Email: 464731 Autolearn: 0 AvgScore: 2.77 AvgScanTime: 1.22 sec Spam: 134440 Autolearn: 0 AvgScore: 14.25 AvgScanTime: 1.36 sec Ham: 330291 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 1.16 sec Time Spent Running SA: 157.26 hours Time Spent Processing Spam: 50.68 hours Time Spent Processing Ham: 106.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128217 89.46 95.37 87.06 2 DKIM_SIGNED 111817 72.96 83.17 68.80 3 XM_DK_Pass 109092 71.16 81.15 67.09 4 RELAYCOUNTRY_US 108071 78.75 80.39 78.08 5 DKIM_VALID 107904 70.28 80.26 66.21 6 XM_B_Unicode 102999 69.22 76.61 66.20 7 DCC_CHECK 93471 41.40 69.53 29.95 8 XMListUnsubscribeExists 92150 51.24 68.54 44.20 9 XM_B_SpammyWords 84135 50.87 62.58 46.10 10 DKIM_VALID_AU 79766 53.65 59.33 51.34 11 XM_DK_Undo_02 56439 16.77 41.98 6.51 12 BAYES_50 56401 49.73 41.95 52.90 13 XM_B_Unicode3 54486 40.52 40.53 40.52 14 XM_B_SpammyWords2 48517 25.65 36.09 21.40 15 MIME_HTML_ONLY 46266 24.73 34.41 20.79 16 LOC_TINY_FONT_1 45732 24.46 34.02 20.56 17 BAYES_99 44568 14.03 33.15 6.25 18 TR_XM_DKIM_Undo 43971 12.70 32.71 4.56 19 FVGT_m_MULTI_ODD 41420 24.82 30.81 22.39 20 DCC_CHECK_NEGATIVE 40912 58.56 30.43 70.01 21 HTML_FONT_LOW_CONTRAST 40692 27.65 30.27 26.59 22 DKIM_VALID_EF 37604 27.05 27.97 26.67 23 BAYES_999 35520 11.38 26.42 5.26 24 T_KAM_HTML_FONT_INVALID 35378 19.97 26.32 17.39 25 RCVD_IN_MSPIKE_H2 33447 20.80 24.88 19.14 26 XMSubLong 31561 22.07 23.48 21.50 27 TR_DCC_Bayes_99 31250 7.93 23.24 1.70 28 XM_Body_Dirty_Words 30462 14.07 22.66 10.57 29 RELAYCOUNTRY_META 29283 8.79 21.78 3.50 30 T_TM2_M_HEADER_IN_MSG 28909 27.06 21.50 29.33 31 RCVD_IN_MSPIKE_WL 27701 25.95 20.60 28.12 32 XM_Multi_Part_URI 21010 12.67 15.63 11.47 33 UNPARSEABLE_RELAY 20632 9.45 15.35 7.05 34 LOTS_OF_MONEY 20110 9.93 14.96 7.88 35 TR_XM_UnparsRelay 20039 8.11 14.91 5.35 36 XM_B_Unsub 19934 14.47 14.83 14.33 37 BOTNET_IPINHOSTNAME 19073 7.40 14.19 4.64 38 RCVD_IN_MSPIKE_H3 18834 15.31 14.01 15.83 39 FSL_BULK_SIG 17958 6.04 13.36 3.06 40 BOTNET 17545 4.81 13.05 1.46 41 TR_XM_SpammyWords4 16727 6.97 12.44 4.74 42 XM_B_SpammyWords3 15630 6.74 11.63 4.74 43 TR_XM_SpammyRelay 15386 4.34 11.44 1.45 44 TR_XM_SpammyWords2 14759 3.87 10.98 0.97 45 UNTRUSTED_Relay 14328 3.89 10.66 1.14 46 XMSexyCombo_05 14181 5.25 10.55 3.10 47 RCVD_IN_BL_SPAMCOP_NET 14180 3.49 10.55 0.61 48 XM_UncommonTLD01 13438 5.37 10.00 3.48 49 