Email: 547998 Autolearn: 0 AvgScore: 2.73 AvgScanTime: 1.09 sec Spam: 141355 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.29 sec Ham: 406643 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.01 sec Time Spent Running SA: 165.27 hours Time Spent Processing Spam: 50.65 hours Time Spent Processing Ham: 114.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133509 86.39 94.45 83.58 2 DKIM_SIGNED 117419 71.73 83.07 67.78 3 XM_DK_Pass 112901 69.98 79.87 66.54 4 DKIM_VALID 110431 67.83 78.12 64.25 5 DCC_CHECK 103634 45.58 73.31 35.94 6 XM_B_Unicode 103175 67.43 72.99 65.50 7 RELAYCOUNTRY_US 100279 75.37 70.94 76.91 8 XM_B_SpammyWords 93550 48.44 66.18 42.28 9 XMListUnsubscribeExists 90582 45.14 64.08 38.55 10 DKIM_VALID_AU 83196 51.38 58.86 48.78 11 XM_DK_Undo_02 61834 16.17 43.74 6.59 12 XM_B_Unicode3 57228 37.45 40.49 36.39 13 BAYES_50 54619 52.18 38.64 56.89 14 XM_B_SpammyWords2 51689 21.10 36.57 15.72 15 TR_XM_DKIM_Undo 47627 12.20 33.69 4.73 16 BAYES_99 46987 13.17 33.24 6.20 17 LOC_TINY_FONT_1 46592 22.66 32.96 19.08 18 MIME_HTML_ONLY 45196 23.50 31.97 20.55 19 DKIM_VALID_EF 44025 29.80 31.14 29.33 20 HTML_FONT_LOW_CONTRAST 42729 24.94 30.23 23.10 21 FVGT_m_MULTI_ODD 39922 22.76 28.24 20.85 22 RCVD_IN_MSPIKE_H2 38680 24.45 27.36 23.43 23 T_KAM_HTML_FONT_INVALID 37058 18.04 26.22 15.20 24 BAYES_999 36915 10.43 26.12 4.98 25 TR_DCC_Bayes_99 35663 8.31 25.23 2.43 26 RELAYCOUNTRY_META 34652 10.15 24.51 5.16 27 XMSubLong 33810 21.25 23.92 20.32 28 DCC_CHECK_NEGATIVE 33789 51.87 23.90 61.59 29 T_TM2_M_HEADER_IN_MSG 32106 29.58 22.71 31.96 30 XM_Body_Dirty_Words 30841 13.23 21.82 10.25 31 RCVD_IN_MSPIKE_WL 29087 27.20 20.58 29.50 32 UNTRUSTED_Relay 27133 6.45 19.19 2.02 33 XM_UncommonTLD01 22924 6.82 16.22 3.55 34 BOTNET 22373 4.97 15.83 1.20 35 XM_Multi_Part_URI 20958 10.55 14.83 9.06 36 FSL_BULK_SIG 20772 9.49 14.69 7.69 37 XM_B_Unsub 20044 10.59 14.18 9.34 38 BOTNET_IPINHOSTNAME 18681 6.04 13.22 3.54 39 XMSexyCombo_05 18236 5.63 12.90 3.10 40 XM_B_SpammyWords3 16713 5.49 11.82 3.29 41 TR_XM_SpammyWords2 16505 3.61 11.68 0.81 42 RCVD_IN_MSPIKE_H3 15877 13.39 11.23 14.14 43 LOTS_OF_MONEY 15063 7.12 10.66 5.90 44 XM_Evil_Numbers_Gen 14861 8.01 10.51 7.14 45 UNPARSEABLE_RELAY 14354 7.54 10.15 6.63 46 TR_XM_UnparsRelay 14181 6.67 10.03 5.50 47 BAYES_60 13823 9.29 9.78 9.12 48 BAYES_80 13403 6.01 9.48 4.80 49 