Email: 609570 Autolearn: 0 AvgScore: 3.84 AvgScanTime: 1.19 sec Spam: 184660 Autolearn: 0 AvgScore: 14.65 AvgScanTime: 1.40 sec Ham: 424910 Autolearn: 0 AvgScore: -0.86 AvgScanTime: 1.11 sec Time Spent Running SA: 202.27 hours Time Spent Processing Spam: 71.78 hours Time Spent Processing Ham: 130.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 175298 90.04 94.93 87.91 2 DKIM_SIGNED 144005 74.80 77.98 73.42 3 DCC_CHECK 142345 49.16 77.08 37.02 4 XM_DK_Pass 139806 73.27 75.71 72.21 5 DKIM_VALID 136637 71.46 73.99 70.36 6 XM_B_Unicode 134222 70.99 72.69 70.26 7 RELAYCOUNTRY_US 125577 78.15 68.00 82.57 8 XM_B_SpammyWords 117133 50.54 63.43 44.94 9 XMListUnsubscribeExists 115583 51.59 62.59 46.81 10 DKIM_VALID_AU 104627 54.70 56.66 53.85 11 XM_B_Unicode3 81920 42.40 44.36 41.55 12 XM_DK_Undo_02 79710 18.30 43.17 7.49 13 BAYES_50 72811 51.82 39.43 57.20 14 MIME_HTML_ONLY 66900 26.08 36.23 21.67 15 XM_B_SpammyWords2 64892 23.22 35.14 18.03 16 LOC_TINY_FONT_1 64269 26.71 34.80 23.19 17 BAYES_99 61992 14.65 33.57 6.43 18 TR_XM_DKIM_Undo 61269 13.43 33.18 4.84 19 HTML_FONT_LOW_CONTRAST 56570 27.99 30.63 26.84 20 DKIM_VALID_EF 50211 28.80 27.19 29.50 21 T_KAM_HTML_FONT_INVALID 50140 20.51 27.15 17.62 22 XMSubLong 48307 22.76 26.16 21.29 23 BAYES_999 48252 11.59 26.13 5.28 24 TR_DCC_Bayes_99 47291 9.62 25.61 2.67 25 FVGT_m_MULTI_ODD 47272 23.53 25.60 22.64 26 RELAYCOUNTRY_META 47067 11.02 25.49 4.73 27 UNTRUSTED_Relay 43939 8.51 23.79 1.87 28 T_TM2_M_HEADER_IN_MSG 39939 27.74 21.63 30.40 29 XM_UncommonTLD01 38940 8.77 21.09 3.41 30 DCC_CHECK_NEGATIVE 38476 48.72 20.84 60.83 31 XM_Body_Dirty_Words 37686 14.60 20.41 12.08 32 BOTNET 37496 7.35 20.31 1.72 33 RCVD_IN_MSPIKE_WL 36354 29.54 19.69 33.82 34 RCVD_IN_MSPIKE_H2 36097 19.99 19.55 20.19 35 FSL_BULK_SIG 33014 9.54 17.88 5.92 36 XM_Multi_Part_URI 27098 12.44 14.67 11.47 37 XM_B_Unsub 24354 11.61 13.19 10.92 38 TR_XM_SpammyWords2 22715 4.19 12.30 0.67 39 XMSexyCombo_05 22654 6.64 12.27 4.20 40 XM_B_SpammyWords3 21839 6.17 11.83 3.71 41 LOTS_OF_MONEY 20908 8.38 11.32 7.10 42 MPART_ALT_DIFF 20819 7.75 11.27 6.22 43 BOTNET_IPINHOSTNAME 20794 6.89 11.26 5.00 44 SpammyFromTLD_02 20124 3.61 10.90 0.45 45 XM_Evil_Numbers_Gen 18641 8.59 10.09 7.94 46 TR_XM_SpammyWords4 17837 5.98 9.66 4.39 47 RCVD_IN_MSPIKE_H3 17776 14.46 9.63 16.56 48 XM_UB50 17670 3.71 9.57 1.17 49 HTML_IMAGE_RATIO_02 