Email: 533335 Autolearn: 0 AvgScore: 1.89 AvgScanTime: 1.33 sec Spam: 133765 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.48 sec Ham: 399570 Autolearn: 0 AvgScore: -2.23 AvgScanTime: 1.28 sec Time Spent Running SA: 196.75 hours Time Spent Processing Spam: 54.85 hours Time Spent Processing Ham: 141.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126136 86.26 94.30 83.56 2 DKIM_SIGNED 111229 74.15 83.15 71.13 3 XM_DK_Pass 106805 72.36 79.85 69.85 4 DKIM_VALID 104053 70.40 77.79 67.93 5 DCC_CHECK 100398 48.81 75.06 40.03 6 XM_B_Unicode 98297 68.05 73.48 66.22 7 RELAYCOUNTRY_US 94254 77.77 70.46 80.21 8 XM_B_SpammyWords 91166 52.42 68.15 47.15 9 XMListUnsubscribeExists 88803 48.47 66.39 42.48 10 DKIM_VALID_AU 77728 53.31 58.11 51.71 11 XM_DK_Undo_02 59065 17.41 44.16 8.45 12 XM_B_Unicode3 53793 39.20 40.21 38.86 13 BAYES_50 52033 49.48 38.90 53.03 14 TR_XM_DKIM_Undo 47881 13.86 35.79 6.51 15 LOC_TINY_FONT_1 47877 24.29 35.79 20.43 16 XM_B_SpammyWords2 47772 22.23 35.71 17.72 17 DKIM_VALID_EF 44094 30.12 32.96 29.17 18 BAYES_99 43612 13.55 32.60 7.18 19 T_KAM_HTML_FONT_INVALID 42666 20.07 31.90 16.11 20 MIME_HTML_ONLY 40587 22.91 30.34 20.43 21 HTML_FONT_LOW_CONTRAST 40486 25.86 30.27 24.38 22 RCVD_IN_MSPIKE_H2 36583 23.79 27.35 22.60 23 FVGT_m_MULTI_ODD 34666 21.99 25.92 20.68 24 BAYES_999 32725 10.38 24.46 5.66 25 RELAYCOUNTRY_META 32567 9.62 24.35 4.69 26 XMSubLong 32342 21.69 24.18 20.86 27 TR_DCC_Bayes_99 31149 8.55 23.29 3.62 28 DCC_CHECK_NEGATIVE 29620 48.69 22.14 57.58 29 UNTRUSTED_Relay 28386 7.04 21.22 2.29 30 T_TM2_M_HEADER_IN_MSG 27269 26.76 20.39 28.89 31 XM_Body_Dirty_Words 26367 12.57 19.71 10.18 32 BOTNET 26241 6.04 19.62 1.50 33 RCVD_IN_MSPIKE_WL 25990 28.75 19.43 31.88 34 XM_UncommonTLD01 25069 7.31 18.74 3.49 35 MPART_ALT_DIFF 20541 8.23 15.36 5.84 36 XM_Multi_Part_URI 19527 11.37 14.60 10.29 37 FSL_BULK_SIG 18851 8.89 14.09 7.14 38 XM_B_Unsub 18261 10.94 13.65 10.04 39 LOTS_OF_MONEY 17301 8.23 12.93 6.65 40 BOTNET_IPINHOSTNAME 16915 6.14 12.65 3.96 41 MIME_HTML_MOSTLY 16101 4.86 12.04 2.45 42 XM_B_SpammyWords3 15452 6.22 11.55 4.43 43 TR_XM_SpammyWords2 15128 3.57 11.31 0.97 44 XMSexyCombo_05 15032 5.21 11.24 3.20 45 TR_XM_SpammyWords4 14756 5.73 11.03 3.96 46 RCVD_IN_MSPIKE_H3 13923 13.62 10.41 14.70 47 UNPARSEABLE_RELAY 13192 7.22 9.86 6.33 48 BAYES_80 13177 6.64 9.85 5.57 49 TR_XM_UnparsRelay 