Email: 308319 Autolearn: 0 AvgScore: 1.96 AvgScanTime: 1.39 sec Spam: 80255 Autolearn: 0 AvgScore: 14.51 AvgScanTime: 1.54 sec Ham: 228064 Autolearn: 0 AvgScore: -2.46 AvgScanTime: 1.33 sec Time Spent Running SA: 118.77 hours Time Spent Processing Spam: 34.44 hours Time Spent Processing Ham: 84.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 74328 81.31 92.61 77.33 2 DKIM_SIGNED 68215 79.57 85.00 77.66 3 XM_DK_Pass 66195 78.09 82.48 76.55 4 DKIM_VALID 64700 76.48 80.62 75.03 5 DCC_CHECK 64329 59.85 80.16 52.71 6 XM_B_Unicode 59077 67.39 73.61 65.19 7 RELAYCOUNTRY_US 56911 79.05 70.91 81.91 8 XMListUnsubscribeExists 51596 51.67 64.29 47.22 9 XM_B_SpammyWords 51139 54.45 63.72 51.18 10 DKIM_VALID_AU 50115 62.99 62.44 63.19 11 XM_DK_Undo_02 38737 20.45 48.27 10.66 12 XM_B_Unicode3 33923 41.33 42.27 41.00 13 LOC_TINY_FONT_1 30453 29.45 37.95 26.46 14 BAYES_99 30109 16.58 37.52 9.21 15 XM_B_SpammyWords2 29040 22.91 36.18 18.24 16 BAYES_50 28125 46.87 35.04 51.03 17 DKIM_VALID_EF 26613 34.15 33.16 34.49 18 TR_XM_DKIM_Undo 26302 14.69 32.77 8.33 19 HTML_FONT_LOW_CONTRAST 24493 28.48 30.52 27.77 20 TR_DCC_Bayes_99 24144 11.96 30.08 5.58 21 MIME_HTML_ONLY 23507 23.84 29.29 21.92 22 BAYES_999 22949 12.83 28.60 7.28 23 T_KAM_HTML_FONT_INVALID 22725 18.44 28.32 14.96 24 RCVD_IN_MSPIKE_H2 21965 23.20 27.37 21.73 25 RELAYCOUNTRY_META 21522 10.02 26.82 4.11 26 FVGT_m_MULTI_ODD 18947 22.22 23.61 21.73 27 XM_Body_Dirty_Words 18437 14.20 22.97 11.12 28 RCVD_IN_MSPIKE_WL 17552 34.86 21.87 39.43 29 UNTRUSTED_Relay 17181 7.05 21.41 2.00 30 XMSubLong 16956 20.22 21.13 19.91 31 T_TM2_M_HEADER_IN_MSG 15535 20.61 19.36 21.05 32 BOTNET 15105 6.04 18.82 1.54 33 DCC_CHECK_NEGATIVE 14121 38.47 17.60 45.82 34 XM_UncommonTLD01 13479 7.35 16.80 4.03 35 XM_B_Unsub 13438 11.93 16.74 10.23 36 FSL_BULK_SIG 12159 10.64 15.15 9.05 37 MPART_ALT_DIFF 11677 7.65 14.55 5.23 38 XM_Multi_Part_URI 11649 12.60 14.51 11.93 39 BOTNET_IPINHOSTNAME 10707 7.10 13.34 4.91 40 UNPARSEABLE_RELAY 9929 9.20 12.37 8.09 41 XM_B_SpammyWords3 9909 6.27 12.35 4.14 42 TR_XM_UnparsRelay 9817 8.39 12.23 7.04 43 XMSexyCombo_05 9666 6.38 12.04 4.39 44 TR_XM_SpammyWords2 9481 4.44 11.81 1.85 45 MIME_HTML_MOSTLY 9296 4.85 11.58 2.48 46 RCVD_IN_MSPIKE_H3 9244 15.01 11.52 16.24 47 LOTS_OF_MONEY 8659 7.25 10.79 6.00 48 HTML_IMAGE_RATIO_02 8147 8.17 10.15 7.48 49 RCVD_IN_BL_SPAMCOP_NET 