Email: 620398 Autolearn: 0 AvgScore: -7.38 AvgScanTime: 1.17 sec Spam: 145945 Autolearn: 0 AvgScore: 13.95 AvgScanTime: 1.35 sec Ham: 474453 Autolearn: 0 AvgScore: -13.94 AvgScanTime: 1.12 sec Time Spent Running SA: 202.04 hours Time Spent Processing Spam: 54.84 hours Time Spent Processing Ham: 147.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131798 87.61 90.31 86.78 2 DKIM_SIGNED 114973 66.53 78.78 62.76 3 XM_B_Unicode 113328 73.01 77.65 71.58 4 XM_DK_Pass 110096 64.92 75.44 61.68 5 DKIM_VALID 107268 63.05 73.50 59.84 6 DCC_CHECK 105485 44.07 72.28 35.39 7 RELAYCOUNTRY_US 101751 69.89 69.72 69.94 8 XM_B_SpammyWords 99754 56.85 68.35 53.31 9 XMListUnsubscribeExists 93666 43.96 64.18 37.74 10 DKIM_VALID_AU 76471 46.84 52.40 45.13 11 BAYES_50 62046 57.24 42.51 61.77 12 XM_DK_Undo_02 60494 14.89 41.45 6.72 13 XM_B_Unicode3 57864 34.81 39.65 33.32 14 XM_B_SpammyWords2 49710 19.76 34.06 15.36 15 TR_XM_DKIM_Undo 49124 11.91 33.66 5.23 16 LOC_TINY_FONT_1 47828 21.75 32.77 18.36 17 BAYES_99 45521 11.59 31.19 5.56 18 MIME_HTML_ONLY 44350 20.24 30.39 17.12 19 HTML_FONT_LOW_CONTRAST 44305 32.91 30.36 33.70 20 DKIM_VALID_EF 43274 26.85 29.65 25.99 21 T_KAM_HTML_FONT_INVALID 41136 18.00 28.19 14.86 22 T_TM2_M_HEADER_IN_MSG 39354 27.13 26.96 27.18 23 FVGT_m_MULTI_ODD 38524 21.05 26.40 19.40 24 DCC_CHECK_NEGATIVE 37068 53.66 25.40 62.36 25 RCVD_IN_MSPIKE_H2 36509 22.02 25.02 21.10 26 TR_DCC_Bayes_99 35093 7.67 24.05 2.63 27 BAYES_999 34876 9.04 23.90 4.46 28 XMSubLong 34719 19.66 23.79 18.40 29 RCVD_IN_MSPIKE_WL 30143 25.50 20.65 26.98 30 RELAYCOUNTRY_META 29729 7.90 20.37 4.07 31 XM_Body_Dirty_Words 29685 11.42 20.34 8.67 32 UNTRUSTED_Relay 24422 5.09 16.73 1.51 33 LOTS_OF_MONEY 22047 7.35 15.11 4.97 34 XM_UncommonTLD01 21974 5.81 15.06 2.97 35 XM_Multi_Part_URI 21099 10.29 14.46 9.00 36 BOTNET 20997 4.26 14.39 1.14 37 FSL_BULK_SIG 20585 8.77 14.10 7.12 38 TR_XM_SpammyWords4 20216 5.54 13.85 2.98 39 BOTNET_IPINHOSTNAME 19906 5.81 13.64 3.41 40 XM_B_Unsub 18079 19.04 12.39 21.09 41 XM_B_SpammyWords3 16497 5.04 11.30 3.11 42 RCVD_IN_MSPIKE_H3 16487 12.46 11.30 12.82 43 XMSexyCombo_05 16386 4.45 11.23 2.37 44 TR_XM_SpammyWords2 14695 3.19 10.07 1.07 45 UNPARSEABLE_RELAY 14350 7.02 9.83 6.15 46 TR_XM_UnparsRelay 13933 6.22 9.55 5.19 47 XM_Evil_Numbers_Gen 13003 7.06 8.91 6.49 48 BAYES_80 12922 5.34 8.85 4.26 49 RCVD_IN_BL_SPAMCOP_NET 