Email: 427947 Autolearn: 0 AvgScore: 2.73 AvgScanTime: 1.16 sec Spam: 73574 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 2.41 sec Ham: 354373 Autolearn: 0 AvgScore: 0.39 AvgScanTime: 0.90 sec Time Spent Running SA: 137.57 hours Time Spent Processing Spam: 49.33 hours Time Spent Processing Ham: 88.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70139 58.25 95.33 50.55 2 DKIM_SIGNED 61934 64.00 84.18 59.81 3 XM_DK_Pass 58611 60.27 79.66 56.24 4 DCC_CHECK 58503 35.10 79.52 25.88 5 XM_B_Unicode 58486 61.70 79.49 58.00 6 RELAYCOUNTRY_US 57596 50.53 78.28 44.77 7 DKIM_VALID 57362 57.33 77.97 53.04 8 XMListUnsubscribeExists 52084 38.63 70.79 31.95 9 XM_B_SpammyWords 49536 35.80 67.33 29.26 10 DKIM_VALID_AU 43775 48.14 59.50 45.78 11 XM_B_Unicode3 33950 29.12 46.14 25.58 12 XM_DK_Undo_02 33069 11.74 44.95 4.84 13 XM_B_SpammyWords2 28674 16.64 38.97 12.01 14 BAYES_50 28421 48.17 38.63 50.15 15 LOC_TINY_FONT_1 27391 19.58 37.23 15.91 16 TR_XM_DKIM_Undo 26207 9.18 35.62 3.69 17 HTML_FONT_LOW_CONTRAST 26072 23.24 35.44 20.70 18 BAYES_99 24683 9.31 33.55 4.27 19 MIME_HTML_ONLY 24331 17.24 33.07 13.96 20 RCVD_IN_MSPIKE_H2 21461 16.46 29.17 13.82 21 DKIM_VALID_EF 20890 18.23 28.39 16.12 22 TR_DCC_Bayes_99 19718 6.50 26.80 2.28 23 FVGT_m_MULTI_ODD 19711 15.38 26.79 13.01 24 T_KAM_HTML_FONT_INVALID 19644 14.96 26.70 12.52 25 BAYES_999 18864 7.32 25.64 3.52 26 XM_Body_Dirty_Words 17248 27.49 23.44 28.33 27 XMSubLong 17217 13.94 23.40 11.97 28 RCVD_IN_MSPIKE_WL 15149 18.18 20.59 17.68 29 DCC_CHECK_NEGATIVE 15051 64.88 20.46 74.10 30 T_TM2_M_HEADER_IN_MSG 15043 29.38 20.45 31.24 31 RELAYCOUNTRY_META 14272 21.36 19.40 21.77 32 XM_Multi_Part_URI 12866 10.77 17.49 9.38 33 BOTNET 11701 3.46 15.90 0.88 34 UNPARSEABLE_RELAY 11190 7.16 15.21 5.49 35 FSL_BULK_SIG 11072 7.22 15.05 5.60 36 TR_XM_UnparsRelay 10870 6.10 14.77 4.30 37 XM_B_SpammyWords3 10388 4.86 14.12 2.94 38 TR_XM_SpammyWords2 10090 3.31 13.71 1.15 39 XM_UncommonTLD01 9673 4.28 13.15 2.44 40 UNTRUSTED_Relay 9348 19.29 12.71 20.66 41 BOTNET_IPINHOSTNAME 9345 4.68 12.70 3.02 42 TR_XM_SpammyRelay 8897 2.72 12.09 0.78 43 XMSexyCombo_05 8330 18.91 11.32 20.49 44 XM_B_Unsub 8115 7.38 11.03 6.62 45 LOTS_OF_MONEY 8085 4.97 10.99 3.72 46 RCVD_IN_MSPIKE_H3 7657 9.13 10.41 8.86 47 XM_SendGrid 7159 5.82 9.73 5.00 48 HTML_IMAGE_RATIO_02 7132 5.64 9.69 4.80 49 RCVD_IN_MSPIKE_H4 