Email: 643470 Autolearn: 0 AvgScore: 0.93 AvgScanTime: 1.12 sec Spam: 102048 Autolearn: 0 AvgScore: 12.97 AvgScanTime: 1.22 sec Ham: 541422 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 1.11 sec Time Spent Running SA: 200.84 hours Time Spent Processing Spam: 34.65 hours Time Spent Processing Ham: 166.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 98961 97.91 96.97 98.08 2 HTML_MESSAGE 91687 88.05 89.85 87.71 3 DKIM_SIGNED 75690 75.29 74.17 75.50 4 XM_DK_Pass 73291 73.99 71.82 74.40 5 DKIM_VALID 70922 71.81 69.50 72.24 6 XM_B_Unicode 68586 69.30 67.21 69.70 7 RELAYCOUNTRY_US 65201 78.95 63.89 81.79 8 XM_B_SpammyWords 63760 49.88 62.48 47.51 9 XMListUnsubscribeExists 62581 51.81 61.33 50.02 10 DKIM_VALID_AU 53636 54.48 52.56 54.85 11 XM_DK_Undo_02 47034 15.95 46.09 10.27 12 BAYES_50 40807 50.90 39.99 52.95 13 RELAYCOUNTRY_META 37225 10.64 36.48 5.77 14 DKIM_VALID_EF 35444 29.94 34.73 29.04 15 XM_B_SpammyWords2 33734 23.85 33.06 22.11 16 MIME_HTML_ONLY 33607 23.22 32.93 21.39 17 BAYES_99 32172 11.01 31.53 7.14 18 LOC_TINY_FONT_1 32117 26.12 31.47 25.11 19 XM_B_Unicode3 31273 38.22 30.65 39.65 20 UNTRUSTED_Relay 28090 6.46 27.53 2.49 21 BOTNET 27978 6.11 27.42 2.10 22 RCVD_IN_MSPIKE_H2 26691 26.71 26.16 26.81 23 XMSubLong 25798 22.91 25.28 22.46 24 T_KAM_HTML_FONT_INVALID 25580 19.71 25.07 18.70 25 T_TM2_M_HEADER_IN_MSG 25473 28.70 24.96 29.41 26 HTML_FONT_LOW_CONTRAST 24748 26.40 24.25 26.80 27 BAYES_999 24489 8.54 24.00 5.63 28 FVGT_m_MULTI_ODD 23888 23.23 23.41 23.20 29 XM_UncommonTLD01 23125 6.26 22.66 3.16 30 XM_Body_Dirty_Words 20998 14.79 20.58 13.70 31 XM_Multi_Part_URI 19158 13.03 18.77 11.94 32 BOTNET_IPINHOSTNAME 16396 6.82 16.07 5.08 33 LOTS_OF_MONEY 16260 8.48 15.93 7.07 34 XMSexyCombo_05 13559 5.91 13.29 4.52 35 XM_UB50 12687 3.03 12.43 1.26 36 XM_B_Phish_Phrases 12095 7.68 11.85 6.90 37 XM_B_SpammyWords3 11917 6.52 11.68 5.54 38 MPART_ALT_DIFF 11892 6.00 11.65 4.94 39 XM_B_Unsub 11030 10.63 10.81 10.59 40 RCVD_IN_BL_SPAMCOP_NET 10943 2.71 10.72 1.20 41 MIME_HTML_MOSTLY 10836 3.54 10.62 2.20 42 RELAYCOUNTRY_FR 10789 1.89 10.57 0.25 43 RCVD_IN_MSPIKE_WL 10082 24.47 9.88 27.21 44 LotsOfNums_01 9782 8.43 9.59 8.21 45 RCVD_IN_MSPIKE_BL 9562 2.52 9.37 1.23 46 HTML_IMAGE_RATIO_02 9492 7.92 9.30 7.66 47 XM_Evil_Numbers_Gen 9182 8.54 9.00 8.46 48 URI_PHP_REDIR 9159 1.45 8.98 0.03 49 BAYES_60 