Email: 504934 Autolearn: 0 AvgScore: 4.40 AvgScanTime: 1.35 sec Spam: 171589 Autolearn: 0 AvgScore: 15.06 AvgScanTime: 1.47 sec Ham: 333345 Autolearn: 0 AvgScore: -1.08 AvgScanTime: 1.28 sec Time Spent Running SA: 188.74 hours Time Spent Processing Spam: 69.86 hours Time Spent Processing Ham: 118.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161017 87.90 93.84 84.85 2 DKIM_SIGNED 147055 77.63 85.70 73.48 3 XM_DK_Pass 143885 75.47 83.85 71.16 4 XM_B_Unicode 142285 73.20 82.92 68.19 5 DKIM_VALID 141890 74.36 82.69 70.08 6 RELAYCOUNTRY_US 131603 78.49 76.70 79.42 7 DCC_CHECK 128445 46.91 74.86 32.52 8 XMListUnsubscribeExists 116188 53.99 67.71 46.93 9 XM_B_SpammyWords 113905 51.18 66.38 43.35 10 DKIM_VALID_AU 104625 57.18 60.97 55.22 11 RCVD_IN_MSPIKE_H2 76111 41.45 44.36 39.96 12 XM_B_Unicode3 72593 39.53 42.31 38.10 13 XM_DK_Undo_02 69117 17.86 40.28 6.32 14 BAYES_50 68482 51.26 39.91 57.10 15 XM_B_SpammyWords2 65550 24.96 38.20 18.14 16 MIME_HTML_ONLY 58351 24.13 34.01 19.04 17 DKIM_VALID_EF 57792 30.40 33.68 28.72 18 TR_XM_DKIM_Undo 57619 14.43 33.58 4.57 19 BAYES_99 56798 14.84 33.10 5.44 20 LOC_TINY_FONT_1 55966 25.88 32.62 22.41 21 FVGT_m_MULTI_ODD 55471 27.53 32.33 25.06 22 T_KAM_HTML_FONT_INVALID 51860 22.52 30.22 18.55 23 HTML_FONT_LOW_CONTRAST 50747 26.94 29.57 25.58 24 RELAYCOUNTRY_META 44613 11.32 26.00 3.76 25 BAYES_999 44603 11.69 25.99 4.32 26 DCC_CHECK_NEGATIVE 43109 53.06 25.12 67.44 27 TR_DCC_Bayes_99 41238 9.31 24.03 1.72 28 XMSubLong 40498 22.68 23.60 22.20 29 XM_Body_Dirty_Words 37852 14.83 22.06 11.11 30 T_TM2_M_HEADER_IN_MSG 36438 28.38 21.24 32.06 31 RCVD_IN_MSPIKE_WL 27344 16.87 15.94 17.36 32 TR_XM_SpammyRelay 27021 6.46 15.75 1.68 33 XM_Multi_Part_URI 26370 13.00 15.37 11.79 34 XM_B_Unsub 25733 10.42 15.00 8.07 35 TR_XM_BayesUnsub 25157 9.17 14.66 6.35 36 BOTNET_IPINHOSTNAME 24743 8.09 14.42 4.84 37 FSL_BULK_SIG 23984 7.20 13.98 3.71 38 RCVD_IN_MSPIKE_H3 22673 11.78 13.21 11.04 39 BOTNET 22649 5.47 13.20 1.49 40 UNPARSEABLE_RELAY 21910 9.56 12.77 7.91 41 TR_XM_UnparsRelay 21522 8.28 12.54 6.09 42 XM_B_SpammyWords3 21428 6.54 12.49 3.48 43 LOTS_OF_MONEY 20993 9.20 12.23 7.64 44 RCVD_IN_BL_SPAMCOP_NET 19871 4.15 11.58 0.32 45 XM_UncommonTLD01 19704 6.69 11.48 4.22 46 RELAYCOUNTRY_CA 19553 4.65 11.40 1.18 47 TR_XM_SpammyWords2 19232 4.38 11.21 0.87 48 TR_XM_SpammyWords4 18187 6.80 10.60 4.84 49 XMSexyCombo_05 