Email: 465785 Autolearn: 0 AvgScore: 2.38 AvgScanTime: 1.31 sec Spam: 111334 Autolearn: 0 AvgScore: 14.95 AvgScanTime: 1.49 sec Ham: 354451 Autolearn: 0 AvgScore: -1.57 AvgScanTime: 1.26 sec Time Spent Running SA: 169.95 hours Time Spent Processing Spam: 46.02 hours Time Spent Processing Ham: 123.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 106832 90.13 95.96 88.29 2 DCC_CHECK 87861 47.85 78.92 38.10 3 DKIM_SIGNED 85238 69.53 76.56 67.32 4 XM_DK_Pass 82550 67.98 74.15 66.04 5 RELAYCOUNTRY_US 82492 79.53 74.09 81.23 6 XM_B_Unicode 79731 71.34 71.61 71.25 7 DKIM_VALID 79680 66.10 71.57 64.38 8 XM_B_SpammyWords 69022 46.54 62.00 41.69 9 XMListUnsubscribeExists 68182 47.91 61.24 43.73 10 DKIM_VALID_AU 55912 49.12 50.22 48.77 11 BAYES_50 51103 49.53 45.90 50.68 12 XM_B_Unicode3 46987 45.32 42.20 46.30 13 MIME_HTML_ONLY 44538 26.87 40.00 22.74 14 XM_B_SpammyWords2 40515 21.82 36.39 17.25 15 XM_DK_Undo_02 39442 13.91 35.43 7.15 16 HTML_FONT_LOW_CONTRAST 34756 26.83 31.22 25.46 17 LOC_TINY_FONT_1 33678 24.33 30.25 22.47 18 TR_XM_DKIM_Undo 31925 10.86 28.67 5.26 19 DKIM_VALID_EF 30714 25.08 27.59 24.30 20 T_KAM_HTML_FONT_INVALID 29299 18.72 26.32 16.33 21 BAYES_99 28092 14.34 25.23 10.92 22 FVGT_m_MULTI_ODD 27901 22.19 25.06 21.29 23 FSL_BULK_SIG 25629 11.79 23.02 8.26 24 RCVD_IN_MSPIKE_H2 24615 19.21 22.11 18.31 25 XMSubLong 24260 20.54 21.79 20.15 26 RELAYCOUNTRY_META 24110 7.27 21.66 2.75 27 T_TM2_M_HEADER_IN_MSG 23620 27.01 21.22 28.83 28 DCC_CHECK_NEGATIVE 23422 52.11 21.04 61.87 29 XM_Body_Dirty_Words 22547 13.21 20.25 11.00 30 RCVD_IN_MSPIKE_WL 21777 26.11 19.56 28.16 31 BAYES_999 21468 12.20 19.28 9.98 32 TR_DCC_Bayes_99 20980 6.80 18.84 3.02 33 UNTRUSTED_Relay 20954 5.33 18.82 1.09 34 XM_UncommonTLD01 18596 6.29 16.70 3.02 35 XM_Multi_Part_URI 18272 12.40 16.41 11.14 36 BOTNET_IPINHOSTNAME 16650 6.69 14.96 4.10 37 BOTNET 15873 4.50 14.26 1.43 38 XM_B_Unsub 15057 11.04 13.52 10.26 39 LOTS_OF_MONEY 15024 10.29 13.49 9.29 40 UNPARSEABLE_RELAY 13551 8.83 12.17 7.78 41 SpammyFromTLD_02 13471 3.19 12.10 0.39 42 TR_XM_UnparsRelay 13203 7.44 11.86 6.06 43 HTML_IMAGE_RATIO_02 12974 7.46 11.65 6.15 44 HTML_MIME_NO_HTML_TAG 12637 4.81 11.35 2.75 45 TR_XM_SpammyWords4 12591 6.91 11.31 5.53 46 T_REMOTE_IMAGE 12421 5.50 11.16 3.73 47 RCVD_IN_BL_SPAMCOP_NET 12072 3.26 10.84 0.88 48 XMSexyCombo_05 12015 5.47 10.79 3.79 49 