Email: 697941 Autolearn: 0 AvgScore: 3.99 AvgScanTime: 1.21 sec Spam: 220969 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.29 sec Ham: 476972 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.18 sec Time Spent Running SA: 235.38 hours Time Spent Processing Spam: 79.26 hours Time Spent Processing Ham: 156.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 210114 90.99 95.09 89.10 2 DKIM_SIGNED 178449 77.96 80.76 76.66 3 DCC_CHECK 174728 52.09 79.07 39.59 4 XM_DK_Pass 168604 75.70 76.30 75.42 5 DKIM_VALID 164741 73.73 74.55 73.36 6 XM_B_Unicode 154598 71.10 69.96 71.62 7 RELAYCOUNTRY_US 148100 77.95 67.02 83.01 8 XMListUnsubscribeExists 146464 54.94 66.28 49.69 9 XM_B_SpammyWords 145335 53.13 65.77 47.28 10 DKIM_VALID_AU 128190 56.25 58.01 55.44 11 XM_DK_Undo_02 96489 18.67 43.67 7.09 12 XM_B_SpammyWords2 83370 25.48 37.73 19.81 13 BAYES_50 76414 49.18 34.58 55.95 14 BAYES_99 75537 13.97 34.18 4.60 15 TR_XM_DKIM_Undo 74782 14.16 33.84 5.04 16 HTML_FONT_LOW_CONTRAST 74233 30.27 33.59 28.73 17 XM_B_Unicode3 72367 37.41 32.75 39.56 18 LOC_TINY_FONT_1 68786 26.57 31.13 24.46 19 DKIM_VALID_EF 68694 30.24 31.09 29.85 20 RELAYCOUNTRY_META 67632 13.10 30.61 4.99 21 MIME_HTML_ONLY 67559 24.00 30.57 20.95 22 RCVD_IN_MSPIKE_H2 61547 27.76 27.85 27.71 23 TR_DCC_Bayes_99 58749 9.88 26.59 2.14 24 BAYES_999 58242 10.86 26.36 3.68 25 T_KAM_HTML_FONT_INVALID 54764 20.11 24.78 17.95 26 UNTRUSTED_Relay 51686 8.71 23.39 1.91 27 XMSubLong 50227 21.53 22.73 20.97 28 FVGT_m_MULTI_ODD 48479 22.33 21.94 22.52 29 T_TM2_M_HEADER_IN_MSG 46263 28.30 20.94 31.72 30 DCC_CHECK_NEGATIVE 42308 45.94 19.15 58.36 31 BOTNET 40597 7.08 18.37 1.84 32 XM_Body_Dirty_Words 40076 15.46 18.14 14.21 33 XM_Multi_Part_URI 38074 13.18 17.23 11.31 34 LOTS_OF_MONEY 35179 9.71 15.92 6.83 35 FSL_BULK_SIG 34312 9.25 15.53 6.34 36 RCVD_IN_MSPIKE_WL 32742 24.08 14.82 28.37 37 XM_B_Unsub 30614 11.79 13.85 10.83 38 TR_XM_SpammyWords4 30351 7.48 13.74 4.58 39 XM_UncommonTLD01 29849 6.44 13.51 3.16 40 BOTNET_IPINHOSTNAME 29748 7.35 13.46 4.53 41 RCVD_IN_MSPIKE_BL 28663 4.70 12.97 0.86 42 TR_XM_SpammyWords2 28568 4.51 12.93 0.61 43 XM_B_SpammyWords3 27904 7.32 12.63 4.86 44 XMSexyCombo_05 25059 6.41 11.34 4.12 45 MPART_ALT_DIFF 24619 6.83 11.14 4.83 46 LotsOfNums_01 22309 9.00 10.10 8.49 47 BAYES_60 22093 8.45 10.00 7.74 48 BAYES_80 21724 6.12 9.83 4.40 49 MIME_HTML_MOSTLY 21558 