Email: 523394 Autolearn: 0 AvgScore: 2.85 AvgScanTime: 1.11 sec Spam: 143209 Autolearn: 0 AvgScore: 14.16 AvgScanTime: 1.37 sec Ham: 380185 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 1.01 sec Time Spent Running SA: 161.31 hours Time Spent Processing Spam: 54.52 hours Time Spent Processing Ham: 106.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134599 87.89 93.99 85.59 2 DKIM_SIGNED 118179 72.88 82.52 69.24 3 XM_DK_Pass 115497 71.40 80.65 67.92 4 DKIM_VALID 112659 69.46 78.67 65.99 5 DCC_CHECK 109821 47.13 76.69 36.00 6 RELAYCOUNTRY_US 105934 78.44 73.97 80.13 7 XM_B_Unicode 105886 68.78 73.94 66.83 8 XM_B_SpammyWords 96315 50.43 67.25 44.09 9 XMListUnsubscribeExists 95737 48.44 66.85 41.51 10 DKIM_VALID_AU 83119 51.82 58.04 49.48 11 XM_DK_Undo_02 65008 17.71 45.39 7.29 12 XM_B_Unicode3 62884 40.74 43.91 39.54 13 XM_B_SpammyWords2 57044 23.40 39.83 17.21 14 BAYES_50 54485 50.59 38.05 55.31 15 TR_XM_DKIM_Undo 51091 13.45 35.68 5.08 16 BAYES_99 50924 14.40 35.56 6.43 17 LOC_TINY_FONT_1 49585 24.24 34.62 20.32 18 MIME_HTML_ONLY 47810 24.74 33.38 21.49 19 HTML_FONT_LOW_CONTRAST 47516 27.18 33.18 24.91 20 DKIM_VALID_EF 44671 29.10 31.19 28.32 21 BAYES_999 39933 11.55 27.88 5.40 22 TR_DCC_Bayes_99 38487 9.22 26.87 2.57 23 FVGT_m_MULTI_ODD 38352 22.33 26.78 20.66 24 T_KAM_HTML_FONT_INVALID 36862 18.50 25.74 15.78 25 RCVD_IN_MSPIKE_H2 35616 23.34 24.87 22.76 26 XMSubLong 35365 22.28 24.69 21.37 27 T_TM2_M_HEADER_IN_MSG 31285 28.40 21.85 30.87 28 XM_Body_Dirty_Words 31211 13.48 21.79 10.34 29 RCVD_IN_MSPIKE_WL 30812 28.10 21.52 30.58 30 RELAYCOUNTRY_META 29948 9.06 20.91 4.59 31 DCC_CHECK_NEGATIVE 29438 50.32 20.56 61.54 32 UNTRUSTED_Relay 25657 6.18 17.92 1.76 33 XM_UncommonTLD01 25361 7.36 17.71 3.46 34 FSL_BULK_SIG 23592 10.41 16.47 8.13 35 BOTNET 23440 5.55 16.37 1.48 36 XM_Multi_Part_URI 23193 11.78 16.20 10.12 37 LOTS_OF_MONEY 19968 9.37 13.94 7.65 38 XM_B_Unsub 19812 11.58 13.83 10.73 39 TR_XM_SpammyWords2 18887 4.10 13.19 0.67 40 BOTNET_IPINHOSTNAME 18782 6.60 13.12 4.15 41 XM_B_SpammyWords3 18294 5.95 12.77 3.38 42 RCVD_IN_MSPIKE_H3 16851 14.60 11.77 15.67 43 TR_XM_SpammyWords4 16654 6.45 11.63 4.49 44 XMSexyCombo_05 16529 5.48 11.54 3.20 45 XM_Evil_Numbers_Gen 15989 8.34 11.16 7.28 46 MPART_ALT_DIFF 15453 7.43 10.79 6.16 47 SpammyFromTLD_02 14257 3.10 9.96 0.51 48 UNPARSEABLE_RELAY 13194 7.54 9.21 6.92 49 LotsOfNums_01 