KHOP_HELO_FCRDNS 11984 4.33 10.76 2.31 50 RCVD_IN_MSPIKE_H3 11896 13.02 10.68 13.75 51 TR_XM_SpammyRelay 11808 3.43 10.61 1.17 52 XM_B_SpammyWords3 11702 5.23 10.51 3.57 53 T_HTML_TAG_BALANCE_CENTER 10983 2.41 9.86 0.07 54 TR_XM_SpammyWords2 10695 3.09 9.61 1.05 55 HTML_IMAGE_ONLY_08 10618 2.34 9.54 0.08 56 XM_UB50 10607 2.82 9.53 0.71 57 XM_SendGrid 10499 7.57 9.43 6.99 58 BODY_URI_ONLY 9591 2.07 8.61 0.02 59 XM_Evil_Numbers_Gen 9578 8.05 8.60 7.88 60 RCVD_IN_MSPIKE_H4 9147 11.10 8.22 12.00 61 MIXED_HREF_CASE 8805 1.89 7.91 0.00 62 MIXED_CENTER_CASE 8805 1.89 7.91 0.00 63 MIXED_IMG_CASE 8800 1.89 7.90 0.00 64 MIXED_AREA_CASE 8795 1.89 7.90 0.00 65 MIXED_FONT_CASE 8408 1.81 7.55 0.00 66 BAYES_80 8191 4.42 7.36 3.50 67 MPART_ALT_DIFF 8172 7.13 7.34 7.07 68 LotsOfNums_01 8145 8.39 7.32 8.73 69 BAYES_60 8134 7.75 7.31 7.89 70 MIXED_CTYPE_CASE 8118 1.75 7.29 0.00 71 XM_B_Phish_Phrases 7182 4.49 6.45 3.88 72 XMNumbers 7150 3.73 6.42 2.88 73 XMSubMetaSx_00 7087 4.71 6.37 4.19 74 TR_XM_PhishingBody 6922 3.63 6.22 2.81 75 TooManyTo_001 6745 6.86 6.06 7.12 76 HTML_FONT_SIZE_LARGE 6691 1.49 6.01 0.07 77 XM_H_Long_From01 6469 5.04 5.81 4.80 78 GOOG_STO_IMG_HTML 5962 1.28 5.36 0.00 79 HTML_IMAGE_RATIO_04 5793 6.39 5.20 6.76 80 DKIM_INVALID 5558 3.43 4.99 2.94 81 TR_XM_SPAMCOP 5430 1.43 4.88 0.35 82 MIME_HTML_MOSTLY 5222 3.06 4.69 2.55 83 TR_XM_DK_SendGrid 5177 4.66 4.65 4.66 84 RCVD_IN_PSBL 5171 1.19 4.64 0.10 85 ALIBABA_IMG_NOT_RCVD_ALI 4905 1.06 4.41 0.00 86 HOSTED_IMG_DIRECT_MX 4879 1.05 4.38 0.00 87 RELAYCOUNTRY_CA 4822 1.49 4.33 0.60 88 XM_B_Investor 4787 1.87 4.30 1.11 89 RCVD_IN_MSPIKE_BL 4611 1.10 4.14 0.14 90 MIME_QP_LONG_LINE 4587 5.21 4.12 5.55 91 XM_B_SpammyTLD 4587 2.34 4.12 1.78 92 URI_GOOG_STO_SPAMMY 4477 0.96 4.02 0.00 93 HTML_FONT_SIZE_HUGE 4220 0.95 3.79 0.06 94 URIBL_DBL_SPAM 4134 0.89 3.71 0.00 95 TM2_M_URI_OPT_OUT 4086 3.67 3.67 3.67 96 XMStrtUSub 4078 4.24 3.66 4.42 97 BAYES_95 4066 2.56 3.65 2.21 98 XM_B_Phish66 4056 1.93 3.64 1.40 99 WANT_TO_ORDER 4041 0.87 3.63 0.00 100 MIME_HTML_ONLY_MULTI 3959 4.62 3.56 4.96 101 XM_SPF_SoftFail 3929 3.88 3.53 4.00 102 TR_XM_SpammyWords5 3917 1.73 3.52 1.17 103 BAYES_40 3853 4.75 3.46 5.15 104 HTML_IMAGE_RATIO_06 3808 3.79 3.42 3.91 105 TR_XM_MSPIKECOMBO 3701 0.90 3.32 0.14 106 RCVD_IN_MSPIKE_L3 3685 0.89 3.31 0.14 107 T_XMDrugObfuBody_08 3655 1.75 3.28 1.26 108 RCVD_IN_RP_RNBL 3639 