Email: 748367 Autolearn: 0 AvgScore: 2.06 AvgScanTime: 1.50 sec Spam: 207593 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.71 sec Ham: 540774 Autolearn: 0 AvgScore: -2.45 AvgScanTime: 1.42 sec Time Spent Running SA: 312.44 hours Time Spent Processing Spam: 98.45 hours Time Spent Processing Ham: 213.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 196164 90.92 94.49 89.55 2 DCC_CHECK 161917 47.26 78.00 35.46 3 DKIM_SIGNED 159523 68.17 76.84 64.83 4 XM_DK_Pass 152923 66.50 73.66 63.75 5 DKIM_VALID 151501 65.10 72.98 62.07 6 XM_B_Unicode 149590 73.55 72.06 74.12 7 RELAYCOUNTRY_US 145080 77.80 69.89 80.83 8 XMListUnsubscribeExists 135343 48.88 65.20 42.62 9 XM_B_SpammyWords 126811 51.34 61.09 47.60 10 DKIM_VALID_AU 118943 50.53 57.30 47.93 11 XM_DK_Undo_02 86207 16.34 41.53 6.67 12 XM_B_Unicode3 76340 41.97 36.77 43.96 13 BAYES_50 75299 46.83 36.27 50.89 14 LOC_TINY_FONT_1 72003 24.32 34.68 20.35 15 BAYES_99 71782 12.67 34.58 4.26 16 XM_B_SpammyWords2 70070 24.09 33.75 20.37 17 TR_XM_DKIM_Undo 68599 12.78 33.04 5.00 18 HTML_FONT_LOW_CONTRAST 68415 26.50 32.96 24.02 19 MIME_HTML_ONLY 65880 26.65 31.74 24.70 20 RCVD_IN_MSPIKE_H2 59585 24.60 28.70 23.03 21 BAYES_999 57618 10.20 27.76 3.46 22 DKIM_VALID_EF 57611 25.39 27.75 24.48 23 TR_DCC_Bayes_99 56480 9.13 27.21 2.19 24 RELAYCOUNTRY_META 50175 9.88 24.17 4.40 25 FVGT_m_MULTI_ODD 48334 19.61 23.28 18.20 26 XMSubLong 48191 19.98 23.21 18.73 27 T_KAM_HTML_FONT_INVALID 46535 17.24 22.42 15.26 28 T_TM2_M_HEADER_IN_MSG 45741 25.17 22.03 26.38 29 XM_Multi_Part_URI 43574 12.97 20.99 9.89 30 DCC_CHECK_NEGATIVE 42281 51.06 20.37 62.84 31 UNTRUSTED_Relay 40627 6.64 19.57 1.67 32 FSL_BULK_SIG 37387 9.40 18.01 6.09 33 XM_Body_Dirty_Words 33760 13.26 16.26 12.10 34 BOTNET 33716 5.63 16.24 1.55 35 RCVD_IN_MSPIKE_WL 32581 22.32 15.69 24.86 36 BOTNET_IPINHOSTNAME 29078 6.68 14.01 3.86 37 XM_UncommonTLD01 26684 6.03 12.85 3.40 38 LotsOfNums_01 26226 8.95 12.63 7.53 39 TR_XM_SpammyWords2 25081 3.95 12.08 0.82 40 XM_B_Unsub 23216 9.50 11.18 8.85 41 LOTS_OF_MONEY 23119 8.51 11.14 7.51 42 XMSexyCombo_05 21105 6.07 10.17 4.50 43 XM_B_SpammyWords3 20649 5.22 9.95 3.40 44 XM_Evil_Numbers_Gen 20388 8.81 9.82 8.42 45 HTML_MIME_NO_HTML_TAG 19481 3.95 9.38 1.86 46 BAYES_60 18890 7.16 9.10 6.42 47 BAYES_80 18744 5.20 9.03 3.73 48 T_REMOTE_IMAGE 18335 4.67 8.83 3.08 49 RCVD_IN_MSPIKE_H3 18027 12.22 8.68 