Email: 336245 Autolearn: 0 AvgScore: 2.48 AvgScanTime: 1.17 sec Spam: 98546 Autolearn: 0 AvgScore: 13.99 AvgScanTime: 1.34 sec Ham: 237699 Autolearn: 0 AvgScore: -2.29 AvgScanTime: 1.10 sec Time Spent Running SA: 109.10 hours Time Spent Processing Spam: 36.58 hours Time Spent Processing Ham: 72.52 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92072 82.81 93.43 78.40 2 DKIM_SIGNED 81092 72.52 82.29 68.48 3 XM_DK_Pass 79077 71.19 80.24 67.44 4 DKIM_VALID 78659 70.61 79.82 66.80 5 RELAYCOUNTRY_US 76677 76.08 77.81 75.36 6 XM_B_Unicode 70814 66.38 71.86 64.10 7 DCC_CHECK 66511 42.90 67.49 32.70 8 XMListUnsubscribeExists 64736 52.37 65.69 46.85 9 DKIM_VALID_AU 61402 56.37 62.31 53.91 10 XM_B_SpammyWords 56631 44.42 57.47 39.01 11 XM_DK_Undo_02 42202 17.93 42.82 7.60 12 XM_B_Unicode3 41015 40.82 41.62 40.49 13 BAYES_50 39779 52.93 40.37 58.14 14 MIME_HTML_ONLY 37080 26.58 37.63 22.00 15 BAYES_99 35110 15.16 35.63 6.67 16 LOC_TINY_FONT_1 33105 26.12 33.59 23.02 17 FVGT_m_MULTI_ODD 32832 26.40 33.32 23.53 18 TR_XM_DKIM_Undo 32019 13.31 32.49 5.35 19 DCC_CHECK_NEGATIVE 31997 57.07 32.47 67.27 20 HTML_FONT_LOW_CONTRAST 29460 27.18 29.89 26.05 21 XM_B_SpammyWords2 29129 20.23 29.56 16.36 22 BAYES_999 28177 12.29 28.59 5.53 23 RELAYCOUNTRY_META 25993 10.66 26.38 4.15 24 DKIM_VALID_EF 25773 26.37 26.15 26.46 25 TR_DCC_Bayes_99 24979 8.91 25.35 2.10 26 RCVD_IN_MSPIKE_H2 24579 20.03 24.94 18.00 27 T_KAM_HTML_FONT_INVALID 22296 18.12 22.62 16.25 28 RCVD_IN_MSPIKE_WL 21485 27.37 21.80 29.67 29 T_TM2_M_HEADER_IN_MSG 19289 22.77 19.57 24.10 30 XMSubLong 19245 20.00 19.53 20.19 31 XM_Body_Dirty_Words 18695 13.06 18.97 10.62 32 XM_Multi_Part_URI 15785 13.52 16.02 12.48 33 RCVD_IN_MSPIKE_H3 15093 16.17 15.32 16.53 34 FSL_BULK_SIG 15022 6.77 15.24 3.26 35 UNTRUSTED_Relay 14005 5.13 14.21 1.36 36 UNPARSEABLE_RELAY 13307 9.63 13.50 8.03 37 TR_XM_UnparsRelay 13034 8.30 13.23 6.26 38 XM_UncommonTLD01 12316 6.56 12.50 4.09 39 XM_B_Unsub 12192 10.25 12.37 9.38 40 BOTNET 12072 4.49 12.25 1.27 41 BOTNET_IPINHOSTNAME 11401 6.73 11.57 4.73 42 MPART_ALT_DIFF 11309 8.28 11.48 6.96 43 TR_XM_SpammyRelay 10997 4.43 11.16 1.64 44 HTML_MIME_NO_HTML_TAG 10982 5.42 11.14 3.05 45 TR_XM_SpammyWords2 10146 3.89 10.30 1.24 46 XMSexyCombo_05 9779 5.37 9.92 3.49 47 TM2_M_VERY_LONG_WORD 9278 4.53 9.41 2.50 48 XM_B_SpammyWords3 9002 5.28 9.13 3.68 49 RCVD_IN_BL_SPAMCOP_NET 