17024 7.89 9.22 7.32 50 UNPARSEABLE_RELAY 16921 7.78 9.16 7.18 51 BAYES_80 16906 6.45 9.16 5.28 52 RCVD_IN_MSPIKE_H4 16898 12.09 9.15 13.36 53 TR_XM_UnparsRelay 16684 7.01 9.03 6.13 54 MIME_HTML_MOSTLY 16485 4.29 8.93 2.27 55 KHOP_HELO_FCRDNS 15769 3.76 8.54 1.68 56 RCVD_IN_BL_SPAMCOP_NET 15737 3.04 8.52 0.65 57 XM_B_Phish_Phrases 15631 6.56 8.46 5.73 58 BAYES_60 15118 8.90 8.19 9.21 59 LotsOfNums_01 14829 8.56 8.03 8.79 60 HTML_FONT_SIZE_LARGE 13903 2.36 7.53 0.11 61 HTML_IMAGE_ONLY_12 13127 2.29 7.11 0.19 62 XMSubMetaSx_00 13001 4.36 7.04 3.20 63 SpammyFromTLD_01 12893 2.64 6.98 0.75 64 XM_SendGrid 12877 6.62 6.97 6.47 65 HTML_SHORT_LINK_IMG_1 12756 2.10 6.91 0.02 66 BODY_URI_ONLY 12443 2.04 6.74 0.00 67 RCVD_IN_MSPIKE_BL 11838 2.02 6.41 0.11 68 TR_XM_MSPIKECOMBO 11500 1.96 6.23 0.10 69 XM_H_Long_From01 11405 5.70 6.18 5.50 70 TR_XM_PhishingBody 10848 3.88 5.87 3.01 71 TooManyTo_001 10686 7.68 5.79 8.51 72 RCVD_IN_PSBL 9968 1.71 5.40 0.10 73 RELAYCOUNTRY_CA 9870 2.55 5.34 1.33 74 BAYES_95 9810 3.74 5.31 3.06 75 XM_UB99 9567 1.57 5.18 0.00 76 HTML_IMAGE_RATIO_04 9446 5.97 5.12 6.34 77 XM_B_SpammyTLD 9138 2.90 4.95 2.01 78 RCVD_IN_RP_SAFE 8568 6.55 4.64 7.38 79 URIBL_SBL_A 8514 2.40 4.61 1.44 80 XMNumbers 8470 3.70 4.59 3.32 81 XM_DIRTYINTL 7803 1.55 4.23 0.39 82 RELAYCOUNTRY_DE 7779 1.62 4.21 0.49 83 RELAYCOUNTRY_FR 7745 1.50 4.19 0.32 84 BOTNET_NORDNS 7647 1.27 4.14 0.02 85 TR_XM_DK_SendGrid 7498 4.07 4.06 4.08 86 HTML_IMAGE_RATIO_06 7370 3.95 3.99 3.94 87 DKIM_INVALID 7368 3.34 3.99 3.06 88 T_REMOTE_IMAGE 7241 3.65 3.92 3.54 89 HTML_MIME_NO_HTML_TAG 7237 2.77 3.92 2.28 90 TR_XM_SpammyWords3 7012 1.19 3.80 0.06 91 RCVD_IN_MSPIKE_L5 6998 1.18 3.79 0.05 92 XMStrtUSub 6796 5.17 3.68 5.82 93 XM_UB999 6681 1.10 3.62 0.00 94 XM_SPF_SoftFail 6488 2.15 3.51 1.56 95 RCVD_IN_RP_RNBL 6475 1.07 3.51 0.02 96 RCVD_IN_RP_CERTIFIED 6455 5.72 3.50 6.68 97 XM_UB60 6434 1.15 3.48 0.14 98 TR_XM_SpammyWords5 6422 2.09 3.48 1.48 99 XM_OfRef6 6296 1.72 3.41 0.99 100 XMDiploma_00 6274 2.30 3.40 1.82 101 XM_B_Phish66 6183 2.26 3.35 1.78 102 TM2_M_URI_OPT_OUT 6129 3.09 3.32 3.00 103 XM_B_COVIDMETA 5878 1.84 3.18 1.26 104 XM_UB80 5673 0.97 3.07 0.05 105 XMBdyGiftCard01 5434 1.24 2.94 0.50 106 MIME_QP_LONG_LINE 5393 4.88 2.92 5.74 107 MIME_HTML_ONLY_MULTI 5318 3.81 2.88 4.22 108 URIBL_DBL_SPAM 5195 0.86 2.81 0.01 109 FROM_EXCESS_BASE64 5171 2.93 2.80 