Email: 487997 Autolearn: 0 AvgScore: 2.91 AvgScanTime: 1.11 sec Spam: 139742 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.25 sec Ham: 348255 Autolearn: 0 AvgScore: -1.67 AvgScanTime: 1.06 sec Time Spent Running SA: 150.96 hours Time Spent Processing Spam: 48.57 hours Time Spent Processing Ham: 102.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133103 87.80 95.25 84.81 2 DKIM_SIGNED 115095 73.21 82.36 69.54 3 RELAYCOUNTRY_US 111423 78.35 79.73 77.79 4 XM_DK_Pass 110050 71.17 78.75 68.13 5 DKIM_VALID 109722 70.35 78.52 67.07 6 XM_B_Unicode 107609 68.01 77.01 64.41 7 DCC_CHECK 96675 41.12 69.18 29.86 8 XM_B_SpammyWords 91953 49.87 65.80 43.47 9 XMListUnsubscribeExists 89204 48.56 63.83 42.43 10 DKIM_VALID_AU 79203 53.48 56.68 52.19 11 BAYES_50 58701 50.90 42.01 54.47 12 XM_B_Unicode3 56921 38.61 40.73 37.76 13 XM_DK_Undo_02 55647 16.31 39.82 6.88 14 XM_B_SpammyWords2 49174 24.12 35.19 19.68 15 LOC_TINY_FONT_1 48350 24.20 34.60 20.03 16 MIME_HTML_ONLY 46951 23.21 33.60 19.04 17 BAYES_99 46038 13.40 32.94 5.55 18 TR_XM_DKIM_Undo 43437 12.26 31.08 4.71 19 FVGT_m_MULTI_ODD 43421 24.62 31.07 22.03 20 DCC_CHECK_NEGATIVE 43005 58.83 30.77 70.09 21 HTML_FONT_LOW_CONTRAST 42843 27.50 30.66 26.24 22 DKIM_VALID_EF 39815 27.63 28.49 27.28 23 RCVD_IN_MSPIKE_H2 37758 22.26 27.02 20.35 24 T_KAM_HTML_FONT_INVALID 37174 20.24 26.60 17.68 25 BAYES_999 36595 10.72 26.19 4.51 26 XMSubLong 32393 22.38 23.18 22.06 27 TR_DCC_Bayes_99 31981 7.88 22.89 1.86 28 T_TM2_M_HEADER_IN_MSG 30296 28.93 21.68 31.84 29 XM_Body_Dirty_Words 29864 14.13 21.37 11.23 30 RELAYCOUNTRY_META 29797 8.56 21.32 3.44 31 RCVD_IN_MSPIKE_WL 25506 24.46 18.25 26.95 32 FSL_BULK_SIG 23271 7.07 16.65 3.23 33 XM_B_Unsub 21085 13.76 15.09 13.23 34 XM_Multi_Part_URI 20787 12.51 14.88 11.56 35 BOTNET_IPINHOSTNAME 20424 7.26 14.62 4.31 36 LOTS_OF_MONEY 18816 8.96 13.46 7.15 37 UNPARSEABLE_RELAY 18791 9.09 13.45 7.35 38 BOTNET 18673 4.90 13.36 1.50 39 TR_XM_UnparsRelay 18376 7.80 13.15 5.66 40 XM_B_SpammyWords3 16913 7.07 12.10 5.05 41 UNTRUSTED_Relay 16774 4.28 12.00 1.18 42 RCVD_IN_MSPIKE_H3 16425 14.21 11.75 15.20 43 TR_XM_SpammyRelay 16182 4.31 11.58 1.40 44 TR_XM_SpammyWords4 16128 6.57 11.54 4.57 45 XMSexyCombo_05 13909 5.04 9.95 3.07 46 RCVD_IN_BL_SPAMCOP_NET 13765 3.26 9.85 0.62 47 RCVD_IN_MSPIKE_BL 13103 3.51 9.38 1.16 48 TR_XM_MSPIKECOMBO 13020 3.50 9.32 1.16 49 