8914 7.16 8.74 6.87 50 BAYES_80 8682 5.14 8.51 4.50 51 RCVD_IN_RP_RNBL 8476 1.38 8.31 0.07 52 SpammyFromTLD_01 8237 1.97 8.07 0.82 53 SpammyFromTLD_02 7877 1.42 7.72 0.23 54 TR_XM_PhishingBody 7548 3.95 7.40 3.30 55 XM_DIRTYINTL 7133 1.59 6.99 0.57 56 BOTNET_NORDNS 6813 1.07 6.68 0.02 57 XMSubMetaSx_00 6658 4.43 6.52 4.03 58 RELAYCOUNTRY_CA 6635 2.43 6.50 1.66 59 T_REMOTE_IMAGE 6530 3.99 6.40 3.54 60 XM_SPF_SoftFail 6454 2.50 6.32 1.78 61 XMStrtUSub 6328 4.86 6.20 4.61 62 XMBrknScrpt_02 6145 1.96 6.02 1.20 63 XM_BadFromFormat 6098 1.08 5.98 0.15 64 XMBody_17 6089 1.89 5.97 1.12 65 RCVD_IN_MSPIKE_H3 5985 13.74 5.86 15.22 66 BODY_URI_ONLY 5680 0.92 5.57 0.05 67 TooManyTo_001 5579 7.56 5.47 7.96 68 KHOP_HELO_FCRDNS 5374 2.30 5.27 1.74 69 HTML_FONT_TINY_NORDNS 5284 0.99 5.18 0.21 70 HTML_MIME_NO_HTML_TAG 5189 3.22 5.08 2.86 71 XM_H_Long_From01 5113 5.06 5.01 5.07 72 SUBJ_ALL_CAPS 5055 2.24 4.95 1.73 73 XM_B_COVIDMETA 5023 2.38 4.92 1.90 74 UNPARSEABLE_RELAY 4967 7.14 4.87 7.57 75 XM_OfRef6 4946 1.93 4.85 1.38 76 XM_UB60 4795 0.83 4.70 0.10 77 DKIM_INVALID 4768 3.49 4.67 3.26 78 BAYES_95 4686 2.92 4.59 2.61 79 XM_B_Phish66 4684 2.29 4.59 1.86 80 RCVD_IN_MSPIKE_L5 4449 0.97 4.36 0.33 81 RCVD_IN_MSPIKE_L3 4304 1.27 4.22 0.72 82 HTML_SHORT_LINK_IMG_1 4196 0.68 4.11 0.03 83 TR_Mismatch_TLD_02 4166 0.73 4.08 0.10 84 RELAYCOUNTRY_IN 4162 0.81 4.08 0.19 85 XMNumbers 3998 3.38 3.92 3.28 86 HTML_IMAGE_RATIO_04 3962 5.14 3.88 5.37 87 XM_SendGrid 3895 6.31 3.82 6.78 88 XM_B_SpammyTLD 3879 2.25 3.80 1.96 89 FROM_MISSP_REPLYTO 3868 0.61 3.79 0.01 90 XM_UB99 3806 0.60 3.73 0.01 91 RCVD_IN_MSPIKE_H4 3734 9.15 3.66 10.19 92 TR_XM_SB_Phish 3621 2.38 3.55 2.16 93 XMSubPhish11 3517 2.32 3.45 2.11 94 T_XMDrugObfuBody_00 3489 1.01 3.42 0.55 95 T_XMDrugObfuBody_08 3461 1.99 3.39 1.73 96 TM2_M_VERY_LONG_WORD 3436 1.53 3.37 1.19 97 XM_UB80 3229 0.53 3.16 0.03 98 LH_URI_DOM_IN_PATH 3207 2.12 3.14 1.93 99 TM2_M_URI_OPT_OUT 3129 3.42 3.07 3.48 100 DKIM_ADSP_NXDOMAIN 3108 1.01 3.05 0.62 101 RCVD_IN_PSBL 3107 0.54 3.04 0.07 102 XM_URI_RBL 3046 0.65 2.98 0.21 103 HTML_IMAGE_ONLY_04 2960 0.50 2.90 0.05 104 URI_HEX 2821 1.93 2.76 1.77 105 T_XMDrugObfuBody_14 2766 1.85 2.71 1.69 106 URIBL_SBL_A 2766 0.63 2.71 0.23 107 XM_B_Unsub2 2745 2.54 2.69 2.51 108 RELAYCOUNTRY_JP 2731 0.46 2.68 0.04 109 TR_XM_COVIDMETA4 2685 0.84 2.63 0.51 110 SHORT_SHORTNER 