Email: 489444 Autolearn: 0 AvgScore: 3.64 AvgScanTime: 1.17 sec Spam: 154565 Autolearn: 0 AvgScore: 13.92 AvgScanTime: 1.32 sec Ham: 334879 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 1.09 sec Time Spent Running SA: 158.47 hours Time Spent Processing Spam: 56.63 hours Time Spent Processing Ham: 101.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146440 89.03 94.74 86.39 2 DKIM_SIGNED 136009 76.78 87.99 71.60 3 XM_DK_Pass 129448 74.50 83.75 70.23 4 DKIM_VALID 128521 73.63 83.15 69.24 5 RELAYCOUNTRY_US 125699 79.16 81.32 78.16 6 XM_B_Unicode 121691 71.57 78.73 68.27 7 XMListUnsubscribeExists 105254 52.74 68.10 45.66 8 XM_B_SpammyWords 102339 51.17 66.21 44.23 9 DCC_CHECK 99242 39.28 64.21 27.78 10 DKIM_VALID_AU 98839 57.92 63.95 55.14 11 RCVD_IN_MSPIKE_H2 77224 41.38 49.96 37.41 12 XM_DK_Undo_02 65232 17.31 42.20 5.82 13 BAYES_50 65091 53.50 42.11 58.75 14 XM_B_Unicode3 64499 41.49 41.73 41.38 15 DCC_CHECK_NEGATIVE 55259 60.66 35.75 72.16 16 XM_B_SpammyWords2 54670 22.40 35.37 16.42 17 LOC_TINY_FONT_1 54075 26.00 34.99 21.85 18 FVGT_m_MULTI_ODD 53459 27.52 34.59 24.26 19 MIME_HTML_ONLY 53412 26.84 34.56 23.28 20 BAYES_99 51592 13.80 33.38 4.76 21 HTML_FONT_LOW_CONTRAST 51437 27.66 33.28 25.06 22 DKIM_VALID_EF 49758 29.41 32.19 28.13 23 TR_XM_DKIM_Undo 49430 12.84 31.98 4.00 24 T_KAM_HTML_FONT_INVALID 43221 20.73 27.96 17.40 25 BAYES_999 40576 10.90 26.25 3.82 26 XMSubLong 34681 24.61 22.44 25.62 27 TR_DCC_Bayes_99 34068 7.76 22.04 1.17 28 T_TM2_M_HEADER_IN_MSG 33825 30.10 21.88 33.90 29 XM_Body_Dirty_Words 33069 16.43 21.39 14.14 30 RELAYCOUNTRY_META 31205 8.98 20.19 3.81 31 XM_Multi_Part_URI 27551 15.54 17.82 14.49 32 XM_B_Unsub 24731 10.66 16.00 8.20 33 TR_XM_BayesUnsub 24196 9.33 15.65 6.42 34 LOTS_OF_MONEY 21668 8.79 14.02 6.37 35 RCVD_IN_MSPIKE_WL 20115 15.95 13.01 17.31 36 BOTNET_IPINHOSTNAME 19673 7.27 12.73 4.75 37 BOTNET 18386 4.72 11.90 1.41 38 XM_B_SpammyWords3 18256 6.14 11.81 3.53 39 TR_XM_SpammyRelay 18183 4.75 11.76 1.52 40 FSL_BULK_SIG 17902 5.64 11.58 2.89 41 UNPARSEABLE_RELAY 17882 8.40 11.57 6.93 42 TR_XM_SpammyWords4 17540 6.22 11.35 3.85 43 TR_XM_UnparsRelay 17522 7.19 11.34 5.27 44 RCVD_IN_BL_SPAMCOP_NET 16668 3.70 10.78 0.43 45 XMSexyCombo_05 16610 7.93 10.75 6.63 46 RCVD_IN_MSPIKE_H3 15921 11.12 10.30 11.50 47 TR_XM_SpammyWords2 15486 3.67 10.02 0.74 48 XM_UncommonTLD01 13550 5.37 8.77 3.81 49 