12763 2.69 8.75 0.82 50 XM_H_Long_From01 12667 5.50 8.68 4.53 51 MPART_ALT_DIFF 12480 5.24 8.55 4.22 52 XM_SPF_SoftFail 12156 3.26 8.33 1.70 53 BAYES_60 12141 8.23 8.32 8.20 54 RCVD_IN_MSPIKE_H4 12035 9.64 8.25 10.07 55 XM_OfRef6 11574 2.61 7.93 0.97 56 XM_B_Phish_Phrases 11425 6.21 7.83 5.72 57 LotsOfNums_01 11130 7.58 7.63 7.57 58 XM_SendGrid 10816 5.97 7.41 5.53 59 TR_XM_PhishingBody 10536 4.01 7.22 3.02 60 SpammyFromTLD_02 10066 1.88 6.90 0.33 61 ALL_TRUSTED 9850 22.47 6.75 27.30 62 XMSubMetaSx_00 9776 3.57 6.70 2.61 63 HTML_IMAGE_RATIO_02 9633 5.26 6.60 4.85 64 MIME_HTML_MOSTLY 9131 2.96 6.26 1.94 65 KHOP_HELO_FCRDNS 8871 2.63 6.08 1.57 66 T_REMOTE_IMAGE 8731 3.67 5.98 2.96 67 RELAYCOUNTRY_CA 8224 2.06 5.63 0.96 68 XM_UB50 8219 2.10 5.63 1.02 69 T_FILL_THIS_FORM_SHORT 8084 1.88 5.54 0.76 70 XM_H_Undi_Recip 7904 1.40 5.42 0.17 71 DKIM_INVALID 7705 3.48 5.28 2.92 72 SpammyFromTLD_01 7681 1.82 5.26 0.76 73 DKIM_ADSP_CUSTOM_MED 7624 1.81 5.22 0.76 74 XMNumbers 7487 3.30 5.13 2.73 75 FORGED_GMAIL_RCVD 7441 1.49 5.10 0.38 76 NML_ADSP_CUSTOM_MED 7357 1.57 5.04 0.50 77 XM_S_SpammyWords 7205 1.45 4.94 0.37 78 TR_XM_Spammywords 7205 1.45 4.94 0.37 79 TooManyTo_001 7133 7.14 4.89 7.84 80 TR_XM_Undi_Recip11 7033 1.16 4.82 0.03 81 BAYES_95 7027 2.89 4.81 2.30 82 LOADSA_MONEY_COMBO 6996 1.16 4.79 0.04 83 MONEY_NOHTML 6966 1.19 4.77 0.09 84 TR_XM_Undi_Recip2 6838 1.11 4.69 0.01 85 TR_XM_Undi_RecipCombo2 6828 1.10 4.68 0.00 86 ADVANCE_FEE_5_NEW_MONEY 6656 1.07 4.56 0.00 87 XFER_LOTSA_MONEY 6641 1.09 4.55 0.03 88 XM_B_Phish66 6624 2.51 4.54 1.89 89 MILLION_USD 6609 1.07 4.53 0.01 90 MILLION_HUNDRED 6524 1.05 4.47 0.00 91 TR_XM_Undi_Recip5 6522 1.06 4.47 0.01 92 MONEY_FORM_SHORT 6516 1.05 4.46 0.00 93 XMStrtUSub 6470 5.93 4.43 6.39 94 FORM_FRAUD_5 6447 1.04 4.42 0.00 95 XM_B_SpammyTLD 6421 2.27 4.40 1.62 96 MONEY_ATM_CARD 6409 1.03 4.39 0.00 97 HTML_IMAGE_RATIO_04 6395 4.27 4.38 4.24 98 HTML_FONT_SIZE_LARGE 6363 1.10 4.36 0.10 99 TR_XM_DK_SendGrid 6231 3.71 4.27 3.54 100 TR_XM_SB_Phish 5936 2.51 4.07 2.03 101 RCVD_IN_MSPIKE_BL 5753 1.02 3.94 0.12 102 TR_XM_MSPIKECOMBO 5728 1.01 3.92 0.11 103 HTML_IMAGE_ONLY_12 5716 1.05 3.92 0.17 104 TR_XM_SpammyWords5 5603 1.84 3.84 1.23 105 XM_UB99 5046 0.81 3.46 0.00 106 XM_DIRTYINTL 5044 1.09 3.46 0.36 107 BODY_URI_ONLY 5031 0.82 3.45 0.01 108 MIME_QP_LONG_LINE 5021 4.31 3.44 4.57 109 XM_B_COVIDMETA 