Email: 509498 Autolearn: 0 AvgScore: 3.76 AvgScanTime: 1.36 sec Spam: 170743 Autolearn: 0 AvgScore: 14.01 AvgScanTime: 1.47 sec Ham: 338755 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 1.30 sec Time Spent Running SA: 191.90 hours Time Spent Processing Spam: 69.68 hours Time Spent Processing Ham: 122.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162871 89.81 95.39 87.00 2 DKIM_SIGNED 151959 79.04 89.00 74.02 3 XM_DK_Pass 148077 77.29 86.73 72.54 4 DKIM_VALID 146371 76.26 85.73 71.49 5 XM_B_Unicode 142910 74.72 83.70 70.20 6 RELAYCOUNTRY_US 137886 81.00 80.76 81.12 7 DCC_CHECK 120569 45.29 70.61 32.52 8 XMListUnsubscribeExists 118409 56.29 69.35 49.70 9 XM_B_SpammyWords 116896 52.46 68.46 44.40 10 DKIM_VALID_AU 109251 58.57 63.99 55.85 11 RCVD_IN_MSPIKE_H2 81822 41.64 47.92 38.48 12 XM_B_Unicode3 76989 42.30 45.09 40.89 13 BAYES_50 75161 52.97 44.02 57.48 14 XM_DK_Undo_02 69898 17.70 40.94 5.99 15 XM_B_SpammyWords2 66807 25.20 39.13 18.18 16 LOC_TINY_FONT_1 61895 28.02 36.25 23.87 17 DKIM_VALID_EF 58348 30.00 34.17 27.89 18 FVGT_m_MULTI_ODD 57660 27.66 33.77 24.59 19 HTML_FONT_LOW_CONTRAST 57652 29.06 33.77 26.69 20 TR_XM_DKIM_Undo 57151 13.89 33.47 4.02 21 MIME_HTML_ONLY 56559 24.32 33.13 19.88 22 BAYES_99 52535 13.88 30.77 5.37 23 T_KAM_HTML_FONT_INVALID 51665 23.55 30.26 20.17 24 DCC_CHECK_NEGATIVE 50119 54.67 29.35 67.42 25 BAYES_999 40824 10.95 23.91 4.41 26 XMSubLong 39408 22.70 23.08 22.51 27 XM_Body_Dirty_Words 37702 14.74 22.08 11.04 28 TR_DCC_Bayes_99 37514 8.26 21.97 1.35 29 T_TM2_M_HEADER_IN_MSG 36613 27.19 21.44 30.09 30 RELAYCOUNTRY_META 34352 9.38 20.12 3.96 31 XM_Multi_Part_URI 32268 14.35 18.90 12.05 32 XM_B_Unsub 25994 10.75 15.22 8.49 33 RCVD_IN_MSPIKE_WL 25515 17.22 14.94 18.37 34 TR_XM_BayesUnsub 25315 9.22 14.83 6.39 35 BOTNET_IPINHOSTNAME 23520 7.79 13.78 4.77 36 XM_B_SpammyWords3 23030 7.44 13.49 4.39 37 TR_XM_SpammyRelay 22791 5.73 13.35 1.89 38 LOTS_OF_MONEY 22568 9.19 13.22 7.16 39 UNPARSEABLE_RELAY 21629 9.34 12.67 7.66 40 TR_XM_UnparsRelay 21093 8.10 12.35 5.96 41 RCVD_IN_BL_SPAMCOP_NET 20188 4.26 11.82 0.45 42 FSL_BULK_SIG 19547 5.56 11.45 2.59 43 TR_XM_SpammyWords2 19401 4.30 11.36 0.74 44 TR_XM_SpammyWords4 19159 6.73 11.22 4.47 45 BOTNET 17540 4.44 10.27 1.49 46 RCVD_IN_MSPIKE_H3 17212 11.38 10.08 12.03 47 RELAYCOUNTRY_CA 16346 4.08 9.57 1.31 48 XMSexyCombo_05 15746 5.21 9.22 3.19 49 