Email: 464469 Autolearn: 0 AvgScore: 5.00 AvgScanTime: 1.44 sec Spam: 191389 Autolearn: 0 AvgScore: 13.25 AvgScanTime: 1.39 sec Ham: 273080 Autolearn: 0 AvgScore: -0.78 AvgScanTime: 1.47 sec Time Spent Running SA: 185.72 hours Time Spent Processing Spam: 74.07 hours Time Spent Processing Ham: 111.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 181412 89.18 94.79 85.24 2 DKIM_SIGNED 161922 81.29 84.60 78.96 3 XM_DK_Pass 158502 80.05 82.82 78.11 4 DKIM_VALID 156663 78.80 81.86 76.66 5 DCC_CHECK 150172 58.35 78.46 44.25 6 RELAYCOUNTRY_US 143312 78.64 74.88 81.28 7 DKIM_VALID_AU 132665 64.56 69.32 61.23 8 XM_B_Unicode 109135 64.62 57.02 69.95 9 XM_B_SpammyWords 107928 52.72 56.39 50.15 10 XMListUnsubscribeExists 107004 55.25 55.91 54.80 11 MIME_HTML_ONLY 86474 31.79 45.18 22.40 12 RCVD_IN_MSPIKE_H2 81480 34.09 42.57 28.14 13 XM_DK_Undo_02 74833 21.44 39.10 9.07 14 BAYES_99 60923 16.83 31.83 6.32 15 XM_B_SpammyWords2 60034 25.96 31.37 22.16 16 FSL_BULK_SIG 57659 15.22 30.13 4.77 17 TR_XM_DKIM_Undo 57100 16.13 29.83 6.52 18 BAYES_50 54208 42.47 28.32 52.39 19 XM_B_Unicode3 53152 36.50 27.77 42.62 20 HTML_FONT_LOW_CONTRAST 51647 29.50 26.99 31.27 21 HTML_MIME_NO_HTML_TAG 48964 11.41 25.58 1.47 22 LOC_TINY_FONT_1 48796 26.84 25.50 27.77 23 BAYES_999 47396 13.10 24.76 4.92 24 RELAYCOUNTRY_META 46220 13.48 24.15 6.00 25 TR_DCC_Bayes_99 45448 11.61 23.75 3.10 26 TR_Sbj_FN_Bdy 43159 9.40 22.55 0.19 27 XMSubEmpty 42294 10.07 22.10 1.64 28 MISSING_SUBJECT 42060 9.11 21.98 0.09 29 XMNoSubject 42060 9.11 21.98 0.09 30 DKIM_VALID_EF 40015 26.97 20.91 31.22 31 DCC_CHECK_NEGATIVE 39208 40.54 20.49 54.59 32 FVGT_m_MULTI_ODD 35970 21.23 18.79 22.94 33 UNTRUSTED_Relay 34673 9.84 18.12 4.04 34 XM_Multi_Part_URI 32559 15.43 17.01 14.32 35 T_KAM_HTML_FONT_INVALID 31376 17.26 16.39 17.87 36 T_TM2_M_HEADER_IN_MSG 31324 19.63 16.37 21.92 37 BAYES_80 30428 9.68 15.90 5.32 38 XMSubLong 29831 18.33 15.59 20.26 39 BOTNET 26088 6.65 13.63 1.75 40 TR_XM_SpammyWords2 25814 6.20 13.49 1.10 41 XM_Body_Dirty_Words 25172 13.74 13.15 14.15 42 LOTS_OF_MONEY 24655 10.35 12.88 8.58 43 RCVD_IN_MSPIKE_WL 22411 21.98 11.71 29.17 44 BOTNET_IPINHOSTNAME 22294 8.32 11.65 5.98 45 XM_B_SpammyWords3 19088 7.65 9.97 6.03 46 BAYES_60 18868 9.18 9.86 8.70 47 LotsOfNums_01 18500 8.72 9.67 8.06 48 XM_B_Unsub 18201 10.29 9.51 10.83 49 XM_UncommonTLD01 15299 5.48 7.99 3.71 