Email: 508032 Autolearn: 0 AvgScore: 1.95 AvgScanTime: 1.40 sec Spam: 117035 Autolearn: 0 AvgScore: 13.19 AvgScanTime: 1.63 sec Ham: 390997 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 1.33 sec Time Spent Running SA: 197.60 hours Time Spent Processing Spam: 53.01 hours Time Spent Processing Ham: 144.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 112605 90.12 96.21 88.29 2 DKIM_SIGNED 101435 74.37 86.67 70.69 3 XM_DK_Pass 96819 72.29 82.73 69.16 4 DKIM_VALID 94254 70.19 80.53 67.10 5 RELAYCOUNTRY_US 93391 79.55 79.80 79.48 6 XM_B_Unicode 89058 71.90 76.10 70.65 7 DCC_CHECK 88459 47.28 75.58 38.80 8 XM_B_SpammyWords 85018 50.90 72.64 44.40 9 XMListUnsubscribeExists 83191 51.51 71.08 45.66 10 DKIM_VALID_AU 69398 52.55 59.30 50.53 11 BAYES_50 54224 51.74 46.33 53.36 12 XM_B_Unicode3 50320 41.79 43.00 41.43 13 XM_DK_Undo_02 47238 14.61 40.36 6.90 14 XM_B_SpammyWords2 44152 22.90 37.73 18.47 15 LOC_TINY_FONT_1 42059 26.22 35.94 23.31 16 HTML_FONT_LOW_CONTRAST 40035 27.08 34.21 24.95 17 TR_XM_DKIM_Undo 38005 11.74 32.47 5.54 18 T_KAM_HTML_FONT_INVALID 36714 20.64 31.37 17.43 19 FVGT_m_MULTI_ODD 34473 23.59 29.46 21.84 20 DKIM_VALID_EF 34179 26.56 29.20 25.77 21 MIME_HTML_ONLY 33537 23.29 28.66 21.68 22 BAYES_99 32610 11.92 27.86 7.15 23 RCVD_IN_MSPIKE_H2 29879 21.56 25.53 20.37 24 XMSubLong 28821 21.71 24.63 20.84 25 DCC_CHECK_NEGATIVE 28541 52.68 24.39 61.14 26 T_TM2_M_HEADER_IN_MSG 26706 27.96 22.82 29.50 27 RCVD_IN_MSPIKE_WL 26341 26.61 22.51 27.83 28 BAYES_999 24977 9.64 21.34 6.14 29 RELAYCOUNTRY_META 24883 8.04 21.26 4.08 30 TR_DCC_Bayes_99 24873 6.99 21.25 2.72 31 XM_Body_Dirty_Words 23361 13.77 19.96 11.91 32 XM_Multi_Part_URI 20135 12.19 17.20 10.69 33 TR_XM_SpammyRelay 17840 5.01 15.24 1.95 34 XM_B_Unsub 17198 12.67 14.69 12.06 35 BOTNET_IPINHOSTNAME 16916 6.29 14.45 3.85 36 BOTNET 16228 4.27 13.87 1.40 37 RCVD_IN_MSPIKE_H3 16075 14.53 13.74 14.76 38 XM_B_SpammyWords3 15814 5.96 13.51 3.70 39 UNPARSEABLE_RELAY 15260 9.09 13.04 7.90 40 LOTS_OF_MONEY 14897 9.31 12.73 8.28 41 TR_XM_UnparsRelay 14675 7.64 12.54 6.18 42 UNTRUSTED_Relay 13807 3.81 11.80 1.42 43 FSL_BULK_SIG 13347 8.44 11.40 7.55 44 XM_UncommonTLD01 12784 5.03 10.92 3.27 45 MPART_ALT_DIFF 12648 6.58 10.81 5.32 46 TR_XM_SpammyWords4 12642 5.75 10.80 4.23 47 XM_SendGrid 12007 7.83 10.26 7.10 48 XM_Evil_Numbers_Gen 11378 8.24 9.72 7.80 49 RCVD_IN_BL_SPAMCOP_NET 