Email: 678111 Autolearn: 0 AvgScore: 3.88 AvgScanTime: 1.34 sec Spam: 215066 Autolearn: 0 AvgScore: 13.76 AvgScanTime: 1.39 sec Ham: 463045 Autolearn: 0 AvgScore: -0.72 AvgScanTime: 1.32 sec Time Spent Running SA: 252.64 hours Time Spent Processing Spam: 83.28 hours Time Spent Processing Ham: 169.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204429 90.23 95.05 87.99 2 DKIM_SIGNED 176761 77.69 82.19 75.59 3 XM_DK_Pass 171566 76.06 79.77 74.33 4 DCC_CHECK 169404 50.71 78.77 37.67 5 DKIM_VALID 167955 74.01 78.09 72.11 6 XM_B_Unicode 150207 69.32 69.84 69.07 7 RELAYCOUNTRY_US 147099 78.08 68.40 82.58 8 DKIM_VALID_AU 135435 57.14 62.97 54.43 9 XM_B_SpammyWords 135387 52.94 62.95 48.28 10 XMListUnsubscribeExists 134215 52.86 62.41 48.42 11 XM_DK_Undo_02 91712 18.30 42.64 6.99 12 XM_B_SpammyWords2 79748 25.72 37.08 20.45 13 BAYES_99 76607 14.59 35.62 4.82 14 XM_B_Unicode3 73706 37.18 34.27 38.53 15 MIME_HTML_ONLY 71853 24.91 33.41 20.96 16 BAYES_50 71172 47.77 33.09 54.59 17 TR_XM_DKIM_Undo 70907 14.10 32.97 5.33 18 HTML_FONT_LOW_CONTRAST 68225 28.85 31.72 27.52 19 LOC_TINY_FONT_1 64586 25.40 30.03 23.25 20 RELAYCOUNTRY_META 64550 13.04 30.01 5.15 21 TR_DCC_Bayes_99 59939 10.50 27.87 2.43 22 BAYES_999 58882 11.24 27.38 3.74 23 RCVD_IN_MSPIKE_H2 58793 27.38 27.34 27.40 24 DKIM_VALID_EF 56511 28.78 26.28 29.94 25 UNTRUSTED_Relay 51481 9.06 23.94 2.14 26 FVGT_m_MULTI_ODD 50012 22.41 23.25 22.02 27 T_TM2_M_HEADER_IN_MSG 49429 28.04 22.98 30.38 28 T_KAM_HTML_FONT_INVALID 49234 19.52 22.89 17.96 29 XMSubLong 48224 21.55 22.42 21.14 30 DCC_CHECK_NEGATIVE 41837 47.20 19.45 60.08 31 FSL_BULK_SIG 41418 9.54 19.26 5.03 32 XM_Multi_Part_URI 39409 13.20 18.32 10.82 33 XM_Body_Dirty_Words 38255 14.41 17.79 12.84 34 RCVD_IN_MSPIKE_WL 31743 23.63 14.76 27.74 35 BOTNET 31639 5.68 14.71 1.49 36 TR_XM_SpammyWords2 30812 4.96 14.33 0.61 37 LOTS_OF_MONEY 28948 9.65 13.46 7.88 38 XM_B_Unsub 28185 11.28 13.11 10.44 39 XM_UncommonTLD01 25466 5.97 11.84 3.25 40 BOTNET_IPINHOSTNAME 24669 6.54 11.47 4.25 41 LotsOfNums_01 24230 9.16 11.27 8.18 42 XM_B_SpammyWords3 24180 7.20 11.24 5.32 43 RCVD_IN_MSPIKE_BL 22966 3.77 10.68 0.56 44 BAYES_80 22623 6.41 10.52 4.50 45 BAYES_60 21197 8.21 9.86 7.44 46 XMSexyCombo_05 20771 5.67 9.66 3.82 47 MPART_ALT_DIFF 20051 6.49 9.32 5.17 48 XM_B_Phish_Phrases 17731 7.38 8.24 6.98 49 XM_Evil_Numbers_Gen 17181 8.13 7.99 8.19 