Email: 526148 Autolearn: 0 AvgScore: 4.71 AvgScanTime: 1.42 sec Spam: 187403 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.53 sec Ham: 338745 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.37 sec Time Spent Running SA: 208.19 hours Time Spent Processing Spam: 79.47 hours Time Spent Processing Ham: 128.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180493 90.91 96.31 87.92 2 DKIM_SIGNED 167937 80.93 89.61 76.13 3 XM_DK_Pass 164134 79.24 87.58 74.62 4 DKIM_VALID 162631 78.35 86.78 73.69 5 XM_B_Unicode 153971 75.52 82.16 71.84 6 RELAYCOUNTRY_US 150444 81.01 80.28 81.41 7 DCC_CHECK 142222 50.33 75.89 36.19 8 XMListUnsubscribeExists 129691 58.09 69.20 51.93 9 XM_B_SpammyWords 127162 53.42 67.85 45.44 10 DKIM_VALID_AU 122761 60.34 65.51 57.49 11 RCVD_IN_MSPIKE_H2 85344 41.52 45.54 39.29 12 XM_B_Unicode3 83176 43.06 44.38 42.32 13 BAYES_50 80780 52.41 43.10 57.57 14 XM_DK_Undo_02 77592 18.94 41.40 6.51 15 XM_B_SpammyWords2 73514 26.68 39.23 19.73 16 FVGT_m_MULTI_ODD 66416 28.58 35.44 24.78 17 LOC_TINY_FONT_1 65518 27.55 34.96 23.44 18 MIME_HTML_ONLY 64853 25.02 34.61 19.72 19 DKIM_VALID_EF 64336 30.24 34.33 27.97 20 TR_XM_DKIM_Undo 63995 15.20 34.15 4.72 21 HTML_FONT_LOW_CONTRAST 62943 30.16 33.59 28.26 22 BAYES_99 61430 15.23 32.78 5.52 23 T_KAM_HTML_FONT_INVALID 55276 23.50 29.50 20.19 24 BAYES_999 48642 12.10 25.96 4.44 25 DCC_CHECK_NEGATIVE 45141 49.63 24.09 63.76 26 XMSubLong 45098 22.76 24.06 22.03 27 TR_DCC_Bayes_99 44350 9.53 23.67 1.71 28 RELAYCOUNTRY_META 42745 10.44 22.81 3.60 29 XM_Body_Dirty_Words 41757 15.44 22.28 11.65 30 T_TM2_M_HEADER_IN_MSG 38986 26.46 20.80 29.59 31 RCVD_IN_MSPIKE_WL 32723 18.11 17.46 18.47 32 XM_Multi_Part_URI 32542 14.23 17.36 12.49 33 XM_B_Unsub 30394 11.31 16.22 8.60 34 TR_XM_BayesUnsub 29593 9.85 15.79 6.56 35 RCVD_IN_MSPIKE_H3 28006 12.94 14.94 11.84 36 LOTS_OF_MONEY 26993 10.37 14.40 8.13 37 TR_XM_SpammyRelay 25649 6.06 13.69 1.84 38 FSL_BULK_SIG 25217 6.97 13.46 3.39 39 UNPARSEABLE_RELAY 23992 9.89 12.80 8.28 40 TR_XM_UnparsRelay 23532 8.71 12.56 6.58 41 BOTNET_IPINHOSTNAME 23411 7.84 12.49 5.27 42 TR_XM_SpammyWords4 23052 7.61 12.30 5.02 43 TR_XM_SpammyWords2 22998 5.02 12.27 1.00 44 XM_B_SpammyWords3 22932 7.10 12.24 4.25 45 BOTNET 21026 5.08 11.22 1.69 46 RCVD_IN_BL_SPAMCOP_NET 19136 4.00 10.21 0.57 47 MPART_ALT_DIFF 18987 6.78 10.13 4.93 48 XMSexyCombo_05 18882 5.36 10.08 