Email: 658474 Autolearn: 0 AvgScore: 4.30 AvgScanTime: 1.24 sec Spam: 209275 Autolearn: 0 AvgScore: 14.52 AvgScanTime: 1.41 sec Ham: 449199 Autolearn: 0 AvgScore: -0.46 AvgScanTime: 1.16 sec Time Spent Running SA: 226.76 hours Time Spent Processing Spam: 82.14 hours Time Spent Processing Ham: 144.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202883 91.06 96.95 88.32 2 DKIM_SIGNED 175164 76.18 83.70 72.68 3 XM_DK_Pass 172092 74.91 82.23 71.50 4 DKIM_VALID 168008 72.88 80.28 69.43 5 DCC_CHECK 167081 50.58 79.84 36.95 6 XM_B_Unicode 163237 73.17 78.00 70.92 7 RELAYCOUNTRY_US 154361 78.21 73.76 80.28 8 XMListUnsubscribeExists 143925 53.91 68.77 46.99 9 XM_B_SpammyWords 140446 51.11 67.11 43.66 10 DKIM_VALID_AU 129307 55.46 61.79 52.51 11 XM_DK_Undo_02 104889 21.36 50.12 7.96 12 XM_B_Unicode3 85734 40.57 40.97 40.38 13 TR_XM_DKIM_Undo 85456 16.56 40.83 5.25 14 BAYES_99 83878 16.99 40.08 6.24 15 XM_B_SpammyWords2 81094 24.31 38.75 17.58 16 LOC_TINY_FONT_1 72457 26.35 34.62 22.50 17 BAYES_50 70590 50.72 33.73 58.64 18 MIME_HTML_ONLY 70457 25.55 33.67 21.77 19 HTML_FONT_LOW_CONTRAST 67394 27.27 32.20 24.97 20 BAYES_999 67209 13.61 32.12 4.99 21 TR_DCC_Bayes_99 66337 12.11 31.70 2.98 22 T_KAM_HTML_FONT_INVALID 58806 21.28 28.10 18.10 23 DKIM_VALID_EF 58117 27.97 27.77 28.06 24 FVGT_m_MULTI_ODD 57365 24.04 27.41 22.48 25 XMSubLong 47897 21.31 22.89 20.57 26 RELAYCOUNTRY_META 47364 10.53 22.63 4.89 27 RCVD_IN_MSPIKE_WL 43678 26.30 20.87 28.83 28 T_TM2_M_HEADER_IN_MSG 41834 28.30 19.99 32.17 29 RCVD_IN_MSPIKE_H2 38989 19.04 18.63 19.23 30 DCC_CHECK_NEGATIVE 38342 47.33 18.32 60.85 31 XM_Body_Dirty_Words 38281 13.03 18.29 10.58 32 XM_UncommonTLD01 37960 8.10 18.14 3.42 33 UNTRUSTED_Relay 37663 7.00 18.00 1.88 34 FSL_BULK_SIG 32504 8.88 15.53 5.78 35 BOTNET 32366 5.98 15.47 1.56 36 TR_XM_SpammyWords2 30202 5.38 14.43 1.16 37 XM_Multi_Part_URI 29049 12.23 13.88 11.45 38 LOTS_OF_MONEY 28438 8.76 13.59 6.51 39 XM_B_Unsub 26341 10.44 12.59 9.44 40 XM_B_SpammyWords3 25801 6.41 12.33 3.65 41 TR_XM_SpammyWords4 25138 6.45 12.01 3.86 42 RCVD_IN_MSPIKE_H3 23645 14.19 11.30 15.53 43 BOTNET_IPINHOSTNAME 22772 6.46 10.88 4.41 44 HTML_IMAGE_RATIO_02 21927 7.45 10.48 6.03 45 XMSexyCombo_05 21692 5.81 10.37 3.69 46 XM_Evil_Numbers_Gen 20271 8.76 9.69 8.33 47 SpammyFromTLD_02 19596 3.21 9.36 0.34 48 MPART_ALT_DIFF 19545 6.17 9.34 4.70 49 