Email: 517071 Autolearn: 0 AvgScore: 3.65 AvgScanTime: 1.25 sec Spam: 158572 Autolearn: 0 AvgScore: 15.35 AvgScanTime: 1.30 sec Ham: 358499 Autolearn: 0 AvgScore: -1.53 AvgScanTime: 1.23 sec Time Spent Running SA: 179.43 hours Time Spent Processing Spam: 57.18 hours Time Spent Processing Ham: 122.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152503 89.00 96.17 85.83 2 RELAYCOUNTRY_US 107780 76.33 67.97 80.03 3 XM_B_SpammyWords 101433 49.66 63.97 43.33 4 DKIM_SIGNED 101091 67.80 63.75 69.60 5 XM_DK_Pass 96408 65.72 60.80 67.90 6 XM_B_Unicode 95545 64.86 60.25 66.90 7 DKIM_VALID 92528 63.40 58.35 65.63 8 DCC_CHECK 86547 39.96 54.58 33.50 9 XMListUnsubscribeExists 84107 45.47 53.04 42.12 10 BAYES_50 78564 52.72 49.54 54.13 11 MIME_HTML_ONLY 76607 28.57 48.31 19.83 12 DCC_CHECK_NEGATIVE 71977 60.00 45.39 66.46 13 DKIM_VALID_AU 69332 47.62 43.72 49.35 14 XM_B_Unicode3 52303 37.41 32.98 39.36 15 XM_DK_Undo_02 47029 13.23 29.66 5.96 16 HTML_MIME_NO_HTML_TAG 46970 10.74 29.62 2.39 17 XM_B_SpammyWords2 45178 20.24 28.49 16.59 18 HTML_SHORT_LINK_IMG_1 42279 8.21 26.66 0.05 19 LOC_TINY_FONT_1 42088 22.60 26.54 20.86 20 BOTNET 42057 9.16 26.52 1.48 21 UNTRUSTED_Relay 41217 8.91 25.99 1.36 22 RELAYCOUNTRY_META 41177 10.51 25.97 3.68 23 TR_XM_DKIM_Undo 39022 10.56 24.61 4.35 24 XM_UncommonTLD01 37916 9.79 23.91 3.54 25 FVGT_m_MULTI_ODD 36386 22.46 22.95 22.24 26 HTML_FONT_LOW_CONTRAST 35935 24.97 22.66 25.99 27 DKIM_VALID_EF 35172 25.56 22.18 27.05 28 XM_Multi_Part_URI 34470 14.20 21.74 10.87 29 T_KAM_HTML_FONT_INVALID 34245 17.91 21.60 16.28 30 XMSubLong 33581 22.22 21.18 22.68 31 BAYES_99 33405 9.43 21.07 4.29 32 RCVD_IN_MSPIKE_H2 32085 20.39 20.23 20.46 33 T_TM2_M_HEADER_IN_MSG 29633 29.15 18.69 33.77 34 XM_Body_Dirty_Words 26800 13.33 16.90 11.74 35 BAYES_999 25719 7.36 16.22 3.44 36 XM_UB50 25009 5.46 15.77 0.90 37 TR_DCC_Bayes_99 24947 5.88 15.73 1.52 38 GOOG_STO_IMG_HTML 24451 4.73 15.42 0.00 39 RCVD_IN_MSPIKE_WL 23941 23.91 15.10 27.80 40 HTML_IMAGE_ONLY_08 22786 4.49 14.37 0.12 41 BODY_URI_ONLY 21197 4.11 13.37 0.01 42 HTML_FONT_SIZE_LARGE 21181 