Email: 628614 Autolearn: 0 AvgScore: -4.85 AvgScanTime: 1.17 sec Spam: 138957 Autolearn: 0 AvgScore: 14.23 AvgScanTime: 1.38 sec Ham: 489657 Autolearn: 0 AvgScore: -10.26 AvgScanTime: 1.11 sec Time Spent Running SA: 204.21 hours Time Spent Processing Spam: 53.27 hours Time Spent Processing Ham: 150.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132907 89.77 95.65 88.11 2 DKIM_SIGNED 117493 64.02 84.55 58.20 3 XM_DK_Pass 113864 62.51 81.94 57.00 4 DKIM_VALID 111290 60.84 80.09 55.37 5 DCC_CHECK 107150 41.41 77.11 31.28 6 XM_B_Unicode 102629 73.36 73.86 73.22 7 RELAYCOUNTRY_US 100154 75.36 72.08 76.30 8 XMListUnsubscribeExists 95539 42.51 68.75 35.07 9 XM_B_SpammyWords 93175 46.55 67.05 40.74 10 DKIM_VALID_AU 81573 45.80 58.70 42.14 11 XM_DK_Undo_02 64743 15.01 46.59 6.05 12 XM_B_Unicode3 53809 39.88 38.72 40.21 13 BAYES_50 52946 46.62 38.10 49.04 14 LOC_TINY_FONT_1 52607 21.85 37.86 17.31 15 XM_B_SpammyWords2 52599 19.19 37.85 13.89 16 TR_XM_DKIM_Undo 50125 11.59 36.07 4.64 17 BAYES_99 47049 11.18 33.86 4.74 18 DKIM_VALID_EF 46355 25.84 33.36 23.71 19 HTML_FONT_LOW_CONTRAST 45558 28.64 32.79 27.47 20 MIME_HTML_ONLY 43483 23.59 31.29 21.40 21 T_KAM_HTML_FONT_INVALID 43038 17.12 30.97 13.19 22 XMSubLong 36817 20.28 26.50 18.52 23 FVGT_m_MULTI_ODD 36197 20.14 26.05 18.46 24 TR_DCC_Bayes_99 36031 7.30 25.93 2.01 25 BAYES_999 36025 8.75 25.93 3.88 26 RCVD_IN_MSPIKE_H2 35678 20.99 25.68 19.66 27 RELAYCOUNTRY_META 32623 8.33 23.48 4.04 28 XM_Body_Dirty_Words 30389 11.58 21.87 8.67 29 T_TM2_M_HEADER_IN_MSG 29711 24.58 21.38 25.49 30 RCVD_IN_MSPIKE_WL 29218 24.15 21.03 25.04 31 DCC_CHECK_NEGATIVE 27953 56.35 20.12 66.64 32 UNTRUSTED_Relay 27797 5.54 20.00 1.44 33 XM_UncommonTLD01 25695 6.45 18.49 3.03 34 BOTNET 23869 4.75 17.18 1.22 35 XM_Multi_Part_URI 20417 9.86 14.69 8.48 36 FSL_BULK_SIG 20224 8.02 14.55 6.16 37 BOTNET_IPINHOSTNAME 20184 5.81 14.53 3.34 38 XM_B_Unsub 19253 8.83 13.86 7.40 39 MPART_ALT_DIFF 18585 10.42 13.37 9.59 40 LOTS_OF_MONEY 17743 7.10 12.77 5.49 41 XMSexyCombo_05 17222 4.56 12.39 2.34 42 XM_B_SpammyWords3 15910 4.88 11.45 3.02 43 TR_XM_SpammyWords2 15824 3.12 11.39 0.77 44 RCVD_IN_MSPIKE_H3 15683 12.01 11.29 12.22 45 TR_XM_SpammyWords4 15503 4.95 11.16 3.18 46 XM_H_Long_From01 14796 5.55 10.65 4.10 47 MIME_HTML_MOSTLY 14107 3.91 10.15 2.13 48 UNPARSEABLE_RELAY 13928 6.34 10.02 5.29 49 TR_XM_UnparsRelay 