Email: 671165 Autolearn: 0 AvgScore: 1.90 AvgScanTime: 1.26 sec Spam: 127853 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 1.33 sec Ham: 543312 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 1.25 sec Time Spent Running SA: 235.74 hours Time Spent Processing Spam: 47.18 hours Time Spent Processing Ham: 188.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 125249 98.50 97.96 98.63 2 HTML_MESSAGE 103707 88.41 81.11 90.13 3 XM_B_SpammyWords 90324 56.19 70.65 52.78 4 XM_B_Unicode 89720 73.10 70.17 73.78 5 RELAYCOUNTRY_US 87010 80.96 68.05 84.00 6 DKIM_SIGNED 86367 77.99 67.55 80.45 7 XM_DK_Pass 83175 76.53 65.06 79.23 8 DKIM_VALID 80662 74.32 63.09 76.96 9 XMListUnsubscribeExists 72032 55.61 56.34 55.44 10 DKIM_VALID_AU 58864 55.34 46.04 57.53 11 XM_DK_Undo_02 55572 17.47 43.47 11.35 12 BAYES_50 51222 52.39 40.06 55.29 13 XM_B_SpammyWords2 50528 27.20 39.52 24.31 14 BAYES_99 45257 12.83 35.40 7.52 15 BOTNET 41206 8.00 32.23 2.30 16 XM_B_Unicode3 39801 39.51 31.13 41.48 17 DKIM_VALID_EF 38719 29.87 30.28 29.77 18 RELAYCOUNTRY_META 37124 10.23 29.04 5.81 19 LOC_TINY_FONT_1 35304 26.67 27.61 26.44 20 BAYES_999 34614 10.08 27.07 6.08 21 MIME_HTML_ONLY 33851 22.05 26.48 21.01 22 HTML_FONT_LOW_CONTRAST 33301 28.23 26.05 28.75 23 UNTRUSTED_Relay 31825 6.89 24.89 2.65 24 T_TM2_M_HEADER_IN_MSG 31409 28.18 24.57 29.03 25 RCVD_IN_MSPIKE_BL 31362 5.37 24.53 0.86 26 LOTS_OF_MONEY 28969 11.18 22.66 8.47 27 FVGT_m_MULTI_ODD 28262 23.45 22.11 23.76 28 RCVD_IN_MSPIKE_H2 28186 27.30 22.05 28.54 29 XM_Multi_Part_URI 27378 14.59 21.41 12.98 30 XMSubLong 27206 21.63 21.28 21.71 31 T_KAM_HTML_FONT_INVALID 25417 20.34 19.88 20.45 32 XM_UncommonTLD01 23699 6.29 18.54 3.41 33 XM_Body_Dirty_Words 22878 14.49 17.89 13.69 34 RCVD_IN_RP_RNBL 22423 3.41 17.54 0.08 35 TR_XM_SpammyWords3 21660 3.62 16.94 0.48 36 TR_XM_SpammyWords2 20329 4.55 15.90 1.88 37 XM_B_Phish_Phrases 20066 8.51 15.69 6.82 38 RCVD_IN_MSPIKE_L5 19925 3.14 15.58 0.21 39 BOTNET_IPINHOSTNAME 17155 6.91 13.42 5.38 40 ANY_BOUNCE_MESSAGE 15571 4.24 12.18 2.38 41 BOUNCE_MESSAGE 15569 4.24 12.18 2.38 42 XM_Lotto 15510 2.51 12.13 0.25 43 XM_B_SpammyWords3 13426 7.29 10.50 6.53 44 XM_B_Unsub 13418 11.39 10.49 11.60 45 TR_XM_COVIDMETA4 12721 2.25 9.95 0.44 46 XM_UB50 12658 3.09 9.90 1.48 47 MPART_ALT_DIFF 12600 4.92 9.86 3.76 48 RCVD_IN_MSPIKE_WL 12547 25.95 9.81 29.75 49 XM_B_COVIDMETA 