XM_Evil_Numbers_Gen 15297 8.25 8.96 7.90 50 BAYES_80 14021 5.50 8.21 4.14 51 XM_UncommonTLD01 13240 5.25 7.75 3.99 52 TR_XM_SPAMCOP 13131 2.76 7.69 0.28 53 BAYES_60 12876 8.49 7.54 8.96 54 UNTRUSTED_Relay 12763 3.31 7.47 1.22 55 LotsOfNums_01 12531 8.33 7.34 8.83 56 HTML_IMAGE_RATIO_02 11693 6.17 6.85 5.83 57 MPART_ALT_DIFF 11493 6.16 6.73 5.87 58 TR_XM_PhishingBody 10895 4.59 6.38 3.69 59 XM_H_Long_From01 10699 5.64 6.27 5.32 60 XM_SendGrid 10186 4.79 5.97 4.19 61 XM_B_Phish_Phrases 9845 4.12 5.77 3.28 62 XM_B_Investor 9820 2.90 5.75 1.46 63 XM_B_SpammyTLD 9816 3.56 5.75 2.45 64 XMSubMetaSx_00 9622 4.61 5.64 4.10 65 TooManyTo_001 9423 7.48 5.52 8.47 66 RCVD_IN_MSPIKE_BL 8587 2.23 5.03 0.81 67 HTML_IMAGE_RATIO_04 8522 5.38 4.99 5.58 68 TR_XM_MSPIKECOMBO 8437 2.20 4.94 0.81 69 BAYES_95 8239 3.36 4.83 2.62 70 XMBody_17 8194 2.01 4.80 0.60 71 XM_SPF_SoftFail 8036 3.37 4.71 2.70 72 XMStrtUSub 7986 4.74 4.68 4.78 73 RCVD_IN_MSPIKE_H4 7910 4.97 4.63 5.13 74 MIME_HTML_ONLY_MULTI 7625 4.13 4.47 3.96 75 T_XMDrugObfuBody_08 7428 2.54 4.35 1.63 76 T_XMDrugObfuBody_14 7211 2.53 4.22 1.68 77 XMNumbers 7007 3.50 4.10 3.19 78 HTML_IMAGE_RATIO_06 6672 3.91 3.91 3.91 79 URIBL_DBL_SPAM 6595 1.30 3.86 0.01 80 T_REMOTE_IMAGE 6592 3.77 3.86 3.73 81 TM2_M_URI_OPT_OUT 6513 3.04 3.81 2.65 82 TR_XM_SpammyWords5 6389 2.14 3.74 1.33 83 TM2_M_VERY_LONG_WORD 6230 2.35 3.65 1.69 84 TR_XM_DK_SendGrid 6218 3.05 3.64 2.74 85 MIME_QP_LONG_LINE 6206 4.91 3.63 5.55 86 T_FILL_THIS_FORM_SHORT 6183 1.81 3.62 0.90 87 XM_DIRTYINTL 6066 1.42 3.55 0.34 88 PDS_OTHER_BAD_TLD 5930 1.26 3.47 0.14 89 XM_UB50 5897 1.66 3.45 0.75 90 XM_B_Phish66 5813 2.73 3.40 2.40 91 DKIM_INVALID 5588 2.78 3.27 2.53 92 HTML_IMAGE_RATIO_08 5457 2.59 3.20 2.28 93 MIME_HTML_MOSTLY 5398 3.10 3.16 3.07 94 XM_OfRef6 5340 1.69 3.13 0.97 95 XM_CamelCaseFrm001 5178 2.35 3.03 2.01 96 RCVD_IN_VALIDITY_RPBL 5163 1.03 3.02 0.02 97 SpammyFromTLD_01 5050 1.63 2.96 0.97 98 HTML_MIME_NO_HTML_TAG 5039 2.66 2.95 2.51 99 XM_DK_Undo_01 4957 1.98 2.90 1.52 100 RCVD_IN_PSBL 4814 1.26 2.82 0.47 101 T_TooManySym_01 4604 5.21 2.70 6.48 102 RCVD_IN_VALIDITY_SAFE 4480 3.79 2.62 4.38 103 SUBJ_ALL_CAPS 4464 2.02 2.61 1.72 104 RCVD_IN_MSPIKE_L5 4452 0.89 2.61 0.02 105 SpammyFromTLD_02 4420 1.22 2.59 0.53 106 XM_B_SpammyWords4 4282 1.13 2.51 0.44 107 XM_H_Undi_Recip 4185 0.98 2.45 0.24 108 XMDiploma_00 4051 1.61 2.37 1.23 109 