Email: 542393 Autolearn: 0 AvgScore: 4.17 AvgScanTime: 1.46 sec Spam: 179624 Autolearn: 0 AvgScore: 13.65 AvgScanTime: 1.54 sec Ham: 362769 Autolearn: 0 AvgScore: -0.53 AvgScanTime: 1.43 sec Time Spent Running SA: 220.64 hours Time Spent Processing Spam: 76.81 hours Time Spent Processing Ham: 143.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170488 89.79 94.91 87.25 2 DKIM_SIGNED 162599 80.93 90.52 76.18 3 XM_DK_Pass 159810 79.10 88.97 74.22 4 DKIM_VALID 158492 78.12 88.24 73.11 5 RELAYCOUNTRY_US 151522 82.16 84.36 81.08 6 XM_B_Unicode 141129 72.74 78.57 69.85 7 XMListUnsubscribeExists 131281 57.40 73.09 49.63 8 DCC_CHECK 125850 47.20 70.06 35.88 9 DKIM_VALID_AU 121554 60.58 67.67 57.07 10 XM_B_SpammyWords 118943 51.16 66.22 43.71 11 RCVD_IN_MSPIKE_H2 82285 41.77 45.81 39.77 12 XM_DK_Undo_02 76455 18.71 42.56 6.90 13 BAYES_50 75341 52.51 41.94 57.75 14 XM_B_Unicode3 74065 40.41 41.23 40.00 15 XM_B_SpammyWords2 70154 24.98 39.06 18.01 16 LOC_TINY_FONT_1 67037 28.66 37.32 24.37 17 HTML_FONT_LOW_CONTRAST 66538 30.30 37.04 26.96 18 FVGT_m_MULTI_ODD 63404 28.84 35.30 25.65 19 DKIM_VALID_EF 62497 30.69 34.79 28.65 20 BAYES_99 60329 14.69 33.59 5.33 21 MIME_HTML_ONLY 57054 24.33 31.76 20.65 22 TR_XM_DKIM_Undo 56868 13.52 31.66 4.54 23 DCC_CHECK_NEGATIVE 53720 52.75 29.91 64.06 24 T_KAM_HTML_FONT_INVALID 53266 23.42 29.65 20.34 25 BAYES_999 48479 11.80 26.99 4.28 26 TR_DCC_Bayes_99 44815 9.59 24.95 1.98 27 XMSubLong 40114 22.03 22.33 21.88 28 XM_Body_Dirty_Words 37821 15.10 21.06 12.15 29 T_TM2_M_HEADER_IN_MSG 36285 25.85 20.20 28.65 30 XM_Multi_Part_URI 31332 13.83 17.44 12.04 31 RELAYCOUNTRY_META 30900 8.59 17.20 4.33 32 XM_B_Unsub 27272 10.22 15.18 7.76 33 TR_XM_BayesUnsub 26739 9.14 14.89 6.29 34 RCVD_IN_MSPIKE_WL 26004 16.85 14.48 18.03 35 BOTNET_IPINHOSTNAME 24152 7.83 13.45 5.05 36 LOTS_OF_MONEY 23945 9.01 13.33 6.86 37 XM_B_SpammyWords3 23195 6.91 12.91 3.94 38 XM_UncommonTLD01 22659 6.75 12.61 3.84 39 RCVD_IN_MSPIKE_H3 21469 12.07 11.95 12.13 40 TR_XM_SpammyWords4 21045 6.56 11.72 4.00 41 TR_XM_SpammyRelay 20480 5.15 11.40 2.06 42 TR_XM_SpammyWords2 19754 4.26 11.00 0.93 43 UNPARSEABLE_RELAY 19323 9.23 10.76 8.47 44 XMSexyCombo_05 18013 5.41 10.03 3.12 45 FSL_BULK_SIG 17279 6.70 9.62 5.26 46 MPART_ALT_DIFF 16757 6.54 9.33 5.15 47 XM_B_SpammyTLD 16259 4.61 9.05 2.41 48 XM_Evil_Numbers_Gen 15648 8.61 8.71 8.56 49 BOTNET 14574 3.75 