Email: 497384 Autolearn: 0 AvgScore: 3.97 AvgScanTime: 1.16 sec Spam: 161688 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.32 sec Ham: 335696 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.09 sec Time Spent Running SA: 160.84 hours Time Spent Processing Spam: 59.11 hours Time Spent Processing Ham: 101.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154227 88.08 95.39 84.56 2 DKIM_SIGNED 139307 76.63 86.16 72.04 3 XM_DK_Pass 136901 74.71 84.67 69.91 4 DKIM_VALID 135884 73.87 84.04 68.97 5 RELAYCOUNTRY_US 133662 81.00 82.67 80.19 6 XM_B_Unicode 129560 72.76 80.13 69.21 7 DCC_CHECK 116881 45.59 72.29 32.73 8 XM_B_SpammyWords 109246 50.01 67.57 41.56 9 XMListUnsubscribeExists 105889 53.04 65.49 47.05 10 DKIM_VALID_AU 102859 56.42 63.62 52.95 11 XM_B_Unicode3 70417 41.11 43.55 39.94 12 BAYES_50 69108 51.86 42.74 56.26 13 XM_DK_Undo_02 65928 17.69 40.77 6.57 14 XM_B_SpammyWords2 61724 24.40 38.17 17.76 15 LOC_TINY_FONT_1 59420 26.18 36.75 21.08 16 FVGT_m_MULTI_ODD 55309 26.98 34.21 23.50 17 RCVD_IN_MSPIKE_H2 54093 29.25 33.46 27.22 18 HTML_FONT_LOW_CONTRAST 52786 26.86 32.65 24.08 19 MIME_HTML_ONLY 52378 23.35 32.39 19.00 20 TR_XM_DKIM_Undo 52228 13.48 32.30 4.42 21 BAYES_99 51735 14.10 32.00 5.48 22 DKIM_VALID_EF 50131 27.83 31.00 26.31 23 T_KAM_HTML_FONT_INVALID 45557 22.39 28.18 19.60 24 DCC_CHECK_NEGATIVE 44752 54.37 27.68 67.22 25 BAYES_999 41016 11.23 25.37 4.42 26 XMSubLong 38109 22.89 23.57 22.56 27 TR_DCC_Bayes_99 37593 8.60 23.25 1.54 28 XM_Body_Dirty_Words 37369 14.70 23.11 10.64 29 T_TM2_M_HEADER_IN_MSG 35436 26.34 21.92 28.47 30 RELAYCOUNTRY_META 33485 9.21 20.71 3.67 31 XM_Multi_Part_URI 28312 13.17 17.51 11.08 32 XM_B_Unsub 26982 11.08 16.69 8.38 33 TR_XM_BayesUnsub 26304 9.54 16.27 6.30 34 BOTNET_IPINHOSTNAME 23148 7.78 14.32 4.63 35 UNPARSEABLE_RELAY 21463 9.53 13.27 7.73 36 FSL_BULK_SIG 21213 6.58 13.12 3.44 37 TR_XM_UnparsRelay 21057 8.32 13.02 6.05 38 LOTS_OF_MONEY 20505 9.32 12.68 7.70 39 XM_B_SpammyWords3 20326 7.08 12.57 4.43 40 TR_XM_SpammyRelay 18616 4.80 11.51 1.57 41 TR_XM_SpammyWords2 18599 4.34 11.50 0.88 42 RCVD_IN_MSPIKE_WL 18465 14.23 11.42 15.59 43 XMSexyCombo_05 17998 5.69 11.13 3.07 44 TR_XM_SpammyWords4 17877 6.89 11.06 4.88 45 BOTNET 17363 4.57 10.74 1.59 46 UNTRUSTED_Relay 15100 3.85 9.34 1.20 47 XM_UncommonTLD01 15089 5.48 9.33 3.63 48 RCVD_IN_MSPIKE_H3 15074 10.46 9.32 11.01 49 