Email: 587539 Autolearn: 0 AvgScore: 1.75 AvgScanTime: 1.33 sec Spam: 170114 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 1.53 sec Ham: 417425 Autolearn: 0 AvgScore: -3.08 AvgScanTime: 1.26 sec Time Spent Running SA: 217.84 hours Time Spent Processing Spam: 72.23 hours Time Spent Processing Ham: 145.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159409 90.05 93.71 88.56 2 DKIM_SIGNED 151338 70.35 88.96 62.76 3 XM_DK_Pass 147705 68.59 86.83 61.15 4 DKIM_VALID 145956 67.69 85.80 60.31 5 RELAYCOUNTRY_US 135778 80.05 79.82 80.15 6 XM_B_Unicode 134692 75.44 79.18 73.92 7 XMListUnsubscribeExists 121251 50.06 71.28 41.42 8 XM_B_SpammyWords 119673 52.42 70.35 45.11 9 DCC_CHECK 116599 39.75 68.54 28.02 10 DKIM_VALID_AU 113293 53.58 66.60 48.27 11 RCVD_IN_MSPIKE_H2 80507 37.40 47.33 33.35 12 XM_DK_Undo_02 72630 16.36 42.69 5.63 13 XM_B_Unicode3 71959 42.35 42.30 42.37 14 BAYES_50 71874 51.20 42.25 54.85 15 XM_B_SpammyWords2 71132 25.36 41.81 18.65 16 LOC_TINY_FONT_1 63255 24.81 37.18 19.76 17 FVGT_m_MULTI_ODD 59453 26.08 34.95 22.47 18 DKIM_VALID_EF 58412 26.76 34.34 23.67 19 TR_XM_DKIM_Undo 57769 12.63 33.96 3.94 20 HTML_FONT_LOW_CONTRAST 56871 26.90 33.43 24.24 21 BAYES_99 55373 12.04 32.55 3.68 22 MIME_HTML_ONLY 53936 25.17 31.71 22.51 23 DCC_CHECK_NEGATIVE 53474 60.21 31.43 71.94 24 T_KAM_HTML_FONT_INVALID 51965 20.11 30.55 15.85 25 BAYES_999 43634 9.47 25.65 2.88 26 T_TM2_M_HEADER_IN_MSG 39473 26.99 23.20 28.53 27 XM_Body_Dirty_Words 39413 13.81 23.17 10.00 28 XMSubLong 39365 21.23 23.14 20.45 29 TR_DCC_Bayes_99 38575 7.47 22.68 1.27 30 RELAYCOUNTRY_META 36576 8.57 21.50 3.30 31 XM_Multi_Part_URI 31000 12.70 18.22 10.44 32 RCVD_IN_MSPIKE_WL 26552 15.31 15.61 15.19 33 TR_XM_SpammyRelay 26508 5.57 15.58 1.50 34 XM_B_Unsub 26270 9.25 15.44 6.72 35 TR_XM_BayesUnsub 25594 8.32 15.05 5.58 36 BOTNET_IPINHOSTNAME 24360 7.35 14.32 4.51 37 LOTS_OF_MONEY 23495 9.23 13.81 7.36 38 RCVD_IN_MSPIKE_H3 21977 10.77 12.92 9.89 39 XM_B_SpammyWords3 21187 6.21 12.45 3.66 40 TR_XM_SpammyWords2 20801 3.99 12.23 0.63 41 TR_XM_SpammyWords4 19193 6.76 11.28 4.91 42 XMSexyCombo_05 18204 5.03 10.70 2.72 43 UNPARSEABLE_RELAY 17367 7.77 10.21 6.78 44 MPART_ALT_DIFF 17332 10.46 10.19 10.57 45 BOTNET 17323 4.17 10.18 1.72 46 FSL_BULK_SIG 16566 4.68 9.74 2.62 47 RCVD_IN_BL_SPAMCOP_NET 16417 3.21 9.65 0.58 48 XM_UncommonTLD01 15563 4.92 9.15 3.19 49 