Email: 717386 Autolearn: 0 AvgScore: 3.72 AvgScanTime: 1.19 sec Spam: 205245 Autolearn: 0 AvgScore: 14.04 AvgScanTime: 1.30 sec Ham: 512141 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 1.15 sec Time Spent Running SA: 237.76 hours Time Spent Processing Spam: 73.97 hours Time Spent Processing Ham: 163.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 194684 90.76 94.85 89.12 2 DCC_CHECK 161642 51.14 78.76 40.07 3 XM_B_Unicode 157279 72.94 76.63 71.46 4 DKIM_SIGNED 155277 76.96 75.65 77.48 5 XM_DK_Pass 151200 75.59 73.67 76.36 6 DKIM_VALID 147573 73.60 71.90 74.28 7 RELAYCOUNTRY_US 147106 80.33 71.67 83.79 8 XM_B_SpammyWords 137301 54.17 66.90 49.07 9 XMListUnsubscribeExists 132708 55.13 64.66 51.31 10 DKIM_VALID_AU 114131 54.92 55.61 54.64 11 XM_DK_Undo_02 87010 18.03 42.39 8.27 12 XM_B_Unicode3 76786 39.35 37.41 40.13 13 HTML_FONT_LOW_CONTRAST 76571 29.90 37.31 26.93 14 BAYES_99 74291 14.04 36.20 5.16 15 XM_B_SpammyWords2 73370 25.70 35.75 21.68 16 MIME_HTML_ONLY 69184 23.62 33.71 19.57 17 LOC_TINY_FONT_1 68306 26.17 33.28 23.31 18 BAYES_50 66844 49.10 32.57 55.73 19 RCVD_IN_MSPIKE_H2 61072 27.87 29.76 27.11 20 BAYES_999 57576 10.95 28.05 4.10 21 TR_DCC_Bayes_99 57528 9.85 28.03 2.56 22 DKIM_VALID_EF 54765 29.04 26.68 29.98 23 FVGT_m_MULTI_ODD 52538 23.95 25.60 23.29 24 RELAYCOUNTRY_META 48915 10.89 23.83 5.70 25 T_TM2_M_HEADER_IN_MSG 47575 28.16 23.18 30.16 26 XMSubLong 43133 21.61 21.02 21.85 27 T_KAM_HTML_FONT_INVALID 42518 19.40 20.72 18.88 28 XM_Multi_Part_URI 40293 13.92 19.63 11.64 29 DCC_CHECK_NEGATIVE 39796 46.80 19.39 57.79 30 FSL_BULK_SIG 39160 9.67 19.08 5.89 31 BOTNET 37393 6.60 18.22 1.95 32 XM_B_Unsub 37143 13.23 18.10 11.28 33 UNTRUSTED_Relay 33064 6.23 16.11 2.28 34 RCVD_IN_MSPIKE_WL 32967 24.98 16.06 28.55 35 XM_Body_Dirty_Words 30970 13.05 15.09 12.23 36 XM_UncommonTLD01 28074 6.31 13.68 3.35 37 TR_XM_SpammyWords2 26967 4.71 13.14 1.33 38 LOTS_OF_MONEY 26537 9.34 12.93 7.90 39 BOTNET_IPINHOSTNAME 25428 6.68 12.39 4.39 40 BAYES_80 21995 6.24 10.72 4.45 41 LotsOfNums_01 21814 9.62 10.63 9.22 42 XM_B_SpammyWords3 21672 6.81 10.56 5.30 43 TooManyTo_001 21498 9.21 10.47 8.70 44 XMBrknScrpt_02 19686 3.65 9.59 1.27 45 RCVD_IN_BL_SPAMCOP_NET 18745 3.70 9.13 1.52 46 XMSexyCombo_05 18515 5.14 9.02 3.58 47 RCVD_IN_MSPIKE_BL 18117 3.17 8.83 0.90 48 RCVD_IN_MSPIKE_H3 17383 13.57 8.47 15.61 49 XM_B_Phish_Phrases 