Email: 722808 Autolearn: 0 AvgScore: 2.04 AvgScanTime: 1.16 sec Spam: 137146 Autolearn: 0 AvgScore: 14.69 AvgScanTime: 1.11 sec Ham: 585662 Autolearn: 0 AvgScore: -0.92 AvgScanTime: 1.17 sec Time Spent Running SA: 233.28 hours Time Spent Processing Spam: 42.47 hours Time Spent Processing Ham: 190.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 131337 97.75 95.76 98.21 2 HTML_MESSAGE 128208 85.37 93.48 83.47 3 XM_B_Unicode 85007 66.88 61.98 68.02 4 DKIM_SIGNED 84318 72.09 61.48 74.58 5 RELAYCOUNTRY_US 81364 74.73 59.33 78.34 6 XM_DK_Pass 81261 70.77 59.25 73.47 7 XM_B_SpammyWords 80511 50.23 58.70 48.24 8 DKIM_VALID 78652 68.88 57.35 71.58 9 XMListUnsubscribeExists 71144 52.10 51.87 52.15 10 DKIM_VALID_AU 60570 52.04 44.16 53.88 11 MIME_HTML_ONLY 59850 24.30 43.64 19.77 12 BAYES_99 54908 13.15 40.04 6.85 13 XM_DK_Undo_02 53412 15.79 38.95 10.37 14 RELAYCOUNTRY_META 52402 11.68 38.21 5.47 15 RCVD_IN_MSPIKE_H2 51815 27.53 37.78 25.13 16 BAYES_999 41321 10.10 30.13 5.41 17 DKIM_VALID_EF 41239 27.67 30.07 27.11 18 BAYES_50 40207 46.39 29.32 50.39 19 XM_B_Unicode3 37353 36.77 27.24 39.01 20 XM_B_SpammyWords2 36592 23.96 26.68 23.32 21 BOTNET 35823 6.55 26.12 1.97 22 UNTRUSTED_Relay 35381 6.58 25.80 2.09 23 LOC_TINY_FONT_1 35236 24.64 25.69 24.40 24 XMSubLong 34498 22.75 25.15 22.19 25 XM_UncommonTLD01 34047 7.16 24.83 3.02 26 HTML_MIME_NO_HTML_TAG 33663 6.34 24.55 2.07 27 XM_Multi_Part_URI 31318 14.23 22.84 12.22 28 RCVD_IN_BL_SPAMCOP_NET 28854 5.46 21.04 1.81 29 T_KAM_HTML_FONT_INVALID 27317 18.81 19.92 18.56 30 HTML_FONT_LOW_CONTRAST 27029 25.65 19.71 27.04 31 RCVD_IN_PSBL 25997 3.61 18.96 0.02 32 T_TM2_M_HEADER_IN_MSG 25761 25.97 18.78 27.65 33 XM_B_Unsub 24450 11.59 17.83 10.13 34 T_REMOTE_IMAGE 23969 6.18 17.48 3.54 35 FVGT_m_MULTI_ODD 23845 21.84 17.39 22.88 36 XM_Body_Dirty_Words 21646 13.62 15.78 13.11 37 BODY_URI_ONLY 20909 3.10 15.25 0.25 38 HTML_IMAGE_RATIO_02 19027 8.23 13.87 6.91 39 LOTS_OF_MONEY 17100 8.66 12.47 7.77 40 MPART_ALT_DIFF 16766 5.73 12.22 4.21 41 SpammyFromTLD_02 15283 2.40 11.14 0.36 42 BOTNET_IPINHOSTNAME 15248 6.17 11.12 5.02 43 MIME_HTML_MOSTLY 15193 3.74 11.08 2.02 44 RCVD_IN_MSPIKE_BL 14066 2.86 10.26 1.13 45 BAYES_80 13089 5.33 9.54 4.34 46 URI_PHP_REDIR 12976 1.81 9.46 0.02 47 BOTNET_NORDNS 12916 1.80 9.42 0.01 48 SpammyFromTLD_01 12759 2.48 9.30 0.88 49 LOCALPART_IN_SUBJECT 12623 1.76 