50 RCVD_IN_MSPIKE_BL 15175 4.74 7.93 2.51 51 RCVD_IN_BL_SPAMCOP_NET 14865 3.96 7.77 1.29 52 XMSexyCombo_05 14827 6.14 7.75 5.02 53 HTML_IMAGE_RATIO_02 14692 7.98 7.68 8.19 54 BAYES_95 13216 5.09 6.91 3.82 55 XM_UB50 12632 3.53 6.60 1.37 56 XMBrknScrpt_02 12286 3.45 6.42 1.37 57 MPART_ALT_DIFF 12249 5.53 6.40 4.92 58 XM_Evil_Numbers_Gen 12142 7.55 6.34 8.39 59 RCVD_IN_MSPIKE_H3 12024 11.72 6.28 15.54 60 MIME_HTML_MOSTLY 11197 3.76 5.85 2.29 61 RCVD_IN_MSPIKE_L3 11168 2.89 5.84 0.83 62 XMBody_17 11124 2.88 5.81 0.83 63 TR_LOTS_OF_MONEY3 10762 2.89 5.62 0.97 64 XMSubMetaSx_00 10693 4.80 5.59 4.24 65 RELAYCOUNTRY_FR 10668 2.47 5.57 0.30 66 T_REMOTE_IMAGE 10601 4.19 5.54 3.24 67 TR_XM_SpammyWords3 10530 2.72 5.50 0.76 68 RELAYCOUNTRY_CA 10454 3.21 5.46 1.63 69 XM_B_Phish_Phrases 10053 7.16 5.25 8.49 70 RCVD_IN_MSPIKE_H4 9357 8.24 4.89 10.59 71 TooManyTo_001 8974 5.52 4.69 6.11 72 UNPARSEABLE_RELAY 8723 7.16 4.56 8.98 73 KHOP_HELO_FCRDNS 8307 2.39 4.34 1.02 74 TR_XM_PhishingBody 8178 3.31 4.27 2.63 75 HTML_SHORT_LINK_IMG_1 7849 1.71 4.10 0.03 76 HTML_IMAGE_ONLY_12 7829 1.78 4.09 0.17 77 URIBL_SBL_A 7683 1.78 4.01 0.22 78 XM_OfRef6 7681 2.70 4.01 1.78 79 BODY_URI_ONLY 7506 2.48 3.92 1.47 80 RCVD_IN_RP_SAFE 7495 7.33 3.92 9.73 81 XM_UB99 7268 1.57 3.80 0.00 82 XM_B_SpammyTLD 7039 2.76 3.68 2.12 83 XMNumbers 7016 3.73 3.67 3.78 84 XM_H_Long_From01 6891 4.49 3.60 5.11 85 HTML_IMAGE_RATIO_04 6657 4.36 3.48 4.98 86 BAYES_40 6411 3.75 3.35 4.02 87 RCVD_IN_RP_CERTIFIED 6240 6.62 3.26 8.97 88 SUBJ_ALL_CAPS 6228 2.33 3.25 1.69 89 SpammyFromTLD_01 6014 1.57 3.14 0.47 90 XM_SendGrid 5998 6.07 3.13 8.12 91 URI_HEX 5948 2.02 3.11 1.26 92 HTML_IMAGE_RATIO_06 5925 3.51 3.10 3.80 93 XM_DIRTYINTL 5819 1.54 3.04 0.48 94 SpammyFromTLD_02 5774 1.37 3.02 0.21 95 TR_XM_MaxSPIKE 5680 1.24 2.97 0.03 96 XM_B_Phish66 5600 1.90 2.93 1.18 97 T_FONT_INVIS_NAKED_TO 5435 2.47 2.84 2.21 98 DKIM_INVALID 5259 2.49 2.75 2.30 99 BOTNET_NORDNS 5234 1.14 2.73 0.02 100 T_XMDrugObfuBody_08 5209 2.07 2.72 1.61 101 RELAYCOUNTRY_IN 5208 2.11 2.72 1.68 102 DKIM_ADSP_NXDOMAIN 5205 1.66 2.72 0.92 103 HTML_IMAGE_RATIO_08 5075 2.38 2.65 2.19 104 XM_UB60 4979 1.16 2.60 0.14 105 BAYES_20 4767 3.23 2.49 3.75 106 XM_UB999 4673 1.01 2.44 0.00 107 RCVD_IN_RP_RNBL 4667 1.05 2.44 0.08 108 XMStrtUSub 4657 4.89 2.43 6.61 109 SHORTENED_URL_HREF 4543 1.18 2.37 0.34 110 URI_TRY_3LD 4450 