Email: 750373 Autolearn: 0 AvgScore: 0.20 AvgScanTime: 1.17 sec Spam: 132073 Autolearn: 0 AvgScore: 13.96 AvgScanTime: 1.15 sec Ham: 618300 Autolearn: 0 AvgScore: -2.74 AvgScanTime: 1.17 sec Time Spent Running SA: 243.41 hours Time Spent Processing Spam: 42.25 hours Time Spent Processing Ham: 201.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 125289 97.74 94.86 98.35 2 HTML_MESSAGE 123084 89.34 93.19 88.52 3 RELAYCOUNTRY_US 82995 78.50 62.84 81.84 4 XM_B_Unicode 80663 70.60 61.07 72.63 5 DKIM_SIGNED 78919 66.55 59.75 68.00 6 XM_DK_Pass 76377 65.30 57.83 66.89 7 DKIM_VALID 74037 63.41 56.06 64.98 8 XM_B_SpammyWords 70570 49.18 53.43 48.28 9 XMListUnsubscribeExists 64987 47.17 49.21 46.74 10 MIME_HTML_ONLY 58562 27.46 44.34 23.86 11 DKIM_VALID_AU 56249 47.86 42.59 48.99 12 RCVD_IN_MSPIKE_H2 54655 26.47 41.38 23.29 13 XM_DK_Undo_02 50986 14.51 38.60 9.36 14 RELAYCOUNTRY_META 48560 10.42 36.77 4.80 15 BAYES_50 43347 45.63 32.82 48.37 16 BAYES_99 42574 10.59 32.24 5.97 17 HTML_IMAGE_RATIO_02 38986 10.46 29.52 6.39 18 BOTNET 38845 6.88 29.41 2.07 19 XM_B_Unicode3 38381 40.56 29.06 43.01 20 XM_B_SpammyWords2 37424 21.63 28.34 20.20 21 DKIM_VALID_EF 36408 25.22 27.57 24.72 22 HTML_MIME_NO_HTML_TAG 34453 6.60 26.09 2.44 23 UNTRUSTED_Relay 31544 5.80 23.88 1.94 24 RCVD_IN_PSBL 30672 4.11 23.22 0.03 25 BAYES_999 30482 7.91 23.08 4.67 26 T_REMOTE_IMAGE 30292 6.55 22.94 3.05 27 LOC_TINY_FONT_1 30149 22.77 22.83 22.76 28 T_KAM_HTML_FONT_INVALID 27766 17.87 21.02 17.20 29 XMSubLong 26567 20.38 20.12 20.44 30 HTML_FONT_LOW_CONTRAST 26219 24.32 19.85 25.28 31 T_TM2_M_HEADER_IN_MSG 25338 24.47 19.18 25.60 32 FVGT_m_MULTI_ODD 22926 19.49 17.36 19.95 33 FROM_EXCESS_BASE64 21875 5.04 16.56 2.58 34 XMSubGiftCard1 20576 2.80 15.58 0.07 35 XM_Body_Dirty_Words 20561 12.43 15.57 11.76 36 XM_Multi_Part_URI 19966 11.67 15.12 10.93 37 XM_UncommonTLD01 19961 5.00 15.11 2.84 38 XM_B_Unsub 17088 10.21 12.94 9.63 39 BAYES_80 16573 5.39 12.55 3.86 40 HTML_IMAGE_ONLY_16 15947 2.37 12.07 0.30 41 BOTNET_IPINHOSTNAME 15791 6.03 11.96 4.76 42 HTML_SHORT_LINK_IMG_2 15572 2.16 11.79 0.10 43 LOTS_OF_MONEY 15279 8.07 11.57 7.32 44 BAYES_60 14896 7.06 11.28 6.16 45 MPART_ALT_DIFF 13989 9.24 10.59 8.96 46 MIME_HTML_MOSTLY 13873 3.63 10.50 2.16 47 XM_B_Phish_Phrases 13702 6.68 10.37 5.90 48 BOTNET_NORDNS 12669 1.70 9.59 0.01 49 HTML_IMAGE_ONLY_12 12411 