13738 5.59 9.89 4.38 50 RCVD_IN_BL_SPAMCOP_NET 13280 2.67 9.56 0.71 51 BAYES_80 13158 5.11 9.47 3.87 52 XM_Evil_Numbers_Gen 12740 8.03 9.17 7.71 53 BAYES_60 12372 7.73 8.90 7.39 54 RCVD_IN_MSPIKE_H4 11940 9.09 8.59 9.23 55 LotsOfNums_01 11578 7.17 8.33 6.84 56 XMSubMetaSx_00 11106 3.93 7.99 2.77 57 SpammyFromTLD_01 10584 2.39 7.62 0.91 58 XM_B_Phish_Phrases 10184 5.52 7.33 5.01 59 XMNumbers 9599 3.66 6.91 2.74 60 XM_SendGrid 9596 5.03 6.91 4.50 61 SpammyFromTLD_02 9070 1.69 6.53 0.32 62 HTML_IMAGE_RATIO_02 8921 4.67 6.42 4.18 63 XM_UB50 8477 2.11 6.10 0.97 64 T_REMOTE_IMAGE 8414 9.14 6.06 10.01 65 KHOP_HELO_FCRDNS 8298 2.43 5.97 1.43 66 TR_XM_PhishingBody 8100 3.31 5.83 2.60 67 RELAYCOUNTRY_CA 7779 1.99 5.60 0.97 68 TooManyTo_001 7655 6.94 5.51 7.34 69 BAYES_95 7602 2.88 5.47 2.14 70 RELAYCOUNTRY_FR 7537 1.36 5.42 0.21 71 XM_B_SpammyTLD 7307 2.30 5.26 1.46 72 XM_UB99 7052 1.13 5.07 0.01 73 HTML_IMAGE_RATIO_04 6985 13.44 5.03 15.83 74 XM_DIRTYINTL 6951 1.36 5.00 0.33 75 HTML_FONT_SIZE_LARGE 6757 1.13 4.86 0.07 76 XMStrtUSub 6682 10.52 4.81 12.15 77 DKIM_INVALID 6203 3.19 4.46 2.82 78 XM_SPF_SoftFail 6022 2.31 4.33 1.74 79 URIBL_SBL_A 5983 1.07 4.31 0.15 80 RCVD_IN_MSPIKE_BL 5869 1.12 4.22 0.24 81 PDS_OTHER_BAD_TLD 5808 1.01 4.18 0.11 82 TR_XM_MSPIKECOMBO 5808 1.10 4.18 0.23 83 BODY_URI_ONLY 5607 0.90 4.04 0.01 84 TM2_M_URI_OPT_OUT 5539 2.79 3.99 2.45 85 HTML_IMAGE_ONLY_12 5451 0.98 3.92 0.15 86 MIME_QP_LONG_LINE 5407 4.22 3.89 4.31 87 TR_XM_SpammyWords5 5332 1.66 3.84 1.04 88 MIXED_FONT_CASE 5331 0.85 3.84 0.00 89 TR_XM_DK_SendGrid 5259 3.05 3.78 2.84 90 HTML_IMAGE_RATIO_06 5028 4.25 3.62 4.43 91 XM_UB999 4925 0.79 3.54 0.01 92 XM_UB60 4710 0.84 3.39 0.11 93 MIME_HTML_ONLY_MULTI 4668 6.95 3.36 7.98 94 XM_B_COVIDMETA 4476 1.34 3.22 0.80 95 T_XMDrugObfuBody_08 4467 1.81 3.21 1.41 96 JH_SPAMMY_PATTERN01 4436 0.71 3.19 0.00 97 HTML_SHORT_LINK_IMG_1 4411 0.71 3.17 0.02 98 XM_OfRef6 4392 1.27 3.16 0.73 99 XM_UB80 4347 0.72 3.13 0.03 100 XM_B_Phish66 4264 1.88 3.07 1.54 101 XMSexyCombo_01 4204 1.01 3.03 0.44 102 RCVD_IN_RP_SAFE 3789 4.84 2.73 5.43 103 RCVD_IN_RP_RNBL 3668 0.60 2.64 0.03 104 RCVD_IN_IADB_LISTED 3597 3.70 2.59 4.02 105 HTML_IMAGE_RATIO_08 3556 1.98 2.56 1.82 106 XMDiploma_00 3506 1.42 2.52 1.10 107 URI_PHP_REDIR 3482 0.55 2.51 0.00 108 RCVD_IN_MSPIKE_L5 3479 0.59 2.50 0.05 109 T_XMDrugObfuBody_14 3469 1.67 