Email: 527601 Autolearn: 0 AvgScore: 4.00 AvgScanTime: 1.55 sec Spam: 178322 Autolearn: 0 AvgScore: 14.07 AvgScanTime: 1.64 sec Ham: 349279 Autolearn: 0 AvgScore: -1.15 AvgScanTime: 1.50 sec Time Spent Running SA: 226.82 hours Time Spent Processing Spam: 81.14 hours Time Spent Processing Ham: 145.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 169947 90.16 95.30 87.53 2 DKIM_SIGNED 156752 79.80 87.90 75.67 3 XM_DK_Pass 152324 78.16 85.42 74.46 4 DKIM_VALID 151353 77.32 84.88 73.46 5 XM_B_Unicode 145347 74.51 81.51 70.93 6 RELAYCOUNTRY_US 142392 81.23 79.85 81.94 7 DCC_CHECK 125101 46.55 70.15 34.50 8 XMListUnsubscribeExists 122643 56.86 68.78 50.78 9 XM_B_SpammyWords 121387 52.49 68.07 44.53 10 DKIM_VALID_AU 114516 59.28 64.22 56.76 11 RCVD_IN_MSPIKE_H2 83968 42.28 47.09 39.83 12 BAYES_50 76898 52.49 43.12 57.27 13 XM_B_Unicode3 76427 41.66 42.86 41.05 14 XM_DK_Undo_02 72785 18.21 40.82 6.67 15 XM_B_SpammyWords2 69340 25.70 38.88 18.96 16 FVGT_m_MULTI_ODD 61197 28.23 34.32 25.13 17 TR_XM_DKIM_Undo 59602 14.52 33.42 4.87 18 LOC_TINY_FONT_1 59338 26.42 33.28 22.92 19 MIME_HTML_ONLY 58641 24.13 32.88 19.66 20 HTML_FONT_LOW_CONTRAST 58471 29.05 32.79 27.15 21 DKIM_VALID_EF 57318 29.38 32.14 27.96 22 BAYES_99 56398 14.24 31.63 5.36 23 DCC_CHECK_NEGATIVE 53189 53.40 29.83 65.43 24 T_KAM_HTML_FONT_INVALID 51433 23.14 28.84 20.23 25 BAYES_999 44001 11.20 24.68 4.32 26 XMSubLong 41049 22.05 23.02 21.55 27 TR_DCC_Bayes_99 39799 8.77 22.32 1.86 28 RELAYCOUNTRY_META 39551 10.17 22.18 4.04 29 XM_Body_Dirty_Words 38477 14.51 21.58 10.90 30 T_TM2_M_HEADER_IN_MSG 36605 26.68 20.53 29.82 31 XM_Multi_Part_URI 32500 14.47 18.23 12.55 32 XM_B_Unsub 27836 10.71 15.61 8.21 33 RCVD_IN_MSPIKE_WL 27678 17.93 15.52 19.16 34 TR_XM_BayesUnsub 27153 9.44 15.23 6.49 35 LOTS_OF_MONEY 25138 8.98 14.10 6.36 36 TR_XM_SpammyRelay 24593 5.79 13.79 1.70 37 BOTNET_IPINHOSTNAME 24509 7.97 13.74 5.03 38 UNPARSEABLE_RELAY 23145 9.69 12.98 8.01 39 RCVD_IN_MSPIKE_H3 23118 12.88 12.96 12.84 40 TR_XM_UnparsRelay 22534 8.35 12.64 6.16 41 TR_XM_SpammyWords4 21661 6.52 12.15 3.65 42 XM_B_SpammyWords3 21562 7.17 12.09 4.65 43 BOTNET 20844 5.02 11.69 1.61 44 FSL_BULK_SIG 20721 5.83 11.62 2.88 45 TR_XM_SpammyWords2 20079 4.37 11.26 0.85 46 XM_Evil_Numbers_Gen 18721 9.35 10.50 8.76 47 RCVD_IN_BL_SPAMCOP_NET 18716 3.94 10.50 0.59 48 XMSexyCombo_05 17581 4.99 9.86 2.51 49 