Email: 642810 Autolearn: 0 AvgScore: 4.27 AvgScanTime: 1.16 sec Spam: 205348 Autolearn: 0 AvgScore: 14.72 AvgScanTime: 1.35 sec Ham: 437462 Autolearn: 0 AvgScore: -0.64 AvgScanTime: 1.07 sec Time Spent Running SA: 206.53 hours Time Spent Processing Spam: 76.89 hours Time Spent Processing Ham: 129.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 197275 90.14 96.07 87.36 2 DKIM_SIGNED 175240 74.41 85.34 69.28 3 XM_DK_Pass 170646 72.94 83.10 68.17 4 DKIM_VALID 166637 70.86 81.15 66.04 5 DCC_CHECK 161915 47.81 78.85 33.24 6 XM_B_Unicode 158664 71.47 77.27 68.75 7 RELAYCOUNTRY_US 150767 76.41 73.42 77.81 8 XMListUnsubscribeExists 141823 51.14 69.06 42.72 9 XM_B_SpammyWords 141732 53.55 69.02 46.28 10 DKIM_VALID_AU 128925 54.47 62.78 50.56 11 XM_DK_Undo_02 109852 21.86 53.50 7.01 12 TR_XM_DKIM_Undo 91363 17.37 44.49 4.64 13 BAYES_99 89221 17.44 43.45 5.23 14 XM_B_Unicode3 82815 37.83 40.33 36.66 15 XM_B_SpammyWords2 80787 26.36 39.34 20.26 16 BAYES_999 73888 14.37 35.98 4.22 17 LOC_TINY_FONT_1 73848 25.29 35.96 20.28 18 TR_DCC_Bayes_99 71139 12.41 34.64 1.97 19 MIME_HTML_ONLY 64976 23.57 31.64 19.78 20 BAYES_50 62960 49.81 30.66 58.80 21 HTML_FONT_LOW_CONTRAST 61716 27.01 30.05 25.58 22 RCVD_IN_MSPIKE_H2 61680 26.75 30.04 25.21 23 T_KAM_HTML_FONT_INVALID 61097 20.43 29.75 16.06 24 DKIM_VALID_EF 59574 27.87 29.01 27.33 25 FVGT_m_MULTI_ODD 57051 24.11 27.78 22.39 26 XMSubLong 49738 20.50 24.22 18.75 27 RELAYCOUNTRY_META 47215 10.54 22.99 4.70 28 RCVD_IN_MSPIKE_WL 44857 24.82 21.84 26.21 29 T_TM2_M_HEADER_IN_MSG 41915 30.13 20.41 34.69 30 DCC_CHECK_NEGATIVE 39149 50.19 19.06 64.80 31 XM_Body_Dirty_Words 37613 13.17 18.32 10.75 32 UNTRUSTED_Relay 37530 6.99 18.28 1.70 33 LOTS_OF_MONEY 36292 11.40 17.67 8.46 34 XM_UncommonTLD01 36066 7.86 17.56 3.30 35 TR_XM_SpammyWords2 35302 5.95 17.19 0.67 36 TR_XM_SpammyWords4 32422 9.21 15.79 6.12 37 BOTNET 31337 5.99 15.26 1.64 38 XM_Multi_Part_URI 28359 11.25 13.81 10.04 39 FSL_BULK_SIG 27873 8.38 13.57 5.94 40 XM_B_SpammyWords3 26105 6.54 12.71 3.64 41 XM_B_Unsub 24166 10.40 11.77 9.76 42 RCVD_IN_MSPIKE_H3 23770 13.73 11.58 14.74 43 BOTNET_IPINHOSTNAME 23301 6.60 11.35 4.37 44 XM_Evil_Numbers_Gen 22549 10.24 10.98 9.89 45 XMSexyCombo_05 20708 5.54 10.08 3.40 46 RCVD_IN_BL_SPAMCOP_NET 20508 3.74 9.99 0.80 47 MPART_ALT_DIFF 19931 6.38 9.71 4.82 48 LotsOfNums_01 19665 8.05 9.58 7.34 49 