Email: 484022 Autolearn: 0 AvgScore: 2.52 AvgScanTime: 1.23 sec Spam: 112950 Autolearn: 0 AvgScore: 14.66 AvgScanTime: 1.43 sec Ham: 371072 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 1.17 sec Time Spent Running SA: 165.82 hours Time Spent Processing Spam: 44.95 hours Time Spent Processing Ham: 120.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 107503 89.09 95.18 87.24 2 DKIM_SIGNED 86520 68.49 76.60 66.02 3 RELAYCOUNTRY_US 86095 75.20 76.22 74.89 4 DCC_CHECK 85073 43.48 75.32 33.79 5 XM_DK_Pass 83699 66.80 74.10 64.58 6 XM_B_Unicode 82300 71.05 72.86 70.49 7 DKIM_VALID 80884 64.73 71.61 62.63 8 XM_B_SpammyWords 72207 45.58 63.93 39.99 9 XMListUnsubscribeExists 69692 45.90 61.70 41.09 10 DKIM_VALID_AU 57746 48.34 51.13 47.49 11 BAYES_50 50887 53.70 45.05 56.33 12 XM_B_Unicode3 45245 42.55 40.06 43.31 13 MIME_HTML_ONLY 41494 28.94 36.74 26.57 14 XM_DK_Undo_02 41024 13.45 36.32 6.48 15 XM_B_SpammyWords2 39697 20.75 35.15 16.36 16 LOC_TINY_FONT_1 36401 23.35 32.23 20.65 17 HTML_FONT_LOW_CONTRAST 34808 25.63 30.82 24.04 18 TR_XM_DKIM_Undo 33173 10.65 29.37 4.96 19 T_KAM_HTML_FONT_INVALID 30560 18.19 27.06 15.49 20 DKIM_VALID_EF 30365 25.30 26.88 24.82 21 FVGT_m_MULTI_ODD 29930 21.82 26.50 20.39 22 RCVD_IN_MSPIKE_H2 29733 20.46 26.32 18.68 23 BAYES_99 28219 10.36 24.98 5.91 24 DCC_CHECK_NEGATIVE 27828 56.48 24.64 66.17 25 XMSubLong 27823 21.18 24.63 20.12 26 T_TM2_M_HEADER_IN_MSG 27684 28.05 24.51 29.12 27 FSL_BULK_SIG 24472 10.46 21.67 7.05 28 RELAYCOUNTRY_META 22452 7.10 19.88 3.21 29 RCVD_IN_MSPIKE_WL 22120 25.37 19.58 27.13 30 XM_Body_Dirty_Words 21450 12.63 18.99 10.70 31 BAYES_999 21426 8.26 18.97 5.00 32 TR_DCC_Bayes_99 20232 5.84 17.91 2.17 33 XM_UncommonTLD01 19320 6.36 17.10 3.09 34 UNTRUSTED_Relay 18101 4.54 16.03 1.05 35 XM_Multi_Part_URI 18026 11.65 15.96 10.34 36 BOTNET 17144 4.58 15.18 1.36 37 BOTNET_IPINHOSTNAME 15479 6.10 13.70 3.79 38 SpammyFromTLD_02 14581 3.18 12.91 0.21 39 HTML_MIME_NO_HTML_TAG 13958 4.82 12.36 2.53 40 XM_B_Unsub 13745 16.04 12.17 17.22 41 LOTS_OF_MONEY 13480 13.16 11.93 13.53 42 UNPARSEABLE_RELAY 13409 8.31 11.87 7.23 43 TR_XM_UnparsRelay 12880 6.72 11.40 5.29 44 T_REMOTE_IMAGE 12845 5.46 11.37 3.66 45 TR_XM_SpammyRelay 12741 3.63 11.28 1.30 46 XM_B_SpammyWords3 12388 5.08 10.97 3.29 47 RCVD_IN_MSPIKE_H3 12329 12.95 10.92 13.57 48 TR_XM_SpammyWords4 11389 5.33 10.08 3.89 49 XMSexyCombo_05 