Email: 487500 Autolearn: 0 AvgScore: 2.02 AvgScanTime: 1.48 sec Spam: 116004 Autolearn: 0 AvgScore: 13.94 AvgScanTime: 1.74 sec Ham: 371496 Autolearn: 0 AvgScore: -1.70 AvgScanTime: 1.40 sec Time Spent Running SA: 200.49 hours Time Spent Processing Spam: 56.17 hours Time Spent Processing Ham: 144.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 110300 88.19 95.08 86.03 2 DKIM_SIGNED 95749 73.72 82.54 70.96 3 XM_DK_Pass 92276 71.57 79.55 69.07 4 RELAYCOUNTRY_US 89556 79.24 77.20 79.88 5 DKIM_VALID 88532 68.98 76.32 66.69 6 XM_B_Unicode 87763 69.00 75.66 66.92 7 DCC_CHECK 82832 43.43 71.40 34.69 8 XMListUnsubscribeExists 79766 50.07 68.76 44.23 9 XM_B_SpammyWords 78767 48.67 67.90 42.67 10 DKIM_VALID_AU 66504 51.79 57.33 50.06 11 BAYES_50 54128 52.49 46.66 54.31 12 XM_B_Unicode3 50132 39.69 43.22 38.59 13 XM_DK_Undo_02 46532 14.36 40.11 6.32 14 XM_B_SpammyWords2 43361 22.41 37.38 17.74 15 LOC_TINY_FONT_1 41132 24.77 35.46 21.44 16 MIME_HTML_ONLY 38555 23.43 33.24 20.37 17 TR_XM_DKIM_Undo 38467 11.49 33.16 4.73 18 HTML_FONT_LOW_CONTRAST 37464 27.38 32.30 25.85 19 FVGT_m_MULTI_ODD 33947 24.33 29.26 22.79 20 BAYES_99 33439 10.47 28.83 4.74 21 T_KAM_HTML_FONT_INVALID 33214 20.19 28.63 17.56 22 DCC_CHECK_NEGATIVE 33128 56.52 28.56 65.26 23 DKIM_VALID_EF 32752 26.91 28.23 26.50 24 RCVD_IN_MSPIKE_H2 29007 21.90 25.01 20.92 25 XMSubLong 28977 21.96 24.98 21.02 26 T_TM2_M_HEADER_IN_MSG 28098 29.37 24.22 30.98 27 RELAYCOUNTRY_META 26356 7.96 22.72 3.35 28 BAYES_999 26161 8.23 22.55 3.76 29 TR_DCC_Bayes_99 24951 6.56 21.51 1.89 30 XM_Body_Dirty_Words 24046 13.11 20.73 10.73 31 RCVD_IN_MSPIKE_WL 22972 26.63 19.80 28.76 32 XM_Multi_Part_URI 18720 12.19 16.14 10.96 33 BOTNET 17541 4.77 15.12 1.54 34 UNTRUSTED_Relay 16415 4.27 14.15 1.19 35 UNPARSEABLE_RELAY 15617 9.13 13.46 7.78 36 TR_XM_UnparsRelay 15171 7.53 13.08 5.80 37 BOTNET_IPINHOSTNAME 15097 6.31 13.01 4.22 38 LOTS_OF_MONEY 14643 8.44 12.62 7.13 39 XM_B_SpammyWords3 14446 5.90 12.45 3.85 40 RCVD_IN_MSPIKE_H3 14307 14.48 12.33 15.15 41 FSL_BULK_SIG 14185 7.84 12.23 6.47 42 TR_XM_SpammyRelay 13453 3.80 11.60 1.37 43 TR_XM_SpammyWords4 13015 6.10 11.22 4.50 44 XM_UncommonTLD01 12828 5.07 11.06 3.20 45 XM_Evil_Numbers_Gen 12757 8.79 11.00 8.10 46 XM_B_Unsub 12591 10.85 10.85 10.85 47 TR_XM_SpammyWords2 12539 3.14 10.81 0.74 48 MPART_ALT_DIFF 12100 6.82 10.43 5.69 49 HTML_IMAGE_RATIO_02 