Email: 528409 Autolearn: 0 AvgScore: 5.85 AvgScanTime: 1.25 sec Spam: 193937 Autolearn: 0 AvgScore: 16.41 AvgScanTime: 1.34 sec Ham: 334472 Autolearn: 0 AvgScore: -0.28 AvgScanTime: 1.20 sec Time Spent Running SA: 183.68 hours Time Spent Processing Spam: 72.22 hours Time Spent Processing Ham: 111.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176323 80.97 90.92 75.20 2 DKIM_SIGNED 159147 75.09 82.06 71.05 3 DCC_CHECK 157612 55.66 81.27 40.81 4 XM_DK_Pass 156165 73.98 80.52 70.19 5 DKIM_VALID 154167 72.76 79.49 68.85 6 XM_B_Unicode 139637 67.54 72.00 64.96 7 RELAYCOUNTRY_US 137670 72.11 70.99 72.77 8 XMListUnsubscribeExists 131314 56.83 67.71 50.52 9 XM_B_SpammyWords 128137 51.89 66.07 43.67 10 DKIM_VALID_AU 120065 57.16 61.91 54.40 11 XM_DK_Undo_02 105026 24.71 54.15 7.63 12 BAYES_99 91957 20.89 47.42 5.52 13 TR_XM_DKIM_Undo 82692 19.06 42.64 5.40 14 BAYES_999 77256 17.45 39.84 4.48 15 TR_DCC_Bayes_99 75634 16.14 39.00 2.89 16 HTML_FONT_LOW_CONTRAST 73218 30.90 37.75 26.93 17 XM_B_SpammyWords2 67456 24.33 34.78 18.27 18 LOC_TINY_FONT_1 66606 28.73 34.34 25.47 19 DKIM_VALID_EF 64043 29.03 33.02 26.71 20 XM_B_Unicode3 60000 35.15 30.94 37.60 21 RCVD_IN_MSPIKE_H2 59832 27.38 30.85 25.36 22 FVGT_m_MULTI_ODD 54026 23.73 27.86 21.34 23 RELAYCOUNTRY_META 52209 12.40 26.92 3.97 24 BAYES_50 49842 44.16 25.70 54.86 25 MIME_HTML_ONLY 44802 20.66 23.10 19.24 26 T_KAM_HTML_FONT_INVALID 42746 18.02 22.04 15.69 27 UNTRUSTED_Relay 40258 9.16 20.76 2.44 28 XM_Multi_Part_URI 39664 14.95 20.45 11.76 29 BOTNET 36429 7.79 18.78 1.41 30 XMSubLong 34826 16.97 17.96 16.39 31 T_TM2_M_HEADER_IN_MSG 34458 19.19 17.77 20.01 32 LOTS_OF_MONEY 34250 11.15 17.66 7.38 33 DCC_CHECK_NEGATIVE 34041 43.26 17.55 58.16 34 TR_XM_SpammyWords4 31685 9.12 16.34 4.94 35 TR_XM_SpammyWords2 30583 6.22 15.77 0.68 36 XM_UncommonTLD01 30294 7.79 15.62 3.25 37 FSL_BULK_SIG 30079 9.38 15.51 5.83 38 BOTNET_IPINHOSTNAME 29553 8.60 15.24 4.75 39 XM_B_Unsub 28318 11.31 14.60 9.40 40 URIBL_SBL_A 26723 5.38 13.78 0.51 41 RCVD_IN_MSPIKE_WL 25755 21.26 13.28 25.89 42 XM_Body_Dirty_Words 25187 12.57 12.99 12.32 43 LotsOfNums_01 22966 9.57 11.84 8.26 44 RCVD_IN_BL_SPAMCOP_NET 21930 4.72 11.31 0.90 45 MPART_ALT_DIFF 20397 6.71 10.52 4.51 46 MIME_HTML_MOSTLY 19446 5.12 10.03 2.28 47 RCVD_IN_MSPIKE_BL 18082 3.60 9.32 0.28 48 TR_XM_MSPIKECOMBO 17818 3.55 9.19 0.28 49 XM_B_SpammyWords3 17688 