4.47 9.76 2.02 50 HTML_MIME_NO_HTML_TAG 21247 4.56 9.62 2.22 51 XM_Evil_Numbers_Gen 20757 8.85 9.39 8.60 52 RCVD_IN_BL_SPAMCOP_NET 19290 3.33 8.73 0.83 53 RCVD_IN_MSPIKE_L3 18799 3.11 8.51 0.61 54 T_REMOTE_IMAGE 18566 5.01 8.40 3.44 55 HTML_IMAGE_RATIO_02 18465 7.62 8.36 7.28 56 TR_XM_SpammyWords3 18185 2.98 8.23 0.55 57 XM_UB50 17376 3.16 7.86 0.98 58 RCVD_IN_MSPIKE_H3 16754 12.86 7.58 15.30 59 KHOP_HELO_FCRDNS 16613 3.50 7.52 1.63 60 XMSubMetaSx_00 15926 4.90 7.21 3.83 61 RELAYCOUNTRY_FR 15630 2.47 7.07 0.33 62 BODY_URI_ONLY 15039 2.19 6.81 0.04 63 RELAYCOUNTRY_CA 14298 3.24 6.47 1.74 64 SpammyFromTLD_01 14064 2.56 6.36 0.80 65 RCVD_IN_MSPIKE_H4 13946 9.06 6.31 10.34 66 DKIM_INVALID 13708 4.22 6.20 3.30 67 BAYES_95 13669 3.80 6.19 2.70 68 XM_B_Phish_Phrases 13473 4.96 6.10 4.44 69 XMNumbers 12835 4.18 5.81 3.42 70 TooManyTo_001 12379 7.69 5.60 8.65 71 TR_XM_PhishingBody 11901 3.99 5.39 3.34 72 URIBL_SBL_A 11824 1.97 5.35 0.40 73 UNPARSEABLE_RELAY 11563 7.37 5.23 8.36 74 HTML_IMAGE_ONLY_08 11376 1.70 5.15 0.10 75 HTML_IMAGE_RATIO_06 11017 4.09 4.99 3.68 76 XM_OfRef6 10814 2.46 4.89 1.33 77 TR_LOTS_OF_MONEY3 10762 2.00 4.87 0.68 78 TM2_M_URI_OPT_OUT 10725 3.64 4.85 3.08 79 HTML_IMAGE_RATIO_08 10480 3.05 4.74 2.26 80 HTML_IMAGE_RATIO_04 10434 4.95 4.72 5.06 81 XM_H_Long_From01 10408 5.45 4.71 5.79 82 XMBrknScrpt_02 10359 2.16 4.69 0.99 83 XM_UB60 10159 1.52 4.60 0.09 84 XMBody_17 9636 1.92 4.36 0.79 85 XM_UB99 9621 1.38 4.35 0.00 86 XM_DIRTYINTL 9084 1.64 4.11 0.49 87 SpammyFromTLD_02 9075 1.44 4.11 0.21 88 XM_SendGrid 9027 6.55 4.09 7.70 89 TR_XM_SpammyWords5 8888 2.36 4.02 1.59 90 XM_SPF_SoftFail 8531 2.74 3.86 2.22 91 T_FONT_INVIS_NAKED_TO 8322 2.53 3.77 1.96 92 RCVD_IN_RP_SAFE 8299 6.30 3.76 7.48 93 RELAYCOUNTRY_IN 8105 1.22 3.67 0.09 94 XM_B_SpammyTLD 7580 2.34 3.43 1.84 95 TR_XM_MaxSPIKE 7474 1.09 3.38 0.02 96 XM_UB80 7465 1.09 3.38 0.03 97 XMStrtUSub 7400 4.29 3.35 4.72 98 T_XMDrugObfuBody_08 7297 2.33 3.30 1.89 99 XM_B_Phish66 7272 2.47 3.29 2.09 100 RCVD_IN_RP_RNBL 7227 1.07 3.27 0.05 101 RCVD_IN_MSPIKE_L5 6756 1.07 3.06 0.15 102 RCVD_IN_RP_CERTIFIED 6749 5.68 3.05 6.90 103 URI_HEX 6744 1.95 3.05 1.44 104 TR_XM_MaxBayes 6495 0.94 2.94 0.01 105 XM_UB999 6469 0.93 2.93 0.00 106 T_XMHurry_00 6420 1.53 2.91 0.90 107 SUBJ_ALL_CAPS 6401 1.82 2.90 1.33 108 TO_NO_BRKTS_HTML_ONLY 6273 1.04 2.84 0.20 109 XM_B_COVIDMETA 6083 1.27 