50 HTML_MIME_NO_HTML_TAG 16959 4.19 7.89 2.47 51 RCVD_IN_MSPIKE_H3 16854 12.84 7.84 15.16 52 XM_B_SpammyTLD 16622 3.71 7.73 1.84 53 RCVD_IN_BL_SPAMCOP_NET 16371 3.03 7.61 0.89 54 MIME_HTML_MOSTLY 16371 3.85 7.61 2.10 55 XM_UB50 15900 3.12 7.39 1.14 56 T_REMOTE_IMAGE 15891 4.74 7.39 3.52 57 TR_Sbj_FN_Bdy 15780 2.45 7.34 0.18 58 KHOP_HELO_FCRDNS 15434 3.52 7.18 1.83 59 RCVD_IN_MSPIKE_L3 15373 2.54 7.15 0.40 60 HTML_IMAGE_RATIO_02 15165 6.87 7.05 6.78 61 TR_XM_PhishingBody 14866 4.36 6.91 3.18 62 XMSubEmpty 14607 2.33 6.79 0.26 63 XMNoSubject 14040 2.12 6.53 0.08 64 MISSING_SUBJECT 14040 2.12 6.53 0.08 65 TR_XM_SpammyWords3 13916 2.28 6.47 0.34 66 HTML_IMAGE_ONLY_12 13707 2.22 6.37 0.30 67 RCVD_IN_MSPIKE_H4 13409 8.76 6.23 9.94 68 BAYES_95 13018 3.91 6.05 2.92 69 TooManyTo_001 12948 7.79 6.02 8.61 70 XMBrknScrpt_02 12680 2.61 5.90 1.08 71 HTML_SHORT_LINK_IMG_1 12409 1.85 5.77 0.03 72 BODY_URI_ONLY 12129 1.83 5.64 0.05 73 UNPARSEABLE_RELAY 11939 7.18 5.55 7.93 74 XMSubMetaSx_00 11352 4.01 5.28 3.42 75 SpammyFromTLD_01 11274 2.23 5.24 0.83 76 XM_UB60 11107 1.71 5.16 0.11 77 RELAYCOUNTRY_CA 10959 2.70 5.10 1.58 78 XMBody_17 10580 2.13 4.92 0.84 79 XM_B_Phish66 10503 2.96 4.88 2.07 80 URIBL_SBL_A 10381 1.69 4.83 0.23 81 RELAYCOUNTRY_SG 10031 1.51 4.66 0.04 82 XM_SendGrid 9795 6.39 4.55 7.24 83 HTML_IMAGE_RATIO_04 9785 4.99 4.55 5.19 84 XM_UB99 9781 1.44 4.55 0.00 85 RELAYCOUNTRY_IN 9522 1.56 4.43 0.23 86 XM_H_Long_From01 9262 5.00 4.31 5.32 87 TR_LOTS_OF_MONEY3 8869 1.90 4.12 0.86 88 DKIM_INVALID 8806 3.67 4.09 3.48 89 XM_DIRTYINTL 8660 1.58 4.03 0.45 90 SpammyFromTLD_02 8608 1.42 4.00 0.22 91 RELAYCOUNTRY_FR 8452 1.45 3.93 0.30 92 HTML_IMAGE_RATIO_06 8426 3.56 3.92 3.40 93 XM_UB80 8387 1.26 3.90 0.03 94 RCVD_IN_RP_RNBL 7958 1.20 3.70 0.03 95 XM_OfRef6 7872 2.02 3.66 1.25 96 XM_SPF_SoftFail 7805 2.40 3.63 1.83 97 RCVD_IN_RP_SAFE 7741 5.89 3.60 6.95 98 XMNumbers 7621 3.49 3.54 3.47 99 T_FONT_INVIS_NAKED_TO 7089 2.27 3.30 1.79 100 URI_HEX 7019 2.05 3.26 1.48 101 HTML_IMAGE_RATIO_08 6983 2.62 3.25 2.32 102 TR_XM_MaxSPIKE 6897 1.03 3.21 0.01 103 XM_B_COVIDMETA 6305 1.62 2.93 1.01 104 TR_XM_MaxBayes 6279 0.93 2.92 0.01 105 RCVD_IN_RP_CERTIFIED 6268 5.30 2.91 6.41 106 HTML_FONT_SIZE_LARGE 6020 0.98 2.80 0.14 107 XMStrtUSub 5990 4.73 2.79 5.63 108 RCVD_IN_MSPIKE_L5 5700 0.88 2.65 0.05 109 TM2_M_URI_OPT_OUT 5651 2.97 2.63 3.13 110 TR_XM_DK_SendGrid 