Email: 467909 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 1.47 sec Spam: 149848 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.63 sec Ham: 318061 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.40 sec Time Spent Running SA: 191.61 hours Time Spent Processing Spam: 67.93 hours Time Spent Processing Ham: 123.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142268 88.52 94.94 85.50 2 DKIM_SIGNED 131956 75.85 88.06 70.10 3 XM_DK_Pass 127424 73.19 85.04 67.61 4 DKIM_VALID 126161 72.31 84.19 66.71 5 RELAYCOUNTRY_US 124191 81.43 82.88 80.75 6 XM_B_Unicode 120964 73.03 80.72 69.41 7 DCC_CHECK 103396 41.89 69.00 29.12 8 XMListUnsubscribeExists 101041 52.90 67.43 46.05 9 XM_B_SpammyWords 100924 51.65 67.35 44.25 10 DKIM_VALID_AU 95182 55.61 63.52 51.88 11 RCVD_IN_MSPIKE_H2 70002 38.79 46.72 35.05 12 XM_B_Unicode3 66150 42.81 44.14 42.18 13 BAYES_50 63629 50.65 42.46 54.51 14 XM_DK_Undo_02 63201 17.90 42.18 6.46 15 XM_B_SpammyWords2 53614 23.93 35.78 18.34 16 LOC_TINY_FONT_1 52929 26.36 35.32 22.14 17 BAYES_99 51115 15.07 34.11 6.11 18 HTML_FONT_LOW_CONTRAST 50387 28.56 33.63 26.17 19 MIME_HTML_ONLY 48735 23.92 32.52 19.86 20 TR_XM_DKIM_Undo 48604 13.45 32.44 4.51 21 FVGT_m_MULTI_ODD 48443 26.64 32.33 23.97 22 DCC_CHECK_NEGATIVE 46411 58.07 30.97 70.84 23 DKIM_VALID_EF 44740 27.57 29.86 26.50 24 T_KAM_HTML_FONT_INVALID 41780 22.16 27.88 19.46 25 BAYES_999 41369 11.89 27.61 4.49 26 TR_DCC_Bayes_99 34645 8.37 23.12 1.43 27 XM_Body_Dirty_Words 32513 14.68 21.70 11.37 28 XMSubLong 32291 22.69 21.55 23.22 29 T_TM2_M_HEADER_IN_MSG 31658 27.05 21.13 29.85 30 RELAYCOUNTRY_META 29932 8.91 19.97 3.70 31 XM_Multi_Part_URI 26149 13.46 17.45 11.58 32 XM_B_Unsub 25607 11.92 17.09 9.48 33 TR_XM_BayesUnsub 24976 10.42 16.67 7.48 34 UNPARSEABLE_RELAY 23196 9.99 15.48 7.41 35 TR_XM_UnparsRelay 22853 8.82 15.25 5.79 36 LOTS_OF_MONEY 21996 11.55 14.68 10.08 37 BOTNET_IPINHOSTNAME 19602 7.47 13.08 4.82 38 XM_B_SpammyWords3 18523 6.86 12.36 4.27 39 TR_XM_SpammyWords4 18323 8.58 12.23 6.86 40 FSL_BULK_SIG 17606 5.95 11.75 3.21 41 TR_XM_SpammyRelay 17101 4.80 11.41 1.68 42 TR_XM_SpammyWords2 17074 4.19 11.39 0.79 43 XMSexyCombo_05 15910 5.99 10.62 3.80 44 BOTNET 15474 4.22 10.33 1.34 45 RCVD_IN_MSPIKE_WL 14781 12.42 9.86 13.62 46 RCVD_IN_BL_SPAMCOP_NET 14603 3.59 9.75 0.70 47 UNTRUSTED_Relay 13514 3.67 9.02 1.16 48 MPART_ALT_DIFF 13445 6.82 8.97 