Email: 755547 Autolearn: 0 AvgScore: 2.90 AvgScanTime: 1.56 sec Spam: 212348 Autolearn: 0 AvgScore: 13.31 AvgScanTime: 1.83 sec Ham: 543199 Autolearn: 0 AvgScore: -1.17 AvgScanTime: 1.46 sec Time Spent Running SA: 327.60 hours Time Spent Processing Spam: 107.78 hours Time Spent Processing Ham: 219.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 203821 88.62 95.98 85.75 2 DKIM_SIGNED 192884 81.65 90.83 78.05 3 XM_DK_Pass 188705 80.30 88.87 76.95 4 DKIM_VALID 184715 78.27 86.99 74.87 5 XM_B_Unicode 171761 73.17 80.89 70.16 6 RELAYCOUNTRY_US 170209 82.79 80.16 83.82 7 DCC_CHECK 167563 54.11 78.91 44.42 8 XMListUnsubscribeExists 163790 57.10 77.13 49.27 9 XM_B_SpammyWords 158853 58.01 74.81 51.44 10 DKIM_VALID_AU 143943 60.52 67.79 57.68 11 XM_DK_Undo_02 108154 20.27 50.93 8.28 12 XM_B_Unicode3 93891 40.97 44.22 39.70 13 XM_B_SpammyWords2 90582 27.09 42.66 21.00 14 TR_XM_DKIM_Undo 90489 15.99 42.61 5.58 15 LOC_TINY_FONT_1 85967 28.75 40.48 24.17 16 BAYES_50 84284 50.67 39.69 54.96 17 HTML_FONT_LOW_CONTRAST 76837 29.20 36.18 26.46 18 BAYES_99 74226 13.33 34.95 4.87 19 RCVD_IN_MSPIKE_H2 67208 28.33 31.65 27.03 20 DKIM_VALID_EF 66762 31.29 31.44 31.24 21 MIME_HTML_ONLY 61939 22.18 29.17 19.44 22 FVGT_m_MULTI_ODD 60093 24.55 28.30 23.08 23 T_KAM_HTML_FONT_INVALID 59410 20.83 27.98 18.03 24 BAYES_999 58851 10.52 27.71 3.80 25 TR_DCC_Bayes_99 58331 9.69 27.47 2.74 26 XMSubLong 50300 20.42 23.69 19.14 27 T_TM2_M_HEADER_IN_MSG 49304 27.59 23.22 29.29 28 RCVD_IN_MSPIKE_WL 49294 30.09 23.21 32.78 29 XM_Body_Dirty_Words 45847 14.22 21.59 11.33 30 RELAYCOUNTRY_META 41568 8.67 19.58 4.40 31 DCC_CHECK_NEGATIVE 40976 43.86 19.30 53.46 32 XM_Multi_Part_URI 33072 12.54 15.57 11.35 33 XM_B_SpammyWords3 32157 7.26 15.14 4.17 34 BOTNET 30098 5.39 14.17 1.96 35 TR_XM_SpammyWords2 29970 4.55 14.11 0.81 36 LOTS_OF_MONEY 28530 8.76 13.44 6.93 37 BOTNET_IPINHOSTNAME 26985 6.82 12.71 4.52 38 RCVD_IN_MSPIKE_H3 26843 14.81 12.64 15.66 39 XM_B_Unsub 24736 10.25 11.65 9.70 40 TR_XM_SpammyWords4 24726 6.73 11.64 4.80 41 XM_Evil_Numbers_Gen 24270 9.53 11.43 8.78 42 XM_UncommonTLD01 24076 5.37 11.34 3.03 43 RCVD_IN_BL_SPAMCOP_NET 23928 4.30 11.27 1.57 44 UNTRUSTED_Relay 23497 4.23 11.07 1.56 45 MPART_ALT_DIFF 22645 6.13 10.66 4.36 46 XMSexyCombo_05 22452 5.69 10.57 3.79 47 LotsOfNums_01 20667 9.09 9.73 8.83 48 RCVD_IN_MSPIKE_H4 20326 11.08 9.57 11.67 