Email: 506261 Autolearn: 0 AvgScore: 3.13 AvgScanTime: 1.60 sec Spam: 132915 Autolearn: 0 AvgScore: 14.90 AvgScanTime: 2.14 sec Ham: 373346 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 1.41 sec Time Spent Running SA: 225.19 hours Time Spent Processing Spam: 79.05 hours Time Spent Processing Ham: 146.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128058 90.26 96.35 88.10 2 DKIM_SIGNED 110041 75.71 82.79 73.19 3 DCC_CHECK 105812 50.41 79.61 40.02 4 XM_DK_Pass 103321 73.21 77.73 71.60 5 RELAYCOUNTRY_US 100230 79.39 75.41 80.80 6 DKIM_VALID 99864 71.02 75.13 69.56 7 XM_B_Unicode 98613 71.79 74.19 70.93 8 XMListUnsubscribeExists 86458 52.15 65.05 47.56 9 XM_B_SpammyWords 85265 50.52 64.15 45.67 10 DKIM_VALID_AU 73998 53.21 55.67 52.34 11 BAYES_50 56521 52.50 42.52 56.05 12 XM_DK_Undo_02 55926 16.41 42.08 7.27 13 XM_B_Unicode3 54480 41.67 40.99 41.91 14 XM_B_SpammyWords2 48038 23.30 36.14 18.72 15 LOC_TINY_FONT_1 47095 25.74 35.43 22.29 16 MIME_HTML_ONLY 43060 23.80 32.40 20.75 17 HTML_FONT_LOW_CONTRAST 42061 28.30 31.65 27.11 18 BAYES_99 42005 12.71 31.60 5.98 19 DKIM_VALID_EF 41577 28.03 31.28 26.87 20 TR_XM_DKIM_Undo 40845 11.98 30.73 5.30 21 T_KAM_HTML_FONT_INVALID 39018 21.07 29.36 18.12 22 FVGT_m_MULTI_ODD 38637 24.57 29.07 22.97 23 RCVD_IN_MSPIKE_H2 36804 25.27 27.69 24.41 24 XMSubLong 35268 23.27 26.53 22.11 25 TR_DCC_Bayes_99 32795 8.52 24.67 2.76 26 BAYES_999 31468 9.83 23.68 4.90 27 RELAYCOUNTRY_META 30064 9.46 22.62 4.77 28 T_TM2_M_HEADER_IN_MSG 28228 28.17 21.24 30.63 29 XM_Body_Dirty_Words 27753 13.81 20.88 11.30 30 DCC_CHECK_NEGATIVE 27028 49.54 20.33 59.93 31 RCVD_IN_MSPIKE_WL 25315 26.98 19.05 29.81 32 XM_UncommonTLD01 25027 7.64 18.83 3.66 33 BOTNET 23913 5.72 17.99 1.35 34 UNTRUSTED_Relay 22599 5.76 17.00 1.76 35 XM_B_Unsub 21705 11.97 16.33 10.42 36 FSL_BULK_SIG 21539 10.03 16.21 7.83 37 XM_Multi_Part_URI 20272 11.78 15.25 10.54 38 LOTS_OF_MONEY 19296 9.01 14.52 7.05 39 XM_B_SpammyWords3 17627 6.32 13.26 3.85 40 BOTNET_IPINHOSTNAME 17168 6.42 12.92 4.11 41 MPART_ALT_DIFF 15432 6.37 11.61 4.50 42 TR_XM_SpammyWords4 14922 6.20 11.23 4.42 43 RCVD_IN_BL_SPAMCOP_NET 14340 3.23 10.79 0.54 44 RCVD_IN_MSPIKE_H3 13944 14.10 10.49 15.39 45 TR_XM_SpammyWords2 13283 3.41 9.99 1.06 46 XMSexyCombo_05 13243 5.23 9.96 3.54 47 UNPARSEABLE_RELAY 13096 8.10 9.85 7.48 48 TR_XM_UnparsRelay 12707 6.85 9.56 5.88 49 