XM_B_Unsub2 4009 1.80 2.35 1.53 110 RCVD_IN_IADB_LISTED 3979 4.43 2.33 5.49 111 URI_NOVOWEL 3973 2.72 2.33 2.92 112 USER_IN_DEF_DKIM_WL 3935 8.94 2.30 12.28 113 RCVD_IN_MSPIKE_L3 3661 1.24 2.14 0.79 114 XM_GoogleGroups 3646 1.86 2.14 1.71 115 RCVD_IN_VALIDITY_CERTIFIED 3637 3.30 2.13 3.90 116 URI_PHP_REDIR 3472 0.68 2.03 0.00 117 HK_RANDOM_REPLYTO 3448 0.74 2.02 0.09 118 DOS_RCVD_IP_TWICE_B 3391 1.05 1.99 0.59 119 TR_XM_FormFill 3380 0.67 1.98 0.01 120 XMLngstWrd_00 3362 1.29 1.97 0.95 121 RCVD_IN_IADB_SPF 3321 3.89 1.95 4.86 122 BOTNET_NORDNS 3319 0.66 1.94 0.01 123 MAILING_LIST_MULTI 3312 2.52 1.94 2.81 124 XMLngstWrd_01 3299 1.22 1.93 0.87 125 FROM_EXCESS_BASE64 3276 2.34 1.92 2.55 126 TR_LOTS_OF_MONEY3 3249 0.83 1.90 0.29 127 HTTPS_HTTP_MISMATCH 3234 1.21 1.89 0.87 128 BAYES_40 3218 3.95 1.88 4.99 129 TR_XM_SB_Phish 3194 1.96 1.87 2.00 130 XMLngstWrd_02 3189 1.14 1.87 0.77 131 RCVD_IN_IADB_DK 3172 3.40 1.86 4.17 132 RCVD_IN_IADB_SENDERID 3140 3.49 1.84 4.32 133 FONT_INVIS_LONG_LINE 3109 0.69 1.82 0.12 134 XMSubPhish11 3099 1.92 1.82 1.98 135 XMLngstWrd_03 3086 1.08 1.81 0.71 136 XMSexyCombo_01 3066 1.54 1.80 1.42 137 XMLngstWrd_04 3024 1.04 1.77 0.67 138 XMStockSpam_06 2989 1.40 1.75 1.22 139 T_XMDrugObfuBody_00 2897 1.09 1.70 0.78 140 XM_UB99 2891 0.57 1.69 0.00 141 HTML_TITLE_SUBJ_DIFF 2868 0.98 1.68 0.63 142 TR_XM_MSPIKECOMBO2 2820 0.61 1.65 0.08 143 TR_XM_SpammyWords3 2817 0.81 1.65 0.39 144 T_XMHurry_00 2805 1.05 1.64 0.75 145 URI_HEX 2803 1.33 1.64 1.17 146 XM_B_COVIDMETA 2777 0.78 1.63 0.35 147 UPPERCASE_75_100 2665 0.91 1.56 0.58 148 KHOP_HELO_FCRDNS 2557 1.72 1.50 1.82 149 ALL_TRUSTED 2516 11.02 1.47 15.83 150 TR_XM_BayesRelay 2498 0.49 1.46 0.00 151 RELAYCOUNTRY_RU 2495 0.51 1.46 0.04 152 XM_URI_RBL 2472 0.57 1.45 0.13 153 XMHTML_After_End 2463 1.05 1.44 0.85 154 XMBdyGiftCard01 2447 0.98 1.43 0.76 155 TR_XM_NoHeaderRelay 2444 0.57 1.43 0.14 156 BAYES_20 2412 2.97 1.41 3.76 157 TR_XM_InvalidRelay 2391 0.48 1.40 0.02 158 URIBL_BLACK 2358 0.49 1.38 0.05 159 TR_XM_PHPDW 2330 0.69 1.36 0.35 160 URI_TRY_3LD 2328 0.82 1.36 0.55 161 XM_UB999 2320 0.46 1.36 0.00 162 TR_Sbj_FN_Bdy 2313 0.56 1.35 0.16 163 TR_XM_PHPForged 2239 0.64 1.31 0.30 164 MPART_ALT_DIFF_COUNT 2215 0.87 1.30 0.66 165 TR_XM_FormFill2 2168 0.62 1.27 0.29 166 XM_H_PHPOS 2159 0.61 1.26 0.29 167 HELO_NODOT 2155 1.51 1.26 1.64 168 XMBrknScrpt_02 2154 0.95 1.26 0.79 