Email: 539429 Autolearn: 0 AvgScore: 3.80 AvgScanTime: 1.38 sec Spam: 170246 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.47 sec Ham: 369183 Autolearn: 0 AvgScore: -0.87 AvgScanTime: 1.34 sec Time Spent Running SA: 206.63 hours Time Spent Processing Spam: 69.60 hours Time Spent Processing Ham: 137.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161289 89.78 94.74 87.49 2 DKIM_SIGNED 152020 76.75 89.29 70.96 3 XM_DK_Pass 147615 75.10 86.71 69.75 4 DKIM_VALID 146632 74.23 86.13 68.74 5 RELAYCOUNTRY_US 137092 78.36 80.53 77.36 6 XM_B_Unicode 134873 73.83 79.22 71.35 7 XMListUnsubscribeExists 121654 54.39 71.46 46.53 8 DCC_CHECK 121640 43.58 71.45 30.73 9 XM_B_SpammyWords 115878 53.56 68.07 46.88 10 DKIM_VALID_AU 110851 56.72 65.11 52.85 11 RCVD_IN_MSPIKE_H2 80347 40.24 47.19 37.03 12 BAYES_50 76778 53.48 45.10 57.34 13 XM_B_Unicode3 70532 39.96 41.43 39.29 14 XM_DK_Undo_02 65842 16.45 38.67 6.20 15 XM_B_SpammyWords2 61825 26.42 36.32 21.86 16 LOC_TINY_FONT_1 60326 26.11 35.43 21.80 17 FVGT_m_MULTI_ODD 59199 26.23 34.77 22.30 18 MIME_HTML_ONLY 57743 23.71 33.92 19.01 19 HTML_FONT_LOW_CONTRAST 56884 28.37 33.41 26.05 20 DKIM_VALID_EF 54644 28.12 32.10 26.28 21 TR_XM_DKIM_Undo 53163 13.02 31.23 4.63 22 BAYES_99 51736 12.93 30.39 4.88 23 DCC_CHECK_NEGATIVE 48573 56.37 28.53 69.21 24 T_KAM_HTML_FONT_INVALID 47148 21.20 27.69 18.20 25 BAYES_999 40248 10.10 23.64 3.85 26 XMSubLong 38611 21.01 22.68 20.24 27 RELAYCOUNTRY_META 38220 9.52 22.45 3.56 28 XM_Body_Dirty_Words 36484 14.43 21.43 11.20 29 TR_DCC_Bayes_99 35064 7.63 20.60 1.64 30 T_TM2_M_HEADER_IN_MSG 33669 28.65 19.78 32.73 31 XM_Multi_Part_URI 29756 13.46 17.48 11.60 32 RCVD_IN_MSPIKE_WL 26771 16.42 15.72 16.74 33 XM_B_Unsub 24853 10.78 14.60 9.02 34 TR_XM_SpammyRelay 24777 5.77 14.55 1.72 35 TR_XM_BayesUnsub 24316 8.97 14.28 6.52 36 BOTNET_IPINHOSTNAME 23056 7.53 13.54 4.76 37 LOTS_OF_MONEY 22274 10.50 13.08 9.30 38 XM_B_SpammyWords3 20399 6.40 11.98 3.82 39 RCVD_IN_MSPIKE_H3 19966 11.05 11.73 10.73 40 UNPARSEABLE_RELAY 19344 8.86 11.36 7.71 41 BOTNET 19114 4.70 11.23 1.69 42 TR_XM_UnparsRelay 18722 7.61 11.00 6.05 43 MPART_ALT_DIFF 18675 6.74 10.97 4.79 44 TR_XM_SpammyWords4 18157 8.01 10.67 6.78 45 FSL_BULK_SIG 17578 5.46 10.33 3.22 46 TR_XM_SpammyWords2 16704 3.65 9.81 0.80 47 XMSexyCombo_05 16401 5.18 9.63 3.12 48 RCVD_IN_BL_SPAMCOP_NET 15962 3.15 9.38 0.28 49 