Email: 651992 Autolearn: 0 AvgScore: 3.75 AvgScanTime: 1.33 sec Spam: 192951 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 1.60 sec Ham: 459041 Autolearn: 0 AvgScore: -0.50 AvgScanTime: 1.22 sec Time Spent Running SA: 241.65 hours Time Spent Processing Spam: 85.51 hours Time Spent Processing Ham: 156.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 185550 90.45 96.16 88.05 2 DKIM_SIGNED 159712 76.79 82.77 74.28 3 XM_DK_Pass 155336 75.19 80.51 72.95 4 DCC_CHECK 151826 50.80 78.69 39.08 5 DKIM_VALID 151577 73.15 78.56 70.88 6 XM_B_Unicode 145950 71.71 75.64 70.06 7 RELAYCOUNTRY_US 142935 79.70 74.08 82.07 8 XMListUnsubscribeExists 132885 54.64 68.87 48.66 9 XM_B_SpammyWords 129957 51.97 67.35 45.51 10 DKIM_VALID_AU 114768 54.87 59.48 52.93 11 XM_DK_Undo_02 88765 18.88 46.00 7.48 12 XM_B_Unicode3 88298 41.41 45.76 39.59 13 XM_B_SpammyWords2 76943 24.84 39.88 18.52 14 BAYES_50 70894 49.57 36.74 54.97 15 LOC_TINY_FONT_1 69986 26.30 36.27 22.11 16 TR_XM_DKIM_Undo 68843 14.16 35.68 5.11 17 BAYES_99 68683 14.48 35.60 5.61 18 MIME_HTML_ONLY 68485 24.83 35.49 20.35 19 HTML_FONT_LOW_CONTRAST 65000 28.84 33.69 26.80 20 T_KAM_HTML_FONT_INVALID 54930 21.15 28.47 18.08 21 DKIM_VALID_EF 54059 29.05 28.02 29.49 22 TR_DCC_Bayes_99 54037 10.04 28.01 2.49 23 BAYES_999 53784 11.43 27.87 4.51 24 FVGT_m_MULTI_ODD 52896 24.63 27.41 23.46 25 XMSubLong 51498 22.67 26.69 20.98 26 RCVD_IN_MSPIKE_WL 44979 29.67 23.31 32.35 27 RCVD_IN_MSPIKE_H2 43890 22.96 22.75 23.06 28 XM_Body_Dirty_Words 42432 14.68 21.99 11.61 29 T_TM2_M_HEADER_IN_MSG 40317 27.73 20.89 30.61 30 RELAYCOUNTRY_META 40152 9.59 20.81 4.87 31 DCC_CHECK_NEGATIVE 37483 46.66 19.43 58.10 32 UNTRUSTED_Relay 34496 6.60 17.88 1.85 33 XM_UncommonTLD01 32966 7.42 17.09 3.36 34 FSL_BULK_SIG 32168 9.42 16.67 6.37 35 XM_Multi_Part_URI 29005 12.26 15.03 11.09 36 TR_XM_SpammyWords2 25792 4.64 13.37 0.98 37 BOTNET 25761 5.31 13.35 1.93 38 XM_B_SpammyWords3 25528 6.72 13.23 3.98 39 BOTNET_IPINHOSTNAME 24768 7.32 12.84 5.00 40 XM_B_Unsub 24622 10.47 12.76 9.51 41 XMSexyCombo_05 24550 6.07 12.72 3.27 42 RCVD_IN_MSPIKE_H3 24368 15.07 12.63 16.10 43 XM_Evil_Numbers_Gen 23049 9.06 11.95 7.84 44 LOTS_OF_MONEY 21194 7.28 10.98 5.72 45 RCVD_IN_MSPIKE_H4 18919 11.78 9.81 12.61 46 UNPARSEABLE_RELAY 18746 8.32 9.72 7.74 47 TR_XM_UnparsRelay 18303 7.37 9.49 6.48 48 SpammyFromTLD_02 18248 2.95 9.46 