RCVD_IN_BL_SPAMCOP_NET 19441 3.54 9.29 0.86 50 LotsOfNums_01 18910 8.64 9.04 8.46 51 BAYES_80 18789 6.19 8.98 4.89 52 RCVD_IN_MSPIKE_H4 18428 9.93 8.81 10.45 53 UNPARSEABLE_RELAY 18088 7.80 8.64 7.41 54 BAYES_60 17780 8.86 8.50 9.03 55 TR_XM_UnparsRelay 17664 6.88 8.44 6.15 56 KHOP_HELO_FCRDNS 16059 3.60 7.67 1.70 57 MIME_HTML_MOSTLY 15259 3.77 7.29 2.14 58 XM_B_Phish_Phrases 15011 5.33 7.17 4.48 59 XM_SendGrid 14273 6.81 6.82 6.81 60 XMSubMetaSx_00 13818 4.41 6.60 3.39 61 RELAYCOUNTRY_CA 13042 2.89 6.23 1.33 62 XMNumbers 12994 4.20 6.21 3.27 63 HTML_FONT_SIZE_LARGE 12653 2.02 6.05 0.14 64 XM_H_Long_From01 12492 5.78 5.97 5.69 65 URIBL_SBL_A 12444 2.86 5.95 1.42 66 XM_UB50 12388 2.76 5.92 1.28 67 HTML_IMAGE_ONLY_12 12280 2.05 5.87 0.27 68 HTML_SHORT_LINK_IMG_1 12154 1.86 5.81 0.03 69 BODY_URI_ONLY 12108 1.84 5.79 0.00 70 TooManyTo_001 11883 8.44 5.68 9.73 71 XM_OfRef6 11572 2.33 5.53 0.84 72 TR_XM_PhishingBody 11563 3.90 5.53 3.14 73 XM_DK_Undo_01 10994 2.67 5.25 1.46 74 BAYES_95 10846 3.75 5.18 3.09 75 XM_B_SpammyTLD 10835 3.15 5.18 2.20 76 SpammyFromTLD_01 9622 2.03 4.60 0.84 77 HTML_IMAGE_RATIO_04 9387 5.29 4.49 5.67 78 XM_UB99 9243 1.41 4.42 0.00 79 XMDiploma_00 8790 2.88 4.20 2.26 80 TR_XM_DK_SendGrid 8771 4.17 4.19 4.16 81 TR_XM_SpammyWords5 8743 2.38 4.18 1.54 82 RCVD_IN_RP_SAFE 8371 6.24 4.00 7.29 83 TR_XM_MaxBayes 8319 1.28 3.98 0.03 84 HTML_IMAGE_RATIO_06 7908 4.15 3.78 4.33 85 T_REMOTE_IMAGE 7715 3.73 3.69 3.75 86 XMStrtUSub 7670 4.50 3.67 4.88 87 T_FILL_THIS_FORM_SHORT 7390 1.71 3.53 0.86 88 RCVD_IN_PSBL 7307 1.17 3.49 0.08 89 DKIM_INVALID 7156 3.30 3.42 3.25 90 PDS_OTHER_BAD_TLD 7059 1.42 3.37 0.50 91 RCVD_IN_MSPIKE_BL 6910 1.13 3.30 0.12 92 TR_XM_MSPIKECOMBO 6791 1.10 3.25 0.10 93 XM_SPF_SoftFail 6731 2.17 3.22 1.69 94 TR_LOTS_OF_MONEY3 6723 1.16 3.21 0.20 95 RELAYCOUNTRY_FR 6587 1.18 3.15 0.26 96 TM2_M_URI_OPT_OUT 6532 2.63 3.12 2.41 97 HTML_IMAGE_RATIO_08 6496 2.91 3.10 2.82 98 RCVD_IN_RP_CERTIFIED 6408 5.52 3.06 6.66 99 XM_UB999 6266 0.95 2.99 0.00 100 XM_B_Phish66 6250 2.35 2.99 2.05 101 XM_UB60 6188 1.05 2.96 0.17 102 RCVD_IN_RP_RNBL 6182 0.97 2.95 0.04 103 FROM_EXCESS_BASE64 5981 2.63 2.86 2.53 104 BOTNET_NORDNS 5882 0.90 2.81 0.01 105 MIME_QP_LONG_LINE 5786 4.65 2.76 5.52 106 XM_UB80 5761 0.91 2.75 0.05 107 MIME_HTML_ONLY_MULTI 5660 2.90 2.70 3.00 108 URI_PHP_REDIR 5568 0.85 2.66 0.00 109 XM_DIRTYINTL 5566 1.10 2.66 