Email: 548632 Autolearn: 0 AvgScore: 1.12 AvgScanTime: 1.31 sec Spam: 147683 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.52 sec Ham: 400949 Autolearn: 0 AvgScore: -3.56 AvgScanTime: 1.24 sec Time Spent Running SA: 200.13 hours Time Spent Processing Spam: 62.34 hours Time Spent Processing Ham: 137.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140653 88.77 95.24 86.39 2 DKIM_SIGNED 126641 69.14 85.75 63.02 3 XM_DK_Pass 123303 67.73 83.49 61.92 4 DKIM_VALID 122434 66.94 82.90 61.06 5 RELAYCOUNTRY_US 117378 81.95 79.48 82.86 6 XM_B_Unicode 113870 72.93 77.10 71.40 7 DCC_CHECK 107250 39.64 72.62 27.49 8 XMListUnsubscribeExists 101558 47.52 68.77 39.69 9 XM_B_SpammyWords 96295 47.61 65.20 41.12 10 DKIM_VALID_AU 92135 50.20 62.39 45.71 11 BAYES_50 63141 49.23 42.75 51.61 12 XM_DK_Undo_02 63035 15.77 42.68 5.86 13 XM_B_Unicode3 61513 43.57 41.65 44.28 14 XM_B_SpammyWords2 52973 21.24 35.87 15.86 15 LOC_TINY_FONT_1 51978 23.43 35.20 19.10 16 MIME_HTML_ONLY 49705 26.32 33.66 23.62 17 TR_XM_DKIM_Undo 49067 11.93 33.22 4.09 18 BAYES_99 48324 12.23 32.72 4.69 19 FVGT_m_MULTI_ODD 46823 23.13 31.71 19.97 20 HTML_FONT_LOW_CONTRAST 46429 24.98 31.44 22.61 21 DKIM_VALID_EF 44046 25.33 29.82 23.67 22 T_KAM_HTML_FONT_INVALID 42461 19.02 28.75 15.43 23 DCC_CHECK_NEGATIVE 40375 60.32 27.34 72.47 24 RCVD_IN_MSPIKE_H2 39826 21.46 26.97 19.43 25 BAYES_999 38108 9.81 25.80 3.92 26 XMSubLong 35303 21.50 23.90 20.61 27 RELAYCOUNTRY_META 34673 8.71 23.48 3.27 28 TR_DCC_Bayes_99 33796 7.29 22.88 1.55 29 T_TM2_M_HEADER_IN_MSG 32296 24.31 21.87 25.22 30 XM_Body_Dirty_Words 31153 13.11 21.09 10.17 31 RCVD_IN_MSPIKE_WL 30327 23.48 20.54 24.57 32 XM_Multi_Part_URI 23008 11.70 15.58 10.27 33 LOTS_OF_MONEY 21474 9.01 14.54 6.98 34 RCVD_IN_MSPIKE_H3 21035 14.11 14.24 14.06 35 XM_B_Unsub 20276 9.79 13.73 8.34 36 FSL_BULK_SIG 20227 5.92 13.70 3.06 37 TR_XM_SpammyRelay 19426 4.52 13.15 1.34 38 UNPARSEABLE_RELAY 19359 8.20 13.11 6.39 39 BOTNET_IPINHOSTNAME 19178 6.36 12.99 3.92 40 TR_XM_UnparsRelay 18964 7.05 12.84 4.92 41 UNTRUSTED_Relay 18098 4.08 12.25 1.06 42 TR_XM_SpammyWords4 18017 6.50 12.20 4.40 43 XM_B_SpammyWords3 17020 5.91 11.52 3.84 44 BOTNET 16959 4.11 11.48 1.39 45 RCVD_IN_BL_SPAMCOP_NET 16787 3.51 11.37 0.62 46 TR_XM_SpammyWords2 15540 3.38 10.52 0.76 47 XMSexyCombo_05 15474 5.10 10.48 3.11 48 MPART_ALT_DIFF 15293 10.99 10.36 11.23 49 