0.21 49 BAYES_80 17687 6.23 9.17 5.00 50 TR_XM_SpammyWords4 17468 5.09 9.05 3.42 51 RCVD_IN_BL_SPAMCOP_NET 17069 3.06 8.85 0.63 52 XM_B_Phish_Phrases 16653 6.30 8.63 5.31 53 T_REMOTE_IMAGE 16076 4.86 8.33 3.40 54 BAYES_60 15626 8.77 8.10 9.05 55 LotsOfNums_01 15614 8.64 8.09 8.87 56 MPART_ALT_DIFF 15606 5.89 8.09 4.96 57 XMSubMetaSx_00 15248 4.74 7.90 3.41 58 XM_SendGrid 15095 7.24 7.82 6.99 59 KHOP_HELO_FCRDNS 15065 3.92 7.81 2.29 60 HTML_IMAGE_RATIO_02 14413 6.72 7.47 6.41 61 HTML_IMAGE_ONLY_12 13319 2.18 6.90 0.20 62 HTML_FONT_SIZE_LARGE 12635 2.05 6.55 0.15 63 BODY_URI_ONLY 12412 1.92 6.43 0.02 64 HTML_IMAGE_RATIO_04 12354 5.55 6.40 5.20 65 RELAYCOUNTRY_CA 11865 2.72 6.15 1.28 66 XMNumbers 11715 4.10 6.07 3.27 67 MIME_HTML_MOSTLY 11682 3.35 6.05 2.22 68 TR_XM_PhishingBody 11546 4.06 5.98 3.25 69 XM_H_Long_From01 11538 5.35 5.98 5.08 70 XM_UB50 11413 2.62 5.91 1.24 71 TooManyTo_001 10694 8.21 5.54 9.33 72 BAYES_95 10646 3.79 5.52 3.07 73 XMStrtUSub 9685 5.13 5.02 5.17 74 RCVD_IN_MSPIKE_BL 9578 1.60 4.96 0.19 75 TR_XM_MSPIKECOMBO 9485 1.58 4.92 0.18 76 TR_XM_DK_SendGrid 9342 4.38 4.84 4.19 77 XM_B_SpammyTLD 9024 2.70 4.68 1.88 78 TR_XM_SpammyWords5 8190 2.34 4.24 1.54 79 DKIM_INVALID 8135 3.64 4.22 3.39 80 RCVD_IN_RP_SAFE 7895 6.14 4.09 7.00 81 HTML_SHORT_LINK_IMG_2 7592 1.19 3.93 0.03 82 XM_SPF_SoftFail 7392 2.39 3.83 1.78 83 HTML_IMAGE_RATIO_06 7263 4.12 3.76 4.27 84 SpammyFromTLD_01 7171 1.69 3.72 0.84 85 XM_B_Phish66 7067 2.46 3.66 1.95 86 RCVD_IN_RP_RNBL 6683 1.06 3.46 0.05 87 XM_B_COVIDMETA 6543 1.75 3.39 1.06 88 TM2_M_URI_OPT_OUT 6462 3.02 3.35 2.88 89 XM_UB99 6311 0.97 3.27 0.00 90 T_XMDrugObfuBody_08 6286 2.09 3.26 1.60 91 T_TooManySym_01 6233 4.31 3.23 4.76 92 XM_DIRTYINTL 6195 1.27 3.21 0.46 93 XM_UB60 6130 1.04 3.18 0.15 94 MIME_QP_LONG_LINE 6116 5.09 3.17 5.90 95 TR_XM_SpammyWords3 6043 0.98 3.13 0.08 96 XM_UB80 5900 0.93 3.06 0.03 97 HTML_SHORT_LINK_IMG_1 5816 0.90 3.01 0.01 98 RCVD_IN_RP_CERTIFIED 5811 5.34 3.01 6.32 99 FROM_EXCESS_BASE64 5735 2.53 2.97 2.34 100 XM_OfRef6 5678 1.51 2.94 0.91 101 RCVD_IN_MSPIKE_L5 5641 0.92 2.92 0.08 102 MIME_HTML_ONLY_MULTI 5599 3.09 2.90 3.17 103 URI_HEX 5591 1.78 2.90 1.31 104 PDS_OTHER_BAD_TLD 5532 1.13 2.87 0.41 105 XM_B_SpammyWords4 5246 1.29 2.72 0.69 106 XM_B_Unsub2 5231 1.99 2.71 1.69 107 URIBL_SBL_A 5193 1.37 2.69 0.82 108 TR_XM_SB_Phish 4976 2.48 2.58 2.44 