Email: 530133 Autolearn: 0 AvgScore: 3.04 AvgScanTime: 1.22 sec Spam: 145379 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 1.39 sec Ham: 384754 Autolearn: 0 AvgScore: -0.95 AvgScanTime: 1.15 sec Time Spent Running SA: 179.01 hours Time Spent Processing Spam: 56.26 hours Time Spent Processing Ham: 122.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138883 89.96 95.53 87.86 2 DKIM_SIGNED 127142 71.67 87.46 65.71 3 XM_DK_Pass 123524 70.19 84.97 64.60 4 DKIM_VALID 123144 69.43 84.71 63.66 5 RELAYCOUNTRY_US 118597 76.21 81.58 74.18 6 XM_B_Unicode 115471 73.22 79.43 70.88 7 DCC_CHECK 105754 41.76 72.74 30.06 8 XMListUnsubscribeExists 101351 50.49 69.72 43.23 9 XM_B_SpammyWords 98260 53.49 67.59 48.17 10 DKIM_VALID_AU 92009 52.66 63.29 48.64 11 XM_DK_Undo_02 62540 16.15 43.02 6.00 12 BAYES_50 62446 53.79 42.95 57.89 13 XM_B_Unicode3 61997 43.89 42.65 44.36 14 XM_B_SpammyWords2 54417 24.37 37.43 19.43 15 LOC_TINY_FONT_1 53557 24.39 36.84 19.69 16 FVGT_m_MULTI_ODD 49011 24.81 33.71 21.44 17 HTML_FONT_LOW_CONTRAST 48533 26.55 33.38 23.97 18 TR_XM_DKIM_Undo 48368 11.97 33.27 3.93 19 BAYES_99 47420 12.32 32.62 4.65 20 MIME_HTML_ONLY 45957 27.57 31.61 26.04 21 T_KAM_HTML_FONT_INVALID 43927 20.89 30.22 17.37 22 DKIM_VALID_EF 43858 26.13 30.17 24.60 23 DCC_CHECK_NEGATIVE 39558 58.19 27.21 69.89 24 BAYES_999 37072 9.75 25.50 3.80 25 RCVD_IN_MSPIKE_H2 36050 19.87 24.80 18.01 26 XMSubLong 35654 21.47 24.52 20.32 27 TR_DCC_Bayes_99 34248 7.52 23.56 1.46 28 XM_Body_Dirty_Words 33294 13.42 22.90 9.83 29 T_TM2_M_HEADER_IN_MSG 31940 25.55 21.97 26.90 30 RCVD_IN_MSPIKE_WL 30005 24.93 20.64 26.55 31 RELAYCOUNTRY_META 29417 7.98 20.23 3.34 32 XM_Multi_Part_URI 23790 12.20 16.36 10.62 33 LOTS_OF_MONEY 23132 9.26 15.91 6.75 34 XM_B_Unsub 22656 18.45 15.58 19.54 35 RCVD_IN_MSPIKE_H3 20410 14.70 14.04 14.95 36 BOTNET_IPINHOSTNAME 20370 6.90 14.01 4.21 37 UNPARSEABLE_RELAY 20129 8.88 13.85 7.00 38 TR_XM_SpammyWords4 19979 6.86 13.74 4.26 39 TR_XM_UnparsRelay 19820 7.77 13.63 5.55 40 FSL_BULK_SIG 18903 5.59 13.00 2.78 41 XM_B_SpammyWords3 18236 6.82 12.54 4.66 42 XMSexyCombo_05 16742 5.17 11.52 2.77 43 TR_XM_SpammyRelay 15932 4.09 10.96 1.49 44 RCVD_IN_BL_SPAMCOP_NET 15779 3.56 10.85 0.81 45 BOTNET 15362 3.92 10.57 1.40 46 UNTRUSTED_Relay 15183 3.76 10.44 1.24 47 TR_XM_SpammyWords2 14960 3.29 10.29 0.64 48 MPART_ALT_DIFF 14631 7.99 10.06 7.21 49 