Email: 296039 Autolearn: 0 AvgScore: 2.39 AvgScanTime: 1.23 sec Spam: 89308 Autolearn: 0 AvgScore: 14.01 AvgScanTime: 1.38 sec Ham: 206731 Autolearn: 0 AvgScore: -2.63 AvgScanTime: 1.17 sec Time Spent Running SA: 101.29 hours Time Spent Processing Spam: 34.19 hours Time Spent Processing Ham: 67.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84306 86.43 94.40 82.99 2 DKIM_SIGNED 79343 75.69 88.84 70.01 3 XM_DK_Pass 78069 74.64 87.42 69.12 4 DKIM_VALID 76926 73.95 86.14 68.69 5 XM_B_Unicode 69247 72.59 77.54 70.45 6 RELAYCOUNTRY_US 69024 78.54 77.29 79.08 7 DCC_CHECK 62487 45.70 69.97 35.22 8 XMListUnsubscribeExists 62093 53.42 69.53 46.46 9 DKIM_VALID_AU 59636 59.72 66.78 56.67 10 XM_B_SpammyWords 56460 49.67 63.22 43.81 11 XM_DK_Undo_02 41690 19.58 46.68 7.88 12 XM_B_Unicode3 41148 44.87 46.07 44.35 13 LOC_TINY_FONT_1 34477 29.81 38.60 26.01 14 BAYES_50 34133 48.20 38.22 52.51 15 BAYES_99 33431 16.28 37.43 7.14 16 TR_XM_DKIM_Undo 32175 14.83 36.03 5.67 17 XM_B_SpammyWords2 31836 24.93 35.65 20.30 18 HTML_FONT_LOW_CONTRAST 30282 30.35 33.91 28.81 19 FVGT_m_MULTI_ODD 29541 24.58 33.08 20.90 20 MIME_HTML_ONLY 27966 28.46 31.31 27.22 21 DCC_CHECK_NEGATIVE 26787 54.26 29.99 64.75 22 BAYES_999 26753 13.14 29.96 5.88 23 DKIM_VALID_EF 25156 27.03 28.17 26.54 24 RELAYCOUNTRY_META 23306 10.05 26.10 3.12 25 T_KAM_HTML_FONT_INVALID 23259 19.96 26.04 17.33 26 RCVD_IN_MSPIKE_WL 22262 27.95 24.93 29.26 27 TR_DCC_Bayes_99 21551 9.17 24.13 2.70 28 RCVD_IN_MSPIKE_H2 21262 20.25 23.81 18.72 29 XM_Body_Dirty_Words 19103 15.93 21.39 13.57 30 XMSubLong 19002 21.40 21.28 21.46 31 XM_Multi_Part_URI 16102 14.53 18.03 13.01 32 T_TM2_M_HEADER_IN_MSG 15342 19.32 17.18 20.24 33 RCVD_IN_MSPIKE_H3 15021 16.27 16.82 16.04 34 XM_B_Unsub 14309 13.79 16.02 12.82 35 TR_XM_BayesUnsub 14060 10.55 15.74 8.31 36 UNPARSEABLE_RELAY 13472 11.00 15.08 9.23 37 TR_XM_UnparsRelay 13223 9.57 14.81 7.31 38 MPART_ALT_DIFF 12696 11.49 14.22 10.31 39 TR_XM_SpammyWords2 11833 5.17 13.25 1.68 40 XM_B_SpammyWords3 11723 7.52 13.13 5.10 41 UNTRUSTED_Relay 11662 4.78 13.06 1.20 42 TR_XM_SpammyRelay 10584 4.51 11.85 1.34 43 RCVD_IN_BL_SPAMCOP_NET 10246 3.98 11.47 0.75 44 BOTNET 10008 4.28 11.21 1.29 45 XMSexyCombo_05 9734 7.03 10.90 5.36 46 BOTNET_IPINHOSTNAME 9587 7.27 10.73 5.78 47 LOTS_OF_MONEY 9391 8.19 10.52 7.19 48 XM_UncommonTLD01 8882 6.74 9.95 5.35 49 FSL_BULK_SIG 