Email: 484902 Autolearn: 0 AvgScore: 2.70 AvgScanTime: 1.35 sec Spam: 122824 Autolearn: 0 AvgScore: 14.87 AvgScanTime: 1.57 sec Ham: 362078 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.27 sec Time Spent Running SA: 181.18 hours Time Spent Processing Spam: 53.73 hours Time Spent Processing Ham: 127.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117805 89.56 95.91 87.40 2 DKIM_SIGNED 102089 74.14 83.12 71.10 3 DCC_CHECK 97417 49.37 79.31 39.21 4 XM_DK_Pass 97237 72.14 79.17 69.75 5 RELAYCOUNTRY_US 95844 79.88 78.03 80.51 6 DKIM_VALID 94517 70.16 76.95 67.86 7 XM_B_Unicode 94178 71.30 76.68 69.48 8 XMListUnsubscribeExists 83189 52.19 67.73 46.91 9 XM_B_SpammyWords 81140 50.54 66.06 45.27 10 DKIM_VALID_AU 69270 52.11 56.40 50.65 11 XM_B_Unicode3 52749 41.58 42.95 41.12 12 XM_DK_Undo_02 52561 16.95 42.79 8.19 13 BAYES_50 50576 51.70 41.18 55.27 14 XM_B_SpammyWords2 45643 23.70 37.16 19.13 15 LOC_TINY_FONT_1 43375 26.55 35.31 23.57 16 MIME_HTML_ONLY 42085 25.75 34.26 22.86 17 TR_XM_DKIM_Undo 40893 12.70 33.29 5.71 18 HTML_FONT_LOW_CONTRAST 40597 27.79 33.05 26.01 19 BAYES_99 38728 12.63 31.53 6.22 20 T_KAM_HTML_FONT_INVALID 38046 21.68 30.98 18.53 21 DKIM_VALID_EF 37905 26.74 30.86 25.34 22 RCVD_IN_MSPIKE_H2 34476 25.10 28.07 24.09 23 FVGT_m_MULTI_ODD 34067 23.74 27.74 22.39 24 XMSubLong 30852 22.48 25.12 21.59 25 TR_DCC_Bayes_99 30673 8.55 24.97 2.98 26 BAYES_999 29289 9.82 23.85 5.06 27 XM_Body_Dirty_Words 28770 14.44 23.42 11.40 28 T_TM2_M_HEADER_IN_MSG 26410 28.98 21.50 31.51 29 DCC_CHECK_NEGATIVE 25363 50.59 20.65 60.75 30 RELAYCOUNTRY_META 24400 7.94 19.87 3.90 31 RCVD_IN_MSPIKE_WL 24282 26.38 19.77 28.63 32 BOTNET 21667 5.65 17.64 1.58 33 XM_UncommonTLD01 21621 6.99 17.60 3.39 34 FSL_BULK_SIG 20159 10.18 16.41 8.06 35 XM_Multi_Part_URI 19606 12.08 15.96 10.76 36 UNTRUSTED_Relay 18605 4.91 15.15 1.44 37 BOTNET_IPINHOSTNAME 17217 6.78 14.02 4.33 38 XMSexyCombo_05 16378 6.10 13.33 3.65 39 XM_B_Unsub 16234 11.38 13.22 10.75 40 LOTS_OF_MONEY 15025 8.31 12.23 6.98 41 XM_B_SpammyWords3 14824 6.27 12.07 4.30 42 MPART_ALT_DIFF 14240 8.34 11.59 7.24 43 TR_XM_SpammyWords2 13838 3.60 11.27 1.00 44 UNPARSEABLE_RELAY 13481 8.31 10.98 7.40 45 TR_XM_UnparsRelay 13245 7.18 10.78 5.95 46 TR_XM_SpammyWords4 13033 5.92 10.61 4.33 47 RCVD_IN_MSPIKE_H3 12183 13.76 9.92 15.07 48 SpammyFromTLD_02 11578 2.76 9.43 0.50 49 XM_Evil_Numbers_Gen 