Email: 535024 Autolearn: 0 AvgScore: 4.63 AvgScanTime: 1.45 sec Spam: 183378 Autolearn: 0 AvgScore: 14.89 AvgScanTime: 1.59 sec Ham: 351646 Autolearn: 0 AvgScore: -0.73 AvgScanTime: 1.38 sec Time Spent Running SA: 216.10 hours Time Spent Processing Spam: 80.99 hours Time Spent Processing Ham: 135.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176293 89.89 96.14 86.64 2 DKIM_SIGNED 158218 78.25 86.28 74.06 3 XM_DK_Pass 154975 76.28 84.51 71.98 4 XM_B_Unicode 153589 74.37 83.76 69.48 5 DKIM_VALID 153571 75.33 83.75 70.94 6 RELAYCOUNTRY_US 143688 79.51 78.36 80.11 7 DCC_CHECK 139148 48.61 75.88 34.39 8 XMListUnsubscribeExists 124860 55.75 68.09 49.32 9 XM_B_SpammyWords 120808 51.10 65.88 43.40 10 DKIM_VALID_AU 115913 57.85 63.21 55.06 11 RCVD_IN_MSPIKE_H2 80566 41.49 43.93 40.21 12 XM_B_Unicode3 78191 40.76 42.64 39.78 13 XM_DK_Undo_02 76564 18.68 41.75 6.65 14 BAYES_50 75259 51.63 41.04 57.16 15 MIME_HTML_ONLY 68027 25.39 37.10 19.28 16 XM_B_SpammyWords2 67420 24.32 36.77 17.83 17 TR_XM_DKIM_Undo 62768 14.79 34.23 4.66 18 BAYES_99 62347 15.03 34.00 5.14 19 LOC_TINY_FONT_1 61156 27.00 33.35 23.68 20 FVGT_m_MULTI_ODD 60821 27.78 33.17 24.98 21 HTML_FONT_LOW_CONTRAST 59881 29.10 32.65 27.25 22 DKIM_VALID_EF 59281 29.03 32.33 27.31 23 T_KAM_HTML_FONT_INVALID 52762 23.32 28.77 20.47 24 BAYES_999 49117 11.90 26.78 4.14 25 TR_DCC_Bayes_99 46676 10.03 25.45 1.98 26 RELAYCOUNTRY_META 46265 10.99 25.23 3.57 27 DCC_CHECK_NEGATIVE 44197 51.35 24.10 65.57 28 XM_Body_Dirty_Words 43837 15.43 23.91 11.01 29 XMSubLong 42123 22.40 22.97 22.10 30 T_TM2_M_HEADER_IN_MSG 36513 26.83 19.91 30.43 31 XM_Multi_Part_URI 30434 13.36 16.60 11.66 32 RCVD_IN_MSPIKE_WL 30054 16.85 16.39 17.08 33 XM_B_Unsub 27712 10.42 15.11 7.98 34 FSL_BULK_SIG 27226 7.03 14.85 2.96 35 TR_XM_BayesUnsub 27088 9.12 14.77 6.17 36 TR_XM_SpammyRelay 26648 6.05 14.53 1.62 37 RCVD_IN_MSPIKE_H3 25529 12.16 13.92 11.24 38 BOTNET_IPINHOSTNAME 25064 7.91 13.67 4.90 39 UNPARSEABLE_RELAY 24738 9.64 13.49 7.64 40 LOTS_OF_MONEY 24214 9.73 13.20 7.92 41 BOTNET 24120 5.56 13.15 1.60 42 TR_XM_UnparsRelay 24102 8.34 13.14 5.83 43 RCVD_IN_BL_SPAMCOP_NET 23338 4.77 12.73 0.61 44 XM_B_SpammyWords3 23116 7.10 12.61 4.23 45 TR_XM_SpammyWords2 21117 4.68 11.52 1.11 46 TR_XM_SpammyWords4 20898 6.53 11.40 4.00 47 XMSexyCombo_05 20747 5.73 11.31 2.82 48 XM_UncommonTLD01 19204 6.07 10.47 3.78 49 RELAYCOUNTRY_CA 