Email: 541788 Autolearn: 0 AvgScore: 1.44 AvgScanTime: 1.50 sec Spam: 139860 Autolearn: 0 AvgScore: 14.49 AvgScanTime: 1.78 sec Ham: 401928 Autolearn: 0 AvgScore: -3.11 AvgScanTime: 1.40 sec Time Spent Running SA: 225.24 hours Time Spent Processing Spam: 69.02 hours Time Spent Processing Ham: 156.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134857 90.59 96.42 88.56 2 DKIM_SIGNED 116567 66.51 83.35 60.65 3 XM_DK_Pass 113012 65.13 80.80 59.68 4 DKIM_VALID 108180 62.61 77.35 57.49 5 RELAYCOUNTRY_US 107320 80.05 76.73 81.20 6 XM_B_Unicode 105704 72.79 75.58 71.82 7 DCC_CHECK 104066 41.72 74.41 30.34 8 XMListUnsubscribeExists 94087 47.53 67.27 40.66 9 XM_B_SpammyWords 90863 51.11 64.97 46.29 10 DKIM_VALID_AU 79067 46.33 56.53 42.78 11 XM_B_Unicode3 59274 46.12 42.38 47.42 12 XM_DK_Undo_02 58402 15.43 41.76 6.27 13 BAYES_50 56429 48.96 40.35 51.96 14 XM_B_SpammyWords2 50621 20.49 36.19 15.02 15 MIME_HTML_ONLY 49141 22.56 35.14 18.18 16 LOC_TINY_FONT_1 46999 23.65 33.60 20.19 17 TR_XM_DKIM_Undo 44877 11.44 32.09 4.26 18 BAYES_99 44548 11.89 31.85 4.94 19 HTML_FONT_LOW_CONTRAST 43568 27.10 31.15 25.69 20 FVGT_m_MULTI_ODD 41719 22.24 29.83 19.61 21 DKIM_VALID_EF 41420 23.41 29.62 21.25 22 T_KAM_HTML_FONT_INVALID 37117 18.89 26.54 16.22 23 DCC_CHECK_NEGATIVE 35748 58.25 25.56 69.63 24 BAYES_999 35088 9.50 25.09 4.08 25 RCVD_IN_MSPIKE_H2 34889 18.70 24.95 16.53 26 RELAYCOUNTRY_META 33586 8.30 24.01 2.84 27 XMSubLong 33508 19.72 23.96 18.24 28 TR_DCC_Bayes_99 32906 7.40 23.53 1.79 29 XM_Body_Dirty_Words 31149 15.02 22.27 12.49 30 T_TM2_M_HEADER_IN_MSG 28365 31.25 20.28 35.07 31 RCVD_IN_MSPIKE_WL 27255 22.84 19.49 24.01 32 XM_Multi_Part_URI 23901 11.83 17.09 10.00 33 BOTNET_IPINHOSTNAME 21812 7.02 15.60 4.04 34 FSL_BULK_SIG 21304 6.68 15.23 3.70 35 BOTNET 20797 4.86 14.87 1.37 36 XM_B_Unsub 20666 13.17 14.78 12.61 37 UNTRUSTED_Relay 20021 4.46 14.32 1.03 38 XM_UncommonTLD01 19565 5.74 13.99 2.87 39 LOTS_OF_MONEY 19146 14.85 13.69 15.25 40 UNPARSEABLE_RELAY 18931 8.50 13.54 6.75 41 TR_XM_UnparsRelay 18508 7.48 13.23 5.48 42 RCVD_IN_MSPIKE_H3 16886 12.61 12.07 12.80 43 TR_XM_SpammyWords4 16490 8.31 11.79 7.10 44 MPART_ALT_DIFF 16369 6.98 11.70 5.34 45 TR_XM_SpammyRelay 16325 3.83 11.67 1.11 46 TR_XM_SpammyWords2 15315 3.41 10.95 0.79 47 XM_B_SpammyWords3 14737 5.20 10.54 3.35 48 RCVD_IN_BL_SPAMCOP_NET 13061 2.99 9.34 0.78 49 XM_Evil_Numbers_Gen 