5.81 49 RCVD_IN_MSPIKE_H3 12620 9.31 8.42 9.73 50 LotsOfNums_01 12588 8.41 8.40 8.41 51 XM_Evil_Numbers_Gen 12495 7.96 8.34 7.78 52 BAYES_80 11623 5.36 7.76 4.22 53 XM_SendGrid 11419 5.78 7.62 4.92 54 BAYES_60 11208 8.49 7.48 8.96 55 XM_UncommonTLD01 11118 4.77 7.42 3.52 56 HTML_IMAGE_RATIO_02 10512 5.87 7.02 5.33 57 XMSubMetaSx_00 10484 4.69 7.00 3.61 58 RELAYCOUNTRY_CA 9661 2.80 6.45 1.08 59 XM_H_Long_From01 9531 5.41 6.36 4.96 60 TR_XM_SPAMCOP 9070 2.17 6.05 0.34 61 MIME_HTML_ONLY_MULTI 8874 4.75 5.92 4.21 62 TM2_M_VERY_LONG_WORD 8696 2.73 5.80 1.28 63 TR_XM_PhishingBody 8690 4.49 5.80 3.88 64 XM_B_Phish_Phrases 8386 4.07 5.60 3.35 65 HTML_MIME_NO_HTML_TAG 8313 3.01 5.55 1.82 66 T_REMOTE_IMAGE 7284 4.13 4.86 3.78 67 HTML_IMAGE_RATIO_04 7084 5.87 4.73 6.41 68 TR_XM_DK_SendGrid 7027 3.54 4.69 3.00 69 RCVD_IN_MSPIKE_BL 6950 2.28 4.64 1.17 70 TR_XM_MSPIKECOMBO 6862 2.26 4.58 1.17 71 BAYES_95 6856 3.21 4.58 2.56 72 XM_B_Investor 6826 2.18 4.56 1.06 73 TR_XM_SpammyWords5 6656 2.34 4.44 1.35 74 T_XMDrugObfuBody_14 6592 2.63 4.40 1.80 75 MIME_QP_LONG_LINE 6414 4.81 4.28 5.06 76 XM_B_SpammyTLD 6354 2.92 4.24 2.29 77 XM_UB50 6287 1.86 4.20 0.76 78 TooManyTo_001 6262 7.10 4.18 8.47 79 XMStrtUSub 6261 4.68 4.18 4.91 80 XMNumbers 6187 4.56 4.13 4.76 81 XM_OfRef6 6177 1.92 4.12 0.89 82 XMDiploma_00 6044 2.35 4.03 1.56 83 XM_SPF_SoftFail 5920 3.96 3.95 3.96 84 MIME_HTML_MOSTLY 5886 2.94 3.93 2.48 85 DKIM_INVALID 5795 3.55 3.87 3.39 86 RCVD_IN_VALIDITY_SAFE 5512 4.12 3.68 4.32 87 HTML_IMAGE_RATIO_06 5213 4.78 3.48 5.39 88 XM_B_Phish66 5178 2.83 3.46 2.54 89 URIBL_DBL_SPAM 5081 1.09 3.39 0.01 90 RCVD_IN_VALIDITY_RPBL 5056 1.10 3.37 0.02 91 XM_DIRTYINTL 4791 1.27 3.20 0.37 92 XMLngstWrd_00 4787 1.28 3.19 0.38 93 XM_GoogleGroups 4783 1.87 3.19 1.24 94 SpammyFromTLD_01 4743 1.44 3.17 0.62 95 XMLngstWrd_01 4729 1.24 3.16 0.34 96 RCVD_IN_VALIDITY_CERTIFIED 4648 3.58 3.10 3.81 97 KHOP_HELO_FCRDNS 4642 2.62 3.10 2.40 98 XM_CamelCaseFrm001 4642 2.28 3.10 1.89 99 XMLngstWrd_02 4606 1.16 3.07 0.26 100 T_XMDrugObfuBody_08 4548 1.97 3.04 1.47 101 RCVD_IN_IADB_LISTED 4378 4.41 2.92 5.11 102 XM_DK_Undo_01 4362 2.09 2.91 1.70 103 TM2_M_URI_OPT_OUT 4179 2.90 2.79 2.96 104 XMLngstWrd_03 4172 1.03 2.78 0.20 105 HTML_TITLE_SUBJ_DIFF 4118 0.89 2.75 0.02 106 T_FILL_THIS_FORM_SHORT 4113 1.39 2.74 0.76 107 XMLngstWrd_04 4081 0.97 2.72 0.15 108 UPPERCASE_75_100 4035 0.88 2.69 