Email: 669848 Autolearn: 0 AvgScore: 3.31 AvgScanTime: 1.55 sec Spam: 179803 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 2.06 sec Ham: 490045 Autolearn: 0 AvgScore: -0.46 AvgScanTime: 1.36 sec Time Spent Running SA: 288.23 hours Time Spent Processing Spam: 102.86 hours Time Spent Processing Ham: 185.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164831 90.03 91.67 89.43 2 DKIM_SIGNED 139752 77.76 77.73 77.78 3 XM_B_Unicode 135535 72.26 75.38 71.12 4 RELAYCOUNTRY_US 135119 80.09 75.15 81.90 5 XM_DK_Pass 133228 75.68 74.10 76.26 6 DCC_CHECK 130428 46.21 72.54 36.54 7 DKIM_VALID 129212 73.41 71.86 73.97 8 XM_B_SpammyWords 120840 54.01 67.21 49.17 9 XMListUnsubscribeExists 119408 54.89 66.41 50.67 10 DKIM_VALID_AU 99201 55.43 55.17 55.52 11 XM_DK_Undo_02 73141 17.44 40.68 8.91 12 BAYES_50 71921 52.16 40.00 56.62 13 XM_B_Unicode3 67150 39.88 37.35 40.80 14 XM_B_SpammyWords2 66590 26.81 37.03 23.06 15 HTML_FONT_LOW_CONTRAST 60247 28.83 33.51 27.12 16 LOC_TINY_FONT_1 59783 26.42 33.25 23.91 17 BAYES_99 58043 12.78 32.28 5.62 18 MIME_HTML_ONLY 56248 23.21 31.28 20.25 19 DKIM_VALID_EF 50021 29.65 27.82 30.32 20 RCVD_IN_MSPIKE_H2 46711 26.38 25.98 26.52 21 DCC_CHECK_NEGATIVE 46583 51.87 25.91 61.40 22 FVGT_m_MULTI_ODD 45298 23.30 25.19 22.60 23 XMSubLong 45082 22.39 25.07 21.41 24 BAYES_999 44818 10.03 24.93 4.56 25 TR_DCC_Bayes_99 42763 8.36 23.78 2.70 26 T_KAM_HTML_FONT_INVALID 41984 20.06 23.35 18.85 27 T_TM2_M_HEADER_IN_MSG 41932 28.73 23.32 30.71 28 BOTNET 39274 7.42 21.84 2.13 29 RELAYCOUNTRY_META 38968 9.66 21.67 5.25 30 XM_Multi_Part_URI 37798 14.39 21.02 11.95 31 XM_Body_Dirty_Words 37182 14.44 20.68 12.15 32 UNTRUSTED_Relay 32361 6.36 18.00 2.08 33 RCVD_IN_MSPIKE_WL 28387 25.91 15.79 29.62 34 LOTS_OF_MONEY 27125 10.03 15.09 8.17 35 FSL_BULK_SIG 24468 7.74 13.61 5.59 36 TR_XM_SpammyWords2 23976 4.69 13.33 1.52 37 BOTNET_IPINHOSTNAME 23100 6.91 12.85 4.74 38 RCVD_IN_MSPIKE_BL 22158 3.85 12.32 0.74 39 XM_B_SpammyWords3 21790 7.59 12.12 5.93 40 XM_B_Unsub 20687 11.67 11.51 11.73 41 XM_B_Phish_Phrases 20048 7.63 11.15 6.34 42 XM_UncommonTLD01 18193 5.19 10.12 3.38 43 XMSexyCombo_05 17754 5.65 9.87 4.10 44 LotsOfNums_01 17533 9.01 9.75 8.74 45 XM_Evil_Numbers_Gen 16775 8.54 9.33 8.25 46 RCVD_IN_RP_RNBL 16202 2.53 9.01 0.15 47 HTML_IMAGE_RATIO_02 15277 7.42 8.50 7.02 48 RCVD_IN_MSPIKE_H3 15141 14.62 8.42 16.89 49 