Email: 510047 Autolearn: 0 AvgScore: 3.06 AvgScanTime: 1.41 sec Spam: 132453 Autolearn: 0 AvgScore: 14.97 AvgScanTime: 1.68 sec Ham: 377594 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.32 sec Time Spent Running SA: 200.47 hours Time Spent Processing Spam: 61.73 hours Time Spent Processing Ham: 138.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126761 89.91 95.70 87.88 2 DCC_CHECK 104797 49.51 79.12 39.12 3 DKIM_SIGNED 102636 73.07 77.49 71.52 4 XM_DK_Pass 98832 71.22 74.62 70.03 5 RELAYCOUNTRY_US 97264 80.03 73.43 82.35 6 XM_B_Unicode 96215 71.90 72.64 71.64 7 DKIM_VALID 95381 68.91 72.01 67.82 8 XM_B_SpammyWords 89633 50.47 67.67 44.44 9 XMListUnsubscribeExists 84131 50.74 63.52 46.25 10 DKIM_VALID_AU 69694 50.89 52.62 50.28 11 BAYES_50 59140 50.95 44.65 53.17 12 XM_B_Unicode3 52811 41.90 39.87 42.61 13 XM_DK_Undo_02 50355 15.13 38.02 7.10 14 XM_B_SpammyWords2 49056 22.97 37.04 18.03 15 MIME_HTML_ONLY 45630 24.03 34.45 20.38 16 LOC_TINY_FONT_1 43456 25.40 32.81 22.81 17 HTML_FONT_LOW_CONTRAST 41108 27.75 31.04 26.59 18 TR_XM_DKIM_Undo 40898 11.96 30.88 5.32 19 FVGT_m_MULTI_ODD 37681 23.89 28.45 22.28 20 DKIM_VALID_EF 37633 26.32 28.41 25.59 21 T_KAM_HTML_FONT_INVALID 37326 20.83 28.18 18.26 22 BAYES_99 35986 12.10 27.17 6.81 23 XMSubLong 34533 22.40 26.07 21.11 24 RELAYCOUNTRY_META 30370 8.76 22.93 3.80 25 RCVD_IN_MSPIKE_H2 29638 20.34 22.38 19.63 26 T_TM2_M_HEADER_IN_MSG 29257 29.17 22.09 31.66 27 FSL_BULK_SIG 28774 11.21 21.72 7.52 28 RCVD_IN_MSPIKE_WL 28376 27.71 21.42 29.91 29 BAYES_999 27750 9.72 20.95 5.78 30 DCC_CHECK_NEGATIVE 27605 50.44 20.84 60.83 31 TR_DCC_Bayes_99 27366 7.64 20.66 3.07 32 XM_Body_Dirty_Words 25713 13.00 19.41 10.76 33 UNTRUSTED_Relay 25631 6.02 19.35 1.35 34 XM_Multi_Part_URI 21050 12.26 15.89 10.99 35 XM_UncommonTLD01 20780 6.49 15.69 3.26 36 BOTNET_IPINHOSTNAME 20587 7.02 15.54 4.03 37 BOTNET 20537 5.12 15.51 1.47 38 XM_B_Unsub 19226 11.12 14.52 9.93 39 TR_XM_SpammyRelay 18744 4.81 14.15 1.53 40 LOTS_OF_MONEY 17785 10.18 13.43 9.04 41 UNPARSEABLE_RELAY 15820 9.20 11.94 8.23 42 TR_XM_SpammyWords4 15631 7.32 11.80 5.75 43 XM_B_SpammyWords3 15504 5.79 11.71 3.72 44 RCVD_IN_MSPIKE_H3 15413 13.62 11.64 14.32 45 XMSexyCombo_05 15266 5.28 11.53 3.09 46 TR_XM_UnparsRelay 15241 7.56 11.51 6.17 47 RCVD_IN_BL_SPAMCOP_NET 14008 3.32 10.58 0.78 48 HTML_IMAGE_RATIO_02 13619 7.07 10.28 5.94 49 