Email: 414303 Autolearn: 0 AvgScore: 4.47 AvgScanTime: 1.26 sec Spam: 146328 Autolearn: 0 AvgScore: 13.49 AvgScanTime: 1.34 sec Ham: 267975 Autolearn: 0 AvgScore: -0.45 AvgScanTime: 1.21 sec Time Spent Running SA: 144.45 hours Time Spent Processing Spam: 54.43 hours Time Spent Processing Ham: 90.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138071 89.64 94.36 87.07 2 DKIM_SIGNED 122360 81.56 83.62 80.43 3 XM_DK_Pass 119144 80.10 81.42 79.37 4 DKIM_VALID 117444 78.76 80.26 77.94 5 XM_B_Unicode 114866 75.52 78.50 73.90 6 DCC_CHECK 112781 56.91 77.07 45.90 7 RELAYCOUNTRY_US 109149 79.37 74.59 81.98 8 XMListUnsubscribeExists 107282 62.58 73.32 56.71 9 XM_B_SpammyWords 103813 57.25 70.95 49.77 10 DKIM_VALID_AU 90715 61.73 61.99 61.58 11 XM_DK_Undo_02 71387 23.16 48.79 9.17 12 XM_B_SpammyWords2 63992 29.59 43.73 21.87 13 TR_XM_DKIM_Undo 59745 18.62 40.83 6.49 14 BAYES_99 58065 18.45 39.68 6.86 15 HTML_FONT_LOW_CONTRAST 56914 34.57 38.89 32.20 16 XM_B_Unicode3 54320 40.86 37.12 42.91 17 LOC_TINY_FONT_1 52080 31.46 35.59 29.20 18 RCVD_IN_MSPIKE_H2 47568 30.50 32.51 29.40 19 BAYES_999 46008 14.77 31.44 5.66 20 BAYES_50 45131 46.09 30.84 54.42 21 TR_DCC_Bayes_99 42797 12.50 29.25 3.35 22 MIME_HTML_ONLY 41762 25.56 28.54 23.94 23 DKIM_VALID_EF 40384 29.41 27.60 30.40 24 FVGT_m_MULTI_ODD 34448 23.95 23.54 24.18 25 RELAYCOUNTRY_META 34024 11.29 23.25 4.76 26 T_TM2_M_HEADER_IN_MSG 32007 22.13 21.87 22.27 27 DCC_CHECK_NEGATIVE 31991 41.95 21.86 52.92 28 XM_Multi_Part_URI 31927 16.86 21.82 14.16 29 T_KAM_HTML_FONT_INVALID 31539 19.89 21.55 18.99 30 XMSubLong 29962 20.40 20.48 20.35 31 LOTS_OF_MONEY 29501 12.46 20.16 8.26 32 TR_XM_SpammyWords2 27335 7.63 18.68 1.59 33 TR_XM_SpammyWords4 26535 9.93 18.13 5.46 34 XM_Body_Dirty_Words 25137 15.24 17.18 14.18 35 UNTRUSTED_Relay 24665 7.36 16.86 2.18 36 RCVD_IN_MSPIKE_WL 24542 24.68 16.77 29.00 37 XM_B_SpammyWords3 19292 8.13 13.18 5.38 38 BOTNET_IPINHOSTNAME 19066 8.40 13.03 5.88 39 BOTNET 19018 5.69 13.00 1.70 40 FSL_BULK_SIG 18005 8.90 12.30 7.04 41 LotsOfNums_01 17619 10.03 12.04 8.93 42 RCVD_IN_MSPIKE_BL 17477 4.82 11.94 0.94 43 XM_B_Unsub 15250 11.23 10.42 11.68 44 XMSexyCombo_05 15020 6.82 10.26 4.93 45 XM_UncommonTLD01 13607 5.81 9.30 3.90 46 BAYES_80 13512 6.69 9.23 5.30 47 RCVD_IN_MSPIKE_H3 13168 13.32 9.00 15.67 48 RCVD_IN_BL_SPAMCOP_NET 13164 3.78 9.00 0.92 49 BAYES_60 13137 