Email: 747944 Autolearn: 0 AvgScore: 2.56 AvgScanTime: 1.41 sec Spam: 221721 Autolearn: 0 AvgScore: 13.48 AvgScanTime: 1.67 sec Ham: 526223 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.31 sec Time Spent Running SA: 293.82 hours Time Spent Processing Spam: 102.67 hours Time Spent Processing Ham: 191.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 214656 84.80 96.81 79.73 2 DKIM_SIGNED 192536 82.22 86.84 80.27 3 XM_DK_Pass 189096 81.06 85.29 79.29 4 DKIM_VALID 184726 79.28 83.31 77.57 5 XM_B_Unicode 177274 69.20 79.95 64.66 6 DCC_CHECK 175671 57.35 79.23 48.13 7 RELAYCOUNTRY_US 170819 83.92 77.04 86.82 8 XMListUnsubscribeExists 162244 54.91 73.17 47.21 9 XM_B_SpammyWords 158590 59.42 71.53 54.32 10 DKIM_VALID_AU 141907 62.16 64.00 61.38 11 XM_DK_Undo_02 108434 19.11 48.91 6.55 12 XM_B_Unicode3 102070 41.17 46.04 39.12 13 XM_B_SpammyWords2 92293 25.22 41.63 18.31 14 TR_XM_DKIM_Undo 90924 15.54 41.01 4.81 15 LOC_TINY_FONT_1 88278 27.87 39.81 22.84 16 BAYES_50 84889 56.48 38.29 64.15 17 BAYES_99 82065 13.83 37.01 4.07 18 HTML_FONT_LOW_CONTRAST 78867 28.28 35.57 25.20 19 MIME_HTML_ONLY 77345 23.58 34.88 18.82 20 RCVD_IN_MSPIKE_H2 70271 27.35 31.69 25.52 21 DKIM_VALID_EF 67103 34.67 30.26 36.52 22 BAYES_999 66083 11.04 29.80 3.13 23 TR_DCC_Bayes_99 64294 10.11 29.00 2.16 24 T_KAM_HTML_FONT_INVALID 60039 19.87 27.08 16.83 25 FVGT_m_MULTI_ODD 59837 23.18 26.99 21.57 26 XMSubLong 54446 20.11 24.56 18.24 27 RCVD_IN_MSPIKE_WL 49817 33.45 22.47 38.07 28 RELAYCOUNTRY_META 47196 9.01 21.29 3.84 29 T_TM2_M_HEADER_IN_MSG 46587 23.67 21.01 24.79 30 XM_Body_Dirty_Words 45607 14.30 20.57 11.66 31 DCC_CHECK_NEGATIVE 42293 40.78 19.07 49.93 32 XM_Multi_Part_URI 34631 12.40 15.62 11.05 33 XM_B_SpammyWords3 34177 7.98 15.41 4.85 34 TR_XM_SpammyWords2 32242 4.65 14.54 0.48 35 LOTS_OF_MONEY 31615 8.70 14.26 6.36 36 UNTRUSTED_Relay 31287 5.12 14.11 1.33 37 XM_UncommonTLD01 29357 5.84 13.24 2.72 38 BOTNET 28267 4.84 12.75 1.50 39 TR_XM_SpammyWords4 27981 6.56 12.62 4.01 40 RCVD_IN_MSPIKE_H3 27237 14.45 12.28 15.36 41 BOTNET_IPINHOSTNAME 26326 6.33 11.87 3.99 42 XM_B_Unsub 25933 9.89 11.70 9.13 43 FSL_BULK_SIG 24810 6.64 11.19 4.72 44 XMSexyCombo_05 23289 5.63 10.50 3.57 45 HTML_IMAGE_RATIO_02 23163 8.12 10.45 7.13 46 XM_Evil_Numbers_Gen 23118 8.59 10.43 7.82 47 RCVD_IN_BL_SPAMCOP_NET 22630 3.92 10.21 1.27 48 RCVD_IN_MSPIKE_H4 