TR_XM_SpammyWords2 12805 3.23 9.16 0.86 50 XM_Evil_Numbers_Gen 12410 7.71 8.88 7.24 51 HTML_IMAGE_RATIO_02 11782 6.73 8.43 6.05 52 XM_UncommonTLD01 11639 4.88 8.33 3.49 53 XM_SendGrid 11192 6.29 8.01 5.61 54 BAYES_80 10845 5.16 7.76 4.11 55 BAYES_60 10582 8.35 7.57 8.66 56 T_REMOTE_IMAGE 10577 4.74 7.57 3.60 57 XM_B_SpammyTLD 10204 3.39 7.30 1.82 58 MPART_ALT_DIFF 9593 5.42 6.86 4.84 59 TR_XM_PhishingBody 9338 4.13 6.68 3.10 60 LotsOfNums_01 8844 7.74 6.33 8.31 61 TR_XM_MaxUnsub 8841 2.36 6.33 0.77 62 XM_H_Long_From01 8835 5.24 6.32 4.80 63 XMSubMetaSx_00 8776 4.77 6.28 4.16 64 HTML_MIME_NO_HTML_TAG 8698 3.26 6.22 2.07 65 RCVD_IN_MSPIKE_H4 8556 9.06 6.12 10.24 66 TooManyTo_001 8191 10.23 5.86 11.99 67 RCVD_IN_MSPIKE_L5 8017 1.66 5.74 0.02 68 RELAYCOUNTRY_CA 7963 2.21 5.70 0.81 69 TR_XM_SpammyWords3 7909 1.96 5.66 0.47 70 XM_UB50 7740 2.13 5.54 0.76 71 XM_B_Phish_Phrases 7700 4.06 5.51 3.48 72 TR_XM_DK_SendGrid 7394 4.03 5.29 3.52 73 KHOP_HELO_FCRDNS 7177 2.83 5.14 1.91 74 PDS_OTHER_BAD_TLD 6811 1.51 4.87 0.17 75 XM_SPF_SoftFail 6763 3.14 4.84 2.46 76 XM_B_Investor 6759 2.30 4.84 1.28 77 XMStrtUSub 6208 4.63 4.44 4.71 78 TR_XM_SPAMCOP 6161 1.39 4.41 0.18 79 BAYES_95 6056 3.16 4.33 2.69 80 XMNumbers 5827 3.72 4.17 3.55 81 HTML_IMAGE_RATIO_04 5652 4.85 4.04 5.18 82 MIME_HTML_MOSTLY 5520 2.71 3.95 2.21 83 MIME_HTML_ONLY_MULTI 5440 3.47 3.89 3.30 84 DKIM_INVALID 5373 2.87 3.84 2.47 85 XM_B_Phish66 5365 2.53 3.84 2.00 86 T_XMDrugObfuBody_14 5297 2.69 3.79 2.25 87 TR_XM_SpammyWords5 5252 2.14 3.76 1.49 88 MIME_QP_LONG_LINE 5241 7.37 3.75 8.83 89 XM_DIRTYINTL 5215 1.27 3.73 0.28 90 URI_PHP_REDIR 5202 1.07 3.72 0.01 91 TM2_M_VERY_LONG_WORD 5143 2.19 3.68 1.59 92 RCVD_IN_VALIDITY_RPBL 5133 1.07 3.67 0.02 93 SpammyFromTLD_01 5006 1.55 3.58 0.73 94 RCVD_IN_VALIDITY_SAFE 4977 4.08 3.56 4.28 95 XM_DK_Undo_01 4622 2.03 3.31 1.51 96 T_XMDrugObfuBody_08 4615 2.20 3.30 1.76 97 BOTNET_NORDNS 4612 0.96 3.30 0.02 98 RCVD_IN_PSBL 4483 1.04 3.21 0.16 99 RCVD_IN_VALIDITY_CERTIFIED 4264 3.58 3.05 3.79 100 XM_OfRef6 4213 1.55 3.01 0.96 101 URI_NOVOWEL 4176 2.49 2.99 2.30 102 T_TooManySym_01 4043 6.06 2.89 7.33 103 HTML_IMAGE_RATIO_06 4026 3.19 2.88 3.31 104 T_FILL_THIS_FORM_SHORT 4016 1.53 2.87 0.99 105 TM2_M_URI_OPT_OUT 3933 5.12 2.81 6.04 106 RCVD_IN_IADB_LISTED 3912 4.22 2.80 4.78 107 ALL_TRUSTED 3780 14.93 2.70 19.84 108 TR_XM_MSPIKECOMBO2 3454 0.84 2.47 0.18 