Email: 650797 Autolearn: 0 AvgScore: 4.26 AvgScanTime: 1.22 sec Spam: 205019 Autolearn: 0 AvgScore: 14.48 AvgScanTime: 1.40 sec Ham: 445778 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 1.13 sec Time Spent Running SA: 220.12 hours Time Spent Processing Spam: 79.81 hours Time Spent Processing Ham: 140.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 196005 90.42 95.60 88.03 2 DKIM_SIGNED 167138 77.04 81.52 74.98 3 XM_DK_Pass 163453 75.63 79.73 73.75 4 DCC_CHECK 160425 51.32 78.25 38.93 5 DKIM_VALID 159116 73.63 77.61 71.80 6 XM_B_Unicode 155485 72.26 75.84 70.61 7 RELAYCOUNTRY_US 149617 79.24 72.98 82.12 8 XMListUnsubscribeExists 138128 54.90 67.37 49.16 9 XM_B_SpammyWords 136763 52.79 66.71 46.39 10 DKIM_VALID_AU 121114 55.66 59.07 54.08 11 XM_DK_Undo_02 95531 20.63 46.60 8.69 12 XM_B_Unicode3 89567 41.76 43.69 40.87 13 XM_B_SpammyWords2 81037 25.75 39.53 19.41 14 BAYES_99 78579 17.00 38.33 7.19 15 LOC_TINY_FONT_1 76494 27.00 37.31 22.26 16 TR_XM_DKIM_Undo 72732 15.01 35.48 5.60 17 BAYES_50 72199 50.72 35.22 57.85 18 MIME_HTML_ONLY 69879 24.96 34.08 20.76 19 HTML_FONT_LOW_CONTRAST 69731 28.71 34.01 26.27 20 BAYES_999 61192 13.24 29.85 5.60 21 TR_DCC_Bayes_99 61154 11.48 29.83 3.04 22 DKIM_VALID_EF 57986 29.85 28.28 30.57 23 FVGT_m_MULTI_ODD 54246 23.72 26.46 22.45 24 XMSubLong 52564 22.74 25.64 21.40 25 T_KAM_HTML_FONT_INVALID 51756 20.57 25.24 18.42 26 RCVD_IN_MSPIKE_WL 47250 30.23 23.05 33.53 27 XM_Body_Dirty_Words 44431 14.52 21.67 11.22 28 RCVD_IN_MSPIKE_H2 44332 22.21 21.62 22.48 29 RELAYCOUNTRY_META 41762 9.93 20.37 5.13 30 DCC_CHECK_NEGATIVE 41254 46.60 20.12 58.77 31 T_TM2_M_HEADER_IN_MSG 38146 27.29 18.61 31.29 32 XM_UncommonTLD01 37365 8.05 18.23 3.36 33 UNTRUSTED_Relay 36884 6.96 17.99 1.89 34 FSL_BULK_SIG 35667 9.78 17.40 6.27 35 BOTNET 29488 5.57 14.38 1.52 36 XM_Multi_Part_URI 29028 12.26 14.16 11.39 37 LOTS_OF_MONEY 27670 8.55 13.50 6.27 38 TR_XM_SpammyWords2 27045 4.87 13.19 1.04 39 BOTNET_IPINHOSTNAME 27039 7.25 13.19 4.52 40 XM_B_Unsub 25801 10.66 12.58 9.78 41 XM_B_SpammyWords3 25655 6.83 12.51 4.21 42 XMSexyCombo_05 24354 5.95 11.88 3.22 43 RCVD_IN_MSPIKE_H3 24130 15.20 11.77 16.78 44 TR_XM_SpammyWords4 23028 6.14 11.23 3.80 45 XM_Evil_Numbers_Gen 21395 8.85 10.44 8.12 46 RCVD_IN_MSPIKE_H4 21018 12.07 10.25 12.91 47 SpammyFromTLD_02 20247 3.33 9.88 0.33 48 UNPARSEABLE_RELAY 19631 8.40 9.58 7.86 49 