Email: 579512 Autolearn: 0 AvgScore: 3.51 AvgScanTime: 1.24 sec Spam: 172928 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 1.41 sec Ham: 406584 Autolearn: 0 AvgScore: -0.79 AvgScanTime: 1.17 sec Time Spent Running SA: 199.38 hours Time Spent Processing Spam: 67.66 hours Time Spent Processing Ham: 131.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164487 89.42 95.12 87.00 2 DKIM_SIGNED 145686 75.60 84.25 71.92 3 RELAYCOUNTRY_US 142755 80.28 82.55 79.32 4 XM_DK_Pass 142112 73.59 82.18 69.94 5 DKIM_VALID 140751 72.70 81.39 69.00 6 XM_B_Unicode 130315 65.71 75.36 61.61 7 DCC_CHECK 119608 41.62 69.17 29.90 8 XMListUnsubscribeExists 116194 49.61 67.19 42.13 9 XM_B_SpammyWords 112382 46.95 64.99 39.28 10 DKIM_VALID_AU 110269 57.92 63.77 55.43 11 RCVD_IN_MSPIKE_H2 77675 38.20 44.92 35.34 12 BAYES_50 74419 54.30 43.03 59.10 13 XM_B_Unicode3 69639 36.47 40.27 34.86 14 XM_DK_Undo_02 67315 15.68 38.93 5.80 15 LOC_TINY_FONT_1 61831 24.61 35.76 19.87 16 XM_B_SpammyWords2 61271 21.84 35.43 16.06 17 HTML_FONT_LOW_CONTRAST 60921 27.43 35.23 24.11 18 FVGT_m_MULTI_ODD 57645 25.71 33.33 22.46 19 BAYES_99 54870 12.62 31.73 4.49 20 DKIM_VALID_EF 54639 27.54 31.60 25.81 21 MIME_HTML_ONLY 54351 24.44 31.43 21.47 22 TR_XM_DKIM_Undo 53586 12.07 30.99 4.02 23 DCC_CHECK_NEGATIVE 53285 58.34 30.81 70.05 24 T_KAM_HTML_FONT_INVALID 46079 19.42 26.65 16.35 25 T_TM2_M_HEADER_IN_MSG 42888 30.55 24.80 33.00 26 BAYES_999 42737 9.89 24.71 3.59 27 TR_DCC_Bayes_99 39715 8.04 22.97 1.69 28 XM_Body_Dirty_Words 36876 13.78 21.32 10.57 29 XMSubLong 35498 19.19 20.53 18.62 30 RELAYCOUNTRY_META 32209 7.96 18.63 3.42 31 XM_Multi_Part_URI 31632 13.25 18.29 11.11 32 LOTS_OF_MONEY 30999 14.51 17.93 13.06 33 XM_B_Unsub 25739 10.88 14.88 9.17 34 TR_XM_BayesUnsub 25125 8.30 14.53 5.65 35 RCVD_IN_MSPIKE_WL 23207 15.08 13.42 15.78 36 TR_XM_SpammyWords4 22823 6.80 13.20 4.08 37 BOTNET_IPINHOSTNAME 22197 6.89 12.84 4.36 38 FSL_BULK_SIG 21896 6.90 12.66 4.45 39 XM_UncommonTLD01 19656 6.24 11.37 4.06 40 RCVD_IN_MSPIKE_H3 19230 10.71 11.12 10.53 41 BOTNET 19176 4.33 11.09 1.45 42 TR_XM_SpammyRelay 19110 4.34 11.05 1.48 43 UNPARSEABLE_RELAY 18398 8.65 10.64 7.80 44 XM_B_SpammyWords3 18333 6.06 10.60 4.13 45 TR_XM_SpammyWords2 18223 3.59 10.54 0.64 46 XMSexyCombo_05 15857 4.84 9.17 2.99 47 XM_Evil_Numbers_Gen 14892 7.68 8.61 7.29 48 MPART_ALT_DIFF 14576 7.25 8.43 6.75 49 BAYES_80 