Email: 762488 Autolearn: 0 AvgScore: 2.89 AvgScanTime: 1.45 sec Spam: 233502 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.65 sec Ham: 528986 Autolearn: 0 AvgScore: -1.89 AvgScanTime: 1.36 sec Time Spent Running SA: 307.20 hours Time Spent Processing Spam: 106.85 hours Time Spent Processing Ham: 200.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 226620 86.07 97.05 81.23 2 DKIM_SIGNED 205278 82.88 87.91 80.67 3 XM_DK_Pass 200641 81.53 85.93 79.58 4 DKIM_VALID 196334 79.61 84.08 77.64 5 DCC_CHECK 186660 57.59 79.94 47.73 6 XM_B_Unicode 183146 69.91 78.43 66.15 7 RELAYCOUNTRY_US 180650 83.48 77.37 86.17 8 XMListUnsubscribeExists 169389 55.99 72.54 48.69 9 XM_B_SpammyWords 167417 58.29 71.70 52.37 10 DKIM_VALID_AU 153036 62.40 65.54 61.01 11 XM_DK_Undo_02 110917 18.77 47.50 6.09 12 XM_B_Unicode3 100851 40.30 43.19 39.02 13 XM_B_SpammyWords2 96254 25.61 41.22 18.72 14 LOC_TINY_FONT_1 93067 28.23 39.86 23.10 15 TR_XM_DKIM_Undo 91260 15.01 39.08 4.38 16 BAYES_50 90637 55.91 38.82 63.45 17 HTML_FONT_LOW_CONTRAST 84376 29.86 36.14 27.09 18 BAYES_99 84236 13.64 36.08 3.73 19 MIME_HTML_ONLY 77817 22.59 33.33 17.85 20 RCVD_IN_MSPIKE_H2 73551 28.11 31.50 26.61 21 DKIM_VALID_EF 72037 33.83 30.85 35.15 22 TR_DCC_Bayes_99 67657 10.23 28.97 1.96 23 T_KAM_HTML_FONT_INVALID 67622 21.39 28.96 18.04 24 BAYES_999 67116 10.82 28.74 2.91 25 FVGT_m_MULTI_ODD 64880 24.70 27.79 23.34 26 XMSubLong 60126 20.86 25.75 18.70 27 RCVD_IN_MSPIKE_WL 49734 32.01 21.30 36.74 28 RELAYCOUNTRY_META 49549 9.50 21.22 4.32 29 XM_Body_Dirty_Words 45628 13.35 19.54 10.62 30 T_TM2_M_HEADER_IN_MSG 45580 24.23 19.52 26.30 31 DCC_CHECK_NEGATIVE 42676 40.36 18.28 50.11 32 XM_B_SpammyWords3 38437 8.53 16.46 5.03 33 XM_Multi_Part_URI 36323 12.28 15.56 10.83 34 LOTS_OF_MONEY 32987 8.15 14.13 5.51 35 XM_UncommonTLD01 32360 6.43 13.86 3.16 36 TR_XM_SpammyWords2 32170 4.56 13.78 0.49 37 BOTNET 31764 5.28 13.60 1.60 38 UNTRUSTED_Relay 31578 5.31 13.52 1.68 39 BOTNET_IPINHOSTNAME 29787 6.84 12.76 4.24 40 TR_XM_SpammyWords4 29723 6.30 12.73 3.46 41 XM_B_Unsub 28844 10.02 12.35 8.99 42 FSL_BULK_SIG 28067 7.16 12.02 5.01 43 XM_Evil_Numbers_Gen 25840 8.72 11.07 7.69 44 HTML_IMAGE_RATIO_02 25782 7.73 11.04 6.27 45 RCVD_IN_MSPIKE_H3 25267 14.08 10.82 15.51 46 XMSexyCombo_05 23112 4.89 9.90 2.69 47 RCVD_IN_MSPIKE_H4 22229 11.99 9.52 13.08 48 RCVD_IN_BL_SPAMCOP_NET 21960 