Email: 678079 Autolearn: 0 AvgScore: 3.55 AvgScanTime: 1.27 sec Spam: 184932 Autolearn: 0 AvgScore: 13.33 AvgScanTime: 1.43 sec Ham: 493147 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.21 sec Time Spent Running SA: 239.62 hours Time Spent Processing Spam: 73.67 hours Time Spent Processing Ham: 165.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171404 90.55 92.68 89.74 2 DKIM_SIGNED 145703 79.66 78.79 79.99 3 DCC_CHECK 143563 50.94 77.63 40.93 4 XM_DK_Pass 141011 78.03 76.25 78.70 5 XM_B_Unicode 138876 72.74 75.10 71.86 6 DKIM_VALID 137398 75.86 74.30 76.45 7 RELAYCOUNTRY_US 134689 80.53 72.83 83.42 8 XMListUnsubscribeExists 124095 57.15 67.10 53.42 9 XM_B_SpammyWords 122353 55.51 66.16 51.52 10 DKIM_VALID_AU 105086 57.32 56.82 57.51 11 XM_DK_Undo_02 75530 17.70 40.84 9.02 12 XM_B_SpammyWords2 73323 27.90 39.65 23.49 13 XM_B_Unicode3 72079 40.74 38.98 41.40 14 BAYES_50 69476 51.28 37.57 56.42 15 BAYES_99 62649 13.54 33.88 5.91 16 HTML_FONT_LOW_CONTRAST 61107 29.78 33.04 28.56 17 LOC_TINY_FONT_1 60939 26.95 32.95 24.70 18 MIME_HTML_ONLY 57820 23.91 31.27 21.15 19 DKIM_VALID_EF 50642 29.42 27.38 30.18 20 FVGT_m_MULTI_ODD 50215 24.39 27.15 23.35 21 RCVD_IN_MSPIKE_H2 48610 27.03 26.29 27.31 22 BAYES_999 47639 10.53 25.76 4.81 23 TR_DCC_Bayes_99 47189 9.12 25.52 2.97 24 T_KAM_HTML_FONT_INVALID 47132 21.11 25.49 19.47 25 XMSubLong 46283 22.63 25.03 21.73 26 T_TM2_M_HEADER_IN_MSG 43927 27.96 23.75 29.54 27 RELAYCOUNTRY_META 43675 10.29 23.62 5.29 28 DCC_CHECK_NEGATIVE 38063 46.93 20.58 56.82 29 UNTRUSTED_Relay 36823 7.00 19.91 2.16 30 XM_Multi_Part_URI 36564 14.00 19.77 11.83 31 XM_Body_Dirty_Words 33373 14.19 18.05 12.75 32 BOTNET 32170 6.15 17.40 1.93 33 FSL_BULK_SIG 30596 8.89 16.54 6.02 34 RCVD_IN_MSPIKE_WL 30237 26.18 16.35 29.86 35 LOTS_OF_MONEY 27826 10.18 15.05 8.35 36 TR_XM_SpammyWords2 25630 5.07 13.86 1.77 37 BOTNET_IPINHOSTNAME 24374 6.94 13.18 4.60 38 XM_B_SpammyWords3 24053 7.72 13.01 5.74 39 XM_B_Phish_Phrases 21386 7.98 11.56 6.63 40 XM_B_Unsub 20294 11.57 10.97 11.79 41 RCVD_IN_MSPIKE_BL 20058 3.38 10.85 0.58 42 XM_UncommonTLD01 19893 5.34 10.76 3.31 43 LotsOfNums_01 19813 9.80 10.71 9.46 44 XM_Evil_Numbers_Gen 19485 9.54 10.54 9.17 45 XMSexyCombo_05 17943 5.43 9.70 3.83 46 T_REMOTE_IMAGE 17283 5.37 9.35 3.88 47 RCVD_IN_MSPIKE_H3 16629 14.58 8.99 16.68 48 BAYES_60 16413 7.74 8.88 7.32 49 BAYES_80 15833 