Email: 816433 Autolearn: 0 AvgScore: 0.34 AvgScanTime: 1.89 sec Spam: 116534 Autolearn: 0 AvgScore: 12.45 AvgScanTime: 3.69 sec Ham: 699899 Autolearn: 0 AvgScore: -1.67 AvgScanTime: 1.59 sec Time Spent Running SA: 428.09 hours Time Spent Processing Spam: 119.58 hours Time Spent Processing Ham: 308.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 113464 98.22 97.37 98.36 2 HTML_MESSAGE 106545 81.31 91.43 79.63 3 DKIM_SIGNED 74732 64.06 64.13 64.05 4 XM_B_Unicode 70933 62.75 60.87 63.06 5 RELAYCOUNTRY_US 70282 68.16 60.31 69.47 6 XM_DK_Pass 70042 62.70 60.10 63.13 7 XMListUnsubscribeExists 65553 45.28 56.25 43.46 8 DKIM_VALID 56756 57.70 48.70 59.20 9 BAYES_50 55518 48.83 47.64 49.02 10 XM_DK_Undo_02 48271 13.92 41.42 9.35 11 DKIM_VALID_AU 41051 42.82 35.23 44.09 12 MIME_HTML_ONLY 37345 19.06 32.05 16.90 13 XM_B_Unicode3 37177 33.44 31.90 33.69 14 BOTNET 36628 6.75 31.43 2.64 15 UNTRUSTED_Relay 35945 5.84 30.85 1.68 16 RELAYCOUNTRY_META 35840 8.64 30.75 4.96 17 BAYES_99 32725 8.99 28.08 5.81 18 LOC_TINY_FONT_1 30611 22.58 26.27 21.97 19 FVGT_m_MULTI_ODD 30297 22.30 26.00 21.69 20 DKIM_VALID_EF 27461 22.65 23.56 22.50 21 BAYES_999 24809 6.90 21.29 4.50 22 LOTS_OF_MONEY 24782 9.79 21.27 7.88 23 HTML_FONT_LOW_CONTRAST 24765 21.81 21.25 21.91 24 RCVD_IN_MSPIKE_H2 24364 20.20 20.91 20.09 25 XMSubLong 23386 20.05 20.07 20.05 26 XM_UB50 22684 3.65 19.47 1.02 27 XM_Body_Dirty_Words 21473 12.45 18.43 11.45 28 T_TM2_M_HEADER_IN_MSG 21064 25.96 18.08 27.28 29 XM_UncommonTLD01 20466 4.75 17.56 2.62 30 T_KAM_HTML_FONT_INVALID 20250 16.80 17.38 16.71 31 BOTNET_IPINHOSTNAME 19519 5.99 16.75 4.20 32 DKIM_INVALID 17976 6.36 15.43 4.85 33 XM_Multi_Part_URI 17541 16.09 15.05 16.26 34 XM_B_Unsub 15994 10.57 13.72 10.05 35 XMSexyCombo_05 14968 4.85 12.84 3.51 36 SUBJ_ALL_CAPS 14722 2.95 12.63 1.34 37 NO_DNS_FOR_FROM 14518 4.07 12.46 2.67 38 HTML_IMAGE_RATIO_02 14027 6.58 12.04 5.67 39 REPLYTO_WITHOUT_TO_CC 11563 1.46 9.92 0.05 40 MISSING_HEADERS 11364 1.75 9.75 0.42 41 HTML_MIME_NO_HTML_TAG 11170 2.99 9.59 1.89 42 RCVD_IN_MSPIKE_BL 11072 1.82 9.50 0.55 43 HELO_NODOT 11043 2.77 9.48 1.66 44 HELO_NO_DOMAIN 11040 2.77 9.47 1.66 45 XM_B_Phish_Phrases 10974 6.77 9.42 6.33 46 BOTNET_NORDNS 10802 1.34 9.27 0.02 47 TR_LOTS_OF_MONEY1 10704 1.33 9.19 0.02 48 LotsOfNums_01 10084 7.96 8.65 7.85 49 MONEY_ATM_CARD 10054 1.24 8.63 0.01 50 