Email: 728060 Autolearn: 0 AvgScore: 4.84 AvgScanTime: 1.66 sec Spam: 256568 Autolearn: 0 AvgScore: 13.53 AvgScanTime: 1.76 sec Ham: 471492 Autolearn: 0 AvgScore: 0.10 AvgScanTime: 1.60 sec Time Spent Running SA: 335.52 hours Time Spent Processing Spam: 125.75 hours Time Spent Processing Ham: 209.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247761 92.13 96.57 89.72 2 DKIM_SIGNED 240827 84.23 93.86 78.99 3 XM_DK_Pass 236794 82.53 92.29 77.22 4 DKIM_VALID 235310 81.82 91.71 76.44 5 RELAYCOUNTRY_US 215398 82.97 83.95 82.43 6 XM_B_Unicode 208990 75.45 81.46 72.18 7 XMListUnsubscribeExists 203375 64.01 79.27 55.71 8 DCC_CHECK 199896 55.10 77.91 42.69 9 DKIM_VALID_AU 177701 63.96 69.26 61.07 10 XM_B_SpammyWords 171089 53.81 66.68 46.80 11 RCVD_IN_MSPIKE_H2 134807 45.52 52.54 41.70 12 XM_DK_Undo_02 126771 22.81 49.41 8.34 13 XM_B_Unicode3 115661 44.12 45.08 43.61 14 LOC_TINY_FONT_1 109907 33.11 42.84 27.82 15 FVGT_m_MULTI_ODD 104262 32.57 40.64 28.18 16 BAYES_50 101731 51.01 39.65 57.20 17 HTML_FONT_LOW_CONTRAST 100073 33.21 39.00 30.06 18 XM_B_SpammyWords2 92502 26.40 36.05 21.14 19 TR_XM_DKIM_Undo 92363 15.77 36.00 4.77 20 BAYES_99 88728 16.45 34.58 6.58 21 DKIM_VALID_EF 85720 29.37 33.41 27.17 22 MIME_HTML_ONLY 75644 22.85 29.48 19.24 23 T_KAM_HTML_FONT_INVALID 71548 23.33 27.89 20.85 24 BAYES_999 68929 12.89 26.87 5.29 25 TR_DCC_Bayes_99 68050 11.14 26.52 2.76 26 DCC_CHECK_NEGATIVE 56608 44.86 22.06 57.27 27 XM_Multi_Part_URI 55830 17.07 21.76 14.52 28 XM_Body_Dirty_Words 49737 14.09 19.39 11.21 29 T_TM2_M_HEADER_IN_MSG 48576 23.75 18.93 26.37 30 XMSubLong 46878 18.50 18.27 18.62 31 RELAYCOUNTRY_META 46214 8.89 18.01 3.93 32 RCVD_IN_MSPIKE_WL 41929 18.46 16.34 19.61 33 UNPARSEABLE_RELAY 41695 12.74 16.25 10.82 34 BOTNET_IPINHOSTNAME 38455 8.43 14.99 4.87 35 RCVD_IN_MSPIKE_H3 33322 11.80 12.99 11.15 36 XM_B_Unsub 32024 9.69 12.48 8.18 37 TR_XM_SpammyRelay 31784 5.54 12.39 1.81 38 TR_XM_BayesUnsub 31161 8.81 12.15 7.00 39 RCVD_IN_BL_SPAMCOP_NET 30214 4.61 11.78 0.71 40 XM_B_SpammyWords3 29626 7.31 11.55 5.00 41 LOTS_OF_MONEY 28461 9.76 11.09 9.03 42 TR_XM_SpammyWords2 28152 4.66 10.97 1.23 43 XM_Evil_Numbers_Gen 26957 10.24 10.51 10.10 44 MPART_ALT_DIFF 26853 6.88 10.47 4.93 45 TR_XM_SPAMCOP 26300 3.87 10.25 0.40 46 XM_UncommonTLD01 25331 6.27 9.87 4.31 47 TR_XM_SpammyWords4 25195 6.30 9.82 4.38 48 TR_XM_UnparsRelay 25191 5.01 9.82 