Email: 677737 Autolearn: 0 AvgScore: 3.35 AvgScanTime: 1.23 sec Spam: 178579 Autolearn: 0 AvgScore: 13.03 AvgScanTime: 1.40 sec Ham: 499158 Autolearn: 0 AvgScore: -0.11 AvgScanTime: 1.16 sec Time Spent Running SA: 230.67 hours Time Spent Processing Spam: 69.62 hours Time Spent Processing Ham: 161.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167548 90.98 93.82 89.97 2 DKIM_SIGNED 142085 77.75 79.56 77.11 3 XM_B_Unicode 138585 72.13 77.60 70.18 4 XM_DK_Pass 138070 76.21 77.32 75.82 5 DCC_CHECK 135039 48.63 75.62 38.98 6 DKIM_VALID 133936 73.86 75.00 73.46 7 RELAYCOUNTRY_US 131309 79.20 73.53 81.23 8 XMListUnsubscribeExists 120192 55.47 67.30 51.23 9 XM_B_SpammyWords 119517 55.54 66.93 51.47 10 DKIM_VALID_AU 103960 56.13 58.22 55.39 11 XM_DK_Undo_02 74284 17.19 41.60 8.46 12 XM_B_Unicode3 72590 39.59 40.65 39.21 13 XM_B_SpammyWords2 72421 28.46 40.55 24.13 14 BAYES_50 64776 51.76 36.27 57.30 15 BAYES_99 62489 12.80 34.99 4.85 16 HTML_FONT_LOW_CONTRAST 60102 29.00 33.66 27.34 17 LOC_TINY_FONT_1 60102 25.60 33.66 22.72 18 MIME_HTML_ONLY 53479 22.15 29.95 19.36 19 RCVD_IN_MSPIKE_H2 51057 26.56 28.59 25.83 20 FVGT_m_MULTI_ODD 48680 23.47 27.26 22.11 21 BAYES_999 48296 10.00 27.04 3.91 22 T_KAM_HTML_FONT_INVALID 47808 20.52 26.77 18.28 23 DKIM_VALID_EF 47207 28.78 26.43 29.62 24 TR_DCC_Bayes_99 46383 8.47 25.97 2.21 25 XMSubLong 45832 23.42 25.66 22.62 26 T_TM2_M_HEADER_IN_MSG 42847 28.94 23.99 30.71 27 DCC_CHECK_NEGATIVE 40490 49.29 22.67 58.82 28 RELAYCOUNTRY_META 40318 9.97 22.58 5.46 29 XM_Multi_Part_URI 35949 14.26 20.13 12.15 30 XM_Body_Dirty_Words 33135 14.19 18.55 12.63 31 UNTRUSTED_Relay 33112 6.53 18.54 2.24 32 RCVD_IN_MSPIKE_WL 29796 25.69 16.69 28.92 33 BOTNET 28829 5.78 16.14 2.08 34 TR_XM_SpammyWords2 27428 4.98 15.36 1.27 35 LOTS_OF_MONEY 24860 9.27 13.92 7.61 36 FSL_BULK_SIG 24667 7.27 13.81 4.93 37 BOTNET_IPINHOSTNAME 24334 6.97 13.63 4.59 38 LotsOfNums_01 21292 9.91 11.92 9.18 39 XM_B_Unsub 20804 11.43 11.65 11.35 40 XM_B_SpammyWords3 20515 7.05 11.49 5.46 41 XM_B_Phish_Phrases 19621 8.13 10.99 7.11 42 XM_Evil_Numbers_Gen 19558 8.69 10.95 7.88 43 XM_UncommonTLD01 19547 5.36 10.95 3.36 44 RCVD_IN_MSPIKE_BL 18261 3.30 10.23 0.82 45 XMSexyCombo_05 17788 5.38 9.96 3.75 46 RCVD_IN_MSPIKE_H3 16540 14.11 9.26 15.85 47 BAYES_80 16159 5.48 9.05 4.21 48 BAYES_60 15002 7.79 8.40 7.57 49 XM_UB50 14389 3.02 8.06 1.22 