13.58 50 KHOP_HELO_FCRDNS 17690 3.33 8.52 1.34 51 TR_XM_SpammyWords4 17622 6.24 8.49 5.38 52 RCVD_IN_BL_SPAMCOP_NET 17375 3.03 8.37 0.98 53 HTML_IMAGE_RATIO_02 17209 6.26 8.29 5.48 54 TooManyTo_001 16730 7.36 8.06 7.09 55 BODY_URI_ONLY 15862 2.15 7.64 0.04 56 XM_UB50 15482 2.71 7.46 0.89 57 MPART_ALT_DIFF 14808 8.83 7.13 9.49 58 RCVD_IN_MSPIKE_BL 14776 2.11 7.12 0.19 59 HTML_IMAGE_ONLY_08 14176 1.95 6.83 0.08 60 TR_XM_MSPIKECOMBO 14009 2.01 6.75 0.19 61 UNPARSEABLE_RELAY 13248 6.64 6.38 6.74 62 RCVD_IN_MSPIKE_H4 12860 8.08 6.19 8.80 63 TR_XM_UnparsRelay 12751 4.92 6.14 4.45 64 XM_B_Phish_Phrases 12132 4.87 5.84 4.49 65 XMSubMetaSx_00 11984 3.93 5.77 3.23 66 BAYES_95 11543 3.19 5.56 2.28 67 XM_SPF_SoftFail 11295 2.56 5.44 1.46 68 XMNumbers 11165 3.68 5.38 3.02 69 SpammyFromTLD_01 11035 2.14 5.32 0.93 70 HTML_IMAGE_RATIO_06 10866 4.98 5.23 4.89 71 MIME_HTML_MOSTLY 10850 3.15 5.23 2.35 72 TM2_M_URI_OPT_OUT 10823 3.40 5.21 2.70 73 XM_H_Long_From01 10770 4.79 5.19 4.63 74 XM_SendGrid 10722 5.88 5.16 6.15 75 RELAYCOUNTRY_CA 10516 2.24 5.07 1.15 76 XM_B_SpammyTLD 10417 3.15 5.02 2.44 77 TR_XM_PhishingBody 9942 3.30 4.79 2.74 78 RCVD_IN_RP_RNBL 9545 1.31 4.60 0.05 79 RCVD_IN_MSPIKE_L5 9279 1.29 4.47 0.07 80 HTML_IMAGE_RATIO_04 9255 11.84 4.46 14.67 81 ALL_TRUSTED 9178 12.83 4.42 16.06 82 T_FILL_THIS_FORM_SHORT 8524 2.08 4.11 1.30 83 TR_XM_SpammyWords5 8219 2.25 3.96 1.59 84 XM_UB60 8086 1.16 3.90 0.11 85 DKIM_INVALID 8022 3.07 3.86 2.77 86 URIBL_SBL_A 7831 1.13 3.77 0.11 87 T_FONT_INVIS_NAKED_TO 7613 2.02 3.67 1.39 88 RELAYCOUNTRY_IN 7264 1.04 3.50 0.09 89 XMStrtUSub 7017 8.90 3.38 11.02 90 SpammyFromTLD_02 6924 1.11 3.34 0.25 91 XM_UB99 6833 0.92 3.29 0.01 92 HTML_IMAGE_RATIO_08 6641 2.15 3.20 1.75 93 URI_HEX 6547 1.75 3.15 1.21 94 RCVD_IN_PSBL 6374 0.91 3.07 0.08 95 XMDiploma_00 6355 2.04 3.06 1.65 96 XM_OfRef6 6317 1.47 3.04 0.86 97 RCVD_IN_RP_SAFE 5963 5.83 2.87 6.97 98 TR_XM_SB_Phish 5773 2.14 2.78 1.89 99 RELAYCOUNTRY_UA 5712 0.77 2.75 0.01 100 RELAYCOUNTRY_FR 5702 0.93 2.75 0.23 101 XM_DIRTYINTL 5702 1.04 2.75 0.38 102 XMSubPhish11 5686 2.11 2.74 1.86 103 XM_UB80 5456 0.75 2.63 0.02 104 BOTNET_NORDNS 5392 0.73 2.60 0.01 105 TR_XM_DK_SendGrid 5377 3.79 2.59 4.25 106 T_XMDrugObfuBody_08 5361 1.76 2.58 1.44 107 SUBJ_ALL_CAPS 5257 1.80 2.53 1.52 108 MIME_QP_LONG_LINE 5250 4.24 2.53 4.90 109 XM_UB999 5243 0.71 2.53 0.01 110 FROM_EXCESS_BASE64 