2.40 49 BOTNET 23455 4.26 9.14 1.60 50 BAYES_80 22517 6.47 8.78 5.21 51 XMSexyCombo_05 22468 5.29 8.76 3.40 52 RELAYCOUNTRY_CA 21710 3.71 8.46 1.12 53 XM_SendGrid 20742 7.00 8.08 6.41 54 HTML_IMAGE_RATIO_02 19981 7.52 7.79 7.37 55 BAYES_60 19911 9.29 7.76 10.12 56 FSL_BULK_SIG 19734 4.97 7.69 3.50 57 TM2_M_VERY_LONG_WORD 19395 3.53 7.56 1.33 58 LotsOfNums_01 19381 8.97 7.55 9.74 59 MIME_HTML_ONLY_MULTI 18758 3.98 7.31 2.17 60 XM_B_SpammyTLD 17868 3.92 6.96 2.26 61 TooManyTo_001 17076 6.93 6.66 7.08 62 UNTRUSTED_Relay 15769 3.27 6.15 1.70 63 XM_B_Phish_Phrases 15287 4.90 5.96 4.32 64 SpammyFromTLD_02 14872 2.22 5.80 0.27 65 TR_XM_PhishingBody 14768 4.15 5.76 3.27 66 TR_XM_SpammyWords5 14642 4.03 5.71 3.12 67 XM_H_Long_From01 14331 5.55 5.59 5.53 68 BAYES_95 13766 4.09 5.37 3.40 69 HTML_MIME_NO_HTML_TAG 13321 2.91 5.19 1.67 70 XMLngstWrd_00 12872 2.16 5.02 0.60 71 XM_GoogleGroups 12839 2.48 5.00 1.11 72 TR_XM_DK_SendGrid 12810 4.59 4.99 4.37 73 XMLngstWrd_01 12789 2.10 4.98 0.53 74 HTML_IMAGE_RATIO_04 12636 5.40 4.93 5.66 75 XMSubMetaSx_00 12343 3.50 4.81 2.79 76 XMLngstWrd_02 12126 1.94 4.73 0.42 77 SUBJ_ALL_CAPS 12041 3.95 4.69 3.55 78 XMLngstWrd_03 11584 1.79 4.51 0.31 79 HTML_TITLE_SUBJ_DIFF 11540 1.61 4.50 0.03 80 XMLngstWrd_04 11350 1.71 4.42 0.23 81 UPPERCASE_75_100 11283 1.57 4.40 0.02 82 XMBody_17 11281 1.97 4.40 0.65 83 MIME_HTML_MOSTLY 10368 3.82 4.04 3.70 84 PDS_OTHER_BAD_TLD 10296 1.57 4.01 0.24 85 HTML_IMAGE_RATIO_06 10025 3.72 3.91 3.61 86 XMStrtUSub 9519 4.61 3.71 5.10 87 XM_DIRTYINTL 9218 1.47 3.59 0.32 88 MIME_QP_LONG_LINE 9116 4.76 3.55 5.42 89 XM_SPF_SoftFail 9090 2.33 3.54 1.66 90 RCVD_IN_VALIDITY_SAFE 8964 5.24 3.49 6.19 91 XM_B_Investor 8960 2.04 3.49 1.26 92 LongTLD 8890 1.56 3.46 0.52 93 FROM_SUSPICIOUS_NTLD 8783 1.23 3.42 0.04 94 XMNumbers 8735 3.62 3.40 3.74 95 T_XMDrugObfuBody_08 8542 2.07 3.33 1.38 96 FROM_SUSPICIOUS_NTLD_FP 8354 1.17 3.26 0.04 97 XM_UB50 8051 1.79 3.14 1.06 98 XM_B_Phish66 8009 2.12 3.12 1.58 99 T_FILL_THIS_FORM_SHORT 7857 1.54 3.06 0.71 100 USER_IN_DEF_DKIM_WL 7826 10.11 3.05 13.95 101 HTML_IMAGE_RATIO_08 7813 2.79 3.05 2.65 102 T_XMDrugObfuBody_14 7759 1.99 3.02 1.43 103 XMSubMetaI_00 7612 2.25 2.97 1.85 104 FROM_EXCESS_BASE64 7499 2.96 2.92 2.97 105 RCVD_IN_MSPIKE_H4 7367 5.23 2.87 6.51 106 RCVD_IN_VALIDITY_CERTIFIED 7334 4.61 2.86 5.56 107 T_XMHurry_00 7155 1.95 2.79 1.50 108 