13001 6.36 9.72 5.23 50 RCVD_IN_BL_SPAMCOP_NET 12316 2.90 9.21 0.79 51 SpammyFromTLD_01 12171 2.80 9.10 0.69 52 XMSubMetaSx_00 11552 4.99 8.64 3.77 53 BAYES_60 11518 9.02 8.61 9.16 54 XM_Evil_Numbers_Gen 10739 7.75 8.03 7.66 55 RCVD_IN_MSPIKE_H4 10733 10.94 8.02 11.91 56 LotsOfNums_01 10565 8.14 7.90 8.22 57 HTML_IMAGE_RATIO_02 10272 5.69 7.68 5.03 58 SpammyFromTLD_02 9932 2.19 7.42 0.43 59 XM_SendGrid 9575 5.82 7.16 5.37 60 HTML_MIME_NO_HTML_TAG 9469 3.44 7.08 2.22 61 XM_UB50 9229 2.74 6.90 1.34 62 RELAYCOUNTRY_FR 9214 1.94 6.89 0.28 63 XM_B_Phish_Phrases 9190 8.16 6.87 8.59 64 TR_XM_PhishingBody 8833 4.75 6.60 4.13 65 TooManyTo_001 7888 7.78 5.90 8.41 66 T_REMOTE_IMAGE 7688 4.39 5.75 3.94 67 BAYES_95 7669 4.23 5.73 3.72 68 XM_H_Long_From01 7348 5.05 5.49 4.90 69 DKIM_INVALID 7176 3.75 5.36 3.21 70 URIBL_SBL_A 7104 1.51 5.31 0.24 71 XM_B_SpammyTLD 6791 2.58 5.08 1.75 72 RCVD_IN_MSPIKE_BL 6427 1.83 4.80 0.83 73 KHOP_HELO_FCRDNS 6424 2.35 4.80 1.53 74 HTML_IMAGE_RATIO_04 6368 5.68 4.76 5.99 75 XMNumbers 6008 3.49 4.49 3.15 76 RCVD_IN_RP_RNBL 5912 1.13 4.42 0.03 77 TR_XM_MSPIKECOMBO 5875 1.37 4.39 0.36 78 RELAYCOUNTRY_CA 5840 2.01 4.37 1.22 79 URI_PHP_REDIR 5655 1.06 4.23 0.00 80 XM_UB99 5543 1.04 4.14 0.00 81 T_HTML_TAG_BALANCE_CENTER 5513 1.12 4.12 0.11 82 XM_SPF_SoftFail 5326 2.33 3.98 1.78 83 BODY_URI_ONLY 5326 1.01 3.98 0.01 84 TR_XM_DK_SendGrid 5290 3.48 3.95 3.33 85 XM_B_Phish66 5257 2.75 3.93 2.35 86 HTML_IMAGE_ONLY_08 4991 1.01 3.73 0.10 87 MIME_QP_LONG_LINE 4975 4.55 3.72 4.83 88 XM_UB80 4937 0.95 3.69 0.04 89 HTML_FONT_SIZE_LARGE 4895 0.97 3.66 0.08 90 TR_XM_SpammyWords5 4822 2.01 3.60 1.47 91 T_XMDrugObfuBody_14 4763 2.67 3.56 2.38 92 GOOG_STO_IMG_HTML 4604 0.86 3.44 0.00 93 RCVD_IN_RP_SAFE 4600 5.55 3.44 6.25 94 XM_UB60 4566 0.96 3.41 0.14 95 TM2_M_URI_OPT_OUT 4559 3.13 3.41 3.04 96 T_XMDrugObfuBody_08 4470 2.02 3.34 1.58 97 MIME_HTML_ONLY_MULTI 4430 3.81 3.31 3.98 98 HTML_IMAGE_RATIO_06 4427 3.66 3.31 3.78 99 BOTNET_NORDNS 4347 0.83 3.25 0.01 100 ALL_TRUSTED 4122 12.90 3.08 16.19 101 XMStrtUSub 3984 7.32 2.98 8.77 102 TR_XM_SpammyWords3 3935 0.97 2.94 0.31 103 MIXED_FONT_CASE 3830 0.72 2.86 0.00 104 MIXED_HREF_CASE 3829 0.72 2.86 0.00 105 MIXED_IMG_CASE 3825 0.72 2.86 0.00 106 XM_OfRef6 3688 1.40 2.76 0.95 107 PDS_OTHER_BAD_TLD 3651 0.81 2.73 0.17 108 XM_B_COVIDMETA 3600 1.25 2.69 0.77 109 XM_DIRTYINTL 3564 0.95 