Email: 504978 Autolearn: 0 AvgScore: 4.11 AvgScanTime: 1.29 sec Spam: 165825 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.39 sec Ham: 339153 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 1.24 sec Time Spent Running SA: 181.29 hours Time Spent Processing Spam: 64.16 hours Time Spent Processing Ham: 117.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157018 89.25 94.69 86.59 2 DKIM_SIGNED 153166 82.28 92.37 77.35 3 XM_DK_Pass 150484 80.54 90.75 75.55 4 DKIM_VALID 147931 79.31 89.21 74.48 5 XM_B_Unicode 140431 75.95 84.69 71.68 6 RELAYCOUNTRY_US 133491 81.32 80.50 81.71 7 XMListUnsubscribeExists 120112 58.83 72.43 52.18 8 DCC_CHECK 119143 48.88 71.85 37.65 9 XM_B_SpammyWords 118208 54.28 71.28 45.97 10 DKIM_VALID_AU 111209 62.41 67.06 60.14 11 RCVD_IN_MSPIKE_H2 84262 44.08 50.81 40.79 12 XM_B_Unicode3 77679 44.53 46.84 43.40 13 XM_DK_Undo_02 75031 19.72 45.25 7.23 14 BAYES_50 67491 52.44 40.70 58.18 15 XM_B_SpammyWords2 66132 26.24 39.88 19.57 16 TR_XM_DKIM_Undo 62173 15.87 37.49 5.30 17 LOC_TINY_FONT_1 61607 30.09 37.15 26.64 18 FVGT_m_MULTI_ODD 59746 29.26 36.03 25.95 19 DKIM_VALID_EF 57489 30.08 34.67 27.84 20 HTML_FONT_LOW_CONTRAST 55719 30.22 33.60 28.57 21 BAYES_99 54541 14.36 32.89 5.31 22 MIME_HTML_ONLY 54475 24.95 32.85 21.08 23 T_KAM_HTML_FONT_INVALID 51386 24.32 30.99 21.06 24 DCC_CHECK_NEGATIVE 46648 51.08 28.13 62.30 25 BAYES_999 42477 11.21 25.62 4.17 26 TR_DCC_Bayes_99 39715 9.40 23.95 2.29 27 XM_Body_Dirty_Words 39301 15.73 23.70 11.84 28 XMSubLong 37818 23.31 22.81 23.55 29 RELAYCOUNTRY_META 34129 9.61 20.58 4.25 30 T_TM2_M_HEADER_IN_MSG 33913 25.69 20.45 28.25 31 XM_Multi_Part_URI 31912 15.50 19.24 13.67 32 RCVD_IN_MSPIKE_WL 27252 17.71 16.43 18.33 33 XM_B_Unsub 26288 10.99 15.85 8.61 34 TR_XM_SpammyRelay 25945 6.58 15.65 2.15 35 TR_XM_BayesUnsub 25370 9.56 15.30 6.76 36 BOTNET_IPINHOSTNAME 23563 7.80 14.21 4.67 37 UNPARSEABLE_RELAY 22770 11.35 13.73 10.18 38 RCVD_IN_MSPIKE_H3 22106 11.79 13.33 11.04 39 XM_B_SpammyWords3 21530 7.44 12.98 4.73 40 LOTS_OF_MONEY 21419 8.45 12.92 6.27 41 RELAYCOUNTRY_CA 19188 4.83 11.57 1.54 42 TR_XM_SpammyWords2 18999 4.54 11.46 1.16 43 XMSexyCombo_05 18574 6.32 11.20 3.94 44 TR_XM_SpammyWords4 18006 6.22 10.86 3.95 45 RCVD_IN_BL_SPAMCOP_NET 16214 3.64 9.78 0.63 46 FSL_BULK_SIG 15846 5.61 9.56 3.68 47 BOTNET 14906 4.21 8.99 1.87 48 BAYES_80 14893 5.95 8.98 