TM2_M_URI_OPT_OUT 7078 2.18 2.76 1.87 109 RCVD_IN_MSPIKE_BL 6947 1.30 2.71 0.53 110 TR_XM_MSPIKECOMBO 6865 1.28 2.68 0.52 111 XM_OfRef6 6823 1.53 2.66 0.92 112 URI_NOVOWEL 6420 2.32 2.50 2.23 113 NORDNS_LOW_CONTRAST 6417 0.92 2.50 0.06 114 XM_B_SpammyWords4 6132 1.19 2.39 0.54 115 XMBrknScrpt_02 6105 1.58 2.38 1.15 116 URIBL_DBL_SPAM 5933 0.82 2.31 0.01 117 HK_RANDOM_REPLYTO 5890 0.88 2.30 0.11 118 XM_DK_Undo_01 5741 1.65 2.24 1.34 119 SpammyFromTLD_01 5735 1.89 2.24 1.70 120 XMDiploma_00 5639 1.57 2.20 1.23 121 TR_LOTS_OF_MONEY3 5556 1.15 2.17 0.60 122 DKIM_INVALID 5517 2.41 2.15 2.55 123 TR_XM_SpammyWords3 5330 0.92 2.08 0.29 124 XM_CamelCaseFrm001 5234 1.98 2.04 1.94 125 XMStockSpam_06 5053 1.95 1.97 1.94 126 RCVD_IN_IADB_LISTED 4998 4.21 1.95 5.45 127 TR_Caps_n_Bayes_99 4967 1.03 1.94 0.53 128 URI_HEX 4587 1.68 1.79 1.63 129 TR_XM_FormFill 4505 0.63 1.76 0.02 130 T_TooManySym_01 4432 4.32 1.73 5.73 131 T_REMOTE_IMAGE 4428 3.00 1.73 3.70 132 RCVD_IN_IADB_SPF 4379 3.77 1.71 4.89 133 FONT_INVIS_LONG_LINE 4374 0.65 1.70 0.07 134 DATE_IN_PAST_12_24 4370 0.61 1.70 0.02 135 XM_B_Unsub2 4357 1.42 1.70 1.27 136 XMBdyGiftCard01 4181 1.24 1.63 1.02 137 URI_PHP_REDIR 4142 0.59 1.61 0.03 138 RCVD_IN_IADB_DK 4138 3.36 1.61 4.31 139 RCVD_IN_IADB_SENDERID 4135 3.45 1.61 4.45 140 TR_XM_SB_Phish 4104 1.78 1.60 1.87 141 XM_B_COVIDMETA 4071 0.90 1.59 0.52 142 MAILING_LIST_MULTI 4028 2.40 1.57 2.85 143 XMSubPhish11 4005 1.75 1.56 1.85 144 RCVD_IN_MSPIKE_L5 3976 0.59 1.55 0.07 145 TR_XM_Base64_M1 3932 1.17 1.53 0.97 146 BAYES_40 3724 3.33 1.45 4.35 147 HTML_FONT_TINY_NORDNS 3590 0.55 1.40 0.09 148 XMSexyCombo_01 3569 1.00 1.39 0.79 149 MPART_ALT_DIFF_COUNT 3501 0.87 1.36 0.60 150 TR_XM_BayesRelay 3474 0.48 1.35 0.00 151 XM_URI_RBL 3393 0.56 1.32 0.14 152 SHOPIFY_IMG_NOT_RCVD_SFY 3381 0.68 1.32 0.34 153 XM_H_Undi_Recip 3315 0.60 1.29 0.23 154 HTTPS_HTTP_MISMATCH 3308 0.87 1.29 0.65 155 RELAYCOUNTRY_AU 3185 0.61 1.24 0.26 156 BOTNET_NORDNS 3133 0.44 1.22 0.01 157 ALL_TRUSTED 3118 9.65 1.22 14.24 158 URIBL_BLACK 3043 0.45 1.19 0.05 159 RELAYCOUNTRY_IN 2997 0.47 1.17 0.09 160 XMHTMLBadTable_001 2944 0.71 1.15 0.48 161 TR_XM_NoHeaderRelay 2937 0.62 1.14 0.33 162 XMPhish30 2806 0.84 1.09 0.71 163 T_XMDrugObfuBody_00 2757 0.98 1.07 0.93 164 TR_XM_PHPDW 2740 0.94 1.07 0.88 165 XM_B_Crypto 2707 1.82 1.06 2.24 166 RCVD_IN_VALIDITY_RPBL 2681 0.40 1.04 0.05 167 