ADVANCE_FEE_4_NEW_MONEY 10000 1.23 8.58 0.01 51 RCVD_IN_RP_RNBL 9804 1.25 8.41 0.06 52 XM_SPF_SoftFail 9779 2.62 8.39 1.66 53 SpammyFromTLD_02 9402 1.45 8.07 0.35 54 BAYES_60 9249 6.00 7.94 5.68 55 XM_Evil_Numbers_Gen 9223 7.24 7.91 7.12 56 RCVD_IN_BL_SPAMCOP_NET 8858 2.21 7.60 1.31 57 XMNumbers 8850 3.35 7.59 2.64 58 BAYES_80 8818 4.27 7.57 3.72 59 TR_XM_PhishingBody 8357 3.37 7.17 2.74 60 XM_B_SpammyTLD 8185 2.86 7.02 2.17 61 XMSubMetaSx_00 8115 3.89 6.96 3.38 62 XM_OfRef6 7720 1.95 6.62 1.17 63 RCVD_IN_MSPIKE_WL 7634 20.13 6.55 22.39 64 XM_DIRTYINTL 7485 1.41 6.42 0.58 65 T_REMOTE_IMAGE 7269 3.28 6.24 2.79 66 RELAYCOUNTRY_CA 7242 2.24 6.21 1.58 67 TooManyTo_001 6518 6.63 5.59 6.80 68 SpammyFromTLD_01 6272 1.43 5.38 0.77 69 TR_XM_COVIDMETA4 6231 1.28 5.35 0.60 70 UNPARSEABLE_RELAY 5875 5.80 5.04 5.93 71 KHOP_HELO_FCRDNS 5762 2.17 4.94 1.71 72 FROM_EXCESS_BASE64 5684 2.81 4.88 2.46 73 XM_B_Phish66 5529 2.03 4.74 1.58 74 PDS_OTHER_BAD_TLD 5416 0.99 4.65 0.38 75 XM_B_COVIDMETA 5402 1.81 4.64 1.33 76 XM_H_Long_From01 5210 4.78 4.47 4.83 77 FROM_SUSPICIOUS_NTLD 5181 0.66 4.45 0.03 78 RCVD_IN_MSPIKE_L5 5083 0.74 4.36 0.14 79 FROM_SUSPICIOUS_NTLD_FP 5047 0.64 4.33 0.02 80 MPART_ALT_DIFF 4966 4.04 4.26 4.01 81 RCVD_IN_MSPIKE_L3 4883 0.87 4.19 0.32 82 XM_SendGrid 4717 5.19 4.05 5.38 83 XM_OfRef7 4556 0.71 3.91 0.18 84 HTML_IMAGE_RATIO_04 4520 4.48 3.88 4.58 85 RCVD_IN_PSBL 4479 0.56 3.84 0.02 86 XM_UB60 4406 0.63 3.78 0.11 87 BAYES_95 4375 2.50 3.75 2.29 88 RCVD_IN_MSPIKE_H3 4369 11.49 3.75 12.78 89 TR_XM_INV_DKIM 4284 0.65 3.68 0.15 90 HDRS_MISSP 4210 0.55 3.61 0.04 91 DKIM_ADSP_NXDOMAIN 4184 0.71 3.59 0.23 92 TM2_M_URI_OPT_OUT 4024 13.59 3.45 15.28 93 XM_URI_RBL 3948 0.65 3.39 0.19 94 T_FILL_THIS_FORM_SHORT 3945 0.99 3.39 0.59 95 TR_LOTS_OF_MONEY3 3940 1.03 3.38 0.64 96 XM_UB99 3851 0.48 3.30 0.00 97 T_XMDrugObfuBody_08 3825 1.81 3.28 1.56 98 BODY_URI_ONLY 3544 0.49 3.04 0.06 99 MIME_HTML_MOSTLY 3517 2.09 3.02 1.94 100 XM_DK_Undo_01 3496 1.84 3.00 1.65 101 RELAYCOUNTRY_JP 3469 0.47 2.98 0.05 102 XMSubEmpty 3466 0.61 2.97 0.21 103 RELAYCOUNTRY_FR 3452 0.68 2.96 0.30 104 URIBL_SBL_A 3448 0.66 2.96 0.27 105 URI_PHP_REDIR 3439 0.43 2.95 0.01 106 XMBody_17 3313 1.21 2.84 0.94 107 HTML_IMAGE_ONLY_08 3303 0.48 2.83 0.09 108 MIME_HEADER_CTYPE_ONLY 3287 0.69 2.82 0.33 109 HTML_SHORT_LINK_IMG_1 3265 0.41 2.80 0.01 110 TR_XM_MaxWHORU 3248 0.44 