2.98 110 T_XMDrugObfuBody_14 4983 2.35 2.70 2.21 111 XM_DK_Undo_01 4666 1.86 2.53 1.57 112 URI_HEX 4576 1.73 2.48 1.40 113 XM_B_Unsub2 4498 1.80 2.44 1.53 114 TR_XM_SB_Phish 4300 2.29 2.33 2.27 115 T_TooManySym_01 4272 4.01 2.31 4.74 116 TR_XM_MaxBayes 4271 0.71 2.31 0.02 117 XMSubPhish11 4198 2.25 2.27 2.23 118 TM2_M_VERY_LONG_WORD 4147 1.71 2.25 1.48 119 HTML_IMAGE_ONLY_24 4146 0.94 2.25 0.37 120 PDS_OTHER_BAD_TLD 4068 0.84 2.20 0.25 121 T_FILL_THIS_FORM_SHORT 4060 1.22 2.20 0.79 122 NO_DNS_FOR_FROM 4021 0.83 2.18 0.25 123 RCVD_IN_IADB_LISTED 3950 4.25 2.14 5.17 124 XMGenDplmaNmb 3859 1.44 2.09 1.16 125 XM_CamelCaseFrm001 3826 1.89 2.07 1.81 126 DKIM_ADSP_NXDOMAIN 3768 0.81 2.04 0.28 127 HTML_IMAGE_RATIO_08 3612 2.09 1.96 2.15 128 T_XMDrugObfuBody_08 3607 1.65 1.95 1.52 129 XM_H_Long_From02 3572 1.31 1.93 1.03 130 RCVD_IN_IADB_SPF 3541 3.72 1.92 4.50 131 XMBrknScrpt_02 3514 1.00 1.90 0.61 132 XMSexyCombo_01 3505 0.84 1.90 0.37 133 RELAYCOUNTRY_IN 3501 0.67 1.90 0.14 134 TR_XM_MaxWHORU 3433 0.70 1.86 0.20 135 TR_XM_PHPDW 3433 0.83 1.86 0.38 136 XM_B_SpammyWords4 3406 0.79 1.84 0.34 137 BAYES_40 3394 3.52 1.84 4.25 138 ALL_TRUSTED 3385 10.33 1.83 14.02 139 XM_UB95 3384 0.57 1.83 0.02 140 HOSTED_IMG_DIRECT_MX 3374 0.55 1.83 0.00 141 URI_PHP_REDIR 3369 0.55 1.82 0.00 142 XM_URI_RBL 3369 0.67 1.82 0.17 143 RCVD_IN_IADB_SENDERID 3320 3.36 1.80 4.05 144 RCVD_IN_IADB_DK 3319 3.26 1.80 3.89 145 HTML_SHORT_LINK_IMG_2 3269 0.56 1.77 0.04 146 TR_Symld_Words 3227 1.60 1.75 1.53 147 T_XMDrugObfuBody_00 3218 1.38 1.74 1.22 148 TR_XM_INV_DKIM 3216 0.65 1.74 0.18 149 TR_XM_PHPForged 3178 0.73 1.72 0.30 150 HTML_IMAGE_ONLY_16 3169 0.69 1.72 0.24 151 URI_NO_WWW_BIZ_CGI 3144 0.52 1.70 0.01 152 DATE_IN_PAST_06_12 3143 0.69 1.70 0.25 153 TR_XM_FormFill2 3138 0.73 1.70 0.30 154 XM_H_PHPOS 3132 0.72 1.70 0.29 155 DIET_1 3040 0.92 1.65 0.61 156 URI_NOVOWEL 3038 2.43 1.65 2.77 157 T_XMHurry_00 3016 0.90 1.63 0.59 158 SUBJ_ALL_CAPS 3010 1.83 1.63 1.91 159 MAILING_LIST_MULTI 2982 2.30 1.61 2.59 160 XMSlimDrugH 2968 0.67 1.61 0.26 161 XMStockSpam_06 2894 1.40 1.57 1.33 162 DKIM_ADSP_CUSTOM_MED 2889 1.12 1.56 0.93 163 URIBL_BLACK 2809 0.49 1.52 0.04 164 MONEY_NOHTML 2768 0.53 1.50 0.11 165 ALIBABA_IMG_NOT_RCVD_ALI 2766 0.46 1.50 0.00 166 XMSubMetaI_00 2657 0.91 1.44 0.68 167 NML_ADSP_CUSTOM_MED 2632 0.89 1.43 0.66 168 XM_Body_Dirty_Words_01 2582 0.51 