Email: 525700 Autolearn: 0 AvgScore: 4.03 AvgScanTime: 1.39 sec Spam: 171904 Autolearn: 0 AvgScore: 14.44 AvgScanTime: 1.49 sec Ham: 353796 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 1.34 sec Time Spent Running SA: 202.56 hours Time Spent Processing Spam: 70.99 hours Time Spent Processing Ham: 131.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164554 90.14 95.72 87.42 2 DKIM_SIGNED 143464 75.09 83.46 71.03 3 XM_DK_Pass 139886 73.65 81.37 69.90 4 DKIM_VALID 138662 72.77 80.66 68.93 5 RELAYCOUNTRY_US 135024 79.03 78.55 79.26 6 XM_B_Unicode 121935 69.55 70.93 68.88 7 DCC_CHECK 119264 45.19 69.38 33.44 8 XMListUnsubscribeExists 110408 52.91 64.23 47.42 9 XM_B_SpammyWords 105334 49.63 61.27 43.96 10 DKIM_VALID_AU 104130 56.02 60.57 53.81 11 BAYES_50 72854 51.46 42.38 55.87 12 XM_DK_Undo_02 70266 17.81 40.88 6.60 13 XM_B_Unicode3 64492 38.54 37.52 39.04 14 FVGT_m_MULTI_ODD 60429 27.28 35.15 23.46 15 XM_B_SpammyWords2 59039 23.89 34.34 18.81 16 LOC_TINY_FONT_1 58489 25.78 34.02 21.78 17 BAYES_99 57742 14.69 33.59 5.51 18 MIME_HTML_ONLY 56967 23.34 33.14 18.58 19 DCC_CHECK_NEGATIVE 52585 54.76 30.59 66.51 20 TR_XM_DKIM_Undo 52393 13.28 30.48 4.92 21 HTML_FONT_LOW_CONTRAST 51907 26.23 30.20 24.30 22 BAYES_999 45927 11.65 26.72 4.32 23 DKIM_VALID_EF 45848 26.49 26.67 26.40 24 T_KAM_HTML_FONT_INVALID 45620 21.46 26.54 18.99 25 RCVD_IN_MSPIKE_H2 45465 22.41 26.45 20.45 26 T_TM2_M_HEADER_IN_MSG 42884 29.53 24.95 31.75 27 XMSubLong 40008 21.98 23.27 21.35 28 RELAYCOUNTRY_META 39767 9.94 23.13 3.54 29 RCVD_IN_MSPIKE_WL 39552 26.97 23.01 28.90 30 TR_DCC_Bayes_99 38069 8.54 22.15 1.93 31 XM_Body_Dirty_Words 34670 13.68 20.17 10.52 32 LOTS_OF_MONEY 28801 11.93 16.75 9.58 33 XM_B_Unsub 27711 10.47 16.12 7.72 34 RCVD_IN_MSPIKE_H3 27270 16.28 15.86 16.48 35 TR_XM_BayesUnsub 27026 9.17 15.72 5.99 36 XM_Multi_Part_URI 26681 12.72 15.52 11.37 37 FSL_BULK_SIG 25416 6.83 14.78 2.96 38 TR_XM_SpammyWords4 23096 7.89 13.44 5.19 39 UNTRUSTED_Relay 22677 5.08 13.19 1.14 40 MPART_ALT_DIFF 22676 7.93 13.19 5.37 41 UNPARSEABLE_RELAY 21764 9.08 12.66 7.34 42 BOTNET_IPINHOSTNAME 21228 7.04 12.35 4.46 43 TR_XM_UnparsRelay 21207 7.89 12.34 5.73 44 XM_B_SpammyWords3 20738 6.52 12.06 3.83 45 BOTNET 20263 4.81 11.79 1.42 46 XM_UncommonTLD01 19221 6.09 11.18 3.62 47 TR_XM_SpammyWords2 18955 4.31 11.03 1.05 48 XMSexyCombo_05 18174 5.35 10.57 2.81 49 TR_XM_PhishingBody 