Email: 615959 Autolearn: 0 AvgScore: 0.75 AvgScanTime: 1.19 sec Spam: 133947 Autolearn: 0 AvgScore: 14.78 AvgScanTime: 1.52 sec Ham: 482012 Autolearn: 0 AvgScore: -3.15 AvgScanTime: 1.10 sec Time Spent Running SA: 203.56 hours Time Spent Processing Spam: 56.47 hours Time Spent Processing Ham: 147.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128980 86.11 96.29 83.28 2 DKIM_SIGNED 106453 62.78 79.47 58.15 3 DCC_CHECK 105667 41.12 78.89 30.63 4 XM_DK_Pass 102324 59.88 76.39 55.29 5 RELAYCOUNTRY_US 100716 75.83 75.19 76.00 6 DKIM_VALID 99680 57.75 74.42 53.12 7 XM_B_Unicode 96878 72.96 72.33 73.14 8 XM_B_SpammyWords 88641 45.88 66.18 40.24 9 XMListUnsubscribeExists 88479 41.45 66.06 34.62 10 DKIM_VALID_AU 74497 43.83 55.62 40.55 11 BAYES_50 62594 49.78 46.73 50.63 12 XM_B_Unicode3 54453 41.98 40.65 42.35 13 XM_DK_Undo_02 51304 12.45 38.30 5.27 14 XM_B_SpammyWords2 48943 19.71 36.54 15.03 15 LOC_TINY_FONT_1 46414 20.65 34.65 16.76 16 MIME_HTML_ONLY 46318 25.20 34.58 22.60 17 HTML_FONT_LOW_CONTRAST 42487 22.25 31.72 19.62 18 TR_XM_DKIM_Undo 40927 9.63 30.55 3.81 19 T_KAM_HTML_FONT_INVALID 39430 16.56 29.44 12.98 20 RCVD_IN_MSPIKE_H2 39373 21.06 29.39 18.74 21 DKIM_VALID_EF 38719 21.95 28.91 20.02 22 XMSubLong 37014 20.40 27.63 18.39 23 BAYES_99 35175 8.95 26.26 4.14 24 FVGT_m_MULTI_ODD 33119 19.29 24.73 17.78 25 T_TM2_M_HEADER_IN_MSG 32908 27.78 24.57 28.67 26 RELAYCOUNTRY_META 31331 10.53 23.39 6.96 27 DCC_CHECK_NEGATIVE 28216 58.83 21.07 69.33 28 XM_Body_Dirty_Words 27962 13.83 20.88 11.87 29 TR_DCC_Bayes_99 27273 5.68 20.36 1.60 30 BAYES_999 27044 7.11 20.19 3.47 31 RCVD_IN_MSPIKE_WL 25323 20.87 18.91 21.42 32 FSL_BULK_SIG 24960 9.64 18.63 7.15 33 UNTRUSTED_Relay 23371 7.51 17.45 4.75 34 XM_UncommonTLD01 20972 5.47 15.66 2.63 35 BOTNET 20614 4.40 15.39 1.34 36 XM_Multi_Part_URI 20075 9.97 14.99 8.58 37 BOTNET_IPINHOSTNAME 18904 5.71 14.11 3.37 38 LOTS_OF_MONEY 17673 7.76 13.19 6.25 39 XM_B_SpammyWords3 16754 5.00 12.51 2.92 40 TR_XM_SpammyRelay 16715 3.83 12.48 1.43 41 XMSexyCombo_05 14770 7.16 11.03 6.08 42 SpammyFromTLD_02 14608 2.59 10.91 0.28 43 XM_B_Unsub 14579 8.13 10.88 7.36 44 UNPARSEABLE_RELAY 14332 6.66 10.70 5.53 45 T_REMOTE_IMAGE 14080 4.58 10.51 2.93 46 TR_XM_SpammyWords4 13935 5.43 10.40 4.04 47 RCVD_IN_MSPIKE_H3 13892 11.05 10.37 11.24 48 TR_XM_UnparsRelay 13848 5.48 10.34 4.13 49 XM_Evil_Numbers_Gen 