Email: 687690 Autolearn: 0 AvgScore: 4.14 AvgScanTime: 1.32 sec Spam: 207257 Autolearn: 0 AvgScore: 15.06 AvgScanTime: 1.45 sec Ham: 480433 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.27 sec Time Spent Running SA: 252.71 hours Time Spent Processing Spam: 83.66 hours Time Spent Processing Ham: 169.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 190083 90.46 91.71 89.92 2 DCC_CHECK 167547 52.14 80.84 39.76 3 DKIM_SIGNED 166068 77.52 80.13 76.40 4 XM_DK_Pass 162014 76.08 78.17 75.18 5 DKIM_VALID 158270 74.08 76.36 73.09 6 XM_B_Unicode 152500 72.40 73.58 71.90 7 RELAYCOUNTRY_US 146663 79.18 70.76 82.81 8 XMListUnsubscribeExists 136957 54.69 66.08 49.77 9 XM_B_SpammyWords 132686 52.33 64.02 47.29 10 DKIM_VALID_AU 124761 56.54 60.20 54.96 11 XM_DK_Undo_02 94272 19.06 45.49 7.65 12 XM_B_Unicode3 76600 39.74 36.96 40.95 13 BAYES_99 75795 14.22 36.57 4.58 14 TR_XM_DKIM_Undo 72809 14.33 35.13 5.36 15 LOC_TINY_FONT_1 72685 27.28 35.07 23.93 16 BAYES_50 71979 49.30 34.73 55.58 17 HTML_FONT_LOW_CONTRAST 71806 29.29 34.65 26.97 18 XM_B_SpammyWords2 70376 24.62 33.96 20.59 19 TR_DCC_Bayes_99 61736 10.67 29.79 2.43 20 RCVD_IN_MSPIKE_H2 61521 28.98 29.68 28.68 21 MIME_HTML_ONLY 60677 22.92 29.28 20.18 22 DKIM_VALID_EF 60553 29.13 29.22 29.09 23 BAYES_999 60273 11.36 29.08 3.71 24 FVGT_m_MULTI_ODD 56169 23.65 27.10 22.16 25 RELAYCOUNTRY_META 54603 11.53 26.35 5.14 26 XMSubLong 50489 21.85 24.36 20.76 27 T_KAM_HTML_FONT_INVALID 49543 20.03 23.90 18.37 28 XM_Multi_Part_URI 41957 14.38 20.24 11.85 29 UNTRUSTED_Relay 41023 7.27 19.79 1.86 30 BOTNET 39987 7.31 19.29 2.15 31 T_TM2_M_HEADER_IN_MSG 39894 27.42 19.25 30.95 32 RCVD_IN_MSPIKE_WL 37007 24.75 17.86 27.72 33 DCC_CHECK_NEGATIVE 36392 45.84 17.56 58.05 34 FSL_BULK_SIG 35396 9.39 17.08 6.07 35 XM_Body_Dirty_Words 33986 14.10 16.40 13.11 36 BOTNET_IPINHOSTNAME 32387 8.07 15.63 4.80 37 XM_B_Unsub 26622 11.69 12.84 11.19 38 XM_UncommonTLD01 25286 5.95 12.20 3.25 39 LotsOfNums_01 24392 10.22 11.77 9.55 40 TR_XM_SpammyWords2 23846 3.82 11.51 0.50 41 RCVD_IN_BL_SPAMCOP_NET 23165 4.05 11.18 0.97 42 XM_B_SpammyWords3 22791 6.92 11.00 5.16 43 LOTS_OF_MONEY 21824 7.24 10.53 5.82 44 RCVD_IN_MSPIKE_H3 21367 13.98 10.31 15.56 45 XM_Evil_Numbers_Gen 20328 9.17 9.81 8.89 46 BAYES_80 19340 5.59 9.33 3.97 47 TR_XM_SpammyWords4 18862 5.29 9.10 3.65 48 XMSexyCombo_05 18257 5.53 8.81 4.11 49 MPART_ALT_DIFF 