XM_Evil_Numbers_Gen 15244 8.08 8.95 7.67 50 UNTRUSTED_Relay 15126 3.72 8.88 1.33 51 XM_UncommonTLD01 14961 5.15 8.79 3.48 52 RELAYCOUNTRY_CA 14752 3.48 8.67 1.09 53 TM2_M_VERY_LONG_WORD 14111 3.41 8.29 1.15 54 BAYES_80 13657 5.17 8.02 3.85 55 MIME_HTML_ONLY_MULTI 13239 4.59 7.78 3.12 56 BAYES_60 12323 8.10 7.24 8.50 57 LotsOfNums_01 11808 8.02 6.94 8.52 58 HTML_MIME_NO_HTML_TAG 11632 3.35 6.83 1.75 59 XM_SendGrid 11145 5.55 6.55 5.10 60 TR_XM_PhishingBody 10721 4.23 6.30 3.27 61 HTML_IMAGE_RATIO_02 10584 5.33 6.22 4.92 62 TR_XM_SPAMCOP 10255 2.00 6.02 0.14 63 XM_B_Investor 9966 3.08 5.85 1.80 64 XMLngstWrd_00 9836 2.16 5.78 0.49 65 XM_GoogleGroups 9754 2.82 5.73 1.47 66 XMLngstWrd_01 9753 2.10 5.73 0.43 67 XM_H_Long_From01 9702 5.56 5.70 5.50 68 XMSubMetaSx_00 9669 4.13 5.68 3.41 69 XMLngstWrd_02 9628 2.00 5.66 0.31 70 XM_B_Phish_Phrases 9180 3.89 5.39 3.20 71 XMLngstWrd_03 9111 1.84 5.35 0.22 72 XMLngstWrd_04 9043 1.79 5.31 0.16 73 HTML_TITLE_SUBJ_DIFF 8911 1.67 5.23 0.03 74 UPPERCASE_75_100 8821 1.66 5.18 0.03 75 HTML_IMAGE_RATIO_04 8650 4.51 5.08 4.24 76 XMStrtUSub 8581 4.53 5.04 4.30 77 XM_SPF_SoftFail 8503 3.06 4.99 2.17 78 XM_B_SpammyTLD 8234 3.40 4.84 2.74 79 BAYES_95 8198 3.19 4.82 2.45 80 RCVD_IN_VALIDITY_RPBL 8031 1.51 4.72 0.04 81 T_XMDrugObfuBody_08 7947 2.72 4.67 1.82 82 XM_UB50 7634 1.99 4.48 0.85 83 TooManyTo_001 7462 6.93 4.38 8.10 84 TR_XM_SpammyWords5 7399 2.28 4.35 1.33 85 RCVD_IN_MSPIKE_BL 7367 2.06 4.33 1.01 86 TR_XM_DK_SendGrid 7294 3.47 4.28 3.09 87 TR_XM_MSPIKECOMBO 7146 2.01 4.20 1.00 88 MIME_HTML_MOSTLY 6956 2.77 4.09 2.16 89 XMNumbers 6934 3.39 4.07 3.08 90 T_XMDrugObfuBody_14 6690 2.48 3.93 1.81 91 XM_B_Phish66 6667 2.45 3.92 1.77 92 RCVD_IN_MSPIKE_H4 5996 4.53 3.52 4.99 93 XM_DIRTYINTL 5986 1.33 3.52 0.32 94 MIME_QP_LONG_LINE 5962 4.87 3.50 5.50 95 XMBody_17 5893 1.38 3.46 0.41 96 HTML_IMAGE_RATIO_06 5840 3.97 3.43 4.22 97 SpammyFromTLD_01 5642 1.59 3.31 0.80 98 XM_OfRef6 5614 1.70 3.30 0.97 99 URIBL_DBL_SPAM 5546 1.04 3.26 0.01 100 XM_B_Unsub2 5449 1.95 3.20 1.37 101 DKIM_INVALID 5388 2.52 3.16 2.22 102 T_REMOTE_IMAGE 5211 3.55 3.06 3.77 103 T_FILL_THIS_FORM_SHORT 5087 1.50 2.99 0.81 104 XMDiploma_00 4985 1.80 2.93 1.29 105 TM2_M_URI_OPT_OUT 4953 2.51 2.91 2.32 106 URI_NOVOWEL 4869 2.64 2.86 2.54 107 XM_CamelCaseFrm001 4766 2.16 2.80 1.87 108 SUBJ_ALL_CAPS 4712 1.89 2.77 1.48 109 BOTNET_NORDNS 4689 0.88 2.75 