0.87 3.27 0.11 109 XM_B_COVIDMETA 3401 1.24 3.05 0.67 110 BAYES_20 3360 3.51 3.02 3.67 111 XM_DIRTYINTL 3359 0.90 3.02 0.23 112 XM_OfRef6 3298 1.27 2.96 0.74 113 TR_XM_NoHeaderRelay 3133 0.78 2.81 0.15 114 BAYES_00 3125 11.07 2.81 13.67 115 TR_XM_PHPDW 3100 0.87 2.78 0.27 116 T_TooManySym_01 3056 4.55 2.74 5.11 117 T_XMDrugObfuBody_14 3049 2.21 2.74 2.04 118 RCVD_IN_VALIDITY_RPBL 3044 0.73 2.73 0.10 119 XM_CamelCaseFrm001 3027 1.94 2.72 1.70 120 TR_XM_PHPForged 2976 0.81 2.67 0.23 121 RCVD_IN_IADB_LISTED 2972 4.68 2.67 5.31 122 TR_XM_FormFill2 2962 0.81 2.66 0.23 123 XM_H_PHPOS 2953 0.80 2.65 0.22 124 XM_DK_Undo_01 2943 1.94 2.64 1.71 125 URI_NOVOWEL 2939 2.68 2.64 2.70 126 SpammyFromTLD_01 2838 1.01 2.55 0.52 127 DATE_IN_PAST_03_06 2837 0.83 2.55 0.29 128 RELAYCOUNTRY_CH 2795 0.61 2.51 0.02 129 BOTNET_NORDNS 2790 0.61 2.51 0.01 130 RCVD_IN_IADB_SPF 2626 4.07 2.36 4.61 131 XM_B_Unsub2 2601 1.43 2.34 1.15 132 XMDiploma_00 2590 1.50 2.33 1.24 133 HTML_IMAGE_RATIO_08 2575 3.46 2.31 3.82 134 T_FILL_THIS_FORM_SHORT 2521 1.05 2.26 0.67 135 T_XMDrugObfuBody_00 2501 1.09 2.25 0.73 136 RCVD_IN_IADB_DK 2476 3.57 2.22 3.99 137 RCVD_IN_IADB_SENDERID 2448 3.66 2.20 4.12 138 TM2_M_VERY_LONG_WORD 2356 1.35 2.12 1.11 139 TR_Symld_Words 2331 2.10 2.09 2.10 140 TR_XM_SpammyWords3 2276 0.58 2.04 0.12 141 TR_XM_SB_Phish 2230 1.96 2.00 1.95 142 XMSexyCombo_01 2218 1.43 1.99 1.25 143 ALL_TRUSTED 2176 13.23 1.95 16.77 144 XMSubPhish11 2141 1.92 1.92 1.92 145 SUBJ_ALL_CAPS 2123 2.13 1.91 2.21 146 XM_URI_RBL 2097 0.56 1.88 0.15 147 URI_HEX 2075 1.47 1.86 1.35 148 PDS_OTHER_BAD_TLD 2073 0.58 1.86 0.18 149 RCVD_IN_RP_SAFE 2070 5.86 1.86 7.12 150 XMBrknScrpt_02 2066 1.04 1.86 0.78 151 FROM_EXCESS_BASE64 2047 2.37 1.84 2.54 152 XM_Body_Dirty_Words_01 2030 0.57 1.82 0.18 153 LOCALPART_IN_SUBJECT 1997 0.44 1.79 0.02 154 RELAYCOUNTRY_FR 1965 0.60 1.76 0.23 155 RELAYCOUNTRY_DE 1965 0.59 1.76 0.22 156 MAILING_LIST_MULTI 1913 1.96 1.72 2.03 157 XM_UB60 1882 0.45 1.69 0.06 158 READY_TO_SHIP 1875 0.40 1.68 0.00 159 XMStockSpam_06 1857 1.32 1.67 1.21 160 RELAYCOUNTRY_NL 1813 0.51 1.63 0.16 161 RELAYCOUNTRY_AZ 1804 0.39 1.62 0.00 162 HK_RANDOM_FROM 1790 0.47 1.61 0.12 163 XM_B_SpammyWords4 1762 0.63 1.58 0.33 164 URIBL_BLACK 1679 0.37 1.51 0.01 165 DIET_1 1671 0.81 1.50 0.59 166 TR_XM_COVIDMETA1 1667 0.59 1.50 0.31 167 XM_UB99 1664 0.36 1.49 0.00 168 XMSubMetaI_00 