Email: 474479 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.57 sec Spam: 155344 Autolearn: 0 AvgScore: 14.04 AvgScanTime: 1.74 sec Ham: 319135 Autolearn: 0 AvgScore: -1.45 AvgScanTime: 1.49 sec Time Spent Running SA: 207.04 hours Time Spent Processing Spam: 74.95 hours Time Spent Processing Ham: 132.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148167 89.55 95.38 86.72 2 DKIM_SIGNED 138852 77.90 89.38 72.31 3 XM_DK_Pass 132976 75.52 85.60 70.62 4 DKIM_VALID 131238 74.48 84.48 69.61 5 XM_B_Unicode 130275 74.76 83.86 70.32 6 RELAYCOUNTRY_US 128174 81.10 82.51 80.42 7 XM_B_SpammyWords 111669 53.32 71.88 44.28 8 DCC_CHECK 111325 45.52 71.66 32.80 9 XMListUnsubscribeExists 106787 54.58 68.74 47.69 10 DKIM_VALID_AU 100171 57.23 64.48 53.69 11 RCVD_IN_MSPIKE_H2 78135 42.25 50.30 38.33 12 XM_B_Unicode3 72172 43.80 46.46 42.51 13 XM_DK_Undo_02 67860 18.90 43.68 6.83 14 BAYES_50 64469 51.36 41.50 56.16 15 XM_B_SpammyWords2 60645 25.58 39.04 19.03 16 LOC_TINY_FONT_1 57999 27.62 37.34 22.89 17 HTML_FONT_LOW_CONTRAST 55976 29.74 36.03 26.68 18 TR_XM_DKIM_Undo 53886 14.40 34.69 4.52 19 DKIM_VALID_EF 51756 29.43 33.32 27.54 20 BAYES_99 50971 15.48 32.81 7.05 21 MIME_HTML_ONLY 50322 24.93 32.39 21.30 22 FVGT_m_MULTI_ODD 47982 26.32 30.89 24.10 23 T_KAM_HTML_FONT_INVALID 45246 22.16 29.13 18.78 24 DCC_CHECK_NEGATIVE 43980 54.43 28.31 67.14 25 BAYES_999 40285 12.52 25.93 5.99 26 TR_DCC_Bayes_99 35813 8.97 23.05 2.12 27 XM_Body_Dirty_Words 35414 15.04 22.80 11.26 28 XMSubLong 35312 22.34 22.73 22.15 29 T_TM2_M_HEADER_IN_MSG 34180 27.45 22.00 30.10 30 XM_Multi_Part_URI 28597 14.23 18.41 12.20 31 RELAYCOUNTRY_META 27651 8.11 17.80 3.40 32 XM_B_Unsub 27332 12.48 17.59 9.98 33 TR_XM_BayesUnsub 26527 10.85 17.08 7.83 34 LOTS_OF_MONEY 26137 11.33 16.83 8.66 35 BOTNET_IPINHOSTNAME 22140 7.90 14.25 4.81 36 TR_XM_SpammyWords4 22134 8.01 14.25 4.97 37 XM_B_SpammyWords3 20462 7.13 13.17 4.19 38 UNPARSEABLE_RELAY 19692 9.24 12.68 7.57 39 TR_XM_SpammyRelay 19285 5.08 12.41 1.51 40 TR_XM_UnparsRelay 19232 8.10 12.38 6.02 41 FSL_BULK_SIG 19146 6.82 12.32 4.15 42 BOTNET 18413 4.82 11.85 1.40 43 RCVD_IN_MSPIKE_WL 17179 14.87 11.06 16.73 44 XMSexyCombo_05 16921 6.02 10.89 3.64 45 RCVD_IN_BL_SPAMCOP_NET 16885 3.80 10.87 0.36 46 TR_XM_SpammyWords2 16751 4.21 10.78 1.01 47 BAYES_80 13533 5.71 8.71 4.25 48 XM_Evil_Numbers_Gen 13488 7.92 8.68 7.56 49 RELAYCOUNTRY_CA 