MPART_ALT_DIFF 13391 5.93 9.47 4.70 50 TR_XM_SpammyWords4 12723 5.10 9.00 3.74 51 LotsOfNums_01 12538 8.06 8.87 7.77 52 RCVD_IN_MSPIKE_H4 11782 10.04 8.34 10.63 53 RCVD_IN_BL_SPAMCOP_NET 11608 2.54 8.21 0.57 54 XM_SendGrid 10750 6.40 7.60 5.99 55 XM_B_Phish_Phrases 10663 6.79 7.54 6.52 56 XM_UB50 9913 2.89 7.01 1.46 57 XMSubMetaSx_00 9872 3.90 6.98 2.82 58 MIME_HTML_MOSTLY 9579 3.38 6.78 2.19 59 SpammyFromTLD_02 9429 1.89 6.67 0.23 60 SpammyFromTLD_01 8955 2.23 6.34 0.81 61 HTML_IMAGE_RATIO_02 8938 5.95 6.32 5.83 62 XM_H_Long_From01 8900 5.21 6.30 4.83 63 KHOP_HELO_FCRDNS 8766 3.41 6.20 2.44 64 TR_XM_PhishingBody 8202 3.66 5.80 2.92 65 RELAYCOUNTRY_CA 7857 2.29 5.56 1.15 66 T_REMOTE_IMAGE 7846 4.04 5.55 3.52 67 HTML_IMAGE_RATIO_04 7697 4.81 5.45 4.58 68 TooManyTo_001 7398 8.22 5.23 9.26 69 XMNumbers 7371 4.40 5.21 4.11 70 RCVD_IN_MSPIKE_BL 7148 1.44 5.06 0.19 71 TR_XM_MSPIKECOMBO 7069 1.42 5.00 0.18 72 DKIM_INVALID 6988 3.90 4.94 3.53 73 BAYES_95 6938 3.17 4.91 2.56 74 XM_B_SpammyTLD 6676 2.58 4.72 1.83 75 RELAYCOUNTRY_FR 6553 1.45 4.64 0.34 76 XM_DIRTYINTL 6306 1.42 4.46 0.36 77 TR_XM_DK_SendGrid 6213 4.03 4.40 3.90 78 HTML_FONT_SIZE_LARGE 5815 1.18 4.11 0.16 79 XM_SPF_SoftFail 5718 2.61 4.05 2.11 80 HTML_MIME_NO_HTML_TAG 5677 3.46 4.02 3.26 81 XMStrtUSub 5661 6.27 4.00 7.06 82 RCVD_IN_RP_SAFE 5541 5.46 3.92 6.00 83 XM_OfRef6 5255 1.71 3.72 1.01 84 XM_UB99 5237 0.96 3.70 0.00 85 HTML_IMAGE_ONLY_12 5168 1.12 3.66 0.23 86 MIME_QP_LONG_LINE 5047 4.43 3.57 4.73 87 TR_XM_SpammyWords5 4836 1.87 3.42 1.33 88 BOTNET_NORDNS 4825 0.89 3.41 0.02 89 XM_UB60 4802 0.97 3.40 0.12 90 BODY_URI_ONLY 4769 0.88 3.37 0.01 91 TM2_M_URI_OPT_OUT 4768 2.92 3.37 2.77 92 URIBL_SBL_A 4660 1.06 3.30 0.28 93 XM_B_Phish66 4633 2.31 3.28 1.97 94 XM_B_COVIDMETA 4513 1.47 3.19 0.88 95 RCVD_IN_MSPIKE_L5 4298 0.85 3.04 0.09 96 RCVD_IN_RP_CERTIFIED 4235 4.80 3.00 5.42 97 HTML_IMAGE_RATIO_06 4233 3.05 2.99 3.07 98 XM_UB80 4192 0.80 2.97 0.05 99 T_TooManySym_01 4104 4.96 2.90 5.68 100 URIBL_DBL_SPAM 4036 0.74 2.86 0.01 101 TM2_M_VERY_LONG_WORD 4001 1.50 2.83 1.04 102 RCVD_IN_RP_RNBL 3973 0.76 2.81 0.05 103 XM_UB999 3946 0.72 2.79 0.00 104 MIME_HTML_ONLY_MULTI 3866 2.87 2.73 2.91 105 T_XMDrugObfuBody_08 3863 1.77 2.73 1.44 106 RELAYCOUNTRY_GB 3785 1.65 2.68 1.30 107 XM_B_Unsub2 3778 1.60 2.67 1.23 108 HTML_IMAGE_RATIO_08 3723 2.00 2.63 1.78 109 TR_Sbj_FN_Bdy 