Email: 649254 Autolearn: 0 AvgScore: 2.52 AvgScanTime: 2.24 sec Spam: 156224 Autolearn: 0 AvgScore: 12.64 AvgScanTime: 3.80 sec Ham: 493030 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 1.75 sec Time Spent Running SA: 404.34 hours Time Spent Processing Spam: 164.98 hours Time Spent Processing Ham: 239.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150665 90.35 96.44 88.43 2 DKIM_SIGNED 128206 76.40 82.07 74.60 3 DCC_CHECK 125507 49.82 80.34 40.15 4 RELAYCOUNTRY_US 125316 81.13 80.22 81.42 5 XM_DK_Pass 124940 75.03 79.97 73.46 6 XM_B_Unicode 118398 72.07 75.79 70.90 7 XMListUnsubscribeExists 110505 54.86 70.73 49.83 8 DKIM_VALID 106436 68.65 68.13 68.82 9 DKIM_VALID_AU 80653 51.05 51.63 50.87 10 XM_DK_Undo_02 70637 16.84 45.22 7.85 11 XM_B_Unicode3 65661 39.99 42.03 39.34 12 BAYES_50 63578 51.29 40.70 54.64 13 MIME_HTML_ONLY 62715 25.01 40.14 20.21 14 LOC_TINY_FONT_1 53173 25.34 34.04 22.58 15 BAYES_99 49276 10.76 31.54 4.18 16 HTML_FONT_LOW_CONTRAST 47656 27.92 30.50 27.10 17 DKIM_VALID_EF 42841 26.36 27.42 26.03 18 TR_DCC_Bayes_99 40160 7.68 25.71 1.96 19 BAYES_999 39144 8.48 25.06 3.23 20 T_KAM_HTML_FONT_INVALID 38618 19.55 24.72 17.91 21 FVGT_m_MULTI_ODD 38278 22.08 24.50 21.31 22 XMSubLong 36099 21.18 23.11 20.58 23 RELAYCOUNTRY_META 34857 9.98 22.31 6.07 24 BOTNET 33323 7.53 21.33 3.16 25 T_TM2_M_HEADER_IN_MSG 31019 27.71 19.86 30.20 26 XM_Body_Dirty_Words 28702 13.54 18.37 12.01 27 DCC_CHECK_NEGATIVE 27814 48.13 17.80 57.74 28 XM_Multi_Part_URI 25857 12.11 16.55 10.70 29 LOTS_OF_MONEY 24761 10.17 15.85 8.37 30 XM_B_Unsub 24142 11.56 15.45 10.32 31 FSL_BULK_SIG 22699 9.26 14.53 7.59 32 DKIM_INVALID 21770 7.74 13.94 5.78 33 XM_UncommonTLD01 21263 6.04 13.61 3.64 34 BOTNET_IPINHOSTNAME 21189 7.02 13.56 4.95 35 XM_B_Phish_Phrases 19418 8.25 12.43 6.93 36 UNTRUSTED_Relay 19382 4.36 12.41 1.82 37 HTML_IMAGE_RATIO_02 19275 8.27 12.34 6.98 38 XMSexyCombo_05 17289 5.17 11.07 3.30 39 NO_DNS_FOR_FROM 16426 4.92 10.51 3.14 40 XM_Evil_Numbers_Gen 16374 8.47 10.48 7.83 41 LotsOfNums_01 14787 9.05 9.47 8.92 42 BAYES_80 12700 4.60 8.13 3.48 43 XM_CamelCaseFrm001 12337 3.45 7.90 2.05 44 RCVD_IN_MSPIKE_H2 11805 12.55 7.56 14.13 45 XMSubMetaSx_00 11179 4.37 7.16 3.48 46 XM_B_COVIDMETA 10761 3.35 6.89 2.22 47 BAYES_60 10543 6.31 6.75 6.17 48 KHOP_HELO_FCRDNS 10495 3.08 6.72 1.93 49 XM_UB50 10370 2.46 6.64 1.13 