8.11 1.60 50 BAYES_80 14049 5.49 7.82 4.34 51 BAYES_60 13542 8.42 7.54 8.85 52 TooManyTo_001 13323 8.05 7.42 8.37 53 SpammyFromTLD_02 13056 2.70 7.27 0.43 54 RELAYCOUNTRY_CA 12852 3.27 7.15 1.35 55 RCVD_IN_BL_SPAMCOP_NET 12427 2.64 6.92 0.52 56 TR_XM_PhishingBody 12273 4.46 6.83 3.28 57 XMSubMetaSx_00 12100 4.58 6.74 3.52 58 LotsOfNums_01 12071 8.27 6.72 9.03 59 UNTRUSTED_Relay 12020 3.08 6.69 1.30 60 HTML_IMAGE_RATIO_02 11828 5.56 6.58 5.06 61 MIME_HTML_ONLY_MULTI 11731 4.42 6.53 3.38 62 PDS_OTHER_BAD_TLD 11371 2.27 6.33 0.27 63 TR_XM_UnparsRelay 11289 3.07 6.28 1.47 64 TM2_M_VERY_LONG_WORD 10332 3.01 5.75 1.66 65 RCVD_IN_MSPIKE_BL 10218 2.21 5.69 0.49 66 XM_H_Long_From01 10113 5.54 5.63 5.50 67 TR_XM_MSPIKECOMBO 10094 2.18 5.62 0.48 68 XM_B_Phish_Phrases 10074 3.86 5.61 3.00 69 XM_B_Investor 10056 2.94 5.60 1.63 70 URIBL_DBL_SPAM 9672 1.79 5.38 0.01 71 XM_SendGrid 9656 5.19 5.38 5.10 72 FROM_SUSPICIOUS_NTLD 8978 1.69 5.00 0.05 73 TR_XM_SPAMCOP 8700 1.75 4.84 0.22 74 LongTLD 8631 1.85 4.81 0.39 75 XM_SPF_SoftFail 8620 3.21 4.80 2.42 76 FROM_SUSPICIOUS_NTLD_FP 8603 1.61 4.79 0.04 77 HTML_MIME_NO_HTML_TAG 8591 3.31 4.78 2.58 78 XMNumbers 8131 4.24 4.53 4.09 79 XM_B_Phish66 8131 2.80 4.53 1.94 80 HTML_IMAGE_RATIO_04 7968 4.15 4.44 4.00 81 BAYES_95 7908 3.30 4.40 2.76 82 TR_XM_SpammyWords3 7322 1.50 4.08 0.22 83 XMStrtUSub 7198 4.76 4.01 5.13 84 XMLngstWrd_00 7008 2.07 3.90 1.16 85 XM_GoogleGroups 6997 2.52 3.90 1.84 86 T_XMDrugObfuBody_14 6960 2.54 3.87 1.89 87 XMLngstWrd_01 6938 2.01 3.86 1.09 88 MIME_HTML_MOSTLY 6853 2.92 3.82 2.48 89 XMLngstWrd_02 6781 1.92 3.78 1.01 90 TR_XM_SpammyWords5 6597 2.09 3.67 1.30 91 XM_UB50 6395 1.74 3.56 0.84 92 XM_OfRef6 6365 1.84 3.54 1.00 93 XMLngstWrd_03 6361 1.80 3.54 0.93 94 TR_XM_DK_SendGrid 6311 3.40 3.51 3.34 95 HTML_TITLE_SUBJ_DIFF 6230 1.65 3.47 0.75 96 XMLngstWrd_04 6121 1.70 3.41 0.86 97 UPPERCASE_75_100 6031 1.61 3.36 0.75 98 MIME_QP_LONG_LINE 5842 4.75 3.25 5.49 99 HTML_IMAGE_RATIO_06 5678 3.87 3.16 4.22 100 XM_DIRTYINTL 5544 1.22 3.09 0.29 101 T_XMDrugObfuBody_08 5537 1.99 3.08 1.45 102 RCVD_IN_MSPIKE_L5 5482 1.04 3.05 0.05 103 URI_PHP_REDIR 5455 1.01 3.04 0.01 104 SpammyFromTLD_01 5447 1.56 3.03 0.83 105 XMBody_17 5249 1.35 2.92 0.58 106 XM_B_Unsub2 5172 2.01 2.88 1.58 107 T_REMOTE_IMAGE 4975 3.70 2.77 4.16 108 T_FILL_THIS_FORM_SHORT 4938 1.58 2.75 1.01 109 XMDiploma_00 4908 2.07 2.73 