Email: 608584 Autolearn: 0 AvgScore: 0.22 AvgScanTime: 1.97 sec Spam: 122942 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 2.49 sec Ham: 485642 Autolearn: 0 AvgScore: -3.19 AvgScanTime: 1.84 sec Time Spent Running SA: 333.62 hours Time Spent Processing Spam: 84.98 hours Time Spent Processing Ham: 248.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117231 90.77 95.35 89.61 2 DKIM_SIGNED 103168 60.36 83.92 54.40 3 XM_DK_Pass 98237 58.50 79.91 53.08 4 DKIM_VALID 95894 56.82 78.00 51.45 5 RELAYCOUNTRY_US 92958 74.77 75.61 74.56 6 DCC_CHECK 91548 38.76 74.46 29.72 7 XM_B_Unicode 91543 74.16 74.46 74.08 8 XMListUnsubscribeExists 85150 41.84 69.26 34.90 9 XM_B_SpammyWords 82134 44.19 66.81 38.47 10 DKIM_VALID_AU 73048 43.03 59.42 38.88 11 BAYES_50 60861 51.59 49.50 52.12 12 XM_B_Unicode3 51956 47.69 42.26 49.07 13 XM_DK_Undo_02 46762 11.73 38.04 5.07 14 XM_B_SpammyWords2 43625 18.61 35.48 14.34 15 LOC_TINY_FONT_1 43415 21.34 35.31 17.81 16 T_KAM_HTML_FONT_INVALID 39178 17.57 31.87 13.95 17 HTML_FONT_LOW_CONTRAST 38770 23.21 31.54 21.10 18 TR_XM_DKIM_Undo 38133 9.39 31.02 3.92 19 MIME_HTML_ONLY 38104 28.31 30.99 27.63 20 DKIM_VALID_EF 36807 21.91 29.94 19.88 21 FVGT_m_MULTI_ODD 36775 20.51 29.91 18.13 22 BAYES_99 31429 11.49 25.56 7.93 23 DCC_CHECK_NEGATIVE 31353 61.20 25.50 70.24 24 XMSubLong 30918 24.15 25.15 23.89 25 RCVD_IN_MSPIKE_H2 29519 17.29 24.01 15.58 26 RELAYCOUNTRY_META 29400 7.26 23.91 3.05 27 XM_Body_Dirty_Words 26377 11.45 21.45 8.91 28 T_TM2_M_HEADER_IN_MSG 26078 23.16 21.21 23.65 29 RCVD_IN_MSPIKE_WL 25772 21.10 20.96 21.13 30 BAYES_999 24483 9.74 19.91 7.17 31 TR_DCC_Bayes_99 23315 5.29 18.96 1.83 32 XM_Multi_Part_URI 19737 10.28 16.05 8.81 33 XM_UncommonTLD01 19360 5.27 15.75 2.61 34 UNTRUSTED_Relay 18933 3.92 15.40 1.01 35 TR_XM_SpammyRelay 18307 4.00 14.89 1.25 36 MPART_ALT_DIFF 17131 10.90 13.93 10.13 37 RCVD_IN_MSPIKE_H3 16553 11.80 13.46 11.38 38 BOTNET_IPINHOSTNAME 16522 5.27 13.44 3.20 39 BOTNET 15900 3.57 12.93 1.19 40 XM_B_Unsub 15858 13.99 12.90 14.27 41 FSL_BULK_SIG 15717 7.72 12.78 6.43 42 LOTS_OF_MONEY 15353 11.68 12.49 11.48 43 XM_B_SpammyWords3 14314 5.15 11.64 3.51 44 UNPARSEABLE_RELAY 13550 6.77 11.02 5.69 45 TR_XM_SpammyWords4 13213 5.37 10.75 4.01 46 TR_XM_UnparsRelay 13114 5.57 10.67 4.27 47 XMSexyCombo_05 12024 3.92 9.78 2.44 48 XM_Evil_Numbers_Gen 11639 8.03 9.47 7.67 49 RCVD_IN_BL_SPAMCOP_NET 