Email: 587113 Autolearn: 0 AvgScore: 0.17 AvgScanTime: 1.42 sec Spam: 129823 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 2.10 sec Ham: 457290 Autolearn: 0 AvgScore: -3.87 AvgScanTime: 1.22 sec Time Spent Running SA: 230.80 hours Time Spent Processing Spam: 75.64 hours Time Spent Processing Ham: 155.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125412 90.55 96.60 88.84 2 DKIM_SIGNED 108173 65.05 83.32 59.86 3 DCC_CHECK 102556 43.13 79.00 32.94 4 XM_DK_Pass 102483 62.88 78.94 58.32 5 RELAYCOUNTRY_US 100533 78.54 77.44 78.85 6 DKIM_VALID 99793 61.03 76.87 56.54 7 XM_B_Unicode 98254 73.47 75.68 72.85 8 XMListUnsubscribeExists 90840 44.59 69.97 37.38 9 XM_B_SpammyWords 87986 49.74 67.77 44.62 10 DKIM_VALID_AU 73169 44.78 56.36 41.49 11 BAYES_50 55610 48.54 42.84 50.16 12 XM_DK_Undo_02 53883 13.90 41.50 6.06 13 XM_B_Unicode3 53118 41.94 40.92 42.24 14 XM_B_SpammyWords2 48933 22.80 37.69 18.58 15 LOC_TINY_FONT_1 46608 22.03 35.90 18.09 16 TR_XM_DKIM_Undo 43635 10.90 33.61 4.45 17 HTML_FONT_LOW_CONTRAST 42771 24.11 32.95 21.60 18 MIME_HTML_ONLY 41406 25.15 31.89 23.24 19 T_KAM_HTML_FONT_INVALID 40689 17.80 31.34 13.95 20 BAYES_99 39851 10.36 30.70 4.58 21 DKIM_VALID_EF 39006 24.12 30.05 22.43 22 RCVD_IN_MSPIKE_H2 36860 22.57 28.39 20.92 23 FVGT_m_MULTI_ODD 36003 20.57 27.73 18.53 24 XMSubLong 33377 21.32 25.71 20.08 25 TR_DCC_Bayes_99 31006 6.94 23.88 2.13 26 BAYES_999 30780 8.11 23.71 3.68 27 T_TM2_M_HEADER_IN_MSG 27766 28.03 21.39 29.92 28 DCC_CHECK_NEGATIVE 27200 56.84 20.95 67.02 29 XM_Body_Dirty_Words 27181 12.29 20.94 9.83 30 RELAYCOUNTRY_META 26176 7.85 20.16 4.35 31 RCVD_IN_MSPIKE_WL 26126 22.78 20.12 23.54 32 XM_Multi_Part_URI 20933 10.54 16.12 8.96 33 UNTRUSTED_Relay 20724 4.85 15.96 1.70 34 BOTNET 20253 4.40 15.60 1.22 35 LOTS_OF_MONEY 19545 9.69 15.06 8.17 36 FSL_BULK_SIG 19295 9.16 14.86 7.55 37 XM_UncommonTLD01 19157 5.52 14.76 2.90 38 BOTNET_IPINHOSTNAME 17288 5.71 13.32 3.55 39 XM_B_SpammyWords3 16262 5.56 12.53 3.58 40 TR_XM_SpammyWords4 15750 7.14 12.13 5.73 41 XM_B_Unsub 14852 9.33 11.44 8.73 42 RCVD_IN_MSPIKE_H3 14079 12.24 10.84 12.63 43 SpammyFromTLD_02 13442 2.54 10.35 0.32 44 UNPARSEABLE_RELAY 12878 7.26 9.92 6.51 45 XMSexyCombo_05 12834 4.88 9.89 3.45 46 TR_XM_SpammyWords2 12769 2.80 9.84 0.80 47 TR_XM_UnparsRelay 12376 5.95 9.53 4.93 48 MPART_ALT_DIFF 12310 9.85 9.48 9.96 49 