2.50 1.43 110 XM_B_Unsub2 3415 1.53 2.46 1.27 111 TR_XM_SB_Phish 3414 2.13 2.46 2.04 112 TR_XM_SpammyWords3 3333 0.65 2.40 0.15 113 XM_DK_Undo_01 3259 1.75 2.35 1.58 114 RCVD_IN_IADB_SPF 3256 3.23 2.34 3.48 115 TM2_M_VERY_LONG_WORD 3163 1.29 2.28 1.00 116 XMSubPhish11 3135 2.07 2.26 2.02 117 RCVD_IN_IADB_DK 3069 2.83 2.21 3.01 118 RCVD_IN_IADB_SENDERID 3066 2.92 2.21 3.12 119 XM_CamelCaseFrm001 3064 1.46 2.20 1.25 120 T_TooManySym_01 3011 3.84 2.17 4.31 121 XMSexyCombo_04 3010 0.60 2.17 0.15 122 URI_NO_WWW_BIZ_CGI 2940 0.47 2.12 0.01 123 SUBJ_ALL_CAPS 2845 1.34 2.05 1.14 124 FROM_EXCESS_BASE64 2835 2.15 2.04 2.18 125 MAILING_LIST_MULTI 2787 2.45 2.01 2.58 126 XM_URI_RBL 2750 0.52 1.98 0.11 127 RCVD_IN_RP_CERTIFIED 2689 4.20 1.94 4.85 128 URIBL_DBL_SPAM 2688 0.43 1.93 0.01 129 XM_UB95 2619 0.43 1.88 0.01 130 URI_HEX 2595 1.43 1.87 1.30 131 TR_XM_MaxBayes 2590 0.41 1.86 0.00 132 BOTNET_NORDNS 2495 0.41 1.80 0.02 133 XMBody_17 2460 0.74 1.77 0.45 134 FROM_SUSPICIOUS_NTLD 2460 0.41 1.77 0.02 135 XM_B_SpammyWords4 2455 0.59 1.77 0.25 136 RCVD_IN_PSBL 2447 0.46 1.76 0.09 137 RELAYCOUNTRY_DE 2380 0.84 1.71 0.59 138 FROM_SUSPICIOUS_NTLD_FP 2357 0.39 1.70 0.02 139 HTML_MIME_NO_HTML_TAG 2352 2.15 1.69 2.28 140 XMStockSpam_06 2349 0.93 1.69 0.72 141 BAYES_40 2320 7.55 1.67 9.21 142 URI_NOVOWEL 2310 2.01 1.66 2.11 143 TR_XM_COVIDMETA4 2285 0.72 1.64 0.46 144 USER_IN_DEF_DKIM_WL 2250 7.20 1.62 8.78 145 XMHTML_After_End 2246 1.11 1.62 0.96 146 HK_RANDOM_REPLYTO 2244 0.49 1.61 0.18 147 XMBrknScrpt_02 2235 0.95 1.61 0.76 148 URIBL_BLACK 2223 0.37 1.60 0.02 149 HTTPS_HTTP_MISMATCH 2124 0.86 1.53 0.67 150 T_XMDrugObfuBody_00 2116 0.79 1.52 0.58 151 TR_XM_BayesRelay 2098 0.34 1.51 0.01 152 XM_H_Undi_Recip 2079 0.46 1.50 0.16 153 TR_XM_COVIDMETA1 2062 0.53 1.48 0.26 154 RELAYCOUNTRY_GB 2054 1.08 1.48 0.97 155 TR_XM_PHPDW 1980 0.50 1.42 0.23 156 XM_B_SEO 1979 0.40 1.42 0.11 157 LongTLD 1978 0.41 1.42 0.12 158 URI_TRY_3LD 1974 0.88 1.42 0.73 159 TR_Symld_Words 1929 1.61 1.39 1.68 160 DKIM_ADSP_CUSTOM_MED 1866 0.97 1.34 0.86 161 TR_XM_PHPForged 1848 0.45 1.33 0.20 162 T_FILL_THIS_FORM_SHORT 1826 0.88 1.31 0.76 163 ALL_TRUSTED 1816 16.67 1.31 21.04 164 TR_XM_FormFill2 1802 0.45 1.30 0.21 165 XM_H_PHPOS 1799 0.44 1.29 0.20 166 TR_XM_SEO4 1784 0.33 1.28 0.06 167 TR_XM_INV_DKIM 1745 0.31 1.26 0.05 168 XMGenDplmaNmb 1706 0.81 1.23 0.69 169 DIET_1 