11346 8.65 9.24 8.45 50 XMSubMetaSx_00 11316 6.05 9.21 4.97 51 BAYES_80 10769 5.61 8.77 4.54 52 HTML_MIME_NO_HTML_TAG 10427 3.90 8.49 2.35 53 BAYES_60 10309 8.95 8.39 9.14 54 T_REMOTE_IMAGE 10171 4.89 8.28 3.74 55 RCVD_IN_MSPIKE_H4 9952 10.06 8.10 10.72 56 LotsOfNums_01 9580 8.98 7.80 9.38 57 XM_B_Phish_Phrases 9447 5.49 7.69 4.74 58 HTML_IMAGE_RATIO_02 9294 6.38 7.57 5.98 59 TR_XM_PhishingBody 9259 4.56 7.54 3.56 60 XM_SendGrid 9019 6.32 7.34 5.98 61 RCVD_IN_BL_SPAMCOP_NET 8988 2.54 7.32 0.92 62 MIME_HTML_MOSTLY 8826 3.66 7.19 2.47 63 KHOP_HELO_FCRDNS 8579 2.94 6.98 1.57 64 HTML_IMAGE_ONLY_08 7895 1.71 6.43 0.11 65 DKIM_INVALID 7572 3.98 6.16 3.24 66 HTML_TAG_BALANCE_CENTER 7531 1.61 6.13 0.08 67 GOOG_STO_IMG_HTML 7456 1.54 6.07 0.00 68 XM_UB50 7433 2.26 6.05 0.98 69 SpammyFromTLD_01 7368 2.07 6.00 0.73 70 XM_H_Long_From01 7154 5.31 5.82 5.13 71 TooManyTo_001 6840 7.76 5.57 8.51 72 RCVD_IN_MSPIKE_BL 6740 1.70 5.49 0.42 73 HTML_IMAGE_RATIO_04 6639 6.33 5.41 6.64 74 MIXED_CENTER_CASE 6503 1.34 5.29 0.00 75 MIXED_HREF_CASE 6364 1.31 5.18 0.00 76 TR_XM_MSPIKECOMBO 6200 1.57 5.05 0.38 77 MIXED_IMG_CASE 6113 1.26 4.98 0.00 78 MIXED_AREA_CASE 6112 1.26 4.98 0.00 79 BAYES_95 6095 3.27 4.96 2.69 80 URI_NOVOWEL 6045 3.45 4.92 2.96 81 XMNumbers 5990 3.56 4.88 3.11 82 MIXED_FONT_CASE 5912 1.22 4.81 0.00 83 XM_B_SpammyTLD 5896 2.67 4.80 1.94 84 BODY_URI_ONLY 5693 1.19 4.64 0.02 85 MIME_QP_LONG_LINE 5662 5.27 4.61 5.50 86 HTML_FONT_SIZE_LARGE 5540 1.22 4.51 0.10 87 XM_B_Phish66 5343 2.70 4.35 2.14 88 MIME_HTML_ONLY_MULTI 5259 5.08 4.28 5.35 89 RELAYCOUNTRY_CA 5070 1.80 4.13 1.01 90 JH_SPAMMY_HEADERS 4793 0.99 3.90 0.00 91 TM2_M_URI_OPT_OUT 4783 3.79 3.89 3.76 92 XM_SPF_SoftFail 4767 2.44 3.88 1.95 93 TR_XM_DK_SendGrid 4676 3.82 3.81 3.83 94 RCVD_IN_RP_SAFE 4672 6.14 3.80 6.93 95 BOTNET_NORDNS 4582 0.96 3.73 0.02 96 RCVD_IN_MSPIKE_L5 4476 1.00 3.64 0.10 97 TR_XM_SpammyWords3 4401 1.13 3.58 0.29 98 URIBL_DBL_SPAM 4357 0.92 3.55 0.02 99 XM_B_COVIDMETA 4295 1.67 3.50 1.06 100 HTML_IMAGE_RATIO_06 4127 4.13 3.36 4.39 101 XM_DIRTYINTL 4030 1.07 3.28 0.33 102 MIXED_CTYPE_CASE 3887 0.81 3.16 0.01 103 RCVD_IN_PSBL 3877 0.87 3.16 0.10 104 T_XMDrugObfuBody_08 3708 2.02 3.02 1.68 105 TR_XM_SpammyWords5 3695 1.83 3.01 1.42 106 XM_OfRef6 3642 1.43 2.97 0.91 107 XMStrtUSub 3577 3.77 2.91 4.06 108 RELAYCOUNTRY_FR 3547 0.90 2.89 0.23 109 