Email: 613823 Autolearn: 0 AvgScore: 2.79 AvgScanTime: 1.08 sec Spam: 124941 Autolearn: 0 AvgScore: 14.56 AvgScanTime: 1.42 sec Ham: 488882 Autolearn: 0 AvgScore: -0.21 AvgScanTime: 1.00 sec Time Spent Running SA: 184.69 hours Time Spent Processing Spam: 49.31 hours Time Spent Processing Ham: 135.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117922 73.51 94.38 68.18 2 DKIM_SIGNED 96592 66.10 77.31 63.23 3 DCC_CHECK 94818 37.51 75.89 27.70 4 RELAYCOUNTRY_US 93372 63.76 74.73 60.95 5 XM_DK_Pass 92801 63.14 74.28 60.30 6 XM_B_Unicode 89882 65.39 71.94 63.72 7 DKIM_VALID 89284 59.55 71.46 56.51 8 XM_B_SpammyWords 80840 40.84 64.70 34.74 9 XMListUnsubscribeExists 78470 39.81 62.81 33.93 10 DKIM_VALID_AU 64935 45.79 51.97 44.21 11 BAYES_50 55948 50.50 44.78 51.96 12 XM_B_Unicode3 50101 32.48 40.10 30.54 13 XM_DK_Undo_02 46383 11.35 37.12 4.77 14 XM_B_SpammyWords2 45625 19.31 36.52 14.92 15 MIME_HTML_ONLY 41774 20.18 33.43 16.79 16 LOC_TINY_FONT_1 40382 19.61 32.32 16.36 17 HTML_FONT_LOW_CONTRAST 39910 23.29 31.94 21.08 18 TR_XM_DKIM_Undo 37639 9.16 30.13 3.81 19 RCVD_IN_MSPIKE_H2 36044 20.94 28.85 18.91 20 T_KAM_HTML_FONT_INVALID 35920 17.36 28.75 14.45 21 DKIM_VALID_EF 35818 21.69 28.67 19.91 22 BAYES_99 35715 9.27 28.59 4.33 23 FVGT_m_MULTI_ODD 32392 18.44 25.93 16.53 24 XMSubLong 31319 17.82 25.07 15.96 25 T_TM2_M_HEADER_IN_MSG 30140 32.74 24.12 34.94 26 DCC_CHECK_NEGATIVE 30079 62.45 24.07 72.26 27 RELAYCOUNTRY_META 28013 16.23 22.42 14.65 28 TR_DCC_Bayes_99 27935 6.18 22.36 2.05 29 BAYES_999 27593 7.37 22.08 3.61 30 XM_Body_Dirty_Words 24614 20.43 19.70 20.62 31 FSL_BULK_SIG 23674 8.53 18.95 5.87 32 RCVD_IN_MSPIKE_WL 23074 20.19 18.47 20.63 33 UNTRUSTED_Relay 21275 13.61 17.03 12.74 34 XM_Multi_Part_URI 20742 10.78 16.60 9.29 35 BOTNET 20616 4.15 16.50 0.99 36 XM_UncommonTLD01 19078 5.15 15.27 2.57 37 BOTNET_IPINHOSTNAME 17128 5.19 13.71 3.02 38 LOTS_OF_MONEY 15166 6.15 12.14 4.61 39 XM_B_SpammyWords3 15067 5.37 12.06 3.66 40 XM_B_Unsub 14402 10.04 11.53 9.65 41 T_REMOTE_IMAGE 14064 4.49 11.26 2.76 42 TR_XM_SpammyRelay 13889 3.21 11.12 1.19 43 SpammyFromTLD_02 13670 2.35 10.94 0.16 44 UNPARSEABLE_RELAY 13546 6.60 10.84 5.52 45 TR_XM_UnparsRelay 13145 5.41 10.52 4.10 46 TR_XM_SpammyWords2 12648 2.74 10.12 0.85 47 XM_Evil_Numbers_Gen 12342 6.94 9.88 6.19 48 TR_XM_SpammyWords4 12312 4.31 9.85 2.89 49 RCVD_IN_MSPIKE_H3 11927 