Email: 555974 Autolearn: 0 AvgScore: -0.07 AvgScanTime: 1.50 sec Spam: 112599 Autolearn: 0 AvgScore: 13.21 AvgScanTime: 1.94 sec Ham: 443375 Autolearn: 0 AvgScore: -3.44 AvgScanTime: 1.39 sec Time Spent Running SA: 232.38 hours Time Spent Processing Spam: 60.79 hours Time Spent Processing Ham: 171.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 106471 90.77 94.56 89.81 2 DKIM_SIGNED 94078 64.28 83.55 59.39 3 RELAYCOUNTRY_US 91689 80.64 81.43 80.44 4 XM_DK_Pass 90351 62.51 80.24 58.01 5 XM_B_Unicode 87906 74.16 78.07 73.16 6 DKIM_VALID 87075 60.53 77.33 56.26 7 DCC_CHECK 83097 40.82 73.80 32.44 8 XM_B_SpammyWords 78978 49.61 70.14 44.40 9 XMListUnsubscribeExists 76931 44.15 68.32 38.01 10 DKIM_VALID_AU 63537 45.36 56.43 42.55 11 BAYES_50 51732 48.84 45.94 49.57 12 XM_B_Unicode3 50689 44.72 45.02 44.64 13 XM_DK_Undo_02 44187 12.53 39.24 5.75 14 XM_B_SpammyWords2 42598 20.05 37.83 15.53 15 LOC_TINY_FONT_1 37385 21.75 33.20 18.84 16 HTML_FONT_LOW_CONTRAST 36857 24.55 32.73 22.48 17 TR_XM_DKIM_Undo 35402 9.81 31.44 4.32 18 MIME_HTML_ONLY 33659 25.30 29.89 24.13 19 FVGT_m_MULTI_ODD 33053 21.19 29.35 19.12 20 DKIM_VALID_EF 32556 23.27 28.91 21.84 21 BAYES_99 31630 10.86 28.09 6.48 22 T_KAM_HTML_FONT_INVALID 31187 17.34 27.70 14.71 23 RCVD_IN_MSPIKE_H2 31151 19.37 27.67 17.27 24 XMSubLong 29882 21.67 26.54 20.43 25 T_TM2_M_HEADER_IN_MSG 29864 25.95 26.52 25.80 26 DCC_CHECK_NEGATIVE 29474 59.14 26.18 67.51 27 RCVD_IN_MSPIKE_WL 24619 24.01 21.86 24.56 28 BAYES_999 24143 8.87 21.44 5.67 29 XM_Body_Dirty_Words 24043 12.76 21.35 10.58 30 TR_DCC_Bayes_99 23935 6.10 21.26 2.25 31 RELAYCOUNTRY_META 21364 6.44 18.97 3.26 32 XM_Multi_Part_URI 18350 10.71 16.30 9.29 33 FSL_BULK_SIG 17297 8.72 15.36 7.04 34 BOTNET_IPINHOSTNAME 17043 5.72 15.14 3.33 35 LOTS_OF_MONEY 16144 8.10 14.34 6.51 36 BOTNET 15429 3.70 13.70 1.17 37 UNPARSEABLE_RELAY 14566 7.58 12.94 6.22 38 RCVD_IN_MSPIKE_H3 14336 12.56 12.73 12.51 39 XM_B_Unsub 14236 10.46 12.64 9.91 40 XM_B_SpammyWords3 14149 5.20 12.57 3.32 41 TR_XM_UnparsRelay 14031 6.26 12.46 4.68 42 TR_XM_SpammyRelay 13892 3.63 12.34 1.42 43 TR_XM_SpammyWords4 13621 5.69 12.10 4.06 44 RCVD_IN_BL_SPAMCOP_NET 12649 2.88 11.23 0.76 45 XM_Evil_Numbers_Gen 12026 8.56 10.68 8.02 46 UNTRUSTED_Relay 11967 3.05 10.63 1.12 47 HTML_IMAGE_RATIO_02 11446 6.29 10.17 5.30 48 XM_SendGrid 11035 6.41 9.80 5.55 49 TR_XM_PhishingBody 