Email: 768209 Autolearn: 0 AvgScore: 2.33 AvgScanTime: 1.48 sec Spam: 218655 Autolearn: 0 AvgScore: 13.79 AvgScanTime: 1.68 sec Ham: 549554 Autolearn: 0 AvgScore: -2.22 AvgScanTime: 1.40 sec Time Spent Running SA: 316.46 hours Time Spent Processing Spam: 102.15 hours Time Spent Processing Ham: 214.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211651 90.26 96.80 87.66 2 DKIM_SIGNED 189116 76.71 86.49 72.81 3 XM_DK_Pass 184914 75.35 84.57 71.68 4 DKIM_VALID 180485 73.31 82.54 69.63 5 DCC_CHECK 177311 52.39 81.09 40.97 6 XM_B_Unicode 168857 73.70 77.23 72.30 7 RELAYCOUNTRY_US 167712 83.08 76.70 85.61 8 XMListUnsubscribeExists 158105 53.57 72.31 46.12 9 XM_B_SpammyWords 154975 55.29 70.88 49.09 10 DKIM_VALID_AU 138299 56.53 63.25 53.86 11 XM_DK_Undo_02 106887 19.14 48.88 7.31 12 XM_B_Unicode3 92544 43.37 42.32 43.78 13 TR_XM_DKIM_Undo 91456 15.72 41.83 5.34 14 XM_B_SpammyWords2 89691 24.84 41.02 18.40 15 LOC_TINY_FONT_1 84343 27.23 38.57 22.72 16 BAYES_50 82143 47.28 37.57 51.14 17 BAYES_99 76601 13.00 35.03 4.23 18 HTML_FONT_LOW_CONTRAST 71218 27.98 32.57 26.16 19 RCVD_IN_MSPIKE_H2 69926 27.23 31.98 25.34 20 DKIM_VALID_EF 63938 28.95 29.24 28.84 21 FVGT_m_MULTI_ODD 63233 23.75 28.92 21.70 22 MIME_HTML_ONLY 61761 24.40 28.25 22.87 23 TR_DCC_Bayes_99 61128 9.64 27.96 2.36 24 BAYES_999 60276 10.25 27.57 3.36 25 T_KAM_HTML_FONT_INVALID 59190 18.98 27.07 15.77 26 XMSubLong 54697 21.29 25.02 19.81 27 RCVD_IN_MSPIKE_WL 47932 28.28 21.92 30.81 28 XM_Body_Dirty_Words 46101 14.52 21.08 11.91 29 T_TM2_M_HEADER_IN_MSG 42604 23.77 19.48 25.47 30 RELAYCOUNTRY_META 40576 8.42 18.56 4.39 31 DCC_CHECK_NEGATIVE 37240 45.68 17.03 57.07 32 LOTS_OF_MONEY 33387 8.86 15.27 6.31 33 XM_Multi_Part_URI 31354 12.19 14.34 11.33 34 XM_B_SpammyWords3 30412 7.25 13.91 4.60 35 BOTNET 30067 5.32 13.75 1.96 36 TR_XM_SpammyWords2 29881 4.36 13.67 0.66 37 TR_XM_SpammyWords4 28415 6.69 13.00 4.18 38 BOTNET_IPINHOSTNAME 27155 6.68 12.42 4.40 39 RCVD_IN_MSPIKE_H3 26379 14.13 12.06 14.95 40 RCVD_IN_BL_SPAMCOP_NET 25864 4.24 11.83 1.22 41 XM_B_Unsub 23769 9.61 10.87 9.11 42 UNTRUSTED_Relay 22763 4.09 10.41 1.57 43 MPART_ALT_DIFF 21591 8.53 9.87 7.99 44 XM_Evil_Numbers_Gen 21587 9.13 9.87 8.83 45 HTML_IMAGE_RATIO_02 21100 7.00 9.65 5.95 46 XMSexyCombo_05 20503 5.86 9.38 4.46 47 LotsOfNums_01 20330 8.66 9.30 8.40 48 XM_UncommonTLD01 19874 4.72 9.09 2.98 49 