6.15 9.12 4.42 50 BAYES_60 17236 7.90 8.89 7.32 51 BAYES_80 17042 6.03 8.79 4.42 52 TR_XM_MaxBayes 14727 2.81 7.59 0.03 53 XMSexyCombo_05 14350 5.29 7.40 4.07 54 TooManyTo_001 14141 6.09 7.29 5.40 55 RCVD_IN_MSPIKE_H3 13764 11.54 7.10 14.12 56 TR_LOTS_OF_MONEY3 13619 3.51 7.02 1.47 57 SpammyFromTLD_01 13530 2.85 6.98 0.46 58 RELAYCOUNTRY_CA 13146 3.47 6.78 1.55 59 RCVD_IN_MSPIKE_L5 12354 2.38 6.37 0.06 60 HTML_IMAGE_RATIO_02 12067 6.43 6.22 6.55 61 XMSlimDrugH 12020 2.41 6.20 0.21 62 RCVD_IN_PSBL 11761 2.32 6.06 0.15 63 XM_Evil_Numbers_Gen 11677 7.05 6.02 7.65 64 XM_UB99 11640 2.21 6.00 0.01 65 RCVD_IN_RP_RNBL 11612 2.26 5.99 0.10 66 HTML_IMAGE_RATIO_06 11506 4.31 5.93 3.36 67 UNPARSEABLE_RELAY 11356 7.48 5.86 8.43 68 TR_XM_SpammyWords5 11173 3.17 5.76 1.66 69 XM_UB50 11099 3.05 5.72 1.51 70 TR_Symld_Words 11080 3.18 5.71 1.72 71 RELAYCOUNTRY_FR 11045 2.24 5.70 0.23 72 TR_XM_UnparsRelay 10895 5.97 5.62 6.18 73 XM_B_SpammyTLD 10885 3.36 5.61 2.06 74 T_REMOTE_IMAGE 10772 3.91 5.55 2.95 75 DRUGS_ERECTILE 10682 2.06 5.51 0.07 76 T_Symld_Words_02 10634 2.30 5.48 0.46 77 RCVD_IN_MSPIKE_H4 10334 8.06 5.33 9.64 78 XMSubMetaD_03 10202 1.95 5.26 0.03 79 TM2_M_VERY_LONG_WORD 10181 2.68 5.25 1.20 80 XMSubMetaD_00 10178 1.96 5.25 0.06 81 KHOP_HELO_FCRDNS 10075 2.47 5.19 0.89 82 SERGIO_SUBJECT_VIAGRA01 10029 1.91 5.17 0.02 83 XMSubMetaD_01 10024 1.91 5.17 0.02 84 BAYES_95 10020 3.74 5.17 2.91 85 XMSubMetaD_02 10008 1.91 5.16 0.02 86 SUBJECT_DRUG_GAP_C 10006 1.91 5.16 0.02 87 SUBJECT_DRUG_GAP_L 9997 1.90 5.15 0.02 88 HTML_MIME_NO_HTML_TAG 9929 2.70 5.12 1.29 89 XMSubMetaSx_00 9795 4.04 5.05 3.46 90 HTML_IMAGE_RATIO_08 9734 3.14 5.02 2.05 91 TVD_SPACE_RATIO 9543 2.08 4.92 0.44 92 XM_SendGrid 9316 6.54 4.80 7.55 93 XMBody_17 9195 2.28 4.74 0.86 94 PDS_FROM_2_EMAILS 9050 1.73 4.67 0.03 95 FROM_2_EMAILS_SHORT 9040 1.72 4.66 0.02 96 XM_UB999 8939 1.70 4.61 0.01 97 XMStrtUSub 8578 4.93 4.42 5.23 98 DATE_IN_PAST_03_06 8528 1.66 4.40 0.08 99 PDS_TO_EQ_FROM_NAME 8526 1.62 4.40 0.02 100 TM2_M_URI_OPT_OUT 8362 11.50 4.31 15.67 101 XM_B_Phish_Phrases 8355 4.51 4.31 4.63 102 PDS_OTHER_BAD_TLD 8302 1.95 4.28 0.60 103 HTML_IMAGE_RATIO_04 8224 4.86 4.24 5.22 104 BODY_URI_ONLY 8215 1.58 4.24 0.04 105 T_FONT_INVIS_NAKED_TO 8022 2.82 4.14 2.05 106 XM_UB60 7742 1.52 3.99 0.09 107 LONG_JUNK_URI 7742 1.52 3.99 0.09 108 NO_FM_NAME_IP_HOSTN 7655 1.46 3.95 0.01 109 