12781 3.39 8.23 1.04 50 RCVD_IN_MSPIKE_H3 12521 9.96 8.06 10.89 51 BAYES_60 11741 8.79 7.56 9.40 52 TR_XM_SPAMCOP 11449 2.56 7.37 0.22 53 XM_SendGrid 11258 5.58 7.25 4.77 54 LotsOfNums_01 11104 8.38 7.15 8.98 55 UNTRUSTED_Relay 11099 3.22 7.14 1.31 56 HTML_IMAGE_RATIO_02 10969 5.99 7.06 5.47 57 XM_UncommonTLD01 10637 4.68 6.85 3.62 58 TR_XM_PhishingBody 10138 4.13 6.53 2.97 59 MPART_ALT_DIFF 10068 6.18 6.48 6.04 60 RCVD_IN_MSPIKE_BL 9577 2.98 6.17 1.43 61 XMSubMetaSx_00 9412 4.51 6.06 3.76 62 TR_XM_MSPIKECOMBO 9408 2.93 6.06 1.41 63 XM_B_Phish_Phrases 9184 4.17 5.91 3.33 64 XM_H_Long_From01 9095 5.44 5.85 5.23 65 BAYES_95 8178 3.48 5.26 2.61 66 XM_B_Investor 8156 2.72 5.25 1.49 67 DKIM_INVALID 7614 3.42 4.90 2.70 68 XM_B_SpammyTLD 7613 3.20 4.90 2.38 69 TR_XM_DK_SendGrid 7000 3.53 4.51 3.05 70 TooManyTo_001 6907 6.84 4.45 8.00 71 HTML_IMAGE_RATIO_06 6868 3.75 4.42 3.42 72 XMStrtUSub 6696 4.43 4.31 4.49 73 XM_SPF_SoftFail 6581 2.89 4.24 2.24 74 TR_XM_SpammyWords3 6569 1.73 4.23 0.51 75 HTML_IMAGE_RATIO_04 6567 5.27 4.23 5.78 76 T_XMDrugObfuBody_14 6533 2.54 4.21 1.73 77 MIME_HTML_MOSTLY 5866 2.87 3.78 2.43 78 TR_XM_SpammyWords5 5810 2.17 3.74 1.41 79 XM_DIRTYINTL 5751 1.42 3.70 0.31 80 XM_OfRef6 5630 1.75 3.62 0.84 81 RCVD_IN_VALIDITY_SAFE 5595 4.25 3.60 4.56 82 MIME_QP_LONG_LINE 5535 4.89 3.56 5.53 83 XM_B_Phish66 5502 2.29 3.54 1.68 84 XMNumbers 5468 3.41 3.52 3.35 85 MIME_HTML_ONLY_MULTI 5249 3.94 3.38 4.21 86 T_XMDrugObfuBody_08 5222 2.03 3.36 1.39 87 XM_UB50 5054 1.61 3.25 0.81 88 TM2_M_VERY_LONG_WORD 5031 2.02 3.24 1.43 89 RCVD_IN_MSPIKE_L5 4865 1.03 3.13 0.01 90 TM2_M_URI_OPT_OUT 4723 3.19 3.04 3.27 91 XM_B_SpammyWords4 4682 1.30 3.01 0.47 92 RCVD_IN_VALIDITY_CERTIFIED 4525 3.68 2.91 4.05 93 PDS_OTHER_BAD_TLD 4506 1.04 2.90 0.14 94 SpammyFromTLD_02 4436 1.36 2.86 0.64 95 URI_NOVOWEL 4368 2.78 2.81 2.77 96 RCVD_IN_MSPIKE_H4 4358 4.16 2.81 4.82 97 USER_IN_DEF_DKIM_WL 4325 9.28 2.78 12.44 98 RCVD_IN_IADB_LISTED 4198 4.75 2.70 5.75 99 XMBody_17 4107 1.21 2.64 0.51 100 T_FILL_THIS_FORM_SHORT 4019 1.42 2.59 0.86 101 T_TooManySym_01 3982 5.06 2.56 6.28 102 T_REMOTE_IMAGE 3974 3.26 2.56 3.59 103 HTML_MIME_NO_HTML_TAG 3953 2.42 2.54 2.37 104 HTML_IMAGE_RATIO_08 3951 2.67 2.54 2.74 105 XM_B_Unsub2 3900 1.86 2.51 1.54 106 KHOP_HELO_FCRDNS 3877 1.82 2.50 1.50 107 XMDiploma_00 3795 1.84 2.44 1.54 108 SpammyFromTLD_01 3759 1.25 2.42 0.68 