Email: 737417 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.43 sec Spam: 216266 Autolearn: 0 AvgScore: 13.85 AvgScanTime: 1.55 sec Ham: 521151 Autolearn: 0 AvgScore: -0.62 AvgScanTime: 1.38 sec Time Spent Running SA: 293.41 hours Time Spent Processing Spam: 93.31 hours Time Spent Processing Ham: 200.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 207982 91.81 96.17 90.00 2 DKIM_SIGNED 188850 80.06 87.32 77.04 3 XM_DK_Pass 178764 77.82 82.66 75.81 4 DKIM_VALID 176700 76.17 81.70 73.88 5 DCC_CHECK 168635 51.56 77.98 40.60 6 RELAYCOUNTRY_US 161582 80.34 74.71 82.67 7 XM_B_Unicode 157285 71.91 72.73 71.58 8 XMListUnsubscribeExists 152589 57.27 70.56 51.76 9 XM_B_SpammyWords 142982 55.00 66.11 50.38 10 DKIM_VALID_AU 137043 57.60 63.37 55.21 11 XM_DK_Undo_02 102046 18.90 47.19 7.16 12 LOC_TINY_FONT_1 85498 29.15 39.53 24.84 13 XM_B_Unicode3 82429 41.16 38.11 42.42 14 XM_B_SpammyWords2 79976 27.04 36.98 22.92 15 HTML_FONT_LOW_CONTRAST 78091 30.30 36.11 27.88 16 BAYES_50 78087 51.01 36.11 57.19 17 TR_XM_DKIM_Undo 77820 14.29 35.98 5.29 18 BAYES_99 74478 12.90 34.44 3.96 19 DKIM_VALID_EF 72513 29.85 33.53 28.32 20 RCVD_IN_MSPIKE_H2 63124 28.24 29.19 27.85 21 MIME_HTML_ONLY 60206 22.57 27.84 20.38 22 TR_DCC_Bayes_99 58987 9.39 27.28 1.96 23 BAYES_999 57330 9.97 26.51 3.11 24 FVGT_m_MULTI_ODD 54968 23.82 25.42 23.15 25 T_KAM_HTML_FONT_INVALID 53704 21.18 24.83 19.67 26 RELAYCOUNTRY_META 51444 10.60 23.79 5.12 27 XMSubLong 47780 21.31 22.09 20.98 28 DCC_CHECK_NEGATIVE 42809 46.19 19.79 57.14 29 BOTNET 42048 7.12 19.44 2.00 30 T_TM2_M_HEADER_IN_MSG 41848 27.88 19.35 31.42 31 XM_Multi_Part_URI 41316 14.05 19.10 11.95 32 RCVD_IN_MSPIKE_WL 41239 26.26 19.07 29.25 33 XM_UncommonTLD01 41136 7.75 19.02 3.07 34 XM_Body_Dirty_Words 40383 14.37 18.67 12.58 35 UNTRUSTED_Relay 36455 6.32 16.86 1.95 36 LOTS_OF_MONEY 31796 9.74 14.70 7.68 37 XM_B_Unsub 28170 11.12 13.03 10.33 38 TR_XM_SpammyWords4 27438 7.48 12.69 5.31 39 TR_XM_SpammyWords2 26928 4.12 12.45 0.66 40 XM_B_SpammyWords3 26876 7.46 12.43 5.39 41 BOTNET_IPINHOSTNAME 26000 6.78 12.02 4.60 42 LotsOfNums_01 24718 9.68 11.43 8.96 43 FSL_BULK_SIG 23067 7.14 10.67 5.68 44 RCVD_IN_MSPIKE_H3 22556 14.66 10.43 16.41 45 RCVD_IN_BL_SPAMCOP_NET 21264 3.80 9.83 1.30 46 MPART_ALT_DIFF 21030 6.27 9.72 4.83 47 XM_Evil_Numbers_Gen 20861 9.00 9.65 8.73 48 TooManyTo_001 20720 8.70 9.58 8.33 49 