1.80 9.40 0.18 50 HTML_SHORT_LINK_IMG_1 12187 1.65 9.23 0.03 51 BODY_URI_ONLY 12155 1.65 9.20 0.04 52 RCVD_IN_MSPIKE_BL 12010 2.41 9.09 0.99 53 XM_B_SpammyWords3 11388 5.79 8.62 5.19 54 URI_PHP_REDIR 10487 1.42 7.94 0.02 55 RCVD_IN_MSPIKE_WL 10281 22.03 7.78 25.07 56 XMSexyCombo_05 10279 4.60 7.78 3.92 57 XM_Evil_Numbers_Gen 9706 8.53 7.35 8.79 58 XM_UB50 9534 2.10 7.22 1.01 59 RELAYCOUNTRY_FR 9362 1.51 7.09 0.32 60 RCVD_IN_BL_SPAMCOP_NET 9119 2.50 6.90 1.56 61 BAYES_95 9048 3.33 6.85 2.58 62 SpammyFromTLD_01 9020 1.91 6.83 0.85 63 HK_RANDOM_FROM 8886 1.27 6.73 0.10 64 SUBJ_ALL_CAPS 8716 2.39 6.60 1.49 65 TR_XM_PhishingBody 8608 3.42 6.52 2.76 66 RELAYCOUNTRY_CA 8402 2.35 6.36 1.50 67 XM_Combo_Sbj 8048 1.27 6.09 0.24 68 XMSubGiftCard2 7951 1.09 6.02 0.03 69 HTML_FONT_TINY_NORDNS 7452 1.22 5.64 0.27 70 XMSubMetaSx_00 7301 4.05 5.53 3.74 71 LotsOfNums_01 7105 7.57 5.38 8.04 72 KHOP_HELO_FCRDNS 7048 2.02 5.34 1.31 73 XM_SPF_SoftFail 7030 2.25 5.32 1.60 74 SpammyFromTLD_02 6549 1.10 4.96 0.27 75 XM_H_Long_From01 6423 5.21 4.86 5.28 76 XM_UB99 6409 0.86 4.85 0.01 77 RCVD_IN_RP_RNBL 6211 0.90 4.70 0.08 78 RELAYCOUNTRY_GB 6181 1.53 4.68 0.86 79 XM_B_SpammyTLD 6057 2.08 4.59 1.55 80 XM_B_COVIDMETA 6008 1.95 4.55 1.39 81 TooManyTo_001 5863 6.56 4.44 7.01 82 XM_UB80 5830 0.82 4.41 0.05 83 XM_UB60 5732 0.89 4.34 0.15 84 RCVD_IN_MSPIKE_L3 5658 1.21 4.28 0.56 85 XM_DIRTYINTL 5607 1.27 4.25 0.63 86 RCVD_IN_MSPIKE_L5 5561 1.01 4.21 0.32 87 RCVD_IN_MSPIKE_H3 5353 12.36 4.05 14.14 88 UNPARSEABLE_RELAY 5137 6.49 3.89 7.05 89 XMBody_17 5122 1.45 3.88 0.93 90 HTML_IMAGE_RATIO_04 5038 12.70 3.81 14.60 91 LH_URI_DOM_IN_PATH 5026 1.91 3.81 1.50 92 TO_NO_BRKTS_HTML_ONLY 5020 0.80 3.80 0.16 93 HTML_IMAGE_ONLY_28 4938 0.96 3.74 0.37 94 DKIM_INVALID 4882 3.14 3.70 3.02 95 XMBrknScrpt_02 4695 1.65 3.55 1.24 96 RCVD_IN_MSPIKE_H4 4635 8.16 3.51 9.15 97 XM_B_Phish66 4373 1.81 3.31 1.48 98 T_XMDrugObfuBody_08 4179 1.82 3.16 1.54 99 XMNumbers 4012 3.02 3.04 3.02 100 XMOffer 3997 0.56 3.03 0.03 101 XM_UB999 3888 0.53 2.94 0.01 102 FROM_LOCAL_NOVOWEL 3734 0.52 2.83 0.03 103 XM_CamelCaseFrm001 3702 1.87 2.80 1.67 104 XM_OfRef6 3692 1.51 2.80 1.23 105 XM_SendGrid 3652 5.38 2.77 5.94 106 TR_XM_RelayPhish 3638 0.60 2.75 0.14 107 T_PDS_OTHER_BAD_TLD 3617 0.65 2.74 0.21 108 HTML_IMAGE_RATIO_08 3437 2.04 2.60 1.92 109 XM_B_Unsub2 3412 2.05 2.58 1.93 110 