17845 5.46 10.40 2.92 50 XM_H_Long_From01 15844 6.33 9.23 4.83 51 UNTRUSTED_Relay 15525 3.93 9.05 1.30 52 BAYES_80 15323 6.06 8.93 4.58 53 BAYES_60 14054 9.02 8.19 9.44 54 XM_Evil_Numbers_Gen 13883 7.81 8.09 7.66 55 TR_XM_SPAMCOP 13654 2.83 7.96 0.19 56 MPART_ALT_DIFF 13514 5.64 7.88 4.49 57 TR_XM_PhishingBody 12173 4.46 7.09 3.11 58 XMSubMetaSx_00 11998 4.75 6.99 3.60 59 XM_CamelCaseFrm001 11879 3.55 6.92 1.82 60 T_REMOTE_IMAGE 11802 4.93 6.88 3.92 61 XM_SPF_SoftFail 11770 4.15 6.86 2.75 62 RCVD_IN_MSPIKE_BL 10751 2.32 6.27 0.29 63 LotsOfNums_01 10441 7.95 6.08 8.91 64 TR_XM_MSPIKECOMBO 10251 2.22 5.97 0.29 65 XM_SendGrid 9948 5.40 5.80 5.19 66 XM_B_Investor 9677 2.89 5.64 1.47 67 XM_B_SpammyTLD 9559 3.26 5.57 2.06 68 HTML_IMAGE_RATIO_02 9504 5.82 5.54 5.97 69 RCVD_IN_VALIDITY_RPBL 9413 1.89 5.49 0.04 70 XM_B_Phish_Phrases 9342 4.14 5.44 3.47 71 BAYES_95 9197 3.60 5.36 2.70 72 XMStrtUSub 8925 4.79 5.20 4.59 73 XMNumbers 8570 4.87 4.99 4.81 74 T_XMDrugObfuBody_08 8423 2.60 4.91 1.41 75 HTML_IMAGE_ONLY_24 8321 1.87 4.85 0.34 76 MIME_HTML_ONLY_MULTI 8299 3.32 4.84 2.55 77 XM_DIRTYINTL 8249 1.83 4.81 0.30 78 HTTP_EXCESSIVE_ESCAPES 8056 1.60 4.69 0.01 79 TR_XM_SpammyWords5 7834 2.46 4.57 1.37 80 TooManyTo_001 7656 7.73 4.46 9.41 81 XMBody_17 7591 1.87 4.42 0.56 82 MIME_HTML_MOSTLY 7271 3.00 4.24 2.36 83 XM_B_Phish66 7218 2.70 4.21 1.93 84 TM2_M_VERY_LONG_WORD 7210 2.15 4.20 1.09 85 BOTNET_NORDNS 7199 1.43 4.20 0.01 86 XM_OfRef6 7068 2.14 4.12 1.13 87 SpammyFromTLD_01 6985 2.06 4.07 1.02 88 TR_XM_SpammyWords3 6866 1.45 4.00 0.14 89 T_XMDrugObfuBody_14 6670 2.59 3.89 1.92 90 XM_UB50 6175 1.77 3.60 0.83 91 HTML_IMAGE_RATIO_04 6143 3.51 3.58 3.48 92 HTML_MIME_NO_HTML_TAG 6132 2.76 3.57 2.33 93 T_FILL_THIS_FORM_SHORT 6102 1.75 3.56 0.83 94 URIBL_DBL_SPAM 5868 1.17 3.42 0.01 95 SUBJ_ALL_CAPS 5775 2.41 3.37 1.91 96 TR_XM_DK_SendGrid 5700 3.46 3.32 3.52 97 RCVD_IN_PSBL 5660 1.31 3.30 0.28 98 HTML_IMAGE_RATIO_06 5537 2.96 3.23 2.82 99 RCVD_IN_MSPIKE_L5 5532 1.11 3.22 0.02 100 DKIM_INVALID 5165 3.27 3.01 3.40 101 SpammyFromTLD_02 4996 1.17 2.91 0.27 102 MIME_QP_LONG_LINE 4982 4.57 2.90 5.43 103 XM_DK_Undo_01 4958 2.08 2.89 1.66 104 URI_NOVOWEL 4801 2.45 2.80 2.27 105 PDS_OTHER_BAD_TLD 4787 1.08 2.79 0.19 106 XM_GoogleGroups 4692 1.86 2.73 1.40 107 T_TooManySym_01 4545 5.86 2.65 7.52 108 TM2_M_URI_OPT_OUT 4509 2.18 2.63 1.95 109 MIME_BASE64_TEXT 