4931 1.35 3.38 0.72 110 TM2_M_URI_OPT_OUT 4868 2.59 3.34 2.35 111 HTML_IMAGE_RATIO_06 4708 3.35 3.23 3.39 112 MIME_HTML_ONLY_MULTI 4535 2.91 3.11 2.86 113 RELAYCOUNTRY_FR 4488 0.90 3.08 0.23 114 XM_UB60 4452 0.82 3.05 0.13 115 MIXED_FONT_CASE 4431 0.71 3.04 0.00 116 JH_SPAMMY_PATTERN01 4408 0.71 3.02 0.00 117 T_XMDrugObfuBody_08 4301 1.94 2.95 1.64 118 HTML_IMAGE_RATIO_08 4289 2.09 2.94 1.83 119 HTML_SHORT_LINK_IMG_1 4122 0.67 2.82 0.01 120 RCVD_IN_RP_RNBL 4000 0.67 2.74 0.04 121 XM_UB80 3853 0.64 2.64 0.03 122 RCVD_IN_MSPIKE_L5 3824 0.64 2.62 0.04 123 RCVD_IN_RP_SAFE 3821 4.92 2.62 5.63 124 XMSubPhish11 3813 2.07 2.61 1.90 125 PDS_OTHER_BAD_TLD 3689 0.77 2.53 0.23 126 XM_PDF 3680 4.19 2.52 4.71 127 BOTNET_NORDNS 3548 0.58 2.43 0.01 128 RCVD_IN_IADB_LISTED 3544 4.04 2.43 4.54 129 TM2_M_VERY_LONG_WORD 3515 1.36 2.41 1.04 130 XM_UB999 3508 0.57 2.40 0.00 131 XM_B_Unsub2 3495 1.63 2.39 1.40 132 T_XMDrugObfuBody_14 3475 1.84 2.38 1.67 133 URI_HEX 3246 1.41 2.22 1.16 134 URIBL_SBL_A 3225 0.71 2.21 0.25 135 XM_URI_RBL 3217 0.60 2.20 0.10 136 XM_DK_Undo_01 3204 1.68 2.20 1.52 137 RCVD_IN_IADB_SPF 3100 3.50 2.12 3.92 138 MAILING_LIST_MULTI 3093 2.62 2.12 2.78 139 FROM_EXCESS_BASE64 3059 2.00 2.10 1.97 140 XM_CamelCaseFrm001 3035 1.56 2.08 1.41 141 XMDiploma_00 2973 1.36 2.04 1.15 142 HTML_MIME_NO_HTML_TAG 2958 2.37 2.03 2.48 143 XM_B_SpammyWords4 2923 0.73 2.00 0.34 144 RCVD_IN_RP_CERTIFIED 2919 4.33 2.00 5.04 145 RCVD_IN_IADB_DK 2900 3.01 1.99 3.33 146 RCVD_IN_PSBL 2890 0.51 1.98 0.06 147 T_TooManySym_01 2873 4.00 1.97 4.62 148 RCVD_IN_IADB_SENDERID 2871 3.12 1.97 3.47 149 URIBL_BLACK 2780 0.47 1.90 0.03 150 TR_XM_SpammyWords3 2700 0.48 1.85 0.06 151 TR_XM_COVIDMETA4 2630 0.66 1.80 0.31 152 XMBody_17 2588 0.68 1.77 0.34 153 TR_XM_INV_DKIM 2520 0.45 1.73 0.05 154 XMStockSpam_06 2503 0.84 1.72 0.57 155 SUBJ_ALL_CAPS 2421 1.40 1.66 1.32 156 TR_XM_SpoofPhishAttach 2420 0.50 1.66 0.15 157 TR_XM_BayesRelay 2419 0.40 1.66 0.01 158 T_XMDrugObfuBody_00 2411 0.82 1.65 0.56 159 BAYES_40 2386 3.52 1.63 4.10 160 USER_IN_DEF_DKIM_WL 2382 7.16 1.63 8.86 161 TR_Symld_Words 2346 1.58 1.61 1.57 162 URIBL_DBL_SPAM 2330 0.38 1.60 0.01 163 URI_PHP_REDIR 2307 0.37 1.58 0.00 164 XMSexyCombo_01 2285 0.60 1.57 0.30 165 GMD_PDF_HORIZ 2272 0.61 1.56 0.32 166 GMD_PDF_SQUARE 2269 0.55 1.55 0.24 167 T_XMHurry_00 2258 0.69 1.55 0.42 168 XMMoneyMeta_00 