XM_Evil_Numbers_Gen 12966 7.20 8.92 6.54 50 XM_UncommonTLD01 12638 4.72 8.69 3.22 51 RCVD_IN_MSPIKE_BL 11895 3.13 8.18 1.22 52 TR_XM_MSPIKECOMBO 11852 3.12 8.15 1.22 53 BAYES_60 11230 8.29 7.72 8.51 54 BAYES_80 11084 4.96 7.62 3.96 55 HTML_IMAGE_RATIO_02 10932 5.74 7.52 5.07 56 TR_XM_MaxUnsub 10247 2.42 7.05 0.67 57 TR_XM_PhishingBody 9562 3.75 6.58 2.67 58 XM_B_Phish_Phrases 9357 3.73 6.44 2.70 59 XM_SendGrid 9191 4.59 6.32 3.94 60 XMSubMetaSx_00 9128 3.97 6.28 3.09 61 LotsOfNums_01 9028 8.00 6.21 8.68 62 RCVD_IN_MSPIKE_H4 8998 8.92 6.19 9.95 63 RELAYCOUNTRY_CA 8812 2.26 6.06 0.82 64 TR_XM_SPAMCOP 8746 1.89 6.02 0.34 65 XM_H_Long_From01 8331 5.23 5.73 5.04 66 XM_B_SpammyTLD 7981 2.79 5.49 1.77 67 HTML_MIME_NO_HTML_TAG 7801 2.92 5.37 2.00 68 TM2_M_VERY_LONG_WORD 7779 2.50 5.35 1.42 69 MIME_HTML_MOSTLY 7476 3.02 5.14 2.22 70 XM_UB50 7443 2.00 5.12 0.83 71 TR_XM_SpammyWords3 7134 1.72 4.91 0.52 72 MIME_HTML_ONLY_MULTI 6903 5.15 4.75 5.30 73 TooManyTo_001 6880 13.06 4.73 16.21 74 T_REMOTE_IMAGE 6538 3.59 4.50 3.24 75 URI_NOVOWEL 6533 3.03 4.49 2.48 76 BAYES_95 6452 2.92 4.44 2.35 77 HTML_IMAGE_RATIO_04 6394 4.64 4.40 4.73 78 XM_SPF_SoftFail 6170 2.38 4.24 1.68 79 XM_DIRTYINTL 6074 1.38 4.18 0.32 80 XM_B_Investor 6018 2.06 4.14 1.27 81 T_XMDrugObfuBody_14 6006 2.67 4.13 2.12 82 TR_XM_DK_SendGrid 5977 2.92 4.11 2.47 83 RCVD_IN_MSPIKE_L3 5780 1.81 3.98 0.99 84 PDS_OTHER_BAD_TLD 5486 1.17 3.77 0.19 85 RCVD_IN_VALIDITY_SAFE 5480 3.79 3.77 3.80 86 XMStrtUSub 5319 3.97 3.66 4.09 87 RCVD_IN_MSPIKE_L5 5314 1.02 3.66 0.03 88 TR_XM_SpammyWords5 5233 2.02 3.60 1.43 89 XM_B_Phish66 5202 2.18 3.58 1.66 90 T_XMDrugObfuBody_08 5132 1.98 3.53 1.40 91 XM_OfRef6 4990 1.52 3.43 0.80 92 KHOP_HELO_FCRDNS 4937 1.79 3.40 1.18 93 SpammyFromTLD_01 4876 1.39 3.35 0.65 94 MIME_QP_LONG_LINE 4866 6.52 3.35 7.72 95 HTML_IMAGE_RATIO_06 4845 3.04 3.33 2.93 96 TM2_M_URI_OPT_OUT 4659 5.83 3.20 6.82 97 RCVD_IN_VALIDITY_CERTIFIED 4626 3.37 3.18 3.45 98 HTML_IMAGE_RATIO_08 4616 2.28 3.18 1.94 99 XMNumbers 4575 3.36 3.15 3.44 100 T_TooManySym_01 4496 5.16 3.09 5.95 101 T_FILL_THIS_FORM_SHORT 4292 1.60 2.95 1.09 102 XM_CamelCaseFrm001 4225 2.05 2.91 1.72 103 RELAYCOUNTRY_FR 4030 0.92 2.77 0.21 104 RCVD_IN_IADB_LISTED 4023 4.56 2.77 5.24 105 DKIM_INVALID 3998 2.24 2.75 2.04 106 SpammyFromTLD_02 3953 0.98 2.72 0.33 107 XM_GoogleGroups 3793 1.78 2.61 1.47 108 XMDiploma_00 3762 