Email: 515675 Autolearn: 0 AvgScore: 3.31 AvgScanTime: 1.19 sec Spam: 175209 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.34 sec Ham: 340466 Autolearn: 0 AvgScore: -2.35 AvgScanTime: 1.12 sec Time Spent Running SA: 171.16 hours Time Spent Processing Spam: 65.43 hours Time Spent Processing Ham: 105.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164040 88.13 93.63 85.30 2 DKIM_SIGNED 151128 73.13 86.26 66.37 3 XM_DK_Pass 148269 71.79 84.62 65.19 4 DKIM_VALID 147239 70.83 84.04 64.04 5 RELAYCOUNTRY_US 141630 81.41 80.83 81.71 6 XM_B_Unicode 133319 66.46 76.09 61.50 7 DCC_CHECK 120192 40.80 68.60 26.49 8 XMListUnsubscribeExists 119612 51.52 68.27 42.91 9 XM_B_SpammyWords 111327 50.85 63.54 44.32 10 DKIM_VALID_AU 110027 54.57 62.80 50.33 11 BAYES_50 76879 48.26 43.88 50.51 12 RCVD_IN_MSPIKE_H2 75179 36.35 42.91 32.98 13 XM_DK_Undo_02 70366 17.53 40.16 5.89 14 XM_B_Unicode3 70105 37.29 40.01 35.89 15 XM_B_SpammyWords2 61686 22.21 35.21 15.52 16 FVGT_m_MULTI_ODD 60167 25.89 34.34 21.53 17 LOC_TINY_FONT_1 59500 23.86 33.96 18.66 18 MIME_HTML_ONLY 58771 24.19 33.54 19.38 19 DCC_CHECK_NEGATIVE 54958 59.16 31.37 73.46 20 BAYES_99 54660 13.63 31.20 4.59 21 TR_XM_DKIM_Undo 54093 13.27 30.87 4.21 22 DKIM_VALID_EF 51702 27.46 29.51 26.40 23 HTML_FONT_LOW_CONTRAST 51508 25.13 29.40 22.93 24 TR_XM_Base64_M1 51380 27.82 29.32 27.05 25 T_KAM_HTML_FONT_INVALID 50229 20.90 28.67 16.90 26 TR_XM_Base64_L1 43245 12.76 24.68 6.63 27 BAYES_999 42949 10.77 24.51 3.69 28 TR_DCC_Bayes_99 38225 8.23 21.82 1.24 29 T_TM2_M_HEADER_IN_MSG 37538 30.73 21.42 35.52 30 XM_Body_Dirty_Words 36652 14.63 20.92 11.40 31 RELAYCOUNTRY_META 36562 9.22 20.87 3.22 32 XMSubLong 34459 19.89 19.67 20.00 33 XM_Multi_Part_URI 29601 12.66 16.89 10.49 34 RCVD_IN_MSPIKE_WL 26793 15.24 15.29 15.22 35 XM_B_Unsub 26630 9.79 15.20 7.01 36 TR_XM_BayesUnsub 26025 8.49 14.85 5.21 37 LOTS_OF_MONEY 22631 11.80 12.92 11.23 38 BOTNET_IPINHOSTNAME 21948 7.10 12.53 4.30 39 RCVD_IN_MSPIKE_H3 21563 11.02 12.31 10.36 40 TR_XM_SpammyRelay 20332 4.88 11.60 1.42 41 RCVD_IN_BL_SPAMCOP_NET 19670 4.25 11.23 0.65 42 MPART_ALT_DIFF 19656 8.08 11.22 6.47 43 FSL_BULK_SIG 19600 5.57 11.19 2.68 44 XM_UncommonTLD01 19025 7.27 10.86 5.42 45 TR_XM_SpammyWords4 18809 9.30 10.74 8.57 46 XM_B_SpammyWords3 18739 5.83 10.70 3.33 47 TR_XM_SpammyWords2 18696 4.08 10.67 0.68 48 UNPARSEABLE_RELAY 18323 7.76 10.46 6.37 