Email: 498308 Autolearn: 0 AvgScore: 3.02 AvgScanTime: 1.40 sec Spam: 139227 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.51 sec Ham: 359081 Autolearn: 0 AvgScore: -1.26 AvgScanTime: 1.36 sec Time Spent Running SA: 193.80 hours Time Spent Processing Spam: 58.37 hours Time Spent Processing Ham: 135.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132342 88.78 95.05 86.35 2 DKIM_SIGNED 116025 75.54 83.34 72.51 3 RELAYCOUNTRY_US 113617 80.80 81.61 80.49 4 XM_DK_Pass 112657 73.92 80.92 71.21 5 DKIM_VALID 111905 73.13 80.38 70.31 6 XM_B_Unicode 110105 71.57 79.08 68.65 7 DCC_CHECK 101647 44.78 73.01 33.84 8 XMListUnsubscribeExists 91769 52.78 65.91 47.69 9 XM_B_SpammyWords 89003 50.03 63.93 44.64 10 DKIM_VALID_AU 85424 55.97 61.36 53.88 11 XM_DK_Undo_02 60930 17.28 43.76 7.01 12 XM_B_Unicode3 59639 40.71 42.84 39.89 13 BAYES_50 55598 50.49 39.93 54.58 14 LOC_TINY_FONT_1 51326 25.87 36.86 21.60 15 BAYES_99 49944 14.13 35.87 5.69 16 XM_B_SpammyWords2 49855 23.61 35.81 18.89 17 MIME_HTML_ONLY 46677 23.38 33.53 19.44 18 TR_XM_DKIM_Undo 46546 12.90 33.43 4.94 19 HTML_FONT_LOW_CONTRAST 44820 27.56 32.19 25.76 20 FVGT_m_MULTI_ODD 43329 24.99 31.12 22.62 21 DKIM_VALID_EF 40880 27.41 29.36 26.66 22 T_KAM_HTML_FONT_INVALID 39879 21.33 28.64 18.49 23 BAYES_999 39463 11.28 28.34 4.66 24 RCVD_IN_MSPIKE_H2 37765 23.02 27.12 21.42 25 DCC_CHECK_NEGATIVE 37545 55.18 26.97 66.12 26 TR_DCC_Bayes_99 35935 8.75 25.81 2.14 27 T_TM2_M_HEADER_IN_MSG 34276 28.10 24.62 29.45 28 XMSubLong 31538 21.26 22.65 20.73 29 XM_Body_Dirty_Words 28566 13.24 20.52 10.41 30 RELAYCOUNTRY_META 27715 8.09 19.91 3.51 31 RCVD_IN_MSPIKE_WL 26932 25.91 19.34 28.46 32 XM_Multi_Part_URI 22778 12.97 16.36 11.66 33 FSL_BULK_SIG 22286 7.15 16.01 3.72 34 LOTS_OF_MONEY 21135 9.90 15.18 7.86 35 XM_B_Unsub 19289 11.55 13.85 10.65 36 UNPARSEABLE_RELAY 19236 9.48 13.82 7.80 37 TR_XM_UnparsRelay 18785 8.06 13.49 5.95 38 TR_XM_SpammyWords4 17613 6.98 12.65 4.78 39 BOTNET 17410 4.66 12.50 1.61 40 BOTNET_IPINHOSTNAME 17308 6.84 12.43 4.67 41 RCVD_IN_MSPIKE_H3 17222 14.94 12.37 15.93 42 XM_B_SpammyWords3 16603 6.24 11.93 4.04 43 TR_XM_SpammyWords2 15840 3.95 11.38 1.07 44 UNTRUSTED_Relay 15265 3.88 10.96 1.13 45 TR_XM_SpammyRelay 14230 3.86 10.22 1.39 46 RCVD_IN_BL_SPAMCOP_NET 13213 3.10 9.49 0.62 47 XM_Evil_Numbers_Gen 13192 8.35 9.48 7.92 48 HTML_IMAGE_RATIO_02 13190 6.69 9.47 