0.38 110 XM_OfRef7 5373 0.93 2.57 0.17 111 T_XMDrugObfuBody_08 5336 1.82 2.55 1.49 112 URI_HEX 5298 1.73 2.53 1.36 113 XM_CamelCaseFrm001 5289 2.14 2.53 1.96 114 TR_XM_FormFill 5227 0.80 2.50 0.01 115 XM_B_Unsub2 5029 1.90 2.40 1.67 116 T_XMDrugObfuBody_14 4921 2.14 2.35 2.03 117 XM_B_COVIDMETA 4909 1.38 2.35 0.94 118 RCVD_IN_MSPIKE_L5 4897 0.79 2.34 0.06 119 RELAYCOUNTRY_DE 4817 1.11 2.30 0.56 120 TR_XM_SB_Phish 4772 2.25 2.28 2.24 121 XM_B_SpammyWords4 4758 0.96 2.27 0.34 122 HTML_IMAGE_ONLY_20 4758 1.20 2.27 0.70 123 SUBJ_ALL_CAPS 4732 2.06 2.26 1.97 124 RELAYCOUNTRY_IN 4713 0.80 2.25 0.12 125 XMSubPhish11 4701 2.22 2.25 2.21 126 T_TooManySym_01 4680 4.28 2.24 5.24 127 TR_XM_SpammyWords3 4652 0.73 2.22 0.03 128 TM2_M_VERY_LONG_WORD 4641 1.48 2.22 1.14 129 RCVD_IN_IADB_LISTED 4485 4.36 2.14 5.39 130 XMBrknScrpt_02 4415 1.06 2.11 0.58 131 XM_DrugUnitList 4251 0.65 2.03 0.00 132 ALIBABA_IMG_NOT_RCVD_ALI 4246 0.65 2.03 0.00 133 XMGenDplmaNmb 4195 1.38 2.00 1.09 134 TR_XM_BayesRelay 4150 0.65 1.98 0.02 135 XMBdyGiftCard01 4134 0.97 1.98 0.50 136 FORGED_GMAIL_RCVD 4062 0.99 1.94 0.54 137 T_XMHurry_00 3972 0.99 1.90 0.57 138 RCVD_IN_IADB_SPF 3922 3.79 1.87 4.68 139 HOSTED_IMG_DIRECT_MX 3743 0.57 1.79 0.00 140 XMBody_17 3697 0.89 1.77 0.48 141 RCVD_IN_IADB_DK 3688 3.27 1.76 3.98 142 RCVD_IN_IADB_SENDERID 3655 3.39 1.75 4.15 143 URIBL_DBL_SPAM 3466 0.53 1.66 0.01 144 TR_Mismatch_TLD_02 3328 0.55 1.59 0.07 145 XM_UB95 3276 0.51 1.57 0.02 146 XMMoneyMeta_00 3255 0.91 1.56 0.60 147 TR_XM_COVIDMETA4 3173 0.71 1.52 0.34 148 T_XMDrugObfuBody_00 3169 0.96 1.51 0.70 149 XMSexyCombo_01 3168 0.71 1.51 0.34 150 XM_URI_RBL 3091 0.56 1.48 0.13 151 XMStockSpam_06 3017 1.31 1.44 1.25 152 HTML_MIME_NO_HTML_TAG 3012 1.92 1.44 2.15 153 URIBL_BLACK 2994 0.48 1.43 0.04 154 DIET_1 2991 0.79 1.43 0.49 155 DATE_IN_PAST_24_48 2925 0.45 1.40 0.00 156 HK_RANDOM_REPLYTO 2911 0.57 1.39 0.18 157 TR_XM_INV_DKIM 2879 0.48 1.38 0.06 158 TR_XM_PHPDW 2844 0.67 1.36 0.35 159 FROM_SUSPICIOUS_NTLD 2843 0.49 1.36 0.08 160 URI_TRY_3LD 2818 1.10 1.35 0.98 161 GOOGLE_DOC_SUSP 2786 0.43 1.33 0.00 162 FROM_SUSPICIOUS_NTLD_FP 2734 0.46 1.31 0.07 163 XMHTML_After_End 2629 1.04 1.26 0.95 164 URI_NOVOWEL 2619 2.20 1.25 2.64 165 RELAYCOUNTRY_CH 2602 0.43 1.24 0.05 166 MAILING_LIST_MULTI 2595 2.17 1.24 2.61 167 BAYES_40 2585 3.23 1.24 4.16 168 TR_XM_PHPForged 2563 0.58 1.22 0.28 