Email: 291814 Autolearn: 0 AvgScore: 1.42 AvgScanTime: 1.55 sec Spam: 57901 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 1.61 sec Ham: 233913 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.54 sec Time Spent Running SA: 126.04 hours Time Spent Processing Spam: 25.88 hours Time Spent Processing Ham: 100.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 57861 99.96 99.93 99.97 2 HTML_MESSAGE 52609 86.33 90.86 85.20 3 DKIM_SIGNED 41361 75.45 71.43 76.44 4 XM_DK_Pass 39989 73.60 69.06 74.72 5 DKIM_VALID 38746 71.92 66.92 73.16 6 RELAYCOUNTRY_US 37986 76.26 65.61 78.89 7 XM_B_Unicode 37489 68.93 64.75 69.97 8 XM_B_SpammyWords 33928 50.54 58.60 48.54 9 XMListUnsubscribeExists 33847 55.07 58.46 54.23 10 XM_DK_Undo_02 27568 17.96 47.61 10.62 11 DKIM_VALID_AU 25950 56.05 44.82 58.83 12 BAYES_50 23421 50.32 40.45 52.76 13 MIME_HTML_ONLY 22956 26.49 39.65 23.23 14 TR_XM_DKIM_Undo 22911 13.71 39.57 7.31 15 BAYES_99 20598 13.69 35.57 8.27 16 XM_B_Unicode3 20083 42.32 34.69 44.21 17 XM_B_SpammyWords2 18310 22.55 31.62 20.31 18 RELAYCOUNTRY_META 18095 8.94 31.25 3.42 19 BAYES_999 15994 10.83 27.62 6.68 20 BOTNET 15945 6.94 27.54 1.84 21 LOC_TINY_FONT_1 15272 28.87 26.38 29.49 22 DKIM_VALID_EF 14778 26.98 25.52 27.34 23 FVGT_m_MULTI_ODD 14484 24.21 25.02 24.01 24 RCVD_IN_MSPIKE_H2 14009 20.42 24.19 19.48 25 HTML_FONT_LOW_CONTRAST 13962 31.28 24.11 33.06 26 UNTRUSTED_Relay 13836 5.82 23.90 1.35 27 XM_Multi_Part_URI 13563 15.59 23.42 13.65 28 T_KAM_HTML_FONT_INVALID 12295 19.56 21.23 19.15 29 XM_Body_Dirty_Words 11930 16.85 20.60 15.93 30 T_TM2_M_HEADER_IN_MSG 11500 21.46 19.86 21.86 31 XMSubLong 10663 20.63 18.42 21.18 32 HTML_MIME_NO_HTML_TAG 10063 4.84 17.38 1.74 33 RCVD_IN_MSPIKE_WL 9838 27.93 16.99 30.64 34 UNPARSEABLE_RELAY 8921 11.36 15.41 10.36 35 TR_XM_UnparsRelay 8577 9.70 14.81 8.43 36 HTML_SHORT_LINK_IMG_1 8264 2.84 14.27 0.02 37 BODY_URI_ONLY 8116 2.79 14.02 0.01 38 XM_UB50 7930 3.39 13.70 0.84 39 TR_XM_SpammyWords2 7431 3.81 12.83 1.58 40 XM_SPF_SoftFail 7415 3.72 12.81 1.47 41 RCVD_IN_BL_SPAMCOP_NET 7317 3.88 12.64 1.71 42 TR_XM_PHPDW 7298 2.74 12.60 0.30 43 LOTS_OF_MONEY 7250 9.42 12.52 8.66 44 TR_XM_PHPForged 7200 2.66 12.44 0.24 45 TR_XM_FormFill2 7175 2.65 12.39 0.24 46 XM_H_PHPOS 7169 2.64 12.38 0.23 47 TR_XM_SpammyRelay 7109 3.75 12.28 1.64 48 BOTNET_IPINHOSTNAME 6666 7.07 11.51 5.97 49 RCVD_IN_MSPIKE_H3 