11326 3.02 9.68 1.03 50 TR_XM_SpammyWords2 11216 3.16 9.58 1.24 51 HTML_IMAGE_RATIO_02 10587 6.36 9.05 5.55 52 XMSexyCombo_05 9943 4.73 8.50 3.60 53 RCVD_IN_MSPIKE_H4 9758 10.49 8.34 11.14 54 MIME_HTML_MOSTLY 9595 3.81 8.20 2.49 55 LotsOfNums_01 9304 8.75 7.95 8.99 56 BAYES_80 8962 4.82 7.66 3.98 57 TR_XM_PhishingBody 8891 4.52 7.60 3.59 58 BAYES_60 8516 8.12 7.28 8.37 59 XMSubMetaSx_00 7784 4.49 6.65 3.84 60 TooManyTo_001 7542 9.37 6.44 10.25 61 XM_UB50 7450 2.20 6.37 0.96 62 XM_B_Phish_Phrases 7276 4.57 6.22 4.08 63 DKIM_INVALID 7181 4.18 6.14 3.59 64 TR_XM_DK_SendGrid 7019 4.81 6.00 4.46 65 XM_H_Long_From01 6904 5.40 5.90 5.25 66 TR_XM_SPAMCOP 6537 1.74 5.59 0.58 67 XMStrtUSub 6330 4.16 5.41 3.79 68 RELAYCOUNTRY_CA 6241 1.93 5.33 0.91 69 URI_NOVOWEL 6163 3.18 5.27 2.56 70 XM_SPF_SoftFail 5900 2.82 5.04 2.15 71 MIME_QP_LONG_LINE 5633 5.89 4.81 6.21 72 HTML_IMAGE_RATIO_04 5600 5.28 4.78 5.43 73 SpammyFromTLD_01 5517 1.70 4.71 0.80 74 TM2_M_URI_OPT_OUT 5358 4.09 4.58 3.95 75 TR_XM_MaxUnsub 5309 1.82 4.54 1.01 76 SpammyFromTLD_02 4943 1.28 4.22 0.41 77 HTML_IMAGE_RATIO_06 4866 4.61 4.16 4.74 78 HTML_MIME_NO_HTML_TAG 4859 2.97 4.15 2.62 79 XMNumbers 4802 3.47 4.10 3.28 80 BAYES_95 4724 2.83 4.04 2.47 81 TR_XM_SpammyWords5 4583 1.95 3.92 1.36 82 MIME_HTML_ONLY_MULTI 4537 3.56 3.88 3.47 83 RCVD_IN_MSPIKE_BL 4533 1.24 3.87 0.45 84 XM_B_Phish66 4507 2.48 3.85 2.07 85 XM_B_Investor 4449 2.00 3.80 1.46 86 TR_XM_NoHeaderRelay 4374 1.00 3.74 0.18 87 HTML_IMAGE_ONLY_20 3913 1.73 3.34 1.25 88 XM_B_SpammyTLD 3869 2.29 3.31 1.99 89 XM_URI_RBL 3743 0.85 3.20 0.15 90 XM_GoogleGroups 3684 2.09 3.15 1.77 91 TR_XM_MSPIKECOMBO 3641 1.06 3.11 0.44 92 T_XMDrugObfuBody_08 3613 1.92 3.09 1.58 93 XMDiploma_00 3473 2.69 2.97 2.60 94 RCVD_IN_IADB_LISTED 3472 4.66 2.97 5.16 95 T_TooManySym_01 3410 5.05 2.91 5.69 96 URIBL_DBL_SPAM 3403 0.67 2.91 0.01 97 JH_SPAMMY_HEADERS 3299 0.65 2.82 0.00 98 T_XMDrugObfuBody_14 3233 2.28 2.76 2.14 99 HTML_IMAGE_RATIO_08 3198 2.89 2.73 2.94 100 XM_B_SpammyWords4 3107 0.96 2.65 0.45 101 HTML_SHORT_LINK_IMG_3 3106 1.04 2.65 0.56 102 HTML_TITLE_SUBJ_DIFF 3081 1.02 2.63 0.54 103 BAYES_40 3066 4.75 2.62 5.39 104 RCVD_IN_IADB_SPF 3032 4.06 2.59 4.50 105 KHOP_HELO_FCRDNS 2947 1.79 2.52 1.58 106 XM_B_Unsub2 2932 1.78 2.51 1.56 107 ALL_TRUSTED 2909 14.29 2.49 17.82 108 MAILING_LIST_MULTI 2876 2.63 2.46 2.68 109 XM_OfRef6 