6.41 2.59 7.86 109 XM_B_Unsub2 3728 1.64 2.56 1.29 110 XM_B_SpammyWords4 3670 1.26 2.52 0.79 111 XMLngstWrd_00 3643 1.26 2.51 0.79 112 URI_PHP_REDIR 3549 0.67 2.44 0.00 113 XMLngstWrd_01 3544 1.20 2.44 0.73 114 XM_DK_Undo_01 3507 1.67 2.41 1.39 115 XMLngstWrd_02 3439 1.12 2.37 0.65 116 XMBody_17 3372 0.94 2.32 0.42 117 TR_LOTS_OF_MONEY3 3350 0.85 2.30 0.29 118 SUBJ_ALL_CAPS 3293 1.77 2.27 1.59 119 RCVD_IN_IADB_SPF 3290 3.98 2.26 4.63 120 RCVD_IN_VALIDITY_RPBL 3073 0.60 2.11 0.03 121 TR_XM_MSPIKECOMBO2 3059 0.69 2.10 0.16 122 XM_B_COVIDMETA 3039 0.94 2.09 0.50 123 URIBL_DBL_SPAM 3002 0.57 2.06 0.01 124 XMLngstWrd_03 2998 0.98 2.06 0.57 125 URI_HEX 2939 1.39 2.02 1.16 126 TR_XM_SB_Phish 2915 2.90 2.01 3.24 127 XMLngstWrd_04 2905 0.92 2.00 0.51 128 RCVD_IN_IADB_DK 2884 3.48 1.98 4.04 129 RCVD_IN_IADB_SENDERID 2865 3.58 1.97 4.19 130 HTML_TITLE_SUBJ_DIFF 2864 0.85 1.97 0.43 131 FROM_EXCESS_BASE64 2848 1.95 1.96 1.94 132 MAILING_LIST_MULTI 2818 2.68 1.94 2.97 133 ALL_TRUSTED 2791 17.56 1.92 23.47 134 UPPERCASE_75_100 2771 0.83 1.91 0.43 135 XMSubPhish11 2742 2.85 1.89 3.21 136 USER_IN_DEF_DKIM_WL 2740 7.63 1.88 9.81 137 XMSexyCombo_01 2727 0.84 1.88 0.44 138 RCVD_IN_IADB_VOUCHED 2720 2.85 1.87 3.22 139 BAYES_40 2712 3.81 1.87 4.55 140 BOTNET_NORDNS 2621 0.51 1.80 0.02 141 HTML_IMAGE_ONLY_08 2581 0.57 1.78 0.12 142 T_XMDrugObfuBody_00 2537 0.94 1.75 0.63 143 XMStockSpam_06 2536 0.94 1.74 0.64 144 TR_XM_PHPDW 2441 0.67 1.68 0.30 145 HTML_TAG_BALANCE_CENTER 2400 0.51 1.65 0.09 146 T_XMHurry_00 2387 0.75 1.64 0.42 147 XMGenDplmaNmb 2353 5.70 1.62 7.25 148 TR_XM_MaxSPIKE 2353 0.54 1.62 0.13 149 XM_URI_RBL 2332 0.52 1.60 0.11 150 TR_XM_COVIDMETA4 2312 0.58 1.59 0.20 151 TR_XM_NoHeaderRelay 2278 0.55 1.57 0.16 152 TR_XM_PHPForged 2257 0.61 1.55 0.25 153 TR_XM_FormFill2 2212 0.60 1.52 0.25 154 XM_H_PHPOS 2195 0.59 1.51 0.24 155 BODY_URI_ONLY 2192 0.43 1.51 0.03 156 XM_UB60 2186 0.46 1.50 0.06 157 MIXED_CENTER_CASE 2175 0.41 1.50 0.00 158 XMHTML_After_End 2174 0.88 1.50 0.64 159 MIXED_HREF_CASE 2145 0.41 1.48 0.00 160 MIXED_IMG_CASE 2131 0.41 1.47 0.00 161 MIXED_AREA_CASE 2123 0.40 1.46 0.00 162 XM_UB99 2122 0.40 1.46 0.01 163 MIXED_FONT_CASE 2094 0.40 1.44 0.00 164 BAYES_20 2086 3.55 1.43 4.35 165 URI_GOOG_STO_SPAMMY 2031 0.38 1.40 0.00 166 RCVD_IN_PSBL 2000 0.48 1.38 0.14 167 URI_LONG_REPEAT 1977 0.38 1.36 0.00 168 HTTPS_HTTP_MISMATCH 1968 