6719 7.69 9.13 7.39 50 BAYES_80 6608 3.74 8.98 2.66 51 TR_XM_SpammyWords4 6355 3.45 8.64 2.38 52 XM_Evil_Numbers_Gen 6330 5.57 8.60 4.94 53 T_REMOTE_IMAGE 6204 2.91 8.43 1.76 54 RCVD_IN_BL_SPAMCOP_NET 6034 1.92 8.20 0.61 55 BAYES_60 5972 9.32 8.12 9.58 56 SpammyFromTLD_02 5923 1.45 8.05 0.08 57 MPART_ALT_DIFF 5896 4.08 8.01 3.27 58 TooManyTo_001 5046 4.47 6.86 3.97 59 RELAYCOUNTRY_CA 4901 1.58 6.66 0.52 60 HTML_MIME_NO_HTML_TAG 4670 2.06 6.35 1.17 61 DKIM_INVALID 4572 6.67 6.21 6.77 62 LotsOfNums_01 4548 4.81 6.18 4.53 63 XMStrtUSub 4390 4.25 5.97 3.90 64 BOTNET_NORDNS 4353 1.07 5.92 0.07 65 XMSubMetaSx_00 4333 2.72 5.89 2.06 66 T_HTML_TAG_BALANCE_CENTER 4326 1.05 5.88 0.04 67 XM_B_Phish_Phrases 4308 2.56 5.86 1.88 68 TR_XM_PhishingBody 4231 2.04 5.75 1.27 69 KHOP_HELO_FCRDNS 4219 1.62 5.73 0.76 70 XM_H_Long_From01 4210 3.52 5.72 3.07 71 XM_B_SpammyTLD 3988 1.96 5.42 1.25 72 HTML_IMAGE_RATIO_04 3915 4.21 5.32 3.98 73 HTML_IMAGE_ONLY_08 3912 0.98 5.32 0.08 74 BODY_URI_ONLY 3897 0.91 5.30 0.00 75 RCVD_IN_RP_SAFE 3813 5.20 5.18 5.20 76 MIME_HTML_MOSTLY 3782 2.20 5.14 1.59 77 TR_XM_DK_SendGrid 3773 3.64 5.13 3.33 78 XM_UB50 3771 14.87 5.13 16.89 79 HTML_FONT_SIZE_LARGE 3727 0.95 5.07 0.09 80 BAYES_95 3305 2.22 4.49 1.75 81 TR_XM_SPAMCOP 3244 1.02 4.41 0.31 82 MIXED_FONT_CASE 3205 0.75 4.36 0.00 83 MIXED_CENTER_CASE 3172 0.74 4.31 0.00 84 MIXED_HREF_CASE 3172 0.74 4.31 0.00 85 MIXED_IMG_CASE 3168 0.74 4.31 0.00 86 MIXED_AREA_CASE 3168 0.74 4.31 0.00 87 MIXED_CTYPE_CASE 3161 0.74 4.30 0.00 88 XMNumbers 2866 2.57 3.90 2.30 89 XM_OfRef6 2855 1.26 3.88 0.71 90 RCVD_IN_RP_CERTIFIED 2830 4.57 3.85 4.72 91 GOOG_STO_IMG_HTML 2701 0.63 3.67 0.00 92 MIME_HTML_ONLY_MULTI 2696 2.60 3.66 2.37 93 XM_B_Investor 2690 1.12 3.66 0.60 94 RCVD_IN_MSPIKE_BL 2593 0.81 3.52 0.24 95 TM2_M_URI_OPT_OUT 2586 20.31 3.51 23.79 96 TR_XM_MSPIKECOMBO 2575 0.80 3.50 0.24 97 HTML_IMAGE_RATIO_06 2547 2.39 3.46 2.17 98 T_XMDrugObfuBody_14 2486 1.80 3.38 1.47 99 T_TooManySym_01 2414 3.85 3.28 3.97 100 XM_SPF_SoftFail 2396 1.42 3.26 1.04 101 URI_NOVOWEL 2362 1.40 3.21 1.03 102 FROM_EXCESS_BASE64 2330 2.39 3.17 2.23 103 USER_IN_DEF_DKIM_WL 2301 8.14 3.13 9.18 104 PDS_OTHER_BAD_TLD 2260 0.77 3.07 0.29 105 SpammyFromTLD_01 2183 0.70 2.97 0.23 106 TR_XM_SpammyWords5 2168 1.20 2.95 0.84 107 XM_DIRTYINTL 2037 15.50 2.77 18.14 108 XM_B_SpammyWords4 