ANY_BOUNCE_MESSAGE 2656 1.78 1.04 2.19 168 HTML_TAG_BALANCE_BODY 2653 0.78 1.03 0.65 169 BOUNCE_MESSAGE 2651 1.78 1.03 2.19 170 TR_XM_PHPForged 2638 0.92 1.03 0.86 171 XM_ProductURIs 2634 1.07 1.03 1.09 172 XM_S_SpammyWords 2627 0.75 1.02 0.60 173 TR_XM_Spammywords 2626 0.75 1.02 0.60 174 TR_XM_FormFill2 2592 0.91 1.01 0.85 175 XMPhish14 2582 0.77 1.01 0.64 176 XM_H_PHPOS 2579 0.90 1.01 0.84 177 TR_Mismatch_TLD_02 2564 0.40 1.00 0.08 178 XMClaimOffer 2557 0.50 1.00 0.24 179 XM_B_SEO 2554 0.43 1.00 0.13 180 URI_TRY_3LD 2552 0.85 0.99 0.77 181 LOW_PRICE 2540 0.70 0.99 0.54 182 BAYES_20 2537 2.37 0.99 3.12 183 TR_XM_Undi_Recip11 2504 0.38 0.98 0.05 184 RCVD_IN_MSPIKE_L3 2495 0.61 0.97 0.41 185 T_MONEY_PERCENT 2488 0.80 0.97 0.70 186 TR_LOTS_OF_MONEY2 2488 0.80 0.97 0.70 187 KHOP_HELO_FCRDNS 2472 0.97 0.96 0.97 188 DATE_IN_PAST_06_12 2466 0.37 0.96 0.05 189 THIS_AD 2451 0.64 0.96 0.47 190 XM_B_DNDMA 2438 0.71 0.95 0.59 191 BAYES_00 2382 5.48 0.93 7.96 192 TR_Sbj_FN_Bdy 2378 0.39 0.93 0.10 193 TR_Symld_Words 2351 1.33 0.92 1.55 194 XMGenDplmaNmb 2330 0.73 0.91 0.63 195 XM_UB99 2329 0.32 0.91 0.00 196 XMHTML_After_End 2293 0.83 0.89 0.79 197 TR_XM_Base64_L1 2264 0.59 0.88 0.44 198 TR_XM_SEO4 2223 0.35 0.87 0.08 199 RCVD_IN_IADB_VOUCHED 2137 2.37 0.83 3.21 200 HTML_FONT_FACE_BAD 2097 1.07 0.82 1.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 423025 92.13 96.57 89.72 2 RELAYCOUNTRY_US 388660 82.97 83.95 82.43 3 DKIM_SIGNED 372412 84.23 93.86 78.99 4 XM_DK_Pass 364091 82.53 92.29 77.22 5 DKIM_VALID 360412 81.82 91.71 76.44 6 XM_B_Unicode 340317 75.45 81.46 72.18 7 DKIM_VALID_AU 287942 63.96 69.26 61.07 8 DCC_CHECK_NEGATIVE 270003 44.86 22.06 57.27 9 BAYES_50 269671 51.01 39.65 57.20 10 XMListUnsubscribeExists 262690 64.01 79.27 55.71 11 XM_B_SpammyWords 220675 53.81 66.68 46.80 12 XM_B_Unicode3 205595 44.12 45.08 43.61 13 DCC_CHECK 201300 55.10 77.91 42.69 14 RCVD_IN_MSPIKE_H2 196621 45.52 52.54 41.70 15 HTML_FONT_LOW_CONTRAST 141718 33.21 39.00 30.06 16 FVGT_m_MULTI_ODD 132876 32.57 40.64 28.18 17 LOC_TINY_FONT_1 131186 33.11 42.84 27.82 18 DKIM_VALID_EF 128127 29.37 33.41 27.17 19 T_TM2_M_HEADER_IN_MSG 124318 23.75 18.93 26.37 20 XM_B_SpammyWords2 99679 26.40 36.05 21.14 21 T_KAM_HTML_FONT_INVALID 98283 23.33 27.89 20.85 22 RCVD_IN_MSPIKE_WL 92473 18.46 16.34 19.61 23 MIME_HTML_ONLY 90717 22.85 29.48 19.24 24 XMSubLong 87794 18.50 18.27 18.62 