5.55 8.56 4.41 50 MPART_ALT_DIFF 15071 4.86 8.15 3.63 51 XM_UB50 14971 3.04 8.10 1.15 52 KHOP_HELO_FCRDNS 14451 3.27 7.81 1.56 53 HTML_IMAGE_ONLY_12 13633 2.18 7.37 0.24 54 RCVD_IN_BL_SPAMCOP_NET 13125 2.87 7.10 1.29 55 HTML_IMAGE_RATIO_02 12977 7.05 7.02 7.06 56 HTML_SHORT_LINK_IMG_1 12730 1.92 6.88 0.05 57 XMSubMetaSx_00 12674 4.28 6.85 3.31 58 BODY_URI_ONLY 12613 1.93 6.82 0.10 59 RCVD_IN_MSPIKE_H4 12284 9.73 6.64 10.89 60 TR_XM_PhishingBody 12278 3.94 6.64 2.93 61 TR_XM_SpammyWords3 11257 1.95 6.09 0.40 62 MIME_HTML_MOSTLY 10901 2.92 5.89 1.80 63 UNPARSEABLE_RELAY 10807 7.94 5.84 8.72 64 RCVD_IN_RP_RNBL 10597 1.64 5.73 0.10 65 RELAYCOUNTRY_CA 10343 2.72 5.59 1.64 66 TooManyTo_001 10161 7.47 5.49 8.21 67 HTML_IMAGE_RATIO_04 10128 5.00 5.48 4.82 68 XM_H_Long_From01 10116 5.74 5.47 5.84 69 BAYES_95 9799 3.49 5.30 2.82 70 XMNumbers 9332 3.88 5.05 3.44 71 RCVD_IN_MSPIKE_L3 9285 1.67 5.02 0.42 72 XMBrknScrpt_02 9052 2.06 4.89 0.99 73 XM_SendGrid 9033 7.15 4.88 8.00 74 XMBody_17 8984 2.01 4.86 0.95 75 SpammyFromTLD_01 8713 1.97 4.71 0.95 76 RCVD_IN_MSPIKE_L5 8682 1.36 4.69 0.10 77 XM_B_COVIDMETA 8535 2.07 4.62 1.11 78 DKIM_INVALID 8305 3.80 4.49 3.54 79 XM_B_Phish66 8115 2.53 4.39 1.83 80 RCVD_IN_PSBL 8001 1.18 4.33 0.01 81 XM_UB60 7665 1.22 4.14 0.12 82 URIBL_SBL_A 7468 1.24 4.04 0.20 83 XM_SPF_SoftFail 7355 2.24 3.98 1.59 84 T_FONT_INVIS_NAKED_TO 7171 2.48 3.88 1.95 85 XM_OfRef6 6890 1.98 3.73 1.32 86 XM_B_SpammyTLD 6648 2.46 3.59 2.03 87 XM_UB99 6604 0.98 3.57 0.01 88 XMStrtUSub 6510 4.21 3.52 4.47 89 RELAYCOUNTRY_FR 6445 1.15 3.49 0.28 90 T_XMDrugObfuBody_08 6091 2.35 3.29 2.00 91 XMDiploma_00 5986 2.18 3.24 1.78 92 TM2_M_URI_OPT_OUT 5775 2.68 3.12 2.51 93 TM2_M_VERY_LONG_WORD 5725 1.75 3.10 1.24 94 URI_HEX 5680 2.08 3.07 1.71 95 SpammyFromTLD_02 5669 1.07 3.07 0.32 96 RCVD_IN_RP_SAFE 5668 6.91 3.06 8.35 97 HTML_IMAGE_RATIO_06 5633 3.23 3.05 3.30 98 XM_DIRTYINTL 5595 1.25 3.03 0.59 99 URI_TRY_3LD 5521 1.67 2.99 1.18 100 TR_LOTS_OF_MONEY3 5386 1.31 2.91 0.70 101 TR_XM_SB_Phish 5376 2.25 2.91 2.01 102 TR_XM_MaxSPIKE 5242 0.78 2.83 0.02 103 BOTNET_NORDNS 5154 0.78 2.79 0.02 104 HTML_IMAGE_RATIO_08 5145 2.57 2.78 2.49 105 MIME_QP_LONG_LINE 5093 5.12 2.75 6.01 106 SUBJ_ALL_CAPS 5028 1.90 2.72 1.59 107 URI_PHP_REDIR 4956 0.73 2.68 0.00 108 TR_XM_COVIDMETA4 4955 1.00 2.68 0.38 109 XM_UB999 4923 0.73 2.66 0.00 110 T_XMDrugObfuBody_00 