XM_Evil_Numbers_Gen 14747 8.00 9.12 7.46 50 RCVD_IN_BL_SPAMCOP_NET 13550 3.13 8.38 0.60 51 BAYES_80 13451 5.92 8.32 4.76 52 BAYES_60 13336 9.09 8.25 9.50 53 MPART_ALT_DIFF 13269 5.78 8.21 4.62 54 LotsOfNums_01 12870 9.15 7.96 9.72 55 HTML_IMAGE_RATIO_02 11831 6.00 7.32 5.37 56 XMSubMetaSx_00 11240 4.38 6.95 3.15 57 TR_XM_PhishingBody 11021 4.45 6.82 3.31 58 XM_H_Long_From01 10712 5.76 6.63 5.34 59 XM_SendGrid 10633 5.63 6.58 5.18 60 HTML_MIME_NO_HTML_TAG 10192 3.34 6.30 1.91 61 RELAYCOUNTRY_CA 10095 2.66 6.24 0.93 62 XM_B_SpammyTLD 9629 4.95 5.96 4.47 63 XM_B_Phish_Phrases 9608 4.02 5.94 3.09 64 T_XMDrugObfuBody_14 8454 2.98 5.23 1.89 65 TM2_M_VERY_LONG_WORD 8362 2.60 5.17 1.36 66 SpammyFromTLD_01 8107 2.13 5.01 0.75 67 MIME_HTML_MOSTLY 7769 3.00 4.80 2.13 68 TR_XM_SPAMCOP 7724 1.66 4.78 0.16 69 BAYES_95 7553 3.27 4.67 2.60 70 XM_B_Investor 7474 2.55 4.62 1.56 71 XM_SPF_SoftFail 7318 2.93 4.53 2.16 72 T_REMOTE_IMAGE 7254 4.26 4.49 4.14 73 TooManyTo_001 7161 6.98 4.43 8.21 74 MIME_HTML_ONLY_MULTI 7097 3.38 4.39 2.89 75 XM_UB50 7044 1.95 4.36 0.78 76 TR_XM_DK_SendGrid 7018 3.64 4.34 3.30 77 XMStrtUSub 6813 4.45 4.21 4.56 78 MIME_QP_LONG_LINE 6811 5.30 4.21 5.83 79 XM_B_Phish66 6555 2.64 4.05 1.96 80 XMNumbers 6231 4.20 3.85 4.37 81 HTML_IMAGE_RATIO_04 6215 4.65 3.84 5.04 82 XM_OfRef6 5786 2.03 3.58 1.28 83 RCVD_IN_VALIDITY_SAFE 5779 4.22 3.57 4.54 84 TR_XM_SpammyWords5 5766 2.10 3.57 1.39 85 XM_DIRTYINTL 5696 1.36 3.52 0.32 86 XMDiploma_00 5315 2.22 3.29 1.71 87 T_XMDrugObfuBody_08 5304 2.35 3.28 1.90 88 KHOP_HELO_FCRDNS 5195 1.96 3.21 1.35 89 PDS_OTHER_BAD_TLD 5038 1.13 3.12 0.17 90 HTML_IMAGE_RATIO_06 4929 2.90 3.05 2.83 91 XM_DK_Undo_01 4889 1.97 3.02 1.46 92 URIBL_DBL_SPAM 4875 0.99 3.02 0.01 93 RCVD_IN_VALIDITY_CERTIFIED 4862 3.70 3.01 4.03 94 URI_NOVOWEL 4815 2.95 2.98 2.94 95 RCVD_IN_IADB_LISTED 4714 5.26 2.92 6.39 96 TM2_M_URI_OPT_OUT 4702 2.53 2.91 2.35 97 XM_B_Unsub2 4606 1.68 2.85 1.12 98 XMLngstWrd_00 4221 1.10 2.61 0.38 99 RCVD_IN_IADB_SPF 4065 4.61 2.51 5.62 100 RELAYCOUNTRY_RU 4049 0.83 2.50 0.02 101 XMLngstWrd_01 4039 1.03 2.50 0.32 102 HTML_IMAGE_RATIO_08 3960 2.24 2.45 2.14 103 XM_CamelCaseFrm001 3955 2.02 2.45 1.81 104 T_TooManySym_01 3944 5.34 2.44 6.73 105 XMLngstWrd_02 3914 0.96 2.42 0.26 106 XM_H_PHPMailer 3843 1.20 2.38 0.63 107 RCVD_IN_VALIDITY_RPBL 3821 0.78 2.36 0.02 108 RCVD_IN_IADB_DK 3787 4.03 2.34 4.84 