6542 14.19 11.30 14.90 50 XM_B_Unsub 6456 14.05 11.15 14.77 51 XM_UncommonTLD01 6444 5.38 11.13 3.95 52 XM_H_PHPMailer 6351 2.56 10.97 0.48 53 XM_H_PHPOS_M 6108 2.18 10.55 0.10 54 RELAYCOUNTRY_RU 5922 2.06 10.23 0.04 55 TVD_SPACE_RATIO 5667 2.99 9.79 1.31 56 TR_XM_SpammyWords4 5526 6.34 9.54 5.54 57 XM_B_SpammyWords3 5453 5.22 9.42 4.18 58 XM_H_Long_From01 5409 5.94 9.34 5.10 59 HTML_IMAGE_ONLY_04 5321 1.85 9.19 0.04 60 XMNumbers 5008 5.43 8.65 4.63 61 XMSexyCombo_05 4989 5.61 8.62 4.87 62 TR_XM_SPAMCOP 4477 1.96 7.73 0.54 63 MPART_ALT_DIFF 4348 5.78 7.51 5.35 64 RELAYCOUNTRY_CA 4226 2.38 7.30 1.16 65 HTML_IMAGE_RATIO_02 4215 8.12 7.28 8.32 66 XM_SendGrid 4051 7.86 7.00 8.08 67 BAYES_60 3979 9.57 6.87 10.24 68 BAYES_80 3464 5.41 5.98 5.27 69 XMSubMetaSx_00 3328 7.69 5.75 8.17 70 TR_XM_MSPIKECOMBO 3327 2.02 5.75 1.10 71 RCVD_IN_MSPIKE_BL 3327 2.02 5.75 1.10 72 TO_NO_BRKTS_HTML_ONLY 3162 1.19 5.46 0.14 73 TooManyTo_001 3154 8.65 5.45 9.44 74 RCVD_IN_MSPIKE_H4 3141 11.92 5.42 13.53 75 PHP_ORIG_SCRIPT 3053 1.05 5.27 0.00 76 XM_Evil_Numbers_Gen 2964 8.50 5.12 9.34 77 TR_XM_MaxUnsub 2962 2.09 5.12 1.34 78 TR_XM_PhishingBody 2861 3.16 4.94 2.72 79 HTML_IMAGE_ONLY_08 2837 1.03 4.90 0.08 80 T_FILL_THIS_FORM_SHORT 2797 1.41 4.83 0.57 81 TM2_M_URI_OPT_OUT 2730 6.50 4.71 6.94 82 DKIM_INVALID 2615 3.53 4.52 3.28 83 LotsOfNums_01 2599 7.78 4.49 8.59 84 DATE_IN_PAST_03_06 2563 1.28 4.43 0.50 85 HTML_TAG_BALANCE_CENTER 2431 0.97 4.20 0.17 86 HTML_SHORT_CENTER 2395 0.83 4.14 0.01 87 MIME_HTML_MOSTLY 2393 2.91 4.13 2.61 88 T_XMDrugObfuBody_14 2386 3.36 4.12 3.17 89 SpammyFromTLD_01 2385 1.18 4.12 0.46 90 XM_B_Investor 2384 1.94 4.12 1.40 91 SHORT_SHORTNER 2383 0.83 4.12 0.02 92 SHORTENER_SHORT_IMG 2368 0.81 4.09 0.00 93 TR_XM_DK_SendGrid 2354 5.09 4.07 5.35 94 XM_B_Phish_Phrases 2340 4.66 4.04 4.81 95 TR_XM_SpammyWords5 2271 2.00 3.92 1.52 96 ALL_TRUSTED 2254 15.55 3.89 18.44 97 MIME_HTML_ONLY_MULTI 2165 3.53 3.74 3.47 98 RCVD_IN_VALIDITY_SAFE 2150 6.50 3.71 7.20 99 HTML_IMAGE_RATIO_04 2120 5.72 3.66 6.23 100 URI_NOVOWEL 2092 2.66 3.61 2.43 101 TM2_M_VERY_LONG_WORD 2013 2.00 3.48 1.64 102 BAYES_00 1995 9.42 3.45 10.90 103 URI_BUFFLY 1992 0.68 3.44 0.00 104 XM_GoogleGroups 1960 1.83 3.39 1.44 105 BOTNET_NORDNS 1896 0.67 3.27 0.02 106 KHOP_HELO_FCRDNS 1896 1.34 3.27 0.86 107 BAYES_95 1861 3.17 3.21 3.16 108 TR_XM_FormFill 1796 0.64 