RELAYCOUNTRY_CA 15846 3.80 8.89 1.20 50 MPART_ALT_DIFF 15473 6.91 8.68 6.01 51 UNTRUSTED_Relay 14776 3.64 8.29 1.27 52 XM_UncommonTLD01 14610 5.36 8.19 3.91 53 BAYES_80 14185 5.57 7.95 4.36 54 BAYES_60 14164 8.80 7.94 9.24 55 TR_XM_SPAMCOP 13843 2.87 7.76 0.37 56 XM_H_Long_From01 12832 6.07 7.20 5.50 57 LotsOfNums_01 12622 8.75 7.08 9.61 58 XM_SendGrid 12405 5.87 6.96 5.31 59 XM_B_Phish_Phrases 11917 4.39 6.68 3.21 60 HTML_IMAGE_RATIO_02 11612 5.64 6.51 5.19 61 TR_XM_PhishingBody 11586 4.31 6.50 3.19 62 MIME_HTML_ONLY_MULTI 10715 4.77 6.01 4.14 63 XMSubMetaSx_00 10167 4.10 5.70 3.28 64 TM2_M_VERY_LONG_WORD 9965 3.27 5.59 2.08 65 XM_B_SpammyTLD 9704 3.75 5.44 2.88 66 XM_B_Investor 9494 2.93 5.32 1.71 67 TooManyTo_001 9087 7.48 5.10 8.70 68 BAYES_95 8499 3.44 4.77 2.76 69 XM_SPF_SoftFail 8397 3.34 4.71 2.64 70 HTML_MIME_NO_HTML_TAG 8386 3.54 4.70 2.94 71 T_REMOTE_IMAGE 8215 4.13 4.61 3.88 72 TR_XM_DK_SendGrid 8128 3.72 4.56 3.30 73 XMStrtUSub 8045 4.80 4.51 4.95 74 XMNumbers 7947 3.73 4.46 3.36 75 HTML_IMAGE_RATIO_04 7604 4.03 4.26 3.91 76 T_XMDrugObfuBody_08 7335 2.25 4.11 1.29 77 XM_OfRef6 7334 2.03 4.11 0.97 78 XMBody_17 7175 1.81 4.02 0.67 79 XM_GoogleGroups 6872 2.90 3.85 2.41 80 XMLngstWrd_00 6618 2.30 3.71 1.58 81 XMLngstWrd_01 6557 2.24 3.68 1.50 82 RCVD_IN_MSPIKE_BL 6455 1.60 3.62 0.57 83 XM_B_Phish66 6433 2.42 3.61 1.82 84 RCVD_IN_VALIDITY_RPBL 6428 1.28 3.60 0.10 85 T_XMDrugObfuBody_14 6393 2.37 3.59 1.75 86 TR_XM_SpammyWords5 6377 2.20 3.58 1.50 87 XMLngstWrd_02 6348 2.12 3.56 1.39 88 MIME_HTML_MOSTLY 6285 2.71 3.52 2.29 89 PDS_OTHER_BAD_TLD 6269 1.31 3.52 0.18 90 XM_CamelCaseFrm001 6254 2.55 3.51 2.06 91 XM_UB50 6202 1.70 3.48 0.79 92 TR_XM_MSPIKECOMBO 6190 1.55 3.47 0.57 93 XM_DIRTYINTL 6156 1.39 3.45 0.34 94 XMDiploma_00 6067 2.33 3.40 1.78 95 HTML_IMAGE_RATIO_06 6017 3.84 3.37 4.08 96 XM_DK_Undo_01 5955 2.28 3.34 1.75 97 XMLngstWrd_03 5952 1.97 3.34 1.28 98 RCVD_IN_VALIDITY_SAFE 5952 4.07 3.34 4.45 99 XMLngstWrd_04 5875 1.91 3.29 1.20 100 HTML_TITLE_SUBJ_DIFF 5775 1.80 3.24 1.06 101 T_FILL_THIS_FORM_SHORT 5755 1.64 3.23 0.83 102 UPPERCASE_75_100 5661 1.77 3.17 1.06 103 TM2_M_URI_OPT_OUT 5528 2.65 3.10 2.42 104 MIME_QP_LONG_LINE 5520 5.08 3.10 6.09 105 XM_B_Unsub2 5464 2.01 3.06 1.48 106 DKIM_INVALID 5399 2.48 3.03 2.20 107 SpammyFromTLD_02 5005 1.28 2.81 0.50 108 RCVD_IN_VALIDITY_CERTIFIED 4858 3.50 2.72 3.89 109 SpammyFromTLD_01 