0.02 109 TR_XM_SpammyWords3 4030 1.17 2.69 0.46 110 XM_B_Unsub2 3940 1.78 2.63 1.38 111 T_TooManySym_01 3831 5.75 2.56 7.25 112 RCVD_IN_IADB_SPF 3830 3.90 2.56 4.54 113 HTML_IMAGE_RATIO_08 3713 2.54 2.48 2.58 114 SUBJ_ALL_CAPS 3702 2.06 2.47 1.86 115 URI_NOVOWEL 3672 2.56 2.45 2.61 116 USER_IN_DEF_DKIM_WL 3603 9.53 2.40 12.89 117 RCVD_IN_IADB_DK 3554 3.43 2.37 3.92 118 RCVD_IN_IADB_SENDERID 3527 3.51 2.35 4.06 119 XMSexyCombo_01 3465 1.39 2.31 0.96 120 PDS_OTHER_BAD_TLD 3407 0.87 2.27 0.21 121 XM_H_Undi_Recip 3339 0.85 2.23 0.21 122 XM_B_COVIDMETA 3334 1.33 2.22 0.91 123 BOTNET_NORDNS 3264 0.71 2.18 0.01 124 TR_XM_SB_Phish 3234 2.16 2.16 2.15 125 RCVD_IN_PSBL 3165 0.87 2.11 0.29 126 TR_Symld_Words 3126 1.86 2.09 1.76 127 HTML_FONT_FACE_BAD 3119 3.46 2.08 4.12 128 FROM_EXCESS_BASE64 2997 2.30 2.00 2.44 129 XM_UB99 2991 0.64 2.00 0.00 130 XM_B_SpammyWords4 2932 0.96 1.96 0.49 131 XMSubPhish11 2925 2.07 1.95 2.13 132 T_XMHurry_00 2913 0.92 1.94 0.44 133 T_XMDrugObfuBody_00 2863 1.21 1.91 0.88 134 SpammyFromTLD_02 2845 0.98 1.90 0.54 135 HTML_IMAGE_ONLY_08 2838 0.68 1.89 0.11 136 URI_PHP_REDIR 2771 0.59 1.85 0.00 137 XMBody_17 2753 0.80 1.84 0.31 138 MAILING_LIST_MULTI 2718 2.32 1.81 2.55 139 TR_LOTS_OF_MONEY3 2639 0.69 1.76 0.18 140 RCVD_IN_MSPIKE_L4 2513 0.56 1.68 0.03 141 URI_HEX 2464 1.38 1.64 1.26 142 HTML_IMAGE_ONLY_20 2460 1.13 1.64 0.88 143 XMStockSpam_06 2435 1.65 1.62 1.66 144 RELAYCOUNTRY_FR 2386 0.68 1.59 0.25 145 TR_XM_COVIDMETA4 2374 0.69 1.58 0.27 146 HTML_FONT_SIZE_LARGE 2307 0.55 1.54 0.08 147 XM_UB999 2286 0.49 1.53 0.00 148 TR_XM_Undi_Recip11 2275 0.52 1.52 0.04 149 RCVD_IN_IADB_VOUCHED 2268 2.68 1.51 3.23 150 MONEY_NOHTML 2262 0.54 1.51 0.08 151 ALL_TRUSTED 2261 11.76 1.51 16.59 152 XMBdyGiftCard01 2244 1.06 1.50 0.86 153 HTTPS_HTTP_MISMATCH 2241 0.88 1.50 0.58 154 RCVD_IN_MSPIKE_L3 2217 1.24 1.48 1.13 155 TR_XM_MSPIKECOMBO2 2183 0.66 1.46 0.29 156 RELAYCOUNTRY_AU 2177 0.67 1.45 0.31 157 TR_XM_PHPDW 2161 0.67 1.44 0.31 158 XM_URI_RBL 2143 0.53 1.43 0.11 159 RCVD_IN_MSPIKE_L5 2132 0.46 1.42 0.01 160 TR_XM_NoHeaderRelay 2132 0.53 1.42 0.12 161 XM_B_DynamicLink 2123 0.48 1.42 0.03 162 TR_XM_PHPForged 2113 0.63 1.41 0.27 163 RELAYCOUNTRY_RU 2104 0.47 1.40 0.03 164 TR_XM_FormFill2 2090 0.63 1.39 0.28 165 RCVD_IN_MSPIKE_H4 2086 2.97 1.39 3.71 166 XM_H_PHPOS 2081 0.62 1.39 0.26 167 XMBrknScrpt_02 2032 0.81 1.36 0.55 168 