Email: 508767 Autolearn: 0 AvgScore: 3.41 AvgScanTime: 1.49 sec Spam: 136509 Autolearn: 0 AvgScore: 14.38 AvgScanTime: 1.68 sec Ham: 372258 Autolearn: 0 AvgScore: -0.61 AvgScanTime: 1.43 sec Time Spent Running SA: 211.06 hours Time Spent Processing Spam: 63.55 hours Time Spent Processing Ham: 147.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131652 90.04 96.44 87.70 2 DKIM_SIGNED 108962 73.47 79.82 71.14 3 DCC_CHECK 107867 50.41 79.02 39.92 4 XM_DK_Pass 103731 71.35 75.99 69.65 5 RELAYCOUNTRY_US 103557 77.85 75.86 78.58 6 XM_B_Unicode 102898 72.77 75.38 71.81 7 DKIM_VALID 100277 69.24 73.46 67.69 8 XMListUnsubscribeExists 90333 51.47 66.17 46.08 9 XM_B_SpammyWords 89831 49.65 65.81 43.72 10 DKIM_VALID_AU 74020 51.10 54.22 49.96 11 BAYES_50 62919 52.43 46.09 54.75 12 XM_B_Unicode3 56865 40.52 41.66 40.11 13 XM_B_SpammyWords2 52203 24.09 38.24 18.91 14 XM_DK_Undo_02 50988 14.88 37.35 6.64 15 MIME_HTML_ONLY 48212 25.25 35.32 21.56 16 LOC_TINY_FONT_1 46414 24.66 34.00 21.23 17 HTML_FONT_LOW_CONTRAST 44916 27.25 32.90 25.18 18 TR_XM_DKIM_Undo 40580 11.48 29.73 4.80 19 T_KAM_HTML_FONT_INVALID 39286 20.89 28.78 18.00 20 DKIM_VALID_EF 37353 26.55 27.36 26.26 21 BAYES_99 37240 11.17 27.28 5.27 22 FVGT_m_MULTI_ODD 37165 23.50 27.23 22.13 23 XMSubLong 34166 21.97 25.03 20.85 24 T_TM2_M_HEADER_IN_MSG 30654 29.33 22.46 31.85 25 TR_DCC_Bayes_99 28912 7.33 21.18 2.25 26 BAYES_999 28678 8.86 21.01 4.40 27 DCC_CHECK_NEGATIVE 28593 49.54 20.95 60.03 28 RELAYCOUNTRY_META 28453 8.24 20.84 3.62 29 XM_Body_Dirty_Words 28136 13.11 20.61 10.36 30 RCVD_IN_MSPIKE_H2 25864 18.19 18.95 17.91 31 FSL_BULK_SIG 25476 10.34 18.66 7.29 32 RCVD_IN_MSPIKE_WL 23689 25.10 17.35 27.94 33 BOTNET 23341 5.72 17.10 1.55 34 UNTRUSTED_Relay 22297 5.32 16.33 1.28 35 XM_UncommonTLD01 20934 6.55 15.34 3.32 36 XM_Multi_Part_URI 20888 12.16 15.30 11.01 37 BOTNET_IPINHOSTNAME 19352 7.03 14.18 4.42 38 XM_B_SpammyWords3 18295 6.78 13.40 4.35 39 LOTS_OF_MONEY 16400 8.78 12.01 7.60 40 XM_B_Unsub 16259 9.97 11.91 9.25 41 UNPARSEABLE_RELAY 15964 9.09 11.69 8.13 42 TR_XM_UnparsRelay 15514 7.43 11.36 5.98 43 TR_XM_SpammyRelay 15396 4.14 11.28 1.52 44 SpammyFromTLD_02 14735 3.19 10.79 0.40 45 XMSexyCombo_05 13910 4.82 10.19 2.85 46 TR_XM_SpammyWords2 13629 3.28 9.98 0.82 47 XM_Evil_Numbers_Gen 13391 8.53 9.81 8.06 48 TR_XM_SpammyWords4 12988 6.16 9.51 4.93 49 RCVD_IN_MSPIKE_H3 