Email: 569830 Autolearn: 0 AvgScore: 2.47 AvgScanTime: 1.46 sec Spam: 134514 Autolearn: 0 AvgScore: 14.15 AvgScanTime: 1.63 sec Ham: 435316 Autolearn: 0 AvgScore: -1.14 AvgScanTime: 1.41 sec Time Spent Running SA: 231.37 hours Time Spent Processing Spam: 60.97 hours Time Spent Processing Ham: 170.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125827 87.81 93.54 86.04 2 DKIM_SIGNED 112035 72.97 83.29 69.79 3 XM_DK_Pass 106301 70.98 79.03 68.50 4 DKIM_VALID 104062 69.07 77.36 66.51 5 DCC_CHECK 101485 46.80 75.45 37.94 6 XM_B_Unicode 101062 70.66 75.13 69.28 7 RELAYCOUNTRY_US 96779 76.02 71.95 77.28 8 XM_B_SpammyWords 88955 52.46 66.13 48.24 9 XMListUnsubscribeExists 88595 47.83 65.86 42.26 10 DKIM_VALID_AU 77442 51.58 57.57 49.73 11 XM_DK_Undo_02 58522 16.10 43.51 7.64 12 XM_B_Unicode3 56750 38.29 42.19 37.09 13 BAYES_50 55369 52.46 41.16 55.95 14 LOC_TINY_FONT_1 48603 24.64 36.13 21.09 15 XM_B_SpammyWords2 48403 25.66 35.98 22.47 16 DKIM_VALID_EF 44584 28.21 33.14 26.68 17 BAYES_99 43506 12.22 32.34 6.00 18 TR_XM_DKIM_Undo 43485 11.86 32.33 5.54 19 HTML_FONT_LOW_CONTRAST 40804 24.92 30.33 23.25 20 MIME_HTML_ONLY 40318 21.57 29.97 18.97 21 T_KAM_HTML_FONT_INVALID 38991 19.59 28.99 16.68 22 FVGT_m_MULTI_ODD 35173 22.51 26.15 21.39 23 RCVD_IN_MSPIKE_H2 34507 23.70 25.65 23.10 24 XMSubLong 33646 21.01 25.01 19.78 25 TR_DCC_Bayes_99 33590 8.22 24.97 3.04 26 BAYES_999 33344 9.55 24.79 4.85 27 RELAYCOUNTRY_META 32033 9.17 23.81 4.65 28 DCC_CHECK_NEGATIVE 29600 50.84 22.01 59.75 29 T_TM2_M_HEADER_IN_MSG 28835 31.27 21.44 34.30 30 XM_Body_Dirty_Words 27770 13.00 20.64 10.64 31 RCVD_IN_MSPIKE_WL 26679 27.25 19.83 29.54 32 UNTRUSTED_Relay 26099 6.06 19.40 1.94 33 BOTNET 24111 5.28 17.92 1.37 34 XM_UncommonTLD01 22113 6.44 16.44 3.35 35 FSL_BULK_SIG 20993 9.50 15.61 7.61 36 XM_Multi_Part_URI 20895 11.49 15.53 10.23 37 LOTS_OF_MONEY 19281 10.24 14.33 8.97 38 XM_B_Unsub 18481 10.59 13.74 9.61 39 BOTNET_IPINHOSTNAME 17674 6.01 13.14 3.80 40 XM_B_SpammyWords3 16547 6.12 12.30 4.21 41 XMSexyCombo_05 16300 5.73 12.12 3.76 42 MPART_ALT_DIFF 15312 6.35 11.38 4.80 43 TR_XM_SpammyWords4 14766 7.80 10.98 6.82 44 RCVD_IN_MSPIKE_H3 14514 13.90 10.79 14.86 45 TR_XM_SpammyWords2 14245 3.41 10.59 1.19 46 UNPARSEABLE_RELAY 13631 7.71 10.13 6.95 47 TR_XM_UnparsRelay 13195 6.75 9.81 5.80 48 XM_Evil_Numbers_Gen 12792 8.44 9.51 8.10 49 MIME_HTML_MOSTLY 