Email: 676999 Autolearn: 0 AvgScore: 3.88 AvgScanTime: 1.22 sec Spam: 202112 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.33 sec Ham: 474887 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.17 sec Time Spent Running SA: 228.53 hours Time Spent Processing Spam: 74.75 hours Time Spent Processing Ham: 153.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 192741 90.95 95.36 89.06 2 DCC_CHECK 162340 51.49 80.32 39.22 3 DKIM_SIGNED 158798 76.25 78.57 75.26 4 XM_DK_Pass 152526 74.58 75.47 74.20 5 DKIM_VALID 149330 72.65 73.88 72.13 6 XM_B_Unicode 143414 69.85 70.96 69.38 7 RELAYCOUNTRY_US 141157 77.90 69.84 81.33 8 XMListUnsubscribeExists 130126 54.20 64.38 49.86 9 XM_B_SpammyWords 128873 54.38 63.76 50.38 10 DKIM_VALID_AU 117343 55.85 58.06 54.91 11 XM_DK_Undo_02 89620 18.18 44.34 7.05 12 XM_B_SpammyWords2 74424 27.80 36.82 23.96 13 XM_B_Unicode3 72103 38.98 35.67 40.38 14 BAYES_50 71178 49.52 35.22 55.61 15 TR_XM_DKIM_Undo 68739 13.76 34.01 5.15 16 BAYES_99 68713 13.33 34.00 4.54 17 HTML_FONT_LOW_CONTRAST 67957 29.51 33.62 27.76 18 LOC_TINY_FONT_1 67739 27.27 33.52 24.61 19 MIME_HTML_ONLY 67690 24.41 33.49 20.55 20 DKIM_VALID_EF 56383 28.48 27.90 28.72 21 RELAYCOUNTRY_META 56104 11.67 27.76 4.82 22 RCVD_IN_MSPIKE_H2 53974 26.42 26.70 26.30 23 BAYES_999 53947 10.52 26.69 3.64 24 TR_DCC_Bayes_99 52693 9.39 26.07 2.30 25 FVGT_m_MULTI_ODD 47268 22.48 23.39 22.09 26 T_KAM_HTML_FONT_INVALID 47182 19.60 23.34 18.00 27 XMSubLong 45709 21.13 22.62 20.49 28 UNTRUSTED_Relay 45401 8.05 22.46 1.91 29 T_TM2_M_HEADER_IN_MSG 40944 27.78 20.26 30.98 30 BOTNET 40789 7.04 20.18 1.45 31 FSL_BULK_SIG 37844 9.27 18.72 5.24 32 XM_Multi_Part_URI 37813 13.48 18.71 11.25 33 XM_Body_Dirty_Words 37606 14.45 18.61 12.68 34 DCC_CHECK_NEGATIVE 36679 46.81 18.15 59.01 35 XM_B_Unsub 32330 12.04 16.00 10.35 36 RCVD_IN_MSPIKE_WL 31630 24.09 15.65 27.68 37 XM_UncommonTLD01 30060 6.61 14.87 3.09 38 TR_XM_SpammyWords2 28544 4.64 14.12 0.61 39 LOTS_OF_MONEY 25466 9.54 12.60 8.23 40 BOTNET_IPINHOSTNAME 25135 6.69 12.44 4.24 41 XM_B_SpammyWords3 22856 7.05 11.31 5.24 42 XMSexyCombo_05 22651 6.32 11.21 4.25 43 LotsOfNums_01 21251 8.88 10.51 8.18 44 HTML_SHORT_LINK_IMG_1 20618 3.09 10.20 0.06 45 RCVD_IN_MSPIKE_BL 19517 3.48 9.66 0.85 46 BAYES_80 19468 5.87 9.63 4.27 47 T_REMOTE_IMAGE 19035 5.15 9.42 3.33 48 MPART_ALT_DIFF 18692 6.34 9.25 5.10 49 BAYES_60 