MPART_ALT_DIFF 13549 6.49 8.77 5.44 50 XM_Evil_Numbers_Gen 13542 7.91 8.76 7.51 51 BAYES_80 12700 5.41 8.22 4.11 52 UNTRUSTED_Relay 12526 3.45 8.10 1.30 53 RELAYCOUNTRY_CA 12297 3.24 7.96 1.07 54 TR_XM_SPAMCOP 11975 2.63 7.75 0.28 55 BAYES_60 11546 8.91 7.47 9.57 56 XM_SendGrid 11400 5.40 7.38 4.49 57 LotsOfNums_01 10954 7.55 7.09 7.77 58 HTML_MIME_NO_HTML_TAG 10580 4.55 6.85 3.49 59 HTML_IMAGE_RATIO_02 10578 5.92 6.84 5.50 60 TM2_M_VERY_LONG_WORD 10352 3.88 6.70 2.58 61 TR_XM_PhishingBody 10240 4.56 6.63 3.61 62 MIME_HTML_ONLY_MULTI 10183 4.84 6.59 4.03 63 XMSubMetaSx_00 10065 4.32 6.51 3.30 64 RCVD_IN_MSPIKE_BL 10047 2.68 6.50 0.91 65 TR_XM_MSPIKECOMBO 9974 2.66 6.45 0.91 66 XM_B_Phish_Phrases 9013 4.30 5.83 3.60 67 XM_H_Long_From01 8474 4.97 5.48 4.73 68 XM_B_Investor 8182 2.77 5.29 1.61 69 TR_XM_DK_SendGrid 7661 3.64 4.96 3.04 70 TooManyTo_001 7580 9.54 4.90 11.67 71 BAYES_95 7502 3.22 4.85 2.46 72 DKIM_INVALID 7488 3.14 4.84 2.36 73 XM_B_SpammyTLD 7352 2.87 4.76 2.00 74 XMLngstWrd_00 7327 2.55 4.74 1.53 75 XMLngstWrd_01 7264 2.49 4.70 1.47 76 XM_SPF_SoftFail 7167 3.08 4.64 2.35 77 XMLngstWrd_02 7126 2.40 4.61 1.38 78 TR_XM_SpammyWords3 6965 1.73 4.51 0.45 79 XMLngstWrd_03 6799 2.27 4.40 1.29 80 XMLngstWrd_04 6732 2.22 4.36 1.24 81 XM_GoogleGroups 6588 2.94 4.26 2.33 82 HTML_IMAGE_RATIO_04 6583 4.43 4.26 4.51 83 T_XMDrugObfuBody_14 6359 2.46 4.11 1.69 84 XMNumbers 6276 3.55 4.06 3.32 85 RCVD_IN_MSPIKE_L5 6015 1.24 3.89 0.01 86 XM_B_Phish66 5748 2.35 3.72 1.71 87 HTML_TITLE_SUBJ_DIFF 5701 1.93 3.69 1.12 88 UPPERCASE_75_100 5644 1.91 3.65 1.11 89 SpammyFromTLD_01 5509 1.65 3.56 0.77 90 TR_XM_SpammyWords5 5303 1.99 3.43 1.32 91 XMDiploma_00 5279 2.58 3.42 2.20 92 XM_DIRTYINTL 5242 1.28 3.39 0.30 93 XMStrtUSub 5221 4.15 3.38 4.51 94 XM_OfRef6 5199 1.69 3.36 0.92 95 MIME_QP_LONG_LINE 5186 4.20 3.36 4.59 96 XM_UB50 5064 1.61 3.28 0.84 97 SpammyFromTLD_02 5007 1.20 3.24 0.25 98 HTML_IMAGE_RATIO_06 4950 3.04 3.20 2.97 99 RCVD_IN_VALIDITY_SAFE 4935 4.17 3.19 4.62 100 T_XMDrugObfuBody_08 4915 1.85 3.18 1.24 101 PDS_OTHER_BAD_TLD 4674 1.04 3.02 0.12 102 RCVD_IN_VALIDITY_RPBL 4502 0.93 2.91 0.01 103 MIME_HTML_MOSTLY 4501 2.73 2.91 2.65 104 T_REMOTE_IMAGE 4433 3.57 2.87 3.90 105 HTML_IMAGE_RATIO_08 4230 2.23 2.74 2.00 106 RCVD_IN_VALIDITY_CERTIFIED 4140 3.66 2.68 4.11 107 XM_B_SpammyWords4 4118 1.17 2.66 0.49 108 TM2_M_URI_OPT_OUT 4109 