109 TM2_M_A_HREF_HREF 3737 1.35 2.41 0.84 110 RCVD_IN_MSPIKE_L3 3629 1.52 2.34 1.13 111 FROM_EXCESS_BASE64 3580 2.35 2.30 2.37 112 RCVD_IN_IADB_SPF 3526 4.18 2.27 5.12 113 RCVD_IN_VALIDITY_RPBL 3500 0.75 2.25 0.01 114 XMStockSpam_06 3443 1.42 2.22 1.03 115 XM_CamelCaseFrm001 3385 2.01 2.18 1.93 116 DIET_1 3368 1.01 2.17 0.44 117 URI_PHP_REDIR 3346 0.71 2.15 0.00 118 SUBJ_ALL_CAPS 3340 1.82 2.15 1.66 119 TR_XM_MSPIKECOMBO2 3281 0.90 2.11 0.31 120 T_XMDrugObfuBody_00 3277 1.20 2.11 0.75 121 TR_LOTS_OF_MONEY3 3274 0.97 2.11 0.42 122 TR_XM_SB_Phish 3261 2.17 2.10 2.20 123 RCVD_IN_IADB_DK 3214 3.65 2.07 4.42 124 RCVD_IN_IADB_SENDERID 3180 3.76 2.05 4.59 125 XM_DK_Undo_01 3141 1.64 2.02 1.45 126 XM_B_COVIDMETA 3128 1.04 2.01 0.57 127 BOTNET_NORDNS 3009 0.64 1.94 0.01 128 XM_H_Undi_Recip 2945 0.76 1.90 0.21 129 XMSubPhish11 2924 2.07 1.88 2.16 130 XMSexyCombo_01 2865 1.16 1.84 0.82 131 TR_Symld_Words 2776 1.77 1.79 1.77 132 MAILING_LIST_MULTI 2721 2.51 1.75 2.88 133 RCVD_IN_PSBL 2703 0.79 1.74 0.33 134 BAYES_40 2590 3.61 1.67 4.56 135 URIBL_DBL_SPAM 2586 0.55 1.66 0.01 136 URI_HEX 2573 1.38 1.66 1.24 137 TR_XM_MaxSPIKE 2513 0.68 1.62 0.23 138 TR_XM_COVIDMETA4 2490 0.68 1.60 0.24 139 XM_UB99 2468 0.52 1.59 0.00 140 T_XMHurry_00 2447 0.86 1.58 0.52 141 XMHTML_After_End 2433 1.03 1.57 0.76 142 ALL_TRUSTED 2427 11.83 1.56 16.83 143 TR_XM_PHPDW 2358 0.72 1.52 0.34 144 RCVD_IN_IADB_VOUCHED 2337 2.97 1.50 3.68 145 XM_ProductURIs 2323 1.79 1.50 1.94 146 TR_XM_COVIDMETA1 2309 0.63 1.49 0.22 147 TR_XM_PHPForged 2307 0.68 1.49 0.29 148 TR_XM_NoHeaderRelay 2301 0.56 1.48 0.11 149 XMReplyNow 2271 0.67 1.46 0.28 150 HTML_TAG_BALANCE_BODY 2271 0.96 1.46 0.72 151 TR_XM_FormFill2 2268 0.67 1.46 0.29 152 XM_H_PHPOS 2252 0.66 1.45 0.28 153 RELAYCOUNTRY_AU 2192 0.64 1.41 0.26 154 MONEY_NOHTML 2173 0.50 1.40 0.07 155 UNDISC_MONEY 2160 0.46 1.39 0.01 156 XMBrknScrpt_02 2159 0.78 1.39 0.49 157 TR_XM_FormFill 2134 0.46 1.37 0.02 158 URIBL_BLACK 2075 0.47 1.34 0.05 159 HTML_OBFUSCATE_05_10 2071 0.53 1.33 0.14 160 HTTPS_HTTP_MISMATCH 2067 0.82 1.33 0.57 161 TR_XM_Base64_M1 2046 1.08 1.32 0.96 162 TR_XM_Undi_Recip11 2036 0.47 1.31 0.06 163 TR_XM_Undi_Recip5 2026 0.43 1.30 0.01 164 XMBdyGiftCard01 2016 0.98 1.30 0.82 165 FROM_SUSPICIOUS_NTLD 2015 0.44 1.30 0.02 166 URI_TRY_3LD 2010 0.84 1.29 0.61 167 XM_H_Long_From02 2008 1.10 1.29 1.01 168 XM_URI_RBL 2006 0.50 1.29 0.12 