Email: 756887 Autolearn: 0 AvgScore: 2.07 AvgScanTime: 1.37 sec Spam: 208027 Autolearn: 0 AvgScore: 14.12 AvgScanTime: 1.51 sec Ham: 548860 Autolearn: 0 AvgScore: -2.49 AvgScanTime: 1.32 sec Time Spent Running SA: 287.78 hours Time Spent Processing Spam: 87.15 hours Time Spent Processing Ham: 200.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 200047 91.32 96.16 89.48 2 DCC_CHECK 164663 46.34 79.15 33.90 3 DKIM_SIGNED 164110 70.71 78.89 67.61 4 XM_DK_Pass 159603 69.19 76.72 66.33 5 DKIM_VALID 155764 67.30 74.88 64.42 6 XM_B_Unicode 153248 73.08 73.67 72.85 7 RELAYCOUNTRY_US 151034 80.64 72.60 83.69 8 XMListUnsubscribeExists 137708 50.48 66.20 44.53 9 XM_B_SpammyWords 133933 51.87 64.38 47.12 10 DKIM_VALID_AU 120981 50.99 58.16 48.27 11 XM_DK_Undo_02 89917 16.18 43.22 5.93 12 XM_B_Unicode3 75772 41.59 36.42 43.55 13 XM_B_SpammyWords2 74599 23.11 35.86 18.27 14 BAYES_50 72460 46.53 34.83 50.96 15 MIME_HTML_ONLY 70578 25.78 33.93 22.70 16 HTML_FONT_LOW_CONTRAST 70025 26.51 33.66 23.80 17 TR_XM_DKIM_Undo 69617 12.43 33.47 4.45 18 LOC_TINY_FONT_1 68575 23.86 32.96 20.41 19 BAYES_99 66439 11.43 31.94 3.66 20 DKIM_VALID_EF 58845 26.97 28.29 26.47 21 RCVD_IN_MSPIKE_H2 57674 25.07 27.72 24.06 22 XMSubLong 54889 23.11 26.39 21.86 23 RELAYCOUNTRY_META 53595 10.45 25.76 4.64 24 FVGT_m_MULTI_ODD 52270 21.18 25.13 19.68 25 T_KAM_HTML_FONT_INVALID 52013 18.39 25.00 15.88 26 BAYES_999 50856 8.82 24.45 2.89 27 TR_DCC_Bayes_99 49394 7.76 23.74 1.70 28 T_TM2_M_HEADER_IN_MSG 45323 24.48 21.79 25.50 29 BOTNET 43957 6.82 21.13 1.40 30 DCC_CHECK_NEGATIVE 40030 51.91 19.24 64.30 31 UNTRUSTED_Relay 39344 6.40 18.91 1.66 32 XM_Multi_Part_URI 38589 12.59 18.55 10.33 33 FSL_BULK_SIG 37532 8.51 18.04 4.90 34 XM_B_Unsub 34184 11.25 16.43 9.28 35 XM_Body_Dirty_Words 33908 12.94 16.30 11.66 36 RCVD_IN_MSPIKE_WL 32878 22.46 15.80 24.98 37 BOTNET_IPINHOSTNAME 28734 6.67 13.81 3.96 38 TR_XM_SpammyWords2 26882 4.02 12.92 0.64 39 LOTS_OF_MONEY 26029 8.26 12.51 6.65 40 XM_UncommonTLD01 25423 5.53 12.22 3.00 41 XM_B_SpammyWords3 23925 6.29 11.50 4.31 42 BAYES_80 21931 5.68 10.54 3.84 43 RCVD_IN_MSPIKE_BL 21699 3.59 10.43 1.00 44 XM_B_Phish_Phrases 20624 7.06 9.91 5.98 45 MPART_ALT_DIFF 19770 9.57 9.50 9.60 46 XMSexyCombo_05 19664 5.16 9.45 3.53 47 LotsOfNums_01 19453 8.19 9.35 7.76 48 HTML_SHORT_LINK_IMG_1 19377 2.58 9.31 0.03 49 XM_Evil_Numbers_Gen 19173 8.56 