Email: 678912 Autolearn: 0 AvgScore: 3.90 AvgScanTime: 1.29 sec Spam: 219304 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 1.39 sec Ham: 459608 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 1.24 sec Time Spent Running SA: 243.08 hours Time Spent Processing Spam: 84.40 hours Time Spent Processing Ham: 158.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 209967 91.01 95.74 88.75 2 DKIM_SIGNED 180660 77.94 82.38 75.82 3 XM_DK_Pass 176062 76.40 80.28 74.55 4 DCC_CHECK 171917 52.79 78.39 40.57 5 DKIM_VALID 171730 74.42 78.31 72.56 6 XM_B_Unicode 166045 72.97 75.71 71.66 7 RELAYCOUNTRY_US 156351 79.45 71.29 83.34 8 XM_B_SpammyWords 150282 55.46 68.53 49.22 9 XMListUnsubscribeExists 147066 55.95 67.06 50.65 10 DKIM_VALID_AU 132273 56.55 60.31 54.75 11 XM_DK_Undo_02 103022 20.28 46.98 7.55 12 XM_B_SpammyWords2 86296 27.38 39.35 21.68 13 XM_B_Unicode3 84034 40.69 38.32 41.82 14 TR_XM_DKIM_Undo 81519 15.76 37.17 5.54 15 BAYES_99 79752 15.34 36.37 5.31 16 BAYES_50 74038 48.73 33.76 55.87 17 HTML_FONT_LOW_CONTRAST 73319 29.91 33.43 28.23 18 LOC_TINY_FONT_1 71547 27.22 32.62 24.65 19 MIME_HTML_ONLY 69587 25.27 31.73 22.18 20 DKIM_VALID_EF 67397 28.98 30.73 28.14 21 BAYES_999 62255 11.97 28.39 4.13 22 TR_DCC_Bayes_99 61121 10.97 27.87 2.90 23 RCVD_IN_MSPIKE_H2 59269 26.92 27.03 26.88 24 RELAYCOUNTRY_META 55729 11.31 25.41 4.58 25 T_KAM_HTML_FONT_INVALID 54054 20.29 24.65 18.21 26 XMSubLong 53026 21.35 24.18 19.99 27 FVGT_m_MULTI_ODD 52561 22.97 23.97 22.50 28 T_TM2_M_HEADER_IN_MSG 48469 27.52 22.10 30.11 29 DCC_CHECK_NEGATIVE 43697 45.40 19.93 57.56 30 UNTRUSTED_Relay 43180 7.65 19.69 1.90 31 XM_Multi_Part_URI 41613 14.08 18.98 11.74 32 XM_Body_Dirty_Words 39914 15.26 18.20 13.86 33 LOTS_OF_MONEY 37594 10.81 17.14 7.79 34 RCVD_IN_MSPIKE_WL 36377 24.84 16.59 28.78 35 BOTNET 34813 6.14 15.87 1.50 36 XM_B_Unsub 33720 12.50 15.38 11.12 37 TR_XM_SpammyWords4 33249 8.60 15.16 5.46 38 FSL_BULK_SIG 31921 8.65 14.56 5.84 39 TR_XM_SpammyWords2 31654 5.20 14.43 0.80 40 XM_UncommonTLD01 28091 6.25 12.81 3.13 41 BOTNET_IPINHOSTNAME 26230 6.76 11.96 4.27 42 XM_B_SpammyWords3 25436 7.20 11.60 5.10 43 BAYES_80 24486 6.74 11.17 4.64 44 XMSexyCombo_05 23565 6.47 10.75 4.42 45 MPART_ALT_DIFF 23439 7.96 10.69 6.66 46 LotsOfNums_01 23406 9.45 10.67 8.87 47 HTML_MIME_NO_HTML_TAG 20789 4.93 9.48 2.75 48 RCVD_IN_MSPIKE_BL 20692 3.51 9.44 0.68 49 