Email: 467864 Autolearn: 0 AvgScore: 2.67 AvgScanTime: 1.18 sec Spam: 128940 Autolearn: 0 AvgScore: 14.28 AvgScanTime: 1.30 sec Ham: 338924 Autolearn: 0 AvgScore: -1.75 AvgScanTime: 1.13 sec Time Spent Running SA: 153.28 hours Time Spent Processing Spam: 46.54 hours Time Spent Processing Ham: 106.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 120499 88.37 93.45 86.43 2 DKIM_SIGNED 107932 73.64 83.71 69.80 3 XM_DK_Pass 104815 71.90 81.29 68.32 4 DKIM_VALID 104141 71.04 80.77 67.34 5 RELAYCOUNTRY_US 102246 79.12 79.30 79.05 6 XM_B_Unicode 101448 69.54 78.68 66.07 7 DCC_CHECK 92901 41.74 72.05 30.21 8 XM_B_SpammyWords 83563 49.53 64.81 43.72 9 XMListUnsubscribeExists 82427 49.31 63.93 43.76 10 DKIM_VALID_AU 78294 54.16 60.72 51.67 11 XM_DK_Undo_02 56659 16.80 43.94 6.48 12 XM_B_Unicode3 55081 39.67 42.72 38.50 13 BAYES_50 47746 49.59 37.03 54.38 14 BAYES_99 47402 13.93 36.76 5.25 15 XM_B_SpammyWords2 45934 23.98 35.62 19.55 16 LOC_TINY_FONT_1 43452 24.18 33.70 20.56 17 TR_XM_DKIM_Undo 42832 12.53 33.22 4.66 18 MIME_HTML_ONLY 42252 23.51 32.77 19.98 19 DKIM_VALID_EF 40404 28.87 31.34 27.93 20 HTML_FONT_LOW_CONTRAST 39583 27.51 30.70 26.30 21 FVGT_m_MULTI_ODD 39458 25.00 30.60 22.87 22 BAYES_999 36998 11.02 28.69 4.30 23 DCC_CHECK_NEGATIVE 36000 58.23 27.92 69.76 24 RCVD_IN_MSPIKE_H2 35766 23.05 27.74 21.26 25 T_KAM_HTML_FONT_INVALID 34964 20.11 27.12 17.45 26 TR_DCC_Bayes_99 33653 8.37 26.10 1.63 27 T_TM2_M_HEADER_IN_MSG 32805 30.48 25.44 32.40 28 XMSubLong 30343 22.22 23.53 21.72 29 RELAYCOUNTRY_META 29537 8.84 22.91 3.49 30 XM_Body_Dirty_Words 26767 14.06 20.76 11.52 31 RCVD_IN_MSPIKE_WL 26325 25.33 20.42 27.20 32 FSL_BULK_SIG 20900 6.80 16.21 3.21 33 LOTS_OF_MONEY 20370 10.01 15.80 7.80 34 XM_Multi_Part_URI 20205 12.35 15.67 11.08 35 XM_B_Unsub 17867 12.56 13.86 12.07 36 RCVD_IN_MSPIKE_H3 17746 14.96 13.76 15.41 37 UNPARSEABLE_RELAY 17270 9.22 13.39 7.63 38 TR_XM_UnparsRelay 16949 7.78 13.14 5.75 39 BOTNET_IPINHOSTNAME 16272 6.59 12.62 4.29 40 UNTRUSTED_Relay 16063 4.27 12.46 1.16 41 BOTNET 16001 4.43 12.41 1.40 42 TR_XM_SpammyWords4 15982 6.87 12.39 4.76 43 TR_XM_SpammyWords2 15416 3.93 11.96 0.88 44 TR_XM_SpammyRelay 15215 4.28 11.80 1.42 45 XM_B_SpammyWords3 14557 6.06 11.29 4.08 46 RCVD_IN_BL_SPAMCOP_NET 12770 3.14 9.90 0.57 47 XMSexyCombo_05 12574 5.31 9.75 3.62 48 XM_Evil_Numbers_Gen 12178 8.30 9.44 7.87 49 