Email: 589854 Autolearn: 0 AvgScore: 4.40 AvgScanTime: 1.38 sec Spam: 200579 Autolearn: 0 AvgScore: 12.90 AvgScanTime: 1.48 sec Ham: 389275 Autolearn: 0 AvgScore: 0.02 AvgScanTime: 1.34 sec Time Spent Running SA: 226.90 hours Time Spent Processing Spam: 82.45 hours Time Spent Processing Ham: 144.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 191057 90.46 95.25 87.99 2 DKIM_SIGNED 159937 75.49 79.74 73.31 3 RELAYCOUNTRY_US 159470 77.98 79.50 77.20 4 XM_DK_Pass 156899 73.80 78.22 71.53 5 DKIM_VALID 155343 72.96 77.45 70.65 6 XM_B_Unicode 138370 64.08 68.99 61.55 7 DCC_CHECK 135446 44.70 67.53 32.94 8 XM_B_SpammyWords 128071 47.84 63.85 39.59 9 XMListUnsubscribeExists 127015 50.40 63.32 43.74 10 DKIM_VALID_AU 120205 57.98 59.93 56.98 11 BAYES_50 98769 53.26 49.24 55.32 12 RCVD_IN_MSPIKE_H2 86997 38.87 43.37 36.55 13 XM_B_Unicode3 76921 37.16 38.35 36.55 14 XM_B_SpammyWords2 72609 23.32 36.20 16.69 15 XM_DK_Undo_02 70510 15.93 35.15 6.02 16 DCC_CHECK_NEGATIVE 65086 55.26 32.45 67.01 17 FVGT_m_MULTI_ODD 63851 26.67 31.83 24.01 18 LOC_TINY_FONT_1 61873 24.33 30.85 20.98 19 DKIM_VALID_EF 57956 26.84 28.89 25.78 20 HTML_FONT_LOW_CONTRAST 57334 25.59 28.58 24.05 21 TR_XM_DKIM_Undo 56568 12.19 28.20 3.94 22 MIME_HTML_ONLY 56165 20.63 28.00 16.83 23 BAYES_99 53901 12.12 26.87 4.52 24 T_KAM_HTML_FONT_INVALID 50197 19.84 25.03 17.17 25 LOTS_OF_MONEY 48537 20.30 24.20 18.30 26 XMSubLong 41428 20.10 20.65 19.82 27 BAYES_999 41424 9.44 20.65 3.66 28 XM_Body_Dirty_Words 41295 14.01 20.59 10.63 29 T_TM2_M_HEADER_IN_MSG 40805 27.44 20.34 31.09 30 RELAYCOUNTRY_META 37769 9.33 18.83 4.44 31 TR_DCC_Bayes_99 36406 7.22 18.15 1.58 32 XM_B_Unsub 34109 10.68 17.01 7.41 33 XM_Multi_Part_URI 33654 14.19 16.78 12.86 34 TR_XM_BayesUnsub 33597 9.64 16.75 5.97 35 FSL_BULK_SIG 30107 8.57 15.01 5.26 36 XM_B_Crypto 27977 13.28 13.95 12.94 37 TR_XM_SpammyRelay 27094 5.62 13.51 1.56 38 URIBL_DBL_PHISH 26695 12.05 13.31 11.40 39 TR_XM_SpammyWords4 26075 7.24 13.00 4.27 40 RCVD_IN_MSPIKE_WL 25105 15.37 12.52 16.84 41 XM_B_SpammyWords3 24363 6.65 12.15 3.82 42 XM_UncommonTLD01 24321 6.89 12.13 4.20 43 BOTNET_IPINHOSTNAME 23385 7.12 11.66 4.78 44 RCVD_IN_MSPIKE_H3 21178 11.19 10.56 11.51 45 XMSexyCombo_05 20026 5.32 9.98 2.91 46 TR_XM_SpammyWords2 19030 3.69 9.49 0.70 47 UNPARSEABLE_RELAY 18268 8.17 9.11 7.69 48 TR_XM_PhishingBody 17845 5.32 8.90 3.48 49 LotsOfNums_01 