Email: 274807 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.22 sec Spam: 100853 Autolearn: 0 AvgScore: 13.78 AvgScanTime: 1.34 sec Ham: 173954 Autolearn: 0 AvgScore: -2.27 AvgScanTime: 1.15 sec Time Spent Running SA: 93.29 hours Time Spent Processing Spam: 37.51 hours Time Spent Processing Ham: 55.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95234 85.03 94.43 79.58 2 DKIM_SIGNED 91693 81.44 90.92 75.94 3 XM_DK_Pass 89595 78.86 88.84 73.08 4 DKIM_VALID 89048 78.34 88.29 72.56 5 RELAYCOUNTRY_US 82787 81.10 82.09 80.53 6 XM_B_Unicode 81180 72.22 80.49 67.42 7 DCC_CHECK 73941 48.68 73.32 34.40 8 XMListUnsubscribeExists 71032 58.34 70.43 51.33 9 DKIM_VALID_AU 70675 63.78 70.08 60.13 10 XM_B_SpammyWords 66333 51.50 65.77 43.22 11 XM_DK_Undo_02 46968 23.09 46.57 9.47 12 RCVD_IN_MSPIKE_H2 46887 40.41 46.49 36.89 13 XM_B_Unicode3 44534 42.64 44.16 41.75 14 BAYES_99 38983 19.17 38.65 7.88 15 TR_XM_DKIM_Undo 38744 18.00 38.42 6.16 16 LOC_TINY_FONT_1 38139 30.15 37.82 25.70 17 XM_B_SpammyWords2 38059 26.35 37.74 19.75 18 BAYES_50 35886 46.54 35.58 52.89 19 MIME_HTML_ONLY 33691 25.52 33.41 20.95 20 FVGT_m_MULTI_ODD 32882 27.81 32.60 25.03 21 HTML_FONT_LOW_CONTRAST 32026 29.09 31.76 27.55 22 BAYES_999 31504 15.55 31.24 6.45 23 DKIM_VALID_EF 30776 29.26 30.52 28.54 24 T_KAM_HTML_FONT_INVALID 29069 21.94 28.82 17.95 25 TR_DCC_Bayes_99 27529 11.81 27.30 2.83 26 DCC_CHECK_NEGATIVE 26887 51.29 26.66 65.57 27 XM_Body_Dirty_Words 22115 15.90 21.93 12.40 28 RELAYCOUNTRY_META 21927 10.13 21.74 3.40 29 XMSubLong 20941 22.50 20.76 23.51 30 T_TM2_M_HEADER_IN_MSG 18569 20.86 18.41 22.29 31 UNPARSEABLE_RELAY 16930 11.87 16.79 9.03 32 XM_Multi_Part_URI 16779 15.15 16.64 14.29 33 TR_XM_UnparsRelay 16557 10.58 16.42 7.19 34 XM_B_Unsub 15874 11.63 15.74 9.24 35 TR_XM_BayesUnsub 15672 10.41 15.54 7.44 36 TR_XM_SpammyWords2 14812 6.39 14.69 1.58 37 XM_B_SpammyWords3 14298 8.73 14.18 5.57 38 TR_XM_SpammyRelay 13632 5.84 13.52 1.39 39 LOTS_OF_MONEY 13135 9.74 13.02 7.84 40 XMSexyCombo_05 11358 6.87 11.26 4.33 41 BOTNET_IPINHOSTNAME 11242 7.94 11.15 6.08 42 RCVD_IN_BL_SPAMCOP_NET 11112 4.79 11.02 1.18 43 FSL_BULK_SIG 10912 5.95 10.82 3.13 44 TR_XM_SpammyWords4 10691 6.81 10.60 4.61 45 RCVD_IN_MSPIKE_WL 10500 10.49 10.41 10.54 46 MPART_ALT_DIFF 10362 6.68 10.27 4.59 47 RCVD_IN_MSPIKE_H3 10089 9.22 10.00 8.76 48 RELAYCOUNTRY_CA 9484 4.22 