109 XM_UB99 3450 0.71 2.47 0.00 110 RELAYCOUNTRY_FR 3414 0.86 2.44 0.22 111 HTML_IMAGE_RATIO_08 3412 2.01 2.44 1.83 112 XMBody_17 3392 0.98 2.43 0.40 113 MAILING_LIST_MULTI 3386 3.52 2.42 3.96 114 T_HTML_TAG_BALANCE_CENTER 3358 0.76 2.40 0.11 115 GOOG_STO_IMG_HTML 3326 0.69 2.38 0.01 116 SpammyFromTLD_02 3271 0.82 2.34 0.21 117 RCVD_IN_IADB_SPF 3270 3.72 2.34 4.28 118 SUBJ_ALL_CAPS 3260 2.08 2.33 1.97 119 HTML_IMAGE_ONLY_08 3142 0.74 2.25 0.13 120 XM_CamelCaseFrm001 3139 1.89 2.25 1.75 121 FROM_EXCESS_BASE64 3114 2.47 2.23 2.56 122 TR_XM_SB_Phish 3098 1.96 2.22 1.86 123 XM_B_Unsub2 3051 1.76 2.18 1.59 124 XMDiploma_00 3040 1.63 2.18 1.41 125 RCVD_IN_MSPIKE_L3 3039 0.94 2.17 0.44 126 RCVD_IN_IADB_DK 2965 3.27 2.12 3.74 127 XM_GoogleGroups 2950 1.68 2.11 1.50 128 RCVD_IN_IADB_SENDERID 2914 3.37 2.09 3.89 129 XMSexyCombo_01 2901 1.27 2.08 0.95 130 TR_XM_PHPDW 2899 0.89 2.07 0.42 131 BAYES_40 2870 4.36 2.05 5.28 132 TR_XM_PHPForged 2801 0.83 2.00 0.36 133 USER_IN_DEF_DKIM_WL 2785 8.41 1.99 10.98 134 XM_UB999 2773 0.57 1.98 0.00 135 XMBrknScrpt_02 2773 1.25 1.98 0.96 136 XMSubPhish11 2760 1.86 1.98 1.81 137 TR_XM_FormFill2 2738 0.83 1.96 0.37 138 XM_B_SpammyWords4 2735 0.93 1.96 0.51 139 XM_H_PHPOS 2724 0.81 1.95 0.36 140 XM_URI_RBL 2707 0.62 1.94 0.10 141 XM_B_SEO 2605 0.63 1.86 0.13 142 MIXED_HREF_CASE 2574 0.53 1.84 0.00 143 MIXED_CENTER_CASE 2574 0.53 1.84 0.00 144 XM_B_COVIDMETA 2567 1.04 1.84 0.72 145 MIXED_IMG_CASE 2561 0.53 1.83 0.00 146 MIXED_AREA_CASE 2530 0.52 1.81 0.00 147 T_XMDrugObfuBody_00 2508 0.92 1.79 0.57 148 MIXED_FONT_CASE 2494 0.51 1.78 0.00 149 TR_XM_SEO4 2491 0.57 1.78 0.08 150 URI_HEX 2474 1.41 1.77 1.26 151 BODY_URI_ONLY 2449 0.52 1.75 0.02 152 RCVD_IN_IADB_VOUCHED 2434 2.64 1.74 3.00 153 XM_H_Undi_Recip 2427 0.65 1.74 0.21 154 XMHTML_After_End 2316 0.96 1.66 0.68 155 TR_XM_NoHeaderRelay 2305 0.60 1.65 0.18 156 HTTPS_HTTP_MISMATCH 2219 1.03 1.59 0.81 157 TR_XM_COVIDMETA4 2193 0.58 1.57 0.19 158 XMLngstWrd_00 2169 0.91 1.55 0.65 159 BAYES_20 2154 3.64 1.54 4.49 160 XMLngstWrd_01 2098 0.85 1.50 0.59 161 LOCALPART_IN_SUBJECT 2083 0.45 1.49 0.03 162 RELAYCOUNTRY_DE 2081 0.60 1.49 0.25 163 XMLngstWrd_02 2038 0.79 1.46 0.52 164 XMStockSpam_06 2026 1.25 1.45 1.17 165 DIET_1 1983 0.59 1.42 0.26 166 XMBdyGiftCard01 1968 0.92 1.41 0.73 167 RCVD_IN_MSPIKE_L4 1964 0.90 1.41 0.70 168 TR_MetaPhish_Combo_01 1955 0.89 1.40 