Email: 543943 Autolearn: 0 AvgScore: 2.33 AvgScanTime: 1.42 sec Spam: 139348 Autolearn: 0 AvgScore: 14.88 AvgScanTime: 1.91 sec Ham: 404595 Autolearn: 0 AvgScore: -1.99 AvgScanTime: 1.25 sec Time Spent Running SA: 214.62 hours Time Spent Processing Spam: 73.97 hours Time Spent Processing Ham: 140.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133237 87.25 95.61 84.37 2 DCC_CHECK 109617 45.75 78.66 34.42 3 RELAYCOUNTRY_US 105682 78.14 75.84 78.93 4 DKIM_SIGNED 100920 69.97 72.42 69.13 5 XM_B_Unicode 96143 65.89 68.99 64.82 6 XM_DK_Pass 93986 67.48 67.45 67.50 7 DKIM_VALID 90773 65.18 65.14 65.19 8 XM_B_SpammyWords 86927 46.66 62.38 41.25 9 XMListUnsubscribeExists 83456 44.63 59.89 39.38 10 DKIM_VALID_AU 64686 48.31 46.42 48.96 11 BAYES_50 60927 51.48 43.72 54.15 12 XM_B_Unicode3 52587 37.07 37.74 36.83 13 MIME_HTML_ONLY 49322 24.45 35.39 20.68 14 XM_B_SpammyWords2 47011 21.96 33.74 17.90 15 XM_DK_Undo_02 46168 13.08 33.13 6.18 16 LOC_TINY_FONT_1 39678 21.70 28.47 19.37 17 HTML_FONT_LOW_CONTRAST 37791 24.28 27.12 23.30 18 RCVD_IN_MSPIKE_H2 37383 25.29 26.83 24.77 19 TR_XM_DKIM_Undo 37312 10.42 26.78 4.78 20 BAYES_99 35803 10.15 25.69 4.80 21 T_KAM_HTML_FONT_INVALID 35618 18.25 25.56 15.73 22 FVGT_m_MULTI_ODD 35456 22.06 25.44 20.89 23 FSL_BULK_SIG 35439 12.96 25.43 8.66 24 DKIM_VALID_EF 34217 25.38 24.56 25.66 25 XMSubLong 32283 20.89 23.17 20.10 26 T_TM2_M_HEADER_IN_MSG 30784 29.96 22.09 32.67 27 DCC_CHECK_NEGATIVE 29666 54.20 21.29 65.53 28 RELAYCOUNTRY_META 28402 8.72 20.38 4.71 29 TR_DCC_Bayes_99 27618 6.67 19.82 2.14 30 BAYES_999 27390 7.96 19.66 3.93 31 BOTNET 27048 6.04 19.41 1.44 32 XM_Body_Dirty_Words 26970 13.20 19.35 11.08 33 RCVD_IN_MSPIKE_WL 25321 23.81 18.17 25.75 34 UNTRUSTED_Relay 24583 6.05 17.64 2.06 35 XM_Multi_Part_URI 19278 11.06 13.83 10.10 36 XM_B_Unsub 19051 11.57 13.67 10.85 37 LOTS_OF_MONEY 17921 8.08 12.86 6.43 38 XM_UncommonTLD01 17418 6.24 12.50 4.08 39 HTML_MIME_NO_HTML_TAG 16636 4.91 11.94 2.49 40 T_REMOTE_IMAGE 16069 6.28 11.53 4.48 41 BOTNET_IPINHOSTNAME 15721 5.73 11.28 3.81 42 TR_XM_SpammyWords4 15376 5.82 11.03 4.02 43 XM_B_SpammyWords3 15294 6.01 10.98 4.31 44 BOTNET_NORDNS 14500 2.68 10.41 0.02 45 RCVD_IN_MSPIKE_H3 14115 12.92 10.13 13.88 46 SpammyFromTLD_02 13575 2.69 9.74 0.26 47 UNPARSEABLE_RELAY 13336 8.19 9.57 7.72 48 RCVD_IN_MSPIKE_BL 13164 2.71 9.45 0.39 49 TR_XM_UnparsRelay 12991 