8646 6.21 9.68 4.71 50 TR_XM_SpammyWords4 7800 6.11 8.73 4.97 51 RELAYCOUNTRY_CA 7640 3.39 8.55 1.16 52 HTML_IMAGE_RATIO_02 7620 7.62 8.53 7.22 53 MIME_HTML_MOSTLY 7596 4.93 8.51 3.39 54 RCVD_IN_MSPIKE_BL 7546 3.31 8.45 1.08 55 TR_XM_MSPIKECOMBO 7489 3.29 8.39 1.08 56 BAYES_80 7372 5.86 8.25 4.83 57 TM2_M_VERY_LONG_WORD 7240 3.32 8.11 1.25 58 RCVD_IN_MSPIKE_H4 6912 10.31 7.74 11.41 59 BAYES_60 6871 9.75 7.69 10.64 60 XM_SendGrid 6756 6.80 7.56 6.47 61 XMSubMetaSx_00 6738 4.75 7.54 3.54 62 XM_Evil_Numbers_Gen 6729 8.98 7.53 9.60 63 LotsOfNums_01 6076 7.52 6.80 7.83 64 URI_NOVOWEL 5861 3.42 6.56 2.07 65 MIME_HTML_ONLY_MULTI 5829 7.29 6.53 7.62 66 XM_H_Long_From01 5611 5.07 6.28 4.55 67 TR_XM_PhishingBody 5292 3.32 5.93 2.20 68 XM_UB50 5273 2.28 5.90 0.72 69 TR_XM_SPAMCOP 5271 1.94 5.90 0.22 70 SpammyFromTLD_01 5072 1.97 5.68 0.37 71 RCVD_IN_VALIDITY_SAFE 4887 6.31 5.47 6.67 72 HTML_MIME_NO_HTML_TAG 4623 2.77 5.18 1.74 73 XMLngstWrd_00 4595 1.99 5.15 0.62 74 HTML_IMAGE_RATIO_04 4549 5.53 5.09 5.72 75 RCVD_IN_MSPIKE_L3 4538 2.22 5.08 0.99 76 XMLngstWrd_01 4499 1.91 5.04 0.56 77 XM_B_Phish_Phrases 4449 3.90 4.98 3.43 78 XMLngstWrd_02 4389 1.81 4.91 0.47 79 XM_B_SpammyTLD 4359 3.26 4.88 2.56 80 TR_XM_DK_SendGrid 4348 4.64 4.87 4.54 81 TooManyTo_001 4214 5.67 4.72 6.08 82 BAYES_95 4195 3.57 4.70 3.09 83 XMStrtUSub 4097 7.05 4.59 8.11 84 RCVD_IN_VALIDITY_CERTIFIED 4056 5.59 4.54 6.04 85 XM_GoogleGroups 3978 2.13 4.45 1.12 86 RELAYCOUNTRY_FR 3867 1.43 4.33 0.17 87 XMLngstWrd_03 3782 1.53 4.23 0.36 88 XMLngstWrd_04 3721 1.47 4.17 0.31 89 T_XMDrugObfuBody_14 3658 2.69 4.10 2.08 90 XM_DIRTYINTL 3652 1.40 4.09 0.24 91 HTML_TITLE_SUBJ_DIFF 3487 1.22 3.90 0.06 92 SpammyFromTLD_02 3414 1.26 3.82 0.15 93 UPPERCASE_75_100 3411 1.17 3.82 0.02 94 HTML_IMAGE_RATIO_06 3322 3.67 3.72 3.64 95 XM_SPF_SoftFail 3117 2.04 3.49 1.41 96 T_REMOTE_IMAGE 3057 4.07 3.42 4.35 97 TR_XM_MSPIKECOMBO2 2919 1.13 3.27 0.21 98 XM_B_Phish66 2847 1.62 3.19 0.94 99 XM_OfRef6 2818 1.53 3.16 0.83 100 XM_B_Investor 2803 1.75 3.14 1.15 101 T_TooManySym_01 2776 6.53 3.11 8.00 102 RCVD_IN_MSPIKE_L5 2761 0.95 3.09 0.03 103 RCVD_IN_VALIDITY_RPBL 2757 0.96 3.09 0.05 104 T_FILL_THIS_FORM_SHORT 2636 1.43 2.95 0.77 105 XM_UB99 2561 0.87 2.87 0.01 106 T_XMDrugObfuBody_08 2551 1.67 2.86 1.16 107 TR_XM_SpammyWords5 2496 1.68 2.79 1.20 108 DKIM_INVALID 2417 1.74 2.71 1.32 