Email: 490522 Autolearn: 0 AvgScore: 3.46 AvgScanTime: 1.14 sec Spam: 149818 Autolearn: 0 AvgScore: 14.74 AvgScanTime: 1.15 sec Ham: 340704 Autolearn: 0 AvgScore: -1.50 AvgScanTime: 1.14 sec Time Spent Running SA: 155.81 hours Time Spent Processing Spam: 48.02 hours Time Spent Processing Ham: 107.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142690 89.26 95.24 86.64 2 RELAYCOUNTRY_US 120411 80.91 80.37 81.15 3 DKIM_SIGNED 111691 72.45 74.55 71.53 4 XM_DK_Pass 107820 70.72 71.97 70.17 5 DKIM_VALID 107046 69.89 71.45 69.20 6 XM_B_Unicode 99267 67.36 66.26 67.85 7 DCC_CHECK 90805 41.03 60.61 32.42 8 XM_B_SpammyWords 89190 47.98 59.53 42.90 9 XMListUnsubscribeExists 88930 49.33 59.36 44.91 10 DKIM_VALID_AU 79839 53.27 53.29 53.26 11 BAYES_50 64572 52.03 43.10 55.96 12 MIME_HTML_ONLY 63049 27.35 42.08 20.88 13 DCC_CHECK_NEGATIVE 58983 58.93 39.37 67.54 14 XM_B_Unicode3 54787 38.78 36.57 39.75 15 XM_DK_Undo_02 53679 15.34 35.83 6.34 16 FVGT_m_MULTI_ODD 45826 26.00 30.59 23.98 17 XM_B_SpammyWords2 45370 21.34 30.28 17.40 18 LOC_TINY_FONT_1 44643 24.39 29.80 22.01 19 BAYES_99 43019 12.26 28.71 5.02 20 TR_XM_DKIM_Undo 42221 12.10 28.18 5.02 21 HTML_FONT_LOW_CONTRAST 41123 26.48 27.45 26.05 22 DKIM_VALID_EF 36777 27.17 24.55 28.33 23 RCVD_IN_MSPIKE_H2 35526 21.88 23.71 21.08 24 BAYES_999 34119 9.77 22.77 4.05 25 BOTNET 33718 7.83 22.51 1.38 26 T_KAM_HTML_FONT_INVALID 33439 19.01 22.32 17.55 27 TR_DCC_Bayes_99 31535 7.79 21.05 1.96 28 RELAYCOUNTRY_META 31024 9.06 20.71 3.93 29 RCVD_IN_MSPIKE_WL 30548 27.65 20.39 30.84 30 XMSubLong 30326 21.47 20.24 22.01 31 T_TM2_M_HEADER_IN_MSG 29733 28.57 19.85 32.41 32 HTML_MIME_NO_HTML_TAG 29215 8.52 19.50 3.70 33 XM_Body_Dirty_Words 28520 13.68 19.04 11.32 34 XM_Multi_Part_URI 20878 12.35 13.94 11.65 35 RCVD_IN_MSPIKE_H3 20442 15.88 13.64 16.86 36 GOOG_STO_IMG_HTML 19155 3.91 12.79 0.00 37 HDRS_MISSP 19070 3.91 12.73 0.03 38 XM_BadFromFormat 18882 3.91 12.60 0.09 39 HTML_SHORT_LINK_IMG_1 18574 3.80 12.40 0.02 40 UNTRUSTED_Relay 18445 4.65 12.31 1.28 41 XM_B_Unsub 18061 10.23 12.06 9.42 42 LOTS_OF_MONEY 18010 9.29 12.02 8.10 43 UNPARSEABLE_RELAY 17232 8.80 11.50 7.61 44 BOTNET_IPINHOSTNAME 16982 6.37 11.34 4.19 45 TR_XM_UnparsRelay 16821 7.46 11.23 5.80 46 XM_UncommonTLD01 16495 5.83 11.01 3.56 47 XM_B_SpammyWords3 15855 6.05 10.58 4.06 48 FSL_BULK_SIG 15673 5.77 10.46 3.71 49 XM_SPF_SoftFail 