4437 1.03 2.59 0.23 110 XM_B_Unsub2 4400 1.65 2.56 1.18 111 URI_PHP_REDIR 4368 0.87 2.55 0.00 112 XM_H_Undi_Recip 4366 1.09 2.54 0.34 113 XMLngstWrd_00 4361 1.28 2.54 0.63 114 XM_UB99 4280 0.85 2.49 0.00 115 XMLngstWrd_01 4266 1.20 2.49 0.54 116 RCVD_IN_MSPIKE_H4 4262 4.14 2.48 4.99 117 RCVD_IN_VALIDITY_SAFE 4256 4.05 2.48 4.85 118 XMLngstWrd_02 4148 1.11 2.42 0.44 119 RCVD_IN_MSPIKE_L3 4134 0.99 2.41 0.27 120 HTML_IMAGE_RATIO_08 4128 2.14 2.41 2.00 121 HTML_TITLE_SUBJ_DIFF 4021 0.82 2.34 0.03 122 XMLngstWrd_03 4008 0.97 2.34 0.27 123 TR_XM_PHPDW 3973 1.24 2.32 0.68 124 XMDiploma_00 3922 1.87 2.29 1.65 125 XMLngstWrd_04 3890 0.89 2.27 0.18 126 FONT_INVIS_LONG_LINE 3849 0.79 2.24 0.04 127 TR_XM_PHPForged 3824 1.18 2.23 0.64 128 UPPERCASE_75_100 3810 0.77 2.22 0.03 129 XM_B_SpammyWords4 3797 1.03 2.21 0.43 130 HTTPS_HTTP_MISMATCH 3795 1.38 2.21 0.95 131 TR_XM_FormFill2 3784 1.17 2.21 0.64 132 XM_H_PHPOS 3775 1.16 2.20 0.63 133 ALL_TRUSTED 3755 12.45 2.19 17.73 134 TR_XM_FormFill 3673 0.74 2.14 0.01 135 HK_RANDOM_REPLYTO 3654 0.79 2.13 0.10 136 TVD_RCVD_SPACE_BRACKET 3649 0.72 2.13 0.00 137 T_XMHurry_00 3460 1.66 2.02 1.47 138 TR_XM_SB_Phish 3452 2.15 2.01 2.22 139 XM_UB999 3442 0.68 2.01 0.00 140 RCVD_IN_VALIDITY_CERTIFIED 3389 3.56 1.98 4.37 141 RCVD_IN_IADB_LISTED 3246 4.05 1.89 5.16 142 TR_XM_NoHeaderRelay 3242 0.72 1.89 0.12 143 BAYES_40 3214 3.87 1.87 4.90 144 XMSexyCombo_01 3109 0.92 1.81 0.47 145 XMSubPhish11 3099 2.05 1.81 2.18 146 FROM_EXCESS_BASE64 3059 2.20 1.78 2.42 147 TR_XM_InvalidRelay 2989 0.60 1.74 0.02 148 MAILING_LIST_MULTI 2956 2.67 1.72 3.16 149 XMStockSpam_06 2873 1.46 1.67 1.36 150 RELAYCOUNTRY_IN 2846 0.64 1.66 0.11 151 RCVD_IN_IADB_SPF 2840 3.59 1.66 4.59 152 TR_XM_MSPIKECOMBO2 2820 0.58 1.64 0.03 153 SHOPIFY_IMG_NOT_RCVD_SFY 2755 0.68 1.61 0.20 154 MPART_ALT_DIFF_COUNT 2735 0.91 1.59 0.55 155 RELAYCOUNTRY_CN 2733 0.58 1.59 0.07 156 RCVD_IN_IADB_DK 2660 3.18 1.55 4.02 157 RCVD_IN_IADB_SENDERID 2633 3.27 1.53 4.16 158 XM_H_Long_From02 2588 1.23 1.51 1.09 159 USER_IN_DEF_DKIM_WL 2561 8.50 1.49 12.11 160 URI_HEX 2522 1.28 1.47 1.18 161 XM_Combo_Sbj 2502 0.62 1.46 0.19 162 BAYES_20 2495 2.87 1.45 3.59 163 XM_B_COVIDMETA 2494 0.74 1.45 0.37 164 TR_XM_BayesRelay 2493 0.49 1.45 0.00 165 T_XMDrugObfuBody_00 2481 0.87 1.45 0.57 166 XMHTML_After_End 2454 1.01 1.43 0.79 167 TR_LOTS_OF_MONEY3 2428 0.69 1.42 0.32 168 