6.58 9.32 5.63 50 XMSexyCombo_05 12505 5.01 8.97 3.65 51 TR_XM_SpammyWords2 11783 2.84 8.46 0.90 52 HTML_IMAGE_ONLY_08 11765 2.24 8.44 0.11 53 BODY_URI_ONLY 11655 2.15 8.36 0.02 54 BAYES_60 11650 7.96 8.36 7.82 55 BAYES_80 11498 4.70 8.25 3.48 56 XM_B_Phish_Phrases 11452 4.60 8.22 3.36 57 XM_Evil_Numbers_Gen 11408 8.20 8.19 8.21 58 T_HTML_TAG_BALANCE_CENTER 11340 2.12 8.14 0.05 59 LotsOfNums_01 10863 8.03 7.80 8.12 60 KHOP_HELO_FCRDNS 10774 3.62 7.73 2.20 61 XM_SendGrid 10407 7.00 7.47 6.84 62 TR_XM_PhishingBody 10382 4.16 7.45 3.03 63 RCVD_IN_BL_SPAMCOP_NET 10258 2.20 7.36 0.43 64 DKIM_INVALID 10147 4.80 7.28 3.94 65 RCVD_IN_MSPIKE_H4 9981 9.00 7.16 9.64 66 MPART_ALT_DIFF 9934 6.80 7.13 6.68 67 HTML_FONT_SIZE_LARGE 9930 1.91 7.13 0.11 68 TR_XM_MSPIKECOMBO 9030 1.88 6.48 0.29 69 XM_UB50 8843 2.69 6.35 1.43 70 HTML_IMAGE_RATIO_02 8751 5.76 6.28 5.58 71 XMSubMetaSx_00 8480 4.37 6.09 3.77 72 XM_SPF_SoftFail 8428 3.30 6.05 2.35 73 XM_B_SpammyTLD 8424 3.01 6.05 1.97 74 XM_H_Long_From01 7904 4.93 5.67 4.67 75 XM_B_Phish66 7061 2.71 5.07 1.90 76 MIXED_CENTER_CASE 6919 1.27 4.97 0.00 77 TooManyTo_001 6902 7.86 4.95 8.86 78 MIXED_HREF_CASE 6888 1.27 4.94 0.00 79 MIXED_IMG_CASE 6873 1.27 4.93 0.00 80 MIXED_AREA_CASE 6872 1.26 4.93 0.00 81 MIXED_FONT_CASE 6664 1.23 4.78 0.00 82 XM_ShortIntro_01 6533 2.46 4.69 1.70 83 BAYES_95 6477 2.76 4.65 2.10 84 XMNumbers 6474 3.85 4.65 3.58 85 XMStrtUSub 6397 5.00 4.59 5.15 86 RCVD_IN_MSPIKE_L5 6346 1.20 4.55 0.04 87 TR_XM_SpammyWords3 6135 1.32 4.40 0.26 88 MIME_HTML_MOSTLY 6112 2.83 4.39 2.29 89 HTML_SHORT_LINK_IMG_1 5791 1.08 4.16 0.01 90 RELAYCOUNTRY_CA 5790 1.74 4.16 0.91 91 BAYES_00 5767 12.14 4.14 14.90 92 PDS_OTHER_BAD_TLD 5761 1.25 4.13 0.26 93 XMMoneyMeta_00 5647 1.41 4.05 0.50 94 HDRS_MISSP 5600 1.05 4.02 0.03 95 MISSING_HEADERS 5527 1.47 3.97 0.60 96 HTML_FONT_SIZE_HUGE 5492 1.04 3.94 0.04 97 HTML_IMAGE_RATIO_06 5409 3.36 3.88 3.18 98 TR_XM_DK_SendGrid 5258 4.22 3.77 4.37 99 HTML_IMAGE_RATIO_04 5106 4.39 3.66 4.64 100 TR_XM_SPAMCOP 5065 1.06 3.63 0.17 101 HELO_NODOT 5013 2.42 3.60 2.02 102 HELO_NO_DOMAIN 5009 2.42 3.59 2.02 103 MIME_QP_LONG_LINE 4949 4.59 3.55 4.94 104 URIBL_DBL_SPAM 4895 0.91 3.51 0.01 105 XM_OfRef6 4687 1.50 3.36 0.86 106 REPLYTO_WITHOUT_TO_CC 4680 0.95 3.36 0.12 107 XMHTML_After_End 4659 1.58 3.34 0.98 108 TR_XM_SpammyWords5 4649 1.97 3.34 1.51 109 URI_PHP_REDIR 4648 