2.75 49 RELAYCOUNTRY_CA 18163 4.18 9.69 1.14 50 XM_UncommonTLD01 16532 5.65 8.82 3.89 51 XM_Evil_Numbers_Gen 16509 8.06 8.81 7.65 52 UNTRUSTED_Relay 15208 3.70 8.12 1.26 53 BAYES_80 14511 5.67 7.74 4.52 54 BAYES_60 13645 8.80 7.28 9.64 55 TR_XM_SPAMCOP 13235 2.64 7.06 0.19 56 XM_H_Long_From01 13121 6.16 7.00 5.69 57 MIME_HTML_ONLY_MULTI 12762 4.29 6.81 2.90 58 XM_SendGrid 12700 5.94 6.78 5.47 59 LotsOfNums_01 12659 8.54 6.75 9.53 60 TM2_M_VERY_LONG_WORD 12386 3.02 6.61 1.03 61 TR_XM_PhishingBody 12079 4.41 6.45 3.29 62 XM_B_Phish_Phrases 11184 4.30 5.97 3.38 63 HTML_MIME_NO_HTML_TAG 10840 3.48 5.78 2.21 64 HTML_IMAGE_RATIO_02 10625 5.91 5.67 6.05 65 T_XMDrugObfuBody_08 10624 3.29 5.67 1.97 66 XMSubMetaSx_00 10326 4.33 5.51 3.67 67 XMBody_17 9720 2.40 5.19 0.85 68 XM_GoogleGroups 9139 2.68 4.88 1.46 69 T_REMOTE_IMAGE 9040 4.13 4.82 3.74 70 XMLngstWrd_00 8953 1.98 4.78 0.43 71 XMLngstWrd_01 8892 1.92 4.74 0.35 72 BAYES_95 8880 3.45 4.74 2.74 73 HTML_IMAGE_RATIO_04 8772 4.45 4.68 4.33 74 XMLngstWrd_02 8739 1.84 4.66 0.27 75 UPPERCASE_75_100 8670 1.66 4.63 0.03 76 XMStrtUSub 8573 5.02 4.57 5.27 77 XM_CamelCaseFrm001 8544 2.98 4.56 2.11 78 XM_B_SpammyTLD 8449 3.10 4.51 2.33 79 RCVD_IN_MSPIKE_BL 8400 1.95 4.48 0.55 80 XM_SPF_SoftFail 8399 2.90 4.48 2.02 81 MIME_HTML_MOSTLY 8393 3.24 4.48 2.56 82 XMLngstWrd_03 8328 1.71 4.44 0.20 83 XMLngstWrd_04 8275 1.65 4.42 0.13 84 XM_B_Investor 8268 2.70 4.41 1.75 85 XM_DIRTYINTL 8171 1.78 4.36 0.35 86 HTML_TITLE_SUBJ_DIFF 8168 1.58 4.36 0.04 87 TR_XM_DK_SendGrid 8018 3.80 4.28 3.54 88 TR_XM_MSPIKECOMBO 7954 1.86 4.24 0.54 89 T_XMDrugObfuBody_14 7795 2.81 4.16 2.06 90 TooManyTo_001 7706 6.86 4.11 8.37 91 TR_XM_SpammyWords5 7537 2.33 4.02 1.39 92 T_FILL_THIS_FORM_SHORT 7499 1.97 4.00 0.85 93 MIME_QP_LONG_LINE 7119 5.17 3.80 5.94 94 HTML_IMAGE_RATIO_06 7044 3.63 3.76 3.55 95 XM_OfRef6 6865 2.08 3.66 1.21 96 XMDiploma_00 6799 2.27 3.63 1.52 97 HTML_IMAGE_RATIO_08 6758 2.92 3.61 2.54 98 XM_UB50 6742 1.78 3.60 0.77 99 XM_B_Phish66 6712 2.44 3.58 1.81 100 XMNumbers 6702 3.39 3.58 3.28 101 RCVD_IN_VALIDITY_RPBL 6445 1.24 3.44 0.02 102 TR_XM_SpammyWords3 5850 1.27 3.12 0.24 103 RCVD_IN_VALIDITY_SAFE 5807 4.20 3.10 4.81 104 TM2_M_URI_OPT_OUT 5677 2.66 3.03 2.46 105 T_TooManySym_01 5649 4.88 3.01 5.92 106 BOTNET_NORDNS 5377 1.03 2.87 0.01 107 DKIM_INVALID 5306 2.58 2.83 2.44 108 SpammyFromTLD_01 5173 1.49 2.76 0.79 