18626 7.81 9.22 7.21 50 XM_Evil_Numbers_Gen 18067 8.40 8.94 8.17 51 XM_UB50 18016 3.38 8.91 1.02 52 KHOP_HELO_FCRDNS 17392 3.70 8.61 1.61 53 RCVD_IN_MSPIKE_H3 17092 13.22 8.46 15.25 54 XM_B_Phish_Phrases 17019 7.63 8.42 7.30 55 HTML_IMAGE_ONLY_12 15639 2.51 7.74 0.28 56 RCVD_IN_BL_SPAMCOP_NET 15540 3.08 7.69 1.12 57 BODY_URI_ONLY 15539 2.35 7.69 0.08 58 SpammyFromTLD_02 15409 2.41 7.62 0.20 59 MIME_HTML_MOSTLY 15366 3.85 7.60 2.25 60 XMBrknScrpt_02 14844 2.79 7.34 0.85 61 XMSubMetaSx_00 14674 4.75 7.26 3.68 62 HTML_IMAGE_RATIO_02 14328 7.25 7.09 7.32 63 XMNumbers 13579 4.72 6.72 3.86 64 RCVD_IN_MSPIKE_H4 13242 8.96 6.55 9.98 65 TR_XM_SpammyWords3 12644 2.23 6.26 0.52 66 TooManyTo_001 12561 7.64 6.21 8.24 67 RCVD_IN_MSPIKE_L3 11339 2.09 5.61 0.59 68 URIBL_SBL_A 11323 1.81 5.60 0.20 69 BOTNET_NORDNS 11153 1.66 5.52 0.01 70 RELAYCOUNTRY_CA 10775 2.61 5.33 1.45 71 UNPARSEABLE_RELAY 10699 7.13 5.29 7.91 72 TR_XM_PhishingBody 10678 4.05 5.28 3.53 73 XM_DIRTYINTL 10221 1.79 5.06 0.40 74 BAYES_95 10063 3.32 4.98 2.61 75 RELAYCOUNTRY_FR 9851 1.64 4.87 0.26 76 XMBody_17 9735 1.92 4.82 0.69 77 RCVD_IN_RP_RNBL 9726 1.49 4.81 0.07 78 XM_H_Long_From01 9502 5.36 4.70 5.64 79 DKIM_INVALID 9468 3.60 4.68 3.14 80 HTML_IMAGE_RATIO_04 9458 5.10 4.68 5.28 81 XM_UB60 9147 1.42 4.53 0.09 82 RCVD_IN_RP_SAFE 9107 6.56 4.51 7.43 83 HTML_MIME_NO_HTML_TAG 9034 2.74 4.47 2.00 84 SpammyFromTLD_01 8781 1.89 4.34 0.84 85 XM_B_SpammyTLD 8751 2.57 4.33 1.83 86 T_FONT_INVIS_NAKED_TO 8737 2.61 4.32 1.88 87 XM_SendGrid 8682 6.37 4.30 7.25 88 RELAYCOUNTRY_IN 8657 1.35 4.28 0.10 89 HTML_IMAGE_RATIO_08 8517 3.24 4.21 2.82 90 HTML_IMAGE_RATIO_06 8406 3.64 4.16 3.42 91 XM_SPF_SoftFail 8346 2.41 4.13 1.68 92 TR_Mismatch_TLD_02 7915 1.21 3.92 0.06 93 DKIM_ADSP_NXDOMAIN 7612 1.51 3.77 0.55 94 RCVD_IN_RP_CERTIFIED 7414 5.96 3.67 6.94 95 T_TooManySym_01 7316 4.69 3.62 5.14 96 T_XMDrugObfuBody_08 7077 2.20 3.50 1.65 97 TR_XM_MaxBayes 6919 1.03 3.42 0.02 98 XMStrtUSub 6915 6.43 3.42 7.71 99 RCVD_IN_MSPIKE_L5 6753 1.14 3.34 0.21 100 INVALID_DATE 6691 1.01 3.31 0.03 101 HDRS_MISSP 6669 0.99 3.30 0.00 102 XM_UB99 6656 0.98 3.29 0.00 103 BOGUS_MIME_VERSION 6635 0.98 3.28 0.00 104 TR_LOTS_OF_MONEY3 6540 1.47 3.24 0.72 105 XM_OfRef6 6495 1.82 3.21 1.23 106 URI_HEX 6288 2.00 3.11 1.53 107 XM_B_COVIDMETA 6285 1.82 3.11 1.27 108 XM_UB80 6075 0.92 3.01 0.03 109 RELAYCOUNTRY_UA 