Email: 542897 Autolearn: 0 AvgScore: 3.24 AvgScanTime: 1.27 sec Spam: 132426 Autolearn: 0 AvgScore: 14.01 AvgScanTime: 1.44 sec Ham: 410471 Autolearn: 0 AvgScore: -0.24 AvgScanTime: 1.22 sec Time Spent Running SA: 191.97 hours Time Spent Processing Spam: 53.00 hours Time Spent Processing Ham: 138.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124638 87.44 94.12 85.29 2 DKIM_SIGNED 104940 70.44 79.24 67.60 3 XM_DK_Pass 101552 68.66 76.69 66.07 4 RELAYCOUNTRY_US 101059 74.35 76.31 73.71 5 DCC_CHECK 100740 44.81 76.07 34.73 6 XM_B_Unicode 99353 72.00 75.03 71.02 7 DKIM_VALID 98280 66.43 74.22 63.92 8 XM_B_SpammyWords 86114 46.20 65.03 40.13 9 XMListUnsubscribeExists 86008 47.55 64.95 41.93 10 DKIM_VALID_AU 71674 49.03 54.12 47.39 11 BAYES_50 58041 54.88 43.83 58.45 12 XM_B_Unicode3 54468 42.41 41.13 42.82 13 XM_B_SpammyWords2 49479 22.17 37.36 17.27 14 XM_DK_Undo_02 49255 13.43 37.19 5.76 15 MIME_HTML_ONLY 44740 26.37 33.78 23.97 16 HTML_FONT_LOW_CONTRAST 44173 25.61 33.36 23.11 17 LOC_TINY_FONT_1 43886 23.23 33.14 20.03 18 RCVD_IN_MSPIKE_H2 41150 25.40 31.07 23.57 19 TR_XM_DKIM_Undo 39181 10.68 29.59 4.58 20 T_KAM_HTML_FONT_INVALID 37726 20.08 28.49 17.36 21 DKIM_VALID_EF 37566 25.38 28.37 24.41 22 BAYES_99 37536 10.56 28.34 4.83 23 FVGT_m_MULTI_ODD 34814 21.93 26.29 20.53 24 XMSubLong 33672 25.89 25.43 26.04 25 DCC_CHECK_NEGATIVE 31638 55.14 23.89 65.23 26 T_TM2_M_HEADER_IN_MSG 30957 28.57 23.38 30.24 27 XM_Body_Dirty_Words 29295 13.40 22.12 10.58 28 TR_DCC_Bayes_99 29080 6.87 21.96 2.01 29 BAYES_999 28003 8.18 21.15 3.99 30 RELAYCOUNTRY_META 26769 10.61 20.21 7.51 31 RCVD_IN_MSPIKE_WL 25618 24.29 19.35 25.89 32 FSL_BULK_SIG 23560 9.33 17.79 6.60 33 XM_Multi_Part_URI 22507 13.32 17.00 12.13 34 UNTRUSTED_Relay 20720 7.65 15.65 5.07 35 XM_UncommonTLD01 20478 6.03 15.46 2.99 36 LOTS_OF_MONEY 19259 12.88 14.54 12.35 37 BOTNET_IPINHOSTNAME 17698 6.17 13.36 3.84 38 BOTNET 16955 4.22 12.80 1.45 39 XM_B_SpammyWords3 16117 5.90 12.17 3.88 40 XM_B_Unsub 15956 14.74 12.05 15.60 41 UNPARSEABLE_RELAY 15510 8.33 11.71 7.23 42 TR_XM_UnparsRelay 14999 6.82 11.33 5.37 43 TR_XM_SpammyRelay 14993 4.05 11.32 1.70 44 TR_XM_SpammyWords4 14745 5.45 11.13 3.61 45 TR_XM_SpammyWords2 14547 3.41 10.99 0.96 46 RCVD_IN_MSPIKE_H3 14225 13.02 10.74 13.75 47 XMSexyCombo_05 13179 5.24 9.95 3.71 48 SpammyFromTLD_02 13093 2.69 9.89 0.36 49 T_REMOTE_IMAGE 