Email: 526674 Autolearn: 0 AvgScore: 3.53 AvgScanTime: 1.43 sec Spam: 139505 Autolearn: 0 AvgScore: 14.18 AvgScanTime: 1.62 sec Ham: 387169 Autolearn: 0 AvgScore: -0.31 AvgScanTime: 1.36 sec Time Spent Running SA: 209.47 hours Time Spent Processing Spam: 62.94 hours Time Spent Processing Ham: 146.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130279 87.49 93.39 85.37 2 DKIM_SIGNED 106775 70.27 76.54 68.01 3 DCC_CHECK 104341 46.28 74.79 36.01 4 XM_DK_Pass 103150 68.54 73.94 66.60 5 XM_B_Unicode 102514 69.65 73.48 68.27 6 RELAYCOUNTRY_US 101224 74.77 72.56 75.57 7 DKIM_VALID 99139 66.20 71.06 64.45 8 XM_B_SpammyWords 89353 46.89 64.05 40.71 9 XMListUnsubscribeExists 89346 48.52 64.05 42.92 10 DKIM_VALID_AU 73125 48.91 52.42 47.65 11 BAYES_50 65487 53.93 46.94 56.45 12 XM_B_Unicode3 57421 40.33 41.16 40.04 13 XM_B_SpammyWords2 51899 21.98 37.20 16.49 14 XM_DK_Undo_02 51153 14.34 36.67 6.29 15 MIME_HTML_ONLY 48695 25.28 34.91 21.81 16 LOC_TINY_FONT_1 46360 23.80 33.23 20.40 17 HTML_FONT_LOW_CONTRAST 45062 25.88 32.30 23.57 18 TR_XM_DKIM_Undo 40144 10.96 28.78 4.54 19 DKIM_VALID_EF 38223 25.79 27.40 25.21 20 T_KAM_HTML_FONT_INVALID 37452 19.95 26.85 17.46 21 BAYES_99 36538 10.47 26.19 4.81 22 XMSubLong 35371 23.90 25.35 23.38 23 DCC_CHECK_NEGATIVE 35099 53.68 25.16 63.95 24 FVGT_m_MULTI_ODD 35098 22.21 25.16 21.15 25 T_TM2_M_HEADER_IN_MSG 33061 28.04 23.70 29.60 26 RELAYCOUNTRY_META 31401 10.88 22.51 6.68 27 XM_Body_Dirty_Words 28680 12.73 20.56 9.91 28 TR_DCC_Bayes_99 28208 6.98 20.22 2.21 29 BAYES_999 28086 8.23 20.13 3.94 30 UNTRUSTED_Relay 26374 8.32 18.91 4.50 31 XM_Multi_Part_URI 25420 14.88 18.22 13.68 32 BOTNET 25192 5.68 18.06 1.22 33 FSL_BULK_SIG 24621 10.00 17.65 7.24 34 RCVD_IN_MSPIKE_H2 21711 15.59 15.56 15.60 35 XM_UncommonTLD01 20840 6.40 14.94 3.32 36 RCVD_IN_MSPIKE_WL 20684 21.84 14.83 24.36 37 BOTNET_IPINHOSTNAME 18675 6.19 13.39 3.59 38 LOTS_OF_MONEY 18414 9.85 13.20 8.64 39 XM_B_SpammyWords3 17969 6.02 12.88 3.55 40 TR_XM_SpammyRelay 15833 4.11 11.35 1.51 41 XMSexyCombo_05 15703 4.94 11.26 2.67 42 XM_B_Unsub 15367 11.84 11.02 12.13 43 TR_XM_SpammyWords4 15317 5.48 10.98 3.50 44 XM_UB50 14682 5.70 10.52 3.96 45 UNPARSEABLE_RELAY 14677 8.66 10.52 7.99 46 TR_XM_UnparsRelay 14102 7.04 10.11 5.93 47 XM_Evil_Numbers_Gen 13910 7.87 9.97 7.11 48 HTML_MIME_NO_HTML_TAG 13820 4.54 9.91 2.61 49 TR_XM_SpammyWords2 