4.47 49 MPART_ALT_DIFF 14754 6.82 8.90 5.80 50 XM_Evil_Numbers_Gen 14690 8.98 8.86 9.04 51 TR_XM_SPAMCOP 14227 3.01 8.58 0.28 52 TR_XM_UnparsRelay 14141 4.21 8.53 2.09 53 BAYES_60 13304 9.08 8.02 9.60 54 XM_UncommonTLD01 12379 5.20 7.47 4.10 55 HTML_IMAGE_RATIO_02 11595 7.09 6.99 7.14 56 LotsOfNums_01 10848 8.01 6.54 8.73 57 TR_XM_PhishingBody 10811 4.86 6.52 4.05 58 XM_H_Long_From01 10599 6.18 6.39 6.08 59 XMSubMetaSx_00 10276 4.05 6.20 3.00 60 XM_SendGrid 10083 6.06 6.08 6.04 61 XM_B_SpammyTLD 9721 3.53 5.86 2.39 62 MIME_HTML_ONLY_MULTI 9548 4.13 5.76 3.34 63 XM_B_Phish_Phrases 9114 4.21 5.50 3.58 64 HTML_IMAGE_RATIO_04 9020 5.55 5.44 5.60 65 BAYES_95 8930 3.62 5.39 2.76 66 TM2_M_VERY_LONG_WORD 8811 2.90 5.31 1.72 67 UNTRUSTED_Relay 8438 2.68 5.09 1.50 68 TooManyTo_001 8242 6.99 4.97 7.98 69 XM_DIRTYINTL 8149 1.84 4.91 0.34 70 XM_B_Investor 7887 2.73 4.76 1.74 71 XMNumbers 7529 4.74 4.54 4.84 72 T_XMDrugObfuBody_08 7477 2.40 4.51 1.38 73 XMStrtUSub 6959 4.94 4.20 5.31 74 TR_XM_DK_SendGrid 6593 4.12 3.98 4.20 75 HTML_MIME_NO_HTML_TAG 6481 2.72 3.91 2.14 76 HTML_IMAGE_RATIO_06 6448 4.55 3.89 4.88 77 T_FILL_THIS_FORM_SHORT 6241 1.84 3.76 0.90 78 TR_XM_SpammyWords5 6196 2.12 3.74 1.33 79 XM_B_Phish66 6154 2.58 3.71 2.03 80 MIME_HTML_MOSTLY 6111 3.05 3.69 2.74 81 XMBody_17 6072 1.48 3.66 0.41 82 URIBL_DBL_SPAM 6063 1.21 3.66 0.02 83 XM_SPF_SoftFail 6063 2.35 3.66 1.71 84 T_XMDrugObfuBody_14 6060 2.40 3.65 1.79 85 RCVD_IN_VALIDITY_SAFE 5961 5.18 3.59 5.96 86 XM_OfRef6 5742 1.80 3.46 0.99 87 XM_H_Undi_Recip 5622 1.29 3.39 0.26 88 RCVD_IN_MSPIKE_BL 5495 1.38 3.31 0.44 89 MIME_QP_LONG_LINE 5486 4.45 3.31 5.01 90 XM_DK_Undo_01 5474 2.11 3.30 1.53 91 TR_XM_MSPIKECOMBO 5382 1.35 3.25 0.42 92 DKIM_INVALID 5235 2.97 3.16 2.88 93 SpammyFromTLD_02 5000 1.39 3.02 0.60 94 XM_GoogleGroups 4971 2.01 3.00 1.52 95 T_TooManySym_01 4721 5.85 2.85 7.31 96 RCVD_IN_VALIDITY_CERTIFIED 4692 4.27 2.83 4.98 97 SUBJ_ALL_CAPS 4633 2.05 2.79 1.69 98 XMLngstWrd_00 4624 1.65 2.79 1.09 99 SpammyFromTLD_01 4623 1.53 2.79 0.91 100 HTML_IMAGE_RATIO_08 4597 2.47 2.77 2.32 101 XMLngstWrd_01 4568 1.58 2.75 1.00 102 RCVD_IN_MSPIKE_H4 4567 4.94 2.75 6.01 103 TR_XM_SpammyWords3 4515 1.04 2.72 0.21 104 FROM_EXCESS_BASE64 4515 2.91 2.72 3.00 105 XM_B_SpammyWords4 4508 1.54 2.72 0.96 106 XMLngstWrd_02 4424 1.45 2.67 0.86 107 HK_RANDOM_REPLYTO 4388 0.93 2.65 0.09 108 