8879 3.11 9.01 0.67 50 LOTS_OF_MONEY 8816 7.02 8.95 6.23 51 MIME_HTML_ONLY_MULTI 8730 6.35 8.86 5.31 52 XM_Evil_Numbers_Gen 8591 8.64 8.72 8.61 53 HTML_IMAGE_RATIO_02 8391 7.52 8.51 7.11 54 XM_SendGrid 7754 6.56 7.87 6.01 55 BAYES_80 7711 5.36 7.82 4.33 56 TR_XM_SpammyWords4 7173 5.07 7.28 4.15 57 XM_H_Long_From01 7171 5.64 7.28 4.96 58 XM_GoogleGroups 7116 4.12 7.22 2.83 59 XMLngstWrd_00 7106 3.52 7.21 1.99 60 BAYES_60 7085 9.50 7.19 10.45 61 XMLngstWrd_01 7053 3.47 7.16 1.94 62 XMLngstWrd_02 6983 3.39 7.09 1.86 63 XMLngstWrd_03 6577 3.21 6.67 1.77 64 HTML_TITLE_SUBJ_DIFF 6532 3.02 6.63 1.52 65 XMLngstWrd_04 6517 3.15 6.61 1.71 66 UPPERCASE_75_100 6477 3.00 6.57 1.52 67 RCVD_IN_MSPIKE_BL 6469 2.58 6.56 0.93 68 TR_XM_MSPIKECOMBO 6419 2.57 6.51 0.93 69 TR_XM_PhishingBody 6336 3.53 6.43 2.33 70 XMSubMetaSx_00 6289 4.91 6.38 4.31 71 T_REMOTE_IMAGE 6246 4.03 6.34 3.08 72 RELAYCOUNTRY_CA 6164 2.65 6.25 1.15 73 RCVD_IN_MSPIKE_H4 6094 9.83 6.18 11.34 74 TR_XM_MaxUnsub 6050 2.53 6.14 1.04 75 XM_UB50 5939 2.42 6.03 0.92 76 LotsOfNums_01 5741 7.49 5.83 8.18 77 XM_SPF_SoftFail 5195 2.82 5.27 1.81 78 TooManyTo_001 5173 6.02 5.25 6.34 79 XMNumbers 4961 5.15 5.03 5.20 80 KHOP_HELO_FCRDNS 4881 2.56 4.95 1.57 81 RCVD_IN_VALIDITY_SAFE 4558 5.46 4.63 5.81 82 BAYES_95 4547 3.39 4.61 2.88 83 TR_XM_DK_SendGrid 4524 4.13 4.59 3.94 84 SpammyFromTLD_01 4480 1.59 4.55 0.36 85 XMStrtUSub 4334 5.18 4.40 5.50 86 TR_XM_SPAMCOP 4268 1.37 4.33 0.14 87 HTML_IMAGE_RATIO_06 4214 3.99 4.28 3.86 88 XM_B_Phish_Phrases 4023 3.28 4.08 2.95 89 SpammyFromTLD_02 3771 1.28 3.83 0.23 90 HTML_IMAGE_RATIO_04 3691 5.37 3.75 6.04 91 RCVD_IN_VALIDITY_CERTIFIED 3614 4.79 3.67 5.25 92 MIME_HTML_MOSTLY 3547 2.62 3.60 2.22 93 TR_XM_SpammyWords5 3522 2.27 3.57 1.73 94 XM_B_Phish66 3490 1.87 3.54 1.17 95 XM_DIRTYINTL 3484 1.31 3.54 0.39 96 T_XMDrugObfuBody_14 3386 2.44 3.44 2.02 97 XM_B_SpammyTLD 3331 2.45 3.38 2.06 98 HTML_IMAGE_ONLY_08 3201 1.05 3.25 0.14 99 RCVD_IN_VALIDITY_RPBL 3134 0.95 3.18 0.02 100 RCVD_IN_MSPIKE_L3 3040 1.27 3.08 0.51 101 XM_OfRef6 3000 1.65 3.04 1.07 102 XM_B_Investor 2959 1.63 3.00 1.06 103 T_XMDrugObfuBody_08 2941 1.80 2.98 1.32 104 T_HTML_TAG_BALANCE_CENTER 2932 0.95 2.98 0.11 105 T_FILL_THIS_FORM_SHORT 2904 1.23 2.95 0.52 106 XM_UB99 2892 0.86 2.93 0.00 107 BOTNET_NORDNS 2864 0.88 2.91 0.03 108 BODY_URI_ONLY 2793 0.84 2.83 0.01 109 