1.82 2.33 1.47 111 XM_SPF_SoftFail 4410 1.62 2.30 1.14 112 TR_XM_MaxBayes 4371 0.95 2.28 0.02 113 URIBL_DBL_ABUSE_REDIR 4049 0.90 2.12 0.04 114 LH_URI_DOM_IN_PATH 3905 1.73 2.04 1.52 115 XM_UB80 3894 0.85 2.03 0.02 116 TR_XM_DK_SendGrid 3837 3.78 2.00 5.03 117 DATE_IN_PAST_03_06 3709 0.84 1.94 0.08 118 XMDiploma_00 3657 1.54 1.91 1.27 119 RCVD_IN_PSBL 3388 0.74 1.77 0.01 120 T_FILL_THIS_FORM_SHORT 3377 1.17 1.76 0.76 121 XMSexyCombo_01 3344 1.35 1.75 1.07 122 TM2_M_URI_OPT_OUT 3267 2.95 1.71 3.82 123 HELO_NODOT 3262 2.02 1.70 2.24 124 HELO_NO_DOMAIN 3255 2.02 1.70 2.24 125 TR_XM_UnparsRelay 3218 0.94 1.68 0.42 126 MISSING_HEADERS 3169 1.79 1.66 1.88 127 T_XMHurry_00 3108 1.25 1.62 0.98 128 RCVD_IN_MSPIKE_L5 3068 0.73 1.60 0.12 129 REPLYTO_WITHOUT_TO_CC 3014 1.51 1.57 1.47 130 TM2_M_VERY_LONG_WORD 2996 1.46 1.57 1.39 131 FROM_EXCESS_BASE64 2964 3.09 1.55 4.16 132 XM_CamelCaseFrm001 2918 1.83 1.52 2.04 133 XMSlimDrugH 2902 0.83 1.52 0.36 134 XM_B_Unsub2 2887 1.44 1.51 1.39 135 TR_LOTS_OF_MONEY1 2823 0.66 1.48 0.09 136 XM_B_SpammyWords4 2782 0.95 1.45 0.60 137 MIME_HTML_ONLY_MULTI 2760 2.52 1.44 3.27 138 XM_UB95 2754 0.60 1.44 0.01 139 DIET_1 2684 0.84 1.40 0.45 140 TR_Mismatch_TLD_01 2675 0.76 1.40 0.31 141 T_XMDrugObfuBody_14 2660 1.54 1.39 1.64 142 XM_B_COVIDMETA 2645 1.10 1.38 0.90 143 MILLION_USD 2609 0.56 1.36 0.01 144 DEAR_SOMETHING 2590 0.67 1.35 0.18 145 RELAYCOUNTRY_UA 2520 0.54 1.32 0.00 146 RCVD_IN_IADB_LISTED 2463 3.15 1.29 4.45 147 HTML_FONT_SIZE_LARGE 2430 0.61 1.27 0.14 148 TR_Orig_Subnet 2428 0.58 1.27 0.10 149 RELAYCOUNTRY_KE 2388 0.57 1.25 0.09 150 MONEY_FROM_41 2378 0.51 1.24 0.00 151 XM_JunkDunk 2377 0.51 1.24 0.00 152 RELAYCOUNTRY_GB 2376 0.88 1.24 0.63 153 TR_Caps_n_Bayes_99 2328 0.60 1.22 0.17 154 PDS_OTHER_BAD_TLD 2290 0.94 1.20 0.76 155 XMBdyGiftCard01 2228 1.15 1.16 1.14 156 XMGppyBdWords 2140 0.55 1.12 0.15 157 RCVD_IN_IADB_SPF 2113 2.73 1.10 3.87 158 MIME_QP_LONG_LINE 2099 2.91 1.10 4.17 159 TR_XM_COVIDMETA4 2098 0.60 1.10 0.25 160 T_TooManySym_01 2069 3.58 1.08 5.32 161 TR_Symld_Words 2054 1.76 1.07 2.24 162 TR_XM_FormFill 2001 0.44 1.05 0.02 163 XMSubNoVowel 1982 1.77 1.04 2.29 164 TR_XM_SB_Phish 1969 1.67 1.03 2.13 165 XMGenDplmaNmb 1950 0.74 1.02 0.55 166 DATE_IN_PAST_12_24 1946 0.64 1.02 0.38 167 URI_NOVOWEL 1911 1.84 1.00 2.43 168 XM_DK_Undo_01 1903 1.26 0.99 1.45 169 RCVD_IN_IADB_SENDERID 