4845 1.28 2.62 0.78 111 RCVD_IN_RP_CERTIFIED 4724 6.32 2.55 7.73 112 TR_XM_DK_SendGrid 4702 4.23 2.54 4.86 113 XMSubPhish11 4610 2.12 2.49 1.98 114 RELAYCOUNTRY_UA 4581 0.69 2.48 0.02 115 LH_URI_DOM_IN_PATH 4542 2.36 2.46 2.32 116 TR_XM_MaxBayes 4381 0.66 2.37 0.02 117 T_TooManySym_01 4337 4.26 2.35 4.97 118 XM_B_Unsub2 4189 2.91 2.27 3.15 119 FROM_EXCESS_BASE64 4185 2.64 2.26 2.78 120 XM_CamelCaseFrm001 4172 2.05 2.26 1.97 121 MIME_HTML_ONLY_MULTI 4145 2.10 2.24 2.05 122 XMMoneyMeta_00 3888 0.94 2.10 0.50 123 XM_B_SpammyWords4 3842 1.02 2.08 0.63 124 XM_UB80 3802 0.58 2.06 0.03 125 XMSexyCombo_01 3781 0.91 2.04 0.49 126 TR_XM_UnparsRelay 3712 0.85 2.01 0.41 127 BAYES_40 3694 4.14 2.00 4.95 128 TR_XM_COVIDMETA1 3529 0.72 1.91 0.28 129 XMGenDplmaNmb 3527 1.17 1.91 0.89 130 DATE_IN_PAST_03_06 3490 0.57 1.89 0.08 131 XM_URI_RBL 3480 0.63 1.88 0.16 132 ANY_BOUNCE_MESSAGE 3446 2.11 1.86 2.20 133 BOUNCE_MESSAGE 3443 2.10 1.86 2.20 134 RCVD_IN_IADB_LISTED 3351 4.58 1.81 5.62 135 RELAYCOUNTRY_IN 3349 0.57 1.81 0.10 136 T_XMDrugObfuBody_14 3348 1.70 1.81 1.66 137 T_XMHurry_00 3314 1.07 1.79 0.80 138 BAYES_20 3301 2.94 1.78 3.37 139 SUBJ_BUY 3291 0.53 1.78 0.06 140 XMBdyGiftCard01 3217 1.05 1.74 0.79 141 XM_Lotto 3164 0.55 1.71 0.12 142 TR_Symld_Words 3139 2.14 1.70 2.31 143 HTML_MIME_NO_HTML_TAG 3097 2.50 1.67 2.81 144 SUBJ_DOLLARS 3018 0.69 1.63 0.34 145 HTML_FONT_SIZE_LARGE 2956 0.53 1.60 0.13 146 RCVD_IN_IADB_SPF 2829 3.97 1.53 4.88 147 PDS_FROM_2_EMAILS 2817 0.44 1.52 0.04 148 T_PDS_OTHER_BAD_TLD 2813 0.79 1.52 0.51 149 FROM_2_EMAILS_SHORT 2777 0.41 1.50 0.01 150 XM_SPF_Unknown 2761 0.92 1.49 0.71 151 TR_XM_RelayPhish 2721 0.54 1.47 0.18 152 XMGppyBdWords 2715 0.51 1.47 0.16 153 NUMERIC_HTTP_ADDR 2690 0.83 1.45 0.59 154 MIME_CHARSET_FARAWAY 2666 0.50 1.44 0.15 155 XMStockSpam_06 2606 1.31 1.41 1.27 156 RCVD_IN_IADB_DK 2605 3.42 1.41 4.18 157 RCVD_IN_IADB_SENDERID 2604 3.53 1.41 4.32 158 PDS_TO_EQ_FROM_NAME 2597 0.39 1.40 0.00 159 MIMEOLE_DIRECT_TO_MX 2567 0.38 1.39 0.00 160 TR_XM_PHPDW 2511 0.63 1.36 0.35 161 XMHTML_After_End 2488 0.98 1.35 0.85 162 TR_Mismatch_TLD_01 2476 0.59 1.34 0.31 163 TR_XM_PHPForged 2468 0.61 1.33 0.33 164 XMSubNoVowel 2456 0.54 1.33 0.24 165 TR_XM_FormFill2 2422 0.60 1.31 0.33 166 XM_H_PHPOS 2420 0.59 1.31 0.33 167 XMSubMetaD_00 2418 0.41 1.31 0.07 168 NO_FM_NAME_IP_HOSTN 2410 0.36 1.30 0.00 169 