10807 4.63 9.60 3.37 50 TR_XM_SpammyWords2 10506 2.58 9.33 0.86 51 XMSexyCombo_05 9956 4.13 8.84 2.94 52 LotsOfNums_01 9868 7.76 8.76 7.51 53 RCVD_IN_MSPIKE_H4 9704 9.91 8.62 10.23 54 XM_UncommonTLD01 8674 3.81 7.70 2.83 55 BAYES_80 8480 3.99 7.53 3.10 56 TooManyTo_001 7636 8.00 6.78 8.31 57 TR_XM_SPAMCOP 7558 1.63 6.71 0.34 58 XM_B_Phish66 7496 2.66 6.66 1.65 59 BAYES_60 7479 6.69 6.64 6.70 60 XM_H_Long_From01 7218 4.74 6.41 4.32 61 XM_B_Phish_Phrases 7186 3.55 6.38 2.83 62 DKIM_INVALID 7003 3.75 6.22 3.13 63 XMSubMetaSx_00 6847 3.92 6.08 3.37 64 HTML_IMAGE_RATIO_04 6603 14.79 5.86 17.05 65 MPART_ALT_DIFF 6574 9.99 5.84 11.05 66 TR_XM_DK_SendGrid 5722 3.87 5.08 3.57 67 RELAYCOUNTRY_CA 5696 1.58 5.06 0.69 68 XM_SPF_SoftFail 5627 2.33 5.00 1.65 69 XM_UB50 5565 1.57 4.94 0.72 70 MIME_QP_LONG_LINE 5529 5.72 4.91 5.93 71 XM_B_Investor 5376 1.97 4.77 1.26 72 XMStrtUSub 5120 10.10 4.55 11.51 73 TM2_M_URI_OPT_OUT 5066 4.16 4.50 4.08 74 TR_XM_SpammyWords5 4997 1.96 4.44 1.33 75 RCVD_IN_MSPIKE_BL 4942 0.99 4.39 0.13 76 BAYES_95 4769 2.33 4.24 1.84 77 XMNumbers 4768 3.05 4.23 2.75 78 XM_B_SpammyTLD 4703 2.21 4.18 1.71 79 XM_OfRef6 4582 1.77 4.07 1.19 80 TR_XM_MSPIKECOMBO 4431 0.90 3.94 0.12 81 HTML_IMAGE_RATIO_06 4252 4.96 3.78 5.26 82 RCVD_IN_RP_RNBL 4248 0.84 3.77 0.09 83 MIME_HTML_MOSTLY 4134 2.65 3.67 2.39 84 HTML_MIME_NO_HTML_TAG 4066 2.62 3.61 2.37 85 T_XMDrugObfuBody_08 3990 1.66 3.54 1.18 86 MIME_HTML_ONLY_MULTI 3595 8.01 3.19 9.23 87 RCVD_IN_VALIDITY_RPBL 3508 0.69 3.12 0.07 88 T_XMDrugObfuBody_14 3442 1.90 3.06 1.61 89 SpammyFromTLD_02 3417 0.86 3.03 0.31 90 T_TooManySym_01 3414 4.20 3.03 4.49 91 BAYES_40 3407 5.48 3.03 6.10 92 XMDiploma_00 3281 1.78 2.91 1.49 93 RCVD_IN_IADB_LISTED 3276 4.07 2.91 4.36 94 XM_DIRTYINTL 3194 0.76 2.84 0.24 95 XM_DK_Undo_01 3185 1.74 2.83 1.46 96 T_FILL_THIS_FORM_SHORT 3185 1.11 2.83 0.67 97 KHOP_HELO_FCRDNS 3171 1.59 2.82 1.28 98 XM_GoogleGroups 3101 1.79 2.75 1.54 99 XM_B_SpammyWords4 3092 0.99 2.75 0.55 100 T_REMOTE_IMAGE 3078 3.21 2.73 3.33 101 XM_B_COVIDMETA 2945 0.99 2.62 0.58 102 RCVD_IN_IADB_SPF 2911 3.61 2.59 3.87 103 ALL_TRUSTED 2909 14.43 2.58 17.44 104 XM_B_Unsub2 2908 1.45 2.58 1.16 105 HTML_IMAGE_RATIO_08 2884 2.39 2.56 2.34 106 TR_XM_SB_Phish 2844 2.03 2.53 1.90 107 XM_CamelCaseFrm001 2838 1.62 2.52 1.39 108 XMSubPhish11 2774 2.00 2.46 1.88 109 RCVD_IN_IADB_DK 2763 3.23 2.45 