12315 3.76 9.16 2.09 50 BAYES_80 11746 5.56 8.73 4.58 51 HTML_IMAGE_RATIO_02 11078 5.54 8.24 4.71 52 BAYES_60 10997 8.37 8.18 8.43 53 RCVD_IN_MSPIKE_H4 10867 10.09 8.08 10.71 54 LotsOfNums_01 10246 8.55 7.62 8.84 55 SpammyFromTLD_01 10196 2.37 7.58 0.76 56 XM_SendGrid 10150 6.42 7.55 6.07 57 XMSubMetaSx_00 9643 4.45 7.17 3.61 58 XM_B_Phish_Phrases 9497 6.54 7.06 6.38 59 XM_UB50 8945 2.60 6.65 1.35 60 XM_H_Long_From01 8596 5.55 6.39 5.29 61 XM_SPF_SoftFail 8452 2.99 6.28 1.97 62 TR_XM_PhishingBody 8202 3.83 6.10 3.13 63 RCVD_IN_BL_SPAMCOP_NET 8126 2.01 6.04 0.77 64 DKIM_INVALID 7973 3.90 5.93 3.28 65 SpammyFromTLD_02 7924 1.65 5.89 0.34 66 T_REMOTE_IMAGE 7922 3.94 5.89 3.34 67 HTML_MIME_NO_HTML_TAG 7014 2.95 5.21 2.25 68 TooManyTo_001 6888 7.58 5.12 8.34 69 RELAYCOUNTRY_CA 6862 1.97 5.10 1.00 70 KHOP_HELO_FCRDNS 6778 2.51 5.04 1.73 71 XMNumbers 6643 3.47 4.94 3.02 72 BAYES_95 6631 3.19 4.93 2.65 73 XM_UB99 6496 1.14 4.83 0.00 74 RELAYCOUNTRY_FR 6247 1.33 4.64 0.30 75 XM_B_SpammyTLD 5893 2.43 4.38 1.82 76 HTML_IMAGE_RATIO_04 5826 5.18 4.33 5.44 77 TR_XM_DK_SendGrid 5701 3.87 4.24 3.76 78 RCVD_IN_MSPIKE_BL 5628 1.17 4.18 0.23 79 XMStrtUSub 5605 5.91 4.17 6.45 80 TR_XM_SpammyWords5 5386 1.82 4.00 1.15 81 XM_DIRTYINTL 5169 1.16 3.84 0.34 82 TR_XM_MSPIKECOMBO 5141 1.06 3.82 0.20 83 BODY_URI_ONLY 4972 0.89 3.70 0.02 84 T_XMDrugObfuBody_08 4937 2.27 3.67 1.84 85 XM_UB999 4679 0.82 3.48 0.00 86 XM_B_Phish66 4658 2.42 3.46 2.09 87 MIME_QP_LONG_LINE 4644 5.01 3.45 5.49 88 TM2_M_URI_OPT_OUT 4615 2.86 3.43 2.68 89 RCVD_IN_RP_RNBL 4574 0.90 3.40 0.12 90 RCVD_IN_RP_SAFE 4513 5.46 3.36 6.11 91 DKIM_ADSP_CUSTOM_MED 4426 1.50 3.29 0.94 92 T_HTML_TAG_BALANCE_CENTER 4383 0.90 3.26 0.17 93 XM_OfRef6 4199 1.49 3.12 0.99 94 FORGED_GMAIL_RCVD 4191 1.10 3.12 0.48 95 NML_ADSP_CUSTOM_MED 4182 1.23 3.11 0.65 96 BOTNET_NORDNS 4146 0.74 3.08 0.01 97 HTML_IMAGE_RATIO_06 4121 3.82 3.06 4.06 98 URIBL_DBL_SPAM 4112 0.72 3.06 0.00 99 RCVD_IN_PSBL 4070 0.79 3.03 0.10 100 HTML_IMAGE_ONLY_08 4064 0.78 3.02 0.09 101 HTML_IMAGE_RATIO_08 4055 2.77 3.01 2.70 102 XM_B_Unsub2 3974 1.88 2.95 1.55 103 MIME_HTML_ONLY_MULTI 3963 2.98 2.95 2.99 104 MIXED_FONT_CASE 3953 0.69 2.94 0.00 105 XM_UB60 3949 0.83 2.94 0.18 106 ALL_TRUSTED 3757 15.52 2.79 19.45 107 GOOG_STO_IMG_HTML 3752 0.66 2.79 0.00 108 MONEY_NOHTML 3751 0.74 2.79 0.11 109 XM_B_COVIDMETA 3649 1.44 2.71 1.05 