Email: 626467 Autolearn: 0 AvgScore: 1.13 AvgScanTime: 1.85 sec Spam: 110225 Autolearn: 0 AvgScore: 13.17 AvgScanTime: 3.40 sec Ham: 516242 Autolearn: 0 AvgScore: -1.44 AvgScanTime: 1.52 sec Time Spent Running SA: 321.92 hours Time Spent Processing Spam: 104.09 hours Time Spent Processing Ham: 217.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106509 97.96 96.63 98.24 2 HTML_MESSAGE 98693 88.97 89.54 88.84 3 DKIM_SIGNED 86101 76.77 78.11 76.48 4 XM_DK_Pass 82927 75.34 75.23 75.36 5 XM_B_Unicode 81957 71.81 74.35 71.26 6 XMListUnsubscribeExists 74586 54.10 67.67 51.20 7 RELAYCOUNTRY_US 72124 78.71 65.43 81.54 8 XM_B_SpammyWords 71031 51.96 64.44 49.29 9 DKIM_VALID 70952 69.95 64.37 71.14 10 XM_DK_Undo_02 55289 17.86 50.16 10.97 11 DKIM_VALID_AU 53139 53.21 48.21 54.27 12 BAYES_99 42039 13.25 38.14 7.94 13 XM_B_SpammyWords2 39583 25.15 35.91 22.85 14 BAYES_50 39020 49.80 35.40 52.88 15 XM_B_Unicode3 38911 39.71 35.30 40.65 16 DKIM_VALID_EF 35427 29.50 32.14 28.94 17 BAYES_999 32972 10.55 29.91 6.41 18 RELAYCOUNTRY_META 32523 10.45 29.51 6.39 19 LOC_TINY_FONT_1 32117 25.48 29.14 24.70 20 BOTNET 31189 7.39 28.30 2.92 21 HTML_FONT_LOW_CONTRAST 30625 28.57 27.78 28.74 22 MIME_HTML_ONLY 29139 21.68 26.44 20.67 23 T_TM2_M_HEADER_IN_MSG 28901 29.35 26.22 30.02 24 UNTRUSTED_Relay 27512 7.14 24.96 3.33 25 FVGT_m_MULTI_ODD 27256 22.88 24.73 22.49 26 RCVD_IN_MSPIKE_H2 26733 25.89 24.25 26.24 27 XMSubLong 26592 21.91 24.13 21.44 28 T_KAM_HTML_FONT_INVALID 25198 19.42 22.86 18.69 29 XM_UncommonTLD01 24004 6.63 21.78 3.40 30 XM_Body_Dirty_Words 21023 14.25 19.07 13.23 31 LOTS_OF_MONEY 19817 9.40 17.98 7.57 32 XM_Multi_Part_URI 19782 13.76 17.95 12.87 33 XM_B_Phish_Phrases 19208 8.75 17.43 6.90 34 MPART_ALT_DIFF 16569 6.71 15.03 4.94 35 BOTNET_IPINHOSTNAME 16069 6.65 14.58 4.96 36 RCVD_IN_MSPIKE_BL 15299 3.24 13.88 0.96 37 DKIM_INVALID 15149 6.82 13.74 5.34 38 XM_B_SpammyWords3 14880 7.47 13.50 6.18 39 RCVD_IN_BL_SPAMCOP_NET 13238 3.17 12.01 1.29 40 SpammyFromTLD_01 13202 2.89 11.98 0.95 41 XMSexyCombo_05 12730 5.52 11.55 4.24 42 NO_DNS_FOR_FROM 12369 4.38 11.22 2.92 43 XM_B_Unsub 11907 10.62 10.80 10.58 44 XM_Evil_Numbers_Gen 11892 8.94 10.79 8.54 45 XM_SPF_SoftFail 10379 3.33 9.42 2.03 46 RCVD_IN_MSPIKE_WL 10211 23.77 9.26 26.87 47 XM_UB99 10205 1.64 9.26 0.02 48 HTML_IMAGE_RATIO_02 9682 7.34 8.78 7.03 49 MIME_HTML_MOSTLY 