Email: 714836 Autolearn: 0 AvgScore: 3.47 AvgScanTime: 1.31 sec Spam: 192038 Autolearn: 0 AvgScore: 13.53 AvgScanTime: 1.49 sec Ham: 522798 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 1.25 sec Time Spent Running SA: 260.39 hours Time Spent Processing Spam: 79.53 hours Time Spent Processing Ham: 180.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 166977 87.33 86.95 87.47 2 RELAYCOUNTRY_US 147912 79.30 77.02 80.14 3 XM_B_Unicode 144502 70.10 75.25 68.20 4 DKIM_SIGNED 142537 75.75 74.22 76.31 5 XM_DK_Pass 137493 74.13 71.60 75.07 6 DKIM_VALID 133557 71.96 69.55 72.85 7 XM_B_SpammyWords 132202 54.87 68.84 49.73 8 DCC_CHECK 131438 45.48 68.44 37.04 9 XMListUnsubscribeExists 121657 54.68 63.35 51.49 10 DKIM_VALID_AU 100951 53.70 52.57 54.12 11 BAYES_50 78923 51.60 41.10 55.45 12 XM_DK_Undo_02 74941 16.80 39.02 8.63 13 XM_B_Unicode3 69939 38.31 36.42 39.00 14 XM_B_SpammyWords2 69621 26.58 36.25 23.02 15 HTML_FONT_LOW_CONTRAST 60008 27.94 31.25 26.72 16 BAYES_99 59364 12.34 30.91 5.51 17 LOC_TINY_FONT_1 58423 25.09 30.42 23.13 18 DCC_CHECK_NEGATIVE 57523 52.55 29.95 60.85 19 MIME_HTML_ONLY 54910 22.05 28.59 19.64 20 FVGT_m_MULTI_ODD 51474 24.34 26.80 23.44 21 RCVD_IN_MSPIKE_H2 50200 26.87 26.14 27.14 22 BOTNET 49909 8.37 25.99 1.90 23 DKIM_VALID_EF 48815 27.89 25.42 28.80 24 BAYES_999 46218 9.74 24.07 4.48 25 TR_DCC_Bayes_99 44466 7.92 23.15 2.33 26 T_TM2_M_HEADER_IN_MSG 44274 27.67 23.05 29.36 27 XMSubLong 42529 21.80 22.15 21.68 28 RELAYCOUNTRY_META 41001 9.55 21.35 5.21 29 XM_Multi_Part_URI 40619 14.37 21.15 11.88 30 T_KAM_HTML_FONT_INVALID 39805 19.36 20.73 18.86 31 XM_Body_Dirty_Words 37925 14.47 19.75 12.53 32 LOTS_OF_MONEY 34554 11.04 17.99 8.49 33 RCVD_IN_MSPIKE_BL 33325 5.11 17.35 0.61 34 UNTRUSTED_Relay 29929 5.75 15.58 2.14 35 RCVD_IN_MSPIKE_WL 29154 24.79 15.18 28.31 36 XM_B_Phish_Phrases 26347 8.57 13.72 6.67 37 RCVD_IN_RP_RNBL 24236 3.46 12.62 0.10 38 XM_B_Unsub 24231 11.14 12.62 10.60 39 BOTNET_IPINHOSTNAME 23700 6.71 12.34 4.64 40 RCVD_IN_MSPIKE_L5 23187 3.36 12.07 0.16 41 FSL_BULK_SIG 22254 6.98 11.59 5.29 42 XM_B_SpammyWords3 22078 6.91 11.50 5.22 43 TR_XM_SpammyWords2 22069 4.16 11.49 1.47 44 TR_XM_SpammyWords3 20805 3.13 10.83 0.31 45 XM_UncommonTLD01 20511 5.19 10.68 3.18 46 ANY_BOUNCE_MESSAGE 19439 5.81 10.12 4.22 47 BOUNCE_MESSAGE 19436 5.80 10.12 4.22 48 HTML_IMAGE_RATIO_02 18814 7.31 9.80 6.40 49 