MPART_ALT_DIFF 12090 7.32 8.99 6.64 50 HTML_IMAGE_RATIO_02 11842 6.76 8.81 5.93 51 RCVD_IN_MSPIKE_BL 11672 3.24 8.68 1.03 52 TR_XM_MSPIKECOMBO 11493 3.20 8.55 1.02 53 BAYES_60 10785 8.67 8.02 8.94 54 XM_Evil_Numbers_Gen 10610 7.44 7.89 7.26 55 XM_SendGrid 10180 5.95 7.57 5.29 56 BAYES_80 10115 5.00 7.52 3.98 57 HTML_MIME_NO_HTML_TAG 10091 3.75 7.51 2.22 58 LotsOfNums_01 9594 8.53 7.14 9.09 59 T_REMOTE_IMAGE 9566 4.65 7.12 3.64 60 TR_XM_PhishingBody 8940 4.20 6.65 3.20 61 XMSubMetaSx_00 8842 4.13 6.58 3.14 62 RELAYCOUNTRY_CA 8407 2.44 6.25 0.88 63 RCVD_IN_MSPIKE_H4 8367 9.19 6.22 10.40 64 XM_H_Long_From01 7951 5.50 5.91 5.33 65 XM_B_Phish_Phrases 7557 3.95 5.62 3.27 66 TooManyTo_001 7484 10.56 5.57 12.59 67 TR_XM_MaxUnsub 7413 2.27 5.51 0.94 68 TR_XM_SPAMCOP 7367 1.72 5.48 0.18 69 MIME_HTML_ONLY_MULTI 7217 4.99 5.37 4.83 70 XM_B_SpammyTLD 7206 3.02 5.36 2.06 71 XM_UB50 6850 1.97 5.10 0.70 72 TM2_M_VERY_LONG_WORD 6586 2.68 4.90 1.78 73 HTML_IMAGE_RATIO_04 6500 5.92 4.83 6.37 74 TR_XM_DK_SendGrid 6396 3.81 4.76 3.42 75 KHOP_HELO_FCRDNS 6182 2.61 4.60 1.80 76 TR_XM_SpammyWords3 6145 1.64 4.57 0.45 77 XM_SPF_SoftFail 5939 2.88 4.42 2.25 78 MIME_QP_LONG_LINE 5910 8.50 4.40 10.18 79 BAYES_95 5885 3.08 4.38 2.56 80 MIME_HTML_MOSTLY 5834 2.82 4.34 2.20 81 XM_DIRTYINTL 5779 1.49 4.30 0.34 82 XM_B_Investor 5697 2.28 4.24 1.48 83 T_XMDrugObfuBody_14 5544 2.41 4.12 1.71 84 XMNumbers 5496 3.57 4.09 3.36 85 XM_B_Phish66 5368 2.37 3.99 1.71 86 BOTNET_NORDNS 5156 1.13 3.84 0.03 87 RCVD_IN_MSPIKE_L5 5073 1.11 3.77 0.02 88 PDS_OTHER_BAD_TLD 4976 1.22 3.70 0.20 89 URI_NOVOWEL 4921 2.76 3.66 2.39 90 T_XMDrugObfuBody_08 4813 1.99 3.58 1.34 91 RCVD_IN_PSBL 4796 1.17 3.57 0.19 92 TR_XM_SpammyWords5 4741 1.91 3.53 1.26 93 RCVD_IN_IADB_LISTED 4634 4.65 3.45 5.14 94 RCVD_IN_VALIDITY_SAFE 4554 3.90 3.39 4.11 95 T_FILL_THIS_FORM_SHORT 4520 1.56 3.36 0.83 96 SpammyFromTLD_02 4511 1.45 3.36 0.68 97 SpammyFromTLD_01 4500 1.43 3.35 0.66 98 XM_DK_Undo_01 4187 2.00 3.11 1.55 99 RCVD_IN_MSPIKE_L3 4116 1.17 3.06 0.39 100 HTML_IMAGE_RATIO_06 4105 3.43 3.05 3.58 101 TM2_M_URI_OPT_OUT 4040 6.27 3.01 7.60 102 XMStrtUSub 3991 3.93 2.97 4.32 103 XM_H_Long_From02 3972 1.50 2.95 0.91 104 RCVD_IN_VALIDITY_RPBL 3939 0.86 2.93 0.02 105 RCVD_IN_VALIDITY_CERTIFIED 3929 3.43 2.92 3.64 106 XM_GoogleGroups 3916 2.10 2.91 1.77 107 DKIM_INVALID 3913 2.68 2.91 2.59 108 RCVD_IN_IADB_SPF 3891 