TR_XM_SpammyWords2 13462 3.49 10.16 1.15 50 XM_UB50 13058 3.19 9.86 0.85 51 SpammyFromTLD_02 12547 2.79 9.47 0.44 52 HTML_MIME_NO_HTML_TAG 12032 3.88 9.08 2.06 53 XM_SendGrid 11991 7.83 9.05 7.40 54 RCVD_IN_MSPIKE_H4 11772 11.99 8.89 13.08 55 T_REMOTE_IMAGE 11768 5.22 8.88 3.94 56 XMSubMetaSx_00 11055 4.52 8.35 3.18 57 XM_Evil_Numbers_Gen 11032 8.18 8.33 8.13 58 MPART_ALT_DIFF 10560 5.79 7.97 5.02 59 BAYES_80 10471 5.05 7.91 4.05 60 BAYES_60 10419 8.31 7.87 8.46 61 TR_XM_PhishingBody 10172 4.42 7.68 3.27 62 KHOP_HELO_FCRDNS 10159 4.09 7.67 2.83 63 LotsOfNums_01 9682 8.74 7.31 9.25 64 HTML_IMAGE_ONLY_08 9672 1.98 7.30 0.11 65 T_HTML_TAG_BALANCE_CENTER 9653 1.95 7.29 0.08 66 GOOG_STO_IMG_HTML 9263 1.82 6.99 0.00 67 BODY_URI_ONLY 8850 1.74 6.68 0.01 68 MIXED_CENTER_CASE 7985 1.57 6.03 0.00 69 MIXED_HREF_CASE 7982 1.57 6.03 0.00 70 MIXED_IMG_CASE 7978 1.57 6.02 0.00 71 MIXED_AREA_CASE 7976 1.56 6.02 0.00 72 RCVD_IN_RP_RNBL 7799 1.59 5.89 0.08 73 XM_B_Phish_Phrases 7783 4.40 5.88 3.88 74 HTML_FONT_SIZE_LARGE 7781 1.60 5.87 0.10 75 TooManyTo_001 7583 7.85 5.73 8.59 76 XMNumbers 7521 3.64 5.68 2.93 77 MIXED_FONT_CASE 7469 1.46 5.64 0.00 78 TR_XM_SPAMCOP 7371 1.69 5.56 0.33 79 DKIM_INVALID 7255 4.16 5.48 3.70 80 HTML_IMAGE_RATIO_04 7090 5.75 5.35 5.88 81 TR_XM_DK_SendGrid 7083 4.58 5.35 4.32 82 XM_H_Long_From01 7083 5.20 5.35 5.15 83 MIXED_CTYPE_CASE 7074 1.39 5.34 0.01 84 MIME_HTML_MOSTLY 6910 2.98 5.22 2.20 85 XM_SPF_SoftFail 6793 4.47 5.13 4.23 86 TR_XM_PHPDW 6790 1.55 5.13 0.30 87 XM_B_Phish66 6666 2.59 5.03 1.74 88 TR_XM_PHPForged 6639 1.50 5.01 0.27 89 TR_XM_FormFill2 6594 1.49 4.98 0.27 90 XM_H_PHPOS 6590 1.49 4.98 0.26 91 RCVD_IN_VALIDITY_RPBL 6525 1.33 4.93 0.07 92 RELAYCOUNTRY_CA 6189 1.85 4.67 0.85 93 XM_B_Investor 5840 2.34 4.41 1.62 94 TR_XM_NoHeaderRelay 5615 1.26 4.24 0.21 95 BAYES_95 5318 2.84 4.02 2.43 96 XM_B_SpammyTLD 5284 2.64 3.99 2.16 97 RELAYCOUNTRY_FR 4833 1.14 3.65 0.26 98 XMStrtUSub 4788 4.03 3.61 4.18 99 MIME_QP_LONG_LINE 4623 5.10 3.49 5.67 100 MIME_HTML_ONLY_MULTI 4600 3.42 3.47 3.40 101 BOTNET_NORDNS 4560 0.91 3.44 0.02 102 TM2_M_URI_OPT_OUT 4522 2.97 3.41 2.82 103 XM_OfRef6 4432 1.58 3.35 0.97 104 HTML_IMAGE_RATIO_06 4412 4.04 3.33 4.29 105 TR_XM_SpammyWords5 4350 1.86 3.28 1.36 106 SpammyFromTLD_01 4332 1.36 3.27 0.70 107 T_XMDrugObfuBody_08 4259 1.90 3.22 1.45 108 T_TooManySym_01 4055 4.65 3.06 5.21 109 URI_NOVOWEL 