9612 3.50 8.72 2.38 50 RCVD_IN_RP_RNBL 9576 1.62 8.69 0.11 51 RCVD_IN_MSPIKE_L5 9545 1.80 8.66 0.33 52 T_XMDrugObfuBody_08 9479 2.82 8.60 1.59 53 LotsOfNums_01 9206 8.31 8.35 8.30 54 BAYES_80 9000 5.06 8.17 4.40 55 RCVD_IN_PSBL 8356 1.36 7.58 0.03 56 BAYES_60 8136 7.03 7.38 6.95 57 XM_UB999 8118 1.31 7.36 0.02 58 XMSubMetaSx_00 7821 5.02 7.10 4.57 59 XM_UB50 7719 2.80 7.00 1.90 60 TR_XM_PhishingBody 7485 3.95 6.79 3.34 61 XMDiploma_00 7386 2.88 6.70 2.06 62 RELAYCOUNTRY_CA 7240 2.45 6.57 1.57 63 XM_H_Long_From01 7237 5.56 6.57 5.35 64 XM_B_COVIDMETA 7218 2.47 6.55 1.59 65 UNPARSEABLE_RELAY 6764 7.50 6.14 7.79 66 XMGenDplmaNmb 6399 1.85 5.81 1.01 67 RELAYCOUNTRY_FR 6156 1.30 5.58 0.39 68 XMNumbers 6056 4.01 5.49 3.69 69 TooManyTo_001 5993 8.18 5.44 8.77 70 URI_PHP_REDIR 5990 0.99 5.43 0.04 71 RCVD_IN_MSPIKE_H3 5966 13.38 5.41 15.09 72 HTML_IMAGE_RATIO_04 5934 5.68 5.38 5.74 73 XM_B_SpammyTLD 5672 2.75 5.15 2.24 74 HTML_FONT_TINY_NORDNS 5512 1.16 5.00 0.34 75 XM_DIRTYINTL 5463 1.34 4.96 0.56 76 BOTNET_NORDNS 5447 0.89 4.94 0.02 77 SpammyFromTLD_02 5256 1.06 4.77 0.27 78 BAYES_95 5090 3.03 4.62 2.69 79 XM_SendGrid 4902 6.61 4.45 7.07 80 XMBody_17 4826 1.51 4.38 0.90 81 RCVD_IN_MSPIKE_L3 4766 1.23 4.32 0.58 82 TR_XM_COVIDMETA4 4667 1.33 4.23 0.71 83 XM_ContractorBdy01 4528 0.72 4.11 0.00 84 XM_B_Phish66 4448 2.27 4.04 1.90 85 TM2_M_URI_OPT_OUT 4406 3.59 4.00 3.51 86 XM_OfRef6 4041 1.55 3.67 1.09 87 RCVD_IN_MSPIKE_H4 3961 9.00 3.59 10.16 88 TR_XM_INV_DKIM 3927 0.72 3.56 0.12 89 SUBJ_ALL_CAPS 3892 1.95 3.53 1.61 90 XMStrtUSub 3850 4.27 3.49 4.44 91 TR_XM_MaxWHORU 3442 0.60 3.12 0.06 92 DATE_IN_PAST_03_06 3384 0.66 3.07 0.14 93 HTML_MIME_NO_HTML_TAG 3315 2.26 3.01 2.11 94 XM_UB60 3217 0.79 2.92 0.34 95 XM_B_SpammyWords4 3212 1.11 2.91 0.73 96 KHOP_HELO_FCRDNS 3210 2.08 2.91 1.90 97 XM_UB80 3187 0.58 2.89 0.09 98 T_TooManySym_01 3067 4.39 2.78 4.74 99 MIME_HTML_ONLY_MULTI 3066 3.06 2.78 3.12 100 TR_XM_UnparsRelay 3048 0.85 2.77 0.44 101 HTML_IMAGE_RATIO_08 2989 2.51 2.71 2.47 102 FROM_SUSPICIOUS_NTLD 2969 0.52 2.69 0.06 103 RELAYCOUNTRY_RU 2952 1.24 2.68 0.93 104 FROM_SUSPICIOUS_NTLD_FP 2876 0.50 2.61 0.04 105 XM_URI_RBL 2873 0.64 2.61 0.22 106 FROM_EXCESS_BASE64 2860 2.64 2.59 2.65 107 TM2_M_VERY_LONG_WORD 2859 1.58 2.59 1.37 108 TR_Mismatch_TLD_01 2857 0.75 2.59 0.36 109 T_XMDrugObfuBody_00 2820 1.08 2.56 0.76 110 