Email: 272089 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 1.23 sec Spam: 85393 Autolearn: 0 AvgScore: 14.98 AvgScanTime: 1.28 sec Ham: 186696 Autolearn: 0 AvgScore: -1.94 AvgScanTime: 1.21 sec Time Spent Running SA: 92.91 hours Time Spent Processing Spam: 30.27 hours Time Spent Processing Ham: 62.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 79010 86.17 92.53 83.27 2 DKIM_SIGNED 71892 79.34 84.19 77.12 3 XM_DK_Pass 70433 77.67 82.48 75.47 4 DKIM_VALID 69909 77.13 81.87 74.97 5 RELAYCOUNTRY_US 68956 80.72 80.75 80.71 6 XM_B_Unicode 64247 71.57 75.24 69.89 7 DCC_CHECK 57104 45.31 66.87 35.45 8 XMListUnsubscribeExists 55504 58.09 65.00 54.94 9 XM_B_SpammyWords 53661 50.48 62.84 44.82 10 DKIM_VALID_AU 52272 61.06 61.21 60.99 11 XM_DK_Undo_02 38612 20.52 45.22 9.23 12 XM_B_Unicode3 38555 44.86 45.15 44.73 13 BAYES_99 33240 17.53 38.93 7.74 14 MIME_HTML_ONLY 31752 27.92 37.18 23.69 15 TR_XM_DKIM_Undo 31108 15.81 36.43 6.37 16 BAYES_50 31046 47.99 36.36 53.30 17 XM_B_SpammyWords2 30922 24.86 36.21 19.66 18 LOC_TINY_FONT_1 30164 29.82 35.32 27.30 19 HTML_FONT_LOW_CONTRAST 28812 31.65 33.74 30.69 20 DCC_CHECK_NEGATIVE 28264 54.66 33.10 64.52 21 FVGT_m_MULTI_ODD 28107 27.03 32.91 24.34 22 BAYES_999 26620 14.11 31.17 6.31 23 RCVD_IN_MSPIKE_H2 25554 23.56 29.93 20.65 24 DKIM_VALID_EF 23614 28.50 27.65 28.89 25 TR_DCC_Bayes_99 21798 9.97 25.53 2.85 26 XM_Body_Dirty_Words 21518 15.81 25.20 11.51 27 T_KAM_HTML_FONT_INVALID 20820 19.49 24.38 17.26 28 RELAYCOUNTRY_META 19851 9.69 23.25 3.48 29 XMSubLong 19482 22.33 22.81 22.11 30 RCVD_IN_MSPIKE_WL 16799 27.97 19.67 31.76 31 T_TM2_M_HEADER_IN_MSG 15843 21.20 18.55 22.41 32 UNPARSEABLE_RELAY 14789 11.70 17.32 9.13 33 TR_XM_UnparsRelay 14483 10.28 16.96 7.23 34 XM_B_Unsub 13842 12.34 16.21 10.57 35 XM_Multi_Part_URI 13116 13.93 15.36 13.28 36 FSL_BULK_SIG 13061 7.00 15.30 3.21 37 BOTNET 12122 5.69 14.20 1.80 38 TR_XM_SpammyWords2 11566 5.36 13.54 1.62 39 RCVD_IN_MSPIKE_H3 11405 15.57 13.36 16.59 40 LOTS_OF_MONEY 11227 10.00 13.15 8.57 41 XMSexyCombo_05 10882 6.51 12.74 3.67 42 BOTNET_IPINHOSTNAME 10585 8.15 12.40 6.21 43 XM_B_SpammyWords3 10441 7.12 12.23 4.78 44 TR_XM_SpammyWords4 9778 7.04 11.45 5.02 45 RCVD_IN_BL_SPAMCOP_NET 9610 4.34 11.25 1.18 46 UNTRUSTED_Relay 9273 4.44 10.86 1.51 47 XM_UncommonTLD01 8954 6.44 10.49 4.59 48 TR_XM_SpammyRelay 8559 4.17 10.02 1.49 49 XM_SendGrid 