Email: 770239 Autolearn: 0 AvgScore: 1.90 AvgScanTime: 1.41 sec Spam: 210607 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.62 sec Ham: 559632 Autolearn: 0 AvgScore: -2.46 AvgScanTime: 1.33 sec Time Spent Running SA: 300.81 hours Time Spent Processing Spam: 94.68 hours Time Spent Processing Ham: 206.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202676 92.43 96.23 91.00 2 DKIM_SIGNED 184598 74.12 87.65 69.03 3 XM_DK_Pass 177117 72.29 84.10 67.85 4 DKIM_VALID 174870 70.72 83.03 66.09 5 DCC_CHECK 162074 48.24 76.96 37.43 6 XM_B_Unicode 160899 75.92 76.40 75.74 7 RELAYCOUNTRY_US 160404 82.41 76.16 84.76 8 XM_B_SpammyWords 145091 53.65 68.89 47.92 9 XMListUnsubscribeExists 143594 51.95 68.18 45.84 10 DKIM_VALID_AU 137873 54.64 65.46 50.57 11 XM_DK_Undo_02 96805 17.26 45.96 6.45 12 XM_B_Unicode3 86309 45.58 40.98 47.32 13 TR_XM_DKIM_Undo 84870 14.88 40.30 5.32 14 LOC_TINY_FONT_1 81503 27.19 38.70 22.86 15 BAYES_50 81454 47.24 38.68 50.46 16 XM_B_SpammyWords2 80343 24.02 38.15 18.70 17 HTML_FONT_LOW_CONTRAST 71202 28.00 33.81 25.82 18 BAYES_99 69962 11.82 33.22 3.77 19 RCVD_IN_MSPIKE_H2 67399 27.28 32.00 25.51 20 DKIM_VALID_EF 65048 26.71 30.89 25.13 21 MIME_HTML_ONLY 60094 25.57 28.53 24.45 22 FVGT_m_MULTI_ODD 58095 22.51 27.58 20.60 23 BAYES_999 55818 9.45 26.50 3.03 24 TR_DCC_Bayes_99 54280 8.43 25.77 1.91 25 XMSubLong 53358 21.69 25.34 20.32 26 T_KAM_HTML_FONT_INVALID 53175 19.03 25.25 16.68 27 RELAYCOUNTRY_META 47356 9.45 22.49 4.54 28 T_TM2_M_HEADER_IN_MSG 43940 24.40 20.86 25.73 29 DCC_CHECK_NEGATIVE 43320 49.62 20.57 60.55 30 XM_Body_Dirty_Words 42934 14.74 20.39 12.61 31 XM_Multi_Part_URI 41738 13.31 19.82 10.86 32 RCVD_IN_MSPIKE_WL 41274 24.51 19.60 26.36 33 LOTS_OF_MONEY 34520 9.14 16.39 6.40 34 UNTRUSTED_Relay 31723 5.40 15.06 1.76 35 BOTNET 31700 5.36 15.05 1.71 36 XM_UncommonTLD01 31028 6.10 14.73 2.85 37 XM_B_Unsub 29925 10.39 14.21 8.95 38 TR_XM_SpammyWords4 29094 6.88 13.81 4.27 39 TR_XM_SpammyWords2 25844 3.96 12.27 0.84 40 XM_B_SpammyWords3 25761 6.97 12.23 4.99 41 BOTNET_IPINHOSTNAME 24997 6.33 11.87 4.24 42 LotsOfNums_01 24824 8.93 11.79 7.86 43 XM_Evil_Numbers_Gen 23498 9.19 11.16 8.45 44 RCVD_IN_MSPIKE_H3 23333 13.79 11.08 14.82 45 FSL_BULK_SIG 22824 7.54 10.84 6.30 46 RCVD_IN_BL_SPAMCOP_NET 22420 3.69 10.65 1.07 47 XM_H_Long_From01 20943 6.33 9.94 4.97 48 MPART_ALT_DIFF 20160 9.74 9.57 9.81 49 