20875 12.22 9.41 13.41 49 MPART_ALT_DIFF 20473 6.43 9.23 5.25 50 XM_B_Phish_Phrases 19588 13.98 8.83 16.15 51 LotsOfNums_01 19301 8.56 8.71 8.50 52 UNPARSEABLE_RELAY 18650 7.55 8.41 7.18 53 TR_XM_UnparsRelay 18397 6.86 8.30 6.25 54 BAYES_80 17433 5.22 7.86 4.11 55 BAYES_60 16186 7.99 7.30 8.28 56 SpammyFromTLD_02 15584 2.33 7.03 0.35 57 XM_H_Long_From01 15566 5.62 7.02 5.03 58 TooManyTo_001 15322 6.94 6.91 6.95 59 RELAYCOUNTRY_CA 15207 2.84 6.86 1.15 60 T_REMOTE_IMAGE 15137 4.11 6.83 2.97 61 XM_UB50 14698 2.58 6.63 0.88 62 XM_SendGrid 14177 6.40 6.39 6.41 63 XMSubMetaSx_00 14067 3.96 6.34 2.96 64 HTML_IMAGE_RATIO_04 13752 5.82 6.20 5.65 65 MIME_HTML_MOSTLY 13727 3.35 6.19 2.15 66 TR_XM_PhishingBody 13346 3.94 6.02 3.06 67 KHOP_HELO_FCRDNS 11997 2.78 5.41 1.67 68 RCVD_IN_RP_SAFE 11757 7.20 5.30 7.99 69 XMNumbers 11403 3.25 5.14 2.45 70 XM_OfRef6 11158 2.03 5.03 0.76 71 BAYES_95 10326 3.17 4.66 2.54 72 HTML_SHORT_LINK_IMG_1 10077 1.36 4.54 0.02 73 XM_B_SpammyTLD 9926 2.99 4.48 2.36 74 URIBL_SBL_A 9251 2.36 4.17 1.60 75 BODY_URI_ONLY 9162 1.23 4.13 0.01 76 RCVD_IN_RP_CERTIFIED 9134 6.36 4.12 7.30 77 HTML_FONT_SIZE_LARGE 9111 1.28 4.11 0.09 78 HTML_IMAGE_RATIO_06 9054 3.43 4.08 3.16 79 HTML_IMAGE_ONLY_12 8933 1.30 4.03 0.15 80 TM2_M_URI_OPT_OUT 8869 3.02 4.00 2.60 81 XMBody_17 8856 1.60 3.99 0.59 82 MIME_HTML_ONLY_MULTI 8778 3.56 3.96 3.39 83 XMStrtUSub 8726 12.47 3.94 16.07 84 FROM_EXCESS_BASE64 8298 3.07 3.74 2.78 85 TR_LOTS_OF_MONEY3 8123 1.52 3.66 0.62 86 RCVD_IN_MSPIKE_BL 8068 1.15 3.64 0.10 87 TR_XM_MSPIKECOMBO 8014 1.14 3.61 0.09 88 TR_XM_DK_SendGrid 7999 4.08 3.61 4.28 89 DKIM_INVALID 7810 2.94 3.52 2.70 90 XM_DK_Undo_01 7774 2.06 3.51 1.45 91 TR_XM_SpammyWords5 7714 2.20 3.48 1.66 92 RELAYCOUNTRY_IN 7641 1.09 3.45 0.09 93 XM_B_COVIDMETA 7417 1.73 3.35 1.05 94 SpammyFromTLD_01 7326 1.38 3.30 0.58 95 URI_HEX 7250 1.79 3.27 1.16 96 MIME_QP_LONG_LINE 7105 4.79 3.20 5.46 97 XM_CamelCaseFrm001 6917 2.10 3.12 1.67 98 HTML_IMAGE_RATIO_08 6870 2.33 3.10 2.01 99 XM_B_SpammyWords4 6841 1.47 3.09 0.79 100 XM_SPF_SoftFail 6823 2.06 3.08 1.63 101 XM_B_Phish66 6746 2.24 3.04 1.90 102 XMDiploma_00 6733 2.03 3.04 1.61 103 RELAYCOUNTRY_FR 6440 1.04 2.90 0.26 104 RCVD_IN_PSBL 6328 0.92 2.85 0.10 105 URIBL_DBL_SPAM 6080 0.82 2.74 0.01 106 TR_XM_SB_Phish 5915 2.09 2.67 1.84 107 XMSubPhish11 5766 2.05 2.60 1.82 108 T_TooManySym_01 5577 