1950 0.75 2.65 0.35 109 T_XMDrugObfuBody_08 1950 0.99 2.65 0.65 110 XM_B_Phish66 1874 0.87 2.55 0.53 111 MIME_QP_LONG_LINE 1830 2.19 2.49 2.13 112 XM_CamelCaseFrm001 1815 1.44 2.47 1.22 113 XMDiploma_00 1806 1.01 2.45 0.71 114 HTML_IMAGE_RATIO_08 1775 1.49 2.41 1.30 115 BAYES_40 1735 3.58 2.36 3.83 116 TM2_M_VERY_LONG_WORD 1734 1.03 2.36 0.75 117 TR_XM_PHPDW 1682 0.55 2.29 0.19 118 T_FILL_THIS_FORM_SHORT 1644 0.73 2.23 0.41 119 XMBrknScrpt_02 1608 1.05 2.19 0.81 120 TR_XM_PHPForged 1543 0.47 2.10 0.13 121 TR_XM_SpammyWords3 1538 0.52 2.09 0.19 122 XMSexyCombo_01 1534 0.60 2.08 0.29 123 TR_XM_FormFill2 1530 0.47 2.08 0.14 124 XM_H_PHPOS 1521 0.46 2.07 0.13 125 XMBdyGiftCard01 1481 0.87 2.01 0.63 126 XMNoVowels 1473 1.13 2.00 0.95 127 XM_UB99 1470 0.35 2.00 0.00 128 URI_HEX 1452 1.00 1.97 0.80 129 MAILING_LIST_MULTI 1450 1.34 1.97 1.21 130 TR_XM_SB_Phish 1428 1.05 1.94 0.86 131 DIET_1 1405 0.55 1.91 0.27 132 XMBody_17 1398 0.56 1.90 0.28 133 SUBJ_ALL_CAPS 1381 0.88 1.88 0.68 134 TR_XM_NoHeaderRelay 1362 0.40 1.85 0.09 135 XM_Body_Dirty_Words_01 1361 0.49 1.85 0.20 136 XMSubPhish11 1348 1.01 1.83 0.84 137 XM_H_Undi_Recip 1345 0.40 1.83 0.10 138 URIBL_DBL_SPAM 1325 0.31 1.80 0.00 139 T_XMHurry_00 1316 4.04 1.79 4.51 140 TR_XM_INV_DKIM 1289 0.37 1.75 0.08 141 BAYES_20 1273 15.34 1.73 18.16 142 URIBL_BLACK 1260 0.30 1.71 0.01 143 XM_UB60 1258 3.20 1.71 3.51 144 XM_B_Unsub2 1254 0.73 1.70 0.53 145 TR_Symld_Words 1249 1.13 1.70 1.02 146 XMSlimDrugH 1245 0.46 1.69 0.20 147 T_XMDrugObfuBody_00 1218 2.18 1.66 2.29 148 RCVD_IN_IADB_LISTED 1218 1.93 1.66 1.99 149 RCVD_IN_PSBL 1212 0.37 1.65 0.10 150 ALL_TRUSTED 1207 28.34 1.64 33.89 151 TR_XM_BayesRelay 1158 0.27 1.57 0.00 152 XMPhish30 1154 0.61 1.57 0.41 153 RCVD_IN_MSPIKE_L5 1129 0.28 1.53 0.02 154 TR_XM_FormFill 1128 0.29 1.53 0.03 155 TR_LOTS_OF_MONEY3 1117 0.39 1.52 0.15 156 URIBL_SBL_A 1111 0.30 1.51 0.05 157 URI_GOOG_STO_SPAMMY 1083 0.25 1.47 0.00 158 XM_UB80 1081 0.26 1.47 0.01 159 RELAYCOUNTRY_NL 1077 0.31 1.46 0.06 160 XM_B_COVIDMETA 1076 0.57 1.46 0.38 161 XM_DK_Undo_01 1066 0.91 1.45 0.79 162 SUBJ_YOUR_FAMILY 1057 0.28 1.44 0.04 163 XM_URI_RBL 1051 0.45 1.43 0.25 164 XMSubNoVowel 1048 1.17 1.42 1.12 165 XMStockSpam_06 1047 0.96 1.42 0.86 166 RCVD_IN_IADB_SPF 1042 1.68 1.42 1.74 167 RELAYCOUNTRY_IN 1033 0.29 1.40 0.06 168 RCVD_IN_MSPIKE_L3 1026 0.33 1.39 0.10 