Email: 662161 Autolearn: 0 AvgScore: 1.93 AvgScanTime: 1.19 sec Spam: 181088 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.45 sec Ham: 481073 Autolearn: 0 AvgScore: -2.77 AvgScanTime: 1.10 sec Time Spent Running SA: 219.49 hours Time Spent Processing Spam: 72.75 hours Time Spent Processing Ham: 146.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 173543 91.92 95.83 90.45 2 DKIM_SIGNED 152204 70.39 84.05 65.24 3 XM_DK_Pass 148628 68.99 82.08 64.07 4 DKIM_VALID 144820 67.13 79.97 62.30 5 DCC_CHECK 140683 45.43 77.69 33.29 6 XM_B_Unicode 136806 74.28 75.55 73.80 7 RELAYCOUNTRY_US 134290 81.55 74.16 84.33 8 XM_B_SpammyWords 121172 49.86 66.91 43.43 9 XMListUnsubscribeExists 120788 48.96 66.70 42.29 10 DKIM_VALID_AU 111234 51.35 61.43 47.56 11 XM_DK_Undo_02 87305 18.07 48.21 6.72 12 XM_B_Unicode3 76827 44.25 42.43 44.94 13 TR_XM_DKIM_Undo 70520 13.73 38.94 4.24 14 BAYES_99 68690 14.00 37.93 4.99 15 LOC_TINY_FONT_1 66818 24.82 36.90 20.27 16 XM_B_SpammyWords2 66061 21.46 36.48 15.80 17 BAYES_50 62958 48.33 34.77 53.44 18 HTML_FONT_LOW_CONTRAST 59977 26.55 33.12 24.08 19 MIME_HTML_ONLY 58669 26.32 32.40 24.03 20 BAYES_999 54468 11.19 30.08 4.07 21 TR_DCC_Bayes_99 53264 9.49 29.41 1.99 22 FVGT_m_MULTI_ODD 52664 22.82 29.08 20.46 23 DKIM_VALID_EF 51027 27.04 28.18 26.61 24 XMSubLong 49286 22.97 27.22 21.37 25 T_KAM_HTML_FONT_INVALID 46235 18.34 25.53 15.63 26 RELAYCOUNTRY_META 40708 9.38 22.48 4.44 27 XM_Body_Dirty_Words 36868 12.65 20.36 9.75 28 DCC_CHECK_NEGATIVE 36675 52.62 20.25 64.80 29 RCVD_IN_MSPIKE_WL 35894 26.15 19.82 28.53 30 RCVD_IN_MSPIKE_H2 35338 17.29 19.51 16.45 31 T_TM2_M_HEADER_IN_MSG 33875 24.16 18.71 26.21 32 XM_UncommonTLD01 33286 7.24 18.38 3.04 33 UNTRUSTED_Relay 32154 5.96 17.76 1.52 34 BOTNET 28442 5.52 15.71 1.69 35 XM_Multi_Part_URI 27078 11.02 14.95 9.55 36 FSL_BULK_SIG 26037 8.20 14.38 5.87 37 XM_B_Unsub 24067 9.77 13.29 8.44 38 XM_B_SpammyWords3 23203 6.18 12.81 3.68 39 XMSexyCombo_05 21955 5.71 12.12 3.29 40 TR_XM_SpammyWords2 21466 3.82 11.85 0.79 41 BOTNET_IPINHOSTNAME 21405 6.33 11.82 4.26 42 LOTS_OF_MONEY 21032 7.35 11.61 5.74 43 XM_Evil_Numbers_Gen 19769 9.40 10.92 8.82 44 SpammyFromTLD_02 19445 3.12 10.74 0.25 45 MPART_ALT_DIFF 18205 10.37 10.05 10.49 46 UNPARSEABLE_RELAY 18102 7.57 10.00 6.65 47 TR_XM_SpammyWords4 17923 5.20 9.90 3.43 48 TR_XM_UnparsRelay 17876 6.73 9.87 5.55 49 