Email: 514370 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.25 sec Spam: 165028 Autolearn: 0 AvgScore: 14.14 AvgScanTime: 1.36 sec Ham: 349342 Autolearn: 0 AvgScore: -1.35 AvgScanTime: 1.19 sec Time Spent Running SA: 178.34 hours Time Spent Processing Spam: 62.47 hours Time Spent Processing Ham: 115.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156699 88.91 94.95 86.06 2 DKIM_SIGNED 140438 75.90 85.10 71.56 3 XM_DK_Pass 137587 74.61 83.37 70.47 4 DKIM_VALID 136444 73.75 82.68 69.54 5 RELAYCOUNTRY_US 131380 78.89 79.61 78.55 6 XM_B_Unicode 126573 72.17 76.70 70.03 7 DCC_CHECK 114093 43.76 69.14 31.77 8 XMListUnsubscribeExists 106666 52.53 64.64 46.81 9 XM_B_SpammyWords 103780 49.08 62.89 42.56 10 DKIM_VALID_AU 102495 55.61 62.11 52.55 11 BAYES_50 70889 53.02 42.96 57.78 12 XM_DK_Undo_02 68569 17.71 41.55 6.44 13 XM_B_Unicode3 68394 40.41 41.44 39.93 14 XM_B_SpammyWords2 59187 23.63 35.86 17.85 15 LOC_TINY_FONT_1 58921 25.89 35.70 21.25 16 FVGT_m_MULTI_ODD 57141 27.64 34.63 24.34 17 BAYES_99 53656 13.95 32.51 5.18 18 MIME_HTML_ONLY 51373 22.98 31.13 19.13 19 TR_XM_DKIM_Undo 50965 12.95 30.88 4.48 20 DCC_CHECK_NEGATIVE 50848 56.19 30.81 68.18 21 HTML_FONT_LOW_CONTRAST 49821 26.11 30.19 24.18 22 DKIM_VALID_EF 46697 26.94 28.30 26.31 23 T_KAM_HTML_FONT_INVALID 45238 21.61 27.41 18.86 24 RCVD_IN_MSPIKE_H2 44673 23.27 27.07 21.48 25 BAYES_999 42382 11.04 25.68 4.12 26 XMSubLong 39141 21.87 23.72 20.99 27 T_TM2_M_HEADER_IN_MSG 36772 26.75 22.28 28.86 28 RCVD_IN_MSPIKE_WL 36370 26.85 22.04 29.12 29 RELAYCOUNTRY_META 36358 9.64 22.03 3.78 30 TR_DCC_Bayes_99 35570 8.00 21.55 1.60 31 XM_Body_Dirty_Words 33737 13.82 20.44 10.69 32 XM_B_Unsub 27907 11.10 16.91 8.35 33 XM_Multi_Part_URI 27497 12.71 16.66 10.84 34 TR_XM_BayesUnsub 27262 9.72 16.52 6.51 35 RCVD_IN_MSPIKE_H3 24373 16.06 14.77 16.67 36 LOTS_OF_MONEY 23724 9.86 14.38 7.72 37 FSL_BULK_SIG 23127 6.69 14.01 3.23 38 UNPARSEABLE_RELAY 22445 9.49 13.60 7.54 39 TR_XM_UnparsRelay 22121 8.41 13.40 6.05 40 BOTNET_IPINHOSTNAME 21429 7.25 12.99 4.54 41 UNTRUSTED_Relay 20676 4.90 12.53 1.30 42 XM_B_SpammyWords3 19836 7.06 12.02 4.71 43 TR_XM_SpammyWords4 18790 6.85 11.39 4.71 44 RCVD_IN_BL_SPAMCOP_NET 18509 3.99 11.22 0.58 45 XM_UncommonTLD01 18403 6.03 11.15 3.61 46 MPART_ALT_DIFF 18399 6.68 11.15 4.57 47 BOTNET 18247 4.56 11.06 1.49 48 TR_XM_SpammyWords2 17349 3.89 10.51 0.76 49 