169 XMSubMetaI_00 2560 0.82 1.22 0.64 170 XMSubMetaSxObfu_03 2525 0.76 1.21 0.56 171 ALL_TRUSTED 2524 11.49 1.21 16.29 172 HTTPS_HTTP_MISMATCH 2514 0.89 1.20 0.74 173 TR_XM_FormFill2 2512 0.57 1.20 0.28 174 XM_H_PHPOS 2503 0.57 1.20 0.27 175 TR_Caps_n_Bayes_99 2482 0.41 1.19 0.05 176 XM_Body_Dirty_Words_01 2419 0.58 1.16 0.31 177 TR_Symld_Words 2323 1.50 1.11 1.69 178 XMPhish08 2274 0.53 1.09 0.27 179 XM_Body_Obfu01 2238 0.47 1.07 0.19 180 TR_XM_COVIDMETA1 2187 0.60 1.05 0.40 181 DATE_IN_PAST_06_12 2133 0.43 1.02 0.16 182 BAYES_20 2021 2.29 0.97 2.90 183 XMSubMetaSSx_00 2002 0.43 0.96 0.19 184 XMSlimDrugH 1945 0.55 0.93 0.38 185 FONT_INVIS_LONG_LINE 1925 0.39 0.92 0.14 186 TR_MetaPhish_Combo_01 1924 0.82 0.92 0.78 187 T_MONEY_PERCENT 1919 0.42 0.92 0.19 188 TR_LOTS_OF_MONEY2 1919 0.42 0.92 0.19 189 RCVD_IN_IADB_VOUCHED 1882 2.65 0.90 3.47 190 TR_XM_RelayPhish 1852 0.33 0.88 0.07 191 DATE_IN_PAST_12_24 1842 0.34 0.88 0.09 192 HTML_TAG_BALANCE_BODY 1833 0.53 0.88 0.36 193 XM_SPF_Unknown 1820 0.65 0.87 0.55 194 XMHTMLBadTable_001 1805 0.66 0.86 0.56 195 XM_PDF 1798 3.69 0.86 5.00 196 RELAYCOUNTRY_AU 1792 0.53 0.86 0.38 197 XM_JunkDunk 1786 0.27 0.85 0.00 198 XM_H_Long_From02 1782 1.23 0.85 1.41 199 URI_NO_WWW_BIZ_CGI 1751 0.27 0.84 0.01 200 XMSexyCombo_04 1721 0.31 0.82 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 396718 91.06 96.95 88.32 2 RELAYCOUNTRY_US 360630 78.21 73.76 80.28 3 DKIM_SIGNED 326486 76.18 83.70 72.68 4 XM_DK_Pass 321189 74.91 82.23 71.50 5 XM_B_Unicode 318570 73.17 78.00 70.92 6 DKIM_VALID 311886 72.88 80.28 69.43 7 DCC_CHECK_NEGATIVE 273339 47.33 18.32 60.85 8 BAYES_50 263392 50.72 33.73 58.64 9 DKIM_VALID_AU 235864 55.46 61.79 52.51 10 XMListUnsubscribeExists 211057 53.91 68.77 46.99 11 XM_B_SpammyWords 196127 51.11 67.11 43.66 12 XM_B_Unicode3 181397 40.57 40.97 40.38 13 DCC_CHECK 165975 50.58 79.84 36.95 14 T_TM2_M_HEADER_IN_MSG 144494 28.30 19.99 32.17 15 RCVD_IN_MSPIKE_WL 129491 26.30 20.87 28.83 16 DKIM_VALID_EF 126058 27.97 27.77 28.06 17 HTML_FONT_LOW_CONTRAST 112179 27.27 32.20 24.97 18 LOC_TINY_FONT_1 101083 26.35 34.62 22.50 19 FVGT_m_MULTI_ODD 100959 24.04 27.41 22.48 20 MIME_HTML_ONLY 97795 25.55 33.67 21.77 21 XMSubLong 92410 21.31 22.89 20.57 22 RCVD_IN_MSPIKE_H2 86372 19.04 18.63 19.23 23 T_KAM_HTML_FONT_INVALID 81291 21.28 28.10 18.10 24 XM_B_SpammyWords2 78979 24.31 38.75 17.58 