3.52 9.40 0.93 49 MPART_ALT_DIFF 21412 5.63 9.17 4.07 50 LotsOfNums_01 20917 8.66 8.96 8.53 51 UNPARSEABLE_RELAY 20252 7.73 8.67 7.32 52 TR_XM_UnparsRelay 19876 6.95 8.51 6.27 53 XM_B_Phish_Phrases 18361 11.65 7.86 13.32 54 BAYES_80 18356 5.32 7.86 4.21 55 XM_H_Long_From01 18265 6.03 7.82 5.25 56 BAYES_60 17661 8.04 7.56 8.25 57 XM_SendGrid 15772 6.59 6.75 6.51 58 TooManyTo_001 15733 7.14 6.74 7.31 59 XMSubMetaSx_00 15552 4.05 6.66 2.90 60 MIME_HTML_MOSTLY 15119 3.46 6.47 2.13 61 TR_XM_PhishingBody 14998 3.97 6.42 2.89 62 RELAYCOUNTRY_CA 14760 2.73 6.32 1.15 63 T_REMOTE_IMAGE 14560 4.33 6.24 3.50 64 XMNumbers 14024 3.73 6.01 2.72 65 HTML_IMAGE_RATIO_04 13716 5.46 5.87 5.28 66 SpammyFromTLD_02 13311 1.95 5.70 0.30 67 XM_UB50 12127 2.37 5.19 1.13 68 KHOP_HELO_FCRDNS 11530 2.85 4.94 1.93 69 BAYES_95 11350 3.33 4.86 2.65 70 XM_B_SpammyTLD 10760 2.86 4.61 2.08 71 TR_XM_SpammyWords5 10752 2.44 4.60 1.48 72 RCVD_IN_RP_SAFE 10248 6.35 4.39 7.22 73 HTML_IMAGE_RATIO_06 9884 3.58 4.23 3.30 74 SpammyFromTLD_01 9868 1.98 4.23 0.98 75 TM2_M_URI_OPT_OUT 9842 2.90 4.21 2.32 76 URIBL_SBL_A 9658 2.43 4.14 1.67 77 TR_XM_DK_SendGrid 9603 4.07 4.11 4.06 78 XM_OfRef6 9592 1.83 4.11 0.83 79 BODY_URI_ONLY 9356 1.23 4.01 0.00 80 XM_DK_Undo_01 9209 2.17 3.94 1.38 81 DKIM_INVALID 8944 3.27 3.83 3.02 82 RCVD_IN_MSPIKE_BL 8935 1.28 3.83 0.15 83 TR_XM_MSPIKECOMBO 8910 1.27 3.82 0.15 84 HTML_SHORT_LINK_IMG_1 8868 1.17 3.80 0.01 85 XMStrtUSub 8670 10.72 3.71 13.81 86 HTML_IMAGE_RATIO_08 8637 2.77 3.70 2.36 87 XM_B_SpammyWords4 8435 1.65 3.61 0.78 88 HTML_IMAGE_ONLY_12 8018 1.17 3.43 0.17 89 XMDiploma_00 7963 2.28 3.41 1.78 90 MIME_HTML_ONLY_MULTI 7936 2.78 3.40 2.51 91 XM_B_COVIDMETA 7896 1.60 3.38 0.81 92 RCVD_IN_RP_CERTIFIED 7667 5.51 3.28 6.49 93 TR_LOTS_OF_MONEY3 7638 1.36 3.27 0.51 94 XM_B_Phish66 7471 2.21 3.20 1.77 95 URIBL_DBL_SPAM 7467 0.98 3.20 0.01 96 RELAYCOUNTRY_FR 7264 1.15 3.11 0.29 97 MIME_QP_LONG_LINE 7116 4.81 3.05 5.59 98 XM_SPF_SoftFail 7052 2.35 3.02 2.06 99 FROM_EXCESS_BASE64 6819 2.81 2.92 2.76 100 URI_HEX 6656 1.73 2.85 1.23 101 XM_UB99 6519 0.86 2.79 0.00 102 TR_XM_SB_Phish 6287 2.16 2.69 1.92 103 XM_B_Unsub2 6258 1.82 2.68 1.44 104 XMBody_17 6168 1.15 2.64 0.49 105 XMSubPhish11 6114 2.12 2.62 1.90 106 RCVD_IN_MSPIKE_L5 6041 0.84 2.59 0.08 107 XMBdyGiftCard01 6034 1.37 2.58 0.83 108 RELAYCOUNTRY_IN 6024 0.86 2.58 0.10 109 XM_UB60 