Email: 561840 Autolearn: 0 AvgScore: 0.96 AvgScanTime: 1.44 sec Spam: 131576 Autolearn: 0 AvgScore: 14.53 AvgScanTime: 1.76 sec Ham: 430264 Autolearn: 0 AvgScore: -3.19 AvgScanTime: 1.34 sec Time Spent Running SA: 224.13 hours Time Spent Processing Spam: 64.33 hours Time Spent Processing Ham: 159.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126301 90.51 95.99 88.83 2 DKIM_SIGNED 105414 66.13 80.12 61.85 3 DCC_CHECK 103732 44.49 78.84 33.98 4 XM_DK_Pass 101374 64.52 77.05 60.70 5 RELAYCOUNTRY_US 99039 81.29 75.27 83.14 6 XM_B_Unicode 98198 73.88 74.63 73.65 7 DKIM_VALID 97926 62.49 74.43 58.83 8 XM_B_SpammyWords 89158 48.68 67.76 42.85 9 XMListUnsubscribeExists 86016 45.57 65.37 39.51 10 DKIM_VALID_AU 73898 47.57 56.16 44.94 11 BAYES_50 58305 49.41 44.31 50.97 12 XM_B_Unicode3 52204 43.92 39.68 45.22 13 XM_DK_Undo_02 51400 13.72 39.06 5.97 14 XM_B_SpammyWords2 49297 20.59 37.47 15.43 15 MIME_HTML_ONLY 43787 26.39 33.28 24.29 16 HTML_FONT_LOW_CONTRAST 42158 25.18 32.04 23.08 17 LOC_TINY_FONT_1 41949 22.59 31.88 19.75 18 TR_XM_DKIM_Undo 41055 10.61 31.20 4.31 19 T_KAM_HTML_FONT_INVALID 39052 19.04 29.68 15.78 20 BAYES_99 38059 10.77 28.93 5.22 21 FVGT_m_MULTI_ODD 37286 21.59 28.34 19.53 22 DKIM_VALID_EF 36638 24.12 27.85 22.98 23 XMSubLong 33845 21.59 25.72 20.32 24 RCVD_IN_MSPIKE_H2 31199 19.19 23.71 17.81 25 RCVD_IN_MSPIKE_WL 30463 25.09 23.15 25.68 26 TR_DCC_Bayes_99 29838 6.91 22.68 2.09 27 BAYES_999 29473 8.64 22.40 4.43 28 RELAYCOUNTRY_META 28590 7.60 21.73 3.28 29 T_TM2_M_HEADER_IN_MSG 28239 25.31 21.46 26.48 30 DCC_CHECK_NEGATIVE 27796 55.48 21.13 65.99 31 XM_Body_Dirty_Words 25870 11.87 19.66 9.49 32 FSL_BULK_SIG 25478 10.03 19.36 7.17 33 UNTRUSTED_Relay 22636 4.87 17.20 1.10 34 XM_UncommonTLD01 21373 6.04 16.24 2.92 35 XM_Multi_Part_URI 21228 10.98 16.13 9.41 36 BOTNET_IPINHOSTNAME 20452 6.35 15.54 3.54 37 XM_B_Unsub 19584 9.97 14.88 8.47 38 RCVD_IN_MSPIKE_H3 17905 12.70 13.61 12.43 39 BOTNET 17828 4.10 13.55 1.21 40 TR_XM_SpammyRelay 17826 4.24 13.55 1.39 41 LOTS_OF_MONEY 17126 7.55 13.02 5.88 42 UNPARSEABLE_RELAY 16455 8.26 12.51 6.96 43 XM_B_SpammyWords3 16393 5.57 12.46 3.46 44 TR_XM_UnparsRelay 16022 6.81 12.18 5.17 45 TR_XM_SpammyWords4 15069 5.40 11.45 3.54 46 XMSexyCombo_05 14548 4.95 11.06 3.08 47 TR_XM_SpammyWords2 13955 3.13 10.61 0.84 48 HTML_IMAGE_RATIO_02 13199 6.03 10.03 4.80 49 SpammyFromTLD_02 12912 