18332 4.14 10.00 1.08 50 UNTRUSTED_Relay 17131 4.10 9.34 1.37 51 XM_Evil_Numbers_Gen 16514 8.59 9.01 8.37 52 XM_H_Long_From01 15754 6.40 8.59 5.25 53 BAYES_80 15366 6.01 8.38 4.78 54 MPART_ALT_DIFF 14969 5.83 8.16 4.61 55 TR_XM_SPAMCOP 14809 3.02 8.08 0.38 56 XM_CamelCaseFrm001 13860 3.79 7.56 1.82 57 T_REMOTE_IMAGE 13701 5.03 7.47 3.75 58 BAYES_60 13414 8.94 7.31 9.78 59 LotsOfNums_01 12633 8.61 6.89 9.51 60 RCVD_IN_MSPIKE_BL 12475 2.60 6.80 0.41 61 TR_XM_PhishingBody 12094 4.24 6.60 3.01 62 TR_XM_MSPIKECOMBO 11835 2.47 6.45 0.40 63 XM_B_Phish_Phrases 11637 4.38 6.35 3.35 64 XMSubMetaSx_00 11050 4.72 6.03 4.04 65 XM_SPF_SoftFail 10903 3.53 5.95 2.28 66 HTML_IMAGE_RATIO_02 10768 5.51 5.87 5.33 67 RCVD_IN_VALIDITY_RPBL 10639 2.01 5.80 0.03 68 TM2_M_VERY_LONG_WORD 10483 2.57 5.72 0.93 69 MIME_HTML_ONLY_MULTI 10412 3.82 5.68 2.86 70 XM_B_Investor 10329 3.22 5.63 1.97 71 XM_SendGrid 10248 4.79 5.59 4.38 72 HTML_IMAGE_ONLY_24 9557 2.01 5.21 0.35 73 HTTP_EXCESSIVE_ESCAPES 9268 1.74 5.05 0.02 74 BAYES_95 9135 3.49 4.98 2.71 75 HTML_MIME_NO_HTML_TAG 9126 3.81 4.98 3.20 76 XM_DIRTYINTL 8813 1.84 4.81 0.30 77 XM_B_SpammyTLD 8342 3.22 4.55 2.53 78 T_XMDrugObfuBody_08 8173 2.53 4.46 1.53 79 XMNumbers 8101 4.12 4.42 3.97 80 TooManyTo_001 8097 7.03 4.42 8.39 81 XMBody_17 7833 1.78 4.27 0.48 82 BOTNET_NORDNS 7818 1.47 4.26 0.02 83 TR_XM_SpammyWords5 7484 2.36 4.08 1.47 84 TR_XM_SpammyWords3 7436 1.49 4.06 0.15 85 XMStrtUSub 7377 4.27 4.02 4.41 86 T_XMDrugObfuBody_14 7322 2.42 3.99 1.60 87 HTML_IMAGE_RATIO_04 7251 4.33 3.95 4.53 88 XM_GoogleGroups 7064 2.16 3.85 1.27 89 XMLngstWrd_00 7016 1.61 3.83 0.45 90 TR_XM_DK_SendGrid 6969 3.17 3.80 2.84 91 XMLngstWrd_01 6904 1.54 3.76 0.38 92 XM_B_Phish66 6813 2.48 3.72 1.83 93 XMLngstWrd_02 6808 1.46 3.71 0.29 94 XM_UB50 6763 1.87 3.69 0.92 95 XM_OfRef6 6709 2.01 3.66 1.14 96 MIME_HTML_MOSTLY 6649 2.91 3.63 2.54 97 HTML_TITLE_SUBJ_DIFF 6584 1.26 3.59 0.04 98 SpammyFromTLD_02 6485 1.51 3.54 0.45 99 T_FILL_THIS_FORM_SHORT 6431 1.77 3.51 0.86 100 XMLngstWrd_03 6424 1.34 3.50 0.21 101 RCVD_IN_PSBL 6360 1.37 3.47 0.27 102 RCVD_IN_MSPIKE_L5 6334 1.20 3.45 0.02 103 XMLngstWrd_04 6298 1.27 3.43 0.14 104 HTML_IMAGE_RATIO_06 5991 3.83 3.27 4.13 105 UPPERCASE_75_100 5959 1.13 3.25 0.02 106 SpammyFromTLD_01 5902 1.60 3.22 0.75 107 MIME_QP_LONG_LINE 5893 4.99 3.21 5.92 108 RCVD_IN_VALIDITY_SAFE 5567 3.84 3.04 4.26 