4.11 2.89 4.61 109 T_TooManySym_01 3881 5.11 2.89 6.02 110 GOOG_STO_IMG_HTML 3675 0.79 2.73 0.00 111 XM_OfRef6 3583 1.53 2.67 1.07 112 RCVD_IN_IADB_DK 3509 3.63 2.61 4.05 113 RCVD_IN_IADB_SENDERID 3488 3.75 2.59 4.22 114 XMLngstWrd_00 3487 1.46 2.59 1.00 115 XMLngstWrd_01 3421 1.41 2.54 0.94 116 XMSexyCombo_01 3421 1.09 2.54 0.49 117 XMLngstWrd_02 3354 1.34 2.49 0.87 118 TR_Mismatch_TLD_01 3272 0.87 2.43 0.23 119 RELAYCOUNTRY_FR 3270 0.86 2.43 0.22 120 XMLngstWrd_03 3256 1.25 2.42 0.77 121 TR_XM_MSPIKECOMBO2 3245 0.78 2.41 0.12 122 HTML_TITLE_SUBJ_DIFF 3216 1.10 2.39 0.57 123 XMLngstWrd_04 3187 1.18 2.37 0.70 124 SUBJ_ALL_CAPS 3166 2.08 2.35 1.97 125 NO_DNS_FOR_FROM 3158 0.84 2.35 0.22 126 DKIM_ADSP_NXDOMAIN 3136 0.86 2.33 0.27 127 T_XMDrugObfuBody_00 3127 1.19 2.33 0.73 128 TR_XM_SB_Phish 3113 2.05 2.32 1.94 129 UPPERCASE_75_100 3109 1.07 2.31 0.57 130 ALL_TRUSTED 3095 14.56 2.30 19.55 131 XM_URI_RBL 3037 0.75 2.26 0.14 132 XM_B_COVIDMETA 3002 1.16 2.23 0.73 133 XMSubPhish11 2989 2.00 2.22 1.91 134 URI_PHP_REDIR 2979 0.65 2.22 0.01 135 XMDiploma_00 2974 1.51 2.21 1.22 136 XM_CamelCaseFrm001 2937 1.97 2.18 1.89 137 RCVD_IN_IADB_VOUCHED 2924 2.86 2.17 3.14 138 T_HTML_TAG_BALANCE_CENTER 2889 0.71 2.15 0.13 139 TR_LOTS_OF_MONEY3 2867 0.78 2.13 0.23 140 TR_XM_MaxWHORU 2847 0.73 2.12 0.17 141 XM_UB99 2738 0.59 2.04 0.00 142 BAYES_40 2691 4.43 2.00 5.42 143 BAD_ENC_HEADER 2666 0.60 1.98 0.04 144 HDRS_MISSP 2661 0.60 1.98 0.03 145 XM_Body_Dirty_Words_01 2643 0.71 1.97 0.19 146 XM_B_SpammyWords4 2642 1.08 1.97 0.72 147 HTML_IMAGE_ONLY_08 2640 0.64 1.96 0.10 148 HTTPS_HTTP_MISMATCH 2599 0.99 1.93 0.60 149 FVGT_m_MULTI_ODD_EMAIL 2532 0.56 1.88 0.03 150 HTML_IMAGE_RATIO_08 2504 2.09 1.86 2.18 151 FROM_EXCESS_BASE64 2493 2.21 1.85 2.35 152 FROM_LOCAL_NOVOWEL 2483 0.56 1.85 0.04 153 MAILING_LIST_MULTI 2435 2.43 1.81 2.68 154 XM_B_Unsub2 2426 1.48 1.80 1.35 155 FROM_SUSPICIOUS_NTLD 2307 0.54 1.72 0.06 156 RCVD_IN_MSPIKE_L4 2304 0.93 1.71 0.60 157 LongTLD 2275 0.60 1.69 0.16 158 USER_IN_DEF_DKIM_WL 2264 8.65 1.68 11.49 159 BODY_URI_ONLY 2260 0.50 1.68 0.02 160 RELAYCOUNTRY_DE 2205 0.71 1.64 0.33 161 MIXED_CENTER_CASE 2203 0.47 1.64 0.00 162 FROM_SUSPICIOUS_NTLD_FP 2203 0.51 1.64 0.05 163 XM_UB999 2192 0.47 1.63 0.00 164 MIXED_HREF_CASE 2189 0.47 1.63 0.00 165 MIXED_IMG_CASE 2173 0.47 1.62 0.00 166 MIXED_AREA_CASE 2171 0.47 1.61 0.00 167 MIXED_FONT_CASE 