XM_UncommonTLD01 14979 4.99 10.14 3.10 50 XM_Evil_Numbers_Gen 13211 8.65 8.95 8.54 51 BAYES_80 12219 4.94 8.27 3.71 52 HTML_IMAGE_RATIO_02 11640 5.49 7.88 4.61 53 TR_XM_PhishingBody 10703 3.86 7.25 2.62 54 BAYES_60 10441 7.59 7.07 7.78 55 RCVD_IN_MSPIKE_BL 10140 2.65 6.87 1.10 56 RELAYCOUNTRY_CA 10122 2.44 6.85 0.82 57 TR_XM_MSPIKECOMBO 10109 2.64 6.85 1.10 58 LotsOfNums_01 9853 7.39 6.67 7.65 59 TR_XM_SPAMCOP 9427 1.89 6.38 0.23 60 XM_B_Phish_Phrases 9146 3.67 6.19 2.74 61 XM_UB50 9015 2.15 6.10 0.69 62 XMSubMetaSx_00 8710 3.68 5.90 2.86 63 RCVD_IN_MSPIKE_H4 8689 8.30 5.88 9.18 64 XM_H_Long_From01 8435 4.79 5.71 4.44 65 TR_XM_MaxUnsub 8367 2.05 5.67 0.72 66 MIME_HTML_ONLY_MULTI 8046 8.47 5.45 9.58 67 HTML_MIME_NO_HTML_TAG 7959 2.85 5.39 1.92 68 T_REMOTE_IMAGE 7629 3.91 5.17 3.45 69 MIME_HTML_MOSTLY 7548 2.90 5.11 2.08 70 XM_B_SpammyTLD 7497 2.73 5.08 1.87 71 TooManyTo_001 7321 6.81 4.96 7.49 72 URI_NOVOWEL 7042 2.85 4.77 2.15 73 HTML_IMAGE_RATIO_04 7038 14.23 4.77 17.71 74 BAYES_95 6717 2.83 4.55 2.20 75 TM2_M_VERY_LONG_WORD 6613 2.32 4.48 1.52 76 XM_SPF_SoftFail 6541 2.44 4.43 1.70 77 XM_B_Investor 6522 2.06 4.42 1.19 78 XM_B_Phish66 6405 2.25 4.34 1.48 79 TR_XM_SpammyWords3 6206 1.48 4.20 0.48 80 XMStrtUSub 6049 9.52 4.10 11.52 81 T_XMDrugObfuBody_14 5690 2.28 3.85 1.70 82 SpammyFromTLD_01 5650 1.49 3.83 0.63 83 XM_DIRTYINTL 5638 1.25 3.82 0.31 84 XM_SendGrid 5367 2.86 3.63 2.57 85 HTML_IMAGE_RATIO_06 5177 4.78 3.51 5.25 86 KHOP_HELO_FCRDNS 5147 1.85 3.49 1.25 87 RCVD_IN_MSPIKE_L5 5080 0.95 3.44 0.04 88 XMNumbers 4962 3.22 3.36 3.16 89 HTML_IMAGE_RATIO_08 4778 2.36 3.24 2.04 90 XM_DK_Undo_01 4766 1.94 3.23 1.46 91 XM_GoogleGroups 4737 2.03 3.21 1.59 92 T_XMDrugObfuBody_08 4736 2.08 3.21 1.67 93 TR_XM_SpammyWords5 4647 1.84 3.15 1.36 94 RCVD_IN_VALIDITY_SAFE 4553 3.80 3.08 4.07 95 TM2_M_URI_OPT_OUT 4503 2.60 3.05 2.43 96 RCVD_IN_PSBL 4491 0.92 3.04 0.14 97 RELAYCOUNTRY_FR 4383 0.97 2.97 0.23 98 MIME_QP_LONG_LINE 4317 4.33 2.92 4.84 99 SpammyFromTLD_02 4266 1.08 2.89 0.41 100 XM_B_Unsub2 4223 1.67 2.86 1.23 101 DKIM_INVALID 4207 2.20 2.85 1.96 102 RCVD_IN_MSPIKE_L3 4165 1.33 2.82 0.79 103 RCVD_IN_VALIDITY_RPBL 4113 0.78 2.79 0.04 104 XMDiploma_00 4060 1.46 2.75 0.99 105 XM_OfRef6 3941 1.35 2.67 0.86 106 RCVD_IN_VALIDITY_CERTIFIED 3933 3.38 2.66 3.65 107 RCVD_IN_IADB_LISTED 3830 3.92 2.59 4.41 108 MAILING_LIST_MULTI 3760 2.61 2.55 2.63 109 