HTML_TAG_BALANCE_CENTER 2023 0.48 1.35 0.07 169 MPART_ALT_DIFF_COUNT 2013 0.84 1.34 0.60 170 RELAYCOUNTRY_DE 2012 0.59 1.34 0.24 171 FROM_SUSPICIOUS_NTLD 2010 0.46 1.34 0.04 172 XM_H_Long_From02 2010 1.11 1.34 1.00 173 XMGenDplmaNmb 2007 0.91 1.34 0.71 174 URIBL_BLACK 1998 0.46 1.33 0.05 175 TR_XM_FormFill 1987 0.43 1.33 0.01 176 BAYES_40 1959 3.77 1.31 4.93 177 XM_ProductURIs 1884 0.79 1.26 0.57 178 TR_XM_Undi_Recip6 1880 0.40 1.25 0.00 179 HK_RANDOM_REPLYTO 1848 0.47 1.23 0.11 180 XM_Body_Dirty_Words_01 1843 0.52 1.23 0.18 181 XM_OfRef7 1813 0.45 1.21 0.10 182 TR_XM_COVIDMETA1 1812 0.52 1.21 0.20 183 FROM_SUSPICIOUS_NTLD_FP 1779 0.41 1.19 0.04 184 BODY_URI_ONLY 1774 0.39 1.18 0.01 185 MIXED_CENTER_CASE 1752 0.38 1.17 0.00 186 HTML_TAG_BALANCE_BODY 1740 0.75 1.16 0.55 187 DIET_1 1723 0.67 1.15 0.45 188 MIXED_HREF_CASE 1714 0.37 1.14 0.00 189 XMSubNoVowel 1704 1.24 1.14 1.28 190 MIXED_IMG_CASE 1693 0.36 1.13 0.00 191 MIXED_AREA_CASE 1690 0.36 1.13 0.00 192 MIXED_FONT_CASE 1667 0.36 1.11 0.01 193 URI_TRY_3LD 1623 0.73 1.08 0.56 194 TM2_M_A_HREF_HREF 1615 0.67 1.08 0.47 195 XMReplyNow 1595 0.50 1.06 0.23 196 XM_UB60 1590 0.38 1.06 0.06 197 FILL_THIS_FORM 1575 0.62 1.05 0.42 198 URI_GOOG_STO_SPAMMY 1538 0.33 1.03 0.00 199 XMSubMetaI_00 1499 0.80 1.00 0.71 200 RELAYCOUNTRY_IN 1476 0.36 0.98 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271930 88.52 94.94 85.50 2 RELAYCOUNTRY_US 256841 81.43 82.88 80.75 3 DCC_CHECK_NEGATIVE 225304 58.07 30.97 70.84 4 DKIM_SIGNED 222972 75.85 88.06 70.10 5 XM_B_Unicode 220768 73.03 80.72 69.41 6 XM_DK_Pass 215034 73.19 85.04 67.61 7 DKIM_VALID 212174 72.31 84.19 66.71 8 BAYES_50 173372 50.65 42.46 54.51 9 DKIM_VALID_AU 165005 55.61 63.52 51.88 10 XMListUnsubscribeExists 146474 52.90 67.43 46.05 11 XM_B_SpammyWords 140746 51.65 67.35 44.25 12 XM_B_Unicode3 134174 42.81 44.14 42.18 13 RCVD_IN_MSPIKE_H2 111493 38.79 46.72 35.05 14 T_TM2_M_HEADER_IN_MSG 94926 27.05 21.13 29.85 15 DCC_CHECK 92623 41.89 69.00 29.12 16 DKIM_VALID_EF 84273 27.57 29.86 26.50 17 HTML_FONT_LOW_CONTRAST 83246 28.56 33.63 26.17 18 FVGT_m_MULTI_ODD 76227 26.64 32.33 23.97 19 XMSubLong 73865 22.69 21.55 23.22 20 LOC_TINY_FONT_1 70431 26.36 35.32 22.14 21 MIME_HTML_ONLY 63179 23.92 32.52 19.86 22 T_KAM_HTML_FONT_INVALID 61896 22.16 27.88 19.46 23 XM_B_SpammyWords2 58345 23.93 35.78 18.34 24 ALL_TRUSTED 52773 11.76 1.51 16.59 25 RCVD_IN_MSPIKE_WL 