9.40 1.21 49 BAYES_80 9200 6.57 9.12 5.08 50 BOTNET 9069 4.24 8.99 1.49 51 XM_UncommonTLD01 8757 6.16 8.68 4.69 52 HTML_IMAGE_RATIO_02 8652 7.23 8.58 6.45 53 XM_Evil_Numbers_Gen 7708 8.25 7.64 8.59 54 UNTRUSTED_Relay 7580 3.49 7.52 1.15 55 BAYES_60 7550 10.10 7.49 11.62 56 TR_XM_SPAMCOP 7516 3.04 7.45 0.49 57 XM_H_Long_From01 7234 6.14 7.17 5.54 58 TM2_M_VERY_LONG_WORD 7233 3.37 7.17 1.16 59 MIME_HTML_ONLY_MULTI 7076 4.45 7.02 2.96 60 XM_SendGrid 7074 6.41 7.01 6.07 61 LotsOfNums_01 6393 7.84 6.34 8.71 62 TR_XM_PhishingBody 6108 3.70 6.06 2.33 63 XMSubMetaSx_00 5946 4.66 5.90 3.94 64 BAYES_95 5778 4.09 5.73 3.15 65 HTML_MIME_NO_HTML_TAG 5705 2.89 5.66 1.28 66 T_REMOTE_IMAGE 5072 4.65 5.03 4.43 67 XM_B_Investor 4908 2.58 4.87 1.25 68 XMStrtUSub 4853 5.55 4.81 5.98 69 XMLngstWrd_00 4744 2.14 4.70 0.66 70 XMLngstWrd_01 4694 2.08 4.65 0.59 71 XMLngstWrd_02 4663 2.01 4.62 0.49 72 RCVD_IN_VALIDITY_SAFE 4640 5.83 4.60 6.54 73 TR_XM_DK_SendGrid 4629 4.28 4.59 4.10 74 XM_GoogleGroups 4522 2.48 4.48 1.32 75 MIME_HTML_MOSTLY 4339 3.05 4.30 2.33 76 XMLngstWrd_03 4307 1.81 4.27 0.39 77 USER_IN_DEF_DKIM_WL 4261 12.88 4.22 17.89 78 TooManyTo_001 4219 5.76 4.18 6.68 79 HTML_TITLE_SUBJ_DIFF 4196 1.56 4.16 0.05 80 XMLngstWrd_04 4185 1.71 4.15 0.29 81 UPPERCASE_75_100 4175 1.54 4.14 0.03 82 XM_B_Phish_Phrases 4139 3.40 4.10 2.99 83 HTML_IMAGE_RATIO_04 4075 5.16 4.04 5.81 84 RCVD_IN_VALIDITY_CERTIFIED 4024 5.07 3.99 5.69 85 T_XMDrugObfuBody_14 3974 2.61 3.94 1.83 86 TR_XM_SpammyWords5 3878 2.84 3.85 2.26 87 XM_B_SpammyTLD 3844 2.81 3.81 2.24 88 SpammyFromTLD_01 3825 1.61 3.79 0.34 89 XM_SPF_SoftFail 3687 2.72 3.66 2.17 90 XM_UB50 3597 1.79 3.57 0.75 91 XM_B_Phish66 3589 1.97 3.56 1.05 92 XM_DIRTYINTL 3313 1.35 3.28 0.23 93 XMNumbers 3304 6.02 3.28 7.61 94 XM_H_Undi_Recip 3268 1.33 3.24 0.22 95 T_TooManySym_01 3226 7.71 3.20 10.32 96 XM_B_SpammyWords4 3154 1.89 3.13 1.17 97 XM_DK_Undo_01 3102 1.98 3.08 1.34 98 SUBJ_ALL_CAPS 3075 1.98 3.05 1.35 99 HTML_IMAGE_RATIO_06 2951 2.99 2.93 3.03 100 T_XMDrugObfuBody_08 2928 1.77 2.90 1.11 101 T_FILL_THIS_FORM_SHORT 2918 1.50 2.89 0.70 102 XM_CamelCaseFrm001 2894 2.28 2.87 1.94 103 XMBody_17 2784 1.33 2.76 0.50 104 RCVD_IN_VALIDITY_RPBL 2757 1.02 2.73 0.02 105 HTML_IMAGE_RATIO_08 2728 2.02 2.70 1.62 106 URI_NOVOWEL 2718 2.56 2.70 2.48 107 FROM_EXCESS_BASE64 2707 3.35 2.68 3.73 108 DKIM_INVALID 2645 