Email: 544360 Autolearn: 0 AvgScore: 3.95 AvgScanTime: 1.54 sec Spam: 186790 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 1.62 sec Ham: 357570 Autolearn: 0 AvgScore: -1.23 AvgScanTime: 1.49 sec Time Spent Running SA: 232.22 hours Time Spent Processing Spam: 84.10 hours Time Spent Processing Ham: 148.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 166689 88.07 89.24 87.45 2 DKIM_SIGNED 163837 77.56 87.71 72.26 3 XM_DK_Pass 160672 76.02 86.02 70.80 4 DKIM_VALID 152724 73.90 81.76 69.79 5 RELAYCOUNTRY_US 149472 79.15 80.02 78.70 6 XM_B_Unicode 144488 73.57 77.35 71.60 7 XMListUnsubscribeExists 132347 56.39 70.85 48.83 8 DCC_CHECK 120811 43.93 64.68 33.10 9 XM_B_SpammyWords 118235 51.75 63.30 45.71 10 DKIM_VALID_AU 115050 56.94 61.59 54.50 11 BAYES_50 88253 53.49 47.25 56.75 12 RCVD_IN_MSPIKE_H2 79758 39.27 42.70 37.48 13 XM_B_Unicode3 79193 40.96 42.40 40.21 14 LOC_TINY_FONT_1 74430 28.62 39.85 22.76 15 XM_DK_Undo_02 70842 16.76 37.93 5.70 16 XM_B_SpammyWords2 66233 25.33 35.46 20.03 17 DCC_CHECK_NEGATIVE 65938 56.03 35.30 66.85 18 HTML_FONT_LOW_CONTRAST 58671 28.00 31.41 26.22 19 DKIM_VALID_EF 58491 28.31 31.31 26.73 20 TR_XM_DKIM_Undo 58322 13.50 31.22 4.25 21 FVGT_m_MULTI_ODD 57612 26.66 30.84 24.48 22 MIME_HTML_ONLY 57297 23.01 30.67 19.01 23 BAYES_99 55750 13.35 29.85 4.74 24 T_KAM_HTML_FONT_INVALID 49925 21.85 26.73 19.30 25 BAYES_999 43570 10.48 23.33 3.77 26 XMSubLong 40330 21.34 21.59 21.21 27 TR_DCC_Bayes_99 39588 8.30 21.19 1.57 28 RELAYCOUNTRY_META 38154 9.50 20.43 3.79 29 XM_Body_Dirty_Words 37865 14.22 20.27 11.05 30 T_TM2_M_HEADER_IN_MSG 36974 28.00 19.79 32.29 31 XM_Multi_Part_URI 30498 13.37 16.33 11.82 32 XM_UncommonTLD01 27745 7.74 14.85 4.03 33 XM_B_Unsub 26818 10.11 14.36 7.89 34 TR_XM_BayesUnsub 25945 8.74 13.89 6.05 35 RCVD_IN_MSPIKE_WL 24740 16.14 13.24 17.65 36 TR_XM_SpammyRelay 24310 5.61 13.01 1.74 37 BOTNET_IPINHOSTNAME 23913 7.35 12.80 4.50 38 XM_B_SpammyTLD 21911 5.41 11.73 2.11 39 UNPARSEABLE_RELAY 21804 9.10 11.67 7.75 40 LOTS_OF_MONEY 21296 9.25 11.40 8.12 41 TR_XM_UnparsRelay 21294 7.90 11.40 6.07 42 BOTNET 20661 4.80 11.06 1.53 43 FSL_BULK_SIG 20371 5.58 10.91 2.80 44 XM_B_SpammyWords3 20021 6.15 10.72 3.76 45 RCVD_IN_BL_SPAMCOP_NET 19851 3.84 10.63 0.30 46 TR_XM_SpammyWords2 19847 4.04 10.63 0.60 47 SpammyFromTLD_01 18336 4.04 9.82 1.01 48 SUBJ_ALL_CAPS 18278 4.61 9.79 1.91 49 