12658 11.57 9.27 12.42 50 XM_SendGrid 12204 7.74 8.94 7.30 51 MPART_ALT_DIFF 11710 5.53 8.58 4.41 52 HTML_MIME_NO_HTML_TAG 11608 5.51 8.50 4.41 53 T_REMOTE_IMAGE 11516 5.01 8.44 3.75 54 TR_XM_PhishingBody 11421 4.62 8.37 3.24 55 XM_UB50 11392 2.80 8.35 0.77 56 HTML_IMAGE_RATIO_02 11141 5.78 8.16 4.90 57 RCVD_IN_BL_SPAMCOP_NET 10715 2.68 7.85 0.78 58 RCVD_IN_MSPIKE_H4 10483 12.01 7.68 13.60 59 HTML_IMAGE_ONLY_08 10299 2.10 7.54 0.11 60 KHOP_HELO_FCRDNS 10180 3.39 7.46 1.90 61 XM_B_Phish_Phrases 10050 4.67 7.36 3.68 62 T_HTML_TAG_BALANCE_CENTER 10042 2.02 7.36 0.07 63 BAYES_60 10002 8.46 7.33 8.88 64 BAYES_80 9786 4.66 7.17 3.73 65 LotsOfNums_01 9660 9.17 7.08 9.94 66 XMSubMetaSx_00 9263 4.24 6.79 3.30 67 DKIM_INVALID 8685 4.23 6.36 3.44 68 MIME_HTML_MOSTLY 8582 3.52 6.29 2.51 69 BODY_URI_ONLY 7820 1.54 5.73 0.01 70 XMNumbers 7730 3.71 5.66 2.99 71 MIXED_CENTER_CASE 7517 1.48 5.51 0.00 72 MIXED_HREF_CASE 7506 1.48 5.50 0.00 73 MIXED_IMG_CASE 7499 1.48 5.49 0.00 74 MIXED_AREA_CASE 7499 1.47 5.49 0.00 75 MIXED_CTYPE_CASE 7493 1.48 5.49 0.01 76 TooManyTo_001 7406 7.63 5.43 8.44 77 XM_H_Long_From01 7137 5.03 5.23 4.96 78 MIXED_FONT_CASE 7125 1.40 5.22 0.00 79 XM_B_Phish66 6975 2.83 5.11 2.00 80 HTML_IMAGE_RATIO_04 6881 5.20 5.04 5.25 81 RELAYCOUNTRY_CA 6531 1.91 4.78 0.86 82 TR_XM_DK_SendGrid 6446 4.40 4.72 4.28 83 XM_B_Investor 6268 2.23 4.59 1.36 84 HTML_FONT_SIZE_LARGE 5747 1.21 4.21 0.11 85 URI_NOVOWEL 5686 3.41 4.17 3.14 86 XM_SPF_SoftFail 5680 2.69 4.16 2.15 87 BAYES_95 5575 2.75 4.08 2.26 88 XM_B_SpammyTLD 5459 2.58 4.00 2.06 89 MIME_QP_LONG_LINE 5153 5.69 3.77 6.39 90 RCVD_IN_RP_SAFE 5100 5.81 3.74 6.57 91 TR_XM_SPAMCOP 5083 1.22 3.72 0.30 92 XMStrtUSub 5001 4.14 3.66 4.31 93 XM_OfRef6 4985 1.56 3.65 0.79 94 BOTNET_NORDNS 4922 0.97 3.61 0.01 95 GOOG_STO_IMG_HTML 4818 0.95 3.53 0.00 96 T_XMDrugObfuBody_08 4760 1.95 3.49 1.38 97 TR_XM_SpammyWords5 4601 1.96 3.37 1.44 98 MIME_HTML_ONLY_MULTI 4560 2.99 3.34 2.87 99 HTML_IMAGE_RATIO_06 4520 3.50 3.31 3.58 100 TM2_M_URI_OPT_OUT 4298 3.09 3.15 3.08 101 HTML_FONT_SIZE_HUGE 4274 0.87 3.13 0.05 102 SpammyFromTLD_01 4216 1.35 3.09 0.71 103 URI_GOOG_STO_SPAMMY 4176 0.82 3.06 0.00 104 URIBL_DBL_SPAM 4169 0.82 3.05 0.01 105 TR_XM_SB_Phish 4133 2.37 3.03 2.12 106 RCVD_IN_PSBL 4031 0.85 2.95 0.07 107 XM_B_COVIDMETA 3982 1.59 2.92 1.11 108 XM_DIRTYINTL 3965 0.97 2.90 0.26 109 RCVD_IN_RP_CERTIFIED 