Email: 286133 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 1.29 sec Spam: 101372 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.44 sec Ham: 184761 Autolearn: 0 AvgScore: -1.75 AvgScanTime: 1.21 sec Time Spent Running SA: 102.54 hours Time Spent Processing Spam: 40.66 hours Time Spent Processing Ham: 61.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93851 85.63 92.58 81.82 2 DKIM_SIGNED 89662 79.54 88.45 74.65 3 XM_DK_Pass 87502 76.50 86.32 71.12 4 DKIM_VALID 87078 76.02 85.90 70.60 5 RELAYCOUNTRY_US 84379 80.55 83.24 79.08 6 XM_B_Unicode 79608 71.99 78.53 68.40 7 DCC_CHECK 71187 45.73 70.22 32.29 8 DKIM_VALID_AU 70684 62.76 69.73 58.94 9 XMListUnsubscribeExists 67625 56.31 66.71 50.61 10 XM_B_SpammyWords 67482 51.18 66.57 42.74 11 RCVD_IN_MSPIKE_H2 46936 39.88 46.30 36.36 12 XM_DK_Undo_02 46557 21.77 45.93 8.52 13 XM_B_Unicode3 44012 42.86 43.42 42.55 14 BAYES_99 40673 19.16 40.12 7.66 15 LOC_TINY_FONT_1 38034 29.41 37.52 24.96 16 BAYES_50 36945 46.60 36.44 52.17 17 XM_B_SpammyWords2 36872 25.04 36.37 18.82 18 TR_XM_DKIM_Undo 36781 16.42 36.28 5.52 19 MIME_HTML_ONLY 35176 25.57 34.70 20.56 20 HTML_FONT_LOW_CONTRAST 33878 30.96 33.42 29.61 21 FVGT_m_MULTI_ODD 33540 27.73 33.09 24.80 22 BAYES_999 32692 15.46 32.25 6.25 23 DKIM_VALID_EF 30372 28.75 29.96 28.09 24 DCC_CHECK_NEGATIVE 30150 54.24 29.74 67.68 25 TR_DCC_Bayes_99 26651 10.68 26.29 2.12 26 T_KAM_HTML_FONT_INVALID 26282 20.80 25.93 17.99 27 XM_Body_Dirty_Words 24067 16.97 23.74 13.26 28 RELAYCOUNTRY_META 21821 9.74 21.53 3.27 29 T_TM2_M_HEADER_IN_MSG 19235 20.76 18.97 21.74 30 XMSubLong 19095 22.12 18.84 23.92 31 XM_B_Unsub 17585 13.01 17.35 10.64 32 TR_XM_BayesUnsub 17249 11.54 17.02 8.54 33 UNPARSEABLE_RELAY 16967 11.47 16.74 8.58 34 XM_Multi_Part_URI 16792 14.65 16.56 13.59 35 TR_XM_UnparsRelay 16559 10.02 16.33 6.55 36 LOTS_OF_MONEY 15177 10.34 14.97 7.79 37 TR_XM_SpammyWords2 14025 5.73 13.84 1.29 38 RCVD_IN_MSPIKE_WL 13890 14.31 13.70 14.64 39 FSL_BULK_SIG 12551 6.52 12.38 3.31 40 TR_XM_SpammyRelay 12377 5.22 12.21 1.39 41 TR_XM_SpammyWords4 11751 7.07 11.59 4.60 42 BOTNET_IPINHOSTNAME 11511 8.00 11.36 6.15 43 RCVD_IN_MSPIKE_H3 11229 10.27 11.08 9.83 44 XMSexyCombo_05 11180 6.70 11.03 4.33 45 BOTNET 11122 4.83 10.97 1.46 46 XM_B_SpammyWords3 11053 6.18 10.90 3.59 47 MPART_ALT_DIFF 10548 7.00 10.41 5.13 48 RCVD_IN_BL_SPAMCOP_NET 10414 4.57 10.27 