SpammyFromTLD_02 12614 2.83 9.49 0.46 50 MIME_HTML_MOSTLY 11684 4.06 8.79 2.37 51 T_REMOTE_IMAGE 11284 4.95 8.49 3.69 52 XM_Evil_Numbers_Gen 11259 7.84 8.47 7.62 53 BAYES_80 11147 5.57 8.39 4.57 54 HTML_MIME_NO_HTML_TAG 10642 3.95 8.01 2.51 55 BAYES_60 10293 8.92 7.74 9.34 56 DKIM_INVALID 10177 4.69 7.66 3.64 57 RCVD_IN_MSPIKE_H4 10115 10.72 7.61 11.83 58 HTML_IMAGE_RATIO_02 9992 5.74 7.52 5.11 59 XM_B_Phish_Phrases 9970 4.73 7.50 3.74 60 XM_SendGrid 9922 6.84 7.46 6.61 61 KHOP_HELO_FCRDNS 9861 3.24 7.42 1.76 62 LotsOfNums_01 9435 8.80 7.10 9.41 63 T_HTML_TAG_BALANCE_CENTER 9227 1.89 6.94 0.10 64 TR_XM_PhishingBody 8965 4.72 6.74 4.00 65 HTML_IMAGE_ONLY_08 8876 1.85 6.68 0.13 66 SpammyFromTLD_01 8747 2.42 6.58 0.93 67 URI_NOVOWEL 8563 3.66 6.44 2.67 68 XMSubMetaSx_00 8289 4.23 6.24 3.52 69 XMNumbers 8255 4.18 6.21 3.45 70 XM_B_SpammyTLD 8170 3.22 6.15 2.18 71 RCVD_IN_MSPIKE_BL 8123 1.83 6.11 0.31 72 HTML_FONT_SIZE_LARGE 7959 1.65 5.99 0.11 73 TR_XM_MSPIKECOMBO 7751 1.75 5.83 0.30 74 BODY_URI_ONLY 7673 1.53 5.77 0.01 75 XM_H_Long_From01 7501 5.33 5.64 5.21 76 MIXED_CENTER_CASE 7131 1.41 5.37 0.00 77 MIXED_HREF_CASE 7123 1.41 5.36 0.00 78 MIXED_IMG_CASE 7121 1.41 5.36 0.00 79 MIXED_AREA_CASE 7118 1.41 5.36 0.00 80 XM_UB50 7079 2.27 5.33 1.18 81 JH_SPAMMY_HEADERS 7003 1.40 5.27 0.02 82 BAYES_95 6812 3.36 5.13 2.73 83 TooManyTo_001 6751 7.80 5.08 8.77 84 MIXED_FONT_CASE 6700 1.32 5.04 0.00 85 HTML_IMAGE_RATIO_04 6656 6.04 5.01 6.41 86 XM_UB99 6631 1.31 4.99 0.00 87 RELAYCOUNTRY_FR 6156 1.44 4.63 0.30 88 RCVD_IN_MSPIKE_L5 6091 1.25 4.58 0.06 89 BOTNET_NORDNS 6003 1.20 4.52 0.01 90 TR_XM_DK_SendGrid 5803 4.22 4.37 4.16 91 HTML_IMAGE_RATIO_06 5770 3.78 4.34 3.59 92 TR_XM_SpammyWords3 5686 1.29 4.28 0.23 93 PDS_OTHER_BAD_TLD 5562 1.34 4.18 0.32 94 XM_SPF_SoftFail 5504 2.48 4.14 1.89 95 XM_B_Phish66 5484 2.47 4.13 1.88 96 RELAYCOUNTRY_CA 5295 1.83 3.98 1.06 97 TR_XM_SpammyWords5 4951 2.17 3.72 1.61 98 MIME_QP_LONG_LINE 4909 5.18 3.69 5.71 99 URI_GOOG_STO_SPAMMY 4879 0.96 3.67 0.00 100 XM_UB999 4742 0.94 3.57 0.00 101 TR_XM_SPAMCOP 4551 1.10 3.42 0.27 102 XM_DIRTYINTL 4500 1.22 3.39 0.45 103 TM2_M_URI_OPT_OUT 4476 3.27 3.37 3.23 104 XMStrtUSub 4405 3.75 3.31 3.91 105 MIME_HTML_ONLY_MULTI 4391 3.08 3.30 3.00 106 RCVD_IN_RP_SAFE 4388 6.28 3.30 7.35 107 T_XMDrugObfuBody_14 4305 2.74 3.24 2.56 108 HTML_IMAGE_RATIO_08 4267 3.02 3.21 2.95 