Email: 547060 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 1.33 sec Spam: 133891 Autolearn: 0 AvgScore: 14.09 AvgScanTime: 1.61 sec Ham: 413169 Autolearn: 0 AvgScore: -0.46 AvgScanTime: 1.24 sec Time Spent Running SA: 201.87 hours Time Spent Processing Spam: 60.04 hours Time Spent Processing Ham: 141.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128547 84.06 96.01 80.19 2 DKIM_SIGNED 107379 71.93 80.20 69.25 3 XM_DK_Pass 103881 69.29 77.59 66.60 4 DCC_CHECK 103183 45.37 77.06 35.10 5 RELAYCOUNTRY_US 102991 73.33 76.92 72.16 6 DKIM_VALID 100481 66.67 75.05 63.96 7 XM_B_Unicode 99978 70.12 74.67 68.65 8 XMListUnsubscribeExists 88148 47.44 65.84 41.48 9 XM_B_SpammyWords 87254 46.14 65.17 39.98 10 DKIM_VALID_AU 73837 50.24 55.15 48.65 11 BAYES_50 59454 51.19 44.40 53.38 12 XM_B_Unicode3 55516 37.65 41.46 36.41 13 XM_DK_Undo_02 51982 13.93 38.82 5.86 14 XM_B_SpammyWords2 49057 22.42 36.64 17.81 15 HTML_FONT_LOW_CONTRAST 47338 25.72 35.36 22.59 16 LOC_TINY_FONT_1 45585 23.22 34.05 19.71 17 MIME_HTML_ONLY 45021 21.96 33.63 18.18 18 TR_XM_DKIM_Undo 41409 10.78 30.93 4.24 19 RCVD_IN_MSPIKE_H2 40826 25.01 30.49 23.24 20 DKIM_VALID_EF 40654 25.67 30.36 24.15 21 T_KAM_HTML_FONT_INVALID 38821 19.36 28.99 16.23 22 BAYES_99 36516 10.87 27.27 5.55 23 XMSubLong 36231 21.06 27.06 19.11 24 FVGT_m_MULTI_ODD 34532 21.22 25.79 19.74 25 DCC_CHECK_NEGATIVE 30657 54.58 22.90 64.85 26 T_TM2_M_HEADER_IN_MSG 29936 31.43 22.36 34.37 27 BAYES_999 27905 8.68 20.84 4.74 28 TR_DCC_Bayes_99 27420 6.61 20.48 2.12 29 XM_Body_Dirty_Words 27263 15.51 20.36 13.94 30 RELAYCOUNTRY_META 27222 11.32 20.33 8.40 31 RCVD_IN_MSPIKE_WL 25013 23.25 18.68 24.73 32 FSL_BULK_SIG 23412 9.98 17.49 7.54 33 XM_UncommonTLD01 21038 6.24 15.71 3.17 34 XM_Multi_Part_URI 20577 11.10 15.37 9.72 35 UNTRUSTED_Relay 19761 8.04 14.76 5.86 36 LOTS_OF_MONEY 18142 8.59 13.55 6.98 37 BOTNET_IPINHOSTNAME 17678 6.01 13.20 3.68 38 XM_B_SpammyWords3 16583 5.56 12.39 3.35 39 XM_B_Unsub 16406 9.54 12.25 8.66 40 TR_XM_SpammyRelay 16019 4.22 11.96 1.71 41 UNPARSEABLE_RELAY 15875 8.50 11.86 7.41 42 BOTNET 15836 3.85 11.83 1.26 43 TR_XM_UnparsRelay 15173 7.03 11.33 5.64 44 TR_XM_SpammyWords4 14729 5.93 11.00 4.28 45 SpammyFromTLD_02 14685 2.92 10.97 0.31 46 RCVD_IN_MSPIKE_H3 13662 12.24 10.20 12.90 47 XMSexyCombo_05 13542 7.94 10.11 7.23 48 TR_XM_SpammyWords2 13204 3.01 9.86 0.78 49 