TR_XM_UnparsRelay 19425 7.60 9.47 6.74 50 MPART_ALT_DIFF 19069 6.20 9.30 4.78 51 RCVD_IN_BL_SPAMCOP_NET 18809 3.55 9.17 0.96 52 HTML_IMAGE_RATIO_02 18687 7.17 9.11 6.27 53 BAYES_80 18014 6.58 8.79 5.56 54 XM_B_Phish_Phrases 17997 6.79 8.78 5.88 55 BAYES_60 16846 9.58 8.22 10.21 56 LotsOfNums_01 16217 8.35 7.91 8.55 57 T_REMOTE_IMAGE 16122 4.95 7.86 3.61 58 XMSubMetaSx_00 15951 4.73 7.78 3.33 59 KHOP_HELO_FCRDNS 15259 3.60 7.44 1.84 60 TR_XM_PhishingBody 14600 4.30 7.12 3.01 61 MIME_HTML_MOSTLY 14511 3.74 7.08 2.21 62 XM_SendGrid 14437 6.99 7.04 6.97 63 HTML_IMAGE_ONLY_12 13999 2.31 6.83 0.23 64 XMNumbers 13006 4.04 6.34 2.98 65 XM_H_Long_From01 12890 5.84 6.29 5.64 66 TooManyTo_001 12873 7.98 6.28 8.76 67 RCVD_IN_MSPIKE_BL 12834 2.07 6.26 0.14 68 TR_XM_MSPIKECOMBO 12678 2.04 6.18 0.13 69 XM_B_SpammyTLD 12248 3.34 5.97 2.12 70 RELAYCOUNTRY_CA 11891 2.72 5.80 1.31 71 HTML_SHORT_LINK_IMG_1 11625 1.80 5.67 0.01 72 XM_UB99 11623 1.79 5.67 0.00 73 BODY_URI_ONLY 11493 1.78 5.61 0.01 74 HTML_FONT_SIZE_LARGE 11129 1.80 5.43 0.13 75 BAYES_95 11008 4.08 5.37 3.49 76 XM_UB50 10130 2.45 4.94 1.30 77 HTML_IMAGE_RATIO_04 9958 5.52 4.86 5.83 78 TR_XM_SpammyWords3 9310 1.48 4.54 0.08 79 XM_B_Phish66 9162 2.69 4.47 1.87 80 XM_SPF_SoftFail 8880 2.45 4.33 1.59 81 SpammyFromTLD_01 8811 1.90 4.30 0.80 82 XMStrtUSub 8741 5.18 4.26 5.60 83 TR_XM_DK_SendGrid 8575 4.26 4.18 4.29 84 RCVD_IN_RP_SAFE 8378 6.45 4.09 7.53 85 DKIM_INVALID 8022 3.41 3.91 3.18 86 XM_DIRTYINTL 7733 1.51 3.77 0.47 87 XM_UB999 7705 1.19 3.76 0.00 88 TR_XM_SpammyWords5 7651 2.06 3.73 1.30 89 RCVD_IN_PSBL 7108 1.16 3.47 0.09 90 XM_OfRef6 7069 1.66 3.45 0.83 91 RCVD_IN_MSPIKE_L5 7067 1.12 3.45 0.05 92 TM2_M_URI_OPT_OUT 6836 3.02 3.33 2.87 93 HTML_IMAGE_RATIO_06 6788 3.58 3.31 3.71 94 RCVD_IN_RP_RNBL 6739 1.05 3.29 0.03 95 MIME_QP_LONG_LINE 6505 4.91 3.17 5.70 96 MIME_HTML_ONLY_MULTI 6385 3.19 3.11 3.22 97 RCVD_IN_RP_CERTIFIED 6340 5.62 3.09 6.78 98 FROM_EXCESS_BASE64 6051 2.73 2.95 2.63 99 T_TooManySym_01 5938 4.53 2.90 5.28 100 HTML_IMAGE_RATIO_08 5913 2.63 2.88 2.51 101 PDS_OTHER_BAD_TLD 5835 1.24 2.85 0.50 102 XMBdyGiftCard01 5549 1.20 2.71 0.51 103 T_XMDrugObfuBody_14 5375 2.27 2.62 2.10 104 XM_UB80 5228 0.83 2.55 0.04 105 XM_CamelCaseFrm001 5225 2.09 2.55 1.89 106 XMDiploma_00 5199 1.91 2.54 1.62 107 T_XMDrugObfuBody_08 5173 1.88 2.52 1.58 108 TR_XM_BayesRelay 5172 0.81 2.52 0.03 109 