RCVD_IN_MSPIKE_H4 19282 10.49 8.82 11.16 50 BAYES_80 19219 5.66 8.79 4.41 51 TooManyTo_001 18866 7.83 8.63 7.51 52 XM_H_Long_From01 17751 5.93 8.12 5.06 53 BAYES_60 17191 7.35 7.86 7.15 54 UNPARSEABLE_RELAY 16630 7.33 7.61 7.23 55 FSL_BULK_SIG 16305 6.22 7.46 5.73 56 TR_XM_UnparsRelay 16059 5.90 7.34 5.33 57 XM_B_Phish_Phrases 15947 7.55 7.29 7.66 58 URIBL_DBL_SPAM 14857 1.95 6.79 0.02 59 MIME_HTML_MOSTLY 14478 3.54 6.62 2.32 60 RELAYCOUNTRY_CA 14460 2.77 6.61 1.24 61 TR_XM_PhishingBody 13908 3.73 6.36 2.68 62 HTML_IMAGE_RATIO_04 13797 10.73 6.31 12.49 63 XM_SendGrid 13037 6.39 5.96 6.56 64 XMSubMetaSx_00 12519 4.09 5.73 3.44 65 XM_OfRef6 12479 2.29 5.71 0.93 66 ALL_TRUSTED 12384 9.69 5.66 11.30 67 URIBL_SBL_A 12344 2.89 5.65 1.80 68 XM_DK_Undo_01 11597 2.58 5.30 1.50 69 BAYES_95 11571 3.42 5.29 2.67 70 XM_B_SpammyTLD 10881 2.70 4.98 1.79 71 SpammyFromTLD_01 10119 1.90 4.63 0.81 72 TM2_M_URI_OPT_OUT 9301 2.81 4.25 2.23 73 HTML_IMAGE_RATIO_08 9165 2.74 4.19 2.16 74 PDS_SHORT_SPOOFED_URL 9156 1.20 4.19 0.01 75 PDS_NO_FULL_NAME_SPOOFED_URL 9142 1.20 4.18 0.01 76 XM_UB50 8998 1.87 4.12 0.97 77 RCVD_IN_RP_SAFE 8995 6.86 4.11 7.96 78 DKIM_INVALID 8631 3.40 3.95 3.18 79 XMStrtUSub 8565 10.19 3.92 12.69 80 MIME_HTML_ONLY_MULTI 8411 5.61 3.85 6.30 81 TR_LOTS_OF_MONEY3 8329 1.33 3.81 0.35 82 XM_SPF_SoftFail 7947 2.18 3.63 1.60 83 MIME_QP_LONG_LINE 7615 4.76 3.48 5.27 84 RCVD_IN_MSPIKE_BL 7557 1.12 3.46 0.19 85 XM_B_Phish66 7370 2.19 3.37 1.72 86 TR_XM_MSPIKECOMBO 7316 1.08 3.35 0.18 87 XMBody_17 7316 1.38 3.35 0.60 88 TR_XM_SpammyWords5 7313 1.92 3.34 1.35 89 HTML_IMAGE_RATIO_06 7280 4.22 3.33 4.58 90 TR_XM_DK_SendGrid 7203 3.85 3.29 4.08 91 FORGED_GMAIL_RCVD 7066 1.37 3.23 0.62 92 RCVD_IN_RP_CERTIFIED 6983 6.17 3.19 7.36 93 XMNumbers 6925 2.83 3.17 2.69 94 RELAYCOUNTRY_FR 6921 1.08 3.17 0.25 95 FROM_EXCESS_BASE64 6859 3.10 3.14 3.09 96 TooManyTo_002 6702 2.32 3.07 2.03 97 XMDiploma_00 6582 1.88 3.01 1.44 98 SHORT_URI_2 6457 0.87 2.95 0.04 99 TR_XM_MaxBayes 6390 0.85 2.92 0.02 100 XM_UB99 6033 0.79 2.76 0.01 101 XMBdyGiftCard01 5995 1.29 2.74 0.72 102 URI_HEX 5959 1.73 2.73 1.34 103 T_FILL_THIS_FORM_SHORT 5856 1.28 2.68 0.73 104 XM_B_COVIDMETA 5561 1.46 2.54 1.03 105 XM_CamelCaseFrm001 5521 1.96 2.52 1.74 106 XM_DIRTYINTL 5437 1.00 2.49 0.40 107 T_XMDrugObfuBody_08 5419 1.59 2.48 1.23 108 T_XMHurry_00 5409 1.31 2.47 0.85 109 RCVD_IN_RP_RNBL 