8336 7.68 9.76 6.72 50 MPART_ALT_DIFF 7913 7.15 9.27 6.18 51 HTML_IMAGE_RATIO_02 7249 8.20 8.49 8.06 52 BAYES_80 7224 6.34 8.46 5.37 53 TM2_M_VERY_LONG_WORD 7060 4.20 8.27 2.33 54 TR_XM_MaxUnsub 6906 3.16 8.09 0.90 55 XM_Evil_Numbers_Gen 6654 8.81 7.79 9.27 56 BAYES_60 6227 10.77 7.29 12.36 57 MIME_HTML_ONLY_MULTI 6097 5.11 7.14 4.18 58 HTML_MIME_NO_HTML_TAG 6056 3.76 7.09 2.24 59 XMSubMetaSx_00 5583 5.13 6.54 4.49 60 RCVD_IN_MSPIKE_H4 5186 11.16 6.07 13.48 61 TR_XM_DK_SendGrid 5078 5.05 5.95 4.64 62 RELAYCOUNTRY_CA 5048 2.44 5.91 0.85 63 TooManyTo_001 4805 6.19 5.63 6.45 64 RCVD_IN_VALIDITY_RPBL 4597 1.71 5.38 0.03 65 RCVD_IN_MSPIKE_BL 4552 2.27 5.33 0.88 66 LotsOfNums_01 4538 7.79 5.31 8.92 67 TR_XM_MSPIKECOMBO 4475 2.24 5.24 0.87 68 XM_GoogleGroups 4397 3.12 5.15 2.20 69 XM_H_Long_From01 4312 5.33 5.05 5.46 70 T_REMOTE_IMAGE 4205 3.97 4.92 3.53 71 TR_XM_SPAMCOP 4195 1.76 4.91 0.32 72 XM_SPF_SoftFail 4153 2.63 4.86 1.61 73 XM_B_Phish_Phrases 4119 4.35 4.82 4.14 74 BAYES_95 4076 3.89 4.77 3.49 75 TR_XM_PhishingBody 4059 3.41 4.75 2.79 76 RCVD_IN_VALIDITY_SAFE 4034 6.18 4.72 6.85 77 XMLngstWrd_00 3906 2.75 4.57 1.91 78 HTML_IMAGE_RATIO_04 3843 5.92 4.50 6.57 79 XMLngstWrd_01 3843 2.66 4.50 1.82 80 XMLngstWrd_02 3804 2.56 4.45 1.69 81 BOTNET_NORDNS 3765 1.41 4.41 0.04 82 T_XMDrugObfuBody_00 3622 1.93 4.24 0.87 83 XM_DIRTYINTL 3617 1.51 4.24 0.26 84 HTML_TITLE_SUBJ_DIFF 3576 2.06 4.19 1.09 85 XMLngstWrd_03 3533 2.35 4.14 1.53 86 XMLngstWrd_04 3496 2.25 4.09 1.41 87 UPPERCASE_75_100 3492 2.00 4.09 1.05 88 T_XMDrugObfuBody_08 3403 2.18 3.99 1.35 89 RCVD_IN_VALIDITY_CERTIFIED 3396 5.37 3.98 6.00 90 XM_UB50 3212 1.86 3.76 0.99 91 RCVD_IN_PSBL 3161 1.20 3.70 0.06 92 T_XMDrugObfuBody_14 3131 2.51 3.67 1.98 93 XM_B_SpammyTLD 3015 2.46 3.53 1.98 94 BODY_URI_ONLY 3014 1.11 3.53 0.01 95 XMNumbers 3013 4.59 3.53 5.07 96 XM_B_Investor 2993 2.07 3.50 1.42 97 SpammyFromTLD_01 2943 1.38 3.45 0.44 98 USER_IN_DEF_DKIM_WL 2743 12.73 3.21 17.08 99 XM_BadFromFormat 2642 1.05 3.09 0.11 100 TM2_M_URI_OPT_OUT 2604 2.94 3.05 2.89 101 TR_XM_SpammyWords5 2575 2.07 3.02 1.64 102 MIME_HTML_MOSTLY 2408 2.71 2.82 2.66 103 RCVD_IN_MSPIKE_L5 2388 0.90 2.80 0.03 104 XMStrtUSub 2342 4.29 2.74 5.00 105 XM_CamelCaseFrm001 2331 2.13 2.73 1.86 106 KHOP_HELO_FCRDNS 2280 1.60 2.67 1.12 107 SpammyFromTLD_02 2246 1.00 2.63 0.25 108 XM_UB99 2244 0.83 2.63 0.01 109 