SpammyFromTLD_02 19644 3.17 9.57 0.17 50 RCVD_IN_MSPIKE_H4 19412 9.35 9.45 9.30 51 BAYES_80 18858 5.89 9.18 4.34 52 URIBL_SBL_A 16817 3.59 8.19 1.43 53 KHOP_HELO_FCRDNS 16684 3.85 8.12 1.85 54 MIME_HTML_MOSTLY 16416 3.94 7.99 2.03 55 UNPARSEABLE_RELAY 15833 7.26 7.71 7.05 56 HTML_IMAGE_RATIO_02 15762 6.78 7.68 6.36 57 TR_XM_UnparsRelay 15587 6.50 7.59 5.98 58 BAYES_60 15440 8.30 7.52 8.67 59 XMSubMetaSx_00 14625 4.77 7.12 3.67 60 XM_OfRef6 14422 2.84 7.02 0.87 61 XM_B_Phish_Phrases 14367 4.86 7.00 3.86 62 XM_SendGrid 13034 6.42 6.35 6.45 63 HTML_SHORT_LINK_IMG_1 12679 1.99 6.17 0.03 64 RELAYCOUNTRY_CA 12567 2.79 6.12 1.23 65 HTML_IMAGE_ONLY_12 12393 2.10 6.04 0.25 66 XM_H_Long_From01 12327 5.43 6.00 5.16 67 XM_DK_Undo_01 12248 2.88 5.96 1.43 68 BODY_URI_ONLY 12065 1.88 5.88 0.00 69 TR_XM_PhishingBody 11517 3.83 5.61 3.00 70 HTML_FONT_SIZE_LARGE 11258 1.85 5.48 0.15 71 XM_UB50 11019 2.51 5.37 1.17 72 BAYES_95 10943 3.50 5.33 2.64 73 RCVD_IN_RP_SAFE 10897 6.36 5.31 6.86 74 SpammyFromTLD_01 10507 2.16 5.12 0.77 75 XMNumbers 10484 3.87 5.11 3.30 76 TR_XM_MaxBayes 10424 1.64 5.08 0.03 77 TooManyTo_001 10181 7.84 4.96 9.20 78 XM_UB99 9800 1.53 4.77 0.00 79 HTML_IMAGE_RATIO_04 9448 4.83 4.60 4.94 80 RELAYCOUNTRY_FR 9409 1.65 4.58 0.28 81 T_FILL_THIS_FORM_SHORT 9092 2.01 4.43 0.88 82 TR_LOTS_OF_MONEY3 9038 1.64 4.40 0.34 83 RCVD_IN_RP_CERTIFIED 8904 5.53 4.34 6.10 84 DKIM_INVALID 8603 3.54 4.19 3.24 85 TR_XM_SpammyWords5 8491 2.35 4.13 1.51 86 XM_B_SpammyTLD 8039 2.50 3.91 1.84 87 TR_XM_DK_SendGrid 7859 4.10 3.83 4.22 88 XMDiploma_00 7440 2.70 3.62 2.27 89 TR_XM_FormFill 7059 1.11 3.44 0.02 90 XM_UB80 6766 1.08 3.29 0.03 91 XM_UB999 6600 1.03 3.21 0.00 92 TM2_M_URI_OPT_OUT 6556 2.66 3.19 2.41 93 XM_B_Phish66 6416 2.39 3.12 2.04 94 XM_SPF_SoftFail 6230 2.09 3.03 1.64 95 XMStrtUSub 6162 5.00 3.00 5.94 96 URI_HEX 6156 1.80 3.00 1.24 97 HTML_IMAGE_RATIO_06 6059 3.34 2.95 3.52 98 XMBrknScrpt_02 5976 1.40 2.91 0.69 99 FORGED_GMAIL_RCVD 5957 1.36 2.90 0.64 100 MIME_QP_LONG_LINE 5949 4.11 2.90 4.68 101 RCVD_IN_MSPIKE_BL 5830 1.03 2.84 0.18 102 TR_XM_MSPIKECOMBO 5728 1.01 2.79 0.18 103 URIBL_DBL_SPAM 5570 0.87 2.71 0.01 104 XM_UB60 5534 0.96 2.69 0.14 105 T_XMHurry_00 5498 3.39 2.68 3.73 106 XM_DIRTYINTL 5430 1.08 2.64 0.34 107 XMSubMetaSxObfu_03 5267 1.51 2.56 1.01 108 RCVD_IN_RP_RNBL 5204 0.83 2.53 0.03 109 T_XMDrugObfuBody_08 5202 