2.61 9.81 0.41 50 XM_SendGrid 12676 6.99 9.63 6.19 51 RCVD_IN_BL_SPAMCOP_NET 12661 3.09 9.62 1.09 52 XM_Evil_Numbers_Gen 12152 8.71 9.24 8.55 53 RCVD_IN_MSPIKE_H4 11721 10.65 8.91 11.18 54 HTML_MIME_NO_HTML_TAG 11280 3.68 8.57 2.18 55 KHOP_HELO_FCRDNS 11144 3.06 8.47 1.41 56 XM_UB50 10992 2.48 8.35 0.68 57 XMSubMetaSx_00 10950 4.11 8.32 2.83 58 MPART_ALT_DIFF 10874 10.33 8.26 10.96 59 T_REMOTE_IMAGE 10117 4.54 7.69 3.57 60 LotsOfNums_01 9945 7.66 7.56 7.69 61 BAYES_80 9941 4.32 7.56 3.33 62 BAYES_60 9406 7.19 7.15 7.20 63 T_HTML_TAG_BALANCE_CENTER 8147 1.52 6.19 0.09 64 TR_XM_PhishingBody 8092 3.40 6.15 2.56 65 XM_B_Phish_Phrases 7803 3.93 5.93 3.32 66 HTML_IMAGE_ONLY_08 7566 1.40 5.75 0.07 67 GOOG_STO_IMG_HTML 7551 1.34 5.74 0.00 68 DKIM_INVALID 7488 3.64 5.69 3.02 69 TooManyTo_001 7347 6.89 5.58 7.28 70 XM_H_Long_From01 7314 4.61 5.56 4.32 71 TR_XM_DK_SendGrid 7276 4.24 5.53 3.84 72 XMNumbers 7056 3.31 5.36 2.68 73 RELAYCOUNTRY_CA 6872 1.79 5.22 0.74 74 BODY_URI_ONLY 6823 1.22 5.19 0.01 75 MIXED_CENTER_CASE 6711 1.20 5.10 0.00 76 MIXED_HREF_CASE 6705 1.19 5.10 0.00 77 XM_B_Investor 6704 2.31 5.10 1.45 78 MIXED_FONT_CASE 6701 1.19 5.09 0.00 79 MIXED_IMG_CASE 6699 1.19 5.09 0.00 80 MIXED_AREA_CASE 6696 1.19 5.09 0.00 81 MIME_HTML_MOSTLY 6474 3.01 4.92 2.42 82 TR_XM_SPAMCOP 6467 1.63 4.92 0.63 83 XM_B_SpammyTLD 5926 2.33 4.50 1.66 84 BAYES_95 5679 2.62 4.32 2.10 85 HTML_FONT_SIZE_LARGE 5673 1.08 4.31 0.09 86 HTML_IMAGE_RATIO_04 5649 14.70 4.29 17.88 87 RCVD_IN_RP_RNBL 5472 1.02 4.16 0.06 88 MIXED_CTYPE_CASE 5468 0.98 4.16 0.01 89 MIME_QP_LONG_LINE 5245 4.33 3.99 4.44 90 XM_SPF_SoftFail 5213 2.16 3.96 1.61 91 TR_XM_PHPDW 5148 1.12 3.91 0.26 92 TR_XM_NoHeaderRelay 5145 1.04 3.91 0.17 93 MIME_HTML_ONLY_MULTI 5124 7.98 3.89 9.23 94 TR_XM_PHPForged 5110 1.09 3.88 0.23 95 TR_XM_FormFill2 5059 1.08 3.84 0.23 96 XM_H_PHPOS 5041 1.07 3.83 0.23 97 XM_B_Phish66 4848 1.98 3.68 1.45 98 RCVD_IN_MSPIKE_BL 4813 0.91 3.66 0.06 99 TR_XM_MSPIKECOMBO 4763 0.89 3.62 0.05 100 RCVD_IN_MSPIKE_L3 4751 0.89 3.61 0.05 101 XMStrtUSub 4687 9.63 3.56 11.48 102 HTML_IMAGE_RATIO_06 4676 5.27 3.55 5.79 103 TM2_M_URI_OPT_OUT 4645 2.93 3.53 2.75 104 RCVD_IN_VALIDITY_RPBL 4610 0.86 3.50 0.06 105 XMDiploma_00 4561 1.69 3.47 1.15 106 URI_NOVOWEL 4464 2.42 3.39 2.12 107 SpammyFromTLD_01 4225 1.23 3.21 0.62 108 XM_OfRef6 4211 1.52 3.20 1.00 109 T_TooManySym_01 4129 4.16 