XM_DK_Undo_01 2216 1.75 2.60 1.36 110 FROM_EXCESS_BASE64 2201 3.95 2.58 4.58 111 XM_B_SpammyWords4 2159 1.18 2.53 0.56 112 XMSexyCombo_01 2094 1.47 2.45 1.02 113 SUBJ_ALL_CAPS 2043 1.88 2.39 1.64 114 HTML_IMAGE_RATIO_08 2013 2.37 2.36 2.38 115 DKIM_INVALID 1983 2.21 2.32 2.15 116 XMGppyBdWords 1971 0.78 2.31 0.08 117 TR_XM_PHPDW 1927 1.00 2.26 0.43 118 HTML_IMAGE_RATIO_06 1899 3.02 2.22 3.38 119 T_Symld_Words_02 1894 0.97 2.22 0.39 120 XMBody_17 1882 1.03 2.20 0.50 121 MIME_QP_LONG_LINE 1863 3.73 2.18 4.44 122 RELAYCOUNTRY_GB 1851 1.06 2.17 0.55 123 TR_XM_NoHeaderRelay 1847 0.79 2.16 0.16 124 RELAYCOUNTRY_PL 1845 0.70 2.16 0.04 125 TR_XM_MSPIKECOMBO2 1807 0.77 2.12 0.16 126 FROM_MISSP_REPLYTO 1804 0.68 2.11 0.03 127 TR_XM_PHPForged 1792 0.91 2.10 0.36 128 URIBL_SBL_A 1791 0.67 2.10 0.02 129 XM_OfRef6 1789 1.16 2.10 0.74 130 TR_XM_FormFill2 1774 0.90 2.08 0.36 131 XM_H_PHPOS 1769 0.89 2.07 0.36 132 XM_UB999 1732 0.64 2.03 0.00 133 TR_Symld_Words 1720 1.74 2.01 1.61 134 T_FILL_THIS_FORM_SHORT 1705 0.94 2.00 0.46 135 XMSubMetaD_00 1705 0.67 2.00 0.06 136 TR_Mismatch_TLD_02 1705 0.68 2.00 0.08 137 T_TooManySym_01 1688 6.07 1.98 7.94 138 TR_XM_SpammyWords3 1681 0.88 1.97 0.38 139 URI_NOVOWEL 1672 2.26 1.96 2.39 140 FROM_2_EMAILS_SHORT 1648 0.61 1.93 0.00 141 RCVD_IN_MSPIKE_L3 1644 1.02 1.93 0.61 142 MAILING_LIST_MULTI 1643 1.92 1.92 1.92 143 NAME_EMAIL_DIFF 1642 0.67 1.92 0.10 144 XM_B_Phish66 1637 1.76 1.92 1.69 145 HDRS_MISSP 1634 0.60 1.91 0.00 146 FROM_SUSPICIOUS_NTLD 1630 0.65 1.91 0.08 147 RCVD_IN_IADB_LISTED 1628 3.81 1.91 4.68 148 XMObfuSubjects 1624 0.60 1.90 0.01 149 XMSubMetaD_01 1578 0.58 1.85 0.00 150 XMSubject_38 1550 0.57 1.82 0.01 151 PDS_TO_EQ_FROM_NAME 1548 0.57 1.81 0.00 152 HTML_IMAGE_ONLY_08 1547 0.64 1.81 0.10 153 DRUGS_ERECTILE 1525 0.57 1.79 0.01 154 XMDiploma_00 1514 1.21 1.77 0.95 155 DIET_1 1513 0.84 1.77 0.41 156 NO_FM_NAME_IP_HOSTN 1499 0.55 1.76 0.00 157 FROM_SUSPICIOUS_NTLD_FP 1491 0.60 1.75 0.07 158 HTML_SHORT_LINK_IMG_1 1469 0.55 1.72 0.01 159 LONG_JUNK_URI 1461 0.56 1.71 0.03 160 URI_HEX 1446 1.41 1.69 1.28 161 RELAYCOUNTRY_AU 1422 0.69 1.67 0.25 162 TVD_SPACE_RATIO 1414 1.68 1.66 1.69 163 XM_B_Unsub2 1414 1.61 1.66 1.58 164 RCVD_IN_IADB_SPF 1394 3.39 1.63 4.19 165 LongTLD 1377 0.58 1.61 0.11 166 T_XMHurry_00 1371 0.83 1.61 0.47 167 HK_RANDOM_REPLYTO 1313 0.54 1.54 0.08 168 TR_XM_FormFill 1309 0.48 