Email: 554703 Autolearn: 0 AvgScore: 1.92 AvgScanTime: 1.46 sec Spam: 129179 Autolearn: 0 AvgScore: 14.16 AvgScanTime: 1.66 sec Ham: 425524 Autolearn: 0 AvgScore: -1.79 AvgScanTime: 1.40 sec Time Spent Running SA: 225.05 hours Time Spent Processing Spam: 59.51 hours Time Spent Processing Ham: 165.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122948 86.62 95.18 84.02 2 DKIM_SIGNED 106636 72.17 82.55 69.02 3 XM_DK_Pass 102167 70.46 79.09 67.84 4 DKIM_VALID 99394 68.26 76.94 65.63 5 DCC_CHECK 97676 44.91 75.61 35.60 6 XM_B_Unicode 97001 67.58 75.09 65.30 7 RELAYCOUNTRY_US 94697 77.71 73.31 79.04 8 XM_B_SpammyWords 89009 50.93 68.90 45.48 9 XMListUnsubscribeExists 83434 45.69 64.59 39.96 10 DKIM_VALID_AU 73804 51.35 57.13 49.59 11 XM_DK_Undo_02 57039 15.65 44.16 7.00 12 XM_B_Unicode3 54474 38.19 42.17 36.99 13 BAYES_50 50870 50.76 39.38 54.21 14 XM_B_SpammyWords2 47886 22.15 37.07 17.62 15 LOC_TINY_FONT_1 45209 23.50 35.00 20.01 16 TR_XM_DKIM_Undo 44099 12.00 34.14 5.27 17 BAYES_99 43963 12.28 34.03 5.68 18 DKIM_VALID_EF 42996 29.44 33.28 28.27 19 HTML_FONT_LOW_CONTRAST 41840 26.22 32.39 24.34 20 MIME_HTML_ONLY 40340 23.60 31.23 21.28 21 T_KAM_HTML_FONT_INVALID 37405 19.08 28.96 16.08 22 RCVD_IN_MSPIKE_H2 34511 24.37 26.72 23.66 23 BAYES_999 34151 9.63 26.44 4.53 24 FVGT_m_MULTI_ODD 33599 21.55 26.01 20.19 25 TR_DCC_Bayes_99 33239 8.04 25.73 2.67 26 XMSubLong 33138 20.31 25.65 18.69 27 RELAYCOUNTRY_META 30407 8.64 23.54 4.11 28 DCC_CHECK_NEGATIVE 28093 52.78 21.75 62.20 29 T_TM2_M_HEADER_IN_MSG 27912 29.42 21.61 31.80 30 XM_Body_Dirty_Words 27660 13.26 21.41 10.78 31 UNTRUSTED_Relay 25746 5.92 19.93 1.67 32 RCVD_IN_MSPIKE_WL 25352 26.85 19.63 29.04 33 BOTNET 24615 5.43 19.05 1.29 34 XM_UncommonTLD01 21552 6.80 16.68 3.79 35 FSL_BULK_SIG 20126 9.16 15.58 7.20 36 XM_Multi_Part_URI 20056 11.14 15.53 9.81 37 XM_B_Unsub 19579 11.37 15.16 10.23 38 BOTNET_IPINHOSTNAME 18086 6.16 14.00 3.78 39 LOTS_OF_MONEY 17780 8.00 13.76 6.25 40 XMSexyCombo_05 16810 5.54 13.01 3.27 41 TR_XM_SpammyWords4 15842 5.77 12.26 3.80 42 XM_B_SpammyWords3 15801 5.89 12.23 3.96 43 MPART_ALT_DIFF 15373 8.04 11.90 6.86 44 TR_XM_SpammyWords2 14674 3.44 11.36 1.04 45 UNPARSEABLE_RELAY 13603 7.87 10.53 7.06 46 XM_Evil_Numbers_Gen 13474 10.36 10.43 10.34 47 TR_XM_UnparsRelay 13411 6.77 10.38 5.67 48 RCVD_IN_MSPIKE_H3 13191 13.44 10.21 14.42 49 BAYES_80 11698 