XM_H_Long_From01 7544 4.78 3.89 5.30 110 HTML_IMAGE_ONLY_08 7505 1.47 3.87 0.08 111 TVD_SPACE_RATIO_MINFP 7420 1.42 3.83 0.02 112 SUBJ_ALL_CAPS 7400 2.25 3.82 1.34 113 TR_XM_PhishingBody 7400 2.74 3.82 2.12 114 XMNumbers 7214 3.35 3.72 3.14 115 XMBrknScrpt_02 6975 1.95 3.60 0.99 116 URI_TRY_3LD 6695 2.09 3.45 1.30 117 XM_OfRef6 6349 1.92 3.27 1.13 118 SpammyFromTLD_02 5818 1.30 3.00 0.32 119 RCVD_IN_RP_SAFE 5779 6.75 2.98 8.93 120 TR_XM_DK_SendGrid 5778 4.14 2.98 4.81 121 T_FILL_THIS_FORM_SHORT 5762 1.60 2.97 0.80 122 XM_UB80 5699 1.09 2.94 0.02 123 TR_XM_SpammyWords3 5656 1.17 2.92 0.16 124 T_XMHurry_00 5614 1.57 2.89 0.80 125 XM_SPF_SoftFail 5479 1.64 2.83 0.95 126 TR_XM_SpoofStaff 5110 1.04 2.63 0.12 127 XMSpoofStaff2 5097 1.04 2.63 0.12 128 RCVD_IN_MSPIKE_L3 5077 1.09 2.62 0.20 129 T_XMDrugObfuBody_08 5012 1.81 2.58 1.36 130 DKIM_INVALID 4980 2.33 2.57 2.20 131 MIMEOLE_DIRECT_TO_MX 4794 0.91 2.47 0.01 132 TR_XM_FormFill 4532 0.87 2.34 0.02 133 RCVD_IN_RP_CERTIFIED 4499 6.11 2.32 8.31 134 XMDiploma_00 4412 1.62 2.27 1.24 135 XM_B_Phish66 4380 1.45 2.26 0.99 136 XM_DIRTYINTL 4366 1.10 2.25 0.42 137 RELAYCOUNTRY_IN 4303 0.85 2.22 0.06 138 TR_Caps_n_Bayes_99 4172 0.81 2.15 0.03 139 TR_XM_SpoofStaff2 4167 0.79 2.15 0.00 140 URI_HEX 4117 1.53 2.12 1.19 141 XM_H_SpoofStaff4 4110 0.86 2.12 0.13 142 TR_XM_PSC1 4108 0.85 2.12 0.12 143 ANY_BOUNCE_MESSAGE 4101 9.84 2.11 14.32 144 BOUNCE_MESSAGE 4100 9.84 2.11 14.32 145 URI_ONLY_MSGID_MALF 3901 0.74 2.01 0.01 146 XMSubNoVowel 3888 1.65 2.00 1.44 147 URI_NO_WWW_BIZ_CGI 3810 0.72 1.96 0.01 148 HDR_ORDER_FTSDMCXX_DIRECT 3761 0.72 1.94 0.01 149 RELAYCOUNTRY_UA 3722 0.71 1.92 0.00 150 XM_DK_Undo_01 3680 1.56 1.90 1.36 151 MIME_HTML_ONLY_MULTI 3633 2.47 1.87 2.82 152 BOTNET_NORDNS 3335 0.64 1.72 0.01 153 XM_B_Unsub2 3323 1.32 1.71 1.09 154 DOS_OE_TO_MX 3313 0.63 1.71 0.00 155 TO_NO_BRKTS_HTML_ONLY 3257 0.67 1.68 0.09 156 XM_UB95 3251 0.62 1.68 0.01 157 MIME_QP_LONG_LINE 3235 3.23 1.67 4.13 158 FROM_EXCESS_BASE64 3195 2.50 1.65 3.00 159 HK_RANDOM_REPLYTO 3023 0.68 1.56 0.17 160 BAYES_40 2880 2.85 1.49 3.65 161 XM_URI_RBL 2738 0.61 1.41 0.14 162 XM_CamelCaseFrm001 2701 1.49 1.39 1.54 163 T_XMDrugObfuBody_14 2640 1.36 1.36 1.36 164 TR_Mismatch_TLD_01 2631 0.78 1.36 0.44 165 FROM_SUSPICIOUS_NTLD 2630 0.58 1.36 0.14 166 RDNS_DYNAMIC 2623 0.89 1.35 0.62 167 FROM_SUSPICIOUS_NTLD_FP 2535 0.56 1.31 0.12 168 