169 FROM_SUSPICIOUS_NTLD_FP 1962 0.43 1.26 0.02 170 XMPhish30 1949 0.87 1.25 0.69 171 XM_UB999 1923 0.41 1.24 0.00 172 T_MONEY_PERCENT 1912 0.54 1.23 0.20 173 TR_LOTS_OF_MONEY2 1912 0.54 1.23 0.20 174 HK_RANDOM_REPLYTO 1879 0.43 1.21 0.06 175 XM_Body_Dirty_Words_01 1821 0.77 1.17 0.58 176 RELAYCOUNTRY_FR 1797 0.55 1.16 0.26 177 TR_XM_BayesRelay 1756 0.37 1.13 0.00 178 BAYES_20 1741 2.64 1.12 3.37 179 TR_XM_Undi_Recip2 1735 0.37 1.12 0.01 180 XMGenDplmaNmb 1702 0.84 1.10 0.71 181 HTML_TAG_BALANCE_CENTER 1690 0.52 1.09 0.25 182 XM_B_DNDMA 1674 0.58 1.08 0.34 183 LongTLD 1619 0.49 1.04 0.21 184 TR_XM_Undi_RecipCombo2 1576 0.33 1.01 0.00 185 XMClaimOffer 1543 0.40 0.99 0.11 186 REMOVE_BEFORE_LINK 1492 0.46 0.96 0.21 187 MIXED_CENTER_CASE 1489 0.31 0.96 0.00 188 XM_B_SEO 1466 0.42 0.94 0.17 189 MIXED_HREF_CASE 1430 0.30 0.92 0.00 190 DKIM_ADSP_CUSTOM_MED 1429 0.90 0.92 0.90 191 MIXED_IMG_CASE 1418 0.30 0.91 0.00 192 MIXED_AREA_CASE 1416 0.30 0.91 0.00 193 HTML_FONT_FACE_BAD 1401 1.59 0.90 1.93 194 RCVD_IN_IADB_OPTIN 1387 1.95 0.89 2.47 195 XM_PDF 1375 3.39 0.89 4.61 196 HTML_FONT_SIZE_LARGE 1374 0.34 0.88 0.08 197 SHOPIFY_IMG_NOT_RCVD_SFY 1372 0.41 0.88 0.19 198 BODY_URI_ONLY 1357 0.30 0.87 0.02 199 TM2_M_OBFU_COMMENT 1352 0.40 0.87 0.18 200 RELAYCOUNTRY_DE 1342 0.50 0.86 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276743 89.55 95.38 86.72 2 RELAYCOUNTRY_US 256641 81.10 82.51 80.42 3 DKIM_SIGNED 230762 77.90 89.38 72.31 4 XM_DK_Pass 225373 75.52 85.60 70.62 5 XM_B_Unicode 224427 74.76 83.86 70.32 6 DKIM_VALID 222140 74.48 84.48 69.61 7 DCC_CHECK_NEGATIVE 214280 54.43 28.31 67.14 8 BAYES_50 179214 51.36 41.50 56.16 9 DKIM_VALID_AU 171350 57.23 64.48 53.69 10 XMListUnsubscribeExists 152207 54.58 68.74 47.69 11 XM_B_SpammyWords 141318 53.32 71.88 44.28 12 XM_B_Unicode3 135654 43.80 46.46 42.51 13 RCVD_IN_MSPIKE_H2 122336 42.25 50.30 38.33 14 DCC_CHECK 104679 45.52 71.66 32.80 15 T_TM2_M_HEADER_IN_MSG 96050 27.45 22.00 30.10 16 DKIM_VALID_EF 87896 29.43 33.32 27.54 17 HTML_FONT_LOW_CONTRAST 85135 29.74 36.03 26.68 18 FVGT_m_MULTI_ODD 76913 26.32 30.89 24.10 19 LOC_TINY_FONT_1 73040 27.62 37.34 22.89 20 XMSubLong 70698 22.34 22.73 22.15 21 MIME_HTML_ONLY 67961 24.93 32.39 21.30 22 XM_B_SpammyWords2 60732 25.58 39.04 19.03 23 T_KAM_HTML_FONT_INVALID 59919 22.16 29.13 18.78 24 ALL_TRUSTED 53710 11.83 1.56 16.83 25 RCVD_IN_MSPIKE_WL 53387 