UNTRUSTED_Relay 15407 3.54 9.06 1.29 50 XM_Evil_Numbers_Gen 15235 9.35 8.96 9.52 51 RELAYCOUNTRY_CA 14518 3.09 8.53 0.88 52 BAYES_60 13520 7.63 7.95 7.51 53 BAYES_80 13506 4.81 7.94 3.54 54 LotsOfNums_01 12090 7.08 7.11 7.07 55 TR_XM_SPAMCOP 11546 2.10 6.79 0.19 56 XMSubMetaSx_00 11001 3.82 6.47 2.74 57 TR_XM_PhishingBody 10750 3.86 6.32 2.86 58 TR_XM_UnparsRelay 10599 2.65 6.23 1.19 59 HTML_IMAGE_RATIO_02 10537 5.15 6.19 4.73 60 XM_SendGrid 10477 4.96 6.16 4.47 61 XM_B_Phish_Phrases 10056 3.80 5.91 2.95 62 XM_H_Long_From01 9730 4.92 5.72 4.59 63 MIME_HTML_MOSTLY 9357 3.21 5.50 2.28 64 MIME_HTML_ONLY_MULTI 9326 7.80 5.48 8.75 65 XM_B_Investor 9209 2.48 5.41 1.29 66 TR_XM_SpammyWords5 8461 2.35 4.97 1.28 67 HTML_IMAGE_RATIO_04 8433 13.48 4.96 16.95 68 TooManyTo_001 8338 6.51 4.90 7.17 69 TM2_M_VERY_LONG_WORD 8018 2.41 4.71 1.48 70 XMBody_17 7746 1.73 4.55 0.58 71 RCVD_IN_MSPIKE_BL 7743 1.58 4.55 0.37 72 BAYES_95 7716 2.87 4.54 2.20 73 T_XMDrugObfuBody_08 7650 2.16 4.50 1.20 74 TR_XM_MSPIKECOMBO 7625 1.56 4.48 0.37 75 T_FILL_THIS_FORM_SHORT 7525 1.93 4.42 0.92 76 XM_UB50 7316 1.81 4.30 0.80 77 XMStrtUSub 7310 9.45 4.30 11.55 78 XM_DIRTYINTL 7222 1.41 4.25 0.26 79 XM_B_SpammyTLD 7095 2.65 4.17 2.03 80 URI_NOVOWEL 6920 2.52 4.07 1.89 81 XMNumbers 6848 3.75 4.03 3.64 82 XM_OfRef6 6809 1.82 4.00 0.94 83 XM_SPF_SoftFail 6774 2.44 3.98 1.81 84 T_XMDrugObfuBody_14 6718 2.12 3.95 1.37 85 HTML_MIME_NO_HTML_TAG 6382 2.58 3.75 2.11 86 TR_XM_DK_SendGrid 6286 3.23 3.70 3.03 87 RCVD_IN_VALIDITY_SAFE 5977 3.84 3.51 3.97 88 SpammyFromTLD_02 5932 1.26 3.49 0.36 89 XM_B_Phish66 5858 2.09 3.44 1.54 90 HTML_IMAGE_RATIO_06 5703 5.02 3.35 5.70 91 TR_XM_SpammyWords3 5685 1.11 3.34 0.20 92 DKIM_INVALID 5382 2.66 3.16 2.45 93 URIBL_DBL_SPAM 5328 0.91 3.13 0.01 94 SpammyFromTLD_01 5271 1.40 3.10 0.71 95 XM_GoogleGroups 5193 1.98 3.05 1.55 96 MIME_QP_LONG_LINE 5192 4.36 3.05 4.89 97 XMLngstWrd_00 5115 1.62 3.01 1.05 98 HTML_IMAGE_RATIO_08 5080 2.37 2.99 2.12 99 XMLngstWrd_01 5065 1.55 2.98 0.97 100 TM2_M_URI_OPT_OUT 4994 2.29 2.94 2.02 101 RCVD_IN_VALIDITY_CERTIFIED 4960 3.23 2.92 3.36 102 XMLngstWrd_02 4930 1.45 2.90 0.86 103 SUBJ_ALL_CAPS 4864 2.00 2.86 1.65 104 TR_XM_NoHeaderRelay 4656 0.86 2.74 0.09 105 FROM_EXCESS_BASE64 4648 2.34 2.73 2.18 106 T_TooManySym_01 4525 4.95 2.66 5.88 107 RCVD_IN_MSPIKE_L3 4464 1.01 2.62 0.35 108 XM_B_Unsub2 4431 1.76 2.60 1.42 109 