Email: 740756 Autolearn: 0 AvgScore: 1.76 AvgScanTime: 1.41 sec Spam: 208101 Autolearn: 0 AvgScore: 13.43 AvgScanTime: 1.57 sec Ham: 532655 Autolearn: 0 AvgScore: -2.80 AvgScanTime: 1.34 sec Time Spent Running SA: 289.63 hours Time Spent Processing Spam: 90.89 hours Time Spent Processing Ham: 198.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 199842 93.02 96.03 91.84 2 DKIM_SIGNED 175264 73.38 84.22 69.15 3 XM_DK_Pass 171541 72.14 82.43 68.12 4 DCC_CHECK 168226 49.65 80.84 37.47 5 DKIM_VALID 167869 70.38 80.67 66.36 6 XM_B_Unicode 162299 77.21 77.99 76.90 7 RELAYCOUNTRY_US 154686 82.42 74.33 85.58 8 XMListUnsubscribeExists 145061 54.02 69.71 47.89 9 XM_B_SpammyWords 139071 52.61 66.83 47.05 10 DKIM_VALID_AU 131028 53.74 62.96 50.14 11 XM_DK_Undo_02 98265 17.82 47.22 6.34 12 XM_B_Unicode3 83323 45.37 40.04 47.45 13 XM_B_SpammyWords2 79892 24.80 38.39 19.49 14 LOC_TINY_FONT_1 76139 26.65 36.59 22.77 15 BAYES_99 75360 12.95 36.21 3.87 16 TR_XM_DKIM_Undo 74769 13.46 35.93 4.69 17 HTML_FONT_LOW_CONTRAST 74293 28.55 35.70 25.75 18 BAYES_50 73346 46.39 35.25 50.74 19 MIME_HTML_ONLY 65506 26.67 31.48 24.80 20 DKIM_VALID_EF 63931 26.46 30.72 24.80 21 RCVD_IN_MSPIKE_H2 63637 26.44 30.58 24.82 22 TR_DCC_Bayes_99 60978 9.64 29.30 1.96 23 BAYES_999 59951 10.36 28.81 3.15 24 T_KAM_HTML_FONT_INVALID 51723 19.33 24.85 17.17 25 FVGT_m_MULTI_ODD 50348 21.49 24.19 20.44 26 RELAYCOUNTRY_META 49976 9.99 24.02 4.51 27 XMSubLong 49065 20.85 23.58 19.78 28 XM_Multi_Part_URI 45114 14.26 21.68 11.35 29 T_TM2_M_HEADER_IN_MSG 40418 23.43 19.42 25.00 30 RCVD_IN_MSPIKE_WL 39575 24.07 19.02 26.05 31 DCC_CHECK_NEGATIVE 36886 48.54 17.73 60.59 32 BOTNET 35649 5.87 17.13 1.47 33 XM_Body_Dirty_Words 35538 13.39 17.08 11.95 34 UNTRUSTED_Relay 35236 6.12 16.93 1.90 35 XM_B_Unsub 31121 10.71 14.95 9.05 36 TR_XM_SpammyWords2 29020 4.52 13.95 0.84 37 LotsOfNums_01 27570 9.56 13.25 8.12 38 FSL_BULK_SIG 27469 7.58 13.20 5.39 39 XM_UncommonTLD01 27312 5.70 13.12 2.79 40 BOTNET_IPINHOSTNAME 25889 6.30 12.44 3.91 41 XM_B_SpammyWords3 25417 7.10 12.21 5.10 42 LOTS_OF_MONEY 25123 8.09 12.07 6.53 43 MPART_ALT_DIFF 22769 10.53 10.94 10.36 44 RCVD_IN_MSPIKE_H3 22241 13.60 10.69 14.74 45 XM_Evil_Numbers_Gen 21538 9.82 10.35 9.61 46 TR_XM_SpammyWords4 21182 5.84 10.18 4.15 47 XMSexyCombo_05 20081 5.58 9.65 3.99 48 HTML_IMAGE_RATIO_02 19298 7.31 9.27 6.55 49 BAYES_80 