Email: 497111 Autolearn: 0 AvgScore: 3.43 AvgScanTime: 1.19 sec Spam: 157012 Autolearn: 0 AvgScore: 14.25 AvgScanTime: 1.35 sec Ham: 340099 Autolearn: 0 AvgScore: -1.57 AvgScanTime: 1.12 sec Time Spent Running SA: 164.21 hours Time Spent Processing Spam: 58.68 hours Time Spent Processing Ham: 105.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149801 89.64 95.41 86.97 2 DKIM_SIGNED 133464 74.22 85.00 69.24 3 XM_DK_Pass 130085 72.54 82.85 67.78 4 DKIM_VALID 128932 71.59 82.12 66.74 5 XM_B_Unicode 128780 71.54 82.02 66.70 6 RELAYCOUNTRY_US 123197 78.50 78.46 78.52 7 DCC_CHECK 112669 43.51 71.76 30.47 8 XM_B_SpammyWords 107276 52.73 68.32 45.53 9 XMListUnsubscribeExists 102635 50.74 65.37 43.98 10 DKIM_VALID_AU 98513 55.59 62.74 52.29 11 RCVD_IN_MSPIKE_H2 75749 39.97 48.24 36.14 12 XM_B_Unicode3 68188 39.35 43.43 37.47 13 XM_DK_Undo_02 66090 17.17 42.09 5.67 14 BAYES_50 64287 51.91 40.94 56.98 15 XM_B_SpammyWords2 60043 24.97 38.24 18.85 16 LOC_TINY_FONT_1 57071 25.63 36.35 20.68 17 HTML_FONT_LOW_CONTRAST 53273 28.10 33.93 25.42 18 BAYES_99 51932 13.77 33.08 4.86 19 TR_XM_DKIM_Undo 51381 13.19 32.72 4.18 20 DKIM_VALID_EF 51160 29.11 32.58 27.51 21 MIME_HTML_ONLY 49288 23.99 31.39 20.57 22 FVGT_m_MULTI_ODD 48461 25.76 30.86 23.40 23 T_KAM_HTML_FONT_INVALID 47508 21.43 30.26 17.35 24 DCC_CHECK_NEGATIVE 44299 56.44 28.21 69.47 25 BAYES_999 40997 10.90 26.11 3.88 26 TR_DCC_Bayes_99 36297 8.26 23.12 1.40 27 T_TM2_M_HEADER_IN_MSG 35688 30.61 22.73 34.25 28 XM_Body_Dirty_Words 33685 14.29 21.45 10.98 29 XMSubLong 33623 21.22 21.41 21.14 30 RELAYCOUNTRY_META 31970 8.82 20.36 3.49 31 XM_Multi_Part_URI 26606 12.70 16.95 10.73 32 XM_B_Unsub 25248 10.78 16.08 8.33 33 TR_XM_BayesUnsub 24671 9.41 15.71 6.50 34 LOTS_OF_MONEY 23364 10.47 14.88 8.43 35 FSL_BULK_SIG 22486 7.20 14.32 3.92 36 TR_XM_SpammyRelay 21439 5.26 13.65 1.39 37 TR_XM_SpammyWords4 20388 8.24 12.98 6.05 38 BOTNET 20201 5.00 12.87 1.37 39 BOTNET_IPINHOSTNAME 19437 6.87 12.38 4.33 40 UNPARSEABLE_RELAY 19259 8.90 12.27 7.35 41 XM_B_SpammyWords3 18802 6.49 11.97 3.96 42 TR_XM_UnparsRelay 18783 7.62 11.96 5.61 43 RCVD_IN_BL_SPAMCOP_NET 17794 3.86 11.33 0.41 44 TR_XM_SpammyWords2 17393 4.08 11.08 0.85 45 RCVD_IN_MSPIKE_WL 17329 15.02 11.04 16.87 46 UNTRUSTED_Relay 15477 4.03 9.86 1.34 47 XMSexyCombo_05 15040 5.42 9.58 3.50 48 BAYES_80 13632 5.56 8.68 4.12 49 RELAYCOUNTRY_CA 13430 3.44 