0.01 110 PDS_OTHER_BAD_TLD 4676 1.06 2.75 0.28 111 RCVD_IN_IADB_LISTED 4568 4.55 2.68 5.41 112 SpammyFromTLD_02 4566 1.14 2.68 0.42 113 RCVD_IN_VALIDITY_SAFE 4541 3.76 2.67 4.27 114 URI_PHP_REDIR 4397 0.82 2.58 0.00 115 XM_B_SpammyWords4 4379 1.24 2.57 0.63 116 HTML_IMAGE_RATIO_08 4334 2.61 2.55 2.63 117 FROM_EXCESS_BASE64 3923 2.56 2.30 2.67 118 RCVD_IN_IADB_SPF 3843 3.99 2.26 4.79 119 T_TooManySym_01 3665 4.63 2.15 5.77 120 RCVD_IN_IADB_DK 3610 3.51 2.12 4.16 121 RCVD_IN_IADB_SENDERID 3602 3.59 2.12 4.27 122 MAILING_LIST_MULTI 3545 2.80 2.08 3.14 123 RCVD_IN_MSPIKE_L3 3544 1.25 2.08 0.87 124 RCVD_IN_VALIDITY_CERTIFIED 3527 3.24 2.07 3.77 125 XM_DK_Undo_01 3509 1.82 2.06 1.70 126 USER_IN_DEF_DKIM_WL 3409 8.78 2.00 11.91 127 TR_XM_PHPDW 3383 0.85 1.99 0.33 128 XM_H_Undi_Recip 3366 0.78 1.98 0.22 129 RCVD_IN_PSBL 3350 1.10 1.97 0.70 130 TR_XM_PHPForged 3232 0.79 1.90 0.27 131 TR_XM_SB_Phish 3215 2.33 1.89 2.54 132 TR_XM_FormFill2 3202 0.78 1.88 0.27 133 XM_H_PHPOS 3200 0.78 1.88 0.27 134 HK_RANDOM_REPLYTO 3192 0.68 1.87 0.13 135 TR_XM_SpammyWords3 3162 0.94 1.86 0.51 136 TR_XM_NoHeaderRelay 3135 0.67 1.84 0.12 137 T_XMDrugObfuBody_00 3104 1.08 1.82 0.74 138 BAYES_40 3054 4.05 1.79 5.09 139 TR_XM_MSPIKECOMBO2 3050 0.65 1.79 0.13 140 XMSexyCombo_01 3008 0.88 1.77 0.47 141 TR_XM_FormFill 2922 0.55 1.72 0.01 142 XM_UB99 2825 0.53 1.66 0.00 143 TM2_M_A_HREF_HREF 2794 0.72 1.64 0.30 144 URI_HEX 2782 1.34 1.63 1.21 145 XM_URI_RBL 2707 0.57 1.59 0.10 146 XM_B_COVIDMETA 2692 0.85 1.58 0.51 147 FONT_INVIS_LONG_LINE 2687 0.56 1.58 0.09 148 XMHTML_After_End 2635 0.99 1.55 0.73 149 HTTPS_HTTP_MISMATCH 2600 1.08 1.53 0.88 150 HTML_IMAGE_ONLY_24 2591 0.72 1.52 0.35 151 XMSubPhish11 2573 2.19 1.51 2.50 152 RELAYCOUNTRY_IN 2527 0.52 1.48 0.07 153 T_XMHurry_00 2511 3.81 1.47 4.89 154 RCVD_IN_IADB_VOUCHED 2511 2.70 1.47 3.26 155 RCVD_IN_MSPIKE_L5 2506 0.47 1.47 0.01 156 HTML_OBFUSCATE_05_10 2455 0.60 1.44 0.22 157 UNDISC_MONEY 2402 0.45 1.41 0.01 158 XMStockSpam_06 2398 0.99 1.41 0.80 159 RELAYCOUNTRY_AU 2381 0.65 1.40 0.30 160 KHOP_HELO_FCRDNS 2366 1.36 1.39 1.34 161 XMBdyGiftCard01 2363 0.89 1.39 0.66 162 TR_XM_Undi_Recip5 2359 0.44 1.39 0.01 163 ALL_TRUSTED 2342 13.96 1.38 19.76 164 URIBL_BLACK 2330 0.47 1.37 0.05 165 XMGenDplmaNmb 2292 0.88 1.35 0.67 166 XM_H_Long_From02 2284 1.25 1.34 1.20 167 XM_UB999 2222 0.41 1.31 0.00 168 MPART_ALT_DIFF_COUNT 