1.73 2.53 1.35 110 MIME_HTML_ONLY_MULTI 5200 2.99 2.53 3.20 111 T_TooManySym_01 5055 4.23 2.46 5.06 112 HTML_IMAGE_RATIO_08 4987 2.35 2.43 2.31 113 RCVD_IN_PSBL 4986 0.82 2.43 0.06 114 PDS_OTHER_BAD_TLD 4883 1.10 2.38 0.49 115 T_XMDrugObfuBody_14 4863 2.05 2.37 1.90 116 GOOGLE_DOC_SUSP 4817 0.76 2.35 0.01 117 BOTNET_NORDNS 4728 0.74 2.30 0.01 118 TR_XM_BayesRelay 4617 0.73 2.25 0.02 119 XM_B_COVIDMETA 4577 1.40 2.23 1.01 120 RELAYCOUNTRY_DE 4496 1.12 2.19 0.61 121 SUBJ_ALL_CAPS 4480 1.82 2.18 1.65 122 URI_PHP_REDIR 4382 0.68 2.13 0.00 123 XM_CamelCaseFrm001 4333 1.79 2.11 1.65 124 RCVD_IN_MSPIKE_L5 4311 0.77 2.10 0.15 125 XMBody_17 4304 1.06 2.10 0.57 126 RCVD_IN_IADB_LISTED 4271 3.66 2.08 4.40 127 HTML_MIME_NO_HTML_TAG 4262 2.29 2.08 2.40 128 TR_XM_SpammyWords3 4182 0.74 2.04 0.14 129 T_REMOTE_IMAGE 4012 3.40 1.95 4.08 130 XMBdyGiftCard01 3984 0.83 1.94 0.30 131 FROM_EXCESS_BASE64 3971 2.60 1.93 2.91 132 TM2_M_VERY_LONG_WORD 3932 1.46 1.91 1.24 133 TR_XM_SB_Phish 3919 2.07 1.91 2.15 134 XMGenDplmaNmb 3896 1.54 1.90 1.37 135 XMSubPhish11 3827 2.04 1.86 2.12 136 URI_NOVOWEL 3822 2.27 1.86 2.46 137 XM_UB95 3763 0.59 1.83 0.01 138 XM_OfRef7 3750 0.66 1.83 0.11 139 TR_XM_INV_DKIM 3686 0.63 1.80 0.08 140 RCVD_IN_IADB_SPF 3681 3.17 1.79 3.82 141 XM_B_Unsub2 3465 1.67 1.69 1.66 142 TR_LOTS_OF_MONEY2 3451 0.67 1.68 0.20 143 T_MONEY_PERCENT 3451 0.67 1.68 0.20 144 RCVD_IN_IADB_DK 3435 2.76 1.67 3.27 145 RCVD_IN_IADB_SENDERID 3410 2.84 1.66 3.39 146 RELAYCOUNTRY_IN 3279 0.58 1.60 0.10 147 XMSexyCombo_01 3272 0.79 1.59 0.41 148 TR_Symld_Words 3265 1.45 1.59 1.39 149 TR_XM_COVIDMETA4 3230 0.78 1.57 0.42 150 XM_B_SpammyWords4 3107 0.70 1.51 0.32 151 T_Symld_Words_02 3095 0.82 1.51 0.49 152 MAILING_LIST_MULTI 3094 2.26 1.51 2.62 153 URI_TRY_3LD 3083 1.13 1.50 0.96 154 XMStockSpam_06 3022 1.27 1.47 1.17 155 RELAYCOUNTRY_GB 2897 1.22 1.41 1.13 156 T_XMDrugObfuBody_00 2708 0.80 1.32 0.55 157 XM_URI_RBL 2708 0.51 1.32 0.12 158 URIBL_BLACK 2697 0.45 1.31 0.04 159 XMMoneyMeta_00 2649 0.78 1.29 0.54 160 TR_XM_PHPDW 2625 0.68 1.28 0.40 161 HK_RANDOM_REPLYTO 2585 0.49 1.26 0.12 162 BAYES_40 2578 3.45 1.26 4.48 163 XM_Body_Dirty_Words_01 2523 0.50 1.23 0.15 164 FONT_INVIS_LONG_LINE 2522 0.45 1.23 0.09 165 MONEY_FRAUD_3 2506 0.39 1.22 0.00 166 FROM_SUSPICIOUS_NTLD 2453 0.43 1.19 0.07 167 TR_XM_COVIDMETA1 2428 0.60 1.18 0.32 168 ALL_TRUSTED 