Email: 539943 Autolearn: 0 AvgScore: 2.48 AvgScanTime: 1.38 sec Spam: 137337 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 1.61 sec Ham: 402606 Autolearn: 0 AvgScore: -1.48 AvgScanTime: 1.30 sec Time Spent Running SA: 206.82 hours Time Spent Processing Spam: 61.32 hours Time Spent Processing Ham: 145.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129235 86.33 94.10 83.68 2 DKIM_SIGNED 114956 76.88 83.70 74.56 3 XM_DK_Pass 108697 74.70 79.15 73.18 4 DKIM_VALID 106244 72.73 77.36 71.15 5 XM_B_Unicode 103962 69.08 75.70 66.82 6 DCC_CHECK 103341 49.72 75.25 41.01 7 RELAYCOUNTRY_US 102127 79.64 74.36 81.44 8 XM_B_SpammyWords 94609 53.37 68.89 48.08 9 XMListUnsubscribeExists 90176 49.66 65.66 44.20 10 DKIM_VALID_AU 79678 55.70 58.02 54.91 11 XM_DK_Undo_02 58670 16.86 42.72 8.04 12 XM_B_Unicode3 56303 39.41 41.00 38.86 13 BAYES_50 53612 50.63 39.04 54.58 14 LOC_TINY_FONT_1 51514 25.39 37.51 21.25 15 XM_B_SpammyWords2 51318 23.67 37.37 18.99 16 TR_XM_DKIM_Undo 46624 13.14 33.95 6.04 17 BAYES_99 46241 13.35 33.67 6.42 18 HTML_FONT_LOW_CONTRAST 44356 27.03 32.30 25.24 19 DKIM_VALID_EF 44274 31.27 32.24 30.95 20 T_KAM_HTML_FONT_INVALID 44248 20.91 32.22 17.05 21 MIME_HTML_ONLY 40860 22.34 29.75 19.82 22 FVGT_m_MULTI_ODD 39159 23.52 28.51 21.82 23 RCVD_IN_MSPIKE_H2 36403 24.91 26.51 24.37 24 BAYES_999 34590 10.30 25.19 5.22 25 TR_DCC_Bayes_99 34579 8.72 25.18 3.11 26 XMSubLong 33908 22.16 24.69 21.30 27 T_TM2_M_HEADER_IN_MSG 30269 28.07 22.04 30.13 28 DCC_CHECK_NEGATIVE 30237 47.72 22.02 56.49 29 RELAYCOUNTRY_META 30062 9.13 21.89 4.78 30 RCVD_IN_MSPIKE_WL 27705 29.32 20.17 32.44 31 XM_Body_Dirty_Words 26736 13.35 19.47 11.26 32 BOTNET 25425 5.87 18.51 1.56 33 UNTRUSTED_Relay 22898 5.54 16.67 1.74 34 LOTS_OF_MONEY 21738 8.94 15.83 6.60 35 XM_UncommonTLD01 21522 6.57 15.67 3.46 36 XM_B_Unsub 21384 11.47 15.57 10.07 37 XM_Multi_Part_URI 20107 11.47 14.64 10.39 38 FSL_BULK_SIG 19840 9.06 14.45 7.23 39 BOTNET_IPINHOSTNAME 18309 6.41 13.33 4.05 40 XM_B_SpammyWords3 17856 6.44 13.00 4.20 41 TR_XM_SpammyWords4 17136 6.20 12.48 4.05 42 TR_XM_SpammyWords2 15401 3.82 11.21 1.30 43 MPART_ALT_DIFF 15185 6.41 11.06 4.82 44 RCVD_IN_MSPIKE_H3 14921 14.07 10.86 15.16 45 UNPARSEABLE_RELAY 14761 7.95 10.75 7.00 46 TR_XM_UnparsRelay 14569 7.11 10.61 5.91 47 XMSexyCombo_05 14015 5.16 10.20 3.44 48 XM_Evil_Numbers_Gen 12572 8.38 9.15 8.11 49 