8.55 1.08 50 XM_Evil_Numbers_Gen 13411 8.18 8.54 8.02 51 RCVD_IN_MSPIKE_H3 12953 9.95 8.25 10.73 52 BAYES_60 12622 8.54 8.04 8.78 53 XM_UncommonTLD01 12488 4.98 7.95 3.60 54 TR_XM_PhishingBody 10754 4.07 6.85 2.78 55 TR_XM_SPAMCOP 10654 2.26 6.79 0.18 56 XM_SPF_SoftFail 10431 4.21 6.64 3.09 57 LotsOfNums_01 10203 7.63 6.50 8.16 58 XM_SendGrid 10095 5.14 6.43 4.55 59 XM_H_Long_From01 9797 5.27 6.24 4.82 60 HTML_IMAGE_RATIO_02 9707 5.66 6.18 5.42 61 XM_B_Phish_Phrases 9628 4.82 6.13 4.21 62 XMSubMetaSx_00 9510 4.31 6.06 3.50 63 MPART_ALT_DIFF 9260 5.58 5.90 5.43 64 RCVD_IN_MSPIKE_BL 8921 2.54 5.68 1.09 65 TR_XM_MSPIKECOMBO 8718 2.49 5.55 1.08 66 XM_B_Investor 8438 2.70 5.37 1.46 67 BAYES_95 8036 3.35 5.12 2.54 68 TooManyTo_001 7992 7.43 5.09 8.51 69 HTML_IMAGE_RATIO_04 7062 4.66 4.50 4.73 70 MIME_HTML_MOSTLY 6801 3.01 4.33 2.40 71 XM_UB50 6775 1.94 4.31 0.84 72 TR_XM_DK_SendGrid 6389 3.32 4.07 2.97 73 XM_OfRef6 6277 1.94 4.00 1.00 74 XMBody_17 6275 1.55 4.00 0.42 75 T_XMDrugObfuBody_14 6189 2.24 3.94 1.45 76 XM_B_SpammyTLD 6120 2.58 3.90 1.97 77 XMNumbers 6088 3.57 3.88 3.43 78 TR_XM_SpammyWords5 6072 2.19 3.87 1.42 79 T_REMOTE_IMAGE 6037 3.83 3.84 3.82 80 HTML_IMAGE_RATIO_06 6031 4.44 3.84 4.71 81 RCVD_IN_VALIDITY_SAFE 6010 4.24 3.83 4.43 82 XM_DIRTYINTL 5910 1.41 3.76 0.32 83 XMStrtUSub 5715 4.33 3.64 4.65 84 T_FILL_THIS_FORM_SHORT 5412 1.65 3.45 0.82 85 T_XMDrugObfuBody_08 5150 2.01 3.28 1.42 86 RCVD_IN_PSBL 5037 1.48 3.21 0.69 87 XM_B_Phish66 4972 2.22 3.17 1.78 88 MIME_QP_LONG_LINE 4960 4.25 3.16 4.75 89 BOTNET_NORDNS 4927 1.00 3.14 0.01 90 XMBrknScrpt_02 4908 1.50 3.13 0.75 91 URI_NOVOWEL 4837 2.41 3.08 2.10 92 RCVD_IN_MSPIKE_L5 4794 0.98 3.05 0.02 93 RCVD_IN_VALIDITY_CERTIFIED 4771 3.72 3.04 4.04 94 T_XMHurry_00 4714 2.71 3.00 2.58 95 TM2_M_VERY_LONG_WORD 4607 1.79 2.93 1.27 96 DKIM_INVALID 4532 2.62 2.89 2.50 97 HTML_IMAGE_RATIO_08 4387 2.33 2.79 2.12 98 TM2_M_URI_OPT_OUT 4311 2.47 2.75 2.34 99 XM_DK_Undo_01 4196 2.03 2.67 1.73 100 MIME_HTML_ONLY_MULTI 4190 3.34 2.67 3.66 101 XM_B_Unsub2 4163 1.96 2.65 1.65 102 SpammyFromTLD_02 4135 0.99 2.63 0.23 103 XM_CamelCaseFrm001 4118 1.95 2.62 1.65 104 XMDiploma_00 4101 1.84 2.61 1.48 105 ALL_TRUSTED 4047 13.63 2.58 18.73 106 TR_XM_MSPIKECOMBO2 4002 0.88 2.55 0.11 107 SpammyFromTLD_01 3977 1.28 2.53 0.71 108 RCVD_IN_VALIDITY_RPBL 3947 0.82 2.51 0.04 109 HTML_MIME_NO_HTML_TAG 3880 