6063 0.90 3.00 0.01 110 TM2_M_URI_OPT_OUT 5918 3.17 2.93 3.27 111 XMSlimDrugH 5778 1.06 2.86 0.29 112 RCVD_IN_PSBL 5759 0.92 2.85 0.09 113 HTML_IMAGE_ONLY_08 5502 0.89 2.72 0.10 114 XM_B_Phish66 5472 2.32 2.71 2.16 115 HDRS_LCASE_IMGONLY 5261 0.79 2.60 0.02 116 TM2_M_VERY_LONG_WORD 5255 1.59 2.60 1.16 117 TR_XM_MaxSPIKE 5243 0.78 2.59 0.01 118 XM_UB999 5190 0.77 2.57 0.00 119 BAYES_40 5040 4.07 2.49 4.74 120 LH_URI_DOM_IN_PATH 4923 2.16 2.44 2.04 121 TR_XM_DK_SendGrid 4886 3.96 2.42 4.61 122 PDS_OTHER_BAD_TLD 4780 1.02 2.37 0.45 123 LOCALPART_IN_SUBJECT 4704 0.71 2.33 0.03 124 XMSexyCombo_01 4692 1.41 2.32 1.03 125 XMDiploma_00 4689 1.71 2.32 1.45 126 TO_NAME_SUBJ_NO_RDNS 4680 0.69 2.32 0.00 127 TR_XM_SB_Phish 4472 1.94 2.21 1.82 128 SUBJ_ALL_CAPS 4423 1.77 2.19 1.60 129 URI_TRY_3LD 4408 1.59 2.18 1.33 130 MIME_QP_LONG_LINE 4320 4.26 2.14 5.16 131 T_XMHurry_00 4237 1.04 2.10 0.60 132 MIME_HTML_ONLY_MULTI 4128 2.97 2.04 3.37 133 US_DOLLARS_3 4096 1.14 2.03 0.77 134 HTML_FONT_SIZE_LARGE 4090 0.68 2.02 0.11 135 XM_CamelCaseFrm001 4037 1.94 2.00 1.91 136 FROM_EXCESS_BASE64 3955 2.96 1.96 3.39 137 FROM_SUSPICIOUS_NTLD 3901 0.63 1.93 0.07 138 XMHTML_After_End 3838 1.20 1.90 0.90 139 FROM_SUSPICIOUS_NTLD_FP 3776 0.60 1.87 0.06 140 T_XMDrugObfuBody_14 3758 1.91 1.86 1.93 141 BAYES_00 3690 10.96 1.83 14.85 142 XM_B_SpammyWords4 3659 0.88 1.81 0.48 143 XM_URI_RBL 3628 0.65 1.80 0.16 144 TR_XM_UnparsRelay 3540 0.76 1.75 0.33 145 XMSubPhish11 3515 1.77 1.74 1.79 146 TR_XM_COVIDMETA4 3383 0.76 1.67 0.37 147 BAYES_20 3368 3.03 1.67 3.61 148 DIET_1 3331 0.80 1.65 0.43 149 RCVD_IN_IADB_LISTED 3323 3.91 1.64 4.87 150 T_FILL_THIS_FORM_SHORT 3283 1.09 1.62 0.86 151 LongTLD 3265 0.57 1.62 0.13 152 XM_RXBody 3154 0.59 1.56 0.17 153 TVD_SPACE_RATIO 3055 0.69 1.51 0.34 154 XM_B_Unsub2 3046 1.76 1.51 1.87 155 XMStockSpam_06 3037 3.01 1.50 3.65 156 XMSexyCombo_04 2927 0.81 1.45 0.54 157 PDS_FROM_2_EMAILS 2857 0.44 1.41 0.03 158 RELAYCOUNTRY_GB 2833 1.12 1.40 1.01 159 RCVD_IN_IADB_SPF 2826 3.43 1.40 4.29 160 XMClaimOffer 2817 0.48 1.39 0.09 161 XM_DK_Undo_01 2813 1.51 1.39 1.56 162 FROM_2_EMAILS_SHORT 2809 0.42 1.39 0.00 163 T_Symld_Words_02 2757 0.70 1.36 0.42 164 FVGT_m_MULTI_ODD_EMAIL 2733 0.42 1.35 0.03 165 HTML_TAG_BALANCE_BODY 2681 0.67 1.33 0.39 166 PDS_TO_EQ_FROM_NAME 2666 0.40 1.32 0.00 167 RCVD_IN_IADB_SENDERID 2632 3.09 1.30 3.85 168 