11415 3.06 8.93 1.67 50 XMSexyCombo_05 11174 4.84 8.74 3.92 51 MIME_HTML_MOSTLY 10814 3.40 8.46 2.21 52 RCVD_IN_MSPIKE_L3 10377 2.00 8.12 0.56 53 LotsOfNums_01 10306 9.43 8.06 9.75 54 SpammyFromTLD_01 9914 2.32 7.75 1.04 55 XM_B_SpammyTLD 9899 3.28 7.74 2.23 56 URIBL_SBL_A 9686 1.68 7.58 0.29 57 XM_Evil_Numbers_Gen 9626 8.62 7.53 8.88 58 RCVD_IN_BL_SPAMCOP_NET 9331 2.88 7.30 1.84 59 BAYES_80 9150 5.12 7.16 4.64 60 T_REMOTE_IMAGE 9031 4.38 7.06 3.75 61 DATE_IN_PAST_03_06 8976 1.42 7.02 0.10 62 BAYES_60 8646 7.21 6.76 7.32 63 XM_OfRef6 8465 2.44 6.62 1.46 64 HTML_IMAGE_RATIO_02 8179 7.15 6.40 7.33 65 SpammyFromTLD_02 8058 1.51 6.30 0.38 66 TR_XM_PhishingBody 7963 3.97 6.23 3.43 67 URI_PHP_REDIR 7877 1.18 6.16 0.01 68 XMBrknScrpt_02 7611 2.40 5.95 1.57 69 RELAYCOUNTRY_FR 7417 1.53 5.80 0.53 70 XM_UB99 7038 1.06 5.50 0.01 71 KHOP_HELO_FCRDNS 6985 2.26 5.46 1.51 72 XMSubMetaSx_00 6886 4.00 5.39 3.67 73 RCVD_IN_MSPIKE_H3 6832 14.57 5.34 16.74 74 RELAYCOUNTRY_CA 6697 2.39 5.24 1.73 75 SHORTENED_URL_HREF 6098 1.20 4.77 0.36 76 XM_SPF_SoftFail 6080 2.48 4.76 1.94 77 BODY_URI_ONLY 6072 0.98 4.75 0.09 78 TooManyTo_001 6048 7.53 4.73 8.19 79 XMNumbers 5972 3.77 4.67 3.56 80 SHORT_SHORTNER 5832 0.88 4.56 0.01 81 HTML_SHORT_LINK_IMG_1 5810 0.88 4.54 0.02 82 XM_H_Long_From01 5780 5.79 4.52 6.09 83 DKIM_INVALID 5705 3.67 4.46 3.48 84 RCVD_IN_PSBL 5690 0.87 4.45 0.03 85 UNPARSEABLE_RELAY 5554 7.79 4.34 8.60 86 SHORTENED_URL_SRC 5507 0.82 4.31 0.00 87 SHORTENER_SHORT_IMG 5459 0.81 4.27 0.00 88 BAYES_95 5452 3.14 4.26 2.87 89 XM_OfRef7 5418 0.96 4.24 0.18 90 RCVD_IN_MSPIKE_H4 5251 9.44 4.11 10.70 91 DATE_IN_PAST_06_12 5219 1.02 4.08 0.29 92 RELAYCOUNTRY_IN 5078 0.85 3.97 0.11 93 XM_B_Phish66 5066 2.32 3.96 1.93 94 XMBody_17 4899 1.47 3.83 0.91 95 TR_XM_MaxSPIKE 4696 0.72 3.67 0.02 96 FILL_THIS_FORM 4684 0.86 3.66 0.20 97 T_FILL_THIS_FORM_LONG 4625 0.80 3.62 0.13 98 XM_UB999 4601 0.69 3.60 0.00 99 TR_LOTS_OF_MONEY3 4512 1.41 3.53 0.91 100 SHORT_URI_3 4498 0.70 3.52 0.04 101 HTML_IMAGE_ONLY_08 4496 0.75 3.52 0.10 102 HTML_IMAGE_RATIO_04 4402 5.06 3.44 5.44 103 XM_SendGrid 4323 7.06 3.38 7.93 104 ADVANCE_FEE_2_NEW_FORM 4294 0.66 3.36 0.02 105 XM_DIRTYINTL 4286 1.10 3.35 0.57 106 TR_XM_MaxBayes 4261 0.68 3.33 0.05 107 BOTNET_NORDNS 4178 0.64 3.27 0.02 108 XMStrtUSub 4080 4.25 3.19 4.50 109 TM2_M_URI_OPT_OUT 3959 2.72 3.10 2.63 110 T_FONT_INVIS_NAKED_TO 