MPART_ALT_DIFF 15084 5.11 8.39 3.91 50 T_REMOTE_IMAGE 14674 4.90 8.16 3.71 51 BAYES_80 14002 5.06 7.79 4.06 52 TR_XM_SpammyWords3 13133 2.26 7.30 0.41 53 XM_UB50 13095 2.68 7.28 1.00 54 BAYES_60 12916 7.02 7.18 6.95 55 RCVD_IN_MSPIKE_L5 12750 2.08 7.09 0.24 56 RCVD_IN_MSPIKE_H4 11940 9.44 6.64 10.47 57 RCVD_IN_BL_SPAMCOP_NET 11933 2.81 6.64 1.40 58 MIME_HTML_MOSTLY 11763 3.38 6.54 2.21 59 XMSubMetaSx_00 11398 4.15 6.34 3.35 60 XMNumbers 11294 4.28 6.28 3.55 61 RCVD_IN_PSBL 11163 1.68 6.21 0.02 62 KHOP_HELO_FCRDNS 11157 2.85 6.21 1.61 63 SHORTENED_URL_HREF 11063 1.92 6.15 0.37 64 XMBrknScrpt_02 10894 2.25 6.06 0.85 65 DKIM_INVALID 10540 4.36 5.86 3.80 66 TR_XM_PhishingBody 10526 3.75 5.85 2.97 67 BODY_URI_ONLY 10318 1.58 5.74 0.05 68 HTML_SHORT_LINK_IMG_1 10209 1.54 5.68 0.02 69 HTML_IMAGE_ONLY_08 10090 1.58 5.61 0.10 70 TooManyTo_001 9971 7.58 5.55 8.33 71 SHORT_URI_3 9859 1.51 5.48 0.05 72 TR_XM_COVIDMETA4 9769 1.78 5.43 0.44 73 HTML_IMAGE_RATIO_04 9728 5.65 5.41 5.74 74 SHORTENED_URL_SRC 9624 1.44 5.35 0.00 75 SHORTENER_SHORT_IMG 9612 1.43 5.35 0.00 76 RELAYCOUNTRY_CA 9539 2.62 5.31 1.63 77 SHORT_SHORTNER 9525 1.43 5.30 0.01 78 UNPARSEABLE_RELAY 9502 6.84 5.28 7.41 79 XM_H_Long_From01 9477 5.63 5.27 5.76 80 BOTNET_NORDNS 9220 1.46 5.13 0.11 81 DATE_IN_PAST_03_06 8831 1.41 4.91 0.12 82 BAYES_95 8605 3.10 4.79 2.48 83 SpammyFromTLD_01 8425 1.95 4.69 0.94 84 RCVD_IN_MSPIKE_L3 8168 1.56 4.54 0.47 85 XM_SPF_SoftFail 8002 2.50 4.45 1.78 86 XM_SendGrid 7958 6.15 4.43 6.79 87 ANY_BOUNCE_MESSAGE 7889 3.47 4.39 3.14 88 BOUNCE_MESSAGE 7888 3.47 4.39 3.14 89 XM_B_COVIDMETA 7885 2.02 4.39 1.15 90 URIBL_SBL_A 7673 1.27 4.27 0.18 91 T_FONT_INVIS_NAKED_TO 7595 2.54 4.22 1.92 92 XM_Lotto 7436 1.25 4.14 0.20 93 LH_URI_DOM_IN_PATH 6836 2.43 3.80 1.93 94 XMBody_17 6832 1.55 3.80 0.72 95 XM_B_SpammyTLD 6599 2.34 3.67 1.86 96 URI_HEX 6338 2.10 3.52 1.57 97 XM_DIRTYINTL 6263 1.26 3.48 0.45 98 TM2_M_URI_OPT_OUT 6106 2.76 3.40 2.52 99 XM_B_Phish66 6037 2.21 3.36 1.79 100 XMStrtUSub 6023 4.37 3.35 4.75 101 T_XMDrugObfuBody_08 6003 2.08 3.34 1.62 102 XMDiploma_00 5810 2.41 3.23 2.11 103 HTML_IMAGE_RATIO_06 5756 3.47 3.20 3.57 104 XM_OfRef6 5754 1.73 3.20 1.19 105 RELAYCOUNTRY_FR 5696 1.04 3.17 0.25 106 SpammyFromTLD_02 5542 1.10 3.08 0.37 107 BAYES_40 5455 4.44 3.03 4.95 108 URI_PHP_REDIR 5257 0.79 2.92 0.01 109 HTML_IMAGE_RATIO_08 4925 2.32 2.74 2.17 110 