49 TR_XM_UnparsRelay 17967 6.68 10.25 4.83 50 BOTNET 17468 4.33 9.97 1.42 51 XM_Evil_Numbers_Gen 16046 8.29 9.16 7.84 52 UNTRUSTED_Relay 15982 3.87 9.12 1.16 53 TR_XM_Base64_C 14245 3.98 8.13 1.84 54 XMSexyCombo_05 14210 4.47 8.11 2.59 55 BAYES_80 13306 5.16 7.59 3.91 56 RELAYCOUNTRY_CA 12976 3.21 7.41 1.05 57 MIME_HTML_ONLY_MULTI 12906 5.74 7.37 4.90 58 BAYES_60 12866 8.02 7.34 8.37 59 TM2_M_VERY_LONG_WORD 12715 3.29 7.26 1.24 60 HTML_MIME_NO_HTML_TAG 12494 3.75 7.13 2.01 61 TR_XM_Base64_L2 12312 3.00 7.03 0.93 62 TR_XM_SPAMCOP 12182 2.52 6.95 0.23 63 TR_XM_Base64_M2 11562 4.97 6.60 4.13 64 LotsOfNums_01 11533 7.46 6.58 7.91 65 TR_XM_PhishingBody 10835 3.94 6.18 2.79 66 XM_SPF_SoftFail 10702 7.07 6.11 7.57 67 XM_H_Long_From01 10448 4.72 5.96 4.08 68 XM_SendGrid 10297 4.81 5.88 4.26 69 XM_B_Phish_Phrases 10062 3.74 5.74 2.72 70 HTML_IMAGE_RATIO_02 9847 5.40 5.62 5.29 71 SpammyFromTLD_01 9437 3.56 5.39 2.62 72 XM_GoogleGroups 9220 2.57 5.26 1.18 73 XMSubMetaSx_00 9082 3.72 5.18 2.96 74 XM_B_SpammyTLD 9056 2.92 5.17 1.77 75 XMLngstWrd_00 9013 2.00 5.14 0.38 76 XMLngstWrd_01 8933 1.95 5.10 0.33 77 XMLngstWrd_02 8755 1.86 5.00 0.25 78 XMLngstWrd_03 8630 1.80 4.93 0.18 79 XM_B_Investor 8570 2.52 4.89 1.30 80 XMLngstWrd_04 8512 1.74 4.86 0.13 81 HTML_TITLE_SUBJ_DIFF 8510 1.67 4.86 0.03 82 UPPERCASE_75_100 8376 1.65 4.78 0.04 83 BAYES_95 8323 3.19 4.75 2.38 84 XMStrtUSub 7726 4.32 4.41 4.28 85 HTML_IMAGE_RATIO_04 7638 4.74 4.36 4.93 86 TooManyTo_001 7580 6.87 4.33 8.18 87 MIME_HTML_MOSTLY 7477 2.70 4.27 1.90 88 XM_UB50 7202 1.90 4.11 0.77 89 HTML_IMAGE_RATIO_06 7054 7.51 4.03 9.31 90 XM_B_Phish66 6643 2.44 3.79 1.75 91 T_XMDrugObfuBody_14 6621 2.24 3.78 1.45 92 RCVD_IN_MSPIKE_BL 6551 1.94 3.74 1.02 93 T_REMOTE_IMAGE 6515 3.60 3.72 3.53 94 TR_XM_DK_SendGrid 6425 3.08 3.67 2.78 95 TR_XM_PHPDW 6268 2.69 3.58 2.24 96 TR_XM_MSPIKECOMBO 6250 1.88 3.57 1.02 97 TR_XM_SpammyWords5 6209 1.98 3.54 1.17 98 SpammyFromTLD_02 6205 1.36 3.54 0.24 99 URIBL_DBL_SPAM 6200 1.21 3.54 0.01 100 TR_XM_PHPForged 6188 2.65 3.53 2.19 101 XMNumbers 6180 3.60 3.53 3.64 102 XM_OfRef6 6148 1.83 3.51 0.96 103 TR_XM_FormFill2 6138 2.63 3.50 2.18 104 XM_H_PHPOS 6113 2.62 3.49 2.17 105 XM_CamelCaseFrm001 5666 2.14 3.23 1.57 106 URI_NOVOWEL 5595 2.38 3.19 1.96 107 T_XMDrugObfuBody_08 5582 1.84 3.19 1.15 108 ALL_TRUSTED 5338 11.56 3.05 15.94 109 XMDiploma_00 5132 1.98 2.93 1.49 