Email: 536758 Autolearn: 0 AvgScore: 3.19 AvgScanTime: 1.34 sec Spam: 173695 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 1.43 sec Ham: 363063 Autolearn: 0 AvgScore: -1.93 AvgScanTime: 1.29 sec Time Spent Running SA: 199.65 hours Time Spent Processing Spam: 69.09 hours Time Spent Processing Ham: 130.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165720 89.99 95.41 87.39 2 DKIM_SIGNED 147253 74.79 84.78 70.01 3 XM_B_Unicode 144744 72.98 83.33 68.03 4 XM_DK_Pass 140895 72.83 81.12 68.87 5 DKIM_VALID 140212 71.96 80.72 67.77 6 RELAYCOUNTRY_US 137058 80.76 78.91 81.65 7 DCC_CHECK 115780 42.08 66.66 30.32 8 XM_B_SpammyWords 114712 52.44 66.04 45.93 9 XMListUnsubscribeExists 113904 52.29 65.58 45.93 10 DKIM_VALID_AU 105192 55.21 60.56 52.65 11 RCVD_IN_MSPIKE_H2 84056 40.32 48.39 36.46 12 XM_B_Unicode3 73980 40.81 42.59 39.96 13 BAYES_50 73024 49.95 42.04 53.74 14 XM_DK_Undo_02 72291 17.72 41.62 6.28 15 XM_B_SpammyWords2 63875 23.71 36.77 17.45 16 LOC_TINY_FONT_1 59581 25.95 34.30 21.95 17 DCC_CHECK_NEGATIVE 57875 57.87 33.32 69.62 18 HTML_FONT_LOW_CONTRAST 57782 27.67 33.27 24.99 19 MIME_HTML_ONLY 57424 23.20 33.06 18.48 20 BAYES_99 56443 14.56 32.50 5.98 21 DKIM_VALID_EF 55349 28.26 31.87 26.53 22 TR_XM_DKIM_Undo 55256 13.60 31.81 4.89 23 FVGT_m_MULTI_ODD 54201 26.00 31.20 23.51 24 T_KAM_HTML_FONT_INVALID 50098 22.00 28.84 18.73 25 BAYES_999 44503 11.65 25.62 4.97 26 XMSubLong 41094 22.62 23.66 22.13 27 TR_DCC_Bayes_99 37946 8.34 21.85 1.87 28 T_TM2_M_HEADER_IN_MSG 36180 29.07 20.83 33.01 29 XM_Body_Dirty_Words 34167 13.65 19.67 10.78 30 RELAYCOUNTRY_META 31399 8.23 18.08 3.51 31 XM_Multi_Part_URI 30269 13.53 17.43 11.67 32 XM_B_Unsub 27310 10.84 15.72 8.51 33 TR_XM_BayesUnsub 26701 9.53 15.37 6.73 34 LOTS_OF_MONEY 26698 12.32 15.37 10.86 35 BOTNET_IPINHOSTNAME 23317 7.47 13.42 4.63 36 TR_XM_SpammyWords4 22089 9.66 12.72 8.19 37 UNPARSEABLE_RELAY 20680 8.55 11.91 6.95 38 XM_B_SpammyWords3 20364 6.16 11.72 3.50 39 TR_XM_UnparsRelay 20273 7.45 11.67 5.44 40 TR_XM_SpammyRelay 19712 4.76 11.35 1.60 41 FSL_BULK_SIG 19690 5.95 11.34 3.38 42 BOTNET 19645 4.59 11.31 1.38 43 RCVD_IN_MSPIKE_WL 18981 15.08 10.93 17.06 44 TR_XM_SpammyWords2 18260 4.08 10.51 1.00 45 RCVD_IN_BL_SPAMCOP_NET 17843 3.72 10.27 0.58 46 BAYES_80 15223 5.61 8.76 4.10 47 XM_Evil_Numbers_Gen 14443 8.44 8.32 8.51 48 RCVD_IN_MSPIKE_H3 14181 10.29 8.16 11.30 49 