TM2_M_URI_OPT_OUT 3394 2.99 2.57 3.08 111 TR_XM_SB_Phish 3361 2.05 2.54 1.95 112 XMDiploma_00 3216 1.82 2.44 1.69 113 XM_UB95 3143 0.44 2.38 0.03 114 XMSubPhish11 3117 2.00 2.36 1.92 115 TR_XM_MaxSPIKE 3089 0.45 2.34 0.05 116 RELAYCOUNTRY_KR 3085 0.42 2.34 0.02 117 XM_URI_RBL 3058 0.55 2.32 0.18 118 URIBL_SBL_A 3042 0.57 2.30 0.19 119 XMSexyCombo_01 2983 1.13 2.26 0.89 120 HTML_IMAGE_RATIO_06 2927 4.18 2.22 4.60 121 XMStrtUSub 2885 8.05 2.18 9.30 122 TR_MetaPhish_Combo_01 2882 0.95 2.18 0.69 123 MISSING_HEADERS 2879 0.72 2.18 0.40 124 TR_XM_COVIDMETA4 2835 0.84 2.15 0.56 125 TR_XM_PHPDW 2820 1.23 2.14 1.03 126 TR_XM_PHPForged 2781 1.21 2.11 1.02 127 XM_B_SpammyWords4 2776 0.98 2.10 0.74 128 TR_XM_FormFill2 2746 1.20 2.08 1.02 129 XM_H_PHPOS 2738 1.20 2.07 1.01 130 FVGT_m_MULTI_ODD_EMAIL 2734 0.39 2.07 0.03 131 URI_HEX 2686 1.83 2.03 1.79 132 DKIM_ADSP_CUSTOM_MED 2669 1.49 2.02 1.38 133 TR_XM_MaxBayes 2631 0.39 1.99 0.05 134 TR_LOTS_OF_MONEY3 2548 0.76 1.93 0.51 135 RELAYCOUNTRY_DE 2541 0.60 1.92 0.31 136 NML_ADSP_CUSTOM_MED 2536 1.26 1.92 1.11 137 ALL_TRUSTED 2517 12.28 1.91 14.49 138 XMGenDplmaNmb 2490 1.19 1.89 1.05 139 RELAYCOUNTRY_HK 2474 0.40 1.87 0.08 140 T_TooManySym_01 2439 3.62 1.85 4.00 141 TR_XM_UnparsRelay 2428 0.72 1.84 0.48 142 TR_XM_COVIDMETA1 2421 0.57 1.83 0.30 143 XMPhish14 2402 0.69 1.82 0.45 144 FORGED_GMAIL_RCVD 2369 1.07 1.79 0.92 145 TR_Symld_Words 2255 1.75 1.71 1.76 146 XMSubNoVowel 2088 3.18 1.58 3.52 147 TM2_M_A_HREF_HREF 2026 0.59 1.53 0.39 148 BAYES_40 2021 4.76 1.53 5.45 149 TR_XM_SpoofStaff 2010 0.35 1.52 0.10 150 RELAYCOUNTRY_AU 1991 0.55 1.51 0.35 151 XMHTML_After_End 1986 0.97 1.50 0.86 152 MIME_QP_LONG_LINE 1985 4.43 1.50 5.05 153 XMSpoofStaff2 1974 0.34 1.49 0.10 154 XM_H_SpoofStaff4 1939 0.34 1.47 0.10 155 XM_JunkDunk 1930 0.26 1.46 0.00 156 TR_XM_PSC1 1896 0.33 1.44 0.10 157 RELAYCOUNTRY_SG 1877 0.31 1.42 0.07 158 MIME_HTML_ONLY_MULTI 1854 6.10 1.40 7.10 159 FROM_SUSPICIOUS_NTLD 1831 0.30 1.39 0.07 160 T_XMDrugObfuBody_14 1825 1.47 1.38 1.49 161 TR_XM_DK_SendGrid 1813 3.14 1.37 3.52 162 TR_Mismatch_TLD_01 1806 0.40 1.37 0.19 163 TM2_M_VERY_LONG_WORD 1804 1.08 1.37 1.02 164 TR_XM_INV_DKIM 1804 0.36 1.37 0.15 165 T_XMDrugObfuBody_00 1773 0.77 1.34 0.65 166 TR_XM_SpoofStaff2 1764 0.24 1.34 0.00 167 RELAYCOUNTRY_CL 1744 0.23 1.32 0.00 168 DKIM_ADSP_NXDOMAIN 1741 1.35 1.32 1.36 169 