3.14 4.47 110 TR_XM_SpammyWords5 4068 1.71 3.09 1.29 111 URIBL_DBL_SPAM 4035 0.73 3.07 0.01 112 TR_XM_SpammyWords3 3914 0.72 2.97 0.03 113 T_XMDrugObfuBody_08 3890 1.68 2.96 1.28 114 RELAYCOUNTRY_FR 3821 0.82 2.90 0.19 115 T_XMDrugObfuBody_14 3577 2.38 2.72 2.27 116 XM_DIRTYINTL 3423 0.79 2.60 0.24 117 BOTNET_NORDNS 3278 0.59 2.49 0.01 118 BAYES_40 3260 4.73 2.48 5.42 119 XM_B_Unsub2 3144 1.65 2.39 1.42 120 RCVD_IN_IADB_LISTED 3066 3.81 2.33 4.26 121 XM_CamelCaseFrm001 2986 1.64 2.27 1.45 122 XM_UB99 2937 0.52 2.23 0.00 123 XM_UB60 2937 0.57 2.23 0.06 124 URI_TRY_3LD 2926 1.16 2.22 0.84 125 XMBrknScrpt_02 2919 1.16 2.22 0.83 126 TR_LOTS_OF_MONEY3 2907 0.89 2.21 0.49 127 HTML_IMAGE_RATIO_08 2899 2.08 2.20 2.04 128 XMGenDplmaNmb 2868 1.02 2.18 0.67 129 T_XMHurry_00 2860 1.24 2.17 0.95 130 HTML_FONT_SIZE_HUGE 2852 0.53 2.17 0.03 131 XM_B_COVIDMETA 2835 1.01 2.15 0.66 132 XM_URI_RBL 2778 0.59 2.11 0.13 133 TR_XM_SB_Phish 2764 2.42 2.10 2.52 134 XMBody_17 2762 0.72 2.10 0.30 135 HTML_IMAGE_ONLY_32 2727 0.79 2.07 0.40 136 RCVD_IN_IADB_SPF 2704 3.34 2.06 3.74 137 BAYES_20 2682 4.33 2.04 5.03 138 XMSubPhish11 2675 2.39 2.03 2.50 139 TM2_M_VERY_LONG_WORD 2654 1.18 2.02 0.93 140 BAYES_00 2650 13.84 2.01 17.46 141 JH_SPAMMY_HEADERS 2643 0.47 2.01 0.00 142 DIET_1 2620 0.71 1.99 0.32 143 MAILING_LIST_MULTI 2591 2.59 1.97 2.78 144 XM_DK_Undo_01 2587 1.57 1.97 1.46 145 RCVD_IN_IADB_DK 2570 2.99 1.95 3.31 146 RDNS_DYNAMIC 2555 0.74 1.94 0.38 147 RCVD_IN_IADB_SENDERID 2507 3.05 1.91 3.40 148 XMNoVowels 2497 1.41 1.90 1.26 149 T_FILL_THIS_FORM_SHORT 2488 0.96 1.89 0.68 150 PDS_OTHER_BAD_TLD 2482 0.62 1.89 0.24 151 RELAYCOUNTRY_IN 2481 0.52 1.89 0.10 152 XM_B_SpammyWords4 2480 0.67 1.88 0.30 153 TR_Mismatch_TLD_02 2475 0.50 1.88 0.07 154 LONG_JUNK_URI 2446 0.45 1.86 0.02 155 T_XMDrugObfuBody_00 2277 0.89 1.73 0.64 156 RCVD_IN_PSBL 2261 0.52 1.72 0.16 157 XM_GoogleGroups 2207 1.84 1.68 1.89 158 URI_HEX 2169 1.28 1.65 1.17 159 SUBJ_ALL_CAPS 2152 1.43 1.64 1.36 160 ALL_TRUSTED 2139 11.73 1.63 14.83 161 XMSexyCombo_01 2137 0.67 1.62 0.38 162 TR_XM_COVIDMETA1 2075 0.51 1.58 0.18 163 XM_UB80 2039 0.38 1.55 0.02 164 XM_UB999 2008 0.36 1.53 0.00 165 XMHTML_After_End 1985 0.91 1.51 0.73 166 TR_XM_COVIDMETA4 1967 0.55 1.49 0.25 167 DATE_IN_PAST_24_48 1964 0.35 1.49 0.00 168 XMStockSpam_06 1935 1.17 1.47 1.08 169 URIBL_BLACK 1926 0.36 1.46 0.02 170 RCVD_IN_RP_SAFE 