T_FILL_THIS_FORM_SHORT 3750 1.25 2.54 0.77 110 TR_XM_SB_Phish 3733 1.99 2.53 1.79 111 XM_CamelCaseFrm001 3729 1.65 2.53 1.33 112 PDS_OTHER_BAD_TLD 3712 0.83 2.51 0.21 113 T_TooManySym_01 3541 4.31 2.40 5.01 114 XMBody_17 3519 0.90 2.38 0.36 115 XMLngstWrd_00 3494 1.34 2.37 0.96 116 XMLngstWrd_01 3457 1.30 2.34 0.91 117 XMLngstWrd_02 3360 1.21 2.28 0.82 118 XMSubPhish11 3337 1.90 2.26 1.77 119 XM_B_SpammyWords4 3335 0.98 2.26 0.51 120 XMLngstWrd_03 3315 1.14 2.24 0.74 121 BOTNET_NORDNS 3282 0.61 2.22 0.02 122 XMLngstWrd_04 3231 1.08 2.19 0.68 123 RCVD_IN_IADB_SPF 3205 3.43 2.17 3.90 124 HTML_TITLE_SUBJ_DIFF 3201 0.98 2.17 0.55 125 TR_XM_DK_SendGrid 3198 1.75 2.17 1.60 126 UPPERCASE_75_100 3077 0.90 2.08 0.46 127 TR_Mismatch_TLD_01 2954 0.69 2.00 0.21 128 XM_B_COVIDMETA 2923 0.99 1.98 0.62 129 XM_UB99 2864 0.52 1.94 0.00 130 RCVD_IN_IADB_DK 2862 3.00 1.94 3.40 131 FROM_EXCESS_BASE64 2810 2.05 1.90 2.10 132 RCVD_IN_IADB_SENDERID 2808 3.09 1.90 3.53 133 XMGenDplmaNmb 2795 0.96 1.89 0.62 134 XMStockSpam_06 2770 1.30 1.88 1.09 135 SUBJ_ALL_CAPS 2740 1.56 1.86 1.45 136 TR_XM_MSPIKECOMBO2 2720 0.60 1.84 0.14 137 BAYES_40 2664 4.40 1.80 5.35 138 T_XMDrugObfuBody_00 2632 0.96 1.78 0.65 139 RCVD_IN_IADB_VOUCHED 2574 2.46 1.74 2.73 140 TR_XM_NoHeaderRelay 2556 0.57 1.73 0.15 141 URI_HEX 2538 1.32 1.72 1.17 142 ALL_TRUSTED 2534 11.39 1.72 14.95 143 TR_XM_PHPDW 2505 0.68 1.70 0.31 144 TR_Mismatch_TLD_02 2477 0.52 1.68 0.09 145 XMSexyCombo_01 2457 0.72 1.66 0.38 146 HTML_IMAGE_ONLY_08 2351 0.50 1.59 0.10 147 XM_URI_RBL 2319 0.51 1.57 0.12 148 USER_IN_DEF_DKIM_WL 2311 7.83 1.56 10.13 149 TR_XM_PHPForged 2307 0.62 1.56 0.27 150 URIBL_DBL_SPAM 2304 0.43 1.56 0.01 151 TR_XM_FormFill2 2253 0.61 1.53 0.27 152 XMHTML_After_End 2249 0.81 1.52 0.55 153 XM_H_PHPOS 2228 0.60 1.51 0.26 154 XM_UB999 2186 0.40 1.48 0.00 155 HTML_TAG_BALANCE_CENTER 2147 0.47 1.45 0.11 156 URI_LONG_REPEAT 2140 0.39 1.45 0.00 157 RELAYCOUNTRY_AU 2123 0.60 1.44 0.29 158 URI_TRY_3LD 2121 0.80 1.44 0.56 159 URI_PHP_REDIR 2114 0.39 1.43 0.00 160 XM_UB60 2069 0.42 1.40 0.05 161 MIXED_CENTER_CASE 2057 0.38 1.39 0.00 162 MIXED_HREF_CASE 2046 0.38 1.39 0.00 163 MIXED_IMG_CASE 2036 0.37 1.38 0.00 164 MIXED_AREA_CASE 2023 0.37 1.37 0.00 165 T_XMHurry_00 2001 0.63 1.35 0.36 166 MIXED_FONT_CASE 1984 0.36 1.34 0.00 167 URIBL_BLACK 1958 0.39 1.33 0.04 168 TR_Symld_Words 1958 1.31 1.33 1.31 169 