50 MPART_ALT_DIFF 13009 4.81 7.28 3.92 51 RCVD_IN_BL_SPAMCOP_NET 12640 3.11 7.08 1.69 52 T_REMOTE_IMAGE 12621 4.32 7.07 3.34 53 RCVD_IN_MSPIKE_H4 12165 9.85 6.81 10.94 54 XMSubMetaSx_00 11785 4.54 6.60 3.80 55 KHOP_HELO_FCRDNS 11323 2.98 6.34 1.78 56 TR_XM_PhishingBody 11052 3.69 6.19 2.80 57 HTML_IMAGE_RATIO_02 10973 6.28 6.14 6.33 58 TooManyTo_001 10836 7.93 6.07 8.59 59 UNPARSEABLE_RELAY 10663 7.00 5.97 7.37 60 RELAYCOUNTRY_CA 9748 2.64 5.46 1.63 61 XMNumbers 9571 3.97 5.36 3.47 62 XMBrknScrpt_02 9505 2.05 5.32 0.88 63 HTML_IMAGE_ONLY_12 9460 1.57 5.30 0.24 64 XM_H_Long_From01 9449 5.69 5.29 5.83 65 RCVD_IN_RP_RNBL 9321 1.48 5.22 0.14 66 BAYES_95 9033 3.17 5.06 2.49 67 RCVD_IN_MSPIKE_L3 9017 1.66 5.05 0.45 68 BODY_URI_ONLY 8951 1.38 5.01 0.09 69 SUBJ_ALL_CAPS 8883 2.69 4.97 1.88 70 HTML_SHORT_LINK_IMG_1 8831 1.35 4.95 0.06 71 MIME_HTML_MOSTLY 8797 3.15 4.93 2.51 72 HTML_IMAGE_RATIO_04 8694 5.38 4.87 5.56 73 TR_XM_SpammyWords3 8479 1.57 4.75 0.44 74 T_XMDrugObfuBody_08 8183 2.43 4.58 1.66 75 DKIM_INVALID 8149 3.89 4.56 3.65 76 XM_SendGrid 8116 6.10 4.54 6.66 77 XMBody_17 8022 1.74 4.49 0.76 78 XM_B_COVIDMETA 7879 2.47 4.41 1.77 79 T_FONT_INVIS_NAKED_TO 7866 2.62 4.40 1.98 80 XM_SPF_SoftFail 7638 2.31 4.28 1.60 81 RCVD_IN_MSPIKE_L5 7174 1.29 4.02 0.31 82 SpammyFromTLD_02 7134 1.30 3.99 0.34 83 XM_B_SpammyTLD 7055 2.41 3.95 1.86 84 XM_B_Phish66 6868 2.24 3.85 1.67 85 URIBL_SBL_A 6806 1.22 3.81 0.29 86 SpammyFromTLD_01 6708 1.67 3.76 0.93 87 XM_OfRef6 6680 1.89 3.74 1.23 88 LH_URI_DOM_IN_PATH 6661 2.84 3.73 2.52 89 RCVD_IN_RP_SAFE 6328 6.80 3.54 7.96 90 XM_UB99 6301 0.93 3.53 0.00 91 HTML_IMAGE_RATIO_08 6280 2.54 3.52 2.19 92 XMStrtUSub 6076 4.34 3.40 4.67 93 HTML_IMAGE_RATIO_06 5861 3.26 3.28 3.25 94 URI_HEX 5840 1.96 3.27 1.50 95 XM_UB60 5723 0.96 3.20 0.15 96 XM_DIRTYINTL 5601 1.34 3.14 0.70 97 XMDiploma_00 5598 2.30 3.13 2.00 98 RCVD_IN_RP_CERTIFIED 5415 6.28 3.03 7.44 99 TM2_M_URI_OPT_OUT 5312 2.62 2.97 2.50 100 T_TooManySym_01 5211 4.19 2.92 4.64 101 BOTNET_NORDNS 5143 0.77 2.88 0.02 102 TR_LOTS_OF_MONEY3 5038 1.15 2.82 0.56 103 MIME_QP_LONG_LINE 5016 4.95 2.81 5.71 104 TM2_M_VERY_LONG_WORD 5000 1.50 2.80 1.04 105 RELAYCOUNTRY_FR 4978 0.94 2.79 0.27 106 TR_Caps_n_Bayes_99 4972 0.85 2.78 0.16 107 TR_XM_MaxSPIKE 4937 0.74 2.76 0.02 108 RCVD_IN_PSBL 4937 0.74 2.76 0.02 109 FROM_EXCESS_BASE64 4907 2.82 2.75 2.84 110 URI_TRY_3LD 