Email: 294428 Autolearn: 0 AvgScore: 3.40 AvgScanTime: 1.27 sec Spam: 79598 Autolearn: 0 AvgScore: 14.78 AvgScanTime: 1.44 sec Ham: 214830 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 1.20 sec Time Spent Running SA: 103.67 hours Time Spent Processing Spam: 31.84 hours Time Spent Processing Ham: 71.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 74223 82.84 93.25 78.98 2 DKIM_SIGNED 61941 73.42 77.82 71.79 3 DCC_CHECK 61904 51.83 77.77 42.22 4 RELAYCOUNTRY_US 60664 75.72 76.21 75.54 5 XM_DK_Pass 59847 71.85 75.19 70.62 6 DKIM_VALID 58478 70.33 73.47 69.17 7 XM_B_Unicode 57655 68.18 72.43 66.61 8 XM_B_SpammyWords 50822 48.36 63.85 42.62 9 XMListUnsubscribeExists 49720 52.66 62.46 49.03 10 DKIM_VALID_AU 42313 53.90 53.16 54.17 11 XM_B_Unicode3 33170 41.46 41.67 41.38 12 XM_DK_Undo_02 31597 17.14 39.70 8.78 13 BAYES_50 30528 50.27 38.35 54.69 14 MIME_HTML_ONLY 30351 26.29 38.13 21.90 15 XM_B_SpammyWords2 29560 23.92 37.14 19.03 16 HTML_FONT_LOW_CONTRAST 26679 28.72 33.52 26.95 17 BAYES_99 25903 14.09 32.54 7.26 18 TR_XM_DKIM_Undo 25716 13.47 32.31 6.49 19 LOC_TINY_FONT_1 24799 26.58 31.16 24.88 20 DKIM_VALID_EF 20856 26.97 26.20 27.25 21 T_KAM_HTML_FONT_INVALID 20572 18.61 25.84 15.93 22 TR_DCC_Bayes_99 19962 9.28 25.08 3.43 23 BAYES_999 19546 11.04 24.56 6.03 24 FVGT_m_MULTI_ODD 19363 22.83 24.33 22.27 25 DCC_CHECK_NEGATIVE 17671 48.14 22.20 57.75 26 FSL_BULK_SIG 17129 11.93 21.52 8.37 27 XM_Body_Dirty_Words 16700 12.94 20.98 9.96 28 XMSubLong 16518 19.64 20.75 19.22 29 RELAYCOUNTRY_META 16067 12.12 20.19 9.13 30 T_TM2_M_HEADER_IN_MSG 15496 21.98 19.47 22.91 31 XM_Multi_Part_URI 13846 18.66 17.39 19.13 32 RCVD_IN_MSPIKE_H2 13073 14.29 16.42 13.50 33 UNTRUSTED_Relay 12842 9.86 16.13 7.53 34 LOTS_OF_MONEY 12815 10.25 16.10 8.08 35 RCVD_IN_MSPIKE_WL 12017 23.64 15.10 26.80 36 BOTNET 11787 5.00 14.81 1.37 37 TR_XM_SpammyWords4 11256 7.31 14.14 4.77 38 XM_UncommonTLD01 11160 6.75 14.02 4.06 39 BOTNET_IPINHOSTNAME 10845 7.45 13.62 5.16 40 UNPARSEABLE_RELAY 10791 10.00 13.56 8.68 41 TR_XM_UnparsRelay 10457 8.39 13.14 6.63 42 TR_XM_SpammyWords2 9952 4.63 12.50 1.71 43 XM_B_Unsub 9873 11.02 12.40 10.50 44 T_REMOTE_IMAGE 9555 5.60 12.00 3.22 45 HTML_MIME_NO_HTML_TAG 8800 4.29 11.06 1.78 46 XMSexyCombo_05 8643 5.46 10.86 3.46 47 XM_B_SpammyWords3 8432 5.87 10.59 4.12 48 SpammyFromTLD_02 8244 2.91 10.36 0.16 49 