2404 13.34 1.17 19.05 169 XM_Body_Obfu01 2398 0.53 1.17 0.23 170 FROM_SUSPICIOUS_NTLD_FP 2367 0.41 1.15 0.06 171 TR_XM_PHPForged 2357 0.59 1.15 0.33 172 TR_XM_FormFill2 2332 0.59 1.14 0.33 173 XM_H_PHPOS 2319 0.58 1.13 0.32 174 XM_JunkDunk 2290 0.36 1.12 0.00 175 XMSubMetaI_00 2280 0.64 1.11 0.42 176 XM_RXBody 2272 0.74 1.11 0.57 177 DIET_1 2207 0.84 1.07 0.73 178 TR_Caps_n_Bayes_99 2172 0.37 1.06 0.05 179 RCVD_IN_IADB_VOUCHED 2164 2.25 1.05 2.82 180 BAYES_20 2161 2.68 1.05 3.44 181 URG_BIZ 2154 0.36 1.05 0.03 182 RDNS_DYNAMIC 2149 0.68 1.05 0.50 183 XMHTML_After_End 2140 1.05 1.04 1.05 184 XM_Nigeria_01 2135 0.36 1.04 0.04 185 XMPhish08 2124 0.49 1.03 0.24 186 MILLION_USD 2107 0.34 1.03 0.01 187 MONEY_NOHTML 2069 0.40 1.01 0.11 188 HTTPS_HTTP_MISMATCH 2024 0.88 0.99 0.83 189 TR_Mismatch_TLD_02 2019 0.37 0.98 0.09 190 TR_XM_RelayPhish 1963 0.35 0.96 0.07 191 XM_PDF 1945 4.23 0.95 5.77 192 LOADSA_MONEY_COMBO 1866 0.32 0.91 0.04 193 BAYES_00 1853 7.16 0.90 10.10 194 NUMERIC_HTTP_ADDR 1804 0.51 0.88 0.34 195 RELAYCOUNTRY_CH 1778 0.31 0.87 0.05 196 T_TooManySym_02 1726 2.07 0.84 2.65 197 FILL_THIS_FORM 1724 0.48 0.84 0.31 198 HTML_TAG_BALANCE_BODY 1720 0.48 0.84 0.31 199 SUBJ_DOLLARS 1715 0.48 0.84 0.32 200 HTML_FONT_FACE_BAD 1698 1.19 0.83 1.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 382158 90.14 96.07 87.36 2 RELAYCOUNTRY_US 340395 76.41 73.42 77.81 3 DKIM_SIGNED 303052 74.41 85.34 69.28 4 XM_B_Unicode 300746 71.47 77.27 68.75 5 XM_DK_Pass 298200 72.94 83.10 68.17 6 DKIM_VALID 288889 70.86 81.15 66.04 7 DCC_CHECK_NEGATIVE 283462 50.19 19.06 64.80 8 BAYES_50 257220 49.81 30.66 58.80 9 DKIM_VALID_AU 221185 54.47 62.78 50.56 10 XM_B_SpammyWords 202476 53.55 69.02 46.28 11 XMListUnsubscribeExists 186898 51.14 69.06 42.72 12 XM_B_Unicode3 160362 37.83 40.33 36.66 13 T_TM2_M_HEADER_IN_MSG 151771 30.13 20.41 34.69 14 DCC_CHECK 145417 47.81 78.85 33.24 15 DKIM_VALID_EF 119577 27.87 29.01 27.33 16 RCVD_IN_MSPIKE_WL 114660 24.82 21.84 26.21 17 HTML_FONT_LOW_CONTRAST 111920 27.01 30.05 25.58 18 RCVD_IN_MSPIKE_H2 110268 26.75 30.04 25.21 19 FVGT_m_MULTI_ODD 97944 24.11 27.78 22.39 20 LOC_TINY_FONT_1 88706 25.29 35.96 20.28 21 XM_B_SpammyWords2 88642 26.36 39.34 20.26 22 MIME_HTML_ONLY 86541 23.57 31.64 19.78 23 ALL_TRUSTED 83344 13.34 1.17 19.05 24 XMSubLong 82009 20.50 24.22 18.75 25 T_KAM_HTML_FONT_INVALID 70252 20.43 