XMSexyCombo_05 16799 5.62 10.18 3.46 50 TR_XM_SpammyRelay 16610 4.36 10.06 1.66 51 HTML_IMAGE_RATIO_02 13800 6.62 8.36 5.80 52 BAYES_80 13397 5.64 8.12 4.47 53 TR_XM_PhishingBody 13240 4.88 8.02 3.40 54 XM_SendGrid 13103 6.20 7.94 5.38 55 XM_Evil_Numbers_Gen 13075 7.53 7.92 7.34 56 BAYES_60 12512 8.86 7.58 9.46 57 XM_B_Phish_Phrases 12377 4.58 7.50 3.20 58 RCVD_IN_MSPIKE_BL 12339 3.32 7.48 1.35 59 TR_XM_MSPIKECOMBO 12255 3.29 7.43 1.34 60 LotsOfNums_01 12197 8.82 7.39 9.50 61 XMSubMetaSx_00 11338 4.35 6.87 3.16 62 RCVD_IN_MSPIKE_H4 11155 9.64 6.76 11.00 63 MIME_HTML_MOSTLY 10981 3.64 6.65 2.22 64 SpammyFromTLD_01 10780 2.58 6.53 0.71 65 XM_B_SpammyTLD 10565 6.14 6.40 6.02 66 TM2_M_VERY_LONG_WORD 9925 2.88 6.01 1.41 67 XM_UB50 9869 2.53 5.98 0.89 68 HTML_MIME_NO_HTML_TAG 9743 3.35 5.90 2.15 69 RELAYCOUNTRY_CA 9462 2.60 5.73 1.11 70 URI_NOVOWEL 9447 3.58 5.72 2.57 71 XM_H_Long_From01 8969 5.21 5.43 5.10 72 TR_XM_SPAMCOP 8693 1.82 5.27 0.19 73 TR_XM_DK_SendGrid 8677 3.99 5.26 3.40 74 XM_B_Phish66 8518 3.01 5.16 2.00 75 MIME_HTML_ONLY_MULTI 8075 3.42 4.89 2.73 76 BAYES_95 7672 3.35 4.65 2.74 77 XM_B_Investor 7667 2.63 4.65 1.67 78 TR_XM_SpammyWords3 7265 1.78 4.40 0.55 79 RCVD_IN_VALIDITY_RPBL 7174 1.40 4.35 0.01 80 TooManyTo_001 7079 6.80 4.29 7.99 81 T_XMDrugObfuBody_14 6915 2.93 4.19 2.33 82 XM_SPF_SoftFail 6852 2.91 4.15 2.32 83 HTML_IMAGE_RATIO_04 6826 4.58 4.14 4.79 84 RELAYCOUNTRY_FR 6793 1.46 4.12 0.21 85 RCVD_IN_MSPIKE_L5 6498 1.29 3.94 0.03 86 XM_OfRef6 6235 1.86 3.78 0.96 87 HTML_IMAGE_RATIO_06 5888 3.65 3.57 3.69 88 T_REMOTE_IMAGE 5777 3.62 3.50 3.68 89 XM_DIRTYINTL 5682 1.33 3.44 0.34 90 KHOP_HELO_FCRDNS 5675 2.28 3.44 1.74 91 URIBL_DBL_SPAM 5534 1.09 3.35 0.02 92 T_XMDrugObfuBody_08 5429 2.10 3.29 1.54 93 XMLngstWrd_00 5391 1.37 3.27 0.48 94 PDS_OTHER_BAD_TLD 5340 1.17 3.24 0.20 95 XMNumbers 5291 3.36 3.21 3.44 96 XMStrtUSub 5275 3.67 3.20 3.90 97 XMLngstWrd_01 5195 1.28 3.15 0.40 98 RCVD_IN_MSPIKE_L3 5097 1.82 3.09 1.23 99 XM_GoogleGroups 5023 1.80 3.04 1.21 100 XMLngstWrd_02 4972 1.20 3.01 0.34 101 RCVD_IN_VALIDITY_SAFE 4950 3.82 3.00 4.21 102 MIME_QP_LONG_LINE 4742 4.91 2.87 5.87 103 XM_B_Unsub2 4733 1.80 2.87 1.30 104 XM_DK_Undo_01 4677 1.95 2.83 1.53 105 TR_XM_SpammyWords5 4650 1.84 2.82 1.37 106 URI_NO_WWW_BIZ_CGI 4509 0.88 2.73 0.01 107 XMLngstWrd_03 4500 1.05 2.73 0.26 108 TM2_M_URI_OPT_OUT 4419 2.60 2.68 2.57 109 