UNTRUSTED_Relay 13817 3.46 7.95 1.30 50 XMSexyCombo_05 13716 4.70 7.90 3.17 51 LotsOfNums_01 13308 8.50 7.66 8.90 52 BAYES_60 13208 8.44 7.60 8.83 53 XMNumbers 13094 4.79 7.54 3.47 54 RELAYCOUNTRY_CA 13030 3.16 7.50 1.08 55 HTML_MIME_NO_HTML_TAG 12816 3.99 7.38 2.37 56 TR_XM_SPAMCOP 12756 2.60 7.34 0.34 57 XM_UncommonTLD01 12342 4.74 7.11 3.61 58 TR_XM_PhishingBody 10890 4.11 6.27 3.07 59 HTML_IMAGE_RATIO_02 10545 5.99 6.07 5.95 60 XMSubMetaSx_00 10167 4.05 5.85 3.18 61 XM_SendGrid 9993 4.48 5.75 3.88 62 RCVD_IN_MSPIKE_BL 9927 2.75 5.72 1.33 63 TR_XM_MSPIKECOMBO 9747 2.70 5.61 1.31 64 MPART_ALT_DIFF 9676 5.16 5.57 4.97 65 XM_B_Investor 9476 2.83 5.46 1.57 66 XM_H_Long_From01 9312 5.05 5.36 4.90 67 XM_B_Phish_Phrases 9205 3.90 5.30 3.24 68 ALL_TRUSTED 9082 12.23 5.23 15.58 69 BAYES_95 8972 3.44 5.17 2.62 70 XMStrtUSub 8237 4.75 4.74 4.76 71 XM_SPF_SoftFail 8162 5.71 4.70 6.19 72 XM_BadFromFormat 8039 1.78 4.63 0.42 73 XM_OfRef6 7964 2.08 4.59 0.88 74 XM_B_SpammyTLD 7683 2.96 4.42 2.26 75 TO_NO_BRKTS_FROM_MSSP 7332 1.58 4.22 0.31 76 TooManyTo_001 7314 6.92 4.21 8.21 77 XMDiploma_00 7305 2.47 4.21 1.64 78 HTML_IMAGE_RATIO_04 7257 4.59 4.18 4.78 79 HTML_SHORT_LINK_IMG_1 7092 1.55 4.08 0.34 80 DKIM_INVALID 7041 2.83 4.05 2.24 81 HTML_IMAGE_ONLY_04 6998 1.55 4.03 0.37 82 MIME_QP_LONG_LINE 6707 4.94 3.86 5.46 83 T_XMDrugObfuBody_14 6633 2.24 3.82 1.49 84 XM_B_Phish66 6482 2.30 3.73 1.62 85 TR_XM_DK_SendGrid 6363 2.87 3.66 2.49 86 TR_XM_SpammyWords5 6241 2.11 3.59 1.40 87 TM2_M_VERY_LONG_WORD 6086 2.06 3.50 1.37 88 TR_XM_SpammyWords3 5827 1.52 3.35 0.65 89 MIME_HTML_ONLY_MULTI 5760 3.31 3.32 3.31 90 XM_UB50 5595 1.62 3.22 0.86 91 MIME_HTML_MOSTLY 5472 2.68 3.15 2.45 92 HTML_IMAGE_RATIO_06 5404 5.76 3.11 7.03 93 T_XMDrugObfuBody_08 5296 2.06 3.05 1.58 94 PDS_OTHER_BAD_TLD 5192 1.06 2.99 0.14 95 RCVD_IN_IADB_LISTED 5116 4.57 2.95 5.34 96 TR_LOTS_OF_MONEY3 4971 1.18 2.86 0.37 97 RCVD_IN_VALIDITY_SAFE 4870 3.88 2.80 4.40 98 SpammyFromTLD_02 4720 1.32 2.72 0.66 99 RCVD_IN_MSPIKE_L5 4690 0.91 2.70 0.05 100 HTML_IMAGE_RATIO_08 4682 3.02 2.70 3.17 101 XMBody_17 4650 1.16 2.68 0.43 102 SpammyFromTLD_01 4612 1.40 2.66 0.81 103 TM2_M_URI_OPT_OUT 4463 2.36 2.57 2.26 104 XM_DIRTYINTL 4452 1.08 2.56 0.37 105 KHOP_HELO_FCRDNS 4396 3.35 2.53 3.75 106 XM_B_Unsub2 4387 1.92 2.53 1.63 107 RCVD_IN_MSPIKE_H4 4376 4.05 2.52 4.78 108 RCVD_IN_IADB_SPF 4246 3.99 2.44 4.73 