0.86 3.34 0.01 110 T_XMDrugObfuBody_08 4645 2.11 3.33 1.68 111 URI_NOVOWEL 4616 2.72 3.31 2.52 112 XM_DIRTYINTL 4609 1.38 3.31 0.71 113 URI_GOOG_STO_SPAMMY 4597 0.85 3.30 0.00 114 XMNoVowels 4405 3.58 3.16 3.73 115 XM_B_COVIDMETA 4376 1.28 3.14 0.63 116 TM2_M_URI_OPT_OUT 4316 4.85 3.10 5.45 117 RELAYCOUNTRY_NG_I 4265 0.85 3.06 0.09 118 URIBL_DBL_ABUSE_SPAM 4207 0.80 3.02 0.03 119 RCVD_IN_MSPIKE_ZBI 4134 0.83 2.97 0.09 120 RCVD_IN_RP_SAFE 4120 5.40 2.96 6.25 121 GOOG_STO_IMG_HTML 4055 0.75 2.91 0.00 122 DKIM_ADSP_NXDOMAIN 4054 0.94 2.91 0.26 123 MIME_HTML_ONLY_MULTI 4047 4.43 2.90 4.96 124 RCVD_IN_IADB_LISTED 3839 4.48 2.75 5.07 125 T_XMDrugObfuBody_14 3779 2.42 2.71 2.32 126 T_TooManySym_01 3547 5.40 2.55 6.39 127 MIXED_CTYPE_CASE 3542 0.66 2.54 0.01 128 TM2_M_VERY_LONG_WORD 3526 1.44 2.53 1.06 129 XMDiploma_00 3480 1.56 2.50 1.24 130 XMMoneyMeta_01 3437 0.66 2.47 0.03 131 HTML_IMAGE_ONLY_12 3369 0.81 2.42 0.26 132 XM_UB99 3365 0.62 2.41 0.00 133 BAYES_40 3353 4.77 2.41 5.58 134 ANY_BOUNCE_MESSAGE 3334 3.38 2.39 3.72 135 RCVD_IN_IADB_SPF 3286 3.86 2.36 4.38 136 BOUNCE_MESSAGE 3275 3.37 2.35 3.72 137 RCVD_IN_RP_CERTIFIED 3265 4.56 2.34 5.32 138 XM_BadFromFormat 3146 0.67 2.26 0.12 139 SpammyFromTLD_01 3058 1.21 2.19 0.87 140 RCVD_IN_IADB_SENDERID 3035 3.44 2.18 3.87 141 RCVD_IN_IADB_DK 3027 3.34 2.17 3.74 142 XM_CamelCaseFrm001 2999 1.74 2.15 1.59 143 MAILING_LIST_MULTI 2834 3.17 2.03 3.57 144 TR_XM_COVIDMETA4 2812 0.80 2.02 0.38 145 HTML_IMAGE_RATIO_08 2753 1.97 1.98 1.97 146 URI_HEX 2737 1.47 1.96 1.30 147 EXCUSE_4 2687 0.50 1.93 0.01 148 RELAYCOUNTRY_NL 2635 0.63 1.89 0.19 149 XM_Body_Dirty_Words_01 2577 0.92 1.85 0.60 150 XM_URI_RBL 2567 0.56 1.84 0.12 151 TR_XM_SB_Phish 2562 3.12 1.84 3.56 152 XM_B_SpammyWords4 2519 0.88 1.81 0.56 153 XMSexyCombo_01 2494 1.08 1.79 0.84 154 JH_SPAMMY_HEADERS 2468 0.45 1.77 0.00 155 RELAYCOUNTRY_IR 2455 0.45 1.76 0.00 156 XM_DK_Undo_01 2455 1.67 1.76 1.63 157 XMBody_17 2440 0.75 1.75 0.40 158 T_FILL_THIS_FORM_SHORT 2416 1.26 1.73 1.09 159 XMSubPhish11 2382 3.06 1.71 3.52 160 XM_B_Unsub2 2367 1.38 1.70 1.26 161 BAYES_20 2366 3.79 1.70 4.51 162 XM_UB80 2344 0.45 1.68 0.02 163 SUBJ_ALL_CAPS 2339 1.56 1.68 1.52 164 TR_XM_COVIDMETA1 2336 0.64 1.68 0.28 165 XM_UB60 2321 0.48 1.67 0.08 166 RELAYCOUNTRY_PL 2302 0.44 1.65 0.03 167 XMBrknScrpt_02 2292 1.11 1.64 0.93 168 XM_UB999 2263 0.42 1.62 0.00 169 