109 RELAYCOUNTRY_FR 4927 0.97 2.55 0.31 110 XMSubPhish11 4857 2.43 2.52 2.40 111 SUBJ_ALL_CAPS 4844 1.75 2.51 1.43 112 XMDiploma_00 4744 1.96 2.46 1.75 113 T_XMDrugObfuBody_14 4736 2.13 2.45 2.00 114 XM_CamelCaseFrm001 4731 2.03 2.45 1.85 115 XMSexyCombo_01 4727 1.08 2.45 0.50 116 TM2_M_VERY_LONG_WORD 4598 1.69 2.38 1.40 117 XM_UB999 4340 0.67 2.25 0.00 118 URIBL_DBL_SPAM 4271 0.66 2.21 0.01 119 XMBdyGiftCard01 4204 1.02 2.18 0.53 120 RCVD_IN_PSBL 4194 0.72 2.17 0.11 121 XM_DK_Undo_01 4144 1.71 2.15 1.53 122 RCVD_IN_IADB_LISTED 3994 4.54 2.07 5.57 123 FROM_SUSPICIOUS_NTLD 3950 0.65 2.05 0.06 124 T_XMHurry_00 3828 0.95 1.98 0.52 125 XM_URI_RBL 3813 0.68 1.98 0.14 126 RELAYCOUNTRY_DE 3804 0.91 1.97 0.46 127 TR_XM_BayesRelay 3790 0.60 1.96 0.02 128 HTML_IMAGE_RATIO_08 3766 2.50 1.95 2.73 129 TR_XM_COVIDMETA4 3731 0.84 1.93 0.38 130 XM_UB95 3693 0.58 1.91 0.02 131 XMStockSpam_06 3688 1.14 1.91 0.82 132 FROM_SUSPICIOUS_NTLD_FP 3631 0.59 1.88 0.05 133 XMBrknScrpt_02 3592 1.02 1.86 0.67 134 T_FILL_THIS_FORM_SHORT 3540 1.26 1.83 1.02 135 RCVD_IN_IADB_SPF 3489 3.97 1.81 4.88 136 HTML_MIME_NO_HTML_TAG 3473 2.42 1.80 2.68 137 URIBL_BLACK 3400 0.55 1.76 0.04 138 XMHTML_After_End 3392 1.43 1.76 1.29 139 XMMoneyMeta_00 3383 0.94 1.75 0.60 140 BAYES_40 3358 3.89 1.74 4.80 141 MAILING_LIST_MULTI 3296 2.54 1.71 2.89 142 RCVD_IN_IADB_DK 3274 3.48 1.70 4.22 143 BOTNET_NORDNS 3239 0.51 1.68 0.01 144 RCVD_IN_IADB_SENDERID 3239 3.56 1.68 4.35 145 XMGenDplmaNmb 3072 1.21 1.59 1.05 146 T_XMDrugObfuBody_00 2993 0.92 1.55 0.65 147 TR_Symld_Words 2943 1.54 1.53 1.55 148 TR_XM_PHPDW 2926 0.67 1.52 0.32 149 URI_NOVOWEL 2814 2.24 1.46 2.57 150 TR_XM_COVIDMETA1 2794 0.66 1.45 0.33 151 XMBody_17 2766 0.70 1.43 0.40 152 TR_XM_PHPForged 2690 0.59 1.39 0.26 153 XM_Body_Dirty_Words_01 2678 0.55 1.39 0.20 154 XMSubMetaI_00 2668 1.04 1.38 0.90 155 TR_XM_FormFill2 2665 0.59 1.38 0.26 156 TR_XM_INV_DKIM 2661 0.47 1.38 0.09 157 HK_RANDOM_REPLYTO 2661 0.54 1.38 0.18 158 XM_H_PHPOS 2654 0.59 1.38 0.25 159 ALL_TRUSTED 2591 10.61 1.34 14.51 160 BAYES_20 2583 3.14 1.34 3.90 161 URI_TRY_3LD 2563 1.12 1.33 1.04 162 XM_H_Long_From02 2452 1.37 1.27 1.41 163 XMSexyCombo_04 2424 0.43 1.26 0.09 164 LongTLD 2418 0.48 1.25 0.15 165 URI_PHP_REDIR 2292 0.36 1.19 0.01 166 RELAYCOUNTRY_GB 2284 1.16 1.18 1.14 167 TR_XM_RelayPhish 2252 0.40 1.17 0.07 168 TR_MetaPhish_Combo_01 