XMMoneyMeta_00 1936 0.71 1.31 0.48 170 RELAYCOUNTRY_DE 1927 0.49 1.30 0.19 171 TR_XM_BayesRelay 1902 0.35 1.29 0.00 172 FROM_SUSPICIOUS_NTLD 1899 0.38 1.29 0.04 173 XM_H_Long_From02 1888 0.89 1.28 0.74 174 BAYES_20 1885 4.01 1.28 5.02 175 XMBrknScrpt_02 1875 0.86 1.27 0.71 176 TR_LOTS_OF_MONEY3 1836 0.46 1.24 0.17 177 TR_XM_COVIDMETA4 1829 0.46 1.24 0.17 178 XMBdyGiftCard01 1825 0.80 1.24 0.64 179 HTTPS_HTTP_MISMATCH 1819 0.76 1.23 0.59 180 TR_XM_FormFill 1818 0.34 1.23 0.01 181 XM_UB80 1741 0.33 1.18 0.02 182 FROM_SUSPICIOUS_NTLD_FP 1740 0.35 1.18 0.04 183 URI_GOOG_STO_SPAMMY 1725 0.32 1.17 0.00 184 XM_B_REG_HTML 1719 0.50 1.16 0.26 185 TooManyTo_002 1719 1.78 1.16 2.01 186 TR_XM_MaxSPIKE 1705 0.38 1.15 0.09 187 XM_H_Undi_Recip 1697 0.45 1.15 0.19 188 XMPhish30 1695 0.81 1.15 0.68 189 TR_MetaPhish_Combo_01 1675 0.75 1.13 0.61 190 TR_BOTNET_NEGATE 1656 0.53 1.12 0.32 191 RELAYCOUNTRY_GB 1653 0.82 1.12 0.71 192 HTML_FONT_TINY_NORDNS 1639 0.35 1.11 0.07 193 REMOVE_BEFORE_LINK 1625 0.45 1.10 0.21 194 DIET_1 1624 0.48 1.10 0.25 195 MPART_ALT_DIFF_COUNT 1607 0.59 1.09 0.41 196 HTML_FONT_SIZE_LARGE 1604 0.34 1.09 0.07 197 RCVD_IN_IADB_OPTIN 1587 1.59 1.07 1.78 198 XM_B_SEO 1586 0.39 1.07 0.14 199 RELAYCOUNTRY_RU 1545 0.30 1.05 0.02 200 LongTLD 1543 0.43 1.04 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 346385 88.77 95.24 86.39 2 RELAYCOUNTRY_US 332237 81.95 79.48 82.86 3 DCC_CHECK_NEGATIVE 290552 60.32 27.34 72.47 4 XM_B_Unicode 286269 72.93 77.10 71.40 5 DKIM_SIGNED 252673 69.14 85.75 63.02 6 XM_DK_Pass 248259 67.73 83.49 61.92 7 DKIM_VALID 244824 66.94 82.90 61.06 8 BAYES_50 206937 49.23 42.75 51.61 9 DKIM_VALID_AU 183290 50.20 62.39 45.71 10 XM_B_Unicode3 177524 43.57 41.65 44.28 11 XM_B_SpammyWords 164887 47.61 65.20 41.12 12 XMListUnsubscribeExists 159154 47.52 68.77 39.69 13 DCC_CHECK 110233 39.64 72.62 27.49 14 T_TM2_M_HEADER_IN_MSG 101102 24.31 21.87 25.22 15 RCVD_IN_MSPIKE_WL 98513 23.48 20.54 24.57 16 DKIM_VALID_EF 94897 25.33 29.82 23.67 17 MIME_HTML_ONLY 94696 26.32 33.66 23.62 18 HTML_FONT_LOW_CONTRAST 90641 24.98 31.44 22.61 19 XMSubLong 82645 21.50 23.90 20.61 20 FVGT_m_MULTI_ODD 80082 23.13 31.71 19.97 21 RCVD_IN_MSPIKE_H2 77922 21.46 26.97 19.43 22 LOC_TINY_FONT_1 76592 23.43 35.20 19.10 23 HTML_IMAGE_RATIO_04 71019 14.23 4.77 17.71 24 XM_H_Trusted_IP 65560 11.95 0.00 16.35 25 HTML_FONT_FACE_BAD 64328 11.88 0.59 