11058 4.76 9.79 3.23 50 XM_SendGrid 10693 7.21 9.47 6.52 51 T_HTML_TAG_BALANCE_CENTER 10441 2.18 9.24 0.04 52 HTML_IMAGE_ONLY_08 10371 2.22 9.18 0.10 53 HTML_IMAGE_RATIO_02 10364 6.85 9.18 6.14 54 TR_XM_SpammyWords2 10163 2.89 9.00 1.03 55 KHOP_HELO_FCRDNS 10035 3.38 8.88 1.70 56 RCVD_IN_BL_SPAMCOP_NET 9893 2.72 8.76 0.88 57 XM_Evil_Numbers_Gen 9753 7.92 8.63 7.70 58 TR_XM_PhishingBody 9654 4.05 8.55 2.68 59 RCVD_IN_MSPIKE_H4 9173 10.81 8.12 11.63 60 XMSubMetaSx_00 9066 4.65 8.03 3.62 61 MIXED_CENTER_CASE 8778 1.82 7.77 0.00 62 MIXED_HREF_CASE 8775 1.81 7.77 0.00 63 MIXED_IMG_CASE 8769 1.82 7.76 0.01 64 MIXED_AREA_CASE 8765 1.81 7.76 0.00 65 MIXED_FONT_CASE 8560 1.77 7.58 0.00 66 BAYES_80 8546 4.38 7.57 3.41 67 BODY_URI_ONLY 8450 1.76 7.48 0.01 68 XM_UB50 8252 2.17 7.31 0.61 69 BAYES_60 7815 7.50 6.92 7.67 70 TooManyTo_001 7430 13.74 6.58 15.92 71 LotsOfNums_01 7424 7.59 6.57 7.89 72 MPART_ALT_DIFF 7226 5.11 6.40 4.71 73 XM_B_Phish66 7064 2.63 6.25 1.52 74 XMNumbers 6917 3.89 6.12 3.21 75 HTML_FONT_SIZE_LARGE 6852 1.50 6.07 0.10 76 XM_H_Long_From01 6320 4.67 5.60 4.39 77 XM_B_Phish_Phrases 6196 3.85 5.49 3.35 78 MIXED_CTYPE_CASE 6084 1.26 5.39 0.00 79 HTML_IMAGE_RATIO_04 6019 4.55 5.33 4.32 80 TR_XM_DK_SendGrid 5664 4.30 5.01 4.09 81 DKIM_INVALID 5636 3.76 4.99 3.38 82 GOOG_STO_IMG_HTML 5493 1.13 4.86 0.00 83 RELAYCOUNTRY_CA 5485 1.68 4.86 0.71 84 TR_XM_SPAMCOP 5410 1.30 4.79 0.24 85 URI_GOOG_STO_SPAMMY 5045 1.04 4.47 0.00 86 XM_B_SpammyTLD 5032 2.34 4.46 1.69 87 TM2_M_URI_OPT_OUT 4973 3.97 4.40 3.83 88 XMStrtUSub 4910 4.41 4.35 4.43 89 XM_SPF_SoftFail 4765 2.62 4.22 2.13 90 XM_B_Investor 4591 2.21 4.06 1.65 91 MIME_HTML_MOSTLY 4532 2.62 4.01 2.20 92 BAYES_95 4461 2.47 3.95 2.01 93 BAYES_40 4394 4.97 3.89 5.30 94 BOTNET_NORDNS 4376 0.91 3.87 0.01 95 MIME_QP_LONG_LINE 4376 5.33 3.87 5.78 96 TR_XM_SpammyWords5 4199 1.90 3.72 1.34 97 MIME_HTML_ONLY_MULTI 4082 3.38 3.61 3.30 98 HTML_FONT_SIZE_HUGE 4066 0.87 3.60 0.04 99 HTML_IMAGE_RATIO_06 4033 3.69 3.57 3.73 100 BAYES_00 3906 10.85 3.46 13.10 101 RCVD_IN_MSPIKE_BL 3847 0.85 3.41 0.08 102 XMDiploma_00 3786 7.16 3.35 8.32 103 RCVD_IN_RP_RNBL 3736 0.86 3.31 0.12 104 XM_OfRef6 3345 1.34 2.96 0.84 105 T_XMDrugObfuBody_14 3323 2.14 2.94 1.89 106 TR_XM_MSPIKECOMBO 3244 0.72 2.87 0.06 107 TR_XM_PHPDW 3240 0.93 2.87 0.34 108 BAYES_20 3219 3.60 2.85 3.83 109 RCVD_IN_VALIDITY_RPBL 3072 0.71 2.72 0.10 