Email: 504304 Autolearn: 0 AvgScore: 1.49 AvgScanTime: 1.45 sec Spam: 97377 Autolearn: 0 AvgScore: 14.23 AvgScanTime: 1.63 sec Ham: 406927 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 1.41 sec Time Spent Running SA: 203.08 hours Time Spent Processing Spam: 44.17 hours Time Spent Processing Ham: 158.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90588 88.72 93.03 87.68 2 DCC_CHECK_NEGATIVE 80626 92.03 82.80 94.24 3 DKIM_SIGNED 77789 74.35 79.88 73.03 4 XM_DK_Pass 73110 71.95 75.08 71.20 5 XM_B_Unicode 71635 70.83 73.56 70.17 6 RELAYCOUNTRY_US 71389 78.85 73.31 80.18 7 DKIM_VALID 70561 69.45 72.46 68.73 8 XM_B_SpammyWords 66504 49.59 68.30 45.11 9 XMListUnsubscribeExists 64613 51.98 66.35 48.54 10 DKIM_VALID_AU 51580 51.86 52.97 51.60 11 XM_DK_Undo_02 43324 14.46 44.49 7.27 12 BAYES_50 42008 52.70 43.14 54.99 13 XM_B_Unicode3 37718 39.85 38.73 40.12 14 XM_B_SpammyWords2 36451 22.30 37.43 18.68 15 TR_XM_DKIM_Undo 35194 11.24 36.14 5.28 16 LOC_TINY_FONT_1 32493 25.95 33.37 24.17 17 BAYES_99 30686 10.39 31.51 5.34 18 DKIM_VALID_EF 30551 27.40 31.37 26.45 19 HTML_FONT_LOW_CONTRAST 30055 29.54 30.86 29.22 20 MIME_HTML_ONLY 29050 22.45 29.83 20.68 21 T_KAM_HTML_FONT_INVALID 28541 21.36 29.31 19.46 22 FVGT_m_MULTI_ODD 27424 25.40 28.16 24.74 23 XMSubLong 26161 22.41 26.87 21.34 24 RELAYCOUNTRY_META 25424 8.24 26.11 3.97 25 RCVD_IN_MSPIKE_H2 23747 21.56 24.39 20.89 26 BAYES_999 23220 7.95 23.85 4.14 27 T_TM2_M_HEADER_IN_MSG 20171 28.02 20.71 29.76 28 XM_Body_Dirty_Words 19830 13.72 20.36 12.13 29 UNTRUSTED_Relay 17162 4.51 17.62 1.37 30 RCVD_IN_MSPIKE_WL 16954 26.11 17.41 28.19 31 BOTNET 16743 4.72 17.19 1.73 32 DCC_CHECK 16697 7.93 17.15 5.73 33 TR_XM_SpammyRelay 15781 4.61 16.21 1.83 34 XM_Multi_Part_URI 15615 12.79 16.04 12.02 35 BOTNET_IPINHOSTNAME 14821 6.66 15.22 4.61 36 LOTS_OF_MONEY 14535 8.55 14.93 7.03 37 XM_UncommonTLD01 13732 5.34 14.10 3.24 38 TR_XM_SpammyWords2 12917 3.32 13.26 0.94 39 XM_B_SpammyWords3 12412 5.97 12.75 4.34 40 UNPARSEABLE_RELAY 11848 9.47 12.17 8.82 41 RCVD_IN_BL_SPAMCOP_NET 11574 2.98 11.89 0.85 42 XM_B_Unsub 11354 12.07 11.66 12.17 43 TR_XM_UnparsRelay 11302 7.87 11.61 6.98 44 TR_XM_SpammyWords4 10794 5.80 11.08 4.54 45 RCVD_IN_MSPIKE_H3 10523 14.45 10.81 15.32 46 MPART_ALT_DIFF 9625 6.30 9.88 5.44 47 XM_UB50 8860 2.47 9.10 0.88 48 RCVD_IN_MSPIKE_BL 8615 2.46 8.85 0.93 49 TR_XM_MSPIKECOMBO 