0.81 1.35 0.60 169 RELAYCOUNTRY_DE 1930 0.57 1.33 0.29 170 XMSlimDrugH 1899 0.69 1.31 0.45 171 TR_BOTNET_NEGATE 1863 0.58 1.28 0.31 172 URIBL_BLACK 1862 0.40 1.28 0.07 173 TR_Symld_Words 1848 1.35 1.27 1.39 174 RELAYCOUNTRY_AU 1832 0.56 1.26 0.29 175 TR_LOTS_OF_MONEY2 1828 0.48 1.26 0.19 176 T_MONEY_PERCENT 1828 0.48 1.26 0.19 177 XMBdyGiftCard01 1827 0.83 1.26 0.67 178 HTML_FONT_SIZE_LARGE 1806 0.40 1.24 0.09 179 TR_XM_COVIDMETA1 1805 0.46 1.24 0.17 180 XM_H_Long_From02 1771 1.11 1.22 1.06 181 XMPhish30 1760 0.71 1.21 0.52 182 TM2_M_A_HREF_HREF 1734 0.53 1.19 0.28 183 RCVD_IN_IADB_OPTIN 1732 1.86 1.19 2.11 184 XM_B_SEO 1707 0.41 1.17 0.12 185 T_Symld_Words_02 1680 0.72 1.16 0.56 186 HTML_FONT_TINY_NORDNS 1654 0.36 1.14 0.06 187 XM_ProductURIs 1650 0.71 1.13 0.55 188 XMSubMetaI_00 1619 0.76 1.11 0.62 189 XM_H_Undi_Recip 1616 0.43 1.11 0.17 190 XM_Body_Dirty_Words_01 1615 0.50 1.11 0.27 191 XM_UB999 1607 0.31 1.11 0.00 192 HTML_TAG_BALANCE_BODY 1607 0.75 1.11 0.61 193 XMBrknScrpt_02 1605 0.76 1.10 0.63 194 URI_TRY_3LD 1596 0.70 1.10 0.55 195 TR_XM_BayesRelay 1587 0.30 1.09 0.00 196 TR_Mismatch_TLD_02 1579 0.36 1.09 0.09 197 TR_XM_SEO4 1553 0.35 1.07 0.08 198 TR_XM_FormFill 1534 0.36 1.06 0.09 199 PLING_QUERY 1516 1.14 1.04 1.18 200 FROM_SUSPICIOUS_NTLD 1504 0.33 1.03 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 338047 89.96 95.53 87.86 2 RELAYCOUNTRY_US 285399 76.21 81.58 74.18 3 XM_B_Unicode 272702 73.22 79.43 70.88 4 DCC_CHECK_NEGATIVE 268901 58.19 27.21 69.89 5 DKIM_SIGNED 252811 71.67 87.46 65.71 6 XM_DK_Pass 248559 70.19 84.97 64.60 7 DKIM_VALID 244943 69.43 84.71 63.66 8 BAYES_50 222716 53.79 42.95 57.89 9 DKIM_VALID_AU 187152 52.66 63.29 48.64 10 XM_B_SpammyWords 185332 53.49 67.59 48.17 11 XM_B_Unicode3 170668 43.89 42.65 44.36 12 XMListUnsubscribeExists 166324 50.49 69.72 43.23 13 DCC_CHECK 115639 41.76 72.74 30.06 14 T_TM2_M_HEADER_IN_MSG 103498 25.55 21.97 26.90 15 RCVD_IN_MSPIKE_WL 102141 24.93 20.64 26.55 16 MIME_HTML_ONLY 100200 27.57 31.61 26.04 17 DKIM_VALID_EF 94645 26.13 30.17 24.60 18 HTML_FONT_LOW_CONTRAST 92240 26.55 33.38 23.97 19 ALL_TRUSTED 90316 17.56 1.92 23.47 20 FVGT_m_MULTI_ODD 82509 24.81 33.71 21.44 21 XMSubLong 78180 21.47 24.52 20.32 22 LOC_TINY_FONT_1 75748 24.39 36.84 19.69 23 XM_B_Unsub 75166 18.45 15.58 19.54 24 XM_B_SpammyWords2 74764 24.37 37.43 19.43 25 RCVD_IN_MSPIKE_H2 69287 19.87 