3949 5.11 2.89 5.92 110 XMSubPhish11 3895 2.30 2.85 2.10 111 HTML_IMAGE_RATIO_08 3884 2.51 2.85 2.39 112 T_XMDrugObfuBody_14 3790 2.22 2.78 2.02 113 BAYES_40 3759 4.72 2.75 5.44 114 XMDiploma_00 3478 1.63 2.55 1.30 115 XM_B_SpammyWords4 3433 1.06 2.51 0.52 116 XM_B_Unsub2 3409 1.61 2.50 1.29 117 T_TooManySym_01 3408 4.66 2.50 5.45 118 TM2_M_VERY_LONG_WORD 3308 1.49 2.42 1.15 119 FROM_EXCESS_BASE64 3134 2.49 2.30 2.56 120 XM_CamelCaseFrm001 3118 1.88 2.28 1.74 121 RCVD_IN_MSPIKE_BL 3073 0.67 2.25 0.10 122 MAILING_LIST_MULTI 3038 2.73 2.23 2.91 123 BAYES_20 3020 3.58 2.21 4.08 124 XM_URI_RBL 2976 0.70 2.18 0.15 125 RCVD_IN_IADB_LISTED 2973 4.89 2.18 5.88 126 JH_SPAMMY_HEADERS 2962 0.58 2.17 0.00 127 TR_XM_MSPIKECOMBO 2927 0.64 2.14 0.08 128 XM_UB60 2892 0.61 2.12 0.06 129 RCVD_IN_MSPIKE_L3 2889 0.63 2.12 0.08 130 XM_DK_Undo_01 2810 1.78 2.06 1.67 131 XMNoVowels 2799 1.86 2.05 1.80 132 XMSexyCombo_01 2754 0.89 2.02 0.48 133 TR_XM_PHPDW 2736 0.79 2.00 0.34 134 XMBody_17 2665 0.81 1.95 0.39 135 TR_XM_PHPForged 2645 0.73 1.94 0.29 136 BAYES_00 2619 10.04 1.92 13.01 137 RCVD_IN_IADB_SPF 2578 4.30 1.89 5.19 138 ALL_TRUSTED 2575 14.37 1.89 18.94 139 TR_XM_NoHeaderRelay 2502 0.63 1.83 0.19 140 SUBJ_ALL_CAPS 2497 1.76 1.83 1.74 141 XMBdyGiftCard01 2430 0.96 1.78 0.66 142 XM_Body_Dirty_Words_01 2421 0.63 1.77 0.21 143 RCVD_IN_IADB_DK 2413 3.79 1.77 4.53 144 XM_UB99 2348 0.46 1.72 0.00 145 T_XMHurry_00 2339 1.86 1.71 1.91 146 RCVD_IN_IADB_SENDERID 2336 3.87 1.71 4.66 147 URI_TRY_3LD 2313 1.15 1.69 0.94 148 HTML_IMAGE_ONLY_32 2307 0.76 1.69 0.42 149 TR_XM_FormFill2 2296 0.67 1.68 0.30 150 RELAYCOUNTRY_IN 2284 0.52 1.67 0.10 151 URI_HEX 2281 1.28 1.67 1.13 152 TO_NO_BRKTS_PCNT 2280 0.45 1.67 0.00 153 XM_H_PHPOS 2278 0.66 1.67 0.29 154 DKIM_ADSP_NXDOMAIN 2251 0.64 1.65 0.27 155 XMStockSpam_06 2171 0.98 1.59 0.76 156 TR_MetaPhish_Combo_01 2156 0.98 1.58 0.76 157 XMBrknScrpt_02 2152 1.02 1.58 0.82 158 PDS_OTHER_BAD_TLD 2115 0.65 1.55 0.32 159 T_XMDrugObfuBody_00 2066 0.82 1.51 0.57 160 USER_IN_DEF_DKIM_WL 2032 8.60 1.49 11.21 161 URIBL_BLACK 2000 0.41 1.47 0.02 162 XMGenDplmaNmb 1977 0.94 1.45 0.76 163 T_FILL_THIS_FORM_SHORT 1976 1.05 1.45 0.90 164 TR_XM_COVIDMETA4 1956 0.61 1.43 0.30 165 RELAYCOUNTRY_AU 1953 0.59 1.43 0.28 166 TR_XM_COVIDMETA1 1914 0.54 1.40 0.22 167 HTTPS_HTTP_MISMATCH 1913 0.95 1.40 0.78 168 DIET_1 1895 0.63 1.39 0.35 169 