URI_PHP_REDIR 3515 0.73 2.86 0.01 110 XMDiploma_00 3490 1.64 2.84 1.23 111 XM_UB99 3461 0.71 2.82 0.00 112 XMSexyCombo_01 3441 1.65 2.80 1.26 113 RCVD_IN_IADB_LISTED 3387 5.22 2.76 6.06 114 RCVD_IN_RP_CERTIFIED 3355 5.33 2.73 6.21 115 T_XMDrugObfuBody_14 3200 2.20 2.61 2.07 116 FROM_EXCESS_BASE64 3191 2.63 2.60 2.64 117 PDS_OTHER_BAD_TLD 3183 0.76 2.59 0.14 118 TR_XM_SB_Phish 3162 2.35 2.57 2.28 119 HTML_FONT_SIZE_HUGE 3149 0.70 2.56 0.07 120 TR_XM_COVIDMETA1 3138 0.95 2.55 0.41 121 T_TooManySym_01 3136 5.12 2.55 6.00 122 TM2_M_VERY_LONG_WORD 3120 1.66 2.54 1.37 123 XM_B_Unsub2 3106 1.68 2.53 1.40 124 RELAYCOUNTRY_DE 3056 1.02 2.49 0.52 125 XM_UB60 3053 0.71 2.49 0.11 126 HTML_IMAGE_RATIO_08 3025 2.39 2.46 2.36 127 URI_GOOG_STO_SPAMMY 3023 0.62 2.46 0.00 128 RCVD_IN_IADB_SPF 3015 4.55 2.45 5.26 129 XMSubPhish11 2965 2.28 2.41 2.24 130 XM_DK_Undo_01 2926 1.86 2.38 1.68 131 RCVD_IN_IADB_SENDERID 2884 4.08 2.35 4.67 132 RCVD_IN_IADB_DK 2882 3.96 2.35 4.51 133 XM_B_SpammyWords4 2842 0.91 2.31 0.43 134 XMBody_17 2820 0.92 2.30 0.45 135 XM_CamelCaseFrm001 2811 2.16 2.29 2.12 136 DIET_1 2640 1.24 2.15 0.93 137 USER_IN_DEF_DKIM_WL 2626 9.27 2.14 11.68 138 XMSlimDrugH 2620 0.74 2.13 0.27 139 BAYES_40 2619 4.82 2.13 5.73 140 XM_UB80 2530 0.55 2.06 0.03 141 SUBJ_ALL_CAPS 2436 1.75 1.98 1.67 142 XM_URI_RBL 2386 0.60 1.94 0.15 143 ALL_TRUSTED 2364 12.95 1.92 16.69 144 XM_Body_Dirty_Words_01 2292 0.60 1.87 0.18 145 TR_XM_COVIDMETA4 2289 0.76 1.86 0.39 146 XM_UB999 2282 0.47 1.86 0.00 147 TR_XM_PHPDW 2250 0.68 1.83 0.29 148 RELAYCOUNTRY_IN 2216 0.54 1.80 0.12 149 MAILING_LIST_MULTI 2186 2.44 1.78 2.66 150 RCVD_IN_MSPIKE_H5 2147 2.56 1.75 2.84 151 URI_HEX 2048 1.37 1.67 1.28 152 T_FILL_THIS_FORM_SHORT 2032 1.03 1.65 0.81 153 XMBdyGiftCard01 2021 0.96 1.65 0.73 154 TR_XM_PHPForged 2002 0.60 1.63 0.24 155 TR_XM_FormFill2 1974 0.59 1.61 0.25 156 XMStockSpam_06 1971 1.32 1.60 1.22 157 XM_H_PHPOS 1961 0.58 1.60 0.24 158 URIBL_BLACK 1960 0.43 1.60 0.03 159 TR_Symld_Words 1934 1.76 1.57 1.82 160 XMGenDplmaNmb 1902 0.96 1.55 0.75 161 URI_TRY_3LD 1837 1.11 1.50 0.98 162 XMBrknScrpt_02 1827 1.12 1.49 1.00 163 RCVD_IN_RP_RNBL 1791 0.38 1.46 0.02 164 XM_JunkDunk 1724 0.36 1.40 0.00 165 T_XMDrugObfuBody_00 1721 0.95 1.40 0.80 166 URI_NO_WWW_BIZ_CGI 1714 0.36 1.40 0.02 167 URIBL_DBL_ABUSE_SPAM 1687 0.36 1.37 0.02 168 XMSexyCombo_04 1670 0.89 1.36 0.73 169 