Email: 682145 Autolearn: 0 AvgScore: 4.01 AvgScanTime: 1.24 sec Spam: 203505 Autolearn: 0 AvgScore: 14.43 AvgScanTime: 1.46 sec Ham: 478640 Autolearn: 0 AvgScore: -0.43 AvgScanTime: 1.14 sec Time Spent Running SA: 234.97 hours Time Spent Processing Spam: 82.79 hours Time Spent Processing Ham: 152.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 196527 91.23 96.57 88.96 2 DKIM_SIGNED 167371 75.74 82.24 72.97 3 XM_DK_Pass 162230 74.03 79.72 71.61 4 DKIM_VALID 158928 72.21 78.10 69.71 5 DCC_CHECK 158774 50.02 78.02 38.12 6 XM_B_Unicode 150989 72.88 74.19 72.32 7 RELAYCOUNTRY_US 144203 77.26 70.86 79.98 8 XMListUnsubscribeExists 137981 53.49 67.80 47.41 9 XM_B_SpammyWords 134984 50.63 66.33 43.96 10 DKIM_VALID_AU 121720 54.73 59.81 52.57 11 XM_DK_Undo_02 95518 19.27 46.94 7.51 12 XM_B_Unicode3 87784 43.03 43.14 42.98 13 XM_B_SpammyWords2 78196 24.16 38.42 18.10 14 BAYES_99 76733 15.12 37.71 5.51 15 LOC_TINY_FONT_1 74560 29.41 36.64 26.33 16 TR_XM_DKIM_Undo 74461 14.29 36.59 4.81 17 MIME_HTML_ONLY 71336 24.01 35.05 19.32 18 BAYES_50 71181 51.68 34.98 58.78 19 HTML_FONT_LOW_CONTRAST 65379 30.76 32.13 30.17 20 DKIM_VALID_EF 60709 29.06 29.83 28.74 21 TR_DCC_Bayes_99 59429 10.36 29.20 2.34 22 BAYES_999 58057 11.58 28.53 4.37 23 FVGT_m_MULTI_ODD 54539 23.82 26.80 22.56 24 T_KAM_HTML_FONT_INVALID 52838 20.57 25.96 18.27 25 XMSubLong 50237 22.12 24.69 21.03 26 RELAYCOUNTRY_META 48383 10.72 23.77 5.17 27 RCVD_IN_MSPIKE_WL 46068 29.56 22.64 32.51 28 XM_Body_Dirty_Words 45119 14.34 22.17 11.01 29 RCVD_IN_MSPIKE_H2 43543 21.50 21.40 21.54 30 XM_UncommonTLD01 42847 8.54 21.05 3.22 31 UNTRUSTED_Relay 41193 7.32 20.24 1.82 32 T_TM2_M_HEADER_IN_MSG 41064 26.34 20.18 28.96 33 DCC_CHECK_NEGATIVE 41008 47.84 20.15 59.62 34 BOTNET 33990 6.24 16.70 1.80 35 FSL_BULK_SIG 33327 9.54 16.38 6.63 36 XM_Multi_Part_URI 29992 12.03 14.74 10.88 37 XM_B_Unsub 27930 10.74 13.72 9.48 38 TR_XM_SpammyWords2 27720 4.61 13.62 0.77 39 XMSexyCombo_05 26673 6.26 13.11 3.35 40 BOTNET_IPINHOSTNAME 25267 7.18 12.42 4.96 41 XM_B_SpammyWords3 25134 6.55 12.35 4.08 42 RCVD_IN_MSPIKE_H3 22918 14.83 11.26 16.35 43 SpammyFromTLD_02 22452 3.55 11.03 0.36 44 XM_Evil_Numbers_Gen 22351 8.52 10.98 7.47 45 LOTS_OF_MONEY 21260 7.36 10.45 6.04 46 RCVD_IN_MSPIKE_H4 21216 11.94 10.43 12.58 47 UNPARSEABLE_RELAY 20301 8.33 9.98 7.63 48 MPART_ALT_DIFF 19901 6.09 9.78 4.53 49 