Email: 672425 Autolearn: 0 AvgScore: 1.46 AvgScanTime: 2.26 sec Spam: 146682 Autolearn: 0 AvgScore: 12.14 AvgScanTime: 3.94 sec Ham: 525743 Autolearn: 0 AvgScore: -1.52 AvgScanTime: 1.79 sec Time Spent Running SA: 421.98 hours Time Spent Processing Spam: 160.42 hours Time Spent Processing Ham: 261.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141341 89.01 96.36 86.96 2 DKIM_SIGNED 124499 74.99 84.88 72.23 3 XM_DK_Pass 120415 73.52 82.09 71.12 4 RELAYCOUNTRY_US 117359 80.49 80.01 80.63 5 DCC_CHECK 114493 46.64 78.06 37.88 6 XM_B_Unicode 110478 69.88 75.32 68.37 7 XMListUnsubscribeExists 108283 53.16 73.82 47.40 8 DKIM_VALID 101617 67.31 69.28 66.77 9 DKIM_VALID_AU 75299 48.85 51.33 48.16 10 XM_DK_Undo_02 65773 15.45 44.84 7.25 11 XM_B_Unicode3 63957 40.48 43.60 39.61 12 BAYES_50 60224 49.28 41.06 51.57 13 MIME_HTML_ONLY 56942 25.55 38.82 21.85 14 LOC_TINY_FONT_1 50836 24.63 34.66 21.84 15 HTML_FONT_LOW_CONTRAST 44235 27.17 30.16 26.34 16 BAYES_99 43356 9.64 29.56 4.08 17 DKIM_VALID_EF 41923 26.52 28.58 25.94 18 FVGT_m_MULTI_ODD 40529 22.75 27.63 21.39 19 T_KAM_HTML_FONT_INVALID 39009 19.43 26.59 17.42 20 XMSubLong 36462 21.31 24.86 20.32 21 TR_DCC_Bayes_99 34147 6.58 23.28 1.92 22 BAYES_999 33536 7.53 22.86 3.25 23 RELAYCOUNTRY_META 33288 9.08 22.69 5.28 24 RCVD_IN_MSPIKE_H2 33191 20.53 22.63 19.94 25 BOTNET 31432 6.78 21.43 2.70 26 T_TM2_M_HEADER_IN_MSG 29566 26.53 20.16 28.31 27 DCC_CHECK_NEGATIVE 29387 51.38 20.03 60.12 28 XM_Body_Dirty_Words 27558 13.41 18.79 11.91 29 XM_Multi_Part_URI 24728 12.20 16.86 10.90 30 DKIM_INVALID 22882 7.68 15.60 5.47 31 XM_UncommonTLD01 22624 6.07 15.42 3.46 32 HTML_IMAGE_RATIO_02 22594 8.99 15.40 7.20 33 LOTS_OF_MONEY 21896 9.72 14.93 8.27 34 BOTNET_IPINHOSTNAME 21430 7.31 14.61 5.27 35 XM_B_Phish_Phrases 19794 8.89 13.49 7.61 36 UNTRUSTED_Relay 18629 4.06 12.70 1.64 37 XM_B_Unsub 17864 11.68 12.18 11.54 38 FSL_BULK_SIG 16960 9.10 11.56 8.42 39 NO_DNS_FOR_FROM 16278 4.93 11.10 3.21 40 LotsOfNums_01 15418 9.17 10.51 8.80 41 XM_Evil_Numbers_Gen 15401 9.37 10.50 9.06 42 XMSexyCombo_05 15200 4.75 10.36 3.18 43 XM_B_COVIDMETA 12447 3.47 8.49 2.07 44 BAYES_80 11786 4.30 8.04 3.26 45 XMSubMetaSx_00 11018 5.21 7.51 4.57 46 TR_XM_PhishingBody 10602 3.95 7.23 3.04 47 RELAYCOUNTRY_CA 10236 2.65 6.98 1.45 48 BAYES_60 10135 6.05 6.91 5.80 49 TR_XM_COVIDMETA4 9721 2.52 6.63 1.38 