15179 5.60 10.13 3.61 50 TR_XM_SpammyWords4 14683 6.51 9.80 5.07 51 BAYES_60 14631 9.58 9.77 9.49 52 MPART_ALT_DIFF 14263 6.97 9.52 5.85 53 TR_XM_SpammyWords2 13409 3.32 8.95 0.84 54 XMSexyCombo_05 13394 5.21 8.94 3.57 55 BAYES_80 12374 5.46 8.26 4.23 56 TR_XM_SpammyRelay 11835 3.48 7.90 1.54 57 XM_Evil_Numbers_Gen 11541 7.65 7.70 7.62 58 RCVD_IN_BL_SPAMCOP_NET 11061 2.63 7.38 0.55 59 XM_UB50 10759 2.76 7.18 0.81 60 XM_SendGrid 10700 6.11 7.14 5.66 61 TM2_M_VERY_LONG_WORD 10661 3.61 7.12 2.07 62 MIME_HTML_ONLY_MULTI 10633 4.98 7.10 4.05 63 HTML_IMAGE_RATIO_02 10518 6.64 7.02 6.47 64 HTML_IMAGE_ONLY_08 10084 2.13 6.73 0.11 65 HTML_IMAGE_ONLY_04 9783 2.03 6.53 0.05 66 RCVD_IN_MSPIKE_H4 9670 10.22 6.45 11.87 67 HTML_SHORT_CENTER 9624 1.96 6.42 0.00 68 TR_XM_PhishingBody 9434 4.36 6.30 3.50 69 LotsOfNums_01 8965 7.85 5.98 8.67 70 XM_GoogleGroups 8806 3.44 5.88 2.36 71 XMLngstWrd_00 7963 2.64 5.32 1.47 72 TR_XM_Spammywords 7953 1.79 5.31 0.24 73 XM_S_SpammyWords 7953 1.79 5.31 0.24 74 XM_H_Long_From01 7899 5.23 5.27 5.21 75 XMLngstWrd_01 7844 2.58 5.24 1.42 76 XMLngstWrd_02 7774 2.50 5.19 1.32 77 TR_XM_MaxUnsub 7542 2.05 5.03 0.74 78 RCVD_IN_MSPIKE_BL 7507 2.26 5.01 1.05 79 XM_B_Phish_Phrases 7406 4.15 4.94 3.80 80 XMSubject_48 7286 1.50 4.86 0.02 81 XMLngstWrd_03 7270 2.32 4.85 1.20 82 XMLngstWrd_04 7211 2.25 4.81 1.13 83 HTML_TITLE_SUBJ_DIFF 7188 2.16 4.80 1.00 84 UPPERCASE_75_100 7124 2.15 4.76 1.00 85 TR_XM_MSPIKECOMBO 7096 2.18 4.74 1.05 86 XMSubMetaSx_00 6777 4.24 4.52 4.12 87 TooManyTo_001 6491 7.36 4.33 8.69 88 TR_XM_DK_SendGrid 6339 3.75 4.23 3.55 89 RELAYCOUNTRY_CA 6330 1.95 4.23 0.95 90 BAYES_95 6232 2.99 4.16 2.48 91 XM_B_SpammyTLD 6090 2.73 4.06 2.15 92 HTML_IMAGE_RATIO_04 5865 4.61 3.91 4.91 93 T_REMOTE_IMAGE 5797 3.77 3.87 3.72 94 SpammyFromTLD_02 5631 1.31 3.76 0.24 95 TR_XM_SPAMCOP 5569 1.25 3.72 0.17 96 SpammyFromTLD_01 5546 1.67 3.70 0.78 97 XMStrtUSub 5521 4.40 3.69 4.72 98 XM_B_Investor 5312 2.26 3.55 1.70 99 XMNumbers 5212 3.71 3.48 3.82 100 T_XMDrugObfuBody_08 5147 2.08 3.44 1.48 101 XM_B_Phish66 5103 2.48 3.41 2.07 102 T_XMDrugObfuBody_14 5100 2.43 3.40 2.01 103 SUBJ_ALL_CAPS 5061 2.48 3.38 2.08 104 BOTNET_NORDNS 4935 1.02 3.29 0.02 105 XM_DIRTYINTL 4865 1.22 3.25 0.33 106 BAYES_40 4863 4.61 3.25 5.21 107 TR_XM_SpammyWords5 4761 1.91 3.18 1.36 108 DKIM_INVALID 4645 2.56 3.10 2.33 109 FROM_SUSPICIOUS_NTLD 