7574 3.09 9.44 0.86 50 RCVD_IN_MSPIKE_H4 7522 13.82 9.37 15.38 51 BAYES_80 7472 7.45 9.31 6.80 52 TR_XM_SpammyWords4 7323 5.12 9.12 3.71 53 SpammyFromTLD_02 7044 2.39 8.78 0.15 54 BAYES_60 6582 10.54 8.20 11.36 55 XM_SendGrid 6469 6.97 8.06 6.59 56 XM_Evil_Numbers_Gen 6320 8.42 7.87 8.61 57 SpammyFromTLD_01 6064 2.25 7.56 0.38 58 XM_B_Phish_Phrases 5822 10.97 7.25 12.28 59 LotsOfNums_01 5495 7.38 6.85 7.56 60 XMSubMetaSx_00 5434 4.58 6.77 3.81 61 XM_UB99 5338 1.73 6.65 0.00 62 RCVD_IN_MSPIKE_BL 5092 2.30 6.34 0.88 63 XM_H_Long_From01 5082 5.43 6.33 5.11 64 XM_UB50 4999 2.41 6.23 1.06 65 BAYES_95 4997 5.48 6.23 5.22 66 TR_XM_PhishingBody 4857 3.30 6.05 2.33 67 RCVD_IN_RP_SAFE 4834 8.32 6.02 9.13 68 TooManyTo_001 4623 6.14 5.76 6.28 69 TR_XM_MSPIKECOMBO 4621 1.85 5.76 0.47 70 RELAYCOUNTRY_CA 4595 2.51 5.73 1.38 71 HTML_IMAGE_RATIO_04 4399 6.82 5.48 7.29 72 XM_B_SpammyTLD 4361 2.80 5.43 1.87 73 HTML_MIME_NO_HTML_TAG 3978 2.39 4.96 1.49 74 KHOP_HELO_FCRDNS 3961 2.03 4.94 1.00 75 XM_DIRTYINTL 3949 1.50 4.92 0.30 76 URIBL_SBL_A 3912 1.55 4.87 0.38 77 T_REMOTE_IMAGE 3736 3.15 4.66 2.62 78 RCVD_IN_RP_RNBL 3652 1.22 4.55 0.04 79 RCVD_IN_RP_CERTIFIED 3584 7.16 4.47 8.10 80 DKIM_INVALID 3515 3.09 4.38 2.63 81 XM_UB999 3510 1.14 4.37 0.00 82 XMStrtUSub 3433 11.70 4.28 14.32 83 RELAYCOUNTRY_FR 3411 1.29 4.25 0.25 84 TR_XM_DK_SendGrid 3291 4.23 4.10 4.28 85 TR_XM_SpammyWords5 3207 2.14 4.00 1.48 86 HTML_IMAGE_RATIO_06 3169 3.79 3.95 3.74 87 XM_SPF_SoftFail 3129 1.82 3.90 1.09 88 PDS_OTHER_BAD_TLD 2885 1.30 3.59 0.49 89 RELAYCOUNTRY_IN 2799 0.95 3.49 0.05 90 TR_XM_SpammyWords3 2783 1.17 3.47 0.36 91 XMNumbers 2780 3.66 3.46 3.73 92 T_XMDrugObfuBody_08 2703 1.82 3.37 1.28 93 RCVD_IN_MSPIKE_L5 2682 0.91 3.34 0.06 94 URIBL_DBL_SPAM 2612 0.85 3.25 0.01 95 XM_B_Phish66 2495 1.64 3.11 1.12 96 MIME_HTML_ONLY_MULTI 2485 3.38 3.10 3.48 97 T_HTML_TAG_BALANCE_CENTER 2481 0.94 3.09 0.18 98 RCVD_IN_PSBL 2431 0.84 3.03 0.07 99 TM2_M_URI_OPT_OUT 2359 3.23 2.94 3.33 100 XM_B_SpammyWords4 2253 1.04 2.81 0.41 101 SUBJ_ALL_CAPS 2228 1.63 2.78 1.22 102 TR_Mismatch_TLD_02 2227 0.76 2.77 0.05 103 XM_OfRef6 2176 1.44 2.71 0.99 104 BOTNET_NORDNS 2171 0.71 2.71 0.01 105 XM_UB60 2145 0.81 2.67 0.15 106 BODY_URI_ONLY 2111 0.69 2.63 0.01 107 XM_UB80 2107 0.72 2.63 0.05 108 HTML_IMAGE_RATIO_08 2087 2.18 2.60 2.03 109 XM_CamelCaseFrm001 2013 2.01 