FROM_SUSPICIOUS_NTLD_FP 1740 0.28 1.32 0.06 170 BAYES_20 1701 5.10 1.29 5.92 171 TR_Caps_n_Bayes_80 1685 0.27 1.28 0.05 172 TR_XM_PhishingBody2 1668 0.23 1.26 0.01 173 URI_TRY_3LD 1646 1.27 1.25 1.28 174 XM_PDF 1586 3.10 1.20 3.50 175 DATE_IN_PAST_03_06 1577 0.29 1.19 0.10 176 TR_XM_SB_Phish1 1570 0.22 1.19 0.01 177 NO_DNS_FOR_FROM 1562 1.13 1.18 1.12 178 MAILING_LIST_MULTI 1526 2.07 1.16 2.27 179 XMSubMetaSxObfu_03 1512 0.50 1.14 0.36 180 XMStockSpam_06 1488 1.07 1.13 1.06 181 XMSpoofStaff 1488 0.23 1.13 0.04 182 RDNS_DYNAMIC 1466 0.53 1.11 0.40 183 T_FILL_THIS_FORM_SHORT 1431 0.77 1.08 0.70 184 TR_Caps_n_Bayes_99 1366 0.23 1.03 0.06 185 RCVD_IN_IADB_LISTED 1364 3.74 1.03 4.32 186 T_XMHurry_00 1357 0.63 1.03 0.55 187 XMMoneyMeta_00 1356 0.65 1.03 0.57 188 T_Symld_Words_02 1316 0.73 1.00 0.67 189 DIET_1 1314 0.77 0.99 0.72 190 MIME_CHARSET_FARAWAY 1299 0.25 0.98 0.10 191 URI_NOVOWEL 1281 1.84 0.97 2.03 192 XMReplyNow 1252 0.25 0.95 0.10 193 XMBody_78 1236 0.54 0.94 0.46 194 T_MONEY_PERCENT 1220 0.38 0.92 0.26 195 TR_LOTS_OF_MONEY2 1220 0.38 0.92 0.26 196 XMSubGarbage 1193 1.27 0.90 1.35 197 RELAYCOUNTRY_VN 1192 0.16 0.90 0.01 198 TR_Mismatch_TLD_02 1110 0.24 0.84 0.11 199 TR_XM_Spammywords 1096 0.39 0.83 0.30 200 XM_S_SpammyWords 1096 0.39 0.83 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 608113 97.74 94.86 98.35 2 HTML_MESSAGE 547315 89.34 93.19 88.52 3 RELAYCOUNTRY_US 506016 78.50 62.84 81.84 4 XM_B_Unicode 449097 70.60 61.07 72.63 5 DKIM_SIGNED 420465 66.55 59.75 68.00 6 XM_DK_Pass 413602 65.30 57.83 66.89 7 DKIM_VALID 401773 63.41 56.06 64.98 8 DKIM_VALID_AU 302906 47.86 42.59 48.99 9 BAYES_50 299077 45.63 32.82 48.37 10 XM_B_SpammyWords 298491 49.18 53.43 48.28 11 XMListUnsubscribeExists 288986 47.17 49.21 46.74 12 XM_B_Unicode3 265959 40.56 29.06 43.01 13 T_TM2_M_HEADER_IN_MSG 158305 24.47 19.18 25.60 14 HTML_FONT_LOW_CONTRAST 156308 24.32 19.85 25.28 15 RCVD_IN_MSPIKE_WL 155027 22.03 7.78 25.07 16 DKIM_VALID_EF 152872 25.22 27.57 24.72 17 MIME_HTML_ONLY 147507 27.46 44.34 23.86 18 RCVD_IN_MSPIKE_H2 143980 26.47 41.38 23.29 19 LOC_TINY_FONT_1 140714 22.77 22.83 22.76 20 XMSubLong 126386 20.38 20.12 20.44 21 XM_B_SpammyWords2 124908 21.63 28.34 20.20 22 FVGT_m_MULTI_ODD 123320 19.49 17.36 19.95 23 BAYES_00 109527 14.72 0.72 17.71 24 T_KAM_HTML_FONT_INVALID 106349 17.87 21.02 17.20 25 HTML_IMAGE_RATIO_04 90248 