RCVD_IN_IADB_DK 2592 3.00 1.28 3.73 169 LONG_JUNK_URI 2581 0.41 1.28 0.04 170 DATE_IN_PAST_03_06 2536 0.47 1.25 0.14 171 TR_XM_COVIDMETA1 2507 0.68 1.24 0.45 172 TR_Symld_Words 2502 1.52 1.24 1.65 173 URI_NOVOWEL 2502 2.09 1.24 2.46 174 MAILING_LIST_MULTI 2502 2.28 1.24 2.73 175 TR_XM_PHPDW 2484 0.59 1.23 0.32 176 T_TooManySym_02 2428 2.11 1.20 2.50 177 TR_XM_PHPForged 2416 0.58 1.20 0.31 178 TR_XM_FormFill2 2403 0.57 1.19 0.31 179 TR_XM_RelayPhish 2402 0.42 1.19 0.10 180 XM_H_PHPOS 2400 0.57 1.19 0.30 181 NO_FM_NAME_IP_HOSTN 2399 0.36 1.19 0.00 182 TR_XM_INV_DKIM 2378 0.39 1.18 0.06 183 XM_UB95 2374 0.36 1.17 0.01 184 T_XMDrugObfuBody_00 2362 0.82 1.17 0.67 185 TR_Mismatch_TLD_01 2320 0.50 1.15 0.23 186 RELAYCOUNTRY_DE 2304 0.60 1.14 0.37 187 TVD_SPACE_RATIO_MINFP 2303 0.35 1.14 0.01 188 XMSubNoVowel 2255 1.24 1.12 1.30 189 XMWghtMeta_00 2251 0.35 1.11 0.02 190 XMGenDplmaNmb 2167 0.83 1.07 0.73 191 HK_RANDOM_FROM 2140 0.41 1.06 0.13 192 REMOVE_BEFORE_LINK 2112 0.52 1.04 0.29 193 XMBdyGiftCard01 2092 0.95 1.04 0.92 194 ALL_TRUSTED 2066 10.89 1.02 15.09 195 ONE_TIME 2023 0.31 1.00 0.02 196 XM_PDF 2001 3.25 0.99 4.21 197 XM_Combo_Sbj 1994 0.53 0.99 0.33 198 XMPhish08 1975 0.66 0.98 0.52 199 XMSlimDrugs 1950 0.30 0.96 0.02 200 RDNS_DYNAMIC 1940 0.63 0.96 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 422956 90.95 95.36 89.06 2 RELAYCOUNTRY_US 386224 77.90 69.84 81.33 3 DKIM_SIGNED 357423 76.25 78.57 75.26 4 XM_DK_Pass 352360 74.58 75.47 74.20 5 DKIM_VALID 342520 72.65 73.88 72.13 6 XM_B_Unicode 329458 69.85 70.96 69.38 7 DCC_CHECK_NEGATIVE 280223 46.81 18.15 59.01 8 BAYES_50 264103 49.52 35.22 55.61 9 DKIM_VALID_AU 260780 55.85 58.06 54.91 10 XM_B_SpammyWords 239262 54.38 63.76 50.38 11 XMListUnsubscribeExists 236793 54.20 64.38 49.86 12 XM_B_Unicode3 191763 38.98 35.67 40.38 13 DCC_CHECK 186263 51.49 80.32 39.22 14 T_TM2_M_HEADER_IN_MSG 147107 27.78 20.26 30.98 15 DKIM_VALID_EF 136398 28.48 27.90 28.72 16 HTML_FONT_LOW_CONTRAST 131820 29.51 33.62 27.76 17 RCVD_IN_MSPIKE_WL 131444 24.09 15.65 27.68 18 RCVD_IN_MSPIKE_H2 124889 26.42 26.70 26.30 19 LOC_TINY_FONT_1 116877 27.27 33.52 24.61 20 XM_B_SpammyWords2 113803 27.80 36.82 23.96 21 FVGT_m_MULTI_ODD 104889 22.48 23.39 22.09 22 MIME_HTML_ONLY 97582 24.41 33.49 20.55 23 XMSubLong 97323 21.13 22.62 20.49 24 T_KAM_HTML_FONT_INVALID 85490 19.60 23.34 18.00 25 RCVD_IN_MSPIKE_H3 