Email: 511536 Autolearn: 0 AvgScore: 3.72 AvgScanTime: 1.27 sec Spam: 170659 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 1.39 sec Ham: 340877 Autolearn: 0 AvgScore: -1.48 AvgScanTime: 1.21 sec Time Spent Running SA: 180.68 hours Time Spent Processing Spam: 65.95 hours Time Spent Processing Ham: 114.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161304 89.60 94.52 87.13 2 DKIM_SIGNED 152936 79.07 89.61 73.79 3 XM_DK_Pass 149586 77.48 87.65 72.39 4 DKIM_VALID 148423 76.56 86.97 71.34 5 RELAYCOUNTRY_US 141074 81.96 82.66 81.61 6 XM_B_Unicode 141040 74.33 82.64 70.16 7 DCC_CHECK 117703 43.72 68.97 31.08 8 XMListUnsubscribeExists 116972 54.85 68.54 48.00 9 XM_B_SpammyWords 116675 51.65 68.37 43.28 10 DKIM_VALID_AU 115365 59.94 67.60 56.11 11 RCVD_IN_MSPIKE_H2 84994 42.54 49.80 38.91 12 XM_DK_Undo_02 78251 19.85 45.85 6.83 13 XM_B_Unicode3 76826 42.00 45.02 40.50 14 XM_B_SpammyWords2 67637 24.97 39.63 17.62 15 BAYES_50 67016 50.76 39.27 56.51 16 LOC_TINY_FONT_1 65223 28.08 38.22 23.01 17 BAYES_99 62037 15.93 36.35 5.70 18 TR_XM_DKIM_Undo 60991 15.11 35.74 4.79 19 HTML_FONT_LOW_CONTRAST 59680 29.31 34.97 26.48 20 DKIM_VALID_EF 57931 30.27 33.95 28.43 21 FVGT_m_MULTI_ODD 56823 27.83 33.30 25.10 22 MIME_HTML_ONLY 54118 24.04 31.71 20.19 23 DCC_CHECK_NEGATIVE 52907 56.24 31.00 68.87 24 T_KAM_HTML_FONT_INVALID 50870 22.69 29.81 19.12 25 BAYES_999 49230 12.63 28.85 4.51 26 TR_DCC_Bayes_99 42374 9.65 24.83 2.05 27 XM_Body_Dirty_Words 41031 15.39 24.04 11.06 28 T_TM2_M_HEADER_IN_MSG 37287 27.50 21.85 30.33 29 XMSubLong 37000 21.35 21.68 21.19 30 RELAYCOUNTRY_META 32445 8.93 19.01 3.88 31 XM_Multi_Part_URI 31009 14.53 18.17 12.71 32 XM_B_Unsub 28980 11.85 16.98 9.28 33 TR_XM_BayesUnsub 28441 10.34 16.67 7.17 34 LOTS_OF_MONEY 25975 9.74 15.22 7.00 35 RCVD_IN_MSPIKE_WL 22588 16.50 13.24 18.13 36 TR_XM_SpammyWords2 22257 4.91 13.04 0.83 37 TR_XM_SpammyWords4 21822 7.32 12.79 4.59 38 UNPARSEABLE_RELAY 21636 9.44 12.68 7.83 39 TR_XM_UnparsRelay 21095 8.15 12.36 6.04 40 XM_B_SpammyWords3 21011 6.82 12.31 4.07 41 TR_XM_SpammyRelay 20494 5.07 12.01 1.59 42 FSL_BULK_SIG 19852 6.02 11.63 3.20 43 RCVD_IN_BL_SPAMCOP_NET 19501 4.14 11.43 0.49 44 BOTNET_IPINHOSTNAME 19355 6.92 11.34 4.71 45 BOTNET 17469 4.37 10.24 1.44 46 RCVD_IN_MSPIKE_H3 17191 11.10 10.07 11.62 47 XMSexyCombo_05 17138 5.37 10.04 3.03 48 XM_Evil_Numbers_Gen 15174 8.42 8.89 8.19 