4027 2.83 3.04 2.75 110 URIBL_DBL_SPAM 4013 0.80 3.03 0.01 111 HTML_IMAGE_ONLY_32 3671 1.07 2.77 0.48 112 BAYES_40 3583 4.44 2.71 5.05 113 XM_B_Unsub2 3580 1.88 2.70 1.59 114 XM_B_COVIDMETA 3409 1.32 2.57 0.88 115 RDNS_DYNAMIC 3400 0.97 2.57 0.41 116 XM_UB60 3352 0.71 2.53 0.07 117 LONG_JUNK_URI 3323 0.66 2.51 0.01 118 RCVD_IN_IADB_LISTED 3282 4.58 2.48 5.31 119 BAYES_00 3273 11.09 2.47 14.11 120 XMDiploma_00 3266 1.79 2.47 1.55 121 XMBrknScrpt_02 3205 1.45 2.42 1.10 122 XM_CamelCaseFrm001 3195 1.87 2.41 1.68 123 TM2_M_VERY_LONG_WORD 3056 1.41 2.31 1.09 124 XM_DIRTYINTL 3025 0.79 2.28 0.26 125 HTML_IMAGE_RATIO_08 3008 3.67 2.27 4.17 126 RCVD_IN_MSPIKE_BL 2993 0.64 2.26 0.08 127 TR_XM_SB_Phish 2983 2.32 2.25 2.35 128 TR_XM_MSPIKECOMBO 2967 0.63 2.24 0.07 129 RCVD_IN_MSPIKE_L3 2961 0.63 2.24 0.07 130 T_XMDrugObfuBody_14 2877 1.99 2.17 1.92 131 RCVD_IN_IADB_SPF 2864 3.99 2.16 4.63 132 XMSubPhish11 2862 2.27 2.16 2.31 133 TR_LOTS_OF_MONEY3 2805 0.78 2.12 0.31 134 TR_Mismatch_TLD_02 2742 0.59 2.07 0.07 135 XM_B_SpammyWords4 2740 0.93 2.07 0.54 136 RCVD_IN_PSBL 2732 0.72 2.06 0.25 137 TVD_RCVD_IP 2704 1.66 2.04 1.53 138 XMNoVowels 2697 1.54 2.04 1.37 139 MAILING_LIST_MULTI 2696 2.87 2.04 3.16 140 RCVD_IN_IADB_DK 2684 3.48 2.03 4.00 141 T_FILL_THIS_FORM_SHORT 2674 1.24 2.02 0.97 142 RCVD_IN_IADB_SENDERID 2666 3.58 2.01 4.13 143 T_XMHurry_00 2663 0.85 2.01 0.45 144 RELAYCOUNTRY_IN 2608 0.58 1.97 0.10 145 BAYES_20 2576 3.20 1.94 3.64 146 XM_UB80 2559 0.52 1.93 0.02 147 HTML_FONT_SIZE_HUGE 2520 0.54 1.90 0.07 148 XM_URI_RBL 2518 0.56 1.90 0.09 149 DATE_IN_PAST_03_06 2515 0.67 1.90 0.24 150 URI_HEX 2506 1.64 1.89 1.55 151 XM_Body_Dirty_Words_01 2427 1.15 1.83 0.91 152 XM_DK_Undo_01 2425 1.64 1.83 1.58 153 XMSexyCombo_01 2327 0.82 1.76 0.49 154 ALL_TRUSTED 2311 11.65 1.74 15.12 155 JH_SPAMMY_HEADERS 2304 0.45 1.74 0.00 156 XMBody_17 2300 0.78 1.74 0.44 157 SUBJ_ALL_CAPS 2257 1.76 1.70 1.77 158 RCVD_IN_RP_SAFE 2186 5.77 1.65 7.21 159 TR_XM_COVIDMETA4 2185 0.63 1.65 0.27 160 TR_XM_SpammyWords3 2154 0.45 1.63 0.04 161 URI_TRY_3LD 2113 1.05 1.60 0.85 162 FROM_EXCESS_BASE64 2085 2.52 1.57 2.85 163 URIBL_BLACK 2079 0.45 1.57 0.06 164 T_XMDrugObfuBody_00 2057 0.88 1.55 0.64 165 TR_XM_COVIDMETA1 2031 0.56 1.53 0.22 166 DIET_1 2017 0.69 1.52 0.40 167 RELAYCOUNTRY_DE 2015 0.62 1.52 0.30 168 XM_UB99 1913 0.38 1.44 0.00 169 PDS_OTHER_BAD_TLD 1831 0.56 