TR_XM_UnparsRelay 19867 7.47 9.76 6.49 50 BAYES_80 19088 6.18 9.38 4.82 51 LotsOfNums_01 19026 8.53 9.35 8.19 52 RCVD_IN_BL_SPAMCOP_NET 18681 3.35 9.18 0.88 53 TR_XM_SpammyWords4 18317 5.39 9.00 3.86 54 HTML_IMAGE_RATIO_02 17239 6.67 8.47 5.90 55 BAYES_60 16332 8.61 8.03 8.86 56 MIME_HTML_MOSTLY 15802 3.84 7.76 2.18 57 HTML_SHORT_LINK_IMG_1 15406 2.27 7.57 0.02 58 XM_B_Phish_Phrases 15178 5.86 7.46 5.18 59 KHOP_HELO_FCRDNS 15170 3.40 7.45 1.67 60 HTML_IMAGE_ONLY_12 15039 2.36 7.39 0.23 61 BODY_URI_ONLY 14850 2.18 7.30 0.01 62 XM_SendGrid 14062 6.78 6.91 6.72 63 TooManyTo_001 13752 8.24 6.76 8.87 64 XMSubMetaSx_00 13390 4.31 6.58 3.34 65 RELAYCOUNTRY_CA 13182 2.90 6.48 1.38 66 TR_XM_PhishingBody 13082 4.41 6.43 3.56 67 XM_H_Long_From01 12511 5.65 6.15 5.44 68 HTML_FONT_SIZE_LARGE 11960 1.84 5.88 0.13 69 BAYES_95 11704 3.90 5.75 3.12 70 XM_UB50 11600 2.59 5.70 1.27 71 SpammyFromTLD_01 11325 2.23 5.56 0.81 72 XMNumbers 11191 3.71 5.50 2.96 73 XM_UB99 11131 1.63 5.47 0.00 74 RCVD_IN_MSPIKE_BL 10944 1.72 5.38 0.16 75 TR_XM_MSPIKECOMBO 10906 1.71 5.36 0.15 76 XM_B_SpammyTLD 10767 4.10 5.29 3.59 77 RCVD_IN_RP_SAFE 10525 6.29 5.17 6.77 78 HTML_IMAGE_RATIO_04 9696 4.77 4.76 4.77 79 XM_DIRTYINTL 9581 1.76 4.71 0.51 80 TR_XM_DK_SendGrid 8531 4.24 4.19 4.27 81 DKIM_INVALID 8443 3.53 4.15 3.26 82 XMStrtUSub 8437 4.81 4.15 5.10 83 RCVD_IN_RP_CERTIFIED 8425 5.58 4.14 6.19 84 RCVD_IN_RP_RNBL 8367 1.24 4.11 0.02 85 MIME_QP_LONG_LINE 7812 5.11 3.84 5.65 86 TR_XM_SpammyWords5 7394 2.07 3.63 1.40 87 TR_XM_SpammyWords3 7018 1.09 3.45 0.08 88 XM_B_Phish66 6846 2.72 3.36 2.44 89 TM2_M_URI_OPT_OUT 6793 2.60 3.34 2.28 90 XM_UB80 6736 1.01 3.31 0.04 91 XMDiploma_00 6710 2.35 3.30 1.95 92 URIBL_DBL_SPAM 6696 0.99 3.29 0.01 93 HTML_IMAGE_RATIO_06 6624 3.61 3.25 3.76 94 XM_SPF_SoftFail 6583 2.11 3.23 1.63 95 RCVD_IN_MSPIKE_L5 6522 0.98 3.20 0.04 96 RELAYCOUNTRY_DE 6504 1.52 3.20 0.81 97 XM_UB60 6319 1.01 3.11 0.12 98 XM_DK_Undo_01 6228 2.04 3.06 1.61 99 HTML_IMAGE_RATIO_08 6189 2.55 3.04 2.35 100 XM_UB999 6078 0.89 2.99 0.00 101 RELAYCOUNTRY_FR 6072 1.07 2.98 0.26 102 RCVD_IN_PSBL 5954 0.93 2.93 0.07 103 FROM_EXCESS_BASE64 5900 2.61 2.90 2.48 104 MIME_HTML_ONLY_MULTI 5851 2.93 2.88 2.95 105 T_REMOTE_IMAGE 5595 3.27 2.75 3.49 106 T_XMDrugObfuBody_14 5531 2.20 2.72 1.98 107 XM_B_Unsub2 5483 1.90 2.69 1.56 108 XM_B_COVIDMETA 5440 1.64 2.67 1.20 