2231 0.97 1.16 0.89 169 XM_Combo_Sbj 2224 0.59 1.15 0.36 170 RCVD_IN_MSPIKE_L4 2207 0.36 1.14 0.03 171 XMSlimDrugH 2206 0.54 1.14 0.29 172 THIS_AD 2155 0.76 1.12 0.61 173 XMSubMetaSxObfu_03 2110 0.66 1.09 0.48 174 HTML_FONT_SIZE_HUGE 2046 0.48 1.06 0.23 175 DIET_1 1923 0.66 1.00 0.52 176 BAYES_00 1889 8.36 0.98 11.47 177 XM_B_SEO 1888 0.50 0.98 0.30 178 TR_XM_MaxBayes 1877 0.29 0.97 0.01 179 RCVD_IN_IADB_VOUCHED 1777 2.71 0.92 3.46 180 TR_XM_SEO4 1773 0.36 0.92 0.12 181 T_Symld_Words_02 1765 0.70 0.91 0.61 182 XM_PDF 1743 3.49 0.90 4.58 183 TR_BOTNET_NEGATE 1738 0.57 0.90 0.44 184 HTTPS_HTTP_MISMATCH 1717 0.95 0.89 0.97 185 RCVD_IN_MSPIKE_H5 1692 2.82 0.88 3.64 186 XM_Body_Obfu01 1688 0.46 0.87 0.28 187 HTML_TAG_BALANCE_BODY 1684 0.53 0.87 0.39 188 XMPhish08 1678 0.53 0.87 0.39 189 XMSubNoVowel 1673 1.21 0.87 1.36 190 HTML_IMAGE_ONLY_20 1667 0.73 0.86 0.67 191 TR_Mismatch_TLD_02 1667 0.32 0.86 0.10 192 RCVD_IN_MSPIKE_L3 1637 0.31 0.85 0.08 193 BAYES_05 1564 1.75 0.81 2.15 194 XMBody_78 1520 0.49 0.79 0.37 195 RELAYCOUNTRY_AU 1516 0.50 0.79 0.39 196 SUBJ_DOLLARS 1499 0.45 0.78 0.31 197 T_TooManySym_02 1493 1.92 0.77 2.40 198 DKIM_ADSP_NXDOMAIN 1489 0.39 0.77 0.24 199 MALE_ENHANCE 1476 0.23 0.76 0.00 200 PLING_QUERY 1470 0.63 0.76 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 404166 90.45 96.16 88.05 2 RELAYCOUNTRY_US 376714 79.70 74.08 82.07 3 DKIM_SIGNED 340957 76.79 82.77 74.28 4 XM_DK_Pass 334890 75.19 80.51 72.95 5 DKIM_VALID 325380 73.15 78.56 70.88 6 XM_B_Unicode 321608 71.71 75.64 70.06 7 DCC_CHECK_NEGATIVE 266704 46.66 19.43 58.10 8 BAYES_50 252320 49.57 36.74 54.97 9 DKIM_VALID_AU 242950 54.87 59.48 52.93 10 XMListUnsubscribeExists 223379 54.64 68.87 48.66 11 XM_B_SpammyWords 208913 51.97 67.35 45.51 12 XM_B_Unicode3 181724 41.41 45.76 39.59 13 DCC_CHECK 179387 50.80 78.69 39.08 14 RCVD_IN_MSPIKE_WL 148478 29.67 23.31 32.35 15 T_TM2_M_HEADER_IN_MSG 140492 27.73 20.89 30.61 16 DKIM_VALID_EF 135356 29.05 28.02 29.49 17 HTML_FONT_LOW_CONTRAST 123015 28.84 33.69 26.80 18 FVGT_m_MULTI_ODD 107700 24.63 27.41 23.46 19 RCVD_IN_MSPIKE_H2 105833 22.96 22.75 23.06 20 LOC_TINY_FONT_1 101508 26.30 36.27 22.11 21 XMSubLong 96310 22.67 26.69 20.98 22 MIME_HTML_ONLY 93414 24.83 35.49 20.35 23 XM_B_SpammyWords2 85016 24.84 39.88 18.52 24 T_KAM_HTML_FONT_INVALID 82982 21.15 28.47 18.08 25 RCVD_IN_MSPIKE_H3 73883 15.07 