3.72 2.52 4.23 109 XMBrknScrpt_02 5492 1.20 2.48 0.66 110 XMBdyGiftCard01 5432 1.42 2.45 0.98 111 XM_DIRTYINTL 5336 0.94 2.41 0.33 112 T_FILL_THIS_FORM_SHORT 5253 1.22 2.37 0.74 113 TM2_M_VERY_LONG_WORD 5250 1.62 2.37 1.31 114 T_XMDrugObfuBody_08 5228 1.61 2.36 1.30 115 XMSexyCombo_01 5200 1.00 2.35 0.43 116 XM_UB60 5169 0.76 2.33 0.10 117 RCVD_IN_MSPIKE_L5 5107 0.73 2.30 0.06 118 XM_UB99 5006 0.67 2.26 0.01 119 TR_XM_MaxBayes 5005 0.71 2.26 0.06 120 URI_TRY_3LD 4871 1.29 2.20 0.91 121 RCVD_IN_IADB_LISTED 4770 4.33 2.15 5.25 122 XM_B_Unsub2 4754 1.53 2.14 1.28 123 XMStockSpam_06 4579 1.45 2.07 1.19 124 T_XMDrugObfuBody_14 4538 2.10 2.05 2.12 125 TR_XM_SpammyWords3 4356 0.62 1.96 0.06 126 RCVD_IN_IADB_SPF 4318 3.80 1.95 4.58 127 TR_XM_BayesRelay 4242 0.58 1.91 0.02 128 RCVD_IN_IADB_DK 4100 3.34 1.85 3.96 129 RCVD_IN_IADB_SENDERID 4073 3.43 1.84 4.10 130 SUBJ_ALL_CAPS 3965 1.75 1.79 1.73 131 URI_NOVOWEL 3880 2.59 1.75 2.94 132 FORGED_GMAIL_RCVD 3821 0.85 1.72 0.48 133 HTML_MIME_NO_HTML_TAG 3660 1.86 1.65 1.95 134 TR_XM_COVIDMETA1 3627 0.81 1.64 0.46 135 XM_UB999 3554 0.48 1.60 0.00 136 RCVD_IN_RP_RNBL 3549 0.50 1.60 0.03 137 BAYES_40 3534 3.22 1.59 3.90 138 HK_RANDOM_REPLYTO 3499 0.58 1.58 0.15 139 XM_UB80 3331 0.48 1.50 0.04 140 T_XMHurry_00 3310 0.89 1.49 0.64 141 XM_OfRef7 3279 0.50 1.48 0.09 142 XMGenDplmaNmb 3274 0.93 1.48 0.70 143 BOTNET_NORDNS 3220 0.44 1.45 0.01 144 XMSubMetaI_00 3209 0.79 1.45 0.51 145 MAILING_LIST_MULTI 3142 1.97 1.42 2.21 146 ALL_TRUSTED 3093 7.77 1.39 10.46 147 BAYES_20 3015 2.35 1.36 2.77 148 XMPhish08 2996 0.49 1.35 0.13 149 XMHTML_After_End 2950 0.85 1.33 0.65 150 XM_URI_RBL 2948 0.50 1.33 0.15 151 TR_XM_FormFill 2872 0.39 1.30 0.01 152 T_XMDrugObfuBody_00 2862 0.81 1.29 0.61 153 DATE_IN_PAST_06_12 2763 0.50 1.25 0.19 154 TR_XM_COVIDMETA4 2744 0.59 1.24 0.32 155 PDS_OTHER_BAD_TLD 2730 1.06 1.23 0.99 156 URIBL_BLACK 2725 0.38 1.23 0.03 157 TR_XM_INV_DKIM 2673 0.41 1.21 0.07 158 NUMERIC_HTTP_ADDR 2623 0.57 1.18 0.31 159 XM_H_Long_From02 2556 0.96 1.15 0.88 160 XM_Body_Dirty_Words_01 2545 0.85 1.15 0.73 161 BAYES_00 2532 6.22 1.14 8.36 162 DATE_IN_PAST_03_06 2484 0.47 1.12 0.19 163 TR_XM_PHPDW 2468 0.50 1.11 0.24 164 TR_Symld_Words 2381 1.20 1.07 1.25 165 TR_MetaPhish_Combo_01 2340 0.68 1.06 0.52 166 THIS_AD 2337 0.45 1.05 0.20 167 TR_XM_PHPForged 2330 0.45 1.05 0.20 168 TR_XM_FormFill2 2252 