Email: 649380 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 1.24 sec Spam: 195272 Autolearn: 0 AvgScore: 15.11 AvgScanTime: 1.45 sec Ham: 454108 Autolearn: 0 AvgScore: -0.42 AvgScanTime: 1.14 sec Time Spent Running SA: 223.13 hours Time Spent Processing Spam: 78.83 hours Time Spent Processing Ham: 144.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 157215 80.76 80.51 80.87 2 XM_B_Unicode 144469 70.58 73.98 69.12 3 HTML_MESSAGE 139952 82.24 71.67 86.79 4 XM_B_SpammyWords 134965 54.50 69.12 48.21 5 DKIM_SIGNED 117961 71.78 60.41 76.67 6 XM_DK_Pass 114541 70.38 58.66 75.42 7 DKIM_VALID 111617 68.33 57.16 73.14 8 DCC_CHECK 109933 42.59 56.30 36.69 9 XMListUnsubscribeExists 97004 49.71 49.68 49.73 10 BAYES_50 95754 53.80 49.04 55.84 11 DCC_CHECK_NEGATIVE 82573 55.54 42.29 61.24 12 DKIM_VALID_AU 81527 50.38 41.75 54.09 13 BOTNET 72374 12.51 37.06 1.96 14 RCVD_IN_MSPIKE_BL 61517 9.90 31.50 0.61 15 XM_B_Unicode3 61083 37.48 31.28 40.15 16 XM_DK_Undo_02 61007 15.64 31.24 8.92 17 XM_Multi_Part_URI 58387 17.35 29.90 11.96 18 XM_B_SpammyWords2 57170 24.02 29.28 21.75 19 LOTS_OF_MONEY 56951 14.95 29.16 8.84 20 RCVD_IN_RP_RNBL 53773 8.37 27.54 0.13 21 RCVD_IN_MSPIKE_L5 53179 8.32 27.23 0.18 22 LOC_TINY_FONT_1 52961 24.91 27.12 23.96 23 RCVD_IN_PSBL 52733 8.14 27.00 0.03 24 HTML_FONT_LOW_CONTRAST 51273 26.90 26.26 27.18 25 BAYES_99 49999 11.77 25.60 5.82 26 BOUNCE_MESSAGE 48630 9.96 24.90 3.53 27 ANY_BOUNCE_MESSAGE 48630 9.96 24.90 3.53 28 MIME_HTML_ONLY 47862 22.16 24.51 21.14 29 XM_Lotto 47449 7.41 24.30 0.15 30 FVGT_m_MULTI_ODD 46751 22.77 23.94 22.26 31 RCVD_IN_MSPIKE_H2 46161 26.18 23.64 27.28 32 TR_XM_SpammyWords3 43714 7.00 22.39 0.38 33 DKIM_VALID_EF 43431 27.12 22.24 29.22 34 XM_Body_Dirty_Words 42643 16.40 21.84 14.06 35 T_TM2_M_HEADER_IN_MSG 41813 26.29 21.41 28.39 36 BAYES_999 39047 9.40 20.00 4.85 37 XMSubLong 38896 22.43 19.92 23.51 38 XM_B_Phish_Phrases 38436 9.88 19.68 5.67 39 TR_XM_COVIDMETA4 37855 6.12 19.39 0.41 40 TR_DCC_Bayes_99 35603 7.12 18.23 2.34 41 T_KAM_HTML_FONT_INVALID 31152 17.44 15.95 18.08 42 RELAYCOUNTRY_META 30996 8.52 15.87 5.35 43 UNTRUSTED_Relay 26989 5.74 13.82 2.26 44 RCVD_IN_MSPIKE_WL 25262 23.99 12.94 28.74 45 FSL_BULK_SIG 22746 7.60 11.65 5.85 46 XM_B_Unsub 21934 11.53 11.23 11.66 47 BOTNET_IPINHOSTNAME 21245 6.73 10.88 4.95 48 XM_B_COVIDMETA 19659 3.86 10.07 1.20 49 DATE_IN_PAST_12_24 