1898 5.00 1.44 6.08 171 TVD_RCVD_IP 1858 1.26 1.41 1.22 172 XM_DrugUnitList 1840 0.33 1.40 0.00 173 EBAY_IMG_NOT_RCVD_EBAY 1831 0.33 1.39 0.01 174 HOSTED_IMG_DIRECT_MX 1829 0.33 1.39 0.00 175 FROM_EXCESS_BASE64 1821 2.40 1.38 2.71 176 TR_XM_INV_DKIM 1781 0.36 1.35 0.05 177 TR_Symld_Words 1780 1.37 1.35 1.38 178 HTML_FONT_FACE_BAD 1748 12.87 1.33 16.40 179 RELAYCOUNTRY_AU 1731 0.49 1.32 0.24 180 HTTPS_HTTP_MISMATCH 1661 0.78 1.26 0.63 181 TR_XM_BayesRelay 1648 0.30 1.25 0.00 182 TR_BOTNET_NEGATE 1636 0.43 1.24 0.18 183 XM_Body_Dirty_Words_01 1608 0.39 1.22 0.14 184 BAYES_05 1581 2.79 1.20 3.27 185 XMBody_78 1561 0.50 1.19 0.29 186 XM_PDF 1547 3.85 1.18 4.67 187 RELAYCOUNTRY_GB 1546 0.83 1.17 0.72 188 RELAYCOUNTRY_DE 1546 0.47 1.17 0.25 189 YOUR_DELIVERY_ADDRESS 1534 0.27 1.17 0.00 190 XMSlimDrugH 1498 0.52 1.14 0.34 191 HTML_TITLE_SUBJ_DIFF 1460 0.48 1.11 0.29 192 HTML_IMAGE_ONLY_20 1442 0.99 1.10 0.96 193 XMPhish30 1436 0.63 1.09 0.49 194 TR_XM_FormFill 1429 0.26 1.09 0.01 195 RELAYCOUNTRY_AZ 1414 0.25 1.07 0.00 196 XM_H_Undi_Recip 1361 0.34 1.03 0.13 197 RCVD_IN_IADB_VOUCHED 1348 2.11 1.02 2.44 198 RELAYCOUNTRY_NL 1316 0.36 1.00 0.16 199 HTML_SHORT_LINK_IMG_3 1266 0.47 0.96 0.32 200 T_TooManySym_02 1230 1.94 0.93 2.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 382204 90.51 95.99 88.83 2 RELAYCOUNTRY_US 357707 81.29 75.27 83.14 3 XM_B_Unicode 316908 73.88 74.63 73.65 4 DCC_CHECK_NEGATIVE 283919 55.48 21.13 65.99 5 DKIM_SIGNED 266123 66.13 80.12 61.85 6 XM_DK_Pass 261150 64.52 77.05 60.70 7 DKIM_VALID 253143 62.49 74.43 58.83 8 BAYES_50 219319 49.41 44.31 50.97 9 XM_B_Unicode3 194553 43.92 39.68 45.22 10 DKIM_VALID_AU 193343 47.57 56.16 44.94 11 XM_B_SpammyWords 184359 48.68 67.76 42.85 12 XMListUnsubscribeExists 169993 45.57 65.37 39.51 13 DCC_CHECK 146220 44.49 78.84 33.98 14 T_TM2_M_HEADER_IN_MSG 113937 25.31 21.46 26.48 15 RCVD_IN_MSPIKE_WL 110497 25.09 23.15 25.68 16 MIME_HTML_ONLY 104494 26.39 33.28 24.29 17 HTML_FONT_LOW_CONTRAST 99303 25.18 32.04 23.08 18 DKIM_VALID_EF 98859 24.12 27.85 22.98 19 XMSubLong 87441 21.59 25.72 20.32 20 LOC_TINY_FONT_1 84969 22.59 31.88 19.75 21 FVGT_m_MULTI_ODD 84018 21.59 28.34 19.53 22 HTML_IMAGE_RATIO_04 76928 14.70 4.29 17.88 23 RCVD_IN_MSPIKE_H2 76615 19.19 23.71 17.81 24 XM_H_Trusted_IP 75541 13.45 0.00 17.56 25 BAYES_00 75113 13.84 2.01 17.46 26 HTML_FONT_FACE_BAD 70551 12.87 