5222 2.61 2.52 2.65 111 HTML_FONT_SIZE_LARGE 5156 0.75 2.48 0.09 112 TR_XM_MaxBayes 5102 0.69 2.46 0.01 113 XM_B_Phish66 4966 1.81 2.39 1.58 114 T_TooManySym_01 4881 3.81 2.35 4.37 115 TR_XM_SpammyWords3 4847 0.72 2.33 0.10 116 URI_TRY_3LD 4833 1.20 2.33 0.76 117 MIME_HTML_ONLY_MULTI 4813 6.24 2.32 7.74 118 RCVD_IN_RP_CERTIFIED 4687 5.23 2.26 6.37 119 XM_B_Unsub2 4624 1.72 2.23 1.52 120 XM_B_SpammyWords4 4553 0.90 2.19 0.40 121 XM_B_COVIDMETA 4500 1.00 2.17 0.56 122 TM2_M_VERY_LONG_WORD 4497 1.35 2.17 1.03 123 DATE_IN_FUTURE_06_12 4292 0.88 2.07 0.42 124 XMSubNoVowel 4181 4.00 2.01 4.76 125 TO_IN_SUBJ 4131 0.87 1.99 0.44 126 XMBrknScrpt_02 4119 0.99 1.98 0.61 127 TR_Symld_Words 4119 1.47 1.98 1.27 128 XMBody_17 4112 0.83 1.98 0.39 129 XM_CamelCaseFrm001 4048 1.68 1.95 1.57 130 BAYES_40 4014 4.09 1.93 4.92 131 T_HTML_ATTACH 3921 0.86 1.89 0.47 132 TR_XM_PHPDW 3904 0.89 1.88 0.51 133 XM_DK_Undo_01 3871 1.47 1.86 1.32 134 OBFU_JVSCR_ESC 3848 0.82 1.85 0.42 135 FROM_IN_TO_AND_SUBJ 3831 0.81 1.85 0.42 136 TR_XM_PHPForged 3802 0.85 1.83 0.47 137 TR_XM_FormFill2 3768 0.84 1.82 0.47 138 XM_H_PHPOS 3762 0.84 1.81 0.47 139 RCVD_IN_IADB_LISTED 3666 3.74 1.77 4.50 140 RCVD_IN_MSPIKE_L3 3591 0.53 1.73 0.07 141 XMGenDplmaNmb 3416 0.98 1.65 0.72 142 TR_XM_COVIDMETA4 3412 0.82 1.64 0.51 143 XM_URI_RBL 3381 0.55 1.63 0.14 144 RCVD_IN_IADB_SPF 3331 3.32 1.60 3.98 145 URG_BIZ 3306 0.50 1.59 0.08 146 T_XMDrugObfuBody_00 3268 0.90 1.57 0.64 147 RDNS_DYNAMIC 3159 0.72 1.52 0.41 148 RCVD_IN_IADB_SENDERID 3139 3.02 1.51 3.60 149 RCVD_IN_IADB_DK 3129 2.93 1.51 3.48 150 BAYES_20 3121 3.76 1.50 4.63 151 T_XMDrugObfuBody_14 3104 1.66 1.50 1.72 152 MIME_CHARSET_FARAWAY 3100 0.50 1.49 0.12 153 XMStockSpam_06 3099 1.48 1.49 1.48 154 XMSexyCombo_01 3052 0.95 1.47 0.74 155 URI_PHP_REDIR 3046 0.41 1.47 0.00 156 XM_UB95 3027 0.41 1.46 0.01 157 TM2_M_A_HREF_HREF 2994 0.61 1.44 0.30 158 TO_NO_BRKTS_HTML_ONLY 2986 0.63 1.44 0.32 159 RELAYCOUNTRY_DE 2941 0.85 1.42 0.63 160 TR_Caps_n_Bayes_99 2938 0.61 1.42 0.30 161 XMMoneyMeta_00 2889 0.80 1.39 0.58 162 MAILING_LIST_MULTI 2858 2.09 1.38 2.37 163 RELAYCOUNTRY_GB 2733 1.08 1.32 0.99 164 HK_RANDOM_REPLYTO 2729 0.50 1.31 0.19 165 TR_Mismatch_TLD_01 2666 0.66 1.28 0.42 166 DATE_IN_PAST_06_12 2661 0.53 1.28 0.24 167 LIST_PARTIAL_SHORT_MSG 2651 0.38 1.28 0.04 168 URI_NOVOWEL 2621 1.92 1.26 2.17 169 NO_DNS_FOR_FROM 2589 