9.22 8.31 50 RCVD_IN_MSPIKE_H3 17697 12.28 8.51 13.72 51 RCVD_IN_BL_SPAMCOP_NET 17586 3.04 8.45 0.98 52 XMBrknScrpt_02 16292 2.78 7.83 0.87 53 BAYES_60 16064 7.24 7.72 7.06 54 T_REMOTE_IMAGE 15735 4.35 7.56 3.14 55 HTML_MIME_NO_HTML_TAG 15623 3.48 7.51 1.96 56 MIME_HTML_MOSTLY 15303 3.73 7.36 2.35 57 HTML_IMAGE_RATIO_02 14378 6.02 6.91 5.68 58 XMSubMetaSx_00 14028 4.28 6.74 3.34 59 RCVD_IN_MSPIKE_H4 13655 8.26 6.56 8.91 60 BOTNET_NORDNS 12764 1.69 6.14 0.01 61 TR_XM_SpammyWords3 12469 2.10 5.99 0.63 62 URIBL_SBL_A 12047 1.77 5.79 0.25 63 RELAYCOUNTRY_CA 12022 2.72 5.78 1.56 64 KHOP_HELO_FCRDNS 11849 2.61 5.70 1.44 65 XMNumbers 11800 3.85 5.67 3.16 66 TooManyTo_001 11796 6.81 5.67 7.24 67 RCVD_IN_MSPIKE_L3 11771 2.08 5.66 0.73 68 BAYES_95 11683 3.20 5.62 2.29 69 HTML_IMAGE_RATIO_04 11658 12.25 5.60 14.77 70 XM_H_Long_From01 11536 4.83 5.55 4.56 71 XM_UB50 11401 2.12 5.48 0.84 72 TR_XM_PhishingBody 11350 3.59 5.46 2.88 73 XMBody_17 11246 2.06 5.41 0.79 74 UNPARSEABLE_RELAY 11005 6.58 5.29 7.06 75 RELAYCOUNTRY_FR 10928 1.62 5.25 0.24 76 HTML_IMAGE_RATIO_06 10439 4.94 5.02 4.91 77 DKIM_ADSP_NXDOMAIN 10227 1.71 4.92 0.49 78 HTML_IMAGE_ONLY_08 10204 1.43 4.91 0.11 79 SpammyFromTLD_01 9979 1.99 4.80 0.92 80 HTML_IMAGE_ONLY_12 9750 1.42 4.69 0.18 81 BOGUS_MIME_VERSION 9505 1.26 4.57 0.00 82 HDRS_MISSP 9463 1.27 4.55 0.03 83 BODY_URI_ONLY 9312 1.26 4.48 0.04 84 XM_SendGrid 9132 5.81 4.39 6.35 85 INVALID_DATE 9026 1.22 4.34 0.03 86 SpammyFromTLD_02 8984 1.40 4.32 0.29 87 HDRS_LCASE_IMGONLY 8935 1.19 4.30 0.02 88 LOCALPART_IN_SUBJECT 8894 1.19 4.28 0.02 89 RCVD_DOTEDU_SHORT 8882 1.19 4.27 0.03 90 TO_NAME_SUBJ_NO_RDNS 8862 1.17 4.26 0.00 91 XM_OfRef6 8785 2.00 4.22 1.16 92 RCVD_IN_MSPIKE_L5 8714 1.32 4.19 0.23 93 RCVD_IN_RP_RNBL 8713 1.22 4.19 0.10 94 DKIM_INVALID 8346 3.41 4.01 3.18 95 XM_SPF_SoftFail 8343 2.21 4.01 1.53 96 T_XMDrugObfuBody_08 8276 2.14 3.98 1.44 97 XM_B_COVIDMETA 8210 1.99 3.95 1.25 98 XM_UB80 7881 1.06 3.79 0.02 99 T_FONT_INVIS_NAKED_TO 7762 2.22 3.73 1.64 100 HTML_IMAGE_RATIO_08 7031 2.45 3.38 2.10 101 XMStrtUSub 6957 8.50 3.34 10.46 102 XM_B_Phish66 6880 2.23 3.31 1.83 103 URI_HEX 6867 1.78 3.30 1.20 104 BAYES_00 6798 14.88 3.27 19.29 105 RCVD_IN_RP_SAFE 6626 5.23 3.19 6.01 106 LH_URI_DOM_IN_PATH 6620 2.09 3.18 1.67 107 XMDiploma_00 6551 1.97 3.15 1.52 108 XM_UB99 6527 0.87 3.14 0.01 109 XM_B_SpammyTLD 6477 2.12 3.11 