BAYES_80 12476 6.26 9.08 5.29 50 HTML_IMAGE_RATIO_02 11443 6.06 8.33 5.28 51 BAYES_60 11340 9.08 8.26 9.36 52 RCVD_IN_MSPIKE_H4 11325 10.76 8.25 11.62 53 XMSubMetaSx_00 11051 4.51 8.05 3.30 54 MIME_HTML_MOSTLY 11009 3.73 8.02 2.27 55 RCVD_IN_BL_SPAMCOP_NET 10742 2.61 7.82 0.84 56 XM_SendGrid 10508 6.40 7.65 5.97 57 LotsOfNums_01 10190 8.49 7.42 8.85 58 SpammyFromTLD_01 9728 2.39 7.08 0.79 59 XM_B_Phish_Phrases 9289 8.12 6.76 8.58 60 TR_XM_PhishingBody 8953 4.20 6.52 3.40 61 DKIM_INVALID 8712 4.15 6.34 3.40 62 XM_H_Long_From01 8604 5.41 6.26 5.12 63 BAYES_95 7813 3.77 5.69 3.12 64 T_REMOTE_IMAGE 7729 4.03 5.63 3.48 65 SpammyFromTLD_02 7709 1.67 5.61 0.32 66 RCVD_IN_MSPIKE_BL 7588 1.65 5.53 0.33 67 XM_UB50 7426 2.25 5.41 1.18 68 HTML_MIME_NO_HTML_TAG 7023 3.13 5.11 2.45 69 TR_XM_MSPIKECOMBO 6937 1.50 5.05 0.30 70 TooManyTo_001 6799 7.75 4.95 8.71 71 XM_SPF_SoftFail 6627 2.69 4.83 1.96 72 KHOP_HELO_FCRDNS 6457 2.42 4.70 1.64 73 XM_B_SpammyTLD 6368 2.56 4.64 1.85 74 RELAYCOUNTRY_CA 6302 2.03 4.59 1.16 75 HTML_IMAGE_RATIO_04 6160 5.54 4.49 5.90 76 XM_UB99 6078 1.13 4.43 0.00 77 TR_XM_DK_SendGrid 5879 3.89 4.28 3.76 78 RCVD_IN_RP_RNBL 5833 1.11 4.25 0.03 79 XMStrtUSub 5714 7.89 4.16 9.16 80 XMNumbers 5427 3.39 3.95 3.20 81 TM2_M_URI_OPT_OUT 5369 3.07 3.91 2.79 82 RELAYCOUNTRY_FR 5369 1.22 3.91 0.31 83 T_HTML_TAG_BALANCE_CENTER 5164 1.05 3.76 0.13 84 BOTNET_NORDNS 5124 0.96 3.73 0.02 85 MIME_QP_LONG_LINE 5058 5.05 3.68 5.52 86 XM_OfRef6 5015 1.60 3.65 0.90 87 TR_XM_SpammyWords5 4965 2.10 3.62 1.59 88 XMDiploma_00 4962 1.93 3.61 1.36 89 XM_B_Phish66 4911 2.51 3.58 2.15 90 URIBL_SBL_A 4857 1.10 3.54 0.27 91 BODY_URI_ONLY 4853 0.91 3.53 0.01 92 HTML_IMAGE_ONLY_08 4763 0.96 3.47 0.11 93 RCVD_IN_RP_SAFE 4745 6.11 3.46 7.02 94 T_XMDrugObfuBody_14 4669 2.57 3.40 2.28 95 MIME_HTML_ONLY_MULTI 4666 3.11 3.40 3.01 96 HTML_IMAGE_RATIO_08 4627 2.59 3.37 2.33 97 TR_XM_SpammyWords3 4466 1.02 3.25 0.26 98 GOOG_STO_IMG_HTML 4375 0.81 3.19 0.00 99 HTML_IMAGE_RATIO_06 4368 3.24 3.18 3.26 100 HTML_FONT_SIZE_LARGE 4199 0.86 3.06 0.11 101 XM_B_COVIDMETA 4194 1.42 3.05 0.87 102 XM_B_Unsub2 4148 1.86 3.02 1.46 103 XM_DIRTYINTL 4086 1.07 2.98 0.43 104 T_XMDrugObfuBody_08 4034 1.81 2.94 1.43 105 XM_UB999 3974 0.74 2.89 0.00 106 URIBL_DBL_SPAM 3816 0.71 2.78 0.01 107 RCVD_IN_PSBL 3806 0.76 2.77 0.07 108 MIXED_IMG_CASE 3696 0.69 2.69 0.00 109 MIXED_HREF_CASE 3692 