29.75 16.06 26 RCVD_IN_MSPIKE_H3 64464 13.73 11.58 14.74 27 XM_Body_Dirty_Words 47048 13.17 18.32 10.75 28 BAYES_00 44188 7.16 0.90 10.10 29 XM_Multi_Part_URI 43925 11.25 13.81 10.04 30 XM_Evil_Numbers_Gen 43260 10.24 10.98 9.89 31 XM_B_Unsub 42677 10.40 11.77 9.76 32 RCVD_IN_MSPIKE_H4 40672 9.35 9.45 9.30 33 TooManyTo_001 40246 7.84 4.96 9.20 34 BAYES_60 37911 8.30 7.52 8.67 35 LOTS_OF_MONEY 37008 11.40 17.67 8.46 36 XM_DKIMWhitelistDomains 35389 5.58 0.22 8.09 37 LotsOfNums_01 32095 8.05 9.58 7.34 38 UNPARSEABLE_RELAY 30848 7.26 7.71 7.05 39 XM_DK_Undo_02 30686 21.86 53.50 7.01 40 RCVD_IN_RP_SAFE 29991 6.36 5.31 6.86 41 TR_XM_DK_Bayes 29001 4.70 0.60 6.63 42 XM_SendGrid 28205 6.42 6.35 6.45 43 TR_XM_DK_Bayes1 28129 4.57 0.59 6.43 44 HTML_IMAGE_RATIO_02 27837 6.78 7.68 6.36 45 TR_XM_SpammyWords4 26772 9.21 15.79 6.12 46 RCVD_IN_RP_CERTIFIED 26674 5.53 4.34 6.10 47 TR_XM_UnparsRelay 26170 6.50 7.59 5.98 48 XMStrtUSub 25991 5.00 3.00 5.94 49 FSL_BULK_SIG 25968 8.38 13.57 5.94 50 XM_PDF 25224 4.23 0.95 5.77 51 TR_XM_DK_Bayes2 24577 3.99 0.52 5.62 52 IN_ZIMBRA_NJ_WHITELIST 23805 3.72 0.05 5.44 53 BAYES_99 22870 17.44 43.45 5.23 54 XM_H_Long_From01 22565 5.43 6.00 5.16 55 T_TooManySym_01 22130 4.23 2.46 5.06 56 HTML_IMAGE_RATIO_04 21599 4.83 4.60 4.94 57 MPART_ALT_DIFF 21106 6.38 9.71 4.82 58 RELAYCOUNTRY_META 20561 10.54 22.99 4.70 59 MIME_QP_LONG_LINE 20452 4.11 2.90 4.68 60 TR_XM_DKIM_Undo 20307 17.37 44.49 4.64 61 BAYES_40 19602 3.45 1.26 4.48 62 RCVD_IN_IADB_LISTED 19250 3.66 2.08 4.40 63 BOTNET_IPINHOSTNAME 19096 6.60 11.35 4.37 64 BAYES_80 18981 5.89 9.18 4.34 65 TR_XM_DK_SendGrid 18480 4.10 3.83 4.22 66 BAYES_999 18480 14.37 35.98 4.22 67 XM_H_Trusted_IP 17950 2.79 0.00 4.10 68 T_REMOTE_IMAGE 17847 3.40 1.95 4.08 69 XM_B_Phish_Phrases 16902 4.86 7.00 3.86 70 RCVD_IN_IADB_SPF 16713 3.17 1.79 3.82 71 T_XMHurry_00 16323 3.39 2.68 3.73 72 XMSubMetaSx_00 16052 4.77 7.12 3.67 73 XM_B_SpammyWords3 15925 6.54 12.71 3.64 74 HTML_IMAGE_RATIO_06 15417 3.34 2.95 3.52 75 BAYES_20 15042 2.68 1.05 3.44 76 XMSexyCombo_05 14891 5.54 10.08 3.40 77 RCVD_IN_IADB_SENDERID 14835 2.84 1.66 3.39 78 XM_UncommonTLD01 14456 7.86 17.56 3.30 79 XMNumbers 14418 3.87 5.11 3.30 80 RCVD_IN_IADB_DK 14307 2.76 1.67 3.27 81 DKIM_INVALID 14163 3.54 4.19 3.24 82 MIME_HTML_ONLY_MULTI 13989 2.99 2.53 3.20 83 TR_XM_PhishingBody 13110 3.83 5.61 3.00 84 