1.74 110 URI_TRY_3LD 6113 1.63 2.94 1.14 111 TM2_M_URI_OPT_OUT 5940 2.75 2.86 2.70 112 HTML_FONT_SIZE_LARGE 5748 0.82 2.76 0.08 113 XM_UB60 5596 0.81 2.69 0.09 114 TR_XM_MaxBayes 5573 0.75 2.68 0.01 115 TR_LOTS_OF_MONEY3 5513 1.13 2.65 0.56 116 BAYES_40 5479 4.33 2.63 4.97 117 MIME_QP_LONG_LINE 5454 4.38 2.62 5.05 118 FROM_EXCESS_BASE64 5313 2.39 2.55 2.32 119 RELAYCOUNTRY_DE 5278 1.07 2.54 0.52 120 RCVD_IN_RP_CERTIFIED 5130 4.60 2.47 5.41 121 BAYES_20 5119 4.07 2.46 4.68 122 TR_XM_DK_SendGrid 5078 3.43 2.44 3.81 123 TR_XM_MaxSPIKE 5044 0.69 2.42 0.03 124 RCVD_IN_PSBL 5019 0.67 2.41 0.01 125 PDS_OTHER_BAD_TLD 5014 0.93 2.41 0.36 126 MIME_HTML_ONLY_MULTI 4971 6.32 2.39 7.81 127 T_Symld_Words_02 4907 1.13 2.36 0.67 128 US_DOLLARS_3 4813 1.36 2.31 1.00 129 XM_DIRTYINTL 4767 1.05 2.29 0.58 130 T_TooManySym_01 4761 4.33 2.29 5.11 131 SUBJ_ALL_CAPS 4759 1.77 2.29 1.58 132 TM2_M_VERY_LONG_WORD 4732 1.36 2.27 1.01 133 RCVD_IN_IADB_LISTED 4694 4.18 2.26 4.91 134 URI_PHP_REDIR 4573 0.61 2.20 0.00 135 XM_B_Unsub2 4463 2.24 2.15 2.28 136 RELAYCOUNTRY_UA 4453 0.59 2.14 0.00 137 RELAYCOUNTRY_GB 4437 1.35 2.13 1.06 138 XM_CamelCaseFrm001 4369 1.72 2.10 1.58 139 T_XMDrugObfuBody_00 4283 1.21 2.06 0.89 140 FROM_SUSPICIOUS_NTLD 4264 0.61 2.05 0.07 141 XM_UB999 4241 0.57 2.04 0.01 142 TR_XM_SB_Phish 4140 1.86 1.99 1.81 143 XM_UB95 4058 0.54 1.95 0.01 144 URI_NOVOWEL 4048 2.13 1.95 2.20 145 RCVD_IN_IADB_SPF 4023 3.65 1.93 4.30 146 TR_XM_COVIDMETA4 4022 0.93 1.93 0.55 147 XMSubPhish11 3975 1.82 1.91 1.79 148 XM_B_SpammyWords4 3908 0.80 1.88 0.39 149 TR_XM_RelayPhish 3846 0.57 1.85 0.08 150 FROM_SUSPICIOUS_NTLD_FP 3770 0.55 1.81 0.07 151 T_XMHurry_00 3729 0.94 1.79 0.62 152 RCVD_IN_IADB_SENDERID 3675 3.28 1.77 3.86 153 RCVD_IN_IADB_DK 3641 3.19 1.75 3.73 154 T_XMDrugObfuBody_14 3604 1.51 1.73 1.42 155 XM_BadFromFormat 3496 0.55 1.68 0.13 156 MAILING_LIST_MULTI 3482 2.17 1.67 2.36 157 LongTLD 3455 0.57 1.66 0.16 158 HTML_TAG_BALANCE_BODY 3430 0.74 1.65 0.39 159 TR_XM_PHPDW 3333 0.65 1.60 0.29 160 TR_XM_PHPForged 3312 0.63 1.59 0.27 161 XMSexyCombo_01 3307 1.10 1.59 0.91 162 XMStockSpam_06 3285 1.16 1.58 1.01 163 TR_XM_FormFill2 3284 0.63 1.58 0.27 164 XM_H_PHPOS 3282 0.62 1.58 0.26 165 TR_XM_UnparsRelay 3143 0.58 1.51 0.23 166 XM_DK_Undo_01 3088 1.48 1.48 1.48 167 T_FILL_THIS_FORM_SHORT 3086 0.98 1.48 0.79 168 XMSlimDrugH 3071 0.63 1.48 0.31 169 