Email: 728507 Autolearn: 0 AvgScore: 3.33 AvgScanTime: 1.45 sec Spam: 209980 Autolearn: 0 AvgScore: 13.51 AvgScanTime: 1.67 sec Ham: 518527 Autolearn: 0 AvgScore: -0.79 AvgScanTime: 1.36 sec Time Spent Running SA: 293.69 hours Time Spent Processing Spam: 97.68 hours Time Spent Processing Ham: 196.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 203478 89.73 96.90 86.82 2 DKIM_SIGNED 191766 82.73 91.33 79.26 3 XM_DK_Pass 187492 81.29 89.29 78.06 4 DKIM_VALID 182938 79.24 87.12 76.05 5 XM_B_Unicode 174041 73.97 82.88 70.36 6 RELAYCOUNTRY_US 171606 83.94 81.72 84.83 7 DCC_CHECK 166160 54.08 79.13 43.94 8 XMListUnsubscribeExists 163473 59.16 77.85 51.59 9 XM_B_SpammyWords 155801 57.28 74.20 50.43 10 DKIM_VALID_AU 140674 60.70 66.99 58.14 11 XM_DK_Undo_02 106451 20.20 50.70 7.85 12 XM_B_SpammyWords2 95564 27.51 45.51 20.21 13 XM_B_Unicode3 94804 42.99 45.15 42.12 14 TR_XM_DKIM_Undo 89098 16.14 42.43 5.49 15 LOC_TINY_FONT_1 88903 29.82 42.34 24.75 16 BAYES_99 78626 14.19 37.44 4.77 17 HTML_FONT_LOW_CONTRAST 77835 30.45 37.07 27.77 18 BAYES_50 77650 49.71 36.98 54.87 19 DKIM_VALID_EF 67843 31.44 32.31 31.08 20 RCVD_IN_MSPIKE_H2 67644 28.92 32.21 27.59 21 FVGT_m_MULTI_ODD 65361 25.74 31.13 23.55 22 T_KAM_HTML_FONT_INVALID 64824 22.05 30.87 18.47 23 BAYES_999 62878 11.31 29.94 3.77 24 TR_DCC_Bayes_99 61524 10.18 29.30 2.43 25 MIME_HTML_ONLY 60061 22.96 28.60 20.68 26 XMSubLong 52619 22.12 25.06 20.92 27 RCVD_IN_MSPIKE_WL 50117 30.45 23.87 33.11 28 T_TM2_M_HEADER_IN_MSG 48048 26.47 22.88 27.93 29 XM_Body_Dirty_Words 43462 14.62 20.70 12.16 30 DCC_CHECK_NEGATIVE 40458 43.89 19.27 53.86 31 RELAYCOUNTRY_META 38751 8.81 18.45 4.90 32 XM_B_SpammyWords3 35895 8.36 17.09 4.82 33 XM_Multi_Part_URI 33766 13.72 16.08 12.77 34 TR_XM_SpammyWords2 32188 4.93 15.33 0.72 35 LOTS_OF_MONEY 28512 8.31 13.58 6.17 36 RCVD_IN_MSPIKE_H3 27624 15.13 13.16 15.93 37 BOTNET 27378 5.15 13.04 1.96 38 BOTNET_IPINHOSTNAME 27216 7.00 12.96 4.59 39 TR_XM_SpammyWords4 24923 6.10 11.87 3.77 40 HTML_IMAGE_RATIO_02 24582 8.48 11.71 7.18 41 XM_B_Unsub 24396 10.22 11.62 9.65 42 XM_Evil_Numbers_Gen 23964 9.40 11.41 8.58 43 RCVD_IN_BL_SPAMCOP_NET 23014 4.01 10.96 1.19 44 XM_UncommonTLD01 20805 5.11 9.91 3.17 45 XMSexyCombo_05 20487 5.47 9.76 3.74 46 RCVD_IN_MSPIKE_H4 20252 11.49 9.64 12.23 47 LotsOfNums_01 20048 9.34 9.55 9.25 48 UNTRUSTED_Relay 19574 3.92 9.32 