Email: 510474 Autolearn: 0 AvgScore: 3.75 AvgScanTime: 1.44 sec Spam: 166804 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.56 sec Ham: 343670 Autolearn: 0 AvgScore: -1.16 AvgScanTime: 1.38 sec Time Spent Running SA: 203.86 hours Time Spent Processing Spam: 72.38 hours Time Spent Processing Ham: 131.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161015 89.45 96.53 86.01 2 DKIM_SIGNED 148778 76.64 89.19 70.54 3 XM_DK_Pass 145957 74.61 87.50 68.35 4 DKIM_VALID 144846 73.61 86.84 67.19 5 RELAYCOUNTRY_US 139028 80.35 83.35 78.90 6 XM_B_Unicode 129377 72.96 77.56 70.72 7 DCC_CHECK 121329 44.17 72.74 30.30 8 XMListUnsubscribeExists 116942 54.13 70.11 46.37 9 DKIM_VALID_AU 109443 56.35 65.61 51.85 10 XM_B_SpammyWords 105607 48.32 63.31 41.04 11 RCVD_IN_MSPIKE_H2 78238 40.32 46.90 37.13 12 BAYES_50 74897 50.75 44.90 53.59 13 XM_B_Unicode3 72276 42.70 43.33 42.39 14 XM_DK_Undo_02 68126 17.53 40.84 6.21 15 FVGT_m_MULTI_ODD 64568 29.64 38.71 25.24 16 XM_B_SpammyWords2 59783 23.39 35.84 17.35 17 LOC_TINY_FONT_1 58524 25.98 35.09 21.56 18 MIME_HTML_ONLY 56732 23.77 34.01 18.80 19 HTML_FONT_LOW_CONTRAST 54245 28.57 32.52 26.66 20 BAYES_99 52413 15.49 31.42 7.76 21 TR_XM_DKIM_Undo 51829 13.06 31.07 4.32 22 DKIM_VALID_EF 50538 27.82 30.30 26.61 23 T_KAM_HTML_FONT_INVALID 47766 22.27 28.64 19.17 24 DCC_CHECK_NEGATIVE 45433 55.78 27.24 69.64 25 BAYES_999 41354 12.60 24.79 6.68 26 XM_Body_Dirty_Words 37616 14.70 22.55 10.89 27 TR_DCC_Bayes_99 37026 8.40 22.20 1.71 28 XMSubLong 36542 21.91 21.91 21.91 29 RELAYCOUNTRY_META 34749 9.09 20.83 3.39 30 T_TM2_M_HEADER_IN_MSG 31836 26.01 19.09 29.37 31 XM_Multi_Part_URI 28351 13.21 17.00 11.37 32 XM_B_Unsub 27198 11.00 16.31 8.43 33 TR_XM_BayesUnsub 26568 9.59 15.93 6.52 34 RCVD_IN_MSPIKE_WL 26030 15.68 15.61 15.72 35 LOTS_OF_MONEY 23799 9.29 14.27 6.87 36 RCVD_IN_MSPIKE_H3 22195 11.70 13.31 10.93 37 UNPARSEABLE_RELAY 21927 9.29 13.15 7.42 38 BOTNET_IPINHOSTNAME 21601 7.31 12.95 4.58 39 TR_XM_UnparsRelay 21499 8.20 12.89 5.92 40 TR_XM_SpammyWords4 20399 6.83 12.23 4.21 41 MPART_ALT_DIFF 19913 6.89 11.94 4.44 42 XM_B_SpammyWords3 19902 6.41 11.93 3.73 43 FSL_BULK_SIG 19175 5.65 11.50 2.81 44 TR_XM_SpammyWords2 18029 4.13 10.81 0.89 45 TR_XM_SpammyRelay 17855 4.61 10.70 1.65 46 RCVD_IN_BL_SPAMCOP_NET 17248 3.72 10.34 0.50 47 XMSexyCombo_05 17032 5.61 10.21 3.37 48 TM2_M_VERY_LONG_WORD 16174 3.96 9.70 