13589 3.10 9.74 0.71 50 SpammyFromTLD_02 13064 2.76 9.36 0.38 51 T_REMOTE_IMAGE 11835 5.12 8.48 3.91 52 HTML_IMAGE_RATIO_02 11698 5.82 8.39 4.89 53 MPART_ALT_DIFF 11689 5.56 8.38 4.54 54 RCVD_IN_MSPIKE_H3 11018 9.71 7.90 10.36 55 XM_SendGrid 11006 7.42 7.89 7.25 56 KHOP_HELO_FCRDNS 10281 3.10 7.37 1.56 57 BAYES_80 10007 4.55 7.17 3.61 58 T_HTML_TAG_BALANCE_CENTER 9781 1.90 7.01 0.06 59 HTML_IMAGE_ONLY_08 9575 1.91 6.86 0.13 60 TR_XM_PhishingBody 9523 4.18 6.83 3.23 61 RCVD_IN_MSPIKE_H4 9397 11.45 6.74 13.15 62 LotsOfNums_01 9308 8.25 6.67 8.82 63 BAYES_60 8992 7.75 6.45 8.22 64 RCVD_IN_BL_SPAMCOP_NET 8954 2.55 6.42 1.16 65 XM_H_Long_From01 8806 5.20 6.31 4.80 66 TM2_M_URI_OPT_OUT 8321 5.87 5.96 5.84 67 XM_B_Phish_Phrases 8160 4.07 5.85 3.43 68 TooManyTo_001 7974 9.45 5.72 10.79 69 XMSubMetaSx_00 7891 3.68 5.66 2.97 70 MIXED_FONT_CASE 7699 1.46 5.52 0.00 71 MIXED_CENTER_CASE 7698 1.46 5.52 0.00 72 MIXED_HREF_CASE 7695 1.46 5.52 0.00 73 MIXED_IMG_CASE 7685 1.46 5.51 0.00 74 MIXED_AREA_CASE 7685 1.46 5.51 0.00 75 DKIM_INVALID 7636 4.06 5.47 3.55 76 MIME_HTML_MOSTLY 7514 2.92 5.39 2.03 77 MIXED_CTYPE_CASE 7438 1.41 5.33 0.00 78 XMNumbers 6969 3.46 5.00 2.91 79 XMStrtUSub 6745 6.34 4.83 6.89 80 HTML_IMAGE_RATIO_04 6685 4.87 4.79 4.89 81 BODY_URI_ONLY 6439 1.23 4.62 0.01 82 RELAYCOUNTRY_CA 6270 1.79 4.49 0.81 83 XM_B_SpammyTLD 6242 2.59 4.47 1.91 84 T_XMDrugObfuBody_00 6229 3.85 4.47 3.63 85 URI_GOOG_STO_SPAMMY 6098 1.16 4.37 0.00 86 TR_XM_DK_SendGrid 5958 4.31 4.27 4.33 87 HTML_FONT_SIZE_LARGE 5825 1.20 4.18 0.12 88 XM_B_Phish66 5698 2.54 4.08 1.98 89 BAYES_95 5666 2.64 4.06 2.13 90 MIME_HTML_ONLY_MULTI 5561 3.24 3.99 2.97 91 XM_B_Investor 5553 2.09 3.98 1.41 92 XM_SPF_SoftFail 5546 2.45 3.98 1.90 93 RELAYCOUNTRY_FR 5520 3.40 3.96 3.20 94 TR_XM_SPAMCOP 5230 1.22 3.75 0.31 95 HTML_IMAGE_RATIO_06 5101 4.22 3.66 4.42 96 ANY_BOUNCE_MESSAGE 5005 5.16 3.59 5.73 97 BOUNCE_MESSAGE 4988 5.16 3.58 5.73 98 SpammyFromTLD_01 4938 1.50 3.54 0.76 99 XM_OfRef6 4931 1.60 3.53 0.91 100 URI_NOVOWEL 4930 2.72 3.53 2.43 101 XM_DIRTYINTL 4841 1.12 3.47 0.27 102 T_XMDrugObfuBody_14 4609 2.18 3.30 1.77 103 T_XMDrugObfuBody_08 4598 1.91 3.30 1.41 104 TR_XM_SpammyWords5 4542 1.71 3.26 1.15 105 BAYES_40 4515 4.97 3.24 5.60 106 TR_XM_PHPDW 4496 1.15 3.22 0.40 107 MIME_QP_LONG_LINE 4486 4.93 3.22 5.55 108 RCVD_IN_RP_SAFE 4329 5.48 3.10 6.34 109 BOTNET_NORDNS 