Email: 497088 Autolearn: 0 AvgScore: 3.65 AvgScanTime: 1.28 sec Spam: 165279 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 1.42 sec Ham: 331809 Autolearn: 0 AvgScore: -1.45 AvgScanTime: 1.21 sec Time Spent Running SA: 176.59 hours Time Spent Processing Spam: 65.18 hours Time Spent Processing Ham: 111.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158883 89.84 96.13 86.71 2 DKIM_SIGNED 143863 77.39 87.04 72.58 3 XM_DK_Pass 140774 75.87 85.17 71.24 4 DKIM_VALID 138722 74.71 83.93 70.12 5 XM_B_Unicode 137494 72.37 83.19 66.98 6 RELAYCOUNTRY_US 131441 80.43 79.53 80.88 7 XM_B_SpammyWords 112699 52.02 68.19 43.96 8 XMListUnsubscribeExists 112343 53.90 67.97 46.89 9 DCC_CHECK 110635 42.60 66.94 30.48 10 DKIM_VALID_AU 104483 58.20 63.22 55.70 11 RCVD_IN_MSPIKE_H2 79246 41.20 47.95 37.85 12 XM_DK_Undo_02 68765 18.08 41.61 6.37 13 BAYES_50 67786 51.28 41.01 56.40 14 XM_B_Unicode3 67135 39.16 40.62 38.44 15 XM_B_SpammyWords2 62813 24.42 38.00 17.65 16 FVGT_m_MULTI_ODD 58036 28.48 35.11 25.18 17 TR_XM_DKIM_Undo 56778 14.29 34.35 4.30 18 LOC_TINY_FONT_1 56251 25.57 34.03 21.36 19 MIME_HTML_ONLY 55390 24.18 33.51 19.52 20 BAYES_99 54795 14.47 33.15 5.16 21 DCC_CHECK_NEGATIVE 54598 57.35 33.03 69.46 22 DKIM_VALID_EF 53197 29.90 32.19 28.76 23 HTML_FONT_LOW_CONTRAST 50632 27.11 30.63 25.35 24 T_KAM_HTML_FONT_INVALID 46589 21.83 28.19 18.66 25 BAYES_999 43240 11.52 26.16 4.23 26 XM_Body_Dirty_Words 39565 15.17 23.94 10.80 27 TR_DCC_Bayes_99 38039 8.66 23.02 1.52 28 RELAYCOUNTRY_META 37034 10.11 22.41 3.98 29 XMSubLong 35988 22.16 21.77 22.36 30 T_TM2_M_HEADER_IN_MSG 33425 28.93 20.22 33.27 31 XM_Multi_Part_URI 27684 13.07 16.75 11.23 32 RCVD_IN_MSPIKE_WL 27125 17.78 16.41 18.46 33 XM_B_Unsub 24775 10.18 14.99 7.79 34 TR_XM_BayesUnsub 24133 8.87 14.60 6.02 35 RCVD_IN_MSPIKE_H3 22799 12.90 13.79 12.45 36 BOTNET_IPINHOSTNAME 22190 7.72 13.43 4.87 37 UNPARSEABLE_RELAY 21792 9.29 13.18 7.35 38 TR_XM_SpammyRelay 21683 5.49 13.12 1.69 39 TR_XM_UnparsRelay 21357 8.06 12.92 5.64 40 LOTS_OF_MONEY 20715 9.84 12.53 8.50 41 TR_XM_SpammyWords2 18895 4.40 11.43 0.90 42 XM_B_SpammyWords3 18788 6.23 11.37 3.67 43 FSL_BULK_SIG 17750 5.36 10.74 2.68 44 TR_XM_SpammyWords4 17734 7.34 10.73 5.65 45 BOTNET 17635 4.53 10.67 1.47 46 RCVD_IN_BL_SPAMCOP_NET 16616 3.77 10.05 0.64 47 XMSexyCombo_05 16248 5.18 9.83 2.86 48 RELAYCOUNTRY_CA 15312 3.83 9.26 1.13 49 MPART_ALT_DIFF 