13215 8.15 9.87 7.68 50 MPART_ALT_DIFF 12961 10.88 9.68 11.21 51 XM_UB50 12811 4.97 9.56 3.69 52 HTML_IMAGE_RATIO_02 12740 5.22 9.51 4.03 53 RCVD_IN_BL_SPAMCOP_NET 12482 2.69 9.32 0.85 54 TR_XM_SpammyWords2 11274 2.31 8.42 0.62 55 XM_SendGrid 10590 5.54 7.91 4.89 56 LotsOfNums_01 10479 7.15 7.82 6.96 57 TR_XM_PhishingBody 10478 3.64 7.82 2.47 58 BAYES_60 10411 6.21 7.77 5.78 59 RCVD_IN_MSPIKE_H4 10233 8.09 7.64 8.22 60 HTML_MIME_NO_HTML_TAG 10001 3.13 7.47 1.92 61 XM_B_Phish_Phrases 9971 4.22 7.44 3.32 62 BAYES_80 9685 3.87 7.23 2.93 63 KHOP_HELO_FCRDNS 9407 2.53 7.02 1.28 64 XMSubMetaSx_00 9259 3.56 6.91 2.62 65 MIME_HTML_MOSTLY 9190 3.12 6.86 2.08 66 TooManyTo_001 9168 7.04 6.84 7.10 67 HTML_IMAGE_ONLY_08 8006 1.36 5.98 0.07 68 RCVD_IN_MSPIKE_BL 7953 1.54 5.94 0.32 69 XM_H_Long_From01 7910 4.22 5.91 3.75 70 T_HTML_TAG_BALANCE_CENTER 7800 1.33 5.82 0.08 71 TR_XM_MSPIKECOMBO 7459 1.46 5.57 0.31 72 URI_NOVOWEL 7086 2.86 5.29 2.18 73 BODY_URI_ONLY 6814 1.11 5.09 0.01 74 XM_B_SpammyTLD 6802 2.22 5.08 1.42 75 DKIM_INVALID 6773 5.03 5.06 5.03 76 XM_B_Phish66 6691 2.24 5.00 1.48 77 XMNumbers 6470 2.95 4.83 2.43 78 TR_XM_SPAMCOP 6427 1.20 4.80 0.20 79 MIXED_CENTER_CASE 6416 1.04 4.79 0.00 80 MIXED_HREF_CASE 6409 1.04 4.78 0.00 81 MIXED_IMG_CASE 6404 1.04 4.78 0.00 82 MIXED_AREA_CASE 6403 1.04 4.78 0.00 83 URIBL_DBL_SPAM 6338 1.03 4.73 0.01 84 MIXED_FONT_CASE 6236 1.01 4.66 0.00 85 HTML_FONT_SIZE_LARGE 6100 1.04 4.55 0.07 86 HTML_IMAGE_RATIO_04 6044 15.89 4.51 19.05 87 RELAYCOUNTRY_CA 5982 1.57 4.47 0.77 88 RCVD_IN_PSBL 5739 1.00 4.28 0.08 89 URI_GOOG_STO_SPAMMY 5674 0.92 4.24 0.00 90 XM_SPF_SoftFail 5653 2.00 4.22 1.38 91 HTML_IMAGE_RATIO_06 5643 5.03 4.21 5.26 92 TR_XM_DK_SendGrid 5597 3.27 4.18 3.02 93 TR_XM_SpammyWords5 5513 1.82 4.12 1.18 94 XMStrtUSub 5409 10.91 4.04 12.81 95 MIME_QP_LONG_LINE 5343 4.11 3.99 4.14 96 BAYES_95 5145 2.20 3.84 1.75 97 SpammyFromTLD_01 5096 1.29 3.80 0.59 98 TM2_M_URI_OPT_OUT 5086 5.42 3.80 5.87 99 XM_B_Investor 5016 1.64 3.74 1.06 100 RCVD_IN_RP_RNBL 4865 0.83 3.63 0.05 101 MIXED_CTYPE_CASE 4815 0.78 3.59 0.00 102 JH_SPAMMY_HEADERS 4681 0.76 3.49 0.00 103 RCVD_IN_RP_SAFE 4636 5.01 3.46 5.44 104 XM_B_COVIDMETA 4571 1.43 3.41 0.87 105 MIME_HTML_ONLY_MULTI 4416 8.28 3.30 9.67 106 T_XMDrugObfuBody_08 4349 1.63 3.25 1.19 107 XM_OfRef6 4298 1.38 3.21 0.87 108 XM_DIRTYINTL 4271 3.66 3.19 3.79 109 