5610 3.80 2.61 4.35 111 T_XMHurry_00 5595 1.49 2.60 0.97 112 XM_UB999 5462 0.81 2.54 0.00 113 LH_URI_DOM_IN_PATH 5288 2.06 2.46 1.88 114 BOTNET_NORDNS 5271 0.80 2.45 0.03 115 T_XMDrugObfuBody_08 5221 1.88 2.43 1.62 116 URI_TRY_3LD 5163 1.41 2.40 0.96 117 SUBJ_ALL_CAPS 5076 1.92 2.36 1.72 118 XMDiploma_00 5059 2.05 2.35 1.91 119 MIME_QP_LONG_LINE 5048 4.34 2.35 5.26 120 XM_UB95 4894 0.73 2.28 0.02 121 RELAYCOUNTRY_UA 4736 0.70 2.20 0.00 122 MIME_HTML_ONLY_MULTI 4526 3.07 2.10 3.51 123 XM_CamelCaseFrm001 4513 1.76 2.10 1.60 124 T_TooManySym_01 4464 4.05 2.08 4.96 125 RCVD_IN_PSBL 4453 0.69 2.07 0.05 126 TR_XM_SB_Phish 4180 2.22 1.94 2.35 127 ANY_BOUNCE_MESSAGE 4132 2.21 1.92 2.35 128 BOUNCE_MESSAGE 4130 2.21 1.92 2.35 129 TM2_M_VERY_LONG_WORD 4027 1.31 1.87 1.05 130 FROM_EXCESS_BASE64 3966 2.30 1.84 2.52 131 XMSexyCombo_01 3917 0.93 1.82 0.52 132 XMSubPhish11 3911 2.15 1.82 2.31 133 XM_URI_RBL 3868 0.69 1.80 0.17 134 BAYES_40 3868 4.04 1.80 5.08 135 RELAYCOUNTRY_DE 3844 0.91 1.79 0.50 136 XM_B_Unsub2 3829 2.06 1.78 2.19 137 RCVD_IN_IADB_LISTED 3828 4.07 1.78 5.14 138 XMSlimDrugH 3772 0.78 1.75 0.33 139 PDS_OTHER_BAD_TLD 3718 0.86 1.73 0.46 140 HELO_NO_DOMAIN 3647 2.00 1.70 2.14 141 HELO_NODOT 3647 2.00 1.70 2.14 142 XM_B_SpammyWords4 3586 0.93 1.67 0.58 143 TR_XM_UnparsRelay 3557 0.79 1.65 0.39 144 RELAYCOUNTRY_GB 3550 1.22 1.65 1.01 145 T_FILL_THIS_FORM_SHORT 3501 1.15 1.63 0.93 146 DKIM_ADSP_CUSTOM_MED 3424 1.28 1.59 1.14 147 XM_JunkDunk 3351 0.49 1.56 0.00 148 RCVD_IN_IADB_SPF 3249 3.52 1.51 4.46 149 NML_ADSP_CUSTOM_MED 3195 1.01 1.49 0.79 150 XMMoneyMeta_00 3143 0.86 1.46 0.58 151 TR_XM_PHPDW 3134 0.69 1.46 0.33 152 TR_XM_COVIDMETA4 3119 0.73 1.45 0.39 153 XM_DK_Undo_01 3118 1.62 1.45 1.70 154 TR_XM_PHPForged 3073 0.65 1.43 0.28 155 TR_XM_FormFill2 3046 0.64 1.42 0.28 156 XM_H_PHPOS 3035 0.64 1.41 0.28 157 T_XMDrugObfuBody_14 3017 1.59 1.40 1.68 158 TR_XM_INV_DKIM 2983 0.51 1.39 0.11 159 URI_NOVOWEL 2978 2.18 1.38 2.55 160 RCVD_IN_IADB_DK 2958 3.06 1.38 3.84 161 RCVD_IN_IADB_SENDERID 2947 3.15 1.37 3.98 162 FORGED_GMAIL_RCVD 2930 0.84 1.36 0.60 163 MAILING_LIST_MULTI 2905 2.10 1.35 2.45 164 XM_ProductURIs 2841 1.39 1.32 1.42 165 BAYES_20 2765 3.20 1.29 4.08 166 XMLngstWrd_00 2761 0.71 1.28 0.44 167 XMGenDplmaNmb 2732 1.07 1.27 0.97 168 XM_ShortIntro_01 2727 1.27 1.27 1.28 169 MISSING_HEADERS 2697 0.98 1.25 0.85 170 