BAYES_20 1665 3.08 1.36 3.67 170 XMSubMetaI_00 1651 0.98 1.34 0.85 171 THIS_AD 1642 0.61 1.34 0.36 172 XMPhish30 1616 0.81 1.32 0.63 173 XM_H_Long_From02 1547 1.02 1.26 0.93 174 TR_XM_BayesRelay 1535 0.32 1.25 0.01 175 HTTPS_HTTP_MISMATCH 1530 0.87 1.25 0.74 176 T_XMHurry_00 1520 0.66 1.24 0.47 177 TR_LOTS_OF_MONEY3 1498 0.46 1.22 0.20 178 T_HTML_TAG_BALANCE_CENTER 1489 0.33 1.21 0.03 179 MPART_ALT_DIFF_COUNT 1476 0.59 1.20 0.38 180 XMHTML_After_End 1442 1.19 1.17 1.19 181 TR_Mismatch_TLD_02 1442 0.37 1.17 0.09 182 XM_UB95 1372 0.29 1.12 0.01 183 TR_BOTNET_NEGATE 1364 0.53 1.11 0.33 184 RELAYCOUNTRY_AU 1350 0.50 1.10 0.30 185 DKIM_ADSP_NXDOMAIN 1338 0.49 1.09 0.29 186 TR_XM_INV_DKIM 1295 0.41 1.05 0.20 187 RCVD_IN_IADB_VOUCHED 1272 3.15 1.04 3.87 188 XM_H_PHPMailer 1259 1.07 1.03 1.08 189 XM_PDF 1243 3.94 1.01 4.93 190 FROM_SUSPICIOUS_NTLD 1242 0.28 1.01 0.04 191 HK_RANDOM_REPLYTO 1241 0.35 1.01 0.13 192 TR_MetaPhish_Combo_01 1230 0.92 1.00 0.89 193 DKIM_ADSP_CUSTOM_MED 1222 1.07 0.99 1.09 194 XM_B_SEO 1220 0.34 0.99 0.12 195 FROM_SUSPICIOUS_NTLD_FP 1206 0.27 0.98 0.03 196 RELAYCOUNTRY_GB 1194 0.86 0.97 0.83 197 SHOPIFY_IMG_NOT_RCVD_SFY 1192 0.40 0.97 0.20 198 HTML_IMAGE_ONLY_20 1180 0.73 0.96 0.65 199 ANY_BOUNCE_MESSAGE 1168 2.31 0.95 2.77 200 BOUNCE_MESSAGE 1165 2.31 0.95 2.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316460 89.56 95.91 87.40 2 RELAYCOUNTRY_US 291518 79.88 78.03 80.51 3 DKIM_SIGNED 257438 74.14 83.12 71.10 4 XM_DK_Pass 252564 72.14 79.17 69.75 5 XM_B_Unicode 251566 71.30 76.68 69.48 6 DKIM_VALID 245696 70.16 76.95 67.86 7 DCC_CHECK_NEGATIVE 219962 50.59 20.65 60.75 8 BAYES_50 200119 51.70 41.18 55.27 9 DKIM_VALID_AU 183392 52.11 56.40 50.65 10 XMListUnsubscribeExists 169868 52.19 67.73 46.91 11 XM_B_SpammyWords 163914 50.54 66.06 45.27 12 XM_B_Unicode3 148881 41.58 42.95 41.12 13 DCC_CHECK 141962 49.37 79.31 39.21 14 T_TM2_M_HEADER_IN_MSG 114101 28.98 21.50 31.51 15 RCVD_IN_MSPIKE_WL 103650 26.38 19.77 28.63 16 HTML_FONT_LOW_CONTRAST 94179 27.79 33.05 26.01 17 DKIM_VALID_EF 91768 26.74 30.86 25.34 18 RCVD_IN_MSPIKE_H2 87229 25.10 28.07 24.09 19 LOC_TINY_FONT_1 85344 26.55 35.31 23.57 20 MIME_HTML_ONLY 82757 25.75 34.26 22.86 21 FVGT_m_MULTI_ODD 81065 23.74 27.74 22.39 22 XMSubLong 78163 22.48 25.12 21.59 23 XM_B_SpammyWords2 69275 23.70 37.16 19.13 24 T_KAM_HTML_FONT_INVALID 67078 21.68 30.98 18.53 25 