50 XM_CamelCaseFrm001 9352 2.93 6.38 1.97 51 XM_H_Long_From01 9078 5.86 6.19 5.77 52 XM_UB50 8808 2.07 6.00 0.97 53 MPART_ALT_DIFF 8779 6.93 5.99 7.19 54 MIME_QP_LONG_LINE 8594 6.26 5.86 6.37 55 TooManyTo_001 8166 7.89 5.57 8.54 56 HTML_IMAGE_RATIO_04 8084 5.90 5.51 6.01 57 KHOP_HELO_FCRDNS 7971 2.65 5.43 1.87 58 UNPARSEABLE_RELAY 7925 6.92 5.40 7.35 59 RCVD_IN_MSPIKE_BL 7668 2.61 5.23 1.89 60 URIBL_SBL_A 7654 1.24 5.22 0.13 61 XM_B_Phish66 7572 2.51 5.16 1.77 62 T_REMOTE_IMAGE 7421 4.03 5.06 3.75 63 XM_SendGrid 7222 6.34 4.92 6.74 64 T_XMDrugObfuBody_08 7100 2.45 4.84 1.79 65 BAYES_95 6879 2.56 4.69 1.96 66 SpammyFromTLD_02 6824 1.28 4.65 0.33 67 RCVD_IN_BL_SPAMCOP_NET 6805 1.63 4.64 0.79 68 RCVD_IN_MSPIKE_WL 6375 10.45 4.35 12.15 69 RCVD_IN_MSPIKE_L3 6152 2.09 4.19 1.51 70 RELAYCOUNTRY_FR 6042 1.06 4.12 0.20 71 XMHTML_After_End 5934 1.37 4.05 0.62 72 XMStrtUSub 5713 5.54 3.89 6.00 73 HTML_IMAGE_RATIO_06 5702 3.65 3.89 3.58 74 TR_XM_MaxBayes 5694 0.86 3.88 0.02 75 PDS_OTHER_BAD_TLD 5647 1.25 3.85 0.52 76 XMNumbers 5572 3.55 3.80 3.48 77 XMBody_17 5424 1.29 3.70 0.62 78 FROM_SUSPICIOUS_NTLD 5371 0.82 3.66 0.03 79 FROM_SUSPICIOUS_NTLD_FP 5325 0.81 3.63 0.03 80 XM_B_SpammyTLD 5265 2.32 3.59 1.97 81 MIME_HTML_MOSTLY 5098 2.86 3.48 2.69 82 XM_OfRef6 5097 1.54 3.47 1.00 83 BAYES_40 5094 5.26 3.47 5.76 84 RDNS_DYNAMIC 5043 1.00 3.44 0.33 85 TM2_M_URI_OPT_OUT 4996 5.11 3.41 5.59 86 FROM_EXCESS_BASE64 4879 2.51 3.33 2.28 87 LongTLD 4848 0.86 3.31 0.18 88 RCVD_IN_MSPIKE_H3 4835 7.69 3.30 8.92 89 XM_SPF_SoftFail 4825 1.95 3.29 1.58 90 XM_DIRTYINTL 4661 1.11 3.18 0.53 91 TR_XM_INV_DKIM 4513 0.79 3.08 0.15 92 SpammyFromTLD_01 4500 1.27 3.07 0.77 93 BODY_URI_ONLY 4383 0.70 2.99 0.07 94 DATE_IN_PAST_03_06 4369 0.70 2.98 0.07 95 DATE_IN_PAST_12_24 4284 0.66 2.92 0.03 96 TR_XM_COVIDMETA1 4134 1.07 2.82 0.58 97 XMSexyCombo_01 4128 1.47 2.81 1.10 98 TR_LOTS_OF_MONEY3 4099 1.08 2.79 0.60 99 DATE_IN_PAST_06_12 4096 0.72 2.79 0.14 100 HTML_IMAGE_RATIO_08 4095 2.49 2.79 2.40 101 T_XMDrugObfuBody_14 4016 2.05 2.74 1.85 102 URI_HEX 4012 1.47 2.74 1.12 103 XM_URI_RBL 3995 0.73 2.72 0.18 104 XMStockSpam_06 3968 1.39 2.71 1.02 105 MIME_HTML_ONLY_MULTI 3792 4.41 2.59 4.92 106 BAYES_20 3779 3.85 2.58 4.21 107 RCVD_IN_IADB_LISTED 3724 4.81 2.54 5.45 108 XMDiploma_00 3493 2.24 2.38 2.20 109 URI_TRY_3LD 3408 1.37 2.32 1.11 110 RCVD_IN_IADB_SPF 