5973 0.87 2.56 0.12 110 XMBrknScrpt_02 5952 1.21 2.55 0.61 111 XM_DIRTYINTL 5933 1.06 2.54 0.41 112 RCVD_IN_PSBL 5930 0.84 2.54 0.09 113 SUBJ_ALL_CAPS 5892 1.69 2.52 1.33 114 T_XMDrugObfuBody_08 5755 1.64 2.46 1.28 115 T_TooManySym_01 5698 3.57 2.44 4.07 116 TM2_M_VERY_LONG_WORD 5621 1.63 2.41 1.29 117 HTML_FONT_SIZE_LARGE 5611 0.82 2.40 0.13 118 T_XMDrugObfuBody_14 5337 2.26 2.29 2.25 119 XM_CamelCaseFrm001 5242 2.17 2.24 2.14 120 T_FILL_THIS_FORM_SHORT 5094 1.16 2.18 0.71 121 XM_UB999 5004 0.66 2.14 0.00 122 TR_XM_MaxBayes 4920 0.66 2.11 0.02 123 FORGED_GMAIL_RCVD 4827 1.07 2.07 0.63 124 URI_TRY_3LD 4647 1.57 1.99 1.39 125 XMSexyCombo_01 4601 0.85 1.97 0.35 126 XMGenDplmaNmb 4574 1.19 1.96 0.85 127 TR_XM_SpammyWords3 4501 0.63 1.93 0.06 128 RCVD_IN_IADB_LISTED 4468 4.39 1.91 5.48 129 TR_XM_BayesRelay 4453 0.60 1.91 0.02 130 RCVD_IN_RP_RNBL 4342 0.58 1.86 0.02 131 BAYES_40 4192 3.32 1.80 3.99 132 T_XMHurry_00 4165 0.97 1.78 0.60 133 BOTNET_NORDNS 4132 0.55 1.77 0.01 134 RCVD_IN_IADB_SPF 4051 3.83 1.73 4.75 135 XMStockSpam_06 4028 0.99 1.73 0.67 136 TR_XM_COVIDMETA1 3846 0.69 1.65 0.27 137 RCVD_IN_IADB_DK 3835 3.34 1.64 4.09 138 XM_URI_RBL 3749 0.67 1.61 0.26 139 RCVD_IN_IADB_SENDERID 3746 3.43 1.60 4.23 140 PDS_OTHER_BAD_TLD 3658 0.99 1.57 0.73 141 HTML_MIME_NO_HTML_TAG 3536 1.74 1.51 1.83 142 XM_UB80 3522 0.49 1.51 0.04 143 URI_PHP_REDIR 3489 0.46 1.49 0.00 144 GOOGLE_DOC_SUSP 3480 0.47 1.49 0.01 145 HK_RANDOM_REPLYTO 3451 0.59 1.48 0.19 146 BAYES_20 3401 2.50 1.46 2.96 147 MAILING_LIST_MULTI 3325 1.91 1.42 2.13 148 T_XMDrugObfuBody_00 3313 0.85 1.42 0.59 149 TR_XM_COVIDMETA4 3275 0.67 1.40 0.34 150 URI_NOVOWEL 3205 2.43 1.37 2.90 151 RELAYCOUNTRY_GB 3163 0.99 1.35 0.83 152 TR_XM_FormFill 3152 0.42 1.35 0.01 153 URIBL_BLACK 3089 0.43 1.32 0.03 154 XMSubMetaI_00 3034 0.79 1.30 0.56 155 XMHTML_After_End 3014 0.80 1.29 0.59 156 NUMERIC_HTTP_ADDR 2957 0.56 1.27 0.24 157 DATE_IN_PAST_06_12 2918 0.41 1.25 0.04 158 RELAYCOUNTRY_AU 2904 0.64 1.24 0.38 159 XMPhish08 2802 0.51 1.20 0.21 160 TR_XM_INV_DKIM 2798 0.43 1.20 0.10 161 XMPhish14 2792 0.73 1.20 0.52 162 TR_Caps_n_Bayes_99 2758 0.41 1.18 0.07 163 TR_XM_PHPDW 2713 0.54 1.16 0.27 164 TR_XM_PHPForged 2702 0.50 1.16 0.22 165 XM_Body_Obfu01 2645 0.57 1.13 0.32 166 TR_XM_FormFill2 2621 0.49 1.12 0.21 167 XM_H_PHPOS 2611 0.49 1.12 0.21 168 XM_S_SpammyWords 2543 0.54 1.09 0.29 169 