1902 2.45 0.99 3.47 170 TR_XM_PHPDW 1901 0.63 0.99 0.37 171 RCVD_IN_IADB_DK 1876 2.38 0.98 3.37 172 TR_XM_PHPForged 1858 0.60 0.97 0.34 173 XM_H_PHPOS 1850 0.60 0.97 0.34 174 TR_XM_FormFill2 1850 0.60 0.97 0.34 175 XMSubPhish11 1849 1.64 0.97 2.11 176 TR_XM_INV_DKIM 1825 0.47 0.95 0.13 177 TR_XM_RelayPhish 1807 0.46 0.94 0.12 178 T_XMDrugObfuBody_00 1732 0.86 0.90 0.82 179 XMStockSpam_06 1707 0.92 0.89 0.93 180 XM_ProductURIs 1690 1.03 0.88 1.14 181 FROM_SUSPICIOUS_NTLD 1672 0.47 0.87 0.18 182 XMHTML_After_End 1668 0.66 0.87 0.51 183 DKIM_ADSP_CUSTOM_MED 1643 0.89 0.86 0.92 184 MIME_CHARSET_FARAWAY 1640 0.41 0.86 0.10 185 XMLngstWrd_00 1610 0.69 0.84 0.58 186 FROM_SUSPICIOUS_NTLD_FP 1592 0.45 0.83 0.18 187 NML_ADSP_CUSTOM_MED 1573 0.69 0.82 0.60 188 ANY_BOUNCE_MESSAGE 1564 2.18 0.82 3.13 189 BOUNCE_MESSAGE 1564 2.18 0.82 3.13 190 RELAYCOUNTRY_NL 1547 0.49 0.81 0.27 191 XMLngstWrd_01 1538 0.64 0.80 0.52 192 XM_URI_RBL 1511 0.43 0.79 0.18 193 FORGED_GMAIL_RCVD 1490 0.64 0.78 0.53 194 RDNS_DYNAMIC 1488 0.76 0.78 0.75 195 RELAYCOUNTRY_SG 1483 0.34 0.77 0.04 196 REMOVE_BEFORE_LINK 1480 0.45 0.77 0.22 197 XM_ShortIntro_01 1449 0.81 0.76 0.85 198 HTML_IMAGE_ONLY_32 1446 0.46 0.76 0.26 199 TR_Mismatch_TLD_02 1440 0.34 0.75 0.06 200 RELAYCOUNTRY_DE 1429 0.51 0.75 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 232781 89.18 94.79 85.24 2 RELAYCOUNTRY_US 221948 78.64 74.88 81.28 3 DKIM_SIGNED 215637 81.29 84.60 78.96 4 XM_DK_Pass 213297 80.05 82.82 78.11 5 DKIM_VALID 209344 78.80 81.86 76.66 6 XM_B_Unicode 191013 64.62 57.02 69.95 7 DKIM_VALID_AU 167199 64.56 69.32 61.23 8 XMListUnsubscribeExists 149636 55.25 55.91 54.80 9 DCC_CHECK_NEGATIVE 149073 40.54 20.49 54.59 10 BAYES_50 143056 42.47 28.32 52.39 11 XM_B_SpammyWords 136960 52.72 56.39 50.15 12 DCC_CHECK 120847 58.35 78.46 44.25 13 XM_B_Unicode3 116388 36.50 27.77 42.62 14 HTML_FONT_LOW_CONTRAST 85388 29.50 26.99 31.27 15 DKIM_VALID_EF 85249 26.97 20.91 31.22 16 RCVD_IN_MSPIKE_WL 79668 21.98 11.71 29.17 17 RCVD_IN_MSPIKE_H2 76837 34.09 42.57 28.14 18 LOC_TINY_FONT_1 75845 26.84 25.50 27.77 19 FVGT_m_MULTI_ODD 62637 21.23 18.79 22.94 20 MIME_HTML_ONLY 61178 31.79 45.18 22.40 21 XM_B_SpammyWords2 60522 25.96 31.37 22.16 22 T_TM2_M_HEADER_IN_MSG 59871 19.63 16.37 21.92 23 XMSubLong 55322 18.33 15.59 20.26 24 T_KAM_HTML_FONT_INVALID 48803 17.26 16.39 17.87 25 RCVD_IN_MSPIKE_H3 