TR_XM_MSPIKECOMBO2 2761 0.96 2.80 0.20 110 USER_IN_DEF_DKIM_WL 2712 10.42 2.75 13.60 111 MIME_QP_LONG_LINE 2682 3.81 2.72 4.27 112 T_TooManySym_01 2669 5.85 2.71 7.15 113 FROM_EXCESS_BASE64 2656 3.01 2.70 3.13 114 XM_DK_Undo_01 2608 1.84 2.65 1.50 115 TM2_M_URI_OPT_OUT 2577 2.50 2.62 2.45 116 TR_XM_SpammyWords3 2558 1.08 2.60 0.45 117 RCVD_IN_MSPIKE_L5 2556 0.77 2.59 0.02 118 DKIM_INVALID 2433 1.91 2.47 1.68 119 XM_CamelCaseFrm001 2385 1.72 2.42 1.43 120 MIXED_HREF_CASE 2315 0.69 2.35 0.00 121 RCVD_IN_PSBL 2314 0.84 2.35 0.22 122 MIXED_IMG_CASE 2299 0.69 2.33 0.01 123 MIXED_AREA_CASE 2296 0.68 2.33 0.00 124 SUBJ_ALL_CAPS 2286 1.65 2.32 1.37 125 MIXED_FONT_CASE 2285 0.68 2.32 0.00 126 XMSubNoVowel 2265 1.96 2.30 1.82 127 XM_UB999 2254 0.67 2.29 0.00 128 RCVD_IN_IADB_LISTED 2208 3.47 2.24 3.98 129 RELAYCOUNTRY_RU 2172 0.67 2.20 0.04 130 MIXED_CENTER_CASE 2163 0.65 2.19 0.00 131 URI_NOVOWEL 2101 2.04 2.13 2.01 132 RELAYCOUNTRY_DE 2041 0.86 2.07 0.36 133 PDS_OTHER_BAD_TLD 1975 0.75 2.00 0.23 134 TR_XM_PHPDW 1966 0.86 2.00 0.39 135 HTML_FONT_SIZE_LARGE 1951 0.68 1.98 0.14 136 RCVD_IN_IADB_SPF 1923 3.11 1.95 3.59 137 TR_XM_PHPForged 1919 0.79 1.95 0.31 138 URI_GOOG_STO_SPAMMY 1900 0.57 1.93 0.00 139 TR_XM_FormFill2 1863 0.77 1.89 0.31 140 TR_XM_NoHeaderRelay 1862 0.69 1.89 0.20 141 XM_H_PHPOS 1841 0.76 1.87 0.29 142 XMBody_17 1824 0.78 1.85 0.34 143 RCVD_IN_IADB_DK 1817 2.78 1.84 3.16 144 XM_BadFromFormat 1817 0.66 1.84 0.17 145 HTML_IMAGE_RATIO_08 1794 1.89 1.82 1.92 146 XM_H_Undi_Recip 1788 0.68 1.81 0.21 147 XMSubMetaI_00 1785 1.22 1.81 0.97 148 RCVD_IN_IADB_SENDERID 1782 2.85 1.81 3.28 149 XMSexyCombo_01 1778 1.31 1.80 1.11 150 XM_B_Unsub2 1761 1.29 1.79 1.08 151 XMDiploma_00 1754 1.28 1.78 1.08 152 XM_B_SpammyWords4 1726 0.86 1.75 0.49 153 XMBrknScrpt_02 1705 1.08 1.73 0.81 154 MAILING_LIST_MULTI 1700 2.38 1.73 2.66 155 ALL_TRUSTED 1680 16.09 1.70 22.06 156 BAYES_40 1644 3.32 1.67 4.01 157 XM_UB60 1587 0.52 1.61 0.07 158 XMStockSpam_06 1586 1.48 1.61 1.42 159 TR_Mismatch_TLD_01 1571 0.60 1.59 0.19 160 URI_HEX 1568 1.47 1.59 1.42 161 TR_Mismatch_TLD_02 1552 0.53 1.57 0.09 162 RELAYCOUNTRY_AU 1520 0.61 1.54 0.22 163 T_XMDrugObfuBody_00 1480 0.85 1.50 0.58 164 TR_XM_FormFill 1467 0.45 1.49 0.01 165 THIS_AD 1430 0.79 1.45 0.52 166 URIBL_BLACK 1428 0.46 1.45 0.05 167 TR_XM_BayesRelay 1419 0.42 1.44 0.00 168 XMPhish30 1384 0.85 1.40 