Email: 522716 Autolearn: 0 AvgScore: 2.07 AvgScanTime: 1.21 sec Spam: 141059 Autolearn: 0 AvgScore: 13.64 AvgScanTime: 1.32 sec Ham: 381657 Autolearn: 0 AvgScore: -2.21 AvgScanTime: 1.16 sec Time Spent Running SA: 175.40 hours Time Spent Processing Spam: 51.91 hours Time Spent Processing Ham: 123.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134513 88.82 95.36 86.40 2 DKIM_SIGNED 116876 73.59 82.86 70.16 3 RELAYCOUNTRY_US 112779 80.28 79.95 80.40 4 XM_DK_Pass 112324 71.78 79.63 68.87 5 DKIM_VALID 112143 71.07 79.50 67.95 6 XM_B_Unicode 108405 70.16 76.85 67.69 7 DCC_CHECK 94897 40.18 67.27 30.16 8 XMListUnsubscribeExists 92854 51.28 65.83 45.91 9 XM_B_SpammyWords 90142 48.19 63.90 42.38 10 DKIM_VALID_AU 85032 54.03 60.28 51.72 11 XM_B_Unicode3 62769 41.01 44.50 39.72 12 BAYES_50 61028 51.83 43.26 54.99 13 XM_DK_Undo_02 56185 15.67 39.83 6.74 14 LOC_TINY_FONT_1 51045 24.81 36.19 20.60 15 MIME_HTML_ONLY 50602 26.34 35.87 22.82 16 XM_B_SpammyWords2 50454 22.80 35.77 18.01 17 BAYES_99 46654 13.01 33.07 5.59 18 FVGT_m_MULTI_ODD 46385 25.12 32.88 22.25 19 DCC_CHECK_NEGATIVE 46106 59.77 32.69 69.78 20 HTML_FONT_LOW_CONTRAST 45337 26.28 32.14 24.11 21 TR_XM_DKIM_Undo 42651 11.37 30.24 4.39 22 T_KAM_HTML_FONT_INVALID 39805 21.60 28.22 19.15 23 DKIM_VALID_EF 39150 26.41 27.75 25.91 24 RCVD_IN_MSPIKE_H2 36751 21.58 26.05 19.92 25 BAYES_999 36428 10.24 25.82 4.49 26 T_TM2_M_HEADER_IN_MSG 32585 27.69 23.10 29.38 27 XM_Body_Dirty_Words 32024 13.82 22.70 10.54 28 RELAYCOUNTRY_META 31890 8.81 22.61 3.71 29 TR_DCC_Bayes_99 31886 7.46 22.60 1.86 30 XMSubLong 31725 20.83 22.49 20.21 31 RCVD_IN_MSPIKE_WL 28133 26.08 19.94 28.35 32 XM_Multi_Part_URI 23361 12.93 16.56 11.59 33 XM_B_Unsub 20593 12.23 14.60 11.35 34 FSL_BULK_SIG 20574 6.46 14.59 3.45 35 BOTNET 20210 4.96 14.33 1.50 36 LOTS_OF_MONEY 20104 8.87 14.25 6.89 37 UNPARSEABLE_RELAY 18969 9.46 13.45 7.99 38 RCVD_IN_MSPIKE_H3 18850 15.52 13.36 16.32 39 UNTRUSTED_Relay 18826 4.47 13.35 1.19 40 TR_XM_UnparsRelay 18437 8.03 13.07 6.16 41 XM_B_SpammyWords3 17363 6.75 12.31 4.69 42 BOTNET_IPINHOSTNAME 17217 6.48 12.21 4.37 43 TR_XM_SpammyWords4 16866 6.14 11.96 3.99 44 TR_XM_SpammyRelay 16433 4.28 11.65 1.55 45 TR_XM_SpammyWords2 15106 3.56 10.71 0.92 46 XMSexyCombo_05 14981 5.15 10.62 3.12 47 MPART_ALT_DIFF 14166 8.84 10.04 8.39 48 XM_UncommonTLD01 13492 5.44 9.56 3.91 49 XM_SendGrid 12602 6.79 8.93 