2.75 0.58 110 RCVD_IN_PSBL 5872 0.90 2.66 0.09 111 RELAYCOUNTRY_UA 5716 0.84 2.59 0.03 112 TR_XM_DK_SendGrid 5677 4.15 2.57 4.88 113 FROM_EXCESS_BASE64 5656 2.59 2.56 2.60 114 TR_Symld_Words 5523 2.00 2.50 1.76 115 URI_TRY_3LD 5228 1.62 2.37 1.28 116 XM_UB95 5111 0.74 2.31 0.02 117 RELAYCOUNTRY_NL 5075 0.86 2.30 0.20 118 DKIM_ADSP_NXDOMAIN 4783 1.09 2.16 0.59 119 MIME_QP_LONG_LINE 4783 4.50 2.16 5.58 120 MIME_HTML_ONLY_MULTI 4747 2.85 2.15 3.18 121 TR_XM_SB_Phish 4690 2.06 2.12 2.04 122 HTML_IMAGE_ONLY_12 4685 0.83 2.12 0.23 123 XMDiploma_00 4587 1.75 2.08 1.60 124 XMSubPhish11 4516 2.01 2.04 2.00 125 BAYES_40 4506 3.92 2.04 4.79 126 T_FILL_THIS_FORM_SHORT 4343 1.36 1.97 1.08 127 XM_CamelCaseFrm001 4326 1.81 1.96 1.73 128 PDS_OTHER_BAD_TLD 4280 0.95 1.94 0.50 129 HTML_FONT_SIZE_LARGE 4205 0.74 1.90 0.20 130 NO_DNS_FOR_FROM 4187 1.00 1.89 0.58 131 RELAYCOUNTRY_GB 4154 1.24 1.88 0.94 132 SHORTENED_URL_HREF 4079 0.94 1.85 0.53 133 XMSexyCombo_01 3991 1.21 1.81 0.93 134 TR_XM_INV_DKIM 3850 0.62 1.74 0.10 135 XM_URI_RBL 3820 0.65 1.73 0.15 136 BOTNET_NORDNS 3813 0.56 1.73 0.02 137 FROM_SUSPICIOUS_NTLD 3808 0.60 1.72 0.07 138 T_TooManySym_01 3762 3.82 1.70 4.80 139 XM_B_Unsub2 3761 1.94 1.70 2.05 140 TR_Mismatch_TLD_02 3702 0.59 1.68 0.09 141 XMSlimDrugH 3695 0.72 1.67 0.28 142 FROM_SUSPICIOUS_NTLD_FP 3653 0.57 1.65 0.06 143 LH_URI_DOM_IN_PATH 3647 1.72 1.65 1.75 144 XM_DK_Undo_01 3612 1.76 1.63 1.82 145 XM_B_SpammyWords4 3596 0.92 1.63 0.60 146 T_HTML_TAG_BALANCE_CENTER 3575 0.62 1.62 0.16 147 ALL_TRUSTED 3567 9.57 1.61 13.25 148 XMMoneyMeta_00 3566 0.89 1.61 0.56 149 TR_XM_COVIDMETA4 3368 0.76 1.52 0.41 150 TM2_M_VERY_LONG_WORD 3343 1.41 1.51 1.36 151 RCVD_IN_IADB_LISTED 3298 4.12 1.49 5.34 152 TR_XM_PHPDW 3277 0.71 1.48 0.35 153 XMStockSpam_06 3276 1.30 1.48 1.21 154 TR_XM_PHPForged 3245 0.67 1.47 0.31 155 TR_XM_FormFill2 3217 0.67 1.46 0.30 156 XM_H_PHPOS 3210 0.66 1.45 0.30 157 RDNS_DYNAMIC 3180 0.78 1.44 0.47 158 XMSubMetaSxObfu_03 3053 1.00 1.38 0.82 159 TR_XM_UnparsRelay 3006 0.71 1.36 0.40 160 XMClaimOffer 3003 0.51 1.36 0.11 161 RELAYCOUNTRY_DE 2962 0.68 1.34 0.38 162 RCVD_IN_IADB_SPF 2944 3.63 1.33 4.70 163 BAYES_20 2896 2.95 1.31 3.71 164 XM_OfRef7 2876 0.52 1.30 0.16 165 DATE_IN_PAST_06_12 2872 0.55 1.30 0.21 166 URIBL_DBL_ABUSE_REDIR 2830 0.41 1.28 0.00 167 LongTLD 2801 0.50 1.27 0.14 168 RCVD_IN_IADB_SENDERID 2781 3.31 1.26 