Email: 693037 Autolearn: 0 AvgScore: 3.71 AvgScanTime: 1.42 sec Spam: 204334 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.56 sec Ham: 488703 Autolearn: 0 AvgScore: -0.46 AvgScanTime: 1.36 sec Time Spent Running SA: 272.68 hours Time Spent Processing Spam: 88.62 hours Time Spent Processing Ham: 184.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 192988 92.05 94.45 91.05 2 DKIM_SIGNED 172409 79.99 84.38 78.15 3 XM_DK_Pass 168038 78.45 82.24 76.87 4 DKIM_VALID 163744 76.45 80.14 74.91 5 DCC_CHECK 160404 52.73 78.50 41.96 6 XM_B_Unicode 157945 75.39 77.30 74.59 7 RELAYCOUNTRY_US 154113 81.96 75.42 84.70 8 XMListUnsubscribeExists 140358 58.63 68.69 54.42 9 XM_B_SpammyWords 138398 55.25 67.73 50.03 10 DKIM_VALID_AU 126354 58.25 61.84 56.76 11 XM_DK_Undo_02 90836 18.27 44.45 7.33 12 XM_B_Unicode3 83169 42.69 40.70 43.52 13 LOC_TINY_FONT_1 81593 30.12 39.93 26.02 14 XM_B_SpammyWords2 80370 26.82 39.33 21.58 15 BAYES_50 74271 50.13 36.35 55.89 16 TR_XM_DKIM_Undo 72632 14.58 35.55 5.81 17 BAYES_99 71755 13.24 35.12 4.09 18 HTML_FONT_LOW_CONTRAST 70582 30.90 34.54 29.37 19 RCVD_IN_MSPIKE_H2 61015 28.55 29.86 28.00 20 DKIM_VALID_EF 60766 28.70 29.74 28.26 21 MIME_HTML_ONLY 59455 23.29 29.10 20.85 22 FVGT_m_MULTI_ODD 57941 25.24 28.36 23.94 23 BAYES_999 56236 10.41 27.52 3.25 24 TR_DCC_Bayes_99 55198 9.52 27.01 2.21 25 T_KAM_HTML_FONT_INVALID 54754 22.06 26.80 20.07 26 XMSubLong 48824 21.80 23.89 20.92 27 RELAYCOUNTRY_META 48034 10.70 23.51 5.35 28 T_TM2_M_HEADER_IN_MSG 42670 26.88 20.88 29.39 29 XM_Multi_Part_URI 41593 14.00 20.36 11.35 30 DCC_CHECK_NEGATIVE 40494 45.17 19.82 55.77 31 RCVD_IN_MSPIKE_WL 40092 26.60 19.62 29.52 32 XM_Body_Dirty_Words 39382 15.09 19.27 13.34 33 BOTNET 33038 6.36 16.17 2.26 34 UNTRUSTED_Relay 32420 6.14 15.87 2.08 35 BOTNET_IPINHOSTNAME 30150 7.87 14.76 4.99 36 XM_B_Unsub 29426 11.35 14.40 10.07 37 LOTS_OF_MONEY 29346 8.79 14.36 6.46 38 TR_XM_SpammyWords2 26496 4.27 12.97 0.63 39 XM_B_SpammyWords3 25831 7.92 12.64 5.95 40 FSL_BULK_SIG 25013 7.55 12.24 5.59 41 TR_XM_SpammyWords4 25001 6.58 12.24 4.21 42 LotsOfNums_01 22685 9.74 11.10 9.17 43 RCVD_IN_MSPIKE_H3 22319 14.36 10.92 15.80 44 XM_Evil_Numbers_Gen 20688 9.31 10.12 8.97 45 MPART_ALT_DIFF 20251 6.78 9.91 5.47 46 XM_UncommonTLD01 20244 5.20 9.91 3.23 47 HTML_IMAGE_RATIO_02 19968 8.05 9.77 7.32 48 RCVD_IN_BL_SPAMCOP_NET 19851 3.73 9.71 1.23 