Email: 529590 Autolearn: 0 AvgScore: 2.59 AvgScanTime: 1.29 sec Spam: 148444 Autolearn: 0 AvgScore: 14.13 AvgScanTime: 1.39 sec Ham: 381146 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 1.26 sec Time Spent Running SA: 190.33 hours Time Spent Processing Spam: 57.23 hours Time Spent Processing Ham: 133.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142603 90.15 96.07 87.84 2 DKIM_SIGNED 125845 74.31 84.78 70.24 3 XM_DK_Pass 121498 72.29 81.85 68.57 4 DKIM_VALID 121096 71.58 81.58 67.69 5 RELAYCOUNTRY_US 121032 82.38 81.53 82.72 6 XM_B_Unicode 112872 72.96 76.04 71.76 7 DCC_CHECK 102360 43.02 68.96 32.92 8 XMListUnsubscribeExists 99167 52.13 66.80 46.41 9 XM_B_SpammyWords 93423 49.97 62.93 44.92 10 DKIM_VALID_AU 89014 53.47 59.96 50.94 11 XM_DK_Undo_02 64091 17.04 43.18 6.86 12 BAYES_50 63897 51.25 43.04 54.45 13 XM_B_Unicode3 61491 42.37 41.42 42.74 14 MIME_HTML_ONLY 51885 25.13 34.95 21.30 15 LOC_TINY_FONT_1 50869 25.19 34.27 21.66 16 XM_B_SpammyWords2 50845 23.04 34.25 18.68 17 TR_XM_DKIM_Undo 49505 13.17 33.35 5.31 18 FVGT_m_MULTI_ODD 49142 25.93 33.10 23.13 19 BAYES_99 46925 12.94 31.61 5.67 20 HTML_FONT_LOW_CONTRAST 46069 26.94 31.03 25.34 21 DCC_CHECK_NEGATIVE 46046 56.94 31.02 67.04 22 DKIM_VALID_EF 43151 26.94 29.07 26.11 23 RCVD_IN_MSPIKE_H2 38905 22.32 26.21 20.81 24 T_KAM_HTML_FONT_INVALID 38164 20.50 25.71 18.48 25 BAYES_999 36829 10.29 24.81 4.63 26 XMSubLong 33638 21.11 22.66 20.50 27 TR_DCC_Bayes_99 33460 7.66 22.54 1.86 28 RELAYCOUNTRY_META 32849 8.90 22.13 3.75 29 T_TM2_M_HEADER_IN_MSG 31384 28.21 21.14 30.96 30 RCVD_IN_MSPIKE_WL 30917 26.91 20.83 29.28 31 XM_Body_Dirty_Words 30193 13.77 20.34 11.21 32 BOTNET_IPINHOSTNAME 23544 7.57 15.86 4.35 33 BOTNET 23235 5.46 15.65 1.49 34 XM_Multi_Part_URI 23050 12.85 15.53 11.81 35 XM_B_Unsub 22587 12.11 15.22 10.90 36 RCVD_IN_MSPIKE_H3 20213 15.40 13.62 16.10 37 LOTS_OF_MONEY 19328 9.85 13.02 8.61 38 UNPARSEABLE_RELAY 19235 9.24 12.96 7.79 39 FSL_BULK_SIG 18849 6.09 12.70 3.52 40 TR_XM_UnparsRelay 18663 7.93 12.57 6.12 41 XM_B_SpammyWords3 17485 6.75 11.78 4.79 42 UNTRUSTED_Relay 16843 4.09 11.35 1.26 43 TR_XM_SpammyWords4 16461 6.40 11.09 4.57 44 XM_UncommonTLD01 16355 5.45 11.02 3.29 45 MPART_ALT_DIFF 15503 8.74 10.44 8.07 46 XMSexyCombo_05 15414 5.30 10.38 3.33 47 TR_XM_SpammyWords2 14454 3.43 9.74 0.97 48 TR_XM_SpammyRelay 14382 3.78 9.69 1.48 49 