4840 1.57 2.71 1.16 111 XM_UB999 4804 0.71 2.69 0.00 112 TR_XM_DK_SendGrid 4480 3.60 2.51 3.99 113 TR_XM_SB_Phish 4415 2.58 2.47 2.62 114 T_XMDrugObfuBody_00 4375 1.14 2.45 0.67 115 XM_B_Unsub2 4277 3.27 2.40 3.59 116 XMSexyCombo_01 4272 1.14 2.39 0.69 117 TR_XM_COVIDMETA4 4272 0.90 2.39 0.37 118 MIME_HTML_ONLY_MULTI 4270 2.10 2.39 2.00 119 XM_CamelCaseFrm001 4250 1.88 2.38 1.69 120 BAYES_40 4187 4.17 2.34 4.83 121 XMSubPhish11 4184 2.52 2.34 2.58 122 TR_XM_MaxBayes 3869 0.58 2.17 0.02 123 XM_B_SpammyWords4 3711 1.09 2.08 0.73 124 TR_XM_UnparsRelay 3548 0.75 1.99 0.31 125 RELAYCOUNTRY_IN 3527 0.61 1.98 0.12 126 ANY_BOUNCE_MESSAGE 3449 3.12 1.93 3.55 127 BOUNCE_MESSAGE 3448 3.12 1.93 3.54 128 T_PDS_OTHER_BAD_TLD 3422 0.75 1.92 0.34 129 XM_URI_RBL 3342 0.65 1.87 0.21 130 SUBJ_BUY 3341 0.55 1.87 0.07 131 HTML_MIME_NO_HTML_TAG 3260 2.50 1.83 2.73 132 FROM_SUSPICIOUS_NTLD 3236 0.55 1.81 0.10 133 XM_UB80 3220 0.50 1.80 0.03 134 XMGenDplmaNmb 3207 1.19 1.80 0.97 135 BAYES_20 3185 2.94 1.78 3.35 136 TR_XM_COVIDMETA1 3180 0.64 1.78 0.24 137 RCVD_IN_IADB_LISTED 3089 4.37 1.73 5.31 138 T_XMDrugObfuBody_14 3047 1.45 1.71 1.36 139 XM_RXBody 3011 0.71 1.69 0.37 140 XMGppyBdWords 2987 0.70 1.67 0.35 141 XMStockSpam_06 2976 2.23 1.67 2.43 142 FROM_SUSPICIOUS_NTLD_FP 2929 0.49 1.64 0.08 143 URI_PHP_REDIR 2901 0.43 1.62 0.00 144 PDS_FROM_2_EMAILS 2787 0.45 1.56 0.05 145 FROM_2_EMAILS_SHORT 2740 0.41 1.53 0.00 146 RELAYCOUNTRY_GB 2686 1.23 1.50 1.13 147 T_FILL_THIS_FORM_SHORT 2677 1.18 1.50 1.07 148 RCVD_IN_IADB_SPF 2614 3.83 1.46 4.68 149 TR_Symld_Words 2601 1.90 1.46 2.06 150 PDS_TO_EQ_FROM_NAME 2591 0.38 1.45 0.00 151 MIME_CHARSET_FARAWAY 2569 0.48 1.44 0.14 152 TR_XM_PHPDW 2556 0.65 1.43 0.37 153 XMHTML_After_End 2556 0.98 1.43 0.82 154 XMSubMetaSxObfu_03 2555 0.63 1.43 0.35 155 TR_XM_PHPForged 2545 0.63 1.43 0.35 156 TR_XM_FormFill2 2511 0.63 1.41 0.35 157 XM_H_PHPOS 2506 0.62 1.40 0.34 158 XMSexyCombo_04 2486 0.45 1.39 0.12 159 XMBdyGiftCard01 2457 0.80 1.38 0.59 160 RCVD_IN_IADB_SENDERID 2437 3.46 1.36 4.20 161 TR_XM_INV_DKIM 2431 0.48 1.36 0.16 162 NO_FM_NAME_IP_HOSTN 2416 0.36 1.35 0.00 163 RCVD_IN_IADB_DK 2410 3.35 1.35 4.07 164 RELAYCOUNTRY_DE 2403 0.87 1.35 0.70 165 XMSubNoVowel 2401 0.55 1.34 0.27 166 XMSubMetaD_00 2391 0.41 1.34 0.07 167 MIMEOLE_DIRECT_TO_MX 2369 0.35 1.33 0.00 168 ALL_TRUSTED 2262 11.08 1.27 14.60 169 