14463 5.22 8.36 3.89 50 UNTRUSTED_Relay 13445 3.15 7.77 1.18 51 BAYES_60 12927 8.07 7.48 8.32 52 XM_B_Phish_Phrases 12844 4.57 7.43 3.36 53 RCVD_IN_BL_SPAMCOP_NET 12698 2.48 7.34 0.42 54 TR_XM_PhishingBody 12592 3.97 7.28 2.56 55 LotsOfNums_01 12463 7.30 7.21 7.34 56 TooManyTo_001 12356 7.47 7.15 7.60 57 RELAYCOUNTRY_CA 11537 2.56 6.67 0.82 58 XM_H_Long_From01 11137 5.13 6.44 4.57 59 XMSubMetaSx_00 10762 3.72 6.22 2.66 60 XM_B_SpammyTLD 10705 3.30 6.19 2.08 61 TR_XM_UnparsRelay 10571 2.77 6.11 1.35 62 SpammyFromTLD_02 10063 1.88 5.82 0.20 63 MIME_HTML_ONLY_MULTI 9984 5.19 5.77 4.94 64 XM_SendGrid 9780 5.29 5.66 5.14 65 HTML_IMAGE_RATIO_02 9595 5.48 5.55 5.44 66 XM_B_Crypto 9404 6.61 5.44 7.11 67 TM2_M_VERY_LONG_WORD 9342 2.85 5.40 1.76 68 HTML_MIME_NO_HTML_TAG 8771 3.56 5.07 2.92 69 XM_SPF_SoftFail 8587 3.12 4.97 2.34 70 TR_XM_SPAMCOP 8532 1.63 4.93 0.23 71 BAYES_95 8445 3.06 4.88 2.29 72 XM_B_Phish66 7908 2.48 4.57 1.58 73 T_REMOTE_IMAGE 7678 4.10 4.44 3.95 74 TR_XM_SpammyWords5 7111 2.32 4.11 1.55 75 XM_CamelCaseFrm001 7036 2.27 4.07 1.50 76 XMLngstWrd_00 7027 2.03 4.06 1.16 77 HTML_IMAGE_RATIO_04 6980 3.60 4.04 3.41 78 XMLngstWrd_01 6940 1.96 4.01 1.09 79 XM_B_Investor 6789 2.02 3.93 1.20 80 PDS_OTHER_BAD_TLD 6643 1.26 3.84 0.17 81 RCVD_IN_MSPIKE_BL 6424 1.35 3.71 0.34 82 XM_GoogleGroups 6402 2.32 3.70 1.73 83 MIME_HTML_MOSTLY 6398 2.79 3.70 2.40 84 XM_UB50 6332 1.67 3.66 0.82 85 XMLngstWrd_02 6317 1.79 3.65 0.99 86 XMNumbers 6317 3.80 3.65 3.87 87 XMStrtUSub 6215 4.48 3.59 4.86 88 TR_XM_MSPIKECOMBO 6199 1.31 3.58 0.34 89 HTML_IMAGE_RATIO_06 6141 3.36 3.55 3.28 90 XMLngstWrd_03 6126 1.70 3.54 0.91 91 FROM_SUSPICIOUS_NTLD 6062 1.07 3.51 0.04 92 TR_XM_DK_SendGrid 6032 3.42 3.49 3.39 93 MIME_QP_LONG_LINE 5858 4.12 3.39 4.44 94 T_XMDrugObfuBody_14 5818 1.97 3.36 1.38 95 HELO_NODOT 5763 2.29 3.33 1.85 96 FROM_SUSPICIOUS_NTLD_FP 5738 1.01 3.32 0.03 97 HELO_NO_DOMAIN 5693 2.28 3.29 1.84 98 LongTLD 5638 1.12 3.26 0.20 99 XM_OfRef6 5587 1.71 3.23 1.06 100 HTML_TITLE_SUBJ_DIFF 5585 1.42 3.23 0.65 101 XMLngstWrd_04 5573 1.55 3.22 0.83 102 MISSING_HEADERS 5556 1.44 3.21 0.68 103 T_XMDrugObfuBody_08 5531 1.84 3.20 1.26 104 RCVD_IN_VALIDITY_SAFE 5454 3.87 3.15 4.17 105 TM2_M_URI_OPT_OUT 5425 3.82 3.14 4.12 106 SpammyFromTLD_01 5376 1.60 3.11 0.96 107 XM_DIRTYINTL 5307 1.10 3.07 0.26 108 UPPERCASE_75_100 5281 1.34 3.05 0.61 109 RCVD_IN_VALIDITY_RPBL 