17501 8.31 8.73 8.10 50 HELO_NODOT 17484 4.14 8.72 1.78 51 HELO_NO_DOMAIN 17476 4.13 8.71 1.78 52 RELAYCOUNTRY_CA 17326 4.23 8.64 1.96 53 MISSING_HEADERS 17015 3.31 8.48 0.65 54 TR_LOTS_OF_MONEY1 16632 3.02 8.29 0.30 55 XM_B_Phish_Phrases 16532 4.52 8.24 2.60 56 BAYES_80 15898 6.74 7.93 6.13 57 BOTNET 15869 3.73 7.91 1.58 58 MPART_ALT_DIFF 15828 5.36 7.89 4.05 59 TooManyTo_001 14568 7.40 7.26 7.47 60 BAYES_60 14144 11.47 7.05 13.75 61 UNTRUSTED_Relay 14044 3.17 7.00 1.19 62 RCVD_IN_BL_SPAMCOP_NET 13947 2.71 6.95 0.52 63 XM_Evil_Numbers_Gen 13847 6.83 6.90 6.80 64 XM_B_Phish66 13238 3.43 6.60 1.80 65 XM_OfRef6 13170 2.81 6.57 0.87 66 XM_B_SpammyTLD 12413 3.68 6.19 2.39 67 ANY_BOUNCE_MESSAGE 11573 9.10 5.77 10.82 68 BOUNCE_MESSAGE 11572 9.10 5.77 10.82 69 XM_SendGrid 11424 5.40 5.70 5.25 70 TM2_M_VERY_LONG_WORD 11246 2.95 5.61 1.59 71 XM_B_Investor 11197 2.75 5.58 1.29 72 TR_XM_UnparsRelay 10749 2.69 5.36 1.31 73 HTML_IMAGE_RATIO_02 10496 5.08 5.23 5.00 74 TR_XM_SPAMCOP 10421 1.98 5.20 0.32 75 XMLngstWrd_00 9908 2.28 4.94 0.91 76 XMLngstWrd_01 9854 2.23 4.91 0.85 77 XMNumbers 9808 3.96 4.89 3.48 78 XMSubMetaSx_00 9744 3.95 4.86 3.47 79 MIME_HTML_ONLY_MULTI 9538 3.26 4.76 2.49 80 ALL_TRUSTED 9262 14.30 4.62 19.29 81 XM_H_Long_From01 9124 4.93 4.55 5.12 82 BAYES_95 9017 3.29 4.50 2.67 83 MIME_HTML_MOSTLY 8705 2.98 4.34 2.29 84 RCVD_IN_MSPIKE_BL 8512 1.64 4.24 0.30 85 TR_XM_MSPIKECOMBO 8468 1.63 4.22 0.29 86 T_XMDrugObfuBody_08 8381 2.42 4.18 1.52 87 SpammyFromTLD_02 8262 1.64 4.12 0.37 88 HTML_IMAGE_RATIO_04 8183 4.32 4.08 4.44 89 XMBody_17 7760 1.78 3.87 0.71 90 HTML_MIME_NO_HTML_TAG 7691 2.69 3.83 2.09 91 XM_SPF_SoftFail 7264 2.47 3.62 1.88 92 XMStrtUSub 7241 3.98 3.61 4.16 93 URI_OPTOUT_3LD 7156 1.32 3.57 0.16 94 T_FILL_THIS_FORM_SHORT 7112 1.75 3.55 0.82 95 TR_XM_PhishingBody2 7031 1.21 3.51 0.02 96 T_XMDrugObfuBody_14 6962 2.10 3.47 1.40 97 XM_UB50 6862 1.66 3.42 0.75 98 PDS_OTHER_BAD_TLD 6822 1.32 3.40 0.25 99 TR_XM_DK_SendGrid 6693 3.46 3.34 3.52 100 SpammyFromTLD_01 6684 1.66 3.33 0.79 101 XM_DIRTYINTL 6502 1.31 3.24 0.32 102 XMLngstWrd_02 6304 1.58 3.14 0.77 103 TR_XM_SpammyWords5 6298 1.74 3.14 1.02 104 URI_NOVOWEL 6220 2.42 3.10 2.07 105 TR_XM_SpammyWords3 6156 1.15 3.07 0.16 106 XM_GoogleGroups 6081 2.08 3.03 1.59 107 HTML_IMAGE_RATIO_08 5968 2.36 2.98 2.05 108 MIME_QP_LONG_LINE 5904 3.92 2.94 4.42 109 XMLngstWrd_03 5901 