17422 6.08 8.41 5.08 50 RCVD_IN_MSPIKE_BL 17414 2.77 8.40 0.34 51 BAYES_60 17296 7.34 8.35 6.90 52 TR_XM_MSPIKECOMBO 17051 2.71 8.23 0.33 53 HTML_IMAGE_RATIO_02 16500 7.41 7.96 7.18 54 URIBL_SBL_A 16127 2.44 7.78 0.14 55 TooManyTo_001 15911 8.47 7.68 8.81 56 UNPARSEABLE_RELAY 14707 7.66 7.10 7.90 57 XM_B_Phish_Phrases 14330 5.19 6.91 4.44 58 RCVD_IN_MSPIKE_H4 14169 8.88 6.84 9.76 59 TR_XM_UnparsRelay 14132 5.95 6.82 5.58 60 MIME_HTML_MOSTLY 14004 3.72 6.76 2.42 61 XM_UB50 13804 2.73 6.66 1.04 62 RCVD_IN_RP_RNBL 13516 2.01 6.52 0.06 63 T_REMOTE_IMAGE 13240 4.38 6.39 3.52 64 RELAYCOUNTRY_CA 13216 2.97 6.38 1.50 65 RCVD_IN_PSBL 13198 1.97 6.37 0.07 66 RCVD_IN_MSPIKE_L5 13141 1.98 6.34 0.10 67 XMSubMetaSx_00 12424 4.47 5.99 3.82 68 XM_SendGrid 12117 6.80 5.85 7.21 69 XM_H_Long_From01 11922 5.84 5.75 5.88 70 TR_XM_PhishingBody 11825 3.62 5.71 2.72 71 SpammyFromTLD_01 11405 2.22 5.50 0.80 72 TR_Symld_Words 11223 2.63 5.42 1.43 73 XMNumbers 11096 3.88 5.35 3.25 74 KHOP_HELO_FCRDNS 10938 2.83 5.28 1.77 75 BAYES_95 10858 3.24 5.24 2.38 76 BODY_URI_ONLY 10572 1.58 5.10 0.06 77 HTML_IMAGE_RATIO_08 10384 3.11 5.01 2.29 78 HTML_IMAGE_ONLY_12 9933 1.63 4.79 0.26 79 HTML_SHORT_LINK_IMG_1 9720 1.43 4.69 0.03 80 T_Symld_Words_02 9582 1.76 4.62 0.52 81 TM2_M_VERY_LONG_WORD 9245 2.17 4.46 1.19 82 XMSlimDrugH 9228 1.70 4.45 0.51 83 HTML_IMAGE_RATIO_04 9054 5.27 4.37 5.66 84 HTML_IMAGE_RATIO_06 9050 4.00 4.37 3.84 85 XM_B_SpammyTLD 8990 2.71 4.34 2.00 86 RCVD_IN_RP_SAFE 8927 6.71 4.31 7.74 87 PDS_FROM_2_EMAILS 8781 1.30 4.24 0.03 88 FROM_2_EMAILS_SHORT 8731 1.28 4.21 0.01 89 TVD_SPACE_RATIO 8294 1.53 4.00 0.46 90 PDS_TO_EQ_FROM_NAME 8253 1.21 3.98 0.01 91 DRUGS_ERECTILE 8163 1.22 3.94 0.05 92 XMSubMetaD_03 8136 1.20 3.93 0.03 93 XM_SPF_SoftFail 8131 2.63 3.92 2.07 94 XMSubMetaD_00 8101 1.24 3.91 0.09 95 T_FONT_INVIS_NAKED_TO 8053 2.24 3.89 1.53 96 TR_XM_SpammyWords5 7996 2.66 3.86 2.15 97 XM_UB99 7960 1.16 3.84 0.01 98 XM_OfRef6 7865 2.08 3.79 1.34 99 RELAYCOUNTRY_FR 7846 1.34 3.79 0.29 100 XMSubMetaD_01 7812 1.14 3.77 0.01 101 XMSubMetaD_02 7803 1.14 3.76 0.01 102 DKIM_INVALID 7798 3.44 3.76 3.30 103 SERGIO_SUBJECT_VIAGRA01 7790 1.14 3.76 0.01 104 SUBJECT_DRUG_GAP_C 7781 1.14 3.75 0.01 105 SUBJECT_DRUG_GAP_L 7775 1.14 3.75 0.01 106 XMSubMetaD_04 7771 1.14 3.75 0.01 107 NO_FM_NAME_IP_HOSTN 7431 1.09 3.59 0.01 108 URI_HEX 7350 2.01 3.55 1.34 109 RCVD_IN_RP_CERTIFIED 