Email: 280464 Autolearn: 0 AvgScore: 2.85 AvgScanTime: 1.27 sec Spam: 92352 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.40 sec Ham: 188112 Autolearn: 0 AvgScore: -2.73 AvgScanTime: 1.21 sec Time Spent Running SA: 99.11 hours Time Spent Processing Spam: 36.03 hours Time Spent Processing Ham: 63.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86691 84.78 93.87 80.31 2 DKIM_SIGNED 80876 79.21 87.57 75.11 3 XM_DK_Pass 79766 78.20 86.37 74.19 4 DKIM_VALID 79232 77.61 85.79 73.60 5 XM_B_Unicode 75105 72.32 81.32 67.91 6 RELAYCOUNTRY_US 73746 79.45 79.85 79.26 7 DCC_CHECK 64104 46.17 69.41 34.76 8 XMListUnsubscribeExists 63443 55.89 68.70 49.60 9 XM_B_SpammyWords 63404 51.13 68.65 42.52 10 DKIM_VALID_AU 62705 62.35 67.90 59.62 11 RCVD_IN_MSPIKE_H2 46561 42.96 50.42 39.30 12 XM_B_Unicode3 44349 43.50 48.02 41.29 13 XM_DK_Undo_02 41113 20.11 44.52 8.12 14 BAYES_99 35411 17.44 38.34 7.18 15 BAYES_50 34674 49.93 37.55 56.01 16 LOC_TINY_FONT_1 34291 29.79 37.13 26.19 17 XM_B_SpammyWords2 34223 24.49 37.06 18.32 18 HTML_FONT_LOW_CONTRAST 33461 30.56 36.23 27.77 19 TR_XM_DKIM_Undo 33310 15.77 36.07 5.81 20 MIME_HTML_ONLY 29234 24.62 31.65 21.17 21 FVGT_m_MULTI_ODD 29122 26.94 31.53 24.69 22 DKIM_VALID_EF 28935 29.41 31.33 28.47 23 DCC_CHECK_NEGATIVE 28222 53.80 30.56 65.21 24 BAYES_999 28082 13.99 30.41 5.93 25 T_KAM_HTML_FONT_INVALID 26384 20.46 28.57 16.48 26 TR_DCC_Bayes_99 25022 10.91 27.09 2.97 27 RELAYCOUNTRY_META 20294 9.43 21.97 3.27 28 XM_Body_Dirty_Words 19993 15.66 21.65 12.72 29 XMSubLong 19439 20.03 21.05 19.53 30 T_TM2_M_HEADER_IN_MSG 18075 23.31 19.57 25.15 31 XM_Multi_Part_URI 17775 15.41 19.25 13.53 32 XM_B_Unsub 14085 10.91 15.25 8.77 33 TR_XM_BayesUnsub 13877 9.73 15.03 7.14 34 TR_XM_SpammyWords2 12777 5.74 13.84 1.77 35 XM_B_SpammyWords3 12471 7.89 13.50 5.14 36 TR_XM_SpammyRelay 12207 5.44 13.22 1.63 37 BOTNET_IPINHOSTNAME 11773 8.43 12.75 6.32 38 UNPARSEABLE_RELAY 11698 9.43 12.67 7.84 39 BOTNET 11567 5.02 12.52 1.33 40 TR_XM_UnparsRelay 11459 8.30 12.41 6.28 41 FSL_BULK_SIG 11162 6.37 12.09 3.57 42 RCVD_IN_MSPIKE_WL 11086 16.14 12.00 18.17 43 LOTS_OF_MONEY 10270 7.93 11.12 6.36 44 RCVD_IN_BL_SPAMCOP_NET 9481 3.77 10.27 0.58 45 UNTRUSTED_Relay 8842 4.09 9.57 1.40 46 XMSexyCombo_05 8764 6.07 9.49 4.39 47 RELAYCOUNTRY_CA 8225 3.71 8.91 1.16 48 XM_UncommonTLD01 8189 5.93 8.87 4.48 49 TR_XM_SpammyWords4 