XM_Evil_Numbers_Gen 14277 7.97 9.62 7.33 50 RCVD_IN_BL_SPAMCOP_NET 14186 3.29 9.56 0.85 51 HTML_MIME_NO_HTML_TAG 13723 4.34 9.24 2.43 52 HTML_IMAGE_RATIO_02 13223 6.62 8.91 5.73 53 BAYES_80 13049 5.57 8.79 4.32 54 XM_SendGrid 12065 6.40 8.13 5.73 55 BAYES_60 11438 8.63 7.71 8.98 56 MIME_HTML_ONLY_MULTI 11216 6.64 7.56 6.28 57 RCVD_IN_MSPIKE_BL 10758 3.00 7.25 1.34 58 LotsOfNums_01 10465 8.96 7.05 9.70 59 TR_XM_MSPIKECOMBO 10392 2.93 7.00 1.34 60 RCVD_IN_MSPIKE_H4 10000 9.96 6.74 11.21 61 TR_XM_PhishingBody 9844 4.19 6.63 3.24 62 XM_B_Phish_Phrases 9801 4.27 6.60 3.36 63 XM_H_Long_From01 9733 5.46 6.56 5.03 64 XM_B_SpammyTLD 9529 3.38 6.42 2.19 65 TM2_M_VERY_LONG_WORD 9346 3.16 6.30 1.93 66 TR_XM_MaxUnsub 9191 2.25 6.19 0.72 67 XM_SPF_SoftFail 8982 5.04 6.05 4.64 68 TooManyTo_001 7743 7.48 5.22 8.36 69 XMSubMetaSx_00 7678 3.78 5.17 3.23 70 TR_XM_DK_SendGrid 7167 3.90 4.83 3.53 71 TR_XM_SPAMCOP 7151 1.67 4.82 0.45 72 XM_GoogleGroups 7073 2.76 4.76 1.98 73 XM_UB50 7038 1.91 4.74 0.81 74 TR_XM_SpammyWords3 6845 1.77 4.61 0.67 75 T_REMOTE_IMAGE 6554 3.70 4.42 3.42 76 RELAYCOUNTRY_CA 6527 1.81 4.40 0.80 77 HTML_IMAGE_RATIO_04 6470 4.99 4.36 5.24 78 XM_B_Investor 6322 2.30 4.26 1.54 79 XMLngstWrd_00 6232 2.03 4.20 1.18 80 XMLngstWrd_01 6139 1.96 4.14 1.11 81 BAYES_95 6119 3.09 4.12 2.69 82 XMLngstWrd_02 5978 1.85 4.03 1.00 83 SpammyFromTLD_02 5920 1.38 3.99 0.37 84 T_XMDrugObfuBody_14 5790 2.58 3.90 2.07 85 XMLngstWrd_03 5656 1.71 3.81 0.90 86 RCVD_IN_MSPIKE_L5 5625 1.20 3.79 0.19 87 XMLngstWrd_04 5561 1.64 3.75 0.82 88 HTML_TITLE_SUBJ_DIFF 5518 1.54 3.72 0.69 89 UPPERCASE_75_100 5457 1.52 3.68 0.69 90 SpammyFromTLD_01 5434 1.55 3.66 0.73 91 PDS_OTHER_BAD_TLD 5367 1.20 3.62 0.26 92 XMNumbers 5332 3.51 3.59 3.47 93 XMStrtUSub 5320 3.89 3.58 4.00 94 XM_B_Unsub2 5160 2.52 3.48 2.15 95 MIME_HTML_MOSTLY 5125 2.85 3.45 2.61 96 TR_XM_SpammyWords5 4997 2.05 3.37 1.53 97 XM_B_Phish66 4991 2.39 3.36 2.01 98 TM2_M_URI_OPT_OUT 4942 4.32 3.33 4.70 99 MIME_QP_LONG_LINE 4927 5.21 3.32 5.95 100 DKIM_INVALID 4749 2.73 3.20 2.55 101 HTML_IMAGE_RATIO_06 4696 3.73 3.16 3.96 102 T_XMDrugObfuBody_08 4646 2.07 3.13 1.65 103 XM_DIRTYINTL 4592 1.11 3.09 0.33 104 HTML_IMAGE_ONLY_08 4517 0.93 3.04 0.11 105 KHOP_HELO_FCRDNS 4508 2.88 3.04 2.81 106 RCVD_IN_VALIDITY_SAFE 4374 3.83 2.95 4.18 107 HTML_SHORT_LINK_IMG_1 4358 0.83 2.94 0.01 108 BOTNET_NORDNS 4234 0.81 2.85 0.02 109 