Email: 659540 Autolearn: 0 AvgScore: 3.58 AvgScanTime: 1.24 sec Spam: 184657 Autolearn: 0 AvgScore: 13.75 AvgScanTime: 1.41 sec Ham: 474883 Autolearn: 0 AvgScore: -0.37 AvgScanTime: 1.17 sec Time Spent Running SA: 227.37 hours Time Spent Processing Spam: 72.46 hours Time Spent Processing Ham: 154.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157949 87.93 85.54 88.86 2 RELAYCOUNTRY_US 140969 79.49 76.34 80.72 3 XM_B_Unicode 140813 70.74 76.26 68.60 4 DKIM_SIGNED 138111 76.23 74.79 76.78 5 XM_DK_Pass 134404 74.87 72.79 75.69 6 DCC_CHECK 131431 47.03 71.18 37.65 7 DKIM_VALID 130420 72.50 70.63 73.23 8 XM_B_SpammyWords 128244 55.72 69.45 50.38 9 XMListUnsubscribeExists 115918 53.01 62.77 49.22 10 DKIM_VALID_AU 102652 55.06 55.59 54.86 11 BAYES_50 79564 53.40 43.09 57.41 12 XM_B_SpammyWords2 70847 28.32 38.37 24.42 13 XM_DK_Undo_02 70758 16.73 38.32 8.33 14 XM_B_Unicode3 65566 37.61 35.51 38.43 15 LOC_TINY_FONT_1 57387 25.67 31.08 23.56 16 HTML_FONT_LOW_CONTRAST 57309 28.13 31.04 27.00 17 BAYES_99 55548 12.31 30.08 5.41 18 MIME_HTML_ONLY 51303 22.02 27.78 19.78 19 DKIM_VALID_EF 51074 29.58 27.66 30.33 20 DCC_CHECK_NEGATIVE 50032 50.97 27.09 60.25 21 RCVD_IN_MSPIKE_H2 49448 26.80 26.78 26.81 22 T_KAM_HTML_FONT_INVALID 45699 19.98 24.75 18.13 23 FVGT_m_MULTI_ODD 44999 23.09 24.37 22.59 24 BOTNET 43447 7.91 23.53 1.84 25 T_TM2_M_HEADER_IN_MSG 42638 30.21 23.09 32.98 26 BAYES_999 42629 9.65 23.09 4.43 27 TR_DCC_Bayes_99 42412 8.47 22.97 2.84 28 XMSubLong 42148 21.62 22.83 21.15 29 XM_Multi_Part_URI 38472 13.71 20.83 10.94 30 RELAYCOUNTRY_META 37449 9.59 20.28 5.44 31 XM_Body_Dirty_Words 37340 15.26 20.22 13.32 32 LOTS_OF_MONEY 36316 11.81 19.67 8.75 33 RCVD_IN_MSPIKE_BL 32556 5.44 17.63 0.70 34 UNTRUSTED_Relay 30832 6.27 16.70 2.21 35 RCVD_IN_MSPIKE_WL 26878 24.65 14.56 28.58 36 FSL_BULK_SIG 24893 7.41 13.48 5.05 37 TR_XM_SpammyWords2 23544 4.47 12.75 1.25 38 RCVD_IN_RP_RNBL 22864 3.55 12.38 0.11 39 DATE_IN_PAST_03_06 22675 3.51 12.28 0.09 40 XM_B_Phish_Phrases 22485 8.02 12.18 6.40 41 XM_B_SpammyWords3 22208 7.37 12.03 5.57 42 RCVD_IN_MSPIKE_L5 21997 3.48 11.91 0.20 43 BOTNET_IPINHOSTNAME 21853 6.61 11.83 4.57 44 RCVD_IN_PSBL 20988 3.21 11.37 0.03 45 TR_XM_SpammyWords3 20239 3.33 10.96 0.36 46 XM_UncommonTLD01 19284 5.46 10.44 3.53 47 XM_B_Unsub 18896 10.83 10.23 11.06 48 XMSexyCombo_05 17640 5.57 9.55 4.03 49 LotsOfNums_01 16912 