Email: 464729 Autolearn: 0 AvgScore: 3.14 AvgScanTime: 1.40 sec Spam: 124759 Autolearn: 0 AvgScore: 14.19 AvgScanTime: 1.57 sec Ham: 339970 Autolearn: 0 AvgScore: -0.92 AvgScanTime: 1.33 sec Time Spent Running SA: 180.25 hours Time Spent Processing Spam: 54.38 hours Time Spent Processing Ham: 125.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 119796 89.78 96.02 87.48 2 DKIM_SIGNED 100502 74.28 80.56 71.98 3 DCC_CHECK 97436 49.63 78.10 39.19 4 XM_DK_Pass 96147 72.16 77.07 70.35 5 RELAYCOUNTRY_US 94586 79.99 75.81 81.52 6 DKIM_VALID 93061 69.96 74.59 68.27 7 XM_B_Unicode 92940 71.13 74.50 69.90 8 XM_B_SpammyWords 85232 50.06 68.32 43.37 9 XMListUnsubscribeExists 81164 51.14 65.06 46.03 10 DKIM_VALID_AU 68755 52.15 55.11 51.07 11 BAYES_50 54554 51.35 43.73 54.15 12 XM_B_Unicode3 53895 41.90 43.20 41.43 13 XM_DK_Undo_02 49360 15.79 39.56 7.07 14 XM_B_SpammyWords2 46612 22.71 37.36 17.33 15 MIME_HTML_ONLY 45903 25.62 36.79 21.52 16 LOC_TINY_FONT_1 42322 26.08 33.92 23.20 17 HTML_FONT_LOW_CONTRAST 41347 28.54 33.14 26.85 18 TR_XM_DKIM_Undo 40645 12.56 32.58 5.22 19 DKIM_VALID_EF 36444 27.15 29.21 26.39 20 T_KAM_HTML_FONT_INVALID 35822 20.49 28.71 17.48 21 BAYES_99 35372 12.10 28.35 6.14 22 FVGT_m_MULTI_ODD 33240 24.25 26.64 23.37 23 RCVD_IN_MSPIKE_H2 32105 21.98 25.73 20.60 24 XMSubLong 29939 22.62 24.00 22.12 25 T_TM2_M_HEADER_IN_MSG 28677 28.52 22.99 30.54 26 TR_DCC_Bayes_99 27353 7.88 21.92 2.72 27 DCC_CHECK_NEGATIVE 27274 50.33 21.86 60.77 28 XM_Body_Dirty_Words 27180 13.75 21.79 10.81 29 BAYES_999 27151 9.57 21.76 5.10 30 RCVD_IN_MSPIKE_WL 25565 27.71 20.49 30.37 31 RELAYCOUNTRY_META 23435 7.65 18.78 3.56 32 FSL_BULK_SIG 22675 10.88 18.18 8.20 33 BOTNET 21400 5.65 17.15 1.43 34 UNTRUSTED_Relay 20955 5.45 16.80 1.29 35 XM_Multi_Part_URI 20122 12.52 16.13 11.20 36 XM_UncommonTLD01 19629 6.83 15.73 3.57 37 BOTNET_IPINHOSTNAME 18301 7.05 14.67 4.25 38 LOTS_OF_MONEY 16788 9.49 13.46 8.03 39 XM_B_Unsub 15667 11.42 12.56 11.00 40 UNPARSEABLE_RELAY 15196 9.35 12.18 8.32 41 TR_XM_SpammyRelay 14907 4.28 11.95 1.46 42 XM_B_SpammyWords3 14731 5.71 11.81 3.48 43 TR_XM_UnparsRelay 14709 7.74 11.79 6.26 44 XMSexyCombo_05 14233 5.39 11.41 3.18 45 TR_XM_SpammyWords4 14185 6.48 11.37 4.69 46 RCVD_IN_MSPIKE_H3 13750 13.39 11.02 14.26 47 SpammyFromTLD_02 13502 3.32 10.82 0.56 48 TR_XM_SpammyWords2 13394 3.45 10.74 0.78 49 HTML_IMAGE_RATIO_02 