0.68 2.69 0.00 110 MIXED_FONT_CASE 3690 0.68 2.69 0.00 111 RCVD_IN_RP_CERTIFIED 3617 5.28 2.63 6.18 112 TM2_M_VERY_LONG_WORD 3609 1.50 2.63 1.11 113 PDS_OTHER_BAD_TLD 3565 0.89 2.60 0.30 114 T_TooManySym_01 3463 4.69 2.52 5.42 115 RCVD_IN_MSPIKE_L5 3421 0.66 2.49 0.03 116 XM_B_SpammyWords4 3410 0.93 2.48 0.40 117 XM_UB60 3361 0.72 2.45 0.13 118 XM_CamelCaseFrm001 3207 1.93 2.34 1.79 119 XM_UB80 3166 0.61 2.31 0.04 120 RELAYCOUNTRY_GB 3153 1.41 2.30 1.11 121 XMGenDplmaNmb 3148 1.16 2.29 0.78 122 TR_XM_SB_Phish 3139 2.18 2.29 2.15 123 XM_URI_RBL 3082 0.68 2.24 0.15 124 ALL_TRUSTED 3080 11.86 2.24 15.15 125 RCVD_IN_IADB_LISTED 2975 4.44 2.17 5.22 126 XMSubPhish11 2960 2.14 2.16 2.13 127 XM_DK_Undo_01 2955 1.80 2.15 1.68 128 SUBJ_ALL_CAPS 2927 1.75 2.13 1.62 129 URI_PHP_REDIR 2889 0.54 2.10 0.00 130 T_FILL_THIS_FORM_SHORT 2783 1.20 2.03 0.91 131 MAILING_LIST_MULTI 2745 2.63 2.00 2.85 132 TR_Symld_Words 2702 1.94 1.97 1.93 133 TR_XM_COVIDMETA1 2687 0.73 1.96 0.31 134 RCVD_IN_IADB_SPF 2681 3.89 1.95 4.55 135 XMMoneyMeta_00 2657 0.91 1.93 0.57 136 FROM_EXCESS_BASE64 2656 2.33 1.93 2.46 137 TR_XM_COVIDMETA4 2651 0.79 1.93 0.39 138 RCVD_IN_IADB_DK 2561 3.42 1.86 3.95 139 TR_XM_PHPDW 2548 0.67 1.86 0.26 140 RCVD_IN_IADB_SENDERID 2527 3.52 1.84 4.09 141 TR_Mismatch_TLD_02 2495 0.52 1.82 0.08 142 XMSexyCombo_01 2462 0.79 1.79 0.45 143 URIBL_BLACK 2456 0.48 1.79 0.04 144 TR_XM_PHPForged 2428 0.62 1.77 0.23 145 XMStockSpam_06 2427 1.36 1.77 1.23 146 URI_HEX 2386 1.43 1.74 1.32 147 TR_XM_FormFill2 2373 0.61 1.73 0.23 148 XM_H_PHPOS 2357 0.60 1.72 0.22 149 XMBrknScrpt_02 2287 1.13 1.67 0.95 150 T_XMDrugObfuBody_00 2281 1.02 1.66 0.80 151 XMBody_17 2272 0.68 1.65 0.35 152 RELAYCOUNTRY_IN 2266 0.52 1.65 0.13 153 URI_NO_WWW_BIZ_CGI 2259 0.42 1.64 0.01 154 XM_UB95 2213 0.42 1.61 0.02 155 TR_XM_INV_DKIM 2142 0.49 1.56 0.12 156 BAYES_40 2120 4.07 1.54 4.93 157 URI_NOVOWEL 2095 2.40 1.53 2.69 158 XMSubMetaSSx_00 2073 0.47 1.51 0.11 159 TR_XM_MaxBayes 2054 0.38 1.50 0.00 160 MONEY_NOHTML 2041 0.45 1.49 0.10 161 TR_XM_BayesRelay 1885 0.36 1.37 0.01 162 RCVD_IN_MSPIKE_L4 1880 0.48 1.37 0.18 163 DKIM_ADSP_CUSTOM_MED 1844 1.01 1.34 0.89 164 XMSubMetaSSxObfu_00 1824 0.37 1.33 0.04 165 HTTPS_HTTP_MISMATCH 1713 0.89 1.25 0.77 166 FORGED_GMAIL_RCVD 1705 0.66 1.24 0.47 167 BAYES_20 1684 3.36 1.23 4.09 168 URI_TRY_3LD 1684 1.07 1.23 1.02 169 TR_LOTS_OF_MONEY3 