Email: 477832 Autolearn: 0 AvgScore: 1.70 AvgScanTime: 1.44 sec Spam: 104191 Autolearn: 0 AvgScore: 12.90 AvgScanTime: 1.74 sec Ham: 373641 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.36 sec Time Spent Running SA: 190.96 hours Time Spent Processing Spam: 50.22 hours Time Spent Processing Ham: 140.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 98338 89.84 94.38 88.57 2 DKIM_SIGNED 89954 72.17 86.34 68.23 3 XM_DK_Pass 86082 70.10 82.62 66.61 4 RELAYCOUNTRY_US 84975 78.32 81.56 77.41 5 XM_B_Unicode 83961 73.53 80.58 71.57 6 DKIM_VALID 83137 68.00 79.79 64.71 7 DCC_CHECK 75599 44.53 72.56 36.72 8 XMListUnsubscribeExists 75051 50.61 72.03 44.64 9 XM_B_SpammyWords 74164 49.38 71.18 43.30 10 DKIM_VALID_AU 59727 50.27 57.32 48.30 11 BAYES_50 47613 49.77 45.70 50.91 12 XM_B_Unicode3 46599 42.82 44.72 42.29 13 XM_DK_Undo_02 41376 14.69 39.71 7.71 14 XM_B_SpammyWords2 41372 22.39 39.71 17.56 15 LOC_TINY_FONT_1 37898 24.57 36.37 21.28 16 HTML_FONT_LOW_CONTRAST 35201 26.70 33.79 24.72 17 FVGT_m_MULTI_ODD 32248 23.85 30.95 21.87 18 TR_XM_DKIM_Undo 32242 11.17 30.95 5.66 19 DKIM_VALID_EF 31632 25.61 30.36 24.28 20 T_KAM_HTML_FONT_INVALID 30617 20.00 29.39 17.39 21 BAYES_99 30103 13.34 28.89 9.01 22 MIME_HTML_ONLY 29048 24.12 27.88 23.07 23 DCC_CHECK_NEGATIVE 28566 55.43 27.42 63.24 24 XMSubLong 27211 24.75 26.12 24.36 25 RCVD_IN_MSPIKE_H2 27144 20.39 26.05 18.81 26 T_TM2_M_HEADER_IN_MSG 25777 27.15 24.74 27.82 27 RCVD_IN_MSPIKE_WL 24201 26.74 23.23 27.72 28 BAYES_999 22879 11.00 21.96 7.95 29 XM_Body_Dirty_Words 22325 13.62 21.43 11.45 30 TR_DCC_Bayes_99 21558 6.57 20.69 2.63 31 RELAYCOUNTRY_META 19791 7.22 18.99 3.93 32 XM_Multi_Part_URI 18390 12.36 17.65 10.88 33 BOTNET_IPINHOSTNAME 16917 7.06 16.24 4.50 34 LOTS_OF_MONEY 14882 8.93 14.28 7.44 35 RCVD_IN_MSPIKE_H3 14020 13.97 13.46 14.11 36 TR_XM_SpammyRelay 13885 4.28 13.33 1.76 37 XM_B_SpammyWords3 13148 5.93 12.62 4.07 38 UNPARSEABLE_RELAY 13132 8.61 12.60 7.49 39 TR_XM_SpammyWords4 12706 6.17 12.19 4.48 40 TR_XM_UnparsRelay 12685 7.30 12.17 5.94 41 XM_B_Unsub 12638 11.79 12.13 11.70 42 BOTNET 12433 4.00 11.93 1.79 43 FSL_BULK_SIG 11488 7.94 11.03 7.08 44 XM_Evil_Numbers_Gen 10543 8.06 10.12 7.49 45 XM_SendGrid 10385 7.37 9.97 6.65 46 RCVD_IN_BL_SPAMCOP_NET 10168 2.85 9.76 0.93 47 TR_XM_SpammyWords2 9818 2.91 9.42 1.09 48 RCVD_IN_MSPIKE_H4 9600 11.11 9.21 11.64 49 