10.48 9.55 10.72 50 XMSexyCombo_05 11306 12.51 9.05 13.39 51 HTML_MIME_NO_HTML_TAG 11190 3.30 8.96 1.85 52 XM_UB50 10910 10.03 8.73 10.37 53 LotsOfNums_01 10406 6.96 8.33 6.61 54 XM_SendGrid 10250 5.53 8.20 4.84 55 HTML_IMAGE_RATIO_02 10206 5.26 8.17 4.52 56 MPART_ALT_DIFF 10065 5.99 8.06 5.46 57 RCVD_IN_MSPIKE_H4 9629 8.01 7.71 8.09 58 HTML_IMAGE_ONLY_08 9576 1.64 7.66 0.10 59 T_HTML_TAG_BALANCE_CENTER 9532 1.59 7.63 0.05 60 KHOP_HELO_FCRDNS 9496 2.78 7.60 1.55 61 BAYES_80 9260 4.00 7.41 3.12 62 XM_B_Phish_Phrases 9041 3.49 7.24 2.54 63 BAYES_60 8727 8.15 6.98 8.44 64 TR_XM_PhishingBody 8685 3.42 6.95 2.51 65 RCVD_IN_BL_SPAMCOP_NET 8589 1.74 6.87 0.43 66 TooManyTo_001 8420 6.78 6.74 6.79 67 BODY_URI_ONLY 8159 1.34 6.53 0.01 68 MIXED_FONT_CASE 7953 1.30 6.37 0.00 69 MIXED_HREF_CASE 7924 1.29 6.34 0.00 70 MIXED_CENTER_CASE 7675 1.25 6.14 0.00 71 XM_H_Long_From01 7665 4.30 6.13 3.83 72 MIXED_AREA_CASE 7659 1.25 6.13 0.00 73 MIXED_IMG_CASE 7659 1.25 6.13 0.00 74 DKIM_INVALID 7308 6.55 5.85 6.73 75 XMSubMetaSx_00 7214 2.99 5.77 2.27 76 RCVD_IN_MSPIKE_BL 7139 1.43 5.71 0.34 77 MIME_HTML_MOSTLY 7075 2.55 5.66 1.76 78 TR_XM_MSPIKECOMBO 6961 1.40 5.57 0.33 79 XMNumbers 6941 3.18 5.56 2.57 80 XM_B_SpammyTLD 6644 2.16 5.32 1.35 81 HTML_FONT_SIZE_LARGE 6642 1.16 5.32 0.10 82 XM_SPF_SoftFail 5639 2.28 4.51 1.71 83 GOOG_STO_IMG_HTML 5630 0.92 4.51 0.00 84 XMStrtUSub 5575 3.42 4.46 3.16 85 TM2_M_URI_OPT_OUT 5569 13.17 4.46 15.39 86 RELAYCOUNTRY_CA 5566 1.42 4.45 0.65 87 XM_B_Investor 5485 1.81 4.39 1.16 88 BAYES_95 5347 2.29 4.28 1.79 89 TR_XM_DK_SendGrid 5347 3.26 4.28 3.00 90 HTML_IMAGE_RATIO_04 5262 4.17 4.21 4.16 91 MIME_QP_LONG_LINE 5253 4.16 4.20 4.15 92 TR_XM_SpammyWords5 4982 1.76 3.99 1.19 93 TR_XM_SPAMCOP 4926 0.96 3.94 0.19 94 XM_B_Phish66 4863 1.91 3.89 1.40 95 URIBL_DBL_SPAM 4623 0.75 3.70 0.00 96 RCVD_IN_RP_SAFE 4583 5.14 3.67 5.51 97 MIXED_CTYPE_CASE 4340 0.71 3.47 0.00 98 BOTNET_NORDNS 4184 0.69 3.35 0.01 99 T_XMDrugObfuBody_08 4087 1.67 3.27 1.26 100 T_XMDrugObfuBody_14 4009 2.08 3.21 1.80 101 XM_OfRef6 3965 1.21 3.17 0.70 102 MIME_HTML_ONLY_MULTI 3912 3.98 3.13 4.20 103 HTML_IMAGE_RATIO_06 3881 2.87 3.11 2.81 104 URI_NOVOWEL 3798 2.25 3.04 2.05 105 RCVD_IN_PSBL 3793 0.69 3.04 0.10 106 RCVD_IN_RP_CERTIFIED 3754 4.65 3.00 5.07 107 TR_XM_SB_Phish 3606 2.58 2.89 2.50 108 RCVD_IN_MSPIKE_L5 3557 0.61 2.85 0.04 109 XMSubPhish11 