Email: 542325 Autolearn: 0 AvgScore: 4.49 AvgScanTime: 1.21 sec Spam: 200910 Autolearn: 0 AvgScore: 14.24 AvgScanTime: 1.30 sec Ham: 341415 Autolearn: 0 AvgScore: -1.24 AvgScanTime: 1.16 sec Time Spent Running SA: 182.33 hours Time Spent Processing Spam: 72.76 hours Time Spent Processing Ham: 109.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 193323 90.48 96.22 87.09 2 XM_B_Unicode 177281 77.23 88.24 70.76 3 DKIM_SIGNED 158670 76.96 78.98 75.77 4 XM_DK_Pass 154607 75.04 76.95 73.92 5 DKIM_VALID 153746 74.27 76.52 72.94 6 XM_B_SpammyWords 150013 55.59 74.67 44.36 7 RELAYCOUNTRY_US 145380 78.48 72.36 82.09 8 DCC_CHECK 129297 43.12 64.36 30.62 9 XMListUnsubscribeExists 123723 54.58 61.58 50.46 10 DKIM_VALID_AU 114092 57.07 56.79 57.24 11 XM_B_Unicode3 104434 45.21 51.98 41.23 12 RCVD_IN_MSPIKE_H2 85564 40.66 42.59 39.52 13 XM_DK_Undo_02 84212 19.78 41.92 6.76 14 BAYES_99 78318 18.09 38.98 5.79 15 MIME_HTML_ONLY 75350 26.20 37.50 19.55 16 DCC_CHECK_NEGATIVE 71549 56.84 35.61 69.33 17 XM_B_SpammyWords2 70776 24.72 35.23 18.54 18 BAYES_50 70763 49.21 35.22 57.45 19 LOC_TINY_FONT_1 66669 27.13 33.18 23.57 20 TR_XM_DKIM_Undo 65328 15.04 32.52 4.75 21 FVGT_m_MULTI_ODD 63211 27.84 31.46 25.70 22 HTML_FONT_LOW_CONTRAST 62326 28.83 31.02 27.54 23 XM_Multi_Part_URI 58948 18.54 29.34 12.18 24 DKIM_VALID_EF 58946 28.99 29.34 28.79 25 BAYES_999 58148 13.70 28.94 4.73 26 T_KAM_HTML_FONT_INVALID 55533 22.99 27.64 20.25 27 TR_DCC_Bayes_99 49187 9.97 24.48 1.44 28 XMSubLong 40735 20.91 20.28 21.29 29 T_TM2_M_HEADER_IN_MSG 40580 26.73 20.20 30.57 30 XM_Body_Dirty_Words 36754 14.26 18.29 11.89 31 XM_B_Phish_Phrases 36553 9.34 18.19 4.13 32 XM_SPF_SoftFail 34152 8.01 17.00 2.73 33 RELAYCOUNTRY_META 30369 7.91 15.12 3.67 34 LOTS_OF_MONEY 29117 10.53 14.49 8.20 35 FSL_BULK_SIG 28877 7.08 14.37 2.78 36 URI_HEX 27820 5.84 13.85 1.13 37 XM_B_Unsub 27505 10.61 13.69 8.80 38 ALL_TRUSTED 27501 14.50 13.69 14.97 39 TR_XM_BayesUnsub 26839 9.23 13.36 6.79 40 BOTNET_IPINHOSTNAME 26379 8.11 13.13 5.16 41 DKIM_ADSP_DISCARD 25606 4.74 12.75 0.03 42 ZMIvirSobY_SUB63 25365 4.69 12.63 0.02 43 RCVD_IN_MSPIKE_WL 25323 15.87 12.60 17.78 44 RCVD_IN_BL_SPAMCOP_NET 24599 4.94 12.24 0.65 45 XM_B_SpammyWords3 23359 7.25 11.63 4.67 46 TR_XM_SpammyWords4 22702 7.47 11.30 5.22 47 TR_XM_SpammyRelay 22128 5.11 11.01 1.64 48 UNPARSEABLE_RELAY 21784 9.02 10.84 7.95 49 TR_XM_SpammyWords2 