109 XMBody_17 2414 1.15 2.70 0.48 110 TR_XM_SpammyWords3 2408 1.16 2.70 0.50 111 USER_IN_DEF_DKIM_WL 2405 12.49 2.69 16.72 112 URI_NO_WWW_BIZ_CGI 2390 0.81 2.68 0.01 113 TR_XM_BayesRelay 2289 0.78 2.56 0.01 114 XM_DK_Undo_01 2210 1.53 2.47 1.12 115 HTML_IMAGE_RATIO_08 2178 2.90 2.44 3.10 116 XM_UB999 2149 0.73 2.41 0.00 117 TM2_M_URI_OPT_OUT 2111 5.76 2.36 7.23 118 BOTNET_NORDNS 2055 0.71 2.30 0.02 119 XMDiploma_00 2043 1.49 2.29 1.15 120 T_XMHurry_00 2008 1.10 2.25 0.60 121 PDS_OTHER_BAD_TLD 2004 0.96 2.24 0.40 122 XM_B_SpammyWords4 1969 1.03 2.20 0.52 123 SUBJ_ALL_CAPS 1955 1.31 2.19 0.93 124 XM_CamelCaseFrm001 1943 1.81 2.18 1.66 125 MIME_QP_LONG_LINE 1883 3.22 2.11 3.69 126 XMBdyGiftCard01 1847 1.76 2.07 1.62 127 TR_XM_MaxSPIKE 1841 0.75 2.06 0.18 128 XM_UB60 1825 0.67 2.04 0.07 129 RELAYCOUNTRY_IN 1818 0.65 2.04 0.05 130 URI_LONG_REPEAT 1783 0.60 2.00 0.00 131 XMNumbers 1772 3.90 1.98 4.73 132 FROM_EXCESS_BASE64 1743 2.56 1.95 2.83 133 URIBL_DBL_SPAM 1742 0.60 1.95 0.01 134 XMSexyCombo_01 1728 0.88 1.93 0.42 135 TR_XM_PHPDW 1671 0.87 1.87 0.43 136 XMSubNoVowel 1651 2.27 1.85 2.45 137 KHOP_HELO_FCRDNS 1632 1.30 1.83 1.08 138 TR_XM_PHPForged 1626 0.81 1.82 0.38 139 TR_XM_FormFill2 1604 0.81 1.80 0.38 140 HTML_TAG_BALANCE_BODY 1597 1.02 1.79 0.69 141 XM_H_PHPOS 1596 0.79 1.79 0.36 142 RCVD_IN_PSBL 1522 0.53 1.70 0.03 143 XM_B_Unsub2 1521 1.09 1.70 0.83 144 TR_XM_FormFill 1499 0.51 1.68 0.01 145 ALL_TRUSTED 1489 13.40 1.67 18.47 146 XMBrknScrpt_02 1469 0.92 1.64 0.61 147 TR_XM_COVIDMETA4 1469 0.62 1.64 0.17 148 XM_Body_Dirty_Words_01 1459 0.62 1.63 0.18 149 XMStockSpam_06 1452 2.21 1.63 2.47 150 XMReplyNow 1441 0.66 1.61 0.24 151 HK_RANDOM_REPLYTO 1422 0.57 1.59 0.13 152 RCVD_IN_IADB_LISTED 1414 3.10 1.58 3.76 153 TR_XM_SB_Phish 1401 3.54 1.57 4.39 154 MIME_CHARSET_FARAWAY 1368 0.60 1.53 0.20 155 MAILING_LIST_MULTI 1357 1.74 1.52 1.83 156 RELAYCOUNTRY_CN 1351 0.48 1.51 0.04 157 XM_B_REG_HTML 1284 0.82 1.44 0.56 158 XMSubPhish11 1283 3.50 1.44 4.39 159 TR_Symld_Words 1279 1.45 1.43 1.46 160 T_XMDrugObfuBody_00 1263 0.96 1.41 0.76 161 BAYES_40 1245 3.48 1.39 4.38 162 XMGenDplmaNmb 1239 0.83 1.39 0.59 163 BAYES_20 1200 2.67 1.34 3.24 164 XM_B_COVIDMETA 1197 0.89 1.34 0.69 165 SHOPIFY_IMG_NOT_RCVD_SFY 1161 0.53 1.30 0.20 166 DIET_1 1159 0.71 1.30 0.46 167 LONG_JUNK_URI 1147 0.40 1.28 0.02 168 RCVD_IN_IADB_SPF 1143 2.72 