Email: 497698 Autolearn: 0 AvgScore: 3.57 AvgScanTime: 1.29 sec Spam: 135363 Autolearn: 0 AvgScore: 14.74 AvgScanTime: 1.50 sec Ham: 362335 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.21 sec Time Spent Running SA: 177.99 hours Time Spent Processing Spam: 56.58 hours Time Spent Processing Ham: 121.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125596 86.87 92.78 84.66 2 DCC_CHECK 102819 46.28 75.96 35.19 3 DKIM_SIGNED 97902 69.82 72.33 68.89 4 RELAYCOUNTRY_US 96068 75.61 70.97 77.35 5 XM_DK_Pass 94336 68.05 69.69 67.43 6 XM_B_Unicode 93182 67.15 68.84 66.52 7 DKIM_VALID 90660 65.71 66.98 65.23 8 XM_B_SpammyWords 84411 46.69 62.36 40.84 9 XMListUnsubscribeExists 80815 46.61 59.70 41.71 10 DKIM_VALID_AU 66852 49.12 49.39 49.02 11 BAYES_50 63656 53.48 47.03 55.90 12 XM_B_Unicode3 51823 38.21 38.28 38.18 13 MIME_HTML_ONLY 50534 25.08 37.33 20.50 14 XM_B_SpammyWords2 46212 21.84 34.14 17.24 15 XM_DK_Undo_02 46120 13.62 34.07 5.97 16 HTML_FONT_LOW_CONTRAST 41609 26.29 30.74 24.63 17 LOC_TINY_FONT_1 40548 23.00 29.96 20.41 18 TR_XM_DKIM_Undo 38067 10.91 28.12 4.49 19 T_KAM_HTML_FONT_INVALID 37268 19.89 27.53 17.04 20 DKIM_VALID_EF 34441 26.06 25.44 26.30 21 BAYES_99 34169 10.50 25.24 5.00 22 FVGT_m_MULTI_ODD 33470 23.11 24.73 22.50 23 DCC_CHECK_NEGATIVE 32485 53.67 24.00 64.76 24 T_TM2_M_HEADER_IN_MSG 32128 29.60 23.73 31.79 25 XMSubLong 32059 21.30 23.68 20.41 26 RELAYCOUNTRY_META 31555 11.30 23.31 6.81 27 FSL_BULK_SIG 29940 11.39 22.12 7.38 28 UNTRUSTED_Relay 29185 9.16 21.56 4.52 29 BOTNET 27321 6.41 20.18 1.26 30 TR_DCC_Bayes_99 26657 6.88 19.69 2.09 31 XM_Multi_Part_URI 26485 15.21 19.57 13.58 32 BAYES_999 25922 8.26 19.15 4.19 33 XM_Body_Dirty_Words 25623 12.96 18.93 10.74 34 XM_UncommonTLD01 21396 6.91 15.81 3.59 35 BOTNET_IPINHOSTNAME 20538 6.90 15.17 3.81 36 RCVD_IN_MSPIKE_H2 19544 15.78 14.44 16.28 37 RCVD_IN_MSPIKE_WL 18945 21.70 14.00 24.58 38 LOTS_OF_MONEY 17000 8.31 12.56 6.72 39 T_REMOTE_IMAGE 15909 6.06 11.75 3.94 40 XM_UB50 14990 5.85 11.07 3.90 41 HTML_MIME_NO_HTML_TAG 14408 5.00 10.64 2.89 42 XM_B_SpammyWords3 14316 5.85 10.58 4.08 43 SpammyFromTLD_02 14195 3.02 10.49 0.24 44 TR_XM_SpammyWords4 13969 5.97 10.32 4.34 45 TR_XM_SpammyRelay 13874 3.82 10.25 1.42 46 XMSexyCombo_05 13834 5.38 10.22 3.57 47 KHOP_HELO_FCRDNS 13703 3.96 10.12 1.66 48 HTML_IMAGE_RATIO_02 13683 6.91 10.11 5.72 49 UNPARSEABLE_RELAY 