2.31 2.66 2.16 109 KHOP_HELO_FCRDNS 4100 1.94 2.65 1.61 110 RCVD_IN_IADB_LISTED 4045 3.92 2.62 4.53 111 USER_IN_DEF_DKIM_WL 4033 8.99 2.61 11.94 112 XM_CamelCaseFrm001 3982 1.95 2.58 1.66 113 T_FILL_THIS_FORM_SHORT 3905 1.37 2.53 0.83 114 XM_B_Unsub2 3884 1.69 2.51 1.31 115 TR_XM_SB_Phish 3824 2.34 2.47 2.27 116 RCVD_IN_MSPIKE_H4 3804 4.16 2.46 4.94 117 T_TooManySym_01 3657 5.44 2.37 6.85 118 XMSubPhish11 3627 2.27 2.35 2.24 119 URI_PHP_REDIR 3583 0.73 2.32 0.00 120 RCVD_IN_MSPIKE_L3 3509 1.25 2.27 0.77 121 RCVD_IN_IADB_SPF 3496 3.47 2.26 4.03 122 URI_NOVOWEL 3467 2.28 2.24 2.29 123 TR_XM_MSPIKECOMBO2 3318 0.77 2.15 0.13 124 XMStockSpam_06 3300 1.63 2.14 1.40 125 RCVD_IN_IADB_DK 3265 3.05 2.11 3.48 126 RCVD_IN_IADB_SENDERID 3262 3.12 2.11 3.58 127 XM_DK_Undo_01 3146 1.69 2.04 1.53 128 XM_UB99 3139 0.64 2.03 0.00 129 TR_XM_PHPDW 3132 0.89 2.03 0.36 130 TR_XM_PHPForged 3105 0.85 2.01 0.32 131 TR_XM_NoHeaderRelay 3063 0.71 1.98 0.12 132 TR_XM_FormFill2 3060 0.84 1.98 0.32 133 TR_LOTS_OF_MONEY3 3058 0.80 1.98 0.26 134 XM_H_PHPOS 3048 0.83 1.97 0.31 135 ALL_TRUSTED 3042 13.72 1.97 19.14 136 FROM_EXCESS_BASE64 3012 2.05 1.95 2.09 137 XMSexyCombo_01 2937 0.89 1.90 0.42 138 XMGenDplmaNmb 2902 1.45 1.88 1.26 139 XMBody_17 2858 0.88 1.85 0.43 140 RCVD_IN_PSBL 2838 0.92 1.84 0.50 141 BOTNET_NORDNS 2750 0.57 1.78 0.01 142 MAILING_LIST_MULTI 2749 2.89 1.78 3.41 143 SUBJ_ALL_CAPS 2741 1.64 1.77 1.58 144 URI_HEX 2729 1.29 1.77 1.08 145 URIBL_DBL_SPAM 2636 0.54 1.71 0.01 146 XM_B_COVIDMETA 2634 0.96 1.70 0.61 147 HK_RANDOM_REPLYTO 2618 0.62 1.69 0.12 148 XMSubMetaI_00 2537 0.89 1.64 0.54 149 HTML_TAG_BALANCE_BODY 2535 0.97 1.64 0.65 150 XM_UB999 2499 0.51 1.62 0.00 151 T_XMHurry_00 2487 1.13 1.61 0.91 152 MONEY_NOHTML 2458 0.55 1.59 0.07 153 TR_Symld_Words 2379 1.72 1.54 1.81 154 BAYES_40 2379 3.67 1.54 4.65 155 TR_XM_COVIDMETA4 2371 0.66 1.53 0.25 156 XM_URI_RBL 2371 0.56 1.53 0.11 157 XMBrknScrpt_02 2235 0.95 1.45 0.71 158 TR_XM_MaxSPIKE 2230 0.53 1.44 0.10 159 URIBL_BLACK 2224 0.49 1.44 0.06 160 T_XMDrugObfuBody_00 2195 0.79 1.42 0.50 161 HTTPS_HTTP_MISMATCH 2195 1.00 1.42 0.81 162 TM2_M_A_HREF_HREF 2181 0.71 1.41 0.38 163 XM_H_Undi_Recip 2146 0.63 1.39 0.28 164 TR_XM_FormFill 2141 0.45 1.39 0.01 165 RELAYCOUNTRY_RU 2135 0.46 1.38 0.04 166 XMHTML_After_End 2095 0.95 1.36 0.76 167 HTML_TAG_BALANCE_CENTER 2066 0.50 1.34 0.11 168 XMReplyNow 2062 