17334 7.28 8.45 6.81 50 XM_Evil_Numbers_Gen 16534 8.13 8.06 8.16 51 HTML_MIME_NO_HTML_TAG 15132 3.53 7.37 1.99 52 TR_XM_DKIM_Undo 14909 2.72 7.26 0.90 53 HTML_IMAGE_RATIO_02 14782 6.67 7.20 6.45 54 BAYES_60 14284 7.39 6.96 7.56 55 HTML_SHORT_LINK_IMG_1 14185 1.99 6.91 0.02 56 BOTNET_NORDNS 14127 1.98 6.88 0.02 57 RCVD_IN_MSPIKE_H4 14071 9.53 6.86 10.61 58 XM_UB50 13569 2.78 6.61 1.24 59 XMSubMetaSx_00 13377 4.52 6.52 3.72 60 MPART_ALT_DIFF 13128 4.97 6.40 4.40 61 RELAYCOUNTRY_CA 12858 2.98 6.26 1.66 62 SpammyFromTLD_02 12739 2.02 6.21 0.35 63 XMDiploma_00 12559 2.98 6.12 1.72 64 UNPARSEABLE_RELAY 12320 7.69 6.00 8.37 65 TR_XM_PhishingBody 12197 4.00 5.94 3.22 66 BAYES_95 11688 3.60 5.69 2.76 67 HDRS_MISSP 11448 1.64 5.58 0.07 68 T_REMOTE_IMAGE 10537 3.99 5.13 3.53 69 TR_XM_SpammyWords3 10274 1.73 5.01 0.42 70 RCVD_IN_RP_RNBL 10238 1.69 4.99 0.36 71 MIME_HTML_MOSTLY 10135 2.93 4.94 2.12 72 DKIM_ADSP_NXDOMAIN 10128 1.81 4.93 0.55 73 HTML_IMAGE_ONLY_08 10085 1.49 4.91 0.12 74 XM_SendGrid 10018 6.89 4.88 7.70 75 XM_Combo_Sbj 9969 1.57 4.86 0.26 76 XM_H_Long_From01 9914 5.38 4.83 5.59 77 KHOP_HELO_FCRDNS 9761 2.51 4.76 1.61 78 T_FONT_INVIS_NAKED_TO 9609 2.70 4.68 1.91 79 XMGenDplmaNmb 9564 2.02 4.66 0.96 80 HTML_IMAGE_RATIO_04 9248 4.74 4.51 4.84 81 SpammyFromTLD_01 9025 2.00 4.40 1.04 82 ALL_TRUSTED 9000 9.88 4.39 12.08 83 URI_NOVOWEL 8895 3.15 4.33 2.67 84 HTML_IMAGE_RATIO_08 8812 3.07 4.29 2.58 85 INVALID_DATE 8766 1.24 4.27 0.03 86 XM_SPF_SoftFail 8763 2.39 4.27 1.64 87 HDRS_LCASE_IMGONLY 8517 1.20 4.15 0.02 88 BOGUS_MIME_VERSION 8483 1.18 4.13 0.00 89 RCVD_DOTEDU_SHORT 8452 1.19 4.12 0.02 90 XM_OfRef6 8375 2.05 4.08 1.24 91 RCVD_IN_MSPIKE_L3 8089 1.45 3.94 0.45 92 RCVD_IN_MSPIKE_L5 7887 1.26 3.84 0.22 93 DKIM_INVALID 7704 3.36 3.75 3.20 94 XMBody_17 7578 1.62 3.69 0.79 95 BAYES_40 7523 4.36 3.67 4.64 96 TR_LOTS_OF_MONEY3 7496 1.63 3.65 0.82 97 HTML_IMAGE_RATIO_06 7453 4.20 3.63 4.42 98 XM_BadFromFormat 7383 1.15 3.60 0.16 99 T_XMDrugObfuBody_08 7228 2.26 3.52 1.76 100 XMOemUri 7203 1.28 3.51 0.39 101 URIBL_SBL_A 7199 1.19 3.51 0.27 102 XMNumbers 7179 3.42 3.50 3.38 103 TM2_M_OBFU_COMMENT 7061 1.01 3.44 0.03 104 XM_UB99 6956 0.98 3.39 0.02 105 TR_Mismatch_TLD_02 6937 1.03 3.38 0.09 106 URI_TRY_3LD 6820 1.73 3.32 1.09 107 XMStrtUSub 6816 4.28 3.32 4.66 108 TM2_M_URI_OPT_OUT 6779 3.17 3.30 3.12 109 XM_B_COVIDMETA 6733 1.74 3.28 1.12 