110 RCVD_IN_RP_CERTIFIED 3585 4.81 2.67 5.47 111 XM_UB80 3569 0.66 2.65 0.05 112 PDS_OTHER_BAD_TLD 3547 0.82 2.64 0.26 113 HTML_FONT_SIZE_LARGE 3531 0.70 2.63 0.10 114 T_TooManySym_01 3472 4.87 2.58 5.57 115 TR_XM_SB_Phish 3427 2.21 2.55 2.11 116 XMSubPhish11 3291 2.17 2.45 2.08 117 TM2_M_VERY_LONG_WORD 3286 1.45 2.44 1.14 118 T_XMDrugObfuBody_14 3254 1.88 2.42 1.71 119 XM_H_Undi_Recip 3154 0.70 2.34 0.19 120 XMDiploma_00 3127 1.48 2.32 1.22 121 XM_B_SpammyWords4 3095 0.84 2.30 0.39 122 RCVD_IN_MSPIKE_L5 3079 0.56 2.29 0.03 123 MIXED_HREF_CASE 3077 0.54 2.29 0.00 124 MIXED_IMG_CASE 3075 0.54 2.29 0.00 125 RCVD_IN_IADB_LISTED 3037 4.54 2.26 5.24 126 SUBJ_ALL_CAPS 3027 1.49 2.25 1.25 127 RELAYCOUNTRY_IN 3004 0.61 2.23 0.11 128 TR_XM_SpammyWords3 2990 0.65 2.22 0.16 129 XM_CamelCaseFrm001 2903 1.83 2.16 1.72 130 XMSexyCombo_01 2884 0.78 2.14 0.36 131 FROM_EXCESS_BASE64 2859 2.17 2.13 2.18 132 TR_XM_COVIDMETA4 2845 0.77 2.12 0.35 133 XM_URI_RBL 2799 0.59 2.08 0.13 134 URI_HEX 2760 1.42 2.05 1.23 135 TR_XM_PHPDW 2700 0.78 2.01 0.41 136 XM_DK_Undo_01 2693 1.75 2.00 1.68 137 XMBody_17 2679 0.76 1.99 0.38 138 LOADSA_MONEY_COMBO 2679 0.50 1.99 0.04 139 RCVD_IN_IADB_SPF 2638 3.94 1.96 4.55 140 TR_XM_PHPForged 2631 0.74 1.96 0.37 141 T_FILL_THIS_FORM_SHORT 2630 1.19 1.96 0.95 142 MAILING_LIST_MULTI 2592 2.66 1.93 2.89 143 TR_XM_FormFill2 2574 0.73 1.91 0.37 144 XM_H_PHPOS 2565 0.72 1.91 0.35 145 FILL_THIS_FORM 2529 0.66 1.88 0.28 146 URI_PHP_REDIR 2522 0.44 1.87 0.00 147 RCVD_IN_IADB_DK 2496 3.43 1.86 3.92 148 URIBL_BLACK 2486 0.46 1.85 0.03 149 RCVD_IN_IADB_SENDERID 2486 3.54 1.85 4.06 150 BAYES_40 2436 4.78 1.81 5.70 151 FILL_THIS_FORM_LONG 2425 0.49 1.80 0.09 152 XFER_LOTSA_MONEY 2412 0.44 1.79 0.03 153 RELAYCOUNTRY_DE 2397 0.84 1.78 0.55 154 URIBL_SBL_A 2393 0.54 1.78 0.16 155 TR_XM_Undi_Recip2 2381 0.43 1.77 0.01 156 MILLION_USD 2374 0.42 1.76 0.01 157 TR_XM_Undi_Recip5 2373 0.43 1.76 0.01 158 MONEY_FORM 2369 0.42 1.76 0.01 159 TR_XM_COVIDMETA1 2341 0.67 1.74 0.34 160 TR_XM_Undi_RecipCombo2 2298 0.40 1.71 0.00 161 T_XMHurry_00 2293 4.55 1.70 5.43 162 XM_UB95 2283 0.42 1.70 0.02 163 TR_Symld_Words 2241 1.67 1.67 1.67 164 TR_XM_Undi_Recip9 2210 0.39 1.64 0.00 165 ADVANCE_FEE_3_NEW_FRM_MNY 2198 0.39 1.63 0.00 166 XMStockSpam_06 2048 1.49 1.52 1.48 167 UNDISC_MONEY 1997 0.36 1.48 0.01 168 XMMoneyMeta_00 1974 0.78 1.47 0.57 169 