8125 5.67 8.80 4.14 50 MPART_ALT_DIFF 7967 6.60 8.63 5.60 51 HTML_IMAGE_RATIO_02 7760 8.02 8.40 7.84 52 BAYES_80 7536 5.56 8.16 4.29 53 XM_Evil_Numbers_Gen 6787 8.02 7.35 8.35 54 BAYES_60 6779 9.20 7.34 10.11 55 XM_SendGrid 6539 5.86 7.08 5.26 56 RCVD_IN_MSPIKE_H3 6389 10.07 6.92 11.62 57 XM_H_Long_From01 6200 7.44 6.71 7.80 58 TR_XM_PhishingBody 6105 3.71 6.61 2.29 59 LotsOfNums_01 5637 7.03 6.10 7.49 60 TR_XM_SPAMCOP 5580 2.15 6.04 0.23 61 TM2_M_VERY_LONG_WORD 5369 3.46 5.81 2.30 62 RCVD_IN_VALIDITY_SAFE 5342 6.31 5.78 6.57 63 XMSubMetaSx_00 5299 4.35 5.74 3.67 64 XMStrtUSub 5287 6.35 5.72 6.65 65 TooManyTo_001 4970 5.72 5.38 5.89 66 T_XMDrugObfuBody_08 4812 2.39 5.21 1.00 67 MIME_HTML_MOSTLY 4706 3.63 5.10 2.91 68 BAYES_95 4621 3.60 5.00 2.91 69 RCVD_IN_MSPIKE_BL 4619 2.15 5.00 0.74 70 XM_SPF_SoftFail 4552 3.53 4.93 2.84 71 MIME_HTML_ONLY_MULTI 4510 4.11 4.88 3.74 72 TR_XM_MSPIKECOMBO 4468 2.09 4.84 0.74 73 XM_B_Phish_Phrases 4311 3.75 4.67 3.30 74 XMBody_17 4206 1.89 4.55 0.59 75 TR_XM_DK_SendGrid 4174 3.88 4.52 3.57 76 HTML_IMAGE_RATIO_04 4016 4.43 4.35 4.47 77 XM_UB50 3895 1.92 4.22 0.80 78 RCVD_IN_VALIDITY_CERTIFIED 3866 5.11 4.19 5.57 79 T_XMDrugObfuBody_14 3810 2.50 4.13 1.70 80 XM_B_Investor 3697 2.11 4.00 1.19 81 T_FILL_THIS_FORM_SHORT 3630 1.64 3.93 0.51 82 BOTNET_NORDNS 3611 1.29 3.91 0.01 83 XM_CamelCaseFrm001 3533 2.42 3.83 1.74 84 TR_XM_SpammyWords5 3530 2.22 3.82 1.44 85 XM_B_SpammyTLD 3525 2.96 3.82 2.54 86 RCVD_IN_VALIDITY_RPBL 3515 1.27 3.81 0.03 87 XM_OfRef6 3502 1.80 3.79 0.82 88 T_REMOTE_IMAGE 3492 3.62 3.78 3.54 89 HTML_IMAGE_RATIO_06 3426 3.81 3.71 3.85 90 XM_B_Phish66 3062 1.75 3.32 0.97 91 T_TooManySym_01 3050 6.10 3.30 7.48 92 XM_DIRTYINTL 3040 1.34 3.29 0.37 93 XMDiploma_00 3029 1.94 3.28 1.28 94 HTML_MIME_NO_HTML_TAG 3020 2.46 3.27 2.07 95 USER_IN_DEF_DKIM_WL 2943 12.57 3.19 17.17 96 XMNumbers 2843 3.79 3.08 4.14 97 XMLngstWrd_00 2793 2.00 3.02 1.49 98 TM2_M_URI_OPT_OUT 2763 2.66 2.99 2.50 99 XMLngstWrd_01 2754 1.92 2.98 1.39 100 XMLngstWrd_02 2671 1.79 2.89 1.25 101 RCVD_IN_MSPIKE_H4 2643 4.41 2.86 5.17 102 SpammyFromTLD_02 2622 1.08 2.84 0.21 103 RCVD_IN_MSPIKE_L3 2518 1.31 2.73 0.61 104 XM_GoogleGroups 2484 2.19 2.69 1.95 105 SUBJ_ALL_CAPS 2450 1.61 2.65 1.10 106 PDS_OTHER_BAD_TLD 2443 1.05 2.65 0.27 107 SpammyFromTLD_01 2425 1.12 2.63 0.38 108 XM_UB99 2398 0.86 2.60 0.00 109 