XMNoVowels 4227 1.97 3.16 1.64 110 RCVD_IN_IADB_LISTED 3917 3.70 2.92 3.91 111 BAYES_40 3664 4.65 2.74 5.18 112 TR_XM_SB_Phish 3639 1.82 2.72 1.57 113 T_TooManySym_01 3545 4.07 2.65 4.47 114 RELAYCOUNTRY_IN 3536 0.67 2.64 0.12 115 XMSubPhish11 3532 1.78 2.64 1.55 116 T_XMDrugObfuBody_14 3531 1.93 2.64 1.73 117 RCVD_IN_IADB_SPF 3491 3.25 2.61 3.42 118 PDS_OTHER_BAD_TLD 3476 0.65 2.60 0.11 119 RCVD_IN_RP_CERTIFIED 3377 4.35 2.52 4.86 120 RCVD_IN_IADB_DK 3321 2.85 2.48 2.95 121 RCVD_IN_IADB_SENDERID 3299 2.93 2.46 3.06 122 XMDiploma_00 3246 1.39 2.42 1.11 123 URI_HEX 3189 1.53 2.38 1.30 124 HTML_IMAGE_ONLY_24 3165 0.73 2.36 0.28 125 XM_B_Unsub2 3114 1.36 2.32 1.10 126 HTML_IMAGE_RATIO_08 3039 1.81 2.27 1.68 127 XM_B_SpammyWords4 3017 0.72 2.25 0.29 128 TR_Symld_Words 3017 1.42 2.25 1.19 129 BAYES_20 3011 6.79 2.25 8.05 130 RCVD_IN_MSPIKE_L5 2996 0.54 2.24 0.06 131 XM_CamelCaseFrm001 2989 1.61 2.23 1.43 132 TR_XM_SpammyWords3 2986 0.68 2.23 0.25 133 XM_UB60 2943 1.07 2.20 0.76 134 XM_DrugUnitList 2888 0.47 2.16 0.00 135 EBAY_IMG_NOT_RCVD_EBAY 2872 0.47 2.14 0.00 136 HOSTED_IMG_DIRECT_MX 2857 0.46 2.13 0.00 137 BAYES_00 2846 14.60 2.12 18.07 138 RELAYCOUNTRY_AZ 2840 0.46 2.12 0.00 139 XMSlimDrugH 2817 0.61 2.10 0.20 140 XM_DK_Undo_01 2815 1.52 2.10 1.36 141 MAILING_LIST_MULTI 2777 2.41 2.07 2.50 142 RCVD_IN_MSPIKE_L4 2774 0.53 2.07 0.10 143 TM2_M_VERY_LONG_WORD 2766 1.16 2.06 0.91 144 FROM_EXCESS_BASE64 2766 2.26 2.06 2.31 145 TR_XM_NoHeaderRelay 2739 0.57 2.04 0.16 146 XM_URI_RBL 2659 0.50 1.99 0.09 147 HTML_FONT_SIZE_HUGE 2551 0.44 1.90 0.04 148 USER_IN_DEF_DKIM_WL 2483 7.40 1.85 8.95 149 TR_Mismatch_TLD_02 2477 0.45 1.85 0.06 150 FROM_SUSPICIOUS_NTLD 2468 0.43 1.84 0.04 151 XMSexyCombo_01 2390 0.61 1.78 0.28 152 FROM_SUSPICIOUS_NTLD_FP 2389 0.41 1.78 0.03 153 HELO_NODOT 2367 1.38 1.77 1.27 154 HELO_NO_DOMAIN 2365 1.38 1.77 1.27 155 GOOG_STO_IMG_HTML 2364 0.38 1.76 0.00 156 XM_UB99 2360 0.38 1.76 0.00 157 TR_XM_COVIDMETA1 2349 0.52 1.75 0.18 158 XMBrknScrpt_02 2345 0.93 1.75 0.70 159 BOTNET_NORDNS 2338 0.40 1.75 0.02 160 SUBJ_ALL_CAPS 2303 1.36 1.72 1.26 161 TR_XM_COVIDMETA4 2293 0.56 1.71 0.25 162 TR_XM_PHPDW 2234 0.52 1.67 0.20 163 ALL_TRUSTED 2214 14.66 1.65 18.28 164 T_FILL_THIS_FORM_SHORT 2207 0.84 1.65 0.62 165 TR_XM_PHPForged 2180 0.49 1.63 0.17 166 T_XMHurry_00 2169 1.51 1.62 1.48 167 T_XMDrugObfuBody_00 2166 0.73 1.62 