XMSexyCombo_05 17928 4.88 9.34 3.24 50 RCVD_IN_PSBL 17848 2.51 9.29 0.01 51 XM_Lotto 17732 2.59 9.23 0.14 52 LotsOfNums_01 16893 8.99 8.80 9.06 53 XM_Evil_Numbers_Gen 16766 7.92 8.73 7.63 54 MPART_ALT_DIFF 16167 4.75 8.42 3.40 55 BAYES_80 15951 5.15 8.31 3.99 56 RCVD_IN_MSPIKE_H3 15943 13.83 8.30 15.86 57 TR_XM_COVIDMETA4 15879 2.53 8.27 0.42 58 BAYES_60 14667 7.27 7.64 7.14 59 RCVD_IN_BL_SPAMCOP_NET 13901 2.95 7.24 1.38 60 MIME_HTML_MOSTLY 12224 3.27 6.37 2.14 61 RCVD_IN_MSPIKE_H4 12026 9.20 6.26 10.27 62 XM_B_SpammyTLD 11952 3.18 6.22 2.06 63 XM_B_COVIDMETA 11834 2.81 6.16 1.58 64 XM_UB50 11672 2.44 6.08 1.10 65 XMSubMetaSx_00 11391 4.32 5.93 3.72 66 T_REMOTE_IMAGE 11131 4.21 5.80 3.63 67 UNPARSEABLE_RELAY 11107 7.32 5.78 7.88 68 RELAYCOUNTRY_CA 11000 2.66 5.73 1.53 69 XM_OfRef6 10543 2.46 5.49 1.35 70 TooManyTo_001 10305 7.96 5.37 8.91 71 TR_XM_PhishingBody 9541 3.49 4.97 2.95 72 XM_H_Long_From01 9316 5.42 4.85 5.63 73 RCVD_IN_MSPIKE_L3 9143 1.56 4.76 0.39 74 BAYES_95 9075 3.04 4.73 2.42 75 DKIM_INVALID 8980 3.79 4.68 3.46 76 XM_SendGrid 8912 6.54 4.64 7.23 77 HTML_IMAGE_RATIO_04 8876 5.29 4.62 5.54 78 XMNumbers 8768 4.15 4.57 3.99 79 XM_SPF_SoftFail 8759 2.51 4.56 1.76 80 XMStrtUSub 8333 4.18 4.34 4.12 81 SpammyFromTLD_01 7666 1.77 3.99 0.96 82 XMBrknScrpt_02 7644 1.71 3.98 0.88 83 BOTNET_NORDNS 7553 1.07 3.93 0.02 84 T_FONT_INVIS_NAKED_TO 7553 2.55 3.93 2.04 85 T_XMDrugObfuBody_08 7068 2.23 3.68 1.70 86 HTML_IMAGE_RATIO_06 7048 3.28 3.67 3.14 87 KHOP_HELO_FCRDNS 6939 2.08 3.61 1.52 88 TM2_M_URI_OPT_OUT 6772 3.01 3.53 2.82 89 BODY_URI_ONLY 6715 0.97 3.50 0.04 90 URIBL_SBL_A 6639 1.05 3.46 0.17 91 HTML_MIME_NO_HTML_TAG 6426 2.73 3.35 2.50 92 HTML_IMAGE_ONLY_08 6248 0.94 3.25 0.10 93 SHORTENED_URL_HREF 6220 1.13 3.24 0.36 94 HTML_SHORT_LINK_IMG_1 6204 0.88 3.23 0.02 95 XM_B_Unsub2 6175 3.05 3.22 3.00 96 URI_HEX 6169 1.97 3.21 1.52 97 SHORT_URI_3 6127 0.88 3.19 0.03 98 SHORTENED_URL_SRC 6022 0.84 3.14 0.00 99 XM_OfRef7 6019 0.98 3.13 0.18 100 SHORTENER_SHORT_IMG 6012 0.84 3.13 0.00 101 URI_TRY_3LD 5997 1.69 3.12 1.16 102 DATE_IN_PAST_06_12 5948 0.89 3.10 0.09 103 RELAYCOUNTRY_FR 5845 1.02 3.04 0.27 104 SpammyFromTLD_02 5741 1.06 2.99 0.35 105 XMDiploma_00 5714 2.04 2.98 1.69 106 MIME_QP_LONG_LINE 5593 5.05 2.91 5.84 107 XM_DIRTYINTL 5518 1.15 2.87 0.52 108 HTML_IMAGE_RATIO_08 5397 2.34 2.81 2.16 109 TR_XM_DK_SendGrid 5387 3.89 2.81 4.28 110 