Email: 721953 Autolearn: 0 AvgScore: 3.71 AvgScanTime: 1.42 sec Spam: 214870 Autolearn: 0 AvgScore: 13.79 AvgScanTime: 1.60 sec Ham: 507083 Autolearn: 0 AvgScore: -0.56 AvgScanTime: 1.34 sec Time Spent Running SA: 284.87 hours Time Spent Processing Spam: 95.46 hours Time Spent Processing Ham: 189.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204190 91.48 95.03 89.97 2 DKIM_SIGNED 183948 80.57 85.61 78.43 3 XM_DK_Pass 178679 78.97 83.16 77.19 4 DKIM_VALID 175626 77.13 81.74 75.18 5 DCC_CHECK 167073 52.41 77.76 41.68 6 RELAYCOUNTRY_US 165679 81.97 77.11 84.03 7 XM_B_Unicode 165411 73.61 76.98 72.18 8 XMListUnsubscribeExists 152909 58.45 71.16 53.06 9 XM_B_SpammyWords 149650 55.02 69.65 48.82 10 DKIM_VALID_AU 135375 58.81 63.00 57.03 11 XM_DK_Undo_02 96031 18.87 44.69 7.92 12 XM_B_SpammyWords2 88169 26.58 41.03 20.45 13 XM_B_Unicode3 87582 41.65 40.76 42.02 14 BAYES_50 85397 50.77 39.74 55.44 15 TR_XM_DKIM_Undo 82766 15.53 38.52 5.79 16 LOC_TINY_FONT_1 82439 28.76 38.37 24.68 17 HTML_FONT_LOW_CONTRAST 76643 30.83 35.67 28.77 18 BAYES_99 69216 12.80 32.21 4.57 19 RCVD_IN_MSPIKE_H2 67238 28.87 31.29 27.85 20 MIME_HTML_ONLY 63147 24.02 29.39 21.74 21 DKIM_VALID_EF 62153 28.65 28.93 28.53 22 FVGT_m_MULTI_ODD 61279 24.66 28.52 23.02 23 XMSubLong 54976 22.57 25.59 21.29 24 TR_DCC_Bayes_99 54863 9.30 25.53 2.42 25 BAYES_999 54650 10.16 25.43 3.69 26 T_KAM_HTML_FONT_INVALID 54576 20.87 25.40 18.95 27 T_TM2_M_HEADER_IN_MSG 45183 26.58 21.03 28.93 28 XM_Body_Dirty_Words 44910 14.96 20.90 12.44 29 RELAYCOUNTRY_META 44611 9.83 20.76 5.20 30 DCC_CHECK_NEGATIVE 43429 45.41 20.21 56.09 31 RCVD_IN_MSPIKE_WL 42800 27.32 19.92 30.45 32 XM_Multi_Part_URI 41158 13.99 19.15 11.81 33 BOTNET 36638 6.70 17.05 2.31 34 UNTRUSTED_Relay 32719 5.95 15.23 2.01 35 XM_B_SpammyWords3 30408 7.94 14.15 5.30 36 LOTS_OF_MONEY 29070 8.56 13.53 6.46 37 BOTNET_IPINHOSTNAME 28370 7.46 13.20 5.03 38 TR_XM_SpammyWords2 27994 4.45 13.03 0.81 39 XM_B_Unsub 27001 10.73 12.57 9.95 40 RCVD_IN_MSPIKE_H3 25490 14.86 11.86 16.13 41 LotsOfNums_01 25277 9.99 11.76 9.24 42 XM_UncommonTLD01 24534 5.55 11.42 3.06 43 TR_XM_SpammyWords4 24190 6.38 11.26 4.31 44 FSL_BULK_SIG 23498 6.89 10.94 5.18 45 XMSexyCombo_05 23265 6.27 10.83 4.34 46 HTML_IMAGE_RATIO_02 22826 8.45 10.62 7.53 47 XM_Evil_Numbers_Gen 21630 9.91 10.07 9.84 48 RCVD_IN_BL_SPAMCOP_NET 21154 3.75 9.85 1.17 49 MPART_ALT_DIFF 