11943 7.05 9.57 6.13 50 HTML_MIME_NO_HTML_TAG 11938 4.35 9.57 2.44 51 XM_SendGrid 11832 7.94 9.48 7.37 52 XM_Evil_Numbers_Gen 11619 8.56 9.31 8.29 53 T_REMOTE_IMAGE 11396 5.35 9.13 3.97 54 RCVD_IN_MSPIKE_H4 11158 12.21 8.94 13.41 55 HTML_IMAGE_ONLY_08 10891 2.43 8.73 0.11 56 MPART_ALT_DIFF 10111 6.66 8.10 6.13 57 XM_UB50 9592 2.69 7.69 0.86 58 T_HTML_TAG_BALANCE_CENTER 9559 2.12 7.66 0.09 59 BAYES_60 9534 8.43 7.64 8.71 60 BAYES_80 9460 4.84 7.58 3.84 61 KHOP_HELO_FCRDNS 9434 3.30 7.56 1.74 62 LotsOfNums_01 9299 8.72 7.45 9.18 63 XMSubMetaSx_00 8583 4.32 6.88 3.38 64 XM_B_Phish_Phrases 8136 4.18 6.52 3.32 65 TooManyTo_001 7979 7.84 6.40 8.37 66 XMNumbers 7829 3.95 6.28 3.09 67 MIXED_CENTER_CASE 7801 1.68 6.25 0.00 68 MIXED_HREF_CASE 7800 1.68 6.25 0.00 69 MIXED_IMG_CASE 7794 1.68 6.25 0.00 70 MIXED_AREA_CASE 7794 1.68 6.25 0.00 71 MIXED_CTYPE_CASE 7789 1.68 6.24 0.00 72 TR_XM_PhishingBody 7706 4.08 6.18 3.31 73 MIXED_FONT_CASE 7619 1.64 6.11 0.00 74 DKIM_INVALID 7441 4.32 5.96 3.71 75 RCVD_IN_BL_SPAMCOP_NET 7151 2.29 5.73 1.03 76 BODY_URI_ONLY 7105 1.54 5.69 0.02 77 MIME_HTML_MOSTLY 6817 3.31 5.46 2.52 78 TR_XM_DK_SendGrid 6736 4.74 5.40 4.50 79 XM_H_Long_From01 6415 5.30 5.14 5.35 80 HTML_IMAGE_RATIO_04 6010 6.14 4.82 6.63 81 XM_B_SpammyTLD 5960 2.78 4.78 2.05 82 HTML_FONT_SIZE_LARGE 5665 1.28 4.54 0.08 83 RELAYCOUNTRY_CA 5625 1.80 4.51 0.80 84 XM_B_Investor 5420 2.16 4.34 1.36 85 URI_GOOG_STO_SPAMMY 5176 1.11 4.15 0.00 86 MIME_QP_LONG_LINE 4669 5.09 3.74 5.59 87 BAYES_95 4653 2.88 3.73 2.57 88 XM_SPF_SoftFail 4609 2.35 3.69 1.86 89 TR_XM_SPAMCOP 4558 1.24 3.65 0.36 90 RCVD_IN_RP_SAFE 4429 6.08 3.55 7.00 91 TR_XM_SpammyWords5 4428 1.97 3.55 1.39 92 XM_OfRef6 4420 1.71 3.54 1.04 93 T_XMDrugObfuBody_08 4366 2.02 3.50 1.48 94 MIME_HTML_ONLY_MULTI 4365 4.08 3.50 4.30 95 XM_B_Phish66 4350 2.18 3.49 1.70 96 XMStrtUSub 4208 4.11 3.37 4.39 97 GOOG_STO_IMG_HTML 4126 0.89 3.31 0.00 98 TM2_M_URI_OPT_OUT 4124 3.45 3.31 3.50 99 T_XMDrugObfuBody_14 4080 2.94 3.27 2.82 100 URI_NOVOWEL 4028 3.01 3.23 2.93 101 HTML_FONT_SIZE_HUGE 4027 0.90 3.23 0.05 102 HTML_IMAGE_RATIO_06 4016 3.74 3.22 3.94 103 SpammyFromTLD_01 3972 1.40 3.18 0.75 104 BOTNET_NORDNS 3890 0.85 3.12 0.01 105 XMDiploma_00 3873 2.07 3.10 1.69 106 URIBL_DBL_SPAM 3678 0.79 2.95 0.00 107 XM_B_Unsub2 3633 1.66 2.91 1.21 108 BAYES_40 3626 4.66 2.91 5.30 109 BAYES_00 3493 10.14 2.80 