8599 2.45 8.83 0.92 50 XM_SendGrid 8462 7.67 8.69 7.43 51 XM_Evil_Numbers_Gen 8335 8.18 8.56 8.09 52 XMSexyCombo_05 8190 4.76 8.41 3.88 53 SpammyFromTLD_02 7386 1.82 7.58 0.44 54 DKIM_INVALID 7228 4.90 7.42 4.30 55 BAYES_80 6948 4.95 7.14 4.42 56 HTML_MIME_NO_HTML_TAG 6882 3.00 7.07 2.02 57 BAYES_60 6869 8.37 7.05 8.69 58 RELAYCOUNTRY_CA 6447 2.09 6.62 1.01 59 T_REMOTE_IMAGE 6397 3.95 6.57 3.32 60 XM_B_Investor 6375 2.64 6.55 1.71 61 TR_XM_PhishingBody 6335 3.91 6.51 3.29 62 TooManyTo_001 6272 8.96 6.44 9.56 63 HTML_IMAGE_RATIO_02 6220 6.13 6.39 6.07 64 LotsOfNums_01 6174 8.42 6.34 8.91 65 MIME_HTML_MOSTLY 6079 3.19 6.24 2.46 66 RCVD_IN_MSPIKE_H4 6016 9.82 6.18 10.69 67 TR_XM_SPAMCOP 5965 1.45 6.13 0.33 68 TR_DCC_Bayes_99 5955 1.35 6.12 0.21 69 RELAYCOUNTRY_FR 5878 1.36 6.04 0.24 70 XM_B_Phish_Phrases 5878 4.28 6.04 3.86 71 XMSubMetaSx_00 5655 4.90 5.81 4.68 72 XM_H_Long_From01 5504 5.27 5.65 5.18 73 KHOP_HELO_FCRDNS 5434 2.40 5.58 1.63 74 RCVD_IN_MSPIKE_L5 5225 1.19 5.37 0.19 75 RCVD_IN_VALIDITY_RPBL 5111 1.09 5.25 0.09 76 T_FILL_THIS_FORM_SHORT 4930 1.66 5.06 0.85 77 XMStrtUSub 4858 4.47 4.99 4.35 78 URI_NOVOWEL 4805 3.03 4.93 2.57 79 TM2_M_URI_OPT_OUT 4765 4.27 4.89 4.12 80 TR_XM_DK_SendGrid 4679 4.56 4.81 4.50 81 XMNumbers 4536 4.06 4.66 3.92 82 TR_XM_SpammyWords3 4461 1.22 4.58 0.41 83 XM_SPF_SoftFail 4387 2.56 4.51 2.09 84 MIME_HTML_ONLY_MULTI 4331 3.68 4.45 3.49 85 SpammyFromTLD_01 4277 1.45 4.39 0.74 86 MIME_QP_LONG_LINE 4260 6.45 4.37 6.95 87 XM_OfRef6 4219 1.70 4.33 1.07 88 TM2_M_VERY_LONG_WORD 4167 1.97 4.28 1.42 89 URIBL_DBL_SPAM 4098 0.83 4.21 0.03 90 HTML_IMAGE_RATIO_04 4080 5.44 4.19 5.74 91 TR_XM_SpammyWords5 4069 2.03 4.18 1.52 92 XM_B_SpammyTLD 3935 2.58 4.04 2.23 93 TR_XM_MaxUnsub 3875 1.32 3.98 0.68 94 XM_B_Phish66 3763 2.23 3.86 1.84 95 BAYES_95 3719 2.88 3.82 2.66 96 HTML_IMAGE_ONLY_08 3713 0.81 3.81 0.09 97 SUBJ_ALL_CAPS 3678 2.02 3.78 1.60 98 XMBody_17 3560 1.02 3.66 0.38 99 FSL_BULK_SIG 3530 1.89 3.63 1.48 100 RCVD_IN_PSBL 3404 0.72 3.50 0.05 101 T_XMDrugObfuBody_08 3278 1.84 3.37 1.48 102 TR_XM_SB_Phish 3265 3.17 3.35 3.12 103 XMSubPhish11 3169 3.11 3.25 3.08 104 XM_URI_RBL 3145 0.75 3.23 0.15 105 BOTNET_NORDNS 3127 0.65 3.21 0.04 106 T_Symld_Words_02 3051 1.23 3.13 0.78 107 XM_DIRTYINTL 3016 0.91 3.10 0.39 108 ALL_TRUSTED 3013 14.32 3.09 17.00 109 MIXED_CENTER_CASE 2981 0.59 3.06 0.00 110 