0.63 169 RELAYCOUNTRY_FR 1373 0.58 1.39 0.24 170 FROM_SUSPICIOUS_NTLD 1371 0.45 1.39 0.06 171 TR_XM_SB_Phish 1366 1.51 1.39 1.57 172 MONEY_NOHTML 1364 0.44 1.38 0.06 173 XMSubPhish11 1344 1.49 1.36 1.54 174 XM_ProductURIs 1335 0.84 1.35 0.63 175 URIBL_DBL_SPAM 1332 0.40 1.35 0.01 176 TR_XM_MaxSPIKE 1323 0.45 1.34 0.08 177 FROM_SUSPICIOUS_NTLD_FP 1286 0.42 1.30 0.06 178 XM_UB80 1273 0.39 1.29 0.02 179 DIET_1 1268 0.59 1.29 0.30 180 BAYES_20 1250 2.49 1.27 3.00 181 XM_URI_RBL 1242 0.45 1.26 0.12 182 RELAYCOUNTRY_BR 1234 0.38 1.25 0.01 183 RCVD_IN_IADB_VOUCHED 1202 2.03 1.22 2.36 184 T_XMHurry_00 1189 0.71 1.21 0.51 185 RELAYCOUNTRY_GB 1183 0.84 1.20 0.69 186 XMBdyGiftCard01 1177 1.03 1.19 0.96 187 XM_H_Long_From02 1154 0.91 1.17 0.80 188 XM_ShortIntro_01 1147 0.70 1.16 0.51 189 TR_MetaPhish_Combo_01 1133 0.87 1.15 0.76 190 XMHTMLBadTable_001 1105 0.70 1.12 0.53 191 TM2_M_A_HREF_HREF 1076 0.52 1.09 0.28 192 TR_BOTNET_NEGATE 1074 0.51 1.09 0.26 193 RELAYCOUNTRY_CN 1059 0.37 1.07 0.08 194 TR_Symld_Words 1052 1.65 1.07 1.90 195 TR_XM_COVIDMETA1 1040 0.38 1.06 0.09 196 TooManyTo_002 1030 1.37 1.05 1.50 197 XMHTML_After_End 1025 0.77 1.04 0.66 198 HTML_TAG_BALANCE_BODY 1021 0.72 1.04 0.58 199 TR_XM_Undi_Recip5 1015 0.32 1.03 0.03 200 TooManyTo_003 961 1.02 0.98 1.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 186365 82.81 93.43 78.40 2 RELAYCOUNTRY_US 179127 76.08 77.81 75.36 3 DKIM_SIGNED 162767 72.52 82.29 68.48 4 XM_DK_Pass 160312 71.19 80.24 67.44 5 DCC_CHECK_NEGATIVE 159906 57.07 32.47 67.27 6 DKIM_VALID 158774 70.61 79.82 66.80 7 XM_B_Unicode 152370 66.38 71.86 64.10 8 BAYES_50 138194 52.93 40.37 58.14 9 DKIM_VALID_AU 128138 56.37 62.31 53.91 10 XMListUnsubscribeExists 111356 52.37 65.69 46.85 11 XM_B_Unicode3 96254 40.82 41.62 40.49 12 XM_B_SpammyWords 92729 44.42 57.47 39.01 13 DCC_CHECK 77736 42.90 67.49 32.70 14 RCVD_IN_MSPIKE_WL 70532 27.37 21.80 29.67 15 DKIM_VALID_EF 62886 26.37 26.15 26.46 16 HTML_FONT_LOW_CONTRAST 61925 27.18 29.89 26.05 17 T_TM2_M_HEADER_IN_MSG 57277 22.77 19.57 24.10 18 FVGT_m_MULTI_ODD 55933 26.40 33.32 23.53 19 LOC_TINY_FONT_1 54730 26.12 33.59 23.02 20 ALL_TRUSTED 52437 16.09 1.70 22.06 21 MIME_HTML_ONLY 52285 26.58 37.63 22.00 22 XMSubLong 47991 20.00 19.53 20.19 23 RCVD_IN_MSPIKE_H2 42783 20.03 24.94 18.00 24 RCVD_IN_MSPIKE_H3 39289 16.17 15.32 16.53 25 XM_B_SpammyWords2 38893 20.23 29.56 