BAYES_80 20029 5.58 9.26 4.06 50 XMSexyCombo_05 19993 5.37 9.24 3.76 51 BAYES_60 18118 7.63 8.38 7.32 52 MIME_HTML_MOSTLY 17721 3.97 8.19 2.22 53 HTML_IMAGE_RATIO_02 17650 6.95 8.16 6.45 54 XM_H_Long_From01 17499 6.67 8.09 6.08 55 RCVD_IN_MSPIKE_H4 16845 9.64 7.79 10.41 56 XMSubMetaSx_00 15716 4.79 7.27 3.76 57 UNPARSEABLE_RELAY 15201 7.96 7.03 8.35 58 XM_B_Phish_Phrases 14828 5.41 6.86 4.81 59 XM_UB50 14776 2.80 6.83 1.12 60 TR_XM_UnparsRelay 14490 6.20 6.70 6.00 61 BOTNET_NORDNS 14185 1.94 6.56 0.03 62 SpammyFromTLD_01 14137 2.53 6.54 0.87 63 XM_B_SpammyTLD 14022 3.40 6.48 2.12 64 XMNumbers 13528 3.97 6.26 3.02 65 RELAYCOUNTRY_CA 13426 2.78 6.21 1.36 66 SpammyFromTLD_02 12960 1.99 5.99 0.32 67 TR_XM_PhishingBody 12758 3.74 5.90 2.85 68 XM_SendGrid 12443 6.97 5.75 7.48 69 XM_OfRef6 12174 2.41 5.63 1.07 70 DKIM_INVALID 12150 3.88 5.62 3.16 71 HTML_IMAGE_RATIO_04 11706 5.30 5.41 5.26 72 BAYES_95 11699 3.32 5.41 2.45 73 KHOP_HELO_FCRDNS 11692 2.78 5.41 1.69 74 T_REMOTE_IMAGE 10739 3.99 4.97 3.59 75 RCVD_IN_MSPIKE_BL 9941 1.54 4.60 0.27 76 TR_XM_MSPIKECOMBO 9809 1.51 4.54 0.26 77 RELAYCOUNTRY_FR 9529 1.53 4.41 0.33 78 XM_SPF_SoftFail 9514 2.75 4.40 2.07 79 XM_DK_Undo_01 9502 2.45 4.39 1.64 80 HTML_IMAGE_RATIO_06 9450 4.19 4.37 4.12 81 RCVD_IN_RP_SAFE 9380 6.44 4.34 7.31 82 TR_XM_SpammyWords5 9293 2.38 4.30 1.58 83 XMStrtUSub 9247 4.58 4.28 4.70 84 URIBL_SBL_A 8743 1.39 4.04 0.29 85 HTML_IMAGE_RATIO_08 8323 2.77 3.85 2.33 86 RCVD_IN_RP_CERTIFIED 8178 5.88 3.78 6.75 87 HTML_IMAGE_ONLY_12 8035 1.24 3.72 0.21 88 RCVD_IN_RP_RNBL 7767 1.10 3.59 0.07 89 XMBody_17 7449 1.61 3.44 0.85 90 BODY_URI_ONLY 7393 1.03 3.42 0.04 91 TM2_M_URI_OPT_OUT 7369 2.60 3.41 2.26 92 HTML_SHORT_LINK_IMG_1 7282 1.00 3.37 0.01 93 TR_XM_SB_Phish 7137 2.53 3.30 2.21 94 RCVD_IN_MSPIKE_L5 7072 1.02 3.27 0.08 95 TR_XM_DK_SendGrid 7015 4.31 3.24 4.75 96 XMSubPhish11 6919 2.47 3.20 2.17 97 XM_B_Phish66 6815 2.19 3.15 1.79 98 TR_LOTS_OF_MONEY3 6802 1.19 3.15 0.38 99 T_FILL_THIS_FORM_SHORT 6636 1.46 3.07 0.79 100 XM_DIRTYINTL 6540 1.20 3.02 0.44 101 FORGED_GMAIL_RCVD 6529 1.37 3.02 0.68 102 PDS_OTHER_BAD_TLD 6514 1.38 3.01 0.70 103 XM_B_COVIDMETA 6469 1.39 2.99 0.72 104 XM_UB99 6405 0.88 2.96 0.01 105 MIME_QP_LONG_LINE 6243 4.99 2.89 5.87 106 FROM_SUSPICIOUS_NTLD 5822 0.84 2.69 0.07 107 XMDiploma_00 5809 2.36 2.69 2.23 108 TR_Mismatch_TLD_02 5736 0.83 2.65 0.07 109 