12602 7.53 9.01 7.01 50 XM_SendGrid 12469 6.03 8.92 5.03 51 XMSexyCombo_05 12405 4.36 8.87 2.79 52 HTML_MIME_NO_HTML_TAG 12135 3.76 8.68 2.04 53 BAYES_60 11964 8.17 8.55 8.04 54 TooManyTo_001 11920 9.67 8.52 10.07 55 XMSubMetaSx_00 11651 6.56 8.33 5.94 56 HTML_IMAGE_RATIO_02 11520 5.66 8.24 4.76 57 BAYES_80 10550 4.66 7.54 3.66 58 LotsOfNums_01 9957 8.17 7.12 8.53 59 SpammyFromTLD_02 9796 2.16 7.00 0.47 60 RCVD_IN_MSPIKE_H4 9784 8.79 7.00 9.42 61 TR_XM_MaxUnsub 9343 2.43 6.68 0.95 62 XM_SPF_SoftFail 8844 12.20 6.32 14.24 63 RCVD_IN_MSPIKE_BL 8739 2.45 6.25 1.13 64 TR_XM_MSPIKECOMBO 8663 2.43 6.19 1.13 65 XM_B_Phish_Phrases 8647 4.08 6.18 3.35 66 TR_XM_PhishingBody 8506 3.72 6.08 2.90 67 MIME_HTML_ONLY_MULTI 8397 4.37 6.00 3.80 68 DKIM_INVALID 8387 3.90 6.00 3.17 69 XM_UB50 8229 1.99 5.88 0.63 70 TR_XM_DK_SendGrid 7435 3.67 5.32 3.10 71 MIME_HTML_MOSTLY 7419 2.78 5.30 1.91 72 KHOP_HELO_FCRDNS 7357 7.26 5.26 7.95 73 TM2_M_VERY_LONG_WORD 7213 2.47 5.16 1.54 74 XMNumbers 7121 3.64 5.09 3.13 75 XM_B_SpammyTLD 6964 2.70 4.98 1.91 76 RELAYCOUNTRY_CA 6862 1.74 4.91 0.64 77 MIME_QP_LONG_LINE 6618 7.54 4.73 8.51 78 TR_XM_SPAMCOP 6597 1.40 4.72 0.24 79 HTML_IMAGE_RATIO_04 6428 5.61 4.60 5.97 80 SpammyFromTLD_01 6313 1.58 4.51 0.56 81 XM_H_Long_From01 6262 4.39 4.48 4.36 82 URI_NOVOWEL 6004 3.23 4.29 2.86 83 TM2_M_URI_OPT_OUT 5849 5.88 4.18 6.47 84 HTML_SHORT_LINK_IMG_1 5730 1.07 4.10 0.01 85 BAYES_95 5576 2.71 3.99 2.26 86 URIBL_DBL_SPAM 5548 1.03 3.97 0.00 87 BODY_URI_ONLY 5503 1.02 3.93 0.01 88 HTML_IMAGE_RATIO_06 5375 3.47 3.84 3.34 89 HTML_IMAGE_ONLY_08 5333 1.05 3.81 0.08 90 T_XMDrugObfuBody_14 5329 2.38 3.81 1.88 91 T_REMOTE_IMAGE 5234 3.09 3.74 2.86 92 GOOG_STO_IMG_HTML 5075 0.94 3.63 0.00 93 TR_XM_SpammyWords5 4978 1.80 3.56 1.19 94 RCVD_IN_IADB_LISTED 4899 5.08 3.50 5.62 95 RELAYCOUNTRY_AU 4871 1.08 3.48 0.25 96 XM_B_Investor 4833 2.16 3.46 1.71 97 RCVD_IN_VALIDITY_SAFE 4750 3.90 3.40 4.08 98 FROM_SUSPICIOUS_NTLD 4502 0.86 3.22 0.04 99 XMStrtUSub 4461 3.53 3.19 3.65 100 FROM_SUSPICIOUS_NTLD_FP 4418 0.85 3.16 0.04 101 XMDiploma_00 4374 1.60 3.13 1.06 102 TR_XM_SpammyWords3 4288 1.19 3.07 0.54 103 BAYES_40 4215 4.40 3.01 4.88 104 XM_B_Phish66 4200 1.90 3.00 1.51 105 PDS_OTHER_BAD_TLD 4182 0.88 2.99 0.14 106 RCVD_IN_IADB_SPF 4113 4.46 2.94 4.98 107 XMLngstWrd_00 4068 1.30 2.91 0.74 108 XMLngstWrd_01 4013 1.23 2.87 0.66 109 