2.66 0.38 110 HTML_IMAGE_RATIO_08 3545 2.11 2.65 1.92 111 XMSexyCombo_01 3515 1.03 2.63 0.50 112 XMDiploma_00 3412 1.69 2.55 1.41 113 TR_XM_SB_Phish 3402 2.24 2.54 2.14 114 RCVD_IN_RP_CERTIFIED 3391 4.80 2.54 5.56 115 RCVD_IN_IADB_LISTED 3388 4.59 2.53 5.28 116 RCVD_IN_PSBL 3363 0.71 2.51 0.11 117 TM2_M_VERY_LONG_WORD 3339 1.51 2.50 1.18 118 XMSubPhish11 3327 2.20 2.49 2.11 119 XM_UB95 3258 0.63 2.44 0.02 120 XM_DK_Undo_01 3228 1.80 2.41 1.60 121 T_TooManySym_01 3227 4.62 2.41 5.37 122 XM_UB999 3141 0.59 2.35 0.00 123 FROM_EXCESS_BASE64 3113 2.50 2.33 2.56 124 XM_CamelCaseFrm001 3106 1.80 2.32 1.63 125 RCVD_IN_IADB_SPF 2998 3.96 2.24 4.53 126 RCVD_IN_MSPIKE_L5 2872 0.59 2.15 0.07 127 RCVD_IN_IADB_DK 2824 3.40 2.11 3.83 128 RCVD_IN_IADB_SENDERID 2812 3.50 2.10 3.97 129 URI_NO_WWW_BIZ_CGI 2807 0.54 2.10 0.01 130 SUBJ_ALL_CAPS 2779 1.82 2.08 1.73 131 T_XMDrugObfuBody_00 2689 1.20 2.01 0.92 132 TR_XM_COVIDMETA1 2683 0.92 2.01 0.56 133 URIBL_DBL_SPAM 2637 0.50 1.97 0.00 134 XM_URI_RBL 2616 0.59 1.96 0.14 135 XM_B_Unsub2 2609 1.56 1.95 1.43 136 TR_XM_COVIDMETA4 2539 0.76 1.90 0.38 137 XMBrknScrpt_02 2524 1.21 1.89 0.98 138 XM_BadFromFormat 2439 0.57 1.82 0.15 139 RCVD_IN_MSPIKE_L4 2437 0.61 1.82 0.21 140 TR_XM_PHPDW 2425 0.65 1.81 0.26 141 MAILING_LIST_MULTI 2424 2.66 1.81 2.95 142 RELAYCOUNTRY_IN 2409 0.53 1.80 0.10 143 XMGenDplmaNmb 2391 1.17 1.79 0.96 144 TR_Symld_Words 2378 1.94 1.78 1.99 145 XMBody_17 2375 0.74 1.78 0.39 146 XMSubMetaSSxObfu_00 2329 0.47 1.74 0.04 147 TR_XM_PHPForged 2305 0.60 1.72 0.22 148 TM2_M_BODY_EMPTY 2304 0.82 1.72 0.52 149 URI_HEX 2297 1.57 1.72 1.51 150 TR_XM_FormFill2 2290 0.60 1.71 0.22 151 TR_LOTS_OF_MONEY3 2290 0.54 1.71 0.15 152 BAYES_40 2288 4.00 1.71 4.76 153 XM_H_PHPOS 2279 0.59 1.70 0.21 154 URIBL_BLACK 2253 0.45 1.68 0.03 155 XMEmptyBody_01 2237 0.51 1.67 0.13 156 XMMoneyMeta_00 2185 0.83 1.63 0.56 157 TR_XM_MaxBayes 2182 0.41 1.63 0.00 158 URI_NOVOWEL 2169 2.57 1.62 2.89 159 T_FILL_THIS_FORM_SHORT 2125 0.99 1.59 0.78 160 XM_B_SpammyWords4 2069 0.60 1.55 0.29 161 T_Symld_Words_02 2048 0.81 1.53 0.57 162 URI_NO_WWW_INFO_CGI 2014 0.39 1.51 0.02 163 TR_Sbj_FN_Bdy 1959 0.48 1.46 0.15 164 XMStockSpam_06 1953 0.97 1.46 0.81 165 URI_TRY_3LD 1945 1.08 1.45 0.95 166 XM_Body_Dirty_Words_01 1914 0.48 1.43 0.16 167 USER_IN_DEF_DKIM_WL 1902 8.69 1.42 11.13 168 RELAYCOUNTRY_GB 1889 0.97 1.41 0.82 169 