FROM_EXCESS_BASE64 12724 2.60 1.93 2.91 85 RCVD_IN_IADB_VOUCHED 12323 2.25 1.05 2.82 86 T_TooManySym_02 11580 2.07 0.84 2.65 87 BAYES_95 11555 3.50 5.33 2.64 88 MAILING_LIST_MULTI 11446 2.26 1.51 2.62 89 TooManyTo_002 10965 1.90 0.61 2.51 90 URI_NOVOWEL 10755 2.27 1.86 2.46 91 TM2_M_URI_OPT_OUT 10555 2.66 3.19 2.41 92 HTML_MIME_NO_HTML_TAG 10482 2.29 2.08 2.40 93 ANY_BOUNCE_MESSAGE 10231 1.74 0.47 2.34 94 BOUNCE_MESSAGE 10202 1.74 0.47 2.33 95 HTML_IMAGE_RATIO_08 10117 2.35 2.43 2.31 96 BAYES_05 10093 1.78 0.65 2.31 97 XMDiploma_00 9934 2.70 3.62 2.27 98 HELO_NODOT 9593 1.67 0.57 2.19 99 HELO_NO_DOMAIN 9592 1.67 0.55 2.19 100 RCVD_IN_MSPIKE_H5 9524 1.74 0.82 2.18 101 TR_XM_SB_Phish 9398 2.07 1.91 2.15 102 XMSubPhish11 9295 2.04 1.86 2.12 103 XM_B_Phish66 8918 2.39 3.12 2.04 104 MIME_HTML_MOSTLY 8893 3.94 7.99 2.03 105 TR_DCC_Bayes_99 8609 12.41 34.64 1.97 106 RCVD_IN_IADB_OPTIN 8397 1.52 0.68 1.92 107 T_XMDrugObfuBody_14 8299 2.05 2.37 1.90 108 KHOP_HELO_FCRDNS 8087 3.85 8.12 1.85 109 XM_B_SpammyTLD 8044 2.50 3.91 1.84 110 TVD_RCVD_IP 7814 1.36 0.46 1.79 111 UNTRUSTED_Relay 7431 6.99 18.28 1.70 112 TooManyTo_003 7306 1.29 0.49 1.67 113 XM_B_Unsub2 7241 1.67 1.69 1.66 114 SUBJ_ALL_CAPS 7235 1.82 2.18 1.65 115 XM_CamelCaseFrm001 7205 1.79 2.11 1.65 116 XM_SPF_SoftFail 7183 2.09 3.03 1.64 117 BOTNET 7161 5.99 15.26 1.64 118 INVALID_MSGID 7110 1.25 0.44 1.63 119 IN_HORDE_ADDRESS_BOOK 7048 1.12 0.07 1.61 120 TR_XM_SpammyWords5 6604 2.35 4.13 1.51 121 MSGID_NOFQDN1 6494 1.03 0.05 1.48 122 XMCapTrack 6322 1.10 0.37 1.45 123 TO_MALFORMED 6282 0.99 0.05 1.44 124 XM_DK_Undo_01 6269 2.88 5.96 1.43 125 URIBL_SBL_A 6258 3.59 8.19 1.43 126 TR_Symld_Words 6064 1.45 1.59 1.39 127 XMGenDplmaNmb 5997 1.54 1.90 1.37 128 HTML_FONT_FACE_BAD 5955 1.19 0.83 1.36 129 T_XMDrugObfuBody_08 5896 1.73 2.53 1.35 130 XMSubNoVowel 5874 1.11 0.62 1.34 131 USER_IN_DEF_DKIM_WL 5653 0.88 0.00 1.29 132 TooManyTo_004 5494 0.99 0.41 1.26 133 URI_HEX 5429 1.80 3.00 1.24 134 TM2_M_VERY_LONG_WORD 5423 1.46 1.91 1.24 135 RELAYCOUNTRY_CA 5391 2.79 6.12 1.23 136 HELO_MISC_IP 5271 0.85 0.09 1.20 137 XMStockSpam_06 5131 1.27 1.47 1.17 138 XM_UB50 5116 2.51 5.37 1.17 139 RELAYCOUNTRY_GB 4965 1.22 1.41 1.13 140 DKIM_ADSP_CUSTOM_MED 4927 0.96 0.60 1.13 141 XMBSHREFv2 4707 0.79 0.18 1.08 142 XMHTML_After_End 4606 1.05 1.04 1.05 143 TooManyTo_005 4598 0.83 0.35 1.05 144 