4.26 169 RCVD_IN_IADB_DK 2777 3.22 1.26 4.13 170 XMSubNoVowel 2773 1.57 1.25 1.71 171 XMSlimDrugs 2727 0.41 1.23 0.02 172 HK_RANDOM_REPLYTO 2701 0.54 1.22 0.22 173 T_XMDrugObfuBody_14 2653 1.54 1.20 1.70 174 XMHTML_After_End 2625 0.94 1.19 0.82 175 MAILING_LIST_MULTI 2591 2.18 1.17 2.64 176 XMBdyGiftCard01 2518 0.91 1.14 0.80 177 REMOVE_BEFORE_LINK 2499 0.51 1.13 0.22 178 XMGenDplmaNmb 2487 0.92 1.13 0.82 179 MISSING_HEADERS 2474 0.70 1.12 0.51 180 HTML_TAG_BALANCE_BODY 2441 0.65 1.10 0.44 181 XM_ProductURIs 2426 0.89 1.10 0.79 182 TR_XM_COVIDMETA1 2407 0.56 1.09 0.32 183 T_XMDrugObfuBody_00 2400 0.76 1.09 0.61 184 BAYES_00 2373 9.76 1.07 13.78 185 XMSexyCombo_04 2371 0.70 1.07 0.53 186 DKIM_ADSP_CUSTOM_MED 2370 1.11 1.07 1.13 187 TR_Mismatch_TLD_01 2350 0.57 1.06 0.35 188 TR_Caps_n_Bayes_99 2324 0.35 1.05 0.02 189 SUBJ_DOLLARS 2300 0.54 1.04 0.30 190 URI_NOVOWEL 2238 2.08 1.01 2.57 191 URI_PHP_REDIR 2193 0.32 0.99 0.01 192 DATE_IN_PAST_12_24 2182 0.34 0.99 0.04 193 TR_Sbj_FN_Bdy 2141 0.44 0.97 0.19 194 TR_XM_FormFill 2103 0.33 0.95 0.04 195 NML_ADSP_CUSTOM_MED 2049 0.81 0.93 0.76 196 RCVD_IN_MSPIKE_H5 2042 2.16 0.92 2.73 197 XMBody_78 2022 0.55 0.92 0.38 198 RCVD_IN_MSPIKE_L4 2003 0.35 0.91 0.08 199 XM_PDF 1999 3.56 0.90 4.79 200 RELAYCOUNTRY_IT 1962 0.31 0.89 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424976 90.99 95.09 89.10 2 RELAYCOUNTRY_US 395954 77.95 67.02 83.01 3 DKIM_SIGNED 365647 77.96 80.76 76.66 4 XM_DK_Pass 359749 75.70 76.30 75.42 5 DKIM_VALID 349885 73.73 74.55 73.36 6 XM_B_Unicode 341608 71.10 69.96 71.62 7 DCC_CHECK_NEGATIVE 278348 45.94 19.15 58.36 8 BAYES_50 266855 49.18 34.58 55.95 9 DKIM_VALID_AU 264432 56.25 58.01 55.44 10 XMListUnsubscribeExists 237010 54.94 66.28 49.69 11 XM_B_SpammyWords 225492 53.13 65.77 47.28 12 DCC_CHECK 188812 52.09 79.07 39.59 13 XM_B_Unicode3 188711 37.41 32.75 39.56 14 T_TM2_M_HEADER_IN_MSG 151288 28.30 20.94 31.72 15 DKIM_VALID_EF 142377 30.24 31.09 29.85 16 HTML_FONT_LOW_CONTRAST 137022 30.27 33.59 28.73 17 RCVD_IN_MSPIKE_WL 135303 24.08 14.82 28.37 18 RCVD_IN_MSPIKE_H2 132182 27.76 27.85 27.71 19 LOC_TINY_FONT_1 116648 26.57 31.13 24.46 20 FVGT_m_MULTI_ODD 107398 22.33 21.94 22.52 21 XMSubLong 100008 21.53 22.73 20.97 22 MIME_HTML_ONLY 99935 24.00 30.57 20.95 23 XM_B_SpammyWords2 94489 25.48 37.73 19.81 24 T_KAM_HTML_FONT_INVALID 85619 20.11 24.78 17.95 25 RCVD_IN_MSPIKE_H3 