5.53 9.06 4.47 50 MIME_HTML_MOSTLY 11625 3.87 9.00 2.32 51 RCVD_IN_MSPIKE_H4 10924 10.06 8.46 10.54 52 BAYES_60 10601 8.27 8.21 8.29 53 LotsOfNums_01 10596 7.99 8.20 7.93 54 XM_SendGrid 10410 6.68 8.06 6.26 55 XMSubMetaSx_00 9878 4.99 7.65 4.18 56 HTML_IMAGE_RATIO_02 9008 5.80 6.97 5.44 57 XM_H_Long_From01 8988 5.52 6.96 5.08 58 T_REMOTE_IMAGE 8959 4.92 6.94 4.31 59 SpammyFromTLD_02 8615 1.71 6.67 0.20 60 SpammyFromTLD_01 8446 2.10 6.54 0.75 61 XM_B_Phish_Phrases 8226 6.12 6.37 6.04 62 XM_UB50 8159 2.36 6.32 1.15 63 TR_XM_PhishingBody 7878 4.01 6.10 3.38 64 DKIM_INVALID 7242 3.91 5.61 3.39 65 RCVD_IN_BL_SPAMCOP_NET 7202 1.69 5.58 0.52 66 TooManyTo_001 7110 8.02 5.50 8.78 67 XM_UB99 6563 1.18 5.08 0.00 68 XM_SPF_SoftFail 6529 2.66 5.05 1.94 69 BAYES_95 6497 3.22 5.03 2.68 70 KHOP_HELO_FCRDNS 6251 2.50 4.84 1.79 71 RCVD_IN_MSPIKE_BL 6209 1.36 4.81 0.31 72 XM_DIRTYINTL 5935 1.35 4.59 0.37 73 TR_XM_DK_SendGrid 5763 4.21 4.46 4.13 74 TR_XM_MSPIKECOMBO 5665 1.23 4.39 0.27 75 RCVD_IN_PSBL 5622 1.04 4.35 0.04 76 XM_B_SpammyTLD 5594 2.23 4.33 1.59 77 RELAYCOUNTRY_FR 5558 1.19 4.30 0.24 78 RCVD_IN_RP_RNBL 5520 1.05 4.27 0.07 79 RELAYCOUNTRY_CA 5452 1.71 4.22 0.95 80 XMStrtUSub 5399 7.75 4.18 8.84 81 HTML_IMAGE_RATIO_04 5304 4.76 4.11 4.96 82 XM_OfRef6 5235 1.63 4.05 0.89 83 MIME_QP_LONG_LINE 5162 4.93 4.00 5.22 84 XMNumbers 5093 3.44 3.94 3.29 85 XM_UB999 5047 0.91 3.91 0.00 86 HTML_IMAGE_RATIO_06 4994 3.21 3.87 3.01 87 TR_XM_SpammyWords5 4967 1.78 3.85 1.15 88 T_XMDrugObfuBody_08 4828 1.98 3.74 1.44 89 TM2_M_URI_OPT_OUT 4639 4.41 3.59 4.66 90 MIME_HTML_ONLY_MULTI 4485 4.68 3.47 5.04 91 HTML_FONT_SIZE_LARGE 4452 0.87 3.45 0.09 92 XM_B_Phish66 4430 2.43 3.43 2.13 93 XM_UB60 4322 0.89 3.35 0.14 94 RCVD_IN_RP_SAFE 4125 5.59 3.19 6.31 95 BODY_URI_ONLY 4082 0.74 3.16 0.01 96 XMDiploma_00 3950 1.79 3.06 1.40 97 T_FILL_THIS_FORM_SHORT 3857 1.44 2.99 0.98 98 XM_B_COVIDMETA 3789 1.28 2.93 0.78 99 PDS_OTHER_BAD_TLD 3768 0.88 2.92 0.26 100 RCVD_IN_MSPIKE_L5 3762 0.74 2.91 0.08 101 XM_B_Unsub2 3761 1.60 2.91 1.20 102 URIBL_SBL_A 3731 0.95 2.89 0.36 103 XM_UB80 3709 0.70 2.87 0.04 104 T_XMDrugObfuBody_14 3707 2.44 2.87 2.31 105 RCVD_IN_IADB_LISTED 3558 4.55 2.75 5.09 106 NO_DNS_FOR_FROM 3543 0.80 2.74 0.21 107 HTML_IMAGE_ONLY_12 3542 0.81 2.74 0.22 108 DKIM_ADSP_NXDOMAIN 3526 0.81 2.73 0.23 109 TR_XM_MaxWHORU 3514 0.78 2.72 0.19 110 TR_XM_SB_Phish 