25 XM_Multi_Part_URI 68446 17.07 21.76 14.52 26 ALL_TRUSTED 67131 9.65 1.22 14.24 27 USER_IN_DEF_DKIM_WL 65787 10.11 3.05 13.95 28 XM_Body_Dirty_Words 52861 14.09 19.39 11.21 29 RCVD_IN_MSPIKE_H3 52569 11.80 12.99 11.15 30 UNPARSEABLE_RELAY 51038 12.74 16.25 10.82 31 BAYES_60 47716 9.29 7.76 10.12 32 XM_Evil_Numbers_Gen 47624 10.24 10.51 10.10 33 LotsOfNums_01 45918 8.97 7.55 9.74 34 XM_DKIMWhitelistDomains 44480 6.14 0.10 9.43 35 LOTS_OF_MONEY 42579 9.76 11.09 9.03 36 XM_DK_Undo_02 39313 22.81 49.41 8.34 37 XM_B_Unsub 38556 9.69 12.48 8.18 38 BAYES_00 37514 5.48 0.93 7.96 39 HTML_IMAGE_RATIO_02 34750 7.52 7.79 7.37 40 TooManyTo_001 33386 6.93 6.66 7.08 41 TR_XM_BayesUnsub 33010 8.81 12.15 7.00 42 BAYES_99 31011 16.45 34.58 6.58 43 RCVD_IN_MSPIKE_H4 30709 5.23 2.87 6.51 44 XM_SendGrid 30242 7.00 8.08 6.41 45 IN_ZIMBRA_NJ_WHITELIST 30241 4.18 0.07 6.41 46 RCVD_IN_VALIDITY_SAFE 29162 5.24 3.49 6.19 47 T_TooManySym_01 27028 4.32 1.73 5.73 48 HTML_IMAGE_RATIO_04 26699 5.40 4.93 5.66 49 TR_XM_DK_Bayes 26385 3.88 0.73 5.60 50 RCVD_IN_VALIDITY_CERTIFIED 26223 4.61 2.86 5.56 51 XM_H_Long_From01 26056 5.55 5.59 5.53 52 TR_XM_DK_Bayes1 26012 3.82 0.71 5.52 53 RCVD_IN_IADB_LISTED 25673 4.21 1.95 5.45 54 MIME_QP_LONG_LINE 25547 4.76 3.55 5.42 55 BAYES_999 24941 12.89 26.87 5.29 56 BAYES_80 24570 6.47 8.78 5.21 57 XMStrtUSub 24042 4.61 3.71 5.10 58 XM_B_SpammyWords3 23581 7.31 11.55 5.00 59 MPART_ALT_DIFF 23264 6.88 10.47 4.93 60 RCVD_IN_IADB_SPF 23055 3.77 1.71 4.89 61 BOTNET_IPINHOSTNAME 22945 8.43 14.99 4.87 62 TR_XM_DK_Bayes2 22779 3.35 0.63 4.83 63 TR_XM_DKIM_Undo 22480 15.77 36.00 4.77 64 RCVD_IN_IADB_SENDERID 20970 3.45 1.61 4.45 65 TR_XM_SpammyWords4 20646 6.30 9.82 4.38 66 TR_XM_DK_SendGrid 20623 4.59 4.99 4.37 67 BAYES_40 20502 3.33 1.45 4.35 68 XM_B_Phish_Phrases 20355 4.90 5.96 4.32 69 XM_UncommonTLD01 20331 6.27 9.87 4.31 70 RCVD_IN_IADB_DK 20331 3.36 1.61 4.31 71 RELAYCOUNTRY_META 18537 8.89 18.01 3.93 72 XM_PDF 17992 2.63 0.44 3.82 73 XMNumbers 17642 3.62 3.40 3.74 74 MIME_HTML_MOSTLY 17463 3.82 4.04 3.70 75 T_REMOTE_IMAGE 17442 3.00 1.73 3.70 76 HTML_IMAGE_RATIO_06 17030 3.72 3.91 3.61 77 SUBJ_ALL_CAPS 16735 3.95 4.69 3.55 78 FSL_BULK_SIG 16485 4.97 7.69 3.50 79 XMSexyCombo_05 16043 5.29 8.76 3.40 80 BAYES_95 16032 4.09 5.37 3.40 81 TR_XM_PhishingBody 15428 4.15 5.76 3.27 82 RCVD_IN_IADB_VOUCHED 15125 2.37 0.83 3.21 83 T_TooManySym_02 