Email: 705581 Autolearn: 0 AvgScore: 3.50 AvgScanTime: 1.36 sec Spam: 215520 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.57 sec Ham: 490061 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.27 sec Time Spent Running SA: 266.91 hours Time Spent Processing Spam: 94.19 hours Time Spent Processing Ham: 172.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 209416 87.64 97.17 83.45 2 DKIM_SIGNED 188980 81.16 87.69 78.29 3 XM_DK_Pass 185032 79.91 85.85 77.29 4 DKIM_VALID 180494 77.88 83.75 75.29 5 DCC_CHECK 171377 55.53 79.52 44.99 6 RELAYCOUNTRY_US 167710 82.26 77.82 84.21 7 XM_B_Unicode 167213 70.83 77.59 67.86 8 XMListUnsubscribeExists 155710 56.36 72.25 49.38 9 XM_B_SpammyWords 152221 55.25 70.63 48.49 10 DKIM_VALID_AU 137784 60.19 63.93 58.55 11 XM_DK_Undo_02 107868 21.68 50.05 9.21 12 XM_B_SpammyWords2 91223 25.55 42.33 18.17 13 XM_B_Unicode3 90848 40.54 42.15 39.84 14 TR_XM_DKIM_Undo 87800 16.46 40.74 5.78 15 BAYES_99 83112 16.43 38.56 6.70 16 LOC_TINY_FONT_1 80729 27.81 37.46 23.56 17 BAYES_50 78690 50.27 36.51 56.32 18 HTML_FONT_LOW_CONTRAST 77496 29.01 35.96 25.95 19 RCVD_IN_MSPIKE_H2 69944 28.53 32.45 26.80 20 MIME_HTML_ONLY 68132 22.93 31.61 19.11 21 BAYES_999 67563 13.32 31.35 5.39 22 TR_DCC_Bayes_99 66736 11.95 30.97 3.59 23 FVGT_m_MULTI_ODD 62395 24.39 28.95 22.38 24 DKIM_VALID_EF 60017 31.29 27.85 32.80 25 T_KAM_HTML_FONT_INVALID 57493 21.11 26.68 18.66 26 XMSubLong 55684 21.41 25.84 19.46 27 T_TM2_M_HEADER_IN_MSG 50386 25.11 23.38 25.87 28 RCVD_IN_MSPIKE_WL 48106 30.21 22.32 33.68 29 RELAYCOUNTRY_META 43920 9.29 20.38 4.41 30 XM_Body_Dirty_Words 43118 13.87 20.01 11.17 31 DCC_CHECK_NEGATIVE 40621 42.45 18.85 52.84 32 TR_XM_SpammyWords2 33397 5.61 15.50 1.26 33 XM_B_SpammyWords3 32163 7.24 14.92 3.86 34 UNTRUSTED_Relay 30641 5.44 14.22 1.59 35 XM_Multi_Part_URI 30299 11.61 14.06 10.53 36 LOTS_OF_MONEY 28843 8.51 13.38 6.36 37 XM_B_Unsub 27756 10.42 12.88 9.33 38 FSL_BULK_SIG 26903 7.66 12.48 5.54 39 XM_UncommonTLD01 26776 6.03 12.42 3.22 40 TR_XM_SpammyWords4 25811 6.65 11.98 4.30 41 RCVD_IN_MSPIKE_H3 25425 14.21 11.80 15.27 42 BOTNET 25401 4.86 11.79 1.82 43 BOTNET_IPINHOSTNAME 25261 6.76 11.72 4.57 44 RCVD_IN_BL_SPAMCOP_NET 24953 4.41 11.58 1.26 45 XM_Evil_Numbers_Gen 22854 9.16 10.60 8.53 46 XMSexyCombo_05 21414 5.66 9.94 3.78 47 LotsOfNums_01 20941 9.38 9.72 9.23 48 RCVD_IN_MSPIKE_H4 20761 11.46 