3.07 2.47 3.34 110 RCVD_IN_MSPIKE_H4 3847 4.30 2.45 5.15 111 T_TooManySym_01 3810 5.05 2.43 6.26 112 HK_RANDOM_REPLYTO 3734 0.81 2.38 0.09 113 TR_XM_SpammyWords3 3712 1.07 2.36 0.48 114 RCVD_IN_IADB_LISTED 3664 4.01 2.33 4.79 115 USER_IN_DEF_DKIM_WL 3587 8.76 2.28 11.75 116 TR_LOTS_OF_MONEY3 3511 0.93 2.24 0.33 117 KHOP_HELO_FCRDNS 3498 2.15 2.23 2.12 118 XM_UB99 3473 0.70 2.21 0.00 119 XMSexyCombo_01 3392 1.12 2.16 0.63 120 XM_B_SpammyWords4 3312 0.97 2.11 0.44 121 SUBJ_ALL_CAPS 3262 1.78 2.08 1.65 122 MAILING_LIST_MULTI 3242 2.69 2.06 2.97 123 FROM_EXCESS_BASE64 3167 2.06 2.02 2.08 124 RCVD_IN_IADB_SPF 3159 3.54 2.01 4.24 125 RCVD_IN_MSPIKE_L3 3138 1.12 2.00 0.72 126 PDS_OTHER_BAD_TLD 3117 0.73 1.99 0.15 127 RCVD_IN_IADB_DK 2938 3.11 1.87 3.68 128 RCVD_IN_IADB_SENDERID 2931 3.18 1.87 3.79 129 XMHTML_After_End 2843 1.11 1.81 0.79 130 TR_XM_NoHeaderRelay 2841 0.66 1.81 0.12 131 XM_B_COVIDMETA 2810 1.02 1.79 0.66 132 XM_UB999 2717 0.55 1.73 0.00 133 URI_HEX 2696 1.32 1.72 1.14 134 XMStockSpam_06 2605 1.66 1.66 1.66 135 TM2_M_A_HREF_HREF 2589 0.78 1.65 0.37 136 XMClaimOffer 2565 0.59 1.63 0.10 137 RELAYCOUNTRY_IN 2525 0.58 1.61 0.10 138 TR_XM_SB_Phish 2514 1.98 1.60 2.16 139 BAYES_40 2477 3.86 1.58 4.92 140 XMSubPhish11 2428 1.94 1.55 2.12 141 XM_URI_RBL 2392 0.55 1.52 0.10 142 MPART_ALT_DIFF_COUNT 2376 0.94 1.51 0.67 143 TR_XM_PHPDW 2364 0.70 1.51 0.33 144 HTML_TAG_BALANCE_BODY 2348 0.91 1.50 0.64 145 TR_XM_PHPForged 2246 0.63 1.43 0.26 146 XM_H_Undi_Recip 2223 0.68 1.42 0.34 147 T_XMDrugObfuBody_00 2206 0.78 1.40 0.49 148 TR_XM_FormFill2 2200 0.62 1.40 0.26 149 XM_H_PHPOS 2191 0.62 1.40 0.26 150 TR_XM_MaxSPIKE 2189 0.49 1.39 0.07 151 URIBL_BLACK 2154 0.47 1.37 0.05 152 TR_Symld_Words 2114 1.54 1.35 1.64 153 XMSubMetaI_00 2095 0.72 1.33 0.44 154 XM_UB60 2078 0.48 1.32 0.09 155 XMBdyGiftCard01 2068 0.87 1.32 0.67 156 HTTPS_HTTP_MISMATCH 2034 0.91 1.30 0.73 157 RELAYCOUNTRY_FR 2028 0.58 1.29 0.26 158 URI_TRY_3LD 1997 0.93 1.27 0.78 159 XM_Body_Dirty_Words_01 1941 0.47 1.24 0.11 160 XMGenDplmaNmb 1935 0.93 1.23 0.79 161 TR_XM_FormFill 1923 0.40 1.22 0.01 162 XM_H_Long_From02 1920 1.07 1.22 1.00 163 RCVD_IN_IADB_VOUCHED 1904 2.43 1.21 3.00 164 XMPhish11 1882 0.42 1.20 0.07 165 BAYES_20 1876 3.10 1.19 3.98 166 XM_B_DNDMA 1871 0.66 1.19 0.42 167 URIBL_DBL_SPAM 1869 0.38 1.19 0.01 168 FONT_INVIS_LONG_LINE 1833 0.48 1.17 0.16 169 TR_XM_BayesRelay 