19543 3.12 10.01 0.15 50 XMSexyCombo_05 18002 6.04 9.22 4.67 51 LotsOfNums_01 17770 9.21 9.10 9.25 52 XM_B_SpammyTLD 17657 4.22 9.04 2.15 53 XM_UncommonTLD01 17537 5.15 8.98 3.50 54 XM_B_SpammyWords3 17503 6.23 8.96 5.05 55 DATE_IN_PAST_06_12 17136 2.78 8.78 0.20 56 TR_XM_SpammyWords2 16943 3.64 8.68 1.48 57 XM_OfRef6 16810 3.36 8.61 1.11 58 XM_Evil_Numbers_Gen 14591 8.33 7.47 8.70 59 BAYES_80 14207 4.87 7.28 3.84 60 MPART_ALT_DIFF 13474 4.91 6.90 4.06 61 RCVD_IN_BL_SPAMCOP_NET 13415 3.05 6.87 1.41 62 T_REMOTE_IMAGE 13150 4.65 6.73 3.75 63 BAYES_60 13038 6.90 6.68 6.99 64 XM_OfRef7 12719 2.07 6.51 0.16 65 RCVD_IN_MSPIKE_H3 12646 13.40 6.48 16.37 66 FILL_THIS_FORM 12389 2.08 6.34 0.24 67 T_FILL_THIS_FORM_LONG 12321 2.01 6.31 0.16 68 TR_XM_PhishingBody 12041 3.99 6.17 3.05 69 ADVANCE_FEE_2_NEW_FORM 11996 1.86 6.14 0.03 70 HTML_IMAGE_RATIO_02 11926 6.61 6.11 6.83 71 RCVD_IN_MSPIKE_H4 11640 8.88 5.96 10.14 72 XMSubMetaSx_00 11316 4.68 5.79 4.20 73 XM_UB50 11032 2.47 5.65 1.11 74 XM_SPF_SoftFail 9933 2.75 5.09 1.75 75 MIME_HTML_MOSTLY 9656 3.18 4.94 2.42 76 FORM_FRAUD 9485 1.48 4.86 0.03 77 TooManyTo_001 9327 7.50 4.78 8.68 78 URI_HEX 9242 2.42 4.73 1.42 79 UNPARSEABLE_RELAY 8974 6.75 4.60 7.68 80 HTML_IMAGE_RATIO_04 8948 5.69 4.58 6.16 81 XMNumbers 8923 4.85 4.57 4.97 82 BODY_URI_ONLY 8816 1.39 4.51 0.05 83 SpammyFromTLD_01 8791 2.11 4.50 1.08 84 BAYES_95 8502 2.94 4.35 2.33 85 XM_H_Long_From01 8402 5.43 4.30 5.91 86 KHOP_HELO_FCRDNS 8340 2.40 4.27 1.59 87 RELAYCOUNTRY_CA 8248 2.37 4.22 1.57 88 T_XMDrugObfuBody_08 7919 2.45 4.06 1.77 89 HTML_SHORT_LINK_IMG_1 7554 1.18 3.87 0.02 90 XM_B_Phish66 7451 2.35 3.82 1.72 91 HTML_IMAGE_ONLY_08 7420 1.22 3.80 0.11 92 SHORTENED_URL_SRC 7412 1.14 3.80 0.00 93 SHORTENER_SHORT_IMG 7393 1.14 3.79 0.00 94 RCVD_IN_MSPIKE_L3 7364 1.40 3.77 0.38 95 SHORT_URI_3 7355 1.16 3.77 0.04 96 SHORTENED_URL_HREF 7274 1.34 3.73 0.32 97 XM_SendGrid 7193 5.96 3.68 6.93 98 SHORT_SHORTNER 7043 1.10 3.61 0.02 99 XMDiploma_00 6517 2.50 3.34 2.13 100 DKIM_INVALID 6344 3.45 3.25 3.53 101 BOTNET_NORDNS 6171 0.97 3.16 0.02 102 ADVANCE_FEE_3_NEW_MONEY 6006 0.93 3.08 0.01 103 T_FONT_INVIS_NAKED_TO 5941 2.24 3.04 1.89 104 TM2_M_URI_OPT_OUT 5822 2.72 2.98 2.61 105 XMStrtUSub 5804 4.29 2.97 4.86 106 DATE_IN_PAST_03_06 5784 0.93 2.96 0.05 107 HTML_IMAGE_RATIO_06 5715 3.13 2.93 3.21 108 HTML_IMAGE_RATIO_08 5607 2.26 2.87 1.99 