1.38 0.27 170 XM_DrugUnitList 1830 0.36 1.38 0.00 171 RELAYCOUNTRY_NL 1819 0.50 1.37 0.19 172 XMStockSpam_06 1789 1.23 1.35 1.18 173 USER_IN_DEF_DKIM_WL 1784 8.81 1.35 11.42 174 TR_Symld_Words 1757 1.42 1.33 1.46 175 TR_XM_INV_DKIM 1703 0.51 1.29 0.24 176 BAYES_05 1686 2.02 1.27 2.28 177 XMGenDplmaNmb 1655 0.99 1.25 0.90 178 TR_XM_BayesRelay 1617 0.32 1.22 0.01 179 XMHTML_After_End 1606 0.84 1.21 0.71 180 RCVD_IN_IADB_VOUCHED 1581 2.75 1.19 3.30 181 HTML_FONT_FACE_BAD 1541 2.62 1.16 3.13 182 WANT_TO_ORDER 1535 0.30 1.16 0.00 183 DATE_IN_PAST_12_24 1533 0.32 1.16 0.02 184 RELAYCOUNTRY_AU 1521 0.55 1.15 0.34 185 XMPhish30 1478 0.72 1.12 0.59 186 RELAYCOUNTRY_RU 1475 0.31 1.11 0.03 187 TR_XM_FormFill 1461 0.30 1.10 0.02 188 XM_H_PHPMailer 1447 0.64 1.09 0.48 189 RELAYCOUNTRY_AZ 1446 0.28 1.09 0.00 190 TR_MetaPhish_Combo_01 1431 1.01 1.08 0.99 191 DEAR_BENEFICIARY 1403 0.28 1.06 0.00 192 HK_RANDOM_REPLYTO 1399 0.36 1.06 0.12 193 XM_PDF 1398 3.89 1.06 4.89 194 TR_BOTNET_NEGATE 1395 0.50 1.05 0.31 195 MONEY_NOHTML 1384 0.33 1.04 0.08 196 MPART_ALT_DIFF_COUNT 1377 0.82 1.04 0.75 197 RELAYCOUNTRY_GB 1334 0.87 1.01 0.83 198 DKIM_ADSP_CUSTOM_MED 1309 0.96 0.99 0.95 199 DATE_IN_PAST_06_12 1301 0.34 0.98 0.12 200 HTTPS_HTTP_MISMATCH 1296 0.79 0.98 0.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 331819 89.91 95.70 87.88 2 RELAYCOUNTRY_US 310947 80.03 73.43 82.35 3 XM_B_Unicode 270490 71.90 72.64 71.64 4 DKIM_SIGNED 270056 73.07 77.49 71.52 5 XM_DK_Pass 264424 71.22 74.62 70.03 6 DKIM_VALID 256073 68.91 72.01 67.82 7 DCC_CHECK_NEGATIVE 229686 50.44 20.84 60.83 8 BAYES_50 200748 50.95 44.65 53.17 9 DKIM_VALID_AU 189845 50.89 52.62 50.28 10 XMListUnsubscribeExists 174644 50.74 63.52 46.25 11 XM_B_SpammyWords 167805 50.47 67.67 44.44 12 XM_B_Unicode3 160907 41.90 39.87 42.61 13 DCC_CHECK 147717 49.51 79.12 39.12 14 T_TM2_M_HEADER_IN_MSG 119529 29.17 22.09 31.66 15 RCVD_IN_MSPIKE_WL 112954 27.71 21.42 29.91 16 HTML_FONT_LOW_CONTRAST 100418 27.75 31.04 26.59 17 DKIM_VALID_EF 96628 26.32 28.41 25.59 18 LOC_TINY_FONT_1 86119 25.40 32.81 22.81 19 FVGT_m_MULTI_ODD 84146 23.89 28.45 22.28 20 XMSubLong 79712 22.40 26.07 21.11 21 MIME_HTML_ONLY 76948 24.03 34.45 20.38 22 RCVD_IN_MSPIKE_H2 74114 20.34 22.38 19.63 23 T_KAM_HTML_FONT_INVALID 68940 20.83 28.18 18.26 24 XM_B_SpammyWords2 68082 22.97 37.04 18.03 25 ALL_TRUSTED 57105 11.65 1.74 15.12 26 