110 RCVD_IN_PSBL 6688 0.94 3.26 0.01 111 XM_B_SpammyTLD 6558 2.29 3.20 1.93 112 XM_B_Phish66 6487 2.33 3.16 2.00 113 TR_XM_DK_SendGrid 5966 4.14 2.91 4.63 114 URI_HEX 5874 1.75 2.86 1.30 115 BODY_URI_ONLY 5862 0.84 2.86 0.03 116 SUBJ_ALL_CAPS 5849 2.18 2.85 1.92 117 T_TooManySym_01 5744 4.71 2.80 5.48 118 TM2_M_VERY_LONG_WORD 5733 1.66 2.79 1.20 119 T_PDS_OTHER_BAD_TLD 5386 1.10 2.62 0.49 120 FROM_EXCESS_BASE64 5329 2.50 2.60 2.46 121 XM_DIRTYINTL 5233 1.11 2.55 0.54 122 TR_XM_UnparsRelay 5115 0.96 2.49 0.35 123 TR_XM_MaxBayes 4949 0.71 2.41 0.03 124 MIME_QP_LONG_LINE 4926 5.10 2.40 6.18 125 XM_UB999 4873 0.69 2.37 0.02 126 T_XMDrugObfuBody_00 4860 1.21 2.37 0.75 127 RELAYCOUNTRY_FR 4850 0.87 2.36 0.28 128 HTML_IMAGE_ONLY_12 4839 0.84 2.36 0.23 129 TR_XM_MaxSPIKE 4821 0.68 2.35 0.02 130 XM_B_SpammyWords4 4821 1.13 2.35 0.63 131 LH_URI_DOM_IN_PATH 4753 2.26 2.32 2.24 132 RCVD_IN_RP_SAFE 4613 5.65 2.25 7.01 133 MIME_HTML_ONLY_MULTI 4590 2.66 2.24 2.83 134 LOCALPART_IN_SUBJECT 4577 0.65 2.23 0.02 135 TO_NAME_SUBJ_NO_RDNS 4537 0.63 2.21 0.00 136 XM_CamelCaseFrm001 4472 1.86 2.18 1.74 137 BAYES_20 4439 3.11 2.16 3.49 138 RELAYCOUNTRY_UA 4436 0.62 2.16 0.00 139 DIET_1 4318 0.96 2.10 0.51 140 FROM_SUSPICIOUS_NTLD 4142 0.64 2.02 0.09 141 HK_RANDOM_REPLYTO 4120 0.70 2.01 0.18 142 T_XMHurry_00 4017 1.12 1.96 0.79 143 FROM_SUSPICIOUS_NTLD_FP 4000 0.62 1.95 0.08 144 XM_B_Unsub2 3866 2.54 1.88 2.81 145 XM_UB60 3862 0.62 1.88 0.11 146 RELAYCOUNTRY_GB 3797 1.17 1.85 0.89 147 XMStockSpam_06 3570 1.36 1.74 1.20 148 TR_XM_SB_Phish 3528 2.07 1.72 2.21 149 TR_XM_COVIDMETA4 3488 0.76 1.70 0.38 150 XM_URI_RBL 3422 0.59 1.67 0.16 151 TR_Symld_Words 3390 1.75 1.65 1.80 152 RCVD_IN_IADB_LISTED 3377 4.64 1.65 5.84 153 XMSexyCombo_01 3321 0.95 1.62 0.68 154 XMSubPhish11 3294 2.00 1.60 2.16 155 RCVD_IN_RP_CERTIFIED 3259 4.92 1.59 6.25 156 T_XMDrugObfuBody_14 3211 1.60 1.56 1.61 157 XM_OfRef7 3193 0.58 1.56 0.19 158 DATE_IN_PAST_03_06 3121 0.50 1.52 0.08 159 DATE_IN_PAST_06_12 3085 0.66 1.50 0.32 160 XMHTML_After_End 3000 1.06 1.46 0.91 161 T_Symld_Words_02 2988 0.87 1.46 0.63 162 MAILING_LIST_MULTI 2987 2.65 1.46 3.13 163 TR_XM_PHPDW 2984 0.65 1.45 0.32 164 T_FILL_THIS_FORM_SHORT 2979 1.12 1.45 0.98 165 TR_XM_PHPForged 2963 0.63 1.44 0.30 166 RCVD_IN_IADB_SPF 2947 4.04 1.44 5.09 167 TR_XM_FormFill2 2931 0.63 1.43 0.30 168 XM_H_PHPOS 2925 0.62 1.43 0.30 169 