43335 12.42 9.86 13.62 26 USER_IN_DEF_DKIM_WL 40994 9.53 2.40 12.89 27 BAYES_00 39723 8.75 0.82 12.49 28 XM_Multi_Part_URI 36832 13.46 17.45 11.58 29 XM_Body_Dirty_Words 36169 14.68 21.70 11.37 30 LOTS_OF_MONEY 32063 11.55 14.68 10.08 31 RCVD_IN_MSPIKE_H3 30943 9.31 8.42 9.73 32 XM_B_Unsub 30168 11.92 17.09 9.48 33 XM_DKIMWhitelistDomains 28842 6.19 0.09 9.07 34 BAYES_60 28501 8.49 7.48 8.96 35 IN_ZIMBRA_NJ_WHITELIST 27705 5.96 0.11 8.71 36 TooManyTo_001 26946 7.10 4.18 8.47 37 LotsOfNums_01 26746 8.41 8.40 8.41 38 XM_Evil_Numbers_Gen 24743 7.96 8.34 7.78 39 TR_XM_BayesUnsub 23801 10.42 16.67 7.48 40 UNPARSEABLE_RELAY 23560 9.99 15.48 7.41 41 T_TooManySym_01 23057 5.75 2.56 7.25 42 TR_XM_SpammyWords4 21828 8.58 12.23 6.86 43 XM_DK_Undo_02 20540 17.90 42.18 6.46 44 HTML_IMAGE_RATIO_04 20386 5.87 4.73 6.41 45 TR_XM_DK_Bayes 19500 4.38 0.66 6.13 46 BAYES_99 19420 15.07 34.11 6.11 47 TR_XM_DK_Bayes1 19097 4.29 0.65 6.00 48 MPART_ALT_DIFF 18475 6.82 8.97 5.81 49 TR_XM_UnparsRelay 18417 8.82 15.25 5.79 50 HTML_IMAGE_RATIO_06 17132 4.78 3.48 5.39 51 TR_XM_DK_Bayes2 16945 3.80 0.54 5.33 52 HTML_IMAGE_RATIO_02 16937 5.87 7.02 5.33 53 RCVD_IN_IADB_LISTED 16267 4.41 2.92 5.11 54 XM_H_Trusted_IP 16230 3.47 0.00 5.10 55 MIME_QP_LONG_LINE 16105 4.81 4.28 5.06 56 XM_H_Long_From01 15788 5.41 6.36 4.96 57 BAYES_40 15685 3.77 1.31 4.93 58 XM_SendGrid 15645 5.78 7.62 4.92 59 XMStrtUSub 15628 4.68 4.18 4.91 60 BOTNET_IPINHOSTNAME 15343 7.47 13.08 4.82 61 XMNumbers 15131 4.56 4.13 4.76 62 RCVD_IN_IADB_SPF 14438 3.90 2.56 4.54 63 TR_XM_DKIM_Undo 14348 13.45 32.44 4.51 64 BAYES_999 14280 11.89 27.61 4.49 65 T_TooManySym_02 13948 3.19 0.66 4.39 66 XM_PDF 13768 3.22 0.86 4.33 67 RCVD_IN_VALIDITY_SAFE 13756 4.12 3.68 4.32 68 XM_B_SpammyWords3 13577 6.86 12.36 4.27 69 BAYES_80 13437 5.36 7.76 4.22 70 MIME_HTML_ONLY_MULTI 13375 4.75 5.92 4.21 71 HTML_FONT_FACE_BAD 13092 3.46 2.08 4.12 72 RCVD_IN_IADB_SENDERID 12913 3.51 2.35 4.06 73 XM_SPF_SoftFail 12593 3.96 3.95 3.96 74 RCVD_IN_IADB_DK 12479 3.43 2.37 3.92 75 TR_XM_PhishingBody 12339 4.49 5.80 3.88 76 RCVD_IN_VALIDITY_CERTIFIED 12110 3.58 3.10 3.81 77 XMSexyCombo_05 12095 5.99 10.62 3.80 78 T_REMOTE_IMAGE 12035 4.13 4.86 3.78 79 BAYES_20 11857 2.84 0.94 3.73 80 RCVD_IN_MSPIKE_H4 11801 2.97 1.39 3.71 81 RELAYCOUNTRY_META 11760 8.91 19.97 3.70 82 XMSubMetaSx_00 11481 4.69 7.00 3.61 83 XM_UncommonTLD01 11186 4.77 