2.51 1.83 110 XM_UB95 1972 0.65 2.46 0.02 111 MIME_QP_LONG_LINE 1940 3.20 2.42 3.48 112 HTML_IMAGE_ONLY_08 1922 0.67 2.39 0.07 113 HTML_FONT_SIZE_LARGE 1878 0.71 2.34 0.13 114 T_TooManySym_01 1871 5.02 2.33 5.97 115 XMBody_17 1844 0.91 2.30 0.43 116 TR_XM_BayesRelay 1838 0.61 2.29 0.01 117 T_FILL_THIS_FORM_SHORT 1802 0.90 2.25 0.43 118 TM2_M_VERY_LONG_WORD 1746 1.49 2.18 1.25 119 TR_XM_PHPDW 1688 0.74 2.10 0.26 120 MIXED_HREF_CASE 1672 0.54 2.08 0.00 121 XMBdyGiftCard01 1661 1.31 2.07 1.04 122 MONEY_NOHTML 1642 0.59 2.05 0.07 123 USER_IN_DEF_DKIM_WL 1639 11.98 2.04 15.48 124 GOOG_STO_IMG_HTML 1610 0.52 2.01 0.00 125 FROM_EXCESS_BASE64 1602 3.10 2.00 3.49 126 TR_XM_PHPForged 1593 0.67 1.98 0.20 127 T_XMDrugObfuBody_14 1587 2.35 1.98 2.48 128 TR_XM_FormFill2 1570 0.66 1.96 0.20 129 XM_H_PHPOS 1561 0.65 1.95 0.19 130 XMSexyCombo_01 1531 0.85 1.91 0.48 131 XM_B_COVIDMETA 1483 0.98 1.85 0.68 132 XMStockSpam_06 1466 1.64 1.83 1.58 133 URI_HEX 1454 1.68 1.81 1.64 134 RCVD_IN_IADB_LISTED 1417 3.15 1.77 3.64 135 XM_B_Unsub2 1415 1.06 1.76 0.81 136 FROM_SUSPICIOUS_NTLD 1408 0.49 1.75 0.05 137 MISSING_HEADERS 1399 0.98 1.74 0.72 138 FROM_SUSPICIOUS_NTLD_FP 1378 0.48 1.72 0.05 139 MIXED_FONT_CASE 1351 0.44 1.68 0.00 140 MIXED_IMG_CASE 1343 0.44 1.67 0.00 141 TR_XM_MaxBayes 1317 0.43 1.64 0.00 142 RCVD_IN_IADB_SPF 1296 2.71 1.61 3.09 143 REPLYTO_WITHOUT_TO_CC 1294 0.72 1.61 0.41 144 BAYES_40 1261 3.02 1.57 3.52 145 XMReplyNow 1236 0.45 1.54 0.06 146 XMBrknScrpt_02 1232 1.26 1.54 1.16 147 RCVD_IN_MSPIKE_L4 1230 0.62 1.53 0.30 148 XM_URI_RBL 1227 0.47 1.53 0.10 149 RCVD_IN_IADB_DK 1220 2.35 1.52 2.64 150 T_XMHurry_00 1217 0.71 1.52 0.43 151 RCVD_IN_IADB_SENDERID 1217 2.41 1.52 2.73 152 TR_Symld_Words 1194 1.81 1.49 1.93 153 RELAYCOUNTRY_RU 1192 0.41 1.49 0.04 154 HTTPS_HTTP_MISMATCH 1184 0.76 1.48 0.50 155 RELAYCOUNTRY_NL 1152 0.50 1.44 0.17 156 TR_Mismatch_TLD_01 1141 0.64 1.42 0.36 157 XMSubNoVowel 1140 1.61 1.42 1.68 158 SHOPIFY_IMG_NOT_RCVD_SFY 1135 0.54 1.41 0.23 159 MAILING_LIST_MULTI 1125 2.02 1.40 2.24 160 XM_DK_Undo_01 1121 1.45 1.40 1.46 161 ADVANCE_FEE_5_NEW_MONEY 1117 0.36 1.39 0.00 162 LOADSA_MONEY_COMBO 1113 0.43 1.39 0.09 163 XM_H_Long_From02 1112 1.12 1.39 1.03 164 TR_LOTS_OF_MONEY1 1110 0.36 1.38 0.00 165 HTML_FONT_SIZE_HUGE 1080 0.47 1.35 0.17 166 MILLION_HUNDRED 1069 0.35 1.33 0.00 167 RDNS_DYNAMIC 1060 0.81 