RDNS_DYNAMIC 2242 0.73 1.26 0.55 170 DATE_IN_PAST_03_06 2196 0.42 1.23 0.14 171 URI_NOVOWEL 2182 2.12 1.22 2.44 172 FROM_NAME_EQ_TO_G_DRIVE 2180 0.32 1.22 0.00 173 XM_PDF 2176 3.90 1.22 4.85 174 CHARSET_FARAWAY_HEADER 2162 0.37 1.21 0.07 175 T_XMHurry_00 2134 0.69 1.19 0.51 176 XMBody_78 2113 0.66 1.18 0.47 177 MAILING_LIST_MULTI 2112 2.30 1.18 2.70 178 XM_DK_Undo_01 2106 1.77 1.18 1.98 179 TR_XM_RelayPhish 2103 0.41 1.18 0.13 180 XMObfuSubjects 2092 0.32 1.17 0.02 181 TR_MetaPhish_Combo_01 2069 0.96 1.16 0.89 182 T_TooManySym_02 1989 2.00 1.11 2.32 183 REMOVE_BEFORE_LINK 1986 0.50 1.11 0.29 184 XM_SPF_Unknown 1953 0.80 1.09 0.70 185 BAYES_05 1950 1.78 1.09 2.02 186 LONG_JUNK_URI2 1926 0.32 1.08 0.05 187 HELO_NODOT 1912 1.55 1.07 1.72 188 NUMERIC_HTTP_ADDR 1901 0.66 1.06 0.51 189 HELO_NO_DOMAIN 1891 1.55 1.06 1.72 190 MISSING_HEADERS 1889 0.58 1.06 0.41 191 DOS_OE_TO_MX 1856 0.28 1.04 0.00 192 HK_RANDOM_REPLYTO 1844 0.46 1.03 0.26 193 XMSlimDrugH 1844 0.62 1.03 0.47 194 NO_DNS_FOR_FROM 1829 0.63 1.02 0.49 195 TR_XM_SpoofStaff 1824 0.32 1.02 0.08 196 TR_Mismatch_TLD_01 1815 0.49 1.02 0.31 197 XMSpoofStaff2 1791 0.32 1.00 0.07 198 XM_UB95 1787 0.27 1.00 0.01 199 BAYES_00 1770 10.11 0.99 13.38 200 RELAYCOUNTRY_NL 1755 0.45 0.98 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 449076 90.98 93.82 89.97 2 RELAYCOUNTRY_US 405456 79.20 73.53 81.23 3 DKIM_SIGNED 384883 77.75 79.56 77.11 4 XM_DK_Pass 378444 76.21 77.32 75.82 5 DKIM_VALID 366659 73.86 75.00 73.46 6 XM_B_Unicode 350290 72.13 77.60 70.18 7 DCC_CHECK_NEGATIVE 293587 49.29 22.67 58.82 8 BAYES_50 286028 51.76 36.27 57.30 9 DKIM_VALID_AU 276469 56.13 58.22 55.39 10 XM_B_SpammyWords 256901 55.54 66.93 51.47 11 XMListUnsubscribeExists 255715 55.47 67.30 51.23 12 XM_B_Unicode3 195732 39.59 40.65 39.21 13 DCC_CHECK 194574 48.63 75.62 38.98 14 T_TM2_M_HEADER_IN_MSG 153292 28.94 23.99 30.71 15 DKIM_VALID_EF 147844 28.78 26.43 29.62 16 RCVD_IN_MSPIKE_WL 144333 25.69 16.69 28.92 17 HTML_FONT_LOW_CONTRAST 136467 29.00 33.66 27.34 18 RCVD_IN_MSPIKE_H2 128951 26.56 28.59 25.83 19 XM_B_SpammyWords2 120460 28.46 40.55 24.13 20 LOC_TINY_FONT_1 113418 25.60 33.66 22.72 21 XMSubLong 112895 23.42 25.66 22.62 22 FVGT_m_MULTI_ODD 110380 23.47 27.26 22.11 23 MIME_HTML_ONLY 96652 22.15 29.95 19.36 24 T_KAM_HTML_FONT_INVALID 91271 20.52 26.77 18.28 25 RCVD_IN_MSPIKE_H3 79117 14.11 9.26 15.85 26 