13624 8.70 10.06 8.19 50 XM_B_Unsub 13360 9.95 9.87 9.97 51 TR_XM_UnparsRelay 13142 7.08 9.71 6.10 52 XM_Evil_Numbers_Gen 12280 8.27 9.07 7.96 53 TR_XM_SpammyWords2 12112 3.00 8.95 0.78 54 T_HTML_TAG_BALANCE_CENTER 11633 2.41 8.59 0.09 55 HTML_IMAGE_ONLY_08 11292 2.36 8.34 0.13 56 BAYES_80 10777 4.77 7.96 3.58 57 MPART_ALT_DIFF 10368 5.57 7.66 4.79 58 BAYES_60 10299 7.97 7.61 8.10 59 XM_SendGrid 10185 7.35 7.52 7.28 60 BODY_URI_ONLY 9688 1.96 7.16 0.01 61 RCVD_IN_MSPIKE_H4 9556 11.57 7.06 13.25 62 RCVD_IN_MSPIKE_H3 9117 9.56 6.74 10.61 63 MIXED_CENTER_CASE 9087 1.83 6.71 0.00 64 MIXED_HREF_CASE 9086 1.83 6.71 0.00 65 MIXED_IMG_CASE 9078 1.83 6.71 0.00 66 MIXED_AREA_CASE 9078 1.82 6.71 0.00 67 TM2_M_URI_OPT_OUT 8920 6.26 6.59 6.13 68 XMSubMetaSx_00 8844 4.66 6.53 3.96 69 TR_XM_PhishingBody 8718 4.04 6.44 3.14 70 MIXED_FONT_CASE 8628 1.73 6.37 0.00 71 LotsOfNums_01 8616 7.70 6.37 8.20 72 XM_B_Phish_Phrases 8614 4.78 6.36 4.19 73 XMNumbers 7998 3.95 5.91 3.22 74 TooManyTo_001 7912 8.02 5.85 8.83 75 T_XMDrugObfuBody_00 7460 4.08 5.51 3.54 76 RCVD_IN_BL_SPAMCOP_NET 7243 1.92 5.35 0.64 77 DKIM_INVALID 7242 4.12 5.35 3.66 78 XM_H_Long_From01 7124 4.68 5.26 4.47 79 MIME_HTML_MOSTLY 6622 2.86 4.89 2.10 80 HTML_FONT_SIZE_LARGE 6435 1.39 4.75 0.13 81 HTML_IMAGE_RATIO_04 6323 5.19 4.67 5.38 82 RELAYCOUNTRY_FR 6285 3.65 4.64 3.28 83 GOOG_STO_IMG_HTML 5716 1.15 4.22 0.00 84 ANY_BOUNCE_MESSAGE 5677 5.26 4.19 5.65 85 BOUNCE_MESSAGE 5657 5.25 4.18 5.65 86 XM_B_SpammyTLD 5536 2.65 4.09 2.11 87 BAYES_95 5477 2.69 4.05 2.18 88 RELAYCOUNTRY_CA 5462 1.67 4.04 0.79 89 TR_XM_DK_SendGrid 5397 4.44 3.99 4.61 90 XM_SPF_SoftFail 5391 2.52 3.98 1.97 91 XM_B_Investor 5350 2.07 3.95 1.37 92 URI_GOOG_STO_SPAMMY 5231 1.05 3.86 0.00 93 XMStrtUSub 5156 4.10 3.81 4.21 94 RCVD_IN_PSBL 5134 1.09 3.79 0.08 95 XMBounce_01 4935 3.17 3.65 2.99 96 XM_B_Phish66 4903 2.53 3.62 2.12 97 MIXED_CTYPE_CASE 4892 0.98 3.61 0.00 98 MIME_HTML_ONLY_MULTI 4892 3.44 3.61 3.37 99 RCVD_IN_RP_SAFE 4884 5.92 3.61 6.78 100 SpammyFromTLD_01 4662 1.48 3.44 0.74 101 T_XMDrugObfuBody_08 4596 1.85 3.40 1.28 102 HOSTED_IMG_DIRECT_MX 4539 0.91 3.35 0.00 103 XM_DrugUnitList 4532 0.91 3.35 0.00 104 TR_XM_SpammyWords5 4460 1.81 3.29 1.26 105 TR_XM_SPAMCOP 4176 1.01 3.09 0.23 106 MIME_QP_LONG_LINE 4073 4.72 3.01 5.36 107 HTML_IMAGE_RATIO_06 4061 3.37 3.00 3.51 108 XM_OfRef6 3980 1.51 2.94 0.98 109 