14.87 11.06 16.73 26 USER_IN_DEF_DKIM_WL 39711 9.28 2.78 12.44 27 XM_Multi_Part_URI 38930 14.23 18.41 12.20 28 XM_Body_Dirty_Words 35942 15.04 22.80 11.26 29 RCVD_IN_MSPIKE_H3 34743 9.96 8.06 10.89 30 BAYES_00 33310 7.26 0.73 10.44 31 XM_B_Unsub 31862 12.48 17.59 9.98 32 XM_DKIMWhitelistDomains 30834 6.60 0.31 9.66 33 BAYES_60 29983 8.79 7.56 9.40 34 LotsOfNums_01 28659 8.38 7.15 8.98 35 LOTS_OF_MONEY 27624 11.33 16.83 8.66 36 TooManyTo_001 25545 6.84 4.45 8.00 37 TR_XM_BayesUnsub 24974 10.85 17.08 7.83 38 UNPARSEABLE_RELAY 24165 9.24 12.68 7.57 39 XM_Evil_Numbers_Gen 24112 7.92 8.68 7.56 40 IN_ZIMBRA_NJ_WHITELIST 22928 4.87 0.12 7.18 41 BAYES_99 22497 15.48 32.81 7.05 42 XM_DK_Undo_02 21797 18.90 43.68 6.83 43 T_TooManySym_01 20029 5.06 2.56 6.28 44 TR_XM_DK_Bayes 19376 4.26 0.52 6.07 45 MPART_ALT_DIFF 19271 6.18 6.48 6.04 46 TR_XM_UnparsRelay 19207 8.10 12.38 6.02 47 TR_XM_DK_Bayes1 19127 4.20 0.52 5.99 48 BAYES_999 19118 12.52 25.93 5.99 49 HTML_IMAGE_RATIO_04 18455 5.27 4.23 5.78 50 RCVD_IN_IADB_LISTED 18363 4.75 2.70 5.75 51 MIME_QP_LONG_LINE 17662 4.89 3.56 5.53 52 HTML_IMAGE_RATIO_02 17472 5.99 7.06 5.47 53 TR_XM_DK_Bayes2 16918 3.72 0.46 5.30 54 XM_H_Long_From01 16701 5.44 5.85 5.23 55 RCVD_IN_IADB_SPF 16327 4.18 2.27 5.12 56 TR_XM_SpammyWords4 15855 8.01 14.25 4.97 57 RCVD_IN_MSPIKE_H4 15387 4.16 2.81 4.82 58 BOTNET_IPINHOSTNAME 15344 7.90 14.25 4.81 59 XM_SendGrid 15209 5.58 7.25 4.77 60 XM_H_Trusted_IP 14852 3.13 0.00 4.65 61 XM_PDF 14702 3.39 0.89 4.61 62 RCVD_IN_IADB_SENDERID 14637 3.76 2.05 4.59 63 RCVD_IN_VALIDITY_SAFE 14548 4.25 3.60 4.56 64 BAYES_40 14547 3.61 1.67 4.56 65 TR_XM_DKIM_Undo 14430 14.40 34.69 4.52 66 XMStrtUSub 14316 4.43 4.31 4.49 67 RCVD_IN_IADB_DK 14094 3.65 2.07 4.42 68 BAYES_80 13550 5.71 8.71 4.25 69 MIME_HTML_ONLY_MULTI 13448 3.94 3.38 4.21 70 XM_B_SpammyWords3 13386 7.13 13.17 4.19 71 FSL_BULK_SIG 13231 6.82 12.32 4.15 72 RCVD_IN_VALIDITY_CERTIFIED 12913 3.68 2.91 4.05 73 T_TooManySym_02 12058 2.77 0.69 3.78 74 XMSubMetaSx_00 12004 4.51 6.06 3.76 75 RCVD_IN_IADB_VOUCHED 11749 2.97 1.50 3.68 76 XMSexyCombo_05 11626 6.02 10.89 3.64 77 XM_UncommonTLD01 11555 4.68 6.85 3.62 78 T_REMOTE_IMAGE 11471 3.26 2.56 3.59 79 HTML_IMAGE_RATIO_06 10918 3.75 4.42 3.42 80 RELAYCOUNTRY_META 10850 8.11 17.80 3.40 81 BAYES_20 10767 2.64 1.12 3.37 82 XMNumbers 10702 3.41 3.52 3.35 83 XM_B_Phish_Phrases 10623 4.17 5.91 