16.36 26 T_KAM_HTML_FONT_INVALID 38629 18.12 22.62 16.25 27 USER_IN_DEF_DKIM_WL 32327 10.42 2.75 13.60 28 XM_Multi_Part_URI 29668 13.52 16.02 12.48 29 RCVD_IN_MSPIKE_H4 26957 9.83 6.18 11.34 30 XM_Body_Dirty_Words 25234 13.06 18.97 10.62 31 BAYES_60 24846 9.50 7.19 10.45 32 XM_DKIMWhitelistDomains 22823 6.80 0.03 9.60 33 BOUNCE_MESSAGE 22317 6.85 0.74 9.39 34 ANY_BOUNCE_MESSAGE 22317 6.85 0.74 9.39 35 XM_B_Unsub 22285 10.25 12.37 9.38 36 BAYES_00 20685 6.33 0.62 8.70 37 XM_Evil_Numbers_Gen 20474 8.64 8.72 8.61 38 LotsOfNums_01 19449 7.49 5.83 8.18 39 UNPARSEABLE_RELAY 19077 9.63 13.50 8.03 40 XM_DK_Undo_02 18072 17.93 42.82 7.60 41 T_TooManySym_01 17003 5.85 2.71 7.15 42 HTML_IMAGE_RATIO_02 16902 7.52 8.51 7.11 43 MPART_ALT_DIFF 16536 8.28 11.48 6.96 44 URI_OPTOUT_3LD 16348 4.92 0.20 6.88 45 BAYES_99 15865 15.16 35.63 6.67 46 TooManyTo_001 15060 6.02 5.25 6.34 47 TR_XM_UnparsRelay 14890 8.30 13.23 6.26 48 LOTS_OF_MONEY 14805 7.02 8.95 6.23 49 HTML_IMAGE_RATIO_04 14355 5.37 3.75 6.04 50 XM_SendGrid 14297 6.56 7.87 6.01 51 RCVD_IN_VALIDITY_SAFE 13815 5.46 4.63 5.81 52 IN_ZIMBRA_NJ_WHITELIST 13378 4.00 0.08 5.63 53 BAYES_999 13136 12.29 28.59 5.53 54 XMStrtUSub 13078 5.18 4.40 5.50 55 TR_XM_DKIM_Undo 12726 13.31 32.49 5.35 56 MIME_HTML_ONLY_MULTI 12633 6.35 8.86 5.31 57 RCVD_IN_VALIDITY_CERTIFIED 12490 4.79 3.67 5.25 58 XMNumbers 12356 5.15 5.03 5.20 59 XM_H_Trusted_IP 12302 3.66 0.00 5.18 60 TR_XM_DK_Bayes 12288 3.76 0.34 5.17 61 TR_XM_DK_Bayes1 12112 3.70 0.34 5.10 62 XM_H_Long_From01 11780 5.64 7.28 4.96 63 BOTNET_IPINHOSTNAME 11245 6.73 11.57 4.73 64 TR_XM_DK_Bayes2 10834 3.31 0.30 4.56 65 BAYES_80 10303 5.36 7.82 4.33 66 XMSubMetaSx_00 10235 4.91 6.38 4.31 67 T_TooManySym_02 10192 3.28 0.86 4.29 68 MIME_QP_LONG_LINE 10140 3.81 2.72 4.27 69 RELAYCOUNTRY_META 9863 10.66 26.38 4.15 70 TR_XM_SpammyWords4 9858 5.07 7.28 4.15 71 XM_UncommonTLD01 9732 6.56 12.50 4.09 72 BAYES_40 9530 3.32 1.67 4.01 73 RCVD_IN_IADB_LISTED 9455 3.47 2.24 3.98 74 TR_XM_DK_SendGrid 9376 4.13 4.59 3.94 75 HTML_IMAGE_RATIO_06 9186 3.99 4.28 3.86 76 XM_B_SpammyWords3 8749 5.28 9.13 3.68 77 RCVD_IN_IADB_SPF 8529 3.11 1.95 3.59 78 XMSexyCombo_05 8292 5.37 9.92 3.49 79 RCVD_IN_IADB_SENDERID 7787 2.85 1.81 3.28 80 FSL_BULK_SIG 7744 6.77 15.24 3.26 81 RCVD_IN_IADB_DK 7516 2.78 1.84 3.16 82 FROM_EXCESS_BASE64 7450 3.01 2.70 3.13 83 T_REMOTE_IMAGE 7310 