109 XM_GoogleGroups 3756 1.62 2.32 1.28 110 USER_IN_DEF_DKIM_WL 3747 9.15 2.32 12.44 111 RCVD_IN_IADB_SENDERID 3735 4.13 2.31 5.01 112 XM_B_SpammyWords4 3683 1.35 2.28 0.90 113 TR_XM_SB_Phish 3617 2.25 2.24 2.25 114 DKIM_INVALID 3423 2.76 2.12 3.07 115 XM_H_Undi_Recip 3421 0.82 2.12 0.19 116 XMSubPhish11 3387 2.18 2.09 2.23 117 SpammyFromTLD_02 3385 0.98 2.09 0.44 118 XMBody_17 3350 0.88 2.07 0.31 119 T_XMDrugObfuBody_00 3291 1.22 2.04 0.83 120 RCVD_IN_PSBL 3286 0.77 2.03 0.16 121 HTML_TITLE_SUBJ_DIFF 3263 0.69 2.02 0.04 122 SUBJ_ALL_CAPS 3244 1.75 2.01 1.63 123 XMLngstWrd_03 3235 0.78 2.00 0.19 124 URI_PHP_REDIR 3169 0.64 1.96 0.00 125 T_FILL_THIS_FORM_SHORT 3136 1.29 1.94 0.97 126 XM_B_COVIDMETA 3134 0.99 1.94 0.53 127 RCVD_IN_MSPIKE_H4 3108 3.29 1.92 3.95 128 XMLngstWrd_04 3055 0.70 1.89 0.13 129 UPPERCASE_75_100 2980 0.62 1.84 0.03 130 URI_PHISH 2890 0.59 1.79 0.01 131 T_XMHurry_00 2852 0.90 1.76 0.48 132 FROM_EXCESS_BASE64 2802 2.26 1.73 2.52 133 TR_XM_Undi_Recip11 2760 0.58 1.71 0.04 134 XMHTML_After_End 2752 1.05 1.70 0.73 135 ALL_TRUSTED 2727 12.18 1.69 17.23 136 RELAYCOUNTRY_FR 2707 0.68 1.67 0.21 137 TR_XM_NoHeaderRelay 2683 0.63 1.66 0.13 138 BAYES_40 2598 3.85 1.61 4.93 139 RCVD_IN_IADB_VOUCHED 2577 3.37 1.59 4.22 140 XMSexyCombo_01 2549 0.75 1.58 0.34 141 HTML_FONT_FACE_BAD 2530 1.23 1.56 1.07 142 RCVD_IN_MSPIKE_BL 2528 0.85 1.56 0.50 143 HTML_IMAGE_ONLY_08 2426 0.56 1.50 0.11 144 BOTNET_NORDNS 2421 0.49 1.50 0.01 145 MAILING_LIST_MULTI 2419 2.45 1.50 2.91 146 XM_UB60 2412 0.53 1.49 0.07 147 TR_XM_PHPDW 2406 0.79 1.49 0.46 148 XMBrknScrpt_02 2374 0.96 1.47 0.72 149 XM_UB99 2370 0.48 1.47 0.00 150 HTTPS_HTTP_MISMATCH 2357 0.98 1.46 0.75 151 TR_Symld_Words 2349 1.60 1.45 1.67 152 TR_XM_MSPIKECOMBO 2339 0.81 1.45 0.50 153 URI_HEX 2312 1.21 1.43 1.10 154 XMStockSpam_06 2286 1.14 1.41 1.01 155 XM_URI_RBL 2268 0.52 1.40 0.09 156 TR_XM_PHPForged 2249 0.73 1.39 0.42 157 TR_XM_COVIDMETA1 2218 0.59 1.37 0.22 158 TR_XM_FormFill2 2204 0.73 1.36 0.42 159 XM_H_PHPOS 2184 0.71 1.35 0.40 160 XMBdyGiftCard01 2149 0.98 1.33 0.81 161 HK_RANDOM_REPLYTO 2148 0.49 1.33 0.08 162 HTML_TAG_BALANCE_CENTER 2126 0.50 1.31 0.10 163 TR_LOTS_OF_MONEY3 2111 0.56 1.31 0.20 164 TR_Mismatch_TLD_01 2098 0.60 1.30 0.27 165 XMGenDplmaNmb 2001 0.90 1.24 0.74 166 XM_H_Long_From02 1988 1.10 1.23 1.04 167 URIBL_BLACK 1967 0.43 1.22 0.05 168 BODY_URI_ONLY 1952 