109 T_TooManySym_01 5294 5.47 2.89 6.82 110 URIBL_DBL_SPAM 5294 1.00 2.89 0.01 111 MIME_BASE64_TEXT 5123 1.08 2.79 0.19 112 TM2_M_URI_OPT_OUT 5033 2.36 2.74 2.17 113 RCVD_IN_MSPIKE_L3 4969 1.17 2.71 0.37 114 XM_B_Unsub2 4933 1.92 2.69 1.52 115 XMDiploma_00 4774 2.36 2.60 2.23 116 URI_NOVOWEL 4742 2.67 2.59 2.72 117 DKIM_INVALID 4647 2.92 2.53 3.12 118 XM_DK_Undo_01 4608 1.86 2.51 1.52 119 XM_UB99 4592 0.86 2.50 0.00 120 RCVD_IN_VALIDITY_CERTIFIED 4581 3.37 2.50 3.82 121 FONT_INVIS_LONG_LINE 4451 0.87 2.43 0.05 122 HTML_IMAGE_RATIO_08 4420 2.46 2.41 2.48 123 USER_IN_DEF_DKIM_WL 4210 8.66 2.30 11.98 124 RCVD_IN_IADB_LISTED 4183 4.53 2.28 5.70 125 TR_LOTS_OF_MONEY3 4092 0.98 2.23 0.33 126 RCVD_IN_MSPIKE_H4 4025 3.80 2.19 4.63 127 TVD_RCVD_SPACE_BRACKET 3881 0.73 2.12 0.01 128 XM_B_SpammyWords4 3863 1.14 2.11 0.63 129 TR_XM_MSPIKECOMBO2 3820 0.74 2.08 0.04 130 HK_RANDOM_REPLYTO 3756 0.75 2.05 0.08 131 XM_UB999 3742 0.70 2.04 0.00 132 PDS_OTHER_BAD_TLD 3732 0.83 2.04 0.20 133 XM_B_COVIDMETA 3702 0.97 2.02 0.42 134 RCVD_IN_IADB_SPF 3685 4.00 2.01 5.04 135 MPART_ALT_DIFF_COUNT 3605 1.04 1.97 0.55 136 XMSexyCombo_01 3557 1.05 1.94 0.59 137 XMStockSpam_06 3546 1.28 1.93 0.93 138 RCVD_IN_IADB_DK 3514 3.52 1.92 4.36 139 HTTPS_HTTP_MISMATCH 3499 1.47 1.91 1.25 140 RCVD_IN_IADB_SENDERID 3466 3.61 1.89 4.51 141 TR_XM_FormFill 3433 0.67 1.87 0.04 142 TR_XM_NoHeaderRelay 3198 0.67 1.74 0.11 143 T_XMHurry_00 3151 0.88 1.72 0.45 144 TR_XM_InvalidRelay 3148 0.60 1.72 0.02 145 FROM_EXCESS_BASE64 3068 2.31 1.67 2.65 146 BAYES_40 3037 3.67 1.66 4.72 147 URI_HEX 3011 1.50 1.64 1.43 148 TR_XM_SB_Phish 2978 1.92 1.62 2.08 149 XMReplyNow 2936 0.71 1.60 0.24 150 MAILING_LIST_MULTI 2914 2.46 1.59 2.91 151 XMSubPhish11 2885 1.89 1.57 2.05 152 URI_PHP_REDIR 2787 0.52 1.52 0.00 153 RELAYCOUNTRY_CN 2742 0.55 1.50 0.06 154 RELAYCOUNTRY_RU 2678 0.52 1.46 0.02 155 ALL_TRUSTED 2531 11.64 1.38 17.00 156 XMHTML_After_End 2530 0.95 1.38 0.73 157 XMBdyGiftCard01 2519 1.04 1.37 0.86 158 TR_XM_BayesRelay 2492 0.47 1.36 0.00 159 TR_XM_PHPDW 2486 0.73 1.36 0.40 160 XM_URI_RBL 2482 0.55 1.35 0.14 161 T_XMDrugObfuBody_00 2466 0.87 1.34 0.62 162 XM_H_Long_From02 2463 1.30 1.34 1.28 163 SUBJ_ALL_CAPS 2461 1.53 1.34 1.63 164 XM_Combo_Sbj 2438 0.59 1.33 0.21 165 RELAYCOUNTRY_AU 2417 0.64 1.32 0.28 166 TR_XM_PHPForged 2407 0.69 1.31 0.36 167 TR_XM_FormFill2 2365 0.68 1.29 0.36 168 