12.70 3.81 14.60 26 ALL_TRUSTED 89620 12.28 1.91 14.49 27 RCVD_IN_MSPIKE_H3 87429 12.36 4.05 14.14 28 XM_Body_Dirty_Words 72736 12.43 15.57 11.76 29 HTML_FONT_FACE_BAD 71281 9.61 0.61 11.53 30 XM_H_Trusted_IP 70795 9.43 0.00 11.45 31 XM_Multi_Part_URI 67602 11.67 15.12 10.93 32 XM_B_Unsub 59525 10.21 12.94 9.63 33 XM_DK_Undo_02 57898 14.51 38.60 9.36 34 XMStrtUSub 57493 8.05 2.18 9.30 35 RCVD_IN_MSPIKE_H4 56590 8.16 3.51 9.15 36 MPART_ALT_DIFF 55373 9.24 10.59 8.96 37 XM_Evil_Numbers_Gen 54328 8.53 7.35 8.79 38 TR_XM_DK_Bayes 51655 6.94 0.34 8.35 39 TR_XM_DK_Bayes1 50197 6.75 0.32 8.12 40 LotsOfNums_01 49686 7.57 5.38 8.04 41 LOTS_OF_MONEY 45272 8.07 11.57 7.32 42 TR_XM_DK_Bayes2 44885 6.03 0.27 7.26 43 MIME_HTML_ONLY_MULTI 43907 6.10 1.40 7.10 44 UNPARSEABLE_RELAY 43579 6.49 3.89 7.05 45 TooManyTo_001 43345 6.56 4.44 7.01 46 HTML_IMAGE_RATIO_02 39488 10.46 29.52 6.39 47 RCVD_IN_RP_SAFE 39012 5.27 0.39 6.31 48 BAYES_60 38061 7.06 11.28 6.16 49 BAYES_99 36911 10.59 32.24 5.97 50 XM_SendGrid 36731 5.38 2.77 5.94 51 BAYES_20 36593 5.10 1.29 5.92 52 XM_B_Phish_Phrases 36453 6.68 10.37 5.90 53 RCVD_IN_RP_CERTIFIED 36254 4.87 0.21 5.86 54 XM_DKIMWhitelistDomains 36072 4.81 0.00 5.83 55 BAYES_40 33689 4.76 1.53 5.45 56 XM_H_Long_From01 32673 5.21 4.86 5.28 57 XM_B_SpammyWords3 32089 5.79 8.62 5.19 58 IN_ZIMBRA_NJ_WHITELIST 31318 4.18 0.05 5.07 59 MIME_QP_LONG_LINE 31237 4.43 1.50 5.05 60 RELAYCOUNTRY_META 29653 10.42 36.77 4.80 61 BOTNET_IPINHOSTNAME 29455 6.03 11.96 4.76 62 BAYES_999 28898 7.91 23.08 4.67 63 HTML_IMAGE_RATIO_06 28437 4.18 2.22 4.60 64 ANY_BOUNCE_MESSAGE 28287 3.89 0.70 4.57 65 BOUNCE_MESSAGE 28283 3.89 0.69 4.57 66 RCVD_IN_IADB_LISTED 26702 3.74 1.03 4.32 67 T_TooManySym_01 24744 3.62 1.85 4.00 68 BAYES_05 24594 3.40 0.72 3.98 69 XMSexyCombo_05 24228 4.60 7.78 3.92 70 BAYES_80 23869 5.39 12.55 3.86 71 RCVD_IN_IADB_SPF 23476 3.27 0.82 3.80 72 XMSubMetaSx_00 23109 4.05 5.53 3.74 73 XMSubNoVowel 21781 3.18 1.58 3.52 74 TR_XM_DK_SendGrid 21758 3.14 1.37 3.52 75 XM_PDF 21645 3.10 1.20 3.50 76 RCVD_IN_IADB_SENDERID 21130 2.95 0.74 3.42 77 RCVD_IN_IADB_DK 20522 2.87 0.75 3.32 78 TM2_M_URI_OPT_OUT 19028 2.99 2.57 3.08 79 T_REMOTE_IMAGE 18870 6.55 22.94 3.05 80 DKIM_INVALID 18692 3.14 3.70 3.02 81 XMNumbers 18679 3.02 3.04 3.02 82 XM_UncommonTLD01 17574 5.00 15.11 2.84 83 TR_XM_PhishingBody 17086 3.42 6.52 2.76 84 