5156 0.90 2.98 0.02 110 TR_LOTS_OF_MONEY1 5085 1.07 2.94 0.28 111 XMDiploma_00 4980 1.80 2.88 1.34 112 DKIM_INVALID 4935 2.90 2.85 2.92 113 ANY_BOUNCE_MESSAGE 4859 3.35 2.81 3.58 114 BOUNCE_MESSAGE 4859 3.35 2.81 3.58 115 URIBL_DBL_SPAM 4825 0.84 2.79 0.01 116 RCVD_IN_VALIDITY_CERTIFIED 4753 3.35 2.75 3.61 117 XMBody_17 4579 1.28 2.65 0.70 118 HTML_IMAGE_RATIO_08 4497 2.07 2.60 1.84 119 URIBL_DBL_PHISH 4492 3.92 2.60 4.48 120 TR_LOTS_OF_MONEY3 4364 0.98 2.52 0.32 121 T_FILL_THIS_FORM_SHORT 4225 1.38 2.44 0.92 122 URIBL_DBL_MALWARE 4188 2.19 2.42 2.09 123 URI_NOVOWEL 4187 2.23 2.42 2.15 124 USER_IN_DEF_DKIM_WL 4086 8.53 2.36 11.16 125 XM_B_Unsub2 4079 1.64 2.36 1.33 126 ALL_TRUSTED 3957 13.61 2.29 18.43 127 SUBJ_ALL_CAPS 3819 1.93 2.21 1.81 128 RCVD_IN_IADB_LISTED 3811 3.80 2.20 4.48 129 BOTNET_NORDNS 3793 0.66 2.19 0.01 130 T_TooManySym_01 3763 4.77 2.18 5.88 131 TR_XM_PHPDW 3760 1.16 2.17 0.72 132 XM_B_SpammyWords4 3742 0.95 2.16 0.44 133 XM_DK_Undo_01 3691 1.65 2.13 1.45 134 TR_XM_PHPForged 3672 1.12 2.12 0.69 135 XM_URI_RBL 3659 0.72 2.12 0.12 136 TR_XM_FormFill2 3628 1.11 2.10 0.69 137 XM_H_PHPOS 3620 1.10 2.09 0.68 138 RCVD_IN_PSBL 3612 0.87 2.09 0.36 139 RCVD_IN_MSPIKE_H4 3588 3.62 2.07 4.28 140 RCVD_IN_MSPIKE_L3 3567 0.83 2.06 0.31 141 TR_XM_SB_Phish 3458 2.89 2.00 3.27 142 HTML_IMAGE_ONLY_24 3452 0.85 2.00 0.36 143 XMSubPhish11 3337 2.86 1.93 3.25 144 HTTP_EXCESSIVE_ESCAPES 3331 0.59 1.93 0.02 145 FROM_EXCESS_BASE64 3306 2.13 1.91 2.22 146 RCVD_IN_IADB_SPF 3257 3.35 1.88 3.98 147 XM_B_COVIDMETA 3240 0.84 1.87 0.40 148 KHOP_HELO_FCRDNS 3234 1.42 1.87 1.23 149 RCVD_IN_IADB_DK 3088 2.95 1.79 3.45 150 RCVD_IN_IADB_SENDERID 3059 3.03 1.77 3.57 151 URI_HEX 3052 1.43 1.76 1.29 152 XM_UB99 3043 0.53 1.76 0.00 153 TR_XM_SpammyWords3 3020 0.65 1.75 0.18 154 TR_XM_NoHeaderRelay 3005 0.59 1.74 0.10 155 XMStockSpam_06 2936 1.39 1.70 1.26 156 BAYES_40 2914 3.92 1.69 4.86 157 XMSexyCombo_01 2913 0.77 1.68 0.38 158 T_XMDrugObfuBody_00 2773 1.03 1.60 0.79 159 TR_XM_MSPIKECOMBO2 2729 0.49 1.58 0.03 160 MAILING_LIST_MULTI 2613 2.08 1.51 2.32 161 XMGenDplmaNmb 2542 0.90 1.47 0.66 162 XM_H_Undi_Recip 2499 0.63 1.45 0.28 163 XM_H_Long_From02 2481 1.20 1.43 1.10 164 XMReplyNow 2446 0.59 1.41 0.24 165 XM_UB999 2432 0.42 1.41 0.00 166 XMBrknScrpt_02 2392 1.04 1.38 0.90 167 HTTPS_HTTP_MISMATCH 2371 1.01 1.37 0.85 168 URI_OPTOUT_3LD 2313 0.44 1.34 0.06 