XMSexyCombo_05 19642 5.46 9.33 4.01 50 BAYES_60 18855 7.17 8.95 6.50 51 HTML_IMAGE_RATIO_02 17288 6.66 8.21 6.07 52 BAYES_80 17229 4.88 8.18 3.64 53 RCVD_IN_MSPIKE_H4 16155 8.85 7.67 9.29 54 XM_B_Phish_Phrases 15147 5.31 7.19 4.60 55 UNPARSEABLE_RELAY 15052 6.98 7.15 6.91 56 MIME_HTML_MOSTLY 15004 3.72 7.12 2.44 57 XM_UB50 14735 2.68 7.00 1.06 58 XM_DK_Undo_01 14675 3.48 6.97 2.16 59 TooManyTo_001 14430 7.76 6.85 8.10 60 TR_XM_UnparsRelay 14421 5.35 6.85 4.78 61 XMSubMetaSx_00 13821 4.03 6.56 3.07 62 RELAYCOUNTRY_CA 13737 2.68 6.52 1.23 63 XM_OfRef6 13560 2.50 6.44 1.01 64 TR_XM_SpammyWords5 12464 2.75 5.92 1.55 65 XM_SendGrid 12232 6.12 5.81 6.23 66 SpammyFromTLD_02 12062 1.76 5.73 0.26 67 TR_XM_PhishingBody 11823 3.69 5.61 2.96 68 FORGED_GMAIL_RCVD 10664 1.79 5.06 0.56 69 SUBJ_ALL_CAPS 10592 2.34 5.03 1.33 70 KHOP_HELO_FCRDNS 10141 2.41 4.82 1.51 71 HTML_IMAGE_RATIO_04 10028 12.48 4.76 15.39 72 DKIM_INVALID 9728 3.40 4.62 2.94 73 XM_B_SpammyTLD 9721 2.99 4.62 2.38 74 XMNumbers 9622 3.33 4.57 2.86 75 SpammyFromTLD_01 9620 1.82 4.57 0.78 76 BAYES_95 9591 2.85 4.55 2.20 77 XMStrtUSub 9579 8.97 4.55 10.63 78 GOOGLE_DOC_SUSP 9517 1.25 4.52 0.02 79 RCVD_IN_MSPIKE_BL 9481 1.35 4.50 0.17 80 TR_XM_MSPIKECOMBO 9393 1.34 4.46 0.16 81 T_REMOTE_IMAGE 9236 3.54 4.39 3.22 82 XM_SPF_SoftFail 8785 2.38 4.17 1.71 83 HTML_IMAGE_RATIO_06 8652 4.39 4.11 4.49 84 RCVD_IN_RP_SAFE 8504 6.45 4.04 7.35 85 HTML_IMAGE_RATIO_08 8448 2.68 4.01 2.18 86 RELAYCOUNTRY_FR 8196 1.28 3.89 0.30 87 TR_XM_SB_Phish 7834 2.65 3.72 2.25 88 XMSubPhish11 7519 2.60 3.57 2.23 89 RCVD_IN_RP_CERTIFIED 7165 5.86 3.40 6.78 90 TR_LOTS_OF_MONEY3 6901 1.21 3.28 0.44 91 RCVD_IN_MSPIKE_L5 6870 0.94 3.26 0.07 92 XMBody_17 6816 1.30 3.24 0.57 93 URIBL_SBL_A 6787 1.05 3.22 0.24 94 XM_B_Phish66 6786 2.15 3.22 1.75 95 XM_DIRTYINTL 6691 1.17 3.18 0.42 96 TR_XM_DK_SendGrid 6611 3.78 3.14 4.02 97 HTML_IMAGE_ONLY_12 6581 0.98 3.12 0.18 98 TM2_M_URI_OPT_OUT 6522 2.53 3.10 2.31 99 MIME_HTML_ONLY_MULTI 6445 6.71 3.06 8.08 100 XM_B_Unsub2 6292 2.14 2.99 1.82 101 T_FILL_THIS_FORM_SHORT 6179 1.32 2.93 0.72 102 MIME_QP_LONG_LINE 6163 4.42 2.93 4.98 103 XMDiploma_00 6135 1.93 2.91 1.55 104 XM_B_COVIDMETA 6108 1.58 2.90 1.09 105 TR_Mismatch_TLD_02 6103 0.85 2.90 0.08 106 URI_HEX 6016 1.99 2.86 1.66 107 BOTNET_NORDNS 5883 0.77 2.79 0.01 108 RCVD_IN_RP_RNBL 5856 0.78 2.78 0.03 109 HTML_SHORT_LINK_IMG_1 5820 