109 URIBL_DBL_SPAM 4151 0.78 2.39 0.01 110 URI_NOVOWEL 4110 2.37 2.37 2.37 111 RCVD_IN_VALIDITY_CERTIFIED 4005 3.33 2.31 3.82 112 TR_Mismatch_TLD_01 3903 0.96 2.25 0.35 113 RCVD_IN_IADB_DK 3891 3.50 2.24 4.10 114 T_REMOTE_IMAGE 3881 3.35 2.23 3.88 115 TR_XM_MSPIKECOMBO2 3865 0.79 2.23 0.10 116 RCVD_IN_IADB_SENDERID 3864 3.58 2.22 4.23 117 USER_IN_DEF_DKIM_WL 3835 8.60 2.21 11.66 118 T_TooManySym_01 3800 4.73 2.19 5.94 119 XM_CamelCaseFrm001 3787 1.90 2.18 1.76 120 SUBJ_ALL_CAPS 3765 1.83 2.17 1.67 121 XM_B_SpammyWords4 3643 0.98 2.10 0.45 122 XMStockSpam_06 3616 1.45 2.08 1.14 123 XM_UB99 3563 0.67 2.05 0.00 124 RCVD_IN_MSPIKE_L3 3526 1.23 2.03 0.84 125 T_FILL_THIS_FORM_SHORT 3525 1.21 2.03 0.82 126 XM_DK_Undo_01 3515 1.82 2.02 1.73 127 URI_HEX 3495 1.58 2.01 1.37 128 RCVD_IN_VALIDITY_RPBL 3482 0.68 2.00 0.05 129 HK_RANDOM_REPLYTO 3404 0.71 1.96 0.11 130 XMSexyCombo_01 3369 0.93 1.94 0.44 131 TR_XM_SB_Phish 3336 2.01 1.92 2.06 132 RCVD_IN_PSBL 3290 0.72 1.89 0.16 133 HTTPS_HTTP_MISMATCH 3202 1.19 1.84 0.87 134 MAILING_LIST_MULTI 3173 2.47 1.83 2.78 135 XMSubPhish11 3171 1.96 1.83 2.03 136 T_XMDrugObfuBody_00 3146 1.10 1.81 0.77 137 FROM_EXCESS_BASE64 3094 2.14 1.78 2.31 138 URI_PHP_REDIR 3088 0.58 1.78 0.00 139 BOTNET_NORDNS 3054 0.57 1.76 0.01 140 RCVD_IN_IADB_VOUCHED 3008 2.85 1.73 3.38 141 XMHTML_After_End 2956 1.02 1.70 0.70 142 XM_UB999 2940 0.55 1.69 0.00 143 XMGenDplmaNmb 2879 1.14 1.66 0.90 144 XMSubNoVowel 2845 1.72 1.64 1.75 145 T_XMHurry_00 2829 0.83 1.63 0.45 146 XM_H_Undi_Recip 2751 0.67 1.58 0.24 147 XMBrknScrpt_02 2717 0.94 1.56 0.64 148 TR_XM_NoHeaderRelay 2631 0.57 1.51 0.11 149 DIET_1 2606 0.65 1.50 0.24 150 XM_URI_RBL 2587 0.56 1.49 0.11 151 TR_XM_COVIDMETA4 2533 0.76 1.46 0.43 152 XM_H_Long_From02 2494 1.35 1.44 1.32 153 URI_TRY_3LD 2479 0.81 1.43 0.51 154 FROM_SUSPICIOUS_NTLD 2461 0.47 1.42 0.02 155 BAYES_40 2432 3.52 1.40 4.53 156 XM_GoogleGroups 2416 1.60 1.39 1.70 157 XMMoneyMeta_00 2414 0.83 1.39 0.56 158 TM2_M_A_HREF_HREF 2404 0.70 1.38 0.37 159 TR_XM_PHPDW 2320 0.65 1.34 0.32 160 XMLngstWrd_00 2310 1.09 1.33 0.97 161 MONEY_NOHTML 2306 0.48 1.33 0.08 162 FROM_SUSPICIOUS_NTLD_FP 2297 0.44 1.32 0.02 163 HTML_TAG_BALANCE_BODY 2295 0.89 1.32 0.68 164 TR_XM_PHPForged 2287 0.61 1.32 0.27 165 TR_Symld_Words 2266 1.45 1.30 1.52 166 XM_B_COVIDMETA 2256 0.79 1.30 0.54 167 TR_XM_FormFill2 2247 0.61 1.29 0.28 168 XMLngstWrd_01 