0.49 168 XM_UB80 2117 0.35 1.58 0.01 169 TR_XM_FormFill2 2117 0.48 1.58 0.17 170 URIBL_BLACK 2108 0.35 1.57 0.02 171 XM_H_PHPOS 2105 0.47 1.57 0.17 172 DIET_1 2074 0.58 1.55 0.31 173 XMGenDplmaNmb 1951 0.75 1.46 0.55 174 XM_PDF 1868 3.25 1.39 3.77 175 XMStockSpam_06 1867 1.06 1.39 0.96 176 TR_LOTS_OF_MONEY3 1832 0.49 1.37 0.25 177 XM_UB999 1828 0.30 1.36 0.00 178 RELAYCOUNTRY_GB 1820 0.94 1.36 0.82 179 DATE_IN_PAST_12_24 1818 0.31 1.36 0.01 180 XMHTML_After_End 1781 0.80 1.33 0.66 181 TR_XM_INV_DKIM 1751 0.37 1.31 0.11 182 NO_DNS_FOR_FROM 1743 0.42 1.30 0.17 183 RELAYCOUNTRY_AU 1724 0.45 1.29 0.22 184 XMBody_17 1723 0.50 1.29 0.28 185 RELAYCOUNTRY_DE 1711 0.83 1.28 0.71 186 XMPhish30 1697 0.66 1.27 0.49 187 URI_TRY_3LD 1695 0.87 1.27 0.76 188 RCVD_IN_MSPIKE_L3 1689 0.39 1.26 0.15 189 DATE_IN_PAST_06_12 1646 0.29 1.23 0.03 190 TR_BOTNET_NEGATE 1594 0.46 1.19 0.26 191 RELAYCOUNTRY_NL 1575 0.37 1.18 0.14 192 RELAYCOUNTRY_FR 1568 3.12 1.17 3.66 193 RDNS_DYNAMIC 1567 0.51 1.17 0.32 194 RCVD_IN_IADB_VOUCHED 1564 2.16 1.17 2.43 195 TooManyTo_002 1527 1.79 1.14 1.97 196 XMMoneyMeta_00 1512 0.59 1.13 0.44 197 XM_H_Long_From02 1502 0.81 1.12 0.72 198 XM_Body_Dirty_Words_01 1502 0.37 1.12 0.16 199 URIBL_SBL_A 1497 0.34 1.12 0.12 200 XMSubNoVowel 1437 4.27 1.07 5.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 401428 86.11 96.29 83.28 2 RELAYCOUNTRY_US 366346 75.83 75.19 76.00 3 XM_B_Unicode 352556 72.96 72.33 73.14 4 DCC_CHECK_NEGATIVE 334174 58.83 21.07 69.33 5 DKIM_SIGNED 280275 62.78 79.47 58.15 6 XM_DK_Pass 266500 59.88 76.39 55.29 7 DKIM_VALID 256037 57.75 74.42 53.12 8 BAYES_50 244052 49.78 46.73 50.63 9 XM_B_Unicode3 204144 41.98 40.65 42.35 10 DKIM_VALID_AU 195456 43.83 55.62 40.55 11 XM_B_SpammyWords 193949 45.88 66.18 40.24 12 XMListUnsubscribeExists 166866 41.45 66.06 34.62 13 DCC_CHECK 147620 41.12 78.89 30.63 14 T_TM2_M_HEADER_IN_MSG 138211 27.78 24.57 28.67 15 MIME_HTML_ONLY 108929 25.20 34.58 22.60 16 RCVD_IN_MSPIKE_WL 103250 20.87 18.91 21.42 17 DKIM_VALID_EF 96483 21.95 28.91 20.02 18 HTML_FONT_LOW_CONTRAST 94593 22.25 31.72 19.62 19 HTML_IMAGE_RATIO_04 91824 15.89 4.51 19.05 20 XM_H_Trusted_IP 91103 14.79 0.00 18.90 21 RCVD_IN_MSPIKE_H2 90343 21.06 29.39 18.74 22 XMSubLong 88625 20.40 27.63 18.39 23 ALL_TRUSTED 88093 14.66 1.65 18.28 24 BAYES_00 87101 14.60 2.12 18.07 25 FVGT_m_MULTI_ODD 85688 19.29 24.73 17.78 