XM_SendGrid 8105 8.28 10.18 7.58 50 TR_XM_SpammyRelay 8065 3.60 10.13 1.18 51 T_HTML_TAG_BALANCE_CENTER 8030 2.84 10.09 0.15 52 HTML_IMAGE_ONLY_08 7942 2.75 9.98 0.07 53 KHOP_HELO_FCRDNS 7475 3.35 9.39 1.11 54 BODY_URI_ONLY 7239 2.46 9.09 0.01 55 BAYES_80 6827 5.86 8.58 4.85 56 HTML_IMAGE_RATIO_02 6775 6.94 8.51 6.36 57 RCVD_IN_BL_SPAMCOP_NET 6720 3.17 8.44 1.22 58 MIXED_FONT_CASE 6587 2.24 8.28 0.00 59 MIXED_CENTER_CASE 6580 2.24 8.27 0.00 60 MIXED_HREF_CASE 6580 2.24 8.27 0.00 61 MIXED_AREA_CASE 6577 2.23 8.26 0.00 62 MIXED_IMG_CASE 6577 2.24 8.26 0.00 63 RCVD_IN_MSPIKE_H3 6107 10.14 7.67 11.06 64 BAYES_60 5954 9.44 7.48 10.16 65 MIXED_CTYPE_CASE 5943 2.02 7.47 0.01 66 XM_UB50 5892 7.13 7.40 7.03 67 XM_Evil_Numbers_Gen 5848 8.83 7.35 9.38 68 RCVD_IN_MSPIKE_H4 5666 12.84 7.12 14.96 69 HTML_FONT_SIZE_LARGE 5546 1.95 6.97 0.09 70 GOOG_STO_IMG_HTML 5189 1.76 6.52 0.00 71 TM2_M_URI_OPT_OUT 5163 8.79 6.49 9.65 72 MPART_ALT_DIFF 4762 4.87 5.98 4.46 73 TR_XM_DK_SendGrid 4755 5.11 5.97 4.79 74 XMSubMetaSx_00 4749 3.99 5.97 3.26 75 RELAYCOUNTRY_CA 4520 2.13 5.68 0.82 76 TooManyTo_001 4487 6.10 5.64 6.27 77 XM_B_Phish_Phrases 4382 4.02 5.51 3.47 78 RCVD_IN_RP_SAFE 4260 7.95 5.35 8.91 79 LotsOfNums_01 4191 7.89 5.27 8.86 80 T_XMDrugObfuBody_00 4070 6.42 5.11 6.90 81 TR_XM_PhishingBody 4054 3.13 5.09 2.40 82 BAYES_95 4003 3.47 5.03 2.90 83 XM_OfRef6 3948 1.86 4.96 0.71 84 XM_H_Long_From01 3850 4.85 4.84 4.85 85 XMNumbers 3699 4.15 4.65 3.97 86 RCVD_IN_RP_CERTIFIED 3494 6.92 4.39 7.86 87 TR_XM_SPAMCOP 3482 1.49 4.37 0.43 88 DKIM_INVALID 3463 3.09 4.35 2.63 89 HTML_IMAGE_RATIO_04 3352 5.62 4.21 6.14 90 T_XMDrugObfuBody_08 3244 1.99 4.08 1.22 91 MIME_HTML_MOSTLY 3093 2.52 3.89 2.01 92 XM_B_SpammyTLD 2979 2.41 3.74 1.92 93 BOTNET_NORDNS 2851 0.97 3.58 0.01 94 RELAYCOUNTRY_FR 2787 5.61 3.50 6.39 95 URI_GOOG_STO_SPAMMY 2710 0.92 3.40 0.00 96 MIME_HTML_ONLY_MULTI 2595 3.03 3.26 2.94 97 XM_B_Investor 2514 1.62 3.16 1.04 98 BOUNCE_MESSAGE 2485 7.45 3.12 9.05 99 ANY_BOUNCE_MESSAGE 2485 7.45 3.12 9.05 100 XM_SPF_SoftFail 2475 1.83 3.11 1.36 101 TR_XM_SpammyWords5 2438 2.10 3.06 1.74 102 HTML_IMAGE_RATIO_06 2355 3.05 2.96 3.08 103 T_XMDrugObfuBody_14 2277 2.58 2.86 2.47 104 XMBounce_01 2165 5.31 2.72 6.26 105 URIBL_DBL_SPAM 2162 0.74 2.72 0.01 106 XMStrtUSub 2138 3.95 2.69 4.42 107 T_Symld_Words_02 2095 0.90 2.63 0.26 108 HTML_FONT_SIZE_HUGE 