21713 4.57 10.81 0.89 50 TR_XM_UnparsRelay 21341 7.83 10.62 6.19 51 BOTNET 19678 4.62 9.79 1.57 52 RCVD_IN_MSPIKE_H3 17774 10.36 8.85 11.25 53 BAYES_80 17077 5.95 8.50 4.46 54 XM_Evil_Numbers_Gen 16274 8.17 8.10 8.21 55 TR_XM_SPAMCOP 15176 2.99 7.55 0.31 56 XMSexyCombo_05 14780 4.71 7.36 3.15 57 BAYES_60 14137 8.37 7.04 9.16 58 RELAYCOUNTRY_CA 13678 3.16 6.81 1.02 59 UNTRUSTED_Relay 13112 3.30 6.53 1.41 60 BAYES_95 12678 4.14 6.31 2.86 61 XM_SendGrid 12644 5.55 6.29 5.11 62 LotsOfNums_01 12241 8.07 6.09 9.24 63 TR_XM_PhishingBody 11561 4.05 5.75 3.04 64 XM_UncommonTLD01 11354 4.40 5.65 3.66 65 HTML_IMAGE_RATIO_02 11102 5.42 5.53 5.36 66 XM_B_SpammyTLD 10923 3.52 5.44 2.40 67 XMSubMetaSx_00 10688 4.18 5.32 3.51 68 XMStrtUSub 10592 4.95 5.27 4.77 69 XM_H_Long_From01 9914 5.03 4.93 5.08 70 HTML_IMAGE_RATIO_04 9601 4.63 4.78 4.54 71 XM_B_Investor 9473 3.14 4.72 2.21 72 MPART_ALT_DIFF 9119 4.71 4.54 4.81 73 XMBody_17 8213 1.90 4.09 0.61 74 HTML_IMAGE_RATIO_06 8157 3.85 4.06 3.72 75 TR_XM_DK_SendGrid 8141 3.48 4.05 3.15 76 TooManyTo_001 8041 6.69 4.00 8.27 77 RCVD_IN_MSPIKE_BL 7422 1.99 3.69 0.99 78 MIME_QP_LONG_LINE 7413 5.11 3.69 5.95 79 T_XMDrugObfuBody_14 7367 2.34 3.67 1.56 80 XM_OfRef6 7280 2.41 3.62 1.70 81 TR_XM_MSPIKECOMBO 7211 1.94 3.59 0.97 82 T_XMDrugObfuBody_08 6931 2.23 3.45 1.51 83 TR_XM_SpammyWords5 6596 2.16 3.28 1.49 84 XM_B_Phish66 6510 2.38 3.24 1.87 85 TM2_M_VERY_LONG_WORD 6434 2.05 3.20 1.37 86 XM_UB50 6326 1.72 3.15 0.88 87 RCVD_IN_MSPIKE_H4 6173 4.55 3.07 5.42 88 T_FILL_THIS_FORM_SHORT 6138 1.69 3.06 0.89 89 TM2_M_URI_OPT_OUT 6025 2.80 3.00 2.69 90 XMNumbers 5929 3.22 2.95 3.37 91 XMDiploma_00 5875 2.00 2.92 1.45 92 MIME_HTML_MOSTLY 5855 2.65 2.91 2.50 93 PDS_OTHER_BAD_TLD 5854 1.21 2.91 0.21 94 HTML_IMAGE_RATIO_08 5544 2.41 2.76 2.21 95 URIBL_DBL_SPAM 5510 1.03 2.74 0.02 96 RCVD_IN_VALIDITY_SAFE 5501 4.07 2.74 4.86 97 XM_DIRTYINTL 5461 1.24 2.72 0.36 98 XMBrknScrpt_02 5073 1.62 2.53 1.08 99 DKIM_INVALID 4924 2.69 2.45 2.83 100 RCVD_IN_IADB_LISTED 4910 4.41 2.44 5.57 101 URIBL_DBL_ABUSE_SPAM 4898 0.91 2.44 0.01 102 MIME_HTML_ONLY_MULTI 4886 2.81 2.43 3.03 103 TR_LOTS_OF_MONEY3 4828 1.25 2.40 0.57 104 XM_CamelCaseFrm001 4768 2.33 2.37 2.30 105 URI_PHP_REDIR 4742 0.88 2.36 0.00 106 XM_B_Unsub2 4738 1.96 2.36 1.72 107 T_REMOTE_IMAGE 4704 3.26 2.34 3.80 108 T_XMHurry_00 4591 1.33 2.29 0.76 109 RCVD_IN_MSPIKE_L3 