2864 1.18 2.45 0.81 110 TR_XM_SB_Phish 2851 2.24 2.44 2.18 111 XM_CamelCaseFrm001 2807 1.89 2.40 1.74 112 RCVD_IN_IADB_DK 2797 3.54 2.39 3.88 113 TM2_M_VERY_LONG_WORD 2782 1.41 2.38 1.12 114 RCVD_IN_RP_RNBL 2778 0.62 2.37 0.10 115 XM_DK_Undo_01 2772 1.95 2.37 1.83 116 XMSubPhish11 2766 2.20 2.36 2.15 117 RCVD_IN_IADB_SENDERID 2764 3.64 2.36 4.02 118 T_REMOTE_IMAGE 2760 3.24 2.36 3.51 119 XM_DIRTYINTL 2750 0.78 2.35 0.31 120 XMSexyCombo_01 2647 1.35 2.26 1.08 121 RCVD_IN_RP_SAFE 2569 5.61 2.20 6.63 122 XM_B_COVIDMETA 2480 1.01 2.12 0.68 123 TR_Symld_Words 2456 1.84 2.10 1.77 124 XMBody_17 2439 0.74 2.08 0.33 125 URI_HEX 2417 1.55 2.07 1.40 126 BOTNET_NORDNS 2408 0.49 2.06 0.01 127 RCVD_IN_VALIDITY_RPBL 2328 0.52 1.99 0.08 128 SUBJ_ALL_CAPS 2294 1.64 1.96 1.54 129 TR_XM_PHPDW 2193 0.69 1.87 0.33 130 RELAYCOUNTRY_IN 2157 0.51 1.84 0.11 131 BAYES_20 2138 3.50 1.83 4.00 132 TR_XM_PHPForged 2091 0.64 1.79 0.30 133 URIBL_BLACK 2081 0.44 1.78 0.04 134 TR_XM_SpammyWords3 2077 0.59 1.77 0.23 135 TR_XM_FormFill2 2060 0.64 1.76 0.30 136 XM_H_PHPOS 2050 0.63 1.75 0.29 137 XM_UB99 2031 0.40 1.74 0.00 138 T_XMDrugObfuBody_00 2027 1.01 1.73 0.80 139 T_FILL_THIS_FORM_SHORT 2018 1.05 1.72 0.85 140 RCVD_IN_MSPIKE_L3 1996 0.67 1.71 0.36 141 RELAYCOUNTRY_AU 1986 0.70 1.70 0.40 142 XMStockSpam_06 1966 1.22 1.68 1.09 143 TR_XM_COVIDMETA4 1881 0.60 1.61 0.30 144 XM_UB60 1871 0.42 1.60 0.07 145 FROM_EXCESS_BASE64 1862 2.17 1.59 2.34 146 RELAYCOUNTRY_FR 1861 0.52 1.59 0.20 147 RCVD_IN_IADB_VOUCHED 1753 2.79 1.50 3.17 148 TR_XM_COVIDMETA1 1709 0.60 1.46 0.35 149 URI_LONG_REPEAT 1703 0.34 1.46 0.00 150 BAYES_00 1701 10.25 1.45 12.88 151 XMBrknScrpt_02 1699 0.85 1.45 0.68 152 TR_XM_INV_DKIM 1651 0.45 1.41 0.17 153 XM_UB999 1635 0.32 1.40 0.00 154 XMGenDplmaNmb 1619 0.95 1.38 0.82 155 TR_XM_BayesRelay 1579 0.31 1.35 0.00 156 XMHTML_After_End 1572 0.83 1.34 0.68 157 RELAYCOUNTRY_CN 1571 0.38 1.34 0.09 158 T_XMHurry_00 1562 0.69 1.33 0.50 159 RCVD_IN_RP_CERTIFIED 1552 4.86 1.33 5.92 160 HTTPS_HTTP_MISMATCH 1521 0.90 1.30 0.78 161 XM_XX_Yahoo 1505 0.35 1.29 0.07 162 RCVD_IN_VALIDITY_SAFE 1505 4.67 1.29 5.69 163 XM_Body_Dirty_Words_01 1444 0.40 1.23 0.15 164 XMPhish30 1427 0.72 1.22 0.57 165 TR_LOTS_OF_MONEY2 1426 0.38 1.22 0.13 166 T_MONEY_PERCENT 1426 0.38 1.22 0.13 167 TR_LOTS_OF_MONEY3 1406 0.42 1.20 0.19 168 XMSubNoVowel 1394 2.15 1.19 2.44 169 