169 XMGenDplmaNmb 2143 0.83 1.26 0.62 170 XMReplyNow 2139 0.58 1.25 0.24 171 TR_Symld_Words 2106 1.57 1.23 1.74 172 RCVD_IN_IADB_VOUCHED 2094 2.71 1.23 3.47 173 REMOVE_BEFORE_LINK 2057 0.55 1.20 0.22 174 RELAYCOUNTRY_AU 2042 0.65 1.20 0.37 175 TR_MetaPhish_Combo_01 2036 0.89 1.19 0.74 176 HTML_IMAGE_ONLY_24 1996 0.62 1.17 0.35 177 XM_H_Long_From02 1971 1.12 1.15 1.10 178 NO_DNS_FOR_FROM 1951 0.59 1.14 0.32 179 HTML_TAG_BALANCE_BODY 1879 0.86 1.10 0.75 180 XM_Combo_Sbj 1863 0.51 1.09 0.22 181 TR_XM_MaxSPIKE 1858 0.42 1.09 0.08 182 XMPhish30 1845 0.75 1.08 0.59 183 XM_ShortIntro_01 1805 0.78 1.06 0.64 184 TR_XM_Base64_M1 1795 0.87 1.05 0.78 185 TR_XM_COVIDMETA1 1791 0.46 1.05 0.17 186 TR_XM_MaxWHORU 1737 0.48 1.02 0.21 187 RELAYCOUNTRY_FR 1643 0.48 0.96 0.24 188 TM2_M_A_HREF_HREF 1609 0.56 0.94 0.37 189 NORDNS_LOW_CONTRAST 1580 0.33 0.93 0.02 190 TR_XM_COVIDMETA4 1573 0.43 0.92 0.19 191 HELO_NO_DOMAIN 1558 1.39 0.91 1.64 192 DKIM_ADSP_NXDOMAIN 1548 0.45 0.91 0.22 193 XM_B_SEO 1520 0.39 0.89 0.14 194 XM_PDF 1517 3.46 0.89 4.76 195 DKIM_ADSP_CUSTOM_MED 1510 0.93 0.88 0.95 196 DIET_1 1502 0.50 0.88 0.31 197 XM_Body_Dirty_Words_01 1495 0.41 0.88 0.17 198 HTML_FONT_FACE_BAD 1485 1.44 0.87 1.73 199 XMSubMetaI_00 1480 0.60 0.87 0.46 200 HTTP_EXCESSIVE_ESCAPES 1471 0.29 0.86 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 294713 89.81 95.39 87.00 2 RELAYCOUNTRY_US 274813 81.00 80.76 81.12 3 DKIM_SIGNED 250749 79.04 89.00 74.02 4 XM_DK_Pass 245734 77.29 86.73 72.54 5 DKIM_VALID 242188 76.26 85.73 71.49 6 XM_B_Unicode 237811 74.72 83.70 70.20 7 DCC_CHECK_NEGATIVE 228405 54.67 29.35 67.42 8 BAYES_50 194732 52.97 44.02 57.48 9 DKIM_VALID_AU 189184 58.57 63.99 55.85 10 XMListUnsubscribeExists 168375 56.29 69.35 49.70 11 XM_B_SpammyWords 150410 52.46 68.46 44.40 12 XM_B_Unicode3 138530 42.30 45.09 40.89 13 RCVD_IN_MSPIKE_H2 130358 41.64 47.92 38.48 14 DCC_CHECK 110173 45.29 70.61 32.52 15 T_TM2_M_HEADER_IN_MSG 101920 27.19 21.44 30.09 16 DKIM_VALID_EF 94479 30.00 34.17 27.89 17 HTML_FONT_LOW_CONTRAST 90422 29.06 33.77 26.69 18 FVGT_m_MULTI_ODD 83288 27.66 33.77 24.59 19 LOC_TINY_FONT_1 80867 28.02 36.25 23.87 20 XMSubLong 76243 22.70 23.08 22.51 21 T_KAM_HTML_FONT_INVALID 68337 23.55 30.26 20.17 22 MIME_HTML_ONLY 67338 24.32 33.13 19.88 23 RCVD_IN_MSPIKE_WL 62219 17.22 14.94 18.37 24 XM_B_SpammyWords2 61602 25.20 39.13 18.18 25 ALL_TRUSTED 53622 