109 PDS_OTHER_BAD_TLD 5280 1.12 2.59 0.49 110 XM_OfRef6 5227 1.50 2.57 1.05 111 T_XMDrugObfuBody_08 4910 1.66 2.41 1.34 112 HTML_FONT_SIZE_HUGE 4907 0.87 2.41 0.21 113 URI_HEX 4876 1.56 2.40 1.20 114 TM2_M_VERY_LONG_WORD 4828 1.59 2.37 1.26 115 TR_XM_BayesRelay 4765 0.72 2.34 0.02 116 XMBdyGiftCard01 4747 0.91 2.33 0.30 117 XM_CamelCaseFrm001 4632 1.81 2.28 1.61 118 XM_UB95 4375 0.65 2.15 0.02 119 XM_B_SpammyWords4 4346 0.85 2.14 0.30 120 TR_XM_SB_Phish 4246 2.09 2.09 2.09 121 XM_JunkDunk 4225 0.62 2.08 0.00 122 RCVD_IN_IADB_LISTED 4213 4.46 2.07 5.48 123 URIBL_SBL_A 4193 0.84 2.06 0.32 124 T_TooManySym_01 4145 4.14 2.04 5.03 125 XMSubPhish11 4131 2.06 2.03 2.07 126 T_FILL_THIS_FORM_SHORT 4124 1.22 2.03 0.88 127 THIS_AD 4067 0.89 2.00 0.42 128 URI_PHP_REDIR 3985 0.59 1.96 0.00 129 MAILING_LIST_MULTI 3956 2.84 1.94 3.21 130 FROM_SUSPICIOUS_NTLD 3785 0.60 1.86 0.06 131 RCVD_IN_IADB_SPF 3771 3.90 1.85 4.77 132 FROM_SUSPICIOUS_NTLD_FP 3720 0.59 1.83 0.06 133 T_XMDrugObfuBody_00 3596 1.01 1.77 0.69 134 RCVD_IN_IADB_DK 3588 3.41 1.76 4.11 135 RCVD_IN_IADB_SENDERID 3556 3.51 1.75 4.26 136 XMBrknScrpt_02 3531 0.90 1.74 0.54 137 XM_URI_RBL 3521 0.61 1.73 0.13 138 RELAYCOUNTRY_IN 3454 0.60 1.70 0.13 139 URIBL_BLACK 3450 0.54 1.70 0.04 140 HTML_MIME_NO_HTML_TAG 3435 1.98 1.69 2.10 141 DIET_1 3386 0.75 1.66 0.37 142 BOTNET_NORDNS 3372 0.50 1.66 0.01 143 XMSubMetaI_00 3344 0.88 1.64 0.56 144 BAYES_40 3320 3.84 1.63 4.78 145 HK_RANDOM_REPLYTO 3183 0.59 1.56 0.18 146 XMSexyCombo_01 3105 0.78 1.53 0.47 147 TR_XM_PHPDW 3011 0.66 1.48 0.32 148 TR_XM_COVIDMETA4 2992 0.69 1.47 0.36 149 SUBJ_ALL_CAPS 2962 1.47 1.46 1.47 150 XMSlimDrugH 2948 0.70 1.45 0.38 151 XMGenDplmaNmb 2946 1.20 1.45 1.09 152 ALL_TRUSTED 2936 12.07 1.44 16.59 153 URI_TRY_3LD 2893 1.07 1.42 0.92 154 XMHTML_After_End 2878 1.17 1.41 1.07 155 XMStockSpam_06 2873 0.96 1.41 0.77 156 DKIM_ADSP_NXDOMAIN 2842 0.66 1.40 0.35 157 URI_NOVOWEL 2819 2.27 1.39 2.65 158 TR_XM_PHPForged 2761 0.58 1.36 0.25 159 TR_XM_FormFill2 2733 0.58 1.34 0.26 160 XM_H_PHPOS 2728 0.57 1.34 0.25 161 RCVD_IN_MSPIKE_L4 2650 0.43 1.30 0.07 162 TooManyTo_002 2646 2.07 1.30 2.40 163 RELAYCOUNTRY_GB 2591 1.29 1.27 1.29 164 XM_Body_Dirty_Words_01 2563 0.46 1.26 0.13 165 TR_XM_INV_DKIM 2489 0.42 1.22 0.07 166 XMPhish08 2474 0.54 1.22 0.26 167 BAYES_20 2414 2.40 1.19 2.91 168 XM_Lotto 2314 0.42 1.14 0.12 169 