14832 6.49 8.97 5.25 50 BAYES_80 14189 5.60 8.58 4.11 51 XM_Evil_Numbers_Gen 14180 8.13 8.58 7.91 52 XM_UncommonTLD01 13864 5.41 8.39 3.93 53 BAYES_60 13535 8.87 8.19 9.21 54 TR_XM_SPAMCOP 12524 2.77 7.58 0.37 55 UNTRUSTED_Relay 12445 3.37 7.53 1.29 56 XM_H_Long_From01 11736 5.56 7.10 4.80 57 TR_XM_PhishingBody 11614 4.49 7.03 3.23 58 XM_B_Phish_Phrases 11425 4.28 6.91 2.98 59 LotsOfNums_01 11041 7.99 6.68 8.64 60 XM_SendGrid 11005 5.46 6.66 4.87 61 MIME_HTML_ONLY_MULTI 10884 4.56 6.59 3.56 62 XM_B_SpammyTLD 10411 3.49 6.30 2.09 63 HTML_IMAGE_RATIO_02 10256 5.42 6.21 5.03 64 TM2_M_VERY_LONG_WORD 9889 3.41 5.98 2.13 65 XMSubMetaSx_00 9705 4.38 5.87 3.63 66 XM_B_Investor 8797 2.79 5.32 1.53 67 XMNumbers 8738 4.03 5.29 3.41 68 HTML_MIME_NO_HTML_TAG 8571 4.02 5.19 3.44 69 T_REMOTE_IMAGE 8467 4.31 5.12 3.91 70 BAYES_95 8142 3.29 4.93 2.47 71 TooManyTo_001 7877 7.57 4.77 8.96 72 XM_SPF_SoftFail 7566 4.73 4.58 4.81 73 PDS_OTHER_BAD_TLD 7394 1.60 4.47 0.16 74 TR_XM_SpammyWords5 7281 2.46 4.41 1.49 75 TR_XM_DK_SendGrid 7205 3.62 4.36 3.26 76 XM_GoogleGroups 7124 2.93 4.31 2.25 77 XMStrtUSub 7090 4.34 4.29 4.36 78 XMBody_17 7087 1.70 4.29 0.41 79 T_XMDrugObfuBody_08 7071 2.40 4.28 1.46 80 XM_B_Phish66 7028 2.68 4.25 1.90 81 HTML_IMAGE_RATIO_04 6820 4.65 4.13 4.91 82 XMLngstWrd_00 6786 2.42 4.11 1.58 83 XM_DIRTYINTL 6729 1.58 4.07 0.33 84 XMLngstWrd_01 6720 2.35 4.07 1.50 85 XMLngstWrd_02 6433 2.20 3.89 1.36 86 XM_CamelCaseFrm001 6318 2.47 3.82 1.79 87 XMLngstWrd_03 6296 2.07 3.81 1.21 88 HTML_IMAGE_RATIO_06 6245 4.30 3.78 4.56 89 XMLngstWrd_04 6239 2.02 3.77 1.15 90 RCVD_IN_VALIDITY_RPBL 6170 1.25 3.73 0.02 91 RCVD_IN_VALIDITY_SAFE 6129 4.64 3.71 5.10 92 UPPERCASE_75_100 6126 1.92 3.71 1.03 93 HTML_TITLE_SUBJ_DIFF 6123 1.93 3.70 1.05 94 XM_OfRef6 5900 1.87 3.57 1.03 95 T_XMDrugObfuBody_14 5802 2.12 3.51 1.43 96 T_FILL_THIS_FORM_SHORT 5731 1.74 3.47 0.88 97 MIME_HTML_MOSTLY 5664 2.68 3.43 2.30 98 RCVD_IN_MSPIKE_BL 5553 1.41 3.36 0.44 99 ALL_TRUSTED 5373 12.01 3.25 16.38 100 TR_XM_MSPIKECOMBO 5209 1.34 3.15 0.44 101 DKIM_INVALID 5141 2.68 3.11 2.46 102 XM_UB50 5131 1.57 3.10 0.80 103 RCVD_IN_VALIDITY_CERTIFIED 5089 4.07 3.08 4.57 104 XM_DK_Undo_01 5060 2.01 3.06 1.48 105 TM2_M_URI_OPT_OUT 5012 2.50 3.03 2.23 106 MIME_QP_LONG_LINE 4990 4.53 3.02 5.28 107 SpammyFromTLD_02 4756 1.13 2.88 0.26 108 XMDiploma_00 4640 1.83 2.81 1.35 109 HTML_IMAGE_RATIO_08 