Email: 486495 Autolearn: 0 AvgScore: 4.52 AvgScanTime: 1.37 sec Spam: 171882 Autolearn: 0 AvgScore: 14.54 AvgScanTime: 1.49 sec Ham: 314613 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.31 sec Time Spent Running SA: 185.05 hours Time Spent Processing Spam: 70.92 hours Time Spent Processing Ham: 114.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165336 90.56 96.19 87.48 2 DKIM_SIGNED 151924 79.38 88.39 74.46 3 XM_DK_Pass 149140 77.93 86.77 73.11 4 DKIM_VALID 147323 76.97 85.71 72.19 5 XM_B_Unicode 142666 75.65 83.00 71.64 6 RELAYCOUNTRY_US 136706 80.38 79.53 80.84 7 DCC_CHECK 128302 48.75 74.65 34.60 8 XMListUnsubscribeExists 119418 57.40 69.48 50.80 9 XM_B_SpammyWords 114084 52.57 66.37 45.03 10 DKIM_VALID_AU 108932 58.74 63.38 56.21 11 XM_B_Unicode3 78944 44.64 45.93 43.93 12 RCVD_IN_MSPIKE_H2 77624 41.60 45.16 39.66 13 BAYES_50 76590 52.91 44.56 57.47 14 XM_DK_Undo_02 69925 18.83 40.68 6.90 15 MIME_HTML_ONLY 65731 27.16 38.24 21.11 16 XM_B_SpammyWords2 62487 24.51 36.35 18.04 17 DKIM_VALID_EF 58715 30.08 34.16 27.86 18 FVGT_m_MULTI_ODD 58348 27.67 33.95 24.25 19 HTML_FONT_LOW_CONTRAST 57489 29.95 33.45 28.04 20 TR_XM_DKIM_Undo 57311 14.81 33.34 4.68 21 LOC_TINY_FONT_1 54551 27.48 31.74 25.15 22 BAYES_99 53657 15.17 31.22 6.40 23 T_KAM_HTML_FONT_INVALID 47040 22.82 27.37 20.33 24 DCC_CHECK_NEGATIVE 43553 51.21 25.34 65.35 25 RELAYCOUNTRY_META 42641 11.29 24.81 3.90 26 BAYES_999 41987 12.10 24.43 5.36 27 XM_Body_Dirty_Words 40178 16.09 23.38 12.10 28 XMSubLong 39468 22.80 22.96 22.72 29 TR_DCC_Bayes_99 38593 9.05 22.45 1.72 30 T_TM2_M_HEADER_IN_MSG 34667 25.41 20.17 28.27 31 XM_Multi_Part_URI 30597 14.32 17.80 12.42 32 RCVD_IN_MSPIKE_WL 29778 17.50 17.32 17.60 33 XM_B_Unsub 27249 11.34 15.85 8.87 34 TR_XM_BayesUnsub 26628 9.96 15.49 6.93 35 RCVD_IN_MSPIKE_H3 25669 12.72 14.93 11.51 36 TR_XM_SpammyRelay 24822 6.42 14.44 2.03 37 LOTS_OF_MONEY 23722 10.05 13.80 8.01 38 BOTNET_IPINHOSTNAME 23408 8.20 13.62 5.24 39 UNPARSEABLE_RELAY 21754 9.26 12.66 7.41 40 TR_XM_UnparsRelay 21333 8.06 12.41 5.68 41 BOTNET 21155 5.32 12.31 1.50 42 FSL_BULK_SIG 21099 6.30 12.28 3.04 43 TR_XM_SpammyWords4 20822 7.36 12.11 4.77 44 XMSexyCombo_05 20195 6.30 11.75 3.33 45 XM_B_SpammyWords3 20033 6.51 11.66 3.70 46 MPART_ALT_DIFF 19957 8.05 11.61 6.11 47 TR_XM_SpammyWords2 18926 4.51 11.01 0.96 48 RCVD_IN_BL_SPAMCOP_NET 18595 4.23 10.82 0.63 49 