UNTRUSTED_Relay 17923 4.18 9.60 1.35 50 TR_XM_SpammyWords4 17818 6.91 9.54 5.53 51 XMSexyCombo_05 17325 5.15 9.28 2.99 52 RCVD_IN_MSPIKE_H3 17257 10.59 9.24 11.29 53 XM_Evil_Numbers_Gen 15565 8.26 8.33 8.22 54 TR_XM_PHPDW 15483 3.17 8.29 0.49 55 TR_XM_PHPForged 15449 3.14 8.27 0.46 56 TR_XM_FormFill2 15391 3.13 8.24 0.46 57 XM_H_PHPOS 15384 3.12 8.24 0.45 58 RELAYCOUNTRY_CA 14991 3.55 8.03 1.20 59 XM_SPF_SoftFail 14738 4.37 7.89 2.54 60 BAYES_80 13612 5.41 7.29 4.43 61 BAYES_60 13304 8.43 7.12 9.11 62 XM_SendGrid 12441 5.58 6.66 5.01 63 LotsOfNums_01 12295 8.05 6.58 8.81 64 MPART_ALT_DIFF 12263 5.67 6.57 5.20 65 HTML_IMAGE_RATIO_02 11378 5.65 6.09 5.42 66 TR_XM_SPAMCOP 11197 2.16 5.99 0.16 67 DKIM_INVALID 11113 3.67 5.95 2.47 68 TR_XM_PhishingBody 10882 3.92 5.83 2.92 69 XM_H_Long_From01 10492 5.22 5.62 5.01 70 TooManyTo_001 10036 7.28 5.37 8.28 71 XMSubMetaSx_00 9864 3.86 5.28 3.12 72 XMStrtUSub 9363 4.60 5.01 4.39 73 RCVD_IN_MSPIKE_BL 9307 2.22 4.98 0.78 74 XM_B_Phish_Phrases 9239 4.14 4.95 3.72 75 XM_B_Investor 9192 2.72 4.92 1.57 76 TR_XM_MSPIKECOMBO 9142 2.19 4.89 0.78 77 XMNumbers 9121 3.87 4.88 3.33 78 XM_UB50 9064 2.24 4.85 0.87 79 TR_XM_SpammyWords5 8620 2.56 4.61 1.49 80 TM2_M_VERY_LONG_WORD 8493 2.55 4.55 1.51 81 T_XMDrugObfuBody_08 8398 2.80 4.50 1.91 82 TR_XM_DK_SendGrid 8041 3.69 4.30 3.36 83 XMBody_17 7783 1.75 4.17 0.49 84 BAYES_95 7745 3.17 4.15 2.67 85 HTML_IMAGE_RATIO_04 7625 4.80 4.08 5.17 86 T_REMOTE_IMAGE 7479 3.59 4.00 3.38 87 T_FILL_THIS_FORM_SHORT 7398 1.94 3.96 0.88 88 MIME_HTML_ONLY_MULTI 7174 3.74 3.84 3.68 89 RCVD_IN_MSPIKE_H4 7154 4.79 3.83 5.29 90 HTML_IMAGE_RATIO_06 6853 3.86 3.67 3.96 91 MIME_HTML_MOSTLY 6850 2.69 3.67 2.18 92 XM_B_SpammyTLD2 6828 1.31 3.66 0.08 93 T_XMDrugObfuBody_14 6748 2.27 3.61 1.56 94 XM_DIRTYINTL 6498 1.40 3.48 0.32 95 MIME_QP_LONG_LINE 6301 4.71 3.37 5.41 96 RCVD_IN_PSBL 6122 1.46 3.28 0.51 97 TM2_M_URI_OPT_OUT 5957 2.60 3.19 2.30 98 URIBL_DBL_SPAM 5853 1.08 3.13 0.01 99 RCVD_IN_VALIDITY_RPBL 5836 1.08 3.12 0.01 100 HTML_MIME_NO_HTML_TAG 5659 2.54 3.03 2.28 101 XM_B_Phish66 5643 2.11 3.02 1.63 102 XM_OfRef6 5414 1.55 2.90 0.85 103 PDS_OTHER_BAD_TLD 5358 1.07 2.87 0.13 104 RCVD_IN_VALIDITY_SAFE 5252 3.69 2.81 4.15 105 HTML_IMAGE_RATIO_08 5135 2.65 2.75 2.59 106 XM_DK_Undo_01 5116 1.95 2.74 1.55 107 BOTNET_NORDNS 4946 0.92 2.65 0.01 108 XM_B_Unsub2 4924 1.81 2.64 1.38 109 