T_REMOTE_IMAGE 20647 5.45 9.41 3.56 50 RCVD_IN_MSPIKE_H3 19529 13.23 8.90 15.30 51 XM_Evil_Numbers_Gen 19453 8.21 8.87 7.90 52 MIME_HTML_MOSTLY 19158 4.32 8.74 2.21 53 BAYES_60 18298 7.96 8.34 7.78 54 HTML_IMAGE_RATIO_02 17968 7.00 8.19 6.44 55 KHOP_HELO_FCRDNS 17348 3.56 7.91 1.49 56 RCVD_IN_BL_SPAMCOP_NET 16788 3.10 7.66 0.93 57 BODY_URI_ONLY 15803 2.35 7.21 0.03 58 RCVD_IN_MSPIKE_L3 15064 2.55 6.87 0.49 59 RCVD_IN_MSPIKE_H4 14861 9.46 6.78 10.73 60 XMBrknScrpt_02 14794 2.84 6.75 0.97 61 TM2_M_URI_OPT_OUT 14769 4.80 6.73 3.87 62 XM_UB50 14673 2.86 6.69 1.03 63 XMSubMetaSx_00 14442 4.52 6.59 3.53 64 TR_XM_SpammyWords3 14414 2.45 6.57 0.48 65 TR_XM_PhishingBody 13917 4.19 6.35 3.16 66 HTML_IMAGE_ONLY_08 13259 2.03 6.05 0.11 67 TooManyTo_001 13163 7.35 6.00 7.99 68 URIBL_SBL_A 12981 2.07 5.92 0.24 69 RELAYCOUNTRY_CA 12951 3.00 5.91 1.61 70 XM_B_Phish_Phrases 12944 5.58 5.90 5.43 71 HTML_IMAGE_RATIO_04 12825 6.14 5.85 6.28 72 SpammyFromTLD_01 12725 2.38 5.80 0.74 73 BAYES_95 12398 3.79 5.65 2.91 74 RELAYCOUNTRY_FR 11661 1.90 5.32 0.27 75 XM_OfRef6 11053 2.50 5.04 1.28 76 UNPARSEABLE_RELAY 10985 7.15 5.01 8.17 77 TR_LOTS_OF_MONEY3 10731 2.01 4.89 0.64 78 XMNumbers 10257 3.69 4.68 3.21 79 XM_H_Long_From01 9749 5.41 4.45 5.87 80 XM_UB80 9207 1.38 4.20 0.03 81 XMBody_17 9199 1.89 4.19 0.79 82 XM_SendGrid 9066 6.23 4.13 7.23 83 XM_B_Phish66 8998 2.57 4.10 1.84 84 DKIM_INVALID 8930 3.52 4.07 3.26 85 HTML_IMAGE_RATIO_06 8482 3.89 3.87 3.89 86 T_FONT_INVIS_NAKED_TO 8428 2.74 3.84 2.22 87 SpammyFromTLD_02 8390 1.49 3.83 0.37 88 RCVD_IN_RP_SAFE 8055 5.85 3.67 6.90 89 TR_XM_MaxSPIKE 8012 1.19 3.65 0.02 90 TR_XM_MaxBayes 7949 1.18 3.62 0.02 91 XM_UB99 7774 1.15 3.54 0.00 92 TR_XM_SpammyWords5 7768 2.19 3.54 1.54 93 URI_HEX 7724 1.93 3.52 1.18 94 T_XMDrugObfuBody_08 7384 2.33 3.37 1.83 95 XMStrtUSub 7355 4.43 3.35 4.94 96 RELAYCOUNTRY_IN 7347 1.14 3.35 0.09 97 XM_B_SpammyTLD 7114 2.31 3.24 1.87 98 XM_SPF_SoftFail 7063 2.16 3.22 1.65 99 HTML_IMAGE_RATIO_08 6964 2.67 3.18 2.42 100 XM_UB60 6923 1.08 3.16 0.08 101 LH_URI_DOM_IN_PATH 6690 2.11 3.05 1.67 102 RCVD_IN_RP_CERTIFIED 6609 5.19 3.01 6.23 103 PDS_OTHER_BAD_TLD 6476 1.22 2.95 0.39 104 FROM_EXCESS_BASE64 6279 2.80 2.86 2.77 105 XM_DIRTYINTL 6127 1.18 2.79 0.41 106 URI_TRY_3LD 5995 1.96 2.73 1.60 107 T_HTML_TAG_BALANCE_CENTER 5813 0.97 2.65 0.16 108 MIME_QP_LONG_LINE 5777 4.73 2.63 5.72 109 