Email: 686111 Autolearn: 0 AvgScore: 3.36 AvgScanTime: 1.21 sec Spam: 203408 Autolearn: 0 AvgScore: 13.42 AvgScanTime: 1.35 sec Ham: 482703 Autolearn: 0 AvgScore: -0.88 AvgScanTime: 1.15 sec Time Spent Running SA: 230.10 hours Time Spent Processing Spam: 76.02 hours Time Spent Processing Ham: 154.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 192635 89.55 94.70 87.39 2 DKIM_SIGNED 170817 76.48 83.98 73.31 3 XM_DK_Pass 164526 74.65 80.88 72.02 4 DKIM_VALID 160778 72.72 79.04 70.06 5 DCC_CHECK 152801 48.65 75.12 37.49 6 RELAYCOUNTRY_US 146226 78.52 71.89 81.31 7 XM_B_Unicode 145341 70.06 71.45 69.48 8 XM_B_SpammyWords 137108 54.10 67.41 48.50 9 XMListUnsubscribeExists 128955 53.11 63.40 48.77 10 DKIM_VALID_AU 121107 54.57 59.54 52.47 11 XM_DK_Undo_02 85296 16.84 41.93 6.26 12 XM_B_SpammyWords2 84485 27.33 41.53 21.34 13 BAYES_50 76110 49.80 37.42 55.01 14 XM_B_Unicode3 75910 40.10 37.32 41.27 15 LOC_TINY_FONT_1 69585 27.06 34.21 24.05 16 HTML_FONT_LOW_CONTRAST 69362 29.00 34.10 26.85 17 TR_XM_DKIM_Undo 67710 13.11 33.29 4.61 18 BAYES_99 66098 12.37 32.50 3.90 19 MIME_HTML_ONLY 64904 25.07 31.91 22.19 20 DKIM_VALID_EF 55862 27.47 27.46 27.48 21 RCVD_IN_MSPIKE_H2 54624 26.10 26.85 25.79 22 FVGT_m_MULTI_ODD 54623 22.69 26.85 20.94 23 RELAYCOUNTRY_META 53206 11.17 26.16 4.85 24 BAYES_999 50966 9.62 25.06 3.12 25 T_KAM_HTML_FONT_INVALID 50067 19.74 24.61 17.69 26 TR_DCC_Bayes_99 48602 8.35 23.89 1.80 27 T_TM2_M_HEADER_IN_MSG 48283 26.91 23.74 28.25 28 DCC_CHECK_NEGATIVE 47304 49.57 23.26 60.66 29 XMSubLong 45213 22.12 22.23 22.07 30 UNTRUSTED_Relay 42281 7.67 20.79 2.15 31 XM_Body_Dirty_Words 40036 15.32 19.68 13.48 32 XM_Multi_Part_URI 37161 13.58 18.27 11.60 33 XM_B_Unsub 33951 13.19 16.69 11.71 34 FSL_BULK_SIG 32575 8.59 16.01 5.46 35 RCVD_IN_MSPIKE_WL 31587 23.81 15.53 27.30 36 BOTNET 31393 5.69 15.43 1.58 37 LOTS_OF_MONEY 29916 10.12 14.71 8.19 38 TR_XM_SpammyWords2 29746 4.77 14.62 0.62 39 LotsOfNums_01 26032 9.95 12.80 8.76 40 XM_B_SpammyWords3 25901 7.21 12.73 4.88 41 BOTNET_IPINHOSTNAME 24925 6.69 12.25 4.35 42 XM_B_Phish_Phrases 23373 7.94 11.49 6.44 43 XMSexyCombo_05 22668 6.45 11.14 4.47 44 XM_Evil_Numbers_Gen 20788 9.09 10.22 8.61 45 XM_UncommonTLD01 20033 5.16 9.85 3.18 46 BAYES_60 19237 8.44 9.46 8.01 47 MIME_HTML_MOSTLY 18776 4.50 9.23 2.50 48 BAYES_80 18557 5.69 9.12 4.24 49 MPART_ALT_DIFF 18439 7.24 