Email: 287460 Autolearn: 0 AvgScore: 4.64 AvgScanTime: 1.39 sec Spam: 108420 Autolearn: 0 AvgScore: 14.65 AvgScanTime: 1.50 sec Ham: 179040 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.32 sec Time Spent Running SA: 110.85 hours Time Spent Processing Spam: 45.09 hours Time Spent Processing Ham: 65.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102374 87.65 94.42 83.55 2 DKIM_SIGNED 95184 81.41 87.79 77.54 3 XM_B_Unicode 94813 77.89 87.45 72.10 4 XM_DK_Pass 93906 80.20 86.61 76.32 5 DKIM_VALID 93162 79.67 85.93 75.87 6 RELAYCOUNTRY_US 86241 79.76 79.54 79.89 7 DCC_CHECK 78242 51.14 72.17 38.41 8 XM_B_SpammyWords 74964 54.49 69.14 45.61 9 XMListUnsubscribeExists 72365 59.69 66.75 55.42 10 DKIM_VALID_AU 71882 64.00 66.30 62.61 11 RCVD_IN_MSPIKE_H2 52929 43.01 48.82 39.50 12 XM_B_Unicode3 52123 46.33 48.08 45.27 13 XM_DK_Undo_02 51187 23.13 47.21 8.55 14 XM_B_SpammyWords2 43467 27.80 40.09 20.36 15 TR_XM_DKIM_Undo 43095 18.34 39.75 5.37 16 BAYES_99 41898 19.11 38.64 7.27 17 LOC_TINY_FONT_1 39073 30.87 36.04 27.74 18 BAYES_50 38976 48.30 35.95 55.78 19 MIME_HTML_ONLY 37190 26.01 34.30 20.99 20 HTML_FONT_LOW_CONTRAST 36628 31.74 33.78 30.50 21 DKIM_VALID_EF 36461 31.11 33.63 29.58 22 BAYES_999 33813 15.50 31.19 5.99 23 FVGT_m_MULTI_ODD 33516 27.99 30.91 26.23 24 T_KAM_HTML_FONT_INVALID 30620 23.13 28.24 20.04 25 DCC_CHECK_NEGATIVE 30167 48.83 27.82 61.55 26 TR_DCC_Bayes_99 29806 11.69 27.49 2.12 27 XM_Body_Dirty_Words 25783 16.49 23.78 12.08 28 RELAYCOUNTRY_META 24460 10.68 22.56 3.49 29 XMSubLong 22713 21.54 20.95 21.90 30 T_TM2_M_HEADER_IN_MSG 21070 21.38 19.43 22.56 31 XM_Multi_Part_URI 19420 16.15 17.91 15.08 32 XM_B_Unsub 19365 12.47 17.86 9.20 33 TR_XM_BayesUnsub 18954 11.18 17.48 7.36 34 TR_XM_SpammyWords2 16728 6.82 15.43 1.61 35 RCVD_IN_MSPIKE_WL 16236 17.91 14.98 19.69 36 TR_XM_SpammyRelay 16233 6.81 14.97 1.87 37 LOTS_OF_MONEY 16172 10.34 14.92 7.56 38 UNPARSEABLE_RELAY 15286 10.37 14.10 8.11 39 TR_XM_UnparsRelay 14858 9.09 13.70 6.29 40 RCVD_IN_BL_SPAMCOP_NET 13777 5.14 12.71 0.56 41 BOTNET_IPINHOSTNAME 13721 9.28 12.66 7.24 42 XM_B_SpammyWords3 13467 7.70 12.42 4.83 43 TR_XM_SpammyWords4 13071 7.32 12.06 4.46 44 BOTNET 12927 5.59 11.92 1.75 45 FSL_BULK_SIG 12198 6.23 11.25 3.19 46 RELAYCOUNTRY_CA 12063 5.22 11.13 1.65 47 XMSexyCombo_05 11832 6.36 10.91 3.61 48 RCVD_IN_MSPIKE_H3 9589 10.85 8.84 12.06 49 