XMLngstWrd_03 4421 1.30 2.60 0.77 110 RELAYCOUNTRY_IN 4334 0.82 2.55 0.12 111 XMLngstWrd_04 4333 1.23 2.55 0.69 112 HTML_TITLE_SUBJ_DIFF 4325 1.09 2.54 0.49 113 RCVD_IN_MSPIKE_H4 4233 3.81 2.49 4.35 114 TR_XM_FormFill 4195 0.75 2.47 0.05 115 UPPERCASE_75_100 4183 1.05 2.46 0.48 116 USER_IN_DEF_DKIM_WL 4158 8.36 2.44 10.77 117 RCVD_IN_VALIDITY_RPBL 4131 0.74 2.43 0.05 118 XM_B_SpammyWords4 4021 1.10 2.36 0.59 119 FONT_INVIS_LONG_LINE 3965 0.71 2.33 0.06 120 T_XMHurry_00 3880 2.53 2.28 2.63 121 XMDiploma_00 3786 1.48 2.23 1.18 122 XMBdyGiftCard01 3772 1.21 2.22 0.79 123 URI_PHP_REDIR 3618 0.62 2.13 0.00 124 XM_DK_Undo_01 3577 1.55 2.10 1.33 125 T_REMOTE_IMAGE 3486 2.89 2.05 3.23 126 XM_CamelCaseFrm001 3389 1.77 1.99 1.69 127 XM_B_COVIDMETA 3370 0.94 1.98 0.52 128 RCVD_IN_PSBL 3365 0.76 1.98 0.27 129 ALL_TRUSTED 3293 12.91 1.94 17.38 130 RCVD_IN_IADB_LISTED 3217 3.34 1.89 3.93 131 TR_XM_PHPDW 3214 0.90 1.89 0.50 132 TR_XM_SB_Phish 3158 1.88 1.86 1.89 133 TR_XM_PHPForged 3093 0.85 1.82 0.46 134 URI_HEX 3088 1.16 1.82 0.89 135 TR_XM_FormFill2 3032 0.84 1.78 0.45 136 XM_H_PHPOS 3025 0.83 1.78 0.45 137 RCVD_IN_IADB_SPF 2919 3.01 1.72 3.53 138 XM_H_Undi_Recip 2893 0.66 1.70 0.23 139 XM_URI_RBL 2795 0.59 1.64 0.16 140 MAILING_LIST_MULTI 2794 2.08 1.64 2.27 141 XMSubPhish11 2774 1.80 1.63 1.86 142 KHOP_HELO_FCRDNS 2767 1.33 1.63 1.22 143 RCVD_IN_IADB_DK 2737 2.69 1.61 3.13 144 XMStockSpam_06 2725 1.19 1.60 1.02 145 TR_XM_InvalidRelay 2711 0.47 1.59 0.01 146 HK_RANDOM_REPLYTO 2700 0.51 1.59 0.07 147 RCVD_IN_MSPIKE_L5 2700 0.47 1.59 0.01 148 BAYES_40 2696 4.20 1.58 5.27 149 RCVD_IN_IADB_SENDERID 2691 2.75 1.58 3.22 150 XM_UB60 2667 0.51 1.57 0.08 151 XMReplyNow 2648 0.60 1.56 0.21 152 TR_Mismatch_TLD_02 2452 0.47 1.44 0.08 153 TR_Symld_Words 2403 1.42 1.41 1.42 154 TR_XM_Undi_Recip5 2376 0.41 1.40 0.01 155 FROM_SUSPICIOUS_NTLD 2367 0.44 1.39 0.05 156 HTTPS_HTTP_MISMATCH 2360 0.98 1.39 0.81 157 XMSexyCombo_01 2354 0.64 1.38 0.33 158 BAYES_00 2272 10.11 1.34 13.69 159 PDS_OTHER_BAD_TLD 2268 0.55 1.33 0.23 160 XM_UB99 2249 0.39 1.32 0.01 161 XMHTML_After_End 2229 0.92 1.31 0.77 162 LongTLD 2192 0.52 1.29 0.21 163 TR_XM_Base64_M1 2179 0.85 1.28 0.67 164 HTML_TAG_BALANCE_BODY 2178 0.75 1.28 0.54 165 RELAYCOUNTRY_AU 2177 0.55 1.28 0.25 166 TR_XM_Undi_Recip11 2169 0.40 1.28 0.05 167 NO_DNS_FOR_FROM 2157 0.62 1.27 0.35 168 LOADSA_MONEY_COMBO 2156 0.39 