3.10 0.04 109 TR_XM_SpammyWords3 1788 1.03 3.09 0.51 110 XMStrtUSub 1681 4.35 2.90 4.71 111 RCVD_IN_VALIDITY_CERTIFIED 1611 5.56 2.78 6.25 112 SUBJ_ALL_CAPS 1587 1.52 2.74 1.22 113 DKIM_ADSP_CUSTOM_MED 1564 1.50 2.70 1.20 114 XM_URI_RBL 1559 0.69 2.69 0.19 115 T_TooManySym_01 1545 5.54 2.67 6.26 116 XMBody_17 1527 0.99 2.64 0.58 117 HTML_IMAGE_RATIO_06 1525 3.21 2.63 3.35 118 XM_DIRTYINTL 1524 0.81 2.63 0.36 119 SpammyFromTLD_02 1505 0.83 2.60 0.39 120 XMSexyCombo_01 1468 3.63 2.54 3.90 121 XM_B_SpammyTLD 1456 2.24 2.51 2.18 122 XM_UB60 1454 0.55 2.51 0.06 123 MAILING_LIST_MULTI 1425 2.20 2.46 2.14 124 T_XMDrugObfuBody_08 1414 1.32 2.44 1.04 125 RCVD_IN_MSPIKE_L3 1398 0.95 2.41 0.59 126 XM_B_Phish66 1392 1.42 2.40 1.17 127 XM_OfRef6 1380 1.20 2.38 0.90 128 BODY_EMPTY 1343 0.46 2.32 0.00 129 RCVD_IN_VALIDITY_RPBL 1341 0.51 2.32 0.06 130 FROM_SUSPICIOUS_NTLD 1280 0.50 2.21 0.07 131 T_XMDrugObfuBody_00 1275 1.24 2.20 1.00 132 XMDiploma_00 1259 1.48 2.17 1.31 133 TR_Mismatch_TLD_01 1256 0.66 2.17 0.28 134 URIBL_DBL_SPAM 1241 0.44 2.14 0.01 135 FROM_SUSPICIOUS_NTLD_FP 1239 0.48 2.14 0.07 136 MIME_QP_LONG_LINE 1238 6.41 2.14 7.47 137 MONEY_NOHTML 1218 0.46 2.10 0.06 138 TR_Mismatch_TLD_02 1217 0.52 2.10 0.13 139 HTML_IMAGE_RATIO_08 1189 2.56 2.05 2.69 140 TR_XM_NoHeaderRelay 1186 0.54 2.05 0.17 141 RELAYCOUNTRY_FR 1175 0.55 2.03 0.19 142 RELAYCOUNTRY_IN 1171 0.45 2.02 0.06 143 XMLngstWrd_00 1155 0.93 1.99 0.66 144 XM_DK_Undo_01 1147 1.61 1.98 1.52 145 BAYES_40 1143 4.06 1.97 4.58 146 TR_XM_BayesRelay 1143 0.40 1.97 0.01 147 XMLngstWrd_01 1118 0.85 1.93 0.59 148 XMLngstWrd_02 1083 0.77 1.87 0.50 149 T_REMOTE_IMAGE 1074 3.04 1.85 3.34 150 XMLngstWrd_03 1060 0.68 1.83 0.40 151 XM_CamelCaseFrm001 1049 1.91 1.81 1.93 152 T_XMHurry_00 1029 0.91 1.78 0.70 153 RCVD_IN_MSPIKE_L5 1025 0.52 1.77 0.21 154 XMLngstWrd_04 1020 0.63 1.76 0.35 155 BAYES_20 1020 2.76 1.76 3.01 156 HTML_TITLE_SUBJ_DIFF 1003 0.48 1.73 0.17 157 TM2_M_BODY_EMPTY 1001 0.48 1.73 0.17 158 TR_XM_INV_DKIM 993 0.77 1.71 0.54 159 XMEmptyBody_01 988 0.36 1.71 0.03 160 XM_B_SpammyWords4 971 0.76 1.68 0.53 161 NML_ADSP_CUSTOM_MED 967 0.88 1.67 0.69 162 JH_SPAMMY_HEADERS 962 0.33 1.66 0.00 163 LongTLD 962 0.46 1.66 0.16 164 FORGED_GMAIL_RCVD 954 0.89 1.65 0.70 165 UPPERCASE_75_100 950 0.47 1.64 0.18 166 RCVD_DOTEDU_SHORT 936 0.34 1.62 0.02 167 HTML_IMAGE_ONLY_20 936 1.07 1.62 