110 TR_XM_NoHeaderRelay 3059 0.78 2.71 0.19 111 SpammyFromTLD_01 3041 1.11 2.69 0.62 112 TR_XM_PHPForged 3031 0.86 2.68 0.30 113 TR_XM_FormFill2 3009 0.85 2.66 0.29 114 XM_CamelCaseFrm001 2997 1.76 2.65 1.49 115 XM_H_PHPOS 2994 0.84 2.65 0.28 116 TR_XM_SB_Phish 2951 2.14 2.61 2.00 117 RCVD_IN_PSBL 2946 0.69 2.61 0.10 118 T_XMDrugObfuBody_08 2919 1.67 2.58 1.40 119 URIBL_DBL_SPAM 2915 0.61 2.58 0.00 120 TM2_M_VERY_LONG_WORD 2900 1.42 2.57 1.07 121 XM_DIRTYINTL 2890 0.78 2.56 0.24 122 ALL_TRUSTED 2884 18.24 2.55 23.02 123 T_TooManySym_01 2880 4.68 2.55 5.33 124 XMSubPhish11 2872 2.10 2.54 1.96 125 XM_DK_Undo_01 2753 1.77 2.44 1.56 126 ALIBABA_IMG_NOT_RCVD_ALI 2696 0.56 2.39 0.00 127 DIET_1 2695 0.83 2.39 0.35 128 XM_B_COVIDMETA 2684 1.17 2.38 0.80 129 HOSTED_IMG_DIRECT_MX 2676 0.55 2.37 0.00 130 URI_NOVOWEL 2611 2.38 2.31 2.40 131 RCVD_IN_MSPIKE_L3 2582 0.58 2.29 0.06 132 XM_B_Unsub2 2566 1.44 2.27 1.19 133 HTML_IMAGE_RATIO_08 2534 2.21 2.24 2.20 134 RCVD_IN_IADB_LISTED 2464 3.96 2.18 4.50 135 SUBJ_ALL_CAPS 2366 1.66 2.09 1.53 136 XMSexyCombo_01 2344 1.25 2.08 0.99 137 XM_GoogleGroups 2324 1.62 2.06 1.49 138 XM_URI_RBL 2291 0.57 2.03 0.12 139 WANT_TO_ORDER 2243 0.47 1.99 0.01 140 XM_B_SpammyWords4 2225 0.73 1.97 0.35 141 XMGenDplmaNmb 2221 0.98 1.97 0.68 142 XMBody_17 2190 0.78 1.94 0.43 143 RCVD_IN_IADB_SPF 2173 3.44 1.92 3.90 144 T_XMDrugObfuBody_00 2137 0.77 1.89 0.43 145 MAILING_LIST_MULTI 2122 2.46 1.88 2.63 146 XMStockSpam_06 2109 1.49 1.87 1.38 147 RELAYCOUNTRY_DE 2027 0.59 1.79 0.22 148 RCVD_IN_RP_SAFE 2026 5.64 1.79 6.81 149 RELAYCOUNTRY_NL 2026 0.54 1.79 0.16 150 URIBL_BLACK 2001 0.43 1.77 0.02 151 RCVD_IN_IADB_DK 1999 2.99 1.77 3.36 152 RELAYCOUNTRY_FR 1995 0.55 1.77 0.18 153 RCVD_IN_IADB_SENDERID 1987 3.08 1.76 3.48 154 XMBrknScrpt_02 1946 1.06 1.72 0.85 155 HTML_IMAGE_ONLY_20 1937 1.34 1.71 1.23 156 XMMoneyMeta_00 1934 0.81 1.71 0.53 157 XM_UB60 1923 0.44 1.70 0.06 158 T_FILL_THIS_FORM_SHORT 1873 1.08 1.66 0.91 159 URI_HEX 1861 1.37 1.65 1.29 160 HTML_TITLE_SUBJ_DIFF 1842 0.74 1.63 0.46 161 TR_Symld_Words 1764 1.70 1.56 1.75 162 HTML_SHORT_LINK_IMG_3 1750 0.74 1.55 0.50 163 T_XMHurry_00 1690 0.63 1.50 0.36 164 TR_LOTS_OF_MONEY3 1641 0.53 1.45 0.25 165 XMSlimDrugH 1630 0.52 1.44 0.24 166 XM_Body_Dirty_Words_01 1621 0.49 1.44 0.20 167 XMHTML_After_End 1599 0.75 1.42 0.55 168 FROM_EXCESS_BASE64 1582 2.10 1.40 2.31 169 FVGT_m_MULTI_ODD_EMAIL 