1.32 0.63 168 XMDiploma_00 1051 1.10 1.31 1.03 169 XM_BadFromFormat 1043 0.47 1.30 0.17 170 XM_H_PHPMailer 1025 0.75 1.28 0.56 171 XM_JunkDunk 1024 0.33 1.28 0.00 172 XM_SPF_Unknown 1023 0.65 1.27 0.43 173 URIBL_BLACK 1017 0.35 1.27 0.02 174 TR_XM_COVIDMETA4 1012 0.55 1.26 0.30 175 T_XMDrugObfuBody_00 1010 0.72 1.26 0.53 176 ALL_TRUSTED 1008 10.97 1.26 14.39 177 URI_TRY_3LD 988 0.93 1.23 0.83 178 HK_SCAM 971 0.32 1.21 0.00 179 TR_LOTS_OF_MONEY2 965 0.43 1.20 0.16 180 T_MONEY_PERCENT 965 0.43 1.20 0.16 181 TR_XM_INV_DKIM 961 0.52 1.20 0.27 182 RELAYCOUNTRY_DE 959 0.60 1.19 0.40 183 DATE_IN_PAST_03_06 957 0.70 1.19 0.53 184 XM_H_Undi_Recip 952 0.45 1.19 0.19 185 XMPhish08 941 0.42 1.17 0.15 186 XMHTMLBadTable_001 927 0.74 1.16 0.59 187 LongTLD 926 0.37 1.15 0.10 188 RELAYCOUNTRY_GB 924 0.75 1.15 0.61 189 XM_Combo_Sbj 908 0.40 1.13 0.15 190 BODY_EMPTY 906 0.30 1.13 0.01 191 RELAYCOUNTRY_ES 901 0.31 1.12 0.02 192 TR_XM_SB_Phish 897 1.29 1.12 1.35 193 XM_Body_Dirty_Words_01 867 0.51 1.08 0.31 194 DIET_1 866 0.58 1.08 0.41 195 TR_Sbj_FN_Bdy 860 0.37 1.07 0.13 196 HK_RANDOM_REPLYTO 854 0.41 1.06 0.19 197 XMPhish30 853 0.73 1.06 0.61 198 XMSubPhish11 852 1.27 1.06 1.34 199 ANY_BOUNCE_MESSAGE 851 2.21 1.06 2.61 200 BOUNCE_MESSAGE 850 2.20 1.06 2.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 186800 79.05 70.91 81.91 2 DKIM_SIGNED 177105 79.57 85.00 77.66 3 HTML_MESSAGE 176367 81.31 92.61 77.33 4 XM_DK_Pass 174575 78.09 82.48 76.55 5 DKIM_VALID 171107 76.48 80.62 75.03 6 XM_B_Unicode 148685 67.39 73.61 65.19 7 DKIM_VALID_AU 144107 62.99 62.44 63.19 8 DCC_CHECK 120205 59.85 80.16 52.71 9 XM_B_SpammyWords 116733 54.45 63.72 51.18 10 BAYES_50 116380 46.87 35.04 51.03 11 XMListUnsubscribeExists 107700 51.67 64.29 47.22 12 DCC_CHECK_NEGATIVE 104501 38.47 17.60 45.82 13 XM_B_Unicode3 93502 41.33 42.27 41.00 14 RCVD_IN_MSPIKE_WL 89921 34.86 21.87 39.43 15 DKIM_VALID_EF 78670 34.15 33.16 34.49 16 HTML_FONT_LOW_CONTRAST 63329 28.48 30.52 27.77 17 LOC_TINY_FONT_1 60335 29.45 37.95 26.46 18 MIME_HTML_ONLY 49995 23.84 29.29 21.92 19 FVGT_m_MULTI_ODD 49566 22.22 23.61 21.73 20 RCVD_IN_MSPIKE_H2 49561 23.20 27.37 21.73 21 T_TM2_M_HEADER_IN_MSG 48011 20.61 19.36 21.05 22 XMSubLong 45401 20.22 21.13 19.91 23 XM_DKIMWhitelistDomains 44096 14.31 0.01 19.33 24 XM_B_SpammyWords2 41602 22.91 36.18 18.24 25 RCVD_IN_MSPIKE_H3 37040 15.01 