URI_TRY_3LD 4803 1.69 2.67 1.33 111 MIME_QP_LONG_LINE 4798 5.10 2.67 5.99 112 XM_UB99 4577 0.69 2.55 0.01 113 TR_LOTS_OF_MONEY3 4498 1.15 2.50 0.65 114 TR_XM_MaxBayes 4418 0.67 2.46 0.01 115 HTML_MIME_NO_HTML_TAG 4409 2.17 2.45 2.07 116 MIME_HTML_ONLY_MULTI 4347 2.14 2.42 2.04 117 T_TooManySym_01 4312 4.19 2.40 4.85 118 XM_UB60 4208 0.68 2.34 0.07 119 RELAYCOUNTRY_IN 4095 0.69 2.28 0.11 120 XM_B_Unsub2 4081 3.03 2.27 3.30 121 TR_Symld_Words 3931 1.94 2.19 1.85 122 XMSexyCombo_01 3874 0.94 2.15 0.49 123 FROM_EXCESS_BASE64 3788 2.80 2.11 3.06 124 XM_URI_RBL 3755 0.71 2.09 0.20 125 TR_XM_DK_SendGrid 3742 3.45 2.08 3.95 126 RCVD_IN_RP_SAFE 3725 6.36 2.07 7.93 127 TR_XM_MaxSPIKE 3705 0.56 2.06 0.01 128 TR_XM_SB_Phish 3660 2.28 2.04 2.37 129 XM_CamelCaseFrm001 3639 1.81 2.02 1.73 130 TM2_M_VERY_LONG_WORD 3595 1.31 2.00 1.06 131 XM_B_SpammyWords4 3547 0.99 1.97 0.63 132 TR_XM_UnparsRelay 3478 0.75 1.93 0.31 133 XMSubPhish11 3461 2.22 1.92 2.33 134 XM_UB999 3431 0.52 1.91 0.01 135 RELAYCOUNTRY_TR 3396 0.51 1.89 0.01 136 BAYES_20 3394 3.19 1.89 3.67 137 RCVD_IN_IADB_LISTED 3385 4.59 1.88 5.58 138 BAYES_00 3286 10.24 1.83 13.33 139 XM_UB80 3125 0.49 1.74 0.03 140 XMGenDplmaNmb 2996 1.19 1.67 1.01 141 T_XMHurry_00 2990 0.93 1.66 0.66 142 TR_XM_INV_DKIM 2984 0.54 1.66 0.12 143 XMStockSpam_06 2972 1.47 1.65 1.40 144 TR_XM_PHPForged 2972 0.69 1.65 0.34 145 RCVD_IN_RP_CERTIFIED 2965 5.80 1.65 7.33 146 T_FILL_THIS_FORM_SHORT 2955 1.23 1.64 1.07 147 TR_XM_PHPDW 2946 0.70 1.64 0.35 148 TR_XM_FormFill2 2879 0.67 1.60 0.33 149 XM_H_PHPOS 2870 0.67 1.60 0.33 150 RCVD_IN_IADB_SPF 2843 3.99 1.58 4.87 151 T_XMDrugObfuBody_00 2843 1.16 1.58 1.00 152 T_XMDrugObfuBody_14 2753 1.76 1.53 1.84 153 HTML_FONT_SIZE_LARGE 2662 0.47 1.48 0.10 154 RCVD_IN_IADB_SENDERID 2580 3.56 1.43 4.34 155 RCVD_IN_IADB_DK 2560 3.46 1.42 4.20 156 XM_OfRef7 2515 0.46 1.40 0.11 157 XMHTML_After_End 2500 0.93 1.39 0.76 158 T_PDS_OTHER_BAD_TLD 2454 0.60 1.36 0.32 159 TR_XM_COVIDMETA1 2445 0.58 1.36 0.29 160 XMBdyGiftCard01 2381 0.68 1.32 0.44 161 URI_NOVOWEL 2323 2.28 1.29 2.64 162 XMGppyBdWords 2319 0.58 1.29 0.33 163 XMSlimDrugH 2260 0.59 1.26 0.34 164 RELAYCOUNTRY_GB 2227 1.05 1.24 0.98 165 TR_XM_RelayPhish 2208 0.42 1.23 0.12 166 SUBJ_ALL_CAPS 2144 1.42 1.19 1.50 167 MAILING_LIST_MULTI 2123 2.23 1.18 2.62 168 XM_DK_Undo_01 2104 1.90 1.17 2.16 169 TR_Mismatch_TLD_01 2097 0.64 1.17 0.45 