49 HTML_IMAGE_RATIO_02 19095 7.79 8.99 7.32 50 FSL_BULK_SIG 17352 6.34 8.17 5.62 51 BAYES_80 17166 5.84 8.08 4.96 52 MIME_HTML_MOSTLY 17132 3.94 8.07 2.33 53 UNPARSEABLE_RELAY 17052 7.86 8.03 7.79 54 XM_B_Phish_Phrases 16597 8.49 7.82 8.75 55 TR_XM_UnparsRelay 16397 6.42 7.72 5.91 56 BAYES_60 15591 7.77 7.34 7.94 57 TR_XM_PhishingBody 15203 4.00 7.16 2.76 58 RELAYCOUNTRY_CA 14433 2.82 6.80 1.27 59 XMSubMetaSx_00 13858 4.07 6.53 3.11 60 URIBL_SBL_A 13839 3.19 6.52 1.89 61 TooManyTo_001 13763 7.32 6.48 7.65 62 XM_SendGrid 13565 6.94 6.39 7.15 63 XM_H_Long_From01 13439 5.77 6.33 5.56 64 HTML_IMAGE_RATIO_04 12739 5.57 6.00 5.40 65 SpammyFromTLD_01 10869 2.08 5.12 0.89 66 XM_OfRef6 10304 1.95 4.85 0.82 67 RCVD_IN_RP_SAFE 9939 6.81 4.68 7.64 68 XM_UB50 9864 2.02 4.65 0.99 69 BAYES_95 9810 3.51 4.62 3.07 70 XM_B_SpammyTLD 9238 2.65 4.35 1.98 71 XMStrtUSub 9121 8.40 4.30 10.00 72 XM_B_Phish66 8983 2.49 4.23 1.81 73 TR_XM_SpammyWords5 8785 2.22 4.14 1.47 74 TM2_M_URI_OPT_OUT 8640 2.62 4.07 2.06 75 XM_SPF_SoftFail 8596 2.48 4.05 1.86 76 HTML_IMAGE_RATIO_06 8315 3.74 3.92 3.67 77 DKIM_INVALID 8169 3.37 3.85 3.19 78 XMNumbers 8044 3.20 3.79 2.97 79 XM_DK_Undo_01 7952 2.04 3.74 1.38 80 XMDiploma_00 7772 2.12 3.66 1.52 81 FROM_EXCESS_BASE64 7762 3.02 3.66 2.77 82 TR_XM_DK_SendGrid 7757 4.15 3.65 4.34 83 MIME_HTML_ONLY_MULTI 7563 2.93 3.56 2.68 84 RCVD_IN_RP_CERTIFIED 7483 6.05 3.52 7.04 85 RELAYCOUNTRY_FR 7372 1.16 3.47 0.25 86 XMBody_17 7349 1.56 3.46 0.81 87 HTML_IMAGE_RATIO_08 7280 2.82 3.43 2.58 88 TR_LOTS_OF_MONEY3 7229 1.26 3.40 0.42 89 XM_DIRTYINTL 7031 1.22 3.31 0.40 90 RCVD_IN_MSPIKE_BL 6955 1.05 3.28 0.18 91 TR_XM_MSPIKECOMBO 6799 1.03 3.20 0.18 92 MIME_QP_LONG_LINE 6600 4.81 3.11 5.48 93 XM_B_COVIDMETA 6454 1.36 3.04 0.70 94 T_FILL_THIS_FORM_SHORT 6300 1.37 2.97 0.75 95 T_TooManySym_01 6298 4.08 2.97 4.51 96 URIBL_DBL_SPAM 6126 0.82 2.88 0.01 97 SpammyFromTLD_02 6064 0.98 2.86 0.25 98 XM_B_SpammyWords4 5950 1.34 2.80 0.76 99 URI_HEX 5679 1.71 2.67 1.34 100 XMBrknScrpt_02 5676 1.19 2.67 0.61 101 RCVD_IN_RP_RNBL 5510 0.75 2.59 0.03 102 XMGenDplmaNmb 5371 1.31 2.53 0.84 103 TR_XM_SB_Phish 5339 2.13 2.51 1.98 104 XMSubPhish11 5254 2.10 2.47 1.96 105 TR_XM_MaxBayes 5250 0.72 2.47 0.04 106 TM2_M_VERY_LONG_WORD 5167 1.59 2.43 1.26 107 XMBdyGiftCard01 5142 1.17 2.42 0.68 108 XM_CamelCaseFrm001 4968 2.03 2.34 1.90 109 