XM_H_Long_From01 9326 6.24 8.60 4.81 50 BAYES_80 9271 6.25 8.55 4.86 51 XM_Evil_Numbers_Gen 8452 8.51 7.80 8.94 52 TR_XM_SPAMCOP 8440 3.16 7.78 0.35 53 HTML_IMAGE_RATIO_02 8348 6.84 7.70 6.33 54 XM_UncommonTLD01 8312 6.00 7.67 4.99 55 UNTRUSTED_Relay 8064 3.56 7.44 1.21 56 BAYES_60 7951 9.91 7.33 11.48 57 XMBody_17 7870 3.28 7.26 0.87 58 XMSubMetaSx_00 6972 5.02 6.43 4.16 59 T_REMOTE_IMAGE 6387 4.76 5.89 4.08 60 RCVD_IN_MSPIKE_H4 6350 6.06 5.86 6.18 61 LotsOfNums_01 6138 7.63 5.66 8.81 62 MPART_ALT_DIFF 5956 5.60 5.49 5.66 63 T_XMDrugObfuBody_08 5900 2.91 5.44 1.38 64 TR_XM_PhishingBody 5766 3.58 5.32 2.53 65 BAYES_95 5744 4.04 5.30 3.28 66 XM_SendGrid 5726 4.78 5.28 4.48 67 RCVD_IN_VALIDITY_RPBL 5663 1.98 5.22 0.01 68 TooManyTo_001 5656 6.47 5.22 7.23 69 XM_CamelCaseFrm001 5614 3.35 5.18 2.24 70 RCVD_IN_MSPIKE_BL 5458 2.20 5.03 0.49 71 TR_XM_MSPIKECOMBO 5263 2.14 4.85 0.49 72 HTML_IMAGE_RATIO_04 5141 4.89 4.74 4.97 73 XM_B_SpammyTLD 5116 3.37 4.72 2.55 74 TR_XM_SpammyWords5 5060 2.84 4.67 1.73 75 XM_SPF_SoftFail 4805 2.82 4.43 1.85 76 XMNumbers 4800 4.32 4.43 4.25 77 T_FILL_THIS_FORM_SHORT 4793 2.10 4.42 0.69 78 XM_B_Phish_Phrases 4711 3.55 4.35 3.07 79 T_XMDrugObfuBody_14 4660 2.84 4.30 1.95 80 XMStrtUSub 4552 5.27 4.20 5.92 81 RCVD_IN_VALIDITY_SAFE 4213 5.63 3.89 6.69 82 XM_B_Investor 4135 2.25 3.81 1.30 83 XM_DIRTYINTL 3985 1.58 3.68 0.31 84 XM_OfRef6 3949 1.99 3.64 1.00 85 PDS_OTHER_BAD_TLD 3867 1.66 3.57 0.50 86 TR_XM_DK_SendGrid 3827 3.23 3.53 3.05 87 MIME_HTML_MOSTLY 3754 3.01 3.46 2.73 88 BOTNET_NORDNS 3628 1.27 3.35 0.02 89 HTML_IMAGE_RATIO_08 3546 2.67 3.27 2.31 90 T_TooManySym_01 3506 6.39 3.23 8.31 91 MIME_HTML_ONLY_MULTI 3492 3.43 3.22 3.56 92 XM_UB50 3380 1.65 3.12 0.76 93 HTML_IMAGE_ONLY_24 3317 1.31 3.06 0.24 94 RCVD_IN_VALIDITY_CERTIFIED 3281 4.76 3.03 5.80 95 XM_DK_Undo_01 3236 1.90 2.98 1.24 96 TM2_M_URI_OPT_OUT 3235 2.65 2.98 2.44 97 DOS_RCVD_IP_TWICE_B 3187 1.70 2.94 0.94 98 USER_IN_DEF_DKIM_WL 3184 11.94 2.94 17.40 99 HTTP_EXCESSIVE_ESCAPES 3143 1.10 2.90 0.01 100 XM_H_Undi_Recip 3122 1.19 2.88 0.16 101 FROM_EXCESS_BASE64 3057 3.36 2.82 3.69 102 TR_XM_FormFill 2982 1.05 2.75 0.02 103 SpammyFromTLD_01 2953 1.38 2.72 0.56 104 XMDiploma_00 2953 1.88 2.72 1.37 105 XM_B_SpammyWords4 2921 1.43 2.69 0.66 106 XM_B_Unsub2 2916 1.78 2.69 1.23 107 XM_B_Phish66 2898 1.64 2.67 1.02 108 RCVD_IN_PSBL 2875 1.38 2.65 0.61 109 