72971 12.86 7.58 15.30 26 XM_Body_Dirty_Words 67794 15.46 18.14 14.21 27 BAYES_00 65725 9.76 1.07 13.78 28 ALL_TRUSTED 63218 9.57 1.61 13.25 29 XM_Multi_Part_URI 53943 13.18 17.23 11.31 30 XM_B_Unsub 51664 11.79 13.85 10.83 31 RCVD_IN_MSPIKE_H4 49308 9.06 6.31 10.34 32 TR_XM_DK_Bayes 44857 6.68 0.79 9.40 33 TR_XM_DK_Bayes1 43638 6.50 0.77 9.15 34 XM_DKIMWhitelistDomains 41431 5.95 0.04 8.69 35 TooManyTo_001 41263 7.69 5.60 8.65 36 XM_Evil_Numbers_Gen 41005 8.85 9.39 8.60 37 LotsOfNums_01 40514 9.00 10.10 8.49 38 UNPARSEABLE_RELAY 39881 7.37 5.23 8.36 39 TR_XM_DK_Bayes2 38307 5.69 0.65 8.03 40 BAYES_60 36912 8.45 10.00 7.74 41 XM_SendGrid 36717 6.55 4.09 7.70 42 RCVD_IN_RP_SAFE 35675 6.30 3.76 7.48 43 HTML_IMAGE_RATIO_02 34746 7.62 8.36 7.28 44 XM_DK_Undo_02 33827 18.67 43.67 7.09 45 RCVD_IN_RP_CERTIFIED 32928 5.68 3.05 6.90 46 LOTS_OF_MONEY 32598 9.71 15.92 6.83 47 FSL_BULK_SIG 30253 9.25 15.53 6.34 48 IN_ZIMBRA_NJ_WHITELIST 30043 4.32 0.05 6.30 49 XM_H_Long_From01 27627 5.45 4.71 5.79 50 MIME_QP_LONG_LINE 26601 4.50 2.16 5.58 51 RCVD_IN_IADB_LISTED 25476 4.12 1.49 5.34 52 HTML_IMAGE_RATIO_04 24135 4.95 4.72 5.06 53 TR_XM_DKIM_Undo 24035 14.16 33.84 5.04 54 RELAYCOUNTRY_META 23786 13.10 30.61 4.99 55 TR_XM_DK_SendGrid 23254 4.15 2.57 4.88 56 XM_B_SpammyWords3 23181 7.32 12.63 4.86 57 MPART_ALT_DIFF 23022 6.83 11.14 4.83 58 T_TooManySym_01 22888 3.82 1.70 4.80 59 XM_PDF 22855 3.56 0.90 4.79 60 BAYES_40 22843 3.92 2.04 4.79 61 XMStrtUSub 22514 4.29 3.35 4.72 62 RCVD_IN_IADB_SPF 22421 3.63 1.33 4.70 63 BAYES_99 21938 13.97 34.18 4.60 64 TR_XM_SpammyWords4 21847 7.48 13.74 4.58 65 BOTNET_IPINHOSTNAME 21583 7.35 13.46 4.53 66 XM_B_Phish_Phrases 21167 4.96 6.10 4.44 67 BAYES_80 20999 6.12 9.83 4.40 68 RCVD_IN_IADB_SENDERID 20329 3.31 1.26 4.26 69 RCVD_IN_IADB_DK 19704 3.22 1.26 4.13 70 XMSexyCombo_05 19673 6.41 11.34 4.12 71 XMSubMetaSx_00 18266 4.90 7.21 3.83 72 BAYES_20 17707 2.95 1.31 3.71 73 BAYES_999 17548 10.86 26.36 3.68 74 HTML_IMAGE_RATIO_06 17534 4.09 4.99 3.68 75 T_REMOTE_IMAGE 16423 5.01 8.40 3.44 76 XMNumbers 16331 4.18 5.81 3.42 77 TR_XM_PhishingBody 15925 3.99 5.39 3.34 78 DKIM_INVALID 15762 4.22 6.20 3.30 79 RCVD_IN_IADB_VOUCHED 15275 2.41 0.70 3.20 80 MIME_HTML_ONLY_MULTI 15161 2.85 2.15 3.18 81 XM_UncommonTLD01 15092 6.44 13.51 3.16 82 TM2_M_URI_OPT_OUT 14704 3.64 4.85 3.08 83 XM_H_Trusted_IP 13565 1.94 0.00 