4479 2.60 2.71 2.55 110 URIBL_DBL_SPAM 4398 0.89 2.66 0.01 111 BOTNET_NORDNS 4372 0.89 2.65 0.01 112 SpammyFromTLD_01 4233 1.43 2.56 0.87 113 T_TooManySym_01 4216 4.90 2.55 6.07 114 RCVD_IN_MSPIKE_H4 4062 4.21 2.46 5.09 115 XM_B_Unsub2 4050 1.61 2.45 1.19 116 HTML_IMAGE_ONLY_24 4024 1.04 2.43 0.34 117 USER_IN_DEF_DKIM_WL 3909 8.55 2.37 11.63 118 BASE64_LENGTH_79_INF 3738 1.03 2.26 0.41 119 URI_NOVOWEL 3683 2.24 2.23 2.25 120 XMSexyCombo_01 3674 1.34 2.22 0.91 121 XM_B_SpammyWords4 3633 1.11 2.20 0.57 122 XM_H_Undi_Recip 3494 0.91 2.11 0.31 123 HTTP_EXCESSIVE_ESCAPES 3449 0.70 2.09 0.00 124 HTTPS_HTTP_MISMATCH 3408 1.31 2.06 0.93 125 RCVD_IN_IADB_LISTED 3286 3.90 1.99 4.85 126 RCVD_IN_MSPIKE_L3 3219 0.93 1.95 0.42 127 XM_UB99 3195 0.64 1.93 0.00 128 TR_XM_SB_Phish 3091 2.01 1.87 2.08 129 URIBL_DBL_ABUSE_SPAM 3047 0.66 1.84 0.07 130 XMSubPhish11 2981 1.97 1.80 2.05 131 URI_HEX 2975 1.39 1.80 1.19 132 TR_XM_NoHeaderRelay 2935 0.67 1.78 0.12 133 FROM_EXCESS_BASE64 2923 2.01 1.77 2.14 134 HK_RANDOM_REPLYTO 2869 0.63 1.74 0.08 135 XM_B_COVIDMETA 2856 0.91 1.73 0.50 136 SUBJ_ALL_CAPS 2852 1.74 1.73 1.75 137 URI_PHP_REDIR 2851 0.57 1.72 0.00 138 RCVD_IN_IADB_SPF 2823 3.45 1.71 4.32 139 BAYES_40 2774 3.78 1.68 4.82 140 MPART_ALT_DIFF_COUNT 2724 0.95 1.65 0.61 141 TR_XM_FormFill 2724 0.55 1.65 0.01 142 TR_XM_MSPIKECOMBO2 2684 0.57 1.62 0.04 143 RCVD_IN_IADB_DK 2664 3.05 1.61 3.76 144 DOS_RCVD_IP_TWICE_B 2655 0.86 1.61 0.48 145 XMStockSpam_06 2652 1.38 1.60 1.26 146 T_XMDrugObfuBody_00 2636 0.91 1.59 0.58 147 RCVD_IN_IADB_SENDERID 2619 3.11 1.58 3.87 148 FONT_INVIS_LONG_LINE 2609 0.59 1.58 0.09 149 SHORT_URI_3 2597 0.57 1.57 0.07 150 XM_UB999 2592 0.52 1.57 0.00 151 XMHTML_After_End 2582 1.10 1.56 0.87 152 MAILING_LIST_MULTI 2571 2.50 1.56 2.97 153 TR_XM_SpammyWords3 2554 0.69 1.55 0.26 154 T_XMHurry_00 2480 0.75 1.50 0.38 155 TR_XM_PHPDW 2442 0.73 1.48 0.35 156 MIME_BASE64_TEXT 2440 0.61 1.48 0.18 157 KHOP_HELO_FCRDNS 2420 2.35 1.46 2.79 158 ANY_BOUNCE_MESSAGE 2406 2.01 1.46 2.29 159 BOUNCE_MESSAGE 2406 2.01 1.46 2.29 160 XMSubMetaI_00 2359 0.88 1.43 0.61 161 TR_XM_PHPForged 2335 0.67 1.41 0.31 162 TR_XM_BayesRelay 2326 0.47 1.41 0.00 163 XMBdyGiftCard01 2281 0.96 1.38 0.75 164 RELAYCOUNTRY_AU 2281 0.65 1.38 0.28 165 TR_XM_InvalidRelay 2277 0.47 1.38 0.02 166 TR_LOTS_OF_MONEY3 2270 0.64 1.37 0.27 167 TR_XM_FormFill2 2268 0.66 1.37 0.30 168 