3813 2.45 2.98 2.33 111 HTML_IMAGE_RATIO_08 3784 2.83 2.96 2.80 112 TR_XM_SB_Phish 3781 2.33 2.96 2.18 113 HTML_IMAGE_RATIO_06 3779 3.14 2.96 3.18 114 XM_URI_RBL 3777 0.74 2.95 0.22 115 XM_UB60 3740 0.69 2.93 0.16 116 URI_HEX 3680 2.02 2.88 1.82 117 XMSubPhish11 3676 2.28 2.88 2.14 118 SUBJ_ALL_CAPS 3569 1.92 2.79 1.72 119 T_TooManySym_01 3362 3.93 2.63 4.24 120 LOCALPART_IN_SUBJECT 3307 0.51 2.59 0.02 121 T_FILL_THIS_FORM_SHORT 3285 1.28 2.57 0.98 122 XM_UB80 3236 0.53 2.53 0.06 123 ADVANCE_FEE_3_NEW_MONEY 3129 0.47 2.45 0.01 124 T_XMDrugObfuBody_08 3100 1.66 2.42 1.48 125 TR_XM_UnparsRelay 3083 0.89 2.41 0.53 126 TM2_M_VERY_LONG_WORD 2979 1.57 2.33 1.39 127 RELAYCOUNTRY_DE 2927 0.93 2.29 0.61 128 BAYES_40 2917 4.22 2.28 4.67 129 TR_XM_PHPDW 2900 0.75 2.27 0.39 130 TR_XM_PHPForged 2884 0.72 2.26 0.36 131 TR_XM_FormFill2 2845 0.72 2.23 0.36 132 XM_H_PHPOS 2837 0.71 2.22 0.36 133 XMSubNoVowel 2780 1.02 2.17 0.74 134 URI_TRY_3LD 2778 1.61 2.17 1.48 135 FORM_FRAUD 2748 0.43 2.15 0.03 136 XMReplyNow 2734 0.47 2.14 0.08 137 XM_CamelCaseFrm001 2720 2.05 2.13 2.03 138 XM_B_SpammyWords4 2689 1.17 2.10 0.95 139 XMDiploma_00 2682 1.97 2.10 1.94 140 LH_URI_DOM_IN_PATH 2672 1.89 2.09 1.85 141 T_PDS_OTHER_BAD_TLD 2636 0.73 2.06 0.41 142 T_XMDrugObfuBody_00 2519 1.04 1.97 0.82 143 XM_BadFromFormat 2506 0.55 1.96 0.22 144 TR_Symld_Words 2477 1.92 1.94 1.92 145 T_XMDrugObfuBody_01 2465 0.43 1.93 0.08 146 TR_XM_RelayPhish 2453 0.50 1.92 0.17 147 MIME_QP_LONG_LINE 2413 5.10 1.89 5.86 148 XMMoneyMeta_00 2407 1.09 1.88 0.91 149 XM_B_Unsub2 2393 2.99 1.87 3.26 150 HTML_MIME_NO_HTML_TAG 2349 2.20 1.84 2.29 151 TR_MetaPhish_Combo_01 2338 0.94 1.83 0.73 152 FROM_SUSPICIOUS_NTLD 2305 0.39 1.80 0.06 153 BAYES_20 2282 3.29 1.78 3.64 154 RELAYCOUNTRY_JP 2226 0.36 1.74 0.04 155 MIME_CHARSET_FARAWAY 2184 0.44 1.71 0.14 156 FROM_SUSPICIOUS_NTLD_FP 2158 0.37 1.69 0.06 157 TR_XM_COVIDMETA1 2156 0.57 1.69 0.31 158 XM_UB95 2100 0.33 1.64 0.03 159 CHARSET_FARAWAY_HEADER 2069 0.35 1.62 0.05 160 TR_XM_DK_SendGrid 2045 4.21 1.60 4.83 161 ALL_TRUSTED 2011 9.53 1.57 11.40 162 TR_XM_INV_DKIM 1976 0.43 1.55 0.17 163 XMHTML_After_End 1967 1.04 1.54 0.93 164 RCVD_IN_IADB_LISTED 1887 4.93 1.48 5.74 165 LongTLD 1840 0.43 1.44 0.19 166 NUMERIC_HTTP_ADDR 1840 0.67 1.44 0.49 167 HTML_IMAGE_ONLY_16 1831 0.54 1.43 0.33 168 XMSexyCombo_01 1819 0.77 1.42 0.62 169 T_XMHurry_00 