T_XMDrugObfuBody_12 1386 0.39 1.18 0.15 170 RELAYCOUNTRY_GB 1377 0.93 1.18 0.86 171 TR_MetaPhish_Combo_01 1368 0.95 1.17 0.88 172 USER_IN_DEF_DKIM_WL 1358 8.58 1.16 10.80 173 RCVD_IN_PSBL 1339 0.35 1.14 0.11 174 T_Symld_Words_02 1321 0.71 1.13 0.59 175 XM_PDF 1284 4.22 1.10 5.16 176 DIET_1 1265 0.55 1.08 0.39 177 URI_TRY_3LD 1249 0.71 1.07 0.60 178 XM_H_Long_From02 1248 1.15 1.07 1.18 179 XMPhish14 1247 0.65 1.07 0.53 180 TR_BOTNET_NEGATE 1238 0.41 1.06 0.22 181 XM_BadFromFormat 1226 0.34 1.05 0.13 182 XMMoneyMeta_00 1225 0.64 1.05 0.52 183 TM2_M_A_HREF_HREF 1220 0.51 1.04 0.35 184 PDS_OTHER_BAD_TLD 1208 0.45 1.03 0.27 185 MIME_CHARSET_FARAWAY 1204 0.36 1.03 0.16 186 XMSubMetaI_00 1197 0.56 1.02 0.42 187 RCVD_IN_IADB_OPTIN 1168 1.83 1.00 2.08 188 MISSING_HEADERS 1161 0.57 0.99 0.44 189 PLING_QUERY 1116 0.53 0.95 0.41 190 RCVD_IN_MSPIKE_L5 1091 0.22 0.93 0.01 191 BAYES_05 1090 2.06 0.93 2.40 192 SHOPIFY_IMG_NOT_RCVD_SFY 1085 0.37 0.93 0.20 193 TR_XM_FormFill 1072 0.23 0.92 0.03 194 NO_DNS_FOR_FROM 1067 0.41 0.91 0.27 195 XM_UB80 1065 0.23 0.91 0.02 196 HTML_FONT_FACE_BAD 1060 1.00 0.91 1.03 197 RELAYCOUNTRY_NL 1057 0.39 0.90 0.24 198 RELAYCOUNTRY_RU 1040 0.25 0.89 0.06 199 XM_B_SEO 1038 0.32 0.89 0.14 200 RELAYCOUNTRY_PL 1035 0.22 0.88 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 345216 90.12 96.21 88.29 2 RELAYCOUNTRY_US 310751 79.55 79.80 79.48 3 DKIM_SIGNED 276389 74.37 86.67 70.69 4 XM_B_Unicode 276234 71.90 76.10 70.65 5 XM_DK_Pass 270416 72.29 82.73 69.16 6 DKIM_VALID 262349 70.19 80.53 67.10 7 DCC_CHECK_NEGATIVE 239072 52.68 24.39 61.14 8 BAYES_50 208655 51.74 46.33 53.36 9 DKIM_VALID_AU 197581 52.55 59.30 50.53 10 XMListUnsubscribeExists 178520 51.51 71.08 45.66 11 XM_B_SpammyWords 173590 50.90 72.64 44.40 12 XM_B_Unicode3 161987 41.79 43.00 41.43 13 DCC_CHECK 151721 47.28 75.58 38.80 14 T_TM2_M_HEADER_IN_MSG 115345 27.96 22.82 29.50 15 RCVD_IN_MSPIKE_WL 108827 26.61 22.51 27.83 16 DKIM_VALID_EF 100762 26.56 29.20 25.77 17 HTML_FONT_LOW_CONTRAST 97542 27.08 34.21 24.95 18 LOC_TINY_FONT_1 91137 26.22 35.94 23.31 19 FVGT_m_MULTI_ODD 85388 23.59 29.46 21.84 20 MIME_HTML_ONLY 84763 23.29 28.66 21.68 21 XMSubLong 81476 21.71 24.63 20.84 22 RCVD_IN_MSPIKE_H2 79631 21.56 25.53 20.37 23 XM_B_SpammyWords2 72207 22.90 37.73 18.47 24 ALL_TRUSTED 69687 14.29 2.49 17.82 25 T_KAM_HTML_FONT_INVALID 68164 20.64 31.37 17.43 26 RCVD_IN_MSPIKE_H3 