1.40 0.13 169 TR_XM_RelayPhish 2552 0.47 1.38 0.07 170 HK_RANDOM_ENVFROM 2523 0.48 1.37 0.10 171 TR_Sbj_FN_Bdy 2516 0.53 1.36 0.17 172 RELAYCOUNTRY_GB 2515 1.09 1.36 0.97 173 TR_XM_COVIDMETA1 2490 0.61 1.35 0.29 174 FORGED_GMAIL_RCVD 2452 0.74 1.33 0.49 175 XM_BadFromFormat 2414 0.56 1.31 0.23 176 RCVD_IN_MSPIKE_L3 2380 0.43 1.29 0.05 177 HK_RANDOM_FROM 2359 0.47 1.28 0.12 178 FROM_SUSPICIOUS_NTLD 2338 0.44 1.27 0.08 179 TR_XM_COVIDMETA4 2291 0.59 1.24 0.31 180 FROM_SUSPICIOUS_NTLD_FP 2266 0.42 1.23 0.07 181 HTML_OFF_PAGE 2220 0.36 1.20 0.00 182 XMSubEmpty 2195 0.53 1.19 0.25 183 RCVD_IN_MSPIKE_L4 2122 0.35 1.15 0.01 184 XMBody_78 2097 0.65 1.14 0.44 185 DATE_IN_PAST_12_24 2091 0.40 1.13 0.08 186 XMSexyCombo_04 2076 0.41 1.12 0.10 187 TR_XM_BayesRelay 2063 0.35 1.12 0.02 188 BAYES_20 2047 2.44 1.11 3.02 189 XM_PDF 2021 4.03 1.09 5.30 190 BODY_EMPTY 1986 0.34 1.08 0.02 191 HTTPS_HTTP_MISMATCH 1985 0.86 1.07 0.76 192 HDRS_MISSP 1982 0.43 1.07 0.14 193 MISSING_SUBJECT 1975 0.38 1.07 0.08 194 XMNoSubject 1975 0.38 1.07 0.08 195 URI_TRY_3LD 1967 1.12 1.07 1.14 196 XMBody_17 1961 0.59 1.06 0.39 197 T_HTML_TAG_BALANCE_CENTER 1956 0.46 1.06 0.20 198 DATE_IN_PAST_03_06 1940 0.44 1.05 0.17 199 XMPhish08 1913 0.48 1.04 0.24 200 XMSubMetaSxObfu_03 1850 0.68 1.00 0.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 373555 90.04 94.93 87.91 2 RELAYCOUNTRY_US 350827 78.15 68.00 82.57 3 DKIM_SIGNED 311976 74.80 77.98 73.42 4 XM_DK_Pass 306811 73.27 75.71 72.21 5 DKIM_VALID 298954 71.46 73.99 70.36 6 XM_B_Unicode 298528 70.99 72.69 70.26 7 DCC_CHECK_NEGATIVE 258480 48.72 20.84 60.83 8 BAYES_50 243058 51.82 39.43 57.20 9 DKIM_VALID_AU 228819 54.70 56.66 53.85 10 XMListUnsubscribeExists 198889 51.59 62.59 46.81 11 XM_B_SpammyWords 190968 50.54 63.43 44.94 12 XM_B_Unicode3 176557 42.40 44.36 41.55 13 DCC_CHECK 157295 49.16 77.08 37.02 14 RCVD_IN_MSPIKE_WL 143699 29.54 19.69 33.82 15 T_TM2_M_HEADER_IN_MSG 129177 27.74 21.63 30.40 16 DKIM_VALID_EF 125340 28.80 27.19 29.50 17 HTML_FONT_LOW_CONTRAST 114062 27.99 30.63 26.84 18 LOC_TINY_FONT_1 98548 26.71 34.80 23.19 19 FVGT_m_MULTI_ODD 96186 23.53 25.60 22.64 20 MIME_HTML_ONLY 92098 26.08 36.23 21.67 21 XMSubLong 90456 22.76 26.16 21.29 22 RCVD_IN_MSPIKE_H2 85782 19.99 19.55 20.19 23 XM_B_SpammyWords2 76623 23.22 35.14 18.03 24 T_KAM_HTML_FONT_INVALID 74855 20.51 27.15 17.62 25 RCVD_IN_MSPIKE_H3 