XM_RXBody 2398 1.06 1.30 0.97 170 TR_XM_INV_DKIM 2321 0.45 1.26 0.15 171 T_FILL_THIS_FORM_SHORT 2317 1.02 1.25 0.93 172 LOW_PRICE 2255 0.61 1.22 0.38 173 RDNS_DYNAMIC 2247 0.75 1.22 0.57 174 FROM_SUSPICIOUS_NTLD 2188 0.38 1.18 0.08 175 MAILING_LIST_MULTI 2177 2.31 1.18 2.73 176 TR_MetaPhish_Combo_01 2152 0.81 1.16 0.67 177 XMObfuSubjects 2146 0.34 1.16 0.03 178 CHARSET_FARAWAY_HEADER 2140 0.35 1.16 0.05 179 XM_UB95 2137 0.33 1.16 0.01 180 ALL_TRUSTED 2097 9.39 1.13 12.49 181 XMClaimOffer 2096 0.40 1.13 0.12 182 URI_NOVOWEL 2092 2.20 1.13 2.60 183 DOS_OE_TO_MX 2088 0.31 1.13 0.00 184 LONG_JUNK_URI2 2072 0.34 1.12 0.05 185 XM_DK_Undo_01 2058 1.66 1.11 1.87 186 FROM_SUSPICIOUS_NTLD_FP 2046 0.35 1.11 0.07 187 FROM_NAME_EQ_TO_G_DRIVE 2036 0.30 1.10 0.00 188 RELAYCOUNTRY_GB 1977 1.02 1.07 0.99 189 XMSubMetaSxObfu_03 1932 0.53 1.04 0.34 190 TR_Caps_n_Bayes_99 1921 0.32 1.04 0.05 191 BAYES_05 1903 1.82 1.03 2.11 192 BAYES_00 1859 9.50 1.01 12.68 193 TR_Mismatch_TLD_02 1843 0.33 1.00 0.08 194 LongTLD 1839 0.41 0.99 0.20 195 DKIM_ADSP_CUSTOM_MED 1829 1.10 0.99 1.14 196 XM_PDF 1806 3.68 0.98 4.70 197 XM_Body_Obfu01 1803 0.47 0.97 0.28 198 TR_LOTS_OF_MONEY2 1793 0.44 0.97 0.24 199 T_MONEY_PERCENT 1793 0.44 0.97 0.24 200 LOADSA_MONEY_COMBO 1792 0.28 0.97 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 442574 90.55 92.68 89.74 2 RELAYCOUNTRY_US 411385 80.53 72.83 83.42 3 DKIM_SIGNED 394487 79.66 78.79 79.99 4 XM_DK_Pass 388090 78.03 76.25 78.70 5 DKIM_VALID 377009 75.86 74.30 76.45 6 XM_B_Unicode 354378 72.74 75.10 71.86 7 DKIM_VALID_AU 283593 57.32 56.82 57.51 8 DCC_CHECK_NEGATIVE 280186 46.93 20.58 56.82 9 BAYES_50 278256 51.28 37.57 56.42 10 XMListUnsubscribeExists 263432 57.15 67.10 53.42 11 XM_B_SpammyWords 254066 55.51 66.16 51.52 12 XM_B_Unicode3 204167 40.74 38.98 41.40 13 DCC_CHECK 201832 50.94 77.63 40.93 14 DKIM_VALID_EF 148833 29.42 27.38 30.18 15 RCVD_IN_MSPIKE_WL 147274 26.18 16.35 29.86 16 T_TM2_M_HEADER_IN_MSG 145679 27.96 23.75 29.54 17 HTML_FONT_LOW_CONTRAST 140824 29.78 33.04 28.56 18 RCVD_IN_MSPIKE_H2 134681 27.03 26.29 27.31 19 LOC_TINY_FONT_1 121819 26.95 32.95 24.70 20 XM_B_SpammyWords2 115828 27.90 39.65 23.49 21 FVGT_m_MULTI_ODD 115145 24.39 27.15 23.35 22 XMSubLong 107140 22.63 25.03 21.73 23 MIME_HTML_ONLY 104316 23.91 31.27 21.15 24 T_KAM_HTML_FONT_INVALID 96028 21.11 25.49 19.47 25 RCVD_IN_MSPIKE_H3 82242 14.58 