169 TR_XM_MaxBayes 1017 0.24 1.38 0.01 170 TR_XM_COVIDMETA4 977 0.33 1.33 0.13 171 RCVD_IN_IADB_DK 976 1.49 1.33 1.52 172 RCVD_IN_IADB_SENDERID 971 1.53 1.32 1.57 173 TR_Mismatch_TLD_01 966 0.38 1.31 0.19 174 BAYES_00 956 5.49 1.30 6.37 175 URI_TRY_3LD 953 0.67 1.30 0.54 176 NORDNS_LOW_CONTRAST 928 0.22 1.26 0.00 177 XMGenDplmaNmb 923 0.49 1.25 0.33 178 MISSING_HEADERS 917 0.35 1.25 0.16 179 FROM_SUSPICIOUS_NTLD 911 0.24 1.24 0.03 180 MIME_CHARSET_FARAWAY 907 0.29 1.23 0.10 181 FROM_SUSPICIOUS_NTLD_FP 878 0.23 1.19 0.03 182 XMHTMLBadTable_001 875 0.65 1.19 0.54 183 XM_H_PHPMailer 865 0.44 1.18 0.29 184 RELAYCOUNTRY_AU 846 0.30 1.15 0.12 185 XM_UB999 830 0.20 1.13 0.00 186 TR_XM_Spammywords 822 0.29 1.12 0.11 187 XM_S_SpammyWords 822 0.29 1.12 0.11 188 RELAYCOUNTRY_DE 820 0.39 1.11 0.23 189 XM_OfRef7 805 0.29 1.09 0.13 190 JH_SPAMMY_HEADERS 797 0.19 1.08 0.00 191 T_Symld_Words_02 796 0.36 1.08 0.21 192 TR_Mismatch_TLD_02 774 0.21 1.05 0.03 193 RCVD_IN_MSPIKE_H5 773 1.36 1.05 1.42 194 RELAYCOUNTRY_CH 772 0.21 1.05 0.03 195 TR_XM_COVIDMETA1 756 0.24 1.03 0.07 196 XMPhish08 754 0.29 1.02 0.13 197 RELAYCOUNTRY_CN 746 0.20 1.01 0.03 198 DATE_IN_PAST_03_06 743 1.44 1.01 1.53 199 HK_RANDOM_REPLYTO 742 0.55 1.01 0.45 200 XMSubMetaI_00 738 0.44 1.00 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 262588 64.88 20.46 74.10 2 DKIM_SIGNED 211958 64.00 84.18 59.81 3 XM_B_Unicode 205541 61.70 79.49 58.00 4 XM_DK_Pass 199312 60.27 79.66 56.24 5 DKIM_VALID 187974 57.33 77.97 53.04 6 HTML_MESSAGE 179125 58.25 95.33 50.55 7 BAYES_50 177721 48.17 38.63 50.15 8 DKIM_VALID_AU 162218 48.14 59.50 45.78 9 RELAYCOUNTRY_US 158649 50.53 78.28 44.77 10 ANY_BOUNCE_MESSAGE 146815 34.40 0.53 41.43 11 BOUNCE_MESSAGE 146815 34.40 0.53 41.43 12 ALL_TRUSTED 120081 28.34 1.64 33.89 13 XMListUnsubscribeExists 113236 38.63 70.79 31.95 14 T_TM2_M_HEADER_IN_MSG 110698 29.38 20.45 31.24 15 XM_B_SpammyWords 103674 35.80 67.33 29.26 16 XM_Body_Dirty_Words 100396 27.49 23.44 28.33 17 DCC_CHECK 91713 35.10 79.52 25.88 18 XM_B_Unicode3 90649 29.12 46.14 25.58 19 TM2_M_URI_OPT_OUT 84322 20.31 3.51 23.79 20 RELAYCOUNTRY_META 77143 21.36 19.40 21.77 21 HTML_FONT_LOW_CONTRAST 73370 23.24 35.44 20.70 22 UNTRUSTED_Relay 73201 19.29 12.71 20.66 23 XMSexyCombo_05 72615 18.91 11.32 20.49 24 RELAYCOUNTRY_FR 70584 16.62 0.71 19.92 25 XMBounce_01 70344 16.45 0.06 