XM_UncommonTLD01 11778 5.07 9.13 3.52 50 BAYES_80 11301 5.73 8.76 4.57 51 XM_SendGrid 11060 6.75 8.58 6.05 52 BAYES_60 9467 8.70 7.34 9.22 53 HTML_IMAGE_RATIO_02 8790 6.25 6.82 6.04 54 XMSubMetaSx_00 8784 4.69 6.81 3.89 55 LotsOfNums_01 8774 8.06 6.80 8.54 56 XM_H_Long_From01 8727 5.41 6.77 4.89 57 TooManyTo_001 8559 10.33 6.64 11.73 58 MPART_ALT_DIFF 8526 5.81 6.61 5.51 59 RCVD_IN_MSPIKE_H4 8141 9.12 6.31 10.18 60 TR_XM_MaxUnsub 7693 2.23 5.97 0.80 61 T_REMOTE_IMAGE 7690 4.23 5.96 3.57 62 RCVD_IN_MSPIKE_BL 7591 2.56 5.89 1.30 63 HTML_IMAGE_RATIO_04 7408 5.30 5.75 5.13 64 TR_XM_MSPIKECOMBO 7402 2.51 5.74 1.28 65 RELAYCOUNTRY_CA 7255 2.15 5.63 0.83 66 XM_B_Phish_Phrases 7224 3.82 5.60 3.15 67 TR_XM_PhishingBody 7093 3.96 5.50 3.37 68 TR_XM_DK_SendGrid 7025 4.24 5.45 3.78 69 BAYES_95 6922 3.37 5.37 2.61 70 HTML_MIME_NO_HTML_TAG 6702 3.17 5.20 2.40 71 TR_XM_SPAMCOP 6528 1.50 5.06 0.15 72 XM_SPF_SoftFail 6398 3.17 4.96 2.49 73 KHOP_HELO_FCRDNS 6247 2.68 4.84 1.85 74 TM2_M_VERY_LONG_WORD 6158 2.41 4.78 1.51 75 XM_B_SpammyTLD 6092 2.72 4.72 1.96 76 XM_UB50 6069 1.85 4.71 0.76 77 MIME_HTML_ONLY_MULTI 5634 4.14 4.37 4.06 78 XMNumbers 5560 3.82 4.31 3.63 79 TR_XM_SpammyWords5 5372 2.30 4.17 1.58 80 RCVD_IN_VALIDITY_SAFE 5097 4.55 3.95 4.78 81 XM_B_Investor 5059 2.14 3.92 1.46 82 RCVD_IN_PSBL 5038 1.09 3.91 0.01 83 MIME_QP_LONG_LINE 4977 6.79 3.86 7.90 84 T_XMDrugObfuBody_08 4882 2.15 3.79 1.52 85 T_XMDrugObfuBody_14 4757 2.39 3.69 1.89 86 RCVD_IN_VALIDITY_RPBL 4533 0.98 3.52 0.01 87 XM_OfRef6 4440 1.80 3.44 1.17 88 TM2_M_URI_OPT_OUT 4420 4.78 3.43 5.30 89 XMStrtUSub 4217 4.20 3.27 4.55 90 HTML_IMAGE_RATIO_06 4211 3.67 3.27 3.83 91 RCVD_IN_VALIDITY_CERTIFIED 4158 3.95 3.22 4.22 92 SpammyFromTLD_02 4154 1.08 3.22 0.26 93 MAILING_LIST_MULTI 4025 3.03 3.12 2.99 94 RCVD_IN_MSPIKE_L5 3988 0.98 3.09 0.18 95 XM_DIRTYINTL 3935 1.07 3.05 0.32 96 XM_GoogleGroups 3924 1.94 3.04 1.52 97 DKIM_INVALID 3791 2.59 2.94 2.46 98 SpammyFromTLD_01 3752 1.30 2.91 0.68 99 RCVD_IN_IADB_LISTED 3728 4.57 2.89 5.22 100 XM_DK_Undo_01 3594 1.96 2.79 1.65 101 XM_UB99 3560 0.76 2.76 0.01 102 XM_H_Undi_Recip 3550 0.91 2.75 0.21 103 PDS_OTHER_BAD_TLD 3529 0.88 2.74 0.17 104 T_FILL_THIS_FORM_SHORT 3447 1.33 2.67 0.82 105 HTML_IMAGE_ONLY_08 3346 0.82 2.60 0.14 106 XM_B_Phish66 3337 2.23 2.59 2.10 107 TR_XM_NoHeaderRelay 3300 0.84 2.56 0.18 108 BOTNET_NORDNS 3249 0.71 2.52 