4265 0.82 3.06 0.01 110 TR_XM_PHPForged 4264 1.02 3.06 0.29 111 URIBL_DBL_SPAM 4161 0.79 2.98 0.00 112 ALL_TRUSTED 4088 14.64 2.93 18.85 113 XMDiploma_00 4063 4.57 2.91 5.17 114 HTML_FONT_SIZE_HUGE 4025 0.82 2.89 0.08 115 T_TooManySym_01 3998 4.45 2.87 5.03 116 XMBounce_01 3992 3.06 2.86 3.13 117 BAYES_20 3714 3.58 2.66 3.91 118 TR_XM_SB_Phish 3443 2.33 2.47 2.28 119 XMNoVowels 3405 1.98 2.44 1.81 120 XMSubPhish11 3369 2.29 2.41 2.25 121 HTML_IMAGE_RATIO_08 3360 2.58 2.41 2.64 122 XM_H_PHPMailer 3270 1.08 2.34 0.63 123 FROM_EXCESS_BASE64 3245 2.62 2.33 2.72 124 RCVD_IN_RP_CERTIFIED 3215 4.77 2.30 5.65 125 XM_B_SpammyWords4 3189 1.03 2.29 0.57 126 XM_B_COVIDMETA 3188 1.01 2.29 0.55 127 DKIM_ADSP_CUSTOM_MED 3160 1.30 2.27 0.95 128 RCVD_IN_IADB_LISTED 3144 4.41 2.25 5.18 129 GOOG_STO_IMG_HTML 3137 0.60 2.25 0.00 130 PDS_OTHER_BAD_TLD 3125 0.80 2.24 0.29 131 DIET_1 3074 0.74 2.20 0.22 132 XM_B_Unsub2 3061 1.68 2.19 1.49 133 RCVD_IN_PSBL 3014 0.73 2.16 0.21 134 TM2_M_VERY_LONG_WORD 2966 1.37 2.13 1.09 135 BAYES_00 2966 10.04 2.13 12.89 136 XM_CamelCaseFrm001 2917 1.66 2.09 1.50 137 NML_ADSP_CUSTOM_MED 2913 0.97 2.09 0.57 138 TR_XM_NoHeaderRelay 2837 0.67 2.03 0.18 139 MAILING_LIST_MULTI 2830 2.63 2.03 2.84 140 FORGED_GMAIL_RCVD 2828 0.94 2.03 0.55 141 XMStockSpam_06 2769 1.03 1.98 0.68 142 RCVD_IN_IADB_SPF 2752 3.87 1.97 4.55 143 HTML_IMAGE_ONLY_32 2712 0.89 1.94 0.51 144 XM_URI_RBL 2649 0.58 1.90 0.11 145 RCVD_IN_IADB_DK 2575 3.40 1.85 3.97 146 XM_DK_Undo_01 2562 1.68 1.84 1.62 147 RCVD_IN_IADB_SENDERID 2558 3.50 1.83 4.10 148 XM_UB60 2488 0.52 1.78 0.07 149 JH_SPAMMY_HEADERS 2469 0.47 1.77 0.00 150 URI_TRY_3LD 2462 1.03 1.76 0.77 151 XMSexyCombo_01 2458 0.73 1.76 0.35 152 URI_HEX 2455 1.31 1.76 1.15 153 XMHTML_After_End 2412 1.05 1.73 0.80 154 XM_UB99 2408 0.46 1.73 0.00 155 TR_XM_FormFill2 2361 0.66 1.69 0.29 156 XM_H_PHPOS 2349 0.65 1.68 0.28 157 XMBody_17 2326 0.72 1.67 0.38 158 TO_NO_BRKTS_HTML_ONLY 2242 0.71 1.61 0.39 159 TR_XM_COVIDMETA1 2241 0.70 1.61 0.38 160 SUBJ_ALL_CAPS 2211 1.47 1.58 1.43 161 RELAYCOUNTRY_GB 2194 1.00 1.57 0.79 162 HTML_FONT_FACE_BAD 2150 1.13 1.54 0.98 163 RELAYCOUNTRY_NL 2116 0.54 1.52 0.19 164 URIBL_BLACK 2116 0.41 1.52 0.02 165 TR_XM_COVIDMETA4 2084 0.64 1.49 0.34 166 T_FILL_THIS_FORM_SHORT 2078 1.03 1.49 0.87 167 XMGenDplmaNmb 2022 1.75 1.45 1.85 168 RCVD_IN_MSPIKE_BL 2016 0.46 1.45 0.11 169 