XM_UB80 2814 0.41 1.37 0.03 170 TR_XM_COVIDMETA1 2772 0.56 1.35 0.25 171 RCVD_IN_IADB_DK 2742 3.53 1.34 4.41 172 RCVD_IN_IADB_SENDERID 2737 3.63 1.33 4.56 173 TR_Caps_n_Bayes_99 2623 0.53 1.28 0.23 174 RELAYCOUNTRY_NL 2560 0.86 1.25 0.71 175 TR_XM_INV_DKIM 2514 0.43 1.22 0.11 176 XMSubNoVowel 2495 1.00 1.22 0.91 177 FVGT_m_MULTI_ODD_EMAIL 2482 0.37 1.21 0.04 178 MIME_CHARSET_FARAWAY 2470 0.43 1.20 0.12 179 XM_UB95 2453 0.35 1.20 0.01 180 TR_XM_RelayPhish 2425 0.42 1.18 0.11 181 XMPhish30 2409 0.69 1.17 0.50 182 DKIM_ADSP_CUSTOM_MED 2352 1.24 1.15 1.28 183 LongTLD 2323 0.48 1.13 0.22 184 XMPhish08 2314 0.57 1.13 0.34 185 RDNS_DYNAMIC 2309 0.67 1.12 0.49 186 TR_Mismatch_TLD_01 2305 0.51 1.12 0.26 187 XMBdyGiftCard01 2268 0.63 1.11 0.44 188 XMGppyBdWords 2214 0.39 1.08 0.12 189 XMSubMetaSSx_00 2208 0.42 1.08 0.15 190 XM_DK_Undo_01 2193 1.71 1.07 1.97 191 XMBody_78 2168 0.56 1.06 0.36 192 NML_ADSP_CUSTOM_MED 2151 0.94 1.05 0.89 193 BAYES_00 2139 10.25 1.04 13.94 194 RELAYCOUNTRY_KR 2123 0.31 1.03 0.01 195 XMSubMetaSxObfu_03 2072 0.65 1.01 0.50 196 NUMERIC_HTTP_ADDR 2064 0.61 1.01 0.46 197 CHARSET_FARAWAY_HEADER 2058 0.32 1.00 0.04 198 RELAYCOUNTRY_DE 2053 0.64 1.00 0.50 199 REMOVE_BEFORE_LINK 2042 0.48 0.99 0.27 200 MPART_ALT_DIFF_COUNT 2040 0.63 0.99 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 456437 90.76 94.85 89.12 2 RELAYCOUNTRY_US 429136 80.33 71.67 83.79 3 DKIM_SIGNED 396796 76.96 75.65 77.48 4 XM_DK_Pass 391076 75.59 73.67 76.36 5 DKIM_VALID 380413 73.60 71.90 74.28 6 XM_B_Unicode 365980 72.94 76.63 71.46 7 DCC_CHECK_NEGATIVE 295960 46.80 19.39 57.79 8 BAYES_50 285425 49.10 32.57 55.73 9 DKIM_VALID_AU 279844 54.92 55.61 54.64 10 XMListUnsubscribeExists 262788 55.13 64.66 51.31 11 XM_B_SpammyWords 251330 54.17 66.90 49.07 12 XM_B_Unicode3 205530 39.35 37.41 40.13 13 DCC_CHECK 205221 51.14 78.76 40.07 14 T_TM2_M_HEADER_IN_MSG 154459 28.16 23.18 30.16 15 DKIM_VALID_EF 153533 29.04 26.68 29.98 16 RCVD_IN_MSPIKE_WL 146214 24.98 16.06 28.55 17 RCVD_IN_MSPIKE_H2 138841 27.87 29.76 27.11 18 HTML_FONT_LOW_CONTRAST 137900 29.90 37.31 26.93 19 LOC_TINY_FONT_1 119405 26.17 33.28 23.31 20 FVGT_m_MULTI_ODD 119300 23.95 25.60 23.29 21 XMSubLong 111888 21.61 21.02 21.85 22 XM_B_SpammyWords2 111030 25.70 35.75 21.68 23 MIME_HTML_ONLY 100228 23.62 33.71 19.57 24 T_KAM_HTML_FONT_INVALID 96689 19.40 20.72 18.88 25 RCVD_IN_MSPIKE_H3 79941 