4727 1.38 2.65 0.74 110 BOTNET_NORDNS 4632 0.88 2.60 0.01 111 T_TooManySym_01 4523 4.71 2.54 5.82 112 XM_B_SpammyWords4 4409 1.46 2.47 0.94 113 URIBL_DBL_SPAM 4352 0.83 2.44 0.01 114 RCVD_IN_IADB_LISTED 4295 4.84 2.41 6.09 115 RCVD_IN_MSPIKE_H4 4171 4.08 2.34 4.97 116 HTTPS_HTTP_MISMATCH 4120 1.68 2.31 1.36 117 XM_B_COVIDMETA 4024 1.00 2.26 0.36 118 HTML_IMAGE_RATIO_08 4003 2.46 2.24 2.56 119 URI_NOVOWEL 3926 2.52 2.20 2.68 120 ALL_TRUSTED 3788 10.76 2.12 15.17 121 RCVD_IN_MSPIKE_L3 3785 1.08 2.12 0.55 122 USER_IN_DEF_DKIM_WL 3730 9.12 2.09 12.71 123 FROM_EXCESS_BASE64 3656 2.37 2.05 2.53 124 RCVD_IN_IADB_SPF 3650 4.27 2.05 5.40 125 TR_LOTS_OF_MONEY3 3629 0.89 2.04 0.31 126 RCVD_IN_IADB_DK 3423 3.71 1.92 4.63 127 TR_XM_SpammyWords3 3376 0.82 1.89 0.27 128 XMStockSpam_06 3368 1.17 1.89 0.80 129 RCVD_IN_IADB_SENDERID 3355 3.82 1.88 4.81 130 TR_XM_SB_Phish 3341 2.14 1.87 2.28 131 TR_XM_FormFill 3327 0.64 1.87 0.01 132 DOS_RCVD_IP_TWICE_B 3287 1.00 1.84 0.57 133 XMSubPhish11 3273 2.12 1.84 2.26 134 MAILING_LIST_MULTI 3240 2.53 1.82 2.89 135 HTML_IMAGE_ONLY_24 3239 0.84 1.82 0.34 136 HK_RANDOM_REPLYTO 3232 0.70 1.81 0.14 137 URI_TRY_3LD 3183 1.14 1.78 0.81 138 URI_PHP_REDIR 3174 0.60 1.78 0.00 139 XM_H_Undi_Recip 3150 0.75 1.77 0.22 140 BAYES_40 3126 3.60 1.75 4.55 141 XMReplyNow 3124 0.78 1.75 0.28 142 TR_XM_MSPIKECOMBO2 3099 0.63 1.74 0.06 143 TR_XM_NoHeaderRelay 3092 0.66 1.73 0.11 144 XM_UB99 2941 0.56 1.65 0.00 145 XMSexyCombo_01 2920 0.96 1.64 0.61 146 TR_Mismatch_TLD_01 2801 0.68 1.57 0.22 147 URI_HEX 2792 1.39 1.57 1.29 148 SUBJ_ALL_CAPS 2791 1.53 1.57 1.51 149 RCVD_IN_PSBL 2790 0.74 1.56 0.32 150 HTTP_EXCESSIVE_ESCAPES 2732 0.52 1.53 0.00 151 FONT_INVIS_LONG_LINE 2656 0.55 1.49 0.08 152 TR_XM_PHPDW 2576 0.71 1.44 0.34 153 XMBdyGiftCard01 2550 1.04 1.43 0.84 154 XM_URI_RBL 2541 0.55 1.42 0.11 155 XM_OfRef7 2505 0.55 1.40 0.12 156 TR_XM_PHPForged 2488 0.66 1.40 0.28 157 KHOP_HELO_FCRDNS 2456 1.51 1.38 1.58 158 XM_H_Long_From02 2434 1.36 1.36 1.35 159 TR_XM_FormFill2 2433 0.65 1.36 0.28 160 TR_XM_InvalidRelay 2430 0.47 1.36 0.02 161 XM_H_PHPOS 2419 0.64 1.36 0.27 162 BAYES_20 2415 2.79 1.35 3.52 163 RCVD_IN_IADB_VOUCHED 2380 2.92 1.33 3.72 164 TR_XM_Base64_M1 2371 1.20 1.33 1.14 165 RELAYCOUNTRY_AU 2330 0.66 1.31 0.34 166 XMHTML_After_End 2307 0.99 1.29 0.83 167 T_XMHurry_00 2283 0.79 1.28 0.53 168 XMGenDplmaNmb 2277 1.01 