Email: 760529 Autolearn: 0 AvgScore: 1.94 AvgScanTime: 1.23 sec Spam: 200836 Autolearn: 0 AvgScore: 13.95 AvgScanTime: 1.37 sec Ham: 559693 Autolearn: 0 AvgScore: -2.37 AvgScanTime: 1.18 sec Time Spent Running SA: 259.76 hours Time Spent Processing Spam: 76.27 hours Time Spent Processing Ham: 183.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 189146 91.36 94.18 90.35 2 DCC_CHECK 158970 46.92 79.15 35.36 3 XM_B_Unicode 157927 75.27 78.63 74.06 4 DKIM_SIGNED 154037 70.98 76.70 68.92 5 XM_DK_Pass 150068 69.59 74.72 67.75 6 RELAYCOUNTRY_US 149696 82.42 74.54 85.25 7 DKIM_VALID 146246 67.63 72.82 65.76 8 XMListUnsubscribeExists 131384 50.63 65.42 45.32 9 XM_B_SpammyWords 130670 52.40 65.06 47.86 10 DKIM_VALID_AU 112791 50.84 56.16 48.94 11 XM_DK_Undo_02 89755 16.61 44.69 6.53 12 BAYES_99 78926 13.39 39.30 4.10 13 XM_B_SpammyWords2 73947 23.84 36.82 19.18 14 XM_B_Unicode3 73376 42.13 36.54 44.13 15 TR_XM_DKIM_Undo 73024 13.28 36.36 4.99 16 HTML_FONT_LOW_CONTRAST 69031 27.46 34.37 24.98 17 BAYES_50 65146 48.60 32.44 54.40 18 MIME_HTML_ONLY 65130 25.93 32.43 23.59 19 LOC_TINY_FONT_1 62312 23.69 31.03 21.06 20 BAYES_999 61972 10.59 30.86 3.32 21 TR_DCC_Bayes_99 60569 9.32 30.16 1.84 22 FVGT_m_MULTI_ODD 53762 21.97 26.77 20.25 23 T_KAM_HTML_FONT_INVALID 52022 18.95 25.90 16.46 24 RCVD_IN_MSPIKE_H2 51571 25.22 25.68 25.06 25 DKIM_VALID_EF 49813 26.28 24.80 26.81 26 XMSubLong 46560 20.52 23.18 19.57 27 RELAYCOUNTRY_META 44229 9.07 22.02 4.43 28 T_TM2_M_HEADER_IN_MSG 41361 25.06 20.59 26.67 29 FSL_BULK_SIG 38922 8.88 19.38 5.11 30 XM_Multi_Part_URI 37760 12.54 18.80 10.30 31 DCC_CHECK_NEGATIVE 37317 51.15 18.58 62.83 32 UNTRUSTED_Relay 36061 5.97 17.96 1.66 33 RCVD_IN_MSPIKE_WL 34616 22.99 17.24 25.06 34 LOTS_OF_MONEY 33718 9.86 16.79 7.38 35 BOTNET 32120 5.26 15.99 1.41 36 XM_Body_Dirty_Words 32064 12.79 15.97 11.65 37 TR_XM_SpammyWords2 29663 4.52 14.77 0.84 38 BOTNET_IPINHOSTNAME 27365 6.51 13.63 3.95 39 RCVD_IN_MSPIKE_BL 26923 4.04 13.41 0.68 40 XM_B_Unsub 22823 10.32 11.36 9.94 41 XM_B_SpammyWords3 21445 6.45 10.68 4.94 42 RCVD_IN_BL_SPAMCOP_NET 21128 3.64 10.52 1.17 43 LotsOfNums_01 20787 8.49 10.35 7.83 44 KHOP_HELO_FCRDNS 19796 3.77 9.86 1.59 45 XMBrknScrpt_02 19272 3.30 9.60 1.05 46 RCVD_IN_MSPIKE_H3 18295 12.65 9.11 13.92 47 XM_B_Phish_Phrases 17774 7.03 8.85 6.37 48 XM_Evil_Numbers_Gen 17700 8.64 8.81 8.58 49 BAYES_60 17629 