5307 0.71 2.43 0.02 110 RCVD_IN_MSPIKE_L5 5302 0.75 2.42 0.08 111 GOOGLE_DOC_SUSP 5238 0.69 2.40 0.01 112 SpammyFromTLD_02 4986 0.84 2.28 0.27 113 T_TooManySym_01 4869 3.85 2.23 4.49 114 XM_B_SpammyWords4 4860 1.03 2.22 0.56 115 XM_UB999 4758 0.62 2.18 0.01 116 RCVD_IN_PSBL 4728 0.69 2.16 0.11 117 RCVD_IN_IADB_LISTED 4702 4.25 2.15 5.08 118 TooManyTo_003 4695 1.55 2.15 1.32 119 T_XMDrugObfuBody_14 4636 2.21 2.12 2.24 120 XMBrknScrpt_02 4586 1.06 2.10 0.65 121 TM2_M_VERY_LONG_WORD 4400 1.45 2.01 1.22 122 URI_TRY_3LD 4321 1.24 1.98 0.94 123 RCVD_IN_IADB_SPF 4259 3.77 1.95 4.50 124 TR_XM_SB_Phish 4206 1.91 1.92 1.91 125 BAYES_40 4171 4.53 1.91 5.57 126 XMSubPhish11 4080 1.88 1.87 1.88 127 PDS_OTHER_BAD_TLD 4074 0.88 1.86 0.49 128 XM_B_Unsub2 4070 1.55 1.86 1.42 129 SUBJ_ALL_CAPS 4066 1.59 1.86 1.49 130 RCVD_IN_IADB_SENDERID 4063 3.43 1.86 4.05 131 RCVD_IN_IADB_DK 4051 3.28 1.85 3.85 132 XMStockSpam_06 4049 1.54 1.85 1.42 133 XMSexyCombo_01 4023 0.87 1.84 0.49 134 XM_URI_RBL 3997 0.64 1.83 0.17 135 XMSubMetaI_00 3903 1.04 1.79 0.75 136 T_REMOTE_IMAGE 3842 2.89 1.76 3.34 137 TR_XM_SpammyWords3 3842 0.57 1.76 0.10 138 TR_XM_BayesRelay 3828 0.51 1.75 0.02 139 XMGenDplmaNmb 3781 1.01 1.73 0.72 140 URI_NOVOWEL 3740 2.28 1.71 2.50 141 BOTNET_NORDNS 3697 0.49 1.69 0.01 142 KHOP_HELO_FCRDNS 3618 1.52 1.65 1.46 143 XM_OfRef7 3616 0.58 1.65 0.15 144 FILL_THIS_FORM 3513 0.58 1.61 0.18 145 XMSlimDrugH 3503 0.60 1.60 0.20 146 URI_PHP_REDIR 3415 0.45 1.56 0.00 147 MONEY_FORM 3364 0.44 1.54 0.01 148 BAYES_20 3357 3.59 1.54 4.41 149 TR_XM_FormFill 3346 0.44 1.53 0.01 150 MAILING_LIST_MULTI 3277 2.30 1.50 2.62 151 FILL_THIS_FORM_LONG 3276 0.46 1.50 0.04 152 DEAR_BENEFICIARY 3182 0.42 1.46 0.00 153 URG_BIZ 3123 0.43 1.43 0.04 154 XMHTML_After_End 3095 1.06 1.42 0.92 155 HK_RANDOM_REPLYTO 3025 0.50 1.38 0.15 156 HTML_MIME_NO_HTML_TAG 3022 1.64 1.38 1.75 157 TR_XM_PHPDW 3008 0.64 1.38 0.35 158 TR_XM_INV_DKIM 2977 0.45 1.36 0.09 159 TR_XM_COVIDMETA4 2928 0.65 1.34 0.37 160 TR_XM_PHPForged 2923 0.60 1.34 0.30 161 TR_XM_FormFill2 2894 0.60 1.32 0.31 162 XM_H_PHPOS 2884 0.59 1.32 0.29 163 XMPhish08 2868 0.48 1.31 0.15 164 ADVANCE_FEE_3_NEW_FRM_MNY 2861 0.37 1.31 0.00 165 URIBL_BLACK 2840 0.39 1.30 0.03 166 T_XMDrugObfuBody_00 2826 0.86 1.29 0.68 167 HTTPS_HTTP_MISMATCH 2799 0.92 1.28 0.77 168 FILL_THIS_FORM_FRAUD_PHISH 2787 0.38 1.27 0.03 169 TooManyTo_004 