5.61 49 XMSexyCombo_05 13154 4.62 9.45 2.75 50 XM_SendGrid 12551 6.85 9.01 6.01 51 XM_UncommonTLD01 12240 5.38 8.79 4.05 52 XM_H_Long_From01 11862 6.28 8.52 5.42 53 BAYES_80 10788 5.56 7.75 4.71 54 TR_XM_PhishingBody 10642 4.63 7.64 3.46 55 LotsOfNums_01 10392 9.17 7.46 9.83 56 BAYES_60 9837 8.60 7.07 9.19 57 TR_XM_MaxUnsub 9588 2.64 6.89 0.99 58 RCVD_IN_MSPIKE_H4 9151 9.57 6.57 10.73 59 XMSubMetaSx_00 8843 4.19 6.35 3.35 60 MPART_ALT_DIFF 8822 5.50 6.34 5.18 61 TooManyTo_001 8752 8.51 6.29 9.37 62 RCVD_IN_MSPIKE_BL 8241 2.60 5.92 1.31 63 TR_XM_MSPIKECOMBO 8178 2.58 5.87 1.31 64 TR_XM_DK_SendGrid 8085 4.33 5.81 3.76 65 RELAYCOUNTRY_CA 7685 2.13 5.52 0.82 66 T_REMOTE_IMAGE 7676 4.22 5.51 3.71 67 XM_B_Phish_Phrases 7356 3.89 5.28 3.34 68 XM_SPF_SoftFail 7306 3.38 5.25 2.65 69 XM_UB50 7227 1.99 5.19 0.75 70 TR_XM_SPAMCOP 6676 1.44 4.80 0.14 71 KHOP_HELO_FCRDNS 6491 2.48 4.66 1.64 72 XM_B_Phish66 6381 2.87 4.58 2.20 73 XM_B_Investor 6371 2.43 4.58 1.60 74 BAYES_95 6324 3.35 4.54 2.88 75 MIME_HTML_ONLY_MULTI 6101 3.75 4.38 3.50 76 XM_B_SpammyTLD 5922 2.67 4.25 2.06 77 TM2_M_VERY_LONG_WORD 5875 2.16 4.22 1.37 78 HTML_IMAGE_RATIO_04 5814 4.71 4.18 4.91 79 HTML_MIME_NO_HTML_TAG 5747 2.76 4.13 2.23 80 RCVD_IN_PSBL 5693 1.25 4.09 0.15 81 HTML_IMAGE_RATIO_06 5633 3.98 4.05 3.95 82 XMNumbers 5553 3.75 3.99 3.66 83 MIME_QP_LONG_LINE 5404 6.50 3.88 7.52 84 RCVD_IN_VALIDITY_RPBL 5129 1.05 3.68 0.02 85 XMStrtUSub 5051 4.19 3.63 4.40 86 TM2_M_URI_OPT_OUT 5039 3.59 3.62 3.58 87 T_XMDrugObfuBody_14 4866 2.29 3.50 1.83 88 TR_XM_SpammyWords5 4695 2.03 3.37 1.50 89 T_XMDrugObfuBody_08 4364 1.89 3.13 1.40 90 XMDiploma_00 4306 1.75 3.09 1.22 91 XM_B_SpammyWords4 4264 1.14 3.06 0.40 92 RCVD_IN_VALIDITY_SAFE 4245 4.04 3.05 4.42 93 RCVD_IN_IADB_LISTED 4170 5.23 3.00 6.09 94 SpammyFromTLD_01 4128 1.84 2.96 1.41 95 DKIM_INVALID 4120 2.41 2.96 2.20 96 XM_OfRef6 4038 1.57 2.90 1.06 97 PDS_OTHER_BAD_TLD 4014 0.95 2.88 0.20 98 RCVD_IN_MSPIKE_L5 3986 0.92 2.86 0.16 99 BOTNET_NORDNS 3941 0.80 2.83 0.02 100 MIME_HTML_MOSTLY 3902 2.31 2.80 2.11 101 XMBody_17 3869 1.05 2.78 0.38 102 HTML_IMAGE_RATIO_08 3767 2.63 2.71 2.60 103 TR_XM_SpammyWords3 3730 1.16 2.68 0.58 104 RCVD_IN_VALIDITY_CERTIFIED 3644 3.50 2.62 3.84 105 XM_CamelCaseFrm001 3641 2.01 2.62 1.77 106 T_FILL_THIS_FORM_SHORT 3608 1.39 2.59 0.92 107 T_TooManySym_01 3510 4.80 2.52 5.68 108 XM_DIRTYINTL 3499 