XM_Evil_Numbers_Gen 12163 8.59 9.37 8.37 50 T_REMOTE_IMAGE 10944 4.35 8.43 3.19 51 XM_B_Phish_Phrases 10837 4.18 8.35 2.99 52 RCVD_IN_MSPIKE_H4 10729 8.69 8.26 8.81 53 LotsOfNums_01 10386 7.82 8.00 7.77 54 XM_SendGrid 10146 6.26 7.82 5.82 55 BAYES_80 9981 4.35 7.69 3.40 56 HTML_MIME_NO_HTML_TAG 9772 3.54 7.53 2.41 57 BAYES_60 9425 7.10 7.26 7.06 58 XM_UB50 9326 2.48 7.18 1.14 59 HTML_IMAGE_RATIO_02 9276 5.17 7.15 4.61 60 TR_XM_PhishingBody 8889 3.86 6.85 3.01 61 XM_B_SpammyTLD 8829 3.01 6.80 1.93 62 RCVD_IN_BL_SPAMCOP_NET 8651 2.03 6.66 0.71 63 XMSubMetaSx_00 8600 3.80 6.62 3.00 64 T_HTML_TAG_BALANCE_CENTER 8520 1.52 6.56 0.09 65 TooManyTo_001 8417 7.32 6.48 7.56 66 DKIM_INVALID 8380 4.02 6.45 3.32 67 KHOP_HELO_FCRDNS 8210 2.93 6.32 1.97 68 MIME_HTML_MOSTLY 7844 2.96 6.04 2.08 69 HTML_IMAGE_ONLY_08 7792 1.39 6.00 0.08 70 XMNumbers 7460 3.33 5.75 2.64 71 XM_H_Long_From01 7216 4.41 5.56 4.09 72 RCVD_IN_MSPIKE_BL 6829 1.41 5.26 0.32 73 TR_XM_MSPIKECOMBO 6753 1.38 5.20 0.29 74 HTML_IMAGE_RATIO_04 6569 14.25 5.06 16.86 75 URI_NOVOWEL 6362 2.80 4.90 2.20 76 MIXED_CENTER_CASE 6359 1.08 4.90 0.00 77 MIXED_HREF_CASE 6355 1.08 4.90 0.00 78 MIXED_FONT_CASE 6341 1.08 4.88 0.00 79 MIXED_AREA_CASE 6337 1.08 4.88 0.00 80 PDS_OTHER_BAD_TLD 6098 1.13 4.70 0.12 81 BODY_URI_ONLY 6090 1.05 4.69 0.01 82 MIXED_IMG_CASE 5995 1.02 4.62 0.00 83 BOTNET_NORDNS 5944 1.03 4.58 0.02 84 TR_XM_SpammyWords5 5658 1.97 4.36 1.29 85 RELAYCOUNTRY_CA 5640 1.65 4.34 0.89 86 TR_XM_SPAMCOP 5613 1.24 4.32 0.37 87 BAYES_95 5556 2.50 4.28 2.00 88 MIME_QP_LONG_LINE 5532 4.36 4.26 4.39 89 MIME_HTML_ONLY_MULTI 5413 7.47 4.17 8.41 90 TM2_M_URI_OPT_OUT 5368 3.03 4.13 2.72 91 XM_SPF_SoftFail 5351 2.64 4.12 2.21 92 XM_B_Phish66 5308 2.33 4.09 1.82 93 TR_XM_DK_SendGrid 5093 3.36 3.92 3.20 94 TR_XM_SB_Phish 5061 2.40 3.90 1.98 95 RCVD_IN_MSPIKE_L5 4942 0.90 3.81 0.08 96 XMSubPhish11 4806 2.34 3.70 1.95 97 TR_XM_SpammyWords3 4747 0.96 3.66 0.19 98 HTML_IMAGE_RATIO_06 4628 4.90 3.56 5.28 99 RCVD_IN_RP_SAFE 4553 5.20 3.51 5.68 100 URI_GOOG_STO_SPAMMY 4528 0.77 3.49 0.00 101 HTML_FONT_SIZE_LARGE 4470 0.81 3.44 0.07 102 URIBL_DBL_SPAM 4239 0.74 3.27 0.02 103 SpammyFromTLD_01 4177 1.28 3.22 0.73 104 XMStrtUSub 4152 9.25 3.20 10.96 105 HTML_FONT_SIZE_HUGE 4083 0.74 3.15 0.05 106 RCVD_IN_IADB_LISTED 4008 4.27 3.09 4.60 107 XM_B_COVIDMETA 3947 1.24 3.04 0.72 108 T_XMHurry_00 3903 3.63 