TR_XM_FormFill 2313 0.35 1.14 0.02 170 TR_Symld_Words 2304 1.62 1.13 1.82 171 NORDNS_LOW_CONTRAST 2291 0.34 1.13 0.01 172 TR_LOTS_OF_MONEY3 2290 0.47 1.13 0.20 173 TooManyTo_003 2283 1.42 1.12 1.54 174 DATE_IN_PAST_03_06 2262 0.42 1.11 0.12 175 T_XMHurry_00 2219 0.61 1.09 0.40 176 XM_BadFromFormat 2183 0.49 1.07 0.25 177 TR_XM_RelayPhish 2121 0.38 1.04 0.09 178 XMMoneyMeta_00 2116 0.75 1.04 0.63 179 XM_RXBody 2097 0.43 1.03 0.18 180 TR_XM_COVIDMETA1 2092 0.52 1.03 0.31 181 RELAYCOUNTRY_RU 2078 0.33 1.02 0.03 182 TooManyTo_004 2054 1.11 1.01 1.15 183 XM_H_Long_From02 2053 1.28 1.01 1.39 184 TR_MetaPhish_Combo_01 2053 0.75 1.01 0.63 185 XM_B_SEO 2044 0.39 1.00 0.14 186 XMBody_17 2040 0.58 1.00 0.39 187 XMSubMetaSxObfu_03 1960 0.70 0.96 0.59 188 HTTPS_HTTP_MISMATCH 1943 0.81 0.95 0.75 189 NUMERIC_HTTP_ADDR 1936 0.49 0.95 0.29 190 RCVD_IN_MSPIKE_H5 1934 2.79 0.95 3.58 191 TR_XM_MaxBayes 1916 0.28 0.94 0.00 192 TR_XM_SEO4 1899 0.33 0.93 0.07 193 NO_DNS_FOR_FROM 1894 0.42 0.93 0.20 194 TR_XM_MaxWHORU 1823 0.40 0.90 0.19 195 TooManyTo_005 1819 0.93 0.89 0.95 196 XMPhish14 1818 0.54 0.89 0.39 197 LongTLD 1806 0.38 0.89 0.16 198 XMSubNoVowel 1795 1.17 0.88 1.29 199 XMPhish30 1792 0.54 0.88 0.40 200 TR_Mismatch_TLD_02 1761 0.31 0.87 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 425775 91.23 96.57 88.96 2 RELAYCOUNTRY_US 382798 77.26 70.86 79.98 3 DKIM_SIGNED 349270 75.74 82.24 72.97 4 XM_B_Unicode 346132 72.88 74.19 72.32 5 XM_DK_Pass 342751 74.03 79.72 71.61 6 DKIM_VALID 333658 72.21 78.10 69.71 7 DCC_CHECK_NEGATIVE 285354 47.84 20.15 59.62 8 BAYES_50 281341 51.68 34.98 58.78 9 DKIM_VALID_AU 251606 54.73 59.81 52.57 10 XMListUnsubscribeExists 226931 53.49 67.80 47.41 11 XM_B_SpammyWords 210407 50.63 66.33 43.96 12 XM_B_Unicode3 205728 43.03 43.14 42.98 13 DCC_CHECK 182447 50.02 78.02 38.12 14 RCVD_IN_MSPIKE_WL 155592 29.56 22.64 32.51 15 HTML_FONT_LOW_CONTRAST 144422 30.76 32.13 30.17 16 T_TM2_M_HEADER_IN_MSG 138620 26.34 20.18 28.96 17 DKIM_VALID_EF 137542 29.06 29.83 28.74 18 LOC_TINY_FONT_1 126026 29.41 36.64 26.33 19 FVGT_m_MULTI_ODD 107966 23.82 26.80 22.56 20 RCVD_IN_MSPIKE_H2 103117 21.50 21.40 21.54 21 XMSubLong 100640 22.12 24.69 21.03 22 MIME_HTML_ONLY 92459 24.01 35.05 19.32 23 T_KAM_HTML_FONT_INVALID 87460 20.57 25.96 18.27 24 XM_B_SpammyWords2 86633 24.16 38.42 18.10 25 ALL_TRUSTED 79384 12.07 1.44 16.59 