TR_Mismatch_TLD_02 1885 0.44 1.38 0.09 170 XMHTML_After_End 1876 1.03 1.37 0.90 171 RELAYCOUNTRY_NL 1844 0.47 1.35 0.15 172 MISSING_HEADERS 1818 0.67 1.33 0.42 173 TR_Symld_Words 1809 1.52 1.33 1.59 174 XM_DrugUnitList 1807 0.36 1.32 0.00 175 TR_XM_INV_DKIM 1783 0.42 1.31 0.10 176 SUBJ_ILLEGAL_CHARS 1759 0.35 1.29 0.00 177 SUBJECT_NEEDS_ENCODING 1759 0.35 1.29 0.00 178 RELAYCOUNTRY_FR 1708 0.46 1.25 0.17 179 T_Symld_Words_02 1677 0.67 1.23 0.47 180 DATE_IN_PAST_03_06 1656 0.47 1.21 0.20 181 XMPhish30 1654 0.78 1.21 0.62 182 TR_BOTNET_NEGATE 1648 0.47 1.21 0.20 183 BAYES_05 1579 2.19 1.16 2.57 184 XM_UB80 1567 0.32 1.15 0.02 185 RCVD_IN_RP_RNBL 1555 0.32 1.14 0.02 186 XMPhish14 1548 0.54 1.13 0.33 187 XM_UB999 1538 0.30 1.13 0.00 188 WANT_TO_ORDER 1529 0.30 1.12 0.00 189 TR_LOTS_OF_MONEY3 1523 0.55 1.12 0.34 190 XM_BadFromFormat 1495 0.36 1.10 0.09 191 RCVD_IN_IADB_VOUCHED 1493 2.83 1.09 3.47 192 DKIM_ADSP_CUSTOM_MED 1487 0.99 1.09 0.95 193 RELAYCOUNTRY_CN 1475 0.37 1.08 0.10 194 XM_H_PHPMailer 1471 0.72 1.08 0.58 195 RELAYCOUNTRY_DE 1466 0.56 1.07 0.37 196 XMSubNoVowel 1455 1.17 1.07 1.21 197 RELAYCOUNTRY_GB 1428 0.85 1.05 0.78 198 MIME_CHARSET_FARAWAY 1364 0.41 1.00 0.19 199 FROM_SUSPICIOUS_NTLD 1357 0.31 0.99 0.06 200 XM_PDF 1327 4.00 0.97 5.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 326462 90.04 96.44 87.70 2 RELAYCOUNTRY_US 292520 77.85 75.86 78.58 3 XM_B_Unicode 267328 72.77 75.38 71.81 4 DKIM_SIGNED 264821 73.47 79.82 71.14 5 XM_DK_Pass 259283 71.35 75.99 69.65 6 DKIM_VALID 251998 69.24 73.46 67.69 7 DCC_CHECK_NEGATIVE 223458 49.54 20.95 60.03 8 BAYES_50 203816 52.43 46.09 54.75 9 DKIM_VALID_AU 185982 51.10 54.22 49.96 10 XMListUnsubscribeExists 171534 51.47 66.17 46.08 11 XM_B_SpammyWords 162761 49.65 65.81 43.72 12 XM_B_Unicode3 149308 40.52 41.66 40.11 13 DCC_CHECK 148600 50.41 79.02 39.92 14 T_TM2_M_HEADER_IN_MSG 118572 29.33 22.46 31.85 15 RCVD_IN_MSPIKE_WL 103996 25.10 17.35 27.94 16 DKIM_VALID_EF 97739 26.55 27.36 26.26 17 HTML_FONT_LOW_CONTRAST 93743 27.25 32.90 25.18 18 FVGT_m_MULTI_ODD 82397 23.50 27.23 22.13 19 MIME_HTML_ONLY 80254 25.25 35.32 21.56 20 LOC_TINY_FONT_1 79038 24.66 34.00 21.23 21 XMSubLong 77617 21.97 25.03 20.85 22 ALL_TRUSTED 70515 14.37 1.89 18.94 23 XM_B_SpammyWords2 70377 24.09 38.24 18.91 24 T_KAM_HTML_FONT_INVALID 67007 20.89 28.78 18.00 25 RCVD_IN_MSPIKE_H2 66674 18.19 18.95 