1830 0.37 1.17 0.00 170 MONEY_NOHTML 1763 0.39 1.12 0.06 171 XMPhish30 1758 0.65 1.12 0.44 172 HTML_FONT_TINY_NORDNS 1754 0.41 1.12 0.09 173 XM_PDF 1744 3.90 1.11 5.19 174 HTML_OBFUSCATE_05_10 1715 0.44 1.09 0.14 175 DKIM_ADSP_CUSTOM_MED 1709 0.96 1.09 0.90 176 TR_XM_COVIDMETA4 1708 0.48 1.09 0.19 177 XMReplyNow 1698 0.55 1.08 0.31 178 HTML_TAG_BALANCE_CENTER 1642 0.41 1.05 0.12 179 XMSubNoVowel 1633 1.07 1.04 1.09 180 HTML_FONT_SIZE_LARGE 1631 0.42 1.04 0.14 181 SUBJ_DOLLARS 1624 0.49 1.03 0.23 182 TR_XM_Base64_M1 1620 0.93 1.03 0.89 183 DIET_1 1612 0.53 1.03 0.31 184 FROM_SUSPICIOUS_NTLD 1610 0.34 1.03 0.02 185 RELAYCOUNTRY_DE 1598 0.54 1.02 0.32 186 TR_Mismatch_TLD_01 1588 0.50 1.01 0.26 187 RELAYCOUNTRY_RU 1580 0.34 1.01 0.04 188 XM_UB80 1534 0.32 0.98 0.02 189 FROM_SUSPICIOUS_NTLD_FP 1518 0.31 0.97 0.01 190 RELAYCOUNTRY_NL 1512 0.39 0.96 0.12 191 TR_XM_COVIDMETA1 1478 0.42 0.94 0.18 192 XMSexyCombo_04 1477 0.40 0.94 0.15 193 ANY_BOUNCE_MESSAGE 1471 1.89 0.94 2.33 194 BOUNCE_MESSAGE 1470 1.89 0.94 2.33 195 MIXED_CENTER_CASE 1456 0.29 0.93 0.00 196 RELAYCOUNTRY_AU 1455 0.49 0.93 0.29 197 BODY_URI_ONLY 1449 0.31 0.92 0.02 198 FORGED_GMAIL_RCVD 1444 0.60 0.92 0.45 199 URI_PHISH 1441 0.31 0.92 0.02 200 XMHTMLBadTable_001 1418 0.59 0.90 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295797 89.64 95.41 86.97 2 RELAYCOUNTRY_US 267059 78.50 78.46 78.52 3 DCC_CHECK_NEGATIVE 236279 56.44 28.21 69.47 4 DKIM_SIGNED 235479 74.22 85.00 69.24 5 XM_DK_Pass 230525 72.54 82.85 67.78 6 DKIM_VALID 226970 71.59 82.12 66.74 7 XM_B_Unicode 226832 71.54 82.02 66.70 8 BAYES_50 193784 51.91 40.94 56.98 9 DKIM_VALID_AU 177826 55.59 62.74 52.29 10 XM_B_SpammyWords 154853 52.73 68.32 45.53 11 XMListUnsubscribeExists 149584 50.74 65.37 43.98 12 XM_B_Unicode3 127428 39.35 43.43 37.47 13 RCVD_IN_MSPIKE_H2 122925 39.97 48.24 36.14 14 T_TM2_M_HEADER_IN_MSG 116482 30.61 22.73 34.25 15 DCC_CHECK 103625 43.51 71.76 30.47 16 DKIM_VALID_EF 93548 29.11 32.58 27.51 17 HTML_FONT_LOW_CONTRAST 86437 28.10 33.93 25.42 18 FVGT_m_MULTI_ODD 79593 25.76 30.86 23.40 19 XMSubLong 71880 21.22 21.41 21.14 20 LOC_TINY_FONT_1 70339 25.63 36.35 20.68 21 MIME_HTML_ONLY 69971 23.99 31.39 20.57 22 XM_B_SpammyWords2 64109 24.97 38.24 18.85 23 ALL_TRUSTED 63714 13.63 2.58 18.73 24 T_KAM_HTML_FONT_INVALID 59006 21.43 30.26 17.35 25 RCVD_IN_MSPIKE_WL 57358 15.02 11.04 16.87 26 