26 RCVD_IN_MSPIKE_H3 78245 14.83 11.26 16.35 27 RCVD_IN_MSPIKE_H4 60216 11.94 10.43 12.58 28 XM_Body_Dirty_Words 52709 14.34 22.17 11.01 29 XM_Multi_Part_URI 52089 12.03 14.74 10.88 30 BAYES_00 45422 6.88 0.74 9.49 31 XM_B_Unsub 45366 10.74 13.72 9.48 32 TooManyTo_001 42440 8.24 6.76 8.87 33 BAYES_60 42411 8.61 8.03 8.86 34 XM_DKIMWhitelistDomains 42350 6.28 0.23 8.85 35 LotsOfNums_01 39180 8.53 9.35 8.19 36 UNPARSEABLE_RELAY 36504 8.33 9.98 7.63 37 XM_DK_Undo_02 35932 19.27 46.94 7.51 38 XM_Evil_Numbers_Gen 35767 8.52 10.98 7.47 39 RCVD_IN_RP_SAFE 32390 6.29 5.17 6.77 40 XM_SendGrid 32181 6.78 6.91 6.72 41 FSL_BULK_SIG 31739 9.54 16.38 6.63 42 TR_XM_UnparsRelay 31083 7.47 9.76 6.49 43 TR_XM_DK_Bayes 30857 4.68 0.51 6.45 44 TR_XM_DK_Bayes1 30250 4.58 0.50 6.32 45 RCVD_IN_RP_CERTIFIED 29632 5.58 4.14 6.19 46 LOTS_OF_MONEY 28925 7.36 10.45 6.04 47 HTML_IMAGE_RATIO_02 28255 6.67 8.47 5.90 48 MIME_QP_LONG_LINE 27054 5.11 3.84 5.65 49 TR_XM_DK_Bayes2 26983 4.10 0.48 5.64 50 BAYES_99 26386 15.12 37.71 5.51 51 RCVD_IN_IADB_LISTED 26223 4.46 2.07 5.48 52 XM_H_Long_From01 26057 5.65 6.15 5.44 53 IN_ZIMBRA_NJ_WHITELIST 25513 3.75 0.05 5.33 54 XM_B_Phish_Phrases 24814 5.86 7.46 5.18 55 RELAYCOUNTRY_META 24765 10.72 23.77 5.17 56 XMStrtUSub 24391 4.81 4.15 5.10 57 T_TooManySym_01 24091 4.14 2.04 5.03 58 BOTNET_IPINHOSTNAME 23734 7.18 12.42 4.96 59 BAYES_80 23066 6.18 9.38 4.82 60 TR_XM_DKIM_Undo 23039 14.29 36.59 4.81 61 BAYES_40 22867 3.84 1.63 4.78 62 HTML_IMAGE_RATIO_04 22815 4.77 4.76 4.77 63 RCVD_IN_IADB_SPF 22811 3.90 1.85 4.77 64 MPART_ALT_DIFF 21672 6.09 9.78 4.53 65 BAYES_999 20917 11.58 28.53 4.37 66 XM_PDF 20900 3.31 0.82 4.37 67 TR_XM_DK_SendGrid 20423 4.24 4.19 4.27 68 RCVD_IN_IADB_SENDERID 20370 3.51 1.75 4.26 69 RCVD_IN_IADB_DK 19666 3.41 1.76 4.11 70 XM_B_SpammyWords3 19532 6.55 12.35 4.08 71 TR_XM_SpammyWords4 18476 5.39 9.00 3.86 72 HTML_IMAGE_RATIO_06 17989 3.61 3.25 3.76 73 XM_B_SpammyTLD 17196 4.10 5.29 3.59 74 RCVD_IN_MSPIKE_H5 17131 2.79 0.95 3.58 75 TR_XM_PhishingBody 17027 4.41 6.43 3.56 76 T_REMOTE_IMAGE 16697 3.27 2.75 3.49 77 RCVD_IN_IADB_VOUCHED 16399 2.64 0.78 3.43 78 XM_H_Trusted_IP 16339 2.40 0.00 3.41 79 XMSexyCombo_05 16051 6.26 13.11 3.35 80 XMSubMetaSx_00 16002 4.31 6.58 3.34 81 DKIM_INVALID 15612 3.53 4.15 3.26 82 XM_UncommonTLD01 15422 8.54 21.05 3.22 83 MAILING_LIST_MULTI 15383 2.84 1.94 