TR_Mismatch_TLD_02 2793 0.53 2.53 0.10 111 TR_XM_PHPDW 2781 0.76 2.52 0.38 112 XM_XX_Yahoo 2745 0.56 2.49 0.15 113 TR_XM_PHPForged 2691 0.72 2.44 0.36 114 T_REMOTE_IMAGE 2674 3.46 2.43 3.68 115 HTML_IMAGE_RATIO_06 2665 3.09 2.42 3.24 116 TR_XM_FormFill2 2659 0.72 2.41 0.36 117 URIBL_SBL_A 2651 0.55 2.41 0.15 118 MIME_QP_LONG_LINE 2651 4.54 2.41 4.99 119 XM_H_PHPOS 2650 0.71 2.40 0.35 120 TR_XM_MaxSPIKE 2592 0.44 2.35 0.03 121 BAYES_40 2552 4.27 2.32 4.69 122 XM_CamelCaseFrm001 2551 1.91 2.31 1.82 123 TR_Symld_Words 2539 1.87 2.30 1.78 124 URI_HEX 2496 1.72 2.26 1.60 125 LH_URI_DOM_IN_PATH 2468 2.08 2.24 2.05 126 T_XMDrugObfuBody_14 2448 1.67 2.22 1.56 127 TR_XM_COVIDMETA1 2379 0.68 2.16 0.36 128 TR_LOTS_OF_MONEY3 2345 0.81 2.13 0.53 129 T_PDS_OTHER_BAD_TLD 2329 0.77 2.11 0.49 130 XMBrknScrpt_02 2254 1.18 2.04 1.00 131 XMSexyCombo_01 2188 1.45 1.99 1.34 132 BAYES_20 2165 3.47 1.96 3.79 133 TR_XM_MaxBayes 2162 0.38 1.96 0.04 134 ALL_TRUSTED 2161 11.36 1.96 13.36 135 XM_B_Unsub2 2129 2.50 1.93 2.62 136 RELAYCOUNTRY_DE 2127 0.69 1.93 0.43 137 T_XMHurry_00 2038 1.01 1.85 0.83 138 TR_XM_RelayPhish 1994 0.47 1.81 0.19 139 T_DEAR_BENEFICIARY 1993 0.43 1.81 0.13 140 RELAYCOUNTRY_GB 1976 1.12 1.79 0.98 141 RDNS_DYNAMIC 1975 0.62 1.79 0.36 142 XMSubNoVowel 1964 1.21 1.78 1.09 143 DKIM_ADSP_NXDOMAIN 1955 0.80 1.77 0.59 144 TR_XM_DK_SendGrid 1952 3.63 1.77 4.03 145 XM_H_Undi_Recip 1944 0.64 1.76 0.40 146 XMMoneyMeta_00 1937 0.79 1.76 0.58 147 XMHTML_After_End 1911 1.09 1.73 0.95 148 URI_NOVOWEL 1857 2.05 1.68 2.13 149 XM_UB95 1845 0.32 1.67 0.03 150 LongTLD 1837 0.45 1.67 0.19 151 XMGppyBdWords 1826 0.49 1.66 0.24 152 DKIM_ADSP_CUSTOM_MED 1808 1.24 1.64 1.16 153 T_FILL_THIS_FORM_SHORT 1807 1.04 1.64 0.91 154 XMStockSpam_06 1772 1.25 1.61 1.17 155 T_Symld_Words_02 1701 0.83 1.54 0.68 156 URI_TRY_3LD 1688 1.36 1.53 1.32 157 DATE_IN_PAST_06_12 1656 0.33 1.50 0.08 158 HELO_NODOT 1634 1.64 1.48 1.67 159 TR_Sbj_FN_Bdy 1629 0.51 1.48 0.30 160 NML_ADSP_CUSTOM_MED 1598 0.93 1.45 0.82 161 FORGED_GMAIL_RCVD 1581 0.74 1.43 0.59 162 HELO_NO_DOMAIN 1573 1.63 1.43 1.67 163 XM_BadFromFormat 1556 0.36 1.41 0.14 164 MAILING_LIST_MULTI 1554 2.29 1.41 2.48 165 XMSubMetaD_00 1535 0.31 1.39 0.07 166 XMSubMetaSxObfu_03 1528 0.64 1.39 0.48 167 RELAYCOUNTRY_IN 1524 0.33 1.38 0.10 168 DIET_1 1496 0.69 1.36 0.55 169 XM_H_Long_From02 1418 1.01 1.29 0.95 