0.69 169 HTML_FONT_SIZE_LARGE 1923 0.47 1.38 0.11 170 TR_LOTS_OF_MONEY3 1914 0.54 1.37 0.21 171 URIBL_BLACK 1897 0.45 1.36 0.09 172 XM_B_DNDMA 1896 0.66 1.36 0.38 173 DKIM_ADSP_CUSTOM_MED 1889 1.06 1.35 0.94 174 TR_XM_BayesRelay 1869 0.38 1.34 0.00 175 TR_Mismatch_TLD_02 1858 0.45 1.33 0.09 176 TR_Symld_Words 1846 1.72 1.32 1.87 177 T_XMHurry_00 1838 0.73 1.32 0.49 178 TR_Mismatch_TLD_01 1803 0.57 1.29 0.28 179 XMPhish30 1801 0.68 1.29 0.44 180 XMMoneyMeta_00 1798 0.77 1.29 0.57 181 XM_UB60 1766 0.42 1.26 0.08 182 RELAYCOUNTRY_NL 1761 0.48 1.26 0.16 183 TR_XM_FormFill 1760 0.38 1.26 0.02 184 FROM_SUSPICIOUS_NTLD 1689 0.38 1.21 0.05 185 ANY_BOUNCE_MESSAGE 1632 2.37 1.17 2.85 186 XMSubMetaI_00 1632 0.72 1.17 0.54 187 BOUNCE_MESSAGE 1631 2.37 1.17 2.85 188 RELAYCOUNTRY_RU 1611 0.35 1.15 0.02 189 TR_BOTNET_NEGATE 1597 0.56 1.14 0.33 190 URI_GOOG_STO_SPAMMY 1589 0.33 1.14 0.00 191 XMLngstWrd_03 1579 0.63 1.13 0.43 192 GOOG_STO_NOIMG_HTML 1578 0.33 1.13 0.00 193 HTML_FONT_SIZE_HUGE 1577 0.36 1.13 0.05 194 XM_RXBody 1564 1.29 1.12 1.36 195 RELAYCOUNTRY_GB 1561 0.94 1.12 0.86 196 XMGenDplmaNmb 1554 0.82 1.11 0.71 197 FROM_SUSPICIOUS_NTLD_FP 1545 0.35 1.11 0.05 198 URIBL_DBL_SPAM 1536 0.32 1.10 0.01 199 XM_H_PHPMailer 1529 0.72 1.09 0.57 200 XMCapTrack 1528 1.19 1.09 1.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295350 87.80 95.25 84.81 2 RELAYCOUNTRY_US 270924 78.35 79.73 77.79 3 DCC_CHECK_NEGATIVE 244106 58.83 30.77 70.09 4 DKIM_SIGNED 242183 73.21 82.36 69.54 5 XM_DK_Pass 237270 71.17 78.75 68.13 6 DKIM_VALID 233573 70.35 78.52 67.07 7 XM_B_Unicode 224295 68.01 77.01 64.41 8 BAYES_50 189680 50.90 42.01 54.47 9 DKIM_VALID_AU 181763 53.48 56.68 52.19 10 XM_B_SpammyWords 151391 49.87 65.80 43.47 11 XMListUnsubscribeExists 147773 48.56 63.83 42.43 12 XM_B_Unicode3 131510 38.61 40.73 37.76 13 T_TM2_M_HEADER_IN_MSG 110867 28.93 21.68 31.84 14 DCC_CHECK 103983 41.12 69.18 29.86 15 DKIM_VALID_EF 95020 27.63 28.49 27.28 16 RCVD_IN_MSPIKE_WL 93867 24.46 18.25 26.95 17 HTML_FONT_LOW_CONTRAST 91365 27.50 30.66 26.24 18 XMSubLong 76811 22.38 23.18 22.06 19 FVGT_m_MULTI_ODD 76704 24.62 31.07 22.03 20 RCVD_IN_MSPIKE_H2 70882 22.26 27.02 20.35 21 LOC_TINY_FONT_1 69769 24.20 34.60 20.03 22 ALL_TRUSTED 69087 14.93 2.70 19.84 23 XM_B_SpammyWords2 68533 24.12 35.19 19.68 24 MIME_HTML_ONLY 66320 23.21 33.60 19.04 25 T_KAM_HTML_FONT_INVALID 61577 