XMBdyGiftCard01 2503 1.09 1.29 0.97 169 T_TooManySym_01 2491 3.45 1.28 4.71 170 RELAYCOUNTRY_DE 2475 0.62 1.28 0.24 171 HTML_FONT_SIZE_LARGE 2474 0.53 1.28 0.10 172 CK_HELO_DYNAMIC_SPLIT_IP 2455 1.55 1.27 1.71 173 FAKE_REPLY_C 2428 0.46 1.25 0.00 174 XMHTML_After_End 2393 0.76 1.23 0.48 175 URI_PHP_REDIR 2362 0.45 1.22 0.00 176 XMSexyCombo_01 2349 0.90 1.21 0.72 177 RCVD_IN_IADB_LISTED 2308 3.23 1.19 4.41 178 XMGenDplmaNmb 2237 0.80 1.15 0.60 179 XMSubMetaI_00 2211 0.71 1.14 0.47 180 ALL_TRUSTED 2193 15.02 1.13 23.07 181 FVGT_m_MULTI_ODD_EMAIL 2193 0.44 1.13 0.03 182 BAYES_20 2190 2.31 1.13 2.99 183 DOS_OUTLOOK_TO_MX 2124 0.41 1.10 0.01 184 XMStockSpam_06 2085 0.86 1.08 0.74 185 TR_XM_PHPDW 2085 0.58 1.08 0.30 186 RCVD_IN_IADB_SPF 2049 2.82 1.06 3.84 187 XMBody_78 2027 0.63 1.05 0.38 188 LongTLD 2026 0.46 1.04 0.12 189 TR_XM_PHPForged 1990 0.51 1.03 0.22 190 T_XMDrugObfuBody_00 1981 0.74 1.02 0.58 191 TR_XM_FormFill2 1979 0.51 1.02 0.22 192 XM_H_PHPOS 1973 0.51 1.02 0.21 193 XM_B_SpammyWords4 1963 0.66 1.01 0.46 194 MIME_CHARSET_FARAWAY 1939 0.42 1.00 0.09 195 RELAYCOUNTRY_BR 1917 0.37 0.99 0.01 196 RCVD_IN_IADB_DK 1899 2.49 0.98 3.36 197 RCVD_IN_IADB_SENDERID 1868 2.54 0.96 3.45 198 XM_Combo_Sbj 1843 0.54 0.95 0.30 199 TR_XM_MaxSPIKE 1842 0.35 0.95 0.00 200 REMOVE_BEFORE_LINK 1802 0.46 0.93 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 251513 80.97 90.92 75.20 2 RELAYCOUNTRY_US 243384 72.11 70.99 72.77 3 DKIM_SIGNED 237634 75.09 82.06 71.05 4 XM_DK_Pass 234755 73.98 80.52 70.19 5 DKIM_VALID 230279 72.76 79.49 68.85 6 XM_B_Unicode 217270 67.54 72.00 64.96 7 DCC_CHECK_NEGATIVE 194535 43.26 17.55 58.16 8 BAYES_50 183496 44.16 25.70 54.86 9 DKIM_VALID_AU 181951 57.16 61.91 54.40 10 XMListUnsubscribeExists 168971 56.83 67.71 50.52 11 XM_B_SpammyWords 146052 51.89 66.07 43.67 12 DCC_CHECK 136506 55.66 81.27 40.81 13 XM_B_Unicode3 125747 35.15 30.94 37.60 14 HTML_FONT_LOW_CONTRAST 90060 30.90 37.75 26.93 15 DKIM_VALID_EF 89354 29.03 33.02 26.71 16 RCVD_IN_MSPIKE_WL 86597 21.26 13.28 25.89 17 LOC_TINY_FONT_1 85201 28.73 34.34 25.47 18 RCVD_IN_MSPIKE_H2 84823 27.38 30.85 25.36 19 ALL_TRUSTED 77168 15.02 1.13 23.07 20 FVGT_m_MULTI_ODD 71370 23.73 27.86 21.34 21 T_TM2_M_HEADER_IN_MSG 66941 19.19 17.77 20.01 22 MIME_HTML_ONLY 64348 20.66 23.10 19.24 23 XM_B_SpammyWords2 61115 24.33 34.78 18.27 24 XMSubLong 54821 16.97 17.96 16.39 25 