17.91 26 RCVD_IN_MSPIKE_H4 50636 12.01 7.68 13.60 27 BAYES_00 48444 10.04 1.92 13.01 28 RCVD_IN_MSPIKE_H3 46230 11.57 9.27 12.42 29 USER_IN_DEF_DKIM_WL 41734 8.60 1.49 11.21 30 XM_Multi_Part_URI 40982 12.16 15.30 11.01 31 XM_Body_Dirty_Words 38567 13.11 20.61 10.36 32 LotsOfNums_01 37007 9.17 7.08 9.94 33 XM_B_Unsub 34440 9.97 11.91 9.25 34 BAYES_60 33060 8.46 7.33 8.88 35 TooManyTo_001 31436 7.63 5.43 8.44 36 UNPARSEABLE_RELAY 30281 9.09 11.69 8.13 37 XM_Evil_Numbers_Gen 30018 8.53 9.81 8.06 38 TR_XM_DK_Bayes 29285 5.95 0.74 7.87 39 TR_XM_DK_Bayes1 28360 5.76 0.70 7.62 40 LOTS_OF_MONEY 28292 8.78 12.01 7.60 41 XM_SendGrid 27172 7.74 8.94 7.30 42 FSL_BULK_SIG 27146 10.34 18.66 7.29 43 XM_DK_Undo_02 24723 14.88 37.35 6.64 44 XM_DKIMWhitelistDomains 24492 4.82 0.04 6.58 45 RCVD_IN_RP_SAFE 24470 5.81 3.74 6.57 46 TR_XM_DK_Bayes2 23803 4.83 0.58 6.39 47 MIME_QP_LONG_LINE 23791 5.69 3.77 6.39 48 TR_XM_UnparsRelay 22262 7.43 11.36 5.98 49 RCVD_IN_RP_CERTIFIED 22040 5.11 2.89 5.92 50 RCVD_IN_IADB_LISTED 21887 4.89 2.18 5.88 51 T_TooManySym_01 20286 4.66 2.50 5.45 52 BAYES_40 20241 4.72 2.75 5.44 53 BAYES_99 19602 11.17 27.28 5.27 54 HTML_IMAGE_RATIO_04 19551 5.20 5.04 5.25 55 RCVD_IN_IADB_SPF 19302 4.30 1.89 5.19 56 XM_PDF 19000 4.00 0.97 5.10 57 XM_H_Long_From01 18472 5.03 5.23 4.96 58 TR_XM_SpammyWords4 18345 6.16 9.51 4.93 59 HTML_IMAGE_RATIO_02 18256 5.78 8.16 4.90 60 TR_XM_DKIM_Undo 17850 11.48 29.73 4.80 61 RCVD_IN_IADB_SENDERID 17357 3.87 1.71 4.66 62 RCVD_IN_IADB_DK 16851 3.79 1.77 4.53 63 BOTNET_IPINHOSTNAME 16438 7.03 14.18 4.42 64 HTML_MIME_NO_HTML_TAG 16419 5.51 8.50 4.41 65 MPART_ALT_DIFF 16407 5.53 8.58 4.41 66 BAYES_999 16379 8.86 21.01 4.40 67 XM_B_SpammyWords3 16191 6.78 13.40 4.35 68 XMStrtUSub 16050 4.14 3.66 4.31 69 TR_XM_DK_SendGrid 15924 4.40 4.72 4.28 70 BAYES_20 15175 3.58 2.21 4.08 71 T_REMOTE_IMAGE 13958 5.01 8.44 3.75 72 BAYES_80 13903 4.66 7.17 3.73 73 XM_B_Phish_Phrases 13712 4.67 7.36 3.68 74 RELAYCOUNTRY_META 13477 8.24 20.84 3.62 75 HTML_IMAGE_RATIO_06 13309 3.50 3.31 3.58 76 RCVD_IN_IADB_VOUCHED 12924 2.83 1.09 3.47 77 DKIM_INVALID 12823 4.23 6.36 3.44 78 XM_UncommonTLD01 12371 6.55 15.34 3.32 79 XMSubMetaSx_00 12290 4.24 6.79 3.30 80 TR_XM_PhishingBody 12066 4.62 8.37 3.24 81 XM_H_Trusted_IP 12050 2.37 0.00 3.24 82 URI_NOVOWEL 11679 3.41 4.17 3.14 83 TM2_M_URI_OPT_OUT 11448 3.09 3.15 3.08 84 XMNumbers 