11378 7.68 9.81 7.01 50 XMSexyCombo_05 10860 4.65 9.36 3.17 51 XM_UB50 10273 2.63 8.86 0.69 52 TR_XM_PhishingBody 10001 4.58 8.62 3.32 53 XM_SendGrid 9429 6.84 8.13 6.44 54 XM_H_Long_From01 9224 5.78 7.95 5.10 55 RCVD_IN_BL_SPAMCOP_NET 8753 2.44 7.55 0.84 56 LotsOfNums_01 8653 8.61 7.46 8.97 57 BAYES_60 8404 8.46 7.24 8.84 58 HTML_MIME_NO_HTML_TAG 8321 3.70 7.17 2.62 59 RCVD_IN_MSPIKE_H4 8128 10.39 7.01 11.45 60 BAYES_80 7988 4.45 6.89 3.69 61 XM_SPF_SoftFail 7856 3.42 6.77 2.38 62 XMSubMetaSx_00 7302 4.64 6.29 4.12 63 DKIM_INVALID 7217 4.74 6.22 4.27 64 XM_B_Phish_Phrases 7169 4.32 6.18 3.74 65 XMNumbers 7141 4.57 6.16 4.08 66 MIME_HTML_MOSTLY 7120 3.28 6.14 2.38 67 TooManyTo_001 7084 8.90 6.11 9.78 68 XM_B_Phish66 7060 3.03 6.09 2.07 69 MIME_HTML_ONLY_MULTI 6503 4.39 5.61 4.02 70 RCVD_IN_MSPIKE_BL 6091 1.94 5.25 0.91 71 TR_XM_MSPIKECOMBO 6072 1.93 5.23 0.89 72 XM_B_Investor 5902 2.64 5.09 1.88 73 RELAYCOUNTRY_CA 5805 1.77 5.00 0.76 74 SpammyFromTLD_02 5716 1.32 4.93 0.19 75 TR_XM_DK_SendGrid 5480 4.31 4.72 4.18 76 TR_XM_SPAMCOP 5473 1.34 4.72 0.29 77 XM_OfRef6 5243 1.82 4.52 0.98 78 TM2_M_VERY_LONG_WORD 4992 2.11 4.30 1.43 79 URI_NOVOWEL 4989 3.15 4.30 2.78 80 HTML_IMAGE_RATIO_04 4910 4.92 4.23 5.14 81 TM2_M_URI_OPT_OUT 4892 4.05 4.22 4.00 82 RCVD_IN_VALIDITY_SAFE 4612 4.96 3.98 5.27 83 XMStrtUSub 4601 4.61 3.97 4.81 84 T_REMOTE_IMAGE 4593 3.93 3.96 3.92 85 MIME_QP_LONG_LINE 4417 5.89 3.81 6.54 86 TR_XM_SpammyWords5 4407 2.07 3.80 1.53 87 T_XMDrugObfuBody_08 4351 2.52 3.75 2.13 88 SpammyFromTLD_01 4318 1.42 3.72 0.70 89 DATE_IN_PAST_03_06 4241 1.09 3.66 0.29 90 HTML_IMAGE_RATIO_06 4106 3.60 3.54 3.62 91 BAYES_95 4014 2.53 3.46 2.24 92 RCVD_IN_PSBL 3991 0.85 3.44 0.05 93 TR_XM_SpammyWords3 3784 1.11 3.26 0.43 94 RCVD_IN_VALIDITY_CERTIFIED 3703 4.26 3.19 4.59 95 TR_XM_MaxUnsub 3689 1.30 3.18 0.71 96 T_XMDrugObfuBody_14 3620 2.25 3.12 1.98 97 BODY_URI_ONLY 3590 0.75 3.09 0.02 98 KHOP_HELO_FCRDNS 3586 2.11 3.09 1.81 99 XM_B_SpammyTLD 3563 2.16 3.07 1.88 100 XMDiploma_00 3473 1.96 2.99 1.64 101 RELAYCOUNTRY_RU 3463 0.73 2.99 0.02 102 HTML_IMAGE_RATIO_08 3341 2.54 2.88 2.44 103 HTML_TAG_BALANCE_CENTER 3187 0.72 2.75 0.08 104 TVD_SPACE_RATIO 3187 1.51 2.75 1.13 105 RCVD_IN_VALIDITY_RPBL 3183 0.72 2.74 0.09 106 RCVD_IN_IADB_LISTED 3138 4.56 2.71 5.14 107 HTML_SHORT_LINK_IMG_1 3051 0.65 2.63 0.03 108 T_TooManySym_01 2984 4.93 2.57 5.67 