XM_B_Unsub2 5735 2.29 2.62 2.13 110 MIME_HTML_ONLY_MULTI 5727 3.72 2.61 4.25 111 XM_UB999 5667 0.84 2.58 0.00 112 RELAYCOUNTRY_UA 5610 0.83 2.56 0.00 113 TO_NO_BRKTS_HTML_ONLY 5366 0.94 2.45 0.22 114 BOTNET_NORDNS 5284 0.79 2.41 0.02 115 TR_XM_DK_SendGrid 5275 3.81 2.41 4.48 116 XM_B_COVIDMETA 5109 1.49 2.33 1.09 117 XMDiploma_00 5076 1.74 2.31 1.47 118 TR_XM_SB_Phish 5007 2.12 2.28 2.05 119 RCVD_IN_IADB_LISTED 4949 4.59 2.26 5.71 120 XMSubPhish11 4826 2.07 2.20 2.01 121 HTML_FONT_SIZE_LARGE 4727 0.77 2.16 0.10 122 SUBJ_ALL_CAPS 4630 1.78 2.11 1.62 123 T_TooManySym_01 4574 3.74 2.09 4.54 124 TR_Symld_Words 4567 2.04 2.08 2.03 125 T_XMHurry_00 4506 1.18 2.05 0.76 126 XM_CamelCaseFrm001 4495 2.00 2.05 1.98 127 RCVD_IN_MSPIKE_L5 4451 0.75 2.03 0.14 128 T_FILL_THIS_FORM_SHORT 4436 1.31 2.02 0.97 129 ALL_TRUSTED 4331 9.39 1.97 12.92 130 RCVD_IN_IADB_SPF 4323 4.02 1.97 4.99 131 RCVD_IN_RP_RNBL 4283 0.66 1.95 0.05 132 XMSubNoVowel 4254 1.83 1.94 1.77 133 BAYES_40 4161 3.86 1.90 4.79 134 RCVD_IN_IADB_SENDERID 3928 3.60 1.79 4.47 135 RCVD_IN_IADB_DK 3856 3.50 1.76 4.34 136 XMBdyGiftCard01 3767 1.20 1.72 0.96 137 XMSexyCombo_01 3723 1.13 1.70 0.86 138 T_XMDrugObfuBody_14 3708 1.81 1.69 1.86 139 TM2_M_VERY_LONG_WORD 3680 1.32 1.68 1.16 140 XM_DK_Undo_01 3556 1.58 1.62 1.55 141 TR_Mismatch_TLD_01 3540 0.77 1.61 0.37 142 XM_UB95 3442 0.52 1.57 0.01 143 XM_URI_RBL 3442 0.62 1.57 0.17 144 TR_XM_COVIDMETA4 3311 0.71 1.51 0.34 145 XM_B_SpammyWords4 3209 1.09 1.46 0.90 146 TR_XM_UnparsRelay 3179 0.64 1.45 0.25 147 URI_PHP_REDIR 3095 0.46 1.41 0.00 148 FROM_SUSPICIOUS_NTLD 3038 0.51 1.39 0.09 149 XMStockSpam_06 3025 1.21 1.38 1.13 150 TR_XM_INV_DKIM 2997 0.57 1.37 0.18 151 FROM_SUSPICIOUS_NTLD_FP 2941 0.49 1.34 0.09 152 HTML_IMAGE_ONLY_12 2911 0.56 1.33 0.20 153 RELAYCOUNTRY_GB 2792 0.92 1.27 0.76 154 TR_XM_PHPDW 2758 0.62 1.26 0.31 155 MAILING_LIST_MULTI 2744 2.01 1.25 2.37 156 RELAYCOUNTRY_DE 2740 0.70 1.25 0.44 157 TR_XM_PHPForged 2707 0.58 1.23 0.27 158 BAYES_20 2697 2.87 1.23 3.66 159 LongTLD 2694 0.52 1.23 0.18 160 TR_XM_FormFill2 2694 0.58 1.23 0.27 161 TR_XM_COVIDMETA1 2692 0.70 1.23 0.45 162 XM_H_PHPOS 2688 0.58 1.23 0.27 163 URI_NOVOWEL 2642 2.18 1.20 2.65 164 RCVD_IN_IADB_VOUCHED 2602 2.71 1.19 3.43 165 SUBJ_DOLLARS 2592 0.63 1.18 0.37 166 XMGenDplmaNmb 2512 0.87 1.15 0.74 167 XMMoneyMeta_00 2460 0.72 1.12 0.52 168 XMHTML_After_End 2433 0.85 