49 XMSexyCombo_05 19124 5.47 9.36 3.84 50 BAYES_80 18685 5.67 9.14 4.21 51 MIME_HTML_MOSTLY 17395 4.16 8.51 2.33 52 UNPARSEABLE_RELAY 16302 8.09 7.98 8.13 53 RCVD_IN_MSPIKE_H4 15905 10.33 7.78 11.40 54 BAYES_60 15585 7.69 7.63 7.71 55 TR_XM_UnparsRelay 15368 6.30 7.52 5.79 56 XM_B_Phish_Phrases 14839 5.07 7.26 4.16 57 XMSubMetaSx_00 14324 4.54 7.01 3.51 58 XM_SendGrid 13607 7.11 6.66 7.30 59 RELAYCOUNTRY_CA 13428 2.99 6.57 1.49 60 RCVD_IN_MSPIKE_BL 12504 1.93 6.12 0.17 61 TooManyTo_001 12406 7.69 6.07 8.37 62 TR_XM_PhishingBody 12293 4.47 6.02 3.82 63 TR_XM_MSPIKECOMBO 12052 1.85 5.90 0.16 64 TR_XM_SpammyWords5 11333 2.76 5.55 1.60 65 XM_H_Long_From01 11324 5.93 5.54 6.10 66 XM_OfRef6 10909 2.31 5.34 1.04 67 XMNumbers 10810 3.77 5.29 3.13 68 BAYES_95 10789 3.39 5.28 2.59 69 HTML_IMAGE_RATIO_08 10624 3.32 5.20 2.53 70 T_REMOTE_IMAGE 10470 4.11 5.12 3.68 71 HTML_IMAGE_RATIO_06 9849 4.58 4.82 4.47 72 HTML_IMAGE_RATIO_04 9700 5.45 4.75 5.75 73 RCVD_IN_RP_RNBL 9486 1.40 4.64 0.04 74 XM_UB50 9455 2.18 4.63 1.16 75 KHOP_HELO_FCRDNS 9377 2.43 4.59 1.53 76 RCVD_IN_MSPIKE_L5 9111 1.37 4.46 0.08 77 SpammyFromTLD_01 9097 1.97 4.45 0.93 78 RCVD_IN_RP_SAFE 8703 7.21 4.26 8.45 79 DKIM_INVALID 8665 3.53 4.24 3.24 80 URIBL_SBL_A 8089 1.29 3.96 0.17 81 XM_SPF_SoftFail 7999 2.33 3.91 1.66 82 TM2_M_URI_OPT_OUT 7921 3.13 3.88 2.82 83 RCVD_IN_PSBL 7674 1.15 3.76 0.06 84 TR_LOTS_OF_MONEY3 7656 1.39 3.75 0.41 85 TR_XM_DK_SendGrid 7598 4.46 3.72 4.78 86 SUBJ_ALL_CAPS 7381 2.21 3.61 1.62 87 XM_UB99 7370 1.07 3.61 0.01 88 RELAYCOUNTRY_FR 7245 1.28 3.55 0.33 89 XM_DK_Undo_01 7190 2.22 3.52 1.67 90 T_FONT_INVIS_NAKED_TO 7020 2.16 3.44 1.62 91 RCVD_IN_RP_CERTIFIED 6987 6.43 3.42 7.68 92 XMStrtUSub 6786 4.47 3.32 4.95 93 HTML_IMAGE_ONLY_12 6759 1.12 3.31 0.21 94 TM2_M_VERY_LONG_WORD 6715 1.83 3.29 1.22 95 BODY_URI_ONLY 6621 0.99 3.24 0.06 96 XM_B_SpammyTLD 6584 2.41 3.22 2.07 97 HTML_SHORT_LINK_IMG_1 6511 0.96 3.19 0.02 98 T_FILL_THIS_FORM_SHORT 6246 1.50 3.06 0.85 99 URI_HEX 6225 2.06 3.05 1.65 100 XM_B_COVIDMETA 6201 1.50 3.03 0.86 101 XM_B_Phish66 6158 2.55 3.01 2.36 102 MIME_QP_LONG_LINE 6047 5.02 2.96 5.88 103 SpammyFromTLD_02 6007 1.00 2.94 0.19 104 XMBody_17 5848 1.33 2.86 0.69 105 TR_XM_SB_Phish 5791 2.57 2.83 2.47 106 XMDiploma_00 5790 2.02 2.83 1.68 107 XM_UB60 5708 0.92 2.79 0.13 108 XMSubPhish11 5642 2.54 2.76 2.44 109 MIME_HTML_ONLY_MULTI 5420 