1.44 49 XM_UncommonTLD01 9256 6.21 9.13 4.60 50 RELAYCOUNTRY_CA 8893 3.86 8.77 1.16 51 XM_SendGrid 8490 6.76 8.38 5.88 52 BAYES_80 8329 6.24 8.22 5.16 53 MIME_HTML_ONLY_MULTI 8122 4.86 8.01 3.12 54 TM2_M_VERY_LONG_WORD 7994 3.63 7.89 1.29 55 XM_H_Long_From01 7711 5.86 7.61 4.91 56 HTML_IMAGE_RATIO_02 7473 7.14 7.37 7.01 57 UNTRUSTED_Relay 7458 3.29 7.36 1.06 58 XM_Evil_Numbers_Gen 7097 7.86 7.00 8.34 59 XMSubMetaSx_00 7019 5.62 6.92 4.91 60 BAYES_60 6677 9.64 6.59 11.31 61 HTML_MIME_NO_HTML_TAG 6205 2.96 6.12 1.22 62 TR_XM_SPAMCOP 6190 2.49 6.11 0.51 63 XMLngstWrd_00 5796 2.28 5.72 0.39 64 XMLngstWrd_01 5745 2.22 5.67 0.33 65 TR_XM_DK_SendGrid 5737 4.59 5.66 4.00 66 XMLngstWrd_02 5693 2.15 5.62 0.25 67 XM_GoogleGroups 5689 2.86 5.61 1.36 68 LotsOfNums_01 5582 7.65 5.51 8.82 69 BAYES_95 5423 4.49 5.35 4.02 70 XMLngstWrd_03 5303 1.98 5.23 0.20 71 TR_XM_PhishingBody 5272 3.48 5.20 2.54 72 HTML_TITLE_SUBJ_DIFF 5260 1.85 5.19 0.02 73 XMLngstWrd_04 5257 1.93 5.19 0.14 74 UPPERCASE_75_100 5228 1.85 5.16 0.03 75 XM_OfRef6 4998 2.29 4.93 0.85 76 T_XMDrugObfuBody_14 4982 2.91 4.91 1.81 77 T_REMOTE_IMAGE 4951 4.38 4.88 4.10 78 XM_B_Phish_Phrases 4793 3.71 4.73 3.16 79 RCVD_IN_VALIDITY_SAFE 4540 5.25 4.48 5.67 80 HTML_IMAGE_RATIO_04 4489 5.29 4.43 5.76 81 XM_B_Investor 4187 2.16 4.13 1.09 82 XMStrtUSub 4166 5.00 4.11 5.49 83 RCVD_IN_VALIDITY_RPBL 4102 1.47 4.05 0.06 84 XM_SPF_SoftFail 4060 2.37 4.01 1.48 85 TR_XM_SpammyWords5 3864 2.10 3.81 1.16 86 TooManyTo_001 3853 5.87 3.80 7.01 87 XM_DIRTYINTL 3827 1.52 3.78 0.28 88 SUBJ_ALL_CAPS 3800 2.28 3.75 1.47 89 RCVD_IN_VALIDITY_CERTIFIED 3754 4.56 3.70 5.04 90 XM_CamelCaseFrm001 3722 2.77 3.67 2.27 91 USER_IN_DEF_DKIM_WL 3653 12.04 3.60 16.67 92 MIME_HTML_MOSTLY 3551 2.87 3.50 2.52 93 XM_B_SpammyTLD 3491 2.45 3.44 1.91 94 XMDiploma_00 3419 1.96 3.37 1.18 95 RCVD_IN_MSPIKE_BL 3344 1.72 3.30 0.85 96 HTML_IMAGE_RATIO_06 3323 3.18 3.28 3.13 97 T_FILL_THIS_FORM_SHORT 3295 1.46 3.25 0.48 98 SpammyFromTLD_01 3282 1.42 3.24 0.42 99 T_XMDrugObfuBody_08 3275 2.02 3.23 1.36 100 XM_UB50 3240 1.57 3.20 0.68 101 T_TooManySym_01 3175 7.33 3.13 9.63 102 TR_XM_MSPIKECOMBO 3102 1.63 3.06 0.85 103 XM_B_Phish66 3089 1.84 3.05 1.17 104 BOTNET_NORDNS 3015 1.06 2.97 0.01 105 MONEY_NOHTML 2917 1.08 2.88 0.09 106 XMNumbers 2849 5.15 2.81 6.43 107 XMSexyCombo_01 2796 1.92 2.76 1.46 108 XM_H_Undi_Recip 2718 1.06 2.68 0.17 