XMLngstWrd_01 2691 0.67 1.25 0.40 171 T_XMDrugObfuBody_00 2663 0.76 1.24 0.54 172 FROM_SUSPICIOUS_NTLD 2660 0.43 1.24 0.06 173 XMStockSpam_06 2645 1.22 1.23 1.22 174 TR_XM_PhishingBody2 2591 0.41 1.20 0.05 175 URI_OPTOUT_3LD 2568 0.42 1.19 0.06 176 FROM_SUSPICIOUS_NTLD_FP 2566 0.42 1.19 0.06 177 XMBdyGiftCard01 2537 0.75 1.18 0.55 178 XMSubNoVowel 2528 1.23 1.18 1.25 179 XMHTML_After_End 2497 0.93 1.16 0.83 180 ALL_TRUSTED 2483 9.53 1.15 13.42 181 URI_NO_WWW_BIZ_CGI 2459 0.37 1.14 0.01 182 TR_XM_RelayPhish 2429 0.44 1.13 0.12 183 XMSubMetaSxObfu_03 2369 0.66 1.10 0.46 184 TR_Mismatch_TLD_02 2363 0.41 1.10 0.10 185 MIME_CHARSET_FARAWAY 2320 0.43 1.08 0.13 186 BAYES_00 2229 9.96 1.04 14.10 187 LongTLD 2216 0.42 1.03 0.14 188 XMSubMetaI_00 2202 0.79 1.02 0.69 189 URI_PHP_REDIR 2192 0.32 1.02 0.00 190 DIET_1 2182 0.57 1.01 0.36 191 TR_XM_COVIDMETA1 2154 0.53 1.00 0.30 192 TR_Symld_Words 2124 1.85 0.99 2.24 193 TR_Mismatch_TLD_01 2072 0.44 0.96 0.20 194 HTML_TAG_BALANCE_BODY 2046 0.66 0.95 0.53 195 RCVD_IN_IADB_VOUCHED 2012 2.47 0.94 3.18 196 REMOVE_BEFORE_LINK 1952 0.46 0.91 0.25 197 XMSexyCombo_04 1940 0.38 0.90 0.14 198 REPLYTO_WITHOUT_TO_CC 1918 0.31 0.89 0.04 199 DATE_IN_PAST_03_06 1863 0.34 0.87 0.10 200 XMLngstWrd_02 1814 0.49 0.84 0.33 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 407448 90.23 95.05 87.99 2 RELAYCOUNTRY_US 382382 78.08 68.40 82.58 3 DKIM_SIGNED 350037 77.69 82.19 75.59 4 XM_DK_Pass 344175 76.06 79.77 74.33 5 DKIM_VALID 333923 74.01 78.09 72.11 6 XM_B_Unicode 319844 69.32 69.84 69.07 7 DCC_CHECK_NEGATIVE 278207 47.20 19.45 60.08 8 BAYES_50 252771 47.77 33.09 54.59 9 DKIM_VALID_AU 252054 57.14 62.97 54.43 10 XMListUnsubscribeExists 224214 52.86 62.41 48.42 11 XM_B_SpammyWords 223574 52.94 62.95 48.28 12 XM_B_Unicode3 178432 37.18 34.27 38.53 13 DCC_CHECK 174448 50.71 78.77 37.67 14 T_TM2_M_HEADER_IN_MSG 140684 28.04 22.98 30.38 15 DKIM_VALID_EF 138643 28.78 26.28 29.94 16 RCVD_IN_MSPIKE_WL 128463 23.63 14.76 27.74 17 HTML_FONT_LOW_CONTRAST 127426 28.85 31.72 27.52 18 RCVD_IN_MSPIKE_H2 126890 27.38 27.34 27.40 19 LOC_TINY_FONT_1 107643 25.40 30.03 23.25 20 FVGT_m_MULTI_ODD 101983 22.41 23.25 22.02 21 XMSubLong 97896 21.55 22.42 21.14 22 MIME_HTML_ONLY 97062 24.91 33.41 20.96 23 XM_B_SpammyWords2 94692 25.72 37.08 20.45 24 T_KAM_HTML_FONT_INVALID 83151 19.52 22.89 17.96 25 RCVD_IN_MSPIKE_H3 70194 12.84 7.84 