RCVD_IN_MSPIKE_L5 4873 0.94 2.61 0.06 110 SpammyFromTLD_02 4822 1.08 2.58 0.30 111 XM_CamelCaseFrm001 4751 2.04 2.54 1.77 112 URI_NOVOWEL 4442 2.42 2.38 2.44 113 TR_XM_FormFill 4430 0.82 2.37 0.02 114 RCVD_IN_IADB_LISTED 4316 4.32 2.31 5.37 115 XMDiploma_00 4282 1.80 2.29 1.55 116 URI_PHP_REDIR 4229 0.78 2.26 0.01 117 XM_B_SpammyWords4 4228 1.20 2.26 0.65 118 RCVD_IN_VALIDITY_CERTIFIED 4227 3.16 2.26 3.63 119 RCVD_IN_MSPIKE_L3 4047 1.21 2.17 0.71 120 T_TooManySym_01 4042 4.69 2.16 6.02 121 XMLngstWrd_00 3723 1.32 1.99 0.97 122 XM_GoogleGroups 3714 1.89 1.99 1.84 123 MAILING_LIST_MULTI 3695 2.60 1.98 2.92 124 TR_XM_SB_Phish 3686 2.11 1.97 2.19 125 XMLngstWrd_01 3666 1.25 1.96 0.88 126 RCVD_IN_IADB_SPF 3650 3.83 1.95 4.82 127 XMSubPhish11 3577 2.07 1.91 2.16 128 XMLngstWrd_02 3533 1.15 1.89 0.77 129 XMSexyCombo_01 3527 0.88 1.89 0.36 130 FROM_EXCESS_BASE64 3518 2.18 1.88 2.34 131 UPPERCASE_75_100 3496 0.97 1.87 0.50 132 RCVD_IN_IADB_DK 3493 3.40 1.87 4.20 133 XM_UB99 3471 0.64 1.86 0.00 134 RCVD_IN_IADB_SENDERID 3453 3.47 1.85 4.32 135 KHOP_HELO_FCRDNS 3400 1.78 1.82 1.75 136 USER_IN_DEF_DKIM_WL 3384 8.34 1.81 11.75 137 BAYES_40 3265 3.92 1.75 5.05 138 HELO_NODOT 3265 1.70 1.75 1.68 139 XMLngstWrd_03 3128 1.02 1.67 0.67 140 DOS_RCVD_IP_TWICE_B 3127 0.91 1.67 0.52 141 XMLngstWrd_04 3074 0.96 1.65 0.61 142 XM_H_Undi_Recip 3065 0.73 1.64 0.25 143 URI_HEX 3056 1.56 1.64 1.52 144 HK_RANDOM_REPLYTO 3013 0.62 1.61 0.10 145 TR_XM_SpammyWords3 2965 0.79 1.59 0.37 146 TR_XM_BayesRelay 2933 0.54 1.57 0.00 147 XM_UB999 2915 0.54 1.56 0.00 148 HTML_TITLE_SUBJ_DIFF 2826 0.84 1.51 0.49 149 TR_XM_NoHeaderRelay 2808 0.60 1.50 0.13 150 T_XMHurry_00 2720 2.90 1.46 3.65 151 TR_XM_MSPIKECOMBO2 2601 0.51 1.39 0.05 152 HELO_NO_DOMAIN 2595 1.58 1.39 1.68 153 HTTPS_HTTP_MISMATCH 2578 1.12 1.38 0.98 154 XMHTML_After_End 2551 1.04 1.37 0.87 155 TR_XM_InvalidRelay 2534 0.48 1.36 0.02 156 T_XMDrugObfuBody_00 2521 0.89 1.35 0.65 157 ALL_TRUSTED 2505 12.60 1.34 18.48 158 RELAYCOUNTRY_IN 2487 0.51 1.33 0.08 159 XMStockSpam_06 2482 1.32 1.33 1.32 160 XM_URI_RBL 2445 0.52 1.31 0.10 161 XMBdyGiftCard01 2418 0.92 1.29 0.72 162 XMGenDplmaNmb 2390 0.91 1.28 0.72 163 TR_Symld_Words 2357 1.58 1.26 1.75 164 BAYES_20 2288 3.02 1.22 3.95 165 XM_Body_Dirty_Words_01 2268 0.51 1.21 0.14 166 URIBL_BLACK 2179 0.43 1.17 0.05 167 XMMoneyMeta_00 2167 0.76 1.16 0.56 168 XMBrknScrpt_02 2162 