ALL_TRUSTED 60428 12.95 1.92 16.69 26 RCVD_IN_MSPIKE_H3 54556 13.76 9.92 15.07 27 USER_IN_DEF_DKIM_WL 42302 9.27 2.14 11.68 28 XM_Body_Dirty_Words 41262 14.44 23.42 11.40 29 XM_Multi_Part_URI 38976 12.08 15.96 10.76 30 XM_B_Unsub 38926 11.38 13.22 10.75 31 RCVD_IN_MSPIKE_H4 38814 10.06 8.10 10.72 32 BAYES_00 37654 7.98 0.83 10.40 33 LotsOfNums_01 33950 8.98 7.80 9.38 34 BAYES_60 33104 8.95 8.39 9.14 35 TooManyTo_001 30800 7.76 5.57 8.51 36 XM_Evil_Numbers_Gen 30601 8.65 9.24 8.45 37 XM_DK_Undo_02 29647 16.95 42.79 8.19 38 FSL_BULK_SIG 29193 10.18 16.41 8.06 39 XM_DKIMWhitelistDomains 28347 5.86 0.04 7.83 40 UNPARSEABLE_RELAY 26795 8.31 10.98 7.40 41 MPART_ALT_DIFF 26208 8.34 11.59 7.24 42 LOTS_OF_MONEY 25291 8.31 12.23 6.98 43 RCVD_IN_RP_SAFE 25104 6.14 3.80 6.93 44 HTML_IMAGE_RATIO_04 24053 6.33 5.41 6.64 45 XM_H_Trusted_IP 22682 4.68 0.00 6.26 46 TR_XM_DK_Bayes 22565 4.80 0.58 6.23 47 BAYES_99 22511 12.63 31.53 6.22 48 RCVD_IN_RP_CERTIFIED 22478 5.33 2.73 6.21 49 RCVD_IN_IADB_LISTED 21943 5.22 2.76 6.06 50 TR_XM_DK_Bayes1 21856 4.65 0.55 6.04 51 T_TooManySym_01 21711 5.12 2.55 6.00 52 HTML_IMAGE_RATIO_02 21661 6.38 7.57 5.98 53 XM_SendGrid 21649 6.32 7.34 5.98 54 TR_XM_UnparsRelay 21553 7.18 10.78 5.95 55 BAYES_40 20749 4.82 2.13 5.73 56 TR_XM_DKIM_Undo 20691 12.70 33.29 5.71 57 MIME_QP_LONG_LINE 19910 5.27 4.61 5.50 58 MIME_HTML_ONLY_MULTI 19365 5.08 4.28 5.35 59 RCVD_IN_IADB_SPF 19044 4.55 2.45 5.26 60 TR_XM_DK_Bayes2 18970 4.03 0.45 5.24 61 IN_ZIMBRA_NJ_WHITELIST 18690 3.87 0.05 5.16 62 XM_H_Long_From01 18592 5.31 5.82 5.13 63 BAYES_999 18311 9.82 23.85 5.06 64 XMSubMetaSx_00 18006 6.05 9.21 4.97 65 XM_PDF 17852 3.94 1.01 4.93 66 XM_B_Phish_Phrases 17176 5.49 7.69 4.74 67 RCVD_IN_IADB_SENDERID 16917 4.08 2.35 4.67 68 BAYES_80 16446 5.61 8.77 4.54 69 RCVD_IN_IADB_DK 16331 3.96 2.35 4.51 70 HTML_IMAGE_RATIO_06 15880 4.13 3.36 4.39 71 TR_XM_SpammyWords4 15686 5.92 10.61 4.33 72 BOTNET_IPINHOSTNAME 15682 6.78 14.02 4.33 73 XM_B_SpammyWords3 15579 6.27 12.07 4.30 74 XMStrtUSub 14712 3.77 2.91 4.06 75 RELAYCOUNTRY_META 14105 7.94 19.87 3.90 76 RCVD_IN_IADB_VOUCHED 14019 3.15 1.04 3.87 77 TR_XM_DK_SendGrid 13852 3.82 3.81 3.83 78 TM2_M_URI_OPT_OUT 13617 3.79 3.89 3.76 79 T_REMOTE_IMAGE 13532 4.89 8.28 3.74 80 BAYES_20 13280 3.08 1.36 3.67 81 XMSexyCombo_05 13222 6.10 13.33 3.65 82 TR_XM_PhishingBody 12873 4.56 7.54 3.56 83 