19295 6.13 8.98 4.92 50 BAYES_80 17372 5.26 8.08 4.06 51 BAYES_60 17337 7.62 8.07 7.43 52 XM_B_Phish_Phrases 17089 5.94 7.95 5.09 53 UNPARSEABLE_RELAY 16580 8.02 7.72 8.14 54 TR_XM_UnparsRelay 15941 6.25 7.42 5.75 55 RCVD_IN_MSPIKE_H4 15690 10.04 7.30 11.20 56 XMSubMetaSx_00 15621 4.46 7.27 3.27 57 XM_H_Long_From01 15435 6.20 7.18 5.78 58 MIME_HTML_MOSTLY 15020 3.79 6.99 2.43 59 TR_XM_PhishingBody 14386 4.00 6.70 2.86 60 XM_UB50 13791 2.73 6.42 1.16 61 XM_SendGrid 13629 7.08 6.34 7.39 62 RCVD_IN_MSPIKE_BL 13067 2.00 6.08 0.26 63 TR_XM_MSPIKECOMBO 12820 1.96 5.97 0.26 64 TooManyTo_001 12535 7.64 5.83 8.40 65 RELAYCOUNTRY_CA 12474 2.71 5.81 1.39 66 HTML_IMAGE_RATIO_04 11986 4.64 5.58 4.24 67 XM_OfRef6 10806 2.17 5.03 0.95 68 SpammyFromTLD_02 10692 1.63 4.98 0.21 69 T_REMOTE_IMAGE 10299 4.05 4.79 3.74 70 XM_DK_Undo_01 10125 2.44 4.71 1.48 71 BAYES_95 9883 3.07 4.60 2.42 72 XMStrtUSub 9858 4.91 4.59 5.04 73 RCVD_IN_RP_SAFE 9632 6.97 4.48 8.02 74 RCVD_IN_PSBL 9548 1.40 4.44 0.12 75 HTML_IMAGE_RATIO_08 9538 2.79 4.44 2.09 76 XMNumbers 9391 3.33 4.37 2.89 77 HTML_IMAGE_RATIO_06 9342 4.31 4.35 4.29 78 RCVD_IN_RP_RNBL 8887 1.27 4.14 0.05 79 SpammyFromTLD_01 8689 1.73 4.04 0.75 80 TR_XM_SpammyWords5 8440 2.26 3.93 1.55 81 TM2_M_URI_OPT_OUT 8353 2.81 3.89 2.36 82 DKIM_INVALID 8322 3.44 3.87 3.25 83 RCVD_IN_MSPIKE_L5 8222 1.19 3.83 0.08 84 XM_SPF_SoftFail 8116 2.41 3.78 1.83 85 RCVD_IN_RP_CERTIFIED 7907 6.30 3.68 7.41 86 XM_B_Phish66 7750 2.39 3.61 1.87 87 TR_XM_DK_SendGrid 7493 4.28 3.49 4.62 88 XM_B_SpammyTLD 7223 2.42 3.36 2.03 89 MIME_QP_LONG_LINE 6942 5.10 3.23 5.90 90 KHOP_HELO_FCRDNS 6851 2.17 3.19 1.74 91 URI_HEX 6802 1.97 3.17 1.46 92 RELAYCOUNTRY_FR 6618 1.10 3.08 0.27 93 XM_B_COVIDMETA 6554 1.65 3.05 1.05 94 TR_LOTS_OF_MONEY3 6350 1.18 2.96 0.42 95 XM_DIRTYINTL 6244 1.15 2.91 0.41 96 XMDiploma_00 6230 2.12 2.90 1.79 97 T_FILL_THIS_FORM_SHORT 6209 1.48 2.89 0.89 98 BOTNET_NORDNS 6119 0.86 2.85 0.01 99 XM_CamelCaseFrm001 6078 2.19 2.83 1.92 100 BAYES_40 6010 4.50 2.80 5.22 101 MIME_HTML_ONLY_MULTI 5879 2.93 2.74 3.01 102 GOOGLE_DOC_SUSP 5853 0.84 2.72 0.04 103 XMBdyGiftCard01 5744 1.30 2.67 0.72 104 XM_B_SpammyWords4 5651 1.24 2.63 0.65 105 URIBL_SBL_A 5615 0.91 2.61 0.19 106 XMBody_17 5608 1.23 2.61 0.64 107 FORGED_GMAIL_RCVD 5537 1.26 2.58 0.71 108 XMBrknScrpt_02 5427 1.31 2.53 0.79 109 XM_B_Unsub2 5357 2.01 2.49 1.81 110 