12.84 110 XM_B_COVIDMETA 3482 1.30 2.79 0.76 111 T_TooManySym_01 3291 4.49 2.64 5.17 112 RCVD_IN_RP_CERTIFIED 3271 5.15 2.62 6.08 113 RCVD_IN_IADB_LISTED 3167 4.81 2.54 5.64 114 TM2_M_VERY_LONG_WORD 3117 1.70 2.50 1.40 115 TR_XM_SB_Phish 3109 2.25 2.49 2.16 116 XM_DIRTYINTL 3068 0.87 2.46 0.28 117 XM_UB60 3008 0.70 2.41 0.07 118 XMSubPhish11 2993 2.20 2.40 2.13 119 T_XMDrugObfuBody_00 2883 1.14 2.31 0.71 120 HTML_IMAGE_RATIO_08 2822 2.43 2.26 2.49 121 RCVD_IN_IADB_SPF 2797 4.19 2.24 4.91 122 RELAYCOUNTRY_IN 2785 0.66 2.23 0.09 123 XM_B_SpammyWords4 2778 0.87 2.23 0.37 124 TR_XM_PHPDW 2774 0.82 2.22 0.30 125 PDS_OTHER_BAD_TLD 2771 0.78 2.22 0.25 126 BAYES_20 2723 3.50 2.18 3.98 127 XM_CamelCaseFrm001 2665 1.83 2.14 1.72 128 ALL_TRUSTED 2649 12.31 2.12 16.05 129 XMNoVowels 2642 1.92 2.12 1.84 130 RCVD_IN_IADB_DK 2636 3.68 2.11 4.26 131 DIET_1 2632 0.97 2.11 0.56 132 RCVD_IN_IADB_SENDERID 2611 3.79 2.09 4.41 133 XMSexyCombo_01 2588 0.94 2.07 0.52 134 TR_XM_PHPForged 2549 0.74 2.04 0.26 135 TR_Symld_Words 2540 1.95 2.04 1.91 136 FROM_EXCESS_BASE64 2540 2.40 2.04 2.53 137 XM_DK_Undo_01 2526 1.82 2.02 1.75 138 TR_XM_FormFill2 2505 0.73 2.01 0.26 139 XM_H_PHPOS 2487 0.72 1.99 0.25 140 SUBJ_ALL_CAPS 2467 1.95 1.98 1.94 141 ALIBABA_IMG_NOT_RCVD_ALI 2463 0.53 1.97 0.00 142 HOSTED_IMG_DIRECT_MX 2443 0.53 1.96 0.00 143 JH_SPAMMY_HEADERS 2394 0.52 1.92 0.00 144 XMBody_17 2387 0.81 1.91 0.41 145 XMStockSpam_06 2311 1.40 1.85 1.23 146 MAILING_LIST_MULTI 2277 2.38 1.83 2.58 147 XMBrknScrpt_02 2252 1.15 1.81 0.91 148 RCVD_IN_PSBL 2217 0.59 1.78 0.16 149 XM_Body_Dirty_Words_01 2186 1.00 1.75 0.72 150 URI_HEX 2153 1.61 1.73 1.57 151 DKIM_ADSP_NXDOMAIN 2148 0.71 1.72 0.33 152 T_FILL_THIS_FORM_SHORT 2122 1.05 1.70 0.81 153 XM_UB80 2077 0.46 1.66 0.02 154 XM_URI_RBL 2023 0.52 1.62 0.12 155 XM_UB99 1961 0.42 1.57 0.00 156 URI_TRY_3LD 1944 1.27 1.56 1.16 157 XMGenDplmaNmb 1931 1.10 1.55 0.93 158 URIBL_BLACK 1926 0.44 1.54 0.04 159 TR_XM_NoHeaderRelay 1870 0.60 1.50 0.26 160 USER_IN_DEF_DKIM_WL 1847 8.69 1.48 11.33 161 TR_LOTS_OF_MONEY3 1809 0.58 1.45 0.26 162 RELAYCOUNTRY_AZ 1753 0.38 1.41 0.00 163 RELAYCOUNTRY_NL 1727 0.50 1.38 0.18 164 TR_XM_COVIDMETA1 1712 0.87 1.37 0.68 165 TR_XM_DK_Bayes 1707 5.84 1.37 7.48 166 TR_XM_DK_Bayes1 1667 5.66 1.34 7.25 167 TR_BOTNET_NEGATE 1621 0.51 1.30 0.23 168 RELAYCOUNTRY_AU 1602 0.54 1.28 0.27 169 HTML_SHORT_LINK_IMG_1 