3.42 110 RCVD_IN_IADB_SENDERID 2708 3.29 2.40 3.52 111 SpammyFromTLD_01 2694 0.96 2.39 0.59 112 BOTNET_NORDNS 2691 0.50 2.39 0.01 113 TR_XM_PHPDW 2682 0.72 2.38 0.30 114 XMSexyCombo_01 2641 1.35 2.35 1.10 115 XM_URI_RBL 2590 0.53 2.30 0.08 116 TR_XM_PHPForged 2590 0.67 2.30 0.26 117 XM_UB99 2581 0.47 2.29 0.00 118 TM2_M_VERY_LONG_WORD 2561 1.18 2.27 0.91 119 HTML_IMAGE_ONLY_20 2558 1.37 2.27 1.15 120 TR_XM_FormFill2 2552 0.66 2.27 0.26 121 ALIBABA_IMG_NOT_RCVD_ALI 2550 0.46 2.26 0.00 122 XM_H_PHPOS 2537 0.66 2.25 0.25 123 HOSTED_IMG_DIRECT_MX 2535 0.46 2.25 0.00 124 MAILING_LIST_MULTI 2518 2.46 2.24 2.51 125 TR_XM_COVIDMETA1 2383 0.57 2.12 0.17 126 FROM_EXCESS_BASE64 2358 2.38 2.09 2.45 127 RCVD_IN_MSPIKE_L3 2326 0.51 2.07 0.11 128 RCVD_IN_PSBL 2277 0.48 2.02 0.08 129 SUBJ_ALL_CAPS 2246 1.51 1.99 1.39 130 URIBL_DBL_SPAM 2246 0.41 1.99 0.01 131 HTML_SHORT_LINK_IMG_3 2240 0.84 1.99 0.55 132 HTML_TITLE_SUBJ_DIFF 2222 0.78 1.97 0.47 133 WANT_TO_ORDER 2145 0.39 1.90 0.01 134 TR_XM_PhishingBody3 2140 0.39 1.90 0.00 135 BAYES_20 2094 4.51 1.86 5.18 136 XMGenDplmaNmb 2047 0.92 1.82 0.69 137 T_XMDrugObfuBody_00 2009 0.89 1.78 0.67 138 TR_Symld_Words 2001 1.51 1.78 1.45 139 XM_UB999 1998 0.36 1.77 0.00 140 TR_XM_NoHeaderRelay 1975 0.48 1.75 0.15 141 RCVD_IN_MSPIKE_L5 1947 0.35 1.73 0.00 142 XMStockSpam_06 1943 1.28 1.73 1.16 143 MONEY_NOHTML 1930 0.42 1.71 0.09 144 URIBL_BLACK 1924 0.37 1.71 0.03 145 TR_XM_COVIDMETA4 1910 0.58 1.70 0.30 146 URI_NOVOWEL 1879 1.95 1.67 2.02 147 URI_TRY_3LD 1879 0.93 1.67 0.74 148 PDS_OTHER_BAD_TLD 1868 0.55 1.66 0.27 149 XMHTML_After_End 1857 0.93 1.65 0.75 150 DKIM_ADSP_CUSTOM_MED 1852 1.01 1.64 0.85 151 XM_Body_Dirty_Words_01 1832 0.52 1.63 0.24 152 URI_HEX 1825 1.29 1.62 1.20 153 XMBody_17 1817 0.54 1.61 0.27 154 XMBrknScrpt_02 1813 0.88 1.61 0.69 155 TR_LOTS_OF_MONEY3 1781 0.49 1.58 0.22 156 RCVD_IN_RP_SAFE 1774 5.21 1.58 6.13 157 TR_XM_SpammyWords3 1765 0.38 1.57 0.08 158 T_XMHurry_00 1760 0.99 1.56 0.84 159 TR_XM_INV_DKIM 1713 0.49 1.52 0.23 160 BAYES_00 1707 14.49 1.52 17.79 161 NML_ADSP_CUSTOM_MED 1690 0.73 1.50 0.53 162 FORGED_GMAIL_RCVD 1648 0.66 1.46 0.45 163 HTTPS_HTTP_MISMATCH 1538 0.81 1.37 0.66 164 TR_XM_BayesRelay 1530 0.28 1.36 0.00 165 XM_H_Long_From02 1492 0.95 1.33 0.86 166 NA_DOLLARS 1480 0.27 1.31 0.00 167 XM_H_Undi_Recip 1480 0.36 1.31 0.12 168 TR_MetaPhish_Combo_01 1474 0.83 1.31 