Email: 496740 Autolearn: 0 AvgScore: 3.47 AvgScanTime: 1.27 sec Spam: 128227 Autolearn: 0 AvgScore: 15.15 AvgScanTime: 1.53 sec Ham: 368513 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.17 sec Time Spent Running SA: 174.66 hours Time Spent Processing Spam: 54.48 hours Time Spent Processing Ham: 120.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123527 88.04 96.33 85.16 2 DKIM_SIGNED 102832 72.04 80.20 69.20 3 DCC_CHECK 100369 45.78 78.27 34.47 4 RELAYCOUNTRY_US 98888 76.00 77.12 75.61 5 XM_DK_Pass 95956 69.36 74.83 67.46 6 XM_B_Unicode 94426 70.37 73.64 69.24 7 DKIM_VALID 92371 66.75 72.04 64.91 8 XMListUnsubscribeExists 85813 48.04 66.92 41.47 9 XM_B_SpammyWords 83057 46.77 64.77 40.50 10 DKIM_VALID_AU 67481 49.98 52.63 49.07 11 BAYES_50 57732 52.43 45.02 55.00 12 XM_B_Unicode3 52446 40.77 40.90 40.72 13 XM_DK_Undo_02 49910 14.66 38.92 6.22 14 XM_B_SpammyWords2 47640 21.50 37.15 16.05 15 LOC_TINY_FONT_1 42935 26.18 33.48 23.64 16 HTML_FONT_LOW_CONTRAST 42730 28.72 33.32 27.11 17 MIME_HTML_ONLY 41922 22.29 32.69 18.68 18 TR_XM_DKIM_Undo 38938 11.37 30.37 4.75 19 RCVD_IN_MSPIKE_H2 37193 25.53 29.01 24.32 20 DKIM_VALID_EF 36191 26.91 28.22 26.45 21 BAYES_99 35682 11.02 27.83 5.17 22 T_KAM_HTML_FONT_INVALID 35460 18.92 27.65 15.88 23 FVGT_m_MULTI_ODD 34531 24.42 26.93 23.55 24 XMSubLong 34452 21.98 26.87 20.28 25 T_TM2_M_HEADER_IN_MSG 29891 29.80 23.31 32.06 26 BAYES_999 28077 8.89 21.90 4.36 27 TR_DCC_Bayes_99 27888 7.17 21.75 2.10 28 DCC_CHECK_NEGATIVE 27796 54.18 21.68 65.49 29 RELAYCOUNTRY_META 27216 9.74 21.22 5.75 30 XM_Body_Dirty_Words 27117 14.51 21.15 12.21 31 RCVD_IN_MSPIKE_WL 23927 25.00 18.66 27.20 32 FSL_BULK_SIG 21776 9.37 16.98 6.73 33 XM_UncommonTLD01 21325 6.84 16.63 3.43 34 UNTRUSTED_Relay 20339 6.38 15.86 3.08 35 BOTNET 20190 5.01 15.75 1.27 36 XM_Multi_Part_URI 20146 11.78 15.71 10.41 37 BOTNET_IPINHOSTNAME 17962 6.52 14.01 3.91 38 SpammyFromTLD_02 16907 3.56 13.19 0.21 39 LOTS_OF_MONEY 16476 8.17 12.85 6.55 40 XM_B_SpammyWords3 15790 5.57 12.31 3.22 41 XMSubMetaSx_00 15318 7.73 11.95 6.26 42 XMSexyCombo_05 14448 6.79 11.27 5.23 43 TR_XM_SpammyWords4 14284 6.08 11.14 4.31 44 XM_B_Unsub 13715 9.69 10.70 9.34 45 UNPARSEABLE_RELAY 13631 8.18 10.63 7.32 46 TR_XM_UnparsRelay 13148 6.70 10.25 5.47 47 RCVD_IN_MSPIKE_H3 12664 13.12 9.88 14.24 48 MPART_ALT_DIFF 11874 5.57 9.26 4.28 49 T_REMOTE_IMAGE 