12804 5.01 9.67 3.50 50 HTML_MIME_NO_HTML_TAG 12704 4.01 9.59 2.21 51 XM_Evil_Numbers_Gen 12546 7.72 9.47 7.15 52 XM_SendGrid 11843 7.04 8.94 6.43 53 T_HTML_TAG_BALANCE_CENTER 10627 2.04 8.02 0.11 54 KHOP_HELO_FCRDNS 10611 3.10 8.01 1.51 55 BAYES_80 10467 4.79 7.90 3.79 56 BAYES_60 10383 8.02 7.84 8.08 57 HTML_IMAGE_ONLY_08 10377 2.00 7.84 0.12 58 LotsOfNums_01 10111 7.92 7.64 8.01 59 RCVD_IN_MSPIKE_H4 10102 9.21 7.63 9.72 60 HTML_IMAGE_RATIO_02 9721 5.69 7.34 5.16 61 XM_UB50 9543 5.10 7.21 4.42 62 BODY_URI_ONLY 9112 1.69 6.88 0.02 63 MPART_ALT_DIFF 8810 4.92 6.65 4.36 64 RCVD_IN_BL_SPAMCOP_NET 8746 1.98 6.60 0.49 65 XM_B_Phish_Phrases 8708 4.19 6.58 3.42 66 MIXED_FONT_CASE 8668 1.60 6.55 0.00 67 HTML_FONT_SIZE_LARGE 8641 1.66 6.53 0.09 68 MIXED_HREF_CASE 8629 1.59 6.52 0.00 69 MIXED_CENTER_CASE 8603 1.59 6.50 0.00 70 MIXED_IMG_CASE 8589 1.58 6.49 0.00 71 MIXED_AREA_CASE 8589 1.58 6.49 0.00 72 TR_XM_PhishingBody 8567 3.76 6.47 2.89 73 XMSubMetaSx_00 7921 3.69 5.98 2.95 74 TooManyTo_001 7887 12.51 5.96 14.62 75 XM_H_Long_From01 6993 4.87 5.28 4.73 76 TR_XM_DK_SendGrid 6812 4.11 5.14 3.78 77 XMNumbers 6713 3.43 5.07 2.90 78 DKIM_INVALID 6660 4.01 5.03 3.68 79 GOOG_STO_IMG_HTML 6545 1.21 4.94 0.00 80 HTML_IMAGE_RATIO_04 6540 5.12 4.94 5.17 81 XM_SPF_SoftFail 6300 2.53 4.76 1.81 82 TM2_M_URI_OPT_OUT 6247 4.92 4.72 4.98 83 RELAYCOUNTRY_CA 6219 1.71 4.70 0.75 84 MIME_HTML_MOSTLY 6136 2.74 4.63 2.13 85 BAYES_95 5722 2.75 4.32 2.24 86 XM_B_SpammyTLD 5678 2.48 4.29 1.90 87 TR_XM_SPAMCOP 5624 1.16 4.25 0.16 88 XM_B_Investor 5550 2.08 4.19 1.40 89 MIME_QP_LONG_LINE 5538 4.78 4.18 4.97 90 XMStrtUSub 5534 3.78 4.18 3.66 91 TR_XM_SpammyWords5 5125 1.98 3.87 1.37 92 HTML_IMAGE_RATIO_06 4841 3.92 3.66 4.00 93 XM_B_Phish66 4603 2.08 3.48 1.63 94 RCVD_IN_MSPIKE_BL 4603 1.11 3.48 0.35 95 RCVD_IN_RP_SAFE 4539 5.55 3.43 6.23 96 TR_XM_MSPIKECOMBO 4534 1.09 3.42 0.34 97 T_XMDrugObfuBody_08 4416 1.77 3.33 1.27 98 MIME_HTML_ONLY_MULTI 4350 3.05 3.28 2.97 99 T_XMDrugObfuBody_14 4118 2.10 3.11 1.77 100 XMNoVowels 3957 2.39 2.99 2.20 101 HTML_IMAGE_RATIO_08 3927 2.47 2.97 2.31 102 T_TooManySym_01 3922 4.47 2.96 4.95 103 URI_NOVOWEL 3914 2.79 2.96 2.74 104 XM_DIRTYINTL 3882 1.73 2.93 1.34 105 RCVD_IN_IADB_LISTED 3835 4.86 2.90 5.49 106 SpammyFromTLD_01 3798 1.20 2.87 0.66 107 URI_GOOG_STO_SPAMMY 3670 0.68 2.77 0.00 108 XM_OfRef6 3647 1.46 2.75 1.05 