9.07 6.46 50 RCVD_IN_MSPIKE_BL 18066 3.36 8.88 1.03 51 XM_UB50 17877 3.39 8.79 1.11 52 XMSubMetaSx_00 16770 5.13 8.24 3.81 53 RCVD_IN_MSPIKE_H3 16673 13.18 8.20 15.28 54 HTML_IMAGE_RATIO_02 16053 7.30 7.89 7.05 55 T_REMOTE_IMAGE 14370 4.31 7.06 3.14 56 RCVD_IN_BL_SPAMCOP_NET 13379 2.63 6.58 0.97 57 RCVD_IN_MSPIKE_H4 13032 8.50 6.41 9.38 58 XM_B_SpammyTLD 12414 3.14 6.10 1.89 59 XMNumbers 12246 4.11 6.02 3.30 60 XMBrknScrpt_02 11864 2.39 5.83 0.94 61 HTML_MIME_NO_HTML_TAG 11689 3.29 5.75 2.25 62 TR_XM_SpammyWords3 11643 2.06 5.72 0.51 63 UNPARSEABLE_RELAY 11278 6.97 5.54 7.57 64 KHOP_HELO_FCRDNS 11252 2.73 5.53 1.55 65 URIBL_SBL_A 10948 1.80 5.38 0.29 66 HTML_IMAGE_RATIO_04 10825 6.19 5.32 6.56 67 TooManyTo_001 10772 7.20 5.30 8.00 68 BAYES_95 10770 3.27 5.29 2.42 69 XM_H_Long_From01 10706 5.20 5.26 5.18 70 HTML_IMAGE_ONLY_12 10564 1.70 5.19 0.23 71 RELAYCOUNTRY_CA 10478 2.55 5.15 1.46 72 HTML_SHORT_LINK_IMG_1 10303 1.53 5.07 0.04 73 BODY_URI_ONLY 10261 1.52 5.04 0.04 74 RCVD_IN_MSPIKE_L3 10061 1.95 4.95 0.68 75 DKIM_INVALID 10039 3.75 4.94 3.26 76 RELAYCOUNTRY_FR 9949 1.65 4.89 0.29 77 XM_UB60 9563 1.47 4.70 0.11 78 TM2_M_URI_OPT_OUT 9517 4.61 4.68 4.57 79 RCVD_IN_RP_RNBL 9338 1.39 4.59 0.04 80 TR_XM_PhishingBody 9333 3.45 4.59 2.97 81 SpammyFromTLD_01 9325 2.00 4.58 0.91 82 XM_SendGrid 9143 6.17 4.49 6.88 83 RCVD_IN_RP_SAFE 9119 5.99 4.48 6.63 84 XM_DIRTYINTL 8898 1.58 4.37 0.40 85 US_DOLLARS_3 8612 2.46 4.23 1.71 86 XM_B_COVIDMETA 8063 2.10 3.96 1.31 87 XM_OfRef6 8021 2.06 3.94 1.27 88 TR_Sbj_FN_Bdy 7960 1.26 3.91 0.15 89 T_FONT_INVIS_NAKED_TO 7949 2.52 3.91 1.93 90 XMBody_17 7888 1.68 3.88 0.76 91 RCVD_IN_RP_CERTIFIED 7771 5.42 3.82 6.09 92 XM_SPF_SoftFail 7295 2.18 3.59 1.58 93 XM_B_Unsub2 7279 2.54 3.58 2.11 94 XMSubEmpty 7262 1.20 3.57 0.20 95 XMSexyCombo_01 7227 1.72 3.55 0.95 96 HTML_IMAGE_RATIO_06 7223 4.01 3.55 4.21 97 RELAYCOUNTRY_SG 7141 1.09 3.51 0.06 98 TR_LOTS_OF_MONEY3 7068 1.54 3.47 0.72 99 RCVD_IN_MSPIKE_L5 6951 1.12 3.42 0.16 100 XMNoSubject 6948 1.06 3.42 0.07 101 MISSING_SUBJECT 6948 1.06 3.42 0.07 102 LH_URI_DOM_IN_PATH 6905 2.44 3.39 2.03 103 URI_HEX 6771 1.93 3.33 1.33 104 XMStrtUSub 6419 3.87 3.16 4.17 105 TM2_M_VERY_LONG_WORD 6069 1.63 2.98 1.06 106 HTML_IMAGE_RATIO_08 5955 2.67 2.93 2.56 107 T_XMDrugObfuBody_08 5881 2.02 2.89 1.65 108 URI_TRY_3LD 5838 1.65 2.87 1.13 109 XMDiploma_00 5530 1.90 