1.28 3.35 169 XM_URI_RBL 1137 0.45 1.27 0.10 170 MPART_ALT_DIFF_COUNT 1126 0.99 1.26 0.88 171 CHARSET_FARAWAY_HEADER 1106 0.41 1.24 0.05 172 XM_H_Undi_Recip 1093 0.47 1.22 0.15 173 XM_H_Long_From02 1087 1.15 1.22 1.12 174 XM_UB80 1070 0.37 1.20 0.02 175 DRUGS_ERECTILE 1048 0.36 1.17 0.01 176 THIS_AD 1045 0.63 1.17 0.40 177 URI_HEX 1044 1.22 1.17 1.24 178 XMSubMetaI_00 1035 0.68 1.16 0.48 179 XM_ProductURIs 1033 0.81 1.16 0.66 180 RCVD_IN_IADB_DK 1031 2.38 1.15 2.91 181 XMSubMetaD_03 1013 0.38 1.13 0.05 182 RELAYCOUNTRY_AU 1006 0.49 1.13 0.22 183 TVD_SPACE_RATIO 1006 1.59 1.13 1.79 184 XMPhish08 1005 0.47 1.13 0.19 185 T_XMDrugObfuBody_12 1004 0.42 1.12 0.11 186 XMPhish30 1001 0.83 1.12 0.70 187 XMClaimOffer 995 0.40 1.11 0.09 188 RELAYCOUNTRY_RU 995 0.35 1.11 0.02 189 RCVD_IN_IADB_SENDERID 991 2.45 1.11 3.03 190 DKIM_ADSP_CUSTOM_MED 979 0.94 1.10 0.88 191 TR_Mismatch_TLD_02 974 0.38 1.09 0.08 192 RCVD_IN_RP_SAFE 959 1.25 1.07 1.33 193 HTTPS_HTTP_MISMATCH 935 0.70 1.05 0.55 194 SUBJ_DOLLARS 934 0.70 1.05 0.55 195 XMSubMetaD_00 931 0.36 1.04 0.06 196 XM_B_DynamicLink 926 0.37 1.04 0.08 197 SUBJ_BUY 926 0.34 1.04 0.05 198 RCVD_IN_IADB_VOUCHED 917 2.03 1.03 2.47 199 TR_XM_NoHeaderRelay 914 0.39 1.02 0.11 200 TR_BOTNET_NEGATE 913 0.48 1.02 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171562 86.43 94.40 82.99 2 RELAYCOUNTRY_US 163474 78.54 77.29 79.08 3 XM_B_Unicode 145635 72.59 77.54 70.45 4 DKIM_SIGNED 144724 75.69 88.84 70.01 5 XM_DK_Pass 142896 74.64 87.42 69.12 6 DKIM_VALID 141996 73.95 86.14 68.69 7 DCC_CHECK_NEGATIVE 133858 54.26 29.99 64.75 8 DKIM_VALID_AU 117153 59.72 66.78 56.67 9 BAYES_50 108554 48.20 38.22 52.51 10 XMListUnsubscribeExists 96043 53.42 69.53 46.46 11 XM_B_Unicode3 91679 44.87 46.07 44.35 12 XM_B_SpammyWords 90578 49.67 63.22 43.81 13 DCC_CHECK 72817 45.70 69.97 35.22 14 RCVD_IN_MSPIKE_WL 60485 27.95 24.93 29.26 15 HTML_FONT_LOW_CONTRAST 59561 30.35 33.91 28.81 16 MIME_HTML_ONLY 56276 28.46 31.31 27.22 17 DKIM_VALID_EF 54868 27.03 28.17 26.54 18 LOC_TINY_FONT_1 53766 29.81 38.60 26.01 19 XMSubLong 44358 21.40 21.28 21.46 20 FVGT_m_MULTI_ODD 43212 24.58 33.08 20.90 21 XM_B_SpammyWords2 41974 24.93 35.65 20.30 22 T_TM2_M_HEADER_IN_MSG 41849 19.32 17.18 20.24 23 RCVD_IN_MSPIKE_H2 38690 20.25 23.81 18.72 24 ALL_TRUSTED 38179 13.40 1.67 18.47 25 T_KAM_HTML_FONT_INVALID 35834 19.96 26.04 17.33 26 