3.10 2.62 3.38 109 XM_OfRef6 2424 1.56 2.40 1.07 110 BOTNET_NORDNS 2343 0.86 2.32 0.01 111 HK_RANDOM_REPLYTO 2324 1.01 2.30 0.27 112 XM_B_Unsub2 2317 1.47 2.30 0.99 113 KHOP_HELO_FCRDNS 2265 1.98 2.25 1.83 114 TM2_M_URI_OPT_OUT 2255 2.35 2.24 2.42 115 SpammyFromTLD_02 2125 1.17 2.11 0.62 116 XMDiploma_00 2038 1.84 2.02 1.73 117 PDS_OTHER_BAD_TLD 2028 0.85 2.01 0.18 118 T_XMHurry_00 1861 0.90 1.85 0.35 119 TR_XM_SB_Phish 1812 1.79 1.80 1.78 120 MIME_QP_LONG_LINE 1798 3.14 1.78 3.92 121 XM_UB99 1743 0.64 1.73 0.00 122 MONEY_NOHTML 1648 0.65 1.63 0.08 123 TR_XM_FormFill 1624 0.60 1.61 0.01 124 TR_XM_PHPDW 1609 0.85 1.60 0.42 125 XM_B_DynamicLink 1609 0.61 1.60 0.03 126 TR_XM_PHPForged 1596 0.80 1.58 0.35 127 TR_XM_Undi_Recip5 1569 0.58 1.56 0.01 128 TR_XM_FormFill2 1568 0.79 1.55 0.35 129 MPART_ALT_DIFF_COUNT 1559 1.09 1.55 0.83 130 T_XMDrugObfuBody_00 1559 1.16 1.55 0.94 131 XM_H_PHPOS 1558 0.78 1.54 0.33 132 TR_Symld_Words 1521 1.40 1.51 1.33 133 XMBrknScrpt_02 1487 0.80 1.47 0.41 134 HTML_TAG_BALANCE_BODY 1449 1.25 1.44 1.14 135 XMSubPhish11 1445 1.64 1.43 1.77 136 XM_Body_Dirty_Words_01 1425 0.64 1.41 0.20 137 UNDISC_MONEY 1422 0.52 1.41 0.01 138 ALL_TRUSTED 1421 11.36 1.41 17.13 139 XM_H_Long_From02 1416 1.24 1.40 1.15 140 XMSexyCombo_01 1416 0.85 1.40 0.52 141 XMStockSpam_06 1401 0.95 1.39 0.69 142 TR_XM_Undi_Recip2 1388 0.53 1.38 0.04 143 XM_ProductURIs 1372 0.88 1.36 0.61 144 TR_XM_Undi_RecipCombo2 1369 0.50 1.36 0.00 145 TR_LOTS_OF_MONEY3 1364 0.61 1.35 0.18 146 XMSubNoVowel 1358 1.22 1.35 1.15 147 XMReplyNow 1335 0.65 1.32 0.26 148 TR_XM_NoHeaderRelay 1334 0.55 1.32 0.11 149 RELAYCOUNTRY_RU 1332 0.50 1.32 0.02 150 RCVD_IN_IADB_LISTED 1328 3.25 1.32 4.38 151 BAYES_40 1322 3.28 1.31 4.42 152 XMBdyGiftCard01 1314 1.22 1.30 1.17 153 DIET_1 1293 0.65 1.28 0.28 154 URIBL_DBL_SPAM 1284 0.47 1.27 0.01 155 FONT_INVIS_LONG_LINE 1275 0.59 1.26 0.20 156 TR_Caps_n_Bayes_99 1271 0.70 1.26 0.38 157 RELAYCOUNTRY_IN 1255 0.50 1.24 0.07 158 XM_UB999 1253 0.46 1.24 0.00 159 XM_URI_RBL 1244 0.53 1.23 0.13 160 TR_LOTS_OF_MONEY2 1242 0.58 1.23 0.21 161 T_MONEY_PERCENT 1242 0.58 1.23 0.21 162 LOADSA_MONEY_COMBO 1205 0.49 1.19 0.09 163 URI_HEX 1190 1.16 1.18 1.15 164 TR_Sbj_FN_Bdy 1184 0.51 1.17 0.13 165 XMPhish30 1172 0.91 1.16 0.77 166 RCVD_IN_IADB_SPF 1167 2.88 1.16 3.87 167 HTTPS_HTTP_MISMATCH 1160 0.72 1.15 0.47 168 TR_XM_COVIDMETA1 