URI_NOVOWEL 3842 2.70 2.84 2.65 110 RCVD_IN_RP_CERTIFIED 3826 5.17 2.83 6.05 111 BOTNET_NORDNS 3759 0.76 2.78 0.01 112 T_XMDrugObfuBody_14 3668 2.29 2.71 2.13 113 XMDiploma_00 3606 1.83 2.66 1.52 114 BAYES_40 3588 4.71 2.65 5.48 115 HTML_FONT_SIZE_HUGE 3547 0.74 2.62 0.04 116 TR_XM_PHPDW 3546 0.99 2.62 0.38 117 T_TooManySym_01 3545 4.69 2.62 5.46 118 HTML_IMAGE_RATIO_08 3451 2.13 2.55 1.97 119 XMNoVowels 3433 2.37 2.54 2.30 120 XM_UB80 3427 0.70 2.53 0.02 121 TR_XM_PHPForged 3377 0.90 2.49 0.31 122 XM_UB60 3350 0.75 2.47 0.11 123 ALL_TRUSTED 3315 13.07 2.45 17.04 124 BAYES_00 3138 10.31 2.32 13.29 125 XM_DIRTYINTL 3125 0.84 2.31 0.29 126 URIBL_DBL_SPAM 3025 0.61 2.23 0.01 127 XM_UB99 2987 0.60 2.21 0.00 128 XM_B_COVIDMETA 2939 1.06 2.17 0.65 129 BAYES_20 2928 3.52 2.16 4.02 130 HTML_IMAGE_ONLY_32 2889 0.99 2.13 0.57 131 PDS_OTHER_BAD_TLD 2887 0.95 2.13 0.51 132 TR_XM_SB_Phish 2884 2.07 2.13 2.04 133 MAILING_LIST_MULTI 2814 2.82 2.08 3.09 134 RCVD_IN_IADB_LISTED 2738 4.16 2.02 4.96 135 XMSubPhish11 2722 2.01 2.01 2.01 136 XM_CamelCaseFrm001 2684 1.62 1.98 1.49 137 HTML_IMAGE_ONLY_28 2665 0.86 1.97 0.45 138 TM2_M_VERY_LONG_WORD 2635 1.40 1.95 1.20 139 XM_DK_Undo_01 2602 1.72 1.92 1.64 140 XM_B_Unsub2 2593 1.56 1.92 1.43 141 HK_RANDOM_FROM 2533 0.60 1.87 0.13 142 XMSexyCombo_01 2513 1.18 1.86 0.93 143 XM_B_SpammyWords4 2480 0.92 1.83 0.57 144 XMBrknScrpt_02 2478 1.18 1.83 0.94 145 SUBJ_ALL_CAPS 2447 1.68 1.81 1.63 146 RCVD_IN_MSPIKE_BL 2441 0.56 1.80 0.09 147 URI_HEX 2429 1.39 1.79 1.23 148 XM_H_PHPMailer 2397 0.92 1.77 0.60 149 HK_RANDOM_ENVFROM 2380 0.54 1.76 0.09 150 AMAZON_IMG_NOT_RCVD_AMZN 2377 0.49 1.76 0.02 151 XM_URI_RBL 2358 0.53 1.74 0.08 152 RCVD_IN_IADB_SPF 2353 3.62 1.74 4.33 153 TR_XM_FormFill2 2350 0.70 1.74 0.31 154 RCVD_IN_RP_RNBL 2349 0.47 1.74 0.00 155 ALIBABA_IMG_NOT_RCVD_ALI 2329 0.47 1.72 0.00 156 HOSTED_IMG_MULTI 2319 0.47 1.71 0.00 157 XM_H_PHPOS 2318 0.68 1.71 0.30 158 RELAYCOUNTRY_DE 2308 0.75 1.71 0.40 159 URI_TRY_3LD 2217 1.26 1.64 1.11 160 EBAY_IMG_NOT_RCVD_EBAY 2209 0.45 1.63 0.00 161 RCVD_IN_IADB_DK 2195 3.18 1.62 3.76 162 XMGenDplmaNmb 2195 1.01 1.62 0.78 163 DATE_IN_PAST_03_06 2184 0.50 1.61 0.09 164 RCVD_IN_IADB_SENDERID 2167 3.26 1.60 3.88 165 DKIM_ADSP_CUSTOM_MED 2164 1.19 1.60 1.04 166 TR_XM_NoHeaderRelay 2146 0.57 1.59 0.20 167 T_Symld_Words_02 2133 0.81 1.58 0.53 168 FROM_EXCESS_BASE64 2089 2.20 