RELAYCOUNTRY_FR 5164 0.98 2.52 0.27 110 URIBL_DBL_SPAM 5120 0.79 2.50 0.01 111 XM_DK_Undo_01 5019 1.83 2.45 1.55 112 ALL_TRUSTED 5011 10.65 2.44 14.43 113 XM_UB60 4986 0.87 2.43 0.15 114 TR_XM_SB_Phish 4895 2.29 2.39 2.25 115 RCVD_IN_IADB_LISTED 4888 4.73 2.38 5.81 116 XM_B_COVIDMETA 4803 1.60 2.34 1.26 117 XMSubPhish11 4589 2.22 2.24 2.22 118 HTML_MIME_NO_HTML_TAG 4563 2.43 2.23 2.53 119 URI_HEX 4492 1.69 2.19 1.46 120 RELAYCOUNTRY_DE 4478 1.23 2.18 0.80 121 XMMoneyMeta_00 4326 1.09 2.11 0.62 122 XM_H_Undi_Recip 4320 0.79 2.11 0.18 123 RCVD_IN_IADB_SPF 4298 4.08 2.10 5.00 124 URI_PHP_REDIR 4261 0.66 2.08 0.00 125 XM_B_SpammyWords4 4157 0.94 2.03 0.45 126 TM2_M_VERY_LONG_WORD 4144 1.49 2.02 1.24 127 XM_B_Unsub2 4104 1.74 2.00 1.62 128 T_FILL_THIS_FORM_SHORT 4087 1.25 1.99 0.91 129 RCVD_IN_IADB_DK 4040 3.54 1.97 4.26 130 XM_URI_RBL 4010 0.71 1.96 0.14 131 XM_UB95 4006 0.63 1.95 0.02 132 DKIM_ADSP_CUSTOM_MED 3991 1.24 1.95 0.91 133 RCVD_IN_IADB_SENDERID 3964 3.65 1.93 4.43 134 XMSexyCombo_01 3940 0.87 1.92 0.39 135 XMBrknScrpt_02 3926 1.06 1.91 0.67 136 FORGED_GMAIL_RCVD 3780 0.91 1.84 0.48 137 HTML_FONT_SIZE_HUGE 3734 0.69 1.82 0.17 138 NML_ADSP_CUSTOM_MED 3680 0.99 1.79 0.62 139 XMStockSpam_06 3634 1.19 1.77 0.93 140 XM_JunkDunk 3611 0.55 1.76 0.00 141 MONEY_NOHTML 3604 0.62 1.76 0.10 142 BOTNET_NORDNS 3603 0.56 1.76 0.01 143 T_XMDrugObfuBody_00 3565 0.99 1.74 0.64 144 XM_S_SpammyWords 3535 0.80 1.72 0.37 145 TR_XM_Spammywords 3535 0.80 1.72 0.37 146 SUBJ_ALL_CAPS 3517 1.55 1.72 1.47 147 RCVD_IN_MSPIKE_L4 3488 0.56 1.70 0.04 148 BAYES_40 3422 3.15 1.67 3.84 149 TR_XM_Undi_Recip11 3376 0.55 1.65 0.04 150 URIBL_SBL_A 3366 0.72 1.64 0.29 151 MAILING_LIST_MULTI 3273 2.61 1.60 3.08 152 XMBody_17 3263 0.86 1.59 0.52 153 TR_XM_INV_DKIM 3250 0.61 1.59 0.16 154 TR_XM_Undi_Recip5 3248 0.51 1.58 0.01 155 XMGenDplmaNmb 3132 1.13 1.53 0.95 156 TR_XM_COVIDMETA4 3129 0.69 1.53 0.31 157 T_XMHurry_00 3111 0.79 1.52 0.46 158 TR_XM_PHPDW 2987 0.67 1.46 0.31 159 TR_Symld_Words 2945 1.55 1.44 1.61 160 XMSubMetaSSx_00 2936 0.54 1.43 0.13 161 T_Symld_Words_02 2807 0.72 1.37 0.42 162 URI_NOVOWEL 2806 2.51 1.37 3.03 163 FILL_THIS_FORM 2798 0.59 1.36 0.24 164 MONEY_ATM_CARD 2792 0.43 1.36 0.00 165 XMSlimDrugH 2788 0.68 1.36 0.37 166 URIBL_BLACK 2757 0.45 1.34 0.03 167 TR_XM_PHPForged 2696 0.57 1.32 0.23 168 TR_XM_Undi_RecipCombo2 2689 0.41 1.31 0.00 169 