3.33 84 TM2_M_URI_OPT_OUT 10434 3.19 3.04 3.27 85 ANY_BOUNCE_MESSAGE 9817 2.33 0.80 3.08 86 BOUNCE_MESSAGE 9814 2.33 0.80 3.08 87 TR_XM_DK_SendGrid 9728 3.53 4.51 3.05 88 TR_XM_PhishingBody 9479 4.13 6.53 2.97 89 MAILING_LIST_MULTI 9189 2.51 1.75 2.88 90 URI_NOVOWEL 8835 2.78 2.81 2.77 91 HTML_IMAGE_RATIO_08 8731 2.67 2.54 2.74 92 DKIM_INVALID 8622 3.42 4.90 2.70 93 BAYES_95 8339 3.48 5.26 2.61 94 RCVD_IN_IADB_OPTIN 7889 1.95 0.89 2.47 95 MIME_HTML_MOSTLY 7761 2.87 3.78 2.43 96 XM_B_SpammyTLD 7580 3.20 4.90 2.38 97 FROM_EXCESS_BASE64 7554 2.35 2.30 2.37 98 HTML_MIME_NO_HTML_TAG 7549 2.42 2.54 2.37 99 XM_SPF_SoftFail 7155 2.89 4.24 2.24 100 TR_XM_SB_Phish 7032 2.17 2.10 2.20 101 BAYES_05 6927 1.67 0.63 2.17 102 XMSubPhish11 6888 2.07 1.88 2.16 103 TVD_RCVD_IP 6804 1.52 0.27 2.13 104 TR_DCC_Bayes_99 6771 8.97 23.05 2.12 105 INVALID_MSGID 6744 1.47 0.13 2.11 106 TooManyTo_002 6742 1.57 0.45 2.11 107 XM_ProductURIs 6177 1.79 1.50 1.94 108 XM_CamelCaseFrm001 6160 2.01 2.18 1.93 109 HTML_FONT_FACE_BAD 6147 1.59 0.90 1.93 110 IN_HORDE_ADDRESS_BOOK 6096 1.32 0.11 1.91 111 TO_MALFORMED 5929 1.25 0.01 1.86 112 TR_Symld_Words 5637 1.77 1.79 1.77 113 T_XMDrugObfuBody_14 5533 2.54 4.21 1.73 114 XMGappySubj_01 5369 1.18 0.16 1.68 115 XM_B_Phish66 5362 2.29 3.54 1.68 116 SUBJ_ALL_CAPS 5290 1.82 2.15 1.66 117 HELO_NODOT 5218 1.30 0.63 1.64 118 HELO_NO_DOMAIN 5214 1.30 0.62 1.63 119 XM_B_Unsub2 4928 1.86 2.51 1.54 120 XMDiploma_00 4925 1.84 2.44 1.54 121 TR_XM_SpammyRelay 4818 5.08 12.41 1.51 122 KHOP_HELO_FCRDNS 4778 1.82 2.50 1.50 123 XM_B_Investor 4755 2.72 5.25 1.49 124 XM_GoogleGroups 4687 1.25 0.79 1.47 125 XM_DK_Undo_01 4639 1.64 2.02 1.45 126 TM2_M_VERY_LONG_WORD 4576 2.02 3.24 1.43 127 RCVD_IN_MSPIKE_BL 4552 2.98 6.17 1.43 128 MSGID_NOFQDN1 4530 0.96 0.03 1.42 129 TR_XM_SpammyWords5 4509 2.17 3.74 1.41 130 TR_XM_MSPIKECOMBO 4486 2.93 6.06 1.41 131 BOTNET 4472 4.82 11.85 1.40 132 T_XMDrugObfuBody_08 4425 2.03 3.36 1.39 133 TooManyTo_003 4401 1.05 0.36 1.38 134 UNTRUSTED_Relay 4168 3.22 7.14 1.31 135 XMBSHREFv2 4064 0.95 0.28 1.27 136 XMSubNoVowel 3994 1.12 0.85 1.25 137 URI_HEX 3954 1.38 1.66 1.24 138 TVD_SPACE_RATIO 3865 0.84 0.08 1.21 139 RCVD_IN_MSPIKE_L3 3601 1.52 2.34 1.13 140 XM_D_tchamptons_WL 3504 0.75 0.03 1.10 141 RELAYCOUNTRY_CA 3309 3.39 8.23 1.04 142 XMCapTrack 3306 0.81 0.34 1.04 143 XMStockSpam_06 3295 1.42 2.22 1.03 144 