1.54 2.45 169 XMStockSpam_06 2065 1.24 1.53 1.14 170 RELAYCOUNTRY_NL 2053 0.55 1.52 0.20 171 XMHTML_After_End 2028 1.05 1.50 0.88 172 TR_Symld_Words 2000 1.89 1.48 2.05 173 T_XMHurry_00 1991 0.83 1.47 0.59 174 DKIM_ADSP_NXDOMAIN 1945 0.63 1.44 0.33 175 TR_XM_INV_DKIM 1930 0.45 1.43 0.08 176 XMSubMetaI_00 1926 0.78 1.42 0.53 177 XMBody_17 1923 0.76 1.42 0.51 178 NML_ADSP_CUSTOM_MED 1908 0.88 1.41 0.68 179 NO_DNS_FOR_FROM 1891 0.55 1.40 0.23 180 TR_XM_COVIDMETA1 1856 0.55 1.37 0.25 181 FORGED_GMAIL_RCVD 1851 0.76 1.37 0.53 182 JH_SPAMMY_HEADERS 1837 0.37 1.36 0.00 183 URIBL_BLACK 1836 0.38 1.36 0.02 184 TR_XM_MaxWHORU 1832 0.48 1.35 0.15 185 XM_UB999 1808 0.36 1.34 0.00 186 HTTPS_HTTP_MISMATCH 1789 0.98 1.32 0.86 187 T_FILL_THIS_FORM_SHORT 1784 0.96 1.32 0.83 188 XM_B_DNDMA 1770 0.69 1.31 0.46 189 HTML_FONT_FACE_BAD 1732 1.29 1.28 1.29 190 TR_XM_COVIDMETA4 1715 0.55 1.27 0.29 191 RELAYCOUNTRY_IN 1712 0.42 1.26 0.11 192 XM_Body_Dirty_Words_01 1701 0.53 1.26 0.26 193 XM_H_Undi_Recip 1691 0.51 1.25 0.23 194 USER_IN_DEF_DKIM_WL 1684 8.79 1.24 11.61 195 RELAYCOUNTRY_GB 1674 0.98 1.24 0.88 196 DIET_1 1670 0.61 1.23 0.38 197 TR_LOTS_OF_MONEY3 1611 0.50 1.19 0.24 198 XM_PDF 1569 4.37 1.16 5.57 199 TR_XM_MSPIKECOMBO 1536 0.37 1.13 0.08 200 XMMoneyMeta_00 1520 0.69 1.12 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 306770 86.87 92.78 84.66 2 RELAYCOUNTRY_US 280255 75.61 70.97 77.35 3 DKIM_SIGNED 249610 69.82 72.33 68.89 4 XM_DK_Pass 244334 68.05 69.69 67.43 5 XM_B_Unicode 241017 67.15 68.84 66.52 6 DKIM_VALID 236363 65.71 66.98 65.23 7 DCC_CHECK_NEGATIVE 234640 53.67 24.00 64.76 8 BAYES_50 202530 53.48 47.03 55.90 9 DKIM_VALID_AU 177617 49.12 49.39 49.02 10 XMListUnsubscribeExists 151142 46.61 59.70 41.71 11 XM_B_SpammyWords 147961 46.69 62.36 40.84 12 XM_B_Unicode3 138354 38.21 38.28 38.18 13 DCC_CHECK 127514 46.28 75.96 35.19 14 T_TM2_M_HEADER_IN_MSG 115185 29.60 23.73 31.79 15 DKIM_VALID_EF 95276 26.06 25.44 26.30 16 HTML_FONT_LOW_CONTRAST 89245 26.29 30.74 24.63 17 RCVD_IN_MSPIKE_WL 89064 21.70 14.00 24.58 18 FVGT_m_MULTI_ODD 81527 23.11 24.73 22.50 19 MIME_HTML_ONLY 74295 25.08 37.33 20.50 20 XMSubLong 73962 21.30 23.68 20.41 21 LOC_TINY_FONT_1 73936 23.00 29.96 20.41 22 XM_B_SpammyWords2 62481 21.84 34.14 17.24 23 ALL_TRUSTED 61740 13.07 2.45 17.04 24 T_KAM_HTML_FONT_INVALID 61739 19.89 27.53 17.04 25 RCVD_IN_MSPIKE_H2 58973 15.78 