7292 6.08 3.52 7.18 110 TR_XM_DK_SendGrid 7144 4.20 3.45 4.52 111 XM_UB60 7021 1.10 3.39 0.12 112 XM_UB80 6936 1.03 3.35 0.04 113 LONG_JUNK_URI 6883 1.03 3.32 0.04 114 XMStrtUSub 6876 4.09 3.32 4.43 115 RELAYCOUNTRY_IN 6869 1.09 3.31 0.13 116 TR_XM_MaxBayes 6594 0.97 3.18 0.01 117 SpammyFromTLD_02 6566 1.09 3.17 0.20 118 TVD_SPACE_RATIO_MINFP 6328 0.93 3.05 0.02 119 XM_B_Phish66 6286 2.24 3.03 1.90 120 XM_B_COVIDMETA 6241 1.81 3.01 1.30 121 TM2_M_URI_OPT_OUT 6193 2.44 2.99 2.20 122 XM_UB999 5488 0.80 2.65 0.01 123 MIME_QP_LONG_LINE 5429 4.91 2.62 5.90 124 XM_B_Unsub2 5412 2.31 2.61 2.17 125 XM_DIRTYINTL 5333 1.06 2.57 0.40 126 BOTNET_NORDNS 5285 0.78 2.55 0.02 127 XMDiploma_00 5117 2.54 2.47 2.57 128 TR_XM_SB_Phish 5049 2.26 2.44 2.18 129 XMBdyGiftCard01 5017 1.15 2.42 0.60 130 XM_DK_Undo_01 5011 1.87 2.42 1.64 131 FROM_EXCESS_BASE64 4967 2.74 2.40 2.89 132 XMBrknScrpt_02 4948 1.22 2.39 0.72 133 MIME_HTML_ONLY_MULTI 4945 2.90 2.39 3.12 134 SUBJ_ALL_CAPS 4913 2.25 2.37 2.20 135 DATE_IN_PAST_03_06 4910 0.77 2.37 0.09 136 XMSubPhish11 4865 2.21 2.35 2.15 137 TR_XM_SpammyWords3 4808 0.81 2.32 0.17 138 XMSubNoVowel 4782 2.29 2.31 2.28 139 BAYES_40 4564 4.38 2.20 5.32 140 XMBody_17 4516 1.01 2.18 0.50 141 T_XMDrugObfuBody_08 4457 1.69 2.15 1.49 142 ALL_TRUSTED 4455 10.11 2.15 13.54 143 MIMEOLE_DIRECT_TO_MX 4375 0.64 2.11 0.01 144 T_FILL_THIS_FORM_SHORT 4327 1.47 2.09 1.21 145 TR_XM_SpoofStaff 4238 0.68 2.04 0.08 146 URI_TRY_3LD 4214 1.65 2.03 1.49 147 XMSexyCombo_01 4211 0.96 2.03 0.50 148 XMSpoofStaff2 4201 0.67 2.03 0.08 149 TR_LOTS_OF_MONEY3 4195 0.76 2.02 0.22 150 HTML_MIME_NO_HTML_TAG 4185 1.96 2.02 1.94 151 XM_CamelCaseFrm001 4148 1.89 2.00 1.84 152 T_TooManySym_01 4031 3.85 1.94 4.67 153 XM_B_SpammyWords4 4004 1.02 1.93 0.63 154 URI_ONLY_MSGID_MALF 3718 0.55 1.79 0.01 155 T_XMDrugObfuBody_00 3625 1.21 1.75 0.98 156 RELAYCOUNTRY_UA 3624 0.57 1.75 0.06 157 HDR_ORDER_FTSDMCXX_DIRECT 3584 0.53 1.73 0.01 158 RCVD_IN_IADB_LISTED 3552 4.37 1.71 5.52 159 URI_NO_WWW_BIZ_CGI 3526 0.53 1.70 0.02 160 XM_UB95 3501 0.52 1.69 0.02 161 MAILING_LIST_MULTI 3439 2.39 1.66 2.70 162 HK_RANDOM_REPLYTO 3413 0.68 1.65 0.26 163 TR_XM_SpoofStaff2 3367 0.49 1.62 0.00 164 T_XMDrugObfuBody_14 3285 1.45 1.58 1.39 165 BAYES_20 3227 3.34 1.56 4.11 166 TR_XM_PSC1 3196 0.52 1.54 0.08 167 XM_H_SpoofStaff4 3191 0.54 1.54 0.10 168 RCVD_IN_IADB_SPF 3154 3.84 1.52 4.84 