Email: 476654 Autolearn: 0 AvgScore: 1.58 AvgScanTime: 2.61 sec Spam: 102906 Autolearn: 0 AvgScore: 13.54 AvgScanTime: 3.03 sec Ham: 373748 Autolearn: 0 AvgScore: -1.72 AvgScanTime: 2.50 sec Time Spent Running SA: 345.98 hours Time Spent Processing Spam: 86.53 hours Time Spent Processing Ham: 259.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 97136 88.48 94.39 86.85 2 DKIM_SIGNED 87656 71.54 85.18 67.79 3 XM_DK_Pass 84356 69.72 81.97 66.35 4 DKIM_VALID 81020 67.41 78.73 64.29 5 RELAYCOUNTRY_US 80530 78.08 78.26 78.03 6 XM_B_Unicode 80045 70.00 77.78 67.86 7 DCC_CHECK 77955 44.35 75.75 35.70 8 XMListUnsubscribeExists 72044 48.17 70.01 42.16 9 XM_B_SpammyWords 71089 48.16 69.08 42.40 10 DKIM_VALID_AU 59869 51.05 58.18 49.09 11 BAYES_50 48639 51.75 47.27 52.99 12 XM_B_Unicode3 44339 40.76 43.09 40.12 13 XM_DK_Undo_02 41846 13.76 40.66 6.35 14 XM_B_SpammyWords2 40361 22.18 39.22 17.49 15 LOC_TINY_FONT_1 38039 24.70 36.96 21.33 16 HTML_FONT_LOW_CONTRAST 34330 27.37 33.36 25.72 17 TR_XM_DKIM_Undo 34005 11.28 33.04 5.29 18 MIME_HTML_ONLY 31341 22.70 30.46 20.57 19 DKIM_VALID_EF 30782 26.98 29.91 26.17 20 T_KAM_HTML_FONT_INVALID 30778 19.42 29.91 16.53 21 FVGT_m_MULTI_ODD 30041 23.81 29.19 22.32 22 BAYES_99 28329 11.88 27.53 7.58 23 XMSubLong 26590 22.33 25.84 21.36 24 DCC_CHECK_NEGATIVE 24917 55.60 24.21 64.24 25 RCVD_IN_MSPIKE_H2 24902 20.93 24.20 20.03 26 T_TM2_M_HEADER_IN_MSG 24039 29.22 23.36 30.83 27 XM_Body_Dirty_Words 23770 14.36 23.10 11.95 28 RCVD_IN_MSPIKE_WL 22739 25.44 22.10 26.37 29 BAYES_999 22047 9.91 21.42 6.74 30 RELAYCOUNTRY_META 21786 7.48 21.17 3.71 31 TR_DCC_Bayes_99 20747 6.07 20.16 2.20 32 XM_Multi_Part_URI 17885 12.18 17.38 10.75 33 BOTNET_IPINHOSTNAME 15728 6.49 15.28 4.07 34 BOTNET 14509 4.24 14.10 1.53 35 UNTRUSTED_Relay 14050 3.97 13.65 1.30 36 LOTS_OF_MONEY 13851 8.14 13.46 6.67 37 XM_B_SpammyWords3 13722 6.03 13.33 4.02 38 RCVD_IN_MSPIKE_H3 13675 13.92 13.29 14.10 39 FSL_BULK_SIG 13570 8.39 13.19 7.07 40 TR_XM_SpammyRelay 13250 3.89 12.88 1.41 41 XM_B_Unsub 13155 11.78 12.78 11.50 42 TR_XM_SpammyWords4 11933 5.80 11.60 4.21 43 UNPARSEABLE_RELAY 11756 8.40 11.42 7.56 44 XM_UncommonTLD01 11580 5.15 11.25 3.47 45 TR_XM_UnparsRelay 11284 6.85 10.97 5.72 46 XMSexyCombo_05 10850 5.45 10.54 4.05 47 XM_Evil_Numbers_Gen 10452 8.15 10.16 7.59 48 TR_XM_SpammyWords2 10227 2.85 9.94 0.89 49 MPART_ALT_DIFF 