15.16 26 BAYES_00 65294 9.96 1.04 14.10 27 ALL_TRUSTED 62125 9.53 1.15 13.42 28 XM_Body_Dirty_Words 59446 14.41 17.79 12.84 29 XM_Multi_Part_URI 50088 13.20 18.32 10.82 30 XM_B_Unsub 48322 11.28 13.11 10.44 31 RCVD_IN_MSPIKE_H4 46019 8.76 6.23 9.94 32 TR_XM_DK_Bayes 42417 6.51 0.81 9.16 33 TR_XM_DK_Bayes1 41116 6.31 0.78 8.88 34 XM_DKIMWhitelistDomains 40489 5.98 0.03 8.74 35 TooManyTo_001 39872 7.79 6.02 8.61 36 XM_Evil_Numbers_Gen 37921 8.13 7.99 8.19 37 LotsOfNums_01 37890 9.16 11.27 8.18 38 UNPARSEABLE_RELAY 36725 7.18 5.55 7.93 39 LOTS_OF_MONEY 36502 9.65 13.46 7.88 40 TR_XM_DK_Bayes2 35503 5.42 0.57 7.67 41 BAYES_60 34450 8.21 9.86 7.44 42 XM_SendGrid 33544 6.39 4.55 7.24 43 XM_DK_Undo_02 32364 18.30 42.64 6.99 44 XM_B_Phish_Phrases 32340 7.38 8.24 6.98 45 RCVD_IN_RP_SAFE 32199 5.89 3.60 6.95 46 HTML_IMAGE_RATIO_02 31397 6.87 7.05 6.78 47 IN_ZIMBRA_NJ_WHITELIST 30401 4.50 0.04 6.57 48 RCVD_IN_RP_CERTIFIED 29680 5.30 2.91 6.41 49 XMStrtUSub 26092 4.73 2.79 5.63 50 TR_XM_DKIM_Undo 24693 14.10 32.97 5.33 51 XM_H_Long_From01 24646 5.00 4.31 5.32 52 XM_B_SpammyWords3 24627 7.20 11.24 5.32 53 MIME_QP_LONG_LINE 24362 4.34 2.35 5.26 54 HTML_IMAGE_RATIO_04 24033 4.99 4.55 5.19 55 MPART_ALT_DIFF 23929 6.49 9.32 5.17 56 RELAYCOUNTRY_META 23853 13.04 30.01 5.15 57 RCVD_IN_IADB_LISTED 23796 4.07 1.78 5.14 58 BAYES_40 23523 4.04 1.80 5.08 59 FSL_BULK_SIG 23274 9.54 19.26 5.03 60 T_TooManySym_01 22967 4.05 2.08 4.96 61 BAYES_99 22309 14.59 35.62 4.82 62 XM_PDF 21736 3.46 0.82 4.69 63 BAYES_80 20834 6.41 10.52 4.50 64 RCVD_IN_IADB_SPF 20630 3.52 1.51 4.46 65 TR_XM_DK_SendGrid 20125 3.80 2.61 4.35 66 BOTNET_IPINHOSTNAME 19671 6.54 11.47 4.25 67 BAYES_20 18904 3.20 1.29 4.08 68 RCVD_IN_IADB_SENDERID 18417 3.15 1.37 3.98 69 RCVD_IN_IADB_DK 17781 3.06 1.38 3.84 70 XMSexyCombo_05 17698 5.67 9.66 3.82 71 BAYES_999 17330 11.24 27.38 3.74 72 T_REMOTE_IMAGE 16284 4.74 7.39 3.52 73 MIME_HTML_ONLY_MULTI 16274 3.07 2.10 3.51 74 DKIM_INVALID 16114 3.67 4.09 3.48 75 XMNumbers 16046 3.49 3.54 3.47 76 XMSubMetaSx_00 15844 4.01 5.28 3.42 77 HTML_IMAGE_RATIO_06 15732 3.56 3.92 3.40 78 XM_UncommonTLD01 15029 5.97 11.84 3.25 79 RCVD_IN_IADB_VOUCHED 14737 2.47 0.94 3.18 80 TR_XM_PhishingBody 14721 4.36 6.91 3.18 81 TM2_M_URI_OPT_OUT 14492 2.97 2.63 3.13 82 XM_H_Trusted_IP 14014 2.07 0.00 3.03 83 BAYES_95 13515 3.91 6.05 2.92 84 RCVD_IN_MSPIKE_H5 12250 2.02 0.69 