72434 13.22 8.46 15.25 26 ALL_TRUSTED 71663 10.89 1.02 15.09 27 BAYES_00 70515 10.96 1.83 14.85 28 XM_Body_Dirty_Words 60193 14.45 18.61 12.68 29 XM_Multi_Part_URI 53418 13.48 18.71 11.25 30 XM_B_Unsub 49171 12.04 16.00 10.35 31 RCVD_IN_MSPIKE_H4 47395 8.96 6.55 9.98 32 TR_XM_DK_Bayes 47155 7.18 0.72 9.93 33 TR_XM_DK_Bayes1 45749 6.97 0.70 9.63 34 TR_XM_DK_Bayes2 40579 6.18 0.62 8.54 35 XM_DKIMWhitelistDomains 40150 5.94 0.04 8.45 36 TooManyTo_001 39147 7.64 6.21 8.24 37 LOTS_OF_MONEY 39090 9.54 12.60 8.23 38 LotsOfNums_01 38855 8.88 10.51 8.18 39 XM_Evil_Numbers_Gen 38813 8.40 8.94 8.17 40 UNPARSEABLE_RELAY 37555 7.13 5.29 7.91 41 XMStrtUSub 36593 6.43 3.42 7.71 42 RCVD_IN_RP_SAFE 35307 6.56 4.51 7.43 43 HTML_IMAGE_RATIO_02 34764 7.25 7.09 7.32 44 XM_B_Phish_Phrases 34645 7.63 8.42 7.30 45 XM_SendGrid 34423 6.37 4.30 7.25 46 BAYES_60 34244 7.81 9.22 7.21 47 XM_DK_Undo_02 33488 18.18 44.34 7.05 48 RCVD_IN_RP_CERTIFIED 32945 5.96 3.67 6.94 49 IN_ZIMBRA_NJ_WHITELIST 28938 4.30 0.10 6.09 50 XM_H_Long_From01 26765 5.36 4.70 5.64 51 HTML_IMAGE_RATIO_04 25078 5.10 4.68 5.28 52 FSL_BULK_SIG 24898 9.27 18.72 5.24 53 XM_B_SpammyWords3 24870 7.05 11.31 5.24 54 MIME_QP_LONG_LINE 24507 4.26 2.14 5.16 55 TR_XM_DKIM_Undo 24439 13.76 34.01 5.15 56 T_TooManySym_01 24430 4.69 3.62 5.14 57 MPART_ALT_DIFF 24220 6.34 9.25 5.10 58 RCVD_IN_IADB_LISTED 23148 3.91 1.64 4.87 59 RELAYCOUNTRY_META 22886 11.67 27.76 4.82 60 BAYES_40 22506 4.07 2.49 4.74 61 TR_XM_DK_SendGrid 21897 3.96 2.42 4.61 62 BAYES_99 21540 13.33 34.00 4.54 63 RCVD_IN_IADB_SPF 20376 3.43 1.40 4.29 64 BAYES_80 20285 5.87 9.63 4.27 65 XMSexyCombo_05 20162 6.32 11.21 4.25 66 BOTNET_IPINHOSTNAME 20154 6.69 12.44 4.24 67 XM_PDF 20006 3.25 0.99 4.21 68 XMNumbers 18345 4.72 6.72 3.86 69 RCVD_IN_IADB_SENDERID 18277 3.09 1.30 3.85 70 RCVD_IN_IADB_DK 17698 3.00 1.28 3.73 71 XMSubMetaSx_00 17472 4.75 7.26 3.68 72 XMStockSpam_06 17343 3.01 1.50 3.65 73 BAYES_999 17291 10.52 26.69 3.64 74 BAYES_20 17130 3.03 1.67 3.61 75 TR_XM_PhishingBody 16764 4.05 5.28 3.53 76 HTML_IMAGE_RATIO_06 16249 3.64 4.16 3.42 77 FROM_EXCESS_BASE64 16085 2.96 1.96 3.39 78 MIME_HTML_ONLY_MULTI 15986 2.97 2.04 3.37 79 T_REMOTE_IMAGE 15819 5.15 9.42 3.33 80 TM2_M_URI_OPT_OUT 15533 3.17 2.93 3.27 81 DKIM_INVALID 14903 3.60 4.68 3.14 82 XM_UncommonTLD01 14664 6.61 14.87 3.09 83 RCVD_IN_IADB_VOUCHED 13984 2.30 0.79 2.94 