9.20 0.02 50 BAYES_60 12334 7.29 8.99 6.89 51 XM_B_Phish_Phrases 12175 6.91 8.88 6.45 52 XM_B_SpammyWords3 12138 6.86 8.85 6.40 53 XMSexyCombo_05 11988 5.08 8.74 4.22 54 RELAYCOUNTRY_FR 11153 1.79 8.13 0.30 55 RCVD_IN_MSPIKE_WL 11039 24.07 8.05 27.82 56 HTML_IMAGE_ONLY_12 10839 1.67 7.90 0.21 57 XM_UB99 10792 1.50 7.87 0.01 58 FROM_SUSPICIOUS_NTLD 10514 1.51 7.67 0.07 59 FROM_SUSPICIOUS_NTLD_FP 10416 1.49 7.59 0.06 60 HTML_SHORT_LINK_IMG_2 10107 1.45 7.37 0.06 61 XM_UB50 10016 2.34 7.30 1.18 62 FROM_EXCESS_BASE64 9753 3.32 7.11 2.43 63 HTML_FONT_TINY_NORDNS 9750 1.54 7.11 0.24 64 DKIM_ADSP_NXDOMAIN 9670 1.91 7.05 0.71 65 KHOP_HELO_FCRDNS 9571 2.64 6.98 1.62 66 BAYES_95 9317 3.40 6.79 2.60 67 XM_Evil_Numbers_Gen 9313 7.70 6.79 7.92 68 RCVD_IN_MSPIKE_L3 8855 1.79 6.46 0.70 69 T_HTML_TAG_BALANCE_CENTER 8596 1.47 6.27 0.35 70 XM_JunkDunk 8455 1.17 6.16 0.00 71 HDRS_MISSP 8003 1.13 5.84 0.03 72 RELAYCOUNTRY_CA 7995 2.42 5.83 1.62 73 XMBody_50 7922 1.10 5.78 0.00 74 XMSubMetaSx_00 7751 3.94 5.65 3.54 75 XM_UB999 7430 1.03 5.42 0.00 76 XM_H_Long_From01 7245 5.73 5.28 5.84 77 TR_XM_PhishingBody 7158 3.57 5.22 3.18 78 RELAYCOUNTRY_GB 6614 1.60 4.82 0.84 79 HK_RANDOM_FROM 6542 0.99 4.77 0.11 80 XM_DIRTYINTL 6309 1.40 4.60 0.65 81 LotsOfNums_01 6258 7.83 4.56 8.59 82 XM_SPF_SoftFail 6223 2.20 4.54 1.65 83 RCVD_IN_RP_RNBL 6003 0.87 4.38 0.05 84 RCVD_IN_MSPIKE_H3 5996 13.35 4.37 15.46 85 XMBody_17 5924 1.70 4.32 1.08 86 XM_B_COVIDMETA 5863 1.88 4.28 1.32 87 DKIM_INVALID 5666 3.22 4.13 3.00 88 UNPARSEABLE_RELAY 5531 6.97 4.03 7.66 89 XMBrknScrpt_02 5338 1.93 3.89 1.47 90 TooManyTo_001 5061 6.84 3.69 7.57 91 XM_B_Phish66 4848 2.25 3.53 1.95 92 XMNumbers 4817 3.54 3.51 3.54 93 XMSubGiftCard1 4677 0.70 3.41 0.06 94 RCVD_IN_MSPIKE_H4 4618 9.09 3.37 10.43 95 HTML_IMAGE_RATIO_04 4594 4.94 3.35 5.31 96 XM_UB60 4578 0.73 3.34 0.12 97 RCVD_IN_MSPIKE_L5 4445 0.89 3.24 0.35 98 TM2_M_URI_OPT_OUT 4275 3.04 3.12 3.02 99 T_XMDrugObfuBody_08 4261 1.76 3.11 1.45 100 XM_B_SpammyTLD 4252 2.10 3.10 1.87 101 ALL_TRUSTED 4175 14.84 3.04 17.60 102 XM_SendGrid 4162 6.13 3.03 6.86 103 XM_UB80 4161 0.61 3.03 0.04 104 TR_XM_MaxSPIKE 4149 0.63 3.03 0.07 105 RELAYCOUNTRY_IN 4003 0.65 2.92 0.12 106 XM_OfRef6 3992 1.69 2.91 1.40 107 LH_URI_DOM_IN_PATH 3783 2.09 2.76 1.93 108 XM_CamelCaseFrm001 3777 2.03 2.75 1.86 109 T_FILL_THIS_FORM_SHORT 3655 1.13 2.67 0.77 110 