2067 0.74 2.60 0.05 109 BAYES_00 2066 8.92 2.60 11.27 110 XM_S_SpammyWords 2023 1.06 2.54 0.52 111 TR_XM_Spammywords 2023 1.06 2.54 0.51 112 XM_CamelCaseFrm001 2009 2.01 2.52 1.83 113 XM_B_Phish66 1998 1.57 2.51 1.22 114 T_TooManySym_01 1983 5.10 2.49 6.07 115 XM_UB99 1956 0.67 2.46 0.00 116 LOADSA_MONEY_COMBO 1863 0.70 2.34 0.09 117 XM_DIRTYINTL 1841 0.78 2.31 0.22 118 TM2_M_VERY_LONG_WORD 1777 1.53 2.23 1.27 119 RCVD_IN_MSPIKE_BL 1757 0.65 2.21 0.07 120 DIET_1 1752 0.87 2.20 0.38 121 SUBJ_ALL_CAPS 1751 1.61 2.20 1.39 122 TR_XM_MSPIKECOMBO 1739 0.64 2.18 0.07 123 BAYES_40 1706 3.64 2.14 4.19 124 XMNoVowels 1689 1.73 2.12 1.59 125 RCVD_IN_MSPIKE_L3 1672 0.61 2.10 0.06 126 FILL_THIS_FORM 1670 0.73 2.10 0.22 127 NO_DNS_FOR_FROM 1663 0.81 2.09 0.34 128 SpammyFromTLD_01 1657 0.85 2.08 0.39 129 DKIM_ADSP_NXDOMAIN 1655 0.85 2.08 0.40 130 XM_Body_Dirty_Words_01 1654 0.83 2.08 0.37 131 XMBrknScrpt_02 1651 1.19 2.07 0.86 132 PDS_OTHER_BAD_TLD 1644 0.88 2.07 0.44 133 TR_XM_MaxWHORU 1639 0.72 2.06 0.22 134 T_FILL_THIS_FORM_SHORT 1637 1.07 2.06 0.70 135 MONEY_FORM 1625 0.55 2.04 0.00 136 BAYES_20 1614 2.59 2.03 2.80 137 FILL_THIS_FORM_LONG 1598 0.60 2.01 0.08 138 URI_NOVOWEL 1573 2.74 1.98 3.03 139 TR_Symld_Words 1564 1.67 1.96 1.56 140 TR_XM_PHPDW 1554 0.76 1.95 0.32 141 ADVANCE_FEE_5_NEW_FRM_MNY 1549 0.53 1.95 0.00 142 XFER_LOTSA_MONEY 1549 0.53 1.95 0.01 143 XMBody_17 1529 0.75 1.92 0.32 144 HTML_IMAGE_RATIO_08 1511 1.81 1.90 1.78 145 TR_XM_PHPForged 1492 0.70 1.87 0.27 146 TR_XM_SpammyWords3 1462 0.52 1.84 0.03 147 TR_XM_FormFill2 1451 0.69 1.82 0.27 148 XM_H_PHPOS 1442 0.68 1.81 0.25 149 XM_B_Unsub2 1427 1.25 1.79 1.06 150 XMDiploma_00 1416 1.58 1.78 1.51 151 XMSexyCombo_01 1413 0.79 1.78 0.43 152 XMSlimDrugH 1404 0.69 1.76 0.29 153 TR_XM_SB_Phish 1383 1.90 1.74 1.96 154 MONEY_FRAUD_5 1367 0.46 1.72 0.00 155 XMSubPhish11 1345 1.88 1.69 1.95 156 MIME_QP_LONG_LINE 1325 3.72 1.66 4.48 157 MONEY_ATM_CARD 1322 0.45 1.66 0.00 158 XM_JunkDunk 1317 0.45 1.65 0.00 159 FROM_EXCESS_BASE64 1315 3.03 1.65 3.53 160 RCVD_IN_IADB_LISTED 1309 3.92 1.64 4.76 161 XM_H_FedEx_Spoof 1298 0.45 1.63 0.02 162 DEAR_WINNER 1291 0.44 1.62 0.00 163 XM_DK_Undo_01 1289 1.54 1.62 1.51 164 RELAYCOUNTRY_NL 1277 0.57 1.60 0.19 165 XMBdyGiftCard01 1274 1.13 1.60 0.96 166 XM_UB60 1248 0.45 1.57 0.04 167 USER_IN_DEF_DKIM_WL 1233 11.68 1.55 15.43 168 