0.44 1.02 0.20 169 XM_H_PHPOS 2248 0.44 1.01 0.19 170 XMSexyCombo_04 2221 0.37 1.00 0.10 171 XMPhish30 2183 0.63 0.98 0.48 172 URI_PHP_REDIR 2162 0.29 0.98 0.00 173 GOOGLE_DOC_SUSP 2103 0.29 0.95 0.01 174 TR_LOTS_OF_MONEY2 2082 0.36 0.94 0.12 175 T_MONEY_PERCENT 2082 0.36 0.94 0.12 176 TR_XM_RelayPhish 2048 0.32 0.92 0.06 177 RELAYCOUNTRY_NL 2003 0.38 0.90 0.16 178 DKIM_ADSP_CUSTOM_MED 1998 0.87 0.90 0.86 179 XM_UB95 1998 0.29 0.90 0.03 180 TR_Caps_n_Bayes_99 1933 0.36 0.87 0.14 181 HTML_IMAGE_ONLY_24 1931 0.46 0.87 0.28 182 XMClaimOffer 1925 0.31 0.87 0.07 183 XMBody_78 1877 0.58 0.85 0.47 184 TR_BOTNET_NEGATE 1873 0.49 0.84 0.35 185 PLING_QUERY 1861 0.56 0.84 0.44 186 DKIM_ADSP_NXDOMAIN 1858 0.41 0.84 0.23 187 XM_B_SEO 1821 0.33 0.82 0.13 188 XM_ProductURIs 1788 0.59 0.81 0.50 189 XM_BadFromFormat 1787 0.34 0.81 0.14 190 HTTPS_HTTP_MISMATCH 1753 0.67 0.79 0.61 191 XM_PDF 1753 2.72 0.79 3.53 192 RCVD_IN_IADB_VOUCHED 1749 2.52 0.79 3.25 193 HTML_FONT_SIZE_HUGE 1745 0.32 0.79 0.12 194 TR_XM_SEO4 1742 0.29 0.79 0.08 195 BAYES_05 1739 1.51 0.78 1.82 196 HTML_TAG_BALANCE_BODY 1727 0.43 0.78 0.29 197 XMOemUri 1724 0.36 0.78 0.18 198 XMSubMetaSSx_00 1721 0.35 0.78 0.17 199 HDRS_MISSP 1706 0.27 0.77 0.06 200 RCVD_IN_MSPIKE_H5 1705 6.77 0.77 9.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 456873 83.92 77.04 86.82 2 DKIM_SIGNED 422409 82.22 86.84 80.27 3 HTML_MESSAGE 419568 84.80 96.81 79.73 4 XM_DK_Pass 417224 81.06 85.29 79.29 5 DKIM_VALID 408211 79.28 83.31 77.57 6 XM_B_Unicode 340267 69.20 79.95 64.66 7 BAYES_50 337552 56.48 38.29 64.15 8 DKIM_VALID_AU 322998 62.16 64.00 61.38 9 XM_B_SpammyWords 285821 59.42 71.53 54.32 10 DCC_CHECK_NEGATIVE 262740 40.78 19.07 49.93 11 DCC_CHECK 253272 57.35 79.23 48.13 12 XMListUnsubscribeExists 248416 54.91 73.17 47.21 13 XM_B_Unicode3 205878 41.17 46.04 39.12 14 RCVD_IN_MSPIKE_WL 200351 33.45 22.47 38.07 15 DKIM_VALID_EF 192195 34.67 30.26 36.52 16 RCVD_IN_MSPIKE_H2 134289 27.35 31.69 25.52 17 HTML_FONT_LOW_CONTRAST 132615 28.28 35.57 25.20 18 T_TM2_M_HEADER_IN_MSG 130447 23.67 21.01 24.79 19 LOC_TINY_FONT_1 120165 27.87 39.81 22.84 20 FVGT_m_MULTI_ODD 113507 23.18 26.99 21.57 21 XM_DKIMWhitelistDomains 102847 13.81 0.21 19.54 22 MIME_HTML_ONLY 99017 23.58 34.88 18.82 23 XM_B_SpammyWords2 96372 25.22 41.63 18.31 24 XMSubLong 95994 20.11 24.56 18.24 25 T_KAM_HTML_FONT_INVALID 