RELAYCOUNTRY_CA 18201 4.65 10.59 1.40 50 XM_UncommonTLD01 16944 6.01 9.86 3.91 51 UNTRUSTED_Relay 14197 3.75 8.26 1.29 52 BAYES_80 14008 5.79 8.15 4.51 53 MIME_HTML_ONLY_MULTI 13953 5.49 8.12 4.06 54 XM_H_Long_From01 13930 6.23 8.10 5.20 55 XM_Evil_Numbers_Gen 13225 7.71 7.69 7.72 56 TM2_M_VERY_LONG_WORD 13130 3.38 7.64 1.05 57 TR_XM_SPAMCOP 13020 2.81 7.57 0.21 58 BAYES_60 12636 8.89 7.35 9.74 59 HTML_MIME_NO_HTML_TAG 11767 4.03 6.85 2.49 60 HTML_IMAGE_RATIO_02 11334 6.40 6.59 6.29 61 XM_SendGrid 11009 5.35 6.40 4.78 62 LotsOfNums_01 11004 8.16 6.40 9.12 63 XMSubMetaSx_00 10381 4.75 6.04 4.04 64 XM_GoogleGroups 10312 2.96 6.00 1.30 65 XM_B_Investor 10211 3.20 5.94 1.71 66 TR_XM_PhishingBody 10178 4.44 5.92 3.64 67 XMLngstWrd_00 10046 2.42 5.84 0.55 68 XMLngstWrd_01 9974 2.34 5.80 0.45 69 XM_B_Phish_Phrases 9872 4.06 5.74 3.14 70 XMLngstWrd_02 9843 2.22 5.73 0.31 71 XM_CamelCaseFrm001 9649 3.15 5.61 1.81 72 T_REMOTE_IMAGE 9504 4.29 5.53 3.61 73 XMLngstWrd_03 9492 2.09 5.52 0.22 74 RCVD_IN_MSPIKE_BL 9484 2.28 5.52 0.52 75 XMLngstWrd_04 9413 2.03 5.48 0.15 76 HTML_TITLE_SUBJ_DIFF 9287 1.94 5.40 0.05 77 UPPERCASE_75_100 9274 1.93 5.40 0.04 78 XM_SPF_SoftFail 9057 3.13 5.27 1.95 79 T_XMDrugObfuBody_08 9013 2.86 5.24 1.56 80 TR_XM_MSPIKECOMBO 8984 2.18 5.23 0.51 81 BAYES_95 8529 3.54 4.96 2.77 82 XMBody_17 8527 2.09 4.96 0.51 83 TR_XM_SpammyWords5 8404 2.67 4.89 1.46 84 XM_DIRTYINTL 8283 1.94 4.82 0.37 85 MIME_HTML_MOSTLY 8033 3.34 4.67 2.62 86 RCVD_IN_VALIDITY_RPBL 7909 1.68 4.60 0.09 87 XM_B_SpammyTLD 7770 3.17 4.52 2.43 88 T_FILL_THIS_FORM_SHORT 7513 2.08 4.37 0.83 89 HTML_IMAGE_RATIO_04 7424 4.74 4.32 4.98 90 TooManyTo_001 7405 6.84 4.31 8.22 91 T_XMDrugObfuBody_14 7112 2.55 4.14 1.69 92 TR_XM_DK_SendGrid 7051 3.41 4.10 3.03 93 XMNumbers 6984 3.59 4.06 3.32 94 XMStrtUSub 6824 4.33 3.97 4.53 95 TR_XM_SpammyWords3 6516 1.47 3.79 0.20 96 XM_UB50 6264 1.86 3.64 0.89 97 HTML_IMAGE_ONLY_24 6233 1.48 3.63 0.30 98 HTTP_EXCESSIVE_ESCAPES 6042 1.25 3.52 0.01 99 MIME_QP_LONG_LINE 5989 4.77 3.48 5.47 100 XM_B_Phish66 5974 2.42 3.48 1.85 101 BOTNET_NORDNS 5683 1.17 3.31 0.01 102 XM_OfRef6 5551 1.90 3.23 1.18 103 XMDiploma_00 5504 2.02 3.20 1.37 104 SpammyFromTLD_02 5477 1.52 3.19 0.61 105 TM2_M_URI_OPT_OUT 5395 3.13 3.14 3.12 106 RCVD_IN_VALIDITY_SAFE 5168 4.38 3.01 5.13 107 URIBL_DBL_SPAM 5105 1.06 2.97 0.01 108 HTML_IMAGE_RATIO_06 5017 3.38 2.92 3.64 