TR_XM_BayesRelay 1971 0.35 1.47 0.01 170 T_XMDrugObfuBody_00 1939 0.85 1.44 0.67 171 USER_IN_DEF_DKIM_WL 1935 8.50 1.44 10.69 172 XMGenDplmaNmb 1912 0.92 1.42 0.76 173 URI_NO_WWW_BIZ_CGI 1905 0.34 1.42 0.01 174 XMBrknScrpt_02 1882 0.99 1.40 0.86 175 TR_Mismatch_TLD_02 1880 0.40 1.40 0.09 176 T_FILL_THIS_FORM_FRAUD_PHISH 1855 0.36 1.38 0.05 177 TO_NO_BRKTS_PCNT 1820 0.33 1.35 0.01 178 URI_TRY_3LD 1748 1.12 1.30 1.06 179 BAYES_20 1701 3.32 1.26 3.96 180 TR_XM_INV_DKIM 1699 0.34 1.26 0.05 181 RELAYCOUNTRY_GB 1697 1.01 1.26 0.93 182 XM_H_PHPMailer 1674 0.80 1.24 0.66 183 URI_NOVOWEL 1638 2.02 1.22 2.27 184 XM_Body_Dirty_Words_01 1591 0.43 1.18 0.20 185 HELO_NODOT 1585 1.75 1.18 1.93 186 FROM_SUSPICIOUS_NTLD 1582 0.31 1.18 0.04 187 XMHTML_After_End 1575 1.06 1.17 1.02 188 XM_PDF 1559 4.12 1.16 5.03 189 TR_MetaPhish_Combo_01 1555 0.88 1.16 0.79 190 XM_B_SEO 1552 0.39 1.15 0.16 191 HELO_NO_DOMAIN 1542 1.75 1.15 1.93 192 RDNS_DYNAMIC 1533 0.57 1.14 0.40 193 HTML_FONT_SIZE_HUGE 1529 0.36 1.14 0.12 194 URI_NO_WWW_INFO_CGI 1524 0.27 1.13 0.01 195 XM_JunkDunk 1524 0.27 1.13 0.00 196 XMSubMetaI_00 1497 0.91 1.11 0.85 197 FROM_SUSPICIOUS_NTLD_FP 1476 0.28 1.10 0.03 198 LongTLD 1449 0.37 1.08 0.15 199 XMSubNoVowel 1436 1.33 1.07 1.41 200 XMBdyGiftCard01 1414 0.72 1.05 0.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 374540 87.81 93.54 86.04 2 RELAYCOUNTRY_US 336401 76.02 71.95 77.28 3 DKIM_SIGNED 303794 72.97 83.29 69.79 4 XM_B_Unicode 301585 70.66 75.13 69.28 5 XM_DK_Pass 298176 70.98 79.03 68.50 6 DKIM_VALID 289524 69.07 77.36 66.51 7 DCC_CHECK_NEGATIVE 260080 50.84 22.01 59.75 8 BAYES_50 243578 52.46 41.16 55.95 9 DKIM_VALID_AU 216491 51.58 57.57 49.73 10 XM_B_SpammyWords 209992 52.46 66.13 48.24 11 XMListUnsubscribeExists 183951 47.83 65.86 42.26 12 DCC_CHECK 165170 46.80 75.45 37.94 13 XM_B_Unicode3 161438 38.29 42.19 37.09 14 T_TM2_M_HEADER_IN_MSG 149329 31.27 21.44 34.30 15 RCVD_IN_MSPIKE_WL 128576 27.25 19.83 29.54 16 DKIM_VALID_EF 116140 28.21 33.14 26.68 17 HTML_FONT_LOW_CONTRAST 101199 24.92 30.33 23.25 18 RCVD_IN_MSPIKE_H2 100547 23.70 25.65 23.10 19 XM_B_SpammyWords2 97827 25.66 35.98 22.47 20 FVGT_m_MULTI_ODD 93100 22.51 26.15 21.39 21 LOC_TINY_FONT_1 91826 24.64 36.13 21.09 22 XMSubLong 86087 21.01 25.01 19.78 23 ALL_TRUSTED 84680 15.52 2.79 19.45 24 MIME_HTML_ONLY 82588 21.57 29.97 18.97 25 T_KAM_HTML_FONT_INVALID 72631 