Email: 551368 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 1.39 sec Spam: 176386 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.50 sec Ham: 374982 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.34 sec Time Spent Running SA: 213.20 hours Time Spent Processing Spam: 73.60 hours Time Spent Processing Ham: 139.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170627 90.25 96.74 87.20 2 DKIM_SIGNED 162646 80.24 92.21 74.61 3 XM_DK_Pass 159463 78.40 90.41 72.76 4 DKIM_VALID 158163 77.50 89.67 71.78 5 RELAYCOUNTRY_US 145761 80.46 82.64 79.44 6 XM_B_Unicode 144414 74.30 81.87 70.74 7 XMListUnsubscribeExists 133126 58.21 75.47 50.08 8 XM_B_SpammyWords 124840 54.23 70.78 46.45 9 DKIM_VALID_AU 121100 60.97 68.66 57.36 10 DCC_CHECK 118751 44.58 67.32 33.88 11 RCVD_IN_MSPIKE_H2 86589 42.05 49.09 38.74 12 XM_DK_Undo_02 79222 18.69 44.91 6.36 13 XM_B_Unicode3 78407 41.42 44.45 39.99 14 XM_B_SpammyWords2 74119 27.41 42.02 20.54 15 BAYES_50 73054 52.56 41.42 57.80 16 LOC_TINY_FONT_1 69513 29.08 39.41 24.22 17 FVGT_m_MULTI_ODD 67724 29.59 38.40 25.45 18 TR_XM_DKIM_Undo 64092 14.72 36.34 4.55 19 MIME_HTML_ONLY 61090 25.09 34.63 20.60 20 HTML_FONT_LOW_CONTRAST 59810 29.41 33.91 27.29 21 BAYES_99 59349 14.06 33.65 4.85 22 DCC_CHECK_NEGATIVE 57614 55.38 32.66 66.07 23 DKIM_VALID_EF 57256 29.20 32.46 27.67 24 T_KAM_HTML_FONT_INVALID 50965 22.77 28.89 19.88 25 BAYES_999 45255 10.78 25.66 3.78 26 XM_Body_Dirty_Words 42965 15.48 24.36 11.31 27 TR_DCC_Bayes_99 42491 9.07 24.09 2.00 28 XMSubLong 40515 22.44 22.97 22.20 29 T_TM2_M_HEADER_IN_MSG 36900 26.79 20.92 29.55 30 RELAYCOUNTRY_META 35931 9.54 20.37 4.44 31 XM_Multi_Part_URI 33844 14.64 19.19 12.51 32 RCVD_IN_MSPIKE_WL 29983 18.01 17.00 18.49 33 XM_B_Unsub 26680 10.08 15.13 7.70 34 TR_XM_BayesUnsub 25998 8.94 14.74 6.21 35 TR_XM_SpammyRelay 24337 5.77 13.80 1.99 36 RCVD_IN_MSPIKE_H3 24289 12.40 13.77 11.75 37 UNPARSEABLE_RELAY 24011 10.73 13.61 9.38 38 XM_B_SpammyWords3 23722 7.26 13.45 4.35 39 BOTNET_IPINHOSTNAME 22768 7.18 12.91 4.48 40 LOTS_OF_MONEY 21235 8.90 12.04 7.42 41 TR_XM_SpammyWords2 21040 4.39 11.93 0.85 42 XMSexyCombo_05 20288 5.87 11.50 3.22 43 TR_XM_SpammyWords4 18518 6.55 10.50 4.69 44 XM_Evil_Numbers_Gen 17615 9.36 9.99 9.07 45 MPART_ALT_DIFF 17550 6.43 9.95 4.77 46 RELAYCOUNTRY_CA 17475 4.04 9.91 1.27 47 RCVD_IN_BL_SPAMCOP_NET 17382 3.67 9.85 0.76 48 