RCVD_IN_MSPIKE_H3 17331 13.11 9.57 14.44 50 BAYES_80 17086 5.65 9.44 4.23 51 RCVD_IN_MSPIKE_H4 16792 10.39 9.27 10.81 52 HTML_IMAGE_RATIO_02 15462 5.98 8.54 5.02 53 LotsOfNums_01 14914 7.98 8.24 7.88 54 BAYES_60 14845 7.96 8.20 7.87 55 RCVD_IN_BL_SPAMCOP_NET 14675 2.70 8.10 0.67 56 XMSubMetaSx_00 14447 4.41 7.98 3.06 57 KHOP_HELO_FCRDNS 14253 3.27 7.87 1.54 58 MIME_HTML_MOSTLY 14063 3.83 7.77 2.35 59 XM_B_Phish_Phrases 13339 4.63 7.37 3.61 60 XM_H_Long_From01 12925 5.44 7.14 4.80 61 XM_SendGrid 12879 6.18 7.11 5.82 62 HTML_FONT_SIZE_LARGE 12135 1.92 6.70 0.12 63 XM_B_SpammyTLD 11992 2.93 6.62 1.54 64 BODY_URI_ONLY 11670 1.77 6.44 0.01 65 HTML_IMAGE_ONLY_12 11499 1.90 6.35 0.22 66 HTML_SHORT_LINK_IMG_1 11340 1.73 6.26 0.02 67 TR_XM_PhishingBody 11322 3.51 6.25 2.48 68 TooManyTo_001 11300 7.14 6.24 7.48 69 RELAYCOUNTRY_CA 10428 2.51 5.76 1.29 70 HTML_IMAGE_RATIO_04 10397 13.67 5.74 16.65 71 BAYES_95 10028 3.38 5.54 2.57 72 XMNumbers 9616 3.50 5.31 2.81 73 XMDiploma_00 9022 3.20 4.98 2.53 74 XM_DK_Undo_01 8943 2.34 4.94 1.36 75 XM_UB99 8857 1.34 4.89 0.00 76 SpammyFromTLD_01 8469 1.87 4.68 0.81 77 XM_UB50 8388 1.99 4.63 0.99 78 URIBL_SBL_A 7926 2.26 4.38 1.46 79 RCVD_IN_RP_SAFE 7876 6.14 4.35 6.81 80 XMStrtUSub 7774 9.66 4.29 11.68 81 TR_XM_SpammyWords5 7549 2.08 4.17 1.29 82 DKIM_INVALID 7384 3.25 4.08 2.94 83 XM_DIRTYINTL 7327 1.38 4.05 0.37 84 RCVD_IN_MSPIKE_BL 7188 1.14 3.97 0.08 85 TR_XM_MSPIKECOMBO 7103 1.13 3.92 0.08 86 TR_XM_DK_SendGrid 6884 3.56 3.80 3.47 87 XM_B_Phish66 6764 2.20 3.74 1.63 88 TM2_M_URI_OPT_OUT 6722 2.65 3.71 2.25 89 HTML_IMAGE_RATIO_06 6715 4.78 3.71 5.19 90 XM_SPF_SoftFail 6691 2.17 3.69 1.59 91 RCVD_IN_RP_CERTIFIED 6448 5.45 3.56 6.16 92 RCVD_IN_RP_RNBL 6405 0.99 3.54 0.03 93 PDS_OTHER_BAD_TLD 6373 1.11 3.52 0.21 94 XM_UB999 6291 0.95 3.47 0.00 95 RELAYCOUNTRY_FR 5901 1.06 3.26 0.23 96 URI_HEX 5796 1.82 3.20 1.30 97 MIME_QP_LONG_LINE 5703 4.15 3.15 4.52 98 RCVD_IN_PSBL 5647 0.91 3.12 0.08 99 MIME_HTML_ONLY_MULTI 5621 7.03 3.10 8.51 100 XM_UB80 5501 0.86 3.04 0.05 101 T_REMOTE_IMAGE 5388 3.22 2.98 3.31 102 TR_XM_SpammyWords3 5359 0.84 2.96 0.04 103 BOTNET_NORDNS 5352 0.82 2.96 0.01 104 RELAYCOUNTRY_IN 5272 0.87 2.91 0.10 105 XM_UB60 5217 0.88 2.88 0.13 106 RCVD_IN_MSPIKE_L5 5145 0.81 2.84 0.04 107 FORGED_GMAIL_RCVD 5136 1.10 2.84 0.45 108 XM_B_COVIDMETA 5047 1.33 2.79 0.78 109 TR_XM_MaxBayes 4709 