49 BAYES_80 14478 5.76 8.48 4.40 50 LotsOfNums_01 13572 8.67 7.95 9.03 51 RELAYCOUNTRY_CA 12974 3.24 7.60 1.05 52 TR_XM_SPAMCOP 12905 2.67 7.56 0.23 53 XM_UncommonTLD01 12633 4.91 7.40 3.66 54 XM_SendGrid 12555 5.87 7.36 5.12 55 UNTRUSTED_Relay 12415 3.38 7.27 1.42 56 BAYES_60 11799 8.29 6.91 8.98 57 MPART_ALT_DIFF 11275 5.94 6.61 5.61 58 HTML_IMAGE_RATIO_02 10504 5.78 6.15 5.59 59 XM_H_Long_From01 10435 5.43 6.11 5.09 60 TR_XM_PhishingBody 10131 4.04 5.94 3.10 61 XMSubMetaSx_00 9843 4.07 5.77 3.23 62 XM_B_Phish_Phrases 9367 4.31 5.49 3.72 63 TM2_M_VERY_LONG_WORD 9321 3.06 5.46 1.85 64 XMStrtUSub 9307 4.84 5.45 4.53 65 BAYES_95 8849 3.58 5.19 2.77 66 HTML_IMAGE_RATIO_04 8701 5.03 5.10 5.00 67 TR_XM_DK_SendGrid 8317 3.82 4.87 3.29 68 XM_B_Investor 8122 2.78 4.76 1.79 69 XM_DIRTYINTL 7908 1.75 4.63 0.31 70 TooManyTo_001 7813 7.28 4.58 8.64 71 T_XMDrugObfuBody_14 7772 2.66 4.55 1.71 72 XM_SPF_SoftFail 7761 3.31 4.55 2.69 73 RCVD_IN_MSPIKE_BL 7613 2.24 4.46 1.12 74 MIME_HTML_ONLY_MULTI 7607 4.14 4.46 3.99 75 TR_XM_SpammyWords5 7595 2.48 4.45 1.49 76 TR_XM_MSPIKECOMBO 7445 2.19 4.36 1.11 77 XMBody_17 7119 1.68 4.17 0.43 78 XM_OfRef6 7008 2.11 4.11 1.10 79 MIME_QP_LONG_LINE 6951 5.06 4.07 5.55 80 HTML_IMAGE_RATIO_06 5849 4.19 3.43 4.57 81 XM_B_SpammyTLD 5784 2.60 3.39 2.20 82 HTML_MIME_NO_HTML_TAG 5766 2.92 3.38 2.69 83 XM_UB50 5759 1.74 3.37 0.92 84 XMBrknScrpt_02 5718 1.58 3.35 0.70 85 XMNumbers 5706 3.30 3.34 3.29 86 T_REMOTE_IMAGE 5588 3.59 3.27 3.75 87 XM_B_Phish66 5518 2.32 3.23 1.86 88 HTML_IMAGE_RATIO_08 5486 3.00 3.21 2.89 89 XM_B_Unsub2 5362 2.27 3.14 1.84 90 XMDiploma_00 5336 1.99 3.13 1.42 91 T_FILL_THIS_FORM_SHORT 5317 1.70 3.12 0.99 92 RCVD_IN_VALIDITY_SAFE 5309 4.04 3.11 4.51 93 SUBJ_ALL_CAPS 5230 2.13 3.06 1.66 94 MIME_HTML_MOSTLY 5227 2.55 3.06 2.29 95 RCVD_IN_IADB_LISTED 5221 4.41 3.06 5.09 96 T_XMDrugObfuBody_08 4950 2.21 2.90 1.87 97 XM_CamelCaseFrm001 4926 2.19 2.89 1.85 98 RCVD_IN_MSPIKE_H4 4840 4.49 2.84 5.31 99 SpammyFromTLD_01 4812 1.50 2.82 0.85 100 SpammyFromTLD_02 4776 1.22 2.80 0.43 101 TM2_M_URI_OPT_OUT 4616 2.46 2.70 2.34 102 XM_GoogleGroups 4586 2.31 2.69 2.13 103 RCVD_IN_IADB_SPF 4516 3.88 2.65 4.50 104 RCVD_IN_VALIDITY_RPBL 4515 0.93 2.65 0.07 105 DKIM_INVALID 4513 2.51 2.64 2.44 106 XMLngstWrd_00 4324 1.62 2.53 1.16 107 XMLngstWrd_01 4273 1.56 2.50 1.09 108 RCVD_IN_IADB_DK 4258 3.42 2.50 3.88 109 