0.02 109 MIME_HTML_MOSTLY 3208 2.12 2.49 1.98 110 URI_NOVOWEL 3197 2.69 2.48 2.77 111 TR_XM_MSPIKECOMBO2 3136 0.82 2.43 0.20 112 BODY_URI_ONLY 3132 0.68 2.43 0.01 113 XMBody_17 3129 1.01 2.43 0.48 114 TR_XM_SpammyWords3 3118 1.12 2.42 0.63 115 XM_B_Unsub2 3096 1.60 2.40 1.30 116 RCVD_IN_IADB_SPF 3064 3.98 2.38 4.60 117 TR_Mismatch_TLD_02 3048 0.72 2.36 0.09 118 T_TooManySym_01 3020 5.08 2.34 6.12 119 SUBJ_ALL_CAPS 2928 1.97 2.27 1.86 120 HTML_IMAGE_RATIO_08 2870 2.00 2.23 1.92 121 URI_HEX 2861 1.52 2.22 1.25 122 XM_UB999 2858 0.61 2.22 0.00 123 USER_IN_DEF_DKIM_WL 2850 8.67 2.21 11.13 124 RCVD_IN_IADB_DK 2847 3.48 2.21 3.97 125 TR_XM_SB_Phish 2846 2.06 2.21 2.01 126 XMSexyCombo_01 2809 1.30 2.18 0.97 127 XMSubPhish11 2766 2.03 2.15 1.98 128 RCVD_IN_IADB_SENDERID 2762 3.59 2.14 4.14 129 ALL_TRUSTED 2697 14.17 2.09 18.76 130 XMLngstWrd_00 2674 1.22 2.07 0.90 131 XM_CamelCaseFrm001 2667 1.68 2.07 1.54 132 XMDiploma_00 2641 1.52 2.05 1.32 133 XM_B_COVIDMETA 2636 1.21 2.04 0.89 134 GOOG_STO_IMG_HTML 2636 0.57 2.04 0.01 135 T_XMDrugObfuBody_00 2634 0.97 2.04 0.56 136 T_XMHurry_00 2622 0.99 2.03 0.59 137 XMLngstWrd_01 2615 1.17 2.03 0.84 138 TR_LOTS_OF_MONEY3 2579 0.83 2.00 0.38 139 MPART_ALT_DIFF_COUNT 2577 0.98 2.00 0.59 140 XMLngstWrd_02 2556 1.08 1.98 0.73 141 XM_B_SpammyWords4 2538 0.77 1.97 0.31 142 HTML_TAG_BALANCE_CENTER 2525 0.59 1.96 0.07 143 HTML_FONT_SIZE_LARGE 2501 0.62 1.94 0.12 144 MIXED_CENTER_CASE 2497 0.54 1.94 0.00 145 TM2_M_A_HREF_HREF 2487 0.83 1.93 0.41 146 RCVD_IN_MSPIKE_L3 2468 0.92 1.91 0.54 147 MIXED_HREF_CASE 2449 0.53 1.90 0.00 148 MIXED_IMG_CASE 2439 0.52 1.89 0.00 149 MIXED_AREA_CASE 2436 0.52 1.89 0.00 150 XMLngstWrd_03 2433 0.97 1.89 0.63 151 MIXED_FONT_CASE 2433 0.52 1.89 0.00 152 XMStockSpam_06 2390 1.35 1.85 1.16 153 RCVD_IN_IADB_VOUCHED 2381 2.93 1.85 3.34 154 BAYES_40 2363 4.35 1.83 5.31 155 XMLngstWrd_04 2282 0.87 1.77 0.52 156 XM_UB60 2262 0.53 1.75 0.06 157 TR_XM_PHPDW 2154 0.85 1.67 0.53 158 XMBrknScrpt_02 2142 1.06 1.66 0.83 159 RELAYCOUNTRY_RU 2138 0.48 1.66 0.03 160 TR_XM_PHPForged 2105 0.79 1.63 0.46 161 MONEY_NOHTML 2089 0.49 1.62 0.07 162 FROM_SUSPICIOUS_NTLD 2078 0.48 1.61 0.05 163 RELAYCOUNTRY_GB 2067 1.03 1.60 0.81 164 TR_XM_FormFill2 2057 0.78 1.60 0.47 165 XM_UB80 2048 0.45 1.59 0.02 166 URIBL_DBL_SPAM 2043 0.44 1.58 0.01 167 HTML_TITLE_SUBJ_DIFF 2041 0.65 1.58 0.30 168 RELAYCOUNTRY_FR 