6.00 50 RCVD_IN_BL_SPAMCOP_NET 12564 2.82 8.91 0.57 51 XM_Evil_Numbers_Gen 12113 8.14 8.59 7.97 52 HTML_MIME_NO_HTML_TAG 11265 4.66 7.99 3.43 53 BAYES_80 10927 5.09 7.75 4.11 54 TM2_M_VERY_LONG_WORD 10369 3.50 7.35 2.08 55 MIME_HTML_ONLY_MULTI 10189 6.78 7.22 6.62 56 BAYES_60 9863 8.60 6.99 9.19 57 TR_XM_MaxUnsub 9637 2.43 6.83 0.80 58 HTML_IMAGE_RATIO_02 9569 5.87 6.78 5.53 59 LotsOfNums_01 9414 8.51 6.67 9.19 60 RCVD_IN_MSPIKE_BL 9378 2.91 6.65 1.53 61 XM_SPF_SoftFail 9249 3.74 6.56 2.70 62 TR_XM_MSPIKECOMBO 9237 2.88 6.55 1.53 63 XM_UB50 8753 2.22 6.21 0.75 64 TR_XM_PhishingBody 8738 3.93 6.19 3.10 65 HTML_IMAGE_RATIO_04 8732 5.85 6.19 5.72 66 RCVD_IN_MSPIKE_H4 8709 9.23 6.17 10.36 67 XMSubMetaSx_00 8447 4.12 5.99 3.43 68 XM_B_Investor 8318 3.06 5.90 2.01 69 XM_H_Long_From01 8027 5.33 5.69 5.20 70 T_REMOTE_IMAGE 8019 4.36 5.68 3.86 71 XM_B_Phish_Phrases 7913 3.95 5.61 3.33 72 TR_XM_DK_SendGrid 7858 4.41 5.57 3.99 73 XM_GoogleGroups 7203 2.83 5.11 1.99 74 TooManyTo_001 7017 6.94 4.97 7.67 75 XMLngstWrd_00 6734 2.34 4.77 1.44 76 XMLngstWrd_01 6627 2.27 4.70 1.38 77 XMLngstWrd_02 6528 2.20 4.63 1.30 78 RELAYCOUNTRY_CA 6448 1.85 4.57 0.84 79 HTML_TITLE_SUBJ_DIFF 6303 1.91 4.47 0.97 80 XMStrtUSub 6164 4.88 4.37 5.06 81 XMLngstWrd_03 6112 2.05 4.33 1.21 82 XMLngstWrd_04 6009 1.97 4.26 1.13 83 BOTNET_NORDNS 5958 1.16 4.22 0.02 84 BAYES_95 5951 3.07 4.22 2.65 85 UPPERCASE_75_100 5912 1.80 4.19 0.92 86 XMNumbers 5903 3.90 4.18 3.79 87 TR_XM_SPAMCOP 5891 1.25 4.18 0.17 88 TR_XM_SpammyWords5 5734 2.34 4.06 1.71 89 MIME_QP_LONG_LINE 5625 5.49 3.99 6.04 90 XM_B_SpammyTLD 5520 2.62 3.91 2.14 91 HTML_IMAGE_RATIO_06 5326 3.38 3.78 3.23 92 RCVD_IN_PSBL 5277 1.06 3.74 0.06 93 XMDiploma_00 5098 1.92 3.61 1.29 94 KHOP_HELO_FCRDNS 5049 2.46 3.58 2.05 95 RCVD_IN_VALIDITY_RPBL 4806 0.93 3.41 0.01 96 T_XMDrugObfuBody_14 4771 2.44 3.38 2.09 97 HTML_IMAGE_RATIO_08 4753 2.42 3.37 2.07 98 XM_DIRTYINTL 4737 1.15 3.36 0.33 99 DKIM_INVALID 4733 2.52 3.36 2.21 100 MIME_HTML_MOSTLY 4691 2.63 3.33 2.37 101 XM_B_Phish66 4611 2.25 3.27 1.87 102 TR_XM_SpammyWords3 4606 1.35 3.27 0.65 103 RCVD_IN_IADB_LISTED 4572 5.56 3.24 6.42 104 SpammyFromTLD_02 4537 1.23 3.22 0.50 105 SpammyFromTLD_01 4448 1.32 3.15 0.64 106 RCVD_IN_MSPIKE_L5 4417 0.94 3.13 0.13 107 RCVD_IN_VALIDITY_SAFE 4306 3.98 3.05 4.32 108 TM2_M_URI_OPT_OUT 4153 4.67 2.94 5.31 109 XM_CamelCaseFrm001 4047 2.09 