URI_PHP_REDIR 4177 0.79 2.81 0.00 110 XM_CamelCaseFrm001 4166 1.97 2.81 1.64 111 XM_OfRef6 4010 1.56 2.70 1.11 112 GOOG_STO_IMG_HTML 3953 0.75 2.66 0.00 113 RCVD_IN_IADB_LISTED 3927 5.08 2.65 6.03 114 HTML_IMAGE_RATIO_08 3922 3.94 2.64 4.45 115 URI_NOVOWEL 3817 2.78 2.57 2.87 116 MAILING_LIST_MULTI 3766 2.87 2.54 3.00 117 RCVD_IN_VALIDITY_CERTIFIED 3755 3.47 2.53 3.83 118 XM_DK_Undo_01 3750 2.01 2.53 1.81 119 RCVD_IN_VALIDITY_RPBL 3522 0.68 2.37 0.02 120 T_TooManySym_01 3462 4.60 2.33 5.48 121 XM_BadFromFormat 3403 0.71 2.29 0.10 122 XM_B_COVIDMETA 3313 0.97 2.23 0.48 123 USER_IN_DEF_DKIM_WL 3224 8.69 2.17 11.23 124 RCVD_IN_IADB_SPF 3215 4.43 2.17 5.31 125 RCVD_IN_MSPIKE_L3 3147 1.04 2.12 0.61 126 XM_UB80 3146 0.61 2.12 0.02 127 XMDiploma_00 3036 1.43 2.05 1.19 128 HDRS_MISSP 2915 0.57 1.96 0.03 129 RCVD_IN_IADB_DK 2893 3.86 1.95 4.60 130 RCVD_IN_IADB_SENDERID 2880 3.98 1.94 4.77 131 RCVD_IN_PSBL 2850 0.56 1.92 0.03 132 SUBJ_ALL_CAPS 2840 2.28 1.91 2.43 133 TR_XM_NoHeaderRelay 2824 0.68 1.90 0.20 134 TR_XM_PHPDW 2797 0.80 1.88 0.38 135 TR_XM_MSPIKECOMBO2 2779 0.64 1.87 0.16 136 T_FILL_THIS_FORM_SHORT 2720 1.10 1.83 0.81 137 XM_URI_RBL 2720 0.59 1.83 0.11 138 XM_B_SpammyWords4 2710 0.92 1.83 0.56 139 RELAYCOUNTRY_CZ 2682 0.52 1.81 0.02 140 FROM_EXCESS_BASE64 2681 2.40 1.81 2.63 141 T_XMDrugObfuBody_00 2671 1.05 1.80 0.75 142 TR_XM_PHPForged 2648 0.74 1.78 0.34 143 TR_XM_SB_Phish 2631 3.11 1.77 3.63 144 TR_XM_FormFill2 2620 0.73 1.76 0.33 145 XM_H_PHPOS 2607 0.73 1.76 0.33 146 XMBody_17 2592 0.74 1.75 0.35 147 XMSexyCombo_01 2570 0.95 1.73 0.65 148 DKIM_ADSP_CUSTOM_MED 2554 1.13 1.72 0.91 149 RCVD_IN_IADB_VOUCHED 2545 3.17 1.71 3.74 150 RELAYCOUNTRY_AU 2509 0.72 1.69 0.34 151 XMSubPhish11 2465 3.05 1.66 3.60 152 RELAYCOUNTRY_FR 2442 0.61 1.65 0.21 153 BAYES_40 2438 3.65 1.64 4.43 154 URIBL_BLACK 2381 0.50 1.60 0.06 155 ALL_TRUSTED 2357 11.14 1.59 14.86 156 XM_UB99 2356 0.45 1.59 0.00 157 XMStockSpam_06 2251 1.06 1.52 0.88 158 URI_HEX 2242 1.38 1.51 1.33 159 XMBdyGiftCard01 2227 0.95 1.50 0.74 160 RELAYCOUNTRY_RU 2173 0.43 1.46 0.03 161 HTML_TAG_BALANCE_CENTER 2136 0.44 1.44 0.05 162 HTML_FONT_TINY_NORDNS 2100 0.44 1.41 0.06 163 XM_UB60 2053 0.45 1.38 0.09 164 BAYES_20 2024 2.98 1.36 3.61 165 RELAYCOUNTRY_GB 2023 0.96 1.36 0.80 166 DIET_1 2022 0.57 1.36 0.26 167 T_XMHurry_00 1978 0.81 1.33 0.61 168 TooManyTo_002 1964 1.98 1.32 2.24 