XMBrknScrpt_02 1958 1.01 1.40 0.86 170 XMSlimDrugH 1956 0.56 1.40 0.26 171 USER_IN_DEF_DKIM_WL 1889 8.20 1.35 10.67 172 T_XMHurry_00 1869 0.62 1.34 0.36 173 TR_XM_INV_DKIM 1814 0.39 1.30 0.06 174 TR_Symld_Words 1807 1.51 1.30 1.59 175 TR_Mismatch_TLD_02 1802 0.40 1.29 0.08 176 XM_H_Undi_Recip 1787 0.45 1.28 0.15 177 RELAYCOUNTRY_AU 1766 0.54 1.27 0.27 178 RELAYCOUNTRY_DE 1742 0.67 1.25 0.47 179 XM_UB80 1710 0.34 1.23 0.03 180 RELAYCOUNTRY_IN 1705 0.41 1.22 0.12 181 XMMoneyMeta_00 1693 0.73 1.21 0.55 182 XMPhish30 1653 0.68 1.18 0.50 183 DATE_IN_PAST_03_06 1634 0.60 1.17 0.39 184 BAYES_05 1618 2.07 1.16 2.40 185 XM_S_SpammyWords 1594 0.51 1.14 0.29 186 TR_XM_Spammywords 1594 0.51 1.14 0.29 187 HTTPS_HTTP_MISMATCH 1576 0.82 1.13 0.71 188 XM_Body_Dirty_Words_01 1546 0.37 1.11 0.10 189 RCVD_IN_IADB_VOUCHED 1488 2.56 1.07 3.10 190 XMWghtMeta_00 1464 0.30 1.05 0.04 191 FROM_SUSPICIOUS_NTLD 1458 0.31 1.05 0.05 192 TR_XM_DK_Bayes 1433 6.02 1.03 7.82 193 XM_PDF 1411 4.01 1.01 5.10 194 T_Symld_Words_02 1381 0.57 0.99 0.43 195 TR_XM_DK_Bayes1 1375 5.83 0.99 7.58 196 EBAY_IMG_NOT_RCVD_EBAY 1361 0.26 0.98 0.00 197 XM_ProductURIs 1360 0.66 0.97 0.55 198 HOSTED_IMG_DIRECT_MX 1356 0.26 0.97 0.00 199 XM_B_SEO 1352 0.36 0.97 0.14 200 TR_XM_SpoofPhishAttach 1316 0.35 0.94 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 330507 87.49 93.39 85.37 2 RELAYCOUNTRY_US 292566 74.77 72.56 75.57 3 XM_B_Unicode 264336 69.65 73.48 68.27 4 DKIM_SIGNED 263299 70.27 76.54 68.01 5 XM_DK_Pass 257852 68.54 73.94 66.60 6 DKIM_VALID 249539 66.20 71.06 64.45 7 DCC_CHECK_NEGATIVE 247605 53.68 25.16 63.95 8 BAYES_50 218544 53.93 46.94 56.45 9 DKIM_VALID_AU 184481 48.91 52.42 47.65 10 XMListUnsubscribeExists 166176 48.52 64.05 42.92 11 XM_B_SpammyWords 157599 46.89 64.05 40.71 12 XM_B_Unicode3 155005 40.33 41.16 40.04 13 DCC_CHECK 139411 46.28 74.79 36.01 14 T_TM2_M_HEADER_IN_MSG 114620 28.04 23.70 29.60 15 DKIM_VALID_EF 97606 25.79 27.40 25.21 16 RCVD_IN_MSPIKE_WL 94332 21.84 14.83 24.36 17 HTML_FONT_LOW_CONTRAST 91250 25.88 32.30 23.57 18 XMSubLong 90527 23.90 25.35 23.38 19 MIME_HTML_ONLY 84456 25.28 34.91 21.81 20 FVGT_m_MULTI_ODD 81878 22.21 25.16 21.15 21 LOC_TINY_FONT_1 78998 23.80 33.23 20.40 22 ALL_TRUSTED 72994 14.64 2.93 18.85 23 T_KAM_HTML_FONT_INVALID 67609 19.95 26.85 17.46 24 XM_B_SpammyWords2 63852 21.98 37.20 16.49 25 RCVD_IN_MSPIKE_H2 60400 15.59 