4.18 13.36 0.12 43 TR_XM_SpammyRelay 20586 4.99 12.98 1.45 44 HTML_TAG_BALANCE_CENTER 19526 3.84 12.31 0.09 45 FROM_SUSPICIOUS_NTLD 18195 3.55 11.47 0.05 46 FROM_SUSPICIOUS_NTLD_FP 18091 3.53 11.41 0.05 47 XMStrtUSub 18003 6.36 11.35 4.15 48 HTML_IMAGE_ONLY_04 16845 3.32 10.62 0.08 49 SHORT_IMG_SUSP_NTLD 16691 3.23 10.53 0.00 50 LOTS_OF_MONEY 15663 8.42 9.88 7.78 51 BOTNET_IPINHOSTNAME 15112 5.73 9.53 4.05 52 UNPARSEABLE_RELAY 14738 8.05 9.29 7.50 53 TR_XM_PHPDW 14598 3.09 9.21 0.38 54 RCVD_IN_MSPIKE_H3 14574 12.91 9.19 14.55 55 TR_XM_PHPForged 14506 3.03 9.15 0.33 56 TR_XM_FormFill2 14476 3.03 9.13 0.33 57 XM_H_PHPOS 14467 3.02 9.12 0.32 58 FSL_BULK_SIG 14426 7.08 9.10 6.19 59 TR_XM_UnparsRelay 14261 6.61 8.99 5.55 60 MPART_ALT_DIFF 14080 6.19 8.88 5.00 61 XM_B_SpammyWords3 13605 5.34 8.58 3.91 62 XMNumbers 13179 5.30 8.31 3.97 63 SpammyFromTLD_02 13134 2.71 8.28 0.25 64 XM_H_PHPMailer 13015 2.93 8.21 0.60 65 TR_XM_SpammyWords4 13009 5.75 8.20 4.66 66 XM_B_Unsub 12621 10.21 7.96 11.21 67 XM_H_PHPOS_M 12608 2.51 7.95 0.10 68 SpammyFromTLD_01 12552 2.97 7.92 0.78 69 TO_NO_BRKTS_HTML_ONLY 12250 2.63 7.73 0.38 70 FROM_NTLD_LINKBAIT 12249 2.37 7.72 0.00 71 XM_SPF_SoftFail 12150 5.55 7.66 4.62 72 RCVD_IN_BL_SPAMCOP_NET 11860 2.95 7.48 0.95 73 TR_XM_SpammyWords2 11498 2.73 7.25 0.73 74 BAYES_60 11341 8.09 7.15 8.51 75 XM_Evil_Numbers_Gen 11330 7.40 7.15 7.52 76 XMSexyCombo_05 10696 4.61 6.75 3.66 77 XM_SendGrid 10151 6.23 6.40 6.15 78 BAYES_80 10056 4.55 6.34 3.76 79 HDRS_MISSP 9749 1.91 6.15 0.03 80 XMGappySubj_01 9653 2.73 6.09 1.24 81 XM_BadFromFormat 9569 1.94 6.03 0.13 82 HTML_IMAGE_RATIO_02 9366 6.00 5.91 6.04 83 RELAYCOUNTRY_RU 8938 1.75 5.64 0.03 84 RCVD_IN_MSPIKE_H4 8696 9.47 5.48 11.24 85 TR_XM_PhishingBody 8600 3.93 5.42 3.27 86 RCVD_IN_MSPIKE_BL 8594 2.24 5.42 0.83 87 TR_XM_MSPIKECOMBO 8582 2.23 5.41 0.82 88 DKIM_INVALID 8563 4.40 5.40 3.96 89 MIME_HTML_MOSTLY 8499 3.18 5.36 2.22 90 LotsOfNums_01 8483 7.43 5.35 8.35 91 NO_DNS_FOR_FROM 8197 1.83 5.17 0.35 92 URI_NOVOWEL 7612 3.35 4.80 2.72 93 TooManyTo_001 7449 8.52 4.70 10.21 94 