XM_H_PHPOS 2258 0.65 1.37 0.30 169 MISSING_HEADERS 2228 0.78 1.35 0.49 170 XMGenDplmaNmb 2209 0.94 1.34 0.75 171 RELAYCOUNTRY_RU 2188 0.46 1.32 0.02 172 TR_Mismatch_TLD_01 2169 0.61 1.31 0.26 173 TR_XM_Base64_M1 2119 1.00 1.28 0.87 174 TR_XM_COVIDMETA1 2112 0.53 1.28 0.15 175 XMBrknScrpt_02 2096 0.99 1.27 0.85 176 XM_H_Long_From02 2093 1.14 1.27 1.07 177 XMReplyNow 2000 0.54 1.21 0.21 178 XM_URI_RBL 1977 0.47 1.20 0.11 179 BAYES_20 1956 2.88 1.18 3.72 180 TR_Symld_Words 1951 1.63 1.18 1.86 181 HELO_NODOT 1939 1.64 1.17 1.88 182 HELO_NO_DOMAIN 1918 1.64 1.16 1.88 183 RELAYCOUNTRY_CN 1915 0.43 1.16 0.07 184 RELAYCOUNTRY_FR 1890 0.56 1.14 0.27 185 XM_PDF 1835 3.97 1.11 5.39 186 RCVD_IN_PSBL 1814 0.60 1.10 0.35 187 REPLYTO_WITHOUT_TO_CC 1796 0.40 1.09 0.05 188 RELAYCOUNTRY_IN 1742 0.40 1.05 0.08 189 REMOVE_BEFORE_LINK 1701 0.48 1.03 0.21 190 RCVD_IN_IADB_VOUCHED 1643 2.33 0.99 2.99 191 TVD_RCVD_SPACE_BRACKET 1635 0.33 0.99 0.01 192 TR_XM_MaxSPIKE 1605 0.35 0.97 0.04 193 XM_Combo_Sbj 1579 0.46 0.96 0.21 194 XM_B_SEO 1576 0.39 0.95 0.11 195 HTML_TAG_BALANCE_BODY 1566 1.12 0.95 1.21 196 XM_Body_Dirty_Words_01 1528 0.38 0.92 0.10 197 RCVD_IN_MSPIKE_L5 1525 0.31 0.92 0.01 198 XM_UB60 1519 0.36 0.92 0.08 199 XMSexyCombo_04 1504 0.70 0.91 0.59 200 XMMoneyMeta_00 1491 0.71 0.90 0.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 287716 89.84 96.13 86.71 2 RELAYCOUNTRY_US 268379 80.43 79.53 80.88 3 DKIM_SIGNED 240834 77.39 87.04 72.58 4 XM_DK_Pass 236374 75.87 85.17 71.24 5 DKIM_VALID 232660 74.71 83.93 70.12 6 DCC_CHECK_NEGATIVE 230485 57.35 33.03 69.46 7 XM_B_Unicode 222246 72.37 83.19 66.98 8 BAYES_50 187135 51.28 41.01 56.40 9 DKIM_VALID_AU 184817 58.20 63.22 55.70 10 XMListUnsubscribeExists 155574 53.90 67.97 46.89 11 XM_B_SpammyWords 145871 52.02 68.19 43.96 12 XM_B_Unicode3 127532 39.16 40.62 38.44 13 RCVD_IN_MSPIKE_H2 125575 41.20 47.95 37.85 14 T_TM2_M_HEADER_IN_MSG 110397 28.93 20.22 33.27 15 DCC_CHECK 101131 42.60 66.94 30.48 16 DKIM_VALID_EF 95444 29.90 32.19 28.76 17 HTML_FONT_LOW_CONTRAST 84116 27.11 30.63 25.35 18 FVGT_m_MULTI_ODD 83550 28.48 35.11 25.18 19 XMSubLong 74186 22.16 21.77 22.36 20 LOC_TINY_FONT_1 70873 25.57 34.03 21.36 21 MIME_HTML_ONLY 64785 24.18 33.51 19.52 22 T_KAM_HTML_FONT_INVALID 61919 21.83 28.19 18.66 23 RCVD_IN_MSPIKE_WL 61263 17.78 16.41 18.46 24 XM_B_SpammyWords2 58569 24.42 38.00 17.65 25 ALL_TRUSTED 54349 