1.53 0.01 169 RCVD_IN_IADB_DK 1302 2.98 1.52 3.65 170 HTML_FONT_TINY_NORDNS 1298 0.52 1.52 0.07 171 RCVD_IN_IADB_SENDERID 1293 3.08 1.51 3.79 172 XMReplyNow 1272 0.64 1.49 0.25 173 TR_XM_SpoofStaff 1263 0.58 1.48 0.17 174 XMSpoofStaff2 1262 0.58 1.48 0.17 175 XMSubMetaD_02 1246 0.46 1.46 0.00 176 XMBdyGiftCard01 1238 1.19 1.45 1.07 177 PDS_FROM_2_EMAILS 1231 0.45 1.44 0.00 178 TR_XM_BayesRelay 1225 0.45 1.43 0.01 179 XMPhish30 1220 0.88 1.43 0.63 180 T_XMDrugObfuBody_09 1194 0.46 1.40 0.03 181 PDS_OTHER_BAD_TLD 1185 0.57 1.39 0.19 182 TooManyTo_002 1172 1.33 1.37 1.31 183 XMSexyCombo_04 1171 0.60 1.37 0.25 184 XM_Body_Dirty_Words_01 1171 0.55 1.37 0.17 185 XMStockSpam_06 1160 1.04 1.36 0.89 186 XMHTMLBadTable_001 1147 0.88 1.34 0.67 187 DRUGS_ERECTILE_OBFU 1132 0.42 1.33 0.00 188 BAYES_40 1108 3.31 1.30 4.23 189 XM_B_REG_HTML 1107 0.78 1.30 0.54 190 XM_H_SpoofStaff4 1104 0.54 1.29 0.19 191 TR_XM_PSC1 1104 0.52 1.29 0.17 192 TR_XM_SB_Phish 1102 1.63 1.29 1.79 193 XMSubPhish11 1091 1.62 1.28 1.78 194 TR_XM_SpoofStaff2 1086 0.40 1.27 0.00 195 RELAYCOUNTRY_FR 1082 0.51 1.27 0.17 196 TooManyTo_003 1080 1.03 1.26 0.92 197 ALL_TRUSTED 1080 11.83 1.26 16.67 198 XM_UB60 1075 0.45 1.26 0.07 199 TO_NO_BRKTS_HTML_ONLY 1054 0.48 1.23 0.13 200 BAYES_20 1050 2.30 1.23 2.79 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155456 86.17 92.53 83.27 2 RELAYCOUNTRY_US 150677 80.72 80.75 80.71 3 DKIM_SIGNED 143987 79.34 84.19 77.12 4 XM_DK_Pass 140903 77.67 82.48 75.47 5 DKIM_VALID 139965 77.13 81.87 74.97 6 XM_B_Unicode 130489 71.57 75.24 69.89 7 DCC_CHECK_NEGATIVE 120464 54.66 33.10 64.52 8 DKIM_VALID_AU 113869 61.06 61.21 60.99 9 XMListUnsubscribeExists 102563 58.09 65.00 54.94 10 BAYES_50 99518 47.99 36.36 53.30 11 XM_B_SpammyWords 83681 50.48 62.84 44.82 12 XM_B_Unicode3 83514 44.86 45.15 44.73 13 DCC_CHECK 66181 45.31 66.87 35.45 14 RCVD_IN_MSPIKE_WL 59297 27.97 19.67 31.76 15 HTML_FONT_LOW_CONTRAST 57304 31.65 33.74 30.69 16 DKIM_VALID_EF 53934 28.50 27.65 28.89 17 LOC_TINY_FONT_1 50972 29.82 35.32 27.30 18 FVGT_m_MULTI_ODD 45434 27.03 32.91 24.34 19 MIME_HTML_ONLY 44222 27.92 37.18 23.69 20 T_TM2_M_HEADER_IN_MSG 41831 21.20 18.55 22.41 21 XMSubLong 41275 22.33 22.81 22.11 22 RCVD_IN_MSPIKE_H2 38555 23.56 29.93 20.65 23 XM_B_SpammyWords2 36707 24.86 36.21 19.66 24 T_KAM_HTML_FONT_INVALID 32216 19.49 24.38 17.26 25 USER_IN_DEF_DKIM_WL 31891 