13.57 8.47 15.61 26 BAYES_00 71404 10.25 1.04 13.94 27 XM_Body_Dirty_Words 62615 13.05 15.09 12.23 28 ALL_TRUSTED 61878 9.88 4.39 12.08 29 XM_Multi_Part_URI 59588 13.92 19.63 11.64 30 XM_B_Unsub 57753 13.23 18.10 11.28 31 RCVD_IN_MSPIKE_H4 54317 9.53 6.86 10.61 32 TR_XM_DK_Bayes 48716 6.94 0.51 9.51 33 TR_XM_DK_Bayes1 47375 6.75 0.49 9.25 34 LotsOfNums_01 47220 9.62 10.63 9.22 35 TooManyTo_001 44581 9.21 10.47 8.70 36 UNPARSEABLE_RELAY 42842 7.69 6.00 8.37 37 XM_DK_Undo_02 42346 18.03 42.39 8.27 38 TR_XM_DK_Bayes2 41839 5.95 0.40 8.17 39 XM_Evil_Numbers_Gen 41786 8.13 8.06 8.16 40 LOTS_OF_MONEY 40472 9.34 12.93 7.90 41 XM_SendGrid 39410 6.89 4.88 7.70 42 BAYES_60 38698 7.39 6.96 7.56 43 XM_DKIMWhitelistDomains 37947 5.29 0.01 7.41 44 RCVD_IN_RP_SAFE 35890 5.65 2.25 7.01 45 XM_B_Phish_Phrases 34857 7.28 8.45 6.81 46 IN_ZIMBRA_NJ_WHITELIST 34812 4.87 0.06 6.80 47 HTML_IMAGE_RATIO_02 33042 6.67 7.20 6.45 48 RCVD_IN_RP_CERTIFIED 32005 4.92 1.59 6.25 49 MIME_QP_LONG_LINE 31651 5.10 2.40 6.18 50 FSL_BULK_SIG 30188 9.67 19.08 5.89 51 RCVD_IN_IADB_LISTED 29885 4.64 1.65 5.84 52 RELAYCOUNTRY_META 29186 10.89 23.83 5.70 53 XM_H_Long_From01 28652 5.38 4.83 5.59 54 T_TooManySym_01 28067 4.71 2.80 5.48 55 XM_B_SpammyWords3 27154 6.81 10.56 5.30 56 BAYES_99 26440 14.04 36.20 5.16 57 RCVD_IN_IADB_SPF 26062 4.04 1.44 5.09 58 XM_PDF 25028 3.76 0.95 4.89 59 HTML_IMAGE_RATIO_04 24775 4.74 4.51 4.84 60 XMStrtUSub 23884 4.28 3.32 4.66 61 BAYES_40 23766 4.36 3.67 4.64 62 TR_XM_DK_SendGrid 23712 4.14 2.91 4.63 63 RCVD_IN_IADB_SENDERID 23334 3.63 1.33 4.56 64 BAYES_80 22784 6.24 10.72 4.45 65 HTML_IMAGE_RATIO_06 22655 4.20 3.63 4.42 66 RCVD_IN_IADB_DK 22607 3.53 1.34 4.41 67 MPART_ALT_DIFF 22517 4.97 6.40 4.40 68 BOTNET_IPINHOSTNAME 22471 6.68 12.39 4.39 69 BAYES_999 20992 10.95 28.05 4.10 70 XMSubMetaSx_00 19066 4.52 6.52 3.72 71 XMSexyCombo_05 18325 5.14 9.02 3.58 72 T_REMOTE_IMAGE 18063 3.99 5.13 3.53 73 RCVD_IN_IADB_VOUCHED 17879 2.70 0.73 3.49 74 BAYES_20 17877 3.11 2.16 3.49 75 XMNumbers 17328 3.42 3.50 3.38 76 XM_UncommonTLD01 17161 6.31 13.68 3.35 77 TR_XM_PhishingBody 16513 4.00 5.94 3.22 78 DKIM_INVALID 16383 3.36 3.75 3.20 79 MAILING_LIST_MULTI 16032 2.65 1.46 3.13 80 TM2_M_URI_OPT_OUT 15982 3.17 3.30 3.12 81 MIME_HTML_ONLY_MULTI 14508 2.66 2.24 2.83 82 XM_B_Unsub2 14370 2.54 1.88 2.81 83 BAYES_95 14151 3.60 5.69 2.76 84 URI_NOVOWEL 13690 3.15 