RCVD_IN_IADB_VOUCHED 16022 2.24 0.61 2.59 85 FROM_EXCESS_BASE64 15979 5.04 16.56 2.58 86 BAYES_95 15976 3.33 6.85 2.58 87 HTML_MIME_NO_HTML_TAG 15074 6.60 26.09 2.44 88 MAILING_LIST_MULTI 14008 2.07 1.16 2.27 89 MIME_HTML_MOSTLY 13376 3.63 10.50 2.16 90 BOTNET 12816 6.88 29.41 2.07 91 URI_NOVOWEL 12555 1.84 0.97 2.03 92 TR_XM_SB_Phish 12053 2.05 2.54 1.95 93 UNTRUSTED_Relay 11992 5.80 23.88 1.94 94 XM_B_Unsub2 11964 2.05 2.58 1.93 95 T_TooManySym_02 11938 1.69 0.56 1.93 96 XMSubPhish11 11874 2.00 2.36 1.92 97 HTML_IMAGE_RATIO_08 11856 2.04 2.60 1.92 98 URI_HEX 11040 1.83 2.03 1.79 99 RCVD_IN_MSPIKE_H5 11008 1.51 0.22 1.78 100 TR_Symld_Words 10880 1.75 1.71 1.76 101 TooManyTo_002 10788 1.56 0.69 1.74 102 RCVD_IN_IADB_OPTIN 10653 1.50 0.45 1.72 103 XMDiploma_00 10446 1.82 2.44 1.69 104 XM_CamelCaseFrm001 10320 1.87 2.80 1.67 105 XM_SPF_SoftFail 9876 2.25 5.32 1.60 106 RCVD_IN_BL_SPAMCOP_NET 9673 2.50 6.90 1.56 107 XM_B_SpammyTLD 9569 2.08 4.59 1.55 108 T_XMDrugObfuBody_08 9506 1.82 3.16 1.54 109 XM_DK_Undo_01 9443 1.39 0.77 1.53 110 LH_URI_DOM_IN_PATH 9294 1.91 3.81 1.50 111 RELAYCOUNTRY_CA 9255 2.35 6.36 1.50 112 SUBJ_ALL_CAPS 9238 2.39 6.60 1.49 113 T_XMDrugObfuBody_14 9185 1.47 1.38 1.49 114 XM_B_Phish66 9176 1.81 3.31 1.48 115 TVD_RCVD_IP 9046 1.27 0.36 1.46 116 XM_B_COVIDMETA 8594 1.95 4.55 1.39 117 DKIM_ADSP_CUSTOM_MED 8545 1.49 2.02 1.38 118 DKIM_ADSP_NXDOMAIN 8413 1.35 1.32 1.36 119 XMSubGarbage 8343 1.27 0.90 1.35 120 IN_HORDE_ADDRESS_BOOK 8238 1.13 0.19 1.33 121 XMSubLongNoVowel 8155 1.21 0.71 1.32 122 KHOP_HELO_FCRDNS 8087 2.02 5.34 1.31 123 XM_GoogleGroups 8056 1.13 0.32 1.30 124 HELO_NO_DOMAIN 7925 1.20 0.83 1.28 125 HELO_NODOT 7925 1.20 0.83 1.28 126 URI_TRY_3LD 7895 1.27 1.25 1.28 127 XMBrknScrpt_02 7674 1.65 3.55 1.24 128 XM_OfRef6 7630 1.51 2.80 1.23 129 INVALID_MSGID 7375 1.09 0.59 1.19 130 HELO_MISC_IP 7225 1.03 0.36 1.17 131 CK_HELO_DYNAMIC_SPLIT_IP 7220 1.04 0.46 1.17 132 TooManyTo_003 7176 1.05 0.53 1.16 133 NO_DNS_FOR_FROM 6899 1.13 1.18 1.12 134 NML_ADSP_CUSTOM_MED 6883 1.26 1.92 1.11 135 XMGappySubj_01 6543 0.90 0.17 1.06 136 XMStockSpam_06 6530 1.07 1.13 1.06 137 XMCapTrack 6527 0.94 0.39 1.06 138 XMGenDplmaNmb 6466 1.19 1.89 1.05 139 TO_MALFORMED 6413 0.87 0.06 1.04 140 TR_XM_PHPDW 6373 1.23 2.14 1.03 141 TM2_M_VERY_LONG_WORD 6327 1.08 1.37 1.02 142 TR_XM_FormFill2 6287 1.20 2.08 1.02 143 