50 RELAYCOUNTRY_CA 9501 2.78 6.08 1.73 51 MPART_ALT_DIFF 9291 5.10 5.95 4.83 52 URIBL_SBL_A 9260 1.56 5.93 0.17 53 XM_H_Long_From01 9229 5.62 5.91 5.52 54 TR_XM_COVIDMETA4 8724 2.32 5.58 1.29 55 HTML_IMAGE_RATIO_04 8528 5.46 5.46 5.45 56 TooManyTo_001 8521 7.96 5.45 8.75 57 RCVD_IN_BL_SPAMCOP_NET 7975 1.84 5.10 0.81 58 UNPARSEABLE_RELAY 7962 6.67 5.10 7.17 59 TR_XM_MaxBayes 7734 1.21 4.95 0.03 60 XMNumbers 7530 3.58 4.82 3.19 61 T_XMDrugObfuBody_08 7424 2.31 4.75 1.53 62 MIME_QP_LONG_LINE 7296 5.69 4.67 6.01 63 TR_LOTS_OF_MONEY3 7060 1.84 4.52 1.00 64 BAYES_95 6941 2.67 4.44 2.11 65 RCVD_IN_MSPIKE_BL 6910 2.24 4.42 1.55 66 XM_SendGrid 6534 5.90 4.18 6.44 67 PDS_OTHER_BAD_TLD 6488 1.11 4.15 0.15 68 RDNS_DYNAMIC 6464 1.29 4.14 0.39 69 HTML_MIME_NO_HTML_TAG 6434 2.67 4.12 2.21 70 DATE_IN_PAST_03_06 6277 1.05 4.02 0.11 71 HTML_IMAGE_RATIO_06 6160 4.09 3.94 4.13 72 SpammyFromTLD_02 6039 1.13 3.87 0.26 73 XM_DIRTYINTL 6013 1.35 3.85 0.56 74 MIME_HTML_MOSTLY 5859 2.83 3.75 2.54 75 XM_SPF_SoftFail 5803 2.11 3.71 1.60 76 XMStrtUSub 5673 4.01 3.63 4.13 77 TR_XM_PhishingBody 5530 1.81 3.54 1.27 78 RCVD_IN_MSPIKE_WL 5274 9.53 3.38 11.48 79 XMBody_17 5201 1.31 3.33 0.67 80 XM_B_SpammyTLD 5173 1.94 3.31 1.50 81 DKIM_ADSP_NXDOMAIN 5065 1.03 3.24 0.33 82 RELAYCOUNTRY_FR 4978 0.97 3.19 0.27 83 TM2_M_URI_OPT_OUT 4974 3.27 3.18 3.30 84 FROM_EXCESS_BASE64 4916 2.72 3.15 2.59 85 XM_B_Phish66 4827 2.41 3.09 2.20 86 XMHTML_After_End 4744 1.34 3.04 0.80 87 T_TooManySym_01 4617 4.30 2.96 4.73 88 BAYES_40 4595 4.66 2.94 5.20 89 RCVD_IN_MSPIKE_H3 4543 7.90 2.91 9.48 90 TR_XM_INV_DKIM 4468 0.77 2.86 0.11 91 BOTNET_NORDNS 4299 0.68 2.75 0.02 92 URI_HEX 4229 1.56 2.71 1.19 93 XM_URI_RBL 4158 0.77 2.66 0.17 94 MIME_HTML_ONLY_MULTI 4072 2.80 2.61 2.85 95 XM_OfRef6 4054 1.63 2.59 1.32 96 T_REMOTE_IMAGE 3963 3.42 2.54 3.70 97 XM_B_Unsub2 3896 2.31 2.49 2.26 98 SpammyFromTLD_01 3823 1.18 2.45 0.78 99 BAYES_20 3823 3.70 2.45 4.09 100 RCVD_IN_MSPIKE_L3 3781 0.88 2.42 0.40 101 HTML_IMAGE_RATIO_08 3759 2.38 2.41 2.37 102 FROM_SUSPICIOUS_NTLD 3591 0.58 2.30 0.03 103 URI_TRY_3LD 3584 1.42 2.29 1.14 104 FROM_SUSPICIOUS_NTLD_FP 3542 0.57 2.27 0.03 105 RCVD_IN_IADB_LISTED 3503 4.53 2.24 5.26 106 T_XMHurry_00 3438 0.84 2.20 0.41 107 DATE_IN_PAST_06_12 3284 0.53 2.10 0.04 108 T_FILL_THIS_FORM_SHORT 3249 1.17 2.08 0.89 109 T_XMDrugObfuBody_14 3192 1.91 2.04 