1.18 49 BOTNET 15294 3.91 9.17 1.36 50 HTML_MIME_NO_HTML_TAG 14983 4.37 8.98 2.13 51 MIME_HTML_ONLY_MULTI 14949 4.75 8.96 2.70 52 XM_UncommonTLD01 14597 5.24 8.75 3.53 53 UNTRUSTED_Relay 14517 3.64 8.70 1.18 54 XM_Evil_Numbers_Gen 13706 7.77 8.22 7.55 55 BAYES_80 13663 5.77 8.19 4.59 56 BAYES_60 11986 8.58 7.19 9.26 57 LotsOfNums_01 11966 8.55 7.17 9.22 58 XMLngstWrd_00 11894 2.72 7.13 0.57 59 XMLngstWrd_01 11819 2.62 7.09 0.45 60 XMLngstWrd_02 11640 2.49 6.98 0.32 61 XM_GoogleGroups 11629 3.16 6.97 1.31 62 XM_SendGrid 11522 5.42 6.91 4.70 63 RELAYCOUNTRY_CA 11326 2.84 6.79 0.92 64 TR_XM_SPAMCOP 11170 2.33 6.70 0.21 65 XMLngstWrd_03 11149 2.31 6.68 0.19 66 HTML_IMAGE_RATIO_02 11069 6.37 6.64 6.24 67 XMLngstWrd_04 11035 2.25 6.62 0.13 68 HTML_TITLE_SUBJ_DIFF 11010 2.19 6.60 0.06 69 UPPERCASE_75_100 10977 2.16 6.58 0.02 70 TR_XM_PhishingBody 10630 4.59 6.37 3.73 71 XM_H_Long_From01 10052 5.24 6.03 4.86 72 XMSubMetaSx_00 9413 4.31 5.64 3.66 73 RCVD_IN_MSPIKE_BL 9387 2.71 5.63 1.29 74 XM_B_Phish_Phrases 9375 3.97 5.62 3.17 75 TR_XM_MSPIKECOMBO 9238 2.68 5.54 1.29 76 XM_B_SpammyTLD 9009 3.12 5.40 2.02 77 XM_B_Investor 8276 2.65 4.96 1.53 78 BAYES_95 7647 3.37 4.58 2.78 79 TR_XM_DK_SendGrid 7470 3.52 4.48 3.05 80 TooManyTo_001 7318 6.81 4.39 7.99 81 XM_SPF_SoftFail 7250 3.09 4.35 2.48 82 HTML_IMAGE_RATIO_04 7033 4.54 4.22 4.69 83 HTML_IMAGE_RATIO_06 6927 3.65 4.15 3.40 84 T_XMDrugObfuBody_14 6912 2.46 4.14 1.64 85 XM_DIRTYINTL 6564 1.50 3.94 0.31 86 XMDiploma_00 6292 2.10 3.77 1.29 87 XM_B_Phish66 6274 2.57 3.76 1.99 88 XM_CamelCaseFrm001 6180 2.44 3.70 1.82 89 MIME_HTML_MOSTLY 6105 2.63 3.66 2.13 90 T_REMOTE_IMAGE 6097 3.52 3.66 3.45 91 TR_XM_SpammyWords3 6005 1.52 3.60 0.51 92 XM_UB50 5974 1.66 3.58 0.73 93 XMStrtUSub 5922 3.89 3.55 4.06 94 MIME_QP_LONG_LINE 5922 5.12 3.55 5.88 95 TR_XM_SpammyWords5 5866 2.05 3.52 1.34 96 XMNumbers 5822 4.30 3.49 4.69 97 URIBL_DBL_SPAM 5775 1.15 3.46 0.02 98 XM_OfRef6 5756 1.74 3.45 0.92 99 SpammyFromTLD_01 5586 1.61 3.35 0.77 100 SpammyFromTLD_02 5514 1.41 3.31 0.50 101 RCVD_IN_VALIDITY_SAFE 5198 4.04 3.12 4.48 102 T_XMDrugObfuBody_08 5058 1.89 3.03 1.33 103 PDS_OTHER_BAD_TLD 5049 1.12 3.03 0.19 104 URI_NOVOWEL 4938 2.70 2.96 2.57 105 RCVD_IN_VALIDITY_RPBL 4920 0.98 2.95 0.02 106 USER_IN_DEF_DKIM_WL 4556 8.60 2.73 11.46 107 RCVD_IN_IADB_LISTED 4214 4.50 2.53 5.46 108 HTML_IMAGE_RATIO_08 4164 2.34 2.50 2.26 