0.56 1.25 0.29 170 DATE_IN_PAST_03_06 2542 0.38 1.22 0.06 171 TR_LOTS_OF_MONEY3 2513 0.48 1.21 0.20 172 HTML_IMAGE_ONLY_20 2504 0.65 1.21 0.44 173 XMBdyGiftCard01 2461 0.93 1.19 0.83 174 FROM_SUSPICIOUS_NTLD 2381 0.37 1.15 0.07 175 XMSubEmpty 2362 0.97 1.14 0.90 176 TR_XM_MaxWHORU 2286 0.37 1.10 0.10 177 TO_NO_BRKTS_PCNT 2269 0.31 1.09 0.01 178 FROM_SUSPICIOUS_NTLD_FP 2243 0.35 1.08 0.07 179 HELO_NODOT 2224 1.36 1.07 1.47 180 BAYES_00 2223 14.44 1.07 19.57 181 HELO_NO_DOMAIN 2221 1.36 1.07 1.47 182 DATE_IN_PAST_12_24 2188 0.41 1.05 0.16 183 TR_XM_BayesRelay 2175 0.30 1.05 0.01 184 TR_XM_INV_DKIM 2144 0.34 1.03 0.07 185 T_XMHurry_00 2114 2.31 1.02 2.81 186 TR_MetaPhish_Combo_01 2110 0.89 1.02 0.84 187 XMHTML_After_End 2100 0.79 1.01 0.70 188 PDS_OTHER_BAD_TLD 2096 0.87 1.01 0.82 189 TVD_SPACE_RATIO_MINFP 2083 0.29 1.00 0.02 190 XMSlimDrugH 2029 0.48 0.98 0.29 191 TR_XM_COVIDMETA1 2019 0.44 0.97 0.24 192 HTML_IMAGE_ONLY_12 1973 0.41 0.95 0.21 193 DKIM_ADSP_CUSTOM_MED 1970 0.84 0.95 0.79 194 SHORTENED_URL_HREF 1970 0.75 0.95 0.68 195 ANY_BOUNCE_MESSAGE 1965 2.68 0.95 3.35 196 BOUNCE_MESSAGE 1963 2.68 0.95 3.35 197 TR_XM_FormFill 1949 0.28 0.94 0.03 198 XMPhish30 1946 0.48 0.94 0.30 199 BAYES_05 1936 2.64 0.93 3.30 200 HTTPS_HTTP_MISMATCH 1913 0.68 0.92 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 484240 90.92 94.49 89.55 2 RELAYCOUNTRY_US 437120 77.80 69.89 80.83 3 XM_B_Unicode 400822 73.55 72.06 74.12 4 DKIM_SIGNED 350602 68.17 76.84 64.83 5 XM_DK_Pass 344754 66.50 73.66 63.75 6 DCC_CHECK_NEGATIVE 339843 51.06 20.37 62.84 7 DKIM_VALID 335649 65.10 72.98 62.07 8 BAYES_50 275186 46.83 36.27 50.89 9 DKIM_VALID_AU 259207 50.53 57.30 47.93 10 XM_B_SpammyWords 257401 51.34 61.09 47.60 11 XM_B_Unicode3 237748 41.97 36.77 43.96 12 XMListUnsubscribeExists 230491 48.88 65.20 42.62 13 DCC_CHECK 191737 47.26 78.00 35.46 14 T_TM2_M_HEADER_IN_MSG 142648 25.17 22.03 26.38 15 RCVD_IN_MSPIKE_WL 134455 22.32 15.69 24.86 16 MIME_HTML_ONLY 133584 26.65 31.74 24.70 17 DKIM_VALID_EF 132390 25.39 27.75 24.48 18 HTML_FONT_LOW_CONTRAST 129896 26.50 32.96 24.02 19 RCVD_IN_MSPIKE_H2 124536 24.60 28.70 23.03 20 XM_B_SpammyWords2 110178 24.09 33.75 20.37 21 LOC_TINY_FONT_1 110027 24.32 34.68 20.35 22 BAYES_00 105837 14.44 1.07 19.57 23 XMSubLong 101307 19.98 23.21 18.73 24 FVGT_m_MULTI_ODD 98404 19.61 23.28 18.20 25 ALL_TRUSTED 86848 12.83 4.42 16.06 