MIXED_HREF_CASE 2977 0.59 3.06 0.00 111 MIXED_FONT_CASE 2973 0.59 3.05 0.00 112 MIXED_IMG_CASE 2970 0.59 3.05 0.00 113 MIXED_AREA_CASE 2969 0.59 3.05 0.00 114 T_TooManySym_01 2853 4.90 2.93 5.37 115 XMSexyCombo_01 2781 1.47 2.86 1.14 116 XM_UB99 2776 0.55 2.85 0.00 117 HTML_IMAGE_RATIO_06 2712 3.94 2.79 4.21 118 BODY_URI_ONLY 2690 0.54 2.76 0.01 119 XM_B_SpammyWords4 2667 0.93 2.74 0.50 120 HTML_TAG_BALANCE_CENTER 2662 0.62 2.73 0.11 121 JH_SPAMMY_HEADERS 2658 0.53 2.73 0.00 122 T_XMDrugObfuBody_14 2649 2.19 2.72 2.07 123 GOOG_STO_IMG_HTML 2592 0.51 2.66 0.00 124 HTML_FONT_SIZE_HUGE 2505 0.55 2.57 0.06 125 LOADSA_MONEY_COMBO 2453 0.53 2.52 0.06 126 MAILING_LIST_MULTI 2407 2.60 2.47 2.64 127 HTML_FONT_TINY_NORDNS 2386 0.63 2.45 0.19 128 HTML_IMAGE_RATIO_08 2366 2.97 2.43 3.09 129 XMDiploma_00 2338 1.76 2.40 1.60 130 TR_XM_PHPDW 2324 0.75 2.39 0.36 131 XM_GoogleGroups 2306 1.60 2.37 1.41 132 BAYES_40 2299 4.69 2.36 5.25 133 XM_B_Unsub2 2290 2.60 2.35 2.66 134 RCVD_IN_IADB_LISTED 2261 4.62 2.32 5.17 135 TR_XM_PHPForged 2260 0.70 2.32 0.31 136 RCVD_IN_RP_RNBL 2239 0.47 2.30 0.04 137 TR_XM_FormFill2 2235 0.70 2.30 0.32 138 XM_H_PHPOS 2223 0.69 2.28 0.30 139 XMStockSpam_06 2186 1.38 2.24 1.17 140 XM_OfRef7 2179 0.50 2.24 0.09 141 URIBL_BLACK 2152 0.48 2.21 0.07 142 XM_UB60 2072 0.50 2.13 0.11 143 HTML_FONT_SIZE_LARGE 2062 0.51 2.12 0.12 144 MILLION_USD 2060 0.41 2.12 0.00 145 XM_B_COVIDMETA 2058 0.98 2.11 0.71 146 RCVD_IN_VALIDITY_SAFE 2043 4.51 2.10 5.09 147 XM_CamelCaseFrm001 2042 1.83 2.10 1.76 148 XM_UB999 2033 0.40 2.09 0.00 149 XFER_LOTSA_MONEY 2027 0.42 2.08 0.02 150 RCVD_IN_MSPIKE_L3 2025 0.71 2.08 0.39 151 XMLngstWrd_00 2016 0.92 2.07 0.65 152 BAYES_20 1998 3.55 2.05 3.90 153 ADVANCE_FEE_5_NEW_MONEY 1985 0.39 2.04 0.00 154 TR_XM_INV_DKIM 1980 0.52 2.03 0.16 155 XMLngstWrd_01 1967 0.85 2.02 0.57 156 DEAR_BENEFICIARY 1955 0.39 2.01 0.00 157 MONEY_FORM_SHORT 1954 0.39 2.01 0.01 158 MONEY_FRAUD_8 1941 0.39 1.99 0.00 159 TR_XM_FormFill 1935 0.39 1.99 0.01 160 XM_DK_Undo_01 1912 1.79 1.96 1.75 161 MILLION_HUNDRED 1907 0.38 1.96 0.00 162 FORM_FRAUD_5 1897 0.38 1.95 0.00 163 HTML_TITLE_SUBJ_DIFF 1896 0.53 1.95 0.19 164 TVD_APPROVED 1887 0.54 1.94 0.21 165 XMLngstWrd_02 1867 0.76 1.92 0.49 166 TR_XM_COVIDMETA4 1846 0.71 1.90 0.43 167 TR_XM_NoHeaderRelay 1824 0.54 1.87 0.22 168 XMLngstWrd_03 1795 0.67 1.84 0.39 169 FOUND_YOU 1784 