169 XMHTML_After_End 1962 0.90 1.32 0.74 170 XM_H_Long_From02 1955 1.31 1.32 1.30 171 URIBL_DBL_SPAM 1950 0.38 1.31 0.01 172 URI_TRY_3LD 1942 0.84 1.31 0.65 173 HTTPS_HTTP_MISMATCH 1940 0.90 1.31 0.74 174 XMPhish30 1890 0.73 1.27 0.52 175 XMSubMetaI_00 1795 0.74 1.21 0.55 176 TooManyTo_003 1785 1.41 1.20 1.49 177 XMMoneyMeta_00 1784 0.84 1.20 0.71 178 TM2_M_A_HREF_HREF 1779 0.81 1.20 0.65 179 TR_XM_COVIDMETA4 1768 0.46 1.19 0.18 180 HTML_IMAGE_ONLY_12 1763 0.51 1.19 0.25 181 TR_XM_COVIDMETA1 1761 0.45 1.19 0.16 182 XMGenDplmaNmb 1746 0.88 1.18 0.77 183 BODY_URI_ONLY 1742 0.34 1.17 0.01 184 XMPhish14 1731 0.62 1.17 0.40 185 XM_UB999 1715 0.33 1.16 0.00 186 XM_B_SEO 1707 0.43 1.15 0.14 187 TR_Symld_Words 1677 1.39 1.13 1.49 188 TR_BOTNET_NEGATE 1676 0.57 1.13 0.35 189 XM_Body_Dirty_Words_01 1670 0.41 1.13 0.14 190 TooManyTo_004 1638 1.06 1.10 1.05 191 RCVD_IN_MSPIKE_L4 1620 0.69 1.09 0.54 192 XM_PDF 1613 3.53 1.09 4.49 193 TR_XM_BayesRelay 1602 0.31 1.08 0.01 194 RCVD_IN_IADB_OPTIN 1601 2.06 1.08 2.44 195 MIXED_HREF_CASE 1596 0.30 1.08 0.00 196 MIXED_CENTER_CASE 1596 0.30 1.08 0.00 197 NML_ADSP_CUSTOM_MED 1593 0.70 1.07 0.56 198 MIXED_AREA_CASE 1582 0.30 1.07 0.00 199 MIXED_IMG_CASE 1582 0.30 1.07 0.00 200 MIXED_FONT_CASE 1578 0.30 1.06 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 334810 90.15 96.07 87.84 2 RELAYCOUNTRY_US 315266 82.38 81.53 82.72 3 XM_B_Unicode 273525 72.96 76.04 71.76 4 DKIM_SIGNED 267710 74.31 84.78 70.24 5 XM_DK_Pass 261359 72.29 81.85 68.57 6 DKIM_VALID 258000 71.58 81.58 67.69 7 DCC_CHECK_NEGATIVE 255509 56.94 31.02 67.04 8 BAYES_50 207519 51.25 43.04 54.45 9 DKIM_VALID_AU 194171 53.47 59.96 50.94 10 XMListUnsubscribeExists 176889 52.13 66.80 46.41 11 XM_B_SpammyWords 171215 49.97 62.93 44.92 12 XM_B_Unicode3 162920 42.37 41.42 42.74 13 DCC_CHECK 125484 43.02 68.96 32.92 14 T_TM2_M_HEADER_IN_MSG 118002 28.21 21.14 30.96 15 RCVD_IN_MSPIKE_WL 111608 26.91 20.83 29.28 16 DKIM_VALID_EF 99519 26.94 29.07 26.11 17 HTML_FONT_LOW_CONTRAST 96593 26.94 31.03 25.34 18 FVGT_m_MULTI_ODD 88157 25.93 33.10 23.13 19 LOC_TINY_FONT_1 82539 25.19 34.27 21.66 20 MIME_HTML_ONLY 81198 25.13 34.95 21.30 21 RCVD_IN_MSPIKE_H2 79316 22.32 26.21 20.81 22 XMSubLong 78150 21.11 22.66 20.50 23 XM_B_SpammyWords2 71197 23.04 34.25 18.68 24 T_KAM_HTML_FONT_INVALID 70426 20.50 25.71 18.48 25 RCVD_IN_MSPIKE_H3 61358 15.40 13.62 16.10 