2763 1.06 1.26 0.98 170 XM_iOS_Forged_Message 2744 0.36 1.25 0.00 171 MONEY_FRAUD_3 2694 0.35 1.23 0.00 172 XMMoneyMeta_00 2693 0.82 1.23 0.66 173 SHORT_URI_3 2662 0.37 1.22 0.04 174 FROM_SUSPICIOUS_NTLD 2646 0.39 1.21 0.06 175 TR_XM_COVIDMETA1 2633 0.53 1.20 0.26 176 BAYES_00 2612 12.82 1.19 17.45 177 FROM_SUSPICIOUS_NTLD_FP 2554 0.37 1.17 0.05 178 XM_UB60 2496 0.39 1.14 0.09 179 NUMERIC_HTTP_ADDR 2456 0.55 1.12 0.32 180 XM_UB80 2353 0.32 1.08 0.02 181 TR_Symld_Words 2349 1.24 1.07 1.31 182 RELAYCOUNTRY_DE 2348 0.62 1.07 0.44 183 RELAYCOUNTRY_NL 2317 0.45 1.06 0.20 184 HTML_TAG_BALANCE_BODY 2283 0.49 1.04 0.27 185 RCVD_IN_MSPIKE_H5 2271 3.66 1.04 4.70 186 XMPhish30 2150 0.58 0.98 0.42 187 XM_H_Long_From02 2137 0.94 0.98 0.93 188 XMSubNoVowel 2135 2.55 0.98 3.18 189 XMSubEmpty 2119 0.42 0.97 0.21 190 T_Symld_Words_02 2067 0.57 0.95 0.42 191 TR_XM_RelayPhish 2045 0.32 0.94 0.08 192 HTML_FONT_SIZE_HUGE 2037 0.37 0.93 0.14 193 XM_S_SpammyWords 2030 0.51 0.93 0.35 194 TR_XM_Spammywords 2028 0.51 0.93 0.35 195 TR_Mismatch_TLD_02 2001 0.32 0.92 0.09 196 XM_Body_Dirty_Words_01 1995 0.45 0.91 0.27 197 TR_XM_DK_Bayes 1965 6.95 0.90 9.36 198 URI_NO_WWW_BIZ_CGI 1964 0.26 0.90 0.01 199 RDNS_DYNAMIC 1952 0.59 0.89 0.48 200 RELAYCOUNTRY_IN 1933 0.33 0.88 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 481745 90.26 96.80 87.66 2 RELAYCOUNTRY_US 470486 83.08 76.70 85.61 3 DKIM_SIGNED 400154 76.71 86.49 72.81 4 XM_B_Unicode 397336 73.70 77.23 72.30 5 XM_DK_Pass 393911 75.35 84.57 71.68 6 DKIM_VALID 382680 73.31 82.54 69.63 7 DCC_CHECK_NEGATIVE 313654 45.68 17.03 57.07 8 DKIM_VALID_AU 296005 56.53 63.25 53.86 9 BAYES_50 281059 47.28 37.57 51.14 10 XM_B_SpammyWords 269803 55.29 70.88 49.09 11 XMListUnsubscribeExists 253442 53.57 72.31 46.12 12 XM_B_Unicode3 240615 43.37 42.32 43.78 13 DCC_CHECK 225131 52.39 81.09 40.97 14 RCVD_IN_MSPIKE_WL 169306 28.28 21.92 30.81 15 DKIM_VALID_EF 158476 28.95 29.24 28.84 16 HTML_FONT_LOW_CONTRAST 143746 27.98 32.57 26.16 17 T_TM2_M_HEADER_IN_MSG 139997 23.77 19.48 25.47 18 RCVD_IN_MSPIKE_H2 139283 27.23 31.98 25.34 19 MIME_HTML_ONLY 125687 24.40 28.25 22.87 20 LOC_TINY_FONT_1 124866 27.23 38.57 22.72 21 FVGT_m_MULTI_ODD 119243 23.75 28.92 21.70 22 XMSubLong 108875 21.29 25.02 19.81 23 XM_B_SpammyWords2 101094 24.84 41.02 18.40 24 BAYES_00 95888 12.82 1.19 17.45 25 T_KAM_HTML_FONT_INVALID 86640 18.98 