BODY_EMPTY 1787 0.35 1.34 0.02 170 TR_XM_BayesRelay 1733 0.33 1.30 0.01 171 XM_H_Long_From02 1733 0.97 1.30 0.87 172 RELAYCOUNTRY_DE 1713 0.73 1.28 0.54 173 XMSubEmpty 1647 0.48 1.23 0.23 174 TR_Mismatch_TLD_02 1617 0.36 1.21 0.07 175 XMPhish30 1590 0.76 1.19 0.62 176 FROM_SUSPICIOUS_NTLD 1587 0.33 1.19 0.04 177 TR_XM_INV_DKIM 1581 0.42 1.18 0.17 178 HTTPS_HTTP_MISMATCH 1560 0.79 1.17 0.66 179 XMSexyCombo_04 1538 0.41 1.15 0.16 180 XM_PDF 1536 4.10 1.15 5.09 181 MISSING_SUBJECT 1519 0.35 1.14 0.08 182 XMNoSubject 1519 0.35 1.14 0.08 183 FROM_SUSPICIOUS_NTLD_FP 1509 0.31 1.13 0.03 184 XMBdyGiftCard01 1494 0.78 1.12 0.67 185 BAYES_20 1473 3.42 1.10 4.19 186 TR_Mismatch_TLD_01 1410 0.51 1.05 0.33 187 RCVD_IN_IADB_VOUCHED 1375 2.81 1.03 3.41 188 DKIM_ADSP_CUSTOM_MED 1373 0.96 1.03 0.94 189 XMSubMetaSxObfu_03 1362 0.54 1.02 0.38 190 ADVANCE_FEE_3_NEW_MONEY 1342 0.25 1.00 0.00 191 RCVD_IN_MSPIKE_H5 1334 4.20 1.00 5.27 192 MONEY_FRAUD_5 1312 0.25 0.98 0.00 193 XM_JunkDunk 1308 0.25 0.98 0.00 194 RELAYCOUNTRY_IR 1305 0.25 0.98 0.00 195 XM_B_SEO 1300 0.33 0.97 0.12 196 HTML_FONT_FACE_BAD 1294 1.52 0.97 1.71 197 LongTLD 1288 0.34 0.96 0.13 198 RELAYCOUNTRY_AU 1284 0.46 0.96 0.30 199 T_XMHurry_00 1251 0.53 0.94 0.39 200 XMSubNoVowel 1197 1.47 0.89 1.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333894 86.26 94.30 83.56 2 RELAYCOUNTRY_US 320507 77.77 70.46 80.21 3 DKIM_SIGNED 284232 74.15 83.15 71.13 4 XM_DK_Pass 279105 72.36 79.85 69.85 5 DKIM_VALID 271422 70.40 77.79 67.93 6 XM_B_Unicode 264613 68.05 73.48 66.22 7 DCC_CHECK_NEGATIVE 230084 48.69 22.14 57.58 8 BAYES_50 211879 49.48 38.90 53.03 9 DKIM_VALID_AU 206600 53.31 58.11 51.71 10 XM_B_SpammyWords 188411 52.42 68.15 47.15 11 XMListUnsubscribeExists 169722 48.47 66.39 42.48 12 DCC_CHECK 159949 48.81 75.06 40.03 13 XM_B_Unicode3 155260 39.20 40.21 38.86 14 RCVD_IN_MSPIKE_WL 127366 28.75 19.43 31.88 15 DKIM_VALID_EF 116538 30.12 32.96 29.17 16 T_TM2_M_HEADER_IN_MSG 115436 26.76 20.39 28.89 17 HTML_FONT_LOW_CONTRAST 97424 25.86 30.27 24.38 18 RCVD_IN_MSPIKE_H2 90284 23.79 27.35 22.60 19 XMSubLong 83353 21.69 24.18 20.86 20 FVGT_m_MULTI_ODD 82631 21.99 25.92 20.68 21 LOC_TINY_FONT_1 81644 24.29 35.79 20.43 22 MIME_HTML_ONLY 81617 22.91 30.34 20.43 23 XM_B_SpammyWords2 70788 22.23 35.71 17.72 24 ALL_TRUSTED 64685 12.90 3.08 16.19 25 T_KAM_HTML_FONT_INVALID 64381 20.07 31.90 16.11 