XM_URI_RBL 3629 0.64 2.65 0.17 111 T_PDS_OTHER_BAD_TLD 3560 1.04 2.60 0.67 112 URIBL_SBL_A 3505 0.79 2.56 0.38 113 XM_UB95 3477 0.50 2.54 0.02 114 TR_LOTS_OF_MONEY3 3426 1.07 2.50 0.73 115 XM_B_Unsub2 3384 2.56 2.47 2.58 116 XMDiploma_00 3312 2.17 2.41 2.11 117 TR_XM_UnparsRelay 3269 0.84 2.38 0.48 118 SHORTENED_URL_HREF 3136 0.66 2.29 0.28 119 TR_XM_COVIDMETA4 3047 0.79 2.22 0.45 120 HTML_SHORT_LINK_IMG_1 3034 0.61 2.21 0.24 121 RELAYCOUNTRY_NL 3001 0.91 2.19 0.60 122 HTML_IMAGE_RATIO_08 2968 2.22 2.16 2.23 123 RELAYCOUNTRY_AU 2858 0.71 2.08 0.38 124 HTML_IMAGE_RATIO_06 2826 3.01 2.06 3.24 125 HTML_IMAGE_ONLY_08 2824 0.46 2.06 0.09 126 XMSexyCombo_01 2770 0.86 2.02 0.59 127 XM_B_SpammyWords4 2769 0.94 2.02 0.69 128 TR_XM_MaxBayes 2749 0.42 2.00 0.05 129 SHORT_URI_3 2738 0.44 2.00 0.07 130 TR_Mismatch_TLD_01 2735 0.54 1.99 0.19 131 SHORT_SHORTNER 2723 0.39 1.99 0.01 132 XMStrtUSub 2669 3.86 1.95 4.31 133 SHORTENED_URL_SRC 2655 0.37 1.94 0.00 134 SHORTENER_SHORT_IMG 2650 0.37 1.93 0.00 135 TR_Symld_Words 2649 2.16 1.93 2.21 136 FROM_LOCAL_NOVOWEL 2639 0.39 1.92 0.03 137 TR_XM_SB_Phish 2617 2.42 1.91 2.54 138 BAYES_40 2589 4.59 1.89 5.22 139 T_TooManySym_01 2556 4.24 1.86 4.79 140 BAYES_20 2543 6.48 1.85 7.56 141 XMSubPhish11 2484 2.38 1.81 2.51 142 MIME_QP_LONG_LINE 2403 4.69 1.75 5.38 143 T_XMDrugObfuBody_14 2384 1.65 1.74 1.63 144 XMGenDplmaNmb 2369 1.05 1.73 0.89 145 TR_XM_COVIDMETA1 2350 0.76 1.71 0.54 146 TR_XM_PHPDW 2342 0.59 1.71 0.32 147 URI_HEX 2335 1.45 1.70 1.39 148 TR_XM_RelayPhish 2319 0.46 1.69 0.18 149 TR_XM_DK_SendGrid 2316 3.58 1.69 4.02 150 TR_XM_PHPForged 2305 0.55 1.68 0.29 151 TR_XM_FormFill2 2279 0.55 1.66 0.28 152 XM_H_PHPOS 2268 0.54 1.65 0.28 153 XM_BadFromFormat 2258 0.41 1.65 0.12 154 TM2_M_VERY_LONG_WORD 2256 1.28 1.64 1.20 155 TR_XM_FormFill 2221 0.33 1.62 0.03 156 TR_XM_INV_DKIM 2192 0.40 1.60 0.11 157 XMStockSpam_06 2136 1.09 1.56 0.98 158 FVGT_m_MULTI_ODD_EMAIL 2088 0.32 1.52 0.04 159 TO_NO_BRKTS_HTML_ONLY 2070 0.40 1.51 0.13 160 TR_Mismatch_TLD_02 2037 0.37 1.49 0.11 161 MIME_HTML_ONLY_MULTI 2008 2.46 1.46 2.69 162 NO_DNS_FOR_FROM 1956 0.60 1.43 0.41 163 RELAYCOUNTRY_DE 1955 0.62 1.43 0.43 164 URI_TRY_3LD 1926 1.47 1.40 1.48 165 SUBJ_ALL_CAPS 1869 1.34 1.36 1.34 166 DKIM_ADSP_CUSTOM_MED 1741 1.07 1.27 1.02 167 HK_SCAM 1740 0.25 1.27 0.01 168 RELAYCOUNTRY_JP 1715 0.26 1.25 0.03 169 URI_NO_WWW_BIZ_CGI 