URIBL_BLACK 2149 0.42 1.54 0.03 170 TR_XM_PhishingBody2 2140 0.42 1.54 0.04 171 XMGenDplmaNmb 2140 0.95 1.54 0.75 172 URI_OPTOUT_3LD 2122 0.44 1.52 0.07 173 LUCRATIVE 2076 0.38 1.49 0.00 174 TR_XM_PHPDW 2076 0.63 1.49 0.33 175 RCVD_IN_RP_RNBL 2069 0.39 1.48 0.02 176 T_XMDrugObfuBody_00 2053 1.08 1.47 0.95 177 TR_XM_PHPForged 2044 0.60 1.47 0.31 178 ALL_TRUSTED 2044 13.52 1.47 17.67 179 US_DOLLARS_3 2015 0.66 1.45 0.39 180 XMStockSpam_06 1982 1.23 1.42 1.16 181 RCVD_IN_IADB_VOUCHED 1978 2.75 1.42 3.20 182 XMSlimDrugH 1971 0.61 1.41 0.33 183 RELAYCOUNTRY_DE 1960 0.88 1.41 0.70 184 HTTPS_HTTP_MISMATCH 1937 0.91 1.39 0.75 185 TR_XM_FormFill2 1933 0.59 1.39 0.31 186 XM_H_PHPOS 1920 0.57 1.38 0.30 187 URIBL_SBL_A 1917 0.44 1.38 0.12 188 DKIM_ADSP_CUSTOM_MED 1884 1.11 1.35 1.03 189 RCVD_IN_PSBL 1836 0.41 1.32 0.10 190 T_XMHurry_00 1813 0.64 1.30 0.41 191 MONEY_NOHTML 1801 0.40 1.29 0.10 192 RCVD_IN_MSPIKE_L4 1783 0.40 1.28 0.10 193 XM_PDF 1780 5.50 1.28 6.95 194 T_MONEY_PERCENT 1763 0.46 1.27 0.19 195 TR_LOTS_OF_MONEY2 1763 0.46 1.27 0.19 196 RELAYCOUNTRY_GB 1754 1.03 1.26 0.95 197 TR_XM_INV_DKIM 1702 0.38 1.22 0.10 198 TR_Mismatch_TLD_01 1694 0.48 1.22 0.22 199 T_Symld_Words_02 1693 0.58 1.21 0.36 200 FORGED_GMAIL_RCVD 1688 0.69 1.21 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 341353 87.25 95.61 84.37 2 RELAYCOUNTRY_US 319332 78.14 75.84 78.93 3 DKIM_SIGNED 279693 69.97 72.42 69.13 4 XM_DK_Pass 273087 67.48 67.45 67.50 5 DCC_CHECK_NEGATIVE 265138 54.20 21.29 65.53 6 DKIM_VALID 263746 65.18 65.14 65.19 7 XM_B_Unicode 262251 65.89 68.99 64.82 8 BAYES_50 219068 51.48 43.72 54.15 9 DKIM_VALID_AU 198106 48.31 46.42 48.96 10 XM_B_SpammyWords 166880 46.66 62.38 41.25 11 XMListUnsubscribeExists 159328 44.63 59.89 39.38 12 XM_B_Unicode3 149028 37.07 37.74 36.83 13 DCC_CHECK 139259 45.75 78.66 34.42 14 T_TM2_M_HEADER_IN_MSG 132195 29.96 22.09 32.67 15 RCVD_IN_MSPIKE_WL 104185 23.81 18.17 25.75 16 DKIM_VALID_EF 103830 25.38 24.56 25.66 17 RCVD_IN_MSPIKE_H2 100205 25.29 26.83 24.77 18 HTML_FONT_LOW_CONTRAST 94262 24.28 27.12 23.30 19 FVGT_m_MULTI_ODD 84538 22.06 25.44 20.89 20 MIME_HTML_ONLY 83666 24.45 35.39 20.68 21 XMSubLong 81322 20.89 23.17 20.10 22 LOC_TINY_FONT_1 78382 21.70 28.47 19.37 23 XM_B_SpammyWords2 72440 21.96 33.74 17.90 24 ALL_TRUSTED 71511 13.52 1.47 17.67 25 T_KAM_HTML_FONT_INVALID 63629 18.25 25.56 15.73 26 BAYES_00 