HTML_IMAGE_RATIO_06 2847 3.08 2.63 3.36 110 SUBJ_ALL_CAPS 2772 1.94 2.56 1.56 111 TM2_M_VERY_LONG_WORD 2755 1.87 2.54 1.47 112 MPART_ALT_DIFF_COUNT 2554 1.39 2.36 0.80 113 HK_RANDOM_REPLYTO 2553 0.96 2.35 0.11 114 RCVD_IN_MSPIKE_L5 2541 0.89 2.34 0.02 115 XMSexyCombo_01 2501 1.20 2.31 0.53 116 RCVD_IN_MSPIKE_L3 2477 1.15 2.28 0.47 117 TR_LOTS_OF_MONEY3 2386 0.99 2.20 0.25 118 MIME_QP_LONG_LINE 2340 3.30 2.16 4.00 119 FONT_INVIS_LONG_LINE 2325 0.94 2.14 0.21 120 T_XMHurry_00 2305 1.18 2.13 0.60 121 XMBdyGiftCard01 2155 1.62 1.99 1.40 122 SpammyFromTLD_02 2152 0.86 1.98 0.18 123 URIBL_DBL_SPAM 2123 0.74 1.96 0.01 124 URI_NOVOWEL 2111 2.35 1.95 2.59 125 TR_XM_MSPIKECOMBO2 2108 0.85 1.94 0.18 126 TR_XM_SpammyWords3 2073 0.83 1.91 0.18 127 DKIM_INVALID 2022 1.74 1.86 1.66 128 HTTPS_HTTP_MISMATCH 2005 1.22 1.85 0.85 129 TR_XM_SB_Phish 2003 1.75 1.85 1.68 130 XMSubPhish11 1955 1.72 1.80 1.67 131 TR_XM_PHPDW 1949 0.93 1.80 0.40 132 MIME_BASE64_TEXT 1907 0.75 1.76 0.14 133 TR_XM_PHPForged 1896 0.86 1.75 0.32 134 TR_XM_NoHeaderRelay 1827 0.69 1.69 0.09 135 KHOP_HELO_FCRDNS 1826 1.16 1.68 0.85 136 TR_XM_FormFill2 1823 0.83 1.68 0.31 137 XM_H_PHPOS 1813 0.82 1.67 0.30 138 XM_URI_RBL 1793 0.70 1.65 0.12 139 TR_Mismatch_TLD_01 1774 0.79 1.64 0.28 140 TR_Symld_Words 1740 2.02 1.60 2.27 141 XM_UB99 1735 0.61 1.60 0.00 142 BAYES_40 1689 3.14 1.56 4.10 143 TR_XM_Undi_Recip5 1669 0.58 1.54 0.01 144 TR_XM_BayesRelay 1647 0.57 1.52 0.00 145 ALL_TRUSTED 1575 11.07 1.45 16.90 146 MAILING_LIST_MULTI 1545 1.89 1.43 2.18 147 T_XMDrugObfuBody_00 1533 0.92 1.41 0.62 148 T_TooManySym_02 1497 3.78 1.38 5.24 149 NO_DNS_FOR_FROM 1492 0.73 1.38 0.34 150 XMStockSpam_06 1468 0.99 1.35 0.77 151 TR_XM_InvalidRelay 1457 0.51 1.34 0.01 152 XM_H_Long_From02 1454 1.13 1.34 1.00 153 UNDISC_MONEY 1454 0.51 1.34 0.01 154 RELAYCOUNTRY_CN 1440 0.52 1.33 0.03 155 TM2_M_A_HREF_HREF 1424 0.86 1.31 0.59 156 XM_UB999 1411 0.49 1.30 0.00 157 DKIM_ADSP_NXDOMAIN 1387 0.70 1.28 0.35 158 TR_XM_MaxSPIKE 1375 0.59 1.27 0.18 159 HTML_MIME_NO_HTML_TAG 1375 1.57 1.27 1.75 160 URI_HEX 1371 1.10 1.26 1.00 161 URIBL_DBL_ABUSE_SPAM 1359 0.48 1.25 0.01 162 RCVD_IN_IADB_LISTED 1345 3.28 1.24 4.51 163 TR_XM_MaxWHORU 1335 0.63 1.23 0.27 164 TVD_RCVD_SPACE_BRACKET 1322 0.46 1.22 0.00 165 BAYES_20 1322 2.20 1.22 2.80 166 FILL_THIS_FORM 1293 0.67 1.19 0.35 167 TR_XM_Base64_M1 1288 1.25 1.19 1.29 168 