9.63 12.27 49 MPART_ALT_DIFF 18710 5.67 8.68 4.34 50 HTML_IMAGE_RATIO_02 18434 7.24 8.55 6.67 51 XM_B_Phish_Phrases 18404 9.98 8.54 10.62 52 UNPARSEABLE_RELAY 17894 7.72 8.30 7.47 53 BAYES_80 17450 6.95 8.10 6.45 54 TR_XM_UnparsRelay 17397 6.84 8.07 6.30 55 BAYES_60 16829 8.49 7.81 8.78 56 MIME_HTML_MOSTLY 16198 3.85 7.52 2.23 57 T_REMOTE_IMAGE 14356 4.38 6.66 3.37 58 XMNumbers 14350 3.84 6.66 2.60 59 XM_SendGrid 14331 6.78 6.65 6.84 60 XM_H_Long_From01 13985 5.57 6.49 5.16 61 HTML_IMAGE_RATIO_04 13876 5.75 6.44 5.44 62 RELAYCOUNTRY_CA 13527 2.81 6.28 1.28 63 TR_XM_PhishingBody 13306 3.81 6.17 2.77 64 TooManyTo_001 12910 7.32 5.99 7.90 65 XM_UB50 12810 2.53 5.94 1.03 66 SpammyFromTLD_02 12199 1.95 5.66 0.33 67 XMSubMetaSx_00 11958 3.89 5.55 3.16 68 TR_XM_SpammyWords5 10998 2.63 5.10 1.54 69 BODY_URI_ONLY 10604 1.51 4.92 0.01 70 HTML_SHORT_LINK_IMG_1 10516 1.50 4.88 0.02 71 RCVD_IN_RP_SAFE 10178 7.40 4.72 8.58 72 TM2_M_URI_OPT_OUT 10132 3.30 4.70 2.68 73 BAYES_95 9805 3.95 4.55 3.69 74 KHOP_HELO_FCRDNS 9505 2.37 4.41 1.48 75 XM_OfRef6 9357 1.91 4.34 0.84 76 XM_DK_Undo_01 9310 2.30 4.32 1.41 77 XM_B_Unsub2 9195 2.44 4.27 1.64 78 URIBL_SBL_A 9104 2.30 4.22 1.45 79 XM_B_SpammyTLD 8970 2.57 4.16 1.87 80 DKIM_INVALID 8486 3.28 3.94 2.99 81 MIME_HTML_ONLY_MULTI 8254 2.91 3.83 2.50 82 TR_XM_DK_SendGrid 8136 4.16 3.78 4.33 83 RCVD_IN_MSPIKE_BL 7990 1.21 3.71 0.11 84 XMStrtUSub 7966 8.47 3.70 10.58 85 TR_XM_MSPIKECOMBO 7959 1.20 3.69 0.10 86 HTML_IMAGE_RATIO_06 7551 4.06 3.50 4.31 87 XMBody_17 7491 1.38 3.48 0.47 88 RCVD_IN_RP_CERTIFIED 7389 6.58 3.43 7.97 89 XMBdyGiftCard01 7302 1.45 3.39 0.59 90 RCVD_IN_PSBL 7216 1.06 3.35 0.06 91 SpammyFromTLD_01 7032 1.65 3.26 0.94 92 HTML_FONT_SIZE_LARGE 6967 1.09 3.23 0.15 93 XM_SPF_SoftFail 6815 1.99 3.16 1.47 94 URI_HEX 6777 1.83 3.14 1.26 95 HTML_IMAGE_ONLY_12 6694 1.07 3.11 0.17 96 RELAYCOUNTRY_FR 6575 1.10 3.05 0.25 97 XMDiploma_00 6560 1.97 3.04 1.49 98 TR_LOTS_OF_MONEY3 6545 1.26 3.04 0.47 99 HTML_IMAGE_RATIO_08 6378 2.66 2.96 2.53 100 XM_DIRTYINTL 6350 1.13 2.95 0.32 101 MIME_QP_LONG_LINE 6223 4.76 2.89 5.58 102 RCVD_IN_MSPIKE_L5 6099 0.91 2.83 0.06 103 XM_B_Phish66 6071 2.07 2.82 1.74 104 URIBL_DBL_SPAM 5974 0.85 2.77 0.01 105 XM_UB60 5747 0.90 2.67 0.12 106 XM_CamelCaseFrm001 5719 2.05 2.65 1.79 107 XM_UB99 5669 0.81 2.63 0.00 108 XM_B_SpammyWords4 5541 1.14 2.57 0.52 109 TR_XM_SpammyWords3 