0.91 2.51 0.29 109 RCVD_IN_IADB_SPF 3494 4.59 2.51 5.39 110 URI_NOVOWEL 3378 2.62 2.43 2.69 111 XM_DK_Undo_01 3355 1.84 2.41 1.62 112 RCVD_IN_IADB_DK 3260 4.05 2.34 4.71 113 MAILING_LIST_MULTI 3217 2.42 2.31 2.46 114 SpammyFromTLD_02 3182 0.95 2.29 0.43 115 TR_Mismatch_TLD_01 3174 0.80 2.28 0.23 116 RCVD_IN_IADB_SENDERID 3166 4.16 2.27 4.89 117 XM_B_Unsub2 3078 1.71 2.21 1.52 118 TR_XM_SB_Phish 3024 2.07 2.17 2.03 119 XMSexyCombo_01 3023 0.97 2.17 0.50 120 SUBJ_ALL_CAPS 3003 1.68 2.16 1.49 121 TR_XM_NoHeaderRelay 2990 0.72 2.15 0.17 122 USER_IN_DEF_DKIM_WL 2988 8.92 2.15 11.55 123 RCVD_IN_MSPIKE_L3 2978 1.02 2.14 0.58 124 XMSubPhish11 2966 2.04 2.13 2.00 125 T_HTML_TAG_BALANCE_CENTER 2949 0.68 2.12 0.12 126 T_XMHurry_00 2945 1.01 2.12 0.59 127 TR_XM_MSPIKECOMBO2 2925 0.73 2.10 0.20 128 TR_LOTS_OF_MONEY3 2908 0.93 2.09 0.47 129 HTML_IMAGE_ONLY_08 2817 0.66 2.02 0.13 130 URI_HEX 2749 1.59 1.97 1.44 131 T_XMDrugObfuBody_00 2697 1.08 1.94 0.75 132 TR_XM_PHPDW 2656 1.41 1.91 1.21 133 XM_UB99 2645 0.53 1.90 0.00 134 XMStockSpam_06 2549 1.11 1.83 0.83 135 TR_XM_PHPForged 2547 1.34 1.83 1.15 136 MPART_ALT_DIFF_COUNT 2528 0.97 1.82 0.64 137 TR_XM_FormFill2 2525 1.34 1.81 1.16 138 XM_H_PHPOS 2515 1.33 1.81 1.15 139 XM_URI_RBL 2499 0.58 1.79 0.12 140 RCVD_IN_IADB_VOUCHED 2475 3.03 1.78 3.52 141 BAYES_40 2446 4.16 1.76 5.09 142 URIBL_BLACK 2442 0.53 1.75 0.06 143 BODY_URI_ONLY 2424 0.50 1.74 0.01 144 TR_Symld_Words 2216 1.70 1.59 1.74 145 XM_B_COVIDMETA 2196 0.79 1.58 0.49 146 FROM_EXCESS_BASE64 2175 2.31 1.56 2.60 147 WANT_TO_ORDER 2167 0.44 1.56 0.00 148 XMLngstWrd_00 2143 0.97 1.54 0.75 149 ALL_TRUSTED 2140 12.81 1.54 17.18 150 MIXED_CENTER_CASE 2066 0.42 1.48 0.00 151 XMLngstWrd_01 2064 0.89 1.48 0.66 152 XM_UB999 2064 0.42 1.48 0.00 153 HTTPS_HTTP_MISMATCH 2057 0.93 1.48 0.72 154 MIXED_HREF_CASE 2053 0.41 1.47 0.00 155 MIXED_FONT_CASE 2052 0.41 1.47 0.00 156 DIET_1 2048 0.64 1.47 0.31 157 MIXED_IMG_CASE 2044 0.41 1.47 0.00 158 MIXED_AREA_CASE 2042 0.41 1.47 0.00 159 TooManyTo_002 2034 1.94 1.46 2.12 160 TR_Mismatch_TLD_02 2022 0.46 1.45 0.08 161 RELAYCOUNTRY_CN 2014 0.45 1.45 0.06 162 TM2_M_A_HREF_HREF 1985 0.62 1.43 0.31 163 URIBL_DBL_SPAM 1970 0.40 1.41 0.01 164 XMLngstWrd_02 1958 0.79 1.41 0.56 165 TR_XM_FormFill 1949 0.40 1.40 0.02 166 BAYES_20 1936 3.22 1.39 3.93 167 XMPhish30 1927 0.77 1.38 0.53 168 XM_GoogleGroups 1925 1.35 1.38 