109 SUBJ_ALL_CAPS 4966 2.28 2.89 1.95 110 SpammyFromTLD_01 4939 1.43 2.87 0.65 111 HTML_IMAGE_RATIO_08 4822 2.42 2.81 2.21 112 DKIM_INVALID 4601 2.41 2.68 2.27 113 URI_NOVOWEL 4574 2.74 2.66 2.78 114 FONT_INVIS_LONG_LINE 4485 0.96 2.61 0.06 115 RCVD_IN_MSPIKE_L3 4432 1.23 2.58 0.49 116 RCVD_IN_MSPIKE_L5 4271 0.89 2.48 0.02 117 XM_B_Unsub2 4184 1.72 2.43 1.33 118 RCVD_IN_VALIDITY_CERTIFIED 4144 3.79 2.41 4.55 119 T_TooManySym_01 4106 4.73 2.39 6.02 120 TR_XM_FormFill 4053 0.84 2.36 0.01 121 RCVD_IN_MSPIKE_H4 3623 3.88 2.11 4.86 122 PDS_OTHER_BAD_TLD 3584 0.82 2.09 0.13 123 XM_DK_Undo_01 3579 1.74 2.08 1.55 124 RCVD_IN_IADB_LISTED 3575 4.51 2.08 5.84 125 XMSexyCombo_01 3561 1.45 2.07 1.12 126 FROM_EXCESS_BASE64 3554 2.42 2.07 2.61 127 RCVD_IN_PSBL 3539 0.90 2.06 0.27 128 HK_RANDOM_REPLYTO 3477 0.76 2.02 0.07 129 XM_UB99 3474 0.72 2.02 0.00 130 T_XMDrugObfuBody_00 3452 1.16 2.01 0.70 131 MAILING_LIST_MULTI 3348 2.43 1.95 2.69 132 RCVD_IN_IADB_SPF 3139 3.97 1.83 5.15 133 HTTPS_HTTP_MISMATCH 3138 1.20 1.83 0.85 134 MIME_BASE64_TEXT 3136 0.74 1.82 0.15 135 TR_XM_NoHeaderRelay 3083 0.71 1.79 0.12 136 XM_B_SpammyWords4 3082 0.85 1.79 0.33 137 TR_XM_SB_Phish 3054 1.96 1.78 2.05 138 XMStockSpam_06 3039 1.36 1.77 1.13 139 T_XMHurry_00 3022 0.99 1.76 0.57 140 RCVD_IN_IADB_DK 2991 3.49 1.74 4.45 141 RCVD_IN_IADB_SENDERID 2975 3.57 1.73 4.57 142 XMSubPhish11 2974 1.93 1.73 2.04 143 USER_IN_DEF_DKIM_WL 2870 9.22 1.67 13.35 144 XM_B_COVIDMETA 2858 0.81 1.66 0.35 145 URI_HEX 2818 1.38 1.64 1.24 146 XM_UB999 2810 0.58 1.63 0.00 147 TR_XM_InvalidRelay 2793 0.59 1.62 0.02 148 RELAYCOUNTRY_AU 2733 0.81 1.59 0.39 149 XM_H_Undi_Recip 2725 0.70 1.59 0.21 150 XM_H_Long_From02 2716 1.22 1.58 1.03 151 URI_PHP_REDIR 2705 0.56 1.57 0.00 152 XM_URI_RBL 2619 0.62 1.52 0.13 153 BAYES_40 2600 3.48 1.51 4.56 154 XMGenDplmaNmb 2549 0.95 1.48 0.66 155 TR_LOTS_OF_MONEY3 2497 0.79 1.45 0.42 156 XMBdyGiftCard01 2491 1.02 1.45 0.78 157 TVD_RCVD_SPACE_BRACKET 2487 0.52 1.45 0.01 158 TR_XM_MSPIKECOMBO2 2467 0.58 1.44 0.11 159 MPART_ALT_DIFF_COUNT 2439 0.85 1.42 0.53 160 TR_XM_BayesRelay 2431 0.50 1.41 0.00 161 TR_XM_PHPDW 2376 0.71 1.38 0.34 162 XM_Body_Dirty_Words_01 2366 0.90 1.38 0.64 163 DOS_RCVD_IP_TWICE_B 2364 0.72 1.38 0.37 164 TR_XM_PHPForged 2299 0.67 1.34 0.30 165 ALL_TRUSTED 2277 10.76 1.32 15.92 166 TR_XM_FormFill2 2267 0.66 1.32 0.30 167 XM_H_PHPOS 2261 0.65 1.32 