25 ALL_TRUSTED 73161 11.49 1.21 16.29 26 RCVD_IN_MSPIKE_H3 69768 14.19 11.30 15.53 27 XM_Multi_Part_URI 51455 12.23 13.88 11.45 28 XM_Body_Dirty_Words 47506 13.03 18.29 10.58 29 RCVD_IN_MSPIKE_H4 46937 9.93 8.81 10.45 30 TooManyTo_001 43693 8.44 5.68 9.73 31 XM_B_Unsub 42405 10.44 12.59 9.44 32 BAYES_00 41828 6.60 0.77 9.31 33 BAYES_60 40566 8.86 8.50 9.03 34 XM_DKIMWhitelistDomains 40201 6.12 0.04 8.95 35 LotsOfNums_01 37995 8.64 9.04 8.46 36 XM_Evil_Numbers_Gen 37431 8.76 9.69 8.33 37 XM_DK_Undo_02 35764 21.36 50.12 7.96 38 UNPARSEABLE_RELAY 33299 7.80 8.64 7.41 39 RCVD_IN_RP_SAFE 32742 6.24 4.00 7.29 40 XM_SendGrid 30598 6.81 6.82 6.81 41 RCVD_IN_RP_CERTIFIED 29913 5.52 3.06 6.66 42 LOTS_OF_MONEY 29244 8.76 13.59 6.51 43 TR_XM_DK_Bayes 28223 4.49 0.65 6.28 44 BAYES_99 28017 16.99 40.08 6.24 45 TR_XM_UnparsRelay 27629 6.88 8.44 6.15 46 TR_XM_DK_Bayes1 27494 4.38 0.64 6.12 47 HTML_IMAGE_RATIO_02 27102 7.45 10.48 6.03 48 FSL_BULK_SIG 25963 8.88 15.53 5.78 49 XM_H_Long_From01 25570 5.78 5.97 5.69 50 HTML_IMAGE_RATIO_04 25453 5.29 4.49 5.67 51 IN_ZIMBRA_NJ_WHITELIST 24982 3.81 0.04 5.56 52 MIME_QP_LONG_LINE 24802 4.65 2.76 5.52 53 TR_XM_DK_Bayes2 24335 3.89 0.62 5.42 54 RCVD_IN_IADB_LISTED 24194 4.36 2.14 5.39 55 TR_XM_DKIM_Undo 23569 16.56 40.83 5.25 56 T_TooManySym_01 23529 4.28 2.24 5.24 57 XM_PDF 22476 3.69 0.86 5.00 58 BAYES_999 22398 13.61 32.12 4.99 59 RELAYCOUNTRY_META 21965 10.53 22.63 4.89 60 BAYES_80 21962 6.19 8.98 4.89 61 XMStrtUSub 21930 4.50 3.67 4.88 62 MPART_ALT_DIFF 21104 6.17 9.34 4.70 63 RCVD_IN_IADB_SPF 21003 3.79 1.87 4.68 64 XM_B_Phish_Phrases 20115 5.33 7.17 4.48 65 BOTNET_IPINHOSTNAME 19793 6.46 10.88 4.41 66 HTML_IMAGE_RATIO_06 19439 4.15 3.78 4.33 67 TR_XM_DK_SendGrid 18699 4.17 4.19 4.16 68 BAYES_40 18694 3.23 1.24 4.16 69 RCVD_IN_IADB_SENDERID 18647 3.39 1.75 4.15 70 RCVD_IN_IADB_DK 17870 3.27 1.76 3.98 71 TR_XM_SpammyWords4 17360 6.45 12.01 3.86 72 XM_H_Trusted_IP 16869 2.56 0.00 3.76 73 T_REMOTE_IMAGE 16837 3.73 3.69 3.75 74 XMSexyCombo_05 16557 5.81 10.37 3.69 75 XM_B_SpammyWords3 16385 6.41 12.33 3.65 76 RCVD_IN_IADB_VOUCHED 15578 2.65 0.90 3.47 77 XM_UncommonTLD01 15370 8.10 18.14 3.42 78 XMSubMetaSx_00 15214 4.41 6.60 3.39 79 XMNumbers 14682 4.20 6.21 3.27 80 DKIM_INVALID 14600 3.30 3.42 3.25 81 TR_XM_PhishingBody 14103 3.90 5.53 3.14 82 BAYES_95 13862 3.75 5.18 3.09 83 MIME_HTML_ONLY_MULTI 13468 