3657 0.88 2.59 0.28 110 TR_XM_SB_Phish 3529 2.19 2.50 2.09 111 TR_XM_SpammyWords3 3526 0.72 2.49 0.10 112 XMSubEmpty 3470 0.94 2.45 0.41 113 RCVD_IN_PSBL 3461 0.68 2.45 0.06 114 XMSubPhish11 3448 2.15 2.44 2.05 115 HTML_SHORT_LINK_IMG_1 3438 0.64 2.43 0.01 116 XM_DK_Undo_01 3376 1.81 2.39 1.61 117 XMNoSubject 3359 0.77 2.38 0.21 118 MISSING_SUBJECT 3359 0.77 2.38 0.21 119 BODY_EMPTY 3355 0.73 2.37 0.16 120 T_XMDrugObfuBody_14 3323 2.02 2.35 1.90 121 URI_HEX 3289 1.45 2.33 1.14 122 XM_PDF 3269 6.17 2.31 7.51 123 XMDiploma_00 3182 1.47 2.25 1.20 124 FROM_EXCESS_BASE64 3163 1.92 2.24 1.81 125 PDS_OTHER_BAD_TLD 3161 0.77 2.24 0.26 126 XM_CamelCaseFrm001 3090 1.64 2.19 1.45 127 RCVD_IN_IADB_LISTED 3046 3.89 2.15 4.50 128 MIME_BASE64_TEXT 2924 0.59 2.07 0.08 129 T_XMHurry_00 2855 0.80 2.02 0.38 130 XMBrknScrpt_02 2767 0.95 1.96 0.61 131 RCVD_IN_IADB_SPF 2754 3.41 1.95 3.91 132 ALL_TRUSTED 2725 15.03 1.93 19.59 133 XM_URI_RBL 2680 0.58 1.90 0.12 134 RCVD_IN_IADB_DK 2621 2.97 1.85 3.36 135 XMStockSpam_06 2619 1.31 1.85 1.13 136 RCVD_IN_IADB_SENDERID 2583 3.06 1.83 3.48 137 XMSubMetaI_00 2561 0.73 1.81 0.36 138 TR_XM_MaxBayes 2550 0.47 1.80 0.01 139 MAILING_LIST_MULTI 2536 2.43 1.79 2.65 140 TR_XM_PHPDW 2501 0.66 1.77 0.28 141 URIBL_BLACK 2380 0.45 1.68 0.03 142 XM_UB95 2373 0.45 1.68 0.02 143 TR_XM_COVIDMETA4 2342 0.68 1.66 0.35 144 XM_B_SpammyWords4 2326 0.66 1.65 0.32 145 XMLngstWrd_00 2310 1.23 1.63 1.09 146 XM_Body_Dirty_Words_01 2308 0.52 1.63 0.13 147 SUBJ_ALL_CAPS 2278 1.57 1.61 1.55 148 BAYES_40 2271 3.89 1.61 4.69 149 XMLngstWrd_01 2246 1.16 1.59 1.01 150 TR_XM_BayesRelay 2231 0.42 1.58 0.01 151 TR_XM_PHPForged 2209 0.58 1.56 0.24 152 T_FILL_THIS_FORM_SHORT 2178 1.09 1.54 0.94 153 XMSexyCombo_01 2170 0.62 1.54 0.30 154 TR_XM_FormFill2 2167 0.58 1.53 0.24 155 XMBdyGiftCard01 2161 0.67 1.53 0.37 156 XM_H_PHPOS 2156 0.56 1.53 0.23 157 URI_NOVOWEL 2156 2.20 1.53 2.44 158 XMSubMetaSSx_00 2130 0.53 1.51 0.19 159 XMSubNoVowel 2080 2.26 1.47 2.53 160 TR_Symld_Words 2052 1.73 1.45 1.82 161 DIET_1 1972 0.69 1.40 0.44 162 HTTPS_HTTP_MISMATCH 1967 0.93 1.39 0.77 163 TR_XM_INV_DKIM 1943 0.46 1.37 0.14 164 TR_Mismatch_TLD_02 1943 0.41 1.37 0.07 165 XMBody_17 1928 0.63 1.36 0.38 166 T_XMDrugObfuBody_00 1866 0.68 1.32 0.45 167 RELAYCOUNTRY_CN 1845 0.39 1.31 0.07 168 XMGenDplmaNmb 1831 0.81 1.30 0.64 169 URI_TRY_3LD 1797 0.99 1.27 