7.40 8.78 6.90 50 XM_UncommonTLD01 17051 4.39 8.49 2.92 51 BAYES_80 16986 5.15 8.46 3.96 52 XMSexyCombo_05 15902 4.74 7.92 3.60 53 T_REMOTE_IMAGE 15224 4.20 7.58 2.99 54 RCVD_IN_PSBL 15052 1.99 7.49 0.01 55 HTML_IMAGE_RATIO_02 14936 6.22 7.44 5.78 56 RCVD_IN_MSPIKE_H4 14587 8.68 7.26 9.18 57 T_TooManySym_01 14454 4.89 7.20 4.06 58 XM_UB50 12794 2.34 6.37 0.89 59 HTML_MIME_NO_HTML_TAG 12393 3.13 6.17 2.04 60 RCVD_IN_MSPIKE_L5 12328 1.78 6.14 0.21 61 XMSubMetaSx_00 12208 4.04 6.08 3.30 62 RELAYCOUNTRY_CA 12085 2.61 6.02 1.39 63 HTML_IMAGE_ONLY_12 11708 1.69 5.83 0.21 64 XMNumbers 11632 3.79 5.79 3.07 65 MPART_ALT_DIFF 11609 8.52 5.78 9.51 66 RCVD_IN_MSPIKE_L3 11388 1.77 5.67 0.38 67 TR_XM_SpammyWords3 11381 1.77 5.67 0.37 68 UNPARSEABLE_RELAY 11333 6.91 5.64 7.36 69 RCVD_IN_RP_RNBL 11305 1.59 5.63 0.15 70 TooManyTo_001 11213 6.87 5.58 7.33 71 T_PDS_OTHER_BAD_TLD 10953 1.61 5.45 0.24 72 DIET_1 10798 1.71 5.38 0.39 73 HTML_SHORT_LINK_IMG_1 10760 1.43 5.36 0.02 74 XM_H_Long_From01 10710 4.90 5.33 4.75 75 BAYES_95 10491 3.16 5.22 2.42 76 TR_XM_PhishingBody 10277 3.54 5.12 2.97 77 HTML_IMAGE_RATIO_06 9706 5.10 4.83 5.19 78 BODY_URI_ONLY 9677 1.30 4.82 0.04 79 HTML_IMAGE_RATIO_04 9265 12.01 4.61 14.66 80 XM_SPF_SoftFail 9234 2.31 4.60 1.49 81 URIBL_SBL_A 9197 1.35 4.58 0.19 82 XMBody_17 8885 1.73 4.42 0.77 83 MIME_HTML_MOSTLY 8358 2.68 4.16 2.14 84 T_FONT_INVIS_NAKED_TO 8264 2.41 4.11 1.80 85 XM_SendGrid 8257 6.05 4.11 6.75 86 T_XMDrugObfuBody_08 7900 2.18 3.93 1.55 87 XM_UB60 7878 1.09 3.92 0.08 88 XM_B_COVIDMETA 7794 1.88 3.88 1.17 89 DKIM_INVALID 7791 3.35 3.88 3.16 90 XM_UB99 7786 1.03 3.88 0.01 91 URI_TRY_3LD 7508 1.80 3.74 1.10 92 TR_LOTS_OF_MONEY3 7387 1.50 3.68 0.72 93 XMStrtUSub 7310 8.69 3.64 10.50 94 HTML_IMAGE_RATIO_08 7018 2.61 3.49 2.29 95 XM_OfRef6 7013 1.82 3.49 1.23 96 XM_B_SpammyTLD 6885 2.23 3.43 1.80 97 TR_XM_MaxSPIKE 6697 0.89 3.33 0.01 98 TR_XM_MaxBayes 6499 0.87 3.24 0.01 99 BOTNET_NORDNS 6486 0.86 3.23 0.01 100 SUBJ_ALL_CAPS 6459 1.91 3.22 1.44 101 URI_HEX 6290 1.71 3.13 1.20 102 HTML_FONT_SIZE_LARGE 6206 0.88 3.09 0.09 103 SpammyFromTLD_01 6048 1.43 3.01 0.86 104 TM2_M_URI_OPT_OUT 6006 2.89 2.99 2.85 105 RCVD_IN_RP_SAFE 6005 5.51 2.99 6.41 106 XM_B_Phish66 5984 2.09 2.98 1.78 107 XM_UB999 5669 0.75 2.82 0.01 108 SpammyFromTLD_02 5438 0.94 2.71 0.30 109 RELAYCOUNTRY_UA 5397 0.71 2.69 0.01 110 MIME_QP_LONG_LINE 