UNTRUSTED_Relay 9472 3.01 9.09 1.32 50 HTML_IMAGE_RATIO_02 9057 6.07 8.69 5.34 51 XMSexyCombo_05 8996 4.26 8.63 3.04 52 BAYES_80 8202 5.36 7.87 4.65 53 XM_UncommonTLD01 7946 4.15 7.63 3.18 54 LotsOfNums_01 7764 8.68 7.45 9.03 55 BAYES_60 7295 8.41 7.00 8.80 56 XMSubMetaSx_00 7214 4.70 6.92 4.08 57 XM_B_Phish_Phrases 6881 3.94 6.60 3.19 58 DKIM_INVALID 6817 4.18 6.54 3.52 59 TooManyTo_001 6745 8.05 6.47 8.49 60 XM_H_Long_From01 6744 4.94 6.47 4.52 61 MPART_ALT_DIFF 6744 5.29 6.47 4.96 62 TR_XM_PhishingBody 6719 3.73 6.45 2.97 63 TR_XM_SPAMCOP 6168 1.55 5.92 0.33 64 RELAYCOUNTRY_CA 5909 1.89 5.67 0.83 65 XM_B_Investor 5682 2.32 5.45 1.45 66 HTML_IMAGE_RATIO_04 5532 6.19 5.31 6.44 67 TR_XM_DK_SendGrid 5508 4.32 5.29 4.05 68 MIME_QP_LONG_LINE 5336 6.00 5.12 6.25 69 XM_SPF_SoftFail 5076 2.56 4.87 1.92 70 TM2_M_URI_OPT_OUT 5069 4.17 4.87 3.97 71 XM_B_SpammyTLD 4757 2.54 4.57 1.97 72 XMStrtUSub 4579 3.98 4.39 3.86 73 BAYES_95 4343 3.10 4.17 2.80 74 TR_XM_SpammyWords5 4319 2.05 4.15 1.47 75 XMNumbers 4288 3.24 4.12 3.00 76 HTML_MIME_NO_HTML_TAG 4230 5.24 4.06 5.57 77 XM_UB50 4145 1.50 3.98 0.81 78 MIME_HTML_MOSTLY 4143 2.83 3.98 2.51 79 XM_B_Phish66 4074 2.17 3.91 1.69 80 XM_OfRef6 4072 1.55 3.91 0.90 81 RCVD_IN_MSPIKE_BL 4007 0.93 3.85 0.12 82 MIME_HTML_ONLY_MULTI 3997 3.47 3.84 3.36 83 T_XMDrugObfuBody_08 3953 1.89 3.79 1.36 84 HTML_IMAGE_RATIO_06 3879 3.44 3.72 3.36 85 T_XMDrugObfuBody_14 3494 2.48 3.35 2.23 86 TR_XM_MSPIKECOMBO 3395 0.80 3.26 0.11 87 ALL_TRUSTED 3290 16.36 3.16 20.04 88 SpammyFromTLD_02 3274 0.99 3.14 0.39 89 HTML_IMAGE_RATIO_08 3201 2.73 3.07 2.63 90 XM_DIRTYINTL 3180 0.91 3.05 0.31 91 XM_B_Unsub2 2974 1.91 2.85 1.65 92 XM_B_COVIDMETA 2910 1.03 2.79 0.54 93 XM_B_SpammyWords4 2879 0.97 2.76 0.47 94 RCVD_IN_IADB_LISTED 2861 4.78 2.75 5.35 95 RCVD_IN_RP_RNBL 2850 0.62 2.74 0.02 96 MAILING_LIST_MULTI 2840 2.95 2.73 3.01 97 XM_GoogleGroups 2828 1.89 2.71 1.66 98 T_TooManySym_01 2773 4.59 2.66 5.13 99 XMDiploma_00 2769 1.55 2.66 1.24 100 TR_XM_SB_Phish 2763 2.27 2.65 2.17 101 XMSubPhish11 2708 2.24 2.60 2.14 102 XM_CamelCaseFrm001 2704 1.85 2.60 1.64 103 XMSexyCombo_01 2632 1.68 2.53 1.44 104 KHOP_HELO_FCRDNS 2618 1.70 2.51 1.48 105 TR_XM_NoHeaderRelay 2600 0.70 2.50 0.20 106 XM_URI_RBL 2597 0.66 2.49 0.15 107 BAYES_40 2579 4.60 2.48 5.20 108 RCVD_IN_IADB_SPF 2532 4.19 2.43 4.67 109 XM_DK_Undo_01 2524 1.77 2.42 1.59 110 