0.73 2.60 0.02 110 XM_B_Unsub2 4665 1.65 2.58 1.31 111 XM_OfRef6 4583 1.23 2.53 0.74 112 T_TooManySym_01 4361 3.90 2.41 4.46 113 HTML_IMAGE_RATIO_08 4323 1.93 2.39 1.75 114 URI_PHP_REDIR 4308 0.65 2.38 0.00 115 FROM_EXCESS_BASE64 4212 2.41 2.33 2.43 116 TR_XM_SB_Phish 4174 2.18 2.30 2.14 117 URIBL_DBL_SPAM 4133 0.63 2.28 0.01 118 RCVD_IN_IADB_LISTED 4106 3.91 2.27 4.53 119 XMSubPhish11 3981 2.12 2.20 2.09 120 T_XMDrugObfuBody_14 3976 1.79 2.20 1.64 121 DIET_1 3970 0.98 2.19 0.52 122 XM_CamelCaseFrm001 3962 1.72 2.19 1.54 123 XM_B_SpammyWords4 3890 0.84 2.15 0.34 124 TM2_M_VERY_LONG_WORD 3834 1.30 2.12 1.00 125 RCVD_IN_IADB_SPF 3697 3.39 2.04 3.90 126 T_XMDrugObfuBody_08 3673 1.53 2.03 1.35 127 XMGenDplmaNmb 3653 1.35 2.02 1.10 128 HTML_MIME_NO_HTML_TAG 3623 1.90 2.00 1.86 129 RELAYCOUNTRY_DE 3562 0.97 1.97 0.60 130 XM_UB95 3554 0.55 1.96 0.02 131 SUBJ_ALL_CAPS 3519 1.55 1.94 1.41 132 RCVD_IN_IADB_DK 3502 2.98 1.93 3.37 133 RCVD_IN_IADB_SENDERID 3453 3.06 1.91 3.50 134 XMSubMetaSxObfu_03 3357 0.85 1.85 0.47 135 XMBrknScrpt_02 3308 0.94 1.83 0.61 136 XMBdyGiftCard01 3248 0.77 1.79 0.38 137 T_FILL_THIS_FORM_SHORT 3200 1.00 1.77 0.71 138 XM_URI_RBL 3188 0.61 1.76 0.17 139 TR_XM_INV_DKIM 3182 0.52 1.76 0.06 140 XMBody_17 3177 0.81 1.75 0.45 141 XMStockSpam_06 3143 1.34 1.74 1.20 142 GOOGLE_DOC_SUSP 3138 0.48 1.73 0.00 143 TR_XM_COVIDMETA4 3045 0.65 1.68 0.27 144 XMSlimDrugH 3010 0.67 1.66 0.30 145 URI_NOVOWEL 3010 2.16 1.66 2.34 146 XMSexyCombo_01 2867 0.65 1.58 0.30 147 TR_Sbj_FN_Bdy 2843 0.54 1.57 0.15 148 MAILING_LIST_MULTI 2763 2.30 1.53 2.59 149 TR_XM_PHPDW 2756 0.67 1.52 0.34 150 BAYES_40 2717 3.85 1.50 4.73 151 HTTPS_HTTP_MISMATCH 2714 1.02 1.50 0.84 152 URIBL_BLACK 2639 0.42 1.46 0.03 153 T_XMDrugObfuBody_00 2591 0.72 1.43 0.45 154 ALL_TRUSTED 2572 9.58 1.42 12.66 155 TR_XM_PHPForged 2508 0.58 1.38 0.28 156 DKIM_ADSP_CUSTOM_MED 2507 1.01 1.38 0.86 157 URI_TRY_3LD 2486 1.04 1.37 0.91 158 TR_XM_FormFill2 2466 0.58 1.36 0.28 159 XM_H_PHPOS 2459 0.57 1.36 0.27 160 FROM_SUSPICIOUS_NTLD 2417 0.41 1.33 0.06 161 T_XMHurry_00 2363 0.66 1.30 0.42 162 FROM_SUSPICIOUS_NTLD_FP 2348 0.40 1.30 0.06 163 XMSubMetaI_00 2319 0.70 1.28 0.48 164 TR_XM_BayesRelay 2309 0.36 1.28 0.02 165 TR_XM_RelayPhish 2297 0.39 1.27 0.07 166 NML_ADSP_CUSTOM_MED 2296 0.77 1.27 0.58 167 XMHTML_After_End 2279 0.94 1.26 0.82 168 RELAYCOUNTRY_GB 2243 1.02 