1648 0.43 1.20 0.17 170 XM_Body_Dirty_Words_01 1642 0.40 1.20 0.13 171 RCVD_IN_MSPIKE_L3 1636 0.36 1.19 0.08 172 USER_IN_DEF_DKIM_WL 1623 8.68 1.18 11.24 173 XMBdyGiftCard01 1596 0.81 1.16 0.69 174 T_XMHurry_00 1596 0.62 1.16 0.43 175 T_Symld_Words_02 1592 0.80 1.16 0.68 176 NML_ADSP_CUSTOM_MED 1566 0.74 1.14 0.61 177 RELAYCOUNTRY_AU 1551 0.57 1.13 0.38 178 XM_PDF 1536 4.14 1.12 5.17 179 XM_H_Long_From02 1520 1.20 1.11 1.23 180 TR_MetaPhish_Combo_01 1472 0.99 1.07 0.96 181 RCVD_IN_MSPIKE_H5 1459 4.49 1.06 5.66 182 XMPhish08 1429 0.47 1.04 0.28 183 XMHTML_After_End 1428 1.09 1.04 1.11 184 RELAYCOUNTRY_DE 1393 0.59 1.01 0.44 185 XM_B_SEO 1386 0.37 1.01 0.15 186 SHOPIFY_IMG_NOT_RCVD_SFY 1376 0.42 1.00 0.22 187 XMSubMetaI_00 1322 0.59 0.96 0.46 188 TR_BOTNET_NEGATE 1319 0.53 0.96 0.39 189 XM_JunkDunk 1312 0.24 0.96 0.00 190 BAYES_00 1292 7.74 0.94 10.06 191 XMHTMLBadTable_001 1281 0.61 0.93 0.50 192 XM_H_PHPMailer 1277 0.70 0.93 0.62 193 FROM_SUSPICIOUS_NTLD 1270 0.26 0.92 0.04 194 TR_XM_SEO4 1267 0.31 0.92 0.10 195 XMPhish30 1256 0.60 0.91 0.50 196 HK_RANDOM_REPLYTO 1224 0.36 0.89 0.18 197 RCVD_IN_IADB_VOUCHED 1215 2.56 0.88 3.13 198 TM2_M_A_HREF_HREF 1189 0.47 0.87 0.34 199 HTML_FONT_FACE_BAD 1186 0.98 0.86 1.02 200 FROM_SUSPICIOUS_NTLD_FP 1182 0.24 0.86 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 336913 86.33 94.10 83.68 2 RELAYCOUNTRY_US 327886 79.64 74.36 81.44 3 DKIM_SIGNED 300172 76.88 83.70 74.56 4 XM_DK_Pass 294645 74.70 79.15 73.18 5 DKIM_VALID 286472 72.73 77.36 71.15 6 XM_B_Unicode 269035 69.08 75.70 66.82 7 DCC_CHECK_NEGATIVE 227436 47.72 22.02 56.49 8 DKIM_VALID_AU 221088 55.70 58.02 54.91 9 BAYES_50 219736 50.63 39.04 54.58 10 XM_B_SpammyWords 193554 53.37 68.89 48.08 11 XMListUnsubscribeExists 177937 49.66 65.66 44.20 12 DCC_CHECK 165128 49.72 75.25 41.01 13 XM_B_Unicode3 156462 39.41 41.00 38.86 14 RCVD_IN_MSPIKE_WL 130612 29.32 20.17 32.44 15 DKIM_VALID_EF 124589 31.27 32.24 30.95 16 T_TM2_M_HEADER_IN_MSG 121311 28.07 22.04 30.13 17 HTML_FONT_LOW_CONTRAST 101609 27.03 32.30 25.24 18 RCVD_IN_MSPIKE_H2 98120 24.91 26.51 24.37 19 FVGT_m_MULTI_ODD 87850 23.52 28.51 21.82 20 XMSubLong 85765 22.16 24.69 21.30 21 LOC_TINY_FONT_1 85559 25.39 37.51 21.25 22 MIME_HTML_ONLY 79789 22.34 29.75 19.82 23 XM_B_SpammyWords2 76460 23.67 37.37 18.99 24 T_KAM_HTML_FONT_INVALID 68663 20.91 32.22 17.05 25 RCVD_IN_MSPIKE_H3 