2.87 1.80 110 XM_OfRef6 4017 1.63 2.85 1.18 111 RCVD_IN_IADB_SPF 3785 4.85 2.68 5.64 112 URI_NOVOWEL 3771 2.89 2.67 2.98 113 T_XMDrugObfuBody_08 3751 1.96 2.66 1.71 114 SUBJ_ALL_CAPS 3690 1.89 2.62 1.62 115 TR_Mismatch_TLD_01 3603 0.83 2.55 0.19 116 RCVD_IN_VALIDITY_CERTIFIED 3592 3.48 2.55 3.82 117 RCVD_IN_IADB_DK 3518 4.23 2.49 4.87 118 RCVD_IN_IADB_SENDERID 3418 4.34 2.42 5.05 119 PDS_OTHER_BAD_TLD 3396 0.85 2.41 0.28 120 XM_B_SpammyWords4 3372 1.03 2.39 0.52 121 T_TooManySym_01 3315 4.54 2.35 5.35 122 TR_XM_SB_Phish 3285 3.21 2.33 3.54 123 XM_DK_Undo_01 3282 1.68 2.33 1.44 124 RCVD_IN_MSPIKE_L3 3259 1.07 2.31 0.62 125 XM_B_Unsub2 3240 1.76 2.30 1.56 126 TR_XM_MSPIKECOMBO2 3232 0.79 2.29 0.24 127 XMSubPhish11 3231 3.18 2.29 3.51 128 MAILING_LIST_MULTI 3179 2.50 2.25 2.60 129 RELAYCOUNTRY_DE 3125 0.79 2.22 0.27 130 T_XMDrugObfuBody_00 3122 1.20 2.21 0.82 131 XM_UB99 2928 0.56 2.08 0.00 132 TR_XM_NoHeaderRelay 2917 0.69 2.07 0.18 133 USER_IN_DEF_DKIM_WL 2775 8.39 1.97 10.77 134 XM_Body_Dirty_Words_01 2763 0.66 1.96 0.18 135 T_HTML_TAG_BALANCE_CENTER 2723 0.59 1.93 0.10 136 RCVD_IN_IADB_VOUCHED 2659 3.49 1.89 4.08 137 DKIM_ADSP_CUSTOM_MED 2638 1.16 1.87 0.90 138 BAYES_40 2589 4.19 1.84 5.07 139 XM_B_COVIDMETA 2568 0.97 1.82 0.66 140 XMBody_17 2563 0.76 1.82 0.37 141 FROM_EXCESS_BASE64 2555 2.14 1.81 2.26 142 T_FILL_THIS_FORM_SHORT 2550 1.13 1.81 0.87 143 TR_XM_PHPDW 2512 0.74 1.78 0.36 144 HTML_IMAGE_ONLY_08 2493 0.58 1.77 0.15 145 RELAYCOUNTRY_GB 2484 1.03 1.76 0.75 146 URI_HEX 2482 1.24 1.76 1.04 147 FORGED_GMAIL_RCVD 2451 0.81 1.74 0.46 148 TR_XM_PHPForged 2410 0.68 1.71 0.30 149 XM_URI_RBL 2406 0.56 1.71 0.14 150 XMStockSpam_06 2377 1.06 1.69 0.83 151 NML_ADSP_CUSTOM_MED 2375 0.90 1.68 0.61 152 TR_XM_FormFill2 2369 0.68 1.68 0.31 153 XM_H_PHPOS 2358 0.67 1.67 0.30 154 XMSexyCombo_01 2329 0.73 1.65 0.38 155 TR_Mismatch_TLD_02 2308 0.50 1.64 0.08 156 RELAYCOUNTRY_AU 2283 0.74 1.62 0.41 157 XMGenDplmaNmb 2192 0.92 1.55 0.69 158 URIBL_BLACK 2174 0.45 1.54 0.05 159 FROM_SUSPICIOUS_NTLD 2164 0.46 1.53 0.06 160 XM_UB60 2134 0.46 1.51 0.08 161 ALL_TRUSTED 2111 12.95 1.50 17.19 162 XM_UB80 2082 0.41 1.48 0.02 163 FROM_SUSPICIOUS_NTLD_FP 2072 0.44 1.47 0.06 164 MIXED_HREF_CASE 2067 0.40 1.47 0.00 165 MIXED_IMG_CASE 2059 0.40 1.46 0.00 166 MIXED_AREA_CASE 2058 0.39 1.46 0.00 167 MIXED_FONT_CASE 2051 0.39 1.45 0.00 168 XM_UB999 2005 0.38 1.42 