24.80 18.01 26 T_KAM_HTML_FONT_INVALID 66824 20.89 30.22 17.37 27 TooManyTo_001 62365 13.06 4.73 16.21 28 RCVD_IN_MSPIKE_H3 57513 14.70 14.04 14.95 29 BAYES_00 44010 8.49 0.70 11.44 30 XM_Multi_Part_URI 40862 12.20 16.36 10.62 31 RCVD_IN_MSPIKE_H4 38293 8.92 6.19 9.95 32 XM_Body_Dirty_Words 37834 13.42 22.90 9.83 33 USER_IN_DEF_DKIM_WL 37729 7.63 1.88 9.81 34 LotsOfNums_01 33398 8.00 6.21 8.68 35 BAYES_60 32725 8.29 7.72 8.51 36 XMDiploma_00 30229 6.41 2.59 7.86 37 MIME_QP_LONG_LINE 29688 6.52 3.35 7.72 38 XMGenDplmaNmb 27882 5.70 1.62 7.25 39 MPART_ALT_DIFF 27744 7.99 10.06 7.21 40 UNPARSEABLE_RELAY 26945 8.88 13.85 7.00 41 TM2_M_URI_OPT_OUT 26241 5.83 3.20 6.82 42 LOTS_OF_MONEY 25979 9.26 15.91 6.75 43 XM_DKIMWhitelistDomains 25789 4.88 0.05 6.70 44 XM_Evil_Numbers_Gen 25180 7.20 8.92 6.54 45 IN_ZIMBRA_NJ_WHITELIST 23685 4.49 0.08 6.16 46 XM_DK_Undo_02 23090 16.15 43.02 6.00 47 T_TooManySym_01 22876 5.16 3.09 5.95 48 TR_XM_DK_Bayes 22557 4.38 0.44 5.86 49 TR_XM_DK_Bayes1 21970 4.26 0.43 5.71 50 TR_XM_UnparsRelay 21353 7.77 13.63 5.55 51 MIME_HTML_ONLY_MULTI 20400 5.15 4.75 5.30 52 RCVD_IN_IADB_LISTED 20150 4.56 2.77 5.24 53 HTML_IMAGE_RATIO_02 19492 5.74 7.52 5.07 54 XM_H_Long_From01 19385 5.23 5.73 5.04 55 TR_XM_DK_Bayes2 19258 3.74 0.39 5.01 56 XM_H_Trusted_IP 19002 3.58 0.00 4.94 57 HTML_IMAGE_RATIO_04 18196 4.64 4.40 4.73 58 XM_B_SpammyWords3 17917 6.82 12.54 4.66 59 BAYES_99 17887 12.32 32.62 4.65 60 RCVD_IN_IADB_SPF 17833 3.98 2.26 4.63 61 BAYES_40 17506 3.81 1.87 4.55 62 BAYES_20 16744 3.55 1.43 4.35 63 TR_XM_SpammyWords4 16397 6.86 13.74 4.26 64 BOTNET_IPINHOSTNAME 16207 6.90 14.01 4.21 65 RCVD_IN_IADB_SENDERID 16108 3.58 1.97 4.19 66 XMStrtUSub 15721 3.97 3.66 4.09 67 XM_PDF 15679 3.21 0.92 4.08 68 RCVD_IN_IADB_DK 15541 3.48 1.98 4.04 69 BAYES_80 15221 4.96 7.62 3.96 70 XM_SendGrid 15149 4.59 6.32 3.94 71 TR_XM_DKIM_Undo 15115 11.97 33.27 3.93 72 BAYES_999 14613 9.75 25.50 3.80 73 RCVD_IN_VALIDITY_SAFE 14607 3.79 3.77 3.80 74 RCVD_IN_VALIDITY_CERTIFIED 13256 3.37 3.18 3.45 75 XMNumbers 13236 3.36 3.15 3.44 76 RELAYCOUNTRY_META 12862 7.98 20.23 3.34 77 T_REMOTE_IMAGE 12474 3.59 4.50 3.24 78 TR_XM_SB_Phish 12450 2.90 2.01 3.24 79 XM_UncommonTLD01 12384 4.72 8.69 3.22 80 RCVD_IN_IADB_VOUCHED 12375 2.85 1.87 3.22 81 XMSubPhish11 12356 2.85 1.89 3.21 82 T_TooManySym_02 11969 2.47 0.77 3.11 83 XMSubMetaSx_00 11905 3.97 6.28 3.09 