109 T_XMDrugObfuBody_00 3628 2.83 2.74 2.86 110 TR_XM_SB_Phish 3604 2.25 2.72 2.09 111 RCVD_IN_RP_CERTIFIED 3539 4.84 2.67 5.54 112 XMSubPhish11 3533 2.21 2.67 2.07 113 XM_B_COVIDMETA 3531 1.14 2.67 0.64 114 BAYES_40 3466 4.26 2.62 4.79 115 XMDiploma_00 3466 6.35 2.62 7.56 116 BOTNET_NORDNS 3373 0.63 2.55 0.01 117 XM_CamelCaseFrm001 3364 1.91 2.54 1.71 118 RCVD_IN_IADB_SPF 3326 4.20 2.51 4.74 119 XM_B_Unsub2 3276 1.87 2.47 1.68 120 URIBL_DBL_SPAM 3132 0.58 2.37 0.00 121 RCVD_IN_IADB_DK 3111 3.65 2.35 4.07 122 RCVD_IN_IADB_SENDERID 3098 3.74 2.34 4.19 123 MAILING_LIST_MULTI 3086 2.88 2.33 3.06 124 TM2_M_VERY_LONG_WORD 3046 1.37 2.30 1.07 125 XM_DK_Undo_01 2987 1.79 2.26 1.64 126 XM_UB60 2965 0.76 2.24 0.28 127 XM_UB99 2904 0.54 2.19 0.00 128 RELAYCOUNTRY_FR 2900 3.31 2.19 3.67 129 TR_XM_PHPDW 2860 0.71 2.16 0.24 130 BAYES_20 2806 3.22 2.12 3.58 131 XM_URI_RBL 2767 0.58 2.09 0.10 132 XMSexyCombo_01 2744 0.86 2.07 0.46 133 SUBJ_ALL_CAPS 2694 1.55 2.03 1.40 134 TR_XM_PHPForged 2687 0.65 2.03 0.21 135 XMMoneyMeta_00 2683 0.91 2.03 0.55 136 TR_XM_FormFill2 2659 0.65 2.01 0.21 137 T_FILL_THIS_FORM_SHORT 2659 1.21 2.01 0.96 138 XM_H_PHPOS 2644 0.64 2.00 0.20 139 XMBody_17 2620 0.72 1.98 0.31 140 XM_B_SpammyWords4 2553 0.88 1.93 0.54 141 BAYES_00 2535 9.57 1.91 12.04 142 URI_HEX 2517 1.45 1.90 1.31 143 TR_XM_SpammyWords3 2476 0.61 1.87 0.21 144 ANY_BOUNCE_MESSAGE 2460 5.12 1.86 6.18 145 BOUNCE_MESSAGE 2458 5.12 1.86 6.18 146 FROM_EXCESS_BASE64 2448 2.13 1.85 2.22 147 RELAYCOUNTRY_GB 2431 1.07 1.84 0.82 148 TR_XM_COVIDMETA4 2335 0.71 1.76 0.36 149 RCVD_IN_PSBL 2322 0.48 1.75 0.06 150 ALL_TRUSTED 2291 15.64 1.73 20.13 151 TR_XM_NoHeaderRelay 2264 0.57 1.71 0.20 152 TR_Symld_Words 2258 1.57 1.71 1.53 153 XMStockSpam_06 2230 0.94 1.68 0.70 154 XMBrknScrpt_02 2167 1.00 1.64 0.79 155 URIBL_BLACK 2153 0.41 1.63 0.01 156 XMGenDplmaNmb 2145 0.99 1.62 0.78 157 HELO_NODOT 2100 1.65 1.59 1.67 158 HELO_NO_DOMAIN 2098 1.65 1.58 1.67 159 PDS_OTHER_BAD_TLD 1982 0.58 1.50 0.28 160 RELAYCOUNTRY_DE 1949 0.99 1.47 0.84 161 RELAYCOUNTRY_NL 1901 0.48 1.44 0.17 162 URI_TRY_3LD 1883 0.99 1.42 0.85 163 XMHTML_After_End 1846 0.88 1.39 0.72 164 RCVD_IN_IADB_VOUCHED 1833 3.00 1.38 3.52 165 USER_IN_DEF_DKIM_WL 1823 8.30 1.38 10.54 166 XM_Body_Dirty_Words_01 1817 0.44 1.37 0.14 167 TR_XM_INV_DKIM 1816 0.37 1.37 0.04 168 XM_H_Undi_Recip 1798 0.44 1.36 0.14 169 