4.33 2.67 85 XM_H_Trusted_IP 13340 1.86 0.00 2.60 86 HTML_IMAGE_RATIO_08 13204 3.07 4.29 2.58 87 TR_DCC_Bayes_99 13129 9.85 28.03 2.56 88 T_TooManySym_02 12844 1.95 0.56 2.51 89 FROM_EXCESS_BASE64 12590 2.50 2.60 2.46 90 RCVD_IN_MSPIKE_H5 11956 1.88 0.74 2.33 91 BOUNCE_MESSAGE 11918 1.87 0.71 2.33 92 ANY_BOUNCE_MESSAGE 11918 1.87 0.71 2.33 93 UNTRUSTED_Relay 11655 6.23 16.11 2.28 94 BAYES_05 11579 1.90 0.99 2.26 95 RCVD_IN_IADB_OPTIN 11493 1.76 0.54 2.24 96 LH_URI_DOM_IN_PATH 11457 2.26 2.32 2.24 97 TR_XM_SB_Phish 11328 2.07 1.72 2.21 98 TooManyTo_002 11101 1.72 0.59 2.17 99 XMSubPhish11 11069 2.00 1.60 2.16 100 MIME_HTML_MOSTLY 10854 2.93 4.94 2.12 101 XM_B_Phish66 10244 2.33 3.16 2.00 102 HTML_MIME_NO_HTML_TAG 10209 3.53 7.37 1.99 103 XM_DK_Undo_01 10106 1.71 1.07 1.97 104 BOTNET 9988 6.60 18.22 1.95 105 XM_B_SpammyTLD 9895 2.29 3.20 1.93 106 SUBJ_ALL_CAPS 9809 2.18 2.85 1.92 107 T_FONT_INVIS_NAKED_TO 9774 2.70 4.68 1.91 108 HELO_NODOT 9756 1.64 0.99 1.90 109 HELO_NO_DOMAIN 9753 1.64 0.99 1.90 110 TR_Symld_Words 9194 1.75 1.65 1.80 111 T_XMDrugObfuBody_08 9000 2.26 3.52 1.76 112 XM_CamelCaseFrm001 8902 1.86 2.18 1.74 113 XMDiploma_00 8784 2.98 6.12 1.72 114 RELAYCOUNTRY_CA 8513 2.98 6.26 1.66 115 XM_SPF_SoftFail 8400 2.39 4.27 1.64 116 T_XMDrugObfuBody_14 8252 1.60 1.56 1.61 117 KHOP_HELO_FCRDNS 8242 2.51 4.76 1.61 118 RCVD_IN_BL_SPAMCOP_NET 7773 3.70 9.13 1.52 119 IN_HORDE_ADDRESS_BOOK 7534 1.10 0.18 1.47 120 TooManyTo_003 7458 1.16 0.43 1.46 121 TVD_RCVD_IP 7424 1.16 0.43 1.45 122 XMNoVowels 7281 1.12 0.37 1.42 123 INVALID_MSGID 7067 1.18 0.67 1.38 124 TR_XM_SpammyWords2 6798 4.71 13.14 1.33 125 URI_HEX 6661 1.75 2.86 1.30 126 XMGappySubj_01 6580 0.94 0.09 1.28 127 DKIM_ADSP_CUSTOM_MED 6550 1.24 1.15 1.28 128 XMBrknScrpt_02 6508 3.65 9.59 1.27 129 TO_MALFORMED 6485 0.91 0.01 1.27 130 XM_H_Long_From02 6466 1.14 0.83 1.26 131 XMCapTrack 6451 0.99 0.33 1.26 132 XM_GoogleGroups 6364 0.99 0.37 1.24 133 XM_UB50 6342 2.78 6.61 1.24 134 XM_OfRef6 6329 2.05 4.08 1.24 135 HELO_MISC_IP 6197 0.97 0.36 1.21 136 CK_HELO_DYNAMIC_SPLIT_IP 6184 1.01 0.53 1.21 137 XMStockSpam_06 6170 1.36 1.74 1.20 138 TM2_M_VERY_LONG_WORD 6169 1.66 2.79 1.20 139 USER_IN_DEF_DKIM_WL 5937 0.83 0.01 1.16 140 XM_B_COVIDMETA 5731 1.74 3.28 1.12 141 URI_TRY_3LD 5570 1.73 3.32 1.09 142 TooManyTo_004 5335 0.85 0.39 1.04 143 SpammyFromTLD_01 5328 2.00 4.40 1.04 144 