1694 0.24 1.24 0.01 170 XMSubNoVowel 1680 0.66 1.22 0.53 171 MISSING_HEADERS 1644 0.52 1.20 0.36 172 RELAYCOUNTRY_AE 1631 0.23 1.19 0.00 173 T_XMDrugObfuBody_00 1630 0.74 1.19 0.64 174 NML_ADSP_CUSTOM_MED 1616 0.83 1.18 0.75 175 XMSexyCombo_04 1537 0.34 1.12 0.16 176 XMHTML_After_End 1487 0.92 1.08 0.88 177 XM_PDF 1467 3.47 1.07 4.03 178 XMSubMetaD_00 1408 0.28 1.03 0.10 179 URI_NOVOWEL 1400 2.20 1.02 2.48 180 DATE_IN_PAST_03_06 1390 0.29 1.01 0.12 181 RCVD_IN_IADB_LISTED 1388 4.12 1.01 4.85 182 TR_MetaPhish_Combo_01 1387 0.70 1.01 0.62 183 XM_XX_Yahoo 1366 0.25 1.00 0.08 184 RELAYCOUNTRY_KR 1357 0.20 0.99 0.02 185 T_XMHurry_00 1340 0.70 0.98 0.64 186 RDNS_DYNAMIC 1336 0.54 0.97 0.44 187 TO_NAME_SUBJ_NO_RDNS 1324 0.18 0.97 0.00 188 REPLYTO_WITHOUT_TO_CC 1316 0.23 0.96 0.06 189 TR_Sbj_FN_Bdy 1315 0.31 0.96 0.16 190 FROM_MISSP_EH_MATCH 1298 0.21 0.95 0.03 191 FORGED_GMAIL_RCVD 1298 0.57 0.95 0.48 192 XM_Nigeria_01 1291 0.33 0.94 0.19 193 XM_DK_Undo_01 1291 1.57 0.94 1.72 194 HK_RANDOM_REPLYTO 1268 0.34 0.92 0.21 195 XMObfuSubjects 1264 0.21 0.92 0.04 196 XMSubMetaSxObfu_03 1247 0.47 0.91 0.37 197 MAILING_LIST_MULTI 1246 2.33 0.91 2.66 198 MIME_CHARSET_FARAWAY 1245 0.25 0.91 0.10 199 XM_SPF_Unknown 1191 0.67 0.87 0.62 200 RELAYCOUNTRY_IL 1187 0.17 0.87 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 575179 97.75 95.76 98.21 2 HTML_MESSAGE 488865 85.37 93.48 83.47 3 RELAYCOUNTRY_US 458781 74.73 59.33 78.34 4 DKIM_SIGNED 436787 72.09 61.48 74.58 5 XM_DK_Pass 430306 70.77 59.25 73.47 6 DKIM_VALID 419192 68.88 57.35 71.58 7 XM_B_Unicode 398375 66.88 61.98 68.02 8 DKIM_VALID_AU 315547 52.04 44.16 53.88 9 XMListUnsubscribeExists 305421 52.10 51.87 52.15 10 BAYES_50 295096 46.39 29.32 50.39 11 XM_B_SpammyWords 282544 50.23 58.70 48.24 12 XM_B_Unicode3 228451 36.77 27.24 39.01 13 RCVD_IN_MSPIKE_WL 162910 24.07 8.05 27.82 14 T_TM2_M_HEADER_IN_MSG 161955 25.97 18.78 27.65 15 DKIM_VALID_EF 158756 27.67 30.07 27.11 16 HTML_FONT_LOW_CONTRAST 158353 25.65 19.71 27.04 17 RCVD_IN_MSPIKE_H2 147159 27.53 37.78 25.13 18 LOC_TINY_FONT_1 142879 24.64 25.69 24.40 19 XM_B_SpammyWords2 136561 23.96 26.68 23.32 20 FVGT_m_MULTI_ODD 134013 21.84 17.39 22.88 21 XMSubLong 129944 22.75 25.15 22.19 22 MIME_HTML_ONLY 115811 24.30 43.64 19.77 23 T_KAM_HTML_FONT_INVALID 108674 18.81 19.92 18.56 24 ALL_TRUSTED 103104 14.84 3.04 17.60 25 RCVD_IN_MSPIKE_H3 