0.70 169 RCVD_IN_IADB_VOUCHED 1461 2.26 1.30 2.50 170 RELAYCOUNTRY_FR 1450 0.40 1.29 0.17 171 TM2_M_A_HREF_HREF 1440 0.58 1.28 0.40 172 XMPhish30 1419 0.61 1.26 0.45 173 RELAYCOUNTRY_CN 1413 0.32 1.25 0.08 174 XM_H_PHPMailer 1396 0.65 1.24 0.50 175 DATE_IN_PAST_06_12 1375 0.28 1.22 0.04 176 XMMoneyMeta_00 1372 0.59 1.22 0.43 177 TR_Mismatch_TLD_02 1347 0.29 1.20 0.06 178 RELAYCOUNTRY_AU 1338 0.47 1.19 0.29 179 RELAYCOUNTRY_AZ 1323 0.24 1.17 0.00 180 BAYES_05 1298 2.81 1.15 3.23 181 XM_PDF 1260 3.46 1.12 4.05 182 RELAYCOUNTRY_GB 1249 0.83 1.11 0.76 183 T_TooManySym_02 1244 2.21 1.10 2.49 184 MONEY_FORM_SHORT 1234 0.23 1.10 0.01 185 NO_DNS_FOR_FROM 1201 0.40 1.07 0.23 186 TR_XM_MaxWHORU 1177 0.34 1.05 0.16 187 XM_B_SEO 1144 0.31 1.02 0.13 188 XMSubMetaI_00 1129 0.56 1.00 0.45 189 T_MONEY_PERCENT 1129 0.34 1.00 0.17 190 TR_LOTS_OF_MONEY2 1129 0.34 1.00 0.17 191 RELAYCOUNTRY_RU 1127 0.23 1.00 0.04 192 USER_IN_DEF_DKIM_WL 1103 7.58 0.98 9.26 193 TR_BOTNET_NEGATE 1093 0.36 0.97 0.20 194 RDNS_DYNAMIC 1084 0.47 0.96 0.35 195 XMBody_78 1084 0.48 0.96 0.36 196 TR_XM_FormFill 1080 0.20 0.96 0.01 197 XMSubNoVowel 1076 4.74 0.96 5.70 198 HTML_FONT_FACE_BAD 1063 12.65 0.94 15.63 199 XMPhish14 1059 0.42 0.94 0.29 200 TR_XM_SEO4 1049 0.23 0.93 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 398174 90.77 94.56 89.81 2 RELAYCOUNTRY_US 356659 80.64 81.43 80.44 3 XM_B_Unicode 324393 74.16 78.07 73.16 4 DCC_CHECK_NEGATIVE 299343 59.14 26.18 67.51 5 DKIM_SIGNED 263315 64.28 83.55 59.39 6 XM_DK_Pass 257184 62.51 80.24 58.01 7 DKIM_VALID 249456 60.53 77.33 56.26 8 BAYES_50 219791 48.84 45.94 49.57 9 XM_B_Unicode3 197930 44.72 45.02 44.64 10 XM_B_SpammyWords 196855 49.61 70.14 44.40 11 DKIM_VALID_AU 188648 45.36 56.43 42.55 12 XMListUnsubscribeExists 168537 44.15 68.32 38.01 13 DCC_CHECK 143851 40.82 73.80 32.44 14 T_TM2_M_HEADER_IN_MSG 114395 25.95 26.52 25.80 15 RCVD_IN_MSPIKE_WL 108897 24.01 21.86 24.56 16 MIME_HTML_ONLY 106998 25.30 29.89 24.13 17 HTML_FONT_LOW_CONTRAST 99658 24.55 32.73 22.48 18 DKIM_VALID_EF 96816 23.27 28.91 21.84 19 XMSubLong 90598 21.67 26.54 20.43 20 FVGT_m_MULTI_ODD 84756 21.19 29.35 19.12 21 LOC_TINY_FONT_1 83553 21.75 33.20 18.84 22 BAYES_00 78872 14.49 1.52 17.79 23 XM_H_Trusted_IP 77763 13.99 0.00 17.54 24 ALL_TRUSTED 77321 14.43 2.58 17.44 25 RCVD_IN_MSPIKE_H2 76550 19.37 27.67 17.27 26 HTML_IMAGE_RATIO_04 75606 