1.24 0.93 169 XMSubMetaSSx_00 2133 0.43 1.18 0.15 170 XMPhish08 2106 0.43 1.16 0.15 171 BAYES_20 2067 3.54 1.14 4.45 172 XM_Body_Dirty_Words_01 2065 0.41 1.14 0.13 173 TR_Symld_Words 2047 1.29 1.13 1.35 174 XM_H_Undi_Recip 1979 0.43 1.09 0.18 175 DATE_IN_PAST_12_24 1973 0.32 1.09 0.03 176 TR_XM_COVIDMETA1 1919 0.48 1.06 0.27 177 XM_H_Long_From02 1905 0.92 1.05 0.87 178 XMBody_78 1883 0.59 1.04 0.42 179 RCVD_IN_MSPIKE_H5 1771 2.65 0.98 3.28 180 XM_ProductURIs 1747 0.80 0.96 0.73 181 XM_PDF 1732 3.17 0.96 4.00 182 XM_B_SEO 1722 0.35 0.95 0.12 183 XMMoneyMeta_00 1706 0.61 0.94 0.48 184 BAYES_00 1687 10.80 0.93 14.52 185 DKIM_ADSP_NXDOMAIN 1637 0.41 0.90 0.22 186 RELAYCOUNTRY_CH 1623 0.28 0.90 0.05 187 TR_XM_SEO4 1622 0.30 0.90 0.07 188 XMGppyBdWords 1620 0.31 0.89 0.09 189 HTML_TAG_BALANCE_BODY 1610 0.49 0.89 0.34 190 RDNS_DYNAMIC 1609 0.60 0.89 0.49 191 RCVD_IN_IADB_VOUCHED 1608 2.28 0.89 2.81 192 RELAYCOUNTRY_NL 1571 0.35 0.87 0.16 193 XMWghtMeta_00 1565 0.28 0.86 0.05 194 HK_RANDOM_REPLYTO 1564 0.35 0.86 0.16 195 SUBJ_DOLLARS 1533 0.43 0.85 0.28 196 TR_MetaPhish_Combo_01 1520 0.66 0.84 0.60 197 MIME_CHARSET_FARAWAY 1481 0.31 0.82 0.11 198 T_TooManySym_02 1476 1.84 0.82 2.23 199 NUMERIC_HTTP_ADDR 1459 0.44 0.81 0.31 200 TooManyTo_002 1434 1.69 0.79 2.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435142 91.92 95.83 90.45 2 RELAYCOUNTRY_US 405712 81.55 74.16 84.33 3 XM_B_Unicode 355016 74.28 75.55 73.80 4 DKIM_SIGNED 313869 70.39 84.05 65.24 5 DCC_CHECK_NEGATIVE 311724 52.62 20.25 64.80 6 XM_DK_Pass 308217 68.99 82.08 64.07 7 DKIM_VALID 299720 67.13 79.97 62.30 8 BAYES_50 257084 48.33 34.77 53.44 9 DKIM_VALID_AU 228802 51.35 61.43 47.56 10 XM_B_Unicode3 216187 44.25 42.43 44.94 11 XM_B_SpammyWords 208953 49.86 66.91 43.43 12 XMListUnsubscribeExists 203439 48.96 66.70 42.29 13 DCC_CHECK 160151 45.43 77.69 33.29 14 RCVD_IN_MSPIKE_WL 137228 26.15 19.82 28.53 15 DKIM_VALID_EF 128032 27.04 28.18 26.61 16 T_TM2_M_HEADER_IN_MSG 126078 24.16 18.71 26.21 17 HTML_FONT_LOW_CONTRAST 115828 26.55 33.12 24.08 18 MIME_HTML_ONLY 115593 26.32 32.40 24.03 19 XMSubLong 102790 22.97 27.22 21.37 20 FVGT_m_MULTI_ODD 98424 22.82 29.08 20.46 21 LOC_TINY_FONT_1 97525 24.82 36.90 20.27 22 HTML_IMAGE_RATIO_04 80112 13.67 5.74 16.65 23 RCVD_IN_MSPIKE_H2 79135 17.29 19.51 16.45 24 XM_B_SpammyWords2 76026 21.46 36.48 15.80 25 T_KAM_HTML_FONT_INVALID 