0.00 169 BAYES_20 1978 3.19 1.40 3.85 170 XMBdyGiftCard01 1938 0.87 1.37 0.68 171 T_XMHurry_00 1937 0.81 1.37 0.60 172 RELAYCOUNTRY_CN 1882 0.40 1.33 0.05 173 MIXED_CENTER_CASE 1881 0.36 1.33 0.00 174 XM_H_Long_From02 1822 1.30 1.29 1.31 175 TM2_M_A_HREF_HREF 1820 0.65 1.29 0.41 176 XMHTML_After_End 1748 0.94 1.24 0.83 177 BODY_URI_ONLY 1713 0.33 1.21 0.01 178 XMPhish30 1690 0.81 1.20 0.67 179 TR_MetaPhish_Combo_01 1682 0.83 1.19 0.70 180 RELAYCOUNTRY_FR 1632 0.48 1.16 0.23 181 DIET_1 1630 0.57 1.16 0.35 182 TR_LOTS_OF_MONEY3 1623 0.47 1.15 0.22 183 RELAYCOUNTRY_RU 1615 0.33 1.14 0.03 184 XM_PDF 1611 4.94 1.14 6.34 185 RCVD_IN_IADB_OPTIN 1604 2.30 1.14 2.72 186 XM_ProductURIs 1594 0.76 1.13 0.63 187 TR_BOTNET_NEGATE 1591 0.52 1.13 0.30 188 RCVD_IN_MSPIKE_L4 1561 0.87 1.11 0.78 189 TR_XM_COVIDMETA1 1552 0.42 1.10 0.17 190 TR_Symld_Words 1548 1.36 1.10 1.45 191 XMBrknScrpt_02 1540 0.87 1.09 0.79 192 MPART_ALT_DIFF_COUNT 1493 0.64 1.06 0.49 193 RELAYCOUNTRY_BR 1489 0.29 1.06 0.00 194 TR_XM_MaxSPIKE 1489 0.33 1.06 0.07 195 HTML_FONT_SIZE_LARGE 1477 0.36 1.05 0.11 196 URI_TRY_3LD 1477 0.80 1.05 0.70 197 LongTLD 1466 0.39 1.04 0.14 198 GOOG_STO_IMG_HTML 1448 0.28 1.03 0.00 199 HTML_TAG_BALANCE_BODY 1445 0.81 1.02 0.73 200 XMMoneyMeta_00 1435 0.64 1.02 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 329754 88.82 95.36 86.40 2 RELAYCOUNTRY_US 306870 80.28 79.95 80.40 3 DKIM_SIGNED 267768 73.59 82.86 70.16 4 DCC_CHECK_NEGATIVE 266324 59.77 32.69 69.78 5 XM_DK_Pass 262863 71.78 79.63 68.87 6 DKIM_VALID 259341 71.07 79.50 67.95 7 XM_B_Unicode 258329 70.16 76.85 67.69 8 BAYES_50 209885 51.83 43.26 54.99 9 DKIM_VALID_AU 197379 54.03 60.28 51.72 10 XMListUnsubscribeExists 175213 51.28 65.83 45.91 11 XM_B_SpammyWords 161747 48.19 63.90 42.38 12 XM_B_Unicode3 151598 41.01 44.50 39.72 13 DCC_CHECK 115121 40.18 67.27 30.16 14 T_TM2_M_HEADER_IN_MSG 112143 27.69 23.10 29.38 15 RCVD_IN_MSPIKE_WL 108209 26.08 19.94 28.35 16 DKIM_VALID_EF 98881 26.41 27.75 25.91 17 HTML_FONT_LOW_CONTRAST 92017 26.28 32.14 24.11 18 MIME_HTML_ONLY 87084 26.34 35.87 22.82 19 FVGT_m_MULTI_ODD 84934 25.12 32.88 22.25 20 LOC_TINY_FONT_1 78640 24.81 36.19 20.60 21 XMSubLong 77143 20.83 22.49 20.21 22 RCVD_IN_MSPIKE_H2 76031 21.58 26.05 19.92 23 T_KAM_HTML_FONT_INVALID 73093 21.60 28.22 19.15 24 XM_B_SpammyWords2 68745 22.80 35.77 18.01 25 ALL_TRUSTED 65600 12.95 1.50 17.19 26 