1133 0.50 1.12 0.13 169 PLING_QUERY 1105 0.80 1.10 0.63 170 RELAYCOUNTRY_CN 1096 0.44 1.09 0.06 171 XMHTML_After_End 1084 0.70 1.07 0.48 172 RCVD_IN_IADB_SENDERID 1081 2.60 1.07 3.49 173 RCVD_IN_IADB_DK 1080 2.54 1.07 3.39 174 MAILING_LIST_MULTI 1042 1.72 1.03 2.11 175 TR_XM_BayesRelay 1027 0.38 1.02 0.00 176 XM_B_COVIDMETA 1027 0.80 1.02 0.67 177 XMHTMLBadTable_001 998 0.77 0.99 0.65 178 RCVD_IN_PSBL 992 0.60 0.98 0.37 179 URI_TRY_3LD 979 0.73 0.97 0.60 180 XMGenDplmaNmb 979 0.99 0.97 1.00 181 XM_B_Crypto 976 0.41 0.97 0.09 182 TR_XM_INV_DKIM 972 0.56 0.96 0.32 183 RCVD_IN_RP_SAFE 967 1.11 0.96 1.20 184 TR_MetaPhish_Combo_01 961 0.97 0.95 0.99 185 XFER_LOTSA_MONEY 939 0.35 0.93 0.01 186 RELAYCOUNTRY_AU 914 0.42 0.91 0.14 187 REMOVE_BEFORE_LINK 907 0.45 0.90 0.18 188 BAYES_20 885 2.22 0.88 3.00 189 URIBL_BLACK 884 0.34 0.88 0.02 190 URI_NO_WWW_BIZ_CGI 870 0.32 0.86 0.01 191 SHOPIFY_IMG_NOT_RCVD_SFY 855 0.46 0.85 0.24 192 RCVD_IN_RP_CERTIFIED 852 0.98 0.84 1.05 193 TR_Mismatch_TLD_01 844 0.50 0.84 0.31 194 TR_XM_Undi_Recip11 832 0.32 0.82 0.02 195 XM_B_REG_HTML 816 0.56 0.81 0.42 196 SUBJ_DOLLARS 810 0.53 0.80 0.37 197 TR_Mismatch_TLD_02 806 0.34 0.80 0.08 198 MIME_BASE64_TEXT 804 0.36 0.80 0.10 199 XMBody_29 803 0.32 0.80 0.05 200 XM_B_COPY_HTML 797 0.94 0.79 1.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 140088 81.10 82.09 80.53 2 HTML_MESSAGE 138425 85.03 94.43 79.58 3 DKIM_SIGNED 132108 81.44 90.92 75.94 4 XM_DK_Pass 127129 78.86 88.84 73.08 5 DKIM_VALID 126227 78.34 88.29 72.56 6 XM_B_Unicode 117282 72.22 80.49 67.42 7 DCC_CHECK_NEGATIVE 114065 51.29 26.66 65.57 8 DKIM_VALID_AU 104594 63.78 70.08 60.13 9 BAYES_50 92002 46.54 35.58 52.89 10 XMListUnsubscribeExists 89282 58.34 70.43 51.33 11 XM_B_SpammyWords 75179 51.50 65.77 43.22 12 XM_B_Unicode3 72632 42.64 44.16 41.75 13 RCVD_IN_MSPIKE_H2 64174 40.41 46.49 36.89 14 DCC_CHECK 59844 48.68 73.32 34.40 15 DKIM_VALID_EF 49644 29.26 30.52 28.54 16 HTML_FONT_LOW_CONTRAST 47926 29.09 31.76 27.55 17 LOC_TINY_FONT_1 44708 30.15 37.82 25.70 18 FVGT_m_MULTI_ODD 43546 27.81 32.60 25.03 19 XMSubLong 40890 22.50 20.76 23.51 20 T_TM2_M_HEADER_IN_MSG 38769 20.86 18.41 22.29 21 MIME_HTML_ONLY 36439 25.52 33.41 20.95 22 XM_B_SpammyWords2 34352 26.35 37.74 19.75 23 T_KAM_HTML_FONT_INVALID 31228 21.94 28.82 17.95 24 USER_IN_DEF_DKIM_WL 31123 12.88 4.22 17.89 25 ALL_TRUSTED 