T_XMDrugObfuBody_10 1278 0.54 1.18 0.16 169 TR_XM_Undi_RecipCombo2 1269 0.44 1.17 0.00 170 XMGenDplmaNmb 1266 0.81 1.17 0.59 171 XMReplyNow 1264 0.54 1.17 0.16 172 HTML_TAG_BALANCE_BODY 1243 1.07 1.15 1.02 173 XM_Body_Dirty_Words_01 1211 0.60 1.12 0.28 174 FILL_THIS_FORM_LONG 1211 0.52 1.12 0.15 175 MONEY_FORM 1195 0.42 1.10 0.00 176 XMHTML_After_End 1167 0.77 1.08 0.58 177 RCVD_IN_RP_RNBL 1165 0.41 1.07 0.00 178 RCVD_IN_IADB_SPF 1147 2.93 1.06 4.06 179 HTML_OBFUSCATE_05_10 1143 0.55 1.05 0.25 180 TR_XM_Undi_Recip9 1137 0.40 1.05 0.00 181 XM_GoogleGroups 1133 1.24 1.05 1.35 182 HTML_FONT_FACE_BAD 1117 1.02 1.03 1.01 183 XMBrknScrpt_02 1104 0.68 1.02 0.48 184 RCVD_IN_IADB_DK 1095 2.59 1.01 3.55 185 RELAYCOUNTRY_AU 1091 0.50 1.01 0.19 186 RCVD_IN_IADB_SENDERID 1090 2.67 1.01 3.68 187 XMPhish30 1082 0.93 1.00 0.88 188 NORDNS_LOW_CONTRAST 1079 0.38 1.00 0.01 189 XM_ShortIntro_01 1077 0.60 0.99 0.36 190 XM_H_PHPMailer 1074 1.07 0.99 1.12 191 XMHTMLBadTable_001 1069 0.76 0.99 0.62 192 DIET_1 1066 0.58 0.98 0.33 193 TR_XM_Undi_Recip11 1064 0.39 0.98 0.03 194 SHOPIFY_IMG_NOT_RCVD_SFY 1056 0.53 0.97 0.26 195 RELAYCOUNTRY_RU 1046 0.38 0.96 0.02 196 XM_OfRef7 999 0.40 0.92 0.08 197 XMLngstWrd_00 998 0.97 0.92 1.00 198 XM_UB60 990 0.38 0.91 0.06 199 HTML_FONT_TINY_NORDNS 979 0.36 0.90 0.03 200 TR_Sbj_FN_Bdy 970 0.40 0.89 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149589 87.65 94.42 83.55 2 RELAYCOUNTRY_US 143030 79.76 79.54 79.89 3 DKIM_SIGNED 138827 81.41 87.79 77.54 4 XM_DK_Pass 136641 80.20 86.61 76.32 5 DKIM_VALID 135846 79.67 85.93 75.87 6 XM_B_Unicode 129093 77.89 87.45 72.10 7 DKIM_VALID_AU 112105 64.00 66.30 62.61 8 DCC_CHECK_NEGATIVE 110193 48.83 27.82 61.55 9 BAYES_50 99861 48.30 35.95 55.78 10 XMListUnsubscribeExists 99217 59.69 66.75 55.42 11 XM_B_SpammyWords 81662 54.49 69.14 45.61 12 XM_B_Unicode3 81052 46.33 48.08 45.27 13 RCVD_IN_MSPIKE_H2 70720 43.01 48.82 39.50 14 DCC_CHECK 68777 51.14 72.17 38.41 15 HTML_FONT_LOW_CONTRAST 54600 31.74 33.78 30.50 16 DKIM_VALID_EF 52960 31.11 33.63 29.58 17 LOC_TINY_FONT_1 49672 30.87 36.04 27.74 18 FVGT_m_MULTI_ODD 46954 27.99 30.91 26.23 19 T_TM2_M_HEADER_IN_MSG 40395 21.38 19.43 22.56 20 XMSubLong 39211 21.54 20.95 21.90 21 MIME_HTML_ONLY 37580 26.01 34.30 20.99 22 XM_B_SpammyWords2 36455 27.80 40.09 20.36 23 T_KAM_HTML_FONT_INVALID 35872 23.13 28.24 20.04 24 RCVD_IN_MSPIKE_WL 35261 