3.01 3.80 109 XM_OfRef6 3832 1.28 2.95 0.81 110 T_XMDrugObfuBody_14 3827 2.02 2.95 1.76 111 T_XMDrugObfuBody_08 3787 1.76 2.92 1.43 112 RCVD_IN_RP_CERTIFIED 3658 4.54 2.82 5.03 113 RCVD_IN_IADB_SPF 3617 3.78 2.79 4.07 114 XM_DIRTYINTL 3616 1.09 2.79 0.61 115 T_TooManySym_01 3492 4.35 2.69 4.82 116 GOOG_STO_IMG_HTML 3459 0.59 2.66 0.00 117 BAYES_40 3451 5.06 2.66 5.74 118 XMBody_17 3398 0.88 2.62 0.39 119 RCVD_IN_IADB_DK 3395 3.37 2.62 3.58 120 RCVD_IN_IADB_SENDERID 3388 3.43 2.61 3.66 121 URI_PHP_REDIR 3321 0.57 2.56 0.00 122 JH_SPAMMY_HEADERS 3283 0.57 2.53 0.01 123 XM_CamelCaseFrm001 3239 1.62 2.49 1.37 124 XMDiploma_00 3236 1.41 2.49 1.10 125 XM_UB99 3147 0.54 2.42 0.01 126 XMStockSpam_06 3127 1.57 2.41 1.33 127 MAILING_LIST_MULTI 3093 2.66 2.38 2.74 128 US_DOLLARS_3 3092 1.23 2.38 0.91 129 TM2_M_VERY_LONG_WORD 3061 1.32 2.36 1.03 130 XM_DK_Undo_01 3054 1.65 2.35 1.45 131 XM_B_Unsub2 3022 1.73 2.33 1.56 132 URI_TRY_3LD 2905 1.13 2.24 0.82 133 HTML_IMAGE_RATIO_08 2890 1.88 2.23 1.78 134 URI_HEX 2881 1.47 2.22 1.26 135 XM_URI_RBL 2783 0.57 2.14 0.12 136 XM_UB60 2744 0.53 2.11 0.09 137 TR_XM_COVIDMETA4 2667 0.84 2.05 0.50 138 RELAYCOUNTRY_IN 2651 0.53 2.04 0.10 139 BAYES_20 2650 4.80 2.04 5.58 140 TR_XM_PHPDW 2571 0.61 1.98 0.23 141 RELAYCOUNTRY_DE 2563 1.10 1.97 0.86 142 XM_B_SpammyWords4 2540 0.67 1.96 0.30 143 DIET_1 2517 0.68 1.94 0.32 144 XMSexyCombo_01 2508 0.83 1.93 0.52 145 TR_LOTS_OF_MONEY3 2480 0.60 1.91 0.23 146 XM_UB80 2450 0.44 1.89 0.03 147 FROM_SUSPICIOUS_NTLD 2426 0.44 1.87 0.04 148 T_XMDrugObfuBody_00 2381 0.80 1.83 0.51 149 FROM_SUSPICIOUS_NTLD_FP 2336 0.42 1.80 0.03 150 TR_XM_PHPForged 2332 0.55 1.80 0.19 151 TR_XM_FormFill2 2317 0.54 1.78 0.19 152 TR_XM_COVIDMETA1 2307 0.63 1.78 0.30 153 XM_H_PHPOS 2291 0.54 1.76 0.19 154 RCVD_IN_RP_RNBL 2249 0.41 1.73 0.03 155 FROM_EXCESS_BASE64 2245 2.10 1.73 2.21 156 XMGenDplmaNmb 2123 0.90 1.64 0.69 157 URIBL_BLACK 2041 0.37 1.57 0.03 158 XM_UB999 2038 0.35 1.57 0.00 159 ALL_TRUSTED 2013 14.57 1.55 18.26 160 XMSlimDrugH 2007 0.49 1.55 0.20 161 TR_MetaPhish_Combo_01 1963 0.82 1.51 0.62 162 SUBJ_ALL_CAPS 1952 1.38 1.50 1.35 163 RELAYCOUNTRY_NL 1918 0.47 1.48 0.18 164 XMBrknScrpt_02 1869 0.99 1.44 0.86 165 BAYES_00 1861 14.07 1.43 17.66 166 T_FILL_THIS_FORM_SHORT 1819 0.86 1.40 0.70 167 HTTPS_HTTP_MISMATCH 1815 0.86 1.40 0.70 168 RCVD_IN_IADB_VOUCHED 1745 2.36 1.34 