1.27 0.03 169 TR_XM_BayesRelay 2115 0.36 1.24 0.00 170 TR_LOTS_OF_MONEY3 2110 0.63 1.24 0.38 171 XMGenDplmaNmb 2092 0.75 1.23 0.55 172 BAYES_20 2072 4.07 1.22 5.23 173 TR_XM_Undi_RecipCombo2 2072 0.35 1.22 0.00 174 XMPhish30 2071 0.80 1.22 0.63 175 UNDISC_MONEY 2062 0.36 1.21 0.01 176 TR_XM_Undi_Recip2 2050 0.37 1.21 0.02 177 TR_XM_Base64_L1 2050 0.57 1.21 0.31 178 URIBL_BLACK 2038 0.37 1.20 0.04 179 TR_XM_MaxWHORU 2036 0.54 1.20 0.27 180 FROM_SUSPICIOUS_NTLD_FP 2026 0.38 1.19 0.04 181 XM_Body_Dirty_Words_01 2024 0.46 1.19 0.16 182 XMBrknScrpt_02 2021 0.73 1.19 0.54 183 DKIM_ADSP_NXDOMAIN 2011 0.50 1.18 0.23 184 BOUNCE_MESSAGE 2008 2.26 1.18 2.70 185 ANY_BOUNCE_MESSAGE 2008 2.26 1.18 2.70 186 XM_OfRef7 1966 0.40 1.16 0.10 187 URI_TRY_3LD 1950 0.76 1.15 0.60 188 BOTNET_NORDNS 1939 0.34 1.14 0.01 189 XM_ProductURIs 1931 0.85 1.14 0.73 190 XFER_LOTSA_MONEY 1926 0.34 1.13 0.02 191 XM_B_DNDMA 1919 0.60 1.13 0.38 192 T_TooManySym_02 1918 2.83 1.13 3.53 193 TR_XM_DK_Bayes 1903 4.19 1.12 5.44 194 TR_XM_COVIDMETA4 1901 0.41 1.12 0.13 195 T_XMDrugObfuBody_00 1863 0.67 1.10 0.50 196 TR_XM_MSPIKECOMBO2 1862 0.33 1.09 0.01 197 XMSubMetaSxObfu_03 1849 0.55 1.09 0.33 198 RELAYCOUNTRY_RU 1770 0.32 1.04 0.02 199 TR_XM_Spammywords 1764 0.47 1.04 0.24 200 XM_S_SpammyWords 1764 0.47 1.04 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 369658 90.05 93.71 88.56 2 RELAYCOUNTRY_US 334548 80.05 79.82 80.15 3 XM_B_Unicode 308543 75.44 79.18 73.92 4 DCC_CHECK_NEGATIVE 300287 60.21 31.43 71.94 5 DKIM_SIGNED 261984 70.35 88.96 62.76 6 XM_DK_Pass 255269 68.59 86.83 61.15 7 DKIM_VALID 251755 67.69 85.80 60.31 8 BAYES_50 228948 51.20 42.25 54.85 9 DKIM_VALID_AU 201494 53.58 66.60 48.27 10 XM_B_SpammyWords 188316 52.42 70.35 45.11 11 XM_B_Unicode3 176878 42.35 42.30 42.37 12 XMListUnsubscribeExists 172900 50.06 71.28 41.42 13 RCVD_IN_MSPIKE_H2 139205 37.40 47.33 33.35 14 T_TM2_M_HEADER_IN_MSG 119105 26.99 23.20 28.53 15 DCC_CHECK 116950 39.75 68.54 28.02 16 HTML_FONT_LOW_CONTRAST 101182 26.90 33.43 24.24 17 DKIM_VALID_EF 98797 26.76 34.34 23.67 18 MIME_HTML_ONLY 93950 25.17 31.71 22.51 19 FVGT_m_MULTI_ODD 93785 26.08 34.95 22.47 20 XMSubLong 85354 21.23 23.14 20.45 21 LOC_TINY_FONT_1 82492 24.81 37.18 19.76 22 XM_B_SpammyWords2 77856 25.36 41.81 18.65 23 ALL_TRUSTED 72533 12.91 1.94 17.38 24 HTML_IMAGE_RATIO_04 70769 13.48 4.96 16.95 25 HTML_FONT_FACE_BAD 