14750 2.19 0.47 3.13 84 BAYES_20 14734 2.37 0.99 3.12 85 TR_XM_SpammyWords5 14713 4.03 5.71 3.12 86 FROM_EXCESS_BASE64 14017 2.96 2.92 2.97 87 MAILING_LIST_MULTI 13450 2.40 1.57 2.85 88 XMSubMetaSx_00 13153 3.50 4.81 2.79 89 TR_DCC_Bayes_99 13025 11.14 26.52 2.76 90 HTML_IMAGE_RATIO_08 12514 2.79 3.05 2.65 91 DKIM_INVALID 12000 2.41 2.15 2.55 92 TR_XM_UnparsRelay 11319 5.01 9.82 2.40 93 HELO_NODOT 10850 1.66 0.48 2.30 94 HELO_NO_DOMAIN 10843 1.66 0.48 2.30 95 XM_B_SpammyTLD 10645 3.92 6.96 2.26 96 XM_B_Crypto 10573 1.82 1.06 2.24 97 URI_NOVOWEL 10495 2.32 2.50 2.23 98 ANY_BOUNCE_MESSAGE 10328 1.78 1.04 2.19 99 BOUNCE_MESSAGE 10324 1.78 1.03 2.19 100 MIME_HTML_ONLY_MULTI 10228 3.98 7.31 2.17 101 RCVD_IN_IADB_OPTIN 9927 1.53 0.48 2.11 102 BAYES_05 9741 1.51 0.50 2.07 103 RCVD_IN_MSPIKE_H5 9195 1.43 0.48 1.95 104 XM_CamelCaseFrm001 9152 1.98 2.04 1.94 105 XMStockSpam_06 9147 1.95 1.97 1.94 106 TR_XM_SB_Phish 8836 1.78 1.60 1.87 107 TM2_M_URI_OPT_OUT 8794 2.18 2.76 1.87 108 XMSubPhish11 8743 1.75 1.56 1.85 109 XMSubMetaI_00 8741 2.25 2.97 1.85 110 TR_XM_SpammyRelay 8525 5.54 12.39 1.81 111 TooManyTo_002 8350 1.33 0.53 1.77 112 IN_HORDE_ADDRESS_BOOK 8040 1.13 0.07 1.71 113 UNTRUSTED_Relay 8020 3.27 6.15 1.70 114 SpammyFromTLD_01 7996 1.89 2.24 1.70 115 HTML_MIME_NO_HTML_TAG 7864 2.91 5.19 1.67 116 XM_SPF_SoftFail 7840 2.33 3.54 1.66 117 URI_HEX 7670 1.68 1.79 1.63 118 BOTNET 7548 4.26 9.14 1.60 119 XMBody_95 7474 1.08 0.16 1.59 120 XM_B_Phish66 7430 2.12 3.12 1.58 121 TR_Symld_Words 7300 1.33 0.92 1.55 122 INVALID_MSGID 7165 1.01 0.08 1.52 123 T_XMHurry_00 7058 1.95 2.79 1.50 124 T_XMDrugObfuBody_14 6758 1.99 3.02 1.43 125 MSGID_NOFQDN1 6676 0.92 0.02 1.42 126 T_XMDrugObfuBody_08 6518 2.07 3.33 1.38 127 XM_DK_Undo_01 6306 1.65 2.24 1.34 128 TM2_M_VERY_LONG_WORD 6282 3.53 7.56 1.33 129 TO_MALFORMED 5994 0.83 0.01 1.27 130 T_TooManySym_03 5977 0.89 0.21 1.27 131 XM_B_Unsub2 5968 1.42 1.70 1.27 132 XM_B_Investor 5924 2.04 3.49 1.26 133 TR_XM_SpammyWords2 5803 4.66 10.97 1.23 134 XMDiploma_00 5790 1.57 2.20 1.23 135 TooManyTo_003 5707 0.94 0.44 1.21 136 HTML_FONT_FACE_BAD 5690 1.07 0.82 1.21 137 TVD_RCVD_IP 5679 0.84 0.18 1.20 138 RCVD_IN_RP_SAFE 5514 1.03 0.78 1.17 139 MISSING_HEADERS 5417 0.85 0.29 1.15 140 XMBrknScrpt_02 5412 1.58 2.38 1.15 141 RELAYCOUNTRY_CA 5284 3.71 8.46 1.12 142 XM_GoogleGroups 5244 2.48 5.00 1.11 143 TVD_SPACE_RATIO 