USER_IN_DEF_DKIM_WL 39967 8.76 2.28 11.75 27 BAYES_00 38118 7.90 0.74 11.21 28 XM_Body_Dirty_Words 37341 14.29 21.45 10.98 29 XM_Multi_Part_URI 36505 12.70 16.95 10.73 30 RCVD_IN_MSPIKE_H3 36488 9.95 8.25 10.73 31 XM_DKIMWhitelistDomains 31839 6.41 0.02 9.36 32 BAYES_60 29856 8.54 8.04 8.78 33 TooManyTo_001 28958 7.43 5.09 8.51 34 LOTS_OF_MONEY 28685 10.47 14.88 8.43 35 XM_B_Unsub 28338 10.78 16.08 8.33 36 LotsOfNums_01 27737 7.63 6.50 8.16 37 XM_Evil_Numbers_Gen 27275 8.18 8.54 8.02 38 IN_ZIMBRA_NJ_WHITELIST 25471 5.16 0.12 7.49 39 UNPARSEABLE_RELAY 24985 8.90 12.27 7.35 40 TR_XM_BayesUnsub 22107 9.41 15.71 6.50 41 T_TooManySym_01 21298 5.05 2.43 6.26 42 TR_XM_SpammyWords4 20573 8.24 12.98 6.05 43 TR_XM_DK_Bayes 19908 4.16 0.50 5.85 44 TR_XM_DK_Bayes1 19542 4.09 0.49 5.75 45 XM_DK_Undo_02 19286 17.17 42.09 5.67 46 TR_XM_UnparsRelay 19075 7.62 11.96 5.61 47 MPART_ALT_DIFF 18473 5.58 5.90 5.43 48 HTML_IMAGE_RATIO_02 18422 5.66 6.18 5.42 49 XM_PDF 17636 3.90 1.11 5.19 50 RCVD_IN_MSPIKE_H4 17528 4.30 2.45 5.15 51 TR_XM_DK_Bayes2 16934 3.53 0.39 4.98 52 BAYES_40 16723 3.86 1.58 4.92 53 BAYES_99 16534 13.77 33.08 4.86 54 XM_H_Long_From01 16405 5.27 6.24 4.82 55 RCVD_IN_IADB_LISTED 16278 4.01 2.33 4.79 56 MIME_QP_LONG_LINE 16147 4.25 3.16 4.75 57 HTML_IMAGE_RATIO_04 16096 4.66 4.50 4.73 58 HTML_IMAGE_RATIO_06 16026 4.44 3.84 4.71 59 XMStrtUSub 15806 4.33 3.64 4.65 60 XM_SendGrid 15466 5.14 6.43 4.55 61 RCVD_IN_VALIDITY_SAFE 15062 4.24 3.83 4.43 62 BOTNET_IPINHOSTNAME 14725 6.87 12.38 4.33 63 RCVD_IN_IADB_SPF 14418 3.54 2.01 4.24 64 XM_B_Phish_Phrases 14313 4.82 6.13 4.21 65 TR_XM_DKIM_Undo 14211 13.19 32.72 4.18 66 BAYES_80 14028 5.56 8.68 4.12 67 XM_H_Trusted_IP 14011 2.82 0.00 4.12 68 RCVD_IN_VALIDITY_CERTIFIED 13724 3.72 3.04 4.04 69 BAYES_20 13528 3.10 1.19 3.98 70 XM_B_SpammyWords3 13470 6.49 11.97 3.96 71 FSL_BULK_SIG 13318 7.20 14.32 3.92 72 BAYES_999 13182 10.90 26.11 3.88 73 T_REMOTE_IMAGE 12995 3.83 3.84 3.82 74 RCVD_IN_IADB_SENDERID 12899 3.18 1.87 3.79 75 RCVD_IN_IADB_DK 12520 3.11 1.87 3.68 76 MIME_HTML_ONLY_MULTI 12435 3.34 2.67 3.66 77 XM_UncommonTLD01 12246 4.98 7.95 3.60 78 XMSubMetaSx_00 11918 4.31 6.06 3.50 79 XMSexyCombo_05 11911 5.42 9.58 3.50 80 RELAYCOUNTRY_META 11884 8.82 20.36 3.49 81 XMNumbers 11665 3.57 3.88 3.43 82 HTML_MIME_NO_HTML_TAG 11361 3.07 2.47 3.34 83 T_TooManySym_02 11313 2.50 0.70 3.33 84 XM_SPF_SoftFail 