84 XM_H_Trusted_IP 13669 2.02 0.00 2.88 85 HTML_IMAGE_RATIO_08 13397 3.24 4.21 2.82 86 MAILING_LIST_MULTI 12944 2.28 1.24 2.73 87 BAYES_95 12407 3.32 4.98 2.61 88 BAYES_05 12094 2.07 0.95 2.55 89 T_TooManySym_02 11851 2.11 1.20 2.50 90 URI_NOVOWEL 11662 2.09 1.24 2.46 91 RCVD_IN_MSPIKE_H5 11615 1.91 0.64 2.45 92 TR_DCC_Bayes_99 10911 9.39 26.07 2.30 93 MIME_HTML_MOSTLY 10694 3.85 7.60 2.25 94 TooManyTo_002 10669 1.76 0.60 2.25 95 ANY_BOUNCE_MESSAGE 10584 1.71 0.49 2.23 96 BOUNCE_MESSAGE 10581 1.71 0.49 2.23 97 XM_B_Phish66 10237 2.32 2.71 2.16 98 LH_URI_DOM_IN_PATH 9667 2.16 2.44 2.04 99 HTML_MIME_NO_HTML_TAG 9506 2.74 4.47 2.00 100 RCVD_IN_IADB_OPTIN 9233 1.52 0.52 1.94 101 T_XMDrugObfuBody_14 9158 1.91 1.86 1.93 102 UNTRUSTED_Relay 9084 8.05 22.46 1.91 103 XM_CamelCaseFrm001 9064 1.94 2.00 1.91 104 T_FONT_INVIS_NAKED_TO 8932 2.61 4.32 1.88 105 XM_B_Unsub2 8890 1.76 1.51 1.87 106 XM_B_SpammyTLD 8681 2.57 4.33 1.83 107 TR_XM_SB_Phish 8661 1.94 2.21 1.82 108 USER_IN_DEF_DKIM_WL 8641 1.28 0.02 1.82 109 XMSubPhish11 8492 1.77 1.74 1.79 110 HELO_NODOT 8121 1.36 0.53 1.71 111 HELO_NO_DOMAIN 8119 1.36 0.53 1.71 112 XM_SPF_SoftFail 7959 2.41 4.13 1.68 113 T_XMDrugObfuBody_08 7847 2.20 3.50 1.65 114 TR_Symld_Words 7813 1.52 1.24 1.65 115 KHOP_HELO_FCRDNS 7649 3.70 8.61 1.61 116 IN_HORDE_ADDRESS_BOOK 7614 1.22 0.31 1.60 117 SUBJ_ALL_CAPS 7591 1.77 2.19 1.60 118 INVALID_MSGID 7431 1.17 0.23 1.56 119 XM_DK_Undo_01 7385 1.51 1.39 1.56 120 TVD_RCVD_IP 7377 1.18 0.31 1.55 121 URI_HEX 7245 2.00 3.11 1.53 122 TooManyTo_003 7019 1.19 0.50 1.48 123 XM_ShortIntro_01 7012 1.16 0.41 1.48 124 RELAYCOUNTRY_CA 6896 2.61 5.33 1.45 125 XMDiploma_00 6882 1.71 2.32 1.45 126 BOTNET 6871 7.04 20.18 1.45 127 TO_MALFORMED 6494 0.97 0.03 1.37 128 URI_TRY_3LD 6338 1.59 2.18 1.33 129 XMSubNoVowel 6161 1.24 1.12 1.30 130 XM_B_COVIDMETA 6052 1.82 3.11 1.27 131 HELO_MISC_IP 6010 1.00 0.39 1.27 132 CK_HELO_DYNAMIC_SPLIT_IP 6003 1.05 0.54 1.26 133 XM_OfRef6 5835 1.82 3.21 1.23 134 XMGappySubj_01 5683 0.90 0.22 1.20 135 DKIM_ADSP_CUSTOM_MED 5674 1.08 0.80 1.19 136 XMCapTrack 5583 0.94 0.38 1.18 137 TM2_M_VERY_LONG_WORD 5519 1.59 2.60 1.16 138 XM_GoogleGroups 5368 0.91 0.40 1.13 139 RCVD_IN_BL_SPAMCOP_NET 5317 3.08 7.69 1.12 140 TooManyTo_004 5209 0.90 0.45 1.10 141 HTML_FONT_FACE_BAD 5115 0.91 0.52 1.08 142 XM_ProductURIs 5089 1.01 0.87 1.07 143 XMBSHREFv2 4955 