0.35 1.83 0.00 170 RCVD_IN_IADB_SPF 1775 4.04 1.82 4.57 171 RELAYCOUNTRY_IN 1763 0.44 1.81 0.11 172 URI_HEX 1742 1.46 1.79 1.38 173 XMLngstWrd_04 1741 0.62 1.79 0.33 174 BAYES_00 1703 10.35 1.75 12.40 175 TR_Mismatch_TLD_01 1687 0.52 1.73 0.23 176 UPPERCASE_75_100 1674 0.49 1.72 0.19 177 RCVD_IN_IADB_DK 1670 3.55 1.71 3.99 178 XMHTML_After_End 1632 0.97 1.68 0.80 179 RCVD_IN_IADB_SENDERID 1629 3.65 1.67 4.13 180 PDS_OTHER_BAD_TLD 1589 0.58 1.63 0.32 181 URI_PHP_REDIR 1576 0.32 1.62 0.01 182 RCVD_IN_VALIDITY_CERTIFIED 1555 3.97 1.60 4.54 183 TM2_M_A_HREF_HREF 1552 0.66 1.59 0.43 184 T_XMDrugObfuBody_00 1528 0.85 1.57 0.68 185 TR_XM_COVIDMETA1 1509 0.51 1.55 0.26 186 LOTTO_DEPT 1505 0.30 1.55 0.00 187 NORDNS_LOW_CONTRAST 1478 0.30 1.52 0.01 188 TR_LOTS_OF_MONEY3 1467 0.60 1.51 0.38 189 MONEY_NOHTML 1452 0.32 1.49 0.03 190 DIET_1 1446 0.57 1.48 0.35 191 RELAYCOUNTRY_AU 1401 0.62 1.44 0.42 192 T_XMHurry_00 1401 0.67 1.44 0.49 193 XMGenDplmaNmb 1391 0.84 1.43 0.71 194 RCVD_IN_MSPIKE_L4 1349 0.54 1.39 0.34 195 XMBrknScrpt_02 1303 0.89 1.34 0.79 196 TR_Symld_Words 1287 1.60 1.32 1.66 197 LOTTO_AGENT 1287 0.26 1.32 0.00 198 FROM_EXCESS_BASE64 1277 2.48 1.31 2.76 199 XMMoneyMeta_00 1260 0.67 1.29 0.52 200 URI_WPADMIN 1256 0.25 1.29 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 383483 92.03 82.80 94.24 2 HTML_MESSAGE 356811 88.72 93.03 87.68 3 RELAYCOUNTRY_US 326256 78.85 73.31 80.18 4 DKIM_SIGNED 297177 74.35 79.88 73.03 5 XM_DK_Pass 289718 71.95 75.08 71.20 6 XM_B_Unicode 285561 70.83 73.56 70.17 7 DKIM_VALID 279686 69.45 72.46 68.73 8 BAYES_50 223782 52.70 43.14 54.99 9 DKIM_VALID_AU 209977 51.86 52.97 51.60 10 XMListUnsubscribeExists 197523 51.98 66.35 48.54 11 XM_B_SpammyWords 183567 49.59 68.30 45.11 12 XM_B_Unicode3 163242 39.85 38.73 40.12 13 T_TM2_M_HEADER_IN_MSG 121111 28.02 20.71 29.76 14 HTML_FONT_LOW_CONTRAST 118912 29.54 30.86 29.22 15 RCVD_IN_MSPIKE_WL 114701 26.11 17.41 28.19 16 DKIM_VALID_EF 107633 27.40 31.37 26.45 17 FVGT_m_MULTI_ODD 100675 25.40 28.16 24.74 18 LOC_TINY_FONT_1 98352 25.95 33.37 24.17 19 XMSubLong 86848 22.41 26.87 21.34 20 RCVD_IN_MSPIKE_H2 85000 21.56 24.39 20.89 21 MIME_HTML_ONLY 84144 22.45 29.83 20.68 22 T_KAM_HTML_FONT_INVALID 79180 21.36 29.31 19.46 23 XM_B_SpammyWords2 76033 22.30 37.43 18.68 24 ALL_TRUSTED 69181 14.32 3.09 17.00 25 RCVD_IN_MSPIKE_H3 62354 14.45 10.81 15.32 26 