3376 4.23 2.30 4.76 111 T_XMHurry_00 3362 0.79 2.29 0.37 112 RCVD_IN_IADB_DK 3269 3.73 2.23 4.15 113 RCVD_IN_IADB_SENDERID 3263 3.75 2.22 4.17 114 TM2_M_VERY_LONG_WORD 3165 1.42 2.16 1.22 115 XM_B_Unsub2 3151 1.95 2.15 1.90 116 BAYES_00 3118 16.51 2.13 20.53 117 RCVD_IN_RP_SAFE 3072 6.35 2.09 7.54 118 RCVD_IN_RP_RNBL 3050 0.48 2.08 0.04 119 HTML_MIME_NO_HTML_TAG 2991 2.82 2.04 3.04 120 XM_UB99 2918 0.44 1.99 0.00 121 TR_XM_DK_SendGrid 2807 3.43 1.91 3.85 122 T_TooManySym_01 2756 4.07 1.88 4.69 123 RELAYCOUNTRY_IN 2715 0.46 1.85 0.07 124 XMGenDplmaNmb 2700 1.69 1.84 1.65 125 T_XMDrugObfuBody_00 2655 0.98 1.81 0.74 126 MAILING_LIST_MULTI 2638 2.43 1.80 2.60 127 TR_XM_PHPDW 2635 0.74 1.80 0.44 128 TR_XM_PHPForged 2612 0.73 1.78 0.43 129 TR_XM_FormFill2 2586 0.72 1.76 0.44 130 DIET_1 2583 0.61 1.76 0.29 131 REPLYTO_WITHOUT_TO_CC 2583 0.43 1.76 0.06 132 XM_H_PHPOS 2582 0.72 1.76 0.43 133 XM_UB60 2567 0.43 1.75 0.07 134 BOTNET_NORDNS 2484 0.39 1.69 0.02 135 RCVD_IN_PSBL 2387 0.37 1.63 0.02 136 TR_XM_DK_Bayes 2376 9.62 1.62 11.85 137 BAYES_05 2311 2.55 1.58 2.82 138 RELAYCOUNTRY_DE 2233 0.74 1.52 0.52 139 XMBdyGiftCard01 2185 1.10 1.49 1.00 140 XMBrknScrpt_02 2178 1.00 1.48 0.86 141 T_FILL_THIS_FORM_SHORT 2161 1.22 1.47 1.14 142 TR_XM_MaxSPIKE 2156 0.42 1.47 0.12 143 XM_DK_Undo_01 2112 1.83 1.44 1.94 144 TR_XM_RelayPhish 2076 0.42 1.42 0.14 145 XMBody_29 1982 0.34 1.35 0.06 146 MPART_ALT_DIFF_COUNT 1961 0.61 1.34 0.41 147 RCVD_IN_RP_CERTIFIED 1945 5.78 1.33 7.02 148 SUBJ_DOLLARS 1914 0.49 1.30 0.27 149 XMSexyCombo_04 1880 0.68 1.28 0.51 150 SUBJ_ALL_CAPS 1865 1.40 1.27 1.44 151 MISSING_HEADERS 1831 0.68 1.25 0.52 152 SHORT_SHORTNER 1813 0.29 1.24 0.02 153 FILL_THIS_FORM 1801 0.55 1.23 0.37 154 XM_H_MailChimp 1799 0.41 1.23 0.18 155 XM_OfRef7 1784 0.36 1.22 0.12 156 XMSubMetaSxObfu_03 1774 1.50 1.21 1.58 157 HTML_SHORT_LINK_IMG_1 1758 0.27 1.20 0.01 158 RELAYCOUNTRY_GB 1740 1.07 1.19 1.04 159 XM_UB999 1709 0.26 1.17 0.00 160 ALL_TRUSTED 1701 12.72 1.16 15.95 161 TR_Mismatch_TLD_02 1699 0.32 1.16 0.09 162 HK_RANDOM_REPLYTO 1637 0.40 1.12 0.20 163 MIME_HEADER_CTYPE_ONLY 1610 0.41 1.10 0.21 164 XM_UB80 1596 0.26 1.09 0.02 165 TR_MetaPhish_Combo_01 1586 0.97 1.08 0.93 166 RCVD_IN_MSPIKE_H4 1540 2.76 1.05 3.23 167 SHORT_URI_2 1531 0.25 1.04 0.03 168 URI_NOVOWEL 1511 0.59 1.03 0.47 169 SHORTENER_SHORT_IMG 1466 0.22 