1669 0.48 1.20 0.27 170 XM_ProductURIs 1662 0.80 1.20 0.69 171 T_XMHurry_00 1646 0.53 1.18 0.34 172 FORGED_GMAIL_RCVD 1629 0.63 1.17 0.47 173 XMSubMetaI_00 1627 0.54 1.17 0.36 174 BAYES_20 1602 5.84 1.15 7.17 175 XM_PDF 1597 3.68 1.15 4.40 176 RCVD_IN_MSPIKE_H5 1595 3.05 1.15 3.59 177 RELAYCOUNTRY_IN 1565 0.34 1.13 0.11 178 NML_ADSP_CUSTOM_MED 1543 0.65 1.11 0.52 179 XMPhish30 1533 0.61 1.10 0.46 180 XMMoneyMeta_00 1520 0.65 1.09 0.53 181 RCVD_IN_IADB_VOUCHED 1464 2.15 1.05 2.47 182 XM_BadFromFormat 1444 0.36 1.04 0.17 183 ADMITS_SPAM 1439 0.35 1.04 0.15 184 HTML_IMAGE_ONLY_20 1429 0.76 1.03 0.69 185 XMSlimDrugH 1401 0.41 1.01 0.24 186 XM_Body_Dirty_Words_01 1383 0.30 1.00 0.10 187 RELAYCOUNTRY_AU 1360 0.46 0.98 0.32 188 XM_OfRef7 1330 0.30 0.96 0.12 189 HK_RANDOM_FROM 1321 0.31 0.95 0.13 190 FSL_THIS_IS_ADV 1317 0.30 0.95 0.11 191 XM_H_Long_From02 1315 0.89 0.95 0.87 192 TR_LOTS_OF_MONEY3 1293 0.30 0.93 0.11 193 RCVD_IN_MSPIKE_L3 1269 0.29 0.91 0.11 194 XMPhish08 1268 0.30 0.91 0.13 195 TR_Mismatch_TLD_02 1258 0.25 0.91 0.07 196 MONEY_NOHTML 1258 0.26 0.91 0.08 197 XMBody_78 1252 0.43 0.90 0.30 198 HTML_FONT_FACE_BAD 1229 10.99 0.88 13.85 199 TR_MetaPhish_Combo_01 1214 0.66 0.87 0.60 200 TR_BOTNET_NEGATE 1189 0.41 0.86 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 431418 89.77 95.65 88.11 2 RELAYCOUNTRY_US 373594 75.36 72.08 76.30 3 XM_B_Unicode 358539 73.36 73.86 73.22 4 DCC_CHECK_NEGATIVE 326288 56.35 20.12 66.64 5 DKIM_SIGNED 284971 64.02 84.55 58.20 6 XM_DK_Pass 279102 62.51 81.94 57.00 7 DKIM_VALID 271145 60.84 80.09 55.37 8 BAYES_50 240116 46.62 38.10 49.04 9 DKIM_VALID_AU 206324 45.80 58.70 42.14 10 XM_B_SpammyWords 199464 46.55 67.05 40.74 11 XM_B_Unicode3 196880 39.88 38.72 40.21 12 XMListUnsubscribeExists 171705 42.51 68.75 35.07 13 DCC_CHECK 153174 41.41 77.11 31.28 14 HTML_FONT_LOW_CONTRAST 134488 28.64 32.79 27.47 15 T_TM2_M_HEADER_IN_MSG 124831 24.58 21.38 25.49 16 RCVD_IN_MSPIKE_WL 122613 24.15 21.03 25.04 17 DKIM_VALID_EF 116082 25.84 33.36 23.71 18 MIME_HTML_ONLY 104794 23.59 31.29 21.40 19 ALL_TRUSTED 103001 16.67 1.31 21.04 20 RCVD_IN_MSPIKE_H2 96278 20.99 25.68 19.66 21 XMSubLong 90681 20.28 26.50 18.52 22 FVGT_m_MULTI_ODD 90377 20.14 26.05 18.46 23 LOC_TINY_FONT_1 84761 21.85 37.86 17.31 24 HTML_IMAGE_RATIO_04 77498 13.44 5.03 15.83 25 XM_H_Trusted_IP 73438 11.68 0.00 15.00 26 XM_B_SpammyWords2 