16702 5.55 9.72 3.53 50 TR_XM_SpammyRelay 16469 4.16 9.58 1.52 51 RCVD_IN_BL_SPAMCOP_NET 16080 3.49 9.35 0.64 52 XM_Evil_Numbers_Gen 14859 7.67 8.64 7.19 53 HTML_MIME_NO_HTML_TAG 14244 4.43 8.29 2.55 54 HTML_IMAGE_RATIO_02 13651 6.10 7.94 5.20 55 TM2_M_VERY_LONG_WORD 13531 3.71 7.87 1.69 56 BAYES_80 13227 5.70 7.69 4.73 57 LotsOfNums_01 12906 8.47 7.51 8.93 58 XM_B_Phish_Phrases 12746 4.76 7.41 3.47 59 XM_B_Phish66 12439 3.86 7.24 2.22 60 XM_SendGrid 12389 6.00 7.21 5.41 61 MIME_HTML_ONLY_MULTI 12376 4.80 7.20 3.63 62 BAYES_60 12230 9.05 7.11 9.99 63 MIME_HTML_MOSTLY 11422 3.83 6.64 2.46 64 XM_UB50 11138 2.64 6.48 0.77 65 RCVD_IN_MSPIKE_H4 11111 9.45 6.46 10.90 66 XMSubMetaSx_00 10911 4.37 6.35 3.41 67 XM_B_SpammyTLD 10897 4.04 6.34 2.92 68 SpammyFromTLD_01 10107 2.44 5.88 0.77 69 XMLngstWrd_00 10068 2.66 5.86 1.10 70 XMLngstWrd_01 9967 2.59 5.80 1.03 71 XMLngstWrd_02 9475 2.43 5.51 0.93 72 XM_GoogleGroups 9384 3.03 5.46 1.85 73 XM_H_Long_From01 9205 5.04 5.35 4.89 74 XMLngstWrd_03 8896 2.25 5.17 0.82 75 URI_NOVOWEL 8864 3.35 5.16 2.48 76 RCVD_IN_MSPIKE_BL 8786 2.56 5.11 1.32 77 RELAYCOUNTRY_CA 8781 2.27 5.11 0.89 78 TR_XM_MSPIKECOMBO 8717 2.54 5.07 1.31 79 XMLngstWrd_04 8705 2.16 5.06 0.75 80 HTML_TITLE_SUBJ_DIFF 8555 2.00 4.98 0.56 81 UPPERCASE_75_100 8458 2.00 4.92 0.59 82 XM_B_Crypto 8328 3.31 4.84 2.56 83 XMStrtUSub 8221 4.65 4.78 4.58 84 TR_XM_DK_SendGrid 8175 3.84 4.76 3.39 85 TR_XM_SPAMCOP 8168 1.66 4.75 0.15 86 KHOP_HELO_FCRDNS 8108 2.58 4.72 1.54 87 RELAYCOUNTRY_FR 8046 1.67 4.68 0.21 88 RCVD_IN_VALIDITY_RPBL 7863 1.53 4.57 0.05 89 BAYES_95 7793 3.49 4.53 2.98 90 HTML_IMAGE_RATIO_04 7567 4.41 4.40 4.42 91 XM_B_Investor 7515 2.60 4.37 1.73 92 T_REMOTE_IMAGE 7401 3.76 4.31 3.49 93 URIBL_DBL_SPAM 7261 1.39 4.22 0.02 94 XM_SPF_SoftFail 7194 2.85 4.18 2.20 95 TooManyTo_001 7189 7.17 4.18 8.61 96 ANY_BOUNCE_MESSAGE 7064 4.17 4.11 4.20 97 BOUNCE_MESSAGE 7064 4.17 4.11 4.20 98 XM_DIRTYINTL 6828 1.51 3.97 0.31 99 TM2_M_A_HREF_HREF 6430 2.55 3.74 1.97 100 HTML_IMAGE_RATIO_06 6403 3.94 3.72 4.05 101 XM_OfRef6 6388 1.91 3.72 1.04 102 T_XMDrugObfuBody_14 5800 2.30 3.37 1.79 103 RCVD_IN_PSBL 5767 1.18 3.35 0.12 104 XMNumbers 5435 3.33 3.16 3.42 105 ALL_TRUSTED 5351 13.41 3.11 18.41 106 XMDiploma_00 5327 1.97 3.10 1.42 107 PDS_OTHER_BAD_TLD 5298 1.11 3.08 0.15 108 TR_XM_SpammyWords5 5115 1.81 2.98 1.24 109 XM_B_Unsub2 4927 1.83 2.87 1.33 