4636 0.98 3.09 0.04 110 XM_OfRef6 4625 1.62 3.09 0.97 111 RCVD_IN_VALIDITY_SAFE 4592 4.08 3.07 4.53 112 FROM_SUSPICIOUS_NTLD_FP 4587 0.96 3.06 0.04 113 HTML_IMAGE_RATIO_06 4457 3.20 2.97 3.29 114 MIME_QP_LONG_LINE 4450 4.64 2.97 5.38 115 TM2_M_URI_OPT_OUT 4277 2.41 2.85 2.21 116 MIME_HTML_MOSTLY 4269 2.47 2.85 2.30 117 DIET_1 4096 1.07 2.73 0.34 118 XM_DK_Undo_01 3824 2.13 2.55 1.94 119 T_FILL_THIS_FORM_SHORT 3796 1.33 2.53 0.80 120 RCVD_IN_VALIDITY_CERTIFIED 3789 3.63 2.53 4.12 121 TR_XM_SpammyWords3 3781 1.09 2.52 0.46 122 RCVD_IN_VALIDITY_RPBL 3778 0.78 2.52 0.01 123 KHOP_HELO_FCRDNS 3685 2.26 2.46 2.17 124 USER_IN_DEF_DKIM_WL 3635 8.76 2.43 11.54 125 RCVD_IN_IADB_LISTED 3626 4.36 2.42 5.22 126 XM_B_Unsub2 3476 1.76 2.32 1.52 127 HTML_IMAGE_RATIO_08 3455 2.98 2.31 3.28 128 T_TooManySym_01 3406 5.45 2.27 6.84 129 FROM_NTLD_LINKBAIT 3359 0.68 2.24 0.00 130 SHORT_IMG_SUSP_NTLD 3359 0.68 2.24 0.00 131 XM_CamelCaseFrm001 3333 1.91 2.22 1.77 132 MAILING_LIST_MULTI 3296 2.80 2.20 3.06 133 RELAYCOUNTRY_RU 3272 0.68 2.18 0.02 134 RELAYCOUNTRY_GB 3264 1.26 2.18 0.86 135 XMSlimDrugH 3262 0.81 2.18 0.21 136 URI_NOVOWEL 3087 2.32 2.06 2.44 137 TR_XM_SB_Phish 3078 2.14 2.05 2.18 138 RCVD_IN_MSPIKE_L3 3044 0.97 2.03 0.50 139 XMSubPhish11 3030 2.12 2.02 2.16 140 RCVD_IN_PSBL 3027 0.64 2.02 0.03 141 RCVD_IN_IADB_SPF 2958 3.83 1.97 4.65 142 PDS_OTHER_BAD_TLD 2936 0.77 1.96 0.25 143 TR_XM_PHPDW 2865 0.87 1.91 0.41 144 XM_B_SpammyWords4 2813 0.91 1.88 0.49 145 RCVD_IN_MSPIKE_L5 2759 0.66 1.84 0.14 146 XMDiploma_00 2758 1.41 1.84 1.22 147 TR_XM_PHPForged 2694 0.80 1.80 0.36 148 DKIM_ADSP_CUSTOM_MED 2690 1.24 1.80 1.00 149 XM_B_COVIDMETA 2687 0.88 1.79 0.48 150 RCVD_IN_IADB_DK 2667 3.38 1.78 4.08 151 TR_XM_FormFill2 2662 0.79 1.78 0.36 152 RCVD_IN_IADB_SENDERID 2658 3.47 1.77 4.22 153 XM_H_PHPOS 2653 0.79 1.77 0.35 154 TR_XM_MSPIKECOMBO2 2623 0.62 1.75 0.12 155 XMBody_17 2613 0.85 1.74 0.46 156 URI_HEX 2600 1.49 1.74 1.38 157 XMWghtMeta_00 2590 0.54 1.73 0.02 158 T_XMDrugObfuBody_00 2582 0.91 1.72 0.55 159 FROM_EXCESS_BASE64 2487 2.40 1.66 2.72 160 SUBJECT_DIET 2470 0.51 1.65 0.01 161 XM_UB99 2405 0.49 1.61 0.00 162 NO_DNS_FOR_FROM 2381 0.70 1.59 0.31 163 XMSexyCombo_01 2343 1.34 1.56 1.23 164 TR_XM_MaxWHORU 2328 0.64 1.55 0.23 165 XM_URI_RBL 2305 0.55 1.54 0.12 166 RCVD_IN_IADB_VOUCHED 2273 2.65 1.52 3.15 167 ALL_TRUSTED 2270 11.90 1.52 16.47 168 