1.33 16.40 27 T_KAM_HTML_FONT_INVALID 67906 19.04 29.68 15.78 28 XM_B_SpammyWords2 66407 20.59 37.47 15.43 29 ALL_TRUSTED 63789 11.73 1.63 14.83 30 RCVD_IN_MSPIKE_H3 53470 12.70 13.61 12.43 31 XMStrtUSub 49414 9.63 3.56 11.48 32 RCVD_IN_MSPIKE_H4 48115 10.65 8.91 11.18 33 MPART_ALT_DIFF 47167 10.33 8.26 10.96 34 USER_IN_DEF_DKIM_WL 41668 7.63 0.92 9.68 35 XM_Body_Dirty_Words 40840 11.87 19.66 9.49 36 XM_Multi_Part_URI 40489 10.98 16.13 9.41 37 MIME_HTML_ONLY_MULTI 39714 7.98 3.89 9.23 38 XM_Evil_Numbers_Gen 36805 8.71 9.24 8.55 39 XM_B_Unsub 36435 9.97 14.88 8.47 40 LotsOfNums_01 33105 7.66 7.56 7.69 41 TooManyTo_001 31343 6.89 5.58 7.28 42 BAYES_60 30965 7.19 7.15 7.20 43 FSL_BULK_SIG 30858 10.03 19.36 7.17 44 UNPARSEABLE_RELAY 29954 8.26 12.51 6.96 45 TR_XM_DK_Bayes 28378 5.23 0.75 6.60 46 TR_XM_DK_Bayes1 27587 5.08 0.72 6.41 47 XM_SendGrid 26612 6.99 9.63 6.19 48 RCVD_IN_RP_SAFE 26175 5.00 1.44 6.08 49 XM_DK_Undo_02 25694 13.72 39.06 5.97 50 LOTS_OF_MONEY 25288 7.55 13.02 5.88 51 XMSubNoVowel 24951 4.63 0.82 5.80 52 HTML_IMAGE_RATIO_06 24920 5.27 3.55 5.79 53 XM_DKIMWhitelistDomains 24683 4.40 0.02 5.74 54 RCVD_IN_RP_CERTIFIED 24142 4.50 0.85 5.61 55 BAYES_40 23338 4.73 2.48 5.42 56 TR_XM_DK_Bayes2 23320 4.29 0.59 5.42 57 BAYES_99 22466 10.77 28.93 5.22 58 RCVD_IN_VALIDITY_SAFE 22400 4.16 0.72 5.21 59 TR_XM_UnparsRelay 22232 6.81 12.18 5.17 60 BAYES_20 21640 4.33 2.04 5.03 61 HTML_IMAGE_RATIO_02 20671 6.03 10.03 4.80 62 RCVD_IN_VALIDITY_CERTIFIED 20637 3.74 0.29 4.80 63 XM_PDF 20097 3.85 1.18 4.67 64 T_TooManySym_01 19246 4.16 3.14 4.47 65 MIME_QP_LONG_LINE 19086 4.33 3.99 4.44 66 BAYES_999 19058 8.64 22.40 4.43 67 XM_H_Long_From01 18577 4.61 5.56 4.32 68 TR_XM_DKIM_Undo 18534 10.61 31.20 4.31 69 RCVD_IN_IADB_LISTED 18324 3.81 2.33 4.26 70 TR_XM_DK_SendGrid 16539 4.24 5.53 3.84 71 RCVD_IN_IADB_SPF 16073 3.34 2.06 3.74 72 T_REMOTE_IMAGE 15365 4.54 7.69 3.57 73 TR_XM_SpammyWords4 15251 5.40 11.45 3.54 74 BOTNET_IPINHOSTNAME 15235 6.35 15.54 3.54 75 ANY_BOUNCE_MESSAGE 15152 2.87 0.74 3.52 76 BOUNCE_MESSAGE 15142 2.87 0.74 3.52 77 XM_B_SpammyWords3 14876 5.57 12.46 3.46 78 RCVD_IN_IADB_SENDERID 14617 3.05 1.91 3.40 79 BAYES_80 14314 4.32 7.56 3.33 80 XM_B_Phish_Phrases 14278 3.93 5.93 3.32 81 RCVD_IN_IADB_DK 14244 2.99 1.95 3.31 82 RELAYCOUNTRY_META 14111 7.60 21.73 3.28 83 BAYES_05 14079 2.79 1.20 3.27 84 XMSexyCombo_05 13254 