FROM_EXCESS_BASE64 5235 3.11 2.44 3.40 111 XM_UB99 5156 0.72 2.40 0.00 112 T_XMHurry_00 5135 1.39 2.39 0.97 113 HTML_MIME_NO_HTML_TAG 5069 2.27 2.36 2.23 114 T_TooManySym_01 5037 4.21 2.34 5.00 115 XM_BadFromFormat 5032 0.84 2.34 0.21 116 XM_URI_RBL 4983 0.80 2.32 0.16 117 TR_XM_SB_Phish 4876 2.11 2.27 2.05 118 XM_UB60 4805 0.76 2.24 0.13 119 XMStockSpam_06 4738 1.60 2.21 1.34 120 TM2_M_VERY_LONG_WORD 4707 1.55 2.19 1.27 121 T_XMDrugObfuBody_08 4702 1.58 2.19 1.32 122 TR_Mismatch_TLD_02 4673 0.69 2.17 0.07 123 BAYES_20 4666 3.35 2.17 3.85 124 XMSubPhish11 4637 2.06 2.16 2.01 125 SUBJ_ALL_CAPS 4636 1.87 2.16 1.74 126 XMSexyCombo_01 4288 0.90 2.00 0.43 127 TR_XM_SpammyWords3 4218 0.70 1.96 0.16 128 BODY_URI_ONLY 4186 0.60 1.95 0.02 129 HTML_IMAGE_ONLY_16 4164 0.77 1.94 0.27 130 T_XMDrugObfuBody_00 4082 1.34 1.90 1.10 131 RCVD_IN_IADB_LISTED 3978 4.61 1.85 5.78 132 FROM_SUSPICIOUS_NTLD 3972 0.62 1.85 0.09 133 T_XMDrugObfuBody_14 3924 1.67 1.83 1.60 134 TR_XM_COVIDMETA1 3923 0.77 1.83 0.32 135 XMGenDplmaNmb 3878 1.20 1.80 0.95 136 PDS_OTHER_BAD_TLD 3865 1.00 1.80 0.67 137 FROM_SUSPICIOUS_NTLD_FP 3828 0.59 1.78 0.08 138 FROM_MISSP_REPLYTO 3778 0.53 1.76 0.00 139 XM_OfRef7 3778 0.60 1.76 0.11 140 XMHTML_After_End 3674 1.14 1.71 0.89 141 TR_XM_MaxBayes 3614 0.51 1.68 0.01 142 XM_UB999 3582 0.50 1.67 0.00 143 RCVD_IN_IADB_SPF 3513 4.02 1.63 5.03 144 URI_TRY_3LD 3451 1.48 1.61 1.43 145 RCVD_IN_IADB_DK 3337 3.50 1.55 4.33 146 RCVD_IN_IADB_SENDERID 3323 3.61 1.55 4.48 147 URI_NOVOWEL 3306 2.69 1.54 3.18 148 MAILING_LIST_MULTI 3290 2.47 1.53 2.86 149 HTML_SHORT_LINK_IMG_1 3216 0.46 1.50 0.01 150 XM_UB80 3209 0.48 1.49 0.06 151 URIBL_BLACK 3152 0.47 1.47 0.04 152 HTML_IMAGE_ONLY_12 3118 0.58 1.45 0.21 153 RCVD_IN_MSPIKE_L4 3088 0.46 1.44 0.04 154 TR_XM_COVIDMETA4 3065 0.75 1.43 0.46 155 XMSubMetaI_00 3034 0.91 1.41 0.69 156 MONEY_FRAUD_5 2981 0.41 1.39 0.00 157 URI_PHP_REDIR 2958 0.41 1.38 0.01 158 TR_XM_FormFill 2956 0.47 1.38 0.09 159 HOSTED_IMG_DIRECT_MX 2939 0.41 1.37 0.00 160 XM_Body_Dirty_Words_01 2930 0.71 1.36 0.43 161 XMPhish08 2894 0.49 1.35 0.13 162 DATE_IN_PAST_03_06 2887 0.48 1.34 0.11 163 BAYES_00 2880 10.66 1.34 14.61 164 FORM_FRAUD_5 2859 0.40 1.33 0.00 165 T_Symld_Words_02 2789 0.77 1.30 0.55 166 URG_BIZ 2789 0.43 1.30 0.06 167 TR_Symld_Words 2758 1.35 1.28 1.37 168 FILL_THIS_FORM 2758 0.53 1.28 0.22 169 RELAYCOUNTRY_IN 2742 0.47 