5496 0.82 2.55 0.06 110 XM_B_COVIDMETA 5467 1.63 2.54 1.23 111 T_XMDrugObfuBody_14 5442 2.10 2.53 1.92 112 XMBrknScrpt_02 5321 1.17 2.47 0.60 113 FROM_EXCESS_BASE64 5284 2.70 2.45 2.82 114 RELAYCOUNTRY_IN 5245 0.81 2.43 0.10 115 T_TooManySym_01 5132 3.69 2.38 4.26 116 TR_XM_MaxBayes 5027 0.73 2.33 0.03 117 T_FILL_THIS_FORM_SHORT 4994 1.17 2.32 0.66 118 XM_BadFromFormat 4972 0.83 2.31 0.19 119 T_XMHurry_00 4883 1.13 2.27 0.63 120 T_XMDrugObfuBody_08 4845 1.61 2.25 1.34 121 TM2_M_VERY_LONG_WORD 4664 1.47 2.16 1.17 122 RCVD_IN_IADB_LISTED 4633 4.68 2.15 5.79 123 XM_UB999 4420 0.63 2.05 0.00 124 FORGED_GMAIL_RCVD 4415 1.04 2.05 0.59 125 RCVD_IN_RP_RNBL 4410 0.65 2.05 0.04 126 TR_XM_BayesRelay 4338 0.63 2.01 0.02 127 TR_XM_SB_Phish 4299 2.15 1.99 2.22 128 BOTNET_NORDNS 4193 0.60 1.95 0.01 129 XMSubPhish11 4175 2.12 1.94 2.20 130 SUBJ_ALL_CAPS 4088 1.87 1.90 1.86 131 RCVD_IN_IADB_SPF 4021 4.09 1.87 5.06 132 XMLongAddy 3987 0.60 1.85 0.05 133 MAILING_LIST_MULTI 3927 2.30 1.82 2.50 134 PDS_OTHER_BAD_TLD 3835 0.88 1.78 0.49 135 BAYES_40 3832 3.24 1.78 3.88 136 HTML_IMAGE_ONLY_08 3777 0.60 1.75 0.10 137 FROM_LOCAL_HEX 3755 0.59 1.74 0.08 138 RCVD_IN_IADB_DK 3734 3.57 1.73 4.37 139 XM_H_Long_From03 3729 0.55 1.73 0.04 140 XMStockSpam_06 3714 1.28 1.72 1.08 141 RCVD_IN_IADB_SENDERID 3707 3.68 1.72 4.54 142 HDRS_LCASE_IMGONLY 3683 0.54 1.71 0.02 143 FROM_LOCAL_DIGITS 3679 0.54 1.71 0.02 144 HK_RANDOM_REPLYTO 3656 0.66 1.70 0.21 145 URI_NOVOWEL 3637 2.47 1.69 2.81 146 XMGenDplmaNmb 3548 1.09 1.65 0.85 147 XMSexyCombo_01 3442 0.84 1.60 0.51 148 TR_XM_COVIDMETA4 3413 0.73 1.58 0.35 149 ANY_BOUNCE_MESSAGE 3339 2.37 1.55 2.73 150 BOUNCE_MESSAGE 3338 2.37 1.55 2.73 151 TR_XM_INV_DKIM 3320 0.60 1.54 0.18 152 URIBL_BLACK 3313 0.49 1.54 0.03 153 URI_TRY_3LD 3297 1.17 1.53 1.02 154 RELAYCOUNTRY_DE 3150 0.74 1.46 0.43 155 TR_XM_FormFill 3139 0.45 1.46 0.01 156 FONT_INVIS_MSGID 3100 0.61 1.44 0.24 157 XM_URI_RBL 3018 0.56 1.40 0.18 158 T_XMDrugObfuBody_00 2981 0.89 1.38 0.68 159 XM_UB80 2862 0.43 1.33 0.04 160 XMHTML_After_End 2835 0.95 1.32 0.79 161 TO_IN_SUBJ 2812 0.42 1.30 0.03 162 HTML_MIME_NO_HTML_TAG 2772 1.81 1.29 2.05 163 BAYES_20 2760 2.42 1.28 2.92 164 GOOGLE_DOC_SUSP 2683 0.38 1.24 0.00 165 TR_XM_PHPDW 2639 0.58 1.22 0.29 166 URI_OPTOUT_3LD 2620 0.41 1.22 0.05 167 XMPhish08 2520 0.49 1.17 0.20 168 TR_XM_COVIDMETA1 2477 0.52 1.15 0.24 