42432 11.72 6.28 15.54 26 XM_Multi_Part_URI 39094 15.43 17.01 14.32 27 XM_Body_Dirty_Words 38638 13.74 13.15 14.15 28 BAYES_00 37570 8.39 0.74 13.76 29 ALL_TRUSTED 35089 7.78 0.55 12.85 30 XM_DKIMWhitelistDomains 33012 7.11 0.01 12.09 31 XM_B_Unsub 29571 10.29 9.51 10.83 32 RCVD_IN_MSPIKE_H4 28929 8.24 4.89 10.59 33 TR_XM_DK_Bayes 27116 6.10 0.65 9.93 34 TR_XM_DK_Bayes1 26696 6.01 0.64 9.78 35 RCVD_IN_RP_SAFE 26566 7.33 3.92 9.73 36 TR_XM_DK_Bayes2 24772 5.54 0.49 9.07 37 XM_DK_Undo_02 24755 21.44 39.10 9.07 38 UNPARSEABLE_RELAY 24517 7.16 4.56 8.98 39 RCVD_IN_RP_CERTIFIED 24508 6.62 3.26 8.97 40 BAYES_60 23762 9.18 9.86 8.70 41 LOTS_OF_MONEY 23417 10.35 12.88 8.58 42 XM_B_Phish_Phrases 23198 7.16 5.25 8.49 43 XM_Evil_Numbers_Gen 22904 7.55 6.34 8.39 44 HTML_IMAGE_RATIO_02 22363 7.98 7.68 8.19 45 XM_SendGrid 22179 6.07 3.13 8.12 46 LotsOfNums_01 22015 8.72 9.67 8.06 47 XMStrtUSub 18045 4.89 2.43 6.61 48 TR_XM_DKIM_Undo 17804 16.13 29.83 6.52 49 BAYES_99 17270 16.83 31.83 6.32 50 TooManyTo_001 16683 5.52 4.69 6.11 51 XM_B_SpammyWords3 16456 7.65 9.97 6.03 52 RELAYCOUNTRY_META 16376 13.48 24.15 6.00 53 BOTNET_IPINHOSTNAME 16340 8.32 11.65 5.98 54 T_TooManySym_01 14541 3.58 1.08 5.32 55 BAYES_80 14523 9.68 15.90 5.32 56 XM_H_Long_From01 13962 4.49 3.60 5.11 57 TR_XM_DK_SendGrid 13732 3.78 2.00 5.03 58 XMSexyCombo_05 13713 6.14 7.75 5.02 59 HTML_IMAGE_RATIO_04 13605 4.36 3.48 4.98 60 BAYES_999 13448 13.10 24.76 4.92 61 MPART_ALT_DIFF 13442 5.53 6.40 4.92 62 IN_ZIMBRA_NJ_WHITELIST 13290 2.88 0.04 4.87 63 FSL_BULK_SIG 13027 15.22 30.13 4.77 64 RCVD_IN_IADB_LISTED 12156 3.15 1.29 4.45 65 XMSubMetaSx_00 11591 4.80 5.59 4.24 66 MIME_QP_LONG_LINE 11396 2.91 1.10 4.17 67 FROM_EXCESS_BASE64 11373 3.09 1.55 4.16 68 UNTRUSTED_Relay 11033 9.84 18.12 4.04 69 BAYES_40 10985 3.75 3.35 4.02 70 RCVD_IN_IADB_SPF 10568 2.73 1.10 3.87 71 BAYES_95 10444 5.09 6.91 3.82 72 TM2_M_URI_OPT_OUT 10421 2.95 1.71 3.82 73 HTML_IMAGE_RATIO_06 10373 3.51 3.10 3.80 74 XMNumbers 10321 3.73 3.67 3.78 75 BAYES_20 10253 3.23 2.49 3.75 76 XM_UncommonTLD01 10144 5.48 7.99 3.71 77 RCVD_IN_IADB_SENDERID 9472 2.45 0.99 3.47 78 RCVD_IN_IADB_DK 9199 2.38 0.98 3.37 79 MIME_HTML_ONLY_MULTI 8943 2.52 1.44 3.27 80 T_REMOTE_IMAGE 8841 4.19 5.54 3.24 81 T_TooManySym_02 8700 1.99 0.28 3.19 82 ANY_BOUNCE_MESSAGE 8558 2.18 0.82 3.13 83 BOUNCE_MESSAGE 8557 2.18 0.82 3.13 