4.95 11.06 3.08 85 DKIM_INVALID 12980 3.64 5.69 3.02 86 XM_UncommonTLD01 12559 6.04 16.24 2.92 87 XMSubMetaSx_00 12164 4.11 8.32 2.83 88 MAILING_LIST_MULTI 11946 2.59 1.97 2.78 89 TM2_M_URI_OPT_OUT 11837 2.93 3.53 2.75 90 FROM_EXCESS_BASE64 11641 2.40 1.38 2.71 91 XMNumbers 11524 3.31 5.36 2.68 92 TR_XM_PhishingBody 11009 3.40 6.15 2.56 93 TR_XM_SB_Phish 10852 2.42 2.10 2.52 94 XMSubPhish11 10738 2.39 2.03 2.50 95 RCVD_IN_IADB_VOUCHED 10490 2.11 1.02 2.44 96 MIME_HTML_MOSTLY 10422 3.01 4.92 2.42 97 T_XMDrugObfuBody_14 9780 2.38 2.72 2.27 98 T_TooManySym_02 9658 1.94 0.93 2.24 99 HTML_MIME_NO_HTML_TAG 9391 3.68 8.57 2.18 100 URI_NOVOWEL 9112 2.42 3.39 2.12 101 XMSubGarbage 9096 1.63 0.03 2.11 102 BAYES_95 9022 2.62 4.32 2.10 103 TR_DCC_Bayes_99 9002 6.91 22.68 2.09 104 RCVD_IN_MSPIKE_H5 8912 1.74 0.64 2.07 105 XMSubLongNoVowel 8812 1.59 0.11 2.05 106 HTML_IMAGE_RATIO_08 8780 2.08 2.20 2.04 107 TooManyTo_002 8533 1.72 0.85 1.98 108 XM_GoogleGroups 8136 1.84 1.68 1.89 109 HELO_NODOT 7283 1.43 0.58 1.69 110 HELO_NO_DOMAIN 7283 1.43 0.57 1.69 111 XM_B_SpammyTLD 7154 2.33 4.50 1.66 112 INVALID_MSGID 6988 1.35 0.47 1.62 113 IN_HORDE_ADDRESS_BOOK 6940 1.25 0.08 1.61 114 XM_SPF_SoftFail 6907 2.16 3.96 1.61 115 RCVD_IN_IADB_OPTIN 6535 1.32 0.67 1.52 116 MSGID_NOFQDN1 6274 1.13 0.07 1.46 117 XM_DK_Undo_01 6261 1.57 1.97 1.46 118 XM_B_Phish66 6258 1.98 3.68 1.45 119 XM_B_Investor 6254 2.31 5.10 1.45 120 XM_CamelCaseFrm001 6223 1.64 2.27 1.45 121 XM_B_Unsub2 6124 1.65 2.39 1.42 122 KHOP_HELO_FCRDNS 6054 3.06 8.47 1.41 123 TO_MALFORMED 6012 1.07 0.02 1.40 124 TR_XM_SpammyRelay 5969 4.24 13.55 1.39 125 TR_Symld_Words 5923 1.37 1.35 1.38 126 SUBJ_ALL_CAPS 5868 1.43 1.64 1.36 127 TooManyTo_003 5554 1.14 0.64 1.29 128 TR_XM_SpammyWords5 5542 1.71 3.09 1.29 129 T_XMDrugObfuBody_08 5523 1.68 2.96 1.28 130 XM_E_Blogspot 5455 1.01 0.15 1.27 131 XMNoVowels 5407 1.41 1.90 1.26 132 TVD_RCVD_IP 5233 1.26 1.41 1.22 133 BOTNET 5208 4.10 13.55 1.21 134 URI_HEX 5047 1.28 1.65 1.17 135 XMDiploma_00 4937 1.69 3.47 1.15 136 XMGappySubj_01 4874 0.90 0.16 1.13 137 XMCapTrack 4832 0.97 0.48 1.12 138 UNTRUSTED_Relay 4742 4.87 17.20 1.10 139 RCVD_IN_BL_SPAMCOP_NET 4709 3.09 9.62 1.09 140 XMStockSpam_06 4635 1.17 1.47 1.08 141 XM_OfRef6 4301 1.52 3.20 1.00 142 HTML_IMAGE_ONLY_20 4118 0.99 1.10 0.96 143 T_XMHurry_00 4079 1.24 2.17 0.95 144 TM2_M_VERY_LONG_WORD 3998 1.18 