TR_Symld_Words 4007 1.82 2.87 1.46 110 XM_DIRTYINTL 3981 0.93 2.85 0.26 111 XM_GoogleGroups 3969 1.55 2.84 1.10 112 XM_B_COVIDMETA 3945 1.24 2.82 0.69 113 XMLngstWrd_02 3932 1.16 2.81 0.59 114 RCVD_IN_MSPIKE_L3 3921 1.27 2.80 0.74 115 XM_BadFromFormat 3897 0.80 2.79 0.11 116 T_XMDrugObfuBody_08 3805 1.81 2.72 1.50 117 XMLngstWrd_03 3791 1.07 2.71 0.50 118 XMSexyCombo_01 3745 2.55 2.68 2.51 119 RCVD_IN_IADB_DK 3672 3.89 2.63 4.33 120 XMLngstWrd_04 3661 0.97 2.62 0.39 121 RCVD_IN_IADB_SENDERID 3652 4.00 2.61 4.48 122 RCVD_IN_MSPIKE_L5 3564 0.68 2.55 0.03 123 RELAYCOUNTRY_FR 3485 0.77 2.49 0.17 124 RCVD_IN_VALIDITY_CERTIFIED 3477 3.29 2.49 3.57 125 HDRS_MISSP 3470 0.67 2.48 0.03 126 TVD_SPACE_RATIO 3464 1.35 2.48 0.96 127 SUBJ_ALL_CAPS 3308 5.04 2.37 5.96 128 XMBody_17 3283 0.96 2.35 0.48 129 HTML_TITLE_SUBJ_DIFF 3272 0.76 2.34 0.21 130 XM_OfRef6 3252 1.17 2.33 0.77 131 XM_CamelCaseFrm001 3211 1.76 2.30 1.57 132 HTML_TAG_BALANCE_CENTER 3205 0.66 2.29 0.09 133 USER_IN_DEF_DKIM_WL 3191 7.94 2.28 9.92 134 UPPERCASE_75_100 3187 0.73 2.28 0.20 135 BAYES_20 3179 3.76 2.27 4.27 136 RDNS_DYNAMIC 3103 0.83 2.22 0.35 137 BOTNET_NORDNS 3091 0.58 2.21 0.01 138 XM_DK_Undo_01 3083 1.54 2.20 1.31 139 T_FILL_THIS_FORM_SHORT 3066 1.08 2.19 0.69 140 RCVD_IN_IADB_VOUCHED 3030 3.19 2.17 3.55 141 HTML_IMAGE_ONLY_04 3001 0.58 2.15 0.03 142 HTML_SHORT_CENTER 2984 0.55 2.13 0.00 143 JH_SPAMMY_HEADERS 2947 0.54 2.11 0.00 144 T_XMDrugObfuBody_00 2941 0.97 2.10 0.57 145 XM_UB60 2925 0.58 2.09 0.06 146 URI_HEX 2909 1.42 2.08 1.19 147 T_TooManySym_01 2882 4.48 2.06 5.32 148 XMStockSpam_06 2834 1.37 2.03 1.14 149 XM_UB99 2808 0.52 2.01 0.00 150 FROM_EXCESS_BASE64 2793 2.16 2.00 2.22 151 XM_B_Unsub2 2654 1.79 1.90 1.76 152 XMGappySubj_01 2635 1.40 1.88 1.23 153 TR_XM_NoHeaderRelay 2630 0.60 1.88 0.15 154 TR_XM_INV_DKIM 2615 0.56 1.87 0.10 155 ALL_TRUSTED 2601 12.99 1.86 16.86 156 TR_XM_SB_Phish 2597 2.04 1.86 2.10 157 RELAYCOUNTRY_CZ 2568 0.49 1.84 0.02 158 TVD_RCVD_IP 2562 1.72 1.83 1.67 159 TR_XM_PHPDW 2553 0.67 1.83 0.27 160 XMGappySubj_02 2521 0.55 1.80 0.11 161 XMSubPhish11 2498 2.00 1.79 2.07 162 TR_XM_PHPForged 2453 0.62 1.75 0.23 163 MIXED_CENTER_CASE 2426 0.45 1.73 0.00 164 MIXED_HREF_CASE 2425 0.45 1.73 0.00 165 TR_XM_FormFill2 2424 0.62 1.73 0.24 166 MIXED_IMG_CASE 2412 0.45 1.72 0.00 167 MIXED_FONT_CASE 2407 0.44 1.72 0.00 168 MIXED_AREA_CASE 2407 0.44 1.72 0.00 