TR_XM_PHPForged 6284 1.21 2.11 1.02 144 XM_UB50 6241 2.10 7.22 1.01 145 XM_H_PHPOS 6240 1.20 2.07 1.01 146 RCVD_IN_MSPIKE_BL 6096 2.41 9.09 0.99 147 TR_MSPIKEBAYES00 5764 0.77 0.01 0.93 148 XMBody_17 5727 1.45 3.88 0.93 149 FORGED_GMAIL_RCVD 5692 1.07 1.79 0.92 150 XMBdyGiftCard01 5621 0.86 0.64 0.91 151 XMSexyCombo_01 5509 1.13 2.26 0.89 152 XM_H_Long_From02 5477 0.84 0.62 0.89 153 XM_E_Blogspot 5452 0.74 0.09 0.88 154 RELAYCOUNTRY_GB 5336 1.53 4.68 0.86 155 XMHTML_After_End 5327 0.97 1.50 0.86 156 SpammyFromTLD_01 5281 1.91 6.83 0.85 157 TooManyTo_004 5011 0.75 0.46 0.81 158 T_TooManySym_03 4965 0.69 0.14 0.80 159 USER_IN_DEF_DKIM_WL 4927 0.66 0.00 0.80 160 XM_B_SpammyWords4 4555 0.98 2.10 0.74 161 HTTPS_HTTP_MISMATCH 4468 0.71 0.66 0.72 162 DIET_1 4434 0.77 0.99 0.72 163 XM_ProductURIs 4400 0.66 0.42 0.71 164 T_FILL_THIS_FORM_SHORT 4358 0.77 1.08 0.70 165 TR_MetaPhish_Combo_01 4240 0.95 2.18 0.69 166 T_Symld_Words_02 4145 0.73 1.00 0.67 167 FROM_GOV_DKIM_AU 4080 0.56 0.07 0.66 168 TooManyTo_005 4071 0.61 0.37 0.66 169 T_XMDrugObfuBody_00 4000 0.77 1.34 0.65 170 XM_ShortIntro_01 3966 0.61 0.48 0.64 171 XM_DIRTYINTL 3913 1.27 4.25 0.63 172 XM_RXBody 3765 0.57 0.37 0.61 173 XMHTMLBadTable_001 3563 0.55 0.44 0.58 174 TR_BOTNET_NEGATE 3551 0.55 0.42 0.57 175 XMBody_95 3548 0.49 0.08 0.57 176 XMMoneyMeta_00 3546 0.65 1.03 0.57 177 XMSubMetaI_00 3503 0.56 0.51 0.57 178 XM_SPF_Unknown 3465 0.59 0.74 0.56 179 HTML_FONT_SIZE_LARGE 3456 0.49 0.19 0.56 180 TR_XM_COVIDMETA4 3451 0.84 2.15 0.56 181 RCVD_IN_MSPIKE_L3 3442 1.21 4.28 0.56 182 TM2_M_BODY_EMPTY 3433 0.49 0.19 0.56 183 T_OBFU_PDF_ATTACH 3428 0.50 0.26 0.55 184 T_XMHurry_00 3371 0.63 1.03 0.55 185 HTML_TAG_BALANCE_BODY 3228 0.53 0.56 0.52 186 TR_LOTS_OF_MONEY3 3134 0.76 1.93 0.51 187 TR_XM_UnparsRelay 2990 0.72 1.84 0.48 188 XM_B_COPY_HTML 2977 0.49 0.55 0.48 189 XMSexyCombo_04 2929 0.52 0.76 0.47 190 PLING_QUERY 2897 0.44 0.30 0.47 191 NUMERIC_HTTP_ADDR 2854 0.47 0.51 0.46 192 XMBody_78 2838 0.54 0.94 0.46 193 T_TooManySym_04 2802 0.38 0.06 0.45 194 XMPhish14 2770 0.69 1.82 0.45 195 XM_B_REG_HTML 2741 0.38 0.09 0.44 196 XM_H_PHPMailer 2712 0.48 0.69 0.44 197 HTML_IMAGE_ONLY_20 2684 0.40 0.25 0.43 198 XMSolicitRefs_0 2670 0.40 0.25 0.43 199 XMNoVowels 2669 0.45 0.51 0.43 200 XMPhish08 2622 0.47 0.71 0.42 ----------------------------------------------------------------------