TR_XM_Undi_Recip2 2628 0.41 1.28 0.01 170 TR_XM_FormFill2 2620 0.56 1.28 0.24 171 TR_Mismatch_TLD_02 2607 0.45 1.27 0.08 172 XM_H_PHPOS 2605 0.56 1.27 0.23 173 XM_BadFromFormat 2594 0.54 1.27 0.21 174 XMHTML_After_End 2586 1.55 1.26 1.68 175 DEAR_BENEFICIARY 2566 0.40 1.25 0.00 176 MONEY_FORM 2559 0.40 1.25 0.01 177 XM_Body_Dirty_Words_01 2509 0.57 1.22 0.26 178 TR_XM_PhishingBody3 2508 0.39 1.22 0.00 179 DIET_1 2500 0.75 1.22 0.53 180 TR_XM_Undi_RecipCombo3 2431 0.37 1.19 0.00 181 URI_TRY_3LD 2419 1.10 1.18 1.06 182 TR_XM_Undi_Recip9 2417 0.37 1.18 0.00 183 TR_XM_FormFill 2410 0.38 1.18 0.01 184 TR_XM_COVIDMETA1 2409 0.63 1.18 0.38 185 BAYES_20 2399 2.20 1.17 2.67 186 FROM_SUSPICIOUS_NTLD 2372 0.41 1.16 0.07 187 T_HTML_TAG_BALANCE_CENTER 2363 0.47 1.15 0.15 188 RELAYCOUNTRY_IN 2337 0.44 1.14 0.11 189 HTML_SHORT_LINK_IMG_2 2291 0.40 1.12 0.07 190 TR_MetaPhish_Combo_01 2284 0.92 1.11 0.82 191 TR_LOTS_OF_MONEY3 2283 0.50 1.11 0.22 192 FROM_SUSPICIOUS_NTLD_FP 2283 0.39 1.11 0.06 193 DATE_IN_PAST_03_06 2265 0.43 1.10 0.12 194 HTML_TAG_BALANCE_BODY 2260 0.59 1.10 0.36 195 XMSubject_63 2259 0.35 1.10 0.00 196 XMSpecificSbj 2243 0.34 1.09 0.00 197 TR_XM_RelayPhish 2194 0.54 1.07 0.30 198 RCVD_IN_IADB_VOUCHED 2165 2.88 1.06 3.72 199 HTTPS_HTTP_MISMATCH 2149 0.86 1.05 0.78 200 XMPhish08 2146 0.47 1.05 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 392429 90.42 95.60 88.03 2 RELAYCOUNTRY_US 366084 79.24 72.98 82.12 3 DKIM_SIGNED 334226 77.04 81.52 74.98 4 XM_DK_Pass 328771 75.63 79.73 73.75 5 DKIM_VALID 320071 73.63 77.61 71.80 6 XM_B_Unicode 314785 72.26 75.84 70.61 7 DCC_CHECK_NEGATIVE 261997 46.60 20.12 58.77 8 BAYES_50 257877 50.72 35.22 57.85 9 DKIM_VALID_AU 241092 55.66 59.07 54.08 10 XMListUnsubscribeExists 219158 54.90 67.37 49.16 11 XM_B_SpammyWords 206817 52.79 66.71 46.39 12 XM_B_Unicode3 182195 41.76 43.69 40.87 13 DCC_CHECK 173558 51.32 78.25 38.93 14 RCVD_IN_MSPIKE_WL 149458 30.23 23.05 33.53 15 T_TM2_M_HEADER_IN_MSG 139480 27.29 18.61 31.29 16 DKIM_VALID_EF 136277 29.85 28.28 30.57 17 HTML_FONT_LOW_CONTRAST 117098 28.71 34.01 26.27 18 RCVD_IN_MSPIKE_H2 100198 22.21 21.62 22.48 19 FVGT_m_MULTI_ODD 100093 23.72 26.46 22.45 20 LOC_TINY_FONT_1 99211 27.00 37.31 22.26 21 XMSubLong 95416 22.74 25.64 21.40 22 MIME_HTML_ONLY 92529 24.96 34.08 20.76 23 XM_B_SpammyWords2 86521 25.75 39.53 19.41 24 T_KAM_HTML_FONT_INVALID 82134 20.57 25.24 