2.72 1.55 110 MIME_QP_LONG_LINE 5364 4.72 2.64 5.60 111 TR_XM_DK_SendGrid 5301 3.76 2.61 4.25 112 SUBJ_ALL_CAPS 5297 2.00 2.60 1.74 113 RCVD_IN_IADB_LISTED 5231 4.71 2.57 5.61 114 XM_UB80 5224 0.78 2.57 0.03 115 RELAYCOUNTRY_UA 5151 0.76 2.53 0.01 116 XM_UB99 5122 0.75 2.52 0.00 117 T_TooManySym_01 5009 4.99 2.46 6.05 118 RCVD_IN_PSBL 4950 0.74 2.43 0.03 119 SpammyFromTLD_02 4918 1.01 2.42 0.42 120 FROM_EXCESS_BASE64 4890 2.62 2.40 2.72 121 ANY_BOUNCE_MESSAGE 4870 3.03 2.39 3.30 122 XM_B_Phish66 4868 1.87 2.39 1.64 123 BOUNCE_MESSAGE 4865 3.02 2.39 3.29 124 BAYES_40 4832 4.32 2.38 5.14 125 XMSexyCombo_04 4738 1.07 2.33 0.53 126 PDS_OTHER_BAD_TLD 4685 0.98 2.30 0.42 127 XM_B_SpammyWords4 4616 1.29 2.27 0.88 128 XMSlimDrugH 4614 0.88 2.27 0.29 129 XM_CamelCaseFrm001 4587 1.92 2.26 1.79 130 TR_XM_SB_Phish 4574 2.16 2.25 2.12 131 MIME_HTML_ONLY_MULTI 4554 3.82 2.24 4.49 132 RCVD_IN_IADB_SPF 4546 4.15 2.23 4.96 133 TR_XM_MaxSPIKE 4472 0.66 2.20 0.02 134 XMSubMetaSx_01 4337 1.00 2.13 0.52 135 XMSubPhish11 4177 2.09 2.05 2.10 136 RCVD_IN_IADB_SENDERID 4148 3.74 2.04 4.46 137 RCVD_IN_IADB_DK 4118 3.66 2.02 4.34 138 T_XMDrugObfuBody_14 4089 1.65 2.01 1.50 139 TR_XM_MaxBayes 4065 0.60 2.00 0.01 140 TO_IN_SUBJ 3995 0.63 1.96 0.07 141 BOTNET_NORDNS 3985 0.60 1.96 0.02 142 RELAYCOUNTRY_IN 3980 0.75 1.96 0.24 143 XMSexyCombo_02 3943 0.87 1.94 0.42 144 T_XMHurry_00 3883 0.97 1.91 0.58 145 SHORT_URI 3821 0.59 1.88 0.04 146 TR_XM_COVIDMETA4 3795 0.80 1.87 0.35 147 URI_OPTOUT_3LD 3723 0.60 1.83 0.07 148 TR_Symld_Words 3699 2.78 1.82 3.18 149 SHORT_SHORTNER 3632 0.55 1.79 0.02 150 BAYES_20 3630 3.36 1.78 4.03 151 PDS_FROM_2_EMAILS 3617 0.56 1.78 0.04 152 FROM_SUSPICIOUS_NTLD 3600 0.57 1.77 0.07 153 FROM_2_EMAILS_SHORT 3575 0.52 1.76 0.00 154 HTML_FONT_SIZE_LARGE 3562 0.64 1.75 0.17 155 FROM_SUSPICIOUS_NTLD_FP 3515 0.56 1.73 0.07 156 XM_RXBody 3496 1.04 1.72 0.76 157 LongTLD 3418 0.61 1.68 0.15 158 LONG_JUNK_URI 3415 0.52 1.68 0.04 159 PDS_TO_EQ_FROM_NAME 3408 0.50 1.68 0.01 160 T_FILL_THIS_FORM_SHORT 3220 1.11 1.58 0.91 161 XM_DK_Undo_01 3179 1.58 1.56 1.59 162 XMLngstWrd_00 3132 0.80 1.54 0.49 163 XMStockSpam_06 3103 1.53 1.53 1.54 164 NO_FM_NAME_IP_HOSTN 3038 0.45 1.49 0.00 165 TR_Caps_n_Bayes_99 3025 0.51 1.49 0.10 166 T_XMDrugObfuBody_00 2995 0.96 1.47 0.75 167 HTML_TAG_BALANCE_BODY 2964 0.70 1.46 0.39 168 MAILING_LIST_MULTI 2960 2.10 