12.73 3.21 17.08 26 ALL_TRUSTED 31114 11.83 1.26 16.67 27 RCVD_IN_MSPIKE_H3 30970 15.57 13.36 16.59 28 RCVD_IN_MSPIKE_H4 25171 11.16 6.07 13.48 29 XM_Multi_Part_URI 24790 13.93 15.36 13.28 30 BAYES_60 23074 10.77 7.29 12.36 31 XM_Body_Dirty_Words 21496 15.81 25.20 11.51 32 XM_DKIMWhitelistDomains 20672 7.62 0.07 11.07 33 XM_B_Unsub 19742 12.34 16.21 10.57 34 XM_Evil_Numbers_Gen 17306 8.81 7.79 9.27 35 XM_DK_Undo_02 17234 20.52 45.22 9.23 36 UNPARSEABLE_RELAY 17052 11.70 17.32 9.13 37 LotsOfNums_01 16648 7.79 5.31 8.92 38 BAYES_00 16551 6.42 1.06 8.87 39 LOTS_OF_MONEY 15995 10.00 13.15 8.57 40 HTML_IMAGE_RATIO_02 15049 8.20 8.49 8.06 41 T_TooManySym_01 14822 6.07 1.98 7.94 42 BAYES_99 14453 17.53 38.93 7.74 43 TR_XM_UnparsRelay 13498 10.28 16.96 7.23 44 RCVD_IN_VALIDITY_SAFE 12791 6.18 4.72 6.85 45 XM_SendGrid 12548 7.68 9.76 6.72 46 HTML_IMAGE_RATIO_04 12257 5.92 4.50 6.57 47 TooManyTo_001 12037 6.19 5.63 6.45 48 TR_XM_DK_Bayes 11940 4.55 0.51 6.40 49 TR_XM_DKIM_Undo 11897 15.81 36.43 6.37 50 TR_XM_DK_Bayes1 11799 4.49 0.50 6.32 51 BAYES_999 11783 14.11 31.17 6.31 52 BOTNET_IPINHOSTNAME 11592 8.15 12.40 6.21 53 MPART_ALT_DIFF 11539 7.15 9.27 6.18 54 RCVD_IN_VALIDITY_CERTIFIED 11209 5.37 3.98 6.00 55 IN_ZIMBRA_NJ_WHITELIST 11003 4.07 0.08 5.89 56 TR_XM_DK_Bayes2 10726 4.05 0.34 5.75 57 XM_H_Long_From01 10192 5.33 5.05 5.46 58 BAYES_80 10023 6.34 8.46 5.37 59 T_TooManySym_02 9506 3.63 0.44 5.09 60 XMNumbers 9464 4.59 3.53 5.07 61 TR_XM_SpammyWords4 9379 7.04 11.45 5.02 62 XMStrtUSub 9329 4.29 2.74 5.00 63 XM_B_SpammyWords3 8932 7.12 12.23 4.78 64 RCVD_IN_IADB_LISTED 8742 3.81 1.91 4.68 65 TR_XM_DK_SendGrid 8670 5.05 5.95 4.64 66 XM_UncommonTLD01 8577 6.44 10.49 4.59 67 FROM_EXCESS_BASE64 8555 3.95 2.58 4.58 68 XMSubMetaSx_00 8377 5.13 6.54 4.49 69 MIME_QP_LONG_LINE 8284 3.73 2.18 4.44 70 BAYES_40 7894 3.31 1.30 4.23 71 RCVD_IN_IADB_SPF 7820 3.39 1.63 4.19 72 MIME_HTML_ONLY_MULTI 7799 5.11 7.14 4.18 73 XM_B_Phish_Phrases 7721 4.35 4.82 4.14 74 RCVD_IN_IADB_SENDERID 7081 3.08 1.51 3.79 75 INVALID_MSGID 7048 2.68 0.29 3.78 76 XMSexyCombo_05 6843 6.51 12.74 3.67 77 RCVD_IN_IADB_DK 6817 2.98 1.52 3.65 78 MSGID_NOFQDN1 6641 2.50 0.19 3.56 79 T_REMOTE_IMAGE 6597 3.97 4.92 3.53 80 BAYES_95 6511 3.89 4.77 3.49 81 RELAYCOUNTRY_META 6504 9.69 23.25 3.48 82 HTML_IMAGE_RATIO_06 6309 3.02 2.22 3.38 83 ANY_BOUNCE_MESSAGE 6132 2.57 1.01 3.28 