12.63 16.10 26 ALL_TRUSTED 66585 10.61 1.34 14.51 27 RCVD_IN_MSPIKE_H4 57873 11.78 9.81 12.61 28 XM_Body_Dirty_Words 53293 14.68 21.99 11.61 29 BAYES_00 52630 8.36 0.98 11.47 30 XM_Multi_Part_URI 50906 12.26 15.03 11.09 31 XM_B_Unsub 43634 10.47 12.76 9.51 32 TooManyTo_001 42820 8.21 5.54 9.33 33 BAYES_60 41525 8.77 8.10 9.05 34 XM_DKIMWhitelistDomains 41071 6.36 0.21 8.95 35 LotsOfNums_01 40715 8.64 8.09 8.87 36 XM_Evil_Numbers_Gen 36001 9.06 11.95 7.84 37 UNPARSEABLE_RELAY 35521 8.32 9.72 7.74 38 XM_DK_Undo_02 34325 18.88 46.00 7.48 39 TR_XM_DK_Bayes 33204 5.32 0.75 7.23 40 TR_XM_DK_Bayes1 32252 5.17 0.74 7.03 41 RCVD_IN_RP_SAFE 32142 6.14 4.09 7.00 42 XM_SendGrid 32086 7.24 7.82 6.99 43 TR_XM_UnparsRelay 29760 7.37 9.49 6.48 44 HTML_IMAGE_RATIO_02 29420 6.72 7.47 6.41 45 FSL_BULK_SIG 29241 9.42 16.67 6.37 46 RCVD_IN_RP_CERTIFIED 29007 5.34 3.01 6.32 47 TR_XM_DK_Bayes2 27983 4.50 0.69 6.10 48 MIME_QP_LONG_LINE 27079 5.09 3.17 5.90 49 LOTS_OF_MONEY 26253 7.28 10.98 5.72 50 BAYES_99 25730 14.48 35.60 5.61 51 RCVD_IN_IADB_LISTED 25583 4.54 2.07 5.57 52 IN_ZIMBRA_NJ_WHITELIST 24750 3.81 0.05 5.39 53 XM_B_Phish_Phrases 24390 6.30 8.63 5.31 54 HTML_IMAGE_RATIO_04 23858 5.55 6.40 5.20 55 XMStrtUSub 23752 5.13 5.02 5.17 56 TR_XM_DKIM_Undo 23466 14.16 35.68 5.11 57 XM_H_Long_From01 23326 5.35 5.98 5.08 58 BOTNET_IPINHOSTNAME 22963 7.32 12.84 5.00 59 BAYES_80 22951 6.23 9.17 5.00 60 MPART_ALT_DIFF 22777 5.89 8.09 4.96 61 RCVD_IN_IADB_SPF 22422 3.97 1.81 4.88 62 RELAYCOUNTRY_META 22377 9.59 20.81 4.87 63 BAYES_40 22025 3.89 1.74 4.80 64 T_TooManySym_01 21860 4.31 3.23 4.76 65 XM_PDF 21037 3.49 0.90 4.58 66 BAYES_999 20719 11.43 27.87 4.51 67 RCVD_IN_IADB_SENDERID 19990 3.56 1.68 4.35 68 HTML_IMAGE_RATIO_06 19602 4.12 3.76 4.27 69 RCVD_IN_IADB_DK 19383 3.48 1.70 4.22 70 TR_XM_DK_SendGrid 19227 4.38 4.84 4.19 71 XM_B_SpammyWords3 18285 6.72 13.23 3.98 72 BAYES_20 17908 3.14 1.34 3.90 73 RCVD_IN_MSPIKE_H5 16722 2.82 0.88 3.64 74 RCVD_IN_IADB_VOUCHED 15874 2.71 0.92 3.46 75 TR_XM_SpammyWords4 15689 5.09 9.05 3.42 76 XMSubMetaSx_00 15659 4.74 7.90 3.41 77 T_REMOTE_IMAGE 15604 4.86 8.33 3.40 78 DKIM_INVALID 15577 3.64 4.22 3.39 79 XM_UncommonTLD01 15417 7.42 17.09 3.36 80 XM_H_Trusted_IP 15344 2.35 0.00 3.34 81 XMSexyCombo_05 15014 6.07 12.72 3.27 82 XMNumbers 15008 4.10 6.07 3.27 83 TR_XM_PhishingBody 14937 4.06 5.98 3.25 84 