0.62 1.33 0.28 169 MIXED_CENTER_CASE 2008 0.41 1.30 0.00 170 TR_Mismatch_TLD_01 2004 0.59 1.30 0.26 171 RCVD_IN_IADB_VOUCHED 1993 2.33 1.29 2.82 172 XM_Combo_Sbj 1976 0.57 1.28 0.25 173 MIXED_HREF_CASE 1968 0.40 1.27 0.00 174 MIXED_IMG_CASE 1956 0.40 1.27 0.01 175 MIXED_AREA_CASE 1945 0.40 1.26 0.00 176 URI_TRY_3LD 1936 0.81 1.25 0.60 177 TR_XM_BayesRelay 1929 0.40 1.25 0.00 178 BODY_URI_ONLY 1913 0.40 1.24 0.01 179 MPART_ALT_DIFF_COUNT 1858 0.78 1.20 0.58 180 BAYES_20 1850 2.70 1.20 3.39 181 XMSubNoVowel 1849 0.99 1.20 0.89 182 XM_H_Long_From02 1844 1.03 1.19 0.95 183 TR_MetaPhish_Combo_01 1823 1.18 1.18 1.17 184 FROM_SUSPICIOUS_NTLD 1819 0.39 1.18 0.03 185 RELAYCOUNTRY_AU 1810 0.56 1.17 0.27 186 MIXED_FONT_CASE 1788 0.37 1.16 0.00 187 RELAYCOUNTRY_FR 1732 0.56 1.12 0.30 188 URI_GOOG_STO_SPAMMY 1716 0.35 1.11 0.00 189 DIET_1 1715 0.56 1.11 0.31 190 XMPhish14 1693 1.06 1.10 1.04 191 TR_XM_Base64_M1 1661 1.00 1.07 0.96 192 TR_XM_COVIDMETA1 1660 0.44 1.07 0.15 193 RELAYCOUNTRY_DE 1652 0.55 1.07 0.32 194 HTML_FONT_SIZE_LARGE 1630 0.40 1.05 0.10 195 XM_UB60 1629 0.40 1.05 0.09 196 FROM_SUSPICIOUS_NTLD_FP 1623 0.35 1.05 0.02 197 FONT_INVIS_LONG_LINE 1611 0.44 1.04 0.16 198 XMBdyGiftCard01 1610 0.90 1.04 0.84 199 XMPhish30 1599 0.72 1.03 0.57 200 T_TooManySym_02 1499 3.19 0.97 4.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 289303 89.03 94.74 86.39 2 RELAYCOUNTRY_US 261755 79.16 81.32 78.16 3 DCC_CHECK_NEGATIVE 241659 60.66 35.75 72.16 4 DKIM_SIGNED 239768 76.78 87.99 71.60 5 XM_DK_Pass 235192 74.50 83.75 70.23 6 DKIM_VALID 231870 73.63 83.15 69.24 7 XM_B_Unicode 228612 71.57 78.73 68.27 8 BAYES_50 196755 53.50 42.11 58.75 9 DKIM_VALID_AU 184647 57.92 63.95 55.14 10 XMListUnsubscribeExists 152893 52.74 68.10 45.66 11 XM_B_SpammyWords 148104 51.17 66.21 44.23 12 XM_B_Unicode3 138569 41.49 41.73 41.38 13 RCVD_IN_MSPIKE_H2 125291 41.38 49.96 37.41 14 T_TM2_M_HEADER_IN_MSG 113520 30.10 21.88 33.90 15 DKIM_VALID_EF 94198 29.41 32.19 28.13 16 DCC_CHECK 93024 39.28 64.21 27.78 17 XMSubLong 85781 24.61 22.44 25.62 18 HTML_FONT_LOW_CONTRAST 83923 27.66 33.28 25.06 19 FVGT_m_MULTI_ODD 81241 27.52 34.59 24.26 20 MIME_HTML_ONLY 77963 26.84 34.56 23.28 21 LOC_TINY_FONT_1 73159 26.00 34.99 21.85 22 ALL_TRUSTED 64089 13.72 1.97 19.14 23 T_KAM_HTML_FONT_INVALID 58257 20.73 27.96 17.40 24 RCVD_IN_MSPIKE_WL 57969 15.95 13.01 17.31 25 XM_B_SpammyWords2 