2239 0.75 1.53 0.50 169 XM_BadFromFormat 2217 0.45 1.52 0.12 170 RELAYCOUNTRY_GB 2208 1.03 1.51 0.88 171 URI_NOVOWEL 2201 1.97 1.51 2.11 172 TR_XM_PHPDW 2158 0.54 1.48 0.25 173 XMSubPhish18 2107 0.44 1.44 0.13 174 XM_UB95 2106 0.35 1.44 0.01 175 HTML_SHORT_LINK_IMG_2 2094 0.36 1.43 0.03 176 HK_RANDOM_REPLYTO 2083 0.45 1.43 0.15 177 TR_XM_PHPForged 2043 0.50 1.40 0.22 178 XMHTML_After_End 2031 1.12 1.39 1.03 179 TR_XM_FormFill2 2022 0.50 1.39 0.22 180 XM_H_PHPOS 2018 0.49 1.38 0.21 181 HTTPS_HTTP_MISMATCH 1916 0.79 1.31 0.64 182 BAYES_20 1912 2.85 1.31 3.32 183 XMSubNoVowel 1904 1.39 1.30 1.41 184 RELAYCOUNTRY_IN 1883 0.38 1.29 0.11 185 URI_TRY_3LD 1878 0.93 1.29 0.82 186 XMGenDplmaNmb 1776 0.76 1.22 0.62 187 TR_XM_MaxBayes 1725 0.28 1.18 0.00 188 XMLngstWrd_00 1724 0.61 1.18 0.44 189 XMLngstWrd_01 1671 0.56 1.14 0.38 190 RCVD_IN_IADB_VOUCHED 1666 2.47 1.14 2.88 191 DIET_1 1655 0.59 1.13 0.42 192 XMBrknScrpt_02 1639 0.90 1.12 0.83 193 TR_XM_COVIDMETA1 1634 0.49 1.12 0.29 194 RCVD_IN_MSPIKE_H5 1621 3.39 1.11 4.09 195 XMBody_78 1543 0.48 1.06 0.30 196 XMSubMetaI_00 1531 0.60 1.05 0.46 197 XM_Body_Dirty_Words_01 1531 0.34 1.05 0.12 198 TR_MetaPhish_Combo_01 1498 10.77 1.03 13.77 199 RELAYCOUNTRY_DE 1427 0.58 0.98 0.45 200 FROM_SUSPICIOUS_NTLD 1380 0.25 0.95 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 411752 87.61 90.31 86.78 2 XM_B_Unicode 339598 73.01 77.65 71.58 3 RELAYCOUNTRY_US 331815 69.89 69.72 69.94 4 DKIM_SIGNED 297766 66.53 78.78 62.76 5 DCC_CHECK_NEGATIVE 295864 53.66 25.40 62.36 6 BAYES_50 293071 57.24 42.51 61.77 7 XM_DK_Pass 292655 64.92 75.44 61.68 8 DKIM_VALID 283911 63.05 73.50 59.84 9 XM_B_SpammyWords 252938 56.85 68.35 53.31 10 DKIM_VALID_AU 214100 46.84 52.40 45.13 11 XMListUnsubscribeExists 179076 43.96 64.18 37.74 12 DCC_CHECK 167917 44.07 72.28 35.39 13 HTML_FONT_LOW_CONTRAST 159891 32.91 30.36 33.70 14 XM_B_Unicode3 158108 34.81 39.65 33.32 15 ALL_TRUSTED 129532 22.47 6.75 27.30 16 T_TM2_M_HEADER_IN_MSG 128980 27.13 26.96 27.18 17 RCVD_IN_MSPIKE_WL 128028 25.50 20.65 26.98 18 DKIM_VALID_EF 123321 26.85 29.65 25.99 19 RCVD_IN_MSPIKE_H2 100096 22.02 25.02 21.10 20 XM_B_Unsub 100057 19.04 12.39 21.09 21 FVGT_m_MULTI_ODD 92066 21.05 26.40 19.40 22 XMSubLong 87278 19.66 23.79 18.40 23 LOC_TINY_FONT_1 87102 21.75 32.77 18.36 24 MIME_HTML_ONLY 81210 20.24 30.39 17.12 25 XM_B_SpammyWords2 72895 19.76 