T_KAM_HTML_FONT_INVALID 52492 18.02 22.04 15.69 26 TM2_M_URI_OPT_OUT 52420 11.50 4.31 15.67 27 ANY_BOUNCE_MESSAGE 47889 9.84 2.11 14.32 28 BOUNCE_MESSAGE 47889 9.84 2.11 14.32 29 RCVD_IN_MSPIKE_H3 47225 11.54 7.10 14.12 30 XM_Body_Dirty_Words 41216 12.57 12.99 12.32 31 XM_Multi_Part_URI 39319 14.95 20.45 11.76 32 BAYES_00 37917 7.45 0.75 11.34 33 RCVD_IN_MSPIKE_H4 32238 8.06 5.33 9.64 34 XM_B_Unsub 31439 11.31 14.60 9.40 35 XM_DKIMWhitelistDomains 29910 5.67 0.02 8.94 36 RCVD_IN_RP_SAFE 29876 6.75 2.98 8.93 37 UNPARSEABLE_RELAY 28189 7.48 5.86 8.43 38 TR_XM_DK_Bayes 28084 5.53 0.59 8.40 39 RCVD_IN_RP_CERTIFIED 27811 6.11 2.32 8.31 40 LotsOfNums_01 27625 9.57 11.84 8.26 41 TR_XM_DK_Bayes1 27590 5.43 0.58 8.25 42 XM_Evil_Numbers_Gen 25577 7.05 6.02 7.65 43 XM_DK_Undo_02 25524 24.71 54.15 7.63 44 TR_XM_DK_Bayes2 25473 4.95 0.34 7.62 45 XM_SendGrid 25268 6.54 4.80 7.55 46 LOTS_OF_MONEY 24677 11.15 17.66 7.38 47 BAYES_60 24485 7.90 8.89 7.32 48 BAYES_05 23382 4.67 0.66 6.99 49 HTML_IMAGE_RATIO_02 21913 6.43 6.22 6.55 50 TR_XM_UnparsRelay 20658 5.97 5.62 6.18 51 FSL_BULK_SIG 19504 9.38 15.51 5.83 52 BAYES_99 18450 20.89 47.42 5.52 53 TooManyTo_001 18053 6.09 7.29 5.40 54 TR_XM_DKIM_Undo 18046 19.06 42.64 5.40 55 XM_H_Long_From01 17716 4.78 3.89 5.30 56 XMStrtUSub 17482 4.93 4.42 5.23 57 HTML_IMAGE_RATIO_04 17473 4.86 4.24 5.22 58 TR_XM_SpammyWords4 16507 9.12 16.34 4.94 59 TR_XM_DK_SendGrid 16100 4.14 2.98 4.81 60 BOTNET_IPINHOSTNAME 15877 8.60 15.24 4.75 61 T_TooManySym_01 15744 3.45 1.28 4.71 62 XM_B_Phish_Phrases 15489 4.51 4.31 4.63 63 MPART_ALT_DIFF 15080 6.71 10.52 4.51 64 BAYES_999 14974 17.45 39.84 4.48 65 BAYES_80 14798 6.03 8.79 4.42 66 XM_B_SpammyWords3 14794 6.15 9.12 4.42 67 RCVD_IN_IADB_LISTED 14740 3.23 1.19 4.41 68 IN_ZIMBRA_NJ_WHITELIST 14422 2.80 0.18 4.31 69 MIME_QP_LONG_LINE 13810 3.23 1.67 4.13 70 XMSexyCombo_05 13615 5.29 7.40 4.07 71 RELAYCOUNTRY_META 13290 12.40 26.92 3.97 72 RCVD_IN_IADB_SPF 12837 2.82 1.06 3.84 73 BAYES_40 12194 2.85 1.49 3.65 74 XMSubMetaSx_00 11561 4.04 5.05 3.46 75 RCVD_IN_IADB_SENDERID 11556 2.54 0.96 3.45 76 RCVD_IN_IADB_DK 11250 2.49 0.98 3.36 77 HTML_IMAGE_RATIO_06 11246 4.31 5.93 3.36 78 XM_UncommonTLD01 10868 7.79 15.62 3.25 79 XMNumbers 10504 3.35 3.72 3.14 80 FROM_EXCESS_BASE64 10040 2.50 1.65 3.00 81 BAYES_20 10016 2.31 1.13 2.99 82 T_REMOTE_IMAGE 9866 3.91 5.55 2.95 83 BAYES_95 9719 3.74 