2041 0.58 1.58 0.20 169 XM_H_PHPOS 2038 0.77 1.58 0.46 170 XM_H_Long_From02 2029 1.16 1.57 1.01 171 FROM_SUSPICIOUS_NTLD_FP 2009 0.47 1.56 0.05 172 XM_URI_RBL 1991 0.50 1.54 0.11 173 FROM_EXCESS_BASE64 1941 2.11 1.51 2.34 174 T_Symld_Words_02 1916 0.80 1.49 0.54 175 UPPERCASE_75_100 1907 0.58 1.48 0.24 176 XMSubNoVowel 1902 1.34 1.48 1.29 177 HTTPS_HTTP_MISMATCH 1879 0.94 1.46 0.74 178 TR_XM_Undi_Recip5 1876 0.41 1.45 0.01 179 TR_XM_BayesRelay 1875 0.40 1.45 0.00 180 TR_XM_Undi_Recip6 1864 0.40 1.45 0.00 181 BAYES_20 1817 3.46 1.41 4.25 182 TR_XM_FormFill 1815 0.40 1.41 0.01 183 RELAYCOUNTRY_DE 1805 0.56 1.40 0.24 184 TR_Sbj_FN_Bdy 1805 0.51 1.40 0.18 185 XMCapTrack 1766 1.32 1.37 1.30 186 TR_BOTNET_NEGATE 1763 0.60 1.37 0.31 187 URI_TRY_3LD 1760 0.87 1.36 0.68 188 URIBL_BLACK 1753 0.41 1.36 0.05 189 RELAYCOUNTRY_AU 1738 0.56 1.35 0.26 190 XM_B_SEO 1738 0.48 1.35 0.15 191 TooManyTo_002 1734 2.18 1.34 2.50 192 XMPhish30 1683 0.81 1.31 0.62 193 TR_XM_Undi_RecipCombo2 1660 0.36 1.29 0.00 194 RELAYCOUNTRY_CN 1647 0.41 1.28 0.08 195 XM_PDF 1620 4.16 1.26 5.26 196 UNDISC_MONEY 1615 0.35 1.25 0.01 197 TR_Symld_Words 1599 1.61 1.24 1.75 198 DIET_1 1567 0.56 1.22 0.31 199 XMHTML_After_End 1566 0.91 1.21 0.80 200 XMGenDplmaNmb 1544 0.89 1.20 0.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 292942 88.37 93.45 86.43 2 RELAYCOUNTRY_US 267919 79.12 79.30 79.05 3 DKIM_SIGNED 236583 73.64 83.71 69.80 4 DCC_CHECK_NEGATIVE 236428 58.23 27.92 69.76 5 XM_DK_Pass 231567 71.90 81.29 68.32 6 DKIM_VALID 228248 71.04 80.77 67.34 7 XM_B_Unicode 223918 69.54 78.68 66.07 8 BAYES_50 184290 49.59 37.03 54.38 9 DKIM_VALID_AU 175116 54.16 60.72 51.67 10 XMListUnsubscribeExists 148299 49.31 63.93 43.76 11 XM_B_SpammyWords 148161 49.53 64.81 43.72 12 XM_B_Unicode3 130498 39.67 42.72 38.50 13 T_TM2_M_HEADER_IN_MSG 109796 30.48 25.44 32.40 14 DCC_CHECK 102377 41.74 72.05 30.21 15 DKIM_VALID_EF 94667 28.87 31.34 27.93 16 RCVD_IN_MSPIKE_WL 92196 25.33 20.42 27.20 17 HTML_FONT_LOW_CONTRAST 89126 27.51 30.70 26.30 18 FVGT_m_MULTI_ODD 77528 25.00 30.60 22.87 19 XMSubLong 73617 22.22 23.53 21.72 20 RCVD_IN_MSPIKE_H2 72062 23.05 27.74 21.26 21 LOC_TINY_FONT_1 69675 24.18 33.70 20.56 22 MIME_HTML_ONLY 67721 23.51 32.77 19.98 23 XM_B_SpammyWords2 66266 23.98 35.62 19.55 24 ALL_TRUSTED 63587 14.17 2.09 18.76 25 T_KAM_HTML_FONT_INVALID 59135 20.11 27.12 17.45 