1.28 0.87 169 TR_XM_BayesRelay 2256 0.43 1.27 0.00 170 MPART_ALT_DIFF_COUNT 2237 0.83 1.25 0.61 171 XMBrknScrpt_02 2190 0.92 1.23 0.76 172 RELAYCOUNTRY_IN 2141 0.46 1.20 0.08 173 XM_UB999 2117 0.40 1.19 0.00 174 LONGLN_LOW_CONTRAST 2103 0.55 1.18 0.24 175 T_XMDrugObfuBody_00 2051 0.75 1.15 0.55 176 TR_XM_MaxSPIKE 2036 0.43 1.14 0.06 177 XM_B_DNDMA 2024 0.60 1.14 0.33 178 RELAYCOUNTRY_FR 1995 0.55 1.12 0.25 179 XM_ProductURIs 1943 0.74 1.09 0.56 180 RCVD_IN_MSPIKE_L5 1920 0.37 1.08 0.01 181 XMPhish08 1905 0.52 1.07 0.25 182 TR_Symld_Words 1903 1.52 1.07 1.75 183 FILL_THIS_FORM 1889 0.58 1.06 0.34 184 XM_Body_Dirty_Words_01 1865 0.43 1.05 0.12 185 HELO_NODOT 1857 1.45 1.04 1.66 186 TR_XM_COVIDMETA1 1830 0.46 1.03 0.17 187 HTML_TAG_BALANCE_BODY 1788 0.82 1.00 0.73 188 RELAYCOUNTRY_GB 1783 0.68 1.00 0.51 189 XM_UB60 1779 0.39 1.00 0.07 190 HELO_NO_DOMAIN 1774 1.44 0.99 1.66 191 TR_MetaPhish_Combo_01 1771 0.88 0.99 0.83 192 MONEY_FORM 1744 0.33 0.98 0.00 193 MIME_BASE64_TEXT 1738 0.46 0.97 0.19 194 XM_B_SEO 1736 0.46 0.97 0.20 195 TM2_M_A_HREF_HREF 1735 0.46 0.97 0.20 196 FILL_THIS_FORM_LONG 1732 0.43 0.97 0.16 197 RELAYCOUNTRY_CN 1719 0.38 0.96 0.09 198 TR_XM_RelayPhish 1711 0.36 0.96 0.06 199 XMPhish30 1705 0.69 0.96 0.56 200 URIBL_BLACK 1702 0.35 0.95 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 305719 90.16 95.30 87.53 2 RELAYCOUNTRY_US 286189 81.23 79.85 81.94 3 DKIM_SIGNED 264286 79.80 87.90 75.67 4 XM_DK_Pass 260064 78.16 85.42 74.46 5 DKIM_VALID 256586 77.32 84.88 73.46 6 XM_B_Unicode 247758 74.51 81.51 70.93 7 DCC_CHECK_NEGATIVE 228548 53.40 29.83 65.43 8 BAYES_50 200041 52.49 43.12 57.27 9 DKIM_VALID_AU 198252 59.28 64.22 56.76 10 XMListUnsubscribeExists 177361 56.86 68.78 50.78 11 XM_B_SpammyWords 155536 52.49 68.07 44.53 12 XM_B_Unicode3 143386 41.66 42.86 41.05 13 RCVD_IN_MSPIKE_H2 139117 42.28 47.09 39.83 14 DCC_CHECK 120507 46.55 70.15 34.50 15 T_TM2_M_HEADER_IN_MSG 104150 26.68 20.53 29.82 16 DKIM_VALID_EF 97672 29.38 32.14 27.96 17 HTML_FONT_LOW_CONTRAST 94823 29.05 32.79 27.15 18 FVGT_m_MULTI_ODD 87771 28.23 34.32 25.13 19 LOC_TINY_FONT_1 80072 26.42 33.28 22.92 20 XMSubLong 75277 22.05 23.02 21.55 21 T_KAM_HTML_FONT_INVALID 70656 23.14 28.84 20.23 22 MIME_HTML_ONLY 68653 24.13 32.88 19.66 23 RCVD_IN_MSPIKE_WL 66933 17.93 15.52 19.16 24 XM_B_SpammyWords2 66230 25.70 38.88 18.96 25 ALL_TRUSTED 52970 10.76 2.12 