11137 3.71 5.66 2.99 85 MAILING_LIST_MULTI 10845 2.73 2.23 2.91 86 MIME_HTML_ONLY_MULTI 10677 2.99 3.34 2.87 87 XMSexyCombo_05 10600 4.82 10.19 2.85 88 T_TooManySym_02 10199 2.18 0.66 2.74 89 BAYES_05 9549 2.19 1.16 2.57 90 FROM_EXCESS_BASE64 9547 2.49 2.30 2.56 91 ANY_BOUNCE_MESSAGE 9532 2.05 0.68 2.56 92 BOUNCE_MESSAGE 9531 2.05 0.67 2.56 93 MIME_HTML_MOSTLY 9331 3.52 6.29 2.51 94 HTML_IMAGE_RATIO_08 8880 2.51 2.85 2.39 95 TooManyTo_002 8580 1.90 0.78 2.30 96 BAYES_95 8407 2.75 4.08 2.26 97 TR_DCC_Bayes_99 8381 7.33 21.18 2.25 98 T_HTML_ATTACH 8373 1.73 0.32 2.25 99 RCVD_IN_IADB_OPTIN 8185 1.81 0.74 2.20 100 XM_SPF_SoftFail 7986 2.69 4.16 2.15 101 TR_XM_SB_Phish 7900 2.37 3.03 2.12 102 XMSubPhish11 7809 2.30 2.85 2.10 103 XM_B_SpammyTLD 7657 2.58 4.00 2.06 104 T_XMDrugObfuBody_14 7506 2.22 2.78 2.02 105 XM_B_Phish66 7428 2.83 5.11 2.00 106 RCVD_IN_MSPIKE_H5 7130 1.51 0.40 1.92 107 T_XMHurry_00 7110 1.86 1.71 1.91 108 IN_HORDE_ADDRESS_BOOK 7102 1.42 0.09 1.91 109 KHOP_HELO_FCRDNS 7079 3.39 7.46 1.90 110 TVD_RCVD_IP 7020 1.42 0.15 1.89 111 HELO_NODOT 6891 1.51 0.56 1.85 112 HELO_NO_DOMAIN 6891 1.51 0.56 1.85 113 INVALID_MSGID 6742 1.36 0.12 1.81 114 XMNoVowels 6685 1.86 2.05 1.80 115 SUBJ_ALL_CAPS 6475 1.76 1.83 1.74 116 XM_CamelCaseFrm001 6463 1.88 2.28 1.74 117 XM_DK_Undo_01 6234 1.78 2.06 1.67 118 MSGID_NOFQDN1 6229 1.23 0.04 1.67 119 TO_MALFORMED 6076 1.20 0.00 1.63 120 TR_Symld_Words 5919 1.52 1.33 1.59 121 TooManyTo_003 5801 1.30 0.59 1.56 122 BOTNET 5781 5.72 17.10 1.55 123 TR_XM_SpammyRelay 5665 4.14 11.28 1.52 124 DATE_IN_PAST_06_12 5533 1.26 0.63 1.49 125 TR_XM_SpammyWords5 5355 1.96 3.37 1.44 126 T_XMDrugObfuBody_08 5151 1.95 3.49 1.38 127 XM_B_Investor 5064 2.23 4.59 1.36 128 XMDiploma_00 4822 1.63 2.55 1.30 129 XM_B_Unsub2 4789 1.61 2.50 1.29 130 UNTRUSTED_Relay 4781 5.32 16.33 1.28 131 XM_GoogleGroups 4718 1.16 0.88 1.27 132 XMCapTrack 4639 1.02 0.42 1.25 133 XMGappySubj_01 4553 0.94 0.15 1.22 134 XMSubNoVowel 4522 1.17 1.07 1.21 135 XM_H_Long_From02 4416 1.09 0.82 1.19 136 TM2_M_VERY_LONG_WORD 4296 1.49 2.42 1.15 137 URI_HEX 4208 1.28 1.67 1.13 138 XM_B_COVIDMETA 4128 1.59 2.92 1.11 139 TooManyTo_004 3996 0.92 0.49 1.07 140 XMBSHREFv2 3861 0.85 0.33 1.04 141 HTML_FONT_FACE_BAD 3776 0.89 0.54 1.01 142 IN_ZIMBRA_NJ_WHITELIST 3582 0.71 0.01 0.96 143 DKIM_ADSP_CUSTOM_MED 3537 0.99 1.09 0.95 144 URI_TRY_3LD 3516 1.15 