NO_DNS_FOR_FROM 3059 0.73 1.47 0.45 170 XMGenDplmaNmb 2989 0.95 1.44 0.77 171 TR_XM_COVIDMETA1 2937 0.69 1.41 0.42 172 TR_Mismatch_TLD_01 2927 0.52 1.41 0.19 173 XM_URI_RBL 2923 0.51 1.41 0.17 174 FVGT_m_MULTI_ODD_EMAIL 2906 0.41 1.40 0.03 175 RELAYCOUNTRY_IN 2846 0.50 1.37 0.17 176 TR_Symld_Words 2539 2.38 1.22 2.82 177 XMHTML_After_End 2457 0.86 1.18 0.74 178 DATE_IN_PAST_03_06 2418 0.41 1.16 0.13 179 RCVD_IN_IADB_VOUCHED 2353 2.44 1.13 2.93 180 HTML_IMAGE_ONLY_28 2342 0.58 1.13 0.37 181 TR_Caps_n_Bayes_99 2298 0.32 1.10 0.03 182 FROM_MISSP_REPLYTO 2221 0.30 1.07 0.01 183 TR_BOTNET_NEGATE 2173 0.52 1.04 0.33 184 DKIM_ADSP_CUSTOM_MED 2147 1.10 1.03 1.12 185 HK_RANDOM_FROM 2145 0.38 1.03 0.13 186 XM_Combo_Sbj 2140 0.47 1.03 0.25 187 TR_XM_INV_DKIM 2136 0.35 1.03 0.10 188 XMBdyGiftCard01 2105 0.72 1.01 0.60 189 RDNS_DYNAMIC 2084 0.57 1.00 0.41 190 ALL_TRUSTED 2078 9.70 1.00 13.00 191 BAYES_05 2044 2.64 0.98 3.27 192 XMSubNoVowel 2016 3.06 0.97 3.86 193 TR_Mismatch_TLD_02 1956 0.32 0.94 0.08 194 XM_SPF_Unknown 1947 0.68 0.94 0.59 195 TR_LOTS_OF_MONEY2 1945 0.41 0.93 0.21 196 T_MONEY_PERCENT 1945 0.41 0.93 0.21 197 REMOVE_BEFORE_LINK 1945 0.41 0.93 0.21 198 SUBJ_BUY 1944 0.36 0.93 0.14 199 TVD_SPACE_RATIO 1914 0.51 0.92 0.35 200 URIBL_BLACK 1911 0.27 0.92 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 491129 91.32 96.16 89.48 2 RELAYCOUNTRY_US 459319 80.64 72.60 83.69 3 XM_B_Unicode 399858 73.08 73.67 72.85 4 DKIM_SIGNED 371057 70.71 78.89 67.61 5 XM_DK_Pass 364070 69.19 76.72 66.33 6 DKIM_VALID 353597 67.30 74.88 64.42 7 DCC_CHECK_NEGATIVE 352891 51.91 19.24 64.30 8 BAYES_50 279687 46.53 34.83 50.96 9 DKIM_VALID_AU 264956 50.99 58.16 48.27 10 XM_B_SpammyWords 258639 51.87 64.38 47.12 11 XMListUnsubscribeExists 244390 50.48 66.20 44.53 12 XM_B_Unicode3 239038 41.59 36.42 43.55 13 DCC_CHECK 186081 46.34 79.15 33.90 14 DKIM_VALID_EF 145275 26.97 28.29 26.47 15 T_TM2_M_HEADER_IN_MSG 139975 24.48 21.79 25.50 16 RCVD_IN_MSPIKE_WL 137124 22.46 15.80 24.98 17 RCVD_IN_MSPIKE_H2 132056 25.07 27.72 24.06 18 HTML_FONT_LOW_CONTRAST 130611 26.51 33.66 23.80 19 MIME_HTML_ONLY 124566 25.78 33.93 22.70 20 XMSubLong 120008 23.11 26.39 21.86 21 LOC_TINY_FONT_1 112038 23.86 32.96 20.41 22 FVGT_m_MULTI_ODD 108020 21.18 25.13 19.68 23 BAYES_00 105863 14.88 3.27 19.29 24 XM_B_SpammyWords2 100297 23.11 35.86 18.27 25 T_KAM_HTML_FONT_INVALID 87145 