26 RCVD_IN_MSPIKE_H3 58724 13.62 10.41 14.70 27 RCVD_IN_MSPIKE_H4 47599 10.94 8.02 11.91 28 XM_DKIMWhitelistDomains 47129 8.84 0.01 11.79 29 USER_IN_DEF_DKIM_WL 44458 8.69 1.42 11.13 30 XM_Multi_Part_URI 41107 11.37 14.60 10.29 31 BAYES_00 40688 7.84 0.86 10.18 32 XM_Body_Dirty_Words 40665 12.57 19.71 10.18 33 XM_B_Unsub 40104 10.94 13.65 10.04 34 BAYES_60 36615 9.02 8.61 9.16 35 XMStrtUSub 35054 7.32 2.98 8.77 36 XM_B_Phish_Phrases 34330 8.16 6.87 8.59 37 XM_DK_Undo_02 33771 17.41 44.16 8.45 38 TooManyTo_001 33595 7.78 5.90 8.41 39 LotsOfNums_01 32833 8.14 7.90 8.22 40 XM_Evil_Numbers_Gen 30592 7.75 8.03 7.66 41 BAYES_99 28681 13.55 32.60 7.18 42 FSL_BULK_SIG 28543 8.89 14.09 7.14 43 LOTS_OF_MONEY 26576 8.23 12.93 6.65 44 TR_XM_DKIM_Undo 26029 13.86 35.79 6.51 45 UNPARSEABLE_RELAY 25309 7.22 9.86 6.33 46 RCVD_IN_RP_SAFE 24981 5.55 3.44 6.25 47 HTML_IMAGE_RATIO_04 23923 5.68 4.76 5.99 48 MPART_ALT_DIFF 23348 8.23 15.36 5.84 49 BAYES_999 22629 10.38 24.46 5.66 50 TR_XM_DK_Bayes 22599 4.38 0.57 5.66 51 XM_H_Trusted_IP 22589 4.24 0.00 5.65 52 BAYES_80 22241 6.64 9.85 5.57 53 RCVD_IN_RP_CERTIFIED 22203 4.80 2.54 5.56 54 TR_XM_DK_Bayes1 21846 4.23 0.55 5.47 55 T_TooManySym_01 21439 4.62 2.41 5.37 56 XM_SendGrid 21439 5.82 7.16 5.37 57 RCVD_IN_IADB_LISTED 21111 4.59 2.53 5.28 58 RCVD_IN_MSPIKE_H5 21043 4.20 1.00 5.27 59 TR_XM_UnparsRelay 20914 6.36 9.72 5.23 60 XM_PDF 20332 4.10 1.15 5.09 61 HTML_IMAGE_RATIO_02 20100 5.69 7.68 5.03 62 IN_ZIMBRA_NJ_WHITELIST 19580 3.69 0.06 4.90 63 XM_H_Long_From01 19565 5.05 5.49 4.90 64 MIME_QP_LONG_LINE 19318 4.55 3.72 4.83 65 TR_XM_DK_Bayes2 19270 3.73 0.47 4.82 66 BAYES_40 19028 4.00 1.71 4.76 67 RELAYCOUNTRY_META 18749 9.62 24.35 4.69 68 RCVD_IN_IADB_SPF 18110 3.96 2.24 4.53 69 XM_B_SpammyWords3 17701 6.22 11.55 4.43 70 BAYES_20 16749 3.42 1.10 4.19 71 TR_XM_PhishingBody 16508 4.75 6.60 4.13 72 MIME_HTML_ONLY_MULTI 15896 3.81 3.31 3.98 73 RCVD_IN_IADB_SENDERID 15881 3.50 2.10 3.97 74 BOTNET_IPINHOSTNAME 15835 6.14 12.65 3.96 75 TR_XM_SpammyWords4 15825 5.73 11.03 3.96 76 T_REMOTE_IMAGE 15740 4.39 5.75 3.94 77 RCVD_IN_IADB_DK 15298 3.40 2.11 3.83 78 HTML_IMAGE_RATIO_06 15105 3.66 3.31 3.78 79 XMSubMetaSx_00 15068 4.99 8.64 3.77 80 BAYES_95 14876 4.23 5.73 3.72 81 TR_DCC_Bayes_99 14469 8.55 23.29 3.62 82 XM_UncommonTLD01 13930 7.31 18.74 3.49 83 RCVD_IN_IADB_VOUCHED 13637 2.81 1.03 3.41 84 