169 XM_H_Long_From02 2443 1.22 1.13 1.26 170 TR_XM_PHPForged 2429 0.51 1.13 0.24 171 XM_Body_Dirty_Words_01 2415 0.53 1.12 0.27 172 TR_XM_FormFill2 2404 0.51 1.12 0.24 173 XM_H_PHPOS 2398 0.50 1.11 0.23 174 XMLngstWrd_00 2391 0.64 1.11 0.44 175 XMSubMetaI_00 2351 0.90 1.09 0.82 176 XM_OfRef7 2257 0.40 1.05 0.11 177 XMPhish14 2216 0.61 1.03 0.43 178 RCVD_IN_IADB_VOUCHED 2166 2.86 1.01 3.67 179 XMPhish30 2158 0.54 1.00 0.34 180 HTML_TAG_BALANCE_BODY 2145 0.56 1.00 0.36 181 FROM_SUSPICIOUS_NTLD 2144 0.35 0.99 0.07 182 TR_MetaPhish_Combo_01 2062 0.72 0.96 0.61 183 FROM_SUSPICIOUS_NTLD_FP 2044 0.33 0.95 0.06 184 XMBody_78 2029 0.52 0.94 0.33 185 T_MONEY_PERCENT 1983 0.40 0.92 0.17 186 TR_LOTS_OF_MONEY2 1983 0.40 0.92 0.17 187 FONT_INVIS_DIRECT 1945 0.28 0.90 0.00 188 RCVD_IN_MSPIKE_H5 1920 4.54 0.89 6.14 189 TR_XM_RelayPhish 1898 0.33 0.88 0.08 190 TR_Symld_Words 1893 1.08 0.88 1.17 191 HTTPS_HTTP_MISMATCH 1892 0.78 0.88 0.73 192 THIS_AD 1870 0.56 0.87 0.43 193 RELAYCOUNTRY_AU 1861 0.55 0.86 0.41 194 NUMERIC_HTTP_ADDR 1859 0.42 0.86 0.22 195 DKIM_ADSP_CUSTOM_MED 1848 0.96 0.86 1.01 196 PLING_QUERY 1837 0.56 0.85 0.43 197 ALL_TRUSTED 1831 9.02 0.85 12.62 198 XM_ProductURIs 1811 0.76 0.84 0.73 199 XMMoneyMeta_00 1786 0.58 0.83 0.48 200 XM_Body_Obfu01 1774 0.42 0.82 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 412672 82.26 77.82 84.21 2 HTML_MESSAGE 408940 87.64 97.17 83.45 3 DKIM_SIGNED 383657 81.16 87.69 78.29 4 XM_DK_Pass 378767 79.91 85.85 77.29 5 DKIM_VALID 368990 77.88 83.75 75.29 6 XM_B_Unicode 332562 70.83 77.59 67.86 7 DKIM_VALID_AU 286916 60.19 63.93 58.55 8 BAYES_50 275978 50.27 36.51 56.32 9 DCC_CHECK_NEGATIVE 258933 42.45 18.85 52.84 10 XMListUnsubscribeExists 241983 56.36 72.25 49.38 11 XM_B_SpammyWords 237634 55.25 70.63 48.49 12 DCC_CHECK 220462 55.53 79.52 44.99 13 XM_B_Unicode3 195225 40.54 42.15 39.84 14 RCVD_IN_MSPIKE_WL 165058 30.21 22.32 33.68 15 DKIM_VALID_EF 160734 31.29 27.85 32.80 16 RCVD_IN_MSPIKE_H2 131326 28.53 32.45 26.80 17 HTML_FONT_LOW_CONTRAST 127182 29.01 35.96 25.95 18 T_TM2_M_HEADER_IN_MSG 126778 25.11 23.38 25.87 19 LOC_TINY_FONT_1 115479 27.81 37.46 23.56 20 FVGT_m_MULTI_ODD 109690 24.39 28.95 22.38 21 XMSubLong 95381 21.41 25.84 19.46 22 MIME_HTML_ONLY 93632 22.93 31.61 19.11 23 T_KAM_HTML_FONT_INVALID 91432 21.11 26.68 18.66 24 XM_B_SpammyWords2 89038 25.55 42.33 18.17 25 RCVD_IN_MSPIKE_H3 