USER_IN_DEF_DKIM_WL 34562 12.49 2.69 16.72 27 RCVD_IN_MSPIKE_H3 33154 16.27 16.82 16.04 28 XM_Body_Dirty_Words 28055 15.93 21.39 13.57 29 XM_Multi_Part_URI 26903 14.53 18.03 13.01 30 XM_B_Unsub 26513 13.79 16.02 12.82 31 XM_DKIMWhitelistDomains 24781 8.39 0.07 11.99 32 BAYES_00 24380 8.39 0.51 11.79 33 RCVD_IN_MSPIKE_H4 23595 10.31 7.74 11.41 34 BAYES_60 21989 9.75 7.69 10.64 35 MPART_ALT_DIFF 21318 11.49 14.22 10.31 36 XM_Evil_Numbers_Gen 19842 8.98 7.53 9.60 37 UNPARSEABLE_RELAY 19081 11.00 15.08 9.23 38 TR_XM_BayesUnsub 17173 10.55 15.74 8.31 39 XMStrtUSub 16767 7.05 4.59 8.11 40 T_TooManySym_01 16546 6.53 3.11 8.00 41 XM_DK_Undo_02 16288 19.58 46.68 7.88 42 LotsOfNums_01 16185 7.52 6.80 7.83 43 XM_H_Trusted_IP 15929 5.38 0.00 7.71 44 MIME_HTML_ONLY_MULTI 15759 7.29 6.53 7.62 45 TR_XM_UnparsRelay 15105 9.57 14.81 7.31 46 TM2_M_URI_OPT_OUT 14937 5.76 2.36 7.23 47 HTML_IMAGE_RATIO_02 14924 7.62 8.53 7.22 48 LOTS_OF_MONEY 14864 8.19 10.52 7.19 49 BAYES_99 14751 16.28 37.43 7.14 50 RCVD_IN_VALIDITY_SAFE 13780 6.31 5.47 6.67 51 XM_SendGrid 13372 6.80 7.56 6.47 52 TR_XM_DK_Bayes 12963 4.50 0.41 6.27 53 TR_XM_DK_Bayes1 12860 4.47 0.41 6.22 54 TooManyTo_001 12572 5.67 4.72 6.08 55 RCVD_IN_VALIDITY_CERTIFIED 12496 5.59 4.54 6.04 56 BAYES_999 12153 13.14 29.96 5.88 57 BOTNET_IPINHOSTNAME 11947 7.27 10.73 5.78 58 HTML_IMAGE_RATIO_04 11820 5.53 5.09 5.72 59 TR_XM_DK_Bayes2 11802 4.08 0.32 5.71 60 TR_XM_DKIM_Undo 11722 14.83 36.03 5.67 61 XMSexyCombo_05 11085 7.03 10.90 5.36 62 XM_UncommonTLD01 11060 6.74 9.95 5.35 63 IN_ZIMBRA_NJ_WHITELIST 11008 3.75 0.10 5.32 64 XM_B_SpammyWords3 10545 7.52 13.13 5.10 65 TR_XM_SpammyWords4 10284 6.11 8.73 4.97 66 BAYES_80 9980 5.86 8.25 4.83 67 XMNumbers 9782 3.90 1.98 4.73 68 FSL_BULK_SIG 9729 6.21 9.68 4.71 69 XM_H_Long_From01 9399 5.07 6.28 4.55 70 TR_XM_DK_SendGrid 9381 4.64 4.87 4.54 71 TR_XM_SB_Phish 9085 3.54 1.57 4.39 72 XMSubPhish11 9069 3.50 1.44 4.39 73 T_TooManySym_02 9054 3.29 0.78 4.38 74 BAYES_40 9047 3.48 1.39 4.38 75 T_REMOTE_IMAGE 8985 4.07 3.42 4.35 76 XM_PDF 8318 2.99 0.61 4.02 77 RCVD_IN_IADB_LISTED 7767 3.10 1.58 3.76 78 MIME_QP_LONG_LINE 7637 3.22 2.11 3.69 79 HTML_IMAGE_RATIO_06 7530 3.67 3.72 3.64 80 XMSubMetaSx_00 7327 4.75 7.54 3.54 81 INVALID_MSGID 7125 2.50 0.29 3.45 82 XM_B_Phish_Phrases 7091 3.90 4.98 3.43 83 MIME_HTML_MOSTLY 7004 4.93 8.51 3.39 84 RCVD_IN_IADB_SPF 