20.24 26.60 17.68 26 RCVD_IN_MSPIKE_H3 52918 14.21 11.75 15.20 27 XM_B_Unsub 46084 13.76 15.09 13.23 28 BAYES_00 42673 9.01 0.94 12.25 29 TooManyTo_001 41755 10.23 5.86 11.99 30 XM_Multi_Part_URI 40252 12.51 14.88 11.56 31 XM_Body_Dirty_Words 39097 14.13 21.37 11.23 32 USER_IN_DEF_DKIM_WL 38250 8.41 1.99 10.98 33 RCVD_IN_MSPIKE_H4 35657 9.06 6.12 10.24 34 MIME_QP_LONG_LINE 30742 7.37 3.75 8.83 35 BAYES_60 30174 8.35 7.57 8.66 36 LotsOfNums_01 28928 7.74 6.33 8.31 37 XM_DKIMWhitelistDomains 27125 5.61 0.18 7.79 38 UNPARSEABLE_RELAY 25581 9.09 13.45 7.35 39 T_TooManySym_01 25522 6.06 2.89 7.33 40 XM_Evil_Numbers_Gen 25214 7.71 8.88 7.24 41 LOTS_OF_MONEY 24899 8.96 13.46 7.15 42 XM_DK_Undo_02 23965 16.31 39.82 6.88 43 IN_ZIMBRA_NJ_WHITELIST 23481 4.85 0.13 6.74 44 TR_XM_DK_Bayes 22341 4.73 0.54 6.42 45 TR_XM_DK_Bayes1 21764 4.61 0.54 6.25 46 HTML_IMAGE_RATIO_02 21073 6.73 8.43 6.05 47 TM2_M_URI_OPT_OUT 21041 5.12 2.81 6.04 48 TR_XM_UnparsRelay 19697 7.80 13.15 5.66 49 XM_SendGrid 19521 6.29 8.01 5.61 50 BAYES_99 19338 13.40 32.94 5.55 51 TR_XM_DK_Bayes2 18717 3.95 0.41 5.37 52 BAYES_40 18386 4.36 2.05 5.28 53 HTML_IMAGE_RATIO_04 18023 4.85 4.04 5.18 54 XM_B_SpammyWords3 17577 7.07 12.10 5.05 55 MPART_ALT_DIFF 16867 5.42 6.86 4.84 56 XM_H_Long_From01 16718 5.24 6.32 4.80 57 RCVD_IN_IADB_LISTED 16664 4.22 2.80 4.78 58 TR_XM_DKIM_Undo 16410 12.26 31.08 4.71 59 XMStrtUSub 16401 4.63 4.44 4.71 60 XM_PDF 16172 3.57 0.90 4.64 61 TR_XM_SpammyWords4 15914 6.57 11.54 4.57 62 BAYES_999 15705 10.72 26.19 4.51 63 BAYES_20 15630 3.64 1.54 4.49 64 T_TooManySym_02 15132 3.32 0.76 4.35 65 BOTNET_IPINHOSTNAME 15020 7.26 14.62 4.31 66 RCVD_IN_VALIDITY_SAFE 14909 4.08 3.56 4.28 67 RCVD_IN_IADB_SPF 14894 3.72 2.34 4.28 68 XMSubMetaSx_00 14493 4.77 6.28 4.16 69 BAYES_80 14316 5.16 7.76 4.11 70 MAILING_LIST_MULTI 13788 3.52 2.42 3.96 71 RCVD_IN_IADB_SENDERID 13552 3.37 2.09 3.89 72 RCVD_IN_VALIDITY_CERTIFIED 13192 3.58 3.05 3.79 73 RCVD_IN_IADB_DK 13009 3.27 2.12 3.74 74 XM_H_Trusted_IP 12690 2.60 0.00 3.64 75 T_REMOTE_IMAGE 12530 4.74 7.57 3.60 76 XMNumbers 12346 3.72 4.17 3.55 77 TR_XM_DK_SendGrid 12266 4.03 5.29 3.52 78 XM_UncommonTLD01 12152 4.88 8.33 3.49 79 XM_B_Phish_Phrases 12120 4.06 5.51 3.48 80 RELAYCOUNTRY_META 11965 8.56 21.32 3.44 81 SHORT_URI_2 11635 2.55 0.58 3.34 82 HTML_IMAGE_RATIO_06 11529 3.19 2.88 3.31 83 MIME_HTML_ONLY_MULTI 11484 3.47 