1.11 0.72 169 XM_ProductURIs 2403 1.86 1.10 2.22 170 T_Symld_Words_02 2400 0.64 1.09 0.43 171 TR_XM_FormFill 2392 0.36 1.09 0.01 172 DATE_IN_PAST_03_06 2387 0.39 1.09 0.05 173 XMSubEmpty 2385 0.81 1.09 0.68 174 LOW_PRICE 2377 0.74 1.08 0.57 175 XMSubMetaSxObfu_03 2341 0.64 1.07 0.44 176 XM_OfRef7 2327 0.43 1.06 0.13 177 T_XMDrugObfuBody_00 2303 0.72 1.05 0.56 178 HTML_TAG_BALANCE_BODY 2114 0.65 0.96 0.51 179 TR_Mismatch_TLD_02 2106 0.37 0.96 0.09 180 XM_ShortIntro_01 2100 0.75 0.96 0.65 181 RCVD_IN_PSBL 2080 0.32 0.95 0.02 182 XMPhish30 2068 0.60 0.94 0.44 183 NUMERIC_HTTP_ADDR 2056 0.74 0.94 0.65 184 REMOVE_BEFORE_LINK 2046 0.55 0.93 0.37 185 HK_RANDOM_REPLYTO 2044 0.42 0.93 0.18 186 TR_BOTNET_NEGATE 2032 0.52 0.93 0.33 187 RCVD_IN_MSPIKE_H5 1987 2.15 0.91 2.75 188 XMBody_78 1935 0.60 0.88 0.46 189 XMSubMetaI_00 1931 0.76 0.88 0.71 190 ACT_NOW_CAPS 1926 0.35 0.88 0.10 191 RCVD_IN_IADB_OPTIN 1910 1.81 0.87 2.26 192 SHORTENED_URL_HREF 1904 0.66 0.87 0.55 193 XM_H_Long_From02 1879 0.98 0.86 1.03 194 BAYES_00 1876 8.91 0.86 12.76 195 URI_NO_WWW_BIZ_CGI 1875 0.29 0.85 0.01 196 XM_BadFromFormat 1862 0.37 0.85 0.14 197 XM_PDF 1825 3.41 0.83 4.64 198 HTML_IMAGE_ONLY_32 1774 0.54 0.81 0.41 199 DKIM_ADSP_CUSTOM_MED 1755 0.94 0.80 1.00 200 TR_XM_RelayPhish 1754 0.32 0.80 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 407921 91.01 95.74 88.75 2 RELAYCOUNTRY_US 383024 79.45 71.29 83.34 3 DKIM_SIGNED 348465 77.94 82.38 75.82 4 XM_DK_Pass 342639 76.40 80.28 74.55 5 DKIM_VALID 333502 74.42 78.31 72.56 6 XM_B_Unicode 329363 72.97 75.71 71.66 7 DCC_CHECK_NEGATIVE 264556 45.40 19.93 57.56 8 BAYES_50 256796 48.73 33.76 55.87 9 DKIM_VALID_AU 251623 56.55 60.31 54.75 10 XMListUnsubscribeExists 232780 55.95 67.06 50.65 11 XM_B_SpammyWords 226227 55.46 68.53 49.22 12 XM_B_Unicode3 192194 40.69 38.32 41.82 13 DCC_CHECK 186452 52.79 78.39 40.57 14 T_TM2_M_HEADER_IN_MSG 138397 27.52 22.10 30.11 15 RCVD_IN_MSPIKE_WL 132271 24.84 16.59 28.78 16 HTML_FONT_LOW_CONTRAST 129725 29.91 33.43 28.23 17 DKIM_VALID_EF 129321 28.98 30.73 28.14 18 RCVD_IN_MSPIKE_H2 123522 26.92 27.03 26.88 19 LOC_TINY_FONT_1 113275 27.22 32.62 24.65 20 FVGT_m_MULTI_ODD 103414 22.97 23.97 22.50 21 MIME_HTML_ONLY 101964 25.27 31.73 22.18 22 XM_B_SpammyWords2 99623 27.38 39.35 21.68 23 XMSubLong 91893 21.35 24.18 19.99 24 T_KAM_HTML_FONT_INVALID 83686 20.29 24.65 18.21 25 RCVD_IN_MSPIKE_H3 