61044 14.07 10.86 15.16 26 ALL_TRUSTED 60975 11.86 2.24 15.15 27 XM_DKIMWhitelistDomains 50393 9.34 0.02 12.52 28 RCVD_IN_MSPIKE_H4 46772 10.76 8.25 11.62 29 XM_Body_Dirty_Words 45336 13.35 19.47 11.26 30 USER_IN_DEF_DKIM_WL 45269 8.68 1.18 11.24 31 XM_Multi_Part_URI 41849 11.47 14.64 10.39 32 XM_B_Unsub 40544 11.47 15.57 10.07 33 BAYES_00 40507 7.74 0.94 10.06 34 BAYES_60 37679 9.08 8.26 9.36 35 XMStrtUSub 36889 7.89 4.16 9.16 36 LotsOfNums_01 35636 8.49 7.42 8.85 37 TooManyTo_001 35049 7.75 4.95 8.71 38 XM_B_Phish_Phrases 34552 8.12 6.76 8.58 39 XM_Evil_Numbers_Gen 32669 8.38 9.15 8.11 40 XM_DK_Undo_02 32378 16.86 42.72 8.04 41 FSL_BULK_SIG 29096 9.06 14.45 7.23 42 RCVD_IN_RP_SAFE 28251 6.11 3.46 7.02 43 UNPARSEABLE_RELAY 28166 7.95 10.75 7.00 44 LOTS_OF_MONEY 26559 8.94 15.83 6.60 45 BAYES_99 25846 13.35 33.67 6.42 46 TR_XM_DK_Bayes 25767 4.93 0.60 6.40 47 RCVD_IN_RP_CERTIFIED 24901 5.28 2.63 6.18 48 TR_XM_DK_Bayes1 24860 4.75 0.58 6.17 49 TR_XM_DKIM_Undo 24302 13.14 33.95 6.04 50 XM_SendGrid 24035 6.40 7.65 5.97 51 TR_XM_UnparsRelay 23800 7.11 10.61 5.91 52 HTML_IMAGE_RATIO_04 23742 5.54 4.49 5.90 53 RCVD_IN_MSPIKE_H5 22796 4.49 1.06 5.66 54 MIME_QP_LONG_LINE 22230 5.05 3.68 5.52 55 T_TooManySym_01 21838 4.69 2.52 5.42 56 TR_XM_DK_Bayes2 21511 4.12 0.53 5.34 57 BAYES_80 21299 6.26 9.08 5.29 58 HTML_IMAGE_RATIO_02 21271 6.06 8.33 5.28 59 BAYES_999 21033 10.30 25.19 5.22 60 RCVD_IN_IADB_LISTED 21019 4.44 2.17 5.22 61 XM_PDF 20833 4.14 1.12 5.17 62 IN_ZIMBRA_NJ_WHITELIST 20699 3.85 0.06 5.14 63 XM_H_Long_From01 20596 5.41 6.26 5.12 64 BAYES_40 19850 4.07 1.54 4.93 65 MPART_ALT_DIFF 19408 6.41 11.06 4.82 66 RELAYCOUNTRY_META 19238 9.13 21.89 4.78 67 RCVD_IN_IADB_SPF 18308 3.89 1.95 4.55 68 XM_B_SpammyWords3 16921 6.44 13.00 4.20 69 RCVD_IN_IADB_SENDERID 16455 3.52 1.84 4.09 70 BAYES_20 16455 3.36 1.23 4.09 71 TR_XM_SpammyWords4 16323 6.20 12.48 4.05 72 BOTNET_IPINHOSTNAME 16303 6.41 13.33 4.05 73 RCVD_IN_IADB_DK 15891 3.42 1.86 3.95 74 TR_XM_DK_SendGrid 15134 3.89 4.28 3.76 75 T_REMOTE_IMAGE 14020 4.03 5.63 3.48 76 XM_UncommonTLD01 13934 6.57 15.67 3.46 77 XMSexyCombo_05 13844 5.16 10.20 3.44 78 XM_H_Trusted_IP 13719 2.54 0.00 3.41 79 TR_XM_PhishingBody 13706 4.20 6.52 3.40 80 DKIM_INVALID 13700 4.15 6.34 3.40 81 XMSubMetaSx_00 13293 4.51 8.05 3.30 82 HTML_IMAGE_RATIO_06 13123 3.24 3.18 3.26 83 XMNumbers 12891 3.39 3.95 