8.99 16.68 26 XM_Body_Dirty_Words 62866 14.19 18.05 12.75 27 BAYES_00 62537 9.50 1.01 12.68 28 ALL_TRUSTED 61574 9.39 1.13 12.49 29 XM_Multi_Part_URI 58342 14.00 19.77 11.83 30 XM_B_Unsub 58156 11.57 10.97 11.79 31 RCVD_IN_MSPIKE_H4 53719 9.73 6.64 10.89 32 TR_XM_DK_Bayes 47689 7.19 0.56 9.67 33 LotsOfNums_01 46668 9.80 10.71 9.46 34 TR_XM_DK_Bayes1 46339 6.98 0.53 9.40 35 XM_Evil_Numbers_Gen 45231 9.54 10.54 9.17 36 XM_DK_Undo_02 44497 17.70 40.84 9.02 37 UNPARSEABLE_RELAY 43000 7.94 5.84 8.72 38 TR_XM_DK_Bayes2 41374 6.23 0.48 8.39 39 LOTS_OF_MONEY 41194 10.18 15.05 8.35 40 RCVD_IN_RP_SAFE 41165 6.91 3.06 8.35 41 TooManyTo_001 40473 7.47 5.49 8.21 42 XM_SendGrid 39461 7.15 4.88 8.00 43 XM_DKIMWhitelistDomains 39038 5.77 0.03 7.92 44 RCVD_IN_RP_CERTIFIED 38130 6.32 2.55 7.73 45 IN_ZIMBRA_NJ_WHITELIST 36788 5.45 0.09 7.46 46 BAYES_60 36101 7.74 8.88 7.32 47 HTML_IMAGE_RATIO_02 34803 7.05 7.02 7.06 48 XM_B_Phish_Phrases 32698 7.98 11.56 6.63 49 FSL_BULK_SIG 29683 8.89 16.54 6.02 50 MIME_QP_LONG_LINE 29626 5.12 2.75 6.01 51 BAYES_99 29138 13.54 33.88 5.91 52 XM_H_Long_From01 28785 5.74 5.47 5.84 53 XM_B_SpammyWords3 28288 7.72 13.01 5.74 54 RCVD_IN_IADB_LISTED 27712 4.58 1.81 5.62 55 RELAYCOUNTRY_META 26067 10.29 23.62 5.29 56 T_TooManySym_01 24519 4.26 2.35 4.97 57 BAYES_40 24410 4.14 2.00 4.95 58 RCVD_IN_IADB_SPF 24087 3.97 1.53 4.88 59 TR_XM_DK_SendGrid 23975 4.23 2.54 4.86 60 HTML_IMAGE_RATIO_04 23752 5.00 5.48 4.82 61 BAYES_999 23738 10.53 25.76 4.81 62 XM_PDF 23181 3.68 0.98 4.70 63 BOTNET_IPINHOSTNAME 22689 6.94 13.18 4.60 64 XMStrtUSub 22038 4.21 3.52 4.47 65 BAYES_80 21770 5.55 8.56 4.41 66 RCVD_IN_IADB_SENDERID 21328 3.53 1.41 4.32 67 RCVD_IN_IADB_DK 20594 3.42 1.41 4.18 68 T_REMOTE_IMAGE 19154 5.37 9.35 3.88 69 XMSexyCombo_05 18872 5.43 9.70 3.83 70 MPART_ALT_DIFF 17880 4.86 8.15 3.63 71 RCVD_IN_IADB_VOUCHED 17523 2.82 0.88 3.55 72 DKIM_INVALID 17478 3.80 4.49 3.54 73 XMNumbers 16945 3.88 5.05 3.44 74 BAYES_20 16608 2.94 1.78 3.37 75 XM_UncommonTLD01 16344 5.34 10.76 3.31 76 XMSubMetaSx_00 16317 4.28 6.85 3.31 77 HTML_IMAGE_RATIO_06 16284 3.23 3.05 3.30 78 XM_B_Unsub2 15549 2.91 2.27 3.15 79 TR_DCC_Bayes_99 14667 9.12 25.52 2.97 80 TR_XM_PhishingBody 14465 3.94 6.64 2.93 81 BAYES_95 13894 3.49 5.30 2.82 82 HTML_MIME_NO_HTML_TAG 13867 2.50 1.67 2.81 83 FROM_EXCESS_BASE64 13734 2.64 2.26 2.78 84 MAILING_LIST_MULTI 