TR_XM_MSPIKECOMBO2 4219 0.90 2.47 0.11 110 RCVD_IN_IADB_SENDERID 4210 3.50 2.47 4.02 111 XMLngstWrd_02 4177 1.47 2.45 0.98 112 T_TooManySym_01 4136 4.98 2.42 6.26 113 RCVD_IN_MSPIKE_L3 4076 1.42 2.39 0.94 114 XM_B_SpammyWords4 4052 1.15 2.37 0.53 115 BOTNET_NORDNS 4035 0.80 2.36 0.01 116 FROM_EXCESS_BASE64 4019 2.23 2.35 2.17 117 MAILING_LIST_MULTI 3945 2.94 2.31 3.26 118 RCVD_IN_VALIDITY_CERTIFIED 3807 3.35 2.23 3.91 119 XMLngstWrd_03 3801 1.33 2.23 0.89 120 XM_H_Undi_Recip 3796 0.89 2.22 0.23 121 URI_NOVOWEL 3786 2.25 2.22 2.26 122 USER_IN_DEF_DKIM_WL 3781 8.68 2.22 11.92 123 UPPERCASE_75_100 3745 1.18 2.19 0.67 124 XMLngstWrd_04 3731 1.28 2.19 0.82 125 TR_XM_NoHeaderRelay 3727 0.81 2.18 0.12 126 XM_DK_Undo_01 3722 1.87 2.18 1.72 127 TR_XM_SB_Phish 3717 2.10 2.18 2.06 128 MONEY_NOHTML 3700 0.77 2.17 0.07 129 TR_XM_SpammyWords3 3673 1.05 2.15 0.50 130 RCVD_IN_PSBL 3666 1.10 2.15 0.57 131 HTML_TITLE_SUBJ_DIFF 3631 1.17 2.13 0.69 132 XMSubPhish11 3547 2.04 2.08 2.02 133 XM_B_COVIDMETA 3304 0.92 1.94 0.41 134 XMSexyCombo_01 3146 0.92 1.84 0.46 135 T_XMHurry_00 3146 0.96 1.84 0.52 136 URI_HEX 3139 1.48 1.84 1.30 137 TR_LOTS_OF_MONEY3 3136 0.81 1.84 0.30 138 TR_XM_MaxSPIKE 2923 0.63 1.71 0.09 139 TR_XM_FormFill 2880 0.57 1.69 0.01 140 XM_URI_RBL 2851 0.66 1.67 0.15 141 TR_XM_BayesRelay 2831 0.56 1.66 0.00 142 URIBL_BLACK 2825 0.63 1.66 0.12 143 XM_UB99 2820 0.55 1.65 0.00 144 XMStockSpam_06 2768 1.33 1.62 1.18 145 TR_XM_Undi_Recip5 2738 0.54 1.60 0.01 146 RCVD_IN_MSPIKE_L5 2715 0.57 1.59 0.05 147 HTML_TAG_BALANCE_BODY 2686 0.97 1.57 0.66 148 LOADSA_MONEY_COMBO 2670 0.63 1.56 0.16 149 BAYES_40 2653 3.71 1.55 4.79 150 RELAYCOUNTRY_RU 2650 0.56 1.55 0.06 151 XMHTML_After_End 2643 1.00 1.55 0.73 152 MPART_ALT_DIFF_COUNT 2630 1.00 1.54 0.73 153 ADVANCE_FEE_5_NEW_MONEY 2622 0.51 1.54 0.00 154 T_XMDrugObfuBody_00 2595 0.90 1.52 0.60 155 RCVD_IN_IADB_VOUCHED 2558 2.62 1.50 3.18 156 XMGenDplmaNmb 2556 1.01 1.50 0.76 157 TR_XM_Undi_RecipCombo2 2555 0.50 1.50 0.00 158 URI_TRY_3LD 2549 0.86 1.49 0.54 159 HK_RANDOM_REPLYTO 2511 0.56 1.47 0.10 160 TR_XM_Undi_Recip11 2481 0.52 1.45 0.06 161 RELAYCOUNTRY_FR 2452 0.67 1.44 0.29 162 XM_OfRef7 2387 0.54 1.40 0.11 163 UNDISC_MONEY 2365 0.47 1.39 0.00 164 XM_H_Long_From02 2364 1.32 1.39 1.29 165 HTTPS_HTTP_MISMATCH 2313 0.98 1.36 0.79 166 PDS_OTHER_BAD_TLD 2311 0.57 1.35 0.18 167 XMClaimOffer 2273 0.51 1.33 0.09 168 