T_XMDrugObfuBody_14 4967 2.07 2.34 1.97 110 T_XMHurry_00 4887 2.68 2.30 2.83 111 T_XMDrugObfuBody_08 4784 1.57 2.25 1.31 112 XM_B_Unsub2 4753 1.99 2.24 1.89 113 XMHTML_After_End 4614 1.29 2.17 0.94 114 T_XMDrugObfuBody_00 4519 1.06 2.13 0.64 115 XMSexyCombo_01 4468 0.87 2.10 0.38 116 RCVD_IN_PSBL 4366 0.64 2.06 0.09 117 RCVD_IN_IADB_LISTED 4344 4.82 2.05 5.90 118 T_REMOTE_IMAGE 4249 3.12 2.00 3.56 119 SUBJ_ALL_CAPS 4193 1.45 1.97 1.25 120 BOTNET_NORDNS 4186 0.56 1.97 0.01 121 BAYES_40 4165 4.28 1.96 5.19 122 XM_UB99 4152 0.56 1.96 0.01 123 RCVD_IN_MSPIKE_L5 4143 0.60 1.95 0.07 124 KHOP_HELO_FCRDNS 4136 1.82 1.95 1.77 125 TR_XM_SpammyWords3 4070 0.61 1.92 0.10 126 XMSubMetaI_00 4045 0.98 1.90 0.61 127 XMStockSpam_06 4023 1.35 1.89 1.14 128 URI_NOVOWEL 3954 2.62 1.86 2.91 129 URI_TRY_3LD 3922 1.44 1.85 1.28 130 RCVD_IN_IADB_SPF 3902 4.23 1.84 5.16 131 XM_URI_RBL 3860 0.61 1.82 0.14 132 FORGED_GMAIL_RCVD 3737 0.87 1.76 0.53 133 TR_XM_BayesRelay 3728 0.51 1.76 0.02 134 RCVD_IN_IADB_DK 3722 3.60 1.75 4.33 135 RCVD_IN_IADB_SENDERID 3708 3.81 1.75 4.62 136 TR_XM_COVIDMETA1 3645 0.68 1.72 0.28 137 TR_XM_PHPDW 3437 0.74 1.62 0.39 138 PDS_OTHER_BAD_TLD 3401 0.77 1.60 0.45 139 URIBL_BLACK 3385 0.47 1.59 0.03 140 TR_XM_PHPForged 3311 0.69 1.56 0.35 141 XM_UB60 3300 0.51 1.55 0.10 142 MAILING_LIST_MULTI 3292 2.18 1.55 2.42 143 TR_XM_FormFill2 3284 0.69 1.55 0.36 144 XM_H_PHPOS 3280 0.68 1.54 0.34 145 TR_XM_FormFill 3258 0.45 1.53 0.03 146 TR_XM_COVIDMETA4 3201 0.66 1.51 0.33 147 URI_PHP_REDIR 3160 0.42 1.49 0.00 148 XM_UB80 3145 0.43 1.48 0.02 149 XM_UB999 3048 0.41 1.44 0.01 150 HTTPS_HTTP_MISMATCH 3028 1.02 1.43 0.86 151 HTML_MIME_NO_HTML_TAG 2964 1.61 1.40 1.70 152 BAYES_20 2869 2.91 1.35 3.52 153 RELAYCOUNTRY_GB 2683 1.04 1.26 0.95 154 RELAYCOUNTRY_DE 2626 0.62 1.24 0.38 155 XMPhish08 2593 0.49 1.22 0.20 156 GOOGLE_DOC_SUSP 2553 0.35 1.20 0.01 157 XM_OfRef7 2551 0.42 1.20 0.11 158 BAYES_00 2539 9.91 1.20 13.32 159 TR_MetaPhish_Combo_01 2530 0.74 1.19 0.56 160 XM_H_Long_From02 2505 1.16 1.18 1.16 161 TR_XM_INV_DKIM 2462 0.39 1.16 0.09 162 FROM_SUSPICIOUS_NTLD 2462 0.37 1.16 0.06 163 XM_Body_Obfu01 2443 0.54 1.15 0.30 164 TR_XM_RelayPhish 2420 0.38 1.14 0.09 165 T_Symld_Words_02 2419 0.71 1.14 0.54 166 TR_Symld_Words 2383 1.23 1.12 1.27 167 XMBody_78 2381 0.60 1.12 0.40 168 FROM_SUSPICIOUS_NTLD_FP 2378 0.35 1.12 0.05 169 XM_B_SEO 2365 