14.79 5.86 17.05 27 HTML_FONT_FACE_BAD 69287 12.65 0.94 15.63 28 XM_B_SpammyWords2 68870 20.05 37.83 15.53 29 T_KAM_HTML_FONT_INVALID 65217 17.34 27.70 14.71 30 RCVD_IN_MSPIKE_H3 55472 12.56 12.73 12.51 31 XMStrtUSub 51025 10.10 4.55 11.51 32 MPART_ALT_DIFF 48982 9.99 5.84 11.05 33 XM_Body_Dirty_Words 46900 12.76 21.35 10.58 34 RCVD_IN_MSPIKE_H4 45373 9.91 8.62 10.23 35 XM_B_Unsub 43924 10.46 12.64 9.91 36 XM_Multi_Part_URI 41183 10.71 16.30 9.29 37 USER_IN_DEF_DKIM_WL 41040 7.58 0.98 9.26 38 MIME_HTML_ONLY_MULTI 40935 8.01 3.19 9.23 39 TooManyTo_001 36865 8.00 6.78 8.31 40 XM_Evil_Numbers_Gen 35548 8.56 10.68 8.02 41 LotsOfNums_01 33276 7.76 8.76 7.51 42 FSL_BULK_SIG 31194 8.72 15.36 7.04 43 BAYES_60 29699 6.69 6.64 6.70 44 LOTS_OF_MONEY 28869 8.10 14.34 6.51 45 BAYES_99 28751 10.86 28.09 6.48 46 TR_XM_DK_Bayes 28130 5.21 0.73 6.34 47 UNPARSEABLE_RELAY 27558 7.58 12.94 6.22 48 TR_XM_DK_Bayes1 27246 5.04 0.68 6.15 49 RCVD_IN_RP_SAFE 27179 5.21 1.58 6.13 50 BAYES_40 27063 5.48 3.03 6.10 51 XM_DKIMWhitelistDomains 26712 4.82 0.06 6.02 52 MIME_QP_LONG_LINE 26283 5.72 4.91 5.93 53 XM_DK_Undo_02 25478 12.53 39.24 5.75 54 XMSubNoVowel 25286 4.74 0.96 5.70 55 BAYES_999 25159 8.87 21.44 5.67 56 XM_SendGrid 24611 6.41 9.80 5.55 57 RCVD_IN_RP_CERTIFIED 24313 4.55 0.87 5.48 58 HTML_IMAGE_RATIO_02 23509 6.29 10.17 5.30 59 HTML_IMAGE_RATIO_06 23310 4.96 3.78 5.26 60 RCVD_IN_VALIDITY_SAFE 23160 4.32 0.75 5.22 61 TR_XM_DK_Bayes2 23109 4.28 0.59 5.21 62 BAYES_20 22983 4.51 1.86 5.18 63 TR_XM_UnparsRelay 20758 6.26 12.46 4.68 64 RCVD_IN_VALIDITY_CERTIFIED 20723 3.78 0.26 4.67 65 T_TooManySym_01 19927 4.20 3.03 4.49 66 RCVD_IN_IADB_LISTED 19332 4.07 2.91 4.36 67 XM_H_Long_From01 19150 4.74 6.41 4.32 68 TR_XM_DKIM_Undo 19135 9.81 31.44 4.32 69 ANY_BOUNCE_MESSAGE 18272 3.47 0.90 4.12 70 BOUNCE_MESSAGE 18249 3.46 0.89 4.12 71 TM2_M_URI_OPT_OUT 18078 4.16 4.50 4.08 72 TR_XM_SpammyWords4 17995 5.69 12.10 4.06 73 XM_PDF 17964 3.46 1.12 4.05 74 RCVD_IN_IADB_SPF 17156 3.61 2.59 3.87 75 TR_XM_DK_SendGrid 15815 3.87 5.08 3.57 76 RCVD_IN_IADB_SENDERID 15593 3.29 2.40 3.52 77 RCVD_IN_IADB_DK 15170 3.23 2.45 3.42 78 XMSubMetaSx_00 14960 3.92 6.08 3.37 79 TR_XM_PhishingBody 14929 4.63 9.60 3.37 80 T_REMOTE_IMAGE 14781 3.21 2.73 3.33 81 BOTNET_IPINHOSTNAME 14755 5.72 15.14 3.33 82 XM_B_SpammyWords3 14736 5.20 12.57 3.32 83 RELAYCOUNTRY_META 14435 6.44 18.97 