TM2_M_VERY_LONG_WORD 2509 1.39 2.41 1.11 111 URIBL_DBL_SPAM 2457 0.52 2.36 0.01 112 XMBody_17 2443 0.84 2.34 0.42 113 HTML_IMAGE_ONLY_20 2432 1.68 2.33 1.50 114 T_REMOTE_IMAGE 2428 3.00 2.33 3.19 115 TR_LOTS_OF_MONEY3 2404 0.82 2.31 0.41 116 RCVD_IN_IADB_DK 2401 3.67 2.30 4.05 117 RCVD_IN_IADB_SENDERID 2378 3.76 2.28 4.18 118 RCVD_IN_VALIDITY_RPBL 2348 0.51 2.25 0.02 119 TR_XM_PHPDW 2322 0.76 2.23 0.35 120 XMStockSpam_06 2302 1.46 2.21 1.25 121 HTML_TITLE_SUBJ_DIFF 2286 0.84 2.19 0.46 122 XM_UB99 2237 0.47 2.15 0.00 123 TR_XM_PHPForged 2227 0.70 2.14 0.30 124 SpammyFromTLD_01 2219 0.98 2.13 0.66 125 URI_NOVOWEL 2213 2.61 2.12 2.74 126 TR_XM_FormFill2 2212 0.70 2.12 0.31 127 XM_H_PHPOS 2192 0.69 2.10 0.30 128 HTML_SHORT_LINK_IMG_3 2183 0.85 2.10 0.50 129 BOTNET_NORDNS 2181 0.47 2.09 0.02 130 T_FILL_THIS_FORM_SHORT 2117 1.06 2.03 0.79 131 TR_Symld_Words 2106 2.42 2.02 2.53 132 SUBJ_ALL_CAPS 2034 1.86 1.95 1.83 133 TR_XM_SpammyWords3 2015 0.47 1.93 0.07 134 URI_HEX 2014 1.50 1.93 1.38 135 URIBL_BLACK 1957 0.45 1.88 0.05 136 RCVD_IN_RP_SAFE 1802 5.84 1.73 6.99 137 PDS_OTHER_BAD_TLD 1768 0.64 1.70 0.35 138 BAYES_20 1735 3.68 1.67 4.24 139 TR_XM_COVIDMETA4 1719 0.60 1.65 0.31 140 RCVD_IN_MSPIKE_L3 1693 0.43 1.62 0.10 141 TR_XM_INV_DKIM 1681 0.58 1.61 0.29 142 FROM_EXCESS_BASE64 1657 2.16 1.59 2.31 143 T_XMDrugObfuBody_00 1644 0.95 1.58 0.78 144 XMGenDplmaNmb 1627 0.88 1.56 0.68 145 XM_UB999 1611 0.34 1.55 0.00 146 T_XMHurry_00 1581 0.64 1.52 0.40 147 XMHTML_After_End 1568 0.91 1.50 0.75 148 RELAYCOUNTRY_FR 1556 0.48 1.49 0.20 149 RELAYCOUNTRY_AU 1516 0.60 1.46 0.37 150 RCVD_IN_MSPIKE_L5 1493 0.32 1.43 0.01 151 TM2_M_A_HREF_HREF 1456 0.77 1.40 0.59 152 TR_XM_COVIDMETA1 1421 0.47 1.36 0.22 153 RCVD_IN_PSBL 1406 0.38 1.35 0.11 154 XMBrknScrpt_02 1401 0.96 1.34 0.85 155 XM_Body_Dirty_Words_01 1390 0.43 1.33 0.18 156 TR_XM_BayesRelay 1389 0.30 1.33 0.01 157 BAYES_00 1368 9.78 1.31 12.14 158 HTML_IMAGE_ONLY_16 1342 0.47 1.29 0.25 159 URI_TRY_3LD 1294 0.90 1.24 0.81 160 HTTPS_HTTP_MISMATCH 1292 0.87 1.24 0.77 161 RELAYCOUNTRY_GB 1258 0.95 1.21 0.87 162 XMPhish30 1242 0.73 1.19 0.61 163 TR_MetaPhish_Combo_01 1240 0.77 1.19 0.65 164 URI_PHP_REDIR 1239 0.27 1.19 0.01 165 T_Symld_Words_02 1233 0.63 1.18 0.48 166 XM_H_PHPMailer 1226 0.61 1.18 0.45 167 RELAYCOUNTRY_CN 1178 0.34 1.13 0.12 168 RCVD_IN_IADB_VOUCHED 1170 2.80 1.12 3.27 169 TR_Mismatch_TLD_02 