18.42 25 RCVD_IN_MSPIKE_H3 74821 15.20 11.77 16.78 26 ALL_TRUSTED 64308 10.65 2.44 14.43 27 RCVD_IN_MSPIKE_H4 57533 12.07 10.25 12.91 28 XM_Multi_Part_URI 50756 12.26 14.16 11.39 29 XM_Body_Dirty_Words 50033 14.52 21.67 11.22 30 BAYES_60 45500 9.58 8.22 10.21 31 XM_DKIMWhitelistDomains 44176 6.79 0.02 9.91 32 XM_B_Unsub 43576 10.66 12.58 9.78 33 TooManyTo_001 39063 7.98 6.28 8.76 34 XM_DK_Undo_02 38738 20.63 46.60 8.69 35 LotsOfNums_01 38106 8.35 7.91 8.55 36 XM_Evil_Numbers_Gen 36194 8.85 10.44 8.12 37 UNPARSEABLE_RELAY 35043 8.40 9.58 7.86 38 BAYES_00 33905 5.40 0.61 7.61 39 RCVD_IN_RP_SAFE 33577 6.45 4.09 7.53 40 BAYES_99 32064 17.00 38.33 7.19 41 XM_SendGrid 31085 6.99 7.04 6.97 42 RCVD_IN_RP_CERTIFIED 30222 5.62 3.09 6.78 43 TR_XM_UnparsRelay 30053 7.60 9.47 6.74 44 HTML_IMAGE_RATIO_02 27971 7.17 9.11 6.27 45 FSL_BULK_SIG 27965 9.78 17.40 6.27 46 LOTS_OF_MONEY 27943 8.55 13.50 6.27 47 XM_B_Phish_Phrases 26204 6.79 8.78 5.88 48 HTML_IMAGE_RATIO_04 25978 5.52 4.86 5.83 49 RCVD_IN_IADB_LISTED 25884 4.73 2.38 5.81 50 MIME_QP_LONG_LINE 25420 4.91 3.17 5.70 51 XM_H_Long_From01 25128 5.84 6.29 5.64 52 IN_ZIMBRA_NJ_WHITELIST 25014 3.86 0.05 5.61 53 TR_XM_DKIM_Undo 24979 15.01 35.48 5.60 54 BAYES_999 24953 13.24 29.85 5.60 55 XMStrtUSub 24942 5.18 4.26 5.60 56 BAYES_80 24800 6.58 8.79 5.56 57 TR_XM_DK_Bayes 23763 3.80 0.47 5.33 58 T_TooManySym_01 23557 4.53 2.90 5.28 59 TR_XM_DK_Bayes1 23374 3.74 0.46 5.24 60 RELAYCOUNTRY_META 22885 9.93 20.37 5.13 61 RCVD_IN_IADB_SPF 22284 4.08 2.10 5.00 62 MPART_ALT_DIFF 21292 6.20 9.30 4.78 63 TR_XM_DK_Bayes2 20937 3.36 0.44 4.70 64 XM_PDF 20249 3.42 0.97 4.54 65 BOTNET_IPINHOSTNAME 20156 7.25 13.19 4.52 66 RCVD_IN_IADB_SENDERID 19764 3.65 1.93 4.43 67 TR_XM_DK_SendGrid 19139 4.26 4.18 4.29 68 RCVD_IN_IADB_DK 18995 3.54 1.97 4.26 69 XM_B_SpammyWords3 18782 6.83 12.51 4.21 70 RCVD_IN_MSPIKE_H5 17104 2.95 1.03 3.84 71 BAYES_40 17103 3.15 1.67 3.84 72 TR_XM_SpammyWords4 16918 6.14 11.23 3.80 73 RCVD_IN_IADB_VOUCHED 16586 2.88 1.06 3.72 74 HTML_IMAGE_RATIO_06 16517 3.58 3.31 3.71 75 T_REMOTE_IMAGE 16103 4.95 7.86 3.61 76 BAYES_95 15548 4.08 5.37 3.49 77 XM_H_Trusted_IP 15458 2.38 0.00 3.47 78 XM_UncommonTLD01 15000 8.05 18.23 3.36 79 XMSubMetaSx_00 14842 4.73 7.78 3.33 80 MIME_HTML_ONLY_MULTI 14367 3.19 3.11 3.22 81 XMSexyCombo_05 14338 5.95 11.88 3.22 82 DKIM_INVALID 14155 3.41 3.91 3.18 83 MAILING_LIST_MULTI 