ALL_TRUSTED 2198 10.71 1.29 15.43 169 XM_Nigeria_01 2185 0.44 1.28 0.02 170 RELAYCOUNTRY_GB 2178 0.83 1.28 0.61 171 XM_UB999 2176 0.43 1.28 0.00 172 XM_Body_Dirty_Words_01 2171 0.55 1.27 0.19 173 KHOP_HELO_FCRDNS 2151 1.60 1.26 1.77 174 RELAYCOUNTRY_AU 2133 0.66 1.25 0.36 175 TR_XM_PHPDW 2131 0.62 1.25 0.31 176 TR_XM_PHPForged 2049 0.58 1.20 0.26 177 HK_SCAM 2048 0.40 1.20 0.00 178 TR_XM_FormFill2 2029 0.57 1.19 0.26 179 XM_H_PHPOS 2021 0.57 1.18 0.26 180 XFER_LOTSA_MONEY 1992 0.41 1.17 0.03 181 XMMoneyMeta_00 1992 0.74 1.17 0.53 182 TR_Symld_Words 1941 1.54 1.14 1.74 183 REMOVE_BEFORE_LINK 1924 0.63 1.13 0.38 184 XMBdyGiftCard01 1900 0.83 1.11 0.69 185 TR_XM_Base64_M1 1883 1.01 1.10 0.96 186 TR_XM_Undi_Recip2 1881 0.38 1.10 0.02 187 FORM_FRAUD_5 1864 0.37 1.09 0.00 188 SUBJ_DOLLARS 1860 0.73 1.09 0.56 189 TR_MetaPhish_Combo_01 1832 0.95 1.07 0.89 190 BAYES_20 1820 2.77 1.07 3.62 191 MONEY_FRAUD_8 1800 0.35 1.05 0.00 192 XM_OfRef8 1788 0.37 1.05 0.03 193 MONEY_FORM_SHORT 1756 0.35 1.03 0.01 194 URIBL_DBL_SPAM 1756 0.35 1.03 0.01 195 FONT_INVIS_LONG_LINE 1720 0.38 1.01 0.06 196 XM_PDF 1677 3.79 0.98 5.19 197 TR_XM_Undi_Recip6 1664 0.33 0.98 0.00 198 XMPhish30 1660 0.64 0.97 0.47 199 XMReplyNow 1641 0.49 0.96 0.25 200 HTML_FONT_TINY_NORDNS 1633 0.36 0.96 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297020 89.60 94.52 87.13 2 RELAYCOUNTRY_US 278192 81.96 82.66 81.61 3 DKIM_SIGNED 251520 79.07 89.61 73.79 4 XM_DK_Pass 246776 77.48 87.65 72.39 5 DKIM_VALID 243196 76.56 86.97 71.34 6 XM_B_Unicode 239169 74.33 82.64 70.16 7 DCC_CHECK_NEGATIVE 234769 56.24 31.00 68.87 8 BAYES_50 192635 50.76 39.27 56.51 9 DKIM_VALID_AU 191262 59.94 67.60 56.11 10 XMListUnsubscribeExists 163617 54.85 68.54 48.00 11 XM_B_SpammyWords 147540 51.65 68.37 43.28 12 XM_B_Unicode3 138039 42.00 45.02 40.50 13 RCVD_IN_MSPIKE_H2 132626 42.54 49.80 38.91 14 DCC_CHECK 105928 43.72 68.97 31.08 15 T_TM2_M_HEADER_IN_MSG 103399 27.50 21.85 30.33 16 DKIM_VALID_EF 96901 30.27 33.95 28.43 17 HTML_FONT_LOW_CONTRAST 90257 29.31 34.97 26.48 18 FVGT_m_MULTI_ODD 85553 27.83 33.30 25.10 19 LOC_TINY_FONT_1 78433 28.08 38.22 23.01 20 XMSubLong 72234 21.35 21.68 21.19 21 MIME_HTML_ONLY 68838 24.04 31.71 20.19 22 T_KAM_HTML_FONT_INVALID 65183 22.69 29.81 19.12 23 RCVD_IN_MSPIKE_WL 61799 16.50 13.24 18.13 24 XM_B_SpammyWords2 60075 24.97 39.63 17.62 25 ALL_TRUSTED 52608 10.71 1.29 