BAYES_00 50470 10.35 1.75 12.40 27 XM_B_Unsub 49527 12.07 11.66 12.17 28 XM_Body_Dirty_Words 49365 13.72 20.36 12.13 29 XM_Multi_Part_URI 48894 12.79 16.04 12.02 30 RCVD_IN_MSPIKE_H4 43511 9.82 6.18 10.69 31 USER_IN_DEF_DKIM_WL 42080 8.47 0.64 10.34 32 TooManyTo_001 38922 8.96 6.44 9.56 33 LotsOfNums_01 36273 8.42 6.34 8.91 34 UNPARSEABLE_RELAY 35889 9.47 12.17 8.82 35 BAYES_60 35353 8.37 7.05 8.69 36 XM_Evil_Numbers_Gen 32924 8.18 8.56 8.09 37 XM_SendGrid 30234 7.67 8.69 7.43 38 XM_DK_Undo_02 29603 14.46 44.49 7.27 39 LOTS_OF_MONEY 28602 8.55 14.93 7.03 40 XM_DKIMWhitelistDomains 28571 5.67 0.01 7.02 41 TR_XM_UnparsRelay 28386 7.87 11.61 6.98 42 MIME_QP_LONG_LINE 28285 6.45 4.37 6.95 43 TR_XM_DK_Bayes 27629 5.61 0.66 6.79 44 TR_XM_DK_Bayes1 26606 5.40 0.63 6.54 45 IN_ZIMBRA_NJ_WHITELIST 25104 4.99 0.08 6.17 46 HTML_IMAGE_RATIO_02 24704 6.13 6.39 6.07 47 HTML_IMAGE_RATIO_04 23350 5.44 4.19 5.74 48 DCC_CHECK 23298 7.93 17.15 5.73 49 TR_XM_DK_Bayes2 22366 4.52 0.43 5.50 50 MPART_ALT_DIFF 22134 6.30 9.88 5.44 51 T_TooManySym_01 21869 4.90 2.93 5.37 52 BAYES_99 21731 10.39 31.51 5.34 53 TR_XM_DKIM_Undo 21480 11.24 36.14 5.28 54 BAYES_40 21349 4.69 2.36 5.25 55 XM_H_Long_From01 21069 5.27 5.65 5.18 56 RCVD_IN_IADB_LISTED 21054 4.62 2.32 5.17 57 RCVD_IN_VALIDITY_SAFE 20711 4.51 2.10 5.09 58 XMSubMetaSx_00 19056 4.90 5.81 4.68 59 XM_PDF 18785 3.93 1.08 4.62 60 BOTNET_IPINHOSTNAME 18764 6.66 15.22 4.61 61 RCVD_IN_IADB_SPF 18578 4.04 1.82 4.57 62 RCVD_IN_VALIDITY_CERTIFIED 18475 3.97 1.60 4.54 63 TR_XM_SpammyWords4 18468 5.80 11.08 4.54 64 TR_XM_DK_SendGrid 18317 4.56 4.81 4.50 65 BAYES_80 18004 4.95 7.14 4.42 66 XMStrtUSub 17691 4.47 4.99 4.35 67 XM_B_SpammyWords3 17680 5.97 12.75 4.34 68 DKIM_INVALID 17491 4.90 7.42 4.30 69 HTML_IMAGE_RATIO_06 17140 3.94 2.79 4.21 70 BAYES_999 16858 7.95 23.85 4.14 71 RCVD_IN_IADB_SENDERID 16786 3.65 1.67 4.13 72 TM2_M_URI_OPT_OUT 16771 4.27 4.89 4.12 73 RCVD_IN_IADB_DK 16252 3.55 1.71 3.99 74 RELAYCOUNTRY_META 16140 8.24 26.11 3.97 75 XMNumbers 15959 4.06 4.66 3.92 76 BAYES_20 15888 3.55 2.05 3.90 77 XMSexyCombo_05 15792 4.76 8.41 3.88 78 XM_B_Phish_Phrases 15723 4.28 6.04 3.86 79 MIME_HTML_ONLY_MULTI 14205 3.68 4.45 3.49 80 BOUNCE_MESSAGE 13991 2.95 0.90 3.44 81 ANY_BOUNCE_MESSAGE 13991 2.95 0.90 3.44 82 T_REMOTE_IMAGE 13517 3.95 6.57 3.32 83 TR_XM_PhishingBody 13369 3.91 6.51 3.29 84 XM_UncommonTLD01 