110 RCVD_IN_VALIDITY_SAFE 5059 3.79 2.89 4.26 111 MIME_QP_LONG_LINE 5058 4.17 2.89 4.84 112 XM_B_Unsub2 5003 1.65 2.86 1.03 113 XM_DIRTYINTL 4965 1.17 2.83 0.31 114 RCVD_IN_MSPIKE_H4 4910 3.78 2.80 4.28 115 XMBody_17 4742 1.30 2.71 0.58 116 USER_IN_DEF_DKIM_WL 4618 8.10 2.64 10.92 117 BOTNET_NORDNS 4561 0.90 2.60 0.02 118 RCVD_IN_VALIDITY_RPBL 4511 0.89 2.57 0.02 119 TM2_M_URI_OPT_OUT 4498 2.37 2.57 2.26 120 HTML_IMAGE_RATIO_08 4432 2.57 2.53 2.59 121 T_FILL_THIS_FORM_SHORT 4426 1.40 2.53 0.83 122 URI_PHP_REDIR 4312 0.84 2.46 0.00 123 KHOP_HELO_FCRDNS 4242 3.48 2.42 4.02 124 RCVD_IN_IADB_LISTED 4109 3.79 2.35 4.53 125 T_TooManySym_01 4076 4.57 2.33 5.73 126 RCVD_IN_VALIDITY_CERTIFIED 4015 3.28 2.29 3.79 127 TR_LOTS_OF_MONEY3 3916 0.97 2.24 0.32 128 DKIM_INVALID 3889 2.29 2.22 2.33 129 PDS_OTHER_BAD_TLD 3871 0.82 2.21 0.10 130 SUBJ_ALL_CAPS 3771 1.81 2.15 1.64 131 RELAYCOUNTRY_FR 3644 0.85 2.08 0.22 132 XMBrknScrpt_02 3623 1.06 2.07 0.55 133 T_XMHurry_00 3567 0.95 2.04 0.39 134 TR_XM_MSPIKECOMBO2 3464 0.76 1.98 0.14 135 RCVD_IN_IADB_SPF 3382 3.34 1.93 4.07 136 XM_UB99 3316 0.65 1.89 0.00 137 XM_B_SpammyWords4 3273 0.96 1.87 0.50 138 FROM_EXCESS_BASE64 3265 2.02 1.86 2.11 139 XM_DK_Undo_01 3259 1.55 1.86 1.40 140 TR_XM_SpammyWords3 3240 0.95 1.85 0.48 141 XM_B_COVIDMETA 3230 1.07 1.84 0.67 142 URI_HEX 3185 1.31 1.82 1.05 143 BOUNCE_MESSAGE 3123 2.47 1.78 2.83 144 ANY_BOUNCE_MESSAGE 3123 2.47 1.78 2.83 145 RCVD_IN_PSBL 3112 0.68 1.78 0.11 146 RCVD_IN_IADB_DK 3082 2.92 1.76 3.52 147 RCVD_IN_MSPIKE_L3 3063 1.00 1.75 0.62 148 RCVD_IN_IADB_SENDERID 3029 3.00 1.73 3.66 149 XMHTML_After_End 3005 0.97 1.72 0.58 150 TR_XM_SB_Phish 2992 2.01 1.71 2.16 151 BAYES_40 2986 4.23 1.70 5.53 152 HTTPS_HTTP_MISMATCH 2957 1.03 1.69 0.68 153 BAYES_20 2820 3.67 1.61 4.73 154 XMSubPhish11 2756 1.94 1.57 2.13 155 XMClaimOffer 2745 0.59 1.57 0.09 156 MAILING_LIST_MULTI 2686 2.18 1.53 2.51 157 HTML_TAG_BALANCE_BODY 2612 0.86 1.49 0.53 158 HK_RANDOM_REPLYTO 2604 0.57 1.49 0.09 159 TR_XM_NoHeaderRelay 2569 0.56 1.47 0.10 160 RCVD_IN_IADB_VOUCHED 2487 2.29 1.42 2.73 161 TR_XM_Base64_L3 2475 0.53 1.41 0.07 162 XMGenDplmaNmb 2426 1.05 1.38 0.88 163 XM_B_DynamicLink 2417 0.49 1.38 0.03 164 XMStockSpam_06 2386 1.16 1.36 1.06 165 XM_UB999 2374 0.46 1.35 0.00 166 T_XMDrugObfuBody_00 2368 0.77 1.35 0.47 167 DKIM_ADSP_NXDOMAIN 2326 0.64 1.33 0.28 168 MPART_ALT_DIFF_COUNT 2283 