74844 14.21 11.80 15.27 26 XM_DKIMWhitelistDomains 73046 10.37 0.05 14.91 27 ALL_TRUSTED 61827 9.02 0.85 12.62 28 RCVD_IN_MSPIKE_H4 60112 11.46 9.63 12.27 29 XM_Body_Dirty_Words 54729 13.87 20.01 11.17 30 XM_B_Phish_Phrases 52032 9.98 8.54 10.62 31 XMStrtUSub 51830 8.47 3.70 10.58 32 XM_Multi_Part_URI 51621 11.61 14.06 10.53 33 BAYES_00 45917 6.73 0.71 9.37 34 XM_B_Unsub 45737 10.42 12.88 9.33 35 LotsOfNums_01 45251 9.38 9.72 9.23 36 XM_DK_Undo_02 45115 21.68 50.05 9.21 37 BAYES_60 43049 8.49 7.81 8.78 38 RCVD_IN_RP_SAFE 42056 7.40 4.72 8.58 39 XM_Evil_Numbers_Gen 41783 9.16 10.60 8.53 40 RCVD_IN_RP_CERTIFIED 39057 6.58 3.43 7.97 41 TooManyTo_001 38706 7.32 5.99 7.90 42 UNPARSEABLE_RELAY 36601 7.72 8.30 7.47 43 TR_XM_DK_Bayes 33635 4.92 0.50 6.86 44 XM_SendGrid 33540 6.78 6.65 6.84 45 BAYES_99 32813 16.43 38.56 6.70 46 TR_XM_DK_Bayes1 32699 4.79 0.49 6.67 47 HTML_IMAGE_RATIO_02 32671 7.24 8.55 6.67 48 BAYES_80 31602 6.95 8.10 6.45 49 LOTS_OF_MONEY 31181 8.51 13.38 6.36 50 TR_XM_UnparsRelay 30864 6.84 8.07 6.30 51 RCVD_IN_MSPIKE_H5 30102 4.54 0.89 6.14 52 TR_XM_DK_Bayes2 28933 4.24 0.46 5.90 53 RCVD_IN_IADB_LISTED 28386 4.68 2.15 5.79 54 TR_XM_DKIM_Undo 28330 16.46 40.74 5.78 55 MIME_QP_LONG_LINE 27336 4.76 2.89 5.58 56 FSL_BULK_SIG 27172 7.66 12.48 5.54 57 HTML_IMAGE_RATIO_04 26666 5.75 6.44 5.44 58 BAYES_999 26393 13.32 31.35 5.39 59 IN_ZIMBRA_NJ_WHITELIST 25799 3.67 0.04 5.26 60 XM_H_Long_From01 25299 5.57 6.49 5.16 61 RCVD_IN_IADB_SPF 24807 4.09 1.87 5.06 62 BOTNET_IPINHOSTNAME 22403 6.76 11.72 4.57 63 RCVD_IN_IADB_SENDERID 22258 3.68 1.72 4.54 64 XM_PDF 21704 3.30 0.74 4.43 65 RELAYCOUNTRY_META 21608 9.29 20.38 4.41 66 RCVD_IN_IADB_DK 21435 3.57 1.73 4.37 67 MPART_ALT_DIFF 21264 5.67 8.68 4.34 68 TR_XM_DK_SendGrid 21235 4.16 3.78 4.33 69 HTML_IMAGE_RATIO_06 21114 4.06 3.50 4.31 70 TR_XM_SpammyWords4 21076 6.65 11.98 4.30 71 T_TooManySym_01 20899 3.69 2.38 4.26 72 BAYES_40 19035 3.24 1.78 3.88 73 XM_B_SpammyWords3 18919 7.24 14.92 3.86 74 XMSexyCombo_05 18509 5.66 9.94 3.78 75 BAYES_95 18078 3.95 4.55 3.69 76 RCVD_IN_IADB_VOUCHED 17999 2.86 1.01 3.67 77 TR_DCC_Bayes_99 17571 11.95 30.97 3.59 78 T_REMOTE_IMAGE 16521 4.38 6.66 3.37 79 XM_UncommonTLD01 15772 6.03 12.42 3.22 80 XMSubMetaSx_00 15501 3.89 5.55 3.16 81 DKIM_INVALID 14667 3.28 3.94 2.99 82 BAYES_20 14292 2.42 1.28 2.92 83 XM_H_Trusted_IP 13977 1.98 0.00 2.85 84 