3337 3.11 2.58 3.26 111 TM2_M_VERY_LONG_WORD 3324 1.45 2.57 1.11 112 HTML_MIME_NO_HTML_TAG 3277 2.55 2.54 2.55 113 URIBL_DBL_SPAM 3233 0.59 2.50 0.01 114 XMSubPhish11 3228 3.07 2.50 3.24 115 XM_CamelCaseFrm001 3206 1.80 2.48 1.59 116 TR_XM_SpammyWords3 3185 0.75 2.47 0.22 117 T_TooManySym_01 3173 4.10 2.46 4.60 118 HTML_SHORT_LINK_IMG_1 3171 0.58 2.45 0.01 119 BOTNET_NORDNS 3170 0.58 2.45 0.01 120 RCVD_IN_RP_CERTIFIED 3149 4.84 2.44 5.57 121 RCVD_IN_IADB_SPF 3127 3.95 2.42 4.41 122 RELAYCOUNTRY_DE 3122 0.92 2.42 0.46 123 MIXED_FONT_CASE 3088 0.56 2.39 0.00 124 RELAYCOUNTRY_IN 3048 0.62 2.36 0.10 125 XM_DK_Undo_01 2957 1.79 2.29 1.64 126 SUBJ_ALL_CAPS 2954 1.53 2.29 1.30 127 HTML_IMAGE_RATIO_08 2891 2.06 2.24 2.00 128 RCVD_IN_IADB_SENDERID 2891 3.53 2.24 3.93 129 RCVD_IN_IADB_DK 2863 3.42 2.22 3.78 130 XM_B_SpammyWords4 2848 0.96 2.20 0.58 131 DKIM_ADSP_CUSTOM_MED 2699 1.34 2.09 1.12 132 T_XMHurry_00 2691 0.73 2.08 0.31 133 URI_HEX 2608 1.80 2.02 1.73 134 URI_NOVOWEL 2541 2.68 1.97 2.90 135 TR_XM_COVIDMETA4 2491 0.77 1.93 0.42 136 XMBody_17 2475 0.66 1.92 0.28 137 MAILING_LIST_MULTI 2449 2.45 1.90 2.61 138 XMSexyCombo_01 2447 1.10 1.89 0.86 139 NML_ADSP_CUSTOM_MED 2444 1.02 1.89 0.75 140 FORGED_GMAIL_RCVD 2375 0.87 1.84 0.58 141 JH_SPAMMY_PATTERN01 2334 0.42 1.81 0.00 142 URI_PHP_REDIR 2297 0.41 1.78 0.00 143 XM_URI_RBL 2290 0.50 1.77 0.12 144 TR_Mismatch_TLD_02 2288 0.47 1.77 0.08 145 BAYES_40 2282 4.54 1.77 5.38 146 FROM_SUSPICIOUS_NTLD 2224 0.43 1.72 0.04 147 XMStockSpam_06 2218 1.20 1.72 1.05 148 URIBL_BLACK 2202 0.42 1.70 0.03 149 TR_XM_MaxBayes 2180 0.39 1.69 0.00 150 XM_UB95 2149 0.40 1.66 0.01 151 FROM_SUSPICIOUS_NTLD_FP 2136 0.41 1.65 0.03 152 MONEY_NOHTML 2130 0.45 1.65 0.08 153 T_XMDrugObfuBody_00 2126 0.82 1.65 0.57 154 URI_TRY_3LD 2078 1.08 1.61 0.92 155 TR_XM_INV_DKIM 2018 0.43 1.56 0.09 156 LongTLD 1999 0.48 1.55 0.16 157 ALL_TRUSTED 1974 14.19 1.53 18.04 158 MONEY_FORM_SHORT 1973 0.36 1.53 0.01 159 XMGenDplmaNmb 1952 1.00 1.51 0.85 160 FROM_EXCESS_BASE64 1907 1.86 1.48 1.97 161 XM_H_Long_From02 1873 0.99 1.45 0.85 162 XM_PDF 1847 5.17 1.43 6.30 163 RELAYCOUNTRY_GB 1836 1.07 1.42 0.96 164 TR_XM_COVIDMETA1 1798 0.65 1.39 0.42 165 XMBrknScrpt_02 1768 1.03 1.37 0.92 166 URI_NO_WWW_INFO_CGI 1750 0.33 1.35 0.01 167 HTML_IMAGE_ONLY_08 1736 0.39 1.34 0.10 168 USER_IN_DEF_DKIM_WL 1734 8.62 1.34 10.83 169 XM_B_SEO 1705 0.47 