1.46 2.37 169 HTML_IMAGE_ONLY_28 2932 0.69 1.44 0.37 170 TR_XM_UnparsRelay 2869 0.63 1.41 0.30 171 TR_XM_INV_DKIM 2860 0.54 1.41 0.18 172 XM_URI_RBL 2841 0.53 1.40 0.17 173 XM_UB95 2816 0.42 1.38 0.01 174 XM_UB999 2802 0.41 1.38 0.00 175 TR_XM_PHPDW 2712 0.57 1.33 0.25 176 T_Symld_Words_02 2708 0.83 1.33 0.62 177 XMGenDplmaNmb 2674 0.95 1.31 0.80 178 XMBdyGiftCard01 2651 0.97 1.30 0.82 179 TR_XM_PHPForged 2640 0.55 1.30 0.24 180 RCVD_IN_IADB_VOUCHED 2636 2.72 1.30 3.32 181 TR_XM_FormFill2 2621 0.55 1.29 0.24 182 XM_H_PHPOS 2616 0.55 1.29 0.23 183 RELAYCOUNTRY_GB 2614 1.06 1.29 0.97 184 TR_Mismatch_TLD_01 2521 0.52 1.24 0.22 185 URI_NOVOWEL 2478 2.19 1.22 2.60 186 DATE_IN_PAST_03_06 2406 0.40 1.18 0.07 187 DKIM_ADSP_CUSTOM_MED 2364 1.17 1.16 1.17 188 TR_XM_COVIDMETA1 2342 0.52 1.15 0.25 189 XMLngstWrd_01 2281 0.63 1.12 0.42 190 ALL_TRUSTED 2237 10.71 1.10 14.76 191 TR_XM_RelayPhish 2171 0.37 1.07 0.08 192 NML_ADSP_CUSTOM_MED 2157 0.87 1.06 0.79 193 BAYES_05 2109 2.13 1.04 2.59 194 BAYES_00 2063 10.61 1.01 14.66 195 XMHTML_After_End 2042 0.77 1.00 0.68 196 TR_MetaPhish_Combo_01 2034 0.70 1.00 0.58 197 XM_OfRef7 2013 0.40 0.99 0.16 198 FORGED_GMAIL_RCVD 2001 0.74 0.98 0.63 199 TR_XM_SpoofStaff 1995 0.34 0.98 0.07 200 XMBody_78 1985 0.57 0.98 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 421811 89.55 94.70 87.39 2 RELAYCOUNTRY_US 392476 78.52 71.89 81.31 3 DKIM_SIGNED 353890 76.48 83.98 73.31 4 XM_DK_Pass 347658 74.65 80.88 72.02 5 DKIM_VALID 338168 72.72 79.04 70.06 6 XM_B_Unicode 335365 70.06 71.45 69.48 7 DCC_CHECK_NEGATIVE 292797 49.57 23.26 60.66 8 BAYES_50 265552 49.80 37.42 55.01 9 DKIM_VALID_AU 253281 54.57 59.54 52.47 10 XMListUnsubscribeExists 235436 53.11 63.40 48.77 11 XM_B_SpammyWords 234089 54.10 67.41 48.50 12 XM_B_Unicode3 199217 40.10 37.32 41.27 13 DCC_CHECK 180971 48.65 75.12 37.49 14 T_TM2_M_HEADER_IN_MSG 136362 26.91 23.74 28.25 15 DKIM_VALID_EF 132643 27.47 27.46 27.48 16 RCVD_IN_MSPIKE_WL 131783 23.81 15.53 27.30 17 HTML_FONT_LOW_CONTRAST 129589 29.00 34.10 26.85 18 RCVD_IN_MSPIKE_H2 124482 26.10 26.85 25.79 19 LOC_TINY_FONT_1 116078 27.06 34.21 24.05 20 MIME_HTML_ONLY 107098 25.07 31.91 22.19 21 XMSubLong 106553 22.12 22.23 22.07 22 XM_B_SpammyWords2 103020 27.33 41.53 21.34 23 FVGT_m_MULTI_ODD 101057 22.69 26.85 20.94 24 T_KAM_HTML_FONT_INVALID 85398 19.74 24.61 17.69 25 RCVD_IN_MSPIKE_H3 73774 