14.44 16.28 26 XM_Multi_Part_URI 49202 15.21 19.57 13.58 27 BAYES_00 48157 10.31 2.32 13.29 28 RCVD_IN_MSPIKE_H4 48025 11.57 7.06 13.25 29 USER_IN_DEF_DKIM_WL 42056 8.79 1.24 11.61 30 XM_Body_Dirty_Words 38903 12.96 18.93 10.74 31 RCVD_IN_MSPIKE_H3 38452 9.56 6.74 10.61 32 XM_B_Unsub 36141 9.95 9.87 9.97 33 TooManyTo_001 32000 8.02 5.85 8.83 34 LotsOfNums_01 29717 7.70 6.37 8.20 35 UNPARSEABLE_RELAY 29673 8.70 10.06 8.19 36 BAYES_60 29364 7.97 7.61 8.10 37 XM_Evil_Numbers_Gen 28859 8.27 9.07 7.96 38 TR_XM_DK_Bayes 28402 5.93 0.82 7.84 39 TR_XM_DK_Bayes1 27416 5.72 0.78 7.57 40 FSL_BULK_SIG 26728 11.39 22.12 7.38 41 XM_DKIMWhitelistDomains 26672 5.37 0.04 7.36 42 XM_SendGrid 26389 7.35 7.52 7.28 43 RELAYCOUNTRY_META 24670 11.30 23.31 6.81 44 RCVD_IN_RP_SAFE 24567 5.92 3.61 6.78 45 LOTS_OF_MONEY 24335 8.31 12.56 6.72 46 TR_XM_DK_Bayes2 23112 4.83 0.70 6.38 47 TM2_M_URI_OPT_OUT 22213 6.26 6.59 6.13 48 TR_XM_UnparsRelay 22085 7.08 9.71 6.10 49 RCVD_IN_RP_CERTIFIED 21928 5.17 2.83 6.05 50 XM_DK_Undo_02 21645 13.62 34.07 5.97 51 HTML_IMAGE_RATIO_02 20725 6.91 10.11 5.72 52 ANY_BOUNCE_MESSAGE 20489 5.26 4.19 5.65 53 BOUNCE_MESSAGE 20488 5.25 4.18 5.65 54 XM_PDF 20189 4.37 1.16 5.57 55 BAYES_40 19870 4.71 2.65 5.48 56 T_TooManySym_01 19799 4.69 2.62 5.46 57 HTML_IMAGE_RATIO_04 19511 5.19 4.67 5.38 58 MIME_QP_LONG_LINE 19412 4.72 3.01 5.36 59 BAYES_99 18105 10.50 25.24 5.00 60 RCVD_IN_IADB_LISTED 17983 4.16 2.02 4.96 61 MPART_ALT_DIFF 17369 5.57 7.66 4.79 62 TR_XM_DK_SendGrid 16709 4.44 3.99 4.61 63 UNTRUSTED_Relay 16381 9.16 21.56 4.52 64 TR_XM_DKIM_Undo 16254 10.91 28.12 4.49 65 XM_H_Long_From01 16179 4.68 5.26 4.47 66 XM_H_Trusted_IP 16098 3.23 0.00 4.44 67 TR_XM_SpammyWords4 15721 5.97 10.32 4.34 68 RCVD_IN_IADB_SPF 15687 3.62 1.74 4.33 69 XMStrtUSub 15268 4.10 3.81 4.21 70 XM_B_Phish_Phrases 15198 4.78 6.36 4.19 71 BAYES_999 15182 8.26 19.15 4.19 72 XM_B_SpammyWords3 14783 5.85 10.58 4.08 73 BAYES_20 14573 3.52 2.16 4.02 74 XMSubMetaSx_00 14345 4.66 6.53 3.96 75 T_REMOTE_IMAGE 14264 6.06 11.75 3.94 76 XM_UB50 14149 5.85 11.07 3.90 77 RCVD_IN_IADB_SENDERID 14060 3.26 1.60 3.88 78 BOTNET_IPINHOSTNAME 13805 6.90 15.17 3.81 79 RCVD_IN_IADB_DK 13615 3.18 1.62 3.76 80 DKIM_INVALID 13247 4.12 5.35 3.66 81 XM_UncommonTLD01 13007 6.91 15.81 3.59 82 BAYES_80 12974 4.77 7.96 3.58 83 XMSexyCombo_05 12922 5.38 10.22 3.57 84 T_XMDrugObfuBody_00 