11.02 1.47 15.83 26 USER_IN_DEF_DKIM_WL 41612 8.94 2.30 12.28 27 XM_Multi_Part_URI 40829 14.35 18.90 12.05 28 RCVD_IN_MSPIKE_H3 40758 11.38 10.08 12.03 29 XM_Body_Dirty_Words 37384 14.74 22.08 11.04 30 BAYES_00 34978 7.08 0.66 10.33 31 BAYES_60 30366 8.49 7.54 8.96 32 LotsOfNums_01 29908 8.33 7.34 8.83 33 XM_B_Unsub 28766 10.75 15.22 8.49 34 TooManyTo_001 28706 7.48 5.52 8.47 35 XM_DKIMWhitelistDomains 27693 5.49 0.16 8.17 36 XM_Evil_Numbers_Gen 26753 8.25 8.96 7.90 37 UNPARSEABLE_RELAY 25963 9.34 12.67 7.66 38 LOTS_OF_MONEY 24243 9.19 13.22 7.16 39 IN_ZIMBRA_NJ_WHITELIST 23769 4.69 0.09 7.02 40 T_TooManySym_01 21940 5.21 2.70 6.48 41 TR_XM_BayesUnsub 21663 9.22 14.83 6.39 42 TR_XM_DK_Bayes 20465 4.17 0.46 6.04 43 XM_DK_Undo_02 20282 17.70 40.94 5.99 44 TR_XM_UnparsRelay 20174 8.10 12.35 5.96 45 TR_XM_DK_Bayes1 20070 4.09 0.45 5.92 46 MPART_ALT_DIFF 19875 6.16 6.73 5.87 47 HTML_IMAGE_RATIO_02 19762 6.17 6.85 5.83 48 HTML_IMAGE_RATIO_04 18886 5.38 4.99 5.58 49 MIME_QP_LONG_LINE 18794 4.91 3.63 5.55 50 RCVD_IN_IADB_LISTED 18586 4.43 2.33 5.49 51 BAYES_99 18193 13.88 30.77 5.37 52 XM_H_Long_From01 18036 5.64 6.27 5.32 53 TR_XM_DK_Bayes2 17656 3.60 0.40 5.21 54 RCVD_IN_MSPIKE_H4 17387 4.97 4.63 5.13 55 BAYES_40 16911 3.95 1.88 4.99 56 RCVD_IN_IADB_SPF 16474 3.89 1.95 4.86 57 XMStrtUSub 16185 4.74 4.68 4.78 58 BOTNET_IPINHOSTNAME 16175 7.79 13.78 4.77 59 XM_PDF 16112 3.46 0.89 4.76 60 TR_XM_SpammyWords4 15133 6.73 11.22 4.47 61 BAYES_999 14942 10.95 23.91 4.41 62 XM_B_SpammyWords3 14867 7.44 13.49 4.39 63 RCVD_IN_VALIDITY_SAFE 14840 3.79 2.62 4.38 64 RCVD_IN_IADB_SENDERID 14630 3.49 1.84 4.32 65 XM_SendGrid 14207 4.79 5.97 4.19 66 RCVD_IN_IADB_DK 14134 3.40 1.86 4.17 67 BAYES_80 14024 5.50 8.21 4.14 68 XMSubMetaSx_00 13889 4.61 5.64 4.10 69 TR_XM_DKIM_Undo 13618 13.89 33.47 4.02 70 XM_UncommonTLD01 13524 5.25 7.75 3.99 71 RELAYCOUNTRY_META 13419 9.38 20.12 3.96 72 MIME_HTML_ONLY_MULTI 13406 4.13 4.47 3.96 73 T_TooManySym_02 13296 2.88 0.82 3.92 74 HTML_IMAGE_RATIO_06 13257 3.91 3.91 3.91 75 RCVD_IN_VALIDITY_CERTIFIED 13195 3.30 2.13 3.90 76 BAYES_20 12734 2.97 1.41 3.76 77 T_REMOTE_IMAGE 12631 3.77 3.86 3.73 78 TR_XM_PhishingBody 12503 4.59 6.38 3.69 79 XM_H_Trusted_IP 12048 2.36 0.00 3.56 80 RCVD_IN_IADB_VOUCHED 11738 2.71 1.23 3.47 81 XM_B_Phish_Phrases 11122 4.12 5.77 3.28 82 XMSexyCombo_05 10821 5.21 9.22 3.19 83 XMNumbers 10804 