XM_UncommonTLD01 15769 5.63 8.94 4.08 49 BOTNET 15453 3.83 8.76 1.51 50 BAYES_80 15164 5.88 8.60 4.61 51 XM_SendGrid 14855 7.10 8.42 6.48 52 TR_XM_UnparsRelay 14800 3.93 8.39 1.83 53 TR_XM_SPAMCOP 14514 2.83 8.23 0.30 54 FSL_BULK_SIG 14193 4.67 8.05 3.08 55 MIME_HTML_ONLY_MULTI 14025 4.77 7.95 3.27 56 TM2_M_VERY_LONG_WORD 13907 3.77 7.88 1.83 57 BAYES_60 13376 8.68 7.58 9.20 58 LotsOfNums_01 12885 8.41 7.31 8.93 59 TR_XM_PhishingBody 12324 4.78 6.99 3.74 60 HTML_MIME_NO_HTML_TAG 11186 3.66 6.34 2.40 61 HTML_IMAGE_RATIO_02 11008 5.63 6.24 5.34 62 XMLngstWrd_00 10236 2.79 5.80 1.37 63 XMLngstWrd_01 10157 2.73 5.76 1.30 64 XM_GoogleGroups 9944 3.10 5.64 1.91 65 UNTRUSTED_Relay 9888 2.79 5.61 1.47 66 BAYES_95 9474 3.76 5.37 3.01 67 XM_B_Phish_Phrases 9456 3.84 5.36 3.12 68 XMSubMetaSx_00 9419 3.90 5.34 3.23 69 TR_XM_DK_SendGrid 9388 4.63 5.32 4.30 70 XM_B_Investor 9293 3.03 5.27 1.97 71 XMLngstWrd_02 9246 2.45 5.24 1.14 72 XM_H_Long_From01 9023 5.35 5.12 5.46 73 XMLngstWrd_03 8962 2.26 5.08 0.93 74 XMLngstWrd_04 8775 2.17 4.97 0.85 75 HTML_TITLE_SUBJ_DIFF 8685 2.05 4.92 0.70 76 UPPERCASE_75_100 8632 2.03 4.89 0.69 77 TooManyTo_001 8598 7.24 4.87 8.35 78 XM_B_SpammyTLD 8532 3.35 4.84 2.66 79 XM_DIRTYINTL 7925 1.63 4.49 0.28 80 HTML_IMAGE_RATIO_04 7829 4.59 4.44 4.66 81 HTML_IMAGE_RATIO_06 7399 4.14 4.19 4.11 82 SpammyFromTLD_02 7349 1.83 4.17 0.73 83 RCVD_IN_VALIDITY_SAFE 7084 4.94 4.02 5.38 84 XMStrtUSub 7073 4.59 4.01 4.86 85 XM_B_Phish66 6870 2.70 3.89 2.14 86 TR_XM_SpammyWords5 6531 2.24 3.70 1.56 87 MIME_QP_LONG_LINE 6512 4.56 3.69 4.97 88 XM_SPF_SoftFail 6346 2.47 3.60 1.94 89 HTML_IMAGE_RATIO_08 6261 2.75 3.55 2.37 90 T_XMDrugObfuBody_08 6258 2.03 3.55 1.32 91 T_XMDrugObfuBody_14 6204 2.12 3.52 1.46 92 XMNumbers 6170 4.03 3.50 4.28 93 MIME_HTML_MOSTLY 5913 2.57 3.35 2.20 94 RCVD_IN_VALIDITY_CERTIFIED 5865 4.30 3.33 4.76 95 RCVD_IN_MSPIKE_BL 5762 1.62 3.27 0.84 96 T_FILL_THIS_FORM_SHORT 5711 1.56 3.24 0.78 97 TR_XM_MSPIKECOMBO 5649 1.58 3.20 0.82 98 XMBody_17 5643 1.31 3.20 0.43 99 TM2_M_URI_OPT_OUT 5371 2.28 3.05 1.92 100 URIBL_DBL_SPAM 5281 0.97 2.99 0.02 101 XM_B_SpammyWords4 5122 1.32 2.90 0.57 102 RCVD_IN_MSPIKE_H4 4802 4.53 2.72 5.39 103 PDS_OTHER_BAD_TLD 4712 1.00 2.67 0.21 104 SpammyFromTLD_01 4702 1.36 2.67 0.74 105 FROM_EXCESS_BASE64 4584 2.65 2.60 2.68 106 DKIM_INVALID 4483 2.74 2.54 2.83 107 USER_IN_DEF_DKIM_WL 4228 9.83 