2208 0.82 1.30 0.60 169 BAYES_20 2152 3.19 1.26 4.08 170 TR_XM_MaxSPIKE 2117 0.46 1.24 0.10 171 RELAYCOUNTRY_RU 2059 0.42 1.21 0.05 172 TR_XM_Base64_M1 2055 1.14 1.21 1.12 173 TR_XM_BayesRelay 2034 0.38 1.19 0.00 174 TR_Symld_Words 2024 1.44 1.19 1.55 175 XMBrknScrpt_02 1989 0.90 1.17 0.77 176 MONEY_NOHTML 1963 0.40 1.15 0.05 177 HTML_TAG_BALANCE_BODY 1951 0.78 1.15 0.61 178 RELAYCOUNTRY_FR 1899 0.53 1.12 0.26 179 TR_XM_Undi_Recip11 1855 0.37 1.09 0.04 180 TR_LOTS_OF_MONEY3 1854 0.49 1.09 0.22 181 TR_XM_COVIDMETA1 1811 0.42 1.06 0.13 182 REMOVE_BEFORE_LINK 1772 0.48 1.04 0.22 183 T_MONEY_PERCENT 1759 0.42 1.03 0.14 184 TR_LOTS_OF_MONEY2 1759 0.42 1.03 0.14 185 HTTP_EXCESSIVE_ESCAPES 1736 0.32 1.02 0.00 186 URI_TRY_3LD 1694 0.68 1.00 0.53 187 XM_Body_Dirty_Words_01 1659 0.37 0.97 0.10 188 XMReplyNow 1652 0.51 0.97 0.30 189 TR_XM_Undi_RecipCombo2 1640 0.31 0.96 0.00 190 XM_PDF 1618 3.38 0.95 4.50 191 XM_UB60 1598 0.35 0.94 0.08 192 RCVD_IN_RP_RNBL 1596 0.30 0.94 0.01 193 FILL_THIS_FORM 1585 0.54 0.93 0.35 194 TR_XM_COVIDMETA4 1571 0.42 0.92 0.19 195 XM_ProductURIs 1545 0.65 0.91 0.54 196 XMPhish30 1536 0.69 0.90 0.59 197 TR_Sbj_FN_Bdy 1532 0.38 0.90 0.14 198 RCVD_IN_IADB_OPTIN 1527 1.77 0.90 2.18 199 XM_B_SEO 1527 0.41 0.90 0.19 200 TR_XM_Undi_Recip2 1517 0.29 0.89 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 323010 89.78 94.74 87.49 2 RELAYCOUNTRY_US 285615 78.36 80.53 77.36 3 XM_B_Unicode 263411 73.83 79.22 71.35 4 DKIM_SIGNED 261976 76.75 89.29 70.96 5 XM_DK_Pass 257493 75.10 86.71 69.75 6 DCC_CHECK_NEGATIVE 255514 56.37 28.53 69.21 7 DKIM_VALID 253787 74.23 86.13 68.74 8 BAYES_50 211699 53.48 45.10 57.34 9 DKIM_VALID_AU 195105 56.72 65.11 52.85 10 XM_B_SpammyWords 173067 53.56 68.07 46.88 11 XMListUnsubscribeExists 171763 54.39 71.46 46.53 12 XM_B_Unicode3 145043 39.96 41.43 39.29 13 RCVD_IN_MSPIKE_H2 136714 40.24 47.19 37.03 14 T_TM2_M_HEADER_IN_MSG 120852 28.65 19.78 32.73 15 DCC_CHECK 113443 43.58 71.45 30.73 16 DKIM_VALID_EF 97026 28.12 32.10 26.28 17 HTML_FONT_LOW_CONTRAST 96155 28.37 33.41 26.05 18 FVGT_m_MULTI_ODD 82312 26.23 34.77 22.30 19 XM_B_SpammyWords2 80689 26.42 36.32 21.86 20 LOC_TINY_FONT_1 80498 26.11 35.43 21.80 21 XMSubLong 74718 21.01 22.68 20.24 22 ALL_TRUSTED 72951 13.96 1.38 19.76 23 MIME_HTML_ONLY 70182 23.71 33.92 19.01 24 T_KAM_HTML_FONT_INVALID 67207 21.20 27.69 18.20 25 RCVD_IN_MSPIKE_WL 