1601 0.37 1.28 0.03 170 FROM_SUSPICIOUS_NTLD 1592 0.39 1.28 0.06 171 FROM_SUSPICIOUS_NTLD_FP 1539 0.37 1.23 0.06 172 T_XMHurry_00 1492 0.59 1.20 0.37 173 HTML_FONT_FACE_BAD 1473 1.70 1.18 1.89 174 XMPhish30 1469 1.10 1.18 1.06 175 XMHTML_After_End 1456 1.01 1.17 0.95 176 XM_H_PHPMailer 1447 0.72 1.16 0.56 177 RCVD_IN_IADB_VOUCHED 1443 2.88 1.16 3.52 178 XMSubMetaI_00 1434 0.65 1.15 0.46 179 RELAYCOUNTRY_DE 1413 0.61 1.13 0.42 180 TR_XM_INV_DKIM 1405 0.54 1.13 0.33 181 BODY_EMPTY 1397 0.32 1.12 0.03 182 TM2_M_A_HREF_HREF 1387 0.72 1.11 0.58 183 XMBdyGiftCard01 1358 0.82 1.09 0.72 184 BAYES_05 1342 2.09 1.08 2.46 185 TR_XM_COVIDMETA4 1331 0.48 1.07 0.27 186 TR_Mismatch_TLD_02 1324 0.36 1.06 0.10 187 TR_XM_BayesRelay 1322 0.29 1.06 0.00 188 HTTPS_HTTP_MISMATCH 1295 0.80 1.04 0.71 189 TR_XM_DK_Bayes2 1264 4.77 1.01 6.15 190 TR_MetaPhish_Combo_01 1258 0.82 1.01 0.76 191 RELAYCOUNTRY_FR 1240 0.41 0.99 0.19 192 XM_PDF 1226 3.99 0.98 5.10 193 TR_Mismatch_TLD_01 1206 0.47 0.97 0.29 194 XM_H_Undi_Recip 1189 0.37 0.95 0.15 195 HTML_IMAGE_ONLY_20 1186 1.17 0.95 1.24 196 T_MONEY_PERCENT 1158 0.35 0.93 0.14 197 TR_LOTS_OF_MONEY2 1158 0.35 0.93 0.14 198 XMSlimDrugH 1146 0.48 0.92 0.32 199 XMMoneyMeta_00 1142 0.59 0.92 0.47 200 RELAYCOUNTRY_GB 1141 0.80 0.91 0.75 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297418 89.78 96.02 87.48 2 RELAYCOUNTRY_US 277146 79.99 75.81 81.52 3 DKIM_SIGNED 244700 74.28 80.56 71.98 4 XM_DK_Pass 239181 72.16 77.07 70.35 5 XM_B_Unicode 237641 71.13 74.50 69.90 6 DKIM_VALID 232083 69.96 74.59 68.27 7 DCC_CHECK_NEGATIVE 206606 50.33 21.86 60.77 8 BAYES_50 184099 51.35 43.73 54.15 9 DKIM_VALID_AU 173618 52.15 55.11 51.07 10 XMListUnsubscribeExists 156479 51.14 65.06 46.03 11 XM_B_SpammyWords 147432 50.06 68.32 43.37 12 XM_B_Unicode3 140847 41.90 43.20 41.43 13 DCC_CHECK 133225 49.63 78.10 39.19 14 T_TM2_M_HEADER_IN_MSG 103841 28.52 22.99 30.54 15 RCVD_IN_MSPIKE_WL 103234 27.71 20.49 30.37 16 HTML_FONT_LOW_CONTRAST 91283 28.54 33.14 26.85 17 DKIM_VALID_EF 89724 27.15 29.21 26.39 18 FVGT_m_MULTI_ODD 79458 24.25 26.64 23.37 19 LOC_TINY_FONT_1 78872 26.08 33.92 23.20 20 XMSubLong 75187 22.62 24.00 22.12 21 MIME_HTML_ONLY 73161 25.62 36.79 21.52 22 RCVD_IN_MSPIKE_H2 70031 21.98 25.73 20.60 23 T_KAM_HTML_FONT_INVALID 59419 20.49 28.71 17.48 24 XM_B_SpammyWords2 58931 22.71 37.36 17.33 25 ALL_TRUSTED 54568 