3.31 2.65 3.59 110 XM_B_Unsub2 5333 2.19 2.61 2.02 111 XM_UB80 5318 0.79 2.60 0.04 112 XM_DIRTYINTL 5259 1.13 2.57 0.52 113 XM_UB999 5203 0.75 2.55 0.00 114 T_XMDrugObfuBody_08 5125 1.95 2.51 1.72 115 XM_CamelCaseFrm001 4925 2.00 2.41 1.83 116 XMBrknScrpt_02 4906 1.19 2.40 0.68 117 XMSexyCombo_01 4891 1.24 2.39 0.76 118 XM_B_SpammyWords4 4806 1.12 2.35 0.60 119 T_TooManySym_01 4728 4.02 2.31 4.73 120 TR_XM_SpammyWords3 4718 0.73 2.31 0.07 121 T_XMDrugObfuBody_14 4690 1.82 2.30 1.62 122 URI_TRY_3LD 4668 1.69 2.28 1.44 123 TR_XM_MaxBayes 4574 0.66 2.24 0.01 124 FROM_EXCESS_BASE64 4551 2.60 2.23 2.75 125 BAYES_40 4392 4.24 2.15 5.11 126 XMBdyGiftCard01 4247 1.11 2.08 0.70 127 PDS_FROM_2_EMAILS 4207 0.63 2.06 0.03 128 FROM_2_EMAILS_SHORT 4171 0.61 2.04 0.00 129 RCVD_IN_IADB_LISTED 4004 4.58 1.96 5.67 130 LONG_JUNK_URI 3988 0.61 1.95 0.05 131 PDS_TO_EQ_FROM_NAME 3934 0.57 1.93 0.00 132 BAYES_20 3875 3.47 1.90 4.13 133 FORGED_GMAIL_RCVD 3808 1.00 1.86 0.63 134 XM_URI_RBL 3726 0.69 1.82 0.21 135 XMStockSpam_06 3640 1.48 1.78 1.35 136 PDS_OTHER_BAD_TLD 3570 1.04 1.75 0.75 137 NO_FM_NAME_IP_HOSTN 3558 0.52 1.74 0.00 138 RCVD_IN_IADB_SPF 3538 4.01 1.73 4.97 139 TR_XM_FormFill 3495 0.51 1.71 0.01 140 TR_Caps_n_Bayes_99 3486 0.54 1.71 0.05 141 BOTNET_NORDNS 3453 0.51 1.69 0.02 142 XMGenDplmaNmb 3406 1.10 1.67 0.87 143 TR_XM_COVIDMETA4 3403 0.75 1.67 0.36 144 T_XMDrugObfuBody_00 3371 1.14 1.65 0.93 145 RCVD_IN_IADB_DK 3342 3.52 1.64 4.30 146 RCVD_IN_IADB_SENDERID 3319 3.62 1.62 4.45 147 XM_UB95 3172 0.47 1.55 0.01 148 RDNS_DYNAMIC 3102 0.80 1.52 0.50 149 XMSubNoVowel 3089 1.24 1.51 1.12 150 URI_WP_HACKED 3084 0.45 1.51 0.01 151 RELAYCOUNTRY_GB 2975 1.30 1.46 1.23 152 XM_OfRef7 2909 0.54 1.42 0.17 153 HTML_MIME_NO_HTML_TAG 2899 1.79 1.42 1.95 154 TR_MetaPhish_Combo_01 2870 0.95 1.40 0.76 155 TR_XM_COVIDMETA1 2852 0.65 1.40 0.34 156 TR_XM_INV_DKIM 2847 0.48 1.39 0.10 157 NUMERIC_HTTP_ADDR 2819 0.83 1.38 0.60 158 MAILING_LIST_MULTI 2817 2.42 1.38 2.85 159 HK_RANDOM_REPLYTO 2814 0.57 1.38 0.23 160 TR_Symld_Words 2807 1.41 1.37 1.42 161 FROM_SUSPICIOUS_NTLD 2730 0.45 1.34 0.08 162 TR_XM_PHPDW 2713 0.66 1.33 0.38 163 BAYES_00 2702 10.16 1.32 13.86 164 HTML_FONT_SIZE_LARGE 2698 0.46 1.32 0.09 165 TR_XM_PHPForged 2680 0.63 1.31 0.34 166 XMHTML_After_End 2630 1.02 1.29 0.90 167 TR_XM_FormFill2 2630 0.62 1.29 0.34 168 XM_H_PHPOS 2622 0.61 1.28 