12838 4.08 5.51 3.54 85 HTML_IMAGE_RATIO_06 12727 3.37 3.00 3.51 86 MIME_HTML_ONLY_MULTI 12221 3.44 3.61 3.37 87 RELAYCOUNTRY_FR 11886 3.65 4.64 3.28 88 XMNumbers 11662 3.95 5.91 3.22 89 TR_XM_PhishingBody 11372 4.04 6.44 3.14 90 MAILING_LIST_MULTI 11207 2.82 2.08 3.09 91 RCVD_IN_IADB_VOUCHED 10905 2.46 0.99 3.01 92 XMBounce_01 10850 3.17 3.65 2.99 93 HTML_MIME_NO_HTML_TAG 10466 5.00 10.64 2.89 94 T_TooManySym_02 9982 2.19 0.68 2.75 95 URI_NOVOWEL 9584 2.70 2.84 2.65 96 TooManyTo_002 9258 2.10 0.89 2.56 97 FROM_EXCESS_BASE64 8878 2.20 1.54 2.45 98 BAYES_05 8837 2.04 0.98 2.44 99 XMNoVowels 8346 2.37 2.54 2.30 100 BAYES_95 7915 2.69 4.05 2.18 101 T_XMDrugObfuBody_14 7710 2.29 2.71 2.13 102 XM_B_Phish66 7665 2.53 3.62 2.12 103 XM_B_SpammyTLD 7631 2.65 4.09 2.11 104 MIME_HTML_MOSTLY 7623 2.86 4.89 2.10 105 TR_DCC_Bayes_99 7572 6.88 19.69 2.09 106 TR_Symld_Words 7421 1.89 1.48 2.05 107 HELO_NODOT 7404 1.73 0.90 2.04 108 HELO_NO_DOMAIN 7404 1.73 0.90 2.04 109 TR_XM_SB_Phish 7399 2.07 2.13 2.04 110 XMSubPhish11 7274 2.01 2.01 2.01 111 XM_SPF_SoftFail 7156 2.52 3.98 1.97 112 HTML_IMAGE_RATIO_08 7151 2.13 2.55 1.97 113 RCVD_IN_IADB_OPTIN 7056 1.61 0.69 1.95 114 IN_HORDE_ADDRESS_BOOK 6974 1.42 0.08 1.92 115 INVALID_MSGID 6740 1.40 0.16 1.86 116 MSGID_NOFQDN1 6157 1.25 0.05 1.70 117 TO_MALFORMED 6061 1.23 0.03 1.67 118 TooManyTo_003 6039 1.40 0.70 1.67 119 KHOP_HELO_FCRDNS 6002 3.96 10.12 1.66 120 XM_DK_Undo_01 5937 1.72 1.92 1.64 121 SUBJ_ALL_CAPS 5915 1.68 1.81 1.63 122 XMSubNoVowel 5516 1.35 0.91 1.52 123 XMDiploma_00 5502 1.83 2.66 1.52 124 XM_CamelCaseFrm001 5391 1.62 1.98 1.49 125 TVD_RCVD_IP 5253 1.13 0.26 1.45 126 XM_B_Unsub2 5190 1.56 1.92 1.43 127 TR_XM_SpammyRelay 5146 3.82 10.25 1.42 128 XMCapTrack 5088 1.16 0.50 1.40 129 XM_B_Investor 4947 2.07 3.95 1.37 130 XM_GoogleGroups 4773 1.20 0.90 1.32 131 HTML_FONT_FACE_BAD 4679 1.29 1.28 1.29 132 T_XMDrugObfuBody_08 4622 1.85 3.40 1.28 133 BOTNET 4580 6.41 20.18 1.26 134 TR_XM_SpammyWords5 4556 1.81 3.29 1.26 135 URI_HEX 4473 1.39 1.79 1.23 136 TM2_M_VERY_LONG_WORD 4343 1.40 1.95 1.20 137 TooManyTo_004 4237 1.01 0.58 1.17 138 XMStockSpam_06 4130 1.24 1.53 1.14 139 URI_TRY_3LD 4037 1.26 1.64 1.11 140 XMGappySubj_01 4009 0.86 0.21 1.11 141 DKIM_ADSP_CUSTOM_MED 3766 1.19 1.60 1.04 142 XM_H_Long_From02 3590 1.02 1.11 0.99 143 XM_OfRef6 3550 1.51 2.94 0.98 144 XMBSHREFv2 3485 0.81 0.40 0.96 