19.59 28.99 16.68 26 RCVD_IN_MSPIKE_H3 64686 13.90 10.79 14.86 27 RCVD_IN_MSPIKE_H4 46601 10.09 8.08 10.71 28 USER_IN_DEF_DKIM_WL 46515 8.50 1.44 10.69 29 XM_Body_Dirty_Words 46311 13.00 20.64 10.64 30 XM_Multi_Part_URI 44553 11.49 15.53 10.23 31 BAYES_00 43662 7.83 0.69 10.03 32 XM_DKIMWhitelistDomains 43109 7.59 0.11 9.90 33 XM_B_Unsub 41855 10.59 13.74 9.61 34 LOTS_OF_MONEY 39045 10.24 14.33 8.97 35 LotsOfNums_01 38481 8.55 7.62 8.84 36 BAYES_60 36695 8.37 8.18 8.43 37 TooManyTo_001 36304 7.58 5.12 8.34 38 XM_Evil_Numbers_Gen 35282 8.44 9.51 8.10 39 XM_DK_Undo_02 33242 16.10 43.51 7.64 40 FSL_BULK_SIG 33133 9.50 15.61 7.61 41 UNPARSEABLE_RELAY 30275 7.71 10.13 6.95 42 TR_XM_SpammyWords4 29703 7.80 10.98 6.82 43 XMStrtUSub 28068 5.91 4.17 6.45 44 XM_B_Phish_Phrases 27779 6.54 7.06 6.38 45 TR_XM_DK_Bayes 26819 4.81 0.43 6.16 46 RCVD_IN_RP_SAFE 26600 5.46 3.36 6.11 47 XM_SendGrid 26421 6.42 7.55 6.07 48 BAYES_99 26103 12.22 32.34 6.00 49 TR_XM_DK_Bayes1 25873 4.64 0.41 5.94 50 TR_XM_UnparsRelay 25267 6.75 9.81 5.80 51 BAYES_40 24802 4.78 1.81 5.70 52 T_TooManySym_01 24255 4.87 2.58 5.57 53 TR_XM_DKIM_Undo 24103 11.86 32.33 5.54 54 MIME_QP_LONG_LINE 23905 5.01 3.45 5.49 55 RCVD_IN_RP_CERTIFIED 23821 4.81 2.67 5.47 56 HTML_IMAGE_RATIO_04 23702 5.18 4.33 5.44 57 T_XMHurry_00 23651 4.55 1.70 5.43 58 XM_H_Long_From01 23049 5.55 6.39 5.29 59 RCVD_IN_IADB_LISTED 22831 4.54 2.26 5.24 60 TR_XM_DK_Bayes2 22276 3.99 0.35 5.12 61 XM_PDF 21899 4.12 1.16 5.03 62 BAYES_999 21093 9.55 24.79 4.85 63 IN_ZIMBRA_NJ_WHITELIST 21008 3.70 0.05 4.83 64 MPART_ALT_DIFF 20886 6.35 11.38 4.80 65 HTML_IMAGE_RATIO_02 20508 5.54 8.24 4.71 66 RELAYCOUNTRY_META 20235 9.17 23.81 4.65 67 BAYES_80 19919 5.56 8.73 4.58 68 RCVD_IN_IADB_SPF 19789 3.94 1.96 4.55 69 XM_B_SpammyWords3 18317 6.12 12.30 4.21 70 RCVD_IN_IADB_SENDERID 17677 3.54 1.85 4.06 71 HTML_IMAGE_RATIO_06 17670 3.82 3.06 4.06 72 RCVD_IN_MSPIKE_H5 17289 3.26 0.96 3.97 73 BAYES_20 17227 3.32 1.26 3.96 74 RCVD_IN_IADB_DK 17052 3.43 1.86 3.92 75 BOTNET_IPINHOSTNAME 16558 6.01 13.14 3.80 76 XMSexyCombo_05 16369 5.73 12.12 3.76 77 TR_XM_DK_SendGrid 16355 3.87 4.24 3.76 78 XMSubMetaSx_00 15709 4.45 7.17 3.61 79 XM_H_Trusted_IP 15679 2.75 0.00 3.60 80 RCVD_IN_IADB_VOUCHED 14619 2.79 0.95 3.36 81 XM_UncommonTLD01 14562 6.44 16.44 3.35 82 T_REMOTE_IMAGE 14524 3.94 5.89 3.34 83 DKIM_INVALID 14270 3.90 5.93 