MIME_HTML_ONLY_MULTI 5143 2.14 2.68 1.94 111 BAYES_40 5090 4.49 2.65 5.17 112 XM_B_Phish66 5067 2.01 2.64 1.78 113 DATE_IN_PAST_03_06 4866 0.76 2.53 0.11 114 FROM_EXCESS_BASE64 4828 2.67 2.51 2.72 115 FILL_THIS_FORM 4759 0.82 2.48 0.21 116 T_FILL_THIS_FORM_LONG 4700 0.75 2.45 0.13 117 DATE_IN_PAST_96_XX 4663 0.66 2.43 0.00 118 RELAYCOUNTRY_IN 4627 0.72 2.41 0.10 119 XMBody_17 4590 1.08 2.39 0.59 120 XM_UB60 4575 0.70 2.38 0.08 121 XM_UB99 4488 0.63 2.34 0.00 122 TR_LOTS_OF_MONEY3 4479 1.11 2.33 0.67 123 XM_URI_RBL 4432 0.76 2.31 0.20 124 XM_CamelCaseFrm001 4394 2.07 2.29 1.99 125 SHORT_SHORTNER 4384 0.62 2.28 0.01 126 DATE_IN_PAST_24_48 4380 0.62 2.28 0.00 127 XM_B_SpammyWords4 4330 1.00 2.25 0.54 128 ADVANCE_FEE_2_NEW_FORM 4325 0.63 2.25 0.03 129 TR_XM_UnparsRelay 4218 0.96 2.20 0.50 130 T_TooManySym_01 4214 3.93 2.19 4.57 131 BAYES_20 3974 3.91 2.07 4.58 132 TR_XM_MaxBayes 3956 0.57 2.06 0.02 133 TR_XM_MaxSPIKE 3950 0.56 2.06 0.01 134 URI_PHP_REDIR 3893 0.55 2.03 0.01 135 LH_URI_DOM_IN_PATH 3664 1.95 1.91 1.96 136 TM2_M_VERY_LONG_WORD 3573 1.33 1.86 1.14 137 FORM_FRAUD 3467 0.51 1.81 0.03 138 XM_UB80 3462 0.50 1.80 0.03 139 T_FILL_THIS_FORM_SHORT 3443 1.17 1.79 0.93 140 XM_UB999 3438 0.48 1.79 0.00 141 HTML_IMAGE_ONLY_32 3429 0.80 1.79 0.44 142 TR_XM_SB_Phish 3293 2.27 1.71 2.48 143 XMSexyCombo_01 3221 0.91 1.68 0.63 144 RCVD_IN_RP_SAFE 3193 6.14 1.66 7.78 145 XMSubPhish11 3178 2.24 1.65 2.45 146 XM_BadFromFormat 3081 0.55 1.60 0.16 147 T_XMDrugObfuBody_14 3079 1.41 1.60 1.34 148 RCVD_IN_IADB_LISTED 3070 4.43 1.60 5.47 149 NUMERIC_HTTP_ADDR 2990 0.74 1.56 0.44 150 XM_SPF_Unknown 2924 0.91 1.52 0.68 151 XMSubNoVowel 2800 0.88 1.46 0.67 152 TR_XM_PHPDW 2780 0.62 1.45 0.31 153 T_Symld_Words_02 2778 0.96 1.45 0.79 154 T_XMHurry_00 2744 0.82 1.43 0.59 155 XMHTML_After_End 2709 1.01 1.41 0.87 156 MIME_CHARSET_FARAWAY 2703 0.47 1.41 0.12 157 TR_XM_PHPForged 2695 0.59 1.40 0.30 158 TR_XM_FormFill2 2661 0.59 1.39 0.30 159 RELAYCOUNTRY_GB 2657 1.10 1.38 1.00 160 XM_H_PHPOS 2652 0.58 1.38 0.29 161 NO_DNS_FOR_FROM 2650 0.72 1.38 0.48 162 TR_XM_RelayPhish 2636 0.50 1.37 0.18 163 TR_Symld_Words 2623 2.19 1.37 2.49 164 XMBdyGiftCard01 2569 0.81 1.34 0.61 165 T_PDS_OTHER_BAD_TLD 2567 0.68 1.34 0.43 166 TR_Mismatch_TLD_01 2541 0.56 1.32 0.29 167 RCVD_IN_IADB_SPF 2522 3.84 1.31 4.77 168 RCVD_IN_RP_CERTIFIED 2479 5.66 1.29 7.26 169 T_XMDrugObfuBody_00 