0.89 1.16 0.76 169 TR_XM_COVIDMETA1 2146 0.51 1.15 0.17 170 RELAYCOUNTRY_AU 2140 0.58 1.15 0.28 171 RELAYCOUNTRY_FR 2115 0.59 1.13 0.30 172 XM_B_COVIDMETA 2100 0.65 1.12 0.40 173 RCVD_IN_IADB_VOUCHED 2096 2.44 1.12 3.13 174 XM_H_Long_From02 2091 1.22 1.12 1.28 175 NO_DNS_FOR_FROM 2072 0.54 1.11 0.24 176 DKIM_ADSP_NXDOMAIN 2044 0.53 1.09 0.23 177 MPART_ALT_DIFF_COUNT 2039 0.77 1.09 0.60 178 RELAYCOUNTRY_DE 2027 0.58 1.09 0.31 179 TR_MetaPhish_Combo_01 2024 0.95 1.08 0.88 180 TR_Mismatch_TLD_02 1999 0.41 1.07 0.07 181 XMReplyNow 1988 0.56 1.06 0.30 182 FSL_HELO_NON_FQDN_1 1977 0.37 1.06 0.01 183 RELAYCOUNTRY_RU 1973 0.39 1.06 0.04 184 HTML_TAG_BALANCE_BODY 1923 0.81 1.03 0.70 185 XMSubNoVowel 1916 1.10 1.03 1.14 186 REMOVE_BEFORE_LINK 1896 0.50 1.02 0.24 187 XMPhish30 1894 0.67 1.01 0.49 188 THIS_AD 1891 0.56 1.01 0.32 189 TR_XM_MaxWHORU 1882 0.47 1.01 0.19 190 HTML_IMAGE_ONLY_24 1880 0.57 1.01 0.34 191 XMPhish14 1851 0.70 0.99 0.54 192 RDNS_DYNAMIC 1849 0.49 0.99 0.22 193 XM_UB60 1783 0.37 0.95 0.07 194 TR_LOTS_OF_MONEY3 1754 0.45 0.94 0.20 195 TR_XM_Base64_M1 1745 0.89 0.93 0.87 196 RELAYCOUNTRY_CN 1708 0.36 0.91 0.06 197 NORDNS_LOW_CONTRAST 1707 0.33 0.91 0.02 198 PDS_RDNS_DYNAMIC_FP 1703 0.35 0.91 0.06 199 TR_XM_MaxSPIKE 1668 0.34 0.89 0.05 200 XM_PDF 1651 3.24 0.88 4.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312703 88.07 89.24 87.45 2 RELAYCOUNTRY_US 281412 79.15 80.02 78.70 3 DKIM_SIGNED 258388 77.56 87.71 72.26 4 XM_B_Unicode 256015 73.57 77.35 71.60 5 XM_DK_Pass 253159 76.02 86.02 70.80 6 DKIM_VALID 249539 73.90 81.76 69.79 7 DCC_CHECK_NEGATIVE 239047 56.03 35.30 66.85 8 BAYES_50 202932 53.49 47.25 56.75 9 DKIM_VALID_AU 194891 56.94 61.59 54.50 10 XMListUnsubscribeExists 174610 56.39 70.85 48.83 11 XM_B_SpammyWords 163460 51.75 63.30 45.71 12 XM_B_Unicode3 143764 40.96 42.40 40.21 13 RCVD_IN_MSPIKE_H2 134001 39.27 42.70 37.48 14 DCC_CHECK 118345 43.93 64.68 33.10 15 T_TM2_M_HEADER_IN_MSG 115460 28.00 19.79 32.29 16 DKIM_VALID_EF 95595 28.31 31.31 26.73 17 HTML_FONT_LOW_CONTRAST 93759 28.00 31.41 26.22 18 FVGT_m_MULTI_ODD 87532 26.66 30.84 24.48 19 LOC_TINY_FONT_1 81370 28.62 39.85 22.76 20 XMSubLong 75824 21.34 21.59 21.21 21 XM_B_SpammyWords2 71632 25.33 35.46 20.03 22 T_KAM_HTML_FONT_INVALID 69022 21.85 26.73 19.30 23 MIME_HTML_ONLY 67961 23.01 30.67 19.01 24 ALL_TRUSTED 66066 12.60 1.34 18.48 25 RCVD_IN_MSPIKE_WL 