5182 0.72 0.04 1.10 144 XM_ProductURIs 5130 1.07 1.03 1.09 145 XM_H_Long_From02 5105 0.96 0.72 1.08 146 RCVD_IN_RP_CERTIFIED 4984 0.91 0.63 1.06 147 XM_UB50 4981 1.79 3.14 1.06 148 HTML_OBFUSCATE_20_30 4886 0.67 0.01 1.04 149 XMBdyGiftCard01 4826 1.24 1.63 1.02 150 TR_XM_Base64_M1 4594 1.17 1.53 0.97 151 KHOP_HELO_FCRDNS 4554 0.97 0.96 0.97 152 XM_H_Trusted_IP 4549 0.62 0.00 0.96 153 T_XMDrugObfuBody_00 4391 0.98 1.07 0.93 154 XM_OfRef6 4316 1.53 2.66 0.92 155 XMCapTrack 4229 0.67 0.25 0.90 156 TooManyTo_004 4158 0.70 0.36 0.88 157 TR_XM_PHPDW 4128 0.94 1.07 0.88 158 XMBSHREFv2 4092 0.63 0.19 0.87 159 TR_LOTS_OF_MONEY1 4083 0.57 0.03 0.87 160 TR_XM_PHPForged 4040 0.92 1.03 0.86 161 TR_XM_FormFill2 4007 0.91 1.01 0.85 162 XM_H_PHPOS 3983 0.90 1.01 0.84 163 XMGappySubj_01 3919 0.65 0.32 0.83 164 DKIM_ADSP_CUSTOM_MED 3866 0.76 0.64 0.82 165 XMHTML_After_End 3727 0.83 0.89 0.79 166 XMSexyCombo_01 3719 1.00 1.39 0.79 167 MIME_HEADER_CTYPE_ONLY 3646 0.52 0.06 0.77 168 URI_TRY_3LD 3635 0.85 0.99 0.77 169 XMNoVowels 3622 0.64 0.40 0.77 170 XMSubMetaSxObfu_03 3550 0.71 0.63 0.75 171 TooManyTo_005 3380 0.58 0.34 0.72 172 RCVD_IN_BL_SPAMCOP_NET 3362 4.61 11.78 0.71 173 T_FILL_THIS_FORM_SHORT 3346 1.54 3.06 0.71 174 XMPhish30 3342 0.84 1.09 0.71 175 TR_LOTS_OF_MONEY2 3315 0.80 0.97 0.70 176 T_MONEY_PERCENT 3315 0.80 0.97 0.70 177 XM_B_COPY_HTML 3269 0.74 0.81 0.69 178 MY_SERVERS_FOUND 3203 0.49 0.13 0.68 179 XM_ShortIntro_01 3187 0.56 0.33 0.68 180 XMBody_17 3077 1.97 4.40 0.65 181 XM_RXBody 3056 0.58 0.46 0.65 182 HTTPS_HTTP_MISMATCH 3050 0.87 1.29 0.65 183 HTML_TAG_BALANCE_BODY 3048 0.78 1.03 0.65 184 XMPhish14 3002 0.77 1.01 0.64 185 FVGT_m_MULTI_ODD_EMAIL 2995 0.45 0.11 0.64 186 XMGenDplmaNmb 2966 0.73 0.91 0.63 187 MPART_ALT_DIFF_COUNT 2844 0.87 1.36 0.60 188 XMLngstWrd_00 2830 2.16 5.02 0.60 189 TR_LOTS_OF_MONEY3 2825 1.15 2.17 0.60 190 TR_XM_Spammywords 2809 0.75 1.02 0.60 191 XM_S_SpammyWords 2809 0.75 1.02 0.60 192 RELAYCOUNTRY_GB 2770 0.63 0.72 0.59 193 XM_B_DNDMA 2763 0.71 0.95 0.59 194 TR_XM_Crypto3 2739 0.45 0.21 0.58 195 TR_MetaPhish_Combo_01 2692 0.65 0.80 0.57 196 LOW_PRICE 2569 0.70 0.99 0.54 197 XM_B_SpammyWords4 2565 1.19 2.39 0.54 198 RCVD_IN_MSPIKE_BL 2513 1.30 2.71 0.53 199 TR_Caps_n_Bayes_99 2502 1.03 1.94 0.53 200 XMLngstWrd_01 2498 2.10 4.98 0.53 ----------------------------------------------------------------------