26 RCVD_IN_MSPIKE_H3 52227 14.96 13.76 15.41 27 XM_B_Unsub 40896 12.56 13.86 12.07 28 BAYES_00 40465 8.88 0.84 11.94 29 TooManyTo_001 39771 10.33 6.64 11.73 30 XM_Body_Dirty_Words 39029 14.06 20.76 11.52 31 USER_IN_DEF_DKIM_WL 37720 8.67 2.21 11.13 32 XM_Multi_Part_URI 37554 12.35 15.67 11.08 33 RCVD_IN_MSPIKE_H4 34506 9.12 6.31 10.18 34 BAYES_60 31242 8.70 7.34 9.22 35 LotsOfNums_01 28949 8.06 6.80 8.54 36 MIME_QP_LONG_LINE 26777 6.79 3.86 7.90 37 XM_Evil_Numbers_Gen 26657 8.30 9.44 7.87 38 LOTS_OF_MONEY 26443 10.01 15.80 7.80 39 UNPARSEABLE_RELAY 25863 9.22 13.39 7.63 40 XM_DKIMWhitelistDomains 25542 5.47 0.05 7.54 41 IN_ZIMBRA_NJ_WHITELIST 24087 5.19 0.16 7.11 42 XM_DK_Undo_02 21948 16.80 43.94 6.48 43 T_TooManySym_01 20755 5.08 2.34 6.12 44 TR_XM_DK_Bayes 20548 4.54 0.54 6.06 45 XM_SendGrid 20499 6.75 8.58 6.05 46 HTML_IMAGE_RATIO_02 20472 6.25 6.82 6.04 47 TR_XM_DK_Bayes1 20075 4.44 0.54 5.92 48 TR_XM_UnparsRelay 19474 7.78 13.14 5.75 49 MPART_ALT_DIFF 18671 5.81 6.61 5.51 50 BAYES_40 18000 4.35 1.83 5.31 51 TM2_M_URI_OPT_OUT 17965 4.78 3.43 5.30 52 XM_PDF 17835 4.16 1.26 5.26 53 BAYES_99 17778 13.93 36.76 5.25 54 RCVD_IN_IADB_LISTED 17675 4.57 2.89 5.22 55 HTML_IMAGE_RATIO_04 17399 5.30 5.75 5.13 56 TR_XM_DK_Bayes2 17222 3.79 0.40 5.08 57 XM_H_Long_From01 16581 5.41 6.77 4.89 58 RCVD_IN_VALIDITY_SAFE 16206 4.55 3.95 4.78 59 TR_XM_SpammyWords4 16138 6.87 12.39 4.76 60 TR_XM_DKIM_Undo 15805 12.53 33.22 4.66 61 RCVD_IN_IADB_SPF 15578 3.98 2.38 4.60 62 BAYES_80 15498 5.73 8.76 4.57 63 XMStrtUSub 15428 4.20 3.27 4.55 64 XM_H_Trusted_IP 14848 3.17 0.00 4.38 65 BAYES_999 14579 11.02 28.69 4.30 66 BOTNET_IPINHOSTNAME 14552 6.59 12.62 4.29 67 BAYES_20 14393 3.46 1.41 4.25 68 RCVD_IN_VALIDITY_CERTIFIED 14313 3.95 3.22 4.22 69 RCVD_IN_IADB_SENDERID 14047 3.59 2.14 4.14 70 XM_B_SpammyWords3 13815 6.06 11.29 4.08 71 MIME_HTML_ONLY_MULTI 13756 4.14 4.37 4.06 72 RCVD_IN_IADB_DK 13450 3.48 2.21 3.97 73 XMSubMetaSx_00 13168 4.69 6.81 3.89 74 HTML_IMAGE_RATIO_06 12971 3.67 3.27 3.83 75 TR_XM_DK_SendGrid 12819 4.24 5.45 3.78 76 XMNumbers 12300 3.82 4.31 3.63 77 XMSexyCombo_05 12268 5.31 9.75 3.62 78 T_REMOTE_IMAGE 12100 4.23 5.96 3.57 79 XM_UncommonTLD01 11927 5.07 9.13 3.52 80 T_TooManySym_02 11848 2.75 0.79 3.50 81 RELAYCOUNTRY_META 11842 8.84 22.91 3.49 82 TR_XM_PhishingBody 11422 3.96 5.50 3.37 83 RCVD_IN_IADB_VOUCHED 11327 2.93 1.85 