170 XM_PDF 1386 3.81 1.26 4.35 171 XMSubMetaI_00 1377 0.79 1.25 0.69 172 SUBJ_BUY 1361 0.25 1.23 0.04 173 BOUNCE_MESSAGE 1342 2.44 1.22 2.70 174 ANY_BOUNCE_MESSAGE 1342 2.44 1.22 2.70 175 PDS_FROM_2_EMAILS 1338 0.25 1.21 0.04 176 XMObfuSubjects 1315 0.22 1.19 0.01 177 RCVD_IN_IADB_LISTED 1276 3.92 1.16 4.51 178 HK_RANDOM_REPLYTO 1264 0.39 1.15 0.23 179 FROM_2_EMAILS_SHORT 1252 0.20 1.14 0.00 180 XM_DK_Undo_01 1240 1.61 1.12 1.71 181 DRUGS_ERECTILE 1239 0.21 1.12 0.02 182 TVD_SPACE_RATIO 1236 0.49 1.12 0.36 183 XM_H_SupportSpoof 1229 0.44 1.11 0.30 184 REMOVE_BEFORE_LINK 1228 0.41 1.11 0.25 185 TR_XM_SpoofStaff 1201 0.25 1.09 0.07 186 XMSlimDrugH 1195 0.56 1.08 0.44 187 XMBody_78 1185 0.59 1.08 0.48 188 BAYES_00 1185 11.95 1.08 14.27 189 LONG_JUNK_URI 1164 0.24 1.06 0.06 190 XMSpoofStaff2 1161 0.24 1.05 0.07 191 PDS_TO_EQ_FROM_NAME 1159 0.19 1.05 0.01 192 XM_S_SpammyWords 1151 0.43 1.04 0.30 193 TR_XM_Spammywords 1151 0.43 1.04 0.30 194 RELAYCOUNTRY_NL 1143 0.46 1.04 0.33 195 XMSubMetaD_01 1133 0.18 1.03 0.00 196 HTTPS_HTTP_MISMATCH 1121 0.80 1.02 0.75 197 XM_H_PHPMailer 1121 0.69 1.02 0.62 198 XM_OfRef7 1116 0.27 1.01 0.11 199 NO_FM_NAME_IP_HOSTN 1110 0.18 1.01 0.00 200 XM_SPF_Unknown 1099 0.76 1.00 0.71 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 507147 97.96 96.63 98.24 2 HTML_MESSAGE 458650 88.97 89.54 88.84 3 RELAYCOUNTRY_US 420947 78.71 65.43 81.54 4 DKIM_SIGNED 394825 76.77 78.11 76.48 5 XM_DK_Pass 389031 75.34 75.23 75.36 6 XM_B_Unicode 367889 71.81 74.35 71.26 7 DKIM_VALID 367265 69.95 64.37 71.14 8 DKIM_VALID_AU 280183 53.21 48.21 54.27 9 BAYES_50 272970 49.80 35.40 52.88 10 XMListUnsubscribeExists 264331 54.10 67.67 51.20 11 XM_B_SpammyWords 254472 51.96 64.44 49.29 12 XM_B_Unicode3 209858 39.71 35.30 40.65 13 T_TM2_M_HEADER_IN_MSG 154963 29.35 26.22 30.02 14 DKIM_VALID_EF 149386 29.50 32.14 28.94 15 HTML_FONT_LOW_CONTRAST 148353 28.57 27.78 28.74 16 RCVD_IN_MSPIKE_WL 138726 23.77 9.26 26.87 17 RCVD_IN_MSPIKE_H2 135473 25.89 24.25 26.24 18 LOC_TINY_FONT_1 127514 25.48 29.14 24.70 19 XM_B_SpammyWords2 117967 25.15 35.91 22.85 20 FVGT_m_MULTI_ODD 116105 22.88 24.73 22.49 21 XMSubLong 110666 21.91 24.13 21.44 22 MIME_HTML_ONLY 106705 21.68 26.44 20.67 23 T_KAM_HTML_FONT_INVALID 96485 19.42 22.86 18.69 24 RCVD_IN_MSPIKE_H3 77879 13.38 5.41 15.09 25 BAYES_00 73651 11.95 1.08 14.27 26 ALL_TRUSTED 