70344 14.46 9.63 16.56 26 ALL_TRUSTED 59581 10.33 1.83 14.02 27 RCVD_IN_MSPIKE_H4 56784 12.09 9.15 13.36 28 XM_Body_Dirty_Words 51314 14.60 20.41 12.08 29 XM_Multi_Part_URI 48743 12.44 14.67 11.47 30 XM_B_Unsub 46412 11.61 13.19 10.92 31 XM_DKIMWhitelistDomains 43498 7.15 0.03 10.24 32 BAYES_00 40731 6.91 0.75 9.59 33 BAYES_60 39138 8.90 8.19 9.21 34 LotsOfNums_01 37354 8.56 8.03 8.79 35 TooManyTo_001 36152 7.68 5.79 8.51 36 XM_Evil_Numbers_Gen 33741 8.59 10.09 7.94 37 XM_DK_Undo_02 31835 18.30 43.17 7.49 38 RCVD_IN_RP_SAFE 31346 6.55 4.64 7.38 39 HTML_IMAGE_RATIO_02 31092 7.89 9.22 7.32 40 UNPARSEABLE_RELAY 30519 7.78 9.16 7.18 41 LOTS_OF_MONEY 30177 8.38 11.32 7.10 42 RCVD_IN_RP_CERTIFIED 28397 5.72 3.50 6.68 43 XM_SendGrid 27502 6.62 6.97 6.47 44 BAYES_99 27340 14.65 33.57 6.43 45 HTML_IMAGE_RATIO_04 26923 5.97 5.12 6.34 46 TR_XM_DK_Bayes 26606 4.52 0.51 6.26 47 MPART_ALT_DIFF 26441 7.75 11.27 6.22 48 TR_XM_DK_Bayes1 26099 4.43 0.51 6.14 49 TR_XM_UnparsRelay 26031 7.01 9.03 6.13 50 FSL_BULK_SIG 25157 9.54 17.88 5.92 51 XMStrtUSub 24730 5.17 3.68 5.82 52 MIME_QP_LONG_LINE 24380 4.88 2.92 5.74 53 XM_B_Phish_Phrases 24330 6.56 8.46 5.73 54 XM_H_Long_From01 23350 5.70 6.18 5.50 55 IN_ZIMBRA_NJ_WHITELIST 23232 3.83 0.05 5.47 56 TR_XM_DK_Bayes2 22973 3.91 0.47 5.41 57 XM_H_Trusted_IP 22602 3.71 0.00 5.32 58 XM_PDF 22521 4.03 1.09 5.30 59 BAYES_80 22440 6.45 9.16 5.28 60 BAYES_999 22419 11.59 26.13 5.28 61 RCVD_IN_IADB_LISTED 21986 4.25 2.14 5.17 62 BOTNET_IPINHOSTNAME 21226 6.89 11.26 5.00 63 TR_XM_DKIM_Undo 20573 13.43 33.18 4.84 64 T_TooManySym_01 20147 4.01 2.31 4.74 65 RELAYCOUNTRY_META 20096 11.02 25.49 4.73 66 RCVD_IN_IADB_SPF 19125 3.72 1.92 4.50 67 TR_XM_SpammyWords4 18638 5.98 9.66 4.39 68 BAYES_40 18053 3.52 1.84 4.25 69 MIME_HTML_ONLY_MULTI 17937 3.81 2.88 4.22 70 XMSexyCombo_05 17849 6.64 12.27 4.20 71 TR_XM_DK_SendGrid 17341 4.07 4.06 4.08 72 RCVD_IN_IADB_SENDERID 17191 3.36 1.80 4.05 73 HTML_IMAGE_RATIO_06 16722 3.95 3.99 3.94 74 RCVD_IN_MSPIKE_H5 16571 2.99 0.91 3.90 75 RCVD_IN_IADB_DK 16535 3.26 1.80 3.89 76 XM_B_SpammyWords3 15744 6.17 11.83 3.71 77 T_REMOTE_IMAGE 15034 3.65 3.92 3.54 78 XM_UncommonTLD01 14493 8.77 21.09 3.41 79 XMNumbers 14098 3.70 4.59 3.32 80 XMSubMetaSx_00 13599 4.36 7.04 3.20 81 RCVD_IN_IADB_VOUCHED 13507 2.48 0.87 3.18 82 DKIM_INVALID 13022 3.34 3.99 3.06 83 BAYES_95 13006 3.74 5.31 