PDS_OTHER_BAD_TLD 4344 0.99 2.62 0.20 109 TM2_M_URI_OPT_OUT 4216 2.13 2.54 1.93 110 USER_IN_DEF_DKIM_WL 4204 9.92 2.54 13.53 111 XMDiploma_00 4182 1.62 2.52 1.18 112 XM_B_Unsub2 4133 1.83 2.49 1.51 113 FONT_INVIS_LONG_LINE 4024 0.84 2.43 0.06 114 XMLngstWrd_03 3982 1.29 2.40 0.75 115 XM_UB50 3905 1.39 2.35 0.92 116 XMLngstWrd_04 3889 1.21 2.35 0.65 117 XM_CamelCaseFrm001 3826 2.25 2.31 2.23 118 HTML_TITLE_SUBJ_DIFF 3796 1.02 2.29 0.40 119 UPPERCASE_75_100 3751 1.02 2.26 0.41 120 RCVD_IN_MSPIKE_L5 3698 0.76 2.23 0.04 121 TR_XM_Undi_Recip5 3667 0.74 2.21 0.02 122 URI_PHP_REDIR 3595 0.71 2.17 0.00 123 TR_XM_FormFill 3558 0.71 2.15 0.01 124 XMStockSpam_06 3502 1.88 2.11 1.77 125 ALL_TRUSTED 3501 10.68 2.11 14.87 126 TR_XM_Undi_Recip2 3348 0.69 2.02 0.04 127 T_REMOTE_IMAGE 3267 3.14 1.97 3.72 128 UNDISC_MONEY 3181 0.63 1.92 0.00 129 TR_XM_PHPDW 3132 1.14 1.89 0.77 130 TR_XM_PHPForged 3090 1.10 1.86 0.73 131 MAILING_LIST_MULTI 3079 2.29 1.86 2.51 132 TR_Symld_Words 3056 1.84 1.84 1.83 133 TR_XM_SB_Phish 3055 1.97 1.84 2.04 134 TR_XM_FormFill2 3048 1.09 1.84 0.73 135 XM_H_PHPOS 3039 1.09 1.83 0.72 136 XMSubPhish11 2991 1.95 1.80 2.02 137 HTTPS_HTTP_MISMATCH 2986 0.99 1.80 0.60 138 TR_XM_Undi_RecipCombo2 2951 0.59 1.78 0.00 139 XMBdyGiftCard01 2939 1.38 1.77 1.19 140 XM_Body_Dirty_Words_01 2907 0.99 1.75 0.62 141 RCVD_IN_IADB_LISTED 2878 3.89 1.74 4.94 142 T_XMHurry_00 2875 1.00 1.73 0.64 143 XM_URI_RBL 2828 0.65 1.71 0.13 144 XMSexyCombo_01 2825 0.81 1.70 0.37 145 RELAYCOUNTRY_AU 2811 0.75 1.70 0.28 146 TR_LOTS_OF_MONEY3 2806 0.72 1.69 0.25 147 TR_XM_Undi_Recip11 2653 0.57 1.60 0.07 148 TR_Sbj_FN_Bdy 2632 0.61 1.59 0.13 149 TR_XM_NoHeaderRelay 2599 0.59 1.57 0.11 150 XM_B_COVIDMETA 2566 0.78 1.55 0.40 151 RCVD_IN_IADB_SPF 2561 3.47 1.54 4.41 152 TR_XM_BayesRelay 2510 0.50 1.51 0.00 153 RCVD_IN_IADB_DK 2431 3.11 1.47 3.91 154 RCVD_IN_IADB_SENDERID 2422 3.17 1.46 4.00 155 URI_NOVOWEL 2413 1.85 1.46 2.04 156 T_TooManySym_02 2411 3.55 1.45 4.58 157 MPART_ALT_DIFF_COUNT 2408 0.93 1.45 0.68 158 BAYES_40 2399 3.58 1.45 4.62 159 XMGenDplmaNmb 2372 0.89 1.43 0.62 160 T_XMDrugObfuBody_00 2369 1.17 1.43 1.05 161 URI_HEX 2317 1.43 1.40 1.44 162 XMBody_78 2297 0.68 1.39 0.34 163 TR_XM_Base64_M1 2212 1.04 1.33 0.89 164 RCVD_IN_VALIDITY_RPBL 2203 0.48 1.33 0.06 165 XMPhish30 2091 1.30 1.26 1.32 166 KHOP_HELO_FCRDNS 2046 1.19 1.23 1.17 167 TR_XM_Undi_RecipCombo3 