XM_PDF 1789 3.69 1.35 4.45 170 XM_UB80 1725 0.33 1.30 0.02 171 TO_NO_BRKTS_PCNT 1702 0.31 1.29 0.00 172 XM_UB999 1659 0.31 1.25 0.00 173 T_Symld_Words_02 1654 0.64 1.25 0.45 174 T_XMHurry_00 1650 0.75 1.25 0.59 175 HTML_FONT_FACE_BAD 1642 0.99 1.24 0.90 176 RCVD_IN_MSPIKE_L4 1633 0.43 1.23 0.17 177 HTML_FONT_SIZE_HUGE 1624 0.34 1.23 0.05 178 RELAYCOUNTRY_AU 1616 0.52 1.22 0.30 179 TR_LOTS_OF_MONEY3 1610 0.50 1.22 0.27 180 TR_XM_BayesRelay 1602 0.30 1.21 0.00 181 T_MONEY_PERCENT 1601 0.47 1.21 0.23 182 TR_LOTS_OF_MONEY2 1601 0.47 1.21 0.23 183 DKIM_ADSP_CUSTOM_MED 1594 0.98 1.20 0.91 184 XMBounce_01 1568 3.06 1.18 3.66 185 DIET_1 1541 0.54 1.16 0.34 186 URIBL_DBL_ABUSE_SPAM 1525 0.33 1.15 0.06 187 HTTPS_HTTP_MISMATCH 1512 0.88 1.14 0.80 188 XM_H_Long_From02 1512 1.14 1.14 1.14 189 BAYES_05 1470 1.94 1.11 2.21 190 JH_SPAMMY_HEADERS 1469 0.27 1.11 0.00 191 RCVD_IN_MSPIKE_L5 1460 0.29 1.10 0.03 192 TooManyTo_002 1457 1.91 1.10 2.17 193 XMPhish30 1451 0.69 1.10 0.55 194 RCVD_IN_MSPIKE_L3 1441 0.37 1.09 0.14 195 TR_XM_COVIDMETA1 1424 0.42 1.08 0.21 196 TR_MetaPhish_Combo_01 1393 1.03 1.05 1.02 197 XM_H_PHPMailer 1382 0.62 1.04 0.49 198 XMPhish14 1369 0.57 1.03 0.42 199 FORGED_GMAIL_RCVD 1337 0.60 1.01 0.46 200 XMHTMLBadTable_001 1330 0.61 1.00 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 350076 87.44 94.12 85.29 2 RELAYCOUNTRY_US 302577 74.35 76.31 73.71 3 XM_B_Unicode 291526 72.00 75.03 71.02 4 DKIM_SIGNED 277487 70.44 79.24 67.60 5 XM_DK_Pass 271200 68.66 76.69 66.07 6 DCC_CHECK_NEGATIVE 267735 55.14 23.89 65.23 7 DKIM_VALID 262382 66.43 74.22 63.92 8 BAYES_50 239905 54.88 43.83 58.45 9 DKIM_VALID_AU 194534 49.03 54.12 47.39 10 XM_B_Unicode3 175782 42.41 41.13 42.82 11 XMListUnsubscribeExists 172117 47.55 64.95 41.93 12 XM_B_SpammyWords 164719 46.20 65.03 40.13 13 DCC_CHECK 142543 44.81 76.07 34.73 14 T_TM2_M_HEADER_IN_MSG 124126 28.57 23.38 30.24 15 XMSubLong 106873 25.89 25.43 26.04 16 RCVD_IN_MSPIKE_WL 106262 24.29 19.35 25.89 17 DKIM_VALID_EF 100208 25.38 28.37 24.41 18 MIME_HTML_ONLY 98408 26.37 33.78 23.97 19 RCVD_IN_MSPIKE_H2 96758 25.40 31.07 23.57 20 HTML_FONT_LOW_CONTRAST 94845 25.61 33.36 23.11 21 FVGT_m_MULTI_ODD 84265 21.93 26.29 20.53 22 ALL_TRUSTED 82628 15.64 1.73 20.13 23 LOC_TINY_FONT_1 82230 23.23 33.14 20.03 24 T_KAM_HTML_FONT_INVALID 71266 20.08 28.49 17.36 25 XM_B_SpammyWords2 70871 22.17 37.36 