170 FILL_THIS_FORM 2071 0.47 1.15 0.22 171 XMMoneyMeta_00 2067 0.73 1.15 0.58 172 XMSubNoVowel 2062 0.71 1.15 0.55 173 DKIM_ADSP_CUSTOM_MED 2058 1.19 1.14 1.20 174 TR_MetaPhish_Combo_01 2022 1.01 1.12 0.96 175 ALL_TRUSTED 1984 10.64 1.10 14.14 176 MIME_CHARSET_FARAWAY 1964 0.39 1.09 0.14 177 FROM_SUSPICIOUS_NTLD 1962 0.35 1.09 0.08 178 T_FILL_THIS_FORM_LONG 1954 0.40 1.09 0.15 179 XMSubMetaI_00 1950 0.85 1.08 0.76 180 XM_BadFromFormat 1891 0.44 1.05 0.21 181 BAYES_05 1876 1.97 1.04 2.31 182 NML_ADSP_CUSTOM_MED 1868 0.90 1.04 0.85 183 FROM_SUSPICIOUS_NTLD_FP 1868 0.33 1.04 0.07 184 T_LONG_INVISIBLE_TEXT 1861 0.67 1.04 0.54 185 XM_SPF_Unknown 1854 0.80 1.03 0.72 186 XMSubMetaSxObfu_03 1846 0.56 1.03 0.39 187 RCVD_IN_IADB_VOUCHED 1812 2.80 1.01 3.45 188 CHARSET_FARAWAY_HEADER 1798 0.31 1.00 0.05 189 XM_ProductURIs 1786 0.92 0.99 0.89 190 XMSlimDrugs 1771 0.28 0.98 0.02 191 XMBody_78 1763 0.58 0.98 0.43 192 XM_Combo_Sbj 1743 0.46 0.97 0.28 193 HTTPS_HTTP_MISMATCH 1738 0.93 0.97 0.92 194 NORDNS_LOW_CONTRAST 1731 0.29 0.96 0.04 195 T_Symld_Words_02 1720 0.67 0.96 0.56 196 URI_NO_WWW_BIZ_CGI 1719 0.27 0.96 0.02 197 DIET_1 1707 0.49 0.95 0.32 198 ADVANCE_FEE_2_NEW_FORM 1705 0.26 0.95 0.01 199 TR_BOTNET_NEGATE 1699 0.70 0.94 0.62 200 SENDGRID_REDIR 1697 0.59 0.94 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 438231 90.03 91.67 89.43 2 RELAYCOUNTRY_US 401363 80.09 75.15 81.90 3 DKIM_SIGNED 381145 77.76 77.73 77.78 4 XM_DK_Pass 373723 75.68 74.10 76.26 5 DKIM_VALID 362502 73.41 71.86 73.97 6 XM_B_Unicode 348521 72.26 75.38 71.12 7 DCC_CHECK_NEGATIVE 300900 51.87 25.91 61.40 8 BAYES_50 277447 52.16 40.00 56.62 9 DKIM_VALID_AU 272087 55.43 55.17 55.52 10 XMListUnsubscribeExists 248301 54.89 66.41 50.67 11 XM_B_SpammyWords 240954 54.01 67.21 49.17 12 XM_B_Unicode3 199958 39.88 37.35 40.80 13 DCC_CHECK 179080 46.21 72.54 36.54 14 T_TM2_M_HEADER_IN_MSG 150486 28.73 23.32 30.71 15 DKIM_VALID_EF 148605 29.65 27.82 30.32 16 RCVD_IN_MSPIKE_WL 145153 25.91 15.79 29.62 17 HTML_FONT_LOW_CONTRAST 132882 28.83 33.51 27.12 18 RCVD_IN_MSPIKE_H2 129968 26.38 25.98 26.52 19 LOC_TINY_FONT_1 117178 26.42 33.25 23.91 20 XM_B_SpammyWords2 113024 26.81 37.03 23.06 21 FVGT_m_MULTI_ODD 110751 23.30 25.19 22.60 22 XMSubLong 104895 22.39 25.07 21.41 23 MIME_HTML_ONLY 99215 23.21 31.28 20.25 24 T_KAM_HTML_FONT_INVALID 92371 20.06 23.35 18.85 25 RCVD_IN_MSPIKE_H3 