13.18 8.20 15.28 26 ALL_TRUSTED 71239 10.71 1.10 14.76 27 BAYES_00 70743 10.61 1.01 14.66 28 XM_Body_Dirty_Words 65065 15.32 19.68 13.48 29 XM_B_Unsub 56530 13.19 16.69 11.71 30 XM_Multi_Part_URI 55990 13.58 18.27 11.60 31 RCVD_IN_MSPIKE_H4 45286 8.50 6.41 9.38 32 TR_XM_DK_Bayes 44891 6.74 0.66 9.30 33 TR_XM_DK_Bayes1 43419 6.52 0.63 8.99 34 LotsOfNums_01 42270 9.95 12.80 8.76 35 XM_Evil_Numbers_Gen 41549 9.09 10.22 8.61 36 LOTS_OF_MONEY 39534 10.12 14.71 8.19 37 XM_DKIMWhitelistDomains 39332 5.74 0.02 8.15 38 TR_XM_DK_Bayes2 38950 5.84 0.56 8.07 39 BAYES_60 38664 8.44 9.46 8.01 40 TooManyTo_001 38605 7.20 5.30 8.00 41 UNPARSEABLE_RELAY 36560 6.97 5.54 7.57 42 HTML_IMAGE_RATIO_02 34017 7.30 7.89 7.05 43 XM_SendGrid 33203 6.17 4.49 6.88 44 RCVD_IN_RP_SAFE 32009 5.99 4.48 6.63 45 HTML_IMAGE_RATIO_04 31666 6.19 5.32 6.56 46 MPART_ALT_DIFF 31205 7.24 9.07 6.46 47 XM_B_Phish_Phrases 31071 7.94 11.49 6.44 48 XM_DK_Undo_02 30231 16.84 41.93 6.26 49 IN_ZIMBRA_NJ_WHITELIST 30063 4.41 0.11 6.23 50 RCVD_IN_RP_CERTIFIED 29385 5.42 3.82 6.09 51 T_TooManySym_01 29223 4.99 2.46 6.05 52 RCVD_IN_IADB_LISTED 27084 4.71 2.57 5.61 53 MIME_QP_LONG_LINE 27029 4.72 2.64 5.60 54 FSL_BULK_SIG 26374 8.59 16.01 5.46 55 XM_H_Trusted_IP 26067 3.80 0.00 5.40 56 XM_H_Long_From01 24999 5.20 5.26 5.18 57 BAYES_40 24796 4.32 2.38 5.14 58 RCVD_IN_IADB_SPF 23928 4.15 2.23 4.96 59 XM_B_SpammyWords3 23580 7.21 12.73 4.88 60 RELAYCOUNTRY_META 23399 11.17 26.16 4.85 61 TR_XM_DKIM_Undo 22251 13.11 33.29 4.61 62 TM2_M_URI_OPT_OUT 22079 4.61 4.68 4.57 63 MIME_HTML_ONLY_MULTI 21650 3.82 2.24 4.49 64 XMSexyCombo_05 21559 6.45 11.14 4.47 65 RCVD_IN_IADB_SENDERID 21545 3.74 2.04 4.46 66 BOTNET_IPINHOSTNAME 21009 6.69 12.25 4.35 67 RCVD_IN_IADB_DK 20969 3.66 2.02 4.34 68 TR_XM_DK_SendGrid 20508 3.76 2.61 4.25 69 BAYES_80 20456 5.69 9.12 4.24 70 XM_PDF 20351 3.24 0.91 4.22 71 HTML_IMAGE_RATIO_06 20305 4.01 3.55 4.21 72 XMStrtUSub 20118 3.87 3.16 4.17 73 BAYES_20 19457 3.36 1.78 4.03 74 BAYES_99 18803 12.37 32.50 3.90 75 XMSubMetaSx_00 18396 5.13 8.24 3.81 76 RCVD_IN_IADB_VOUCHED 16040 2.72 1.30 3.32 77 XMNumbers 15938 4.11 6.02 3.30 78 ANY_BOUNCE_MESSAGE 15907 3.03 2.39 3.30 79 BOUNCE_MESSAGE 15880 3.02 2.39 3.29 80 DKIM_INVALID 15722 3.75 4.94 3.26 81 TR_Symld_Words 15359 2.78 1.82 3.18 82 XM_UncommonTLD01 15339 5.16 9.85 3.18 83 T_REMOTE_IMAGE 15181 4.31 7.06 3.14 