0.77 1.30 0.49 169 XM_H_Undi_Recip 2226 0.59 1.27 0.25 170 XM_URI_RBL 2213 0.50 1.26 0.10 171 XMBdyGiftCard01 2180 0.80 1.24 0.56 172 RELAYCOUNTRY_RU 2148 0.44 1.23 0.03 173 XM_H_Long_From02 2145 1.01 1.22 0.90 174 BAYES_05 2123 2.41 1.21 3.03 175 XMSexyCombo_01 2119 0.72 1.21 0.47 176 TM2_M_A_HREF_HREF 2067 0.62 1.18 0.33 177 TR_XM_MaxSPIKE 2066 0.45 1.18 0.07 178 TR_XM_FormFill 2059 0.41 1.18 0.01 179 URIBL_BLACK 2033 0.42 1.16 0.04 180 XMSubNoVowel 2024 1.16 1.16 1.16 181 RELAYCOUNTRY_IN 1977 0.43 1.13 0.07 182 HTML_TAG_BALANCE_CENTER 1975 0.45 1.13 0.10 183 URI_TRY_3LD 1971 0.65 1.12 0.41 184 HTML_OBFUSCATE_05_10 1918 0.47 1.09 0.15 185 FONT_INVIS_LONG_LINE 1917 0.44 1.09 0.11 186 REMOVE_BEFORE_LINK 1892 0.55 1.08 0.28 187 TR_XM_BayesRelay 1884 0.37 1.08 0.00 188 XMBounce_01 1882 0.38 1.07 0.02 189 TR_XM_COVIDMETA1 1850 0.50 1.06 0.21 190 TR_XM_Base64_M3 1849 0.64 1.06 0.42 191 HTML_SHORT_LINK_IMG_3 1834 0.41 1.05 0.08 192 BODY_URI_ONLY 1822 0.36 1.04 0.01 193 RCVD_IN_MSPIKE_L5 1815 0.36 1.04 0.01 194 RELAYCOUNTRY_AU 1809 0.49 1.03 0.21 195 MIXED_CENTER_CASE 1800 0.35 1.03 0.00 196 T_TVD_MIME_NO_HEADERS 1793 0.36 1.02 0.01 197 HTML_FONT_SIZE_LARGE 1768 0.41 1.01 0.11 198 MIXED_HREF_CASE 1761 0.34 1.01 0.00 199 XM_PDF 1755 3.78 1.00 5.20 200 XM_UB60 1751 0.39 1.00 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 290414 88.13 93.63 85.30 2 RELAYCOUNTRY_US 278182 81.41 80.83 81.71 3 DCC_CHECK_NEGATIVE 250101 59.16 31.37 73.46 4 DKIM_SIGNED 225961 73.13 86.26 66.37 5 XM_DK_Pass 221938 71.79 84.62 65.19 6 DKIM_VALID 218022 70.83 84.04 64.04 7 XM_B_Unicode 209401 66.46 76.09 61.50 8 BAYES_50 171963 48.26 43.88 50.51 9 DKIM_VALID_AU 171373 54.57 62.80 50.33 10 XM_B_SpammyWords 150884 50.85 63.54 44.32 11 XMListUnsubscribeExists 146078 51.52 68.27 42.91 12 XM_B_Unicode3 122184 37.29 40.01 35.89 13 T_TM2_M_HEADER_IN_MSG 120934 30.73 21.42 35.52 14 RCVD_IN_MSPIKE_H2 112290 36.35 42.91 32.98 15 TR_XM_Base64_M1 92080 27.82 29.32 27.05 16 DCC_CHECK 90191 40.80 68.60 26.49 17 DKIM_VALID_EF 89889 27.46 29.51 26.40 18 HTML_FONT_LOW_CONTRAST 78079 25.13 29.40 22.93 19 FVGT_m_MULTI_ODD 73319 25.89 34.34 21.53 20 XMSubLong 68110 19.89 19.67 20.00 21 MIME_HTML_ONLY 65970 24.19 33.54 19.38 22 LOC_TINY_FONT_1 63540 23.86 33.96 18.66 23 BAYES_00 57688 11.43 0.71 16.94 24 T_KAM_HTML_FONT_INVALID 57526 20.90 28.67 16.90 25 ALL_TRUSTED 54277 11.56 3.05 15.94 