URIBL_BLACK 2362 0.48 1.29 0.06 169 XM_H_PHPOS 2353 0.67 1.28 0.35 170 RELAYCOUNTRY_FR 2327 0.59 1.27 0.23 171 XMGenDplmaNmb 2275 1.22 1.24 1.21 172 XM_Body_Dirty_Words_01 2270 0.50 1.24 0.12 173 KHOP_HELO_FCRDNS 2267 1.31 1.24 1.35 174 XM_RXBody 2264 0.64 1.23 0.33 175 MultiRelay_CC 2206 0.42 1.20 0.01 176 XMPhish30 2167 0.72 1.18 0.48 177 RELAYCOUNTRY_GB 2133 0.77 1.16 0.57 178 TR_Mismatch_TLD_02 2082 0.45 1.14 0.10 179 BAYES_20 2074 2.59 1.13 3.35 180 RCVD_IN_RP_RNBL 2071 0.39 1.13 0.01 181 RELAYCOUNTRY_IN 2038 0.44 1.11 0.08 182 TR_XM_MaxSPIKE 2005 0.40 1.09 0.04 183 XMNoVowels 1980 0.95 1.08 0.89 184 XM_UB80 1973 0.38 1.08 0.02 185 TR_XM_COVIDMETA4 1964 0.48 1.07 0.17 186 TR_XM_Base64_M1 1961 1.04 1.07 1.03 187 RCVD_IN_IADB_VOUCHED 1940 2.67 1.06 3.51 188 LONGLN_LOW_CONTRAST 1920 0.59 1.05 0.35 189 HTML_TAG_BALANCE_BODY 1883 0.83 1.03 0.73 190 RELAYCOUNTRY_JP 1880 0.37 1.03 0.02 191 XMBrknScrpt_02 1874 0.74 1.02 0.59 192 XM_B_SEO 1829 0.45 1.00 0.17 193 XMSlimDrugH 1828 0.57 1.00 0.34 194 TR_Symld_Words 1819 1.43 0.99 1.66 195 XM_H_Undi_Recip 1787 0.49 0.97 0.24 196 XM_Body_Obfu01 1777 0.61 0.97 0.43 197 XM_UB60 1771 0.38 0.97 0.07 198 NORDNS_LOW_CONTRAST 1770 0.35 0.97 0.03 199 XMMoneyMeta_00 1758 0.67 0.96 0.53 200 TR_XM_COVIDMETA1 1743 0.42 0.95 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 304664 89.89 96.14 86.64 2 RELAYCOUNTRY_US 281716 79.51 78.36 80.11 3 DKIM_SIGNED 260426 78.25 86.28 74.06 4 XM_DK_Pass 253123 76.28 84.51 71.98 5 DKIM_VALID 249459 75.33 83.75 70.94 6 XM_B_Unicode 244320 74.37 83.76 69.48 7 DCC_CHECK_NEGATIVE 230560 51.35 24.10 65.57 8 BAYES_50 200998 51.63 41.04 57.16 9 DKIM_VALID_AU 193623 57.85 63.21 55.06 10 XMListUnsubscribeExists 173429 55.75 68.09 49.32 11 XM_B_SpammyWords 152603 51.10 65.88 43.40 12 RCVD_IN_MSPIKE_H2 141414 41.49 43.93 40.21 13 XM_B_Unicode3 139888 40.76 42.64 39.78 14 DCC_CHECK 120914 48.61 75.88 34.39 15 T_TM2_M_HEADER_IN_MSG 107022 26.83 19.91 30.43 16 DKIM_VALID_EF 96046 29.03 32.33 27.31 17 HTML_FONT_LOW_CONTRAST 95826 29.10 32.65 27.25 18 FVGT_m_MULTI_ODD 87831 27.78 33.17 24.98 19 LOC_TINY_FONT_1 83287 27.00 33.35 23.68 20 XMSubLong 77726 22.40 22.97 22.10 21 T_KAM_HTML_FONT_INVALID 71982 23.32 28.77 20.47 22 MIME_HTML_ONLY 67807 25.39 37.10 19.28 23 XM_B_SpammyWords2 62692 24.32 36.77 17.83 24 RCVD_IN_MSPIKE_WL 60071 16.85 16.39 17.08 25 ALL_TRUSTED 59764 11.64 1.38 