90520 13.35 4.37 15.46 26 BAYES_00 77021 10.80 0.77 13.15 27 XM_Body_Dirty_Words 76801 13.62 15.78 13.11 28 XM_Multi_Part_URI 71570 14.23 22.84 12.22 29 RCVD_IN_MSPIKE_H4 61074 9.09 3.37 10.43 30 XM_DK_Undo_02 60728 15.79 38.95 10.37 31 XM_B_Unsub 59314 11.59 17.83 10.13 32 TR_XM_DK_Bayes 51940 7.24 0.27 8.87 33 TR_XM_DK_Bayes1 50325 7.01 0.26 8.59 34 LotsOfNums_01 50323 7.83 4.56 8.59 35 ANY_BOUNCE_MESSAGE 48416 6.77 0.39 8.27 36 BOUNCE_MESSAGE 48408 6.77 0.39 8.27 37 XM_Evil_Numbers_Gen 46377 7.70 6.79 7.92 38 LOTS_OF_MONEY 45516 8.66 12.47 7.77 39 UNPARSEABLE_RELAY 44875 6.97 4.03 7.66 40 TR_XM_DK_Bayes2 44772 6.24 0.23 7.64 41 TooManyTo_001 44363 6.84 3.69 7.57 42 BAYES_20 44264 6.48 1.85 7.56 43 RCVD_IN_RP_SAFE 42758 6.00 0.44 7.30 44 HTML_IMAGE_RATIO_02 40464 8.23 13.87 6.91 45 BAYES_60 40360 7.29 8.99 6.89 46 RCVD_IN_RP_CERTIFIED 40247 5.61 0.23 6.87 47 XM_SendGrid 40153 6.13 3.03 6.86 48 BAYES_99 40124 13.15 40.04 6.85 49 XM_DKIMWhitelistDomains 39107 5.41 0.00 6.68 50 XM_B_Phish_Phrases 37789 6.91 8.88 6.45 51 XM_B_SpammyWords3 37455 6.86 8.85 6.40 52 XM_H_Long_From01 34181 5.73 5.28 5.84 53 RELAYCOUNTRY_META 32028 11.68 38.21 5.47 54 BAYES_999 31674 10.10 30.13 5.41 55 MIME_QP_LONG_LINE 31513 4.69 1.75 5.38 56 HTML_IMAGE_RATIO_04 31087 4.94 3.35 5.31 57 IN_ZIMBRA_NJ_WHITELIST 30987 4.29 0.03 5.29 58 BAYES_40 30590 4.59 1.89 5.22 59 BOTNET_IPINHOSTNAME 29378 6.17 11.12 5.02 60 RCVD_IN_IADB_LISTED 28421 4.12 1.01 4.85 61 T_TooManySym_01 28068 4.24 1.86 4.79 62 BAYES_80 25447 5.33 9.54 4.34 63 XMStrtUSub 25227 3.86 1.95 4.31 64 XMSexyCombo_05 24705 5.08 8.74 4.22 65 MPART_ALT_DIFF 24680 5.73 12.22 4.21 66 RCVD_IN_IADB_SPF 24641 3.57 0.84 4.21 67 XM_PDF 23607 3.47 1.07 4.03 68 TR_XM_DK_SendGrid 23563 3.58 1.69 4.02 69 RCVD_IN_IADB_SENDERID 22095 3.20 0.76 3.77 70 RCVD_IN_IADB_DK 21356 3.10 0.76 3.65 71 XMNumbers 20737 3.54 3.51 3.54 72 XMSubMetaSx_00 20734 3.94 5.65 3.54 73 T_REMOTE_IMAGE 20726 6.18 17.48 3.54 74 HTML_IMAGE_RATIO_06 18947 3.01 2.06 3.24 75 TR_XM_PhishingBody 18636 3.57 5.22 3.18 76 RCVD_IN_IADB_VOUCHED 18025 2.60 0.57 3.08 77 XM_UncommonTLD01 17699 7.16 24.83 3.02 78 TM2_M_URI_OPT_OUT 17665 3.04 3.12 3.02 79 DKIM_INVALID 17595 3.22 4.13 3.00 80 BAYES_05 17515 2.57 0.80 2.99 81 MIME_HTML_ONLY_MULTI 15737 2.46 1.46 2.69 82 MAILING_LIST_MULTI 15567 2.33 0.91 2.66 83 BAYES_95 15231 3.40 6.79 2.60 