70298 13.23 8.90 15.30 26 XM_Body_Dirty_Words 63697 15.26 18.20 13.86 27 ALL_TRUSTED 59385 9.39 1.97 12.92 28 BAYES_00 58628 8.91 0.86 12.76 29 XM_Multi_Part_URI 53948 14.08 18.98 11.74 30 XM_B_Unsub 51126 12.50 15.38 11.12 31 RCVD_IN_MSPIKE_H4 49337 9.46 6.78 10.73 32 XM_DKIMWhitelistDomains 42582 6.28 0.02 9.26 33 LotsOfNums_01 40784 9.45 10.67 8.87 34 TR_XM_DK_Bayes 37697 5.75 0.60 8.20 35 UNPARSEABLE_RELAY 37557 7.15 5.01 8.17 36 TR_XM_DK_Bayes1 36871 5.61 0.55 8.02 37 TooManyTo_001 36732 7.35 6.00 7.99 38 XM_Evil_Numbers_Gen 36300 8.21 8.87 7.90 39 LOTS_OF_MONEY 35781 10.81 17.14 7.79 40 BAYES_60 35753 7.96 8.34 7.78 41 XM_DK_Undo_02 34687 20.28 46.98 7.55 42 TR_XM_DK_Bayes2 33305 5.07 0.51 7.25 43 XM_SendGrid 33220 6.23 4.13 7.23 44 RCVD_IN_RP_SAFE 31692 5.85 3.67 6.90 45 MPART_ALT_DIFF 30614 7.96 10.69 6.66 46 HTML_IMAGE_RATIO_02 29584 7.00 8.19 6.44 47 HTML_IMAGE_RATIO_04 28879 6.14 5.85 6.28 48 IN_ZIMBRA_NJ_WHITELIST 28705 4.25 0.05 6.25 49 RCVD_IN_RP_CERTIFIED 28655 5.19 3.01 6.23 50 XM_H_Long_From01 27001 5.41 4.45 5.87 51 FSL_BULK_SIG 26836 8.65 14.56 5.84 52 MIME_QP_LONG_LINE 26303 4.73 2.63 5.72 53 RCVD_IN_IADB_LISTED 26241 4.59 2.26 5.71 54 TR_XM_DKIM_Undo 25465 15.76 37.17 5.54 55 TR_XM_SpammyWords4 25110 8.60 15.16 5.46 56 XM_B_Phish_Phrases 24963 5.58 5.90 5.43 57 BAYES_99 24413 15.34 36.37 5.31 58 XM_B_SpammyWords3 23430 7.20 11.60 5.10 59 RCVD_IN_IADB_SPF 22949 4.02 1.97 4.99 60 XMStrtUSub 22727 4.43 3.35 4.94 61 BAYES_40 22016 3.86 1.90 4.79 62 XM_H_Trusted_IP 21620 3.18 0.00 4.70 63 XM_PDF 21323 3.41 0.83 4.64 64 BAYES_80 21303 6.74 11.17 4.64 65 RELAYCOUNTRY_META 21044 11.31 25.41 4.58 66 T_TooManySym_01 20850 3.74 2.09 4.54 67 TR_XM_DK_SendGrid 20595 3.81 2.41 4.48 68 RCVD_IN_IADB_SENDERID 20537 3.60 1.79 4.47 69 XMSexyCombo_05 20335 6.47 10.75 4.42 70 RCVD_IN_IADB_DK 19935 3.50 1.76 4.34 71 BOTNET_IPINHOSTNAME 19632 6.76 11.96 4.27 72 MIME_HTML_ONLY_MULTI 19554 3.72 2.61 4.25 73 BAYES_999 18983 11.97 28.39 4.13 74 HTML_IMAGE_RATIO_06 17896 3.89 3.87 3.89 75 TM2_M_URI_OPT_OUT 17807 4.80 6.73 3.87 76 BAYES_20 16799 2.87 1.23 3.66 77 T_REMOTE_IMAGE 16370 5.45 9.41 3.56 78 XMSubMetaSx_00 16231 4.52 6.59 3.53 79 RCVD_IN_IADB_VOUCHED 15772 2.71 1.19 3.43 80 DKIM_INVALID 14963 3.52 4.07 3.26 81 XMNumbers 14761 3.69 4.68 3.21 82 TR_XM_PhishingBody 14538 4.19 6.35 3.16 83 XM_UncommonTLD01 14373 6.25 12.81 