1.74 110 TM2_M_URI_OPT_OUT 4896 2.13 2.73 1.84 111 URI_NOVOWEL 4855 2.73 2.70 2.75 112 RCVD_IN_VALIDITY_SAFE 4809 3.69 2.68 4.20 113 XM_DK_Undo_01 4781 1.90 2.66 1.52 114 XM_B_SpammyWords4 4612 1.33 2.57 0.71 115 USER_IN_DEF_DKIM_WL 4388 9.36 2.44 12.79 116 RCVD_IN_MSPIKE_L3 4341 1.09 2.42 0.43 117 DKIM_INVALID 4107 2.81 2.29 3.07 118 TR_XM_PHPDW 4089 1.04 2.28 0.43 119 TR_XM_PHPForged 3993 0.99 2.22 0.38 120 RCVD_IN_MSPIKE_H4 3973 3.84 2.21 4.64 121 TR_XM_FormFill2 3940 0.98 2.19 0.38 122 XM_H_PHPOS 3932 0.97 2.19 0.37 123 T_TooManySym_01 3893 5.06 2.17 6.49 124 HTTPS_HTTP_MISMATCH 3887 1.40 2.16 1.02 125 HTML_IMAGE_RATIO_08 3800 2.36 2.12 2.48 126 RCVD_IN_IADB_LISTED 3737 4.44 2.08 5.60 127 SUBJ_ALL_CAPS 3715 1.86 2.07 1.76 128 DATE_IN_PAST_06_12 3662 0.76 2.04 0.13 129 XM_CamelCaseFrm001 3651 2.22 2.03 2.31 130 RCVD_IN_VALIDITY_CERTIFIED 3626 3.16 2.02 3.72 131 XMSexyCombo_01 3510 1.24 1.95 0.89 132 XM_H_Undi_Recip 3503 0.81 1.95 0.24 133 BAYES_40 3466 3.84 1.93 4.79 134 FROM_EXCESS_BASE64 3386 2.41 1.89 2.67 135 DATE_IN_PAST_12_24 3381 0.66 1.88 0.05 136 TR_XM_NoHeaderRelay 3163 0.67 1.76 0.13 137 RCVD_IN_IADB_SPF 3147 3.88 1.75 4.93 138 URI_HEX 3119 1.51 1.74 1.40 139 XMStockSpam_06 3110 1.40 1.73 1.23 140 T_XMHurry_00 3095 0.95 1.72 0.56 141 TR_XM_FormFill 3092 0.58 1.72 0.02 142 RCVD_IN_IADB_DK 2983 3.37 1.66 4.22 143 MAILING_LIST_MULTI 2980 2.21 1.66 2.49 144 RCVD_IN_IADB_SENDERID 2920 3.47 1.63 4.39 145 T_XMDrugObfuBody_00 2900 0.99 1.61 0.68 146 TR_XM_SB_Phish 2852 2.06 1.59 2.30 147 TR_LOTS_OF_MONEY3 2836 0.72 1.58 0.29 148 TR_XM_Undi_Recip11 2821 0.56 1.57 0.06 149 XM_B_COVIDMETA 2814 0.70 1.57 0.27 150 XM_URI_RBL 2814 0.62 1.57 0.16 151 XMSubPhish11 2723 2.03 1.52 2.28 152 FONT_INVIS_LONG_LINE 2657 0.53 1.48 0.06 153 TR_Mismatch_TLD_02 2654 0.54 1.48 0.08 154 XMHTML_After_End 2563 1.02 1.43 0.82 155 KHOP_HELO_FCRDNS 2529 1.38 1.41 1.37 156 BAYES_20 2505 2.82 1.39 3.53 157 XMBrknScrpt_02 2475 1.14 1.38 1.03 158 XMReplyNow 2425 0.63 1.35 0.28 159 ALL_TRUSTED 2407 11.03 1.34 15.82 160 DATE_IN_PAST_24_48 2357 0.44 1.31 0.00 161 XM_BadFromFormat 2336 0.53 1.30 0.15 162 RELAYCOUNTRY_IN 2325 0.50 1.29 0.11 163 XMSubMetaSxObfu_03 2278 0.64 1.27 0.33 164 HTML_TAG_BALANCE_BODY 2210 0.87 1.23 0.69 165 RCVD_IN_PSBL 2204 0.64 1.23 0.35 166 TR_Symld_Words 2194 1.85 1.22 2.16 167 URI_TRY_3LD 2171 0.77 1.21 0.55 168 HTML_SHORT_LINK_IMG_1 2165 