57729 14.53 13.74 14.76 27 BAYES_00 50360 10.25 1.45 12.88 28 XM_B_Unsub 47145 12.67 14.69 12.06 29 XM_Body_Dirty_Words 46582 13.77 19.96 11.91 30 RCVD_IN_MSPIKE_H4 43551 10.49 8.34 11.14 31 USER_IN_DEF_DKIM_WL 42218 8.58 1.16 10.80 32 XM_Multi_Part_URI 41784 12.19 17.20 10.69 33 TooManyTo_001 40085 9.37 6.44 10.25 34 LotsOfNums_01 35149 8.75 7.95 8.99 35 BAYES_60 32723 8.12 7.28 8.37 36 LOTS_OF_MONEY 32390 9.31 12.73 8.28 37 UNPARSEABLE_RELAY 30900 9.09 13.04 7.90 38 XM_DKIMWhitelistDomains 30733 6.06 0.06 7.86 39 XM_Evil_Numbers_Gen 30493 8.24 9.72 7.80 40 FSL_BULK_SIG 29515 8.44 11.40 7.55 41 TR_XM_DK_Bayes 28866 5.86 0.77 7.38 42 BAYES_99 27954 11.92 27.86 7.15 43 TR_XM_DK_Bayes1 27876 5.66 0.74 7.13 44 XM_SendGrid 27777 7.83 10.26 7.10 45 XM_DK_Undo_02 26975 14.61 40.36 6.90 46 RCVD_IN_RP_SAFE 25919 5.61 2.20 6.63 47 IN_ZIMBRA_NJ_WHITELIST 25498 5.05 0.12 6.52 48 MIME_QP_LONG_LINE 24278 5.89 4.81 6.21 49 TR_XM_UnparsRelay 24151 7.64 12.54 6.18 50 BAYES_999 24011 9.64 21.34 6.14 51 TR_XM_DK_Bayes2 23639 4.80 0.62 6.05 52 RCVD_IN_RP_CERTIFIED 23147 4.86 1.33 5.92 53 T_TooManySym_01 22267 5.05 2.91 5.69 54 RCVD_IN_VALIDITY_SAFE 22234 4.67 1.29 5.69 55 HTML_IMAGE_RATIO_02 21703 6.36 9.05 5.55 56 TR_XM_DKIM_Undo 21656 11.74 32.47 5.54 57 HTML_IMAGE_RATIO_04 21230 5.28 4.78 5.43 58 BAYES_40 21079 4.75 2.62 5.39 59 MPART_ALT_DIFF 20793 6.58 10.81 5.32 60 XM_H_Long_From01 20509 5.40 5.90 5.25 61 RCVD_IN_IADB_LISTED 20181 4.66 2.97 5.16 62 XM_PDF 20160 4.22 1.10 5.16 63 RCVD_IN_VALIDITY_CERTIFIED 19815 4.05 0.66 5.07 64 XM_H_Trusted_IP 18996 3.74 0.00 4.86 65 HTML_IMAGE_RATIO_06 18539 4.61 4.16 4.74 66 RCVD_IN_IADB_SPF 17606 4.06 2.59 4.50 67 TR_XM_DK_SendGrid 17425 4.81 6.00 4.46 68 TR_XM_SpammyWords4 16548 5.75 10.80 4.23 69 RELAYCOUNTRY_META 15951 8.04 21.26 4.08 70 XM_B_Phish_Phrases 15946 4.57 6.22 4.08 71 RCVD_IN_IADB_SENDERID 15708 3.64 2.36 4.02 72 BAYES_20 15644 3.50 1.83 4.00 73 BAYES_80 15550 4.82 7.66 3.98 74 TM2_M_URI_OPT_OUT 15439 4.09 4.58 3.95 75 RCVD_IN_IADB_DK 15175 3.54 2.39 3.88 76 BOTNET_IPINHOSTNAME 15043 6.29 14.45 3.85 77 XMSubMetaSx_00 15013 4.49 6.65 3.84 78 XMStrtUSub 14829 4.16 5.41 3.79 79 XM_B_SpammyWords3 14450 5.96 13.51 3.70 80 XMSexyCombo_05 14072 4.73 8.50 3.60 81 TR_XM_PhishingBody 14055 4.52 7.60 3.59 82 DKIM_INVALID 14040 4.18 6.14 3.59 83 ANY_BOUNCE_MESSAGE 13941 2.88 0.58 3.57 84 