18.39 25.00 15.88 26 HTML_IMAGE_RATIO_04 81074 12.25 5.60 14.77 27 RCVD_IN_MSPIKE_H3 75286 12.28 8.51 13.72 28 XM_H_Trusted_IP 71372 9.43 0.00 13.00 29 ALL_TRUSTED 71327 9.70 1.00 13.00 30 HTML_FONT_FACE_BAD 69764 9.42 0.74 12.71 31 XM_Body_Dirty_Words 64000 12.94 16.30 11.66 32 XMStrtUSub 57401 8.50 3.34 10.46 33 XM_Multi_Part_URI 56709 12.59 18.55 10.33 34 MPART_ALT_DIFF 52671 9.57 9.50 9.60 35 XM_B_Unsub 50945 11.25 16.43 9.28 36 RCVD_IN_MSPIKE_H4 48897 8.26 6.56 8.91 37 TR_XM_DK_Bayes 46666 6.39 0.83 8.50 38 XM_Evil_Numbers_Gen 45626 8.56 9.22 8.31 39 TR_XM_DK_Bayes1 45303 6.21 0.81 8.25 40 MIME_HTML_ONLY_MULTI 42840 6.32 2.39 7.81 41 LotsOfNums_01 42567 8.19 9.35 7.76 42 TR_XM_DK_Bayes2 40081 5.50 0.73 7.30 43 TooManyTo_001 39718 6.81 5.67 7.24 44 UNPARSEABLE_RELAY 38775 6.58 5.29 7.06 45 BAYES_60 38724 7.24 7.72 7.06 46 XM_DKIMWhitelistDomains 37118 4.91 0.03 6.76 47 LOTS_OF_MONEY 36503 8.26 12.51 6.65 48 XM_SendGrid 34844 5.81 4.39 6.35 49 RCVD_IN_RP_SAFE 32989 5.23 3.19 6.01 50 XM_B_Phish_Phrases 32815 7.06 9.91 5.98 51 XM_DK_Undo_02 32543 16.18 43.22 5.93 52 IN_ZIMBRA_NJ_WHITELIST 32361 4.29 0.06 5.90 53 HTML_IMAGE_RATIO_02 31154 6.02 6.91 5.68 54 RCVD_IN_RP_CERTIFIED 29667 4.60 2.47 5.41 55 T_TooManySym_01 28028 4.33 2.29 5.11 56 MIME_QP_LONG_LINE 27724 4.38 2.62 5.05 57 BAYES_40 27265 4.33 2.63 4.97 58 RCVD_IN_IADB_LISTED 26953 4.18 2.26 4.91 59 HTML_IMAGE_RATIO_06 26949 4.94 5.02 4.91 60 FSL_BULK_SIG 26916 8.51 18.04 4.90 61 BAYES_20 25698 4.07 2.46 4.68 62 RELAYCOUNTRY_META 25475 10.45 25.76 4.64 63 XM_H_Long_From01 25025 4.83 5.55 4.56 64 TR_XM_DKIM_Undo 24449 12.43 33.47 4.45 65 XM_B_SpammyWords3 23665 6.29 11.50 4.31 66 RCVD_IN_IADB_SPF 23579 3.65 1.93 4.30 67 BOTNET_IPINHOSTNAME 21726 6.67 13.81 3.96 68 XM_PDF 21243 3.05 0.87 3.87 69 RCVD_IN_IADB_SENDERID 21171 3.28 1.77 3.86 70 XMSubNoVowel 21168 3.06 0.97 3.86 71 BAYES_80 21054 5.68 10.54 3.84 72 TR_XM_DK_SendGrid 20903 3.43 2.44 3.81 73 RCVD_IN_IADB_DK 20467 3.19 1.75 3.73 74 BAYES_99 20070 11.43 31.94 3.66 75 XMSexyCombo_05 19360 5.16 9.45 3.53 76 XMSubMetaSx_00 18353 4.28 6.74 3.34 77 BAYES_05 17937 2.64 0.98 3.27 78 DKIM_INVALID 17460 3.41 4.01 3.18 79 XMNumbers 17348 3.85 5.67 3.16 80 T_REMOTE_IMAGE 17208 4.35 7.56 3.14 81 XM_UncommonTLD01 16454 5.53 12.22 3.00 82 RCVD_IN_IADB_VOUCHED 16090 2.44 1.13 2.93 83 BAYES_999 15879 8.82 24.45 2.89 84 TR_XM_PhishingBody 