URI_NOVOWEL 2386 2.16 2.58 1.95 110 TR_XM_MSPIKECOMBO2 2384 0.92 2.58 0.11 111 TR_XM_SpammyWords3 2278 1.08 2.47 0.40 112 RCVD_IN_PSBL 2207 1.72 2.39 1.39 113 FROM_EXCESS_BASE64 2203 2.99 2.39 3.28 114 XMLngstWrd_03 2117 1.48 2.29 1.08 115 HTML_TAG_BALANCE_BODY 2085 1.14 2.26 0.58 116 XMLngstWrd_04 2060 1.40 2.23 0.99 117 XM_UB999 2057 0.73 2.23 0.00 118 MIME_QP_LONG_LINE 2055 2.90 2.23 3.23 119 RCVD_IN_MSPIKE_H5 2054 1.66 2.22 1.38 120 UPPERCASE_75_100 1986 1.22 2.15 0.76 121 FONT_INVIS_LONG_LINE 1959 0.76 2.12 0.09 122 HTML_IMAGE_RATIO_08 1951 2.02 2.11 1.97 123 HTML_TITLE_SUBJ_DIFF 1944 1.19 2.10 0.75 124 HTML_IMAGE_ONLY_24 1898 0.83 2.06 0.22 125 XMBrknScrpt_02 1883 1.38 2.04 1.05 126 XM_B_Unsub2 1876 1.25 2.03 0.86 127 XM_B_SpammyWords4 1851 1.11 2.00 0.67 128 MPART_ALT_DIFF_COUNT 1827 1.25 1.98 0.90 129 TR_XM_FormFill 1813 0.65 1.96 0.01 130 T_XMHurry_00 1813 0.98 1.96 0.50 131 TR_XM_PHPDW 1780 0.81 1.93 0.26 132 XMSexyCombo_01 1728 0.97 1.87 0.52 133 XMBdyGiftCard01 1726 1.48 1.87 1.30 134 DIET_1 1724 0.89 1.87 0.40 135 HTTP_EXCESSIVE_ESCAPES 1713 0.61 1.85 0.00 136 RELAYCOUNTRY_RU 1706 0.62 1.85 0.02 137 TR_XM_MaxSPIKE 1706 0.67 1.85 0.09 138 T_XMDrugObfuBody_00 1704 1.01 1.85 0.60 139 KHOP_HELO_FCRDNS 1688 1.88 1.83 1.90 140 RCVD_IN_MSPIKE_L5 1685 0.64 1.82 0.05 141 DKIM_INVALID 1644 1.60 1.78 1.51 142 TR_XM_PHPForged 1634 0.72 1.77 0.21 143 TR_LOTS_OF_MONEY3 1623 0.67 1.76 0.13 144 XM_DK_Undo_01 1615 1.42 1.75 1.26 145 TR_XM_FormFill2 1605 0.71 1.74 0.21 146 XM_H_PHPOS 1596 0.70 1.73 0.20 147 XM_H_Undi_Recip 1471 0.66 1.59 0.21 148 TR_XM_NoHeaderRelay 1459 0.58 1.58 0.09 149 ALL_TRUSTED 1394 12.52 1.51 17.93 150 MAILING_LIST_MULTI 1383 1.78 1.50 1.91 151 XMStockSpam_06 1365 1.63 1.48 1.71 152 URIBL_DBL_SPAM 1364 0.49 1.48 0.01 153 BAYES_40 1342 3.79 1.45 4.93 154 RCVD_IN_IADB_LISTED 1338 2.78 1.45 3.43 155 XMReplyNow 1311 0.64 1.42 0.26 156 TR_XM_SB_Phish 1307 1.52 1.42 1.57 157 TM2_M_A_HREF_HREF 1260 0.81 1.36 0.54 158 RELAYCOUNTRY_AU 1257 0.60 1.36 0.22 159 TR_XM_Base64_M1 1234 1.16 1.34 1.08 160 XMHTML_After_End 1234 0.88 1.34 0.65 161 MONEY_NOHTML 1233 0.46 1.34 0.04 162 SHOPIFY_IMG_NOT_RCVD_SFY 1197 0.58 1.30 0.22 163 URI_HEX 1196 1.27 1.30 1.26 164 XM_H_Long_From02 1172 1.09 1.27 1.00 165 RELAYCOUNTRY_IN 1154 0.44 1.25 0.04 166 URI_TRY_3LD 1144 0.77 1.24 0.55 167 XM_URI_RBL 1139 0.47 1.23 0.09 168 