8.42 9.16 8.13 50 ANY_BOUNCE_MESSAGE 16792 4.24 9.09 2.35 51 BOUNCE_MESSAGE 16791 4.24 9.09 2.35 52 XM_Lotto 16578 2.56 8.98 0.07 53 XM_Evil_Numbers_Gen 15869 8.29 8.59 8.17 54 MPART_ALT_DIFF 15218 4.91 8.24 3.62 55 TR_XM_COVIDMETA4 14999 2.56 8.12 0.40 56 RCVD_IN_MSPIKE_H3 14607 13.83 7.91 16.14 57 BAYES_80 14321 5.12 7.76 4.10 58 BAYES_60 13494 7.12 7.31 7.04 59 XM_UB50 13456 2.85 7.29 1.12 60 XMSubMetaSx_00 13096 4.44 7.09 3.41 61 XM_OfRef6 11998 2.84 6.50 1.42 62 HTML_IMAGE_RATIO_02 11970 6.54 6.48 6.56 63 T_REMOTE_IMAGE 11393 4.42 6.17 3.74 64 RCVD_IN_BL_SPAMCOP_NET 11171 2.51 6.05 1.13 65 RCVD_IN_MSPIKE_H4 11129 9.08 6.03 10.27 66 MIME_HTML_MOSTLY 11076 3.25 6.00 2.18 67 XMBody_17 10537 2.26 5.71 0.92 68 TooManyTo_001 10199 8.07 5.52 9.06 69 TR_XM_PhishingBody 10196 3.66 5.52 2.93 70 XMBrknScrpt_02 10101 2.22 5.47 0.95 71 KHOP_HELO_FCRDNS 9995 2.78 5.41 1.75 72 UNPARSEABLE_RELAY 9709 6.99 5.26 7.66 73 RELAYCOUNTRY_CA 9574 2.56 5.18 1.54 74 URIBL_SBL_A 9544 1.57 5.17 0.17 75 XM_B_COVIDMETA 9356 2.27 5.07 1.18 76 XM_H_Long_From01 9166 5.50 4.96 5.72 77 XM_B_SpammyTLD 9094 2.73 4.92 1.88 78 RCVD_IN_MSPIKE_L3 9074 1.70 4.91 0.45 79 BAYES_95 8638 3.16 4.68 2.58 80 XM_SendGrid 8516 6.42 4.61 7.13 81 HTML_SHORT_LINK_IMG_1 8184 1.30 4.43 0.08 82 BODY_URI_ONLY 8125 1.30 4.40 0.10 83 T_FONT_INVIS_NAKED_TO 7874 2.70 4.26 2.10 84 HTML_IMAGE_RATIO_04 7764 4.27 4.20 4.30 85 DKIM_INVALID 7691 3.72 4.17 3.55 86 SpammyFromTLD_01 7654 1.94 4.14 1.08 87 T_XMDrugObfuBody_08 7636 2.56 4.14 1.94 88 XM_SPF_SoftFail 7438 2.42 4.03 1.79 89 SpammyFromTLD_02 7034 1.23 3.81 0.22 90 XM_OfRef7 6572 1.13 3.56 0.18 91 RELAYCOUNTRY_FR 6487 1.18 3.51 0.27 92 XMNumbers 6375 3.66 3.45 3.75 93 SUBJ_ALL_CAPS 6319 2.16 3.42 1.67 94 HTML_IMAGE_RATIO_08 6187 2.50 3.35 2.16 95 URI_HEX 6162 1.95 3.34 1.41 96 XM_B_Phish66 6150 2.26 3.33 1.84 97 HTML_IMAGE_ONLY_08 6114 1.02 3.31 0.13 98 XMStrtUSub 6054 4.02 3.28 4.31 99 SHORT_URI_3 5968 0.94 3.23 0.04 100 TR_LOTS_OF_MONEY3 5908 1.47 3.20 0.79 101 XM_DIRTYINTL 5904 1.25 3.20 0.50 102 SHORT_SHORTNER 5894 0.90 3.19 0.01 103 INVALID_DATE 5832 0.92 3.16 0.05 104 SHORTENED_URL_SRC 5687 0.86 3.08 0.00 105 SHORTENER_SHORT_IMG 5682 0.86 3.08 0.00 106 SHORTENED_URL_HREF 5649 1.04 3.06 0.25 107 URI_PHP_REDIR 5522 0.84 2.99 0.01 108 TM2_M_URI_OPT_OUT 5364 2.63 2.90 2.52 109 HTML_IMAGE_RATIO_06 5018 3.31 2.72 3.54 110 