1.73 49 MPART_ALT_DIFF 17582 5.53 8.37 4.38 50 UNPARSEABLE_RELAY 17360 8.31 8.27 8.33 51 TR_XM_UnparsRelay 16955 6.91 8.07 6.43 52 BAYES_80 16810 5.86 8.01 5.00 53 TooManyTo_001 16380 7.97 7.80 8.05 54 XM_B_Phish_Phrases 16154 8.02 7.69 8.15 55 RELAYCOUNTRY_CA 15833 3.16 7.54 1.39 56 FSL_BULK_SIG 15254 5.99 7.26 5.47 57 XM_H_Long_From01 14955 5.89 7.12 5.39 58 TR_XM_PhishingBody 14866 4.03 7.08 2.79 59 BAYES_60 14467 7.59 6.89 7.87 60 XM_SendGrid 14145 7.35 6.74 7.59 61 MIME_HTML_MOSTLY 13334 3.50 6.35 2.35 62 XMSubMetaSx_00 13096 4.24 6.24 3.44 63 HTML_IMAGE_RATIO_04 12188 6.08 5.80 6.20 64 URIBL_SBL_A 10803 2.86 5.14 1.94 65 XM_OfRef6 10569 2.17 5.03 1.01 66 XMStrtUSub 10326 7.50 4.92 8.54 67 XM_B_SpammyTLD 10194 3.01 4.85 2.26 68 BAYES_95 9939 3.45 4.73 2.93 69 RCVD_IN_RP_SAFE 9190 7.36 4.38 8.57 70 DKIM_INVALID 8828 3.50 4.20 3.21 71 XMBody_17 8645 1.73 4.12 0.76 72 TR_XM_SpammyWords5 8382 2.25 3.99 1.54 73 SpammyFromTLD_02 8335 1.36 3.97 0.30 74 TM2_M_URI_OPT_OUT 8325 2.98 3.96 2.58 75 XM_DK_Undo_01 8276 2.16 3.94 1.44 76 TR_XM_DK_SendGrid 8238 4.57 3.92 4.83 77 URI_HEX 7782 2.18 3.71 1.56 78 XM_B_Phish66 7561 2.24 3.60 1.69 79 XM_UB50 7374 1.77 3.51 1.06 80 TM2_M_VERY_LONG_WORD 7330 2.11 3.49 1.56 81 XMNumbers 7228 3.14 3.44 3.02 82 XM_SPF_SoftFail 7190 2.09 3.42 1.55 83 XMDiploma_00 7060 1.97 3.36 1.41 84 HTML_IMAGE_RATIO_06 7055 3.30 3.36 3.27 85 MIME_QP_LONG_LINE 7043 5.28 3.35 6.06 86 MIME_HTML_ONLY_MULTI 6764 2.90 3.22 2.76 87 RCVD_IN_RP_CERTIFIED 6760 6.45 3.22 7.76 88 HTML_IMAGE_RATIO_08 6692 2.70 3.19 2.51 89 FROM_EXCESS_BASE64 6546 2.93 3.12 2.85 90 SpammyFromTLD_01 6480 1.42 3.09 0.75 91 RELAYCOUNTRY_FR 6332 1.06 3.02 0.27 92 XM_CamelCaseFrm001 6280 2.48 2.99 2.27 93 RCVD_IN_MSPIKE_BL 6074 0.97 2.89 0.19 94 T_XMHurry_00 6046 1.32 2.88 0.69 95 TR_XM_MSPIKECOMBO 5970 0.95 2.84 0.18 96 XMBdyGiftCard01 5781 1.41 2.75 0.87 97 TR_LOTS_OF_MONEY3 5720 1.09 2.72 0.43 98 URIBL_DBL_SPAM 5650 0.78 2.69 0.01 99 T_FILL_THIS_FORM_SHORT 5639 1.30 2.69 0.74 100 PDS_OTHER_BAD_TLD 5514 1.25 2.63 0.70 101 XM_B_Unsub2 5401 1.85 2.57 1.56 102 XM_B_SpammyWords4 5329 1.19 2.54 0.64 103 T_TooManySym_01 5219 4.45 2.49 5.25 104 TR_XM_MaxBayes 5215 0.73 2.48 0.02 105 XMBrknScrpt_02 5036 1.24 2.40 0.77 106 T_XMDrugObfuBody_14 4972 2.41 2.37 2.42 107 XM_B_COVIDMETA 4957 1.20 2.36 0.73 108 T_REMOTE_IMAGE 4902 3.23 2.33 3.59 109 