26 T_KAM_HTML_FONT_INVALID 82502 17.24 22.42 15.26 27 HTML_IMAGE_RATIO_04 79317 11.84 4.46 14.67 28 RCVD_IN_MSPIKE_H3 73423 12.22 8.68 13.58 29 XM_H_Trusted_IP 71842 9.60 0.00 13.29 30 HTML_FONT_FACE_BAD 69653 9.47 0.60 12.88 31 XM_Body_Dirty_Words 65452 13.26 16.26 12.10 32 XMStrtUSub 59572 8.90 3.38 11.02 33 XM_Multi_Part_URI 53497 12.97 20.99 9.89 34 MPART_ALT_DIFF 51310 8.83 7.13 9.49 35 TR_XM_DK_Bayes 49818 6.86 0.73 9.21 36 TR_XM_DK_Bayes1 48395 6.66 0.71 8.95 37 XM_B_Unsub 47860 9.50 11.18 8.85 38 RCVD_IN_MSPIKE_H4 47584 8.08 6.19 8.80 39 XM_Evil_Numbers_Gen 45517 8.81 9.82 8.42 40 XM_DKIMWhitelistDomains 43656 5.85 0.06 8.07 41 TR_XM_DK_Bayes2 43026 5.91 0.60 7.96 42 MIME_HTML_ONLY_MULTI 41879 6.24 2.32 7.74 43 LotsOfNums_01 40719 8.95 12.63 7.53 44 LOTS_OF_MONEY 40590 8.51 11.14 7.51 45 TooManyTo_001 38363 7.36 8.06 7.09 46 RCVD_IN_RP_SAFE 37675 5.83 2.87 6.97 47 UNPARSEABLE_RELAY 36444 6.64 6.38 6.74 48 XM_DK_Undo_02 36052 16.34 41.53 6.67 49 BAYES_60 34706 7.16 9.10 6.42 50 RCVD_IN_RP_CERTIFIED 34442 5.23 2.26 6.37 51 XM_SendGrid 33262 5.88 5.16 6.15 52 FSL_BULK_SIG 32959 9.40 18.01 6.09 53 HTML_IMAGE_RATIO_02 29622 6.26 8.29 5.48 54 TR_XM_SpammyWords4 29106 6.24 8.49 5.38 55 TR_XM_DKIM_Undo 27050 12.78 33.04 5.00 56 IN_ZIMBRA_NJ_WHITELIST 26949 3.62 0.06 4.98 57 BAYES_40 26581 4.09 1.93 4.92 58 MIME_QP_LONG_LINE 26498 4.24 2.53 4.90 59 HTML_IMAGE_RATIO_06 26419 4.98 5.23 4.89 60 XMSubNoVowel 25761 4.00 2.01 4.76 61 BAYES_20 25048 3.76 1.50 4.63 62 XM_H_Long_From01 25040 4.79 5.19 4.63 63 XMSexyCombo_05 24348 6.07 10.17 4.50 64 RCVD_IN_IADB_LISTED 24336 3.74 1.77 4.50 65 XM_B_Phish_Phrases 24289 4.87 5.84 4.49 66 TR_XM_UnparsRelay 24056 4.92 6.14 4.45 67 RELAYCOUNTRY_META 23780 9.88 24.17 4.40 68 T_TooManySym_01 23647 3.81 2.35 4.37 69 BAYES_99 23043 12.67 34.58 4.26 70 TR_XM_DK_SendGrid 22988 3.79 2.59 4.25 71 RCVD_IN_IADB_SPF 21501 3.32 1.60 3.98 72 BOTNET_IPINHOSTNAME 20879 6.68 14.01 3.86 73 XM_PDF 20804 3.03 0.89 3.85 74 BAYES_80 20189 5.20 9.03 3.73 75 RCVD_IN_IADB_SENDERID 19491 3.02 1.51 3.60 76 RCVD_IN_IADB_DK 18827 2.93 1.51 3.48 77 BAYES_999 18703 10.20 27.76 3.46 78 XM_UncommonTLD01 18411 6.03 12.85 3.40 79 XM_B_SpammyWords3 18400 5.22 9.95 3.40 80 ANY_BOUNCE_MESSAGE 18126 2.68 0.95 3.35 81 BOUNCE_MESSAGE 18124 2.68 0.95 3.35 82 BAYES_05 17824 2.64 0.93 3.30 83 XMSubMetaSx_00 17459 3.93 5.77 3.23 84 T_REMOTE_IMAGE 