2664 0.44 2.61 0.03 111 XMSubMetaD_00 2652 0.52 2.60 0.13 112 TR_XM_PHPDW 2622 0.73 2.57 0.38 113 XM_UB999 2618 0.41 2.57 0.01 114 XMDiploma_00 2618 2.19 2.57 2.12 115 TR_XM_MaxSPIKE 2613 0.46 2.56 0.06 116 TR_XM_PHPForged 2598 0.70 2.55 0.35 117 TR_XM_FormFill2 2573 0.70 2.52 0.35 118 HTML_IMAGE_RATIO_06 2563 3.50 2.51 3.69 119 XM_H_PHPOS 2561 0.69 2.51 0.34 120 T_FILL_THIS_FORM_SHORT 2510 1.38 2.46 1.18 121 XMGppyBdWords 2472 0.52 2.42 0.16 122 BAYES_40 2463 4.31 2.41 4.67 123 RELAYCOUNTRY_DE 2367 0.68 2.32 0.37 124 XM_CamelCaseFrm001 2297 1.73 2.25 1.63 125 T_PDS_OTHER_BAD_TLD 2236 0.75 2.19 0.48 126 TR_XM_COVIDMETA1 2206 0.63 2.16 0.34 127 ALL_TRUSTED 2185 12.04 2.14 13.90 128 T_TooManySym_01 2178 4.44 2.13 4.88 129 HTML_IMAGE_RATIO_08 2160 2.26 2.12 2.29 130 XMSexyCombo_01 2148 0.95 2.10 0.73 131 TR_XM_UnparsRelay 2143 0.72 2.10 0.46 132 SUBJ_BUY 2130 0.38 2.09 0.06 133 HDRS_MISSP 2127 0.36 2.08 0.03 134 TR_XM_RelayPhish 2110 0.43 2.07 0.13 135 PDS_FROM_2_EMAILS 2095 0.36 2.05 0.04 136 XMSlimDrugH 2090 0.61 2.05 0.34 137 BAYES_20 2060 3.47 2.02 3.74 138 TR_Symld_Words 2048 1.75 2.01 1.70 139 FROM_EXCESS_BASE64 2037 2.33 2.00 2.39 140 DIET_1 1994 0.79 1.95 0.57 141 T_HTML_TAG_BALANCE_CENTER 1989 0.43 1.95 0.15 142 TR_XM_DK_SendGrid 1979 3.72 1.94 4.06 143 LONG_JUNK_URI2 1977 0.36 1.94 0.07 144 TR_LOTS_OF_MONEY3 1963 0.75 1.92 0.52 145 ANY_BOUNCE_MESSAGE 1940 2.99 1.90 3.20 146 BOUNCE_MESSAGE 1929 2.99 1.89 3.20 147 NO_FM_NAME_IP_HOSTN 1915 0.30 1.88 0.00 148 TR_XM_MaxBayes 1912 0.33 1.87 0.04 149 FROM_MISSP_EH_MATCH 1899 0.31 1.86 0.01 150 XM_NotFromAmazon 1844 0.30 1.81 0.02 151 MIME_QP_LONG_LINE 1826 4.67 1.79 5.21 152 RELAYCOUNTRY_KR 1826 0.30 1.79 0.02 153 XM_B_SpammyWords4 1792 0.82 1.76 0.65 154 XM_OfRef7 1788 0.41 1.75 0.15 155 URI_NOVOWEL 1741 2.07 1.71 2.14 156 TR_XM_INV_DKIM 1740 0.33 1.71 0.07 157 HTML_SHORT_CENTER 1717 0.27 1.68 0.00 158 MIME_HTML_ONLY_MULTI 1703 3.07 1.67 3.33 159 XM_Lotto 1670 0.41 1.64 0.17 160 TO_NO_BRKTS_HTML_ONLY 1666 0.36 1.63 0.12 161 XMObfuSubjects 1625 0.26 1.59 0.01 162 MONEY_FRAUD_5 1609 0.27 1.58 0.03 163 RDNS_DYNAMIC 1595 0.61 1.56 0.43 164 XM_UB95 1577 0.26 1.55 0.02 165 NO_DNS_FOR_FROM 1567 0.62 1.54 0.45 166 XMMoneyMeta_00 1544 0.72 1.51 0.57 167 XMSubNoVowel 1535 1.13 1.50 1.06 168 SHORT_URI_2 1517 0.27 1.49 0.04 169 XMSubMetaSxObfu_03 1490 0.58 1.46 0.41 