84 BOUNCE_MESSAGE 6132 2.57 1.01 3.28 85 TO_MALFORMED 6017 2.23 0.06 3.22 86 FSL_BULK_SIG 5989 7.00 15.30 3.21 87 TVD_RCVD_IP 5862 2.34 0.58 3.14 88 TM2_M_URI_OPT_OUT 5398 2.94 3.05 2.89 89 TR_DCC_Bayes_99 5330 9.97 25.53 2.85 90 RCVD_IN_IADB_VOUCHED 5250 2.29 1.14 2.81 91 XM_H_Trusted_IP 5245 1.93 0.00 2.81 92 BAYES_20 5217 2.30 1.23 2.79 93 TR_XM_PhishingBody 5214 3.41 4.75 2.79 94 MIME_HTML_MOSTLY 4968 2.71 2.82 2.66 95 URI_NOVOWEL 4468 2.26 1.96 2.39 96 HTML_IMAGE_RATIO_08 4435 2.37 2.36 2.38 97 TM2_M_VERY_LONG_WORD 4355 4.20 8.27 2.33 98 HTML_MIME_NO_HTML_TAG 4182 3.76 7.09 2.24 99 XM_GoogleGroups 4100 3.12 5.15 2.20 100 DKIM_INVALID 4022 2.21 2.32 2.15 101 XM_PDF 3951 1.56 0.34 2.12 102 IN_HORDE_ADDRESS_BOOK 3903 1.58 0.45 2.09 103 T_XMDrugObfuBody_14 3695 2.51 3.67 1.98 104 XM_B_SpammyTLD 3688 2.46 3.53 1.98 105 MAILING_LIST_MULTI 3589 1.92 1.92 1.92 106 XMBSHREFv2 3579 1.36 0.15 1.92 107 XMLngstWrd_00 3573 2.75 4.57 1.91 108 RCVD_IN_IADB_OPTIN 3547 1.53 0.72 1.90 109 XM_CamelCaseFrm001 3474 2.13 2.73 1.86 110 BAYES_05 3451 1.44 0.56 1.85 111 XMLngstWrd_01 3407 2.66 4.50 1.82 112 BOTNET 3353 5.69 14.20 1.80 113 TR_XM_SB_Phish 3346 1.63 1.29 1.79 114 XMSubPhish11 3328 1.62 1.28 1.78 115 XM_H_Long_From02 3262 1.53 1.04 1.75 116 XM_B_Phish66 3159 1.76 1.92 1.69 117 RCVD_IN_MSPIKE_H5 3156 1.24 0.24 1.69 118 XMLngstWrd_02 3154 2.56 4.45 1.69 119 TVD_SPACE_RATIO 3148 1.68 1.66 1.69 120 TR_XM_SpammyWords5 3067 2.07 3.02 1.64 121 SUBJ_ALL_CAPS 3060 1.88 2.39 1.64 122 TR_XM_SpammyWords2 3027 5.36 13.54 1.62 123 TR_Symld_Words 3012 1.74 2.01 1.61 124 XM_SPF_SoftFail 2997 2.63 4.86 1.61 125 XMGappySubj_01 2962 1.11 0.06 1.59 126 XM_B_Unsub2 2955 1.61 1.66 1.58 127 XMLngstWrd_03 2849 2.35 4.14 1.53 128 UNTRUSTED_Relay 2813 4.44 10.86 1.51 129 TR_XM_SpammyRelay 2778 4.17 10.02 1.49 130 XM_B_Investor 2643 2.07 3.50 1.42 131 XMLngstWrd_04 2635 2.25 4.09 1.41 132 XM_D_tchamptons_WL 2609 0.96 0.00 1.40 133 XM_DK_Undo_01 2535 1.75 2.60 1.36 134 T_XMDrugObfuBody_08 2516 2.18 3.99 1.35 135 RCVD_IN_RP_SAFE 2506 1.25 1.04 1.34 136 TooManyTo_002 2455 1.33 1.37 1.31 137 URI_HEX 2386 1.41 1.69 1.28 138 RCVD_IN_BL_SPAMCOP_NET 2204 4.34 11.25 1.18 139 XMSubNoVowel 2183 1.02 0.68 1.17 140 RCVD_IN_RP_CERTIFIED 2169 1.07 0.86 1.16 141 TM2_M_A_HREF_HREF 2155 1.16 1.19 1.15 142 XMSubMetaI_00 2141 1.03 0.76 1.15 143 T_TooManySym_03 2097 0.80 0.09 1.12 