1156 0.32 1.11 0.10 170 DEAR_SOMETHING 1138 0.37 1.09 0.17 171 SHOPIFY_IMG_NOT_RCVD_SFY 1114 0.38 1.07 0.18 172 MONEY_NOHTML 1095 0.29 1.05 0.08 173 HK_RANDOM_REPLYTO 1091 0.32 1.05 0.11 174 ANY_BOUNCE_MESSAGE 1074 3.42 1.03 4.08 175 BOUNCE_MESSAGE 1072 3.42 1.03 4.08 176 RELAYCOUNTRY_RU 1067 0.24 1.02 0.02 177 XM_H_Long_From02 1066 1.15 1.02 1.18 178 XM_PDF 1062 3.88 1.02 4.68 179 DIET_1 1056 0.50 1.01 0.36 180 TR_BOTNET_NEGATE 1047 0.42 1.00 0.26 181 XMMoneyMeta_00 1033 0.66 0.99 0.57 182 NO_DNS_FOR_FROM 1026 0.41 0.98 0.26 183 XM_ProductURIs 1022 0.96 0.98 0.95 184 XMBdyGiftCard01 1016 1.18 0.98 1.24 185 TR_XM_MaxWHORU 1006 0.36 0.97 0.19 186 XM_H_Undi_Recip 1000 0.32 0.96 0.15 187 THIS_AD 1000 0.35 0.96 0.19 188 MISSING_HEADERS 996 0.50 0.96 0.38 189 DKIM_ADSP_CUSTOM_MED 973 0.94 0.93 0.94 190 HELO_NODOT 966 1.45 0.93 1.60 191 HELO_NO_DOMAIN 963 1.45 0.92 1.60 192 USER_IN_DEF_DKIM_WL 958 8.86 0.92 11.07 193 RCVD_IN_RP_CERTIFIED 953 5.04 0.91 6.19 194 FROM_SUSPICIOUS_NTLD 934 0.23 0.90 0.05 195 BAYES_05 932 1.95 0.89 2.25 196 XM_B_SEO 927 0.34 0.89 0.19 197 XM_S_SpammyWords 922 0.38 0.88 0.24 198 TR_XM_Spammywords 922 0.38 0.88 0.24 199 MPART_ALT_DIFF_COUNT 908 0.49 0.87 0.39 200 RCVD_IN_VALIDITY_SAFE 904 4.87 0.87 5.99 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 330943 89.84 94.38 88.57 2 RELAYCOUNTRY_US 289242 78.32 81.56 77.41 3 XM_B_Unicode 267410 73.53 80.58 71.57 4 DKIM_SIGNED 254919 72.17 86.34 68.23 5 XM_DK_Pass 248875 70.10 82.62 66.61 6 DKIM_VALID 241778 68.00 79.79 64.71 7 DCC_CHECK_NEGATIVE 236298 55.43 27.42 63.24 8 BAYES_50 190205 49.77 45.70 50.91 9 DKIM_VALID_AU 180479 50.27 57.32 48.30 10 XMListUnsubscribeExists 166783 50.61 72.03 44.64 11 XM_B_SpammyWords 161788 49.38 71.18 43.30 12 XM_B_Unicode3 158012 42.82 44.72 42.29 13 DCC_CHECK 137189 44.53 72.56 36.72 14 T_TM2_M_HEADER_IN_MSG 103962 27.15 24.74 27.82 15 RCVD_IN_MSPIKE_WL 103581 26.74 23.23 27.72 16 HTML_FONT_LOW_CONTRAST 92366 26.70 33.79 24.72 17 XMSubLong 91033 24.75 26.12 24.36 18 DKIM_VALID_EF 90728 25.61 30.36 24.28 19 MIME_HTML_ONLY 86212 24.12 27.88 23.07 20 FVGT_m_MULTI_ODD 81725 23.85 30.95 21.87 21 LOC_TINY_FONT_1 79504 24.57 36.37 21.28 22 ALL_TRUSTED 74879 16.36 3.16 20.04 23 RCVD_IN_MSPIKE_H2 70276 20.39 26.05 18.81 24 XM_B_SpammyWords2 65599 22.39 39.71 17.56 25 T_KAM_HTML_FONT_INVALID 64970 20.00 29.39 17.39 26 RCVD_IN_MSPIKE_H3 