109 ALL_TRUSTED 2964 14.22 2.56 17.86 110 T_FILL_THIS_FORM_SHORT 2936 1.30 2.53 0.91 111 XMBody_17 2884 0.86 2.49 0.36 112 XM_DIRTYINTL 2883 0.79 2.49 0.26 113 BAYES_40 2854 4.87 2.46 5.63 114 XM_GoogleGroups 2845 1.67 2.45 1.42 115 XMSexyCombo_01 2833 1.33 2.44 0.99 116 XM_CamelCaseFrm001 2756 1.90 2.38 1.75 117 RELAYCOUNTRY_CH 2737 0.58 2.36 0.03 118 TR_XM_PHPDW 2722 0.80 2.35 0.31 119 RELAYCOUNTRY_FR 2710 0.69 2.34 0.18 120 HK_RANDOM_FROM 2695 0.64 2.32 0.11 121 TR_XM_SB_Phish 2684 2.30 2.31 2.29 122 XMStockSpam_06 2669 1.44 2.30 1.17 123 HK_RANDOM_ENVFROM 2638 0.62 2.27 0.10 124 XMSubPhish11 2611 2.27 2.25 2.27 125 RCVD_IN_MSPIKE_L3 2599 0.82 2.24 0.37 126 RCVD_IN_IADB_SPF 2597 4.00 2.24 4.54 127 XM_DK_Undo_01 2551 1.76 2.20 1.63 128 XM_B_COVIDMETA 2496 0.94 2.15 0.57 129 TR_Mismatch_TLD_02 2471 0.57 2.13 0.08 130 HTML_IMAGE_ONLY_04 2469 0.56 2.13 0.07 131 TR_XM_PHPForged 2465 0.72 2.12 0.28 132 URIBL_DBL_SPAM 2459 0.51 2.12 0.00 133 XM_B_Unsub2 2458 1.71 2.12 1.58 134 FROM_EXCESS_BASE64 2455 2.33 2.12 2.40 135 TR_XM_FormFill2 2446 0.71 2.11 0.28 136 TR_XM_NoHeaderRelay 2444 0.63 2.11 0.17 137 SHORT_SHORTNER 2444 0.51 2.11 0.01 138 XM_DrugUnitList 2438 0.50 2.10 0.00 139 ALIBABA_IMG_NOT_RCVD_ALI 2436 0.50 2.10 0.00 140 HOSTED_IMG_DIRECT_MX 2420 0.50 2.09 0.00 141 XM_H_PHPOS 2418 0.70 2.08 0.27 142 XMLngstWrd_00 2408 0.99 2.08 0.65 143 MAILING_LIST_MULTI 2406 2.59 2.07 2.75 144 HTML_SHORT_CENTER 2385 0.49 2.06 0.00 145 SHORTENER_SHORT_IMG 2374 0.49 2.05 0.00 146 XMLngstWrd_01 2373 0.94 2.05 0.59 147 RCVD_IN_IADB_SENDERID 2337 3.59 2.01 4.08 148 RCVD_IN_IADB_DK 2337 3.47 2.01 3.92 149 XM_URI_RBL 2309 0.56 1.99 0.11 150 XMLngstWrd_02 2303 0.86 1.99 0.50 151 URI_HEX 2271 1.58 1.96 1.46 152 TM2_M_A_HREF_HREF 2267 0.73 1.95 0.35 153 XMLngstWrd_03 2253 0.78 1.94 0.41 154 JH_SPAMMY_HEADERS 2244 0.46 1.93 0.00 155 T_XMHurry_00 2239 0.79 1.93 0.43 156 RCVD_IN_MSPIKE_L5 2204 0.61 1.90 0.21 157 XMLngstWrd_04 2177 0.72 1.88 0.35 158 HTML_TITLE_SUBJ_DIFF 2161 0.62 1.86 0.23 159 BAYES_20 2107 3.57 1.82 4.12 160 UPPERCASE_75_100 2105 0.62 1.81 0.25 161 XMGenDplmaNmb 2084 1.08 1.80 0.86 162 RCVD_IN_IADB_VOUCHED 2078 2.79 1.79 3.10 163 SUBJ_ALL_CAPS 2071 1.56 1.79 1.49 164 XMBrknScrpt_02 2053 1.17 1.77 0.98 165 READY_TO_SHIP 2037 0.42 1.76 0.00 166 WANT_TO_ORDER 2035 0.42 1.75 0.00 167 TR_XM_INV_DKIM 2011 0.61 1.73 0.26 168 XM_B_SpammyWords4 