84 BAYES_999 15067 9.62 25.06 3.12 85 TR_XM_PhishingBody 14359 3.45 4.59 2.97 86 FROM_EXCESS_BASE64 13106 2.62 2.40 2.72 87 RCVD_IN_MSPIKE_H5 12723 2.13 0.93 2.64 88 URI_NOVOWEL 12542 2.19 1.22 2.60 89 BAYES_05 12512 2.13 1.04 2.59 90 HTML_IMAGE_RATIO_08 12380 2.67 2.93 2.56 91 MIME_HTML_MOSTLY 12078 4.50 9.23 2.50 92 BAYES_95 11690 3.27 5.29 2.42 93 MAILING_LIST_MULTI 11457 2.10 1.46 2.37 94 HTML_MIME_NO_HTML_TAG 10880 3.29 5.75 2.25 95 T_TooManySym_02 10645 1.71 0.54 2.21 96 UNTRUSTED_Relay 10369 7.67 20.79 2.15 97 RCVD_IN_IADB_OPTIN 10368 1.79 0.94 2.15 98 HTML_FONT_FACE_BAD 10283 1.64 0.47 2.13 99 TR_XM_SB_Phish 10257 2.16 2.25 2.12 100 XM_B_Unsub2 10182 2.54 3.58 2.11 101 XMSubPhish11 10153 2.09 2.05 2.10 102 LH_URI_DOM_IN_PATH 9809 2.44 3.39 2.03 103 TooManyTo_002 9769 1.59 0.56 2.02 104 T_FONT_INVIS_NAKED_TO 9329 2.52 3.91 1.93 105 XM_B_SpammyTLD 9116 3.14 6.10 1.89 106 TR_DCC_Bayes_99 8670 8.35 23.89 1.80 107 XM_CamelCaseFrm001 8620 1.92 2.26 1.79 108 XMSubNoVowel 8478 1.44 0.69 1.76 109 SUBJ_ALL_CAPS 8391 2.00 2.60 1.74 110 US_DOLLARS_3 8263 2.46 4.23 1.71 111 T_XMDrugObfuBody_08 7974 2.02 2.89 1.65 112 XM_B_Phish66 7936 1.87 2.39 1.64 113 XM_DK_Undo_01 7687 1.58 1.56 1.59 114 INVALID_MSGID 7673 1.18 0.21 1.59 115 XM_SPF_SoftFail 7635 2.18 3.59 1.58 116 BOTNET 7615 5.69 15.43 1.58 117 XMDiploma_00 7494 1.90 2.72 1.55 118 KHOP_HELO_FCRDNS 7472 2.73 5.53 1.55 119 TVD_RCVD_IP 7436 1.16 0.26 1.54 120 IN_HORDE_ADDRESS_BOOK 7423 1.19 0.36 1.54 121 XMStockSpam_06 7418 1.53 1.53 1.54 122 HELO_NODOT 7356 1.26 0.62 1.52 123 HELO_NO_DOMAIN 7351 1.25 0.62 1.52 124 T_XMDrugObfuBody_14 7225 1.65 2.01 1.50 125 XM_ShortIntro_01 7056 1.17 0.46 1.46 126 RELAYCOUNTRY_CA 7025 2.55 5.15 1.46 127 XMGappySubj_01 6535 1.03 0.26 1.35 128 TO_MALFORMED 6523 0.99 0.15 1.35 129 URI_HEX 6443 1.93 3.33 1.33 130 TooManyTo_003 6384 1.05 0.42 1.32 131 XM_B_COVIDMETA 6345 2.10 3.96 1.31 132 FORGED_MUA_OUTLOOK 6307 0.95 0.09 1.31 133 XM_OfRef6 6127 2.06 3.94 1.27 134 CK_HELO_DYNAMIC_SPLIT_IP 6068 1.06 0.59 1.26 135 HELO_MISC_IP 6067 1.00 0.40 1.26 136 XMBSHREFv2 5738 0.90 0.22 1.19 137 DKIM_ADSP_CUSTOM_MED 5643 1.17 1.16 1.17 138 URI_TRY_3LD 5460 1.65 2.87 1.13 139 XM_UB50 5382 3.39 8.79 1.11 140 USER_IN_DEF_DKIM_WL 5285 0.78 0.03 1.09 141 XM_ProductURIs 5190 1.00 0.82 1.08 142 TM2_M_VERY_LONG_WORD 5120 1.63 2.98 1.06 143 XMCapTrack 5120 0.84 