XMLngstWrd_04 4318 0.97 2.62 0.19 110 RCVD_IN_VALIDITY_CERTIFIED 4246 3.41 2.57 3.80 111 HTML_TITLE_SUBJ_DIFF 4223 0.84 2.56 0.03 112 RCVD_IN_PSBL 4191 0.90 2.54 0.12 113 UPPERCASE_75_100 4182 0.83 2.53 0.02 114 XMDiploma_00 4168 1.77 2.53 1.41 115 T_TooManySym_01 4110 4.69 2.49 5.73 116 DKIM_INVALID 3994 2.15 2.42 2.02 117 ANY_BOUNCE_MESSAGE 3921 2.91 2.38 3.16 118 BOUNCE_MESSAGE 3919 2.90 2.37 3.16 119 ALL_TRUSTED 3912 13.43 2.37 18.66 120 XM_CamelCaseFrm001 3882 1.98 2.35 1.81 121 HTML_IMAGE_RATIO_08 3818 1.98 2.31 1.83 122 T_FILL_THIS_FORM_SHORT 3796 1.35 2.30 0.90 123 SpammyFromTLD_02 3675 1.01 2.23 0.44 124 URI_PHP_REDIR 3588 0.70 2.17 0.00 125 SUBJ_ALL_CAPS 3584 1.78 2.17 1.60 126 TR_XM_MSPIKECOMBO2 3575 0.86 2.17 0.24 127 URI_HEX 3555 1.53 2.15 1.23 128 TR_Mismatch_TLD_01 3528 0.85 2.14 0.25 129 RCVD_IN_IADB_LISTED 3504 4.42 2.12 5.51 130 XM_B_SpammyWords4 3426 1.16 2.08 0.73 131 JH_SPAMMY_HEADERS 3419 0.67 2.07 0.00 132 XM_B_COVIDMETA 3298 1.03 2.00 0.57 133 BOTNET_NORDNS 3241 0.64 1.96 0.01 134 XM_B_Crypto 3228 1.05 1.96 0.62 135 TR_XM_SB_Phish 3209 2.05 1.94 2.10 136 USER_IN_DEF_DKIM_WL 3170 8.30 1.92 11.31 137 TR_LOTS_OF_MONEY3 3165 0.89 1.92 0.40 138 XMSexyCombo_01 3125 0.89 1.89 0.42 139 XM_UB60 3104 0.65 1.88 0.07 140 XM_UB99 3103 0.61 1.88 0.01 141 URI_OPTOUT_3LD 3081 0.73 1.87 0.19 142 T_XMDrugObfuBody_00 3040 1.09 1.84 0.73 143 XMSubPhish11 3015 1.97 1.83 2.04 144 MAILING_LIST_MULTI 3012 2.46 1.83 2.77 145 HK_RANDOM_REPLYTO 2919 0.66 1.77 0.13 146 XMBody_17 2873 0.85 1.74 0.42 147 RCVD_IN_IADB_SPF 2872 3.91 1.74 4.94 148 XMHTML_After_End 2857 1.03 1.73 0.71 149 FROM_EXCESS_BASE64 2796 2.03 1.69 2.18 150 BAYES_40 2706 3.77 1.64 4.78 151 XMBrknScrpt_02 2702 1.05 1.64 0.78 152 TR_Symld_Words 2658 1.59 1.61 1.57 153 XMGenDplmaNmb 2630 1.02 1.59 0.74 154 RELAYCOUNTRY_RU 2597 0.53 1.57 0.03 155 RCVD_IN_IADB_DK 2585 3.45 1.57 4.34 156 HTTPS_HTTP_MISMATCH 2500 0.93 1.51 0.65 157 RCVD_IN_IADB_SENDERID 2491 3.53 1.51 4.48 158 XM_H_PHPMailer 2486 0.90 1.51 0.62 159 TR_XM_MaxSPIKE 2476 0.63 1.50 0.22 160 XM_H_Undi_Recip 2440 0.67 1.48 0.29 161 XM_UB80 2428 0.48 1.47 0.02 162 HTML_FONT_FACE_BAD 2422 1.16 1.47 1.02 163 BAYES_20 2395 3.00 1.45 3.74 164 XM_URI_RBL 2359 0.53 1.43 0.10 165 TR_XM_PHPDW 2336 0.75 1.42 0.44 166 TR_XM_PHPForged 2290 0.70 1.39 0.37 167 TR_XM_COVIDMETA1 2286 0.58 1.39 0.20 168 RCVD_IN_IADB_VOUCHED 2251 2.64 