0.81 0.26 1.04 144 XMSexyCombo_01 4868 1.41 2.32 1.03 145 XM_UB50 4834 3.38 8.91 1.02 146 RELAYCOUNTRY_GB 4775 1.12 1.40 1.01 147 T_TooManySym_03 4765 0.76 0.20 1.00 148 TR_MSPIKEBAYES00 4681 0.70 0.01 0.99 149 XMBdyGiftCard01 4373 0.95 1.04 0.92 150 XMHTML_After_End 4284 1.20 1.90 0.90 151 TooManyTo_005 4116 0.71 0.35 0.87 152 T_FILL_THIS_FORM_SHORT 4077 1.09 1.62 0.86 153 XMBrknScrpt_02 4041 2.79 7.34 0.85 154 RCVD_IN_MSPIKE_BL 4031 3.48 9.66 0.85 155 SpammyFromTLD_01 3993 1.89 4.34 0.84 156 XMSubGiftCard1 3938 0.74 0.53 0.83 157 XM_H_Long_From02 3914 0.77 0.65 0.82 158 XMBody_95 3852 0.60 0.11 0.81 159 T_MONEY_PERCENT 3850 0.79 0.75 0.81 160 TR_LOTS_OF_MONEY2 3850 0.79 0.75 0.81 161 XMSubGiftCard2 3800 0.59 0.09 0.80 162 NML_ADSP_CUSTOM_MED 3769 0.75 0.65 0.79 163 XMGetyour 3759 0.62 0.23 0.79 164 US_DOLLARS_3 3639 1.14 2.03 0.77 165 HTTPS_HTTP_MISMATCH 3539 0.75 0.77 0.75 166 XMGenDplmaNmb 3454 0.83 1.07 0.73 167 TR_LOTS_OF_MONEY3 3421 1.47 3.24 0.72 168 TR_MetaPhish_Combo_01 3377 0.73 0.76 0.71 169 XMBody_17 3280 1.92 4.82 0.69 170 NUMERIC_HTTP_ADDR 3205 0.57 0.31 0.67 171 XM_E_Blogspot 3199 0.50 0.08 0.67 172 XM_SPF_Unknown 3193 0.69 0.73 0.67 173 FORGED_GMAIL_RCVD 3165 0.64 0.58 0.67 174 T_XMDrugObfuBody_00 3160 0.82 1.17 0.67 175 XMNoVowels 3140 0.55 0.29 0.66 176 TR_XM_SpammyWords2 2899 4.64 14.12 0.61 177 T_XMHurry_00 2827 1.04 2.10 0.60 178 T_TooManySym_04 2791 0.43 0.06 0.59 179 RCVD_IN_MSPIKE_L3 2780 2.09 5.61 0.59 180 HTML_IMAGE_ONLY_20 2718 0.50 0.33 0.57 181 T_OBFU_PDF_ATTACH 2640 0.43 0.13 0.56 182 RCVD_IN_SORBS_DUL 2628 0.51 0.42 0.55 183 DKIM_ADSP_NXDOMAIN 2611 1.51 3.77 0.55 184 XMSexyCombo_04 2580 0.81 1.45 0.54 185 NO_DNS_FOR_FROM 2503 0.51 0.46 0.53 186 TR_XM_SpammyWords3 2480 2.23 6.26 0.52 187 XMSubMetaI_00 2470 0.65 0.95 0.52 188 XMPhish08 2469 0.66 0.98 0.52 189 XMPhish30 2436 0.62 0.86 0.51 190 XMOemUri 2387 0.40 0.16 0.50 191 RDNS_DYNAMIC 2314 0.63 0.96 0.49 192 XM_H_PHPMailer 2283 0.46 0.41 0.48 193 XM_B_SpammyWords4 2281 0.88 1.81 0.48 194 XM_S_SubURI 2273 0.34 0.02 0.48 195 SHORT_HELO_AND_INLINE_IMAGE 2266 0.36 0.09 0.48 196 XMSubMetaSxObfu_02 2226 0.41 0.29 0.47 197 XM_B_COPY_HTML 2201 0.46 0.46 0.46 198 XMMoneyMeta_00 2142 0.52 0.67 0.45 199 PDS_OTHER_BAD_TLD 2128 1.02 2.37 0.45 200 TR_XM_COVIDMETA1 2127 0.68 1.24 0.45 ----------------------------------------------------------------------