1.00 0.00 170 RCVD_IN_IADB_VOUCHED 1453 2.84 0.99 3.36 171 XMPhish30 1436 0.48 0.98 0.34 172 HDRS_LCASE_IMGONLY 1430 0.22 0.97 0.01 173 TR_XM_DK_Bayes1 1407 8.73 0.96 10.90 174 TR_LOTS_OF_MONEY2 1404 0.45 0.96 0.31 175 T_MONEY_PERCENT 1404 0.45 0.96 0.31 176 XMSlimDrugH 1390 0.39 0.95 0.24 177 TO_EQ_FM_DOM_HTML_ONLY 1386 0.23 0.94 0.03 178 HTML_IMAGE_ONLY_04 1378 0.26 0.94 0.07 179 XM_PDF 1373 4.49 0.94 5.48 180 XMSubMetaI_00 1351 0.58 0.92 0.49 181 NO_FM_NAME_IP_HOSTN 1345 0.20 0.92 0.00 182 TR_Symld_Words 1341 1.59 0.91 1.77 183 DKIM_ADSP_CUSTOM_MED 1338 1.25 0.91 1.35 184 XM_H_PHPMailer 1299 0.57 0.89 0.49 185 TO_EQ_FM_DOM_HTML_IMG 1288 0.20 0.88 0.02 186 XM_ProductURIs 1288 0.77 0.88 0.74 187 XMBody_78 1288 0.54 0.88 0.44 188 TR_XM_DK_Bayes2 1276 7.67 0.87 9.56 189 RELAYCOUNTRY_IT 1276 0.23 0.87 0.06 190 HTML_SHORT_CENTER 1263 0.19 0.86 0.00 191 HTTPS_HTTP_MISMATCH 1201 0.77 0.82 0.76 192 XM_UB95 1190 0.18 0.81 0.01 193 XMMoneyMeta_00 1164 0.68 0.79 0.64 194 XM_H_Long_From02 1121 1.07 0.76 1.16 195 XM_RXBody 1117 0.52 0.76 0.45 196 RELAYCOUNTRY_AT 1075 0.29 0.73 0.16 197 TooManyTo_002 1067 1.98 0.73 2.33 198 XM_H_PHPOS_M 1066 0.29 0.73 0.17 199 TM2_M_A_HREF_HREF 1065 0.44 0.73 0.36 200 XMSubMetaSSxObfu_00 1044 0.17 0.71 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 457175 89.01 96.36 86.96 2 RELAYCOUNTRY_US 423909 80.49 80.01 80.63 3 DKIM_SIGNED 379756 74.99 84.88 72.23 4 XM_DK_Pass 373919 73.52 82.09 71.12 5 XM_B_Unicode 359432 69.88 75.32 68.37 6 DKIM_VALID 351017 67.31 69.28 66.77 7 DCC_CHECK_NEGATIVE 316077 51.38 20.03 60.12 8 BAYES_50 271134 49.28 41.06 51.57 9 DKIM_VALID_AU 253207 48.85 51.33 48.16 10 XMListUnsubscribeExists 249200 53.16 73.82 47.40 11 XM_B_Unicode3 208263 40.48 43.60 39.61 12 DCC_CHECK 199142 46.64 78.06 37.88 13 T_TM2_M_HEADER_IN_MSG 148853 26.53 20.16 28.31 14 HTML_FONT_LOW_CONTRAST 138459 27.17 30.16 26.34 15 DKIM_VALID_EF 136378 26.52 28.58 25.94 16 MIME_HTML_ONLY 114868 25.55 38.82 21.85 17 LOC_TINY_FONT_1 114812 24.63 34.66 21.84 18 FVGT_m_MULTI_ODD 112462 22.75 27.63 21.39 19 BAYES_00 107915 16.51 2.13 20.53 20 XMSubLong 106835 21.31 24.86 20.32 21 RCVD_IN_MSPIKE_H2 104848 20.53 22.63 19.94 22 T_KAM_HTML_FONT_INVALID 91610 19.43 26.59 17.42 23 ALL_TRUSTED 83855 12.72 1.16 15.95 24 RCVD_IN_MSPIKE_WL 63885 10.45 4.35 12.15 25 XM_Body_Dirty_Words 62642 13.41 18.79 