0.77 2.76 0.02 110 BODY_URI_ONLY 5807 0.79 2.76 0.05 111 XM_BadFromFormat 5528 0.90 2.62 0.25 112 XM_UB60 5323 0.81 2.53 0.16 113 URI_TRY_3LD 5279 1.46 2.51 1.07 114 TR_Sbj_FN_Bdy 5157 0.80 2.45 0.18 115 XM_B_SpammyWords4 5101 0.97 2.42 0.42 116 BAYES_40 5088 4.41 2.42 5.16 117 XMBrknScrpt_02 5003 1.21 2.38 0.77 118 XM_CamelCaseFrm001 4678 1.91 2.22 1.79 119 FROM_MISSP_REPLYTO 4621 0.60 2.19 0.00 120 FROM_EXCESS_BASE64 4607 2.74 2.19 2.94 121 T_TooManySym_01 4596 3.50 2.18 4.00 122 T_XMDrugObfuBody_08 4554 1.61 2.16 1.40 123 HTML_FONT_SIZE_LARGE 4547 0.68 2.16 0.13 124 XM_UB99 4532 0.59 2.15 0.00 125 RCVD_IN_PSBL 4452 0.63 2.11 0.08 126 RCVD_IN_IADB_LISTED 4162 3.94 1.98 4.69 127 LOADSA_MONEY_COMBO 4047 0.56 1.92 0.05 128 XMBdyGiftCard01 4034 1.49 1.92 1.33 129 FILL_THIS_FORM 4005 0.70 1.90 0.24 130 XMGenDplmaNmb 3970 1.25 1.89 1.01 131 TR_XM_MaxBayes 3966 0.52 1.88 0.01 132 TR_XM_SpammyWords3 3958 0.59 1.88 0.10 133 TM2_M_VERY_LONG_WORD 3945 1.32 1.87 1.11 134 T_XMDrugObfuBody_14 3900 1.54 1.85 1.43 135 XMSexyCombo_01 3881 0.80 1.84 0.41 136 TR_XM_COVIDMETA4 3861 0.88 1.83 0.51 137 RCVD_IN_IADB_SPF 3740 3.44 1.78 4.07 138 T_FILL_THIS_FORM_LONG 3716 0.56 1.76 0.11 139 XFER_LOTSA_MONEY 3690 0.51 1.75 0.04 140 XM_URI_RBL 3576 0.59 1.70 0.17 141 RCVD_IN_IADB_DK 3564 3.01 1.69 3.51 142 HTML_MIME_NO_HTML_TAG 3551 1.73 1.69 1.75 143 BAYES_20 3513 4.09 1.67 5.00 144 RCVD_IN_IADB_SENDERID 3479 3.10 1.65 3.64 145 XMStockSpam_06 3427 1.19 1.63 1.03 146 XM_UB80 3372 0.47 1.60 0.04 147 DATE_IN_PAST_06_12 3355 0.56 1.59 0.17 148 TR_XM_COVIDMETA1 3331 0.75 1.58 0.44 149 TR_Symld_Words 3327 1.37 1.58 1.29 150 XM_UB999 3327 0.43 1.58 0.00 151 URI_NOVOWEL 3274 2.36 1.55 2.67 152 RELAYCOUNTRY_UA 3273 0.45 1.55 0.04 153 HK_RANDOM_REPLYTO 3144 0.54 1.49 0.18 154 T_XMDrugObfuBody_00 3069 0.99 1.46 0.82 155 BAYES_00 3048 14.70 1.45 19.68 156 XM_OfRef7 3047 0.46 1.45 0.08 157 TR_Caps_n_Bayes_99 3024 0.41 1.44 0.02 158 MAILING_LIST_MULTI 2974 2.19 1.41 2.49 159 PDS_OTHER_BAD_TLD 2946 0.86 1.40 0.66 160 XM_H_Long_From02 2922 1.24 1.39 1.19 161 RELAYCOUNTRY_GB 2871 1.13 1.36 1.05 162 XMSubNoVowel 2850 3.85 1.35 4.79 163 TR_MetaPhish_Combo_01 2830 0.83 1.34 0.63 164 XM_ProductURIs 2788 1.25 1.32 1.23 165 TR_XM_PHPDW 2677 0.55 1.27 0.28 166 XMHTML_After_End 2675 0.89 1.27 0.75 167 TR_XM_PHPForged 2606 0.51 1.24 0.23 168 HTTPS_HTTP_MISMATCH 2598 0.86 1.23 