1.36 3.24 169 TR_XM_FormFill2 2233 0.69 1.35 0.37 170 XM_H_PHPOS 2220 0.68 1.35 0.36 171 XM_UB999 2218 0.43 1.34 0.00 172 XMBdyGiftCard01 2200 0.99 1.33 0.82 173 XMStockSpam_06 2200 1.24 1.33 1.19 174 XM_B_SEO 2196 0.54 1.33 0.16 175 TR_XM_COVIDMETA4 2187 0.58 1.33 0.23 176 T_XMHurry_00 2134 0.80 1.29 0.57 177 HOSTED_IMG_DIRECT_MX 2119 0.41 1.28 0.00 178 URI_LONG_REPEAT 2102 0.41 1.27 0.00 179 RELAYCOUNTRY_AU 2065 0.62 1.25 0.33 180 TR_XM_PhishingBody2 2043 0.43 1.24 0.04 181 TM2_M_A_HREF_HREF 2006 0.58 1.22 0.28 182 HTML_FONT_SIZE_LARGE 2006 0.46 1.22 0.10 183 TR_XM_BayesRelay 2001 0.39 1.21 0.00 184 XM_H_Long_From02 1996 1.31 1.21 1.36 185 RELAYCOUNTRY_IN 1992 0.44 1.21 0.08 186 TR_XM_NoHeaderRelay 1986 0.48 1.20 0.14 187 BODY_URI_ONLY 1982 0.40 1.20 0.02 188 RELAYCOUNTRY_DE 1928 0.58 1.17 0.31 189 TR_XM_SEO4 1912 0.44 1.16 0.10 190 TR_XM_FormFill 1911 0.38 1.16 0.01 191 HTML_TAG_BALANCE_BODY 1895 0.91 1.15 0.80 192 XMPhish30 1873 0.77 1.13 0.59 193 DIET_1 1862 0.58 1.13 0.32 194 HTML_IMAGE_ONLY_08 1860 0.44 1.13 0.12 195 URIBL_BLACK 1856 0.40 1.12 0.05 196 XM_B_DNDMA 1841 0.69 1.12 0.49 197 URI_TRY_3LD 1791 0.70 1.09 0.52 198 TR_BOTNET_NEGATE 1754 0.57 1.06 0.34 199 TR_XM_SpoofStaff 1710 0.40 1.04 0.10 200 XMSpoofStaff2 1701 0.40 1.03 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 300645 88.91 94.95 86.06 2 RELAYCOUNTRY_US 274404 78.89 79.61 78.55 3 DKIM_SIGNED 249984 75.90 85.10 71.56 4 XM_DK_Pass 246170 74.61 83.37 70.47 5 XM_B_Unicode 244636 72.17 76.70 70.03 6 DKIM_VALID 242917 73.75 82.68 69.54 7 DCC_CHECK_NEGATIVE 238174 56.19 30.81 68.18 8 BAYES_50 201854 53.02 42.96 57.78 9 DKIM_VALID_AU 183567 55.61 62.11 52.55 10 XMListUnsubscribeExists 163529 52.53 64.64 46.81 11 XM_B_SpammyWords 148696 49.08 62.89 42.56 12 XM_B_Unicode3 139476 40.41 41.44 39.93 13 DCC_CHECK 110995 43.76 69.14 31.77 14 RCVD_IN_MSPIKE_WL 101729 26.85 22.04 29.12 15 T_TM2_M_HEADER_IN_MSG 100822 26.75 22.28 28.86 16 DKIM_VALID_EF 91899 26.94 28.30 26.31 17 FVGT_m_MULTI_ODD 85013 27.64 34.63 24.34 18 HTML_FONT_LOW_CONTRAST 84479 26.11 30.19 24.18 19 RCVD_IN_MSPIKE_H2 75036 23.27 27.07 21.48 20 LOC_TINY_FONT_1 74233 25.89 35.70 21.25 21 XMSubLong 73334 21.87 23.72 20.99 22 MIME_HTML_ONLY 66846 22.98 31.13 19.13 23 T_KAM_HTML_FONT_INVALID 65898 21.61 27.41 18.86 24 ALL_TRUSTED 65193 13.43 2.37 18.66 25 XM_B_SpammyWords2 62359 23.63 35.86 17.85 26 