3.50 4.10 3.19 84 MIME_HTML_MOSTLY 10400 3.10 3.16 3.07 85 URI_NOVOWEL 9889 2.72 2.33 2.92 86 MAILING_LIST_MULTI 9523 2.52 1.94 2.81 87 TR_XM_DK_SendGrid 9298 3.05 3.64 2.74 88 XM_SPF_SoftFail 9130 3.37 4.71 2.70 89 TM2_M_URI_OPT_OUT 8983 3.04 3.81 2.65 90 BAYES_95 8869 3.36 4.83 2.62 91 FSL_BULK_SIG 8790 5.56 11.45 2.59 92 FROM_EXCESS_BASE64 8637 2.34 1.92 2.55 93 DKIM_INVALID 8561 2.78 3.27 2.53 94 HTML_MIME_NO_HTML_TAG 8512 2.66 2.95 2.51 95 XM_B_SpammyTLD 8299 3.56 5.75 2.45 96 XM_B_Phish66 8118 2.73 3.40 2.40 97 BAYES_05 7946 1.79 0.68 2.35 98 RCVD_IN_IADB_OPTIN 7906 1.75 0.60 2.33 99 TooManyTo_002 7817 1.78 0.74 2.31 100 TVD_RCVD_IP 7794 1.64 0.33 2.30 101 HTML_IMAGE_RATIO_08 7725 2.59 3.20 2.28 102 ANY_BOUNCE_MESSAGE 7617 1.71 0.63 2.25 103 BOUNCE_MESSAGE 7616 1.71 0.63 2.25 104 INVALID_MSGID 6883 1.39 0.12 2.03 105 XM_CamelCaseFrm001 6796 2.35 3.03 2.01 106 TR_XM_SB_Phish 6776 1.96 1.87 2.00 107 XMSubPhish11 6693 1.92 1.82 1.98 108 MSGID_NOFQDN1 6414 1.26 0.02 1.89 109 TR_XM_SpammyRelay 6393 5.73 13.35 1.89 110 IN_HORDE_ADDRESS_BOOK 6302 1.27 0.09 1.86 111 KHOP_HELO_FCRDNS 6181 1.72 1.50 1.82 112 TO_MALFORMED 5946 1.17 0.01 1.76 113 TR_Symld_Words 5898 1.57 1.23 1.74 114 HTML_FONT_FACE_BAD 5872 1.44 0.87 1.73 115 SUBJ_ALL_CAPS 5837 2.02 2.61 1.72 116 XM_GoogleGroups 5809 1.86 2.14 1.71 117 TM2_M_VERY_LONG_WORD 5721 2.35 3.65 1.69 118 T_XMDrugObfuBody_14 5696 2.53 4.22 1.68 119 HELO_NODOT 5551 1.51 1.26 1.64 120 HELO_NO_DOMAIN 5548 1.39 0.91 1.64 121 T_XMDrugObfuBody_08 5517 2.54 4.35 1.63 122 XM_B_Unsub2 5187 1.80 2.35 1.53 123 XM_DK_Undo_01 5146 1.98 2.90 1.52 124 BOTNET 5060 4.44 10.27 1.49 125 TooManyTo_003 5025 1.20 0.63 1.48 126 XM_B_Investor 4934 2.90 5.75 1.46 127 XMGappySubj_01 4922 1.03 0.20 1.45 128 XMSexyCombo_01 4797 1.54 1.80 1.42 129 TR_DCC_Bayes_99 4577 8.26 21.97 1.35 130 TR_XM_SpammyWords5 4514 2.14 3.74 1.33 131 RELAYCOUNTRY_CA 4430 4.08 9.57 1.31 132 XMBody_95 4393 0.90 0.13 1.30 133 XMDiploma_00 4161 1.61 2.37 1.23 134 XMBSHREFv2 4157 0.89 0.23 1.23 135 XMStockSpam_06 4143 1.40 1.75 1.22 136 UNTRUSTED_Relay 4118 3.31 7.47 1.22 137 RCVD_IN_MSPIKE_H5 4074 0.88 0.23 1.20 138 URI_HEX 3959 1.33 1.64 1.17 139 XMCapTrack 3878 0.87 0.33 1.14 140 XMSubNoVowel 3875 1.00 0.72 1.14 141 XM_H_Long_From02 3737 1.12 1.15 1.10 142 TooManyTo_004 3659 0.90 0.54 1.08 143 SpammyFromTLD_01 3274 1.63 2.96 0.97 144 XM_OfRef6 3270 