68994 11.36 1.96 13.36 27 XM_Body_Dirty_Words 68278 14.25 19.07 13.23 28 XM_Multi_Part_URI 66440 13.76 17.95 12.87 29 XM_DK_Undo_02 56625 17.86 50.16 10.97 30 XM_B_Unsub 54632 10.62 10.80 10.58 31 RCVD_IN_MSPIKE_H4 52452 9.00 3.59 10.16 32 TooManyTo_001 45269 8.18 5.44 8.77 33 XM_Evil_Numbers_Gen 44092 8.94 10.79 8.54 34 TR_XM_DK_Bayes 43875 7.12 0.66 8.50 35 LotsOfNums_01 42830 8.31 8.35 8.30 36 TR_XM_DK_Bayes1 40999 6.63 0.49 7.94 37 BAYES_99 40982 13.25 38.14 7.94 38 UNPARSEABLE_RELAY 40193 7.50 6.14 7.79 39 LOTS_OF_MONEY 39099 9.40 17.98 7.57 40 RCVD_IN_RP_SAFE 38676 6.24 0.40 7.49 41 XM_DKIMWhitelistDomains 38574 6.16 0.04 7.47 42 XM_SendGrid 36516 6.61 4.45 7.07 43 HTML_IMAGE_RATIO_02 36316 7.34 8.78 7.03 44 TR_XM_DK_Bayes2 36020 5.78 0.19 6.98 45 BAYES_60 35898 7.03 7.38 6.95 46 XM_B_Phish_Phrases 35600 8.75 17.43 6.90 47 RCVD_IN_RP_CERTIFIED 35573 5.72 0.25 6.89 48 BAYES_999 33115 10.55 29.91 6.41 49 RELAYCOUNTRY_META 32969 10.45 29.51 6.39 50 XM_B_SpammyWords3 31887 7.47 13.50 6.18 51 IN_ZIMBRA_NJ_WHITELIST 31413 5.03 0.09 6.08 52 HTML_IMAGE_RATIO_04 29639 5.68 5.38 5.74 53 XM_H_Long_From01 27612 5.56 6.57 5.35 54 DKIM_INVALID 27560 6.82 13.74 5.34 55 MIME_QP_LONG_LINE 25786 4.54 2.41 4.99 56 BOTNET_IPINHOSTNAME 25606 6.65 14.58 4.96 57 MPART_ALT_DIFF 25495 6.71 15.03 4.94 58 T_TooManySym_01 24448 4.39 2.78 4.74 59 BAYES_40 24200 4.27 2.32 4.69 60 XMSubMetaSx_00 23614 5.02 7.10 4.57 61 RCVD_IN_IADB_LISTED 23281 3.92 1.16 4.51 62 XMStrtUSub 22902 4.27 3.49 4.44 63 BAYES_80 22694 5.06 8.17 4.40 64 XM_PDF 22461 3.81 1.26 4.35 65 XMSexyCombo_05 21877 5.52 11.55 4.24 66 TR_XM_DK_SendGrid 20813 3.63 1.77 4.03 67 RCVD_IN_IADB_SPF 20317 3.41 0.96 3.94 68 BAYES_20 19549 3.47 1.96 3.79 69 XMNumbers 19059 4.01 5.49 3.69 70 T_REMOTE_IMAGE 19012 3.46 2.43 3.68 71 RCVD_IN_IADB_SENDERID 18264 3.07 0.90 3.54 72 TM2_M_URI_OPT_OUT 18107 3.59 4.00 3.51 73 RCVD_IN_IADB_DK 17793 3.00 0.88 3.45 74 XM_UncommonTLD01 17532 6.63 21.78 3.40 75 TR_XM_PhishingBody 17248 3.95 6.79 3.34 76 UNTRUSTED_Relay 17214 7.14 24.96 3.33 77 HTML_IMAGE_RATIO_06 16711 3.09 2.42 3.24 78 MIME_HTML_ONLY_MULTI 16107 3.06 2.78 3.12 79 NO_DNS_FOR_FROM 15098 4.38 11.22 2.92 80 BOTNET 15094 7.39 28.30 2.92 81 XM_H_Trusted_IP 14789 2.36 0.00 2.86 82 RCVD_IN_IADB_VOUCHED 14065 2.35 0.57 2.72 83 ANY_BOUNCE_MESSAGE 13940 2.44 1.22 2.70 84 BOUNCE_MESSAGE 13938 