0.31 1.06 144 XM_GoogleGroups 5063 0.85 0.39 1.05 145 RCVD_IN_MSPIKE_BL 4987 3.36 8.88 1.03 146 TooManyTo_004 4732 0.79 0.33 0.98 147 TR_MSPIKEBAYES00 4714 0.69 0.02 0.98 148 XM_H_Long_From02 4699 0.95 0.88 0.97 149 RELAYCOUNTRY_GB 4685 1.06 1.29 0.97 150 RCVD_IN_BL_SPAMCOP_NET 4683 2.63 6.58 0.97 151 XMSexyCombo_01 4573 1.72 3.55 0.95 152 XMSubMetaSxObfu_03 4565 0.94 0.94 0.95 153 XMBrknScrpt_02 4529 2.39 5.83 0.94 154 T_TooManySym_03 4478 0.70 0.15 0.93 155 HTML_IMAGE_ONLY_20 4458 0.79 0.47 0.92 156 T_FILL_THIS_FORM_SHORT 4382 1.11 1.58 0.91 157 SpammyFromTLD_01 4379 2.00 4.58 0.91 158 XM_B_SpammyWords4 4253 1.29 2.27 0.88 159 XMBody_95 4202 0.65 0.12 0.87 160 TM2_M_BODY_EMPTY 4037 0.63 0.13 0.84 161 XMBdyGiftCard01 3975 0.97 1.30 0.82 162 TooManyTo_005 3947 0.66 0.28 0.82 163 XMSubGiftCard1 3902 0.63 0.21 0.81 164 XMGenDplmaNmb 3859 0.95 1.31 0.80 165 NML_ADSP_CUSTOM_MED 3817 0.87 1.06 0.79 166 HTTPS_HTTP_MISMATCH 3790 0.76 0.69 0.79 167 XM_RXBody 3673 1.04 1.72 0.76 168 XMSubGiftCard2 3671 0.57 0.13 0.76 169 XMBody_17 3655 1.68 3.88 0.76 170 T_XMDrugObfuBody_00 3610 0.96 1.47 0.75 171 DIET_1 3582 0.75 0.78 0.74 172 XMGetyour 3495 0.55 0.15 0.72 173 TR_LOTS_OF_MONEY3 3478 1.54 3.47 0.72 174 FROM_GOV_DKIM_AU 3419 0.57 0.23 0.71 175 XMSubMetaI_00 3319 0.74 0.86 0.69 176 RCVD_IN_MSPIKE_L3 3297 1.95 4.95 0.68 177 XMHTML_After_End 3270 0.77 1.00 0.68 178 NUMERIC_HTTP_ADDR 3246 0.60 0.43 0.67 179 T_OBFU_PDF_ATTACH 3066 0.48 0.11 0.64 180 XM_SPF_Unknown 3063 0.70 0.85 0.63 181 FORGED_GMAIL_RCVD 3063 0.74 0.98 0.63 182 TR_XM_SpammyWords2 3015 4.77 14.62 0.62 183 T_Symld_Words_02 2990 0.83 1.33 0.62 184 TR_MetaPhish_Combo_01 2798 0.70 1.00 0.58 185 T_XMHurry_00 2795 0.97 1.91 0.58 186 MISSING_HEADERS 2752 0.55 0.49 0.57 187 XMSexyCombo_04 2575 1.07 2.33 0.53 188 TM2_M_A_HREF_HREF 2538 0.61 0.81 0.53 189 DKIM_ADSP_NXDOMAIN 2530 0.52 0.50 0.52 190 XMEmptyBody_01 2525 0.37 0.02 0.52 191 XMSubMetaSx_01 2523 1.00 2.13 0.52 192 T_TooManySym_04 2490 0.38 0.05 0.52 193 TR_XM_SpammyWords3 2467 2.06 5.72 0.51 194 NO_DNS_FOR_FROM 2406 0.44 0.30 0.50 195 XMMoneyMeta_00 2365 0.58 0.78 0.49 196 XMLngstWrd_00 2364 0.80 1.54 0.49 197 RELAYCOUNTRY_DE 2354 0.56 0.73 0.49 198 RDNS_DYNAMIC 2320 0.62 0.93 0.48 199 XM_S_SubURI 2285 0.35 0.05 0.47 200 XMPhish08 2281 0.53 0.66 0.47 ----------------------------------------------------------------------