TR_Mismatch_TLD_02 2268 0.52 1.51 0.08 169 TR_Symld_Words 2217 1.70 1.48 1.80 170 XM_H_Undi_Recip 2200 0.61 1.47 0.23 171 TR_XM_NoHeaderRelay 2189 0.59 1.46 0.20 172 XMStockSpam_06 2166 1.26 1.45 1.19 173 RELAYCOUNTRY_FR 2110 0.62 1.41 0.28 174 RELAYCOUNTRY_AU 2108 0.62 1.41 0.28 175 URIBL_DBL_SPAM 2045 0.43 1.36 0.01 176 URI_PHP_REDIR 2031 0.42 1.36 0.00 177 XMSubMetaI_00 2030 0.90 1.35 0.70 178 T_XMHurry_00 1997 0.75 1.33 0.49 179 HTML_FONT_TINY_NORDNS 1970 0.45 1.31 0.07 180 UNCLAIMED_MONEY 1885 0.39 1.26 0.00 181 URIBL_BLACK 1872 0.41 1.25 0.04 182 TR_XM_FormFill 1845 0.38 1.23 0.01 183 XMHTML_After_End 1799 0.88 1.20 0.74 184 XM_UB999 1774 0.36 1.18 0.00 185 BAYES_20 1764 2.90 1.18 3.65 186 XM_B_SEO 1732 0.44 1.16 0.13 187 TR_XM_COVIDMETA1 1681 0.47 1.12 0.19 188 XMBdyGiftCard01 1671 0.73 1.12 0.57 189 XM_UB60 1649 0.39 1.10 0.08 190 XMPhish30 1583 0.72 1.06 0.57 191 FORGED_GMAIL_RCVD 1571 0.67 1.05 0.50 192 URI_TRY_3LD 1562 0.69 1.04 0.54 193 HTML_TAG_BALANCE_CENTER 1548 0.35 1.03 0.05 194 TR_XM_Undi_Recip5 1544 0.32 1.03 0.00 195 TR_LOTS_OF_MONEY2 1543 0.46 1.03 0.21 196 T_MONEY_PERCENT 1543 0.46 1.03 0.21 197 TooManyTo_002 1533 2.07 1.02 2.53 198 FILL_THIS_FORM 1523 1.05 1.02 1.07 199 TR_BOTNET_NEGATE 1510 0.52 1.01 0.31 200 XM_B_DNDMA 1493 0.54 1.00 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295174 89.26 95.24 86.64 2 RELAYCOUNTRY_US 276483 80.91 80.37 81.15 3 DKIM_SIGNED 243703 72.45 74.55 71.53 4 XM_DK_Pass 239087 70.72 71.97 70.17 5 DKIM_VALID 235781 69.89 71.45 69.20 6 XM_B_Unicode 231160 67.36 66.26 67.85 7 DCC_CHECK_NEGATIVE 230105 58.93 39.37 67.54 8 BAYES_50 190642 52.03 43.10 55.96 9 DKIM_VALID_AU 181469 53.27 53.29 53.26 10 XMListUnsubscribeExists 153022 49.33 59.36 44.91 11 XM_B_SpammyWords 146162 47.98 59.53 42.90 12 XM_B_Unicode3 135419 38.78 36.57 39.75 13 DCC_CHECK 110450 41.03 60.61 32.42 14 T_TM2_M_HEADER_IN_MSG 110414 28.57 19.85 32.41 15 RCVD_IN_MSPIKE_WL 105079 27.65 20.39 30.84 16 DKIM_VALID_EF 96517 27.17 24.55 28.33 17 HTML_FONT_LOW_CONTRAST 88743 26.48 27.45 26.05 18 FVGT_m_MULTI_ODD 81701 26.00 30.59 23.98 19 XMSubLong 74990 21.47 20.24 22.01 20 LOC_TINY_FONT_1 74982 24.39 29.80 22.01 21 RCVD_IN_MSPIKE_H2 71804 21.88 23.71 21.08 22 MIME_HTML_ONLY 71128 27.35 42.08 20.88 23 T_KAM_HTML_FONT_INVALID 59786 19.01 22.32 17.55 24 XM_B_SpammyWords2 59294 21.34 30.28 17.40 25 RCVD_IN_MSPIKE_H3 