169 XM_URI_RBL 3151 0.58 1.52 0.18 170 TR_XM_PHPDW 3141 0.70 1.52 0.35 171 TR_XM_PHPForged 3119 0.68 1.50 0.32 172 XMGenDplmaNmb 3110 1.42 1.50 1.38 173 TR_XM_FormFill2 3083 0.66 1.49 0.31 174 XM_H_PHPOS 3073 0.66 1.48 0.30 175 DATE_IN_PAST_12_24 3037 0.56 1.47 0.17 176 TR_XM_COVIDMETA1 2994 0.66 1.44 0.33 177 XMSubMetaSxObfu_03 2993 0.77 1.44 0.47 178 RCVD_IN_IADB_DK 2972 3.38 1.43 4.22 179 TR_XM_COVIDMETA4 2952 0.73 1.42 0.44 180 RCVD_IN_IADB_SENDERID 2940 3.47 1.42 4.36 181 XMHTML_After_End 2935 0.98 1.42 0.79 182 DOS_OE_TO_MX 2899 0.43 1.40 0.01 183 URI_NOVOWEL 2881 2.34 1.39 2.74 184 RDNS_DYNAMIC 2878 0.75 1.39 0.47 185 XMStockSpam_06 2755 1.23 1.33 1.19 186 RCVD_IN_MSPIKE_L3 2741 0.52 1.32 0.17 187 PDS_OTHER_BAD_TLD 2681 0.84 1.29 0.65 188 CK_HELO_DYNAMIC_SPLIT_IP 2679 1.22 1.29 1.19 189 HTTPS_HTTP_MISMATCH 2663 0.95 1.28 0.80 190 HTML_FONT_SIZE_LARGE 2658 0.48 1.28 0.14 191 TR_XM_BayesRelay 2634 0.39 1.27 0.01 192 XM_ProductURIs 2608 0.92 1.26 0.77 193 FROM_SUSPICIOUS_NTLD 2601 0.44 1.25 0.09 194 TR_Mismatch_TLD_01 2582 0.75 1.25 0.53 195 T_XMHurry_00 2572 0.76 1.24 0.55 196 URG_BIZ 2557 0.42 1.23 0.07 197 XMSubEmpty 2553 1.26 1.23 1.27 198 TR_XM_INV_DKIM 2551 0.41 1.23 0.05 199 FROM_SUSPICIOUS_NTLD_FP 2459 0.41 1.19 0.08 200 XMSubMetaI_00 2434 0.79 1.17 0.63 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 432016 90.46 91.71 89.92 2 RELAYCOUNTRY_US 397869 79.18 70.76 82.81 3 DKIM_SIGNED 367029 77.52 80.13 76.40 4 XM_DK_Pass 361212 76.08 78.17 75.18 5 DKIM_VALID 351168 74.08 76.36 73.09 6 XM_B_Unicode 345413 72.40 73.58 71.90 7 DCC_CHECK_NEGATIVE 278869 45.84 17.56 58.05 8 BAYES_50 267042 49.30 34.73 55.58 9 DKIM_VALID_AU 264029 56.54 60.20 54.96 10 XMListUnsubscribeExists 239128 54.69 66.08 49.77 11 XM_B_SpammyWords 227208 52.33 64.02 47.29 12 XM_B_Unicode3 196720 39.74 36.96 40.95 13 DCC_CHECK 191042 52.14 80.84 39.76 14 T_TM2_M_HEADER_IN_MSG 148681 27.42 19.25 30.95 15 DKIM_VALID_EF 139769 29.13 29.22 29.09 16 RCVD_IN_MSPIKE_H2 137780 28.98 29.68 28.68 17 RCVD_IN_MSPIKE_WL 133183 24.75 17.86 27.72 18 HTML_FONT_LOW_CONTRAST 129592 29.29 34.65 26.97 19 LOC_TINY_FONT_1 114948 27.28 35.07 23.93 20 FVGT_m_MULTI_ODD 106470 23.65 27.10 22.16 21 XMSubLong 99749 21.85 24.36 20.76 22 XM_B_SpammyWords2 98914 24.62 33.96 20.59 23 MIME_HTML_ONLY 96963 22.92 29.28 20.18 24 T_KAM_HTML_FONT_INVALID 88233 20.03 23.90 18.37 25 RCVD_IN_MSPIKE_H3 