17.00 26 USER_IN_DEF_DKIM_WL 42137 8.66 2.30 11.98 27 XM_Multi_Part_URI 41019 13.36 16.60 11.66 28 RCVD_IN_MSPIKE_H3 39514 12.16 13.92 11.24 29 XM_Body_Dirty_Words 38714 15.43 23.91 11.01 30 BAYES_00 35372 6.88 0.80 10.06 31 BAYES_60 34396 8.94 7.31 9.78 32 LotsOfNums_01 33428 8.61 6.89 9.51 33 XM_DKIMWhitelistDomains 30619 5.92 0.59 8.71 34 TooManyTo_001 29496 7.03 4.42 8.39 35 XM_Evil_Numbers_Gen 29442 8.59 9.01 8.37 36 XM_B_Unsub 28058 10.42 15.11 7.98 37 LOTS_OF_MONEY 27866 9.73 13.20 7.92 38 UNPARSEABLE_RELAY 26857 9.64 13.49 7.64 39 T_TooManySym_01 23965 5.47 2.89 6.82 40 XM_DK_Undo_02 23390 18.68 41.75 6.65 41 IN_ZIMBRA_NJ_WHITELIST 23106 4.35 0.11 6.57 42 TR_XM_DK_Bayes 21961 4.31 0.59 6.25 43 TR_XM_BayesUnsub 21695 9.12 14.77 6.17 44 TR_XM_DK_Bayes1 21642 4.25 0.59 6.15 45 MIME_QP_LONG_LINE 20824 4.99 3.21 5.92 46 TR_XM_UnparsRelay 20500 8.34 13.14 5.83 47 RCVD_IN_IADB_LISTED 20045 4.53 2.28 5.70 48 HTML_IMAGE_RATIO_02 18735 5.51 5.87 5.33 49 TR_XM_DK_Bayes2 18503 3.63 0.49 5.26 50 XM_H_Long_From01 18463 6.40 8.59 5.25 51 BAYES_99 18060 15.03 34.00 5.14 52 RCVD_IN_IADB_SPF 17718 4.00 2.01 5.04 53 XM_PDF 17667 3.58 0.81 5.02 54 BOTNET_IPINHOSTNAME 17232 7.91 13.67 4.90 55 BAYES_80 16803 6.01 8.38 4.78 56 BAYES_40 16586 3.67 1.66 4.72 57 TR_XM_DKIM_Undo 16382 14.79 34.23 4.66 58 RCVD_IN_MSPIKE_H4 16297 3.80 2.19 4.63 59 MPART_ALT_DIFF 16205 5.83 8.16 4.61 60 HTML_IMAGE_RATIO_04 15928 4.33 3.95 4.53 61 RCVD_IN_IADB_SENDERID 15850 3.61 1.89 4.51 62 XMStrtUSub 15495 4.27 4.02 4.41 63 XM_SendGrid 15387 4.79 5.59 4.38 64 RCVD_IN_IADB_DK 15339 3.52 1.92 4.36 65 RCVD_IN_VALIDITY_SAFE 14966 3.84 3.04 4.26 66 XM_B_SpammyWords3 14880 7.10 12.61 4.23 67 BAYES_999 14550 11.90 26.78 4.14 68 HTML_IMAGE_RATIO_06 14509 3.83 3.27 4.13 69 XMSubMetaSx_00 14222 4.72 6.03 4.04 70 T_TooManySym_02 14130 2.87 0.66 4.02 71 TR_XM_SpammyWords4 14059 6.53 11.40 4.00 72 XMNumbers 13961 4.12 4.42 3.97 73 RCVD_IN_VALIDITY_CERTIFIED 13427 3.37 2.50 3.82 74 XM_UncommonTLD01 13294 6.07 10.47 3.78 75 T_REMOTE_IMAGE 13186 5.03 7.47 3.75 76 RELAYCOUNTRY_META 12542 10.99 25.23 3.57 77 RCVD_IN_IADB_VOUCHED 12347 2.67 1.06 3.51 78 BAYES_20 11773 2.59 1.13 3.35 79 XM_B_Phish_Phrases 11771 4.38 6.35 3.35 80 HTML_MIME_NO_HTML_TAG 11269 3.81 4.98 3.20 81 DKIM_INVALID 10967 2.92 2.53 3.12 82 TR_XM_PhishingBody 10592 4.24 6.60 3.01 83 FSL_BULK_SIG 10408 7.03 14.85 2.96 84 