0.29 168 TR_Caps_n_Bayes_99 2241 0.64 1.30 0.28 169 TR_Symld_Words 2231 1.64 1.30 1.82 170 XMReplyNow 2213 0.59 1.29 0.20 171 KHOP_HELO_FCRDNS 2174 1.23 1.26 1.21 172 RELAYCOUNTRY_RU 2131 0.45 1.24 0.02 173 RELAYCOUNTRY_IN 2077 0.48 1.21 0.08 174 TR_XM_Base64_M1 2061 1.12 1.20 1.07 175 XM_ProductURIs 2036 0.92 1.18 0.77 176 URIBL_BLACK 2029 0.45 1.18 0.05 177 RELAYCOUNTRY_CN 1961 0.45 1.14 0.07 178 TR_XM_MaxSPIKE 1932 0.47 1.12 0.11 179 TM2_M_A_HREF_HREF 1903 0.79 1.11 0.62 180 LONGLN_LOW_CONTRAST 1881 0.54 1.09 0.24 181 BAYES_20 1856 2.55 1.08 3.36 182 XM_Combo_Sbj 1835 0.48 1.07 0.16 183 LongTLD 1829 0.64 1.06 0.41 184 XMPhish30 1804 1.12 1.05 1.16 185 XMHTMLBadTable_001 1786 0.79 1.04 0.65 186 SHOPIFY_IMG_NOT_RCVD_SFY 1741 0.49 1.01 0.21 187 XMHTML_After_End 1665 0.85 0.97 0.79 188 TR_XM_COVIDMETA4 1638 0.43 0.95 0.14 189 TM2_M_OBFU_COMMENT 1632 0.46 0.95 0.18 190 RCVD_IN_IADB_VOUCHED 1617 2.68 0.94 3.63 191 URI_TRY_3LD 1603 0.76 0.93 0.66 192 RCVD_IN_RP_RNBL 1600 0.34 0.93 0.02 193 XM_B_SEO 1600 0.40 0.93 0.12 194 MultiRelay_CC 1598 0.33 0.93 0.00 195 TR_XM_SEO4 1561 0.37 0.91 0.07 196 TR_Mismatch_TLD_02 1559 0.38 0.91 0.09 197 TR_Mismatch_TLD_01 1548 0.48 0.90 0.26 198 XM_UB60 1537 0.35 0.89 0.06 199 RELAYCOUNTRY_FR 1508 0.46 0.88 0.24 200 FROM_SUSPICIOUS_NTLD 1481 0.32 0.86 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 275228 90.56 96.19 87.48 2 RELAYCOUNTRY_US 254331 80.38 79.53 80.84 3 DKIM_SIGNED 234269 79.38 88.39 74.46 4 XM_DK_Pass 230008 77.93 86.77 73.11 5 DKIM_VALID 227130 76.97 85.71 72.19 6 XM_B_Unicode 225378 75.65 83.00 71.64 7 DCC_CHECK_NEGATIVE 205602 51.21 25.34 65.35 8 BAYES_50 180802 52.91 44.56 57.47 9 DKIM_VALID_AU 176855 58.74 63.38 56.21 10 XMListUnsubscribeExists 159832 57.40 69.48 50.80 11 XM_B_SpammyWords 141662 52.57 66.37 45.03 12 XM_B_Unicode3 138221 44.64 45.93 43.93 13 RCVD_IN_MSPIKE_H2 124781 41.60 45.16 39.66 14 DCC_CHECK 108866 48.75 74.65 34.60 15 T_TM2_M_HEADER_IN_MSG 88950 25.41 20.17 28.27 16 HTML_FONT_LOW_CONTRAST 88225 29.95 33.45 28.04 17 DKIM_VALID_EF 87637 30.08 34.16 27.86 18 LOC_TINY_FONT_1 79121 27.48 31.74 25.15 19 FVGT_m_MULTI_ODD 76285 27.67 33.95 24.25 20 XMSubLong 71465 22.80 22.96 22.72 21 MIME_HTML_ONLY 66422 27.16 38.24 21.11 22 T_KAM_HTML_FONT_INVALID 63959 22.82 27.37 20.33 23 XM_B_SpammyWords2 56744 24.51 36.35 18.04 24 RCVD_IN_MSPIKE_WL 55368 17.50 17.32 17.60 25 