RCVD_IN_BL_SPAMCOP_NET 12453 2.77 9.30 0.66 50 XM_Evil_Numbers_Gen 12178 7.29 9.10 6.70 51 T_REMOTE_IMAGE 12002 4.89 8.96 3.56 52 XM_SendGrid 11725 7.05 8.76 6.49 53 HTML_MIME_NO_HTML_TAG 11174 3.84 8.35 2.37 54 MPART_ALT_DIFF 10978 5.12 8.20 4.12 55 HTML_IMAGE_RATIO_02 10747 5.67 8.03 4.91 56 KHOP_HELO_FCRDNS 10687 3.17 7.98 1.61 57 BAYES_80 10415 4.75 7.78 3.77 58 RCVD_IN_MSPIKE_H4 10209 9.06 7.62 9.52 59 BAYES_60 10101 7.35 7.54 7.29 60 LotsOfNums_01 9933 7.90 7.42 8.06 61 XM_B_Phish_Phrases 9457 4.03 7.06 3.04 62 TooManyTo_001 9251 7.71 6.91 7.97 63 TR_XM_PhishingBody 9213 3.79 6.88 2.79 64 HTML_IMAGE_ONLY_08 9197 1.77 6.87 0.11 65 T_HTML_TAG_BALANCE_CENTER 9075 1.70 6.78 0.05 66 XMSubMetaSx_00 8866 3.97 6.62 3.11 67 BODY_URI_ONLY 8222 1.51 6.14 0.01 68 XM_UB50 8170 4.88 6.10 4.49 69 XM_H_Long_From01 7945 4.95 5.93 4.63 70 TR_XM_SPAMCOP 7438 1.60 5.56 0.32 71 MIXED_CENTER_CASE 7350 1.34 5.49 0.00 72 MIXED_HREF_CASE 7342 1.34 5.48 0.00 73 MIXED_IMG_CASE 7338 1.34 5.48 0.00 74 MIXED_AREA_CASE 7337 1.34 5.48 0.00 75 MIXED_FONT_CASE 7336 1.34 5.48 0.00 76 XM_B_SpammyTLD 7312 2.63 5.46 1.71 77 MIME_HTML_MOSTLY 6917 2.86 5.17 2.11 78 XMNumbers 6909 3.37 5.16 2.79 79 DKIM_INVALID 6898 5.26 5.15 5.29 80 RELAYCOUNTRY_CA 6865 1.93 5.13 0.89 81 TR_XM_DK_SendGrid 6828 4.23 5.10 3.95 82 XM_SPF_SoftFail 6664 2.59 4.98 1.82 83 MIXED_CTYPE_CASE 6663 1.22 4.98 0.00 84 HTML_IMAGE_RATIO_04 6617 5.77 4.94 6.03 85 HTML_FONT_SIZE_LARGE 6061 1.17 4.53 0.09 86 XM_B_Phish66 5999 2.25 4.48 1.53 87 MIME_QP_LONG_LINE 5875 4.80 4.39 4.93 88 BAYES_95 5483 2.77 4.10 2.34 89 XMStrtUSub 5406 4.23 4.04 4.30 90 HTML_IMAGE_RATIO_06 5079 3.31 3.79 3.15 91 URIBL_DBL_SPAM 5053 0.93 3.77 0.01 92 TM2_M_URI_OPT_OUT 5019 6.33 3.75 7.16 93 MIME_HTML_ONLY_MULTI 4997 2.86 3.73 2.58 94 XM_OfRef6 4977 1.57 3.72 0.87 95 URI_NOVOWEL 4930 2.83 3.68 2.55 96 RCVD_IN_MSPIKE_BL 4924 1.10 3.68 0.26 97 TR_XM_MSPIKECOMBO 4892 1.08 3.65 0.25 98 XM_B_Investor 4885 1.85 3.65 1.26 99 GOOG_STO_IMG_HTML 4735 0.87 3.54 0.00 100 XM_B_COVIDMETA 4457 1.23 3.33 0.55 101 T_XMDrugObfuBody_08 4380 1.85 3.27 1.39 102 TR_XM_SpammyWords5 4333 1.77 3.24 1.29 103 T_XMDrugObfuBody_14 4252 2.17 3.18 1.84 104 RCVD_IN_RP_SAFE 4126 5.50 3.08 6.28 105 URI_GOOG_STO_SPAMMY 4097 0.75 3.06 0.00 106 XMNoVowels 4001 2.20 2.99 1.95 107 PDS_OTHER_BAD_TLD 3899 0.93 2.91 0.29 108 SpammyFromTLD_01 3894 1.29 2.91 