RCVD_IN_MSPIKE_H3 58236 16.06 14.77 16.67 27 USER_IN_DEF_DKIM_WL 39502 8.30 1.92 11.31 28 RCVD_IN_MSPIKE_H4 38437 9.64 6.76 11.00 29 XM_Multi_Part_URI 37858 12.71 16.66 10.84 30 XM_Body_Dirty_Words 37346 13.82 20.44 10.69 31 LotsOfNums_01 33181 8.82 7.39 9.50 32 BAYES_60 33051 8.86 7.58 9.46 33 BAYES_00 32988 6.60 0.58 9.44 34 XM_B_Unsub 29180 11.10 16.91 8.35 35 TooManyTo_001 27921 6.80 4.29 7.99 36 XM_DKIMWhitelistDomains 27192 5.31 0.07 7.78 37 LOTS_OF_MONEY 26983 9.86 14.38 7.72 38 UNPARSEABLE_RELAY 26356 9.49 13.60 7.54 39 XM_Evil_Numbers_Gen 25635 7.53 7.92 7.34 40 IN_ZIMBRA_NJ_WHITELIST 24357 4.77 0.11 6.97 41 TR_XM_BayesUnsub 22737 9.72 16.52 6.51 42 XM_DK_Undo_02 22501 17.71 41.55 6.44 43 TR_XM_UnparsRelay 21133 8.41 13.40 6.05 44 XM_B_SpammyTLD 21042 6.14 6.40 6.02 45 MIME_QP_LONG_LINE 20518 4.91 2.87 5.87 46 TR_XM_DK_Bayes 20347 4.10 0.44 5.82 47 HTML_IMAGE_RATIO_02 20252 6.62 8.36 5.80 48 T_TooManySym_01 20009 4.69 2.49 5.73 49 TR_XM_DK_Bayes1 19945 4.02 0.43 5.71 50 RCVD_IN_IADB_LISTED 19244 4.42 2.12 5.51 51 XM_SendGrid 18808 6.20 7.94 5.38 52 BAYES_99 18102 13.95 32.51 5.18 53 XM_H_Long_From01 17829 5.21 5.43 5.10 54 RCVD_IN_IADB_SPF 17255 3.91 1.74 4.94 55 TR_XM_DK_Bayes2 16968 3.41 0.34 4.86 56 HTML_IMAGE_RATIO_04 16727 4.58 4.14 4.79 57 BAYES_40 16711 3.77 1.64 4.78 58 XM_PDF 16502 3.49 0.88 4.72 59 TR_XM_SpammyWords4 16465 6.85 11.39 4.71 60 XM_B_SpammyWords3 16458 7.06 12.02 4.71 61 MPART_ALT_DIFF 15968 6.68 11.15 4.57 62 BOTNET_IPINHOSTNAME 15867 7.25 12.99 4.54 63 RCVD_IN_IADB_SENDERID 15659 3.53 1.51 4.48 64 TR_XM_DKIM_Undo 15638 12.95 30.88 4.48 65 BAYES_80 15619 5.64 8.12 4.47 66 RCVD_IN_IADB_DK 15154 3.45 1.57 4.34 67 RCVD_IN_VALIDITY_SAFE 14714 3.82 3.00 4.21 68 BAYES_999 14398 11.04 25.68 4.12 69 XMStrtUSub 13614 3.67 3.20 3.90 70 RCVD_IN_VALIDITY_CERTIFIED 13291 3.41 2.57 3.80 71 RELAYCOUNTRY_META 13215 9.64 22.03 3.78 72 BAYES_20 13048 3.00 1.45 3.74 73 HTML_IMAGE_RATIO_06 12903 3.65 3.57 3.69 74 T_REMOTE_IMAGE 12865 3.62 3.50 3.68 75 XM_UncommonTLD01 12618 6.03 11.15 3.61 76 XMSexyCombo_05 12099 5.62 10.18 3.46 77 XMNumbers 12003 3.36 3.21 3.44 78 TR_XM_PhishingBody 11886 4.88 8.02 3.40 79 TR_XM_DK_SendGrid 11872 3.99 5.26 3.40 80 T_TooManySym_02 11360 2.46 0.78 3.25 81 RCVD_IN_IADB_VOUCHED 11320 2.64 1.36 3.24 82 FSL_BULK_SIG 11295 6.69 14.01 3.23 83 XM_B_Phish_Phrases 11170 4.58 7.50 3.20 84 XMSubMetaSx_00 