4519 1.40 2.25 0.90 110 XM_B_SpammyWords4 4389 1.26 2.18 0.72 111 T_TooManySym_01 4372 4.41 2.18 5.72 112 RCVD_IN_VALIDITY_RPBL 4370 0.83 2.18 0.04 113 XM_URI_RBL 4327 0.87 2.15 0.12 114 TR_XM_SB_Phish 4315 2.31 2.15 2.40 115 MAILING_LIST_MULTI 4303 2.99 2.14 3.49 116 BOTNET_NORDNS 4274 0.80 2.13 0.01 117 USER_IN_DEF_DKIM_WL 4273 8.58 2.13 12.37 118 FROM_EXCESS_BASE64 4235 2.25 2.11 2.34 119 RCVD_IN_IADB_SPF 4183 3.90 2.08 4.98 120 XMSubPhish11 4148 2.26 2.06 2.38 121 URI_NOVOWEL 4123 2.44 2.05 2.67 122 RCVD_IN_VALIDITY_CERTIFIED 4043 3.46 2.01 4.31 123 URI_TRY_3LD 4038 1.25 2.01 0.81 124 SpammyFromTLD_01 3979 1.22 1.98 0.77 125 RCVD_IN_IADB_DK 3905 3.47 1.94 4.36 126 RCVD_IN_IADB_SENDERID 3887 3.54 1.93 4.49 127 TR_XM_BayesRelay 3825 0.71 1.90 0.00 128 TR_XM_SpammyWords3 3779 1.01 1.88 0.49 129 XMClaimOffer 3754 0.78 1.87 0.14 130 TR_XM_MSPIKECOMBO2 3636 0.73 1.81 0.10 131 SpammyFromTLD_02 3501 0.91 1.74 0.42 132 XM_B_COVIDMETA 3468 0.98 1.73 0.53 133 XMSexyCombo_01 3411 1.05 1.70 0.66 134 T_XMDrugObfuBody_00 3260 1.16 1.62 0.88 135 XM_H_Undi_Recip 3255 0.78 1.62 0.29 136 XMGenDplmaNmb 3245 1.17 1.62 0.91 137 REMOVE_BEFORE_LINK 3200 0.84 1.59 0.39 138 XM_DK_Undo_01 3164 1.57 1.57 1.57 139 XM_H_Long_From02 3127 1.39 1.56 1.29 140 SUBJ_ALL_CAPS 3096 1.69 1.54 1.77 141 TR_XM_NoHeaderRelay 3075 0.64 1.53 0.11 142 HTTPS_HTTP_MISMATCH 3047 1.22 1.52 1.05 143 XMHTML_After_End 3044 1.03 1.52 0.74 144 XMStockSpam_06 2998 1.34 1.49 1.26 145 TR_XM_MaxSPIKE 2904 0.60 1.45 0.09 146 TM2_M_A_HREF_HREF 2859 0.98 1.42 0.71 147 HTML_TAG_BALANCE_BODY 2832 0.96 1.41 0.70 148 T_Symld_Words_02 2821 0.91 1.40 0.62 149 BAYES_40 2807 3.45 1.40 4.66 150 FONT_INVIS_LONG_LINE 2797 0.62 1.39 0.16 151 RCVD_IN_PSBL 2758 0.85 1.37 0.54 152 HTML_MIME_NO_HTML_TAG 2721 1.72 1.35 1.94 153 XM_UB99 2698 0.50 1.34 0.00 154 RCVD_IN_IADB_VOUCHED 2639 2.51 1.31 3.21 155 TR_XM_Undi_Recip5 2631 0.49 1.31 0.01 156 XMReplyNow 2609 0.67 1.30 0.31 157 TR_XM_FormFill 2605 0.49 1.30 0.02 158 KHOP_HELO_FCRDNS 2566 1.61 1.28 1.81 159 XMBdyGiftCard01 2555 0.94 1.27 0.74 160 URIBL_BLACK 2502 0.50 1.25 0.06 161 TR_XM_Base64_M1 2394 0.95 1.19 0.82 162 HK_RANDOM_REPLYTO 2342 0.49 1.17 0.09 163 TR_Symld_Words 2307 1.68 1.15 2.00 164 UNDISC_MONEY 2304 0.44 1.15 0.03 165 XM_HighProb1 2303 0.43 1.15 0.00 166 HK_SCAM 2302 0.43 1.15 0.01 167 TR_Mismatch_TLD_01 2287 0.63 1.14 0.34 168 