RELAYCOUNTRY_RU 2410 0.50 1.40 0.04 169 XM_URI_RBL 2332 0.54 1.36 0.12 170 KHOP_HELO_FCRDNS 2303 1.62 1.34 1.77 171 XMReplyNow 2263 0.63 1.32 0.28 172 XM_B_SEO 2259 0.54 1.32 0.14 173 XMBdyGiftCard01 2235 0.97 1.30 0.79 174 RELAYCOUNTRY_AU 2220 0.61 1.29 0.26 175 XMSubNoVowel 2177 0.91 1.27 0.73 176 TR_XM_SEO4 2157 0.48 1.26 0.08 177 URIBL_BLACK 2154 0.46 1.26 0.05 178 LongTLD 2138 0.69 1.25 0.40 179 TM2_M_A_HREF_HREF 2106 0.64 1.23 0.34 180 XMBrknScrpt_02 2071 0.90 1.21 0.75 181 MultiRelay_CC 2020 0.40 1.18 0.01 182 TR_XM_COVIDMETA4 1949 0.50 1.14 0.17 183 XM_Body_Dirty_Words_01 1933 0.49 1.13 0.16 184 RELAYCOUNTRY_FR 1925 0.54 1.12 0.25 185 TR_XM_Undi_Recip5 1905 0.38 1.11 0.01 186 REMOVE_BEFORE_LINK 1878 0.70 1.09 0.49 187 XM_UB60 1873 0.41 1.09 0.07 188 XMPhish08 1851 0.49 1.08 0.18 189 TR_XM_Undi_Recip11 1830 0.43 1.07 0.10 190 RCVD_IN_RP_RNBL 1825 0.37 1.06 0.01 191 TR_Mismatch_TLD_02 1779 0.42 1.04 0.10 192 TR_XM_Undi_RecipCombo2 1776 0.35 1.04 0.00 193 XMGenDplmaNmb 1772 0.87 1.03 0.79 194 RCVD_IN_IADB_VOUCHED 1771 2.34 1.03 3.01 195 XM_Nigeria_01 1767 0.38 1.03 0.04 196 UNDISC_MONEY 1743 0.35 1.02 0.01 197 TM2_M_BODY_EMPTY 1735 0.66 1.01 0.49 198 RELAYCOUNTRY_GB 1723 0.73 1.00 0.59 199 NORDNS_LOW_CONTRAST 1714 0.36 1.00 0.03 200 TR_Symld_Words 1705 1.51 0.99 1.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 282829 87.90 93.84 84.85 2 RELAYCOUNTRY_US 264743 78.49 76.70 79.42 3 DKIM_SIGNED 244939 77.63 85.70 73.48 4 XM_DK_Pass 237212 75.47 83.85 71.16 5 DKIM_VALID 233593 74.36 82.69 70.08 6 XM_B_Unicode 227315 73.20 82.92 68.19 7 DCC_CHECK_NEGATIVE 224804 53.06 25.12 67.44 8 BAYES_50 190338 51.26 39.91 57.10 9 DKIM_VALID_AU 184084 57.18 60.97 55.22 10 XMListUnsubscribeExists 156433 53.99 67.71 46.93 11 XM_B_SpammyWords 144518 51.18 66.38 43.35 12 RCVD_IN_MSPIKE_H2 133203 41.45 44.36 39.96 13 XM_B_Unicode3 127013 39.53 42.31 38.10 14 DCC_CHECK 108396 46.91 74.86 32.52 15 T_TM2_M_HEADER_IN_MSG 106869 28.38 21.24 32.06 16 DKIM_VALID_EF 95727 30.40 33.68 28.72 17 HTML_FONT_LOW_CONTRAST 85259 26.94 29.57 25.58 18 FVGT_m_MULTI_ODD 83529 27.53 32.33 25.06 19 LOC_TINY_FONT_1 74689 25.88 32.62 22.41 20 XMSubLong 74017 22.68 23.60 22.20 21 MIME_HTML_ONLY 63469 24.13 34.01 19.04 22 T_KAM_HTML_FONT_INVALID 61842 22.52 30.22 18.55 23 XM_B_SpammyWords2 60469 24.96 38.20 18.14 24 ALL_TRUSTED 59105 12.45 2.19 17.73 25 RCVD_IN_MSPIKE_WL 57863 