2.40 13.33 108 TR_XM_SpammyWords3 4212 0.96 2.39 0.29 109 XM_B_Unsub2 4139 1.82 2.35 1.57 110 URI_PHP_REDIR 4107 0.75 2.33 0.01 111 XM_UB50 4092 1.37 2.32 0.93 112 XM_DK_Undo_01 4086 1.84 2.32 1.61 113 XM_OfRef6 4045 1.36 2.29 0.92 114 RCVD_IN_MSPIKE_L5 3919 0.76 2.22 0.07 115 T_TooManySym_01 3782 5.34 2.14 6.84 116 XMStockSpam_06 3757 1.55 2.13 1.27 117 XMDiploma_00 3558 1.45 2.02 1.19 118 TR_XM_SB_Phish 3499 2.36 1.98 2.54 119 XM_CamelCaseFrm001 3491 2.13 1.98 2.20 120 XMSexyCombo_01 3480 0.96 1.97 0.48 121 MAILING_LIST_MULTI 3430 2.58 1.94 2.87 122 TR_XM_FormFill 3410 0.62 1.93 0.01 123 HK_RANDOM_REPLYTO 3325 0.71 1.89 0.15 124 HTTPS_HTTP_MISMATCH 3196 1.18 1.81 0.89 125 T_REMOTE_IMAGE 3182 3.13 1.80 3.75 126 RCVD_IN_IADB_LISTED 3170 3.65 1.80 4.52 127 XMSubPhish11 3125 2.19 1.77 2.39 128 XM_URI_RBL 3072 0.65 1.74 0.13 129 T_XMHurry_00 3038 2.04 1.72 2.19 130 URI_NOVOWEL 2962 1.84 1.68 1.92 131 TR_XM_NoHeaderRelay 2915 0.62 1.65 0.13 132 FONT_INVIS_LONG_LINE 2829 0.56 1.60 0.07 133 RCVD_IN_IADB_SPF 2795 3.26 1.58 4.05 134 ALL_TRUSTED 2789 12.21 1.58 17.21 135 URI_HEX 2777 1.33 1.57 1.21 136 BOTNET_NORDNS 2776 0.51 1.57 0.01 137 SUBJ_ALL_CAPS 2749 1.78 1.56 1.89 138 TR_XM_PHPDW 2725 0.88 1.54 0.57 139 XMHTML_After_End 2711 1.17 1.54 0.99 140 TR_LOTS_OF_MONEY3 2704 0.74 1.53 0.37 141 XMBrknScrpt_02 2681 0.86 1.52 0.55 142 RCVD_IN_VALIDITY_RPBL 2641 0.50 1.50 0.04 143 RCVD_IN_IADB_DK 2633 2.94 1.49 3.62 144 XM_UB99 2610 0.48 1.48 0.00 145 RCVD_IN_IADB_SENDERID 2605 2.99 1.48 3.70 146 TR_XM_BayesRelay 2604 0.48 1.48 0.00 147 XMBdyGiftCard01 2568 1.16 1.46 1.02 148 URIBL_BLACK 2531 0.49 1.43 0.05 149 TR_XM_PHPForged 2503 0.81 1.42 0.52 150 TR_XM_FormFill2 2449 0.80 1.39 0.52 151 XM_H_PHPOS 2447 0.79 1.39 0.51 152 TR_XM_Base64_M1 2440 1.20 1.38 1.12 153 T_XMDrugObfuBody_00 2429 0.77 1.38 0.49 154 DATE_IN_PAST_06_12 2403 0.47 1.36 0.06 155 FROM_SUSPICIOUS_NTLD 2393 0.46 1.36 0.04 156 RELAYCOUNTRY_AU 2390 0.67 1.35 0.34 157 XM_ProductURIs 2337 0.80 1.32 0.56 158 BAYES_40 2315 3.85 1.31 5.05 159 THIS_AD 2279 0.69 1.29 0.41 160 LongTLD 2218 0.69 1.26 0.42 161 KHOP_HELO_FCRDNS 2198 1.33 1.25 1.37 162 XMSubMetaI_00 2170 1.07 1.23 1.00 163 TR_XM_InvalidRelay 2121 0.40 1.20 0.02 164 XM_B_COVIDMETA 2107 0.59 1.19 0.31 165 XM_UB999 2087 0.38 1.18 0.00 166 REMOVE_BEFORE_LINK 2042 0.53 1.16 0.23 167 XMPhish30 1976 0.79 1.12 0.63 168 ANY_BOUNCE_MESSAGE 