169 XM_H_PHPOS 2406 0.61 1.72 0.22 170 XM_H_TOP 2402 0.45 1.72 0.01 171 HTML_IMAGE_RATIO_08 2384 9.73 1.70 12.52 172 MAILING_LIST_MULTI 2378 2.00 1.70 2.11 173 RCVD_IN_VALIDITY_RPBL 2363 0.46 1.69 0.03 174 RCVD_IN_PSBL 2346 0.62 1.68 0.25 175 XM_UB999 2279 0.42 1.63 0.00 176 TM2_M_A_HREF_HREF 2182 0.68 1.56 0.37 177 HTML_FONT_SIZE_LARGE 2174 0.46 1.55 0.08 178 TR_LOTS_OF_MONEY3 2174 0.99 1.55 0.79 179 URI_TRY_3LD 2164 0.88 1.55 0.65 180 XM_B_SpammyWords4 2070 0.60 1.48 0.29 181 DATE_IN_PAST_06_12 2037 0.40 1.46 0.04 182 HTML_TAG_BALANCE_BODY 1969 0.74 1.41 0.50 183 BAYES_00 1942 13.15 1.39 17.24 184 TR_XM_COVIDMETA4 1934 0.54 1.38 0.25 185 RCVD_IN_IADB_OPTIN 1900 2.07 1.36 2.32 186 XM_URI_RBL 1890 0.43 1.35 0.11 187 URIBL_BLACK 1884 0.38 1.35 0.05 188 T_XMHurry_00 1858 0.62 1.33 0.37 189 XM_Body_Dirty_Words_01 1831 0.45 1.31 0.16 190 XMSubMetaSxObfu_03 1830 0.83 1.31 0.67 191 XMPhish30 1776 0.86 1.27 0.72 192 DKIM_ADSP_CUSTOM_MED 1763 0.98 1.26 0.88 193 RELAYCOUNTRY_RU 1759 0.34 1.26 0.02 194 XM_UB80 1692 0.32 1.21 0.01 195 XMGenDplmaNmb 1640 0.71 1.17 0.55 196 FORGED_GMAIL_RCVD 1591 0.67 1.14 0.51 197 XMBrknScrpt_02 1587 0.96 1.13 0.90 198 TR_Caps_n_Bayes_99 1579 0.42 1.13 0.17 199 XMBdyGiftCard01 1567 0.82 1.12 0.72 200 HTML_FONT_SIZE_HUGE 1563 0.32 1.12 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 355962 90.59 96.42 88.56 2 RELAYCOUNTRY_US 326357 80.05 76.73 81.20 3 XM_B_Unicode 288671 72.79 75.58 71.82 4 DCC_CHECK_NEGATIVE 279851 58.25 25.56 69.63 5 DKIM_SIGNED 243788 66.51 83.35 60.65 6 XM_DK_Pass 239855 65.13 80.80 59.68 7 DKIM_VALID 231049 62.61 77.35 57.49 8 BAYES_50 208830 48.96 40.35 51.96 9 XM_B_Unicode3 190613 46.12 42.38 47.42 10 XM_B_SpammyWords 186042 51.11 64.97 46.29 11 DKIM_VALID_AU 171953 46.33 56.53 42.78 12 XMListUnsubscribeExists 163407 47.53 67.27 40.66 13 T_TM2_M_HEADER_IN_MSG 140953 31.25 20.28 35.07 14 DCC_CHECK 121960 41.72 74.41 30.34 15 HTML_FONT_LOW_CONTRAST 103270 27.10 31.15 25.69 16 RCVD_IN_MSPIKE_WL 96490 22.84 19.49 24.01 17 DKIM_VALID_EF 85397 23.41 29.62 21.25 18 LOC_TINY_FONT_1 81154 23.65 33.60 20.19 19 FVGT_m_MULTI_ODD 78798 22.24 29.83 19.61 20 IN_ZIMBRA_NJ_WHITELIST 73710 13.62 0.07 18.34 21 XMSubLong 73331 19.72 23.96 18.24 22 MIME_HTML_ONLY 73082 22.56 35.14 18.18 23 BAYES_00 69281 13.15 1.39 17.24 24 ALL_TRUSTED 67761 12.99 1.86 16.86 25 RCVD_IN_MSPIKE_H2 66442 18.70 24.95 16.53 