0.41 1.11 0.13 170 XMSexyCombo_04 2343 0.40 1.10 0.12 171 ALL_TRUSTED 2304 9.68 1.09 13.04 172 XM_ProductURIs 2286 0.89 1.08 0.82 173 T_MONEY_PERCENT 2259 0.55 1.06 0.34 174 TR_LOTS_OF_MONEY2 2259 0.55 1.06 0.34 175 NUMERIC_HTTP_ADDR 2238 0.52 1.05 0.31 176 XM_Body_Dirty_Words_01 2228 0.43 1.05 0.19 177 URI_NO_WWW_BIZ_CGI 2177 0.29 1.03 0.01 178 HK_RANDOM_REPLYTO 2133 0.41 1.00 0.18 179 RCVD_IN_MSPIKE_H5 2125 4.20 1.00 5.45 180 TR_Mismatch_TLD_02 2011 0.31 0.95 0.07 181 TR_BOTNET_NEGATE 1999 0.60 0.94 0.47 182 TR_XM_SEO4 1994 0.31 0.94 0.06 183 TR_XM_DK_Bayes 1982 6.84 0.93 9.14 184 XMPhish30 1954 0.51 0.92 0.35 185 SUBJ_DOLLARS 1941 0.57 0.91 0.43 186 LongTLD 1931 0.36 0.91 0.14 187 TR_XM_DK_Bayes1 1915 6.50 0.90 8.69 188 DIET_1 1891 0.51 0.89 0.36 189 XM_SPF_Unknown 1884 0.65 0.89 0.55 190 RELAYCOUNTRY_NL 1831 0.38 0.86 0.19 191 DATE_IN_PAST_24_48 1830 0.25 0.86 0.00 192 TM2_M_A_HREF_HREF 1789 0.42 0.84 0.25 193 HTML_TAG_BALANCE_BODY 1749 0.45 0.82 0.30 194 XMMoneyMeta_00 1745 0.59 0.82 0.50 195 URI_GOOGLE_PROXY 1708 0.29 0.80 0.09 196 RDNS_DYNAMIC 1697 0.58 0.80 0.49 197 BAYES_05 1691 1.78 0.80 2.17 198 URIBL_DBL_ABUSE_SPAM 1638 0.27 0.77 0.08 199 XM_UB95 1617 0.22 0.76 0.01 200 XM_Combo_Sbj 1614 0.43 0.76 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 465767 88.62 95.98 85.75 2 RELAYCOUNTRY_US 455294 82.79 80.16 83.82 3 DKIM_SIGNED 423988 81.65 90.83 78.05 4 XM_DK_Pass 418004 80.30 88.87 76.95 5 DKIM_VALID 406668 78.27 86.99 74.87 6 XM_B_Unicode 381091 73.17 80.89 70.16 7 DKIM_VALID_AU 313332 60.52 67.79 57.68 8 BAYES_50 298553 50.67 39.69 54.96 9 DCC_CHECK_NEGATIVE 290416 43.86 19.30 53.46 10 XM_B_SpammyWords 279433 58.01 74.81 51.44 11 XMListUnsubscribeExists 267622 57.10 77.13 49.27 12 DCC_CHECK 241273 54.11 78.91 44.42 13 XM_B_Unicode3 215644 40.97 44.22 39.70 14 RCVD_IN_MSPIKE_WL 178086 30.09 23.21 32.78 15 DKIM_VALID_EF 169685 31.29 31.44 31.24 16 T_TM2_M_HEADER_IN_MSG 159127 27.59 23.22 29.29 17 RCVD_IN_MSPIKE_H2 146844 28.33 31.65 27.03 18 HTML_FONT_LOW_CONTRAST 143754 29.20 36.18 26.46 19 LOC_TINY_FONT_1 131287 28.75 40.48 24.17 20 FVGT_m_MULTI_ODD 125384 24.55 28.30 23.08 21 XM_B_SpammyWords2 114096 27.09 42.66 21.00 22 MIME_HTML_ONLY 105606 22.18 29.17 19.44 23 XMSubLong 103989 20.42 23.69 19.14 24 T_KAM_HTML_FONT_INVALID 97954 20.83 27.98 18.03 25 RCVD_IN_MSPIKE_H3 85083 14.81 12.64 15.66 26 