TR_XM_DK_SendGrid 13286 3.48 3.95 3.33 85 DKIM_INVALID 12810 3.75 5.36 3.21 86 XMSexyCombo_05 12776 5.21 11.24 3.20 87 XMNumbers 12598 3.49 4.49 3.15 88 TM2_M_URI_OPT_OUT 12158 3.13 3.41 3.04 89 MAILING_LIST_MULTI 11773 2.66 1.81 2.95 90 ANY_BOUNCE_MESSAGE 11616 2.40 0.88 2.91 91 BOUNCE_MESSAGE 11610 2.40 0.88 2.91 92 URI_NOVOWEL 11542 2.57 1.62 2.89 93 T_TooManySym_02 10599 2.19 0.79 2.65 94 FROM_EXCESS_BASE64 10219 2.50 2.33 2.56 95 MIME_HTML_MOSTLY 9808 4.86 12.04 2.45 96 T_XMDrugObfuBody_14 9502 2.67 3.56 2.38 97 TooManyTo_002 9490 2.00 0.87 2.38 98 XM_B_Phish66 9385 2.75 3.93 2.35 99 UNTRUSTED_Relay 9158 7.04 21.22 2.29 100 RCVD_IN_IADB_OPTIN 8982 1.87 0.73 2.25 101 HTML_MIME_NO_HTML_TAG 8889 3.44 7.08 2.22 102 BAYES_05 8811 1.81 0.63 2.21 103 TR_XM_SB_Phish 8535 2.24 2.54 2.14 104 HELO_NODOT 8508 1.78 0.72 2.13 105 HELO_NO_DOMAIN 8502 1.77 0.72 2.13 106 XMSubPhish11 8418 2.20 2.49 2.11 107 TR_Symld_Words 7971 1.94 1.78 1.99 108 HTML_IMAGE_RATIO_08 7684 2.11 2.65 1.92 109 INVALID_MSGID 7226 1.49 0.54 1.81 110 IN_HORDE_ADDRESS_BOOK 7170 1.37 0.09 1.79 111 XM_SPF_SoftFail 7121 2.33 3.98 1.78 112 XM_B_SpammyTLD 6978 2.58 5.08 1.75 113 SUBJ_ALL_CAPS 6919 1.82 2.08 1.73 114 HTML_FONT_FACE_BAD 6830 1.52 0.97 1.71 115 XMSubNoVowel 6667 1.47 0.89 1.67 116 XM_CamelCaseFrm001 6502 1.80 2.32 1.63 117 XM_DK_Undo_01 6391 1.80 2.41 1.60 118 T_XMDrugObfuBody_08 6317 2.02 3.34 1.58 119 TO_MALFORMED 6289 1.18 0.02 1.57 120 TooManyTo_003 6266 1.35 0.70 1.57 121 KHOP_HELO_FCRDNS 6133 2.35 4.80 1.53 122 URI_HEX 6052 1.57 1.72 1.51 123 BOTNET 5978 6.04 19.62 1.50 124 TR_XM_SpammyWords5 5876 2.01 3.60 1.47 125 MISSING_HEADERS 5806 1.21 0.49 1.45 126 XM_B_Unsub2 5700 1.56 1.95 1.43 127 TVD_RCVD_IP 5661 1.12 0.22 1.42 128 XMDiploma_00 5617 1.69 2.55 1.41 129 XM_UB50 5358 2.74 6.90 1.34 130 XM_GoogleGroups 5243 1.13 0.61 1.31 131 TR_MetaPhish_Combo_01 4954 1.15 0.86 1.24 132 XMCapTrack 4930 1.05 0.50 1.23 133 XMHTML_After_End 4904 1.11 0.74 1.23 134 XMGappySubj_01 4903 0.96 0.15 1.23 135 RELAYCOUNTRY_CA 4871 2.01 4.37 1.22 136 TM2_M_VERY_LONG_WORD 4728 1.51 2.50 1.18 137 HTML_IMAGE_ONLY_20 4568 0.96 0.40 1.14 138 TooManyTo_004 4470 0.99 0.61 1.12 139 XMBrknScrpt_02 3918 1.21 1.89 0.98 140 TR_XM_SpammyWords2 3887 3.57 11.31 0.97 141 XMGenDplmaNmb 3834 1.17 1.79 0.96 142 XM_OfRef6 3799 1.40 2.76 0.95 143 URI_TRY_3LD 3790 1.08 1.45 0.95 144 