170 T_XMHurry_00 1488 0.78 1.46 0.65 171 DATE_IN_PAST_03_06 1482 0.40 1.45 0.20 172 URI_TRY_3LD 1479 1.27 1.45 1.24 173 LongTLD 1455 0.36 1.43 0.16 174 FORM_FRAUD_5 1440 0.22 1.41 0.00 175 XMGenDplmaNmb 1437 1.07 1.41 1.00 176 DKIM_ADSP_CUSTOM_MED 1417 1.10 1.39 1.04 177 MAILING_LIST_MULTI 1410 2.38 1.38 2.57 178 XMWghtMeta_00 1399 0.24 1.37 0.03 179 TR_LOTS_OF_MONEY2 1397 0.45 1.37 0.27 180 T_MONEY_PERCENT 1397 0.45 1.37 0.27 181 XMSlimDrugs 1395 0.24 1.37 0.03 182 XM_PDF 1360 3.98 1.33 4.47 183 XM_ShortIntro_01 1352 1.51 1.32 1.54 184 FROM_SUSPICIOUS_NTLD 1348 0.26 1.32 0.06 185 XMStockSpam_06 1341 1.15 1.31 1.12 186 TR_XM_SpoofStaff 1339 0.23 1.31 0.03 187 HELO_NODOT 1332 2.00 1.31 2.13 188 HELO_NO_DOMAIN 1332 2.00 1.31 2.13 189 RCVD_IN_IADB_LISTED 1325 4.00 1.30 4.51 190 NML_ADSP_CUSTOM_MED 1323 0.84 1.30 0.76 191 XMSpoofStaff2 1322 0.23 1.30 0.03 192 RELAYCOUNTRY_GB 1318 0.95 1.29 0.89 193 DRUGS_ERECTILE 1310 0.21 1.28 0.01 194 BAYES_00 1298 12.57 1.27 14.70 195 XMBody_78 1290 0.61 1.26 0.48 196 SHORT_URI_3 1284 0.25 1.26 0.06 197 XMHTML_After_End 1266 0.85 1.24 0.78 198 FROM_SUSPICIOUS_NTLD_FP 1258 0.24 1.23 0.05 199 HTML_IMAGE_ONLY_08 1257 0.29 1.23 0.11 200 MIMEOLE_DIRECT_TO_MX 1254 0.20 1.23 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 531053 97.91 96.97 98.08 2 HTML_MESSAGE 474878 88.05 89.85 87.71 3 RELAYCOUNTRY_US 442819 78.95 63.89 81.79 4 DKIM_SIGNED 408799 75.29 74.17 75.50 5 XM_DK_Pass 402791 73.99 71.82 74.40 6 DKIM_VALID 391132 71.81 69.50 72.24 7 XM_B_Unicode 377364 69.30 67.21 69.70 8 DKIM_VALID_AU 296958 54.48 52.56 54.85 9 BAYES_50 286708 50.90 39.99 52.95 10 XMListUnsubscribeExists 270815 51.81 61.33 50.02 11 XM_B_SpammyWords 257229 49.88 62.48 47.51 12 XM_B_Unicode3 214655 38.22 30.65 39.65 13 T_TM2_M_HEADER_IN_MSG 159228 28.70 24.96 29.41 14 DKIM_VALID_EF 157240 29.94 34.73 29.04 15 RCVD_IN_MSPIKE_WL 147343 24.47 9.88 27.21 16 RCVD_IN_MSPIKE_H2 145160 26.71 26.16 26.81 17 HTML_FONT_LOW_CONTRAST 145125 26.40 24.25 26.80 18 LOC_TINY_FONT_1 135975 26.12 31.47 25.11 19 FVGT_m_MULTI_ODD 125609 23.23 23.41 23.20 20 XMSubLong 121606 22.91 25.28 22.46 21 XM_B_SpammyWords2 119704 23.85 33.06 22.11 22 MIME_HTML_ONLY 115821 23.22 32.93 21.39 23 T_KAM_HTML_FONT_INVALID 101247 19.71 25.07 18.70 24 RCVD_IN_MSPIKE_H3 82408 13.74 5.86 15.22 25 BAYES_00 79580 12.57 1.27 14.70 26 ALL_TRUSTED 