3.13 84 BAYES_95 13360 3.79 5.65 2.91 85 TR_DCC_Bayes_99 13345 10.97 27.87 2.90 86 FROM_EXCESS_BASE64 12726 2.80 2.86 2.77 87 HTML_MIME_NO_HTML_TAG 12650 4.93 9.48 2.75 88 RCVD_IN_MSPIKE_H5 12636 2.15 0.91 2.75 89 URI_NOVOWEL 12172 2.18 1.20 2.65 90 HTML_IMAGE_RATIO_08 11139 2.67 3.18 2.42 91 MAILING_LIST_MULTI 10898 2.01 1.25 2.37 92 T_TooManySym_02 10772 1.79 0.64 2.34 93 BAYES_05 10540 1.79 0.73 2.29 94 RCVD_IN_IADB_OPTIN 10395 1.81 0.87 2.26 95 XM_ProductURIs 10205 1.86 1.10 2.22 96 T_FONT_INVIS_NAKED_TO 10184 2.74 3.84 2.22 97 MIME_HTML_MOSTLY 10156 4.32 8.74 2.21 98 XM_B_Unsub2 9780 2.29 2.62 2.13 99 TR_XM_SB_Phish 9401 2.12 2.28 2.05 100 TR_Symld_Words 9309 2.04 2.08 2.03 101 XMSubPhish11 9239 2.07 2.20 2.01 102 TooManyTo_002 9117 1.50 0.50 1.98 103 XM_CamelCaseFrm001 9083 2.00 2.05 1.98 104 ANY_BOUNCE_MESSAGE 8926 1.52 0.64 1.94 105 BOUNCE_MESSAGE 8920 1.52 0.63 1.94 106 HTML_FONT_FACE_BAD 8858 1.47 0.52 1.93 107 UNTRUSTED_Relay 8753 7.65 19.69 1.90 108 XM_B_SpammyTLD 8580 2.31 3.24 1.87 109 T_XMDrugObfuBody_14 8566 1.81 1.69 1.86 110 XM_B_Phish66 8472 2.57 4.10 1.84 111 T_XMDrugObfuBody_08 8402 2.33 3.37 1.83 112 XMSubNoVowel 8143 1.83 1.94 1.77 113 LH_URI_DOM_IN_PATH 7653 2.11 3.05 1.67 114 XM_SPF_SoftFail 7589 2.16 3.22 1.65 115 SUBJ_ALL_CAPS 7466 1.78 2.11 1.62 116 INVALID_MSGID 7434 1.17 0.22 1.62 117 RELAYCOUNTRY_CA 7419 3.00 5.91 1.61 118 URI_TRY_3LD 7342 1.96 2.73 1.60 119 IN_HORDE_ADDRESS_BOOK 7184 1.08 0.06 1.56 120 XM_DK_Undo_01 7145 1.58 1.62 1.55 121 TR_XM_SpammyWords5 7088 2.19 3.54 1.54 122 HELO_NODOT 7017 1.21 0.56 1.53 123 HELO_NO_DOMAIN 7016 1.21 0.56 1.53 124 BOTNET 6886 6.14 15.87 1.50 125 KHOP_HELO_FCRDNS 6833 3.56 7.91 1.49 126 XMDiploma_00 6742 1.74 2.31 1.47 127 MSGID_NOFQDN1 6698 1.00 0.03 1.46 128 TVD_RCVD_IP 6636 1.01 0.12 1.44 129 TO_MALFORMED 6571 0.98 0.03 1.43 130 XMGappySubj_01 6233 0.96 0.13 1.36 131 TooManyTo_003 5928 1.00 0.39 1.29 132 XM_OfRef6 5895 2.50 5.04 1.28 133 HELO_MISC_IP 5655 0.89 0.17 1.23 134 CK_HELO_DYNAMIC_SPLIT_IP 5653 0.89 0.17 1.23 135 URI_HEX 5403 1.93 3.52 1.18 136 TM2_M_VERY_LONG_WORD 5314 1.32 1.68 1.16 137 USER_IN_DEF_DKIM_WL 5312 0.80 0.05 1.16 138 XMStockSpam_06 5180 1.21 1.38 1.13 139 XMCapTrack 5052 0.85 0.34 1.10 140 XM_B_COVIDMETA 5017 1.49 2.33 1.09 141 XMBSHREFv2 4823 0.77 0.20 1.05 142 XM_H_Long_From02 4751 0.98 0.86 1.03 143 XM_UB50 4730 2.86 6.69 1.03 144 