2442 0.85 1.27 0.70 170 CHARSET_FARAWAY_HEADER 2419 0.37 1.26 0.05 171 TR_XM_COVIDMETA1 2411 0.58 1.26 0.33 172 BAYES_00 2411 10.02 1.26 13.24 173 NORMAL_HTTP_TO_IP 2406 0.38 1.25 0.05 174 DATE_IN_PAST_12_24 2404 0.37 1.25 0.05 175 ADVANCE_FEE_3_NEW_MONEY 2401 0.34 1.25 0.00 176 TR_XM_INV_DKIM 2378 0.47 1.24 0.18 177 URI_NOVOWEL 2365 2.26 1.23 2.63 178 XMStockSpam_06 2355 2.04 1.23 2.34 179 RCVD_IN_IADB_SENDERID 2350 3.44 1.22 4.25 180 RCVD_IN_IADB_DK 2345 3.34 1.22 4.12 181 FROM_SUSPICIOUS_NTLD 2248 0.36 1.17 0.06 182 XM_DK_Undo_01 2212 1.67 1.15 1.86 183 MAILING_LIST_MULTI 2189 2.13 1.14 2.49 184 FROM_SUSPICIOUS_NTLD_FP 2177 0.33 1.13 0.04 185 XM_S_SpammyWords 2175 0.48 1.13 0.24 186 TR_XM_Spammywords 2175 0.48 1.13 0.24 187 BAYES_05 2167 2.12 1.13 2.49 188 SUBJ_ALL_CAPS 2163 1.36 1.13 1.44 189 XMBody_78 2114 0.61 1.10 0.43 190 HK_RANDOM_REPLYTO 2073 0.42 1.08 0.18 191 DKIM_ADSP_NXDOMAIN 2067 0.70 1.08 0.56 192 XMGenDplmaNmb 2062 0.97 1.07 0.93 193 MIMEOLE_DIRECT_TO_MX 2062 0.29 1.07 0.00 194 MISSING_HEADERS 2025 0.60 1.05 0.44 195 RDNS_DYNAMIC 1963 0.62 1.02 0.47 196 DOS_OE_TO_MX 1940 0.27 1.01 0.00 197 MPART_ALT_DIFF_COUNT 1916 0.62 1.00 0.48 198 XMMoneyMeta_00 1909 0.69 0.99 0.58 199 TR_Mismatch_TLD_02 1908 0.33 0.99 0.08 200 ALL_TRUSTED 1898 11.82 0.99 15.79 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 457273 87.33 86.95 87.47 2 RELAYCOUNTRY_US 418962 79.30 77.02 80.14 3 DKIM_SIGNED 398960 75.75 74.22 76.31 4 XM_DK_Pass 392439 74.13 71.60 75.07 5 DKIM_VALID 380864 71.96 69.55 72.85 6 XM_B_Unicode 356567 70.10 75.25 68.20 7 DCC_CHECK_NEGATIVE 318131 52.55 29.95 60.85 8 BAYES_50 289898 51.60 41.10 55.45 9 DKIM_VALID_AU 282933 53.70 52.57 54.12 10 XMListUnsubscribeExists 269189 54.68 63.35 51.49 11 XM_B_SpammyWords 259998 54.87 68.84 49.73 12 XM_B_Unicode3 203913 38.31 36.42 39.00 13 DCC_CHECK 193649 45.48 68.44 37.04 14 T_TM2_M_HEADER_IN_MSG 153495 27.67 23.05 29.36 15 DKIM_VALID_EF 150555 27.89 25.42 28.80 16 RCVD_IN_MSPIKE_WL 148023 24.79 15.18 28.31 17 RCVD_IN_MSPIKE_H2 141894 26.87 26.14 27.14 18 HTML_FONT_LOW_CONTRAST 139682 27.94 31.25 26.72 19 FVGT_m_MULTI_ODD 122539 24.34 26.80 23.44 20 LOC_TINY_FONT_1 120903 25.09 30.42 23.13 21 XM_B_SpammyWords2 120357 26.58 36.25 23.02 22 XMSubLong 113330 21.80 22.15 21.68 23 MIME_HTML_ONLY 102691 22.05 28.59 19.64 24 T_KAM_HTML_FONT_INVALID 98603 19.36 20.73 18.86 25 