0.44 1.21 0.06 169 RELAYCOUNTRY_AU 2134 0.71 1.19 0.47 170 XMGenDplmaNmb 2114 0.89 1.18 0.75 171 XMBdyGiftCard01 2051 0.96 1.14 0.87 172 TR_XM_MSPIKECOMBO2 2043 0.41 1.14 0.05 173 URIBL_BLACK 2034 0.40 1.13 0.04 174 RCVD_IN_VALIDITY_RPBL 2008 0.39 1.12 0.03 175 RCVD_IN_IADB_VOUCHED 1953 2.80 1.09 3.64 176 HK_RANDOM_REPLYTO 1945 0.43 1.08 0.11 177 XM_H_Long_From02 1942 1.07 1.08 1.06 178 BOTNET_NORDNS 1928 0.36 1.07 0.01 179 HDRS_LCASE_IMGONLY 1920 0.41 1.07 0.08 180 XM_Body_Dirty_Words_01 1901 0.71 1.06 0.53 181 TR_XM_Base64_M1 1890 1.06 1.05 1.06 182 TR_XM_COVIDMETA4 1870 0.42 1.04 0.12 183 XM_B_SEO 1861 0.47 1.04 0.19 184 XM_UB99 1845 0.34 1.03 0.00 185 TM2_M_BODY_EMPTY 1826 0.70 1.02 0.54 186 XMPhish30 1806 0.74 1.01 0.61 187 SHOPIFY_IMG_NOT_RCVD_SFY 1797 0.47 1.00 0.20 188 TR_XM_SEO4 1790 0.41 1.00 0.12 189 XMEmptyBody_01 1780 0.40 0.99 0.10 190 TR_XM_COVIDMETA1 1758 0.42 0.98 0.14 191 TR_XM_MaxSPIKE 1694 0.34 0.94 0.05 192 TR_XM_Spammywords 1670 0.52 0.93 0.31 193 XM_S_SpammyWords 1670 0.52 0.93 0.31 194 LOADSA_MONEY_COMBO 1653 0.34 0.92 0.05 195 MPART_ALT_DIFF_COUNT 1634 0.61 0.91 0.46 196 THIS_AD 1626 0.40 0.91 0.15 197 XM_ProductURIs 1626 0.58 0.91 0.42 198 DATE_IN_PAST_03_06 1624 0.50 0.90 0.30 199 RELAYCOUNTRY_FR 1600 0.47 0.89 0.26 200 HTML_IMAGE_ONLY_08 1578 0.41 0.88 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316508 89.79 94.91 87.25 2 RELAYCOUNTRY_US 294115 82.16 84.36 81.08 3 DKIM_SIGNED 276370 80.93 90.52 76.18 4 XM_DK_Pass 269235 79.10 88.97 74.22 5 DKIM_VALID 265221 78.12 88.24 73.11 6 XM_B_Unicode 253407 72.74 78.57 69.85 7 DCC_CHECK_NEGATIVE 232392 52.75 29.91 64.06 8 BAYES_50 209496 52.51 41.94 57.75 9 DKIM_VALID_AU 207028 60.58 67.67 57.07 10 XMListUnsubscribeExists 180056 57.40 73.09 49.63 11 XM_B_SpammyWords 158559 51.16 66.22 43.71 12 XM_B_Unicode3 145109 40.41 41.23 40.00 13 RCVD_IN_MSPIKE_H2 144290 41.77 45.81 39.77 14 DCC_CHECK 130165 47.20 70.06 35.88 15 DKIM_VALID_EF 103950 30.69 34.79 28.65 16 T_TM2_M_HEADER_IN_MSG 103931 25.85 20.20 28.65 17 HTML_FONT_LOW_CONTRAST 97789 30.30 37.04 26.96 18 FVGT_m_MULTI_ODD 93044 28.84 35.30 25.65 19 LOC_TINY_FONT_1 88423 28.66 37.32 24.37 20 XMSubLong 79363 22.03 22.33 21.88 21 MIME_HTML_ONLY 74914 24.33 31.76 20.65 22 T_KAM_HTML_FONT_INVALID 73781 23.42 29.65 20.34 23 RCVD_IN_MSPIKE_WL 65391 16.85 14.48 18.03 24 XM_B_SpammyWords2 65339 24.98 39.06 18.01 25 