0.89 170 XM_BadFromFormat 1786 0.47 1.26 0.20 171 XM_B_SEO 1734 0.43 1.23 0.15 172 XMHTML_After_End 1719 1.29 1.22 1.32 173 ANY_BOUNCE_MESSAGE 1711 3.31 1.21 4.04 174 BOUNCE_MESSAGE 1710 3.31 1.21 4.04 175 RCVD_IN_MSPIKE_L4 1705 0.33 1.21 0.03 176 URI_PHP_REDIR 1679 0.31 1.19 0.00 177 DKIM_ADSP_NXDOMAIN 1661 0.49 1.18 0.25 178 HTML_SHORT_LINK_IMG_2 1613 0.32 1.14 0.03 179 RELAYCOUNTRY_DE 1593 0.63 1.13 0.46 180 TR_XM_COVIDMETA1 1571 0.50 1.11 0.29 181 TR_XM_SEO4 1558 0.34 1.10 0.08 182 HK_RANDOM_REPLYTO 1557 0.44 1.10 0.21 183 BAYES_20 1556 3.24 1.10 3.99 184 XMBody_78 1555 0.53 1.10 0.33 185 RELAYCOUNTRY_IN 1534 0.38 1.09 0.13 186 HTML_IMAGE_ONLY_20 1522 1.25 1.08 1.32 187 XMLngstWrd_02 1507 0.59 1.07 0.42 188 XM_H_Undi_Recip 1499 0.43 1.06 0.21 189 FROM_SUSPICIOUS_NTLD 1495 0.30 1.06 0.04 190 RCVD_IN_MSPIKE_H5 1428 3.76 1.01 4.72 191 NO_DNS_FOR_FROM 1407 0.41 1.00 0.21 192 MONEY_NOHTML 1401 0.33 0.99 0.11 193 T_HTML_TAG_BALANCE_CENTER 1399 0.35 0.99 0.13 194 FROM_SUSPICIOUS_NTLD_FP 1395 0.27 0.99 0.03 195 TR_XM_MaxWHORU 1395 0.40 0.99 0.19 196 TR_LOTS_OF_MONEY3 1390 0.40 0.98 0.19 197 XMLngstWrd_03 1387 0.47 0.98 0.30 198 GMD_PDF_HORIZ 1351 1.85 0.96 2.16 199 MY_SERVERS_FOUND 1349 0.76 0.95 0.70 200 GMD_PDF_SQUARE 1324 1.79 0.94 2.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 339887 86.39 94.45 83.58 2 RELAYCOUNTRY_US 312744 75.37 70.94 76.91 3 DKIM_SIGNED 275635 71.73 83.07 67.78 4 XM_DK_Pass 270589 69.98 79.87 66.54 5 XM_B_Unicode 266342 67.43 72.99 65.50 6 DKIM_VALID 261271 67.83 78.12 64.25 7 DCC_CHECK_NEGATIVE 250466 51.87 23.90 61.59 8 BAYES_50 231351 52.18 38.64 56.89 9 DKIM_VALID_AU 198347 51.38 58.86 48.78 10 XM_B_SpammyWords 171925 48.44 66.18 42.28 11 XMListUnsubscribeExists 156776 45.14 64.08 38.55 12 XM_B_Unicode3 147980 37.45 40.49 36.39 13 DCC_CHECK 146155 45.58 73.31 35.94 14 T_TM2_M_HEADER_IN_MSG 129968 29.58 22.71 31.96 15 RCVD_IN_MSPIKE_WL 119944 27.20 20.58 29.50 16 DKIM_VALID_EF 119271 29.80 31.14 29.33 17 RCVD_IN_MSPIKE_H2 95287 24.45 27.36 23.43 18 HTML_FONT_LOW_CONTRAST 93917 24.94 30.23 23.10 19 FVGT_m_MULTI_ODD 84804 22.76 28.24 20.85 20 MIME_HTML_ONLY 83557 23.50 31.97 20.55 21 XMSubLong 82618 21.25 23.92 20.32 22 ALL_TRUSTED 79666 15.03 1.93 19.59 23 LOC_TINY_FONT_1 77572 22.66 32.96 19.08 24 XM_B_SpammyWords2 63931 21.10 36.57 15.72 25 T_KAM_HTML_FONT_INVALID 61805 18.04 26.22 