145 TooManyTo_005 3453 0.83 0.50 0.95 146 HELO_MISC_IP 3405 0.70 0.06 0.94 147 XMBrknScrpt_02 3405 1.18 1.83 0.94 148 XMSexyCombo_01 3371 1.18 1.86 0.93 149 HTML_IMAGE_ONLY_20 3249 0.73 0.28 0.90 150 RELAYCOUNTRY_GB 3195 0.98 1.24 0.88 151 XMHTML_After_End 3186 1.05 1.50 0.88 152 XM_E_Blogspot 3149 0.65 0.07 0.87 153 HTTPS_HTTP_MISMATCH 3109 0.98 1.32 0.86 154 IN_ZIMBRA_NJ_WHITELIST 3051 0.62 0.01 0.84 155 T_FILL_THIS_FORM_SHORT 3017 0.96 1.32 0.83 156 XMBody_95 3015 0.66 0.21 0.83 157 T_TooManySym_03 2915 0.66 0.27 0.80 158 RELAYCOUNTRY_CA 2846 1.67 4.04 0.79 159 TR_XM_SpammyWords2 2828 3.00 8.95 0.78 160 XMGenDplmaNmb 2809 1.01 1.62 0.78 161 TR_MetaPhish_Combo_01 2684 0.75 0.78 0.74 162 SpammyFromTLD_01 2680 1.48 3.44 0.74 163 RCVD_IN_MSPIKE_H5 2587 0.57 0.20 0.71 164 XMBody_78 2545 0.77 0.93 0.70 165 XM_ShortIntro_01 2509 0.67 0.61 0.69 166 NML_ADSP_CUSTOM_MED 2467 0.88 1.41 0.68 167 RCVD_IN_SORBS_DUL 2462 0.59 0.34 0.68 168 XM_ProductURIs 2408 0.74 0.92 0.66 169 T_OBFU_PDF_ATTACH 2364 0.52 0.16 0.65 170 XM_B_COVIDMETA 2342 1.06 2.17 0.65 171 RCVD_IN_BL_SPAMCOP_NET 2325 1.92 5.35 0.64 172 XMSexyCombo_04 2217 0.66 0.79 0.61 173 MPART_ALT_DIFF_COUNT 2183 0.67 0.83 0.60 174 XM_H_PHPMailer 2174 0.92 1.77 0.60 175 T_XMHurry_00 2138 0.83 1.47 0.59 176 XM_B_SpammyWords4 2083 0.92 1.83 0.57 177 TM2_M_BODY_EMPTY 2063 0.44 0.11 0.57 178 HTML_IMAGE_ONLY_32 2055 0.99 2.13 0.57 179 SHORT_HELO_AND_INLINE_IMAGE 1979 0.44 0.17 0.55 180 TVD_SPACE_RATIO 1951 0.43 0.15 0.54 181 XMBdyGiftCard01 1934 0.57 0.68 0.53 182 XMSubMetaI_00 1933 0.78 1.42 0.53 183 FORGED_GMAIL_RCVD 1927 0.76 1.37 0.53 184 T_Symld_Words_02 1904 0.81 1.58 0.53 185 XMMoneyMeta_00 1894 0.69 1.12 0.52 186 XMBody_17 1865 0.76 1.42 0.51 187 PDS_OTHER_BAD_TLD 1865 0.95 2.13 0.51 188 MISSING_HEADERS 1839 0.60 0.85 0.51 189 XMSubMetaSxObfu_02 1732 0.44 0.36 0.48 190 XM_B_COPY_HTML 1726 0.50 0.55 0.48 191 BASE64_LENGTH_79_INF 1697 0.42 0.29 0.47 192 TO_NO_BRKTS_HTML_ONLY 1685 0.61 1.00 0.47 193 TR_MSPIKEBAYES00 1665 0.34 0.01 0.46 194 XM_B_DNDMA 1653 0.69 1.31 0.46 195 HTML_IMAGE_ONLY_28 1639 0.86 1.97 0.45 196 FROM_GOV_SPOOF 1635 0.36 0.12 0.45 197 USER_IN_WHITELIST 1609 0.32 0.00 0.44 198 USER_IN_WELCOMELIST 1609 0.32 0.00 0.44 199 RDNS_DYNAMIC 1602 0.53 0.77 0.44 200 HTML_TAG_BALANCE_BODY 1602 0.56 0.89 0.44 ----------------------------------------------------------------------