1.43 2.94 0.65 110 XMLngstWrd_04 5415 1.31 2.70 0.60 111 URIBL_DBL_SPAM 5382 0.92 2.68 0.00 112 HTML_IMAGE_RATIO_06 5179 2.92 2.58 3.09 113 UPPERCASE_75_100 5094 1.20 2.54 0.50 114 TR_XM_PHPDW 5091 1.11 2.54 0.37 115 HTML_TITLE_SUBJ_DIFF 5088 1.21 2.54 0.53 116 TR_XM_PHPForged 5032 1.08 2.51 0.34 117 T_REMOTE_IMAGE 4999 3.34 2.49 3.77 118 TR_XM_FormFill2 4976 1.06 2.48 0.33 119 XM_H_PHPOS 4969 1.06 2.48 0.33 120 TR_XM_NoHeaderRelay 4851 0.89 2.42 0.11 121 RCVD_IN_VALIDITY_SAFE 4813 3.51 2.40 4.08 122 LongTLD 4791 0.99 2.39 0.27 123 TM2_M_URI_OPT_OUT 4744 1.93 2.37 1.70 124 XMDiploma_00 4693 1.65 2.34 1.30 125 DKIM_INVALID 4594 2.53 2.29 2.65 126 XM_B_Unsub2 4537 1.67 2.26 1.37 127 INVESTMENT_ADVICE 4394 0.81 2.19 0.09 128 XM_DK_Undo_01 4343 1.68 2.17 1.43 129 TR_XM_FormFill 4313 0.74 2.15 0.01 130 RCVD_IN_MSPIKE_L5 4259 0.74 2.12 0.02 131 FROM_SUSPICIOUS_NTLD 4227 0.75 2.11 0.05 132 KHOP_HELO_FCRDNS 4096 1.55 2.04 1.29 133 FROM_SUSPICIOUS_NTLD_FP 3974 0.70 1.98 0.04 134 RCVD_IN_VALIDITY_CERTIFIED 3949 3.01 1.97 3.55 135 RCVD_IN_MSPIKE_L3 3869 0.83 1.93 0.27 136 USER_IN_DEF_DKIM_WL 3822 8.09 1.91 11.28 137 XM_CamelCaseFrm001 3791 1.81 1.89 1.76 138 HK_RANDOM_REPLYTO 3778 0.70 1.88 0.09 139 XM_B_SpammyWords4 3764 1.00 1.88 0.54 140 XM_URI_RBL 3717 0.72 1.85 0.14 141 RCVD_IN_IADB_LISTED 3704 3.53 1.85 4.40 142 FROM_EXCESS_BASE64 3703 2.25 1.85 2.47 143 RCVD_IN_MSPIKE_H4 3647 3.48 1.82 4.34 144 RELAYCOUNTRY_IN 3588 0.63 1.79 0.03 145 T_TooManySym_01 3426 4.39 1.71 5.77 146 T_XMHurry_00 3291 0.88 1.64 0.49 147 RCVD_IN_IADB_SPF 3253 3.16 1.62 3.95 148 URI_PHP_REDIR 3203 0.54 1.60 0.00 149 FONT_INVIS_LONG_LINE 3184 0.59 1.59 0.07 150 BAYES_40 3178 3.35 1.58 4.27 151 DATE_IN_PAST_12_24 3151 0.56 1.57 0.04 152 RCVD_IN_IADB_DK 3108 2.83 1.55 3.49 153 RCVD_IN_IADB_SENDERID 3075 2.88 1.53 3.58 154 URI_HEX 3049 1.83 1.52 1.99 155 XMSexyCombo_01 3044 0.93 1.52 0.62 156 MAILING_LIST_MULTI 3000 2.00 1.50 2.25 157 TR_XM_Crypto2 2974 1.11 1.48 0.93 158 TM2_M_BODY_EMPTY 2959 0.80 1.48 0.45 159 XM_B_COVIDMETA 2923 0.71 1.46 0.33 160 XMEmptyBody_01 2903 0.57 1.45 0.11 161 TR_XM_SB_Phish 2871 1.75 1.43 1.92 162 XMSubPhish11 2774 1.73 1.38 1.90 163 SUBJ_ALL_CAPS 2738 1.32 1.37 1.30 164 XMBdyGiftCard01 2732 1.06 1.36 0.90 165 URI_TRY_3LD 2710 0.81 1.35 0.54 166 BAYES_20 2700 2.54 1.35 3.16 167 RCVD_IN_VALIDITY_RPBL 2688 0.46 1.34 0.01 168 XMStockSpam_06 