109 SpammyFromTLD_02 5170 1.29 2.76 0.48 110 TR_XM_FormFill 4839 0.94 2.58 0.04 111 XM_B_Unsub2 4809 1.75 2.57 1.31 112 RCVD_IN_VALIDITY_CERTIFIED 4717 3.58 2.52 4.17 113 URI_NOVOWEL 4711 2.84 2.51 3.02 114 HTML_IMAGE_ONLY_24 4698 1.12 2.51 0.35 115 PDS_OTHER_BAD_TLD 4593 0.98 2.45 0.17 116 XM_DK_Undo_01 4444 1.83 2.37 1.53 117 URIBL_DBL_SPAM 4433 0.85 2.37 0.01 118 XM_B_SpammyWords4 4367 1.26 2.33 0.67 119 HTTP_EXCESSIVE_ESCAPES 4344 0.83 2.32 0.01 120 RCVD_IN_MSPIKE_H4 4243 4.33 2.26 5.47 121 SUBJ_ALL_CAPS 4155 1.97 2.22 1.84 122 HK_RANDOM_REPLYTO 4050 0.83 2.16 0.09 123 RCVD_IN_MSPIKE_L3 4013 1.10 2.14 0.52 124 DOS_RCVD_IP_TWICE_B 3876 1.07 2.07 0.51 125 FONT_INVIS_LONG_LINE 3800 0.86 2.03 0.21 126 USER_IN_DEF_DKIM_WL 3762 9.01 2.01 12.88 127 RCVD_IN_IADB_LISTED 3721 4.40 1.99 5.74 128 XM_H_Undi_Recip 3639 0.82 1.94 0.20 129 RCVD_IN_MSPIKE_L5 3556 0.68 1.90 0.01 130 XMSexyCombo_01 3536 0.99 1.89 0.50 131 XM_B_COVIDMETA 3500 0.95 1.87 0.44 132 XM_UB99 3456 0.66 1.84 0.00 133 RCVD_IN_PSBL 3410 0.82 1.82 0.26 134 BAYES_40 3363 3.66 1.79 4.70 135 TR_XM_SB_Phish 3340 2.00 1.78 2.13 136 FROM_EXCESS_BASE64 3320 2.15 1.77 2.36 137 RCVD_IN_IADB_SPF 3270 3.90 1.74 5.08 138 XMSubPhish11 3244 1.97 1.73 2.10 139 MAILING_LIST_MULTI 3209 2.57 1.71 3.04 140 TR_XM_InvalidRelay 3197 0.62 1.71 0.02 141 HTTPS_HTTP_MISMATCH 3181 1.29 1.70 1.06 142 RCVD_IN_IADB_DK 3126 3.43 1.67 4.40 143 XMStockSpam_06 3098 1.16 1.65 0.89 144 RCVD_IN_IADB_SENDERID 3095 3.51 1.65 4.55 145 T_XMHurry_00 3062 0.96 1.63 0.58 146 URI_TRY_3LD 3048 0.98 1.63 0.61 147 TR_XM_NoHeaderRelay 3018 0.65 1.61 0.11 148 TR_XM_BayesRelay 3002 0.57 1.60 0.00 149 XM_URI_RBL 2958 0.64 1.58 0.13 150 XMGenDplmaNmb 2944 1.15 1.57 0.92 151 TR_XM_MSPIKECOMBO2 2791 0.57 1.49 0.07 152 XM_UB999 2753 0.52 1.47 0.00 153 URI_HEX 2735 1.33 1.46 1.26 154 T_XMDrugObfuBody_00 2716 1.11 1.45 0.93 155 MPART_ALT_DIFF_COUNT 2589 0.89 1.38 0.62 156 ALL_TRUSTED 2574 10.57 1.37 15.66 157 TR_LOTS_OF_MONEY3 2552 0.68 1.36 0.31 158 TR_XM_COVIDMETA1 2529 0.60 1.35 0.19 159 TM2_M_A_HREF_HREF 2478 0.78 1.32 0.48 160 MIME_BASE64_TEXT 2408 0.57 1.28 0.18 161 XM_H_Long_From02 2400 1.36 1.28 1.41 162 RELAYCOUNTRY_AU 2368 0.70 1.26 0.38 163 RELAYCOUNTRY_RU 2352 0.46 1.26 0.02 164 TR_XM_PHPDW 2340 0.65 1.25 0.32 165 XMReplyNow 2331 0.61 1.24 0.25 166 BAYES_20 2327 2.76 1.24 3.60 167 XMHTML_After_End 2310 0.99 1.23 0.86 168 