XM_UncommonTLD01 12270 6.99 17.60 3.39 84 DKIM_INVALID 11742 3.98 6.16 3.24 85 XMNumbers 11267 3.56 4.88 3.11 86 TR_DCC_Bayes_99 10794 8.55 24.97 2.98 87 URI_NOVOWEL 10701 3.45 4.92 2.96 88 RCVD_IN_MSPIKE_H5 10280 2.56 1.75 2.84 89 ANY_BOUNCE_MESSAGE 10037 2.31 0.95 2.77 90 BOUNCE_MESSAGE 10037 2.31 0.95 2.77 91 T_TooManySym_02 9838 2.21 0.70 2.72 92 BAYES_95 9743 3.27 4.96 2.69 93 MAILING_LIST_MULTI 9644 2.44 1.78 2.66 94 FROM_EXCESS_BASE64 9542 2.63 2.60 2.64 95 RCVD_IN_IADB_OPTIN 9321 2.08 0.64 2.57 96 MIME_HTML_MOSTLY 8926 3.66 7.19 2.47 97 HTML_FONT_FACE_BAD 8793 2.03 0.85 2.43 98 HTML_IMAGE_RATIO_08 8547 2.39 2.46 2.36 99 HTML_MIME_NO_HTML_TAG 8493 3.90 8.49 2.35 100 BAYES_05 8469 1.96 0.84 2.34 101 TooManyTo_002 8363 1.95 0.90 2.31 102 TR_XM_SB_Phish 8241 2.35 2.57 2.28 103 XMSubPhish11 8110 2.28 2.41 2.24 104 XM_B_Phish66 7746 2.70 4.35 2.14 105 XM_CamelCaseFrm001 7686 2.16 2.29 2.12 106 T_XMDrugObfuBody_14 7478 2.20 2.61 2.07 107 INVALID_MSGID 7289 1.55 0.17 2.01 108 IN_HORDE_ADDRESS_BOOK 7097 1.50 0.14 1.96 109 XM_SPF_SoftFail 7052 2.44 3.88 1.95 110 XM_B_SpammyTLD 7041 2.67 4.80 1.94 111 TR_Symld_Words 6600 1.76 1.57 1.82 112 HELO_NODOT 6366 1.49 0.70 1.76 113 HELO_NO_DOMAIN 6363 1.49 0.69 1.76 114 TO_MALFORMED 6267 1.29 0.00 1.73 115 XM_DK_Undo_01 6082 1.86 2.38 1.68 116 T_XMDrugObfuBody_08 6079 2.02 3.02 1.68 117 SUBJ_ALL_CAPS 6060 1.75 1.98 1.67 118 TVD_RCVD_IP 5721 1.24 0.25 1.58 119 BOTNET 5719 5.65 17.64 1.58 120 KHOP_HELO_FCRDNS 5682 2.94 6.98 1.57 121 TooManyTo_003 5547 1.33 0.72 1.53 122 UNTRUSTED_Relay 5217 4.91 15.15 1.44 123 TR_XM_SpammyWords5 5155 1.83 3.01 1.42 124 XM_B_Unsub2 5063 1.68 2.53 1.40 125 TM2_M_VERY_LONG_WORD 4952 1.66 2.54 1.37 126 XMGappySubj_01 4783 1.02 0.13 1.32 127 XM_GoogleGroups 4626 1.12 0.67 1.28 128 URI_HEX 4619 1.37 1.67 1.28 129 XMSexyCombo_01 4565 1.65 2.80 1.26 130 XMDiploma_00 4451 1.64 2.84 1.23 131 XMStockSpam_06 4409 1.32 1.60 1.22 132 XMCapTrack 4334 1.05 0.61 1.20 133 XMHTML_After_End 4307 1.19 1.17 1.19 134 TooManyTo_004 3967 0.97 0.62 1.10 135 DKIM_ADSP_CUSTOM_MED 3957 1.07 0.99 1.09 136 XM_H_PHPMailer 3920 1.07 1.03 1.08 137 XM_B_COVIDMETA 3822 1.67 3.50 1.06 138 RELAYCOUNTRY_CA 3656 1.80 4.13 1.01 139 TR_XM_SpammyWords2 3636 3.60 11.27 1.00 140 XMBrknScrpt_02 3614 1.12 1.49 1.00 141 URI_TRY_3LD 3551 1.11 1.50 0.98 142 XM_UB50 3537 2.26 6.05 0.98 143 XMBSHREFv2 3473 