RCVD_IN_MSPIKE_H3 82932 13.83 8.30 15.86 26 ALL_TRUSTED 82564 11.82 0.99 15.79 27 BAYES_00 69217 10.02 1.26 13.24 28 XM_Body_Dirty_Words 65510 14.47 19.75 12.53 29 XM_Multi_Part_URI 62129 14.37 21.15 11.88 30 XM_B_Unsub 55410 11.14 12.62 10.60 31 RCVD_IN_MSPIKE_H4 53713 9.20 6.26 10.27 32 TR_XM_DK_Bayes 52125 7.43 0.50 9.97 33 TR_XM_DK_Bayes1 50618 7.21 0.48 9.68 34 LotsOfNums_01 47362 8.99 8.80 9.06 35 TooManyTo_001 46589 7.96 5.37 8.91 36 XM_DK_Undo_02 45138 16.80 39.02 8.63 37 TR_XM_DK_Bayes2 44961 6.39 0.36 8.60 38 LOTS_OF_MONEY 44388 11.04 17.99 8.49 39 UNPARSEABLE_RELAY 41199 7.32 5.78 7.88 40 RCVD_IN_RP_SAFE 40696 6.14 1.66 7.78 41 XM_Evil_Numbers_Gen 39876 7.92 8.73 7.63 42 RCVD_IN_RP_CERTIFIED 37961 5.66 1.29 7.26 43 XM_SendGrid 37823 6.54 4.64 7.23 44 BAYES_60 37327 7.27 7.64 7.14 45 XM_DKIMWhitelistDomains 36594 5.12 0.01 7.00 46 IN_ZIMBRA_NJ_WHITELIST 36538 5.12 0.04 6.99 47 XM_B_Phish_Phrases 34889 8.57 13.72 6.67 48 HTML_IMAGE_RATIO_02 33471 7.31 9.80 6.40 49 MIME_QP_LONG_LINE 30536 5.05 2.91 5.84 50 XM_H_Long_From01 29425 5.42 4.85 5.63 51 HTML_IMAGE_RATIO_04 28947 5.29 4.62 5.54 52 BAYES_99 28823 12.34 30.91 5.51 53 RCVD_IN_IADB_LISTED 28591 4.43 1.60 5.47 54 FSL_BULK_SIG 27658 6.98 11.59 5.29 55 XM_B_SpammyWords3 27314 6.91 11.50 5.22 56 RELAYCOUNTRY_META 27251 9.55 21.35 5.21 57 BAYES_40 27023 4.49 2.65 5.17 58 RCVD_IN_IADB_SPF 24960 3.84 1.31 4.77 59 BOTNET_IPINHOSTNAME 24270 6.71 12.34 4.64 60 BAYES_20 23954 3.91 2.07 4.58 61 T_TooManySym_01 23896 3.93 2.19 4.57 62 BAYES_999 23398 9.74 24.07 4.48 63 XM_PDF 23275 3.49 0.86 4.45 64 TR_XM_DK_SendGrid 22390 3.89 2.81 4.28 65 RCVD_IN_IADB_SENDERID 22221 3.44 1.22 4.25 66 ANY_BOUNCE_MESSAGE 22060 5.81 10.12 4.22 67 BOUNCE_MESSAGE 22050 5.80 10.12 4.22 68 XMStrtUSub 21565 4.18 4.34 4.12 69 RCVD_IN_IADB_DK 21520 3.34 1.22 4.12 70 XMNumbers 20870 4.15 4.57 3.99 71 BAYES_80 20839 5.15 8.31 3.99 72 XMSubMetaSx_00 19456 4.32 5.93 3.72 73 T_REMOTE_IMAGE 18990 4.21 5.80 3.63 74 RCVD_IN_IADB_VOUCHED 18198 2.76 0.79 3.48 75 DKIM_INVALID 18096 3.79 4.68 3.46 76 MPART_ALT_DIFF 17797 4.75 8.42 3.40 77 XMSexyCombo_05 16957 4.88 9.34 3.24 78 XM_UncommonTLD01 16599 5.19 10.68 3.18 79 HTML_IMAGE_RATIO_06 16425 3.28 3.67 3.14 80 XM_B_Unsub2 15663 3.05 3.22 3.00 81 TR_XM_PhishingBody 15425 3.49 4.97 2.95 82 TM2_M_URI_OPT_OUT 14731 3.01 3.53 2.82 83 FROM_EXCESS_BASE64 14235 2.67 2.51 2.72 84 URI_NOVOWEL 