26 T_KAM_HTML_FONT_INVALID 65205 18.89 26.54 16.22 27 LOTS_OF_MONEY 61284 14.85 13.69 15.25 28 XM_B_SpammyWords2 60387 20.49 36.19 15.02 29 XM_SPF_SoftFail 57252 12.20 6.32 14.24 30 HTML_FONT_FACE_BAD 56737 10.66 0.74 14.12 31 RCVD_IN_MSPIKE_H3 51429 12.61 12.07 12.80 32 XM_B_Unsub 50679 13.17 14.78 12.61 33 HTML_IMAGE_RATIO_08 50313 9.73 1.70 12.52 34 XM_Body_Dirty_Words 50213 15.02 22.27 12.49 35 TooManyTo_001 40488 9.67 8.52 10.07 36 XM_Multi_Part_URI 40179 11.83 17.09 10.00 37 USER_IN_DEF_DKIM_WL 39852 7.94 2.28 9.92 38 RCVD_IN_MSPIKE_H4 37866 8.79 7.00 9.42 39 LotsOfNums_01 34303 8.17 7.12 8.53 40 MIME_QP_LONG_LINE 34220 7.54 4.73 8.51 41 BAYES_60 32297 8.17 8.55 8.04 42 KHOP_HELO_FCRDNS 31966 7.26 5.26 7.95 43 TR_XM_SpammyWords4 28530 8.31 11.79 7.10 44 XM_Evil_Numbers_Gen 28168 7.53 9.01 7.01 45 UNPARSEABLE_RELAY 27143 8.50 13.54 6.75 46 XM_DKIMWhitelistDomains 27074 5.00 0.02 6.74 47 TM2_M_URI_OPT_OUT 25997 5.88 4.18 6.47 48 XM_DK_Undo_02 25208 15.43 41.76 6.27 49 HTML_IMAGE_RATIO_04 23987 5.61 4.60 5.97 50 SUBJ_ALL_CAPS 23972 5.04 2.37 5.96 51 XMSubMetaSx_00 23881 6.56 8.33 5.94 52 TR_XM_DK_Bayes 23832 4.56 0.63 5.93 53 FILL_THIS_FORM 23512 4.40 0.23 5.85 54 TR_XM_DK_Bayes1 23050 4.41 0.59 5.73 55 RCVD_IN_IADB_LISTED 22602 5.08 3.50 5.62 56 TR_XM_UnparsRelay 22021 7.48 13.23 5.48 57 MPART_ALT_DIFF 21443 6.98 11.70 5.34 58 T_TooManySym_01 21382 4.48 2.06 5.32 59 XM_SendGrid 20217 6.03 8.92 5.03 60 RCVD_IN_IADB_SPF 20030 4.46 2.94 4.98 61 TR_XM_DK_Bayes2 20009 3.79 0.38 4.98 62 BAYES_99 19866 11.89 31.85 4.94 63 BAYES_40 19631 4.40 3.01 4.88 64 HTML_IMAGE_RATIO_02 19145 5.66 8.24 4.76 65 XM_H_Trusted_IP 19098 3.52 0.00 4.75 66 RCVD_IN_IADB_SENDERID 18006 4.00 2.61 4.48 67 XM_H_Long_From01 17534 4.39 4.48 4.36 68 RCVD_IN_IADB_DK 17417 3.89 2.63 4.33 69 BAYES_20 17170 3.76 2.27 4.27 70 TR_XM_DKIM_Undo 17107 11.44 32.09 4.26 71 XM_PDF 16899 3.36 0.92 4.20 72 BAYES_999 16405 9.50 25.09 4.08 73 RCVD_IN_VALIDITY_SAFE 16391 3.90 3.40 4.08 74 BOTNET_IPINHOSTNAME 16240 7.02 15.60 4.04 75 MIME_HTML_ONLY_MULTI 15274 4.37 6.00 3.80 76 FSL_BULK_SIG 14866 6.68 15.23 3.70 77 BAYES_80 14721 4.66 7.54 3.66 78 XMStrtUSub 14660 3.53 3.19 3.65 79 RCVD_IN_VALIDITY_CERTIFIED 14358 3.29 2.49 3.57 80 RCVD_IN_IADB_VOUCHED 14278 3.19 2.17 3.55 81 XM_B_SpammyWords3 13456 5.20 10.54 3.35 82 XM_B_Phish_Phrases 13448 4.08 6.18 3.35 83 HTML_IMAGE_RATIO_06 