63115 16.14 13.24 17.65 26 XM_Multi_Part_URI 42278 13.37 16.33 11.82 27 USER_IN_DEF_DKIM_WL 42024 8.34 1.81 11.75 28 RCVD_IN_MSPIKE_H3 40381 10.59 9.24 11.29 29 XM_Body_Dirty_Words 39523 14.22 20.27 11.05 30 BAYES_00 38073 7.26 0.76 10.65 31 XM_DKIMWhitelistDomains 33050 6.12 0.15 9.24 32 BAYES_60 32576 8.43 7.12 9.11 33 LotsOfNums_01 31504 8.05 6.58 8.81 34 TooManyTo_001 29613 7.28 5.37 8.28 35 XM_Evil_Numbers_Gen 29379 8.26 8.33 8.22 36 LOTS_OF_MONEY 29038 9.25 11.40 8.12 37 XM_B_Unsub 28229 10.11 14.36 7.89 38 UNPARSEABLE_RELAY 27728 9.10 11.67 7.75 39 IN_ZIMBRA_NJ_WHITELIST 23856 4.41 0.08 6.67 40 TR_XM_UnparsRelay 21721 7.90 11.40 6.07 41 TR_XM_BayesUnsub 21622 8.74 13.89 6.05 42 T_TooManySym_01 21514 4.69 2.16 6.02 43 TR_XM_DK_Bayes 21398 4.09 0.45 5.98 44 TR_XM_DK_Bayes1 21111 4.03 0.44 5.90 45 XM_DK_Undo_02 20368 16.76 37.93 5.70 46 TR_XM_SpammyWords4 19782 6.91 9.54 5.53 47 HTML_IMAGE_RATIO_02 19363 5.65 6.09 5.42 48 MIME_QP_LONG_LINE 19346 4.71 3.37 5.41 49 RCVD_IN_IADB_LISTED 19194 4.32 2.31 5.37 50 RCVD_IN_MSPIKE_H4 18912 4.79 3.83 5.29 51 MPART_ALT_DIFF 18605 5.67 6.57 5.20 52 HTML_IMAGE_RATIO_04 18480 4.80 4.08 5.17 53 TR_XM_DK_Bayes2 18198 3.46 0.34 5.09 54 BAYES_40 18067 3.92 1.75 5.05 55 XM_SendGrid 17925 5.58 6.66 5.01 56 XM_H_Long_From01 17914 5.22 5.62 5.01 57 RCVD_IN_IADB_SPF 17224 3.83 1.95 4.82 58 BAYES_99 16939 13.35 29.85 4.74 59 BOTNET_IPINHOSTNAME 16076 7.35 12.80 4.50 60 XM_PDF 15970 3.24 0.88 4.47 61 BAYES_80 15854 5.41 7.29 4.43 62 XMStrtUSub 15693 4.60 5.01 4.39 63 RCVD_IN_IADB_SENDERID 15455 3.47 1.85 4.32 64 TR_XM_DKIM_Undo 15187 13.50 31.22 4.25 65 RCVD_IN_IADB_DK 15018 3.40 1.87 4.20 66 RCVD_IN_VALIDITY_SAFE 14825 3.69 2.81 4.15 67 XM_UncommonTLD01 14409 7.74 14.85 4.03 68 HTML_IMAGE_RATIO_06 14150 3.86 3.67 3.96 69 BAYES_20 14129 3.02 1.22 3.95 70 RELAYCOUNTRY_META 13553 9.50 20.43 3.79 71 BAYES_999 13486 10.48 23.33 3.77 72 XM_B_SpammyWords3 13443 6.15 10.72 3.76 73 XM_B_Phish_Phrases 13299 4.14 4.95 3.72 74 MIME_HTML_ONLY_MULTI 13172 3.74 3.84 3.68 75 T_XMHurry_00 13044 2.90 1.46 3.65 76 RCVD_IN_VALIDITY_CERTIFIED 12975 3.16 2.26 3.63 77 T_REMOTE_IMAGE 12070 3.59 4.00 3.38 78 TR_XM_DK_SendGrid 12032 3.69 4.30 3.36 79 XMNumbers 11920 3.87 4.88 3.33 80 T_TooManySym_02 11657 2.36 0.64 3.26 81 RCVD_IN_IADB_VOUCHED 11187 2.44 1.12 3.13 82 XMSubMetaSx_00 11174 3.86 5.28 3.12 83 XMSexyCombo_05 