3.28 84 TR_XM_PhishingBody 13631 3.83 6.10 3.13 85 TR_DCC_Bayes_99 13236 8.22 24.97 3.04 86 XMNumbers 13128 3.47 4.94 3.02 87 MIME_HTML_ONLY_MULTI 13014 2.98 2.95 2.99 88 MAILING_LIST_MULTI 12593 2.66 1.93 2.89 89 HTML_IMAGE_RATIO_08 11740 2.77 3.01 2.70 90 TM2_M_URI_OPT_OUT 11673 2.86 3.43 2.68 91 ANY_BOUNCE_MESSAGE 11575 2.21 0.76 2.66 92 BOUNCE_MESSAGE 11568 2.21 0.75 2.66 93 BAYES_95 11534 3.19 4.93 2.65 94 T_TooManySym_02 10255 1.95 0.63 2.36 95 TooManyTo_002 10038 1.97 0.86 2.31 96 URI_NOVOWEL 9895 2.02 1.22 2.27 97 HTML_MIME_NO_HTML_TAG 9795 2.95 5.21 2.25 98 FROM_EXCESS_BASE64 9494 2.17 2.13 2.18 99 BAYES_05 9459 1.81 0.65 2.17 100 RCVD_IN_IADB_OPTIN 9402 1.81 0.66 2.16 101 TR_XM_SB_Phish 9192 2.21 2.55 2.11 102 XM_B_Phish66 9105 2.42 3.46 2.09 103 MIME_HTML_MOSTLY 9102 3.76 9.16 2.09 104 XMSubPhish11 9051 2.17 2.45 2.08 105 XM_SPF_SoftFail 8576 2.99 6.28 1.97 106 UNTRUSTED_Relay 8431 6.06 19.40 1.94 107 HELO_NODOT 8408 1.75 1.18 1.93 108 HELO_NO_DOMAIN 8403 1.75 1.15 1.93 109 T_XMDrugObfuBody_08 8025 2.27 3.67 1.84 110 XM_B_SpammyTLD 7929 2.43 4.38 1.82 111 IN_HORDE_ADDRESS_BOOK 7536 1.34 0.09 1.73 112 KHOP_HELO_FCRDNS 7527 2.51 5.04 1.73 113 XM_CamelCaseFrm001 7500 1.83 2.16 1.72 114 T_XMDrugObfuBody_14 7445 1.88 2.42 1.71 115 XM_DK_Undo_01 7299 1.75 2.00 1.68 116 TR_Symld_Words 7251 1.67 1.67 1.67 117 INVALID_MSGID 7175 1.36 0.43 1.65 118 XM_B_Unsub2 6743 1.88 2.95 1.55 119 XMStockSpam_06 6440 1.49 1.52 1.48 120 TooManyTo_003 6440 1.30 0.71 1.48 121 TO_MALFORMED 6300 1.11 0.01 1.45 122 XMCapTrack 6212 1.21 0.50 1.43 123 XMSubNoVowel 6130 1.33 1.07 1.41 124 TVD_RCVD_IP 6127 1.16 0.34 1.41 125 BOTNET 5955 5.28 17.92 1.37 126 XM_UB50 5857 2.60 6.65 1.35 127 SUBJ_ALL_CAPS 5459 1.49 2.25 1.25 128 URI_HEX 5359 1.42 2.05 1.23 129 XMDiploma_00 5300 1.48 2.32 1.22 130 XMNoVowels 5170 1.14 0.97 1.19 131 TR_XM_SpammyWords2 5164 3.41 10.59 1.19 132 XM_GoogleGroups 5148 1.06 0.65 1.18 133 XMGappySubj_01 5102 0.97 0.30 1.17 134 XM_H_Long_From02 5036 1.12 1.00 1.16 135 TR_XM_SpammyWords5 4993 1.82 4.00 1.15 136 TM2_M_VERY_LONG_WORD 4966 1.45 2.44 1.14 137 URI_TRY_3LD 4636 1.12 1.30 1.06 138 XM_B_COVIDMETA 4552 1.44 2.71 1.05 139 TooManyTo_004 4547 0.93 0.57 1.04 140 XMHTML_After_End 4448 1.06 1.17 1.02 141 RELAYCOUNTRY_CA 4358 1.97 5.10 1.00 142 XM_OfRef6 4319 1.49 3.12 0.99 143 T_FILL_THIS_FORM_SHORT 4148 1.19 1.96 0.95 144 