57459 15.88 13.64 16.86 26 ALL_TRUSTED 56104 11.90 1.52 16.47 27 RCVD_IN_MSPIKE_H4 40440 10.22 6.45 11.87 28 BAYES_00 39996 8.45 0.97 11.74 29 XM_Multi_Part_URI 39678 12.35 13.94 11.65 30 USER_IN_DEF_DKIM_WL 39316 8.76 2.43 11.54 31 XM_Body_Dirty_Words 38575 13.68 19.04 11.32 32 BAYES_60 32344 9.58 9.77 9.49 33 XM_B_Unsub 32105 10.23 12.06 9.42 34 TooManyTo_001 29614 7.36 4.33 8.69 35 LotsOfNums_01 29535 7.85 5.98 8.67 36 IN_ZIMBRA_NJ_WHITELIST 28296 5.80 0.11 8.31 37 LOTS_OF_MONEY 27584 9.29 12.02 8.10 38 XM_Evil_Numbers_Gen 25961 7.65 7.70 7.62 39 UNPARSEABLE_RELAY 25929 8.80 11.50 7.61 40 XM_DKIMWhitelistDomains 25728 5.27 0.09 7.55 41 T_TooManySym_01 23316 5.45 2.27 6.84 42 TR_XM_DK_Bayes 22722 4.76 0.41 6.67 43 TR_XM_DK_Bayes1 22243 4.66 0.41 6.53 44 HTML_IMAGE_RATIO_02 22046 6.64 7.02 6.47 45 XM_DK_Undo_02 21584 15.34 35.83 6.34 46 MPART_ALT_DIFF 19915 6.97 9.52 5.85 47 TR_XM_UnparsRelay 19748 7.46 11.23 5.80 48 XM_SendGrid 19283 6.11 7.14 5.66 49 XM_PDF 19230 4.18 0.87 5.64 50 TR_XM_DK_Bayes2 19096 3.99 0.33 5.60 51 MIME_QP_LONG_LINE 18320 4.64 2.97 5.38 52 RCVD_IN_IADB_LISTED 17775 4.36 2.42 5.22 53 BAYES_40 17735 4.61 3.25 5.21 54 XM_H_Long_From01 17734 5.23 5.27 5.21 55 TR_XM_SpammyWords4 17269 6.51 9.80 5.07 56 BAYES_99 17120 12.26 28.71 5.02 57 TR_XM_DKIM_Undo 17114 12.10 28.18 5.02 58 HTML_IMAGE_RATIO_04 16728 4.61 3.91 4.91 59 XMStrtUSub 16065 4.40 3.69 4.72 60 RCVD_IN_IADB_SPF 15851 3.83 1.97 4.65 61 RCVD_IN_VALIDITY_SAFE 15440 4.08 3.07 4.53 62 BAYES_80 14403 5.46 8.26 4.23 63 RCVD_IN_IADB_SENDERID 14380 3.47 1.77 4.22 64 BOTNET_IPINHOSTNAME 14269 6.37 11.34 4.19 65 RCVD_IN_VALIDITY_CERTIFIED 14033 3.63 2.53 4.12 66 XMSubMetaSx_00 14032 4.24 4.52 4.12 67 RCVD_IN_IADB_DK 13911 3.38 1.78 4.08 68 XM_B_SpammyWords3 13832 6.05 10.58 4.06 69 BAYES_999 13808 9.77 22.77 4.05 70 MIME_HTML_ONLY_MULTI 13805 4.98 7.10 4.05 71 RELAYCOUNTRY_META 13394 9.06 20.71 3.93 72 XMNumbers 13005 3.71 3.48 3.82 73 XM_B_Phish_Phrases 12955 4.15 4.94 3.80 74 T_REMOTE_IMAGE 12684 3.77 3.87 3.72 75 FSL_BULK_SIG 12653 5.77 10.46 3.71 76 HTML_MIME_NO_HTML_TAG 12591 8.52 19.50 3.70 77 BAYES_20 12443 2.90 1.18 3.65 78 XM_SPF_SoftFail 12307 5.60 10.13 3.61 79 T_TooManySym_02 12224 2.70 0.68 3.59 80 XMSexyCombo_05 12162 5.21 8.94 3.57 81 XM_UncommonTLD01 12120 5.83 11.01 3.56 82 TR_XM_DK_SendGrid 12079 3.75 4.23 3.55 83 TR_XM_PhishingBody 