26 XM_B_SpammyWords2 52843 22.21 35.21 15.52 27 RCVD_IN_MSPIKE_WL 51815 15.24 15.29 15.22 28 IN_ZIMBRA_NJ_WHITELIST 39336 7.67 0.13 11.55 29 XM_Body_Dirty_Words 38797 14.63 20.92 11.40 30 LOTS_OF_MONEY 38241 11.80 12.92 11.23 31 USER_IN_DEF_DKIM_WL 37173 8.10 2.64 10.92 32 XM_Multi_Part_URI 35703 12.66 16.89 10.49 33 RCVD_IN_MSPIKE_H3 35273 11.02 12.31 10.36 34 HTML_IMAGE_RATIO_06 31686 7.51 4.03 9.31 35 TR_XM_SpammyWords4 29170 9.30 10.74 8.57 36 HTML_FONT_FACE_BAD 28723 5.86 0.84 8.44 37 BAYES_60 28507 8.02 7.34 8.37 38 TooManyTo_001 27850 6.87 4.33 8.18 39 LotsOfNums_01 26939 7.46 6.58 7.91 40 XM_DKIMWhitelistDomains 26891 5.26 0.13 7.90 41 XM_Evil_Numbers_Gen 26678 8.29 9.16 7.84 42 XM_SPF_SoftFail 25779 7.07 6.11 7.57 43 XM_B_Unsub 23866 9.79 15.20 7.01 44 TR_XM_DK_Bayes 23513 4.74 0.52 6.91 45 TR_XM_DK_Bayes1 22665 4.57 0.51 6.66 46 TR_XM_Base64_L1 22565 12.76 24.68 6.63 47 MPART_ALT_DIFF 22017 8.08 11.22 6.47 48 UNPARSEABLE_RELAY 21700 7.76 10.46 6.37 49 XM_H_Trusted_IP 20610 4.00 0.00 6.05 50 XM_DK_Undo_02 20053 17.53 40.16 5.89 51 TR_XM_DK_Bayes2 19826 3.99 0.41 5.82 52 T_TooManySym_01 19512 4.57 2.33 5.73 53 BAYES_40 18833 4.23 1.70 5.53 54 XM_UncommonTLD01 18461 7.27 10.86 5.42 55 HTML_IMAGE_RATIO_02 18011 5.40 5.62 5.29 56 TR_XM_BayesUnsub 17734 8.49 14.85 5.21 57 XM_PDF 17720 3.78 1.00 5.20 58 HTML_IMAGE_RATIO_04 16791 4.74 4.36 4.93 59 MIME_HTML_ONLY_MULTI 16671 5.74 7.37 4.90 60 MIME_QP_LONG_LINE 16465 4.17 2.89 4.84 61 TR_XM_UnparsRelay 16459 6.68 10.25 4.83 62 BAYES_20 16092 3.67 1.61 4.73 63 BAYES_99 15635 13.63 31.20 4.59 64 RCVD_IN_IADB_LISTED 15421 3.79 2.35 4.53 65 BOTNET_IPINHOSTNAME 14648 7.10 12.53 4.30 66 RCVD_IN_MSPIKE_H4 14578 3.78 2.80 4.28 67 XMStrtUSub 14555 4.32 4.41 4.28 68 XM_SendGrid 14496 4.81 5.88 4.26 69 RCVD_IN_VALIDITY_SAFE 14489 3.79 2.89 4.26 70 TR_XM_DKIM_Undo 14342 13.27 30.87 4.21 71 TR_XM_Base64_M2 14058 4.97 6.60 4.13 72 XM_H_Long_From01 13901 4.72 5.96 4.08 73 RCVD_IN_IADB_SPF 13867 3.34 1.93 4.07 74 KHOP_HELO_FCRDNS 13685 3.48 2.42 4.02 75 BAYES_80 13298 5.16 7.59 3.91 76 RCVD_IN_VALIDITY_CERTIFIED 12905 3.28 2.29 3.79 77 BAYES_999 12578 10.77 24.51 3.69 78 RCVD_IN_IADB_SENDERID 12445 3.00 1.73 3.66 79 XMNumbers 12384 3.60 3.53 3.64 80 T_REMOTE_IMAGE 12033 3.60 3.72 3.53 81 RCVD_IN_IADB_DK 11988 2.92 1.76 3.52 82 XM_B_SpammyWords3 11329 5.83 10.70 3.33 83 T_TooManySym_02 11015 2.36 0.65 