ALL_TRUSTED 57396 11.03 1.34 15.82 26 USER_IN_DEF_DKIM_WL 46395 9.36 2.44 12.79 27 XM_Body_Dirty_Words 44061 15.10 21.06 12.15 28 RCVD_IN_MSPIKE_H3 43989 12.07 11.95 12.13 29 XM_Multi_Part_URI 43672 13.83 17.44 12.04 30 BAYES_00 38201 7.28 0.70 10.53 31 LotsOfNums_01 32772 8.27 6.72 9.03 32 XM_DKIMWhitelistDomains 32539 6.06 0.19 8.97 33 BAYES_60 32101 8.42 7.54 8.85 34 XM_Evil_Numbers_Gen 31064 8.61 8.71 8.56 35 UNPARSEABLE_RELAY 30729 9.23 10.76 8.47 36 TooManyTo_001 30356 8.05 7.42 8.37 37 XM_B_Unsub 28149 10.22 15.18 7.76 38 XM_DK_Undo_02 25024 18.71 42.56 6.90 39 LOTS_OF_MONEY 24904 9.01 13.33 6.86 40 IN_ZIMBRA_NJ_WHITELIST 24697 4.58 0.08 6.81 41 TR_XM_DK_Bayes 24192 4.63 0.52 6.67 42 TR_XM_DK_Bayes1 23718 4.54 0.52 6.54 43 T_TooManySym_01 23559 5.06 2.17 6.49 44 TR_XM_BayesUnsub 22817 9.14 14.89 6.29 45 TR_XM_DK_Bayes2 21053 4.01 0.40 5.80 46 RCVD_IN_IADB_LISTED 20331 4.44 2.08 5.60 47 XM_H_Long_From01 19938 5.54 5.63 5.50 48 MIME_QP_LONG_LINE 19915 4.75 3.25 5.49 49 XM_PDF 19874 3.88 0.66 5.48 50 BAYES_99 19348 14.69 33.59 5.33 51 FSL_BULK_SIG 19069 6.70 9.62 5.26 52 MPART_ALT_DIFF 18693 6.54 9.33 5.15 53 XMStrtUSub 18599 4.76 4.01 5.13 54 XM_SendGrid 18495 5.19 5.38 5.10 55 HTML_IMAGE_RATIO_02 18351 5.56 6.58 5.06 56 BOTNET_IPINHOSTNAME 18319 7.83 13.45 5.05 57 RCVD_IN_IADB_SPF 17879 3.88 1.75 4.93 58 BAYES_40 17386 3.84 1.93 4.79 59 RCVD_IN_MSPIKE_H4 16833 3.84 2.21 4.64 60 TR_XM_DKIM_Undo 16459 13.52 31.66 4.54 61 RCVD_IN_IADB_SENDERID 15915 3.47 1.63 4.39 62 BAYES_80 15747 5.49 7.82 4.34 63 RELAYCOUNTRY_META 15693 8.59 17.20 4.33 64 BAYES_999 15511 11.80 26.99 4.28 65 RCVD_IN_IADB_DK 15297 3.37 1.66 4.22 66 HTML_IMAGE_RATIO_06 15296 3.87 3.16 4.22 67 RCVD_IN_VALIDITY_SAFE 15227 3.69 2.68 4.20 68 T_REMOTE_IMAGE 15100 3.70 2.77 4.16 69 XMNumbers 14844 4.24 4.53 4.09 70 HTML_IMAGE_RATIO_04 14525 4.15 4.44 4.00 71 TR_XM_SpammyWords4 14509 6.56 11.72 4.00 72 T_TooManySym_02 14442 2.90 0.70 3.98 73 XM_B_SpammyWords3 14281 6.91 12.91 3.94 74 XM_UncommonTLD01 13947 6.75 12.61 3.84 75 RCVD_IN_VALIDITY_CERTIFIED 13498 3.16 2.02 3.72 76 RCVD_IN_IADB_VOUCHED 13219 2.80 1.09 3.64 77 BAYES_20 12817 2.82 1.39 3.53 78 XMSubMetaSx_00 12757 4.58 6.74 3.52 79 MIME_HTML_ONLY_MULTI 12253 4.42 6.53 3.38 80 TR_XM_DK_SendGrid 12111 3.40 3.51 3.34 81 TR_XM_PhishingBody 11898 4.46 6.83 3.28 82 XMSexyCombo_05 11305 5.41 10.03 3.12 83 DKIM_INVALID 11149 