TR_XM_DK_SendGrid 4992 3.88 2.70 4.34 111 LH_URI_DOM_IN_PATH 4851 2.21 2.63 2.05 112 BAYES_40 4847 4.21 2.62 4.83 113 URI_TRY_3LD 4811 1.55 2.61 1.15 114 XM_UB99 4767 0.73 2.58 0.00 115 XMDiploma_00 4714 2.19 2.55 2.05 116 XMSexyCombo_01 4667 1.17 2.53 0.64 117 RCVD_IN_RP_SAFE 4667 6.77 2.53 8.42 118 T_TooManySym_01 4649 4.47 2.52 5.22 119 FILL_THIS_FORM 4520 0.86 2.45 0.24 120 FROM_EXCESS_BASE64 4357 2.28 2.36 2.26 121 MIME_HTML_ONLY_MULTI 4314 1.97 2.34 1.83 122 BOTNET_NORDNS 4257 0.66 2.31 0.01 123 XM_URI_RBL 4221 0.76 2.29 0.16 124 ADVANCE_FEE_2_NEW_FORM 4194 0.65 2.27 0.02 125 XM_CamelCaseFrm001 4015 1.82 2.17 1.68 126 RCVD_IN_RP_CERTIFIED 3968 6.28 2.15 7.89 127 XM_UB60 3948 0.66 2.14 0.08 128 XM_B_SpammyWords4 3909 1.07 2.12 0.66 129 TR_XM_MaxBayes 3866 0.60 2.09 0.02 130 MIME_QP_LONG_LINE 3737 4.44 2.02 5.39 131 TR_XM_MaxSPIKE 3730 0.58 2.02 0.02 132 T_XMHurry_00 3688 1.20 2.00 0.88 133 FORM_FRAUD 3659 0.56 1.98 0.01 134 XM_UB999 3579 0.54 1.94 0.00 135 TM2_M_VERY_LONG_WORD 3545 1.52 1.92 1.37 136 XM_B_Unsub2 3524 2.75 1.91 3.07 137 TR_XM_SB_Phish 3484 1.97 1.89 2.00 138 TR_Symld_Words 3454 2.00 1.87 2.04 139 XMBdyGiftCard01 3450 0.88 1.87 0.49 140 TR_XM_COVIDMETA1 3436 0.76 1.86 0.33 141 BAYES_20 3354 3.04 1.82 3.51 142 T_FILL_THIS_FORM_SHORT 3335 1.19 1.81 0.96 143 TR_XM_UnparsRelay 3303 0.85 1.79 0.49 144 HTML_IMAGE_ONLY_12 3260 0.71 1.77 0.30 145 RELAYCOUNTRY_IN 3250 0.61 1.76 0.16 146 MISSING_HEADERS 3249 0.89 1.76 0.55 147 XMSubPhish11 3232 1.89 1.75 1.94 148 TR_XM_PHPDW 3214 0.82 1.74 0.47 149 T_XMDrugObfuBody_14 3214 1.71 1.74 1.70 150 TR_XM_PHPForged 3192 0.81 1.73 0.45 151 XMMoneyMeta_00 3182 0.85 1.72 0.51 152 TR_XM_FormFill2 3157 0.80 1.71 0.45 153 XM_H_PHPOS 3152 0.80 1.71 0.44 154 XMHTML_After_End 3023 1.05 1.64 0.82 155 T_XMDrugObfuBody_00 3006 1.01 1.63 0.77 156 BAYES_00 2947 9.73 1.60 12.90 157 T_PDS_OTHER_BAD_TLD 2863 0.78 1.55 0.48 158 ADVANCE_FEE_3_NEW_MONEY 2851 0.44 1.54 0.00 159 REPLYTO_WITHOUT_TO_CC 2814 0.49 1.52 0.08 160 ALL_TRUSTED 2806 11.49 1.52 15.37 161 XMStockSpam_06 2754 2.94 1.49 3.50 162 RELAYCOUNTRY_DE 2745 0.75 1.49 0.46 163 HTML_FONT_SIZE_LARGE 2702 0.49 1.46 0.12 164 RCVD_IN_IADB_LISTED 2614 4.14 1.42 5.20 165 TR_XM_INV_DKIM 2542 0.43 1.38 0.07 166 XMGenDplmaNmb 2541 1.11 1.38 1.01 167 FROM_SUSPICIOUS_NTLD 2536 0.44 1.37 0.08 168 HTML_MIME_NO_HTML_TAG 2533 2.16 1.37 2.46 169 XM_UB80 2503 