Email: 476958 Autolearn: 0 AvgScore: 3.67 AvgScanTime: 1.29 sec Spam: 154905 Autolearn: 0 AvgScore: 14.18 AvgScanTime: 1.42 sec Ham: 322053 Autolearn: 0 AvgScore: -1.38 AvgScanTime: 1.23 sec Time Spent Running SA: 171.11 hours Time Spent Processing Spam: 61.23 hours Time Spent Processing Ham: 109.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147031 87.78 94.92 84.34 2 DKIM_SIGNED 124024 75.16 80.06 72.81 3 XM_B_Unicode 122799 72.71 79.27 69.55 4 XM_DK_Pass 121025 73.61 78.13 71.44 5 DKIM_VALID 119832 72.84 77.36 70.66 6 RELAYCOUNTRY_US 118220 79.35 76.32 80.81 7 XM_B_SpammyWords 105480 52.81 68.09 45.46 8 DCC_CHECK 103034 43.82 66.51 32.91 9 XMListUnsubscribeExists 99131 52.22 63.99 46.56 10 DKIM_VALID_AU 90970 54.59 58.73 52.59 11 BAYES_50 71833 52.45 46.37 55.37 12 XM_B_Unicode3 63941 42.18 41.28 42.62 13 XM_DK_Undo_02 62283 17.55 40.21 6.66 14 XM_B_SpammyWords2 57285 24.92 36.98 19.12 15 DCC_CHECK_NEGATIVE 51820 56.14 33.45 67.06 16 FVGT_m_MULTI_ODD 51658 26.34 33.35 22.97 17 LOC_TINY_FONT_1 50157 25.77 32.38 22.60 18 TR_XM_DKIM_Undo 49103 13.42 31.70 4.63 19 BAYES_99 47438 13.96 30.62 5.94 20 MIME_HTML_ONLY 46381 24.57 29.94 21.98 21 HTML_FONT_LOW_CONTRAST 45888 27.02 29.62 25.76 22 T_KAM_HTML_FONT_INVALID 43952 22.27 28.37 19.34 23 DKIM_VALID_EF 39690 24.97 25.62 24.65 24 BAYES_999 37379 11.15 24.13 4.91 25 RELAYCOUNTRY_META 35157 10.05 22.70 3.97 26 RCVD_IN_MSPIKE_H2 35073 21.90 22.64 21.55 27 XM_Body_Dirty_Words 33280 15.37 21.48 12.43 28 TR_DCC_Bayes_99 32939 8.05 21.26 1.70 29 T_TM2_M_HEADER_IN_MSG 32268 24.59 20.83 26.40 30 XMSubLong 31787 20.49 20.52 20.47 31 RCVD_IN_MSPIKE_WL 31664 26.28 20.44 29.09 32 LOTS_OF_MONEY 25024 11.38 16.15 9.08 33 XM_Multi_Part_URI 24384 13.07 15.74 11.79 34 XM_B_Unsub 24267 11.98 15.67 10.21 35 UNTRUSTED_Relay 23427 5.94 15.12 1.52 36 TR_XM_SpammyWords4 22417 8.75 14.47 6.00 37 XM_B_SpammyWords3 22251 7.27 14.36 3.85 38 RCVD_IN_MSPIKE_H3 22016 15.94 14.21 16.77 39 FSL_BULK_SIG 21666 7.14 13.99 3.85 40 UNPARSEABLE_RELAY 19637 9.06 12.68 7.32 41 TR_XM_UnparsRelay 19158 7.98 12.37 5.87 42 BOTNET_IPINHOSTNAME 19095 7.19 12.33 4.71 43 MIME_QP_LONG_LINE 18166 9.53 11.73 8.48 44 XM_UncommonTLD01 18037 6.33 11.64 3.78 45 TM2_M_URI_OPT_OUT 17865 8.07 11.53 6.40 46 MPART_ALT_DIFF 17796 8.33 11.49 6.81 47 TR_XM_SpammyRelay 17479 4.82 11.28 1.71 48 XMSexyCombo_05 17451 6.40 11.27 4.06 49 BOTNET 16765 