XM_DIRTYINTL 4865 0.98 2.32 0.44 110 XM_UB99 4771 0.66 2.27 0.00 111 SUBJ_ALL_CAPS 4712 1.72 2.24 1.51 112 T_XMDrugObfuBody_08 4578 1.51 2.18 1.24 113 RCVD_IN_IADB_LISTED 4544 4.77 2.16 5.82 114 RCVD_IN_RP_RNBL 4367 0.61 2.08 0.02 115 XM_URI_RBL 4344 0.74 2.07 0.20 116 BAYES_40 4304 4.34 2.05 5.26 117 FROM_SUSPICIOUS_NTLD 4162 0.61 1.98 0.06 118 URI_TRY_3LD 4145 1.35 1.97 1.09 119 XMSexyCombo_01 4141 1.07 1.97 0.70 120 RCVD_IN_MSPIKE_L5 4086 0.61 1.95 0.07 121 TR_XM_SB_Phish 4066 2.10 1.94 2.17 122 XMGenDplmaNmb 4056 1.07 1.93 0.72 123 FROM_SUSPICIOUS_NTLD_FP 4033 0.59 1.92 0.05 124 TR_XM_BayesRelay 4006 0.57 1.91 0.02 125 RCVD_IN_IADB_SPF 3983 4.17 1.90 5.09 126 URI_NOVOWEL 3930 2.72 1.87 3.07 127 XMSubPhish11 3929 2.06 1.87 2.14 128 XMStockSpam_06 3843 1.35 1.83 1.16 129 RCVD_IN_IADB_SENDERID 3735 3.76 1.78 4.56 130 XM_UB999 3701 0.51 1.76 0.00 131 RCVD_IN_IADB_DK 3701 3.65 1.76 4.41 132 RCVD_IN_PSBL 3688 0.57 1.76 0.09 133 BAYES_20 3645 3.14 1.74 3.71 134 HK_RANDOM_REPLYTO 3454 0.60 1.64 0.17 135 TR_XM_COVIDMETA1 3451 0.73 1.64 0.36 136 MAILING_LIST_MULTI 3440 2.54 1.64 2.90 137 XMHTML_After_End 3437 1.14 1.64 0.94 138 TR_XM_FormFill 3427 0.48 1.63 0.01 139 BOTNET_NORDNS 3404 0.47 1.62 0.01 140 KHOP_HELO_FCRDNS 3390 1.55 1.61 1.52 141 XMPhish08 3321 0.59 1.58 0.20 142 TR_XM_SpammyWords3 3314 0.52 1.58 0.09 143 URIBL_BLACK 3204 0.46 1.53 0.03 144 HTML_MIME_NO_HTML_TAG 3136 1.86 1.49 2.01 145 DATE_IN_PAST_96_XX 3111 0.43 1.48 0.00 146 URI_PHP_REDIR 3021 0.42 1.44 0.00 147 FORGED_GMAIL_RCVD 3019 0.82 1.44 0.57 148 TR_Symld_Words 2865 1.42 1.36 1.44 149 TR_XM_INV_DKIM 2809 0.45 1.34 0.09 150 XMSubMetaI_00 2785 0.84 1.33 0.65 151 TR_XM_COVIDMETA4 2740 0.67 1.30 0.42 152 NUMERIC_HTTP_ADDR 2740 0.57 1.30 0.28 153 HTTPS_HTTP_MISMATCH 2708 0.98 1.29 0.85 154 XM_Body_Obfu01 2651 0.60 1.26 0.33 155 XM_UB60 2619 0.43 1.25 0.10 156 XM_UB80 2588 0.37 1.23 0.02 157 BAYES_00 2456 9.75 1.17 13.22 158 TR_XM_PHPDW 2414 0.55 1.15 0.30 159 TR_XM_PHPForged 2380 0.50 1.13 0.24 160 XM_OfRef7 2339 0.41 1.11 0.12 161 T_XMDrugObfuBody_00 2329 0.87 1.11 0.77 162 XM_Body_Dirty_Words_01 2320 0.55 1.10 0.32 163 TR_XM_FormFill2 2319 0.50 1.10 0.26 164 XM_H_PHPOS 2304 0.49 1.10 0.24 165 RCVD_IN_MSPIKE_H5 2241 3.83 1.07 4.94 166 XMSlimDrugH 2175 0.60 1.04 0.43 167 XM_B_SEO 2149 0.39 1.02 0.14 168 XMPhish30 2138 0.55 1.02 0.35 169 XM_H_Long_From02 2093 1.15 