4.03 6.34 3.08 84 HTML_MIME_NO_HTML_TAG 7252 5.42 11.14 3.05 85 BAYES_20 7124 2.49 1.27 3.00 86 XM_B_Phish_Phrases 7018 3.28 4.08 2.95 87 INVALID_MSGID 6853 2.14 0.35 2.88 88 BAYES_95 6841 3.39 4.61 2.88 89 XM_GoogleGroups 6733 4.12 7.22 2.83 90 MAILING_LIST_MULTI 6312 2.38 1.73 2.66 91 MSGID_NOFQDN1 6173 1.88 0.14 2.60 92 TO_MALFORMED 6027 1.80 0.02 2.54 93 TM2_M_VERY_LONG_WORD 5951 4.53 9.41 2.50 94 TVD_RCVD_IP 5915 1.83 0.23 2.49 95 TM2_M_URI_OPT_OUT 5834 2.50 2.62 2.45 96 XM_PDF 5765 1.87 0.53 2.43 97 RCVD_IN_IADB_VOUCHED 5616 2.03 1.22 2.36 98 TR_XM_PhishingBody 5536 3.53 6.43 2.33 99 MIME_HTML_MOSTLY 5271 2.62 3.60 2.22 100 TR_DCC_Bayes_99 4982 8.91 25.35 2.10 101 XM_B_SpammyTLD 4899 2.45 3.38 2.06 102 T_XMDrugObfuBody_14 4807 2.44 3.44 2.02 103 URI_NOVOWEL 4771 2.04 2.13 2.01 104 XMLngstWrd_00 4734 3.52 7.21 1.99 105 XMLngstWrd_01 4605 3.47 7.16 1.94 106 HTML_IMAGE_RATIO_08 4574 1.89 1.82 1.92 107 TR_Symld_Words 4511 1.65 1.07 1.90 108 XMLngstWrd_02 4425 3.39 7.09 1.86 109 IN_HORDE_ADDRESS_BOOK 4407 1.34 0.11 1.85 110 XMSubNoVowel 4319 1.96 2.30 1.82 111 BAYES_05 4304 1.47 0.63 1.81 112 XM_SPF_SoftFail 4296 2.82 5.27 1.81 113 RCVD_IN_MSPIKE_H5 4286 1.36 0.30 1.80 114 XMLngstWrd_03 4215 3.21 6.67 1.77 115 TR_XM_SpammyWords5 4109 2.27 3.57 1.73 116 XMLngstWrd_04 4058 3.15 6.61 1.71 117 DKIM_INVALID 3993 1.91 2.47 1.68 118 TR_XM_SpammyRelay 3889 4.43 11.16 1.64 119 KHOP_HELO_FCRDNS 3739 2.56 4.95 1.57 120 RCVD_IN_IADB_OPTIN 3727 1.35 0.84 1.57 121 TR_XM_SB_Phish 3720 1.51 1.39 1.57 122 XMSubPhish11 3670 1.49 1.36 1.54 123 UPPERCASE_75_100 3618 3.00 6.57 1.52 124 HTML_TITLE_SUBJ_DIFF 3607 3.02 6.63 1.52 125 XM_DK_Undo_01 3572 1.84 2.65 1.50 126 TooManyTo_002 3569 1.37 1.05 1.50 127 XMBSHREFv2 3436 1.09 0.23 1.45 128 HTML_FONT_FACE_BAD 3416 1.27 0.88 1.44 129 XM_CamelCaseFrm001 3405 1.72 2.42 1.43 130 XMStockSpam_06 3384 1.48 1.61 1.42 131 URI_HEX 3368 1.47 1.59 1.42 132 SUBJ_ALL_CAPS 3268 1.65 2.32 1.37 133 UNTRUSTED_Relay 3240 5.13 14.21 1.36 134 XMGappySubj_01 3155 0.98 0.14 1.33 135 XM_E_Blogspot 3144 1.01 0.26 1.32 136 T_XMDrugObfuBody_08 3126 1.80 2.98 1.32 137 TVD_SPACE_RATIO 3092 1.02 0.34 1.30 138 BOTNET 3009 4.49 12.25 1.27 139 TR_XM_SpammyWords2 2950 3.89 10.30 1.24 140 XM_B_Phish66 2789 1.87 3.54 1.17 141 XMSubMetaSxObfu_03 2777 0.93 0.35 1.17 142 RELAYCOUNTRY_CA 2734 2.65 6.25 1.15 143 RCVD_IN_RP_SAFE 2681 1.07 