15.17 26 RCVD_IN_MSPIKE_H3 44832 12.88 12.96 12.84 27 USER_IN_DEF_DKIM_WL 44385 9.12 2.09 12.71 28 XM_Multi_Part_URI 43820 14.47 18.23 12.55 29 XM_Body_Dirty_Words 38066 14.51 21.58 10.90 30 BAYES_00 37554 7.41 0.87 10.75 31 LotsOfNums_01 33553 8.75 7.08 9.61 32 BAYES_60 32256 8.80 7.94 9.24 33 XM_DKIMWhitelistDomains 31764 6.05 0.08 9.09 34 XM_Evil_Numbers_Gen 30596 9.35 10.50 8.76 35 TooManyTo_001 30375 7.48 5.10 8.70 36 XM_B_Unsub 28693 10.71 15.61 8.21 37 UNPARSEABLE_RELAY 27973 9.69 12.98 8.01 38 IN_ZIMBRA_NJ_WHITELIST 24580 4.69 0.08 7.04 39 TR_XM_DK_Bayes 23388 4.67 0.70 6.70 40 XM_DK_Undo_02 23314 18.21 40.82 6.67 41 TR_XM_DK_Bayes1 23095 4.61 0.70 6.61 42 TR_XM_BayesUnsub 22667 9.44 15.23 6.49 43 LOTS_OF_MONEY 22221 8.98 14.10 6.36 44 TR_XM_UnparsRelay 21505 8.35 12.64 6.16 45 MIME_QP_LONG_LINE 21277 5.08 3.10 6.09 46 RCVD_IN_IADB_LISTED 21256 4.84 2.41 6.09 47 MPART_ALT_DIFF 20989 6.91 8.68 6.01 48 T_TooManySym_01 20316 4.71 2.54 5.82 49 XM_H_Long_From01 19195 6.07 7.20 5.50 50 TR_XM_DK_Bayes2 19078 3.81 0.58 5.46 51 RCVD_IN_IADB_SPF 18867 4.27 2.05 5.40 52 BAYES_99 18720 14.24 31.63 5.36 53 XM_SendGrid 18545 5.87 6.96 5.31 54 HTML_IMAGE_RATIO_02 18132 5.64 6.51 5.19 55 BOTNET_IPINHOSTNAME 17559 7.97 13.74 5.03 56 RCVD_IN_MSPIKE_H4 17367 4.08 2.34 4.97 57 XMStrtUSub 17289 4.80 4.51 4.95 58 TR_XM_DKIM_Undo 16996 14.52 33.42 4.87 59 RCVD_IN_IADB_SENDERID 16793 3.82 1.88 4.81 60 XM_PDF 16308 3.38 0.87 4.67 61 XM_B_SpammyWords3 16257 7.17 12.09 4.65 62 RCVD_IN_IADB_DK 16171 3.71 1.92 4.63 63 BAYES_40 15877 3.60 1.75 4.55 64 RCVD_IN_VALIDITY_SAFE 15536 4.07 3.34 4.45 65 BAYES_80 15217 5.57 7.95 4.36 66 BAYES_999 15089 11.20 24.68 4.32 67 MIME_HTML_ONLY_MULTI 14473 4.77 6.01 4.14 68 HTML_IMAGE_RATIO_06 14257 3.84 3.37 4.08 69 RELAYCOUNTRY_META 14116 10.17 22.18 4.04 70 XM_UncommonTLD01 13667 5.36 8.19 3.91 71 HTML_IMAGE_RATIO_04 13660 4.03 4.26 3.91 72 RCVD_IN_VALIDITY_CERTIFIED 13593 3.50 2.72 3.89 73 T_REMOTE_IMAGE 13559 4.13 4.61 3.88 74 RCVD_IN_IADB_VOUCHED 13002 2.92 1.33 3.72 75 TR_XM_SpammyWords4 12742 6.52 12.15 3.65 76 BAYES_20 12306 2.79 1.35 3.52 77 XMNumbers 11735 3.73 4.46 3.36 78 TR_XM_DK_SendGrid 11512 3.72 4.56 3.30 79 XMSubMetaSx_00 11461 4.10 5.70 3.28 80 XM_B_Phish_Phrases 11220 4.39 6.68 3.21 81 TR_XM_PhishingBody 11147 4.31 6.50 3.19 82 T_TooManySym_02 11143 2.35 0.69 3.19 83 HTML_MIME_NO_HTML_TAG 10283 3.54 