27.07 15.77 26 RCVD_IN_MSPIKE_H3 82161 14.13 12.06 14.95 27 XMStrtUSub 69751 10.19 3.92 12.69 28 HTML_IMAGE_RATIO_04 68651 10.73 6.31 12.49 29 XM_Body_Dirty_Words 65450 14.52 21.08 11.91 30 XM_DKIMWhitelistDomains 62518 8.24 0.36 11.38 31 XM_Multi_Part_URI 62286 12.19 14.34 11.33 32 ALL_TRUSTED 62078 9.69 5.66 11.30 33 RCVD_IN_MSPIKE_H4 61332 10.49 8.82 11.16 34 XM_H_Trusted_IP 53260 6.93 0.00 9.69 35 TR_XM_DK_Bayes 51412 6.95 0.90 9.36 36 HTML_FONT_FACE_BAD 51139 6.81 0.55 9.31 37 XM_B_Unsub 50044 9.61 10.87 9.11 38 TR_XM_DK_Bayes1 49307 6.67 0.87 8.97 39 XM_Evil_Numbers_Gen 48526 9.13 9.87 8.83 40 LotsOfNums_01 46159 8.66 9.30 8.40 41 MPART_ALT_DIFF 43933 8.53 9.87 7.99 42 RCVD_IN_RP_SAFE 43725 6.86 4.11 7.96 43 TR_XM_DK_Bayes2 42707 5.77 0.75 7.77 44 XM_B_Phish_Phrases 42085 7.55 7.29 7.66 45 TooManyTo_001 41289 7.83 8.63 7.51 46 RCVD_IN_RP_CERTIFIED 40426 6.17 3.19 7.36 47 XM_DK_Undo_02 40175 19.14 48.88 7.31 48 UNPARSEABLE_RELAY 39713 7.33 7.61 7.23 49 BAYES_60 39297 7.35 7.86 7.15 50 XM_SendGrid 36048 6.39 5.96 6.56 51 LOTS_OF_MONEY 34686 8.86 15.27 6.31 52 MIME_HTML_ONLY_MULTI 34648 5.61 3.85 6.30 53 HTML_IMAGE_RATIO_02 32693 7.00 9.65 5.95 54 FSL_BULK_SIG 31467 6.22 7.46 5.73 55 BAYES_40 30618 4.53 1.91 5.57 56 TR_XM_DKIM_Undo 29334 15.72 41.83 5.34 57 TR_XM_UnparsRelay 29276 5.90 7.34 5.33 58 MIME_QP_LONG_LINE 28956 4.76 3.48 5.27 59 IN_ZIMBRA_NJ_WHITELIST 28191 3.68 0.05 5.13 60 RCVD_IN_IADB_LISTED 27939 4.25 2.15 5.08 61 XM_H_Long_From01 27827 5.93 8.12 5.06 62 RCVD_IN_MSPIKE_H5 25813 3.66 1.04 4.70 63 XM_B_SpammyWords3 25287 7.25 13.91 4.60 64 HTML_IMAGE_RATIO_06 25147 4.22 3.33 4.58 65 RCVD_IN_IADB_SPF 24707 3.77 1.95 4.50 66 T_TooManySym_01 24669 3.85 2.23 4.49 67 XMSexyCombo_05 24527 5.86 9.38 4.46 68 BAYES_20 24253 3.59 1.54 4.41 69 BAYES_80 24238 5.66 8.79 4.41 70 BOTNET_IPINHOSTNAME 24173 6.68 12.42 4.40 71 RELAYCOUNTRY_META 24127 8.42 18.56 4.39 72 BAYES_99 23229 13.00 35.03 4.23 73 TR_XM_SpammyWords4 22946 6.69 13.00 4.18 74 TR_XM_DK_SendGrid 22398 3.85 3.29 4.08 75 RCVD_IN_IADB_SENDERID 22284 3.43 1.86 4.05 76 RCVD_IN_IADB_DK 21148 3.28 1.85 3.85 77 XM_PDF 20367 2.86 0.74 3.71 78 XMSubMetaSx_00 18900 4.09 5.73 3.44 79 BAYES_999 18458 10.25 27.57 3.36 80 T_REMOTE_IMAGE 18362 2.89 1.76 3.34 81 DKIM_INVALID 17474 3.40 3.95 3.18 82 XMSubNoVowel 17461 2.55 0.98 3.18 83 FROM_EXCESS_BASE64 16982 3.10 3.14 3.09 84 