0.41 1.21 0.02 169 HTML_TAG_BALANCE_BODY 1939 0.89 1.20 0.74 170 RELAYCOUNTRY_DE 1928 0.62 1.19 0.34 171 RELAYCOUNTRY_AU 1922 0.64 1.19 0.37 172 DIET_1 1866 0.63 1.15 0.38 173 XMReplyNow 1864 0.52 1.15 0.22 174 URI_TRY_3LD 1850 0.79 1.14 0.61 175 MIXED_CENTER_CASE 1849 0.37 1.14 0.00 176 MIXED_HREF_CASE 1832 0.37 1.13 0.00 177 MIXED_IMG_CASE 1821 0.37 1.13 0.01 178 MIXED_AREA_CASE 1815 0.37 1.12 0.00 179 XMPhish30 1792 0.79 1.11 0.64 180 MIXED_FONT_CASE 1781 0.36 1.10 0.00 181 XM_UB999 1769 0.36 1.09 0.00 182 DATE_IN_PAST_03_06 1743 0.47 1.08 0.18 183 XM_UB80 1729 0.36 1.07 0.02 184 XMSubMetaI_00 1719 0.86 1.06 0.77 185 TR_XM_Undi_Recip6 1719 0.35 1.06 0.00 186 XM_B_SEO 1711 1.01 1.06 0.99 187 T_TooManySym_02 1699 3.22 1.05 4.27 188 RDNS_DYNAMIC 1681 0.65 1.04 0.47 189 ANY_BOUNCE_MESSAGE 1671 2.76 1.03 3.59 190 BOUNCE_MESSAGE 1670 2.76 1.03 3.59 191 XMSubMetaSxObfu_04 1667 0.37 1.03 0.05 192 BAYES_20 1661 2.79 1.03 3.64 193 MPART_ALT_DIFF_COUNT 1631 0.72 1.01 0.57 194 RELAYCOUNTRY_GB 1595 0.79 0.99 0.70 195 XM_ProductURIs 1591 0.73 0.98 0.61 196 T_Symld_Words_02 1572 0.66 0.97 0.50 197 HTML_FONT_SIZE_HUGE 1570 0.35 0.97 0.05 198 URI_GOOG_STO_SPAMMY 1546 0.31 0.96 0.00 199 TR_MetaPhish_Combo_01 1537 0.89 0.95 0.87 200 PDS_RDNS_DYNAMIC_FP 1517 0.35 0.94 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283856 88.08 95.39 84.56 2 RELAYCOUNTRY_US 269199 81.00 82.67 80.19 3 DKIM_SIGNED 241823 76.63 86.16 72.04 4 XM_DK_Pass 234681 74.71 84.67 69.91 5 XM_B_Unicode 232351 72.76 80.13 69.21 6 DKIM_VALID 231515 73.87 84.04 68.97 7 DCC_CHECK_NEGATIVE 225660 54.37 27.68 67.22 8 BAYES_50 188848 51.86 42.74 56.26 9 DKIM_VALID_AU 177751 56.42 63.62 52.95 10 XMListUnsubscribeExists 157942 53.04 65.49 47.05 11 XM_B_SpammyWords 139500 50.01 67.57 41.56 12 XM_B_Unicode3 134064 41.11 43.55 39.94 13 DCC_CHECK 109862 45.59 72.29 32.73 14 T_TM2_M_HEADER_IN_MSG 95568 26.34 21.92 28.47 15 RCVD_IN_MSPIKE_H2 91384 29.25 33.46 27.22 16 DKIM_VALID_EF 88306 27.83 31.00 26.31 17 HTML_FONT_LOW_CONTRAST 80829 26.86 32.65 24.08 18 FVGT_m_MULTI_ODD 78900 26.98 34.21 23.50 19 XMSubLong 75747 22.89 23.57 22.56 20 LOC_TINY_FONT_1 70776 26.18 36.75 21.08 21 T_KAM_HTML_FONT_INVALID 65813 22.39 28.18 19.60 22 MIME_HTML_ONLY 63767 23.35 32.39 19.00 23 XM_B_SpammyWords2 59626 24.40 38.17 17.76 24 ALL_TRUSTED 57832 12.18 1.69 17.23 25 RCVD_IN_MSPIKE_WL 52328 14.23 11.42 