84 MAILING_LIST_MULTI 11411 2.68 1.94 2.97 85 HTML_IMAGE_RATIO_06 11278 3.04 3.33 2.93 86 FSL_BULK_SIG 10712 5.59 13.00 2.78 87 XMSexyCombo_05 10643 5.17 11.52 2.77 88 XM_B_Phish_Phrases 10403 3.73 6.44 2.70 89 TR_XM_PhishingBody 10292 3.75 6.58 2.67 90 BOUNCE_MESSAGE 9685 2.04 0.78 2.52 91 ANY_BOUNCE_MESSAGE 9685 2.04 0.78 2.52 92 URI_NOVOWEL 9549 3.03 4.49 2.48 93 TR_XM_DK_SendGrid 9518 2.92 4.11 2.47 94 BAYES_95 9052 2.92 4.44 2.35 95 BAYES_05 8889 1.84 0.61 2.31 96 MIME_HTML_MOSTLY 8535 3.02 5.14 2.22 97 T_XMDrugObfuBody_14 8167 2.67 4.13 2.12 98 RCVD_IN_IADB_OPTIN 8127 1.86 1.19 2.11 99 TooManyTo_002 8101 1.76 0.86 2.11 100 DKIM_INVALID 7868 2.24 2.75 2.04 101 HTML_MIME_NO_HTML_TAG 7705 2.92 5.37 2.00 102 FROM_EXCESS_BASE64 7483 1.95 1.96 1.94 103 HTML_IMAGE_RATIO_08 7448 2.28 3.18 1.94 104 SHORT_URI_2 7251 1.47 0.38 1.88 105 XM_B_SpammyTLD 6817 2.79 5.49 1.77 106 INVALID_MSGID 6677 1.32 0.22 1.74 107 XM_CamelCaseFrm001 6634 2.05 2.91 1.72 108 XM_SPF_SoftFail 6452 2.38 4.24 1.68 109 XM_B_Phish66 6373 2.18 3.58 1.66 110 RCVD_IN_MSPIKE_H5 6335 1.31 0.41 1.65 111 HELO_NODOT 6308 1.33 0.52 1.64 112 HELO_NO_DOMAIN 6306 1.33 0.52 1.64 113 XMSubNoVowel 6241 1.32 0.53 1.62 114 IN_HORDE_ADDRESS_BOOK 6198 1.20 0.10 1.61 115 SUBJ_ALL_CAPS 6102 1.77 2.27 1.59 116 TO_MALFORMED 5787 1.10 0.04 1.50 117 SHORTENED_URL_HREF 5739 1.12 0.14 1.49 118 TR_XM_SpammyRelay 5737 4.09 10.96 1.49 119 XM_GoogleGroups 5647 1.78 2.61 1.47 120 TR_DCC_Bayes_99 5613 7.52 23.56 1.46 121 TR_XM_SpammyWords5 5495 2.02 3.60 1.43 122 TooManyTo_003 5477 1.24 0.74 1.42 123 TM2_M_VERY_LONG_WORD 5461 2.50 5.35 1.42 124 BOTNET 5395 3.92 10.57 1.40 125 T_XMDrugObfuBody_08 5373 1.98 3.53 1.40 126 XM_DK_Undo_01 5363 1.67 2.41 1.39 127 TR_Symld_Words 5332 1.35 1.27 1.39 128 TVD_RCVD_IP 5170 1.02 0.15 1.34 129 XM_B_Unsub2 4968 1.64 2.56 1.29 130 XM_B_Investor 4892 2.06 4.14 1.27 131 UNTRUSTED_Relay 4763 3.76 10.44 1.24 132 RCVD_IN_MSPIKE_BL 4686 3.13 8.18 1.22 133 TR_XM_MSPIKECOMBO 4682 3.12 8.15 1.22 134 XMGappySubj_01 4634 0.92 0.15 1.20 135 PLING_QUERY 4534 1.14 1.04 1.18 136 KHOP_HELO_FCRDNS 4531 1.79 3.40 1.18 137 URI_HEX 4449 1.39 2.02 1.16 138 T_FILL_THIS_FORM_SHORT 4189 1.60 2.95 1.09 139 XM_H_Long_From02 4089 1.11 1.22 1.06 140 XMCapTrack 3992 0.86 0.38 1.04 141 XMNoVowels 3970 0.85 0.36 1.03 142 RCVD_IN_MSPIKE_L3 3817 1.81 3.98 0.99 143 XMBSHREFv2 3814 0.79 0.25 