FROM_MISSP_REPLYTO 7353 1.43 4.64 0.02 95 XM_B_Phish_Phrases 7282 3.76 4.59 3.40 96 BAYES_40 7261 5.29 4.58 5.60 97 XM_B_Investor 6965 2.39 4.39 1.51 98 XMSubMetaSx_00 6800 4.86 4.29 5.11 99 XM_H_Long_From01 6774 4.59 4.27 4.74 100 RELAYCOUNTRY_PL 6532 1.29 4.12 0.04 101 T_REMOTE_IMAGE 6503 3.75 4.10 3.59 102 BOTNET_NORDNS 6416 1.25 4.05 0.02 103 RELAYCOUNTRY_CA 6281 1.77 3.96 0.81 104 MIME_HTML_ONLY_MULTI 6276 3.56 3.96 3.39 105 BAYES_00 6157 11.48 3.88 14.84 106 TR_XM_DK_SendGrid 5760 3.78 3.63 3.84 107 TR_XM_SPAMCOP 5685 1.46 3.59 0.51 108 DKIM_ADSP_NXDOMAIN 5591 1.35 3.53 0.39 109 TR_XM_SpammyWords5 5517 1.97 3.48 1.31 110 XM_XX_Yahoo 5332 1.06 3.36 0.05 111 BAYES_95 5244 2.51 3.31 2.16 112 HTML_IMAGE_RATIO_04 5203 4.57 3.28 5.14 113 TM2_M_VERY_LONG_WORD 5186 1.86 3.27 1.24 114 TR_XM_MaxWHORU 5015 1.14 3.16 0.25 115 XMGappySubj_02 4951 1.08 3.12 0.17 116 URIBL_DBL_SPAM 4906 0.95 3.09 0.00 117 HTML_IMAGE_ONLY_12 4874 1.14 3.07 0.29 118 TM2_M_URI_OPT_OUT 4816 3.72 3.04 4.03 119 MIME_QP_LONG_LINE 4728 5.16 2.98 6.12 120 BAYES_20 4667 3.73 2.94 4.08 121 KHOP_HELO_FCRDNS 4643 3.02 2.93 3.06 122 RCVD_IN_VALIDITY_SAFE 4385 4.20 2.77 4.83 123 XM_B_SpammyTLD 4320 2.20 2.72 1.96 124 TR_XM_SpammyWords3 4262 1.12 2.69 0.42 125 HK_RANDOM_FROM 4223 0.90 2.66 0.12 126 RELAYCOUNTRY_FR 4200 0.97 2.65 0.23 127 XM_OfRef6 4178 1.53 2.63 1.05 128 XM_B_Phish66 4148 2.26 2.62 2.10 129 JH_SPAMMY_HEADERS 4139 0.80 2.61 0.00 130 T_XMDrugObfuBody_14 4075 2.40 2.57 2.33 131 RCVD_IN_MSPIKE_L3 3993 1.04 2.52 0.38 132 T_HTML_TAG_BALANCE_CENTER 3944 0.77 2.49 0.02 133 XM_GoogleGroups 3790 1.98 2.39 1.80 134 HTML_IMAGE_RATIO_06 3671 2.94 2.32 3.22 135 SUBJ_ALL_CAPS 3638 2.18 2.29 2.13 136 XMDiploma_00 3600 1.55 2.27 1.23 137 T_FILL_THIS_FORM_SHORT 3588 1.31 2.26 0.89 138 RCVD_IN_VALIDITY_CERTIFIED 3481 3.61 2.20 4.24 139 TR_XM_MaxUnsub 3470 1.11 2.19 0.64 140 XM_DIRTYINTL 3399 0.89 2.14 0.33 141 XM_UB60 3361 0.70 2.12 0.07 142 BODY_EMPTY 3275 0.64 2.07 0.00 143 T_TooManySym_01 3261 5.73 2.06 7.35 144 XM_DK_Undo_01 3164 1.77 2.00 1.67 145 T_XMDrugObfuBody_08 3121 1.51 1.97 1.31 146 