2010 0.73 1.73 0.41 169 URIBL_BLACK 1952 0.44 1.68 0.05 170 URI_BUFFLY 1947 0.40 1.68 0.00 171 USER_IN_DEF_DKIM_WL 1947 8.78 1.68 11.00 172 TR_XM_FormFill 1912 0.42 1.65 0.04 173 BAYES_00 1912 11.02 1.65 13.94 174 TR_XM_COVIDMETA4 1905 0.68 1.64 0.37 175 TR_XM_COVIDMETA1 1877 0.55 1.62 0.22 176 T_XMDrugObfuBody_00 1768 0.85 1.52 0.64 177 XMSubMetaI_00 1733 0.68 1.49 0.43 178 XM_UB99 1726 0.36 1.49 0.00 179 TR_Symld_Words 1709 1.65 1.47 1.71 180 DKIM_ADSP_CUSTOM_MED 1706 1.17 1.47 1.08 181 XMHTML_After_End 1695 0.96 1.46 0.80 182 BOTNET_NORDNS 1686 0.36 1.45 0.02 183 XM_UB60 1627 0.38 1.40 0.07 184 XMBdyGiftCard01 1611 0.79 1.39 0.60 185 HTTPS_HTTP_MISMATCH 1594 0.89 1.37 0.74 186 RELAYCOUNTRY_AU 1565 0.54 1.35 0.29 187 RELAYCOUNTRY_GB 1558 0.90 1.34 0.76 188 DIET_1 1529 0.68 1.32 0.48 189 RELAYCOUNTRY_IN 1482 0.37 1.28 0.09 190 TR_LOTS_OF_MONEY2 1468 0.48 1.27 0.23 191 T_MONEY_PERCENT 1468 0.48 1.27 0.23 192 NML_ADSP_CUSTOM_MED 1453 0.85 1.25 0.73 193 HTML_IMAGE_ONLY_08 1436 0.41 1.24 0.15 194 XM_H_PHPMailer 1434 0.76 1.24 0.61 195 TR_LOTS_OF_MONEY3 1408 0.79 1.21 0.66 196 URI_TRY_3LD 1389 0.78 1.20 0.65 197 XM_UB999 1382 0.28 1.19 0.00 198 TR_MetaPhish_Combo_01 1378 0.85 1.19 0.75 199 T_Symld_Words_02 1352 0.79 1.17 0.68 200 XM_H_Long_From02 1323 1.02 1.14 0.98 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 319616 88.19 95.08 86.03 2 RELAYCOUNTRY_US 296742 79.24 77.20 79.88 3 DKIM_SIGNED 263625 73.72 82.54 70.96 4 XM_DK_Pass 256609 71.57 79.55 69.07 5 XM_B_Unicode 248607 69.00 75.66 66.92 6 DKIM_VALID 247745 68.98 76.32 66.69 7 DCC_CHECK_NEGATIVE 242427 56.52 28.56 65.26 8 BAYES_50 201749 52.49 46.66 54.31 9 DKIM_VALID_AU 185983 51.79 57.33 50.06 10 XMListUnsubscribeExists 164319 50.07 68.76 44.23 11 XM_B_SpammyWords 158512 48.67 67.90 42.67 12 XM_B_Unicode3 143343 39.69 43.22 38.59 13 DCC_CHECK 128887 43.43 71.40 34.69 14 T_TM2_M_HEADER_IN_MSG 115087 29.37 24.22 30.98 15 RCVD_IN_MSPIKE_WL 106847 26.63 19.80 28.76 16 DKIM_VALID_EF 98440 26.91 28.23 26.50 17 HTML_FONT_LOW_CONTRAST 96021 27.38 32.30 25.85 18 FVGT_m_MULTI_ODD 84674 24.33 29.26 22.79 19 LOC_TINY_FONT_1 79639 24.77 35.46 21.44 20 XMSubLong 78102 21.96 24.98 21.02 21 RCVD_IN_MSPIKE_H2 77734 21.90 25.01 20.92 22 MIME_HTML_ONLY 75668 23.43 33.24 20.37 23 ALL_TRUSTED 66337 14.22 2.56 17.86 24 XM_B_SpammyWords2 65895 22.41 37.38 17.74 25 T_KAM_HTML_FONT_INVALID 