3.89 3.30 84 FSL_BULK_SIG 11250 7.07 16.65 3.23 85 TR_XM_PhishingBody 10813 4.13 6.68 3.10 86 XMSexyCombo_05 10704 5.04 9.95 3.07 87 RCVD_IN_IADB_VOUCHED 10451 2.64 1.74 3.00 88 ANY_BOUNCE_MESSAGE 9916 2.37 1.17 2.85 89 BOUNCE_MESSAGE 9915 2.37 1.17 2.85 90 BAYES_95 9362 3.16 4.33 2.69 91 FROM_EXCESS_BASE64 8923 2.47 2.23 2.56 92 BAYES_05 8694 2.00 0.78 2.50 93 DKIM_INVALID 8610 2.87 3.84 2.47 94 XM_SPF_SoftFail 8582 3.14 4.84 2.46 95 TooManyTo_002 8288 1.98 0.97 2.38 96 URI_NOVOWEL 7998 2.49 2.99 2.30 97 T_XMDrugObfuBody_14 7832 2.69 3.79 2.25 98 MIME_HTML_MOSTLY 7702 2.71 3.95 2.21 99 HTML_MIME_NO_HTML_TAG 7218 3.26 6.22 2.07 100 XM_B_Phish66 6958 2.53 3.84 2.00 101 RCVD_IN_IADB_OPTIN 6943 1.73 1.07 1.99 102 HELO_NO_DOMAIN 6894 1.55 0.49 1.98 103 HELO_NODOT 6894 1.55 0.49 1.98 104 SUBJ_ALL_CAPS 6874 2.08 2.33 1.97 105 KHOP_HELO_FCRDNS 6652 2.83 5.14 1.91 106 TVD_RCVD_IP 6627 1.44 0.29 1.90 107 XMNoVowels 6590 1.48 0.46 1.89 108 INVALID_MSGID 6537 1.43 0.32 1.88 109 TR_Symld_Words 6524 1.72 1.32 1.87 110 TR_DCC_Bayes_99 6493 7.88 22.89 1.86 111 TR_XM_SB_Phish 6473 1.96 2.22 1.86 112 HTML_IMAGE_RATIO_08 6381 2.01 2.44 1.83 113 XM_B_SpammyTLD 6355 3.39 7.30 1.82 114 XMSubPhish11 6309 1.86 1.98 1.81 115 T_XMDrugObfuBody_08 6143 2.20 3.30 1.76 116 MSGID_NOFQDN1 6123 1.28 0.09 1.76 117 XM_CamelCaseFrm001 6092 1.89 2.25 1.75 118 IN_HORDE_ADDRESS_BOOK 6087 1.27 0.07 1.75 119 TO_MALFORMED 5791 1.19 0.01 1.66 120 XM_B_Unsub2 5553 1.76 2.18 1.59 121 TM2_M_VERY_LONG_WORD 5530 2.19 3.68 1.59 122 TooManyTo_003 5469 1.36 0.84 1.57 123 RCVD_IN_MSPIKE_H5 5292 1.19 0.38 1.52 124 XM_DK_Undo_01 5264 2.03 3.31 1.51 125 XM_GoogleGroups 5237 1.68 2.11 1.50 126 BOTNET 5215 4.90 13.36 1.50 127 TR_XM_SpammyWords5 5174 2.14 3.76 1.49 128 T_TooManySym_03 5116 1.13 0.28 1.47 129 XMGappySubj_01 4930 1.13 0.42 1.42 130 XMDiploma_00 4905 1.63 2.18 1.41 131 TR_XM_SpammyRelay 4867 4.31 11.58 1.40 132 XM_RXBody 4746 1.29 1.12 1.36 133 XM_B_Investor 4471 2.30 4.84 1.28 134 TVD_SPACE_RATIO 4465 0.95 0.11 1.28 135 XMSubNoVowel 4437 1.22 1.08 1.27 136 HTML_FONT_FACE_BAD 4426 1.11 0.71 1.27 137 URI_HEX 4398 1.41 1.77 1.26 138 DKIM_ADSP_NXDOMAIN 4356 1.07 0.62 1.25 139 XMCapTrack 4285 1.19 1.09 1.23 140 UNTRUSTED_Relay 4101 4.28 12.00 1.18 141 XMStockSpam_06 4085 1.25 1.45 1.17 142 RCVD_IN_MSPIKE_BL 4040 3.51 9.38 1.16 143 TR_XM_MSPIKECOMBO 4039 3.50 9.32 1.16 144 