16.04 26 XM_B_SpammyWords2 63575 21.24 35.87 15.86 27 BAYES_00 63271 11.77 0.89 15.78 28 T_KAM_HTML_FONT_INVALID 61865 19.02 28.75 15.43 29 ALL_TRUSTED 59935 11.39 1.72 14.95 30 RCVD_IN_MSPIKE_H3 56377 14.11 14.24 14.06 31 XMStrtUSub 46196 9.52 4.10 11.52 32 MPART_ALT_DIFF 45013 10.99 10.36 11.23 33 XM_Multi_Part_URI 41165 11.70 15.58 10.27 34 XM_Body_Dirty_Words 40785 13.11 21.09 10.17 35 USER_IN_DEF_DKIM_WL 40631 7.83 1.56 10.13 36 MIME_HTML_ONLY_MULTI 38411 8.47 5.45 9.58 37 RCVD_IN_MSPIKE_H4 36824 8.30 5.88 9.18 38 XM_Evil_Numbers_Gen 34228 8.65 8.95 8.54 39 XM_B_Unsub 33436 9.79 13.73 8.34 40 BAYES_60 31178 7.59 7.07 7.78 41 LotsOfNums_01 30677 7.39 6.67 7.65 42 TooManyTo_001 30022 6.81 4.96 7.49 43 LOTS_OF_MONEY 27979 9.01 14.54 6.98 44 TR_XM_DK_Bayes 27190 5.12 0.60 6.78 45 TR_XM_DK_Bayes1 26676 5.02 0.59 6.65 46 XM_DKIMWhitelistDomains 25877 4.77 0.20 6.45 47 UNPARSEABLE_RELAY 25640 8.20 13.11 6.39 48 XM_DK_Undo_02 23499 15.77 42.68 5.86 49 IN_ZIMBRA_NJ_WHITELIST 23335 4.28 0.10 5.82 50 BAYES_40 21453 4.40 1.80 5.35 51 HTML_IMAGE_RATIO_06 21047 4.78 3.51 5.25 52 XMSubNoVowel 20689 3.98 0.77 5.16 53 BAYES_20 20113 4.01 1.28 5.02 54 T_TooManySym_01 20084 4.31 2.40 5.01 55 TR_XM_UnparsRelay 19731 7.05 12.84 4.92 56 MIME_QP_LONG_LINE 19415 4.33 2.92 4.84 57 BAYES_99 18791 12.23 32.72 4.69 58 TR_XM_DK_Bayes2 18684 3.54 0.50 4.66 59 HTML_IMAGE_RATIO_02 18473 5.49 7.88 4.61 60 XM_H_Long_From01 17822 4.79 5.71 4.44 61 RCVD_IN_IADB_LISTED 17674 3.92 2.59 4.41 62 TR_XM_SpammyWords4 17638 6.50 12.20 4.40 63 TR_XM_DKIM_Undo 16400 11.93 33.22 4.09 64 RCVD_IN_VALIDITY_SAFE 16305 3.80 3.08 4.07 65 BAYES_999 15727 9.81 25.80 3.92 66 BOTNET_IPINHOSTNAME 15713 6.36 12.99 3.92 67 RCVD_IN_IADB_SPF 15617 3.43 2.17 3.90 68 BAYES_05 15503 2.99 0.62 3.87 69 XM_B_SpammyWords3 15381 5.91 11.52 3.84 70 BAYES_80 14873 4.94 8.27 3.71 71 XM_PDF 14845 2.94 0.86 3.70 72 RCVD_IN_VALIDITY_CERTIFIED 14629 3.38 2.66 3.65 73 RCVD_IN_IADB_SENDERID 14169 3.09 1.90 3.53 74 T_REMOTE_IMAGE 13836 3.91 5.17 3.45 75 RCVD_IN_IADB_DK 13620 3.00 1.94 3.40 76 ANY_BOUNCE_MESSAGE 13488 2.66 0.76 3.36 77 BOUNCE_MESSAGE 13487 2.66 0.76 3.36 78 RELAYCOUNTRY_META 13095 8.71 23.48 3.27 79 XMNumbers 12682 3.22 3.36 3.16 80 XMSexyCombo_05 12479 5.10 10.48 3.11 81 XM_UncommonTLD01 12421 4.99 10.14 3.10 82 FSL_BULK_SIG 12270 5.92 13.70 3.06 83 T_TooManySym_02 11655 2.31 0.70 2.91 84 