13065 8.24 9.12 7.91 50 TR_XM_UnparsRelay 13001 6.61 9.08 5.69 51 BAYES_80 12840 5.80 8.97 4.60 52 HTML_IMAGE_RATIO_02 12825 6.51 8.96 5.58 53 RCVD_IN_MSPIKE_H4 12429 10.59 8.68 11.31 54 MIME_HTML_MOSTLY 12300 3.95 8.59 2.20 55 XM_B_Phish_Phrases 12176 6.00 8.50 5.06 56 RCVD_IN_BL_SPAMCOP_NET 11793 2.77 8.23 0.71 57 BAYES_60 11669 8.36 8.15 8.45 58 XM_SendGrid 10779 6.60 7.53 6.26 59 TR_XM_PhishingBody 10771 4.49 7.52 3.35 60 T_REMOTE_IMAGE 10761 4.55 7.51 3.43 61 KHOP_HELO_FCRDNS 9117 3.28 6.37 2.12 62 XM_H_Long_From01 8877 5.50 6.20 5.24 63 XMSubMetaSx_00 8832 4.43 6.17 3.78 64 TooManyTo_001 8404 8.02 5.87 8.83 65 HTML_IMAGE_RATIO_04 7807 6.56 5.45 6.98 66 XM_UB99 7774 1.50 5.43 0.02 67 XM_B_SpammyTLD 7474 2.79 5.22 1.87 68 RCVD_IN_MSPIKE_BL 7466 1.55 5.21 0.17 69 TR_XM_MSPIKECOMBO 7439 1.54 5.19 0.16 70 BAYES_95 7302 3.34 5.10 2.68 71 RELAYCOUNTRY_CA 7265 2.12 5.07 1.01 72 XM_UB50 7247 2.24 5.06 1.18 73 XM_SPF_SoftFail 6633 2.94 4.63 2.30 74 SpammyFromTLD_01 6491 1.79 4.53 0.76 75 RELAYCOUNTRY_FR 6467 1.45 4.52 0.29 76 HTML_FONT_SIZE_LARGE 6361 1.28 4.44 0.09 77 RCVD_IN_RP_SAFE 6278 5.72 4.38 6.22 78 XM_B_Phish66 6230 2.79 4.35 2.21 79 TR_XM_DK_SendGrid 6196 4.10 4.33 4.01 80 HTML_IMAGE_ONLY_12 5891 1.28 4.11 0.21 81 XM_UB999 5807 1.12 4.05 0.01 82 TR_XM_SpammyWords5 5679 2.20 3.97 1.54 83 XM_OfRef6 5648 1.73 3.94 0.90 84 DKIM_INVALID 5520 3.42 3.85 3.25 85 XM_B_COVIDMETA 5404 1.77 3.77 1.02 86 TM2_M_URI_OPT_OUT 5399 3.40 3.77 3.26 87 XMNumbers 5299 3.39 3.70 3.27 88 MIME_QP_LONG_LINE 5214 4.83 3.64 5.28 89 BODY_URI_ONLY 5068 0.97 3.54 0.01 90 HTML_SHORT_LINK_IMG_1 5006 0.96 3.50 0.01 91 RCVD_IN_RP_CERTIFIED 4846 4.91 3.38 5.48 92 XM_DIRTYINTL 4818 1.17 3.36 0.34 93 XMStrtUSub 4771 4.96 3.33 5.57 94 FROM_EXCESS_BASE64 4541 2.41 3.17 2.13 95 T_XMDrugObfuBody_14 4443 2.36 3.10 2.08 96 HTML_IMAGE_RATIO_06 4357 3.31 3.04 3.41 97 URIBL_DBL_SPAM 4288 0.82 2.99 0.01 98 MIME_HTML_ONLY_MULTI 4018 3.89 2.81 4.29 99 XM_B_Unsub2 3899 1.86 2.72 1.54 100 XM_UB60 3862 0.85 2.70 0.15 101 RCVD_IN_IADB_LISTED 3786 4.57 2.64 5.30 102 RCVD_IN_PSBL 3698 0.76 2.58 0.08 103 XM_UB80 3694 0.74 2.58 0.05 104 T_TooManySym_01 3636 5.20 2.54 6.20 105 RCVD_IN_RP_RNBL 3634 0.72 2.54 0.04 106 T_FILL_THIS_FORM_SHORT 3628 1.26 2.53 0.77 107 URI_HEX 3622 1.74 2.53 1.44 108 XMDiploma_00 3576 1.48 2.50 1.10 109 MONEY_NOHTML 3545 0.75 2.48 0.10 110 HTML_IMAGE_RATIO_08 