3.24 84 RELAYCOUNTRY_META 10970 9.22 20.87 3.22 85 BAYES_05 10328 2.41 1.21 3.03 86 XMSubMetaSx_00 10086 3.72 5.18 2.96 87 ANY_BOUNCE_MESSAGE 9637 2.47 1.78 2.83 88 BOUNCE_MESSAGE 9637 2.47 1.78 2.83 89 TR_XM_PhishingBody 9508 3.94 6.18 2.79 90 TR_XM_DK_SendGrid 9469 3.08 3.67 2.78 91 RCVD_IN_IADB_VOUCHED 9309 2.29 1.42 2.73 92 XM_B_Phish_Phrases 9249 3.74 5.74 2.72 93 FSL_BULK_SIG 9124 5.57 11.19 2.68 94 SpammyFromTLD_01 8933 3.56 5.39 2.62 95 HTML_IMAGE_RATIO_08 8832 2.57 2.53 2.59 96 XMSexyCombo_05 8825 4.47 8.11 2.59 97 MAILING_LIST_MULTI 8554 2.18 1.53 2.51 98 TooManyTo_002 8238 1.80 0.60 2.42 99 BAYES_95 8120 3.19 4.75 2.38 100 DKIM_INVALID 7939 2.29 2.22 2.33 101 TM2_M_URI_OPT_OUT 7699 2.37 2.57 2.26 102 TR_XM_PHPDW 7621 2.69 3.58 2.24 103 TR_XM_PHPForged 7465 2.65 3.53 2.19 104 TR_XM_FormFill2 7439 2.63 3.50 2.18 105 XM_H_PHPOS 7389 2.62 3.49 2.17 106 TR_XM_SB_Phish 7370 2.01 1.71 2.16 107 XMSubPhish11 7252 1.94 1.57 2.13 108 FROM_EXCESS_BASE64 7177 2.02 1.86 2.11 109 HELO_NODOT 6973 1.58 0.67 2.05 110 TVD_RCVD_IP 6926 1.42 0.23 2.03 111 HTML_MIME_NO_HTML_TAG 6860 3.75 7.13 2.01 112 HELO_NO_DOMAIN 6857 1.55 0.65 2.01 113 INVALID_MSGID 6702 1.36 0.17 1.97 114 URI_NOVOWEL 6675 2.38 3.19 1.96 115 MIME_HTML_MOSTLY 6465 2.70 4.27 1.90 116 RCVD_IN_IADB_OPTIN 6338 1.52 0.87 1.86 117 TR_XM_Base64_C 6256 3.98 8.13 1.84 118 XM_B_SpammyTLD 6014 2.92 5.17 1.77 119 XM_B_Phish66 5962 2.44 3.79 1.75 120 TO_MALFORMED 5946 1.16 0.02 1.75 121 IN_HORDE_ADDRESS_BOOK 5806 1.17 0.13 1.71 122 TooManyTo_003 5574 1.25 0.50 1.64 123 SUBJ_ALL_CAPS 5570 1.81 2.15 1.64 124 XM_CamelCaseFrm001 5355 2.14 3.23 1.57 125 TR_Symld_Words 5302 1.36 0.98 1.56 126 XMDiploma_00 5084 1.98 2.93 1.49 127 T_XMDrugObfuBody_14 4933 2.24 3.78 1.45 128 TR_XM_SpammyRelay 4850 4.88 11.60 1.42 129 BOTNET 4844 4.33 9.97 1.42 130 XM_DK_Undo_01 4753 1.55 1.86 1.40 131 XM_B_Investor 4413 2.52 4.89 1.30 132 XMCapTrack 4315 0.95 0.33 1.27 133 XMBSHREFv2 4243 0.91 0.25 1.25 134 TM2_M_VERY_LONG_WORD 4237 3.29 7.26 1.24 135 TR_DCC_Bayes_99 4220 8.23 21.82 1.24 136 TooManyTo_004 4161 0.94 0.39 1.22 137 FILL_THIS_FORM 4072 1.00 0.60 1.20 138 XM_GoogleGroups 4018 2.57 5.26 1.18 139 TR_XM_SpammyWords5 3995 1.98 3.54 1.17 140 UNTRUSTED_Relay 3964 3.87 9.12 1.16 141 XMSubNoVowel 3939 1.16 1.16 1.16 142 T_XMDrugObfuBody_08 3911 1.84 3.19 1.15 143 XMGappySubj_01 3900 0.79 0.10 1.15 144 TVD_SPACE_RATIO 