Email: 539773 Autolearn: 0 AvgScore: 3.86 AvgScanTime: 1.33 sec Spam: 168186 Autolearn: 0 AvgScore: 14.62 AvgScanTime: 1.55 sec Ham: 371587 Autolearn: 0 AvgScore: -1.00 AvgScanTime: 1.22 sec Time Spent Running SA: 198.81 hours Time Spent Processing Spam: 72.40 hours Time Spent Processing Ham: 126.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161325 90.02 95.92 87.35 2 DCC_CHECK 134940 51.97 80.23 39.18 3 DKIM_SIGNED 130794 74.54 77.77 73.08 4 XM_DK_Pass 127112 73.08 75.58 71.95 5 DKIM_VALID 124027 71.12 73.74 69.93 6 XM_B_Unicode 118336 70.17 70.36 70.08 7 RELAYCOUNTRY_US 114313 76.85 67.97 80.87 8 XMListUnsubscribeExists 108531 52.73 64.53 47.39 9 XM_B_SpammyWords 102478 49.55 60.93 44.39 10 DKIM_VALID_AU 95398 54.84 56.72 53.99 11 XM_DK_Undo_02 77751 19.80 46.23 7.83 12 XM_B_Unicode3 71588 41.67 42.56 41.27 13 MIME_HTML_ONLY 64867 26.55 38.57 21.11 14 BAYES_99 61176 16.79 36.37 7.93 15 LOC_TINY_FONT_1 58941 26.99 35.05 23.34 16 TR_XM_DKIM_Undo 58762 14.48 34.94 5.22 17 XM_B_SpammyWords2 58127 23.30 34.56 18.21 18 BAYES_50 56572 48.38 33.64 55.05 19 HTML_FONT_LOW_CONTRAST 51372 27.96 30.54 26.79 20 BAYES_999 48741 13.66 28.98 6.73 21 TR_DCC_Bayes_99 47883 10.85 28.47 2.87 22 DKIM_VALID_EF 46210 29.10 27.48 29.84 23 RELAYCOUNTRY_META 43886 11.63 26.09 5.09 24 XMSubLong 43514 21.65 25.87 19.74 25 XM_UncommonTLD01 41340 10.03 24.58 3.44 26 FVGT_m_MULTI_ODD 40027 23.21 23.80 22.94 27 T_KAM_HTML_FONT_INVALID 39698 18.89 23.60 16.76 28 UNTRUSTED_Relay 39483 8.79 23.48 2.15 29 RCVD_IN_MSPIKE_H2 37154 22.54 22.09 22.74 30 RCVD_IN_MSPIKE_WL 36759 29.81 21.86 33.41 31 FSL_BULK_SIG 36169 11.64 21.51 7.17 32 XM_Body_Dirty_Words 34498 14.15 20.51 11.27 33 T_TM2_M_HEADER_IN_MSG 31565 25.08 18.77 27.94 34 DCC_CHECK_NEGATIVE 30492 46.27 18.13 59.00 35 BOTNET 30288 6.64 18.01 1.50 36 XM_Multi_Part_URI 26145 12.79 15.55 11.55 37 XMSexyCombo_05 23730 7.04 14.11 3.84 38 TR_XM_SpammyWords2 22251 4.55 13.23 0.62 39 SpammyFromTLD_02 21970 4.20 13.06 0.18 40 XM_B_Unsub 20571 10.81 12.23 10.17 41 RCVD_IN_MSPIKE_H3 20281 15.20 12.06 16.62 42 BOTNET_IPINHOSTNAME 19860 7.02 11.81 4.86 43 XM_Evil_Numbers_Gen 19258 9.56 11.45 8.70 44 LOTS_OF_MONEY 18630 7.74 11.08 6.23 45 XM_B_SpammyWords3 18424 5.95 10.95 3.68 46 KHOP_HELO_FCRDNS 17795 4.36 10.58 1.54 47 BAYES_80 17713 6.95 10.53 5.33 48 T_REMOTE_IMAGE 17582 5.56 10.45 3.34 49 RCVD_IN_BL_SPAMCOP_NET 