17.91 14.98 19.69 25 USER_IN_DEF_DKIM_WL 31147 11.94 2.94 17.40 26 ALL_TRUSTED 30255 11.07 1.45 16.90 27 XM_Multi_Part_URI 27004 16.15 17.91 15.08 28 XM_DKIMWhitelistDomains 22198 7.75 0.08 12.40 29 XM_Body_Dirty_Words 21624 16.49 23.78 12.08 30 RCVD_IN_MSPIKE_H3 21589 10.85 8.84 12.06 31 BAYES_60 20549 9.91 7.33 11.48 32 XM_B_Unsub 16478 12.47 17.86 9.20 33 XM_Evil_Numbers_Gen 16006 8.51 7.80 8.94 34 LotsOfNums_01 15782 7.63 5.66 8.81 35 BAYES_00 15461 5.68 0.80 8.64 36 XM_DK_Undo_02 15305 23.13 47.21 8.55 37 T_TooManySym_01 14871 6.39 3.23 8.31 38 UNPARSEABLE_RELAY 14513 10.37 14.10 8.11 39 LOTS_OF_MONEY 13541 10.34 14.92 7.56 40 TR_XM_BayesUnsub 13174 11.18 17.48 7.36 41 BAYES_99 13025 19.11 38.64 7.27 42 BOTNET_IPINHOSTNAME 12962 9.28 12.66 7.24 43 TooManyTo_001 12942 6.47 5.22 7.23 44 RCVD_IN_VALIDITY_SAFE 11983 5.63 3.89 6.69 45 TR_XM_DK_Bayes 11450 4.21 0.61 6.40 46 TR_XM_DK_Bayes1 11346 4.18 0.61 6.34 47 HTML_IMAGE_RATIO_02 11328 6.84 7.70 6.33 48 TR_XM_UnparsRelay 11264 9.09 13.70 6.29 49 RCVD_IN_MSPIKE_H4 11070 6.06 5.86 6.18 50 BAYES_999 10730 15.50 31.19 5.99 51 XMStrtUSub 10599 5.27 4.20 5.92 52 IN_ZIMBRA_NJ_WHITELIST 10583 3.71 0.06 5.91 53 RCVD_IN_VALIDITY_CERTIFIED 10391 4.76 3.03 5.80 54 MPART_ALT_DIFF 10142 5.60 5.49 5.66 55 TR_XM_DK_Bayes2 10137 3.70 0.47 5.66 56 TR_XM_DKIM_Undo 9622 18.34 39.75 5.37 57 T_TooManySym_02 9383 3.78 1.38 5.24 58 XM_UncommonTLD01 8935 6.00 7.67 4.99 59 HTML_IMAGE_RATIO_04 8902 4.89 4.74 4.97 60 BAYES_80 8706 6.25 8.55 4.86 61 XM_B_SpammyWords3 8656 7.70 12.42 4.83 62 XM_H_Long_From01 8607 6.24 8.60 4.81 63 RCVD_IN_IADB_LISTED 8083 3.28 1.24 4.51 64 XM_SendGrid 8014 4.78 5.28 4.48 65 TR_XM_SpammyWords4 7980 7.32 12.06 4.46 66 XMNumbers 7612 4.32 4.43 4.25 67 XMSubMetaSx_00 7453 5.02 6.43 4.16 68 BAYES_40 7334 3.14 1.56 4.10 69 T_REMOTE_IMAGE 7300 4.76 5.89 4.08 70 RCVD_IN_IADB_SPF 7274 2.93 1.06 4.06 71 MIME_QP_LONG_LINE 7154 3.30 2.16 4.00 72 INVALID_MSGID 6961 2.49 0.18 3.89 73 FROM_EXCESS_BASE64 6602 3.36 2.82 3.69 74 MSGID_NOFQDN1 6591 2.31 0.03 3.68 75 RCVD_IN_IADB_SENDERID 6582 2.67 1.01 3.68 76 XMSexyCombo_05 6455 6.36 10.91 3.61 77 MIME_HTML_ONLY_MULTI 6368 3.43 3.22 3.56 78 RCVD_IN_IADB_DK 6355 2.59 1.01 3.55 79 RELAYCOUNTRY_META 6243 10.68 22.56 3.49 80 HTML_IMAGE_RATIO_06 6014 3.08 2.63 3.36 81 TO_MALFORMED 5914 2.07 0.04 3.30 82 BAYES_95 5873 4.04 5.30 3.28 83 FSL_BULK_SIG 