10128 6.26 9.84 5.27 50 XM_SendGrid 9282 7.28 9.02 6.80 51 RCVD_IN_BL_SPAMCOP_NET 9037 2.52 8.78 0.79 52 HTML_IMAGE_RATIO_02 8972 6.73 8.72 6.18 53 RCVD_IN_MSPIKE_H4 8663 9.91 8.42 10.32 54 LotsOfNums_01 7920 8.05 7.70 8.15 55 XM_UB50 7772 2.32 7.55 0.88 56 BAYES_80 7563 4.40 7.35 3.58 57 XMSubMetaSx_00 7410 4.83 7.20 4.18 58 BAYES_60 7121 7.65 6.92 7.85 59 TR_XM_PhishingBody 6903 3.91 6.71 3.14 60 TooManyTo_001 6841 9.14 6.65 9.83 61 DKIM_INVALID 6636 4.13 6.45 3.49 62 XM_H_Long_From01 6570 4.93 6.38 4.53 63 MIME_HTML_MOSTLY 6428 3.14 6.25 2.29 64 XM_B_Phish_Phrases 6370 3.79 6.19 3.12 65 XM_SPF_SoftFail 5847 3.03 5.68 2.31 66 TR_XM_SPAMCOP 5303 1.37 5.15 0.33 67 TR_XM_DK_SendGrid 5201 4.50 5.05 4.35 68 URI_NOVOWEL 5080 2.88 4.94 2.32 69 MIME_HTML_ONLY_MULTI 5061 3.89 4.92 3.61 70 HTML_IMAGE_RATIO_04 4994 5.40 4.85 5.55 71 RELAYCOUNTRY_CA 4883 1.64 4.75 0.79 72 XMNumbers 4777 4.04 4.64 3.88 73 TR_XM_SpammyWords5 4719 2.19 4.59 1.53 74 TM2_M_URI_OPT_OUT 4646 4.06 4.51 3.93 75 XMStrtUSub 4573 4.72 4.44 4.79 76 KHOP_HELO_FCRDNS 4569 2.44 4.44 1.90 77 SpammyFromTLD_01 4519 1.61 4.39 0.84 78 SpammyFromTLD_02 4432 1.11 4.31 0.22 79 MIME_QP_LONG_LINE 4429 5.58 4.30 5.93 80 XM_B_Investor 4309 1.94 4.19 1.32 81 HTML_MIME_NO_HTML_TAG 4299 2.87 4.18 2.50 82 RCVD_IN_MSPIKE_BL 4193 1.24 4.07 0.46 83 XM_OfRef6 4181 1.84 4.06 1.23 84 TR_XM_MSPIKECOMBO 4160 1.23 4.04 0.45 85 T_REMOTE_IMAGE 4063 3.61 3.95 3.52 86 BAYES_95 3873 2.44 3.76 2.08 87 XM_B_Phish66 3814 2.35 3.71 1.97 88 XM_B_SpammyTLD 3716 2.36 3.61 2.02 89 XM_DIRTYINTL 3638 0.99 3.54 0.29 90 TR_XM_MaxUnsub 3632 1.38 3.53 0.79 91 HTML_IMAGE_RATIO_06 3625 3.04 3.52 2.91 92 TM2_M_VERY_LONG_WORD 3510 1.62 3.41 1.12 93 SUBJ_ALL_CAPS 3359 2.06 3.26 1.73 94 XMBody_17 3334 1.01 3.24 0.39 95 T_XMDrugObfuBody_14 3183 2.33 3.09 2.12 96 XMDiploma_00 3120 1.81 3.03 1.47 97 RCVD_IN_IADB_LISTED 3017 3.89 2.93 4.15 98 TR_XM_NoHeaderRelay 2998 0.78 2.91 0.20 99 T_TooManySym_01 2953 5.44 2.87 6.15 100 URIBL_DBL_SPAM 2925 0.62 2.84 0.01 101 T_XMDrugObfuBody_08 2807 1.88 2.73 1.65 102 HTML_IMAGE_RATIO_08 2764 2.43 2.69 2.36 103 BAYES_40 2739 4.88 2.66 5.49 104 ALL_TRUSTED 2712 15.90 2.64 19.55 105 XMSexyCombo_01 2691 1.60 2.62 1.32 106 TR_XM_PHPDW 2599 0.96 2.53 0.53 107 RCVD_IN_IADB_SPF 2550 3.40 2.48 3.65 108 TR_XM_SpammyWords3 2519 0.74 2.45 0.26 109 XM_DK_Undo_01 2504 1.99 2.43 1.87 110 URI_HEX 