26 HTML_FONT_FACE_BAD 85628 14.10 0.92 17.76 27 LOC_TINY_FONT_1 80778 20.65 34.65 16.76 28 XM_B_SpammyWords2 72463 19.71 36.54 15.03 29 T_KAM_HTML_FONT_INVALID 62544 16.56 29.44 12.98 30 XMStrtUSub 61769 10.91 4.04 12.81 31 XM_Body_Dirty_Words 57225 13.83 20.88 11.87 32 RCVD_IN_MSPIKE_H3 54195 11.05 10.37 11.24 33 MPART_ALT_DIFF 54035 10.88 9.68 11.21 34 ANY_BOUNCE_MESSAGE 50052 8.28 0.71 10.38 35 BOUNCE_MESSAGE 50046 8.28 0.71 10.38 36 MIME_HTML_ONLY_MULTI 46603 8.28 3.30 9.67 37 USER_IN_DEF_DKIM_WL 43119 7.40 1.85 8.95 38 XM_Multi_Part_URI 41333 9.97 14.99 8.58 39 RCVD_IN_MSPIKE_H4 39603 8.09 7.64 8.22 40 BAYES_20 38798 6.79 2.25 8.05 41 XM_Evil_Numbers_Gen 37011 8.15 9.87 7.68 42 XM_B_Unsub 35497 8.13 10.88 7.36 43 FSL_BULK_SIG 34448 9.64 18.63 7.15 44 TooManyTo_001 34219 7.04 6.84 7.10 45 LotsOfNums_01 33562 7.15 7.82 6.96 46 RELAYCOUNTRY_META 33554 10.53 23.39 6.96 47 TR_XM_DK_Bayes 30828 5.16 0.73 6.40 48 LOTS_OF_MONEY 30143 7.76 13.19 6.25 49 TR_XM_DK_Bayes1 29860 5.00 0.71 6.19 50 XMSexyCombo_05 29327 7.16 11.03 6.08 51 TM2_M_URI_OPT_OUT 28308 5.42 3.80 5.87 52 BAYES_60 27858 6.21 7.77 5.78 53 UNPARSEABLE_RELAY 26661 6.66 10.70 5.53 54 RCVD_IN_RP_SAFE 26242 5.01 3.46 5.44 55 TR_XM_DK_Bayes2 25787 4.31 0.55 5.35 56 XM_DK_Undo_02 25387 12.45 38.30 5.27 57 HTML_IMAGE_RATIO_06 25330 5.03 4.21 5.26 58 BAYES_40 24952 4.65 2.74 5.18 59 XM_DKIMWhitelistDomains 24909 4.05 0.01 5.17 60 XMSubNoVowel 24870 4.27 1.07 5.16 61 DKIM_INVALID 24238 5.03 5.06 5.03 62 XM_SendGrid 23558 5.54 7.91 4.89 63 RCVD_IN_RP_CERTIFIED 23424 4.35 2.52 4.86 64 UNTRUSTED_Relay 22892 7.51 17.45 4.75 65 T_TooManySym_01 21522 4.07 2.65 4.47 66 BAYES_99 19965 8.95 26.26 4.14 67 MIME_QP_LONG_LINE 19961 4.11 3.99 4.14 68 TR_XM_UnparsRelay 19929 5.48 10.34 4.13 69 TR_XM_SpammyWords4 19485 5.43 10.40 4.04 70 HTML_IMAGE_RATIO_02 19426 5.22 9.51 4.03 71 RCVD_IN_IADB_LISTED 18853 3.70 2.92 3.91 72 TR_XM_DKIM_Undo 18368 9.63 30.55 3.81 73 XM_DIRTYINTL 18279 3.66 3.19 3.79 74 XM_PDF 18175 3.25 1.39 3.77 75 XM_H_Long_From01 18095 4.22 5.91 3.75 76 XM_UB50 17804 4.97 9.56 3.69 77 RELAYCOUNTRY_FR 17657 3.12 1.17 3.66 78 XMBounce_01 17117 2.81 0.15 3.55 79 BAYES_999 16733 7.11 20.19 3.47 80 BAYES_05 16726 2.94 1.04 3.47 81 RCVD_IN_IADB_SPF 16508 3.25 2.61 3.42 82 BOTNET_IPINHOSTNAME 16267 5.71 14.11 3.37 83 XM_B_Phish_Phrases 16016 4.22 7.44 3.32 84 RCVD_IN_IADB_SENDERID 