4.49 10.82 1.44 50 RCVD_IN_BL_SPAMCOP_NET 15675 3.75 10.12 0.69 51 TR_XM_SpammyWords2 15330 3.87 9.90 0.97 52 RCVD_IN_MSPIKE_BL 14878 4.03 9.60 1.34 53 XM_UB50 14528 3.74 9.38 1.03 54 TR_XM_PhishingBody 14146 5.03 9.13 3.05 55 LotsOfNums_01 12707 8.74 8.20 9.00 56 HTML_IMAGE_RATIO_02 12120 6.46 7.82 5.80 57 XM_Evil_Numbers_Gen 11371 7.77 7.34 7.98 58 BAYES_80 11343 5.37 7.32 4.43 59 BAYES_60 11289 9.25 7.29 10.19 60 TR_XM_MSPIKECOMBO 11023 3.22 7.12 1.34 61 XM_SendGrid 10766 5.62 6.95 4.97 62 SpammyFromTLD_01 10544 2.69 6.81 0.71 63 TM2_M_VERY_LONG_WORD 10262 3.76 6.62 2.38 64 XMSubMetaSx_00 10249 4.78 6.62 3.89 65 XM_B_Phish_Phrases 10205 4.59 6.59 3.62 66 XM_B_Phish66 9816 3.03 6.34 1.43 67 XM_H_Long_From01 9613 5.82 6.21 5.63 68 MIME_HTML_ONLY_MULTI 9585 5.34 6.19 4.93 69 HTML_MIME_NO_HTML_TAG 9476 4.33 6.12 3.47 70 XMLngstWrd_00 9370 3.19 6.05 1.81 71 RCVD_IN_MSPIKE_H4 9210 9.11 5.95 10.63 72 RELAYCOUNTRY_CA 9068 2.52 5.85 0.92 73 HELO_NODOT 8998 2.93 5.81 1.54 74 HELO_NO_DOMAIN 8992 2.92 5.80 1.54 75 XMLngstWrd_01 8919 3.04 5.76 1.74 76 MIME_HTML_MOSTLY 8879 3.34 5.73 2.19 77 TR_XM_MaxUnsub 8855 2.58 5.72 1.07 78 MISSING_HEADERS 8756 2.26 5.65 0.63 79 XM_B_SpammyTLD 8708 3.32 5.62 2.22 80 TR_LOTS_OF_MONEY3 8466 2.23 5.47 0.67 81 REPLYTO_WITHOUT_TO_CC 8432 2.00 5.44 0.34 82 UReplyToMismatch 8175 1.91 5.28 0.29 83 XM_B_SpammyWords4 8020 2.09 5.18 0.60 84 TR_XM_SPAMCOP 7631 1.72 4.93 0.17 85 XMLngstWrd_02 7567 2.71 4.88 1.66 86 XM_B_Investor 7309 2.51 4.72 1.45 87 BOUNCE_MESSAGE 7296 5.08 4.71 5.26 88 ANY_BOUNCE_MESSAGE 7296 5.08 4.71 5.26 89 HTML_IMAGE_RATIO_04 7130 6.01 4.60 6.69 90 URI_NOVOWEL 6878 3.10 4.44 2.46 91 KHOP_HELO_FCRDNS 6697 2.47 4.32 1.57 92 T_XMDrugObfuBody_14 6684 2.78 4.31 2.04 93 XM_DIRTYINTL 6625 1.60 4.28 0.31 94 XM_B_Unsub2 6580 2.20 4.25 1.22 95 BAYES_95 6489 3.24 4.19 2.78 96 XM_GoogleGroups 6465 2.90 4.17 2.29 97 TR_XM_SpammyWords3 6362 1.71 4.11 0.55 98 TR_XM_DK_SendGrid 6350 3.42 4.10 3.09 99 TooManyTo_001 6123 6.09 3.95 7.12 100 RELAYCOUNTRY_FR 6105 1.42 3.94 0.21 101 XMLngstWrd_03 5943 2.16 3.84 1.35 102 XM_OfRef6 5928 1.83 3.83 0.88 103 TR_XM_COVIDMETA4 5747 1.33 3.71 0.19 104 XMNumbers 5706 3.62 3.68 3.59 105 T_Symld_Words_02 5658 1.49 3.65 0.44 106 RCVD_IN_MSPIKE_L5 5582 1.20 3.60 0.04 107 XM_SPF_SoftFail 5535 2.50 3.57 1.99 108 XMLngstWrd_04 5507 2.02 3.56 1.28 109 XM_ShortIntro_01 5411 1.58 3.49 