1.87 110 TR_XM_PHPDW 3155 1.31 2.02 1.08 111 RCVD_IN_RP_SAFE 3154 6.45 2.02 7.85 112 TR_XM_PHPForged 3106 1.29 1.99 1.06 113 RCVD_IN_IADB_SPF 3099 4.00 1.98 4.64 114 SUBJ_ALL_CAPS 3094 1.60 1.98 1.48 115 TR_XM_FormFill2 3089 1.28 1.98 1.06 116 XM_H_PHPOS 3084 1.28 1.97 1.06 117 BODY_URI_ONLY 3025 0.51 1.94 0.06 118 RCVD_IN_IADB_DK 2971 3.53 1.90 4.04 119 LongTLD 2963 0.59 1.90 0.18 120 RCVD_IN_IADB_SENDERID 2947 3.57 1.89 4.10 121 TO_MALFORMED 2925 1.56 1.87 1.46 122 BAYES_00 2912 13.64 1.86 17.38 123 XMDiploma_00 2892 1.77 1.85 1.74 124 XM_Palau_URI 2874 0.44 1.84 0.00 125 XMSexyCombo_01 2785 0.74 1.78 0.41 126 RELAYCOUNTRY_GB 2735 1.37 1.75 1.26 127 RELAYCOUNTRY_DE 2712 0.87 1.74 0.60 128 HTML_IMAGE_ONLY_08 2710 0.51 1.73 0.12 129 XMPhish08 2703 0.83 1.73 0.55 130 HTML_SHORT_LINK_IMG_1 2691 0.43 1.72 0.02 131 T_XMDrugObfuBody_00 2687 0.84 1.72 0.56 132 RCVD_IN_MSPIKE_L5 2667 1.03 1.71 0.81 133 TR_XM_DK_SendGrid 2650 3.02 1.70 3.43 134 TM2_M_VERY_LONG_WORD 2608 1.19 1.67 1.04 135 XMBody_78 2581 0.70 1.65 0.39 136 TR_XM_RelayPhish 2493 0.50 1.60 0.15 137 DATE_IN_PAST_12_24 2483 0.40 1.59 0.02 138 URI_NOVOWEL 2453 0.69 1.57 0.41 139 RELAYCOUNTRY_IN 2445 0.46 1.57 0.11 140 RCVD_IN_RP_RNBL 2438 0.40 1.56 0.03 141 TR_Symld_Words 2397 1.42 1.53 1.38 142 XMBdyGiftCard01 2359 1.12 1.51 1.00 143 XMStockSpam_06 2306 0.97 1.48 0.81 144 XMSubMetaSSx_00 2233 0.42 1.43 0.10 145 MPART_ALT_DIFF_COUNT 2212 0.65 1.42 0.41 146 MAILING_LIST_MULTI 2199 2.58 1.41 2.95 147 XM_UB60 2185 0.42 1.40 0.10 148 TO_NO_BRKTS_HTML_ONLY 2178 1.14 1.39 1.06 149 TR_XM_COVIDMETA1 2108 0.39 1.35 0.09 150 XMSubMetaI_00 2043 0.71 1.31 0.52 151 RCVD_IN_RP_CERTIFIED 2020 5.85 1.29 7.30 152 XMGenDplmaNmb 1999 0.99 1.28 0.89 153 RCVD_IN_PSBL 1995 0.36 1.28 0.07 154 XMMoneyMeta_00 1982 0.76 1.27 0.60 155 TR_XM_DK_Bayes 1971 9.20 1.26 11.72 156 XM_ProductURIs 1914 0.99 1.23 0.91 157 HK_RANDOM_FROM 1885 0.40 1.21 0.15 158 XM_H_MailChimp 1884 0.43 1.21 0.18 159 XM_UB80 1872 0.31 1.20 0.03 160 BAYES_05 1854 2.38 1.19 2.75 161 ALL_TRUSTED 1847 11.44 1.18 14.70 162 HDRS_MISSP 1845 0.34 1.18 0.08 163 HTML_FONT_FACE_BAD 1820 0.95 1.16 0.89 164 TR_MetaPhish_Combo_01 1806 1.17 1.16 1.18 165 XM_UB99 1762 0.27 1.13 0.00 166 MIME_HEADER_CTYPE_ONLY 1752 0.44 1.12 0.22 167 HDRS_LCASE_IMGONLY 1730 0.27 1.11 0.01 168 XM_DK_Undo_01 1659 1.74 1.06 1.95 169 XMPhish30 1630 