TR_XM_Spammywords 2543 0.53 1.09 0.29 170 DATE_IN_PAST_03_06 2531 0.37 1.08 0.06 171 HTTPS_HTTP_MISMATCH 2512 0.88 1.08 0.79 172 DIET_1 2485 0.54 1.06 0.30 173 XMSubNoVowel 2456 0.93 1.05 0.87 174 XM_OfRef7 2445 0.40 1.05 0.11 175 XMBody_78 2375 0.56 1.02 0.35 176 SUBJ_DOLLARS 2370 0.51 1.01 0.29 177 XM_BadFromFormat 2327 0.39 1.00 0.13 178 TR_Symld_Words 2319 1.23 0.99 1.33 179 RCVD_IN_MSPIKE_H5 2238 5.95 0.96 8.15 180 XM_H_Long_From02 2196 1.15 0.94 1.24 181 ALL_TRUSTED 2168 7.68 0.93 10.66 182 RELAYCOUNTRY_NL 2160 0.38 0.93 0.14 183 XM_UB95 2125 0.30 0.91 0.02 184 XMPhish30 2122 0.50 0.91 0.31 185 XM_ProductURIs 2110 0.95 0.90 0.96 186 TR_MetaPhish_Combo_01 2054 0.66 0.88 0.57 187 MPART_ALT_DIFF_COUNT 2027 0.54 0.87 0.39 188 HTML_TAG_BALANCE_BODY 2027 0.49 0.87 0.33 189 TR_XM_RelayPhish 2020 0.33 0.87 0.10 190 BAYES_00 2013 6.40 0.86 8.85 191 HTML_IMAGE_ONLY_28 2012 0.49 0.86 0.33 192 XM_B_SEO 1998 0.35 0.86 0.13 193 XMSexyCombo_04 1987 0.29 0.85 0.04 194 XM_Body_Dirty_Words_01 1977 0.37 0.85 0.17 195 FROM_SUSPICIOUS_NTLD 1966 0.30 0.84 0.06 196 XMMoneyMeta_00 1937 0.54 0.83 0.41 197 XM_PDF 1934 2.84 0.83 3.73 198 RCVD_IN_IADB_VOUCHED 1932 2.69 0.83 3.51 199 TR_LOTS_OF_MONEY2 1917 0.36 0.82 0.16 200 T_MONEY_PERCENT 1917 0.36 0.82 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 455850 83.48 77.37 86.17 2 HTML_MESSAGE 429677 86.07 97.05 81.23 3 DKIM_SIGNED 426709 82.88 87.91 80.67 4 XM_DK_Pass 420983 81.53 85.93 79.58 5 DKIM_VALID 410712 79.61 84.08 77.64 6 XM_B_Unicode 349906 69.91 78.43 66.15 7 BAYES_50 335641 55.91 38.82 63.45 8 DKIM_VALID_AU 322744 62.40 65.54 61.01 9 XM_B_SpammyWords 277050 58.29 71.70 52.37 10 DCC_CHECK_NEGATIVE 265082 40.36 18.28 50.11 11 XMListUnsubscribeExists 257547 55.99 72.54 48.69 12 DCC_CHECK 252493 57.59 79.94 47.73 13 XM_B_Unicode3 206419 40.30 43.19 39.02 14 RCVD_IN_MSPIKE_WL 194352 32.01 21.30 36.74 15 DKIM_VALID_EF 185920 33.83 30.85 35.15 16 HTML_FONT_LOW_CONTRAST 143327 29.86 36.14 27.09 17 RCVD_IN_MSPIKE_H2 140781 28.11 31.50 26.61 18 T_TM2_M_HEADER_IN_MSG 139147 24.23 19.52 26.30 19 FVGT_m_MULTI_ODD 123482 24.70 27.79 23.34 20 LOC_TINY_FONT_1 122192 28.23 39.86 23.10 21 XM_B_SpammyWords2 99012 25.61 41.22 18.72 22 XMSubLong 98919 20.86 25.75 18.70 23 T_KAM_HTML_FONT_INVALID 95442 21.39 28.96 18.04 24 MIME_HTML_ONLY 94405 22.59 33.33 17.85 25 XM_DKIMWhitelistDomains 93805 12.31 