10516 4.21 6.64 3.09 85 RCVD_IN_IADB_VOUCHED 10200 2.43 1.21 3.00 86 MAILING_LIST_MULTI 10107 2.69 2.06 2.97 87 TR_XM_DK_SendGrid 10097 3.32 4.07 2.97 88 HTML_FONT_FACE_BAD 9789 2.22 0.81 2.88 89 TR_XM_PhishingBody 9464 4.07 6.85 2.78 90 BAYES_05 8895 1.99 0.63 2.62 91 T_XMHurry_00 8758 2.71 3.00 2.58 92 BAYES_95 8633 3.35 5.12 2.54 93 TooManyTo_002 8578 1.97 0.76 2.52 94 DKIM_INVALID 8509 2.62 2.89 2.50 95 MIME_HTML_MOSTLY 8169 3.01 4.33 2.40 96 TM2_M_URI_OPT_OUT 7963 2.47 2.75 2.34 97 ANY_BOUNCE_MESSAGE 7910 1.89 0.94 2.33 98 BOUNCE_MESSAGE 7910 1.89 0.94 2.33 99 TR_XM_SB_Phish 7335 1.98 1.60 2.16 100 XMSubPhish11 7206 1.94 1.55 2.12 101 KHOP_HELO_FCRDNS 7196 2.15 2.23 2.12 102 HTML_IMAGE_RATIO_08 7194 2.33 2.79 2.12 103 URI_NOVOWEL 7141 2.41 3.08 2.10 104 HELO_NODOT 7119 1.64 0.64 2.09 105 HELO_NO_DOMAIN 7114 1.63 0.64 2.09 106 FROM_EXCESS_BASE64 7090 2.06 2.02 2.08 107 TVD_RCVD_IP 7055 1.51 0.27 2.07 108 RCVD_IN_IADB_OPTIN 7000 1.63 0.70 2.06 109 XM_B_SpammyTLD 6695 2.58 3.90 1.97 110 INVALID_MSGID 6613 1.38 0.15 1.94 111 IN_HORDE_ADDRESS_BOOK 6292 1.29 0.09 1.85 112 TO_MALFORMED 6044 1.22 0.01 1.78 113 XM_B_Phish66 6040 2.22 3.17 1.78 114 XM_DK_Undo_01 5880 2.03 2.67 1.73 115 MSGID_NOFQDN1 5866 1.20 0.06 1.72 116 TooManyTo_003 5758 1.36 0.64 1.69 117 XMStockSpam_06 5657 1.66 1.66 1.66 118 XM_B_Unsub2 5602 1.96 2.65 1.65 119 XM_CamelCaseFrm001 5599 1.95 2.62 1.65 120 SUBJ_ALL_CAPS 5596 1.78 2.08 1.65 121 TR_Symld_Words 5561 1.54 1.35 1.64 122 XMDiploma_00 5025 1.84 2.61 1.48 123 XM_B_Investor 4964 2.70 5.37 1.46 124 T_XMDrugObfuBody_14 4948 2.24 3.94 1.45 125 TR_XM_SpammyWords5 4839 2.19 3.87 1.42 126 T_XMDrugObfuBody_08 4830 2.01 3.28 1.42 127 TR_DCC_Bayes_99 4768 8.26 23.12 1.40 128 TR_XM_SpammyRelay 4732 5.26 13.65 1.39 129 BOTNET 4665 5.00 12.87 1.37 130 UNTRUSTED_Relay 4550 4.03 9.86 1.34 131 XM_GoogleGroups 4374 1.09 0.65 1.29 132 TM2_M_VERY_LONG_WORD 4310 1.79 2.93 1.27 133 XMCapTrack 4287 1.05 0.59 1.26 134 TooManyTo_004 4180 1.02 0.56 1.23 135 XMGappySubj_01 4039 0.86 0.15 1.19 136 XMBSHREFv2 4038 0.90 0.28 1.19 137 XMBody_95 3969 0.85 0.15 1.17 138 URI_HEX 3890 1.32 1.72 1.14 139 RCVD_IN_MSPIKE_BL 3703 2.54 5.68 1.09 140 XMSubNoVowel 3700 1.07 1.04 1.09 141 RELAYCOUNTRY_CA 3680 3.44 8.55 1.08 142 TR_XM_MSPIKECOMBO 3679 2.49 5.55 1.08 143 XM_H_Long_From02 3413 1.07 1.22 1.00 144 XM_OfRef6 3388 1.94 4.00 1.00 145 