2154 0.46 1.60 0.00 168 URI_HEX 2139 1.48 1.59 1.44 169 XMBrknScrpt_02 2101 0.85 1.56 0.56 170 TR_XM_PHPDW 2098 0.72 1.56 0.38 171 XMHTML_After_End 2092 0.95 1.56 0.70 172 RELAYCOUNTRY_GB 2091 0.96 1.56 0.72 173 XM_H_Undi_Recip 2057 0.57 1.53 0.18 174 BAYES_20 2056 3.74 1.53 4.64 175 RELAYCOUNTRY_AU 2026 0.65 1.51 0.31 176 TR_XM_PHPForged 2023 0.66 1.50 0.32 177 TR_XM_FormFill 2011 0.44 1.50 0.01 178 XMBody_17 2006 0.67 1.49 0.34 179 TR_XM_BayesRelay 2003 0.43 1.49 0.00 180 T_XMHurry_00 1999 0.79 1.49 0.51 181 TR_XM_FormFill2 1964 0.65 1.46 0.32 182 XM_H_PHPOS 1952 0.64 1.45 0.30 183 RCVD_IN_IADB_OPTIN 1913 1.80 1.42 1.95 184 URI_GOOG_STO_SPAMMY 1907 0.41 1.42 0.00 185 TR_XM_COVIDMETA1 1896 0.63 1.41 0.31 186 TR_Symld_Words 1874 1.54 1.39 1.60 187 TR_Mismatch_TLD_02 1842 0.48 1.37 0.12 188 RELAYCOUNTRY_RU 1821 0.42 1.35 0.03 189 XMStockSpam_06 1797 0.98 1.34 0.83 190 URIBL_BLACK 1783 0.42 1.33 0.05 191 XM_UB60 1754 0.42 1.30 0.05 192 TR_XM_NoHeaderRelay 1734 0.49 1.29 0.17 193 TR_XM_COVIDMETA4 1727 0.48 1.28 0.16 194 XM_ProductURIs 1668 0.81 1.24 0.64 195 XMBdyGiftCard01 1631 0.86 1.21 0.72 196 URI_TRY_3LD 1580 0.72 1.18 0.54 197 XMPhish30 1537 0.97 1.14 0.90 198 XMGenDplmaNmb 1528 0.83 1.14 0.70 199 HTML_FONT_SIZE_HUGE 1516 0.37 1.13 0.05 200 TR_BOTNET_NEGATE 1514 0.54 1.13 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 287545 89.46 95.37 87.06 2 RELAYCOUNTRY_US 257882 78.75 80.39 78.08 3 DCC_CHECK_NEGATIVE 231244 58.56 30.43 70.01 4 DKIM_SIGNED 227229 72.96 83.17 68.80 5 XM_DK_Pass 221593 71.16 81.15 67.09 6 DKIM_VALID 218686 70.28 80.26 66.21 7 XM_B_Unicode 218667 69.22 76.61 66.20 8 BAYES_50 174720 49.73 41.95 52.90 9 DKIM_VALID_AU 169561 53.65 59.33 51.34 10 XM_B_SpammyWords 152266 50.87 62.58 46.10 11 XMListUnsubscribeExists 145982 51.24 68.54 44.20 12 XM_B_Unicode3 133818 40.52 40.53 40.52 13 DCC_CHECK 98914 41.40 69.53 29.95 14 T_TM2_M_HEADER_IN_MSG 96866 27.06 21.50 29.33 15 RCVD_IN_MSPIKE_WL 92880 25.95 20.60 28.12 16 DKIM_VALID_EF 88092 27.05 27.97 26.67 17 HTML_FONT_LOW_CONTRAST 87828 27.65 30.27 26.59 18 FVGT_m_MULTI_ODD 73944 24.82 30.81 22.39 19 XMSubLong 71008 22.07 23.48 21.50 20 XM_B_SpammyWords2 70698 25.65 36.09 21.40 21 MIME_HTML_ONLY 68651 24.73 34.41 20.79 22 LOC_TINY_FONT_1 67923 24.46 34.02 20.56 23 ALL_TRUSTED 64586 14.56 2.30 19.55 24 RCVD_IN_MSPIKE_H2 63212 20.80 24.88 19.14 25 T_KAM_HTML_FONT_INVALID 