12.01 3.25 16.38 26 RCVD_IN_MSPIKE_H3 41304 12.90 13.79 12.45 27 BAYES_00 39183 8.10 0.65 11.81 28 USER_IN_DEF_DKIM_WL 38581 8.55 2.37 11.63 29 XM_Multi_Part_URI 37263 13.07 16.75 11.23 30 XM_Body_Dirty_Words 35840 15.17 23.94 10.80 31 BAYES_60 30558 8.87 8.19 9.21 32 TooManyTo_001 29728 7.57 4.77 8.96 33 IN_ZIMBRA_NJ_WHITELIST 29528 5.97 0.09 8.90 34 XM_DKIMWhitelistDomains 29198 5.90 0.07 8.80 35 LotsOfNums_01 28676 7.99 6.68 8.64 36 LOTS_OF_MONEY 28208 9.84 12.53 8.50 37 XM_Evil_Numbers_Gen 26242 8.13 8.58 7.91 38 XM_B_Unsub 25838 10.18 14.99 7.79 39 UNPARSEABLE_RELAY 24403 9.29 13.18 7.35 40 XM_DK_Undo_02 21130 18.08 41.61 6.37 41 TR_XM_DK_Bayes 20711 4.31 0.44 6.24 42 TR_XM_DK_Bayes1 20370 4.24 0.43 6.14 43 T_TooManySym_01 20130 4.90 2.55 6.07 44 TR_XM_BayesUnsub 19959 8.87 14.60 6.02 45 TR_XM_SpammyWords4 18733 7.34 10.73 5.65 46 TR_XM_UnparsRelay 18711 8.06 12.92 5.64 47 XM_PDF 17887 3.97 1.11 5.39 48 TR_XM_DK_Bayes2 17801 3.71 0.38 5.36 49 MIME_QP_LONG_LINE 17532 4.53 3.02 5.28 50 MPART_ALT_DIFF 17429 6.49 8.97 5.25 51 BAYES_99 17123 14.47 33.15 5.16 52 RCVD_IN_VALIDITY_SAFE 16924 4.64 3.71 5.10 53 RCVD_IN_MSPIKE_H4 16876 4.21 2.46 5.09 54 HTML_IMAGE_RATIO_02 16674 5.42 6.21 5.03 55 HTML_IMAGE_RATIO_04 16284 4.65 4.13 4.91 56 BOTNET_IPINHOSTNAME 16163 7.72 13.43 4.87 57 XM_SendGrid 16148 5.46 6.66 4.87 58 RCVD_IN_IADB_LISTED 16089 3.90 1.99 4.85 59 BAYES_40 15992 3.78 1.68 4.82 60 XM_SPF_SoftFail 15964 4.73 4.58 4.81 61 XM_H_Long_From01 15913 5.56 7.10 4.80 62 RCVD_IN_VALIDITY_CERTIFIED 15167 4.07 3.08 4.57 63 HTML_IMAGE_RATIO_06 15126 4.30 3.78 4.56 64 XMStrtUSub 14460 4.34 4.29 4.36 65 RCVD_IN_IADB_SPF 14319 3.45 1.71 4.32 66 TR_XM_DKIM_Undo 14277 14.29 34.35 4.30 67 BAYES_999 14021 11.52 26.16 4.23 68 BAYES_80 13632 5.60 8.58 4.11 69 RELAYCOUNTRY_META 13209 10.11 22.41 3.98 70 XM_UncommonTLD01 13025 5.41 8.39 3.93 71 T_REMOTE_IMAGE 12969 4.31 5.12 3.91 72 RCVD_IN_IADB_SENDERID 12837 3.11 1.58 3.87 73 RCVD_IN_IADB_DK 12484 3.05 1.61 3.76 74 BAYES_20 12348 2.88 1.18 3.72 75 XM_B_SpammyWords3 12192 6.23 11.37 3.67 76 XMSubMetaSx_00 12048 4.38 5.87 3.63 77 MIME_HTML_ONLY_MULTI 11800 4.56 6.59 3.56 78 T_TooManySym_02 11700 2.56 0.63 3.53 79 HTML_MIME_NO_HTML_TAG 11402 4.02 5.19 3.44 80 XMNumbers 11304 4.03 5.29 3.41 81 TR_XM_DK_SendGrid 10813 3.62 4.36 3.26 82 TR_XM_PhishingBody 10720 4.49 7.03 3.23 83 RCVD_IN_IADB_VOUCHED 9916 2.33 