XM_DKIMWhitelistDomains 73209 9.77 0.29 13.48 27 BAYES_00 72347 9.91 1.20 13.32 28 ALL_TRUSTED 70819 9.68 1.09 13.04 29 RCVD_IN_MSPIKE_H4 63381 11.08 9.57 11.67 30 XM_Multi_Part_URI 61654 12.54 15.57 11.35 31 XM_Body_Dirty_Words 61557 14.22 21.59 11.33 32 XMStrtUSub 54322 8.40 4.30 10.00 33 XM_B_Unsub 52694 10.25 11.65 9.70 34 TR_XM_DK_Bayes 49673 6.84 0.93 9.14 35 LotsOfNums_01 47975 9.09 9.73 8.83 36 XM_Evil_Numbers_Gen 47704 9.53 11.43 8.78 37 XM_B_Phish_Phrases 47521 8.49 7.82 8.75 38 TR_XM_DK_Bayes1 47185 6.50 0.90 8.69 39 XM_DK_Undo_02 44999 20.27 50.93 8.28 40 BAYES_60 43115 7.77 7.34 7.94 41 UNPARSEABLE_RELAY 42330 7.86 8.03 7.79 42 TooManyTo_001 41540 7.32 6.48 7.65 43 RCVD_IN_RP_SAFE 41518 6.81 4.68 7.64 44 TR_XM_DK_Bayes2 40457 5.56 0.73 7.45 45 HTML_IMAGE_RATIO_02 39770 7.79 8.99 7.32 46 XM_SendGrid 38848 6.94 6.39 7.15 47 RCVD_IN_RP_CERTIFIED 38217 6.05 3.52 7.04 48 LOTS_OF_MONEY 37650 8.76 13.44 6.93 49 TR_XM_UnparsRelay 32087 6.42 7.72 5.91 50 RCVD_IN_IADB_LISTED 32036 4.82 2.05 5.90 51 FSL_BULK_SIG 30531 6.34 8.17 5.62 52 TR_XM_DKIM_Undo 30286 15.99 42.61 5.58 53 XM_H_Long_From01 30186 5.77 6.33 5.56 54 MIME_QP_LONG_LINE 29763 4.81 3.11 5.48 55 RCVD_IN_MSPIKE_H5 29622 4.20 1.00 5.45 56 HTML_IMAGE_RATIO_04 29329 5.57 6.00 5.40 57 IN_ZIMBRA_NJ_WHITELIST 28860 3.83 0.05 5.31 58 BAYES_40 28190 4.28 1.96 5.19 59 RCVD_IN_IADB_SPF 28029 4.23 1.84 5.16 60 BAYES_80 26953 5.84 8.08 4.96 61 BAYES_99 26454 13.33 34.95 4.87 62 TR_XM_SpammyWords4 26100 6.73 11.64 4.80 63 RCVD_IN_IADB_SENDERID 25110 3.81 1.75 4.62 64 BOTNET_IPINHOSTNAME 24563 6.82 12.71 4.52 65 T_TooManySym_01 24520 4.08 2.97 4.51 66 RELAYCOUNTRY_META 23918 8.67 19.58 4.40 67 MPART_ALT_DIFF 23683 6.13 10.66 4.36 68 TR_XM_DK_SendGrid 23601 4.15 3.65 4.34 69 RCVD_IN_IADB_DK 23509 3.60 1.75 4.33 70 XM_B_SpammyWords3 22665 7.26 15.14 4.17 71 XM_PDF 21404 3.04 0.74 3.94 72 BAYES_999 20667 10.52 27.71 3.80 73 XMSexyCombo_05 20568 5.69 10.57 3.79 74 RCVD_IN_IADB_VOUCHED 20248 2.89 0.75 3.73 75 HTML_IMAGE_RATIO_06 19927 3.74 3.92 3.67 76 T_REMOTE_IMAGE 19341 3.12 2.00 3.56 77 BAYES_20 19113 2.91 1.35 3.52 78 DKIM_INVALID 17320 3.37 3.85 3.19 79 XMSubMetaSx_00 16873 4.07 6.53 3.11 80 BAYES_95 16689 3.51 4.62 3.07 81 XM_UncommonTLD01 16476 5.37 11.34 3.03 82 XMNumbers 16153 3.20 3.79 2.97 83 URI_NOVOWEL 15825 2.62 1.86 2.91 84 T_XMHurry_00 15370 2.68 2.30 2.83 85 