15.56 15.60 26 XM_Multi_Part_URI 52959 14.88 18.22 13.68 27 RCVD_IN_MSPIKE_H4 50932 11.45 6.74 13.15 28 BAYES_00 49900 10.04 2.13 12.89 29 XM_B_Unsub 46965 11.84 11.02 12.13 30 TooManyTo_001 41776 9.45 5.72 10.79 31 USER_IN_DEF_DKIM_WL 41296 8.20 1.35 10.67 32 RCVD_IN_MSPIKE_H3 40104 9.71 7.90 10.36 33 XM_Body_Dirty_Words 38350 12.73 20.56 9.91 34 LotsOfNums_01 34151 8.25 6.67 8.82 35 LOTS_OF_MONEY 33455 9.85 13.20 8.64 36 BAYES_60 31832 7.75 6.45 8.22 37 UNPARSEABLE_RELAY 30922 8.66 10.52 7.99 38 TR_XM_DK_Bayes 30278 6.02 1.03 7.82 39 TR_XM_DK_Bayes1 29330 5.83 0.99 7.58 40 XM_SendGrid 28088 7.42 7.89 7.25 41 FSL_BULK_SIG 28026 10.00 17.65 7.24 42 XM_Evil_Numbers_Gen 27535 7.87 9.97 7.11 43 XM_DKIMWhitelistDomains 27086 5.15 0.01 7.00 44 XMStrtUSub 26666 6.34 4.83 6.89 45 RELAYCOUNTRY_META 25879 10.88 22.51 6.68 46 RCVD_IN_RP_SAFE 24530 5.48 3.10 6.34 47 TR_XM_DK_Bayes2 24526 4.88 0.84 6.33 48 XM_DK_Undo_02 24360 14.34 36.67 6.29 49 TR_XM_UnparsRelay 22969 7.04 10.11 5.93 50 TM2_M_URI_OPT_OUT 22617 5.87 5.96 5.84 51 ANY_BOUNCE_MESSAGE 22183 5.16 3.59 5.73 52 BOUNCE_MESSAGE 22181 5.16 3.58 5.73 53 RCVD_IN_RP_CERTIFIED 21892 4.77 2.30 5.65 54 BAYES_40 21666 4.97 3.24 5.60 55 MIME_QP_LONG_LINE 21496 4.93 3.22 5.55 56 RCVD_IN_IADB_LISTED 20070 4.41 2.25 5.18 57 XMDiploma_00 20007 4.57 2.91 5.17 58 XM_PDF 19727 4.01 1.01 5.10 59 T_TooManySym_01 19461 4.45 2.87 5.03 60 HTML_IMAGE_RATIO_04 18950 4.87 4.79 4.89 61 HTML_IMAGE_RATIO_02 18930 5.82 8.39 4.89 62 BAYES_99 18610 10.47 26.19 4.81 63 XM_H_Long_From01 18574 5.20 6.31 4.80 64 RCVD_IN_IADB_SPF 17627 3.87 1.97 4.55 65 TR_XM_DKIM_Undo 17595 10.96 28.78 4.54 66 MPART_ALT_DIFF 17586 5.56 8.38 4.54 67 UNTRUSTED_Relay 17438 8.32 18.91 4.50 68 HTML_IMAGE_RATIO_06 17100 4.22 3.66 4.42 69 TR_XM_DK_SendGrid 16765 4.31 4.27 4.33 70 RCVD_IN_IADB_SENDERID 15874 3.50 1.83 4.10 71 RCVD_IN_IADB_DK 15353 3.40 1.85 3.97 72 XM_UB50 15317 5.70 10.52 3.96 73 BAYES_999 15240 8.23 20.13 3.94 74 T_REMOTE_IMAGE 15124 5.12 8.48 3.91 75 BAYES_20 15119 3.58 2.66 3.91 76 XM_H_Trusted_IP 14407 2.74 0.00 3.72 77 T_XMDrugObfuBody_00 14051 3.85 4.47 3.63 78 BAYES_80 13973 4.55 7.17 3.61 79 BOTNET_IPINHOSTNAME 13913 6.19 13.39 3.59 80 DKIM_INVALID 13760 4.06 5.47 3.55 81 XM_B_SpammyWords3 13743 6.02 12.88 3.55 82 TR_XM_SpammyWords4 13565 5.48 10.98 3.50 83 XM_B_Phish_Phrases 13273 4.07 5.85 3.43 84 XM_UncommonTLD01 