0.99 2.99 84 XM_B_Phish_Phrases 9875 4.28 6.91 2.98 85 MAILING_LIST_MULTI 9846 2.50 1.56 2.97 86 XMSexyCombo_05 9506 5.18 9.83 2.86 87 HTML_FONT_FACE_BAD 9461 2.09 0.57 2.85 88 KHOP_HELO_FCRDNS 9250 2.35 1.46 2.79 89 FSL_BULK_SIG 8884 5.36 10.74 2.68 90 HTML_IMAGE_RATIO_08 8462 2.60 2.71 2.55 91 TooManyTo_002 8313 1.90 0.67 2.51 92 BAYES_95 8195 3.29 4.93 2.47 93 DKIM_INVALID 8174 2.68 3.11 2.46 94 MIME_HTML_MOSTLY 7643 2.68 3.43 2.30 95 BAYES_05 7643 1.74 0.62 2.30 96 BOUNCE_MESSAGE 7590 2.01 1.46 2.29 97 ANY_BOUNCE_MESSAGE 7590 2.01 1.46 2.29 98 URI_NOVOWEL 7461 2.24 2.23 2.25 99 XM_GoogleGroups 7454 2.93 4.31 2.25 100 TM2_M_URI_OPT_OUT 7411 2.50 3.03 2.23 101 XM_H_Trusted_IP 7385 1.49 0.00 2.23 102 TVD_RCVD_IP 7347 1.59 0.35 2.21 103 FROM_EXCESS_BASE64 7085 2.01 1.77 2.14 104 TM2_M_VERY_LONG_WORD 7068 3.41 5.98 2.13 105 INVALID_MSGID 6984 1.45 0.14 2.10 106 XM_B_SpammyTLD 6940 3.49 6.30 2.09 107 TR_XM_SB_Phish 6892 2.01 1.87 2.08 108 XMSubPhish11 6807 1.97 1.80 2.05 109 RCVD_IN_IADB_OPTIN 6740 1.55 0.57 2.03 110 MSGID_NOFQDN1 6353 1.29 0.03 1.91 111 XM_B_Phish66 6303 2.68 4.25 1.90 112 HELO_NODOT 6225 1.64 1.17 1.88 113 HELO_NO_DOMAIN 6225 1.64 1.16 1.88 114 TR_Symld_Words 6158 1.63 1.18 1.86 115 IN_HORDE_ADDRESS_BOOK 6004 1.24 0.10 1.81 116 TO_MALFORMED 5974 1.24 0.11 1.80 117 XM_CamelCaseFrm001 5938 2.47 3.82 1.79 118 SUBJ_ALL_CAPS 5806 1.74 1.73 1.75 119 TR_XM_SpammyRelay 5617 5.49 13.12 1.69 120 TooManyTo_003 5311 1.25 0.54 1.60 121 XMLngstWrd_00 5239 2.42 4.11 1.58 122 XM_B_Investor 5074 2.79 5.32 1.53 123 TR_DCC_Bayes_99 5027 8.66 23.02 1.52 124 XMLngstWrd_01 4971 2.35 4.07 1.50 125 TR_XM_SpammyWords5 4955 2.46 4.41 1.49 126 XM_DK_Undo_01 4919 2.01 3.06 1.48 127 BOTNET 4889 4.53 10.67 1.47 128 T_XMDrugObfuBody_08 4838 2.40 4.28 1.46 129 XMBody_95 4759 0.99 0.10 1.43 130 T_XMDrugObfuBody_14 4746 2.12 3.51 1.43 131 XMLngstWrd_02 4516 2.20 3.89 1.36 132 XMDiploma_00 4472 1.83 2.81 1.35 133 XMCapTrack 4356 1.03 0.45 1.31 134 UNTRUSTED_Relay 4291 3.37 7.53 1.29 135 XMStockSpam_06 4193 1.38 1.60 1.26 136 XMBSHREFv2 4115 0.92 0.29 1.24 137 XMGappySubj_01 4022 0.86 0.14 1.21 138 XMLngstWrd_03 4009 2.07 3.81 1.21 139 HTML_TAG_BALANCE_BODY 3999 1.12 0.95 1.21 140 XM_B_Unsub2 3963 1.61 2.45 1.19 141 URI_HEX 3959 1.39 1.80 1.19 142 TooManyTo_004 3845 0.93 0.46 1.16 143 XMLngstWrd_04 3807 2.02 3.77 1.15 144 RELAYCOUNTRY_CA 3750 3.83 9.26 1.13 