75176 18.34 25.53 15.63 26 XM_H_Trusted_IP 74162 11.20 0.00 15.42 27 HTML_FONT_FACE_BAD 70515 10.82 0.63 14.66 28 BAYES_00 69834 10.80 0.93 14.52 29 RCVD_IN_MSPIKE_H3 69479 13.11 9.57 14.44 30 ALL_TRUSTED 60894 9.58 1.42 12.66 31 XMStrtUSub 56186 9.66 4.29 11.68 32 RCVD_IN_MSPIKE_H4 51980 10.39 9.27 10.81 33 MPART_ALT_DIFF 50457 10.37 10.05 10.49 34 XM_Body_Dirty_Words 46904 12.65 20.36 9.75 35 XM_Multi_Part_URI 45922 11.02 14.95 9.55 36 XM_Evil_Numbers_Gen 42445 9.40 10.92 8.82 37 MIME_HTML_ONLY_MULTI 40954 7.03 3.10 8.51 38 XM_B_Unsub 40611 9.77 13.29 8.44 39 LotsOfNums_01 37909 7.98 8.24 7.88 40 BAYES_60 37864 7.96 8.20 7.87 41 XM_DKIMWhitelistDomains 36873 5.59 0.08 7.66 42 TooManyTo_001 36000 7.14 6.24 7.48 43 RCVD_IN_RP_SAFE 32767 6.14 4.35 6.81 44 XM_DK_Undo_02 32329 18.07 48.21 6.72 45 UNPARSEABLE_RELAY 31996 7.57 10.00 6.65 46 TR_XM_DK_Bayes 30084 4.72 0.63 6.25 47 RCVD_IN_RP_CERTIFIED 29639 5.45 3.56 6.16 48 TR_XM_DK_Bayes1 29483 4.62 0.62 6.13 49 FSL_BULK_SIG 28232 8.20 14.38 5.87 50 XM_SendGrid 28022 6.18 7.11 5.82 51 LOTS_OF_MONEY 27615 7.35 11.61 5.74 52 TR_XM_UnparsRelay 26684 6.73 9.87 5.55 53 TR_XM_DK_Bayes2 26643 4.19 0.60 5.54 54 HTML_IMAGE_RATIO_06 24954 4.78 3.71 5.19 55 IN_ZIMBRA_NJ_WHITELIST 24220 3.67 0.05 5.03 56 HTML_IMAGE_RATIO_02 24164 5.98 8.54 5.02 57 BAYES_99 23982 14.00 37.93 4.99 58 XMSubNoVowel 23341 3.72 0.72 4.85 59 XM_H_Long_From01 23097 5.44 7.14 4.80 60 BAYES_40 22766 3.85 1.50 4.73 61 RCVD_IN_IADB_LISTED 21770 3.91 2.27 4.53 62 MIME_QP_LONG_LINE 21752 4.15 3.15 4.52 63 T_TooManySym_01 21449 3.90 2.41 4.46 64 BAYES_20 21393 3.54 1.14 4.45 65 RELAYCOUNTRY_META 21379 9.38 22.48 4.44 66 BOTNET_IPINHOSTNAME 20502 6.33 11.82 4.26 67 TR_XM_DKIM_Undo 20412 13.73 38.94 4.24 68 BAYES_80 20344 5.65 9.44 4.23 69 BAYES_999 19603 11.19 30.08 4.07 70 XM_PDF 19253 3.17 0.96 4.00 71 RCVD_IN_IADB_SPF 18779 3.39 2.04 3.90 72 XM_B_SpammyWords3 17704 6.18 12.81 3.68 73 XM_B_Phish_Phrases 17347 4.63 7.37 3.61 74 RCVD_IN_IADB_SENDERID 16830 3.06 1.91 3.50 75 TR_XM_DK_SendGrid 16714 3.56 3.80 3.47 76 TR_XM_SpammyWords4 16524 5.20 9.90 3.43 77 RCVD_IN_IADB_DK 16226 2.98 1.93 3.37 78 T_REMOTE_IMAGE 15932 3.22 2.98 3.31 79 XMSexyCombo_05 15838 5.71 12.12 3.29 80 RCVD_IN_MSPIKE_H5 15769 2.65 0.98 3.28 81 BAYES_05 15449 2.49 0.56 3.21 82 XMSubMetaSx_00 14732 4.41 7.98 3.06 83 XM_UncommonTLD01 14645 7.24 18.38 