13709 2.61 1.60 3.08 84 TR_DCC_Bayes_99 13544 11.48 29.83 3.04 85 URI_NOVOWEL 13508 2.51 1.37 3.03 86 TR_XM_PhishingBody 13408 4.30 7.12 3.01 87 XMNumbers 13295 4.04 6.34 2.98 88 TM2_M_URI_OPT_OUT 12805 3.02 3.33 2.87 89 ANY_BOUNCE_MESSAGE 12615 2.24 0.96 2.83 90 BOUNCE_MESSAGE 12612 2.24 0.96 2.83 91 BAYES_20 11922 2.20 1.17 2.67 92 FROM_EXCESS_BASE64 11715 2.73 2.95 2.63 93 T_TooManySym_02 11414 1.99 0.76 2.56 94 HTML_MIME_NO_HTML_TAG 11257 2.43 2.23 2.53 95 HTML_IMAGE_RATIO_08 11186 2.63 2.88 2.51 96 RCVD_IN_IADB_OPTIN 10940 1.90 0.69 2.45 97 TR_XM_SB_Phish 10031 2.29 2.39 2.25 98 TooManyTo_002 10005 1.75 0.68 2.24 99 XMSubPhish11 9887 2.22 2.24 2.22 100 MIME_HTML_MOSTLY 9849 3.74 7.08 2.21 101 XM_B_SpammyTLD 9468 3.34 5.97 2.12 102 T_XMDrugObfuBody_14 9378 2.27 2.62 2.10 103 HELO_NODOT 8436 1.46 0.52 1.89 104 HELO_NO_DOMAIN 8435 1.46 0.52 1.89 105 UNTRUSTED_Relay 8429 6.96 17.99 1.89 106 XM_CamelCaseFrm001 8409 2.09 2.55 1.89 107 XM_B_Phish66 8318 2.69 4.47 1.87 108 KHOP_HELO_FCRDNS 8186 3.60 7.44 1.84 109 TVD_RCVD_IP 7794 1.28 0.27 1.75 110 XMHTML_After_End 7510 1.55 1.26 1.68 111 XM_B_Unsub2 7220 1.74 2.00 1.62 112 XMDiploma_00 7202 1.91 2.54 1.62 113 TR_Symld_Words 7170 1.55 1.44 1.61 114 XM_SPF_SoftFail 7072 2.45 4.33 1.59 115 T_XMDrugObfuBody_08 7060 1.88 2.52 1.58 116 BAYES_05 7059 1.28 0.63 1.58 117 IN_HORDE_ADDRESS_BOOK 6993 1.09 0.06 1.57 118 INVALID_MSGID 6979 1.18 0.34 1.57 119 XM_DK_Undo_01 6919 1.83 2.45 1.55 120 BOTNET 6775 5.57 14.38 1.52 121 TooManyTo_003 6584 1.19 0.56 1.48 122 SUBJ_ALL_CAPS 6552 1.55 1.72 1.47 123 URI_HEX 6528 1.69 2.19 1.46 124 MSGID_NOFQDN1 6450 1.01 0.05 1.45 125 TO_MALFORMED 6261 1.10 0.44 1.40 126 XM_H_Long_From02 6182 1.27 1.02 1.39 127 RELAYCOUNTRY_CA 5831 2.72 5.80 1.31 128 XM_UB50 5810 2.45 4.94 1.30 129 TR_XM_SpammyWords5 5779 2.06 3.73 1.30 130 RELAYCOUNTRY_GB 5692 1.19 1.01 1.28 131 XMSubNoVowel 5685 1.07 0.62 1.28 132 XMCapTrack 5603 1.00 0.43 1.26 133 XMGappySubj_01 5598 1.01 0.46 1.26 134 XM_B_COVIDMETA 5596 1.60 2.34 1.26 135 XM_GoogleGroups 5588 1.04 0.57 1.25 136 TM2_M_VERY_LONG_WORD 5525 1.49 2.02 1.24 137 USER_IN_DEF_DKIM_WL 5484 0.85 0.02 1.23 138 HELO_MISC_IP 5355 0.85 0.09 1.20 139 HTML_FONT_FACE_BAD 4946 0.97 0.66 1.11 140 TooManyTo_004 4806 0.89 0.48 1.08 141 XMBSHREFv2 4759 0.83 0.31 1.07 142 URI_TRY_3LD 4745 1.10 1.18 1.06 143 TR_XM_SpammyWords2 4631 4.87 13.19 