8.81 8.98 8.72 50 TR_LOTS_OF_MONEY3 12740 3.76 8.71 1.06 51 HTML_IMAGE_RATIO_02 12420 7.93 8.49 7.62 52 RCVD_IN_MSPIKE_L3 12395 3.44 8.47 0.69 53 TR_XM_SpammyWords3 11802 3.29 8.07 0.68 54 XM_Evil_Numbers_Gen 11764 8.44 8.04 8.66 55 XMBrknScrpt_02 11150 3.62 7.62 1.43 56 T_REMOTE_IMAGE 10637 4.81 7.27 3.47 57 XM_UB50 10203 3.07 6.97 0.95 58 RCVD_IN_MSPIKE_H4 10034 9.31 6.86 10.66 59 XMBody_17 9948 3.02 6.80 0.96 60 RELAYCOUNTRY_CA 9831 3.66 6.72 2.00 61 XMSubMetaSx_00 9756 4.85 6.67 3.85 62 HTML_IMAGE_RATIO_04 9282 5.94 6.34 5.72 63 MPART_ALT_DIFF 9099 5.45 6.22 5.03 64 HTML_MIME_NO_HTML_TAG 9048 3.46 6.18 1.97 65 BAYES_95 8809 4.26 6.02 3.30 66 KHOP_HELO_FCRDNS 8682 2.64 5.93 0.84 67 TooManyTo_001 8591 6.17 5.87 6.34 68 UNPARSEABLE_RELAY 8365 8.71 5.72 10.34 69 TR_XM_SpammyWords5 8096 3.03 5.53 1.66 70 MIME_HTML_MOSTLY 7913 3.50 5.41 2.45 71 XM_OfRef6 7440 2.75 5.08 1.48 72 HTML_IMAGE_ONLY_08 7259 1.80 4.96 0.08 73 RCVD_IN_RP_SAFE 7207 8.28 4.93 10.11 74 TM2_M_URI_OPT_OUT 7179 4.09 4.91 3.65 75 BODY_URI_ONLY 7174 1.75 4.90 0.03 76 XM_B_Phish_Phrases 7051 4.53 4.82 4.37 77 URIBL_SBL_A 6431 1.78 4.39 0.35 78 T_FONT_INVIS_NAKED_TO 6295 3.12 4.30 2.48 79 TR_XM_MaxSPIKE 6285 1.54 4.30 0.03 80 XM_SendGrid 6213 7.55 4.25 9.35 81 RCVD_IN_RP_CERTIFIED 5828 7.47 3.98 9.38 82 URI_HEX 5797 2.21 3.96 1.25 83 XM_H_Long_From01 5755 5.03 3.93 5.64 84 XMStrtUSub 5748 5.10 3.93 5.74 85 HTML_IMAGE_RATIO_06 5687 3.76 3.89 3.70 86 XMNumbers 5646 3.91 3.86 3.95 87 SUBJ_ALL_CAPS 5583 2.25 3.82 1.39 88 TR_XM_PhishingBody 5499 3.16 3.76 2.84 89 XM_B_SpammyTLD 5430 2.78 3.71 2.27 90 XM_UB60 5385 1.35 3.68 0.08 91 RCVD_IN_RP_RNBL 5175 1.30 3.54 0.08 92 HTML_IMAGE_RATIO_08 5138 2.42 3.51 1.83 93 DKIM_INVALID 4916 2.80 3.36 2.49 94 XM_SPF_SoftFail 4877 1.84 3.33 1.02 95 SpammyFromTLD_01 4864 1.53 3.32 0.54 96 SpammyFromTLD_02 4733 1.28 3.23 0.21 97 T_XMHurry_00 4668 1.74 3.19 0.94 98 XM_DIRTYINTL 4609 1.43 3.15 0.48 99 RELAYCOUNTRY_FR 4501 1.25 3.08 0.25 100 T_XMDrugObfuBody_08 4476 2.12 3.06 1.61 101 TR_XM_MaxBayes 4222 1.03 2.89 0.02 102 BOTNET_NORDNS 4150 1.01 2.84 0.02 103 RCVD_IN_MSPIKE_L5 4136 1.11 2.83 0.17 104 TR_XM_DK_SendGrid 4010 4.78 2.74 5.90 105 FROM_EXCESS_BASE64 3876 3.22 2.65 3.53 106 URI_TRY_3LD 3871 1.83 2.65 1.38 107 XM_UB99 3278 0.79 2.24 0.00 108 XM_DK_Undo_01 3238 1.68 2.21 1.39 109 XM_CamelCaseFrm001 3145 2.02 2.15 1.94 110 