URI_HEX 1223 1.44 1.54 1.40 169 XM_B_SpammyWords4 1220 0.76 1.53 0.47 170 XM_B_COVIDMETA 1204 1.07 1.51 0.91 171 XM_UB999 1193 0.41 1.50 0.00 172 XMStockSpam_06 1177 0.99 1.48 0.81 173 ALL_TRUSTED 1159 11.94 1.46 15.83 174 RELAYCOUNTRY_DE 1140 0.63 1.43 0.33 175 XM_URI_RBL 1135 0.46 1.43 0.10 176 T_FILL_THIS_FORM_FRAUD_PHISH 1121 0.41 1.41 0.03 177 RCVD_IN_IADB_SPF 1115 3.34 1.40 4.06 178 TR_XM_NoHeaderRelay 1105 0.48 1.39 0.14 179 T_XMHurry_00 1076 0.73 1.35 0.50 180 XM_UB80 1066 0.37 1.34 0.01 181 MAILING_LIST_MULTI 1052 1.94 1.32 2.16 182 RCVD_IN_IADB_DK 1048 2.87 1.32 3.44 183 FROM_SUSPICIOUS_NTLD 1034 0.41 1.30 0.08 184 XM_ProductURIs 1013 0.84 1.27 0.68 185 XMWghtMeta_00 1007 0.38 1.27 0.05 186 RCVD_IN_IADB_SENDERID 1006 2.96 1.26 3.59 187 TR_XM_FormFill 1001 0.35 1.26 0.01 188 TR_XM_INV_DKIM 997 0.50 1.25 0.23 189 XMPhish30 994 0.75 1.25 0.57 190 BAYES_05 976 1.71 1.23 1.88 191 XMHTMLBadTable_001 965 0.65 1.21 0.44 192 URIBL_BLACK 963 0.34 1.21 0.01 193 URI_TRY_3LD 961 1.10 1.21 1.06 194 TR_LOTS_OF_MONEY3 934 0.47 1.17 0.21 195 TR_XM_BayesRelay 921 0.32 1.16 0.00 196 XMSubMetaI_00 917 0.90 1.15 0.80 197 FROM_SUSPICIOUS_NTLD_FP 903 0.36 1.13 0.07 198 SUBJ_DOLLARS 895 0.56 1.12 0.36 199 XMSubNoVowel 894 1.15 1.12 1.16 200 XM_H_Undi_Recip 870 0.41 1.09 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 169683 82.84 93.25 78.98 2 RELAYCOUNTRY_US 162277 75.72 76.21 75.54 3 DKIM_SIGNED 154233 73.42 77.82 71.79 4 XM_DK_Pass 151711 71.85 75.19 70.62 5 DKIM_VALID 148592 70.33 73.47 69.17 6 XM_B_Unicode 143090 68.18 72.43 66.61 7 DCC_CHECK_NEGATIVE 124065 48.14 22.20 57.75 8 BAYES_50 117484 50.27 38.35 54.69 9 DKIM_VALID_AU 116384 53.90 53.16 54.17 10 XMListUnsubscribeExists 105339 52.66 62.46 49.03 11 XM_B_SpammyWords 91559 48.36 63.85 42.62 12 DCC_CHECK 90692 51.83 77.77 42.22 13 XM_B_Unicode3 88889 41.46 41.67 41.38 14 DKIM_VALID_EF 58550 26.97 26.20 27.25 15 HTML_FONT_LOW_CONTRAST 57888 28.72 33.52 26.95 16 RCVD_IN_MSPIKE_WL 57577 23.64 15.10 26.80 17 LOC_TINY_FONT_1 53459 26.58 31.16 24.88 18 T_TM2_M_HEADER_IN_MSG 49210 21.98 19.47 22.91 19 FVGT_m_MULTI_ODD 47853 22.83 24.33 22.27 20 MIME_HTML_ONLY 47050 26.29 38.13 21.90 21 XMSubLong 41300 19.64 20.75 19.22 22 XM_Multi_Part_URI 41088 18.66 17.39 19.13 23 XM_B_SpammyWords2 40878 23.92 37.14 19.03 24 T_KAM_HTML_FONT_INVALID 34228 18.61 25.84 15.93 25 ALL_TRUSTED 