3546 2.54 2.84 2.47 110 URI_GOOG_STO_SPAMMY 3546 0.58 2.84 0.00 111 XM_DIRTYINTL 3488 9.08 2.79 10.68 112 T_TooManySym_01 3441 4.12 2.75 4.47 113 XM_B_COVIDMETA 3432 1.01 2.75 0.56 114 PDS_OTHER_BAD_TLD 3422 0.72 2.74 0.21 115 XMNoVowels 3385 2.07 2.71 1.91 116 HTML_IMAGE_RATIO_08 3352 1.96 2.68 1.78 117 SpammyFromTLD_01 3314 0.96 2.65 0.53 118 BAYES_40 3314 4.30 2.65 4.72 119 XMDiploma_00 3297 1.43 2.64 1.13 120 XM_B_Unsub2 3200 1.62 2.56 1.38 121 XM_UB99 3134 0.51 2.51 0.00 122 RCVD_IN_IADB_LISTED 3078 3.50 2.46 3.77 123 ALL_TRUSTED 3044 20.77 2.44 25.45 124 T_XMDrugObfuBody_00 3001 1.80 2.40 1.65 125 XMBrknScrpt_02 2917 1.08 2.33 0.76 126 TR_XM_SpammyWords3 2762 0.65 2.21 0.25 127 BAYES_20 2741 10.10 2.19 12.12 128 RELAYCOUNTRY_FR 2736 9.94 2.19 11.92 129 RCVD_IN_IADB_SPF 2718 3.06 2.18 3.28 130 XM_DK_Undo_01 2715 1.51 2.17 1.34 131 T_FILL_THIS_FORM_SHORT 2692 1.03 2.15 0.75 132 TM2_M_VERY_LONG_WORD 2670 1.07 2.14 0.80 133 MAILING_LIST_MULTI 2601 2.47 2.08 2.56 134 RCVD_IN_IADB_DK 2584 2.68 2.07 2.84 135 FROM_EXCESS_BASE64 2583 1.94 2.07 1.90 136 BAYES_00 2555 9.18 2.04 11.00 137 RCVD_IN_IADB_SENDERID 2549 2.74 2.04 2.92 138 XMSexyCombo_01 2500 0.70 2.00 0.37 139 FROM_SUSPICIOUS_NTLD 2490 0.43 1.99 0.04 140 XM_URI_RBL 2484 0.47 1.99 0.08 141 SUBJ_ALL_CAPS 2477 1.39 1.98 1.24 142 RELAYCOUNTRY_NL 2476 0.48 1.98 0.10 143 ANY_BOUNCE_MESSAGE 2461 19.58 1.97 24.09 144 BOUNCE_MESSAGE 2459 19.58 1.97 24.08 145 TR_XM_PHPDW 2446 0.58 1.96 0.23 146 RCVD_IN_MSPIKE_L4 2425 0.51 1.94 0.15 147 XM_CamelCaseFrm001 2408 1.51 1.93 1.40 148 FROM_SUSPICIOUS_NTLD_FP 2406 0.42 1.93 0.03 149 HTML_IMAGE_ONLY_28 2398 0.66 1.92 0.33 150 TR_XM_PHPForged 2314 0.53 1.85 0.19 151 TR_XM_FormFill2 2267 0.51 1.81 0.18 152 XM_H_PHPOS 2249 0.50 1.80 0.17 153 TR_XM_COVIDMETA4 2226 0.56 1.78 0.25 154 XM_B_SpammyWords4 2221 0.68 1.78 0.40 155 URI_HEX 2165 1.19 1.73 1.06 156 XMBody_17 2163 0.53 1.73 0.22 157 TR_Symld_Words 2152 1.36 1.72 1.27 158 TR_XM_NoHeaderRelay 2094 0.47 1.68 0.16 159 HELO_NODOT 2066 1.40 1.65 1.34 160 HELO_NO_DOMAIN 2061 1.40 1.65 1.33 161 XM_UB999 2033 0.33 1.63 0.00 162 XM_UB60 2013 1.99 1.61 2.09 163 T_XMHurry_00 2012 1.96 1.61 2.04 164 XMGenDplmaNmb 1890 0.87 1.51 0.70 165 URI_TRY_3LD 1836 0.95 1.47 0.81 166 XMStockSpam_06 1832 0.97 1.47 0.85 167 RELAYCOUNTRY_GB 1823 0.83 1.46 0.66 168 URIBL_BLACK 1799 0.31 1.44 0.02 169 TR_XM_COVIDMETA1 