11563 2.41 9.41 0.64 50 TR_XM_SpammyWords2 10727 2.29 8.73 0.66 51 XM_SendGrid 10195 5.65 8.29 4.99 52 XM_UB50 10186 2.21 8.29 0.67 53 LotsOfNums_01 10032 7.09 8.16 6.82 54 HTML_MIME_NO_HTML_TAG 9799 3.97 7.97 2.95 55 MIME_HTML_MOSTLY 9748 3.22 7.93 2.03 56 SpammyFromTLD_02 9516 1.85 7.74 0.36 57 BAYES_60 9149 6.63 7.44 6.42 58 HTML_IMAGE_RATIO_02 9019 4.94 7.34 4.33 59 RCVD_IN_MSPIKE_H4 8629 8.01 7.02 8.26 60 XMSubMetaSx_00 8392 3.70 6.83 2.90 61 BAYES_80 8295 3.64 6.75 2.85 62 MIME_HTML_ONLY_MULTI 8085 8.05 6.58 8.42 63 XM_H_Long_From01 8066 4.32 6.56 3.75 64 DKIM_INVALID 7274 3.55 5.92 2.95 65 URI_NOVOWEL 7268 2.87 5.91 2.09 66 XM_B_Phish_Phrases 7187 3.44 5.85 2.83 67 TR_XM_PhishingBody 6986 3.11 5.68 2.46 68 TooManyTo_001 6897 11.02 5.61 12.39 69 T_REMOTE_IMAGE 6681 3.37 5.43 2.84 70 TR_XM_SPAMCOP 6435 1.29 5.23 0.29 71 SpammyFromTLD_01 6394 1.53 5.20 0.60 72 TM2_M_VERY_LONG_WORD 6356 1.84 5.17 1.00 73 MIME_QP_LONG_LINE 6201 5.05 5.04 5.05 74 KHOP_HELO_FCRDNS 5979 1.97 4.86 1.24 75 HTML_IMAGE_RATIO_04 5923 13.59 4.82 15.81 76 RCVD_IN_MSPIKE_BL 5790 1.47 4.71 0.66 77 TR_XM_MSPIKECOMBO 5767 1.47 4.69 0.65 78 XM_SPF_SoftFail 5722 2.13 4.65 1.49 79 RELAYCOUNTRY_CA 5691 1.52 4.63 0.74 80 TR_XM_DK_SendGrid 5385 3.38 4.38 3.13 81 TM2_M_URI_OPT_OUT 5351 3.36 4.35 3.11 82 XM_B_Investor 5339 1.97 4.34 1.37 83 XMNumbers 5272 3.10 4.29 2.80 84 XM_B_SpammyTLD 5213 2.03 4.24 1.47 85 HTML_IMAGE_RATIO_06 4654 4.64 3.79 4.86 86 JH_SPAMMY_HEADERS 4581 0.75 3.73 0.00 87 XM_GoogleGroups 4525 1.70 3.68 1.20 88 URIBL_DBL_SPAM 4389 0.73 3.57 0.01 89 TR_XM_NoHeaderRelay 4367 0.83 3.55 0.14 90 XMLngstWrd_00 4357 1.69 3.54 1.22 91 XMLngstWrd_01 4294 1.56 3.49 1.07 92 ALL_TRUSTED 4267 19.37 3.47 23.39 93 BAYES_95 4200 2.21 3.42 1.90 94 XMLngstWrd_02 4184 1.41 3.40 0.91 95 XMStrtUSub 4169 8.91 3.39 10.31 96 XMLngstWrd_03 4083 1.24 3.32 0.71 97 HTML_IMAGE_ONLY_08 4033 0.80 3.28 0.17 98 HTML_TITLE_SUBJ_DIFF 4007 0.85 3.26 0.24 99 XMLngstWrd_04 3968 1.13 3.23 0.60 100 XM_B_Phish66 3908 1.72 3.18 1.35 101 TR_XM_SpammyWords5 3886 1.52 3.16 1.10 102 RELAYCOUNTRY_FR 3860 0.79 3.14 0.20 103 TR_XM_MaxUnsub 3801 1.13 3.09 0.64 104 GOOG_STO_IMG_HTML 3791 0.62 3.08 0.00 105 UPPERCASE_75_100 3750 0.80 3.05 0.23 106 T_XMDrugObfuBody_08 3699 1.50 3.01 1.11 107 XM_OfRef6 3697 1.20 3.01 0.75 108 XM_B_Unsub2 3688 1.65 3.00 1.31 109 RCVD_IN_IADB_LISTED 3570 3.93 