XM_B_Phish66 3098 1.59 2.12 1.30 111 XM_URI_RBL 3075 0.85 2.10 0.17 112 RELAYCOUNTRY_IN 3069 0.78 2.10 0.06 113 XMDiploma_00 3039 1.51 2.08 1.21 114 LH_URI_DOM_IN_PATH 2904 1.71 1.98 1.56 115 T_HTML_TAG_BALANCE_CENTER 2889 0.82 1.97 0.19 116 RCVD_IN_PSBL 2872 0.73 1.96 0.06 117 RELAYCOUNTRY_UA 2825 0.68 1.93 0.00 118 XM_UB80 2793 0.69 1.91 0.03 119 BAYES_40 2789 3.27 1.91 4.01 120 XMSubNoVowel 2738 1.66 1.87 1.55 121 TR_Symld_Words 2720 2.21 1.86 2.40 122 T_FILL_THIS_FORM_SHORT 2719 1.26 1.86 0.93 123 MIME_HTML_ONLY_MULTI 2641 2.72 1.80 3.22 124 HTML_FONT_SIZE_LARGE 2640 0.69 1.80 0.09 125 RCVD_IN_IADB_LISTED 2614 3.72 1.79 4.78 126 T_TooManySym_01 2607 4.53 1.78 6.03 127 TR_XM_UnparsRelay 2505 0.93 1.71 0.51 128 TR_Mismatch_TLD_01 2492 0.91 1.70 0.48 129 DKIM_ADSP_NXDOMAIN 2446 1.60 1.67 1.56 130 T_XMDrugObfuBody_14 2437 1.68 1.67 1.68 131 URI_PHP_REDIR 2429 0.60 1.66 0.02 132 MISSING_HEADERS 2412 0.75 1.65 0.26 133 XMSexyCombo_01 2380 0.94 1.63 0.57 134 REPLYTO_WITHOUT_TO_CC 2356 0.60 1.61 0.04 135 MIME_QP_LONG_LINE 2351 3.55 1.61 4.62 136 XM_B_Unsub2 2308 1.58 1.58 1.59 137 HELO_NODOT 2260 0.93 1.54 0.59 138 HELO_NO_DOMAIN 2259 0.93 1.54 0.59 139 TR_XM_PHPDW 2225 0.76 1.52 0.35 140 XMStockSpam_06 2210 1.10 1.51 0.87 141 RCVD_IN_IADB_SPF 2200 3.27 1.50 4.23 142 XMBdyGiftCard01 2188 1.21 1.50 1.05 143 XM_UB999 2178 0.53 1.49 0.00 144 TR_XM_PHPForged 2171 0.71 1.48 0.29 145 TR_XM_FormFill2 2162 0.70 1.48 0.28 146 XM_H_PHPOS 2159 0.70 1.48 0.28 147 ALL_TRUSTED 2145 9.32 1.47 13.61 148 TM2_M_VERY_LONG_WORD 2112 1.29 1.44 1.20 149 PDS_OTHER_BAD_TLD 2085 0.90 1.42 0.61 150 TO_NO_BRKTS_HTML_ONLY 2060 0.62 1.41 0.20 151 SUBJ_DOLLARS 2039 0.81 1.39 0.50 152 XM_B_SpammyWords4 2028 0.83 1.39 0.53 153 BAYES_20 2022 2.42 1.38 2.99 154 RELAYCOUNTRY_RO 2008 0.63 1.37 0.22 155 T_XMDrugObfuBody_00 1963 0.98 1.34 0.78 156 RCVD_IN_IADB_SENDERID 1961 2.93 1.34 3.80 157 MIME_CHARSET_FARAWAY 1917 0.53 1.31 0.10 158 RCVD_IN_IADB_DK 1915 2.84 1.31 3.67 159 DATE_IN_PAST_03_06 1879 0.51 1.28 0.08 160 DEAR_SOMETHING 1865 0.56 1.27 0.17 161 REMOVE_BEFORE_LINK 1853 0.59 1.27 0.22 162 MILLION_USD 1828 0.45 1.25 0.01 163 XM_UB95 1818 0.45 1.24 0.01 164 TR_LOTS_OF_MONEY1 1809 0.45 1.24 0.01 165 URI_NOVOWEL 1803 2.08 1.23 2.54 166 CHARSET_FARAWAY_HEADER 1767 0.44 1.21 0.02 167 XM_ProductURIs 1760 0.99 1.20 0.88 168 XMGenDplmaNmb 1754 0.79 1.20 0.57 