109 XM_B_Unsub2 4150 1.66 2.49 1.25 110 XM_B_SpammyWords4 4149 1.15 2.49 0.50 111 XM_DK_Undo_01 4125 1.89 2.47 1.60 112 TM2_M_URI_OPT_OUT 4121 2.24 2.47 2.13 113 RCVD_IN_MSPIKE_L4 4120 1.36 2.47 0.82 114 KHOP_HELO_FCRDNS 4051 1.97 2.43 1.75 115 RCVD_IN_VALIDITY_CERTIFIED 3997 3.50 2.40 4.04 116 DKIM_INVALID 3932 3.03 2.36 3.35 117 T_TooManySym_01 3865 5.30 2.32 6.74 118 URI_PHP_REDIR 3822 0.75 2.29 0.00 119 XMBody_17 3666 0.94 2.20 0.33 120 RCVD_IN_MSPIKE_H4 3620 3.52 2.17 4.17 121 RCVD_IN_IADB_SPF 3579 3.97 2.15 4.86 122 FROM_EXCESS_BASE64 3508 2.30 2.10 2.40 123 T_XMDrugObfuBody_00 3426 1.53 2.05 1.28 124 TR_XM_SB_Phish 3412 2.18 2.05 2.24 125 RCVD_IN_IADB_DK 3258 3.50 1.95 4.25 126 T_FILL_THIS_FORM_SHORT 3253 1.14 1.95 0.75 127 XMSexyCombo_01 3231 1.04 1.94 0.60 128 RCVD_IN_IADB_SENDERID 3209 3.58 1.92 4.39 129 XM_UB99 3190 0.63 1.91 0.00 130 XMSubPhish11 3102 2.09 1.86 2.20 131 TR_LOTS_OF_MONEY3 3067 0.77 1.84 0.26 132 XM_B_COVIDMETA 3058 0.98 1.83 0.56 133 BOTNET_NORDNS 3054 0.61 1.83 0.01 134 URI_HEX 2985 1.29 1.79 1.05 135 RCVD_IN_MSPIKE_L5 2938 0.62 1.76 0.06 136 MAILING_LIST_MULTI 2917 2.45 1.75 2.79 137 SUBJ_ALL_CAPS 2910 1.64 1.74 1.58 138 TR_XM_MSPIKECOMBO2 2889 0.72 1.73 0.23 139 RCVD_IN_PSBL 2768 0.62 1.66 0.12 140 TR_XM_NoHeaderRelay 2747 0.61 1.65 0.11 141 XMGenDplmaNmb 2645 0.98 1.59 0.69 142 RELAYCOUNTRY_AU 2577 0.71 1.54 0.31 143 RELAYCOUNTRY_RU 2501 0.51 1.50 0.02 144 TR_XM_COVIDMETA4 2492 0.64 1.49 0.22 145 RELAYCOUNTRY_FR 2487 0.61 1.49 0.18 146 BAYES_40 2480 3.94 1.49 5.12 147 HTTPS_HTTP_MISMATCH 2462 0.89 1.48 0.61 148 ALL_TRUSTED 2424 12.98 1.45 18.57 149 XM_H_Undi_Recip 2421 0.67 1.45 0.29 150 XMHTML_After_End 2418 0.88 1.45 0.60 151 RCVD_IN_IADB_VOUCHED 2395 2.71 1.44 3.33 152 XM_UB999 2388 0.47 1.43 0.00 153 HTML_TAG_BALANCE_BODY 2349 0.86 1.41 0.59 154 XM_URI_RBL 2310 0.52 1.38 0.10 155 XMBdyGiftCard01 2253 0.86 1.35 0.63 156 XMStockSpam_06 2242 1.21 1.34 1.14 157 HK_RANDOM_REPLYTO 2241 0.51 1.34 0.10 158 XM_B_DynamicLink 2241 0.46 1.34 0.03 159 XM_Body_Dirty_Words_01 2220 0.52 1.33 0.13 160 TR_XM_PHPDW 2180 0.69 1.31 0.38 161 RCVD_IN_MSPIKE_L3 2180 0.70 1.31 0.40 162 T_XMHurry_00 2155 0.72 1.29 0.44 163 URIBL_BLACK 2153 0.46 1.29 0.06 164 XM_H_Long_From02 2144 1.25 1.29 1.23 165 TR_XM_PHPForged 2143 0.94 1.28 0.77 166 RELAYCOUNTRY_DE 2105 0.61 1.26 0.29 167 TR_XM_FormFill2 2095 0.63 1.26 0.33 168 XM_H_PHPOS 