2.02 0.93 145 TooManyTo_004 3928 0.82 0.53 0.91 146 TVD_SPACE_RATIO_MINFP 3664 0.75 0.42 0.85 147 TR_XM_SpammyWords2 3621 3.13 10.61 0.84 148 URI_TRY_3LD 3616 1.16 2.22 0.84 149 XMBrknScrpt_02 3576 1.16 2.22 0.83 150 DKIM_ADSP_CUSTOM_MED 3572 0.82 0.78 0.83 151 XM_H_Long_From02 3530 0.85 0.93 0.82 152 XMBSHREFv2 3465 0.67 0.21 0.81 153 HELO_MISC_IP 3361 0.62 0.10 0.78 154 IN_ZIMBRA_NJ_WHITELIST 3326 0.59 0.01 0.77 155 RELAYCOUNTRY_CA 3166 1.79 5.22 0.74 156 XMHTML_After_End 3150 0.91 1.51 0.73 157 TVD_PH_BODY_ACCOUNTS_PRE 3116 0.63 0.33 0.72 158 TR_MetaPhish_Combo_01 3116 0.72 0.71 0.72 159 RELAYCOUNTRY_GB 3091 0.83 1.17 0.72 160 TooManyTo_005 3060 0.63 0.39 0.71 161 XM_UB50 2928 2.48 8.35 0.68 162 T_FILL_THIS_FORM_SHORT 2910 0.96 1.89 0.68 163 XMBdyGiftCard01 2894 0.69 0.74 0.67 164 T_TooManySym_03 2879 0.59 0.31 0.67 165 XMGenDplmaNmb 2863 1.02 2.18 0.67 166 XMBody_95 2854 0.55 0.17 0.66 167 XM_B_COVIDMETA 2824 1.01 2.15 0.66 168 T_XMDrugObfuBody_00 2734 0.89 1.73 0.64 169 HTTPS_HTTP_MISMATCH 2728 0.78 1.26 0.63 170 TM2_M_BODY_EMPTY 2728 0.52 0.14 0.63 171 T_OBFU_PDF_ATTACH 2728 0.53 0.19 0.63 172 TR_XM_SPAMCOP 2697 1.63 4.92 0.63 173 SpammyFromTLD_01 2675 1.23 3.21 0.62 174 MPART_ALT_DIFF_COUNT 2580 0.63 0.74 0.60 175 XM_B_COPY_HTML 2452 0.58 0.61 0.57 176 XM_ProductURIs 2398 0.56 0.58 0.56 177 XM_ShortIntro_01 2359 0.53 0.49 0.55 178 NML_ADSP_CUSTOM_MED 2339 0.57 0.64 0.54 179 PLING_QUERY 2321 0.54 0.52 0.54 180 BASE64_LENGTH_79_INF 2271 0.47 0.26 0.53 181 FROM_GOV_DKIM_AU 2221 0.49 0.41 0.52 182 RCVD_IN_SORBS_DUL 2135 0.43 0.23 0.50 183 TR_LOTS_OF_MONEY3 2111 0.89 2.21 0.49 184 XMPhish30 2098 0.63 1.09 0.49 185 SHORT_HELO_AND_INLINE_IMAGE 2069 0.39 0.07 0.48 186 TVD_SPACE_RATIO 1968 0.39 0.17 0.46 187 FORGED_GMAIL_RCVD 1966 0.49 0.60 0.46 188 HTML_TAG_BALANCE_BODY 1941 0.53 0.77 0.45 189 TR_MSPIKEBAYES00 1892 0.35 0.06 0.44 190 XMMoneyMeta_00 1883 0.55 0.92 0.44 191 XMHTMLBadTable_001 1862 0.43 0.42 0.43 192 HTML_IMAGE_ONLY_28 1819 0.42 0.43 0.42 193 SpammyFromTLD_02 1761 2.61 9.81 0.41 194 T_MANY_PILL_PRICE 1754 0.31 0.01 0.41 195 FROM_GOV_SPOOF 1738 0.34 0.12 0.40 196 XM_H_PHPMailer 1707 0.52 0.91 0.40 197 HTML_IMAGE_ONLY_32 1700 0.79 2.07 0.40 198 XMSexyCombo_01 1652 0.67 1.62 0.38 199 XMLngstWrd_00 1630 0.38 0.40 0.38 200 RDNS_DYNAMIC 1619 0.74 1.94 0.38 ----------------------------------------------------------------------