17.27 26 XM_B_Unsub 64043 14.74 12.05 15.60 27 TooManyTo_001 60007 12.51 5.96 14.62 28 RCVD_IN_MSPIKE_H3 56449 13.02 10.74 13.75 29 LOTS_OF_MONEY 50678 12.88 14.54 12.35 30 XM_Multi_Part_URI 49791 13.32 17.00 12.13 31 BAYES_00 49409 9.57 1.91 12.04 32 XM_Body_Dirty_Words 43446 13.40 22.12 10.58 33 USER_IN_DEF_DKIM_WL 43264 8.30 1.38 10.54 34 RCVD_IN_MSPIKE_H4 39898 9.21 7.63 9.72 35 BAYES_60 33151 8.02 7.84 8.08 36 LotsOfNums_01 32883 7.92 7.64 8.01 37 XMDiploma_00 31032 6.35 2.62 7.56 38 RELAYCOUNTRY_META 30837 10.61 20.21 7.51 39 TR_XM_DK_Bayes 30196 5.76 0.82 7.36 40 UNPARSEABLE_RELAY 29693 8.33 11.71 7.23 41 XM_Evil_Numbers_Gen 29349 7.72 9.47 7.15 42 TR_XM_DK_Bayes1 29333 5.60 0.80 7.15 43 XM_DKIMWhitelistDomains 27302 5.04 0.03 6.65 44 FSL_BULK_SIG 27074 9.33 17.79 6.60 45 XM_SendGrid 26398 7.04 8.94 6.43 46 RCVD_IN_RP_SAFE 25591 5.55 3.43 6.23 47 ANY_BOUNCE_MESSAGE 25352 5.12 1.86 6.18 48 BOUNCE_MESSAGE 25351 5.12 1.86 6.18 49 TR_XM_DK_Bayes2 24839 4.72 0.59 6.05 50 XM_DK_Undo_02 23644 13.43 37.19 5.76 51 RCVD_IN_RP_CERTIFIED 22730 4.84 2.67 5.54 52 RCVD_IN_IADB_LISTED 22544 4.86 2.90 5.49 53 TR_XM_UnparsRelay 22026 6.82 11.33 5.37 54 HTML_IMAGE_RATIO_04 21237 5.12 4.94 5.17 55 HTML_IMAGE_RATIO_02 21166 5.69 7.34 5.16 56 UNTRUSTED_Relay 20827 7.65 15.65 5.07 57 TM2_M_URI_OPT_OUT 20447 4.92 4.72 4.98 58 MIME_QP_LONG_LINE 20387 4.78 4.18 4.97 59 T_TooManySym_01 20321 4.47 2.96 4.95 60 BAYES_99 19807 10.56 28.34 4.83 61 BAYES_40 19650 4.26 2.62 4.79 62 RCVD_IN_IADB_SPF 19458 4.20 2.51 4.74 63 XM_H_Long_From01 19430 4.87 5.28 4.73 64 TR_XM_DKIM_Undo 18780 10.68 29.59 4.58 65 XM_PDF 18258 3.69 1.35 4.45 66 XM_UB50 18158 5.10 7.21 4.42 67 MPART_ALT_DIFF 17915 4.92 6.65 4.36 68 XM_H_Trusted_IP 17310 3.19 0.00 4.22 69 RCVD_IN_IADB_SENDERID 17207 3.74 2.34 4.19 70 RCVD_IN_IADB_DK 16709 3.65 2.35 4.07 71 HTML_IMAGE_RATIO_06 16415 3.92 3.66 4.00 72 BAYES_999 16384 8.18 21.15 3.99 73 XM_B_SpammyWords3 15919 5.90 12.17 3.88 74 BOTNET_IPINHOSTNAME 15776 6.17 13.36 3.84 75 BAYES_80 15558 4.79 7.90 3.79 76 TR_XM_DK_SendGrid 15502 4.11 5.14 3.78 77 XMSexyCombo_05 15244 5.24 9.95 3.71 78 DKIM_INVALID 15105 4.01 5.03 3.68 79 RELAYCOUNTRY_FR 15065 3.31 2.19 3.67 80 XMBounce_01 15024 3.06 1.18 3.66 81 XMStrtUSub 15005 3.78 4.18 3.66 82 TR_XM_SpammyWords4 14819 5.45 11.13 3.61 83 BAYES_20 14696 3.22 2.12 3.58 84 RCVD_IN_IADB_VOUCHED 14469 