1.33 169 FROM_SUSPICIOUS_NTLD 1880 0.41 1.35 0.04 170 URI_TRY_3LD 1873 0.78 1.35 0.56 171 TooManyTo_003 1870 1.37 1.34 1.38 172 RELAYCOUNTRY_AU 1828 0.60 1.31 0.33 173 FROM_SUSPICIOUS_NTLD_FP 1812 0.39 1.30 0.04 174 XM_UB60 1792 0.40 1.29 0.06 175 XM_H_Long_From02 1788 1.25 1.28 1.24 176 TooManyTo_004 1765 1.04 1.27 0.95 177 RELAYCOUNTRY_DE 1762 0.55 1.27 0.27 178 XM_H_Undi_Recip 1756 0.49 1.26 0.19 179 XMHTML_After_End 1721 0.93 1.24 0.82 180 RELAYCOUNTRY_FR 1721 0.48 1.24 0.19 181 T_Symld_Words_02 1716 0.78 1.23 0.61 182 TR_BOTNET_NEGATE 1710 0.62 1.23 0.38 183 RELAYCOUNTRY_GB 1706 0.90 1.23 0.77 184 XMGenDplmaNmb 1687 0.78 1.21 0.62 185 DATE_IN_PAST_03_06 1665 0.46 1.20 0.18 186 GOOG_STO_IMG_HTML 1657 0.33 1.19 0.00 187 TR_XM_BayesRelay 1653 0.33 1.19 0.00 188 TooManyTo_005 1615 0.86 1.16 0.75 189 DKIM_ADSP_CUSTOM_MED 1571 1.00 1.13 0.95 190 XMSlimDrugH 1559 0.59 1.12 0.39 191 XMBdyGiftCard01 1555 0.77 1.12 0.64 192 XMLngstWrd_03 1551 0.63 1.11 0.45 193 XMBrknScrpt_02 1539 0.70 1.11 0.55 194 XMSubNoVowel 1535 1.27 1.10 1.34 195 XM_ProductURIs 1529 0.68 1.10 0.52 196 HTML_FONT_SIZE_LARGE 1525 0.37 1.10 0.09 197 XM_RXBody 1519 0.63 1.09 0.45 198 RCVD_IN_IADB_OPTIN 1491 1.97 1.07 2.31 199 MISSING_HEADERS 1483 0.56 1.07 0.37 200 XM_PDF 1473 4.19 1.06 5.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 310051 88.78 95.05 86.35 2 RELAYCOUNTRY_US 289019 80.80 81.61 80.49 3 DKIM_SIGNED 260374 75.54 83.34 72.51 4 XM_DK_Pass 255713 73.92 80.92 71.21 5 DKIM_VALID 252484 73.13 80.38 70.31 6 XM_B_Unicode 246523 71.57 79.08 68.65 7 DCC_CHECK_NEGATIVE 237428 55.18 26.97 66.12 8 BAYES_50 195999 50.49 39.93 54.58 9 DKIM_VALID_AU 193475 55.97 61.36 53.88 10 XMListUnsubscribeExists 171261 52.78 65.91 47.69 11 XM_B_SpammyWords 160299 50.03 63.93 44.64 12 XM_B_Unicode3 143223 40.71 42.84 39.89 13 DCC_CHECK 121504 44.78 73.01 33.84 14 T_TM2_M_HEADER_IN_MSG 105733 28.10 24.62 29.45 15 RCVD_IN_MSPIKE_WL 102197 25.91 19.34 28.46 16 DKIM_VALID_EF 95724 27.41 29.36 26.66 17 HTML_FONT_LOW_CONTRAST 92502 27.56 32.19 25.76 18 FVGT_m_MULTI_ODD 81219 24.99 31.12 22.62 19 LOC_TINY_FONT_1 77579 25.87 36.86 21.60 20 RCVD_IN_MSPIKE_H2 76922 23.02 27.12 21.42 21 XMSubLong 74420 21.26 22.65 20.73 22 MIME_HTML_ONLY 69806 23.38 33.53 19.44 23 XM_B_SpammyWords2 67814 23.61 35.81 18.89 24 T_KAM_HTML_FONT_INVALID 66387 21.33 28.64 18.49 25 ALL_TRUSTED 61699 12.81 