65219 20.19 28.63 17.56 26 RCVD_IN_MSPIKE_H3 56273 14.48 12.33 15.15 27 BAYES_00 51788 11.02 1.65 13.94 28 RCVD_IN_MSPIKE_H4 42521 10.39 7.01 11.45 29 USER_IN_DEF_DKIM_WL 40860 8.78 1.68 11.00 30 XM_Multi_Part_URI 40698 12.19 16.14 10.96 31 XM_B_Unsub 40296 10.85 10.85 10.85 32 XM_Body_Dirty_Words 39854 13.11 20.73 10.73 33 TooManyTo_001 36325 8.90 6.11 9.78 34 LotsOfNums_01 33339 8.61 7.46 8.97 35 BAYES_60 32846 8.46 7.24 8.84 36 TR_XM_DK_Bayes 30482 6.43 0.73 8.21 37 XM_Evil_Numbers_Gen 30079 8.79 11.00 8.10 38 TR_XM_DK_Bayes1 29407 6.19 0.68 7.92 39 UNPARSEABLE_RELAY 28898 9.13 13.46 7.78 40 XM_DKIMWhitelistDomains 28811 5.95 0.16 7.76 41 LOTS_OF_MONEY 26480 8.44 12.62 7.13 42 HTML_IMAGE_RATIO_02 26039 7.68 9.81 7.01 43 TR_XM_DK_Bayes2 24804 5.21 0.49 6.68 44 IN_ZIMBRA_NJ_WHITELIST 24781 5.10 0.09 6.67 45 MIME_QP_LONG_LINE 24286 5.89 3.81 6.54 46 FSL_BULK_SIG 24042 7.84 12.23 6.47 47 XM_SendGrid 23927 6.84 8.13 6.44 48 XM_DK_Undo_02 23464 14.36 40.11 6.32 49 XM_PDF 21960 4.74 0.99 5.91 50 TR_XM_UnparsRelay 21538 7.53 13.08 5.80 51 MPART_ALT_DIFF 21151 6.82 10.43 5.69 52 T_TooManySym_01 21059 4.93 2.57 5.67 53 BAYES_40 20898 4.87 2.46 5.63 54 RCVD_IN_VALIDITY_SAFE 19560 4.96 3.98 5.27 55 RCVD_IN_IADB_LISTED 19110 4.56 2.71 5.14 56 HTML_IMAGE_RATIO_04 19095 4.92 4.23 5.14 57 XM_H_Long_From01 18939 5.78 7.95 5.10 58 XMStrtUSub 17886 4.61 3.97 4.81 59 BAYES_99 17604 10.47 28.83 4.74 60 TR_XM_DKIM_Undo 17554 11.49 33.16 4.73 61 RCVD_IN_VALIDITY_CERTIFIED 17048 4.26 3.19 4.59 62 RCVD_IN_IADB_SPF 16881 4.00 2.24 4.54 63 TR_XM_SpammyWords4 16731 6.10 11.22 4.50 64 DKIM_INVALID 15880 4.74 6.22 4.27 65 XM_H_Trusted_IP 15813 3.24 0.00 4.26 66 BOTNET_IPINHOSTNAME 15669 6.31 13.01 4.22 67 TR_XM_DK_SendGrid 15543 4.31 4.72 4.18 68 BAYES_20 15314 3.57 1.82 4.12 69 XMSubMetaSx_00 15307 4.64 6.29 4.12 70 RCVD_IN_IADB_SENDERID 15155 3.59 2.01 4.08 71 XMNumbers 15155 4.57 6.16 4.08 72 MIME_HTML_ONLY_MULTI 14921 4.39 5.61 4.02 73 TM2_M_URI_OPT_OUT 14858 4.05 4.22 4.00 74 RCVD_IN_IADB_DK 14576 3.47 2.01 3.92 75 T_REMOTE_IMAGE 14552 3.93 3.96 3.92 76 XM_B_SpammyWords3 14321 5.90 12.45 3.85 77 BAYES_999 13959 8.23 22.55 3.76 78 XM_B_Phish_Phrases 13894 4.32 6.18 3.74 79 ANY_BOUNCE_MESSAGE 13812 3.01 0.74 3.72 80 BOUNCE_MESSAGE 13808 3.01 0.73 3.72 81 BAYES_80 13720 4.45 6.89 3.69 82 HTML_IMAGE_RATIO_06 13430 3.60 3.54 3.62 83 RELAYCOUNTRY_META 12433 