15.59 26 USER_IN_DEF_DKIM_WL 41766 9.15 2.32 12.44 27 XM_Multi_Part_URI 37189 13.17 17.51 11.08 28 RCVD_IN_MSPIKE_H3 36966 10.46 9.32 11.01 29 XM_Body_Dirty_Words 35724 14.70 23.11 10.64 30 BAYES_00 35349 7.38 0.83 10.53 31 LotsOfNums_01 32636 9.15 7.96 9.72 32 BAYES_60 31894 9.09 8.25 9.50 33 XM_B_Unsub 28124 11.08 16.69 8.38 34 TooManyTo_001 27564 6.98 4.43 8.21 35 UNPARSEABLE_RELAY 25950 9.53 13.27 7.73 36 XM_DKIMWhitelistDomains 25899 5.22 0.04 7.72 37 LOTS_OF_MONEY 25863 9.32 12.68 7.70 38 IN_ZIMBRA_NJ_WHITELIST 25354 5.14 0.14 7.55 39 XM_Evil_Numbers_Gen 25052 8.00 9.12 7.46 40 T_TooManySym_01 22603 5.34 2.44 6.73 41 XM_DK_Undo_02 22070 17.69 40.77 6.57 42 TR_XM_DK_Bayes 21793 4.59 0.65 6.49 43 RCVD_IN_IADB_LISTED 21454 5.26 2.92 6.39 44 TR_XM_DK_Bayes1 21390 4.51 0.64 6.37 45 TR_XM_BayesUnsub 21156 9.54 16.27 6.30 46 TR_XM_UnparsRelay 20311 8.32 13.02 6.05 47 MIME_QP_LONG_LINE 19562 5.30 4.21 5.83 48 RCVD_IN_IADB_SPF 18867 4.61 2.51 5.62 49 TR_XM_DK_Bayes2 18551 3.91 0.54 5.53 50 BAYES_99 18383 14.10 32.00 5.48 51 HTML_IMAGE_RATIO_02 18023 6.00 7.32 5.37 52 XM_H_Long_From01 17925 5.76 6.63 5.34 53 XM_SendGrid 17376 5.63 6.58 5.18 54 HTML_IMAGE_RATIO_04 16907 4.65 3.84 5.04 55 RCVD_IN_IADB_SENDERID 16826 4.13 2.31 5.01 56 BAYES_40 16534 3.85 1.61 4.93 57 TR_XM_SpammyWords4 16387 6.89 11.06 4.88 58 RCVD_IN_IADB_DK 16240 4.03 2.34 4.84 59 BAYES_80 15992 5.92 8.32 4.76 60 XM_PDF 15677 3.44 0.88 4.67 61 BOTNET_IPINHOSTNAME 15539 7.78 14.32 4.63 62 MPART_ALT_DIFF 15500 5.78 8.21 4.62 63 XMStrtUSub 15300 4.45 4.21 4.56 64 RCVD_IN_VALIDITY_SAFE 15231 4.22 3.57 4.54 65 XM_B_SpammyTLD 14991 4.95 5.96 4.47 66 XM_B_SpammyWords3 14869 7.08 12.57 4.43 67 BAYES_999 14831 11.23 25.37 4.42 68 TR_XM_DKIM_Undo 14824 13.48 32.30 4.42 69 XMNumbers 14662 4.20 3.85 4.37 70 T_TooManySym_02 14328 3.22 1.05 4.27 71 RCVD_IN_IADB_VOUCHED 14183 3.37 1.59 4.22 72 T_REMOTE_IMAGE 13910 4.26 4.49 4.14 73 RCVD_IN_VALIDITY_CERTIFIED 13538 3.70 3.01 4.03 74 RCVD_IN_MSPIKE_H4 13251 3.29 1.92 3.95 75 RELAYCOUNTRY_META 12308 9.21 20.71 3.67 76 BAYES_20 12225 2.79 1.03 3.64 77 XM_UncommonTLD01 12178 5.48 9.33 3.63 78 ANY_BOUNCE_MESSAGE 12056 2.76 1.03 3.59 79 BOUNCE_MESSAGE 12049 2.76 1.03 3.59 80 FSL_BULK_SIG 11539 6.58 13.12 3.44 81 TR_XM_PhishingBody 11101 4.45 6.82 3.31 82 TR_XM_DK_SendGrid 11074 3.64 4.34 3.30 83 XMSubMetaSx_00 10569 4.38 6.95 3.15 84 