169 TR_XM_FormFill 1690 0.42 1.15 0.02 170 HK_RANDOM_REPLYTO 1678 0.55 1.15 0.23 171 TR_XM_INV_DKIM 1674 0.52 1.14 0.18 172 XM_OfRef7 1667 0.55 1.14 0.23 173 RELAYCOUNTRY_DE 1665 0.64 1.14 0.36 174 RELAYCOUNTRY_NL 1651 0.53 1.13 0.20 175 BAYES_00 1648 8.48 1.13 12.49 176 XMMoneyMeta_00 1640 0.67 1.12 0.42 177 TR_XM_SB_Phish 1627 1.47 1.11 1.67 178 XMBody_29 1622 0.44 1.11 0.08 179 TR_Caps_n_Bayes_99 1618 0.48 1.11 0.13 180 TR_XM_COVIDMETA4 1598 0.54 1.09 0.23 181 TVD_SPACE_RATIO_MINFP 1595 0.39 1.09 0.01 182 XMSubPhish11 1578 1.45 1.08 1.66 183 MAILING_LIST_MULTI 1566 1.63 1.07 1.93 184 XMBody_78 1542 0.73 1.05 0.56 185 FROM_SUSPICIOUS_NTLD 1525 0.44 1.04 0.11 186 HTML_TAG_BALANCE_BODY 1521 0.79 1.04 0.65 187 XMHTML_After_End 1503 0.70 1.03 0.52 188 XM_B_COVIDMETA 1472 0.74 1.01 0.59 189 RCVD_IN_IADB_VOUCHED 1468 2.17 1.00 2.81 190 TR_XM_DK_Bayes 1444 6.47 0.99 9.46 191 TR_XM_RelayPhish 1443 0.42 0.99 0.10 192 FROM_SUSPICIOUS_NTLD_FP 1439 0.41 0.98 0.10 193 TR_XM_DK_Bayes1 1432 6.36 0.98 9.30 194 XMSubMetaSSx_00 1415 0.49 0.97 0.23 195 MIMEOLE_DIRECT_TO_MX 1407 0.34 0.96 0.00 196 NO_DNS_FOR_FROM 1403 0.93 0.96 0.92 197 LOW_PRICE 1396 0.81 0.95 0.74 198 DOS_OE_TO_MX 1395 0.34 0.95 0.00 199 TR_Mismatch_TLD_02 1373 0.40 0.94 0.11 200 RCVD_IN_MSPIKE_H5 1340 2.05 0.92 2.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 233319 89.64 94.36 87.07 2 RELAYCOUNTRY_US 219691 79.37 74.59 81.98 3 DKIM_SIGNED 215532 81.56 83.62 80.43 4 XM_DK_Pass 212694 80.10 81.42 79.37 5 DKIM_VALID 208855 78.76 80.26 77.94 6 XM_B_Unicode 198025 75.52 78.50 73.90 7 DKIM_VALID_AU 165030 61.73 61.99 61.58 8 XMListUnsubscribeExists 151979 62.58 73.32 56.71 9 BAYES_50 145825 46.09 30.84 54.42 10 DCC_CHECK_NEGATIVE 141812 41.95 21.86 52.92 11 XM_B_SpammyWords 133365 57.25 70.95 49.77 12 DCC_CHECK 123003 56.91 77.07 45.90 13 XM_B_Unicode3 114979 40.86 37.12 42.91 14 HTML_FONT_LOW_CONTRAST 86300 34.57 38.89 32.20 15 DKIM_VALID_EF 81474 29.41 27.60 30.40 16 RCVD_IN_MSPIKE_H2 78775 30.50 32.51 29.40 17 LOC_TINY_FONT_1 78249 31.46 35.59 29.20 18 RCVD_IN_MSPIKE_WL 77714 24.68 16.77 29.00 19 FVGT_m_MULTI_ODD 64796 23.95 23.54 24.18 20 MIME_HTML_ONLY 64150 25.56 28.54 23.94 21 T_TM2_M_HEADER_IN_MSG 59687 22.13 21.87 22.27 22 XM_B_SpammyWords2 58596 29.59 43.73 21.87 23 XMSubLong 54539 20.40 20.48 20.35 24 T_KAM_HTML_FONT_INVALID 50878 19.89 21.55 18.99 25 