RCVD_IN_MSPIKE_L5 2278 0.43 1.13 0.02 169 TR_XM_PHPDW 2263 0.61 1.13 0.30 170 MONEY_NOHTML 2176 0.45 1.08 0.08 171 LOADSA_MONEY_COMBO 2131 0.46 1.06 0.10 172 TR_MetaPhish_Combo_01 2130 0.89 1.06 0.80 173 TR_XM_PHPForged 2120 0.55 1.06 0.24 174 XMPhish30 2091 0.72 1.04 0.53 175 TR_XM_FormFill2 2090 0.54 1.04 0.24 176 XM_H_PHPOS 2079 0.53 1.03 0.24 177 MPART_ALT_DIFF_COUNT 2075 0.76 1.03 0.60 178 BAYES_20 2073 2.55 1.03 3.45 179 TR_XM_COVIDMETA1 2019 0.49 1.00 0.19 180 RELAYCOUNTRY_FR 1981 0.53 0.99 0.26 181 XM_UB999 1962 0.36 0.98 0.00 182 TR_XM_COVIDMETA4 1942 0.50 0.97 0.23 183 SUBJ_DOLLARS 1940 0.61 0.97 0.39 184 TR_Mismatch_TLD_02 1921 0.42 0.96 0.10 185 BAYES_00 1908 6.63 0.95 9.97 186 DKIM_ADSP_CUSTOM_MED 1859 0.99 0.93 1.02 187 XM_B_DNDMA 1855 0.64 0.92 0.47 188 RELAYCOUNTRY_AU 1819 0.55 0.91 0.34 189 XFER_LOTSA_MONEY 1818 0.34 0.90 0.02 190 XMBody_78 1799 0.60 0.90 0.42 191 XM_Body_Dirty_Words_01 1786 0.72 0.89 0.62 192 TR_XM_Base64_L1 1770 0.55 0.88 0.36 193 RELAYCOUNTRY_IN 1704 0.36 0.85 0.07 194 XMMoneyMeta_00 1685 0.62 0.84 0.50 195 XMSubNoVowel 1670 0.75 0.83 0.70 196 XM_B_SEO 1670 0.40 0.83 0.15 197 DIET_1 1663 0.49 0.83 0.29 198 XM_PDF 1655 3.87 0.82 5.66 199 XMLngstWrd_00 1643 0.69 0.82 0.62 200 XM_ProductURIs 1642 0.65 0.82 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297349 90.48 96.22 87.09 2 RELAYCOUNTRY_US 280252 78.48 72.36 82.09 3 DKIM_SIGNED 258697 76.96 78.98 75.77 4 XM_DK_Pass 252361 75.04 76.95 73.92 5 DKIM_VALID 249019 74.27 76.52 72.94 6 XM_B_Unicode 241577 77.23 88.24 70.76 7 DCC_CHECK_NEGATIVE 236717 56.84 35.61 69.33 8 BAYES_50 196140 49.21 35.22 57.45 9 DKIM_VALID_AU 195429 57.07 56.79 57.24 10 XMListUnsubscribeExists 172284 54.58 61.58 50.46 11 XM_B_SpammyWords 151464 55.59 74.67 44.36 12 XM_B_Unicode3 140760 45.21 51.98 41.23 13 RCVD_IN_MSPIKE_H2 134924 40.66 42.59 39.52 14 DCC_CHECK 104536 43.12 64.36 30.62 15 T_TM2_M_HEADER_IN_MSG 104359 26.73 20.20 30.57 16 DKIM_VALID_EF 98277 28.99 29.34 28.79 17 HTML_FONT_LOW_CONTRAST 94015 28.83 31.02 27.54 18 FVGT_m_MULTI_ODD 87755 27.84 31.46 25.70 19 LOC_TINY_FONT_1 80460 27.13 33.18 23.57 20 XMSubLong 72675 20.91 20.28 21.29 21 T_KAM_HTML_FONT_INVALID 69131 22.99 27.64 20.25 22 MIME_HTML_ONLY 66758 26.20 37.50 19.55 23 XM_B_SpammyWords2 63285 24.72 35.23 18.54 24 RCVD_IN_MSPIKE_WL 60720 15.87 12.60 17.78 25 ALL_TRUSTED 51116 14.50 13.69 14.97 26 