1783 0.93 1.39 0.83 170 RDNS_DYNAMIC 1771 0.66 1.39 0.48 171 MIME_HTML_ONLY_MULTI 1765 1.96 1.38 2.10 172 TR_Caps_n_Bayes_99 1747 0.39 1.37 0.16 173 XM_SPF_Unknown 1705 0.78 1.33 0.65 174 XMStockSpam_06 1688 1.15 1.32 1.12 175 XMGenDplmaNmb 1659 1.07 1.30 1.02 176 SHORT_URI_2 1650 0.26 1.29 0.02 177 FROM_EXCESS_BASE64 1622 2.72 1.27 3.06 178 T_XMDrugObfuBody_14 1611 1.79 1.26 1.91 179 XM_PDF 1598 3.84 1.25 4.45 180 MIMEOLE_DIRECT_TO_MX 1581 0.24 1.24 0.00 181 DIET_1 1565 0.50 1.22 0.33 182 DKIM_ADSP_CUSTOM_MED 1525 1.22 1.19 1.23 183 RCVD_IN_IADB_SPF 1510 4.26 1.18 4.98 184 URI_NOVOWEL 1505 2.28 1.18 2.54 185 MONEY_FORM_SHORT 1474 0.23 1.15 0.01 186 URI_NO_WWW_BIZ_CGI 1472 0.23 1.15 0.01 187 BAYES_00 1467 9.71 1.15 11.72 188 MAILING_LIST_MULTI 1463 2.18 1.14 2.43 189 BODY_EMPTY 1440 0.21 1.13 0.00 190 NML_ADSP_CUSTOM_MED 1436 0.94 1.12 0.90 191 TR_Mismatch_TLD_02 1429 0.27 1.12 0.07 192 HTML_IMAGE_ONLY_04 1404 0.24 1.10 0.04 193 RCVD_IN_IADB_SENDERID 1402 3.80 1.10 4.44 194 RCVD_IN_IADB_DK 1394 3.69 1.09 4.30 195 RELAYCOUNTRY_UA 1384 0.21 1.08 0.01 196 HELO_NO_DOMAIN 1381 1.39 1.08 1.46 197 HELO_NODOT 1381 1.39 1.08 1.46 198 DOS_OE_TO_MX 1374 0.21 1.07 0.00 199 TO_NAME_SUBJ_NO_RDNS 1365 0.20 1.07 0.00 200 TR_XM_FormFill 1363 0.22 1.07 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 535860 98.50 97.96 98.63 2 HTML_MESSAGE 489671 88.41 81.11 90.13 3 RELAYCOUNTRY_US 456356 80.96 68.05 84.00 4 DKIM_SIGNED 437071 77.99 67.55 80.45 5 XM_DK_Pass 430477 76.53 65.06 79.23 6 DKIM_VALID 418157 74.32 63.09 76.96 7 XM_B_Unicode 400881 73.10 70.17 73.78 8 DKIM_VALID_AU 312551 55.34 46.04 57.53 9 XMListUnsubscribeExists 301222 55.61 56.34 55.44 10 BAYES_50 300395 52.39 40.06 55.29 11 XM_B_SpammyWords 286773 56.19 70.65 52.78 12 XM_B_Unicode3 225361 39.51 31.13 41.48 13 DKIM_VALID_EF 161762 29.87 30.28 29.77 14 RCVD_IN_MSPIKE_WL 161620 25.95 9.81 29.75 15 T_TM2_M_HEADER_IN_MSG 157697 28.18 24.57 29.03 16 HTML_FONT_LOW_CONTRAST 156196 28.23 26.05 28.75 17 RCVD_IN_MSPIKE_H2 155067 27.30 22.05 28.54 18 LOC_TINY_FONT_1 143673 26.67 27.61 26.44 19 XM_B_SpammyWords2 132058 27.20 39.52 24.31 20 FVGT_m_MULTI_ODD 129111 23.45 22.11 23.76 21 XMSubLong 117965 21.63 21.28 21.71 22 MIME_HTML_ONLY 114137 22.05 26.48 21.01 23 T_KAM_HTML_FONT_INVALID 111124 20.34 19.88 20.45 24 RCVD_IN_MSPIKE_H3 90939 14.57 5.34 16.74 25 XM_Body_Dirty_Words 74403 