18716 5.12 8.99 3.61 50 MIME_HTML_MOSTLY 18146 4.22 8.72 2.47 51 RCVD_IN_BL_SPAMCOP_NET 17271 3.19 8.30 1.19 52 BAYES_60 16940 6.92 8.14 6.44 53 XM_B_Phish_Phrases 16359 5.33 7.86 4.34 54 RCVD_IN_MSPIKE_H4 15810 8.68 7.60 9.11 55 UNPARSEABLE_RELAY 15593 7.32 7.49 7.26 56 TR_XM_UnparsRelay 14930 5.63 7.17 5.02 57 RELAYCOUNTRY_CA 14333 2.84 6.89 1.26 58 XMSubMetaSx_00 13633 4.11 6.55 3.16 59 TooManyTo_001 13586 6.85 6.53 6.98 60 XM_SendGrid 12848 6.39 6.17 6.48 61 T_REMOTE_IMAGE 12736 3.92 6.12 3.06 62 SpammyFromTLD_01 12650 2.21 6.08 0.70 63 TR_XM_PhishingBody 12598 3.46 6.05 2.45 64 HTML_IMAGE_RATIO_08 12268 3.41 5.90 2.43 65 BAYES_95 11415 3.15 5.49 2.23 66 XM_UB50 11015 2.25 5.29 1.06 67 TR_XM_SpammyWords5 10748 2.47 5.16 1.41 68 XM_H_Long_From01 10648 5.26 5.12 5.32 69 XM_OfRef6 10493 2.02 5.04 0.84 70 KHOP_HELO_FCRDNS 10409 2.56 5.00 1.61 71 URIBL_SBL_A 9982 1.44 4.80 0.13 72 HTML_IMAGE_RATIO_04 9806 12.77 4.71 15.92 73 HTML_IMAGE_RATIO_06 9626 4.98 4.63 5.12 74 RCVD_IN_MSPIKE_BL 9529 1.57 4.58 0.40 75 TR_XM_MSPIKECOMBO 9402 1.55 4.52 0.39 76 HTML_IMAGE_ONLY_12 9367 1.40 4.50 0.19 77 XMNumbers 9231 3.39 4.44 2.98 78 HTML_SHORT_LINK_IMG_1 9157 1.25 4.40 0.02 79 BODY_URI_ONLY 9105 1.28 4.38 0.06 80 XMStrtUSub 8793 8.75 4.23 10.51 81 TM2_M_URI_OPT_OUT 8707 2.99 4.18 2.52 82 RELAYCOUNTRY_FR 8598 1.37 4.13 0.30 83 XM_B_SpammyTLD 8490 2.51 4.08 1.90 84 XM_SPF_SoftFail 8393 2.39 4.03 1.75 85 RCVD_IN_RP_SAFE 8380 6.41 4.03 7.34 86 T_FONT_INVIS_NAKED_TO 8030 2.10 3.86 1.42 87 DKIM_INVALID 7395 3.01 3.55 2.79 88 SpammyFromTLD_02 7355 1.18 3.53 0.26 89 SUBJ_ALL_CAPS 7174 2.00 3.45 1.43 90 RCVD_IN_RP_CERTIFIED 7086 5.80 3.41 6.73 91 XMBrknScrpt_02 6981 1.44 3.35 0.70 92 TR_XM_DK_SendGrid 6881 3.84 3.31 4.05 93 XM_UB99 6693 0.91 3.22 0.01 94 URI_HEX 6667 1.97 3.20 1.48 95 XM_UB60 6509 0.96 3.13 0.12 96 XM_B_Phish66 6461 1.98 3.10 1.55 97 TR_LOTS_OF_MONEY3 6397 1.12 3.07 0.36 98 XMBody_17 6348 1.22 3.05 0.51 99 FROM_EXCESS_BASE64 6155 3.05 2.96 3.08 100 MIME_HTML_ONLY_MULTI 6145 6.87 2.95 8.40 101 XM_DK_Undo_01 6138 1.90 2.95 1.48 102 XM_B_Unsub2 6068 1.92 2.92 1.54 103 RCVD_IN_RP_RNBL 6010 0.83 2.89 0.03 104 RCVD_IN_MSPIKE_L5 5953 0.86 2.86 0.08 105 XM_UB80 5823 0.83 2.80 0.06 106 XM_B_COVIDMETA 5804 1.28 2.79 0.68 107 HTML_MIME_NO_HTML_TAG 5794 2.09 2.78 1.82 108 MIME_QP_LONG_LINE 5771 4.49 2.77 5.16 109 XM_DIRTYINTL 5526 1.09 2.66 