12864 6.40 14.94 3.32 85 TR_XM_PhishingBody 12496 4.18 6.83 3.23 86 RELAYCOUNTRY_FR 12375 3.40 3.96 3.20 87 XMBounce_01 12126 3.06 2.86 3.13 88 RCVD_IN_IADB_VOUCHED 12010 2.56 1.07 3.10 89 XMSubMetaSx_00 11501 3.68 5.66 2.97 90 MIME_HTML_ONLY_MULTI 11482 3.24 3.99 2.97 91 XMNumbers 11278 3.46 5.00 2.91 92 MAILING_LIST_MULTI 11006 2.63 2.03 2.84 93 FROM_EXCESS_BASE64 10543 2.62 2.33 2.72 94 XMSexyCombo_05 10340 4.94 11.26 2.67 95 HTML_IMAGE_RATIO_08 10212 2.58 2.41 2.64 96 HTML_MIME_NO_HTML_TAG 10096 4.54 9.91 2.61 97 T_TooManySym_02 9443 1.99 0.76 2.44 98 URI_NOVOWEL 9401 2.72 3.53 2.43 99 BAYES_05 9281 2.07 1.16 2.40 100 TooManyTo_002 9001 1.93 0.84 2.32 101 TR_XM_SB_Phish 8828 2.33 2.47 2.28 102 XMSubPhish11 8705 2.29 2.41 2.25 103 TR_DCC_Bayes_99 8552 6.98 20.22 2.21 104 BAYES_95 8231 2.64 4.06 2.13 105 HELO_NODOT 7863 1.66 0.62 2.03 106 HELO_NO_DOMAIN 7862 1.66 0.62 2.03 107 MIME_HTML_MOSTLY 7849 2.92 5.39 2.03 108 XM_B_Phish66 7684 2.54 4.08 1.98 109 RCVD_IN_IADB_OPTIN 7541 1.64 0.77 1.95 110 IN_HORDE_ADDRESS_BOOK 7435 1.44 0.11 1.92 111 XM_B_SpammyTLD 7377 2.59 4.47 1.91 112 XM_SPF_SoftFail 7355 2.45 3.98 1.90 113 XMGenDplmaNmb 7178 1.75 1.45 1.85 114 XMNoVowels 7000 1.98 2.44 1.81 115 T_XMDrugObfuBody_14 6862 2.18 3.30 1.77 116 INVALID_MSGID 6762 1.32 0.14 1.75 117 XM_DK_Undo_01 6287 1.68 1.84 1.62 118 TR_Symld_Words 6158 1.51 1.30 1.59 119 MSGID_NOFQDN1 6123 1.17 0.03 1.58 120 TO_MALFORMED 6050 1.18 0.10 1.56 121 KHOP_HELO_FCRDNS 6043 3.10 7.37 1.56 122 TooManyTo_003 5867 1.28 0.64 1.52 123 TR_XM_SpammyRelay 5830 4.11 11.35 1.51 124 XM_CamelCaseFrm001 5818 1.66 2.09 1.50 125 XM_B_Unsub2 5762 1.68 2.19 1.49 126 SUBJ_ALL_CAPS 5528 1.47 1.58 1.43 127 XM_B_Investor 5461 2.09 3.98 1.41 128 T_XMDrugObfuBody_08 5447 1.91 3.30 1.41 129 XMSubNoVowel 5290 1.22 0.80 1.37 130 XMCapTrack 5078 1.08 0.44 1.31 131 TVD_RCVD_IP 5058 1.05 0.32 1.31 132 XM_GoogleGroups 5020 1.19 0.91 1.30 133 XMGappySubj_01 4942 0.97 0.13 1.28 134 BOTNET 4734 5.68 18.06 1.22 135 XM_H_Long_From02 4620 1.11 0.88 1.19 136 RCVD_IN_BL_SPAMCOP_NET 4499 2.55 6.42 1.16 137 TR_XM_SpammyWords5 4471 1.71 3.26 1.15 138 URI_HEX 4452 1.31 1.76 1.15 139 XMBSHREFv2 4407 0.94 0.41 1.14 140 TM2_M_VERY_LONG_WORD 4231 1.37 2.13 1.09 141 TooManyTo_004 4040 0.91 0.53 1.04 142 HTML_FONT_FACE_BAD 3780 1.13 1.54 0.98 143 DKIM_ADSP_CUSTOM_MED 3691 1.30 2.27 0.95 144 