16370 3.63 9.73 0.87 50 MPART_ALT_DIFF 15970 6.35 9.50 4.92 51 BAYES_60 15608 9.35 9.28 9.38 52 HTML_FONT_SIZE_LARGE 15360 2.95 9.13 0.15 53 HTML_IMAGE_ONLY_12 15280 2.99 9.09 0.23 54 RCVD_IN_MSPIKE_H4 15154 11.51 9.01 12.64 55 UNPARSEABLE_RELAY 14776 8.17 8.79 7.89 56 TR_XM_UnparsRelay 14605 7.39 8.68 6.80 57 LotsOfNums_01 14280 7.94 8.49 7.69 58 XMSubMetaSx_00 14054 5.02 8.36 3.51 59 BODY_URI_ONLY 13820 2.56 8.22 0.01 60 SpammyFromTLD_01 13592 2.92 8.08 0.59 61 MIME_HTML_MOSTLY 13264 3.97 7.89 2.19 62 HTML_IMAGE_RATIO_02 13082 7.87 7.78 7.90 63 XMNumbers 12240 4.51 7.28 3.25 64 TR_XM_SpammyWords4 12079 4.70 7.18 3.57 65 XM_B_Phish_Phrases 12072 5.32 7.18 4.48 66 XM_SendGrid 11710 7.14 6.96 7.21 67 HTML_IMAGE_RATIO_04 11319 6.12 6.73 5.85 68 XM_UB50 10541 2.90 6.27 1.38 69 RCVD_IN_RP_SAFE 10501 7.69 6.24 8.34 70 BAYES_95 9984 4.10 5.94 3.26 71 RELAYCOUNTRY_CA 9840 2.76 5.85 1.36 72 HTML_SHORT_LINK_IMG_1 9631 1.80 5.73 0.02 73 XM_UB99 9542 1.77 5.67 0.00 74 TooManyTo_001 9502 7.59 5.65 8.46 75 XM_H_Long_From01 9328 5.74 5.55 5.83 76 RCVD_IN_MSPIKE_BL 8916 1.76 5.30 0.15 77 TR_XM_MSPIKECOMBO 8776 1.73 5.22 0.15 78 TR_XM_PhishingBody 8613 3.19 5.12 2.31 79 RCVD_IN_RP_CERTIFIED 8339 6.83 4.96 7.67 80 XM_DIRTYINTL 7476 1.65 4.45 0.39 81 XM_UB999 7010 1.30 4.17 0.00 82 XM_UB60 6862 1.39 4.08 0.17 83 DKIM_INVALID 6767 3.42 4.02 3.15 84 XM_UB80 6757 1.28 4.02 0.04 85 RCVD_IN_RP_RNBL 6687 1.26 3.98 0.04 86 XM_B_SpammyTLD 6561 2.57 3.90 1.97 87 RELAYCOUNTRY_FR 6473 1.42 3.85 0.32 88 XMStrtUSub 6452 5.41 3.84 6.12 89 TR_XM_DK_SendGrid 6226 4.33 3.70 4.62 90 T_TooManySym_01 6136 4.83 3.65 5.36 91 XM_SPF_SoftFail 5902 2.15 3.51 1.53 92 HTML_SHORT_LINK_IMG_2 5762 1.09 3.43 0.04 93 TM2_M_URI_OPT_OUT 5688 3.11 3.38 2.98 94 XM_CamelCaseFrm001 5458 2.36 3.25 1.96 95 RELAYCOUNTRY_DE 5421 1.31 3.22 0.44 96 TR_XM_SpammyWords5 5405 1.97 3.21 1.40 97 RCVD_IN_PSBL 5301 1.07 3.15 0.13 98 RCVD_IN_MSPIKE_L5 5262 1.02 3.13 0.07 99 FROM_EXCESS_BASE64 5081 3.14 3.02 3.19 100 XMSlimDrugH 4989 1.13 2.97 0.30 101 FROM_SUSPICIOUS_NTLD 4924 0.97 2.93 0.09 102 SUBJ_ALL_CAPS 4889 2.04 2.91 1.65 103 HTML_IMAGE_RATIO_06 4825 3.30 2.87 3.49 104 MIME_QP_LONG_LINE 4820 4.31 2.87 4.96 105 HTML_IMAGE_RATIO_08 4359 2.41 2.59 2.32 106 NO_DNS_FOR_FROM 4336 0.97 2.58 0.24 107 TR_XM_MaxWHORU 4312 0.95 2.56 0.22 108 XM_UB95 4309 0.82 2.56 0.03 109 XMBdyGiftCard01 4190 