XM_UB60 5713 0.87 2.64 0.14 110 URI_HEX 5712 1.85 2.64 1.52 111 XMBrknScrpt_02 5668 1.38 2.62 0.86 112 XMStockSpam_06 5654 3.45 2.61 3.80 113 FROM_SUSPICIOUS_NTLD_FP 5642 0.81 2.61 0.06 114 XMSexyCombo_01 5504 1.29 2.55 0.77 115 BAYES_40 5481 4.31 2.53 5.05 116 T_TooManySym_01 5436 3.83 2.51 4.37 117 MIME_HTML_ONLY_MULTI 5396 2.86 2.50 3.01 118 RCVD_IN_PSBL 5146 0.79 2.38 0.14 119 SUBJ_ALL_CAPS 5111 1.67 2.36 1.39 120 DATE_IN_PAST_96_XX 5107 0.70 2.36 0.00 121 FROM_EXCESS_BASE64 5104 3.25 2.36 3.62 122 XM_BadFromFormat 5055 0.86 2.34 0.25 123 FROM_MISSP_REPLYTO 4988 0.68 2.31 0.00 124 XM_B_Unsub2 4911 2.11 2.27 2.04 125 XM_UB999 4657 0.64 2.15 0.01 126 XM_OfRef7 4589 0.71 2.12 0.13 127 XM_CamelCaseFrm001 4529 2.00 2.09 1.97 128 TR_XM_MaxBayes 4456 0.61 2.06 0.01 129 T_XMDrugObfuBody_08 4450 1.80 2.06 1.69 130 XM_B_SpammyWords4 4441 0.98 2.05 0.54 131 TR_XM_SpammyWords3 4414 0.72 2.04 0.18 132 URI_TRY_3LD 4166 1.69 1.93 1.59 133 RCVD_IN_IADB_LISTED 4060 4.57 1.88 5.68 134 BAYES_20 4046 3.17 1.87 3.71 135 XMBdyGiftCard01 3995 1.04 1.85 0.71 136 FILL_THIS_FORM 3892 0.76 1.80 0.33 137 TM2_M_VERY_LONG_WORD 3858 1.49 1.78 1.37 138 XM_UB80 3848 0.55 1.78 0.04 139 T_XMDrugObfuBody_14 3733 1.62 1.73 1.57 140 MONEY_FORM 3732 0.52 1.73 0.02 141 XMGenDplmaNmb 3669 1.47 1.70 1.38 142 XMSubNoVowel 3669 1.19 1.70 0.98 143 RCVD_IN_IADB_SPF 3620 3.97 1.67 4.93 144 XM_URI_RBL 3583 0.59 1.66 0.15 145 T_XMHurry_00 3520 0.92 1.63 0.62 146 TR_Symld_Words 3480 1.45 1.61 1.38 147 TR_XM_COVIDMETA4 3479 0.77 1.61 0.42 148 DATE_IN_PAST_06_12 3452 0.60 1.60 0.18 149 RCVD_IN_IADB_DK 3446 3.47 1.59 4.25 150 RCVD_IN_IADB_SENDERID 3383 3.56 1.56 4.39 151 RELAYCOUNTRY_GB 3361 1.16 1.55 1.00 152 TR_XM_PHPDW 3286 0.73 1.52 0.40 153 GOOGLE_DOC_SUSP 3255 0.50 1.51 0.08 154 TR_XM_PHPForged 3245 0.69 1.50 0.35 155 RELAYCOUNTRY_UA 3236 0.47 1.50 0.04 156 TR_XM_FormFill2 3215 0.69 1.49 0.35 157 XM_H_PHPOS 3204 0.68 1.48 0.34 158 TR_XM_FormFill 3192 0.44 1.48 0.01 159 HTML_MIME_NO_HTML_TAG 3130 1.66 1.45 1.74 160 MAILING_LIST_MULTI 2988 2.42 1.38 2.86 161 TR_MetaPhish_Combo_01 2986 0.87 1.38 0.66 162 URI_NOVOWEL 2980 2.57 1.38 3.07 163 XM_S_ServInvoice 2923 0.42 1.35 0.04 164 NORDNS_LOW_CONTRAST 2903 0.40 1.34 0.01 165 URG_BIZ 2778 0.40 1.28 0.04 166 T_XMDrugObfuBody_00 2714 0.89 1.25 0.73 167 RELAYCOUNTRY_DE 2668 0.64 1.23 0.40 168 TR_XM_BayesRelay 2654 0.37 1.23 