5709 6.23 11.25 3.19 84 TVD_RCVD_IP 5622 2.15 0.51 3.14 85 XM_B_Phish_Phrases 5492 3.55 4.35 3.07 86 TR_XM_DK_SendGrid 5461 3.23 3.53 3.05 87 RCVD_IN_IADB_VOUCHED 5179 2.04 0.64 2.89 88 BAYES_20 5006 2.20 1.22 2.80 89 MIME_HTML_MOSTLY 4886 3.01 3.46 2.73 90 URI_NOVOWEL 4644 2.35 1.95 2.59 91 XM_B_SpammyTLD 4565 3.37 4.72 2.55 92 TR_XM_PhishingBody 4527 3.58 5.32 2.53 93 XM_PDF 4501 1.71 0.39 2.51 94 TM2_M_URI_OPT_OUT 4371 2.65 2.98 2.44 95 XM_H_Trusted_IP 4135 1.44 0.00 2.31 96 HTML_IMAGE_RATIO_08 4133 2.67 3.27 2.31 97 TR_Symld_Words 4069 2.02 1.60 2.27 98 XM_CamelCaseFrm001 4011 3.35 5.18 2.24 99 XMBSHREFv2 3972 1.43 0.12 2.22 100 MAILING_LIST_MULTI 3895 1.89 1.43 2.18 101 IN_HORDE_ADDRESS_BOOK 3831 1.37 0.09 2.14 102 TR_DCC_Bayes_99 3801 11.69 27.49 2.12 103 T_XMDrugObfuBody_14 3495 2.84 4.30 1.95 104 RCVD_IN_IADB_OPTIN 3465 1.34 0.36 1.94 105 TR_XM_SpammyRelay 3350 6.81 14.97 1.87 106 BOUNCE_MESSAGE 3344 1.33 0.43 1.87 107 ANY_BOUNCE_MESSAGE 3344 1.33 0.43 1.87 108 XM_SPF_SoftFail 3308 2.82 4.43 1.85 109 BAYES_05 3225 1.36 0.64 1.80 110 HTML_MIME_NO_HTML_TAG 3140 1.57 1.27 1.75 111 BOTNET 3129 5.59 11.92 1.75 112 TR_XM_SpammyWords5 3096 2.84 4.67 1.73 113 TR_XM_SB_Phish 3014 1.75 1.85 1.68 114 XMSubPhish11 2996 1.72 1.80 1.67 115 DKIM_INVALID 2981 1.74 1.86 1.66 116 RELAYCOUNTRY_CA 2950 5.22 11.13 1.65 117 XMGappySubj_01 2913 1.04 0.08 1.63 118 TR_XM_SpammyWords2 2884 6.82 15.43 1.61 119 XMBody_95 2808 1.01 0.08 1.57 120 SUBJ_ALL_CAPS 2791 1.94 2.56 1.56 121 TM2_M_VERY_LONG_WORD 2625 1.87 2.54 1.47 122 RCVD_IN_MSPIKE_H5 2602 1.01 0.27 1.45 123 XMBdyGiftCard01 2514 1.62 1.99 1.40 124 TooManyTo_002 2464 1.11 0.67 1.38 125 T_XMDrugObfuBody_08 2464 2.91 5.44 1.38 126 XMDiploma_00 2451 1.88 2.72 1.37 127 XM_GoogleGroups 2421 1.24 1.05 1.35 128 XM_B_Investor 2328 2.25 3.81 1.30 129 TR_XM_Base64_M1 2304 1.25 1.19 1.29 130 TVD_SPACE_RATIO 2288 0.82 0.08 1.28 131 RCVD_IN_RP_SAFE 2287 1.11 0.85 1.28 132 XM_DK_Undo_01 2224 1.90 2.98 1.24 133 XM_B_Unsub2 2201 1.78 2.69 1.23 134 UNTRUSTED_Relay 2163 3.56 7.44 1.21 135 TR_MetaPhish_Combo_01 2157 1.07 0.85 1.20 136 XM_D_tchamptons_WL 2133 0.75 0.03 1.19 137 XM_H_PHPMailer 2000 1.07 0.99 1.12 138 RCVD_IN_RP_CERTIFIED 1978 0.94 0.67 1.10 139 T_TooManySym_03 1963 0.86 0.48 1.10 140 XM_B_COPY_HTML 1896 1.00 0.89 1.06 141 HTML_TAG_BALANCE_BODY 1828 1.07 1.15 1.02 142 XM_B_Phish66 1827 1.64 2.67 