3.21 84 BAYES_95 14916 3.90 5.75 3.12 85 XMNumbers 14150 3.71 5.50 2.96 86 MIME_HTML_ONLY_MULTI 14127 2.93 2.88 2.95 87 BAYES_20 13924 2.40 1.19 2.91 88 ANY_BOUNCE_MESSAGE 13170 2.13 0.67 2.75 89 BOUNCE_MESSAGE 13164 2.13 0.66 2.75 90 URI_NOVOWEL 12662 2.27 1.39 2.65 91 FROM_EXCESS_BASE64 11871 2.61 2.90 2.48 92 XM_B_Phish66 11697 2.72 3.36 2.44 93 TooManyTo_002 11470 2.07 1.30 2.40 94 T_TooManySym_02 11420 1.87 0.64 2.39 95 HTML_IMAGE_RATIO_08 11236 2.55 3.04 2.35 96 TR_DCC_Bayes_99 11221 10.36 29.20 2.34 97 TM2_M_URI_OPT_OUT 10915 2.60 3.34 2.28 98 RCVD_IN_IADB_OPTIN 10509 1.70 0.53 2.20 99 MIME_HTML_MOSTLY 10415 3.84 7.76 2.18 100 HTML_MIME_NO_HTML_TAG 10064 1.98 1.69 2.10 101 TR_XM_SB_Phish 10019 2.09 2.09 2.09 102 XMSubPhish11 9898 2.06 2.03 2.07 103 HELO_NODOT 9599 1.56 0.52 2.01 104 HELO_NO_DOMAIN 9596 1.56 0.51 2.00 105 T_XMDrugObfuBody_14 9501 2.20 2.72 1.98 106 XMDiploma_00 9337 2.35 3.30 1.95 107 TR_Symld_Words 8730 1.62 1.13 1.82 108 UNTRUSTED_Relay 8728 7.32 20.24 1.82 109 BOTNET 8599 6.24 16.70 1.80 110 BAYES_05 8305 1.40 0.60 1.74 111 SPOOF_COM2COM 8228 1.24 0.10 1.72 112 TVD_RCVD_IP 8170 1.27 0.24 1.71 113 KHOP_HELO_FCRDNS 8013 3.40 7.45 1.67 114 XM_SPF_SoftFail 7794 2.11 3.23 1.63 115 XM_CamelCaseFrm001 7694 1.81 2.28 1.61 116 XM_DK_Undo_01 7685 2.04 3.06 1.61 117 USER_IN_DEF_DKIM_WL 7608 1.12 0.01 1.59 118 IN_HORDE_ADDRESS_BOOK 7580 1.13 0.06 1.58 119 XM_B_Unsub2 7483 1.90 2.69 1.56 120 TooManyTo_003 7371 1.42 1.12 1.54 121 INVALID_MSGID 7085 1.14 0.35 1.48 122 SUBJ_ALL_CAPS 7054 1.47 1.46 1.47 123 TR_XM_SpammyWords5 6693 2.07 3.63 1.40 124 XM_H_Long_From02 6669 1.28 1.01 1.39 125 RELAYCOUNTRY_CA 6618 2.90 6.48 1.38 126 MSGID_NOFQDN1 6481 0.96 0.04 1.35 127 T_XMDrugObfuBody_08 6437 1.66 2.41 1.34 128 XMCapTrack 6330 1.06 0.44 1.32 129 TO_MALFORMED 6257 0.92 0.00 1.31 130 XMSubNoVowel 6195 1.17 0.88 1.29 131 RELAYCOUNTRY_GB 6180 1.29 1.27 1.29 132 XM_UB50 6060 2.59 5.70 1.27 133 TM2_M_VERY_LONG_WORD 6044 1.59 2.37 1.26 134 XM_GoogleGroups 6030 1.07 0.61 1.26 135 HELO_MISC_IP 5775 0.87 0.08 1.21 136 URI_HEX 5750 1.56 2.40 1.20 137 XM_B_COVIDMETA 5733 1.64 2.67 1.20 138 TooManyTo_004 5526 1.11 1.01 1.15 139 XMBSHREFv2 5247 0.82 0.18 1.10 140 XMGenDplmaNmb 5214 1.20 1.45 1.09 141 XMHTML_After_End 5129 1.17 1.41 1.07 142 XMGappySubj_01 5119 0.79 0.13 1.07 143 XM_OfRef6 5016 1.50 2.57 1.05 144 TooManyTo_005 