11719 5.04 9.14 3.61 50 XM_Evil_Numbers_Gen 11467 8.09 8.94 7.79 51 RCVD_IN_BL_SPAMCOP_NET 11288 2.73 8.80 0.62 52 TR_XM_SpammyWords2 11266 2.88 8.79 0.82 53 XM_SendGrid 10661 6.90 8.31 6.41 54 HTML_MIME_NO_HTML_TAG 10486 3.88 8.18 2.38 55 DKIM_INVALID 10461 5.29 8.16 4.30 56 KHOP_HELO_FCRDNS 10319 3.42 8.05 1.81 57 RCVD_IN_MSPIKE_H4 9888 9.83 7.71 10.57 58 XM_B_SpammyTLD 9671 3.42 7.54 1.98 59 TooManyTo_001 9606 8.60 7.49 8.99 60 BAYES_80 9342 4.53 7.29 3.57 61 XM_B_Phish_Phrases 9196 4.59 7.17 3.70 62 LotsOfNums_01 9146 7.94 7.13 8.21 63 HTML_IMAGE_ONLY_08 8939 1.88 6.97 0.10 64 XM_UB50 8836 3.60 6.89 2.46 65 HTML_IMAGE_RATIO_02 8835 6.57 6.89 6.46 66 BAYES_60 8788 7.90 6.85 8.26 67 T_HTML_TAG_BALANCE_CENTER 8527 1.76 6.65 0.06 68 MIME_HTML_MOSTLY 8335 3.19 6.50 2.04 69 URIBL_DBL_SPAM 8197 1.65 6.39 0.01 70 TR_XM_PhishingBody 8176 4.07 6.38 3.26 71 RCVD_IN_MSPIKE_BL 8075 1.86 6.30 0.31 72 XMNumbers 8013 5.95 6.25 5.84 73 TR_XM_MSPIKECOMBO 7952 1.83 6.20 0.31 74 XM_H_Long_From01 7149 5.04 5.58 4.85 75 MIXED_CENTER_CASE 6991 1.41 5.45 0.00 76 MIXED_HREF_CASE 6986 1.41 5.45 0.00 77 MIXED_IMG_CASE 6985 1.41 5.45 0.00 78 MIXED_FONT_CASE 6985 1.41 5.45 0.00 79 MIXED_AREA_CASE 6983 1.41 5.45 0.00 80 XM_SPF_SoftFail 6831 2.77 5.33 1.88 81 PDS_OTHER_BAD_TLD 6570 1.52 5.12 0.27 82 URI_NOVOWEL 6524 3.23 5.09 2.58 83 URI_GOOG_STO_SPAMMY 6453 1.30 5.03 0.00 84 BODY_URI_ONLY 6343 1.28 4.95 0.01 85 TR_XM_SPAMCOP 6059 1.39 4.73 0.23 86 TR_XM_SpammyWords3 6009 1.39 4.69 0.24 87 BOTNET_NORDNS 5836 1.18 4.55 0.01 88 HTML_FONT_SIZE_LARGE 5733 1.25 4.47 0.13 89 RCVD_IN_MSPIKE_L5 5666 1.16 4.42 0.03 90 TR_XM_DK_SendGrid 5615 4.03 4.38 3.91 91 MIXED_CTYPE_CASE 5403 1.09 4.21 0.00 92 XMSexyCombo_01 5196 1.74 4.05 0.93 93 RELAYCOUNTRY_CA 5189 1.76 4.05 0.97 94 HTML_IMAGE_RATIO_04 5116 4.36 3.99 4.49 95 MIME_QP_LONG_LINE 4996 4.55 3.90 4.78 96 XM_OfRef6 4878 1.78 3.80 1.08 97 BAYES_95 4847 2.56 3.78 2.13 98 XM_B_Phish66 4722 2.44 3.68 2.01 99 RCVD_IN_RP_SAFE 4670 6.19 3.64 7.08 100 TM2_M_URI_OPT_OUT 4588 4.14 3.58 4.34 101 XMStrtUSub 4481 4.20 3.49 4.45 102 XMNoVowels 4408 4.65 3.44 5.07 103 MIME_HTML_ONLY_MULTI 4394 3.05 3.43 2.92 104 XM_DIRTYINTL 4368 2.10 3.41 1.64 105 SpammyFromTLD_01 4296 1.38 3.35 0.69 106 XM_B_COVIDMETA 4041 1.32 3.15 0.68 107 HTML_FONT_SIZE_HUGE 4004 0.84 3.12 0.05 108 T_XMDrugObfuBody_14 3973 2.37 3.10 2.11 109 