0.94 168 HTTPS_HTTP_MISMATCH 931 0.67 1.61 0.43 169 XM_Body_Dirty_Words_01 918 0.47 1.59 0.20 170 RCVD_IN_MSPIKE_L4 904 0.55 1.56 0.30 171 RELAYCOUNTRY_PL 896 0.35 1.55 0.05 172 URIBL_BLACK 878 0.33 1.52 0.03 173 XM_UB99 869 0.30 1.50 0.00 174 XMCapTrack 868 0.75 1.50 0.56 175 XMBrknScrpt_02 852 1.14 1.47 1.06 176 GOOG_STO_IMG_HTML 847 0.44 1.46 0.19 177 RCVD_IN_IADB_LISTED 839 3.66 1.45 4.21 178 XM_B_Unsub2 833 1.23 1.44 1.18 179 XMBdyGiftCard01 828 1.21 1.43 1.15 180 TM2_M_A_HREF_HREF 825 0.88 1.42 0.74 181 TR_Caps_n_Bayes_99 823 0.40 1.42 0.14 182 XMStockSpam_06 822 1.59 1.42 1.63 183 TR_XM_COVIDMETA4 819 0.50 1.41 0.28 184 XMSubNoVowel 779 0.91 1.35 0.80 185 TR_XM_SB_Phish 763 1.93 1.32 2.08 186 DIET_1 754 0.63 1.30 0.47 187 TR_Symld_Words 753 2.11 1.30 2.31 188 URI_NO_WWW_BIZ_CGI 742 0.26 1.28 0.01 189 XMSubPhish11 719 1.88 1.24 2.04 190 HTML_SHORT_LINK_IMG_3 718 0.43 1.24 0.23 191 XM_UB80 697 0.26 1.20 0.03 192 RELAYCOUNTRY_AU 685 0.48 1.18 0.31 193 XM_HighProb1 676 0.23 1.17 0.00 194 XMReplyNow 670 0.29 1.16 0.08 195 XMHTML_After_End 668 0.57 1.15 0.42 196 HTML_TAG_BALANCE_BODY 663 0.80 1.15 0.71 197 PDS_OTHER_BAD_TLD 661 0.53 1.14 0.38 198 URI_HEX 637 1.29 1.10 1.33 199 NO_DNS_FOR_FROM 615 0.56 1.06 0.43 200 RELAYCOUNTRY_DE 612 0.36 1.06 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 233850 99.96 99.93 99.97 2 HTML_MESSAGE 199304 86.33 90.86 85.20 3 RELAYCOUNTRY_US 184544 76.26 65.61 78.89 4 DKIM_SIGNED 178805 75.45 71.43 76.44 5 XM_DK_Pass 174779 73.60 69.06 74.72 6 DKIM_VALID 171128 71.92 66.92 73.16 7 XM_B_Unicode 163668 68.93 64.75 69.97 8 DKIM_VALID_AU 137620 56.05 44.82 58.83 9 XMListUnsubscribeExists 126856 55.07 58.46 54.23 10 BAYES_50 123406 50.32 40.45 52.76 11 XM_B_SpammyWords 113542 50.54 58.60 48.54 12 XM_B_Unicode3 103422 42.32 34.69 44.21 13 HTML_FONT_LOW_CONTRAST 77324 31.28 24.11 33.06 14 RCVD_IN_MSPIKE_WL 71661 27.93 16.99 30.64 15 LOC_TINY_FONT_1 68977 28.87 26.38 29.49 16 DKIM_VALID_EF 63950 26.98 25.52 27.34 17 FVGT_m_MULTI_ODD 56169 24.21 25.02 24.01 18 MIME_HTML_ONLY 54343 26.49 39.65 23.23 19 T_TM2_M_HEADER_IN_MSG 51124 21.46 19.86 21.86 20 XMSubLong 49549 20.63 18.42 21.18 21 XM_B_SpammyWords2 47499 22.55 31.62 20.31 22 RCVD_IN_MSPIKE_H2 45573 20.42 24.19 19.48 23 T_KAM_HTML_FONT_INVALID 44794 19.56 21.23 19.15 24 ALL_TRUSTED 43122 15.55 3.89 18.44 25 XM_Body_Dirty_Words 37252 16.85 