82777 14.62 8.42 16.89 26 ALL_TRUSTED 69291 10.64 1.10 14.14 27 BAYES_00 65304 10.24 1.83 13.33 28 XM_Body_Dirty_Words 59564 14.44 20.68 12.15 29 XM_Multi_Part_URI 58583 14.39 21.02 11.95 30 XM_B_Unsub 57490 11.67 11.51 11.73 31 RCVD_IN_MSPIKE_H4 51291 9.44 6.64 10.47 32 TR_XM_DK_Bayes 48456 7.36 0.47 9.89 33 TR_XM_DK_Bayes1 46531 7.06 0.43 9.50 34 XM_DK_Undo_02 43664 17.44 40.68 8.91 35 LotsOfNums_01 42840 9.01 9.75 8.74 36 TR_XM_DK_Bayes2 41096 6.23 0.37 8.39 37 TooManyTo_001 40834 7.58 5.55 8.33 38 XM_Evil_Numbers_Gen 40432 8.54 9.33 8.25 39 LOTS_OF_MONEY 40049 10.03 15.09 8.17 40 XM_DKIMWhitelistDomains 39790 5.94 0.01 8.12 41 RCVD_IN_RP_SAFE 38869 6.36 2.07 7.93 42 IN_ZIMBRA_NJ_WHITELIST 36591 5.47 0.04 7.47 43 UNPARSEABLE_RELAY 36335 6.84 5.28 7.41 44 RCVD_IN_RP_CERTIFIED 35916 5.80 1.65 7.33 45 HTML_IMAGE_RATIO_02 34398 7.42 8.50 7.02 46 BAYES_60 34077 7.02 7.18 6.95 47 XM_SendGrid 33269 6.15 4.43 6.79 48 XM_B_Phish_Phrases 31061 7.63 11.15 6.34 49 MIME_QP_LONG_LINE 29340 5.10 2.67 5.99 50 XM_B_SpammyWords3 29069 7.59 12.12 5.93 51 XM_H_Long_From01 28212 5.63 5.27 5.76 52 HTML_IMAGE_RATIO_04 28109 5.65 5.41 5.74 53 BAYES_99 27544 12.78 32.28 5.62 54 FSL_BULK_SIG 27377 7.74 13.61 5.59 55 RCVD_IN_IADB_LISTED 27342 4.59 1.88 5.58 56 RELAYCOUNTRY_META 25731 9.66 21.67 5.25 57 BAYES_40 24266 4.44 3.03 4.95 58 RCVD_IN_IADB_SPF 23860 3.99 1.58 4.87 59 T_TooManySym_01 23769 4.19 2.40 4.85 60 XMStrtUSub 23261 4.37 3.35 4.75 61 BOTNET_IPINHOSTNAME 23211 6.91 12.85 4.74 62 XM_PDF 22501 3.60 0.90 4.59 63 BAYES_999 22338 10.03 24.93 4.56 64 RCVD_IN_IADB_SENDERID 21270 3.56 1.43 4.34 65 RCVD_IN_IADB_DK 20601 3.46 1.42 4.20 66 XMSexyCombo_05 20100 5.65 9.87 4.10 67 BAYES_80 19909 5.06 7.79 4.06 68 TR_XM_DK_SendGrid 19342 3.45 2.08 3.95 69 MPART_ALT_DIFF 19156 5.11 8.39 3.91 70 DKIM_INVALID 18643 4.36 5.86 3.80 71 T_REMOTE_IMAGE 18178 4.90 8.16 3.71 72 BAYES_20 17975 3.19 1.89 3.67 73 HTML_IMAGE_RATIO_06 17505 3.47 3.20 3.57 74 XMNumbers 17374 4.28 6.28 3.55 75 RCVD_IN_IADB_VOUCHED 16926 2.80 1.01 3.45 76 XM_UncommonTLD01 16573 5.19 10.12 3.38 77 XMSubMetaSx_00 16415 4.15 6.34 3.35 78 XM_B_Unsub2 16193 3.03 2.27 3.30 79 ANY_BOUNCE_MESSAGE 15382 3.47 4.39 3.14 80 BOUNCE_MESSAGE 15375 3.47 4.39 3.14 81 FROM_EXCESS_BASE64 14999 2.80 2.11 3.06 82 TR_XM_PhishingBody 14578 3.75 5.85 2.97 83 TR_DCC_Bayes_99 13210 8.36 23.78 2.70 84 URI_NOVOWEL 