1975 1.50 1.12 1.68 169 BOUNCE_MESSAGE 1956 1.50 1.11 1.68 170 XM_B_SEO 1949 0.47 1.10 0.17 171 MPART_ALT_DIFF_COUNT 1946 0.71 1.10 0.53 172 XMGenDplmaNmb 1902 0.75 1.08 0.59 173 FROM_SUSPICIOUS_NTLD_FP 1897 0.37 1.08 0.04 174 RELAYCOUNTRY_FR 1842 0.52 1.04 0.28 175 TR_XM_SEO4 1836 0.41 1.04 0.12 176 XMReplyNow 1831 0.49 1.04 0.23 177 TR_XM_COVIDMETA1 1801 0.42 1.02 0.13 178 XM_H_Long_From02 1793 1.10 1.02 1.14 179 HTML_FONT_TINY_NORDNS 1779 0.41 1.01 0.13 180 XMPhish14 1776 0.69 1.01 0.55 181 TR_MetaPhish_Combo_01 1711 0.79 0.97 0.71 182 HTML_TAG_BALANCE_BODY 1698 0.74 0.96 0.64 183 PLING_QUERY 1676 0.65 0.95 0.50 184 DATE_IN_PAST_03_06 1674 0.45 0.95 0.21 185 RCVD_IN_RP_SAFE 1648 0.98 0.93 1.01 186 XM_RXBody 1641 0.60 0.93 0.44 187 TR_Symld_Words 1631 1.37 0.92 1.58 188 NORDNS_LOW_CONTRAST 1628 0.34 0.92 0.07 189 RELAYCOUNTRY_GB 1602 0.84 0.91 0.80 190 URI_TRY_3LD 1591 0.64 0.90 0.52 191 BAYES_20 1586 2.85 0.90 3.77 192 XMSlimDrugH 1584 0.62 0.90 0.48 193 TR_XM_COVIDMETA4 1562 0.37 0.89 0.13 194 XM_Body_Dirty_Words_01 1556 0.34 0.88 0.09 195 XMBody_78 1555 0.56 0.88 0.41 196 DIET_1 1528 0.51 0.87 0.35 197 T_Symld_Words_02 1479 0.63 0.84 0.53 198 RELAYCOUNTRY_RU 1479 0.29 0.84 0.03 199 XM_H_Undi_Recip 1479 0.42 0.84 0.22 200 TR_LOTS_OF_MONEY2 1441 0.37 0.82 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 326984 90.25 96.74 87.20 2 RELAYCOUNTRY_US 297877 80.46 82.64 79.44 3 DKIM_SIGNED 279782 80.24 92.21 74.61 4 XM_DK_Pass 272821 78.40 90.41 72.76 5 DKIM_VALID 269156 77.50 89.67 71.78 6 XM_B_Unicode 265267 74.30 81.87 70.74 7 DCC_CHECK_NEGATIVE 247753 55.38 32.66 66.07 8 BAYES_50 216735 52.56 41.42 57.80 9 DKIM_VALID_AU 215087 60.97 68.66 57.36 10 XMListUnsubscribeExists 187802 58.21 75.47 50.08 11 XM_B_SpammyWords 174192 54.23 70.78 46.45 12 XM_B_Unicode3 149948 41.42 44.45 39.99 13 RCVD_IN_MSPIKE_H2 145270 42.05 49.09 38.74 14 DCC_CHECK 127060 44.58 67.32 33.88 15 T_TM2_M_HEADER_IN_MSG 110797 26.79 20.92 29.55 16 DKIM_VALID_EF 103760 29.20 32.46 27.67 17 HTML_FONT_LOW_CONTRAST 102328 29.41 33.91 27.29 18 FVGT_m_MULTI_ODD 95422 29.59 38.40 25.45 19 LOC_TINY_FONT_1 90807 29.08 39.41 24.22 20 XMSubLong 83234 22.44 22.97 22.20 21 MIME_HTML_ONLY 77240 25.09 34.63 20.60 22 XM_B_SpammyWords2 77018 27.41 42.02 20.54 23 T_KAM_HTML_FONT_INVALID 74563 22.77 28.89 19.88 24 RCVD_IN_MSPIKE_WL 69322 18.01 17.00 18.49 25 ALL_TRUSTED 