169 MPART_ALT_DIFF_COUNT 2312 0.78 1.34 0.54 170 LONGLN_LOW_CONTRAST 2310 0.59 1.34 0.27 171 XMBdyGiftCard01 2287 0.84 1.32 0.63 172 BAYES_20 2287 2.95 1.32 3.64 173 TR_XM_FormFill 2231 0.40 1.29 0.03 174 DATE_IN_PAST_03_06 2220 0.49 1.28 0.16 175 TR_XM_PhishingBody2 2199 0.40 1.27 0.03 176 RCVD_IN_MSPIKE_L5 2198 0.40 1.27 0.03 177 URIBL_BLACK 2111 0.39 1.22 0.04 178 TR_XM_InvalidRelay 2072 0.37 1.20 0.02 179 T_XMHurry_00 2061 0.64 1.19 0.40 180 HTML_TAG_BALANCE_BODY 2057 0.83 1.19 0.68 181 DATE_IN_PAST_06_12 2048 0.38 1.18 0.04 182 XMHTML_After_End 2026 0.86 1.17 0.72 183 RELAYCOUNTRY_AU 1995 0.53 1.15 0.26 184 RELAYCOUNTRY_RU 1937 0.35 1.12 0.02 185 RELAYCOUNTRY_FR 1933 0.48 1.12 0.20 186 HK_RANDOM_REPLYTO 1915 0.37 1.11 0.05 187 TR_XM_Base64_M1 1909 0.94 1.10 0.87 188 FONT_INVIS_LONG_LINE 1904 0.37 1.10 0.06 189 TR_Mismatch_TLD_02 1900 0.38 1.10 0.08 190 MIME_BASE64_TEXT 1898 0.43 1.10 0.15 191 XMPhish30 1883 0.58 1.09 0.37 192 TR_Symld_Words 1775 1.63 1.03 1.88 193 SUBJ_DOLLARS 1769 0.47 1.02 0.23 194 RCVD_IN_IADB_VOUCHED 1762 2.20 1.02 2.70 195 TR_XM_COVIDMETA1 1659 0.39 0.96 0.14 196 TR_XM_MaxSPIKE 1633 0.31 0.94 0.03 197 XM_ProductURIs 1623 0.53 0.94 0.35 198 DIET_1 1618 0.40 0.94 0.18 199 XMSubMetaI_00 1612 0.59 0.93 0.44 200 TR_XM_Spammywords 1596 0.44 0.92 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 353739 89.42 95.12 87.00 2 RELAYCOUNTRY_US 322499 80.28 82.55 79.32 3 DKIM_SIGNED 292404 75.60 84.25 71.92 4 DCC_CHECK_NEGATIVE 284818 58.34 30.81 70.05 5 XM_DK_Pass 284377 73.59 82.18 69.94 6 DKIM_VALID 280548 72.70 81.39 69.00 7 XM_B_Unicode 250489 65.71 75.36 61.61 8 BAYES_50 240282 54.30 43.03 59.10 9 DKIM_VALID_AU 225379 57.92 63.77 55.43 10 XMListUnsubscribeExists 171302 49.61 67.19 42.13 11 XM_B_SpammyWords 159709 46.95 64.99 39.28 12 RCVD_IN_MSPIKE_H2 143692 38.20 44.92 35.34 13 XM_B_Unicode3 141731 36.47 40.27 34.86 14 T_TM2_M_HEADER_IN_MSG 134158 30.55 24.80 33.00 15 DCC_CHECK 121578 41.62 69.17 29.90 16 DKIM_VALID_EF 104949 27.54 31.60 25.81 17 HTML_FONT_LOW_CONTRAST 98045 27.43 35.23 24.11 18 FVGT_m_MULTI_ODD 91323 25.71 33.33 22.46 19 MIME_HTML_ONLY 87277 24.44 31.43 21.47 20 LOC_TINY_FONT_1 80806 24.61 35.76 19.87 21 XMSubLong 75723 19.19 20.53 18.62 22 ALL_TRUSTED 74939 13.61 2.29 18.43 23 T_KAM_HTML_FONT_INVALID 66479 19.42 26.65 16.35 24 XM_B_SpammyWords2 65285 21.84 35.43 16.06 25 RCVD_IN_MSPIKE_WL 64173 