2246 1.01 1.29 0.88 169 XM_H_PHPOS 2233 0.59 1.29 0.26 170 URIBL_BLACK 2228 0.45 1.28 0.05 171 TR_XM_COVIDMETA1 2211 0.52 1.27 0.16 172 TR_XM_MaxSPIKE 2207 0.45 1.27 0.06 173 TR_LOTS_OF_MONEY2 2173 0.57 1.25 0.24 174 T_MONEY_PERCENT 2173 0.57 1.25 0.24 175 TR_XM_Undi_Recip5 2100 0.39 1.21 0.00 176 XMLngstWrd_02 2063 0.86 1.19 0.71 177 TR_XM_FormFill 2006 0.38 1.15 0.01 178 RELAYCOUNTRY_RU 1979 0.38 1.14 0.02 179 RELAYCOUNTRY_DE 1948 0.55 1.12 0.28 180 TR_XM_BayesRelay 1932 0.36 1.11 0.00 181 LongTLD 1930 0.51 1.11 0.22 182 UNDISC_MONEY 1872 0.35 1.08 0.00 183 BAYES_20 1859 2.66 1.07 3.42 184 HTML_TITLE_SUBJ_DIFF 1845 0.55 1.06 0.31 185 HTML_TAG_BALANCE_CENTER 1833 0.43 1.06 0.12 186 RELAYCOUNTRY_AU 1814 0.55 1.04 0.32 187 TR_XM_Base64_M1 1807 0.97 1.04 0.93 188 XMPhish30 1801 0.66 1.04 0.48 189 T_Symld_Words_02 1796 0.72 1.03 0.58 190 RCVD_IN_IADB_OPTIN 1796 1.86 1.03 2.25 191 TR_MetaPhish_Combo_01 1772 0.85 1.02 0.76 192 XMLngstWrd_03 1746 0.68 1.01 0.52 193 MIXED_CENTER_CASE 1741 0.33 1.00 0.00 194 XMReplyNow 1730 0.50 1.00 0.27 195 LOADSA_MONEY_COMBO 1706 0.35 0.98 0.04 196 MIXED_HREF_CASE 1693 0.32 0.97 0.00 197 XM_B_SEO 1685 0.45 0.97 0.20 198 MIXED_IMG_CASE 1679 0.32 0.97 0.00 199 RELAYCOUNTRY_FR 1679 0.48 0.97 0.25 200 XM_ProductURIs 1678 0.91 0.97 0.88 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 317287 89.99 95.41 87.39 2 RELAYCOUNTRY_US 296450 80.76 78.91 81.65 3 DKIM_SIGNED 254177 74.79 84.78 70.01 4 DCC_CHECK_NEGATIVE 252754 57.87 33.32 69.62 5 XM_DK_Pass 250032 72.83 81.12 68.87 6 XM_B_Unicode 247005 72.98 83.33 68.03 7 DKIM_VALID 246033 71.96 80.72 67.77 8 BAYES_50 195110 49.95 42.04 53.74 9 DKIM_VALID_AU 191165 55.21 60.56 52.65 10 XMListUnsubscribeExists 166744 52.29 65.58 45.93 11 XM_B_SpammyWords 166741 52.44 66.04 45.93 12 XM_B_Unicode3 145068 40.81 42.59 39.96 13 RCVD_IN_MSPIKE_H2 132383 40.32 48.39 36.46 14 T_TM2_M_HEADER_IN_MSG 119841 29.07 20.83 33.01 15 DCC_CHECK 110095 42.08 66.66 30.32 16 DKIM_VALID_EF 96315 28.26 31.87 26.53 17 HTML_FONT_LOW_CONTRAST 90732 27.67 33.27 24.99 18 FVGT_m_MULTI_ODD 85374 26.00 31.20 23.51 19 XMSubLong 80345 22.62 23.66 22.13 20 LOC_TINY_FONT_1 79696 25.95 34.30 21.95 21 T_KAM_HTML_FONT_INVALID 67993 22.00 28.84 18.73 22 MIME_HTML_ONLY 67085 23.20 33.06 18.48 23 XM_B_SpammyWords2 63371 23.71 36.77 17.45 24 RCVD_IN_MSPIKE_WL 61954 15.08 10.93 17.06 25 ALL_TRUSTED 56581 