2077 0.62 1.25 0.31 169 TR_Symld_Words 2042 1.49 1.22 1.61 170 XM_UB80 1987 0.40 1.19 0.01 171 HTML_IMAGE_ONLY_20 1923 0.91 1.15 0.80 172 HTML_TAG_BALANCE_CENTER 1877 0.41 1.13 0.07 173 XMBrknScrpt_02 1856 0.86 1.11 0.74 174 XMPhish30 1822 1.00 1.09 0.96 175 TR_XM_COVIDMETA1 1812 0.49 1.09 0.20 176 HTML_FONT_SIZE_LARGE 1797 0.40 1.08 0.07 177 MPART_ALT_DIFF_COUNT 1787 0.71 1.07 0.54 178 XMMoneyMeta_00 1763 0.65 1.06 0.46 179 BAYES_20 1695 2.89 1.02 3.80 180 XM_UB60 1677 0.38 1.01 0.07 181 RELAYCOUNTRY_IN 1650 0.37 0.99 0.07 182 XMReplyNow 1639 0.48 0.98 0.24 183 MONEY_NOHTML 1637 0.37 0.98 0.07 184 XM_B_DNDMA 1599 0.62 0.96 0.46 185 BODY_URI_ONLY 1598 0.32 0.96 0.02 186 URI_TRY_3LD 1589 0.65 0.95 0.51 187 HTML_FONT_TINY_NORDNS 1588 0.37 0.95 0.09 188 HTML_FONT_FACE_BAD 1584 1.12 0.95 1.20 189 TM2_M_A_HREF_HREF 1579 0.52 0.95 0.31 190 DIET_1 1561 0.47 0.94 0.25 191 MIXED_CENTER_CASE 1557 0.31 0.93 0.00 192 XMSubMetaI_00 1553 0.75 0.93 0.66 193 MIXED_HREF_CASE 1542 0.30 0.92 0.00 194 MIXED_IMG_CASE 1535 0.30 0.92 0.00 195 MIXED_AREA_CASE 1518 0.30 0.91 0.00 196 HTML_SHORT_LINK_IMG_3 1492 0.34 0.89 0.07 197 RCVD_IN_IADB_OPTIN 1492 1.74 0.89 2.15 198 XM_B_SEO 1474 0.92 0.88 0.94 199 XM_PDF 1463 3.60 0.88 4.92 200 RELAYCOUNTRY_CN 1461 0.32 0.88 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295581 89.45 96.53 86.01 2 RELAYCOUNTRY_US 271157 80.35 83.35 78.90 3 XM_B_Unicode 243054 72.96 77.56 70.72 4 DKIM_SIGNED 242425 76.64 89.19 70.54 5 DCC_CHECK_NEGATIVE 239319 55.78 27.24 69.64 6 XM_DK_Pass 234886 74.61 87.50 68.35 7 DKIM_VALID 230900 73.61 86.84 67.19 8 BAYES_50 184172 50.75 44.90 53.59 9 DKIM_VALID_AU 178199 56.35 65.61 51.85 10 XMListUnsubscribeExists 159359 54.13 70.11 46.37 11 XM_B_Unicode3 145684 42.70 43.33 42.39 12 XM_B_SpammyWords 141040 48.32 63.31 41.04 13 RCVD_IN_MSPIKE_H2 127600 40.32 46.90 37.13 14 DCC_CHECK 104134 44.17 72.74 30.30 15 T_TM2_M_HEADER_IN_MSG 100921 26.01 19.09 29.37 16 HTML_FONT_LOW_CONTRAST 91617 28.57 32.52 26.66 17 DKIM_VALID_EF 91453 27.82 30.30 26.61 18 FVGT_m_MULTI_ODD 86756 29.64 38.71 25.24 19 XMSubLong 75312 21.91 21.91 21.91 20 LOC_TINY_FONT_1 74089 25.98 35.09 21.56 21 T_KAM_HTML_FONT_INVALID 65896 22.27 28.64 19.17 22 MIME_HTML_ONLY 64627 23.77 34.01 18.80 23 ALL_TRUSTED 63812 12.98 1.45 18.57 24 XM_B_SpammyWords2 59625 23.39 35.84 17.35 25 RCVD_IN_MSPIKE_WL 54009 15.68 15.61 15.72 26 