7.96 22.72 3.35 84 TR_XM_PhishingBody 12329 4.58 8.62 3.32 85 T_TooManySym_02 12277 2.71 0.79 3.30 86 XM_UncommonTLD01 11886 5.07 11.06 3.20 87 XMSexyCombo_05 11791 4.65 9.36 3.17 88 RCVD_IN_IADB_VOUCHED 11504 2.79 1.79 3.10 89 URI_NOVOWEL 10343 3.15 4.30 2.78 90 MAILING_LIST_MULTI 10208 2.59 2.07 2.75 91 HTML_MIME_NO_HTML_TAG 9722 3.70 7.17 2.62 92 BAYES_05 9252 2.13 0.98 2.49 93 TooManyTo_002 9079 2.01 0.62 2.44 94 HTML_IMAGE_RATIO_08 9050 2.54 2.88 2.44 95 FROM_EXCESS_BASE64 8917 2.33 2.12 2.40 96 MIME_HTML_MOSTLY 8858 3.28 6.14 2.38 97 XM_SPF_SoftFail 8839 3.42 6.77 2.38 98 TR_XM_SB_Phish 8521 2.30 2.31 2.29 99 XMSubPhish11 8440 2.27 2.25 2.27 100 BAYES_95 8311 2.53 3.46 2.24 101 RCVD_IN_MSPIKE_H5 8053 1.76 0.46 2.17 102 T_XMDrugObfuBody_08 7913 2.52 3.75 2.13 103 HELO_NODOT 7700 1.75 0.72 2.07 104 RCVD_IN_IADB_OPTIN 7699 1.85 1.13 2.07 105 HELO_NO_DOMAIN 7697 1.75 0.71 2.07 106 XM_B_Phish66 7690 3.03 6.09 2.07 107 T_XMDrugObfuBody_14 7373 2.25 3.12 1.98 108 TR_DCC_Bayes_99 7016 6.56 21.51 1.89 109 XM_B_SpammyTLD 6989 2.16 3.07 1.88 110 XM_B_Investor 6988 2.64 5.09 1.88 111 IN_HORDE_ADDRESS_BOOK 6878 1.44 0.11 1.85 112 INVALID_MSGID 6792 1.44 0.20 1.83 113 KHOP_HELO_FCRDNS 6719 2.11 3.09 1.81 114 XM_CamelCaseFrm001 6507 1.90 2.38 1.75 115 TR_Symld_Words 6342 1.65 1.47 1.71 116 MSGID_NOFQDN1 6259 1.30 0.08 1.68 117 TO_MALFORMED 6169 1.27 0.01 1.66 118 TooManyTo_003 6081 1.36 0.49 1.64 119 XMDiploma_00 6078 1.96 2.99 1.64 120 XM_DK_Undo_01 6047 1.76 2.20 1.63 121 TVD_RCVD_IP 5990 1.26 0.15 1.61 122 XM_B_Unsub2 5858 1.71 2.12 1.58 123 BOTNET 5737 4.77 15.12 1.54 124 TR_XM_SpammyWords5 5670 2.07 3.80 1.53 125 SUBJ_ALL_CAPS 5542 1.56 1.79 1.49 126 URI_HEX 5442 1.58 1.96 1.46 127 TM2_M_VERY_LONG_WORD 5313 2.11 4.30 1.43 128 XM_GoogleGroups 5279 1.67 2.45 1.42 129 XMCapTrack 5091 1.16 0.50 1.37 130 TR_XM_SpammyRelay 5071 3.80 11.60 1.37 131 HTML_FONT_FACE_BAD 4910 1.17 0.67 1.32 132 XMSubNoVowel 4783 1.10 0.48 1.29 133 TooManyTo_004 4510 1.02 0.40 1.21 134 UNTRUSTED_Relay 4417 4.27 14.15 1.19 135 XMStockSpam_06 4336 1.44 2.30 1.17 136 XMGappySubj_01 4212 0.91 0.20 1.13 137 TVD_SPACE_RATIO 4180 1.51 2.75 1.13 138 DKIM_ADSP_CUSTOM_MED 4015 1.17 1.47 1.08 139 RCVD_IN_RP_SAFE 3870 0.98 0.78 1.04 140 XM_E_Blogspot 3818 0.83 0.21 1.03 141 TooManyTo_005 3754 0.85 0.36 1.01 142 T_OBFU_PDF_ATTACH 3745 0.80 0.15 1.01 143 XMBSHREFv2 3678 0.82 