USER_IN_DEF_DKIM_WL 42236 8.58 2.13 12.37 27 XM_Multi_Part_URI 41576 18.54 29.34 12.18 28 XM_Body_Dirty_Words 40604 14.26 18.29 11.89 29 RCVD_IN_MSPIKE_H3 38425 10.36 8.85 11.25 30 BAYES_00 34050 6.63 0.95 9.97 31 LotsOfNums_01 31551 8.07 6.09 9.24 32 BAYES_60 31259 8.37 7.04 9.16 33 XM_DKIMWhitelistDomains 30380 5.65 0.14 8.90 34 XM_B_Unsub 30058 10.61 13.69 8.80 35 TooManyTo_001 28232 6.69 4.00 8.27 36 XM_Evil_Numbers_Gen 28038 8.17 8.10 8.21 37 LOTS_OF_MONEY 27991 10.53 14.49 8.20 38 UNPARSEABLE_RELAY 27152 9.02 10.84 7.95 39 IN_ZIMBRA_NJ_WHITELIST 25569 4.74 0.08 7.49 40 TR_XM_BayesUnsub 23196 9.23 13.36 6.79 41 XM_DK_Undo_02 23081 19.78 41.92 6.76 42 TR_XM_UnparsRelay 21125 7.83 10.62 6.19 43 TR_XM_DK_Bayes 20960 4.16 0.80 6.14 44 TR_XM_DK_Bayes1 20578 4.09 0.79 6.03 45 MIME_QP_LONG_LINE 20312 5.11 3.69 5.95 46 BAYES_99 19777 18.09 38.98 5.79 47 T_TooManySym_01 19538 4.41 2.18 5.72 48 XM_PDF 19339 3.87 0.82 5.66 49 RCVD_IN_IADB_LISTED 19001 4.41 2.44 5.57 50 RCVD_IN_MSPIKE_H4 18501 4.55 3.07 5.42 51 HTML_IMAGE_RATIO_02 18312 5.42 5.53 5.36 52 TR_XM_DK_Bayes2 18091 3.62 0.76 5.30 53 TR_XM_SpammyWords4 17809 7.47 11.30 5.22 54 BOTNET_IPINHOSTNAME 17605 8.11 13.13 5.16 55 XM_SendGrid 17446 5.55 6.29 5.11 56 XM_H_Long_From01 17338 5.03 4.93 5.08 57 RCVD_IN_IADB_SPF 16990 3.90 2.08 4.98 58 RCVD_IN_VALIDITY_SAFE 16590 4.07 2.74 4.86 59 MPART_ALT_DIFF 16425 4.71 4.54 4.81 60 XMStrtUSub 16280 4.95 5.27 4.77 61 TR_XM_DKIM_Undo 16231 15.04 32.52 4.75 62 BAYES_999 16140 13.70 28.94 4.73 63 XM_B_SpammyWords3 15942 7.25 11.63 4.67 64 BAYES_40 15925 3.45 1.40 4.66 65 HTML_IMAGE_RATIO_04 15493 4.63 4.78 4.54 66 RCVD_IN_IADB_SENDERID 15319 3.54 1.93 4.49 67 BAYES_80 15217 5.95 8.50 4.46 68 RCVD_IN_IADB_DK 14890 3.47 1.94 4.36 69 RCVD_IN_VALIDITY_CERTIFIED 14724 3.46 2.01 4.31 70 XM_B_Phish_Phrases 14108 9.34 18.19 4.13 71 T_REMOTE_IMAGE 12977 3.26 2.34 3.80 72 HTML_IMAGE_RATIO_06 12713 3.85 4.06 3.72 73 RELAYCOUNTRY_META 12519 7.91 15.12 3.67 74 XM_UncommonTLD01 12486 4.40 5.65 3.66 75 XMSubMetaSx_00 11989 4.18 5.32 3.51 76 MAILING_LIST_MULTI 11928 2.99 2.14 3.49 77 BAYES_20 11762 2.55 1.03 3.45 78 XMNumbers 11521 3.22 2.95 3.37 79 RCVD_IN_IADB_VOUCHED 10972 2.51 1.31 3.21 80 T_TooManySym_02 10912 2.24 0.60 3.20 81 XMSexyCombo_05 10768 4.71 7.36 3.15 82 TR_XM_DK_SendGrid 10745 3.48 4.05 3.15 83 TR_XM_PhishingBody 10381 4.05 5.75 3.04 84 MIME_HTML_ONLY_MULTI 