75279 12.04 2.14 13.90 27 XM_Body_Dirty_Words 74180 14.79 20.58 13.70 28 XM_Multi_Part_URI 64656 13.03 18.77 11.94 29 XM_B_Unsub 57359 10.63 10.81 10.59 30 XM_DK_Undo_02 55581 15.95 46.09 10.27 31 RCVD_IN_MSPIKE_H4 55166 9.15 3.66 10.19 32 TR_XM_DK_Bayes 48605 7.64 0.56 8.98 33 TR_XM_DK_Bayes1 47031 7.39 0.54 8.69 34 XM_Evil_Numbers_Gen 45790 8.54 9.00 8.46 35 LotsOfNums_01 44449 8.43 9.59 8.21 36 TooManyTo_001 43072 7.56 5.47 7.96 37 TR_XM_DK_Bayes2 41694 6.56 0.50 7.70 38 HTML_IMAGE_RATIO_02 41450 7.92 9.30 7.66 39 UNPARSEABLE_RELAY 40971 7.14 4.87 7.57 40 XM_DKIMWhitelistDomains 39937 6.21 0.00 7.38 41 BAYES_99 38662 11.01 31.53 7.14 42 LOTS_OF_MONEY 38281 8.48 15.93 7.07 43 RCVD_IN_RP_SAFE 38122 5.98 0.34 7.04 44 XM_B_Phish_Phrases 37352 7.68 11.85 6.90 45 BAYES_60 37173 7.16 8.74 6.87 46 XM_SendGrid 36686 6.31 3.82 6.78 47 RCVD_IN_RP_CERTIFIED 35798 5.59 0.19 6.61 48 IN_ZIMBRA_NJ_WHITELIST 31561 4.92 0.12 5.83 49 RELAYCOUNTRY_META 31240 10.64 36.48 5.77 50 BAYES_999 30487 8.54 24.00 5.63 51 XM_B_SpammyWords3 30021 6.52 11.68 5.54 52 HTML_IMAGE_RATIO_04 29100 5.14 3.88 5.37 53 MIME_QP_LONG_LINE 28216 4.67 1.79 5.21 54 BOTNET_IPINHOSTNAME 27503 6.82 16.07 5.08 55 XM_H_Long_From01 27468 5.06 5.01 5.07 56 MPART_ALT_DIFF 26726 6.00 11.65 4.94 57 T_TooManySym_01 26400 4.44 2.13 4.88 58 BAYES_40 25287 4.31 2.41 4.67 59 XMStrtUSub 24944 4.86 6.20 4.61 60 XMSexyCombo_05 24452 5.91 13.29 4.52 61 RCVD_IN_IADB_LISTED 24396 4.00 1.30 4.51 62 BAYES_80 24372 5.14 8.51 4.50 63 XM_PDF 24221 3.98 1.33 4.47 64 TR_XM_DK_SendGrid 21961 3.72 1.94 4.06 65 XMSubMetaSx_00 21821 4.43 6.52 4.03 66 RCVD_IN_IADB_SPF 21202 3.47 1.08 3.92 67 BAYES_20 20240 3.47 2.02 3.74 68 HTML_IMAGE_RATIO_06 19989 3.50 2.51 3.69 69 T_REMOTE_IMAGE 19173 3.99 6.40 3.54 70 RCVD_IN_IADB_SENDERID 18945 3.10 1.00 3.50 71 TM2_M_URI_OPT_OUT 18849 3.42 3.07 3.48 72 RCVD_IN_IADB_DK 18378 3.01 0.99 3.39 73 MIME_HTML_ONLY_MULTI 18033 3.07 1.67 3.33 74 TR_XM_PhishingBody 17892 3.95 7.40 3.30 75 XMNumbers 17765 3.38 3.92 3.28 76 DKIM_INVALID 17667 3.49 4.67 3.26 77 ANY_BOUNCE_MESSAGE 17316 2.99 1.90 3.20 78 BOUNCE_MESSAGE 17308 2.99 1.89 3.20 79 XM_UncommonTLD01 17126 6.26 22.66 3.16 80 XM_H_Trusted_IP 15639 2.43 0.00 2.89 81 HTML_MIME_NO_HTML_TAG 15502 3.22 5.08 2.86 82 BAYES_05 15265 2.52 0.94 2.82 83 RCVD_IN_IADB_VOUCHED 15186 2.47 0.71 2.80 84 BAYES_95 14120 