0.51 1.04 0.35 170 TR_Mismatch_TLD_02 1628 0.31 1.04 0.07 171 HTML_FONT_SIZE_HUGE 1583 0.36 1.01 0.16 172 SCRIPT_GIBBERISH 1572 0.24 1.01 0.00 173 XM_H_PHPMailer 1544 0.64 0.99 0.53 174 XMPhish14 1466 0.49 0.94 0.35 175 T_TooManySym_02 1461 1.88 0.94 2.18 176 RCVD_IN_IADB_VOUCHED 1461 2.64 0.94 3.18 177 XM_H_Long_From02 1450 1.24 0.93 1.34 178 T_MONEY_PERCENT 1388 0.38 0.89 0.22 179 TR_LOTS_OF_MONEY2 1388 0.38 0.89 0.22 180 RELAYCOUNTRY_AU 1360 0.53 0.87 0.42 181 REMOVE_BEFORE_LINK 1357 0.43 0.87 0.29 182 XMBrknScrpt_02 1305 0.84 0.84 0.84 183 XM_H_PHPOS_M 1301 0.33 0.83 0.17 184 DEAR_FRIEND 1276 0.25 0.82 0.07 185 XM_PDF 1270 3.46 0.81 4.30 186 XMSlimDrugH 1259 0.46 0.81 0.34 187 NORDNS_LOW_CONTRAST 1256 0.54 0.80 0.45 188 XM_JunkDunk 1219 0.19 0.78 0.00 189 DKIM_ADSP_CUSTOM_MED 1218 1.25 0.78 1.39 190 HTTPS_HTTP_MISMATCH 1216 0.87 0.78 0.90 191 TR_XM_COVIDMETA3 1212 0.21 0.78 0.03 192 XM_B_COPY_HTML 1173 0.43 0.75 0.33 193 TR_XM_DK_Bayes1 1172 8.44 0.75 10.88 194 MISSING_HEADERS 1161 0.57 0.74 0.51 195 XMSubMetaSxObfu_03 1161 0.47 0.74 0.38 196 XM_UB95 1132 0.18 0.72 0.01 197 XM_UB999 1124 0.18 0.72 0.00 198 URIBL_BLACK 1095 0.18 0.70 0.01 199 DIET_1 1076 0.38 0.69 0.28 200 RELAYCOUNTRY_NL 1059 0.52 0.68 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435965 90.35 96.44 88.43 2 RELAYCOUNTRY_US 401418 81.13 80.22 81.42 3 DKIM_SIGNED 367800 76.40 82.07 74.60 4 XM_DK_Pass 362174 75.03 79.97 73.46 5 XM_B_Unicode 349540 72.07 75.79 70.90 6 DKIM_VALID 339295 68.65 68.13 68.82 7 DCC_CHECK_NEGATIVE 284676 48.13 17.80 57.74 8 BAYES_50 269398 51.29 40.70 54.64 9 DKIM_VALID_AU 250790 51.05 51.63 50.87 10 XMListUnsubscribeExists 245663 54.86 70.73 49.83 11 DCC_CHECK 197957 49.82 80.34 40.15 12 XM_B_Unicode3 193976 39.99 42.03 39.34 13 T_TM2_M_HEADER_IN_MSG 148878 27.71 19.86 30.20 14 HTML_FONT_LOW_CONTRAST 133598 27.92 30.50 27.10 15 DKIM_VALID_EF 128313 26.36 27.42 26.03 16 LOC_TINY_FONT_1 111331 25.34 34.04 22.58 17 FVGT_m_MULTI_ODD 105073 22.08 24.50 21.31 18 XMSubLong 101442 21.18 23.11 20.58 19 MIME_HTML_ONLY 99641 25.01 40.14 20.21 20 T_KAM_HTML_FONT_INVALID 88314 19.55 24.72 17.91 21 BAYES_00 85670 13.64 1.86 17.38 22 ALL_TRUSTED 72455 11.44 1.18 14.70 23 RCVD_IN_MSPIKE_H2 69688 12.55 7.56 14.13 24 XM_Body_Dirty_Words 59216 13.54 18.37 12.01 25 TR_XM_DK_Bayes 57782 9.20 1.26 11.72 26 RCVD_IN_MSPIKE_WL 56614 