34.06 15.36 26 T_KAM_HTML_FONT_INVALID 70523 18.00 28.19 14.86 27 TR_MetaPhish_Combo_01 65343 10.77 1.03 13.77 28 MISSING_HEADERS 64070 10.44 0.47 13.50 29 XM_H_SpoofStaff4 62554 10.12 0.15 13.18 30 XMSUPPORT 62120 10.01 0.00 13.09 31 RCVD_IN_MSPIKE_H3 60815 12.46 11.30 12.82 32 RCVD_IN_MSPIKE_H4 47786 9.64 8.25 10.07 33 XM_DKIMWhitelistDomains 43894 7.08 0.01 9.25 34 XM_Multi_Part_URI 42709 10.29 14.46 9.00 35 USER_IN_DEF_DKIM_WL 42056 7.16 1.63 8.86 36 BAYES_00 41160 6.79 0.66 8.68 37 XM_Body_Dirty_Words 41144 11.42 20.34 8.67 38 BAYES_60 38924 8.23 8.32 8.20 39 TooManyTo_001 37179 7.14 4.89 7.84 40 LotsOfNums_01 35898 7.58 7.63 7.57 41 FSL_BULK_SIG 33798 8.77 14.10 7.12 42 XM_DK_Undo_02 31889 14.89 41.45 6.72 43 XM_Evil_Numbers_Gen 30771 7.06 8.91 6.49 44 XMStrtUSub 30317 5.93 4.43 6.39 45 UNPARSEABLE_RELAY 29195 7.02 9.83 6.15 46 XM_B_Phish_Phrases 27120 6.21 7.83 5.72 47 RCVD_IN_RP_SAFE 26708 4.92 2.62 5.63 48 BAYES_99 26371 11.59 31.19 5.56 49 XM_SendGrid 26217 5.97 7.41 5.53 50 TR_XM_DKIM_Undo 24792 11.91 33.66 5.23 51 TR_XM_UnparsRelay 24638 6.22 9.55 5.19 52 TR_XM_DK_Bayes 24146 3.99 0.41 5.09 53 RCVD_IN_RP_CERTIFIED 23930 4.33 2.00 5.04 54 LOTS_OF_MONEY 23558 7.35 15.11 4.97 55 TR_XM_DK_Bayes1 23332 3.85 0.40 4.92 56 HTML_IMAGE_RATIO_02 23021 5.26 6.60 4.85 57 XM_PDF 22339 4.19 2.52 4.71 58 T_TooManySym_01 21930 4.00 1.97 4.62 59 MIME_QP_LONG_LINE 21704 4.31 3.44 4.57 60 RCVD_IN_IADB_LISTED 21521 4.04 2.43 4.54 61 XM_H_Long_From01 21479 5.50 8.68 4.53 62 BAYES_999 21184 9.04 23.90 4.46 63 IN_ZIMBRA_NJ_WHITELIST 20621 3.34 0.05 4.35 64 BAYES_80 20220 5.34 8.85 4.26 65 HTML_IMAGE_RATIO_04 20109 4.27 4.38 4.24 66 MPART_ALT_DIFF 20037 5.24 8.55 4.22 67 TR_XM_DK_Bayes2 19707 3.26 0.34 4.15 68 BAYES_40 19445 3.52 1.63 4.10 69 RCVD_IN_MSPIKE_H5 19427 3.39 1.11 4.09 70 RELAYCOUNTRY_META 19303 7.90 20.37 4.07 71 RCVD_IN_IADB_SPF 18583 3.50 2.12 3.92 72 XM_H_Trusted_IP 17623 2.84 0.00 3.71 73 TR_XM_DK_SendGrid 16785 3.71 4.27 3.54 74 RCVD_IN_IADB_SENDERID 16455 3.12 1.97 3.47 75 BOTNET_IPINHOSTNAME 16165 5.81 13.64 3.41 76 HTML_IMAGE_RATIO_06 16086 3.35 3.23 3.39 77 RCVD_IN_IADB_DK 15804 3.01 1.99 3.33 78 BAYES_20 15761 2.85 1.31 3.32 79 XM_B_SpammyWords3 14743 5.04 11.30 3.11 80 TR_XM_PhishingBody 14340 4.01 7.22 3.02 81 TR_XM_SpammyWords4 14131 5.54 13.85 2.98 82 XM_UncommonTLD01 14075 5.81 15.06 2.97 83 T_REMOTE_IMAGE 