HTML_FONT_SIZE_HUGE 3052 0.62 1.92 0.05 147 RCVD_IN_IADB_LISTED 3045 3.87 1.92 4.73 148 HTML_TITLE_SUBJ_DIFF 2837 0.72 1.79 0.25 149 XMLngstWrd_00 2822 1.03 1.78 0.70 150 RCVD_IN_MSPIKE_L5 2799 0.66 1.77 0.17 151 ALL_TRUSTED 2782 12.73 1.75 17.59 152 XMLngstWrd_01 2774 0.97 1.75 0.63 153 MAILING_LIST_MULTI 2720 3.03 1.72 3.61 154 XMLngstWrd_02 2707 0.90 1.71 0.55 155 TO_NO_BRKTS_FROM_MSSP 2695 0.54 1.70 0.03 156 XMLngstWrd_03 2673 0.82 1.69 0.44 157 RELAYCOUNTRY_KR 2670 0.53 1.68 0.02 158 XM_B_COVIDMETA 2633 0.88 1.66 0.54 159 XMBody_17 2627 0.84 1.66 0.49 160 XMLngstWrd_04 2619 0.77 1.65 0.38 161 UPPERCASE_75_100 2554 0.66 1.61 0.23 162 XM_CamelCaseFrm001 2545 1.57 1.60 1.56 163 TR_XM_SB_Phish 2497 2.16 1.57 2.41 164 RCVD_IN_IADB_SPF 2479 3.35 1.56 4.15 165 TR_XM_COVIDMETA4 2467 0.72 1.56 0.35 166 XMSubPhish11 2444 2.12 1.54 2.38 167 XMStockSpam_06 2415 1.27 1.52 1.15 168 IMG_ONLY_FM_DOM_INFO 2379 0.46 1.50 0.00 169 TR_Symld_Words 2363 1.62 1.49 1.68 170 HTML_IMAGE_RATIO_08 2350 3.34 1.48 4.15 171 FROM_EXCESS_BASE64 2334 1.96 1.47 2.18 172 XMSexyCombo_01 2281 1.86 1.44 2.04 173 RCVD_IN_IADB_DK 2277 2.94 1.44 3.60 174 RCVD_IN_IADB_SENDERID 2266 3.02 1.43 3.73 175 XM_URI_RBL 2216 0.51 1.40 0.11 176 TR_XM_FormFill 2168 0.43 1.37 0.01 177 TR_XM_NoHeaderRelay 2165 0.55 1.37 0.19 178 XM_B_SpammyWords4 2152 0.71 1.36 0.42 179 RCVD_IN_VALIDITY_RPBL 2130 0.45 1.34 0.06 180 XM_B_Unsub2 2088 1.46 1.32 1.53 181 HK_RANDOM_REPLYTO 2083 0.45 1.31 0.07 182 XMMoneyMeta_00 2082 0.79 1.31 0.56 183 RCVD_IN_PSBL 2065 0.43 1.30 0.05 184 XMPhish08 1967 0.51 1.24 0.18 185 URI_HEX 1959 1.32 1.24 1.36 186 XM_Body_Dirty_Words_01 1948 0.49 1.23 0.16 187 XM_UB99 1931 0.38 1.22 0.00 188 TR_XM_INV_DKIM 1928 0.46 1.22 0.13 189 TR_MetaPhish_Combo_01 1878 0.95 1.18 0.85 190 HTML_TAG_BALANCE_BODY 1871 0.82 1.18 0.66 191 XMBrknScrpt_02 1856 0.99 1.17 0.91 192 BAYES_05 1851 2.17 1.17 2.61 193 XMGenDplmaNmb 1810 0.82 1.14 0.68 194 XMHTML_After_End 1804 0.96 1.14 0.89 195 RCVD_IN_MSPIKE_L4 1790 0.53 1.13 0.26 196 HDRS_LCASE_IMGONLY 1790 0.38 1.13 0.05 197 RCVD_IN_IADB_VOUCHED 1771 