13775 2.26 1.23 2.63 85 HTML_MIME_NO_HTML_TAG 13084 2.73 3.35 2.50 86 TR_Symld_Words 13041 2.19 1.37 2.49 87 MAILING_LIST_MULTI 13020 2.13 1.14 2.49 88 BAYES_05 13006 2.12 1.13 2.49 89 TR_XM_SB_Phish 12949 2.27 1.71 2.48 90 XMSubPhish11 12826 2.24 1.65 2.45 91 BAYES_95 12663 3.04 4.73 2.42 92 XMStockSpam_06 12229 2.04 1.23 2.34 93 TR_DCC_Bayes_99 12179 7.92 23.15 2.33 94 RCVD_IN_IADB_OPTIN 12027 1.82 0.52 2.30 95 T_TooManySym_02 11617 1.76 0.52 2.22 96 RCVD_IN_MSPIKE_H5 11378 1.76 0.62 2.18 97 HTML_IMAGE_RATIO_08 11298 2.34 2.81 2.16 98 UNTRUSTED_Relay 11181 5.75 15.58 2.14 99 MIME_HTML_MOSTLY 11163 3.27 6.37 2.14 100 TooManyTo_002 11007 1.70 0.58 2.11 101 XM_B_SpammyTLD 10760 3.18 6.22 2.06 102 T_FONT_INVIS_NAKED_TO 10649 2.55 3.93 2.04 103 XM_CamelCaseFrm001 10379 2.07 2.29 1.99 104 LH_URI_DOM_IN_PATH 10251 1.95 1.91 1.96 105 MIME_HTML_ONLY_MULTI 10144 2.14 2.68 1.94 106 BOTNET 9931 8.37 25.99 1.90 107 XM_DK_Undo_01 9730 1.67 1.15 1.86 108 XM_B_Phish66 9321 2.01 2.64 1.78 109 XM_SPF_SoftFail 9177 2.51 4.56 1.76 110 T_XMDrugObfuBody_08 8882 2.23 3.68 1.70 111 XMDiploma_00 8857 2.04 2.98 1.69 112 HELO_NODOT 8448 1.41 0.86 1.62 113 HELO_NO_DOMAIN 8447 1.41 0.83 1.62 114 XM_B_COVIDMETA 8255 2.81 6.16 1.58 115 TVD_RCVD_IP 8105 1.20 0.25 1.55 116 RELAYCOUNTRY_CA 7986 2.66 5.73 1.53 117 KHOP_HELO_FCRDNS 7951 2.08 3.61 1.52 118 URI_HEX 7932 1.97 3.21 1.52 119 XM_H_Long_From02 7772 1.28 0.71 1.49 120 TR_XM_SpammyWords2 7686 4.16 11.49 1.47 121 IN_HORDE_ADDRESS_BOOK 7627 1.09 0.08 1.46 122 SUBJ_ALL_CAPS 7550 1.36 1.13 1.44 123 INVALID_MSGID 7424 1.17 0.49 1.42 124 TooManyTo_003 7369 1.14 0.40 1.41 125 RCVD_IN_BL_SPAMCOP_NET 7197 2.95 7.24 1.38 126 XM_OfRef6 7071 2.46 5.49 1.35 127 T_XMDrugObfuBody_14 6999 1.41 1.60 1.34 128 HELO_MISC_IP 6905 1.04 0.28 1.32 129 CK_HELO_DYNAMIC_SPLIT_IP 6903 1.05 0.30 1.32 130 XM_GoogleGroups 6869 1.06 0.39 1.31 131 XMGappySubj_01 6729 0.97 0.09 1.29 132 USER_IN_DEF_DKIM_WL 6612 0.93 0.01 1.26 133 XMCapTrack 6496 1.00 0.34 1.24 134 TO_MALFORMED 6265 0.88 0.00 1.20 135 URI_TRY_3LD 6053 1.69 3.12 1.16 136 TM2_M_VERY_LONG_WORD 5952 1.33 1.86 1.14 137 DKIM_ADSP_CUSTOM_MED 5873 1.07 0.94 1.12 138 XMBSHREFv2 5824 0.90 0.31 1.11 139 XM_UB50 5765 2.44 6.08 1.10 140 TooManyTo_004 5482 0.86 0.34 1.05 141 RELAYCOUNTRY_GB 5233 1.10 1.38 1.00 142 XM_ProductURIs 5175 0.92 0.72 0.99 143 T_TooManySym_03 5030 0.75 0.16 0.96 