DKIM_ADSP_CUSTOM_MED 4111 1.50 3.29 0.94 145 RELAYCOUNTRY_GB 4054 1.01 1.26 0.93 146 HTML_FONT_FACE_BAD 3990 0.87 0.74 0.92 147 XMBrknScrpt_02 3741 0.99 1.40 0.86 148 TooManyTo_005 3695 0.76 0.48 0.85 149 XMSubMetaI_00 3681 0.91 1.11 0.85 150 T_OBFU_PDF_ATTACH 3498 0.65 0.17 0.80 151 HTML_IMAGE_ONLY_20 3478 0.70 0.37 0.80 152 TR_MetaPhish_Combo_01 3460 0.88 1.16 0.79 153 XMBSHREFv2 3349 0.65 0.28 0.77 154 XM_SPF_Unknown 3343 0.79 0.85 0.77 155 RCVD_IN_BL_SPAMCOP_NET 3340 2.01 6.04 0.77 156 HTTPS_HTTP_MISMATCH 3335 0.82 1.01 0.77 157 SpammyFromTLD_01 3310 2.37 7.58 0.76 158 XMGenDplmaNmb 3302 0.92 1.42 0.76 159 T_TooManySym_03 3172 0.60 0.20 0.73 160 XMBody_95 3166 0.62 0.29 0.73 161 XM_RXBody 3075 0.67 0.55 0.71 162 T_XMDrugObfuBody_00 2931 0.85 1.44 0.67 163 TR_MSPIKEBAYES00 2890 0.51 0.01 0.66 164 XM_H_PHPMailer 2888 0.80 1.24 0.66 165 NML_ADSP_CUSTOM_MED 2816 1.23 3.11 0.65 166 XM_ShortIntro_01 2766 0.65 0.68 0.64 167 RCVD_IN_SORBS_DUL 2710 0.54 0.28 0.62 168 XMBdyGiftCard01 2692 0.72 1.05 0.62 169 XMMoneyMeta_00 2494 0.78 1.47 0.57 170 MSGID_NOFQDN1 2399 0.43 0.04 0.55 171 SHORT_HELO_AND_INLINE_IMAGE 2396 0.46 0.16 0.55 172 RELAYCOUNTRY_DE 2395 0.84 1.78 0.55 173 FROM_GOV_SPOOF 2301 0.45 0.19 0.53 174 XMHTMLBadTable_001 2285 0.57 0.72 0.52 175 XMLngstWrd_00 2279 0.55 0.62 0.52 176 XM_ProductURIs 2099 0.52 0.65 0.48 177 FORGED_GMAIL_RCVD 2099 1.10 3.12 0.48 178 FROM_GOV_DKIM_AU 2042 0.38 0.08 0.47 179 XMLngstWrd_01 2038 0.49 0.55 0.47 180 TM2_M_BODY_EMPTY 2028 0.38 0.09 0.47 181 HTML_IMAGE_ONLY_32 2009 0.41 0.24 0.46 182 XM_B_COPY_HTML 1993 0.49 0.58 0.46 183 XMPhish30 1906 0.55 0.92 0.44 184 HTML_IMAGE_ONLY_28 1885 0.43 0.43 0.43 185 HTML_IMAGE_ONLY_24 1847 0.39 0.30 0.42 186 TVD_SPACE_RATIO 1782 0.35 0.14 0.41 187 MISSING_HEADERS 1775 0.43 0.51 0.41 188 TR_XM_PHPDW 1767 0.78 2.01 0.41 189 XMDateMe_00 1763 0.41 0.44 0.40 190 RDNS_DYNAMIC 1743 0.57 1.14 0.40 191 XM_B_REG_HTML 1695 0.39 0.41 0.39 192 XM_B_SpammyWords4 1682 0.84 2.30 0.39 193 XMLngstWrd_02 1679 0.40 0.45 0.39 194 XMBody_17 1657 0.76 1.99 0.38 195 TR_BOTNET_NEGATE 1634 0.51 0.95 0.38 196 RELAYCOUNTRY_AU 1631 0.49 0.86 0.37 197 USER_IN_WHITELIST 1613 0.28 0.00 0.37 198 TR_XM_FormFill2 1613 0.73 1.91 0.37 199 USER_IN_WELCOMELIST 1613 0.28 0.00 0.37 200 HTML_TAG_BALANCE_BODY 1609 0.49 0.87 0.37 ----------------------------------------------------------------------