12925 2.28 1.29 2.64 85 MAILING_LIST_MULTI 12838 2.23 1.18 2.62 86 T_TooManySym_02 12526 2.07 0.74 2.56 87 TM2_M_URI_OPT_OUT 12354 2.76 3.40 2.52 88 BAYES_95 12167 3.10 4.79 2.48 89 TR_XM_SB_Phish 11609 2.28 2.04 2.37 90 XMSubPhish11 11422 2.22 1.92 2.33 91 BAYES_05 11307 1.97 1.04 2.31 92 TooManyTo_002 11208 1.83 0.60 2.29 93 RCVD_IN_MSPIKE_H5 11086 1.85 0.73 2.26 94 RCVD_IN_IADB_OPTIN 10865 1.81 0.70 2.22 95 MIME_HTML_MOSTLY 10845 3.38 6.54 2.21 96 HTML_IMAGE_RATIO_08 10648 2.32 2.74 2.17 97 XM_DK_Undo_01 10599 1.90 1.17 2.16 98 BOTNET 10427 7.42 21.84 2.13 99 XMDiploma_00 10329 2.41 3.23 2.11 100 UNTRUSTED_Relay 10216 6.36 18.00 2.08 101 HTML_MIME_NO_HTML_TAG 10148 2.17 2.45 2.07 102 MIME_HTML_ONLY_MULTI 9994 2.14 2.42 2.04 103 LH_URI_DOM_IN_PATH 9462 2.43 3.80 1.93 104 T_FONT_INVIS_NAKED_TO 9400 2.54 4.22 1.92 105 XM_B_SpammyTLD 9096 2.34 3.67 1.86 106 TR_Symld_Words 9055 1.94 2.19 1.85 107 T_XMDrugObfuBody_14 9016 1.76 1.53 1.84 108 HTML_FONT_FACE_BAD 8900 1.52 0.70 1.82 109 XM_B_Phish66 8781 2.21 3.36 1.79 110 XM_SPF_SoftFail 8722 2.50 4.45 1.78 111 XM_CamelCaseFrm001 8497 1.81 2.02 1.73 112 HELO_NODOT 8156 1.44 0.82 1.66 113 HELO_NO_DOMAIN 8154 1.44 0.82 1.66 114 RELAYCOUNTRY_CA 8010 2.62 5.31 1.63 115 T_XMDrugObfuBody_08 7933 2.08 3.34 1.62 116 KHOP_HELO_FCRDNS 7904 2.85 6.21 1.61 117 INVALID_MSGID 7833 1.27 0.37 1.60 118 IN_HORDE_ADDRESS_BOOK 7759 1.20 0.14 1.58 119 URI_HEX 7697 2.10 3.52 1.57 120 TooManyTo_003 7677 1.27 0.47 1.57 121 TVD_RCVD_IP 7633 1.20 0.22 1.56 122 TR_XM_SpammyWords2 7427 4.69 13.33 1.52 123 SUBJ_ALL_CAPS 7355 1.42 1.19 1.50 124 RCVD_IN_BL_SPAMCOP_NET 6878 2.81 6.64 1.40 125 XMStockSpam_06 6861 1.47 1.65 1.40 126 XMGappySubj_01 6710 1.05 0.20 1.37 127 XMCapTrack 6650 1.11 0.44 1.36 128 URI_TRY_3LD 6530 1.69 2.67 1.33 129 TO_MALFORMED 6481 0.97 0.02 1.32 130 HELO_MISC_IP 6476 1.06 0.35 1.32 131 CK_HELO_DYNAMIC_SPLIT_IP 6474 1.09 0.46 1.32 132 XM_GoogleGroups 6108 1.02 0.41 1.25 133 DKIM_ADSP_CUSTOM_MED 5895 1.19 1.14 1.20 134 XM_OfRef6 5825 1.73 3.20 1.19 135 XM_B_COVIDMETA 5646 2.02 4.39 1.15 136 TooManyTo_004 5643 0.95 0.40 1.15 137 T_FILL_THIS_FORM_SHORT 5264 1.23 1.64 1.07 138 XMBSHREFv2 5198 0.86 0.31 1.06 139 TM2_M_VERY_LONG_WORD 5197 1.31 2.00 1.06 140 XM_H_Long_From02 5169 1.02 0.91 1.05 141 T_TooManySym_03 5038 0.82 0.26 1.03 142 USER_IN_DEF_DKIM_WL 5036 0.75 0.01 1.03 143 XMGenDplmaNmb 