110 DKIM_INVALID 4802 2.33 2.79 2.10 111 TR_Mismatch_TLD_01 4759 1.10 2.77 0.29 112 T_XMDrugObfuBody_08 4726 1.73 2.75 1.24 113 RCVD_IN_MSPIKE_L3 4590 1.30 2.67 0.63 114 XM_DK_Undo_01 4585 1.98 2.67 1.64 115 RCVD_IN_VALIDITY_SAFE 4560 3.66 2.65 4.15 116 SpammyFromTLD_02 4523 1.11 2.63 0.37 117 MIME_QP_LONG_LINE 4317 4.37 2.51 5.28 118 RCVD_IN_IADB_LISTED 4253 4.38 2.47 5.31 119 URI_OPTOUT_3LD 4251 0.88 2.47 0.11 120 BAYES_40 4233 4.11 2.46 4.91 121 XM_UB99 4209 0.80 2.45 0.00 122 T_TooManySym_01 4198 4.58 2.44 5.62 123 HTML_IMAGE_RATIO_08 3960 2.52 2.30 2.63 124 RCVD_IN_VALIDITY_CERTIFIED 3886 3.28 2.26 3.78 125 TR_XM_PhishingBody2 3883 0.76 2.26 0.04 126 XM_CamelCaseFrm001 3862 1.89 2.25 1.71 127 TR_XM_Crypto3 3829 0.85 2.23 0.18 128 T_XMDrugObfuBody_00 3718 1.20 2.16 0.74 129 URI_PHP_REDIR 3680 0.70 2.14 0.01 130 TR_XM_SpammyWords3 3625 1.06 2.11 0.55 131 TR_XM_MSPIKECOMBO2 3573 0.81 2.08 0.19 132 TM2_M_URI_OPT_OUT 3548 2.18 2.06 2.24 133 BOTNET_NORDNS 3540 0.68 2.06 0.01 134 XMSexyCombo_01 3538 1.18 2.06 0.75 135 RCVD_IN_IADB_SPF 3485 3.84 2.03 4.72 136 XMBody_17 3473 1.03 2.02 0.54 137 XM_UB999 3413 0.65 1.99 0.00 138 XM_B_SpammyWords4 3386 1.10 1.97 0.68 139 MAILING_LIST_MULTI 3363 2.50 1.96 2.77 140 URI_HEX 3350 1.67 1.95 1.54 141 XM_B_COVIDMETA 3345 1.08 1.95 0.66 142 XMHTML_After_End 3344 1.15 1.95 0.77 143 T_FILL_THIS_FORM_SHORT 3324 1.15 1.93 0.77 144 USER_IN_DEF_DKIM_WL 3296 8.53 1.92 11.74 145 JH_SPAMMY_HEADERS 3242 0.62 1.89 0.00 146 TR_XM_SB_Phish 3192 2.26 1.86 2.46 147 RCVD_IN_IADB_DK 3148 3.36 1.83 4.10 148 READY_TO_SHIP 3126 0.60 1.82 0.01 149 RCVD_IN_IADB_SENDERID 3052 3.46 1.78 4.27 150 XMSubPhish11 2991 2.20 1.74 2.43 151 URI_NO_WWW_BIZ_CGI 2975 0.57 1.73 0.01 152 XM_UB60 2879 0.59 1.67 0.07 153 SUBJ_ALL_CAPS 2878 1.53 1.67 1.46 154 T_HTML_TAG_BALANCE_CENTER 2789 0.63 1.62 0.15 155 RCVD_IN_MSPIKE_L5 2753 0.55 1.60 0.04 156 XMStockSpam_06 2732 1.01 1.59 0.73 157 RELAYCOUNTRY_RU 2708 0.54 1.58 0.04 158 TR_XM_COVIDMETA1 2681 0.67 1.56 0.24 159 HTML_IMAGE_ONLY_08 2676 0.58 1.56 0.11 160 RCVD_IN_IADB_VOUCHED 2667 2.76 1.55 3.34 161 FROM_EXCESS_BASE64 2570 2.08 1.50 2.37 162 XM_H_Undi_Recip 2541 0.62 1.48 0.21 163 TR_Symld_Words 2539 1.59 1.48 1.65 164 MISSING_HEADERS 2539 0.96 1.48 0.71 165 TR_LOTS_OF_MONEY3 2512 0.67 1.46 0.28 166 HELO_NODOT 2467 1.99 1.44 2.25 167 HTTPS_HTTP_MISMATCH 2464 1.07 1.43 0.90 168 HELO_NO_DOMAIN 