2.90 4.19 110 XM_DIRTYINTL 3569 0.77 2.90 0.23 111 XM_DK_Undo_01 3393 1.68 2.76 1.41 112 MIXED_CENTER_CASE 3207 0.53 2.61 0.00 113 MIXED_HREF_CASE 3199 0.53 2.60 0.00 114 MIXED_FONT_CASE 3191 0.52 2.60 0.00 115 MIXED_IMG_CASE 3191 0.53 2.60 0.00 116 MIXED_AREA_CASE 3185 0.52 2.59 0.00 117 RCVD_IN_IADB_SPF 3174 3.43 2.58 3.65 118 BAYES_40 3121 4.65 2.54 5.19 119 T_HTML_TAG_BALANCE_CENTER 3031 0.53 2.47 0.04 120 XMDiploma_00 3030 5.71 2.46 6.53 121 RCVD_IN_IADB_DK 3022 3.03 2.46 3.17 122 RCVD_IN_IADB_SENDERID 2942 3.09 2.39 3.27 123 TR_XM_SpammyWords3 2935 0.76 2.39 0.35 124 XM_B_COVIDMETA 2914 0.94 2.37 0.58 125 HTML_IMAGE_RATIO_08 2870 1.90 2.33 1.78 126 T_XMDrugObfuBody_14 2841 1.79 2.31 1.65 127 T_TooManySym_01 2744 3.76 2.23 4.15 128 XM_CamelCaseFrm001 2744 1.47 2.23 1.27 129 MAILING_LIST_MULTI 2699 2.13 2.20 2.12 130 T_FILL_THIS_FORM_SHORT 2621 0.98 2.13 0.69 131 BOTNET_NORDNS 2585 0.44 2.10 0.02 132 RELAYCOUNTRY_IN 2581 0.49 2.10 0.08 133 XM_B_SpammyWords4 2577 0.81 2.10 0.48 134 XMBody_17 2466 0.69 2.01 0.36 135 XMSexyCombo_01 2464 0.81 2.00 0.51 136 XM_URI_RBL 2446 0.48 1.99 0.10 137 HTML_FONT_SIZE_HUGE 2438 0.43 1.98 0.03 138 BAYES_20 2432 4.13 1.98 4.67 139 RCVD_IN_MSPIKE_L5 2414 0.57 1.96 0.22 140 RCVD_IN_MSPIKE_L3 2406 0.59 1.96 0.24 141 DIET_1 2397 0.60 1.95 0.26 142 RCVD_IN_VALIDITY_SAFE 2351 3.92 1.91 4.43 143 TR_XM_SB_Phish 2349 1.61 1.91 1.54 144 T_XMDrugObfuBody_00 2317 0.74 1.88 0.45 145 XMSubPhish11 2295 1.58 1.87 1.51 146 XM_UB60 2221 0.42 1.81 0.07 147 TR_XM_PHPDW 2212 0.56 1.80 0.24 148 BAYES_00 2169 13.07 1.76 15.93 149 XM_UB99 2160 0.36 1.76 0.00 150 SUBJ_ALL_CAPS 2087 1.36 1.70 1.27 151 TR_XM_PHPForged 2080 0.51 1.69 0.21 152 HTML_FONT_SIZE_LARGE 2072 0.39 1.69 0.07 153 BODY_URI_ONLY 2069 0.35 1.68 0.01 154 RELAYCOUNTRY_AU 2042 0.55 1.66 0.27 155 TR_XM_FormFill2 2040 0.51 1.66 0.21 156 XM_H_PHPOS 2028 0.50 1.65 0.21 157 XMStockSpam_06 2013 1.13 1.64 1.00 158 PDS_OTHER_BAD_TLD 2010 0.42 1.63 0.12 159 URIBL_BLACK 1995 0.36 1.62 0.04 160 URI_HEX 1944 1.25 1.58 1.16 161 XMBrknScrpt_02 1912 0.90 1.56 0.73 162 URI_NO_WWW_BIZ_CGI 1907 0.32 1.55 0.00 163 T_XMHurry_00 1887 0.63 1.53 0.41 164 MIXED_CTYPE_CASE 1850 0.31 1.50 0.00 165 RCVD_IN_RP_SAFE 1828 3.55 1.49 4.08 166 TR_XM_COVIDMETA4 1803 0.51 1.47 0.27 167 XM_H_Undi_Recip 1743 0.39 1.42 0.13 168 RELAYCOUNTRY_DE 1741 0.48 1.42 0.25 169 XMHTML_After_End 1739 