3.06 84 BAYES_20 12835 2.44 1.11 3.02 85 TR_XM_PhishingBody 12777 3.88 5.87 3.01 86 TM2_M_URI_OPT_OUT 12735 3.09 3.32 3.00 87 FROM_EXCESS_BASE64 12664 2.93 2.80 2.98 88 BOUNCE_MESSAGE 11785 2.14 0.68 2.77 89 ANY_BOUNCE_MESSAGE 11785 2.14 0.68 2.77 90 URI_NOVOWEL 11758 2.43 1.65 2.77 91 TR_DCC_Bayes_99 11327 9.62 25.61 2.67 92 MAILING_LIST_MULTI 11024 2.30 1.61 2.59 93 T_TooManySym_02 10671 2.03 0.93 2.51 94 TooManyTo_002 9864 1.84 0.72 2.32 95 HTML_MIME_NO_HTML_TAG 9677 2.77 3.92 2.28 96 MIME_HTML_MOSTLY 9666 4.29 8.93 2.27 97 TR_XM_SB_Phish 9641 2.29 2.33 2.27 98 XMSubPhish11 9496 2.25 2.27 2.23 99 T_XMDrugObfuBody_14 9370 2.35 2.70 2.21 100 HTML_IMAGE_RATIO_08 9123 2.09 1.96 2.15 101 RCVD_IN_IADB_OPTIN 8792 1.64 0.64 2.07 102 XM_B_SpammyTLD 8549 2.90 4.95 2.01 103 BAYES_05 8308 1.56 0.65 1.96 104 SUBJ_ALL_CAPS 8115 1.83 1.63 1.91 105 HELO_NODOT 8046 1.46 0.47 1.89 106 HELO_NO_DOMAIN 8042 1.46 0.47 1.89 107 UNTRUSTED_Relay 7957 8.51 23.79 1.87 108 XMDiploma_00 7751 2.30 3.40 1.82 109 TVD_RCVD_IP 7742 1.40 0.43 1.82 110 XM_CamelCaseFrm001 7710 1.89 2.07 1.81 111 HTML_FONT_FACE_BAD 7675 1.52 0.87 1.81 112 XMSubNoVowel 7645 1.48 0.76 1.80 113 XM_B_Phish66 7572 2.26 3.35 1.78 114 INVALID_MSGID 7451 1.32 0.33 1.75 115 BOTNET 7309 7.35 20.31 1.72 116 KHOP_HELO_FCRDNS 7147 3.76 8.54 1.68 117 IN_HORDE_ADDRESS_BOOK 7034 1.18 0.08 1.66 118 MSGID_NOFQDN1 6854 1.14 0.04 1.61 119 XM_DK_Undo_01 6659 1.86 2.53 1.57 120 XM_SPF_SoftFail 6641 2.15 3.51 1.56 121 TR_Symld_Words 6517 1.60 1.75 1.53 122 XM_B_Unsub2 6494 1.80 2.44 1.53 123 T_XMDrugObfuBody_08 6468 1.65 1.95 1.52 124 TooManyTo_003 6384 1.22 0.58 1.50 125 TM2_M_VERY_LONG_WORD 6305 1.71 2.25 1.48 126 TR_XM_SpammyWords5 6304 2.09 3.48 1.48 127 TO_MALFORMED 6252 1.09 0.23 1.47 128 URIBL_SBL_A 6119 2.40 4.61 1.44 129 URI_HEX 5961 1.73 2.48 1.40 130 RELAYCOUNTRY_CA 5670 2.55 5.34 1.33 131 HELO_MISC_IP 5662 0.95 0.08 1.33 132 XMStockSpam_06 5660 1.40 1.57 1.33 133 XM_B_COVIDMETA 5339 1.84 3.18 1.26 134 T_XMDrugObfuBody_00 5198 1.38 1.74 1.22 135 XMCapTrack 5197 0.98 0.41 1.22 136 XMBSHREFv2 4996 0.88 0.20 1.18 137 XM_UB50 4973 3.71 9.57 1.17 138 XMGenDplmaNmb 4934 1.44 2.09 1.16 139 XM_GoogleGroups 4928 0.98 0.56 1.16 140 URI_TRY_3LD 4841 1.12 1.07 1.14 141 XMGappySubj_01 4810 0.84 0.17 1.13 142 USER_IN_DEF_DKIM_WL 4782 0.81 0.07 1.13 143 HTML_IMAGE_ONLY_20 4733 0.93 0.51 1.11 144 TooManyTo_004 