3855 1.06 0.92 1.13 145 XMStockSpam_06 3614 1.16 1.36 1.06 146 URI_HEX 3586 1.31 1.82 1.05 147 RELAYCOUNTRY_CA 3577 3.21 7.41 1.05 148 TooManyTo_005 3553 0.81 0.35 1.04 149 XM_B_Unsub2 3513 1.65 2.86 1.03 150 RCVD_IN_MSPIKE_BL 3467 1.94 3.74 1.02 151 TR_XM_MSPIKECOMBO 3466 1.88 3.57 1.02 152 XM_OfRef6 3268 1.83 3.51 0.96 153 TR_XM_Base64_L2 3178 3.00 7.03 0.93 154 TR_MetaPhish_Combo_01 3143 0.90 0.85 0.92 155 XM_E_Blogspot 3142 0.68 0.22 0.92 156 DKIM_ADSP_CUSTOM_MED 3092 0.93 0.99 0.91 157 XM_H_Long_From02 3062 1.01 1.22 0.90 158 XMGenDplmaNmb 2985 1.05 1.38 0.88 159 RCVD_IN_RP_SAFE 2831 0.75 0.59 0.83 160 T_FILL_THIS_FORM_SHORT 2814 1.40 2.53 0.83 161 XM_ShortIntro_01 2691 0.64 0.34 0.79 162 T_TooManySym_03 2681 0.62 0.30 0.79 163 XMBody_95 2658 0.55 0.11 0.78 164 XM_UB50 2606 1.90 4.11 0.77 165 RCVD_IN_RP_CERTIFIED 2512 0.65 0.48 0.74 166 MSGID_NOFQDN1 2349 0.46 0.01 0.69 167 HTTPS_HTTP_MISMATCH 2331 1.03 1.69 0.68 168 TR_XM_SpammyWords2 2321 4.08 10.67 0.68 169 XM_B_COVIDMETA 2291 1.07 1.84 0.67 170 RCVD_IN_BL_SPAMCOP_NET 2225 4.25 11.23 0.65 171 HTML_IMAGE_ONLY_20 2187 0.71 0.86 0.64 172 RCVD_IN_MSPIKE_L3 2099 1.00 1.75 0.62 173 T_OBFU_PDF_ATTACH 2022 0.50 0.32 0.59 174 NML_ADSP_CUSTOM_MED 2002 0.65 0.78 0.59 175 XMHTML_After_End 1978 0.97 1.72 0.58 176 XMBody_17 1975 1.30 2.71 0.58 177 SHORT_HELO_AND_INLINE_IMAGE 1965 0.41 0.09 0.58 178 RCVD_IN_MSPIKE_H5 1964 0.44 0.18 0.58 179 XM_H_PHPMailer 1936 0.66 0.84 0.57 180 XMBdyGiftCard01 1920 0.80 1.24 0.56 181 XM_B_COPY_HTML 1902 0.62 0.73 0.56 182 XMBrknScrpt_02 1864 1.06 2.07 0.55 183 RELAYCOUNTRY_GB 1853 0.57 0.61 0.54 184 RCVD_IN_SORBS_DUL 1841 0.41 0.15 0.54 185 HTML_TAG_BALANCE_BODY 1810 0.86 1.49 0.53 186 XMNoVowels 1739 0.46 0.35 0.51 187 XM_B_SpammyWords4 1694 0.96 1.87 0.50 188 MPART_ALT_DIFF_COUNT 1668 0.77 1.30 0.49 189 TR_XM_SpammyWords3 1643 0.95 1.85 0.48 190 XMSubMetaI_00 1622 0.62 0.89 0.48 191 FORGED_GMAIL_RCVD 1598 0.60 0.86 0.47 192 XMSexyCombo_01 1587 0.72 1.21 0.47 193 USER_IN_WHITELIST 1586 0.31 0.00 0.47 194 USER_IN_WELCOMELIST 1586 0.31 0.00 0.47 195 T_XMDrugObfuBody_00 1585 0.77 1.35 0.47 196 XMMoneyMeta_00 1554 0.53 0.67 0.46 197 XMPhish30 1535 0.62 0.95 0.45 198 MSGID_FROM_MTA_HEADER 1525 0.36 0.18 0.45 199 HTML_IMAGE_ONLY_28 1520 0.39 0.29 0.45 200 HTML_IMAGE_ONLY_32 1519 0.34 0.13 0.45 ----------------------------------------------------------------------