29806 11.36 1.41 17.13 26 XM_Multi_Part_URI 24857 15.15 16.64 14.29 27 XM_Body_Dirty_Words 21570 15.90 21.93 12.40 28 BAYES_60 20213 10.10 7.49 11.62 29 XM_DKIMWhitelistDomains 19973 7.33 0.18 11.48 30 RCVD_IN_MSPIKE_WL 18333 10.49 10.41 10.54 31 T_TooManySym_01 17952 7.71 3.20 10.32 32 BAYES_00 17066 6.48 0.72 9.81 33 XM_DK_Undo_02 16473 23.09 46.57 9.47 34 XM_B_Unsub 16076 11.63 15.74 9.24 35 UNPARSEABLE_RELAY 15702 11.87 16.79 9.03 36 RCVD_IN_MSPIKE_H3 15247 9.22 10.00 8.76 37 LotsOfNums_01 15145 7.84 6.34 8.71 38 XM_Evil_Numbers_Gen 14951 8.25 7.64 8.59 39 BAYES_99 13699 19.17 38.65 7.88 40 LOTS_OF_MONEY 13644 9.74 13.02 7.84 41 XMNumbers 13246 6.02 3.28 7.61 42 TR_XM_BayesUnsub 12937 10.41 15.54 7.44 43 TR_XM_UnparsRelay 12515 10.58 16.42 7.19 44 T_TooManySym_02 12135 4.70 0.78 6.98 45 TooManyTo_001 11617 5.76 4.18 6.68 46 TR_XM_DK_Bayes 11505 4.42 0.63 6.61 47 RCVD_IN_VALIDITY_SAFE 11373 5.83 4.60 6.54 48 TR_XM_DK_Bayes1 11372 4.37 0.63 6.54 49 IN_ZIMBRA_NJ_WHITELIST 11307 4.15 0.08 6.50 50 BAYES_999 11227 15.55 31.24 6.45 51 HTML_IMAGE_RATIO_02 11219 7.23 8.58 6.45 52 TR_XM_DKIM_Undo 10721 18.00 38.42 6.16 53 BOTNET_IPINHOSTNAME 10582 7.94 11.15 6.08 54 XM_SendGrid 10551 6.41 7.01 6.07 55 XMStrtUSub 10407 5.55 4.81 5.98 56 TR_XM_DK_Bayes2 10321 3.91 0.42 5.93 57 HTML_IMAGE_RATIO_04 10105 5.16 4.04 5.81 58 RCVD_IN_VALIDITY_CERTIFIED 9906 5.07 3.99 5.69 59 XM_B_SpammyWords3 9688 8.73 14.18 5.57 60 XM_H_Long_From01 9635 6.14 7.17 5.54 61 BAYES_80 8842 6.57 9.12 5.08 62 XM_UncommonTLD01 8158 6.16 8.68 4.69 63 TR_XM_SpammyWords4 8011 6.81 10.60 4.61 64 MPART_ALT_DIFF 7984 6.68 10.27 4.59 65 T_REMOTE_IMAGE 7704 4.65 5.03 4.43 66 BAYES_40 7688 3.28 1.31 4.42 67 RCVD_IN_IADB_LISTED 7611 3.25 1.32 4.38 68 XMSexyCombo_05 7527 6.87 11.26 4.33 69 TR_XM_DK_SendGrid 7138 4.28 4.59 4.10 70 INVALID_MSGID 7119 2.65 0.16 4.09 71 XMSubMetaSx_00 6854 4.66 5.90 3.94 72 MIME_QP_LONG_LINE 6822 3.14 1.78 3.92 73 RCVD_IN_IADB_SPF 6738 2.88 1.16 3.87 74 TVD_RCVD_IP 6617 2.52 0.31 3.80 75 FROM_EXCESS_BASE64 6492 3.35 2.68 3.73 76 RCVD_IN_IADB_SENDERID 6069 2.60 1.07 3.49 77 RELAYCOUNTRY_META 5917 10.13 21.74 3.40 78 RCVD_IN_IADB_DK 5895 2.54 1.07 3.39 79 DKIM_INVALID 5881 3.10 2.62 3.38 80 TO_MALFORMED 5768 2.11 0.02 3.32 81 BAYES_95 5474 4.09 5.73 3.15 82 FSL_BULK_SIG 5447 5.95 10.82 3.13 83 HTML_IMAGE_RATIO_06 5267 2.99 2.93 3.03 