4653 0.92 0.51 1.10 145 XM_H_Long_From02 4393 1.31 1.93 1.03 146 XM_OfRef6 4197 1.72 3.41 0.99 147 RELAYCOUNTRY_GB 4118 1.09 1.36 0.97 148 DKIM_ADSP_CUSTOM_MED 3965 1.12 1.56 0.93 149 TooManyTo_005 3826 0.76 0.45 0.90 150 XMHTML_After_End 3545 0.85 0.90 0.83 151 XMBody_95 3382 0.58 0.09 0.80 152 T_FILL_THIS_FORM_SHORT 3363 1.22 2.20 0.79 153 TVD_SPACE_RATIO 3320 0.57 0.09 0.78 154 HTTPS_HTTP_MISMATCH 3248 0.86 1.07 0.76 155 XMNoVowels 3223 0.65 0.40 0.76 156 SpammyFromTLD_01 3175 2.64 6.98 0.75 157 XM_ShortIntro_01 3029 0.66 0.53 0.71 158 TVD_SPACE_RATIO_MINFP 3028 0.61 0.39 0.71 159 TR_MSPIKEBAYES00 2973 0.49 0.01 0.70 160 T_TooManySym_03 2938 0.66 0.59 0.69 161 XMSubMetaI_00 2893 0.91 1.44 0.68 162 TR_XM_SpammyWords2 2852 4.19 12.30 0.67 163 NML_ADSP_CUSTOM_MED 2811 0.89 1.43 0.66 164 RCVD_IN_SORBS_DUL 2804 0.51 0.17 0.66 165 TR_MetaPhish_Combo_01 2793 0.75 0.97 0.66 166 RCVD_IN_BL_SPAMCOP_NET 2766 3.04 8.52 0.65 167 SHORT_HELO_AND_INLINE_IMAGE 2752 0.47 0.07 0.65 168 T_OBFU_PDF_ATTACH 2719 0.50 0.18 0.64 169 FROM_GOV_DKIM_AU 2654 0.49 0.17 0.62 170 XMBrknScrpt_02 2592 1.00 1.90 0.61 171 DIET_1 2585 0.92 1.65 0.61 172 XM_H_PHPMailer 2541 0.62 0.68 0.60 173 XM_ProductURIs 2511 0.65 0.77 0.59 174 T_XMHurry_00 2500 0.90 1.63 0.59 175 XM_SPF_Unknown 2423 0.66 0.86 0.57 176 XMHTMLBadTable_001 2403 0.54 0.49 0.57 177 T_Symld_Words_02 2402 0.61 0.71 0.57 178 XMPhish30 2371 0.67 0.94 0.56 179 XMSubMetaSxObfu_03 2319 0.68 1.00 0.55 180 XM_B_REG_HTML 2230 0.51 0.48 0.52 181 FROM_GOV_SPOOF 2166 0.45 0.32 0.51 182 RDNS_DYNAMIC 2112 0.64 0.97 0.50 183 XMBdyGiftCard01 2104 1.24 2.94 0.50 184 FORGED_GMAIL_RCVD 2084 0.74 1.33 0.49 185 RELAYCOUNTRY_DE 2073 1.62 4.21 0.49 186 XMMoneyMeta_00 2070 0.56 0.73 0.49 187 TM2_M_BODY_EMPTY 2043 0.36 0.07 0.48 188 NUMERIC_HTTP_ADDR 2023 0.62 0.94 0.48 189 XMLngstWrd_00 2018 0.54 0.68 0.47 190 TM2_M_A_HREF_HREF 2008 0.51 0.60 0.47 191 TR_Mismatch_TLD_01 1958 0.51 0.63 0.46 192 SpammyFromTLD_02 1905 3.61 10.90 0.45 193 XMBody_78 1863 0.65 1.14 0.44 194 MISSING_HEADERS 1818 0.49 0.63 0.43 195 XM_B_COPY_HTML 1800 0.46 0.53 0.42 196 XMLngstWrd_01 1784 0.48 0.62 0.42 197 HTML_IMAGE_ONLY_32 1749 0.37 0.28 0.41 198 SUBJ_DOLLARS 1731 0.45 0.56 0.41 199 USER_IN_WHITELIST 1730 0.28 0.00 0.41 200 USER_IN_WELCOMELIST 1730 0.28 0.00 0.41 ----------------------------------------------------------------------