11.52 16.24 26 USER_IN_DEF_DKIM_WL 35308 11.98 2.04 15.48 27 RCVD_IN_MSPIKE_H4 35085 13.82 9.37 15.38 28 T_KAM_HTML_FONT_INVALID 34125 18.44 28.32 14.96 29 ALL_TRUSTED 32824 10.97 1.26 14.39 30 XMStrtUSub 32650 11.70 4.28 14.32 31 XM_B_Phish_Phrases 28002 10.97 7.25 12.28 32 XM_Multi_Part_URI 27204 12.60 14.51 11.93 33 BAYES_60 25908 10.54 8.20 11.36 34 XM_Body_Dirty_Words 25355 14.20 22.97 11.12 35 XM_DK_Undo_02 24303 20.45 48.27 10.66 36 XM_B_Unsub 23331 11.93 16.74 10.23 37 BAYES_99 21014 16.58 37.52 9.21 38 RCVD_IN_RP_SAFE 20812 8.32 6.02 9.13 39 FSL_BULK_SIG 20648 10.64 15.15 9.05 40 XM_Evil_Numbers_Gen 19629 8.42 7.87 8.61 41 TR_XM_DKIM_Undo 18996 14.69 32.77 8.33 42 RCVD_IN_RP_CERTIFIED 18477 7.16 4.47 8.10 43 UNPARSEABLE_RELAY 18439 9.20 12.37 8.09 44 BAYES_00 17869 5.93 0.51 7.84 45 RCVD_IN_MSPIKE_H5 17796 6.03 0.98 7.80 46 LotsOfNums_01 17249 7.38 6.85 7.56 47 HTML_IMAGE_RATIO_02 17048 8.17 10.15 7.48 48 HTML_IMAGE_RATIO_04 16632 6.82 5.48 7.29 49 BAYES_999 16606 12.83 28.60 7.28 50 TR_XM_UnparsRelay 16048 8.39 12.23 7.04 51 BAYES_80 15512 7.45 9.31 6.80 52 XM_SendGrid 15019 6.97 8.06 6.59 53 TooManyTo_001 14318 6.14 5.76 6.28 54 LOTS_OF_MONEY 13688 7.25 10.79 6.00 55 T_TooManySym_01 13621 5.02 2.33 5.97 56 TR_DCC_Bayes_99 12736 11.96 30.08 5.58 57 TR_XM_DK_Bayes 12304 4.09 0.38 5.39 58 TR_XM_DK_Bayes1 12031 4.00 0.37 5.28 59 MPART_ALT_DIFF 11924 7.65 14.55 5.23 60 BAYES_95 11906 5.48 6.23 5.22 61 XM_H_Long_From01 11646 5.43 6.33 5.11 62 TR_XM_DK_Bayes2 11237 3.73 0.35 4.93 63 BOTNET_IPINHOSTNAME 11198 7.10 13.34 4.91 64 XM_H_Trusted_IP 10094 3.27 0.00 4.43 65 XMSexyCombo_05 10004 6.38 12.04 4.39 66 TR_XM_DK_SendGrid 9758 4.23 4.10 4.28 67 XM_B_SpammyWords3 9434 6.27 12.35 4.14 68 RELAYCOUNTRY_META 9372 10.02 26.82 4.11 69 XM_UncommonTLD01 9184 7.35 16.80 4.03 70 IN_ZIMBRA_NJ_WHITELIST 8819 2.87 0.03 3.87 71 XMSubMetaSx_00 8692 4.58 6.77 3.81 72 HTML_IMAGE_RATIO_06 8521 3.79 3.95 3.74 73 XMNumbers 8509 3.66 3.46 3.73 74 TR_XM_SpammyWords4 8464 5.12 9.12 3.71 75 RCVD_IN_IADB_LISTED 8306 3.15 1.77 3.64 76 BAYES_40 8039 3.02 1.57 3.52 77 T_TooManySym_02 8007 2.76 0.61 3.51 78 FROM_EXCESS_BASE64 7963 3.10 2.00 3.49 79 MIME_QP_LONG_LINE 7936 3.20 2.42 3.48 80 MIME_HTML_ONLY_MULTI 7929 3.38 3.10 3.48 81 BAYES_20 7688 2.76 1.04 3.37 82 INVALID_MSGID 7668 2.72 0.88 3.36 83 TM2_M_URI_OPT_OUT 7585 3.23 2.94 3.33 84 