DKIM_ADSP_CUSTOM_MED 3738 0.96 1.03 0.94 145 TooManyTo_005 3693 0.82 0.52 0.92 146 T_XMDrugObfuBody_00 3687 1.20 2.01 0.92 147 XMPhish14 3635 0.82 0.57 0.91 148 XM_H_Long_From02 3458 0.97 1.30 0.87 149 RCVD_IN_MSPIKE_BL 3335 1.83 4.80 0.83 150 XMBSHREFv2 3311 0.69 0.29 0.83 151 RELAYCOUNTRY_GB 3268 0.97 1.41 0.82 152 XMStockSpam_06 3240 0.97 1.46 0.81 153 RCVD_IN_BL_SPAMCOP_NET 3158 2.90 9.21 0.79 154 XM_H_SpoofStaff4 3147 0.61 0.06 0.79 155 T_FILL_THIS_FORM_SHORT 3133 0.99 1.59 0.78 156 XM_B_COVIDMETA 3082 1.25 2.69 0.77 157 FROM_GOV_SPOOF 3079 0.66 0.33 0.77 158 T_TooManySym_03 3065 0.63 0.21 0.77 159 XMNoVowels 2970 0.73 0.70 0.74 160 XM_SPF_Unknown 2852 0.74 0.82 0.71 161 SpammyFromTLD_01 2776 2.80 9.10 0.69 162 XM_ProductURIs 2767 0.69 0.67 0.69 163 T_OBFU_PDF_ATTACH 2758 0.57 0.19 0.69 164 XMBody_95 2740 0.56 0.20 0.69 165 XMBdyGiftCard01 2664 0.78 1.12 0.67 166 HTTPS_HTTP_MISMATCH 2631 0.79 1.17 0.66 167 XM_H_PHPMailer 2622 0.71 0.89 0.66 168 TR_XM_PhishingBody2 2532 0.57 0.38 0.63 169 TVD_SPACE_RATIO_MINFP 2529 0.68 0.84 0.63 170 XMPhish30 2478 0.76 1.19 0.62 171 MSGID_NOFQDN1 2446 0.47 0.03 0.61 172 XMLngstWrd_00 2407 0.61 0.62 0.60 173 XMSUPPORT 2401 0.45 0.00 0.60 174 XM_ShortIntro_01 2284 0.55 0.50 0.57 175 T_Symld_Words_02 2261 0.81 1.53 0.57 176 XMMoneyMeta_00 2247 0.83 1.63 0.56 177 TR_XM_COVIDMETA1 2231 0.92 2.01 0.56 178 NML_ADSP_CUSTOM_MED 2204 0.60 0.76 0.55 179 RCVD_IN_SORBS_DUL 2182 0.46 0.21 0.55 180 RELAYCOUNTRY_DE 2160 0.73 1.28 0.54 181 FORGED_GMAIL_RCVD 2150 0.62 0.88 0.54 182 DKIM_ADSP_NXDOMAIN 2086 0.57 0.70 0.52 183 FROM_GOV_DKIM_AU 2078 0.41 0.09 0.52 184 XMLngstWrd_01 2065 0.53 0.56 0.52 185 TM2_M_BODY_EMPTY 2063 0.82 1.72 0.52 186 XM_B_COPY_HTML 2060 0.57 0.74 0.52 187 TR_MSPIKEBAYES00 2059 0.39 0.01 0.52 188 XMSexyCombo_01 1990 1.03 2.63 0.50 189 HTML_TAG_BALANCE_BODY 1986 0.55 0.69 0.50 190 XMHTMLBadTable_001 1968 0.58 0.83 0.49 191 SHORT_HELO_AND_INLINE_IMAGE 1918 0.39 0.13 0.48 192 RCVD_IN_MSPIKE_ZBI 1889 0.46 0.41 0.47 193 TVD_SPACE_RATIO 1884 0.48 0.49 0.47 194 REPLYTO_WITHOUT_TO_CC 1846 0.39 0.17 0.46 195 DIET_1 1774 0.51 0.70 0.44 196 RELAYCOUNTRY_NG_I 1755 0.34 0.05 0.44 197 XM_B_REG_HTML 1748 0.43 0.41 0.44 198 XMSubMetaI_00 1740 0.51 0.74 0.44 199 SpammyFromTLD_02 1724 2.19 7.42 0.43 200 NO_DNS_FOR_FROM 1684 0.44 0.50 0.42 ----------------------------------------------------------------------