5383 4.58 2.68 5.26 111 XM_DIRTYINTL 5303 1.02 2.64 0.43 112 XMDiploma_00 5284 1.96 2.63 1.72 113 LH_URI_DOM_IN_PATH 5259 1.93 2.62 1.68 114 TM2_M_VERY_LONG_WORD 5193 1.41 2.59 0.98 115 RCVD_IN_RP_CERTIFIED 4968 5.02 2.47 5.93 116 TR_XM_DK_SendGrid 4958 3.51 2.47 3.88 117 FROM_EXCESS_BASE64 4912 2.42 2.45 2.41 118 XM_B_SpammyWords4 4689 1.02 2.33 0.55 119 XM_CamelCaseFrm001 4650 1.72 2.32 1.51 120 XM_B_Unsub2 4596 2.17 2.29 2.13 121 TR_XM_COVIDMETA4 4487 0.84 2.23 0.34 122 RELAYCOUNTRY_IN 4354 0.65 2.17 0.10 123 TR_XM_SB_Phish 4350 2.02 2.17 1.97 124 XMSexyCombo_01 4341 1.16 2.16 0.80 125 RCVD_IN_IADB_LISTED 4244 4.17 2.11 4.90 126 BAYES_40 4095 5.38 2.04 6.58 127 T_XMHurry_00 4088 1.05 2.04 0.70 128 TR_XM_UnparsRelay 4087 0.76 2.03 0.30 129 MIME_HTML_ONLY_MULTI 4044 6.17 2.01 7.66 130 XM_UB80 4016 0.55 2.00 0.02 131 XM_URI_RBL 3973 0.65 1.98 0.17 132 XMSubPhish11 3926 1.95 1.95 1.94 133 XMSlimDrugH 3661 0.72 1.82 0.33 134 RCVD_IN_IADB_SPF 3650 3.62 1.82 4.27 135 DKIM_ADSP_CUSTOM_MED 3543 1.23 1.76 1.03 136 HK_RANDOM_FROM 3489 0.57 1.74 0.14 137 T_XMDrugObfuBody_00 3438 0.91 1.71 0.62 138 T_FILL_THIS_FORM_SHORT 3419 1.07 1.70 0.84 139 BAYES_20 3419 3.43 1.70 4.05 140 TR_Symld_Words 3389 1.71 1.69 1.72 141 RCVD_IN_IADB_SENDERID 3372 3.26 1.68 3.83 142 RCVD_IN_IADB_DK 3286 3.16 1.64 3.70 143 NML_ADSP_CUSTOM_MED 3263 0.98 1.62 0.75 144 XM_DK_Undo_01 3211 1.59 1.60 1.59 145 RELAYCOUNTRY_FR 3082 0.55 1.53 0.20 146 T_XMDrugObfuBody_14 3067 1.45 1.53 1.42 147 HK_RANDOM_ENVFROM 2979 0.48 1.48 0.12 148 TR_XM_COVIDMETA1 2951 0.60 1.47 0.28 149 RCVD_IN_MSPIKE_L4 2939 0.45 1.46 0.09 150 MIME_CHARSET_FARAWAY 2914 0.46 1.45 0.10 151 FROM_SUSPICIOUS_NTLD 2889 0.43 1.44 0.07 152 XMSubNoVowel 2873 3.01 1.43 3.57 153 XMSubMetaD_00 2867 0.45 1.43 0.10 154 TR_Caps_n_Bayes_99 2862 0.43 1.43 0.08 155 XM_SPF_Unknown 2853 0.82 1.42 0.61 156 XMGenDplmaNmb 2803 1.01 1.40 0.87 157 TR_XM_PHPDW 2795 0.63 1.39 0.36 158 XMStockSpam_06 2767 1.14 1.38 1.05 159 MAILING_LIST_MULTI 2766 2.21 1.38 2.52 160 SUBJ_BUY 2760 0.45 1.37 0.11 161 FORGED_GMAIL_RCVD 2748 0.74 1.37 0.51 162 TR_XM_PHPForged 2734 0.59 1.36 0.31 163 FROM_SUSPICIOUS_NTLD_FP 2724 0.40 1.36 0.06 164 TR_XM_FormFill2 2723 0.58 1.36 0.31 165 XM_H_PHPOS 2718 0.58 1.35 0.30 166 TR_XM_INV_DKIM 2706 0.45 1.35 0.12 167 CHARSET_FARAWAY_HEADER 2624 0.37 1.31 0.03 168 XMBdyGiftCard01 2614 0.92 1.30 0.79 169 