4954 1.19 1.67 1.01 144 T_XMDrugObfuBody_00 4914 1.16 1.58 1.00 145 XM_UB50 4877 2.68 7.28 1.00 146 RELAYCOUNTRY_GB 4815 1.05 1.24 0.98 147 TR_MSPIKEBAYES00 4762 0.71 0.00 0.97 148 TR_MetaPhish_Combo_01 4712 1.01 1.12 0.96 149 SpammyFromTLD_01 4610 1.95 4.69 0.94 150 HTTPS_HTTP_MISMATCH 4503 0.93 0.97 0.92 151 TooManyTo_005 4382 0.74 0.32 0.89 152 XM_ProductURIs 4378 0.92 0.99 0.89 153 XMBrknScrpt_02 4170 2.25 6.06 0.85 154 NML_ADSP_CUSTOM_MED 4157 0.90 1.04 0.85 155 XMBody_95 3759 0.59 0.09 0.77 156 XMHTML_After_End 3721 0.93 1.39 0.76 157 XMSubMetaI_00 3717 0.85 1.08 0.76 158 RCVD_IN_MSPIKE_BL 3642 3.85 12.32 0.74 159 XM_ShortIntro_01 3584 0.63 0.34 0.73 160 T_OBFU_PDF_ATTACH 3582 0.59 0.19 0.73 161 XMBody_17 3545 1.55 3.80 0.72 162 XM_SPF_Unknown 3527 0.80 1.03 0.72 163 FROM_GOV_DKIM_AU 3361 0.61 0.40 0.69 164 T_MONEY_PERCENT 3280 0.70 0.77 0.67 165 TR_LOTS_OF_MONEY2 3280 0.70 0.77 0.67 166 T_XMHurry_00 3216 0.93 1.66 0.66 167 TR_LOTS_OF_MONEY3 3197 1.15 2.50 0.65 168 DKIM_ADSP_NXDOMAIN 3140 0.71 0.88 0.64 169 XM_B_SpammyWords4 3111 0.99 1.97 0.63 170 TR_BOTNET_NEGATE 3018 0.70 0.94 0.62 171 XMMoneyMeta_00 2827 0.73 1.15 0.58 172 XMNoVowels 2797 0.53 0.42 0.57 173 FORGED_GMAIL_RCVD 2793 0.65 0.86 0.57 174 HTML_TAG_BALANCE_BODY 2766 0.59 0.64 0.56 175 T_Symld_Words_02 2758 0.67 0.96 0.56 176 XMSubNoVowel 2675 0.71 1.15 0.55 177 XMHTMLBadTable_001 2662 0.58 0.67 0.54 178 T_TooManySym_04 2656 0.41 0.06 0.54 179 T_LONG_INVISIBLE_TEXT 2650 0.67 1.04 0.54 180 XM_B_COPY_HTML 2635 0.53 0.52 0.54 181 XM_B_REG_HTML 2625 0.53 0.51 0.54 182 XMLngstWrd_00 2523 0.47 0.36 0.51 183 MISSING_HEADERS 2462 0.51 0.53 0.50 184 RDNS_DYNAMIC 2458 0.61 0.90 0.50 185 XM_H_PHPMailer 2438 0.54 0.64 0.50 186 XMSexyCombo_01 2412 0.94 2.15 0.49 187 NO_DNS_FOR_FROM 2399 0.59 0.85 0.49 188 HTML_IMAGE_ONLY_20 2386 0.47 0.41 0.49 189 RCVD_IN_SORBS_DUL 2362 0.45 0.35 0.48 190 XMPhish14 2346 0.58 0.85 0.48 191 NUMERIC_HTTP_ADDR 2302 0.57 0.84 0.47 192 RCVD_IN_MSPIKE_L3 2291 1.56 4.54 0.47 193 SENDGRID_REDIR 2286 0.59 0.94 0.47 194 XM_S_SubURI 2251 0.35 0.06 0.46 195 FROM_GOV_SPOOF 2241 0.37 0.15 0.46 196 XM_H_Trusted_IP 2238 0.33 0.00 0.46 197 XMLngstWrd_01 2227 0.42 0.34 0.45 198 TR_Mismatch_TLD_01 2215 0.64 1.17 0.45 199 XM_DIRTYINTL 2205 1.26 3.48 0.45 200 TR_XM_COVIDMETA4 2178 1.78 5.43 0.44 ----------------------------------------------------------------------