0.29 0.99 144 XMSexyCombo_01 3660 1.33 2.44 0.99 145 XM_H_Long_From02 3653 1.02 1.14 0.98 146 XMBrknScrpt_02 3642 1.17 1.77 0.98 147 XM_OfRef6 3630 1.82 4.52 0.98 148 RCVD_IN_RP_CERTIFIED 3392 0.84 0.60 0.91 149 T_FILL_THIS_FORM_SHORT 3381 1.30 2.53 0.91 150 RCVD_IN_MSPIKE_BL 3372 1.94 5.25 0.91 151 TR_XM_MSPIKECOMBO 3315 1.93 5.23 0.89 152 XMGenDplmaNmb 3203 1.08 1.80 0.86 153 RCVD_IN_BL_SPAMCOP_NET 3136 2.44 7.55 0.84 154 T_TooManySym_03 3095 0.73 0.42 0.83 155 XMHTML_After_End 2978 0.96 1.46 0.80 156 XMBody_95 2923 0.62 0.10 0.79 157 SHORT_URI_2 2865 0.72 0.55 0.77 158 RELAYCOUNTRY_CA 2830 1.77 5.00 0.76 159 RELAYCOUNTRY_GB 2826 0.90 1.34 0.76 160 XM_ProductURIs 2798 0.80 0.97 0.75 161 TR_MetaPhish_Combo_01 2768 0.85 1.19 0.75 162 TR_XM_SpammyWords2 2760 3.14 10.81 0.74 163 HTTPS_HTTP_MISMATCH 2756 0.89 1.37 0.74 164 NML_ADSP_CUSTOM_MED 2705 0.85 1.25 0.73 165 TR_XM_MaxUnsub 2650 1.30 3.18 0.71 166 XM_ShortIntro_01 2620 0.67 0.54 0.71 167 HTML_IMAGE_ONLY_20 2603 0.58 0.19 0.70 168 SpammyFromTLD_01 2599 1.42 3.72 0.70 169 XM_UB50 2567 2.63 8.86 0.69 170 T_Symld_Words_02 2518 0.79 1.17 0.68 171 TR_LOTS_OF_MONEY3 2441 0.79 1.21 0.66 172 XMLngstWrd_00 2414 0.99 2.08 0.65 173 URI_TRY_3LD 2407 0.78 1.20 0.65 174 T_XMDrugObfuBody_00 2360 0.85 1.52 0.64 175 XM_RXBody 2271 0.55 0.34 0.61 176 XM_H_PHPMailer 2259 0.76 1.24 0.61 177 XMBdyGiftCard01 2246 0.79 1.39 0.60 178 RCVD_IN_SORBS_DUL 2243 0.52 0.26 0.60 179 XMLngstWrd_01 2204 0.94 2.05 0.59 180 SHORT_HELO_AND_INLINE_IMAGE 2171 0.47 0.11 0.58 181 XM_B_COPY_HTML 2154 0.61 0.70 0.58 182 XMNoVowels 2140 0.58 0.61 0.58 183 FORGED_GMAIL_RCVD 2126 0.66 0.92 0.57 184 XM_B_COVIDMETA 2109 0.94 2.15 0.57 185 XMPhish30 2087 0.65 0.94 0.56 186 HTML_IMAGE_ONLY_28 2013 0.50 0.36 0.54 187 TR_MSPIKEBAYES00 1990 0.41 0.02 0.54 188 TM2_M_BODY_EMPTY 1990 0.51 0.41 0.54 189 XMSubMetaSxObfu_03 1988 0.56 0.63 0.54 190 XMLngstWrd_02 1871 0.86 1.99 0.50 191 FROM_GOV_DKIM_AU 1807 0.40 0.11 0.49 192 XMMoneyMeta_00 1790 0.57 0.83 0.48 193 DIET_1 1766 0.68 1.32 0.48 194 HTML_TAG_BALANCE_BODY 1750 0.54 0.76 0.47 195 MISSING_HEADERS 1723 0.48 0.55 0.46 196 T_MANY_PILL_PRICE 1711 0.36 0.04 0.46 197 XMOemUri 1705 0.42 0.31 0.46 198 HTML_IMAGE_ONLY_32 1703 0.41 0.25 0.46 199 PLING_QUERY 1698 0.57 0.92 0.46 200 USER_IN_WHITELIST 1696 0.35 0.00 0.46 ----------------------------------------------------------------------