11046 4.35 6.87 3.16 85 ANY_BOUNCE_MESSAGE 11027 2.91 2.38 3.16 86 BOUNCE_MESSAGE 11023 2.90 2.37 3.16 87 MAILING_LIST_MULTI 9661 2.46 1.83 2.77 88 BAYES_95 9574 3.35 4.65 2.74 89 XM_H_Trusted_IP 9541 1.85 0.00 2.73 90 MIME_HTML_ONLY_MULTI 9521 3.42 4.89 2.73 91 URI_NOVOWEL 8993 3.58 5.72 2.57 92 TM2_M_URI_OPT_OUT 8977 2.60 2.68 2.57 93 BAYES_05 8393 1.80 0.51 2.40 94 T_XMDrugObfuBody_14 8150 2.93 4.19 2.33 95 XM_SPF_SoftFail 8120 2.91 4.15 2.32 96 TooManyTo_002 7763 1.73 0.67 2.22 97 MIME_HTML_MOSTLY 7741 3.64 6.65 2.22 98 FROM_EXCESS_BASE64 7631 2.03 1.69 2.18 99 RCVD_IN_IADB_OPTIN 7623 1.74 0.82 2.18 100 HTML_MIME_NO_HTML_TAG 7513 3.35 5.90 2.15 101 TVD_RCVD_IP 7390 1.51 0.24 2.12 102 TR_XM_SB_Phish 7336 2.05 1.94 2.10 103 XMSubPhish11 7119 1.97 1.83 2.04 104 DKIM_INVALID 7067 2.15 2.42 2.02 105 XM_B_Phish66 6970 3.01 5.16 2.00 106 INVALID_MSGID 6887 1.42 0.24 1.97 107 HTML_IMAGE_RATIO_08 6384 1.98 2.31 1.83 108 HELO_NO_DOMAIN 6371 1.50 0.82 1.82 109 HELO_NODOT 6371 1.50 0.82 1.82 110 XM_CamelCaseFrm001 6310 1.98 2.35 1.81 111 IN_HORDE_ADDRESS_BOOK 6300 1.29 0.19 1.80 112 KHOP_HELO_FCRDNS 6071 2.28 3.44 1.74 113 XM_B_Investor 5847 2.63 4.65 1.67 114 TO_MALFORMED 5842 1.14 0.01 1.67 115 TR_XM_SpammyRelay 5816 4.36 10.06 1.66 116 SUBJ_ALL_CAPS 5579 1.78 2.17 1.60 117 TR_DCC_Bayes_99 5574 8.00 21.55 1.60 118 TR_Symld_Words 5495 1.59 1.61 1.57 119 T_XMDrugObfuBody_08 5369 2.10 3.29 1.54 120 XM_DK_Undo_01 5334 1.95 2.83 1.53 121 BOTNET 5211 4.56 11.06 1.49 122 TooManyTo_003 5117 1.17 0.56 1.46 123 XMGappySubj_01 5085 1.04 0.17 1.46 124 RCVD_IN_MSPIKE_H5 5056 1.15 0.51 1.45 125 TM2_M_VERY_LONG_WORD 4911 2.88 6.01 1.41 126 XMDiploma_00 4911 1.77 2.53 1.41 127 TR_XM_SpammyWords5 4801 1.84 2.82 1.37 128 XM_H_Long_From02 4765 1.31 1.21 1.36 129 RCVD_IN_MSPIKE_BL 4718 3.32 7.48 1.35 130 TR_XM_MSPIKECOMBO 4667 3.29 7.43 1.34 131 T_HTML_ATTACH 4599 0.93 0.11 1.32 132 XM_B_Unsub2 4546 1.80 2.87 1.30 133 UNTRUSTED_Relay 4539 4.90 12.53 1.30 134 URI_HEX 4309 1.53 2.15 1.23 135 RCVD_IN_MSPIKE_L3 4282 1.82 3.09 1.23 136 XM_GoogleGroups 4228 1.80 3.04 1.21 137 XMStockSpam_06 4166 1.24 1.33 1.19 138 XMCapTrack 4056 0.96 0.54 1.16 139 XMBSHREFv2 3993 0.84 0.19 1.14 140 RELAYCOUNTRY_CA 3889 2.60 5.73 1.11 141 TooManyTo_004 3657 0.85 0.43 1.05 142 HTML_FONT_FACE_BAD 3558 1.16 1.47 1.02 143 TVD_SPACE_RATIO 3431 0.87 0.63 0.98 144 XMSubNoVowel 3413 0.88 