60284 12.14 4.14 14.90 27 RCVD_IN_MSPIKE_H3 56152 12.92 10.13 13.88 28 XM_Body_Dirty_Words 44828 13.20 19.35 11.08 29 XM_B_Unsub 43890 11.57 13.67 10.85 30 USER_IN_DEF_DKIM_WL 41728 7.90 0.88 10.31 31 XM_Multi_Part_URI 40869 11.06 13.83 10.10 32 RCVD_IN_MSPIKE_H4 38986 9.00 7.16 9.64 33 TooManyTo_001 35854 7.86 4.95 8.86 34 FSL_BULK_SIG 35038 12.96 25.43 8.66 35 XM_Evil_Numbers_Gen 33219 8.20 8.19 8.21 36 LotsOfNums_01 32837 8.03 7.80 8.12 37 TR_XM_DK_Bayes 31843 6.02 0.65 7.87 38 BAYES_60 31644 7.96 8.36 7.82 39 UNPARSEABLE_RELAY 31223 8.19 9.57 7.72 40 TR_XM_DK_Bayes1 30718 5.81 0.62 7.59 41 XM_DKIMWhitelistDomains 29093 5.35 0.02 7.19 42 XM_PDF 28137 5.50 1.28 6.95 43 XM_SendGrid 27672 7.00 7.47 6.84 44 MPART_ALT_DIFF 27033 6.80 7.13 6.68 45 LOTS_OF_MONEY 26013 8.08 12.86 6.43 46 T_TooManySym_01 25844 5.40 2.55 6.39 47 TR_XM_DK_Bayes2 25523 4.82 0.48 6.31 48 RCVD_IN_RP_SAFE 25275 5.40 2.96 6.25 49 XM_DK_Undo_02 24986 13.08 33.13 6.18 50 XM_H_Trusted_IP 24309 4.47 0.00 6.01 51 TR_XM_UnparsRelay 22795 6.58 9.32 5.63 52 BAYES_40 22586 4.77 2.41 5.58 53 HTML_IMAGE_RATIO_02 22575 5.76 6.28 5.58 54 TM2_M_URI_OPT_OUT 22042 4.85 3.10 5.45 55 RCVD_IN_RP_CERTIFIED 21530 4.56 2.34 5.32 56 IN_ZIMBRA_NJ_WHITELIST 21040 3.88 0.06 5.20 57 XMStrtUSub 20823 5.00 4.59 5.15 58 RCVD_IN_IADB_LISTED 20519 4.48 2.75 5.07 59 MIME_HTML_ONLY_MULTI 20051 4.43 2.90 4.96 60 MIME_QP_LONG_LINE 20001 4.59 3.55 4.94 61 BAYES_99 19408 10.15 25.69 4.80 62 TR_XM_DKIM_Undo 19359 10.42 26.78 4.78 63 RELAYCOUNTRY_META 19048 8.72 20.38 4.71 64 XM_H_Long_From01 18889 4.93 5.67 4.67 65 HTML_IMAGE_RATIO_04 18765 4.39 3.66 4.64 66 BAYES_20 18230 3.79 1.70 4.51 67 T_REMOTE_IMAGE 18116 6.28 11.53 4.48 68 RCVD_IN_IADB_SPF 17714 3.86 2.36 4.38 69 TR_XM_DK_SendGrid 17677 4.22 3.77 4.37 70 XM_B_SpammyWords3 17420 6.01 10.98 4.31 71 XM_UncommonTLD01 16497 6.24 12.50 4.08 72 TR_XM_SpammyWords4 16255 5.82 11.03 4.02 73 DKIM_INVALID 15947 4.80 7.28 3.94 74 BAYES_999 15896 7.96 19.66 3.93 75 RCVD_IN_IADB_SENDERID 15676 3.44 2.18 3.87 76 BOTNET_IPINHOSTNAME 15426 5.73 11.28 3.81 77 XMSubMetaSx_00 15271 4.37 6.09 3.77 78 RCVD_IN_IADB_DK 15132 3.34 2.17 3.74 79 XMNoVowels 15081 3.58 3.16 3.73 80 ANY_BOUNCE_MESSAGE 15054 3.38 2.39 3.72 81 BOUNCE_MESSAGE 15042 3.37 2.35 3.72 82 XMSexyCombo_05 14755 5.01 8.97 3.65 83 XMNumbers 14491 3.85 4.65 3.58 84 MAILING_LIST_MULTI 14434 3.17 