64531 12.21 1.58 17.21 26 USER_IN_DEF_DKIM_WL 49969 9.83 2.40 13.33 27 XM_Multi_Part_URI 46899 14.64 19.19 12.51 28 RCVD_IN_MSPIKE_H3 44074 12.40 13.77 11.75 29 XM_Body_Dirty_Words 42392 15.48 24.36 11.31 30 BAYES_00 35802 6.73 0.73 9.55 31 UNPARSEABLE_RELAY 35176 10.73 13.61 9.38 32 BAYES_60 34491 8.68 7.58 9.20 33 XM_Evil_Numbers_Gen 34001 9.36 9.99 9.07 34 LotsOfNums_01 33496 8.41 7.31 8.93 35 XM_DKIMWhitelistDomains 32868 5.97 0.03 8.77 36 TooManyTo_001 31320 7.24 4.87 8.35 37 XM_B_Unsub 28882 10.08 15.13 7.70 38 LOTS_OF_MONEY 27827 8.90 12.04 7.42 39 T_TooManySym_01 25648 5.34 2.14 6.84 40 IN_ZIMBRA_NJ_WHITELIST 25363 4.63 0.10 6.76 41 XM_SendGrid 24283 7.10 8.42 6.48 42 XM_DK_Undo_02 23853 18.69 44.91 6.36 43 TR_XM_BayesUnsub 23272 8.94 14.74 6.21 44 TR_XM_DK_Bayes 22859 4.31 0.51 6.10 45 TR_XM_DK_Bayes1 22456 4.23 0.50 5.99 46 XM_H_Long_From01 20491 5.35 5.12 5.46 47 RCVD_IN_MSPIKE_H4 20193 4.53 2.72 5.39 48 RCVD_IN_VALIDITY_SAFE 20177 4.94 4.02 5.38 49 HTML_IMAGE_RATIO_02 20011 5.63 6.24 5.34 50 TR_XM_DK_Bayes2 19910 3.72 0.34 5.31 51 XM_PDF 19548 3.74 0.61 5.21 52 BAYES_40 18923 3.85 1.31 5.05 53 MIME_QP_LONG_LINE 18622 4.56 3.69 4.97 54 XMStrtUSub 18218 4.59 4.01 4.86 55 BAYES_99 18175 14.06 33.65 4.85 56 MPART_ALT_DIFF 17881 6.43 9.95 4.77 57 RCVD_IN_VALIDITY_CERTIFIED 17858 4.30 3.33 4.76 58 TR_XM_SpammyWords4 17598 6.55 10.50 4.69 59 HTML_IMAGE_RATIO_04 17468 4.59 4.44 4.66 60 BAYES_80 17281 5.88 8.60 4.61 61 TR_XM_DKIM_Undo 17071 14.72 36.34 4.55 62 RCVD_IN_IADB_LISTED 16945 3.65 1.80 4.52 63 BOTNET_IPINHOSTNAME 16806 7.18 12.91 4.48 64 RELAYCOUNTRY_META 16655 9.54 20.37 4.44 65 XM_B_SpammyWords3 16301 7.26 13.45 4.35 66 TR_XM_DK_SendGrid 16115 4.63 5.32 4.30 67 XMNumbers 16065 4.03 3.50 4.28 68 HTML_IMAGE_RATIO_06 15421 4.14 4.19 4.11 69 XM_UncommonTLD01 15282 5.63 8.94 4.08 70 RCVD_IN_IADB_SPF 15204 3.26 1.58 4.05 71 T_TooManySym_02 14287 2.79 0.61 3.81 72 BAYES_999 14159 10.78 25.66 3.78 73 BAYES_20 14149 2.85 0.90 3.77 74 T_REMOTE_IMAGE 14076 3.13 1.80 3.75 75 TR_XM_PhishingBody 14008 4.78 6.99 3.74 76 RCVD_IN_IADB_SENDERID 13867 2.99 1.48 3.70 77 RCVD_IN_IADB_DK 13562 2.94 1.49 3.62 78 MIME_HTML_ONLY_MULTI 12262 4.77 7.95 3.27 79 XMSubMetaSx_00 12105 3.90 5.34 3.23 80 XMSexyCombo_05 12058 5.87 11.50 3.22 81 XM_B_Phish_Phrases 11699 3.84 5.36 3.12 82 FSL_BULK_SIG 11534 4.67 8.05 3.08 83 BAYES_95 11279 3.76 