0.77 0.22 0.96 144 XM_H_Long_From02 3377 1.02 1.26 0.93 145 DIET_1 3374 1.24 2.15 0.93 146 RCVD_IN_BL_SPAMCOP_NET 3336 2.54 7.32 0.92 147 XM_OfRef6 3295 1.43 2.97 0.91 148 T_TooManySym_03 3246 0.73 0.22 0.90 149 TR_MetaPhish_Combo_01 3218 0.92 1.00 0.89 150 TooManyTo_005 3141 0.78 0.51 0.87 151 XMSubNoVowel 3121 0.75 0.41 0.86 152 XM_SPF_Unknown 3101 0.77 0.52 0.86 153 XMSubMetaI_00 3085 0.98 1.34 0.85 154 RELAYCOUNTRY_GB 2988 0.86 0.97 0.83 155 T_FILL_THIS_FORM_SHORT 2941 1.03 1.65 0.81 156 T_XMDrugObfuBody_00 2904 0.95 1.40 0.80 157 XM_ProductURIs 2804 0.80 0.86 0.77 158 XMGenDplmaNmb 2733 0.96 1.55 0.75 159 HTTPS_HTTP_MISMATCH 2691 0.87 1.25 0.74 160 SpammyFromTLD_01 2655 2.07 6.00 0.73 161 XMBdyGiftCard01 2635 0.96 1.65 0.73 162 XMSexyCombo_04 2628 0.89 1.36 0.73 163 XMBody_95 2584 0.60 0.26 0.71 164 MSGID_NOFQDN1 2499 0.52 0.01 0.69 165 XM_B_COPY_HTML 2454 0.69 0.72 0.68 166 NML_ADSP_CUSTOM_MED 2398 0.68 0.73 0.66 167 XMHTMLBadTable_001 2367 0.67 0.70 0.65 168 HTML_IMAGE_ONLY_20 2364 0.73 0.96 0.65 169 XMPhish30 2297 0.81 1.32 0.63 170 FORGED_GMAIL_RCVD 2289 0.69 0.85 0.63 171 XMNoVowels 2281 0.61 0.56 0.63 172 XMLngstWrd_00 2215 0.62 0.63 0.61 173 TR_MSPIKEBAYES00 2180 0.46 0.03 0.60 174 HTML_TAG_BALANCE_BODY 2158 0.65 0.81 0.60 175 RCVD_IN_SORBS_DUL 2150 0.53 0.35 0.59 176 FROM_GOV_DKIM_AU 2089 0.47 0.14 0.58 177 T_OBFU_PDF_ATTACH 2086 0.48 0.19 0.58 178 XM_B_REG_HTML 2001 0.53 0.45 0.55 179 XM_ShortIntro_01 1941 0.58 0.71 0.54 180 XMLngstWrd_01 1897 0.50 0.43 0.52 181 RELAYCOUNTRY_DE 1883 1.02 2.49 0.52 182 TVD_SPACE_RATIO 1828 0.48 0.41 0.50 183 SpammyFromTLD_02 1826 2.76 9.43 0.50 184 TM2_M_A_HREF_HREF 1790 0.54 0.68 0.49 185 FROM_GOV_SPOOF 1735 0.42 0.25 0.48 186 T_XMHurry_00 1703 0.66 1.24 0.47 187 SHORT_HELO_AND_INLINE_IMAGE 1684 0.37 0.09 0.47 188 XMPhish14 1679 0.58 0.92 0.46 189 XMMoneyMeta_00 1667 0.55 0.82 0.46 190 XMBody_17 1617 0.92 2.30 0.45 191 XMLngstWrd_02 1605 0.41 0.32 0.44 192 XM_B_SpammyWords4 1571 0.91 2.31 0.43 193 HTML_IMAGE_ONLY_32 1562 0.38 0.22 0.43 194 XMBody_78 1561 0.51 0.74 0.43 195 MISSING_HEADERS 1553 0.45 0.52 0.43 196 TM2_M_BODY_EMPTY 1537 0.34 0.10 0.42 197 RCVD_IN_MSPIKE_BL 1504 1.70 5.49 0.42 198 RDNS_DYNAMIC 1496 0.44 0.51 0.41 199 XMSolicitRefs_0 1473 0.45 0.58 0.41 200 TR_XM_COVIDMETA1 1471 0.95 2.55 0.41 ----------------------------------------------------------------------