14.49 17.89 13.69 26 XM_Multi_Part_URI 70518 14.59 21.41 12.98 27 BAYES_00 63690 9.71 1.15 11.72 28 XM_B_Unsub 63046 11.39 10.49 11.60 29 ALL_TRUSTED 61963 9.53 1.57 11.40 30 XM_DK_Undo_02 61689 17.47 43.47 11.35 31 RCVD_IN_MSPIKE_H4 58116 9.44 4.11 10.70 32 LotsOfNums_01 52968 9.43 8.06 9.75 33 TR_XM_DK_Bayes 48325 7.26 0.32 8.89 34 XM_Evil_Numbers_Gen 48239 8.62 7.53 8.88 35 TR_XM_DK_Bayes1 46770 7.03 0.30 8.61 36 UNPARSEABLE_RELAY 46713 7.79 4.34 8.60 37 LOTS_OF_MONEY 46036 11.18 22.66 8.47 38 TooManyTo_001 44483 7.53 4.73 8.19 39 XM_SendGrid 43083 7.06 3.38 7.93 40 RCVD_IN_RP_SAFE 42414 6.46 0.76 7.81 41 TR_XM_DK_Bayes2 41260 6.19 0.22 7.59 42 BAYES_99 40836 12.83 35.40 7.52 43 HTML_IMAGE_RATIO_02 39833 7.15 6.40 7.33 44 BAYES_60 39753 7.21 6.76 7.32 45 RCVD_IN_RP_CERTIFIED 38680 5.83 0.34 7.12 46 XM_B_Phish_Phrases 37034 8.51 15.69 6.82 47 IN_ZIMBRA_NJ_WHITELIST 36744 5.49 0.07 6.76 48 XM_DKIMWhitelistDomains 36441 5.43 0.01 6.71 49 XM_B_SpammyWords3 35484 7.29 10.50 6.53 50 XM_H_Long_From01 33064 5.79 4.52 6.09 51 BAYES_999 33009 10.08 27.07 6.08 52 MIME_QP_LONG_LINE 31845 5.10 1.89 5.86 53 RELAYCOUNTRY_META 31564 10.23 29.04 5.81 54 RCVD_IN_IADB_LISTED 31180 4.93 1.48 5.74 55 HTML_IMAGE_RATIO_04 29573 5.06 3.44 5.44 56 BOTNET_IPINHOSTNAME 29252 6.91 13.42 5.38 57 RCVD_IN_IADB_SPF 27069 4.26 1.18 4.98 58 TR_XM_DK_SendGrid 26232 4.21 1.60 4.83 59 BAYES_40 25379 4.22 2.28 4.67 60 BAYES_80 25220 5.12 7.16 4.64 61 XMStrtUSub 24439 4.25 3.19 4.50 62 XM_PDF 24202 3.84 1.25 4.45 63 RCVD_IN_IADB_SENDERID 24096 3.80 1.10 4.44 64 RCVD_IN_IADB_DK 23345 3.69 1.09 4.30 65 T_TooManySym_01 23032 3.93 2.63 4.24 66 XMSexyCombo_05 21320 4.84 8.74 3.92 67 MPART_ALT_DIFF 20424 4.92 9.86 3.76 68 T_REMOTE_IMAGE 20352 4.38 7.06 3.75 69 XMSubMetaSx_00 19945 4.00 5.39 3.67 70 BAYES_20 19780 3.29 1.78 3.64 71 RCVD_IN_IADB_VOUCHED 19598 3.07 0.76 3.61 72 XMNumbers 19320 3.77 4.67 3.56 73 DKIM_INVALID 18914 3.67 4.46 3.48 74 TR_XM_PhishingBody 18662 3.97 6.23 3.43 75 XM_UncommonTLD01 18540 6.29 18.54 3.41 76 XM_B_Unsub2 17702 2.99 1.87 3.26 77 HTML_IMAGE_RATIO_06 17297 3.14 2.96 3.18 78 FROM_EXCESS_BASE64 16608 2.72 1.27 3.06 79 BAYES_95 15598 3.14 4.26 2.87 80 HTML_IMAGE_RATIO_08 15215 2.83 2.96 2.80 81 UNTRUSTED_Relay 14400 6.89 24.89 2.65 82 TM2_M_URI_OPT_OUT 14289 2.72 3.10 2.63 83 URI_NOVOWEL 13823 2.28 1.18 2.54 84 MAILING_LIST_MULTI 13188 2.18 