15.20 26 RCVD_IN_MSPIKE_H3 57516 13.39 11.23 14.14 27 RCVD_IN_MSPIKE_H4 43244 10.04 8.34 10.63 28 XM_DKIMWhitelistDomains 42454 7.76 0.04 10.44 29 XM_Body_Dirty_Words 41676 13.23 21.82 10.25 30 BAYES_00 39103 7.32 0.70 9.62 31 XM_B_Unsub 37998 10.59 14.18 9.34 32 TooManyTo_001 37668 8.22 5.23 9.26 33 BAYES_60 37104 9.29 9.78 9.12 34 XM_Multi_Part_URI 36838 10.55 14.83 9.06 35 LotsOfNums_01 31613 8.06 8.87 7.77 36 FSL_BULK_SIG 31257 9.49 14.69 7.69 37 XM_PDF 30548 6.17 2.31 7.51 38 XM_Evil_Numbers_Gen 29047 8.01 10.51 7.14 39 XMStrtUSub 28717 6.27 4.00 7.06 40 UNPARSEABLE_RELAY 26948 7.54 10.15 6.63 41 XM_DK_Undo_02 26781 16.17 43.74 6.59 42 XM_B_Phish_Phrases 26521 6.79 7.54 6.52 43 BAYES_99 25197 13.17 33.24 6.20 44 RCVD_IN_RP_SAFE 24394 5.46 3.92 6.00 45 XM_SendGrid 24342 6.40 7.60 5.99 46 LOTS_OF_MONEY 23974 7.12 10.66 5.90 47 HTML_IMAGE_RATIO_02 23687 5.95 6.32 5.83 48 T_TooManySym_01 23103 4.96 2.90 5.68 49 TR_XM_DK_Bayes 22786 4.28 0.49 5.60 50 TR_XM_UnparsRelay 22379 6.67 10.03 5.50 51 RCVD_IN_RP_CERTIFIED 22053 4.80 3.00 5.42 52 TR_XM_DK_Bayes1 21862 4.11 0.47 5.38 53 RELAYCOUNTRY_META 20965 10.15 24.51 5.16 54 BAYES_999 20247 10.43 26.12 4.98 55 IN_ZIMBRA_NJ_WHITELIST 20218 3.70 0.05 4.97 56 XM_H_Trusted_IP 19936 3.64 0.00 4.90 57 XM_H_Long_From01 19661 5.21 6.30 4.83 58 BAYES_80 19518 6.01 9.48 4.80 59 TR_XM_DKIM_Undo 19250 12.20 33.69 4.73 60 MIME_QP_LONG_LINE 19236 4.43 3.57 4.73 61 RCVD_IN_MSPIKE_H5 19184 3.76 1.01 4.72 62 MPART_ALT_DIFF 19105 5.93 9.47 4.70 63 BAYES_40 19057 3.89 1.61 4.69 64 HTML_IMAGE_RATIO_04 18635 4.81 5.45 4.58 65 TR_XM_DK_Bayes2 18491 3.47 0.37 4.55 66 RCVD_IN_IADB_LISTED 18298 3.89 2.15 4.50 67 USER_IN_DEF_DKIM_WL 17916 3.38 0.44 4.41 68 XMNumbers 16722 4.40 5.21 4.11 69 ANY_BOUNCE_MESSAGE 16440 3.31 1.21 4.04 70 BOUNCE_MESSAGE 16439 3.31 1.21 4.04 71 BAYES_20 16212 3.24 1.10 3.99 72 RCVD_IN_IADB_SPF 15908 3.41 1.95 3.91 73 TR_XM_DK_SendGrid 15849 4.03 4.40 3.90 74 TR_XM_SpammyWords4 15211 5.10 9.00 3.74 75 XM_UncommonTLD01 14455 6.82 16.22 3.55 76 BOTNET_IPINHOSTNAME 14398 6.04 13.22 3.54 77 DKIM_INVALID 14364 3.90 4.94 3.53 78 T_REMOTE_IMAGE 14313 4.04 5.55 3.52 79 RCVD_IN_IADB_SENDERID 14168 3.06 1.83 3.48 80 RCVD_IN_IADB_DK 13668 2.97 1.85 3.36 81 XM_B_SpammyWords3 13363 5.49 11.82 3.29 82 HTML_MIME_NO_HTML_TAG 13258 3.46 4.02 3.26 83 XMSexyCombo_05 12597 5.63 12.90 3.10 84 