ALL_TRUSTED 50093 10.76 1.32 15.92 26 USER_IN_DEF_DKIM_WL 41999 9.22 1.67 13.35 27 XM_Multi_Part_URI 39065 14.32 17.80 12.42 28 XM_Body_Dirty_Words 38082 16.09 23.38 12.10 29 RCVD_IN_MSPIKE_H3 36217 12.72 14.93 11.51 30 BAYES_60 30632 8.89 7.35 9.74 31 BAYES_00 28752 6.14 0.64 9.14 32 LotsOfNums_01 28690 8.16 6.40 9.12 33 XM_DKIMWhitelistDomains 28209 5.87 0.20 8.97 34 XM_B_Unsub 27919 11.34 15.85 8.87 35 TooManyTo_001 25848 6.84 4.31 8.22 36 LOTS_OF_MONEY 25190 10.05 13.80 8.01 37 XM_Evil_Numbers_Gen 24296 7.71 7.69 7.72 38 UNPARSEABLE_RELAY 23298 9.26 12.66 7.41 39 TR_XM_BayesUnsub 21810 9.96 15.49 6.93 40 IN_ZIMBRA_NJ_WHITELIST 21759 4.51 0.10 6.92 41 XM_DK_Undo_02 21703 18.83 40.68 6.90 42 BAYES_99 20148 15.17 31.22 6.40 43 HTML_IMAGE_RATIO_02 19797 6.40 6.59 6.29 44 MPART_ALT_DIFF 19230 8.05 11.61 6.11 45 T_TooManySym_01 18927 4.73 2.39 6.02 46 RCVD_IN_IADB_LISTED 18380 4.51 2.08 5.84 47 TR_XM_DK_Bayes 18216 3.92 0.48 5.79 48 TR_XM_DK_Bayes1 17936 3.86 0.48 5.70 49 TR_XM_UnparsRelay 17876 8.06 12.41 5.68 50 MIME_QP_LONG_LINE 17195 4.77 3.48 5.47 51 BAYES_999 16867 12.10 24.43 5.36 52 BOTNET_IPINHOSTNAME 16478 8.20 13.62 5.24 53 XM_H_Long_From01 16356 6.23 8.10 5.20 54 RCVD_IN_IADB_SPF 16190 3.97 1.83 5.15 55 RCVD_IN_VALIDITY_SAFE 16140 4.38 3.01 5.13 56 XM_PDF 15875 3.54 0.80 5.05 57 HTML_IMAGE_RATIO_04 15657 4.74 4.32 4.98 58 TR_XM_DK_Bayes2 15643 3.35 0.37 4.97 59 RCVD_IN_MSPIKE_H4 15276 3.88 2.11 4.86 60 XM_SendGrid 15031 5.35 6.40 4.78 61 TR_XM_SpammyWords4 14998 7.36 12.11 4.77 62 TR_XM_DKIM_Undo 14726 14.81 33.34 4.68 63 RCVD_IN_IADB_SENDERID 14392 3.57 1.73 4.57 64 BAYES_40 14344 3.48 1.51 4.56 65 RCVD_IN_VALIDITY_CERTIFIED 14313 3.79 2.41 4.55 66 XMStrtUSub 14265 4.33 3.97 4.53 67 BAYES_80 14175 5.79 8.15 4.51 68 RCVD_IN_IADB_DK 13996 3.49 1.74 4.45 69 XM_H_Trusted_IP 12937 2.66 0.00 4.11 70 MIME_HTML_ONLY_MULTI 12778 5.49 8.12 4.06 71 XMSubMetaSx_00 12705 4.75 6.04 4.04 72 XM_UncommonTLD01 12288 6.01 9.86 3.91 73 RELAYCOUNTRY_META 12267 11.29 24.81 3.90 74 XM_B_SpammyWords3 11655 6.51 11.66 3.70 75 TR_XM_PhishingBody 11444 4.44 5.92 3.64 76 HTML_IMAGE_RATIO_06 11440 3.38 2.92 3.64 77 RCVD_IN_IADB_VOUCHED 11431 2.68 0.94 3.63 78 T_REMOTE_IMAGE 11373 4.29 5.53 3.61 79 T_TooManySym_02 10638 2.46 0.78 3.38 80 BAYES_20 10566 2.55 1.08 3.36 81 XMSexyCombo_05 10476 6.30 11.75 3.33 82 XMNumbers 10460 3.59 4.06 3.32 83 XM_B_Phish_Phrases 