2.81 2.29 3.07 84 XM_B_Phish_Phrases 10867 3.86 5.61 3.00 85 BAYES_95 10008 3.30 4.40 2.76 86 URI_NOVOWEL 9975 2.73 2.70 2.75 87 FROM_EXCESS_BASE64 9681 2.41 1.89 2.67 88 HTML_MIME_NO_HTML_TAG 9349 3.31 4.78 2.58 89 MAILING_LIST_MULTI 9028 2.21 1.66 2.49 90 MIME_HTML_MOSTLY 8989 2.92 3.82 2.48 91 HTML_IMAGE_RATIO_08 8979 2.36 2.12 2.48 92 RCVD_IN_IADB_OPTIN 8858 1.82 0.58 2.44 93 XM_SPF_SoftFail 8771 3.21 4.80 2.42 94 XM_B_SpammyTLD 8745 4.61 9.05 2.41 95 TooManyTo_002 8433 1.75 0.59 2.32 96 XM_CamelCaseFrm001 8396 2.22 2.03 2.31 97 TR_XM_SB_Phish 8345 2.06 1.59 2.30 98 XMSubPhish11 8269 2.03 1.52 2.28 99 TR_Symld_Words 7840 1.85 1.22 2.16 100 BAYES_05 7664 1.64 0.68 2.11 101 TR_XM_SpammyRelay 7457 5.15 11.40 2.06 102 ANY_BOUNCE_MESSAGE 7266 1.56 0.68 2.00 103 BOUNCE_MESSAGE 7265 1.56 0.68 2.00 104 TR_DCC_Bayes_99 7182 9.59 24.95 1.98 105 XM_B_Phish66 7046 2.80 4.53 1.94 106 INVALID_MSGID 6941 1.32 0.13 1.91 107 HELO_NODOT 6905 1.41 0.41 1.90 108 HELO_NO_DOMAIN 6903 1.41 0.40 1.90 109 T_XMDrugObfuBody_14 6842 2.54 3.87 1.89 110 XM_GoogleGroups 6692 2.52 3.90 1.84 111 TM2_M_URI_OPT_OUT 6667 2.13 2.73 1.84 112 IN_HORDE_ADDRESS_BOOK 6604 1.25 0.09 1.82 113 MSGID_NOFQDN1 6417 1.19 0.02 1.77 114 SUBJ_ALL_CAPS 6374 1.86 2.07 1.76 115 XMDiploma_00 6307 2.07 2.73 1.74 116 XM_H_Trusted_IP 6243 1.15 0.00 1.72 117 TVD_RCVD_IP 6065 1.22 0.31 1.67 118 T_TooManySym_03 6032 1.19 0.22 1.66 119 TM2_M_VERY_LONG_WORD 6021 3.01 5.75 1.66 120 XM_B_Investor 5896 2.94 5.60 1.63 121 TVD_SPACE_RATIO 5880 1.12 0.12 1.62 122 TO_MALFORMED 5864 1.09 0.01 1.62 123 BOTNET 5789 3.75 8.11 1.60 124 XM_B_Unsub2 5730 2.01 2.88 1.58 125 TooManyTo_003 5611 1.18 0.44 1.55 126 XM_DK_Undo_01 5518 1.90 2.66 1.52 127 TR_XM_UnparsRelay 5348 3.07 6.28 1.47 128 T_XMDrugObfuBody_08 5244 1.99 3.08 1.45 129 URI_HEX 5081 1.51 1.74 1.40 130 KHOP_HELO_FCRDNS 4957 1.38 1.41 1.37 131 RELAYCOUNTRY_CA 4899 3.27 7.15 1.35 132 TR_XM_SpammyWords5 4721 2.09 3.67 1.30 133 UNTRUSTED_Relay 4704 3.08 6.69 1.30 134 RCVD_IN_MSPIKE_H5 4569 0.95 0.31 1.26 135 XMStockSpam_06 4478 1.40 1.73 1.23 136 XMCapTrack 4456 0.95 0.39 1.23 137 XMGappySubj_01 4269 0.84 0.15 1.18 138 XMLngstWrd_00 4217 2.07 3.90 1.16 139 XMBSHREFv2 4087 0.85 0.31 1.13 140 TooManyTo_004 4017 0.87 0.38 1.11 141 XMLngstWrd_01 3970 2.01 3.86 1.09 142 XM_H_Long_From02 3859 1.07 1.08 1.06 143 T_OBFU_PDF_ATTACH 3854 0.74 0.10 1.06 144 