1.00 1.22 170 XM_H_TOP 2074 0.29 0.99 0.00 171 BAYES_05 2071 1.97 0.99 2.36 172 HTML_TAG_BALANCE_BODY 2050 0.57 0.98 0.40 173 TM2_M_A_HREF_HREF 2011 0.52 0.96 0.34 174 XM_Nigeria_01 2002 0.33 0.95 0.07 175 RELAYCOUNTRY_GB 1985 1.07 0.95 1.12 176 RCVD_IN_IADB_VOUCHED 1983 2.82 0.94 3.58 177 ALL_TRUSTED 1973 8.60 0.94 11.71 178 TR_XM_DK_Bayes 1956 7.20 0.93 9.74 179 XMMoneyMeta_00 1954 0.69 0.93 0.59 180 GOOGLE_DOC_SUSP 1910 0.27 0.91 0.01 181 TR_XM_DK_Bayes1 1909 6.93 0.91 9.37 182 TR_BOTNET_NEGATE 1898 0.57 0.90 0.44 183 TR_XM_SEO4 1898 0.33 0.90 0.09 184 TR_MetaPhish_Combo_01 1883 0.80 0.90 0.75 185 RELAYCOUNTRY_NL 1830 0.38 0.87 0.18 186 T_Symld_Words_02 1828 0.67 0.87 0.59 187 TR_XM_RelayPhish 1772 0.43 0.84 0.26 188 XM_ProductURIs 1771 0.65 0.84 0.58 189 SUBJ_DOLLARS 1753 0.47 0.83 0.32 190 XM_PDF 1740 3.30 0.83 4.30 191 LongTLD 1733 0.34 0.83 0.14 192 XMBody_78 1698 0.52 0.81 0.40 193 URI_NO_WWW_BIZ_CGI 1697 0.24 0.81 0.01 194 RDNS_DYNAMIC 1658 0.65 0.79 0.59 195 DKIM_ADSP_CUSTOM_MED 1657 0.90 0.79 0.94 196 LOADSA_MONEY_COMBO 1648 0.26 0.78 0.05 197 TR_XM_DK_Bayes2 1642 6.01 0.78 8.13 198 XMClaimOffer 1631 0.27 0.78 0.07 199 T_MONEY_PERCENT 1626 0.32 0.77 0.14 200 TR_LOTS_OF_MONEY2 1626 0.32 0.77 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 450193 89.73 96.90 86.82 2 RELAYCOUNTRY_US 439879 83.94 81.72 84.83 3 DKIM_SIGNED 410963 82.73 91.33 79.26 4 XM_DK_Pass 404738 81.29 89.29 78.06 5 DKIM_VALID 394322 79.24 87.12 76.05 6 XM_B_Unicode 364819 73.97 82.88 70.36 7 DKIM_VALID_AU 301497 60.70 66.99 58.14 8 BAYES_50 284502 49.71 36.98 54.87 9 DCC_CHECK_NEGATIVE 279281 43.89 19.27 53.86 10 XMListUnsubscribeExists 267497 59.16 77.85 51.59 11 XM_B_SpammyWords 261511 57.28 74.20 50.43 12 DCC_CHECK 227831 54.08 79.13 43.94 13 XM_B_Unicode3 218389 42.99 45.15 42.12 14 RCVD_IN_MSPIKE_WL 171689 30.45 23.87 33.11 15 DKIM_VALID_EF 161177 31.44 32.31 31.08 16 T_TM2_M_HEADER_IN_MSG 144807 26.47 22.88 27.93 17 HTML_FONT_LOW_CONTRAST 143983 30.45 37.07 27.77 18 RCVD_IN_MSPIKE_H2 143064 28.92 32.21 27.59 19 LOC_TINY_FONT_1 128311 29.82 42.34 24.75 20 FVGT_m_MULTI_ODD 122139 25.74 31.13 23.55 21 XMSubLong 108496 22.12 25.06 20.92 22 MIME_HTML_ONLY 107228 22.96 28.60 20.68 23 XM_B_SpammyWords2 104820 27.51 45.51 20.21 24 T_KAM_HTML_FONT_INVALID 95777 22.05 30.87 18.47 25 RCVD_IN_MSPIKE_H3 82625 15.13 13.16 15.93 26 BAYES_00 