1626 0.70 1.46 0.47 169 TR_LOTS_OF_MONEY3 1615 0.50 1.45 0.20 170 XMBody_17 1594 0.67 1.43 0.43 171 TR_XM_INV_DKIM 1522 0.52 1.37 0.25 172 RELAYCOUNTRY_AU 1506 0.50 1.35 0.23 173 XMGenDplmaNmb 1496 0.93 1.34 0.80 174 XM_H_Undi_Recip 1454 0.41 1.31 0.14 175 BAYES_05 1409 2.06 1.27 2.31 176 RDNS_DYNAMIC 1402 0.63 1.26 0.43 177 TR_XM_COVIDMETA4 1394 0.49 1.25 0.25 178 TR_XM_BayesRelay 1392 0.30 1.25 0.00 179 URI_TRY_3LD 1387 1.16 1.25 1.13 180 HK_RANDOM_ENVFROM 1370 0.37 1.23 0.10 181 XM_B_DNDMA 1349 0.58 1.21 0.38 182 HTML_FONT_FACE_BAD 1347 3.15 1.21 3.76 183 XMPhish30 1341 0.77 1.20 0.63 184 XM_UB80 1333 0.30 1.20 0.02 185 RCVD_IN_RP_CERTIFIED 1327 4.92 1.19 6.09 186 RCVD_IN_IADB_VOUCHED 1321 2.83 1.19 3.35 187 T_XMHurry_00 1310 0.56 1.18 0.36 188 JH_SPAMMY_HEADERS 1251 0.27 1.12 0.00 189 USER_IN_DEF_DKIM_WL 1239 8.86 1.11 11.29 190 TR_BOTNET_NEGATE 1238 0.49 1.11 0.30 191 XMSexyCombo_04 1237 0.73 1.11 0.61 192 URI_PHP_REDIR 1232 0.26 1.11 0.00 193 T_Symld_Words_02 1169 0.61 1.05 0.47 194 TR_Mismatch_TLD_02 1168 0.29 1.05 0.05 195 XM_UB999 1136 0.24 1.02 0.00 196 RCVD_IN_VALIDITY_SAFE 1127 4.89 1.01 6.10 197 XMSubMetaSxObfu_03 1117 1.00 1.00 0.99 198 XMHTML_After_End 1107 0.61 0.99 0.50 199 MONEY_NOHTML 1093 0.31 0.98 0.10 200 XM_H_PHPMailer 1068 0.64 0.96 0.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312957 90.13 95.96 88.29 2 RELAYCOUNTRY_US 287936 79.53 74.09 81.23 3 XM_B_Unicode 252558 71.34 71.61 71.25 4 DKIM_SIGNED 238617 69.53 76.56 67.32 5 XM_DK_Pass 234088 67.98 74.15 66.04 6 DKIM_VALID 228186 66.10 71.57 64.38 7 DCC_CHECK_NEGATIVE 219282 52.11 21.04 61.87 8 BAYES_50 179623 49.53 45.90 50.68 9 DKIM_VALID_AU 172872 49.12 50.22 48.77 10 XM_B_Unicode3 164125 45.32 42.20 46.30 11 XMListUnsubscribeExists 154991 47.91 61.24 43.73 12 XM_B_SpammyWords 147761 46.54 62.00 41.69 13 DCC_CHECK 135031 47.85 78.92 38.10 14 T_TM2_M_HEADER_IN_MSG 102191 27.01 21.22 28.83 15 RCVD_IN_MSPIKE_WL 99829 26.11 19.56 28.16 16 HTML_FONT_LOW_CONTRAST 90226 26.83 31.22 25.46 17 DKIM_VALID_EF 86121 25.08 27.59 24.30 18 MIME_HTML_ONLY 80618 26.87 40.00 22.74 19 LOC_TINY_FONT_1 79651 24.33 30.25 22.47 20 FVGT_m_MULTI_ODD 75465 22.19 25.06 21.29 21 XMSubLong 71425 20.54 21.79 20.15 22 RCVD_IN_MSPIKE_H2 64885 19.21 22.11 18.31 23 XM_B_SpammyWords2 61130 21.82 36.39 17.25 24 ALL_TRUSTED 59427 13.23 1.95 16.77 25 T_KAM_HTML_FONT_INVALID 