0.01 169 HTML_FONT_SIZE_LARGE 2640 0.42 1.22 0.09 170 T_Symld_Words_02 2639 0.91 1.22 0.78 171 XM_ProductURIs 2617 1.26 1.21 1.28 172 HK_SCAM 2580 0.35 1.19 0.00 173 XMHTML_After_End 2551 0.95 1.18 0.86 174 TR_XM_INV_DKIM 2511 0.42 1.16 0.11 175 XMSexyCombo_04 2487 0.44 1.15 0.14 176 RELAYCOUNTRY_IN 2469 0.40 1.14 0.09 177 BAYES_00 2411 10.17 1.11 13.93 178 FORM_FRAUD_5 2404 0.33 1.11 0.00 179 URI_NO_WWW_BIZ_CGI 2381 0.33 1.10 0.02 180 XMPhish08 2374 0.47 1.10 0.20 181 TR_XM_COVIDMETA1 2357 0.51 1.09 0.27 182 XMSubMetaSxObfu_03 2344 0.71 1.08 0.56 183 MONEY_FRAUD_8 2342 0.32 1.08 0.00 184 RDNS_DYNAMIC 2313 0.65 1.07 0.47 185 XM_Combo_Sbj 2302 0.49 1.06 0.25 186 HTTPS_HTTP_MISMATCH 2290 0.93 1.06 0.88 187 HK_RANDOM_REPLYTO 2198 0.41 1.02 0.16 188 DATE_IN_PAST_12_24 2188 0.40 1.01 0.15 189 XM_UB95 2174 0.31 1.01 0.02 190 LongTLD 2166 0.40 1.00 0.15 191 T_FILL_THIS_FORM_LOAN 2139 0.36 0.99 0.10 192 DKIM_ADSP_CUSTOM_MED 2112 1.01 0.98 1.02 193 XMMoneyMeta_00 2060 0.70 0.95 0.60 194 XM_H_Long_From02 2046 1.11 0.95 1.17 195 URI_PHP_REDIR 2037 0.28 0.94 0.00 196 RELAYCOUNTRY_RU 2027 0.33 0.94 0.08 197 XMSubLongNoVowel 1999 0.28 0.92 0.01 198 XMSubMetaI_00 1992 0.58 0.92 0.44 199 ALL_TRUSTED 1973 9.94 0.91 13.68 200 URI_GOOGLE_PROXY 1943 0.31 0.90 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 469059 91.81 96.17 90.00 2 RELAYCOUNTRY_US 430826 80.34 74.71 82.67 3 DKIM_SIGNED 401492 80.06 87.32 77.04 4 XM_DK_Pass 395093 77.82 82.66 75.81 5 DKIM_VALID 385004 76.17 81.70 73.88 6 XM_B_Unicode 373027 71.91 72.73 71.58 7 BAYES_50 298034 51.01 36.11 57.19 8 DCC_CHECK_NEGATIVE 297782 46.19 19.79 57.14 9 DKIM_VALID_AU 287729 57.60 63.37 55.21 10 XMListUnsubscribeExists 269751 57.27 70.56 51.76 11 XM_B_SpammyWords 262564 55.00 66.11 50.38 12 XM_B_Unicode3 221078 41.16 38.11 42.42 13 DCC_CHECK 211570 51.56 77.98 40.60 14 T_TM2_M_HEADER_IN_MSG 163763 27.88 19.35 31.42 15 RCVD_IN_MSPIKE_WL 152443 26.26 19.07 29.25 16 DKIM_VALID_EF 147579 29.85 33.53 28.32 17 HTML_FONT_LOW_CONTRAST 145322 30.30 36.11 27.88 18 RCVD_IN_MSPIKE_H2 145129 28.24 29.19 27.85 19 LOC_TINY_FONT_1 129458 29.15 39.53 24.84 20 FVGT_m_MULTI_ODD 120670 23.82 25.42 23.15 21 XM_B_SpammyWords2 119435 27.04 36.98 22.92 22 XMSubLong 109341 21.31 22.09 20.98 23 MIME_HTML_ONLY 106226 22.57 27.84 20.38 24 T_KAM_HTML_FONT_INVALID 102486 21.18 24.83 19.67 25 RCVD_IN_MSPIKE_H3 