1.08 2.49 0.44 110 XM_B_Phish66 4148 1.77 2.47 1.45 111 MIME_HTML_ONLY_MULTI 4094 2.92 2.43 3.14 112 URI_HEX 4019 1.77 2.39 1.49 113 XM_DK_Undo_01 3991 1.77 2.37 1.50 114 FROM_SUSPICIOUS_NTLD_FP 3965 0.79 2.36 0.08 115 RELAYCOUNTRY_GB 3951 1.45 2.35 1.04 116 XMSexyCombo_01 3927 1.09 2.33 0.53 117 TR_XM_BayesRelay 3869 0.73 2.30 0.02 118 TM2_M_VERY_LONG_WORD 3854 1.54 2.29 1.20 119 T_XMDrugObfuBody_14 3846 2.60 2.29 2.74 120 TR_XM_SpammyWords3 3795 0.76 2.26 0.08 121 T_XMHurry_00 3770 1.02 2.24 0.47 122 URIBL_DBL_SPAM 3769 0.71 2.24 0.02 123 XMBrknScrpt_02 3767 1.19 2.24 0.71 124 XM_B_COVIDMETA 3682 1.15 2.19 0.68 125 PDS_OTHER_BAD_TLD 3650 1.01 2.17 0.48 126 URIBL_SBL_A 3549 0.84 2.11 0.27 127 XMMoneyMeta_00 3499 0.98 2.08 0.48 128 XM_OfRef6 3351 1.17 1.99 0.80 129 XM_BadFromFormat 3347 0.81 1.99 0.27 130 XM_B_SpammyWords4 3294 0.91 1.96 0.43 131 BOTNET_NORDNS 3294 0.62 1.96 0.01 132 XMHTML_After_End 3251 1.66 1.93 1.54 133 XMSubMetaI_00 3249 1.15 1.93 0.79 134 XMBody_17 3157 0.93 1.88 0.50 135 XM_URI_RBL 3130 0.69 1.86 0.16 136 T_XMDrugObfuBody_08 3119 1.63 1.85 1.53 137 HTML_MIME_NO_HTML_TAG 3020 2.03 1.80 2.13 138 XM_B_Unsub2 3010 1.29 1.79 1.06 139 RCVD_IN_IADB_LISTED 2993 3.95 1.78 4.93 140 HK_RANDOM_REPLYTO 2974 0.70 1.77 0.22 141 XMDiploma_00 2955 1.57 1.76 1.48 142 T_Symld_Words_02 2940 0.86 1.75 0.46 143 TR_XM_SB_Phish 2885 1.90 1.72 1.98 144 SUBJ_DOLLARS 2782 0.67 1.65 0.22 145 XM_Body_Dirty_Words_01 2772 0.64 1.65 0.18 146 BAYES_40 2754 3.51 1.64 4.36 147 XMSubPhish11 2751 1.86 1.64 1.95 148 MAILING_LIST_MULTI 2736 2.51 1.63 2.91 149 TR_XM_PHPDW 2714 0.78 1.61 0.40 150 RELAYCOUNTRY_CH 2705 0.54 1.61 0.05 151 RELAYCOUNTRY_RU 2617 0.52 1.56 0.05 152 XM_H_Long_From02 2604 1.13 1.55 0.93 153 RCVD_IN_IADB_SPF 2578 3.42 1.53 4.27 154 URIBL_BLACK 2545 0.49 1.51 0.03 155 XMStockSpam_06 2498 1.35 1.49 1.28 156 TR_XM_INV_DKIM 2484 0.54 1.48 0.11 157 DIET_1 2476 0.84 1.47 0.55 158 XMSubNoVowel 2468 2.48 1.47 2.94 159 TR_XM_PHPForged 2460 0.67 1.46 0.31 160 URI_NOVOWEL 2458 2.39 1.46 2.82 161 TR_XM_FormFill2 2442 0.67 1.45 0.32 162 XM_H_PHPOS 2427 0.66 1.44 0.30 163 RCVD_IN_IADB_DK 2413 2.97 1.43 3.66 164 XMSexyCombo_04 2401 0.48 1.43 0.06 165 RCVD_IN_IADB_SENDERID 2386 3.06 1.42 3.80 166 TR_XM_COVIDMETA4 2301 0.64 1.37 0.30 167 THIS_AD 2267 0.94 1.35 0.75 168 T_FILL_THIS_FORM_SHORT 2250 0.94 1.34 0.76 169 T_TooManySym_02 2209 