84 XM_B_Unsub2 15098 2.56 2.47 2.58 85 TR_XM_SB_Phish 14867 2.42 1.91 2.54 86 XMSubPhish11 14725 2.38 1.81 2.51 87 URI_NOVOWEL 14512 2.20 1.02 2.48 88 FROM_EXCESS_BASE64 14258 3.32 7.11 2.43 89 T_TooManySym_02 14107 2.02 0.37 2.41 90 HTML_IMAGE_RATIO_08 13075 2.22 2.16 2.23 91 TR_Symld_Words 12970 2.16 1.93 2.21 92 XMDiploma_00 12361 2.17 2.41 2.11 93 UNTRUSTED_Relay 12215 6.58 25.80 2.09 94 HTML_MIME_NO_HTML_TAG 12132 6.34 24.55 2.07 95 MIME_HTML_MOSTLY 11812 3.74 11.08 2.02 96 RCVD_IN_IADB_OPTIN 11627 1.69 0.44 1.99 97 BOTNET 11539 6.55 26.12 1.97 98 XM_B_Phish66 11397 2.25 3.53 1.95 99 RCVD_IN_MSPIKE_H5 11316 1.62 0.31 1.93 100 LH_URI_DOM_IN_PATH 11309 2.09 2.76 1.93 101 XM_B_SpammyTLD 10943 2.10 3.10 1.87 102 XM_CamelCaseFrm001 10900 2.03 2.75 1.86 103 TooManyTo_002 10629 1.58 0.56 1.81 104 RCVD_IN_BL_SPAMCOP_NET 10603 5.46 21.04 1.81 105 XM_DK_Undo_01 10089 1.57 0.94 1.72 106 XM_SPF_SoftFail 9657 2.20 4.54 1.65 107 T_XMDrugObfuBody_14 9568 1.65 1.74 1.63 108 RELAYCOUNTRY_CA 9517 2.42 5.83 1.62 109 KHOP_HELO_FCRDNS 9477 2.64 6.98 1.62 110 URI_TRY_3LD 8672 1.47 1.40 1.48 111 XMBrknScrpt_02 8630 1.93 3.89 1.47 112 T_XMDrugObfuBody_08 8468 1.76 3.11 1.45 113 TVD_RCVD_IP 8287 1.19 0.24 1.41 114 XM_OfRef6 8208 1.69 2.91 1.40 115 URI_HEX 8137 1.45 1.70 1.39 116 SUBJ_ALL_CAPS 7834 1.34 1.36 1.34 117 HELO_NODOT 7783 1.21 0.72 1.33 118 HELO_NO_DOMAIN 7782 1.21 0.71 1.33 119 XM_B_COVIDMETA 7719 1.88 4.28 1.32 120 XM_H_Long_From02 7664 1.16 0.51 1.31 121 IN_HORDE_ADDRESS_BOOK 7541 1.05 0.05 1.29 122 INVALID_MSGID 7463 1.12 0.45 1.27 123 XM_H_Trusted_IP 7290 1.01 0.00 1.24 124 TooManyTo_003 7066 1.06 0.43 1.21 125 TM2_M_VERY_LONG_WORD 7019 1.28 1.64 1.20 126 XMGappySubj_01 6958 0.99 0.14 1.19 127 XM_UB50 6897 2.34 7.30 1.18 128 HELO_MISC_IP 6873 1.01 0.31 1.17 129 CK_HELO_DYNAMIC_SPLIT_IP 6858 1.01 0.32 1.17 130 RCVD_IN_MSPIKE_BL 6601 2.86 10.26 1.13 131 TO_MALFORMED 6459 0.90 0.03 1.10 132 XMBody_17 6339 1.70 4.32 1.08 133 XM_GoogleGroups 6158 0.90 0.26 1.05 134 XMCapTrack 6137 0.91 0.34 1.05 135 DKIM_ADSP_CUSTOM_MED 5960 1.07 1.27 1.02 136 XMStockSpam_06 5732 1.09 1.56 0.98 137 USER_IN_DEF_DKIM_WL 5536 0.77 0.00 0.95 138 T_TooManySym_03 5469 0.78 0.11 0.93 139 XMNoVowels 5403 0.83 0.44 0.92 140 TR_MSPIKEBAYES00 5267 0.73 0.00 0.90 141 XMGenDplmaNmb 5208 1.05 1.73 0.89 142 TooManyTo_004 5203 0.79 0.36 0.89 143 XMHTML_After_End 