13465 2.31 1.18 2.73 85 URI_NOVOWEL 12831 2.20 1.13 2.60 86 T_TooManySym_02 12658 2.02 0.56 2.57 87 TM2_M_URI_OPT_OUT 12378 2.68 3.12 2.51 88 HTML_IMAGE_RATIO_08 12278 2.57 2.78 2.49 89 LH_URI_DOM_IN_PATH 11455 2.36 2.46 2.32 90 TR_Symld_Words 11372 2.14 1.70 2.31 91 RCVD_IN_MSPIKE_H5 11313 1.86 0.72 2.29 92 RCVD_IN_IADB_OPTIN 11298 1.82 0.58 2.29 93 ANY_BOUNCE_MESSAGE 10832 2.11 1.86 2.20 94 BOUNCE_MESSAGE 10830 2.10 1.86 2.20 95 UNTRUSTED_Relay 10665 7.00 19.91 2.16 96 TooManyTo_002 10478 1.71 0.61 2.12 97 BAYES_05 10408 1.82 1.03 2.11 98 MIME_HTML_ONLY_MULTI 10086 2.10 2.24 2.05 99 XM_B_SpammyTLD 10029 2.46 3.59 2.03 100 TR_XM_SB_Phish 9897 2.25 2.91 2.01 101 T_XMDrugObfuBody_08 9841 2.35 3.29 2.00 102 XMSubPhish11 9740 2.12 2.49 1.98 103 XM_CamelCaseFrm001 9705 2.05 2.26 1.97 104 T_FONT_INVIS_NAKED_TO 9633 2.48 3.88 1.95 105 BOTNET 9522 6.15 17.40 1.93 106 XM_DK_Undo_01 9202 1.66 1.11 1.87 107 XM_B_Phish66 9023 2.53 4.39 1.83 108 MIME_HTML_MOSTLY 8879 2.92 5.89 1.80 109 XMDiploma_00 8800 2.18 3.24 1.78 110 TR_XM_SpammyWords2 8748 5.07 13.86 1.77 111 URI_HEX 8448 2.08 3.07 1.71 112 HELO_NODOT 8239 1.43 0.79 1.67 113 HELO_NO_DOMAIN 8237 1.43 0.79 1.67 114 T_XMDrugObfuBody_14 8167 1.70 1.81 1.66 115 RELAYCOUNTRY_CA 8084 2.72 5.59 1.64 116 XM_SPF_SoftFail 7839 2.24 3.98 1.59 117 SUBJ_ALL_CAPS 7823 1.90 2.72 1.59 118 KHOP_HELO_FCRDNS 7703 3.27 7.81 1.56 119 IN_HORDE_ADDRESS_BOOK 7624 1.20 0.29 1.55 120 INVALID_MSGID 7388 1.19 0.36 1.50 121 TVD_RCVD_IP 7227 1.19 0.44 1.47 122 TooManyTo_003 7007 1.16 0.45 1.42 123 XM_H_Long_From02 6922 1.26 0.86 1.40 124 USER_IN_DEF_DKIM_WL 6690 0.99 0.01 1.36 125 XM_OfRef6 6526 1.98 3.73 1.32 126 TO_MALFORMED 6503 0.96 0.01 1.32 127 XMGappySubj_01 6413 1.05 0.40 1.30 128 XMCapTrack 6360 1.04 0.37 1.29 129 RCVD_IN_BL_SPAMCOP_NET 6340 2.87 7.10 1.29 130 XMStockSpam_06 6260 1.31 1.41 1.27 131 TM2_M_VERY_LONG_WORD 6133 1.75 3.10 1.24 132 CK_HELO_DYNAMIC_SPLIT_IP 6031 1.10 0.78 1.22 133 HELO_MISC_IP 6030 0.99 0.36 1.22 134 XM_GoogleGroups 5821 0.98 0.44 1.18 135 URI_TRY_3LD 5803 1.67 2.99 1.18 136 XM_UB50 5662 3.04 8.10 1.15 137 DKIM_ADSP_CUSTOM_MED 5627 1.10 0.99 1.14 138 XM_B_COVIDMETA 5482 2.07 4.62 1.11 139 TooManyTo_004 5063 0.86 0.40 1.03 140 T_TooManySym_03 4917 0.77 0.18 1.00 141 RELAYCOUNTRY_GB 4906 1.02 1.07 0.99 142 XMBrknScrpt_02 4892 2.06 4.89 0.99 143 XMBSHREFv2 4886 0.81 0.34 0.99 144 