1.28 0.12 170 PDS_FROM_2_EMAILS 2713 0.39 1.26 0.03 171 FROM_2_EMAILS_SHORT 2692 0.38 1.25 0.01 172 DKIM_ADSP_NXDOMAIN 2645 0.53 1.23 0.23 173 NAME_EMAIL_DIFF 2581 0.43 1.20 0.11 174 PDS_TO_EQ_FROM_NAME 2579 0.36 1.20 0.01 175 XMSubMetaSxObfu_03 2502 0.79 1.16 0.63 176 NUMERIC_HTTP_ADDR 2474 0.56 1.15 0.31 177 ALL_TRUSTED 2472 8.98 1.15 12.29 178 URI_WP_HACKED 2442 0.34 1.14 0.01 179 RDNS_DYNAMIC 2438 0.71 1.13 0.54 180 TR_XM_INV_DKIM 2425 0.41 1.13 0.10 181 RELAYCOUNTRY_DE 2394 0.62 1.11 0.42 182 NO_FM_NAME_IP_HOSTN 2359 0.33 1.10 0.00 183 MONEY_FORM 2317 0.33 1.08 0.01 184 TR_MetaPhish_Combo_01 2237 0.84 1.04 0.76 185 TR_XM_BayesRelay 2220 0.32 1.03 0.02 186 BODY_SINGLE_WORD 2195 0.32 1.02 0.02 187 RELAYCOUNTRY_GB 2147 1.05 1.00 1.08 188 BODY_SINGLE_URI 2143 0.30 1.00 0.01 189 TR_XM_PHPDW 2118 0.54 0.99 0.36 190 DKIM_ADSP_CUSTOM_MED 2114 1.08 0.98 1.13 191 ACT_NOW_CAPS 2112 0.43 0.98 0.20 192 MONEY_ATM_CARD 2107 0.30 0.98 0.02 193 XMPhish30 2101 0.56 0.98 0.39 194 TR_XM_DK_Bayes 2095 7.91 0.98 10.85 195 BAYES_05 2073 1.93 0.96 2.33 196 ALIBABA_IMG_NOT_RCVD_ALI 2066 0.29 0.96 0.00 197 XM_H_Long_From02 2064 1.05 0.96 1.08 198 TR_XM_PHPForged 2048 0.51 0.95 0.32 199 TR_XM_FormFill2 2033 0.51 0.95 0.32 200 TR_XM_DK_Bayes1 2027 7.69 0.94 10.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 456220 91.48 95.03 89.97 2 RELAYCOUNTRY_US 426124 81.97 77.11 84.03 3 DKIM_SIGNED 397698 80.57 85.61 78.43 4 XM_DK_Pass 391418 78.97 83.16 77.19 5 DKIM_VALID 381208 77.13 81.74 75.18 6 XM_B_Unicode 366020 73.61 76.98 72.18 7 DKIM_VALID_AU 289202 58.81 63.00 57.03 8 DCC_CHECK_NEGATIVE 284427 45.41 20.21 56.09 9 BAYES_50 281139 50.77 39.74 55.44 10 XMListUnsubscribeExists 269058 58.45 71.16 53.06 11 XM_B_SpammyWords 247554 55.02 69.65 48.82 12 XM_B_Unicode3 213084 41.65 40.76 42.02 13 DCC_CHECK 211330 52.41 77.76 41.68 14 RCVD_IN_MSPIKE_WL 154424 27.32 19.92 30.45 15 T_TM2_M_HEADER_IN_MSG 146688 26.58 21.03 28.93 16 HTML_FONT_LOW_CONTRAST 145902 30.83 35.67 28.77 17 DKIM_VALID_EF 144678 28.65 28.93 28.53 18 RCVD_IN_MSPIKE_H2 141224 28.87 31.29 27.85 19 LOC_TINY_FONT_1 125167 28.76 38.37 24.68 20 FVGT_m_MULTI_ODD 116731 24.66 28.52 23.02 21 MIME_HTML_ONLY 110254 24.02 29.39 21.74 22 XMSubLong 107946 22.57 25.59 21.29 23 XM_B_SpammyWords2 103691 26.58 41.03 20.45 24 T_KAM_HTML_FONT_INVALID 96110 20.87 25.40 18.95 25 RCVD_IN_MSPIKE_H3 81788 14.86 