USER_IN_DEF_DKIM_WL 39368 8.60 2.73 11.46 27 XM_Multi_Part_URI 39086 13.21 17.00 11.37 28 RCVD_IN_MSPIKE_H3 37549 11.70 13.31 10.93 29 XM_Body_Dirty_Words 37420 14.70 22.55 10.89 30 BAYES_00 37016 7.47 0.68 10.77 31 BAYES_60 31816 8.58 7.19 9.26 32 LotsOfNums_01 31682 8.55 7.17 9.22 33 XM_B_Unsub 28967 11.00 16.31 8.43 34 XM_DKIMWhitelistDomains 28505 5.60 0.04 8.29 35 TooManyTo_001 27465 6.81 4.39 7.99 36 BAYES_99 26681 15.49 31.42 7.76 37 XM_Evil_Numbers_Gen 25944 7.77 8.22 7.55 38 UNPARSEABLE_RELAY 25506 9.29 13.15 7.42 39 IN_ZIMBRA_NJ_WHITELIST 24334 4.80 0.09 7.08 40 LOTS_OF_MONEY 23623 9.29 14.27 6.87 41 T_TooManySym_01 23169 5.30 2.32 6.74 42 BAYES_999 22971 12.60 24.79 6.68 43 TR_XM_BayesUnsub 22401 9.59 15.93 6.52 44 TR_XM_DK_Bayes 22092 4.49 0.50 6.43 45 HTML_IMAGE_RATIO_02 21449 6.37 6.64 6.24 46 XM_DK_Undo_02 21343 17.53 40.84 6.21 47 TR_XM_DK_Bayes1 20944 4.27 0.50 6.09 48 TR_XM_UnparsRelay 20338 8.20 12.89 5.92 49 MIME_QP_LONG_LINE 20215 5.12 3.55 5.88 50 RCVD_IN_IADB_LISTED 18764 4.50 2.53 5.46 51 TR_XM_DK_Bayes2 18088 3.67 0.40 5.26 52 BAYES_40 17611 3.94 1.49 5.12 53 XM_PDF 16921 3.60 0.88 4.92 54 XM_H_Long_From01 16707 5.24 6.03 4.86 55 RCVD_IN_IADB_SPF 16694 3.97 2.15 4.86 56 XM_SendGrid 16166 5.42 6.91 4.70 57 XMNumbers 16128 4.30 3.49 4.69 58 HTML_IMAGE_RATIO_04 16120 4.54 4.22 4.69 59 BAYES_80 15786 5.77 8.19 4.59 60 BOTNET_IPINHOSTNAME 15723 7.31 12.95 4.58 61 RCVD_IN_VALIDITY_SAFE 15409 4.04 3.12 4.48 62 MPART_ALT_DIFF 15271 6.89 11.94 4.44 63 RCVD_IN_IADB_SENDERID 15084 3.58 1.92 4.39 64 TR_XM_DKIM_Undo 14842 13.06 31.07 4.32 65 RCVD_IN_IADB_DK 14590 3.50 1.95 4.25 66 TR_XM_SpammyWords4 14476 6.83 12.23 4.21 67 RCVD_IN_MSPIKE_H4 14335 3.52 2.17 4.17 68 XM_H_Trusted_IP 14142 2.77 0.00 4.11 69 XMStrtUSub 13948 3.89 3.55 4.06 70 RCVD_IN_VALIDITY_CERTIFIED 13877 3.50 2.40 4.04 71 T_TooManySym_02 13671 2.86 0.56 3.98 72 BOUNCE_MESSAGE 13149 2.83 0.77 3.83 73 ANY_BOUNCE_MESSAGE 13149 2.83 0.77 3.83 74 BAYES_20 13043 2.89 1.02 3.80 75 XM_B_SpammyWords3 12823 6.41 11.93 3.73 76 TR_XM_PhishingBody 12806 4.59 6.37 3.73 77 XMSubMetaSx_00 12576 4.31 5.64 3.66 78 XM_UncommonTLD01 12138 5.24 8.75 3.53 79 T_REMOTE_IMAGE 11866 3.52 3.66 3.45 80 HTML_IMAGE_RATIO_06 11688 3.65 4.15 3.40 81 RELAYCOUNTRY_META 11636 9.09 20.83 3.39 82 XMSexyCombo_05 11586 5.61 10.21 3.37 83 DKIM_INVALID 11525 3.03 2.36 3.35 84 RCVD_IN_IADB_VOUCHED 