HTML_IMAGE_RATIO_06 12483 3.05 2.99 3.07 85 TR_XM_PhishingBody 11863 3.66 5.80 2.92 86 MIME_HTML_ONLY_MULTI 11851 2.87 2.73 2.91 87 XMSubMetaSx_00 11475 3.90 6.98 2.82 88 T_TooManySym_02 11302 2.24 0.70 2.78 89 TM2_M_URI_OPT_OUT 11257 2.92 3.37 2.77 90 RCVD_IN_IADB_VOUCHED 11192 2.26 0.86 2.75 91 MAILING_LIST_MULTI 10789 2.43 1.79 2.65 92 TooManyTo_002 10756 2.16 0.76 2.65 93 BAYES_95 10416 3.17 4.91 2.56 94 XMSubNoVowel 10284 2.26 1.47 2.53 95 KHOP_HELO_FCRDNS 9935 3.41 6.20 2.44 96 URI_NOVOWEL 9916 2.20 1.53 2.44 97 TR_DCC_Bayes_99 9895 8.31 25.23 2.43 98 MIME_HTML_MOSTLY 8919 3.38 6.78 2.19 99 GMD_PDF_HORIZ 8792 1.85 0.96 2.16 100 BAYES_05 8685 1.72 0.54 2.14 101 XM_SPF_SoftFail 8576 2.61 4.05 2.11 102 HELO_NODOT 8569 1.74 0.70 2.11 103 HELO_NO_DOMAIN 8568 1.74 0.70 2.11 104 GMD_PDF_SQUARE 8506 1.79 0.94 2.09 105 TR_XM_SB_Phish 8495 2.19 2.50 2.09 106 XMSubPhish11 8327 2.15 2.44 2.05 107 UNTRUSTED_Relay 8225 6.45 19.19 2.02 108 XM_B_Phish66 8004 2.31 3.28 1.97 109 T_XMDrugObfuBody_14 7745 2.02 2.35 1.90 110 XM_B_SpammyTLD 7438 2.58 4.72 1.83 111 RCVD_IN_IADB_OPTIN 7424 1.52 0.62 1.83 112 TR_Symld_Words 7407 1.73 1.45 1.82 113 FROM_EXCESS_BASE64 7372 1.92 2.24 1.81 114 HTML_IMAGE_RATIO_08 7224 2.00 2.63 1.78 115 IN_HORDE_ADDRESS_BOOK 7223 1.34 0.09 1.78 116 TooManyTo_003 7208 1.48 0.62 1.77 117 INVALID_MSGID 6919 1.36 0.36 1.70 118 XM_DK_Undo_01 6566 1.81 2.39 1.61 119 SUBJ_ALL_CAPS 6320 1.57 1.61 1.55 120 TO_MALFORMED 6271 1.18 0.15 1.54 121 XMCapTrack 6060 1.24 0.52 1.49 122 TVD_RCVD_IP 5995 1.14 0.19 1.47 123 XM_UB50 5945 2.89 7.01 1.46 124 XM_CamelCaseFrm001 5880 1.64 2.19 1.45 125 T_XMDrugObfuBody_08 5848 1.77 2.73 1.44 126 TR_XM_SpammyWords5 5404 1.87 3.42 1.33 127 XMHTML_After_End 5354 1.29 1.22 1.32 128 HTML_IMAGE_ONLY_20 5352 1.25 1.08 1.32 129 RELAYCOUNTRY_GB 5281 1.65 2.68 1.30 130 TVD_SPACE_RATIO 5267 0.99 0.12 1.30 131 TooManyTo_004 5254 1.10 0.53 1.29 132 XM_B_Unsub2 5016 1.60 2.67 1.23 133 XMDiploma_00 4891 1.47 2.25 1.20 134 BOTNET 4882 4.97 15.83 1.20 135 XM_GoogleGroups 4701 1.02 0.61 1.16 136 RELAYCOUNTRY_CA 4668 2.29 5.56 1.15 137 URI_HEX 4644 1.45 2.33 1.14 138 XMStockSpam_06 4585 1.31 1.85 1.13 139 MSGID_NOFQDN1 4522 0.86 0.14 1.11 140 XMLngstWrd_00 4424 1.23 1.63 1.09 141 HTML_FONT_FACE_BAD 4394 1.01 0.83 1.08 142 XMGappySubj_01 4362 0.83 0.13 1.07 143 XM_ProductURIs 4358 0.99 0.76 1.07 144 