ALL_TRUSTED 72857 11.08 1.27 14.60 27 BAYES_00 66763 10.11 0.99 13.38 28 XM_Body_Dirty_Words 63062 14.19 18.55 12.63 29 XM_Multi_Part_URI 60665 14.26 20.13 12.15 30 XM_B_Unsub 56679 11.43 11.65 11.35 31 RCVD_IN_MSPIKE_H4 54603 9.85 6.81 10.94 32 TR_XM_DK_Bayes 51179 7.69 0.53 10.25 33 TR_XM_DK_Bayes1 49671 7.46 0.49 9.95 34 LotsOfNums_01 45847 9.91 11.92 9.18 35 TR_XM_DK_Bayes2 44411 6.67 0.43 8.90 36 TooManyTo_001 42896 7.93 6.07 8.59 37 XM_DK_Undo_02 42209 17.19 41.60 8.46 38 RCVD_IN_RP_SAFE 39729 6.80 3.54 7.96 39 XM_Evil_Numbers_Gen 39355 8.69 10.95 7.88 40 LOTS_OF_MONEY 37998 9.27 13.92 7.61 41 BAYES_60 37771 7.79 8.40 7.57 42 RCVD_IN_RP_CERTIFIED 37137 6.28 3.03 7.44 43 IN_ZIMBRA_NJ_WHITELIST 36910 5.47 0.08 7.39 44 UNPARSEABLE_RELAY 36776 7.00 5.97 7.37 45 XM_B_Phish_Phrases 35486 8.13 10.99 7.11 46 XM_DKIMWhitelistDomains 33366 4.93 0.01 6.68 47 XM_SendGrid 33252 6.10 4.54 6.66 48 HTML_IMAGE_RATIO_02 31579 6.28 6.14 6.33 49 XM_H_Long_From01 29091 5.69 5.29 5.83 50 MIME_QP_LONG_LINE 28509 4.95 2.81 5.71 51 HTML_IMAGE_RATIO_04 27749 5.38 4.87 5.56 52 RELAYCOUNTRY_META 27237 9.97 22.58 5.46 53 XM_B_SpammyWords3 27234 7.05 11.49 5.46 54 RCVD_IN_IADB_LISTED 26506 4.37 1.73 5.31 55 FSL_BULK_SIG 24625 7.27 13.81 4.93 56 BAYES_99 24230 12.80 34.99 4.85 57 XM_PDF 24229 3.90 1.22 4.85 58 BAYES_40 24086 4.17 2.34 4.83 59 RCVD_IN_IADB_SPF 23340 3.83 1.46 4.68 60 XMStrtUSub 23328 4.34 3.40 4.67 61 T_TooManySym_01 23172 4.19 2.92 4.64 62 BOTNET_IPINHOSTNAME 22896 6.97 13.63 4.59 63 BAYES_80 20998 5.48 9.05 4.21 64 RCVD_IN_IADB_SENDERID 20986 3.46 1.36 4.20 65 RCVD_IN_IADB_DK 20293 3.35 1.35 4.07 66 TR_XM_DK_SendGrid 19906 3.60 2.51 3.99 67 MPART_ALT_DIFF 19575 4.81 7.28 3.92 68 BAYES_999 19508 10.00 27.04 3.91 69 XMSubMetaSx_00 18958 4.54 6.60 3.80 70 XMSexyCombo_05 18694 5.38 9.96 3.75 71 DKIM_INVALID 18224 3.89 4.56 3.65 72 XM_B_Unsub2 17902 3.27 2.40 3.59 73 ANY_BOUNCE_MESSAGE 17697 3.12 1.93 3.55 74 BOUNCE_MESSAGE 17692 3.12 1.93 3.54 75 XMNumbers 17308 3.97 5.36 3.47 76 XM_UncommonTLD01 16789 5.36 10.95 3.36 77 BAYES_20 16722 2.94 1.78 3.35 78 T_REMOTE_IMAGE 16661 4.32 7.07 3.34 79 HTML_IMAGE_RATIO_06 16232 3.26 3.28 3.25 80 RCVD_IN_IADB_VOUCHED 15995 2.58 0.82 3.20 81 FROM_EXCESS_BASE64 14198 2.82 2.75 2.84 82 TR_XM_PhishingBody 13983 3.69 6.19 2.80 83 HTML_MIME_NO_HTML_TAG 13650 2.50 1.83 2.73 84 MAILING_LIST_MULTI 13462 