3.04 84 DKIM_INVALID 14149 3.25 4.08 2.94 85 ANY_BOUNCE_MESSAGE 14099 2.26 0.47 2.93 86 BOUNCE_MESSAGE 14094 2.26 0.47 2.93 87 XMNumbers 13528 3.50 5.31 2.81 88 RCVD_IN_IADB_VOUCHED 13503 2.28 0.89 2.81 89 MAILING_LIST_MULTI 12438 2.30 1.53 2.59 90 BAYES_95 12356 3.38 5.54 2.57 91 XMDiploma_00 12189 3.20 4.98 2.53 92 TR_XM_PhishingBody 11930 3.51 6.25 2.48 93 FROM_EXCESS_BASE64 11713 2.41 2.33 2.43 94 MIME_HTML_MOSTLY 11318 3.83 7.77 2.35 95 URI_NOVOWEL 11265 2.16 1.66 2.34 96 TM2_M_URI_OPT_OUT 10821 2.65 3.71 2.25 97 T_TooManySym_02 10708 1.84 0.82 2.23 98 TR_XM_SB_Phish 10294 2.18 2.30 2.14 99 XMSubPhish11 10032 2.12 2.20 2.09 100 TooManyTo_002 9745 1.69 0.79 2.03 101 TR_DCC_Bayes_99 9597 9.49 29.41 1.99 102 HTML_MIME_NO_HTML_TAG 8968 1.90 2.00 1.86 103 XMSubGarbage 8805 1.34 0.02 1.83 104 HELO_NODOT 8778 1.49 0.61 1.82 105 HELO_NO_DOMAIN 8778 1.49 0.60 1.82 106 RCVD_IN_IADB_OPTIN 8645 1.46 0.57 1.80 107 XMSubLongNoVowel 8579 1.33 0.13 1.78 108 HTML_IMAGE_RATIO_08 8441 1.93 2.39 1.75 109 BOTNET 8141 5.52 15.71 1.69 110 T_XMDrugObfuBody_14 7900 1.79 2.20 1.64 111 XM_B_Phish66 7826 2.20 3.74 1.63 112 XM_SPF_SoftFail 7666 2.17 3.69 1.59 113 TVD_RCVD_IP 7601 1.22 0.26 1.58 114 XM_CamelCaseFrm001 7421 1.72 2.19 1.54 115 KHOP_HELO_FCRDNS 7400 3.27 7.87 1.54 116 XM_B_SpammyTLD 7397 2.93 6.62 1.54 117 INVALID_MSGID 7361 1.22 0.38 1.53 118 UNTRUSTED_Relay 7333 5.96 17.76 1.52 119 IN_HORDE_ADDRESS_BOOK 7050 1.09 0.08 1.47 120 URIBL_SBL_A 7043 2.26 4.38 1.46 121 MSGID_NOFQDN1 6789 1.06 0.11 1.41 122 SUBJ_ALL_CAPS 6771 1.55 1.94 1.41 123 XM_DK_Undo_01 6562 2.34 4.94 1.36 124 TR_Symld_Words 6485 1.29 1.13 1.35 125 T_XMDrugObfuBody_08 6471 1.53 2.03 1.35 126 XM_B_Unsub2 6291 1.65 2.58 1.31 127 TO_MALFORMED 6271 0.95 0.01 1.30 128 TooManyTo_003 6243 1.12 0.64 1.30 129 URI_HEX 6234 1.82 3.20 1.30 130 TR_XM_SpammyWords5 6229 2.08 4.17 1.29 131 RELAYCOUNTRY_CA 6203 2.51 5.76 1.29 132 XMStockSpam_06 5763 1.34 1.74 1.20 133 XMCapTrack 5481 0.95 0.44 1.14 134 XM_E_Blogspot 5451 0.85 0.11 1.13 135 XM_GoogleGroups 5364 0.97 0.59 1.12 136 HELO_MISC_IP 5303 0.87 0.25 1.10 137 XMGenDplmaNmb 5290 1.35 2.02 1.10 138 USER_IN_DEF_DKIM_WL 4932 0.80 0.21 1.03 139 XMBSHREFv2 4874 0.80 0.24 1.01 140 TM2_M_VERY_LONG_WORD 4791 1.30 2.12 1.00 141 XM_UB50 4783 1.99 4.63 0.99 142 TooManyTo_004 4515 0.81 0.46 0.94 143 RELAYCOUNTRY_GB 4485 1.02 1.24 0.93 