1.32 0.21 170 BAYES_20 1685 3.87 1.30 4.64 171 RCVD_IN_IADB_VOUCHED 1668 2.79 1.29 3.25 172 TR_Symld_Words 1667 1.47 1.29 1.53 173 TR_XM_SEO4 1643 0.37 1.27 0.10 174 TR_XM_BayesRelay 1636 0.30 1.27 0.01 175 TR_XM_PHPDW 1625 0.51 1.26 0.29 176 XMSlimDrugH 1617 0.49 1.25 0.26 177 HELO_NODOT 1579 1.91 1.22 2.12 178 TR_XM_PHPForged 1552 0.47 1.20 0.25 179 TR_XM_FormFill2 1522 0.47 1.18 0.25 180 HTML_IMAGE_ONLY_20 1521 0.90 1.18 0.82 181 XM_BadFromFormat 1511 0.40 1.17 0.16 182 XM_H_PHPOS 1503 0.45 1.16 0.24 183 T_HTML_TAG_BALANCE_CENTER 1489 0.37 1.15 0.14 184 XMMoneyMeta_00 1473 0.65 1.14 0.50 185 HELO_NO_DOMAIN 1461 1.89 1.13 2.12 186 XM_H_Undi_Recip 1434 0.42 1.11 0.22 187 XMHTML_After_End 1417 1.15 1.10 1.17 188 SHOPIFY_IMG_NOT_RCVD_SFY 1405 0.39 1.09 0.17 189 XM_Body_Dirty_Words_01 1393 0.40 1.08 0.19 190 XMSubMetaI_00 1351 0.73 1.05 0.63 191 XMBdyGiftCard01 1315 0.67 1.02 0.56 192 HTML_FONT_SIZE_HUGE 1312 0.33 1.02 0.12 193 T_MONEY_PERCENT 1310 0.45 1.01 0.28 194 TR_LOTS_OF_MONEY2 1310 0.45 1.01 0.28 195 GOOG_STO_IMG_HTML 1298 0.23 1.00 0.00 196 TR_BOTNET_NEGATE 1297 0.44 1.00 0.27 197 XMBody_78 1252 0.45 0.97 0.29 198 HTML_SHORT_LINK_IMG_3 1247 0.27 0.97 0.06 199 XMPhish08 1244 0.36 0.96 0.17 200 RCVD_IN_MSPIKE_H5 1237 3.35 0.96 4.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 357524 86.62 95.18 84.02 2 RELAYCOUNTRY_US 336350 77.71 73.31 79.04 3 DKIM_SIGNED 293687 72.17 82.55 69.02 4 XM_DK_Pass 288667 70.46 79.09 67.84 5 DKIM_VALID 279256 68.26 76.94 65.63 6 XM_B_Unicode 277846 67.58 75.09 65.30 7 DCC_CHECK_NEGATIVE 264693 52.78 21.75 62.20 8 BAYES_50 230675 50.76 39.38 54.21 9 DKIM_VALID_AU 211029 51.35 57.13 49.59 10 XM_B_SpammyWords 193515 50.93 68.90 45.48 11 XMListUnsubscribeExists 170019 45.69 64.59 39.96 12 XM_B_Unicode3 157394 38.19 42.17 36.99 13 DCC_CHECK 151466 44.91 75.61 35.60 14 T_TM2_M_HEADER_IN_MSG 135299 29.42 21.61 31.80 15 RCVD_IN_MSPIKE_WL 123566 26.85 19.63 29.04 16 DKIM_VALID_EF 120289 29.44 33.28 28.27 17 HTML_FONT_LOW_CONTRAST 103590 26.22 32.39 24.34 18 RCVD_IN_MSPIKE_H2 100667 24.37 26.72 23.66 19 MIME_HTML_ONLY 90559 23.60 31.23 21.28 20 FVGT_m_MULTI_ODD 85925 21.55 26.01 20.19 21 LOC_TINY_FONT_1 85151 23.50 35.00 20.01 22 XMSubLong 79541 20.31 25.65 18.69 23 ALL_TRUSTED 76765 14.19 1.53 18.04 24 XM_B_SpammyWords2 74993 22.15 37.07 17.62 25 T_KAM_HTML_FONT_INVALID 68416 19.08 28.96 16.08 