2660 1.22 1.33 1.16 169 T_XMDrugObfuBody_00 2640 0.86 1.32 0.63 170 RCVD_IN_PSBL 2607 0.64 1.30 0.30 171 XMBrknScrpt_02 2545 0.93 1.27 0.76 172 HTTPS_HTTP_MISMATCH 2531 0.97 1.26 0.82 173 XM_H_Undi_Recip 2464 0.59 1.23 0.26 174 XMHTML_After_End 2313 1.06 1.15 1.01 175 XMGenDplmaNmb 2263 0.86 1.13 0.72 176 XMReplyNow 2257 0.54 1.13 0.24 177 TR_LOTS_OF_MONEY3 2223 0.62 1.11 0.37 178 TR_XM_RelayPhish 2218 0.41 1.11 0.05 179 XM_UB60 2176 0.42 1.08 0.07 180 HTML_TAG_BALANCE_BODY 2127 0.93 1.06 0.87 181 URIBL_BLACK 2107 0.38 1.05 0.04 182 TR_Symld_Words 2093 1.54 1.04 1.79 183 RELAYCOUNTRY_AU 2091 0.60 1.04 0.37 184 BOTNET_NORDNS 2049 0.36 1.02 0.02 185 TR_XM_COVIDMETA1 1975 0.62 0.98 0.43 186 TR_XM_MSPIKECOMBO2 1971 0.34 0.98 0.01 187 NO_DNS_FOR_FROM 1954 0.54 0.97 0.32 188 XM_UB99 1953 0.33 0.97 0.00 189 XM_B_SEO 1933 0.41 0.96 0.12 190 TR_XM_MaxWHORU 1908 0.46 0.95 0.21 191 SHOPIFY_IMG_NOT_RCVD_SFY 1891 0.47 0.94 0.22 192 TR_XM_SEO4 1891 0.37 0.94 0.08 193 MPART_ALT_DIFF_COUNT 1850 0.68 0.92 0.55 194 TR_XM_Crypto3 1832 0.32 0.91 0.02 195 XM_OfRef7 1825 0.39 0.91 0.13 196 XMPhish30 1811 0.79 0.90 0.73 197 TR_XM_COVIDMETA4 1799 0.39 0.90 0.14 198 HTML_FONT_FACE_BAD 1753 0.91 0.87 0.93 199 RELAYCOUNTRY_RU 1729 0.30 0.86 0.01 200 TR_XM_InvalidRelay 1726 0.31 0.86 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 342520 90.46 95.25 87.99 2 RELAYCOUNTRY_US 300506 77.98 79.50 77.20 3 DKIM_SIGNED 285360 75.49 79.74 73.31 4 XM_DK_Pass 278442 73.80 78.22 71.53 5 DKIM_VALID 275038 72.96 77.45 70.65 6 DCC_CHECK_NEGATIVE 260869 55.26 32.45 67.01 7 XM_B_Unicode 239602 64.08 68.99 61.55 8 DKIM_VALID_AU 221796 57.98 59.93 56.98 9 BAYES_50 215366 53.26 49.24 55.32 10 XMListUnsubscribeExists 170284 50.40 63.32 43.74 11 XM_B_SpammyWords 154127 47.84 63.85 39.59 12 XM_B_Unicode3 142298 37.16 38.35 36.55 13 RCVD_IN_MSPIKE_H2 142276 38.87 43.37 36.55 14 DCC_CHECK 128223 44.70 67.53 32.94 15 T_TM2_M_HEADER_IN_MSG 121030 27.44 20.34 31.09 16 DKIM_VALID_EF 100336 26.84 28.89 25.78 17 HTML_FONT_LOW_CONTRAST 93605 25.59 28.58 24.05 18 FVGT_m_MULTI_ODD 93451 26.67 31.83 24.01 19 LOC_TINY_FONT_1 81663 24.33 30.85 20.98 20 XMSubLong 77150 20.10 20.65 19.82 21 ALL_TRUSTED 75078 14.30 4.62 19.29 22 LOTS_OF_MONEY 71225 20.30 24.20 18.30 23 T_KAM_HTML_FONT_INVALID 66824 19.84 25.03 17.17 24 RCVD_IN_MSPIKE_WL 65540 15.37 12.52 16.84 25 MIME_HTML_ONLY 65505 20.63 28.00 