU_JPG_ATTACH 907 0.35 0.11 0.44 197 XMNoVowels 897 0.43 0.43 0.43 198 RELAYCOUNTRY_DE 868 0.99 2.53 0.42 199 NUMERIC_HTTP_ADDR 853 0.49 0.69 0.41 200 URIBL_SBL_A 823 0.57 1.05 0.40 ----------------------------------------------------------------------