34000 11.94 1.46 15.83 26 USER_IN_DEF_DKIM_WL 33154 11.68 1.55 15.43 27 RCVD_IN_MSPIKE_H4 32148 12.84 7.12 14.96 28 RCVD_IN_MSPIKE_H2 28994 14.29 16.42 13.50 29 BAYES_00 24202 8.92 2.60 11.27 30 RCVD_IN_MSPIKE_H3 23753 10.14 7.67 11.06 31 XM_B_Unsub 22559 11.02 12.40 10.50 32 BAYES_60 21827 9.44 7.48 10.16 33 XM_Body_Dirty_Words 21403 12.94 20.98 9.96 34 XM_DKIMWhitelistDomains 21347 7.26 0.03 9.94 35 TM2_M_URI_OPT_OUT 20727 8.79 6.49 9.65 36 XM_Evil_Numbers_Gen 20153 8.83 7.35 9.38 37 RELAYCOUNTRY_META 19621 12.12 20.19 9.13 38 ANY_BOUNCE_MESSAGE 19448 7.45 3.12 9.05 39 BOUNCE_MESSAGE 19442 7.45 3.12 9.05 40 RCVD_IN_RP_SAFE 19145 7.95 5.35 8.91 41 LotsOfNums_01 19036 7.89 5.27 8.86 42 XM_DK_Undo_02 18860 17.14 39.70 8.78 43 UNPARSEABLE_RELAY 18650 10.00 13.56 8.68 44 FSL_BULK_SIG 17988 11.93 21.52 8.37 45 LOTS_OF_MONEY 17353 10.25 16.10 8.08 46 RCVD_IN_RP_CERTIFIED 16892 6.92 4.39 7.86 47 TR_XM_DK_Bayes 16722 5.91 0.84 7.78 48 XM_SendGrid 16285 8.28 10.18 7.58 49 TR_XM_DK_Bayes1 16222 5.73 0.82 7.55 50 UNTRUSTED_Relay 16180 9.86 16.13 7.53 51 BAYES_99 15593 14.09 32.54 7.26 52 XM_UB50 15108 7.13 7.40 7.03 53 T_XMDrugObfuBody_00 14826 6.42 5.11 6.90 54 TR_XM_DK_Bayes2 14479 5.09 0.63 6.74 55 TR_XM_UnparsRelay 14243 8.39 13.14 6.63 56 TR_XM_DKIM_Undo 13935 13.47 32.31 6.49 57 RELAYCOUNTRY_FR 13724 5.61 3.50 6.39 58 HTML_IMAGE_RATIO_02 13666 6.94 8.51 6.36 59 TooManyTo_001 13465 6.10 5.64 6.27 60 XMBounce_01 13458 5.31 2.72 6.26 61 HTML_IMAGE_RATIO_04 13196 5.62 4.21 6.14 62 T_TooManySym_01 13046 5.10 2.49 6.07 63 BAYES_999 12950 11.04 24.56 6.03 64 BOTNET_IPINHOSTNAME 11081 7.45 13.62 5.16 65 XM_H_Long_From01 10424 4.85 4.84 4.85 66 BAYES_80 10414 5.86 8.58 4.85 67 TR_XM_DK_SendGrid 10289 5.11 5.97 4.79 68 TR_XM_SpammyWords4 10255 7.31 14.14 4.77 69 RCVD_IN_IADB_LISTED 10232 3.92 1.64 4.76 70 MIME_QP_LONG_LINE 9628 3.72 1.66 4.48 71 MPART_ALT_DIFF 9577 4.87 5.98 4.46 72 XMStrtUSub 9493 3.95 2.69 4.42 73 BAYES_40 9007 3.64 2.14 4.19 74 XM_B_SpammyWords3 8843 5.87 10.59 4.12 75 RCVD_IN_IADB_SPF 8726 3.34 1.40 4.06 76 XM_UncommonTLD01 8723 6.75 14.02 4.06 77 XMNumbers 8521 4.15 4.65 3.97 78 T_TooManySym_02 7734 2.76 0.48 3.60 79 RCVD_IN_IADB_SENDERID 7712 2.96 1.26 3.59 80 FROM_EXCESS_BASE64 7593 3.03 1.65 3.53 81 INVALID_MSGID 7572 2.62 0.16 3.52 82 XM_B_Phish_Phrases 7458 4.02 5.51 3.47 83 XMSexyCombo_05 7423 5.46 