XM_RXBody 4780 1.06 1.30 0.97 145 XMBody_17 4678 2.01 4.86 0.95 146 SpammyFromTLD_01 4677 1.97 4.71 0.95 147 T_FILL_THIS_FORM_SHORT 4573 1.02 1.25 0.93 148 XMGenDplmaNmb 4380 1.17 1.91 0.89 149 HTTPS_HTTP_MISMATCH 4274 0.85 0.81 0.87 150 XMBody_95 4201 0.64 0.06 0.85 151 TR_MSPIKEBAYES00 4195 0.62 0.01 0.85 152 XMHTML_After_End 4172 0.98 1.35 0.85 153 NML_ADSP_CUSTOM_MED 4089 0.84 0.87 0.83 154 T_XMHurry_00 3956 1.07 1.79 0.80 155 XM_ProductURIs 3925 0.80 0.82 0.80 156 TooManyTo_005 3912 0.67 0.36 0.79 157 T_OBFU_PDF_ATTACH 3897 0.62 0.16 0.79 158 XMBdyGiftCard01 3889 1.05 1.74 0.79 159 T_XMDrugObfuBody_00 3862 1.28 2.62 0.78 160 XM_ShortIntro_01 3554 0.61 0.32 0.72 161 XM_SPF_Unknown 3497 0.92 1.49 0.71 162 TR_LOTS_OF_MONEY3 3471 1.31 2.91 0.70 163 TM2_M_A_HREF_HREF 3467 0.70 0.71 0.70 164 TR_MetaPhish_Combo_01 3318 0.81 1.16 0.67 165 XMNoVowels 3246 0.59 0.41 0.66 166 RELAYCOUNTRY_DE 3210 0.70 0.82 0.65 167 HTML_FONT_FACE_BAD 3139 0.64 0.65 0.64 168 XM_B_SpammyWords4 3105 1.02 2.08 0.63 169 XMDateMe_00 3104 0.54 0.31 0.63 170 PLING_QUERY 3078 0.65 0.71 0.62 171 FROM_GOV_DKIM_AU 3035 0.50 0.18 0.62 172 NUMERIC_HTTP_ADDR 2928 0.83 1.45 0.59 173 XM_DIRTYINTL 2911 1.25 3.03 0.59 174 XM_B_COPY_HTML 2907 0.55 0.46 0.59 175 RCVD_IN_MSPIKE_BL 2882 3.38 10.85 0.58 176 FORGED_GMAIL_RCVD 2836 0.65 0.87 0.58 177 RDNS_DYNAMIC 2811 0.75 1.22 0.57 178 XM_H_PHPMailer 2727 0.55 0.53 0.55 179 HTML_TAG_BALANCE_BODY 2721 0.63 0.85 0.55 180 XM_S_SpammyWords 2670 0.60 0.75 0.54 181 TR_XM_Spammywords 2667 0.60 0.75 0.54 182 DKIM_ADSP_NXDOMAIN 2641 0.59 0.74 0.54 183 MISSING_HEADERS 2616 0.50 0.43 0.53 184 T_TooManySym_04 2616 0.40 0.05 0.53 185 T_Symld_Words_02 2601 0.61 0.84 0.53 186 SENDGRID_REDIR 2575 0.58 0.73 0.52 187 T_PDS_OTHER_BAD_TLD 2537 0.79 1.52 0.51 188 NO_DNS_FOR_FROM 2535 0.57 0.71 0.51 189 XMMoneyMeta_00 2462 0.94 2.10 0.50 190 XMHTMLBadTable_001 2417 0.53 0.62 0.49 191 XMBody_78 2405 0.60 0.89 0.49 192 XMSexyCombo_01 2397 0.91 2.04 0.49 193 RCVD_IN_SORBS_DUL 2357 0.41 0.24 0.48 194 XMSubMetaI_00 2327 0.55 0.77 0.47 195 XM_S_SubURI 2278 0.34 0.02 0.46 196 TR_BOTNET_NEGATE 2259 0.56 0.83 0.46 197 FROM_GOV_SPOOF 2240 0.37 0.14 0.45 198 TM2_M_BODY_EMPTY 2239 0.35 0.07 0.45 199 SHORT_HELO_AND_INLINE_IMAGE 2185 0.34 0.06 0.44 200 XMSolicitRefs_0 2135 0.42 0.38 0.43 ----------------------------------------------------------------------