DRUGS_ERECTILE 2608 0.35 1.30 0.01 170 XMHTML_After_End 2606 0.85 1.30 0.69 171 MIMEOLE_DIRECT_TO_MX 2579 0.34 1.28 0.00 172 XMSubMetaD_03 2562 0.35 1.28 0.02 173 NUMERIC_HTTP_ADDR 2468 0.78 1.23 0.62 174 PDS_FROM_2_EMAILS 2431 0.35 1.21 0.04 175 XMSubMetaD_01 2431 0.32 1.21 0.00 176 URI_NOVOWEL 2420 1.95 1.20 2.22 177 SERGIO_SUBJECT_VIAGRA01 2413 0.32 1.20 0.00 178 SUBJECT_DRUG_GAP_L 2411 0.32 1.20 0.00 179 SUBJECT_DRUG_GAP_C 2409 0.32 1.20 0.00 180 XMSubMetaD_02 2408 0.32 1.20 0.00 181 FROM_2_EMAILS_SHORT 2387 0.32 1.19 0.00 182 REMOVE_BEFORE_LINK 2373 0.48 1.18 0.23 183 XMBody_78 2371 0.59 1.18 0.38 184 HK_RANDOM_REPLYTO 2302 0.43 1.15 0.17 185 PDS_TO_EQ_FROM_NAME 2280 0.30 1.14 0.00 186 TR_XM_RelayPhish 2192 0.38 1.09 0.13 187 BAYES_00 2180 11.44 1.09 15.15 188 XM_UB95 2161 0.30 1.08 0.02 189 ALL_TRUSTED 2096 8.70 1.04 11.45 190 RCVD_IN_IADB_VOUCHED 2084 2.48 1.04 3.00 191 NO_FM_NAME_IP_HOSTN 2070 0.27 1.03 0.00 192 DOS_OE_TO_MX 2044 0.27 1.02 0.00 193 TR_XM_FormFill 1975 0.27 0.98 0.01 194 LongTLD 1965 0.38 0.98 0.16 195 BAYES_05 1961 2.05 0.98 2.43 196 DKIM_ADSP_NXDOMAIN 1961 0.60 0.98 0.47 197 HELO_NODOT 1948 1.40 0.97 1.55 198 HELO_NO_DOMAIN 1947 1.40 0.97 1.55 199 XM_UCStrings02 1942 0.29 0.97 0.04 200 TR_BOTNET_NEGATE 1933 0.47 0.96 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 505662 91.36 94.18 90.35 2 RELAYCOUNTRY_US 477120 82.42 74.54 85.25 3 XM_B_Unicode 414504 75.27 78.63 74.06 4 DKIM_SIGNED 385753 70.98 76.70 68.92 5 XM_DK_Pass 379175 69.59 74.72 67.75 6 DKIM_VALID 368068 67.63 72.82 65.76 7 DCC_CHECK_NEGATIVE 351662 51.15 18.58 62.83 8 BAYES_50 304452 48.60 32.44 54.40 9 DKIM_VALID_AU 273888 50.84 56.16 48.94 10 XM_B_SpammyWords 267870 52.40 65.06 47.86 11 XMListUnsubscribeExists 253636 50.63 65.42 45.32 12 XM_B_Unicode3 247003 42.13 36.54 44.13 13 DCC_CHECK 197899 46.92 79.15 35.36 14 DKIM_VALID_EF 150041 26.28 24.80 26.81 15 T_TM2_M_HEADER_IN_MSG 149256 25.06 20.59 26.67 16 RCVD_IN_MSPIKE_H2 140266 25.22 25.68 25.06 17 RCVD_IN_MSPIKE_WL 140257 22.99 17.24 25.06 18 HTML_FONT_LOW_CONTRAST 139818 27.46 34.37 24.98 19 MIME_HTML_ONLY 132038 25.93 32.43 23.59 20 LOC_TINY_FONT_1 117876 23.69 31.03 21.06 21 FVGT_m_MULTI_ODD 113318 21.97 26.77 20.25 22 XMSubLong 109531 20.52 23.18 19.57 23 XM_B_SpammyWords2 107340 23.84 36.82 19.18 24 T_KAM_HTML_FONT_INVALID 92115 18.95 25.90 16.46 25 BAYES_00 84814 11.44 1.09 