9.53 3.38 11.48 27 TR_XM_DK_Bayes1 53649 8.44 0.75 10.88 28 XM_Multi_Part_URI 52761 12.11 16.55 10.70 29 XM_B_Unsub 50902 11.56 15.45 10.32 30 TR_XM_DK_Bayes2 47616 7.49 0.63 9.66 31 RCVD_IN_MSPIKE_H3 46717 7.90 2.91 9.48 32 LotsOfNums_01 43982 9.05 9.47 8.92 33 TooManyTo_001 43159 7.96 5.45 8.75 34 LOTS_OF_MONEY 41289 10.17 15.85 8.37 35 RCVD_IN_RP_SAFE 38693 6.45 2.02 7.85 36 XM_DK_Undo_02 38689 16.84 45.22 7.85 37 XM_Evil_Numbers_Gen 38616 8.47 10.48 7.83 38 FSL_BULK_SIG 37399 9.26 14.53 7.59 39 RCVD_IN_RP_CERTIFIED 35972 5.85 1.29 7.30 40 UNPARSEABLE_RELAY 35337 6.67 5.10 7.17 41 HTML_IMAGE_RATIO_02 34398 8.27 12.34 6.98 42 XM_DKIMWhitelistDomains 34275 5.28 0.01 6.95 43 XM_B_Phish_Phrases 34173 8.25 12.43 6.93 44 XM_SendGrid 31764 5.90 4.18 6.44 45 BAYES_60 30424 6.31 6.75 6.17 46 RELAYCOUNTRY_META 29941 9.98 22.31 6.07 47 MIME_QP_LONG_LINE 29640 5.69 4.67 6.01 48 DKIM_INVALID 28505 7.74 13.94 5.78 49 XM_H_Long_From01 27234 5.62 5.91 5.52 50 HTML_IMAGE_RATIO_04 26890 5.46 5.46 5.45 51 RCVD_IN_IADB_LISTED 25926 4.53 2.24 5.26 52 BAYES_40 25637 4.66 2.94 5.20 53 BOTNET_IPINHOSTNAME 24400 7.02 13.56 4.95 54 MPART_ALT_DIFF 23795 5.10 5.95 4.83 55 T_TooManySym_01 23330 4.30 2.96 4.73 56 RCVD_IN_IADB_SPF 22883 4.00 1.98 4.64 57 XM_PDF 21193 3.46 0.81 4.30 58 BAYES_99 20606 10.76 31.54 4.18 59 HTML_IMAGE_RATIO_06 20382 4.09 3.94 4.13 60 XMStrtUSub 20376 4.01 3.63 4.13 61 RCVD_IN_IADB_SENDERID 20203 3.57 1.89 4.10 62 BAYES_20 20167 3.70 2.45 4.09 63 RCVD_IN_IADB_DK 19920 3.53 1.90 4.04 64 T_REMOTE_IMAGE 18248 3.42 2.54 3.70 65 XM_UncommonTLD01 17930 6.04 13.61 3.64 66 XMSubMetaSx_00 17179 4.37 7.16 3.48 67 BAYES_80 17148 4.60 8.13 3.48 68 IN_ZIMBRA_NJ_WHITELIST 17045 2.63 0.02 3.46 69 TR_XM_DK_SendGrid 16931 3.02 1.70 3.43 70 XMSexyCombo_05 16274 5.17 11.07 3.30 71 TM2_M_URI_OPT_OUT 16269 3.27 3.18 3.30 72 BAYES_999 15940 8.48 25.06 3.23 73 XMNumbers 15712 3.58 4.82 3.19 74 RCVD_IN_IADB_VOUCHED 15662 2.64 0.94 3.18 75 BOTNET 15585 7.53 21.33 3.16 76 NO_DNS_FOR_FROM 15500 4.92 10.51 3.14 77 XM_H_Trusted_IP 14744 2.27 0.00 2.99 78 MAILING_LIST_MULTI 14552 2.58 1.41 2.95 79 ANY_BOUNCE_MESSAGE 14178 2.28 0.41 2.88 80 BOUNCE_MESSAGE 14175 2.28 0.41 2.88 81 MIME_HTML_ONLY_MULTI 14075 2.80 2.61 2.85 82 BAYES_05 13566 2.38 1.19 2.75 83 FROM_EXCESS_BASE64 12756 2.72 3.15 2.59 84 MIME_HTML_MOSTLY 12510 2.83 3.75 2.54 85 