2.79 0.05 111 HDRS_LCASE_IMGONLY 3131 0.39 2.69 0.01 112 RCVD_IN_MSPIKE_H4 3117 7.46 2.67 8.25 113 T_Symld_Words_02 3075 0.81 2.64 0.51 114 XMSexyCombo_01 3035 0.98 2.60 0.71 115 BAD_ENC_HEADER 3030 0.40 2.60 0.03 116 XM_BadFromFormat 3029 0.49 2.60 0.14 117 XMNoVowels 2955 0.84 2.54 0.56 118 TR_XM_MaxSPIKE 2902 0.37 2.49 0.02 119 MIME_QP_LONG_LINE 2820 4.73 2.42 5.12 120 TR_Mismatch_TLD_01 2789 0.50 2.39 0.18 121 TR_XM_UnparsRelay 2779 0.62 2.38 0.33 122 SUBJ_ILLEGAL_CHARS 2776 0.35 2.38 0.01 123 TR_Sbj_FN_Bdy 2725 0.48 2.34 0.17 124 TR_XM_MaxBayes 2697 0.36 2.31 0.04 125 XMStrtUSub 2690 3.70 2.31 3.94 126 HTML_TAG_BALANCE_CENTER 2684 0.42 2.30 0.10 127 RELAYCOUNTRY_DE 2630 0.65 2.26 0.38 128 RELAYCOUNTRY_TW 2626 0.37 2.25 0.05 129 MPART_ALT_DIFF_COUNT 2596 0.54 2.23 0.26 130 HTML_IMAGE_RATIO_06 2589 3.05 2.22 3.19 131 XMBrknScrpt_02 2557 1.06 2.19 0.87 132 T_XMDrugObfuBody_00 2554 3.61 2.19 3.85 133 XM_UB999 2543 0.31 2.18 0.00 134 MONEY_FORM_SHORT 2527 0.31 2.17 0.01 135 XMLngstWrd_00 2523 0.59 2.17 0.33 136 XMNoSubject 2494 0.37 2.14 0.07 137 MISSING_SUBJECT 2494 0.37 2.14 0.07 138 TR_Symld_Words 2468 1.49 2.12 1.38 139 FORM_FRAUD 2426 0.30 2.08 0.01 140 T_XMDrugObfuBody_14 2410 1.51 2.07 1.42 141 BAYES_40 2409 3.82 2.07 4.11 142 TR_XM_PHPDW 2383 0.59 2.04 0.35 143 TR_XM_PHPForged 2358 0.58 2.02 0.34 144 TR_XM_FormFill2 2337 0.57 2.01 0.33 145 XM_H_PHPOS 2328 0.57 2.00 0.33 146 MAILING_LIST_MULTI 2324 2.21 1.99 2.24 147 XM_UB80 2279 0.32 1.96 0.05 148 DKIM_ADSP_CUSTOM_MED 2250 1.05 1.93 0.91 149 TR_XM_COVIDMETA1 2249 0.61 1.93 0.39 150 RELAYCOUNTRY_GB 2205 0.99 1.89 0.84 151 URI_NOVOWEL 2161 0.62 1.85 0.41 152 URI_WP_DIRINDEX 2145 0.27 1.84 0.01 153 TM2_M_VERY_LONG_WORD 2139 1.17 1.84 1.06 154 XMSubNoVowel 2112 1.14 1.81 1.03 155 NML_ADSP_CUSTOM_MED 2095 0.82 1.80 0.65 156 XM_CamelCaseFrm001 2083 1.82 1.79 1.83 157 HK_RANDOM_FROM 2053 0.35 1.76 0.11 158 XM_B_Unsub2 2032 3.51 1.74 3.80 159 URI_WP_HACKED_2 1980 0.26 1.70 0.03 160 TR_XM_DK_SendGrid 1979 2.85 1.70 3.04 161 URI_HEX 1914 1.21 1.64 1.14 162 T_TooManySym_01 1896 3.20 1.63 3.47 163 TR_XM_RelayPhish 1896 0.36 1.63 0.14 164 URI_NO_WWW_INFO_CGI 1888 0.24 1.62 0.02 165 XMLngstWrd_01 1853 0.49 1.59 0.30 166 XMDiploma_00 1850 1.41 1.59 1.38 167 NUMERIC_HTTP_ADDR 1850 0.50 1.59 0.32 168 HTML_IMAGE_RATIO_08 1814 2.11 1.56 2.21 169 FILL_THIS_FORM 1739 0.35 1.49 0.16 