109 XM_B_COVIDMETA 4235 1.53 3.19 0.94 110 GOOG_STO_IMG_HTML 4164 0.82 3.13 0.00 111 URI_PHP_REDIR 4066 0.81 3.06 0.01 112 XM_OfRef6 3889 1.61 2.93 1.14 113 XMDiploma_00 3833 1.82 2.88 1.45 114 T_XMDrugObfuBody_08 3775 2.30 2.84 2.11 115 TM2_M_VERY_LONG_WORD 3655 1.77 2.75 1.42 116 URIBL_DBL_SPAM 3389 0.68 2.55 0.01 117 T_TooManySym_01 3381 4.65 2.54 5.40 118 DIET_1 3362 0.90 2.53 0.32 119 XM_UB60 3277 0.74 2.47 0.13 120 RCVD_IN_IADB_LISTED 3240 4.77 2.44 5.61 121 XM_CamelCaseFrm001 3174 2.26 2.39 2.22 122 US_DOLLARS_3 3164 1.32 2.38 0.94 123 RCVD_IN_RP_CERTIFIED 3138 5.63 2.36 6.79 124 XM_B_Unsub2 3090 1.63 2.32 1.38 125 TR_XM_COVIDMETA4 3042 0.87 2.29 0.36 126 TR_XM_SB_Phish 3005 2.40 2.26 2.45 127 XM_B_SpammyWords4 2994 0.86 2.25 0.36 128 RELAYCOUNTRY_DE 2904 1.22 2.18 0.88 129 XM_UB80 2815 0.58 2.12 0.04 130 XMSubPhish11 2792 2.32 2.10 2.39 131 RCVD_IN_IADB_SPF 2721 4.17 2.05 4.93 132 XM_DK_Undo_01 2653 1.76 2.00 1.67 133 T_XMDrugObfuBody_00 2652 1.04 2.00 0.70 134 XM_URI_RBL 2584 0.62 1.94 0.14 135 RCVD_IN_IADB_DK 2562 3.66 1.93 4.27 136 XMGenDplmaNmb 2559 1.14 1.93 0.86 137 RCVD_IN_IADB_SENDERID 2556 3.74 1.92 4.39 138 FROM_EXCESS_BASE64 2495 2.54 1.88 2.77 139 HTML_FONT_SIZE_HUGE 2478 0.56 1.86 0.10 140 URI_HEX 2458 1.60 1.85 1.51 141 BAYES_40 2456 4.36 1.85 5.25 142 TR_XM_PHPDW 2435 0.70 1.83 0.29 143 MAILING_LIST_MULTI 2419 2.64 1.82 2.93 144 SUBJ_ALL_CAPS 2378 1.63 1.79 1.57 145 TR_XM_COVIDMETA1 2356 0.73 1.77 0.36 146 ALL_TRUSTED 2348 12.21 1.77 15.93 147 URIBL_BLACK 2248 0.46 1.69 0.03 148 XM_JunkDunk 2210 0.44 1.66 0.00 149 XMMoneyMeta_00 2208 1.03 1.66 0.80 150 XMSlimDrugH 2195 0.60 1.65 0.22 151 XMBody_17 2187 0.80 1.65 0.49 152 XMBrknScrpt_02 2182 1.12 1.64 0.93 153 T_XMHurry_00 2174 1.00 1.64 0.78 154 TR_XM_PHPForged 2168 0.61 1.63 0.25 155 TR_XM_FormFill2 2144 0.61 1.61 0.25 156 XM_UB95 2139 0.44 1.61 0.02 157 RELAYCOUNTRY_AU 2129 0.70 1.60 0.38 158 XM_H_PHPOS 2107 0.60 1.59 0.24 159 HTTPS_HTTP_MISMATCH 2062 1.13 1.55 0.98 160 RCVD_IN_PSBL 2040 0.47 1.53 0.09 161 URI_TRY_3LD 2017 1.16 1.52 1.04 162 XMSexyCombo_01 2015 0.68 1.52 0.39 163 XMStockSpam_06 1990 1.05 1.50 0.88 164 RELAYCOUNTRY_GB 1965 1.21 1.48 1.12 165 XM_H_Long_From02 1894 1.32 1.42 1.28 166 RELAYCOUNTRY_NL 1847 0.50 1.39 0.19 167 TR_XM_INV_DKIM 1796 0.44 1.35 0.11 168 T_FILL_THIS_FORM_SHORT 1774 1.05 1.33 0.94 169 XM_Body_Dirty_Words_01 