TooManyTo_005 4280 0.90 0.46 1.05 145 TM2_M_VERY_LONG_WORD 4216 1.50 2.83 1.04 146 DKIM_ADSP_CUSTOM_MED 4210 0.99 0.88 1.04 147 XMLngstWrd_01 4106 1.16 1.59 1.01 148 XM_OfRef6 4097 1.71 3.72 1.01 149 XM_H_Long_From02 4066 0.98 0.93 1.00 150 T_FILL_THIS_FORM_SHORT 3811 1.09 1.54 0.94 151 URI_TRY_3LD 3610 0.99 1.27 0.89 152 XM_B_COVIDMETA 3565 1.47 3.19 0.88 153 XMBSHREFv2 3503 0.70 0.25 0.86 154 TVD_SPACE_RATIO_MINFP 3493 0.77 0.50 0.86 155 XM_E_Blogspot 3294 0.62 0.09 0.81 156 TR_XM_SpammyWords2 3283 3.61 11.68 0.81 157 SpammyFromTLD_01 3282 2.23 6.34 0.81 158 HTTPS_HTTP_MISMATCH 3128 0.93 1.39 0.77 159 XMBody_95 3112 0.59 0.08 0.77 160 T_TooManySym_03 2926 0.60 0.26 0.72 161 TR_MetaPhish_Combo_01 2861 0.76 0.91 0.70 162 XMNoVowels 2859 0.64 0.47 0.70 163 XMSolicitRefs_0 2855 0.63 0.42 0.70 164 NML_ADSP_CUSTOM_MED 2852 0.71 0.73 0.70 165 MY_SERVERS_FOUND 2833 0.76 0.95 0.70 166 XM_SPF_Unknown 2831 0.68 0.62 0.70 167 RCVD_IN_SORBS_DUL 2793 0.57 0.22 0.69 168 XM_ShortIntro_01 2658 0.67 0.71 0.65 169 XMGenDplmaNmb 2620 0.81 1.30 0.64 170 FROM_GOV_SPOOF 2605 0.53 0.22 0.64 171 T_OBFU_PDF_ATTACH 2516 0.52 0.23 0.62 172 XMBrknScrpt_02 2462 0.95 1.96 0.61 173 RCVD_IN_BL_SPAMCOP_NET 2330 2.54 8.21 0.57 174 SHORT_HELO_AND_INLINE_IMAGE 2328 0.46 0.13 0.57 175 XM_H_PHPMailer 2275 0.64 0.89 0.56 176 XM_RXBody 2247 0.51 0.40 0.55 177 TM2_M_BODY_EMPTY 2230 0.43 0.07 0.55 178 FROM_NO_USER 2181 0.41 0.03 0.54 179 XMMoneyMeta_00 2120 0.59 0.78 0.52 180 HTML_IMAGE_ONLY_32 2106 0.44 0.22 0.52 181 FORGED_GMAIL_RCVD 2078 0.57 0.75 0.51 182 MISSING_HEADERS 2062 0.54 0.62 0.51 183 URI_OPTOUT_3LD 2030 0.56 0.73 0.50 184 XMHTMLBadTable_001 2020 0.53 0.62 0.50 185 T_Symld_Words_02 1887 0.55 0.81 0.46 186 HTML_IMAGE_ONLY_28 1886 0.46 0.44 0.46 187 HELO_MISC_IP 1863 0.35 0.03 0.46 188 XM_B_REG_HTML 1855 0.44 0.41 0.46 189 RELAYCOUNTRY_DE 1853 0.63 1.13 0.46 190 T_XMDrugObfuBody_00 1845 0.68 1.32 0.45 191 DIET_1 1799 0.69 1.40 0.44 192 XMDateMe_00 1777 0.48 0.62 0.44 193 XM_B_COPY_HTML 1744 0.48 0.62 0.43 194 RDNS_DYNAMIC 1725 0.53 0.82 0.42 195 TR_MSPIKEBAYES00 1721 0.32 0.01 0.42 196 XMLngstWrd_02 1719 0.59 1.07 0.42 197 HTML_IMAGE_ONLY_24 1692 0.38 0.28 0.42 198 XMSubEmpty 1670 0.94 2.45 0.41 199 NICE_REPLY_A 1660 0.31 0.02 0.41 200 HTML_TAG_BALANCE_BODY 1618 0.47 0.67 0.40 ----------------------------------------------------------------------