1579 0.35 1.40 0.03 170 TR_XM_COVIDMETA4 1550 0.52 1.37 0.26 171 TR_XM_COVIDMETA1 1543 0.47 1.37 0.19 172 PDS_OTHER_BAD_TLD 1525 0.51 1.35 0.26 173 BAYES_05 1501 2.17 1.33 2.43 174 XMSubMetaI_00 1500 0.78 1.33 0.61 175 RELAYCOUNTRY_AU 1500 0.54 1.33 0.30 176 XM_UB99 1491 0.31 1.32 0.00 177 LOCALPART_IN_SUBJECT 1475 0.33 1.31 0.03 178 XM_PDF 1462 4.18 1.29 5.06 179 URI_TRY_3LD 1433 0.96 1.27 0.87 180 TR_MetaPhish_Combo_01 1430 0.80 1.27 0.66 181 TR_XM_SpammyWords3 1406 0.31 1.24 0.02 182 RELAYCOUNTRY_IN 1379 0.37 1.22 0.10 183 TR_XM_INV_DKIM 1352 0.43 1.20 0.19 184 XM_H_PHPMailer 1326 0.68 1.17 0.53 185 URIBL_DBL_ABUSE_SPAM 1303 0.34 1.15 0.09 186 TR_XM_PhishingBody3 1292 0.27 1.14 0.00 187 XM_UB80 1254 0.28 1.11 0.02 188 RCVD_IN_IADB_VOUCHED 1248 2.41 1.10 2.81 189 USER_IN_DEF_DKIM_WL 1232 8.65 1.09 10.95 190 DATE_IN_PAST_03_06 1220 0.51 1.08 0.33 191 RCVD_IN_RP_CERTIFIED 1219 4.98 1.08 6.17 192 XMPhish30 1217 0.62 1.08 0.48 193 TooManyTo_002 1213 1.94 1.07 2.21 194 HTTPS_HTTP_MISMATCH 1211 0.79 1.07 0.71 195 TR_LOTS_OF_MONEY2 1199 0.38 1.06 0.17 196 T_MONEY_PERCENT 1199 0.38 1.06 0.17 197 ANY_BOUNCE_MESSAGE 1175 2.76 1.04 3.28 198 BOUNCE_MESSAGE 1174 2.75 1.04 3.28 199 DATE_IN_PAST_06_12 1173 0.31 1.04 0.09 200 DKIM_ADSP_CUSTOM_MED 1171 0.99 1.04 0.98 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 323709 89.09 95.18 87.24 2 RELAYCOUNTRY_US 277906 75.20 76.22 74.89 3 XM_B_Unicode 261576 71.05 72.86 70.49 4 DCC_CHECK_NEGATIVE 245544 56.48 24.64 66.17 5 DKIM_SIGNED 244974 68.49 76.60 66.02 6 XM_DK_Pass 239633 66.80 74.10 64.58 7 DKIM_VALID 232415 64.73 71.61 62.63 8 BAYES_50 209020 53.70 45.05 56.33 9 DKIM_VALID_AU 176232 48.34 51.13 47.49 10 XM_B_Unicode3 160708 42.55 40.06 43.31 11 XMListUnsubscribeExists 152462 45.90 61.70 41.09 12 XM_B_SpammyWords 148399 45.58 63.93 39.99 13 DCC_CHECK 125367 43.48 75.32 33.79 14 T_TM2_M_HEADER_IN_MSG 108062 28.05 24.51 29.12 15 RCVD_IN_MSPIKE_WL 100677 25.37 19.58 27.13 16 MIME_HTML_ONLY 98601 28.94 36.74 26.57 17 DKIM_VALID_EF 92083 25.30 26.88 24.82 18 HTML_FONT_LOW_CONTRAST 89224 25.63 30.82 24.04 19 ALL_TRUSTED 85417 18.24 2.55 23.02 20 LOC_TINY_FONT_1 76632 23.35 32.23 20.65 21 FVGT_m_MULTI_ODD 75663 21.82 26.50 20.39 22 XMSubLong 74669 21.18 24.63 20.12 23 RCVD_IN_MSPIKE_H2 69318 20.46 26.32 18.68 24 XM_B_Unsub 63894 16.04 12.17 17.22 25 XM_B_SpammyWords2 60715 20.75 35.15 16.36 