TR_XM_PHPForged 2296 0.62 1.23 0.28 169 TR_Symld_Words 2292 1.61 1.22 1.82 170 TR_XM_FormFill2 2235 0.60 1.19 0.28 171 RELAYCOUNTRY_CN 2232 0.48 1.19 0.08 172 XM_H_PHPOS 2225 0.60 1.19 0.27 173 XM_B_SEO 2221 0.50 1.19 0.12 174 XMPhish30 2206 0.90 1.18 0.75 175 RELAYCOUNTRY_IN 2191 0.47 1.17 0.08 176 XMBdyGiftCard01 2158 0.99 1.15 0.90 177 T_Symld_Words_02 2147 0.81 1.15 0.62 178 TR_XM_Undi_Recip5 2132 0.41 1.14 0.01 179 TR_XM_SEO4 2114 0.44 1.13 0.06 180 URI_PHP_REDIR 2026 0.39 1.08 0.00 181 TR_XM_MaxSPIKE 2006 0.42 1.07 0.07 182 KHOP_HELO_FCRDNS 1982 1.09 1.06 1.10 183 URIBL_BLACK 1960 0.40 1.05 0.04 184 XM_OfRef7 1946 0.44 1.04 0.11 185 XMBrknScrpt_02 1898 0.94 1.01 0.91 186 LONGLN_LOW_CONTRAST 1895 0.47 1.01 0.16 187 UNDISC_MONEY 1881 0.36 1.00 0.00 188 XM_B_DNDMA 1872 0.64 1.00 0.45 189 NORDNS_LOW_CONTRAST 1849 0.38 0.99 0.05 190 HTML_TAG_BALANCE_BODY 1799 0.82 0.96 0.74 191 TVD_RCVD_SPACE_BRACKET 1787 0.34 0.95 0.00 192 TR_Caps_n_Bayes_99 1781 0.47 0.95 0.20 193 RCVD_IN_IADB_VOUCHED 1760 2.62 0.94 3.56 194 XM_Body_Dirty_Words_01 1757 0.55 0.94 0.34 195 XM_UB60 1755 0.38 0.94 0.07 196 XMPhish14 1744 0.57 0.93 0.38 197 TR_XM_Base64_M1 1730 0.92 0.92 0.92 198 HELO_NODOT 1728 1.29 0.92 1.49 199 HELO_NO_DOMAIN 1720 1.29 0.92 1.49 200 TR_MetaPhish_Combo_01 1703 0.78 0.91 0.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297809 90.91 96.31 87.92 2 RELAYCOUNTRY_US 275787 81.01 80.28 81.41 3 DKIM_SIGNED 257886 80.93 89.61 76.13 4 XM_DK_Pass 252772 79.24 87.58 74.62 5 DKIM_VALID 249616 78.35 86.78 73.69 6 XM_B_Unicode 243358 75.52 82.16 71.84 7 DCC_CHECK_NEGATIVE 215969 49.63 24.09 63.76 8 BAYES_50 194999 52.41 43.10 57.57 9 DKIM_VALID_AU 194736 60.34 65.51 57.49 10 XMListUnsubscribeExists 175924 58.09 69.20 51.93 11 XM_B_SpammyWords 153917 53.42 67.85 45.44 12 XM_B_Unicode3 143373 43.06 44.38 42.32 13 RCVD_IN_MSPIKE_H2 133105 41.52 45.54 39.29 14 DCC_CHECK 122575 50.33 75.89 36.19 15 T_TM2_M_HEADER_IN_MSG 100233 26.46 20.80 29.59 16 HTML_FONT_LOW_CONTRAST 95737 30.16 33.59 28.26 17 DKIM_VALID_EF 94755 30.24 34.33 27.97 18 FVGT_m_MULTI_ODD 83956 28.58 35.44 24.78 19 LOC_TINY_FONT_1 79413 27.55 34.96 23.44 20 XMSubLong 74638 22.76 24.06 22.03 21 T_KAM_HTML_FONT_INVALID 68389 23.50 29.50 20.19 22 XM_B_SpammyWords2 66838 26.68 39.23 19.73 23 MIME_HTML_ONLY 66799 25.02 34.61 19.72 24 RCVD_IN_MSPIKE_WL 62567 18.11 17.46 18.47 25 ALL_TRUSTED 