0.76 109 XMDiploma_00 3796 1.53 2.84 1.10 110 XM_DIRTYINTL 3733 4.23 2.79 4.70 111 TR_XM_SB_Phish 3695 2.58 2.76 2.52 112 HTML_IMAGE_RATIO_08 3667 2.53 2.74 2.46 113 BAYES_00 3593 9.69 2.68 11.96 114 T_TooManySym_01 3542 4.40 2.65 4.96 115 HELO_NO_DOMAIN 3523 1.75 2.63 1.46 116 HELO_NODOT 3523 1.75 2.63 1.46 117 BAYES_40 3510 4.55 2.62 5.17 118 RCVD_IN_IADB_LISTED 3509 4.34 2.62 4.90 119 XMSubPhish11 3468 2.52 2.59 2.49 120 BAYES_20 3220 6.60 2.40 7.96 121 XM_B_Unsub2 3186 1.55 2.38 1.28 122 RCVD_IN_RP_CERTIFIED 3160 4.83 2.36 5.62 123 RCVD_IN_IADB_SPF 3127 3.82 2.34 4.30 124 FROM_EXCESS_BASE64 3104 2.19 2.32 2.15 125 XM_B_SpammyWords4 3070 0.84 2.29 0.37 126 XM_CamelCaseFrm001 3057 1.76 2.28 1.59 127 TM2_M_VERY_LONG_WORD 3024 1.26 2.26 0.93 128 FROM_SUSPICIOUS_NTLD 2991 0.59 2.23 0.06 129 RCVD_IN_IADB_DK 2944 3.38 2.20 3.76 130 RCVD_IN_IADB_SENDERID 2908 3.46 2.17 3.88 131 FROM_SUSPICIOUS_NTLD_FP 2903 0.57 2.17 0.06 132 XM_UB60 2880 1.21 2.15 0.91 133 HTML_FONT_SIZE_HUGE 2849 0.55 2.13 0.05 134 RCVD_IN_MSPIKE_L5 2770 0.58 2.07 0.10 135 MAILING_LIST_MULTI 2770 2.50 2.07 2.64 136 XM_URI_RBL 2711 0.66 2.02 0.22 137 URI_HEX 2683 1.30 2.00 1.07 138 JH_SPAMMY_HEADERS 2663 0.49 1.99 0.00 139 TR_XM_PHPDW 2635 0.66 1.97 0.23 140 XM_DK_Undo_01 2612 1.62 1.95 1.51 141 TR_XM_COVIDMETA1 2602 0.68 1.94 0.27 142 TR_XM_PHPForged 2588 0.62 1.93 0.20 143 TR_XM_FormFill2 2538 0.62 1.90 0.20 144 XM_H_PHPOS 2524 0.60 1.89 0.19 145 XMBody_17 2514 0.77 1.88 0.41 146 XMGenDplmaNmb 2446 0.99 1.83 0.72 147 XM_ShortIntro_01 2407 1.36 1.80 1.21 148 TR_XM_NoHeaderRelay 2403 0.59 1.79 0.21 149 XM_UB99 2353 0.43 1.76 0.00 150 XMStockSpam_06 2338 0.95 1.75 0.69 151 TR_XM_SpammyWords3 2306 0.53 1.72 0.15 152 TR_XM_COVIDMETA4 2299 0.69 1.72 0.36 153 XMSexyCombo_01 2262 0.74 1.69 0.43 154 T_XMDrugObfuBody_00 2258 0.93 1.69 0.68 155 MISSING_HEADERS 2161 0.69 1.61 0.39 156 ALL_TRUSTED 2153 16.01 1.61 20.67 157 XMMoneyMeta_00 2118 0.73 1.58 0.46 158 RELAYCOUNTRY_NL 2091 0.50 1.56 0.15 159 T_FILL_THIS_FORM_SHORT 2084 0.98 1.56 0.80 160 XMHTML_After_End 2082 0.98 1.55 0.80 161 SUBJ_ALL_CAPS 2062 1.54 1.54 1.54 162 URI_TRY_3LD 2029 1.16 1.52 1.04 163 BOTNET_NORDNS 2002 0.37 1.50 0.01 164 RELAYCOUNTRY_GB 1957 1.11 1.46 1.00 165 XM_H_TOP 1943 0.36 1.45 0.00 166 URIBL_BLACK 1942 0.37 1.45 0.02 167 DIET_1 1911 0.61 1.43 0.34 168 T_XMHurry_00 1907 2.00 1.42 2.19 