TR_XM_Undi_Recip5 1131 0.41 1.22 0.01 169 XMSubPhish11 1122 1.45 1.21 1.56 170 RCVD_IN_IADB_SPF 1120 2.45 1.21 3.06 171 XM_Body_Dirty_Words_01 1113 0.56 1.21 0.25 172 XMPhish30 1111 0.79 1.20 0.59 173 BAYES_20 1111 2.99 1.20 3.86 174 UNDISC_MONEY 1073 0.39 1.16 0.01 175 TR_Symld_Words 1067 1.90 1.16 2.26 176 RCVD_IN_IADB_SENDERID 1066 2.24 1.15 2.77 177 XMPhish08 1059 0.51 1.15 0.19 178 XMGenDplmaNmb 1058 0.70 1.15 0.47 179 RCVD_IN_RP_SAFE 1056 1.24 1.14 1.29 180 RCVD_IN_IADB_DK 1051 2.17 1.14 2.67 181 XM_H_PHPMailer 1042 0.72 1.13 0.52 182 URIBL_BLACK 1034 0.39 1.12 0.03 183 XMHTMLBadTable_001 1031 0.85 1.12 0.72 184 XMClaimOffer 1007 0.43 1.09 0.10 185 XM_UB60 998 0.40 1.08 0.07 186 TR_Mismatch_TLD_02 998 0.42 1.08 0.09 187 XMBody_29 987 0.49 1.07 0.21 188 HK_RANDOM_REPLYTO 977 0.41 1.06 0.09 189 DKIM_ADSP_CUSTOM_MED 974 0.89 1.05 0.82 190 XMSubMetaI_00 965 0.96 1.04 0.92 191 XMSlimDrugH 963 0.59 1.04 0.37 192 TR_Mismatch_TLD_01 954 0.50 1.03 0.25 193 MIME_CHARSET_FARAWAY 953 0.50 1.03 0.24 194 FROM_SUSPICIOUS_NTLD 952 0.36 1.03 0.04 195 HTML_OBFUSCATE_05_10 950 0.51 1.03 0.26 196 XM_Combo_Sbj 930 0.47 1.01 0.21 197 HTTPS_HTTP_MISMATCH 928 0.92 1.00 0.87 198 MIME_BASE64_TEXT 924 0.38 1.00 0.08 199 TR_Caps_n_Bayes_99 851 0.49 0.92 0.27 200 PLING_QUERY 849 0.59 0.92 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151080 84.78 93.87 80.31 2 RELAYCOUNTRY_US 149090 79.45 79.85 79.26 3 DKIM_SIGNED 141282 79.21 87.57 75.11 4 XM_DK_Pass 139567 78.20 86.37 74.19 5 DKIM_VALID 138445 77.61 85.79 73.60 6 XM_B_Unicode 127739 72.32 81.32 67.91 7 DCC_CHECK_NEGATIVE 122666 53.80 30.56 65.21 8 DKIM_VALID_AU 112158 62.35 67.90 59.62 9 BAYES_50 105355 49.93 37.55 56.01 10 XMListUnsubscribeExists 93309 55.89 68.70 49.60 11 XM_B_SpammyWords 79987 51.13 68.65 42.52 12 XM_B_Unicode3 77664 43.50 48.02 41.29 13 RCVD_IN_MSPIKE_H2 73929 42.96 50.42 39.30 14 DCC_CHECK 65396 46.17 69.41 34.76 15 DKIM_VALID_EF 53559 29.41 31.33 28.47 16 HTML_FONT_LOW_CONTRAST 52242 30.56 36.23 27.77 17 LOC_TINY_FONT_1 49270 29.79 37.13 26.19 18 T_TM2_M_HEADER_IN_MSG 47312 23.31 19.57 25.15 19 FVGT_m_MULTI_ODD 46445 26.94 31.53 24.69 20 MIME_HTML_ONLY 39815 24.62 31.65 21.17 21 XMSubLong 36738 20.03 21.05 19.53 22 XM_B_SpammyWords2 34456 24.49 37.06 18.32 23 RCVD_IN_MSPIKE_WL 34181 16.14 12.00 18.17 24 ALL_TRUSTED 33723 12.52 1.51 17.93 25 USER_IN_DEF_DKIM_WL 32301 