15.15 26 HTML_IMAGE_RATIO_04 82074 12.01 4.61 14.66 27 RCVD_IN_MSPIKE_H3 77901 12.65 9.11 13.92 28 HTML_FONT_FACE_BAD 72949 9.77 0.67 13.03 29 XM_H_Trusted_IP 70670 9.29 0.00 12.63 30 XM_Body_Dirty_Words 65204 12.79 15.97 11.65 31 ALL_TRUSTED 64062 8.70 1.04 11.45 32 XMStrtUSub 58754 8.69 3.64 10.50 33 XM_Multi_Part_URI 57622 12.54 18.80 10.30 34 XM_B_Unsub 55631 10.32 11.36 9.94 35 MPART_ALT_DIFF 53206 8.52 5.78 9.51 36 RCVD_IN_MSPIKE_H4 51396 8.68 7.26 9.18 37 TR_XM_DK_Bayes 50200 6.80 0.75 8.97 38 TR_XM_DK_Bayes1 48844 6.62 0.73 8.73 39 XM_Evil_Numbers_Gen 48015 8.64 8.81 8.58 40 LotsOfNums_01 43808 8.49 10.35 7.83 41 MIME_HTML_ONLY_MULTI 42891 6.17 2.01 7.66 42 TR_XM_DK_Bayes2 42866 5.79 0.58 7.66 43 LOTS_OF_MONEY 41307 9.86 16.79 7.38 44 UNPARSEABLE_RELAY 41187 6.91 5.64 7.36 45 TooManyTo_001 41029 6.87 5.58 7.33 46 XM_DKIMWhitelistDomains 38650 5.10 0.05 6.91 47 BAYES_60 38639 7.40 8.78 6.90 48 XM_SendGrid 37790 6.05 4.11 6.75 49 BAYES_40 36815 5.38 2.04 6.58 50 XM_DK_Undo_02 36558 16.61 44.69 6.53 51 RCVD_IN_RP_SAFE 35875 5.51 2.99 6.41 52 XM_B_Phish_Phrases 35663 7.03 8.85 6.37 53 IN_ZIMBRA_NJ_WHITELIST 34229 4.52 0.07 6.12 54 RCVD_IN_RP_CERTIFIED 33183 5.02 2.47 5.93 55 HTML_IMAGE_RATIO_02 32340 6.22 7.44 5.78 56 MIME_QP_LONG_LINE 29418 4.58 2.68 5.26 57 HTML_IMAGE_RATIO_06 29046 5.10 4.83 5.19 58 FSL_BULK_SIG 28588 8.88 19.38 5.11 59 TR_XM_DKIM_Undo 27946 13.28 36.36 4.99 60 XM_B_SpammyWords3 27628 6.45 10.68 4.94 61 RCVD_IN_IADB_LISTED 27436 4.17 2.11 4.90 62 XM_H_Long_From01 26562 4.90 5.33 4.75 63 XM_PDF 26028 3.66 0.90 4.65 64 RELAYCOUNTRY_META 24770 9.07 22.02 4.43 65 RCVD_IN_IADB_SPF 23873 3.62 1.82 4.27 66 BAYES_99 22946 13.39 39.30 4.10 67 T_TooManySym_01 22716 4.89 7.20 4.06 68 BAYES_20 22693 3.43 1.70 4.05 69 BAYES_80 22184 5.15 8.46 3.96 70 BOTNET_IPINHOSTNAME 22130 6.51 13.63 3.95 71 TR_XM_DK_SendGrid 21737 3.51 2.47 3.88 72 RCVD_IN_IADB_SENDERID 21425 3.26 1.68 3.83 73 RCVD_IN_IADB_DK 20713 3.16 1.64 3.70 74 XMSexyCombo_05 20153 4.74 7.92 3.60 75 XMSubNoVowel 19984 3.01 1.43 3.57 76 BAYES_999 18557 10.59 30.86 3.32 77 XMSubMetaSx_00 18491 4.04 6.08 3.30 78 DKIM_INVALID 17685 3.35 3.88 3.16 79 XMNumbers 17174 3.79 5.79 3.07 80 RCVD_IN_IADB_VOUCHED 16815 2.48 1.04 3.00 81 T_REMOTE_IMAGE 16723 4.20 7.58 2.99 82 TR_XM_PhishingBody 16619 3.54 5.12 2.97 83 XM_UncommonTLD01 16344 4.39 8.49 2.92 84 TM2_M_URI_OPT_OUT 