15.08 13.42 15.78 26 LOTS_OF_MONEY 53100 14.51 17.93 13.06 27 USER_IN_DEF_DKIM_WL 45374 8.53 2.36 11.16 28 XM_Multi_Part_URI 45154 13.25 18.29 11.11 29 BAYES_00 45103 8.04 0.85 11.09 30 XM_Body_Dirty_Words 42992 13.78 21.32 10.57 31 RCVD_IN_MSPIKE_H3 42811 10.71 11.12 10.53 32 XM_B_Unsub 37290 10.88 14.88 9.17 33 XM_DKIMWhitelistDomains 34088 5.92 0.11 8.38 34 BAYES_60 33835 8.07 7.48 8.32 35 UNPARSEABLE_RELAY 31720 8.65 10.64 7.80 36 TooManyTo_001 30907 7.47 7.15 7.60 37 LotsOfNums_01 29826 7.30 7.21 7.34 38 XM_Evil_Numbers_Gen 29637 7.68 8.61 7.29 39 XM_B_Crypto 28925 6.61 5.44 7.11 40 MPART_ALT_DIFF 27461 7.25 8.43 6.75 41 XM_PDF 25823 4.67 0.72 6.35 42 IN_ZIMBRA_NJ_WHITELIST 24291 4.21 0.06 5.97 43 T_TooManySym_01 23896 4.77 2.18 5.88 44 XM_DK_Undo_02 23578 15.68 38.93 5.80 45 TR_XM_BayesUnsub 22959 8.30 14.53 5.65 46 TR_XM_DK_Bayes 22806 4.09 0.51 5.61 47 MIME_HEADER_CTYPE_ONLY 22597 3.94 0.15 5.56 48 TR_XM_DK_Bayes1 22305 4.00 0.51 5.49 49 HTML_IMAGE_RATIO_02 22135 5.48 5.55 5.44 50 MY_SERVERS_FOUND 21397 3.74 0.16 5.26 51 XM_SendGrid 20899 5.29 5.66 5.14 52 MIME_HTML_ONLY_MULTI 20071 5.19 5.77 4.94 53 BAYES_40 19779 3.92 1.69 4.86 54 XMStrtUSub 19747 4.48 3.59 4.86 55 TR_XM_DK_Bayes2 19390 3.48 0.45 4.77 56 XM_H_Long_From01 18563 5.13 6.44 4.57 57 BAYES_99 18269 12.62 31.73 4.49 58 RCVD_IN_IADB_LISTED 18214 3.80 2.20 4.48 59 URIBL_DBL_PHISH 18197 3.92 2.60 4.48 60 FSL_BULK_SIG 18106 6.90 12.66 4.45 61 MIME_QP_LONG_LINE 18041 4.12 3.39 4.44 62 BOTNET_IPINHOSTNAME 17726 6.89 12.84 4.36 63 RCVD_IN_MSPIKE_H4 17383 3.62 2.07 4.28 64 RCVD_IN_VALIDITY_SAFE 16953 3.87 3.15 4.17 65 XM_B_SpammyWords3 16801 6.06 10.60 4.13 66 TM2_M_URI_OPT_OUT 16731 3.82 3.14 4.12 67 TR_XM_SpammyWords4 16606 6.80 13.20 4.08 68 XM_UncommonTLD01 16508 6.24 11.37 4.06 69 TR_XM_DKIM_Undo 16341 12.07 30.99 4.02 70 RCVD_IN_IADB_SPF 16173 3.35 1.88 3.98 71 T_REMOTE_IMAGE 16057 4.10 4.44 3.95 72 BAYES_80 15811 5.22 8.36 3.89 73 XMNumbers 15731 3.80 3.65 3.87 74 BAYES_20 14809 2.95 1.32 3.64 75 RCVD_IN_VALIDITY_CERTIFIED 14677 3.35 2.75 3.61 76 BAYES_999 14592 9.89 24.71 3.59 77 ANY_BOUNCE_MESSAGE 14576 3.35 2.81 3.58 78 BOUNCE_MESSAGE 14574 3.35 2.81 3.58 79 RCVD_IN_IADB_SENDERID 14512 3.03 1.77 3.57 80 T_TooManySym_02 14479 2.68 0.61 3.56 81 RCVD_IN_IADB_DK 14009 2.95 1.79 3.45 82 RELAYCOUNTRY_META 13896 7.96 18.63 3.42 83 HTML_IMAGE_RATIO_04 13872 3.60 4.04 3.41 