26 RCVD_IN_MSPIKE_H3 61348 13.44 10.21 14.42 27 BAYES_00 50540 9.27 0.67 11.88 28 USER_IN_DEF_DKIM_WL 46095 8.62 1.34 10.83 29 XM_Body_Dirty_Words 45868 13.26 21.41 10.78 30 RCVD_IN_MSPIKE_H4 44857 10.06 8.46 10.54 31 XM_Evil_Numbers_Gen 44016 10.36 10.43 10.34 32 XM_B_Unsub 43513 11.37 15.16 10.23 33 XM_DKIMWhitelistDomains 42279 7.63 0.05 9.94 34 XM_Multi_Part_URI 41728 11.14 15.53 9.81 35 XMStrtUSub 37603 7.75 4.18 8.84 36 TooManyTo_001 37351 8.02 5.50 8.78 37 BAYES_60 35293 8.27 8.21 8.29 38 LotsOfNums_01 33731 7.99 8.20 7.93 39 FSL_BULK_SIG 30658 9.16 15.58 7.20 40 UNPARSEABLE_RELAY 30051 7.87 10.53 7.06 41 XM_DK_Undo_02 29779 15.65 44.16 7.00 42 MPART_ALT_DIFF 29205 8.04 11.90 6.86 43 TR_XM_DK_Bayes 27865 5.12 0.43 6.55 44 TR_XM_DK_Bayes1 26933 4.95 0.42 6.33 45 RCVD_IN_RP_SAFE 26871 5.59 3.19 6.31 46 XM_PDF 26827 5.17 1.43 6.30 47 XM_SendGrid 26631 6.68 8.06 6.26 48 LOTS_OF_MONEY 26610 8.00 13.76 6.25 49 XM_B_Phish_Phrases 25717 6.12 6.37 6.04 50 XM_H_Trusted_IP 24392 4.40 0.00 5.73 51 BAYES_99 24156 12.28 34.03 5.68 52 TR_XM_UnparsRelay 24118 6.77 10.38 5.67 53 RCVD_IN_RP_CERTIFIED 23709 4.84 2.44 5.57 54 HTML_IMAGE_RATIO_02 23138 5.80 6.97 5.44 55 BAYES_40 22881 4.54 1.77 5.38 56 TR_XM_DK_Bayes2 22813 4.19 0.32 5.36 57 TR_XM_DKIM_Undo 22442 12.00 34.14 5.27 58 MIME_QP_LONG_LINE 22203 4.93 4.00 5.22 59 RCVD_IN_IADB_LISTED 21656 4.55 2.75 5.09 60 XM_H_Long_From01 21626 5.52 6.96 5.08 61 MIME_HTML_ONLY_MULTI 21451 4.68 3.47 5.04 62 HTML_IMAGE_RATIO_04 21106 4.76 4.11 4.96 63 IN_ZIMBRA_NJ_WHITELIST 20942 3.79 0.05 4.92 64 TM2_M_URI_OPT_OUT 19837 4.41 3.59 4.66 65 BAYES_20 19764 3.87 1.30 4.64 66 T_TooManySym_01 19561 4.10 2.46 4.60 67 BAYES_999 19289 9.63 26.44 4.53 68 BAYES_80 19004 5.53 9.06 4.47 69 RCVD_IN_IADB_SPF 18774 3.95 2.42 4.41 70 T_REMOTE_IMAGE 18326 4.92 6.94 4.31 71 XMSubMetaSx_00 17787 4.99 7.65 4.18 72 TR_XM_DK_SendGrid 17595 4.21 4.46 4.13 73 RELAYCOUNTRY_META 17500 8.64 23.54 4.11 74 RCVD_IN_MSPIKE_H5 17361 3.35 0.96 4.08 75 XM_B_SpammyWords3 16860 5.89 12.23 3.96 76 RCVD_IN_IADB_SENDERID 16706 3.53 2.24 3.93 77 TR_XM_SpammyWords4 16181 5.77 12.26 3.80 78 XM_UncommonTLD01 16147 6.80 16.68 3.79 79 BOTNET_IPINHOSTNAME 16104 6.16 14.00 3.78 80 RCVD_IN_IADB_DK 16094 3.42 2.22 3.78 81 DKIM_INVALID 14431 3.91 5.61 3.39 82 TR_XM_PhishingBody 14388 4.01 6.10 3.38 83 XMNumbers 14012 3.44 3.94 3.29 84 XMSexyCombo_05 