14052 3.67 5.98 2.96 84 DKIM_INVALID 13855 3.48 5.28 2.92 85 RCVD_IN_IADB_VOUCHED 13676 2.47 1.14 2.88 86 MIME_HTML_ONLY_MULTI 13548 2.91 3.11 2.86 87 MAILING_LIST_MULTI 13181 2.62 2.12 2.78 88 ANY_BOUNCE_MESSAGE 12967 2.31 0.93 2.73 89 BOUNCE_MESSAGE 12967 2.31 0.93 2.73 90 XMNumbers 12960 3.30 5.13 2.73 91 TR_DCC_Bayes_99 12474 7.67 24.05 2.63 92 XMSubMetaSx_00 12381 3.57 6.70 2.61 93 HTML_MIME_NO_HTML_TAG 11771 2.37 2.03 2.48 94 T_TooManySym_02 11243 1.93 0.51 2.37 95 XMSexyCombo_05 11225 4.45 11.23 2.37 96 TM2_M_URI_OPT_OUT 11173 2.59 3.34 2.35 97 BAYES_95 10923 2.89 4.81 2.30 98 TooManyTo_002 10296 1.84 0.78 2.17 99 URI_NOVOWEL 10005 1.97 1.51 2.11 100 TR_XM_SB_Phish 9630 2.51 4.07 2.03 101 FROM_EXCESS_BASE64 9346 2.00 2.10 1.97 102 MIME_HTML_MOSTLY 9226 2.96 6.26 1.94 103 RCVD_IN_IADB_OPTIN 9067 1.65 0.78 1.91 104 XMSubPhish11 9021 2.07 2.61 1.90 105 XM_B_Phish66 8960 2.51 4.54 1.89 106 HTML_IMAGE_RATIO_08 8702 2.09 2.94 1.83 107 BAYES_05 8577 1.55 0.71 1.81 108 HELO_NODOT 8364 1.50 0.66 1.76 109 HELO_NO_DOMAIN 8361 1.50 0.65 1.76 110 XM_SPF_SoftFail 8060 3.26 8.33 1.70 111 T_XMDrugObfuBody_14 7924 1.84 2.38 1.67 112 T_XMDrugObfuBody_08 7760 1.94 2.95 1.64 113 XM_B_SpammyTLD 7687 2.27 4.40 1.62 114 IN_HORDE_ADDRESS_BOOK 7641 1.25 0.09 1.61 115 KHOP_HELO_FCRDNS 7453 2.63 6.08 1.57 116 TR_Symld_Words 7436 1.58 1.61 1.57 117 XM_DK_Undo_01 7229 1.68 2.20 1.52 118 UNTRUSTED_Relay 7181 5.09 16.73 1.51 119 INVALID_MSGID 7144 1.23 0.32 1.51 120 TooManyTo_003 6937 1.27 0.64 1.46 121 XMSubNoVowel 6702 1.39 1.30 1.41 122 XM_CamelCaseFrm001 6669 1.56 2.08 1.41 123 XM_B_Unsub2 6622 1.63 2.39 1.40 124 TVD_RCVD_IP 6496 1.10 0.25 1.37 125 TO_MALFORMED 6378 1.03 0.02 1.34 126 XMCapTrack 6307 1.13 0.47 1.33 127 SUBJ_ALL_CAPS 6250 1.40 1.66 1.32 128 TR_XM_SpammyWords5 5815 1.84 3.84 1.23 129 XM_GoogleGroups 5608 1.05 0.61 1.18 130 URI_HEX 5485 1.41 2.22 1.16 131 XMDiploma_00 5464 1.36 2.04 1.15 132 BOTNET 5423 4.26 14.39 1.14 133 XM_H_Long_From02 5300 1.03 0.76 1.12 134 TR_XM_SpammyWords2 5076 3.19 10.07 1.07 135 TooManyTo_004 4947 0.93 0.55 1.04 136 TM2_M_VERY_LONG_WORD 4936 1.36 2.41 1.04 137 XMHTML_After_End 4902 1.12 1.39 1.03 138 XMGappySubj_01 4901 0.81 0.10 1.03 139 XM_UB50 4818 2.10 5.63 1.02 140 HTML_FONT_FACE_BAD 4614 0.91 0.71 0.97 141 XM_OfRef6 4598 2.61 7.93 0.97 142 RELAYCOUNTRY_CA 4552 2.06 5.63 0.96 143 RELAYCOUNTRY_GB 