57879 18.72 26.32 16.33 26 RCVD_IN_MSPIKE_H3 48732 13.02 10.68 13.75 27 BAYES_00 48450 11.07 2.81 13.67 28 RCVD_IN_MSPIKE_H4 42545 11.10 8.22 12.00 29 USER_IN_DEF_DKIM_WL 40017 8.86 1.11 11.29 30 XM_Multi_Part_URI 39484 12.40 16.41 11.14 31 XM_Body_Dirty_Words 38999 13.21 20.25 11.00 32 BAYES_99 38704 14.34 25.23 10.92 33 XM_B_Unsub 36367 11.04 13.52 10.26 34 BAYES_999 35369 12.20 19.28 9.98 35 LOTS_OF_MONEY 32927 10.29 13.49 9.29 36 XM_H_Trusted_IP 31559 6.78 0.00 8.90 37 LotsOfNums_01 30945 8.39 7.32 8.73 38 FSL_BULK_SIG 29287 11.79 23.02 8.26 39 BAYES_60 27978 7.75 7.31 7.89 40 XM_Evil_Numbers_Gen 27914 8.05 8.60 7.88 41 XM_DKIMWhitelistDomains 27708 5.98 0.12 7.82 42 UNPARSEABLE_RELAY 27560 8.83 12.17 7.78 43 TR_XM_DK_Bayes 26462 5.82 0.60 7.47 44 TR_XM_DK_Bayes1 25633 5.64 0.57 7.23 45 XM_DK_Undo_02 25343 13.91 35.43 7.15 46 RCVD_IN_RP_SAFE 25238 5.86 1.86 7.12 47 TooManyTo_001 25230 6.86 6.06 7.12 48 MPART_ALT_DIFF 25050 7.13 7.34 7.07 49 XM_SendGrid 24765 7.57 9.43 6.99 50 HTML_IMAGE_RATIO_04 23963 6.39 5.20 6.76 51 TR_XM_DK_Bayes2 22452 4.92 0.43 6.33 52 HTML_IMAGE_RATIO_02 21796 7.46 11.65 6.15 53 RCVD_IN_VALIDITY_SAFE 21635 4.89 1.01 6.10 54 RCVD_IN_RP_CERTIFIED 21569 4.92 1.19 6.09 55 TR_XM_UnparsRelay 21468 7.44 11.86 6.06 56 MIME_QP_LONG_LINE 19666 5.21 4.12 5.55 57 TR_XM_SpammyWords4 19603 6.91 11.31 5.53 58 RCVD_IN_IADB_LISTED 18835 4.68 2.67 5.31 59 TR_XM_DKIM_Undo 18642 10.86 28.67 5.26 60 RCVD_IN_VALIDITY_CERTIFIED 18470 4.09 0.50 5.21 61 BAYES_40 18271 4.75 3.46 5.15 62 T_TooManySym_01 18127 4.55 2.74 5.11 63 MIME_HTML_ONLY_MULTI 17565 4.62 3.56 4.96 64 ANY_BOUNCE_MESSAGE 17125 3.88 0.85 4.83 65 BOUNCE_MESSAGE 17122 3.88 0.85 4.83 66 XM_H_Long_From01 17029 5.04 5.81 4.80 67 TR_XM_DK_SendGrid 16523 4.66 4.65 4.66 68 XM_PDF 16381 3.73 0.89 4.62 69 RCVD_IN_IADB_SPF 16326 4.07 2.36 4.61 70 XMStrtUSub 15682 4.24 3.66 4.42 71 XMSubNoVowel 15652 3.50 0.59 4.42 72 XMSubMetaSx_00 14865 4.71 6.37 4.19 73 RCVD_IN_IADB_SENDERID 14587 3.66 2.20 4.12 74 BOTNET_IPINHOSTNAME 14515 6.69 14.96 4.10 75 XM_SPF_SoftFail 14164 3.88 3.53 4.00 76 RCVD_IN_IADB_DK 14155 3.57 2.22 3.99 77 HTML_IMAGE_RATIO_06 13842 3.79 3.42 3.91 78 XM_B_Phish_Phrases 13755 4.49 6.45 3.88 79 HTML_IMAGE_RATIO_08 13533 3.46 2.31 3.82 80 XMSexyCombo_05 13449 5.47 10.79 3.79 81 HTML_FONT_FACE_BAD 13337 3.15 1.21 3.76 82 T_REMOTE_IMAGE 13220 5.50 11.16 3.73 