109 BAYES_40 5399 4.71 2.76 5.54 110 XM_URI_RBL 5357 0.95 2.74 0.18 111 XMBrknScrpt_02 4843 1.23 2.48 0.69 112 XM_DIRTYINTL 4408 1.01 2.26 0.47 113 XM_B_Unsub2 4232 2.54 2.17 2.70 114 SpammyFromTLD_02 4184 0.96 2.14 0.46 115 XM_UB99 4096 0.63 2.10 0.00 116 MIME_QP_LONG_LINE 4046 5.11 2.07 6.42 117 LH_URI_DOM_IN_PATH 3997 1.98 2.05 1.95 118 HTML_MIME_NO_HTML_TAG 3930 2.38 2.01 2.54 119 XM_CamelCaseFrm001 3900 1.92 2.00 1.89 120 TR_XM_DK_SendGrid 3842 3.41 1.97 4.03 121 URIBL_SBL_A 3835 0.69 1.96 0.15 122 XMBody_17 3832 0.98 1.96 0.56 123 MIME_HTML_ONLY_MULTI 3824 2.09 1.96 2.15 124 TR_LOTS_OF_MONEY3 3761 0.89 1.93 0.44 125 T_TooManySym_01 3711 4.34 1.90 5.39 126 TM2_M_VERY_LONG_WORD 3702 1.39 1.90 1.17 127 RCVD_IN_RP_SAFE 3646 5.59 1.87 7.18 128 T_XMDrugObfuBody_14 3633 1.67 1.86 1.59 129 T_XMDrugObfuBody_01 3521 0.57 1.80 0.03 130 RELAYCOUNTRY_IN 3507 0.62 1.80 0.11 131 BAYES_20 3488 3.33 1.79 4.00 132 TR_XM_UnparsRelay 3459 0.86 1.77 0.47 133 TR_XM_SB_Phish 3435 2.00 1.76 2.11 134 FROM_EXCESS_BASE64 3415 2.59 1.75 2.95 135 TR_Symld_Words 3373 3.04 1.73 3.60 136 XMSubPhish11 3341 1.97 1.71 2.09 137 RELAYCOUNTRY_FR 3324 0.69 1.70 0.25 138 XMReplyNow 3239 0.58 1.66 0.11 139 TR_XM_COVIDMETA1 3154 0.73 1.62 0.35 140 URI_PHP_REDIR 3117 0.48 1.60 0.01 141 URI_TRY_3LD 3097 1.26 1.59 1.12 142 SUBJ_ALL_CAPS 3060 1.68 1.57 1.72 143 DATE_IN_PAST_24_48 3042 0.47 1.56 0.00 144 XM_UB999 2992 0.46 1.53 0.00 145 TR_XM_MaxSPIKE 2979 0.47 1.53 0.01 146 RCVD_IN_RP_CERTIFIED 2979 5.10 1.53 6.64 147 XMSexyCombo_01 2972 1.47 1.52 1.45 148 T_XMDrugObfuBody_00 2945 1.00 1.51 0.78 149 XMGenDplmaNmb 2920 1.08 1.50 0.90 150 RCVD_IN_IADB_LISTED 2865 4.65 1.47 6.02 151 BAYES_00 2773 9.69 1.42 13.25 152 TR_XM_PHPDW 2716 0.62 1.39 0.29 153 T_XMHurry_00 2710 0.80 1.39 0.55 154 XM_UB60 2704 0.49 1.38 0.10 155 TR_XM_PHPForged 2619 0.60 1.34 0.27 156 XM_UB80 2612 0.42 1.34 0.03 157 TR_XM_FormFill2 2597 0.60 1.33 0.28 158 XM_H_PHPOS 2585 0.59 1.32 0.27 159 XMPhish30 2494 0.76 1.28 0.54 160 XM_B_SpammyWords4 2459 0.65 1.26 0.39 161 DATE_IN_PAST_96_XX 2435 0.38 1.25 0.01 162 HTML_IMAGE_ONLY_32 2422 0.67 1.24 0.42 163 URI_NOVOWEL 2418 2.18 1.24 2.58 164 XMBdyGiftCard01 2411 0.82 1.23 0.64 165 T_FILL_THIS_FORM_SHORT 2301 1.01 1.18 0.94 166 RELAYCOUNTRY_GB 2261 1.06 1.16 1.02 167 T_PDS_OTHER_BAD_TLD 2229 0.60 1.14 0.37 168 RCVD_IN_IADB_SPF 2216 4.05 1.13 5.31 169 