68036 19.19 37.85 13.89 27 HTML_FONT_FACE_BAD 67829 10.99 0.88 13.85 28 BAYES_00 65316 10.56 0.79 13.34 29 T_KAM_HTML_FONT_INVALID 64581 17.12 30.97 13.19 30 RCVD_IN_MSPIKE_H3 59818 12.01 11.29 12.22 31 XMStrtUSub 59473 10.52 4.81 12.15 32 T_REMOTE_IMAGE 49033 9.14 6.06 10.01 33 MPART_ALT_DIFF 46944 10.42 13.37 9.59 34 RCVD_IN_MSPIKE_H4 45192 9.09 8.59 9.23 35 BAYES_40 45114 7.55 1.67 9.21 36 USER_IN_DEF_DKIM_WL 42996 7.20 1.62 8.78 37 XM_Body_Dirty_Words 42430 11.58 21.87 8.67 38 XM_Multi_Part_URI 41533 9.86 14.69 8.48 39 MIME_HTML_ONLY_MULTI 39052 6.95 3.36 7.98 40 XM_DKIMWhitelistDomains 38094 6.06 0.01 7.78 41 XM_Evil_Numbers_Gen 37740 8.03 9.17 7.71 42 XM_B_Unsub 36251 8.83 13.86 7.40 43 MISSING_HEADERS 36224 5.90 0.63 7.40 44 BAYES_60 36190 7.73 8.90 7.39 45 TooManyTo_001 35946 6.94 5.51 7.34 46 XM_H_SpoofStaff4 35837 5.74 0.16 7.32 47 BAYES_20 35105 5.84 1.15 7.17 48 XMSUPPORT 34239 5.45 0.00 6.99 49 LotsOfNums_01 33506 7.17 8.33 6.84 50 FSL_BULK_SIG 30173 8.02 14.55 6.16 51 XM_DK_Undo_02 29613 15.01 46.59 6.05 52 LOTS_OF_MONEY 26859 7.10 12.77 5.49 53 RCVD_IN_RP_SAFE 26611 4.84 2.73 5.43 54 UNPARSEABLE_RELAY 25912 6.34 10.02 5.29 55 XM_B_Phish_Phrases 24522 5.52 7.33 5.01 56 TR_XM_DK_Bayes 23956 3.91 0.45 4.89 57 RCVD_IN_RP_CERTIFIED 23742 4.20 1.94 4.85 58 BAYES_99 23201 11.18 33.86 4.74 59 TR_XM_DK_Bayes1 23055 3.76 0.44 4.71 60 TR_XM_DKIM_Undo 22739 11.59 36.07 4.64 61 XMSubNoVowel 22650 3.79 0.84 4.63 62 XM_SendGrid 22019 5.03 6.91 4.50 63 HTML_IMAGE_RATIO_06 21714 4.25 3.62 4.43 64 XM_PDF 21561 3.68 1.15 4.40 65 TR_XM_UnparsRelay 21424 5.59 9.89 4.38 66 T_TooManySym_01 21109 3.84 2.17 4.31 67 MIME_QP_LONG_LINE 21107 4.22 3.89 4.31 68 IN_ZIMBRA_NJ_WHITELIST 20672 3.30 0.05 4.22 69 HTML_IMAGE_RATIO_02 20462 4.67 6.42 4.18 70 XM_H_Long_From01 20099 5.55 10.65 4.10 71 RELAYCOUNTRY_META 19770 8.33 23.48 4.04 72 RCVD_IN_IADB_LISTED 19661 3.70 2.59 4.02 73 TR_XM_DK_Bayes2 19593 3.19 0.33 4.00 74 BAYES_999 18984 8.75 25.93 3.88 75 BAYES_80 18937 5.11 9.47 3.87 76 RCVD_IN_MSPIKE_H5 17603 3.05 1.15 3.59 77 RCVD_IN_IADB_SPF 17055 3.23 2.34 3.48 78 BOTNET_IPINHOSTNAME 16368 5.81 14.53 3.34 79 TR_XM_SpammyWords4 15590 4.95 11.16 3.18 80 RCVD_IN_IADB_SENDERID 15263 2.92 2.21 3.12 81 BAYES_05 15199 2.55 0.59 3.10 82 ANY_BOUNCE_MESSAGE 14882 2.55 0.80 3.04 83 BOUNCE_MESSAGE 14880 2.54 0.80 3.04 84 XM_UncommonTLD01 