1.69 3.13 0.97 145 DKIM_ADSP_CUSTOM_MED 3229 0.93 0.88 0.95 146 XMLngstWrd_00 3218 1.29 1.97 0.95 147 RCVD_IN_RP_SAFE 3048 0.76 0.48 0.90 148 T_FILL_THIS_FORM_SHORT 3036 1.81 3.62 0.90 149 HTTPS_HTTP_MISMATCH 2943 1.21 1.89 0.87 150 XMLngstWrd_01 2941 1.22 1.93 0.87 151 TooManyTo_005 2937 0.74 0.49 0.87 152 T_TooManySym_03 2922 0.67 0.27 0.86 153 XMHTML_After_End 2893 1.05 1.44 0.85 154 TVD_SPACE_RATIO 2798 0.58 0.08 0.83 155 RCVD_IN_MSPIKE_BL 2759 2.23 5.03 0.81 156 TR_XM_MSPIKECOMBO 2757 2.20 4.94 0.81 157 RCVD_IN_RP_CERTIFIED 2732 0.66 0.37 0.81 158 RCVD_IN_MSPIKE_L3 2670 1.24 2.14 0.79 159 XMBrknScrpt_02 2662 0.95 1.26 0.79 160 T_XMDrugObfuBody_00 2648 1.09 1.70 0.78 161 TR_XM_Base64_M1 2632 0.87 1.05 0.78 162 XMLngstWrd_02 2614 1.14 1.87 0.77 163 XMBdyGiftCard01 2567 0.98 1.43 0.76 164 XM_UB50 2556 1.66 3.45 0.75 165 T_XMHurry_00 2533 1.05 1.64 0.75 166 HTML_TAG_BALANCE_BODY 2526 0.86 1.10 0.75 167 TR_XM_SpammyWords2 2510 4.30 11.36 0.74 168 TR_MetaPhish_Combo_01 2494 0.89 1.19 0.74 169 HTML_IMAGE_ONLY_20 2445 0.71 0.68 0.72 170 XMLngstWrd_03 2404 1.08 1.81 0.71 171 FROM_GOV_DKIM_AU 2389 0.51 0.12 0.71 172 T_OBFU_PDF_ATTACH 2314 0.50 0.14 0.68 173 XMLngstWrd_04 2255 1.04 1.77 0.67 174 MPART_ALT_DIFF_COUNT 2232 0.87 1.30 0.66 175 XM_ShortIntro_01 2163 0.78 1.06 0.64 176 XM_shorewaves_Whitelist 2154 0.42 0.00 0.64 177 XM_H_PHPMailer 2148 0.64 0.65 0.63 178 RELAYCOUNTRY_GB 2144 0.66 0.72 0.63 179 HTML_TITLE_SUBJ_DIFF 2140 0.98 1.68 0.63 180 NML_ADSP_CUSTOM_MED 2124 0.66 0.72 0.63 181 XMGenDplmaNmb 2088 0.83 1.26 0.62 182 XMNoVowels 2036 0.54 0.42 0.60 183 XMBody_17 2024 2.01 4.80 0.60 184 XMSexyCombo_04 2023 0.56 0.47 0.60 185 XM_ProductURIs 2018 0.59 0.59 0.60 186 XMPhish30 1994 0.75 1.08 0.59 187 DOS_RCVD_IP_TWICE_B 1983 1.05 1.99 0.59 188 UPPERCASE_75_100 1951 0.91 1.56 0.58 189 XM_B_COPY_HTML 1939 0.59 0.63 0.57 190 T_Symld_Words_02 1873 0.66 0.86 0.55 191 URI_TRY_3LD 1866 0.82 1.36 0.55 192 SpammyFromTLD_02 1809 1.22 2.59 0.53 193 FORGED_GMAIL_RCVD 1747 0.59 0.73 0.52 194 T_MANY_PILL_PRICE 1725 0.34 0.01 0.51 195 XMHTMLBadTable_001 1692 0.59 0.76 0.50 196 SHORT_HELO_AND_INLINE_IMAGE 1687 0.39 0.17 0.50 197 XM_D_tchamptons_WL 1664 0.33 0.02 0.49 198 FILL_THIS_FORM 1644 0.41 0.26 0.49 199 XMMoneyMeta_00 1619 0.56 0.72 0.48 200 RCVD_IN_PSBL 1594 1.26 2.82 0.47 ----------------------------------------------------------------------