2.36 1.31 2.83 170 T_MONEY_PERCENT 2132 0.52 1.27 0.18 171 TR_LOTS_OF_MONEY2 2132 0.52 1.27 0.18 172 XMGenDplmaNmb 2111 0.95 1.26 0.80 173 HTML_IMAGE_ONLY_20 2104 1.19 1.25 1.16 174 XMSubMetaSSx_00 2070 0.51 1.23 0.18 175 GOOG_STO_IMG_NOHTML 2044 0.41 1.22 0.05 176 BAYES_20 1954 2.85 1.16 3.62 177 XM_RXBody 1951 0.47 1.16 0.16 178 T_XMDrugObfuBody_00 1930 0.89 1.15 0.78 179 URI_PHP_REDIR 1915 0.36 1.14 0.00 180 TR_Symld_Words 1903 1.30 1.13 1.38 181 HTML_SHORT_LINK_IMG_3 1902 0.39 1.13 0.06 182 XMPhish08 1888 0.44 1.12 0.13 183 TR_Mismatch_TLD_02 1884 0.40 1.12 0.07 184 TR_XM_RelayPhish 1852 0.41 1.10 0.10 185 NUMERIC_HTTP_ADDR 1841 0.49 1.09 0.22 186 RCVD_IN_MSPIKE_L3 1810 0.36 1.08 0.04 187 XMSubMetaSx_01 1790 0.41 1.06 0.11 188 XMSubMetaSSxObfu_00 1770 0.40 1.05 0.10 189 XMSexyCombo_02 1760 0.38 1.05 0.08 190 ALL_TRUSTED 1754 10.95 1.04 15.44 191 URI_TRY_3LD 1726 1.08 1.03 1.10 192 DKIM_ADSP_NXDOMAIN 1718 0.49 1.02 0.25 193 RCVD_IN_MSPIKE_L4 1704 0.34 1.01 0.04 194 RELAYCOUNTRY_NL 1639 0.48 0.97 0.25 195 HTTPS_HTTP_MISMATCH 1602 0.80 0.95 0.72 196 DATE_IN_PAST_03_06 1554 0.51 0.92 0.33 197 TR_MetaPhish_Combo_01 1524 0.78 0.91 0.72 198 DKIM_ADSP_CUSTOM_MED 1517 1.03 0.90 1.09 199 MIME_CHARSET_FARAWAY 1514 0.39 0.90 0.16 200 XM_Combo_Sbj 1466 0.38 0.87 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 324587 90.02 95.92 87.35 2 RELAYCOUNTRY_US 300507 76.85 67.97 80.87 3 DKIM_SIGNED 271551 74.54 77.77 73.08 4 XM_DK_Pass 267345 73.08 75.58 71.95 5 XM_B_Unicode 260418 70.17 70.36 70.08 6 DKIM_VALID 259864 71.12 73.74 69.93 7 DCC_CHECK_NEGATIVE 219246 46.27 18.13 59.00 8 BAYES_50 204575 48.38 33.64 55.05 9 DKIM_VALID_AU 200631 54.84 56.72 53.99 10 XMListUnsubscribeExists 176088 52.73 64.53 47.39 11 XM_B_SpammyWords 164956 49.55 60.93 44.39 12 XM_B_Unicode3 153356 41.67 42.56 41.27 13 DCC_CHECK 145598 51.97 80.23 39.18 14 RCVD_IN_MSPIKE_WL 124148 29.81 21.86 33.41 15 DKIM_VALID_EF 110873 29.10 27.48 29.84 16 T_TM2_M_HEADER_IN_MSG 103812 25.08 18.77 27.94 17 HTML_FONT_LOW_CONTRAST 99530 27.96 30.54 26.79 18 LOC_TINY_FONT_1 86726 26.99 35.05 23.34 19 FVGT_m_MULTI_ODD 85242 23.21 23.80 22.94 20 RCVD_IN_MSPIKE_H2 84505 22.54 22.09 22.74 21 MIME_HTML_ONLY 78450 26.55 38.57 21.11 22 XMSubLong 73338 21.65 25.87 19.74 23 XM_B_SpammyWords2 67650 23.30 34.56 18.21 24 T_KAM_HTML_FONT_INVALID 62278 18.89 23.60 16.76 25 RCVD_IN_MSPIKE_H3 