1786 0.42 1.43 0.17 170 RELAYCOUNTRY_DE 1772 0.54 1.42 0.32 171 HOSTED_IMG_DIRECT_MX 1756 0.29 1.41 0.00 172 XM_PDF 1740 3.44 1.39 3.96 173 RELAYCOUNTRY_AZ 1720 0.28 1.38 0.00 174 XM_DrugUnitList 1712 0.28 1.37 0.00 175 ALIBABA_IMG_NOT_RCVD_ALI 1704 0.28 1.36 0.00 176 RELAYCOUNTRY_AU 1690 0.42 1.35 0.18 177 TR_XM_INV_DKIM 1672 0.30 1.34 0.04 178 DIET_1 1666 0.47 1.33 0.24 179 HTML_FONT_SIZE_HUGE 1652 0.31 1.32 0.06 180 XM_H_TOP 1624 0.27 1.30 0.00 181 JH_SPAMMY_HEADERS 1622 0.26 1.30 0.00 182 XMBounce_01 1610 9.61 1.29 11.74 183 USER_IN_DEF_DKIM_WL 1604 7.05 1.28 8.52 184 RDNS_DYNAMIC 1571 0.51 1.26 0.33 185 XMBdyGiftCard01 1567 0.67 1.25 0.52 186 XM_UB80 1543 0.26 1.23 0.01 187 XM_Body_Dirty_Words_01 1534 0.39 1.23 0.18 188 RCVD_IN_MSPIKE_H5 1518 1.70 1.21 1.83 189 TR_XM_BayesRelay 1514 0.25 1.21 0.00 190 XMPhish14 1510 0.48 1.21 0.30 191 TR_M_TOP_BAYES 1509 0.25 1.21 0.00 192 XMHTML_After_End 1486 0.75 1.19 0.64 193 HTML_FONT_FACE_BAD 1479 0.89 1.18 0.82 194 RELAYCOUNTRY_IN 1476 0.34 1.18 0.12 195 TR_LOTS_OF_MONEY3 1455 0.34 1.16 0.13 196 TR_MetaPhish_Combo_01 1442 0.63 1.15 0.49 197 DATE_IN_PAST_06_12 1413 0.66 1.13 0.54 198 XM_JunkDunk 1356 0.22 1.09 0.00 199 DKIM_ADSP_CUSTOM_MED 1342 0.88 1.07 0.82 200 T_Symld_Words_02 1335 0.53 1.07 0.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 353278 62.45 24.07 72.26 2 HTML_MESSAGE 333321 73.51 94.38 68.18 3 XM_B_Unicode 311501 65.39 71.94 63.72 4 DKIM_SIGNED 309144 66.10 77.31 63.23 5 RELAYCOUNTRY_US 297973 63.76 74.73 60.95 6 XM_DK_Pass 294773 63.14 74.28 60.30 7 DKIM_VALID 276261 59.55 71.46 56.51 8 BAYES_50 254039 50.50 44.78 51.96 9 DKIM_VALID_AU 216159 45.79 51.97 44.21 10 T_TM2_M_HEADER_IN_MSG 170803 32.74 24.12 34.94 11 XM_B_SpammyWords 169830 40.84 64.70 34.74 12 XMListUnsubscribeExists 165900 39.81 62.81 33.93 13 XM_B_Unicode3 149299 32.48 40.10 30.54 14 DCC_CHECK 135430 37.51 75.89 27.70 15 ALL_TRUSTED 124421 20.77 2.44 25.45 16 ANY_BOUNCE_MESSAGE 117750 19.58 1.97 24.09 17 BOUNCE_MESSAGE 117743 19.58 1.97 24.08 18 HTML_FONT_LOW_CONTRAST 103077 23.29 31.94 21.08 19 RCVD_IN_MSPIKE_WL 100865 20.19 18.47 20.63 20 XM_Body_Dirty_Words 100805 20.43 19.70 20.62 21 DKIM_VALID_EF 97337 21.69 28.67 19.91 22 RCVD_IN_MSPIKE_H2 92462 20.94 28.85 18.91 23 MIME_HTML_ONLY 82086 20.18 33.43 16.79 24 FVGT_m_MULTI_ODD 80809 18.44 25.93 16.53 25 LOC_TINY_FONT_1 79969 19.61 32.32 