0.65 110 HTML_TITLE_SUBJ_DIFF 5383 1.91 3.48 1.16 111 HTML_IMAGE_RATIO_06 5378 3.49 3.47 3.50 112 T_XMDrugObfuBody_08 5335 2.01 3.44 1.32 113 UPPERCASE_75_100 5327 1.89 3.44 1.14 114 T_REMOTE_IMAGE 5208 3.45 3.36 3.49 115 URIBL_DBL_SPAM 5172 1.09 3.34 0.01 116 XMStrtUSub 5019 3.80 3.24 4.08 117 NA_DOLLARS 4984 1.13 3.22 0.12 118 RCVD_IN_VALIDITY_SAFE 4837 3.88 3.12 4.24 119 PDS_OTHER_BAD_TLD 4826 1.13 3.12 0.17 120 RCVD_IN_MSPIKE_L3 4701 1.58 3.03 0.89 121 RELAYCOUNTRY_NG_I 4652 0.98 3.00 0.00 122 TR_XM_SpammyWords5 4575 1.91 2.95 1.41 123 ALL_TRUSTED 4434 11.95 2.86 16.32 124 TR_Mismatch_TLD_01 4412 1.11 2.85 0.27 125 XM_B_COVIDMETA 4375 1.33 2.82 0.61 126 RCVD_IN_VALIDITY_CERTIFIED 4212 3.45 2.72 3.80 127 DKIM_INVALID 4192 2.32 2.71 2.14 128 SpammyFromTLD_02 3945 1.24 2.55 0.62 129 XMDiploma_00 3882 1.55 2.51 1.10 130 RCVD_IN_MSPIKE_ZBI 3855 0.81 2.49 0.00 131 TR_XM_NoHeaderRelay 3846 0.90 2.48 0.14 132 XM_DK_Undo_01 3846 1.79 2.48 1.46 133 XM_UB99 3793 0.80 2.45 0.00 134 T_TooManySym_01 3700 4.88 2.39 6.08 135 T_FILL_THIS_FORM_SHORT 3682 1.18 2.38 0.61 136 URI_OPTOUT_3LD 3552 0.78 2.29 0.05 137 RCVD_IN_PSBL 3545 0.75 2.29 0.01 138 XM_CamelCaseFrm001 3545 2.15 2.29 2.08 139 RCVD_IN_IADB_LISTED 3529 4.30 2.28 5.28 140 URI_PHP_REDIR 3493 0.74 2.25 0.00 141 TR_XM_PHPDW 3478 1.04 2.25 0.47 142 RCVD_IN_VALIDITY_RPBL 3447 0.79 2.23 0.10 143 TR_XM_PHPForged 3425 0.98 2.21 0.39 144 TR_XM_FormFill2 3379 0.98 2.18 0.40 145 XM_H_PHPOS 3362 0.97 2.17 0.39 146 TR_XM_PhishingBody2 3359 0.72 2.17 0.03 147 TR_XM_COVIDMETA1 3289 0.83 2.12 0.21 148 TR_XM_MSPIKECOMBO2 3280 0.83 2.12 0.21 149 XM_UB999 3138 0.66 2.03 0.00 150 RELAYCOUNTRY_DE 3074 0.95 1.98 0.45 151 RCVD_IN_IADB_SPF 3041 3.80 1.96 4.68 152 HTML_IMAGE_RATIO_08 3037 2.21 1.96 2.34 153 T_XMDrugObfuBody_00 3026 1.40 1.95 1.13 154 XMBody_17 2962 0.87 1.91 0.37 155 XMStockSpam_06 2923 1.78 1.89 1.73 156 XMSexyCombo_01 2914 1.39 1.88 1.16 157 XMBounce_01 2869 0.81 1.85 0.31 158 TR_XM_SB_Phish 2847 1.95 1.84 2.01 159 BOTNET_NORDNS 2845 0.61 1.84 0.02 160 RCVD_IN_IADB_DK 2773 3.34 1.79 4.08 161 URI_NO_WWW_BIZ_CGI 2760 0.59 1.78 0.02 162 RCVD_IN_IADB_SENDERID 2708 3.44 1.75 4.25 163 SUBJ_ALL_CAPS 2672 1.78 1.72 1.80 164 XM_Body_Dirty_Words_01 2665 1.05 1.72 0.73 165 T_XMHurry_00 2655 0.86 1.71 0.45 166 TR_LOTS_OF_MONEY1 2604 0.56 1.68 0.02 167 HTTPS_HTTP_MISMATCH 2590 1.10 1.67 0.82 168 BAYES_40 2578 