61752 15.20 12.06 16.62 26 ALL_TRUSTED 57362 10.95 1.04 15.44 27 RCVD_IN_MSPIKE_H4 46965 11.51 9.01 12.64 28 XM_Multi_Part_URI 42906 12.79 15.55 11.55 29 XM_Body_Dirty_Words 41880 14.15 20.51 11.27 30 XM_DKIMWhitelistDomains 40263 7.47 0.03 10.84 31 XM_B_Unsub 37800 10.81 12.23 10.17 32 BAYES_60 34873 9.35 9.28 9.38 33 BAYES_00 34127 6.58 0.84 9.18 34 XM_Evil_Numbers_Gen 32343 9.56 11.45 8.70 35 TooManyTo_001 31454 7.59 5.65 8.46 36 RCVD_IN_RP_SAFE 30992 7.69 6.24 8.34 37 BAYES_99 29457 16.79 36.37 7.93 38 HTML_IMAGE_RATIO_02 29372 7.87 7.78 7.90 39 UNPARSEABLE_RELAY 29319 8.17 8.79 7.89 40 XM_DK_Undo_02 29106 19.80 46.23 7.83 41 LotsOfNums_01 28579 7.94 8.49 7.69 42 RCVD_IN_RP_CERTIFIED 28509 6.83 4.96 7.67 43 XM_SendGrid 26807 7.14 6.96 7.21 44 FSL_BULK_SIG 26653 11.64 21.51 7.17 45 TR_XM_UnparsRelay 25267 7.39 8.68 6.80 46 BAYES_999 25014 13.66 28.98 6.73 47 LOTS_OF_MONEY 23152 7.74 11.08 6.23 48 TR_XM_DK_Bayes 22765 4.42 0.66 6.13 49 XMStrtUSub 22752 5.41 3.84 6.12 50 TR_XM_DK_Bayes1 22129 4.30 0.65 5.96 51 HTML_IMAGE_RATIO_04 21727 6.12 6.73 5.85 52 XM_H_Long_From01 21674 5.74 5.55 5.83 53 TR_XM_DK_Bayes2 20172 3.93 0.63 5.43 54 T_TooManySym_01 19923 4.83 3.65 5.36 55 BAYES_80 19820 6.95 10.53 5.33 56 XM_H_Trusted_IP 19712 3.65 0.00 5.30 57 TR_XM_DKIM_Undo 19389 14.48 34.94 5.22 58 RELAYCOUNTRY_META 18898 11.63 26.09 5.09 59 IN_ZIMBRA_NJ_WHITELIST 18831 3.50 0.04 5.07 60 MIME_QP_LONG_LINE 18431 4.31 2.87 4.96 61 RCVD_IN_IADB_LISTED 18306 3.95 1.78 4.93 62 MPART_ALT_DIFF 18288 6.35 9.50 4.92 63 BOTNET_IPINHOSTNAME 18055 7.02 11.81 4.86 64 TR_XM_DK_SendGrid 17151 4.33 3.70 4.62 65 XM_B_Phish_Phrases 16634 5.32 7.18 4.48 66 BAYES_40 16188 3.51 1.64 4.36 67 RCVD_IN_IADB_SPF 15872 3.42 1.53 4.27 68 RCVD_IN_MSPIKE_H5 15431 3.10 0.79 4.15 69 XM_PDF 14508 2.92 0.73 3.90 70 XMSexyCombo_05 14276 7.04 14.11 3.84 71 RCVD_IN_IADB_SENDERID 14129 3.06 1.42 3.80 72 XM_B_SpammyWords3 13667 5.95 10.95 3.68 73 RCVD_IN_IADB_DK 13615 2.97 1.43 3.66 74 BAYES_20 13446 2.85 1.16 3.62 75 TR_XM_SpammyWords4 13283 4.70 7.18 3.57 76 ANY_BOUNCE_MESSAGE 13170 2.57 0.43 3.54 77 BOUNCE_MESSAGE 13165 2.57 0.42 3.54 78 XMSubMetaSx_00 13052 5.02 8.36 3.51 79 HTML_IMAGE_RATIO_06 12967 3.30 2.87 3.49 80 XM_UncommonTLD01 12774 10.03 24.58 3.44 81 T_REMOTE_IMAGE 12414 5.56 10.45 3.34 82 BAYES_95 12120 4.10 5.94 3.26 83 XMNumbers 12082 4.51 7.28 3.25 84 