7.42 3.52 84 DKIM_INVALID 10798 3.55 3.87 3.39 85 XM_B_Phish_Phrases 10666 4.07 5.60 3.35 86 RCVD_IN_IADB_VOUCHED 10282 2.68 1.51 3.23 87 FSL_BULK_SIG 10213 5.95 11.75 3.21 88 TR_XM_DK_SendGrid 9557 3.54 4.69 3.00 89 TM2_M_URI_OPT_OUT 9405 2.90 2.79 2.96 90 ANY_BOUNCE_MESSAGE 8495 2.07 0.81 2.67 91 BOUNCE_MESSAGE 8493 2.07 0.81 2.67 92 URI_NOVOWEL 8295 2.56 2.45 2.61 93 HTML_IMAGE_RATIO_08 8193 2.54 2.48 2.58 94 BAYES_95 8150 3.21 4.58 2.56 95 MAILING_LIST_MULTI 8122 2.32 1.81 2.55 96 XM_B_Phish66 8070 2.83 3.46 2.54 97 BAYES_05 7912 1.86 0.54 2.49 98 MIME_HTML_MOSTLY 7891 2.94 3.93 2.48 99 FROM_EXCESS_BASE64 7760 2.30 2.00 2.44 100 KHOP_HELO_FCRDNS 7626 2.62 3.10 2.40 101 XM_B_SpammyTLD 7289 2.92 4.24 2.29 102 INVALID_MSGID 6914 1.52 0.14 2.17 103 TR_XM_SB_Phish 6854 2.16 2.16 2.15 104 TooManyTo_002 6851 1.66 0.60 2.15 105 RCVD_IN_IADB_OPTIN 6834 1.77 0.95 2.15 106 XMSubPhish11 6780 2.07 1.95 2.13 107 IN_HORDE_ADDRESS_BOOK 6033 1.33 0.13 1.90 108 XM_CamelCaseFrm001 6026 2.28 3.10 1.89 109 SUBJ_ALL_CAPS 5931 2.06 2.47 1.86 110 TO_MALFORMED 5799 1.25 0.03 1.82 111 HTML_MIME_NO_HTML_TAG 5786 3.01 5.55 1.82 112 TVD_RCVD_IP 5729 1.42 0.61 1.80 113 T_XMDrugObfuBody_14 5715 2.63 4.40 1.80 114 TR_Symld_Words 5597 1.86 2.09 1.76 115 T_TooManySym_03 5428 1.25 0.28 1.71 116 XM_DK_Undo_01 5416 2.09 2.91 1.70 117 TR_XM_SpammyRelay 5337 4.80 11.41 1.68 118 XMStockSpam_06 5269 1.65 1.62 1.66 119 HELO_NODOT 5129 1.25 0.48 1.61 120 HELO_NO_DOMAIN 5127 1.25 0.48 1.61 121 XMDiploma_00 4971 2.35 4.03 1.56 122 XMGappySubj_01 4910 1.07 0.08 1.54 123 TooManyTo_003 4689 1.16 0.50 1.47 124 T_XMDrugObfuBody_08 4678 1.97 3.04 1.47 125 TR_DCC_Bayes_99 4542 8.37 23.12 1.43 126 XM_B_Unsub2 4392 1.78 2.63 1.38 127 TVD_SPACE_RATIO 4319 0.95 0.09 1.36 128 TR_XM_SpammyWords5 4294 2.34 4.44 1.35 129 BOTNET 4268 4.22 10.33 1.34 130 TM2_M_VERY_LONG_WORD 4081 2.73 5.80 1.28 131 XMSubNoVowel 4079 1.24 1.14 1.28 132 XMBSHREFv2 4062 0.97 0.30 1.28 133 URI_HEX 3999 1.38 1.64 1.26 134 XM_GoogleGroups 3946 1.87 3.19 1.24 135 RCVD_IN_MSPIKE_BL 3734 2.28 4.64 1.17 136 TR_XM_MSPIKECOMBO 3730 2.26 4.58 1.17 137 UNTRUSTED_Relay 3680 3.67 9.02 1.16 138 RCVD_IN_MSPIKE_L3 3600 1.24 1.48 1.13 139 NUMERIC_HTTP_ADDR 3592 0.84 0.22 1.13 140 RELAYCOUNTRY_CA 3442 2.80 6.45 1.08 141 XM_B_Investor 3358 2.18 4.56 1.06 142 TooManyTo_004 3343 0.82 0.31 1.05 143 XM_B_SEO 3272 1.00 0.95 1.03 144 