3541 2.22 2.47 2.12 111 XM_CamelCaseFrm001 3535 1.89 2.47 1.68 112 XM_B_SpammyWords4 3519 0.98 2.46 0.42 113 T_XMDrugObfuBody_08 3472 1.62 2.42 1.32 114 RCVD_IN_IADB_SPF 3430 3.97 2.40 4.56 115 TR_XM_SB_Phish 3368 2.59 2.35 2.68 116 XMBdyGiftCard01 3342 0.89 2.33 0.35 117 XM_DK_Undo_01 3289 1.75 2.30 1.54 118 TM2_M_VERY_LONG_WORD 3270 1.47 2.28 1.17 119 XMSubPhish11 3249 2.54 2.27 2.64 120 RCVD_IN_IADB_DK 3217 3.43 2.25 3.88 121 PDS_OTHER_BAD_TLD 3208 0.74 2.24 0.18 122 SUBJ_ALL_CAPS 3199 1.82 2.23 1.66 123 RCVD_IN_IADB_SENDERID 3198 3.54 2.23 4.03 124 XM_H_Undi_Recip 3163 0.72 2.21 0.17 125 TR_XM_SpammyWords3 2943 0.64 2.06 0.11 126 ALL_TRUSTED 2932 12.71 2.05 16.73 127 T_XMHurry_00 2925 0.81 2.04 0.34 128 XMStockSpam_06 2909 1.43 2.03 1.20 129 XMSexyCombo_01 2893 1.17 2.02 0.84 130 RCVD_IN_MSPIKE_L5 2853 0.60 1.99 0.07 131 XMBrknScrpt_02 2823 0.91 1.97 0.51 132 URI_TRY_3LD 2759 1.25 1.93 1.00 133 RCVD_IN_MSPIKE_L4 2725 0.54 1.90 0.03 134 TR_Mismatch_TLD_01 2716 0.73 1.90 0.29 135 XM_DrugUnitList 2674 0.51 1.87 0.00 136 MAILING_LIST_MULTI 2643 2.61 1.85 2.90 137 URIBL_SBL_A 2624 0.62 1.83 0.16 138 TR_XM_Undi_Recip5 2575 0.50 1.80 0.01 139 XMGenDplmaNmb 2566 0.98 1.79 0.68 140 HTML_MIME_NO_HTML_TAG 2544 2.56 1.78 2.85 141 TR_Mismatch_TLD_02 2536 0.54 1.77 0.08 142 XM_UB95 2506 0.49 1.75 0.01 143 DKIM_ADSP_CUSTOM_MED 2458 1.21 1.72 1.02 144 RELAYCOUNTRY_IN 2447 0.57 1.71 0.15 145 TR_XM_PHPDW 2406 0.66 1.68 0.28 146 TR_Symld_Words 2384 1.86 1.66 1.93 147 MONEY_FRAUD_8 2381 0.46 1.66 0.00 148 HOSTED_IMG_DIRECT_MX 2374 0.45 1.66 0.00 149 TR_XM_BayesRelay 2352 0.46 1.64 0.01 150 TR_XM_COVIDMETA1 2301 0.67 1.61 0.31 151 DATE_IN_PAST_12_24 2289 0.45 1.60 0.02 152 TR_XM_Spammywords 2249 0.58 1.57 0.20 153 XM_S_SpammyWords 2249 0.58 1.57 0.20 154 XM_URI_RBL 2233 0.51 1.56 0.11 155 URIBL_BLACK 2218 0.44 1.55 0.03 156 URI_NOVOWEL 2173 2.50 1.52 2.86 157 NML_ADSP_CUSTOM_MED 2166 0.91 1.51 0.68 158 TR_XM_PHPForged 2166 0.59 1.51 0.25 159 FORGED_GMAIL_RCVD 2162 0.79 1.51 0.52 160 TR_XM_FormFill2 2149 0.59 1.50 0.25 161 BAYES_40 2147 4.00 1.50 4.94 162 T_XMDrugObfuBody_00 2143 0.84 1.50 0.59 163 XM_H_PHPOS 2137 0.58 1.49 0.24 164 XMBody_17 2121 0.68 1.48 0.37 165 BOTNET_NORDNS 2115 0.42 1.48 0.02 166 TR_XM_COVIDMETA4 2039 0.70 1.42 0.42 167 URI_PHP_REDIR 1957 0.37 1.37 0.00 168 LOADSA_MONEY_COMBO 1934 0.41 1.35 0.05 169 TR_XM_MaxBayes 1924 0.37 