170 LongTLD 1690 0.35 1.45 0.17 171 FORGED_GMAIL_RCVD 1677 0.55 1.44 0.40 172 BAYES_20 1673 3.01 1.44 3.28 173 XMSubMetaSx_01 1633 0.26 1.40 0.07 174 XMSexyCombo_04 1623 0.30 1.39 0.12 175 MIME_HTML_ONLY_MULTI 1619 2.39 1.39 2.56 176 URI_TRY_3LD 1579 1.16 1.35 1.13 177 NORMAL_HTTP_TO_IP 1548 0.23 1.33 0.05 178 ALL_TRUSTED 1547 23.36 1.33 27.02 179 ANY_BOUNCE_MESSAGE 1520 13.06 1.30 15.02 180 XM_XX_Yahoo 1518 0.22 1.30 0.04 181 BOUNCE_MESSAGE 1517 13.06 1.30 15.01 182 RDNS_DYNAMIC 1508 0.43 1.29 0.29 183 HTML_SHORT_LINK_IMG_3 1496 0.25 1.28 0.07 184 HTML_IMAGE_ONLY_16 1468 0.38 1.26 0.23 185 HTML_IMAGE_ONLY_20 1452 0.56 1.25 0.44 186 FROM_NTLD_LINKBAIT 1431 0.18 1.23 0.00 187 SHORT_IMG_SUSP_NTLD 1430 0.18 1.23 0.00 188 DATE_IN_PAST_03_06 1387 0.26 1.19 0.11 189 TR_MetaPhish_Combo_01 1374 0.71 1.18 0.63 190 XMHTML_After_End 1357 0.82 1.16 0.77 191 XM_PDF 1312 3.10 1.13 3.43 192 XM_Combo_Sbj 1300 0.30 1.12 0.16 193 HK_RANDOM_REPLYTO 1257 0.33 1.08 0.21 194 HTML_FONT_FACE_BAD 1257 0.85 1.08 0.81 195 XMBody_78 1254 0.50 1.08 0.41 196 FVGT_m_MULTI_ODD_EMAIL 1238 0.17 1.06 0.03 197 XMStockSpam_06 1237 0.80 1.06 0.76 198 RELAYCOUNTRY_PL 1231 0.17 1.06 0.03 199 TR_Mismatch_TLD_02 1229 0.21 1.05 0.07 200 XM_UB95 1217 0.17 1.04 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 688401 98.22 97.37 98.36 2 HTML_MESSAGE 557298 81.31 91.43 79.63 3 RELAYCOUNTRY_US 486208 68.16 60.31 69.47 4 DKIM_SIGNED 448251 64.06 64.13 64.05 5 XM_DK_Pass 441833 62.70 60.10 63.13 6 XM_B_Unicode 441354 62.75 60.87 63.06 7 DKIM_VALID 414311 57.70 48.70 59.20 8 BAYES_50 343125 48.83 47.64 49.02 9 DKIM_VALID_AU 308573 42.82 35.23 44.09 10 XMListUnsubscribeExists 304166 45.28 56.25 43.46 11 XM_B_Unicode3 235802 33.44 31.90 33.69 12 T_TM2_M_HEADER_IN_MSG 190916 25.96 18.08 27.28 13 ALL_TRUSTED 189131 23.36 1.33 27.02 14 BAYES_00 159964 19.70 0.78 22.86 15 DKIM_VALID_EF 157472 22.65 23.56 22.50 16 RCVD_IN_MSPIKE_WL 156689 20.13 6.55 22.39 17 LOC_TINY_FONT_1 153764 22.58 26.27 21.97 18 HTML_FONT_LOW_CONTRAST 153326 21.81 21.25 21.91 19 FVGT_m_MULTI_ODD 151778 22.30 26.00 21.69 20 RCVD_IN_MSPIKE_H2 140579 20.20 20.91 20.09 21 XMSubLong 140321 20.05 20.07 20.05 22 MIME_HTML_ONLY 118260 19.06 32.05 16.90 23 T_KAM_HTML_FONT_INVALID 116931 16.80 17.38 16.71 24 XM_Multi_Part_URI 113819 16.09 15.05 16.26 25 TM2_M_URI_OPT_OUT 106949 13.59 3.45 15.28 26 