109 TM2_M_URI_OPT_OUT 2687 3.13 2.65 3.40 110 SpammyFromTLD_02 2632 1.07 2.60 0.23 111 RCVD_IN_MSPIKE_H4 2601 3.93 2.57 4.68 112 DKIM_INVALID 2584 3.52 2.55 4.05 113 HTML_IMAGE_RATIO_08 2581 1.88 2.55 1.52 114 XM_B_Unsub2 2561 1.61 2.53 1.11 115 XMBrknScrpt_02 2513 1.29 2.48 0.64 116 TR_XM_Undi_Recip5 2374 0.83 2.34 0.01 117 TR_LOTS_OF_MONEY3 2331 0.95 2.30 0.21 118 XM_B_DynamicLink 2288 0.82 2.26 0.03 119 URI_NOVOWEL 2166 1.92 2.14 1.81 120 KHOP_HELO_FCRDNS 2141 1.44 2.11 1.07 121 TR_Sbj_FN_Bdy 2108 0.82 2.08 0.12 122 TR_Caps_n_Bayes_99 2105 0.98 2.08 0.38 123 UNDISC_MONEY 2062 0.72 2.03 0.01 124 MIME_QP_LONG_LINE 2024 3.84 2.00 4.84 125 TR_XM_PHPDW 1980 0.98 1.95 0.44 126 FROM_EXCESS_BASE64 1971 3.21 1.94 3.90 127 TR_XM_PHPForged 1939 0.88 1.91 0.31 128 TR_XM_SB_Phish 1912 1.83 1.89 1.79 129 TR_XM_FormFill2 1912 0.87 1.89 0.31 130 XM_H_PHPOS 1901 0.85 1.88 0.29 131 TR_Symld_Words 1860 2.21 1.83 2.42 132 XMSubPhish11 1859 1.79 1.83 1.77 133 RELAYCOUNTRY_RU 1853 0.66 1.83 0.02 134 RCVD_IN_PSBL 1843 0.86 1.82 0.33 135 TR_XM_Undi_RecipCombo2 1829 0.64 1.80 0.00 136 XM_UB99 1828 0.64 1.80 0.00 137 XMBody_17 1826 1.09 1.80 0.70 138 T_XMDrugObfuBody_00 1825 1.17 1.80 0.83 139 XMHTML_After_End 1823 0.95 1.80 0.48 140 XM_DK_Undo_01 1800 1.51 1.78 1.36 141 XMStockSpam_06 1759 1.58 1.74 1.50 142 HTML_IMAGE_ONLY_20 1758 1.11 1.73 0.77 143 TR_XM_NoHeaderRelay 1725 0.68 1.70 0.11 144 XM_B_SpammyWords4 1719 0.89 1.70 0.45 145 FILL_THIS_FORM 1716 0.79 1.69 0.30 146 HTML_TAG_BALANCE_BODY 1707 1.06 1.68 0.71 147 TR_XM_MSPIKECOMBO2 1706 0.71 1.68 0.18 148 LOADSA_MONEY_COMBO 1683 0.61 1.66 0.03 149 PDS_OTHER_BAD_TLD 1679 0.79 1.66 0.31 150 MONEY_FORM 1662 0.59 1.64 0.01 151 XMBdyGiftCard01 1643 1.31 1.62 1.14 152 FILL_THIS_FORM_LONG 1637 0.63 1.61 0.08 153 TR_XM_FormFill 1636 0.58 1.61 0.01 154 HTTPS_HTTP_MISMATCH 1607 0.87 1.59 0.47 155 XFER_LOTSA_MONEY 1583 0.56 1.56 0.01 156 URIBL_DBL_SPAM 1583 0.56 1.56 0.01 157 HTML_SHORT_LINK_IMG_3 1526 0.55 1.51 0.03 158 FORM_FRAUD_5 1487 0.52 1.47 0.00 159 T_XMHurry_00 1483 0.86 1.46 0.53 160 RCVD_IN_MSPIKE_L5 1480 0.52 1.46 0.01 161 ALL_TRUSTED 1473 12.40 1.45 18.41 162 TR_XM_SpammyWords3 1471 0.67 1.45 0.24 163 XM_UB999 1440 0.51 1.42 0.00 164 RCVD_IN_IADB_LISTED 1426 3.05 1.41 3.96 165 XMDateMe_00 1423 0.65 1.40 0.24 166 XMSexyCombo_04 1410 1.08 1.39 0.91 167 XM_H_Long_From02 1392 1.16 1.37 1.05 168 