4547 0.93 0.89 0.95 145 URI_TRY_3LD 4398 1.07 1.42 0.92 146 DKIM_ADSP_CUSTOM_MED 4293 0.87 0.81 0.90 147 T_FILL_THIS_FORM_SHORT 4209 1.22 2.03 0.88 148 RCVD_IN_BL_SPAMCOP_NET 4189 3.35 9.18 0.88 149 XMBody_95 3932 0.62 0.14 0.82 150 HTML_FONT_FACE_BAD 3901 0.77 0.65 0.82 151 SpammyFromTLD_01 3894 2.23 5.56 0.81 152 RELAYCOUNTRY_DE 3854 1.52 3.20 0.81 153 TR_MSPIKEBAYES00 3763 0.56 0.01 0.79 154 TR_XM_SpammyWords2 3703 4.61 13.62 0.77 155 XMStockSpam_06 3686 0.96 1.41 0.77 156 FROM_GOV_DKIM_AU 3649 0.64 0.36 0.76 157 HTTPS_HTTP_MISMATCH 3568 0.81 0.95 0.75 158 TVD_SPACE_RATIO 3452 0.54 0.10 0.72 159 T_XMDrugObfuBody_00 3323 1.01 1.77 0.69 160 T_TooManySym_03 3171 0.52 0.19 0.66 161 XMNoVowels 3105 0.59 0.45 0.65 162 TR_MetaPhish_Combo_01 3030 0.75 1.01 0.63 163 XMMoneyMeta_00 3014 0.75 1.04 0.63 164 NML_ADSP_CUSTOM_MED 2955 0.63 0.66 0.62 165 XMSubMetaSxObfu_03 2839 0.70 0.96 0.59 166 HTML_IMAGE_ONLY_20 2797 0.52 0.37 0.58 167 RCVD_IN_SORBS_DUL 2773 0.46 0.18 0.58 168 MSGID_FROM_MTA_HEADER 2753 0.46 0.18 0.58 169 SHORT_HELO_AND_INLINE_IMAGE 2736 0.42 0.06 0.57 170 XM_SPF_Unknown 2730 0.64 0.82 0.57 171 XM_ShortIntro_01 2720 0.52 0.42 0.57 172 XMLngstWrd_00 2710 0.54 0.46 0.57 173 XM_H_PHPMailer 2675 0.58 0.65 0.56 174 XMSubMetaI_00 2667 0.88 1.64 0.56 175 XMBrknScrpt_02 2577 0.90 1.74 0.54 176 XM_ProductURIs 2513 0.52 0.50 0.53 177 FROM_GOV_SPOOF 2440 0.40 0.14 0.51 178 T_OBFU_PDF_ATTACH 2440 0.40 0.15 0.51 179 XM_DIRTYINTL 2432 1.76 4.71 0.51 180 XMLngstWrd_01 2389 0.48 0.43 0.50 181 XMDateMe_00 2385 0.48 0.45 0.50 182 RDNS_DYNAMIC 2375 0.60 0.83 0.50 183 FORGED_GMAIL_RCVD 2355 0.55 0.68 0.49 184 PDS_OTHER_BAD_TLD 2345 1.12 2.59 0.49 185 XMHTMLBadTable_001 2314 0.52 0.60 0.48 186 MISSING_HEADERS 2271 0.52 0.61 0.47 187 XMSexyCombo_01 2228 0.78 1.53 0.47 188 TM2_M_BODY_EMPTY 2226 0.35 0.09 0.47 189 T_Symld_Words_02 2176 0.55 0.78 0.45 190 HTML_IMAGE_ONLY_32 2002 0.44 0.48 0.42 191 THIS_AD 1992 0.89 2.00 0.42 192 T_XMHurry_00 1925 0.61 1.09 0.40 193 XMPhish30 1916 0.54 0.88 0.40 194 XMLngstWrd_02 1893 0.35 0.24 0.40 195 XMBody_17 1889 0.58 1.00 0.39 196 HTML_IMAGE_ONLY_28 1876 0.37 0.32 0.39 197 XMPhish14 1844 0.54 0.89 0.39 198 USER_IN_WHITELIST 1814 0.27 0.00 0.38 199 USER_IN_WELCOMELIST 1814 0.27 0.00 0.38 200 XMSlimDrugH 1795 0.70 1.45 0.38 ----------------------------------------------------------------------