54975 22.40 35.37 16.42 26 XM_Multi_Part_URI 48512 15.54 17.82 14.49 27 XM_Body_Dirty_Words 47336 16.43 21.39 14.14 28 USER_IN_DEF_DKIM_WL 39976 8.99 2.61 11.94 29 TooManyTo_001 39097 9.54 4.90 11.67 30 RCVD_IN_MSPIKE_H3 38509 11.12 10.30 11.50 31 BAYES_00 34101 7.20 0.73 10.18 32 XM_DKIMWhitelistDomains 33204 6.98 0.62 9.92 33 BAYES_60 32040 8.91 7.47 9.57 34 XM_B_Unsub 27459 10.66 16.00 8.20 35 LotsOfNums_01 26016 7.55 7.09 7.77 36 XM_Evil_Numbers_Gen 25151 7.91 8.76 7.51 37 IN_ZIMBRA_NJ_WHITELIST 23271 4.79 0.11 6.95 38 UNPARSEABLE_RELAY 23220 8.40 11.57 6.93 39 T_TooManySym_01 22954 5.44 2.37 6.85 40 XMSexyCombo_05 22200 7.93 10.75 6.63 41 TR_XM_BayesUnsub 21484 9.33 15.65 6.42 42 LOTS_OF_MONEY 21338 8.79 14.02 6.37 43 TR_XM_DK_Bayes 20919 4.46 0.57 6.25 44 TR_XM_DK_Bayes1 20601 4.39 0.56 6.15 45 XM_DK_Undo_02 19500 17.31 42.20 5.82 46 HTML_IMAGE_RATIO_02 18417 5.92 6.84 5.50 47 MPART_ALT_DIFF 18232 6.49 8.77 5.44 48 TR_XM_DK_Bayes2 18077 3.83 0.44 5.40 49 XM_PDF 17946 3.95 0.90 5.36 50 TR_XM_UnparsRelay 17649 7.19 11.34 5.27 51 RCVD_IN_MSPIKE_H4 16542 4.16 2.46 4.94 52 BAYES_99 15950 13.80 33.38 4.76 53 BOTNET_IPINHOSTNAME 15893 7.27 12.73 4.75 54 XM_H_Long_From01 15838 4.97 5.48 4.73 55 BAYES_40 15572 3.67 1.54 4.65 56 RCVD_IN_VALIDITY_SAFE 15479 4.17 3.19 4.62 57 MIME_QP_LONG_LINE 15364 4.20 3.36 4.59 58 RCVD_IN_IADB_LISTED 15159 3.92 2.62 4.53 59 XMStrtUSub 15104 4.15 3.38 4.51 60 HTML_IMAGE_RATIO_04 15097 4.43 4.26 4.51 61 XM_SendGrid 15039 5.40 7.38 4.49 62 T_TooManySym_02 14118 3.19 0.97 4.22 63 RCVD_IN_VALIDITY_CERTIFIED 13773 3.66 2.68 4.11 64 BAYES_80 13758 5.41 8.22 4.11 65 MIME_HTML_ONLY_MULTI 13496 4.84 6.59 4.03 66 RCVD_IN_IADB_SPF 13490 3.47 2.26 4.03 67 TR_XM_DKIM_Undo 13402 12.84 31.98 4.00 68 T_REMOTE_IMAGE 13054 3.57 2.87 3.90 69 TR_XM_SpammyWords4 12883 6.22 11.35 3.85 70 BAYES_999 12790 10.90 26.25 3.82 71 RELAYCOUNTRY_META 12756 8.98 20.19 3.81 72 XM_UncommonTLD01 12744 5.37 8.77 3.81 73 TR_XM_PhishingBody 12081 4.56 6.63 3.61 74 XM_B_Phish_Phrases 12055 4.30 5.83 3.60 75 RCVD_IN_IADB_SENDERID 11993 3.12 2.11 3.58 76 XM_B_SpammyWords3 11806 6.14 11.81 3.53 77 HTML_MIME_NO_HTML_TAG 11680 4.55 6.85 3.49 78 RCVD_IN_IADB_DK 11656 3.05 2.11 3.48 79 MAILING_LIST_MULTI 11417 2.89 1.78 3.41 80 BAYES_20 11348 2.70 1.20 3.39 81 XMNumbers 11113 3.55 4.06 3.32 82 XMSubMetaSx_00 11058 4.32 6.51 3.30 83 TR_XM_DK_SendGrid 