RCVD_IN_MSPIKE_H3 42005 13.32 9.00 15.67 26 XM_Body_Dirty_Words 38003 15.24 17.18 14.18 27 XM_Multi_Part_URI 37941 16.86 21.82 14.16 28 ALL_TRUSTED 36483 9.32 1.47 13.61 29 BAYES_00 33465 8.48 1.13 12.49 30 XM_B_Unsub 31292 11.23 10.42 11.68 31 XM_DKIMWhitelistDomains 29995 7.24 0.01 11.19 32 RCVD_IN_MSPIKE_H4 28555 9.31 6.86 10.66 33 UNPARSEABLE_RELAY 27708 8.71 5.72 10.34 34 RCVD_IN_RP_SAFE 27099 8.28 4.93 10.11 35 TR_XM_DK_Bayes 25352 6.47 0.99 9.46 36 RCVD_IN_RP_CERTIFIED 25131 7.47 3.98 9.38 37 XM_SendGrid 25065 7.55 4.25 9.35 38 TR_XM_DK_Bayes1 24920 6.36 0.98 9.30 39 XM_DK_Undo_02 24572 23.16 48.79 9.17 40 LotsOfNums_01 23927 10.03 12.04 8.93 41 BAYES_60 23374 8.81 8.98 8.72 42 XM_Evil_Numbers_Gen 23207 8.44 8.04 8.66 43 TR_XM_DK_Bayes2 23149 5.88 0.84 8.64 44 LOTS_OF_MONEY 22134 12.46 20.16 8.26 45 HTML_IMAGE_RATIO_02 20422 7.93 8.49 7.62 46 FSL_BULK_SIG 18863 8.90 12.30 7.04 47 BAYES_99 18392 18.45 39.68 6.86 48 TR_XM_DKIM_Undo 17380 18.62 40.83 6.49 49 TooManyTo_001 16988 6.17 5.87 6.34 50 T_TooManySym_01 16152 4.53 1.78 6.03 51 TR_XM_DK_SendGrid 15807 4.78 2.74 5.90 52 BOTNET_IPINHOSTNAME 15755 8.40 13.03 5.88 53 XMStrtUSub 15388 5.10 3.93 5.74 54 HTML_IMAGE_RATIO_04 15334 5.94 6.34 5.72 55 BAYES_999 15168 14.77 31.44 5.66 56 XM_H_Long_From01 15105 5.03 3.93 5.64 57 TR_XM_SpammyWords4 14624 9.93 18.13 5.46 58 XM_B_SpammyWords3 14404 8.13 13.18 5.38 59 BAYES_80 14190 6.69 9.23 5.30 60 MPART_ALT_DIFF 13483 5.45 6.22 5.03 61 XMSexyCombo_05 13217 6.82 10.26 4.93 62 IN_ZIMBRA_NJ_WHITELIST 13195 3.20 0.03 4.92 63 RCVD_IN_IADB_LISTED 12808 3.72 1.79 4.78 64 RELAYCOUNTRY_META 12755 11.29 23.25 4.76 65 MIME_QP_LONG_LINE 12372 3.55 1.61 4.62 66 XM_B_Phish_Phrases 11717 4.53 4.82 4.37 67 RCVD_IN_IADB_SPF 11329 3.27 1.50 4.23 68 BAYES_40 10744 3.27 1.91 4.01 69 XMNumbers 10573 3.91 3.86 3.95 70 XM_UncommonTLD01 10453 5.81 9.30 3.90 71 XMSubMetaSx_00 10327 4.85 6.67 3.85 72 RCVD_IN_IADB_SENDERID 10174 2.93 1.34 3.80 73 HTML_IMAGE_RATIO_06 9910 3.76 3.89 3.70 74 RCVD_IN_IADB_DK 9844 2.84 1.31 3.67 75 TM2_M_URI_OPT_OUT 9781 4.09 4.91 3.65 76 FROM_EXCESS_BASE64 9467 3.22 2.65 3.53 77 T_TooManySym_02 9353 2.43 0.50 3.49 78 T_REMOTE_IMAGE 9293 4.81 7.27 3.47 79 TR_DCC_Bayes_99 8976 12.50 29.25 3.35 80 BAYES_95 8841 4.26 6.02 3.30 81 MIME_HTML_ONLY_MULTI 8621 2.72 1.80 3.22 82 INVALID_MSGID 8109 2.05 0.27 3.03 83 BAYES_20 8021 2.42 