13929 5.54 13.01 3.27 85 TR_XM_SB_Phish 13892 3.11 2.58 3.26 86 RCVD_IN_IADB_VOUCHED 13829 2.79 1.29 3.25 87 XMSubPhish11 13774 3.07 2.50 3.24 88 HTML_IMAGE_RATIO_06 12801 3.21 3.87 3.01 89 URI_NOVOWEL 12325 2.68 1.97 2.90 90 BAYES_05 11827 2.26 0.55 2.78 91 BAYES_95 11383 3.22 5.03 2.68 92 TR_DCC_Bayes_99 11354 8.04 25.73 2.67 93 MAILING_LIST_MULTI 11123 2.45 1.90 2.61 94 ANY_BOUNCE_MESSAGE 11115 2.17 0.71 2.61 95 BOUNCE_MESSAGE 11114 2.17 0.71 2.61 96 HTML_MIME_NO_HTML_TAG 10846 2.55 2.54 2.55 97 TooManyTo_002 10822 2.16 0.91 2.54 98 T_TooManySym_02 9964 1.97 0.72 2.34 99 MIME_HTML_MOSTLY 9869 3.87 9.00 2.32 100 T_XMDrugObfuBody_14 9821 2.44 2.87 2.31 101 RCVD_IN_IADB_OPTIN 9268 1.88 0.89 2.18 102 XM_B_Phish66 9067 2.43 3.43 2.13 103 HELO_NODOT 9011 1.91 1.22 2.12 104 HELO_NO_DOMAIN 9009 1.89 1.13 2.12 105 XMSubNoVowel 8813 1.81 0.93 2.07 106 HTML_IMAGE_RATIO_08 8509 2.06 2.24 2.00 107 FROM_EXCESS_BASE64 8391 1.86 1.48 1.97 108 XM_SPF_SoftFail 8249 2.66 5.05 1.94 109 IN_HORDE_ADDRESS_BOOK 7815 1.43 0.08 1.84 110 KHOP_HELO_FCRDNS 7607 2.50 4.84 1.79 111 URI_HEX 7353 1.80 2.02 1.73 112 TooManyTo_003 7347 1.50 0.74 1.73 113 UNTRUSTED_Relay 7120 5.92 19.93 1.67 114 INVALID_MSGID 7020 1.35 0.37 1.65 115 XM_DK_Undo_01 6973 1.79 2.29 1.64 116 XM_CamelCaseFrm001 6782 1.80 2.48 1.59 117 XM_B_SpammyTLD 6764 2.23 4.33 1.59 118 TR_Symld_Words 6494 1.47 1.29 1.53 119 XMCapTrack 6396 1.30 0.62 1.50 120 TO_MALFORMED 6270 1.14 0.02 1.47 121 T_XMDrugObfuBody_08 6136 1.98 3.74 1.44 122 XMDiploma_00 5969 1.79 3.06 1.40 123 TVD_RCVD_IP 5779 1.09 0.19 1.36 124 XM_SPF_Unknown 5607 1.20 0.83 1.32 125 XM_GoogleGroups 5571 1.15 0.63 1.31 126 SUBJ_ALL_CAPS 5530 1.53 2.29 1.30 127 BOTNET 5501 5.43 19.05 1.29 128 TooManyTo_004 5274 1.10 0.66 1.24 129 XM_B_Unsub2 5094 1.60 2.91 1.20 130 XMHTML_After_End 4971 1.15 1.10 1.17 131 T_OBFU_PDF_ATTACH 4940 0.98 0.40 1.16 132 XM_UB50 4906 2.36 6.32 1.15 133 TR_XM_SpammyWords5 4881 1.78 3.85 1.15 134 XMSubMetaSxObfu_03 4848 1.05 0.78 1.14 135 DKIM_ADSP_CUSTOM_MED 4755 1.34 2.09 1.12 136 TM2_M_VERY_LONG_WORD 4707 1.45 2.57 1.11 137 XM_E_Blogspot 4580 0.85 0.11 1.08 138 XMStockSpam_06 4455 1.20 1.72 1.05 139 TR_XM_SpammyWords2 4419 3.44 11.36 1.04 140 XMGappySubj_01 4335 0.83 0.19 1.02 141 TooManyTo_005 4253 0.90 0.57 1.00 142 T_FILL_THIS_FORM_SHORT 4150 1.44 2.99 0.98 143 RELAYCOUNTRY_GB 4074 1.07 1.42 0.96 