57422 19.97 26.32 17.39 26 RCVD_IN_MSPIKE_H3 52300 15.31 14.01 15.83 27 XM_B_Unsub 47317 14.47 14.83 14.33 28 BAYES_00 42173 9.30 0.77 12.77 29 TooManyTo_001 41578 10.56 5.57 12.59 30 USER_IN_DEF_DKIM_WL 37956 8.65 1.68 11.49 31 XM_Multi_Part_URI 37883 12.67 15.63 11.47 32 XM_Body_Dirty_Words 34910 14.07 22.66 10.57 33 RCVD_IN_MSPIKE_H4 34356 9.19 6.22 10.40 34 MIME_QP_LONG_LINE 33615 8.50 4.40 10.18 35 LotsOfNums_01 30037 8.53 7.14 9.09 36 BAYES_60 29521 8.67 8.02 8.94 37 LOTS_OF_MONEY 26039 9.93 14.96 7.88 38 XM_DKIMWhitelistDomains 25879 5.58 0.05 7.84 39 TM2_M_URI_OPT_OUT 25112 6.27 3.01 7.60 40 XM_Evil_Numbers_Gen 23982 7.44 7.89 7.26 41 UNPARSEABLE_RELAY 23301 9.45 15.35 7.05 42 IN_ZIMBRA_NJ_WHITELIST 22642 4.90 0.10 6.86 43 MPART_ALT_DIFF 21942 7.32 8.99 6.64 44 XM_DK_Undo_02 21507 16.77 41.98 6.51 45 TR_XM_DK_Bayes 21139 4.68 0.45 6.40 46 HTML_IMAGE_RATIO_04 21030 5.92 4.83 6.37 47 BAYES_99 20636 14.03 33.15 6.25 48 TR_XM_DK_Bayes1 20610 4.56 0.45 6.24 49 T_TooManySym_01 19873 5.11 2.89 6.02 50 HTML_IMAGE_RATIO_02 19595 6.76 8.81 5.93 51 TR_XM_DK_Bayes2 18180 4.02 0.38 5.50 52 XM_H_Trusted_IP 18083 3.89 0.00 5.47 53 BAYES_40 17894 4.43 2.00 5.42 54 TR_XM_UnparsRelay 17659 8.11 14.91 5.35 55 XM_H_Long_From01 17611 5.50 5.91 5.33 56 XM_SendGrid 17486 5.95 7.57 5.29 57 BAYES_999 17375 11.38 26.42 5.26 58 RCVD_IN_IADB_LISTED 16993 4.65 3.45 5.14 59 MIME_HTML_ONLY_MULTI 15969 4.99 5.37 4.83 60 XM_B_SpammyWords3 15672 6.74 11.63 4.74 61 TR_XM_SpammyWords4 15662 6.97 12.44 4.74 62 BOTNET_IPINHOSTNAME 15330 7.40 14.19 4.64 63 BAYES_20 15330 3.74 1.53 4.64 64 RCVD_IN_IADB_SPF 15221 4.11 2.89 4.61 65 TR_XM_DKIM_Undo 15060 12.70 32.71 4.56 66 XMStrtUSub 14259 3.93 2.97 4.32 67 XM_PDF 14049 3.25 0.79 4.25 68 RCVD_IN_IADB_SENDERID 13935 3.75 2.59 4.22 69 RCVD_IN_VALIDITY_SAFE 13567 3.90 3.39 4.11 70 RCVD_IN_IADB_DK 13365 3.63 2.61 4.05 71 SHORT_URI_2 13361 3.06 0.66 4.05 72 BAYES_80 13132 5.00 7.52 3.98 73 RCVD_IN_VALIDITY_CERTIFIED 12030 3.43 2.92 3.64 74 T_REMOTE_IMAGE 12021 4.65 7.12 3.64 75 HTML_IMAGE_RATIO_06 11831 3.43 3.05 3.58 76 RELAYCOUNTRY_META 11571 8.79 21.78 3.50 77 XM_UncommonTLD01 11500 5.37 10.00 3.48 78 T_TooManySym_02 11481 2.68 0.74 3.48 79 TR_XM_DK_SendGrid 11291 3.81 4.76 3.42 80 XMNumbers 11089 3.57 4.09 3.36 81 XM_B_Phish_Phrases 10809 3.95 5.62 3.27 82 TR_XM_PhishingBody 10576 4.20 6.65 3.20 83 RCVD_IN_IADB_VOUCHED 