2471 1.74 2.40 1.56 111 TR_XM_PHPForged 2450 0.89 2.38 0.47 112 XM_CamelCaseFrm001 2448 1.87 2.38 1.73 113 TR_XM_FormFill2 2402 0.88 2.33 0.48 114 XM_H_PHPOS 2386 0.87 2.32 0.47 115 TR_XM_SB_Phish 2353 2.06 2.29 1.99 116 XM_URI_RBL 2328 0.60 2.26 0.14 117 T_FILL_THIS_FORM_SHORT 2306 1.26 2.24 0.99 118 RCVD_IN_IADB_DK 2302 2.96 2.24 3.16 119 RCVD_IN_IADB_SENDERID 2295 3.05 2.23 3.28 120 MAILING_LIST_MULTI 2265 2.60 2.20 2.71 121 JH_SPAMMY_HEADERS 2219 0.47 2.16 0.00 122 XMSubPhish11 2201 2.00 2.14 1.96 123 XM_B_SpammyWords4 2174 0.70 2.11 0.31 124 XM_B_Unsub2 2161 1.52 2.10 1.36 125 XMStockSpam_06 2155 1.40 2.09 1.21 126 RCVD_IN_VALIDITY_SAFE 2142 4.75 2.08 5.49 127 BAYES_20 2086 3.62 2.03 4.05 128 RELAYCOUNTRY_FR 2073 0.61 2.01 0.22 129 RCVD_IN_MSPIKE_L3 2071 0.71 2.01 0.35 130 BOTNET_NORDNS 2059 0.45 2.00 0.02 131 XM_B_COVIDMETA 2040 0.90 1.98 0.60 132 URIBL_BLACK 1961 0.45 1.91 0.05 133 T_XMHurry_00 1959 0.80 1.90 0.49 134 XM_UB99 1850 0.39 1.80 0.00 135 RELAYCOUNTRY_DE 1834 0.61 1.78 0.29 136 RCVD_IN_RP_SAFE 1810 4.31 1.76 5.02 137 XMGenDplmaNmb 1805 1.03 1.75 0.83 138 TR_XM_COVIDMETA4 1795 0.62 1.74 0.31 139 XM_GoogleGroups 1793 1.49 1.74 1.42 140 RCVD_IN_IADB_VOUCHED 1788 2.33 1.74 2.49 141 RELAYCOUNTRY_IN 1775 0.47 1.72 0.13 142 FROM_EXCESS_BASE64 1763 2.24 1.71 2.39 143 XMBrknScrpt_02 1716 1.13 1.67 0.98 144 PDS_OTHER_BAD_TLD 1709 0.56 1.66 0.26 145 T_XMDrugObfuBody_00 1679 0.76 1.63 0.52 146 FILL_THIS_FORM 1664 0.59 1.62 0.31 147 BODY_URI_ONLY 1649 0.35 1.60 0.01 148 TR_LOTS_OF_MONEY3 1645 0.71 1.60 0.47 149 HTTPS_HTTP_MISMATCH 1637 0.92 1.59 0.74 150 XMLngstWrd_00 1632 0.86 1.59 0.66 151 XMHTML_After_End 1631 1.09 1.58 0.95 152 HTML_IMAGE_ONLY_08 1544 0.40 1.50 0.10 153 BAYES_00 1544 10.69 1.50 13.23 154 TR_XM_INV_DKIM 1537 0.37 1.49 0.06 155 XM_OfRef7 1522 0.38 1.48 0.08 156 TR_XM_COVIDMETA1 1515 0.47 1.47 0.20 157 MONEY_NOHTML 1496 0.38 1.45 0.08 158 MONEY_FORM 1494 0.32 1.45 0.00 159 XMLngstWrd_01 1488 0.76 1.45 0.58 160 RCVD_IN_VALIDITY_CERTIFIED 1464 4.10 1.42 4.83 161 RCVD_IN_MSPIKE_L5 1424 0.31 1.38 0.01 162 XMPhish30 1423 0.70 1.38 0.51 163 XM_UB999 1409 0.30 1.37 0.00 164 XMLngstWrd_02 1401 0.67 1.36 0.48 165 RELAYCOUNTRY_NL 1393 0.43 1.35 0.17 166 DKIM_ADSP_CUSTOM_MED 1350 1.14 1.31 1.09 167 XMLngstWrd_03 1346 0.57 1.31 0.36 168 XM_UB60 1333 0.33 1.30 0.06 169 RELAYCOUNTRY_AU 1318 0.53 1.28 0.32 170 