FROM_EXCESS_BASE64 13796 2.70 2.45 2.82 85 URI_NOVOWEL 13790 2.47 1.69 2.81 86 TR_XM_PhishingBody 13583 3.81 6.17 2.77 87 ANY_BOUNCE_MESSAGE 13373 2.37 1.55 2.73 88 BOUNCE_MESSAGE 13372 2.37 1.55 2.73 89 TM2_M_URI_OPT_OUT 13123 3.30 4.70 2.68 90 XMNumbers 12751 3.84 6.66 2.60 91 HTML_IMAGE_RATIO_08 12418 2.66 2.96 2.53 92 MAILING_LIST_MULTI 12271 2.30 1.82 2.50 93 MIME_HTML_ONLY_MULTI 12254 2.91 3.83 2.50 94 RCVD_IN_IADB_OPTIN 11702 1.86 0.67 2.39 95 MIME_HTML_MOSTLY 10940 3.85 7.52 2.23 96 TR_XM_SB_Phish 10879 2.15 1.99 2.22 97 XMSubPhish11 10770 2.12 1.94 2.20 98 T_TooManySym_02 10742 1.69 0.56 2.19 99 HTML_MIME_NO_HTML_TAG 10025 1.81 1.29 2.05 100 TooManyTo_002 9619 1.54 0.57 1.96 101 T_XMDrugObfuBody_14 9388 2.10 2.53 1.92 102 BAYES_05 9295 1.52 0.67 1.90 103 XM_B_SpammyTLD 9186 2.57 4.16 1.87 104 SUBJ_ALL_CAPS 9129 1.87 1.90 1.86 105 BOTNET 8905 4.86 11.79 1.82 106 XM_CamelCaseFrm001 8762 2.05 2.65 1.79 107 XM_B_Phish66 8528 2.07 2.82 1.74 108 XM_B_Unsub2 8020 2.44 4.27 1.64 109 TVD_RCVD_IP 7904 1.16 0.13 1.61 110 UNTRUSTED_Relay 7770 5.44 14.22 1.59 111 TR_XM_SpammyWords5 7529 2.63 5.10 1.54 112 HELO_NODOT 7443 1.21 0.52 1.52 113 HELO_NO_DOMAIN 7443 1.18 0.40 1.52 114 IN_HORDE_ADDRESS_BOOK 7324 1.06 0.06 1.49 115 XMDiploma_00 7318 1.97 3.04 1.49 116 KHOP_HELO_FCRDNS 7244 2.37 4.41 1.48 117 XM_SPF_SoftFail 7191 1.99 3.16 1.47 118 URIBL_SBL_A 7109 2.30 4.22 1.45 119 INVALID_MSGID 6945 1.08 0.32 1.42 120 XM_DK_Undo_01 6897 2.30 4.32 1.41 121 TooManyTo_003 6664 1.09 0.48 1.36 122 T_XMDrugObfuBody_08 6544 1.61 2.25 1.34 123 MSGID_NOFQDN1 6414 0.93 0.08 1.31 124 RELAYCOUNTRY_CA 6296 2.81 6.28 1.28 125 TO_MALFORMED 6222 0.88 0.00 1.27 126 RCVD_IN_BL_SPAMCOP_NET 6182 4.41 11.58 1.26 127 XM_H_Long_From02 6173 1.22 1.13 1.26 128 TR_XM_SpammyWords2 6161 5.61 15.50 1.26 129 URI_HEX 6154 1.83 3.14 1.26 130 XM_B_COVIDMETA 6017 1.63 2.54 1.23 131 TM2_M_VERY_LONG_WORD 5737 1.47 2.16 1.17 132 TR_Symld_Words 5717 1.08 0.88 1.17 133 HELO_MISC_IP 5433 0.79 0.08 1.11 134 XMStockSpam_06 5290 1.28 1.72 1.08 135 XMSubNoVowel 5276 0.99 0.80 1.08 136 XMBSHREFv2 5266 0.80 0.19 1.07 137 USER_IN_DEF_DKIM_WL 5156 0.73 0.00 1.05 138 HTML_FONT_FACE_BAD 5065 0.93 0.69 1.03 139 XM_UB50 5059 2.53 5.94 1.03 140 XMCapTrack 5026 0.81 0.31 1.03 141 URI_TRY_3LD 4975 1.17 1.53 1.02 142 XMGappySubj_01 4962 0.84 0.45 1.01 143 DKIM_ADSP_CUSTOM_MED 4957 0.96 0.86 