2.92 4.59 2.61 85 T_TooManySym_02 14064 2.28 0.60 2.60 86 MAILING_LIST_MULTI 13914 2.38 1.38 2.57 87 XM_B_Unsub2 13586 2.54 2.69 2.51 88 UNTRUSTED_Relay 13478 6.46 27.53 2.49 89 FROM_EXCESS_BASE64 12945 2.33 2.00 2.39 90 HTML_IMAGE_RATIO_08 12373 2.26 2.12 2.29 91 MIME_HTML_MOSTLY 11928 3.54 10.62 2.20 92 TR_XM_SB_Phish 11672 2.38 3.55 2.16 93 TooManyTo_002 11608 1.94 0.87 2.14 94 URI_NOVOWEL 11577 2.07 1.71 2.14 95 HELO_NODOT 11526 2.00 1.31 2.13 96 HELO_NO_DOMAIN 11525 2.00 1.31 2.13 97 XMDiploma_00 11469 2.19 2.57 2.12 98 XMSubPhish11 11437 2.32 3.45 2.11 99 BOTNET 11355 6.11 27.42 2.10 100 XM_B_SpammyTLD 10586 2.25 3.80 1.96 101 LH_URI_DOM_IN_PATH 10453 2.12 3.14 1.93 102 XM_B_COVIDMETA 10294 2.38 4.92 1.90 103 RCVD_IN_IADB_OPTIN 10113 1.66 0.55 1.87 104 XM_B_Phish66 10078 2.29 4.59 1.86 105 RCVD_IN_MSPIKE_H5 9769 1.57 0.36 1.80 106 XM_SPF_SoftFail 9640 2.50 6.32 1.78 107 URI_HEX 9572 1.93 2.76 1.77 108 KHOP_HELO_FCRDNS 9407 2.30 5.27 1.74 109 T_XMDrugObfuBody_08 9346 1.99 3.39 1.73 110 SUBJ_ALL_CAPS 9341 2.24 4.95 1.73 111 TR_Symld_Words 9196 1.75 2.01 1.70 112 TVD_RCVD_IP 9189 1.50 0.46 1.70 113 T_XMDrugObfuBody_14 9168 1.85 2.71 1.69 114 XM_DK_Undo_01 9024 1.55 0.95 1.67 115 RELAYCOUNTRY_CA 8997 2.43 6.50 1.66 116 XM_CamelCaseFrm001 8836 1.73 2.25 1.63 117 XM_ShortIntro_01 8355 1.51 1.32 1.54 118 TooManyTo_003 7961 1.33 0.60 1.47 119 HELO_MISC_IP 7806 1.30 0.56 1.44 120 CK_HELO_DYNAMIC_SPLIT_IP 7798 1.36 0.94 1.44 121 XM_OfRef6 7493 1.93 4.85 1.38 122 INVALID_MSGID 7372 1.30 0.95 1.36 123 XM_B_Crypto 7231 1.17 0.30 1.34 124 IN_HORDE_ADDRESS_BOOK 7152 1.16 0.33 1.32 125 PDS_BTC_ID 7044 1.12 0.19 1.30 126 XM_UB50 6818 3.03 12.43 1.26 127 URI_TRY_3LD 6697 1.27 1.45 1.24 128 USER_IN_DEF_DKIM_WL 6670 1.04 0.02 1.23 129 XMCapTrack 6646 1.12 0.54 1.23 130 RCVD_IN_MSPIKE_BL 6643 2.52 9.37 1.23 131 RCVD_IN_BL_SPAMCOP_NET 6500 2.71 10.72 1.20 132 XMBrknScrpt_02 6481 1.96 6.02 1.20 133 TM2_M_VERY_LONG_WORD 6440 1.53 3.37 1.19 134 T_FILL_THIS_FORM_SHORT 6389 1.38 2.46 1.18 135 TO_MALFORMED 6373 1.00 0.03 1.18 136 HTTPS_HTTP_MISMATCH 6358 1.17 1.12 1.17 137 HTML_FONT_FACE_BAD 6304 1.11 0.81 1.16 138 XMGappySubj_01 6103 1.02 0.43 1.13 139 XMStockSpam_06 6074 1.15 1.31 1.12 140 XMBody_17 6051 1.89 5.97 1.12 141 MISSING_HEADERS 5965 1.12 1.22 1.10 142 TooManyTo_004 5903 1.00 0.51 1.09 143 XM_H_Long_From02 5883 1.02 0.65 