15.43 26 XM_Multi_Part_URI 43312 14.53 18.17 12.71 27 USER_IN_DEF_DKIM_WL 40622 8.68 2.22 11.92 28 RCVD_IN_MSPIKE_H3 39613 11.10 10.07 11.62 29 XM_Body_Dirty_Words 37692 15.39 24.04 11.06 30 BAYES_00 37236 7.50 0.66 10.92 31 XM_DKIMWhitelistDomains 31674 6.32 0.37 9.29 32 XM_B_Unsub 31645 11.85 16.98 9.28 33 LotsOfNums_01 30786 8.67 7.95 9.03 34 BAYES_60 30614 8.29 6.91 8.98 35 TooManyTo_001 29435 7.28 4.58 8.64 36 XM_Evil_Numbers_Gen 27905 8.42 8.89 8.19 37 UNPARSEABLE_RELAY 26677 9.44 12.68 7.83 38 TR_XM_BayesUnsub 24430 10.34 16.67 7.17 39 IN_ZIMBRA_NJ_WHITELIST 24201 4.76 0.09 7.10 40 LOTS_OF_MONEY 23863 9.74 15.22 7.00 41 XM_DK_Undo_02 23279 19.85 45.85 6.83 42 T_TooManySym_01 21349 4.98 2.42 6.26 43 TR_XM_UnparsRelay 20596 8.15 12.36 6.04 44 TR_XM_DK_Bayes 19679 4.01 0.50 5.77 45 BAYES_99 19430 15.93 36.35 5.70 46 TR_XM_DK_Bayes1 19333 3.94 0.49 5.67 47 MPART_ALT_DIFF 19109 5.94 6.61 5.61 48 HTML_IMAGE_RATIO_02 19056 5.78 6.15 5.59 49 MIME_QP_LONG_LINE 18918 5.06 4.07 5.55 50 RCVD_IN_MSPIKE_H4 18114 4.49 2.84 5.31 51 XM_PDF 17700 3.79 0.98 5.19 52 XM_SendGrid 17448 5.87 7.36 5.12 53 RCVD_IN_IADB_LISTED 17362 4.41 3.06 5.09 54 XM_H_Long_From01 17356 5.43 6.11 5.09 55 HTML_IMAGE_RATIO_04 17045 5.03 5.10 5.00 56 TR_XM_DK_Bayes2 16961 3.44 0.39 4.98 57 TR_XM_DKIM_Undo 16322 15.11 35.74 4.79 58 BAYES_40 16316 3.71 1.55 4.79 59 BOTNET_IPINHOSTNAME 16059 6.92 11.34 4.71 60 TR_XM_SpammyWords4 15633 7.32 12.79 4.59 61 HTML_IMAGE_RATIO_06 15564 4.19 3.43 4.57 62 XMStrtUSub 15430 4.84 5.45 4.53 63 BAYES_999 15377 12.63 28.85 4.51 64 RCVD_IN_VALIDITY_SAFE 15364 4.04 3.11 4.51 65 RCVD_IN_IADB_SPF 15350 3.88 2.65 4.50 66 BAYES_80 15001 5.76 8.48 4.40 67 XM_B_SpammyWords3 13884 6.82 12.31 4.07 68 RCVD_IN_IADB_SENDERID 13693 3.50 2.47 4.02 69 MIME_HTML_ONLY_MULTI 13591 4.14 4.46 3.99 70 RCVD_IN_VALIDITY_CERTIFIED 13321 3.35 2.23 3.91 71 RCVD_IN_IADB_DK 13231 3.42 2.50 3.88 72 RELAYCOUNTRY_META 13225 8.93 19.01 3.88 73 XM_H_Trusted_IP 13080 2.56 0.00 3.84 74 T_REMOTE_IMAGE 12772 3.59 3.27 3.75 75 XM_B_Phish_Phrases 12693 4.31 5.49 3.72 76 XM_UncommonTLD01 12488 4.91 7.40 3.66 77 BAYES_20 12327 2.77 1.07 3.62 78 TR_XM_DK_SendGrid 11221 3.82 4.87 3.29 79 XMNumbers 11200 3.30 3.34 3.29 80 MAILING_LIST_MULTI 11105 2.94 2.31 3.26 81 XMSubMetaSx_00 10997 4.07 5.77 3.23 82 FSL_BULK_SIG 10925 6.02 11.63 3.20 83 RCVD_IN_IADB_VOUCHED 10839 2.62 1.50 3.18 