RCVD_IN_MSPIKE_H3 62284 15.52 13.36 16.32 27 BAYES_00 45808 8.98 0.80 12.00 28 XM_Multi_Part_URI 44248 12.93 16.56 11.59 29 XM_B_Unsub 43326 12.23 14.60 11.35 30 USER_IN_DEF_DKIM_WL 41103 8.39 1.97 10.77 31 XM_Body_Dirty_Words 40219 13.82 22.70 10.54 32 RCVD_IN_MSPIKE_H4 39548 9.23 6.17 10.36 33 LotsOfNums_01 35081 8.51 6.67 9.19 34 BAYES_60 35077 8.60 6.99 9.19 35 MPART_ALT_DIFF 32018 8.84 10.04 8.39 36 UNPARSEABLE_RELAY 30485 9.46 13.45 7.99 37 XM_Evil_Numbers_Gen 30417 8.14 8.59 7.97 38 TooManyTo_001 29259 6.94 4.97 7.67 39 IN_ZIMBRA_NJ_WHITELIST 27837 5.36 0.12 7.29 40 LOTS_OF_MONEY 26286 8.87 14.25 6.89 41 XM_DKIMWhitelistDomains 26283 5.04 0.04 6.89 42 XM_DK_Undo_02 25720 15.67 39.83 6.74 43 MIME_HTML_ONLY_MULTI 25271 6.78 7.22 6.62 44 RCVD_IN_IADB_LISTED 24504 5.56 3.24 6.42 45 XM_PDF 24212 4.94 1.14 6.34 46 TR_XM_DK_Bayes 23801 4.68 0.46 6.24 47 TR_XM_UnparsRelay 23527 8.03 13.07 6.16 48 TR_XM_DK_Bayes1 23249 4.57 0.45 6.09 49 MIME_QP_LONG_LINE 23059 5.49 3.99 6.04 50 XM_SendGrid 22916 6.79 8.93 6.00 51 HTML_IMAGE_RATIO_04 21847 5.85 6.19 5.72 52 RCVD_IN_IADB_SPF 21543 4.85 2.68 5.64 53 XM_H_Trusted_IP 21489 4.11 0.00 5.63 54 BAYES_99 21352 13.01 33.07 5.59 55 HTML_IMAGE_RATIO_02 21120 5.87 6.78 5.53 56 TR_XM_DK_Bayes2 20451 4.02 0.41 5.36 57 T_TooManySym_01 20431 4.54 2.35 5.35 58 TM2_M_URI_OPT_OUT 20254 4.67 2.94 5.31 59 XM_H_Long_From01 19846 5.33 5.69 5.20 60 BAYES_40 19333 4.19 1.84 5.07 61 XMStrtUSub 19326 4.88 4.37 5.06 62 RCVD_IN_IADB_SENDERID 19283 4.34 2.42 5.05 63 RCVD_IN_IADB_DK 18569 4.23 2.49 4.87 64 XM_B_SpammyWords3 17896 6.75 12.31 4.69 65 BAYES_999 17118 10.24 25.82 4.49 66 TR_XM_DKIM_Undo 16766 11.37 30.24 4.39 67 BOTNET_IPINHOSTNAME 16676 6.48 12.21 4.37 68 RCVD_IN_VALIDITY_SAFE 16474 3.98 3.05 4.32 69 BAYES_80 15685 5.09 7.75 4.11 70 RCVD_IN_IADB_VOUCHED 15570 3.49 1.89 4.08 71 TR_XM_SpammyWords4 15238 6.14 11.96 3.99 72 TR_XM_DK_SendGrid 15212 4.41 5.57 3.99 73 XM_UncommonTLD01 14941 5.44 9.56 3.91 74 T_REMOTE_IMAGE 14750 4.36 5.68 3.86 75 BAYES_20 14689 3.19 1.40 3.85 76 RCVD_IN_VALIDITY_CERTIFIED 14590 3.48 2.55 3.82 77 XMNumbers 14462 3.90 4.18 3.79 78 RELAYCOUNTRY_META 14141 8.81 22.61 3.71 79 TR_XM_SB_Phish 13493 3.21 2.33 3.54 80 XMSubPhish11 13392 3.18 2.29 3.51 81 FSL_BULK_SIG 13175 6.46 14.59 3.45 82 XMSubMetaSx_00 13088 4.12 5.99 3.43 83 HTML_MIME_NO_HTML_TAG 13082 4.66 7.99 3.43 84 XM_B_Phish_Phrases 