19.85 26 BAYES_20 64370 15.34 1.73 18.16 27 XM_DIRTYINTL 64283 15.50 2.77 18.14 28 RCVD_IN_MSPIKE_WL 62652 18.18 20.59 17.68 29 XM_UB50 59868 14.87 5.13 16.89 30 DKIM_VALID_EF 57130 18.23 28.39 16.12 31 LOC_TINY_FONT_1 56383 19.58 37.23 15.91 32 MIME_HTML_ONLY 49465 17.24 33.07 13.96 33 RCVD_IN_MSPIKE_H2 48979 16.46 29.17 13.82 34 FVGT_m_MULTI_ODD 46088 15.38 26.79 13.01 35 T_KAM_HTML_FONT_INVALID 44373 14.96 26.70 12.52 36 XM_B_SpammyWords2 42546 16.64 38.97 12.01 37 XMSubLong 42422 13.94 23.40 11.97 38 BAYES_60 33934 9.32 8.12 9.58 39 XM_Multi_Part_URI 33233 10.77 17.49 9.38 40 USER_IN_DEF_DKIM_WL 32546 8.14 3.13 9.18 41 RCVD_IN_MSPIKE_H3 31408 9.13 10.41 8.86 42 RCVD_IN_MSPIKE_H4 26203 7.69 9.13 7.39 43 DKIM_INVALID 23984 6.67 6.21 6.77 44 XM_B_Unsub 23470 7.38 11.03 6.62 45 BAYES_00 22557 5.49 1.30 6.37 46 XM_DKIMWhitelistDomains 21860 5.14 0.16 6.17 47 FSL_BULK_SIG 19840 7.22 15.05 5.60 48 UNPARSEABLE_RELAY 19441 7.16 15.21 5.49 49 RCVD_IN_RP_SAFE 18421 5.20 5.18 5.20 50 XM_SendGrid 17735 5.82 9.73 5.00 51 XM_Evil_Numbers_Gen 17523 5.57 8.60 4.94 52 XM_DK_Undo_02 17167 11.74 44.95 4.84 53 HTML_IMAGE_RATIO_02 17011 5.64 9.69 4.80 54 RCVD_IN_RP_CERTIFIED 16725 4.57 3.85 4.72 55 LotsOfNums_01 16049 4.81 6.18 4.53 56 T_XMHurry_00 15991 4.04 1.79 4.51 57 TR_XM_UnparsRelay 15253 6.10 14.77 4.30 58 BAYES_99 15141 9.31 33.55 4.27 59 TR_XM_DK_Bayes 14302 3.48 0.83 4.04 60 HTML_IMAGE_RATIO_04 14100 4.21 5.32 3.98 61 TooManyTo_001 14084 4.47 6.86 3.97 62 T_TooManySym_01 14055 3.85 3.28 3.97 63 TR_XM_DK_Bayes1 13979 3.41 0.81 3.94 64 XMStrtUSub 13816 4.25 5.97 3.90 65 BAYES_40 13578 3.58 2.36 3.83 66 LOTS_OF_MONEY 13181 4.97 10.99 3.72 67 TR_XM_DKIM_Undo 13069 9.18 35.62 3.69 68 TR_XM_DK_Bayes2 12620 3.05 0.61 3.56 69 BAYES_999 12471 7.32 25.64 3.52 70 XM_UB60 12442 3.20 1.71 3.51 71 TR_XM_DK_SendGrid 11818 3.64 5.13 3.33 72 MPART_ALT_DIFF 11575 4.08 8.01 3.27 73 BAYES_05 11459 2.82 0.84 3.23 74 XM_H_Long_From01 10869 3.52 5.72 3.07 75 BOTNET_IPINHOSTNAME 10691 4.68 12.70 3.02 76 XM_B_SpammyWords3 10406 4.86 14.12 2.94 77 BAYES_80 9415 3.74 8.98 2.66 78 XM_H_Trusted_IP 9168 2.14 0.00 2.59 79 TO_NO_BRKTS_HTML_IMG 8985 2.12 0.10 2.54 80 XM_UncommonTLD01 8662 4.28 13.15 2.44 81 TR_XM_SpammyWords4 8426 3.45 8.64 2.38 82 MIME_HTML_ONLY_MULTI 8411 2.60 3.66 2.37 83 XMNumbers 8152 2.57 3.90 2.30 84 T_XMDrugObfuBody_00 8099 