RELAYCOUNTRY_DE 2201 0.79 1.13 0.64 170 ALL_TRUSTED 2174 10.80 1.11 14.96 171 XM_UB95 2152 0.34 1.10 0.01 172 XMLngstWrd_00 2129 0.92 1.09 0.85 173 MISSING_HEADERS 2128 0.64 1.09 0.45 174 TR_XM_MaxBayes 2122 0.33 1.09 0.01 175 XMHTML_After_End 2107 0.92 1.08 0.85 176 RCVD_IN_IADB_DK 2067 3.52 1.06 4.58 177 RCVD_IN_IADB_SENDERID 2060 3.64 1.05 4.75 178 XMStockSpam_06 2054 1.42 1.05 1.57 179 XMManySubDom_06 2017 0.32 1.03 0.02 180 XMSubNoVowel 1932 0.98 0.99 0.98 181 TR_XM_RelayPhish 1924 0.38 0.99 0.12 182 XM_DK_Undo_01 1910 1.71 0.98 2.02 183 BAYES_05 1903 1.96 0.97 2.39 184 XMLngstWrd_01 1864 0.86 0.95 0.81 185 XM_S_SpammyWords 1861 0.47 0.95 0.26 186 TR_XM_Spammywords 1860 0.47 0.95 0.26 187 RDNS_DYNAMIC 1854 0.67 0.95 0.54 188 DKIM_ADSP_CUSTOM_MED 1832 1.19 0.94 1.30 189 TR_XM_INV_DKIM 1783 0.43 0.91 0.22 190 T_HTML_TAG_BALANCE_CENTER 1757 0.40 0.90 0.19 191 XMBody_78 1742 0.68 0.89 0.58 192 TR_MetaPhish_Combo_01 1715 0.73 0.88 0.66 193 MAILING_LIST_MULTI 1714 1.92 0.88 2.37 194 FROM_SUSPICIOUS_NTLD 1710 0.28 0.88 0.03 195 REPLYTO_WITHOUT_TO_CC 1699 0.30 0.87 0.06 196 XMGppyBdWords 1675 0.35 0.86 0.13 197 XM_ProductURIs 1662 0.88 0.85 0.89 198 FROM_SUSPICIOUS_NTLD_FP 1655 0.27 0.85 0.02 199 NML_ADSP_CUSTOM_MED 1619 0.88 0.83 0.90 200 HTML_IMAGE_ONLY_16 1597 0.44 0.82 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 394106 82.24 71.67 86.79 2 RELAYCOUNTRY_US 367251 80.76 80.51 80.87 3 DKIM_SIGNED 348149 71.78 60.41 76.67 4 XM_DK_Pass 342475 70.38 58.66 75.42 5 DKIM_VALID 332118 68.33 57.16 73.14 6 XM_B_Unicode 313872 70.58 73.98 69.12 7 DCC_CHECK_NEGATIVE 278080 55.54 42.29 61.24 8 BAYES_50 253582 53.80 49.04 55.84 9 DKIM_VALID_AU 245648 50.38 41.75 54.09 10 XMListUnsubscribeExists 225825 49.71 49.68 49.73 11 XM_B_SpammyWords 218943 54.50 69.12 48.21 12 XM_B_Unicode3 182302 37.48 31.28 40.15 13 DCC_CHECK 166608 42.59 56.30 36.69 14 DKIM_VALID_EF 132705 27.12 22.24 29.22 15 RCVD_IN_MSPIKE_WL 130517 23.99 12.94 28.74 16 T_TM2_M_HEADER_IN_MSG 128905 26.29 21.41 28.39 17 RCVD_IN_MSPIKE_H2 123868 26.18 23.64 27.28 18 HTML_FONT_LOW_CONTRAST 123411 26.90 26.26 27.18 19 LOC_TINY_FONT_1 108819 24.91 27.12 23.96 20 XMSubLong 106747 22.43 19.92 23.51 21 FVGT_m_MULTI_ODD 101082 22.77 23.94 22.26 22 XM_B_SpammyWords2 98782 24.02 29.28 21.75 23 MIME_HTML_ONLY 96010 22.16 24.51 21.14 24 T_KAM_HTML_FONT_INVALID 82084 17.44 15.95 18.08 