14749 2.93 2.46 3.06 85 TR_XM_DK_SendGrid 14558 3.27 4.18 3.02 86 RCVD_IN_IADB_DK 14213 2.85 2.48 2.95 87 T_REMOTE_IMAGE 14143 4.58 10.51 2.93 88 BAYES_80 14134 3.87 7.23 2.93 89 XM_B_SpammyWords3 14052 5.00 12.51 2.92 90 XM_UncommonTLD01 12691 5.47 15.66 2.63 91 XMSubMetaSx_00 12651 3.56 6.91 2.62 92 MAILING_LIST_MULTI 12050 2.41 2.07 2.50 93 TR_XM_PhishingBody 11913 3.64 7.82 2.47 94 RCVD_IN_IADB_VOUCHED 11718 2.16 1.17 2.43 95 XMNumbers 11692 2.95 4.83 2.43 96 FROM_EXCESS_BASE64 11124 2.26 2.06 2.31 97 URI_NOVOWEL 10526 2.86 5.29 2.18 98 MIME_HTML_MOSTLY 10036 3.12 6.86 2.08 99 T_TooManySym_02 10031 1.80 0.80 2.08 100 TooManyTo_002 9509 1.79 1.14 1.97 101 RCVD_IN_MSPIKE_H5 9452 1.73 0.89 1.96 102 HTML_MIME_NO_HTML_TAG 9263 3.13 7.47 1.92 103 BAYES_95 8416 2.20 3.84 1.75 104 T_XMDrugObfuBody_14 8339 1.93 2.64 1.73 105 HTML_IMAGE_RATIO_08 8081 1.81 2.27 1.68 106 XMSubGarbage 7940 1.36 0.32 1.65 107 XMNoVowels 7918 1.97 3.16 1.64 108 XMSubLongNoVowel 7837 1.37 0.46 1.63 109 TR_DCC_Bayes_99 7730 5.68 20.36 1.60 110 TR_XM_SB_Phish 7551 1.82 2.72 1.57 111 XMSubPhish11 7459 1.78 2.64 1.55 112 RCVD_IN_IADB_OPTIN 7388 1.36 0.73 1.53 113 IN_HORDE_ADDRESS_BOOK 7206 1.19 0.10 1.49 114 T_XMHurry_00 7151 1.51 1.62 1.48 115 XM_B_Phish66 7112 2.24 5.00 1.48 116 INVALID_MSGID 7084 1.20 0.22 1.47 117 XM_CamelCaseFrm001 6905 1.61 2.23 1.43 118 TR_XM_SpammyRelay 6877 3.83 12.48 1.43 119 XM_B_SpammyTLD 6849 2.22 5.08 1.42 120 XM_SPF_SoftFail 6637 2.00 4.22 1.38 121 MSGID_NOFQDN1 6561 1.09 0.10 1.36 122 XM_DK_Undo_01 6534 1.52 2.10 1.36 123 BOTNET 6479 4.40 15.39 1.34 124 TO_MALFORMED 6377 1.04 0.04 1.32 125 TooManyTo_003 6329 1.23 0.93 1.31 126 URI_HEX 6243 1.53 2.38 1.30 127 KHOP_HELO_FCRDNS 6170 2.53 7.02 1.28 128 HELO_NODOT 6141 1.38 1.77 1.27 129 HELO_NO_DOMAIN 6140 1.38 1.77 1.27 130 SUBJ_ALL_CAPS 6079 1.36 1.72 1.26 131 XM_E_Blogspot 5880 0.97 0.09 1.22 132 TR_Symld_Words 5754 1.42 2.25 1.19 133 T_XMDrugObfuBody_08 5716 1.63 3.25 1.19 134 TR_XM_SpammyWords5 5668 1.82 4.12 1.18 135 XMDiploma_00 5337 1.39 2.42 1.11 136 XM_GoogleGroups 5336 1.05 0.83 1.11 137 XM_B_Unsub2 5289 1.36 2.32 1.10 138 XMCapTrack 5234 1.06 0.96 1.09 139 TVD_RCVD_IP 5173 0.99 0.68 1.07 140 XMGappySubj_01 5130 0.87 0.16 1.06 141 XM_B_Investor 5104 1.64 3.74 1.06 142 XMStockSpam_06 4640 1.06 1.39 0.96 143 TooManyTo_004 4454 0.89 0.76 0.92 144 TM2_M_VERY_LONG_WORD 