2.18 1.66 2.29 85 TR_DCC_Bayes_99 8095 6.50 26.80 2.28 86 FROM_EXCESS_BASE64 7893 2.39 3.17 2.23 87 T_TooManySym_02 7811 1.96 0.80 2.20 88 HTML_IMAGE_RATIO_06 7684 2.39 3.46 2.17 89 MIME_QP_LONG_LINE 7545 2.19 2.49 2.13 90 XMSubMetaSx_00 7308 2.72 5.89 2.06 91 TVD_RCVD_IP 7102 1.70 0.21 2.00 92 RCVD_IN_IADB_LISTED 7057 1.93 1.66 1.99 93 INVALID_MSGID 6976 1.66 0.19 1.97 94 MSGID_NOFQDN1 6738 1.58 0.05 1.90 95 XM_B_Phish_Phrases 6653 2.56 5.86 1.88 96 T_REMOTE_IMAGE 6245 2.91 8.43 1.76 97 BAYES_95 6190 2.22 4.49 1.75 98 RCVD_IN_IADB_SPF 6151 1.68 1.42 1.74 99 TO_MALFORMED 6017 1.41 0.01 1.70 100 MIME_HTML_MOSTLY 5619 2.20 5.14 1.59 101 RCVD_IN_IADB_SENDERID 5574 1.53 1.32 1.57 102 DATE_IN_PAST_03_06 5435 1.44 1.01 1.53 103 RCVD_IN_IADB_DK 5390 1.49 1.33 1.52 104 DATE_IN_PAST_06_12 5357 1.32 0.41 1.51 105 T_XMDrugObfuBody_14 5213 1.80 3.38 1.47 106 RCVD_IN_MSPIKE_H5 5041 1.36 1.05 1.42 107 XM_PDF 4815 1.22 0.58 1.36 108 HTML_IMAGE_RATIO_08 4599 1.49 2.41 1.30 109 IN_HORDE_ADDRESS_BOOK 4594 1.10 0.13 1.30 110 TR_XM_PhishingBody 4505 2.04 5.75 1.27 111 XM_B_SpammyTLD 4421 1.96 5.42 1.25 112 XM_CamelCaseFrm001 4327 1.44 2.47 1.22 113 MAILING_LIST_MULTI 4285 1.34 1.97 1.21 114 HTML_MIME_NO_HTML_TAG 4156 2.06 6.35 1.17 115 RCVD_IN_IADB_VOUCHED 4141 1.09 0.73 1.17 116 TR_XM_SpammyWords2 4083 3.31 13.71 1.15 117 XMSubNoVowel 3960 1.17 1.42 1.12 118 XM_SPF_SoftFail 3669 1.42 3.26 1.04 119 URI_NOVOWEL 3650 1.40 3.21 1.03 120 TR_Symld_Words 3600 1.13 1.70 1.02 121 HELO_MISC_IP 3389 0.81 0.09 0.96 122 XMNoVowels 3372 1.13 2.00 0.95 123 BOTNET 3119 3.46 15.90 0.88 124 TR_XM_SB_Phish 3061 1.05 1.94 0.86 125 XMStockSpam_06 3053 0.96 1.42 0.86 126 XMSubPhish11 2985 1.01 1.83 0.84 127 TR_XM_SpammyWords5 2965 1.20 2.95 0.84 128 XMBSHREFv2 2952 0.71 0.13 0.83 129 TooManyTo_002 2942 0.83 0.85 0.83 130 XMGappySubj_01 2878 0.74 0.38 0.81 131 XMBrknScrpt_02 2867 1.05 2.19 0.81 132 URI_HEX 2841 1.00 1.97 0.80 133 HTML_FONT_FACE_BAD 2836 0.82 0.90 0.80 134 XM_DK_Undo_01 2809 0.91 1.45 0.79 135 TR_XM_SpammyRelay 2753 2.72 12.09 0.78 136 KHOP_HELO_FCRDNS 2694 1.62 5.73 0.76 137 TM2_M_VERY_LONG_WORD 2660 1.03 2.36 0.75 138 RCVD_IN_IADB_OPTIN 2653 0.72 0.58 0.75 139 XM_GoogleGroups 2643 0.75 0.74 0.75 140 HTML_IMAGE_ONLY_20 2635 0.65 0.20 0.74 141 XM_OfRef6 2524 1.26 3.88 0.71 142 XMDiploma_00 2522 1.01 2.45 0.71 143 SUBJ_ALL_CAPS 2404 