145 XM_ProductURIs 3567 1.01 0.89 1.08 146 XM_H_Long_From02 3559 1.14 1.27 1.07 147 HTML_TITLE_SUBJ_DIFF 3491 1.93 3.70 1.05 148 RCVD_IN_RP_SAFE 3440 0.93 0.70 1.04 149 UPPERCASE_75_100 3432 1.92 3.71 1.03 150 XM_OfRef6 3403 1.87 3.57 1.03 151 XMNoVowels 3245 0.79 0.42 0.98 152 DKIM_ADSP_CUSTOM_MED 3137 0.92 0.86 0.95 153 TooManyTo_005 3133 0.76 0.38 0.94 154 HTTPS_HTTP_MISMATCH 3101 1.31 2.06 0.93 155 RCVD_IN_MSPIKE_H5 3083 0.67 0.16 0.93 156 RCVD_IN_RP_CERTIFIED 3053 0.82 0.61 0.92 157 XMSexyCombo_01 3011 1.34 2.22 0.91 158 TR_XM_SpammyWords2 2970 4.40 11.43 0.90 159 TVD_SPACE_RATIO 2951 0.64 0.15 0.89 160 T_FILL_THIS_FORM_SHORT 2908 1.74 3.47 0.88 161 SpammyFromTLD_01 2899 1.43 2.56 0.87 162 XMHTML_After_End 2894 1.10 1.56 0.87 163 TR_XM_Base64_M1 2875 1.00 1.28 0.87 164 XMSubMetaSxObfu_03 2842 0.86 0.88 0.86 165 T_TooManySym_03 2834 0.67 0.29 0.85 166 XMBrknScrpt_02 2823 0.99 1.27 0.85 167 T_OBFU_PDF_ATTACH 2728 0.60 0.15 0.82 168 XM_H_PHPMailer 2717 0.80 0.77 0.82 169 XM_UB50 2663 1.57 3.10 0.80 170 XMSubNoVowel 2635 0.78 0.76 0.79 171 TR_MetaPhish_Combo_01 2585 0.80 0.84 0.78 172 XMBdyGiftCard01 2499 0.96 1.38 0.75 173 XMGenDplmaNmb 2472 0.94 1.34 0.75 174 URI_TRY_3LD 2340 0.72 0.76 0.71 175 XM_ShortIntro_01 2259 0.66 0.61 0.68 176 HTML_IMAGE_ONLY_20 2147 0.57 0.42 0.65 177 XMPhish30 2135 0.73 0.90 0.64 178 RCVD_IN_BL_SPAMCOP_NET 2117 3.77 10.05 0.64 179 XM_B_COPY_HTML 2090 0.64 0.65 0.63 180 XMMoneyMeta_00 2057 0.71 0.90 0.62 181 XMSubMetaI_00 2036 0.88 1.43 0.61 182 MPART_ALT_DIFF_COUNT 2014 0.95 1.65 0.61 183 NML_ADSP_CUSTOM_MED 1997 0.61 0.63 0.60 184 XMSexyCombo_04 1973 0.70 0.91 0.59 185 T_XMDrugObfuBody_00 1909 0.91 1.59 0.58 186 T_Symld_Words_02 1900 0.65 0.81 0.57 187 XM_B_SpammyWords4 1892 1.11 2.20 0.57 188 SHORT_HELO_AND_INLINE_IMAGE 1845 0.44 0.21 0.56 189 RELAYCOUNTRY_GB 1799 0.64 0.84 0.54 190 T_MANY_PILL_PRICE 1749 0.36 0.01 0.53 191 HTML_IMAGE_ONLY_32 1675 0.40 0.19 0.50 192 XM_B_COVIDMETA 1674 0.91 1.73 0.50 193 XM_shorewaves_Whitelist 1660 0.33 0.00 0.50 194 XMSubMetaSxObfu_02 1632 0.43 0.32 0.49 195 MISSING_HEADERS 1631 0.78 1.35 0.49 196 FORGED_GMAIL_RCVD 1619 0.55 0.67 0.49 197 DOS_RCVD_IP_TWICE_B 1600 0.86 1.61 0.48 198 MSGID_FROM_MTA_HEADER 1594 0.37 0.14 0.48 199 FROM_GOV_DKIM_AU 1574 0.35 0.10 0.47 200 TM2_M_BODY_EMPTY 1528 0.36 0.16 0.46 ----------------------------------------------------------------------