144 SpammyFromTLD_01 5010 1.77 3.99 0.96 145 T_FILL_THIS_FORM_SHORT 4887 1.17 1.79 0.93 146 XMGenDplmaNmb 4845 0.97 1.07 0.93 147 TR_MSPIKEBAYES00 4646 0.66 0.02 0.89 148 XMBrknScrpt_02 4581 1.71 3.98 0.88 149 XMHTML_After_End 4540 1.01 1.41 0.87 150 TooManyTo_005 4429 0.70 0.30 0.85 151 NML_ADSP_CUSTOM_MED 4117 0.80 0.83 0.79 152 T_Symld_Words_02 4113 0.96 1.45 0.79 153 XMBody_95 3851 0.57 0.11 0.74 154 HTTPS_HTTP_MISMATCH 3847 0.75 0.79 0.74 155 TR_MetaPhish_Combo_01 3707 0.78 0.96 0.71 156 T_XMDrugObfuBody_00 3651 0.85 1.27 0.70 157 XM_SPF_Unknown 3552 0.91 1.52 0.68 158 XMSubNoVowel 3500 0.88 1.46 0.67 159 T_OBFU_PDF_ATTACH 3500 0.52 0.12 0.67 160 SENDGRID_REDIR 3495 0.65 0.61 0.67 161 TR_LOTS_OF_MONEY3 3478 1.11 2.33 0.67 162 XM_ShortIntro_01 3472 0.65 0.61 0.66 163 FROM_GOV_DKIM_AU 3471 0.53 0.17 0.66 164 XMSexyCombo_01 3310 0.91 1.68 0.63 165 XM_H_Trusted_IP 3245 0.45 0.00 0.62 166 XMBdyGiftCard01 3188 0.81 1.34 0.61 167 RCVD_IN_MSPIKE_BL 3169 5.11 17.35 0.61 168 XMBody_17 3098 1.08 2.39 0.59 169 T_XMHurry_00 3097 0.82 1.43 0.59 170 XMMoneyMeta_00 3048 0.69 0.99 0.58 171 DKIM_ADSP_NXDOMAIN 2904 0.70 1.08 0.56 172 HTML_FONT_FACE_BAD 2866 0.58 0.66 0.55 173 FORGED_GMAIL_RCVD 2858 0.60 0.73 0.55 174 XM_B_SpammyWords4 2848 1.00 2.25 0.54 175 XMSubMetaI_00 2798 0.57 0.66 0.54 176 RELAYCOUNTRY_DE 2792 0.62 0.84 0.53 177 XMNoVowels 2735 0.57 0.70 0.52 178 XM_DIRTYINTL 2706 1.15 2.87 0.52 179 RCVD_IN_SORBS_DUL 2683 0.41 0.14 0.51 180 T_TooManySym_04 2635 0.38 0.03 0.50 181 XM_H_PHPMailer 2630 0.53 0.62 0.50 182 TR_XM_UnparsRelay 2622 0.96 2.20 0.50 183 XMHTMLBadTable_001 2552 0.49 0.50 0.49 184 MPART_ALT_DIFF_COUNT 2531 0.62 1.00 0.48 185 NO_DNS_FOR_FROM 2518 0.72 1.38 0.48 186 RELAYCOUNTRY_AU 2515 0.52 0.62 0.48 187 HTML_IMAGE_ONLY_20 2507 0.46 0.42 0.48 188 TR_BOTNET_NEGATE 2499 0.56 0.79 0.48 189 HTML_TAG_BALANCE_BODY 2484 0.52 0.63 0.48 190 RDNS_DYNAMIC 2463 0.62 1.02 0.47 191 TVD_SPACE_RATIO 2376 0.35 0.06 0.45 192 XMOemUri 2375 0.39 0.20 0.45 193 NUMERIC_HTTP_ADDR 2308 0.74 1.56 0.44 194 HTML_IMAGE_ONLY_32 2295 0.80 1.79 0.44 195 MISSING_HEADERS 2288 0.60 1.05 0.44 196 SHORT_HELO_AND_INLINE_IMAGE 2287 0.34 0.08 0.44 197 XM_S_SubURI 2284 0.34 0.08 0.44 198 XMBody_78 2271 0.61 1.10 0.43 199 XMPhish30 2270 0.55 0.88 0.43 200 T_PDS_OTHER_BAD_TLD 2260 0.68 1.34 0.43 ----------------------------------------------------------------------