169 TR_XM_INV_DKIM 1906 0.49 1.42 0.19 170 XMBrknScrpt_02 1876 0.86 1.40 0.68 171 TR_Symld_Words 1870 1.41 1.40 1.42 172 TR_Mismatch_TLD_02 1862 0.41 1.39 0.09 173 RELAYCOUNTRY_AU 1811 0.53 1.35 0.26 174 XM_UB80 1787 0.34 1.33 0.02 175 RCVD_IN_PSBL 1704 0.34 1.27 0.04 176 XM_PDF 1698 3.74 1.27 4.54 177 DATE_IN_PAST_06_12 1662 0.33 1.24 0.04 178 RELAYCOUNTRY_IN 1647 0.37 1.23 0.09 179 RELAYCOUNTRY_DE 1637 0.90 1.22 0.79 180 TR_Mismatch_TLD_01 1623 0.47 1.21 0.23 181 BAYES_05 1593 2.23 1.19 2.57 182 XM_UB999 1590 0.29 1.19 0.00 183 TR_MetaPhish_Combo_01 1588 0.90 1.19 0.81 184 REPLYTO_WITHOUT_TO_CC 1585 0.31 1.18 0.03 185 RCVD_IN_IADB_VOUCHED 1566 2.55 1.17 3.00 186 XM_B_SEO 1550 0.38 1.16 0.13 187 TR_XM_BayesRelay 1529 0.28 1.14 0.00 188 XM_Body_Dirty_Words_01 1524 0.40 1.14 0.17 189 TR_LOTS_OF_MONEY3 1519 0.45 1.13 0.23 190 USER_IN_DEF_DKIM_WL 1503 7.67 1.12 9.80 191 T_Symld_Words_02 1500 0.61 1.12 0.44 192 TR_XM_SEO4 1481 0.31 1.11 0.05 193 RELAYCOUNTRY_FR 1472 3.68 1.10 4.52 194 XM_ProductURIs 1449 0.75 1.08 0.64 195 XMPhish30 1412 0.68 1.05 0.55 196 DKIM_ADSP_CUSTOM_MED 1406 0.93 1.05 0.89 197 URIBL_SBL_A 1403 0.35 1.05 0.12 198 LUCRATIVE 1370 0.26 1.02 0.01 199 T_MONEY_PERCENT 1350 0.41 1.01 0.22 200 TR_LOTS_OF_MONEY2 1350 0.41 1.01 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 331333 84.06 96.01 80.19 2 RELAYCOUNTRY_US 298141 73.33 76.92 72.16 3 DKIM_SIGNED 286132 71.93 80.20 69.25 4 XM_B_Unicode 283621 70.12 74.67 68.65 5 XM_DK_Pass 275159 69.29 77.59 66.60 6 DCC_CHECK_NEGATIVE 267942 54.58 22.90 64.85 7 DKIM_VALID 264271 66.67 75.05 63.96 8 BAYES_50 220563 51.19 44.40 53.38 9 DKIM_VALID_AU 201005 50.24 55.15 48.65 10 XMListUnsubscribeExists 171385 47.44 65.84 41.48 11 XM_B_SpammyWords 165170 46.14 65.17 39.98 12 XM_B_Unicode3 150453 37.65 41.46 36.41 13 DCC_CHECK 145039 45.37 77.06 35.10 14 T_TM2_M_HEADER_IN_MSG 142004 31.43 22.36 34.37 15 RCVD_IN_MSPIKE_WL 102170 23.25 18.68 24.73 16 DKIM_VALID_EF 99764 25.67 30.36 24.15 17 RCVD_IN_MSPIKE_H2 96020 25.01 30.49 23.24 18 HTML_FONT_LOW_CONTRAST 93339 25.72 35.36 22.59 19 ALL_TRUSTED 85404 16.01 1.61 20.67 20 FVGT_m_MULTI_ODD 81580 21.22 25.79 19.74 21 LOC_TINY_FONT_1 81452 23.22 34.05 19.71 22 XMSubLong 78974 21.06 27.06 19.11 23 MIME_HTML_ONLY 75123 21.96 33.63 18.18 24 XM_B_SpammyWords2 73602 22.42 36.64 17.81 25 T_KAM_HTML_FONT_INVALID 67069 19.36 28.99 16.23 