0.40 1.36 0.02 170 T_FILL_THIS_FORM_LONG 2495 0.45 1.35 0.10 171 FROM_SUSPICIOUS_NTLD_FP 2397 0.42 1.30 0.07 172 XMSubNoVowel 2379 0.57 1.29 0.30 173 TR_Caps_n_Bayes_99 2347 0.40 1.27 0.07 174 TR_XM_RelayPhish 2285 0.45 1.24 0.15 175 RELAYCOUNTRY_GB 2268 1.12 1.23 1.07 176 RDNS_DYNAMIC 2212 0.73 1.20 0.55 177 RCVD_IN_IADB_SPF 2201 3.59 1.19 4.52 178 TR_Sbj_FN_Bdy 2182 0.50 1.18 0.24 179 TR_Mismatch_TLD_02 2125 0.38 1.15 0.08 180 RCVD_IN_IADB_SENDERID 2056 3.23 1.11 4.05 181 RCVD_IN_IADB_DK 2050 3.11 1.11 3.89 182 XM_H_Long_From02 1968 1.09 1.07 1.09 183 XM_PDF 1956 3.96 1.06 5.09 184 RELAYCOUNTRY_NL 1942 0.62 1.05 0.45 185 XMBody_78 1887 0.69 1.02 0.56 186 XMSubMetaSxObfu_03 1883 0.61 1.02 0.45 187 MAILING_LIST_MULTI 1881 2.30 1.02 2.80 188 TR_MetaPhish_Combo_01 1870 0.77 1.01 0.67 189 URI_NOVOWEL 1866 2.03 1.01 2.43 190 MIME_CHARSET_FARAWAY 1829 0.39 0.99 0.16 191 XMSexyCombo_04 1817 0.39 0.98 0.16 192 URI_NO_WWW_BIZ_CGI 1810 0.28 0.98 0.01 193 XMSlimDrugH 1791 0.52 0.97 0.34 194 T_TooManySym_02 1790 2.18 0.97 2.65 195 XM_ProductURIs 1781 0.95 0.96 0.95 196 BAYES_05 1781 1.87 0.96 2.22 197 DKIM_ADSP_CUSTOM_MED 1756 1.12 0.95 1.19 198 FILL_THIS_FORM_LONG 1755 0.30 0.95 0.05 199 REMOVE_BEFORE_LINK 1698 0.44 0.92 0.26 200 PDS_FROM_2_EMAILS 1683 0.31 0.91 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 421979 87.93 85.54 88.86 2 RELAYCOUNTRY_US 383320 79.49 76.34 80.72 3 DKIM_SIGNED 364637 76.23 74.79 76.78 4 XM_DK_Pass 359422 74.87 72.79 75.69 5 DKIM_VALID 347775 72.50 70.63 73.23 6 XM_B_Unicode 325778 70.74 76.26 68.60 7 DCC_CHECK_NEGATIVE 286115 50.97 27.09 60.25 8 BAYES_50 272613 53.40 43.09 57.41 9 DKIM_VALID_AU 260519 55.06 55.59 54.86 10 XM_B_SpammyWords 239231 55.72 69.45 50.38 11 XMListUnsubscribeExists 233732 53.01 62.77 49.22 12 XM_B_Unicode3 182482 37.61 35.51 38.43 13 DCC_CHECK 178773 47.03 71.18 37.65 14 T_TM2_M_HEADER_IN_MSG 156604 30.21 23.09 32.98 15 DKIM_VALID_EF 144021 29.58 27.66 30.33 16 RCVD_IN_MSPIKE_WL 135715 24.65 14.56 28.58 17 HTML_FONT_LOW_CONTRAST 128233 28.13 31.04 27.00 18 RCVD_IN_MSPIKE_H2 127294 26.80 26.78 26.81 19 XM_B_SpammyWords2 115966 28.32 38.37 24.42 20 LOC_TINY_FONT_1 111905 25.67 31.08 23.56 21 FVGT_m_MULTI_ODD 107294 23.09 24.37 22.59 22 XMSubLong 100445 21.62 22.83 21.15 23 MIME_HTML_ONLY 93945 22.02 27.78 19.78 24 T_KAM_HTML_FONT_INVALID 86087 19.98 24.75 18.13 25 RCVD_IN_MSPIKE_H3 