2.44 1.22 2.70 85 BAYES_95 13911 3.03 4.62 2.69 86 FROM_EXCESS_BASE64 13703 2.64 2.59 2.65 87 XM_B_Unsub2 13537 2.50 1.93 2.62 88 MAILING_LIST_MULTI 12785 2.29 1.41 2.48 89 HTML_IMAGE_RATIO_08 12754 2.51 2.71 2.47 90 BAYES_05 12386 2.14 0.94 2.40 91 MIME_HTML_MOSTLY 12284 3.50 8.72 2.38 92 T_TooManySym_02 12255 2.10 0.80 2.37 93 XM_B_SpammyTLD 11558 2.75 5.15 2.24 94 TooManyTo_002 11488 1.99 0.88 2.23 95 URI_NOVOWEL 11007 2.05 1.68 2.13 96 HTML_MIME_NO_HTML_TAG 10873 2.26 3.01 2.11 97 XMDiploma_00 10631 2.88 6.70 2.06 98 LH_URI_DOM_IN_PATH 10571 2.08 2.24 2.05 99 XM_SPF_SoftFail 10466 3.33 9.42 2.03 100 TVD_RCVD_IP 10113 1.68 0.39 1.96 101 XM_UB50 9805 2.80 7.00 1.90 102 XM_B_Phish66 9797 2.27 4.04 1.90 103 KHOP_HELO_FCRDNS 9790 2.08 2.91 1.90 104 XM_CamelCaseFrm001 9418 1.91 2.31 1.82 105 RCVD_IN_IADB_OPTIN 9418 1.58 0.44 1.82 106 TR_Symld_Words 9181 1.87 2.30 1.78 107 XM_DK_Undo_01 8845 1.61 1.12 1.71 108 HELO_NODOT 8614 1.64 1.48 1.67 109 HELO_NO_DOMAIN 8613 1.63 1.43 1.67 110 RCVD_IN_MSPIKE_H5 8395 1.39 0.26 1.63 111 SUBJ_ALL_CAPS 8308 1.95 3.53 1.61 112 URI_HEX 8251 1.72 2.26 1.60 113 XM_B_COVIDMETA 8234 2.47 6.55 1.59 114 T_XMDrugObfuBody_08 8204 2.82 8.60 1.59 115 RELAYCOUNTRY_CA 8114 2.45 6.57 1.57 116 T_XMDrugObfuBody_14 8033 1.67 2.22 1.56 117 HELO_MISC_IP 7771 1.35 0.64 1.51 118 CK_HELO_DYNAMIC_SPLIT_IP 7747 1.36 0.69 1.50 119 TooManyTo_003 7715 1.33 0.56 1.49 120 INVALID_MSGID 7500 1.28 0.49 1.45 121 IN_HORDE_ADDRESS_BOOK 7355 1.22 0.26 1.42 122 TM2_M_VERY_LONG_WORD 7058 1.58 2.59 1.37 123 XMSexyCombo_01 6926 1.45 1.99 1.34 124 URI_TRY_3LD 6828 1.36 1.53 1.32 125 RCVD_IN_BL_SPAMCOP_NET 6635 3.17 12.01 1.29 126 XM_GoogleGroups 6608 1.13 0.45 1.28 127 XMCapTrack 6605 1.14 0.49 1.28 128 TO_MALFORMED 6375 1.03 0.05 1.23 129 XMGappySubj_01 6064 0.99 0.10 1.17 130 XMStockSpam_06 6064 1.25 1.61 1.17 131 DKIM_ADSP_CUSTOM_MED 5974 1.24 1.64 1.16 132 XM_OfRef6 5639 1.55 3.67 1.09 133 XMSubNoVowel 5628 1.21 1.78 1.09 134 TooManyTo_004 5620 0.98 0.48 1.09 135 HTML_FONT_FACE_BAD 5414 0.99 0.72 1.05 136 USER_IN_DEF_DKIM_WL 5287 0.84 0.01 1.02 137 XMGenDplmaNmb 5215 1.85 5.81 1.01 138 XMBdyGiftCard01 5173 0.95 0.72 1.00 139 XMBrknScrpt_02 5149 1.18 2.04 1.00 140 RELAYCOUNTRY_GB 5034 1.12 1.79 0.98 141 T_TooManySym_03 4992 0.84 0.22 0.97 142 RCVD_IN_MSPIKE_BL 4974 3.24 13.88 0.96 143 XM_H_Long_From02 4922 1.01 1.29 