BOUNCE_MESSAGE 13940 2.88 0.58 3.57 85 T_REMOTE_IMAGE 13712 3.24 2.36 3.51 86 MIME_HTML_ONLY_MULTI 13549 3.56 3.88 3.47 87 XMNumbers 12824 3.47 4.10 3.28 88 XM_UncommonTLD01 12794 5.03 10.92 3.27 89 RCVD_IN_IADB_VOUCHED 12399 2.79 1.50 3.17 90 HTML_IMAGE_RATIO_08 11483 2.89 2.73 2.94 91 T_TooManySym_02 11375 2.42 0.77 2.91 92 TR_DCC_Bayes_99 10641 6.99 21.25 2.72 93 MAILING_LIST_MULTI 10485 2.63 2.46 2.68 94 HTML_MIME_NO_HTML_TAG 10240 2.97 4.15 2.62 95 XMDiploma_00 10170 2.69 2.97 2.60 96 URI_NOVOWEL 9999 3.18 5.27 2.56 97 MIME_HTML_MOSTLY 9736 3.81 8.20 2.49 98 BAYES_95 9658 2.83 4.04 2.47 99 XMSubNoVowel 9522 2.15 1.19 2.44 100 BAYES_05 9366 2.06 0.93 2.40 101 FROM_EXCESS_BASE64 9160 2.17 1.59 2.34 102 TooManyTo_002 8605 1.89 0.84 2.20 103 TR_XM_SB_Phish 8509 2.24 2.44 2.18 104 XM_SPF_SoftFail 8422 2.82 5.04 2.15 105 XMSubPhish11 8396 2.20 2.36 2.15 106 T_XMDrugObfuBody_14 8375 2.28 2.76 2.14 107 RCVD_IN_IADB_OPTIN 8123 1.83 1.00 2.08 108 XM_B_Phish66 8105 2.48 3.85 2.07 109 XM_B_SpammyTLD 7765 2.29 3.31 1.99 110 TR_XM_SpammyRelay 7626 5.01 15.24 1.95 111 HELO_NODOT 7567 1.59 0.42 1.94 112 HELO_NO_DOMAIN 7562 1.58 0.42 1.93 113 RCVD_IN_MSPIKE_H5 7547 1.59 0.43 1.93 114 IN_HORDE_ADDRESS_BOOK 7275 1.46 0.11 1.86 115 XM_DK_Undo_01 7156 1.95 2.37 1.83 116 XM_GoogleGroups 6927 2.09 3.15 1.77 117 TR_Symld_Words 6907 1.84 2.10 1.77 118 XM_CamelCaseFrm001 6813 1.89 2.40 1.74 119 INVALID_MSGID 6700 1.36 0.17 1.71 120 KHOP_HELO_FCRDNS 6163 1.79 2.52 1.58 121 T_XMDrugObfuBody_08 6159 1.92 3.09 1.58 122 MSGID_NOFQDN1 6131 1.22 0.04 1.57 123 XM_B_Unsub2 6094 1.78 2.51 1.56 124 SUBJ_ALL_CAPS 6025 1.64 1.96 1.54 125 TO_MALFORMED 6009 1.19 0.01 1.54 126 XM_B_Investor 5703 2.00 3.80 1.46 127 TooManyTo_003 5622 1.25 0.61 1.44 128 UNTRUSTED_Relay 5566 3.81 11.80 1.42 129 BOTNET 5481 4.27 13.87 1.40 130 URI_HEX 5456 1.55 2.07 1.40 131 TR_XM_SpammyWords5 5315 1.95 3.92 1.36 132 TVD_RCVD_IP 5060 1.06 0.28 1.29 133 TVD_SPACE_RATIO_MINFP 5033 1.04 0.20 1.29 134 XMCapTrack 5017 1.09 0.45 1.28 135 HTML_IMAGE_ONLY_20 4892 1.73 3.34 1.25 136 TR_XM_SpammyWords2 4835 3.16 9.58 1.24 137 XMGappySubj_01 4807 0.97 0.12 1.23 138 XM_H_Long_From02 4611 1.15 1.07 1.18 139 TM2_M_VERY_LONG_WORD 4369 1.41 2.38 1.12 140 XMStockSpam_06 4257 1.22 1.68 1.09 141 XMNoVowels 4247 1.01 0.75 1.09 142 XMSexyCombo_01 4212 1.35 2.26 1.08 143 HTML_FONT_FACE_BAD 4041 1.00 0.91 1.03 