TR_XM_FormFill 1318 0.28 1.28 0.01 171 HTML_FONT_SIZE_LARGE 1314 0.37 1.28 0.12 172 GOOG_STO_IMG_HTML 1309 0.27 1.27 0.00 173 XM_Body_Dirty_Words_01 1305 0.81 1.27 0.68 174 URI_TRY_3LD 1280 0.79 1.24 0.67 175 T_HTML_TAG_BALANCE_CENTER 1279 0.34 1.24 0.09 176 TR_BOTNET_NEGATE 1273 0.47 1.24 0.26 177 TR_Symld_Words 1270 1.58 1.23 1.67 178 RCVD_IN_IADB_OPTIN 1269 1.58 1.23 1.67 179 RDNS_DYNAMIC 1266 0.62 1.23 0.45 180 XM_H_Undi_Recip 1263 0.41 1.23 0.18 181 HTML_TITLE_SUBJ_DIFF 1247 0.38 1.21 0.15 182 XMSubMetaI_00 1238 0.62 1.20 0.45 183 RELAYCOUNTRY_GB 1220 0.88 1.19 0.79 184 XMLngstWrd_04 1216 0.48 1.18 0.29 185 FORGED_GMAIL_RCVD 1204 0.72 1.17 0.60 186 FROM_SUSPICIOUS_NTLD 1198 0.28 1.16 0.04 187 RCVD_IN_RP_CERTIFIED 1188 3.70 1.15 4.40 188 MISSING_HEADERS 1184 0.65 1.15 0.51 189 XM_H_Long_From02 1181 0.92 1.15 0.86 190 TR_Mismatch_TLD_02 1177 0.30 1.14 0.07 191 DIET_1 1177 0.54 1.14 0.37 192 XM_B_SEO 1173 0.36 1.14 0.14 193 MIXED_FONT_CASE 1172 0.25 1.14 0.00 194 XMMoneyMeta_00 1154 0.64 1.12 0.51 195 USER_IN_DEF_DKIM_WL 1148 8.87 1.12 11.00 196 MONEY_FRAUD_8 1145 0.24 1.11 0.00 197 XM_UB80 1135 0.25 1.10 0.02 198 XM_H_PHPMailer 1134 0.73 1.10 0.63 199 NML_ADSP_CUSTOM_MED 1134 0.79 1.10 0.71 200 HK_SCAM 1130 0.24 1.10 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 324607 88.48 94.39 86.85 2 RELAYCOUNTRY_US 291636 78.08 78.26 78.03 3 XM_B_Unicode 253618 70.00 77.78 67.86 4 DKIM_SIGNED 253346 71.54 85.18 67.79 5 XM_DK_Pass 247967 69.72 81.97 66.35 6 DKIM_VALID 240297 67.41 78.73 64.29 7 DCC_CHECK_NEGATIVE 240080 55.60 24.21 64.24 8 BAYES_50 198041 51.75 47.27 52.99 9 DKIM_VALID_AU 183477 51.05 58.18 49.09 10 XM_B_SpammyWords 158456 48.16 69.08 42.40 11 XMListUnsubscribeExists 157556 48.17 70.01 42.16 12 XM_B_Unicode3 149955 40.76 43.09 40.12 13 DCC_CHECK 133437 44.35 75.75 35.70 14 T_TM2_M_HEADER_IN_MSG 115222 29.22 23.36 30.83 15 RCVD_IN_MSPIKE_WL 98539 25.44 22.10 26.37 16 DKIM_VALID_EF 97806 26.98 29.91 26.17 17 HTML_FONT_LOW_CONTRAST 96141 27.37 33.36 25.72 18 FVGT_m_MULTI_ODD 83429 23.81 29.19 22.32 19 XMSubLong 79841 22.33 25.84 21.36 20 LOC_TINY_FONT_1 79717 24.70 36.96 21.33 21 MIME_HTML_ONLY 76863 22.70 30.46 20.57 22 RCVD_IN_MSPIKE_H2 74858 20.93 24.20 20.03 23 ALL_TRUSTED 73069 15.90 2.64 19.55 24 XM_B_SpammyWords2 65375 22.18 39.22 17.49 25 T_KAM_HTML_FONT_INVALID 61789 19.42 29.91 16.53 26 RCVD_IN_MSPIKE_H3 