0.72 169 TR_XM_FormFill2 2578 0.51 1.22 0.24 170 MONEY_FRAUD_5 2577 0.34 1.22 0.00 171 XM_H_PHPOS 2570 0.50 1.22 0.23 172 XMSubMetaI_00 2566 0.72 1.22 0.53 173 FROM_SUSPICIOUS_NTLD 2546 0.40 1.21 0.09 174 T_Symld_Words_02 2538 0.71 1.21 0.52 175 MONEY_FORM 2525 0.33 1.20 0.01 176 ADVANCE_FEE_4_NEW_MONEY 2521 0.33 1.20 0.00 177 TR_XM_DK_Bayes 2442 7.25 1.16 9.55 178 RELAYCOUNTRY_IN 2437 0.39 1.16 0.10 179 TR_XM_FormFill 2397 0.32 1.14 0.01 180 T_XMHurry_00 2382 0.65 1.13 0.47 181 TR_XM_DK_Bayes1 2377 7.04 1.13 9.27 182 TR_XM_BayesRelay 2372 0.31 1.13 0.01 183 FROM_SUSPICIOUS_NTLD_FP 2364 0.37 1.12 0.09 184 URI_PHP_REDIR 2320 0.30 1.10 0.00 185 TR_XM_DK_Bayes2 2224 6.20 1.06 8.13 186 DKIM_ADSP_CUSTOM_MED 2213 0.93 1.05 0.88 187 ALL_TRUSTED 2207 9.06 1.05 12.07 188 XM_S_ServInvoice 2204 0.29 1.05 0.01 189 URI_NO_WWW_INFO_CGI 2192 0.31 1.04 0.03 190 TR_XM_INV_DKIM 2176 0.33 1.03 0.07 191 TR_XM_RelayPhish 2097 0.33 1.00 0.08 192 XMClaimOffer 2072 0.35 0.98 0.10 193 T_FILL_THIS_FORM_LOAN 2040 0.35 0.97 0.12 194 XMPhish30 1971 0.54 0.94 0.39 195 FORM_FRAUD_5 1912 0.29 0.91 0.06 196 XM_RXBody 1907 0.38 0.91 0.18 197 RDNS_DYNAMIC 1902 0.72 0.90 0.66 198 RELAYCOUNTRY_DE 1889 0.62 0.90 0.52 199 T_MONEY_PERCENT 1857 0.35 0.88 0.15 200 TR_LOTS_OF_MONEY2 1857 0.35 0.88 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 509245 92.43 96.23 91.00 2 RELAYCOUNTRY_US 474355 82.41 76.16 84.76 3 XM_B_Unicode 423877 75.92 76.40 75.74 4 DKIM_SIGNED 386308 74.12 87.65 69.03 5 XM_DK_Pass 379704 72.29 84.10 67.85 6 DKIM_VALID 369872 70.72 83.03 66.09 7 DCC_CHECK_NEGATIVE 338868 49.62 20.57 60.55 8 DKIM_VALID_AU 282989 54.64 65.46 50.57 9 BAYES_50 282412 47.24 38.68 50.46 10 XM_B_SpammyWords 268152 53.65 68.89 47.92 11 XM_B_Unicode3 264802 45.58 40.98 47.32 12 XMListUnsubscribeExists 256515 51.95 68.18 45.84 13 DCC_CHECK 209465 48.24 76.96 37.43 14 RCVD_IN_MSPIKE_WL 147542 24.51 19.60 26.36 15 HTML_FONT_LOW_CONTRAST 144478 28.00 33.81 25.82 16 T_TM2_M_HEADER_IN_MSG 143985 24.40 20.86 25.73 17 RCVD_IN_MSPIKE_H2 142747 27.28 32.00 25.51 18 DKIM_VALID_EF 140650 26.71 30.89 25.13 19 MIME_HTML_ONLY 136844 25.57 28.53 24.45 20 LOC_TINY_FONT_1 127957 27.19 38.70 22.86 21 FVGT_m_MULTI_ODD 115295 22.51 27.58 20.60 22 XMSubLong 113707 21.69 25.34 20.32 23 BAYES_00 110156 14.70 1.45 19.68 24 XM_B_SpammyWords2 104666 24.02 38.15 18.70 25 T_KAM_HTML_FONT_INVALID 93372 