1.38 2.99 84 TR_XM_PhishingBody 7599 3.16 3.76 2.84 85 MSGID_NOFQDN1 7598 1.84 0.02 2.84 86 RCVD_IN_IADB_VOUCHED 7539 2.17 1.00 2.81 87 RCVD_IN_MSPIKE_H5 7154 2.05 0.92 2.67 88 URI_NOVOWEL 6819 2.08 1.23 2.54 89 DKIM_INVALID 6677 2.80 3.36 2.49 90 T_FONT_INVIS_NAKED_TO 6645 3.12 4.30 2.48 91 MIME_HTML_MOSTLY 6572 3.50 5.41 2.45 92 TO_MALFORMED 6556 1.61 0.06 2.45 93 TR_Symld_Words 6436 2.21 1.86 2.40 94 XM_PDF 6232 1.61 0.30 2.33 95 TVD_RCVD_IP 6100 1.51 0.12 2.28 96 XM_B_SpammyTLD 6092 2.78 3.71 2.27 97 UNTRUSTED_Relay 5832 7.36 16.86 2.18 98 HELO_MISC_IP 5516 1.41 0.21 2.06 99 CK_HELO_DYNAMIC_SPLIT_IP 5513 1.40 0.18 2.06 100 RELAYCOUNTRY_CA 5348 3.66 6.72 2.00 101 HTML_MIME_NO_HTML_TAG 5284 3.46 6.18 1.97 102 XM_H_Trusted_IP 5232 1.26 0.00 1.95 103 XM_CamelCaseFrm001 5211 2.02 2.15 1.94 104 MAILING_LIST_MULTI 5172 1.63 1.07 1.93 105 ANY_BOUNCE_MESSAGE 5152 1.46 0.61 1.92 106 BOUNCE_MESSAGE 5151 1.46 0.61 1.92 107 BAYES_05 5123 1.53 0.82 1.91 108 USER_IN_DEF_DKIM_WL 4918 1.19 0.00 1.84 109 RCVD_IN_IADB_OPTIN 4897 1.45 0.77 1.83 110 HTML_IMAGE_RATIO_08 4893 2.42 3.51 1.83 111 IN_HORDE_ADDRESS_BOOK 4826 1.19 0.06 1.80 112 XMGappySubj_01 4629 1.17 0.15 1.73 113 BOTNET 4545 5.69 13.00 1.70 114 T_XMDrugObfuBody_14 4513 1.68 1.67 1.68 115 XMBSHREFv2 4490 1.14 0.17 1.68 116 TR_XM_SB_Phish 4474 1.47 1.11 1.67 117 TR_XM_SpammyWords5 4440 3.03 5.53 1.66 118 XMSubPhish11 4435 1.45 1.08 1.66 119 T_XMDrugObfuBody_08 4303 2.12 3.06 1.61 120 TR_XM_SpammyWords2 4267 7.63 18.68 1.59 121 XM_B_Unsub2 4257 1.58 1.58 1.59 122 LH_URI_DOM_IN_PATH 4193 1.71 1.98 1.56 123 DKIM_ADSP_NXDOMAIN 4190 1.60 1.67 1.56 124 XMSubNoVowel 4157 1.66 1.87 1.55 125 XM_OfRef6 3963 2.75 5.08 1.48 126 XMBrknScrpt_02 3834 3.62 7.62 1.43 127 XM_DK_Undo_01 3722 1.68 2.21 1.39 128 SUBJ_ALL_CAPS 3721 2.25 3.82 1.39 129 T_TooManySym_03 3718 0.95 0.14 1.39 130 URI_TRY_3LD 3705 1.83 2.65 1.38 131 XM_B_Phish66 3488 1.59 2.12 1.30 132 TooManyTo_002 3387 0.97 0.44 1.26 133 URI_HEX 3339 2.21 3.96 1.25 134 XMBody_95 3265 0.83 0.13 1.22 135 XMDiploma_00 3231 1.51 2.08 1.21 136 TM2_M_VERY_LONG_WORD 3227 1.29 1.44 1.20 137 XM_H_Long_From02 3073 0.91 0.48 1.15 138 HTML_FONT_FACE_BAD 2960 0.95 0.66 1.10 139 TR_LOTS_OF_MONEY3 2845 3.76 8.71 1.06 140 XMBdyGiftCard01 2825 1.21 1.50 1.05 141 XM_GoogleGroups 2759 0.79 0.36 1.03 142 XM_SPF_SoftFail 2732 1.84 3.33 1.02 143 DKIM_ADSP_CUSTOM_MED 