1.54 17.18 26 RCVD_IN_MSPIKE_H3 57215 14.94 12.37 15.93 27 XM_Multi_Part_URI 41870 12.97 16.36 11.66 28 USER_IN_DEF_DKIM_WL 41477 8.92 2.15 11.55 29 BAYES_00 40999 8.49 0.94 11.42 30 RCVD_IN_MSPIKE_H4 38538 9.57 6.57 10.73 31 XM_B_Unsub 38256 11.55 13.85 10.65 32 XM_Body_Dirty_Words 37393 13.24 20.52 10.41 33 LotsOfNums_01 35283 9.17 7.46 9.83 34 TooManyTo_001 33651 8.51 6.29 9.37 35 BAYES_60 33010 8.60 7.07 9.19 36 XM_Evil_Numbers_Gen 28435 8.35 9.48 7.92 37 LOTS_OF_MONEY 28218 9.90 15.18 7.86 38 UNPARSEABLE_RELAY 28017 9.48 13.82 7.80 39 MIME_QP_LONG_LINE 26998 6.50 3.88 7.52 40 XM_DKIMWhitelistDomains 26249 5.28 0.05 7.31 41 IN_ZIMBRA_NJ_WHITELIST 25708 5.19 0.11 7.16 42 XM_DK_Undo_02 25172 17.28 43.76 7.01 43 TR_XM_DK_Bayes 23373 4.87 0.65 6.51 44 TR_XM_DK_Bayes1 22976 4.79 0.64 6.40 45 RCVD_IN_IADB_LISTED 21878 5.23 3.00 6.09 46 XM_SendGrid 21575 6.85 9.01 6.01 47 TR_XM_UnparsRelay 21363 8.06 13.49 5.95 48 BAYES_99 20449 14.13 35.87 5.69 49 T_TooManySym_01 20389 4.80 2.52 5.68 50 HTML_IMAGE_RATIO_02 20149 6.69 9.47 5.61 51 TR_XM_DK_Bayes2 20145 4.18 0.48 5.61 52 XM_H_Long_From01 19455 6.28 8.52 5.42 53 XM_PDF 19390 4.19 1.06 5.40 54 RCVD_IN_IADB_SPF 19371 4.59 2.51 5.39 55 MPART_ALT_DIFF 18606 5.50 6.34 5.18 56 BAYES_40 18287 4.16 1.76 5.09 57 TR_XM_DKIM_Undo 17736 12.90 33.43 4.94 58 HTML_IMAGE_RATIO_04 17646 4.71 4.18 4.91 59 RCVD_IN_IADB_SENDERID 17565 4.16 2.27 4.89 60 TR_XM_SpammyWords4 17176 6.98 12.65 4.78 61 RCVD_IN_IADB_DK 16926 4.05 2.34 4.71 62 BAYES_80 16913 5.56 7.75 4.71 63 BOTNET_IPINHOSTNAME 16772 6.84 12.43 4.67 64 BAYES_999 16744 11.28 28.34 4.66 65 RCVD_IN_VALIDITY_SAFE 15872 4.04 3.05 4.42 66 XMStrtUSub 15813 4.19 3.63 4.40 67 XM_UncommonTLD01 14552 5.38 8.79 4.05 68 XM_B_SpammyWords3 14516 6.24 11.93 4.04 69 HTML_IMAGE_RATIO_06 14181 3.98 4.05 3.95 70 BAYES_20 14114 3.22 1.39 3.93 71 RCVD_IN_VALIDITY_CERTIFIED 13773 3.50 2.62 3.84 72 TR_XM_DK_SendGrid 13512 4.33 5.81 3.76 73 FSL_BULK_SIG 13352 7.15 16.01 3.72 74 T_REMOTE_IMAGE 13333 4.22 5.51 3.71 75 XMNumbers 13154 3.75 3.99 3.66 76 XM_H_Trusted_IP 13037 2.62 0.00 3.63 77 TM2_M_URI_OPT_OUT 12844 3.59 3.62 3.58 78 RCVD_IN_IADB_VOUCHED 12641 3.03 1.78 3.52 79 RELAYCOUNTRY_META 12588 8.09 19.91 3.51 80 MIME_HTML_ONLY_MULTI 12581 3.75 4.38 3.50 81 TR_XM_PhishingBody 12408 4.63 7.64 3.46 82 XMSubMetaSx_00 12015 4.19 6.35 3.35 83 XM_B_Phish_Phrases 12006 