76630 13.83 7.91 16.14 26 ALL_TRUSTED 72974 11.49 1.52 15.37 27 XM_Body_Dirty_Words 63276 15.26 20.22 13.32 28 BAYES_00 61259 9.73 1.60 12.90 29 XM_B_Unsub 52506 10.83 10.23 11.06 30 XM_Multi_Part_URI 51955 13.71 20.83 10.94 31 RCVD_IN_MSPIKE_H4 48752 9.08 6.03 10.27 32 TR_XM_DK_Bayes 45826 7.12 0.63 9.65 33 TR_XM_DK_Bayes1 44328 6.89 0.61 9.33 34 TooManyTo_001 43048 8.07 5.52 9.06 35 LOTS_OF_MONEY 41557 11.81 19.67 8.75 36 RCVD_IN_RP_SAFE 39982 6.77 2.53 8.42 37 XM_DK_Undo_02 39567 16.73 38.32 8.33 38 TR_XM_DK_Bayes2 39152 6.08 0.51 8.24 39 XM_Evil_Numbers_Gen 38805 8.29 8.59 8.17 40 LotsOfNums_01 38604 8.42 9.16 8.13 41 XM_DKIMWhitelistDomains 37659 5.71 0.01 7.93 42 RCVD_IN_RP_CERTIFIED 37478 6.28 2.15 7.89 43 UNPARSEABLE_RELAY 36397 6.99 5.26 7.66 44 IN_ZIMBRA_NJ_WHITELIST 35407 5.38 0.05 7.46 45 XM_SendGrid 33858 6.42 4.61 7.13 46 BAYES_60 33454 7.12 7.31 7.04 47 HTML_IMAGE_RATIO_02 31155 6.54 6.48 6.56 48 XM_B_Phish_Phrases 30402 8.02 12.18 6.40 49 XM_H_Long_From01 27141 5.50 4.96 5.72 50 XM_B_SpammyWords3 26428 7.37 12.03 5.57 51 RELAYCOUNTRY_META 25817 9.59 20.28 5.44 52 BAYES_99 25673 12.31 30.08 5.41 53 MIME_QP_LONG_LINE 25577 4.44 2.02 5.39 54 T_TooManySym_01 24807 4.47 2.52 5.22 55 RCVD_IN_IADB_LISTED 24695 4.14 1.42 5.20 56 XM_PDF 24162 3.96 1.06 5.09 57 FSL_BULK_SIG 23983 7.41 13.48 5.05 58 BAYES_40 22952 4.21 2.62 4.83 59 BOTNET_IPINHOSTNAME 21717 6.61 11.83 4.57 60 RCVD_IN_IADB_SPF 21479 3.59 1.19 4.52 61 BAYES_999 21038 9.65 23.09 4.43 62 TR_XM_DK_SendGrid 20596 3.88 2.70 4.34 63 XMStrtUSub 20463 4.02 3.28 4.31 64 HTML_IMAGE_RATIO_04 20426 4.27 4.20 4.30 65 BAYES_80 19454 5.12 7.76 4.10 66 RCVD_IN_IADB_SENDERID 19218 3.23 1.11 4.05 67 XMSexyCombo_05 19119 5.57 9.55 4.03 68 RCVD_IN_IADB_DK 18477 3.11 1.11 3.89 69 XMNumbers 17792 3.66 3.45 3.75 70 T_REMOTE_IMAGE 17772 4.42 6.17 3.74 71 MPART_ALT_DIFF 17187 4.91 8.24 3.62 72 DKIM_INVALID 16862 3.72 4.17 3.55 73 HTML_IMAGE_RATIO_06 16809 3.31 2.72 3.54 74 XM_UncommonTLD01 16756 5.46 10.44 3.53 75 BAYES_20 16681 3.04 1.82 3.51 76 XMStockSpam_06 16635 2.94 1.49 3.50 77 XMSubMetaSx_00 16194 4.44 7.09 3.41 78 RCVD_IN_IADB_VOUCHED 15429 2.53 0.70 3.25 79 XM_B_Unsub2 14591 2.75 1.91 3.07 80 TR_XM_PhishingBody 13917 3.66 5.52 2.93 81 TR_DCC_Bayes_99 13466 8.47 22.97 2.84 82 MAILING_LIST_MULTI 13291 2.30 1.02 2.80 83 T_TooManySym_02 12586 2.18 0.97 2.65 84 BAYES_95 12229 