88587 19.87 27.08 16.83 26 XM_B_Phish_Phrases 84970 13.98 8.83 16.15 27 XMStrtUSub 84543 12.47 3.94 16.07 28 RCVD_IN_MSPIKE_H3 80843 14.45 12.28 15.36 29 RCVD_IN_MSPIKE_H4 70541 12.22 9.41 13.41 30 XM_Body_Dirty_Words 61379 14.30 20.57 11.66 31 XM_Multi_Part_URI 58151 12.40 15.62 11.05 32 ALL_TRUSTED 55048 7.77 1.39 10.46 33 RCVD_IN_MSPIKE_H5 48967 6.77 0.77 9.31 34 XM_B_Unsub 48042 9.89 11.70 9.13 35 LotsOfNums_01 44716 8.56 8.71 8.50 36 BAYES_00 43985 6.22 1.14 8.36 37 BAYES_60 43587 7.99 7.30 8.28 38 RCVD_IN_RP_SAFE 42060 7.20 5.30 7.99 39 XM_Evil_Numbers_Gen 41161 8.59 10.43 7.82 40 RCVD_IN_RP_CERTIFIED 38436 6.36 4.12 7.30 41 UNPARSEABLE_RELAY 37804 7.55 8.41 7.18 42 HTML_IMAGE_RATIO_02 37541 8.12 10.45 7.13 43 TooManyTo_001 36567 6.94 6.91 6.95 44 XM_DK_Undo_02 34480 19.11 48.91 6.55 45 XM_SendGrid 33720 6.40 6.39 6.41 46 LOTS_OF_MONEY 33465 8.70 14.26 6.36 47 TR_XM_UnparsRelay 32902 6.86 8.30 6.25 48 TR_XM_DK_Bayes 32481 4.56 0.72 6.17 49 TR_XM_DK_Bayes1 31831 4.46 0.68 6.05 50 HTML_IMAGE_RATIO_04 29743 5.82 6.20 5.65 51 MIME_QP_LONG_LINE 28757 4.79 3.20 5.46 52 TR_XM_DK_Bayes2 28317 3.92 0.46 5.38 53 RCVD_IN_IADB_LISTED 27648 4.33 2.15 5.25 54 MPART_ALT_DIFF 27620 6.43 9.23 5.25 55 IN_ZIMBRA_NJ_WHITELIST 26717 3.60 0.08 5.08 56 XM_H_Long_From01 26468 5.62 7.02 5.03 57 XM_B_SpammyWords3 25521 7.98 15.41 4.85 58 TR_XM_DKIM_Undo 25294 15.54 41.01 4.81 59 FSL_BULK_SIG 24842 6.64 11.19 4.72 60 RCVD_IN_IADB_SPF 24108 3.80 1.95 4.58 61 TR_XM_DK_SendGrid 22521 4.08 3.61 4.28 62 T_TooManySym_01 22272 3.72 2.52 4.23 63 BAYES_80 21631 5.22 7.86 4.11 64 RCVD_IN_IADB_SENDERID 21551 3.43 1.84 4.10 65 BAYES_99 21412 13.83 37.01 4.07 66 TR_XM_SpammyWords4 21090 6.56 12.62 4.01 67 BOTNET_IPINHOSTNAME 20984 6.33 11.87 3.99 68 RCVD_IN_IADB_DK 20850 3.34 1.85 3.96 69 BAYES_40 20544 3.22 1.59 3.90 70 RELAYCOUNTRY_META 20224 9.01 21.29 3.84 71 XMSexyCombo_05 18794 5.63 10.50 3.57 72 XM_PDF 18599 2.72 0.79 3.53 73 XM_H_Trusted_IP 18465 2.47 0.00 3.51 74 MIME_HTML_ONLY_MULTI 17820 3.56 3.96 3.39 75 RCVD_IN_IADB_VOUCHED 17122 2.52 0.79 3.25 76 HTML_IMAGE_RATIO_06 16635 3.43 4.08 3.16 77 BAYES_999 16459 11.04 29.80 3.13 78 TR_XM_PhishingBody 16109 3.94 6.02 3.06 79 T_REMOTE_IMAGE 15631 4.11 6.83 2.97 80 XMSubMetaSx_00 15583 3.96 6.34 2.96 81 URI_NOVOWEL 15497 2.59 1.75 2.94 82 FROM_EXCESS_BASE64 14654 3.07 3.74 2.78 83 BAYES_20 14566 