26 ALL_TRUSTED 56638 11.14 1.59 14.86 27 BAYES_00 51492 9.99 0.95 13.51 28 XM_Multi_Part_URI 45013 12.85 15.53 11.81 29 USER_IN_DEF_DKIM_WL 42808 8.69 2.17 11.23 30 RCVD_IN_MSPIKE_H4 42733 9.96 6.74 11.21 31 XM_Body_Dirty_Words 42710 13.77 20.34 11.21 32 XM_B_Unsub 41544 12.11 15.22 10.90 33 LotsOfNums_01 36970 8.96 7.05 9.70 34 IN_ZIMBRA_NJ_WHITELIST 35213 6.67 0.08 9.24 35 BAYES_60 34240 8.63 7.71 8.98 36 LOTS_OF_MONEY 32823 9.85 13.02 8.61 37 TooManyTo_001 31856 7.48 5.22 8.36 38 MPART_ALT_DIFF 30765 8.74 10.44 8.07 39 UNPARSEABLE_RELAY 29704 9.24 12.96 7.79 40 XM_Evil_Numbers_Gen 27936 7.97 9.62 7.33 41 XM_DKIMWhitelistDomains 27366 5.17 0.02 7.18 42 XM_DK_Undo_02 26141 17.04 43.18 6.86 43 TR_XM_DK_Bayes 24868 4.85 0.53 6.52 44 TR_XM_DK_Bayes1 24324 4.74 0.53 6.38 45 MIME_HTML_ONLY_MULTI 23940 6.64 7.56 6.28 46 TR_XM_UnparsRelay 23331 7.93 12.57 6.12 47 RCVD_IN_IADB_LISTED 22977 5.08 2.65 6.03 48 MIME_QP_LONG_LINE 22661 5.21 3.32 5.95 49 XM_H_Trusted_IP 22122 4.18 0.00 5.80 50 HTML_IMAGE_RATIO_02 21852 6.62 8.91 5.73 51 XM_SendGrid 21840 6.40 8.13 5.73 52 BAYES_99 21620 12.94 31.61 5.67 53 TR_XM_DK_Bayes2 20889 4.06 0.40 5.48 54 T_TooManySym_01 20878 4.60 2.33 5.48 55 RCVD_IN_IADB_SPF 20244 4.43 2.17 5.31 56 TR_XM_DKIM_Undo 20232 13.17 33.35 5.31 57 HTML_IMAGE_RATIO_04 19969 4.99 4.36 5.24 58 XM_H_Long_From01 19177 5.46 6.56 5.03 59 XM_B_SpammyWords3 18262 6.75 11.78 4.79 60 RCVD_IN_IADB_SENDERID 18188 3.98 1.94 4.77 61 TM2_M_URI_OPT_OUT 17912 4.32 3.33 4.70 62 XM_SPF_SoftFail 17692 5.04 6.05 4.64 63 BAYES_999 17664 10.29 24.81 4.63 64 RCVD_IN_IADB_DK 17540 3.86 1.95 4.60 65 TR_XM_SpammyWords4 17424 6.40 11.09 4.57 66 XM_PDF 17096 3.53 1.09 4.49 67 HTML_IMAGE_RATIO_08 16949 3.94 2.64 4.45 68 BAYES_40 16870 3.65 1.64 4.43 69 BOTNET_IPINHOSTNAME 16562 7.57 15.86 4.35 70 BAYES_80 16447 5.57 8.79 4.32 71 RCVD_IN_VALIDITY_SAFE 15917 3.83 2.95 4.18 72 XMStrtUSub 15260 3.89 3.58 4.00 73 HTML_IMAGE_RATIO_06 15077 3.73 3.16 3.96 74 RCVD_IN_VALIDITY_CERTIFIED 14603 3.47 2.53 3.83 75 RELAYCOUNTRY_META 14307 8.90 22.13 3.75 76 RCVD_IN_IADB_VOUCHED 14258 3.17 1.71 3.74 77 TR_XM_SB_Phish 13821 3.11 1.77 3.63 78 BAYES_20 13773 2.98 1.36 3.61 79 XMSubPhish11 13703 3.05 1.66 3.60 80 HTML_FONT_FACE_BAD 13646 2.79 0.78 3.58 81 TR_XM_DK_SendGrid 13462 3.90 4.83 3.53 82 FSL_BULK_SIG 13420 6.09 12.70 3.52 83 XMNumbers 13234 3.51 3.59 3.47 84 