20.60 15.93 26 USER_IN_DEF_DKIM_WL 35761 12.39 0.69 15.29 27 RCVD_IN_MSPIKE_H3 34863 14.19 11.30 14.90 28 XM_B_Unsub 34558 14.05 11.15 14.77 29 XM_Multi_Part_URI 31931 15.59 23.42 13.65 30 RCVD_IN_MSPIKE_H4 31638 11.92 5.42 13.53 31 BAYES_00 25505 9.42 3.45 10.90 32 XM_DK_Undo_02 24853 17.96 47.61 10.62 33 UNPARSEABLE_RELAY 24241 11.36 15.41 10.36 34 BAYES_60 23953 9.57 6.87 10.24 35 TooManyTo_001 22080 8.65 5.45 9.44 36 XM_Evil_Numbers_Gen 21852 8.50 5.12 9.34 37 XM_DKIMWhitelistDomains 21682 7.43 0.01 9.27 38 LOTS_OF_MONEY 20252 9.42 12.52 8.66 39 LotsOfNums_01 20100 7.78 4.49 8.59 40 TR_XM_UnparsRelay 19719 9.70 14.81 8.43 41 HTML_IMAGE_RATIO_02 19466 8.12 7.28 8.32 42 BAYES_99 19351 13.69 35.57 8.27 43 XMSubMetaSx_00 19121 7.69 5.75 8.17 44 XM_SendGrid 18900 7.86 7.00 8.08 45 MIME_QP_LONG_LINE 17471 6.41 2.14 7.47 46 TR_XM_DKIM_Undo 17093 13.71 39.57 7.31 47 RCVD_IN_VALIDITY_SAFE 16832 6.50 3.71 7.20 48 TR_XM_DK_Bayes 16726 5.86 0.63 7.15 49 TR_XM_DK_Bayes1 16427 5.75 0.62 7.02 50 TM2_M_URI_OPT_OUT 16233 6.50 4.71 6.94 51 BAYES_999 15616 10.83 27.62 6.68 52 T_TooManySym_01 14633 5.54 2.67 6.26 53 RCVD_IN_VALIDITY_CERTIFIED 14608 5.56 2.78 6.25 54 HTML_IMAGE_RATIO_04 14567 5.72 3.66 6.23 55 TR_XM_DK_Bayes2 14563 5.06 0.35 6.23 56 BOTNET_IPINHOSTNAME 13959 7.07 11.51 5.97 57 TR_XM_SpammyWords4 12968 6.34 9.54 5.54 58 TR_XM_DK_SendGrid 12512 5.09 4.07 5.35 59 MPART_ALT_DIFF 12509 5.78 7.51 5.35 60 BAYES_80 12332 5.41 5.98 5.27 61 XM_H_Long_From01 11918 5.94 9.34 5.10 62 IN_ZIMBRA_NJ_WHITELIST 11450 3.93 0.02 4.89 63 XMSexyCombo_05 11391 5.61 8.62 4.87 64 XM_B_Phish_Phrases 11255 4.66 4.04 4.81 65 XMStrtUSub 11008 4.35 2.90 4.71 66 XMNumbers 10835 5.43 8.65 4.63 67 BAYES_40 10707 4.06 1.97 4.58 68 RCVD_IN_IADB_LISTED 9847 3.66 1.45 4.21 69 XM_B_SpammyWords3 9783 5.22 9.42 4.18 70 T_TooManySym_02 9693 3.42 0.50 4.14 71 XM_UncommonTLD01 9242 5.38 11.13 3.95 72 XMSexyCombo_01 9129 3.63 2.54 3.90 73 BOUNCE_MESSAGE 8742 3.20 1.02 3.74 74 ANY_BOUNCE_MESSAGE 8742 3.20 1.02 3.74 75 FROM_EXCESS_BASE64 8734 3.20 1.05 3.73 76 RCVD_IN_IADB_SPF 8573 3.15 1.05 3.67 77 MIME_HTML_ONLY_MULTI 8123 3.53 3.74 3.47 78 RELAYCOUNTRY_META 7997 8.94 31.25 3.42 79 SHORT_URI_3 7921 2.88 0.81 3.39 80 HTML_IMAGE_RATIO_06 7834 3.21 2.63 3.35 81 T_REMOTE_IMAGE 7811 3.04 1.85 3.34 82 DKIM_INVALID 7677 3.53 4.52 3.28 83 RCVD_IN_IADB_SENDERID 7632 2.80 