10707 5.15 9.28 2.99 84 TR_XM_PhishingBody 10450 3.92 5.83 2.92 85 MAILING_LIST_MULTI 10433 2.60 1.98 2.92 86 XM_H_Trusted_IP 10413 1.91 0.00 2.91 87 FSL_BULK_SIG 10007 5.58 10.91 2.80 88 BAYES_95 9532 3.17 4.15 2.67 89 BAYES_05 9468 1.95 0.61 2.65 90 HTML_IMAGE_RATIO_08 9276 2.65 2.75 2.59 91 XM_SPF_SoftFail 9065 4.37 7.89 2.54 92 DKIM_INVALID 8849 3.67 5.95 2.47 93 URI_NOVOWEL 8707 2.42 2.38 2.44 94 TooManyTo_002 8418 1.74 0.57 2.35 95 FROM_EXCESS_BASE64 8374 2.18 1.88 2.34 96 TM2_M_URI_OPT_OUT 8207 2.60 3.19 2.30 97 HTML_MIME_NO_HTML_TAG 8146 2.54 3.03 2.28 98 TR_XM_SB_Phish 7816 2.11 1.97 2.19 99 MIME_HTML_MOSTLY 7797 2.69 3.67 2.18 100 ANY_BOUNCE_MESSAGE 7766 1.63 0.60 2.17 101 BOUNCE_MESSAGE 7764 1.63 0.60 2.17 102 XMSubPhish11 7718 2.07 1.91 2.16 103 RCVD_IN_IADB_OPTIN 7637 1.62 0.62 2.14 104 TVD_RCVD_IP 7579 1.49 0.30 2.12 105 XM_B_SpammyTLD 7543 5.41 11.73 2.11 106 SUBJ_ALL_CAPS 6839 4.61 9.79 1.91 107 T_XMDrugObfuBody_08 6836 2.80 4.50 1.91 108 INVALID_MSGID 6597 1.25 0.11 1.84 109 XM_GoogleGroups 6562 1.89 1.99 1.84 110 XM_CamelCaseFrm001 6342 2.04 2.54 1.77 111 KHOP_HELO_FCRDNS 6275 1.78 1.82 1.75 112 TR_Symld_Words 6248 1.58 1.26 1.75 113 IN_HORDE_ADDRESS_BOOK 6238 1.17 0.08 1.74 114 TR_XM_SpammyRelay 6220 5.61 13.01 1.74 115 MSGID_NOFQDN1 6125 1.13 0.01 1.71 116 HELO_NODOT 5993 1.70 1.75 1.68 117 HELO_NO_DOMAIN 5991 1.58 1.39 1.68 118 TO_MALFORMED 5957 1.10 0.01 1.67 119 XM_B_Phish66 5837 2.11 3.02 1.63 120 XM_B_Investor 5618 2.72 4.92 1.57 121 TR_DCC_Bayes_99 5606 8.30 21.19 1.57 122 T_XMDrugObfuBody_14 5593 2.27 3.61 1.56 123 XMDiploma_00 5538 1.80 2.29 1.55 124 XM_DK_Undo_01 5526 1.95 2.74 1.55 125 BOTNET 5455 4.80 11.06 1.53 126 URI_HEX 5452 1.56 1.64 1.52 127 TooManyTo_003 5403 1.16 0.47 1.51 128 TM2_M_VERY_LONG_WORD 5396 2.55 4.55 1.51 129 TR_XM_SpammyWords5 5313 2.56 4.61 1.49 130 XM_B_Unsub2 4929 1.81 2.64 1.38 131 UNTRUSTED_Relay 4817 4.18 9.60 1.35 132 XMStockSpam_06 4704 1.32 1.33 1.32 133 XM_H_Long_From02 4575 1.22 1.12 1.28 134 XMCapTrack 4335 0.91 0.34 1.21 135 RELAYCOUNTRY_CA 4308 3.55 8.03 1.20 136 XMGappySubj_01 4216 0.83 0.17 1.18 137 XMBody_95 4208 0.82 0.13 1.18 138 XMSubNoVowel 4079 1.10 1.03 1.14 139 XMBSHREFv2 4008 0.83 0.27 1.12 140 TooManyTo_004 3973 0.86 0.39 1.11 141 DKIM_ADSP_CUSTOM_MED 3855 0.95 0.72 1.08 142 RCVD_IN_MSPIKE_H5 3822 0.76 0.18 1.07 143 SpammyFromTLD_01 3629 4.04 9.82 1.01 144 