1.34 0.00 170 RELAYCOUNTRY_GB 1916 1.07 1.34 0.97 171 TR_XM_INV_DKIM 1903 0.44 1.33 0.10 172 RCVD_IN_MSPIKE_L3 1861 0.40 1.30 0.06 173 TR_XM_Undi_Recip11 1850 0.38 1.29 0.04 174 XM_Body_Dirty_Words_01 1820 0.76 1.27 0.57 175 HK_RANDOM_REPLYTO 1800 0.47 1.26 0.18 176 FROM_SUSPICIOUS_NTLD 1792 0.37 1.25 0.04 177 HTML_IMAGE_ONLY_24 1750 0.59 1.22 0.35 178 HTML_IMAGE_ONLY_28 1744 0.62 1.22 0.40 179 FROM_SUSPICIOUS_NTLD_FP 1717 0.35 1.20 0.03 180 XMSolicitRefs_0 1692 0.55 1.18 0.31 181 XMPhish30 1679 0.71 1.17 0.54 182 INVALID_DATE 1654 0.34 1.15 0.03 183 HTML_IMAGE_ONLY_20 1618 1.47 1.13 1.60 184 RCVD_IN_IADB_VOUCHED 1591 2.83 1.11 3.47 185 TR_MetaPhish_Combo_01 1589 0.84 1.11 0.74 186 BAYES_20 1586 3.48 1.11 4.38 187 RELAYCOUNTRY_DE 1584 0.70 1.11 0.55 188 TR_LOTS_OF_MONEY3 1559 0.45 1.09 0.21 189 T_Symld_Words_02 1555 0.56 1.09 0.37 190 TR_XM_Undi_RecipCombo2 1551 0.30 1.08 0.00 191 RCVD_IN_MSPIKE_H5 1532 2.90 1.07 3.59 192 XMBody_78 1524 0.63 1.06 0.46 193 TR_XM_PhishingBody3 1508 0.29 1.05 0.00 194 XFER_LOTSA_MONEY 1508 0.31 1.05 0.04 195 XMSubMetaSxObfu_03 1494 1.02 1.04 1.01 196 TR_BOTNET_NEGATE 1474 0.53 1.03 0.34 197 EBAY_IMG_NOT_RCVD_EBAY 1461 0.28 1.02 0.00 198 FILL_THIS_FORM 1443 0.49 1.01 0.29 199 XM_PDF 1429 3.91 1.00 5.01 200 XMSubMetaI_00 1413 0.58 0.99 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 325393 87.89 93.99 85.59 2 RELAYCOUNTRY_US 304635 78.44 73.97 80.13 3 DKIM_SIGNED 263246 72.88 82.52 69.24 4 XM_DK_Pass 258231 71.40 80.65 67.92 5 XM_B_Unicode 254094 68.78 73.94 66.83 6 DKIM_VALID 250890 69.46 78.67 65.99 7 DCC_CHECK_NEGATIVE 233952 50.32 20.56 61.54 8 BAYES_50 210277 50.59 38.05 55.31 9 DKIM_VALID_AU 188129 51.82 58.04 49.48 10 XM_B_SpammyWords 167634 50.43 67.25 44.09 11 XMListUnsubscribeExists 157816 48.44 66.85 41.51 12 XM_B_Unicode3 150329 40.74 43.91 39.54 13 DCC_CHECK 136855 47.13 76.69 36.00 14 T_TM2_M_HEADER_IN_MSG 117348 28.40 21.85 30.87 15 RCVD_IN_MSPIKE_WL 116262 28.10 21.52 30.58 16 DKIM_VALID_EF 107651 29.10 31.19 28.32 17 HTML_FONT_LOW_CONTRAST 94719 27.18 33.18 24.91 18 RCVD_IN_MSPIKE_H2 86544 23.34 24.87 22.76 19 MIME_HTML_ONLY 81683 24.74 33.38 21.49 20 XMSubLong 81238 22.28 24.69 21.37 21 FVGT_m_MULTI_ODD 78532 22.33 26.78 20.66 22 LOC_TINY_FONT_1 77270 24.24 34.62 20.32 23 XM_B_SpammyWords2 65445 23.40 39.83 17.21 24 ALL_TRUSTED 63607 12.71 2.05 16.73 25 T_KAM_HTML_FONT_INVALID 59985 