0.80 1.41 0.64 170 XM_UB999 1729 0.29 1.41 0.00 171 RCVD_IN_VALIDITY_RPBL 1724 0.33 1.40 0.06 172 TR_Symld_Words 1707 1.34 1.39 1.33 173 TR_XM_INV_DKIM 1706 0.42 1.39 0.17 174 XMSubMetaSSxObfu_00 1703 0.29 1.39 0.02 175 FROM_EXCESS_BASE64 1669 1.77 1.36 1.88 176 HTTPS_HTTP_MISMATCH 1662 0.83 1.35 0.70 177 RCVD_IN_VALIDITY_CERTIFIED 1655 3.42 1.35 3.94 178 TR_XM_COVIDMETA1 1652 0.38 1.34 0.14 179 RCVD_IN_IADB_VOUCHED 1625 2.33 1.32 2.58 180 TR_Mismatch_TLD_02 1588 0.31 1.29 0.06 181 FROM_SUSPICIOUS_NTLD 1580 0.28 1.29 0.03 182 XMGenDplmaNmb 1552 0.76 1.26 0.63 183 URI_TRY_3LD 1543 0.65 1.26 0.50 184 FROM_SUSPICIOUS_NTLD_FP 1539 0.27 1.25 0.03 185 XMPhish30 1518 0.62 1.23 0.47 186 XMSubMetaI_00 1513 0.52 1.23 0.34 187 XMBdyGiftCard01 1508 0.67 1.23 0.53 188 RCVD_IN_RP_RNBL 1503 0.29 1.22 0.05 189 SUBJ_DOLLARS 1483 0.41 1.21 0.21 190 XM_UB80 1480 0.26 1.20 0.02 191 TR_LOTS_OF_MONEY3 1455 0.41 1.18 0.22 192 URI_LONG_REPEAT 1444 0.24 1.17 0.00 193 XMBody_78 1431 0.45 1.16 0.27 194 LongTLD 1418 0.32 1.15 0.10 195 USER_IN_DEF_DKIM_WL 1406 6.87 1.14 8.32 196 RELAYCOUNTRY_GB 1390 0.75 1.13 0.65 197 URI_PHP_REDIR 1381 0.24 1.12 0.01 198 DKIM_ADSP_CUSTOM_MED 1349 0.79 1.10 0.72 199 RELAYCOUNTRY_CN 1343 0.28 1.09 0.08 200 RELAYCOUNTRY_SG 1311 0.26 1.07 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435164 90.77 95.35 89.61 2 RELAYCOUNTRY_US 362091 74.77 75.61 74.56 3 XM_B_Unicode 359759 74.16 74.46 74.08 4 DCC_CHECK_NEGATIVE 341115 61.20 25.50 70.24 5 DKIM_SIGNED 264189 60.36 83.92 54.40 6 XM_DK_Pass 257760 58.50 79.91 53.08 7 BAYES_50 253129 51.59 49.50 52.12 8 DKIM_VALID 249881 56.82 78.00 51.45 9 XM_B_Unicode3 238307 47.69 42.26 49.07 10 DKIM_VALID_AU 188840 43.03 59.42 38.88 11 XM_B_SpammyWords 186823 44.19 66.81 38.47 12 XMListUnsubscribeExists 169469 41.84 69.26 34.90 13 DCC_CHECK 144347 38.76 74.46 29.72 14 MIME_HTML_ONLY 134180 28.31 30.99 27.63 15 XMSubLong 116042 24.15 25.15 23.89 16 T_TM2_M_HEADER_IN_MSG 114853 23.16 21.21 23.65 17 ALL_TRUSTED 113613 19.37 3.47 23.39 18 RCVD_IN_MSPIKE_WL 102639 21.10 20.96 21.13 19 HTML_FONT_LOW_CONTRAST 102484 23.21 31.54 21.10 20 DKIM_VALID_EF 96530 21.91 29.94 19.88 21 FVGT_m_MULTI_ODD 88025 20.51 29.91 18.13 22 LOC_TINY_FONT_1 86486 21.34 35.31 17.81 23 XM_H_Trusted_IP 83631 13.74 0.00 17.22 24 BAYES_00 77345 13.07 1.76 15.93 25 HTML_IMAGE_RATIO_04 76792 13.59 4.82 15.81 26 RCVD_IN_MSPIKE_H2 