67254 11.73 0.99 16.11 26 T_KAM_HTML_FONT_INVALID 66162 20.11 30.55 15.85 27 RCVD_IN_MSPIKE_WL 63394 15.31 15.61 15.19 28 XM_H_Trusted_IP 60735 10.34 0.00 14.55 29 BAYES_00 57125 10.11 1.34 13.69 30 XMStrtUSub 48197 9.45 4.30 11.55 31 USER_IN_DEF_DKIM_WL 44972 8.36 2.44 10.77 32 MPART_ALT_DIFF 44130 10.46 10.19 10.57 33 XM_Multi_Part_URI 43591 12.70 18.22 10.44 34 XM_Body_Dirty_Words 41730 13.81 23.17 10.00 35 RCVD_IN_MSPIKE_H3 41294 10.77 12.92 9.89 36 XM_Evil_Numbers_Gen 39718 9.35 8.96 9.52 37 MIME_HTML_ONLY_MULTI 36514 7.80 5.48 8.75 38 XM_DKIMWhitelistDomains 32284 5.50 0.01 7.73 39 BAYES_60 31337 7.63 7.95 7.51 40 LOTS_OF_MONEY 30716 9.23 13.81 7.36 41 TooManyTo_001 29924 6.51 4.90 7.17 42 LotsOfNums_01 29514 7.08 7.11 7.07 43 UNPARSEABLE_RELAY 28298 7.77 10.21 6.78 44 XM_B_Unsub 28064 9.25 15.44 6.72 45 T_TooManySym_01 24559 4.95 2.66 5.88 46 HTML_IMAGE_RATIO_06 23781 5.02 3.35 5.70 47 IN_ZIMBRA_NJ_WHITELIST 23516 4.02 0.08 5.63 48 XM_DK_Undo_02 23491 16.36 42.69 5.63 49 TR_XM_BayesUnsub 23296 8.32 15.05 5.58 50 TR_XM_DK_Bayes 22725 4.19 1.12 5.44 51 TR_XM_DK_Bayes1 22368 4.06 0.87 5.36 52 BAYES_40 21993 4.20 1.58 5.27 53 BAYES_20 21831 4.07 1.22 5.23 54 TR_XM_SpammyWords4 20510 6.76 11.28 4.91 55 MIME_QP_LONG_LINE 20402 4.36 3.05 4.89 56 TR_XM_DK_Bayes2 20072 3.62 0.71 4.81 57 HTML_IMAGE_RATIO_02 19740 5.15 6.19 4.73 58 XMSubNoVowel 19445 3.43 0.43 4.66 59 XM_H_Long_From01 19151 4.92 5.72 4.59 60 BOTNET_IPINHOSTNAME 18843 7.35 14.32 4.51 61 XM_SendGrid 18660 4.96 6.16 4.47 62 RCVD_IN_MSPIKE_H4 18139 3.81 2.49 4.35 63 XM_PDF 17071 3.11 0.72 4.09 64 BAYES_05 16876 3.06 0.64 4.04 65 RCVD_IN_VALIDITY_SAFE 16588 3.84 3.51 3.97 66 TR_XM_DKIM_Undo 16455 12.63 33.96 3.94 67 RCVD_IN_IADB_LISTED 16402 3.34 1.89 3.93 68 BAYES_99 15360 12.04 32.55 3.68 69 XM_B_SpammyWords3 15290 6.21 12.45 3.66 70 XMNumbers 15185 3.75 4.03 3.64 71 BAYES_80 14782 4.81 7.94 3.54 72 RCVD_IN_IADB_SPF 14751 3.01 1.72 3.53 73 T_TooManySym_02 14737 2.83 1.13 3.53 74 RCVD_IN_VALIDITY_CERTIFIED 14022 3.23 2.92 3.36 75 RELAYCOUNTRY_META 13781 8.57 21.50 3.30 76 T_REMOTE_IMAGE 13484 2.89 2.05 3.23 77 RCVD_IN_IADB_SENDERID 13451 2.75 1.58 3.22 78 XM_UncommonTLD01 13333 4.92 9.15 3.19 79 RCVD_IN_IADB_DK 13052 2.69 1.61 3.13 80 TR_XM_DK_SendGrid 12666 3.23 3.70 3.03 81 XM_B_Phish_Phrases 12294 3.80 5.91 2.95 82 BAYES_999 12024 9.47 25.65 2.88 83 TR_XM_PhishingBody 11923 