9875 4.06 5.74 3.14 84 TM2_M_URI_OPT_OUT 9822 3.13 3.14 3.12 85 FSL_BULK_SIG 9558 6.30 12.28 3.04 86 TR_XM_DK_SendGrid 9536 3.41 4.10 3.03 87 URI_NOVOWEL 8755 2.74 2.66 2.78 88 BAYES_95 8702 3.54 4.96 2.77 89 MAILING_LIST_MULTI 8474 2.43 1.95 2.69 90 MIME_HTML_MOSTLY 8234 3.34 4.67 2.62 91 FROM_EXCESS_BASE64 8208 2.42 2.07 2.61 92 HTML_MIME_NO_HTML_TAG 7845 4.03 6.85 2.49 93 ANY_BOUNCE_MESSAGE 7689 1.80 0.63 2.44 94 BOUNCE_MESSAGE 7687 1.80 0.63 2.44 95 XM_B_SpammyTLD 7632 3.17 4.52 2.43 96 RCVD_IN_IADB_OPTIN 7609 1.76 0.56 2.42 97 DKIM_INVALID 7139 2.41 2.68 2.27 98 HTML_IMAGE_RATIO_08 6960 2.42 2.81 2.21 99 INVALID_MSGID 6724 1.42 0.11 2.14 100 TooManyTo_002 6495 1.54 0.58 2.06 101 BAYES_05 6491 1.52 0.53 2.06 102 TR_XM_SB_Phish 6464 1.96 1.78 2.05 103 XMSubPhish11 6406 1.93 1.73 2.04 104 TR_XM_SpammyRelay 6391 6.42 14.44 2.03 105 MSGID_NOFQDN1 6303 1.30 0.02 2.00 106 XM_SPF_SoftFail 6149 3.13 5.27 1.95 107 SUBJ_ALL_CAPS 6128 2.28 2.89 1.95 108 TO_MALFORMED 5971 1.24 0.03 1.90 109 IN_HORDE_ADDRESS_BOOK 5874 1.25 0.12 1.87 110 TVD_RCVD_IP 5866 1.32 0.32 1.86 111 XM_B_Phish66 5807 2.42 3.48 1.85 112 TR_Symld_Words 5724 1.64 1.30 1.82 113 XM_CamelCaseFrm001 5694 3.15 5.61 1.81 114 TR_DCC_Bayes_99 5427 9.05 22.45 1.72 115 HTML_FONT_FACE_BAD 5413 1.41 0.84 1.72 116 XM_B_Investor 5376 3.20 5.94 1.71 117 T_XMDrugObfuBody_14 5302 2.55 4.14 1.69 118 T_XMDrugObfuBody_08 4917 2.86 5.24 1.56 119 XM_DK_Undo_01 4869 1.74 2.08 1.55 120 XMBSHREFv2 4822 1.09 0.29 1.53 121 XMGappySubj_01 4780 1.06 0.21 1.52 122 BOTNET 4709 5.32 12.31 1.50 123 TR_XM_SpammyWords5 4604 2.67 4.89 1.46 124 RELAYCOUNTRY_CA 4419 4.65 10.59 1.40 125 XMBody_95 4355 0.96 0.18 1.38 126 XMSubNoVowel 4349 1.18 0.81 1.38 127 HELO_NODOT 4319 1.16 0.76 1.37 128 XMDiploma_00 4316 2.02 3.20 1.37 129 HELO_NO_DOMAIN 4315 1.15 0.76 1.37 130 TooManyTo_003 4207 1.02 0.44 1.34 131 XM_B_Unsub2 4198 1.72 2.43 1.33 132 XM_GoogleGroups 4092 2.96 6.00 1.30 133 UNTRUSTED_Relay 4045 3.75 8.26 1.29 134 URI_HEX 3901 1.38 1.64 1.24 135 RCVD_IN_MSPIKE_H5 3875 0.90 0.28 1.23 136 KHOP_HELO_FCRDNS 3805 1.23 1.26 1.21 137 XM_OfRef6 3697 1.90 3.23 1.18 138 XMPhish30 3649 1.12 1.05 1.16 139 XMStockSpam_06 3561 1.36 1.77 1.13 140 XMSexyCombo_01 3515 1.45 2.07 1.12 141 TR_XM_Base64_M1 3378 1.12 1.20 1.07 142 TM2_M_VERY_LONG_WORD 3306 3.38 7.64 1.05 143 XM_H_Long_From02 3237 1.22 1.58 1.03 144 RCVD_IN_RP_SAFE 