3.34 84 FSL_BULK_SIG 10896 6.80 16.21 3.21 85 XM_B_Phish_Phrases 10663 3.82 5.60 3.15 86 MAILING_LIST_MULTI 10137 3.03 3.12 2.99 87 URI_NOVOWEL 9405 2.69 2.48 2.77 88 ANY_BOUNCE_MESSAGE 9069 2.18 0.87 2.68 89 BOUNCE_MESSAGE 9068 2.18 0.87 2.68 90 BAYES_95 8835 3.37 5.37 2.61 91 TooManyTo_002 8486 2.18 1.34 2.50 92 XM_SPF_SoftFail 8448 3.17 4.96 2.49 93 BAYES_05 8423 1.97 0.62 2.49 94 DKIM_INVALID 8335 2.59 2.94 2.46 95 SHORT_URI_2 8197 1.88 0.47 2.42 96 HTML_MIME_NO_HTML_TAG 8145 3.17 5.20 2.40 97 FROM_EXCESS_BASE64 7935 2.11 1.51 2.34 98 RCVD_IN_IADB_OPTIN 7566 1.92 1.09 2.23 99 XM_B_Phish66 7102 2.23 2.59 2.10 100 HELO_NODOT 6871 1.58 0.42 2.03 101 HELO_NO_DOMAIN 6862 1.58 0.42 2.02 102 TR_XM_SB_Phish 6814 2.06 2.21 2.01 103 TVD_RCVD_IP 6736 1.54 0.36 1.99 104 XMSubPhish11 6711 2.03 2.15 1.98 105 MIME_HTML_MOSTLY 6694 2.12 2.49 1.98 106 XM_B_SpammyTLD 6657 2.72 4.72 1.96 107 INVALID_MSGID 6627 1.51 0.34 1.96 108 HTML_IMAGE_RATIO_08 6494 2.00 2.23 1.92 109 T_XMDrugObfuBody_14 6418 2.39 3.69 1.89 110 HTML_FONT_FACE_BAD 6415 1.63 0.94 1.89 111 SUBJ_ALL_CAPS 6292 1.97 2.27 1.86 112 KHOP_HELO_FCRDNS 6274 2.68 4.84 1.85 113 IN_HORDE_ADDRESS_BOOK 6241 1.39 0.19 1.84 114 MSGID_NOFQDN1 6204 1.36 0.12 1.83 115 TO_MALFORMED 5987 1.29 0.05 1.77 116 TR_Symld_Words 5920 1.61 1.24 1.75 117 TooManyTo_003 5884 1.59 1.19 1.74 118 XM_DK_Undo_01 5593 1.96 2.79 1.65 119 TR_DCC_Bayes_99 5511 8.37 26.10 1.63 120 RCVD_IN_MSPIKE_H5 5463 1.26 0.34 1.61 121 TR_XM_SpammyWords5 5370 2.30 4.17 1.58 122 XM_CamelCaseFrm001 5214 1.68 2.07 1.54 123 T_XMDrugObfuBody_08 5164 2.15 3.79 1.52 124 XM_GoogleGroups 5151 1.94 3.04 1.52 125 TM2_M_VERY_LONG_WORD 5104 2.41 4.78 1.51 126 XM_B_Investor 4959 2.14 3.92 1.46 127 TR_XM_SpammyRelay 4814 4.28 11.80 1.42 128 BOTNET 4733 4.43 12.41 1.40 129 XMDiploma_00 4468 1.52 2.05 1.32 130 XMCapTrack 4408 1.32 1.37 1.30 131 XM_B_Unsub2 4401 1.60 2.40 1.30 132 RCVD_IN_MSPIKE_BL 4391 2.56 5.89 1.30 133 XMGappySubj_01 4375 1.13 0.70 1.29 134 TooManyTo_004 4362 1.24 1.12 1.29 135 XMSubNoVowel 4362 1.34 1.48 1.29 136 TR_XM_MSPIKECOMBO 4328 2.51 5.74 1.28 137 URI_HEX 4242 1.52 2.22 1.25 138 XM_RXBody 4220 1.06 0.57 1.25 139 XM_OfRef6 3968 1.80 3.44 1.17 140 XMStockSpam_06 3946 1.35 1.85 1.16 141 UNTRUSTED_Relay 3922 4.27 12.46 1.16 142 TVD_SPACE_RATIO 3904 0.97 0.48 1.15 143 TooManyTo_005 3662 1.07 1.05 1.08 144 XMBSHREFv2 3526 