12.31 2.12 16.05 26 RCVD_IN_MSPIKE_H3 48488 13.39 11.02 14.26 27 RCVD_IN_MSPIKE_H4 45576 12.21 8.94 13.41 28 BAYES_00 43642 10.14 2.80 12.84 29 USER_IN_DEF_DKIM_WL 38519 8.69 1.48 11.33 30 XM_Multi_Part_URI 38076 12.52 16.13 11.20 31 XM_B_Unsub 37392 11.42 12.56 11.00 32 XM_Body_Dirty_Words 36735 13.75 21.79 10.81 33 LotsOfNums_01 31203 8.72 7.45 9.18 34 BAYES_60 29627 8.43 7.64 8.71 35 TooManyTo_001 28439 7.84 6.40 8.37 36 UNPARSEABLE_RELAY 28269 9.35 12.18 8.32 37 XM_Evil_Numbers_Gen 28178 8.56 9.31 8.29 38 FSL_BULK_SIG 27866 10.88 18.18 8.20 39 XM_DKIMWhitelistDomains 27624 5.95 0.03 8.13 40 LOTS_OF_MONEY 27295 9.49 13.46 8.03 41 TR_XM_DK_Bayes 25423 5.84 1.37 7.48 42 XM_SendGrid 25067 7.94 9.48 7.37 43 TR_XM_DK_Bayes1 24648 5.66 1.34 7.25 44 XM_DK_Undo_02 24031 15.79 39.56 7.07 45 RCVD_IN_RP_SAFE 23811 6.08 3.55 7.00 46 HTML_IMAGE_RATIO_04 22542 6.14 4.82 6.63 47 TR_XM_UnparsRelay 21280 7.74 11.79 6.26 48 TR_XM_DK_Bayes2 20915 4.77 1.01 6.15 49 BAYES_99 20883 12.10 28.35 6.14 50 HTML_IMAGE_RATIO_02 20840 7.05 9.57 6.13 51 MPART_ALT_DIFF 20835 6.66 8.10 6.13 52 RCVD_IN_RP_CERTIFIED 20670 5.15 2.62 6.08 53 XM_H_Trusted_IP 19650 4.23 0.00 5.78 54 RCVD_IN_IADB_LISTED 19165 4.81 2.54 5.64 55 MIME_QP_LONG_LINE 19007 5.09 3.74 5.59 56 XM_H_Long_From01 18197 5.30 5.14 5.35 57 BAYES_40 18017 4.66 2.91 5.30 58 TR_XM_DKIM_Undo 17734 12.56 32.58 5.22 59 T_TooManySym_01 17587 4.49 2.64 5.17 60 BAYES_999 17340 9.57 21.76 5.10 61 XM_PDF 17330 3.99 0.98 5.10 62 RCVD_IN_IADB_SPF 16695 4.19 2.24 4.91 63 TR_XM_SpammyWords4 15943 6.48 11.37 4.69 64 TR_XM_DK_SendGrid 15306 4.74 5.40 4.50 65 RCVD_IN_IADB_SENDERID 14985 3.79 2.09 4.41 66 XMStrtUSub 14910 4.11 3.37 4.39 67 MIME_HTML_ONLY_MULTI 14605 4.08 3.50 4.30 68 RCVD_IN_IADB_DK 14481 3.68 2.11 4.26 69 BOTNET_IPINHOSTNAME 14456 7.05 14.67 4.25 70 BAYES_20 13533 3.50 2.18 3.98 71 T_REMOTE_IMAGE 13489 5.35 9.13 3.97 72 HTML_IMAGE_RATIO_06 13379 3.74 3.22 3.94 73 BAYES_80 13051 4.84 7.58 3.84 74 DKIM_INVALID 12617 4.32 5.96 3.71 75 XM_UncommonTLD01 12129 6.83 15.73 3.57 76 RELAYCOUNTRY_META 12095 7.65 18.78 3.56 77 RCVD_IN_IADB_VOUCHED 11961 2.88 1.16 3.52 78 TM2_M_URI_OPT_OUT 11913 3.45 3.31 3.50 79 XM_B_SpammyWords3 11823 5.71 11.81 3.48 80 XMSubMetaSx_00 11483 4.32 6.88 3.38 81 XM_B_Phish_Phrases 11295 4.18 6.52 3.32 82 TR_XM_PhishingBody 11257 4.08 6.18 3.31 83 XMSexyCombo_05 10799 5.39 11.41 