MPART_ALT_DIFF_COUNT 1389 0.97 1.37 0.76 169 TR_Mismatch_TLD_02 1383 0.53 1.36 0.07 170 RCVD_IN_MSPIKE_L3 1373 1.00 1.35 0.81 171 TR_XM_Undi_Recip6 1368 0.48 1.35 0.00 172 XM_URI_RBL 1341 0.59 1.32 0.18 173 RELAYCOUNTRY_AU 1332 0.58 1.31 0.18 174 DIET_1 1305 0.64 1.29 0.28 175 TR_XM_Undi_Recip9 1302 0.46 1.28 0.00 176 PLING_QUERY 1293 0.79 1.28 0.53 177 FILL_THIS_FORM_LOAN 1265 0.51 1.25 0.10 178 XM_ProductURIs 1261 0.89 1.24 0.70 179 XMSubNoVowel 1255 1.36 1.24 1.42 180 MONEY_FRAUD_5 1251 0.44 1.23 0.00 181 XMSubMetaI_00 1250 1.08 1.23 1.00 182 HK_RANDOM_REPLYTO 1241 0.49 1.22 0.09 183 TR_Mismatch_TLD_01 1233 0.69 1.22 0.41 184 XM_LoanWordsFrm 1223 0.44 1.21 0.02 185 BAYES_40 1218 3.24 1.20 4.35 186 XMClaimOffer 1209 0.49 1.19 0.10 187 RCVD_IN_IADB_SPF 1203 2.73 1.19 3.57 188 TR_XM_Undi_Recip11 1189 0.43 1.17 0.02 189 MAILING_LIST_MULTI 1167 1.93 1.15 2.36 190 MIME_BASE64_TEXT 1162 0.50 1.15 0.14 191 XMGenDplmaNmb 1156 0.83 1.14 0.66 192 XMReplyNow 1140 0.57 1.12 0.27 193 TR_MetaPhish_Combo_01 1139 1.01 1.12 0.95 194 FROM_SUSPICIOUS_NTLD 1137 0.45 1.12 0.08 195 RELAYCOUNTRY_FR 1119 0.51 1.10 0.18 196 URI_HEX 1106 0.94 1.09 0.86 197 ADVANCE_FEE_4_NEW_FRM_MNY 1098 0.38 1.08 0.00 198 HTML_FONT_TINY_NORDNS 1098 0.43 1.08 0.07 199 RCVD_IN_IADB_DK 1096 2.43 1.08 3.17 200 RCVD_IN_IADB_SENDERID 1087 2.48 1.07 3.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151171 85.63 92.58 81.82 2 RELAYCOUNTRY_US 146100 80.55 83.24 79.08 3 DKIM_SIGNED 137931 79.54 88.45 74.65 4 XM_DK_Pass 131396 76.50 86.32 71.12 5 DKIM_VALID 130448 76.02 85.90 70.60 6 XM_B_Unicode 126370 71.99 78.53 68.40 7 DCC_CHECK_NEGATIVE 125038 54.24 29.74 67.68 8 DKIM_VALID_AU 108906 62.76 69.73 58.94 9 BAYES_50 96388 46.60 36.44 52.17 10 XMListUnsubscribeExists 93510 56.31 66.71 50.61 11 XM_B_SpammyWords 78966 51.18 66.57 42.74 12 XM_B_Unicode3 78624 42.86 43.42 42.55 13 RCVD_IN_MSPIKE_H2 67179 39.88 46.30 36.36 14 DCC_CHECK 59651 45.73 70.22 32.29 15 HTML_FONT_LOW_CONTRAST 54705 30.96 33.42 29.61 16 DKIM_VALID_EF 51893 28.75 29.96 28.09 17 LOC_TINY_FONT_1 46108 29.41 37.52 24.96 18 FVGT_m_MULTI_ODD 45816 27.73 33.09 24.80 19 XMSubLong 44186 22.12 18.84 23.92 20 T_TM2_M_HEADER_IN_MSG 40163 20.76 18.97 21.74 21 MIME_HTML_ONLY 37983 25.57 34.70 20.56 22 XM_B_SpammyWords2 34769 25.04 36.37 18.82 23 ALL_TRUSTED 34016 12.40 1.45 18.41 24 T_KAM_HTML_FONT_INVALID 33232 20.80 25.93 