2.90 2.70 3.00 84 TR_DCC_Bayes_99 13378 12.11 31.70 2.98 85 BAYES_20 13041 2.29 0.97 2.90 86 RCVD_IN_MSPIKE_H5 12786 2.19 0.77 2.85 87 HTML_IMAGE_RATIO_08 12689 2.91 3.10 2.82 88 URI_NOVOWEL 11850 2.20 1.25 2.64 89 MAILING_LIST_MULTI 11714 2.17 1.24 2.61 90 FROM_EXCESS_BASE64 11362 2.63 2.86 2.53 91 T_TooManySym_02 11270 1.91 0.63 2.51 92 TM2_M_URI_OPT_OUT 10810 2.63 3.12 2.41 93 TooManyTo_002 10579 1.79 0.58 2.36 94 ANY_BOUNCE_MESSAGE 10520 1.72 0.39 2.34 95 BOUNCE_MESSAGE 10518 1.72 0.39 2.34 96 RCVD_IN_IADB_OPTIN 10451 1.77 0.57 2.33 97 XMDiploma_00 10173 2.88 4.20 2.26 98 TR_XM_SB_Phish 10052 2.25 2.28 2.24 99 XMSubPhish11 9925 2.22 2.25 2.21 100 XM_B_SpammyTLD 9879 3.15 5.18 2.20 101 HTML_MIME_NO_HTML_TAG 9644 1.92 1.44 2.15 102 MIME_HTML_MOSTLY 9597 3.77 7.29 2.14 103 XM_B_Phish66 9217 2.35 2.99 2.05 104 T_XMDrugObfuBody_14 9138 2.14 2.35 2.03 105 HELO_NODOT 8873 1.52 0.55 1.98 106 HELO_NO_DOMAIN 8869 1.52 0.54 1.97 107 SUBJ_ALL_CAPS 8841 2.06 2.26 1.97 108 XM_CamelCaseFrm001 8811 2.14 2.53 1.96 109 UNTRUSTED_Relay 8455 7.00 18.00 1.88 110 TVD_RCVD_IP 8102 1.30 0.22 1.80 111 BAYES_05 7836 1.37 0.57 1.74 112 KHOP_HELO_FCRDNS 7619 3.60 7.67 1.70 113 XM_SPF_SoftFail 7588 2.17 3.22 1.69 114 TR_Symld_Words 7587 1.50 1.11 1.69 115 XM_B_Unsub2 7495 1.90 2.40 1.67 116 INVALID_MSGID 7378 1.28 0.50 1.64 117 IN_HORDE_ADDRESS_BOOK 7199 1.12 0.07 1.60 118 TooManyTo_003 7009 1.22 0.48 1.56 119 BOTNET 6993 5.98 15.47 1.56 120 TR_XM_SpammyWords5 6906 2.38 4.18 1.54 121 T_XMDrugObfuBody_08 6677 1.82 2.55 1.49 122 MSGID_NOFQDN1 6637 1.02 0.03 1.48 123 XM_DK_Undo_01 6558 2.67 5.25 1.46 124 XMSubNoVowel 6481 1.17 0.58 1.44 125 URIBL_SBL_A 6372 2.86 5.95 1.42 126 XM_H_Long_From02 6340 1.23 0.85 1.41 127 TO_MALFORMED 6277 0.96 0.03 1.40 128 XMCapTrack 6197 1.05 0.36 1.38 129 URI_HEX 6104 1.73 2.53 1.36 130 RELAYCOUNTRY_CA 5985 2.89 6.23 1.33 131 XM_UB50 5758 2.76 5.92 1.28 132 XMStockSpam_06 5617 1.31 1.44 1.25 133 HELO_MISC_IP 5548 0.89 0.14 1.24 134 XM_GoogleGroups 5319 0.96 0.47 1.18 135 TR_XM_SpammyWords2 5224 5.38 14.43 1.16 136 USER_IN_DEF_DKIM_WL 5181 0.80 0.04 1.15 137 TooManyTo_004 5161 0.92 0.42 1.15 138 TM2_M_VERY_LONG_WORD 5130 1.48 2.22 1.14 139 XMGenDplmaNmb 4915 1.38 2.00 1.09 140 XMBSHREFv2 4843 0.80 0.20 1.08 141 HTML_FONT_FACE_BAD 4835 0.96 0.70 1.08 142 XMGappySubj_01 4771 0.76 0.11 1.06 143 RELAYCOUNTRY_GB 4566 0.95 