13175 5.34 14.10 3.24 85 XM_H_Trusted_IP 12975 2.57 0.00 3.19 86 TR_XM_SB_Phish 12699 3.17 3.35 3.12 87 HTML_IMAGE_RATIO_08 12591 2.97 2.43 3.09 88 XMSubPhish11 12535 3.11 3.25 3.08 89 RCVD_IN_IADB_VOUCHED 12223 2.67 1.27 3.00 90 T_TooManySym_02 12168 2.57 0.83 2.99 91 FROM_EXCESS_BASE64 11232 2.48 1.31 2.76 92 XM_B_Unsub2 10838 2.60 2.35 2.66 93 BAYES_95 10805 2.88 3.82 2.66 94 MAILING_LIST_MULTI 10730 2.60 2.47 2.64 95 URI_NOVOWEL 10464 3.03 4.93 2.57 96 MIME_HTML_MOSTLY 10005 3.19 6.24 2.46 97 BAYES_05 9533 2.11 1.14 2.34 98 XM_B_SpammyTLD 9086 2.58 4.04 2.23 99 TooManyTo_002 8952 1.97 1.00 2.20 100 RCVD_IN_MSPIKE_H5 8836 1.83 0.43 2.17 101 XM_SPF_SoftFail 8511 2.56 4.51 2.09 102 T_XMDrugObfuBody_14 8417 2.19 2.72 2.07 103 HTML_MIME_NO_HTML_TAG 8238 3.00 7.07 2.02 104 RCVD_IN_RP_SAFE 8113 1.71 0.54 1.99 105 RCVD_IN_IADB_OPTIN 8072 1.74 0.74 1.98 106 XM_B_Phish66 7497 2.23 3.86 1.84 107 HELO_NODOT 7494 1.63 0.77 1.84 108 HELO_NO_DOMAIN 7492 1.63 0.77 1.84 109 TR_XM_SpammyRelay 7461 4.61 16.21 1.83 110 XM_CamelCaseFrm001 7177 1.83 2.10 1.76 111 RCVD_IN_RP_CERTIFIED 7120 1.49 0.40 1.75 112 XM_DK_Undo_01 7108 1.79 1.96 1.75 113 BOTNET 7058 4.72 17.19 1.73 114 IN_HORDE_ADDRESS_BOOK 6953 1.39 0.08 1.71 115 XM_B_Investor 6950 2.64 6.55 1.71 116 INVALID_MSGID 6773 1.39 0.26 1.66 117 TR_Symld_Words 6760 1.60 1.32 1.66 118 KHOP_HELO_FCRDNS 6647 2.40 5.58 1.63 119 XMDiploma_00 6513 1.76 2.40 1.60 120 SUBJ_ALL_CAPS 6499 2.02 3.78 1.60 121 TR_XM_SpammyWords5 6184 2.03 4.18 1.52 122 MSGID_NOFQDN1 6109 1.22 0.02 1.50 123 TO_MALFORMED 6028 1.20 0.02 1.48 124 T_XMDrugObfuBody_08 6022 1.84 3.37 1.48 125 FSL_BULK_SIG 6011 1.89 3.63 1.48 126 TooManyTo_003 5947 1.33 0.79 1.46 127 TM2_M_VERY_LONG_WORD 5793 1.97 4.28 1.42 128 TVD_RCVD_IP 5760 1.21 0.37 1.42 129 XM_GoogleGroups 5742 1.60 2.37 1.41 130 URI_HEX 5606 1.46 1.79 1.38 131 UNTRUSTED_Relay 5590 4.51 17.62 1.37 132 XM_H_Long_From02 5271 1.21 0.85 1.30 133 SHORT_URI_2 5221 1.26 1.18 1.28 134 XMGappySubj_01 4934 1.00 0.11 1.21 135 XMStockSpam_06 4754 1.38 2.24 1.17 136 HTML_FONT_FACE_BAD 4707 1.07 0.68 1.16 137 XMSexyCombo_01 4620 1.47 2.86 1.14 138 XMCapTrack 4620 0.99 0.39 1.14 139 XMSubNoVowel 4376 1.04 0.87 1.08 140 XM_OfRef6 4372 1.70 4.33 1.07 141 XM_H_SpoofStaff4 4183 0.92 0.46 1.03 142 TooManyTo_004 4125 0.93 0.59 1.01 143 RELAYCOUNTRY_CA 4090 2.09 6.62 1.01 144 XMBSHREFv2 