12.57 3.19 17.17 26 T_KAM_HTML_FONT_INVALID 30998 20.46 28.57 16.48 27 XM_Multi_Part_URI 25457 15.41 19.25 13.53 28 XM_DKIMWhitelistDomains 25449 9.09 0.04 13.53 29 XM_Body_Dirty_Words 23921 15.66 21.65 12.72 30 RCVD_IN_MSPIKE_H3 21866 10.07 6.92 11.62 31 BAYES_60 19017 9.20 7.34 10.11 32 XM_B_Unsub 16501 10.91 15.25 8.77 33 BAYES_00 16098 5.84 0.31 8.56 34 XM_Evil_Numbers_Gen 15701 8.02 7.35 8.35 35 XM_DK_Undo_02 15279 20.11 44.52 8.12 36 HTML_IMAGE_RATIO_02 14747 8.02 8.40 7.84 37 UNPARSEABLE_RELAY 14746 9.43 12.67 7.84 38 XM_H_Long_From01 14674 7.44 6.71 7.80 39 LotsOfNums_01 14091 7.03 6.10 7.49 40 T_TooManySym_01 14068 6.10 3.30 7.48 41 BAYES_99 13501 17.44 38.34 7.18 42 TR_XM_BayesUnsub 13424 9.73 15.03 7.14 43 XMStrtUSub 12510 6.35 5.72 6.65 44 RCVD_IN_VALIDITY_SAFE 12355 6.31 5.78 6.57 45 LOTS_OF_MONEY 11959 7.93 11.12 6.36 46 BOTNET_IPINHOSTNAME 11884 8.43 12.75 6.32 47 TR_XM_UnparsRelay 11819 8.30 12.41 6.28 48 BAYES_999 11157 13.99 30.41 5.93 49 TooManyTo_001 11086 5.72 5.38 5.89 50 TR_XM_DKIM_Undo 10924 15.77 36.07 5.81 51 IN_ZIMBRA_NJ_WHITELIST 10636 3.82 0.08 5.65 52 MPART_ALT_DIFF 10542 6.60 8.63 5.60 53 RCVD_IN_VALIDITY_CERTIFIED 10471 5.11 4.19 5.57 54 TR_XM_DK_Bayes 10148 3.69 0.23 5.39 55 TR_XM_DK_Bayes1 10073 3.66 0.22 5.35 56 XM_SendGrid 9888 5.86 7.08 5.26 57 RCVD_IN_MSPIKE_H4 9722 4.41 2.86 5.17 58 XM_B_SpammyWords3 9662 7.89 13.50 5.14 59 TR_XM_DK_Bayes2 9303 3.38 0.20 4.95 60 BAYES_40 9280 3.79 1.45 4.93 61 T_TooManySym_02 8867 3.35 0.57 4.71 62 XM_UncommonTLD01 8435 5.93 8.87 4.48 63 HTML_IMAGE_RATIO_04 8413 4.43 4.35 4.47 64 XMSexyCombo_05 8249 6.07 9.49 4.39 65 BAYES_80 8063 5.56 8.16 4.29 66 TVD_RCVD_IP 7811 2.90 0.35 4.15 67 XMNumbers 7789 3.79 3.08 4.14 68 TR_XM_SpammyWords4 7788 5.67 8.80 4.14 69 BAYES_20 7270 2.99 1.20 3.86 70 HTML_IMAGE_RATIO_06 7248 3.81 3.71 3.85 71 MIME_HTML_ONLY_MULTI 7026 4.11 4.88 3.74 72 XMSubMetaSx_00 6908 4.35 5.74 3.67 73 TR_XM_DK_SendGrid 6717 3.88 4.52 3.57 74 FSL_BULK_SIG 6717 6.37 12.09 3.57 75 T_REMOTE_IMAGE 6663 3.62 3.78 3.54 76 T_HTML_ATTACH 6597 2.39 0.10 3.51 77 INVALID_MSGID 6515 2.46 0.42 3.46 78 RCVD_IN_IADB_LISTED 6445 2.78 1.45 3.43 79 XM_B_Phish_Phrases 6204 3.75 4.67 3.30 80 FROM_EXCESS_BASE64 6176 2.99 2.39 3.28 81 RELAYCOUNTRY_META 6144 9.43 21.97 3.27 82 MIME_QP_LONG_LINE 6079 2.90 2.23 3.23 83 TO_MALFORMED 6063 2.36 0.61 3.22 84 