84 TR_XM_PhishingBody 10559 4.04 5.94 3.10 85 T_TooManySym_02 10478 2.25 0.60 3.07 86 XMSexyCombo_05 10312 5.37 10.04 3.03 87 HTML_IMAGE_RATIO_08 9836 3.00 3.21 2.89 88 BAYES_95 9459 3.58 5.19 2.77 89 HTML_MIME_NO_HTML_TAG 9186 2.92 3.38 2.69 90 XM_SPF_SoftFail 9159 3.31 4.55 2.69 91 DKIM_INVALID 8324 2.51 2.64 2.44 92 TM2_M_URI_OPT_OUT 7977 2.46 2.70 2.34 93 TooManyTo_002 7916 1.73 0.54 2.32 94 BAYES_05 7857 1.71 0.52 2.30 95 MIME_HTML_MOSTLY 7801 2.55 3.06 2.29 96 URI_NOVOWEL 7709 2.25 2.22 2.26 97 ANY_BOUNCE_MESSAGE 7633 1.69 0.60 2.24 98 BOUNCE_MESSAGE 7628 1.69 0.60 2.24 99 XM_B_SpammyTLD 7495 2.60 3.39 2.20 100 TVD_RCVD_IP 7431 1.57 0.34 2.18 101 RCVD_IN_IADB_OPTIN 7415 1.75 0.91 2.18 102 FROM_EXCESS_BASE64 7382 2.23 2.35 2.17 103 XM_GoogleGroups 7249 2.31 2.69 2.13 104 HELO_NODOT 7031 1.58 0.62 2.06 105 TR_XM_SB_Phish 7030 2.10 2.18 2.06 106 HELO_NO_DOMAIN 7025 1.58 0.61 2.06 107 TR_DCC_Bayes_99 6996 9.65 24.83 2.05 108 XMSubPhish11 6883 2.04 2.08 2.02 109 INVALID_MSGID 6648 1.34 0.13 1.95 110 IN_HORDE_ADDRESS_BOOK 6457 1.30 0.11 1.89 111 T_XMDrugObfuBody_08 6358 2.21 2.90 1.87 112 XM_B_Phish66 6350 2.32 3.23 1.86 113 TM2_M_VERY_LONG_WORD 6307 3.06 5.46 1.85 114 XM_CamelCaseFrm001 6295 2.19 2.89 1.85 115 XM_B_Unsub2 6257 2.27 3.14 1.84 116 XM_B_Investor 6096 2.78 4.76 1.79 117 TO_MALFORMED 6076 1.19 0.01 1.78 118 KHOP_HELO_FCRDNS 6020 1.60 1.26 1.77 119 TR_Symld_Words 5920 1.54 1.14 1.74 120 XM_DK_Undo_01 5852 1.87 2.18 1.72 121 MSGID_NOFQDN1 5827 1.15 0.04 1.71 122 T_XMDrugObfuBody_14 5827 2.66 4.55 1.71 123 SUBJ_ALL_CAPS 5657 2.13 3.06 1.66 124 TR_XM_SpammyRelay 5425 5.07 12.01 1.59 125 TR_XM_SpammyWords5 5091 2.48 4.45 1.49 126 TooManyTo_003 5080 1.14 0.43 1.49 127 XMSubNoVowel 5054 1.27 0.85 1.48 128 XMGappySubj_01 4908 1.01 0.14 1.44 129 BOTNET 4899 4.37 10.24 1.44 130 UNTRUSTED_Relay 4856 3.38 7.27 1.42 131 XMDiploma_00 4851 1.99 3.13 1.42 132 XMBody_95 4826 1.00 0.15 1.42 133 URI_HEX 4435 1.48 1.84 1.30 134 XM_H_Long_From02 4408 1.32 1.39 1.29 135 XMBSHREFv2 4358 0.92 0.22 1.28 136 XMCapTrack 4169 0.94 0.38 1.22 137 RCVD_IN_MSPIKE_H5 4072 0.90 0.33 1.19 138 XMStockSpam_06 4014 1.33 1.62 1.18 139 XMLngstWrd_00 3967 1.62 2.53 1.16 140 RCVD_IN_MSPIKE_BL 3828 2.24 4.46 1.12 141 TR_XM_MSPIKECOMBO 3777 2.19 4.36 1.11 142 XM_OfRef6 3760 2.11 4.11 1.10 143 XMLngstWrd_01 3719 1.56 2.50 1.09 144 TooManyTo_004 3629 0.84 0.38 1.06 