85523 14.66 10.43 16.41 26 BAYES_00 72604 10.17 1.11 13.93 27 ALL_TRUSTED 71312 9.94 0.91 13.68 28 XM_Body_Dirty_Words 65566 14.37 18.67 12.58 29 XM_Multi_Part_URI 62275 14.05 19.10 11.95 30 RCVD_IN_MSPIKE_H4 54268 9.64 7.79 10.41 31 XM_B_Unsub 53856 11.12 13.03 10.33 32 TR_XM_DK_Bayes 52954 7.43 0.84 10.16 33 TR_XM_DK_Bayes1 51192 7.18 0.81 9.82 34 XM_DKIMWhitelistDomains 47613 6.46 0.01 9.14 35 LotsOfNums_01 46673 9.68 11.43 8.96 36 XM_Evil_Numbers_Gen 45513 9.00 9.65 8.73 37 TR_XM_DK_Bayes2 44309 6.22 0.71 8.50 38 UNPARSEABLE_RELAY 43504 7.96 7.03 8.35 39 TooManyTo_001 43429 8.70 9.58 8.33 40 LOTS_OF_MONEY 40050 9.74 14.70 7.68 41 XM_SendGrid 38977 6.97 5.75 7.48 42 BAYES_60 38150 7.63 8.38 7.32 43 RCVD_IN_RP_SAFE 38080 6.44 4.34 7.31 44 XM_DK_Undo_02 37302 18.90 47.19 7.16 45 RCVD_IN_RP_CERTIFIED 35165 5.88 3.78 6.75 46 HTML_IMAGE_RATIO_02 33621 6.95 8.16 6.45 47 XM_H_Long_From01 31668 6.67 8.09 6.08 48 TR_XM_UnparsRelay 31260 6.20 6.70 6.00 49 MIME_QP_LONG_LINE 30589 4.99 2.89 5.87 50 IN_ZIMBRA_NJ_WHITELIST 30018 4.08 0.04 5.76 51 RCVD_IN_IADB_LISTED 29625 4.57 1.88 5.68 52 FSL_BULK_SIG 29610 7.14 10.67 5.68 53 XM_B_SpammyWords3 28106 7.46 12.43 5.39 54 TR_XM_SpammyWords4 27691 7.48 12.69 5.31 55 TR_XM_DKIM_Undo 27555 14.29 35.98 5.29 56 HTML_IMAGE_RATIO_04 27396 5.30 5.41 5.26 57 RELAYCOUNTRY_META 26702 10.60 23.79 5.12 58 BAYES_40 26334 4.31 2.53 5.05 59 RCVD_IN_IADB_SPF 25667 3.97 1.67 4.93 60 MPART_ALT_DIFF 25179 6.27 9.72 4.83 61 XM_B_Phish_Phrases 25091 5.41 6.86 4.81 62 TR_XM_DK_SendGrid 24747 4.31 3.24 4.75 63 XMStrtUSub 24500 4.58 4.28 4.70 64 BOTNET_IPINHOSTNAME 23989 6.78 12.02 4.60 65 RCVD_IN_IADB_SENDERID 22859 3.56 1.56 4.39 66 T_TooManySym_01 22773 3.83 2.51 4.37 67 RCVD_IN_IADB_DK 22151 3.47 1.59 4.25 68 HTML_IMAGE_RATIO_06 21450 4.19 4.37 4.12 69 BAYES_80 21150 5.58 9.26 4.06 70 XM_PDF 20726 3.05 0.80 3.98 71 BAYES_99 20660 12.90 34.44 3.96 72 XMStockSpam_06 19819 3.45 2.61 3.80 73 XMSubMetaSx_00 19587 4.79 7.27 3.76 74 XMSexyCombo_05 19574 5.37 9.24 3.76 75 BAYES_20 19347 3.17 1.87 3.71 76 FROM_EXCESS_BASE64 18884 3.25 2.36 3.62 77 RCVD_IN_IADB_VOUCHED 18782 2.77 0.77 3.60 78 T_REMOTE_IMAGE 18715 3.99 4.97 3.59 79 DKIM_INVALID 16488 3.88 5.62 3.16 80 BAYES_999 16222 9.97 26.51 3.11 81 URI_NOVOWEL 16003 2.57 1.38 3.07 82 XM_UncommonTLD01 15982 7.75 19.02 3.07 83 XMNumbers 15717 3.97 6.26 3.02 84 