3.18 84 XMNumbers 10514 3.95 6.28 3.09 85 URI_NOVOWEL 9978 3.01 3.23 2.93 86 BOUNCE_MESSAGE 9793 2.34 0.85 2.88 87 ANY_BOUNCE_MESSAGE 9793 2.34 0.85 2.88 88 T_XMDrugObfuBody_14 9583 2.94 3.27 2.82 89 TR_DCC_Bayes_99 9250 7.88 21.92 2.72 90 RCVD_IN_MSPIKE_H5 9170 2.11 0.53 2.70 91 T_TooManySym_02 8942 2.09 0.63 2.63 92 MAILING_LIST_MULTI 8779 2.38 1.83 2.58 93 BAYES_95 8741 2.88 3.73 2.57 94 FROM_EXCESS_BASE64 8591 2.40 2.04 2.53 95 MIME_HTML_MOSTLY 8578 3.31 5.46 2.52 96 HTML_IMAGE_RATIO_08 8481 2.43 2.26 2.49 97 BAYES_05 8366 2.09 1.08 2.46 98 HTML_MIME_NO_HTML_TAG 8287 4.35 9.57 2.44 99 TooManyTo_002 7779 1.91 0.86 2.29 100 RCVD_IN_IADB_OPTIN 7464 1.81 0.77 2.20 101 TR_XM_SB_Phish 7353 2.25 2.49 2.16 102 IN_HORDE_ADDRESS_BOOK 7316 1.60 0.08 2.15 103 XMSubPhish11 7235 2.20 2.40 2.13 104 XM_B_SpammyTLD 6978 2.78 4.78 2.05 105 INVALID_MSGID 6845 1.51 0.12 2.01 106 SUBJ_ALL_CAPS 6596 1.95 1.98 1.94 107 TR_Symld_Words 6502 1.95 2.04 1.91 108 HTML_FONT_FACE_BAD 6421 1.70 1.18 1.89 109 XM_SPF_SoftFail 6320 2.35 3.69 1.86 110 MSGID_NOFQDN1 6314 1.37 0.04 1.86 111 XMNoVowels 6265 1.92 2.12 1.84 112 TO_MALFORMED 6032 1.30 0.01 1.77 113 XM_DK_Undo_01 5953 1.82 2.02 1.75 114 KHOP_HELO_FCRDNS 5916 3.30 7.56 1.74 115 XM_CamelCaseFrm001 5840 1.83 2.14 1.72 116 XM_B_Phish66 5772 2.18 3.49 1.70 117 XMDiploma_00 5758 2.07 3.10 1.69 118 HELO_NODOT 5706 1.39 0.62 1.68 119 HELO_NO_DOMAIN 5704 1.39 0.61 1.68 120 XMSubNoVowel 5673 1.37 0.56 1.67 121 URI_HEX 5332 1.61 1.73 1.57 122 TVD_RCVD_IP 5263 1.18 0.19 1.55 123 TooManyTo_003 5200 1.29 0.64 1.53 124 T_XMDrugObfuBody_08 5044 2.02 3.50 1.48 125 TR_XM_SpammyRelay 4964 4.28 11.95 1.46 126 BOTNET 4874 5.65 17.15 1.43 127 XMGappySubj_01 4845 1.14 0.35 1.43 128 TM2_M_VERY_LONG_WORD 4775 1.70 2.50 1.40 129 TR_XM_SpammyWords5 4740 1.97 3.55 1.39 130 XM_B_Investor 4623 2.16 4.34 1.36 131 XM_GoogleGroups 4437 1.20 0.90 1.31 132 UNTRUSTED_Relay 4380 5.45 16.80 1.29 133 HTML_IMAGE_ONLY_20 4232 1.17 0.95 1.24 134 XMStockSpam_06 4198 1.40 1.85 1.23 135 XM_B_Unsub2 4100 1.66 2.91 1.21 136 XMCapTrack 4023 0.97 0.41 1.18 137 URI_TRY_3LD 3936 1.27 1.56 1.16 138 XMBSHREFv2 3751 0.91 0.38 1.10 139 XMPhish30 3620 1.10 1.18 1.06 140 XM_OfRef6 3549 1.71 3.54 1.04 141 TooManyTo_004 3519 0.90 0.52 1.04 142 HELO_MISC_IP 3504 0.76 0.03 1.03 143 RCVD_IN_BL_SPAMCOP_NET 3502 2.29 5.73 1.03 144 XM_H_Long_From02 3280 0.91 0.74 