25 RCVD_IN_MSPIKE_H3 74359 13.40 6.48 16.37 26 ALL_TRUSTED 67938 10.80 1.11 14.96 27 XM_Body_Dirty_Words 63826 16.40 21.84 14.06 28 BAYES_00 60153 9.69 1.42 13.25 29 XM_Multi_Part_URI 54290 17.35 29.90 11.96 30 XM_B_Unsub 52954 11.53 11.23 11.66 31 RCVD_IN_MSPIKE_H4 46031 8.88 5.96 10.14 32 TR_XM_DK_Bayes 44178 6.94 0.47 9.73 33 TR_XM_DK_Bayes1 42696 6.71 0.45 9.40 34 LotsOfNums_01 42027 9.21 9.10 9.25 35 XM_DK_Undo_02 40529 15.64 31.24 8.92 36 LOTS_OF_MONEY 40152 14.95 29.16 8.84 37 XM_Evil_Numbers_Gen 39526 8.33 7.47 8.70 38 TooManyTo_001 39399 7.50 4.78 8.68 39 TR_XM_DK_Bayes2 38058 5.98 0.40 8.38 40 XM_DKIMWhitelistDomains 37277 5.74 0.01 8.21 41 UNPARSEABLE_RELAY 34878 6.75 4.60 7.68 42 RCVD_IN_RP_SAFE 32622 5.59 1.87 7.18 43 IN_ZIMBRA_NJ_WHITELIST 32377 5.00 0.05 7.13 44 BAYES_60 31737 6.90 6.68 6.99 45 XM_SendGrid 31479 5.96 3.68 6.93 46 HTML_IMAGE_RATIO_02 31028 6.61 6.11 6.83 47 RCVD_IN_RP_CERTIFIED 30161 5.10 1.53 6.64 48 MIME_QP_LONG_LINE 29160 5.11 2.07 6.42 49 HTML_IMAGE_RATIO_04 27981 5.69 4.58 6.16 50 RCVD_IN_IADB_LISTED 27316 4.65 1.47 6.02 51 XM_H_Long_From01 26844 5.43 4.30 5.91 52 FSL_BULK_SIG 26586 7.60 11.65 5.85 53 BAYES_99 26427 11.77 25.60 5.82 54 XM_B_Phish_Phrases 25730 9.88 19.68 5.67 55 BAYES_40 25169 4.71 2.76 5.54 56 T_TooManySym_01 24477 4.34 1.90 5.39 57 RELAYCOUNTRY_META 24303 8.52 15.87 5.35 58 RCVD_IN_IADB_SPF 24109 4.05 1.13 5.31 59 XM_B_SpammyWords3 22950 6.23 8.96 5.05 60 XM_PDF 22794 3.75 0.81 5.02 61 XMNumbers 22574 4.85 4.57 4.97 62 BOTNET_IPINHOSTNAME 22476 6.73 10.88 4.95 63 XMStrtUSub 22059 4.29 2.97 4.86 64 BAYES_999 22005 9.40 20.00 4.85 65 RCVD_IN_IADB_SENDERID 21563 3.64 1.05 4.75 66 XMSexyCombo_05 21220 6.04 9.22 4.67 67 RCVD_IN_IADB_DK 20802 3.52 1.06 4.58 68 XMSubMetaSx_00 19070 4.68 5.79 4.20 69 MPART_ALT_DIFF 18443 4.91 6.90 4.06 70 TR_XM_DK_SendGrid 18311 3.41 1.97 4.03 71 BAYES_20 18166 3.33 1.79 4.00 72 BAYES_80 17428 4.87 7.28 3.84 73 RCVD_IN_IADB_VOUCHED 17182 2.88 0.77 3.78 74 T_REMOTE_IMAGE 17019 4.65 6.73 3.75 75 TR_Symld_Words 16359 3.04 1.73 3.60 76 ANY_BOUNCE_MESSAGE 16038 9.96 24.90 3.53 77 BOUNCE_MESSAGE 16035 9.96 24.90 3.53 78 DKIM_INVALID 16031 3.45 3.25 3.53 79 XM_UncommonTLD01 15897 5.15 8.98 3.50 80 HTML_IMAGE_RATIO_06 14591 3.13 2.93 3.21 81 TR_XM_PhishingBody 13855 3.99 6.17 3.05 82 FROM_EXCESS_BASE64 13395 2.59 1.75 2.95 83 XM_B_Unsub2 12239 2.54 2.17 