84 TR_DCC_Bayes_99 8466 11.61 23.75 3.10 85 RCVD_IN_MSPIKE_H5 8307 2.01 0.54 3.04 86 INVALID_MSGID 8007 1.79 0.17 2.93 87 RCVD_IN_IADB_VOUCHED 7490 1.91 0.71 2.74 88 TR_XM_PhishingBody 7195 3.31 4.27 2.63 89 RCVD_IN_MSPIKE_BL 6857 4.74 7.93 2.51 90 TVD_RCVD_IP 6678 1.49 0.12 2.45 91 URI_NOVOWEL 6637 1.84 1.00 2.43 92 TO_MALFORMED 6439 1.44 0.14 2.36 93 DKIM_INVALID 6293 2.49 2.75 2.30 94 MIME_HTML_MOSTLY 6245 3.76 5.85 2.29 95 XMSubNoVowel 6240 1.77 1.04 2.29 96 TR_Symld_Words 6127 1.76 1.07 2.24 97 HELO_NODOT 6117 2.02 1.70 2.24 98 HELO_NO_DOMAIN 6115 2.02 1.70 2.24 99 T_FONT_INVIS_NAKED_TO 6047 2.47 2.84 2.21 100 HTML_IMAGE_RATIO_08 5990 2.38 2.65 2.19 101 XM_H_Trusted_IP 5970 1.29 0.00 2.19 102 HK_SCAM 5869 1.30 0.09 2.15 103 HELO_MISC_IP 5821 1.34 0.22 2.13 104 CK_HELO_DYNAMIC_SPLIT_IP 5819 1.35 0.24 2.13 105 TR_XM_SB_Phish 5810 1.67 1.03 2.13 106 XM_B_SpammyTLD 5802 2.76 3.68 2.12 107 XM_PDF 5800 1.33 0.20 2.12 108 XMSubPhish11 5756 1.64 0.97 2.11 109 XM_CamelCaseFrm001 5571 1.83 1.52 2.04 110 BAYES_05 5217 1.37 0.60 1.91 111 MISSING_HEADERS 5138 1.79 1.66 1.88 112 IN_HORDE_ADDRESS_BOOK 5059 1.13 0.10 1.85 113 MAILING_LIST_MULTI 5048 1.38 0.72 1.85 114 XM_OfRef6 4858 2.70 4.01 1.78 115 BOTNET 4792 6.65 13.63 1.75 116 XMBSHREFv2 4769 1.10 0.18 1.75 117 RCVD_IN_IADB_OPTIN 4767 1.27 0.59 1.75 118 SUBJ_ALL_CAPS 4615 2.33 3.25 1.69 119 RELAYCOUNTRY_IN 4594 2.11 2.72 1.68 120 XMGappySubj_01 4592 1.03 0.10 1.68 121 T_XMDrugObfuBody_14 4492 1.54 1.39 1.64 122 XMSubEmpty 4480 10.07 22.10 1.64 123 RELAYCOUNTRY_CA 4442 3.21 5.46 1.63 124 T_XMDrugObfuBody_08 4394 2.07 2.72 1.61 125 USER_IN_DEF_DKIM_WL 4356 0.94 0.01 1.60 126 RCVD_IN_MSPIKE_ZBI 4164 0.98 0.21 1.52 127 LH_URI_DOM_IN_PATH 4143 1.73 2.04 1.52 128 URI_TRY_3LD 4023 1.82 2.33 1.47 129 REPLYTO_WITHOUT_TO_CC 4014 1.51 1.57 1.47 130 HTML_MIME_NO_HTML_TAG 4011 11.41 25.58 1.47 131 BODY_URI_ONLY 4009 2.48 3.92 1.47 132 XM_DK_Undo_01 3947 1.26 0.99 1.45 133 XM_B_Unsub2 3790 1.44 1.51 1.39 134 TM2_M_VERY_LONG_WORD 3787 1.46 1.57 1.39 135 XM_UB50 3743 3.53 6.60 1.37 136 XMBrknScrpt_02 3731 3.45 6.42 1.37 137 T_TooManySym_03 3704 0.82 0.06 1.36 138 RCVD_IN_BL_SPAMCOP_NET 3523 3.96 7.77 1.29 139 XMDiploma_00 3476 1.54 1.91 1.27 140 URI_HEX 3451 2.02 3.11 1.26 141 XMBody_95 3411 0.75 0.03 1.25 142 XM_B_Phish66 3223 1.90 2.93 1.18 143 HTML_FONT_FACE_BAD 3122 0.85 0.43 1.14 144 