RCVD_IN_MSPIKE_H5 3257 0.75 0.19 1.02 145 XM_H_Long_From02 3232 1.10 1.29 1.01 146 TR_XM_SpammyWords2 3230 4.21 10.78 1.01 147 TooManyTo_004 3197 0.77 0.30 1.00 148 TR_XM_Base64_M1 3058 1.08 1.32 0.96 149 XMBody_95 2988 0.68 0.16 0.94 150 RCVD_IN_RP_SAFE 2917 0.85 0.70 0.91 151 T_TooManySym_03 2902 0.73 0.36 0.91 152 DKIM_ADSP_CUSTOM_MED 2865 0.90 0.92 0.90 153 TR_MetaPhish_Combo_01 2746 0.84 0.80 0.86 154 T_FILL_THIS_FORM_SHORT 2742 1.42 2.59 0.86 155 XM_OfRef6 2694 1.75 3.62 0.84 156 TM2_M_A_HREF_HREF 2687 1.35 2.41 0.84 157 XMSexyCombo_01 2624 1.16 1.84 0.82 158 XMBdyGiftCard01 2615 0.98 1.30 0.82 159 RCVD_IN_RP_CERTIFIED 2597 0.73 0.56 0.81 160 XM_UB50 2591 1.61 3.25 0.81 161 XM_B_COPY_HTML 2590 0.79 0.75 0.81 162 TooManyTo_005 2544 0.62 0.26 0.80 163 HTML_IMAGE_ONLY_20 2509 0.76 0.70 0.79 164 XMHTML_After_End 2436 1.03 1.57 0.76 165 T_XMDrugObfuBody_00 2405 1.20 2.11 0.75 166 HTML_TAG_BALANCE_BODY 2299 0.96 1.46 0.72 167 XMGenDplmaNmb 2280 0.84 1.10 0.71 168 FROM_GOV_DKIM_AU 2260 0.52 0.15 0.71 169 XMPhish30 2200 0.87 1.25 0.69 170 XM_ShortIntro_01 2177 0.55 0.29 0.68 171 SpammyFromTLD_01 2172 1.25 2.42 0.68 172 SpammyFromTLD_02 2038 1.36 2.86 0.64 173 T_OBFU_PDF_ATTACH 2007 0.48 0.18 0.63 174 XM_RXBody 1971 0.61 0.60 0.62 175 XMNoVowels 1959 0.57 0.47 0.61 176 URI_TRY_3LD 1952 0.84 1.29 0.61 177 XM_H_PHPMailer 1944 0.65 0.74 0.61 178 TR_XM_INV_DKIM 1942 0.61 0.60 0.61 179 XM_Body_Dirty_Words_01 1850 0.77 1.17 0.58 180 XMLngstWrd_00 1846 0.63 0.74 0.58 181 XM_B_COVIDMETA 1817 1.04 2.01 0.57 182 HTTPS_HTTP_MISMATCH 1813 0.82 1.33 0.57 183 BASE64_LENGTH_79_INF 1768 0.44 0.20 0.55 184 NML_ADSP_CUSTOM_MED 1761 0.62 0.76 0.55 185 TO_NO_BRKTS_HTML_ONLY 1755 0.40 0.11 0.55 186 RELAYCOUNTRY_GB 1676 0.51 0.49 0.53 187 T_XMHurry_00 1644 0.86 1.58 0.52 188 XMBody_17 1628 1.21 2.64 0.51 189 TR_XM_SpammyWords3 1616 1.73 4.23 0.51 190 FORGED_GMAIL_RCVD 1604 0.58 0.73 0.50 191 XMSexyCombo_04 1575 0.57 0.72 0.49 192 XMBrknScrpt_02 1562 0.78 1.39 0.49 193 MPART_ALT_DIFF_COUNT 1557 0.60 0.83 0.49 194 SHORT_HELO_AND_INLINE_IMAGE 1548 0.35 0.07 0.49 195 XMHTMLBadTable_001 1547 0.57 0.75 0.48 196 XMLngstWrd_01 1540 0.55 0.69 0.48 197 XMSexyCombo_02 1506 0.44 0.39 0.47 198 XMSubMetaI_00 1504 0.57 0.78 0.47 199 RCVD_IN_SORBS_DUL 1496 0.36 0.12 0.47 200 XM_B_SpammyWords4 1487 1.30 3.01 0.47 ----------------------------------------------------------------------