12.23 5.23 15.58 26 BAYES_00 52762 10.11 0.88 14.53 27 XM_Multi_Part_URI 42366 13.53 17.43 11.67 28 USER_IN_DEF_DKIM_WL 42338 8.60 2.21 11.66 29 RCVD_IN_MSPIKE_H3 41036 10.29 8.16 11.30 30 LOTS_OF_MONEY 39433 12.32 15.37 10.86 31 XM_Body_Dirty_Words 39121 13.65 19.67 10.78 32 IN_ZIMBRA_NJ_WHITELIST 38746 7.27 0.14 10.67 33 LotsOfNums_01 32315 8.50 7.66 8.90 34 XM_DKIMWhitelistDomains 32280 6.07 0.18 8.89 35 BAYES_60 32068 8.44 7.60 8.83 36 XM_B_Unsub 30893 10.84 15.72 8.51 37 XM_Evil_Numbers_Gen 30883 8.44 8.32 8.51 38 TooManyTo_001 29820 6.92 4.21 8.21 39 TR_XM_SpammyWords4 29736 9.66 12.72 8.19 40 HTML_IMAGE_RATIO_06 25515 5.76 3.11 7.03 41 UNPARSEABLE_RELAY 25221 8.55 11.91 6.95 42 TR_XM_BayesUnsub 24439 9.53 15.37 6.73 43 XM_DK_Undo_02 22808 17.72 41.62 6.28 44 XM_SPF_SoftFail 22481 5.71 4.70 6.19 45 TR_XM_DK_Bayes 22228 4.35 0.63 6.12 46 BAYES_99 21718 14.56 32.50 5.98 47 HTML_IMAGE_RATIO_02 21613 5.99 6.07 5.95 48 T_TooManySym_01 21576 4.73 2.19 5.94 49 TR_XM_DK_Bayes1 21315 4.17 0.60 5.87 50 MIME_QP_LONG_LINE 19822 4.94 3.86 5.46 51 TR_XM_UnparsRelay 19740 7.45 11.67 5.44 52 RCVD_IN_IADB_LISTED 19405 4.57 2.95 5.34 53 TR_XM_DK_Bayes2 18755 3.63 0.43 5.17 54 MPART_ALT_DIFF 18035 5.16 5.57 4.97 55 BAYES_999 18033 11.65 25.62 4.97 56 XM_H_Long_From01 17787 5.05 5.36 4.90 57 TR_XM_DKIM_Undo 17737 13.60 31.81 4.89 58 HTML_IMAGE_RATIO_04 17367 4.59 4.18 4.78 59 RCVD_IN_MSPIKE_H4 17349 4.05 2.52 4.78 60 XMStrtUSub 17265 4.75 4.74 4.76 61 RCVD_IN_IADB_SPF 17162 3.99 2.44 4.73 62 HTML_FONT_FACE_BAD 17065 3.42 0.74 4.70 63 BOTNET_IPINHOSTNAME 16798 7.47 13.42 4.63 64 BAYES_40 16462 3.52 1.40 4.53 65 XM_PDF 16281 3.34 0.94 4.48 66 RCVD_IN_VALIDITY_SAFE 15969 3.88 2.80 4.40 67 RCVD_IN_IADB_SENDERID 15371 3.58 2.22 4.23 68 RCVD_IN_IADB_DK 14886 3.50 2.24 4.10 69 BAYES_80 14880 5.61 8.76 4.10 70 T_REMOTE_IMAGE 14093 3.35 2.23 3.88 71 XM_SendGrid 14073 4.48 5.75 3.88 72 RCVD_IN_VALIDITY_CERTIFIED 13875 3.33 2.31 3.82 73 KHOP_HELO_FCRDNS 13602 3.35 2.53 3.75 74 XM_UncommonTLD01 13107 4.74 7.11 3.61 75 XM_H_Trusted_IP 13048 2.43 0.00 3.59 76 T_TooManySym_02 12859 2.63 0.73 3.54 77 RELAYCOUNTRY_META 12760 8.23 18.08 3.51 78 XM_B_SpammyWords3 12693 6.16 11.72 3.50 79 XMNumbers 12612 4.79 7.54 3.47 80 BAYES_20 12426 2.66 1.07 3.42 81 RCVD_IN_IADB_VOUCHED 12270 2.85 1.73 3.38 82 FSL_BULK_SIG 12267 5.95 11.34 3.38 83 MIME_HTML_ONLY_MULTI 12033 3.31 