3.97 1.66 5.09 169 USER_IN_DEF_DKIM_WL 2556 8.66 1.65 12.04 170 MAILING_LIST_MULTI 2549 2.20 1.65 2.47 171 XMSubPhish11 2517 1.87 1.62 1.99 172 XMBdyGiftCard01 2350 1.07 1.52 0.86 173 FROM_EXCESS_BASE64 2321 2.17 1.50 2.49 174 TR_XM_BayesRelay 2241 0.47 1.45 0.00 175 RELAYCOUNTRY_RU 2223 0.48 1.44 0.02 176 XM_UB60 2155 0.52 1.39 0.10 177 HTML_FONT_TINY_NORDNS 2148 0.51 1.39 0.08 178 XM_URI_RBL 2125 0.52 1.37 0.11 179 XMHTML_After_End 2068 0.92 1.34 0.72 180 XMReplyNow 2066 0.62 1.33 0.28 181 DETAILS_OF_PRODUCT 2063 0.43 1.33 0.00 182 URI_HEX 2058 1.31 1.33 1.30 183 JH_SPAMMY_HEADERS 2046 0.43 1.32 0.00 184 RCVD_IN_IADB_VOUCHED 1977 2.66 1.28 3.33 185 TR_Symld_Words 1965 1.34 1.27 1.38 186 RELAYCOUNTRY_AU 1926 0.60 1.24 0.29 187 TM2_M_A_HREF_HREF 1898 0.87 1.23 0.70 188 XM_H_Long_From02 1870 0.95 1.21 0.83 189 MPART_ALT_DIFF_COUNT 1867 0.80 1.21 0.61 190 XMSubMetaSxObfu_03 1861 0.99 1.20 0.89 191 BAYES_20 1849 3.28 1.19 4.29 192 TR_XM_FormFill 1842 0.39 1.19 0.01 193 URIBL_BLACK 1781 0.40 1.15 0.04 194 TR_XM_MaxSPIKE 1740 0.44 1.12 0.12 195 HTML_FONT_FACE_BAD 1713 1.49 1.11 1.67 196 HTML_IMAGE_ONLY_08 1708 0.43 1.10 0.10 197 LONG_JUNK_URI2 1667 0.38 1.08 0.04 198 XMGenDplmaNmb 1659 0.78 1.07 0.64 199 HK_RANDOM_REPLYTO 1654 0.38 1.07 0.06 200 XMPhish30 1629 0.83 1.05 0.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271630 87.78 94.92 84.34 2 RELAYCOUNTRY_US 260241 79.35 76.32 80.81 3 DKIM_SIGNED 234473 75.16 80.06 72.81 4 XM_DK_Pass 230073 73.61 78.13 71.44 5 DKIM_VALID 227578 72.84 77.36 70.66 6 XM_B_Unicode 223981 72.71 79.27 69.55 7 DCC_CHECK_NEGATIVE 215963 56.14 33.45 67.06 8 BAYES_50 178315 52.45 46.37 55.37 9 DKIM_VALID_AU 169382 54.59 58.73 52.59 10 XMListUnsubscribeExists 149953 52.22 63.99 46.56 11 XM_B_SpammyWords 146420 52.81 68.09 45.46 12 XM_B_Unicode3 137248 42.18 41.28 42.62 13 DCC_CHECK 105987 43.82 66.51 32.91 14 RCVD_IN_MSPIKE_WL 93673 26.28 20.44 29.09 15 T_TM2_M_HEADER_IN_MSG 85033 24.59 20.83 26.40 16 HTML_FONT_LOW_CONTRAST 82971 27.02 29.62 25.76 17 DKIM_VALID_EF 79397 24.97 25.62 24.65 18 FVGT_m_MULTI_ODD 73976 26.34 33.35 22.97 19 LOC_TINY_FONT_1 72776 25.77 32.38 22.60 20 MIME_HTML_ONLY 70797 24.57 29.94 21.98 21 RCVD_IN_MSPIKE_H2 69395 21.90 22.64 21.55 22 XMSubLong 65935 20.49 20.52 20.47 23 T_KAM_HTML_FONT_INVALID 62287 22.27 28.37 19.34 24 XM_B_SpammyWords2 61586 24.92 36.98 19.12 25 RCVD_IN_MSPIKE_H3 