RCVD_IN_IADB_VOUCHED 16682 2.40 0.79 3.04 85 XM_UncommonTLD01 16360 4.72 9.09 2.98 86 BAYES_05 16255 2.35 0.82 2.96 87 XMNumbers 14804 2.83 3.17 2.69 88 TR_XM_PhishingBody 14735 3.73 6.36 2.68 89 BAYES_95 14698 3.42 5.29 2.67 90 MAILING_LIST_MULTI 14411 2.30 1.50 2.62 91 URI_NOVOWEL 13746 2.28 1.71 2.50 92 TR_DCC_Bayes_99 12960 9.64 27.96 2.36 93 MIME_HTML_MOSTLY 12755 3.54 6.62 2.32 94 T_XMDrugObfuBody_14 12307 2.21 2.12 2.24 95 TM2_M_URI_OPT_OUT 12265 2.81 4.25 2.23 96 ANY_BOUNCE_MESSAGE 11972 1.66 0.35 2.18 97 BOUNCE_MESSAGE 11972 1.66 0.35 2.18 98 HTML_IMAGE_RATIO_08 11852 2.74 4.19 2.16 99 T_TooManySym_02 11604 1.68 0.59 2.11 100 TooManyTo_002 11150 2.32 3.07 2.03 101 RCVD_IN_IADB_OPTIN 11013 1.57 0.48 2.00 102 BOTNET 10773 5.32 13.75 1.96 103 TR_XM_SB_Phish 10505 1.91 1.92 1.91 104 XMSubPhish11 10356 1.88 1.87 1.88 105 URIBL_SBL_A 9889 2.89 5.65 1.80 106 XM_B_SpammyTLD 9854 2.70 4.98 1.79 107 HTML_MIME_NO_HTML_TAG 9612 1.64 1.38 1.75 108 XM_CamelCaseFrm001 9571 1.96 2.52 1.74 109 XM_B_Phish66 9447 2.19 3.37 1.72 110 HELO_NODOT 9032 1.30 0.42 1.64 111 HELO_NO_DOMAIN 9031 1.29 0.42 1.64 112 XM_SPF_SoftFail 8784 2.18 3.63 1.60 113 UNTRUSTED_Relay 8636 4.09 10.41 1.57 114 XM_DK_Undo_01 8242 2.58 5.30 1.50 115 SUBJ_ALL_CAPS 8184 1.59 1.86 1.49 116 KHOP_HELO_FCRDNS 8025 1.52 1.65 1.46 117 XMDiploma_00 7895 1.88 3.01 1.44 118 XM_B_Unsub2 7813 1.55 1.86 1.42 119 XMStockSpam_06 7808 1.54 1.85 1.42 120 IN_HORDE_ADDRESS_BOOK 7780 1.04 0.08 1.42 121 TVD_RCVD_IP 7705 1.06 0.20 1.40 122 TR_XM_SpammyWords5 7445 1.92 3.34 1.35 123 URI_HEX 7350 1.73 2.73 1.34 124 TooManyTo_003 7242 1.55 2.15 1.32 125 INVALID_MSGID 7208 1.05 0.38 1.31 126 TR_Symld_Words 7201 1.24 1.07 1.31 127 RELAYCOUNTRY_CA 6838 2.77 6.61 1.24 128 T_XMDrugObfuBody_08 6759 1.59 2.48 1.23 129 TM2_M_VERY_LONG_WORD 6732 1.45 2.01 1.22 130 RCVD_IN_BL_SPAMCOP_NET 6689 4.24 11.83 1.22 131 XMSubGarbage 6572 0.88 0.09 1.20 132 MSGID_NOFQDN1 6529 0.86 0.03 1.19 133 TO_MALFORMED 6431 0.84 0.01 1.17 134 XMSubLongNoVowel 6345 0.89 0.21 1.15 135 HELO_MISC_IP 5983 0.83 0.17 1.09 136 XM_GoogleGroups 5933 0.91 0.50 1.08 137 XMCapTrack 5927 0.86 0.31 1.08 138 TR_MSPIKEBAYES00 5731 0.76 0.04 1.04 139 USER_IN_DEF_DKIM_WL 5676 0.74 0.00 1.03 140 XM_B_COVIDMETA 5647 1.46 2.54 1.03 141 TooManyTo_004 5365 1.06 1.26 0.98 142 XM_UB50 5356 1.87 4.12 0.97 143 XMBSHREFv2 5283 0.77 0.29 0.96 144 