0.95 1.13 144 XMSexyCombo_01 2627 1.31 1.80 1.11 145 XM_B_Unsub2 2564 1.29 1.79 1.08 146 XMDiploma_00 2561 1.28 1.78 1.08 147 XM_OfRef6 2533 1.65 3.04 1.07 148 XM_B_Investor 2514 1.63 3.00 1.06 149 XMBody_95 2487 0.77 0.10 1.05 150 TooManyTo_003 2471 1.02 0.98 1.04 151 TR_XM_MaxUnsub 2462 2.53 6.14 1.04 152 T_TooManySym_03 2435 0.85 0.44 1.02 153 RCVD_IN_RP_CERTIFIED 2399 0.93 0.74 1.01 154 XMSubMetaI_00 2315 1.22 1.81 0.97 155 XMBdyGiftCard01 2277 1.03 1.19 0.96 156 RCVD_IN_MSPIKE_BL 2218 2.58 6.56 0.93 157 TR_XM_MSPIKECOMBO 2215 2.57 6.51 0.93 158 XM_UB50 2190 2.42 6.03 0.92 159 DKIM_ADSP_CUSTOM_MED 2164 0.92 0.94 0.91 160 HTML_IMAGE_ONLY_20 2010 0.76 0.56 0.85 161 TooManyTo_004 1968 0.84 0.85 0.83 162 XMBrknScrpt_02 1936 1.08 1.73 0.81 163 XMSexyCombo_04 1896 0.78 0.74 0.80 164 XM_H_Long_From02 1895 0.91 1.17 0.80 165 TR_MetaPhish_Combo_01 1796 0.87 1.15 0.76 166 XM_B_COPY_HTML 1747 0.78 0.89 0.73 167 T_MANY_PILL_PRICE 1737 0.52 0.01 0.73 168 XM_shorewaves_Whitelist 1686 0.50 0.00 0.71 169 TooManyTo_005 1681 0.74 0.82 0.71 170 RELAYCOUNTRY_GB 1631 0.84 1.20 0.69 171 RCVD_IN_BL_SPAMCOP_NET 1590 3.11 9.01 0.67 172 XMHTML_After_End 1573 0.77 1.04 0.66 173 XM_H_PHPMailer 1506 0.67 0.75 0.63 174 XM_ProductURIs 1501 0.84 1.35 0.63 175 XMPhish30 1487 0.85 1.40 0.63 176 HELO_NODOT 1461 0.54 0.34 0.61 177 HELO_NO_DOMAIN 1461 0.53 0.34 0.61 178 MPART_ALT_DIFF_COUNT 1433 0.70 0.94 0.60 179 XMCapTrack 1398 0.49 0.27 0.59 180 HTML_TAG_BALANCE_BODY 1387 0.72 1.04 0.58 181 T_XMDrugObfuBody_00 1374 0.85 1.50 0.58 182 XM_B_COVIDMETA 1339 0.58 0.62 0.56 183 HTTPS_HTTP_MISMATCH 1316 0.60 0.72 0.55 184 USER_IN_WELCOMELIST 1298 0.39 0.00 0.55 185 USER_IN_WHITELIST 1298 0.39 0.00 0.55 186 XMHTMLBadTable_001 1259 0.70 1.12 0.53 187 T_FILL_THIS_FORM_SHORT 1245 1.23 2.95 0.52 188 THIS_AD 1240 0.79 1.45 0.52 189 RDNS_DYNAMIC 1233 0.58 0.73 0.52 190 XMNoVowels 1222 0.47 0.35 0.51 191 XM_D_tchamptons_WL 1221 0.37 0.01 0.51 192 NML_ADSP_CUSTOM_MED 1217 0.58 0.73 0.51 193 TR_MSPIKEBAYES00 1216 0.36 0.01 0.51 194 RCVD_IN_MSPIKE_L3 1214 1.27 3.08 0.51 195 XM_ShortIntro_01 1213 0.70 1.16 0.51 196 T_XMHurry_00 1208 0.71 1.21 0.51 197 XM_B_DNDMA 1189 0.61 0.87 0.50 198 URI_TRY_3LD 1187 0.61 0.87 0.50 199 XM_B_SpammyWords4 1167 0.86 1.75 0.49 200 FORGED_GMAIL_RCVD 1159 0.57 0.79 0.49 ----------------------------------------------------------------------