0.88 1.88 0.68 144 HTML_IMAGE_ONLY_32 2368 0.59 0.21 0.67 145 T_XMDrugObfuBody_08 2302 0.99 2.65 0.65 146 T_TooManySym_03 2231 0.57 0.26 0.63 147 XMBdyGiftCard01 2225 0.87 2.01 0.63 148 RCVD_IN_BL_SPAMCOP_NET 2173 1.92 8.20 0.61 149 TooManyTo_003 2137 0.62 0.70 0.60 150 XM_B_Investor 2110 1.12 3.66 0.60 151 XM_H_Long_From02 2067 0.61 0.73 0.58 152 XMHTMLBadTable_001 1922 0.65 1.19 0.54 153 XM_B_DNDMA 1913 0.52 0.45 0.54 154 XM_B_COPY_HTML 1902 0.59 0.83 0.54 155 URI_TRY_3LD 1896 0.67 1.30 0.54 156 XM_B_Phish66 1870 0.87 2.55 0.53 157 XM_B_Unsub2 1869 0.73 1.70 0.53 158 RELAYCOUNTRY_CA 1845 1.58 6.66 0.52 159 DKIM_ADSP_CUSTOM_MED 1840 0.58 0.88 0.52 160 XMBody_95 1760 0.46 0.27 0.50 161 TooManyTo_004 1667 0.49 0.61 0.47 162 TR_MSPIKEBAYES00 1635 0.38 0.01 0.46 163 HK_RANDOM_REPLYTO 1611 0.55 1.01 0.45 164 XM_B_REG_HTML 1606 0.51 0.78 0.45 165 TVD_SPACE_RATIO_MINFP 1525 0.37 0.08 0.43 166 T_FILL_THIS_FORM_SHORT 1461 0.73 2.23 0.41 167 XMPhish30 1461 0.61 1.57 0.41 168 IN_ZIMBRA_NJ_WHITELIST 1452 0.34 0.01 0.41 169 TooManyTo_005 1422 0.43 0.56 0.40 170 TR_MetaPhish_Combo_01 1393 0.48 0.88 0.39 171 XM_B_COVIDMETA 1347 0.57 1.46 0.38 172 RDNS_DYNAMIC 1333 0.42 0.62 0.38 173 XM_ProductURIs 1326 0.48 0.97 0.37 174 XMSubMetaSxObfu_02 1294 0.37 0.39 0.37 175 XMLngstWrd_00 1281 0.41 0.67 0.36 176 USER_IN_WHITELIST 1273 0.30 0.00 0.36 177 USER_IN_WELCOMELIST 1273 0.30 0.00 0.36 178 XM_B_SpammyWords4 1256 0.75 2.65 0.35 179 XMHTML_After_End 1190 0.41 0.75 0.34 180 RELAYCOUNTRY_GB 1170 0.43 0.90 0.33 181 XMGenDplmaNmb 1158 0.49 1.25 0.33 182 XMSubMetaI_00 1128 0.44 1.00 0.32 183 XMLngstWrd_01 1116 0.37 0.61 0.31 184 TR_XM_SPAMCOP 1111 1.02 4.41 0.31 185 NML_ADSP_CUSTOM_MED 1111 0.39 0.76 0.31 186 XMSexyCombo_01 1038 0.60 2.08 0.29 187 XM_H_PHPMailer 1036 0.44 1.18 0.29 188 PDS_OTHER_BAD_TLD 1021 0.77 3.07 0.29 189 T_TooManySym_04 1011 0.26 0.14 0.29 190 XMBody_17 1003 0.56 1.90 0.28 191 TVD_SPACE_RATIO 1000 0.26 0.13 0.28 192 XM_shorewaves_Whitelist 998 0.23 0.00 0.28 193 XMCapTrack 998 0.28 0.28 0.28 194 FORGED_GMAIL_RCVD 971 0.35 0.73 0.27 195 XMOemUri 971 0.25 0.13 0.27 196 DIET_1 965 0.55 1.91 0.27 197 HELO_NODOT 949 0.38 0.91 0.27 198 HELO_NO_DOMAIN 949 0.38 0.91 0.27 199 HTML_TAG_BALANCE_BODY 945 0.39 0.97 0.27 200 PLING_QUERY 937 0.32 0.61 0.26 ----------------------------------------------------------------------