XMBSHREFv2 5211 0.80 0.27 1.02 145 HTML_FONT_FACE_BAD 5201 0.92 0.67 1.02 146 T_TooManySym_03 5154 0.76 0.15 1.01 147 T_FILL_THIS_FORM_SHORT 5021 1.12 1.45 0.98 148 XMGenDplmaNmb 4902 2.02 4.66 0.96 149 XMSubNoVowel 4648 1.00 1.22 0.91 150 XMHTML_After_End 4638 1.06 1.46 0.91 151 RCVD_IN_MSPIKE_BL 4623 3.17 8.83 0.90 152 TR_XM_DKIM_Undo 4592 2.72 7.26 0.90 153 RELAYCOUNTRY_GB 4579 1.17 1.85 0.89 154 NML_ADSP_CUSTOM_MED 4562 0.94 1.05 0.89 155 XMBody_95 4344 0.64 0.11 0.85 156 TR_LOTS_OF_MONEY3 4205 1.63 3.65 0.82 157 TR_MSPIKEBAYES00 4161 0.59 0.04 0.81 158 TooManyTo_005 4101 0.65 0.26 0.80 159 XMBody_17 4070 1.62 3.69 0.79 160 T_XMHurry_00 4021 1.12 1.96 0.79 161 T_XMDrugObfuBody_00 3851 1.21 2.37 0.75 162 HTTPS_HTTP_MISMATCH 3804 0.69 0.56 0.74 163 TR_MetaPhish_Combo_01 3781 0.80 0.96 0.74 164 FROM_GOV_DKIM_AU 3661 0.56 0.17 0.71 165 XM_ProductURIs 3649 0.70 0.67 0.71 166 RELAYCOUNTRY_NL 3627 0.86 1.25 0.71 167 XM_SPF_Unknown 3530 0.74 0.87 0.69 168 XMSexyCombo_01 3500 0.95 1.62 0.68 169 XM_ShortIntro_01 3400 0.60 0.44 0.66 170 T_OBFU_PDF_ATTACH 3297 0.51 0.18 0.64 171 XM_B_SpammyWords4 3250 1.13 2.35 0.63 172 FORGED_GMAIL_RCVD 3222 0.66 0.73 0.63 173 T_Symld_Words_02 3220 0.87 1.46 0.63 174 SENDGRID_REDIR 3104 0.62 0.65 0.61 175 T_TooManySym_04 2962 0.43 0.06 0.58 176 XMMoneyMeta_00 2932 0.59 0.64 0.57 177 DKIM_ADSP_NXDOMAIN 2824 1.81 4.93 0.55 178 XM_H_PHPMailer 2810 0.54 0.51 0.55 179 RCVD_IN_SORBS_DUL 2800 0.53 0.49 0.55 180 XMHTMLBadTable_001 2772 0.57 0.63 0.54 181 HTML_IMAGE_ONLY_20 2755 0.47 0.30 0.54 182 XM_DIRTYINTL 2744 1.11 2.55 0.54 183 HTML_TAG_BALANCE_BODY 2700 0.60 0.78 0.53 184 TM2_M_BODY_EMPTY 2595 0.38 0.06 0.51 185 DIET_1 2595 0.96 2.10 0.51 186 XMSubMetaSxObfu_03 2583 0.65 1.01 0.50 187 MISSING_HEADERS 2572 0.58 0.79 0.50 188 XMSubMetaI_00 2569 0.54 0.64 0.50 189 XMPhish30 2539 0.69 1.17 0.50 190 RELAYCOUNTRY_DE 2539 0.64 1.00 0.50 191 T_PDS_OTHER_BAD_TLD 2526 1.10 2.62 0.49 192 XM_B_REG_HTML 2516 0.47 0.43 0.49 193 FROM_GOV_SPOOF 2512 0.38 0.12 0.49 194 SHORT_HELO_AND_INLINE_IMAGE 2510 0.37 0.07 0.49 195 RDNS_DYNAMIC 2497 0.67 1.12 0.49 196 MPART_ALT_DIFF_COUNT 2470 0.63 0.99 0.48 197 NO_DNS_FOR_FROM 2404 0.49 0.56 0.47 198 NUMERIC_HTTP_ADDR 2334 0.61 1.01 0.46 199 XM_S_SubURI 2315 0.34 0.05 0.45 200 RCVD_IN_MSPIKE_L3 2281 1.45 3.94 0.45 ----------------------------------------------------------------------