84 TR_XM_DK_SendGrid 13786 3.42 3.49 3.39 85 XM_B_Phish_Phrases 13664 4.57 7.43 3.36 86 XM_H_Trusted_IP 13468 2.32 0.00 3.31 87 HTML_IMAGE_RATIO_06 13354 3.36 3.55 3.28 88 TR_XM_SB_Phish 13311 2.89 2.00 3.27 89 XMSubPhish11 13212 2.86 1.93 3.25 90 XMSexyCombo_05 12168 4.84 9.17 2.99 91 HTML_MIME_NO_HTML_TAG 11880 3.56 5.07 2.92 92 DKIM_INVALID 11856 2.90 2.85 2.92 93 RCVD_IN_IADB_VOUCHED 10965 2.20 1.02 2.70 94 XMSubMetaSx_00 10801 3.72 6.22 2.66 95 TR_XM_PhishingBody 10393 3.97 7.28 2.56 96 MIME_HTML_MOSTLY 9752 2.79 3.70 2.40 97 XM_SPF_SoftFail 9504 3.12 4.97 2.34 98 MAILING_LIST_MULTI 9414 2.08 1.51 2.32 99 BAYES_05 9388 1.82 0.66 2.31 100 BAYES_95 9306 3.06 4.88 2.29 101 FROM_EXCESS_BASE64 9031 2.13 1.91 2.22 102 URI_NOVOWEL 8728 2.23 2.42 2.15 103 TooManyTo_002 8627 1.66 0.58 2.12 104 URIBL_DBL_MALWARE 8512 2.19 2.42 2.09 105 XM_B_SpammyTLD 8444 3.30 6.19 2.08 106 TR_Symld_Words 7654 1.63 1.03 1.88 107 HELO_NODOT 7502 2.29 3.33 1.85 108 HELO_NO_DOMAIN 7501 2.28 3.29 1.84 109 HTML_IMAGE_RATIO_08 7500 2.07 2.60 1.84 110 RCVD_IN_IADB_OPTIN 7452 1.45 0.54 1.83 111 SUBJ_ALL_CAPS 7376 1.93 2.21 1.81 112 TM2_M_VERY_LONG_WORD 7166 2.85 5.40 1.76 113 XM_GoogleGroups 7014 2.32 3.70 1.73 114 TR_DCC_Bayes_99 6873 8.04 22.97 1.69 115 INVALID_MSGID 6781 1.21 0.12 1.67 116 IN_HORDE_ADDRESS_BOOK 6497 1.14 0.07 1.60 117 XM_B_Phish66 6442 2.48 4.57 1.58 118 T_OBFU_PDF_ATTACH 6434 1.15 0.14 1.58 119 TR_XM_SpammyWords5 6315 2.32 4.11 1.55 120 MSGID_NOFQDN1 6261 1.09 0.04 1.54 121 XM_CamelCaseFrm001 6116 2.27 4.07 1.50 122 TVD_RCVD_IP 6083 1.15 0.34 1.50 123 TR_XM_SpammyRelay 6028 4.34 11.05 1.48 124 TooManyTo_003 5966 1.17 0.47 1.47 125 TO_MALFORMED 5927 1.04 0.06 1.46 126 BOTNET 5908 4.33 11.09 1.45 127 XM_DK_Undo_01 5887 1.65 2.13 1.45 128 T_TooManySym_03 5784 1.08 0.26 1.42 129 TVD_SPACE_RATIO 5661 1.01 0.11 1.39 130 T_XMDrugObfuBody_14 5618 1.97 3.36 1.38 131 TR_XM_UnparsRelay 5508 2.77 6.11 1.35 132 XMDiploma_00 5432 1.80 2.88 1.34 133 XM_B_Unsub2 5397 1.64 2.36 1.33 134 URI_HEX 5225 1.43 1.76 1.29 135 XMStockSpam_06 5119 1.39 1.70 1.26 136 T_XMDrugObfuBody_08 5105 1.84 3.20 1.26 137 KHOP_HELO_FCRDNS 4985 1.42 1.87 1.23 138 XM_B_Investor 4889 2.02 3.93 1.20 139 UNTRUSTED_Relay 4796 3.15 7.77 1.18 140 XMLngstWrd_00 4728 2.03 4.06 1.16 141 XM_H_Long_From02 4483 1.20 1.43 1.10 142 XMLngstWrd_01 4417 1.96 4.01 1.09 143 TooManyTo_004 4397 0.88 0.42 