16.83 26 XM_B_SpammyWords2 64960 23.32 36.20 16.69 27 BAYES_60 53525 11.47 7.05 13.75 28 XM_B_Crypto 50385 13.28 13.95 12.94 29 XM_Multi_Part_URI 50044 14.19 16.78 12.86 30 RCVD_IN_MSPIKE_H3 44801 11.19 10.56 11.51 31 URIBL_DBL_PHISH 44396 12.05 13.31 11.40 32 USER_IN_DEF_DKIM_WL 43925 8.09 1.91 11.28 33 BOUNCE_MESSAGE 42120 9.10 5.77 10.82 34 ANY_BOUNCE_MESSAGE 42120 9.10 5.77 10.82 35 XM_Body_Dirty_Words 41371 14.01 20.59 10.63 36 BAYES_00 32100 5.72 0.81 8.25 37 XM_DKIMWhitelistDomains 32067 5.45 0.05 8.24 38 LotsOfNums_01 31534 8.31 8.73 8.10 39 UNPARSEABLE_RELAY 29937 8.17 9.11 7.69 40 TooManyTo_001 29076 7.40 7.26 7.47 41 XM_B_Unsub 28864 10.68 17.01 7.41 42 XM_Evil_Numbers_Gen 26456 6.83 6.90 6.80 43 BAYES_80 23847 6.74 7.93 6.13 44 XM_DK_Undo_02 23428 15.93 35.15 6.02 45 TR_XM_BayesUnsub 23236 9.64 16.75 5.97 46 IN_ZIMBRA_NJ_WHITELIST 23155 3.95 0.06 5.95 47 MIME_HEADER_CTYPE_ONLY 22907 3.96 0.24 5.88 48 T_TooManySym_01 22462 4.39 1.71 5.77 49 TR_XM_DK_Bayes 22422 4.03 0.66 5.76 50 TR_XM_DK_Bayes1 22057 3.96 0.66 5.67 51 FSL_BULK_SIG 20462 8.57 15.01 5.26 52 XM_SendGrid 20438 5.40 5.70 5.25 53 XM_H_Long_From01 19948 4.93 4.55 5.12 54 HTML_IMAGE_RATIO_02 19467 5.08 5.23 5.00 55 TR_XM_DK_Bayes2 19018 3.44 0.63 4.89 56 BOTNET_IPINHOSTNAME 18591 7.12 11.66 4.78 57 BAYES_99 17614 12.12 26.87 4.52 58 HTML_IMAGE_RATIO_04 17285 4.32 4.08 4.44 59 RELAYCOUNTRY_META 17279 9.33 18.83 4.44 60 MIME_QP_LONG_LINE 17213 3.92 2.94 4.42 61 RCVD_IN_IADB_LISTED 17116 3.53 1.85 4.40 62 RCVD_IN_MSPIKE_H4 16897 3.48 1.82 4.34 63 TR_XM_SpammyWords4 16611 7.24 13.00 4.27 64 BAYES_40 16611 3.35 1.58 4.27 65 XM_PDF 16525 2.99 0.56 4.25 66 XM_UncommonTLD01 16341 6.89 12.13 4.20 67 XMStrtUSub 16206 3.98 3.61 4.16 68 RCVD_IN_VALIDITY_SAFE 15885 3.51 2.40 4.08 69 MPART_ALT_DIFF 15784 5.36 7.89 4.05 70 RCVD_IN_IADB_SPF 15379 3.16 1.62 3.95 71 TR_XM_DKIM_Undo 15352 12.19 28.20 3.94 72 XM_B_SpammyWords3 14879 6.65 12.15 3.82 73 T_REMOTE_IMAGE 14677 3.34 2.49 3.77 74 BAYES_999 14233 9.44 20.65 3.66 75 RCVD_IN_IADB_SENDERID 13932 2.88 1.53 3.58 76 RCVD_IN_VALIDITY_CERTIFIED 13826 3.01 1.97 3.55 77 T_TooManySym_02 13795 2.54 0.59 3.54 78 TR_XM_DK_SendGrid 13707 3.46 3.34 3.52 79 RCVD_IN_IADB_DK 13586 2.83 1.55 3.49 80 XMNumbers 13549 3.96 4.89 3.48 81 TR_XM_PhishingBody 13547 5.32 8.90 3.48 82 MY_SERVERS_FOUND 13528 2.36 0.19 3.48 83 XMSubMetaSx_00 13526 3.95 