0.92 3.26 84 INVALID_MSGID 7601 2.65 0.22 3.25 85 T_XMDrugObfuBody_14 7419 3.36 4.12 3.17 86 RCVD_IN_IADB_DK 7416 2.73 0.95 3.17 87 BAYES_95 7380 3.17 3.21 3.16 88 MSGID_NOFQDN1 7149 2.46 0.04 3.06 89 BAYES_20 7046 2.76 1.76 3.01 90 TR_XM_PhishingBody 6371 3.16 4.94 2.72 91 TO_MALFORMED 6297 2.17 0.04 2.69 92 HTML_IMAGE_RATIO_08 6290 2.56 2.05 2.69 93 RCVD_IN_IADB_VOUCHED 6154 2.31 1.02 2.63 94 MIME_HTML_MOSTLY 6097 2.91 4.13 2.61 95 URI_NOVOWEL 5677 2.66 3.61 2.43 96 TR_Symld_Words 5409 2.11 1.30 2.31 97 XM_H_Trusted_IP 5271 1.81 0.00 2.25 98 XM_PDF 5236 1.87 0.38 2.24 99 RCVD_IN_MSPIKE_H5 5160 1.82 0.27 2.21 100 XM_B_SpammyTLD 5090 2.24 2.51 2.18 101 TVD_RCVD_IP 5015 1.77 0.25 2.14 102 MAILING_LIST_MULTI 5006 2.20 2.46 2.14 103 XMSubMetaSx_01 4938 1.81 0.57 2.11 104 TR_XM_SB_Phish 4862 1.93 1.32 2.08 105 XMSubPhish11 4767 1.88 1.24 2.04 106 IN_HORDE_ADDRESS_BOOK 4724 1.63 0.04 2.02 107 XM_CamelCaseFrm001 4514 1.91 1.81 1.93 108 XMSexyCombo_02 4384 1.66 0.79 1.87 109 BOTNET 4308 6.94 27.54 1.84 110 BAYES_05 4226 1.58 0.66 1.81 111 HTML_MIME_NO_HTML_TAG 4067 4.84 17.38 1.74 112 RCVD_IN_BL_SPAMCOP_NET 4006 3.88 12.64 1.71 113 RCVD_IN_IADB_OPTIN 3945 1.46 0.54 1.69 114 TR_XM_SpammyRelay 3845 3.75 12.28 1.64 115 TM2_M_VERY_LONG_WORD 3835 2.00 3.48 1.64 116 XMStockSpam_06 3810 1.59 1.42 1.63 117 XMGappySubj_01 3804 1.34 0.21 1.63 118 TR_XM_SpammyWords2 3686 3.81 12.83 1.58 119 XMBSHREFv2 3657 1.28 0.12 1.56 120 XM_DK_Undo_01 3556 1.61 1.98 1.52 121 TR_XM_SpammyWords5 3551 2.00 3.92 1.52 122 XM_ProductURIs 3544 1.39 0.90 1.52 123 RCVD_IN_RP_SAFE 3476 1.34 0.77 1.49 124 XM_SPF_SoftFail 3439 3.72 12.81 1.47 125 XM_GoogleGroups 3369 1.83 3.39 1.44 126 XM_B_Investor 3286 1.94 4.12 1.40 127 UNTRUSTED_Relay 3158 5.82 23.90 1.35 128 TR_XM_MaxUnsub 3133 2.09 5.12 1.34 129 URI_HEX 3114 1.29 1.10 1.33 130 XMDiploma_00 3058 1.48 2.17 1.31 131 TVD_SPACE_RATIO 3057 2.99 9.79 1.31 132 RCVD_IN_RP_CERTIFIED 3039 1.15 0.56 1.30 133 SUBJ_ALL_CAPS 2843 1.52 2.74 1.22 134 DKIM_ADSP_CUSTOM_MED 2806 1.50 2.70 1.20 135 XM_B_Unsub2 2751 1.23 1.44 1.18 136 XM_B_Phish66 2741 1.42 2.40 1.17 137 RELAYCOUNTRY_CA 2712 2.38 7.30 1.16 138 XMBdyGiftCard01 2701 1.21 1.43 1.15 139 XMSubMetaSxObfu_03 2608 0.97 0.38 1.11 140 RCVD_IN_MSPIKE_BL 2569 2.02 5.75 1.10 141 TR_XM_MSPIKECOMBO 2565 2.02 5.75 1.10 142 TooManyTo_002 2564 1.03 0.78 1.10 143 XMBrknScrpt_02 