URI_PHP_REDIR 3889 0.78 3.03 0.00 110 T_XMDrugObfuBody_08 3795 1.77 2.96 1.35 111 HTML_IMAGE_RATIO_06 3776 3.23 2.94 3.33 112 RCVD_IN_RP_CERTIFIED 3776 5.42 2.94 6.28 113 TR_XM_SpammyWords5 3756 1.71 2.93 1.29 114 T_TooManySym_01 3659 4.90 2.85 5.61 115 JH_SPAMMY_HEADERS 3568 0.73 2.78 0.01 116 BAYES_40 3554 4.54 2.77 5.15 117 BAYES_00 3397 10.46 2.65 13.17 118 RCVD_IN_RP_RNBL 3377 0.68 2.63 0.01 119 XMDiploma_00 3361 1.70 2.62 1.37 120 XM_B_Unsub2 3245 1.73 2.53 1.45 121 XM_UB99 3218 0.65 2.51 0.00 122 RCVD_IN_IADB_LISTED 3166 4.02 2.47 4.56 123 TR_XM_SB_Phish 3087 2.19 2.41 2.11 124 URI_HEX 3047 1.66 2.38 1.41 125 TR_XM_COVIDMETA4 2994 0.85 2.33 0.34 126 XMSubPhish11 2978 2.15 2.32 2.08 127 BAYES_20 2955 4.32 2.30 5.02 128 HTML_IMAGE_RATIO_08 2901 2.01 2.26 1.93 129 GOOG_STO_IMG_HTML 2845 0.57 2.22 0.00 130 RCVD_IN_IADB_SPF 2793 3.53 2.18 3.99 131 MAILING_LIST_MULTI 2749 2.43 2.14 2.53 132 TM2_M_VERY_LONG_WORD 2693 1.42 2.10 1.18 133 XM_DK_Undo_01 2608 1.82 2.03 1.74 134 XM_CamelCaseFrm001 2608 1.74 2.03 1.63 135 RCVD_IN_IADB_DK 2601 3.11 2.03 3.48 136 RCVD_IN_IADB_SENDERID 2592 3.18 2.02 3.58 137 RELAYCOUNTRY_IN 2558 0.60 1.99 0.11 138 XMSlimDrugH 2558 0.76 1.99 0.34 139 FROM_SUSPICIOUS_NTLD 2555 0.54 1.99 0.04 140 FROM_EXCESS_BASE64 2517 2.30 1.96 2.42 141 FROM_SUSPICIOUS_NTLD_FP 2495 0.53 1.95 0.04 142 TR_XM_PHPDW 2445 0.72 1.91 0.30 143 RCVD_IN_PSBL 2441 0.53 1.90 0.05 144 XM_URI_RBL 2407 0.56 1.88 0.09 145 XMBrknScrpt_02 2383 1.23 1.86 1.01 146 TO_NO_BRKTS_PCNT 2336 0.47 1.82 0.00 147 TR_XM_PHPForged 2331 0.66 1.82 0.25 148 XM_B_SpammyWords4 2330 0.76 1.82 0.39 149 TR_XM_FormFill2 2310 0.66 1.80 0.26 150 XM_H_PHPOS 2293 0.64 1.79 0.24 151 XMStockSpam_06 2213 1.34 1.73 1.21 152 XM_UB999 2201 0.44 1.72 0.00 153 T_FILL_THIS_FORM_SHORT 2180 1.09 1.70 0.88 154 RELAYCOUNTRY_NL 2131 0.57 1.66 0.18 155 T_XMDrugObfuBody_00 2129 0.96 1.66 0.72 156 ALL_TRUSTED 2124 15.24 1.66 19.96 157 XM_UB60 2101 0.49 1.64 0.09 158 TR_XM_INV_DKIM 2019 0.45 1.57 0.05 159 DIET_1 2010 0.64 1.57 0.32 160 XM_PDF 2007 4.29 1.57 5.23 161 RELAYCOUNTRY_GB 1996 1.11 1.56 0.96 162 RELAYCOUNTRY_DE 1982 0.87 1.55 0.63 163 HTTPS_HTTP_MISMATCH 1956 1.04 1.53 0.87 164 XMSexyCombo_04 1950 0.55 1.52 0.21 165 URIBL_BLACK 1927 0.40 1.50 0.02 166 TR_XM_COVIDMETA1 1897 0.59 1.48 0.28 167 BAYES_05 1865 2.25 1.45 2.52 168 URI_TRY_3LD 1847 1.17 1.44 1.08 169 