10357 2.86 2.17 3.14 84 XMSubMetaSx_00 10355 4.13 6.58 3.14 85 XMSexyCombo_05 10240 5.25 10.55 3.10 86 FSL_BULK_SIG 10109 6.04 13.36 3.06 87 ANY_BOUNCE_MESSAGE 9647 2.39 1.09 2.92 88 BOUNCE_MESSAGE 9647 2.39 1.09 2.92 89 MAILING_LIST_MULTI 8860 2.43 1.81 2.68 90 DKIM_INVALID 8543 2.68 2.91 2.59 91 BAYES_05 8443 2.00 0.65 2.56 92 BAYES_95 8440 3.08 4.38 2.56 93 URI_NOVOWEL 7903 2.76 3.66 2.39 94 FROM_EXCESS_BASE64 7757 2.21 1.85 2.35 95 XM_SPF_SoftFail 7423 2.88 4.42 2.25 96 HTML_MIME_NO_HTML_TAG 7320 3.75 7.51 2.22 97 MIME_HTML_MOSTLY 7259 2.82 4.34 2.20 98 TVD_RCVD_IP 7249 1.70 0.48 2.19 99 HTML_IMAGE_RATIO_08 7215 2.09 1.86 2.18 100 INVALID_MSGID 7057 1.56 0.13 2.14 101 XM_B_SpammyTLD 6810 3.02 5.36 2.06 102 TooManyTo_002 6706 1.64 0.67 2.03 103 SUBJ_ALL_CAPS 6517 2.08 2.35 1.97 104 RCVD_IN_IADB_OPTIN 6446 1.80 1.42 1.95 105 TR_XM_SB_Phish 6421 2.05 2.32 1.94 106 XMSubPhish11 6319 2.00 2.22 1.91 107 MSGID_NOFQDN1 6264 1.36 0.03 1.90 108 XM_CamelCaseFrm001 6232 1.97 2.18 1.89 109 RCVD_IN_MSPIKE_H5 6224 1.45 0.37 1.88 110 IN_HORDE_ADDRESS_BOOK 6136 1.34 0.08 1.86 111 KHOP_HELO_FCRDNS 5956 2.61 4.60 1.80 112 TM2_M_VERY_LONG_WORD 5882 2.68 4.90 1.78 113 XM_GoogleGroups 5830 2.10 2.91 1.77 114 TO_MALFORMED 5791 1.25 0.02 1.75 115 HTML_FONT_FACE_BAD 5712 1.40 0.58 1.73 116 T_XMDrugObfuBody_14 5654 2.41 4.12 1.71 117 XM_B_Phish66 5643 2.37 3.99 1.71 118 TR_DCC_Bayes_99 5626 7.93 23.24 1.70 119 HELO_NODOT 5453 1.30 0.45 1.65 120 HELO_NO_DOMAIN 5450 1.30 0.44 1.65 121 XMSubNoVowel 5409 1.46 1.02 1.64 122 XMGappySubj_01 5315 1.18 0.14 1.61 123 TR_Symld_Words 5296 1.54 1.39 1.60 124 XM_DK_Undo_01 5106 2.00 3.11 1.55 125 XM_B_Investor 4900 2.28 4.24 1.48 126 BOTNET 4826 4.81 13.05 1.46 127 TR_XM_SpammyRelay 4803 4.34 11.44 1.45 128 URI_HEX 4749 1.48 1.59 1.44 129 TooManyTo_003 4505 1.12 0.54 1.36 130 XM_B_Unsub2 4450 1.48 1.80 1.35 131 T_XMDrugObfuBody_08 4413 1.99 3.58 1.34 132 TR_XM_SpammyWords5 4156 1.91 3.53 1.26 133 XMDiploma_00 4039 1.51 2.21 1.22 134 XMBSHREFv2 3841 0.90 0.26 1.16 135 UNTRUSTED_Relay 3762 3.89 10.66 1.14 136 TVD_SPACE_RATIO 3565 0.80 0.11 1.08 137 XM_OfRef6 3539 1.53 2.67 1.07 138 XM_RXBody 3481 1.00 0.87 1.05 139 RCVD_IN_MSPIKE_BL 3395 3.24 8.68 1.03 140 TR_XM_MSPIKECOMBO 3374 3.20 8.55 1.02 141 HTML_IMAGE_ONLY_20 3359 0.80 0.27 1.02 142 XMCapTrack 3330 0.82 0.34 1.01 143 XMLngstWrd_00 3303 1.46 2.59 1.00 144 