6917 2.72 1.28 3.35 85 BAYES_20 6705 2.67 1.34 3.24 86 RELAYCOUNTRY_META 6450 10.05 26.10 3.12 87 HTML_IMAGE_RATIO_08 6408 2.90 2.44 3.10 88 BAYES_95 6379 3.57 4.70 3.09 89 RCVD_IN_IADB_SENDERID 6258 2.45 1.11 3.03 90 ANY_BOUNCE_MESSAGE 6188 2.39 1.00 2.99 91 BOUNCE_MESSAGE 6188 2.39 1.00 2.99 92 RCVD_IN_IADB_DK 6025 2.38 1.15 2.91 93 FROM_EXCESS_BASE64 5846 2.56 1.95 2.83 94 TO_MALFORMED 5772 1.95 0.00 2.79 95 TVD_RCVD_IP 5650 2.02 0.37 2.73 96 TR_DCC_Bayes_99 5591 9.17 24.13 2.70 97 XM_B_SpammyTLD 5292 3.26 4.88 2.56 98 RCVD_IN_IADB_VOUCHED 5101 2.03 1.03 2.47 99 XMStockSpam_06 5097 2.21 1.63 2.47 100 XMSubNoVowel 5058 2.27 1.85 2.45 101 BAYES_05 4942 1.81 0.45 2.39 102 TR_XM_PhishingBody 4539 3.32 5.93 2.20 103 T_XMDrugObfuBody_14 4291 2.69 4.10 2.08 104 URI_NOVOWEL 4270 3.42 6.56 2.07 105 XMBSHREFv2 4174 1.52 0.37 2.02 106 IN_HORDE_ADDRESS_BOOK 4128 1.47 0.24 2.00 107 MAILING_LIST_MULTI 3783 1.74 1.52 1.83 108 RCVD_IN_MSPIKE_H5 3736 1.37 0.37 1.81 109 TVD_SPACE_RATIO 3709 1.59 1.13 1.79 110 HTML_MIME_NO_HTML_TAG 3589 2.77 5.18 1.74 111 RCVD_IN_IADB_OPTIN 3538 1.39 0.66 1.71 112 TR_XM_SpammyWords2 3475 5.17 13.25 1.68 113 XM_CamelCaseFrm001 3429 1.81 2.18 1.66 114 XMBdyGiftCard01 3350 1.76 2.07 1.62 115 XMGappySubj_01 3017 1.06 0.15 1.46 116 TR_Symld_Words 3017 1.45 1.43 1.46 117 XM_SPF_SoftFail 2913 2.04 3.49 1.41 118 TR_XM_SpammyRelay 2763 4.51 11.85 1.34 119 RCVD_IN_RP_SAFE 2745 1.25 1.07 1.33 120 DKIM_INVALID 2728 1.74 2.71 1.32 121 BOTNET 2672 4.28 11.21 1.29 122 TM2_M_VERY_LONG_WORD 2581 3.32 8.11 1.25 123 URI_HEX 2565 1.22 1.17 1.24 124 UNTRUSTED_Relay 2489 4.78 13.06 1.20 125 RCVD_IN_RP_CERTIFIED 2485 1.10 0.87 1.20 126 TR_XM_SpammyWords5 2475 1.68 2.79 1.20 127 T_XMDrugObfuBody_08 2400 1.67 2.86 1.16 128 RELAYCOUNTRY_CA 2389 3.39 8.55 1.16 129 XMDiploma_00 2374 1.49 2.29 1.15 130 XM_B_Investor 2371 1.75 3.14 1.15 131 TooManyTo_002 2355 1.07 0.90 1.14 132 XM_GoogleGroups 2325 2.13 4.45 1.12 133 MSGID_NOFQDN1 2322 0.79 0.02 1.12 134 XM_H_Long_From02 2321 1.15 1.22 1.12 135 XM_DK_Undo_01 2308 1.53 2.47 1.12 136 RCVD_IN_MSPIKE_BL 2243 3.31 8.45 1.08 137 TR_XM_MSPIKECOMBO 2243 3.29 8.39 1.08 138 T_OBFU_PDF_ATTACH 2241 0.81 0.17 1.08 139 KHOP_HELO_FCRDNS 2231 1.30 1.83 1.08 140 HTML_FONT_FACE_BAD 2227 0.98 0.75 1.08 141 T_TooManySym_03 2096 0.80 0.30 1.01 142 RCVD_IN_MSPIKE_L3 2040 2.22 5.08 0.99 143 