4.70 2.94 84 MAILING_LIST_MULTI 10102 2.53 1.82 2.89 85 XM_B_SpammyTLD 10067 3.75 5.44 2.88 86 FSL_BULK_SIG 10058 5.83 11.62 2.88 87 XM_H_Trusted_IP 10013 1.90 0.00 2.87 88 BAYES_95 9627 3.44 4.77 2.76 89 URI_NOVOWEL 9346 2.52 2.20 2.68 90 XM_SPF_SoftFail 9224 3.34 4.71 2.64 91 HTML_IMAGE_RATIO_08 8952 2.46 2.24 2.56 92 FROM_EXCESS_BASE64 8841 2.37 2.05 2.53 93 RCVD_IN_IADB_OPTIN 8779 1.94 0.82 2.51 94 XMSexyCombo_05 8758 4.99 9.86 2.51 95 TM2_M_URI_OPT_OUT 8445 2.65 3.10 2.42 96 XM_GoogleGroups 8433 2.90 3.85 2.41 97 TooManyTo_002 8072 1.75 0.64 2.31 98 MIME_HTML_MOSTLY 8011 2.71 3.52 2.29 99 TR_XM_SB_Phish 7961 2.14 1.87 2.28 100 XMSubPhish11 7894 2.12 1.84 2.26 101 DKIM_INVALID 7700 2.48 3.03 2.20 102 ANY_BOUNCE_MESSAGE 7686 1.75 0.87 2.20 103 BOUNCE_MESSAGE 7685 1.75 0.87 2.20 104 BAYES_05 7680 1.66 0.61 2.20 105 TM2_M_VERY_LONG_WORD 7277 3.27 5.59 2.08 106 XM_CamelCaseFrm001 7212 2.55 3.51 2.06 107 TVD_RCVD_IP 7135 1.47 0.34 2.04 108 INVALID_MSGID 6735 1.33 0.14 1.93 109 TR_DCC_Bayes_99 6491 8.77 22.32 1.86 110 IN_HORDE_ADDRESS_BOOK 6350 1.23 0.09 1.82 111 XM_B_Phish66 6342 2.42 3.61 1.82 112 XMDiploma_00 6230 2.33 3.40 1.78 113 MSGID_NOFQDN1 6225 1.19 0.02 1.78 114 TR_Symld_Words 6127 1.52 1.07 1.75 115 T_XMDrugObfuBody_14 6125 2.37 3.59 1.75 116 XM_DK_Undo_01 6098 2.28 3.34 1.75 117 XM_B_Investor 5978 2.93 5.32 1.71 118 TR_XM_SpammyRelay 5943 5.79 13.79 1.70 119 TO_MALFORMED 5938 1.14 0.04 1.70 120 HELO_NODOT 5808 1.45 1.04 1.66 121 HELO_NO_DOMAIN 5805 1.44 0.99 1.66 122 BOTNET 5616 5.02 11.69 1.61 123 XMLngstWrd_00 5522 2.30 3.71 1.58 124 KHOP_HELO_FCRDNS 5510 1.51 1.38 1.58 125 SUBJ_ALL_CAPS 5277 1.53 1.57 1.51 126 XMLngstWrd_01 5248 2.24 3.68 1.50 127 TR_XM_SpammyWords5 5239 2.20 3.58 1.50 128 XM_B_Unsub2 5165 2.01 3.06 1.48 129 TooManyTo_003 5095 1.13 0.50 1.46 130 XMLngstWrd_02 4839 2.12 3.56 1.39 131 HTTPS_HTTP_MISMATCH 4740 1.68 2.31 1.36 132 XMGappySubj_01 4738 0.97 0.21 1.36 133 RCVD_IN_MSPIKE_H5 4734 0.97 0.22 1.36 134 XM_H_Long_From02 4717 1.36 1.36 1.35 135 XMBSHREFv2 4598 0.96 0.25 1.32 136 T_XMDrugObfuBody_08 4523 2.25 4.11 1.29 137 URI_HEX 4516 1.39 1.57 1.29 138 XMLngstWrd_03 4459 1.97 3.34 1.28 139 UNTRUSTED_Relay 4453 3.64 8.29 1.27 140 XMBody_95 4262 0.85 0.14 1.22 141 XMCapTrack 4219 0.94 0.42 1.21 142 RELAYCOUNTRY_CA 4204 3.80 8.89 1.20 143 XMLngstWrd_04 4199 1.91 3.29 1.20 144 XMSubNoVowel 4053 0.99 