2039 0.40 1.23 0.00 168 XM_H_Long_From02 2016 1.09 1.22 1.03 169 XMSubMetaI_00 1982 0.93 1.20 0.80 170 XMHTML_After_End 1980 1.01 1.19 0.91 171 FILL_THIS_FORM 1979 0.64 1.19 0.38 172 XM_OfRef7 1963 0.45 1.18 0.09 173 XMBrknScrpt_02 1947 0.68 1.17 0.44 174 URIBL_BLACK 1909 0.42 1.15 0.06 175 FILL_THIS_FORM_LONG 1888 0.48 1.14 0.16 176 XMReplyNow 1810 0.52 1.09 0.24 177 HTML_TAG_BALANCE_BODY 1799 0.83 1.08 0.71 178 XM_B_SEO 1795 0.43 1.08 0.11 179 THIS_AD 1789 0.68 1.08 0.48 180 T_TooManySym_03 1777 1.65 1.07 1.94 181 BAYES_00 1771 6.88 1.07 9.72 182 XM_B_DNDMA 1729 0.71 1.04 0.55 183 MONEY_FORM 1675 0.34 1.01 0.01 184 TR_XM_SEO4 1657 0.37 1.00 0.06 185 TR_XM_Undi_Recip9 1655 0.33 1.00 0.00 186 PLING_QUERY 1650 0.71 1.00 0.56 187 XM_UB99 1650 0.33 1.00 0.01 188 TR_XM_COVIDMETA1 1641 0.48 0.99 0.23 189 TR_XM_COVIDMETA4 1639 0.41 0.99 0.13 190 BASE64_LENGTH_79_INF 1596 0.74 0.96 0.64 191 URI_TRY_3LD 1579 0.66 0.95 0.51 192 BAYES_20 1571 2.54 0.95 3.31 193 TR_XM_InvalidRelay 1556 0.32 0.94 0.02 194 TR_XM_Base64_L1 1516 0.47 0.91 0.25 195 T_MONEY_PERCENT 1507 0.44 0.91 0.22 196 TR_LOTS_OF_MONEY2 1507 0.44 0.91 0.22 197 TR_Caps_n_Bayes_99 1491 0.32 0.90 0.04 198 XMMoneyMeta_00 1482 0.58 0.89 0.43 199 TR_XM_Undi_Recip6 1446 0.29 0.87 0.01 200 TR_XM_Spammywords 1437 0.46 0.87 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 293670 89.25 94.69 86.59 2 RELAYCOUNTRY_US 277138 81.32 80.50 81.71 3 DKIM_SIGNED 262343 82.28 92.37 77.35 4 XM_DK_Pass 256233 80.54 90.75 75.55 5 DKIM_VALID 252588 79.31 89.21 74.48 6 XM_B_Unicode 243091 75.95 84.69 71.68 7 DCC_CHECK_NEGATIVE 211309 51.08 28.13 62.30 8 DKIM_VALID_AU 203973 62.41 67.06 60.14 9 BAYES_50 197310 52.44 40.70 58.18 10 XMListUnsubscribeExists 176963 58.83 72.43 52.18 11 XM_B_SpammyWords 155894 54.28 71.28 45.97 12 XM_B_Unicode3 147178 44.53 46.84 43.40 13 RCVD_IN_MSPIKE_H2 138326 44.08 50.81 40.79 14 DCC_CHECK 127687 48.88 71.85 37.65 15 HTML_FONT_LOW_CONTRAST 96907 30.22 33.60 28.57 16 T_TM2_M_HEADER_IN_MSG 95812 25.69 20.45 28.25 17 DKIM_VALID_EF 94432 30.08 34.67 27.84 18 LOC_TINY_FONT_1 90334 30.09 37.15 26.64 19 FVGT_m_MULTI_ODD 88024 29.26 36.03 25.95 20 XMSubLong 79879 23.31 22.81 23.55 21 MIME_HTML_ONLY 71509 24.95 32.85 21.08 22 T_KAM_HTML_FONT_INVALID 71433 24.32 30.99 21.06 23 XM_B_SpammyWords2 66376 26.24 39.88 19.57 24 RCVD_IN_MSPIKE_WL 62163 17.71 16.43 