5.37 3.01 84 MAILING_LIST_MULTI 10770 2.58 1.94 2.87 85 DKIM_INVALID 10626 2.74 2.54 2.83 86 RCVD_IN_IADB_VOUCHED 10324 2.13 0.81 2.75 87 FROM_EXCESS_BASE64 10052 2.65 2.60 2.68 88 XM_B_SpammyTLD 9957 3.35 4.84 2.66 89 TR_XM_SB_Phish 9514 2.36 1.98 2.54 90 HTML_MIME_NO_HTML_TAG 8993 3.66 6.34 2.40 91 XMSubPhish11 8969 2.19 1.77 2.39 92 HTML_IMAGE_RATIO_08 8885 2.75 3.55 2.37 93 MIME_HTML_MOSTLY 8267 2.57 3.35 2.20 94 XM_CamelCaseFrm001 8234 2.13 1.98 2.20 95 T_XMHurry_00 8220 2.04 1.72 2.19 96 TooManyTo_002 8178 1.70 0.68 2.18 97 BAYES_05 8146 1.62 0.44 2.17 98 XM_B_Phish66 8026 2.70 3.89 2.14 99 TR_DCC_Bayes_99 7502 9.07 24.09 2.00 100 TR_XM_SpammyRelay 7480 5.77 13.80 1.99 101 INVALID_MSGID 7412 1.39 0.14 1.98 102 XM_B_Investor 7398 3.03 5.27 1.97 103 XM_SPF_SoftFail 7258 2.47 3.60 1.94 104 URI_NOVOWEL 7203 1.84 1.68 1.92 105 TM2_M_URI_OPT_OUT 7198 2.28 3.05 1.92 106 XM_H_Trusted_IP 7192 1.30 0.00 1.92 107 XM_GoogleGroups 7149 3.10 5.64 1.91 108 SUBJ_ALL_CAPS 7090 1.78 1.56 1.89 109 MSGID_NOFQDN1 6938 1.27 0.03 1.85 110 TM2_M_VERY_LONG_WORD 6876 3.77 7.88 1.83 111 TR_XM_UnparsRelay 6857 3.93 8.39 1.83 112 RCVD_IN_IADB_OPTIN 6765 1.37 0.44 1.80 113 IN_HORDE_ADDRESS_BOOK 6664 1.23 0.08 1.78 114 HELO_NODOT 6658 1.37 0.50 1.78 115 HELO_NO_DOMAIN 6653 1.36 0.49 1.77 116 TVD_RCVD_IP 6449 1.23 0.18 1.72 117 ANY_BOUNCE_MESSAGE 6309 1.50 1.12 1.68 118 BOUNCE_MESSAGE 6306 1.50 1.11 1.68 119 XM_DK_Undo_01 6036 1.84 2.32 1.61 120 TO_MALFORMED 6035 1.11 0.06 1.61 121 TR_Symld_Words 5936 1.37 0.92 1.58 122 XM_B_Unsub2 5889 1.82 2.35 1.57 123 TR_XM_SpammyWords5 5843 2.24 3.70 1.56 124 BOTNET 5659 3.83 8.76 1.51 125 TooManyTo_003 5613 1.20 0.57 1.50 126 T_TooManySym_03 5593 1.09 0.22 1.49 127 UNTRUSTED_Relay 5496 2.79 5.61 1.47 128 T_XMDrugObfuBody_14 5491 2.12 3.52 1.46 129 TVD_SPACE_RATIO 5303 0.99 0.09 1.41 130 XMLngstWrd_00 5147 2.79 5.80 1.37 131 KHOP_HELO_FCRDNS 5141 1.33 1.25 1.37 132 RCVD_IN_MSPIKE_H5 5055 1.08 0.51 1.35 133 T_XMDrugObfuBody_08 4944 2.03 3.55 1.32 134 XMLngstWrd_01 4880 2.73 5.76 1.30 135 RELAYCOUNTRY_CA 4776 4.04 9.91 1.27 136 XMStockSpam_06 4765 1.55 2.13 1.27 137 T_OBFU_PDF_ATTACH 4760 0.90 0.10 1.27 138 URI_HEX 4553 1.33 1.57 1.21 139 XMDiploma_00 4462 1.45 2.02 1.19 140 XMGappySubj_01 4461 1.01 0.63 1.19 141 XMBSHREFv2 4289 0.88 0.32 1.14 142 XM_H_Long_From02 4286 1.10 1.02 1.14 143 XMLngstWrd_02 4263 2.45 5.24 1.14 