145 RELAYCOUNTRY_CA 3588 3.24 7.60 1.05 146 XMNoVowels 3552 0.84 0.43 1.04 147 HTML_FONT_FACE_BAD 3417 0.97 0.89 1.00 148 T_FILL_THIS_FORM_SHORT 3388 1.70 3.12 0.99 149 XMLngstWrd_02 3350 1.47 2.45 0.98 150 TR_XM_Base64_M1 3264 1.01 1.10 0.96 151 RCVD_IN_MSPIKE_L3 3206 1.42 2.39 0.94 152 XM_UB50 3139 1.74 3.37 0.92 153 DKIM_ADSP_CUSTOM_MED 3086 0.87 0.79 0.91 154 TR_MetaPhish_Combo_01 3034 0.95 1.07 0.89 155 XMLngstWrd_03 3018 1.33 2.23 0.89 156 TooManyTo_005 3002 0.69 0.32 0.88 157 RCVD_IN_RP_SAFE 2923 0.80 0.69 0.86 158 SpammyFromTLD_01 2882 1.50 2.82 0.85 159 TR_XM_SpammyWords2 2839 4.91 13.04 0.83 160 XMLngstWrd_04 2799 1.28 2.19 0.82 161 HTTPS_HTTP_MISMATCH 2697 0.98 1.36 0.79 162 XMGenDplmaNmb 2594 1.01 1.50 0.76 163 XM_ShortIntro_01 2563 0.65 0.45 0.75 164 RCVD_IN_RP_CERTIFIED 2544 0.66 0.49 0.75 165 XMHTML_After_End 2497 1.00 1.55 0.73 166 MPART_ALT_DIFF_COUNT 2494 1.00 1.54 0.73 167 T_TooManySym_03 2428 0.53 0.17 0.71 168 XMBrknScrpt_02 2386 1.58 3.35 0.70 169 XMBdyGiftCard01 2341 0.83 1.11 0.69 170 HTML_TITLE_SUBJ_DIFF 2337 1.17 2.13 0.69 171 UPPERCASE_75_100 2280 1.18 2.19 0.67 172 HTML_TAG_BALANCE_BODY 2265 0.97 1.57 0.66 173 TVD_SPACE_RATIO 2178 0.47 0.13 0.64 174 SHORT_HELO_AND_INLINE_IMAGE 2139 0.45 0.09 0.63 175 XM_B_COPY_HTML 2097 0.63 0.66 0.62 176 T_OBFU_PDF_ATTACH 2090 0.49 0.25 0.61 177 RELAYCOUNTRY_GB 2068 0.83 1.28 0.61 178 XM_ProductURIs 2037 0.69 0.86 0.60 179 T_XMDrugObfuBody_00 2034 0.90 1.52 0.60 180 FROM_GOV_DKIM_AU 2025 0.48 0.26 0.59 181 RCVD_IN_PSBL 1946 1.10 2.15 0.57 182 XM_H_PHPMailer 1934 0.58 0.61 0.57 183 NML_ADSP_CUSTOM_MED 1921 0.55 0.53 0.56 184 T_Symld_Words_02 1900 0.66 0.86 0.56 185 SUBJ_DOLLARS 1898 0.73 1.09 0.56 186 RCVD_IN_SORBS_DUL 1861 0.41 0.13 0.55 187 XM_shorewaves_Whitelist 1858 0.36 0.00 0.55 188 URI_TRY_3LD 1831 0.86 1.49 0.54 189 XM_B_SpammyWords4 1820 1.15 2.37 0.53 190 XMMoneyMeta_00 1818 0.74 1.17 0.53 191 HTML_IMAGE_ONLY_20 1794 0.44 0.27 0.53 192 T_XMHurry_00 1756 0.96 1.84 0.52 193 TR_XM_SpammyWords3 1713 1.05 2.15 0.50 194 RCVD_IN_BL_SPAMCOP_NET 1678 4.14 11.43 0.49 195 BASE64_LENGTH_79_INF 1635 0.38 0.19 0.48 196 XMPhish30 1597 0.64 0.97 0.47 197 XMSubMetaI_00 1565 0.58 0.81 0.46 198 XMSexyCombo_01 1564 0.92 1.84 0.46 199 XMHTMLBadTable_001 1560 0.57 0.78 0.46 200 FORGED_GMAIL_RCVD 1560 0.53 0.68 0.46 ----------------------------------------------------------------------