3.00 1.38 3.52 85 T_REMOTE_IMAGE 14377 5.01 9.67 3.50 86 XM_B_Phish_Phrases 14052 4.19 6.58 3.42 87 MAILING_LIST_MULTI 12567 2.88 2.33 3.06 88 XM_UncommonTLD01 12256 6.03 15.46 2.99 89 MIME_HTML_ONLY_MULTI 12204 3.05 3.28 2.97 90 XMSubMetaSx_00 12093 3.69 5.98 2.95 91 XMNumbers 11922 3.43 5.07 2.90 92 TR_XM_PhishingBody 11847 3.76 6.47 2.89 93 T_XMDrugObfuBody_00 11757 2.83 2.74 2.86 94 URI_NOVOWEL 11251 2.79 2.96 2.74 95 T_TooManySym_02 10330 2.11 0.84 2.52 96 RCVD_IN_MSPIKE_H5 9915 2.06 0.97 2.42 97 HTML_IMAGE_RATIO_08 9494 2.47 2.97 2.31 98 RCVD_IN_IADB_OPTIN 9393 1.94 0.86 2.29 99 BAYES_95 9209 2.75 4.32 2.24 100 FROM_EXCESS_BASE64 9098 2.13 1.85 2.22 101 BAYES_05 9076 1.94 1.11 2.21 102 HTML_MIME_NO_HTML_TAG 9058 4.01 9.59 2.21 103 XMNoVowels 9033 2.39 2.99 2.20 104 TooManyTo_002 8926 1.91 1.10 2.17 105 MIME_HTML_MOSTLY 8743 2.74 4.63 2.13 106 TR_XM_SB_Phish 8594 2.25 2.72 2.09 107 XMSubPhish11 8481 2.21 2.67 2.07 108 TR_DCC_Bayes_99 8240 6.87 21.96 2.01 109 XM_B_SpammyTLD 7779 2.48 4.29 1.90 110 XM_SPF_SoftFail 7428 2.53 4.76 1.81 111 IN_HORDE_ADDRESS_BOOK 7289 1.37 0.10 1.78 112 T_XMDrugObfuBody_14 7279 2.10 3.11 1.77 113 XM_CamelCaseFrm001 7032 1.91 2.54 1.71 114 TR_XM_SpammyRelay 6983 4.05 11.32 1.70 115 XM_B_Unsub2 6893 1.87 2.47 1.68 116 HELO_NODOT 6842 1.65 1.59 1.67 117 HELO_NO_DOMAIN 6840 1.65 1.58 1.67 118 XM_DK_Undo_01 6735 1.79 2.26 1.64 119 XM_B_Phish66 6675 2.08 3.48 1.63 120 INVALID_MSGID 6352 1.22 0.21 1.55 121 TR_Symld_Words 6268 1.57 1.71 1.53 122 KHOP_HELO_FCRDNS 6210 3.10 8.01 1.51 123 XMSubNoVowel 5981 1.24 0.56 1.46 124 BOTNET 5956 4.22 12.80 1.45 125 TooManyTo_003 5868 1.28 0.83 1.43 126 XM_B_Investor 5748 2.08 4.19 1.40 127 SUBJ_ALL_CAPS 5729 1.55 2.03 1.40 128 MSGID_NOFQDN1 5715 1.06 0.04 1.39 129 TO_MALFORMED 5667 1.06 0.06 1.38 130 TR_XM_SpammyWords5 5621 1.98 3.87 1.37 131 XM_DIRTYINTL 5483 1.73 2.93 1.34 132 URI_HEX 5376 1.45 1.90 1.31 133 TVD_RCVD_IP 5303 1.04 0.25 1.29 134 XM_GoogleGroups 5249 1.16 0.77 1.28 135 T_XMDrugObfuBody_08 5195 1.77 3.33 1.27 136 XMGappySubj_01 5134 1.01 0.26 1.25 137 XMCapTrack 4944 1.08 0.68 1.20 138 XM_H_Long_From02 4683 1.14 1.14 1.14 139 SHORTENED_URL_HREF 4542 0.86 0.08 1.11 140 XMBSHREFv2 4391 0.88 0.29 1.07 141 TM2_M_VERY_LONG_WORD 4373 1.37 2.30 1.07 142 XM_OfRef6 4296 1.46 2.75 1.05 143 TooManyTo_004 4236 0.94 0.66 1.03 144 TR_MetaPhish_Combo_01 4207 