11.91 26 TR_XM_DK_Bayes 62281 9.62 1.62 11.85 27 XM_B_Unsub 60668 11.68 12.18 11.54 28 XM_Multi_Part_URI 57325 12.20 16.86 10.90 29 TR_XM_DK_Bayes1 57281 8.73 0.96 10.90 30 TR_XM_DK_Bayes2 50276 7.67 0.87 9.56 31 XM_Evil_Numbers_Gen 47612 9.37 10.50 9.06 32 RCVD_IN_MSPIKE_H3 46884 7.69 3.30 8.92 33 LotsOfNums_01 46241 9.17 10.51 8.80 34 TooManyTo_001 44914 7.89 5.57 8.54 35 FSL_BULK_SIG 44248 9.10 11.56 8.42 36 LOTS_OF_MONEY 43483 9.72 14.93 8.27 37 XM_B_Phish_Phrases 40003 8.89 13.49 7.61 38 RCVD_IN_RP_SAFE 39642 6.35 2.09 7.54 39 UNPARSEABLE_RELAY 38627 6.92 5.40 7.35 40 XM_DK_Undo_02 38099 15.45 44.84 7.25 41 HTML_IMAGE_RATIO_02 37878 8.99 15.40 7.20 42 MPART_ALT_DIFF 37813 6.93 5.99 7.19 43 RCVD_IN_RP_CERTIFIED 36906 5.78 1.33 7.02 44 XM_SendGrid 35420 6.34 4.92 6.74 45 XM_DKIMWhitelistDomains 34979 5.30 0.46 6.65 46 MIME_QP_LONG_LINE 33509 6.26 5.86 6.37 47 HTML_IMAGE_RATIO_04 31585 5.90 5.51 6.01 48 XMStrtUSub 31570 5.54 3.89 6.00 49 BAYES_60 30514 6.05 6.91 5.80 50 XM_H_Long_From01 30336 5.86 6.19 5.77 51 BAYES_40 30283 5.26 3.47 5.76 52 TM2_M_URI_OPT_OUT 29377 5.11 3.41 5.59 53 XM_PDF 28803 4.49 0.94 5.48 54 DKIM_INVALID 28739 7.68 15.60 5.47 55 RCVD_IN_IADB_LISTED 28645 4.81 2.54 5.45 56 RELAYCOUNTRY_META 27757 9.08 22.69 5.28 57 BOTNET_IPINHOSTNAME 27722 7.31 14.61 5.27 58 MIME_HTML_ONLY_MULTI 25882 4.41 2.59 4.92 59 XM_H_Trusted_IP 25560 3.80 0.00 4.86 60 RCVD_IN_IADB_SPF 25044 4.23 2.30 4.76 61 T_TooManySym_01 24633 4.07 1.88 4.69 62 XMSubMetaSx_00 24003 5.21 7.51 4.57 63 BAYES_20 22133 3.85 2.58 4.21 64 RCVD_IN_IADB_SENDERID 21939 3.75 2.22 4.17 65 RCVD_IN_IADB_DK 21829 3.73 2.23 4.15 66 BAYES_99 21468 9.64 29.56 4.08 67 TR_XM_DK_SendGrid 20226 3.43 1.91 3.85 68 T_REMOTE_IMAGE 19707 4.03 5.06 3.75 69 HTML_IMAGE_RATIO_06 18813 3.65 3.89 3.58 70 XMNumbers 18314 3.55 3.80 3.48 71 XM_UncommonTLD01 18168 6.07 15.42 3.46 72 RCVD_IN_IADB_VOUCHED 17663 2.84 0.99 3.36 73 IN_ZIMBRA_NJ_WHITELIST 17395 2.59 0.02 3.31 74 BAYES_80 17129 4.30 8.04 3.26 75 BAYES_999 17109 7.53 22.86 3.25 76 RCVD_IN_MSPIKE_H4 17001 2.76 1.05 3.23 77 ANY_BOUNCE_MESSAGE 16925 2.61 0.43 3.22 78 BOUNCE_MESSAGE 16917 2.61 0.43 3.22 79 NO_DNS_FOR_FROM 16861 4.93 11.10 3.21 80 XMSexyCombo_05 16731 4.75 10.36 3.18 81 TR_XM_PhishingBody 15987 3.95 7.23 3.04 82 HTML_MIME_NO_HTML_TAG 15979 2.82 2.04 3.04 83 BAYES_05 14846 2.55 1.58 2.82 84 