52683 13.92 13.29 14.10 27 BAYES_00 49432 10.69 1.50 13.23 28 XM_Body_Dirty_Words 44679 14.36 23.10 11.95 29 XM_B_Unsub 42985 11.78 12.78 11.50 30 USER_IN_DEF_DKIM_WL 41125 8.87 1.12 11.00 31 XM_Multi_Part_URI 40166 12.18 17.38 10.75 32 RCVD_IN_MSPIKE_H4 38560 9.91 8.42 10.32 33 TooManyTo_001 36749 9.14 6.65 9.83 34 LotsOfNums_01 30449 8.05 7.70 8.15 35 BAYES_60 29348 7.65 6.92 7.85 36 XM_Evil_Numbers_Gen 28378 8.15 10.16 7.59 37 BAYES_99 28312 11.88 27.53 7.58 38 UNPARSEABLE_RELAY 28261 8.40 11.42 7.56 39 TR_XM_DK_Bayes 27554 5.98 0.93 7.37 40 TR_XM_DK_Bayes1 26796 5.82 0.90 7.17 41 FSL_BULK_SIG 26435 8.39 13.19 7.07 42 XM_DKIMWhitelistDomains 26215 5.53 0.13 7.01 43 XM_SendGrid 25397 7.28 9.02 6.80 44 BAYES_999 25174 9.91 21.42 6.74 45 LOTS_OF_MONEY 24933 8.14 13.46 6.67 46 IN_ZIMBRA_NJ_WHITELIST 24195 5.09 0.07 6.47 47 XM_DK_Undo_02 23720 13.76 40.66 6.35 48 HTML_IMAGE_RATIO_02 23108 6.73 8.72 6.18 49 T_TooManySym_01 22976 5.44 2.87 6.15 50 TR_XM_DK_Bayes2 22620 4.88 0.60 6.05 51 MIME_QP_LONG_LINE 22150 5.58 4.30 5.93 52 XM_H_Trusted_IP 21778 4.57 0.00 5.83 53 TR_XM_UnparsRelay 21383 6.85 10.97 5.72 54 HTML_IMAGE_RATIO_04 20743 5.40 4.85 5.55 55 RCVD_IN_VALIDITY_SAFE 20521 4.75 2.08 5.49 56 BAYES_40 20506 4.88 2.66 5.49 57 TR_XM_DKIM_Undo 19764 11.28 33.04 5.29 58 MPART_ALT_DIFF 19706 6.26 9.84 5.27 59 XM_PDF 19110 4.24 1.09 5.11 60 RCVD_IN_RP_SAFE 18745 4.31 1.76 5.02 61 RCVD_IN_VALIDITY_CERTIFIED 18062 4.10 1.42 4.83 62 XMStrtUSub 17912 4.72 4.44 4.79 63 XM_H_Long_From01 16920 4.93 6.38 4.53 64 RCVD_IN_RP_CERTIFIED 16460 3.70 1.15 4.40 65 TR_XM_DK_SendGrid 16270 4.50 5.05 4.35 66 TR_XM_SpammyWords4 15726 5.80 11.60 4.21 67 ANY_BOUNCE_MESSAGE 15648 3.47 0.88 4.19 68 BOUNCE_MESSAGE 15646 3.47 0.88 4.19 69 XMSubMetaSx_00 15613 4.83 7.20 4.18 70 RCVD_IN_IADB_LISTED 15518 3.89 2.93 4.15 71 BOTNET_IPINHOSTNAME 15210 6.49 15.28 4.07 72 BAYES_20 15146 3.62 2.03 4.05 73 XMSexyCombo_05 15137 5.45 10.54 4.05 74 XM_B_SpammyWords3 15030 6.03 13.33 4.02 75 TM2_M_URI_OPT_OUT 14696 4.06 4.51 3.93 76 XMNumbers 14497 4.04 4.64 3.88 77 RELAYCOUNTRY_META 13865 7.48 21.17 3.71 78 RCVD_IN_IADB_SPF 13638 3.40 2.48 3.65 79 MIME_HTML_ONLY_MULTI 13493 3.89 4.92 3.61 80 BAYES_80 13391 4.40 7.35 3.58 81 T_REMOTE_IMAGE 13168 3.61 3.95 3.52 82 DKIM_INVALID 13049 4.13 6.45 3.49 83 XM_UncommonTLD01 12960 5.15 11.25 3.47 84 XMSubNoVowel 12561 