1764 0.46 1.33 0.16 170 XMSubMetaI_00 1751 0.73 1.32 0.52 171 BAYES_20 1697 2.93 1.28 3.52 172 TR_XM_BayesRelay 1696 0.34 1.28 0.01 173 XM_B_SEO 1685 0.45 1.27 0.16 174 TR_LOTS_OF_MONEY3 1651 0.48 1.24 0.20 175 TR_Symld_Words 1637 1.67 1.23 1.83 176 XMHTML_After_End 1631 1.17 1.23 1.15 177 USER_IN_DEF_DKIM_WL 1559 8.98 1.17 11.76 178 XMNoVowels 1550 0.96 1.17 0.88 179 URIBL_SBL_A 1539 0.48 1.16 0.23 180 TR_XM_SEO4 1519 0.36 1.14 0.08 181 XMBdyGiftCard01 1518 0.81 1.14 0.69 182 XMWghtMeta_00 1497 0.31 1.13 0.02 183 URI_NO_WWW_BIZ_CGI 1483 0.30 1.12 0.01 184 RCVD_IN_IADB_VOUCHED 1464 2.82 1.10 3.43 185 XM_SPF_Unknown 1455 0.79 1.09 0.68 186 TR_BOTNET_NEGATE 1413 0.50 1.06 0.30 187 TR_Mismatch_TLD_02 1386 0.33 1.04 0.08 188 HTML_IMAGE_ONLY_20 1349 1.12 1.01 1.16 189 XMSubMetaSSx_00 1345 0.39 1.01 0.16 190 RELAYCOUNTRY_PL 1338 0.29 1.01 0.03 191 MPART_ALT_DIFF_COUNT 1333 0.58 1.00 0.43 192 SHOPIFY_IMG_NOT_RCVD_SFY 1305 0.42 0.98 0.22 193 XM_H_PHPMailer 1303 0.73 0.98 0.65 194 XMSubMetaSxObfu_03 1302 0.55 0.98 0.39 195 TR_Mismatch_TLD_01 1298 0.59 0.98 0.45 196 RCVD_IN_RP_RNBL 1290 0.30 0.97 0.06 197 XM_PDF 1273 3.83 0.96 4.86 198 RCVD_IN_MSPIKE_H5 1256 2.16 0.94 2.59 199 T_MONEY_PERCENT 1253 0.40 0.94 0.21 200 TR_LOTS_OF_MONEY2 1253 0.40 0.94 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 328910 90.26 96.35 88.10 2 RELAYCOUNTRY_US 301680 79.39 75.41 80.80 3 DKIM_SIGNED 273266 75.71 82.79 73.19 4 XM_DK_Pass 267332 73.21 77.73 71.60 5 XM_B_Unicode 264820 71.79 74.19 70.93 6 DKIM_VALID 259686 71.02 75.13 69.56 7 DCC_CHECK_NEGATIVE 223753 49.54 20.33 59.93 8 BAYES_50 209278 52.50 42.52 56.05 9 DKIM_VALID_AU 195405 53.21 55.67 52.34 10 XMListUnsubscribeExists 177575 52.15 65.05 47.56 11 XM_B_SpammyWords 170504 50.52 64.15 45.67 12 XM_B_Unicode3 156456 41.67 40.99 41.91 13 DCC_CHECK 149405 50.41 79.61 40.02 14 T_TM2_M_HEADER_IN_MSG 114369 28.17 21.24 30.63 15 RCVD_IN_MSPIKE_WL 111281 26.98 19.05 29.81 16 HTML_FONT_LOW_CONTRAST 101196 28.30 31.65 27.11 17 DKIM_VALID_EF 100313 28.03 31.28 26.87 18 RCVD_IN_MSPIKE_H2 91137 25.27 27.69 24.41 19 FVGT_m_MULTI_ODD 85739 24.57 29.07 22.97 20 LOC_TINY_FONT_1 83229 25.74 35.43 22.29 21 XMSubLong 82547 23.27 26.53 22.11 22 MIME_HTML_ONLY 77451 23.80 32.40 20.75 23 XM_B_SpammyWords2 69905 23.30 36.14 18.72 24 T_KAM_HTML_FONT_INVALID 67641 21.07 29.36 18.12 25 ALL_TRUSTED 59483 12.21 1.77 