53048 10.57 1.37 15.66 26 USER_IN_DEF_DKIM_WL 43645 9.01 2.01 12.88 27 XM_Multi_Part_URI 42310 14.23 17.36 12.49 28 RCVD_IN_MSPIKE_H3 40092 12.94 14.94 11.84 29 XM_Body_Dirty_Words 39461 15.44 22.28 11.65 30 BAYES_60 32657 8.80 7.28 9.64 31 LotsOfNums_01 32298 8.54 6.75 9.53 32 BAYES_00 31958 6.33 0.71 9.43 33 XM_DKIMWhitelistDomains 31392 6.09 0.34 9.27 34 XM_B_Unsub 29136 11.31 16.22 8.60 35 TooManyTo_001 28366 6.86 4.11 8.37 36 UNPARSEABLE_RELAY 28045 9.89 12.80 8.28 37 LOTS_OF_MONEY 27551 10.37 14.40 8.13 38 XM_Evil_Numbers_Gen 25915 8.06 8.81 7.65 39 IN_ZIMBRA_NJ_WHITELIST 23387 4.49 0.12 6.90 40 TR_XM_UnparsRelay 22296 8.71 12.56 6.58 41 TR_XM_BayesUnsub 22208 9.85 15.79 6.56 42 XM_DK_Undo_02 22047 18.94 41.40 6.51 43 TR_XM_DK_Bayes 21713 4.31 0.51 6.41 44 TR_XM_DK_Bayes1 21427 4.25 0.51 6.33 45 HTML_IMAGE_RATIO_02 20493 5.91 5.67 6.05 46 MIME_QP_LONG_LINE 20107 5.17 3.80 5.94 47 T_TooManySym_01 20051 4.88 3.01 5.92 48 RCVD_IN_IADB_LISTED 19443 4.40 1.99 5.74 49 XM_H_Long_From01 19266 6.16 7.00 5.69 50 TR_XM_DK_Bayes2 19134 3.80 0.46 5.65 51 BAYES_99 18684 15.23 32.78 5.52 52 RCVD_IN_MSPIKE_H4 18535 4.33 2.26 5.47 53 XM_SendGrid 18529 5.94 6.78 5.47 54 BOTNET_IPINHOSTNAME 17850 7.84 12.49 5.27 55 XMStrtUSub 17849 5.02 4.57 5.27 56 RCVD_IN_IADB_SPF 17224 3.90 1.74 5.08 57 TR_XM_SpammyWords4 17003 7.61 12.30 5.02 58 MPART_ALT_DIFF 16702 6.78 10.13 4.93 59 XM_PDF 16312 3.38 0.78 4.82 60 RCVD_IN_VALIDITY_SAFE 16299 4.20 3.10 4.81 61 TR_XM_DKIM_Undo 16001 15.20 34.15 4.72 62 BAYES_40 15916 3.66 1.79 4.70 63 RCVD_IN_IADB_SENDERID 15398 3.51 1.65 4.55 64 BAYES_80 15308 5.67 7.74 4.52 65 BAYES_999 15047 12.10 25.96 4.44 66 RCVD_IN_IADB_DK 14900 3.43 1.67 4.40 67 HTML_IMAGE_RATIO_04 14665 4.45 4.68 4.33 68 XM_B_SpammyWords3 14407 7.10 12.24 4.25 69 RCVD_IN_VALIDITY_CERTIFIED 14136 3.58 2.52 4.17 70 XM_UncommonTLD01 13176 5.65 8.82 3.89 71 T_REMOTE_IMAGE 12676 4.13 4.82 3.74 72 XMSubMetaSx_00 12437 4.33 5.51 3.67 73 BAYES_20 12182 2.76 1.24 3.60 74 RELAYCOUNTRY_META 12180 10.44 22.81 3.60 75 RCVD_IN_IADB_VOUCHED 12047 2.62 0.94 3.56 76 HTML_IMAGE_RATIO_06 12032 3.63 3.76 3.55 77 TR_XM_DK_SendGrid 11999 3.80 4.28 3.54 78 FSL_BULK_SIG 11481 6.97 13.46 3.39 79 XM_B_Phish_Phrases 11439 4.30 5.97 3.38 80 T_TooManySym_02 11228 2.39 0.71 3.31 81 TR_XM_PhishingBody 11144 4.41 6.45 3.29 82 XMNumbers 11120 3.39 3.58 3.28 83 MAILING_LIST_MULTI 10295 