2.84 84 RCVD_IN_MSPIKE_H5 13024 2.16 0.92 2.73 85 BAYES_95 12886 3.80 6.19 2.70 86 MAILING_LIST_MULTI 12596 2.18 1.17 2.64 87 FROM_EXCESS_BASE64 12421 2.59 2.56 2.60 88 URI_NOVOWEL 12264 2.08 1.01 2.57 89 T_TooManySym_02 11715 1.84 0.52 2.46 90 BAYES_05 11105 1.84 0.79 2.33 91 TooManyTo_002 10946 1.77 0.62 2.29 92 HTML_IMAGE_RATIO_08 10779 3.05 4.74 2.26 93 HTML_MIME_NO_HTML_TAG 10586 4.56 9.62 2.22 94 XM_SPF_SoftFail 10574 2.74 3.86 2.22 95 TR_DCC_Bayes_99 10203 9.88 26.59 2.14 96 XM_B_Phish66 9986 2.47 3.29 2.09 97 XM_B_Unsub2 9768 1.94 1.70 2.05 98 TR_XM_SB_Phish 9721 2.06 2.12 2.04 99 RCVD_IN_IADB_OPTIN 9705 1.56 0.54 2.03 100 MIME_HTML_MOSTLY 9628 4.47 9.76 2.02 101 XMSubPhish11 9518 2.01 2.04 2.00 102 ANY_BOUNCE_MESSAGE 9448 1.52 0.53 1.98 103 BOUNCE_MESSAGE 9444 1.52 0.53 1.98 104 T_FONT_INVIS_NAKED_TO 9352 2.53 3.77 1.96 105 UNTRUSTED_Relay 9091 8.71 23.39 1.91 106 T_XMDrugObfuBody_08 8991 2.33 3.30 1.89 107 BOTNET 8789 7.08 18.37 1.84 108 XM_B_SpammyTLD 8778 2.34 3.43 1.84 109 XM_DK_Undo_01 8682 1.76 1.63 1.82 110 HELO_NODOT 8485 1.44 0.71 1.78 111 HELO_NO_DOMAIN 8484 1.44 0.71 1.78 112 TR_Symld_Words 8414 2.00 2.50 1.76 113 LH_URI_DOM_IN_PATH 8327 1.72 1.65 1.75 114 RELAYCOUNTRY_CA 8321 3.24 6.47 1.74 115 XM_CamelCaseFrm001 8273 1.81 1.96 1.73 116 XMSubNoVowel 8178 1.57 1.25 1.71 117 T_XMDrugObfuBody_14 8130 1.54 1.20 1.70 118 KHOP_HELO_FCRDNS 7788 3.50 7.52 1.63 119 XMDiploma_00 7637 1.75 2.08 1.60 120 TR_XM_SpammyWords5 7586 2.36 4.02 1.59 121 IN_HORDE_ADDRESS_BOOK 7575 1.11 0.06 1.59 122 INVALID_MSGID 7334 1.11 0.18 1.54 123 TooManyTo_003 7296 1.20 0.49 1.53 124 URI_HEX 6858 1.95 3.05 1.44 125 TVD_RCVD_IP 6596 1.10 0.49 1.38 126 TO_MALFORMED 6584 0.94 0.00 1.38 127 XMCapTrack 6579 1.06 0.36 1.38 128 MSGID_NOFQDN1 6524 0.94 0.02 1.37 129 TM2_M_VERY_LONG_WORD 6498 1.41 1.51 1.36 130 SUBJ_ALL_CAPS 6330 1.82 2.90 1.33 131 XM_OfRef6 6327 2.46 4.89 1.33 132 URI_TRY_3LD 6083 1.62 2.37 1.28 133 USER_IN_DEF_DKIM_WL 6070 0.93 0.19 1.27 134 XMStockSpam_06 5767 1.30 1.48 1.21 135 XMGappySubj_01 5706 0.92 0.32 1.20 136 HTML_FONT_FACE_BAD 5627 0.98 0.55 1.18 137 XM_GoogleGroups 5469 0.91 0.38 1.15 138 TooManyTo_004 5431 0.92 0.44 1.14 139 HELO_MISC_IP 5418 0.87 0.30 1.14 140 CK_HELO_DYNAMIC_SPLIT_IP 5394 0.95 0.57 1.13 141 DKIM_ADSP_CUSTOM_MED 5381 1.11 1.07 1.13 142 T_FILL_THIS_FORM_SHORT 5150 1.36 1.97 1.08 143 XMBrknScrpt_02 4730 