2.35 1.36 2.77 84 XM_UncommonTLD01 14331 5.84 13.24 2.72 85 DKIM_INVALID 14198 2.94 3.52 2.70 86 TM2_M_URI_OPT_OUT 13699 3.02 4.00 2.60 87 BAYES_95 13388 3.17 4.66 2.54 88 XMNumbers 12917 3.25 5.14 2.45 89 XM_B_SpammyTLD 12442 2.99 4.48 2.36 90 MAILING_LIST_MULTI 11626 1.97 1.42 2.21 91 TR_DCC_Bayes_99 11341 10.11 29.00 2.16 92 MIME_HTML_MOSTLY 11333 3.35 6.19 2.15 93 RCVD_IN_IADB_OPTIN 11268 1.66 0.52 2.14 94 T_XMDrugObfuBody_14 11162 2.10 2.05 2.12 95 HTML_IMAGE_RATIO_08 10555 2.33 3.10 2.01 96 T_TooManySym_02 10502 1.60 0.67 2.00 97 ANY_BOUNCE_MESSAGE 10241 1.48 0.38 1.95 98 HTML_MIME_NO_HTML_TAG 10241 1.86 1.65 1.95 99 BOUNCE_MESSAGE 10217 1.48 0.38 1.94 100 XM_B_Phish66 10011 2.24 3.04 1.90 101 TVD_RCVD_IP 9864 1.37 0.17 1.87 102 TR_XM_SB_Phish 9707 2.09 2.67 1.84 103 TooManyTo_002 9678 1.47 0.59 1.84 104 XMSubPhish11 9592 2.05 2.60 1.82 105 BAYES_05 9557 1.51 0.78 1.82 106 SUBJ_ALL_CAPS 9094 1.75 1.79 1.73 107 XM_CamelCaseFrm001 8806 2.10 3.12 1.67 108 KHOP_HELO_FCRDNS 8777 2.78 5.41 1.67 109 TR_XM_SpammyWords5 8713 2.20 3.48 1.66 110 XM_SPF_SoftFail 8558 2.06 3.08 1.63 111 XMDiploma_00 8456 2.03 3.04 1.61 112 URIBL_SBL_A 8413 2.36 4.17 1.60 113 BOTNET 7906 4.84 12.75 1.50 114 XM_DK_Undo_01 7623 2.06 3.51 1.45 115 IN_HORDE_ADDRESS_BOOK 7585 1.05 0.11 1.44 116 INVALID_MSGID 7174 1.03 0.24 1.36 117 HTML_FONT_FACE_BAD 7026 1.11 0.56 1.34 118 UNTRUSTED_Relay 6991 5.12 14.11 1.33 119 TM2_M_VERY_LONG_WORD 6902 1.62 2.37 1.31 120 T_XMDrugObfuBody_08 6843 1.61 2.36 1.30 121 USER_IN_DEF_DKIM_WL 6758 0.91 0.03 1.28 122 HELO_NODOT 6740 1.02 0.41 1.28 123 HELO_NO_DOMAIN 6739 1.02 0.40 1.28 124 XM_B_Unsub2 6711 1.53 2.14 1.28 125 RCVD_IN_BL_SPAMCOP_NET 6690 3.92 10.21 1.27 126 TR_Symld_Words 6568 1.20 1.07 1.25 127 MSGID_NOFQDN1 6562 0.89 0.04 1.25 128 TooManyTo_003 6527 1.02 0.49 1.24 129 TO_MALFORMED 6330 0.85 0.02 1.20 130 XMStockSpam_06 6273 1.45 2.07 1.19 131 URI_HEX 6116 1.79 3.27 1.16 132 RELAYCOUNTRY_CA 6027 2.84 6.86 1.15 133 XMSubNoVowel 5819 0.96 0.60 1.11 134 XM_B_COVIDMETA 5548 1.73 3.35 1.05 135 HELO_MISC_IP 5522 0.77 0.10 1.05 136 XM_RXBody 5228 0.81 0.37 0.99 137 XMBSHREFv2 5214 0.75 0.17 0.99 138 PDS_OTHER_BAD_TLD 5188 1.06 1.23 0.99 139 XMBdyGiftCard01 5183 1.42 2.45 0.98 140 XM_GoogleGroups 5086 0.83 0.51 0.97 141 XMCapTrack 5077 0.76 0.28 0.96 142 TR_MSPIKEBAYES00 5005 0.67 0.01 0.95 143 XMGappySubj_01 