68558 9.75 1.17 13.22 27 XM_Multi_Part_URI 66191 13.72 16.08 12.77 28 XM_DKIMWhitelistDomains 64493 8.87 0.04 12.44 29 RCVD_IN_MSPIKE_H4 63432 11.49 9.64 12.23 30 XM_Body_Dirty_Words 63071 14.62 20.70 12.16 31 ALL_TRUSTED 60696 8.60 0.94 11.71 32 TR_XM_DK_Bayes 50501 7.20 0.93 9.74 33 XM_B_Unsub 50028 10.22 11.62 9.65 34 TR_XM_DK_Bayes1 48593 6.93 0.91 9.37 35 LotsOfNums_01 47968 9.34 9.55 9.25 36 XM_Evil_Numbers_Gen 44506 9.40 11.41 8.58 37 RCVD_IN_RP_SAFE 44461 7.36 4.38 8.57 38 XMStrtUSub 44287 7.50 4.92 8.54 39 UNPARSEABLE_RELAY 43195 8.31 8.27 8.33 40 XM_B_Phish_Phrases 42276 8.02 7.69 8.15 41 TR_XM_DK_Bayes2 42148 6.01 0.78 8.13 42 TooManyTo_001 41716 7.97 7.80 8.05 43 BAYES_60 40830 7.59 6.89 7.87 44 XM_DK_Undo_02 40702 20.20 50.70 7.85 45 RCVD_IN_RP_CERTIFIED 40260 6.45 3.22 7.76 46 XM_SendGrid 39381 7.35 6.74 7.59 47 HTML_IMAGE_RATIO_02 37229 8.48 11.71 7.18 48 TR_XM_UnparsRelay 33364 6.91 8.07 6.43 49 HTML_IMAGE_RATIO_04 32129 6.08 5.80 6.20 50 LOTS_OF_MONEY 31994 8.31 13.58 6.17 51 MIME_QP_LONG_LINE 31403 5.28 3.35 6.06 52 RCVD_IN_IADB_LISTED 30197 4.77 2.16 5.82 53 TR_XM_DKIM_Undo 28463 16.14 42.43 5.49 54 FSL_BULK_SIG 28377 5.99 7.26 5.47 55 XM_H_Long_From01 27956 5.89 7.12 5.39 56 IN_ZIMBRA_NJ_WHITELIST 27951 3.85 0.06 5.39 57 BAYES_40 27298 4.34 2.05 5.26 58 T_TooManySym_01 27221 4.45 2.49 5.25 59 RCVD_IN_IADB_SPF 26398 4.17 1.90 5.09 60 BAYES_80 25912 5.86 8.01 5.00 61 RCVD_IN_MSPIKE_H5 25632 3.83 1.07 4.94 62 RELAYCOUNTRY_META 25432 8.81 18.45 4.90 63 TR_XM_DK_SendGrid 25067 4.57 3.92 4.83 64 XM_B_SpammyWords3 24998 8.36 17.09 4.82 65 BAYES_99 24744 14.19 37.44 4.77 66 BOTNET_IPINHOSTNAME 23784 7.00 12.96 4.59 67 RCVD_IN_IADB_SENDERID 23628 3.76 1.78 4.56 68 RCVD_IN_IADB_DK 22870 3.65 1.76 4.41 69 MPART_ALT_DIFF 22735 5.53 8.37 4.38 70 XM_PDF 22305 3.30 0.83 4.30 71 BAYES_999 19551 11.31 29.94 3.77 72 TR_XM_SpammyWords4 19533 6.10 11.87 3.77 73 XMSexyCombo_05 19395 5.47 9.76 3.74 74 BAYES_20 19251 3.14 1.74 3.71 75 T_REMOTE_IMAGE 18600 3.23 2.33 3.59 76 RCVD_IN_IADB_VOUCHED 18552 2.82 0.94 3.58 77 XMSubMetaSx_00 17826 4.24 6.24 3.44 78 HTML_IMAGE_RATIO_06 16966 3.30 3.36 3.27 79 DKIM_INVALID 16641 3.50 4.20 3.21 80 XM_UncommonTLD01 16438 5.11 9.91 3.17 81 URI_NOVOWEL 15902 2.72 1.87 3.07 82 XMNumbers 15682 3.14 3.44 3.02 83 BAYES_95 15169 3.45 4.73 2.93 84 MAILING_LIST_MULTI 15055 2.54 1.64 2.90 85 