11.86 16.13 26 BAYES_00 74081 10.66 1.34 14.61 27 XM_Body_Dirty_Words 63072 14.96 20.90 12.44 28 ALL_TRUSTED 62336 8.98 1.15 12.29 29 XM_Multi_Part_URI 59862 13.99 19.15 11.81 30 RCVD_IN_MSPIKE_H4 56795 10.04 7.30 11.20 31 TR_XM_DK_Bayes 55010 7.91 0.98 10.85 32 TR_XM_DK_Bayes1 53515 7.69 0.94 10.55 33 XM_B_Unsub 50472 10.73 12.57 9.95 34 XM_Evil_Numbers_Gen 49912 9.91 10.07 9.84 35 TR_XM_DK_Bayes2 46953 6.75 0.84 9.26 36 LotsOfNums_01 46854 9.99 11.76 9.24 37 XM_DKIMWhitelistDomains 45881 6.37 0.06 9.05 38 TooManyTo_001 42605 7.64 5.83 8.40 39 UNPARSEABLE_RELAY 41289 8.02 7.72 8.14 40 RCVD_IN_RP_SAFE 40662 6.97 4.48 8.02 41 XM_DK_Undo_02 40172 18.87 44.69 7.92 42 HTML_IMAGE_RATIO_02 38203 8.45 10.62 7.53 43 BAYES_60 37686 7.62 8.07 7.43 44 RCVD_IN_RP_CERTIFIED 37572 6.30 3.68 7.41 45 XM_SendGrid 37498 7.08 6.34 7.39 46 LOTS_OF_MONEY 32741 8.56 13.53 6.46 47 IN_ZIMBRA_NJ_WHITELIST 30098 4.20 0.10 5.94 48 MIME_QP_LONG_LINE 29901 5.10 3.23 5.90 49 TR_XM_DKIM_Undo 29374 15.53 38.52 5.79 50 XM_H_Long_From01 29334 6.20 7.18 5.78 51 RCVD_IN_IADB_LISTED 29326 4.61 1.85 5.78 52 TR_XM_UnparsRelay 29158 6.25 7.42 5.75 53 XM_B_SpammyWords3 26884 7.94 14.15 5.30 54 BAYES_40 26447 4.50 2.80 5.22 55 RELAYCOUNTRY_META 26356 9.83 20.76 5.20 56 FSL_BULK_SIG 26270 6.89 10.94 5.18 57 XM_B_Phish_Phrases 25823 5.94 7.95 5.09 58 XMStrtUSub 25554 4.91 4.59 5.04 59 RCVD_IN_IADB_SPF 25521 4.02 1.63 5.03 60 BOTNET_IPINHOSTNAME 25509 7.46 13.20 5.03 61 T_TooManySym_01 25358 4.21 2.34 5.00 62 MPART_ALT_DIFF 24963 6.13 8.98 4.92 63 XM_PDF 23859 3.53 0.75 4.71 64 TR_XM_DK_SendGrid 23415 4.28 3.49 4.62 65 BAYES_99 23183 12.80 32.21 4.57 66 RCVD_IN_IADB_SENDERID 22737 3.61 1.55 4.48 67 XMSexyCombo_05 21993 6.27 10.83 4.34 68 RCVD_IN_IADB_DK 21958 3.50 1.55 4.33 69 TR_XM_SpammyWords4 21876 6.38 11.26 4.31 70 HTML_IMAGE_RATIO_06 21751 4.31 4.35 4.29 71 HTML_IMAGE_RATIO_04 21489 4.64 5.58 4.24 72 BAYES_80 20585 5.26 8.08 4.06 73 BAYES_20 19503 3.35 2.17 3.85 74 T_REMOTE_IMAGE 18952 4.05 4.79 3.74 75 BAYES_999 18694 10.16 25.43 3.69 76 RCVD_IN_IADB_VOUCHED 18002 2.71 0.71 3.55 77 FROM_EXCESS_BASE64 17239 3.11 2.44 3.40 78 XMSubMetaSx_00 16595 4.46 7.27 3.27 79 DKIM_INVALID 16490 3.44 3.87 3.25 80 URI_NOVOWEL 16131 2.69 1.54 3.18 81 RCVD_IN_MSPIKE_H5 15841 2.42 0.75 3.12 82 XM_UncommonTLD01 15524 5.55 11.42 3.06 83 MIME_HTML_ONLY_MULTI 15265 2.93 2.74 3.01 84 XMNumbers 