2.36 1.12 2.91 198 URIBL_BLACK 1764 0.37 1.11 0.04 199 XM_UB80 1755 0.35 1.11 0.02 200 FVGT_m_MULTI_ODD_EMAIL 1695 0.35 1.07 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 307685 89.00 96.17 85.83 2 RELAYCOUNTRY_US 286893 76.33 67.97 80.03 3 DKIM_SIGNED 249498 67.80 63.75 69.60 4 XM_DK_Pass 243417 65.72 60.80 67.90 5 XM_B_Unicode 239832 64.86 60.25 66.90 6 DCC_CHECK_NEGATIVE 238248 60.00 45.39 66.46 7 DKIM_VALID 235294 63.40 58.35 65.63 8 BAYES_50 194048 52.72 49.54 54.13 9 DKIM_VALID_AU 176909 47.62 43.72 49.35 10 XM_B_SpammyWords 155337 49.66 63.97 43.33 11 XMListUnsubscribeExists 151002 45.47 53.04 42.12 12 XM_B_Unicode3 141120 37.41 32.98 39.36 13 T_TM2_M_HEADER_IN_MSG 121068 29.15 18.69 33.77 14 DCC_CHECK 120094 39.96 54.58 33.50 15 RCVD_IN_MSPIKE_WL 99666 23.91 15.10 27.80 16 DKIM_VALID_EF 96980 25.56 22.18 27.05 17 HTML_FONT_LOW_CONTRAST 93188 24.97 22.66 25.99 18 XMSubLong 81300 22.22 21.18 22.68 19 FVGT_m_MULTI_ODD 79732 22.46 22.95 22.24 20 LOC_TINY_FONT_1 74779 22.60 26.54 20.86 21 RCVD_IN_MSPIKE_H2 73355 20.39 20.23 20.46 22 MIME_HTML_ONLY 71102 28.57 48.31 19.83 23 ALL_TRUSTED 63061 12.73 1.75 17.59 24 XM_B_SpammyWords2 59487 20.24 28.49 16.59 25 T_KAM_HTML_FONT_INVALID 58358 17.91 21.60 16.28 26 BAYES_00 53201 11.48 3.88 14.84 27 RCVD_IN_MSPIKE_H3 52164 12.91 9.19 14.55 28 XM_Body_Dirty_Words 42102 13.33 16.90 11.74 29 RCVD_IN_MSPIKE_H4 40278 9.47 5.48 11.24 30 XM_B_Unsub 40191 10.21 7.96 11.21 31 XM_Multi_Part_URI 38952 14.20 21.74 10.87 32 USER_IN_DEF_DKIM_WL 38724 7.77 0.93 10.80 33 TooManyTo_001 36602 8.52 4.70 10.21 34 IN_ZIMBRA_NJ_WHITELIST 32951 6.39 0.07 9.19 35 BAYES_60 30507 8.09 7.15 8.51 36 LotsOfNums_01 29917 7.43 5.35 8.35 37 TR_XM_DK_Bayes 28191 5.60 0.48 7.86 38 LOTS_OF_MONEY 27880 8.42 9.88 7.78 39 TR_XM_DK_Bayes1 27297 5.42 0.46 7.61 40 XM_Evil_Numbers_Gen 26947 7.40 7.15 7.52 41 UNPARSEABLE_RELAY 26897 8.05 9.29 7.50 42 T_TooManySym_01 26363 5.73 2.06 7.35 43 XM_DKIMWhitelistDomains 25207 4.92 0.14 7.03 44 TR_XM_DK_Bayes2 22511 4.47 0.38 6.28 45 FSL_BULK_SIG 22201 7.08 9.10 6.19 46 XM_SendGrid 22056 6.23 6.40 