BOTNET 14179 6.78 21.43 2.70 85 MIME_HTML_MOSTLY 14138 2.86 3.48 2.69 86 MAILING_LIST_MULTI 13683 2.43 1.80 2.60 87 HTML_IMAGE_RATIO_08 12619 2.49 2.79 2.40 88 TooManyTo_002 12249 1.98 0.73 2.33 89 FROM_EXCESS_BASE64 11987 2.51 3.33 2.28 90 T_TooManySym_02 11870 1.90 0.62 2.26 91 XMDiploma_00 11581 2.24 2.38 2.20 92 RCVD_IN_IADB_OPTIN 11022 1.76 0.55 2.10 93 XM_B_COVIDMETA 10890 3.47 8.49 2.07 94 XM_CamelCaseFrm001 10377 2.93 6.38 1.97 95 XM_B_SpammyTLD 10339 2.32 3.59 1.97 96 BAYES_95 10307 2.56 4.69 1.96 97 XM_DK_Undo_01 10220 1.83 1.44 1.94 98 TR_DCC_Bayes_99 10115 6.58 23.28 1.92 99 XM_B_Unsub2 9976 1.95 2.15 1.90 100 RCVD_IN_MSPIKE_BL 9913 2.61 5.23 1.89 101 KHOP_HELO_FCRDNS 9856 2.65 5.43 1.87 102 T_XMDrugObfuBody_14 9748 2.05 2.74 1.85 103 T_XMDrugObfuBody_08 9406 2.45 4.84 1.79 104 TR_Symld_Words 9320 1.59 0.91 1.77 105 XM_B_Phish66 9280 2.51 5.16 1.77 106 TVD_RCVD_IP 9133 1.38 0.11 1.74 107 XMGenDplmaNmb 8656 1.69 1.84 1.65 108 UNTRUSTED_Relay 8645 4.06 12.70 1.64 109 TooManyTo_003 8386 1.37 0.58 1.60 110 XM_SPF_SoftFail 8305 1.95 3.29 1.58 111 XMSubMetaSxObfu_03 8305 1.50 1.21 1.58 112 IN_HORDE_ADDRESS_BOOK 8088 1.22 0.06 1.54 113 HTML_FONT_FACE_BAD 8020 1.32 0.60 1.53 114 RCVD_IN_MSPIKE_L3 7931 2.09 4.19 1.51 115 RELAYCOUNTRY_CA 7607 2.65 6.98 1.45 116 INVALID_MSGID 7591 1.15 0.09 1.44 117 SUBJ_ALL_CAPS 7574 1.40 1.27 1.44 118 HELO_NODOT 7271 1.21 0.59 1.38 119 HELO_NO_DOMAIN 7270 1.21 0.59 1.38 120 HELO_MISC_IP 7264 1.09 0.05 1.38 121 CK_HELO_DYNAMIC_SPLIT_IP 7257 1.09 0.05 1.38 122 TR_XM_COVIDMETA4 7238 2.52 6.63 1.38 123 TO_MALFORMED 7202 1.09 0.09 1.37 124 DKIM_ADSP_CUSTOM_MED 7073 1.25 0.91 1.35 125 XMSubNoVowel 7055 1.16 0.52 1.34 126 XMGappySubj_01 7017 1.07 0.13 1.33 127 XM_GoogleGroups 6943 1.14 0.48 1.32 128 TooManyTo_004 6452 1.07 0.52 1.23 129 TM2_M_VERY_LONG_WORD 6396 1.42 2.16 1.22 130 XM_H_Long_From02 6086 1.07 0.76 1.16 131 T_FILL_THIS_FORM_SHORT 6018 1.22 1.47 1.14 132 XMCapTrack 6007 1.00 0.48 1.14 133 T_OBFU_PDF_ATTACH 5960 0.95 0.31 1.13 134 USER_IN_DEF_DKIM_WL 5916 0.88 0.00 1.13 135 URI_HEX 5879 1.47 2.74 1.12 136 URI_TRY_3LD 5813 1.37 2.32 1.11 137 XMSexyCombo_01 5788 1.47 2.81 1.10 138 XM_GRM 5500 0.82 0.00 1.05 139 RELAYCOUNTRY_GB 5454 1.07 1.19 1.04 140 XMStockSpam_06 5362 1.39 2.71 1.02 141 TooManyTo_005 5336 0.89 0.46 1.01 142 XM_OfRef6 5280 1.54 3.47 1.00 143 XMBdyGiftCard01 