10350 2.81 2.43 3.03 85 BAYES_95 9779 4.14 6.31 2.86 86 DKIM_INVALID 9678 2.69 2.45 2.83 87 FSL_BULK_SIG 9498 7.08 14.37 2.78 88 XM_SPF_SoftFail 9311 8.01 17.00 2.73 89 TM2_M_URI_OPT_OUT 9183 2.80 3.00 2.69 90 URI_NOVOWEL 9123 2.44 2.05 2.67 91 MIME_HTML_MOSTLY 8537 2.65 2.91 2.50 92 TR_XM_SB_Phish 8205 2.31 2.15 2.40 93 XM_B_SpammyTLD 8191 3.52 5.44 2.40 94 XMSubPhish11 8125 2.26 2.06 2.38 95 FROM_EXCESS_BASE64 7994 2.25 2.11 2.34 96 XM_CamelCaseFrm001 7842 2.33 2.37 2.30 97 TooManyTo_002 7840 1.60 0.42 2.30 98 XM_H_Trusted_IP 7831 1.44 0.00 2.29 99 TVD_RCVD_IP 7599 1.49 0.23 2.23 100 XM_B_Investor 7534 3.14 4.72 2.21 101 HTML_IMAGE_RATIO_08 7531 2.41 2.76 2.21 102 BAYES_05 7503 1.59 0.57 2.20 103 RCVD_IN_IADB_OPTIN 7349 1.65 0.80 2.15 104 TR_Symld_Words 6830 1.68 1.15 2.00 105 HELO_NODOT 6610 1.40 0.50 1.94 106 HTML_MIME_NO_HTML_TAG 6609 1.72 1.35 1.94 107 HELO_NO_DOMAIN 6604 1.39 0.45 1.93 108 INVALID_MSGID 6587 1.25 0.09 1.93 109 ANY_BOUNCE_MESSAGE 6436 1.38 0.52 1.89 110 BOUNCE_MESSAGE 6434 1.38 0.52 1.88 111 IN_HORDE_ADDRESS_BOOK 6420 1.23 0.12 1.88 112 XM_GoogleGroups 6395 1.40 0.61 1.87 113 XM_B_Phish66 6377 2.38 3.24 1.87 114 KHOP_HELO_FCRDNS 6168 1.61 1.28 1.81 115 TO_MALFORMED 6116 1.20 0.21 1.79 116 SUBJ_ALL_CAPS 6060 1.69 1.54 1.77 117 XM_B_Unsub2 5866 1.96 2.36 1.72 118 MSGID_NOFQDN1 5837 1.08 0.02 1.71 119 XM_OfRef6 5799 2.41 3.62 1.70 120 TR_XM_SpammyRelay 5591 5.11 11.01 1.64 121 XM_DK_Undo_01 5368 1.57 1.57 1.57 122 BOTNET 5368 4.62 9.79 1.57 123 T_XMDrugObfuBody_14 5325 2.34 3.67 1.56 124 TooManyTo_003 5201 1.08 0.33 1.52 125 T_XMDrugObfuBody_08 5144 2.23 3.45 1.51 126 TR_XM_SpammyWords5 5093 2.16 3.28 1.49 127 XMDiploma_00 4947 2.00 2.92 1.45 128 TR_DCC_Bayes_99 4904 9.97 24.48 1.44 129 UNTRUSTED_Relay 4809 3.30 6.53 1.41 130 TM2_M_VERY_LONG_WORD 4692 2.05 3.20 1.37 131 XMGappySubj_01 4672 0.91 0.14 1.37 132 XMBody_95 4601 0.90 0.13 1.35 133 XM_H_Long_From02 4388 1.39 1.56 1.29 134 XMStockSpam_06 4296 1.34 1.49 1.26 135 XMBSHREFv2 4241 0.89 0.29 1.24 136 XMCapTrack 3916 0.83 0.30 1.15 137 URI_HEX 3853 5.84 13.85 1.13 138 RCVD_IN_MSPIKE_H5 3794 0.95 0.68 1.11 139 XMBrknScrpt_02 3693 1.62 2.53 1.08 140 HTML_FONT_FACE_BAD 3690 0.91 0.63 1.08 141 TooManyTo_004 3655 0.77 0.26 1.07 142 HTTPS_HTTP_MISMATCH 3596 1.22 1.52 1.05 143 DKIM_ADSP_CUSTOM_MED 3492 0.99 0.93 1.02 144 RELAYCOUNTRY_CA 3478 3.16 6.81 1.02 145 