16.36 26 XMSubLong 78035 17.82 25.07 15.96 27 TM2_M_URI_OPT_OUT 75263 13.17 4.46 15.39 28 XM_B_SpammyWords2 72920 19.31 36.52 14.92 29 RELAYCOUNTRY_META 71626 16.23 22.42 14.65 30 T_KAM_HTML_FONT_INVALID 70666 17.36 28.75 14.45 31 XMSexyCombo_05 65462 12.51 9.05 13.39 32 UNTRUSTED_Relay 62283 13.61 17.03 12.74 33 BAYES_20 59271 10.10 2.19 12.12 34 RELAYCOUNTRY_FR 58273 9.94 2.19 11.92 35 XMBounce_01 57407 9.61 1.29 11.74 36 BAYES_00 53790 9.18 2.04 11.00 37 RCVD_IN_MSPIKE_H3 52399 10.48 9.55 10.72 38 XM_DIRTYINTL 52218 9.08 2.79 10.68 39 XM_UB50 50682 10.03 8.73 10.37 40 XM_B_Unsub 47196 10.04 11.53 9.65 41 XM_Multi_Part_URI 45434 10.78 16.60 9.29 42 USER_IN_DEF_DKIM_WL 41665 7.05 1.28 8.52 43 BAYES_60 41279 8.15 6.98 8.44 44 RCVD_IN_MSPIKE_H4 39533 8.01 7.71 8.09 45 TooManyTo_001 33184 6.78 6.74 6.79 46 DKIM_INVALID 32883 6.55 5.85 6.73 47 LotsOfNums_01 32339 6.96 8.33 6.61 48 XM_Evil_Numbers_Gen 30286 6.94 9.88 6.19 49 TR_XM_DK_Bayes 29311 4.93 0.74 6.00 50 FSL_BULK_SIG 28682 8.53 18.95 5.87 51 TR_XM_DK_Bayes1 28072 4.72 0.71 5.74 52 XM_DKIMWhitelistDomains 27312 4.47 0.08 5.59 53 UNPARSEABLE_RELAY 26972 6.60 10.84 5.52 54 RCVD_IN_RP_SAFE 26943 5.14 3.67 5.51 55 MPART_ALT_DIFF 26685 5.99 8.06 5.46 56 RCVD_IN_RP_CERTIFIED 24791 4.65 3.00 5.07 57 XM_H_Trusted_IP 24485 3.99 0.00 5.01 58 XM_SendGrid 23666 5.53 8.20 4.84 59 TR_XM_DK_Bayes2 23426 3.92 0.49 4.79 60 XM_DK_Undo_02 23310 11.35 37.12 4.77 61 BAYES_40 23098 4.30 2.65 4.72 62 LOTS_OF_MONEY 22555 6.15 12.14 4.61 63 HTML_IMAGE_RATIO_02 22111 5.26 8.17 4.52 64 T_TooManySym_01 21840 4.12 2.75 4.47 65 BAYES_99 21179 9.27 28.59 4.33 66 MIME_HTML_ONLY_MULTI 20523 3.98 3.13 4.20 67 HTML_IMAGE_RATIO_04 20317 4.17 4.21 4.16 68 MIME_QP_LONG_LINE 20296 4.16 4.20 4.15 69 TR_XM_UnparsRelay 20048 5.41 10.52 4.10 70 XM_PDF 19366 3.44 1.39 3.96 71 XM_H_Long_From01 18701 4.30 6.13 3.83 72 TR_XM_DKIM_Undo 18614 9.16 30.13 3.81 73 RCVD_IN_IADB_LISTED 18436 3.50 2.46 3.77 74 XM_B_SpammyWords3 17909 5.37 12.06 3.66 75 BAYES_999 17636 7.37 22.08 3.61 76 RCVD_IN_IADB_SPF 16042 3.06 2.18 3.28 77 XMStrtUSub 15431 3.42 4.46 3.16 78 BAYES_80 15266 4.00 7.41 3.12 79 BOTNET_IPINHOSTNAME 14748 5.19 13.71 3.02 80 TR_XM_DK_SendGrid 14670 3.26 4.28 3.00 81 RCVD_IN_IADB_SENDERID 14299 2.74 2.04 2.92 82 TR_XM_SpammyWords4 14114 4.31 9.85 2.89 83 RCVD_IN_IADB_DK 13860 2.68 2.07 2.84 84 HTML_IMAGE_RATIO_06 