2.80 0.75 3.36 85 RCVD_IN_IADB_SENDERID 12261 3.05 2.23 3.28 86 T_TooManySym_02 12086 2.74 0.94 3.23 87 RCVD_IN_IADB_DK 11821 2.96 2.24 3.16 88 BAYES_05 11780 2.68 0.98 3.15 89 TR_XM_PhishingBody 11745 3.91 6.71 3.14 90 XM_B_Phish_Phrases 11676 3.79 6.19 3.12 91 HTML_IMAGE_RATIO_06 10870 3.04 3.52 2.91 92 MAILING_LIST_MULTI 10129 2.60 2.20 2.71 93 HTML_MIME_NO_HTML_TAG 9361 2.87 4.18 2.50 94 RCVD_IN_IADB_VOUCHED 9300 2.33 1.74 2.49 95 FROM_EXCESS_BASE64 8922 2.24 1.71 2.39 96 HTML_IMAGE_RATIO_08 8839 2.43 2.69 2.36 97 TooManyTo_002 8760 2.04 0.96 2.34 98 URI_NOVOWEL 8661 2.88 4.94 2.32 99 XM_SPF_SoftFail 8615 3.03 5.68 2.31 100 MIME_HTML_MOSTLY 8541 3.14 6.25 2.29 101 TR_DCC_Bayes_99 8208 6.07 20.16 2.20 102 TVD_SPACE_RATIO_MINFP 7942 1.68 0.07 2.12 103 T_XMDrugObfuBody_14 7920 2.33 3.09 2.12 104 BAYES_95 7779 2.44 3.76 2.08 105 XM_B_SpammyTLD 7555 2.36 3.61 2.02 106 HELO_NODOT 7506 1.73 0.72 2.01 107 HELO_NO_DOMAIN 7503 1.73 0.72 2.01 108 TR_XM_SB_Phish 7456 2.06 2.29 1.99 109 XM_B_Phish66 7368 2.35 3.71 1.97 110 XMSubPhish11 7318 2.00 2.14 1.96 111 RCVD_IN_MSPIKE_H5 7296 1.61 0.39 1.95 112 KHOP_HELO_FCRDNS 7083 2.44 4.44 1.90 113 XM_DK_Undo_01 6992 1.99 2.43 1.87 114 IN_HORDE_ADDRESS_BOOK 6728 1.43 0.09 1.80 115 INVALID_MSGID 6594 1.43 0.23 1.76 116 SUBJ_ALL_CAPS 6483 2.06 3.26 1.73 117 XM_CamelCaseFrm001 6451 1.87 2.38 1.73 118 RCVD_IN_IADB_OPTIN 6254 1.58 1.23 1.67 119 TR_Symld_Words 6242 1.58 1.23 1.67 120 T_XMDrugObfuBody_08 6175 1.88 2.73 1.65 121 MSGID_NOFQDN1 6150 1.30 0.07 1.65 122 TO_MALFORMED 6020 1.27 0.02 1.61 123 TVD_RCVD_IP 5928 1.28 0.16 1.59 124 TooManyTo_003 5841 1.39 0.77 1.56 125 URI_HEX 5830 1.74 2.40 1.56 126 TR_XM_SpammyWords5 5732 2.19 4.59 1.53 127 BOTNET 5723 4.24 14.10 1.53 128 XMDiploma_00 5499 1.81 3.03 1.47 129 XM_GoogleGroups 5308 1.49 1.74 1.42 130 TR_XM_SpammyRelay 5275 3.89 12.88 1.41 131 XM_B_Unsub2 5099 1.52 2.10 1.36 132 XMSexyCombo_01 4940 1.60 2.62 1.32 133 XM_B_Investor 4916 1.94 4.19 1.32 134 UNTRUSTED_Relay 4875 3.97 13.65 1.30 135 XMCapTrack 4732 1.09 0.46 1.27 136 XM_OfRef6 4601 1.84 4.06 1.23 137 XMStockSpam_06 4538 1.40 2.09 1.21 138 HTML_FONT_FACE_BAD 4534 1.11 0.76 1.21 139 XMBdyGiftCard01 4520 1.17 1.01 1.21 140 TooManyTo_004 4266 1.03 0.61 1.14 141 TM2_M_VERY_LONG_WORD 4204 1.62 3.41 1.12 142 XMGappySubj_01 4178 0.91 0.16 1.12 143 DKIM_ADSP_CUSTOM_MED 4066 1.14 1.31 1.09 144 