15.93 26 RCVD_IN_MSPIKE_H3 57446 14.10 10.49 15.39 27 RCVD_IN_MSPIKE_H4 44173 10.72 7.61 11.83 28 USER_IN_DEF_DKIM_WL 43915 8.98 1.17 11.76 29 XM_Body_Dirty_Words 42179 13.81 20.88 11.30 30 XM_Multi_Part_URI 39348 11.78 15.25 10.54 31 XM_B_Unsub 38898 11.97 16.33 10.42 32 BAYES_00 38515 7.81 0.78 10.32 33 LotsOfNums_01 35124 8.80 7.10 9.41 34 BAYES_60 34886 8.92 7.74 9.34 35 TooManyTo_001 32738 7.80 5.08 8.77 36 FSL_BULK_SIG 29230 10.03 16.21 7.83 37 XM_Evil_Numbers_Gen 28436 7.84 8.47 7.62 38 UNPARSEABLE_RELAY 27931 8.10 9.85 7.48 39 XM_DKIMWhitelistDomains 27694 5.47 0.01 7.42 40 RCVD_IN_RP_SAFE 27429 6.28 3.30 7.35 41 XM_DK_Undo_02 27147 16.41 42.08 7.27 42 LOTS_OF_MONEY 26329 9.01 14.52 7.05 43 RCVD_IN_RP_CERTIFIED 25348 5.63 2.36 6.79 44 XM_SendGrid 24686 6.84 7.46 6.61 45 TR_XM_DK_Bayes 24643 5.01 0.55 6.60 46 HTML_IMAGE_RATIO_04 23916 6.04 5.01 6.41 47 TR_XM_DK_Bayes1 23811 4.84 0.52 6.38 48 BAYES_99 22322 12.71 31.60 5.98 49 TR_XM_UnparsRelay 21950 6.85 9.56 5.88 50 MIME_QP_LONG_LINE 21302 5.18 3.69 5.71 51 RCVD_IN_IADB_LISTED 20927 4.77 2.44 5.61 52 TR_XM_DK_Bayes2 20420 4.14 0.42 5.47 53 T_TooManySym_01 20178 4.65 2.54 5.40 54 IN_ZIMBRA_NJ_WHITELIST 19796 3.93 0.07 5.30 55 TR_XM_DKIM_Undo 19785 11.98 30.73 5.30 56 BAYES_40 19617 4.36 1.85 5.25 57 XM_H_Long_From01 19463 5.33 5.64 5.21 58 HTML_IMAGE_RATIO_02 19066 5.74 7.52 5.11 59 RCVD_IN_IADB_SPF 18410 4.17 2.05 4.93 60 BAYES_999 18298 9.83 23.68 4.90 61 XM_PDF 18130 3.83 0.96 4.86 62 RELAYCOUNTRY_META 17808 9.46 22.62 4.77 63 BAYES_80 17077 5.57 8.39 4.57 64 MPART_ALT_DIFF 16795 6.37 11.61 4.50 65 TR_XM_SpammyWords4 16484 6.20 11.23 4.42 66 XM_H_Trusted_IP 16466 3.25 0.00 4.41 67 RCVD_IN_IADB_SENDERID 16396 3.74 1.92 4.39 68 RCVD_IN_IADB_DK 15956 3.66 1.93 4.27 69 TR_XM_DK_SendGrid 15540 4.22 4.37 4.16 70 BOTNET_IPINHOSTNAME 15329 6.42 12.92 4.11 71 TR_XM_PhishingBody 14918 4.72 6.74 4.00 72 XMStrtUSub 14587 3.75 3.31 3.91 73 XM_B_SpammyWords3 14362 6.32 13.26 3.85 74 XM_B_Phish_Phrases 13981 4.73 7.50 3.74 75 T_REMOTE_IMAGE 13763 4.95 8.49 3.69 76 XM_UncommonTLD01 13673 7.64 18.83 3.66 77 DKIM_INVALID 13580 4.69 7.66 3.64 78 HTML_IMAGE_RATIO_06 13386 3.78 4.34 3.59 79 XMSexyCombo_05 13217 5.23 9.96 3.54 80 BAYES_20 13143 2.93 1.28 3.52 81 XMSubMetaSx_00 13127 4.23 6.24 3.52 82 XMNumbers 12888 4.18 6.21 3.45 83 RCVD_IN_IADB_VOUCHED 12799 2.82 1.10 3.43 84 