3.26 84 BAYES_05 14305 2.81 1.15 3.23 85 DKIM_INVALID 13859 3.75 6.22 3.13 86 BAYES_80 13725 3.99 7.53 3.10 87 XMSexyCombo_05 13022 4.13 8.84 2.94 88 IN_ZIMBRA_NJ_WHITELIST 12602 2.27 0.04 2.84 89 XM_B_Phish_Phrases 12552 3.55 6.38 2.83 90 XM_UncommonTLD01 12530 3.81 7.70 2.83 91 XMNumbers 12201 3.05 4.23 2.75 92 MAILING_LIST_MULTI 11140 2.46 2.24 2.51 93 RCVD_IN_IADB_VOUCHED 11105 2.26 1.30 2.50 94 T_TooManySym_02 11033 2.21 1.10 2.49 95 FROM_EXCESS_BASE64 10865 2.38 2.09 2.45 96 MIME_HTML_MOSTLY 10576 2.65 3.67 2.39 97 HTML_MIME_NO_HTML_TAG 10487 2.62 3.61 2.37 98 HTML_IMAGE_RATIO_08 10395 2.39 2.56 2.34 99 TR_DCC_Bayes_99 9963 6.10 21.26 2.25 100 URI_NOVOWEL 8948 1.95 1.67 2.02 101 TooManyTo_002 8883 1.78 0.88 2.00 102 TR_XM_SB_Phish 8435 2.03 2.53 1.90 103 XMSubGarbage 8369 1.51 0.03 1.89 104 XMSubPhish11 8325 2.00 2.46 1.88 105 BAYES_95 8178 2.33 4.24 1.84 106 RCVD_IN_MSPIKE_H5 8052 1.55 0.51 1.82 107 XMSubLongNoVowel 8033 1.47 0.14 1.81 108 XM_B_SpammyTLD 7571 2.21 4.18 1.71 109 XM_SPF_SoftFail 7337 2.33 5.00 1.65 110 XM_B_Phish66 7301 2.66 6.66 1.65 111 T_XMDrugObfuBody_14 7142 1.90 3.06 1.61 112 IN_HORDE_ADDRESS_BOOK 6951 1.27 0.11 1.57 113 HELO_NODOT 6947 1.40 0.73 1.57 114 HELO_NO_DOMAIN 6944 1.40 0.73 1.57 115 INVALID_MSGID 6844 1.27 0.18 1.54 116 XM_GoogleGroups 6825 1.79 2.75 1.54 117 RCVD_IN_IADB_OPTIN 6777 1.40 0.87 1.53 118 XMDiploma_00 6604 1.78 2.91 1.49 119 XM_DK_Undo_01 6464 1.74 2.83 1.46 120 TR_Symld_Words 6408 1.51 1.78 1.45 121 TR_XM_SpammyRelay 6287 3.63 12.34 1.42 122 MSGID_NOFQDN1 6226 1.13 0.05 1.40 123 XM_CamelCaseFrm001 6172 1.62 2.52 1.39 124 SUBJ_ALL_CAPS 6157 1.51 1.99 1.39 125 TO_MALFORMED 6051 1.09 0.01 1.36 126 TR_XM_SpammyWords5 5918 1.96 4.44 1.33 127 TooManyTo_003 5799 1.18 0.67 1.31 128 TVD_RCVD_IP 5759 1.12 0.43 1.30 129 KHOP_HELO_FCRDNS 5665 1.59 2.82 1.28 130 TVD_SPACE_RATIO_MINFP 5629 1.05 0.18 1.27 131 XM_B_Investor 5603 1.97 4.77 1.26 132 URI_HEX 5336 1.29 1.62 1.20 133 XM_OfRef6 5281 1.77 4.07 1.19 134 XM_E_Blogspot 5275 0.97 0.10 1.19 135 T_XMDrugObfuBody_08 5241 1.66 3.54 1.18 136 BOTNET 5168 3.70 13.70 1.17 137 XMStockSpam_06 5151 1.28 1.73 1.16 138 XM_B_Unsub2 5137 1.45 2.58 1.16 139 HTML_IMAGE_ONLY_20 5084 1.37 2.27 1.15 140 UNTRUSTED_Relay 4972 3.05 10.63 1.12 141 XMSexyCombo_01 4889 1.35 2.35 1.10 142 XMCapTrack 4684 0.95 0.53 1.06 143 XMGappySubj_01 4552 0.89 0.34 1.03 144 