2.65 169 XMHTML_After_End 1740 1.00 1.34 0.90 170 TR_XM_BayesRelay 1684 0.29 1.30 0.01 171 URIBL_SBL_A 1648 0.35 1.27 0.09 172 XMPhish30 1615 0.69 1.24 0.54 173 TM2_M_A_HREF_HREF 1614 0.55 1.24 0.36 174 RELAYCOUNTRY_FR 1594 0.63 1.23 0.46 175 TR_XM_INV_DKIM 1547 0.31 1.19 0.06 176 TR_Symld_Words 1537 1.86 1.18 2.05 177 RCVD_IN_PSBL 1529 0.35 1.18 0.12 178 XM_H_Long_From02 1524 0.90 1.17 0.82 179 XMMoneyMeta_00 1496 0.65 1.15 0.51 180 XM_PDF 1493 3.66 1.15 4.37 181 XMNoVowels 1493 0.91 1.15 0.84 182 DATE_IN_PAST_12_24 1488 0.28 1.15 0.03 183 RELAYCOUNTRY_GB 1475 1.15 1.14 1.15 184 TooManyTo_002 1474 1.88 1.14 2.09 185 MPART_ALT_DIFF_COUNT 1473 0.49 1.13 0.31 186 BAYES_05 1429 3.22 1.10 3.82 187 XM_H_TOP 1416 0.24 1.09 0.00 188 XM_Body_Dirty_Words_01 1395 0.34 1.07 0.13 189 TR_M_TOP_BAYES 1342 0.23 1.03 0.00 190 RELAYCOUNTRY_CH 1341 0.26 1.03 0.04 191 XMBdyGiftCard01 1334 0.71 1.03 0.62 192 XM_JunkDunk 1325 0.23 1.02 0.00 193 RELAYCOUNTRY_IR 1319 0.23 1.02 0.00 194 RCVD_IN_MSPIKE_H5 1318 1.85 1.02 2.09 195 XM_SPF_Unknown 1314 0.70 1.01 0.61 196 USER_IN_DEF_DKIM_WL 1305 7.55 1.01 9.41 197 XM_H_PHPMailer 1301 0.64 1.00 0.54 198 XM_B_SEO 1284 0.31 0.99 0.12 199 RCVD_IN_MSPIKE_L3 1277 0.29 0.98 0.09 200 TooManyTo_003 1242 1.29 0.96 1.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 406243 90.55 96.60 88.84 2 RELAYCOUNTRY_US 360583 78.54 77.44 78.85 3 XM_B_Unicode 333115 73.47 75.68 72.85 4 DCC_CHECK_NEGATIVE 306490 56.84 20.95 67.02 5 DKIM_SIGNED 273725 65.05 83.32 59.86 6 XM_DK_Pass 266697 62.88 78.94 58.32 7 DKIM_VALID 258531 61.03 76.87 56.54 8 BAYES_50 229391 48.54 42.84 50.16 9 XM_B_SpammyWords 204062 49.74 67.77 44.62 10 XM_B_Unicode3 193137 41.94 40.92 42.24 11 DKIM_VALID_AU 189746 44.78 56.36 41.49 12 XMListUnsubscribeExists 170926 44.59 69.97 37.38 13 DCC_CHECK 150649 43.13 79.00 32.94 14 T_TM2_M_HEADER_IN_MSG 136804 28.03 21.39 29.92 15 RCVD_IN_MSPIKE_WL 107635 22.78 20.12 23.54 16 MIME_HTML_ONLY 106279 25.15 31.89 23.24 17 DKIM_VALID_EF 102589 24.12 30.05 22.43 18 HTML_FONT_LOW_CONTRAST 98761 24.11 32.95 21.60 19 RCVD_IN_MSPIKE_H2 95671 22.57 28.39 20.92 20 XMSubLong 91806 21.32 25.71 20.08 21 XM_B_SpammyWords2 84951 22.80 37.69 18.58 22 FVGT_m_MULTI_ODD 84740 20.57 27.73 18.53 23 ALL_TRUSTED 83514 14.57 1.55 18.26 24 LOC_TINY_FONT_1 82708 22.03 35.90 18.09 25 BAYES_00 80755 14.07 1.43 17.66 26 HTML_IMAGE_RATIO_04 