74738 13.98 10.31 15.56 26 BAYES_00 69859 10.50 1.13 14.54 27 ALL_TRUSTED 65056 10.11 2.15 13.54 28 XM_Body_Dirty_Words 62969 14.10 16.40 13.11 29 XM_Multi_Part_URI 56930 14.38 20.24 11.85 30 XM_B_Unsub 53751 11.69 12.84 11.19 31 TR_XM_DK_Bayes 49995 7.52 0.81 10.41 32 TR_XM_DK_Bayes1 48526 7.30 0.80 10.10 33 RCVD_IN_MSPIKE_H4 46909 8.88 6.84 9.76 34 LotsOfNums_01 45886 10.22 11.77 9.55 35 XM_DKIMWhitelistDomains 42858 6.25 0.05 8.92 36 XM_Evil_Numbers_Gen 42708 9.17 9.81 8.89 37 TooManyTo_001 42303 8.47 7.68 8.81 38 TR_XM_DK_Bayes2 42227 6.36 0.73 8.79 39 UNPARSEABLE_RELAY 37966 7.66 7.10 7.90 40 RCVD_IN_RP_SAFE 37203 6.71 4.31 7.74 41 XM_DK_Undo_02 36776 19.06 45.49 7.65 42 XM_SendGrid 34647 6.80 5.85 7.21 43 RCVD_IN_RP_CERTIFIED 34503 6.08 3.52 7.18 44 HTML_IMAGE_RATIO_02 34477 7.41 7.96 7.18 45 BAYES_60 33168 7.34 8.35 6.90 46 IN_ZIMBRA_NJ_WHITELIST 29961 4.41 0.17 6.24 47 FSL_BULK_SIG 29171 9.39 17.08 6.07 48 MIME_QP_LONG_LINE 28357 4.91 2.62 5.90 49 XM_H_Long_From01 28260 5.84 5.75 5.88 50 LOTS_OF_MONEY 27985 7.24 10.53 5.82 51 HTML_IMAGE_RATIO_04 27172 5.27 4.37 5.66 52 TR_XM_UnparsRelay 26791 5.95 6.82 5.58 53 RCVD_IN_IADB_LISTED 26508 4.37 1.71 5.52 54 TR_XM_DKIM_Undo 25737 14.33 35.13 5.36 55 BAYES_40 25555 4.38 2.20 5.32 56 XM_B_SpammyWords3 24793 6.92 11.00 5.16 57 RELAYCOUNTRY_META 24673 11.53 26.35 5.14 58 MPART_ALT_DIFF 24415 6.08 8.41 5.08 59 RCVD_IN_IADB_SPF 23274 3.84 1.52 4.84 60 BOTNET_IPINHOSTNAME 23082 8.07 15.63 4.80 61 T_TooManySym_01 22447 3.85 1.94 4.67 62 BAYES_99 21980 14.22 36.57 4.58 63 TR_XM_DK_SendGrid 21728 4.20 3.45 4.52 64 XM_B_Phish_Phrases 21327 5.19 6.91 4.44 65 XMStrtUSub 21263 4.09 3.32 4.43 66 RCVD_IN_IADB_SENDERID 20955 3.47 1.42 4.36 67 XM_PDF 20928 3.29 0.82 4.36 68 RCVD_IN_IADB_DK 20267 3.38 1.43 4.22 69 XMSexyCombo_05 19752 5.53 8.81 4.11 70 BAYES_20 19730 3.34 1.56 4.11 71 BAYES_80 19076 5.59 9.33 3.97 72 HTML_IMAGE_RATIO_06 18430 4.00 4.37 3.84 73 XMSubMetaSx_00 18348 4.47 5.99 3.82 74 BAYES_999 17822 11.36 29.08 3.71 75 TR_XM_SpammyWords4 17532 5.29 9.10 3.65 76 T_REMOTE_IMAGE 16912 4.38 6.39 3.52 77 DKIM_INVALID 15861 3.44 3.76 3.30 78 XM_UncommonTLD01 15619 5.95 12.20 3.25 79 XMNumbers 15607 3.88 5.35 3.25 80 RCVD_IN_IADB_VOUCHED 15456 2.47 0.74 3.22 81 MIME_HTML_ONLY_MULTI 14967 2.90 2.39 3.12 82 FROM_EXCESS_BASE64 13864 2.74 2.40 2.89 83 XM_H_Trusted_IP 13752 2.00 0.00 2.86 84 