FROM_EXCESS_BASE64 14783 2.93 3.12 2.85 86 TR_XM_PhishingBody 14461 4.03 7.08 2.79 87 MIME_HTML_ONLY_MULTI 14336 2.90 3.22 2.76 88 TM2_M_URI_OPT_OUT 13376 2.98 3.96 2.58 89 XM_H_Trusted_IP 13213 1.81 0.00 2.55 90 HTML_IMAGE_RATIO_08 13001 2.70 3.19 2.51 91 T_TooManySym_02 12681 1.93 0.65 2.45 92 TR_DCC_Bayes_99 12611 10.18 29.30 2.43 93 T_XMDrugObfuBody_14 12573 2.41 2.37 2.42 94 BAYES_05 12246 1.97 0.99 2.36 95 RCVD_IN_IADB_OPTIN 12225 1.86 0.62 2.36 96 MIME_HTML_MOSTLY 12168 3.50 6.35 2.35 97 XM_CamelCaseFrm001 11777 2.48 2.99 2.27 98 XM_B_SpammyTLD 11701 3.01 4.85 2.26 99 TR_XM_SB_Phish 11229 2.10 1.94 2.17 100 XMSubPhish11 11099 2.06 1.87 2.14 101 TooManyTo_002 10817 1.70 0.75 2.09 102 HTML_MIME_NO_HTML_TAG 10444 1.86 1.49 2.01 103 BOTNET 10138 5.15 13.04 1.96 104 URIBL_SBL_A 10061 2.86 5.14 1.94 105 ANY_BOUNCE_MESSAGE 9937 1.48 0.42 1.92 106 BOUNCE_MESSAGE 9937 1.48 0.42 1.92 107 UNTRUSTED_Relay 8962 3.92 9.32 1.73 108 HELO_NO_DOMAIN 8774 1.31 0.38 1.69 109 HELO_NODOT 8774 1.31 0.38 1.69 110 XM_B_Phish66 8762 2.24 3.60 1.69 111 URI_HEX 8106 2.18 3.71 1.56 112 XM_B_Unsub2 8086 1.85 2.57 1.56 113 TM2_M_VERY_LONG_WORD 8065 2.11 3.49 1.56 114 XM_SPF_SoftFail 8027 2.09 3.42 1.55 115 TR_XM_SpammyWords5 7999 2.25 3.99 1.54 116 KHOP_HELO_FCRDNS 7904 1.55 1.61 1.52 117 SUBJ_ALL_CAPS 7842 1.72 2.24 1.51 118 IN_HORDE_ADDRESS_BOOK 7704 1.09 0.11 1.49 119 TR_Symld_Words 7463 1.42 1.36 1.44 120 XM_DK_Undo_01 7453 2.16 3.94 1.44 121 INVALID_MSGID 7438 1.14 0.42 1.43 122 XMDiploma_00 7305 1.97 3.36 1.41 123 RELAYCOUNTRY_CA 7208 3.16 7.54 1.39 124 TVD_RCVD_IP 7183 1.05 0.23 1.39 125 TooManyTo_003 7081 1.16 0.65 1.37 126 MSGID_NOFQDN1 6603 0.93 0.09 1.27 127 T_XMDrugObfuBody_08 6426 1.51 2.18 1.24 128 TO_MALFORMED 6425 0.89 0.01 1.24 129 XM_H_Long_From02 6316 1.15 1.00 1.22 130 RCVD_IN_BL_SPAMCOP_NET 6188 4.01 10.96 1.19 131 HELO_MISC_IP 6033 0.88 0.20 1.16 132 XMStockSpam_06 6014 1.35 1.83 1.16 133 XMCapTrack 5892 0.94 0.44 1.14 134 RELAYCOUNTRY_GB 5782 1.07 0.95 1.12 135 XMGappySubj_01 5706 0.83 0.16 1.10 136 TR_MSPIKEBAYES00 5666 0.78 0.02 1.09 137 URI_TRY_3LD 5660 1.35 1.97 1.09 138 XM_GoogleGroups 5653 0.92 0.51 1.09 139 USER_IN_DEF_DKIM_WL 5580 0.77 0.02 1.08 140 XM_UB50 5518 1.77 3.51 1.06 141 XMBSHREFv2 5304 0.80 0.25 1.02 142 XM_OfRef6 5222 2.17 5.03 1.01 143 TooManyTo_004 5110 0.86 0.57 0.99 144 XMSubNoVowel 5063 0.90 0.70 