6.15 47 MIME_QP_LONG_LINE 21934 5.16 2.98 6.12 48 HTML_IMAGE_RATIO_02 21650 6.00 5.91 6.04 49 XM_DK_Undo_02 21379 13.23 29.66 5.96 50 BAYES_40 20074 5.29 4.58 5.60 51 TR_XM_UnparsRelay 19905 6.61 8.99 5.55 52 XM_PDF 18533 3.79 0.69 5.17 53 HTML_IMAGE_RATIO_04 18419 4.57 3.28 5.14 54 XMSubMetaSx_00 18336 4.86 4.29 5.11 55 MPART_ALT_DIFF 17941 6.19 8.88 5.00 56 RCVD_IN_VALIDITY_SAFE 17327 4.20 2.77 4.83 57 XM_H_Long_From01 16983 4.59 4.27 4.74 58 RCVD_IN_IADB_LISTED 16962 3.87 1.92 4.73 59 TR_XM_SpammyWords4 16705 5.75 8.20 4.66 60 XM_SPF_SoftFail 16559 5.55 7.66 4.62 61 T_TooManySym_02 15884 3.31 0.77 4.43 62 TR_XM_DKIM_Undo 15587 10.56 24.61 4.35 63 BAYES_99 15378 9.43 21.07 4.29 64 RCVD_IN_VALIDITY_CERTIFIED 15186 3.61 2.20 4.24 65 HTML_IMAGE_RATIO_08 14895 3.34 1.48 4.15 66 XMStrtUSub 14870 6.36 11.35 4.15 67 RCVD_IN_IADB_SPF 14868 3.35 1.56 4.15 68 BAYES_20 14631 3.73 2.94 4.08 69 BOTNET_IPINHOSTNAME 14526 5.73 9.53 4.05 70 TM2_M_URI_OPT_OUT 14437 3.72 3.04 4.03 71 XMNumbers 14217 5.30 8.31 3.97 72 DKIM_INVALID 14204 4.40 5.40 3.96 73 XM_B_SpammyWords3 14026 5.34 8.58 3.91 74 TR_XM_DK_SendGrid 13783 3.78 3.63 3.84 75 BAYES_80 13483 4.55 6.34 3.76 76 RCVD_IN_IADB_SENDERID 13356 3.02 1.43 3.73 77 RELAYCOUNTRY_META 13179 10.51 25.97 3.68 78 XMSexyCombo_05 13135 4.61 6.75 3.66 79 MAILING_LIST_MULTI 12953 3.03 1.72 3.61 80 ANY_BOUNCE_MESSAGE 12925 2.74 0.77 3.61 81 BOUNCE_MESSAGE 12924 2.74 0.77 3.61 82 RCVD_IN_IADB_DK 12915 2.94 1.44 3.60 83 T_REMOTE_IMAGE 12885 3.75 4.10 3.59 84 HTML_FONT_FACE_BAD 12827 2.65 0.56 3.58 85 XM_UncommonTLD01 12701 9.79 23.91 3.54 86 XM_H_Trusted_IP 12430 2.40 0.00 3.47 87 BAYES_999 12328 7.36 16.22 3.44 88 XM_B_Phish_Phrases 12177 3.76 4.59 3.40 89 MIME_HTML_ONLY_MULTI 12145 3.56 3.96 3.39 90 TR_XM_PhishingBody 11728 3.93 5.42 3.27 91 HTML_IMAGE_RATIO_06 11528 2.94 2.32 3.22 92 KHOP_HELO_FCRDNS 10986 3.02 2.93 3.06 93 RCVD_IN_IADB_VOUCHED 10436 2.36 1.12 2.91 94 URI_NOVOWEL 9734 3.35 4.80 2.72 95 TooManyTo_002 9419 2.09 0.89 2.63 96 BAYES_05 9369 2.17 1.17 2.61 97 TR_XM_SB_Phish 8647 2.16 1.57 2.41 98 HTML_MIME_NO_HTML_TAG 