4047 0.86 0.29 0.99 145 TVD_SPACE_RATIO 3907 0.79 0.09 0.96 146 TR_XM_SpammyWords2 3831 3.32 13.26 0.94 147 DKIM_ADSP_CUSTOM_MED 3825 0.96 1.03 0.94 148 RCVD_IN_MSPIKE_BL 3770 2.46 8.85 0.93 149 TR_XM_MSPIKECOMBO 3743 2.45 8.83 0.92 150 HTTPS_HTTP_MISMATCH 3628 0.94 1.15 0.89 151 XM_UB50 3594 2.47 9.10 0.88 152 RCVD_IN_BL_SPAMCOP_NET 3447 2.98 11.89 0.85 153 T_FILL_THIS_FORM_SHORT 3445 1.66 5.06 0.85 154 TooManyTo_005 3369 0.77 0.53 0.83 155 TR_MetaPhish_Combo_01 3336 0.86 1.04 0.82 156 RELAYCOUNTRY_GB 3299 0.88 1.18 0.81 157 XMHTML_After_End 3247 0.97 1.68 0.80 158 XMBrknScrpt_02 3203 0.89 1.34 0.79 159 T_Symld_Words_02 3170 1.23 3.13 0.78 160 T_TooManySym_03 3106 0.68 0.31 0.76 161 HTML_IMAGE_ONLY_20 3046 0.65 0.22 0.75 162 SpammyFromTLD_01 3025 1.45 4.39 0.74 163 XMPhish30 3017 0.79 0.99 0.74 164 XM_B_COVIDMETA 2872 0.98 2.11 0.71 165 XMGenDplmaNmb 2870 0.84 1.43 0.71 166 T_XMDrugObfuBody_00 2775 0.85 1.57 0.68 167 XMBody_95 2768 0.58 0.17 0.68 168 TR_XM_MaxUnsub 2765 1.32 3.98 0.68 169 XMBdyGiftCard01 2743 0.64 0.51 0.67 170 XMSubMetaI_00 2737 0.71 0.84 0.67 171 XMLngstWrd_00 2630 0.92 2.07 0.65 172 XM_ProductURIs 2572 0.66 0.77 0.63 173 XM_ShortIntro_01 2570 0.64 0.68 0.63 174 URI_TRY_3LD 2559 0.72 1.10 0.63 175 FROM_GOV_DKIM_AU 2538 0.53 0.13 0.62 176 HTML_TAG_BALANCE_BODY 2488 0.66 0.85 0.61 177 NML_ADSP_CUSTOM_MED 2449 0.66 0.90 0.60 178 XMNoVowels 2410 0.59 0.60 0.59 179 T_OBFU_PDF_ATTACH 2389 0.49 0.11 0.59 180 TR_MSPIKEBAYES00 2365 0.47 0.02 0.58 181 XM_B_COPY_HTML 2351 0.64 0.89 0.58 182 XMLngstWrd_01 2331 0.85 2.02 0.57 183 FROM_GOV_SPOOF 2322 0.50 0.21 0.57 184 TR_XM_Spammywords 2293 0.63 0.88 0.56 185 XM_S_SpammyWords 2293 0.63 0.88 0.56 186 PLING_QUERY 2273 0.60 0.79 0.56 187 XM_H_PHPMailer 2195 0.63 1.01 0.54 188 RCVD_IN_SORBS_DUL 2189 0.50 0.34 0.54 189 SHORT_HELO_AND_INLINE_IMAGE 2157 0.45 0.12 0.53 190 XMMoneyMeta_00 2129 0.67 1.29 0.52 191 FORGED_GMAIL_RCVD 2098 0.59 0.90 0.52 192 XMHTMLBadTable_001 2096 0.58 0.83 0.52 193 XM_B_SpammyWords4 2026 0.93 2.74 0.50 194 T_XMHurry_00 1984 0.67 1.44 0.49 195 XMLngstWrd_02 1976 0.76 1.92 0.49 196 MPART_ALT_DIFF_COUNT 1947 0.54 0.81 0.48 197 HTML_IMAGE_ONLY_32 1824 0.43 0.34 0.45 198 RDNS_DYNAMIC 1810 0.54 0.96 0.44 199 XMSubMetaSx_01 1792 0.51 0.79 0.44 200 SpammyFromTLD_02 1785 1.82 7.58 0.44 ----------------------------------------------------------------------