144 RCVD_IN_BL_SPAMCOP_NET 4008 3.02 9.68 1.03 145 TooManyTo_004 4000 0.90 0.47 1.02 146 XM_ProductURIs 3954 0.96 0.79 1.01 147 TR_XM_MaxUnsub 3936 1.82 4.54 1.01 148 DKIM_ADSP_CUSTOM_MED 3905 0.97 0.88 1.00 149 TVD_SPACE_RATIO 3842 0.79 0.13 0.98 150 XM_UB50 3748 2.20 6.37 0.96 151 XMBSHREFv2 3700 0.80 0.30 0.95 152 RELAYCOUNTRY_CA 3552 1.93 5.33 0.91 153 TR_MetaPhish_Combo_01 3453 0.95 1.17 0.88 154 RELAYCOUNTRY_GB 3352 0.93 1.18 0.86 155 T_FILL_THIS_FORM_SHORT 3308 1.05 1.72 0.85 156 TooManyTo_005 3215 0.72 0.39 0.82 157 XMGenDplmaNmb 3191 0.95 1.38 0.82 158 XM_OfRef6 3153 1.18 2.45 0.81 159 SpammyFromTLD_01 3144 1.70 4.71 0.80 160 T_XMDrugObfuBody_00 3115 1.01 1.73 0.80 161 HTTPS_HTTP_MISMATCH 3052 0.90 1.30 0.78 162 XMBody_95 2974 0.63 0.20 0.76 163 T_TooManySym_03 2810 0.63 0.32 0.72 164 XM_B_COVIDMETA 2673 1.01 2.12 0.68 165 XMHTML_After_End 2657 0.83 1.34 0.68 166 XMBrknScrpt_02 2643 0.85 1.45 0.68 167 SHORT_URI_2 2590 0.63 0.51 0.66 168 NML_ADSP_CUSTOM_MED 2566 0.65 0.63 0.66 169 FROM_GOV_DKIM_AU 2462 0.51 0.13 0.63 170 RCVD_IN_SORBS_DUL 2447 0.55 0.29 0.63 171 XMBdyGiftCard01 2423 0.68 0.87 0.62 172 XM_ShortIntro_01 2404 0.58 0.47 0.61 173 T_OBFU_PDF_ATTACH 2348 0.50 0.16 0.60 174 URI_TRY_3LD 2338 0.71 1.07 0.60 175 XMLngstWrd_00 2306 0.53 0.33 0.59 176 T_Symld_Words_02 2296 0.71 1.13 0.59 177 TR_XM_SPAMCOP 2282 1.74 5.59 0.58 178 XMPhish30 2232 0.72 1.22 0.57 179 HTML_SHORT_LINK_IMG_3 2196 1.04 2.65 0.56 180 TR_MSPIKEBAYES00 2168 0.44 0.04 0.55 181 HTML_TITLE_SUBJ_DIFF 2121 1.02 2.63 0.54 182 XMPhish14 2069 0.65 1.07 0.53 183 XM_H_PHPMailer 2059 0.55 0.63 0.53 184 SHORT_HELO_AND_INLINE_IMAGE 2044 0.43 0.10 0.52 185 XMMoneyMeta_00 2023 0.64 1.05 0.52 186 XM_B_COPY_HTML 2014 0.56 0.72 0.52 187 THIS_AD 1972 0.49 0.45 0.50 188 FORGED_GMAIL_RCVD 1972 0.56 0.73 0.50 189 T_XMHurry_00 1936 0.69 1.33 0.50 190 HTML_TAG_BALANCE_BODY 1858 0.56 0.86 0.48 191 HTML_IMAGE_ONLY_28 1850 0.52 0.66 0.47 192 XM_B_SpammyWords4 1779 0.96 2.65 0.45 193 RCVD_IN_MSPIKE_BL 1756 1.24 3.87 0.45 194 XMHTMLBadTable_001 1746 0.43 0.39 0.45 195 RDNS_DYNAMIC 1746 0.52 0.78 0.45 196 TR_XM_MSPIKECOMBO 1725 1.06 3.11 0.44 197 XMLngstWrd_01 1725 0.41 0.28 0.44 198 MISSING_HEADERS 1723 0.57 0.99 0.44 199 TM2_M_BODY_EMPTY 1717 0.38 0.19 0.44 200 FORGED_OUTLOOK_TAGS 1657 0.33 0.01 0.42 ----------------------------------------------------------------------