53996 15.94 14.21 16.77 26 ALL_TRUSTED 52563 11.95 2.86 16.32 27 XM_Body_Dirty_Words 40027 15.37 21.48 12.43 28 USER_IN_DEF_DKIM_WL 38765 8.66 1.65 12.04 29 XM_Multi_Part_URI 37970 13.07 15.74 11.79 30 RCVD_IN_MSPIKE_H4 34246 9.11 5.95 10.63 31 XM_B_Unsub 32881 11.98 15.67 10.21 32 BAYES_60 32830 9.25 7.29 10.19 33 BAYES_00 30274 6.57 0.68 9.40 34 LOTS_OF_MONEY 29257 11.38 16.15 9.08 35 LotsOfNums_01 28986 8.74 8.20 9.00 36 XM_DKIMWhitelistDomains 27641 5.81 0.05 8.58 37 MIME_QP_LONG_LINE 27299 9.53 11.73 8.48 38 XM_Evil_Numbers_Gen 25702 7.77 7.34 7.98 39 UNPARSEABLE_RELAY 23578 9.06 12.68 7.32 40 TooManyTo_001 22934 6.09 3.95 7.12 41 MPART_ALT_DIFF 21934 8.33 11.49 6.81 42 HTML_IMAGE_RATIO_04 21531 6.01 4.60 6.69 43 XM_DK_Undo_02 21445 17.55 40.21 6.66 44 TM2_M_URI_OPT_OUT 20615 8.07 11.53 6.40 45 IN_ZIMBRA_NJ_WHITELIST 20542 4.34 0.10 6.38 46 T_TooManySym_01 19595 4.88 2.39 6.08 47 TR_XM_SpammyWords4 19324 8.75 14.47 6.00 48 BAYES_99 19124 13.96 30.62 5.94 49 TR_XM_UnparsRelay 18920 7.98 12.37 5.87 50 HTML_IMAGE_RATIO_02 18674 6.46 7.82 5.80 51 XM_H_Long_From01 18132 5.82 6.21 5.63 52 TR_XM_DK_Bayes 17928 3.91 0.47 5.57 53 TR_XM_DK_Bayes1 17605 3.84 0.46 5.47 54 RCVD_IN_IADB_LISTED 17000 4.30 2.28 5.28 55 ANY_BOUNCE_MESSAGE 16951 5.08 4.71 5.26 56 BOUNCE_MESSAGE 16951 5.08 4.71 5.26 57 BAYES_40 16380 3.97 1.66 5.09 58 XM_SendGrid 16019 5.62 6.95 4.97 59 MIME_HTML_ONLY_MULTI 15869 5.34 6.19 4.93 60 BAYES_999 15817 11.15 24.13 4.91 61 BOTNET_IPINHOSTNAME 15182 7.19 12.33 4.71 62 XM_H_Trusted_IP 15154 3.18 0.00 4.71 63 RCVD_IN_IADB_SPF 15074 3.80 1.96 4.68 64 TR_XM_DK_Bayes2 15017 3.26 0.35 4.66 65 TR_XM_DKIM_Undo 14895 13.42 31.70 4.63 66 BAYES_80 14261 5.37 7.32 4.43 67 BAYES_20 13801 3.28 1.19 4.29 68 RCVD_IN_IADB_SENDERID 13682 3.44 1.75 4.25 69 RCVD_IN_VALIDITY_SAFE 13653 3.88 3.12 4.24 70 RCVD_IN_IADB_DK 13147 3.34 1.79 4.08 71 XMStrtUSub 13129 3.80 3.24 4.08 72 XMSexyCombo_05 13084 6.40 11.27 4.06 73 RELAYCOUNTRY_META 12779 10.05 22.70 3.97 74 XMSubMetaSx_00 12535 4.78 6.62 3.89 75 XM_B_SpammyWords3 12412 7.27 14.36 3.85 76 FSL_BULK_SIG 12403 7.14 13.99 3.85 77 XM_PDF 12253 2.77 0.61 3.80 78 RCVD_IN_VALIDITY_CERTIFIED 12246 3.45 2.72 3.80 79 XM_UncommonTLD01 12161 6.33 11.64 3.78 80 XM_B_Phish_Phrases 11674 4.59 6.59 3.62 81 XMNumbers 11571 3.62 3.68 3.59 82 HTML_IMAGE_RATIO_06 11264 3.49 3.47 3.50 83 T_REMOTE_IMAGE 11246 3.45 