18.50 25.74 15.78 26 RCVD_IN_MSPIKE_H3 59586 14.60 11.77 15.67 27 RCVD_IN_MSPIKE_H4 43017 10.59 8.68 11.31 28 BAYES_00 41313 8.16 0.97 10.87 29 XM_B_Unsub 40778 11.58 13.83 10.73 30 XM_Body_Dirty_Words 39328 13.48 21.79 10.34 31 XM_Multi_Part_URI 38465 11.78 16.20 10.12 32 XM_DKIMWhitelistDomains 37376 7.22 0.30 9.83 33 TooManyTo_001 33576 8.02 5.87 8.83 34 BAYES_60 32108 8.36 8.15 8.45 35 FSL_BULK_SIG 30918 10.41 16.47 8.13 36 LotsOfNums_01 30073 8.24 9.12 7.91 37 LOTS_OF_MONEY 29081 9.37 13.94 7.65 38 XM_DK_Undo_02 27710 17.71 45.39 7.29 39 XM_Evil_Numbers_Gen 27684 8.34 11.16 7.28 40 HTML_IMAGE_RATIO_04 26544 6.56 5.45 6.98 41 UNPARSEABLE_RELAY 26293 7.54 9.21 6.92 42 XM_H_Trusted_IP 25242 4.82 0.00 6.64 43 BAYES_99 24432 14.40 35.56 6.43 44 XM_SendGrid 23785 6.60 7.53 6.26 45 RCVD_IN_RP_SAFE 23657 5.72 4.38 6.22 46 T_TooManySym_01 23558 5.20 2.54 6.20 47 MPART_ALT_DIFF 23410 7.43 10.79 6.16 48 TR_XM_DK_Bayes 22700 4.53 0.72 5.97 49 TR_XM_DK_Bayes1 22032 4.40 0.71 5.80 50 TR_XM_UnparsRelay 21617 6.61 9.08 5.69 51 HTML_IMAGE_RATIO_02 21227 6.51 8.96 5.58 52 XMStrtUSub 21181 4.96 3.33 5.57 53 RCVD_IN_RP_CERTIFIED 20840 4.91 3.38 5.48 54 BAYES_999 20524 11.55 27.88 5.40 55 RCVD_IN_IADB_LISTED 20155 4.57 2.64 5.30 56 IN_ZIMBRA_NJ_WHITELIST 20116 3.86 0.05 5.29 57 MIME_QP_LONG_LINE 20066 4.83 3.64 5.28 58 XM_H_Long_From01 19924 5.50 6.20 5.24 59 TR_XM_DKIM_Undo 19326 13.45 35.68 5.08 60 XM_B_Phish_Phrases 19219 6.00 8.50 5.06 61 XM_PDF 19049 3.91 1.00 5.01 62 TR_XM_DK_Bayes2 18964 3.79 0.60 4.99 63 BAYES_40 18775 4.00 1.50 4.94 64 BAYES_80 17496 5.80 8.97 4.60 65 RELAYCOUNTRY_META 17461 9.06 20.91 4.59 66 RCVD_IN_IADB_SPF 17343 3.97 2.40 4.56 67 TR_XM_SpammyWords4 17089 6.45 11.63 4.49 68 BAYES_20 16639 3.48 1.11 4.38 69 MIME_HTML_ONLY_MULTI 16318 3.89 2.81 4.29 70 BOTNET_IPINHOSTNAME 15759 6.60 13.12 4.15 71 RCVD_IN_IADB_SENDERID 15323 3.54 2.23 4.03 72 TR_XM_DK_SendGrid 15247 4.10 4.33 4.01 73 RCVD_IN_IADB_DK 14742 3.43 2.25 3.88 74 XMSubMetaSx_00 14365 4.43 6.17 3.78 75 RCVD_IN_MSPIKE_H5 13659 2.90 1.07 3.59 76 ANY_BOUNCE_MESSAGE 13583 2.75 0.56 3.57 77 BOUNCE_MESSAGE 13583 2.75 0.56 3.57 78 RCVD_IN_IADB_VOUCHED 13204 2.83 1.11 3.47 79 XM_UncommonTLD01 13146 7.36 17.71 3.46 80 T_REMOTE_IMAGE 13036 4.55 7.51 3.43 81 HTML_IMAGE_RATIO_06 12967 3.31 3.04 3.41 82 XM_B_SpammyWords3 12832 5.95 12.77 3.38 83 TR_XM_PhishingBody 12722 4.49 