MSGID_NOFQDN1 5820 2.12 0.14 3.09 85 RCVD_IN_IADB_SPF 5764 2.45 1.21 3.06 86 TR_DCC_Bayes_99 5583 10.91 27.09 2.97 87 BAYES_95 5473 3.60 5.00 2.91 88 MIME_HTML_MOSTLY 5472 3.63 5.10 2.91 89 XM_SPF_SoftFail 5337 3.53 4.93 2.84 90 RCVD_IN_IADB_SENDERID 5215 2.24 1.15 2.77 91 RCVD_IN_IADB_DK 5028 2.17 1.14 2.67 92 XM_B_SpammyTLD 4776 2.96 3.82 2.54 93 TM2_M_URI_OPT_OUT 4707 2.66 2.99 2.50 94 XM_H_Trusted_IP 4666 1.66 0.00 2.48 95 XMBSHREFv2 4438 1.67 0.26 2.36 96 TM2_M_VERY_LONG_WORD 4330 3.46 5.81 2.30 97 TR_XM_PhishingBody 4302 3.71 6.61 2.29 98 TR_Symld_Words 4255 1.90 1.16 2.26 99 BAYES_05 4055 1.66 0.64 2.16 100 XM_PDF 3974 1.55 0.40 2.11 101 RCVD_IN_IADB_VOUCHED 3947 1.66 0.78 2.10 102 HTML_MIME_NO_HTML_TAG 3889 2.46 3.27 2.07 103 IN_HORDE_ADDRESS_BOOK 3873 1.41 0.10 2.06 104 HTML_IMAGE_RATIO_08 3708 2.02 2.11 1.97 105 URI_NOVOWEL 3677 2.16 2.58 1.95 106 XM_GoogleGroups 3666 2.19 2.69 1.95 107 MAILING_LIST_MULTI 3602 1.78 1.50 1.91 108 KHOP_HELO_FCRDNS 3572 1.88 1.83 1.90 109 TR_XM_SpammyWords2 3327 5.74 13.84 1.77 110 XM_CamelCaseFrm001 3267 2.42 3.83 1.74 111 XMStockSpam_06 3219 1.63 1.48 1.71 112 T_XMDrugObfuBody_14 3203 2.50 4.13 1.70 113 XMBody_95 3131 1.14 0.08 1.66 114 ANY_BOUNCE_MESSAGE 3111 1.38 0.82 1.65 115 BOUNCE_MESSAGE 3109 1.38 0.82 1.65 116 TR_XM_SpammyRelay 3060 5.44 13.22 1.63 117 XMGappySubj_01 3036 1.31 0.70 1.61 118 TR_XM_SB_Phish 2953 1.52 1.42 1.57 119 XMSubPhish11 2933 1.45 1.21 1.56 120 DKIM_INVALID 2837 1.60 1.78 1.51 121 XMLngstWrd_00 2810 2.00 3.02 1.49 122 RCVD_IN_IADB_OPTIN 2786 1.15 0.48 1.48 123 TR_XM_SpammyWords5 2706 2.22 3.82 1.44 124 XM_shorewaves_Whitelist 2646 0.94 0.00 1.41 125 UNTRUSTED_Relay 2626 4.09 9.57 1.40 126 XMLngstWrd_01 2624 1.92 2.98 1.39 127 RCVD_IN_PSBL 2623 1.72 2.39 1.39 128 RCVD_IN_MSPIKE_H5 2593 1.66 2.22 1.38 129 BOTNET 2508 5.02 12.52 1.33 130 TVD_SPACE_RATIO 2498 0.91 0.07 1.33 131 XMBdyGiftCard01 2437 1.48 1.87 1.30 132 RCVD_IN_RP_SAFE 2433 1.24 1.14 1.29 133 XMDiploma_00 2413 1.94 3.28 1.28 134 XM_DK_Undo_01 2373 1.42 1.75 1.26 135 URI_HEX 2364 1.27 1.30 1.26 136 XMLngstWrd_02 2346 1.79 2.89 1.25 137 HTML_FONT_FACE_BAD 2333 1.08 0.76 1.24 138 XM_RXBody 2260 1.02 0.66 1.20 139 XM_B_Investor 2230 2.11 4.00 1.19 140 RELAYCOUNTRY_CA 2180 3.71 8.91 1.16 141 TooManyTo_002 2166 0.96 0.58 1.15 142 SUBJ_ALL_CAPS 2077 1.61 2.65 1.10 143 XMLngstWrd_03 2032 1.48 2.29 