ANY_BOUNCE_MESSAGE 105095 13.06 1.30 15.02 27 BOUNCE_MESSAGE 105079 13.06 1.30 15.01 28 RCVD_IN_MSPIKE_H3 89421 11.49 3.75 12.78 29 XM_Body_Dirty_Words 80155 12.45 18.43 11.45 30 XM_B_Unsub 70320 10.57 13.72 10.05 31 XM_DK_Undo_02 65410 13.92 41.42 9.35 32 RCVD_IN_MSPIKE_H4 57760 7.46 2.67 8.25 33 LOTS_OF_MONEY 55139 9.79 21.27 7.88 34 LotsOfNums_01 54917 7.96 8.65 7.85 35 TR_XM_DK_Bayes 53418 6.59 0.33 7.63 36 XM_Evil_Numbers_Gen 49852 7.24 7.91 7.12 37 TR_XM_DK_Bayes1 49625 6.10 0.18 7.09 38 TooManyTo_001 47572 6.63 5.59 6.80 39 XM_B_Phish_Phrases 44281 6.77 9.42 6.33 40 TR_XM_DK_Bayes2 44251 5.44 0.16 6.32 41 RCVD_IN_RP_SAFE 42883 5.33 0.57 6.13 42 UNPARSEABLE_RELAY 41496 5.80 5.04 5.93 43 BAYES_99 40664 8.99 28.08 5.81 44 IN_ZIMBRA_NJ_WHITELIST 40183 4.93 0.03 5.74 45 BAYES_60 39772 6.00 7.94 5.68 46 HTML_IMAGE_RATIO_02 39676 6.58 12.04 5.67 47 RCVD_IN_RP_CERTIFIED 39088 4.83 0.30 5.58 48 XM_DKIMWhitelistDomains 37731 4.62 0.01 5.39 49 XM_SendGrid 37656 5.19 4.05 5.38 50 MIME_QP_LONG_LINE 35828 4.73 2.42 5.12 51 RELAYCOUNTRY_META 34728 8.64 30.75 4.96 52 DKIM_INVALID 33940 6.36 15.43 4.85 53 XM_H_Long_From01 33788 4.78 4.47 4.83 54 HTML_IMAGE_RATIO_04 32081 4.48 3.88 4.58 55 BAYES_999 31502 6.90 21.29 4.50 56 RCVD_IN_IADB_LISTED 31298 3.94 0.74 4.47 57 BOTNET_IPINHOSTNAME 29375 5.99 16.75 4.20 58 BAYES_40 28738 3.82 2.07 4.11 59 MPART_ALT_DIFF 28048 4.04 4.26 4.01 60 XMStrtUSub 27556 3.70 2.31 3.94 61 RCVD_IN_IADB_SPF 27402 3.45 0.64 3.92 62 T_XMDrugObfuBody_00 26934 3.61 2.19 3.85 63 XM_B_Unsub2 26614 3.51 1.74 3.80 64 BAYES_80 26048 4.27 7.57 3.72 65 XMSexyCombo_05 24596 4.85 12.84 3.51 66 T_TooManySym_01 24270 3.20 1.63 3.47 67 RCVD_IN_IADB_SENDERID 24247 3.06 0.61 3.46 68 XM_PDF 23988 3.10 1.13 3.43 69 RCVD_IN_IADB_DK 23774 3.00 0.61 3.40 70 XMSubMetaSx_00 23677 3.89 6.96 3.38 71 BAYES_20 22931 3.01 1.44 3.28 72 BAYES_05 22639 2.88 0.73 3.23 73 HTML_IMAGE_RATIO_06 22310 3.05 2.22 3.19 74 TR_XM_DK_SendGrid 21281 2.85 1.70 3.04 75 T_REMOTE_IMAGE 19524 3.28 6.24 2.79 76 T_XMHurry_00 19208 2.50 1.02 2.74 77 TR_XM_PhishingBody 19192 3.37 7.17 2.74 78 RCVD_IN_IADB_VOUCHED 18845 2.34 0.26 2.69 79 NO_DNS_FOR_FROM 18682 4.07 12.46 2.67 80 BOTNET 18480 6.75 31.43 2.64 81 XMNumbers 18473 3.35 7.59 2.64 82 XM_UncommonTLD01 18316 4.75 17.56 2.62 83 MIME_HTML_ONLY_MULTI 17930 2.39 1.39 2.56 84 FROM_EXCESS_BASE64 17239 2.81 4.88 