0.48 110 T_TooManySym_01 5488 3.63 2.64 4.02 111 T_XMDrugObfuBody_08 5475 1.75 2.63 1.40 112 T_FILL_THIS_FORM_SHORT 5109 1.15 2.46 0.65 113 XMDiploma_00 5081 1.81 2.44 1.57 114 XMBdyGiftCard01 4997 1.25 2.40 0.81 115 TR_XM_SB_Phish 4779 1.97 2.30 1.85 116 TR_XM_MaxBayes 4753 0.65 2.28 0.01 117 BAYES_40 4638 4.33 2.23 5.15 118 XM_UB999 4609 0.63 2.21 0.01 119 XMSubPhish11 4586 1.93 2.20 1.83 120 XM_CamelCaseFrm001 4377 1.80 2.10 1.69 121 TR_XM_SpammyWords3 4267 0.63 2.05 0.08 122 RCVD_IN_PSBL 4113 0.59 1.98 0.04 123 BOTNET_NORDNS 4073 0.56 1.96 0.02 124 URI_TRY_3LD 3886 1.20 1.87 0.93 125 RCVD_IN_IADB_LISTED 3877 4.15 1.86 5.04 126 PDS_OTHER_BAD_TLD 3835 0.99 1.84 0.66 127 XM_B_SpammyWords4 3609 0.81 1.73 0.44 128 BAYES_20 3597 3.98 1.73 4.86 129 XM_UB95 3588 0.49 1.72 0.01 130 XMSubMetaI_00 3583 1.07 1.72 0.81 131 TM2_M_VERY_LONG_WORD 3574 1.40 1.72 1.28 132 XM_URI_RBL 3519 0.60 1.69 0.18 133 HTML_FONT_SIZE_LARGE 3482 0.54 1.67 0.09 134 XMSubNoVowel 3480 3.60 1.67 4.35 135 RCVD_IN_IADB_SPF 3472 3.63 1.67 4.40 136 TR_XM_PHPDW 3455 0.72 1.66 0.35 137 RELAYCOUNTRY_AL 3413 0.46 1.64 0.01 138 TR_XM_PHPForged 3370 0.69 1.62 0.32 139 TR_Caps_n_Bayes_99 3363 0.48 1.62 0.03 140 XMSexyCombo_01 3351 0.82 1.61 0.51 141 TR_XM_FormFill2 3341 0.68 1.61 0.32 142 XM_H_PHPOS 3331 0.68 1.60 0.32 143 RCVD_IN_IADB_DK 3329 3.19 1.60 3.81 144 RCVD_IN_IADB_SENDERID 3299 3.28 1.59 3.94 145 TR_XM_FormFill 3179 0.44 1.53 0.02 146 TR_XM_COVIDMETA4 3120 0.65 1.50 0.31 147 T_XMDrugObfuBody_14 3120 1.48 1.50 1.48 148 FROM_SUSPICIOUS_NTLD 3110 0.47 1.49 0.07 149 XMGenDplmaNmb 3086 1.11 1.48 0.96 150 XM_OfRef7 3029 0.49 1.46 0.12 151 XMPhish08 2954 0.58 1.42 0.25 152 FROM_SUSPICIOUS_NTLD_FP 2940 0.44 1.41 0.06 153 XMStockSpam_06 2912 1.44 1.40 1.45 154 RELAYCOUNTRY_IN 2908 0.46 1.40 0.10 155 T_XMHurry_00 2814 0.77 1.35 0.54 156 NUMERIC_HTTP_ADDR 2785 0.65 1.34 0.39 157 FORGED_GMAIL_RCVD 2763 0.83 1.33 0.63 158 TR_XM_COVIDMETA1 2747 0.54 1.32 0.23 159 T_Symld_Words_02 2739 0.70 1.32 0.47 160 RELAYCOUNTRY_GB 2696 0.93 1.30 0.79 161 T_XMDrugObfuBody_00 2666 1.10 1.28 1.03 162 RELAYCOUNTRY_DE 2517 0.68 1.21 0.47 163 MAILING_LIST_MULTI 2504 1.92 1.20 2.20 164 URI_NO_WWW_BIZ_CGI 2486 0.34 1.19 0.01 165 URI_PHP_REDIR 2483 0.34 1.19 0.00 166 TR_XM_BayesRelay 2458 0.34 1.18 0.01 167 DKIM_ADSP_CUSTOM_MED 2453 1.05 1.18 1.00 168 URI_NOVOWEL 2449 2.16 1.18 2.54 169 