18.33 25 ALL_TRUSTED 50444 10.68 2.11 14.87 26 XM_Multi_Part_URI 46358 15.50 19.24 13.67 27 USER_IN_DEF_DKIM_WL 45872 9.92 2.54 13.53 28 XM_Body_Dirty_Words 40150 15.73 23.70 11.84 29 RCVD_IN_MSPIKE_H3 37446 11.79 13.33 11.04 30 UNPARSEABLE_RELAY 34520 11.35 13.73 10.18 31 BAYES_00 32979 6.88 1.07 9.72 32 BAYES_60 32544 9.08 8.02 9.60 33 XM_DKIMWhitelistDomains 31540 6.34 0.28 9.30 34 XM_Evil_Numbers_Gen 30657 8.98 8.86 9.04 35 LotsOfNums_01 29603 8.01 6.54 8.73 36 XM_B_Unsub 29186 10.99 15.85 8.61 37 TooManyTo_001 27072 6.99 4.97 7.98 38 T_TooManySym_01 24798 5.85 2.85 7.31 39 XM_DK_Undo_02 24537 19.72 45.25 7.23 40 HTML_IMAGE_RATIO_02 24228 7.09 6.99 7.14 41 TR_XM_DK_Bayes 23566 4.95 0.85 6.95 42 IN_ZIMBRA_NJ_WHITELIST 23449 4.67 0.09 6.91 43 TR_XM_BayesUnsub 22914 9.56 15.30 6.76 44 TR_XM_DK_Bayes1 22693 4.77 0.85 6.69 45 LOTS_OF_MONEY 21273 8.45 12.92 6.27 46 TR_XM_DK_Bayes2 20683 4.34 0.74 6.10 47 XM_H_Long_From01 20629 6.18 6.39 6.08 48 XM_SendGrid 20499 6.06 6.08 6.04 49 RCVD_IN_MSPIKE_H4 20385 4.94 2.75 6.01 50 RCVD_IN_VALIDITY_SAFE 20197 5.18 3.59 5.96 51 MPART_ALT_DIFF 19679 6.82 8.90 5.80 52 HTML_IMAGE_RATIO_04 18991 5.55 5.44 5.60 53 XMStrtUSub 18009 4.94 4.20 5.31 54 BAYES_99 17999 14.36 32.89 5.31 55 TR_XM_DKIM_Undo 17983 15.87 37.49 5.30 56 MIME_QP_LONG_LINE 16989 4.45 3.31 5.01 57 RCVD_IN_VALIDITY_CERTIFIED 16895 4.27 2.83 4.98 58 RCVD_IN_IADB_LISTED 16741 3.89 1.74 4.94 59 HTML_IMAGE_RATIO_06 16537 4.55 3.89 4.88 60 XMNumbers 16428 4.74 4.54 4.84 61 XM_B_SpammyWords3 16040 7.44 12.98 4.73 62 BOTNET_IPINHOSTNAME 15839 7.80 14.21 4.67 63 BAYES_40 15660 3.58 1.45 4.62 64 T_TooManySym_02 15531 3.55 1.45 4.58 65 BAYES_80 15158 5.95 8.98 4.47 66 XM_PDF 15060 3.20 0.66 4.44 67 RCVD_IN_IADB_SPF 14965 3.47 1.54 4.41 68 RELAYCOUNTRY_META 14411 9.61 20.58 4.25 69 TR_XM_DK_SendGrid 14237 4.12 3.98 4.20 70 BAYES_999 14138 11.21 25.62 4.17 71 XM_UncommonTLD01 13900 5.20 7.47 4.10 72 TR_XM_PhishingBody 13736 4.86 6.52 4.05 73 RCVD_IN_IADB_SENDERID 13581 3.17 1.46 4.00 74 TR_XM_SpammyWords4 13411 6.22 10.86 3.95 75 XMSexyCombo_05 13359 6.32 11.20 3.94 76 RCVD_IN_IADB_DK 13260 3.11 1.47 3.91 77 T_REMOTE_IMAGE 12600 3.14 1.97 3.72 78 FSL_BULK_SIG 12497 5.61 9.56 3.68 79 XM_B_Phish_Phrases 12152 4.21 5.50 3.58 80 MIME_HTML_ONLY_MULTI 11318 4.13 5.76 3.34 81 BAYES_20 11233 2.54 0.95 3.31 82 XMSubMetaSx_00 10167 4.05 6.20 3.00 83 