19.03 25.25 16.68 26 HTML_IMAGE_RATIO_04 86102 12.48 4.76 15.39 27 RCVD_IN_MSPIKE_H3 82918 13.79 11.08 14.82 28 XM_H_Trusted_IP 71326 9.26 0.00 12.75 29 HTML_FONT_FACE_BAD 71067 9.46 0.85 12.70 30 XM_Body_Dirty_Words 70565 14.74 20.39 12.61 31 ALL_TRUSTED 67551 9.06 1.05 12.07 32 XM_Multi_Part_URI 60795 13.31 19.82 10.86 33 XMStrtUSub 59493 8.97 4.55 10.63 34 MPART_ALT_DIFF 54891 9.74 9.57 9.81 35 TR_XM_DK_Bayes 53421 7.25 1.16 9.55 36 RCVD_IN_MSPIKE_H4 52000 8.85 7.67 9.29 37 TR_XM_DK_Bayes1 51877 7.04 1.13 9.27 38 XM_B_Unsub 50095 10.39 14.21 8.95 39 XM_Evil_Numbers_Gen 47310 9.19 11.16 8.45 40 TR_XM_DK_Bayes2 45523 6.20 1.06 8.13 41 TooManyTo_001 45305 7.76 6.85 8.10 42 MIME_HTML_ONLY_MULTI 45221 6.71 3.06 8.08 43 LotsOfNums_01 43994 8.93 11.79 7.86 44 XM_DKIMWhitelistDomains 43765 5.69 0.04 7.82 45 RCVD_IN_RP_SAFE 41139 6.45 4.04 7.35 46 UNPARSEABLE_RELAY 38686 6.98 7.15 6.91 47 RCVD_IN_RP_CERTIFIED 37948 5.86 3.40 6.78 48 BAYES_60 36397 7.17 8.95 6.50 49 XM_DK_Undo_02 36106 17.26 45.96 6.45 50 LOTS_OF_MONEY 35843 9.14 16.39 6.40 51 FSL_BULK_SIG 35267 7.54 10.84 6.30 52 XM_SendGrid 34879 6.12 5.81 6.23 53 HTML_IMAGE_RATIO_02 33997 6.66 8.21 6.07 54 TR_XM_DKIM_Undo 29775 14.88 40.30 5.32 55 IN_ZIMBRA_NJ_WHITELIST 29638 3.86 0.04 5.30 56 BAYES_40 28872 4.41 2.42 5.16 57 BAYES_20 27954 4.09 1.67 5.00 58 XM_B_SpammyWords3 27915 6.97 12.23 4.99 59 MIME_QP_LONG_LINE 27891 4.42 2.93 4.98 60 XM_H_Long_From01 27817 6.33 9.94 4.97 61 XMSubNoVowel 26800 3.85 1.35 4.79 62 TR_XM_UnparsRelay 26764 5.35 6.85 4.78 63 RCVD_IN_IADB_LISTED 26219 3.94 1.98 4.69 64 XM_B_Phish_Phrases 25741 5.31 7.19 4.60 65 RELAYCOUNTRY_META 25431 9.45 22.49 4.54 66 HTML_IMAGE_RATIO_06 25139 4.39 4.11 4.49 67 TR_XM_SpammyWords4 23906 6.88 13.81 4.27 68 BOTNET_IPINHOSTNAME 23747 6.33 11.87 4.24 69 RCVD_IN_IADB_SPF 22756 3.44 1.78 4.07 70 TR_XM_DK_SendGrid 22472 3.78 3.14 4.02 71 XMSexyCombo_05 22419 5.46 9.33 4.01 72 T_TooManySym_01 22395 3.50 2.18 4.00 73 BAYES_99 21073 11.82 33.22 3.77 74 BAYES_80 20368 4.88 8.18 3.64 75 RCVD_IN_IADB_SENDERID 20362 3.10 1.65 3.64 76 XM_PDF 20339 2.85 0.77 3.63 77 BAYES_05 20035 2.84 0.88 3.58 78 RCVD_IN_IADB_DK 19642 3.01 1.69 3.51 79 T_REMOTE_IMAGE 18046 3.54 4.39 3.22 80 XMSubMetaSx_00 17189 4.03 6.56 3.07 81 BAYES_999 16980 9.45 26.50 3.03 82 TR_XM_PhishingBody 16586 3.69 5.61 2.96 83 FROM_EXCESS_BASE64 16462 2.74 2.19 2.94 