17.99 25 USER_IN_DEF_DKIM_WL 30795 12.04 3.60 16.67 26 RCVD_IN_MSPIKE_WL 27051 14.31 13.70 14.64 27 XM_Multi_Part_URI 25116 14.65 16.56 13.59 28 XM_Body_Dirty_Words 24496 16.97 23.74 13.26 29 XM_DKIMWhitelistDomains 20941 7.46 0.41 11.33 30 BAYES_60 20905 9.64 6.59 11.31 31 XM_B_Unsub 19653 13.01 17.35 10.64 32 BAYES_00 18556 6.68 0.54 10.04 33 RCVD_IN_MSPIKE_H3 18156 10.27 11.08 9.83 34 T_TooManySym_01 17792 7.33 3.13 9.63 35 LotsOfNums_01 16295 7.65 5.51 8.82 36 UNPARSEABLE_RELAY 15856 11.47 16.74 8.58 37 TR_XM_BayesUnsub 15785 11.54 17.02 8.54 38 XM_DK_Undo_02 15733 21.77 45.93 8.52 39 XM_Evil_Numbers_Gen 15407 7.86 7.00 8.34 40 LOTS_OF_MONEY 14397 10.34 14.97 7.79 41 BAYES_99 14152 19.16 40.12 7.66 42 TR_XM_DK_Bayes 13166 4.76 0.46 7.13 43 TR_XM_DK_Bayes1 12978 4.70 0.46 7.02 44 HTML_IMAGE_RATIO_02 12957 7.14 7.37 7.01 45 TooManyTo_001 12952 5.87 3.80 7.01 46 T_TooManySym_02 12568 4.70 0.86 6.80 47 TR_XM_UnparsRelay 12099 10.02 16.33 6.55 48 TR_XM_DK_Bayes2 11926 4.30 0.37 6.45 49 XMNumbers 11887 5.15 2.81 6.43 50 BAYES_999 11551 15.46 32.25 6.25 51 BOTNET_IPINHOSTNAME 11367 8.00 11.36 6.15 52 IN_ZIMBRA_NJ_WHITELIST 10872 3.82 0.07 5.88 53 XM_SendGrid 10863 6.76 8.38 5.88 54 HTML_IMAGE_RATIO_04 10635 5.29 4.43 5.76 55 RCVD_IN_VALIDITY_SAFE 10471 5.25 4.48 5.67 56 TR_XM_DKIM_Undo 10206 16.42 36.28 5.52 57 XMStrtUSub 10143 5.00 4.11 5.49 58 BAYES_80 9529 6.24 8.22 5.16 59 MPART_ALT_DIFF 9478 7.00 10.41 5.13 60 RCVD_IN_VALIDITY_CERTIFIED 9306 4.56 3.70 5.04 61 XMSubMetaSx_00 9073 5.62 6.92 4.91 62 XM_H_Long_From01 9067 5.86 7.61 4.91 63 MIME_QP_LONG_LINE 8950 3.84 2.00 4.84 64 RCVD_IN_MSPIKE_H4 8648 3.93 2.57 4.68 65 XM_UncommonTLD01 8501 6.21 9.13 4.60 66 TR_XM_SpammyWords4 8490 7.07 11.59 4.60 67 BAYES_40 8042 3.24 1.20 4.35 68 XMSexyCombo_05 7995 6.70 11.03 4.33 69 T_REMOTE_IMAGE 7583 4.38 4.88 4.10 70 INVALID_MSGID 7483 2.67 0.17 4.05 71 DKIM_INVALID 7483 3.52 2.55 4.05 72 BAYES_95 7432 4.49 5.35 4.02 73 TR_XM_DK_SendGrid 7395 4.59 5.66 4.00 74 RCVD_IN_IADB_LISTED 7309 3.05 1.41 3.96 75 FROM_EXCESS_BASE64 7200 3.21 1.94 3.90 76 XM_B_SpammyWords3 6629 6.18 10.90 3.59 77 RCVD_IN_IADB_SPF 6605 2.73 1.19 3.57 78 XM_H_Trusted_IP 6441 2.25 0.00 3.49 79 TM2_M_URI_OPT_OUT 6278 3.13 2.65 3.40 80 FSL_BULK_SIG 6109 6.52 12.38 3.31 81 RELAYCOUNTRY_META 6046 9.74 21.53 3.27 82 RCVD_IN_IADB_SENDERID 5995 2.48 1.07 3.24 83 RCVD_IN_IADB_DK 