XM_Body_Dirty_Words_01 1847 0.84 1.44 0.63 170 SUBJ_ALL_CAPS 1792 1.41 1.40 1.42 171 RELAYCOUNTRY_PL 1785 0.38 1.39 0.03 172 T_XMHurry_00 1784 0.65 1.39 0.39 173 XM_H_TOP 1784 0.36 1.39 0.00 174 HTML_IMAGE_ONLY_20 1784 1.08 1.39 0.97 175 TR_Mismatch_TLD_02 1755 0.44 1.37 0.11 176 XMGenDplmaNmb 1751 0.95 1.37 0.80 177 XMBody_17 1735 0.63 1.35 0.38 178 TR_M_TOP_BAYES 1721 0.35 1.34 0.00 179 XMHTML_After_End 1664 1.06 1.30 0.98 180 HELO_NODOT 1653 1.72 1.29 1.87 181 HELO_NO_DOMAIN 1648 1.71 1.29 1.86 182 TooManyTo_002 1624 2.22 1.27 2.55 183 XM_UB80 1603 0.34 1.25 0.02 184 TR_Symld_Words 1584 1.41 1.24 1.48 185 XMSubMetaSSx_00 1567 0.47 1.22 0.20 186 USER_IN_DEF_DKIM_WL 1554 8.18 1.21 10.61 187 HTML_SHORT_LINK_IMG_3 1553 0.37 1.21 0.07 188 DKIM_ADSP_CUSTOM_MED 1544 1.04 1.20 0.99 189 RELAYCOUNTRY_FR 1542 1.49 1.20 1.59 190 XM_SPF_Unknown 1505 0.88 1.17 0.78 191 RCVD_IN_IADB_VOUCHED 1476 2.39 1.15 2.82 192 XMBdyGiftCard01 1455 0.75 1.13 0.62 193 TR_XM_BayesRelay 1424 0.29 1.11 0.00 194 TR_Mismatch_TLD_01 1402 0.44 1.09 0.21 195 XMSubNoVowel 1398 1.65 1.09 1.84 196 RDNS_DYNAMIC 1397 0.59 1.09 0.41 197 T_TooManySym_02 1387 2.31 1.08 2.74 198 RCVD_IN_MSPIKE_H5 1375 2.05 1.07 2.38 199 MISSING_HEADERS 1372 0.64 1.07 0.49 200 RELAYCOUNTRY_AU 1364 0.48 1.06 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 313824 88.04 96.33 85.16 2 RELAYCOUNTRY_US 278615 76.00 77.12 75.61 3 XM_B_Unicode 255152 70.37 73.64 69.24 4 DKIM_SIGNED 255021 72.04 80.20 69.20 5 XM_DK_Pass 248582 69.36 74.83 67.46 6 DCC_CHECK_NEGATIVE 241324 54.18 21.68 65.49 7 DKIM_VALID 239191 66.75 72.04 64.91 8 BAYES_50 202691 52.43 45.02 55.00 9 DKIM_VALID_AU 180812 49.98 52.63 49.07 10 XMListUnsubscribeExists 152813 48.04 66.92 41.47 11 XM_B_Unicode3 150056 40.77 40.90 40.72 12 XM_B_SpammyWords 149248 46.77 64.77 40.50 13 DCC_CHECK 127024 45.78 78.27 34.47 14 T_TM2_M_HEADER_IN_MSG 118145 29.80 23.31 32.06 15 RCVD_IN_MSPIKE_WL 100236 25.00 18.66 27.20 16 HTML_FONT_LOW_CONTRAST 99909 28.72 33.32 27.11 17 DKIM_VALID_EF 97483 26.91 28.22 26.45 18 RCVD_IN_MSPIKE_H2 89635 25.53 29.01 24.32 19 LOC_TINY_FONT_1 87120 26.18 33.48 23.64 20 FVGT_m_MULTI_ODD 86770 24.42 26.93 23.55 21 XMSubLong 74734 21.98 26.87 20.28 22 ALL_TRUSTED 73558 15.24 1.66 19.96 23 MIME_HTML_ONLY 68822 22.29 32.69 18.68 24 XM_B_SpammyWords2 59140 21.50 37.15 16.05 25 T_KAM_HTML_FONT_INVALID 58522 18.92 27.65 