84 DKIM_INVALID 16436 3.40 4.62 2.94 85 RCVD_IN_IADB_VOUCHED 16180 2.31 0.75 2.89 86 XMNumbers 15996 3.33 4.57 2.86 87 XM_UncommonTLD01 15946 6.10 14.73 2.85 88 URI_NOVOWEL 14942 2.36 1.55 2.67 89 TooManyTo_002 14714 2.09 0.65 2.63 90 MAILING_LIST_MULTI 13923 2.19 1.41 2.49 91 MIME_HTML_MOSTLY 13678 3.72 7.12 2.44 92 XM_B_SpammyTLD 13313 2.99 4.62 2.38 93 TM2_M_URI_OPT_OUT 12931 2.53 3.10 2.31 94 RCVD_IN_MSPIKE_H5 12624 1.87 0.85 2.26 95 TR_XM_SB_Phish 12573 2.65 3.72 2.25 96 XMSubPhish11 12475 2.60 3.57 2.23 97 BAYES_95 12333 2.85 4.55 2.20 98 HTML_IMAGE_RATIO_08 12211 2.68 4.01 2.18 99 XM_DK_Undo_01 12111 3.48 6.97 2.16 100 ANY_BOUNCE_MESSAGE 11930 1.67 0.43 2.13 101 BOUNCE_MESSAGE 11928 1.67 0.43 2.13 102 T_TooManySym_02 11271 1.61 0.54 2.01 103 TooManyTo_003 11092 1.58 0.53 1.98 104 TR_DCC_Bayes_99 10683 8.43 25.77 1.91 105 RCVD_IN_IADB_OPTIN 10414 1.49 0.51 1.86 106 XM_B_Unsub2 10179 2.14 2.99 1.82 107 XM_CamelCaseFrm001 10019 1.91 2.22 1.79 108 UNTRUSTED_Relay 9871 5.40 15.06 1.76 109 HTML_MIME_NO_HTML_TAG 9769 1.73 1.69 1.75 110 XM_B_Phish66 9769 2.15 3.22 1.75 111 BOTNET 9593 5.36 15.05 1.71 112 XM_SPF_SoftFail 9552 2.38 4.17 1.71 113 TVD_RCVD_IP 9466 1.30 0.26 1.69 114 URI_HEX 9310 1.99 2.86 1.66 115 TooManyTo_004 9112 1.31 0.47 1.63 116 HELO_NODOT 9030 1.36 0.69 1.61 117 HELO_NO_DOMAIN 9030 1.35 0.67 1.61 118 XMDiploma_00 8696 1.93 2.91 1.55 119 TR_XM_SpammyWords5 8696 2.75 5.92 1.55 120 KHOP_HELO_FCRDNS 8440 2.41 4.82 1.51 121 TooManyTo_005 8240 1.18 0.42 1.47 122 T_XMDrugObfuBody_14 7992 1.54 1.85 1.43 123 XMSubGarbage 7959 1.10 0.24 1.42 124 XMSubLongNoVowel 7921 1.17 0.53 1.42 125 T_XMDrugObfuBody_08 7828 1.61 2.16 1.40 126 IN_HORDE_ADDRESS_BOOK 7736 1.02 0.06 1.38 127 XMBdyGiftCard01 7463 1.49 1.92 1.33 128 SUBJ_ALL_CAPS 7421 2.34 5.03 1.33 129 INVALID_MSGID 7270 1.07 0.48 1.30 130 TR_Symld_Words 7247 1.37 1.58 1.29 131 RELAYCOUNTRY_CA 6878 2.68 6.52 1.23 132 XM_ProductURIs 6867 1.25 1.32 1.23 133 HELO_MISC_IP 6859 0.96 0.24 1.23 134 XM_H_Long_From02 6642 1.24 1.39 1.19 135 MSGID_NOFQDN1 6566 0.88 0.10 1.17 136 TO_MALFORMED 6554 0.85 0.01 1.17 137 XMCapTrack 6473 0.94 0.36 1.16 138 TM2_M_VERY_LONG_WORD 6204 1.32 1.87 1.11 139 TR_MSPIKEBAYES00 6167 0.81 0.02 1.10 140 XM_B_COVIDMETA 6091 1.58 2.90 1.09 141 URI_TRY_3LD 6005 1.46 2.51 1.07 142 RCVD_IN_BL_SPAMCOP_NET 5997 3.69 10.65 1.07 143 XM_UB50 5909 2.68 7.00 1.06 