3.16 4.68 2.58 85 TooManyTo_002 11993 2.00 0.64 2.53 86 TM2_M_URI_OPT_OUT 11970 2.63 2.90 2.52 87 HTML_MIME_NO_HTML_TAG 11698 2.16 1.37 2.46 88 URI_NOVOWEL 11554 2.03 1.01 2.43 89 ANY_BOUNCE_MESSAGE 11165 4.24 9.09 2.35 90 BOUNCE_MESSAGE 11164 4.24 9.09 2.35 91 FROM_EXCESS_BASE64 10709 2.28 2.36 2.26 92 BAYES_05 10555 1.87 0.96 2.22 93 UNTRUSTED_Relay 10516 6.27 16.70 2.21 94 MIME_HTML_MOSTLY 10361 3.25 6.00 2.18 95 RCVD_IN_MSPIKE_H5 10333 1.74 0.62 2.18 96 HTML_IMAGE_RATIO_08 10273 2.50 3.35 2.16 97 RCVD_IN_IADB_OPTIN 10042 1.64 0.43 2.11 98 T_FONT_INVIS_NAKED_TO 9960 2.70 4.26 2.10 99 LH_URI_DOM_IN_PATH 9717 2.21 2.63 2.05 100 XMDiploma_00 9712 2.19 2.55 2.05 101 TR_Symld_Words 9709 2.00 1.87 2.04 102 TR_XM_SB_Phish 9509 1.97 1.89 2.00 103 XM_DK_Undo_01 9277 1.66 0.90 1.95 104 XMSubPhish11 9231 1.89 1.75 1.94 105 T_XMDrugObfuBody_08 9230 2.56 4.14 1.94 106 XM_B_SpammyTLD 8929 2.73 4.92 1.88 107 XM_B_Phish66 8748 2.26 3.33 1.84 108 BOTNET 8716 7.91 23.53 1.84 109 MIME_HTML_ONLY_MULTI 8704 1.97 2.34 1.83 110 XM_SPF_SoftFail 8506 2.42 4.03 1.79 111 KHOP_HELO_FCRDNS 8324 2.78 5.41 1.75 112 HELO_NODOT 8277 1.50 0.87 1.74 113 HELO_NO_DOMAIN 8276 1.50 0.87 1.74 114 TooManyTo_003 8264 1.39 0.47 1.74 115 T_XMDrugObfuBody_14 8083 1.71 1.74 1.70 116 XM_CamelCaseFrm001 7972 1.82 2.17 1.68 117 SUBJ_ALL_CAPS 7953 2.16 3.42 1.67 118 TVD_RCVD_IP 7659 1.28 0.43 1.61 119 IN_HORDE_ADDRESS_BOOK 7499 1.19 0.18 1.58 120 INVALID_MSGID 7449 1.23 0.35 1.57 121 RELAYCOUNTRY_CA 7323 2.56 5.18 1.54 122 USER_IN_DEF_DKIM_WL 6969 1.06 0.01 1.47 123 XMCapTrack 6787 1.22 0.66 1.43 124 XM_OfRef6 6724 2.84 6.50 1.42 125 URI_HEX 6716 1.95 3.34 1.41 126 TO_MALFORMED 6503 0.99 0.01 1.37 127 TM2_M_VERY_LONG_WORD 6486 1.52 1.92 1.37 128 TooManyTo_004 6112 1.04 0.41 1.29 129 HELO_MISC_IP 6011 1.01 0.37 1.27 130 CK_HELO_DYNAMIC_SPLIT_IP 5979 1.07 0.57 1.26 131 XMGappySubj_01 5959 0.93 0.11 1.25 132 TR_XM_SpammyWords2 5920 4.47 12.75 1.25 133 XM_GoogleGroups 5778 0.99 0.42 1.22 134 DKIM_ADSP_CUSTOM_MED 5650 1.12 0.95 1.19 135 XM_B_COVIDMETA 5606 2.27 5.07 1.18 136 T_TooManySym_03 5603 0.90 0.18 1.18 137 URI_TRY_3LD 5439 1.55 2.61 1.15 138 RCVD_IN_BL_SPAMCOP_NET 5364 2.51 6.05 1.13 139 XM_UB50 5315 2.85 7.29 1.12 140 XMBSHREFv2 5258 0.89 0.33 1.11 141 XM_H_Long_From02 5193 1.09 1.07 1.09 142 SpammyFromTLD_01 5132 1.94 4.14 1.08 143 RELAYCOUNTRY_GB 5101 1.12 1.23 1.07 144 