0.83 0.29 1.04 145 DKIM_ADSP_CUSTOM_MED 3437 1.02 1.04 1.01 146 XM_H_Long_From02 3412 1.16 1.57 1.01 147 XMNoVowels 3290 0.86 0.59 0.97 148 XMSexyCombo_01 3276 1.30 2.18 0.97 149 XM_E_Blogspot 3205 0.72 0.13 0.95 150 RCVD_IN_RP_SAFE 3157 0.91 0.85 0.93 151 T_TooManySym_03 3106 0.76 0.36 0.92 152 XMLngstWrd_00 3039 1.22 2.07 0.90 153 XM_B_COVIDMETA 3031 1.21 2.04 0.89 154 TR_XM_SpammyWords2 2985 3.93 11.96 0.88 155 RCVD_IN_RP_CERTIFIED 2895 0.78 0.60 0.85 156 XMLngstWrd_01 2847 1.17 2.03 0.84 157 XMSubMetaSxObfu_03 2841 0.81 0.73 0.84 158 XMBrknScrpt_02 2819 1.06 1.66 0.83 159 RELAYCOUNTRY_CA 2819 2.15 5.63 0.83 160 XMBody_95 2785 0.62 0.10 0.82 161 T_FILL_THIS_FORM_SHORT 2777 1.33 2.67 0.82 162 RELAYCOUNTRY_GB 2734 1.03 1.60 0.81 163 TR_XM_MaxUnsub 2722 2.23 5.97 0.80 164 TR_MetaPhish_Combo_01 2714 0.83 0.89 0.80 165 XMHTML_After_End 2710 0.91 1.21 0.80 166 XMBdyGiftCard01 2667 0.89 1.16 0.79 167 XMGenDplmaNmb 2642 0.89 1.20 0.78 168 XM_UB50 2570 1.85 4.71 0.76 169 HTTPS_HTTP_MISMATCH 2502 0.94 1.46 0.74 170 XMLngstWrd_02 2488 1.08 1.98 0.73 171 SpammyFromTLD_01 2308 1.30 2.91 0.68 172 URI_TRY_3LD 2303 0.87 1.36 0.68 173 HTML_IMAGE_ONLY_20 2280 0.66 0.62 0.67 174 XM_ShortIntro_01 2266 0.64 0.56 0.67 175 XM_H_PHPMailer 2189 0.65 0.65 0.65 176 HTML_TAG_BALANCE_BODY 2128 0.76 1.12 0.63 177 TR_XM_SpammyWords3 2125 1.12 2.42 0.63 178 XMLngstWrd_03 2122 0.97 1.89 0.63 179 NML_ADSP_CUSTOM_MED 2115 0.69 0.87 0.62 180 XMSexyCombo_04 2112 0.69 0.85 0.62 181 XMPhish30 2109 0.81 1.31 0.62 182 XMSubMetaI_00 2039 0.65 0.76 0.60 183 SHORT_HELO_AND_INLINE_IMAGE 2039 0.46 0.09 0.60 184 FILL_THIS_FORM 2016 0.54 0.39 0.59 185 MPART_ALT_DIFF_COUNT 2015 0.98 2.00 0.59 186 T_OBFU_PDF_ATTACH 2009 0.48 0.18 0.59 187 T_XMHurry_00 1991 0.99 2.03 0.59 188 RCVD_IN_BL_SPAMCOP_NET 1930 3.14 9.90 0.57 189 RCVD_IN_SORBS_DUL 1922 0.48 0.27 0.57 190 T_XMDrugObfuBody_00 1912 0.97 2.04 0.56 191 XM_ProductURIs 1905 0.69 1.02 0.56 192 RCVD_IN_MSPIKE_L4 1902 0.61 0.73 0.56 193 T_Symld_Words_02 1840 0.80 1.49 0.54 194 XM_shorewaves_Whitelist 1826 0.39 0.00 0.54 195 RCVD_IN_MSPIKE_L3 1824 0.92 1.91 0.54 196 TR_XM_PHPDW 1803 0.85 1.67 0.53 197 XMLngstWrd_04 1768 0.87 1.77 0.52 198 FORGED_GMAIL_RCVD 1751 0.63 0.91 0.52 199 XM_B_COPY_HTML 1720 0.56 0.69 0.51 200 SHORTENED_URL_HREF 1661 0.42 0.23 0.49 ----------------------------------------------------------------------