2.65 85 URI_NOVOWEL 11800 2.18 1.38 2.55 86 FROM_EXCESS_BASE64 11654 2.30 1.84 2.52 87 HTML_MIME_NO_HTML_TAG 11460 4.19 7.89 2.47 88 BAYES_05 11443 1.92 0.74 2.47 89 MAILING_LIST_MULTI 11354 2.10 1.35 2.45 90 TR_DCC_Bayes_99 11246 10.50 27.87 2.43 91 T_TooManySym_02 11163 1.84 0.60 2.41 92 TooManyTo_002 11009 1.83 0.65 2.38 93 TR_XM_SB_Phish 10889 2.22 1.94 2.35 94 ANY_BOUNCE_MESSAGE 10874 2.21 1.92 2.35 95 BOUNCE_MESSAGE 10873 2.21 1.92 2.35 96 HTML_IMAGE_RATIO_08 10759 2.62 3.25 2.32 97 XMSubPhish11 10681 2.15 1.82 2.31 98 TR_Symld_Words 10388 1.85 0.99 2.24 99 XM_B_Unsub2 10149 2.06 1.78 2.19 100 UNTRUSTED_Relay 9927 9.06 23.94 2.14 101 HELO_NODOT 9921 2.00 1.70 2.14 102 HELO_NO_DOMAIN 9919 2.00 1.70 2.14 103 MIME_HTML_MOSTLY 9707 3.85 7.61 2.10 104 RCVD_IN_IADB_OPTIN 9595 1.61 0.60 2.07 105 XM_B_Phish66 9588 2.96 4.88 2.07 106 XMDiploma_00 8833 2.05 2.35 1.91 107 LH_URI_DOM_IN_PATH 8690 2.06 2.46 1.88 108 XM_B_SpammyTLD 8532 3.71 7.73 1.84 109 XM_SPF_SoftFail 8490 2.40 3.63 1.83 110 KHOP_HELO_FCRDNS 8465 3.52 7.18 1.83 111 T_FONT_INVIS_NAKED_TO 8275 2.27 3.30 1.79 112 SUBJ_ALL_CAPS 7965 1.92 2.36 1.72 113 XM_DK_Undo_01 7864 1.62 1.45 1.70 114 T_XMDrugObfuBody_14 7763 1.59 1.40 1.68 115 T_XMDrugObfuBody_08 7500 1.88 2.43 1.62 116 XM_CamelCaseFrm001 7397 1.76 2.10 1.60 117 RELAYCOUNTRY_CA 7325 2.70 5.10 1.58 118 USER_IN_DEF_DKIM_WL 7278 1.08 0.01 1.57 119 TooManyTo_003 7248 1.23 0.52 1.57 120 IN_HORDE_ADDRESS_BOOK 7236 1.09 0.06 1.56 121 INVALID_MSGID 7181 1.11 0.15 1.55 122 BOTNET 6900 5.68 14.71 1.49 123 TVD_RCVD_IP 6863 1.06 0.14 1.48 124 URI_HEX 6859 2.05 3.26 1.48 125 XM_ProductURIs 6574 1.39 1.32 1.42 126 TO_MALFORMED 6523 0.97 0.01 1.41 127 XMCapTrack 6152 1.06 0.49 1.33 128 XM_ShortIntro_01 5912 1.27 1.27 1.28 129 XMSubNoVowel 5810 1.23 1.18 1.25 130 XM_OfRef6 5808 2.02 3.66 1.25 131 XMGappySubj_01 5700 0.88 0.14 1.23 132 HELO_MISC_IP 5675 0.91 0.24 1.23 133 CK_HELO_DYNAMIC_SPLIT_IP 5668 0.91 0.24 1.22 134 XMStockSpam_06 5632 1.22 1.23 1.22 135 XM_GoogleGroups 5315 0.91 0.39 1.15 136 XM_UB50 5273 3.12 7.39 1.14 137 DKIM_ADSP_CUSTOM_MED 5271 1.28 1.59 1.14 138 TooManyTo_004 5115 0.89 0.44 1.10 139 XMBSHREFv2 5038 0.85 0.32 1.09 140 XMBrknScrpt_02 5015 2.61 5.90 1.08 141 HTML_FONT_FACE_BAD 4894 0.88 0.50 1.06 142 TM2_M_VERY_LONG_WORD 4847 1.31 1.87 1.05 143 RELAYCOUNTRY_GB 4696 1.22 1.65 1.01 144 XM_B_COVIDMETA 4663 1.62 