TR_XM_INV_DKIM 2368 0.36 1.14 0.06 170 PLING_QUERY 2364 0.52 1.14 0.28 171 XMHTML_After_End 2360 0.79 1.13 0.65 172 TR_Symld_Words 2350 1.18 1.13 1.20 173 TR_XM_RelayPhish 2340 0.38 1.12 0.09 174 XM_H_Long_From02 2317 1.03 1.11 1.00 175 XM_BadFromFormat 2296 0.48 1.10 0.23 176 XMMoneyMeta_00 2258 0.63 1.09 0.46 177 HK_RANDOM_REPLYTO 2240 0.44 1.08 0.19 178 URG_BIZ 2240 0.36 1.08 0.09 179 BAYES_00 2198 14.40 1.06 19.62 180 NML_ADSP_CUSTOM_MED 2177 0.79 1.05 0.68 181 DATE_IN_PAST_03_06 2103 0.39 1.01 0.15 182 XMSubMetaSxObfu_03 2088 0.52 1.00 0.33 183 LongTLD 2073 0.38 1.00 0.13 184 ALL_TRUSTED 2059 8.13 0.99 10.91 185 XMPhish30 2034 0.50 0.98 0.31 186 RCVD_IN_MSPIKE_L3 1935 0.46 0.93 0.28 187 MIME_CHARSET_FARAWAY 1869 0.32 0.90 0.10 188 BAYES_05 1869 2.70 0.90 3.40 189 RELAYCOUNTRY_NL 1858 0.37 0.89 0.17 190 HTTPS_HTTP_MISMATCH 1855 0.72 0.89 0.65 191 XM_Combo_Sbj 1818 0.39 0.87 0.20 192 T_MONEY_PERCENT 1809 0.36 0.87 0.17 193 TR_LOTS_OF_MONEY2 1809 0.36 0.87 0.17 194 XM_S_SpammyWords 1791 0.46 0.86 0.30 195 TR_XM_Spammywords 1791 0.46 0.86 0.30 196 RDNS_DYNAMIC 1788 0.55 0.86 0.42 197 T_TooManySym_02 1787 1.60 0.86 1.89 198 CHARSET_FARAWAY_HEADER 1737 0.27 0.83 0.05 199 XMSubMetaSSx_00 1713 0.35 0.82 0.16 200 XM_LoanWordsFrm 1699 0.28 0.82 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 489206 93.02 96.03 91.84 2 RELAYCOUNTRY_US 455848 82.42 74.33 85.58 3 XM_B_Unicode 409611 77.21 77.99 76.90 4 DKIM_SIGNED 368337 73.38 84.22 69.15 5 XM_DK_Pass 362869 72.14 82.43 68.12 6 DKIM_VALID 353467 70.38 80.67 66.36 7 DCC_CHECK_NEGATIVE 322714 48.54 17.73 60.59 8 BAYES_50 270280 46.39 35.25 50.74 9 DKIM_VALID_AU 267057 53.74 62.96 50.14 10 XMListUnsubscribeExists 255072 54.02 69.71 47.89 11 XM_B_Unicode3 252721 45.37 40.04 47.45 12 XM_B_SpammyWords 250617 52.61 66.83 47.05 13 DCC_CHECK 199585 49.65 80.84 37.47 14 RCVD_IN_MSPIKE_WL 138730 24.07 19.02 26.05 15 HTML_FONT_LOW_CONTRAST 137165 28.55 35.70 25.75 16 T_TM2_M_HEADER_IN_MSG 133157 23.43 19.42 25.00 17 RCVD_IN_MSPIKE_H2 132220 26.44 30.58 24.82 18 DKIM_VALID_EF 132083 26.46 30.72 24.80 19 MIME_HTML_ONLY 132078 26.67 31.48 24.80 20 LOC_TINY_FONT_1 121304 26.65 36.59 22.77 21 FVGT_m_MULTI_ODD 108857 21.49 24.19 20.44 22 XMSubLong 105355 20.85 23.58 19.78 23 BAYES_00 104507 14.40 1.06 19.62 24 XM_B_SpammyWords2 103799 24.80 38.39 19.49 25 T_KAM_HTML_FONT_INVALID 91449 19.33 24.85 