HTTPS_HTTP_MISMATCH 3503 1.12 1.38 0.98 145 XMLngstWrd_00 3483 1.32 1.99 0.97 146 HTML_FONT_FACE_BAD 3281 0.86 0.75 0.92 147 TooManyTo_005 3202 0.70 0.34 0.90 148 RCVD_IN_RP_SAFE 3171 0.77 0.54 0.89 149 TR_MetaPhish_Combo_01 3160 0.95 1.08 0.88 150 XMLngstWrd_01 3158 1.25 1.96 0.88 151 T_FILL_THIS_FORM_SHORT 3144 1.94 3.96 0.88 152 XM_UB50 3119 2.24 4.85 0.87 153 TR_XM_Base64_M1 3113 0.89 0.93 0.87 154 XMHTML_After_End 3096 1.04 1.37 0.87 155 XM_OfRef6 3050 1.55 2.90 0.85 156 TVD_SPACE_RATIO 2970 0.57 0.08 0.83 157 RCVD_IN_MSPIKE_BL 2801 2.22 4.98 0.78 158 TR_XM_MSPIKECOMBO 2793 2.19 4.89 0.78 159 RCVD_IN_RP_CERTIFIED 2743 0.64 0.40 0.77 160 XMLngstWrd_02 2737 1.15 1.89 0.77 161 XMBrknScrpt_02 2709 0.89 1.16 0.76 162 T_TooManySym_03 2679 0.59 0.28 0.75 163 XM_ShortIntro_01 2624 0.62 0.41 0.73 164 XMSubMetaI_00 2617 0.76 0.83 0.73 165 XMBdyGiftCard01 2587 0.92 1.29 0.72 166 XMGenDplmaNmb 2585 0.91 1.28 0.72 167 RCVD_IN_MSPIKE_L3 2556 1.21 2.17 0.71 168 HTML_TAG_BALANCE_BODY 2513 0.81 1.03 0.70 169 FORGED_GMAIL_RCVD 2406 0.64 0.59 0.67 170 XMLngstWrd_03 2401 1.02 1.67 0.67 171 XM_B_SpammyWords4 2331 1.20 2.26 0.65 172 T_XMDrugObfuBody_00 2314 0.89 1.35 0.65 173 T_OBFU_PDF_ATTACH 2268 0.48 0.18 0.63 174 XM_H_PHPMailer 2246 0.62 0.59 0.63 175 XMNoVowels 2197 0.51 0.31 0.61 176 XMSlimDrugH 2189 0.69 0.85 0.61 177 XMLngstWrd_04 2172 0.96 1.65 0.61 178 XM_ProductURIs 2165 0.60 0.58 0.61 179 TR_XM_SpammyWords2 2160 4.04 10.63 0.60 180 MPART_ALT_DIFF_COUNT 2146 0.77 1.09 0.60 181 NML_ADSP_CUSTOM_MED 2116 0.56 0.50 0.59 182 URI_TRY_3LD 2044 0.67 0.86 0.57 183 T_Symld_Words_02 2029 0.64 0.77 0.57 184 XM_shorewaves_Whitelist 2003 0.37 0.00 0.56 185 XMMoneyMeta_00 1994 0.76 1.16 0.56 186 XM_RXBody 1963 0.52 0.48 0.55 187 TO_NO_BRKTS_HTML_ONLY 1954 0.39 0.10 0.55 188 XMPhish14 1946 0.70 0.99 0.54 189 HTML_IMAGE_ONLY_20 1943 0.45 0.27 0.54 190 SHORT_HELO_AND_INLINE_IMAGE 1885 0.42 0.23 0.53 191 XM_B_COPY_HTML 1884 0.60 0.75 0.53 192 DOS_RCVD_IP_TWICE_B 1848 0.91 1.67 0.52 193 RCVD_IN_PSBL 1824 1.46 3.28 0.51 194 SUBJ_BUY 1802 0.39 0.16 0.50 195 UPPERCASE_75_100 1778 0.97 1.87 0.50 196 RELAYCOUNTRY_GB 1768 0.62 0.85 0.49 197 TR_XM_PHPDW 1767 3.17 8.29 0.49 198 XMBody_17 1762 1.75 4.17 0.49 199 HTML_TITLE_SUBJ_DIFF 1762 0.84 1.51 0.49 200 XMSubMetaSxObfu_02 1759 0.43 0.31 0.49 ----------------------------------------------------------------------