TM2_M_URI_OPT_OUT 12072 3.27 3.37 3.23 85 MIME_HTML_ONLY_MULTI 11196 3.08 3.30 3.00 86 HTML_IMAGE_RATIO_08 11025 3.02 3.21 2.95 87 MAILING_LIST_MULTI 10934 2.64 1.82 2.93 88 FROM_EXCESS_BASE64 10346 2.54 1.88 2.77 89 TR_DCC_Bayes_99 10321 8.52 24.67 2.76 90 ANY_BOUNCE_MESSAGE 10289 2.18 0.58 2.76 91 BOUNCE_MESSAGE 10284 2.18 0.58 2.75 92 BAYES_95 10195 3.36 5.13 2.73 93 URI_NOVOWEL 9979 3.66 6.44 2.67 94 T_TooManySym_02 9711 2.12 0.78 2.60 95 RCVD_IN_MSPIKE_H5 9662 2.16 0.94 2.59 96 T_XMDrugObfuBody_14 9569 2.74 3.24 2.56 97 HTML_MIME_NO_HTML_TAG 9355 3.95 8.01 2.51 98 TR_XM_SB_Phish 9154 2.40 2.26 2.45 99 XMSubPhish11 8936 2.32 2.10 2.39 100 MIME_HTML_MOSTLY 8850 4.06 8.79 2.37 101 TooManyTo_002 8705 1.93 0.80 2.33 102 BAYES_05 8310 1.83 0.71 2.23 103 XM_CamelCaseFrm001 8285 2.26 2.39 2.22 104 RCVD_IN_IADB_OPTIN 8168 1.78 0.63 2.19 105 XM_B_SpammyTLD 8156 3.22 6.15 2.18 106 T_XMDrugObfuBody_08 7863 2.30 2.84 2.11 107 HELO_NODOT 7402 1.62 0.62 1.98 108 HELO_NO_DOMAIN 7401 1.62 0.62 1.98 109 IN_HORDE_ADDRESS_BOOK 7381 1.48 0.10 1.98 110 INVALID_MSGID 7202 1.47 0.17 1.93 111 XM_SPF_SoftFail 7055 2.48 4.14 1.89 112 XM_B_Phish66 7027 2.47 4.13 1.88 113 TR_Symld_Words 6826 1.67 1.23 1.83 114 MSGID_NOFQDN1 6617 1.32 0.05 1.77 115 UNTRUSTED_Relay 6570 5.76 17.00 1.76 116 KHOP_HELO_FCRDNS 6557 3.24 7.42 1.76 117 TO_MALFORMED 6398 1.27 0.04 1.71 118 XM_DK_Undo_01 6236 1.76 2.00 1.67 119 TR_XM_SpammyWords5 6027 2.17 3.72 1.61 120 SUBJ_ALL_CAPS 5865 1.63 1.79 1.57 121 URI_HEX 5626 1.60 1.85 1.51 122 TooManyTo_003 5582 1.26 0.59 1.50 123 XMSubNoVowel 5554 1.32 0.85 1.49 124 XMDiploma_00 5403 1.82 2.88 1.45 125 TM2_M_VERY_LONG_WORD 5285 1.77 2.75 1.42 126 TVD_RCVD_IP 5281 1.09 0.19 1.41 127 XM_B_Unsub2 5144 1.63 2.32 1.38 128 XMCapTrack 5137 1.14 0.47 1.38 129 BOTNET 5052 5.72 17.99 1.35 130 XM_GoogleGroups 4772 1.12 0.69 1.28 131 XMPhish30 4769 1.18 0.91 1.28 132 XM_H_Long_From02 4769 1.32 1.42 1.28 133 XMGappySubj_01 4651 0.95 0.13 1.25 134 XM_UB50 4423 2.27 5.33 1.18 135 HTML_IMAGE_ONLY_20 4317 1.12 1.01 1.16 136 HTML_FONT_FACE_BAD 4314 0.99 0.53 1.16 137 XMHTML_After_End 4296 1.17 1.23 1.15 138 XM_OfRef6 4270 1.61 2.93 1.14 139 RELAYCOUNTRY_GB 4173 1.21 1.48 1.12 140 TR_XM_SpammyWords2 3967 3.41 9.99 1.06 141 RELAYCOUNTRY_CA 3947 1.83 3.98 1.06 142 TooManyTo_004 3880 0.89 0.48 1.04 143 URI_TRY_3LD 3871 1.16 1.52 1.04 144 HTTPS_HTTP_MISMATCH 