RCVD_IN_MSPIKE_H5 3342 0.78 0.34 0.98 146 TooManyTo_005 3312 0.80 0.42 0.97 147 XM_ProductURIs 3258 0.87 0.68 0.96 148 DKIM_ADSP_CUSTOM_MED 3075 0.96 1.09 0.90 149 TR_XM_Base64_M1 3018 0.93 1.03 0.89 150 TR_XM_SpammyWords2 2891 4.08 11.08 0.85 151 RCVD_IN_RP_SAFE 2872 0.81 0.74 0.84 152 XM_UB50 2861 1.94 4.31 0.84 153 XMNoVowels 2835 0.68 0.36 0.83 154 T_FILL_THIS_FORM_SHORT 2802 1.65 3.45 0.82 155 T_TooManySym_03 2779 0.65 0.29 0.82 156 XM_E_Blogspot 2775 0.60 0.12 0.82 157 XMHTML_After_End 2697 1.11 1.81 0.79 158 XMGenDplmaNmb 2680 0.93 1.23 0.79 159 XM_ShortIntro_01 2662 0.69 0.49 0.78 160 URI_TRY_3LD 2650 0.93 1.27 0.78 161 RCVD_IN_RP_CERTIFIED 2602 0.71 0.60 0.77 162 XMBrknScrpt_02 2562 1.50 3.13 0.75 163 HTTPS_HTTP_MISMATCH 2482 0.91 1.30 0.73 164 TR_MetaPhish_Combo_01 2478 0.73 0.73 0.73 165 FILL_THIS_FORM 2454 0.67 0.55 0.72 166 RCVD_IN_MSPIKE_L3 2435 1.12 2.00 0.72 167 SpammyFromTLD_01 2400 1.28 2.53 0.71 168 RCVD_IN_PSBL 2339 1.48 3.21 0.69 169 XMSlimDrugH 2314 0.66 0.60 0.68 170 MPART_ALT_DIFF_COUNT 2279 0.94 1.51 0.67 171 XMBdyGiftCard01 2270 0.87 1.32 0.67 172 XM_B_COVIDMETA 2248 1.02 1.79 0.66 173 TVD_SPACE_RATIO 2248 0.49 0.11 0.66 174 T_OBFU_PDF_ATTACH 2236 0.56 0.35 0.66 175 HTML_TAG_BALANCE_BODY 2164 0.91 1.50 0.64 176 XMSexyCombo_01 2151 1.12 2.16 0.63 177 SHORT_HELO_AND_INLINE_IMAGE 2120 0.46 0.10 0.62 178 XM_H_PHPMailer 2068 0.66 0.77 0.61 179 NML_ADSP_CUSTOM_MED 1991 0.67 0.86 0.59 180 XM_B_COPY_HTML 1922 0.66 0.85 0.57 181 XMSubMetaSxObfu_02 1914 0.57 0.60 0.56 182 HTML_IMAGE_ONLY_20 1909 0.48 0.32 0.56 183 RCVD_IN_SORBS_DUL 1875 0.42 0.14 0.55 184 T_Symld_Words_02 1863 0.61 0.74 0.55 185 XMhairloss01 1786 0.50 0.43 0.53 186 RELAYCOUNTRY_GB 1717 0.54 0.62 0.50 187 T_XMDrugObfuBody_00 1661 0.78 1.40 0.49 188 TR_XM_SpammyWords3 1622 1.07 2.36 0.48 189 HTML_IMAGE_ONLY_32 1606 0.40 0.25 0.47 190 HTML_IMAGE_ONLY_28 1536 0.43 0.38 0.45 191 FORGED_GMAIL_RCVD 1531 0.60 0.92 0.45 192 XM_shorewaves_Whitelist 1528 0.31 0.00 0.45 193 TO_NO_BRKTS_HTML_ONLY 1527 0.35 0.15 0.45 194 MISSING_HEADERS 1522 0.44 0.42 0.45 195 XM_B_SpammyWords4 1507 0.97 2.11 0.44 196 MSGID_FROM_MTA_HEADER 1507 0.36 0.17 0.44 197 XMPhish30 1498 0.65 1.12 0.44 198 XMSubMetaI_00 1494 0.72 1.33 0.44 199 XMHTMLBadTable_001 1493 0.59 0.90 0.44 200 XMLngstWrd_00 1477 0.54 0.77 0.43 ----------------------------------------------------------------------