3.32 3.31 84 XM_B_Phish_Phrases 11749 3.90 5.30 3.24 85 XMSubMetaSx_00 11548 4.05 5.85 3.18 86 HTML_IMAGE_RATIO_08 11525 3.02 2.70 3.17 87 XMSexyCombo_05 11520 4.70 7.90 3.17 88 TR_XM_PhishingBody 11163 4.11 6.27 3.07 89 ANY_BOUNCE_MESSAGE 10768 2.28 0.84 2.97 90 BOUNCE_MESSAGE 10767 2.28 0.84 2.97 91 MAILING_LIST_MULTI 10083 2.47 1.83 2.78 92 BAYES_95 9513 3.44 5.17 2.62 93 TR_XM_DK_SendGrid 9033 2.87 3.66 2.49 94 MIME_HTML_MOSTLY 8893 2.68 3.15 2.45 95 URI_NOVOWEL 8618 2.37 2.37 2.37 96 TooManyTo_002 8605 1.80 0.61 2.37 97 HTML_MIME_NO_HTML_TAG 8601 3.99 7.38 2.37 98 FROM_EXCESS_BASE64 8388 2.14 1.78 2.31 99 TM2_M_URI_OPT_OUT 8212 2.36 2.57 2.26 100 XM_B_SpammyTLD 8196 2.96 4.42 2.26 101 RCVD_IN_IADB_OPTIN 8182 1.86 1.03 2.25 102 DKIM_INVALID 8144 2.83 4.05 2.24 103 BAYES_05 8122 1.70 0.58 2.24 104 TVD_RCVD_IP 8046 1.59 0.29 2.22 105 TR_XM_SB_Phish 7464 2.01 1.92 2.06 106 HELO_NODOT 7373 1.53 0.48 2.03 107 XMSubPhish11 7364 1.96 1.83 2.03 108 HELO_NO_DOMAIN 7363 1.53 0.48 2.03 109 TR_DCC_Bayes_99 6800 8.34 21.85 1.87 110 IN_HORDE_ADDRESS_BOOK 6612 1.28 0.14 1.82 111 INVALID_MSGID 6582 1.26 0.11 1.81 112 XM_CamelCaseFrm001 6396 1.90 2.18 1.76 113 XMSubNoVowel 6362 1.72 1.64 1.75 114 XM_DK_Undo_01 6264 1.82 2.02 1.73 115 XM_GoogleGroups 6188 1.60 1.39 1.70 116 SUBJ_ALL_CAPS 6071 1.83 2.17 1.67 117 XMDiploma_00 5968 2.47 4.21 1.64 118 TO_MALFORMED 5927 1.11 0.01 1.63 119 XM_B_Unsub2 5913 1.92 2.53 1.63 120 XM_B_Phish66 5880 2.30 3.73 1.62 121 TooManyTo_003 5845 1.25 0.50 1.61 122 TR_XM_SpammyRelay 5825 4.76 11.35 1.60 123 T_XMDrugObfuBody_08 5751 2.06 3.05 1.58 124 XM_B_Investor 5697 2.83 5.46 1.57 125 TR_Symld_Words 5536 1.45 1.30 1.52 126 T_XMDrugObfuBody_14 5401 2.24 3.82 1.49 127 TR_XM_SpammyWords5 5077 2.11 3.59 1.40 128 XMGappySubj_01 5065 0.98 0.12 1.40 129 BOTNET 5017 4.59 11.31 1.38 130 TM2_M_VERY_LONG_WORD 4976 2.06 3.50 1.37 131 URI_HEX 4962 1.58 2.01 1.37 132 RCVD_IN_MSPIKE_BL 4814 2.75 5.72 1.33 133 XMBSHREFv2 4790 1.01 0.36 1.32 134 XM_H_Long_From02 4775 1.35 1.44 1.32 135 TR_XM_MSPIKECOMBO 4755 2.70 5.61 1.31 136 UNTRUSTED_Relay 4732 3.46 7.95 1.30 137 XMCapTrack 4604 0.97 0.36 1.27 138 TooManyTo_004 4236 0.93 0.44 1.17 139 XMStockSpam_06 4156 1.45 2.08 1.14 140 RELAYCOUNTRY_CA 3908 3.16 7.50 1.08 141 TR_XM_SpammyWords2 3645 4.08 10.51 1.00 142 RCVD_IN_MSPIKE_H5 3569 0.74 0.24 0.98 143 XMLngstWrd_00 3515 1.09 1.33 0.97 144 