75683 17.29 24.01 15.58 27 XM_B_SpammyWords2 69626 18.61 35.48 14.34 28 XM_B_Unsub 69301 13.99 12.90 14.27 29 HTML_FONT_FACE_BAD 68908 11.51 0.93 14.19 30 T_KAM_HTML_FONT_INVALID 67751 17.57 31.87 13.95 31 TooManyTo_001 60149 11.02 5.61 12.39 32 LOTS_OF_MONEY 55757 11.68 12.49 11.48 33 RCVD_IN_MSPIKE_H3 55283 11.80 13.46 11.38 34 XMStrtUSub 50050 8.91 3.39 10.31 35 MPART_ALT_DIFF 49215 10.90 13.93 10.13 36 XM_Body_Dirty_Words 43282 11.45 21.45 8.91 37 XM_Multi_Part_URI 42807 10.28 16.05 8.81 38 MIME_HTML_ONLY_MULTI 40907 8.05 6.58 8.42 39 USER_IN_DEF_DKIM_WL 40395 6.87 1.14 8.32 40 RCVD_IN_MSPIKE_H4 40108 8.01 7.02 8.26 41 BAYES_99 38503 11.49 25.56 7.93 42 XM_Evil_Numbers_Gen 37235 8.03 9.47 7.67 43 BAYES_999 34823 9.74 19.91 7.17 44 XMSubNoVowel 33928 5.77 0.98 6.99 45 LotsOfNums_01 33117 7.09 8.16 6.82 46 XMDiploma_00 31728 5.71 2.46 6.53 47 FSL_BULK_SIG 31246 7.72 12.78 6.43 48 BAYES_60 31196 6.63 7.44 6.42 49 XM_DKIMWhitelistDomains 29278 4.82 0.04 6.03 50 TR_XM_DK_Bayes 29070 4.93 0.77 5.99 51 TR_XM_DK_Bayes1 28278 4.80 0.75 5.82 52 UNPARSEABLE_RELAY 27642 6.77 11.02 5.69 53 BAYES_40 25191 4.65 2.54 5.19 54 XM_DK_Undo_02 24601 11.73 38.04 5.07 55 MIME_QP_LONG_LINE 24521 5.05 5.04 5.05 56 IN_ZIMBRA_NJ_WHITELIST 24428 4.03 0.07 5.03 57 ANY_BOUNCE_MESSAGE 24418 4.17 0.76 5.03 58 BOUNCE_MESSAGE 24417 4.16 0.76 5.03 59 XM_SendGrid 24220 5.65 8.29 4.99 60 TR_XM_DK_Bayes2 23714 4.03 0.66 4.88 61 HTML_IMAGE_RATIO_06 23593 4.64 3.79 4.86 62 BAYES_20 22673 4.13 1.98 4.67 63 RCVD_IN_VALIDITY_SAFE 21505 3.92 1.91 4.43 64 HTML_IMAGE_RATIO_02 21046 4.94 7.34 4.33 65 TR_XM_UnparsRelay 20759 5.57 10.67 4.27 66 RCVD_IN_IADB_LISTED 20337 3.93 2.90 4.19 67 T_TooManySym_01 20140 3.76 2.23 4.15 68 RCVD_IN_RP_SAFE 19805 3.55 1.49 4.08 69 TR_XM_SpammyWords4 19451 5.37 10.75 4.01 70 RCVD_IN_VALIDITY_CERTIFIED 19146 3.42 1.35 3.94 71 TR_XM_DKIM_Undo 19028 9.39 31.02 3.92 72 XM_PDF 18567 3.25 1.01 3.82 73 XM_H_Long_From01 18226 4.32 6.56 3.75 74 RCVD_IN_IADB_SPF 17725 3.43 2.58 3.65 75 RCVD_IN_RP_CERTIFIED 17606 3.09 1.00 3.63 76 XM_B_SpammyWords3 17052 5.15 11.64 3.51 77 RCVD_IN_IADB_SENDERID 15858 3.09 2.39 3.27 78 BOTNET_IPINHOSTNAME 15564 5.27 13.44 3.20 79 RCVD_IN_IADB_DK 15392 3.03 2.46 3.17 80 TR_XM_DK_SendGrid 15177 3.38 4.38 3.13 81 TM2_M_URI_OPT_OUT 15102 3.36 4.35 3.11 82 RELAYCOUNTRY_META 14799 7.26 23.91 3.05 83 BAYES_05 14531 2.59 