2460 1.98 1.43 2.25 169 TR_XM_NoHeaderRelay 2425 0.55 1.41 0.13 170 RELAYCOUNTRY_DE 2398 0.62 1.39 0.25 171 HTML_FONT_FACE_BAD 2389 1.11 1.39 0.97 172 XM_URI_RBL 2379 0.53 1.38 0.12 173 XMBrknScrpt_02 2370 0.90 1.38 0.67 174 MPART_ALT_DIFF_COUNT 2335 0.87 1.36 0.63 175 T_XMHurry_00 2277 1.73 1.32 1.92 176 XM_H_Long_From02 2276 1.32 1.32 1.32 177 URIBL_BLACK 2250 0.47 1.31 0.07 178 HK_RANDOM_FROM 2202 0.68 1.28 0.39 179 TR_XM_PHPDW 2152 0.69 1.25 0.42 180 MIXED_CENTER_CASE 2146 0.41 1.25 0.00 181 MIXED_HREF_CASE 2109 0.40 1.23 0.00 182 TR_XM_PHPForged 2105 0.65 1.22 0.36 183 MIXED_AREA_CASE 2099 0.40 1.22 0.00 184 MIXED_IMG_CASE 2099 0.40 1.22 0.01 185 MIXED_FONT_CASE 2052 0.39 1.19 0.00 186 TR_XM_FormFill2 2049 0.64 1.19 0.37 187 RELAYCOUNTRY_AU 2044 0.60 1.19 0.31 188 BODY_URI_ONLY 2036 0.40 1.18 0.02 189 XM_H_PHPOS 2034 0.62 1.18 0.35 190 TR_XM_Undi_Recip11 2027 0.42 1.18 0.06 191 TR_XM_MaxSPIKE 2012 0.42 1.17 0.06 192 URI_TRY_3LD 1995 0.73 1.16 0.51 193 TR_LOTS_OF_MONEY1 1974 0.59 1.15 0.32 194 URI_GOOG_STO_SPAMMY 1973 0.38 1.15 0.00 195 XM_UB80 1946 0.38 1.13 0.02 196 TR_XM_BayesRelay 1934 0.37 1.13 0.00 197 XMSubNoVowel 1907 1.20 1.11 1.24 198 HTML_TAG_BALANCE_BODY 1884 0.83 1.10 0.70 199 XMSubMetaSxObfu_03 1875 0.66 1.09 0.45 200 T_Symld_Words_02 1865 0.68 1.08 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309290 90.14 95.72 87.42 2 RELAYCOUNTRY_US 280416 79.03 78.55 79.26 3 DKIM_SIGNED 251294 75.09 83.46 71.03 4 XM_DK_Pass 247287 73.65 81.37 69.90 5 DKIM_VALID 243866 72.77 80.66 68.93 6 XM_B_Unicode 243699 69.55 70.93 68.88 7 DCC_CHECK_NEGATIVE 235296 54.76 30.59 66.51 8 BAYES_50 197670 51.46 42.38 55.87 9 DKIM_VALID_AU 190374 56.02 60.57 53.81 10 XMListUnsubscribeExists 167762 52.91 64.23 47.42 11 XM_B_SpammyWords 155546 49.63 61.27 43.96 12 XM_B_Unicode3 138135 38.54 37.52 39.04 13 DCC_CHECK 118313 45.19 69.38 33.44 14 T_TM2_M_HEADER_IN_MSG 112338 29.53 24.95 31.75 15 RCVD_IN_MSPIKE_WL 102254 26.97 23.01 28.90 16 DKIM_VALID_EF 93417 26.49 26.67 26.40 17 HTML_FONT_LOW_CONTRAST 85982 26.23 30.20 24.30 18 FVGT_m_MULTI_ODD 82989 27.28 35.15 23.46 19 LOC_TINY_FONT_1 77050 25.78 34.02 21.78 20 XMSubLong 75536 21.98 23.27 21.35 21 RCVD_IN_MSPIKE_H2 72345 22.41 26.45 20.45 22 T_KAM_HTML_FONT_INVALID 67196 21.46 26.54 18.99 23 XM_B_SpammyWords2 66552 23.89 34.34 18.81 24 MIME_HTML_ONLY 65727 23.34 33.14 18.58 25 ALL_TRUSTED 