4176 1.03 1.51 0.88 144 TooManyTo_005 3972 0.75 0.47 0.84 145 XMBrknScrpt_02 3949 0.90 1.12 0.83 146 RCVD_IN_BL_SPAMCOP_NET 3897 2.69 8.75 0.82 147 URI_TRY_3LD 3877 0.93 1.29 0.82 148 SpammyFromTLD_01 3614 1.82 5.26 0.76 149 DKIM_ADSP_CUSTOM_MED 3611 1.81 5.22 0.76 150 T_FILL_THIS_FORM_SHORT 3599 1.88 5.54 0.76 151 XMBSHREFv2 3457 0.60 0.17 0.73 152 XM_B_COVIDMETA 3429 1.35 3.38 0.72 153 TVD_SPACE_RATIO 3356 0.57 0.13 0.71 154 XMNoVowels 3287 0.70 0.73 0.69 155 HTML_IMAGE_ONLY_20 3274 0.68 0.63 0.69 156 XMBody_95 3160 0.53 0.09 0.67 157 HTTPS_HTTP_MISMATCH 3016 0.79 1.31 0.64 158 RCVD_IN_SORBS_DUL 3009 0.53 0.19 0.63 159 T_TooManySym_03 2948 0.51 0.16 0.62 160 XMGenDplmaNmb 2931 0.76 1.22 0.62 161 XMStockSpam_06 2715 0.84 1.72 0.57 162 T_XMDrugObfuBody_00 2666 0.82 1.65 0.56 163 XM_ShortIntro_01 2658 0.63 0.85 0.56 164 XMBdyGiftCard01 2643 0.61 0.80 0.56 165 XM_SPF_Unknown 2466 0.55 0.67 0.52 166 T_OBFU_PDF_ATTACH 2426 0.43 0.14 0.51 167 XMMoneyMeta_00 2395 0.75 1.53 0.50 168 FROM_GOV_SPOOF 2389 0.43 0.17 0.50 169 MSGID_NOFQDN1 2387 0.39 0.03 0.50 170 NML_ADSP_CUSTOM_MED 2376 1.57 5.04 0.50 171 SHORT_HELO_AND_INLINE_IMAGE 2301 0.41 0.16 0.48 172 XMHTMLBadTable_001 2240 0.54 0.77 0.47 173 XM_ProductURIs 2226 0.48 0.51 0.47 174 XM_H_PHPMailer 2226 0.52 0.70 0.47 175 TR_MSPIKEBAYES00 2216 0.36 0.01 0.47 176 HTML_IMAGE_ONLY_32 2190 0.41 0.26 0.46 177 XMSubMetaI_00 2184 0.60 1.05 0.46 178 RELAYCOUNTRY_DE 2158 0.58 0.98 0.45 179 XMPhish30 2143 0.55 0.87 0.45 180 TM2_M_BODY_EMPTY 2090 0.36 0.09 0.44 181 XMLngstWrd_00 2090 0.61 1.18 0.44 182 T_XMHurry_00 2012 0.69 1.55 0.42 183 XMDateMe_00 1999 0.40 0.33 0.42 184 DIET_1 1995 0.59 1.13 0.42 185 XMPhish14 1969 0.53 0.90 0.42 186 TVD_SPACE_RATIO_MINFP 1964 0.39 0.33 0.41 187 FROM_GOV_DKIM_AU 1921 0.36 0.20 0.40 188 XM_B_REG_HTML 1805 0.38 0.39 0.38 189 FORGED_GMAIL_RCVD 1802 1.49 5.10 0.38 190 RDNS_DYNAMIC 1800 0.46 0.74 0.38 191 T_Symld_Words_02 1785 0.48 0.84 0.38 192 XMLngstWrd_01 1780 0.56 1.14 0.38 193 XM_S_SpammyWords 1773 1.45 4.94 0.37 194 TR_XM_Spammywords 1769 1.45 4.94 0.37 195 XM_B_COPY_HTML 1753 0.41 0.54 0.37 196 HTML_IMAGE_ONLY_24 1750 0.36 0.31 0.37 197 NICE_REPLY_A 1727 0.29 0.03 0.36 198 XM_DIRTYINTL 1696 1.09 3.46 0.36 199 XMOemUri 1646 0.31 0.18 0.35 200 XMSubMetaSxObfu_03 1636 0.42 0.68 0.34 ----------------------------------------------------------------------