XM_H_Long_From02 4528 0.95 0.78 1.04 145 XM_GoogleGroups 4522 0.84 0.42 1.03 146 XMSubMetaSxObfu_03 4438 1.51 2.56 1.01 147 XM_B_COVIDMETA 4429 1.40 2.23 1.01 148 URI_TRY_3LD 4195 1.13 1.50 0.96 149 XMBody_95 4114 0.68 0.13 0.94 150 XMGappySubj_01 4086 0.66 0.07 0.93 151 T_FILL_THIS_FORM_SHORT 3847 2.01 4.43 0.88 152 XM_OfRef6 3813 2.84 7.02 0.87 153 TVD_SPACE_RATIO 3667 0.59 0.07 0.84 154 HTTPS_HTTP_MISMATCH 3642 0.88 0.99 0.83 155 XM_ShortIntro_01 3589 0.68 0.37 0.82 156 T_OBFU_PDF_ATTACH 3528 0.60 0.16 0.81 157 RCVD_IN_BL_SPAMCOP_NET 3508 3.74 9.99 0.80 158 SpammyFromTLD_01 3367 2.16 5.12 0.77 159 TR_MetaPhish_Combo_01 3351 0.77 0.79 0.77 160 NML_ADSP_CUSTOM_MED 3345 0.67 0.46 0.76 161 HTML_IMAGE_ONLY_20 3320 0.60 0.26 0.76 162 T_TooManySym_03 3255 0.56 0.18 0.74 163 DIET_1 3175 0.84 1.07 0.73 164 RCVD_IN_SORBS_DUL 3050 0.63 0.48 0.70 165 XMBrknScrpt_02 3000 1.40 2.91 0.69 166 TR_XM_SpammyWords2 2936 5.95 17.19 0.67 167 XM_E_Blogspot 2838 0.46 0.07 0.65 168 FORGED_GMAIL_RCVD 2792 1.36 2.90 0.64 169 SHORT_HELO_AND_INLINE_IMAGE 2781 0.45 0.07 0.64 170 XM_SPF_Unknown 2754 0.63 0.63 0.63 171 XMNoVowels 2723 0.55 0.41 0.62 172 TR_MSPIKEBAYES00 2700 0.43 0.02 0.62 173 RELAYCOUNTRY_DE 2678 1.12 2.19 0.61 174 FROM_GOV_SPOOF 2643 0.46 0.14 0.60 175 XMBody_17 2492 1.06 2.10 0.57 176 XM_RXBody 2474 0.74 1.11 0.57 177 XM_H_PHPMailer 2415 0.59 0.68 0.55 178 T_XMDrugObfuBody_00 2406 0.80 1.32 0.55 179 XM_ProductURIs 2383 0.54 0.52 0.54 180 XMMoneyMeta_00 2366 0.78 1.29 0.54 181 TM2_M_BODY_EMPTY 2327 0.40 0.11 0.53 182 XMLngstWrd_00 2291 0.47 0.35 0.52 183 RDNS_DYNAMIC 2199 0.68 1.05 0.50 184 XMHTMLBadTable_001 2174 0.59 0.78 0.50 185 PDS_OTHER_BAD_TLD 2157 1.10 2.38 0.49 186 T_Symld_Words_02 2147 0.82 1.51 0.49 187 XMLngstWrd_01 2064 0.42 0.32 0.47 188 MSGID_FROM_MTA_HEADER 2051 0.39 0.21 0.47 189 XMDateMe_00 2045 0.42 0.32 0.47 190 XM_GRM 2044 0.32 0.00 0.47 191 XM_B_REG_HTML 2004 0.43 0.36 0.46 192 MISSING_HEADERS 1998 0.43 0.38 0.46 193 USER_IN_WHITELIST 1979 0.31 0.00 0.45 194 USER_IN_WELCOMELIST 1979 0.31 0.00 0.45 195 FROM_GOV_DKIM_AU 1964 0.34 0.11 0.45 196 HTML_IMAGE_ONLY_32 1958 0.39 0.25 0.45 197 T_MANY_PILL_PRICE 1944 0.31 0.02 0.44 198 HTML_IMAGE_ONLY_28 1879 0.38 0.29 0.43 199 XMSubMetaI_00 1826 0.64 1.11 0.42 200 TR_XM_COVIDMETA4 1816 0.78 1.57 0.42 ----------------------------------------------------------------------