61801 16.42 15.72 16.74 26 USER_IN_DEF_DKIM_WL 43979 8.78 2.00 11.91 27 XM_Multi_Part_URI 42836 13.46 17.48 11.60 28 XM_Body_Dirty_Words 41339 14.43 21.43 11.20 29 BAYES_00 40578 7.75 0.71 10.99 30 RCVD_IN_MSPIKE_H3 39628 11.05 11.73 10.73 31 LOTS_OF_MONEY 34352 10.50 13.08 9.30 32 XM_B_Unsub 33288 10.78 14.60 9.02 33 XM_DKIMWhitelistDomains 31450 5.84 0.04 8.52 34 LotsOfNums_01 31448 8.02 6.94 8.52 35 BAYES_60 31391 8.10 7.24 8.50 36 TooManyTo_001 29897 6.93 4.38 8.10 37 UNPARSEABLE_RELAY 28446 8.86 11.36 7.71 38 XM_Evil_Numbers_Gen 28327 8.08 8.95 7.67 39 TR_XM_SpammyWords4 25025 8.01 10.67 6.78 40 TR_XM_BayesUnsub 24055 8.97 14.28 6.52 41 IN_ZIMBRA_NJ_WHITELIST 24021 4.48 0.10 6.51 42 TR_XM_DK_Bayes 22908 4.42 0.56 6.21 43 XM_DK_Undo_02 22882 16.45 38.67 6.20 44 TR_XM_DK_Bayes1 22532 4.35 0.55 6.10 45 TR_XM_UnparsRelay 22343 7.61 11.00 6.05 46 T_TooManySym_01 21307 4.63 2.15 5.77 47 MIME_QP_LONG_LINE 20321 4.87 3.50 5.50 48 XM_H_Long_From01 20302 5.56 5.70 5.50 49 RCVD_IN_IADB_LISTED 19990 4.55 2.68 5.41 50 TR_XM_DK_Bayes2 19666 3.80 0.50 5.33 51 XM_SendGrid 18818 5.55 6.55 5.10 52 BAYES_40 18809 4.05 1.79 5.09 53 RCVD_IN_MSPIKE_H4 18430 4.53 3.52 4.99 54 HTML_IMAGE_RATIO_02 18166 5.33 6.22 4.92 55 T_XMHurry_00 18035 3.81 1.47 4.89 56 BAYES_99 18017 12.93 30.39 4.88 57 RCVD_IN_IADB_SPF 17699 3.99 2.26 4.79 58 MPART_ALT_DIFF 17676 6.74 10.97 4.79 59 BOTNET_IPINHOSTNAME 17588 7.53 13.54 4.76 60 TR_XM_DKIM_Undo 17097 13.02 31.23 4.63 61 XM_PDF 16611 3.38 0.95 4.50 62 XMStrtUSub 15879 4.53 5.04 4.30 63 RCVD_IN_VALIDITY_SAFE 15766 3.76 2.67 4.27 64 RCVD_IN_IADB_SENDERID 15761 3.59 2.12 4.27 65 HTML_IMAGE_RATIO_04 15656 4.51 5.08 4.24 66 HTML_IMAGE_RATIO_06 15587 3.97 3.43 4.22 67 RCVD_IN_IADB_DK 15346 3.51 2.12 4.16 68 BAYES_20 15045 3.19 1.26 4.08 69 BAYES_999 14226 10.10 23.64 3.85 70 BAYES_80 14225 5.17 8.02 3.85 71 XM_B_SpammyWords3 14116 6.40 11.98 3.82 72 T_REMOTE_IMAGE 13935 3.55 3.06 3.77 73 RCVD_IN_VALIDITY_CERTIFIED 13930 3.24 2.07 3.77 74 RELAYCOUNTRY_META 13127 9.52 22.45 3.56 75 XM_UncommonTLD01 12839 5.15 8.79 3.48 76 XMSubMetaSx_00 12592 4.13 5.68 3.41 77 TR_XM_PhishingBody 12073 4.23 6.30 3.27 78 RCVD_IN_IADB_VOUCHED 12035 2.70 1.47 3.26 79 FSL_BULK_SIG 11884 5.46 10.33 3.22 80 XM_B_Phish_Phrases 11821 3.89 5.39 3.20 81 MAILING_LIST_MULTI 11580 2.80 2.08 3.14 82 XMSexyCombo_05 11528 5.18 9.63 3.12 83 MIME_HTML_ONLY_MULTI 