XM_B_Phish_Phrases 10363 4.02 5.94 3.09 85 XMSexyCombo_05 10322 5.69 11.13 3.07 86 DKIM_INVALID 10308 2.76 2.12 3.07 87 URI_NOVOWEL 9857 2.95 2.98 2.94 88 MAILING_LIST_MULTI 9762 2.45 1.50 2.91 89 MIME_HTML_ONLY_MULTI 9700 3.38 4.39 2.89 90 HTML_IMAGE_RATIO_06 9507 2.90 3.05 2.83 91 RCVD_IN_IADB_OPTIN 9472 2.20 0.91 2.82 92 XM_H_Trusted_IP 9036 1.82 0.00 2.69 93 BAYES_95 8723 3.27 4.67 2.60 94 FROM_EXCESS_BASE64 8449 2.26 1.73 2.52 95 TM2_M_URI_OPT_OUT 7903 2.53 2.91 2.35 96 BAYES_05 7745 1.74 0.56 2.31 97 TooManyTo_002 7607 1.71 0.55 2.27 98 TR_XM_SB_Phish 7569 2.25 2.24 2.25 99 XMSubPhish11 7471 2.18 2.09 2.23 100 XM_SPF_SoftFail 7250 2.93 4.53 2.16 101 HTML_IMAGE_RATIO_08 7174 2.24 2.45 2.14 102 MIME_HTML_MOSTLY 7144 3.00 4.80 2.13 103 INVALID_MSGID 6766 1.42 0.17 2.02 104 XM_B_Phish66 6575 2.64 4.05 1.96 105 HTML_MIME_NO_HTML_TAG 6406 3.34 6.30 1.91 106 T_XMDrugObfuBody_08 6369 2.35 3.28 1.90 107 T_XMDrugObfuBody_14 6351 2.98 5.23 1.89 108 IN_HORDE_ADDRESS_BOOK 6286 1.32 0.17 1.87 109 TVD_RCVD_IP 6109 1.29 0.19 1.82 110 HELO_NODOT 6084 1.36 0.41 1.81 111 HELO_NO_DOMAIN 6082 1.36 0.41 1.81 112 XM_CamelCaseFrm001 6070 2.02 2.45 1.81 113 TO_MALFORMED 5770 1.17 0.03 1.72 114 XMDiploma_00 5724 2.22 3.29 1.71 115 T_TooManySym_03 5722 1.27 0.36 1.70 116 TR_Symld_Words 5596 1.60 1.45 1.67 117 SUBJ_ALL_CAPS 5469 1.75 2.01 1.63 118 BOTNET 5343 4.57 10.74 1.59 119 TR_XM_SpammyRelay 5278 4.80 11.51 1.57 120 XM_B_Investor 5230 2.55 4.62 1.56 121 TR_DCC_Bayes_99 5170 8.60 23.25 1.54 122 TooManyTo_003 4963 1.14 0.45 1.48 123 XM_DK_Undo_01 4916 1.97 3.02 1.46 124 XMGappySubj_01 4664 0.99 0.16 1.39 125 TR_XM_SpammyWords5 4663 2.10 3.57 1.39 126 TM2_M_VERY_LONG_WORD 4578 2.60 5.17 1.36 127 KHOP_HELO_FCRDNS 4544 1.96 3.21 1.35 128 XM_OfRef6 4312 2.03 3.58 1.28 129 XM_GoogleGroups 4292 1.62 2.32 1.28 130 UNTRUSTED_Relay 4025 3.85 9.34 1.20 131 XMCapTrack 4004 0.94 0.43 1.19 132 XM_B_Unsub2 3767 1.68 2.85 1.12 133 XMBSHREFv2 3758 0.92 0.50 1.12 134 URI_HEX 3683 1.21 1.43 1.10 135 HTML_FONT_FACE_BAD 3588 1.23 1.56 1.07 136 TooManyTo_004 3553 0.83 0.37 1.06 137 TVD_SPACE_RATIO 3526 0.88 0.54 1.05 138 XM_H_Long_From02 3507 1.10 1.23 1.04 139 XMStockSpam_06 3391 1.14 1.41 1.01 140 XM_B_SEO 3318 1.01 1.06 0.99 141 T_FILL_THIS_FORM_SHORT 3262 1.29 1.94 0.97 142 XMSubNoVowel 3238 0.89 0.73 0.96 143 RELAYCOUNTRY_CA 3119 2.66 6.24 0.93 144 DKIM_ADSP_CUSTOM_MED 3094 