1.14 2.43 85 ANY_BOUNCE_MESSAGE 12906 4.24 12.18 2.38 86 BOUNCE_MESSAGE 12904 4.24 12.18 2.38 87 RCVD_IN_IADB_OPTIN 12803 2.01 0.52 2.36 88 T_FONT_INVIS_NAKED_TO 12659 2.45 2.98 2.33 89 BAYES_05 12603 2.07 1.01 2.32 90 RCVD_IN_MSPIKE_H5 12565 1.94 0.36 2.31 91 BOTNET 12502 8.00 32.23 2.30 92 HTML_MIME_NO_HTML_TAG 12449 2.20 1.84 2.29 93 T_TooManySym_02 12352 1.94 0.53 2.27 94 XM_B_SpammyTLD 12114 3.28 7.74 2.23 95 MIME_HTML_MOSTLY 12022 3.40 8.46 2.21 96 TR_XM_SB_Phish 11864 2.33 2.96 2.18 97 XMSubPhish11 11642 2.28 2.88 2.14 98 MIME_HTML_ONLY_MULTI 11394 1.96 1.38 2.10 99 XM_CamelCaseFrm001 11013 2.05 2.13 2.03 100 XM_DK_Undo_01 10762 1.78 0.92 1.98 101 XMDiploma_00 10565 1.97 2.10 1.94 102 XM_SPF_SoftFail 10538 2.48 4.76 1.94 103 XM_B_Phish66 10500 2.32 3.96 1.93 104 TR_Symld_Words 10426 1.92 1.94 1.92 105 T_XMDrugObfuBody_14 10389 1.79 1.26 1.91 106 TooManyTo_002 10267 1.66 0.68 1.89 107 TR_XM_SpammyWords2 10188 4.55 15.90 1.88 108 LH_URI_DOM_IN_PATH 10036 1.89 2.09 1.85 109 RCVD_IN_BL_SPAMCOP_NET 9984 2.88 7.30 1.84 110 URI_HEX 9864 2.02 2.88 1.82 111 RELAYCOUNTRY_CA 9373 2.39 5.24 1.73 112 SUBJ_ALL_CAPS 9324 1.92 2.79 1.72 113 XM_B_COVIDMETA 9093 3.06 8.93 1.67 114 XMBrknScrpt_02 8530 2.40 5.95 1.57 115 KHOP_HELO_FCRDNS 8206 2.26 5.46 1.51 116 TVD_RCVD_IP 8069 1.29 0.44 1.49 117 T_XMDrugObfuBody_08 8064 1.66 2.42 1.48 118 XM_UB50 8051 3.09 9.90 1.48 119 URI_TRY_3LD 8032 1.61 2.17 1.48 120 XM_OfRef6 7926 2.44 6.62 1.46 121 HELO_NODOT 7920 1.39 1.08 1.46 122 HELO_NO_DOMAIN 7919 1.39 1.08 1.46 123 TM2_M_VERY_LONG_WORD 7571 1.57 2.33 1.39 124 INVALID_MSGID 7425 1.18 0.38 1.37 125 IN_HORDE_ADDRESS_BOOK 7372 1.13 0.15 1.36 126 TooManyTo_003 6961 1.13 0.51 1.28 127 DKIM_ADSP_CUSTOM_MED 6660 1.22 1.19 1.23 128 HELO_MISC_IP 6593 1.07 0.45 1.21 129 CK_HELO_DYNAMIC_SPLIT_IP 6586 1.10 0.61 1.21 130 USER_IN_DEF_DKIM_WL 6503 0.97 0.01 1.20 131 XMBdyGiftCard01 6452 1.09 0.67 1.19 132 XMGappySubj_01 6427 0.98 0.14 1.18 133 XM_ProductURIs 6402 1.07 0.62 1.18 134 XM_GoogleGroups 6371 1.02 0.36 1.17 135 XMCapTrack 6359 1.04 0.47 1.17 136 TO_MALFORMED 6357 0.95 0.01 1.17 137 XMStockSpam_06 6058 1.15 1.32 1.12 138 SENDGRID_REDIR 5812 0.99 0.63 1.07 139 SpammyFromTLD_01 5666 2.32 7.75 1.04 140 XM_H_Long_From02 5595 0.98 0.74 1.03 141 XMGenDplmaNmb 5546 1.07 1.30 1.02 142 T_FILL_THIS_FORM_SHORT 5310 1.28 2.57 0.98 143 XM_B_SpammyWords4 5156 1.17 