RCVD_IN_MSPIKE_BL 3378 1.99 3.69 0.99 146 TR_XM_MSPIKECOMBO 3325 1.94 3.59 0.97 147 RCVD_IN_RP_SAFE 3266 0.82 0.60 0.96 148 XMGenDplmaNmb 3102 1.17 1.62 0.91 149 RCVD_IN_MSPIKE_L3 3064 1.40 2.25 0.90 150 TR_XM_SpammyWords2 3052 4.57 10.81 0.89 151 T_FILL_THIS_FORM_SHORT 3049 1.69 3.06 0.89 152 TooManyTo_005 3019 0.64 0.22 0.88 153 T_XMDrugObfuBody_00 3013 1.16 1.62 0.88 154 XM_UB50 3009 1.72 3.15 0.88 155 RCVD_IN_RP_CERTIFIED 2941 0.70 0.42 0.86 156 TR_XM_Base64_M1 2784 0.95 1.19 0.82 157 URI_TRY_3LD 2763 1.25 2.01 0.81 158 TVD_SPACE_RATIO 2723 0.53 0.07 0.80 159 TR_MetaPhish_Combo_01 2721 0.89 1.06 0.80 160 T_OBFU_PDF_ATTACH 2663 0.55 0.15 0.78 161 XM_RXBody 2646 0.62 0.35 0.78 162 SpammyFromTLD_01 2614 1.22 1.98 0.77 163 T_XMHurry_00 2596 1.33 2.29 0.76 164 XMHTML_After_End 2542 1.03 1.52 0.74 165 XMBdyGiftCard01 2537 0.94 1.27 0.74 166 XM_B_SpammyWords4 2448 1.26 2.18 0.72 167 TM2_M_A_HREF_HREF 2439 0.98 1.42 0.71 168 T_TooManySym_03 2391 0.53 0.23 0.70 169 XMSubNoVowel 2382 0.75 0.83 0.70 170 HTML_TAG_BALANCE_BODY 2375 0.96 1.41 0.70 171 XM_D_tchamptons_WL 2331 0.44 0.03 0.68 172 FROM_GOV_DKIM_AU 2330 0.68 0.67 0.68 173 XMSexyCombo_01 2266 1.05 1.70 0.66 174 XM_ShortIntro_01 2229 0.53 0.33 0.65 175 RCVD_IN_BL_SPAMCOP_NET 2218 4.94 12.24 0.65 176 SHORT_HELO_AND_INLINE_IMAGE 2159 0.43 0.07 0.63 177 TVD_PH_BODY_ACCOUNTS_PRE 2149 0.44 0.11 0.63 178 NML_ADSP_CUSTOM_MED 2135 0.67 0.75 0.63 179 XM_Body_Dirty_Words_01 2123 0.72 0.89 0.62 180 T_Symld_Words_02 2122 0.91 1.40 0.62 181 RELAYCOUNTRY_GB 2111 0.61 0.59 0.62 182 XMLngstWrd_00 2102 0.69 0.82 0.62 183 XMBody_17 2088 1.90 4.09 0.61 184 MPART_ALT_DIFF_COUNT 2039 0.76 1.03 0.60 185 FORGED_GMAIL_RCVD 2023 0.66 0.76 0.59 186 XM_B_COPY_HTML 1945 0.56 0.55 0.57 187 TR_LOTS_OF_MONEY3 1932 1.25 2.40 0.57 188 XM_H_PHPMailer 1927 0.57 0.57 0.56 189 XM_ProductURIs 1909 0.65 0.82 0.56 190 XMLngstWrd_01 1860 0.64 0.79 0.54 191 RCVD_IN_PSBL 1841 0.85 1.37 0.54 192 XM_B_COVIDMETA 1821 0.98 1.73 0.53 193 XMNoVowels 1800 0.44 0.30 0.53 194 XMPhish30 1797 0.72 1.04 0.53 195 BASE64_LENGTH_79_INF 1760 0.39 0.17 0.52 196 XM_shorewaves_Whitelist 1753 0.32 0.00 0.51 197 RCVD_IN_SORBS_DUL 1750 0.36 0.10 0.51 198 HTML_IMAGE_ONLY_20 1744 0.43 0.29 0.51 199 XMHTMLBadTable_001 1727 0.58 0.70 0.51 200 HTML_IMAGE_ONLY_28 1713 0.39 0.20 0.50 ----------------------------------------------------------------------