15.88 26 RCVD_IN_MSPIKE_H3 52488 13.12 9.88 14.24 27 BAYES_00 48551 10.46 2.65 13.17 28 XM_Body_Dirty_Words 44982 14.51 21.15 12.21 29 USER_IN_DEF_DKIM_WL 39095 8.18 1.21 10.61 30 RCVD_IN_MSPIKE_H4 38961 9.83 7.71 10.57 31 XM_Multi_Part_URI 38375 11.78 15.71 10.41 32 XM_B_Unsub 34433 9.69 10.70 9.34 33 TooManyTo_001 33128 8.60 7.49 8.99 34 BAYES_60 30438 7.90 6.85 8.26 35 LotsOfNums_01 30273 7.94 7.13 8.21 36 XM_Evil_Numbers_Gen 28718 8.09 8.94 7.79 37 TR_XM_DK_Bayes 28323 5.94 0.91 7.69 38 TR_XM_DK_Bayes1 27244 5.72 0.89 7.39 39 UNPARSEABLE_RELAY 26987 8.18 10.63 7.32 40 XM_DKIMWhitelistDomains 26933 5.43 0.02 7.31 41 RCVD_IN_RP_SAFE 26085 6.19 3.64 7.08 42 FSL_BULK_SIG 24793 9.37 16.98 6.73 43 LOTS_OF_MONEY 24120 8.17 12.85 6.55 44 HTML_IMAGE_RATIO_02 23813 6.57 6.89 6.46 45 XM_SendGrid 23616 6.90 8.31 6.41 46 RCVD_IN_RP_CERTIFIED 23136 5.42 2.94 6.28 47 XMSubMetaSx_00 23066 7.73 11.95 6.26 48 XM_DK_Undo_02 22926 14.66 38.92 6.22 49 TR_XM_DK_Bayes2 22443 4.70 0.69 6.09 50 XMNumbers 21523 5.95 6.25 5.84 51 RELAYCOUNTRY_META 21175 9.74 21.22 5.75 52 T_TooManySym_01 20682 4.90 2.85 5.61 53 ANY_BOUNCE_MESSAGE 20196 4.30 0.92 5.48 54 BOUNCE_MESSAGE 20193 4.30 0.92 5.48 55 TR_XM_UnparsRelay 20152 6.70 10.25 5.47 56 XM_PDF 19287 4.29 1.57 5.23 57 XMSexyCombo_05 19268 6.79 11.27 5.23 58 BAYES_99 19037 11.02 27.83 5.17 59 BAYES_40 18987 4.54 2.77 5.15 60 XMNoVowels 18673 4.65 3.44 5.07 61 BAYES_20 18488 4.32 2.30 5.02 62 XM_H_Long_From01 17882 5.04 5.58 4.85 63 MIME_QP_LONG_LINE 17601 4.55 3.90 4.78 64 TR_XM_DKIM_Undo 17519 11.37 30.37 4.75 65 RCVD_IN_IADB_LISTED 16813 4.02 2.47 4.56 66 HTML_IMAGE_RATIO_04 16560 4.36 3.99 4.49 67 XM_H_Trusted_IP 16438 3.31 0.00 4.46 68 XMStrtUSub 16386 4.20 3.49 4.45 69 BAYES_999 16078 8.89 21.90 4.36 70 TM2_M_URI_OPT_OUT 15977 4.14 3.58 4.34 71 TR_XM_SpammyWords4 15901 6.08 11.14 4.31 72 DKIM_INVALID 15830 5.29 8.16 4.30 73 MPART_ALT_DIFF 15788 5.57 9.26 4.28 74 RCVD_IN_IADB_SPF 14721 3.53 2.18 3.99 75 BOTNET_IPINHOSTNAME 14411 6.52 14.01 3.91 76 TR_XM_DK_SendGrid 14392 4.03 4.38 3.91 77 XM_B_Phish_Phrases 13628 4.59 7.17 3.70 78 T_REMOTE_IMAGE 13300 5.04 9.14 3.61 79 RCVD_IN_IADB_SENDERID 13190 3.18 2.02 3.58 80 BAYES_80 13169 4.53 7.29 3.57 81 RCVD_IN_IADB_DK 12828 3.11 2.03 3.48 82 XM_UncommonTLD01 12642 6.84 16.63 3.43 83 HTML_IMAGE_RATIO_06 12265 3.23 2.94 3.33 84 TR_XM_PhishingBody 12021 