TooManyTo_004 3951 1.02 0.72 1.13 145 XMBSHREFv2 3453 0.76 0.20 0.99 146 T_FILL_THIS_FORM_SHORT 3435 1.53 2.87 0.99 147 XM_H_Long_From02 3381 0.98 1.01 0.97 148 XM_OfRef6 3336 1.55 3.01 0.96 149 XMBrknScrpt_02 3329 1.25 1.98 0.96 150 XMSexyCombo_01 3314 1.27 2.08 0.95 151 DKIM_ADSP_CUSTOM_MED 3276 1.06 1.35 0.94 152 TooManyTo_005 3223 0.85 0.67 0.93 153 RCVD_IN_RP_SAFE 3081 0.82 0.64 0.88 154 RELAYCOUNTRY_GB 3010 0.94 1.12 0.86 155 TR_XM_SpammyWords2 2980 3.23 9.16 0.86 156 XM_E_Blogspot 2948 0.66 0.19 0.85 157 T_TooManySym_04 2913 0.64 0.15 0.84 158 HTTPS_HTTP_MISMATCH 2814 1.03 1.59 0.81 159 RELAYCOUNTRY_CA 2807 2.21 5.70 0.81 160 RCVD_IN_RP_CERTIFIED 2761 0.72 0.53 0.79 161 TR_XM_MaxUnsub 2681 2.36 6.33 0.77 162 XM_ShortIntro_01 2663 0.71 0.59 0.76 163 XM_UB50 2648 2.13 5.54 0.76 164 XMBdyGiftCard01 2541 0.92 1.41 0.73 165 SpammyFromTLD_01 2540 1.55 3.58 0.73 166 XM_B_COVIDMETA 2519 1.04 1.84 0.72 167 XMGenDplmaNmb 2464 0.82 1.11 0.71 168 RCVD_IN_MSPIKE_L4 2423 0.90 1.41 0.70 169 SHORTENED_URL_HREF 2419 0.56 0.23 0.69 170 TR_MetaPhish_Combo_01 2412 0.89 1.40 0.69 171 XMBody_95 2403 0.53 0.14 0.69 172 XMHTML_After_End 2384 0.96 1.66 0.68 173 HTML_TAG_BALANCE_BODY 2364 0.77 0.98 0.68 174 XMLngstWrd_00 2281 0.91 1.55 0.65 175 HTML_IMAGE_ONLY_20 2271 0.58 0.41 0.65 176 RCVD_IN_BL_SPAMCOP_NET 2143 3.26 9.85 0.62 177 T_Symld_Words_02 2129 0.67 0.81 0.61 178 FROM_GOV_DKIM_AU 2112 0.47 0.13 0.61 179 URI_TRY_3LD 2086 0.72 1.01 0.60 180 XMLngstWrd_01 2070 0.85 1.50 0.59 181 NML_ADSP_CUSTOM_MED 2065 0.64 0.76 0.59 182 XM_B_COPY_HTML 2048 0.59 0.59 0.59 183 XMSexyCombo_04 2014 0.64 0.79 0.58 184 T_XMDrugObfuBody_00 1998 0.92 1.79 0.57 185 XM_H_PHPMailer 1993 0.72 1.09 0.57 186 XMMoneyMeta_00 1976 0.77 1.29 0.57 187 SHORT_HELO_AND_INLINE_IMAGE 1968 0.43 0.09 0.57 188 T_OBFU_PDF_ATTACH 1953 0.44 0.14 0.56 189 XMSubMetaI_00 1888 0.72 1.17 0.54 190 XMLngstWrd_02 1809 0.79 1.46 0.52 191 XMSubMetaSxObfu_02 1790 0.46 0.33 0.51 192 XM_B_SpammyWords4 1781 0.93 1.96 0.51 193 XM_ProductURIs 1762 0.66 1.03 0.51 194 PLING_QUERY 1761 0.65 1.02 0.51 195 HTML_IMAGE_ONLY_32 1750 0.42 0.23 0.50 196 RCVD_IN_SORBS_DUL 1740 0.41 0.19 0.50 197 TR_MSPIKEBAYES00 1725 0.36 0.02 0.50 198 T_XMHurry_00 1722 0.73 1.32 0.49 199 SHORT_URI_3 1681 0.38 0.12 0.48 200 FORGED_GMAIL_RCVD 1678 0.58 0.81 0.48 ----------------------------------------------------------------------