144 RELAYCOUNTRY_CA 4037 1.71 4.22 0.95 145 HTML_FONT_FACE_BAD 3988 0.91 0.81 0.94 146 XMBrknScrpt_02 3933 1.03 1.37 0.92 147 URI_TRY_3LD 3902 1.08 1.61 0.92 148 XM_OfRef6 3795 1.63 4.05 0.89 149 XMSexyCombo_01 3665 1.10 1.89 0.86 150 XM_H_Long_From02 3620 0.99 1.45 0.85 151 XMGenDplmaNmb 3608 1.00 1.51 0.85 152 HTML_IMAGE_ONLY_20 3479 0.90 1.18 0.82 153 XMBody_95 3328 0.63 0.11 0.78 154 XM_B_COVIDMETA 3300 1.28 2.93 0.78 155 HTTPS_HTTP_MISMATCH 3272 0.80 0.92 0.77 156 T_TooManySym_03 3208 0.66 0.35 0.75 157 NML_ADSP_CUSTOM_MED 3201 1.02 1.89 0.75 158 SpammyFromTLD_01 3198 2.10 6.54 0.75 159 XMBSHREFv2 3163 0.62 0.22 0.74 160 RCVD_IN_SORBS_DUL 3039 0.60 0.23 0.71 161 XM_ShortIntro_01 3007 0.71 0.73 0.71 162 TR_MetaPhish_Combo_01 2962 0.76 0.95 0.70 163 XMSubMetaI_00 2686 0.73 1.05 0.63 164 FROM_GOV_SPOOF 2653 0.53 0.22 0.62 165 XM_H_PHPMailer 2622 0.68 0.89 0.62 166 XMNoVowels 2523 0.60 0.63 0.59 167 XM_B_SpammyWords4 2483 0.96 2.20 0.58 168 T_Symld_Words_02 2479 0.63 0.80 0.58 169 FORGED_GMAIL_RCVD 2462 0.87 1.84 0.58 170 SHORT_HELO_AND_INLINE_IMAGE 2439 0.48 0.17 0.57 171 MSGID_NOFQDN1 2412 0.44 0.04 0.57 172 T_XMDrugObfuBody_00 2410 0.82 1.65 0.57 173 XMBdyGiftCard01 2390 0.67 1.02 0.56 174 TM2_M_BODY_EMPTY 2381 0.46 0.12 0.56 175 TR_MSPIKEBAYES00 2350 0.43 0.01 0.55 176 XM_ProductURIs 2224 0.56 0.68 0.52 177 XMPhish14 2220 0.58 0.77 0.52 178 RCVD_IN_BL_SPAMCOP_NET 2198 1.69 5.58 0.52 179 XMMoneyMeta_00 2130 0.65 1.14 0.50 180 XM_B_REG_HTML 2118 0.47 0.39 0.50 181 HTML_IMAGE_ONLY_28 2016 0.52 0.69 0.47 182 XMLngstWrd_00 1996 0.47 0.46 0.47 183 XMPhish30 1981 0.57 0.93 0.47 184 GMD_PDF_HORIZ 1968 0.38 0.13 0.46 185 RELAYCOUNTRY_DE 1967 0.92 2.42 0.46 186 HTML_IMAGE_ONLY_32 1939 0.41 0.25 0.46 187 XMHTMLBadTable_001 1934 0.52 0.75 0.45 188 XM_B_COPY_HTML 1892 0.48 0.60 0.44 189 MISSING_HEADERS 1874 0.47 0.59 0.44 190 TVD_SPACE_RATIO_MINFP 1859 0.42 0.37 0.44 191 T_MANY_PILL_PRICE 1813 0.33 0.00 0.43 192 TR_XM_COVIDMETA1 1808 0.65 1.39 0.42 193 TR_XM_COVIDMETA4 1773 0.77 1.93 0.42 194 TVD_SPACE_RATIO 1759 0.36 0.18 0.41 195 XMLngstWrd_01 1753 0.41 0.41 0.41 196 NICE_REPLY_A 1739 0.32 0.04 0.41 197 HTML_IMAGE_ONLY_24 1707 0.39 0.35 0.40 198 GMD_PDF_EMPTY_BODY 1685 0.32 0.09 0.40 199 RDNS_DYNAMIC 1663 0.45 0.64 0.39 200 USER_IN_WHITELIST 1625 0.29 0.00 0.38 ----------------------------------------------------------------------