0.95 144 XMHTML_After_End 4892 1.09 1.73 0.95 145 SpammyFromTLD_01 4888 2.89 11.98 0.95 146 RELAYCOUNTRY_RU 4825 1.24 2.68 0.93 147 T_FILL_THIS_FORM_SHORT 4682 1.04 1.64 0.91 148 XM_ProductURIs 4662 0.86 0.65 0.90 149 XMBody_17 4635 1.51 4.38 0.90 150 TooManyTo_005 4632 0.81 0.38 0.90 151 T_XMHurry_00 4306 1.01 1.85 0.83 152 NML_ADSP_CUSTOM_MED 4236 0.93 1.45 0.82 153 TR_MetaPhish_Combo_01 4099 0.82 0.96 0.79 154 XMBody_95 3948 0.65 0.11 0.76 155 T_XMDrugObfuBody_00 3933 1.08 2.56 0.76 156 HTTPS_HTTP_MISMATCH 3894 0.80 1.02 0.75 157 TR_MSPIKEBAYES00 3863 0.62 0.04 0.75 158 XM_B_SpammyWords4 3744 1.11 2.91 0.73 159 XM_SPF_Unknown 3687 0.76 1.00 0.71 160 XM_ShortIntro_01 3649 0.66 0.46 0.71 161 TR_XM_COVIDMETA4 3642 1.33 4.23 0.71 162 XMSubMetaI_00 3559 0.79 1.25 0.69 163 XM_RXBody 3547 0.65 0.50 0.69 164 T_Symld_Words_02 3516 0.83 1.54 0.68 165 XM_E_Blogspot 3345 0.55 0.08 0.65 166 XMSexyCombo_04 3223 0.68 0.94 0.62 167 XM_H_PHPMailer 3196 0.69 1.02 0.62 168 XM_B_REG_HTML 3160 0.55 0.27 0.61 169 T_OBFU_PDF_ATTACH 3099 0.53 0.17 0.60 170 FORGED_GMAIL_RCVD 3071 0.74 1.43 0.59 171 DKIM_ADSP_NXDOMAIN 3053 0.80 1.77 0.59 172 XMMoneyMeta_00 3019 0.79 1.76 0.58 173 RCVD_IN_MSPIKE_L3 2969 1.23 4.32 0.58 174 XMHTMLBadTable_001 2963 0.54 0.40 0.57 175 XM_DIRTYINTL 2901 1.34 4.96 0.56 176 TR_BOTNET_NEGATE 2840 0.54 0.48 0.55 177 DIET_1 2838 0.69 1.36 0.55 178 T_TooManySym_04 2786 0.46 0.06 0.54 179 XMNoVowels 2729 0.51 0.41 0.53 180 TR_LOTS_OF_MONEY3 2721 0.81 2.13 0.53 181 HTML_IMAGE_ONLY_20 2719 0.49 0.33 0.53 182 XMPhish30 2658 0.59 0.92 0.51 183 XMPhish08 2648 0.59 0.94 0.51 184 RCVD_IN_SORBS_DUL 2561 0.46 0.31 0.50 185 NUMERIC_HTTP_ADDR 2526 0.55 0.82 0.49 186 MISSING_HEADERS 2524 0.57 0.96 0.49 187 T_PDS_OTHER_BAD_TLD 2510 0.77 2.11 0.49 188 XMBody_78 2503 0.59 1.08 0.48 189 XMSubMetaSxObfu_03 2466 0.64 1.39 0.48 190 HTML_TAG_BALANCE_BODY 2405 0.51 0.74 0.47 191 FROM_GOV_SPOOF 2405 0.42 0.20 0.47 192 FROM_GOV_DKIM_AU 2341 0.39 0.11 0.45 193 XM_S_SubURI 2293 0.39 0.11 0.44 194 XMSlimDrugH 2290 0.56 1.08 0.44 195 TR_XM_UnparsRelay 2288 0.85 2.77 0.44 196 HTML_IMAGE_ONLY_28 2272 0.42 0.35 0.44 197 XM_B_COPY_HTML 2239 0.51 0.85 0.43 198 RELAYCOUNTRY_DE 2225 0.69 1.93 0.43 199 SHORT_HELO_AND_INLINE_IMAGE 2208 0.37 0.09 0.43 200 XMOemUri 2191 0.41 0.32 0.42 ----------------------------------------------------------------------