26 TooManyTo_001 59064 13.74 6.58 15.92 27 T_KAM_HTML_FONT_INVALID 57468 18.19 27.06 15.49 28 RCVD_IN_MSPIKE_H3 50355 12.95 10.92 13.57 29 LOTS_OF_MONEY 50210 13.16 11.93 13.53 30 BAYES_00 48618 10.85 3.46 13.10 31 RCVD_IN_MSPIKE_H4 43154 10.81 8.12 11.63 32 USER_IN_DEF_DKIM_WL 40647 8.65 1.09 10.95 33 XM_Body_Dirty_Words 39699 12.63 18.99 10.70 34 XM_Multi_Part_URI 38362 11.65 15.96 10.34 35 XMDiploma_00 30872 7.16 3.35 8.32 36 LotsOfNums_01 29296 7.59 6.57 7.89 37 XM_Evil_Numbers_Gen 28572 7.92 8.63 7.70 38 BAYES_60 28469 7.50 6.92 7.67 39 TR_XM_DK_Bayes 28266 6.06 0.94 7.62 40 TR_XM_DK_Bayes1 27384 5.87 0.92 7.38 41 UNPARSEABLE_RELAY 26833 8.31 11.87 7.23 42 XM_DKIMWhitelistDomains 26403 5.46 0.01 7.12 43 FSL_BULK_SIG 26160 10.46 21.67 7.05 44 RCVD_IN_RP_SAFE 25252 5.64 1.79 6.81 45 XM_SendGrid 24201 7.21 9.47 6.52 46 XM_DK_Undo_02 24053 13.45 36.32 6.48 47 TR_XM_DK_Bayes2 23178 4.95 0.71 6.25 48 RCVD_IN_RP_CERTIFIED 22897 4.98 1.08 6.17 49 HTML_IMAGE_RATIO_02 22774 6.85 9.18 6.14 50 BAYES_99 21927 10.36 24.98 5.91 51 RCVD_IN_VALIDITY_SAFE 21915 4.71 0.76 5.91 52 MIME_QP_LONG_LINE 21442 5.33 3.87 5.78 53 RCVD_IN_VALIDITY_CERTIFIED 19875 4.17 0.26 5.36 54 T_TooManySym_01 19786 4.68 2.55 5.33 55 BAYES_40 19681 4.97 3.89 5.30 56 TR_XM_UnparsRelay 19635 6.72 11.40 5.29 57 XM_PDF 18786 4.18 1.29 5.06 58 BAYES_999 18556 8.26 18.97 5.00 59 TR_XM_DKIM_Undo 18396 10.65 29.37 4.96 60 MPART_ALT_DIFF 17493 5.11 6.40 4.71 61 XM_H_Trusted_IP 16708 3.45 0.00 4.50 62 RCVD_IN_IADB_LISTED 16683 3.96 2.18 4.50 63 XMStrtUSub 16457 4.41 4.35 4.43 64 XM_H_Long_From01 16281 4.67 5.60 4.39 65 HTML_IMAGE_RATIO_04 16028 4.55 5.33 4.32 66 TR_XM_DK_SendGrid 15166 4.30 5.01 4.09 67 RCVD_IN_IADB_SPF 14461 3.44 1.92 3.90 68 TR_XM_SpammyWords4 14427 5.33 10.08 3.89 69 BAYES_20 14229 3.60 2.85 3.83 70 TM2_M_URI_OPT_OUT 14223 3.97 4.40 3.83 71 BOTNET_IPINHOSTNAME 14058 6.10 13.70 3.79 72 HTML_IMAGE_RATIO_06 13831 3.69 3.57 3.73 73 T_REMOTE_IMAGE 13567 5.46 11.37 3.66 74 XMSubMetaSx_00 13444 4.65 8.03 3.62 75 RCVD_IN_IADB_SENDERID 12925 3.08 1.76 3.48 76 BAYES_80 12639 4.38 7.57 3.41 77 DKIM_INVALID 12559 3.76 4.99 3.38 78 RCVD_IN_IADB_DK 12479 2.99 1.77 3.36 79 XM_B_Phish_Phrases 12441 3.85 5.49 3.35 80 MIME_HTML_ONLY_MULTI 12259 3.38 3.61 3.30 81 XM_B_SpammyWords3 12201 5.08 10.97 3.29 82 ANY_BOUNCE_MESSAGE 12160 2.76 1.04 3.28 83 BOUNCE_MESSAGE 12157 2.75 1.04 3.28 