XM_GoogleGroups 4704 0.83 0.43 1.02 145 DKIM_ADSP_CUSTOM_MED 4618 0.94 0.80 1.00 146 XMBrknScrpt_02 4461 2.84 6.75 0.97 147 T_FILL_THIS_FORM_SHORT 4441 1.31 2.02 0.97 148 XMBdyGiftCard01 4397 1.20 1.72 0.96 149 TooManyTo_004 4377 0.75 0.34 0.95 150 T_TooManySym_03 4328 0.70 0.20 0.94 151 RCVD_IN_BL_SPAMCOP_NET 4276 3.10 7.66 0.93 152 XM_B_SpammyWords4 4159 1.09 1.46 0.90 153 TR_MSPIKEBAYES00 4040 0.61 0.04 0.88 154 XMSexyCombo_01 3960 1.13 1.70 0.86 155 TR_XM_SpammyWords2 3661 5.20 14.43 0.80 156 XMBody_17 3608 1.89 4.19 0.79 157 TooManyTo_005 3546 0.62 0.29 0.77 158 T_XMHurry_00 3507 1.18 2.05 0.76 159 RELAYCOUNTRY_GB 3478 0.92 1.27 0.76 160 SpammyFromTLD_01 3421 2.38 5.80 0.74 161 XMGenDplmaNmb 3379 0.87 1.15 0.74 162 XMBody_95 3356 0.53 0.10 0.73 163 XMHTML_After_End 3319 0.85 1.11 0.72 164 DIET_1 3256 0.64 0.50 0.71 165 XMSubMetaI_00 3251 0.76 0.88 0.71 166 FROM_GOV_DKIM_AU 3199 0.51 0.13 0.70 167 RCVD_IN_MSPIKE_BL 3145 3.51 9.44 0.68 168 XMSubEmpty 3123 0.81 1.09 0.68 169 HTTPS_HTTP_MISMATCH 3112 0.68 0.67 0.68 170 NML_ADSP_CUSTOM_MED 3074 0.66 0.65 0.67 171 T_OBFU_PDF_ATTACH 3036 0.49 0.14 0.66 172 XM_ShortIntro_01 3002 0.75 0.96 0.65 173 NUMERIC_HTTP_ADDR 2982 0.74 0.94 0.65 174 TR_MetaPhish_Combo_01 2958 0.66 0.70 0.64 175 TR_LOTS_OF_MONEY3 2933 2.01 4.89 0.64 176 DKIM_ADSP_NXDOMAIN 2864 0.59 0.52 0.62 177 FROM_GOV_SPOOF 2735 0.45 0.14 0.60 178 NO_DNS_FOR_FROM 2711 0.52 0.38 0.59 179 XM_SPF_Unknown 2697 0.64 0.76 0.59 180 XMHTMLBadTable_001 2670 0.56 0.52 0.58 181 XMOemUri 2659 0.44 0.15 0.58 182 LOW_PRICE 2626 0.74 1.08 0.57 183 T_XMDrugObfuBody_00 2572 0.72 1.05 0.56 184 T_TooManySym_04 2561 0.39 0.05 0.56 185 HTML_IMAGE_ONLY_20 2549 0.44 0.21 0.55 186 SHORTENED_URL_HREF 2545 0.66 0.87 0.55 187 FORGED_GMAIL_RCVD 2447 0.59 0.72 0.53 188 SENDGRID_REDIR 2420 0.54 0.57 0.53 189 XMMoneyMeta_00 2395 0.72 1.12 0.52 190 PLING_QUERY 2378 0.54 0.60 0.52 191 HTML_TAG_BALANCE_BODY 2329 0.65 0.96 0.51 192 XM_B_COPY_HTML 2301 0.47 0.41 0.50 193 TM2_M_BODY_EMPTY 2271 0.35 0.06 0.49 194 RCVD_IN_MSPIKE_L3 2266 2.55 6.87 0.49 195 XM_S_SubURI 2261 0.35 0.05 0.49 196 TR_XM_SpammyWords3 2227 2.45 6.57 0.48 197 RCVD_IN_SORBS_DUL 2190 0.35 0.10 0.48 198 XMNoVowels 2161 0.40 0.24 0.47 199 SHORT_HELO_AND_INLINE_IMAGE 2141 0.34 0.07 0.47 200 TVD_SPACE_RATIO 2138 0.45 0.43 0.47 ----------------------------------------------------------------------