26 XM_Body_Dirty_Words 57611 15.51 20.36 13.94 27 RCVD_IN_MSPIKE_H3 53293 12.24 10.20 12.90 28 BAYES_00 49426 9.69 2.68 11.96 29 ANY_BOUNCE_MESSAGE 47675 8.90 0.77 11.54 30 BOUNCE_MESSAGE 47673 8.90 0.77 11.54 31 USER_IN_DEF_DKIM_WL 40475 7.67 1.12 9.80 32 XM_Multi_Part_URI 40165 11.10 15.37 9.72 33 RCVD_IN_MSPIKE_H4 39329 9.06 7.62 9.52 34 XM_B_Unsub 35766 9.54 12.25 8.66 35 RELAYCOUNTRY_META 34695 11.32 20.33 8.40 36 LotsOfNums_01 33287 7.90 7.42 8.06 37 TooManyTo_001 32909 7.71 6.91 7.97 38 BAYES_20 32883 6.60 2.40 7.96 39 FSL_BULK_SIG 31167 9.98 17.49 7.54 40 UNPARSEABLE_RELAY 30627 8.50 11.86 7.41 41 BAYES_60 30121 7.35 7.54 7.29 42 XMSexyCombo_05 29889 7.94 10.11 7.23 43 TR_XM_DK_Bayes 29829 5.64 0.77 7.22 44 TM2_M_URI_OPT_OUT 29586 6.33 3.75 7.16 45 TR_XM_DK_Bayes1 28837 5.46 0.75 6.98 46 LOTS_OF_MONEY 28835 8.59 13.55 6.98 47 XM_Evil_Numbers_Gen 27695 7.29 9.10 6.70 48 XM_DKIMWhitelistDomains 27204 4.99 0.07 6.58 49 XM_SendGrid 26830 7.05 8.76 6.49 50 RCVD_IN_RP_SAFE 25966 5.50 3.08 6.28 51 HTML_IMAGE_RATIO_04 24926 5.77 4.94 6.03 52 TR_XM_DK_Bayes2 24566 4.65 0.65 5.95 53 UNTRUSTED_Relay 24219 8.04 14.76 5.86 54 XM_DK_Undo_02 24197 13.93 38.82 5.86 55 TR_XM_UnparsRelay 23290 7.03 11.33 5.64 56 RCVD_IN_RP_CERTIFIED 23240 4.83 2.36 5.62 57 BAYES_99 22926 10.87 27.27 5.55 58 DKIM_INVALID 21861 5.26 5.15 5.29 59 BAYES_40 21374 4.55 2.62 5.17 60 T_TooManySym_01 20507 4.40 2.65 4.96 61 MIME_QP_LONG_LINE 20361 4.80 4.39 4.93 62 HTML_IMAGE_RATIO_02 20269 5.67 8.03 4.91 63 RCVD_IN_IADB_LISTED 20229 4.34 2.62 4.90 64 BAYES_999 19586 8.68 20.84 4.74 65 XM_DIRTYINTL 19418 4.23 2.79 4.70 66 XM_H_Long_From01 19128 4.95 5.93 4.63 67 XM_PDF 18746 3.74 1.27 4.54 68 RELAYCOUNTRY_FR 18660 3.68 1.10 4.52 69 XM_UB50 18537 4.88 6.10 4.49 70 XMBounce_01 18492 3.41 0.13 4.48 71 XM_H_Trusted_IP 17930 3.28 0.00 4.34 72 RCVD_IN_IADB_SPF 17776 3.82 2.34 4.30 73 XMStrtUSub 17753 4.23 4.04 4.30 74 TR_XM_SpammyWords4 17695 5.93 11.00 4.28 75 TR_XM_DKIM_Undo 17537 10.78 30.93 4.24 76 MPART_ALT_DIFF 17031 5.12 8.20 4.12 77 TR_XM_DK_SendGrid 16321 4.23 5.10 3.95 78 RCVD_IN_IADB_SENDERID 16033 3.46 2.17 3.88 79 BAYES_80 15594 4.75 7.78 3.77 80 RCVD_IN_IADB_DK 15523 3.38 2.20 3.76 81 BOTNET_IPINHOSTNAME 15204 6.01 13.20 3.68 82 T_REMOTE_IMAGE 14727 4.89 8.96 3.56 83 XM_B_SpammyWords3 13858 5.56 12.39 3.35 84 XM_UncommonTLD01 13084 6.24 15.71 3.17 