144 KHOP_HELO_FCRDNS 2082 1.60 2.67 1.12 145 HTML_TITLE_SUBJ_DIFF 2030 2.06 4.19 1.09 146 HTML_IMAGE_ONLY_20 2015 0.95 0.65 1.08 147 XMBdyGiftCard01 2000 1.19 1.45 1.07 148 UPPERCASE_75_100 1963 2.00 4.09 1.05 149 HTML_FONT_FACE_BAD 1917 0.95 0.78 1.03 150 XMSexyCombo_01 1907 1.47 2.45 1.02 151 XM_UB50 1841 1.86 3.76 0.99 152 XMDiploma_00 1772 1.21 1.77 0.95 153 TR_MetaPhish_Combo_01 1742 1.00 1.15 0.93 154 TooManyTo_003 1715 1.03 1.26 0.92 155 XM_B_COVIDMETA 1698 0.91 0.90 0.91 156 TR_XM_MaxUnsub 1681 3.16 8.09 0.90 157 XMStockSpam_06 1659 1.04 1.36 0.89 158 XMSubMetaSxObfu_03 1659 0.91 0.94 0.89 159 RCVD_IN_MSPIKE_BL 1634 2.27 5.33 0.88 160 TR_XM_MSPIKECOMBO 1633 2.24 5.24 0.87 161 T_XMDrugObfuBody_00 1617 1.93 4.24 0.87 162 RELAYCOUNTRY_CA 1591 2.44 5.91 0.85 163 XM_B_COPY_HTML 1517 0.77 0.68 0.81 164 DKIM_ADSP_CUSTOM_MED 1422 0.86 1.08 0.76 165 URI_TRY_3LD 1406 0.83 1.01 0.75 166 XM_OfRef6 1380 1.16 2.10 0.74 167 USER_IN_WELCOMELIST 1336 0.49 0.00 0.72 168 USER_IN_WHITELIST 1336 0.49 0.00 0.72 169 MPART_ALT_DIFF_COUNT 1324 0.68 0.61 0.71 170 XMSubMetaSxObfu_02 1294 0.59 0.36 0.69 171 TR_XM_INV_DKIM 1290 0.69 0.68 0.69 172 RDNS_DYNAMIC 1279 0.75 0.90 0.69 173 XMHTMLBadTable_001 1258 0.88 1.34 0.67 174 HTML_TAG_BALANCE_BODY 1254 0.74 0.89 0.67 175 TooManyTo_004 1237 0.82 1.18 0.66 176 XM_H_PHPMailer 1184 0.77 1.07 0.63 177 XMPhish30 1168 0.88 1.43 0.63 178 RCVD_IN_MSPIKE_L3 1143 1.02 1.93 0.61 179 XM_ProductURIs 1128 0.75 1.07 0.60 180 TR_Caps_n_Bayes_99 1099 0.69 0.90 0.59 181 XM_shorewaves_Whitelist 1061 0.39 0.00 0.57 182 XM_B_SpammyWords4 1043 1.18 2.53 0.56 183 RELAYCOUNTRY_GB 1024 1.06 2.17 0.55 184 XM_B_REG_HTML 1009 0.78 1.30 0.54 185 TR_MSPIKEBAYES00 1007 0.37 0.01 0.54 186 TooManyTo_005 983 0.71 1.11 0.53 187 HTTPS_HTTP_MISMATCH 980 0.74 1.22 0.52 188 XM_Walgreens_Forge 967 0.36 0.00 0.52 189 HELO_NODOT 942 0.56 0.67 0.50 190 HELO_NO_DOMAIN 939 0.55 0.66 0.50 191 XMBody_17 928 1.03 2.20 0.50 192 XMBrknScrpt_02 923 0.56 0.71 0.49 193 XM_Ancestry_Forge 921 0.34 0.00 0.49 194 T_TooManySym_04 918 0.35 0.03 0.49 195 T_XMHurry_00 875 0.83 1.61 0.47 196 XMGenDplmaNmb 868 0.54 0.69 0.46 197 T_FILL_THIS_FORM_SHORT 865 0.94 2.00 0.46 198 DKIM_ADSP_NXDOMAIN 861 0.38 0.20 0.46 199 NML_ADSP_CUSTOM_MED 847 0.58 0.85 0.45 200 SpammyFromTLD_01 824 1.38 3.45 0.44 ----------------------------------------------------------------------