16.87 15.94 17.36 26 USER_IN_DEF_DKIM_WL 40370 8.50 1.49 12.11 27 XM_Multi_Part_URI 39293 13.00 15.37 11.79 28 XM_Body_Dirty_Words 37023 14.83 22.06 11.11 29 RCVD_IN_MSPIKE_H3 36815 11.78 13.21 11.04 30 BAYES_00 33211 6.77 0.57 9.96 31 BAYES_60 31482 9.02 8.19 9.44 32 TooManyTo_001 31369 7.73 4.46 9.41 33 LotsOfNums_01 29707 7.95 6.08 8.91 34 XM_DKIMWhitelistDomains 28990 5.79 0.15 8.70 35 XM_B_Unsub 26903 10.42 15.00 8.07 36 UNPARSEABLE_RELAY 26377 9.56 12.77 7.91 37 XM_Evil_Numbers_Gen 25535 7.81 8.09 7.66 38 LOTS_OF_MONEY 25477 9.20 12.23 7.64 39 T_TooManySym_01 25068 5.86 2.65 7.52 40 IN_ZIMBRA_NJ_WHITELIST 22668 4.51 0.07 6.80 41 TR_XM_BayesUnsub 21151 9.17 14.66 6.35 42 XM_DK_Undo_02 21069 17.86 40.28 6.32 43 TR_XM_DK_Bayes 20822 4.24 0.34 6.25 44 TR_XM_DK_Bayes1 20467 4.17 0.33 6.14 45 TR_XM_UnparsRelay 20304 8.28 12.54 6.09 46 HTML_IMAGE_RATIO_02 19897 5.82 5.54 5.97 47 XM_PDF 18735 3.97 0.78 5.62 48 BAYES_99 18125 14.84 33.10 5.44 49 MIME_QP_LONG_LINE 18105 4.57 2.90 5.43 50 TR_XM_DK_Bayes2 17887 3.64 0.28 5.37 51 XM_SendGrid 17297 5.40 5.80 5.19 52 RCVD_IN_IADB_LISTED 17212 4.05 1.89 5.16 53 RCVD_IN_MSPIKE_H4 16628 4.14 2.48 4.99 54 BAYES_40 16337 3.87 1.87 4.90 55 RCVD_IN_VALIDITY_SAFE 16172 4.05 2.48 4.85 56 TR_XM_SpammyWords4 16128 6.80 10.60 4.84 57 BOTNET_IPINHOSTNAME 16124 8.09 14.42 4.84 58 XM_H_Long_From01 16106 6.33 9.23 4.83 59 XMNumbers 16018 4.87 4.99 4.81 60 RCVD_IN_IADB_SPF 15291 3.59 1.66 4.59 61 XMStrtUSub 15286 4.79 5.20 4.59 62 BAYES_80 15268 6.06 8.93 4.58 63 TR_XM_DKIM_Undo 15225 14.43 33.58 4.57 64 MPART_ALT_DIFF 14951 5.64 7.88 4.49 65 T_TooManySym_02 14870 3.27 0.95 4.46 66 RCVD_IN_VALIDITY_CERTIFIED 14580 3.56 1.98 4.37 67 BAYES_999 14417 11.69 25.99 4.32 68 XM_UncommonTLD01 14064 6.69 11.48 4.22 69 RCVD_IN_IADB_SENDERID 13878 3.27 1.53 4.16 70 RCVD_IN_IADB_DK 13416 3.18 1.55 4.02 71 T_REMOTE_IMAGE 13068 4.93 6.88 3.92 72 RELAYCOUNTRY_META 12521 11.32 26.00 3.76 73 FSL_BULK_SIG 12382 7.20 13.98 3.71 74 XMSubMetaSx_00 11985 4.75 6.99 3.60 75 BAYES_20 11972 2.87 1.45 3.59 76 TR_XM_DK_SendGrid 11748 3.46 3.32 3.52 77 HTML_IMAGE_RATIO_04 11598 3.51 3.58 3.48 78 XM_B_SpammyWords3 11585 6.54 12.49 3.48 79 XM_B_Phish_Phrases 11576 4.14 5.44 3.47 80 DKIM_INVALID 11346 3.27 3.01 3.40 81 MAILING_LIST_MULTI 10526 2.67 1.72 3.16 82 TR_XM_PhishingBody 10362 4.46 7.09 3.11 83 RCVD_IN_IADB_VOUCHED 10049 2.34 1.03 