2.03 3.57 85 TR_XM_SB_Phish 14408 3.12 1.84 3.56 86 XMSubPhish11 14239 3.06 1.71 3.52 87 BAYES_80 14082 4.70 8.25 3.48 88 XM_B_Phish_Phrases 13592 4.60 8.22 3.36 89 RCVD_IN_IADB_VOUCHED 12960 2.75 1.42 3.20 90 T_TooManySym_02 12948 2.57 0.72 3.20 91 HTML_IMAGE_RATIO_06 12850 3.36 3.88 3.18 92 TR_XM_PhishingBody 12255 4.16 7.45 3.03 93 BAYES_05 10769 2.25 1.06 2.66 94 URI_NOVOWEL 10176 2.72 3.31 2.52 95 TooManyTo_002 10122 2.11 0.99 2.50 96 HTML_MIME_NO_HTML_TAG 10077 4.91 11.94 2.49 97 XM_SPF_SoftFail 9511 3.30 6.05 2.35 98 FROM_EXCESS_BASE64 9446 2.03 1.16 2.33 99 T_XMDrugObfuBody_14 9393 2.42 2.71 2.32 100 MIME_HTML_MOSTLY 9262 2.83 4.39 2.29 101 RCVD_IN_MSPIKE_H5 9047 1.89 0.88 2.24 102 KHOP_HELO_FCRDNS 8895 3.62 7.73 2.20 103 TR_DCC_Bayes_99 8653 6.67 19.82 2.14 104 BAYES_95 8512 2.76 4.65 2.10 105 RCVD_IN_IADB_OPTIN 8509 1.80 0.91 2.10 106 UNTRUSTED_Relay 8331 6.05 17.64 2.06 107 XMSubNoVowel 8197 1.77 1.03 2.03 108 HELO_NODOT 8176 2.42 3.60 2.02 109 HELO_NO_DOMAIN 8175 2.42 3.59 2.02 110 HTML_IMAGE_RATIO_08 7965 1.97 1.98 1.97 111 XM_B_SpammyTLD 7960 3.01 6.05 1.97 112 IN_HORDE_ADDRESS_BOOK 7726 1.44 0.09 1.91 113 XM_B_Phish66 7668 2.71 5.07 1.90 114 INVALID_MSGID 7283 1.38 0.18 1.80 115 TVD_RCVD_IP 7178 1.37 0.21 1.77 116 TR_Symld_Words 7126 1.62 1.21 1.76 117 XM_ShortIntro_01 6873 2.46 4.69 1.70 118 T_XMDrugObfuBody_08 6806 2.11 3.33 1.68 119 XM_DK_Undo_01 6603 1.67 1.76 1.63 120 MSGID_NOFQDN1 6578 1.22 0.05 1.63 121 TooManyTo_003 6562 1.41 0.81 1.62 122 XM_CamelCaseFrm001 6453 1.74 2.15 1.59 123 TO_MALFORMED 6376 1.18 0.01 1.58 124 SUBJ_ALL_CAPS 6137 1.56 1.68 1.52 125 TR_XM_SpammyWords5 6092 1.97 3.34 1.51 126 BOTNET 5824 6.04 19.41 1.44 127 XM_UB50 5805 2.69 6.35 1.43 128 XMCapTrack 5597 1.26 0.89 1.38 129 URI_HEX 5273 1.47 1.96 1.30 130 XM_B_Unsub2 5117 1.38 1.70 1.26 131 XM_SPF_Unknown 5052 1.11 0.73 1.25 132 XMDiploma_00 5012 1.56 2.50 1.24 133 TooManyTo_004 4854 1.07 0.70 1.20 134 XMStockSpam_06 4690 1.23 1.42 1.16 135 T_OBFU_PDF_ATTACH 4663 0.91 0.22 1.15 136 XM_E_Blogspot 4514 0.85 0.09 1.12 137 T_FILL_THIS_FORM_SHORT 4414 1.26 1.73 1.09 138 XM_GoogleGroups 4355 0.98 0.70 1.08 139 TM2_M_VERY_LONG_WORD 4288 1.44 2.53 1.06 140 XMGappySubj_01 4251 0.81 0.12 1.05 141 DKIM_ADSP_CUSTOM_MED 4148 1.11 1.35 1.03 142 XMHTML_After_End 3953 1.58 3.34 0.98 143 T_TooManySym_03 3942 0.80 0.28 0.97 144 TooManyTo_005 3913 0.88 