15977 2.89 2.99 2.85 85 ANY_BOUNCE_MESSAGE 15097 2.24 0.96 2.70 86 BOUNCE_MESSAGE 15087 2.24 0.96 2.70 87 MAILING_LIST_MULTI 14077 2.21 1.38 2.52 88 BAYES_05 13614 2.05 0.98 2.43 89 BAYES_95 13533 3.16 5.22 2.42 90 FROM_EXCESS_BASE64 13511 2.42 2.45 2.41 91 HTML_IMAGE_RATIO_08 12821 2.61 3.49 2.29 92 URI_NOVOWEL 12413 1.95 1.20 2.22 93 MIME_HTML_MOSTLY 11988 2.68 4.16 2.14 94 XM_B_Unsub2 11924 2.17 2.29 2.13 95 HTML_MIME_NO_HTML_TAG 11444 3.13 6.17 2.04 96 T_TooManySym_02 11438 1.71 0.78 2.04 97 TR_XM_SB_Phish 11043 2.02 2.17 1.97 98 RCVD_IN_MSPIKE_H5 10960 1.67 0.86 1.96 99 XMSubPhish11 10867 1.95 1.95 1.94 100 TooManyTo_002 10599 1.54 0.56 1.89 101 RCVD_IN_IADB_OPTIN 10565 1.58 0.72 1.89 102 TR_DCC_Bayes_99 10290 9.32 30.16 1.84 103 T_FONT_INVIS_NAKED_TO 10096 2.41 4.11 1.80 104 XM_B_SpammyTLD 10087 2.23 3.43 1.80 105 XM_B_Phish66 9947 2.09 2.98 1.78 106 TR_Symld_Words 9637 1.71 1.69 1.72 107 XMDiploma_00 9617 1.96 2.63 1.72 108 LH_URI_DOM_IN_PATH 9428 1.93 2.62 1.68 109 UNTRUSTED_Relay 9311 5.97 17.96 1.66 110 XM_DK_Undo_01 8910 1.59 1.60 1.59 111 KHOP_HELO_FCRDNS 8891 3.77 9.86 1.59 112 T_XMDrugObfuBody_08 8703 2.18 3.93 1.55 113 HELO_NODOT 8672 1.40 0.97 1.55 114 HELO_NO_DOMAIN 8671 1.40 0.97 1.55 115 XM_CamelCaseFrm001 8431 1.72 2.32 1.51 116 XM_SPF_SoftFail 8332 2.31 4.60 1.49 117 SUBJ_ALL_CAPS 8043 1.91 3.22 1.44 118 T_XMDrugObfuBody_14 7927 1.45 1.53 1.42 119 BOTNET 7916 5.26 15.99 1.41 120 RELAYCOUNTRY_CA 7802 2.61 6.02 1.39 121 XMSubLongNoVowel 7726 1.06 0.16 1.38 122 IN_HORDE_ADDRESS_BOOK 7700 1.07 0.23 1.38 123 INVALID_MSGID 7602 1.18 0.67 1.36 124 TVD_RCVD_IP 7597 1.05 0.21 1.36 125 XMSubGarbage 7573 1.00 0.03 1.35 126 TooManyTo_003 7132 1.04 0.38 1.27 127 XM_GoogleGroups 7113 1.05 0.42 1.27 128 XM_OfRef6 6864 1.82 3.49 1.23 129 URI_HEX 6709 1.71 3.13 1.20 130 XMGappySubj_01 6692 0.93 0.18 1.20 131 XMCapTrack 6625 0.95 0.32 1.18 132 XM_B_COVIDMETA 6539 1.88 3.88 1.17 133 RCVD_IN_BL_SPAMCOP_NET 6524 3.64 10.52 1.17 134 TO_MALFORMED 6485 0.85 0.01 1.16 135 HELO_MISC_IP 6418 0.94 0.36 1.15 136 CK_HELO_DYNAMIC_SPLIT_IP 6415 0.97 0.47 1.15 137 URI_TRY_3LD 6150 1.80 3.74 1.10 138 XMStockSpam_06 5894 1.14 1.38 1.05 139 XMBrknScrpt_02 5850 3.30 9.60 1.05 140 DKIM_ADSP_CUSTOM_MED 5786 1.23 1.76 1.03 141 XMBSHREFv2 5751 0.86 0.39 1.03 142 USER_IN_DEF_DKIM_WL 5625 0.74 0.01 1.01 143 TM2_M_VERY_LONG_WORD 5507 1.41 2.59 0.98 