7.52 3.35 84 XMNumbers 12432 3.39 3.70 3.27 85 TM2_M_URI_OPT_OUT 12410 3.40 3.77 3.26 86 DKIM_INVALID 12356 3.42 3.85 3.25 87 XMSexyCombo_05 12155 5.48 11.54 3.20 88 T_TooManySym_02 11552 2.44 0.86 3.04 89 MAILING_LIST_MULTI 11041 2.61 1.85 2.90 90 URI_NOVOWEL 10892 2.50 1.52 2.86 91 HTML_MIME_NO_HTML_TAG 10851 2.56 1.78 2.85 92 BAYES_95 10200 3.34 5.10 2.68 93 TR_XM_SB_Phish 10181 2.59 2.35 2.68 94 XMSubPhish11 10041 2.54 2.27 2.64 95 TR_DCC_Bayes_99 9780 9.22 26.87 2.57 96 TooManyTo_002 9366 2.01 0.81 2.46 97 BAYES_05 8943 1.88 0.61 2.35 98 XM_SPF_SoftFail 8736 2.94 4.63 2.30 99 RCVD_IN_IADB_OPTIN 8659 1.86 0.75 2.28 100 XMSubNoVowel 8514 1.84 0.80 2.24 101 XM_B_Phish66 8395 2.79 4.35 2.21 102 MIME_HTML_MOSTLY 8372 3.95 8.59 2.20 103 FROM_EXCESS_BASE64 8085 2.41 3.17 2.13 104 HTML_IMAGE_RATIO_08 8056 2.22 2.47 2.12 105 KHOP_HELO_FCRDNS 8055 3.28 6.37 2.12 106 T_XMDrugObfuBody_14 7894 2.36 3.10 2.08 107 HELO_NODOT 7634 1.60 0.53 2.01 108 HELO_NO_DOMAIN 7632 1.60 0.53 2.01 109 IN_HORDE_ADDRESS_BOOK 7561 1.46 0.07 1.99 110 TR_Symld_Words 7351 1.86 1.66 1.93 111 HTML_FONT_FACE_BAD 7305 1.59 0.72 1.92 112 INVALID_MSGID 7194 1.48 0.37 1.89 113 XM_B_SpammyTLD 7106 2.79 5.22 1.87 114 UNTRUSTED_Relay 6675 6.18 17.92 1.76 115 MSGID_NOFQDN1 6672 1.32 0.16 1.75 116 TVD_RCVD_IP 6539 1.29 0.16 1.72 117 XM_CamelCaseFrm001 6374 1.89 2.47 1.68 118 SUBJ_ALL_CAPS 6313 1.82 2.23 1.66 119 TO_MALFORMED 6262 1.20 0.01 1.65 120 TooManyTo_003 6150 1.36 0.68 1.62 121 HTML_IMAGE_ONLY_20 6065 1.47 1.13 1.60 122 TR_XM_SpammyWords5 5859 2.20 3.97 1.54 123 XM_DK_Undo_01 5849 1.75 2.30 1.54 124 XM_B_Unsub2 5838 1.86 2.72 1.54 125 BOTNET 5632 5.55 16.37 1.48 126 URI_HEX 5471 1.74 2.53 1.44 127 XMGappySubj_01 5185 1.06 0.24 1.36 128 XMCapTrack 5029 1.07 0.40 1.32 129 USER_IN_DEF_DKIM_WL 5017 0.97 0.03 1.32 130 T_XMDrugObfuBody_08 5004 1.62 2.42 1.32 131 XM_GoogleGroups 4778 1.12 0.75 1.26 132 XMHTML_After_End 4647 1.14 0.91 1.22 133 XMStockSpam_06 4558 1.43 2.03 1.20 134 XM_UB50 4497 2.24 5.06 1.18 135 TM2_M_VERY_LONG_WORD 4435 1.47 2.28 1.17 136 TooManyTo_004 4417 1.00 0.58 1.16 137 XMDiploma_00 4179 1.48 2.50 1.10 138 DKIM_ADSP_CUSTOM_MED 3876 1.21 1.72 1.02 139 XM_B_COVIDMETA 3873 1.77 3.77 1.02 140 RELAYCOUNTRY_CA 3849 2.12 5.07 1.01 141 HELO_MISC_IP 3830 0.75 0.06 1.01 142 XMSubMetaSxObfu_03 3828 1.02 1.04 1.01 143 URI_TRY_3LD 3788 1.25 1.93 1.00 144 RELAYCOUNTRY_GB 