FROM_EXCESS_BASE64 11850 3.14 3.02 3.19 85 DKIM_INVALID 11687 3.42 4.02 3.15 86 MIME_HTML_ONLY_MULTI 11660 2.92 2.43 3.14 87 RCVD_IN_IADB_VOUCHED 11474 2.40 0.87 3.09 88 TM2_M_URI_OPT_OUT 11081 3.11 3.38 2.98 89 XMSubNoVowel 10942 2.48 1.47 2.94 90 MAILING_LIST_MULTI 10822 2.51 1.63 2.91 91 TR_DCC_Bayes_99 10681 10.85 28.47 2.87 92 T_TooManySym_02 10519 2.36 1.31 2.83 93 URI_NOVOWEL 10462 2.39 1.46 2.82 94 T_XMDrugObfuBody_14 10165 2.60 2.29 2.74 95 HTML_IMAGE_RATIO_08 8625 2.41 2.59 2.32 96 TR_XM_PhishingBody 8595 3.19 5.12 2.31 97 MIME_HTML_MOSTLY 8156 3.97 7.89 2.19 98 TooManyTo_002 8003 1.70 0.71 2.15 99 UNTRUSTED_Relay 7987 8.79 23.48 2.15 100 TVD_RCVD_IP 7942 1.52 0.15 2.14 101 HTML_MIME_NO_HTML_TAG 7913 2.03 1.80 2.13 102 RCVD_IN_IADB_OPTIN 7682 1.60 0.57 2.07 103 TR_XM_SB_Phish 7374 1.90 1.72 1.98 104 XM_B_SpammyTLD 7334 2.57 3.90 1.97 105 XM_CamelCaseFrm001 7277 2.36 3.25 1.96 106 XMSubPhish11 7264 1.86 1.64 1.95 107 BAYES_05 6976 1.48 0.60 1.88 108 INVALID_MSGID 6937 1.50 0.70 1.87 109 MSGID_NOFQDN1 6381 1.20 0.05 1.72 110 TO_MALFORMED 6282 1.17 0.01 1.69 111 SUBJ_ALL_CAPS 6115 2.04 2.91 1.65 112 HELO_NO_DOMAIN 5950 1.25 0.48 1.60 113 HELO_NODOT 5950 1.25 0.48 1.60 114 IN_HORDE_ADDRESS_BOOK 5861 1.10 0.06 1.58 115 KHOP_HELO_FCRDNS 5740 4.36 10.58 1.54 116 XMHTML_After_End 5726 1.66 1.93 1.54 117 T_XMDrugObfuBody_08 5690 1.63 1.85 1.53 118 XM_SPF_SoftFail 5683 2.15 3.51 1.53 119 HELO_MISC_IP 5649 1.08 0.10 1.52 120 XM_DK_Undo_01 5584 1.77 2.37 1.50 121 BOTNET 5570 6.64 18.01 1.50 122 URI_HEX 5524 1.77 2.39 1.49 123 XMDiploma_00 5504 1.57 1.76 1.48 124 TooManyTo_003 5471 1.20 0.59 1.47 125 XM_B_Phish66 5404 1.77 2.47 1.45 126 USER_IN_DEF_DKIM_WL 5361 1.00 0.02 1.44 127 TVD_SPACE_RATIO_MINFP 5288 1.14 0.53 1.42 128 TR_XM_SpammyWords5 5213 1.97 3.21 1.40 129 TR_Symld_Words 5139 1.30 1.13 1.38 130 XM_UB50 5136 2.90 6.27 1.38 131 RELAYCOUNTRY_CA 5058 2.76 5.85 1.36 132 XMBSHREFv2 4875 0.96 0.20 1.31 133 XMStockSpam_06 4763 1.35 1.49 1.28 134 TM2_M_VERY_LONG_WORD 4473 1.54 2.29 1.20 135 HTML_FONT_FACE_BAD 4466 1.07 0.77 1.20 136 HTML_IMAGE_ONLY_20 4303 1.19 1.25 1.16 137 XMBody_95 4186 0.81 0.10 1.13 138 URI_TRY_3LD 4103 1.08 1.03 1.10 139 DKIM_ADSP_CUSTOM_MED 4060 1.03 0.90 1.09 140 XM_GoogleGroups 4060 0.89 0.43 1.09 141 XMGappySubj_01 4058 0.79 0.12 1.09 142 TooManyTo_004 4054 0.92 0.53 1.09 143 XMCapTrack 4017 0.87 0.39 1.08 