RCVD_IN_MSPIKE_H3 54071 13.62 11.64 14.32 27 BAYES_00 53269 11.09 2.47 14.11 28 RCVD_IN_MSPIKE_H4 49405 11.99 8.89 13.08 29 USER_IN_DEF_DKIM_WL 43138 8.81 1.35 11.42 30 XM_Multi_Part_URI 41490 12.26 15.89 10.99 31 XM_Body_Dirty_Words 40611 13.00 19.41 10.76 32 XM_B_Unsub 37478 11.12 14.52 9.93 33 LotsOfNums_01 34909 8.74 7.31 9.25 34 LOTS_OF_MONEY 34128 10.18 13.43 9.04 35 TooManyTo_001 32449 7.85 5.73 8.59 36 BAYES_60 31944 8.31 7.87 8.46 37 UNPARSEABLE_RELAY 31090 9.20 11.94 8.23 38 XM_Evil_Numbers_Gen 30680 8.18 8.33 8.13 39 XM_DKIMWhitelistDomains 29289 5.75 0.02 7.76 40 TR_XM_DK_Bayes 28783 5.86 0.83 7.62 41 FSL_BULK_SIG 28393 11.21 21.72 7.52 42 TR_XM_DK_Bayes1 27956 5.69 0.81 7.40 43 XM_SendGrid 27937 7.83 9.05 7.40 44 RCVD_IN_RP_SAFE 27223 5.77 1.65 7.21 45 XM_DK_Undo_02 26827 15.13 38.02 7.10 46 BAYES_99 25708 12.10 27.17 6.81 47 RCVD_IN_RP_CERTIFIED 24412 5.03 0.95 6.47 48 TR_XM_DK_Bayes2 23743 4.81 0.60 6.29 49 RCVD_IN_VALIDITY_SAFE 23435 4.81 0.81 6.21 50 TR_XM_UnparsRelay 23300 7.56 11.51 6.17 51 HTML_IMAGE_RATIO_02 22443 7.07 10.28 5.94 52 HTML_IMAGE_RATIO_04 22215 5.75 5.35 5.88 53 BAYES_999 21817 9.72 20.95 5.78 54 TR_XM_SpammyWords4 21696 7.32 11.80 5.75 55 MIME_QP_LONG_LINE 21414 5.10 3.49 5.67 56 RCVD_IN_VALIDITY_CERTIFIED 21010 4.20 0.30 5.56 57 TR_XM_DKIM_Undo 20099 11.96 30.88 5.32 58 RCVD_IN_IADB_LISTED 20069 4.58 2.48 5.31 59 T_TooManySym_01 19666 4.65 3.06 5.21 60 XM_H_Long_From01 19429 5.20 5.35 5.15 61 BAYES_40 19087 4.44 2.71 5.05 62 MPART_ALT_DIFF 18971 5.79 7.97 5.02 63 XM_PDF 18453 3.89 1.06 4.89 64 RCVD_IN_IADB_SPF 17479 3.99 2.16 4.63 65 XM_H_Trusted_IP 17025 3.34 0.00 4.51 66 TR_XM_DK_SendGrid 16299 4.58 5.35 4.32 67 HTML_IMAGE_RATIO_06 16198 4.04 3.33 4.29 68 XM_SPF_SoftFail 15990 4.47 5.13 4.23 69 XMStrtUSub 15780 4.03 3.61 4.18 70 HTML_IMAGE_RATIO_08 15727 3.67 2.27 4.17 71 RCVD_IN_IADB_SENDERID 15588 3.58 2.01 4.13 72 BAYES_80 15299 5.05 7.91 4.05 73 BOTNET_IPINHOSTNAME 15210 7.02 15.54 4.03 74 RCVD_IN_IADB_DK 15086 3.48 2.03 4.00 75 T_REMOTE_IMAGE 14875 5.22 8.88 3.94 76 XM_B_Phish_Phrases 14666 4.40 5.88 3.88 77 RELAYCOUNTRY_META 14330 8.76 22.93 3.80 78 XM_B_SpammyWords3 14033 5.79 11.71 3.72 79 DKIM_INVALID 13983 4.16 5.48 3.70 80 BAYES_20 13739 3.20 1.94 3.64 81 MIME_HTML_ONLY_MULTI 12840 3.42 3.47 3.40 82 RCVD_IN_IADB_VOUCHED 12450 2.75 1.19 3.30 83 TR_XM_PhishingBody 12363 4.42 7.68 3.27 