15791 3.59 5.46 2.88 85 TR_Symld_Words 15500 2.38 1.22 2.82 86 ANY_BOUNCE_MESSAGE 15378 2.17 0.50 2.80 87 BOUNCE_MESSAGE 15326 2.16 0.50 2.79 88 TM2_M_URI_OPT_OUT 14845 2.75 2.86 2.70 89 MAILING_LIST_MULTI 12951 2.17 1.67 2.36 90 RCVD_IN_MSPIKE_H5 12941 1.91 0.73 2.36 91 MIME_HTML_MOSTLY 12892 3.73 7.36 2.35 92 FROM_EXCESS_BASE64 12749 2.39 2.55 2.32 93 BAYES_95 12542 3.20 5.62 2.29 94 XM_B_Unsub2 12525 2.24 2.15 2.28 95 URI_NOVOWEL 12052 2.13 1.95 2.20 96 HTML_IMAGE_RATIO_08 11516 2.45 3.38 2.10 97 HTML_MIME_NO_HTML_TAG 10751 3.48 7.51 1.96 98 T_TooManySym_02 10635 1.58 0.64 1.94 99 TooManyTo_002 10500 1.55 0.59 1.91 100 RCVD_IN_IADB_OPTIN 10186 1.57 0.81 1.86 101 XM_B_Phish66 10026 2.23 3.31 1.83 102 TR_XM_SB_Phish 9943 1.86 1.99 1.81 103 XMSubPhish11 9828 1.82 1.91 1.79 104 XM_B_SpammyTLD 9539 2.12 3.11 1.74 105 TR_DCC_Bayes_99 9307 7.76 23.74 1.70 106 LH_URI_DOM_IN_PATH 9188 2.09 3.18 1.67 107 UNTRUSTED_Relay 9102 6.40 18.91 1.66 108 T_FONT_INVIS_NAKED_TO 9004 2.22 3.73 1.64 109 HELO_NODOT 8800 1.41 0.90 1.60 110 HELO_NO_DOMAIN 8799 1.41 0.89 1.60 111 SUBJ_ALL_CAPS 8670 1.77 2.29 1.58 112 XM_CamelCaseFrm001 8656 1.72 2.10 1.58 113 RELAYCOUNTRY_CA 8585 2.72 5.78 1.56 114 XMSubGarbage 8562 1.18 0.18 1.56 115 XM_SPF_SoftFail 8406 2.21 4.01 1.53 116 XMDiploma_00 8335 1.97 3.15 1.52 117 XM_DK_Undo_01 8138 1.48 1.48 1.48 118 XMSubLongNoVowel 8078 1.13 0.24 1.47 119 KHOP_HELO_FCRDNS 7912 2.61 5.70 1.44 120 T_XMDrugObfuBody_08 7887 2.14 3.98 1.44 121 T_XMDrugObfuBody_14 7795 1.51 1.73 1.42 122 BOTNET 7687 6.82 21.13 1.40 123 INVALID_MSGID 7654 1.08 0.26 1.39 124 IN_HORDE_ADDRESS_BOOK 7606 1.06 0.18 1.39 125 TVD_RCVD_IP 7424 1.06 0.29 1.35 126 XM_B_COVIDMETA 6865 1.99 3.95 1.25 127 TooManyTo_003 6860 1.02 0.41 1.25 128 URI_HEX 6576 1.78 3.30 1.20 129 TO_MALFORMED 6469 0.86 0.01 1.18 130 XM_OfRef6 6385 2.00 4.22 1.16 131 FORGED_MUA_OUTLOOK 6343 0.88 0.14 1.16 132 XMGappySubj_01 6334 0.88 0.17 1.15 133 XMCapTrack 6329 0.92 0.32 1.15 134 URI_TRY_3LD 6241 1.63 2.94 1.14 135 DKIM_ADSP_CUSTOM_MED 6147 1.10 1.03 1.12 136 XM_ShortIntro_01 6138 0.97 0.59 1.12 137 HELO_MISC_IP 6082 0.91 0.39 1.11 138 CK_HELO_DYNAMIC_SPLIT_IP 6074 0.97 0.62 1.11 139 RELAYCOUNTRY_GB 5795 1.35 2.13 1.06 140 XM_GoogleGroups 5658 0.87 0.43 1.03 141 TM2_M_VERY_LONG_WORD 5542 1.36 2.27 1.01 142 XMStockSpam_06 5523 1.16 1.58 1.01 143 US_DOLLARS_3 5478 1.36 2.31 