84 XMSexyCombo_05 11971 4.76 9.79 3.23 85 RELAYCOUNTRY_META 11922 7.10 19.88 3.21 86 XMNumbers 11897 3.89 6.12 3.21 87 T_TooManySym_02 11621 2.60 0.84 3.13 88 XM_UncommonTLD01 11449 6.36 17.10 3.09 89 RCVD_IN_IADB_VOUCHED 10436 2.41 1.10 2.81 90 TR_XM_PhishingBody 9943 4.05 8.55 2.68 91 MAILING_LIST_MULTI 9771 2.46 1.88 2.63 92 HTML_MIME_NO_HTML_TAG 9380 4.82 12.36 2.53 93 BAYES_05 9008 2.17 1.33 2.43 94 URI_NOVOWEL 8901 2.38 2.31 2.40 95 FROM_EXCESS_BASE64 8574 2.10 1.40 2.31 96 TooManyTo_002 8200 1.94 1.07 2.21 97 HTML_IMAGE_RATIO_08 8177 2.21 2.24 2.20 98 MIME_HTML_MOSTLY 8167 2.62 4.01 2.20 99 TR_DCC_Bayes_99 8047 5.84 17.91 2.17 100 XM_SPF_SoftFail 7902 2.62 4.22 2.13 101 BAYES_95 7473 2.47 3.95 2.01 102 TR_XM_SB_Phish 7431 2.14 2.61 2.00 103 XMSubNoVowel 7367 1.64 0.49 1.99 104 XMSubPhish11 7283 2.10 2.54 1.96 105 RCVD_IN_MSPIKE_H5 7168 1.61 0.55 1.93 106 T_XMDrugObfuBody_14 7028 2.14 2.94 1.89 107 HELO_NODOT 6915 1.60 0.72 1.86 108 HELO_NO_DOMAIN 6909 1.60 0.72 1.86 109 INVALID_MSGID 6814 1.45 0.16 1.84 110 RCVD_IN_IADB_OPTIN 6623 1.56 0.80 1.78 111 IN_HORDE_ADDRESS_BOOK 6569 1.38 0.09 1.77 112 TR_Symld_Words 6488 1.70 1.56 1.75 113 KHOP_HELO_FCRDNS 6301 3.38 8.88 1.70 114 XM_B_SpammyTLD 6274 2.34 4.46 1.69 115 MSGID_NOFQDN1 6225 1.30 0.06 1.68 116 XM_B_Investor 6120 2.21 4.06 1.65 117 TO_MALFORMED 6003 1.24 0.00 1.62 118 TVD_RCVD_IP 5920 1.34 0.50 1.60 119 XM_DK_Undo_01 5805 1.77 2.44 1.56 120 SUBJ_ALL_CAPS 5683 1.66 2.09 1.53 121 XM_B_Phish66 5649 2.63 6.25 1.52 122 XM_CamelCaseFrm001 5534 1.76 2.65 1.49 123 XM_GoogleGroups 5521 1.62 2.06 1.49 124 TooManyTo_003 5359 1.30 0.82 1.44 125 T_XMDrugObfuBody_08 5185 1.67 2.58 1.40 126 XMStockSpam_06 5109 1.49 1.87 1.38 127 BOTNET 5042 4.58 15.18 1.36 128 SHORTENED_URL_HREF 5008 1.08 0.18 1.35 129 TR_XM_SpammyWords5 4980 1.90 3.72 1.34 130 TR_XM_SpammyRelay 4826 3.63 11.28 1.30 131 URI_HEX 4780 1.37 1.65 1.29 132 XMCapTrack 4664 1.07 0.46 1.26 133 HTML_IMAGE_ONLY_20 4570 1.34 1.71 1.23 134 XM_B_Unsub2 4427 1.44 2.27 1.19 135 HTML_FONT_FACE_BAD 4005 1.01 0.78 1.08 136 TM2_M_VERY_LONG_WORD 3955 1.42 2.57 1.07 137 UNTRUSTED_Relay 3884 4.54 16.03 1.05 138 XMGappySubj_01 3832 0.82 0.13 1.03 139 TR_XM_SpammyWords2 3823 2.89 9.00 1.03 140 TooManyTo_004 3697 0.92 0.66 1.00 141 XMSexyCombo_01 3690 1.25 2.08 0.99 142 DKIM_ADSP_CUSTOM_MED 3637 0.99 1.04 0.98 143 TVD_SPACE_RATIO 3615 0.78 0.14 0.97 