10.86 3.46 84 RCVD_IN_IADB_DK 7396 2.87 1.32 3.44 85 TR_DCC_Bayes_99 7363 9.28 25.08 3.43 86 MSGID_NOFQDN1 7168 2.45 0.05 3.34 87 XMSubMetaSx_00 7006 3.99 5.97 3.26 88 RCVD_IN_IADB_VOUCHED 6941 2.59 0.87 3.23 89 T_REMOTE_IMAGE 6921 5.60 12.00 3.22 90 HTML_IMAGE_RATIO_06 6614 3.05 2.96 3.08 91 URI_NOVOWEL 6504 2.74 1.98 3.03 92 MIME_HTML_ONLY_MULTI 6313 3.03 3.26 2.94 93 BAYES_95 6224 3.47 5.03 2.90 94 XM_H_Trusted_IP 6146 2.09 0.00 2.86 95 TO_MALFORMED 6043 2.06 0.02 2.81 96 BAYES_20 6021 2.59 2.03 2.80 97 XM_PDF 5750 2.06 0.41 2.68 98 DKIM_INVALID 5641 3.09 4.35 2.63 99 TVD_RCVD_IP 5466 1.90 0.16 2.54 100 T_XMDrugObfuBody_14 5312 2.58 2.86 2.47 101 IN_HORDE_ADDRESS_BOOK 5288 1.81 0.06 2.46 102 TR_XM_PhishingBody 5151 3.13 5.09 2.40 103 MAILING_LIST_MULTI 4649 1.94 1.32 2.16 104 RCVD_IN_IADB_OPTIN 4420 1.69 0.69 2.06 105 MIME_HTML_MOSTLY 4325 2.52 3.89 2.01 106 TR_XM_SB_Phish 4213 1.90 1.74 1.96 107 XMSubPhish11 4187 1.88 1.69 1.95 108 XM_B_SpammyTLD 4123 2.41 3.74 1.92 109 BAYES_05 4046 1.71 1.23 1.88 110 XM_CamelCaseFrm001 3923 2.01 2.52 1.83 111 HTML_IMAGE_RATIO_08 3832 1.81 1.90 1.78 112 HTML_MIME_NO_HTML_TAG 3826 4.29 11.06 1.78 113 TR_XM_SpammyWords5 3737 2.10 3.06 1.74 114 TR_XM_SpammyWords2 3677 4.63 12.50 1.71 115 XMBSHREFv2 3668 1.30 0.19 1.71 116 HELO_MISC_IP 3628 1.25 0.06 1.69 117 XMNoVowels 3412 1.73 2.12 1.59 118 TR_Symld_Words 3345 1.67 1.96 1.56 119 XM_DK_Undo_01 3247 1.54 1.62 1.51 120 XMDiploma_00 3240 1.58 1.78 1.51 121 XM_H_Long_From02 3149 1.36 1.06 1.47 122 URI_HEX 3012 1.44 1.54 1.40 123 XMGappySubj_01 2999 1.04 0.07 1.40 124 SUBJ_ALL_CAPS 2991 1.61 2.20 1.39 125 BOTNET 2938 5.00 14.81 1.37 126 XM_SPF_SoftFail 2923 1.83 3.11 1.36 127 TooManyTo_002 2847 1.17 0.77 1.33 128 XM_GoogleGroups 2736 1.08 0.55 1.27 129 TM2_M_VERY_LONG_WORD 2724 1.53 2.23 1.27 130 RCVD_IN_BL_SPAMCOP_NET 2628 3.17 8.44 1.22 131 T_XMDrugObfuBody_08 2628 1.99 4.08 1.22 132 XM_B_Phish66 2611 1.57 2.51 1.22 133 TR_XM_SpammyRelay 2537 3.60 10.13 1.18 134 XMSubNoVowel 2493 1.15 1.12 1.16 135 KHOP_HELO_FCRDNS 2388 3.35 9.39 1.11 136 HTML_IMAGE_ONLY_20 2362 0.92 0.45 1.10 137 URI_TRY_3LD 2271 1.10 1.21 1.06 138 XM_B_Unsub2 2268 1.25 1.79 1.06 139 XM_B_Investor 2243 1.62 3.16 1.04 140 T_TooManySym_03 2215 0.81 0.21 1.03 141 XMBody_95 2193 0.78 0.13 1.02 142 XMBdyGiftCard01 2058 1.13 1.60 0.96 143 HTML_TAG_BALANCE_BODY 2047 0.93 