2470 1.14 1.47 1.06 144 XM_H_Long_From02 2455 0.98 0.69 1.05 145 XMSubMetaI_00 2442 0.96 0.60 1.04 146 T_XMDrugObfuBody_08 2431 1.32 2.44 1.04 147 T_TooManySym_03 2357 0.84 0.15 1.01 148 T_XMDrugObfuBody_00 2347 1.24 2.20 1.00 149 TR_MetaPhish_Combo_01 2322 0.90 0.54 0.99 150 HTML_FONT_FACE_BAD 2292 0.86 0.39 0.98 151 XMSexyCombo_04 2288 0.90 0.60 0.98 152 HTML_IMAGE_ONLY_20 2188 1.07 1.62 0.94 153 XM_OfRef6 2109 1.20 2.38 0.90 154 KHOP_HELO_FCRDNS 2014 1.34 3.27 0.86 155 XM_UB50 1968 3.39 13.70 0.84 156 XMPhish30 1938 0.83 0.83 0.83 157 XM_B_COPY_HTML 1929 0.78 0.61 0.82 158 XMSubNoVowel 1871 0.91 1.35 0.80 159 XMBody_95 1859 0.65 0.08 0.79 160 TooManyTo_003 1832 0.76 0.68 0.78 161 T_MANY_PILL_PRICE 1805 0.62 0.01 0.77 162 TM2_M_A_HREF_HREF 1740 0.88 1.42 0.74 163 HTML_TAG_BALANCE_BODY 1666 0.80 1.15 0.71 164 FORGED_GMAIL_RCVD 1649 0.89 1.65 0.70 165 T_XMHurry_00 1631 0.91 1.78 0.70 166 NML_ADSP_CUSTOM_MED 1614 0.88 1.67 0.69 167 XM_B_COVIDMETA 1558 0.70 0.83 0.67 168 XMLngstWrd_00 1550 0.93 1.99 0.66 169 RDNS_DYNAMIC 1500 0.70 0.92 0.64 170 XM_D_tchamptons_WL 1486 0.51 0.00 0.64 171 SHORTENED_URL_HREF 1472 0.68 0.89 0.63 172 XMGenDplmaNmb 1468 0.70 0.98 0.63 173 XMBody_78 1467 0.58 0.41 0.63 174 URI_TRY_3LD 1463 0.65 0.76 0.63 175 TR_MSPIKEBAYES00 1461 0.50 0.00 0.62 176 XMHTMLBadTable_001 1418 0.68 0.98 0.61 177 XMSubMetaSxObfu_02 1408 0.53 0.26 0.60 178 USER_IN_WHITELIST 1393 0.48 0.00 0.60 179 USER_IN_WELCOMELIST 1393 0.48 0.00 0.60 180 TooManyTo_004 1378 0.60 0.65 0.59 181 RCVD_IN_MSPIKE_L3 1377 0.95 2.41 0.59 182 XMLngstWrd_01 1372 0.85 1.93 0.59 183 XMBody_17 1366 0.99 2.64 0.58 184 T_FILL_THIS_FORM_SHORT 1322 1.41 4.83 0.57 185 XMCapTrack 1315 0.75 1.50 0.56 186 XM_B_REG_HTML 1279 0.57 0.66 0.55 187 TR_XM_SPAMCOP 1256 1.96 7.73 0.54 188 TR_XM_INV_DKIM 1255 0.77 1.71 0.54 189 TR_LOTS_OF_MONEY2 1246 0.55 0.60 0.53 190 T_MONEY_PERCENT 1246 0.55 0.60 0.53 191 XM_B_SpammyWords4 1235 0.76 1.68 0.53 192 MPART_ALT_DIFF_COUNT 1208 0.55 0.70 0.52 193 TR_XM_SpammyWords3 1204 1.03 3.09 0.51 194 XMPhish14 1200 0.51 0.50 0.51 195 DKIM_ADSP_NXDOMAIN 1196 0.55 0.73 0.51 196 TooManyTo_005 1176 0.52 0.59 0.50 197 DATE_IN_PAST_03_06 1172 1.28 4.43 0.50 198 XMLngstWrd_02 1164 0.77 1.87 0.50 199 XMNoVowels 1121 0.45 0.31 0.48 200 XM_H_PHPMailer 1118 2.56 10.97 0.48 ----------------------------------------------------------------------