FROM_EXCESS_BASE64 15060 3.02 3.66 2.77 86 TR_XM_PhishingBody 14994 4.00 7.16 2.76 87 TR_DCC_Bayes_99 14880 9.69 27.47 2.74 88 MIME_HTML_ONLY_MULTI 14577 2.93 3.56 2.68 89 HTML_IMAGE_RATIO_08 13998 2.82 3.43 2.58 90 RCVD_IN_IADB_OPTIN 13583 1.94 0.49 2.50 91 MAILING_LIST_MULTI 13163 2.18 1.55 2.42 92 MIME_HTML_MOSTLY 12639 3.94 8.07 2.33 93 XM_H_Trusted_IP 12004 1.59 0.00 2.21 94 T_TooManySym_02 11782 1.75 0.66 2.17 95 BAYES_05 11765 1.78 0.80 2.17 96 TM2_M_URI_OPT_OUT 11169 2.62 4.07 2.06 97 TR_XM_SB_Phish 10776 2.13 2.51 1.98 98 XM_B_SpammyTLD 10768 2.65 4.35 1.98 99 TooManyTo_002 10705 1.59 0.61 1.97 100 T_XMDrugObfuBody_14 10682 2.07 2.34 1.97 101 XMSubPhish11 10641 2.10 2.47 1.96 102 BOTNET 10635 5.39 14.17 1.96 103 XM_CamelCaseFrm001 10334 2.03 2.34 1.90 104 XM_B_Unsub2 10279 1.99 2.24 1.89 105 URIBL_SBL_A 10245 3.19 6.52 1.89 106 XM_SPF_SoftFail 10118 2.48 4.05 1.86 107 BOUNCE_MESSAGE 9920 1.43 0.42 1.83 108 ANY_BOUNCE_MESSAGE 9920 1.43 0.42 1.83 109 XM_B_Phish66 9846 2.49 4.23 1.81 110 KHOP_HELO_FCRDNS 9629 1.82 1.95 1.77 111 HTML_MIME_NO_HTML_TAG 9223 1.61 1.40 1.70 112 TVD_RCVD_IP 9146 1.26 0.16 1.68 113 HELO_NODOT 8987 1.32 0.46 1.65 114 HELO_NO_DOMAIN 8981 1.32 0.45 1.65 115 RCVD_IN_BL_SPAMCOP_NET 8532 4.30 11.27 1.57 116 UNTRUSTED_Relay 8477 4.23 11.07 1.56 117 XMDiploma_00 8236 2.12 3.66 1.52 118 IN_HORDE_ADDRESS_BOOK 7991 1.08 0.08 1.47 119 TR_XM_SpammyWords5 7961 2.22 4.14 1.47 120 XM_DK_Undo_01 7495 2.04 3.74 1.38 121 INVALID_MSGID 7276 1.06 0.35 1.34 122 URI_HEX 7259 1.71 2.67 1.34 123 TooManyTo_003 7217 1.10 0.50 1.33 124 T_XMDrugObfuBody_08 7101 1.57 2.25 1.31 125 URI_TRY_3LD 6947 1.44 1.85 1.28 126 RELAYCOUNTRY_CA 6888 2.82 6.80 1.27 127 TR_Symld_Words 6876 1.23 1.12 1.27 128 TM2_M_VERY_LONG_WORD 6853 1.59 2.43 1.26 129 SUBJ_ALL_CAPS 6770 1.45 1.97 1.25 130 MSGID_NOFQDN1 6530 0.87 0.03 1.20 131 TO_MALFORMED 6470 0.86 0.02 1.19 132 XMCapTrack 6462 0.95 0.35 1.19 133 XM_H_Long_From02 6284 1.16 1.18 1.16 134 USER_IN_DEF_DKIM_WL 6266 0.83 0.01 1.15 135 XMStockSpam_06 6169 1.35 1.89 1.14 136 HELO_MISC_IP 5819 0.83 0.20 1.07 137 XM_GoogleGroups 5699 0.90 0.50 1.05 138 XMBSHREFv2 5436 0.83 0.39 1.00 139 XM_UB50 5361 2.02 4.65 0.99 140 TooManyTo_004 5205 0.81 0.43 0.96 141 RELAYCOUNTRY_GB 5157 1.04 1.26 0.95 142 XMGappySubj_01 5113 0.72 0.16 0.94 143 XMHTML_After_End 5108 1.29 2.17 0.94 144 DKIM_ADSP_CUSTOM_MED 