77113 14.25 5.06 16.86 27 XM_H_Trusted_IP 73566 12.53 0.00 16.09 28 HTML_FONT_FACE_BAD 68167 11.78 0.76 14.91 29 T_KAM_HTML_FONT_INVALID 63804 17.80 31.34 13.95 30 RCVD_IN_MSPIKE_H3 57769 12.24 10.84 12.63 31 XMStrtUSub 50136 9.25 3.20 10.96 32 MPART_ALT_DIFF 45549 9.85 9.48 9.96 33 XM_Body_Dirty_Words 44970 12.29 20.94 9.83 34 USER_IN_DEF_DKIM_WL 43013 7.55 1.01 9.41 35 XM_Multi_Part_URI 40956 10.54 16.12 8.96 36 RCVD_IN_MSPIKE_H4 40306 8.69 8.26 8.81 37 XM_B_Unsub 39940 9.33 11.44 8.73 38 MIME_HTML_ONLY_MULTI 38441 7.47 4.17 8.41 39 XM_Evil_Numbers_Gen 38272 8.59 9.37 8.37 40 LOTS_OF_MONEY 37355 9.69 15.06 8.17 41 LotsOfNums_01 35533 7.82 8.00 7.77 42 TooManyTo_001 34565 7.32 6.48 7.56 43 FSL_BULK_SIG 34513 9.16 14.86 7.55 44 BAYES_60 32262 7.10 7.26 7.06 45 TR_XM_DK_Bayes 30354 5.36 0.84 6.64 46 XM_DKIMWhitelistDomains 29825 5.10 0.08 6.52 47 UNPARSEABLE_RELAY 29766 7.26 9.92 6.51 48 TR_XM_DK_Bayes1 29209 5.15 0.81 6.39 49 XM_DK_Undo_02 27719 13.90 41.50 6.06 50 XM_SendGrid 26597 6.26 7.82 5.82 51 BAYES_40 26268 5.06 2.66 5.74 52 TR_XM_SpammyWords4 26192 7.14 12.13 5.73 53 RCVD_IN_RP_SAFE 25956 5.20 3.51 5.68 54 BAYES_20 25520 4.80 2.04 5.58 55 TR_XM_DK_Bayes2 24291 4.30 0.72 5.31 56 HTML_IMAGE_RATIO_06 24153 4.90 3.56 5.28 57 RCVD_IN_RP_CERTIFIED 23013 4.54 2.82 5.03 58 XMSubNoVowel 22694 3.98 0.50 4.96 59 TR_XM_UnparsRelay 22531 5.95 9.53 4.93 60 T_TooManySym_01 22054 4.35 2.69 4.82 61 IN_ZIMBRA_NJ_WHITELIST 21354 3.65 0.04 4.67 62 HTML_IMAGE_RATIO_02 21092 5.17 7.15 4.61 63 RCVD_IN_IADB_LISTED 21051 4.27 3.09 4.60 64 BAYES_99 20949 10.36 30.70 4.58 65 TR_XM_DKIM_Undo 20342 10.90 33.61 4.45 66 MIME_QP_LONG_LINE 20055 4.36 4.26 4.39 67 XM_PDF 20000 3.66 1.15 4.37 68 RELAYCOUNTRY_META 19887 7.85 20.16 4.35 69 XM_H_Long_From01 18689 4.41 5.56 4.09 70 RCVD_IN_IADB_SPF 18599 3.78 2.79 4.07 71 BAYES_05 17461 3.22 1.10 3.82 72 T_XMHurry_00 17389 3.63 3.01 3.80 73 BAYES_999 16849 8.11 23.71 3.68 74 RCVD_IN_IADB_SENDERID 16754 3.43 2.61 3.66 75 XM_B_SpammyWords3 16386 5.56 12.53 3.58 76 BOUNCE_MESSAGE 16379 2.95 0.71 3.58 77 ANY_BOUNCE_MESSAGE 16379 2.95 0.71 3.58 78 RCVD_IN_IADB_DK 16368 3.37 2.62 3.58 79 BOTNET_IPINHOSTNAME 16221 5.71 13.32 3.55 80 XMSexyCombo_05 15799 4.88 9.89 3.45 81 BAYES_80 15547 4.35 7.69 3.40 82 DKIM_INVALID 15194 4.02 6.45 3.32 83 TR_XM_DK_SendGrid 14629 3.36 3.92 3.20 84 T_REMOTE_IMAGE 