14861 6.45 18.49 3.03 85 XM_B_SpammyWords3 14793 4.88 11.45 3.02 86 RCVD_IN_IADB_DK 14717 2.83 2.21 3.01 87 TR_XM_DK_SendGrid 13926 3.05 3.78 2.84 88 DKIM_INVALID 13826 3.19 4.46 2.82 89 XMSubMetaSx_00 13570 3.93 7.99 2.77 90 XMNumbers 13428 3.66 6.91 2.74 91 TR_XM_PhishingBody 12734 3.31 5.83 2.60 92 MAILING_LIST_MULTI 12613 2.45 2.01 2.58 93 RCVD_IN_IADB_VOUCHED 12076 2.15 1.05 2.47 94 TM2_M_URI_OPT_OUT 11999 2.79 3.99 2.45 95 XMSexyCombo_05 11455 4.56 12.39 2.34 96 HTML_MIME_NO_HTML_TAG 11167 2.15 1.69 2.28 97 FROM_EXCESS_BASE64 10677 2.15 2.04 2.18 98 BAYES_95 10479 2.88 5.47 2.14 99 MIME_HTML_MOSTLY 10447 3.91 10.15 2.13 100 URI_NOVOWEL 10323 2.01 1.66 2.11 101 TooManyTo_002 10020 1.78 0.85 2.05 102 TR_XM_SB_Phish 9996 2.13 2.46 2.04 103 T_TooManySym_02 9869 1.72 0.66 2.02 104 XMSubPhish11 9868 2.07 2.26 2.02 105 TR_DCC_Bayes_99 9847 7.30 25.93 2.01 106 HTML_IMAGE_RATIO_08 8899 1.98 2.56 1.82 107 XM_SPF_SoftFail 8516 2.31 4.33 1.74 108 XMSubGarbage 8322 1.41 0.39 1.70 109 HELO_NO_DOMAIN 8226 1.43 0.54 1.68 110 HELO_NODOT 8226 1.43 0.55 1.68 111 TR_Symld_Words 8212 1.61 1.39 1.68 112 XMSubLongNoVowel 8089 1.40 0.50 1.65 113 XM_DK_Undo_01 7737 1.75 2.35 1.58 114 RCVD_IN_IADB_OPTIN 7666 1.36 0.63 1.57 115 XM_B_Phish66 7531 1.88 3.07 1.54 116 IN_HORDE_ADDRESS_BOOK 7335 1.18 0.07 1.50 117 XM_B_SpammyTLD 7165 2.30 5.26 1.46 118 UNTRUSTED_Relay 7054 5.54 20.00 1.44 119 T_XMDrugObfuBody_14 7022 1.67 2.50 1.43 120 KHOP_HELO_FCRDNS 6993 2.43 5.97 1.43 121 INVALID_MSGID 6946 1.19 0.37 1.42 122 T_XMDrugObfuBody_08 6911 1.81 3.21 1.41 123 TooManyTo_003 6667 1.21 0.69 1.36 124 XMCapTrack 6456 1.15 0.54 1.32 125 URI_HEX 6369 1.43 1.87 1.30 126 TVD_RCVD_IP 6244 1.06 0.30 1.28 127 XM_B_Unsub2 6218 1.53 2.46 1.27 128 TO_MALFORMED 6166 0.99 0.05 1.26 129 XM_CamelCaseFrm001 6126 1.46 2.20 1.25 130 BOTNET 5964 4.75 17.18 1.22 131 XM_GoogleGroups 5595 1.03 0.64 1.14 132 SUBJ_ALL_CAPS 5560 1.34 2.05 1.14 133 XMDiploma_00 5396 1.42 2.52 1.10 134 TR_XM_SpammyWords5 5107 1.66 3.84 1.04 135 XM_E_Blogspot 5091 0.83 0.11 1.04 136 TM2_M_VERY_LONG_WORD 4916 1.29 2.28 1.00 137 XMGappySubj_01 4900 0.80 0.11 1.00 138 TooManyTo_004 4836 0.90 0.60 0.99 139 XM_UB50 4762 2.11 6.10 0.97 140 RELAYCOUNTRY_CA 4760 1.99 5.60 0.97 141 RELAYCOUNTRY_GB 4741 1.08 1.48 0.97 142 XMHTML_After_End 4712 1.11 1.62 0.96 143 SpammyFromTLD_01 4470 2.39 7.62 0.91 144 