3.01 84 XMSexyCombo_05 9737 5.46 10.40 2.92 85 HTML_IMAGE_RATIO_06 9411 2.96 3.23 2.82 86 XM_SPF_SoftFail 9168 4.15 6.86 2.75 87 BAYES_95 9003 3.60 5.36 2.70 88 MIME_HTML_ONLY_MULTI 8490 3.32 4.84 2.55 89 TooManyTo_002 8375 1.84 0.53 2.51 90 FROM_EXCESS_BASE64 8052 2.20 1.78 2.42 91 MIME_HTML_MOSTLY 7871 3.00 4.24 2.36 92 HTML_MIME_NO_HTML_TAG 7780 2.76 3.57 2.33 93 BAYES_05 7607 1.71 0.61 2.28 94 URI_NOVOWEL 7580 2.45 2.80 2.27 95 TR_XM_SB_Phish 7396 2.15 2.01 2.22 96 BOUNCE_MESSAGE 7301 1.70 0.75 2.19 97 ANY_BOUNCE_MESSAGE 7301 1.70 0.75 2.19 98 XMSubPhish11 7262 2.05 1.81 2.18 99 TVD_RCVD_IP 7239 1.55 0.36 2.17 100 XM_B_SpammyTLD 6879 3.26 5.57 2.06 101 RCVD_IN_IADB_OPTIN 6732 1.57 0.68 2.02 102 INVALID_MSGID 6664 1.36 0.13 2.00 103 HTML_IMAGE_RATIO_08 6660 2.14 2.41 2.00 104 HELO_NODOT 6574 1.50 0.59 1.97 105 HELO_NO_DOMAIN 6567 1.50 0.58 1.97 106 TM2_M_URI_OPT_OUT 6506 2.18 2.63 1.95 107 XM_B_Phish66 6425 2.70 4.21 1.93 108 T_XMDrugObfuBody_14 6406 2.59 3.89 1.92 109 SUBJ_ALL_CAPS 6374 2.41 3.37 1.91 110 MSGID_NOFQDN1 6246 1.25 0.03 1.87 111 IN_HORDE_ADDRESS_BOOK 6073 1.23 0.09 1.82 112 XM_CamelCaseFrm001 6054 3.55 6.92 1.82 113 XM_H_Trusted_IP 6036 1.20 0.00 1.81 114 T_TooManySym_03 6023 1.32 0.36 1.81 115 TO_MALFORMED 5947 1.19 0.05 1.78 116 TR_Symld_Words 5913 1.51 0.99 1.77 117 KHOP_HELO_FCRDNS 5901 1.62 1.34 1.77 118 TR_DCC_Bayes_99 5748 9.31 24.03 1.72 119 TooManyTo_003 5723 1.28 0.43 1.72 120 TVD_SPACE_RATIO 5700 1.20 0.21 1.71 121 TR_XM_SpammyRelay 5615 6.46 15.75 1.68 122 XM_DK_Undo_01 5520 2.08 2.89 1.66 123 XMDiploma_00 5513 1.87 2.29 1.65 124 BOTNET 4961 5.47 13.20 1.49 125 XM_B_Investor 4910 2.89 5.64 1.47 126 T_XMHurry_00 4897 1.66 2.02 1.47 127 T_XMDrugObfuBody_08 4686 2.60 4.91 1.41 128 XM_GoogleGroups 4677 1.86 2.73 1.40 129 TR_XM_SpammyWords5 4566 2.46 4.57 1.37 130 XMStockSpam_06 4517 1.46 1.67 1.36 131 RCVD_IN_MSPIKE_H5 4420 0.96 0.24 1.33 132 UNTRUSTED_Relay 4342 3.93 9.05 1.30 133 TooManyTo_004 4269 0.98 0.39 1.28 134 XMCapTrack 4138 0.98 0.48 1.24 135 XMGappySubj_01 3995 0.86 0.21 1.20 136 XMBSHREFv2 3949 0.87 0.25 1.18 137 URI_HEX 3942 1.28 1.47 1.18 138 RELAYCOUNTRY_CA 3937 4.65 11.40 1.18 139 XM_B_Unsub2 3923 1.65 2.56 1.18 140 XMBody_95 3899 0.81 0.11 1.17 141 DKIM_ADSP_CUSTOM_MED 3769 1.04 0.86 1.13 142 XM_OfRef6 3752 2.14 4.12 1.13 143 TM2_M_VERY_LONG_WORD 3633 2.15 4.20 1.09 144 XM_H_Long_From02 3623 