0.02 17.73 26 RCVD_IN_MSPIKE_H3 82066 14.08 10.82 15.51 27 XMStrtUSub 73035 10.72 3.71 13.81 28 XM_B_Phish_Phrases 70449 11.65 7.86 13.32 29 RCVD_IN_MSPIKE_H4 69176 11.99 9.52 13.08 30 XM_Multi_Part_URI 57287 12.28 15.56 10.83 31 ALL_TRUSTED 56378 7.68 0.93 10.66 32 XM_Body_Dirty_Words 56158 13.35 19.54 10.62 33 XM_B_Unsub 47577 10.02 12.35 8.99 34 BAYES_00 46807 6.40 0.86 8.85 35 LotsOfNums_01 45107 8.66 8.96 8.53 36 BAYES_60 43623 8.04 7.56 8.25 37 RCVD_IN_MSPIKE_H5 43110 5.95 0.96 8.15 38 XM_Evil_Numbers_Gen 40669 8.72 11.07 7.69 39 UNPARSEABLE_RELAY 38698 7.73 8.67 7.32 40 TooManyTo_001 38691 7.14 6.74 7.31 41 RCVD_IN_RP_SAFE 38182 6.35 4.39 7.22 42 TR_XM_DK_Bayes 34753 4.76 0.67 6.57 43 XM_SendGrid 34451 6.59 6.75 6.51 44 RCVD_IN_RP_CERTIFIED 34316 5.51 3.28 6.49 45 TR_XM_DK_Bayes1 34062 4.67 0.65 6.44 46 TR_XM_UnparsRelay 33155 6.95 8.51 6.27 47 HTML_IMAGE_RATIO_02 33154 7.73 11.04 6.27 48 XM_DK_Undo_02 32208 18.77 47.50 6.09 49 TR_XM_DK_Bayes2 30132 4.12 0.56 5.70 50 MIME_QP_LONG_LINE 29585 4.81 3.05 5.59 51 LOTS_OF_MONEY 29141 8.15 14.13 5.51 52 RCVD_IN_IADB_LISTED 29001 4.39 1.91 5.48 53 IN_ZIMBRA_NJ_WHITELIST 27999 3.69 0.05 5.29 54 HTML_IMAGE_RATIO_04 27908 5.46 5.87 5.28 55 XM_H_Long_From01 27746 6.03 7.82 5.25 56 XM_B_SpammyWords3 26586 8.53 16.46 5.03 57 FSL_BULK_SIG 26499 7.16 12.02 5.01 58 RCVD_IN_IADB_SPF 25151 3.83 1.73 4.75 59 TR_XM_DKIM_Undo 23189 15.01 39.08 4.38 60 RELAYCOUNTRY_META 22874 9.50 21.22 4.32 61 BOTNET_IPINHOSTNAME 22405 6.84 12.76 4.24 62 RCVD_IN_IADB_SENDERID 22381 3.43 1.60 4.23 63 BAYES_80 22244 5.32 7.86 4.21 64 RCVD_IN_IADB_DK 21612 3.34 1.64 4.09 65 T_TooManySym_01 21510 3.57 2.44 4.07 66 MPART_ALT_DIFF 21506 5.63 9.17 4.07 67 TR_XM_DK_SendGrid 21461 4.07 4.11 4.06 68 BAYES_40 21118 3.32 1.80 3.99 69 BAYES_99 19743 13.64 36.08 3.73 70 XM_PDF 19715 2.84 0.83 3.73 71 RCVD_IN_IADB_VOUCHED 18586 2.69 0.83 3.51 72 T_REMOTE_IMAGE 18491 4.33 6.24 3.50 73 TR_XM_SpammyWords4 18313 6.30 12.73 3.46 74 HTML_IMAGE_RATIO_06 17446 3.58 4.23 3.30 75 XM_UncommonTLD01 16697 6.43 13.86 3.16 76 DKIM_INVALID 15997 3.27 3.83 3.02 77 BAYES_20 15664 2.50 1.46 2.96 78 BAYES_999 15408 10.82 28.74 2.91 79 XMSubMetaSx_00 15365 4.05 6.66 2.90 80 URI_NOVOWEL 15358 2.43 1.37 2.90 81 TR_XM_PhishingBody 15264 3.97 6.42 2.89 82 FROM_EXCESS_BASE64 14605 2.81 2.92 2.76 83 XMNumbers 14409 3.73 6.01 2.72 84 XMSexyCombo_05 