2.30 1.18 2.70 85 TR_XM_SB_Phish 13057 2.58 2.47 2.62 86 XMSubPhish11 12870 2.52 2.34 2.58 87 LH_URI_DOM_IN_PATH 12574 2.84 3.73 2.52 88 MIME_HTML_MOSTLY 12534 3.15 4.93 2.51 89 TM2_M_URI_OPT_OUT 12477 2.62 2.97 2.50 90 BAYES_95 12449 3.17 5.06 2.49 91 URI_NOVOWEL 12169 2.12 1.22 2.44 92 XMStockSpam_06 12125 2.23 1.67 2.43 93 T_TooManySym_02 11563 2.00 1.11 2.32 94 UNTRUSTED_Relay 11158 6.53 18.54 2.24 95 TooManyTo_002 11013 1.81 0.70 2.21 96 TR_DCC_Bayes_99 11007 8.47 25.97 2.21 97 HTML_IMAGE_RATIO_08 10939 2.54 3.52 2.19 98 RCVD_IN_MSPIKE_H5 10613 1.73 0.61 2.13 99 RCVD_IN_IADB_OPTIN 10427 1.69 0.56 2.09 100 BOTNET 10372 5.78 16.14 2.08 101 TR_Symld_Words 10290 1.90 1.46 2.06 102 BAYES_05 10097 1.78 1.09 2.02 103 XMDiploma_00 9995 2.30 3.13 2.00 104 MIME_HTML_ONLY_MULTI 9975 2.10 2.39 2.00 105 T_FONT_INVIS_NAKED_TO 9882 2.62 4.40 1.98 106 XM_DK_Undo_01 9868 1.77 1.18 1.98 107 SUBJ_ALL_CAPS 9362 2.69 4.97 1.88 108 XM_B_SpammyTLD 9280 2.41 3.95 1.86 109 KHOP_HELO_FCRDNS 8863 2.98 6.34 1.78 110 XM_B_COVIDMETA 8828 2.47 4.41 1.77 111 HTML_FONT_FACE_BAD 8674 1.44 0.60 1.74 112 HELO_NODOT 8600 1.55 1.07 1.72 113 HELO_NO_DOMAIN 8599 1.55 1.06 1.72 114 XM_CamelCaseFrm001 8460 1.88 2.38 1.69 115 RCVD_IN_BL_SPAMCOP_NET 8451 3.11 7.08 1.69 116 XM_B_Phish66 8320 2.24 3.85 1.67 117 T_XMDrugObfuBody_08 8304 2.43 4.58 1.66 118 RELAYCOUNTRY_CA 8160 2.64 5.46 1.63 119 XM_SPF_SoftFail 7999 2.31 4.28 1.60 120 INVALID_MSGID 7512 1.22 0.42 1.50 121 IN_HORDE_ADDRESS_BOOK 7480 1.19 0.31 1.50 122 URI_HEX 7465 1.96 3.27 1.50 123 TooManyTo_003 7461 1.24 0.53 1.49 124 TVD_RCVD_IP 7289 1.21 0.50 1.46 125 XMGappySubj_01 6786 1.08 0.30 1.36 126 T_XMDrugObfuBody_14 6780 1.45 1.71 1.36 127 XMCapTrack 6486 1.08 0.46 1.30 128 TO_MALFORMED 6455 0.95 0.00 1.29 129 TR_XM_SpammyWords2 6319 4.98 15.36 1.27 130 XM_OfRef6 6115 1.89 3.74 1.23 131 XM_UB50 6080 3.02 8.06 1.22 132 DKIM_ADSP_CUSTOM_MED 5991 1.14 0.96 1.20 133 HELO_MISC_IP 5923 1.00 0.47 1.19 134 CK_HELO_DYNAMIC_SPLIT_IP 5919 1.09 0.82 1.19 135 URI_TRY_3LD 5808 1.57 2.71 1.16 136 RELAYCOUNTRY_GB 5622 1.23 1.50 1.13 137 TooManyTo_004 5505 0.93 0.46 1.10 138 XM_GoogleGroups 5433 0.91 0.42 1.09 139 T_FILL_THIS_FORM_SHORT 5338 1.18 1.50 1.07 140 TM2_M_VERY_LONG_WORD 5176 1.50 2.80 1.04 141 XMBSHREFv2 4890 0.82 0.37 0.98 142 TR_MSPIKEBAYES00 4865 0.73 0.03 0.97 143 XMGenDplmaNmb 4864 1.19 1.80 0.97 144 