1.00 2.99 84 HTML_MIME_NO_HTML_TAG 14335 3.97 7.97 2.95 85 DKIM_INVALID 14308 3.55 5.92 2.95 86 XMSubMetaSx_00 14105 3.70 6.83 2.90 87 BAYES_80 13846 3.64 6.75 2.85 88 T_REMOTE_IMAGE 13810 3.37 5.43 2.84 89 XM_B_Phish_Phrases 13720 3.44 5.85 2.83 90 XMNumbers 13588 3.10 4.29 2.80 91 XM_UncommonTLD01 12688 5.27 15.75 2.61 92 TVD_SPACE_RATIO_MINFP 12612 2.12 0.21 2.60 93 RCVD_IN_IADB_VOUCHED 12552 2.33 1.32 2.58 94 TR_XM_PhishingBody 11971 3.11 5.68 2.46 95 XMSexyCombo_05 11828 3.92 9.78 2.44 96 T_TooManySym_02 11675 2.04 0.59 2.40 97 MAILING_LIST_MULTI 10285 2.13 2.20 2.12 98 URI_NOVOWEL 10173 2.87 5.91 2.09 99 MIME_HTML_MOSTLY 9871 3.22 7.93 2.03 100 XMSubGarbage 9244 1.53 0.03 1.90 101 BAYES_95 9221 2.21 3.42 1.90 102 FROM_EXCESS_BASE64 9112 1.77 1.36 1.88 103 XMSubLongNoVowel 9054 1.52 0.15 1.86 104 TR_DCC_Bayes_99 8896 5.29 18.96 1.83 105 HTML_IMAGE_RATIO_08 8668 1.90 2.33 1.78 106 TooManyTo_002 8431 1.57 0.89 1.74 107 RCVD_IN_IADB_OPTIN 8082 1.49 0.82 1.66 108 T_XMDrugObfuBody_14 8036 1.79 2.31 1.65 109 TR_XM_SB_Phish 7478 1.61 1.91 1.54 110 XMSubPhish11 7344 1.58 1.87 1.51 111 RCVD_IN_MSPIKE_H5 7248 1.29 0.48 1.49 112 XM_SPF_SoftFail 7220 2.13 4.65 1.49 113 INVALID_MSGID 7167 1.22 0.20 1.48 114 XM_B_SpammyTLD 7121 2.03 4.24 1.47 115 HELO_NODOT 7094 1.25 0.41 1.46 116 HELO_NO_DOMAIN 7090 1.25 0.40 1.46 117 XM_DK_Undo_01 6834 1.68 2.76 1.41 118 IN_HORDE_ADDRESS_BOOK 6729 1.12 0.08 1.39 119 XM_B_Investor 6656 1.97 4.34 1.37 120 XM_B_Phish66 6574 1.72 3.18 1.35 121 TR_Symld_Words 6450 1.34 1.39 1.33 122 XM_B_Unsub2 6351 1.65 3.00 1.31 123 MSGID_NOFQDN1 6272 1.05 0.07 1.29 124 SUBJ_ALL_CAPS 6188 1.36 1.70 1.27 125 XM_CamelCaseFrm001 6184 1.47 2.23 1.27 126 TR_XM_SpammyRelay 6057 4.00 14.89 1.25 127 TO_MALFORMED 6043 0.99 0.01 1.24 128 KHOP_HELO_FCRDNS 6028 1.97 4.86 1.24 129 TVD_RCVD_IP 5938 1.04 0.30 1.22 130 XMLngstWrd_00 5928 1.69 3.54 1.22 131 XM_GoogleGroups 5815 1.70 3.68 1.20 132 BOTNET 5799 3.57 12.93 1.19 133 URI_HEX 5643 1.25 1.58 1.16 134 TooManyTo_003 5578 1.05 0.66 1.15 135 T_XMDrugObfuBody_08 5405 1.50 3.01 1.11 136 XM_E_Blogspot 5394 0.92 0.17 1.11 137 MY_SERVERS_FOUND 5374 1.00 0.58 1.11 138 TR_XM_SpammyWords5 5341 1.52 3.16 1.10 139 XMLngstWrd_01 5196 1.56 3.49 1.07 140 SHORTENED_URL_HREF 5128 0.89 0.22 1.06 141 UNTRUSTED_Relay 4901 3.92 15.40 1.01 142 TM2_M_VERY_LONG_WORD 4868 1.84 5.17 1.00 143 XMGappySubj_01 