5860 2.43 1.08 3.17 84 XM_B_Phish_Phrases 5831 3.71 4.73 3.16 85 HTML_IMAGE_RATIO_06 5781 3.18 3.28 3.13 86 TO_MALFORMED 5772 2.06 0.13 3.12 87 MIME_HTML_ONLY_MULTI 5771 4.86 8.01 3.12 88 TVD_RCVD_IP 5697 2.22 0.66 3.08 89 BAYES_20 5689 2.33 0.98 3.08 90 ANY_BOUNCE_MESSAGE 5345 2.06 0.55 2.89 91 BOUNCE_MESSAGE 5341 2.06 0.54 2.89 92 T_TooManySym_03 4862 1.81 0.31 2.63 93 RCVD_IN_IADB_VOUCHED 4793 1.98 0.85 2.59 94 TR_XM_PhishingBody 4687 3.48 5.20 2.54 95 MIME_HTML_MOSTLY 4663 2.87 3.50 2.52 96 TR_Symld_Words 4474 2.21 1.83 2.42 97 MAILING_LIST_MULTI 4352 1.93 1.15 2.36 98 XM_PDF 4253 1.70 0.60 2.30 99 XM_CamelCaseFrm001 4194 2.77 3.67 2.27 100 BAYES_05 4066 1.61 0.54 2.20 101 IN_HORDE_ADDRESS_BOOK 4005 1.43 0.08 2.17 102 TR_DCC_Bayes_99 3909 10.68 26.29 2.12 103 XMBSHREFv2 3712 1.36 0.17 2.01 104 XM_B_SpammyTLD 3522 2.45 3.44 1.91 105 URI_NOVOWEL 3342 1.92 2.14 1.81 106 T_XMDrugObfuBody_14 3337 2.91 4.91 1.81 107 TR_XM_SB_Phish 3311 1.83 1.89 1.79 108 RCVD_IN_IADB_OPTIN 3298 1.33 0.51 1.79 109 XMSubPhish11 3267 1.79 1.83 1.77 110 XMGappySubj_01 3198 1.17 0.16 1.73 111 TVD_SPACE_RATIO 3055 1.10 0.08 1.65 112 XM_B_SEO 3046 1.20 0.39 1.65 113 FVGT_m_MULTI_ODD_EMAIL 2915 1.05 0.10 1.58 114 HTML_IMAGE_RATIO_08 2800 1.88 2.55 1.52 115 XMStockSpam_06 2775 1.58 1.74 1.50 116 XM_SPF_SoftFail 2731 2.37 4.01 1.48 117 SUBJ_ALL_CAPS 2714 2.28 3.75 1.47 118 XMSexyCombo_01 2704 1.92 2.76 1.46 119 BOTNET 2700 4.83 10.97 1.46 120 RCVD_IN_BL_SPAMCOP_NET 2663 4.57 10.27 1.44 121 XMSubNoVowel 2631 1.36 1.24 1.42 122 TooManyTo_002 2585 1.04 0.39 1.40 123 TR_XM_SpammyRelay 2564 5.22 12.21 1.39 124 HTML_FONT_FACE_BAD 2558 1.27 1.06 1.38 125 XM_DK_Undo_01 2517 1.51 1.78 1.36 126 T_XMDrugObfuBody_08 2508 2.02 3.23 1.36 127 XM_GoogleGroups 2508 2.86 5.61 1.36 128 MSGID_NOFQDN1 2451 0.86 0.01 1.33 129 TR_XM_SpammyWords2 2382 5.73 13.84 1.29 130 TM2_M_VERY_LONG_WORD 2380 3.63 7.89 1.29 131 HTML_MIME_NO_HTML_TAG 2256 2.96 6.12 1.22 132 XMSubMetaSxObfu_03 2187 0.95 0.53 1.18 133 XMDiploma_00 2177 1.96 3.37 1.18 134 XM_B_Phish66 2168 1.84 3.05 1.17 135 TR_XM_SpammyWords5 2152 2.10 3.81 1.16 136 RELAYCOUNTRY_CA 2139 3.86 8.77 1.16 137 RCVD_IN_RP_SAFE 2130 1.06 0.89 1.15 138 XMBdyGiftCard01 2108 1.31 1.62 1.14 139 XMBody_95 2089 0.78 0.15 1.13 140 XM_B_Unsub2 2042 1.61 2.53 1.11 141 XM_B_Investor 2005 2.16 4.13 1.09 142 XM_RXBody 1999 0.98 0.79 1.08 143 