12717 3.95 5.61 3.33 85 HTML_IMAGE_RATIO_06 12344 3.38 3.78 3.23 86 XMSexyCombo_05 11919 5.15 10.62 3.12 87 TR_XM_PhishingBody 11816 3.93 6.19 3.10 88 T_TooManySym_02 11379 2.37 0.71 2.98 89 URI_NOVOWEL 11360 2.89 2.67 2.98 90 ANY_BOUNCE_MESSAGE 11086 2.34 0.82 2.90 91 BOUNCE_MESSAGE 11086 2.34 0.82 2.90 92 RCVD_IN_IADB_OPTIN 10399 2.30 1.14 2.72 93 XM_SPF_SoftFail 10308 3.74 6.56 2.70 94 BAYES_95 10103 3.07 4.22 2.65 95 MAILING_LIST_MULTI 9905 2.50 2.25 2.60 96 BAYES_05 9720 2.02 0.60 2.55 97 MIME_HTML_MOSTLY 9064 2.63 3.33 2.37 98 FROM_EXCESS_BASE64 8616 2.14 1.81 2.26 99 DKIM_INVALID 8427 2.52 3.36 2.21 100 XM_B_SpammyTLD 8163 2.62 3.91 2.14 101 T_XMDrugObfuBody_14 7980 2.44 3.38 2.09 102 TM2_M_VERY_LONG_WORD 7940 3.50 7.35 2.08 103 HTML_IMAGE_RATIO_08 7906 2.42 3.37 2.07 104 TVD_RCVD_IP 7853 1.58 0.29 2.06 105 KHOP_HELO_FCRDNS 7827 2.46 3.58 2.05 106 XM_B_Investor 7674 3.06 5.90 2.01 107 XM_GoogleGroups 7597 2.83 5.11 1.99 108 TooManyTo_002 7184 1.56 0.70 1.88 109 XM_B_Phish66 7150 2.25 3.27 1.87 110 TR_DCC_Bayes_99 7103 7.46 22.60 1.86 111 XM_CamelCaseFrm001 6856 2.09 2.87 1.80 112 INVALID_MSGID 6807 1.36 0.22 1.78 113 IN_HORDE_ADDRESS_BOOK 6531 1.27 0.09 1.71 114 TR_XM_SpammyWords5 6518 2.34 4.06 1.71 115 T_XMDrugObfuBody_08 6510 1.96 2.66 1.71 116 XMSubNoVowel 6480 1.44 0.73 1.70 117 RCVD_IN_MSPIKE_H5 6377 1.33 0.41 1.67 118 MSGID_NOFQDN1 6237 1.22 0.10 1.63 119 SUBJ_ALL_CAPS 6171 1.89 2.62 1.62 120 HELO_NODOT 6147 1.36 0.68 1.61 121 HELO_NO_DOMAIN 6140 1.35 0.64 1.61 122 TO_MALFORMED 6058 1.17 0.03 1.59 123 XM_B_Unsub2 5955 1.76 2.30 1.56 124 TR_XM_SpammyRelay 5933 4.28 11.65 1.55 125 RCVD_IN_MSPIKE_BL 5838 2.91 6.65 1.53 126 TR_XM_MSPIKECOMBO 5834 2.88 6.55 1.53 127 BOTNET 5710 4.96 14.33 1.50 128 TR_Symld_Words 5549 1.36 1.10 1.45 129 XM_DK_Undo_01 5511 1.68 2.33 1.44 130 XMLngstWrd_00 5494 2.34 4.77 1.44 131 XMLngstWrd_01 5258 2.27 4.70 1.38 132 XM_H_Long_From02 4988 1.30 1.29 1.31 133 XMLngstWrd_02 4965 2.20 4.63 1.30 134 T_OBFU_PDF_ATTACH 4950 1.03 0.32 1.30 135 XMDiploma_00 4935 1.92 3.61 1.29 136 TooManyTo_003 4848 1.09 0.61 1.27 137 XMLngstWrd_03 4616 2.05 4.33 1.21 138 XMGappySubj_01 4611 0.92 0.15 1.21 139 UNTRUSTED_Relay 4557 4.47 13.35 1.19 140 XM_OfRef6 4497 1.63 2.85 1.18 141 XMLngstWrd_04 4308 1.97 4.26 1.13 142 HTML_FONT_FACE_BAD 4169 0.98 0.67 1.09 143 TVD_SPACE_RATIO 4099 0.81 0.08 1.07 144 URI_HEX 3975 