144 XMGappySubj_01 4416 0.80 0.50 0.92 145 URI_TRY_3LD 4369 1.04 1.37 0.91 146 XM_H_Long_From02 4166 0.92 1.05 0.87 147 DKIM_ADSP_CUSTOM_MED 4157 1.01 1.38 0.86 148 HTTPS_HTTP_MISMATCH 4021 1.02 1.50 0.84 149 XMHTML_After_End 3968 0.94 1.26 0.82 150 SpammyFromTLD_01 3902 1.87 4.68 0.81 151 TR_XM_SpammyWords2 3824 3.82 11.85 0.79 152 XM_B_COVIDMETA 3767 1.33 2.79 0.78 153 TooManyTo_005 3673 0.67 0.41 0.76 154 XMBody_95 3571 0.57 0.12 0.74 155 XM_OfRef6 3559 1.23 2.53 0.74 156 XM_ProductURIs 3532 0.80 0.96 0.73 157 TVD_SPACE_RATIO 3435 0.54 0.07 0.71 158 T_FILL_THIS_FORM_SHORT 3426 1.00 1.77 0.71 159 FROM_GOV_DKIM_AU 3375 0.65 0.50 0.70 160 RCVD_IN_BL_SPAMCOP_NET 3229 2.70 8.10 0.67 161 HTML_IMAGE_ONLY_20 3138 0.56 0.30 0.65 162 RCVD_IN_SORBS_DUL 3129 0.54 0.25 0.65 163 XM_ShortIntro_01 2984 0.53 0.28 0.62 164 SHORT_HELO_AND_INLINE_IMAGE 2950 0.47 0.08 0.61 165 XMBrknScrpt_02 2925 0.94 1.83 0.61 166 RELAYCOUNTRY_DE 2892 0.97 1.97 0.60 167 TR_MetaPhish_Combo_01 2873 0.66 0.84 0.60 168 T_TooManySym_03 2849 0.53 0.37 0.59 169 NML_ADSP_CUSTOM_MED 2773 0.77 1.27 0.58 170 TR_MSPIKEBAYES00 2754 0.42 0.01 0.57 171 XMHTMLBadTable_001 2741 0.59 0.65 0.57 172 T_OBFU_PDF_ATTACH 2717 0.46 0.19 0.56 173 XMLngstWrd_00 2676 0.53 0.44 0.56 174 XMSubMetaSxObfu_02 2608 0.52 0.45 0.54 175 XM_RXBody 2600 0.53 0.50 0.54 176 DIET_1 2522 0.98 2.19 0.52 177 XM_SPF_Unknown 2470 0.59 0.78 0.51 178 XM_H_PHPMailer 2413 0.57 0.75 0.50 179 RDNS_DYNAMIC 2372 0.60 0.89 0.49 180 XMSubMetaI_00 2322 0.70 1.28 0.48 181 XMMoneyMeta_00 2314 0.61 0.94 0.48 182 T_Symld_Words_02 2273 0.54 0.70 0.47 183 XMSubMetaSxObfu_03 2253 0.85 1.85 0.47 184 XMNoVowels 2205 0.48 0.53 0.46 185 XMLngstWrd_01 2190 0.44 0.41 0.46 186 XMBody_17 2169 0.81 1.75 0.45 187 FORGED_GMAIL_RCVD 2151 1.10 2.84 0.45 188 T_XMDrugObfuBody_00 2146 0.72 1.43 0.45 189 TM2_M_BODY_EMPTY 2111 0.34 0.06 0.44 190 XMBody_78 2040 0.59 1.04 0.42 191 T_XMHurry_00 2005 0.66 1.30 0.42 192 XM_B_REG_HTML 1995 0.41 0.41 0.41 193 HTML_IMAGE_ONLY_28 1945 0.40 0.38 0.40 194 HTML_IMAGE_ONLY_32 1937 0.35 0.20 0.40 195 FROM_GOV_SPOOF 1921 0.32 0.12 0.40 196 XMPhish30 1859 0.49 0.75 0.39 197 XMBdyGiftCard01 1850 0.77 1.79 0.38 198 MISSING_HEADERS 1837 0.38 0.38 0.38 199 USER_IN_WELCOMELIST 1809 0.27 0.00 0.38 200 USER_IN_WHITELIST 1809 0.27 0.00 0.38 ----------------------------------------------------------------------