144 XMBSHREFv2 5899 0.86 0.35 1.05 145 USER_IN_DEF_DKIM_WL 5882 0.77 0.01 1.05 146 RELAYCOUNTRY_GB 5849 1.13 1.36 1.05 147 XMStockSpam_06 5749 1.19 1.63 1.03 148 XM_GoogleGroups 5705 0.87 0.48 1.02 149 XM_OfRef6 5674 2.50 6.44 1.01 150 XMGenDplmaNmb 5664 1.25 1.89 1.01 151 XM_E_Blogspot 5132 0.69 0.07 0.92 152 XMSubEmpty 4978 0.71 0.22 0.89 153 DKIM_ADSP_CUSTOM_MED 4922 0.93 1.05 0.88 154 XMGappySubj_01 4709 0.65 0.13 0.84 155 TR_XM_SpammyWords2 4673 3.96 12.27 0.84 156 T_XMDrugObfuBody_00 4576 0.99 1.46 0.82 157 SpammyFromTLD_01 4379 1.82 4.57 0.78 158 XMBrknScrpt_02 4298 1.21 2.38 0.77 159 XMBody_95 4292 0.61 0.18 0.77 160 XMHTML_After_End 4189 0.89 1.27 0.75 161 HTTPS_HTTP_MISMATCH 4044 0.86 1.23 0.72 162 T_FILL_THIS_FORM_SHORT 4024 1.32 2.93 0.72 163 RDNS_DYNAMIC 3673 0.72 0.90 0.66 164 PDS_OTHER_BAD_TLD 3673 0.86 1.40 0.66 165 TR_MetaPhish_Combo_01 3528 0.83 1.34 0.63 166 NML_ADSP_CUSTOM_MED 3471 0.69 0.87 0.62 167 XMMoneyMeta_00 3303 0.66 0.85 0.59 168 XMBody_17 3191 1.30 3.24 0.57 169 FROM_GOV_DKIM_AU 3185 0.52 0.38 0.57 170 FORGED_GMAIL_RCVD 3120 1.79 5.06 0.56 171 T_TooManySym_03 2975 0.42 0.11 0.53 172 PDS_SHORT_SPOOFED_URL 2975 0.41 0.08 0.53 173 XMSubMetaI_00 2967 0.72 1.22 0.53 174 T_Symld_Words_02 2937 0.71 1.21 0.52 175 XM_H_PHPMailer 2906 0.51 0.49 0.52 176 RELAYCOUNTRY_DE 2901 0.62 0.90 0.52 177 NUMERIC_HTTP_ADDR 2897 0.59 0.77 0.52 178 XM_SPF_Unknown 2890 0.55 0.63 0.52 179 TR_XM_COVIDMETA4 2881 0.88 1.83 0.51 180 XM_Body_Obfu01 2880 0.52 0.54 0.51 181 XMSolicitRefs_0 2827 0.45 0.31 0.51 182 RCVD_IN_SORBS_DUL 2756 0.43 0.25 0.49 183 XMNoVowels 2737 0.48 0.46 0.49 184 XM_ShortIntro_01 2698 0.46 0.38 0.48 185 T_OBFU_PDF_ATTACH 2672 0.39 0.15 0.48 186 MSGID_FROM_MTA_HEADER 2654 0.40 0.21 0.47 187 T_XMHurry_00 2615 0.65 1.13 0.47 188 SHORT_HELO_AND_INLINE_IMAGE 2607 0.35 0.06 0.47 189 TR_XM_COVIDMETA1 2471 0.75 1.58 0.44 190 XMHTMLBadTable_001 2463 0.49 0.61 0.44 191 TR_LOTS_OF_MONEY3 2436 1.21 3.28 0.44 192 XMLngstWrd_00 2423 0.43 0.43 0.43 193 XMPhish14 2396 0.49 0.65 0.43 194 XM_DIRTYINTL 2343 1.17 3.18 0.42 195 XM_B_SpammyWords4 2339 0.97 2.42 0.42 196 XM_B_REG_HTML 2331 0.43 0.46 0.42 197 XMSexyCombo_01 2293 0.80 1.84 0.41 198 TM2_M_BODY_EMPTY 2287 0.31 0.05 0.41 199 MISSING_HEADERS 2264 0.42 0.47 0.40 200 TR_BOTNET_NEGATE 2257 0.52 0.81 0.40 ----------------------------------------------------------------------