0.33 169 RELAYCOUNTRY_AL 2557 0.37 1.25 0.01 170 FROM_SUSPICIOUS_NTLD_FP 2553 0.42 1.25 0.08 171 XMSexyCombo_04 2508 0.50 1.23 0.19 172 T_XMHurry_00 2458 0.83 1.20 0.68 173 URI_NOVOWEL 2434 2.37 1.19 2.86 174 DATE_IN_PAST_03_06 2425 0.40 1.19 0.08 175 MIMEOLE_DIRECT_TO_MX 2389 0.35 1.17 0.00 176 XMPhish08 2372 0.55 1.16 0.30 177 TR_XM_SpoofStaff 2354 0.41 1.15 0.10 178 XMSubMetaI_00 2350 0.81 1.15 0.67 179 XMSpoofStaff2 2327 0.41 1.14 0.10 180 BAYES_05 2265 1.99 1.11 2.36 181 XM_LoanWordsFrm 2242 0.38 1.10 0.07 182 XM_ProductURIs 2240 1.34 1.10 1.45 183 URI_GOOGLE_PROXY 2237 0.37 1.09 0.06 184 BITCOIN_XPRIO 2204 0.32 1.08 0.00 185 HTTPS_HTTP_MISMATCH 2180 0.96 1.07 0.92 186 CK_HELO_DYNAMIC_SPLIT_IP 2134 0.90 1.04 0.84 187 TR_LOTS_OF_MONEY2 2105 0.45 1.03 0.20 188 T_MONEY_PERCENT 2105 0.45 1.03 0.20 189 TR_XM_BayesRelay 2089 0.31 1.02 0.01 190 URG_BIZ 2084 0.33 1.02 0.04 191 ALL_TRUSTED 2083 8.37 1.02 11.45 192 RELAYCOUNTRY_DE 2054 0.75 1.01 0.64 193 LongTLD 2001 0.39 0.98 0.15 194 RELAYCOUNTRY_IN 1975 0.36 0.97 0.11 195 XM_Nigeria_01 1956 0.38 0.96 0.14 196 MIME_CHARSET_FARAWAY 1950 0.36 0.95 0.11 197 HELO_NODOT 1943 1.46 0.95 1.67 198 XMSubMetaSSx_00 1932 0.37 0.95 0.13 199 HELO_NO_DOMAIN 1925 1.46 0.94 1.67 200 TR_XM_RelayPhish 1922 0.46 0.94 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 444986 92.05 94.45 91.05 2 RELAYCOUNTRY_US 413924 81.96 75.42 84.70 3 DKIM_SIGNED 381927 79.99 84.38 78.15 4 XM_DK_Pass 375670 78.45 82.24 76.87 5 DKIM_VALID 366100 76.45 80.14 74.91 6 XM_B_Unicode 364531 75.39 77.30 74.59 7 DKIM_VALID_AU 277365 58.25 61.84 56.76 8 BAYES_50 273144 50.13 36.35 55.89 9 DCC_CHECK_NEGATIVE 272564 45.17 19.82 55.77 10 XMListUnsubscribeExists 265937 58.63 68.69 54.42 11 XM_B_SpammyWords 244492 55.25 67.73 50.03 12 XM_B_Unicode3 212685 42.69 40.70 43.52 13 DCC_CHECK 205063 52.73 78.50 41.96 14 RCVD_IN_MSPIKE_WL 144275 26.60 19.62 29.52 15 T_TM2_M_HEADER_IN_MSG 143643 26.88 20.88 29.39 16 HTML_FONT_LOW_CONTRAST 143545 30.90 34.54 29.37 17 DKIM_VALID_EF 138131 28.70 29.74 28.26 18 RCVD_IN_MSPIKE_H2 136835 28.55 29.86 28.00 19 LOC_TINY_FONT_1 127177 30.12 39.93 26.02 20 FVGT_m_MULTI_ODD 116974 25.24 28.36 23.94 21 XM_B_SpammyWords2 105474 26.82 39.33 21.58 22 XMSubLong 102261 21.80 23.89 20.92 23 MIME_HTML_ONLY 101919 23.29 29.10 20.85 24 T_KAM_HTML_FONT_INVALID 98106 22.06 26.80 20.07 25 RCVD_IN_MSPIKE_H3 77211 