MAILING_LIST_MULTI 10235 2.46 1.59 2.91 85 MIME_HTML_ONLY_MULTI 10042 3.82 5.68 2.86 86 TR_XM_DK_SendGrid 9996 3.17 3.80 2.84 87 XMSexyCombo_05 9904 5.73 11.31 2.82 88 URI_NOVOWEL 9548 2.67 2.59 2.72 89 BAYES_95 9526 3.49 4.98 2.71 90 FROM_EXCESS_BASE64 9311 2.31 1.67 2.65 91 XM_H_Trusted_IP 9197 1.72 0.00 2.62 92 MIME_HTML_MOSTLY 8944 2.91 3.63 2.54 93 XM_B_SpammyTLD 8885 3.22 4.55 2.53 94 HTML_IMAGE_RATIO_08 8736 2.46 2.41 2.48 95 RCVD_IN_IADB_OPTIN 8267 1.77 0.65 2.35 96 XM_SPF_SoftFail 8009 3.53 5.95 2.28 97 ANY_BOUNCE_MESSAGE 7970 1.74 0.74 2.27 98 BOUNCE_MESSAGE 7965 1.74 0.74 2.27 99 TooManyTo_002 7922 1.67 0.56 2.25 100 XMDiploma_00 7854 2.36 2.60 2.23 101 TM2_M_URI_OPT_OUT 7619 2.36 2.74 2.17 102 BAYES_05 7525 1.61 0.58 2.14 103 TR_XM_SB_Phish 7312 1.92 1.62 2.08 104 XMSubPhish11 7211 1.89 1.57 2.05 105 TR_DCC_Bayes_99 6972 10.03 25.45 1.98 106 XM_B_Investor 6920 3.22 5.63 1.97 107 INVALID_MSGID 6672 1.30 0.15 1.90 108 HELO_NODOT 6653 1.44 0.57 1.89 109 HELO_NO_DOMAIN 6650 1.43 0.56 1.89 110 IN_HORDE_ADDRESS_BOOK 6589 1.27 0.11 1.87 111 XM_B_Phish66 6441 2.48 3.72 1.83 112 XM_CamelCaseFrm001 6417 3.79 7.56 1.82 113 MSGID_NOFQDN1 6196 1.17 0.02 1.76 114 TVD_RCVD_IP 6074 1.28 0.43 1.73 115 TO_MALFORMED 5951 1.12 0.03 1.69 116 TR_Symld_Words 5823 1.43 0.99 1.66 117 T_TooManySym_03 5758 1.17 0.27 1.64 118 SUBJ_ALL_CAPS 5740 1.53 1.34 1.63 119 TR_XM_SpammyRelay 5703 6.05 14.53 1.62 120 TVD_SPACE_RATIO 5668 1.10 0.12 1.61 121 T_XMDrugObfuBody_14 5635 2.42 3.99 1.60 122 BOTNET 5611 5.56 13.15 1.60 123 T_XMDrugObfuBody_08 5370 2.53 4.46 1.53 124 XM_B_Unsub2 5332 1.92 2.69 1.52 125 XM_DK_Undo_01 5331 1.86 2.51 1.52 126 TR_XM_SpammyWords5 5163 2.36 4.08 1.47 127 TooManyTo_003 5088 1.09 0.42 1.45 128 URI_HEX 5012 1.50 1.64 1.43 129 UNTRUSTED_Relay 4817 4.10 9.34 1.37 130 KHOP_HELO_FCRDNS 4761 1.31 1.24 1.35 131 XMGappySubj_01 4630 0.95 0.25 1.32 132 XMBSHREFv2 4624 0.99 0.36 1.31 133 XM_H_Long_From02 4488 1.30 1.34 1.28 134 XM_GoogleGroups 4483 2.16 3.85 1.27 135 HTTPS_HTTP_MISMATCH 4379 1.47 1.91 1.25 136 RCVD_IN_MSPIKE_H5 4260 0.89 0.27 1.21 137 XMCapTrack 4248 0.94 0.42 1.21 138 XMGenDplmaNmb 4242 1.22 1.24 1.21 139 T_OBFU_HTML_ATTACH 4196 0.82 0.09 1.19 140 XM_OfRef6 4025 2.01 3.66 1.14 141 TR_XM_SpammyWords2 3917 4.68 11.52 1.11 142 XMBody_95 3834 0.77 0.17 1.09 143 RELAYCOUNTRY_CA 3797 4.14 10.00 1.08 144 TooManyTo_004 3685 0.81 