2.57 1.71 3.04 84 URI_NOVOWEL 10235 2.84 2.51 3.02 85 MIME_HTML_ONLY_MULTI 9809 4.29 6.81 2.90 86 XMSexyCombo_05 9313 5.36 10.08 2.75 87 BAYES_95 9272 3.45 4.74 2.74 88 MIME_HTML_MOSTLY 8675 3.24 4.48 2.56 89 HTML_IMAGE_RATIO_08 8613 2.92 3.61 2.54 90 TM2_M_URI_OPT_OUT 8322 2.66 3.03 2.46 91 DKIM_INVALID 8270 2.58 2.83 2.44 92 XM_H_Trusted_IP 8073 1.53 0.00 2.38 93 FROM_EXCESS_BASE64 7984 2.15 1.77 2.36 94 RCVD_IN_IADB_OPTIN 7921 1.71 0.56 2.34 95 XM_B_SpammyTLD 7885 3.10 4.51 2.33 96 BAYES_05 7769 1.69 0.61 2.29 97 HTML_MIME_NO_HTML_TAG 7495 3.48 5.78 2.21 98 TooManyTo_002 7299 1.55 0.46 2.15 99 TR_XM_SB_Phish 7201 2.00 1.78 2.13 100 XM_CamelCaseFrm001 7147 2.98 4.56 2.11 101 XMSubPhish11 7125 1.97 1.73 2.10 102 T_XMDrugObfuBody_14 6974 2.81 4.16 2.06 103 ANY_BOUNCE_MESSAGE 6937 1.52 0.58 2.05 104 BOUNCE_MESSAGE 6932 1.52 0.58 2.05 105 XM_SPF_SoftFail 6846 2.90 4.48 2.02 106 INVALID_MSGID 6781 1.33 0.12 2.00 107 T_XMDrugObfuBody_08 6686 3.29 5.67 1.97 108 MSGID_NOFQDN1 6291 1.20 0.02 1.86 109 TR_XM_SpammyRelay 6243 6.06 13.69 1.84 110 SUBJ_ALL_CAPS 6227 1.97 2.22 1.84 111 TR_Symld_Words 6175 1.61 1.22 1.82 112 IN_HORDE_ADDRESS_BOOK 6152 1.22 0.13 1.82 113 XM_B_Phish66 6133 2.44 3.58 1.81 114 TO_MALFORMED 5967 1.17 0.10 1.76 115 XM_B_Investor 5939 2.70 4.41 1.75 116 TR_DCC_Bayes_99 5794 9.53 23.67 1.71 117 BOTNET 5711 5.08 11.22 1.69 118 TVD_RCVD_IP 5664 1.17 0.27 1.67 119 XM_DK_Undo_01 5187 1.83 2.37 1.53 120 XMDiploma_00 5137 2.27 3.63 1.52 121 HELO_NODOT 5062 1.29 0.92 1.49 122 HELO_NO_DOMAIN 5062 1.29 0.92 1.49 123 XM_GoogleGroups 4940 2.68 4.88 1.46 124 XM_H_Long_From02 4772 1.36 1.28 1.41 125 TooManyTo_003 4726 1.04 0.39 1.40 126 XMGappySubj_01 4715 0.94 0.12 1.39 127 TR_XM_SpammyWords5 4696 2.33 4.02 1.39 128 XM_B_Unsub2 4421 1.75 2.57 1.31 129 URI_HEX 4264 1.33 1.46 1.26 130 UNTRUSTED_Relay 4262 3.70 8.12 1.26 131 XMBody_95 4212 0.85 0.14 1.24 132 XMBSHREFv2 4163 0.90 0.31 1.23 133 XM_OfRef6 4083 2.08 3.66 1.21 134 RCVD_IN_MSPIKE_H5 3940 0.84 0.25 1.16 135 RELAYCOUNTRY_CA 3854 4.18 9.69 1.14 136 KHOP_HELO_FCRDNS 3727 1.09 1.06 1.10 137 XMCapTrack 3629 0.82 0.35 1.07 138 HTTPS_HTTP_MISMATCH 3607 1.29 1.70 1.06 139 HTML_FONT_FACE_BAD 3583 0.98 0.83 1.06 140 TM2_M_VERY_LONG_WORD 3506 3.02 6.61 1.03 141 TR_XM_SpammyWords2 3401 5.02 12.27 1.00 142 RCVD_IN_RP_SAFE 3377 0.85 0.60 1.00 143 TooManyTo_004 3373 0.76 0.33 1.00 144 