0.82 1.02 144 DKIM_ADSP_CUSTOM_MED 4475 0.91 0.74 1.00 145 URI_TRY_3LD 4409 1.10 1.35 0.98 146 XMHTML_After_End 4250 1.04 1.26 0.95 147 TooManyTo_005 4242 0.76 0.36 0.94 148 XM_B_COVIDMETA 4204 1.38 2.35 0.94 149 T_FILL_THIS_FORM_SHORT 3875 1.71 3.53 0.86 150 RCVD_IN_BL_SPAMCOP_NET 3865 3.54 9.29 0.86 151 XMBody_95 3804 0.61 0.11 0.85 152 XM_OfRef6 3791 2.33 5.53 0.84 153 SpammyFromTLD_01 3769 2.03 4.60 0.84 154 TR_MSPIKEBAYES00 3593 0.55 0.01 0.80 155 TVD_SPACE_RATIO 3587 0.56 0.06 0.80 156 T_OBFU_PDF_ATTACH 3531 0.59 0.16 0.79 157 TR_MetaPhish_Combo_01 3504 0.82 0.92 0.78 158 HTTPS_HTTP_MISMATCH 3322 0.89 1.20 0.74 159 XM_ProductURIs 3292 0.68 0.56 0.73 160 T_XMDrugObfuBody_00 3160 0.96 1.51 0.70 161 HTML_IMAGE_ONLY_20 3151 1.20 2.27 0.70 162 T_TooManySym_03 3132 0.54 0.20 0.70 163 NML_ADSP_CUSTOM_MED 3053 0.65 0.60 0.68 164 XM_ShortIntro_01 3034 0.54 0.25 0.68 165 RCVD_IN_SORBS_DUL 2993 0.52 0.21 0.67 166 XMSubMetaI_00 2860 0.82 1.22 0.64 167 XMNoVowels 2815 0.60 0.55 0.63 168 TM2_M_BODY_EMPTY 2772 0.44 0.07 0.62 169 XMMoneyMeta_00 2708 0.91 1.56 0.60 170 SHORT_HELO_AND_INLINE_IMAGE 2652 0.42 0.06 0.59 171 PDS_FROM_2_EMAILS 2591 0.42 0.09 0.58 172 XM_H_PHPMailer 2590 0.61 0.68 0.58 173 XMBrknScrpt_02 2583 1.06 2.11 0.58 174 T_XMHurry_00 2557 0.99 1.90 0.57 175 XMHTMLBadTable_001 2532 0.66 0.86 0.56 176 XM_RXBody 2527 0.52 0.42 0.56 177 RELAYCOUNTRY_DE 2523 1.11 2.30 0.56 178 XMSubMetaSxObfu_03 2506 0.76 1.21 0.56 179 XM_SPF_Unknown 2470 0.65 0.87 0.55 180 FORGED_GMAIL_RCVD 2426 0.99 1.94 0.54 181 T_Symld_Words_02 2350 0.59 0.73 0.52 182 XMOemUri 2272 0.44 0.29 0.51 183 PDS_OTHER_BAD_TLD 2266 1.42 3.37 0.50 184 XMBdyGiftCard01 2235 0.97 1.98 0.50 185 FROM_GOV_SPOOF 2220 0.37 0.10 0.49 186 DIET_1 2208 0.79 1.43 0.49 187 HTML_IMAGE_ONLY_32 2171 0.42 0.28 0.48 188 FROM_GOV_DKIM_AU 2156 0.39 0.19 0.48 189 XMBody_17 2153 0.89 1.77 0.48 190 PLING_QUERY 2149 0.47 0.44 0.48 191 RDNS_DYNAMIC 2112 0.57 0.79 0.47 192 XMDateMe_00 2007 0.39 0.28 0.45 193 HTML_IMAGE_ONLY_24 1954 0.37 0.22 0.43 194 XMLngstWrd_00 1947 0.39 0.29 0.43 195 USER_IN_WELCOMELIST 1929 0.29 0.00 0.43 196 USER_IN_WHITELIST 1929 0.29 0.00 0.43 197 HTML_IMAGE_ONLY_28 1924 0.40 0.34 0.43 198 MISSING_HEADERS 1888 0.40 0.36 0.42 199 XMBody_78 1887 0.53 0.77 0.42 200 TR_XM_COVIDMETA1 1779 0.60 1.05 0.40 ----------------------------------------------------------------------