0.61 0.97 145 MIME_HEADER_CTYPE_ONLY 3860 0.74 0.14 0.95 146 T_XMDrugObfuBody_00 3831 1.08 1.47 0.95 147 RELAYCOUNTRY_GB 3826 1.03 1.26 0.95 148 XMBrknScrpt_02 3755 1.11 1.64 0.93 149 HTML_FONT_FACE_BAD 3722 0.83 0.56 0.92 150 RELAYCOUNTRY_CA 3676 1.74 4.16 0.91 151 TR_XM_SpammyWords2 3649 2.84 8.46 0.90 152 SpammyFromTLD_01 3509 1.21 2.19 0.87 153 XM_OfRef6 3497 1.50 3.36 0.86 154 HTML_IMAGE_ONLY_20 3416 0.77 0.56 0.84 155 XMSexyCombo_01 3396 1.08 1.79 0.84 156 XM_H_Long_From02 3369 0.93 1.20 0.83 157 URI_TRY_3LD 3336 0.88 1.05 0.82 158 XMBSHREFv2 3194 0.68 0.38 0.79 159 TR_MetaPhish_Combo_01 3121 0.74 0.65 0.77 160 HTTPS_HTTP_MISMATCH 3035 0.91 1.39 0.75 161 XMGenDplmaNmb 3018 0.95 1.54 0.75 162 MY_SERVERS_FOUND 3005 0.59 0.14 0.74 163 XMBody_95 2976 0.58 0.12 0.74 164 XM_DIRTYINTL 2873 1.38 3.31 0.71 165 RELAYCOUNTRY_DE 2817 0.88 1.41 0.70 166 NML_ADSP_CUSTOM_MED 2702 0.78 1.12 0.67 167 XM_B_COVIDMETA 2569 1.28 3.14 0.63 168 RCVD_IN_SORBS_DUL 2552 0.54 0.27 0.63 169 TM2_M_BODY_EMPTY 2461 0.48 0.12 0.61 170 MISSING_HEADERS 2445 1.47 3.97 0.60 171 XM_Body_Dirty_Words_01 2421 0.92 1.85 0.60 172 RELAYCOUNTRY_FR 2391 0.75 1.20 0.59 173 FROM_GOV_SPOOF 2373 0.49 0.20 0.59 174 XMBdyGiftCard01 2342 0.65 0.87 0.58 175 XMHTMLBadTable_001 2289 0.57 0.58 0.57 176 XM_B_SpammyWords4 2275 0.88 1.81 0.56 177 XM_H_PHPMailer 2235 0.59 0.70 0.55 178 XMLngstWrd_00 2234 0.63 0.85 0.55 179 XM_ProductURIs 2191 0.61 0.81 0.54 180 SHORT_HELO_AND_INLINE_IMAGE 2179 0.44 0.17 0.54 181 XMSubMetaSxObfu_03 2161 0.57 0.69 0.53 182 HTML_TAG_BALANCE_BODY 2143 0.58 0.71 0.53 183 HTML_IMAGE_ONLY_32 2087 0.44 0.22 0.52 184 FORGED_GMAIL_RCVD 2076 0.69 1.21 0.51 185 XMPhish30 2047 0.63 0.98 0.51 186 XMMoneyMeta_00 2022 1.41 4.05 0.50 187 XMLngstWrd_01 2008 0.58 0.83 0.50 188 XMSexyCombo_04 1996 0.53 0.63 0.49 189 TR_MSPIKEBAYES00 1980 0.37 0.02 0.49 190 XM_B_REG_HTML 1968 0.49 0.51 0.49 191 XMDateMe_00 1880 0.47 0.48 0.46 192 HTML_IMAGE_ONLY_28 1879 0.43 0.34 0.46 193 MSGID_FROM_MTA_HEADER 1840 0.41 0.29 0.45 194 XM_shorewaves_Whitelist 1839 0.34 0.00 0.45 195 TVD_SPACE_RATIO 1822 0.35 0.07 0.45 196 XMBounce_01 1785 0.45 0.46 0.44 197 XM_B_COPY_HTML 1766 0.49 0.63 0.44 198 FROM_GOV_DKIM_AU 1759 0.36 0.13 0.43 199 T_TooManySym_04 1757 0.35 0.11 0.43 200 TVD_SPACE_RATIO_MINFP 1749 0.36 0.15 0.43 ----------------------------------------------------------------------