RCVD_IN_IADB_SPF 7047 2.71 1.61 3.09 85 TO_MALFORMED 6264 2.03 0.00 2.75 86 RCVD_IN_IADB_SENDERID 6217 2.41 1.52 2.73 87 RCVD_IN_IADB_DK 6019 2.35 1.52 2.64 88 DKIM_INVALID 5998 3.09 4.38 2.63 89 T_REMOTE_IMAGE 5979 3.15 4.66 2.62 90 ANY_BOUNCE_MESSAGE 5950 2.21 1.06 2.61 91 BOUNCE_MESSAGE 5948 2.20 1.06 2.61 92 MIME_HTML_MOSTLY 5658 4.85 11.58 2.48 93 T_XMDrugObfuBody_14 5657 2.35 1.98 2.48 94 RCVD_IN_IADB_VOUCHED 5434 1.94 0.70 2.38 95 TVD_RCVD_IP 5342 1.87 0.52 2.34 96 TR_XM_PhishingBody 5320 3.30 6.05 2.33 97 MAILING_LIST_MULTI 5104 2.02 1.40 2.24 98 XM_PDF 4719 1.66 0.50 2.07 99 HTML_IMAGE_RATIO_08 4633 2.18 2.60 2.03 100 URI_NOVOWEL 4619 1.76 1.01 2.03 101 UNTRUSTED_Relay 4550 7.05 21.41 2.00 102 IN_HORDE_ADDRESS_BOOK 4509 1.49 0.12 1.98 103 TR_Symld_Words 4398 1.81 1.49 1.93 104 XM_B_SpammyTLD 4263 2.80 5.43 1.87 105 TR_XM_SpammyWords2 4220 4.44 11.81 1.85 106 XM_CamelCaseFrm001 4181 2.01 2.51 1.83 107 XMSubNoVowel 3824 1.61 1.42 1.68 108 BAYES_05 3747 1.37 0.58 1.64 109 URI_HEX 3738 1.68 1.81 1.64 110 XMStockSpam_06 3602 1.64 1.83 1.58 111 HTML_FONT_FACE_BAD 3598 1.36 0.75 1.58 112 RCVD_IN_IADB_OPTIN 3528 1.30 0.61 1.55 113 BOTNET 3514 6.04 18.82 1.54 114 HTML_MIME_NO_HTML_TAG 3389 2.39 4.96 1.49 115 TR_XM_SpammyWords5 3378 2.14 4.00 1.48 116 XMBSHREFv2 3345 1.15 0.27 1.47 117 XM_DK_Undo_01 3339 1.45 1.40 1.46 118 XMGappySubj_01 3218 1.08 0.14 1.41 119 TooManyTo_002 3173 1.20 0.64 1.39 120 RELAYCOUNTRY_CA 3153 2.51 5.73 1.38 121 TR_XM_SB_Phish 3090 1.29 1.12 1.35 122 XMSubPhish11 3062 1.27 1.06 1.34 123 T_XMDrugObfuBody_08 2915 1.82 3.37 1.28 124 TM2_M_VERY_LONG_WORD 2856 1.49 2.18 1.25 125 SUBJ_ALL_CAPS 2789 1.63 2.78 1.22 126 XM_GoogleGroups 2781 1.08 0.67 1.22 127 XMBrknScrpt_02 2643 1.26 1.54 1.16 128 XM_B_Phish66 2560 1.64 3.11 1.12 129 T_TooManySym_03 2555 0.89 0.23 1.12 130 MSGID_NOFQDN1 2552 0.84 0.04 1.12 131 XM_SPF_SoftFail 2492 1.82 3.90 1.09 132 HTML_IMAGE_ONLY_20 2469 0.85 0.20 1.08 133 XM_UB50 2418 2.41 6.23 1.06 134 XMBdyGiftCard01 2376 1.31 2.07 1.04 135 XM_H_Long_From02 2356 1.12 1.39 1.03 136 XMDiploma_00 2338 1.10 1.31 1.03 137 KHOP_HELO_FCRDNS 2286 2.03 4.94 1.00 138 XM_OfRef6 2254 1.44 2.71 0.99 139 XM_ProductURIs 2248 0.97 0.92 0.99 140 HELO_NODOT 2216 0.89 0.64 0.97 141 HELO_NO_DOMAIN 2216 0.89 0.64 0.97 142 TooManyTo_003 2186 0.85 0.53 0.96 143 XMHTML_After_End 2095 0.87 0.73 0.92 