1.01 144 XM_GoogleGroups 4952 0.86 0.51 1.01 145 TooManyTo_004 4836 0.81 0.41 0.99 146 SpammyFromTLD_01 4608 1.65 3.26 0.94 147 XMBody_95 4535 0.69 0.17 0.93 148 XMGenDplmaNmb 4163 1.09 1.65 0.85 149 XM_OfRef6 4122 1.91 4.34 0.84 150 XMSubMetaI_00 4030 0.90 1.09 0.82 151 RELAYCOUNTRY_GB 3980 0.79 0.75 0.81 152 TooManyTo_005 3967 0.67 0.36 0.81 153 XMHTML_After_End 3879 0.95 1.32 0.79 154 FROM_GOV_DKIM_AU 3764 0.60 0.22 0.77 155 HTTPS_HTTP_MISMATCH 3594 0.78 0.88 0.73 156 XM_ProductURIs 3572 0.76 0.84 0.73 157 TVD_SPACE_RATIO 3495 0.52 0.07 0.71 158 NML_ADSP_CUSTOM_MED 3449 0.70 0.70 0.70 159 XMHTMLBadTable_001 3350 0.70 0.72 0.68 160 T_XMDrugObfuBody_00 3319 0.89 1.38 0.68 161 T_FILL_THIS_FORM_SHORT 3248 1.17 2.32 0.66 162 XM_H_PHPMailer 3108 0.62 0.59 0.63 163 T_XMHurry_00 3095 1.13 2.27 0.63 164 T_TooManySym_03 3028 0.47 0.12 0.62 165 TR_MetaPhish_Combo_01 2993 0.72 0.96 0.61 166 XMBrknScrpt_02 2955 1.17 2.47 0.60 167 XMBdyGiftCard01 2908 1.45 3.39 0.59 168 FORGED_GMAIL_RCVD 2902 1.04 2.05 0.59 169 XM_ShortIntro_01 2770 0.48 0.28 0.57 170 HTML_IMAGE_ONLY_20 2718 0.44 0.17 0.55 171 XMSubMetaSxObfu_03 2694 0.59 0.69 0.55 172 XM_SPF_Unknown 2604 0.56 0.63 0.53 173 TR_MSPIKEBAYES00 2603 0.37 0.01 0.53 174 SHORT_HELO_AND_INLINE_IMAGE 2538 0.37 0.04 0.52 175 XM_B_SpammyWords4 2536 1.14 2.57 0.52 176 XMSexyCombo_01 2476 0.84 1.60 0.51 177 T_OBFU_PDF_ATTACH 2396 0.38 0.14 0.49 178 PDS_OTHER_BAD_TLD 2391 0.88 1.78 0.49 179 XMMoneyMeta_00 2341 0.58 0.83 0.48 180 TR_LOTS_OF_MONEY3 2314 1.26 3.04 0.47 181 T_Symld_Words_02 2307 0.52 0.64 0.47 182 FROM_GOV_SPOOF 2303 0.36 0.12 0.47 183 RDNS_DYNAMIC 2296 0.53 0.67 0.47 184 XMNoVowels 2292 0.50 0.56 0.47 185 XMBody_17 2279 1.38 3.48 0.47 186 XM_B_REG_HTML 2205 0.42 0.35 0.45 187 RCVD_IN_SORBS_DUL 2174 0.36 0.16 0.44 188 XMLngstWrd_00 2153 0.64 1.11 0.44 189 PLING_QUERY 2109 0.56 0.85 0.43 190 XMPhish14 2103 0.61 1.03 0.43 191 RELAYCOUNTRY_DE 2097 0.74 1.46 0.43 192 TM2_M_BODY_EMPTY 2096 0.31 0.05 0.43 193 THIS_AD 2088 0.56 0.87 0.43 194 MISSING_HEADERS 2058 0.39 0.34 0.42 195 RELAYCOUNTRY_AU 2021 0.55 0.86 0.41 196 XMLngstWrd_01 1832 0.51 0.81 0.37 197 HTML_IMAGE_ONLY_28 1782 0.39 0.46 0.36 198 HTML_TAG_BALANCE_BODY 1771 0.56 1.00 0.36 199 USER_IN_WELCOMELIST 1755 0.25 0.00 0.36 200 USER_IN_WHITELIST 1755 0.25 0.00 0.36 ----------------------------------------------------------------------