11930 4.36 6.30 3.50 84 XM_H_Trusted_IP 11384 2.32 0.00 3.34 85 HTML_IMAGE_RATIO_06 11219 3.20 2.97 3.29 86 HTML_IMAGE_RATIO_08 11161 2.98 2.31 3.28 87 RCVD_IN_IADB_VOUCHED 10741 2.65 1.52 3.15 88 MAILING_LIST_MULTI 10434 2.80 2.20 3.06 89 FROM_EXCESS_BASE64 9271 2.40 1.66 2.72 90 ANY_BOUNCE_MESSAGE 8967 2.09 0.87 2.63 91 BOUNCE_MESSAGE 8960 2.09 0.86 2.63 92 TooManyTo_002 8616 2.07 1.02 2.53 93 BAYES_95 8453 2.99 4.16 2.48 94 URI_NOVOWEL 8316 2.32 2.06 2.44 95 HTML_FONT_FACE_BAD 8204 1.86 0.62 2.41 96 XM_GoogleGroups 8051 3.44 5.88 2.36 97 DKIM_INVALID 7922 2.56 3.10 2.33 98 HELO_NODOT 7917 1.81 0.64 2.32 99 HELO_NO_DOMAIN 7915 1.81 0.63 2.32 100 MIME_HTML_MOSTLY 7845 2.47 2.85 2.30 101 BAYES_05 7560 1.72 0.59 2.22 102 TM2_M_URI_OPT_OUT 7524 2.41 2.85 2.21 103 TR_XM_SB_Phish 7429 2.14 2.05 2.18 104 KHOP_HELO_FCRDNS 7397 2.26 2.46 2.17 105 XMSubPhish11 7349 2.12 2.02 2.16 106 XM_B_SpammyTLD 7322 2.73 4.06 2.15 107 RCVD_IN_IADB_OPTIN 7277 1.78 0.96 2.14 108 RCVD_IN_MSPIKE_H5 7180 1.55 0.29 2.11 109 SUBJ_ALL_CAPS 7103 2.48 3.38 2.08 110 XM_B_Phish66 7057 2.48 3.41 2.07 111 TM2_M_VERY_LONG_WORD 7043 3.61 7.12 2.07 112 T_XMDrugObfuBody_14 6844 2.43 3.40 2.01 113 TR_DCC_Bayes_99 6667 7.79 21.05 1.96 114 INVALID_MSGID 6621 1.44 0.30 1.94 115 XM_DK_Undo_01 6605 2.13 2.55 1.94 116 IN_HORDE_ADDRESS_BOOK 6175 1.29 0.12 1.81 117 TR_Symld_Words 6135 1.70 1.48 1.80 118 MSGID_NOFQDN1 6131 1.29 0.14 1.80 119 TO_MALFORMED 6045 1.23 0.01 1.77 120 XM_CamelCaseFrm001 6018 1.91 2.22 1.77 121 TVD_RCVD_IP 5829 1.30 0.37 1.71 122 XM_B_Investor 5795 2.26 3.55 1.70 123 TooManyTo_003 5784 1.46 0.91 1.70 124 TR_XM_SpammyRelay 5231 3.48 7.90 1.54 125 XM_B_Unsub2 5175 1.76 2.32 1.52 126 T_XMDrugObfuBody_08 5056 2.08 3.44 1.48 127 XMLngstWrd_00 5011 2.64 5.32 1.47 128 XMLngstWrd_01 4830 2.58 5.24 1.42 129 URI_HEX 4703 1.49 1.74 1.38 130 BOTNET 4696 7.83 22.51 1.38 131 TR_XM_SpammyWords5 4624 1.91 3.18 1.36 132 XMCapTrack 4564 1.23 0.98 1.34 133 XMLngstWrd_02 4491 2.50 5.19 1.32 134 UNTRUSTED_Relay 4366 4.65 12.31 1.28 135 XMSexyCombo_01 4207 1.34 1.56 1.23 136 XMDiploma_00 4172 1.41 1.84 1.22 137 XMGappySubj_01 4118 0.99 0.51 1.21 138 XMSubNoVowel 4115 1.02 0.60 1.21 139 TooManyTo_004 4102 1.09 0.83 1.20 140 XMLngstWrd_03 4096 2.32 4.85 1.20 141 XMStockSpam_06 4039 1.26 1.45 1.19 142 XMLngstWrd_04 3848 2.25 4.81 1.13 143 XM_E_Blogspot 3720 0.83 0.22 1.09 144 