84 XM_UncommonTLD01 12303 6.49 15.69 3.26 85 XMSubMetaSx_00 11993 4.52 8.35 3.18 86 MAILING_LIST_MULTI 11923 2.87 2.04 3.16 87 HTML_FONT_FACE_BAD 11831 2.62 1.16 3.13 88 XMSexyCombo_05 11658 5.28 11.53 3.09 89 TR_DCC_Bayes_99 11586 7.64 20.66 3.07 90 ANY_BOUNCE_MESSAGE 11178 2.34 0.59 2.96 91 BOUNCE_MESSAGE 11175 2.34 0.59 2.96 92 XMNumbers 11057 3.64 5.68 2.93 93 FROM_EXCESS_BASE64 10772 2.52 1.57 2.85 94 KHOP_HELO_FCRDNS 10700 4.09 7.67 2.83 95 TM2_M_URI_OPT_OUT 10636 2.97 3.41 2.82 96 URI_NOVOWEL 10393 2.83 3.04 2.75 97 T_TooManySym_02 9788 2.13 0.82 2.59 98 RCVD_IN_MSPIKE_H5 9478 2.09 0.90 2.51 99 BAYES_95 9184 2.84 4.02 2.43 100 TooManyTo_002 9083 2.02 0.90 2.41 101 TR_XM_SB_Phish 8856 2.32 2.25 2.35 102 XMSubPhish11 8726 2.27 2.16 2.31 103 BAYES_05 8613 2.02 1.27 2.28 104 MIME_HTML_MOSTLY 8300 2.98 5.22 2.20 105 XM_B_SpammyTLD 8172 2.64 3.99 2.16 106 RCVD_IN_IADB_OPTIN 7975 1.76 0.77 2.11 107 HTML_MIME_NO_HTML_TAG 7761 3.88 9.08 2.06 108 XMSubNoVowel 7725 1.68 0.63 2.05 109 T_XMDrugObfuBody_14 7256 1.99 2.17 1.92 110 HELO_NODOT 7190 1.59 0.69 1.90 111 HELO_NO_DOMAIN 7184 1.59 0.69 1.90 112 IN_HORDE_ADDRESS_BOOK 6977 1.39 0.08 1.85 113 SUBJ_ALL_CAPS 6699 1.76 1.70 1.77 114 INVALID_MSGID 6649 1.35 0.18 1.76 115 XM_B_Phish66 6567 2.59 5.03 1.74 116 XM_CamelCaseFrm001 6336 1.87 2.41 1.68 117 TooManyTo_003 6205 1.40 0.70 1.64 118 XM_B_Investor 6107 2.34 4.41 1.62 119 MSGID_NOFQDN1 6039 1.19 0.04 1.60 120 TO_MALFORMED 6038 1.19 0.01 1.60 121 XM_B_Unsub2 6015 1.88 2.70 1.59 122 XM_DK_Undo_01 5948 1.64 1.83 1.58 123 URI_HEX 5857 1.64 1.89 1.55 124 XMDiploma_00 5839 1.79 2.47 1.55 125 TR_XM_SpammyRelay 5786 4.81 14.15 1.53 126 TVD_RCVD_IP 5762 1.66 2.04 1.53 127 BOTNET 5562 5.12 15.51 1.47 128 TR_Symld_Words 5503 1.42 1.33 1.46 129 T_XMDrugObfuBody_08 5457 1.90 3.22 1.45 130 XM_GoogleGroups 5413 1.30 0.91 1.43 131 XMNoVowels 5168 1.54 2.04 1.37 132 TR_XM_SpammyWords5 5126 1.86 3.28 1.36 133 UNTRUSTED_Relay 5091 6.02 19.35 1.35 134 XMGappySubj_01 5066 1.03 0.13 1.34 135 XMCapTrack 4911 1.09 0.50 1.30 136 FILL_THIS_FORM 4701 1.04 0.47 1.24 137 XM_H_Long_From02 4628 1.13 0.87 1.23 138 IN_ZIMBRA_NJ_WHITELIST 4623 0.91 0.01 1.22 139 XMStockSpam_06 4464 1.23 1.35 1.18 140 TooManyTo_004 4443 1.02 0.58 1.18 141 TR_XM_SpammyWords2 4353 3.49 10.16 1.15 142 XMBSHREFv2 4335 0.95 0.39 1.15 143 XMBrknScrpt_02 4171 1.45 2.42 1.10 144 TM2_M_VERY_LONG_WORD 