0.66 1.16 145 TR_XM_Base64_M1 3971 1.20 1.33 1.14 146 HTML_TITLE_SUBJ_DIFF 3711 1.80 3.24 1.06 147 UPPERCASE_75_100 3695 1.77 3.17 1.06 148 TooManyTo_004 3693 0.84 0.43 1.06 149 DKIM_ADSP_CUSTOM_MED 3426 0.94 0.87 0.98 150 XM_OfRef6 3376 2.03 4.11 0.97 151 XM_B_SpammyWords4 3278 1.46 2.47 0.94 152 RCVD_IN_RP_SAFE 3212 0.84 0.67 0.92 153 HTML_FONT_FACE_BAD 3152 0.79 0.57 0.90 154 XMGenDplmaNmb 3050 1.01 1.28 0.87 155 TooManyTo_005 3032 0.69 0.35 0.87 156 TR_XM_SpammyWords2 2954 4.37 11.26 0.85 157 XMBdyGiftCard01 2923 1.04 1.43 0.84 158 T_FILL_THIS_FORM_SHORT 2914 1.64 3.23 0.83 159 TR_MetaPhish_Combo_01 2897 0.88 0.99 0.83 160 XMHTML_After_End 2891 0.99 1.29 0.83 161 XMNoVowels 2834 0.65 0.33 0.81 162 URI_TRY_3LD 2813 1.14 1.78 0.81 163 XMStockSpam_06 2806 1.17 1.89 0.80 164 TVD_SPACE_RATIO 2782 0.56 0.09 0.80 165 RCVD_IN_RP_CERTIFIED 2773 0.72 0.59 0.79 166 XM_UB50 2767 1.70 3.48 0.79 167 FROM_GOV_DKIM_AU 2718 0.55 0.12 0.78 168 XMBrknScrpt_02 2649 0.92 1.23 0.76 169 SpammyFromTLD_01 2569 1.38 2.65 0.74 170 HTML_TAG_BALANCE_BODY 2555 0.82 1.00 0.73 171 T_TooManySym_03 2502 0.56 0.26 0.72 172 XMBody_17 2351 1.81 4.02 0.67 173 XM_B_COPY_HTML 2292 0.62 0.54 0.66 174 NML_ADSP_CUSTOM_MED 2217 0.66 0.70 0.63 175 XM_ShortIntro_01 2190 0.55 0.39 0.63 176 XM_H_PHPMailer 2186 0.66 0.73 0.63 177 XMSubMetaI_00 2135 0.62 0.65 0.61 178 XMSexyCombo_01 2130 0.96 1.64 0.61 179 MPART_ALT_DIFF_COUNT 2127 0.83 1.25 0.61 180 T_OBFU_PDF_ATTACH 2106 0.45 0.14 0.60 181 XMSubMetaSxObfu_03 2074 0.59 0.57 0.59 182 RCVD_IN_BL_SPAMCOP_NET 2067 3.94 10.50 0.59 183 XMMoneyMeta_00 2061 0.69 0.88 0.59 184 DOS_RCVD_IP_TWICE_B 1992 1.00 1.84 0.57 185 RCVD_IN_MSPIKE_BL 1988 1.60 3.62 0.57 186 TR_XM_MSPIKECOMBO 1974 1.55 3.47 0.57 187 XM_ProductURIs 1970 0.74 1.09 0.56 188 XMPhish30 1958 0.69 0.96 0.56 189 FORGED_GMAIL_RCVD 1944 0.60 0.68 0.56 190 T_XMDrugObfuBody_00 1917 0.75 1.15 0.55 191 RCVD_IN_MSPIKE_L3 1905 1.08 2.12 0.55 192 T_XMHurry_00 1861 0.79 1.28 0.53 193 HTML_IMAGE_ONLY_20 1833 0.55 0.59 0.52 194 T_Symld_Words_02 1817 0.59 0.73 0.52 195 XMPhish14 1806 0.62 0.83 0.52 196 RELAYCOUNTRY_GB 1793 0.68 1.00 0.51 197 XMHTMLBadTable_001 1784 0.63 0.85 0.51 198 SpammyFromTLD_02 1729 1.28 2.81 0.50 199 SHORT_HELO_AND_INLINE_IMAGE 1684 0.39 0.21 0.48 200 XM_shorewaves_Whitelist 1661 0.31 0.00 0.48 ----------------------------------------------------------------------