65147 13.41 3.11 18.41 26 RCVD_IN_MSPIKE_H3 58303 16.28 15.86 16.48 27 USER_IN_DEF_DKIM_WL 41543 8.53 1.92 11.74 28 XM_Multi_Part_URI 40210 12.72 15.52 11.37 29 RCVD_IN_MSPIKE_H4 38561 9.45 6.46 10.90 30 XM_Body_Dirty_Words 37226 13.68 20.17 10.52 31 BAYES_00 36005 7.06 0.64 10.18 32 BAYES_60 35350 9.05 7.11 9.99 33 LOTS_OF_MONEY 33895 11.93 16.75 9.58 34 LotsOfNums_01 31607 8.47 7.51 8.93 35 TooManyTo_001 30479 7.17 4.18 8.61 36 XM_B_Unsub 27325 10.47 16.12 7.72 37 XM_DKIMWhitelistDomains 26751 5.10 0.02 7.56 38 UNPARSEABLE_RELAY 25972 9.08 12.66 7.34 39 XM_Evil_Numbers_Gen 25437 7.67 8.64 7.19 40 IN_ZIMBRA_NJ_WHITELIST 24262 4.65 0.10 6.86 41 XM_DK_Undo_02 23352 17.81 40.88 6.60 42 TR_XM_BayesUnsub 21200 9.17 15.72 5.99 43 TR_XM_DK_Bayes 20646 4.07 0.45 5.84 44 TR_XM_UnparsRelay 20278 7.89 12.34 5.73 45 TR_XM_DK_Bayes1 20210 3.99 0.44 5.71 46 T_TooManySym_01 19874 4.58 2.44 5.62 47 BAYES_99 19486 14.69 33.59 5.51 48 XM_SendGrid 19150 6.00 7.21 5.41 49 MPART_ALT_DIFF 18994 7.93 13.19 5.37 50 RCVD_IN_IADB_LISTED 18783 4.38 2.47 5.31 51 MIME_QP_LONG_LINE 18664 4.37 2.51 5.28 52 HTML_IMAGE_RATIO_02 18403 6.10 7.94 5.20 53 TR_XM_SpammyWords4 18374 7.89 13.44 5.19 54 TR_XM_DK_Bayes2 17965 3.55 0.41 5.08 55 TR_XM_DKIM_Undo 17417 13.28 30.48 4.92 56 BAYES_40 17369 4.11 2.46 4.91 57 XM_H_Long_From01 17314 5.04 5.35 4.89 58 XM_PDF 16855 3.49 0.86 4.76 59 BAYES_80 16722 5.70 7.69 4.73 60 RCVD_IN_IADB_SPF 16714 3.84 2.03 4.72 61 XMStrtUSub 16202 4.65 4.78 4.58 62 BOTNET_IPINHOSTNAME 15792 7.04 12.35 4.46 63 HTML_IMAGE_RATIO_04 15633 4.41 4.40 4.42 64 BAYES_999 15293 11.65 26.72 4.32 65 RCVD_IN_IADB_SENDERID 15116 3.46 1.78 4.27 66 ANY_BOUNCE_MESSAGE 14866 4.17 4.11 4.20 67 BOUNCE_MESSAGE 14866 4.17 4.11 4.20 68 RCVD_IN_VALIDITY_SAFE 14676 3.66 2.65 4.15 69 RCVD_IN_IADB_DK 14515 3.36 1.83 4.10 70 HTML_IMAGE_RATIO_06 14329 3.94 3.72 4.05 71 XM_B_SpammyWords3 13553 6.52 12.06 3.83 72 RCVD_IN_VALIDITY_CERTIFIED 13373 3.28 2.26 3.78 73 MIME_HTML_ONLY_MULTI 12843 4.80 7.20 3.63 74 XM_UncommonTLD01 12815 6.09 11.18 3.62 75 RELAYCOUNTRY_META 12512 9.94 23.13 3.54 76 TR_XM_PhishingBody 12475 5.55 9.72 3.53 77 T_REMOTE_IMAGE 12363 3.76 4.31 3.49 78 XM_B_Phish_Phrases 12266 4.76 7.41 3.47 79 BAYES_20 12150 2.63 0.97 3.43 80 XMNumbers 12086 3.33 3.16 3.42 81 XMSubMetaSx_00 12059 4.37 6.35 3.41 82 TR_XM_DK_SendGrid 11999 3.84 4.76 3.39 83 RCVD_IN_IADB_VOUCHED 