2.93 1.01 145 XM_H_Long_From02 4610 0.88 0.64 1.00 146 TR_MetaPhish_Combo_01 4606 0.95 0.84 0.99 147 XMGenDplmaNmb 4509 1.07 1.27 0.97 148 T_XMHurry_00 4507 1.49 2.60 0.97 149 URI_TRY_3LD 4425 1.41 2.40 0.96 150 T_TooManySym_03 4368 0.69 0.13 0.94 151 T_FILL_THIS_FORM_SHORT 4306 1.15 1.63 0.93 152 TooManyTo_005 4304 0.75 0.38 0.93 153 RCVD_IN_BL_SPAMCOP_NET 4142 3.03 7.61 0.89 154 TR_LOTS_OF_MONEY3 3994 1.90 4.12 0.86 155 MISSING_HEADERS 3940 0.98 1.25 0.85 156 XMBody_17 3875 2.13 4.92 0.84 157 XMHTML_After_End 3842 0.93 1.16 0.83 158 SpammyFromTLD_01 3829 2.23 5.24 0.83 159 HTTPS_HTTP_MISMATCH 3794 0.77 0.67 0.82 160 XMBody_95 3673 0.56 0.05 0.79 161 NML_ADSP_CUSTOM_MED 3668 1.01 1.49 0.79 162 TR_MSPIKEBAYES00 3439 0.52 0.03 0.74 163 XM_E_Blogspot 3282 0.50 0.05 0.71 164 XM_SPF_Unknown 3262 0.71 0.72 0.70 165 XMSubMetaI_00 3184 0.79 1.02 0.69 166 T_OBFU_PDF_ATTACH 3072 0.50 0.14 0.66 167 XM_H_PHPMailer 2888 0.59 0.51 0.62 168 XMNoVowels 2852 0.58 0.51 0.62 169 TR_XM_SpammyWords2 2813 4.96 14.33 0.61 170 FORGED_GMAIL_RCVD 2787 0.84 1.36 0.60 171 NUMERIC_HTTP_ADDR 2715 0.58 0.57 0.59 172 XM_B_SpammyWords4 2706 0.93 1.67 0.58 173 XMMoneyMeta_00 2678 0.86 1.46 0.58 174 DKIM_ADSP_NXDOMAIN 2609 0.59 0.66 0.56 175 FROM_GOV_SPOOF 2606 0.43 0.13 0.56 176 RCVD_IN_MSPIKE_BL 2594 3.77 10.68 0.56 177 RCVD_IN_SORBS_DUL 2592 0.44 0.17 0.56 178 T_TooManySym_04 2545 0.39 0.04 0.55 179 XMBdyGiftCard01 2545 0.75 1.18 0.55 180 FROM_GOV_DKIM_AU 2519 0.41 0.13 0.54 181 NO_DNS_FOR_FROM 2503 0.54 0.54 0.54 182 T_XMDrugObfuBody_00 2493 0.76 1.24 0.54 183 HTML_TAG_BALANCE_BODY 2454 0.66 0.95 0.53 184 SHORT_HELO_AND_INLINE_IMAGE 2435 0.38 0.05 0.53 185 XMSexyCombo_01 2414 0.93 1.82 0.52 186 TM2_M_BODY_EMPTY 2403 0.37 0.05 0.52 187 T_Symld_Words_02 2402 0.53 0.55 0.52 188 HTML_IMAGE_ONLY_20 2372 0.43 0.25 0.51 189 RELAYCOUNTRY_DE 2338 0.91 1.79 0.50 190 RDNS_DYNAMIC 2314 0.59 0.77 0.50 191 XM_S_SubURI 2295 0.36 0.05 0.50 192 XMHTMLBadTable_001 2286 0.56 0.70 0.49 193 HTML_IMAGE_ONLY_28 2131 0.41 0.30 0.46 194 XMSubMetaSxObfu_03 2128 0.66 1.10 0.46 195 PDS_OTHER_BAD_TLD 2115 0.86 1.73 0.46 196 XM_DIRTYINTL 2065 1.58 4.03 0.45 197 XMLngstWrd_00 2050 0.71 1.28 0.44 198 HTML_IMAGE_ONLY_32 2036 0.37 0.23 0.44 199 T_MANY_PILL_PRICE 1965 0.29 0.00 0.42 200 T_TooManySym_05 1890 0.28 0.00 0.41 ----------------------------------------------------------------------