5015 0.88 0.76 0.92 145 SpammyFromTLD_01 4829 2.08 5.12 0.89 146 TR_MSPIKEBAYES00 4717 0.63 0.03 0.87 147 XMSubNoVowel 4688 0.81 0.69 0.86 148 HTTPS_HTTP_MISMATCH 4682 1.02 1.43 0.86 149 XMGenDplmaNmb 4550 1.31 2.53 0.84 150 XM_ProductURIs 4463 0.89 1.08 0.82 151 XM_OfRef6 4451 1.95 4.85 0.82 152 XMBody_95 4427 0.64 0.18 0.81 153 XMBody_17 4421 1.56 3.46 0.81 154 TR_XM_SpammyWords2 4387 4.55 14.11 0.81 155 TooManyTo_005 4231 0.66 0.37 0.78 156 HTML_FONT_FACE_BAD 4200 0.73 0.63 0.77 157 XM_B_SpammyWords4 4153 1.34 2.80 0.76 158 T_FILL_THIS_FORM_SHORT 4061 1.37 2.97 0.75 159 XM_B_COVIDMETA 3810 1.36 3.04 0.70 160 FROM_GOV_DKIM_AU 3728 0.55 0.20 0.69 161 XMBdyGiftCard01 3692 1.17 2.42 0.68 162 T_XMDrugObfuBody_00 3475 1.06 2.13 0.64 163 NML_ADSP_CUSTOM_MED 3461 0.62 0.59 0.64 164 TVD_SPACE_RATIO 3426 0.48 0.11 0.63 165 XMSubMetaI_00 3327 0.98 1.90 0.61 166 XMBrknScrpt_02 3321 1.19 2.67 0.61 167 T_OBFU_PDF_ATTACH 3279 0.47 0.14 0.60 168 XMHTMLBadTable_001 3217 0.62 0.69 0.59 169 TR_MetaPhish_Combo_01 3040 0.74 1.19 0.56 170 XM_ShortIntro_01 3030 0.50 0.34 0.56 171 XM_SPF_Unknown 2996 0.65 0.89 0.55 172 T_Symld_Words_02 2908 0.71 1.14 0.54 173 FORGED_GMAIL_RCVD 2856 0.87 1.76 0.53 174 T_TooManySym_03 2818 0.42 0.18 0.52 175 XMMoneyMeta_00 2692 0.59 0.82 0.50 176 XMSubMetaSxObfu_02 2669 0.48 0.44 0.49 177 RDNS_DYNAMIC 2664 0.58 0.80 0.49 178 XMNoVowels 2627 0.52 0.63 0.48 179 XM_H_PHPMailer 2614 0.50 0.55 0.48 180 TR_BOTNET_NEGATE 2563 0.60 0.94 0.47 181 XM_B_COPY_HTML 2497 0.46 0.48 0.46 182 SHORT_HELO_AND_INLINE_IMAGE 2494 0.35 0.06 0.46 183 RCVD_IN_SORBS_DUL 2492 0.38 0.18 0.46 184 HTML_IMAGE_ONLY_32 2454 0.39 0.25 0.45 185 PDS_OTHER_BAD_TLD 2451 0.77 1.60 0.45 186 SUBJ_DOLLARS 2330 0.57 0.91 0.43 187 TR_LOTS_OF_MONEY3 2306 1.26 3.40 0.42 188 PLING_QUERY 2300 0.47 0.60 0.42 189 TM2_M_BODY_EMPTY 2247 0.32 0.07 0.41 190 XM_DIRTYINTL 2179 1.22 3.31 0.40 191 XMBody_78 2177 0.60 1.12 0.40 192 XM_B_REG_HTML 2149 0.35 0.24 0.40 193 TR_XM_PHPDW 2140 0.74 1.62 0.39 194 HTML_IMAGE_ONLY_28 2133 0.36 0.29 0.39 195 FROM_GOV_SPOOF 2131 0.31 0.10 0.39 196 XMSubMetaSxObfu_03 2129 0.44 0.57 0.39 197 MISSING_HEADERS 2116 0.38 0.34 0.39 198 SHOPIFY_IMG_NOT_RCVD_SFY 2088 0.38 0.36 0.38 199 HTML_IMAGE_ONLY_20 2076 0.34 0.23 0.38 200 XMSexyCombo_01 2069 0.87 2.10 0.38 ----------------------------------------------------------------------