1.24 1.76 1.04 145 XMCapTrack 3967 0.93 0.64 1.04 146 HTML_TITLE_SUBJ_DIFF 3685 1.91 4.47 0.97 147 XMBSHREFv2 3518 0.74 0.23 0.92 148 TR_XM_SpammyWords2 3511 3.56 10.71 0.92 149 UPPERCASE_75_100 3499 1.80 4.19 0.92 150 DKIM_ADSP_CUSTOM_MED 3423 1.16 1.87 0.90 151 TooManyTo_004 3405 0.79 0.52 0.89 152 T_FILL_THIS_FORM_SHORT 3332 1.13 1.81 0.87 153 RELAYCOUNTRY_CA 3218 1.85 4.57 0.84 154 RCVD_IN_RP_SAFE 3187 0.80 0.71 0.84 155 XMHTML_After_End 3181 0.94 1.24 0.83 156 XMSubMetaI_00 3177 0.87 0.96 0.83 157 XMStockSpam_06 3172 1.06 1.69 0.83 158 T_XMDrugObfuBody_00 3133 1.20 2.21 0.82 159 TR_XM_MaxUnsub 3048 2.43 6.83 0.80 160 XMBrknScrpt_02 3004 0.87 1.09 0.79 161 RCVD_IN_MSPIKE_L4 2976 0.87 1.11 0.78 162 RELAYCOUNTRY_GB 2880 1.03 1.76 0.75 163 XMBody_95 2872 0.57 0.09 0.75 164 XM_UB50 2863 2.22 6.21 0.75 165 RCVD_IN_RP_CERTIFIED 2863 0.71 0.59 0.75 166 HTML_TAG_BALANCE_BODY 2801 0.81 1.02 0.73 167 TooManyTo_005 2796 0.66 0.48 0.73 168 XM_shorewaves_Whitelist 2793 0.53 0.00 0.73 169 URI_TRY_3LD 2687 0.80 1.05 0.70 170 TR_MetaPhish_Combo_01 2681 0.83 1.19 0.70 171 HTML_IMAGE_ONLY_20 2642 0.66 0.57 0.69 172 XMGenDplmaNmb 2639 0.92 1.55 0.69 173 XMBdyGiftCard01 2598 0.87 1.37 0.68 174 HTTPS_HTTP_MISMATCH 2550 0.74 0.92 0.67 175 XMPhish30 2547 0.81 1.20 0.67 176 XM_B_COVIDMETA 2506 0.97 1.82 0.66 177 TR_XM_SpammyWords3 2473 1.35 3.27 0.65 178 SpammyFromTLD_01 2461 1.32 3.15 0.64 179 T_TooManySym_03 2451 0.54 0.27 0.64 180 XM_ProductURIs 2392 0.76 1.13 0.63 181 RCVD_IN_MSPIKE_L3 2359 1.07 2.31 0.62 182 NML_ADSP_CUSTOM_MED 2313 0.90 1.68 0.61 183 T_XMHurry_00 2271 0.81 1.37 0.60 184 XM_E_Blogspot 2225 0.48 0.22 0.58 185 XM_B_COPY_HTML 2201 0.61 0.72 0.58 186 RCVD_IN_BL_SPAMCOP_NET 2188 2.82 8.91 0.57 187 XM_ShortIntro_01 2186 0.59 0.63 0.57 188 FROM_GOV_DKIM_AU 2120 0.45 0.15 0.56 189 XM_H_PHPMailer 2003 0.59 0.78 0.52 190 XM_B_SpammyWords4 2002 1.03 2.39 0.52 191 TM2_M_BODY_EMPTY 1980 0.41 0.10 0.52 192 T_Symld_Words_02 1919 0.62 0.95 0.50 193 XMMoneyMeta_00 1918 0.64 1.02 0.50 194 SpammyFromTLD_02 1909 1.23 3.22 0.50 195 RCVD_IN_SORBS_DUL 1870 0.43 0.27 0.49 196 MPART_ALT_DIFF_COUNT 1869 0.64 1.06 0.49 197 TR_MSPIKEBAYES00 1820 0.35 0.02 0.48 198 FILL_THIS_FORM 1803 0.41 0.26 0.47 199 SHORT_HELO_AND_INLINE_IMAGE 1795 0.37 0.10 0.47 200 FORGED_GMAIL_RCVD 1769 0.81 1.74 0.46 ----------------------------------------------------------------------