4374 1.16 2.06 0.91 145 XM_B_COVIDMETA 4217 1.43 3.41 0.87 146 XM_OfRef6 4204 1.38 3.21 0.87 147 RCVD_IN_BL_SPAMCOP_NET 4103 2.69 9.32 0.85 148 HTML_IMAGE_ONLY_20 3971 0.76 0.53 0.82 149 RELAYCOUNTRY_GB 3971 0.94 1.36 0.82 150 RELAYCOUNTRY_CA 3695 1.57 4.47 0.77 151 URI_TRY_3LD 3660 0.87 1.27 0.76 152 XM_UB60 3651 1.07 2.20 0.76 153 TooManyTo_005 3559 0.72 0.67 0.74 154 DKIM_ADSP_CUSTOM_MED 3531 0.78 0.94 0.73 155 XM_H_Long_From02 3462 0.81 1.12 0.72 156 RELAYCOUNTRY_DE 3406 0.83 1.28 0.71 157 XMBrknScrpt_02 3395 0.93 1.75 0.70 158 HELO_MISC_IP 3310 0.63 0.43 0.69 159 XMBSHREFv2 3283 0.60 0.30 0.68 160 IN_ZIMBRA_NJ_WHITELIST 3192 0.52 0.01 0.66 161 XMHTML_After_End 3166 0.80 1.33 0.66 162 T_TooManySym_03 3150 0.55 0.19 0.65 163 FROM_GOV_DKIM_AU 3081 0.60 0.46 0.64 164 TR_XM_SpammyWords2 2971 2.31 8.42 0.62 165 T_FILL_THIS_FORM_SHORT 2967 0.84 1.65 0.62 166 SpammyFromTLD_01 2826 1.29 3.80 0.59 167 XM_RXBody 2808 0.55 0.45 0.58 168 TR_MSPIKEBAYES00 2711 0.45 0.03 0.56 169 XMBdyGiftCard01 2697 0.60 0.75 0.56 170 XMGenDplmaNmb 2655 0.75 1.46 0.55 171 TR_MetaPhish_Combo_01 2634 0.64 0.99 0.55 172 HTTPS_HTTP_MISMATCH 2595 0.65 1.04 0.54 173 XMBody_95 2585 0.46 0.19 0.54 174 XM_ProductURIs 2541 0.59 0.80 0.53 175 TVD_SPACE_RATIO_MINFP 2499 0.52 0.53 0.52 176 T_OBFU_PDF_ATTACH 2425 0.43 0.18 0.50 177 XMPhish30 2373 0.66 1.27 0.49 178 T_XMDrugObfuBody_00 2352 0.73 1.62 0.49 179 NML_ADSP_CUSTOM_MED 2351 0.54 0.74 0.49 180 MSGID_FROM_MTA_HEADER 2350 0.46 0.34 0.49 181 XM_B_COPY_HTML 2302 0.51 0.64 0.48 182 XM_ShortIntro_01 2226 0.50 0.62 0.46 183 XMMoneyMeta_00 2131 0.59 1.13 0.44 184 XMHTMLBadTable_001 2118 0.47 0.57 0.44 185 XMLngstWrd_00 2096 0.50 0.75 0.43 186 RCVD_IN_SORBS_DUL 2075 0.52 0.85 0.43 187 T_Symld_Words_02 2046 0.53 0.90 0.42 188 MY_SERVERS_FOUND 1948 0.35 0.14 0.40 189 XMLngstWrd_01 1903 0.46 0.71 0.39 190 TVD_SPACE_RATIO 1885 0.42 0.51 0.39 191 FROM_GOV_SPOOF 1829 0.32 0.09 0.38 192 XM_H_PHPMailer 1814 0.49 0.92 0.38 193 TM2_M_BODY_EMPTY 1804 0.31 0.09 0.37 194 XM_B_REG_HTML 1787 0.41 0.56 0.37 195 XMDateMe_00 1765 0.44 0.70 0.37 196 XM_USANA_RCVD 1739 0.28 0.00 0.36 197 SHORT_HELO_AND_INLINE_IMAGE 1737 0.37 0.39 0.36 198 FORGED_GMAIL_RCVD 1729 0.44 0.75 0.36 199 PLING_QUERY 1668 0.45 0.84 0.35 200 HTML_IMAGE_ONLY_32 1629 0.32 0.25 0.34 ----------------------------------------------------------------------