83 TM2_M_URI_OPT_OUT 13011 3.67 3.67 3.67 84 BAYES_20 13002 3.51 3.02 3.67 85 XM_B_SpammyWords3 12639 5.23 10.51 3.57 86 BAYES_80 12394 4.42 7.36 3.50 87 TVD_SPACE_RATIO_MINFP 11964 2.61 0.17 3.38 88 RCVD_IN_IADB_VOUCHED 11872 2.83 1.19 3.35 89 XM_UncommonTLD01 10717 6.29 16.70 3.02 90 TR_DCC_Bayes_99 10712 6.80 18.84 3.02 91 DKIM_INVALID 10431 3.43 4.99 2.94 92 T_TooManySym_02 10295 2.37 0.66 2.90 93 XMNumbers 10210 3.73 6.42 2.88 94 TR_XM_PhishingBody 9970 3.63 6.22 2.81 95 HTML_MIME_NO_HTML_TAG 9758 4.81 11.35 2.75 96 RELAYCOUNTRY_META 9732 7.27 21.66 2.75 97 URI_NOVOWEL 9553 2.68 2.64 2.70 98 MIME_HTML_MOSTLY 9034 3.06 4.69 2.55 99 FROM_EXCESS_BASE64 9014 2.37 1.84 2.54 100 RCVD_IN_MSPIKE_H5 8552 1.99 0.66 2.41 101 KHOP_HELO_FCRDNS 8177 4.33 10.76 2.31 102 BAYES_05 8174 2.06 1.27 2.31 103 BAYES_95 7846 2.56 3.65 2.21 104 SUBJ_ALL_CAPS 7821 2.13 1.91 2.21 105 RCVD_IN_IADB_OPTIN 7508 1.80 0.80 2.12 106 TR_Symld_Words 7451 2.10 2.09 2.10 107 T_XMDrugObfuBody_14 7237 2.21 2.74 2.04 108 MAILING_LIST_MULTI 7202 1.96 1.72 2.03 109 TR_XM_SB_Phish 6899 1.96 2.00 1.95 110 INVALID_MSGID 6841 1.55 0.33 1.93 111 XMSubPhish11 6800 1.92 1.92 1.92 112 IN_HORDE_ADDRESS_BOOK 6687 1.46 0.10 1.89 113 XM_B_SpammyTLD 6326 2.34 4.12 1.78 114 TooManyTo_002 6275 1.54 0.81 1.77 115 MSGID_NOFQDN1 6243 1.37 0.11 1.76 116 XM_DK_Undo_01 6073 1.94 2.64 1.71 117 XM_CamelCaseFrm001 6025 1.94 2.72 1.70 118 TO_MALFORMED 6023 1.29 0.01 1.70 119 TVD_RCVD_IP 5501 1.38 0.84 1.55 120 BOTNET 5070 4.50 14.26 1.43 121 XM_B_Phish66 4949 1.93 3.64 1.40 122 HELO_NODOT 4912 1.20 0.59 1.39 123 HELO_NO_DOMAIN 4910 1.19 0.59 1.39 124 URI_HEX 4782 1.47 1.86 1.35 125 HTML_IMAGE_ONLY_20 4643 1.11 0.46 1.31 126 T_XMDrugObfuBody_08 4482 1.75 3.28 1.26 127 XMSexyCombo_01 4428 1.43 1.99 1.25 128 XMDiploma_00 4397 1.50 2.33 1.24 129 XMStockSpam_06 4290 1.32 1.67 1.21 130 TR_XM_SpammyRelay 4156 3.43 10.61 1.17 131 TR_XM_SpammyWords5 4150 1.73 3.52 1.17 132 XMGappySubj_01 4131 0.92 0.13 1.17 133 XM_B_Unsub2 4065 1.43 2.34 1.15 134 TooManyTo_003 4058 1.02 0.63 1.14 135 URI_TRY_3LD 3999 1.16 1.25 1.13 136 TM2_M_VERY_LONG_WORD 3921 1.35 2.12 1.11 137 XM_B_Investor 3919 1.87 4.30 1.11 138 XM_GoogleGroups 3895 1.05 0.90 1.10 139 UNTRUSTED_Relay 3880 5.33 18.82 1.09 140 IN_ZIMBRA_NJ_WHITELIST 3829 0.82 0.01 1.08 141 TR_XM_SpammyWords2 3712 3.09 9.61 1.05 142 XMBSHREFv2 3569 0.81 0.19 