XMSubMetaSx_00 11484 3.68 5.90 2.86 85 XM_B_Phish_Phrases 10984 3.67 6.19 2.74 86 RCVD_IN_IADB_VOUCHED 10949 2.46 1.74 2.73 87 MAILING_LIST_MULTI 10557 2.61 2.55 2.63 88 TR_XM_PhishingBody 10495 3.86 7.25 2.62 89 XM_SendGrid 10299 2.86 3.63 2.57 90 TM2_M_URI_OPT_OUT 9737 2.60 3.05 2.43 91 BAYES_95 8826 2.83 4.55 2.20 92 XMSubLongNoVowel 8712 1.65 0.21 2.17 93 XMSubGarbage 8628 1.58 0.02 2.15 94 URI_NOVOWEL 8616 2.85 4.77 2.15 95 FROM_EXCESS_BASE64 8430 2.05 1.90 2.10 96 MIME_HTML_MOSTLY 8345 2.90 5.11 2.08 97 HTML_IMAGE_RATIO_08 8177 2.36 3.24 2.04 98 TooManyTo_002 8041 1.78 1.16 2.01 99 DKIM_INVALID 7849 2.20 2.85 1.96 100 HTML_MIME_NO_HTML_TAG 7697 2.85 5.39 1.92 101 XM_B_SpammyTLD 7483 2.73 5.08 1.87 102 T_HTML_ATTACH 7343 1.37 0.12 1.83 103 TR_XM_SB_Phish 7171 1.99 2.53 1.79 104 RCVD_IN_IADB_OPTIN 7145 1.59 1.07 1.78 105 XMSubPhish11 7098 1.90 2.26 1.77 106 XM_SPF_SoftFail 6833 2.44 4.43 1.70 107 T_XMDrugObfuBody_14 6825 2.28 3.85 1.70 108 T_XMDrugObfuBody_08 6686 2.08 3.21 1.67 109 INVALID_MSGID 6641 1.28 0.27 1.66 110 HELO_NODOT 6521 1.33 0.52 1.63 111 HELO_NO_DOMAIN 6520 1.33 0.52 1.63 112 TR_XM_DK_SendGrid 6402 1.75 2.17 1.60 113 XM_GoogleGroups 6383 2.03 3.21 1.59 114 TR_DCC_Bayes_99 6217 7.29 22.88 1.55 115 IN_HORDE_ADDRESS_BOOK 6134 1.14 0.09 1.53 116 TM2_M_VERY_LONG_WORD 6092 2.32 4.48 1.52 117 TVD_RCVD_IP 5926 1.15 0.26 1.48 118 XM_B_Phish66 5921 2.25 4.34 1.48 119 XM_DK_Undo_01 5867 1.94 3.23 1.46 120 SUBJ_ALL_CAPS 5814 1.56 1.86 1.45 121 TO_MALFORMED 5793 1.06 0.01 1.44 122 BOTNET 5585 4.11 11.48 1.39 123 TR_XM_SpammyWords5 5468 1.84 3.15 1.36 124 TooManyTo_003 5426 1.26 1.01 1.35 125 TR_XM_SpammyRelay 5375 4.52 13.15 1.34 126 XM_CamelCaseFrm001 5347 1.65 2.53 1.33 127 RCVD_IN_MSPIKE_H5 5312 1.08 0.41 1.32 128 TR_Symld_Words 5251 1.31 1.33 1.31 129 XMGappySubj_01 5028 1.08 0.61 1.25 130 KHOP_HELO_FCRDNS 4998 1.85 3.49 1.25 131 XM_B_Unsub2 4939 1.67 2.86 1.23 132 XM_E_Blogspot 4826 0.93 0.19 1.20 133 XM_B_Investor 4779 2.06 4.42 1.19 134 URI_HEX 4680 1.32 1.72 1.17 135 DKIM_ADSP_NXDOMAIN 4413 0.92 0.42 1.10 136 RCVD_IN_MSPIKE_BL 4402 2.65 6.87 1.10 137 TR_XM_MSPIKECOMBO 4393 2.64 6.85 1.10 138 XMStockSpam_06 4377 1.30 1.88 1.09 139 XMCapTrack 4288 1.00 0.82 1.07 140 UNTRUSTED_Relay 4270 4.08 12.25 1.06 141 XMDiploma_00 3954 1.46 2.75 0.99 142 XMLngstWrd_00 3842 1.34 2.37 0.96 143 XMBSHREFv2 3781 0.78 0.35 0.94 144 