3684 1.07 1.34 0.97 145 XMBSHREFv2 3643 0.77 0.27 0.96 146 TooManyTo_005 3460 0.79 0.49 0.91 147 XM_OfRef6 3420 1.73 3.94 0.90 148 XM_H_Long_From02 3389 0.91 0.96 0.89 149 XM_ProductURIs 3289 0.82 0.69 0.87 150 XMSexyCombo_01 3206 1.17 2.02 0.84 151 TVD_SPACE_RATIO 3149 0.63 0.11 0.83 152 FROM_GOV_SPOOF 3146 0.65 0.17 0.83 153 T_TooManySym_03 3107 0.67 0.26 0.82 154 XMNoVowels 3024 0.69 0.41 0.80 155 T_FILL_THIS_FORM_SHORT 2946 1.26 2.53 0.77 156 TVD_SPACE_RATIO_MINFP 2937 0.64 0.28 0.77 157 SpammyFromTLD_01 2896 1.79 4.53 0.76 158 TR_MetaPhish_Combo_01 2807 0.84 1.11 0.74 159 XMBody_95 2798 0.56 0.09 0.74 160 TR_MSPIKEBAYES00 2703 0.52 0.02 0.71 161 RCVD_IN_BL_SPAMCOP_NET 2689 2.77 8.23 0.71 162 HTTPS_HTTP_MISMATCH 2652 0.74 0.84 0.70 163 T_OBFU_PDF_ATTACH 2650 0.57 0.23 0.70 164 XM_ShortIntro_01 2610 0.63 0.47 0.69 165 FROM_GOV_DKIM_AU 2607 0.52 0.09 0.69 166 NML_ADSP_CUSTOM_MED 2596 0.91 1.51 0.68 167 XMGenDplmaNmb 2586 0.98 1.79 0.68 168 TR_XM_SpammyWords2 2561 4.10 13.19 0.67 169 XM_H_PHPMailer 2422 0.69 0.84 0.64 170 RCVD_IN_SORBS_DUL 2407 0.50 0.15 0.63 171 SHORT_HELO_AND_INLINE_IMAGE 2311 0.46 0.06 0.61 172 T_XMDrugObfuBody_00 2256 0.84 1.50 0.59 173 XM_SPF_Unknown 2253 0.60 0.61 0.59 174 XM_Body_Dirty_Words_01 2174 0.76 1.27 0.57 175 RELAYCOUNTRY_DE 2094 0.70 1.11 0.55 176 HTML_TAG_BALANCE_BODY 2081 0.61 0.76 0.55 177 XMPhish30 2049 0.71 1.17 0.54 178 XM_B_COPY_HTML 2016 0.61 0.84 0.53 179 XMSexyCombo_04 2007 0.65 0.97 0.53 180 XMMoneyMeta_00 2004 0.53 0.56 0.53 181 XMSubMetaSx_01 1991 0.49 0.41 0.52 182 FORGED_GMAIL_RCVD 1983 0.79 1.51 0.52 183 SpammyFromTLD_02 1951 3.10 9.96 0.51 184 XMBrknScrpt_02 1948 0.91 1.97 0.51 185 TVD_PH_BODY_ACCOUNTS_PRE 1893 0.49 0.47 0.50 186 DIET_1 1865 0.59 0.85 0.49 187 XMSexyCombo_02 1839 0.45 0.35 0.48 188 XMHTMLBadTable_001 1786 0.52 0.65 0.47 189 XMBody_78 1760 0.63 1.06 0.46 190 MISSING_HEADERS 1738 0.47 0.51 0.46 191 TM2_M_BODY_EMPTY 1635 0.33 0.06 0.43 192 XM_B_SpammyWords4 1615 0.98 2.46 0.42 193 XMSubMetaI_00 1609 0.58 0.99 0.42 194 TR_XM_COVIDMETA4 1606 0.70 1.42 0.42 195 XMLngstWrd_00 1597 0.42 0.42 0.42 196 HTML_IMAGE_ONLY_32 1561 0.36 0.24 0.41 197 HTML_IMAGE_ONLY_28 1514 0.62 1.22 0.40 198 XM_H_SpoofStaff4 1511 0.30 0.05 0.40 199 XM_D_tchamptons_WL 1504 0.29 0.00 0.40 200 XMDateMe_00 1453 0.36 0.29 0.38 ----------------------------------------------------------------------