1.00 144 RCVD_IN_MSPIKE_BL 5466 3.59 10.43 1.00 145 RCVD_IN_BL_SPAMCOP_NET 5390 3.04 8.45 0.98 146 SpammyFromTLD_01 5062 1.99 4.80 0.92 147 XMBSHREFv2 5031 0.73 0.25 0.92 148 XM_E_Blogspot 5026 0.69 0.08 0.92 149 XMSexyCombo_01 4997 1.10 1.59 0.91 150 USER_IN_DEF_DKIM_WL 4982 0.66 0.01 0.91 151 TooManyTo_004 4928 0.75 0.35 0.90 152 T_XMDrugObfuBody_00 4901 1.21 2.06 0.89 153 XM_H_Long_From02 4897 0.83 0.66 0.89 154 XMBrknScrpt_02 4766 2.78 7.83 0.87 155 XM_UB50 4610 2.12 5.48 0.84 156 T_TooManySym_03 4505 0.64 0.16 0.82 157 T_FILL_THIS_FORM_SHORT 4359 0.98 1.48 0.79 158 XMBody_17 4339 2.06 5.41 0.79 159 TR_MSPIKEBAYES00 4264 0.57 0.03 0.78 160 XMGenDplmaNmb 4234 0.95 1.44 0.77 161 XM_ProductURIs 4180 0.76 0.76 0.76 162 NML_ADSP_CUSTOM_MED 4136 0.76 0.78 0.75 163 HTTPS_HTTP_MISMATCH 4113 0.77 0.82 0.75 164 XMHTML_After_End 4048 0.86 1.18 0.74 165 RCVD_IN_MSPIKE_L3 3982 2.08 5.66 0.73 166 XMBody_95 3760 0.52 0.10 0.69 167 TooManyTo_005 3734 0.58 0.30 0.68 168 T_Symld_Words_02 3662 1.13 2.36 0.67 169 TR_XM_SpammyWords2 3537 4.02 12.92 0.64 170 TR_MetaPhish_Combo_01 3468 0.71 0.91 0.63 171 TR_XM_SpammyWords3 3439 2.10 5.99 0.63 172 T_XMHurry_00 3377 0.94 1.79 0.62 173 XMBdyGiftCard01 3315 0.72 1.01 0.60 174 FORGED_GMAIL_RCVD 3314 0.67 0.83 0.60 175 XM_SPF_Unknown 3220 0.68 0.94 0.59 176 XM_DIRTYINTL 3184 1.05 2.29 0.58 177 T_OBFU_PDF_ATTACH 3114 0.45 0.15 0.57 178 TR_LOTS_OF_MONEY3 3068 1.13 2.65 0.56 179 TR_XM_COVIDMETA4 3043 0.93 1.93 0.55 180 FROM_GOV_DKIM_AU 3001 0.54 0.51 0.55 181 XMHTMLBadTable_001 2880 0.56 0.66 0.52 182 RELAYCOUNTRY_DE 2840 1.07 2.54 0.52 183 XMMoneyMeta_00 2811 0.60 0.84 0.51 184 XMSubMetaSSx_00 2754 0.56 0.72 0.50 185 DKIM_ADSP_NXDOMAIN 2714 1.71 4.92 0.49 186 MISSING_HEADERS 2706 0.48 0.46 0.49 187 XMGetyour 2681 0.43 0.26 0.49 188 XMSexyCombo_04 2674 0.54 0.67 0.49 189 XMSubMetaI_00 2615 0.52 0.64 0.48 190 XM_H_PHPMailer 2613 0.47 0.44 0.48 191 NUMERIC_HTTP_ADDR 2597 0.50 0.57 0.47 192 T_TooManySym_04 2591 0.36 0.05 0.47 193 XMNoVowels 2581 0.42 0.29 0.47 194 XMSolicitRefs_0 2579 0.45 0.41 0.47 195 XM_RXBody 2566 0.46 0.43 0.47 196 XMSubGiftCard1 2535 0.43 0.34 0.46 197 RCVD_IN_SORBS_DUL 2500 0.40 0.27 0.46 198 HTML_IMAGE_ONLY_20 2469 0.47 0.51 0.45 199 MSGID_FROM_MTA_HEADER 2461 0.38 0.20 0.45 200 NO_DNS_FOR_FROM 2453 0.73 1.47 0.45 ----------------------------------------------------------------------