2.70 84 TM2_M_URI_OPT_OUT 11861 2.72 2.98 2.61 85 URI_NOVOWEL 11734 2.18 1.24 2.58 86 HTML_MIME_NO_HTML_TAG 11515 2.38 2.01 2.54 87 T_TooManySym_02 11515 1.91 0.44 2.54 88 RCVD_IN_IADB_OPTIN 11475 1.91 0.49 2.53 89 MIME_HTML_MOSTLY 10971 3.18 4.94 2.42 90 BAYES_05 10831 1.96 0.97 2.39 91 MAILING_LIST_MULTI 10766 1.92 0.88 2.37 92 TR_DCC_Bayes_99 10611 7.12 18.23 2.34 93 BAYES_95 10580 2.94 4.35 2.33 94 UNTRUSTED_Relay 10274 5.74 13.82 2.26 95 TooManyTo_002 10180 1.74 0.57 2.24 96 RCVD_IN_MSPIKE_H5 10127 1.71 0.50 2.23 97 XM_B_SpammyTLD 9775 4.22 9.04 2.15 98 MIME_HTML_ONLY_MULTI 9747 2.09 1.96 2.15 99 XMDiploma_00 9688 2.50 3.34 2.13 100 TR_XM_SB_Phish 9574 2.00 1.76 2.11 101 XMSubPhish11 9473 1.97 1.71 2.09 102 XM_DK_Undo_01 9194 1.71 0.98 2.02 103 HTML_IMAGE_RATIO_08 9052 2.26 2.87 1.99 104 BOTNET 8882 12.51 37.06 1.96 105 LH_URI_DOM_IN_PATH 8871 1.98 2.05 1.95 106 XM_CamelCaseFrm001 8592 1.92 2.00 1.89 107 T_FONT_INVIS_NAKED_TO 8582 2.24 3.04 1.89 108 TVD_RCVD_IP 8087 1.33 0.28 1.78 109 T_XMDrugObfuBody_08 8022 2.45 4.06 1.77 110 XM_SPF_SoftFail 7931 2.75 5.09 1.75 111 XM_B_Phish66 7820 2.35 3.82 1.72 112 SUBJ_ALL_CAPS 7819 1.68 1.57 1.72 113 INVALID_MSGID 7527 1.27 0.36 1.66 114 HELO_NODOT 7497 1.39 0.78 1.65 115 HELO_NO_DOMAIN 7496 1.39 0.78 1.65 116 IN_HORDE_ADDRESS_BOOK 7304 1.16 0.12 1.61 117 T_XMDrugObfuBody_14 7241 1.67 1.86 1.59 118 KHOP_HELO_FCRDNS 7229 2.40 4.27 1.59 119 XMStockSpam_06 7140 1.42 1.05 1.57 120 RELAYCOUNTRY_CA 7131 2.37 4.22 1.57 121 TooManyTo_003 6942 1.18 0.38 1.53 122 HELO_MISC_IP 6932 1.16 0.30 1.53 123 CK_HELO_DYNAMIC_SPLIT_IP 6932 1.19 0.40 1.53 124 TR_XM_SpammyWords2 6716 3.64 8.68 1.48 125 XMGappySubj_01 6691 1.08 0.18 1.47 126 XMSexyCombo_01 6564 1.47 1.52 1.45 127 TO_MALFORMED 6481 1.00 0.00 1.43 128 URI_HEX 6463 2.42 4.73 1.42 129 RCVD_IN_BL_SPAMCOP_NET 6406 3.05 6.87 1.41 130 DKIM_ADSP_CUSTOM_MED 5918 1.19 0.94 1.30 131 XM_GoogleGroups 5513 0.95 0.35 1.21 132 XMBSHREFv2 5488 0.93 0.27 1.21 133 XMCapTrack 5441 0.96 0.40 1.20 134 XM_B_COVIDMETA 5433 3.86 10.07 1.20 135 TM2_M_VERY_LONG_WORD 5303 1.39 1.90 1.17 136 TooManyTo_004 5255 0.91 0.33 1.16 137 XM_H_Long_From02 5252 1.05 0.80 1.16 138 USER_IN_DEF_DKIM_WL 5209 0.81 0.01 1.15 139 URI_TRY_3LD 5088 1.26 1.59 1.12 140 XM_OfRef6 5020 3.36 8.61 1.11 141 XM_UB50 5020 2.47 5.65 1.11 142 SpammyFromTLD_01 4885 2.11 4.50 1.08 143 T_TooManySym_03 