MIME_HTML_ONLY_MULTI 14530 3.09 2.90 3.17 85 BAYES_95 14085 3.79 5.52 3.07 86 ANY_BOUNCE_MESSAGE 13399 2.18 0.43 2.92 87 BOUNCE_MESSAGE 13398 2.18 0.43 2.92 88 MAILING_LIST_MULTI 13271 2.54 1.71 2.89 89 TM2_M_URI_OPT_OUT 13214 3.02 3.35 2.88 90 HTML_IMAGE_RATIO_08 12541 2.50 1.95 2.73 91 HTML_MIME_NO_HTML_TAG 12314 2.42 1.80 2.68 92 URI_NOVOWEL 11791 2.24 1.46 2.57 93 TR_DCC_Bayes_99 11449 10.04 28.01 2.49 94 TR_XM_SB_Phish 11194 2.48 2.58 2.44 95 TooManyTo_002 11160 1.92 0.71 2.43 96 XMSubPhish11 11007 2.43 2.52 2.40 97 T_TooManySym_02 10999 1.92 0.77 2.40 98 FROM_EXCESS_BASE64 10746 2.53 2.97 2.34 99 KHOP_HELO_FCRDNS 10500 3.92 7.81 2.29 100 RCVD_IN_IADB_OPTIN 10359 1.78 0.64 2.26 101 MIME_HTML_MOSTLY 10190 3.35 6.05 2.22 102 BAYES_05 9860 1.75 0.81 2.15 103 T_XMDrugObfuBody_14 9159 2.13 2.45 2.00 104 HELO_NODOT 9095 1.56 0.56 1.98 105 HELO_NO_DOMAIN 9095 1.56 0.56 1.98 106 XM_B_Phish66 8971 2.46 3.66 1.95 107 BOTNET 8879 5.31 13.35 1.93 108 XM_B_SpammyTLD 8608 2.70 4.68 1.88 109 UNTRUSTED_Relay 8513 6.60 17.88 1.85 110 XM_CamelCaseFrm001 8496 2.03 2.45 1.85 111 XM_SPF_SoftFail 8185 2.39 3.83 1.78 112 TVD_RCVD_IP 8091 1.30 0.20 1.76 113 XMDiploma_00 8016 1.96 2.46 1.75 114 XM_B_Unsub2 7740 1.99 2.71 1.69 115 T_XMDrugObfuBody_08 7325 2.09 3.26 1.60 116 TooManyTo_003 7290 1.29 0.59 1.59 117 IN_HORDE_ADDRESS_BOOK 7214 1.13 0.08 1.57 118 TR_Symld_Words 7110 1.54 1.53 1.55 119 TR_XM_SpammyWords5 7067 2.34 4.24 1.54 120 XM_DK_Undo_01 7008 1.71 2.15 1.53 121 INVALID_MSGID 6993 1.20 0.42 1.52 122 SUBJ_ALL_CAPS 6585 1.75 2.51 1.43 123 XM_H_Long_From02 6493 1.37 1.27 1.41 124 MSGID_NOFQDN1 6458 1.01 0.05 1.41 125 TM2_M_VERY_LONG_WORD 6428 1.69 2.38 1.40 126 TO_MALFORMED 6291 0.97 0.02 1.37 127 XMSubNoVowel 6240 1.21 0.87 1.36 128 XMCapTrack 6159 1.07 0.43 1.34 129 URI_HEX 6003 1.78 2.90 1.31 130 XMHTML_After_End 5935 1.43 1.76 1.29 131 RELAYCOUNTRY_CA 5855 2.72 6.15 1.28 132 XM_UB50 5692 2.62 5.91 1.24 133 XM_GoogleGroups 5458 1.00 0.54 1.19 134 HELO_MISC_IP 5339 0.83 0.05 1.16 135 TooManyTo_004 5250 0.96 0.53 1.14 136 RELAYCOUNTRY_GB 5249 1.16 1.18 1.14 137 USER_IN_DEF_DKIM_WL 4881 0.75 0.00 1.06 138 XM_B_COVIDMETA 4853 1.75 3.39 1.06 139 XMGenDplmaNmb 4833 1.21 1.59 1.05 140 XMBSHREFv2 4813 0.80 0.22 1.05 141 URI_TRY_3LD 4771 1.12 1.33 1.04 142 T_FILL_THIS_FORM_SHORT 4680 1.26 1.83 1.02 143 HTML_FONT_FACE_BAD 4488 0.90 0.70 0.98 144 