XM_H_Long_From02 4254 0.89 0.95 0.87 145 DKIM_ADSP_CUSTOM_MED 4219 0.97 1.34 0.86 146 TooManyTo_005 3920 0.74 0.51 0.80 147 XM_B_COVIDMETA 3917 1.34 3.22 0.80 148 TR_XM_SpammyWords2 3776 3.12 11.39 0.77 149 T_FILL_THIS_FORM_SHORT 3720 0.88 1.31 0.76 150 XMBrknScrpt_02 3711 0.95 1.61 0.76 151 URI_TRY_3LD 3577 0.88 1.42 0.73 152 XM_OfRef6 3570 1.27 3.16 0.73 153 XMStockSpam_06 3508 0.93 1.69 0.72 154 RCVD_IN_BL_SPAMCOP_NET 3481 2.67 9.56 0.71 155 XMBSHREFv2 3444 0.59 0.20 0.70 156 XM_ProductURIs 3384 0.80 1.20 0.69 157 XMGenDplmaNmb 3383 0.81 1.23 0.69 158 HTML_IMAGE_ONLY_20 3362 0.76 1.03 0.69 159 HTTPS_HTTP_MISMATCH 3300 0.86 1.53 0.67 160 T_TooManySym_03 2994 0.52 0.19 0.61 161 TR_MetaPhish_Combo_01 2927 0.66 0.87 0.60 162 RELAYCOUNTRY_DE 2909 0.84 1.71 0.59 163 T_XMDrugObfuBody_00 2838 0.79 1.52 0.58 164 XMBody_95 2820 0.47 0.09 0.58 165 T_OBFU_PDF_ATTACH 2759 0.47 0.12 0.56 166 FROM_GOV_SPOOF 2728 0.48 0.19 0.56 167 XMNoVowels 2644 0.60 0.79 0.54 168 XMMoneyMeta_00 2588 0.65 1.09 0.53 169 RCVD_IN_SORBS_DUL 2566 0.46 0.25 0.52 170 NML_ADSP_CUSTOM_MED 2555 0.65 1.11 0.52 171 XMLngstWrd_00 2541 0.57 0.73 0.52 172 XM_ShortIntro_01 2450 0.51 0.53 0.50 173 XM_SPF_Unknown 2437 0.55 0.75 0.50 174 TR_MSPIKEBAYES00 2398 0.38 0.00 0.49 175 MSGID_FROM_MTA_HEADER 2324 0.42 0.24 0.47 176 FORGED_GMAIL_RCVD 2311 0.63 1.17 0.47 177 XMLngstWrd_01 2307 0.52 0.71 0.47 178 TM2_M_BODY_EMPTY 2300 0.39 0.11 0.47 179 XMPhish30 2273 0.61 1.10 0.46 180 XM_H_PHPMailer 2270 0.51 0.68 0.46 181 XMSubMetaSxObfu_03 2266 0.49 0.60 0.46 182 SHORT_HELO_AND_INLINE_IMAGE 2260 0.39 0.16 0.46 183 TR_XM_COVIDMETA4 2249 0.72 1.64 0.46 184 XMBody_17 2216 0.74 1.77 0.45 185 XM_B_COPY_HTML 2216 0.48 0.56 0.45 186 XMBdyGiftCard01 2177 0.51 0.74 0.44 187 MSGID_NOFQDN1 2158 0.35 0.03 0.44 188 XMSexyCombo_01 2138 1.01 3.03 0.44 189 TVD_SPACE_RATIO 2007 0.35 0.13 0.41 190 HTML_IMAGE_ONLY_28 1996 0.44 0.54 0.41 191 TVD_SPACE_RATIO_MINFP 1995 0.39 0.31 0.41 192 XMPhish14 1973 0.50 0.83 0.40 193 XM_S_SpammyWords 1958 0.46 0.68 0.40 194 TR_XM_Spammywords 1957 0.46 0.68 0.40 195 XMLngstWrd_02 1889 0.42 0.55 0.39 196 XM_B_REG_HTML 1813 0.38 0.42 0.37 197 HTML_IMAGE_ONLY_32 1809 0.34 0.25 0.37 198 XMSubMetaI_00 1764 0.54 1.17 0.36 199 FROM_GOV_DKIM_AU 1764 0.37 0.41 0.36 200 RDNS_DYNAMIC 1741 0.43 0.69 0.36 ----------------------------------------------------------------------