144 TooManyTo_004 4220 0.92 0.48 1.13 145 TR_XM_Base64_M1 4182 1.20 1.38 1.12 146 XMCapTrack 3951 0.87 0.48 1.05 147 XMBdyGiftCard01 3811 1.16 1.46 1.02 148 RCVD_IN_RP_SAFE 3780 0.98 0.93 1.01 149 XMSubMetaI_00 3742 1.07 1.23 1.00 150 XMHTML_After_End 3713 1.17 1.54 0.99 151 HTML_FONT_FACE_BAD 3673 0.91 0.78 0.98 152 XMSubNoVowel 3569 0.76 0.36 0.95 153 TooManyTo_005 3489 0.78 0.45 0.93 154 XM_UB50 3488 1.37 2.32 0.93 155 XMLngstWrd_03 3481 2.26 5.08 0.93 156 XM_OfRef6 3461 1.36 2.29 0.92 157 RCVD_IN_RP_CERTIFIED 3328 0.85 0.78 0.89 158 HTTPS_HTTP_MISMATCH 3323 1.18 1.81 0.89 159 FROM_GOV_DKIM_AU 3232 0.63 0.15 0.86 160 XMLngstWrd_04 3206 2.17 4.97 0.85 161 TR_XM_SpammyWords2 3188 4.39 11.93 0.85 162 RCVD_IN_MSPIKE_BL 3168 1.62 3.27 0.84 163 TR_XM_MSPIKECOMBO 3071 1.58 3.20 0.82 164 DKIM_ADSP_CUSTOM_MED 3062 0.76 0.65 0.82 165 XMBody_95 3003 0.59 0.14 0.80 166 RELAYCOUNTRY_GB 3002 0.84 0.91 0.80 167 XM_ShortIntro_01 2989 0.68 0.43 0.80 168 FVGT_m_MULTI_ODD_EMAIL 2964 0.57 0.11 0.79 169 T_FILL_THIS_FORM_SHORT 2911 1.56 3.24 0.78 170 RCVD_IN_BL_SPAMCOP_NET 2841 3.67 9.85 0.76 171 SpammyFromTLD_01 2782 1.36 2.67 0.74 172 SpammyFromTLD_02 2756 1.83 4.17 0.73 173 TR_MetaPhish_Combo_01 2648 0.79 0.97 0.71 174 HTML_TITLE_SUBJ_DIFF 2631 2.05 4.92 0.70 175 UPPERCASE_75_100 2577 2.03 4.89 0.69 176 RCVD_IN_MSPIKE_L3 2535 0.71 0.78 0.68 177 XM_B_COPY_HTML 2507 0.64 0.59 0.67 178 HTML_TAG_BALANCE_BODY 2396 0.74 0.96 0.64 179 XMPhish30 2364 0.79 1.12 0.63 180 XMNoVowels 2221 0.55 0.45 0.59 181 XMGenDplmaNmb 2214 0.75 1.08 0.59 182 XM_B_SpammyWords4 2133 1.32 2.90 0.57 183 TR_XM_PHPDW 2123 0.88 1.54 0.57 184 XMHTMLBadTable_001 2112 0.63 0.78 0.56 185 SHORT_HELO_AND_INLINE_IMAGE 2100 0.40 0.07 0.56 186 XM_ProductURIs 2095 0.80 1.32 0.56 187 XMBrknScrpt_02 2059 0.86 1.52 0.55 188 XMPhish14 2046 0.69 1.01 0.55 189 RCVD_IN_PSBL 2031 0.55 0.57 0.54 190 T_Symld_Words_02 1994 0.63 0.84 0.53 191 HTML_IMAGE_ONLY_20 1992 0.44 0.23 0.53 192 MPART_ALT_DIFF_COUNT 1976 0.71 1.10 0.53 193 URI_TRY_3LD 1965 0.64 0.90 0.52 194 TR_XM_PHPForged 1961 0.81 1.42 0.52 195 XM_H_PHPMailer 1958 0.60 0.75 0.52 196 TR_XM_FormFill2 1941 0.80 1.39 0.52 197 XM_H_PHPOS 1912 0.79 1.39 0.51 198 NML_ADSP_CUSTOM_MED 1898 0.51 0.51 0.51 199 MISSING_HEADERS 1896 0.49 0.45 0.51 200 PLING_QUERY 1881 0.65 0.95 0.50 ----------------------------------------------------------------------