FROM_EXCESS_BASE64 10158 2.91 2.72 3.00 84 RCVD_IN_IADB_VOUCHED 10009 2.21 0.71 2.95 85 DKIM_INVALID 9755 2.97 3.16 2.88 86 BAYES_95 9349 3.62 5.39 2.76 87 MIME_HTML_MOSTLY 9277 3.05 3.69 2.74 88 MAILING_LIST_MULTI 8503 2.29 1.86 2.51 89 XM_B_SpammyTLD 8091 3.53 5.86 2.39 90 XM_H_Trusted_IP 7903 1.57 0.00 2.33 91 HTML_IMAGE_RATIO_08 7854 2.47 2.77 2.32 92 TR_DCC_Bayes_99 7752 9.40 23.95 2.29 93 XM_CamelCaseFrm001 7557 2.25 2.31 2.23 94 TR_XM_SpammyRelay 7293 6.58 15.65 2.15 95 HTML_MIME_NO_HTML_TAG 7269 2.72 3.91 2.14 96 INVALID_MSGID 7139 1.47 0.16 2.10 97 TR_XM_UnparsRelay 7096 4.21 8.53 2.09 98 URI_NOVOWEL 6932 1.85 1.46 2.04 99 BAYES_05 6919 1.55 0.56 2.04 100 TR_XM_SB_Phish 6917 1.97 1.84 2.04 101 XM_B_Phish66 6888 2.58 3.71 2.03 102 XMSubPhish11 6848 1.95 1.80 2.02 103 RCVD_IN_IADB_OPTIN 6721 1.47 0.42 1.98 104 MSGID_NOFQDN1 6686 1.33 0.03 1.97 105 TooManyTo_002 6590 1.52 0.66 1.94 106 T_TooManySym_03 6566 1.65 1.07 1.94 107 TM2_M_URI_OPT_OUT 6543 2.13 2.54 1.93 108 IN_HORDE_ADDRESS_BOOK 6445 1.31 0.10 1.90 109 BOTNET 6335 4.21 8.99 1.87 110 TR_Symld_Words 6213 1.84 1.84 1.83 111 T_XMDrugObfuBody_14 6065 2.40 3.65 1.79 112 TO_MALFORMED 6030 1.20 0.01 1.78 113 XMStockSpam_06 6001 1.88 2.11 1.77 114 XM_B_Investor 5894 2.73 4.76 1.74 115 ANY_BOUNCE_MESSAGE 5860 1.38 0.66 1.73 116 BOUNCE_MESSAGE 5859 1.38 0.66 1.73 117 TM2_M_VERY_LONG_WORD 5824 2.90 5.31 1.72 118 XM_SPF_SoftFail 5783 2.35 3.66 1.71 119 SUBJ_ALL_CAPS 5741 2.05 2.79 1.69 120 HTML_FONT_FACE_BAD 5732 1.38 0.74 1.69 121 TVD_SPACE_RATIO 5236 1.08 0.12 1.54 122 RELAYCOUNTRY_CA 5226 4.83 11.57 1.54 123 XM_DK_Undo_01 5198 2.11 3.30 1.53 124 XM_GoogleGroups 5159 2.01 3.00 1.52 125 XM_B_Unsub2 5129 1.83 2.49 1.51 126 UNTRUSTED_Relay 5100 2.68 5.09 1.50 127 URI_HEX 4889 1.43 1.40 1.44 128 HELO_NODOT 4799 1.16 0.63 1.41 129 HELO_NO_DOMAIN 4790 1.15 0.62 1.41 130 XMGappySubj_01 4774 0.98 0.12 1.41 131 T_XMDrugObfuBody_08 4667 2.40 4.51 1.38 132 TR_XM_SpammyWords5 4494 2.12 3.74 1.33 133 TooManyTo_003 4480 1.08 0.58 1.32 134 XMPhish30 4464 1.30 1.26 1.32 135 RCVD_IN_MSPIKE_H5 4332 0.97 0.35 1.28 136 TVD_RCVD_IP 4154 0.90 0.23 1.22 137 XMBdyGiftCard01 4051 1.38 1.77 1.19 138 XMDiploma_00 4000 1.62 2.52 1.18 139 KHOP_HELO_FCRDNS 3972 1.19 1.23 1.17 140 RCVD_IN_RP_SAFE 3947 1.03 0.75 1.16 141 TR_XM_SpammyWords2 3940 4.54 11.46 1.16 142 XMBody_95 3938 0.84 0.18 1.16 143 