3.36 3.49 84 HTML_MIME_NO_HTML_TAG 11174 4.33 6.12 3.47 85 T_HTML_ATTACH 11001 2.34 0.11 3.42 86 RCVD_IN_IADB_VOUCHED 10716 2.66 1.28 3.33 87 T_TooManySym_02 10374 2.37 0.61 3.22 88 TR_XM_DK_SendGrid 9952 3.42 4.10 3.09 89 TR_XM_PhishingBody 9831 5.03 9.13 3.05 90 BAYES_95 8942 3.24 4.19 2.78 91 BAYES_05 8120 1.91 0.65 2.52 92 FROM_EXCESS_BASE64 8019 2.17 1.50 2.49 93 MAILING_LIST_MULTI 7955 2.20 1.65 2.47 94 URI_NOVOWEL 7928 3.10 4.44 2.46 95 TM2_M_VERY_LONG_WORD 7658 3.76 6.62 2.38 96 HTML_IMAGE_RATIO_08 7525 2.21 1.96 2.34 97 XM_GoogleGroups 7371 2.90 4.17 2.29 98 XM_B_SpammyTLD 7142 3.32 5.62 2.22 99 MIME_HTML_MOSTLY 7052 3.34 5.73 2.19 100 DKIM_INVALID 6895 2.32 2.71 2.14 101 INVALID_MSGID 6873 1.48 0.12 2.13 102 RCVD_IN_IADB_OPTIN 6789 1.68 0.79 2.11 103 XM_CamelCaseFrm001 6691 2.15 2.29 2.08 104 T_XMDrugObfuBody_14 6575 2.78 4.31 2.04 105 TR_XM_SB_Phish 6473 1.95 1.84 2.01 106 XMSubPhish11 6419 1.87 1.62 1.99 107 XM_SPF_SoftFail 6400 2.50 3.57 1.99 108 TVD_RCVD_IP 6164 1.33 0.13 1.91 109 XMLngstWrd_00 5839 3.19 6.05 1.81 110 IN_HORDE_ADDRESS_BOOK 5828 1.27 0.16 1.81 111 TooManyTo_002 5823 1.40 0.56 1.81 112 SUBJ_ALL_CAPS 5803 1.78 1.72 1.80 113 TO_MALFORMED 5773 1.23 0.05 1.79 114 XMLngstWrd_01 5600 3.04 5.76 1.74 115 XMStockSpam_06 5573 1.78 1.89 1.73 116 TR_XM_SpammyRelay 5517 4.82 11.28 1.71 117 TR_DCC_Bayes_99 5469 8.05 21.26 1.70 118 RCVD_IN_MSPIKE_H5 5431 1.23 0.28 1.69 119 HTML_FONT_FACE_BAD 5376 1.49 1.11 1.67 120 XMLngstWrd_02 5355 2.71 4.88 1.66 121 KHOP_HELO_FCRDNS 5063 2.47 4.32 1.57 122 HELO_NO_DOMAIN 4955 2.92 5.80 1.54 123 HELO_NODOT 4955 2.93 5.81 1.54 124 XMGappySubj_01 4953 1.07 0.10 1.54 125 UNTRUSTED_Relay 4888 5.94 15.12 1.52 126 XM_DK_Undo_01 4697 1.79 2.48 1.46 127 XM_B_Investor 4676 2.51 4.72 1.45 128 BOTNET 4638 4.49 10.82 1.44 129 XM_B_Phish66 4617 3.03 6.34 1.43 130 TR_XM_SpammyWords5 4534 1.91 2.95 1.41 131 XMSubNoVowel 4514 1.20 0.79 1.40 132 TR_Symld_Words 4441 1.34 1.27 1.38 133 XMLngstWrd_03 4340 2.16 3.84 1.35 134 RCVD_IN_MSPIKE_BL 4323 4.03 9.60 1.34 135 TR_XM_MSPIKECOMBO 4321 3.22 7.12 1.34 136 T_XMDrugObfuBody_08 4247 2.01 3.44 1.32 137 URI_HEX 4178 1.31 1.33 1.30 138 XMLngstWrd_04 4130 2.02 3.56 1.28 139 XM_ProductURIs 3942 1.14 0.96 1.22 140 XM_B_Unsub2 3920 2.20 4.25 1.22 141 TooManyTo_003 3801 0.95 0.46 1.18 142 XMSexyCombo_01 3728 1.39 1.88 1.16 143 HTML_TITLE_SUBJ_DIFF 3723 1.91 3.48 