84 BAYES_20 5215 2.22 0.88 3.00 85 XM_B_Phish_Phrases 5194 3.40 4.10 2.99 86 MIME_HTML_ONLY_MULTI 5156 4.45 7.02 2.96 87 RCVD_IN_IADB_VOUCHED 5025 2.08 0.68 2.89 88 TR_DCC_Bayes_99 4916 11.81 27.30 2.83 89 ANY_BOUNCE_MESSAGE 4872 1.91 0.38 2.80 90 BOUNCE_MESSAGE 4872 1.91 0.38 2.80 91 XM_H_Trusted_IP 4862 1.77 0.00 2.79 92 T_TooManySym_03 4786 1.87 0.36 2.75 93 URI_NOVOWEL 4306 2.56 2.70 2.48 94 TM2_M_URI_OPT_OUT 4203 2.35 2.24 2.42 95 XM_PDF 4062 1.59 0.32 2.34 96 TR_XM_PhishingBody 4061 3.70 6.06 2.33 97 MIME_HTML_MOSTLY 4053 3.05 4.30 2.33 98 IN_HORDE_ADDRESS_BOOK 3936 1.46 0.08 2.26 99 TR_XM_SpammyWords5 3923 2.84 3.85 2.26 100 XM_B_SpammyTLD 3888 2.81 3.81 2.24 101 XM_SPF_SoftFail 3780 2.72 3.66 2.17 102 BAYES_05 3754 1.55 0.50 2.16 103 XMGappySubj_01 3732 1.40 0.11 2.15 104 MAILING_LIST_MULTI 3679 1.72 1.03 2.11 105 XMBSHREFv2 3585 1.39 0.22 2.06 106 RCVD_IN_IADB_OPTIN 3439 1.40 0.40 1.98 107 XM_CamelCaseFrm001 3372 2.28 2.87 1.94 108 T_XMDrugObfuBody_14 3192 2.61 3.94 1.83 109 KHOP_HELO_FCRDNS 3186 1.98 2.25 1.83 110 TR_XM_SB_Phish 3095 1.79 1.80 1.78 111 XMSubPhish11 3072 1.64 1.43 1.77 112 RCVD_IN_MSPIKE_H4 3029 1.25 0.39 1.74 113 XM_B_SEO 3006 1.26 0.45 1.73 114 XMDiploma_00 3006 1.84 2.02 1.73 115 TVD_SPACE_RATIO 2970 1.13 0.13 1.71 116 FVGT_m_MULTI_ODD_EMAIL 2912 1.09 0.09 1.67 117 HTML_IMAGE_RATIO_08 2820 2.02 2.70 1.62 118 TR_XM_SpammyWords2 2756 6.39 14.69 1.58 119 BOTNET 2595 4.24 8.99 1.49 120 TR_XM_SpammyRelay 2416 5.84 13.52 1.39 121 MSGID_NOFQDN1 2361 0.86 0.01 1.36 122 SUBJ_ALL_CAPS 2356 1.98 3.05 1.35 123 TooManyTo_002 2351 0.96 0.28 1.35 124 XM_DK_Undo_01 2331 1.98 3.08 1.34 125 TR_Symld_Words 2319 1.40 1.51 1.33 126 XM_GoogleGroups 2293 2.48 4.48 1.32 127 HTML_MIME_NO_HTML_TAG 2229 2.89 5.66 1.28 128 XM_B_Investor 2173 2.58 4.87 1.25 129 RELAYCOUNTRY_CA 2100 4.22 9.40 1.21 130 RCVD_IN_RP_SAFE 2092 1.11 0.96 1.20 131 RCVD_IN_BL_SPAMCOP_NET 2045 4.79 11.02 1.18 132 XMBdyGiftCard01 2040 1.22 1.30 1.17 133 XM_B_SpammyWords4 2027 1.89 3.13 1.17 134 TM2_M_VERY_LONG_WORD 2022 3.37 7.17 1.16 135 UNTRUSTED_Relay 2001 3.49 7.52 1.15 136 XM_shorewaves_Whitelist 1999 0.73 0.00 1.15 137 URI_HEX 1998 1.16 1.18 1.15 138 XM_H_Long_From02 1996 1.24 1.40 1.15 139 XMSubNoVowel 1995 1.22 1.35 1.15 140 HTML_TAG_BALANCE_BODY 1988 1.25 1.44 1.14 141 T_XMDrugObfuBody_08 1923 1.77 2.90 1.11 142 XM_OfRef6 1854 1.56 2.40 