3213 0.88 0.63 1.02 145 XMCapTrack 3111 0.77 0.37 0.99 146 TooManyTo_004 3036 0.76 0.40 0.96 147 TR_XM_SpammyWords2 3025 4.51 11.01 0.96 148 XM_D_tchamptons_WL 2910 0.61 0.03 0.92 149 RCVD_IN_RP_CERTIFIED 2887 0.77 0.49 0.92 150 XM_UB50 2799 1.86 3.64 0.89 151 XM_B_COPY_HTML 2734 0.82 0.74 0.87 152 DKIM_ADSP_CUSTOM_MED 2718 0.83 0.77 0.86 153 HTML_IMAGE_ONLY_20 2688 0.66 0.31 0.85 154 HTTPS_HTTP_MISMATCH 2681 1.20 1.83 0.85 155 T_FILL_THIS_FORM_SHORT 2602 2.08 4.37 0.83 156 TVD_SPACE_RATIO 2529 0.56 0.11 0.80 157 XMHTML_After_End 2472 0.85 0.97 0.79 158 XMBdyGiftCard01 2453 1.02 1.45 0.78 159 XM_ProductURIs 2436 0.92 1.18 0.77 160 HTML_TAG_BALANCE_BODY 2417 0.79 0.83 0.77 161 T_TooManySym_03 2402 0.59 0.26 0.76 162 FROM_GOV_DKIM_AU 2369 0.52 0.10 0.75 163 TR_MetaPhish_Combo_01 2317 0.70 0.64 0.74 164 TooManyTo_005 2314 0.60 0.34 0.74 165 T_XMDrugObfuBody_00 2200 1.16 2.01 0.70 166 XMBrknScrpt_02 2156 0.70 0.72 0.69 167 T_OBFU_PDF_ATTACH 2129 0.47 0.08 0.68 168 URI_TRY_3LD 2092 0.76 0.93 0.66 169 XMGenDplmaNmb 2065 0.95 1.48 0.66 170 SpammyFromTLD_01 2040 1.43 2.87 0.65 171 XMHTMLBadTable_001 2034 0.79 1.04 0.65 172 XM_Body_Dirty_Words_01 2022 0.90 1.38 0.64 173 RCVD_IN_BL_SPAMCOP_NET 1969 4.23 10.82 0.63 174 XMSexyCombo_04 1953 0.70 0.84 0.62 175 XM_RXBody 1938 0.60 0.58 0.62 176 TM2_M_A_HREF_HREF 1935 0.79 1.11 0.62 177 SpammyFromTLD_02 1931 1.52 3.19 0.61 178 XM_H_PHPMailer 1920 0.60 0.58 0.61 179 XM_ShortIntro_01 1858 0.53 0.42 0.59 180 RELAYCOUNTRY_GB 1849 0.66 0.79 0.59 181 T_XMHurry_00 1809 0.99 1.76 0.57 182 XMLngstWrd_00 1745 2.42 5.84 0.55 183 XMSubMetaSxObfu_04 1705 0.51 0.45 0.54 184 NML_ADSP_CUSTOM_MED 1688 0.53 0.52 0.54 185 XMNoVowels 1682 0.51 0.45 0.53 186 MPART_ALT_DIFF_COUNT 1681 0.85 1.42 0.53 187 RCVD_IN_MSPIKE_BL 1628 2.28 5.52 0.52 188 TR_XM_MSPIKECOMBO 1619 2.18 5.23 0.51 189 XMBody_17 1617 2.09 4.96 0.51 190 XMSexyCombo_02 1561 0.43 0.32 0.50 191 RCVD_IN_MSPIKE_L3 1539 1.23 2.58 0.49 192 XMMoneyMeta_00 1530 0.52 0.59 0.49 193 T_Symld_Words_02 1511 0.52 0.59 0.48 194 FORGED_GMAIL_RCVD 1482 0.53 0.65 0.47 195 XM_B_DNDMA 1465 0.54 0.67 0.47 196 TR_XM_Base64_L1 1437 0.54 0.69 0.46 197 XMSolicitRefs_0 1424 0.46 0.48 0.45 198 XMLngstWrd_01 1421 2.34 5.80 0.45 199 USER_IN_WELCOMELIST 1354 0.28 0.00 0.43 200 USER_IN_WHITELIST 1354 0.28 0.00 0.43 ----------------------------------------------------------------------