14204 4.89 9.90 2.69 85 BAYES_95 14031 3.33 4.86 2.65 86 MIME_HTML_ONLY_MULTI 13285 2.78 3.40 2.51 87 HTML_IMAGE_RATIO_08 12471 2.77 3.70 2.36 88 TM2_M_URI_OPT_OUT 12262 2.90 4.21 2.32 89 RCVD_IN_IADB_OPTIN 12000 1.72 0.48 2.27 90 T_XMDrugObfuBody_14 11924 2.26 2.29 2.25 91 XM_H_Trusted_IP 11589 1.52 0.00 2.19 92 XM_CamelCaseFrm001 11303 2.17 2.24 2.14 93 MAILING_LIST_MULTI 11244 1.91 1.42 2.13 94 MIME_HTML_MOSTLY 11243 3.46 6.47 2.13 95 XM_B_SpammyTLD 11021 2.86 4.61 2.08 96 XM_SPF_SoftFail 10902 2.35 3.02 2.06 97 T_TooManySym_02 10881 1.66 0.75 2.06 98 TR_DCC_Bayes_99 10381 10.23 28.97 1.96 99 TVD_RCVD_IP 10328 1.42 0.21 1.95 100 KHOP_HELO_FCRDNS 10208 2.85 4.94 1.93 101 TooManyTo_002 10200 1.51 0.57 1.93 102 TR_XM_SB_Phish 10172 2.16 2.69 1.92 103 BAYES_05 10114 1.54 0.70 1.91 104 XMSubPhish11 10076 2.12 2.62 1.90 105 ANY_BOUNCE_MESSAGE 9714 1.46 0.61 1.84 106 BOUNCE_MESSAGE 9712 1.46 0.61 1.84 107 HTML_MIME_NO_HTML_TAG 9706 1.74 1.51 1.83 108 XMDiploma_00 9403 2.28 3.41 1.78 109 XM_B_Phish66 9378 2.21 3.20 1.77 110 UNTRUSTED_Relay 8908 5.31 13.52 1.68 111 URIBL_SBL_A 8856 2.43 4.14 1.67 112 BOTNET 8483 5.28 13.60 1.60 113 HELO_NO_DOMAIN 8016 1.19 0.47 1.52 114 HELO_NODOT 8016 1.20 0.49 1.52 115 TR_XM_SpammyWords5 7828 2.44 4.60 1.48 116 IN_HORDE_ADDRESS_BOOK 7652 1.02 0.06 1.45 117 XM_B_Unsub2 7605 1.82 2.68 1.44 118 URI_TRY_3LD 7358 1.57 1.99 1.39 119 XM_DK_Undo_01 7326 2.17 3.94 1.38 120 INVALID_MSGID 7156 1.04 0.32 1.35 121 TR_Symld_Words 7025 1.23 0.99 1.33 122 SUBJ_ALL_CAPS 7025 1.69 2.52 1.33 123 TooManyTo_003 6960 1.06 0.48 1.32 124 TM2_M_VERY_LONG_WORD 6809 1.63 2.41 1.29 125 T_XMDrugObfuBody_08 6787 1.64 2.46 1.28 126 XM_H_Long_From02 6560 1.15 0.94 1.24 127 URI_HEX 6525 1.73 2.85 1.23 128 MSGID_NOFQDN1 6485 0.87 0.05 1.23 129 USER_IN_DEF_DKIM_WL 6433 0.85 0.02 1.22 130 TO_MALFORMED 6412 0.84 0.01 1.21 131 RELAYCOUNTRY_CA 6058 2.73 6.32 1.15 132 XMCapTrack 5969 0.90 0.39 1.13 133 XM_UB50 5954 2.37 5.19 1.13 134 HELO_MISC_IP 5274 0.78 0.29 1.00 135 SpammyFromTLD_01 5202 1.98 4.23 0.98 136 DKIM_ADSP_CUSTOM_MED 5182 0.92 0.78 0.98 137 XM_ProductURIs 5102 0.95 0.90 0.96 138 TooManyTo_004 5042 0.79 0.42 0.95 139 RCVD_IN_BL_SPAMCOP_NET 4912 3.52 9.40 0.93 140 XMBSHREFv2 4851 0.76 0.39 0.92 141 XM_GoogleGroups 4784 0.76 0.42 0.90 142 HTML_FONT_FACE_BAD 4688 0.80 0.62 0.89 143 XMGappySubj_01 4623 0.67 0.19 0.87 144 