XM_ProductURIs 3116 1.03 0.88 1.14 145 XMBdyGiftCard01 3115 1.15 1.16 1.14 146 XM_SPF_SoftFail 3113 1.62 2.30 1.14 147 TooManyTo_002 3101 0.77 0.25 1.14 148 XM_H_Long_From02 3076 0.81 0.36 1.13 149 TR_XM_SpammyWords2 2993 6.20 13.49 1.10 150 XM_GoogleGroups 2972 0.75 0.26 1.09 151 XMSexyCombo_01 2935 1.35 1.75 1.07 152 PLING_QUERY 2837 0.82 0.51 1.04 153 KHOP_HELO_FCRDNS 2775 2.39 4.34 1.02 154 T_XMHurry_00 2679 1.25 1.62 0.98 155 TR_LOTS_OF_MONEY3 2638 2.89 5.62 0.97 156 XMStockSpam_06 2546 0.92 0.89 0.93 157 DKIM_ADSP_NXDOMAIN 2505 1.66 2.72 0.92 158 DKIM_ADSP_CUSTOM_MED 2501 0.89 0.86 0.92 159 XM_B_COVIDMETA 2449 1.10 1.38 0.90 160 TR_MSPIKEBAYES00 2441 0.53 0.01 0.89 161 NO_DNS_FOR_FROM 2390 0.71 0.47 0.88 162 TR_MetaPhish_Combo_01 2372 0.72 0.50 0.87 163 T_TooManySym_04 2355 0.52 0.03 0.86 164 XM_ShortIntro_01 2324 0.81 0.76 0.85 165 XMBody_17 2269 2.88 5.81 0.83 166 RCVD_IN_MSPIKE_L3 2253 2.89 5.84 0.83 167 T_XMDrugObfuBody_00 2246 0.86 0.90 0.82 168 XM_S_SubURI 2229 0.49 0.04 0.82 169 TooManyTo_003 2118 0.53 0.18 0.78 170 PDS_OTHER_BAD_TLD 2089 0.94 1.20 0.76 171 TR_XM_SpammyWords3 2086 2.72 5.50 0.76 172 T_FILL_THIS_FORM_SHORT 2072 1.17 1.76 0.76 173 RDNS_DYNAMIC 2046 0.76 0.78 0.75 174 HTML_TAG_BALANCE_BODY 1968 0.68 0.63 0.72 175 USER_IN_WELCOMELIST 1849 0.40 0.00 0.68 176 USER_IN_WHITELIST 1849 0.40 0.00 0.68 177 T_TooManySym_05 1832 0.40 0.00 0.67 178 NUMERIC_HTTP_ADDR 1755 0.51 0.33 0.64 179 RELAYCOUNTRY_GB 1710 0.88 1.24 0.63 180 NML_ADSP_CUSTOM_MED 1644 0.69 0.82 0.60 181 XM_B_SpammyWords4 1631 0.95 1.45 0.60 182 HTTPS_HTTP_MISMATCH 1624 0.58 0.56 0.59 183 XMSubMetaI_00 1618 0.56 0.52 0.59 184 XMLngstWrd_00 1591 0.69 0.84 0.58 185 T_Symld_Words_02 1545 0.63 0.72 0.57 186 XMBody_78 1540 0.60 0.64 0.56 187 TooManyTo_004 1538 0.40 0.17 0.56 188 XMPhish08 1527 0.48 0.38 0.56 189 XMGenDplmaNmb 1497 0.74 1.02 0.55 190 XMHTMLBadTable_001 1496 0.60 0.67 0.55 191 FORGED_GMAIL_RCVD 1460 0.64 0.78 0.53 192 XM_B_COPY_HTML 1453 0.49 0.43 0.53 193 XMLngstWrd_01 1431 0.64 0.80 0.52 194 SUBJ_DOLLARS 1430 0.51 0.48 0.52 195 HTML_IMAGE_ONLY_20 1410 0.46 0.38 0.52 196 XMHTML_After_End 1402 0.66 0.87 0.51 197 XM_B_REG_HTML 1385 0.51 0.52 0.51 198 XMSubMetaSxObfu_02 1321 0.43 0.36 0.48 199 TooManyTo_005 1315 0.35 0.15 0.48 200 XM_DIRTYINTL 1315 1.54 3.04 0.48 ----------------------------------------------------------------------