2.46 85 HTML_FONT_SIZE_HUGE 16782 2.17 0.80 2.40 86 XM_H_Trusted_IP 16771 2.05 0.00 2.40 87 BAYES_95 16004 2.50 3.75 2.29 88 MAILING_LIST_MULTI 15701 2.21 1.99 2.24 89 HTML_IMAGE_RATIO_08 15443 2.11 1.56 2.21 90 XM_B_SpammyTLD 15189 2.86 7.02 2.17 91 MIME_HTML_MOSTLY 13575 2.09 3.02 1.94 92 HTML_MIME_NO_HTML_TAG 13241 2.99 9.59 1.89 93 XM_CamelCaseFrm001 12776 1.82 1.79 1.83 94 KHOP_HELO_FCRDNS 11987 2.17 4.94 1.71 95 T_TooManySym_02 11800 1.52 0.52 1.69 96 UNTRUSTED_Relay 11753 5.84 30.85 1.68 97 RCVD_IN_IADB_OPTIN 11677 1.46 0.24 1.67 98 XM_SPF_SoftFail 11652 2.62 8.39 1.66 99 HELO_NODOT 11611 2.77 9.48 1.66 100 TooManyTo_002 11608 1.51 0.65 1.66 101 HELO_NO_DOMAIN 11607 2.77 9.47 1.66 102 XM_DK_Undo_01 11524 1.84 3.00 1.65 103 RELAYCOUNTRY_CA 11063 2.24 6.21 1.58 104 XM_B_Phish66 11045 2.03 4.74 1.58 105 T_XMDrugObfuBody_08 10943 1.81 3.28 1.56 106 TVD_RCVD_IP 10846 1.37 0.30 1.55 107 T_XMDrugObfuBody_14 9917 1.51 2.07 1.42 108 TR_Symld_Words 9681 1.49 2.12 1.38 109 XMDiploma_00 9627 1.41 1.59 1.38 110 RCVD_IN_MSPIKE_H5 9508 1.18 0.13 1.36 111 SUBJ_ALL_CAPS 9397 2.95 12.63 1.34 112 XM_B_COVIDMETA 9342 1.81 4.64 1.33 113 RCVD_IN_BL_SPAMCOP_NET 9191 2.21 7.60 1.31 114 XM_GoogleGroups 8232 1.07 0.44 1.18 115 XM_OfRef6 8215 1.95 6.62 1.17 116 URI_HEX 7968 1.21 1.64 1.14 117 URI_TRY_3LD 7907 1.16 1.35 1.13 118 TooManyTo_003 7849 1.03 0.47 1.12 119 IN_HORDE_ADDRESS_BOOK 7825 0.97 0.08 1.12 120 HELO_MISC_IP 7809 1.05 0.63 1.12 121 CK_HELO_DYNAMIC_SPLIT_IP 7809 1.04 0.59 1.12 122 INVALID_MSGID 7528 0.98 0.37 1.08 123 TM2_M_VERY_LONG_WORD 7441 1.17 1.84 1.06 124 XMSubNoVowel 7189 1.14 1.81 1.03 125 XM_UB50 7114 3.65 19.47 1.02 126 XMCapTrack 6940 0.92 0.49 0.99 127 XMBody_17 6562 1.21 2.84 0.94 128 TO_MALFORMED 6495 0.80 0.01 0.93 129 DKIM_ADSP_CUSTOM_MED 6352 1.05 1.93 0.91 130 XMBdyGiftCard01 6274 0.86 0.65 0.90 131 TR_MSPIKEBAYES00 6266 0.77 0.00 0.90 132 XMBrknScrpt_02 6105 1.06 2.19 0.87 133 XM_H_Long_From02 6093 0.84 0.65 0.87 134 RELAYCOUNTRY_GB 5879 0.99 1.89 0.84 135 TooManyTo_004 5760 0.77 0.42 0.82 136 HTML_FONT_FACE_BAD 5654 0.85 1.08 0.81 137 USER_IN_DEF_DKIM_WL 5475 0.67 0.01 0.78 138 XMHTML_After_End 5375 0.82 1.16 0.77 139 SpammyFromTLD_01 5375 1.43 5.38 0.77 140 XMStockSpam_06 5287 0.80 1.06 0.76 141 XMGenDplmaNmb 5045 0.77 1.03 0.72 142 XMGappySubj_01 5042 0.64 0.15 0.72 143 XMSexyCombo_01 5002 0.98 2.60 0.71 