85 HTML_IMAGE_RATIO_06 13033 3.31 3.79 3.15 86 XMSubMetaSx_00 12858 3.97 6.62 3.11 87 XM_B_Phish_Phrases 12568 4.03 7.06 3.04 88 RCVD_IN_IADB_VOUCHED 12384 2.55 1.17 3.00 89 XMNumbers 11527 3.37 5.16 2.79 90 TR_XM_PhishingBody 11516 3.79 6.88 2.79 91 MAILING_LIST_MULTI 10904 2.50 2.07 2.64 92 MIME_HTML_ONLY_MULTI 10665 2.86 3.73 2.58 93 BAYES_05 10604 2.23 1.19 2.57 94 URI_NOVOWEL 10542 2.83 3.68 2.55 95 TR_XM_SB_Phish 10423 2.58 2.76 2.52 96 XMSubPhish11 10306 2.52 2.59 2.49 97 HTML_IMAGE_RATIO_08 10148 2.53 2.74 2.46 98 T_TooManySym_02 9884 2.01 0.84 2.39 99 HTML_MIME_NO_HTML_TAG 9810 3.84 8.35 2.37 100 BAYES_95 9671 2.77 4.10 2.34 101 RCVD_IN_MSPIKE_H5 9548 1.95 0.85 2.31 102 T_XMHurry_00 9050 2.00 1.42 2.19 103 FROM_EXCESS_BASE64 8863 2.19 2.32 2.15 104 TR_DCC_Bayes_99 8753 6.61 20.48 2.12 105 MIME_HTML_MOSTLY 8721 2.86 5.17 2.11 106 TooManyTo_002 8710 1.84 1.01 2.11 107 XMNoVowels 8049 2.20 2.99 1.95 108 RCVD_IN_IADB_OPTIN 7788 1.61 0.76 1.88 109 T_XMDrugObfuBody_14 7619 2.17 3.18 1.84 110 XMSubNoVowel 7585 1.59 0.81 1.84 111 XM_SPF_SoftFail 7509 2.59 4.98 1.82 112 INVALID_MSGID 7155 1.38 0.29 1.73 113 IN_HORDE_ADDRESS_BOOK 7141 1.34 0.14 1.73 114 TR_XM_SpammyRelay 7084 4.22 11.96 1.71 115 XM_B_SpammyTLD 7059 2.63 5.46 1.71 116 KHOP_HELO_FCRDNS 6644 3.17 7.98 1.61 117 XM_CamelCaseFrm001 6586 1.76 2.28 1.59 118 MSGID_NOFQDN1 6496 1.20 0.05 1.57 119 SUBJ_ALL_CAPS 6382 1.54 1.54 1.54 120 TO_MALFORMED 6362 1.18 0.07 1.54 121 XM_B_Phish66 6316 2.25 4.48 1.53 122 XM_DK_Undo_01 6254 1.62 1.95 1.51 123 HELO_NO_DOMAIN 6047 1.75 2.63 1.46 124 HELO_NODOT 6047 1.75 2.63 1.46 125 TooManyTo_003 5854 1.26 0.78 1.42 126 TR_Symld_Words 5849 1.41 1.40 1.42 127 T_XMDrugObfuBody_08 5754 1.85 3.27 1.39 128 TVD_RCVD_IP 5642 1.10 0.27 1.37 129 TR_XM_SpammyWords5 5333 1.77 3.24 1.29 130 XM_B_Unsub2 5299 1.55 2.38 1.28 131 BOTNET 5218 3.85 11.83 1.26 132 XM_B_Investor 5217 1.85 3.65 1.26 133 HTML_IMAGE_ONLY_20 5183 1.00 0.22 1.25 134 XMGappySubj_01 5173 0.99 0.16 1.25 135 XM_GoogleGroups 5121 1.11 0.72 1.24 136 XM_H_Long_From02 5050 1.14 0.89 1.22 137 XM_ShortIntro_01 5017 1.36 1.80 1.21 138 XMCapTrack 4960 1.08 0.71 1.20 139 XMDiploma_00 4565 1.53 2.84 1.10 140 URI_HEX 4430 1.30 2.00 1.07 141 URI_TRY_3LD 4311 1.16 1.52 1.04 142 TooManyTo_004 4160 0.92 0.65 1.01 143 RELAYCOUNTRY_GB 4142 1.11 1.46 1.00 144 HTML_FONT_FACE_BAD 4113 0.94 0.77 1.00 