11507 4.59 7.78 3.12 84 TR_XM_DK_SendGrid 11420 3.47 4.28 3.09 85 T_TooManySym_02 11355 2.27 0.51 3.08 86 XMNumbers 11353 3.39 4.07 3.08 87 BAYES_05 10385 2.14 0.67 2.81 88 XM_H_Trusted_IP 10338 1.92 0.00 2.80 89 XM_B_SpammyTLD 10114 3.40 4.84 2.74 90 FROM_EXCESS_BASE64 9864 2.56 2.30 2.67 91 HTML_IMAGE_RATIO_08 9727 2.61 2.55 2.63 92 URI_NOVOWEL 9387 2.64 2.86 2.54 93 TR_XM_SB_Phish 9363 2.33 1.89 2.54 94 XMSubPhish11 9217 2.19 1.51 2.50 95 BAYES_95 9034 3.19 4.82 2.45 96 TM2_M_URI_OPT_OUT 8562 2.51 2.91 2.32 97 DKIM_INVALID 8189 2.52 3.16 2.22 98 TooManyTo_002 8169 1.67 0.49 2.21 99 RCVD_IN_IADB_OPTIN 8046 1.77 0.90 2.18 100 XM_SPF_SoftFail 7996 3.06 4.99 2.17 101 MIME_HTML_MOSTLY 7988 2.77 4.09 2.16 102 ANY_BOUNCE_MESSAGE 7588 1.63 0.71 2.06 103 BOUNCE_MESSAGE 7586 1.63 0.71 2.05 104 HELO_NODOT 6969 1.47 0.57 1.89 105 HELO_NO_DOMAIN 6967 1.47 0.57 1.89 106 XM_CamelCaseFrm001 6912 2.16 2.80 1.87 107 INVALID_MSGID 6796 1.34 0.25 1.84 108 T_XMDrugObfuBody_08 6720 2.72 4.67 1.82 109 T_XMDrugObfuBody_14 6670 2.48 3.93 1.81 110 XM_B_Investor 6637 3.08 5.85 1.80 111 IN_HORDE_ADDRESS_BOOK 6561 1.24 0.08 1.78 112 XM_B_Phish66 6523 2.45 3.92 1.77 113 HTML_MIME_NO_HTML_TAG 6446 3.35 6.83 1.75 114 TR_XM_SpammyRelay 6366 5.77 14.55 1.72 115 XM_DK_Undo_01 6283 1.82 2.06 1.70 116 BOTNET 6234 4.70 11.23 1.69 117 TVD_RCVD_IP 6192 1.24 0.28 1.68 118 TR_DCC_Bayes_99 6068 7.63 20.60 1.64 119 TO_MALFORMED 6010 1.14 0.07 1.63 120 MSGID_NOFQDN1 5965 1.14 0.09 1.62 121 TR_Symld_Words 5724 1.44 1.19 1.55 122 SUBJ_ALL_CAPS 5477 1.89 2.77 1.48 123 XM_GoogleGroups 5441 2.82 5.73 1.47 124 TooManyTo_003 5266 1.09 0.37 1.43 125 XM_B_Unsub2 5071 1.95 3.20 1.37 126 KHOP_HELO_FCRDNS 4964 1.36 1.39 1.34 127 UNTRUSTED_Relay 4915 3.72 8.88 1.33 128 TR_XM_SpammyWords5 4900 2.28 4.35 1.33 129 XMGappySubj_01 4812 0.94 0.15 1.30 130 XMDiploma_00 4750 1.80 2.93 1.29 131 URI_HEX 4457 1.34 1.63 1.21 132 XMBody_95 4440 0.85 0.08 1.20 133 XM_H_Long_From02 4440 1.25 1.34 1.20 134 XMCapTrack 4369 0.94 0.40 1.18 135 TM2_M_VERY_LONG_WORD 4259 3.41 8.29 1.15 136 TR_MetaPhish_Combo_01 4195 1.00 0.69 1.14 137 TR_XM_Base64_M1 4121 1.14 1.21 1.12 138 XMBSHREFv2 4030 0.84 0.28 1.09 139 RELAYCOUNTRY_CA 4014 3.48 8.67 1.09 140 TooManyTo_004 3851 0.80 0.28 1.04 141 HTML_FONT_FACE_BAD 3766 0.92 0.71 1.02 142 RCVD_IN_MSPIKE_H5 3743 0.84 0.48 1.01 143 RCVD_IN_MSPIKE_BL 3723 2.06 4.33 1.01 