HTML_IMAGE_RATIO_08 11702 2.38 2.41 2.37 86 TooManyTo_002 11630 1.92 0.55 2.36 87 XM_B_Unsub2 11124 2.31 2.49 2.26 88 XM_B_COVIDMETA 10963 3.35 6.89 2.22 89 HTML_MIME_NO_HTML_TAG 10909 2.67 4.12 2.21 90 XM_B_Phish66 10825 2.41 3.09 2.20 91 T_TooManySym_02 10743 1.88 0.94 2.18 92 BAYES_95 10411 2.67 4.44 2.11 93 XM_CamelCaseFrm001 10083 3.45 7.90 2.05 94 RCVD_IN_MSPIKE_H4 9905 1.64 0.47 2.01 95 RCVD_IN_IADB_OPTIN 9773 1.65 0.59 1.98 96 TR_DCC_Bayes_99 9688 7.68 25.71 1.96 97 XM_DK_Undo_01 9635 1.74 1.06 1.95 98 KHOP_HELO_FCRDNS 9533 3.08 6.72 1.93 99 TVD_RCVD_IP 9446 1.52 0.25 1.92 100 T_XMDrugObfuBody_14 9211 1.91 2.04 1.87 101 UNTRUSTED_Relay 8957 4.36 12.41 1.82 102 XMDiploma_00 8580 1.77 1.85 1.74 103 RELAYCOUNTRY_CA 8546 2.78 6.08 1.73 104 HELO_NODOT 8241 1.40 0.54 1.67 105 HELO_NO_DOMAIN 8238 1.40 0.54 1.67 106 TooManyTo_003 7984 1.33 0.42 1.62 107 XM_SPF_SoftFail 7882 2.11 3.71 1.60 108 IN_HORDE_ADDRESS_BOOK 7708 1.20 0.04 1.56 109 RCVD_IN_MSPIKE_BL 7663 2.24 4.42 1.55 110 T_XMDrugObfuBody_08 7562 2.31 4.75 1.53 111 INVALID_MSGID 7552 1.22 0.25 1.53 112 XM_B_SpammyTLD 7395 1.94 3.31 1.50 113 SUBJ_ALL_CAPS 7287 1.60 1.98 1.48 114 HELO_MISC_IP 7241 1.14 0.10 1.47 115 CK_HELO_DYNAMIC_SPLIT_IP 7224 1.14 0.09 1.47 116 TO_MALFORMED 7191 1.56 1.87 1.46 117 XM_GoogleGroups 7020 1.19 0.46 1.42 118 DKIM_ADSP_CUSTOM_MED 6873 1.25 0.78 1.39 119 TR_Symld_Words 6818 1.42 1.53 1.38 120 XM_H_Long_From02 6618 1.24 0.93 1.34 121 XMSubNoVowel 6575 1.17 0.63 1.33 122 XM_OfRef6 6516 1.63 2.59 1.32 123 XMCapTrack 6507 1.14 0.58 1.32 124 TR_XM_COVIDMETA4 6353 2.32 5.58 1.29 125 TR_XM_PhishingBody 6249 1.81 3.54 1.27 126 RELAYCOUNTRY_GB 6190 1.37 1.75 1.26 127 TooManyTo_004 6034 1.01 0.35 1.22 128 URI_HEX 5868 1.56 2.71 1.19 129 TR_MetaPhish_Combo_01 5815 1.17 1.16 1.18 130 URI_TRY_3LD 5642 1.42 2.29 1.14 131 XM_UB50 5587 2.46 6.64 1.13 132 USER_IN_DEF_DKIM_WL 5498 0.85 0.01 1.12 133 TR_XM_PHPDW 5321 1.31 2.02 1.08 134 XMGappySubj_01 5270 0.85 0.16 1.07 135 TR_XM_PHPForged 5249 1.29 1.99 1.06 136 TR_XM_FormFill2 5242 1.28 1.98 1.06 137 XM_H_PHPOS 5212 1.28 1.97 1.06 138 TO_NO_BRKTS_HTML_ONLY 5206 1.14 1.39 1.06 139 TM2_M_VERY_LONG_WORD 5122 1.19 1.67 1.04 140 TooManyTo_005 5026 0.84 0.29 1.02 141 NML_ADSP_CUSTOM_MED 4963 0.90 0.54 1.01 142 XMBdyGiftCard01 4933 1.12 1.51 1.00 143 TR_LOTS_OF_MONEY3 4906 1.84 4.52 1.00 144 