16646 4.67 8.83 3.08 85 XMNumbers 16343 3.68 5.38 3.02 86 T_XMHurry_00 15179 2.31 1.02 2.81 87 DKIM_INVALID 14953 3.07 3.86 2.77 88 TR_XM_PhishingBody 14791 3.30 4.79 2.74 89 TM2_M_URI_OPT_OUT 14626 3.40 5.21 2.70 90 FROM_EXCESS_BASE64 14330 2.61 2.52 2.65 91 RCVD_IN_IADB_VOUCHED 14098 2.08 0.72 2.61 92 RCVD_IN_MSPIKE_H5 13448 2.02 0.82 2.49 93 XM_B_SpammyTLD 13190 3.15 5.02 2.44 94 MAILING_LIST_MULTI 12790 2.09 1.38 2.37 95 MIME_HTML_MOSTLY 12687 3.15 5.23 2.35 96 BAYES_95 12305 3.19 5.56 2.28 97 TR_DCC_Bayes_99 11865 9.13 27.21 2.19 98 URI_NOVOWEL 11720 1.92 1.26 2.17 99 TR_XM_SB_Phish 10212 2.14 2.78 1.89 100 XMSubPhish11 10084 2.11 2.74 1.86 101 HTML_MIME_NO_HTML_TAG 10043 3.95 9.38 1.86 102 TooManyTo_002 9979 1.49 0.56 1.85 103 T_TooManySym_02 9782 1.48 0.64 1.81 104 HTML_IMAGE_RATIO_08 9472 2.15 3.20 1.75 105 T_XMDrugObfuBody_14 9320 1.66 1.50 1.72 106 RCVD_IN_IADB_OPTIN 9168 1.37 0.51 1.70 107 UNTRUSTED_Relay 9054 6.64 19.57 1.67 108 XMDiploma_00 8935 2.04 3.06 1.65 109 TR_XM_SpammyWords5 8584 2.25 3.96 1.59 110 XM_B_Phish66 8560 1.81 2.39 1.58 111 XM_CamelCaseFrm001 8516 1.68 1.95 1.57 112 XMSubGarbage 8451 1.14 0.05 1.56 113 BOTNET 8400 5.63 16.24 1.55 114 XMSubLongNoVowel 8270 1.17 0.25 1.53 115 XM_B_Unsub2 8220 1.72 2.23 1.52 116 SUBJ_ALL_CAPS 8217 1.80 2.53 1.52 117 XMStockSpam_06 7988 1.48 1.49 1.48 118 HELO_NODOT 7950 1.36 1.07 1.47 119 HELO_NO_DOMAIN 7949 1.36 1.07 1.47 120 XM_SPF_SoftFail 7885 2.56 5.44 1.46 121 T_XMDrugObfuBody_08 7797 1.76 2.58 1.44 122 T_FONT_INVIS_NAKED_TO 7515 2.02 3.67 1.39 123 IN_HORDE_ADDRESS_BOOK 7309 1.02 0.16 1.35 124 KHOP_HELO_FCRDNS 7232 3.33 8.52 1.34 125 INVALID_MSGID 7174 1.12 0.57 1.33 126 XM_DK_Undo_01 7114 1.47 1.86 1.32 127 T_FILL_THIS_FORM_SHORT 7010 2.08 4.11 1.30 128 TR_Symld_Words 6861 1.47 1.98 1.27 129 TooManyTo_003 6594 1.01 0.45 1.22 130 URI_HEX 6553 1.75 3.15 1.21 131 TVD_RCVD_IP 6544 1.11 0.83 1.21 132 TO_MALFORMED 6514 0.89 0.06 1.20 133 MSGID_NOFQDN1 6436 0.88 0.08 1.19 134 RELAYCOUNTRY_CA 6219 2.24 5.07 1.15 135 XMCapTrack 5954 0.90 0.37 1.10 136 XM_H_Long_From02 5707 0.98 0.78 1.06 137 XM_GoogleGroups 5588 0.86 0.42 1.03 138 TM2_M_VERY_LONG_WORD 5586 1.35 2.17 1.03 139 HELO_MISC_IP 5469 0.83 0.34 1.01 140 CK_HELO_DYNAMIC_SPLIT_IP 5462 0.93 0.72 1.01 141 RELAYCOUNTRY_GB 5339 1.08 1.32 0.99 142 RCVD_IN_BL_SPAMCOP_NET 5289 3.03 8.37 0.98 143 USER_IN_DEF_DKIM_WL 