T_REMOTE_IMAGE 13052 3.70 4.42 3.42 85 XM_B_Phish_Phrases 12811 4.27 6.60 3.36 86 XMSexyCombo_05 12674 5.30 10.38 3.33 87 XM_UncommonTLD01 12529 5.45 11.02 3.29 88 TR_XM_PhishingBody 12337 4.19 6.63 3.24 89 XMSubMetaSx_00 12329 3.78 5.17 3.23 90 T_TooManySym_02 11572 2.38 0.68 3.04 91 MAILING_LIST_MULTI 11450 2.87 2.54 3.00 92 ANY_BOUNCE_MESSAGE 11072 2.35 0.92 2.90 93 BOUNCE_MESSAGE 11054 2.34 0.92 2.90 94 URI_NOVOWEL 10921 2.78 2.57 2.87 95 KHOP_HELO_FCRDNS 10720 2.88 3.04 2.81 96 BAYES_95 10260 3.09 4.12 2.69 97 FROM_EXCESS_BASE64 10034 2.40 1.81 2.63 98 MIME_HTML_MOSTLY 9943 2.85 3.45 2.61 99 DKIM_INVALID 9710 2.73 3.20 2.55 100 RCVD_IN_IADB_OPTIN 9318 2.06 1.08 2.44 101 HTML_MIME_NO_HTML_TAG 9274 4.34 9.24 2.43 102 SUBJ_ALL_CAPS 9259 2.28 1.91 2.43 103 BAYES_05 8916 1.90 0.77 2.34 104 TooManyTo_002 8536 1.98 1.32 2.24 105 XM_B_SpammyTLD 8355 3.38 6.42 2.19 106 XM_B_Unsub2 8209 2.52 3.48 2.15 107 T_XMDrugObfuBody_14 7879 2.58 3.90 2.07 108 XM_B_Phish66 7679 2.39 3.36 2.01 109 XM_GoogleGroups 7553 2.76 4.76 1.98 110 RCVD_IN_MSPIKE_H5 7517 1.55 0.47 1.97 111 TM2_M_VERY_LONG_WORD 7369 3.16 6.30 1.93 112 XMSubNoVowel 7250 1.53 0.57 1.90 113 HELO_NODOT 7105 1.53 0.67 1.86 114 HELO_NO_DOMAIN 7101 1.53 0.67 1.86 115 TR_DCC_Bayes_99 7088 7.66 22.54 1.86 116 XM_DK_Undo_01 6896 2.01 2.53 1.81 117 IN_HORDE_ADDRESS_BOOK 6758 1.31 0.11 1.77 118 INVALID_MSGID 6622 1.35 0.35 1.74 119 TVD_RCVD_IP 6433 1.32 0.39 1.69 120 T_XMDrugObfuBody_08 6300 2.07 3.13 1.65 121 FILL_THIS_FORM 6296 1.26 0.25 1.65 122 XM_CamelCaseFrm001 6251 1.97 2.81 1.64 123 MSGID_NOFQDN1 6085 1.20 0.18 1.60 124 TO_MALFORMED 6037 1.18 0.14 1.58 125 XM_B_Investor 5885 2.30 4.26 1.54 126 TR_XM_SpammyWords5 5846 2.05 3.37 1.53 127 TR_Symld_Words 5696 1.39 1.13 1.49 128 TooManyTo_003 5687 1.41 1.20 1.49 129 BOTNET 5669 5.46 15.65 1.49 130 TR_XM_SpammyRelay 5643 3.78 9.69 1.48 131 RCVD_IN_MSPIKE_BL 5110 3.00 7.25 1.34 132 TR_XM_MSPIKECOMBO 5104 2.93 7.00 1.34 133 URI_HEX 5059 1.38 1.51 1.33 134 XM_H_Long_From02 4957 1.31 1.32 1.30 135 XMGappySubj_01 4809 1.01 0.36 1.26 136 UNTRUSTED_Relay 4794 4.09 11.35 1.26 137 XMDiploma_00 4542 1.43 2.05 1.19 138 XMCapTrack 4520 1.10 0.88 1.19 139 XMLngstWrd_00 4501 2.03 4.20 1.18 140 XMBSHREFv2 4304 0.89 0.28 1.13 141 XM_OfRef6 4244 1.56 2.70 1.11 142 XMLngstWrd_01 4224 1.96 4.14 1.11 143 TooManyTo_004 3988 1.06 1.10 1.05 144 TVD_SPACE_RATIO 3941 