144 XM_E_Blogspot 5263 0.71 0.07 0.94 145 XM_H_Long_From02 5181 0.87 0.70 0.93 146 TooManyTo_004 5108 0.76 0.32 0.91 147 XM_UB50 4971 2.34 6.37 0.89 148 XMGenDplmaNmb 4880 1.01 1.40 0.87 149 RELAYCOUNTRY_GB 4861 0.89 0.96 0.87 150 SpammyFromTLD_01 4791 1.43 3.01 0.86 151 TR_XM_SpammyWords2 4729 4.52 14.77 0.84 152 T_FILL_THIS_FORM_SHORT 4718 1.07 1.70 0.84 153 T_TooManySym_03 4682 0.68 0.23 0.84 154 TR_MSPIKEBAYES00 4558 0.61 0.04 0.81 155 XMSexyCombo_01 4480 1.16 2.16 0.80 156 XMBdyGiftCard01 4415 0.92 1.30 0.79 157 HTTPS_HTTP_MISMATCH 4369 0.77 0.74 0.78 158 XM_ProductURIs 4329 0.82 0.96 0.77 159 XMBody_17 4305 1.73 4.42 0.77 160 NML_ADSP_CUSTOM_MED 4187 0.98 1.62 0.75 161 TooManyTo_005 4093 0.61 0.25 0.73 162 MISSING_HEADERS 4046 0.64 0.42 0.72 163 TR_LOTS_OF_MONEY3 4024 1.50 3.68 0.72 164 T_XMHurry_00 3933 1.05 2.04 0.70 165 XMHTML_After_End 3872 0.85 1.30 0.69 166 XMSubMetaSxObfu_03 3848 0.68 0.64 0.69 167 RCVD_IN_MSPIKE_BL 3806 4.04 13.41 0.68 168 T_OBFU_PDF_ATTACH 3779 0.55 0.20 0.68 169 T_XMDrugObfuBody_00 3489 0.91 1.71 0.62 170 NUMERIC_HTTP_ADDR 3446 0.78 1.23 0.62 171 XMBody_95 3438 0.48 0.09 0.61 172 XM_SPF_Unknown 3413 0.82 1.42 0.61 173 FROM_GOV_DKIM_AU 3408 0.59 0.56 0.61 174 XM_ShortIntro_01 3362 0.55 0.42 0.60 175 HTML_TAG_BALANCE_BODY 3198 0.67 0.95 0.57 176 XMLngstWrd_00 3144 0.49 0.28 0.56 177 XM_B_SpammyWords4 3058 1.02 2.33 0.55 178 XMLngstWrd_01 2948 0.45 0.24 0.53 179 XM_H_PHPMailer 2936 0.53 0.56 0.52 180 XMMoneyMeta_00 2862 0.63 0.96 0.51 181 FORGED_GMAIL_RCVD 2843 0.74 1.37 0.51 182 TR_MetaPhish_Combo_01 2748 0.61 0.93 0.49 183 SENDGRID_REDIR 2662 0.52 0.64 0.48 184 T_TooManySym_04 2649 0.36 0.04 0.47 185 T_Symld_Words_02 2640 0.54 0.72 0.47 186 MPART_ALT_DIFF_COUNT 2637 0.53 0.71 0.47 187 XMNoVowels 2630 0.42 0.30 0.47 188 XM_B_COPY_HTML 2621 0.46 0.45 0.47 189 DKIM_ADSP_NXDOMAIN 2621 0.60 0.98 0.47 190 XMSexyCombo_04 2589 0.51 0.65 0.46 191 TM2_M_BODY_EMPTY 2583 0.35 0.04 0.46 192 T_HTML_TAG_BALANCE_CENTER 2570 0.44 0.37 0.46 193 RCVD_IN_SORBS_DUL 2518 0.43 0.36 0.45 194 NO_DNS_FOR_FROM 2500 0.44 0.43 0.45 195 XMHTMLBadTable_001 2474 0.50 0.64 0.44 196 XMLngstWrd_02 2470 0.37 0.18 0.44 197 XM_DIRTYINTL 2427 1.02 2.64 0.43 198 RDNS_DYNAMIC 2418 0.57 0.95 0.43 199 XMPhish08 2376 0.49 0.67 0.42 200 FROM_GOV_SPOOF 2374 0.35 0.14 0.42 ----------------------------------------------------------------------