5056 0.68 0.02 0.93 144 XM_E_Blogspot 5021 0.68 0.05 0.93 145 SpammyFromTLD_01 5013 2.14 5.32 0.93 146 XM_ProductURIs 5009 0.89 0.79 0.93 147 TR_MSPIKEBAYES00 4896 0.66 0.02 0.91 148 XMSubEmpty 4861 0.97 1.14 0.90 149 XM_UB50 4794 2.71 7.46 0.89 150 XMBSHREFv2 4689 0.72 0.33 0.87 151 TooManyTo_004 4685 0.73 0.38 0.87 152 XM_OfRef6 4669 1.47 3.04 0.86 153 XMGappySubj_01 4559 0.70 0.33 0.84 154 TR_MetaPhish_Combo_01 4530 0.89 1.02 0.84 155 XMBdyGiftCard01 4479 0.93 1.19 0.83 156 TR_XM_SpammyWords2 4445 3.95 12.08 0.82 157 PDS_OTHER_BAD_TLD 4410 0.87 1.01 0.82 158 DKIM_ADSP_CUSTOM_MED 4288 0.84 0.95 0.79 159 URI_TRY_3LD 4118 1.20 2.33 0.76 160 XMSexyCombo_01 4025 0.95 1.47 0.74 161 XMSubMetaSxObfu_03 3960 0.73 0.71 0.73 162 FROM_GOV_DKIM_AU 3953 0.62 0.33 0.73 163 XMGenDplmaNmb 3888 0.98 1.65 0.72 164 TooManyTo_005 3882 0.61 0.32 0.72 165 XMBody_95 3808 0.53 0.09 0.70 166 XMHTML_After_End 3777 0.79 1.01 0.70 167 T_OBFU_PDF_ATTACH 3736 0.55 0.17 0.69 168 SHORTENED_URL_HREF 3659 0.75 0.95 0.68 169 T_XMDrugObfuBody_00 3475 0.90 1.57 0.64 170 RELAYCOUNTRY_DE 3417 0.85 1.42 0.63 171 XMBrknScrpt_02 3311 0.99 1.98 0.61 172 HTTPS_HTTP_MISMATCH 3187 0.68 0.92 0.59 173 XMMoneyMeta_00 3122 0.80 1.39 0.58 174 NUMERIC_HTTP_ADDR 3057 0.51 0.36 0.57 175 XM_B_COVIDMETA 3014 1.00 2.17 0.56 176 T_TooManySym_03 3013 0.50 0.34 0.56 177 NML_ADSP_CUSTOM_MED 2984 0.62 0.81 0.55 178 XM_SPF_Unknown 2951 0.58 0.68 0.55 179 XM_ShortIntro_01 2888 0.49 0.39 0.53 180 TR_XM_COVIDMETA4 2735 0.82 1.64 0.51 181 TR_XM_PHPDW 2733 0.89 1.88 0.51 182 XMSexyCombo_04 2657 0.56 0.74 0.49 183 MSGID_FROM_MTA_HEADER 2640 0.39 0.15 0.49 184 XM_H_PHPMailer 2575 0.49 0.51 0.48 185 TR_XM_PHPForged 2540 0.85 1.83 0.47 186 TR_XM_FormFill2 2538 0.84 1.82 0.47 187 T_HTML_ATTACH 2518 0.86 1.89 0.47 188 XM_H_PHPOS 2515 0.84 1.81 0.47 189 FORGED_GMAIL_RCVD 2409 0.57 0.89 0.45 190 TO_IN_SUBJ 2403 0.87 1.99 0.44 191 HTML_IMAGE_ONLY_20 2387 0.65 1.21 0.44 192 T_Symld_Words_02 2374 0.56 0.89 0.44 193 XMNoVowels 2362 0.44 0.45 0.44 194 RCVD_IN_SORBS_DUL 2334 0.41 0.37 0.43 195 TR_Mismatch_TLD_01 2298 0.66 1.28 0.42 196 XMPhish08 2286 0.49 0.67 0.42 197 SHORT_HELO_AND_INLINE_IMAGE 2267 0.33 0.11 0.42 198 DATE_IN_FUTURE_06_12 2264 0.88 2.07 0.42 199 OBFU_JVSCR_ESC 2253 0.82 1.85 0.42 200 FROM_IN_TO_AND_SUBJ 2253 0.81 1.85 0.42 ----------------------------------------------------------------------