TooManyTo_004 3765 0.88 0.72 0.94 145 XMLngstWrd_01 3651 1.30 2.34 0.91 146 TVD_SPACE_RATIO 3647 0.74 0.29 0.91 147 XM_OfRef6 3463 1.35 2.67 0.86 148 RELAYCOUNTRY_CA 3283 2.44 6.85 0.82 149 XMLngstWrd_02 3278 1.21 2.28 0.82 150 RCVD_IN_MSPIKE_L3 3155 1.33 2.82 0.79 151 T_FILL_THIS_FORM_SHORT 3103 1.25 2.54 0.77 152 RCVD_IN_RP_SAFE 3094 0.73 0.62 0.77 153 TooManyTo_005 3085 0.75 0.68 0.77 154 DKIM_ADSP_CUSTOM_MED 3040 0.75 0.73 0.76 155 TR_XM_SpammyWords2 3031 3.38 10.52 0.76 156 T_TooManySym_03 2978 0.61 0.26 0.74 157 XM_H_Long_From02 2973 0.89 1.28 0.74 158 XMLngstWrd_03 2953 1.14 2.24 0.74 159 TR_XM_MaxUnsub 2867 2.05 5.67 0.72 160 XMBrknScrpt_02 2848 0.86 1.27 0.71 161 RELAYCOUNTRY_GB 2830 0.82 1.12 0.71 162 RCVD_IN_RP_CERTIFIED 2789 0.65 0.53 0.70 163 XM_UB50 2773 2.15 6.10 0.69 164 XMPhish30 2738 0.81 1.15 0.68 165 XMLngstWrd_04 2707 1.08 2.19 0.68 166 T_XMDrugObfuBody_00 2623 0.96 1.78 0.65 167 XMBdyGiftCard01 2555 0.80 1.24 0.64 168 SpammyFromTLD_01 2544 1.49 3.83 0.63 169 XM_B_COVIDMETA 2501 0.99 1.98 0.62 170 RCVD_IN_BL_SPAMCOP_NET 2495 3.51 11.37 0.62 171 XMGenDplmaNmb 2481 0.96 1.89 0.62 172 XM_RXBody 2473 0.59 0.51 0.62 173 TR_MetaPhish_Combo_01 2457 0.75 1.13 0.61 174 XMBody_95 2449 0.51 0.23 0.61 175 FROM_GOV_DKIM_AU 2389 0.53 0.36 0.60 176 HTML_IMAGE_ONLY_20 2380 0.61 0.64 0.59 177 HTTPS_HTTP_MISMATCH 2353 0.76 1.23 0.59 178 XM_B_COPY_HTML 2325 0.59 0.63 0.58 179 URI_TRY_3LD 2257 0.80 1.44 0.56 180 MSGID_NOFQDN1 2241 0.42 0.02 0.56 181 XM_ShortIntro_01 2236 0.57 0.62 0.56 182 HTML_TAG_BALANCE_BODY 2225 0.65 0.91 0.55 183 XMHTML_After_End 2193 0.81 1.52 0.55 184 HTML_TITLE_SUBJ_DIFF 2189 0.98 2.17 0.55 185 XMSubMetaI_00 2121 0.65 0.96 0.53 186 T_OBFU_PDF_ATTACH 2054 0.42 0.16 0.51 187 XM_B_SpammyWords4 2049 0.98 2.26 0.51 188 XMNoVowels 2008 0.47 0.37 0.50 189 SHORT_HELO_AND_INLINE_IMAGE 1986 0.39 0.09 0.50 190 XMMoneyMeta_00 1934 0.71 1.31 0.48 191 TR_XM_SpammyWords3 1926 1.48 4.20 0.48 192 T_Symld_Words_02 1916 0.56 0.78 0.48 193 NML_ADSP_CUSTOM_MED 1914 0.51 0.61 0.48 194 TR_MSPIKEBAYES00 1852 0.35 0.03 0.46 195 UPPERCASE_75_100 1835 0.90 2.08 0.46 196 RCVD_IN_SORBS_DUL 1750 0.37 0.18 0.44 197 XM_H_PHPMailer 1749 0.57 0.93 0.44 198 T_MANY_PILL_PRICE 1703 0.32 0.03 0.42 199 XM_ProductURIs 1655 0.55 0.92 0.41 200 MPART_ALT_DIFF_COUNT 1655 0.59 1.09 0.41 ----------------------------------------------------------------------