3677 1.13 1.55 0.98 145 T_FILL_THIS_FORM_SHORT 3525 1.05 1.33 0.94 146 US_DOLLARS_3 3517 1.32 2.38 0.94 147 XM_B_COVIDMETA 3491 1.53 3.19 0.94 148 XMBrknScrpt_02 3490 1.12 1.64 0.93 149 SpammyFromTLD_01 3484 2.42 6.58 0.93 150 DKIM_ADSP_CUSTOM_MED 3477 0.92 0.89 0.93 151 TR_MetaPhish_Combo_01 3339 0.85 0.72 0.89 152 XMStockSpam_06 3301 1.05 1.50 0.88 153 XMBSHREFv2 3300 0.77 0.44 0.88 154 XMNoVowels 3298 0.96 1.17 0.88 155 RELAYCOUNTRY_DE 3282 1.22 2.18 0.88 156 XMGenDplmaNmb 3219 1.14 1.93 0.86 157 XM_ProductURIs 3165 0.85 0.84 0.85 158 TooManyTo_005 3127 0.73 0.44 0.84 159 T_TooManySym_03 3116 0.69 0.28 0.83 160 XMMoneyMeta_00 2996 1.03 1.66 0.80 161 T_XMHurry_00 2901 1.00 1.64 0.78 162 XMBody_95 2798 0.62 0.25 0.75 163 T_XMDrugObfuBody_00 2607 1.04 2.00 0.70 164 XMBdyGiftCard01 2581 0.81 1.14 0.69 165 XM_SPF_Unknown 2528 0.79 1.09 0.68 166 XM_H_PHPMailer 2410 0.73 0.98 0.65 167 RCVD_IN_SORBS_DUL 2360 0.54 0.26 0.63 168 NML_ADSP_CUSTOM_MED 2295 0.64 0.70 0.61 169 XM_ShortIntro_01 2279 0.60 0.57 0.61 170 HTML_TAG_BALANCE_BODY 2224 0.66 0.83 0.60 171 T_OBFU_PDF_ATTACH 2190 0.48 0.17 0.59 172 MSGID_FROM_MTA_HEADER 2150 0.49 0.26 0.58 173 SHORT_HELO_AND_INLINE_IMAGE 2123 0.44 0.09 0.57 174 TR_MSPIKEBAYES00 2109 0.42 0.01 0.56 175 MISSING_HEADERS 2107 0.56 0.54 0.56 176 T_Symld_Words_02 2083 0.63 0.83 0.56 177 XM_B_COPY_HTML 2082 0.56 0.57 0.56 178 XM_B_REG_HTML 2070 0.52 0.41 0.55 179 RCVD_IN_BL_SPAMCOP_NET 2022 3.23 10.79 0.54 180 XMHTMLBadTable_001 1974 0.52 0.51 0.53 181 XMSubMetaI_00 1960 0.73 1.32 0.52 182 XMBody_17 1842 0.80 1.65 0.49 183 FROM_GOV_SPOOF 1841 0.42 0.23 0.49 184 XMPhish14 1818 0.57 0.79 0.49 185 FORGED_GMAIL_RCVD 1808 0.56 0.76 0.48 186 PLING_QUERY 1774 0.46 0.44 0.48 187 FROM_GOV_DKIM_AU 1766 0.44 0.36 0.47 188 XMOemUri 1756 0.41 0.24 0.47 189 SpammyFromTLD_02 1725 2.83 9.49 0.46 190 HTML_IMAGE_ONLY_28 1698 0.45 0.42 0.45 191 XM_DIRTYINTL 1681 1.22 3.39 0.45 192 TR_Mismatch_TLD_01 1668 0.59 0.98 0.45 193 TVD_SPACE_RATIO 1649 0.35 0.09 0.44 194 XMLngstWrd_00 1636 0.41 0.32 0.44 195 RDNS_DYNAMIC 1621 0.46 0.53 0.43 196 MPART_ALT_DIFF_COUNT 1607 0.58 1.00 0.43 197 TVD_PH_BODY_META_ALL 1556 0.37 0.23 0.42 198 TM2_M_BODY_EMPTY 1548 0.33 0.08 0.41 199 USER_IN_WELCOMELIST 1540 0.30 0.00 0.41 200 USER_IN_WHITELIST 1540 0.30 0.00 0.41 ----------------------------------------------------------------------