14.36 10.92 15.80 26 BAYES_00 67714 10.16 1.32 13.86 27 XM_Body_Dirty_Words 65210 15.09 19.27 13.34 28 ALL_TRUSTED 55935 8.37 1.02 11.45 29 RCVD_IN_MSPIKE_H4 55708 10.33 7.78 11.40 30 XM_Multi_Part_URI 55455 14.00 20.36 11.35 31 TR_XM_DK_Bayes 49549 7.38 0.78 10.14 32 XM_B_Unsub 49234 11.35 14.40 10.07 33 TR_XM_DK_Bayes1 48172 7.17 0.76 9.86 34 LotsOfNums_01 44803 9.74 11.10 9.17 35 XM_Evil_Numbers_Gen 43845 9.31 10.12 8.97 36 TR_XM_DK_Bayes2 42862 6.39 0.71 8.77 37 RCVD_IN_RP_SAFE 41298 7.21 4.26 8.45 38 TooManyTo_001 40915 7.69 6.07 8.37 39 UNPARSEABLE_RELAY 39754 8.09 7.98 8.13 40 XM_DKIMWhitelistDomains 38918 5.62 0.01 7.96 41 BAYES_60 37676 7.69 7.63 7.71 42 RCVD_IN_RP_CERTIFIED 37554 6.43 3.42 7.68 43 XM_DK_Undo_02 35813 18.27 44.45 7.33 44 HTML_IMAGE_RATIO_02 35796 8.05 9.77 7.32 45 XM_SendGrid 35651 7.11 6.66 7.30 46 LOTS_OF_MONEY 31591 8.79 14.36 6.46 47 XM_H_Long_From01 29791 5.93 5.54 6.10 48 XM_B_SpammyWords3 29061 7.92 12.64 5.95 49 IN_ZIMBRA_NJ_WHITELIST 29052 4.23 0.13 5.94 50 MIME_QP_LONG_LINE 28733 5.02 2.96 5.88 51 TR_XM_DKIM_Undo 28401 14.58 35.55 5.81 52 TR_XM_UnparsRelay 28278 6.30 7.52 5.79 53 HTML_IMAGE_RATIO_04 28105 5.45 4.75 5.75 54 RCVD_IN_IADB_LISTED 27712 4.58 1.96 5.67 55 FSL_BULK_SIG 27308 7.55 12.24 5.59 56 MPART_ALT_DIFF 26710 6.78 9.91 5.47 57 RELAYCOUNTRY_META 26139 10.70 23.51 5.35 58 BAYES_40 24995 4.24 2.15 5.11 59 BOTNET_IPINHOSTNAME 24378 7.87 14.76 4.99 60 RCVD_IN_IADB_SPF 24271 4.01 1.73 4.97 61 XMStrtUSub 24202 4.47 3.32 4.95 62 TR_XM_DK_SendGrid 23339 4.46 3.72 4.78 63 T_TooManySym_01 23124 4.02 2.31 4.73 64 HTML_IMAGE_RATIO_06 21865 4.58 4.82 4.47 65 RCVD_IN_IADB_SENDERID 21760 3.62 1.62 4.45 66 RCVD_IN_IADB_DK 21033 3.52 1.64 4.30 67 XM_PDF 20810 3.24 0.82 4.26 68 BAYES_80 20589 5.67 9.14 4.21 69 TR_XM_SpammyWords4 20575 6.58 12.24 4.21 70 XM_B_Phish_Phrases 20332 5.07 7.26 4.16 71 BAYES_20 20193 3.47 1.90 4.13 72 BAYES_99 19995 13.24 35.12 4.09 73 XMSexyCombo_05 18762 5.47 9.36 3.84 74 TR_XM_PhishingBody 18673 4.47 6.02 3.82 75 T_REMOTE_IMAGE 18001 4.11 5.12 3.68 76 MIME_HTML_ONLY_MULTI 17541 3.31 2.65 3.59 77 XM_H_Trusted_IP 17199 2.48 0.00 3.52 78 XMSubMetaSx_00 17145 4.54 7.01 3.51 79 RCVD_IN_IADB_VOUCHED 16845 2.70 0.90 3.45 80 BAYES_999 15900 10.41 27.52 3.25 81 DKIM_INVALID 15827 3.53 4.24 3.24 82 XM_UncommonTLD01 15784 5.20 9.91 3.23 83 XMNumbers 15319 3.77 5.29 3.13 84 