1.03 1.05 1.02 145 TR_XM_SpammyWords2 3939 3.41 10.99 0.96 146 T_FILL_THIS_FORM_SHORT 3927 1.21 2.01 0.96 147 DKIM_ADSP_CUSTOM_MED 3738 0.98 1.20 0.91 148 HTML_FONT_FACE_BAD 3707 0.99 1.24 0.90 149 URI_TRY_3LD 3471 0.99 1.42 0.85 150 HELO_MISC_IP 3452 0.65 0.06 0.84 151 RELAYCOUNTRY_DE 3451 0.99 1.47 0.84 152 RELAYCOUNTRY_GB 3366 1.07 1.84 0.82 153 TooManyTo_005 3351 0.75 0.56 0.82 154 HTTPS_HTTP_MISMATCH 3280 0.88 1.14 0.80 155 IN_ZIMBRA_NJ_WHITELIST 3269 0.60 0.01 0.80 156 XMBrknScrpt_02 3261 1.00 1.64 0.79 157 XMGenDplmaNmb 3220 0.99 1.62 0.78 158 T_TooManySym_03 3119 0.66 0.36 0.76 159 TR_MSPIKEBAYES00 3112 0.58 0.03 0.76 160 HTML_IMAGE_ONLY_20 3096 0.70 0.53 0.75 161 RELAYCOUNTRY_CA 3083 1.71 4.70 0.75 162 XMHTML_After_End 2940 0.88 1.39 0.72 163 XMStockSpam_06 2885 0.94 1.68 0.70 164 FROM_GOV_DKIM_AU 2752 0.54 0.15 0.67 165 SpammyFromTLD_01 2701 1.20 2.87 0.66 166 XM_B_COVIDMETA 2637 1.14 2.67 0.64 167 XMBody_95 2554 0.53 0.23 0.62 168 T_XMHurry_00 2428 0.75 1.25 0.59 169 RCVD_IN_SORBS_DUL 2367 0.56 0.52 0.58 170 XM_ShortIntro_01 2335 0.60 0.70 0.57 171 XMBdyGiftCard01 2330 0.60 0.72 0.57 172 NML_ADSP_CUSTOM_MED 2296 0.65 0.95 0.56 173 XMPhish30 2268 0.69 1.10 0.55 174 XMMoneyMeta_00 2263 0.91 2.03 0.55 175 XM_B_SpammyWords4 2235 0.88 1.93 0.54 176 T_OBFU_PDF_ATTACH 2232 0.47 0.24 0.54 177 XM_ProductURIs 2197 0.57 0.67 0.54 178 RCVD_IN_BL_SPAMCOP_NET 2026 1.98 6.60 0.49 179 TVD_SPACE_RATIO_MINFP 2015 0.40 0.13 0.49 180 XMHTMLBadTable_001 2004 0.61 1.00 0.49 181 XM_H_PHPMailer 1995 0.62 1.04 0.49 182 XM_B_DNDMA 1965 0.53 0.69 0.48 183 FORGED_GMAIL_RCVD 1903 0.60 1.01 0.46 184 XMSexyCombo_01 1900 0.86 2.07 0.46 185 HTML_TAG_BALANCE_BODY 1898 0.54 0.77 0.46 186 SHORT_HELO_AND_INLINE_IMAGE 1866 0.43 0.36 0.45 187 TVD_SPACE_RATIO 1847 0.37 0.11 0.45 188 T_Symld_Words_02 1843 0.64 1.25 0.45 189 HTML_IMAGE_ONLY_28 1841 0.48 0.60 0.45 190 HTML_IMAGE_ONLY_32 1827 0.41 0.29 0.45 191 XMPhish14 1724 0.57 1.03 0.42 192 MPART_ALT_DIFF_COUNT 1713 0.47 0.63 0.42 193 FROM_GOV_SPOOF 1706 0.34 0.10 0.42 194 TM2_M_BODY_EMPTY 1702 0.34 0.13 0.41 195 XMLngstWrd_00 1637 0.39 0.37 0.40 196 NICE_REPLY_A 1630 0.31 0.04 0.40 197 XM_B_COPY_HTML 1591 0.47 0.72 0.39 198 MISSING_HEADERS 1583 0.45 0.66 0.39 199 RDNS_DYNAMIC 1567 0.48 0.79 0.38 200 XMDateMe_00 1538 0.40 0.50 0.37 ----------------------------------------------------------------------