1.01 143 XMSubMetaSxObfu_03 3522 1.00 1.00 0.99 144 XMCapTrack 3453 0.86 0.48 0.97 145 XM_ProductURIs 3440 0.96 0.94 0.97 146 TVD_SPACE_RATIO 3148 0.71 0.13 0.89 147 XM_H_Long_From02 3146 0.89 0.88 0.89 148 RCVD_IN_BL_SPAMCOP_NET 3116 3.26 10.84 0.88 149 DKIM_ADSP_CUSTOM_MED 3115 0.85 0.77 0.88 150 XMBdyGiftCard01 3027 0.82 0.69 0.85 151 FILL_THIS_FORM 3018 0.77 0.52 0.85 152 XMGenDplmaNmb 2825 0.93 1.34 0.80 153 PLING_QUERY 2821 0.74 0.55 0.80 154 TooManyTo_004 2803 0.73 0.53 0.79 155 XM_E_Blogspot 2775 0.62 0.12 0.78 156 XMBrknScrpt_02 2764 1.04 1.86 0.78 157 T_OBFU_PDF_ATTACH 2733 0.61 0.11 0.77 158 XMBody_95 2712 0.63 0.21 0.77 159 XM_OfRef6 2611 1.27 2.96 0.74 160 XMLngstWrd_00 2596 0.64 0.37 0.73 161 T_XMDrugObfuBody_00 2570 1.09 2.25 0.73 162 T_TooManySym_03 2551 0.60 0.21 0.72 163 XM_UB50 2525 2.82 9.53 0.71 164 TR_MetaPhish_Combo_01 2501 0.71 0.74 0.71 165 HTML_TAG_BALANCE_BODY 2437 0.72 0.82 0.69 166 XM_RXBody 2397 0.63 0.49 0.68 167 T_FILL_THIS_FORM_SHORT 2385 1.05 2.26 0.67 168 XM_B_COVIDMETA 2380 1.24 3.05 0.67 169 XMPhish30 2238 0.77 1.20 0.63 170 TooManyTo_005 2233 0.59 0.46 0.63 171 TR_MSPIKEBAYES00 2227 0.49 0.03 0.63 172 XMBody_78 2190 0.70 0.96 0.62 173 XMSexyCombo_04 2148 0.73 1.11 0.61 174 RELAYCOUNTRY_CA 2130 1.49 4.33 0.60 175 RELAYCOUNTRY_GB 2120 0.67 0.89 0.60 176 DIET_1 2101 0.81 1.50 0.59 177 XMLngstWrd_01 2044 0.52 0.32 0.58 178 XMNoVowels 1992 0.56 0.56 0.56 179 HTTPS_HTTP_MISMATCH 1979 0.60 0.72 0.56 180 NML_ADSP_CUSTOM_MED 1962 0.55 0.53 0.55 181 XM_B_COPY_HTML 1947 0.62 0.83 0.55 182 XMSubMetaSx_01 1937 0.48 0.29 0.55 183 XM_H_PHPMailer 1906 0.64 0.96 0.54 184 XMSexyCombo_02 1855 0.48 0.36 0.52 185 SpammyFromTLD_01 1847 1.01 2.55 0.52 186 TM2_M_A_HREF_HREF 1774 0.59 0.89 0.50 187 XMHTML_After_End 1756 0.61 0.99 0.50 188 XM_ShortIntro_01 1728 0.49 0.50 0.49 189 FROM_GOV_DKIM_AU 1709 0.40 0.15 0.48 190 XM_D_tchamptons_WL 1705 0.37 0.00 0.48 191 FORGED_GMAIL_RCVD 1677 0.51 0.61 0.47 192 T_Symld_Words_02 1663 0.61 1.05 0.47 193 XMSubMetaI_00 1649 0.70 1.46 0.47 194 XMOemUri 1627 0.41 0.24 0.46 195 XMLngstWrd_02 1602 0.41 0.26 0.45 196 TM2_M_BODY_EMPTY 1582 0.37 0.11 0.45 197 HTML_IMAGE_ONLY_28 1557 0.40 0.26 0.44 198 XMPhish14 1552 0.51 0.75 0.44 199 XMMoneyMeta_00 1550 0.53 0.81 0.44 200 XMHTMLBadTable_001 1542 0.43 0.43 0.44 ----------------------------------------------------------------------