52724 13.97 13.46 14.11 27 BAYES_00 45374 9.78 1.31 12.14 28 XM_B_Unsub 43707 11.79 12.13 11.70 29 RCVD_IN_MSPIKE_H4 43477 11.11 9.21 11.64 30 XM_Body_Dirty_Words 42766 13.62 21.43 11.45 31 USER_IN_DEF_DKIM_WL 41375 8.86 0.92 11.07 32 XM_Multi_Part_URI 40650 12.36 17.65 10.88 33 LotsOfNums_01 33730 8.68 7.45 9.03 34 BAYES_99 33653 13.34 28.89 9.01 35 BAYES_60 32867 8.41 7.00 8.80 36 TooManyTo_001 31713 8.05 6.47 8.49 37 BAYES_999 29686 11.00 21.96 7.95 38 XM_DK_Undo_02 28814 14.69 39.71 7.71 39 UNPARSEABLE_RELAY 27987 8.61 12.60 7.49 40 XM_Evil_Numbers_Gen 27986 8.06 10.12 7.49 41 LOTS_OF_MONEY 27785 8.93 14.28 7.44 42 TR_XM_DK_Bayes 26844 5.80 0.84 7.18 43 FSL_BULK_SIG 26461 7.94 11.03 7.08 44 RCVD_IN_RP_SAFE 26123 5.84 1.73 6.99 45 TR_XM_DK_Bayes1 26063 5.63 0.82 6.98 46 XM_DKIMWhitelistDomains 25147 5.27 0.02 6.73 47 XM_SendGrid 24848 7.37 9.97 6.65 48 HTML_IMAGE_RATIO_04 24048 6.19 5.31 6.44 49 MIME_QP_LONG_LINE 23346 6.00 5.12 6.25 50 RCVD_IN_RP_CERTIFIED 23138 5.04 0.91 6.19 51 IN_ZIMBRA_NJ_WHITELIST 23069 4.85 0.10 6.17 52 TR_XM_DK_Bayes2 22511 4.86 0.71 6.02 53 RCVD_IN_VALIDITY_SAFE 22381 4.87 0.87 5.99 54 TR_XM_UnparsRelay 22181 7.30 12.17 5.94 55 XM_H_Trusted_IP 21561 4.51 0.00 5.77 56 TR_XM_DKIM_Undo 21150 11.17 30.95 5.66 57 HTML_MIME_NO_HTML_TAG 20814 5.24 4.06 5.57 58 RCVD_IN_IADB_LISTED 19972 4.78 2.75 5.35 59 HTML_IMAGE_RATIO_02 19958 6.07 8.69 5.34 60 RCVD_IN_VALIDITY_CERTIFIED 19794 4.21 0.29 5.30 61 BAYES_40 19422 4.60 2.48 5.20 62 T_TooManySym_01 19164 4.59 2.66 5.13 63 MPART_ALT_DIFF 18519 5.29 6.47 4.96 64 XM_PDF 17479 3.88 1.02 4.68 65 RCVD_IN_IADB_SPF 17466 4.19 2.43 4.67 66 BAYES_80 17389 5.36 7.87 4.65 67 XM_H_Long_From01 16871 4.94 6.47 4.52 68 BOTNET_IPINHOSTNAME 16824 7.06 16.24 4.50 69 TR_XM_SpammyWords4 16755 6.17 12.19 4.48 70 BAYES_20 15856 3.68 1.67 4.24 71 RCVD_IN_IADB_SENDERID 15606 3.76 2.28 4.18 72 ANY_BOUNCE_MESSAGE 15251 3.42 1.03 4.08 73 BOUNCE_MESSAGE 15248 3.42 1.03 4.08 74 XMSubMetaSx_00 15242 4.70 6.92 4.08 75 XM_B_SpammyWords3 15196 5.93 12.62 4.07 76 TR_XM_DK_SendGrid 15123 4.32 5.29 4.05 77 RCVD_IN_IADB_DK 15118 3.67 2.30 4.05 78 TM2_M_URI_OPT_OUT 14852 4.17 4.87 3.97 79 RELAYCOUNTRY_META 14690 7.22 18.99 3.93 80 XMStrtUSub 14417 3.98 4.39 3.86 81 DKIM_INVALID 13141 4.18 6.54 3.52 82 MIME_HTML_ONLY_MULTI 12564 3.47 3.84 3.36 83 HTML_IMAGE_RATIO_06 12536 3.44 3.72 3.36 84 