13747 2.87 3.11 2.81 85 T_REMOTE_IMAGE 13485 4.49 11.26 2.76 86 XM_UncommonTLD01 12563 5.15 15.27 2.57 87 XMNumbers 12557 3.18 5.56 2.57 88 MAILING_LIST_MULTI 12533 2.47 2.08 2.56 89 XM_B_Phish_Phrases 12399 3.49 7.24 2.54 90 TR_XM_PhishingBody 12278 3.42 6.95 2.51 91 TR_XM_SB_Phish 12224 2.58 2.89 2.50 92 BAYES_05 12215 2.21 1.07 2.50 93 XMSubPhish11 12060 2.54 2.84 2.47 94 RCVD_IN_IADB_VOUCHED 11579 2.09 1.00 2.37 95 T_TooManySym_02 11293 2.01 0.84 2.31 96 XMSubMetaSx_00 11113 2.99 5.77 2.27 97 XM_UB60 10223 1.99 1.61 2.09 98 TR_DCC_Bayes_99 10028 6.18 22.36 2.05 99 URI_NOVOWEL 10007 2.25 3.04 2.05 100 T_XMHurry_00 9992 1.96 1.61 2.04 101 TooManyTo_002 9423 1.75 1.04 1.93 102 XMNoVowels 9339 2.07 2.71 1.91 103 FROM_EXCESS_BASE64 9305 1.94 2.07 1.90 104 HTML_MIME_NO_HTML_TAG 9056 3.30 8.96 1.85 105 XMSubNoVowel 9012 1.63 0.81 1.84 106 RCVD_IN_MSPIKE_H5 8933 1.70 1.21 1.83 107 T_XMDrugObfuBody_14 8778 2.08 3.21 1.80 108 BAYES_95 8735 2.29 4.28 1.79 109 HTML_IMAGE_RATIO_08 8706 1.96 2.68 1.78 110 MIME_HTML_MOSTLY 8607 2.55 5.66 1.76 111 XM_SPF_SoftFail 8380 2.28 4.51 1.71 112 T_XMDrugObfuBody_00 8061 1.80 2.40 1.65 113 RCVD_IN_IADB_OPTIN 7627 1.38 0.65 1.56 114 KHOP_HELO_FCRDNS 7587 2.78 7.60 1.55 115 IN_HORDE_ADDRESS_BOOK 6869 1.14 0.10 1.41 116 XM_CamelCaseFrm001 6862 1.51 1.93 1.40 117 XM_B_Phish66 6846 1.91 3.89 1.40 118 INVALID_MSGID 6826 1.15 0.17 1.40 119 XM_B_Unsub2 6744 1.62 2.56 1.38 120 XM_B_SpammyTLD 6599 2.16 5.32 1.35 121 XM_DK_Undo_01 6544 1.51 2.17 1.34 122 HELO_NODOT 6527 1.40 1.65 1.34 123 HELO_NO_DOMAIN 6525 1.40 1.65 1.33 124 TooManyTo_003 6262 1.18 0.80 1.28 125 MSGID_NOFQDN1 6233 1.03 0.05 1.27 126 TR_Symld_Words 6226 1.36 1.72 1.27 127 T_XMDrugObfuBody_08 6179 1.67 3.27 1.26 128 TO_MALFORMED 6167 1.01 0.02 1.26 129 DATE_IN_PAST_12_24 6164 1.11 0.54 1.26 130 MY_SERVERS_FOUND 6139 1.18 0.91 1.26 131 SUBJ_ALL_CAPS 6070 1.39 1.98 1.24 132 TVD_RCVD_IP 6041 1.08 0.45 1.24 133 TO_NO_BRKTS_HTML_IMG 5913 1.01 0.24 1.21 134 TR_XM_SpammyWords5 5816 1.76 3.99 1.19 135 TR_XM_SpammyRelay 5804 3.21 11.12 1.19 136 XM_B_Investor 5654 1.81 4.39 1.16 137 XMDiploma_00 5511 1.43 2.64 1.13 138 URI_HEX 5160 1.19 1.73 1.06 139 XMCapTrack 5095 0.93 0.49 1.04 140 XM_GoogleGroups 5094 0.98 0.74 1.04 141 BOTNET 4849 4.15 16.50 0.99 142 TooManyTo_004 4571 0.87 0.62 0.93 143 XM_E_Blogspot 4520 0.76 0.14 0.92 144 XMGappySubj_01 4388 0.74 