4849 0.83 0.15 1.00 144 XMStockSpam_06 4843 1.13 1.64 1.00 145 XMCapTrack 4536 0.82 0.39 0.93 146 XMLngstWrd_02 4416 1.41 3.40 0.91 147 XM_ProductURIs 4142 0.83 0.73 0.85 148 TooManyTo_004 3900 0.74 0.50 0.80 149 XM_B_COPY_HTML 3880 0.75 0.57 0.80 150 TVD_SPACE_RATIO 3814 0.64 0.07 0.79 151 XMBSHREFv2 3807 0.71 0.40 0.78 152 XM_H_Long_From02 3807 0.81 0.90 0.78 153 XM_OfRef6 3634 1.20 3.01 0.75 154 RELAYCOUNTRY_CA 3583 1.52 4.63 0.74 155 XMBrknScrpt_02 3550 0.90 1.56 0.73 156 DKIM_ADSP_CUSTOM_MED 3484 0.79 1.10 0.72 157 TM2_M_BODY_EMPTY 3449 0.76 0.95 0.71 158 XMLngstWrd_03 3448 1.24 3.32 0.71 159 HTTPS_HTTP_MISMATCH 3410 0.83 1.35 0.70 160 T_FILL_THIS_FORM_SHORT 3362 0.98 2.13 0.69 161 XM_UB50 3261 2.21 8.29 0.67 162 SHORT_URI_2 3208 0.64 0.58 0.66 163 TR_XM_SpammyWords2 3193 2.29 8.73 0.66 164 HTML_IMAGE_ONLY_20 3187 0.64 0.59 0.66 165 RCVD_IN_MSPIKE_BL 3184 1.47 4.71 0.66 166 RELAYCOUNTRY_GB 3166 0.75 1.13 0.65 167 TR_XM_MSPIKECOMBO 3149 1.47 4.69 0.65 168 RCVD_IN_BL_SPAMCOP_NET 3109 2.41 9.41 0.64 169 XMHTML_After_End 3108 0.80 1.41 0.64 170 TR_XM_MaxUnsub 3084 1.13 3.09 0.64 171 XMGenDplmaNmb 3063 0.76 1.26 0.63 172 TooManyTo_005 3060 0.59 0.45 0.63 173 XMLngstWrd_04 2923 1.13 3.23 0.60 174 SpammyFromTLD_01 2891 1.53 5.20 0.60 175 T_TooManySym_03 2874 0.52 0.24 0.59 176 XM_B_COVIDMETA 2828 0.94 2.37 0.58 177 XMNoVowels 2772 0.61 0.76 0.57 178 TR_MetaPhish_Combo_01 2662 0.61 0.87 0.55 179 XMBdyGiftCard01 2562 0.67 1.23 0.53 180 XMBody_95 2528 0.46 0.20 0.52 181 XM_ShortIntro_01 2501 0.57 0.81 0.51 182 XM_RXBody 2484 0.47 0.31 0.51 183 XMSexyCombo_01 2484 0.81 2.00 0.51 184 URI_TRY_3LD 2443 0.65 1.26 0.50 185 NML_ADSP_CUSTOM_MED 2418 0.58 0.92 0.50 186 FROM_GOV_DKIM_AU 2413 0.49 0.46 0.50 187 TR_MSPIKEBAYES00 2366 0.39 0.02 0.49 188 T_OBFU_PDF_ATTACH 2360 0.43 0.23 0.49 189 XM_B_SpammyWords4 2341 0.81 2.10 0.48 190 RCVD_IN_SORBS_DUL 2297 0.43 0.27 0.47 191 XMPhish30 2271 0.62 1.23 0.47 192 XMEmptyBody_01 2222 0.55 0.93 0.46 193 T_XMDrugObfuBody_00 2185 0.74 1.88 0.45 194 FROM_GOV_SPOOF 1974 0.36 0.15 0.41 195 T_XMHurry_00 1968 0.63 1.53 0.41 196 SHORT_HELO_AND_INLINE_IMAGE 1940 0.34 0.08 0.40 197 T_Symld_Words_02 1901 0.47 0.79 0.39 198 XMSubMetaSxObfu_03 1889 0.41 0.50 0.39 199 XM_H_PHPMailer 1844 0.45 0.74 0.38 200 MSGID_FROM_MTA_HEADER 1820 0.36 0.28 0.37 ----------------------------------------------------------------------