URI_TRY_3LD 5173 1.24 1.98 0.94 145 RELAYCOUNTRY_GB 5171 0.91 0.83 0.94 146 XM_OfRef6 5125 2.29 5.71 0.93 147 XM_H_Long_From02 5107 0.94 0.98 0.93 148 XMHTML_After_End 5052 1.06 1.42 0.92 149 XMGappySubj_01 4943 0.71 0.25 0.90 150 DKIM_ADSP_CUSTOM_MED 4753 0.81 0.67 0.86 151 T_XMHurry_00 4656 1.31 2.47 0.85 152 FROM_GOV_DKIM_AU 4507 0.64 0.18 0.82 153 SpammyFromTLD_01 4476 1.90 4.63 0.81 154 TooManyTo_005 4402 0.69 0.39 0.80 155 HTTPS_HTTP_MISMATCH 4234 0.92 1.28 0.77 156 XMSubMetaI_00 4100 1.04 1.79 0.75 157 XMBody_95 4059 0.57 0.13 0.74 158 T_FILL_THIS_FORM_SHORT 4011 1.28 2.68 0.73 159 XMBdyGiftCard01 3942 1.29 2.74 0.72 160 XMGenDplmaNmb 3940 1.01 1.73 0.72 161 T_XMDrugObfuBody_00 3753 0.86 1.29 0.68 162 TR_XM_SpammyWords2 3628 4.36 13.67 0.66 163 XMMoneyMeta_00 3605 0.82 1.23 0.66 164 XMBrknScrpt_02 3546 1.06 2.10 0.65 165 TVD_SPACE_RATIO 3494 0.54 0.29 0.64 166 FORGED_GMAIL_RCVD 3427 1.37 3.23 0.62 167 XMSubMetaSxObfu_02 3342 0.54 0.35 0.61 168 XM_ProductURIs 3319 0.65 0.77 0.60 169 XMBody_17 3281 1.38 3.35 0.60 170 TR_MetaPhish_Combo_01 3234 0.65 0.80 0.59 171 NML_ADSP_CUSTOM_MED 3156 0.56 0.53 0.57 172 T_OBFU_PDF_ATTACH 3093 0.46 0.19 0.56 173 XM_B_SpammyWords4 3063 1.03 2.22 0.56 174 T_TooManySym_03 3056 0.44 0.15 0.56 175 XM_SPF_Unknown 2811 0.59 0.78 0.51 176 XM_ShortIntro_01 2801 0.55 0.66 0.51 177 RCVD_IN_SORBS_DUL 2760 0.40 0.15 0.50 178 XM_H_PHPMailer 2733 0.51 0.55 0.50 179 SHORT_HELO_AND_INLINE_IMAGE 2724 0.37 0.06 0.50 180 PDS_OTHER_BAD_TLD 2692 0.88 1.86 0.49 181 XMSexyCombo_01 2683 0.87 1.84 0.49 182 XM_B_COPY_HTML 2672 0.53 0.64 0.49 183 XMBody_78 2650 0.57 0.80 0.48 184 XMNoVowels 2628 0.55 0.73 0.48 185 RDNS_DYNAMIC 2612 0.59 0.89 0.48 186 XMHTMLBadTable_001 2504 0.43 0.38 0.46 187 RELAYCOUNTRY_DE 2434 0.62 1.07 0.44 188 XMSubMetaSxObfu_03 2336 0.48 0.63 0.43 189 HTML_IMAGE_ONLY_20 2304 0.36 0.23 0.42 190 XMPhish30 2296 0.58 0.98 0.42 191 T_Symld_Words_02 2289 0.57 0.95 0.42 192 MISSING_HEADERS 2230 0.40 0.37 0.41 193 XM_DIRTYINTL 2225 1.00 2.49 0.40 194 FROM_GOV_SPOOF 2159 0.31 0.09 0.39 195 HTML_IMAGE_ONLY_28 2153 0.39 0.39 0.39 196 XMLngstWrd_00 2133 0.37 0.31 0.39 197 TR_BOTNET_NEGATE 2108 0.51 0.82 0.38 198 XM_Body_Obfu01 2099 0.52 0.85 0.38 199 SHOPIFY_IMG_NOT_RCVD_SFY 2097 0.37 0.34 0.38 200 TM2_M_BODY_EMPTY 2059 0.29 0.07 0.37 ----------------------------------------------------------------------