0.96 145 DKIM_ADSP_CUSTOM_MED 3278 0.92 0.81 0.96 146 XMHTML_After_End 3222 1.01 1.17 0.95 147 XMGenDplmaNmb 3160 1.10 1.55 0.93 148 IN_ZIMBRA_NJ_WHITELIST 3129 0.68 0.01 0.92 149 XMBrknScrpt_02 3079 1.15 1.81 0.91 150 XM_UB50 2924 2.69 7.69 0.86 151 TooManyTo_005 2861 0.74 0.45 0.84 152 T_FILL_THIS_FORM_SHORT 2767 1.05 1.70 0.81 153 RELAYCOUNTRY_CA 2731 1.80 4.51 0.80 154 TR_XM_SpammyWords2 2662 3.45 10.74 0.78 155 T_TooManySym_03 2658 0.63 0.20 0.78 156 XMBody_95 2647 0.61 0.14 0.78 157 XM_B_COVIDMETA 2578 1.30 2.79 0.76 158 TR_MetaPhish_Combo_01 2572 0.82 1.01 0.76 159 RELAYCOUNTRY_GB 2566 0.80 0.91 0.75 160 SpammyFromTLD_01 2534 1.40 3.18 0.75 161 XM_ProductURIs 2495 0.75 0.79 0.73 162 FROM_GOV_DKIM_AU 2459 0.65 0.44 0.72 163 XM_Body_Dirty_Words_01 2445 1.00 1.75 0.72 164 XMBdyGiftCard01 2440 0.82 1.09 0.72 165 MPART_ALT_DIFF_COUNT 2430 0.70 0.66 0.71 166 T_XMDrugObfuBody_00 2408 1.14 2.31 0.71 167 HTTPS_HTTP_MISMATCH 2405 0.80 1.04 0.71 168 XM_D_tchamptons_WL 2392 0.51 0.00 0.70 169 XMLngstWrd_00 2359 0.60 0.36 0.69 170 TR_XM_COVIDMETA1 2309 0.87 1.37 0.68 171 XMLngstWrd_01 2123 0.55 0.33 0.62 172 TVD_SPACE_RATIO_MINFP 2111 0.49 0.14 0.62 173 T_OBFU_PDF_ATTACH 2088 0.49 0.14 0.61 174 TM2_M_A_HREF_HREF 1982 0.72 1.11 0.58 175 TR_MSPIKEBAYES00 1959 0.43 0.05 0.58 176 SpammyFromTLD_02 1920 3.32 10.82 0.56 177 XM_H_PHPMailer 1896 0.72 1.16 0.56 178 FORGED_GMAIL_RCVD 1896 0.59 0.69 0.56 179 DIET_1 1890 0.97 2.11 0.56 180 NML_ADSP_CUSTOM_MED 1868 0.58 0.67 0.55 181 XM_ShortIntro_01 1849 0.51 0.42 0.54 182 XM_B_COPY_HTML 1844 0.59 0.72 0.54 183 RCVD_IN_SORBS_DUL 1799 0.45 0.22 0.53 184 XMSexyCombo_01 1783 0.94 2.07 0.52 185 FROM_GOV_SPOOF 1770 0.44 0.20 0.52 186 MISSING_HEADERS 1765 0.59 0.79 0.52 187 T_MANY_PILL_PRICE 1749 0.38 0.01 0.51 188 TVD_SPACE_RATIO 1702 0.40 0.14 0.50 189 SHORT_HELO_AND_INLINE_IMAGE 1616 0.37 0.08 0.48 190 XMMoneyMeta_00 1605 0.59 0.92 0.47 191 XMBody_78 1575 0.48 0.53 0.46 192 XMSubMetaI_00 1569 0.65 1.15 0.46 193 HTML_TAG_BALANCE_BODY 1569 0.49 0.58 0.46 194 XMSubMetaSxObfu_03 1564 0.48 0.52 0.46 195 RDNS_DYNAMIC 1532 0.51 0.67 0.45 196 HTML_IMAGE_ONLY_32 1519 0.38 0.20 0.45 197 XMHTMLBadTable_001 1510 0.53 0.75 0.44 198 T_Symld_Words_02 1476 0.54 0.82 0.43 199 XMDateMe_00 1469 0.49 0.64 0.43 200 XMLngstWrd_02 1466 0.37 0.20 0.43 ----------------------------------------------------------------------