MIME_HTML_ONLY_MULTI 15681 2.86 2.50 3.01 85 MAILING_LIST_MULTI 14885 2.42 1.38 2.86 86 TR_XM_PhishingBody 14828 3.74 5.90 2.85 87 BAYES_95 12789 3.32 5.41 2.45 88 XM_H_Trusted_IP 12658 1.72 0.00 2.43 89 RCVD_IN_MSPIKE_H5 12652 1.96 0.85 2.43 90 HTML_IMAGE_RATIO_08 12117 2.77 3.85 2.33 91 RCVD_IN_IADB_OPTIN 12009 1.78 0.51 2.30 92 BAYES_05 11857 1.86 0.85 2.28 93 TM2_M_URI_OPT_OUT 11799 2.60 3.41 2.26 94 XMDiploma_00 11620 2.36 2.69 2.23 95 MIME_HTML_MOSTLY 11551 3.97 8.19 2.22 96 TR_XM_SB_Phish 11516 2.53 3.30 2.21 97 XMSubPhish11 11315 2.47 3.20 2.17 98 TooManyTo_002 11278 1.77 0.83 2.16 99 XM_B_SpammyTLD 11067 3.40 6.48 2.12 100 T_TooManySym_02 10820 1.63 0.54 2.08 101 XM_SPF_SoftFail 10767 2.75 4.40 2.07 102 XM_B_Unsub2 10639 2.11 2.27 2.04 103 BOTNET 10424 7.12 19.44 2.00 104 XM_CamelCaseFrm001 10246 2.00 2.09 1.97 105 TR_DCC_Bayes_99 10223 9.39 27.28 1.96 106 UNTRUSTED_Relay 10157 6.32 16.86 1.95 107 XM_B_Phish66 9347 2.19 3.15 1.79 108 HTML_MIME_NO_HTML_TAG 9093 1.66 1.45 1.74 109 KHOP_HELO_FCRDNS 8831 2.78 5.41 1.69 110 T_XMDrugObfuBody_08 8810 1.80 2.06 1.69 111 ANY_BOUNCE_MESSAGE 8598 1.27 0.37 1.65 112 BOUNCE_MESSAGE 8596 1.27 0.37 1.65 113 XM_DK_Undo_01 8564 2.45 4.39 1.64 114 HELO_NODOT 8505 1.39 0.81 1.63 115 HELO_NO_DOMAIN 8505 1.39 0.79 1.63 116 URI_TRY_3LD 8309 1.69 1.93 1.59 117 TVD_RCVD_IP 8263 1.22 0.33 1.59 118 TR_XM_SpammyWords5 8257 2.38 4.30 1.58 119 T_XMDrugObfuBody_14 8183 1.62 1.73 1.57 120 URI_HEX 7911 1.85 2.64 1.52 121 IN_HORDE_ADDRESS_BOOK 7855 1.09 0.07 1.51 122 TooManyTo_003 7608 1.24 0.70 1.46 123 SUBJ_ALL_CAPS 7224 1.67 2.36 1.39 124 TR_Symld_Words 7197 1.45 1.61 1.38 125 INVALID_MSGID 7191 1.10 0.44 1.38 126 XMGenDplmaNmb 7181 1.47 1.70 1.38 127 TM2_M_VERY_LONG_WORD 7132 1.49 1.78 1.37 128 RELAYCOUNTRY_CA 7075 2.78 6.21 1.36 129 RCVD_IN_BL_SPAMCOP_NET 6781 3.80 9.83 1.30 130 XM_ProductURIs 6661 1.26 1.21 1.28 131 TO_MALFORMED 6567 0.89 0.01 1.26 132 XMCapTrack 6489 0.99 0.37 1.25 133 MSGID_NOFQDN1 6469 0.90 0.07 1.24 134 XM_H_Long_From02 6121 1.11 0.95 1.17 135 XM_UB50 5862 2.80 6.83 1.12 136 HELO_MISC_IP 5785 0.87 0.29 1.11 137 TR_MSPIKEBAYES00 5676 0.77 0.01 1.09 138 XM_GoogleGroups 5636 0.90 0.47 1.08 139 USER_IN_DEF_DKIM_WL 5585 0.76 0.01 1.07 140 XM_OfRef6 5577 2.41 5.63 1.07 141 TooManyTo_004 5442 0.93 0.64 1.04 142 DKIM_ADSP_CUSTOM_MED 5340 1.01 0.98 1.02 143 XMGappySubj_01 5306 0.77 0.18 