XMSubNoVowel 3289 0.91 0.80 0.97 145 T_XMDrugObfuBody_00 3140 1.11 1.45 0.93 146 TR_XM_Base64_M1 3126 0.92 0.92 0.92 147 XMGenDplmaNmb 3102 1.15 1.57 0.92 148 DKIM_ADSP_CUSTOM_MED 3100 0.85 0.72 0.92 149 XMBrknScrpt_02 3069 0.94 1.01 0.91 150 XMBdyGiftCard01 3054 0.99 1.15 0.90 151 XMStockSpam_06 3023 1.16 1.65 0.89 152 RCVD_IN_RP_CERTIFIED 2923 0.73 0.49 0.86 153 XMHTML_After_End 2899 0.99 1.23 0.86 154 XMBody_17 2883 2.40 5.19 0.85 155 T_FILL_THIS_FORM_SHORT 2867 1.97 4.00 0.85 156 T_TooManySym_03 2781 0.64 0.30 0.82 157 TVD_SPACE_RATIO 2738 0.56 0.12 0.81 158 FROM_GOV_DKIM_AU 2706 0.56 0.13 0.80 159 TooManyTo_005 2678 0.60 0.27 0.79 160 SpammyFromTLD_01 2675 1.49 2.76 0.79 161 XM_UB50 2608 1.78 3.60 0.77 162 XMPhish30 2528 0.90 1.18 0.75 163 HTML_TAG_BALANCE_BODY 2523 0.82 0.96 0.74 164 XMSubMetaI_00 2435 0.79 0.91 0.72 165 TR_MetaPhish_Combo_01 2424 0.78 0.91 0.72 166 XM_B_COPY_HTML 2261 0.63 0.55 0.67 167 XM_B_SpammyWords4 2258 1.26 2.33 0.67 168 XM_ProductURIs 2134 0.64 0.67 0.63 169 T_OBFU_PDF_ATTACH 2118 0.43 0.08 0.63 170 MPART_ALT_DIFF_COUNT 2101 0.89 1.38 0.62 171 T_Symld_Words_02 2098 0.81 1.15 0.62 172 URI_TRY_3LD 2083 0.98 1.63 0.61 173 RELAYCOUNTRY_GB 2062 0.67 0.77 0.61 174 XMNoVowels 2052 0.57 0.51 0.61 175 XM_H_PHPMailer 1997 0.61 0.64 0.59 176 HTML_IMAGE_ONLY_20 1984 0.55 0.49 0.59 177 XM_ShortIntro_01 1970 0.50 0.36 0.58 178 T_XMHurry_00 1970 0.96 1.63 0.58 179 RCVD_IN_BL_SPAMCOP_NET 1919 4.00 10.21 0.57 180 XMSlimDrugH 1903 0.54 0.51 0.56 181 XM_D_tchamptons_WL 1888 0.37 0.02 0.56 182 RCVD_IN_MSPIKE_BL 1861 1.95 4.48 0.55 183 TR_XM_MSPIKECOMBO 1828 1.86 4.24 0.54 184 NML_ADSP_CUSTOM_MED 1791 0.52 0.51 0.53 185 RCVD_IN_MSPIKE_L3 1760 1.10 2.14 0.52 186 DOS_RCVD_IP_TWICE_B 1731 1.07 2.07 0.51 187 TO_NO_BRKTS_HTML_ONLY 1730 0.36 0.09 0.51 188 XMSubMetaSxObfu_02 1728 0.52 0.53 0.51 189 FORGED_GMAIL_RCVD 1718 0.54 0.59 0.51 190 XMMoneyMeta_00 1712 0.60 0.76 0.51 191 XMSexyCombo_01 1695 0.99 1.89 0.50 192 XMHTMLBadTable_001 1656 0.56 0.68 0.49 193 SpammyFromTLD_02 1619 1.29 2.76 0.48 194 TM2_M_A_HREF_HREF 1615 0.78 1.32 0.48 195 PLING_QUERY 1547 0.51 0.61 0.46 196 XM_B_DNDMA 1510 0.64 1.00 0.45 197 HTML_IMAGE_ONLY_28 1499 0.40 0.33 0.44 198 XM_B_COVIDMETA 1496 0.95 1.87 0.44 199 TR_XM_Base64_L1 1494 0.48 0.54 0.44 200 USER_IN_WELCOMELIST 1491 0.28 0.00 0.44 ----------------------------------------------------------------------