URI_NOVOWEL 13180 2.34 1.39 2.74 85 TR_XM_PhishingBody 13052 3.62 5.71 2.72 86 MAILING_LIST_MULTI 12977 2.39 1.66 2.70 87 BAYES_05 12501 2.08 0.88 2.60 88 XMDiploma_00 12352 2.54 2.47 2.57 89 TooManyTo_002 11945 1.93 0.64 2.49 90 TR_DCC_Bayes_99 11657 10.67 29.79 2.43 91 MIME_HTML_MOSTLY 11605 3.72 6.76 2.42 92 RCVD_IN_MSPIKE_H5 11536 1.89 0.71 2.40 93 BAYES_95 11428 3.24 5.24 2.38 94 HTML_IMAGE_RATIO_08 10978 3.11 5.01 2.29 95 XMSubNoVowel 10971 2.29 2.31 2.28 96 SUBJ_ALL_CAPS 10587 2.25 2.37 2.20 97 TM2_M_URI_OPT_OUT 10583 2.44 2.99 2.20 98 T_TooManySym_02 10563 1.71 0.58 2.20 99 TR_XM_SB_Phish 10459 2.26 2.44 2.18 100 XM_B_Unsub2 10444 2.31 2.61 2.17 101 RCVD_IN_IADB_OPTIN 10332 1.65 0.49 2.15 102 XMSubPhish11 10324 2.21 2.35 2.15 103 TR_XM_SpammyWords5 10318 2.66 3.86 2.15 104 BOTNET 10307 7.31 19.29 2.15 105 XM_SPF_SoftFail 9927 2.63 3.92 2.07 106 XM_B_SpammyTLD 9619 2.71 4.34 2.00 107 HTML_MIME_NO_HTML_TAG 9315 1.96 2.02 1.94 108 XM_B_Phish66 9130 2.24 3.03 1.90 109 UNTRUSTED_Relay 8956 7.27 19.79 1.86 110 XM_CamelCaseFrm001 8827 1.89 2.00 1.84 111 HELO_NODOT 8765 1.58 1.00 1.82 112 HELO_NO_DOMAIN 8765 1.58 1.00 1.82 113 KHOP_HELO_FCRDNS 8493 2.83 5.28 1.77 114 TooManyTo_003 8063 1.33 0.52 1.68 115 XM_DK_Undo_01 7879 1.87 2.42 1.64 116 IN_HORDE_ADDRESS_BOOK 7613 1.29 0.62 1.58 117 T_FONT_INVIS_NAKED_TO 7332 2.24 3.89 1.53 118 INVALID_MSGID 7278 1.23 0.56 1.51 119 TVD_RCVD_IP 7260 1.26 0.68 1.51 120 RELAYCOUNTRY_CA 7208 2.97 6.38 1.50 121 URI_TRY_3LD 7159 1.65 2.03 1.49 122 T_XMDrugObfuBody_08 7142 1.69 2.15 1.49 123 ANY_BOUNCE_MESSAGE 7101 1.17 0.47 1.48 124 BOUNCE_MESSAGE 7081 1.17 0.46 1.47 125 USER_IN_DEF_DKIM_WL 7000 1.11 0.29 1.46 126 TR_Symld_Words 6873 2.63 5.42 1.43 127 T_XMDrugObfuBody_14 6689 1.45 1.58 1.39 128 XMGenDplmaNmb 6636 1.42 1.50 1.38 129 TO_MALFORMED 6600 0.96 0.00 1.37 130 MSGID_NOFQDN1 6575 0.96 0.02 1.37 131 XMCapTrack 6550 1.08 0.41 1.36 132 URI_HEX 6445 2.01 3.55 1.34 133 XM_OfRef6 6417 2.08 3.79 1.34 134 XM_B_COVIDMETA 6232 1.81 3.01 1.30 135 XMSubEmpty 6123 1.26 1.23 1.27 136 TooManyTo_004 6042 1.00 0.42 1.26 137 T_FILL_THIS_FORM_SHORT 5810 1.47 2.09 1.21 138 XMStockSpam_06 5731 1.23 1.33 1.19 139 CK_HELO_DYNAMIC_SPLIT_IP 5707 1.22 1.29 1.19 140 HELO_MISC_IP 5702 0.99 0.53 1.19 141 TM2_M_VERY_LONG_WORD 5701 2.17 4.46 1.19 142 XM_GoogleGroups 5464 0.92 0.42 1.14 143 DKIM_ADSP_CUSTOM_MED 5088 1.04 0.99 