TVD_SPACE_RATIO 3495 0.67 0.05 0.96 145 TooManyTo_005 3398 0.76 0.38 0.94 146 TR_XM_Base64_M1 3373 0.97 1.04 0.93 147 DKIM_ADSP_CUSTOM_MED 3307 0.90 0.87 0.91 148 XMGenDplmaNmb 3258 1.14 1.66 0.90 149 XM_ProductURIs 3208 0.91 0.97 0.88 150 XM_OfRef6 3204 2.08 4.59 0.88 151 XMLngstWrd_01 3177 1.01 1.29 0.88 152 HTTPS_HTTP_MISMATCH 3164 1.19 1.84 0.87 153 XM_UB50 3108 1.62 3.22 0.86 154 RCVD_IN_MSPIKE_L3 3064 1.23 2.03 0.84 155 T_FILL_THIS_FORM_SHORT 2967 1.21 2.03 0.82 156 HTML_IMAGE_ONLY_20 2939 0.73 0.55 0.81 157 SpammyFromTLD_01 2927 1.40 2.66 0.81 158 RCVD_IN_RP_SAFE 2919 0.74 0.61 0.80 159 T_TooManySym_03 2782 0.60 0.26 0.77 160 T_XMDrugObfuBody_00 2781 1.10 1.81 0.77 161 TR_MetaPhish_Combo_01 2777 0.85 1.02 0.76 162 XMBody_95 2680 0.57 0.23 0.74 163 XMBdyGiftCard01 2625 0.79 0.93 0.72 164 XMLngstWrd_02 2570 0.86 1.19 0.71 165 RCVD_IN_RP_CERTIFIED 2566 0.63 0.48 0.71 166 XMHTML_After_End 2542 1.02 1.70 0.70 167 HTML_TAG_BALANCE_BODY 2474 0.89 1.32 0.68 168 XMHTMLBadTable_001 2473 0.71 0.78 0.68 169 FROM_GOV_DKIM_AU 2439 0.50 0.13 0.67 170 SpammyFromTLD_02 2385 1.32 2.72 0.66 171 XMNoVowels 2369 0.58 0.43 0.65 172 TR_XM_SpammyWords3 2350 1.52 3.35 0.65 173 XM_ShortIntro_01 2345 0.55 0.35 0.65 174 XM_shorewaves_Whitelist 2310 0.43 0.00 0.64 175 XMBrknScrpt_02 2308 0.94 1.56 0.64 176 MSGID_NOFQDN1 2306 0.43 0.01 0.64 177 XMSubMetaI_00 2226 0.69 0.84 0.61 178 SHORT_HELO_AND_INLINE_IMAGE 2216 0.44 0.08 0.61 179 XM_B_COPY_HTML 2200 0.63 0.69 0.61 180 RCVD_IN_BL_SPAMCOP_NET 2123 3.72 10.27 0.58 181 T_Symld_Words_02 2088 0.72 1.03 0.58 182 XMPhish14 2044 0.68 0.91 0.56 183 XM_H_PHPMailer 2036 0.58 0.62 0.56 184 NML_ADSP_CUSTOM_MED 2025 0.60 0.68 0.56 185 XMMoneyMeta_00 2015 0.83 1.39 0.56 186 T_OBFU_PDF_ATTACH 2003 0.45 0.25 0.55 187 XM_B_COVIDMETA 1976 0.79 1.30 0.54 188 RCVD_IN_SORBS_DUL 1928 0.39 0.09 0.53 189 MPART_ALT_DIFF_COUNT 1916 0.63 0.84 0.53 190 XMLngstWrd_03 1904 0.68 1.01 0.52 191 URI_TRY_3LD 1846 0.81 1.43 0.51 192 XMPhish30 1751 0.66 1.04 0.48 193 T_MANY_PILL_PRICE 1737 0.33 0.01 0.48 194 RELAYCOUNTRY_GB 1736 0.52 0.61 0.48 195 FORGED_GMAIL_RCVD 1730 0.56 0.74 0.48 196 PLING_QUERY 1700 0.62 0.95 0.47 197 XMLngstWrd_04 1665 0.62 0.95 0.46 198 T_XMHurry_00 1634 0.83 1.63 0.45 199 XM_B_SpammyWords4 1622 0.98 2.10 0.45 200 XMSexyCombo_01 1602 0.93 1.94 0.44 ----------------------------------------------------------------------