RCVD_IN_IADB_VOUCHED 12233 2.80 1.12 3.27 85 XM_B_Phish_Phrases 11926 3.94 6.60 3.19 86 T_REMOTE_IMAGE 11922 3.00 2.33 3.19 87 XM_UncommonTLD01 11897 4.15 7.63 3.18 88 XMSubNoVowel 11414 2.57 0.81 3.05 89 XMSexyCombo_05 11341 4.26 8.63 3.04 90 MAILING_LIST_MULTI 11248 2.95 2.73 3.01 91 XMNumbers 11215 3.24 4.12 3.00 92 TR_XM_PhishingBody 11089 3.73 6.45 2.97 93 T_HTML_ATTACH 10909 2.39 0.49 2.92 94 T_TooManySym_02 10733 2.40 0.72 2.87 95 UNICODE_OBFU_ZW 10689 2.29 0.23 2.86 96 BAYES_95 10461 3.10 4.17 2.80 97 URI_NOVOWEL 10241 2.61 2.12 2.74 98 TR_DCC_Bayes_99 9830 6.57 20.69 2.63 99 HTML_IMAGE_RATIO_08 9823 2.73 3.07 2.63 100 TR_Symld_Words 9439 2.42 2.02 2.53 101 MIME_HTML_MOSTLY 9368 2.83 3.98 2.51 102 FROM_EXCESS_BASE64 8645 2.16 1.59 2.31 103 BAYES_05 8403 1.95 0.89 2.25 104 T_XMDrugObfuBody_14 8337 2.48 3.35 2.23 105 TR_XM_SB_Phish 8098 2.27 2.65 2.17 106 XMSubPhish11 7997 2.24 2.60 2.14 107 RCVD_IN_IADB_OPTIN 7800 1.80 0.76 2.09 108 TVD_SPACE_RATIO_MINFP 7623 1.66 0.30 2.04 109 TooManyTo_002 7443 1.73 0.80 1.99 110 RCVD_IN_MSPIKE_H5 7380 1.67 0.56 1.98 111 XM_B_SpammyTLD 7375 2.54 4.57 1.97 112 XM_SPF_SoftFail 7170 2.56 4.87 1.92 113 SUBJ_ALL_CAPS 6832 1.86 1.95 1.83 114 BOTNET 6704 4.00 11.93 1.79 115 TR_XM_SpammyRelay 6585 4.28 13.33 1.76 116 INVALID_MSGID 6487 1.41 0.22 1.74 117 IN_HORDE_ADDRESS_BOOK 6393 1.36 0.11 1.71 118 XM_B_Phish66 6305 2.17 3.91 1.69 119 XM_GoogleGroups 6217 1.89 2.71 1.66 120 XM_B_Unsub2 6155 1.91 2.85 1.65 121 XM_CamelCaseFrm001 6125 1.85 2.60 1.64 122 MSGID_NOFQDN1 6011 1.27 0.07 1.61 123 HELO_NODOT 5971 1.45 0.93 1.60 124 HELO_NO_DOMAIN 5966 1.45 0.92 1.60 125 XM_DK_Undo_01 5924 1.77 2.42 1.59 126 TO_MALFORMED 5724 1.21 0.05 1.53 127 HTML_IMAGE_ONLY_20 5614 1.68 2.33 1.50 128 KHOP_HELO_FCRDNS 5513 1.70 2.51 1.48 129 TR_XM_SpammyWords5 5495 2.05 4.15 1.47 130 XM_B_Investor 5407 2.32 5.45 1.45 131 TVD_RCVD_IP 5383 1.20 0.33 1.44 132 XMSexyCombo_01 5374 1.68 2.53 1.44 133 URI_HEX 5154 1.50 1.93 1.38 134 TooManyTo_003 5108 1.21 0.64 1.37 135 T_XMDrugObfuBody_08 5080 1.89 3.79 1.36 136 UNTRUSTED_Relay 4925 3.01 9.09 1.32 137 HTML_FONT_FACE_BAD 4779 1.15 0.70 1.28 138 XMStockSpam_06 4673 1.46 2.21 1.25 139 XMDiploma_00 4624 1.55 2.66 1.24 140 XMBdyGiftCard01 4620 1.18 0.98 1.24 141 XMGappySubj_01 4427 0.96 0.15 1.18 142 XM_H_Long_From02 4414 1.15 1.02 1.18 143 TM2_M_VERY_LONG_WORD 4154 1.39 2.41 