0.88 0.95 144 XM_B_COVIDMETA 1960 1.07 1.51 0.91 145 TooManyTo_003 1947 0.82 0.60 0.91 146 TR_MetaPhish_Combo_01 1917 0.85 0.74 0.89 147 HTML_FONT_FACE_BAD 1915 0.85 0.74 0.89 148 XM_D_tchamptons_WL 1862 0.63 0.00 0.87 149 XMBrknScrpt_02 1851 1.19 2.07 0.86 150 DKIM_ADSP_CUSTOM_MED 1850 0.90 1.01 0.86 151 RELAYCOUNTRY_CA 1759 2.13 5.68 0.82 152 XMStockSpam_06 1741 0.99 1.48 0.81 153 XMSubMetaI_00 1727 0.90 1.15 0.80 154 XM_B_REG_HTML 1709 0.84 0.95 0.80 155 RCVD_IN_MSPIKE_H5 1676 0.65 0.31 0.78 156 XMLngstWrd_00 1654 0.63 0.26 0.77 157 XMGenDplmaNmb 1568 0.81 1.01 0.73 158 XM_OfRef6 1528 1.86 4.96 0.71 159 USER_IN_WELCOMELIST 1515 0.51 0.00 0.71 160 USER_IN_WHITELIST 1515 0.51 0.00 0.71 161 T_FILL_THIS_FORM_SHORT 1501 1.07 2.06 0.70 162 XM_ProductURIs 1471 0.84 1.27 0.68 163 TR_MSPIKEBAYES00 1454 0.50 0.01 0.68 164 IN_ZIMBRA_NJ_WHITELIST 1433 0.49 0.01 0.67 165 XMLngstWrd_01 1426 0.55 0.23 0.66 166 TooManyTo_004 1388 0.62 0.54 0.65 167 XM_B_COPY_HTML 1387 0.70 0.84 0.65 168 RDNS_DYNAMIC 1321 0.64 0.73 0.61 169 MPART_ALT_DIFF_COUNT 1309 0.65 0.75 0.61 170 XMHTML_After_End 1254 0.60 0.66 0.58 171 XMPhish30 1228 0.75 1.25 0.57 172 XMLngstWrd_02 1216 0.46 0.18 0.57 173 TVD_SPACE_RATIO 1215 0.44 0.11 0.57 174 XM_H_PHPMailer 1194 0.58 0.66 0.56 175 TooManyTo_005 1186 0.53 0.45 0.55 176 DATE_IN_PAST_03_06 1164 0.57 0.66 0.54 177 NML_ADSP_CUSTOM_MED 1130 0.62 0.89 0.53 178 RELAYCOUNTRY_GB 1129 0.59 0.75 0.53 179 XM_S_SpammyWords 1108 1.06 2.54 0.52 180 TR_XM_Spammywords 1105 1.06 2.54 0.51 181 HELO_NO_DOMAIN 1097 0.50 0.47 0.51 182 HELO_NODOT 1097 0.50 0.47 0.51 183 T_XMHurry_00 1080 0.73 1.35 0.50 184 FORGED_GMAIL_RCVD 1069 0.56 0.73 0.50 185 XM_B_SpammyWords4 1004 0.76 1.53 0.47 186 T_TooManySym_04 994 0.37 0.11 0.46 187 XMLngstWrd_03 992 0.38 0.15 0.46 188 HTTPS_HTTP_MISMATCH 970 0.60 1.01 0.45 189 XMSubMetaSxObfu_02 965 0.42 0.32 0.45 190 PDS_OTHER_BAD_TLD 955 0.88 2.07 0.44 191 XMHTMLBadTable_001 938 0.65 1.21 0.44 192 TR_XM_SPAMCOP 919 1.49 4.37 0.43 193 XM_B_DNDMA 918 0.45 0.53 0.43 194 XMSexyCombo_01 914 0.79 1.78 0.43 195 XMSubMetaSxObfu_03 883 0.43 0.50 0.41 196 RCVD_IN_PSBL 881 0.50 0.73 0.41 197 XMCapTrack 872 0.39 0.34 0.41 198 PLING_QUERY 869 0.49 0.73 0.40 199 DKIM_ADSP_NXDOMAIN 856 0.85 2.08 0.40 200 SpammyFromTLD_01 842 0.85 2.08 0.39 ----------------------------------------------------------------------