TVD_SPACE_RATIO 3852 0.84 0.13 1.03 145 T_FILL_THIS_FORM_SHORT 3699 1.26 2.24 0.99 146 XMBrknScrpt_02 3674 1.13 1.67 0.98 147 XMBSHREFv2 3648 0.85 0.39 0.98 148 XM_E_Blogspot 3630 0.81 0.21 0.97 149 XMHTML_After_End 3569 1.09 1.58 0.95 150 TooManyTo_005 3444 0.84 0.55 0.92 151 HTML_IMAGE_ONLY_20 3347 0.80 0.46 0.90 152 TR_XM_SpammyWords2 3334 2.85 9.94 0.89 153 XM_UB50 3286 2.32 7.55 0.88 154 XM_H_Long_From02 3225 0.92 1.15 0.86 155 SpammyFromTLD_01 3158 1.61 4.39 0.84 156 XMGenDplmaNmb 3089 1.03 1.75 0.83 157 SHORT_URI_2 3058 0.78 0.66 0.82 158 RELAYCOUNTRY_GB 2968 0.88 1.19 0.79 159 T_TooManySym_03 2967 0.68 0.29 0.79 160 RCVD_IN_BL_SPAMCOP_NET 2966 2.52 8.78 0.79 161 TR_XM_MaxUnsub 2957 1.38 3.53 0.79 162 RELAYCOUNTRY_CA 2947 1.64 4.75 0.79 163 XMNoVowels 2909 0.69 0.38 0.78 164 HTTPS_HTTP_MISMATCH 2764 0.92 1.59 0.74 165 XMBody_95 2763 0.62 0.18 0.74 166 NML_ADSP_CUSTOM_MED 2653 0.79 1.10 0.71 167 TR_MetaPhish_Combo_01 2637 0.72 0.78 0.71 168 XM_Body_Dirty_Words_01 2551 0.81 1.27 0.68 169 URI_TRY_3LD 2490 0.79 1.24 0.67 170 XMLngstWrd_00 2484 0.86 1.59 0.66 171 RCVD_IN_SORBS_DUL 2442 0.58 0.33 0.65 172 XM_ShortIntro_01 2405 0.64 0.64 0.64 173 XM_H_PHPMailer 2368 0.73 1.10 0.63 174 XM_ProductURIs 2321 0.68 0.87 0.62 175 FORGED_GMAIL_RCVD 2239 0.72 1.17 0.60 176 XM_B_COVIDMETA 2236 0.90 1.98 0.60 177 XMSexyCombo_04 2158 0.64 0.87 0.58 178 XMLngstWrd_01 2152 0.76 1.45 0.58 179 XMSexyCombo_02 2085 0.54 0.49 0.56 180 SHORT_HELO_AND_INLINE_IMAGE 2058 0.46 0.11 0.55 181 TR_XM_PHPDW 1974 0.96 2.53 0.53 182 XM_B_COPY_HTML 1944 0.58 0.79 0.52 183 HTML_TAG_BALANCE_BODY 1941 0.61 0.93 0.52 184 T_OBFU_PDF_ATTACH 1935 0.44 0.15 0.52 185 T_XMDrugObfuBody_00 1931 0.76 1.63 0.52 186 XMPhish30 1909 0.70 1.38 0.51 187 XMMoneyMeta_00 1899 0.64 1.12 0.51 188 MISSING_HEADERS 1893 0.65 1.15 0.51 189 TM2_M_BODY_EMPTY 1869 0.44 0.20 0.50 190 T_XMHurry_00 1844 0.80 1.90 0.49 191 TR_MSPIKEBAYES00 1805 0.39 0.04 0.48 192 XMLngstWrd_02 1784 0.67 1.36 0.48 193 TR_XM_FormFill2 1783 0.88 2.33 0.48 194 HTML_IMAGE_ONLY_32 1776 0.47 0.45 0.48 195 TR_XM_PHPForged 1775 0.89 2.38 0.47 196 TR_LOTS_OF_MONEY3 1760 0.71 1.60 0.47 197 XMSubMetaSxObfu_02 1760 0.46 0.40 0.47 198 XM_H_PHPOS 1741 0.87 2.32 0.47 199 RCVD_IN_MSPIKE_BL 1728 1.24 4.07 0.46 200 TR_XM_MSPIKECOMBO 1696 1.23 4.04 0.45 ----------------------------------------------------------------------