URI_NOVOWEL 13999 2.37 1.19 2.86 85 MAILING_LIST_MULTI 13951 2.42 1.38 2.85 86 TM2_M_URI_OPT_OUT 13783 3.13 3.88 2.82 87 FROM_EXCESS_BASE64 13447 2.60 2.23 2.75 88 BAYES_95 12678 3.39 5.28 2.59 89 HTML_IMAGE_RATIO_08 12367 3.32 5.20 2.53 90 TR_XM_SB_Phish 12053 2.57 2.83 2.47 91 XMSubPhish11 11929 2.54 2.76 2.44 92 XM_B_Phish66 11535 2.55 3.01 2.36 93 BAYES_05 11530 1.99 1.11 2.36 94 MIME_HTML_MOSTLY 11403 4.16 8.51 2.33 95 RCVD_IN_MSPIKE_H5 11356 1.91 0.91 2.32 96 BOTNET 11065 6.36 16.17 2.26 97 RCVD_IN_IADB_OPTIN 10947 1.76 0.61 2.24 98 TR_DCC_Bayes_99 10805 9.52 27.01 2.21 99 TooManyTo_002 10638 1.72 0.64 2.18 100 UNTRUSTED_Relay 10151 6.14 15.87 2.08 101 XM_B_SpammyTLD 10136 2.41 3.22 2.07 102 T_TooManySym_02 10040 1.64 0.65 2.05 103 XM_B_Unsub2 9851 2.19 2.61 2.02 104 HTML_MIME_NO_HTML_TAG 9506 1.79 1.42 1.95 105 XM_CamelCaseFrm001 8960 2.00 2.41 1.83 106 USER_IN_DEF_DKIM_WL 8808 1.28 0.05 1.80 107 T_XMDrugObfuBody_08 8382 1.95 2.51 1.72 108 XMDiploma_00 8231 2.02 2.83 1.68 109 HELO_NO_DOMAIN 8184 1.46 0.94 1.67 110 HELO_NODOT 8184 1.46 0.95 1.67 111 XM_DK_Undo_01 8174 2.22 3.52 1.67 112 XM_SPF_SoftFail 8126 2.33 3.91 1.66 113 URI_HEX 8046 2.06 3.05 1.65 114 SUBJ_ALL_CAPS 7932 2.21 3.61 1.62 115 T_FONT_INVIS_NAKED_TO 7920 2.16 3.44 1.62 116 T_XMDrugObfuBody_14 7904 1.82 2.30 1.62 117 TR_XM_SpammyWords5 7797 2.76 5.55 1.60 118 KHOP_HELO_FCRDNS 7472 2.43 4.59 1.53 119 ANY_BOUNCE_MESSAGE 7469 1.21 0.44 1.53 120 BOUNCE_MESSAGE 7467 1.21 0.44 1.53 121 IN_HORDE_ADDRESS_BOOK 7459 1.18 0.37 1.53 122 INVALID_MSGID 7398 1.22 0.50 1.51 123 RELAYCOUNTRY_CA 7289 2.99 6.57 1.49 124 XM_ProductURIs 7078 1.34 1.10 1.45 125 URI_TRY_3LD 7043 1.69 2.28 1.44 126 TR_Symld_Words 6939 1.41 1.37 1.42 127 TooManyTo_003 6923 1.15 0.51 1.42 128 HTML_FONT_FACE_BAD 6708 1.14 0.60 1.37 129 MSGID_NOFQDN1 6670 0.98 0.05 1.36 130 XMStockSpam_06 6590 1.48 1.78 1.35 131 TO_MALFORMED 6570 0.95 0.01 1.34 132 TVD_RCVD_IP 6558 1.16 0.73 1.34 133 XM_H_Long_From02 6189 1.16 0.92 1.27 134 XMCapTrack 6079 1.00 0.42 1.24 135 RCVD_IN_BL_SPAMCOP_NET 6027 3.73 9.71 1.23 136 RELAYCOUNTRY_GB 6021 1.30 1.46 1.23 137 TM2_M_VERY_LONG_WORD 5953 1.83 3.29 1.22 138 HELO_MISC_IP 5819 0.96 0.41 1.19 139 XM_GoogleGroups 5690 0.97 0.51 1.16 140 XM_UB50 5676 2.18 4.63 1.16 141 XMSubNoVowel 5475 1.24 1.51 1.12 142 XMGappySubj_01 5285 0.82 0.20 1.08 143 XM_OfRef6 5098 2.31 5.34 1.04 