TR_XM_SpammyWords2 3208 3.87 10.98 0.97 145 TooManyTo_004 3202 0.83 0.48 0.97 146 TR_XM_MaxUnsub 3121 2.27 5.51 0.94 147 XMLngstWrd_01 3115 1.41 2.54 0.94 148 TM2_M_A_HREF_HREF 3051 0.89 0.79 0.92 149 XM_H_Long_From02 3009 1.50 2.95 0.91 150 DKIM_ADSP_CUSTOM_MED 2997 0.91 0.93 0.91 151 XMPhish30 2960 0.97 1.14 0.90 152 RELAYCOUNTRY_CA 2915 2.44 6.25 0.88 153 XMLngstWrd_02 2870 1.34 2.49 0.87 154 T_TooManySym_03 2798 0.69 0.32 0.85 155 XMStockSpam_06 2751 0.98 1.34 0.83 156 T_FILL_THIS_FORM_SHORT 2750 1.56 3.36 0.83 157 SHORTENED_URL_HREF 2724 0.63 0.14 0.82 158 XM_D_tchamptons_WL 2708 0.58 0.00 0.82 159 RCVD_IN_RP_SAFE 2700 0.78 0.67 0.82 160 FROM_GOV_DKIM_AU 2655 0.61 0.15 0.80 161 TooManyTo_005 2625 0.69 0.44 0.79 162 XMBody_95 2609 0.61 0.17 0.79 163 XMLngstWrd_03 2546 1.25 2.42 0.77 164 RCVD_IN_RP_CERTIFIED 2431 0.69 0.56 0.74 165 TR_MetaPhish_Combo_01 2427 0.78 0.91 0.73 166 XM_B_COVIDMETA 2405 1.16 2.23 0.73 167 T_XMDrugObfuBody_00 2396 1.19 2.33 0.73 168 XM_B_SpammyWords4 2381 1.08 1.97 0.72 169 XMBdyGiftCard01 2375 0.86 1.21 0.72 170 RELAYCOUNTRY_GB 2375 0.96 1.56 0.72 171 XM_B_COPY_HTML 2351 0.71 0.70 0.71 172 XMHTML_After_End 2324 0.95 1.56 0.70 173 XMLngstWrd_04 2316 1.18 2.37 0.70 174 XM_UB50 2315 1.97 5.10 0.70 175 XMGenDplmaNmb 2309 0.83 1.14 0.70 176 SpammyFromTLD_02 2239 1.45 3.36 0.68 177 SpammyFromTLD_01 2168 1.43 3.35 0.66 178 XM_ProductURIs 2119 0.81 1.24 0.64 179 T_OBFU_PDF_ATTACH 2078 0.48 0.13 0.63 180 RCVD_IN_BL_SPAMCOP_NET 2017 3.49 10.55 0.61 181 HTTPS_HTTP_MISMATCH 1996 0.99 1.93 0.60 182 RCVD_IN_MSPIKE_L4 1995 0.93 1.71 0.60 183 NML_ADSP_CUSTOM_MED 1975 0.65 0.77 0.60 184 XM_H_PHPMailer 1952 0.63 0.71 0.59 185 TR_XM_INV_DKIM 1906 0.59 0.64 0.58 186 SHORT_URI_3 1895 0.44 0.11 0.57 187 XM_ShortIntro_01 1891 0.60 0.67 0.57 188 HTML_TITLE_SUBJ_DIFF 1885 1.10 2.39 0.57 189 UPPERCASE_75_100 1882 1.07 2.31 0.57 190 XMBrknScrpt_02 1843 0.85 1.56 0.56 191 HTML_TAG_BALANCE_BODY 1827 0.65 0.90 0.55 192 TVD_SPACE_RATIO_MINFP 1801 0.42 0.13 0.55 193 XM_S_SpammyWords 1773 0.52 0.50 0.54 194 TR_XM_Spammywords 1773 0.52 0.50 0.54 195 URI_TRY_3LD 1770 0.72 1.18 0.54 196 XMSlimDrugH 1750 0.56 0.63 0.53 197 XMNoVowels 1722 0.46 0.31 0.52 198 XM_shorewaves_Whitelist 1719 0.37 0.00 0.52 199 XMSubMetaI_00 1715 0.56 0.66 0.52 200 T_XMHurry_00 1694 0.79 1.49 0.51 ----------------------------------------------------------------------