TR_MetaPhish_Combo_01 3624 0.93 0.90 0.94 145 XM_OfRef6 3512 1.60 3.53 0.91 146 IN_ZIMBRA_NJ_WHITELIST 3375 0.64 0.01 0.87 147 T_FILL_THIS_FORM_SHORT 3356 1.03 1.49 0.87 148 HELO_MISC_IP 3340 0.64 0.04 0.86 149 XMBrknScrpt_02 3338 1.01 1.40 0.86 150 RCVD_IN_MSPIKE_H5 3296 0.68 0.19 0.85 151 TooManyTo_005 3206 0.72 0.43 0.83 152 RELAYCOUNTRY_CA 3132 1.79 4.49 0.81 153 XMHTML_After_End 3099 1.05 1.73 0.80 154 RELAYCOUNTRY_GB 3072 1.00 1.57 0.79 155 URI_TRY_3LD 2978 1.03 1.76 0.77 156 SpammyFromTLD_01 2954 1.50 3.54 0.76 157 XMBody_95 2884 0.59 0.17 0.74 158 T_TooManySym_03 2817 0.60 0.24 0.73 159 HTML_IMAGE_ONLY_20 2807 0.65 0.44 0.73 160 TR_XM_SpammyWords2 2760 3.10 9.74 0.71 161 HTTPS_HTTP_MISMATCH 2754 0.82 1.13 0.71 162 MPART_ALT_DIFF_COUNT 2736 0.72 0.76 0.71 163 XMStockSpam_06 2630 1.03 1.98 0.68 164 RCVD_IN_SORBS_DUL 2476 0.53 0.22 0.64 165 XM_H_PHPMailer 2437 1.08 2.34 0.63 166 XM_ShortIntro_01 2364 0.60 0.58 0.61 167 MISSING_HEADERS 2247 0.60 0.65 0.58 168 SHORT_HELO_AND_INLINE_IMAGE 2234 0.45 0.08 0.58 169 FROM_GOV_DKIM_AU 2232 0.45 0.09 0.58 170 XM_B_SpammyWords4 2214 1.03 2.29 0.57 171 XMLngstWrd_00 2191 0.52 0.40 0.57 172 NML_ADSP_CUSTOM_MED 2190 0.97 2.09 0.57 173 XMBdyGiftCard01 2182 0.61 0.73 0.56 174 XM_B_COVIDMETA 2148 1.01 2.29 0.55 175 XMMoneyMeta_00 2143 0.73 1.21 0.55 176 XM_ProductURIs 2141 0.66 0.97 0.55 177 T_OBFU_PDF_ATTACH 2124 0.44 0.14 0.55 178 FORGED_GMAIL_RCVD 2114 0.94 2.03 0.55 179 TVD_SPACE_RATIO 1997 0.40 0.08 0.52 180 SHORTENED_URL_HREF 1974 0.40 0.08 0.51 181 HTML_IMAGE_ONLY_32 1972 0.89 1.94 0.51 182 XMLngstWrd_01 1925 0.46 0.37 0.50 183 XMPhish30 1924 0.68 1.18 0.50 184 TR_MSPIKEBAYES00 1903 0.37 0.02 0.49 185 XM_B_COPY_HTML 1875 0.52 0.63 0.48 186 HTML_TAG_BALANCE_BODY 1810 0.55 0.77 0.47 187 RELAYCOUNTRY_DE 1808 0.67 1.25 0.47 188 TM2_M_BODY_EMPTY 1774 0.37 0.12 0.46 189 FROM_GOV_SPOOF 1678 0.38 0.23 0.43 190 T_Symld_Words_02 1646 0.57 0.99 0.43 191 HTML_IMAGE_ONLY_28 1640 0.43 0.47 0.42 192 XMSubMetaI_00 1611 0.55 0.91 0.42 193 XMLngstWrd_02 1609 0.37 0.26 0.42 194 XMDateMe_00 1567 0.40 0.39 0.40 195 RDNS_DYNAMIC 1556 0.49 0.75 0.40 196 XMPhish14 1544 0.53 0.88 0.40 197 TR_XM_PHPDW 1541 1.15 3.22 0.40 198 XM_B_REG_HTML 1533 0.41 0.46 0.40 199 XMSubMetaSxObfu_03 1531 0.45 0.58 0.40 200 DATE_IN_PAST_03_06 1524 0.60 1.17 0.39 ----------------------------------------------------------------------