5.17 2.91 84 TR_DCC_Bayes_99 9662 16.14 39.00 2.89 85 T_TooManySym_02 9588 1.96 0.40 2.87 86 MIME_HTML_ONLY_MULTI 9427 2.47 1.87 2.82 87 RCVD_IN_IADB_VOUCHED 9047 1.91 0.54 2.70 88 XM_PDF 8502 1.72 0.29 2.54 89 MAILING_LIST_MULTI 8421 1.88 0.79 2.52 90 INVALID_MSGID 8302 1.74 0.45 2.48 91 UNTRUSTED_Relay 8146 9.16 20.76 2.44 92 MSGID_NOFQDN1 7779 1.49 0.06 2.33 93 URI_NOVOWEL 7644 1.77 0.87 2.29 94 MIME_HTML_MOSTLY 7612 5.12 10.03 2.28 95 DKIM_INVALID 7355 2.33 2.57 2.20 96 RCVD_IN_MSPIKE_H5 7134 1.66 0.85 2.13 97 TR_XM_PhishingBody 7078 2.74 3.82 2.12 98 XM_B_SpammyTLD 6888 3.36 5.61 2.06 99 T_FONT_INVIS_NAKED_TO 6855 2.82 4.14 2.05 100 HTML_IMAGE_RATIO_08 6842 3.14 5.02 2.05 101 TO_MALFORMED 6552 1.24 0.00 1.96 102 TVD_RCVD_IP 6405 1.44 0.62 1.91 103 RCVD_IN_IADB_OPTIN 5816 1.25 0.40 1.74 104 TR_Symld_Words 5740 3.18 5.71 1.72 105 CK_HELO_DYNAMIC_SPLIT_IP 5730 1.55 1.27 1.71 106 HELO_MISC_IP 5727 1.27 0.52 1.71 107 TR_XM_SpammyWords5 5552 3.17 5.76 1.66 108 XM_H_Trusted_IP 5496 1.04 0.00 1.64 109 XMGappySubj_01 5191 1.02 0.10 1.55 110 RELAYCOUNTRY_CA 5190 3.47 6.78 1.55 111 XM_CamelCaseFrm001 5152 1.49 1.39 1.54 112 XM_GoogleGroups 5146 1.11 0.37 1.54 113 IN_HORDE_ADDRESS_BOOK 5123 1.28 0.84 1.53 114 XM_UB50 5038 3.05 5.72 1.51 115 TR_LOTS_OF_MONEY3 4919 3.51 7.02 1.47 116 XMSubNoVowel 4812 1.65 2.00 1.44 117 BOTNET 4720 7.79 18.78 1.41 118 XMBSHREFv2 4663 0.94 0.15 1.39 119 XM_DK_Undo_01 4560 1.56 1.90 1.36 120 T_XMDrugObfuBody_14 4542 1.36 1.36 1.36 121 T_XMDrugObfuBody_08 4535 1.81 2.58 1.36 122 USER_IN_DEF_DKIM_WL 4503 0.86 0.03 1.35 123 SUBJ_ALL_CAPS 4476 2.25 3.82 1.34 124 URI_TRY_3LD 4359 2.09 3.45 1.30 125 HTML_MIME_NO_HTML_TAG 4315 2.70 5.12 1.29 126 T_TooManySym_03 4225 0.84 0.11 1.26 127 TR_XM_SB_Phish 4207 1.13 0.91 1.26 128 XMSubPhish11 4147 1.09 0.83 1.24 129 XMDiploma_00 4133 1.62 2.27 1.24 130 TM2_M_VERY_LONG_WORD 4006 2.68 5.25 1.20 131 URI_HEX 3968 1.53 2.12 1.19 132 XM_OfRef6 3779 1.92 3.27 1.13 133 HTML_FONT_FACE_BAD 3770 0.95 0.64 1.13 134 XMBody_95 3672 0.72 0.08 1.10 135 XM_B_Unsub2 3658 1.32 1.71 1.09 136 TooManyTo_002 3511 0.77 0.28 1.05 137 HELO_NODOT 3488 0.85 0.51 1.04 138 HELO_NO_DOMAIN 3488 0.85 0.51 1.04 139 XMBrknScrpt_02 3310 1.95 3.60 0.99 140 XM_B_Phish66 3307 1.45 2.26 0.99 141 XMBdyGiftCard01 3238 1.09 1.29 0.97 142 XM_H_Long_From02 3208 0.75 0.40 0.96 143 XM_SPF_SoftFail 3184 1.64 2.83 0.95 