14647 3.33 4.37 2.89 85 MAILING_LIST_MULTI 14512 2.47 1.53 2.86 86 TR_XM_PhishingBody 14505 4.00 6.70 2.86 87 MIME_HTML_MOSTLY 12324 3.79 6.99 2.43 88 BAYES_95 12291 3.07 4.60 2.42 89 TR_DCC_Bayes_99 12249 9.30 25.53 2.42 90 TM2_M_URI_OPT_OUT 11948 2.81 3.89 2.36 91 BAYES_05 11830 1.93 0.96 2.33 92 RCVD_IN_IADB_OPTIN 11829 1.78 0.48 2.33 93 BOTNET 11726 6.70 17.05 2.31 94 T_TooManySym_02 11519 1.77 0.58 2.27 95 HTML_MIME_NO_HTML_TAG 11309 2.27 2.36 2.23 96 XM_H_Trusted_IP 11185 1.55 0.00 2.21 97 TooManyTo_002 11037 1.74 0.71 2.18 98 HTML_IMAGE_RATIO_08 10596 2.79 4.44 2.09 99 TR_XM_SB_Phish 10371 2.11 2.27 2.05 100 XM_B_SpammyTLD 10277 2.42 3.36 2.03 101 XMSubPhish11 10207 2.06 2.16 2.01 102 UNTRUSTED_Relay 10203 5.95 15.23 2.01 103 XM_CamelCaseFrm001 9730 2.19 2.83 1.92 104 XM_B_Phish66 9494 2.39 3.61 1.87 105 XM_SPF_SoftFail 9299 2.41 3.78 1.83 106 HELO_NODOT 9292 1.53 0.82 1.83 107 HELO_NO_DOMAIN 9292 1.53 0.82 1.83 108 XM_B_Unsub2 9181 2.01 2.49 1.81 109 XMDiploma_00 9055 2.12 2.90 1.79 110 SUBJ_ALL_CAPS 8845 1.87 2.16 1.74 111 KHOP_HELO_FCRDNS 8840 2.17 3.19 1.74 112 ANY_BOUNCE_MESSAGE 8428 1.29 0.40 1.66 113 BOUNCE_MESSAGE 8424 1.29 0.40 1.66 114 T_XMDrugObfuBody_14 8108 1.67 1.83 1.60 115 TR_XM_SpammyWords5 7877 2.26 3.93 1.55 116 IN_HORDE_ADDRESS_BOOK 7858 1.17 0.28 1.55 117 TVD_RCVD_IP 7663 1.18 0.40 1.51 118 TR_MSPIKEBAYES00 7558 1.06 0.04 1.49 119 XM_DK_Undo_01 7504 2.44 4.71 1.48 120 URI_HEX 7423 1.97 3.17 1.46 121 TooManyTo_003 7310 1.19 0.58 1.44 122 URI_TRY_3LD 7239 1.48 1.61 1.43 123 INVALID_MSGID 7078 1.20 0.72 1.40 124 RELAYCOUNTRY_CA 7069 2.71 5.81 1.39 125 TR_Symld_Words 6970 1.35 1.28 1.37 126 XMStockSpam_06 6809 1.60 2.21 1.34 127 T_XMDrugObfuBody_08 6684 1.58 2.19 1.32 128 USER_IN_DEF_DKIM_WL 6669 0.92 0.00 1.32 129 MSGID_NOFQDN1 6538 0.99 0.28 1.29 130 TO_MALFORMED 6476 0.90 0.02 1.28 131 TM2_M_VERY_LONG_WORD 6465 1.55 2.19 1.27 132 XMCapTrack 6160 0.95 0.33 1.21 133 XM_GoogleGroups 5957 0.97 0.50 1.17 134 RCVD_IN_BL_SPAMCOP_NET 5938 3.75 9.85 1.17 135 HELO_MISC_IP 5924 0.94 0.39 1.17 136 XM_UB50 5894 2.73 6.42 1.16 137 DKIM_ADSP_CUSTOM_MED 5715 1.08 0.98 1.13 138 XMSubNoVowel 5670 1.04 0.84 1.12 139 T_XMDrugObfuBody_00 5569 1.34 1.90 1.10 140 XM_H_Long_From02 5499 1.05 0.96 1.08 141 RELAYCOUNTRY_GB 5459 1.05 1.00 1.08 142 XM_B_COVIDMETA 5324 1.65 3.05 1.05 143 TooManyTo_004 5162 0.87 0.51 1.02 144 