17.17 26 HTML_IMAGE_RATIO_04 84810 12.77 4.71 15.92 27 RCVD_IN_MSPIKE_H3 78506 13.60 10.69 14.74 28 XM_H_Trusted_IP 75151 10.15 0.00 14.11 29 HTML_FONT_FACE_BAD 73670 10.12 0.63 13.83 30 XM_Body_Dirty_Words 63663 13.39 17.08 11.95 31 XM_Multi_Part_URI 60482 14.26 21.68 11.35 32 ALL_TRUSTED 58129 8.13 0.99 10.91 33 XMStrtUSub 55999 8.75 4.23 10.51 34 MPART_ALT_DIFF 55198 10.53 10.94 10.36 35 XM_Evil_Numbers_Gen 51202 9.82 10.35 9.61 36 RCVD_IN_MSPIKE_H4 48523 8.68 7.60 9.11 37 XM_B_Unsub 48231 10.71 14.95 9.05 38 TR_XM_DK_Bayes 47619 6.66 0.81 8.94 39 TR_XM_DK_Bayes1 46220 6.46 0.79 8.68 40 MIME_HTML_ONLY_MULTI 44741 6.87 2.95 8.40 41 LotsOfNums_01 43254 9.56 13.25 8.12 42 TR_XM_DK_Bayes2 41026 5.71 0.63 7.70 43 XM_DKIMWhitelistDomains 39328 5.32 0.04 7.38 44 RCVD_IN_RP_SAFE 39117 6.41 4.03 7.34 45 UNPARSEABLE_RELAY 38663 7.32 7.49 7.26 46 TooManyTo_001 37181 6.85 6.53 6.98 47 RCVD_IN_RP_CERTIFIED 35856 5.80 3.41 6.73 48 HTML_IMAGE_RATIO_02 34870 7.31 9.27 6.55 49 LOTS_OF_MONEY 34799 8.09 12.07 6.53 50 XM_SendGrid 34496 6.39 6.17 6.48 51 BAYES_60 34325 6.92 8.14 6.44 52 XM_DK_Undo_02 33769 17.82 47.22 6.34 53 IN_ZIMBRA_NJ_WHITELIST 29852 4.04 0.05 5.60 54 FSL_BULK_SIG 28700 7.58 13.20 5.39 55 XM_H_Long_From01 28340 5.26 5.12 5.32 56 MIME_QP_LONG_LINE 27500 4.49 2.77 5.16 57 BAYES_40 27441 4.33 2.23 5.15 58 HTML_IMAGE_RATIO_06 27262 4.98 4.63 5.12 59 XM_B_SpammyWords3 27169 7.10 12.21 5.10 60 RCVD_IN_IADB_LISTED 26856 4.15 1.86 5.04 61 TR_XM_UnparsRelay 26740 5.63 7.17 5.02 62 BAYES_20 25891 3.98 1.73 4.86 63 TR_XM_DKIM_Undo 24958 13.46 35.93 4.69 64 RELAYCOUNTRY_META 24030 9.99 24.02 4.51 65 RCVD_IN_IADB_SPF 23452 3.63 1.67 4.40 66 XMSubNoVowel 23187 3.60 1.67 4.35 67 XM_B_Phish_Phrases 23143 5.33 7.86 4.34 68 TR_XM_SpammyWords4 22095 5.84 10.18 4.15 69 TR_XM_DK_SendGrid 21595 3.84 3.31 4.05 70 T_TooManySym_01 21424 3.63 2.64 4.02 71 XMSexyCombo_05 21268 5.58 9.65 3.99 72 RCVD_IN_IADB_SENDERID 21009 3.28 1.59 3.94 73 BOTNET_IPINHOSTNAME 20812 6.30 12.44 3.91 74 BAYES_99 20591 12.95 36.21 3.87 75 RCVD_IN_IADB_DK 20285 3.19 1.60 3.81 76 BAYES_80 19207 5.12 8.99 3.61 77 BAYES_05 18097 2.70 0.90 3.40 78 XM_PDF 17571 2.57 0.72 3.30 79 XMSubMetaSx_00 16839 4.11 6.55 3.16 80 BAYES_999 16773 10.36 28.81 3.15 81 FROM_EXCESS_BASE64 16402 3.05 2.96 3.08 82 RCVD_IN_IADB_VOUCHED 16367 2.41 0.70 3.07 83 T_REMOTE_IMAGE 16315 3.92 6.12 3.06 