0.98 145 HTML_FONT_FACE_BAD 4997 0.88 0.66 0.96 146 DKIM_ADSP_CUSTOM_MED 4885 0.90 0.79 0.94 147 XMHTML_After_End 4882 1.14 1.64 0.94 148 XMBdyGiftCard01 4509 1.41 2.75 0.87 149 HTTPS_HTTP_MISMATCH 4429 0.98 1.29 0.85 150 TooManyTo_005 4167 0.72 0.51 0.80 151 XMBody_95 4086 0.61 0.16 0.79 152 T_XMDrugObfuBody_00 3997 0.87 1.11 0.77 153 XMBrknScrpt_02 3996 1.24 2.40 0.77 154 XMBody_17 3946 1.73 4.12 0.76 155 TR_MetaPhish_Combo_01 3914 0.80 0.90 0.75 156 SpammyFromTLD_01 3875 1.42 3.09 0.75 157 T_FILL_THIS_FORM_SHORT 3844 1.30 2.69 0.74 158 XM_B_COVIDMETA 3762 1.20 2.36 0.73 159 XMGenDplmaNmb 3719 1.07 1.93 0.72 160 TR_XM_SpammyWords2 3718 4.93 15.33 0.72 161 XMSexyCombo_01 3622 1.07 1.97 0.70 162 PDS_OTHER_BAD_TLD 3618 1.25 2.63 0.70 163 T_XMHurry_00 3571 1.32 2.88 0.69 164 XMNoVowels 3552 0.64 0.53 0.69 165 FROM_GOV_DKIM_AU 3511 0.55 0.23 0.68 166 TVD_SPACE_RATIO 3408 0.49 0.06 0.66 167 XMSubMetaI_00 3357 0.84 1.33 0.65 168 XM_B_SpammyWords4 3304 1.19 2.54 0.64 169 HTML_IMAGE_ONLY_20 3298 0.52 0.22 0.64 170 NML_ADSP_CUSTOM_MED 3286 0.64 0.64 0.63 171 T_TooManySym_03 3253 0.49 0.16 0.63 172 RELAYCOUNTRY_DE 3188 0.64 0.70 0.61 173 XM_SPF_Unknown 3183 0.59 0.53 0.61 174 T_OBFU_PDF_ATTACH 3121 0.47 0.16 0.60 175 RDNS_DYNAMIC 3079 0.65 0.79 0.59 176 XMMoneyMeta_00 3060 0.69 0.93 0.59 177 T_Symld_Words_02 3037 0.67 0.87 0.59 178 XM_ProductURIs 2983 0.65 0.84 0.58 179 XMHTMLBadTable_001 2980 0.56 0.54 0.57 180 FORGED_GMAIL_RCVD 2933 0.82 1.44 0.57 181 XM_ShortIntro_01 2851 0.49 0.36 0.55 182 XM_H_PHPMailer 2743 0.50 0.41 0.53 183 MSGID_FROM_MTA_HEADER 2551 0.40 0.17 0.49 184 RCVD_IN_SORBS_DUL 2511 0.40 0.18 0.48 185 SHORT_HELO_AND_INLINE_IMAGE 2494 0.37 0.08 0.48 186 XMPhish14 2447 0.55 0.75 0.47 187 XMSolicitRefs_0 2352 0.42 0.34 0.45 188 XMLngstWrd_00 2305 0.42 0.37 0.44 189 TM2_M_BODY_EMPTY 2302 0.33 0.06 0.44 190 SHOPIFY_IMG_NOT_RCVD_SFY 2292 0.41 0.33 0.44 191 XM_DIRTYINTL 2262 0.98 2.32 0.44 192 TR_BOTNET_NEGATE 2258 0.57 0.90 0.44 193 XMSlimDrugH 2217 0.60 1.04 0.43 194 TR_LOTS_OF_MONEY3 2209 1.09 2.72 0.43 195 MISSING_HEADERS 2198 0.44 0.50 0.42 196 DKIM_ADSP_NXDOMAIN 2171 0.43 0.46 0.42 197 TR_XM_COVIDMETA4 2165 0.67 1.30 0.42 198 MPART_ALT_DIFF_COUNT 2164 0.52 0.77 0.42 199 XMBody_78 2077 0.52 0.81 0.40 200 HTML_TAG_BALANCE_BODY 2071 0.57 0.98 0.40 ----------------------------------------------------------------------