4843 0.77 0.09 1.07 144 RELAYCOUNTRY_GB 4650 1.06 1.16 1.02 145 TR_MSPIKEBAYES00 4481 0.70 0.02 0.99 146 XMSubNoVowel 4441 0.98 0.99 0.98 147 XMSexyCombo_04 4385 0.82 0.48 0.97 148 T_FILL_THIS_FORM_SHORT 4277 1.01 1.18 0.94 149 T_OBFU_PDF_ATTACH 4200 0.68 0.12 0.92 150 NML_ADSP_CUSTOM_MED 4085 0.88 0.83 0.90 151 XM_H_Trusted_IP 4084 0.63 0.00 0.90 152 XMGenDplmaNmb 4068 1.08 1.50 0.90 153 XMSubMetaSxObfu_03 4051 0.81 0.62 0.89 154 TooManyTo_005 4035 0.70 0.25 0.89 155 XM_ProductURIs 4034 0.88 0.85 0.89 156 XMHTML_After_End 3876 0.92 1.08 0.85 157 XMLngstWrd_00 3875 0.92 1.09 0.85 158 XMLngstWrd_01 3695 0.86 0.95 0.81 159 T_XMDrugObfuBody_00 3540 1.00 1.51 0.78 160 XMBody_95 3497 0.56 0.08 0.77 161 XMLngstWrd_02 3443 0.78 0.82 0.76 162 FROM_GOV_DKIM_AU 3232 0.54 0.12 0.71 163 XM_SPF_Unknown 3199 0.71 0.71 0.70 164 T_Symld_Words_02 3199 0.74 0.81 0.70 165 XM_ShortIntro_01 3137 0.62 0.44 0.69 166 XMBrknScrpt_02 3129 1.23 2.48 0.69 167 HTTPS_HTTP_MISMATCH 3069 0.70 0.76 0.68 168 TR_MetaPhish_Combo_01 3004 0.73 0.88 0.66 169 HTML_IMAGE_ONLY_20 3001 0.53 0.23 0.66 170 XMNoVowels 2994 0.60 0.46 0.66 171 RELAYCOUNTRY_DE 2918 0.79 1.13 0.64 172 XMBdyGiftCard01 2905 0.82 1.23 0.64 173 XMLngstWrd_03 2887 0.62 0.57 0.64 174 PLING_QUERY 2850 0.66 0.74 0.63 175 DKIM_ADSP_NXDOMAIN 2785 0.63 0.68 0.61 176 RCVD_IN_MSPIKE_BL 2776 9.90 31.50 0.61 177 XMLngstWrd_04 2760 0.55 0.40 0.61 178 T_TooManySym_04 2725 0.43 0.02 0.60 179 XMBody_78 2654 0.68 0.89 0.58 180 FORGED_GMAIL_RCVD 2653 0.64 0.78 0.58 181 HTML_FONT_FACE_BAD 2606 0.56 0.51 0.57 182 XMBody_17 2547 0.98 1.96 0.56 183 T_XMHurry_00 2506 0.80 1.39 0.55 184 XMSubMetaI_00 2483 0.58 0.66 0.55 185 RDNS_DYNAMIC 2469 0.67 0.95 0.54 186 XMHTMLBadTable_001 2465 0.51 0.43 0.54 187 XMMoneyMeta_00 2434 0.62 0.80 0.54 188 XMPhish30 2431 0.76 1.28 0.54 189 TM2_M_A_HREF_HREF 2430 0.58 0.69 0.54 190 NO_DNS_FOR_FROM 2397 0.57 0.66 0.53 191 SENDGRID_REDIR 2382 0.50 0.44 0.52 192 XM_S_SubURI 2334 0.39 0.10 0.51 193 TVD_SPACE_RATIO 2313 0.38 0.07 0.51 194 NUMERIC_HTTP_ADDR 2269 0.59 0.78 0.50 195 USER_IN_WHITELIST 2267 0.35 0.00 0.50 196 USER_IN_WELCOMELIST 2267 0.35 0.00 0.50 197 XMSubMetaSx_01 2252 0.45 0.35 0.50 198 MPART_ALT_DIFF_COUNT 2215 0.57 0.76 0.49 199 T_HTML_ATTACH 2209 0.45 0.35 0.49 200 TR_BOTNET_NEGATE 2201 0.57 0.76 0.48 ----------------------------------------------------------------------