11441 2.71 1.44 3.33 85 XM_B_Phish_Phrases 10909 3.97 5.62 3.17 86 TR_XM_DK_SendGrid 10486 3.52 4.48 3.05 87 FSL_BULK_SIG 9673 5.65 11.50 2.81 88 MAILING_LIST_MULTI 9586 2.45 1.75 2.79 89 BAYES_95 9564 3.37 4.58 2.78 90 MIME_HTML_ONLY_MULTI 9294 4.75 8.96 2.70 91 XMSubNoVowel 9055 2.00 0.70 2.63 92 XM_H_PHPMailer 8855 1.86 0.39 2.58 93 URI_NOVOWEL 8836 2.70 2.96 2.57 94 XM_SPF_SoftFail 8537 3.09 4.35 2.48 95 FROM_EXCESS_BASE64 8250 2.30 2.10 2.40 96 BAYES_05 7978 1.73 0.52 2.32 97 HTML_IMAGE_RATIO_08 7758 2.34 2.50 2.26 98 TR_XM_SB_Phish 7705 2.18 2.05 2.24 99 BASE64_LENGTH_79_INF 7597 1.57 0.26 2.21 100 XMSubPhish11 7547 2.09 1.86 2.20 101 RCVD_IN_IADB_OPTIN 7396 1.74 0.89 2.15 102 TooManyTo_002 7355 1.63 0.57 2.14 103 TM2_M_URI_OPT_OUT 7333 2.24 2.47 2.13 104 MIME_HTML_MOSTLY 7331 2.63 3.66 2.13 105 HTML_MIME_NO_HTML_TAG 7322 4.37 8.98 2.13 106 TVD_RCVD_IP 6971 1.43 0.19 2.03 107 XM_B_SpammyTLD 6931 3.12 5.40 2.02 108 XM_B_Phish66 6852 2.57 3.76 1.99 109 INVALID_MSGID 6737 1.37 0.14 1.96 110 HELO_NODOT 6395 1.36 0.34 1.86 111 HELO_NO_DOMAIN 6390 1.35 0.30 1.86 112 XM_CamelCaseFrm001 6252 2.44 3.70 1.82 113 IN_HORDE_ADDRESS_BOOK 6024 1.22 0.11 1.75 114 KHOP_HELO_FCRDNS 6016 1.97 2.43 1.75 115 TO_MALFORMED 5946 1.17 0.01 1.73 116 TR_DCC_Bayes_99 5864 8.40 22.20 1.71 117 TR_XM_SpammyRelay 5686 4.61 10.70 1.65 118 T_XMDrugObfuBody_14 5647 2.46 4.14 1.64 119 TR_Symld_Words 5543 1.49 1.22 1.61 120 XM_DK_Undo_01 5508 1.89 2.47 1.60 121 SUBJ_ALL_CAPS 5440 1.64 1.74 1.58 122 T_TooManySym_03 5400 1.14 0.27 1.57 123 XM_B_Investor 5253 2.65 4.96 1.53 124 DKIM_ADSP_CUSTOM_MED 5202 1.27 0.78 1.51 125 TooManyTo_003 4844 1.11 0.49 1.41 126 BOTNET 4674 3.91 9.17 1.36 127 XMGappySubj_01 4673 0.97 0.15 1.36 128 TR_XM_SpammyWords5 4613 2.05 3.52 1.34 129 T_XMDrugObfuBody_08 4566 1.89 3.03 1.33 130 XM_GoogleGroups 4512 3.16 6.97 1.31 131 XMDiploma_00 4449 2.10 3.77 1.29 132 RCVD_IN_MSPIKE_BL 4425 2.71 5.63 1.29 133 TR_XM_MSPIKECOMBO 4421 2.68 5.54 1.29 134 T_XMDrugObfuBody_00 4402 1.53 2.05 1.28 135 XM_B_Unsub2 4305 1.66 2.49 1.25 136 XMBSHREFv2 4253 0.91 0.22 1.24 137 XM_H_Long_From02 4231 1.25 1.29 1.23 138 HTML_FONT_FACE_BAD 4124 1.12 0.95 1.20 139 XMCapTrack 4115 0.92 0.35 1.20 140 UNTRUSTED_Relay 4060 3.64 8.70 1.18 141 TM2_M_VERY_LONG_WORD 4060 3.96 9.70 1.18 142 XMStockSpam_06 3930 1.21 1.34 1.14 143 NML_ADSP_CUSTOM_MED 3918 0.97 0.62 1.14 144 