14580 4.35 8.43 3.19 85 TR_XM_PhishingBody 13780 3.86 6.85 3.01 86 XMSubMetaSx_00 13723 3.80 6.62 3.00 87 XM_B_Phish_Phrases 13682 4.18 8.35 2.99 88 XM_UncommonTLD01 13261 5.52 14.76 2.90 89 MAILING_LIST_MULTI 12544 2.66 2.38 2.74 90 TM2_M_URI_OPT_OUT 12443 3.03 4.13 2.72 91 RCVD_IN_IADB_VOUCHED 12098 2.36 1.34 2.65 92 XMNumbers 12094 3.33 5.75 2.64 93 HTML_MIME_NO_HTML_TAG 11004 3.54 7.53 2.41 94 T_TooManySym_02 10925 2.04 0.81 2.39 95 XM_SPF_SoftFail 10125 2.64 4.12 2.21 96 FROM_EXCESS_BASE64 10102 2.10 1.73 2.21 97 URI_NOVOWEL 10064 2.80 4.90 2.20 98 TR_DCC_Bayes_99 9728 6.94 23.88 2.13 99 TooManyTo_002 9571 1.88 1.14 2.09 100 RCVD_IN_MSPIKE_H5 9560 1.85 1.02 2.09 101 MIME_HTML_MOSTLY 9528 2.96 6.04 2.08 102 TR_Symld_Words 9363 1.86 1.18 2.05 103 BAYES_95 9130 2.50 4.28 2.00 104 TR_XM_SB_Phish 9053 2.40 3.90 1.98 105 KHOP_HELO_FCRDNS 9017 2.93 6.32 1.97 106 XMSubPhish11 8916 2.34 3.70 1.95 107 XM_B_SpammyTLD 8830 3.01 6.80 1.93 108 TVD_RCVD_IP 8614 1.51 0.21 1.88 109 XMSubGarbage 8600 1.47 0.04 1.88 110 XMSubLongNoVowel 8380 1.47 0.18 1.83 111 XM_B_Phish66 8343 2.33 4.09 1.82 112 HTML_IMAGE_RATIO_08 8152 1.88 2.23 1.78 113 T_XMDrugObfuBody_14 8028 2.02 2.95 1.76 114 RCVD_IN_IADB_OPTIN 7851 1.55 0.96 1.72 115 UNTRUSTED_Relay 7752 4.85 15.96 1.70 116 HELO_NODOT 7665 1.44 0.60 1.68 117 HELO_NO_DOMAIN 7665 1.44 0.60 1.68 118 IN_HORDE_ADDRESS_BOOK 7313 1.27 0.10 1.60 119 INVALID_MSGID 7157 1.27 0.22 1.57 120 XM_B_Unsub2 7135 1.73 2.33 1.56 121 XM_DK_Undo_01 6640 1.65 2.35 1.45 122 MSGID_NOFQDN1 6640 1.14 0.05 1.45 123 T_XMDrugObfuBody_08 6526 1.76 2.92 1.43 124 TO_MALFORMED 6357 1.08 0.00 1.39 125 TooManyTo_003 6343 1.29 0.96 1.39 126 XM_CamelCaseFrm001 6262 1.62 2.49 1.37 127 SUBJ_ALL_CAPS 6160 1.38 1.50 1.35 128 XMStockSpam_06 6077 1.57 2.41 1.33 129 TR_XM_SpammyWords5 5918 1.97 4.36 1.29 130 URI_HEX 5747 1.47 2.22 1.26 131 XMCapTrack 5588 1.10 0.67 1.22 132 BOTNET 5574 4.40 15.60 1.22 133 XM_E_Blogspot 5385 0.93 0.06 1.18 134 RELAYCOUNTRY_GB 5279 1.15 1.14 1.15 135 XM_UB50 5209 2.48 7.18 1.14 136 XMDiploma_00 5050 1.41 2.49 1.10 137 XMGappySubj_01 4713 0.83 0.12 1.03 138 TM2_M_VERY_LONG_WORD 4695 1.32 2.36 1.03 139 XM_GoogleGroups 4650 0.94 0.67 1.02 140 TooManyTo_004 4534 0.94 0.78 0.99 141 US_DOLLARS_3 4149 1.23 2.38 0.91 142 XMHTML_After_End 4102 1.00 1.34 0.90 143 RELAYCOUNTRY_CA 4058 1.65 4.34 0.89 144 T_TooManySym_03 