T_XMHurry_00 4902 1.39 2.39 0.97 145 XM_OfRef6 4828 2.17 5.03 0.95 146 XMGenDplmaNmb 4808 1.20 1.80 0.95 147 XMBSHREFv2 4594 0.70 0.22 0.91 148 XMBody_95 4584 0.67 0.10 0.90 149 XMHTML_After_End 4522 1.14 1.71 0.89 150 T_OBFU_PDF_ATTACH 4508 0.67 0.14 0.89 151 T_FILL_THIS_FORM_SHORT 4504 1.48 2.89 0.89 152 XMNoVowels 4421 0.73 0.40 0.87 153 XMGappySubj_01 4310 0.64 0.16 0.85 154 HTML_FONT_FACE_BAD 4198 0.74 0.54 0.83 155 TooManyTo_005 4171 0.71 0.43 0.82 156 TR_XM_SpammyWords2 4105 4.45 13.03 0.81 157 XMBrknScrpt_02 4024 1.31 2.53 0.79 158 NML_ADSP_CUSTOM_MED 3991 0.81 0.85 0.79 159 HTTPS_HTTP_MISMATCH 3870 0.80 0.89 0.76 160 TR_MetaPhish_Combo_01 3843 0.84 1.04 0.76 161 FROM_GOV_DKIM_AU 3842 0.58 0.15 0.76 162 XM_ProductURIs 3820 0.79 0.87 0.75 163 SpammyFromTLD_01 3793 1.73 4.04 0.75 164 T_TooManySym_03 3685 0.55 0.12 0.73 165 XMBdyGiftCard01 3670 1.30 2.67 0.72 166 FORGED_GMAIL_RCVD 3589 1.26 2.58 0.71 167 XMSubMetaI_00 3518 0.91 1.41 0.69 168 PDS_OTHER_BAD_TLD 3386 1.00 1.80 0.67 169 XM_E_Blogspot 3361 0.49 0.08 0.66 170 XM_B_SpammyWords4 3292 1.24 2.63 0.65 171 XMBody_17 3259 1.23 2.61 0.64 172 HTML_IMAGE_ONLY_20 3222 0.59 0.49 0.64 173 XM_SPF_Unknown 3214 0.59 0.49 0.63 174 XMSubMetaSxObfu_03 3204 0.79 1.16 0.63 175 PLING_QUERY 3201 0.59 0.48 0.63 176 XMMoneyMeta_00 3182 0.72 0.93 0.63 177 XM_ShortIntro_01 3125 0.51 0.27 0.62 178 RCVD_IN_SORBS_DUL 2886 0.48 0.26 0.57 179 XM_Body_Obfu01 2870 0.54 0.48 0.57 180 SHORT_HELO_AND_INLINE_IMAGE 2825 0.42 0.09 0.56 181 T_Symld_Words_02 2765 0.77 1.30 0.55 182 XMHTMLBadTable_001 2756 0.54 0.52 0.54 183 RDNS_DYNAMIC 2717 0.71 1.13 0.54 184 XM_H_PHPMailer 2454 0.43 0.29 0.48 185 HTML_IMAGE_ONLY_32 2390 0.38 0.15 0.47 186 XM_S_SpammyWords 2373 0.58 0.85 0.47 187 TR_XM_Spammywords 2372 0.58 0.85 0.47 188 TR_XM_COVIDMETA4 2321 0.75 1.43 0.46 189 RELAYCOUNTRY_NL 2317 0.56 0.81 0.46 190 MISSING_HEADERS 2304 0.48 0.55 0.45 191 FROM_GOV_SPOOF 2290 0.35 0.12 0.45 192 TM2_M_BODY_EMPTY 2287 0.33 0.06 0.45 193 XM_B_REG_HTML 2273 0.40 0.28 0.45 194 HTML_IMAGE_ONLY_28 2225 0.45 0.48 0.44 195 TR_BOTNET_NEGATE 2204 0.53 0.77 0.43 196 XMSexyCombo_01 2199 0.90 2.00 0.43 197 XM_Body_Dirty_Words_01 2162 0.71 1.36 0.43 198 XMLngstWrd_00 2143 0.41 0.37 0.42 199 TR_LOTS_OF_MONEY3 2136 1.18 2.96 0.42 200 MSGID_FROM_MTA_HEADER 2118 0.36 0.23 0.42 ----------------------------------------------------------------------