0.13 0.90 145 TR_XM_SpammyWords2 4154 2.74 10.12 0.85 146 XMStockSpam_06 4136 0.97 1.47 0.85 147 DKIM_ADSP_CUSTOM_MED 4029 0.88 1.07 0.82 148 HTML_FONT_FACE_BAD 4006 0.89 1.18 0.82 149 URI_TRY_3LD 3984 0.95 1.47 0.81 150 TM2_M_VERY_LONG_WORD 3908 1.07 2.14 0.80 151 HTML_IMAGE_ONLY_20 3773 0.67 0.25 0.77 152 XMBrknScrpt_02 3696 1.08 2.33 0.76 153 T_FILL_THIS_FORM_SHORT 3650 1.03 2.15 0.75 154 TooManyTo_005 3626 0.70 0.51 0.74 155 T_TooManySym_03 3530 0.64 0.32 0.72 156 XM_H_Long_From02 3460 0.73 0.83 0.71 157 HELO_MISC_IP 3447 0.58 0.10 0.71 158 XM_OfRef6 3439 1.21 3.17 0.70 159 XMGenDplmaNmb 3432 0.87 1.51 0.70 160 XMBSHREFv2 3318 0.61 0.33 0.68 161 RELAYCOUNTRY_GB 3251 0.83 1.46 0.66 162 IN_ZIMBRA_NJ_WHITELIST 3230 0.53 0.01 0.66 163 RELAYCOUNTRY_CA 3180 1.42 4.45 0.65 164 XMHTML_After_End 3137 0.75 1.19 0.64 165 XMPhish30 3066 0.71 1.06 0.63 166 XMBody_95 2839 0.51 0.21 0.58 167 HTTPS_HTTP_MISMATCH 2764 0.65 0.97 0.57 168 XM_B_COVIDMETA 2739 1.01 2.75 0.56 169 NML_ADSP_CUSTOM_MED 2692 0.61 0.85 0.55 170 PLING_QUERY 2674 0.55 0.58 0.55 171 DATE_IN_PAST_06_12 2624 0.66 1.13 0.54 172 SpammyFromTLD_01 2583 0.96 2.65 0.53 173 MISSING_HEADERS 2574 0.54 0.59 0.53 174 TVD_SPACE_RATIO_MINFP 2544 0.53 0.56 0.52 175 XMBdyGiftCard01 2531 0.67 1.25 0.52 176 XM_ShortIntro_01 2457 0.53 0.65 0.50 177 TR_MetaPhish_Combo_01 2412 0.63 1.15 0.49 178 XM_ProductURIs 2384 0.60 1.03 0.49 179 XMSubMetaI_00 2325 0.57 0.93 0.48 180 T_OBFU_PDF_ATTACH 2311 0.40 0.14 0.47 181 RCVD_IN_SORBS_DUL 2149 0.46 0.56 0.44 182 FORGED_GMAIL_RCVD 2137 0.54 0.92 0.44 183 RCVD_IN_BL_SPAMCOP_NET 2122 1.74 6.87 0.43 184 XM_H_PHPMailer 2097 0.54 0.98 0.43 185 XM_RXBody 2045 0.45 0.60 0.42 186 XMHTMLBadTable_001 1983 0.46 0.67 0.41 187 XM_B_COPY_HTML 1967 0.43 0.56 0.40 188 XM_B_SpammyWords4 1963 0.68 1.78 0.40 189 FROM_GOV_SPOOF 1941 0.33 0.09 0.40 190 TM2_M_BODY_EMPTY 1934 0.34 0.12 0.40 191 T_Symld_Words_02 1906 0.53 1.07 0.39 192 TVD_SPACE_RATIO 1891 0.41 0.48 0.39 193 TR_MSPIKEBAYES00 1862 0.31 0.03 0.38 194 SHORT_HELO_AND_INLINE_IMAGE 1839 0.38 0.37 0.38 195 XMSexyCombo_01 1808 0.70 2.00 0.37 196 T_MANY_PILL_PRICE 1769 0.29 0.01 0.36 197 HTML_IMAGE_ONLY_32 1705 0.33 0.25 0.35 198 XM_B_REG_HTML 1700 0.37 0.47 0.35 199 MPART_ALT_DIFF_COUNT 1694 0.42 0.73 0.35 200 XMMoneyMeta_00 1683 0.46 0.91 0.34 ----------------------------------------------------------------------