0.35 1.05 145 HTML_FONT_FACE_BAD 3667 0.94 0.74 1.04 146 TR_XM_Base64_M1 3608 1.04 1.07 1.03 147 XMSubNoVowel 3433 0.94 0.88 0.98 148 TM2_M_VERY_LONG_WORD 3283 2.57 5.72 0.93 149 XMStockSpam_06 3276 1.28 1.93 0.93 150 XM_UB50 3222 1.87 3.69 0.92 151 XMNoVowels 3127 0.95 1.08 0.89 152 DKIM_ADSP_CUSTOM_MED 3067 0.82 0.71 0.87 153 XMBdyGiftCard01 3039 1.04 1.37 0.86 154 T_FILL_THIS_FORM_SHORT 3030 1.77 3.51 0.86 155 FVGT_m_MULTI_ODD_EMAIL 2962 0.62 0.19 0.84 156 RCVD_IN_RP_SAFE 2954 0.77 0.64 0.84 157 TooManyTo_005 2939 0.65 0.28 0.84 158 RCVD_IN_RP_CERTIFIED 2653 0.68 0.53 0.75 159 SpammyFromTLD_01 2632 1.60 3.22 0.75 160 FROM_GOV_DKIM_AU 2566 0.52 0.11 0.73 161 XMHTML_After_End 2561 0.95 1.38 0.73 162 HTML_TAG_BALANCE_BODY 2560 0.83 1.03 0.73 163 XM_H_PHPMailer 2349 0.66 0.65 0.67 164 T_OBFU_PDF_ATTACH 2233 0.48 0.19 0.64 165 XM_B_SpammyWords4 2210 1.14 2.11 0.63 166 T_XMDrugObfuBody_00 2195 0.87 1.34 0.62 167 XM_ShortIntro_01 2174 0.67 0.76 0.62 168 TR_MetaPhish_Combo_01 2168 0.67 0.77 0.62 169 RCVD_IN_BL_SPAMCOP_NET 2162 4.77 12.73 0.61 170 XMSubMetaI_00 2162 0.65 0.73 0.61 171 T_Symld_Words_02 2146 0.64 0.71 0.61 172 PLING_QUERY 2140 0.63 0.66 0.61 173 XMSexyCombo_01 2081 1.05 1.94 0.59 174 XMBrknScrpt_02 2072 0.74 1.02 0.59 175 XM_B_COPY_HTML 2053 0.55 0.48 0.58 176 XM_ProductURIs 2041 0.70 0.92 0.58 177 HTML_IMAGE_ONLY_20 2023 0.56 0.53 0.58 178 URI_TRY_3LD 1999 0.69 0.92 0.57 179 RELAYCOUNTRY_GB 1997 0.77 1.16 0.57 180 MPART_ALT_DIFF_COUNT 1938 1.04 1.97 0.55 181 SHORT_HELO_AND_INLINE_IMAGE 1926 0.39 0.09 0.55 182 NML_ADSP_CUSTOM_MED 1909 0.55 0.56 0.54 183 XMHTMLBadTable_001 1880 0.61 0.76 0.53 184 XMMoneyMeta_00 1851 0.67 0.96 0.53 185 BASE64_LENGTH_79_INF 1849 0.42 0.21 0.53 186 HTML_IMAGE_ONLY_28 1758 0.48 0.44 0.50 187 HTML_IMAGE_ONLY_32 1739 0.40 0.23 0.49 188 GMD_PDF_HORIZ 1724 0.34 0.05 0.49 189 FORGED_GMAIL_RCVD 1721 0.52 0.57 0.49 190 RCVD_IN_SORBS_DUL 1713 0.38 0.18 0.49 191 XMPhish30 1675 0.72 1.18 0.48 192 XMBody_17 1673 1.78 4.27 0.48 193 TR_XM_Base64_L1 1605 0.55 0.74 0.46 194 XMLngstWrd_00 1596 1.61 3.83 0.45 195 SpammyFromTLD_02 1590 1.51 3.54 0.45 196 T_XMHurry_00 1576 0.88 1.72 0.45 197 XM_Body_Obfu01 1498 0.61 0.97 0.43 198 USER_IN_WHITELIST 1487 0.28 0.00 0.42 199 USER_IN_WELCOMELIST 1487 0.28 0.00 0.42 200 XM_B_COVIDMETA 1465 0.97 2.02 0.42 ----------------------------------------------------------------------