8555 10.74 29.62 2.39 99 XMSubPhish11 8531 2.12 1.54 2.38 100 T_XMDrugObfuBody_14 8350 2.40 2.57 2.33 101 MIME_HTML_MOSTLY 7956 3.18 5.36 2.22 102 FROM_EXCESS_BASE64 7807 1.96 1.47 2.18 103 BAYES_95 7729 2.51 3.31 2.16 104 SUBJ_ALL_CAPS 7626 2.18 2.29 2.13 105 HELO_NODOT 7586 1.66 0.62 2.12 106 HELO_NO_DOMAIN 7585 1.66 0.62 2.12 107 XM_B_Phish66 7530 2.26 2.62 2.10 108 XMSexyCombo_01 7331 1.86 1.44 2.04 109 RCVD_IN_MSPIKE_H5 7224 1.53 0.42 2.02 110 XM_B_SpammyTLD 7037 2.20 2.72 1.96 111 FILL_THIS_FORM 6785 1.37 0.19 1.89 112 INVALID_MSGID 6724 1.35 0.15 1.88 113 RCVD_IN_IADB_OPTIN 6606 1.45 0.57 1.84 114 TooManyTo_003 6599 1.51 0.76 1.84 115 IN_HORDE_ADDRESS_BOOK 6572 1.29 0.06 1.83 116 XM_GoogleGroups 6461 1.98 2.39 1.80 117 MSGID_NOFQDN1 6269 1.22 0.03 1.75 118 TO_MALFORMED 6085 1.18 0.01 1.70 119 TR_Symld_Words 6017 1.62 1.49 1.68 120 XM_DK_Undo_01 6002 1.77 2.00 1.67 121 XM_CamelCaseFrm001 5583 1.57 1.60 1.56 122 TVD_RCVD_IP 5508 1.10 0.10 1.54 123 XM_B_Unsub2 5487 1.46 1.32 1.53 124 TR_DCC_Bayes_99 5465 5.88 15.73 1.52 125 XM_B_Investor 5409 2.39 4.39 1.51 126 BOTNET 5319 9.16 26.52 1.48 127 TR_XM_SpammyRelay 5196 4.99 12.98 1.45 128 XMSubNoVowel 5153 1.20 0.65 1.44 129 URI_HEX 4881 1.32 1.24 1.36 130 XMNoVowels 4865 1.06 0.39 1.36 131 UNTRUSTED_Relay 4863 8.91 25.99 1.36 132 XM_E_Blogspot 4824 0.97 0.12 1.35 133 TVD_SPACE_RATIO 4785 1.02 0.32 1.33 134 XMCapTrack 4755 1.11 0.62 1.33 135 TooManyTo_004 4733 1.14 0.72 1.32 136 TR_XM_SpammyWords5 4693 1.97 3.48 1.31 137 T_XMDrugObfuBody_08 4688 1.51 1.97 1.31 138 SHORT_URI_3 4575 0.96 0.25 1.28 139 TM2_M_VERY_LONG_WORD 4455 1.86 3.27 1.24 140 XMGappySubj_01 4445 2.73 6.09 1.24 141 XMDiploma_00 4401 1.55 2.27 1.23 142 XMStockSpam_06 4127 1.27 1.52 1.15 143 DKIM_ADSP_CUSTOM_MED 4071 1.02 0.76 1.14 144 TooManyTo_005 3946 0.97 0.67 1.10 145 T_TooManySym_03 3909 0.84 0.29 1.09 146 XM_OfRef6 3751 1.53 2.63 1.05 147 XMSubMetaSx_01 3730 0.80 0.25 1.04 148 XM_H_Long_From02 3694 0.92 0.68 1.03 149 XMBSHREFv2 3686 0.79 0.25 1.03 150 RCVD_IN_RP_SAFE 3415 0.86 0.66 0.95 151 RCVD_IN_BL_SPAMCOP_NET 