3.89 5.28 3.34 84 T_TooManySym_02 11275 2.50 0.86 3.14 85 BAYES_95 10359 3.35 4.54 2.88 86 ANY_BOUNCE_MESSAGE 10065 2.30 1.01 2.80 87 BOUNCE_MESSAGE 10063 2.30 1.01 2.80 88 XMSexyCombo_05 9882 4.62 9.45 2.75 89 URI_NOVOWEL 9672 2.62 2.43 2.69 90 XM_SPF_SoftFail 9514 3.38 5.25 2.65 91 FROM_EXCESS_BASE64 9324 2.31 1.56 2.60 92 HTML_IMAGE_RATIO_08 9323 2.63 2.71 2.60 93 BAYES_05 8945 2.00 0.72 2.49 94 MAILING_LIST_MULTI 8841 2.42 2.31 2.46 95 RCVD_IN_IADB_OPTIN 8304 1.97 1.07 2.31 96 HTML_MIME_NO_HTML_TAG 8000 2.76 4.13 2.23 97 XM_B_Phish66 7906 2.87 4.58 2.20 98 DKIM_INVALID 7890 2.41 2.96 2.20 99 TR_DCC_Bayes_99 7687 8.75 25.81 2.14 100 TooManyTo_002 7627 1.94 1.46 2.12 101 MIME_HTML_MOSTLY 7587 2.31 2.80 2.11 102 XM_B_SpammyTLD 7404 2.67 4.25 2.06 103 TR_XM_SB_Phish 7276 2.07 2.17 2.03 104 XMSubPhish11 7196 2.04 2.13 2.00 105 INVALID_MSGID 6937 1.48 0.32 1.93 106 IN_HORDE_ADDRESS_BOOK 6635 1.37 0.15 1.85 107 T_XMDrugObfuBody_14 6562 2.29 3.50 1.83 108 HELO_NODOT 6518 1.47 0.58 1.82 109 HELO_NO_DOMAIN 6513 1.46 0.55 1.81 110 RCVD_IN_MSPIKE_H5 6444 1.41 0.40 1.79 111 XM_CamelCaseFrm001 6363 2.01 2.62 1.77 112 TR_Symld_Words 6236 1.70 1.59 1.74 113 MSGID_NOFQDN1 6099 1.29 0.22 1.70 114 TVD_RCVD_IP 6077 1.29 0.27 1.69 115 TO_MALFORMED 5985 1.20 0.01 1.67 116 KHOP_HELO_FCRDNS 5885 2.48 4.66 1.64 117 XM_DK_Undo_01 5802 1.84 2.41 1.62 118 BOTNET 5798 4.66 12.50 1.61 119 XM_B_Investor 5751 2.43 4.58 1.60 120 XM_B_Unsub2 5448 1.71 2.21 1.52 121 TR_XM_SpammyWords5 5400 2.03 3.37 1.50 122 SUBJ_ALL_CAPS 5347 1.68 2.16 1.49 123 URI_HEX 5158 1.59 1.97 1.44 124 SpammyFromTLD_01 5061 1.84 2.96 1.41 125 T_XMDrugObfuBody_08 5042 1.89 3.13 1.40 126 TR_XM_SpammyRelay 4981 3.86 10.22 1.39 127 TooManyTo_003 4971 1.37 1.34 1.38 128 TM2_M_VERY_LONG_WORD 4912 2.16 4.22 1.37 129 XMSubNoVowel 4797 1.27 1.10 1.34 130 XM_GoogleGroups 4782 1.35 1.38 1.33 131 RCVD_IN_MSPIKE_BL 4705 2.60 5.92 1.31 132 TR_XM_MSPIKECOMBO 4701 2.58 5.87 1.31 133 XMGappySubj_01 4674 0.98 0.13 1.30 134 XM_H_Long_From02 4444 1.25 1.28 1.24 135 SHORT_URI_2 4429 0.98 0.31 1.23 136 XMDiploma_00 4395 1.75 3.09 1.22 137 XMCapTrack 4361 1.01 0.48 1.21 138 TR_XM_PHPDW 4358 1.41 1.91 1.21 139 XMBSHREFv2 4256 0.92 0.24 1.19 140 TR_XM_FormFill2 4158 1.34 1.81 1.16 141 TR_XM_PHPForged 4146 1.34 1.83 1.15 142 XM_H_PHPOS 4129 1.33 1.81 1.15 143 UNTRUSTED_Relay 4049 3.88 10.96 1.13 144 