XMPhish08 4020 0.85 0.62 0.91 145 TM2_M_VERY_LONG_WORD 4014 1.18 2.27 0.91 146 TooManyTo_004 3935 0.81 0.52 0.89 147 TR_XM_SpammyWords2 3824 2.58 9.33 0.86 148 XM_H_Long_From02 3800 0.95 1.33 0.86 149 DKIM_ADSP_CUSTOM_MED 3767 1.01 1.64 0.85 150 T_XMHurry_00 3732 0.99 1.56 0.84 151 XMBSHREFv2 3648 0.72 0.32 0.82 152 SHORT_URI_3 3488 0.73 0.50 0.79 153 RCVD_IN_BL_SPAMCOP_NET 3389 2.88 11.23 0.76 154 RELAYCOUNTRY_GB 3386 0.83 1.11 0.76 155 TVD_SPACE_RATIO 3320 0.62 0.09 0.75 156 XMHTML_After_End 3310 0.93 1.65 0.75 157 XMBdyGiftCard01 3297 0.73 0.66 0.74 158 URI_TRY_3LD 3270 0.93 1.67 0.74 159 XM_UB50 3177 1.57 4.94 0.72 160 TR_MetaPhish_Combo_01 3125 0.83 1.31 0.70 161 TooManyTo_005 3106 0.65 0.43 0.70 162 RELAYCOUNTRY_CA 3075 1.58 5.06 0.69 163 XMBrknScrpt_02 3060 0.88 1.61 0.69 164 XMGenDplmaNmb 3050 0.92 1.82 0.69 165 XMSolicitRefs_0 3044 0.68 0.63 0.69 166 XMNoVowels 3004 0.68 0.71 0.68 167 T_XMDrugObfuBody_00 2965 0.89 1.78 0.67 168 T_FILL_THIS_FORM_SHORT 2962 1.11 2.83 0.67 169 T_TooManySym_03 2960 0.60 0.33 0.67 170 HTTPS_HTTP_MISMATCH 2942 0.81 1.37 0.66 171 SpammyFromTLD_01 2627 0.96 2.39 0.59 172 XM_ProductURIs 2602 0.65 0.91 0.59 173 XM_B_COPY_HTML 2579 0.60 0.69 0.58 174 XM_B_COVIDMETA 2578 0.99 2.62 0.58 175 T_OBFU_PDF_ATTACH 2575 0.49 0.14 0.58 176 XMBody_95 2568 0.52 0.28 0.58 177 XM_ShortIntro_01 2540 0.57 0.55 0.57 178 RCVD_IN_SORBS_DUL 2501 0.58 0.67 0.56 179 SHORT_URI_2 2471 0.54 0.49 0.56 180 HTML_SHORT_LINK_IMG_3 2443 0.84 1.99 0.55 181 XM_B_SpammyWords4 2432 0.99 2.75 0.55 182 XMLngstWrd_00 2396 0.53 0.48 0.54 183 FROM_GOV_DKIM_AU 2380 0.53 0.53 0.54 184 NML_ADSP_CUSTOM_MED 2358 0.73 1.50 0.53 185 TR_MSPIKEBAYES00 2305 0.42 0.04 0.52 186 XM_H_PHPMailer 2209 0.65 1.24 0.50 187 HTML_TITLE_SUBJ_DIFF 2105 0.78 1.97 0.47 188 HTML_TAG_BALANCE_BODY 2036 0.50 0.65 0.46 189 XMSubMetaI_00 2012 0.56 1.00 0.45 190 FORGED_GMAIL_RCVD 2001 0.66 1.46 0.45 191 XMLngstWrd_01 1986 0.44 0.39 0.45 192 SHORT_HELO_AND_INLINE_IMAGE 1981 0.38 0.10 0.45 193 XMPhish30 1978 0.61 1.26 0.45 194 HTML_IMAGE_ONLY_28 1909 0.43 0.43 0.43 195 T_Symld_Words_02 1889 0.51 0.85 0.43 196 XMMoneyMeta_00 1888 0.59 1.22 0.43 197 XMDateMe_00 1794 0.40 0.38 0.40 198 TM2_M_A_HREF_HREF 1789 0.58 1.28 0.40 199 XM_USANA_RCVD 1777 0.32 0.00 0.40 200 TM2_M_BODY_EMPTY 1618 0.32 0.12 0.36 ----------------------------------------------------------------------