1.16 144 XMBSHREFv2 3711 0.83 0.17 1.15 145 UPPERCASE_75_100 3672 1.89 3.44 1.14 146 T_XMDrugObfuBody_00 3628 1.40 1.95 1.13 147 XMDiploma_00 3527 1.55 2.51 1.10 148 TR_XM_MaxUnsub 3451 2.58 5.72 1.07 149 XM_UB50 3325 3.74 9.38 1.03 150 TVD_SPACE_RATIO 3270 0.82 0.42 1.02 151 TR_XM_SpammyWords2 3126 3.87 9.90 0.97 152 RELAYCOUNTRY_CA 2948 2.52 5.85 0.92 153 XMCapTrack 2882 0.69 0.25 0.89 154 XMSubMetaSxObfu_03 2873 0.99 1.20 0.89 155 RCVD_IN_MSPIKE_L3 2856 1.58 3.03 0.89 156 TR_MetaPhish_Combo_01 2834 0.84 0.75 0.88 157 XM_OfRef6 2822 1.83 3.83 0.88 158 XM_B_COPY_HTML 2803 0.81 0.70 0.87 159 RCVD_IN_RP_SAFE 2788 0.77 0.58 0.87 160 XMBdyGiftCard01 2770 1.07 1.52 0.86 161 XM_D_tchamptons_WL 2702 0.57 0.00 0.84 162 XM_H_Long_From02 2683 0.95 1.21 0.83 163 HTML_IMAGE_ONLY_20 2676 0.64 0.25 0.83 164 TooManyTo_004 2658 0.69 0.42 0.83 165 DKIM_ADSP_CUSTOM_MED 2646 0.80 0.75 0.82 166 HTTPS_HTTP_MISMATCH 2634 1.10 1.67 0.82 167 RCVD_IN_RP_CERTIFIED 2509 0.68 0.48 0.78 168 RELAYCOUNTRY_GB 2449 0.78 0.81 0.76 169 T_TooManySym_03 2423 0.59 0.26 0.75 170 XMBody_95 2390 0.56 0.17 0.74 171 XMPhish30 2346 0.83 1.05 0.73 172 XM_Body_Dirty_Words_01 2345 1.05 1.72 0.73 173 MSGID_NOFQDN1 2340 0.49 0.01 0.73 174 MY_SERVERS_FOUND 2327 0.63 0.44 0.72 175 XMHTML_After_End 2324 0.92 1.34 0.72 176 SpammyFromTLD_01 2281 2.69 6.81 0.71 177 XMSexyCombo_04 2251 0.77 0.92 0.70 178 TM2_M_A_HREF_HREF 2247 0.87 1.23 0.70 179 RCVD_IN_BL_SPAMCOP_NET 2209 3.75 10.12 0.69 180 FROM_GOV_DKIM_AU 2197 0.53 0.22 0.68 181 URI_TRY_3LD 2190 0.70 0.76 0.68 182 XMSubMetaSx_01 2188 0.54 0.24 0.68 183 TR_LOTS_OF_MONEY3 2151 2.23 5.47 0.67 184 LOW_PRICE 2122 0.50 0.18 0.66 185 XM_ShortIntro_01 2106 1.58 3.49 0.65 186 TooManyTo_005 2101 0.54 0.31 0.65 187 XMGenDplmaNmb 2051 0.78 1.07 0.64 188 XM_H_PHPMailer 2044 0.62 0.59 0.63 189 MISSING_HEADERS 2018 2.26 5.65 0.63 190 XMPhish14 1999 0.68 0.82 0.62 191 HTML_TAG_BALANCE_BODY 1985 0.75 1.02 0.62 192 SpammyFromTLD_02 1984 1.24 2.55 0.62 193 XM_B_COVIDMETA 1971 1.33 2.82 0.61 194 MPART_ALT_DIFF_COUNT 1967 0.80 1.21 0.61 195 T_FILL_THIS_FORM_SHORT 1949 1.18 2.38 0.61 196 XM_B_SpammyWords4 1946 2.09 5.18 0.60 197 XMBrknScrpt_02 1901 0.70 0.92 0.59 198 XMSexyCombo_02 1787 0.44 0.21 0.55 199 TR_XM_SpammyWords3 1785 1.71 4.11 0.55 200 MIME_HEADER_CTYPE_ONLY 1771 0.52 0.45 0.55 ----------------------------------------------------------------------