5183 0.92 1.08 0.88 144 SpammyFromTLD_01 5167 2.48 9.30 0.88 145 HTML_FONT_FACE_BAD 5153 0.83 0.60 0.88 146 RELAYCOUNTRY_GB 4925 1.60 4.82 0.84 147 XMBdyGiftCard01 4882 0.79 0.59 0.83 148 T_Symld_Words_02 4593 0.77 0.73 0.78 149 T_FILL_THIS_FORM_SHORT 4495 1.13 2.67 0.77 150 NML_ADSP_CUSTOM_MED 4408 0.83 1.18 0.75 151 HTTPS_HTTP_MISMATCH 4340 0.70 0.55 0.74 152 TR_LOTS_OF_MONEY3 4285 1.07 2.50 0.73 153 DKIM_ADSP_NXDOMAIN 4130 1.91 7.05 0.71 154 RCVD_IN_MSPIKE_L3 4091 1.79 6.46 0.70 155 XM_B_SpammyWords4 4023 0.94 2.02 0.69 156 XMHTMLBadTable_001 3996 0.61 0.31 0.68 157 XMBody_95 3970 0.56 0.07 0.68 158 T_PDS_OTHER_BAD_TLD 3944 1.04 2.60 0.67 159 TooManyTo_005 3925 0.60 0.29 0.67 160 XM_DIRTYINTL 3785 1.40 4.60 0.65 161 XMBody_78 3770 0.68 0.83 0.64 162 T_XMHurry_00 3751 0.70 0.98 0.64 163 T_XMDrugObfuBody_00 3721 0.74 1.19 0.64 164 XM_ShortIntro_01 3716 0.60 0.46 0.63 165 TR_MetaPhish_Combo_01 3648 0.70 1.01 0.62 166 XM_SPF_Unknown 3643 0.67 0.87 0.62 167 XM_ProductURIs 3641 0.61 0.53 0.62 168 RELAYCOUNTRY_NL 3543 0.91 2.19 0.60 169 XMSexyCombo_01 3479 0.86 2.02 0.59 170 TR_BOTNET_NEGATE 3410 0.56 0.45 0.58 171 XMMoneyMeta_00 3339 0.62 0.86 0.57 172 TM2_M_BODY_EMPTY 3337 0.62 0.81 0.57 173 HTML_TAG_BALANCE_BODY 3317 0.59 0.71 0.57 174 DIET_1 3291 0.58 0.66 0.56 175 FROM_GOV_DKIM_AU 3211 0.50 0.28 0.55 176 TR_XM_COVIDMETA1 3174 0.76 1.71 0.54 177 T_OBFU_PDF_ATTACH 3134 0.47 0.18 0.54 178 XMSubNoVowel 3109 0.66 1.22 0.53 179 T_TooManySym_04 3042 0.43 0.04 0.52 180 THIS_AD 2991 0.48 0.34 0.51 181 FORGED_GMAIL_RCVD 2834 0.57 0.95 0.48 182 TR_XM_UnparsRelay 2805 0.84 2.38 0.48 183 XMPhish30 2706 0.50 0.64 0.46 184 XMSubMetaI_00 2670 0.44 0.40 0.46 185 TR_XM_COVIDMETA4 2647 0.79 2.22 0.45 186 XM_H_PHPMailer 2592 0.48 0.62 0.44 187 XMLngstWrd_00 2579 0.42 0.33 0.44 188 RDNS_DYNAMIC 2577 0.54 0.97 0.44 189 RELAYCOUNTRY_DE 2527 0.62 1.43 0.43 190 XMLKML 2517 0.35 0.00 0.43 191 TM2_M_A_HREF_HREF 2484 0.50 0.82 0.42 192 XMSlimDrugH 2449 0.46 0.66 0.42 193 NO_DNS_FOR_FROM 2412 0.60 1.43 0.41 194 HTML_IMAGE_ONLY_28 2378 0.36 0.17 0.41 195 XMPhish08 2349 0.44 0.58 0.40 196 XMSolicitRefs_0 2327 0.39 0.35 0.40 197 XM_B_COPY_HTML 2306 0.46 0.72 0.39 198 MPART_ALT_DIFF_COUNT 2301 0.44 0.64 0.39 199 XMLngstWrd_01 2283 0.37 0.27 0.39 200 FROM_GOV_SPOOF 2260 0.33 0.09 0.39 ----------------------------------------------------------------------