11824 2.76 1.55 3.34 84 XM_H_Trusted_IP 11383 2.17 0.00 3.22 85 T_TooManySym_02 11359 2.37 0.65 3.21 86 BAYES_95 10530 3.49 4.53 2.98 87 FSL_BULK_SIG 10478 6.83 14.78 2.96 88 XM_B_SpammyTLD 10344 4.04 6.34 2.92 89 XMSexyCombo_05 9945 5.35 10.57 2.81 90 MAILING_LIST_MULTI 9794 2.50 1.96 2.77 91 HTML_IMAGE_RATIO_08 9301 2.52 2.30 2.63 92 XM_B_Crypto 9050 3.31 4.84 2.56 93 HTML_MIME_NO_HTML_TAG 9028 4.43 8.29 2.55 94 URI_NOVOWEL 8771 3.35 5.16 2.48 95 MIME_HTML_MOSTLY 8694 3.83 6.64 2.46 96 TR_XM_SB_Phish 8691 2.26 1.86 2.46 97 XMSubPhish11 8592 2.20 1.74 2.43 98 FROM_EXCESS_BASE64 8372 2.08 1.50 2.37 99 RCVD_IN_IADB_OPTIN 8031 1.84 0.95 2.27 100 TooManyTo_002 7988 1.74 0.68 2.26 101 HELO_NODOT 7972 1.99 1.44 2.25 102 HELO_NO_DOMAIN 7968 1.98 1.43 2.25 103 TM2_M_URI_OPT_OUT 7920 2.18 2.06 2.24 104 XM_B_Phish66 7862 3.86 7.24 2.22 105 BAYES_05 7845 1.64 0.46 2.22 106 XM_SPF_SoftFail 7783 2.85 4.18 2.20 107 DKIM_INVALID 7428 2.33 2.79 2.10 108 TVD_RCVD_IP 7211 1.48 0.33 2.04 109 TM2_M_A_HREF_HREF 6978 2.55 3.74 1.97 110 TR_DCC_Bayes_99 6828 8.54 22.15 1.93 111 T_XMHurry_00 6801 1.73 1.32 1.92 112 INVALID_MSGID 6725 1.32 0.13 1.90 113 XM_GoogleGroups 6561 3.03 5.46 1.85 114 IN_HORDE_ADDRESS_BOOK 6474 1.28 0.14 1.83 115 T_XMDrugObfuBody_14 6317 2.30 3.37 1.79 116 XM_B_Investor 6128 2.60 4.37 1.73 117 XM_CamelCaseFrm001 6051 1.89 2.25 1.71 118 TM2_M_VERY_LONG_WORD 5978 3.71 7.87 1.69 119 TO_MALFORMED 5846 1.12 0.02 1.65 120 TR_Symld_Words 5840 1.59 1.48 1.65 121 XM_DK_Undo_01 5813 1.98 2.67 1.64 122 KHOP_HELO_FCRDNS 5457 2.58 4.72 1.54 123 URI_HEX 5449 1.67 1.95 1.54 124 RCVD_IN_MSPIKE_H5 5390 1.25 0.68 1.52 125 TR_XM_SpammyRelay 5374 4.16 9.58 1.52 126 SUBJ_ALL_CAPS 5177 1.53 1.67 1.46 127 TooManyTo_003 5126 1.16 0.58 1.45 128 BOTNET 5018 4.81 11.79 1.42 129 XMDiploma_00 5018 1.97 3.10 1.42 130 XMGappySubj_01 4754 0.92 0.05 1.34 131 XM_B_Unsub2 4690 1.83 2.87 1.33 132 XM_H_Long_From02 4661 1.32 1.32 1.32 133 RCVD_IN_MSPIKE_BL 4654 2.56 5.11 1.32 134 TR_XM_MSPIKECOMBO 4646 2.54 5.07 1.31 135 XMBSHREFv2 4578 0.97 0.29 1.29 136 TR_XM_SpammyWords5 4398 1.81 2.98 1.24 137 XMSubNoVowel 4387 1.20 1.11 1.24 138 T_XMDrugObfuBody_08 4382 1.73 2.75 1.24 139 XMCapTrack 4124 0.95 0.51 1.17 140 UNTRUSTED_Relay 4027 5.08 13.19 1.14 141 XMLngstWrd_00 3902 2.66 5.86 1.10 142 TR_XM_SpammyWords2 3716 4.31 11.03 1.05 143 XM_OfRef6 3673 1.91 3.72 1.04 144 XMLngstWrd_01 