2.16 4.69 0.99 144 XM_H_Long_From02 4702 0.88 0.66 0.99 145 XM_UB50 4681 3.16 7.86 0.98 146 T_TooManySym_03 4585 0.72 0.19 0.96 147 XMBSHREFv2 4560 0.73 0.25 0.96 148 RELAYCOUNTRY_GB 4504 1.24 1.88 0.94 149 TooManyTo_005 4479 0.76 0.38 0.94 150 XMSexyCombo_01 4459 1.21 1.81 0.93 151 XMBody_95 4391 0.66 0.09 0.92 152 TR_MSPIKEBAYES00 4365 0.63 0.02 0.92 153 T_XMHurry_00 4285 1.53 2.91 0.90 154 RCVD_IN_MSPIKE_BL 4110 4.70 12.97 0.86 155 RCVD_IN_BL_SPAMCOP_NET 3973 3.33 8.73 0.83 156 XMSubMetaSxObfu_03 3934 1.00 1.38 0.82 157 XMGenDplmaNmb 3931 0.92 1.13 0.82 158 XMHTML_After_End 3917 0.94 1.19 0.82 159 FROM_GOV_DKIM_AU 3894 0.59 0.11 0.82 160 XMBdyGiftCard01 3824 0.91 1.14 0.80 161 SpammyFromTLD_01 3823 2.56 6.36 0.80 162 XMBody_17 3783 1.92 4.36 0.79 163 XM_ProductURIs 3763 0.89 1.10 0.79 164 XM_ShortIntro_01 3708 0.72 0.60 0.78 165 HTTPS_HTTP_MISMATCH 3653 0.73 0.67 0.77 166 NML_ADSP_CUSTOM_MED 3637 0.81 0.93 0.76 167 TR_MetaPhish_Combo_01 3618 0.80 0.88 0.76 168 XMSolicitRefs_0 3452 0.59 0.31 0.72 169 XMSubEmpty 3439 0.69 0.62 0.72 170 XM_SPF_Unknown 3425 0.77 0.87 0.72 171 XM_E_Blogspot 3355 0.50 0.07 0.70 172 TR_LOTS_OF_MONEY3 3222 2.00 4.87 0.68 173 NUMERIC_HTTP_ADDR 3170 0.60 0.46 0.66 174 FORGED_GMAIL_RCVD 3062 0.65 0.67 0.64 175 TR_XM_SpammyWords2 2930 4.51 12.93 0.61 176 RCVD_IN_MSPIKE_L3 2905 3.11 8.51 0.61 177 T_OBFU_PDF_ATTACH 2896 0.46 0.14 0.61 178 T_XMDrugObfuBody_00 2892 0.76 1.09 0.61 179 XMNoVowels 2856 0.53 0.38 0.60 180 XM_B_SpammyWords4 2840 0.92 1.63 0.60 181 XMSubMetaI_00 2824 0.64 0.74 0.59 182 DKIM_ADSP_NXDOMAIN 2793 1.09 2.16 0.59 183 NO_DNS_FOR_FROM 2777 1.00 1.89 0.58 184 XM_B_COVIDMETA 2765 1.27 2.75 0.58 185 XM_H_PHPMailer 2749 0.54 0.45 0.58 186 XMSubMetaSxObfu_02 2659 0.43 0.17 0.56 187 XMMoneyMeta_00 2653 0.89 1.61 0.56 188 TR_XM_SpammyWords3 2635 2.98 8.23 0.55 189 T_TooManySym_04 2632 0.41 0.10 0.55 190 T_Symld_Words_02 2554 0.60 0.72 0.54 191 RCVD_IN_SORBS_DUL 2536 0.42 0.17 0.53 192 SHORTENED_URL_HREF 2512 0.94 1.85 0.53 193 XMSexyCombo_04 2506 0.70 1.07 0.53 194 MISSING_HEADERS 2425 0.70 1.12 0.51 195 XMHTMLBadTable_001 2422 0.51 0.50 0.51 196 FROM_GOV_SPOOF 2385 0.37 0.10 0.50 197 XM_RXBody 2371 0.46 0.36 0.50 198 PDS_OTHER_BAD_TLD 2362 0.95 1.94 0.50 199 XMOemUri 2361 0.44 0.31 0.49 200 TM2_M_BODY_EMPTY 2352 0.35 0.06 0.49 ----------------------------------------------------------------------