4.86 3.47 84 BAYES_20 12294 2.54 1.35 3.16 85 HTML_IMAGE_RATIO_06 12038 2.92 2.58 3.09 86 XMSexyCombo_05 11340 5.32 9.98 2.91 87 BAYES_95 10399 3.29 4.50 2.67 88 DKIM_INVALID 10322 2.53 2.29 2.65 89 RCVD_IN_IADB_VOUCHED 10271 2.01 0.80 2.64 90 XM_B_Phish_Phrases 10137 4.52 8.24 2.60 91 MIME_HTML_ONLY_MULTI 9689 3.26 4.76 2.49 92 FROM_EXCESS_BASE64 9597 2.25 1.85 2.47 93 XM_B_SpammyTLD 9294 3.68 6.19 2.39 94 MIME_HTML_MOSTLY 8898 2.98 4.34 2.29 95 MAILING_LIST_MULTI 8770 2.00 1.50 2.25 96 HTML_MIME_NO_HTML_TAG 8152 2.69 3.83 2.09 97 URI_NOVOWEL 8066 2.42 3.10 2.07 98 HTML_IMAGE_RATIO_08 7977 2.36 2.98 2.05 99 URI_HEX 7766 1.83 1.52 1.99 100 TooManyTo_002 7744 1.49 0.54 1.99 101 RELAYCOUNTRY_CA 7615 4.23 8.64 1.96 102 BAYES_05 7512 1.50 0.68 1.93 103 TR_XM_SB_Phish 7477 1.75 1.43 1.92 104 XMSubPhish11 7402 1.73 1.38 1.90 105 XM_SPF_SoftFail 7304 2.47 3.62 1.88 106 XM_B_Phish66 7009 3.43 6.60 1.80 107 TR_Symld_Words 6964 1.54 1.04 1.79 108 INVALID_MSGID 6922 1.21 0.11 1.78 109 HELO_NODOT 6913 4.14 8.72 1.78 110 HELO_NO_DOMAIN 6910 4.13 8.71 1.78 111 XM_CamelCaseFrm001 6861 1.81 1.89 1.76 112 RCVD_IN_IADB_OPTIN 6720 1.29 0.44 1.73 113 TM2_M_URI_OPT_OUT 6637 1.93 2.37 1.70 114 MSGID_NOFQDN1 6384 1.09 0.02 1.64 115 IN_HORDE_ADDRESS_BOOK 6344 1.09 0.06 1.63 116 TM2_M_VERY_LONG_WORD 6183 2.95 5.61 1.59 117 XM_GoogleGroups 6175 2.08 3.03 1.59 118 TR_DCC_Bayes_99 6164 7.22 18.15 1.58 119 BOTNET 6154 3.73 7.91 1.58 120 TR_XM_SpammyRelay 6080 5.62 13.51 1.56 121 TO_MALFORMED 5961 1.01 0.01 1.53 122 T_XMDrugObfuBody_08 5911 2.42 4.18 1.52 123 TVD_RCVD_IP 5860 1.08 0.24 1.51 124 TVD_SPACE_RATIO 5592 0.98 0.09 1.44 125 XM_DK_Undo_01 5558 1.68 2.17 1.43 126 T_TooManySym_03 5544 1.02 0.24 1.42 127 T_XMDrugObfuBody_14 5438 2.10 3.47 1.40 128 XM_B_Unsub2 5324 1.67 2.26 1.37 129 TooManyTo_003 5116 1.02 0.44 1.31 130 TR_XM_UnparsRelay 5095 2.69 5.36 1.31 131 SUBJ_ALL_CAPS 5051 1.32 1.37 1.30 132 XMDiploma_00 5044 1.65 2.34 1.30 133 XM_B_Investor 5041 2.75 5.58 1.29 134 KHOP_HELO_FCRDNS 5029 1.55 2.04 1.29 135 UNTRUSTED_Relay 4634 3.17 7.00 1.19 136 XMStockSpam_06 4532 1.22 1.33 1.16 137 XMBSHREFv2 4504 0.84 0.23 1.16 138 XM_H_Long_From02 4409 1.03 0.84 1.13 139 XM_H_Trusted_IP 4403 0.75 0.00 1.13 140 XMGappySubj_01 4020 0.73 0.14 1.03 141 TR_XM_SpammyWords5 3973 1.74 3.14 1.02 142 XMHTML_After_End 3946 1.06 1.15 1.01 143 XMCapTrack 3879 0.76 0.30 1.00 