4.07 6.38 3.26 85 XM_B_SpammyWords3 11855 5.57 12.31 3.22 86 UNTRUSTED_Relay 11366 6.38 15.86 3.08 87 MIME_HTML_ONLY_MULTI 10764 3.05 3.43 2.92 88 RCVD_IN_IADB_VOUCHED 10388 2.39 1.15 2.82 89 T_TooManySym_02 10099 2.31 1.08 2.74 90 URI_NOVOWEL 9520 3.23 5.09 2.58 91 TooManyTo_002 9392 2.22 1.27 2.55 92 MAILING_LIST_MULTI 9318 2.43 2.14 2.53 93 BAYES_05 9295 2.25 1.45 2.52 94 XM_UB50 9069 3.60 6.89 2.46 95 FROM_EXCESS_BASE64 8915 2.30 1.96 2.42 96 RCVD_IN_MSPIKE_H5 8787 2.05 1.07 2.38 97 HTML_MIME_NO_HTML_TAG 8774 3.88 8.18 2.38 98 FUZZY_MICROSOFT 8479 1.75 0.16 2.30 99 BAYES_95 7846 2.56 3.78 2.13 100 T_XMDrugObfuBody_14 7785 2.37 3.10 2.11 101 TR_XM_SB_Phish 7784 2.19 2.41 2.11 102 TR_DCC_Bayes_99 7732 7.17 21.75 2.10 103 XMSubPhish11 7683 2.15 2.32 2.08 104 MIME_HTML_MOSTLY 7500 3.19 6.50 2.04 105 XM_B_Phish66 7397 2.44 3.68 2.01 106 XM_B_SpammyTLD 7304 3.42 7.54 1.98 107 INVALID_MSGID 7225 1.54 0.32 1.96 108 IN_HORDE_ADDRESS_BOOK 7103 1.45 0.08 1.93 109 HTML_IMAGE_RATIO_08 7103 2.01 2.26 1.93 110 XM_SPF_SoftFail 6946 2.77 5.33 1.88 111 HELO_NODOT 6873 1.72 1.29 1.87 112 HELO_NO_DOMAIN 6871 1.71 1.29 1.86 113 XMSubNoVowel 6793 1.65 1.09 1.84 114 KHOP_HELO_FCRDNS 6673 3.42 8.05 1.81 115 RCVD_IN_IADB_OPTIN 6614 1.53 0.78 1.79 116 MSGID_NOFQDN1 6453 1.33 0.12 1.75 117 XM_DK_Undo_01 6408 1.82 2.03 1.74 118 TO_MALFORMED 6316 1.27 0.01 1.71 119 TooManyTo_003 6208 1.52 1.05 1.68 120 XM_DIRTYINTL 6047 2.10 3.41 1.64 121 XM_CamelCaseFrm001 6016 1.74 2.03 1.63 122 RELAYCOUNTRY_FR 5869 1.49 1.20 1.59 123 TR_Symld_Words 5444 1.41 1.24 1.48 124 XMBounce_01 5378 1.13 0.18 1.46 125 XM_B_Unsub2 5337 1.73 2.53 1.45 126 SUBJ_ALL_CAPS 5235 1.41 1.40 1.42 127 URI_HEX 5197 1.66 2.38 1.41 128 TVD_RCVD_IP 5160 1.16 0.46 1.40 129 XMCapTrack 5088 1.18 0.60 1.38 130 XMDiploma_00 5059 1.70 2.62 1.37 131 T_XMDrugObfuBody_08 4978 1.77 2.96 1.35 132 XM_GoogleGroups 4769 1.17 0.80 1.29 133 TR_XM_SpammyWords5 4742 1.71 2.93 1.29 134 BOTNET 4677 5.01 15.75 1.27 135 TooManyTo_004 4501 1.13 0.88 1.22 136 XMStockSpam_06 4445 1.34 1.73 1.21 137 TM2_M_VERY_LONG_WORD 4349 1.42 2.10 1.18 138 XM_OfRef6 3977 1.78 3.80 1.08 139 URI_TRY_3LD 3977 1.17 1.44 1.08 140 XMGappySubj_01 3902 0.83 0.16 1.06 141 XMBrknScrpt_02 3731 1.23 1.86 1.01 142 TooManyTo_005 3714 0.95 0.79 1.01 143 DKIM_ADSP_CUSTOM_MED 3641 1.04 1.20 0.99 144 XMHTML_After_End 3622 1.06 1.30 0.98 