0.78 0.14 1.03 145 XMLngstWrd_02 3819 1.85 4.03 1.00 146 TR_XM_SpammyWords2 3707 3.43 9.74 0.97 147 DKIM_ADSP_CUSTOM_MED 3455 1.13 1.72 0.91 148 XMLngstWrd_03 3426 1.71 3.81 0.90 149 XM_E_Blogspot 3368 0.69 0.19 0.88 150 XMStockSpam_06 3354 1.06 1.52 0.88 151 RCVD_IN_BL_SPAMCOP_NET 3246 3.29 9.56 0.85 152 TooManyTo_005 3225 0.89 1.02 0.85 153 XMLngstWrd_04 3136 1.64 3.75 0.82 154 T_FILL_THIS_FORM_SHORT 3095 1.10 1.83 0.81 155 XM_UB50 3086 1.91 4.74 0.81 156 RELAYCOUNTRY_CA 3052 1.81 4.40 0.80 157 RELAYCOUNTRY_GB 3041 0.96 1.36 0.80 158 RCVD_IN_RP_SAFE 3010 0.77 0.72 0.79 159 T_TooManySym_03 2979 0.64 0.27 0.78 160 XMGenDplmaNmb 2925 0.88 1.18 0.77 161 T_XMDrugObfuBody_00 2868 1.05 1.80 0.75 162 TR_MSPIKEBAYES00 2860 0.55 0.02 0.75 163 XMBrknScrpt_02 2840 0.75 0.76 0.75 164 XMBody_95 2826 0.56 0.09 0.74 165 XMBdyGiftCard01 2824 0.95 1.50 0.74 166 XMHTML_After_End 2817 0.90 1.32 0.74 167 HTTPS_HTTP_MISMATCH 2810 0.90 1.31 0.74 168 SpammyFromTLD_01 2770 1.55 3.66 0.73 169 TR_MetaPhish_Combo_01 2763 0.79 0.95 0.72 170 RCVD_IN_RP_CERTIFIED 2746 0.69 0.61 0.72 171 TR_XM_MaxUnsub 2739 2.25 6.19 0.72 172 XM_D_tchamptons_WL 2731 0.52 0.01 0.72 173 XMMoneyMeta_00 2690 0.84 1.20 0.71 174 HTML_TITLE_SUBJ_DIFF 2638 1.54 3.72 0.69 175 UPPERCASE_75_100 2612 1.52 3.68 0.69 176 TR_XM_SpammyWords3 2554 1.77 4.61 0.67 177 TM2_M_A_HREF_HREF 2491 0.81 1.20 0.65 178 FROM_GOV_DKIM_AU 2487 0.51 0.14 0.65 179 URI_TRY_3LD 2487 0.84 1.31 0.65 180 XMSexyCombo_01 2464 0.95 1.73 0.65 181 RCVD_IN_MSPIKE_L3 2343 1.04 2.12 0.61 182 XM_ShortIntro_01 2310 0.58 0.52 0.61 183 T_XMHurry_00 2309 0.81 1.33 0.61 184 XMNoVowels 2285 0.59 0.55 0.60 185 T_Symld_Words_02 2252 0.64 0.77 0.59 186 SHORT_HELO_AND_INLINE_IMAGE 2217 0.45 0.10 0.58 187 HTML_IMAGE_ONLY_20 2204 0.52 0.36 0.58 188 XM_B_SpammyWords4 2151 0.92 1.83 0.56 189 T_OBFU_PDF_ATTACH 2147 0.47 0.22 0.56 190 XMSubMetaSxObfu_03 2121 0.59 0.69 0.56 191 NML_ADSP_CUSTOM_MED 2119 0.70 1.07 0.56 192 XM_H_PHPMailer 2116 0.64 0.87 0.56 193 XMSubMetaI_00 2115 0.74 1.21 0.55 194 RCVD_IN_MSPIKE_L4 2045 0.69 1.09 0.54 195 HTML_TAG_BALANCE_BODY 2028 0.63 0.88 0.53 196 XMPhish30 1966 0.73 1.27 0.52 197 XM_B_COPY_HTML 1946 0.59 0.79 0.51 198 RCVD_IN_SORBS_DUL 1940 0.44 0.26 0.51 199 FORGED_GMAIL_RCVD 1862 0.65 1.06 0.49 200 XM_B_COVIDMETA 1839 0.97 2.23 0.48 ----------------------------------------------------------------------