TR_XM_SpammyWords2 4483 4.64 13.37 0.98 145 HTTPS_HTTP_MISMATCH 4450 0.95 0.89 0.97 146 TooManyTo_005 4290 0.80 0.46 0.93 147 XMGappySubj_01 4263 0.70 0.15 0.93 148 DKIM_ADSP_CUSTOM_MED 4231 0.86 0.72 0.92 149 XM_OfRef6 4198 1.51 2.94 0.91 150 XMSubMetaI_00 4121 1.04 1.38 0.90 151 TR_MetaPhish_Combo_01 4090 0.97 1.16 0.89 152 XMBody_95 3982 0.65 0.12 0.87 153 TR_MSPIKEBAYES00 3954 0.61 0.02 0.86 154 SpammyFromTLD_01 3848 1.69 3.72 0.84 155 URIBL_SBL_A 3767 1.37 2.69 0.82 156 XMStockSpam_06 3765 1.14 1.91 0.82 157 TVD_SPACE_RATIO 3347 0.53 0.07 0.73 158 XM_ProductURIs 3241 0.71 0.71 0.71 159 XM_B_SpammyWords4 3175 1.29 2.72 0.69 160 RCVD_IN_SORBS_DUL 3095 0.52 0.16 0.67 161 HTML_IMAGE_ONLY_20 3088 0.73 0.86 0.67 162 XMBrknScrpt_02 3056 1.02 1.86 0.67 163 FROM_GOV_DKIM_AU 3025 0.55 0.29 0.66 164 T_XMDrugObfuBody_00 2986 0.92 1.55 0.65 165 NML_ADSP_CUSTOM_MED 2951 0.62 0.56 0.64 166 XM_ShortIntro_01 2927 0.63 0.61 0.64 167 RCVD_IN_BL_SPAMCOP_NET 2875 3.06 8.85 0.63 168 T_TooManySym_03 2866 0.55 0.37 0.62 169 XMNoVowels 2808 0.58 0.51 0.61 170 T_Symld_Words_02 2797 0.70 0.91 0.61 171 THIS_AD 2793 0.76 1.12 0.61 172 XMMoneyMeta_00 2751 0.94 1.75 0.60 173 T_OBFU_PDF_ATTACH 2743 0.47 0.18 0.60 174 XM_SPF_Unknown 2664 0.61 0.68 0.58 175 PLING_QUERY 2656 0.63 0.76 0.58 176 SHORT_HELO_AND_INLINE_IMAGE 2631 0.42 0.07 0.57 177 FROM_GOV_SPOOF 2626 0.46 0.19 0.57 178 XM_H_PHPMailer 2600 0.60 0.67 0.57 179 XMHTMLBadTable_001 2596 0.59 0.66 0.57 180 XMLngstWrd_00 2575 0.51 0.39 0.56 181 TM2_M_BODY_EMPTY 2530 0.41 0.06 0.55 182 XMBdyGiftCard01 2444 1.02 2.18 0.53 183 HTML_IMAGE_ONLY_28 2438 0.49 0.41 0.53 184 DIET_1 2398 0.66 1.00 0.52 185 T_XMHurry_00 2389 0.95 1.98 0.52 186 XMLngstWrd_01 2332 0.46 0.35 0.51 187 XMSolicitRefs_0 2328 0.47 0.39 0.51 188 MISSING_HEADERS 2304 0.58 0.76 0.50 189 XMSexyCombo_01 2283 1.08 2.45 0.50 190 FORGED_GMAIL_RCVD 2219 0.52 0.61 0.48 191 XMSubMetaSxObfu_03 2188 0.66 1.09 0.48 192 XMPhish30 2148 0.55 0.75 0.47 193 XM_DIRTYINTL 2108 1.27 3.21 0.46 194 RELAYCOUNTRY_DE 2103 0.91 1.97 0.46 195 NUMERIC_HTTP_ADDR 2086 0.50 0.60 0.45 196 SHOPIFY_IMG_NOT_RCVD_SFY 2061 0.45 0.45 0.45 197 RDNS_DYNAMIC 2050 0.52 0.70 0.45 198 XM_B_COPY_HTML 2008 0.47 0.55 0.44 199 TR_BOTNET_NEGATE 2002 0.57 0.90 0.44 200 HTML_IMAGE_ONLY_32 1998 0.36 0.17 0.44 ----------------------------------------------------------------------