TVD_SPACE_RATIO 3672 0.90 0.49 1.08 145 FILL_THIS_FORM 3636 1.05 1.02 1.07 146 RCVD_IN_MSPIKE_BL 3585 2.26 5.01 1.05 147 TR_XM_MSPIKECOMBO 3582 2.18 4.74 1.05 148 XMBSHREFv2 3493 0.79 0.26 1.03 149 HTML_TITLE_SUBJ_DIFF 3411 2.16 4.80 1.00 150 DKIM_ADSP_CUSTOM_MED 3409 1.24 1.80 1.00 151 UPPERCASE_75_100 3409 2.15 4.76 1.00 152 XM_H_Long_From02 3361 0.99 0.99 0.99 153 XM_OfRef6 3301 1.62 3.09 0.97 154 TooManyTo_005 3284 0.90 0.76 0.96 155 RELAYCOUNTRY_CA 3226 1.95 4.23 0.95 156 T_TooManySym_03 3196 0.72 0.22 0.94 157 XMNoVowels 3100 0.73 0.33 0.91 158 RCVD_IN_RP_SAFE 3063 0.82 0.63 0.90 159 RELAYCOUNTRY_GB 2927 1.26 2.18 0.86 160 XMBody_95 2901 0.62 0.08 0.85 161 TR_XM_SpammyWords2 2862 3.32 8.95 0.84 162 RCVD_IN_RP_CERTIFIED 2824 0.73 0.51 0.83 163 XM_UB50 2759 2.76 7.18 0.81 164 SHORT_HELO_AND_INLINE_IMAGE 2747 0.59 0.09 0.81 165 T_FILL_THIS_FORM_SHORT 2717 1.33 2.53 0.80 166 SpammyFromTLD_01 2656 1.67 3.70 0.78 167 HTTPS_HTTP_MISMATCH 2596 0.83 0.97 0.76 168 XMHTML_After_End 2514 0.88 1.20 0.74 169 TR_XM_MaxUnsub 2506 2.05 5.03 0.74 170 TR_MetaPhish_Combo_01 2446 0.75 0.83 0.72 171 XMSubMetaI_00 2372 0.90 1.35 0.70 172 XMBrknScrpt_02 2324 0.75 0.92 0.68 173 XM_RXBody 2297 0.57 0.34 0.67 174 XM_ShortIntro_01 2273 0.62 0.53 0.67 175 HTML_IMAGE_ONLY_20 2187 0.57 0.39 0.64 176 XMGenDplmaNmb 2176 0.73 0.94 0.64 177 XM_H_PHPMailer 2098 0.67 0.81 0.62 178 XMPhish14 2063 0.68 0.85 0.61 179 XMSexyCombo_04 2052 0.61 0.62 0.60 180 RCVD_IN_SORBS_DUL 2049 0.50 0.28 0.60 181 T_OBFU_PDF_ATTACH 2037 0.46 0.15 0.60 182 NML_ADSP_CUSTOM_MED 2005 0.69 0.93 0.59 183 T_Symld_Words_02 1953 0.64 0.78 0.57 184 TR_MSPIKEBAYES00 1946 0.40 0.02 0.57 185 XMPhish30 1929 0.72 1.06 0.57 186 XMBdyGiftCard01 1926 0.73 1.12 0.57 187 HTML_TAG_BALANCE_BODY 1893 0.66 0.91 0.56 188 T_XMDrugObfuBody_00 1879 0.91 1.72 0.55 189 RCVD_IN_BL_SPAMCOP_NET 1857 2.63 7.38 0.55 190 URI_TRY_3LD 1827 0.69 1.04 0.54 191 XM_B_COPY_HTML 1756 0.54 0.60 0.52 192 XM_ProductURIs 1737 0.53 0.57 0.51 193 FORGED_GMAIL_RCVD 1714 0.67 1.05 0.50 194 RCVD_IN_MSPIKE_L3 1709 0.97 2.03 0.50 195 XMMoneyMeta_00 1692 0.58 0.76 0.50 196 XMOemUri 1690 0.44 0.30 0.50 197 FROM_GOV_DKIM_AU 1683 0.37 0.10 0.49 198 T_XMHurry_00 1663 0.75 1.33 0.49 199 USER_IN_WHITELIST 1662 0.34 0.00 0.49 200 USER_IN_WELCOMELIST 1662 0.34 0.00 0.49 ----------------------------------------------------------------------