1.08 144 TR_XM_Base64_M1 2026 1.16 1.34 1.08 145 RCVD_IN_RP_CERTIFIED 2021 1.01 0.88 1.07 146 XMBrknScrpt_02 1977 1.38 2.04 1.05 147 XM_H_Long_From02 1884 1.09 1.27 1.00 148 T_XMDrugObfuBody_08 1882 2.39 5.21 1.00 149 XMLngstWrd_04 1870 1.40 2.23 0.99 150 XM_B_Phish66 1834 1.75 3.32 0.97 151 XM_B_COPY_HTML 1820 0.92 0.83 0.97 152 T_TooManySym_03 1806 0.72 0.23 0.96 153 BODY_ENHANCEMENT2 1800 0.65 0.03 0.96 154 T_Symld_Words_02 1786 0.88 0.74 0.95 155 XMSubMetaI_00 1728 0.96 1.04 0.92 156 MPART_ALT_DIFF_COUNT 1684 1.25 1.98 0.90 157 HTTPS_HTTP_MISMATCH 1645 0.92 1.00 0.87 158 XM_B_Unsub2 1618 1.25 2.03 0.86 159 TooManyTo_003 1560 0.69 0.39 0.83 160 XM_OfRef6 1542 1.80 3.79 0.82 161 TR_MetaPhish_Combo_01 1539 0.84 0.87 0.82 162 DKIM_ADSP_CUSTOM_MED 1534 0.89 1.05 0.82 163 XM_UB50 1502 1.92 4.22 0.80 164 UPPERCASE_75_100 1431 1.22 2.15 0.76 165 HTML_TITLE_SUBJ_DIFF 1406 1.19 2.10 0.75 166 RCVD_IN_MSPIKE_BL 1401 2.15 5.00 0.74 167 TR_XM_MSPIKECOMBO 1401 2.09 4.84 0.74 168 XMSubNoVowel 1386 0.80 0.92 0.74 169 XMHTMLBadTable_001 1348 0.85 1.12 0.72 170 USER_IN_WHITELIST 1344 0.48 0.00 0.71 171 USER_IN_WELCOMELIST 1344 0.48 0.00 0.71 172 XMSubMetaSxObfu_02 1299 0.69 0.68 0.69 173 XM_B_SpammyWords4 1266 1.11 2.00 0.67 174 XM_ProductURIs 1244 0.73 0.88 0.66 175 XMHTML_After_End 1228 0.88 1.34 0.65 176 RCVD_IN_MSPIKE_L3 1153 1.31 2.73 0.61 177 TooManyTo_004 1151 0.52 0.33 0.61 178 XM_D_tchamptons_WL 1139 0.41 0.02 0.61 179 T_XMDrugObfuBody_00 1133 1.01 1.85 0.60 180 XMPhish30 1118 0.79 1.20 0.59 181 XMBody_17 1102 1.89 4.55 0.59 182 HTML_TAG_BALANCE_BODY 1100 1.14 2.26 0.58 183 RCVD_IN_BL_SPAMCOP_NET 1095 3.77 10.27 0.58 184 XM_B_COVIDMETA 1086 0.59 0.63 0.58 185 XM_B_REG_HTML 1050 0.59 0.66 0.56 186 XM_S_SubURI 1030 0.37 0.01 0.55 187 URI_TRY_3LD 1029 0.77 1.24 0.55 188 TM2_M_A_HREF_HREF 1019 0.81 1.36 0.54 189 XMSexyCombo_01 981 0.97 1.87 0.52 190 RDNS_DYNAMIC 977 0.58 0.70 0.52 191 HTML_IMAGE_ONLY_20 975 0.51 0.49 0.52 192 XM_H_PHPMailer 974 0.72 1.13 0.52 193 TooManyTo_005 974 0.45 0.30 0.52 194 T_FILL_THIS_FORM_SHORT 957 1.64 3.93 0.51 195 T_XMHurry_00 945 0.98 1.96 0.50 196 TR_XM_Base64_L1 903 0.60 0.85 0.48 197 XMGenDplmaNmb 892 0.70 1.15 0.47 198 NML_ADSP_CUSTOM_MED 889 0.61 0.90 0.47 199 XMDateMe_00 835 0.37 0.23 0.44 200 XMPhish14 833 0.58 0.87 0.44 ----------------------------------------------------------------------