2644 0.91 0.78 0.99 144 XMBody_17 2582 3.02 6.80 0.96 145 PLING_QUERY 2547 0.82 0.59 0.95 146 XM_UB50 2536 3.07 6.97 0.95 147 T_XMHurry_00 2523 1.74 3.19 0.94 148 RCVD_IN_MSPIKE_BL 2510 4.82 11.94 0.94 149 XMSubEmpty 2483 0.91 0.89 0.93 150 T_FILL_THIS_FORM_SHORT 2481 1.26 1.86 0.93 151 TR_MSPIKEBAYES00 2479 0.61 0.03 0.93 152 RCVD_IN_BL_SPAMCOP_NET 2478 3.78 9.00 0.92 153 NO_DNS_FOR_FROM 2470 0.93 0.96 0.92 154 TooManyTo_003 2393 0.71 0.37 0.89 155 T_TooManySym_04 2388 0.59 0.03 0.89 156 XM_ProductURIs 2353 0.99 1.20 0.88 157 XMStockSpam_06 2333 1.10 1.51 0.87 158 KHOP_HELO_FCRDNS 2243 2.64 5.93 0.84 159 XM_S_SubURI 2239 0.57 0.07 0.84 160 XMHTMLBadTable_001 2141 0.78 0.73 0.80 161 T_XMDrugObfuBody_00 2093 0.98 1.34 0.78 162 LOW_PRICE 1970 0.81 0.95 0.74 163 USER_IN_WELCOMELIST 1934 0.47 0.00 0.72 164 USER_IN_WHITELIST 1934 0.47 0.00 0.72 165 RDNS_DYNAMIC 1926 0.75 0.82 0.72 166 T_TooManySym_05 1872 0.46 0.01 0.70 167 RELAYCOUNTRY_GB 1843 0.71 0.74 0.69 168 RCVD_IN_MSPIKE_L3 1840 3.44 8.47 0.69 169 SHORTENED_URL_HREF 1817 0.70 0.75 0.68 170 TR_XM_SpammyWords3 1811 3.29 8.07 0.68 171 XM_ShortIntro_01 1747 0.71 0.81 0.65 172 HTML_TAG_BALANCE_BODY 1746 0.79 1.04 0.65 173 TooManyTo_004 1741 0.54 0.34 0.65 174 NML_ADSP_CUSTOM_MED 1682 0.66 0.73 0.63 175 FORGED_GMAIL_RCVD 1634 0.65 0.72 0.61 176 PDS_OTHER_BAD_TLD 1626 0.90 1.42 0.61 177 TR_MetaPhish_Combo_01 1610 0.56 0.47 0.60 178 HTTPS_HTTP_MISMATCH 1595 0.55 0.46 0.60 179 XM_B_REG_HTML 1584 0.63 0.71 0.59 180 XM_B_COVIDMETA 1579 0.74 1.01 0.59 181 HELO_NODOT 1578 0.93 1.54 0.59 182 HELO_NO_DOMAIN 1577 0.93 1.54 0.59 183 XMSexyCombo_01 1524 0.94 1.63 0.57 184 XMGenDplmaNmb 1518 0.79 1.20 0.57 185 XMBody_78 1495 0.73 1.05 0.56 186 XMLngstWrd_00 1492 0.42 0.17 0.56 187 XMSubMetaI_00 1490 0.64 0.80 0.56 188 TooManyTo_005 1460 0.46 0.31 0.54 189 SpammyFromTLD_01 1456 1.53 3.32 0.54 190 T_Symld_Words_02 1437 0.64 0.84 0.54 191 DIET_1 1437 0.63 0.81 0.54 192 XMPhish14 1434 0.46 0.32 0.54 193 NUMERIC_HTTP_ADDR 1422 0.47 0.36 0.53 194 XM_B_SpammyWords4 1420 0.83 1.39 0.53 195 XM_B_COPY_HTML 1396 0.47 0.37 0.52 196 XMHTML_After_End 1384 0.70 1.03 0.52 197 TR_XM_UnparsRelay 1361 0.93 1.71 0.51 198 XMLngstWrd_01 1358 0.38 0.16 0.51 199 SUBJ_DOLLARS 1332 0.81 1.39 0.50 200 XMSubMetaSxObfu_02 1313 0.41 0.26 0.49 ----------------------------------------------------------------------