FROM_GOV_DKIM_AU 4598 0.72 0.06 0.93 145 XM_ProductURIs 4491 0.99 1.23 0.91 146 HTTPS_HTTP_MISMATCH 4428 0.87 0.78 0.90 147 XMGenDplmaNmb 4405 0.99 1.28 0.89 148 HTML_FONT_FACE_BAD 4372 0.95 1.16 0.89 149 T_FILL_THIS_FORM_SHORT 4367 1.17 2.08 0.89 150 XMBrknScrpt_02 4146 0.84 0.84 0.84 151 RCVD_IN_MSPIKE_L5 4005 1.03 1.71 0.81 152 XMStockSpam_06 3984 0.97 1.48 0.81 153 RCVD_IN_BL_SPAMCOP_NET 3970 1.84 5.10 0.81 154 XMHTML_After_End 3959 1.34 3.04 0.80 155 TR_MSPIKEBAYES00 3846 0.59 0.01 0.78 156 SpammyFromTLD_01 3844 1.18 2.45 0.78 157 XMNoVowels 3527 0.64 0.41 0.72 158 T_TooManySym_03 3445 0.61 0.31 0.70 159 XMBody_17 3283 1.31 3.33 0.67 160 XM_ShortIntro_01 3137 0.60 0.48 0.64 161 XMMoneyMeta_00 2971 0.76 1.27 0.60 162 RELAYCOUNTRY_DE 2958 0.87 1.74 0.60 163 FORGED_GMAIL_RCVD 2954 0.61 0.63 0.60 164 XM_SPF_Unknown 2924 0.59 0.58 0.59 165 TR_XM_COVIDMETA5 2838 0.44 0.01 0.58 166 T_XMDrugObfuBody_00 2774 0.84 1.72 0.56 167 XM_DIRTYINTL 2760 1.35 3.85 0.56 168 XMPhish08 2716 0.83 1.73 0.55 169 T_OBFU_PDF_ATTACH 2649 0.44 0.13 0.54 170 HTML_IMAGE_ONLY_20 2645 0.49 0.33 0.54 171 RCVD_IN_SORBS_DUL 2635 0.43 0.10 0.53 172 XM_H_PHPMailer 2610 0.64 0.99 0.53 173 XMSubMetaI_00 2573 0.71 1.31 0.52 174 MISSING_HEADERS 2523 0.57 0.74 0.51 175 T_Symld_Words_02 2484 0.51 0.54 0.50 176 TM2_M_BODY_EMPTY 2319 0.38 0.11 0.47 177 RELAYCOUNTRY_NL 2315 0.52 0.68 0.47 178 XMHTMLBadTable_001 2271 0.48 0.56 0.46 179 FROM_GOV_SPOOF 2264 0.41 0.26 0.46 180 NORDNS_LOW_CONTRAST 2240 0.54 0.80 0.45 181 HTML_IMAGE_ONLY_32 2167 0.41 0.30 0.44 182 HTML_IMAGE_ONLY_28 2102 0.40 0.32 0.43 183 AC_DIV_BONANZA 2090 0.34 0.09 0.42 184 RELAYCOUNTRY_AU 2088 0.53 0.87 0.42 185 T_XMHurry_00 2040 0.84 2.20 0.41 186 XMSexyCombo_01 2029 0.74 1.78 0.41 187 MPART_ALT_DIFF_COUNT 2011 0.65 1.42 0.41 188 SHORT_HELO_AND_INLINE_IMAGE 2010 0.32 0.04 0.41 189 URI_NOVOWEL 1998 0.69 1.57 0.41 190 TM2_M_A_HREF_HREF 1976 0.46 0.67 0.40 191 TVD_SPACE_RATIO 1970 0.33 0.12 0.40 192 RCVD_IN_MSPIKE_L3 1964 0.88 2.42 0.40 193 XMLKML 1963 0.30 0.00 0.40 194 XMBody_78 1942 0.70 1.65 0.39 195 RDNS_DYNAMIC 1930 1.29 4.14 0.39 196 XMBody_95 1880 0.32 0.11 0.38 197 XM_B_REG_HTML 1872 0.43 0.59 0.38 198 XMSubMetaSxObfu_03 1866 0.47 0.74 0.38 199 RCVD_IN_MSPIKE_L4 1858 0.38 0.37 0.38 200 XMDateMe_00 1824 0.36 0.35 0.37 ----------------------------------------------------------------------