144 DKIM_ADSP_CUSTOM_MED 2076 0.91 0.90 0.91 145 RCVD_IN_MSPIKE_BL 2009 2.30 6.34 0.88 146 RCVD_IN_BL_SPAMCOP_NET 1965 3.09 9.44 0.86 147 URI_TRY_3LD 1885 0.93 1.23 0.83 148 XM_B_Unsub2 1842 1.06 1.76 0.81 149 XM_B_REG_HTML 1813 0.81 0.83 0.79 150 T_MANY_PILL_PRICE 1800 0.59 0.01 0.79 151 XMBody_95 1748 0.61 0.17 0.77 152 TR_MSPIKEBAYES00 1736 0.57 0.01 0.76 153 XM_B_COPY_HTML 1725 0.75 0.74 0.76 154 TooManyTo_004 1718 0.68 0.49 0.75 155 MISSING_HEADERS 1635 0.98 1.74 0.72 156 XM_B_COVIDMETA 1552 0.98 1.85 0.68 157 TR_MetaPhish_Combo_01 1547 0.69 0.73 0.68 158 TooManyTo_005 1493 0.60 0.43 0.65 159 RDNS_DYNAMIC 1439 0.81 1.32 0.63 160 XMGenDplmaNmb 1417 0.66 0.78 0.62 161 RELAYCOUNTRY_GB 1401 0.75 1.15 0.61 162 XMPhish30 1383 0.73 1.06 0.61 163 XMHTMLBadTable_001 1348 0.74 1.16 0.59 164 XMSubMetaI_00 1338 0.65 0.84 0.59 165 XMLngstWrd_00 1320 0.63 0.79 0.58 166 XM_H_PHPMailer 1273 0.75 1.28 0.56 167 SUBJ_DOLLARS 1249 0.67 1.00 0.55 168 NML_ADSP_CUSTOM_MED 1249 0.59 0.72 0.55 169 USER_IN_WHITELIST 1232 0.40 0.00 0.54 170 USER_IN_WELCOMELIST 1232 0.40 0.00 0.54 171 HTML_TAG_BALANCE_BODY 1219 0.63 0.90 0.53 172 DATE_IN_PAST_03_06 1213 0.70 1.19 0.53 173 T_XMDrugObfuBody_00 1202 0.72 1.26 0.53 174 TVD_SPACE_RATIO 1187 0.46 0.28 0.52 175 XMLngstWrd_01 1182 0.56 0.69 0.52 176 NUMERIC_HTTP_ADDR 1169 0.60 0.83 0.51 177 PLING_QUERY 1152 0.59 0.83 0.51 178 TVD_SPACE_RATIO_MINFP 1148 0.61 0.93 0.50 179 HTTPS_HTTP_MISMATCH 1146 0.76 1.48 0.50 180 PDS_OTHER_BAD_TLD 1110 1.30 3.59 0.49 181 XMSexyCombo_01 1105 0.85 1.91 0.48 182 T_TooManySym_04 1089 0.38 0.09 0.48 183 FORGED_GMAIL_RCVD 1089 0.54 0.73 0.48 184 TR_XM_MSPIKECOMBO 1076 1.85 5.76 0.47 185 XMSubMetaSxObfu_02 1075 0.44 0.36 0.47 186 XMCapTrack 1040 0.42 0.30 0.46 187 XMLngstWrd_02 1017 0.46 0.51 0.45 188 XM_SPF_Unknown 988 0.65 1.27 0.43 189 T_XMHurry_00 987 0.71 1.52 0.43 190 T_FILL_THIS_FORM_SHORT 980 0.90 2.25 0.43 191 XMBody_17 973 0.91 2.30 0.43 192 MPART_ALT_DIFF_COUNT 953 0.49 0.68 0.42 193 XM_B_SpammyWords4 944 1.04 2.81 0.41 194 REPLYTO_WITHOUT_TO_CC 933 0.72 1.61 0.41 195 DIET_1 933 0.58 1.08 0.41 196 RCVD_IN_MSPIKE_ZBI 933 0.46 0.59 0.41 197 XMNoVowels 912 0.45 0.59 0.40 198 RELAYCOUNTRY_DE 904 0.60 1.19 0.40 199 RELAYCOUNTRY_NG_I 892 0.29 0.01 0.39 200 BODY_ENHANCEMENT 877 0.30 0.05 0.38 ----------------------------------------------------------------------