144 T_OBFU_PDF_ATTACH 4940 0.64 0.21 0.71 145 XM_ProductURIs 4901 0.70 0.68 0.70 146 TooManyTo_005 4822 0.63 0.28 0.69 147 SHORT_HELO_AND_INLINE_IMAGE 4652 0.58 0.11 0.66 148 NML_ADSP_CUSTOM_MED 4562 0.82 1.80 0.65 149 TR_LOTS_OF_MONEY3 4445 1.03 3.38 0.64 150 TR_MetaPhish_Combo_01 4439 0.71 1.18 0.63 151 URI_OPTOUT_3LD 4359 0.64 0.77 0.62 152 HTTPS_HTTP_MISMATCH 4298 0.63 0.69 0.61 153 TR_XM_COVIDMETA4 4182 1.28 5.35 0.60 154 T_FILL_THIS_FORM_SHORT 4159 0.99 3.39 0.59 155 XM_DIRTYINTL 4040 1.41 6.42 0.58 156 XMBody_95 3959 0.50 0.08 0.57 157 T_TooManySym_03 3955 0.50 0.13 0.57 158 XMNoVowels 3938 0.84 2.54 0.56 159 RCVD_IN_MSPIKE_BL 3818 1.82 9.50 0.55 160 T_Symld_Words_02 3556 0.81 2.64 0.51 161 XMMoneyMeta_00 3380 0.53 0.84 0.48 162 DIET_1 3374 0.55 0.96 0.48 163 XM_SPF_Unknown 3333 0.50 0.64 0.48 164 XMPhish30 3252 0.51 0.77 0.46 165 XMSubMetaSxObfu_03 3223 0.53 0.95 0.46 166 HTML_IMAGE_ONLY_20 3081 0.56 1.25 0.44 167 XM_ShortIntro_01 2971 0.45 0.59 0.42 168 FROM_GOV_DKIM_AU 2958 0.37 0.04 0.42 169 MISSING_HEADERS 2934 1.75 9.75 0.42 170 URI_NOVOWEL 2881 0.62 1.85 0.41 171 XMBody_78 2845 0.50 1.08 0.41 172 THIS_AD 2844 0.41 0.40 0.41 173 XMHTMLBadTable_001 2835 0.41 0.47 0.41 174 XM_H_PHPMailer 2820 0.44 0.70 0.40 175 FORGED_GMAIL_RCVD 2775 0.55 1.44 0.40 176 TR_XM_COVIDMETA1 2750 0.61 1.93 0.39 177 TR_BOTNET_NEGATE 2744 0.38 0.28 0.39 178 RELAYCOUNTRY_AU 2723 0.46 0.85 0.39 179 PDS_OTHER_BAD_TLD 2671 0.99 4.65 0.38 180 RELAYCOUNTRY_DE 2657 0.65 2.26 0.38 181 XMPhish08 2625 0.46 0.98 0.38 182 XMSubMetaI_00 2607 0.40 0.59 0.37 183 RCVD_IN_SORBS_DUL 2549 0.34 0.18 0.36 184 TR_XM_PHPDW 2464 0.59 2.04 0.35 185 SpammyFromTLD_02 2449 1.45 8.07 0.35 186 PLING_QUERY 2437 0.34 0.30 0.35 187 HTML_IMAGE_ONLY_28 2424 0.34 0.30 0.35 188 XM_B_COPY_HTML 2384 0.35 0.38 0.34 189 REMOVE_BEFORE_LINK 2378 0.39 0.69 0.34 190 HTML_IMAGE_ONLY_32 2377 0.31 0.14 0.34 191 XMSubMetaSxObfu_02 2371 0.34 0.37 0.34 192 TR_XM_PHPForged 2349 0.58 2.02 0.34 193 MIME_HEADER_CTYPE_ONLY 2331 0.69 2.82 0.33 194 TR_XM_FormFill2 2327 0.57 2.01 0.33 195 XMLngstWrd_00 2311 0.59 2.17 0.33 196 XM_H_PHPOS 2303 0.57 2.00 0.33 197 FROM_GOV_SPOOF 2286 0.32 0.25 0.33 198 TR_XM_UnparsRelay 2279 0.62 2.38 0.33 199 NUMERIC_HTTP_ADDR 2234 0.50 1.59 0.32 200 RCVD_IN_MSPIKE_L3 2211 0.87 4.19 0.32 ----------------------------------------------------------------------