1.11 144 XMCapTrack 4153 0.97 0.44 1.11 145 TR_XM_SpammyWords2 4071 2.91 9.42 1.09 146 XMBSHREFv2 3691 0.85 0.37 0.99 147 TooManyTo_004 3620 0.87 0.53 0.97 148 XM_ProductURIs 3553 0.96 0.98 0.95 149 DKIM_ADSP_CUSTOM_MED 3510 0.94 0.93 0.94 150 RCVD_IN_BL_SPAMCOP_NET 3460 2.85 9.76 0.93 151 XM_OfRef6 3345 1.55 3.91 0.90 152 RELAYCOUNTRY_GB 3262 0.95 1.21 0.87 153 XMBrknScrpt_02 3194 0.96 1.34 0.85 154 RELAYCOUNTRY_CA 3106 1.89 5.67 0.83 155 XMSubMetaSxObfu_03 3099 0.80 0.68 0.83 156 TVD_SPACE_RATIO 3042 0.67 0.15 0.81 157 XM_UB50 3029 1.50 3.98 0.81 158 URI_TRY_3LD 3025 0.90 1.24 0.81 159 T_FILL_THIS_FORM_SHORT 2950 1.06 2.03 0.79 160 TooManyTo_005 2929 0.71 0.45 0.78 161 T_TooManySym_03 2920 0.67 0.28 0.78 162 T_XMDrugObfuBody_00 2910 0.95 1.58 0.78 163 FROM_GOV_DKIM_AU 2875 0.63 0.11 0.77 164 HTTPS_HTTP_MISMATCH 2859 0.87 1.24 0.77 165 XMBody_95 2837 0.64 0.20 0.76 166 XMHTML_After_End 2803 0.91 1.50 0.75 167 XMNoVowels 2787 0.72 0.63 0.75 168 LOW_PRICE 2580 0.62 0.36 0.69 169 XMLngstWrd_00 2569 0.63 0.41 0.69 170 XMGenDplmaNmb 2555 0.88 1.56 0.68 171 XM_RXBody 2510 0.60 0.35 0.67 172 SpammyFromTLD_01 2465 0.98 2.13 0.66 173 TR_MetaPhish_Combo_01 2421 0.77 1.19 0.65 174 XMPhish30 2262 0.73 1.19 0.61 175 TM2_M_A_HREF_HREF 2217 0.77 1.40 0.59 176 NML_ADSP_CUSTOM_MED 2147 0.63 0.82 0.57 177 XM_ShortIntro_01 2116 0.60 0.71 0.57 178 XMMoneyMeta_00 2114 0.66 0.99 0.57 179 T_OBFU_PDF_ATTACH 2099 0.47 0.14 0.56 180 XM_B_COPY_HTML 2059 0.58 0.68 0.55 181 XMSubMetaI_00 2056 0.59 0.73 0.55 182 XM_D_tchamptons_WL 2021 0.42 0.00 0.54 183 RCVD_IN_SORBS_DUL 2015 0.57 0.67 0.54 184 XMSexyCombo_04 2014 0.57 0.67 0.54 185 XM_B_COVIDMETA 2001 1.03 2.79 0.54 186 SHORT_URI_3 1992 0.48 0.30 0.53 187 TR_MSPIKEBAYES00 1980 0.42 0.02 0.53 188 XMLngstWrd_01 1979 0.49 0.37 0.53 189 HTML_TAG_BALANCE_BODY 1961 0.56 0.68 0.52 190 FORGED_GMAIL_RCVD 1931 0.58 0.82 0.52 191 HTML_SHORT_LINK_IMG_3 1880 0.85 2.10 0.50 192 XMHTMLBadTable_001 1815 0.52 0.65 0.49 193 T_Symld_Words_02 1800 0.63 1.18 0.48 194 XM_B_SpammyWords4 1759 0.97 2.76 0.47 195 HTML_TITLE_SUBJ_DIFF 1726 0.84 2.19 0.46 196 XM_B_DNDMA 1695 0.53 0.78 0.45 197 XM_H_PHPMailer 1695 0.61 1.18 0.45 198 SHORT_HELO_AND_INLINE_IMAGE 1663 0.37 0.10 0.45 199 USER_IN_WHITELIST 1629 0.34 0.00 0.44 200 USER_IN_WELCOMELIST 1629 0.34 0.00 0.44 ----------------------------------------------------------------------