1.02 143 HTML_FONT_FACE_BAD 1804 1.02 1.03 1.01 144 URI_HEX 1793 1.10 1.26 1.00 145 XMLngstWrd_00 1790 0.97 0.92 1.00 146 XM_H_Long_From02 1789 1.13 1.34 1.00 147 XM_OfRef6 1785 1.99 3.64 1.00 148 DOS_RCVD_IP_TWICE_B 1687 1.70 2.94 0.94 149 TooManyTo_003 1601 0.79 0.62 0.89 150 XMLngstWrd_01 1599 0.89 0.88 0.89 151 XMPhish30 1584 0.93 1.00 0.88 152 XMSubNoVowel 1584 0.82 0.71 0.88 153 XMBody_17 1551 3.28 7.26 0.87 154 KHOP_HELO_FCRDNS 1522 1.16 1.68 0.85 155 HTTPS_HTTP_MISMATCH 1515 1.22 1.85 0.85 156 MPART_ALT_DIFF_COUNT 1431 1.39 2.36 0.80 157 DKIM_ADSP_CUSTOM_MED 1418 0.77 0.72 0.79 158 XMStockSpam_06 1374 0.99 1.35 0.77 159 XM_UB50 1356 1.65 3.12 0.76 160 XMLngstWrd_02 1327 0.78 0.85 0.74 161 USER_IN_WELCOMELIST 1279 0.44 0.00 0.71 162 USER_IN_WHITELIST 1279 0.44 0.00 0.71 163 T_FILL_THIS_FORM_SHORT 1235 2.10 4.42 0.69 164 XM_B_COVIDMETA 1201 0.70 0.74 0.67 165 TooManyTo_004 1196 0.59 0.47 0.67 166 XM_B_SpammyWords4 1189 1.43 2.69 0.66 167 HTML_IMAGE_ONLY_20 1185 0.53 0.30 0.66 168 XMSubMetaSxObfu_02 1179 0.53 0.33 0.66 169 XMSubMetaI_00 1141 0.70 0.80 0.64 170 XMHTMLBadTable_001 1115 0.76 0.99 0.62 171 T_XMDrugObfuBody_00 1110 0.92 1.41 0.62 172 RCVD_IN_PSBL 1086 1.38 2.65 0.61 173 T_XMHurry_00 1074 1.18 2.13 0.60 174 TM2_M_A_HREF_HREF 1062 0.86 1.31 0.59 175 XMGenDplmaNmb 1060 0.81 1.17 0.59 176 URI_TRY_3LD 1059 0.58 0.57 0.59 177 XMHTML_After_End 1043 0.77 1.08 0.58 178 XM_S_SubURI 1039 0.36 0.01 0.58 179 XMLngstWrd_03 1037 0.65 0.76 0.58 180 TooManyTo_005 1025 0.51 0.42 0.57 181 SpammyFromTLD_01 1008 1.38 2.72 0.56 182 XM_ProductURIs 999 0.58 0.62 0.56 183 RCVD_IN_BL_SPAMCOP_NET 998 5.14 12.71 0.56 184 XMSlimDrugH 990 0.59 0.65 0.55 185 BODY_ENHANCEMENT2 983 0.35 0.01 0.55 186 XM_B_REG_HTML 977 0.60 0.70 0.55 187 XMSexyCombo_01 947 1.20 2.31 0.53 188 DATE_IN_PAST_03_06 940 0.51 0.48 0.53 189 PLING_QUERY 928 0.63 0.81 0.52 190 XMLngstWrd_04 914 0.60 0.74 0.51 191 XMNoVowels 914 0.57 0.68 0.51 192 PDS_OTHER_BAD_TLD 898 1.66 3.57 0.50 193 RCVD_IN_MSPIKE_BL 879 2.20 5.03 0.49 194 TR_XM_MSPIKECOMBO 879 2.14 4.85 0.49 195 XMBrknScrpt_02 857 0.68 1.02 0.48 196 TR_XM_Base64_L1 851 0.49 0.52 0.48 197 FORGED_GMAIL_RCVD 843 0.48 0.49 0.47 198 RCVD_IN_MSPIKE_L3 840 1.15 2.28 0.47 199 NML_ADSP_CUSTOM_MED 838 0.53 0.62 0.47 200 TR_Caps_n_Bayes_99 826 0.54 0.66 0.46 ----------------------------------------------------------------------