10167 3.64 4.96 3.04 84 HTML_IMAGE_RATIO_06 9937 3.04 3.20 2.97 85 FSL_BULK_SIG 9680 5.64 11.58 2.89 86 RCVD_IN_IADB_VOUCHED 9433 2.33 1.29 2.82 87 MIME_HTML_MOSTLY 8870 2.73 2.91 2.65 88 TM2_M_VERY_LONG_WORD 8645 3.88 6.70 2.58 89 XM_H_Trusted_IP 8423 1.72 0.00 2.52 90 BAYES_95 8247 3.22 4.85 2.46 91 ANY_BOUNCE_MESSAGE 8161 1.90 0.74 2.44 92 BOUNCE_MESSAGE 8159 1.90 0.74 2.44 93 TooManyTo_002 8014 1.90 0.82 2.39 94 DKIM_INVALID 7898 3.14 4.84 2.36 95 XM_SPF_SoftFail 7886 3.08 4.64 2.35 96 XM_GoogleGroups 7810 2.94 4.26 2.33 97 URI_NOVOWEL 7668 2.28 2.24 2.29 98 TR_XM_SB_Phish 7605 2.34 2.47 2.27 99 XMSubPhish11 7501 2.27 2.35 2.24 100 XMDiploma_00 7366 2.58 3.42 2.20 101 TM2_M_URI_OPT_OUT 7220 2.31 2.66 2.16 102 BAYES_05 7107 1.61 0.50 2.12 103 FROM_EXCESS_BASE64 7015 2.05 1.95 2.09 104 HELO_NODOT 6766 1.59 0.66 2.02 105 HELO_NO_DOMAIN 6762 1.59 0.66 2.02 106 HTML_IMAGE_RATIO_08 6708 2.23 2.74 2.00 107 XM_B_SpammyTLD 6704 2.87 4.76 2.00 108 INVALID_MSGID 6678 1.40 0.12 1.99 109 TVD_RCVD_IP 6518 1.39 0.19 1.95 110 RCVD_IN_IADB_OPTIN 6433 1.57 0.81 1.92 111 XMNoVowels 6192 1.43 0.51 1.85 112 IN_HORDE_ADDRESS_BOOK 6146 1.29 0.09 1.84 113 TR_Symld_Words 6061 1.72 1.54 1.81 114 TO_MALFORMED 5939 1.22 0.03 1.77 115 XM_B_Phish66 5739 2.35 3.72 1.71 116 T_XMDrugObfuBody_14 5670 2.46 4.11 1.69 117 XM_CamelCaseFrm001 5565 1.95 2.58 1.66 118 TooManyTo_003 5404 1.33 0.71 1.61 119 KHOP_HELO_FCRDNS 5402 1.94 2.65 1.61 120 XM_B_Investor 5398 2.77 5.29 1.61 121 SUBJ_ALL_CAPS 5275 1.64 1.77 1.58 122 XMLngstWrd_00 5138 2.55 4.74 1.53 123 XM_DK_Undo_01 5133 1.69 2.04 1.53 124 TR_XM_SpammyRelay 5084 4.75 11.76 1.52 125 MSGID_NOFQDN1 5036 1.04 0.05 1.50 126 XMLngstWrd_01 4927 2.49 4.70 1.47 127 BOTNET 4733 4.72 11.90 1.41 128 XMStockSpam_06 4678 1.63 2.14 1.40 129 XMLngstWrd_02 4629 2.40 4.61 1.38 130 TR_XM_SpammyWords5 4432 1.99 3.43 1.32 131 XM_B_Unsub2 4388 1.69 2.51 1.31 132 XMCapTrack 4370 1.01 0.38 1.30 133 UNTRUSTED_Relay 4360 3.45 8.10 1.30 134 XMLngstWrd_03 4333 2.27 4.40 1.29 135 XMGappySubj_01 4214 0.91 0.15 1.26 136 XMGenDplmaNmb 4211 1.45 1.88 1.26 137 T_XMDrugObfuBody_08 4159 1.85 3.18 1.24 138 XMLngstWrd_04 4142 2.22 4.36 1.24 139 TooManyTo_004 3990 1.02 0.65 1.19 140 XMBSHREFv2 3959 0.92 0.35 1.18 141 TR_DCC_Bayes_99 3934 7.76 22.04 1.17 142 TR_MetaPhish_Combo_01 3928 1.18 1.18 1.17 143 HTML_TITLE_SUBJ_DIFF 3761 1.93 3.69 1.12 