XMSubNoVowel 4611 0.93 1.05 0.87 145 XMGenDplmaNmb 4496 1.19 1.96 0.85 146 RELAYCOUNTRY_GB 4395 0.99 1.35 0.83 147 XMBdyGiftCard01 4389 1.37 2.58 0.83 148 XM_OfRef6 4385 1.83 4.11 0.83 149 XMBody_95 4362 0.60 0.10 0.82 150 XM_B_COVIDMETA 4300 1.60 3.38 0.81 151 TooManyTo_005 4195 0.66 0.36 0.79 152 HTTPS_HTTP_MISMATCH 4192 0.88 1.08 0.79 153 XM_B_SpammyWords4 4120 1.65 3.61 0.78 154 PDS_OTHER_BAD_TLD 3878 0.99 1.57 0.73 155 TR_MSPIKEBAYES00 3824 0.51 0.01 0.72 156 T_FILL_THIS_FORM_SHORT 3751 1.16 2.18 0.71 157 NML_ADSP_CUSTOM_MED 3638 0.64 0.55 0.69 158 XMStockSpam_06 3524 0.99 1.73 0.67 159 TVD_SPACE_RATIO 3515 0.48 0.08 0.66 160 FORGED_GMAIL_RCVD 3314 1.07 2.07 0.63 161 XMBrknScrpt_02 3240 1.21 2.55 0.61 162 T_XMHurry_00 3199 0.97 1.78 0.60 163 XM_H_PHPMailer 3191 0.58 0.54 0.60 164 T_XMDrugObfuBody_00 3131 0.85 1.42 0.59 165 XMHTML_After_End 3101 0.80 1.29 0.59 166 TR_MetaPhish_Combo_01 2994 0.66 0.88 0.57 167 XM_shorewaves_Whitelist 2969 0.39 0.00 0.56 168 XMSubMetaI_00 2962 0.79 1.30 0.56 169 T_TooManySym_03 2909 0.45 0.23 0.55 170 XMLngstWrd_00 2836 0.54 0.54 0.54 171 RDNS_DYNAMIC 2812 0.60 0.74 0.53 172 XMHTMLBadTable_001 2803 0.55 0.58 0.53 173 PLING_QUERY 2761 0.53 0.56 0.52 174 XMPhish14 2743 0.73 1.20 0.52 175 T_Symld_Words_02 2735 0.61 0.82 0.52 176 TR_LOTS_OF_MONEY3 2698 1.36 3.27 0.51 177 HTML_IMAGE_ONLY_20 2636 0.43 0.26 0.50 178 XMBody_17 2617 1.15 2.64 0.49 179 TR_XM_SpammyWords2 2609 4.56 13.78 0.49 180 RELAYCOUNTRY_DE 2577 0.56 0.72 0.49 181 XM_SPF_Unknown 2522 0.51 0.58 0.48 182 T_OBFU_PDF_ATTACH 2468 0.38 0.19 0.47 183 FROM_GOV_DKIM_AU 2458 0.37 0.15 0.46 184 XMLngstWrd_01 2441 0.47 0.48 0.46 185 XM_ShortIntro_01 2424 0.43 0.35 0.46 186 XMNoVowels 2349 0.46 0.50 0.44 187 TM2_M_BODY_EMPTY 2342 0.32 0.05 0.44 188 SHORT_HELO_AND_INLINE_IMAGE 2276 0.32 0.05 0.43 189 RCVD_IN_SORBS_DUL 2269 0.36 0.21 0.43 190 XM_DIRTYINTL 2185 1.06 2.54 0.41 191 XMMoneyMeta_00 2171 0.54 0.83 0.41 192 MPART_ALT_DIFF_COUNT 2088 0.54 0.87 0.39 193 FROM_GOV_SPOOF 2012 0.30 0.10 0.38 194 XMLngstWrd_02 2002 0.38 0.38 0.38 195 RELAYCOUNTRY_AU 1984 0.64 1.24 0.38 196 MISSING_HEADERS 1978 0.36 0.33 0.37 197 XM_B_COPY_HTML 1978 0.38 0.39 0.37 198 TR_BOTNET_NEGATE 1963 0.47 0.69 0.37 199 XMSolicitRefs_0 1959 0.35 0.29 0.37 200 USER_IN_WELCOMELIST 1891 0.25 0.00 0.36 ----------------------------------------------------------------------