144 XMBSHREFv2 3545 0.80 0.27 0.96 145 T_FILL_THIS_FORM_SHORT 3364 1.08 1.66 0.91 146 XM_E_Blogspot 3338 0.71 0.10 0.90 147 RCVD_IN_BL_SPAMCOP_NET 3255 2.72 8.76 0.88 148 XM_H_Long_From02 3253 0.88 0.87 0.88 149 URI_TRY_3LD 3231 0.96 1.27 0.87 150 XMNoVowels 3175 0.78 0.53 0.86 151 XMBrknScrpt_02 3168 1.06 1.72 0.85 152 T_TooManySym_03 3136 0.71 0.27 0.85 153 XM_OfRef6 3122 1.34 2.96 0.84 154 TooManyTo_005 3015 0.76 0.57 0.81 155 TVD_SPACE_RATIO_MINFP 3011 0.65 0.10 0.81 156 XM_B_COVIDMETA 2971 1.17 2.38 0.80 157 XMBody_95 2862 0.62 0.13 0.77 158 IN_ZIMBRA_NJ_WHITELIST 2825 0.59 0.01 0.76 159 RELAYCOUNTRY_GB 2771 0.78 0.89 0.75 160 T_OBFU_PDF_ATTACH 2671 0.60 0.21 0.72 161 RELAYCOUNTRY_CA 2629 1.68 4.86 0.71 162 HTTPS_HTTP_MISMATCH 2623 0.79 1.07 0.71 163 XMGenDplmaNmb 2511 0.98 1.97 0.68 164 TR_MetaPhish_Combo_01 2452 0.80 1.27 0.66 165 XMBdyGiftCard01 2444 0.67 0.71 0.66 166 XM_ShortIntro_01 2418 0.66 0.68 0.65 167 NML_ADSP_CUSTOM_MED 2401 0.67 0.76 0.65 168 SpammyFromTLD_01 2309 1.11 2.69 0.62 169 RCVD_IN_SORBS_DUL 2289 0.54 0.30 0.62 170 XM_ProductURIs 2276 0.60 0.58 0.61 171 XM_UB50 2274 2.17 7.31 0.61 172 XMSubMetaI_00 2265 0.78 1.33 0.61 173 XM_B_REG_HTML 2134 0.51 0.29 0.58 174 XM_RXBody 2070 0.52 0.41 0.56 175 XMHTML_After_End 2044 0.75 1.42 0.55 176 SHORT_URI_3 2034 0.51 0.38 0.55 177 XMMoneyMeta_00 1974 0.81 1.71 0.53 178 XM_H_PHPMailer 1966 0.68 1.17 0.53 179 TM2_M_BODY_EMPTY 1959 0.44 0.14 0.53 180 TM2_M_A_HREF_HREF 1885 0.56 0.71 0.51 181 TR_MSPIKEBAYES00 1870 0.40 0.06 0.50 182 SHORT_HELO_AND_INLINE_IMAGE 1870 0.41 0.12 0.50 183 FORGED_GMAIL_RCVD 1852 0.58 0.87 0.50 184 HTML_SHORT_LINK_IMG_3 1841 0.74 1.55 0.50 185 XMHTMLBadTable_001 1826 0.47 0.40 0.49 186 MISSING_HEADERS 1802 0.57 0.84 0.49 187 XMPhish30 1792 0.62 1.08 0.48 188 FROM_GOV_SPOOF 1770 0.40 0.15 0.48 189 HTML_TITLE_SUBJ_DIFF 1721 0.74 1.63 0.46 190 XM_B_COPY_HTML 1718 0.52 0.73 0.46 191 T_Symld_Words_02 1718 0.54 0.79 0.46 192 HTML_IMAGE_ONLY_24 1714 0.42 0.27 0.46 193 HTML_IMAGE_ONLY_28 1614 0.46 0.56 0.43 194 USER_IN_WELCOMELIST 1613 0.33 0.00 0.43 195 USER_IN_WHITELIST 1613 0.33 0.00 0.43 196 T_XMDrugObfuBody_00 1603 0.77 1.89 0.43 197 XMBody_17 1592 0.78 1.94 0.43 198 HTML_TAG_BALANCE_BODY 1582 0.49 0.70 0.43 199 HTML_IMAGE_ONLY_32 1566 0.38 0.24 0.42 200 RDNS_DYNAMIC 1520 0.56 1.04 0.41 ----------------------------------------------------------------------