4853 0.70 0.19 0.92 144 URI_TRY_3LD 4774 1.29 2.20 0.91 145 TooManyTo_004 4666 0.75 0.43 0.89 146 XM_UB50 4628 2.58 6.63 0.88 147 XM_H_Long_From02 4605 0.96 1.15 0.88 148 DKIM_ADSP_CUSTOM_MED 4512 0.87 0.90 0.86 149 RELAYCOUNTRY_GB 4463 0.82 0.75 0.85 150 XM_B_SpammyWords4 4166 1.47 3.09 0.79 151 XM_OfRef6 3988 2.03 5.03 0.76 152 XMBody_95 3937 0.57 0.13 0.75 153 T_FILL_THIS_FORM_SHORT 3887 1.22 2.37 0.74 154 XM_Body_Dirty_Words_01 3841 0.85 1.15 0.73 155 TooManyTo_005 3826 0.62 0.37 0.73 156 XMGenDplmaNmb 3704 0.93 1.48 0.70 157 HTML_IMAGE_ONLY_20 3593 0.52 0.14 0.68 158 XMBrknScrpt_02 3499 1.20 2.48 0.66 159 XMHTML_After_End 3410 0.85 1.33 0.65 160 T_XMHurry_00 3361 0.89 1.49 0.64 161 TVD_SPACE_RATIO 3308 0.46 0.06 0.63 162 TR_LOTS_OF_MONEY3 3251 1.52 3.66 0.62 163 HTTPS_HTTP_MISMATCH 3230 0.67 0.79 0.61 164 T_XMDrugObfuBody_00 3227 0.81 1.29 0.61 165 XMHTMLBadTable_001 3218 0.59 0.53 0.61 166 XMBody_17 3101 1.60 3.99 0.59 167 SpammyFromTLD_01 3029 1.38 3.30 0.58 168 NML_ADSP_CUSTOM_MED 2830 0.57 0.64 0.54 169 TR_MetaPhish_Combo_01 2739 0.68 1.06 0.52 170 T_TooManySym_03 2735 0.44 0.26 0.52 171 XMSubMetaI_00 2674 0.79 1.45 0.51 172 XM_ProductURIs 2646 0.59 0.81 0.50 173 XM_H_PHPMailer 2606 0.52 0.59 0.50 174 XM_SPF_Unknown 2567 0.51 0.57 0.49 175 XMPhish30 2549 0.63 0.98 0.48 176 FORGED_GMAIL_RCVD 2545 0.85 1.72 0.48 177 TR_XM_SpammyWords2 2525 4.65 14.54 0.48 178 XMBody_78 2497 0.58 0.85 0.47 179 XMPhish14 2488 0.52 0.62 0.47 180 FROM_GOV_DKIM_AU 2465 0.37 0.15 0.47 181 RDNS_DYNAMIC 2430 0.54 0.71 0.46 182 TR_XM_COVIDMETA1 2416 0.81 1.64 0.46 183 XM_Body_Obfu01 2396 0.53 0.70 0.46 184 PLING_QUERY 2316 0.56 0.84 0.44 185 TVD_SPACE_RATIO_MINFP 2298 0.40 0.32 0.44 186 XMSexyCombo_01 2288 1.00 2.35 0.43 187 T_OBFU_PDF_ATTACH 2250 0.36 0.20 0.43 188 XM_ShortIntro_01 2231 0.41 0.37 0.42 189 XMNoVowels 2218 0.41 0.38 0.42 190 FROM_GOV_SPOOF 2146 0.33 0.13 0.41 191 XM_B_REG_HTML 2098 0.39 0.37 0.40 192 XMMoneyMeta_00 2069 0.41 0.47 0.39 193 SHORT_HELO_AND_INLINE_IMAGE 2015 0.28 0.05 0.38 194 RCVD_IN_SORBS_DUL 1998 0.31 0.14 0.38 195 XM_B_COPY_HTML 1994 0.43 0.56 0.38 196 MISSING_HEADERS 1993 0.38 0.38 0.38 197 XMLngstWrd_00 1989 0.40 0.47 0.38 198 RELAYCOUNTRY_DE 1987 0.48 0.71 0.38 199 TM2_M_BODY_EMPTY 1919 0.27 0.06 0.36 200 DIET_1 1872 0.46 0.71 0.36 ----------------------------------------------------------------------