3410 2.95 7.48 0.95 152 XMSexyCombo_02 3271 0.71 0.26 0.91 153 XMBrknScrpt_02 3265 0.99 1.17 0.91 154 XM_UB50 3214 5.46 15.77 0.90 155 T_FILL_THIS_FORM_SHORT 3186 1.31 2.26 0.89 156 XMHTML_After_End 3174 0.96 1.14 0.89 157 HTML_IMAGE_ONLY_20 3151 0.73 0.41 0.88 158 RCVD_IN_RP_CERTIFIED 3077 0.75 0.50 0.86 159 TR_MetaPhish_Combo_01 3045 0.95 1.18 0.85 160 RCVD_IN_MSPIKE_BL 2973 2.24 5.42 0.83 161 XMSubMetaSxObfu_03 2951 0.76 0.62 0.82 162 TR_XM_MSPIKECOMBO 2924 2.23 5.41 0.82 163 RELAYCOUNTRY_GB 2923 0.82 0.82 0.82 164 RELAYCOUNTRY_CA 2892 1.77 3.96 0.81 165 SpammyFromTLD_01 2782 2.97 7.92 0.78 166 XMBody_95 2774 0.56 0.08 0.77 167 NML_ADSP_CUSTOM_MED 2707 0.70 0.58 0.76 168 HTTPS_HTTP_MISMATCH 2637 0.78 0.89 0.74 169 TR_XM_SpammyWords2 2609 2.73 7.25 0.73 170 XMLngstWrd_00 2496 1.03 1.78 0.70 171 XMGenDplmaNmb 2443 0.82 1.14 0.68 172 T_XMDrugObfuBody_00 2397 0.78 1.03 0.67 173 T_OBFU_PDF_ATTACH 2379 0.48 0.08 0.66 174 RCVD_IN_SORBS_DUL 2375 0.53 0.23 0.66 175 XM_ShortIntro_01 2369 0.64 0.58 0.66 176 HTML_TAG_BALANCE_BODY 2366 0.82 1.18 0.66 177 FORGED_GMAIL_RCVD 2310 0.65 0.68 0.64 178 T_Symld_Words_02 2309 0.69 0.79 0.64 179 TR_XM_MaxUnsub 2283 1.11 2.19 0.64 180 XMLngstWrd_01 2259 0.97 1.75 0.63 181 XM_H_PHPMailer 2153 2.93 8.21 0.60 182 SHORT_HELO_AND_INLINE_IMAGE 2118 0.44 0.09 0.59 183 XMSexyCombo_04 2053 0.51 0.38 0.57 184 XMBdyGiftCard01 2001 0.64 0.84 0.56 185 XMMoneyMeta_00 1992 0.79 1.31 0.56 186 XMLngstWrd_02 1965 0.90 1.71 0.55 187 XM_B_COVIDMETA 1921 0.88 1.66 0.54 188 TR_MSPIKEBAYES00 1880 0.37 0.03 0.52 189 TR_XM_SPAMCOP 1844 1.46 3.59 0.51 190 HTML_IMAGE_ONLY_28 1805 0.43 0.27 0.50 191 XM_B_COPY_HTML 1803 0.49 0.47 0.50 192 URI_TRY_3LD 1789 0.59 0.79 0.50 193 HTML_IMAGE_ONLY_32 1768 0.39 0.17 0.49 194 XMSubMetaI_00 1764 0.55 0.68 0.49 195 XMPhish30 1754 0.60 0.86 0.49 196 TM2_M_BODY_EMPTY 1745 0.48 0.48 0.49 197 XMBody_17 1741 0.84 1.66 0.49 198 XM_ProductURIs 1691 0.53 0.68 0.47 199 XMSubMetaSxObfu_02 1686 0.39 0.20 0.47 200 MISSING_HEADERS 1609 0.58 0.87 0.45 ----------------------------------------------------------------------