145 TM2_M_VERY_LONG_WORD 3847 1.26 2.26 0.93 146 XM_UB60 3752 1.21 2.15 0.91 147 DKIM_ADSP_CUSTOM_MED 3692 0.93 1.05 0.89 148 RELAYCOUNTRY_CA 3680 1.93 5.13 0.89 149 XM_OfRef6 3586 1.57 3.72 0.87 150 XMBSHREFv2 3527 0.75 0.41 0.85 151 TooManyTo_005 3362 0.75 0.56 0.81 152 TR_MetaPhish_Combo_01 3347 0.90 1.19 0.81 153 TVD_SPACE_RATIO_MINFP 3330 0.63 0.11 0.81 154 XMHTML_After_End 3302 0.98 1.55 0.80 155 T_FILL_THIS_FORM_SHORT 3298 0.98 1.56 0.80 156 RELAYCOUNTRY_DE 3264 0.90 1.22 0.79 157 HELO_MISC_IP 3253 0.66 0.26 0.79 158 TR_XM_SpammyWords2 3238 3.01 9.86 0.78 159 MIME_HEADER_CTYPE_ONLY 3176 0.63 0.20 0.77 160 SpammyFromTLD_01 3149 1.29 2.91 0.76 161 IN_ZIMBRA_NJ_WHITELIST 3123 0.57 0.01 0.76 162 XMGenDplmaNmb 2973 0.99 1.83 0.72 163 MY_SERVERS_FOUND 2945 0.57 0.13 0.71 164 XMStockSpam_06 2851 0.95 1.75 0.69 165 T_TooManySym_03 2833 0.60 0.35 0.69 166 T_XMDrugObfuBody_00 2815 0.93 1.69 0.68 167 XMBrknScrpt_02 2808 0.86 1.40 0.68 168 XMBody_95 2776 0.57 0.25 0.67 169 HTTPS_HTTP_MISMATCH 2743 0.73 0.91 0.66 170 RCVD_IN_BL_SPAMCOP_NET 2713 2.77 9.30 0.66 171 XM_ProductURIs 2651 0.75 1.08 0.64 172 TR_MSPIKEBAYES00 2630 0.48 0.02 0.64 173 XMBdyGiftCard01 2531 0.67 0.83 0.61 174 T_OBFU_PDF_ATTACH 2510 0.50 0.17 0.61 175 XMHTMLBadTable_001 2459 0.62 0.71 0.60 176 NML_ADSP_CUSTOM_MED 2458 0.64 0.78 0.59 177 MSGID_FROM_MTA_HEADER 2319 0.52 0.39 0.56 178 XMPhish30 2291 0.68 1.05 0.55 179 XM_B_COVIDMETA 2277 1.23 3.33 0.55 180 HTML_TAG_BALANCE_BODY 2056 0.57 0.79 0.50 181 XM_B_COPY_HTML 1993 0.50 0.56 0.48 182 FORGED_GMAIL_RCVD 1982 0.59 0.93 0.48 183 XM_H_PHPMailer 1970 0.60 0.99 0.48 184 FROM_GOV_DKIM_AU 1914 0.43 0.33 0.46 185 RCVD_IN_SORBS_DUL 1896 0.52 0.72 0.46 186 XMMoneyMeta_00 1889 0.73 1.58 0.46 187 XMPhish14 1828 0.48 0.59 0.44 188 T_Symld_Words_02 1817 0.61 1.12 0.44 189 TVD_SPACE_RATIO 1807 0.35 0.08 0.44 190 XMSexyCombo_01 1769 0.74 1.69 0.43 191 XM_B_REG_HTML 1732 0.42 0.40 0.42 192 SHORT_HELO_AND_INLINE_IMAGE 1729 0.41 0.38 0.42 193 TM2_M_BODY_EMPTY 1690 0.33 0.08 0.41 194 XMBody_17 1685 0.77 1.88 0.41 195 XMBody_78 1684 0.49 0.76 0.41 196 HTML_IMAGE_ONLY_32 1684 0.37 0.25 0.41 197 HTML_IMAGE_ONLY_28 1652 0.42 0.49 0.40 198 USER_IN_WHITELIST 1616 0.30 0.00 0.39 199 USER_IN_WELCOMELIST 1616 0.30 0.00 0.39 200 MISSING_HEADERS 1614 0.69 1.61 0.39 ----------------------------------------------------------------------