1.08 144 XMCapTrack 4394 0.87 0.36 1.08 145 XMSubNoVowel 4367 0.92 0.54 1.07 146 XM_OfRef6 4312 1.71 3.23 1.06 147 XMLngstWrd_02 4032 1.79 3.65 0.99 148 XMBSHREFv2 3996 0.81 0.40 0.98 149 RCVD_IN_MSPIKE_H5 3979 0.75 0.22 0.98 150 SpammyFromTLD_01 3921 1.60 3.11 0.96 151 DKIM_ADSP_CUSTOM_MED 3790 0.88 0.75 0.93 152 T_FILL_THIS_FORM_SHORT 3750 1.38 2.44 0.92 153 XMLngstWrd_03 3706 1.70 3.54 0.91 154 XMBrknScrpt_02 3640 1.04 1.38 0.90 155 XMGappySubj_01 3546 0.68 0.21 0.87 156 TooManyTo_005 3536 0.72 0.36 0.87 157 TR_XM_Base64_M1 3525 0.94 1.10 0.87 158 RCVD_IN_RP_SAFE 3474 0.78 0.61 0.85 159 HTTPS_HTTP_MISMATCH 3462 1.01 1.37 0.85 160 XMLngstWrd_04 3394 1.55 3.22 0.83 161 XM_UB50 3334 1.67 3.66 0.82 162 RELAYCOUNTRY_CA 3320 2.56 6.67 0.82 163 T_XMDrugObfuBody_00 3199 1.03 1.60 0.79 164 HTML_FONT_FACE_BAD 3105 0.74 0.68 0.76 165 RCVD_IN_RP_CERTIFIED 3023 0.68 0.53 0.74 166 XMNoVowels 2995 0.68 0.54 0.74 167 FVGT_m_MULTI_ODD_EMAIL 2970 0.58 0.24 0.73 168 TR_XM_PHPDW 2940 1.16 2.17 0.72 169 XMHTML_After_End 2936 0.86 1.17 0.72 170 XMBody_95 2865 0.53 0.12 0.70 171 XMBody_17 2849 1.28 2.65 0.70 172 HTML_IMAGE_ONLY_20 2811 0.62 0.46 0.69 173 TR_XM_PHPForged 2808 1.12 2.12 0.69 174 TR_XM_FormFill2 2788 1.11 2.10 0.69 175 MISSING_HEADERS 2784 1.44 3.21 0.68 176 HTML_TAG_BALANCE_BODY 2775 0.83 1.19 0.68 177 XM_H_PHPOS 2769 1.10 2.09 0.68 178 XMGenDplmaNmb 2695 0.90 1.47 0.66 179 HTML_TITLE_SUBJ_DIFF 2627 1.42 3.23 0.65 180 TR_XM_SpammyWords2 2586 3.59 10.54 0.64 181 XMBdyGiftCard01 2569 0.84 1.32 0.63 182 UPPERCASE_75_100 2483 1.34 3.05 0.61 183 NML_ADSP_CUSTOM_MED 2466 0.60 0.57 0.61 184 XM_ShortIntro_01 2416 0.52 0.34 0.59 185 FROM_GOV_DKIM_AU 2343 0.51 0.36 0.58 186 TR_MetaPhish_Combo_01 2318 0.58 0.59 0.57 187 TM2_M_BODY_EMPTY 2292 0.44 0.16 0.56 188 XM_RXBody 2273 0.48 0.31 0.56 189 FORGED_GMAIL_RCVD 2246 0.56 0.59 0.55 190 MPART_ALT_DIFF_COUNT 2195 0.78 1.34 0.54 191 XM_H_PHPMailer 2156 0.58 0.69 0.53 192 XM_B_COPY_HTML 2073 0.55 0.64 0.51 193 BODY_ENHANCEMENT2 2003 0.35 0.01 0.49 194 URI_TRY_3LD 1885 0.59 0.87 0.46 195 RCVD_IN_SORBS_DUL 1817 0.39 0.27 0.45 196 SHORT_HELO_AND_INLINE_IMAGE 1794 0.33 0.07 0.44 197 XMSubMetaI_00 1793 0.59 0.93 0.44 198 HTML_IMAGE_ONLY_28 1787 0.48 0.58 0.44 199 XM_B_SpammyWords4 1772 0.95 2.16 0.44 200 HTML_IMAGE_ONLY_32 1737 0.34 0.12 0.43 ----------------------------------------------------------------------