144 XMSubEmpty 3051 0.90 0.89 0.91 145 RCVD_IN_BL_SPAMCOP_NET 3020 4.72 11.31 0.90 146 KHOP_HELO_FCRDNS 2990 2.47 5.19 0.89 147 XM_ShortIntro_01 2944 0.78 0.60 0.88 148 DKIM_ADSP_CUSTOM_MED 2931 0.82 0.72 0.88 149 XMBody_17 2860 2.28 4.74 0.86 150 T_FILL_THIS_FORM_SHORT 2679 1.60 2.97 0.80 151 T_XMHurry_00 2676 1.57 2.89 0.80 152 DKIM_ADSP_NXDOMAIN 2607 0.77 0.75 0.78 153 NO_DNS_FOR_FROM 2520 0.65 0.47 0.75 154 XMStockSpam_06 2473 0.86 1.08 0.74 155 XM_B_COVIDMETA 2471 0.77 0.83 0.74 156 TR_MSPIKEBAYES00 2470 0.47 0.02 0.74 157 XM_ProductURIs 2465 0.75 0.79 0.74 158 T_TooManySym_04 2444 0.47 0.03 0.73 159 TVD_PH_BODY_ACCOUNTS_PRE 2419 0.49 0.10 0.72 160 TooManyTo_003 2407 0.53 0.21 0.72 161 XMSexyCombo_01 2393 0.90 1.21 0.72 162 TR_XM_SpammyWords2 2265 6.22 15.77 0.68 163 XM_S_SubURI 2234 0.44 0.04 0.67 164 HTTPS_HTTP_MISMATCH 2154 0.62 0.57 0.64 165 XMHTMLBadTable_001 2144 0.57 0.44 0.64 166 SHORTENED_URL_HREF 2094 0.63 0.63 0.63 167 RDNS_DYNAMIC 2084 0.89 1.35 0.62 168 PLING_QUERY 2066 0.55 0.44 0.62 169 XMGenDplmaNmb 2006 0.80 1.15 0.60 170 PDS_OTHER_BAD_TLD 2003 1.95 4.28 0.60 171 RELAYCOUNTRY_GB 2002 0.60 0.61 0.60 172 USER_IN_WELCOMELIST 1969 0.37 0.00 0.59 173 USER_IN_WHITELIST 1969 0.37 0.00 0.59 174 FORGED_GMAIL_RCVD 1958 0.61 0.65 0.59 175 T_XMDrugObfuBody_00 1932 0.74 1.02 0.58 176 NML_ADSP_CUSTOM_MED 1895 0.60 0.65 0.57 177 TooManyTo_004 1865 0.42 0.19 0.56 178 T_TooManySym_05 1863 0.35 0.01 0.56 179 XM_B_REG_HTML 1828 0.43 0.23 0.55 180 TR_MetaPhish_Combo_01 1813 0.50 0.43 0.54 181 SUBJ_DOLLARS 1798 0.59 0.69 0.54 182 URIBL_SBL_A 1706 5.38 13.78 0.51 183 XM_D_tchamptons_WL 1673 0.32 0.02 0.50 184 FROM_GOV_DKIM_AU 1665 0.33 0.04 0.50 185 HTML_TAG_BALANCE_BODY 1645 0.64 0.89 0.49 186 TooManyTo_005 1637 0.37 0.18 0.49 187 XMHTML_After_End 1616 0.76 1.23 0.48 188 DIET_1 1568 0.55 0.68 0.47 189 XMSubMetaI_00 1565 0.71 1.14 0.47 190 T_Symld_Words_02 1532 2.30 5.48 0.46 191 SpammyFromTLD_01 1531 2.85 6.98 0.46 192 XM_B_SpammyWords4 1530 0.66 1.01 0.46 193 NUMERIC_HTTP_ADDR 1501 0.37 0.24 0.45 194 XMNoVowels 1491 0.40 0.33 0.45 195 TR_Mismatch_TLD_01 1485 0.78 1.36 0.44 196 TVD_SPACE_RATIO 1465 2.08 4.92 0.44 197 XM_B_COPY_HTML 1441 0.41 0.38 0.43 198 XMLngstWrd_00 1421 0.51 0.66 0.42 199 XM_DIRTYINTL 1421 1.10 2.25 0.42 200 XM_H_PHPMailer 1367 0.42 0.45 0.41 ----------------------------------------------------------------------