144 TR_XM_MSPIKECOMBO 3691 2.01 4.20 1.00 145 XM_OfRef6 3576 1.70 3.30 0.97 146 XMSubNoVowel 3492 0.85 0.63 0.95 147 DKIM_ADSP_CUSTOM_MED 3262 0.87 0.84 0.88 148 HTTPS_HTTP_MISMATCH 3238 1.08 1.53 0.88 149 RCVD_IN_MSPIKE_L3 3208 1.25 2.08 0.87 150 TooManyTo_005 3143 0.66 0.24 0.85 151 FROM_GOV_DKIM_AU 3133 0.62 0.13 0.85 152 XM_UB50 3120 1.99 4.48 0.85 153 RCVD_IN_RP_SAFE 3102 0.76 0.59 0.84 154 TVD_SPACE_RATIO 3019 0.59 0.09 0.82 155 T_FILL_THIS_FORM_SHORT 3000 1.50 2.99 0.81 156 XMStockSpam_06 2964 0.99 1.41 0.80 157 TR_XM_SpammyWords2 2959 3.65 9.81 0.80 158 SpammyFromTLD_01 2956 1.59 3.31 0.80 159 XMBrknScrpt_02 2861 0.90 1.17 0.77 160 T_XMDrugObfuBody_00 2735 1.08 1.82 0.74 161 RCVD_IN_RP_CERTIFIED 2704 0.65 0.48 0.73 162 XMHTML_After_End 2702 0.99 1.55 0.73 163 T_TooManySym_03 2595 0.54 0.19 0.70 164 RCVD_IN_PSBL 2595 1.10 1.97 0.70 165 XMGenDplmaNmb 2467 0.88 1.35 0.67 166 XM_ShortIntro_01 2464 0.59 0.41 0.67 167 XMBdyGiftCard01 2429 0.89 1.39 0.66 168 T_OBFU_PDF_ATTACH 2402 0.52 0.23 0.65 169 XMSubMetaSxObfu_02 2319 0.56 0.40 0.63 170 XM_B_SpammyWords4 2316 1.24 2.57 0.63 171 HTML_TAG_BALANCE_BODY 2257 0.78 1.15 0.61 172 XMNoVowels 2233 0.51 0.29 0.60 173 MPART_ALT_DIFF_COUNT 2215 0.82 1.30 0.60 174 SHORT_HELO_AND_INLINE_IMAGE 2189 0.43 0.08 0.59 175 XMPhish30 2162 0.69 0.90 0.59 176 XMHTMLBadTable_001 2098 0.62 0.72 0.57 177 NML_ADSP_CUSTOM_MED 2081 0.57 0.57 0.56 178 XMMoneyMeta_00 2049 0.66 0.88 0.56 179 RELAYCOUNTRY_GB 2037 0.60 0.70 0.55 180 XM_B_COPY_HTML 2010 0.58 0.67 0.54 181 T_Symld_Words_02 1997 0.61 0.76 0.54 182 XMPhish14 1992 0.56 0.62 0.54 183 T_HTML_ATTACH 1989 0.45 0.26 0.54 184 XM_H_PHPMailer 1980 0.60 0.73 0.54 185 XM_ProductURIs 1976 0.65 0.91 0.54 186 URI_TRY_3LD 1967 0.68 1.00 0.53 187 RCVD_IN_SORBS_DUL 1912 0.42 0.22 0.52 188 TR_XM_SpammyWords3 1899 0.94 1.86 0.51 189 XM_B_COVIDMETA 1888 0.85 1.58 0.51 190 XMLngstWrd_00 1826 2.16 5.78 0.49 191 XMSexyCombo_01 1720 0.88 1.77 0.47 192 TM2_M_BODY_EMPTY 1683 0.55 0.74 0.46 193 HTML_IMAGE_ONLY_32 1669 0.41 0.31 0.45 194 HTML_IMAGE_ONLY_28 1662 0.45 0.45 0.45 195 HTML_IMAGE_ONLY_20 1654 0.46 0.47 0.45 196 FORGED_GMAIL_RCVD 1640 0.52 0.70 0.44 197 XMOemUri 1591 0.38 0.28 0.43 198 XMLngstWrd_01 1583 2.10 5.73 0.43 199 PLING_QUERY 1573 0.53 0.76 0.43 200 SpammyFromTLD_02 1564 1.14 2.68 0.42 ----------------------------------------------------------------------