3.86 6.32 2.86 84 XMSubMetaSx_00 11440 3.82 6.47 2.74 85 XMSexyCombo_05 11345 5.03 10.70 2.72 86 ANY_BOUNCE_MESSAGE 11288 2.26 1.18 2.70 87 BOUNCE_MESSAGE 11286 2.26 1.18 2.70 88 T_XMHurry_00 10961 2.53 2.28 2.63 89 FSL_BULK_SIG 10953 4.68 9.74 2.62 90 DKIM_INVALID 10229 2.66 3.16 2.45 91 MIME_HTML_MOSTLY 9521 3.21 5.50 2.28 92 MAILING_LIST_MULTI 9455 2.08 1.64 2.27 93 RCVD_IN_IADB_VOUCHED 9389 1.84 0.84 2.25 94 BAYES_95 9172 2.87 4.54 2.20 95 FROM_EXCESS_BASE64 9117 2.34 2.73 2.18 96 HTML_IMAGE_RATIO_08 8829 2.37 2.99 2.12 97 HTML_MIME_NO_HTML_TAG 8791 2.58 3.75 2.11 98 XMSubLongNoVowel 8738 1.51 0.07 2.09 99 XMSubGarbage 8571 1.46 0.02 2.05 100 XM_B_SpammyTLD 8462 2.65 4.17 2.03 101 TM2_M_URI_OPT_OUT 8437 2.29 2.94 2.02 102 TooManyTo_002 8001 1.52 0.54 1.92 103 TR_XM_SB_Phish 7893 1.88 1.86 1.89 104 URI_NOVOWEL 7874 2.52 4.07 1.89 105 XMSubPhish11 7773 1.80 1.63 1.86 106 XM_SPF_SoftFail 7558 2.44 3.98 1.81 107 BOTNET 7180 4.17 10.18 1.72 108 XM_CamelCaseFrm001 7035 1.77 1.99 1.69 109 INVALID_MSGID 6953 1.22 0.14 1.67 110 SUBJ_ALL_CAPS 6899 2.00 2.86 1.65 111 TVD_RCVD_IP 6717 1.23 0.28 1.61 112 XM_E_Blogspot 6576 1.14 0.07 1.58 113 XM_GoogleGroups 6459 1.98 3.05 1.55 114 MSGID_NOFQDN1 6435 1.11 0.05 1.54 115 XM_B_Phish66 6409 2.09 3.44 1.54 116 TR_XM_SpammyRelay 6247 5.57 15.58 1.50 117 T_TooManySym_03 6244 1.26 0.69 1.50 118 RCVD_IN_IADB_OPTIN 6204 1.20 0.50 1.49 119 IN_HORDE_ADDRESS_BOOK 6195 1.08 0.09 1.48 120 TM2_M_VERY_LONG_WORD 6161 2.41 4.71 1.48 121 TO_MALFORMED 5953 1.02 0.02 1.43 122 XM_B_Unsub2 5932 1.76 2.60 1.42 123 TR_Symld_Words 5931 1.42 1.41 1.42 124 HELO_NODOT 5838 1.14 0.49 1.40 125 HELO_NO_DOMAIN 5837 1.14 0.49 1.40 126 T_XMDrugObfuBody_14 5737 2.12 3.95 1.37 127 XM_DK_Undo_01 5554 1.55 2.10 1.33 128 XM_B_Investor 5391 2.48 5.41 1.29 129 UNTRUSTED_Relay 5377 3.54 9.06 1.29 130 TVD_SPACE_RATIO 5367 0.96 0.14 1.29 131 TR_XM_SpammyWords5 5342 2.35 4.97 1.28 132 TR_DCC_Bayes_99 5311 7.47 22.68 1.27 133 TooManyTo_003 5196 1.01 0.43 1.24 134 KHOP_HELO_FCRDNS 5073 1.33 1.63 1.22 135 T_XMDrugObfuBody_08 5019 2.16 4.50 1.20 136 TR_XM_UnparsRelay 4975 2.65 6.23 1.19 137 XMDiploma_00 4914 1.48 2.23 1.18 138 XMGappySubj_01 4423 0.84 0.32 1.06 139 XMLngstWrd_00 4403 1.62 3.01 1.05 140 XMStockSpam_06 4270 1.19 1.60 1.02 141 XMCapTrack 4075 0.80 0.36 0.98 142 XMLngstWrd_01 4065 1.55 2.98 0.97 143 RCVD_IN_MSPIKE_H5 3961 0.73 