1.07 143 XMBody_95 1843 0.70 0.09 1.06 144 XM_B_Phish66 1833 1.97 3.56 1.05 145 RCVD_IN_RP_CERTIFIED 1830 0.98 0.84 1.05 146 XM_B_COPY_HTML 1778 0.94 0.79 1.02 147 XMGenDplmaNmb 1736 0.99 0.97 1.00 148 XM_B_Unsub2 1720 1.47 2.30 0.99 149 TooManyTo_003 1716 0.70 0.21 0.99 150 TR_MetaPhish_Combo_01 1715 0.97 0.95 0.99 151 XM_D_tchamptons_WL 1706 0.62 0.00 0.98 152 T_XMDrugObfuBody_00 1640 1.16 1.55 0.94 153 HTML_IMAGE_ONLY_20 1513 0.79 0.64 0.87 154 DKIM_ADSP_CUSTOM_MED 1467 0.80 0.73 0.84 155 MPART_ALT_DIFF_COUNT 1446 1.09 1.55 0.83 156 HTML_FONT_FACE_BAD 1403 0.78 0.75 0.81 157 XM_H_PHPMailer 1368 0.76 0.71 0.79 158 TooManyTo_004 1337 0.56 0.20 0.77 159 XMPhish30 1333 0.91 1.16 0.77 160 XM_UB50 1313 1.79 3.57 0.75 161 T_FILL_THIS_FORM_SHORT 1215 1.50 2.89 0.70 162 XMStockSpam_06 1207 0.95 1.39 0.69 163 USER_IN_WHITELIST 1180 0.43 0.00 0.68 164 USER_IN_WELCOMELIST 1180 0.43 0.00 0.68 165 XM_B_COVIDMETA 1162 0.80 1.02 0.67 166 TooManyTo_005 1156 0.49 0.18 0.66 167 XMLngstWrd_00 1145 2.14 4.70 0.66 168 XMHTMLBadTable_001 1124 0.77 0.99 0.65 169 PLING_QUERY 1095 0.80 1.10 0.63 170 SpammyFromTLD_02 1084 1.17 2.11 0.62 171 RDNS_DYNAMIC 1083 0.61 0.59 0.62 172 XMSubMetaSxObfu_02 1057 0.57 0.52 0.61 173 XM_ProductURIs 1055 0.88 1.36 0.61 174 URI_TRY_3LD 1037 0.73 0.97 0.60 175 HELO_NODOT 1036 0.52 0.40 0.60 176 HELO_NO_DOMAIN 1035 0.52 0.39 0.59 177 XMLngstWrd_01 1020 2.08 4.65 0.59 178 DATE_IN_PAST_03_06 1014 0.52 0.40 0.58 179 FROM_GOV_DKIM_AU 937 0.35 0.04 0.54 180 XMSexyCombo_01 910 0.85 1.40 0.52 181 XMBody_17 876 1.33 2.76 0.50 182 XM_ShortIntro_01 867 0.46 0.38 0.50 183 XMSubMetaI_00 864 0.54 0.62 0.50 184 NML_ADSP_CUSTOM_MED 860 0.55 0.65 0.49 185 TR_XM_SPAMCOP 850 3.04 7.45 0.49 186 XMLngstWrd_02 848 2.01 4.62 0.49 187 XMHTML_After_End 840 0.70 1.07 0.48 188 XMNoVowels 836 0.39 0.24 0.48 189 HTTPS_HTTP_MISMATCH 822 0.72 1.15 0.47 190 FORGED_GMAIL_RCVD 814 0.52 0.62 0.47 191 XMSubMetaSxObfu_03 812 0.45 0.41 0.47 192 XM_S_SubURI 784 0.29 0.02 0.45 193 DKIM_ADSP_NXDOMAIN 775 0.50 0.60 0.45 194 T_TooManySym_04 775 0.36 0.21 0.45 195 RELAYCOUNTRY_GB 773 0.55 0.73 0.44 196 XMCapTrack 764 0.36 0.21 0.44 197 TR_XM_PHPDW 729 0.85 1.60 0.42 198 CTE_8BIT_MISMATCH 725 0.27 0.02 0.42 199 XM_B_REG_HTML 724 0.56 0.81 0.42 200 XMBrknScrpt_02 717 0.80 1.47 0.41 ----------------------------------------------------------------------