3.20 84 RCVD_IN_IADB_VOUCHED 12600 2.56 0.88 3.13 85 BAYES_95 12569 3.77 5.69 3.12 86 TR_DCC_Bayes_99 12522 8.72 25.18 3.11 87 MIME_HTML_ONLY_MULTI 12137 3.11 3.40 3.01 88 MAILING_LIST_MULTI 11459 2.63 2.00 2.85 89 TM2_M_URI_OPT_OUT 11213 3.07 3.91 2.79 90 URI_NOVOWEL 10845 2.40 1.53 2.69 91 T_TooManySym_02 10440 2.13 0.77 2.59 92 ANY_BOUNCE_MESSAGE 9930 1.99 0.60 2.47 93 BOUNCE_MESSAGE 9929 1.99 0.60 2.47 94 FROM_EXCESS_BASE64 9901 2.33 1.93 2.46 95 HTML_MIME_NO_HTML_TAG 9872 3.13 5.11 2.45 96 TooManyTo_002 9553 1.99 0.86 2.37 97 HTML_IMAGE_RATIO_08 9381 2.59 3.37 2.33 98 T_XMDrugObfuBody_14 9198 2.57 3.40 2.28 99 MIME_HTML_MOSTLY 9144 3.73 8.02 2.27 100 BAYES_05 8664 1.74 0.55 2.15 101 XM_B_Phish66 8661 2.51 3.58 2.15 102 TR_XM_SB_Phish 8657 2.18 2.29 2.15 103 XMSubPhish11 8573 2.14 2.16 2.13 104 RCVD_IN_IADB_OPTIN 8107 1.66 0.61 2.01 105 HELO_NODOT 8086 1.68 0.72 2.01 106 HELO_NO_DOMAIN 8081 1.68 0.71 2.01 107 XM_SPF_SoftFail 7910 2.69 4.83 1.96 108 TR_Symld_Words 7783 1.94 1.97 1.93 109 XM_B_SpammyTLD 7463 2.56 4.64 1.85 110 IN_HORDE_ADDRESS_BOOK 7330 1.38 0.08 1.82 111 XM_CamelCaseFrm001 7204 1.93 2.34 1.79 112 INVALID_MSGID 7121 1.44 0.47 1.77 113 UNTRUSTED_Relay 6992 5.54 16.67 1.74 114 XM_DK_Undo_01 6763 1.80 2.15 1.68 115 KHOP_HELO_FCRDNS 6587 2.42 4.70 1.64 116 SUBJ_ALL_CAPS 6523 1.75 2.13 1.62 117 TR_XM_SpammyWords5 6391 2.10 3.62 1.59 118 TooManyTo_003 6322 1.33 0.63 1.57 119 TO_MALFORMED 6321 1.17 0.01 1.57 120 BOTNET 6271 5.87 18.51 1.56 121 XM_B_Unsub2 5877 1.86 3.02 1.46 122 T_XMDrugObfuBody_08 5740 1.81 2.94 1.43 123 XMCapTrack 5685 1.18 0.49 1.41 124 TVD_RCVD_IP 5593 1.17 0.55 1.39 125 XMDiploma_00 5467 1.93 3.61 1.36 126 URI_HEX 5315 1.43 1.74 1.32 127 TR_XM_SpammyWords2 5222 3.82 11.21 1.30 128 XM_GoogleGroups 5154 1.10 0.56 1.28 129 XMSubNoVowel 4974 1.09 0.67 1.24 130 XM_H_Long_From02 4956 1.20 1.11 1.23 131 XMStockSpam_06 4943 1.36 1.77 1.23 132 XM_UB50 4742 2.25 5.41 1.18 133 XMGappySubj_01 4699 0.90 0.10 1.17 134 RELAYCOUNTRY_CA 4651 2.03 4.59 1.16 135 TooManyTo_004 4548 0.98 0.54 1.13 136 TM2_M_VERY_LONG_WORD 4471 1.50 2.63 1.11 137 XMHTML_After_End 4469 1.09 1.04 1.11 138 RELAYCOUNTRY_GB 4466 1.41 2.30 1.11 139 URI_TRY_3LD 4096 1.07 1.23 1.02 140 HTML_FONT_FACE_BAD 4092 0.98 0.86 1.02 141 TR_MetaPhish_Combo_01 3872 0.99 1.07 0.96 142 XMBrknScrpt_02 3805 1.13 1.67 0.95 143 TooManyTo_005 3802 0.83 0.48 