5235 1.10 1.49 1.00 144 NML_ADSP_CUSTOM_MED 5093 0.90 0.66 0.97 145 XM_UB50 5078 2.07 6.00 0.97 146 XM_SPF_Unknown 4944 0.85 0.51 0.94 147 TR_MetaPhish_Combo_01 4905 0.97 1.08 0.93 148 XMBrknScrpt_02 4535 1.00 1.48 0.86 149 XMClaimOffer 4417 0.74 0.39 0.84 150 RCVD_IN_BL_SPAMCOP_NET 4131 1.63 4.64 0.79 151 SpammyFromTLD_01 4065 1.27 3.07 0.77 152 HTTPS_HTTP_MISMATCH 3987 0.77 0.82 0.76 153 T_XMDrugObfuBody_00 3902 0.98 1.81 0.74 154 XM_ProductURIs 3897 0.77 0.88 0.74 155 T_TooManySym_03 3866 0.63 0.24 0.74 156 TR_MSPIKEBAYES00 3456 0.52 0.00 0.66 157 XMNoVowels 3409 0.62 0.54 0.65 158 XMMoneyMeta_00 3390 0.68 0.79 0.64 159 FROM_GOV_DKIM_AU 3282 0.52 0.14 0.62 160 FROM_GOV_SPOOF 3278 0.57 0.39 0.62 161 XMHTML_After_End 3262 1.37 4.05 0.62 162 XMBody_17 3248 1.29 3.70 0.62 163 HTML_IMAGE_ONLY_20 3135 0.57 0.46 0.60 164 TR_LOTS_OF_MONEY3 3133 1.08 2.79 0.60 165 THIS_AD 3072 0.60 0.66 0.58 166 TR_XM_COVIDMETA1 3040 1.07 2.82 0.58 167 FORGED_GMAIL_RCVD 3007 0.60 0.69 0.57 168 XM_ShortIntro_01 2878 0.49 0.30 0.55 169 XM_DIRTYINTL 2788 1.11 3.18 0.53 170 MISSING_HEADERS 2737 0.68 1.25 0.52 171 PDS_OTHER_BAD_TLD 2730 1.25 3.85 0.52 172 RELAYCOUNTRY_DE 2718 0.74 1.52 0.52 173 XMSexyCombo_04 2696 0.68 1.28 0.51 174 T_Symld_Words_02 2609 0.53 0.65 0.50 175 XMSubMetaI_00 2580 0.58 0.92 0.49 176 XM_H_PHPMailer 2550 0.57 0.89 0.49 177 XMPhish14 2512 0.48 0.49 0.48 178 XMGappySubj_02 2481 0.38 0.03 0.47 179 URI_NOVOWEL 2479 0.59 1.03 0.47 180 RELAYCOUNTRY_AU 2463 0.51 0.66 0.47 181 XMLngstWrd_00 2460 0.45 0.38 0.47 182 XMPhish08 2380 0.50 0.68 0.45 183 XM_RXBody 2374 0.52 0.76 0.45 184 XMRcvdHeader_15 2349 0.35 0.00 0.45 185 TR_XM_PHPDW 2333 0.74 1.80 0.44 186 XMBody_78 2311 0.54 0.88 0.44 187 TR_XM_FormFill2 2289 0.72 1.76 0.44 188 TR_XM_PHPForged 2283 0.73 1.78 0.43 189 RCVD_IN_SORBS_DUL 2280 0.36 0.09 0.43 190 XM_H_PHPOS 2253 0.72 1.76 0.43 191 XM_E_Blogspot 2248 0.35 0.08 0.43 192 XMHTMLBadTable_001 2248 0.44 0.46 0.43 193 RELAYCOUNTRY_NL 2180 0.44 0.54 0.41 194 MPART_ALT_DIFF_COUNT 2153 0.61 1.34 0.41 195 XMLngstWrd_01 2122 0.39 0.35 0.40 196 MSGID_FROM_MTA_HEADER 2108 0.36 0.20 0.40 197 TM2_M_BODY_EMPTY 2095 0.36 0.22 0.40 198 XM_B_REG_HTML 2092 0.40 0.39 0.40 199 HTML_IMAGE_ONLY_28 2005 0.40 0.45 0.38 200 T_XMHurry_00 1969 0.79 2.29 0.37 ----------------------------------------------------------------------