2.10 0.95 144 XMHTML_After_End 5045 1.04 1.54 0.93 145 RELAYCOUNTRY_GB 4989 0.92 0.90 0.92 146 TooManyTo_004 4983 0.83 0.45 0.92 147 XMBody_17 4967 1.47 3.83 0.91 148 TR_LOTS_OF_MONEY3 4945 1.41 3.53 0.91 149 XMMoneyMeta_00 4933 1.09 1.88 0.91 150 NML_ADSP_CUSTOM_MED 4876 0.94 1.12 0.90 151 T_TooManySym_03 4718 0.73 0.15 0.87 152 RCVD_IN_MSPIKE_BL 4651 5.37 24.53 0.86 153 TR_MSPIKEBAYES00 4550 0.68 0.00 0.84 154 DKIM_ADSP_NXDOMAIN 4525 0.86 0.97 0.83 155 HTTPS_HTTP_MISMATCH 4506 0.87 1.03 0.83 156 T_XMHurry_00 4486 0.93 1.39 0.83 157 T_XMDrugObfuBody_00 4440 1.04 1.97 0.82 158 XM_ShortIntro_01 4248 0.78 0.79 0.78 159 T_OBFU_PDF_ATTACH 4203 0.66 0.19 0.77 160 TooManyTo_005 4113 0.69 0.38 0.76 161 XMSubNoVowel 4035 1.02 2.17 0.74 162 TR_MetaPhish_Combo_01 3980 0.94 1.83 0.73 163 XMBody_95 3805 0.58 0.06 0.70 164 PLING_QUERY 3761 0.61 0.27 0.69 165 T_Symld_Words_02 3713 0.69 0.70 0.68 166 FORGED_GMAIL_RCVD 3611 0.73 1.01 0.66 167 T_MONEY_PERCENT 3532 0.65 0.65 0.65 168 TR_LOTS_OF_MONEY2 3532 0.65 0.65 0.65 169 XM_SPF_Unknown 3506 0.78 1.33 0.65 170 TR_BOTNET_NEGATE 3381 0.58 0.39 0.62 171 XMSexyCombo_01 3371 0.77 1.42 0.62 172 RELAYCOUNTRY_DE 3306 0.93 2.29 0.61 173 XMSubMetaI_00 3242 0.57 0.47 0.60 174 XM_H_Trusted_IP 3228 0.48 0.00 0.59 175 XMHTMLBadTable_001 3226 0.56 0.42 0.59 176 HTML_FONT_FACE_BAD 3204 0.58 0.56 0.59 177 XMPhish14 3181 0.65 0.94 0.59 178 XM_DIRTYINTL 3087 1.10 3.35 0.57 179 FROM_GOV_DKIM_AU 3074 0.49 0.19 0.57 180 XMBody_78 3073 0.61 0.82 0.57 181 RCVD_IN_MSPIKE_L3 3047 2.00 8.12 0.56 182 XMSubMetaSxObfu_02 3036 0.52 0.36 0.56 183 TM2_M_A_HREF_HREF 3018 0.57 0.65 0.56 184 MPART_ALT_DIFF_COUNT 2943 0.59 0.82 0.54 185 XMSubMetaSxObfu_03 2895 0.60 0.90 0.53 186 TR_XM_UnparsRelay 2888 0.89 2.41 0.53 187 RELAYCOUNTRY_FR 2869 1.53 5.80 0.53 188 XM_Combo_Sbj 2827 0.59 0.90 0.52 189 XM_H_PHPMailer 2806 0.55 0.69 0.52 190 HTML_IMAGE_ONLY_20 2776 0.51 0.53 0.51 191 HTML_TAG_BALANCE_BODY 2742 0.52 0.60 0.50 192 XM_B_REG_HTML 2670 0.42 0.12 0.49 193 XMPhish30 2656 0.52 0.65 0.49 194 NUMERIC_HTTP_ADDR 2646 0.67 1.44 0.49 195 RDNS_DYNAMIC 2633 0.66 1.39 0.48 196 TR_XM_SpammyWords3 2626 3.62 16.94 0.48 197 NO_DNS_FOR_FROM 2615 0.54 0.81 0.48 198 T_TooManySym_04 2596 0.39 0.04 0.48 199 XMNoVowels 2582 0.50 0.60 0.48 200 XMLngstWrd_00 2418 0.53 0.87 0.45 ----------------------------------------------------------------------