XMCapTrack 3245 0.80 0.33 1.02 145 XM_H_Long_From02 3169 1.11 1.34 1.00 146 XMSexyCombo_01 3051 1.39 2.31 0.96 147 XMSubMetaSxObfu_03 2964 0.87 0.73 0.93 148 FVGT_m_MULTI_ODD_EMAIL 2942 0.66 0.09 0.92 149 XM_B_COVIDMETA 2894 1.33 2.22 0.91 150 XM_OfRef6 2825 1.92 4.12 0.89 151 TR_MetaPhish_Combo_01 2821 0.91 0.97 0.89 152 DKIM_ADSP_CUSTOM_MED 2811 0.87 0.83 0.88 153 HTML_IMAGE_ONLY_20 2804 1.13 1.64 0.88 154 TO_IN_SUBJ 2795 0.64 0.13 0.88 155 T_XMDrugObfuBody_00 2789 1.21 1.91 0.88 156 NORMAL_HTTP_TO_IP 2774 0.63 0.10 0.87 157 XMBdyGiftCard01 2739 1.06 1.50 0.86 158 RCVD_IN_RP_SAFE 2700 0.81 0.72 0.85 159 XM_D_tchamptons_WL 2668 0.59 0.06 0.84 160 TooManyTo_005 2642 0.64 0.25 0.83 161 XMBody_95 2602 0.61 0.17 0.82 162 TR_XM_SpammyWords2 2514 4.19 11.39 0.79 163 XMPhish30 2441 0.83 0.96 0.77 164 XM_UB50 2412 1.86 4.20 0.76 165 T_FILL_THIS_FORM_SHORT 2411 1.39 2.74 0.76 166 RCVD_IN_RP_CERTIFIED 2399 0.71 0.62 0.75 167 MSGID_NOFQDN1 2309 0.50 0.01 0.73 168 RELAYCOUNTRY_GB 2298 0.72 0.73 0.72 169 FROM_GOV_DKIM_AU 2268 0.58 0.29 0.71 170 XMSubMetaI_00 2263 0.80 1.00 0.71 171 TVD_SPACE_RATIO_MINFP 2256 0.56 0.23 0.71 172 XMGenDplmaNmb 2254 0.91 1.34 0.71 173 RCVD_IN_BL_SPAMCOP_NET 2211 3.59 9.75 0.70 174 XMMoneyMeta_00 2140 0.75 0.93 0.67 175 XM_B_DNDMA 2109 0.74 0.89 0.66 176 XM_B_COPY_HTML 2094 0.75 0.95 0.66 177 XMHTML_After_End 2077 0.73 0.88 0.65 178 XM_H_PHPMailer 1984 0.64 0.69 0.62 179 XM_ShortIntro_01 1980 0.58 0.49 0.62 180 XMSexyCombo_04 1980 0.73 0.96 0.62 181 SpammyFromTLD_01 1978 1.44 3.17 0.62 182 XMSubMetaSx_01 1949 0.53 0.35 0.61 183 T_OBFU_PDF_ATTACH 1947 0.47 0.18 0.61 184 MPART_ALT_DIFF_COUNT 1910 0.84 1.34 0.60 185 HTTPS_HTTP_MISMATCH 1857 0.88 1.50 0.58 186 XMNoVowels 1840 0.48 0.27 0.58 187 XM_ProductURIs 1812 0.79 1.26 0.57 188 URI_TRY_3LD 1772 0.73 1.08 0.56 189 XMSexyCombo_02 1762 0.44 0.20 0.55 190 HTML_TAG_BALANCE_BODY 1761 0.75 1.16 0.55 191 XMBrknScrpt_02 1745 0.81 1.36 0.55 192 T_MANY_PILL_PRICE 1742 0.37 0.01 0.55 193 SpammyFromTLD_02 1724 0.98 1.90 0.54 194 NML_ADSP_CUSTOM_MED 1723 0.57 0.64 0.54 195 XMHTMLBadTable_001 1631 0.60 0.79 0.51 196 USER_IN_WHITELIST 1561 0.33 0.00 0.49 197 USER_IN_WELCOMELIST 1561 0.33 0.00 0.49 198 XM_B_SpammyWords4 1557 0.96 1.96 0.49 199 TM2_M_A_HREF_HREF 1509 0.67 1.08 0.47 200 FORGED_GMAIL_RCVD 1493 0.54 0.69 0.47 ----------------------------------------------------------------------