144 DKIM_ADSP_CUSTOM_MED 5082 0.96 0.78 1.04 145 TR_MSPIKEBAYES00 5021 0.73 0.01 1.03 146 TooManyTo_004 4982 0.85 0.43 1.02 147 FROM_GOV_DKIM_AU 4700 0.71 0.11 0.96 148 XMBSHREFv2 4651 0.76 0.30 0.95 149 SpammyFromTLD_01 4530 1.97 4.45 0.93 150 T_XMDrugObfuBody_00 4521 1.14 1.65 0.93 151 HTTPS_HTTP_MISMATCH 4499 0.96 1.07 0.92 152 XMHTML_After_End 4411 1.02 1.29 0.90 153 XMGenDplmaNmb 4234 1.10 1.67 0.87 154 TooManyTo_005 4222 0.72 0.38 0.86 155 XM_B_COVIDMETA 4194 1.50 3.03 0.86 156 T_FILL_THIS_FORM_SHORT 4175 1.50 3.06 0.85 157 CK_HELO_DYNAMIC_SPLIT_IP 4121 0.90 1.04 0.84 158 XMSexyCombo_01 3711 1.24 2.39 0.76 159 TR_MetaPhish_Combo_01 3702 0.95 1.40 0.76 160 PDS_OTHER_BAD_TLD 3651 1.04 1.75 0.75 161 NML_ADSP_CUSTOM_MED 3577 0.72 0.69 0.73 162 XMBdyGiftCard01 3437 1.11 2.08 0.70 163 XMBody_17 3363 1.33 2.86 0.69 164 XMBrknScrpt_02 3339 1.19 2.40 0.68 165 T_XMHurry_00 3320 0.83 1.20 0.68 166 T_Symld_Words_02 3279 0.69 0.74 0.67 167 XMSubMetaI_00 3275 0.81 1.15 0.67 168 XM_ShortIntro_01 3245 0.61 0.47 0.66 169 XMPhish30 3245 0.72 0.84 0.66 170 XM_SPF_Unknown 3195 0.67 0.72 0.65 171 RELAYCOUNTRY_DE 3120 0.75 1.01 0.64 172 FORGED_GMAIL_RCVD 3098 1.00 1.86 0.63 173 TR_XM_SpammyWords2 3065 4.27 12.97 0.63 174 T_OBFU_PDF_ATTACH 3044 0.48 0.14 0.62 175 T_TooManySym_03 2956 0.50 0.26 0.60 176 NUMERIC_HTTP_ADDR 2955 0.83 1.38 0.60 177 XMMoneyMeta_00 2945 0.63 0.70 0.60 178 XM_B_SpammyWords4 2922 1.12 2.35 0.60 179 SUBJ_DOLLARS 2844 0.53 0.41 0.58 180 XMBody_95 2741 0.43 0.11 0.56 181 SHORT_HELO_AND_INLINE_IMAGE 2698 0.43 0.12 0.55 182 RCVD_IN_SORBS_DUL 2696 0.48 0.31 0.55 183 PLING_QUERY 2660 0.53 0.49 0.54 184 HTML_IMAGE_ONLY_20 2615 0.47 0.32 0.54 185 XM_DIRTYINTL 2564 1.13 2.57 0.52 186 XMSubMetaSxObfu_03 2522 0.63 0.91 0.52 187 XMNoVowels 2492 0.49 0.44 0.51 188 XMHTMLBadTable_001 2479 0.52 0.55 0.51 189 MSGID_FROM_MTA_HEADER 2462 0.39 0.13 0.50 190 RDNS_DYNAMIC 2423 0.80 1.52 0.50 191 XMBody_78 2354 0.62 0.93 0.48 192 XM_Body_Obfu01 2287 0.57 0.81 0.47 193 XMOemUri 2209 0.39 0.24 0.45 194 XM_H_PHPMailer 2206 0.46 0.49 0.45 195 TM2_M_BODY_EMPTY 2193 0.33 0.04 0.45 196 HTML_TAG_BALANCE_BODY 2191 0.59 0.92 0.45 197 DIET_1 2171 0.47 0.53 0.44 198 HTML_IMAGE_ONLY_28 2163 0.42 0.38 0.44 199 FROM_GOV_SPOOF 2051 0.33 0.11 0.42 200 XM_S_SpammyWords 2021 0.46 0.58 0.41 ----------------------------------------------------------------------