FORGED_GMAIL_RCVD 3817 0.96 0.65 1.11 145 NUMERIC_HTTP_ADDR 3612 0.80 0.29 1.05 146 URI_HEX 3604 1.29 1.79 1.05 147 TooManyTo_004 3480 0.82 0.42 1.01 148 TVD_SPACE_RATIO 3466 0.73 0.16 1.01 149 XMPhish30 3283 1.00 1.09 0.96 150 XM_B_SEO 3232 0.92 0.88 0.94 151 RCVD_IN_RP_SAFE 3180 0.80 0.55 0.93 152 RELAYCOUNTRY_CA 3152 2.84 6.79 0.92 153 XM_OfRef6 3151 1.74 3.45 0.92 154 NORMAL_HTTP_TO_IP 3113 0.64 0.10 0.91 155 TR_XM_SpammyWords2 3042 4.13 10.81 0.89 156 FVGT_m_MULTI_ODD_EMAIL 2948 0.61 0.10 0.86 157 RCVD_IN_RP_CERTIFIED 2884 0.70 0.41 0.84 158 RCVD_IN_MSPIKE_L4 2815 1.36 2.47 0.82 159 TooManyTo_005 2789 0.67 0.39 0.81 160 HTML_IMAGE_ONLY_08 2752 0.65 0.32 0.80 161 HTML_IMAGE_ONLY_20 2740 0.91 1.15 0.80 162 TR_XM_PHPForged 2656 0.94 1.28 0.77 163 SpammyFromTLD_01 2643 1.61 3.35 0.77 164 T_FILL_THIS_FORM_SHORT 2583 1.14 1.95 0.75 165 XMBody_95 2552 0.58 0.25 0.74 166 XMBrknScrpt_02 2546 0.86 1.11 0.74 167 TR_MetaPhish_Combo_01 2533 0.76 0.80 0.74 168 XM_UB50 2507 1.66 3.58 0.73 169 T_HTML_ATTACH 2424 0.51 0.10 0.71 170 XMGenDplmaNmb 2381 0.98 1.59 0.69 171 MSGID_NOFQDN1 2355 0.47 0.01 0.69 172 XM_ShortIntro_01 2264 0.57 0.39 0.66 173 XMSubMetaI_00 2259 0.75 0.93 0.66 174 HTML_OBFUSCATE_20_30 2252 0.46 0.06 0.66 175 XMSubMetaSxObfu_03 2176 0.59 0.49 0.63 176 XMBdyGiftCard01 2155 0.86 1.35 0.63 177 RCVD_IN_MSPIKE_H5 2125 0.46 0.13 0.62 178 HTTPS_HTTP_MISMATCH 2098 0.89 1.48 0.61 179 FROM_GOV_DKIM_AU 2080 0.48 0.24 0.61 180 XMSexyCombo_01 2078 1.04 1.94 0.60 181 XMHTML_After_End 2075 0.88 1.45 0.60 182 XM_B_COPY_HTML 2044 0.62 0.68 0.59 183 HTML_TAG_BALANCE_BODY 2034 0.86 1.41 0.59 184 T_OBFU_PDF_ATTACH 2006 0.43 0.10 0.58 185 XMLngstWrd_00 1976 2.72 7.13 0.57 186 RELAYCOUNTRY_GB 1963 0.60 0.67 0.57 187 XM_B_COVIDMETA 1930 0.98 1.83 0.56 188 XMHTMLBadTable_001 1922 0.57 0.58 0.56 189 SHORT_HELO_AND_INLINE_IMAGE 1894 0.40 0.08 0.55 190 MPART_ALT_DIFF_COUNT 1848 0.71 1.07 0.54 191 RCVD_IN_SORBS_DUL 1800 0.38 0.08 0.52 192 XM_ProductURIs 1781 0.58 0.71 0.52 193 URI_TRY_3LD 1753 0.65 0.95 0.51 194 TR_XM_SpammyWords3 1745 1.52 3.60 0.51 195 RCVD_IN_BL_SPAMCOP_NET 1718 3.72 10.34 0.50 196 XM_B_SpammyWords4 1714 1.15 2.49 0.50 197 SpammyFromTLD_02 1708 1.41 3.31 0.50 198 XMPhish14 1701 0.57 0.74 0.49 199 XM_B_REG_HTML 1643 0.48 0.49 0.48 200 T_Symld_Words_02 1598 0.56 0.75 0.46 ----------------------------------------------------------------------