1.23 1.51 1.09 145 TooManyTo_005 3454 0.79 0.31 1.04 146 SpammyFromTLD_01 3405 2.06 4.07 1.02 147 RCVD_IN_RP_SAFE 3174 0.82 0.55 0.95 148 HTTPS_HTTP_MISMATCH 3151 1.38 2.21 0.95 149 HTML_FONT_FACE_BAD 3077 0.86 0.73 0.92 150 XMNoVowels 3036 0.74 0.40 0.91 151 FVGT_m_MULTI_ODD_EMAIL 2956 0.64 0.17 0.89 152 RCVD_IN_RP_CERTIFIED 2921 0.71 0.40 0.88 153 TR_XM_SpammyWords2 2900 4.38 11.21 0.87 154 XM_UB50 2780 1.77 3.60 0.83 155 T_FILL_THIS_FORM_SHORT 2751 1.75 3.56 0.83 156 TR_XM_Base64_M1 2660 0.82 0.87 0.80 157 XMBdyGiftCard01 2643 0.97 1.30 0.79 158 XMGenDplmaNmb 2642 0.87 1.03 0.79 159 XMHTML_After_End 2625 1.01 1.43 0.79 160 XMSubMetaSxObfu_02 2587 0.82 0.90 0.78 161 HTML_TAG_BALANCE_BODY 2583 0.82 0.91 0.77 162 XMBrknScrpt_02 2493 0.90 1.21 0.75 163 XMSubNoVowel 2442 0.91 1.27 0.73 164 XM_H_PHPMailer 2417 0.73 0.73 0.73 165 XM_B_COPY_HTML 2355 0.67 0.60 0.71 166 TR_MetaPhish_Combo_01 2336 0.78 0.94 0.70 167 FORGED_GMAIL_RCVD 2292 0.71 0.74 0.69 168 TR_XM_PHPDW 2272 1.24 2.32 0.68 169 XM_ShortIntro_01 2255 0.64 0.56 0.68 170 XM_RXBody 2231 0.53 0.26 0.67 171 T_OBFU_PDF_ATTACH 2178 0.49 0.16 0.65 172 TR_XM_PHPForged 2142 1.18 2.23 0.64 173 TR_XM_FormFill2 2123 1.17 2.21 0.64 174 XMLngstWrd_00 2095 1.28 2.54 0.63 175 XM_H_PHPOS 2095 1.16 2.20 0.63 176 NML_ADSP_CUSTOM_MED 2041 0.63 0.66 0.61 177 HTML_IMAGE_ONLY_20 2031 0.52 0.34 0.61 178 XMPhish30 1966 0.70 0.92 0.59 179 RELAYCOUNTRY_GB 1955 0.73 1.00 0.59 180 SHORT_HELO_AND_INLINE_IMAGE 1941 0.41 0.09 0.58 181 URI_TRY_3LD 1927 0.70 0.93 0.58 182 T_XMDrugObfuBody_00 1887 0.87 1.45 0.57 183 XMBody_17 1866 1.87 4.42 0.56 184 MPART_ALT_DIFF_COUNT 1836 0.91 1.59 0.55 185 XMLngstWrd_01 1801 1.20 2.49 0.54 186 XM_shorewaves_Whitelist 1799 0.36 0.00 0.54 187 T_Symld_Words_02 1742 0.59 0.72 0.52 188 XM_ProductURIs 1726 0.57 0.67 0.52 189 HTML_IMAGE_ONLY_32 1660 0.41 0.25 0.50 190 REMOVE_BEFORE_LINK 1641 0.70 1.09 0.49 191 RCVD_IN_SORBS_DUL 1627 0.38 0.18 0.49 192 TM2_M_BODY_EMPTY 1621 0.66 1.01 0.49 193 MISSING_HEADERS 1602 0.46 0.41 0.48 194 HTML_IMAGE_ONLY_28 1561 0.41 0.31 0.47 195 XMSexyCombo_01 1557 0.92 1.81 0.47 196 TO_NO_BRKTS_HTML_ONLY 1555 0.36 0.14 0.47 197 XMLngstWrd_02 1474 1.11 2.42 0.44 198 USER_IN_WELCOMELIST 1471 0.29 0.00 0.44 199 USER_IN_WHITELIST 1471 0.29 0.00 0.44 200 FROM_GOV_SPOOF 1466 0.34 0.15 0.44 ----------------------------------------------------------------------