TVD_SPACE_RATIO 3961 0.90 0.38 1.10 145 TR_XM_SpammyWords2 3828 3.95 11.38 1.07 146 XM_OfRef6 3791 1.57 2.90 1.06 147 HTML_FONT_FACE_BAD 3596 0.96 0.86 1.00 148 TR_XM_MaxUnsub 3565 2.64 6.89 0.99 149 TooManyTo_004 3409 1.04 1.27 0.95 150 DKIM_ADSP_CUSTOM_MED 3408 1.00 1.13 0.95 151 T_FILL_THIS_FORM_SHORT 3295 1.39 2.59 0.92 152 RCVD_IN_RP_SAFE 3097 0.81 0.66 0.86 153 XMStockSpam_06 2971 1.11 1.83 0.83 154 RELAYCOUNTRY_CA 2931 2.13 5.52 0.82 155 XMHTML_After_End 2927 0.93 1.24 0.82 156 T_TooManySym_03 2819 0.69 0.44 0.79 157 TR_MetaPhish_Combo_01 2804 0.80 0.84 0.78 158 RCVD_IN_RP_CERTIFIED 2772 0.71 0.54 0.77 159 RELAYCOUNTRY_GB 2766 0.90 1.23 0.77 160 XMBody_95 2724 0.57 0.08 0.76 161 XM_UB50 2709 1.99 5.19 0.75 162 XMLngstWrd_00 2687 0.97 1.54 0.75 163 TooManyTo_005 2683 0.86 1.16 0.75 164 T_XMDrugObfuBody_00 2681 1.08 1.94 0.75 165 HTTPS_HTTP_MISMATCH 2584 0.93 1.48 0.72 166 FROM_GOV_DKIM_AU 2440 0.55 0.21 0.68 167 XMLngstWrd_01 2378 0.89 1.48 0.66 168 XMBdyGiftCard01 2299 0.77 1.12 0.64 169 HTML_TAG_BALANCE_BODY 2294 0.70 0.85 0.64 170 HTML_IMAGE_ONLY_20 2285 0.55 0.33 0.64 171 MPART_ALT_DIFF_COUNT 2281 0.97 1.82 0.64 172 XM_ShortIntro_01 2259 0.63 0.64 0.63 173 RCVD_IN_BL_SPAMCOP_NET 2233 3.10 9.49 0.62 174 XMGenDplmaNmb 2220 0.78 1.21 0.62 175 T_Symld_Words_02 2183 0.78 1.23 0.61 176 XMMoneyMeta_00 2162 0.70 0.95 0.60 177 NML_ADSP_CUSTOM_MED 2138 0.68 0.91 0.60 178 PLING_QUERY 2127 0.63 0.72 0.59 179 T_XMHurry_00 2106 1.01 2.12 0.59 180 RCVD_IN_MSPIKE_L3 2100 1.02 2.14 0.58 181 TR_XM_SpammyWords3 2073 1.16 2.68 0.58 182 T_OBFU_PDF_ATTACH 2059 0.48 0.23 0.57 183 RCVD_IN_MSPIKE_L4 2027 0.65 0.87 0.56 184 URI_TRY_3LD 2012 0.78 1.35 0.56 185 XMLngstWrd_02 1997 0.79 1.41 0.56 186 XMNoVowels 1984 0.49 0.32 0.55 187 XMBrknScrpt_02 1958 0.70 1.11 0.55 188 XMPhish30 1904 0.77 1.38 0.53 189 XM_H_PHPMailer 1876 0.60 0.80 0.52 190 XM_ProductURIs 1856 0.68 1.10 0.52 191 SHORT_HELO_AND_INLINE_IMAGE 1846 0.39 0.08 0.51 192 LOW_PRICE 1823 0.43 0.23 0.51 193 FORGED_GMAIL_RCVD 1816 0.64 1.00 0.51 194 XM_B_COPY_HTML 1796 0.54 0.65 0.50 195 XMSexyCombo_01 1790 0.97 2.17 0.50 196 RCVD_IN_SORBS_DUL 1783 0.44 0.31 0.50 197 XM_B_COVIDMETA 1758 0.79 1.58 0.49 198 TR_MSPIKEBAYES00 1751 0.36 0.02 0.49 199 XMHTMLBadTable_001 1741 0.58 0.82 0.48 200 TR_LOTS_OF_MONEY3 1702 0.93 2.09 0.47 ----------------------------------------------------------------------