XM_H_Long_From02 4859 0.92 0.79 0.97 145 XM_ProductURIs 4808 0.92 0.79 0.96 146 T_TooManySym_03 4749 0.76 0.22 0.95 147 SpammyFromTLD_01 4631 1.67 3.76 0.93 148 USER_IN_DEF_DKIM_WL 4627 0.68 0.01 0.93 149 TR_MetaPhish_Combo_01 4455 0.96 1.16 0.89 150 XMBrknScrpt_02 4397 2.05 5.32 0.88 151 FROM_GOV_DKIM_AU 4394 0.75 0.40 0.88 152 TooManyTo_005 4243 0.73 0.38 0.85 153 HTTPS_HTTP_MISMATCH 4187 0.87 0.97 0.84 154 T_OBFU_PDF_ATTACH 4111 0.66 0.20 0.82 155 XMHTML_After_End 4111 0.98 1.43 0.82 156 RCVD_IN_MSPIKE_BL 4108 3.30 10.23 0.82 157 NML_ADSP_CUSTOM_MED 3936 0.80 0.84 0.79 158 XMBody_17 3775 1.74 4.49 0.76 159 XM_B_SpammyWords4 3646 1.09 2.08 0.73 160 XM_ShortIntro_01 3589 0.63 0.37 0.72 161 XM_DIRTYINTL 3478 1.34 3.14 0.70 162 XM_SPF_Unknown 3472 0.80 1.09 0.70 163 RELAYCOUNTRY_DE 3472 0.87 1.35 0.70 164 XMBody_95 3455 0.53 0.07 0.69 165 XMSexyCombo_01 3429 1.14 2.39 0.69 166 XMSubMetaSxObfu_02 3348 0.57 0.30 0.67 167 T_XMDrugObfuBody_00 3328 1.14 2.45 0.67 168 T_Symld_Words_02 3309 0.75 0.98 0.66 169 FORGED_GMAIL_RCVD 3165 0.65 0.69 0.63 170 TM2_M_A_HREF_HREF 3143 0.72 0.98 0.63 171 XMSolicitRefs_0 3078 0.56 0.42 0.62 172 XMMoneyMeta_00 2997 0.68 0.92 0.60 173 XMNoVowels 2996 0.60 0.58 0.60 174 XMBdyGiftCard01 2960 0.80 1.38 0.59 175 XM_B_COPY_HTML 2879 0.58 0.59 0.58 176 XM_H_PHPMailer 2797 0.55 0.50 0.56 177 MSGID_FROM_MTA_HEADER 2786 0.46 0.18 0.56 178 TR_LOTS_OF_MONEY3 2773 1.15 2.82 0.56 179 RDNS_DYNAMIC 2739 0.73 1.26 0.55 180 DKIM_ADSP_NXDOMAIN 2625 0.52 0.50 0.53 181 T_TooManySym_04 2561 0.40 0.08 0.51 182 T_XMHurry_00 2549 0.69 1.19 0.51 183 NUMERIC_HTTP_ADDR 2541 0.66 1.06 0.51 184 NO_DNS_FOR_FROM 2451 0.63 1.02 0.49 185 RCVD_IN_SORBS_DUL 2450 0.45 0.35 0.49 186 TM2_M_BODY_EMPTY 2438 0.38 0.09 0.49 187 XMHTMLBadTable_001 2401 0.60 0.94 0.48 188 XMSlimDrugH 2362 0.62 1.03 0.47 189 SENDGRID_REDIR 2352 0.54 0.72 0.47 190 XMBody_78 2338 0.66 1.18 0.47 191 HTML_TAG_BALANCE_BODY 2328 0.49 0.57 0.47 192 XMLngstWrd_00 2307 0.48 0.55 0.46 193 XM_S_SubURI 2299 0.35 0.02 0.46 194 XM_S_SpammyWords 2299 0.53 0.74 0.46 195 XM_B_REG_HTML 2298 0.42 0.30 0.46 196 TR_XM_Spammywords 2293 0.53 0.74 0.46 197 RCVD_IN_MSPIKE_L3 2254 1.66 5.05 0.45 198 SHORT_HELO_AND_INLINE_IMAGE 2248 0.35 0.07 0.45 199 TR_BOTNET_NEGATE 2203 0.53 0.78 0.44 200 DIET_1 2194 0.58 0.98 0.44 ----------------------------------------------------------------------