1.69 0.94 145 HELO_MISC_IP 3358 0.67 0.04 0.90 146 XMHTML_After_End 3348 1.03 1.37 0.90 147 T_FILL_THIS_FORM_SHORT 3346 1.05 1.45 0.90 148 RELAYCOUNTRY_CA 3210 1.91 4.78 0.86 149 TooManyTo_005 3135 0.73 0.43 0.84 150 T_TooManySym_03 3102 0.67 0.23 0.83 151 HTML_IMAGE_ONLY_20 3056 0.76 0.61 0.82 152 TR_XM_SpammyWords2 3055 3.28 9.98 0.82 153 XMBrknScrpt_02 3043 1.02 1.58 0.82 154 XM_OfRef6 2953 1.56 3.65 0.79 155 FROM_GOV_DKIM_AU 2928 0.68 0.39 0.79 156 RCVD_IN_BL_SPAMCOP_NET 2917 2.68 7.85 0.78 157 XMBody_95 2899 0.62 0.20 0.78 158 HTTPS_HTTP_MISMATCH 2898 0.95 1.40 0.78 159 RELAYCOUNTRY_GB 2894 0.85 1.05 0.78 160 XM_UB50 2866 2.80 8.35 0.77 161 XM_ProductURIs 2865 0.81 0.93 0.77 162 XMStockSpam_06 2821 0.98 1.59 0.76 163 XMGenDplmaNmb 2818 0.94 1.45 0.76 164 TR_MetaPhish_Combo_01 2816 0.98 1.58 0.76 165 SpammyFromTLD_01 2630 1.35 3.09 0.71 166 XM_ShortIntro_01 2568 0.63 0.45 0.69 167 MPART_ALT_DIFF_COUNT 2510 0.72 0.83 0.67 168 XMBdyGiftCard01 2443 0.96 1.78 0.66 169 T_OBFU_PDF_ATTACH 2424 0.52 0.15 0.65 170 XMPhish30 2315 0.78 1.21 0.62 171 NML_ADSP_CUSTOM_MED 2292 0.70 0.94 0.62 172 HTML_TAG_BALANCE_BODY 2282 0.71 0.96 0.61 173 XM_H_PHPMailer 2170 0.72 1.08 0.58 174 RCVD_IN_SORBS_DUL 2127 0.56 0.52 0.57 175 T_XMDrugObfuBody_00 2125 0.82 1.51 0.57 176 TR_MSPIKEBAYES00 1955 0.40 0.04 0.53 177 SHORT_HELO_AND_INLINE_IMAGE 1954 0.40 0.08 0.52 178 XM_B_SpammyWords4 1954 1.06 2.51 0.52 179 TVD_SPACE_RATIO 1907 0.40 0.11 0.51 180 FORGED_GMAIL_RCVD 1883 0.62 0.94 0.51 181 XMLngstWrd_00 1857 0.53 0.63 0.50 182 XMMoneyMeta_00 1819 0.58 0.85 0.49 183 XMSexyCombo_01 1784 0.89 2.02 0.48 184 T_Symld_Words_02 1749 0.67 1.23 0.47 185 TM2_M_BODY_EMPTY 1721 0.37 0.13 0.46 186 XMSubMetaI_00 1718 0.59 0.95 0.46 187 XM_B_COPY_HTML 1711 0.50 0.59 0.46 188 XMLngstWrd_01 1685 0.49 0.60 0.45 189 XMDateMe_00 1620 0.41 0.33 0.44 190 RDNS_DYNAMIC 1613 0.47 0.57 0.43 191 XMHTMLBadTable_001 1591 0.47 0.60 0.43 192 MISSING_HEADERS 1579 0.67 1.33 0.42 193 HTML_IMAGE_ONLY_28 1560 0.43 0.48 0.42 194 USER_IN_WHITELIST 1554 0.31 0.00 0.42 195 USER_IN_WELCOMELIST 1554 0.31 0.00 0.42 196 HTML_IMAGE_ONLY_32 1549 0.76 1.69 0.42 197 MSGID_FROM_MTA_HEADER 1490 0.36 0.25 0.40 198 SpammyFromTLD_02 1476 3.19 10.79 0.40 199 TVD_SPACE_RATIO_MINFP 1471 0.33 0.17 0.40 200 XMBody_17 1452 0.81 1.95 0.39 ----------------------------------------------------------------------