1.02 144 RELAYCOUNTRY_GB 5193 1.16 1.55 1.00 145 XMBSHREFv2 5135 0.78 0.27 0.99 146 XMSubNoVowel 5114 1.19 1.70 0.98 147 HTTPS_HTTP_MISMATCH 4574 0.93 1.06 0.88 148 SpammyFromTLD_01 4544 2.53 6.54 0.87 149 TooManyTo_005 4541 0.78 0.57 0.87 150 XMHTML_After_End 4477 0.95 1.18 0.86 151 XMBrknScrpt_02 4475 1.38 2.62 0.86 152 XMBody_17 4425 1.61 3.44 0.85 153 HTML_FONT_FACE_BAD 4321 0.78 0.65 0.83 154 XMNoVowels 4250 0.71 0.47 0.82 155 XMBody_95 4233 0.63 0.20 0.81 156 FROM_GOV_DKIM_AU 4190 0.60 0.10 0.80 157 T_FILL_THIS_FORM_SHORT 4116 1.46 3.07 0.79 158 T_Symld_Words_02 4073 0.91 1.22 0.78 159 XMSexyCombo_01 4007 1.29 2.55 0.77 160 T_XMDrugObfuBody_00 3821 0.89 1.25 0.73 161 XM_B_COVIDMETA 3750 1.39 2.99 0.72 162 XMBdyGiftCard01 3699 1.04 1.85 0.71 163 PDS_OTHER_BAD_TLD 3655 1.38 3.01 0.70 164 NML_ADSP_CUSTOM_MED 3577 0.73 0.82 0.69 165 FORGED_GMAIL_RCVD 3566 1.37 3.02 0.68 166 T_TooManySym_03 3521 0.53 0.17 0.68 167 TR_MetaPhish_Combo_01 3450 0.87 1.38 0.66 168 TR_XM_SpammyWords2 3417 4.12 12.45 0.66 169 XM_SPF_Unknown 3339 0.71 0.89 0.64 170 T_XMHurry_00 3233 0.92 1.63 0.62 171 XMMoneyMeta_00 3127 0.70 0.95 0.60 172 XMSubMetaSxObfu_03 2918 0.71 1.08 0.56 173 XM_B_SpammyWords4 2814 0.98 2.05 0.54 174 XM_H_PHPMailer 2659 0.49 0.46 0.51 175 XM_ShortIntro_01 2649 0.43 0.25 0.51 176 XMHTMLBadTable_001 2597 0.54 0.64 0.50 177 RCVD_IN_SORBS_DUL 2593 0.41 0.20 0.50 178 HTML_IMAGE_ONLY_20 2552 0.43 0.28 0.49 179 T_OBFU_PDF_ATTACH 2522 0.39 0.15 0.48 180 XMLngstWrd_00 2518 0.45 0.35 0.48 181 RDNS_DYNAMIC 2448 0.65 1.07 0.47 182 RELAYCOUNTRY_NL 2410 0.55 0.76 0.46 183 XM_B_COPY_HTML 2393 0.45 0.42 0.46 184 FROM_GOV_SPOOF 2387 0.35 0.09 0.46 185 TM2_M_BODY_EMPTY 2353 0.33 0.04 0.45 186 SHORT_HELO_AND_INLINE_IMAGE 2345 0.35 0.10 0.45 187 XMOemUri 2317 0.42 0.35 0.44 188 XMSubMetaI_00 2312 0.58 0.92 0.44 189 HTML_IMAGE_ONLY_32 2307 0.38 0.22 0.44 190 HTML_TAG_BALANCE_BODY 2306 0.56 0.86 0.44 191 XM_DIRTYINTL 2302 1.20 3.02 0.44 192 PLING_QUERY 2285 0.46 0.51 0.44 193 XMBody_78 2262 0.56 0.88 0.43 194 XMLngstWrd_01 2250 0.40 0.34 0.43 195 XMPhish30 2216 0.53 0.80 0.43 196 TR_BOTNET_NEGATE 2175 0.46 0.55 0.42 197 TR_XM_COVIDMETA4 2168 0.77 1.61 0.42 198 HTML_IMAGE_ONLY_28 2145 0.39 0.35 0.41 199 MISSING_HEADERS 2120 0.45 0.55 0.41 200 RELAYCOUNTRY_DE 2079 0.64 1.23 0.40 ----------------------------------------------------------------------