0.99 144 TooManyTo_004 3737 0.86 0.58 0.97 145 TVD_PH_BODY_ACCOUNTS_PRE 3682 0.73 0.13 0.96 146 TVD_SPACE_RATIO 3629 0.74 0.20 0.94 147 HTML_FONT_FACE_BAD 3484 0.88 0.80 0.91 148 DKIM_ADSP_NXDOMAIN 3384 0.77 0.47 0.88 149 XM_UB50 3185 2.00 5.12 0.83 150 RELAYCOUNTRY_CA 3148 2.26 6.06 0.82 151 RCVD_IN_BL_SPAMCOP_NET 3110 3.56 10.85 0.81 152 T_TooManySym_03 3094 0.66 0.28 0.80 153 XM_OfRef6 3074 1.52 3.43 0.80 154 DKIM_ADSP_CUSTOM_MED 3045 0.78 0.77 0.79 155 XMLngstWrd_00 3031 1.26 2.51 0.79 156 TooManyTo_005 3026 0.72 0.54 0.79 157 XM_B_SpammyWords4 3021 1.26 2.52 0.79 158 RCVD_IN_RP_SAFE 2996 0.78 0.77 0.78 159 XMLngstWrd_01 2802 1.20 2.44 0.73 160 TR_MetaPhish_Combo_01 2781 0.76 0.86 0.72 161 XMBody_95 2744 0.56 0.14 0.71 162 RCVD_IN_RP_CERTIFIED 2726 0.69 0.66 0.71 163 XMBdyGiftCard01 2586 0.83 1.26 0.67 164 TR_XM_MaxUnsub 2576 2.42 7.05 0.67 165 RELAYCOUNTRY_GB 2530 0.74 0.96 0.66 166 XMLngstWrd_02 2510 1.12 2.37 0.65 167 SpammyFromTLD_01 2484 1.39 3.35 0.65 168 XMHTML_After_End 2476 0.88 1.50 0.64 169 TR_XM_SpammyWords2 2473 3.29 10.29 0.64 170 XMStockSpam_06 2462 0.94 1.74 0.64 171 T_XMDrugObfuBody_00 2443 0.94 1.75 0.63 172 XMBrknScrpt_02 2439 0.76 1.10 0.63 173 FROM_GOV_DKIM_AU 2424 0.53 0.26 0.63 174 XMSubMetaI_00 2403 0.76 1.11 0.62 175 HTML_IMAGE_ONLY_20 2392 0.56 0.41 0.62 176 HTML_TAG_BALANCE_BODY 2346 0.75 1.11 0.61 177 HTTPS_HTTP_MISMATCH 2302 0.81 1.35 0.60 178 MSGID_NOFQDN1 2215 0.42 0.02 0.58 179 XM_B_DNDMA 2215 0.64 0.81 0.58 180 XMLngstWrd_03 2211 0.98 2.06 0.57 181 XM_RXBody 2161 0.62 0.77 0.56 182 T_Symld_Words_02 2146 0.72 1.16 0.56 183 URI_TRY_3LD 2110 0.70 1.10 0.55 184 XM_ProductURIs 2101 0.71 1.13 0.55 185 XM_ShortIntro_01 2080 0.54 0.54 0.54 186 NML_ADSP_CUSTOM_MED 2048 0.56 0.65 0.53 187 XM_B_COPY_HTML 2029 0.53 0.54 0.53 188 T_OBFU_PDF_ATTACH 2016 0.43 0.19 0.52 189 XMPhish30 2005 0.71 1.21 0.52 190 TR_XM_SpammyWords3 2002 1.72 4.91 0.52 191 XMMoneyMeta_00 1980 0.65 1.02 0.51 192 XMLngstWrd_04 1980 0.92 2.00 0.51 193 XM_B_COVIDMETA 1926 0.94 2.09 0.50 194 XM_H_PHPMailer 1920 0.61 0.89 0.50 195 XMOemUri 1908 0.41 0.17 0.50 196 SHORT_HELO_AND_INLINE_IMAGE 1871 0.38 0.09 0.49 197 FROM_GOV_SPOOF 1837 0.38 0.13 0.48 198 TR_MSPIKEBAYES00 1813 0.35 0.03 0.47 199 XM_E_Blogspot 1790 0.39 0.18 0.47 200 MPART_ALT_DIFF_COUNT 1773 0.59 0.93 0.46 ----------------------------------------------------------------------