144 XM_B_Unsub2 3954 1.29 1.79 1.06 145 RELAYCOUNTRY_GB 3849 1.45 2.35 1.04 146 XM_H_Long_From02 3474 1.13 1.55 0.93 147 XM_E_Blogspot 3383 0.65 0.09 0.91 148 TooManyTo_005 3375 0.77 0.46 0.91 149 RCVD_IN_BL_SPAMCOP_NET 3227 3.63 9.73 0.87 150 XMGenDplmaNmb 2991 0.95 1.26 0.80 151 XM_OfRef6 2988 1.17 1.99 0.80 152 TVD_SPACE_RATIO 2982 0.58 0.10 0.80 153 XMSubMetaI_00 2953 1.15 1.93 0.79 154 T_XMDrugObfuBody_00 2892 0.89 1.15 0.78 155 XM_ProductURIs 2887 0.75 0.70 0.78 156 T_TooManySym_03 2878 0.61 0.24 0.77 157 T_FILL_THIS_FORM_SHORT 2812 0.94 1.34 0.76 158 THIS_AD 2800 0.94 1.35 0.75 159 HTTPS_HTTP_MISMATCH 2690 0.80 0.95 0.72 160 TR_MetaPhish_Combo_01 2680 0.78 0.91 0.72 161 NML_ADSP_CUSTOM_MED 2659 0.71 0.69 0.72 162 XM_H_PHPMailer 2655 0.74 0.81 0.71 163 XMBrknScrpt_02 2641 1.19 2.24 0.71 164 XM_B_COVIDMETA 2536 1.15 2.19 0.68 165 TR_MSPIKEBAYES00 2482 0.47 0.02 0.67 166 XMNoVowels 2471 0.61 0.50 0.66 167 XM_ShortIntro_01 2453 0.59 0.43 0.66 168 TR_XM_SpammyWords2 2297 4.55 13.23 0.62 169 SpammyFromTLD_01 2176 2.92 8.08 0.59 170 FORGED_GMAIL_RCVD 2125 0.64 0.77 0.57 171 DIET_1 2039 0.84 1.47 0.55 172 XMLngstWrd_00 2030 0.49 0.36 0.55 173 XMHTMLBadTable_001 2022 0.61 0.74 0.54 174 RDNS_DYNAMIC 1979 0.62 0.81 0.53 175 T_OBFU_PDF_ATTACH 1961 0.40 0.12 0.53 176 XMSexyCombo_01 1961 1.09 2.33 0.53 177 RCVD_IN_SORBS_DUL 1901 0.42 0.21 0.51 178 XMSubMetaSxObfu_02 1893 0.47 0.37 0.51 179 XMBody_17 1874 0.93 1.88 0.50 180 XMSubMetaSxObfu_03 1872 0.55 0.67 0.50 181 USER_IN_WHITELIST 1861 0.34 0.00 0.50 182 USER_IN_WELCOMELIST 1861 0.34 0.00 0.50 183 SHOPIFY_IMG_NOT_RCVD_SFY 1796 0.50 0.54 0.48 184 XMLngstWrd_01 1791 0.44 0.34 0.48 185 PDS_OTHER_BAD_TLD 1784 1.01 2.17 0.48 186 XMMoneyMeta_00 1768 0.98 2.08 0.48 187 T_XMHurry_00 1742 1.02 2.24 0.47 188 XM_B_REG_HTML 1723 0.43 0.37 0.46 189 T_Symld_Words_02 1712 0.86 1.75 0.46 190 XM_SPF_Unknown 1690 0.54 0.72 0.45 191 SHORT_HELO_AND_INLINE_IMAGE 1678 0.32 0.04 0.45 192 RELAYCOUNTRY_DE 1647 1.31 3.22 0.44 193 XMBdyGiftCard01 1618 1.08 2.49 0.44 194 MISSING_HEADERS 1598 0.44 0.47 0.43 195 XM_B_SpammyWords4 1593 0.91 1.96 0.43 196 HTML_IMAGE_ONLY_28 1512 0.36 0.25 0.41 197 NICE_REPLY_A 1507 0.28 0.02 0.41 198 PLING_QUERY 1506 0.47 0.62 0.41 199 TM2_M_BODY_EMPTY 1492 0.30 0.08 0.40 200 TR_XM_PHPDW 1489 0.78 1.61 0.40 ----------------------------------------------------------------------