1.04 144 RCVD_IN_BL_SPAMCOP_NET 4272 3.55 9.17 0.96 145 XMGenDplmaNmb 4228 1.13 1.53 0.95 146 XMStockSpam_06 4132 1.19 1.77 0.93 147 XMBody_95 4105 0.66 0.10 0.92 148 DKIM_ADSP_CUSTOM_MED 4064 1.24 1.95 0.91 149 T_FILL_THIS_FORM_SHORT 4043 1.25 1.99 0.91 150 TooManyTo_005 3928 0.74 0.43 0.88 151 XM_OfRef6 3721 1.66 3.45 0.83 152 TR_MetaPhish_Combo_01 3674 0.92 1.11 0.82 153 SpammyFromTLD_01 3576 1.90 4.30 0.80 154 RELAYCOUNTRY_DE 3555 1.23 2.18 0.80 155 HTTPS_HTTP_MISMATCH 3476 0.86 1.05 0.78 156 TVD_SPACE_RATIO 3282 0.53 0.09 0.74 157 HTML_IMAGE_ONLY_20 3100 0.70 0.70 0.70 158 XMBrknScrpt_02 2975 1.06 1.91 0.67 159 XM_ProductURIs 2957 0.67 0.68 0.66 160 PLING_QUERY 2922 0.73 0.90 0.66 161 T_XMDrugObfuBody_00 2850 0.99 1.74 0.64 162 XM_SPF_Unknown 2806 0.61 0.58 0.63 163 T_TooManySym_03 2798 0.52 0.30 0.63 164 NML_ADSP_CUSTOM_MED 2759 0.99 1.79 0.62 165 XMMoneyMeta_00 2754 1.09 2.11 0.62 166 XM_H_PHPMailer 2687 0.62 0.67 0.60 167 FROM_GOV_SPOOF 2621 0.46 0.18 0.59 168 XMNoVowels 2616 0.59 0.61 0.59 169 T_OBFU_PDF_ATTACH 2565 0.46 0.20 0.58 170 XMSubMetaSxObfu_03 2509 0.66 0.87 0.56 171 XMLngstWrd_00 2470 0.47 0.29 0.55 172 XM_ShortIntro_01 2423 0.49 0.38 0.54 173 MSGID_FROM_MTA_HEADER 2380 0.41 0.15 0.53 174 TR_MSPIKEBAYES00 2374 0.37 0.01 0.53 175 RCVD_IN_SORBS_DUL 2353 0.41 0.15 0.53 176 DIET_1 2351 0.75 1.22 0.53 177 TVD_SPACE_RATIO_MINFP 2346 0.46 0.31 0.53 178 XMBody_17 2334 0.86 1.59 0.52 179 XMHTMLBadTable_001 2328 0.59 0.72 0.52 180 XMBdyGiftCard01 2272 1.20 2.71 0.51 181 RDNS_DYNAMIC 2271 0.62 0.87 0.51 182 FROM_GOV_DKIM_AU 2241 0.38 0.13 0.50 183 PDS_OTHER_BAD_TLD 2209 1.24 2.85 0.50 184 SHORT_HELO_AND_INLINE_IMAGE 2196 0.36 0.06 0.49 185 XMLngstWrd_01 2191 0.42 0.27 0.49 186 XMSubMetaI_00 2183 0.65 0.99 0.49 187 FORGED_GMAIL_RCVD 2151 0.91 1.84 0.48 188 XMPhish30 2140 0.56 0.74 0.48 189 XMBody_78 2123 0.62 0.94 0.48 190 XM_DIRTYINTL 2084 1.51 3.77 0.47 191 MISSING_HEADERS 2046 0.44 0.39 0.46 192 T_XMHurry_00 2043 0.79 1.52 0.46 193 XM_B_SpammyWords4 1985 0.94 2.03 0.45 194 HTML_IMAGE_ONLY_28 1907 0.42 0.39 0.43 195 T_Symld_Words_02 1872 0.72 1.37 0.42 196 USER_IN_WELCOMELIST 1850 0.28 0.00 0.42 197 USER_IN_WHITELIST 1850 0.28 0.00 0.42 198 TM2_M_BODY_EMPTY 1829 0.31 0.08 0.41 199 XMSolicitRefs_0 1791 0.44 0.52 0.40 200 XMLngstWrd_02 1786 0.34 0.22 0.40 ----------------------------------------------------------------------