FROM_GOV_DKIM_AU 3851 0.89 0.38 1.14 144 XMLngstWrd_00 3702 1.65 2.79 1.09 145 XMSubNoVowel 3567 0.83 0.39 1.05 146 T_XMDrugObfuBody_00 3558 1.17 1.43 1.05 147 XM_H_Long_From02 3491 1.09 1.22 1.03 148 XMLngstWrd_01 3406 1.58 2.75 1.00 149 XM_OfRef6 3366 1.80 3.46 0.99 150 RCVD_IN_RP_CERTIFIED 3283 0.85 0.60 0.97 151 XM_B_SpammyWords4 3271 1.54 2.72 0.96 152 HTML_IMAGE_ONLY_20 3265 0.76 0.33 0.96 153 DKIM_ADSP_CUSTOM_MED 3256 0.86 0.65 0.96 154 TooManyTo_004 3159 0.78 0.48 0.93 155 XM_UB50 3115 1.39 2.35 0.92 156 XMHTML_After_End 3101 1.01 1.19 0.91 157 SpammyFromTLD_01 3082 1.53 2.79 0.91 158 T_FILL_THIS_FORM_SHORT 3048 1.84 3.76 0.90 159 XMCapTrack 3038 0.72 0.36 0.90 160 TR_XM_Base64_M1 3035 1.04 1.33 0.89 161 FVGT_m_MULTI_ODD_EMAIL 2972 0.64 0.15 0.88 162 XMLngstWrd_02 2913 1.45 2.67 0.86 163 XMBSHREFv2 2858 0.64 0.22 0.84 164 XMSubMetaI_00 2726 0.93 1.20 0.80 165 XM_B_COPY_HTML 2656 0.81 0.86 0.78 166 TR_XM_PHPDW 2608 1.14 1.89 0.77 167 TooManyTo_005 2539 0.65 0.46 0.75 168 XMLngstWrd_03 2538 1.29 2.40 0.75 169 TR_XM_PHPForged 2486 1.10 1.86 0.73 170 TR_XM_FormFill2 2471 1.09 1.84 0.73 171 XM_H_PHPOS 2445 1.09 1.83 0.72 172 HTML_TAG_BALANCE_BODY 2410 0.83 1.08 0.71 173 TR_MetaPhish_Combo_01 2390 0.74 0.81 0.70 174 MPART_ALT_DIFF_COUNT 2306 0.93 1.45 0.68 175 XM_ShortIntro_01 2297 0.55 0.29 0.68 176 XMLngstWrd_04 2208 1.21 2.35 0.65 177 T_OBFU_PDF_ATTACH 2199 0.46 0.08 0.65 178 NML_ADSP_CUSTOM_MED 2173 0.61 0.53 0.64 179 BASE64_LENGTH_79_INF 2158 0.74 0.96 0.64 180 T_XMHurry_00 2156 1.00 1.73 0.64 181 RCVD_IN_BL_SPAMCOP_NET 2150 3.64 9.78 0.63 182 XMGenDplmaNmb 2119 0.89 1.43 0.62 183 XM_Body_Dirty_Words_01 2087 0.99 1.75 0.62 184 SpammyFromTLD_02 2041 1.39 3.02 0.60 185 HTTPS_HTTP_MISMATCH 2037 0.99 1.80 0.60 186 TM2_M_BODY_EMPTY 2037 0.43 0.08 0.60 187 FORGED_GMAIL_RCVD 1946 0.56 0.52 0.57 188 XM_H_PHPMailer 1921 0.63 0.77 0.57 189 PLING_QUERY 1915 0.71 1.00 0.56 190 RCVD_IN_PSBL 1902 0.62 0.75 0.56 191 XM_ProductURIs 1869 0.62 0.75 0.55 192 XM_B_DNDMA 1850 0.71 1.04 0.55 193 LongTLD 1823 0.61 0.76 0.54 194 XM_B_REG_HTML 1776 0.58 0.70 0.52 195 XMNoVowels 1767 0.50 0.45 0.52 196 URI_TRY_3LD 1740 0.66 0.95 0.51 197 XMHTMLBadTable_001 1701 0.57 0.70 0.50 198 RELAYCOUNTRY_GB 1682 0.61 0.85 0.50 199 THIS_AD 1627 0.68 1.08 0.48 200 XMOemUri 1574 0.36 0.15 0.46 ----------------------------------------------------------------------