84 XMNumbers 15871 3.39 4.44 2.98 85 XM_UncommonTLD01 14875 5.70 13.12 2.79 86 DKIM_INVALID 14870 3.01 3.55 2.79 87 URI_NOVOWEL 13520 2.16 1.18 2.54 88 TM2_M_URI_OPT_OUT 13407 2.99 4.18 2.52 89 MIME_HTML_MOSTLY 13147 4.22 8.72 2.47 90 TR_XM_PhishingBody 13026 3.46 6.05 2.45 91 HTML_IMAGE_RATIO_08 12969 3.41 5.90 2.43 92 BAYES_95 11901 3.15 5.49 2.23 93 RCVD_IN_MSPIKE_H5 11701 1.79 0.73 2.20 94 MAILING_LIST_MULTI 11692 1.92 1.20 2.20 95 ANY_BOUNCE_MESSAGE 11652 1.71 0.50 2.19 96 BOUNCE_MESSAGE 11648 1.71 0.49 2.19 97 RCVD_IN_IADB_OPTIN 10622 1.57 0.48 1.99 98 TR_DCC_Bayes_99 10455 9.64 29.30 1.96 99 UNTRUSTED_Relay 10131 6.12 16.93 1.90 100 XM_B_SpammyTLD 10118 2.51 4.08 1.90 101 T_TooManySym_02 10092 1.60 0.86 1.89 102 TR_XM_SB_Phish 9841 1.97 2.30 1.85 103 XMSubPhish11 9728 1.93 2.20 1.83 104 HTML_MIME_NO_HTML_TAG 9720 2.09 2.78 1.82 105 XM_SPF_SoftFail 9317 2.39 4.03 1.75 106 TooManyTo_002 9272 1.39 0.49 1.74 107 XMSubGarbage 9167 1.25 0.06 1.72 108 XM_CamelCaseFrm001 8987 1.80 2.10 1.69 109 XMSubLongNoVowel 8732 1.29 0.41 1.64 110 KHOP_HELO_FCRDNS 8586 2.56 5.00 1.61 111 XMDiploma_00 8347 1.81 2.44 1.57 112 XM_B_Phish66 8243 1.98 3.10 1.55 113 XM_B_Unsub2 8181 1.92 2.92 1.54 114 XM_DK_Undo_01 7902 1.90 2.95 1.48 115 URI_HEX 7901 1.97 3.20 1.48 116 T_XMDrugObfuBody_14 7858 1.48 1.50 1.48 117 BOTNET 7819 5.87 17.13 1.47 118 XMStockSpam_06 7740 1.44 1.40 1.45 119 TVD_RCVD_IP 7662 1.09 0.20 1.44 120 SUBJ_ALL_CAPS 7620 2.00 3.45 1.43 121 T_FONT_INVIS_NAKED_TO 7543 2.10 3.86 1.42 122 TR_XM_SpammyWords5 7514 2.47 5.16 1.41 123 T_XMDrugObfuBody_08 7472 1.75 2.63 1.40 124 IN_HORDE_ADDRESS_BOOK 7451 1.04 0.12 1.40 125 INVALID_MSGID 7294 1.09 0.39 1.37 126 HELO_NO_DOMAIN 6970 1.15 0.75 1.31 127 HELO_NODOT 6970 1.15 0.76 1.31 128 TM2_M_VERY_LONG_WORD 6802 1.40 1.72 1.28 129 RELAYCOUNTRY_CA 6729 2.84 6.89 1.26 130 TO_MALFORMED 6584 0.89 0.02 1.24 131 MSGID_NOFQDN1 6511 0.89 0.03 1.22 132 TR_Symld_Words 6410 1.18 1.13 1.20 133 RCVD_IN_BL_SPAMCOP_NET 6354 3.19 8.30 1.19 134 HELO_MISC_IP 6002 1.00 0.67 1.13 135 CK_HELO_DYNAMIC_SPLIT_IP 5996 1.00 0.69 1.13 136 TooManyTo_003 5943 0.91 0.38 1.12 137 XM_ProductURIs 5694 0.99 0.80 1.07 138 XM_UB50 5635 2.25 5.29 1.06 139 XM_E_Blogspot 5607 0.77 0.05 1.05 140 T_XMDrugObfuBody_00 5499 1.10 1.28 1.03 141 XMCapTrack 5370 0.81 0.30 1.01 142 DKIM_ADSP_CUSTOM_MED 5321 1.05 1.18 1.00 143 XM_H_Long_From02 