XMGenDplmaNmb 4791 1.11 1.38 1.01 145 TooManyTo_005 4765 0.82 0.34 1.00 146 T_FILL_THIS_FORM_SHORT 4545 1.19 1.81 0.96 147 XMBrknScrpt_02 4516 2.22 5.47 0.95 148 XM_ProductURIs 4516 0.95 0.96 0.95 149 XMBody_17 4362 2.26 5.71 0.92 150 XMNoVowels 4257 0.76 0.42 0.90 151 TR_MSPIKEBAYES00 4242 0.64 0.00 0.89 152 T_XMHurry_00 4195 1.20 2.00 0.88 153 NML_ADSP_CUSTOM_MED 4070 0.85 0.83 0.86 154 HTTPS_HTTP_MISMATCH 3984 0.83 0.81 0.84 155 T_OBFU_PDF_ATTACH 3971 0.65 0.17 0.84 156 XMHTML_After_End 3893 1.05 1.64 0.82 157 XM_SPF_Unknown 3811 0.79 0.75 0.80 158 TR_LOTS_OF_MONEY3 3756 1.47 3.20 0.79 159 T_XMDrugObfuBody_00 3655 1.01 1.63 0.77 160 XMBody_95 3524 0.55 0.05 0.74 161 XMSubMetaI_00 3501 0.72 0.66 0.74 162 XM_ShortIntro_01 3476 0.71 0.66 0.73 163 RCVD_IN_MSPIKE_BL 3336 5.44 17.63 0.70 164 T_Symld_Words_02 3230 0.69 0.71 0.68 165 TR_MetaPhish_Combo_01 3182 0.77 1.01 0.67 166 XMHTMLBadTable_001 3163 0.68 0.71 0.67 167 XM_B_SpammyWords4 3157 1.07 2.12 0.66 168 HTML_FONT_FACE_BAD 3086 0.63 0.58 0.65 169 XM_B_REG_HTML 3075 0.65 0.67 0.65 170 DKIM_ADSP_NXDOMAIN 3051 0.64 0.62 0.64 171 XMSexyCombo_01 3036 1.17 2.53 0.64 172 T_MONEY_PERCENT 2891 0.63 0.68 0.61 173 TR_LOTS_OF_MONEY2 2891 0.63 0.68 0.61 174 NO_DNS_FOR_FROM 2871 0.65 0.76 0.60 175 T_TooManySym_04 2800 0.44 0.06 0.59 176 XM_H_PHPMailer 2757 0.58 0.56 0.58 177 XM_RXBody 2739 0.50 0.30 0.58 178 XMBody_78 2671 0.69 1.02 0.56 179 FORGED_GMAIL_RCVD 2644 0.65 0.88 0.56 180 MISSING_HEADERS 2616 0.89 1.76 0.55 181 RDNS_DYNAMIC 2589 0.73 1.20 0.55 182 FROM_GOV_DKIM_AU 2483 0.39 0.05 0.52 183 HTML_TAG_BALANCE_BODY 2445 0.54 0.60 0.51 184 XMMoneyMeta_00 2403 0.85 1.72 0.51 185 XMSolicitRefs_0 2384 0.44 0.26 0.50 186 XMLngstWrd_00 2378 0.45 0.30 0.50 187 NUMERIC_HTTP_ADDR 2371 0.53 0.62 0.50 188 XM_DIRTYINTL 2352 1.25 3.20 0.50 189 XMBdyGiftCard01 2347 0.88 1.87 0.49 190 TR_XM_UnparsRelay 2313 0.85 1.79 0.49 191 RCVD_IN_SORBS_DUL 2299 0.44 0.31 0.48 192 T_PDS_OTHER_BAD_TLD 2288 0.78 1.55 0.48 193 SHORT_HELO_AND_INLINE_IMAGE 2271 0.36 0.07 0.48 194 XM_S_SubURI 2263 0.35 0.03 0.48 195 TM2_M_BODY_EMPTY 2229 0.36 0.07 0.47 196 TR_XM_PHPDW 2213 0.82 1.74 0.47 197 TR_BOTNET_NEGATE 2202 0.56 0.82 0.46 198 HTML_IMAGE_ONLY_32 2185 0.37 0.15 0.46 199 RELAYCOUNTRY_DE 2172 0.75 1.49 0.46 200 SENDGRID_REDIR 2154 0.53 0.74 0.45 ----------------------------------------------------------------------