XM_B_Phish66 1948 1.62 3.19 0.94 144 SUBJ_ALL_CAPS 1914 1.31 2.19 0.93 145 XM_B_COPY_HTML 1906 0.88 0.79 0.92 146 DKIM_ADSP_CUSTOM_MED 1816 0.94 1.10 0.88 147 MPART_ALT_DIFF_COUNT 1815 0.99 1.26 0.88 148 XM_OfRef6 1712 1.53 3.16 0.83 149 XM_B_Unsub2 1708 1.09 1.70 0.83 150 TooManyTo_003 1677 0.82 0.84 0.81 151 XM_E_Blogspot 1647 0.63 0.26 0.80 152 XMBody_95 1631 0.60 0.15 0.79 153 TR_MetaPhish_Combo_01 1613 0.81 0.88 0.78 154 T_FILL_THIS_FORM_SHORT 1586 1.43 2.95 0.77 155 HTML_IMAGE_ONLY_20 1570 0.62 0.30 0.76 156 T_XMDrugObfuBody_00 1567 0.96 1.41 0.76 157 RCVD_IN_BL_SPAMCOP_NET 1546 3.98 11.47 0.75 158 XM_UB50 1482 2.28 5.90 0.72 159 XMPhish30 1445 0.83 1.12 0.70 160 XM_B_COVIDMETA 1434 0.89 1.34 0.69 161 HTML_TAG_BALANCE_BODY 1425 1.02 1.79 0.69 162 XM_ProductURIs 1373 0.81 1.16 0.66 163 XM_H_PHPMailer 1355 0.73 0.92 0.66 164 XMLngstWrd_00 1285 1.99 5.15 0.62 165 TooManyTo_004 1274 0.66 0.77 0.62 166 XMBrknScrpt_02 1254 0.92 1.64 0.61 167 XMHTMLBadTable_001 1254 0.73 1.00 0.61 168 T_XMHurry_00 1243 1.10 2.25 0.60 169 XMGenDplmaNmb 1218 0.83 1.39 0.59 170 XM_D_tchamptons_WL 1201 0.41 0.02 0.58 171 XMLngstWrd_01 1164 1.91 5.04 0.56 172 XM_B_REG_HTML 1157 0.82 1.44 0.56 173 SUBJ_DOLLARS 1128 0.70 1.05 0.55 174 HTTPS_HTTP_MISMATCH 1128 0.70 1.05 0.55 175 T_OBFU_DOC_ATTACH 1116 0.38 0.00 0.54 176 USER_IN_WHITELIST 1115 0.38 0.00 0.54 177 USER_IN_WELCOMELIST 1115 0.38 0.00 0.54 178 TR_MSPIKEBAYES00 1100 0.38 0.02 0.53 179 RDNS_DYNAMIC 1083 0.58 0.71 0.52 180 NML_ADSP_CUSTOM_MED 1081 0.66 0.98 0.52 181 TooManyTo_005 1076 0.46 0.33 0.52 182 XM_B_SpammyWords4 1070 1.03 2.20 0.52 183 URI_TRY_3LD 1069 0.63 0.88 0.52 184 FORGED_GMAIL_RCVD 1040 0.62 0.91 0.50 185 TR_XM_SpammyWords3 1030 1.16 2.70 0.50 186 DATE_IN_PAST_03_06 1029 0.51 0.54 0.50 187 XMSubMetaSxObfu_02 1020 0.48 0.43 0.49 188 TM2_M_BODY_EMPTY 994 0.36 0.09 0.48 189 XMBody_17 993 1.15 2.70 0.48 190 XMSubMetaI_00 985 0.68 1.16 0.48 191 RELAYCOUNTRY_GB 976 0.51 0.60 0.47 192 XM_B_DNDMA 973 0.63 1.01 0.47 193 XMLngstWrd_02 962 1.81 4.91 0.47 194 DIET_1 945 0.71 1.30 0.46 195 XM_shorewaves_Whitelist 936 0.32 0.00 0.45 196 PRESENTAMOS_ES 934 0.32 0.00 0.45 197 XM_ShortIntro_01 911 0.47 0.55 0.44 198 TR_XM_PHPDW 895 0.87 1.87 0.43 199 T_TooManySym_04 892 0.36 0.21 0.43 200 XMSexyCombo_01 865 0.88 1.93 0.42 ----------------------------------------------------------------------