1.06 144 XM_UB50 4975 2.73 6.66 1.04 145 TooManyTo_005 4950 0.83 0.36 1.03 146 HTML_FONT_FACE_BAD 4871 0.89 0.60 1.01 147 XMBSHREFv2 4823 0.79 0.31 1.00 148 FROM_GOV_DKIM_AU 4720 0.78 0.32 0.98 149 TR_MSPIKEBAYES00 4703 0.69 0.02 0.98 150 T_XMDrugObfuBody_00 4686 1.21 1.75 0.98 151 RCVD_IN_BL_SPAMCOP_NET 4679 4.05 11.18 0.97 152 RELAYCOUNTRY_GB 4675 1.00 1.06 0.97 153 XM_H_Long_From02 4554 0.89 0.77 0.95 154 XMGappySubj_01 4429 0.76 0.37 0.92 155 XMBody_95 4363 0.69 0.17 0.91 156 SHORTENED_URL_HREF 4073 0.87 0.93 0.85 157 XMNoVowels 3965 0.77 0.63 0.83 158 HTTPS_HTTP_MISMATCH 3861 0.95 1.28 0.80 159 SpammyFromTLD_01 3837 2.22 5.50 0.80 160 XMHTML_After_End 3810 0.98 1.42 0.79 161 XM_ProductURIs 3705 0.92 1.26 0.77 162 NML_ADSP_CUSTOM_MED 3532 0.77 0.84 0.74 163 XM_SPF_Unknown 3514 0.69 0.60 0.73 164 XMBrknScrpt_02 3468 1.22 2.39 0.72 165 XM_RXBody 3418 0.59 0.31 0.71 166 XM_E_Blogspot 3393 0.51 0.07 0.71 167 T_TooManySym_03 3374 0.54 0.15 0.70 168 XMSolicitRefs_0 3205 0.54 0.26 0.67 169 XM_ShortIntro_01 3169 0.57 0.37 0.66 170 PDS_OTHER_BAD_TLD 3102 0.84 1.29 0.65 171 XM_B_SpammyWords4 3033 1.02 1.93 0.63 172 XMSubMetaI_00 3012 0.79 1.17 0.63 173 TR_MetaPhish_Combo_01 2997 0.69 0.86 0.62 174 FORGED_GMAIL_RCVD 2960 0.76 1.10 0.62 175 T_OBFU_PDF_ATTACH 2925 0.46 0.11 0.61 176 XMBdyGiftCard01 2896 1.15 2.42 0.60 177 RCVD_IN_SORBS_DUL 2878 0.58 0.54 0.60 178 XM_H_PHPMailer 2746 0.54 0.48 0.57 179 XMMoneyMeta_00 2659 0.73 1.13 0.55 180 T_XMHurry_00 2625 0.76 1.24 0.55 181 TR_Mismatch_TLD_01 2552 0.75 1.25 0.53 182 HTML_IMAGE_ONLY_20 2536 0.49 0.39 0.53 183 T_Symld_Words_02 2505 1.76 4.62 0.52 184 XMSubMetaSxObfu_02 2482 0.46 0.32 0.52 185 XMSlimDrugH 2438 1.70 4.45 0.51 186 SHORT_HELO_AND_INLINE_IMAGE 2435 0.39 0.12 0.51 187 XMBody_17 2420 1.01 2.18 0.50 188 TR_XM_SpammyWords2 2400 3.82 11.51 0.50 189 XMSexyCombo_01 2396 0.96 2.03 0.50 190 MISSING_HEADERS 2320 0.49 0.52 0.48 191 XMSubMetaSxObfu_03 2282 0.77 1.44 0.47 192 RDNS_DYNAMIC 2271 0.75 1.39 0.47 193 XMLngstWrd_00 2222 0.44 0.40 0.46 194 FROM_GOV_SPOOF 2209 0.35 0.10 0.46 195 TVD_SPACE_RATIO 2197 1.53 4.00 0.46 196 TM2_M_BODY_EMPTY 2176 0.33 0.04 0.45 197 HTML_IMAGE_ONLY_32 2132 0.36 0.16 0.44 198 TR_XM_COVIDMETA4 2097 0.73 1.42 0.44 199 XMHTMLBadTable_001 2074 0.48 0.60 0.43 200 HTML_IMAGE_ONLY_28 2053 0.38 0.27 0.43 ----------------------------------------------------------------------