TR_XM_Base64_M1 3854 1.06 1.05 1.06 145 XMBrknScrpt_02 3722 1.14 1.38 1.03 146 HTTPS_HTTP_MISMATCH 3715 1.40 2.16 1.02 147 XMLngstWrd_02 3655 1.92 3.78 1.01 148 T_FILL_THIS_FORM_SHORT 3654 1.58 2.75 1.01 149 XM_OfRef6 3622 1.84 3.54 1.00 150 DKIM_ADSP_CUSTOM_MED 3427 0.86 0.70 0.94 151 XMLngstWrd_03 3380 1.80 3.54 0.93 152 TR_XM_SpammyWords2 3365 4.26 11.00 0.93 153 HTML_FONT_FACE_BAD 3356 0.80 0.56 0.93 154 TooManyTo_005 3251 0.71 0.32 0.90 155 XMSexyCombo_01 3224 1.24 1.95 0.89 156 XMBdyGiftCard01 3158 0.96 1.14 0.87 157 XMLngstWrd_04 3117 1.70 3.41 0.86 158 XMBody_95 3034 0.60 0.13 0.84 159 XM_UB50 3030 1.74 3.56 0.84 160 SpammyFromTLD_01 3013 1.56 3.03 0.83 161 XMSubNoVowel 3002 0.69 0.41 0.83 162 XMHTML_After_End 2981 1.02 1.43 0.82 163 FVGT_m_MULTI_ODD_EMAIL 2935 0.58 0.12 0.81 164 RCVD_IN_RP_SAFE 2850 0.73 0.62 0.79 165 XMGenDplmaNmb 2724 0.89 1.18 0.75 166 UPPERCASE_75_100 2720 1.61 3.36 0.75 167 HTML_TITLE_SUBJ_DIFF 2716 1.65 3.47 0.75 168 XM_B_SpammyWords4 2575 1.33 2.57 0.71 169 HTML_TAG_BALANCE_BODY 2521 0.87 1.23 0.69 170 FROM_GOV_DKIM_AU 2503 0.53 0.19 0.69 171 XM_ShortIntro_01 2496 0.58 0.37 0.69 172 T_XMDrugObfuBody_00 2471 0.99 1.61 0.68 173 RCVD_IN_RP_CERTIFIED 2463 0.62 0.51 0.68 174 TR_MetaPhish_Combo_01 2405 0.63 0.55 0.66 175 XMNoVowels 2364 0.56 0.38 0.65 176 XMPhish30 2208 0.74 1.01 0.61 177 BODY_ENHANCEMENT2 2118 0.40 0.02 0.58 178 XM_H_PHPMailer 2090 0.59 0.63 0.58 179 NML_ADSP_CUSTOM_MED 2089 0.58 0.58 0.58 180 XMBody_17 2086 1.35 2.92 0.58 181 SHORT_HELO_AND_INLINE_IMAGE 2037 0.40 0.07 0.56 182 T_XMHurry_00 2036 0.95 1.72 0.56 183 URI_TRY_3LD 2010 0.77 1.21 0.55 184 XMMoneyMeta_00 2009 0.57 0.61 0.55 185 XMHTMLBadTable_001 1976 0.58 0.65 0.54 186 T_Symld_Words_02 1973 0.59 0.69 0.54 187 TM2_M_BODY_EMPTY 1966 0.70 1.02 0.54 188 XM_B_COPY_HTML 1958 0.57 0.62 0.54 189 FORGED_GMAIL_RCVD 1943 0.55 0.58 0.54 190 HTML_IMAGE_ONLY_28 1942 0.48 0.38 0.54 191 XM_Body_Dirty_Words_01 1939 0.71 1.06 0.53 192 XM_RXBody 1923 0.54 0.56 0.53 193 XMSexyCombo_04 1897 0.59 0.74 0.52 194 XMSubMetaI_00 1892 0.60 0.74 0.52 195 HTML_IMAGE_ONLY_20 1888 0.47 0.36 0.52 196 RCVD_IN_BL_SPAMCOP_NET 1886 2.64 6.92 0.52 197 XMDateMe_00 1796 0.44 0.33 0.50 198 XMSexyCombo_02 1780 0.48 0.47 0.49 199 RCVD_IN_MSPIKE_BL 1762 2.21 5.69 0.49 200 RELAYCOUNTRY_GB 1762 0.53 0.62 0.49 ----------------------------------------------------------------------