145 HTML_IMAGE_ONLY_20 3579 1.08 1.39 0.97 146 RELAYCOUNTRY_CA 3574 1.76 4.05 0.97 147 HTML_FONT_FACE_BAD 3543 0.92 0.80 0.96 148 RELAYCOUNTRY_GB 3532 1.11 1.56 0.96 149 XMBody_95 3493 0.75 0.18 0.95 150 TR_MetaPhish_Combo_01 3460 0.95 0.97 0.94 151 XMSexyCombo_01 3438 1.74 4.05 0.93 152 HELO_MISC_IP 3298 0.70 0.14 0.89 153 XM_H_Long_From02 3284 0.93 1.03 0.89 154 XMBSHREFv2 3236 0.74 0.34 0.88 155 T_FILL_THIS_FORM_SHORT 3225 1.09 1.70 0.88 156 HTTPS_HTTP_MISMATCH 3190 1.04 1.53 0.87 157 XM_E_Blogspot 3119 0.65 0.08 0.85 158 IN_ZIMBRA_NJ_WHITELIST 3108 0.63 0.01 0.84 159 T_TooManySym_03 3036 0.72 0.42 0.82 160 TR_XM_SpammyWords2 3021 2.88 8.79 0.82 161 XMGenDplmaNmb 2962 0.95 1.37 0.80 162 XM_SPF_Unknown 2888 0.88 1.17 0.78 163 T_XMDrugObfuBody_00 2637 0.96 1.66 0.72 164 XM_RXBody 2569 0.62 0.40 0.70 165 SpammyFromTLD_01 2552 1.38 3.35 0.69 166 XM_ProductURIs 2550 0.75 0.92 0.69 167 XM_B_COVIDMETA 2498 1.32 3.15 0.68 168 XM_ShortIntro_01 2482 0.73 0.88 0.67 169 TVD_SPACE_RATIO 2439 0.52 0.12 0.66 170 XMPhish30 2421 0.76 1.05 0.66 171 NML_ADSP_CUSTOM_MED 2417 0.71 0.86 0.66 172 RCVD_IN_SORBS_DUL 2399 0.72 0.91 0.65 173 XM_Body_Dirty_Words_01 2327 0.84 1.44 0.63 174 RELAYCOUNTRY_DE 2324 0.87 1.55 0.63 175 TVD_SPACE_RATIO_MINFP 2297 0.49 0.09 0.62 176 XMBdyGiftCard01 2288 0.75 1.13 0.62 177 RCVD_IN_BL_SPAMCOP_NET 2268 2.73 8.80 0.62 178 XM_H_PHPMailer 2222 0.62 0.65 0.60 179 XMSubMetaI_00 2199 0.64 0.78 0.60 180 T_OBFU_PDF_ATTACH 2034 0.48 0.27 0.55 181 TR_MSPIKEBAYES00 1935 0.40 0.02 0.53 182 TM2_M_BODY_EMPTY 1918 0.44 0.22 0.52 183 XMMoneyMeta_00 1851 0.61 0.92 0.50 184 SHORT_HELO_AND_INLINE_IMAGE 1837 0.47 0.37 0.50 185 MISSING_HEADERS 1814 0.64 1.07 0.49 186 FROM_GOV_SPOOF 1792 0.40 0.17 0.49 187 FORGED_GMAIL_RCVD 1760 0.62 1.01 0.48 188 XMHTMLBadTable_001 1757 0.53 0.67 0.48 189 HTML_IMAGE_ONLY_24 1753 0.43 0.31 0.48 190 HTML_IMAGE_ONLY_32 1748 0.46 0.42 0.47 191 HTML_IMAGE_ONLY_28 1693 0.49 0.57 0.46 192 USER_IN_WHITELIST 1665 0.34 0.00 0.45 193 USER_IN_WELCOMELIST 1665 0.34 0.00 0.45 194 XMOemUri 1636 0.40 0.26 0.44 195 XM_B_COPY_HTML 1606 0.48 0.60 0.44 196 FROM_GOV_DKIM_AU 1564 0.36 0.16 0.42 197 RDNS_DYNAMIC 1529 0.59 1.09 0.41 198 XMDateMe_00 1494 0.39 0.36 0.41 199 HTML_TAG_BALANCE_BODY 1476 0.55 0.98 0.40 200 NICE_REPLY_A 1470 0.30 0.04 0.40 ----------------------------------------------------------------------