KHOP_HELO_FCRDNS 1980 1.44 2.11 1.07 144 XM_D_tchamptons_WL 1955 0.69 0.01 1.06 145 UNTRUSTED_Relay 1954 3.29 7.36 1.06 146 XM_H_Long_From02 1936 1.16 1.37 1.05 147 RCVD_IN_RP_CERTIFIED 1898 0.91 0.70 1.03 148 TooManyTo_003 1880 0.77 0.32 1.02 149 XMSubMetaI_00 1851 1.08 1.23 1.00 150 TR_MetaPhish_Combo_01 1754 1.01 1.12 0.95 151 DKIM_ADSP_CUSTOM_MED 1730 0.98 1.06 0.94 152 TM2_M_A_HREF_HREF 1706 0.87 0.78 0.92 153 XMSubMetaSx_01 1703 0.82 0.62 0.92 154 XMSexyCombo_04 1679 1.08 1.39 0.91 155 XMSexyCombo_02 1621 0.80 0.66 0.88 156 URI_HEX 1587 0.94 1.09 0.86 157 RCVD_IN_MSPIKE_BL 1566 1.72 3.30 0.85 158 XM_OfRef6 1565 2.29 4.93 0.85 159 TR_XM_MSPIKECOMBO 1562 1.63 3.06 0.85 160 T_XMDrugObfuBody_00 1532 1.17 1.80 0.83 161 RCVD_IN_MSPIKE_L3 1489 1.00 1.35 0.81 162 XMHTMLBadTable_001 1481 0.88 1.02 0.80 163 TR_XM_INV_DKIM 1430 0.71 0.61 0.77 164 HTML_IMAGE_ONLY_20 1426 1.11 1.73 0.77 165 XM_B_COPY_HTML 1424 0.78 0.81 0.77 166 TooManyTo_004 1419 0.60 0.30 0.77 167 USER_IN_WELCOMELIST 1411 0.49 0.00 0.76 168 USER_IN_WHITELIST 1411 0.49 0.00 0.76 169 MPART_ALT_DIFF_COUNT 1395 0.97 1.37 0.76 170 XMPhish30 1354 0.77 0.83 0.73 171 HTML_TAG_BALANCE_BODY 1317 1.06 1.68 0.71 172 XMBody_17 1290 1.09 1.80 0.70 173 TVD_SPACE_RATIO_MINFP 1290 0.57 0.32 0.70 174 XM_ProductURIs 1289 0.89 1.24 0.70 175 XM_UB50 1262 1.57 3.20 0.68 176 XMGenDplmaNmb 1228 0.83 1.14 0.66 177 XM_H_PHPMailer 1190 0.75 0.95 0.64 178 XMBrknScrpt_02 1183 1.29 2.48 0.64 179 TooManyTo_005 1178 0.49 0.23 0.64 180 RDNS_DYNAMIC 1125 0.72 0.92 0.61 181 URI_TRY_3LD 1124 0.77 1.07 0.61 182 SHORT_URI_3 1112 0.48 0.25 0.60 183 XM_USANA_RCVD 1078 0.38 0.00 0.58 184 XM_S_SubURI 1070 0.38 0.02 0.58 185 DATE_IN_PAST_03_06 1064 0.51 0.39 0.58 186 XMSubMetaSxObfu_02 1019 0.47 0.33 0.55 187 NML_ADSP_CUSTOM_MED 1012 0.70 0.98 0.55 188 FORGED_GMAIL_RCVD 984 0.68 0.94 0.53 189 T_XMHurry_00 982 0.86 1.46 0.53 190 PLING_QUERY 974 0.79 1.28 0.53 191 XM_B_COVIDMETA 964 0.68 0.97 0.52 192 TR_XM_SPAMCOP 940 2.49 6.11 0.51 193 SUBJ_DOLLARS 926 0.57 0.71 0.50 194 T_Symld_Words_02 921 0.54 0.61 0.50 195 T_FILL_THIS_FORM_SHORT 887 1.46 3.25 0.48 196 RCVD_IN_IADB_OPTIN_GT50 885 0.33 0.06 0.48 197 HELO_NODOT 885 0.51 0.56 0.48 198 HELO_NO_DOMAIN 883 0.49 0.52 0.48 199 XMHTML_After_End 881 0.95 1.80 0.48 200 RELAYCOUNTRY_GB 878 0.52 0.60 0.48 ----------------------------------------------------------------------