144 RCVD_IN_MSPIKE_H5 3842 0.70 0.14 0.99 145 TooManyTo_004 3762 0.76 0.36 0.97 146 HTML_FONT_FACE_BAD 3639 0.91 0.87 0.93 147 TR_XM_Crypto2 3601 1.11 1.48 0.93 148 XMLngstWrd_00 3552 2.28 4.94 0.91 149 XMBdyGiftCard01 3517 1.06 1.36 0.90 150 XMBody_95 3510 0.64 0.14 0.90 151 XM_OfRef6 3386 2.81 6.57 0.87 152 HTML_TAG_BALANCE_BODY 3369 0.93 1.06 0.87 153 XMLngstWrd_01 3318 2.23 4.91 0.85 154 T_FILL_THIS_FORM_SHORT 3202 1.75 3.55 0.82 155 HTTPS_HTTP_MISMATCH 3196 0.97 1.26 0.82 156 DKIM_ADSP_CUSTOM_MED 3189 0.74 0.60 0.82 157 RCVD_IN_RP_SAFE 3161 0.70 0.49 0.81 158 TR_XM_Base64_M1 3088 0.78 0.76 0.79 159 SpammyFromTLD_01 3081 1.66 3.33 0.79 160 FROM_GOV_DKIM_AU 3032 0.66 0.43 0.78 161 XMLngstWrd_02 3011 1.58 3.14 0.77 162 XMBrknScrpt_02 2962 0.93 1.27 0.76 163 FVGT_m_MULTI_ODD_EMAIL 2960 0.55 0.13 0.76 164 TooManyTo_005 2948 0.60 0.30 0.76 165 XM_UB50 2906 1.66 3.42 0.75 166 XMPhish30 2843 0.79 0.90 0.73 167 XMGenDplmaNmb 2786 0.86 1.13 0.72 168 XMMailDelErr 2781 0.68 0.61 0.71 169 XMBody_17 2756 1.78 3.87 0.71 170 TR_XM_SpammyWords2 2737 3.69 9.49 0.70 171 RCVD_IN_RP_CERTIFIED 2729 0.60 0.41 0.70 172 MISSING_HEADERS 2530 3.31 8.48 0.65 173 XMLngstWrd_03 2528 1.43 2.94 0.65 174 TR_MetaPhish_Combo_01 2515 0.67 0.70 0.65 175 XMPhish14 2501 0.65 0.67 0.64 176 T_XMDrugObfuBody_00 2448 0.86 1.32 0.63 177 XMSexyCombo_01 2426 0.93 1.52 0.62 178 XMSubMetaSxObfu_03 2409 0.64 0.69 0.62 179 XM_ShortIntro_01 2352 0.52 0.36 0.60 180 XMLngstWrd_04 2319 1.31 2.70 0.60 181 T_OBFU_PDF_ATTACH 2309 0.42 0.08 0.59 182 XMSubNoVowel 2164 0.49 0.36 0.56 183 MPART_ALT_DIFF_COUNT 2136 0.68 0.92 0.55 184 XM_B_COPY_HTML 2131 0.54 0.52 0.55 185 XM_B_SpammyWords4 2108 1.00 1.88 0.54 186 URI_TRY_3LD 2087 0.81 1.35 0.54 187 XM_H_PHPMailer 2085 0.56 0.59 0.54 188 NML_ADSP_CUSTOM_MED 2051 0.51 0.48 0.53 189 HTML_TITLE_SUBJ_DIFF 2051 1.21 2.54 0.53 190 RCVD_IN_BL_SPAMCOP_NET 2043 2.71 6.95 0.52 191 HTML_IMAGE_ONLY_20 2039 0.63 0.84 0.52 192 XM_Body_Dirty_Words_01 2034 0.53 0.55 0.52 193 UPPERCASE_75_100 1965 1.20 2.54 0.50 194 T_XMHurry_00 1913 0.88 1.64 0.49 195 XMNoVowels 1846 0.39 0.23 0.47 196 FORGED_GMAIL_RCVD 1825 0.48 0.50 0.47 197 XMHTMLBadTable_001 1784 0.55 0.72 0.46 198 T_Symld_Words_02 1779 0.56 0.76 0.46 199 RELAYCOUNTRY_GB 1765 0.53 0.68 0.45 200 TM2_M_BODY_EMPTY 1757 0.80 1.48 0.45 ----------------------------------------------------------------------