0.91 0.88 0.92 145 XM_B_SpammyWords4 3012 1.35 2.28 0.90 146 RCVD_IN_RP_SAFE 3009 0.85 0.74 0.90 147 TR_XM_SpammyWords2 2968 4.34 11.50 0.88 148 FVGT_m_MULTI_ODD_EMAIL 2946 0.64 0.16 0.88 149 TR_MetaPhish_Combo_01 2913 0.89 0.95 0.87 150 XM_B_COPY_HTML 2803 0.73 0.52 0.83 151 T_XMDrugObfuBody_00 2789 1.22 2.04 0.83 152 TooManyTo_005 2730 0.63 0.25 0.81 153 RCVD_IN_RP_CERTIFIED 2727 0.76 0.64 0.81 154 FROM_GOV_DKIM_AU 2726 0.59 0.14 0.81 155 XMBody_95 2715 0.59 0.13 0.81 156 XMBdyGiftCard01 2713 0.98 1.33 0.81 157 XM_UB50 2634 1.95 4.36 0.78 158 XMSubMetaI_00 2579 0.86 1.06 0.77 159 HTTPS_HTTP_MISMATCH 2520 0.98 1.46 0.75 160 SpammyFromTLD_01 2501 2.13 5.01 0.75 161 HTML_TAG_BALANCE_BODY 2485 0.89 1.20 0.74 162 XMGenDplmaNmb 2481 0.90 1.24 0.74 163 XMHTML_After_End 2455 1.05 1.70 0.73 164 T_OBFU_PDF_ATTACH 2417 0.54 0.16 0.72 165 XMBrknScrpt_02 2411 0.96 1.47 0.72 166 RELAYCOUNTRY_GB 2346 0.79 0.99 0.70 167 MSGID_NOFQDN1 2286 0.46 0.01 0.68 168 XMPhish30 2155 0.79 1.11 0.64 169 XM_H_PHPMailer 2116 1.20 2.38 0.63 170 RCVD_IN_MSPIKE_H5 2111 0.48 0.18 0.63 171 HTML_IMAGE_ONLY_20 2076 0.54 0.37 0.62 172 NML_ADSP_CUSTOM_MED 2071 0.66 0.75 0.62 173 URI_TRY_3LD 2057 0.79 1.14 0.61 174 XM_ProductURIs 2041 0.73 0.98 0.61 175 RCVD_IN_BL_SPAMCOP_NET 2029 3.13 8.38 0.60 176 XM_ShortIntro_01 2027 0.53 0.38 0.60 177 MPART_ALT_DIFF_COUNT 1928 0.72 1.01 0.57 178 XM_D_tchamptons_WL 1922 0.39 0.01 0.57 179 XMMoneyMeta_00 1863 0.66 0.87 0.55 180 SHORT_HELO_AND_INLINE_IMAGE 1834 0.39 0.06 0.55 181 XM_B_COVIDMETA 1788 0.99 1.94 0.53 182 XMNoVowels 1757 0.43 0.22 0.52 183 RCVD_IN_SORBS_DUL 1752 0.38 0.09 0.52 184 FORGED_GMAIL_RCVD 1706 0.59 0.75 0.51 185 T_Symld_Words_02 1694 0.66 0.97 0.50 186 RCVD_IN_MSPIKE_BL 1680 0.85 1.56 0.50 187 TR_XM_MSPIKECOMBO 1674 0.81 1.45 0.50 188 RCVD_IN_MSPIKE_L3 1629 0.61 0.88 0.49 189 T_XMHurry_00 1604 0.90 1.76 0.48 190 RDNS_DYNAMIC 1569 0.65 1.04 0.47 191 TR_XM_PHPDW 1533 0.79 1.49 0.46 192 XMHTMLBadTable_001 1495 0.57 0.82 0.45 193 SpammyFromTLD_02 1487 0.98 2.09 0.44 194 PLING_QUERY 1475 0.56 0.80 0.44 195 HTML_IMAGE_ONLY_32 1428 0.38 0.28 0.43 196 HTML_IMAGE_ONLY_28 1406 0.41 0.40 0.42 197 TR_XM_PHPForged 1406 0.73 1.39 0.42 198 TR_XM_FormFill2 1404 0.73 1.36 0.42 199 XM_S_SpammyWords 1393 0.43 0.45 0.41 200 TR_XM_Spammywords 1392 0.43 0.45 0.41 ----------------------------------------------------------------------