144 UPPERCASE_75_100 3724 1.91 3.65 1.11 145 TVD_SPACE_RATIO 3612 0.77 0.10 1.08 146 URI_HEX 3606 1.29 1.77 1.08 147 RELAYCOUNTRY_CA 3580 3.24 7.96 1.07 148 XMPhish14 3485 1.06 1.10 1.04 149 HTML_FONT_FACE_BAD 3465 0.97 0.83 1.03 150 T_TooManySym_03 3418 0.80 0.31 1.02 151 TooManyTo_005 3299 0.85 0.56 0.99 152 TR_XM_Base64_M1 3218 1.00 1.07 0.96 153 XM_ProductURIs 3183 0.95 0.94 0.95 154 XM_H_Long_From02 3182 1.03 1.19 0.95 155 RCVD_IN_RP_SAFE 3151 0.85 0.64 0.94 156 XM_OfRef6 3073 1.69 3.36 0.92 157 RCVD_IN_MSPIKE_BL 3063 2.68 6.50 0.91 158 TR_XM_MSPIKECOMBO 3061 2.66 6.45 0.91 159 DKIM_ADSP_CUSTOM_MED 3054 0.93 0.96 0.91 160 T_XMHurry_00 3041 1.13 1.61 0.91 161 XM_E_Blogspot 3008 0.67 0.18 0.90 162 XMSubNoVowel 2980 0.99 1.20 0.89 163 RCVD_IN_MSPIKE_H5 2918 0.68 0.25 0.87 164 XMBody_95 2812 0.62 0.15 0.84 165 RCVD_IN_RP_CERTIFIED 2808 0.74 0.52 0.84 166 XM_UB50 2808 1.61 3.28 0.84 167 XMBdyGiftCard01 2807 0.90 1.04 0.84 168 T_FILL_THIS_FORM_SHORT 2792 1.37 2.53 0.83 169 HTTPS_HTTP_MISMATCH 2718 1.00 1.42 0.81 170 XM_ShortIntro_01 2596 0.69 0.51 0.78 171 RCVD_IN_MSPIKE_L3 2595 1.25 2.27 0.77 172 SpammyFromTLD_01 2585 1.65 3.56 0.77 173 XMHTML_After_End 2549 0.95 1.36 0.76 174 TR_XM_SpammyWords2 2475 3.67 10.02 0.74 175 XMBrknScrpt_02 2392 0.95 1.45 0.71 176 T_OBFU_PDF_ATTACH 2220 0.53 0.23 0.66 177 HTML_TAG_BALANCE_BODY 2190 0.97 1.64 0.65 178 XM_RXBody 2130 0.59 0.48 0.64 179 XM_H_PHPMailer 2053 0.67 0.80 0.61 180 XM_B_COVIDMETA 2049 0.96 1.70 0.61 181 SHORT_HELO_AND_INLINE_IMAGE 2049 0.45 0.10 0.61 182 URI_TRY_3LD 2022 0.81 1.25 0.60 183 XMHTMLBadTable_001 1971 0.68 0.88 0.59 184 NML_ADSP_CUSTOM_MED 1964 0.64 0.75 0.59 185 RELAYCOUNTRY_GB 1955 0.68 0.89 0.58 186 MPART_ALT_DIFF_COUNT 1938 0.78 1.20 0.58 187 XMPhish30 1918 0.72 1.03 0.57 188 XM_B_COPY_HTML 1906 0.61 0.70 0.57 189 RCVD_IN_SORBS_DUL 1883 0.42 0.12 0.56 190 XMSubMetaI_00 1817 0.89 1.64 0.54 191 T_Symld_Words_02 1744 0.61 0.81 0.52 192 T_MANY_PILL_PRICE 1720 0.35 0.01 0.51 193 RCVD_IN_PSBL 1682 0.92 1.84 0.50 194 T_XMDrugObfuBody_00 1661 0.79 1.42 0.50 195 FORGED_GMAIL_RCVD 1644 0.59 0.82 0.49 196 HTML_IMAGE_ONLY_20 1637 0.55 0.68 0.49 197 XM_B_SpammyWords4 1630 1.17 2.66 0.49 198 HTML_IMAGE_ONLY_32 1580 0.41 0.27 0.47 199 XMMoneyMeta_00 1578 0.55 0.71 0.47 200 MISSING_HEADERS 1577 0.50 0.56 0.47 ----------------------------------------------------------------------