13440 3.47 3.84 3.34 84 T_TooManySym_02 13130 2.57 0.59 3.27 85 DKIM_INVALID 12739 3.90 6.00 3.17 86 XMNumbers 12599 3.64 5.09 3.13 87 SHORT_URI_3 12509 2.48 0.67 3.11 88 ANY_BOUNCE_MESSAGE 12493 2.47 0.64 3.11 89 BOUNCE_MESSAGE 12491 2.47 0.64 3.11 90 TR_XM_DK_SendGrid 12447 3.67 5.32 3.10 91 TR_XM_PhishingBody 11647 3.72 6.08 2.90 92 XM_UncommonTLD01 11540 5.74 13.99 2.87 93 T_REMOTE_IMAGE 11498 3.09 3.74 2.86 94 URI_NOVOWEL 11493 3.23 4.29 2.86 95 RELAYCOUNTRY_META 11404 8.30 24.01 2.84 96 XMSexyCombo_05 11219 4.36 8.87 2.79 97 BAYES_05 11039 2.31 1.04 2.75 98 XMSexyCombo_01 10093 2.55 2.68 2.51 99 RCVD_IN_IADB_OPTIN 9334 2.07 1.36 2.32 100 BAYES_95 9082 2.71 3.99 2.26 101 FROM_EXCESS_BASE64 8905 2.16 2.00 2.22 102 MAILING_LIST_MULTI 8472 2.00 1.70 2.11 103 TR_XM_SB_Phish 8458 2.04 1.86 2.10 104 XMSubPhish11 8333 2.00 1.79 2.07 105 HTML_MIME_NO_HTML_TAG 8217 3.76 8.68 2.04 106 XM_B_SpammyTLD 7665 2.70 4.98 1.91 107 MIME_HTML_MOSTLY 7659 2.78 5.30 1.91 108 T_XMDrugObfuBody_14 7560 2.38 3.81 1.88 109 RCVD_IN_MSPIKE_H5 7195 1.44 0.42 1.79 110 TR_DCC_Bayes_99 7175 7.40 23.53 1.79 111 XM_B_Unsub2 7059 1.79 1.90 1.76 112 XM_B_Investor 6859 2.16 3.46 1.71 113 INVALID_MSGID 6752 1.30 0.19 1.68 114 TVD_RCVD_IP 6732 1.72 1.83 1.67 115 IN_HORDE_ADDRESS_BOOK 6634 1.27 0.17 1.65 116 TooManyTo_002 6476 1.41 0.83 1.61 117 XM_CamelCaseFrm001 6322 1.76 2.30 1.57 118 MSGID_NOFQDN1 6297 1.19 0.11 1.57 119 TM2_M_VERY_LONG_WORD 6196 2.47 5.16 1.54 120 TO_MALFORMED 6156 1.14 0.03 1.53 121 XM_B_Phish66 6067 1.90 3.00 1.51 122 T_XMDrugObfuBody_08 6028 1.81 2.72 1.50 123 TR_Symld_Words 5868 1.82 2.87 1.46 124 XMSubNoVowel 5726 1.32 1.02 1.42 125 XM_E_Blogspot 5626 1.06 0.10 1.40 126 BOTNET 5521 4.86 14.87 1.37 127 XM_DK_Undo_01 5271 1.54 2.20 1.31 128 HELO_NODOT 5116 1.10 0.59 1.27 129 HELO_NO_DOMAIN 5114 1.09 0.58 1.27 130 XMGappySubj_01 4942 1.40 1.88 1.23 131 TR_XM_SpammyWords5 4789 1.80 3.56 1.19 132 URI_HEX 4778 1.42 2.08 1.19 133 XMSubMetaSx_01 4723 0.99 0.47 1.18 134 XMStockSpam_06 4584 1.37 2.03 1.14 135 RCVD_IN_MSPIKE_BL 4554 2.45 6.25 1.13 136 TR_XM_MSPIKECOMBO 4525 2.43 6.19 1.13 137 TR_XM_SpammyRelay 4451 3.83 11.67 1.11 138 XM_GoogleGroups 4432 1.55 2.84 1.10 139 TooManyTo_003 4312 0.99 0.74 1.07 140 XMDiploma_00 4272 1.60 3.13 1.06 141 UNTRUSTED_Relay 4132 4.46 14.32 1.03 142 XM_H_Long_From02 4104 1.01 0.96 1.02 143 XMBSHREFv2 3860 0.78 