0.20 0.95 144 XMBSHREFv2 3924 0.76 0.33 0.94 145 XM_OfRef6 3911 1.82 4.00 0.94 146 T_FILL_THIS_FORM_SHORT 3823 1.93 4.42 0.92 147 TooManyTo_004 3734 0.74 0.37 0.89 148 URI_HEX 3731 1.16 1.82 0.89 149 RELAYCOUNTRY_CA 3656 3.09 8.53 0.88 150 FROM_GOV_DKIM_AU 3620 0.70 0.31 0.87 151 XMLngstWrd_02 3582 1.45 2.90 0.86 152 XM_H_Long_From02 3405 0.85 0.94 0.82 153 HTTPS_HTTP_MISMATCH 3394 0.98 1.39 0.81 154 XM_UB50 3322 1.81 4.30 0.80 155 XMBdyGiftCard01 3313 1.21 2.22 0.79 156 RCVD_IN_RP_SAFE 3278 0.77 0.73 0.79 157 XMLngstWrd_03 3203 1.30 2.60 0.77 158 XMHTML_After_End 3195 0.92 1.31 0.77 159 DKIM_ADSP_CUSTOM_MED 3167 0.76 0.76 0.76 160 XMBody_95 3055 0.58 0.21 0.73 161 XM_ProductURIs 3051 0.85 1.14 0.73 162 TooManyTo_005 3032 0.61 0.32 0.73 163 FVGT_m_MULTI_ODD_EMAIL 2951 0.54 0.12 0.71 164 SpammyFromTLD_01 2948 1.40 3.10 0.71 165 XMLngstWrd_04 2892 1.23 2.55 0.69 166 RCVD_IN_RP_CERTIFIED 2825 0.65 0.58 0.68 167 TR_XM_Base64_M1 2787 0.85 1.28 0.67 168 XMPhish30 2632 0.80 1.22 0.63 169 TR_XM_SpammyWords2 2631 3.99 12.23 0.63 170 URI_TRY_3LD 2509 0.76 1.15 0.60 171 XMOemUri 2494 0.50 0.26 0.60 172 TR_MetaPhish_Combo_01 2488 0.71 0.98 0.60 173 XM_B_SpammyWords4 2452 1.10 2.36 0.59 174 RCVD_IN_BL_SPAMCOP_NET 2425 3.21 9.65 0.58 175 XMBody_17 2413 1.73 4.55 0.58 176 XMGenDplmaNmb 2308 0.75 1.23 0.55 177 XMNoVowels 2281 0.55 0.56 0.55 178 XMMoneyMeta_00 2271 0.64 0.87 0.54 179 XM_B_COPY_HTML 2260 0.62 0.82 0.54 180 XMBrknScrpt_02 2243 0.73 1.19 0.54 181 HTML_TAG_BALANCE_BODY 2235 0.75 1.28 0.54 182 XM_ShortIntro_01 2223 0.50 0.43 0.53 183 T_OBFU_PDF_ATTACH 2171 0.42 0.18 0.52 184 XM_B_COVIDMETA 2171 0.94 1.98 0.52 185 XM_H_PHPMailer 2122 0.59 0.80 0.51 186 TR_XM_PHPDW 2085 0.90 1.89 0.50 187 NML_ADSP_CUSTOM_MED 2083 0.53 0.61 0.50 188 T_XMDrugObfuBody_00 2071 0.67 1.10 0.50 189 HTML_TITLE_SUBJ_DIFF 2050 1.09 2.54 0.49 190 UPPERCASE_75_100 2013 1.05 2.46 0.48 191 T_Symld_Words_02 1987 0.64 1.03 0.48 192 HTML_IMAGE_ONLY_20 1918 0.52 0.65 0.46 193 TR_XM_PHPForged 1903 0.85 1.82 0.46 194 TR_XM_FormFill2 1885 0.84 1.78 0.45 195 XM_H_PHPOS 1875 0.83 1.78 0.45 196 XMSubMetaSxObfu_02 1854 0.44 0.42 0.44 197 MPART_ALT_DIFF_COUNT 1836 0.56 0.86 0.44 198 RELAYCOUNTRY_GB 1760 0.53 0.80 0.42 199 FORGED_GMAIL_RCVD 1754 0.49 0.67 0.42 200 SHORT_HELO_AND_INLINE_IMAGE 1676 0.31 0.07 0.40 ----------------------------------------------------------------------