0.94 144 T_FILL_THIS_FORM_SHORT 3673 1.20 2.03 0.91 145 XM_OfRef6 3638 1.60 3.65 0.90 146 DKIM_ADSP_CUSTOM_MED 3601 1.01 1.34 0.89 147 XM_B_COVIDMETA 3497 1.42 3.05 0.87 148 XMBSHREFv2 3388 0.70 0.30 0.84 149 RCVD_IN_BL_SPAMCOP_NET 3374 2.61 7.82 0.84 150 HTML_IMAGE_ONLY_20 3347 0.71 0.34 0.83 151 T_XMDrugObfuBody_00 3231 1.02 1.66 0.80 152 SpammyFromTLD_01 3186 2.39 7.08 0.79 153 XMBody_95 3178 0.63 0.17 0.79 154 XMNoVowels 3156 0.77 0.74 0.78 155 XMGenDplmaNmb 3134 1.16 2.29 0.78 156 HTTPS_HTTP_MISMATCH 3111 0.89 1.25 0.77 157 T_TooManySym_03 3032 0.64 0.30 0.75 158 T_OBFU_PDF_ATTACH 3029 0.62 0.23 0.75 159 RCVD_IN_SORBS_DUL 2818 0.60 0.32 0.70 160 XMBdyGiftCard01 2779 0.81 1.16 0.69 161 T_Symld_Words_02 2728 0.80 1.16 0.68 162 XM_SPF_Unknown 2660 0.67 0.71 0.66 163 XM_RXBody 2599 0.55 0.27 0.65 164 XM_ShortIntro_01 2512 0.63 0.63 0.62 165 XM_H_PHPMailer 2484 0.70 0.93 0.62 166 NML_ADSP_CUSTOM_MED 2451 0.74 1.14 0.61 167 TR_MSPIKEBAYES00 2437 0.46 0.03 0.61 168 MSGID_NOFQDN1 2437 0.46 0.03 0.61 169 HTML_TAG_BALANCE_BODY 2411 0.63 0.74 0.60 170 XM_ProductURIs 2349 0.61 0.69 0.58 171 XMLngstWrd_00 2317 0.54 0.43 0.58 172 SHORT_HELO_AND_INLINE_IMAGE 2301 0.46 0.14 0.57 173 XMMoneyMeta_00 2276 0.91 1.93 0.57 174 FROM_GOV_SPOOF 2144 0.44 0.17 0.53 175 XMLngstWrd_01 2109 0.48 0.36 0.52 176 XM_B_COPY_HTML 2085 0.53 0.55 0.52 177 XM_B_REG_HTML 2083 0.54 0.61 0.52 178 TM2_M_BODY_EMPTY 2056 0.59 0.84 0.51 179 XMHTMLBadTable_001 2033 0.61 0.93 0.50 180 XMPhish30 2002 0.60 0.91 0.50 181 MISSING_HEADERS 1943 0.50 0.54 0.48 182 FORGED_GMAIL_RCVD 1876 0.66 1.24 0.47 183 XMSubMetaI_00 1854 0.59 0.96 0.46 184 XMLngstWrd_02 1836 0.42 0.31 0.46 185 TVD_SPACE_RATIO_MINFP 1822 0.45 0.44 0.45 186 XMSexyCombo_01 1819 0.79 1.79 0.45 187 FROM_GOV_DKIM_AU 1799 0.38 0.20 0.45 188 RELAYCOUNTRY_DE 1773 0.59 1.01 0.44 189 DKIM_ADSP_NXDOMAIN 1747 0.53 0.79 0.43 190 T_XMHurry_00 1745 0.62 1.16 0.43 191 RDNS_DYNAMIC 1745 0.49 0.66 0.43 192 XMDateMe_00 1739 0.47 0.58 0.43 193 XM_DIRTYINTL 1717 1.07 2.98 0.43 194 HTML_IMAGE_ONLY_32 1673 0.38 0.29 0.42 195 XMSubMetaSxObfu_03 1657 0.45 0.55 0.41 196 TVD_SPACE_RATIO 1652 0.34 0.15 0.41 197 NO_DNS_FOR_FROM 1645 0.52 0.85 0.41 198 HTML_IMAGE_ONLY_24 1644 0.36 0.23 0.41 199 XMPhish14 1639 0.52 0.85 0.41 200 XM_B_SpammyWords4 1613 0.93 2.48 0.40 ----------------------------------------------------------------------