3648 2.59 5.80 1.03 145 TooManyTo_004 3588 0.85 0.51 1.01 146 TVD_SPACE_RATIO 3541 0.83 0.48 1.00 147 HTML_FONT_FACE_BAD 3431 1.11 1.39 0.97 148 MY_SERVERS_FOUND 3381 0.78 0.41 0.96 149 XMLngstWrd_02 3295 2.43 5.51 0.93 150 HTTPS_HTTP_MISMATCH 3180 1.07 1.43 0.90 151 RELAYCOUNTRY_CA 3140 2.27 5.11 0.89 152 RCVD_IN_RP_SAFE 3127 0.75 0.47 0.88 153 DKIM_ADSP_CUSTOM_MED 3071 0.92 1.01 0.87 154 TR_MetaPhish_Combo_01 2989 0.90 1.02 0.84 155 XMBody_95 2956 0.61 0.16 0.84 156 XMLngstWrd_03 2917 2.25 5.17 0.82 157 RCVD_IN_RP_CERTIFIED 2864 0.68 0.40 0.81 158 T_TooManySym_03 2827 0.63 0.29 0.80 159 TooManyTo_005 2769 0.62 0.30 0.78 160 MIME_HEADER_CTYPE_ONLY 2742 0.57 0.16 0.78 161 XM_UB50 2740 2.64 6.48 0.77 162 T_FILL_THIS_FORM_SHORT 2724 1.15 1.93 0.77 163 SpammyFromTLD_01 2723 2.44 5.88 0.77 164 XMHTML_After_End 2712 1.15 1.95 0.77 165 XMGenDplmaNmb 2694 0.86 1.07 0.76 166 RELAYCOUNTRY_GB 2664 0.86 1.07 0.75 167 XMSexyCombo_01 2649 1.18 2.06 0.75 168 XMLngstWrd_04 2639 2.16 5.06 0.75 169 T_XMDrugObfuBody_00 2605 1.20 2.16 0.74 170 XMStockSpam_06 2579 1.01 1.59 0.73 171 MISSING_HEADERS 2528 0.96 1.48 0.71 172 HTML_TAG_BALANCE_BODY 2489 0.83 1.10 0.70 173 XMBdyGiftCard01 2415 0.81 1.08 0.68 174 XM_B_SpammyWords4 2410 1.10 1.97 0.68 175 XM_ShortIntro_01 2370 0.61 0.48 0.67 176 XMBrknScrpt_02 2369 0.90 1.38 0.67 177 XM_B_COVIDMETA 2341 1.08 1.95 0.66 178 FROM_GOV_DKIM_AU 2329 0.49 0.15 0.66 179 MSGID_NOFQDN1 2313 0.44 0.01 0.65 180 XMNoVowels 2283 0.52 0.25 0.65 181 XM_H_PHPMailer 2262 0.62 0.59 0.64 182 RCVD_IN_BL_SPAMCOP_NET 2254 3.49 9.35 0.64 183 RCVD_IN_MSPIKE_L4 2250 0.69 0.80 0.64 184 RCVD_IN_MSPIKE_L3 2239 1.30 2.67 0.63 185 MPART_ALT_DIFF_COUNT 2238 0.87 1.36 0.63 186 T_OBFU_PDF_ATTACH 2190 0.48 0.18 0.62 187 XMMoneyMeta_00 2076 0.72 1.00 0.59 188 UPPERCASE_75_100 2075 2.00 4.92 0.59 189 XM_B_COPY_HTML 1987 0.60 0.68 0.56 190 HTML_TITLE_SUBJ_DIFF 1980 2.00 4.98 0.56 191 SHORT_HELO_AND_INLINE_IMAGE 1976 0.40 0.07 0.56 192 TR_MSPIKEBAYES00 1958 0.38 0.01 0.55 193 TR_XM_SpammyWords3 1954 1.06 2.11 0.55 194 NML_ADSP_CUSTOM_MED 1925 0.63 0.80 0.54 195 XMBody_17 1922 1.03 2.02 0.54 196 RCVD_IN_SORBS_DUL 1878 0.40 0.12 0.53 197 HTML_IMAGE_ONLY_20 1871 0.44 0.26 0.53 198 URI_TRY_3LD 1821 0.73 1.16 0.51 199 FROM_GOV_SPOOF 1816 0.39 0.14 0.51 200 XMPhish30 1812 0.69 1.07 0.51 ----------------------------------------------------------------------