1.09 144 XM_GoogleGroups 5855 0.96 0.34 1.08 145 XMNoVowels 5800 0.98 0.50 1.07 146 XMSubNoVowel 5713 1.13 1.50 1.06 147 XM_ProductURIs 5659 0.95 0.47 1.05 148 DKIM_ADSP_CUSTOM_MED 5634 1.10 1.39 1.04 149 T_TooManySym_03 5592 0.89 0.16 1.03 150 XMGenDplmaNmb 5433 1.07 1.41 1.00 151 TooManyTo_005 4936 0.83 0.39 0.91 152 TR_MSPIKEBAYES00 4862 0.76 0.01 0.90 153 RELAYCOUNTRY_GB 4802 0.95 1.29 0.89 154 XMSubEmpty 4730 0.93 1.22 0.87 155 XMSubMetaI_00 4711 0.91 1.09 0.87 156 SpammyFromTLD_01 4461 1.97 8.07 0.82 157 TR_Sbj_FN_Bdy 4455 0.85 1.02 0.82 158 XMBdyGiftCard01 4399 0.81 0.82 0.81 159 XMHTML_After_End 4201 0.85 1.24 0.78 160 NML_ADSP_CUSTOM_MED 4095 0.84 1.30 0.76 161 XM_E_Blogspot 4080 0.65 0.09 0.75 162 XMBody_95 4005 0.63 0.06 0.74 163 T_OBFU_PDF_ATTACH 3973 0.64 0.16 0.73 164 XMSexyCombo_01 3968 0.95 2.10 0.73 165 TR_MetaPhish_Combo_01 3952 0.73 0.75 0.73 166 RCVD_IN_MSPIKE_L3 3873 1.27 4.22 0.72 167 XMNoSubject 3864 0.73 0.84 0.71 168 MISSING_SUBJECT 3864 0.73 0.84 0.71 169 XM_SPF_Unknown 3707 0.76 1.19 0.68 170 RELAYCOUNTRY_NL 3601 0.68 0.79 0.67 171 XM_B_SpammyWords4 3511 0.82 1.76 0.65 172 T_XMHurry_00 3501 0.78 1.46 0.65 173 XMSubMetaSxObfu_02 3457 0.58 0.26 0.64 174 DKIM_ADSP_NXDOMAIN 3360 1.01 3.05 0.62 175 REPLYTO_WITHOUT_TO_CC 3286 0.64 0.84 0.61 176 T_TooManySym_04 3109 0.49 0.05 0.57 177 XMMoneyMeta_00 3088 0.72 1.51 0.57 178 XM_DIRTYINTL 3076 1.59 6.99 0.57 179 DIET_1 3069 0.79 1.95 0.57 180 XMPhish14 3052 0.62 0.90 0.56 181 XMHTMLBadTable_001 3039 0.55 0.46 0.56 182 TM2_M_A_HREF_HREF 3014 0.60 0.83 0.56 183 T_XMDrugObfuBody_00 3003 1.01 3.42 0.55 184 TR_BOTNET_NEGATE 2948 0.54 0.52 0.54 185 TR_LOTS_OF_MONEY3 2838 0.75 1.92 0.52 186 NUMERIC_HTTP_ADDR 2837 0.56 0.76 0.52 187 XM_H_PHPMailer 2828 0.59 0.94 0.52 188 T_Symld_Words_02 2811 0.62 1.15 0.52 189 TR_XM_COVIDMETA4 2743 0.84 2.63 0.51 190 HTML_IMAGE_ONLY_28 2741 0.48 0.31 0.51 191 FROM_GOV_DKIM_AU 2716 0.44 0.11 0.50 192 XMLKML 2712 0.42 0.00 0.50 193 RCVD_IN_SORBS_DUL 2655 0.45 0.24 0.49 194 XMBody_78 2606 0.61 1.26 0.48 195 T_PDS_OTHER_BAD_TLD 2579 0.75 2.19 0.48 196 HTML_IMAGE_ONLY_20 2574 0.46 0.38 0.48 197 FORGED_GMAIL_RCVD 2553 0.59 1.19 0.47 198 TR_XM_UnparsRelay 2471 0.72 2.10 0.46 199 TM2_M_BODY_EMPTY 2443 0.40 0.11 0.45 200 XM_B_REG_HTML 2440 0.39 0.07 0.45 ----------------------------------------------------------------------