0.66 0.98 145 XM_ProductURIs 3395 0.96 0.95 0.97 146 XM_OfRef6 3342 1.86 3.78 0.96 147 DKIM_ADSP_CUSTOM_MED 3323 0.90 0.78 0.95 148 HTML_IMAGE_ONLY_20 3158 0.85 0.74 0.90 149 T_FILL_THIS_FORM_SHORT 3142 1.35 2.30 0.90 150 XM_UB50 3125 2.53 5.98 0.89 151 RCVD_IN_RP_SAFE 3038 0.78 0.58 0.87 152 TR_MetaPhish_Combo_01 3019 0.83 0.74 0.86 153 TooManyTo_005 3019 0.69 0.32 0.86 154 XMBody_95 2968 0.64 0.19 0.85 155 XMBdyGiftCard01 2882 0.99 1.33 0.82 156 HTML_TAG_BALANCE_BODY 2806 0.91 1.15 0.80 157 RCVD_IN_RP_CERTIFIED 2770 0.69 0.48 0.79 158 XMSolicitRefs_0 2756 0.70 0.50 0.79 159 XMBrknScrpt_02 2713 1.05 1.64 0.78 160 T_TooManySym_03 2710 0.62 0.28 0.78 161 TR_XM_SpammyWords2 2639 3.89 10.51 0.76 162 XMGenDplmaNmb 2599 1.02 1.59 0.74 163 T_XMDrugObfuBody_00 2553 1.09 1.84 0.73 164 FROM_GOV_DKIM_AU 2546 0.53 0.12 0.73 165 XM_B_SpammyWords4 2545 1.16 2.08 0.73 166 RELAYCOUNTRY_GB 2535 0.74 0.78 0.73 167 SpammyFromTLD_01 2496 2.58 6.53 0.71 168 XMHTML_After_End 2466 1.03 1.73 0.71 169 MSGID_NOFQDN1 2332 0.46 0.02 0.67 170 HTTPS_HTTP_MISMATCH 2267 0.93 1.51 0.65 171 XM_B_COPY_HTML 2266 0.69 0.76 0.65 172 XM_RXBody 2256 0.54 0.31 0.65 173 XMNoVowels 2216 0.50 0.22 0.63 174 XM_B_Crypto 2182 1.05 1.96 0.62 175 XM_H_PHPMailer 2165 0.90 1.51 0.62 176 XM_ShortIntro_01 2128 0.57 0.50 0.61 177 MPART_ALT_DIFF_COUNT 2111 0.62 0.64 0.60 178 XM_Body_Dirty_Words_01 2083 0.65 0.76 0.60 179 XMPhish30 2071 0.77 1.13 0.59 180 RCVD_IN_BL_SPAMCOP_NET 2017 3.99 11.22 0.58 181 XM_B_COVIDMETA 1996 1.03 2.00 0.57 182 NML_ADSP_CUSTOM_MED 1991 0.60 0.67 0.57 183 T_OBFU_PDF_ATTACH 1982 0.43 0.14 0.57 184 T_XMHurry_00 1975 0.80 1.29 0.57 185 FORGED_GMAIL_RCVD 1965 0.59 0.66 0.56 186 TR_XM_SpammyWords3 1915 1.78 4.40 0.55 187 XMHTMLBadTable_001 1876 0.63 0.82 0.54 188 SHORT_HELO_AND_INLINE_IMAGE 1851 0.38 0.07 0.53 189 XM_shorewaves_Whitelist 1816 0.35 0.00 0.52 190 URI_TRY_3LD 1810 0.70 1.09 0.52 191 XM_B_DNDMA 1718 0.69 1.12 0.49 192 TR_MSPIKEBAYES00 1715 0.34 0.01 0.49 193 XMLngstWrd_00 1666 1.37 3.27 0.48 194 XM_D_tchamptons_WL 1655 0.32 0.00 0.47 195 HTML_IMAGE_ONLY_32 1617 0.49 0.56 0.46 196 RCVD_IN_SORBS_DUL 1605 0.36 0.15 0.46 197 XMMoneyMeta_00 1584 0.61 0.95 0.45 198 T_Symld_Words_02 1552 0.56 0.81 0.44 199 SpammyFromTLD_02 1534 1.01 2.23 0.44 200 USER_IN_WELCOMELIST 1530 0.30 0.00 0.44 ----------------------------------------------------------------------