4124 1.41 2.31 1.09 145 TR_MetaPhish_Combo_01 3735 1.01 1.08 0.99 146 TVD_SPACE_RATIO_MINFP 3664 0.76 0.16 0.97 147 T_FILL_THIS_FORM_SHORT 3651 1.24 2.02 0.97 148 XM_OfRef6 3647 1.58 3.35 0.97 149 TooManyTo_005 3609 0.83 0.49 0.96 150 DKIM_ADSP_CUSTOM_MED 3605 0.96 0.99 0.95 151 XM_E_Blogspot 3600 0.74 0.11 0.95 152 XM_Body_Dirty_Words_01 3437 1.15 1.83 0.91 153 XMGenDplmaNmb 3399 0.99 1.25 0.90 154 HELO_MISC_IP 3346 0.69 0.15 0.89 155 XM_B_COVIDMETA 3327 1.32 2.57 0.88 156 XM_UB50 3228 3.19 9.86 0.85 157 URI_TRY_3LD 3227 1.05 1.60 0.85 158 XMBdyGiftCard01 3225 0.82 0.74 0.85 159 RELAYCOUNTRY_CA 3223 1.85 4.67 0.85 160 RELAYCOUNTRY_GB 3126 0.87 1.01 0.83 161 HTML_IMAGE_ONLY_20 3034 0.74 0.56 0.80 162 RCVD_IN_BL_SPAMCOP_NET 2932 3.32 10.58 0.78 163 XM_ProductURIs 2912 0.80 0.89 0.77 164 T_TooManySym_03 2899 0.64 0.27 0.77 165 MPART_ALT_DIFF_COUNT 2829 0.82 1.04 0.75 166 HTTPS_HTTP_MISMATCH 2708 0.79 0.98 0.72 167 XMHTML_After_End 2663 0.84 1.21 0.71 168 SpammyFromTLD_01 2629 1.36 3.27 0.70 169 TR_MSPIKEBAYES00 2420 0.50 0.08 0.64 170 T_XMDrugObfuBody_00 2412 0.88 1.55 0.64 171 XMMoneyMeta_00 2357 0.68 0.84 0.62 172 NML_ADSP_CUSTOM_MED 2340 0.68 0.86 0.62 173 XMBody_95 2340 0.50 0.15 0.62 174 RCVD_IN_SORBS_DUL 2256 0.52 0.28 0.60 175 T_OBFU_PDF_ATTACH 2221 0.47 0.15 0.59 176 XMPhish30 2217 0.72 1.12 0.59 177 XM_ShortIntro_01 2187 0.58 0.57 0.58 178 XMSubMetaI_00 2175 0.67 0.93 0.58 179 FROM_GOV_DKIM_AU 2145 0.46 0.13 0.57 180 TVD_SPACE_RATIO 2083 0.44 0.11 0.55 181 FROM_GOV_SPOOF 2066 0.45 0.18 0.55 182 XMLngstWrd_00 2064 0.48 0.28 0.55 183 SHORT_HELO_AND_INLINE_IMAGE 2034 0.42 0.10 0.54 184 XM_B_SpammyWords4 2025 0.93 2.07 0.54 185 FORGED_GMAIL_RCVD 1930 0.60 0.86 0.51 186 XMPhish14 1910 0.56 0.73 0.51 187 XMHTMLBadTable_001 1875 0.53 0.64 0.50 188 XM_B_COPY_HTML 1865 0.52 0.59 0.49 189 XMSexyCombo_01 1856 0.82 1.76 0.49 190 HTML_IMAGE_ONLY_28 1834 0.47 0.43 0.49 191 XM_H_PHPMailer 1830 0.64 1.09 0.48 192 HTML_IMAGE_ONLY_32 1801 1.07 2.77 0.48 193 HTML_TAG_BALANCE_BODY 1757 0.50 0.59 0.47 194 XMLngstWrd_01 1757 0.41 0.23 0.47 195 TM2_M_BODY_EMPTY 1730 0.37 0.12 0.46 196 T_XMHurry_00 1687 0.85 2.01 0.45 197 XM_S_SpammyWords 1677 0.53 0.76 0.44 198 TR_XM_Spammywords 1677 0.53 0.76 0.44 199 XMBody_17 1676 0.78 1.74 0.44 200 XM_B_REG_HTML 1675 0.38 0.20 0.44 ----------------------------------------------------------------------