4014 0.74 0.24 0.88 145 XMBrknScrpt_02 3926 0.99 1.44 0.86 146 RELAYCOUNTRY_DE 3922 1.10 1.97 0.86 147 XMNoVowels 3824 0.91 1.15 0.84 148 XM_H_Long_From02 3748 0.90 1.17 0.82 149 URI_TRY_3LD 3745 1.13 2.24 0.82 150 TooManyTo_005 3721 0.79 0.72 0.81 151 XM_OfRef6 3684 1.28 2.95 0.81 152 TR_XM_SpammyWords2 3650 2.80 9.84 0.80 153 XMBSHREFv2 3413 0.64 0.27 0.75 154 SpammyFromTLD_01 3351 1.28 3.22 0.73 155 XM_B_COVIDMETA 3307 1.24 3.04 0.72 156 DKIM_ADSP_CUSTOM_MED 3305 0.73 0.75 0.72 157 HTML_IMAGE_ONLY_20 3252 0.70 0.66 0.71 158 RCVD_IN_BL_SPAMCOP_NET 3251 2.03 6.66 0.71 159 T_FILL_THIS_FORM_SHORT 3223 0.86 1.40 0.70 160 HTTPS_HTTP_MISMATCH 3220 0.86 1.40 0.70 161 XMGenDplmaNmb 3143 0.90 1.64 0.69 162 MSGID_FROM_MTA_HEADER 2996 0.59 0.34 0.66 163 TR_MetaPhish_Combo_01 2837 0.82 1.51 0.62 164 XMBdyGiftCard01 2824 0.71 1.03 0.62 165 XM_shorewaves_Whitelist 2823 0.48 0.00 0.62 166 XMBody_95 2812 0.53 0.23 0.61 167 XM_DIRTYINTL 2798 1.09 2.79 0.61 168 XM_SPF_Unknown 2775 0.70 1.01 0.61 169 XM_H_UTAHEDU_HELP 2735 0.58 0.51 0.60 170 XMSubMetaSxObfu_03 2724 0.60 0.62 0.60 171 RCVD_IN_SORBS_DUL 2666 0.50 0.21 0.58 172 TR_MSPIKEBAYES00 2520 0.43 0.01 0.55 173 T_OBFU_PDF_ATTACH 2517 0.47 0.19 0.55 174 XM_H_PHPMailer 2475 0.64 1.00 0.54 175 XMPhish30 2464 0.69 1.24 0.54 176 XMSexyCombo_01 2389 0.83 1.93 0.52 177 XM_ShortIntro_01 2358 0.59 0.85 0.52 178 T_XMDrugObfuBody_00 2340 0.80 1.83 0.51 179 XM_B_COPY_HTML 2310 0.53 0.61 0.51 180 XMMoneyMeta_00 2310 0.65 1.15 0.51 181 TR_XM_COVIDMETA4 2264 0.84 2.05 0.50 182 SHORT_HELO_AND_INLINE_IMAGE 2201 0.40 0.09 0.48 183 NML_ADSP_CUSTOM_MED 2176 0.49 0.54 0.48 184 XM_ProductURIs 2121 0.53 0.75 0.46 185 URI_DOTEDU 2104 0.37 0.04 0.46 186 XMLngstWrd_00 2093 0.44 0.39 0.46 187 RELAYCOUNTRY_FR 2084 0.63 1.23 0.46 188 XM_B_REG_HTML 2060 0.47 0.52 0.45 189 FROM_GOV_SPOOF 2011 0.40 0.25 0.44 190 XMHTMLBadTable_001 1998 0.50 0.72 0.44 191 TM2_M_BODY_EMPTY 1914 0.35 0.10 0.42 192 XMLngstWrd_01 1873 0.40 0.37 0.41 193 MISSING_HEADERS 1862 0.43 0.52 0.41 194 XMPhish14 1852 0.45 0.62 0.40 195 XMBody_17 1788 0.88 2.62 0.39 196 XMSolicitRefs_0 1738 0.40 0.47 0.38 197 TVD_SPACE_RATIO 1735 0.41 0.50 0.38 198 HTML_TAG_BALANCE_BODY 1695 0.43 0.66 0.37 199 TR_XM_SPAMCOP 1690 1.24 4.32 0.37 200 MY_SERVERS_FOUND 1682 0.33 0.18 0.37 ----------------------------------------------------------------------