5309 1.03 1.11 1.00 144 XM_GoogleGroups 5173 0.81 0.41 0.97 145 TR_MSPIKEBAYES00 5161 0.70 0.01 0.97 146 USER_IN_DEF_DKIM_WL 5157 0.70 0.01 0.97 147 XMGenDplmaNmb 5122 1.11 1.48 0.96 148 URI_TRY_3LD 4968 1.20 1.87 0.93 149 XMBSHREFv2 4809 0.74 0.32 0.90 150 XMGappySubj_01 4573 0.66 0.15 0.86 151 XM_OfRef6 4488 2.02 5.04 0.84 152 TR_XM_SpammyWords2 4456 4.52 13.95 0.84 153 TooManyTo_004 4333 0.68 0.33 0.81 154 XMSubMetaI_00 4308 1.07 1.72 0.81 155 XMBdyGiftCard01 4297 1.25 2.40 0.81 156 RELAYCOUNTRY_GB 4199 0.93 1.30 0.79 157 XMBody_95 3867 0.55 0.11 0.73 158 SpammyFromTLD_01 3734 2.21 6.08 0.70 159 XMBrknScrpt_02 3716 1.44 3.35 0.70 160 XM_B_COVIDMETA 3645 1.28 2.79 0.68 161 NML_ADSP_CUSTOM_MED 3645 0.79 1.05 0.68 162 TooManyTo_005 3540 0.55 0.27 0.66 163 PDS_OTHER_BAD_TLD 3507 0.99 1.84 0.66 164 XMHTML_After_End 3478 0.79 1.13 0.65 165 HTTPS_HTTP_MISMATCH 3467 0.72 0.89 0.65 166 T_FILL_THIS_FORM_SHORT 3446 1.15 2.46 0.65 167 FORGED_GMAIL_RCVD 3363 0.83 1.33 0.63 168 T_XMHurry_00 2896 0.77 1.35 0.54 169 XMHTMLBadTable_001 2871 0.56 0.63 0.54 170 T_TooManySym_03 2833 0.42 0.13 0.53 171 TR_MetaPhish_Combo_01 2827 0.60 0.78 0.53 172 XMSexyCombo_01 2726 0.82 1.61 0.51 173 XMBody_17 2711 1.22 3.05 0.51 174 XMNoVowels 2605 0.49 0.49 0.49 175 XMOemUri 2580 0.42 0.26 0.48 176 XM_ShortIntro_01 2563 0.41 0.22 0.48 177 XM_DIRTYINTL 2541 1.09 2.66 0.48 178 RELAYCOUNTRY_DE 2502 0.68 1.21 0.47 179 RCVD_IN_SORBS_DUL 2490 0.40 0.22 0.47 180 T_OBFU_PDF_ATTACH 2484 0.37 0.14 0.47 181 T_Symld_Words_02 2483 0.70 1.32 0.47 182 HTML_IMAGE_ONLY_20 2465 0.52 0.65 0.46 183 XMSlimDrugH 2444 0.52 0.69 0.46 184 XMSolicitRefs_0 2426 0.44 0.40 0.46 185 XMMoneyMeta_00 2424 0.63 1.09 0.46 186 XM_B_SpammyWords4 2360 0.81 1.73 0.44 187 RDNS_DYNAMIC 2254 0.55 0.86 0.42 188 XM_Body_Obfu01 2215 0.39 0.33 0.42 189 XMLngstWrd_00 2204 0.40 0.38 0.41 190 XM_H_PHPMailer 2175 0.43 0.47 0.41 191 RCVD_IN_MSPIKE_BL 2129 1.57 4.58 0.40 192 XM_B_REG_HTML 2124 0.36 0.28 0.40 193 XM_B_COPY_HTML 2122 0.42 0.48 0.40 194 FROM_GOV_DKIM_AU 2103 0.37 0.30 0.39 195 XM_SPF_Unknown 2102 0.45 0.60 0.39 196 TR_XM_MSPIKECOMBO 2086 1.55 4.52 0.39 197 NUMERIC_HTTP_ADDR 2066 0.65 1.34 0.39 198 XMLngstWrd_01 2009 0.37 0.34 0.38 199 HTML_IMAGE_ONLY_28 1966 0.36 0.35 0.37 200 T_MANY_PILL_PRICE 1950 0.27 0.02 0.37 ----------------------------------------------------------------------