0.26 0.96 144 TVD_SPACE_RATIO 3853 1.35 2.48 0.96 145 TR_XM_MaxUnsub 3833 2.43 6.68 0.95 146 XMSexyCombo_02 3800 0.85 0.57 0.95 147 XMBrknScrpt_02 3621 0.96 1.13 0.90 148 DKIM_ADSP_CUSTOM_MED 3534 0.98 1.26 0.88 149 HTML_IMAGE_ONLY_20 3407 0.73 0.40 0.85 150 XMCapTrack 3282 0.68 0.28 0.82 151 RCVD_IN_RP_SAFE 3253 0.79 0.75 0.81 152 TR_LOTS_OF_MONEY3 3178 0.99 1.55 0.79 153 TR_XM_SpammyWords2 3178 3.41 10.95 0.79 154 RCVD_IN_BL_SPAMCOP_NET 3129 2.99 9.34 0.78 155 XM_OfRef6 3091 1.17 2.33 0.77 156 TooManyTo_004 3071 0.73 0.65 0.76 157 T_TooManySym_03 2977 0.62 0.26 0.74 158 RCVD_IN_MSPIKE_L3 2974 1.27 2.80 0.74 159 XMLngstWrd_00 2971 1.30 2.91 0.74 160 RCVD_IN_RP_CERTIFIED 2924 0.67 0.50 0.73 161 XMPhish30 2884 0.86 1.27 0.72 162 XMBdyGiftCard01 2877 0.82 1.12 0.72 163 T_FILL_THIS_FORM_SHORT 2786 1.08 2.19 0.69 164 XM_B_COVIDMETA 2770 1.24 2.82 0.69 165 XMSubMetaSxObfu_03 2674 0.83 1.31 0.67 166 XMLngstWrd_01 2667 1.23 2.87 0.66 167 URI_TRY_3LD 2603 0.88 1.55 0.65 168 RELAYCOUNTRY_CA 2574 1.74 4.91 0.64 169 TooManyTo_005 2537 0.62 0.60 0.63 170 XM_UB50 2531 1.99 5.88 0.63 171 SHORTENED_URL_HREF 2529 0.52 0.22 0.63 172 TR_MetaPhish_Combo_01 2500 0.68 0.84 0.62 173 HTTPS_HTTP_MISMATCH 2493 0.72 1.00 0.62 174 XMHTML_After_End 2467 0.74 1.11 0.61 175 XM_B_COPY_HTML 2455 0.67 0.83 0.61 176 XMLngstWrd_02 2371 1.16 2.81 0.59 177 NML_ADSP_CUSTOM_MED 2359 0.69 0.99 0.59 178 FROM_GOV_DKIM_AU 2337 0.50 0.26 0.58 179 XMBody_95 2326 0.46 0.11 0.58 180 RELAYCOUNTRY_GB 2318 0.71 1.09 0.58 181 T_XMDrugObfuBody_00 2309 0.97 2.10 0.57 182 T_OBFU_PDF_ATTACH 2254 0.48 0.25 0.56 183 SpammyFromTLD_01 2254 1.58 4.51 0.56 184 XMGenDplmaNmb 2209 0.71 1.17 0.55 185 XM_H_SpoofStaff4 2191 0.49 0.33 0.55 186 TR_XM_SpammyWords3 2168 1.19 3.07 0.54 187 XM_ProductURIs 2139 0.57 0.69 0.53 188 FORGED_GMAIL_RCVD 2050 0.67 1.14 0.51 189 TVD_SPACE_RATIO_MINFP 2035 0.44 0.25 0.51 190 HTML_TAG_BALANCE_BODY 2028 0.74 1.41 0.50 191 XMLngstWrd_03 2027 1.07 2.71 0.50 192 XMBody_17 1945 0.96 2.35 0.48 193 SpammyFromTLD_02 1901 2.16 7.00 0.47 194 XM_D_tchamptons_WL 1880 0.38 0.13 0.47 195 TR_MSPIKEBAYES00 1872 0.35 0.02 0.47 196 XMSubMetaI_00 1847 0.61 1.04 0.46 197 XM_ShortIntro_01 1822 0.44 0.42 0.45 198 XM_H_PHPMailer 1809 0.59 1.00 0.45 199 XMBody_106 1788 0.35 0.07 0.44 200 XMPhish14 1780 0.56 0.88 0.44 ----------------------------------------------------------------------