Email: 640657 Autolearn: 0 AvgScore: 2.65 AvgScanTime: 1.19 sec Spam: 166623 Autolearn: 0 AvgScore: 13.36 AvgScanTime: 1.35 sec Ham: 474034 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 1.14 sec Time Spent Running SA: 212.55 hours Time Spent Processing Spam: 62.32 hours Time Spent Processing Ham: 150.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155730 90.47 93.46 89.41 2 DKIM_SIGNED 133919 77.43 80.37 76.39 3 XM_DK_Pass 130509 75.91 78.33 75.06 4 DKIM_VALID 127478 74.02 76.51 73.15 5 DCC_CHECK 126417 47.97 75.87 38.16 6 XM_B_Unicode 124714 70.89 74.85 69.50 7 RELAYCOUNTRY_US 121386 81.07 72.85 83.95 8 XM_B_SpammyWords 115419 54.52 69.27 49.33 9 XMListUnsubscribeExists 113085 53.96 67.87 49.07 10 DKIM_VALID_AU 96769 55.22 58.08 54.22 11 XM_DK_Undo_02 75139 17.21 45.10 7.40 12 XM_B_Unicode3 67930 41.07 40.77 41.17 13 XM_B_SpammyWords2 65389 26.67 39.24 22.25 14 TR_XM_DKIM_Undo 62015 13.74 37.22 5.48 15 BAYES_50 60178 50.00 36.12 54.88 16 BAYES_99 57852 12.56 34.72 4.78 17 LOC_TINY_FONT_1 55668 25.96 33.41 23.34 18 HTML_FONT_LOW_CONTRAST 55107 28.91 33.07 27.44 19 MIME_HTML_ONLY 54581 25.49 32.76 22.94 20 DKIM_VALID_EF 45579 28.88 27.35 29.42 21 BAYES_999 45184 9.88 27.12 3.82 22 T_KAM_HTML_FONT_INVALID 43676 20.43 26.21 18.40 23 RCVD_IN_MSPIKE_H2 43256 27.04 25.96 27.42 24 FVGT_m_MULTI_ODD 42728 22.41 25.64 21.27 25 TR_DCC_Bayes_99 42451 8.18 25.48 2.10 26 XMSubLong 40814 22.27 24.49 21.49 27 RELAYCOUNTRY_META 40444 9.88 24.27 4.82 28 T_TM2_M_HEADER_IN_MSG 39657 27.53 23.80 28.84 29 DCC_CHECK_NEGATIVE 36791 50.03 22.08 59.85 30 XM_Body_Dirty_Words 34158 14.64 20.50 12.58 31 UNTRUSTED_Relay 31311 6.61 18.79 2.33 32 RCVD_IN_MSPIKE_WL 30089 25.71 18.06 28.40 33 XM_Multi_Part_URI 28009 12.90 16.81 11.52 34 BOTNET 27164 5.39 16.30 1.55 35 FSL_BULK_SIG 26345 8.86 15.81 6.42 36 TR_XM_SpammyWords2 23860 4.44 14.32 0.96 37 BOTNET_IPINHOSTNAME 23314 6.88 13.99 4.38 38 LOTS_OF_MONEY 21558 9.51 12.94 8.31 39 XM_B_SpammyWords3 21232 7.05 12.74 5.05 40 XM_B_Unsub 18550 11.93 11.13 12.22 41 XM_B_Phish_Phrases 18155 7.95 10.90 6.91 42 XMSexyCombo_05 17587 5.60 10.55 3.85 43 XM_Evil_Numbers_Gen 17272 9.14 10.37 8.71 44 T_REMOTE_IMAGE 17117 5.91 10.27 4.37 45 LotsOfNums_01 16942 9.04 10.17 8.64 46 XM_UncommonTLD01 16595 4.92 9.96 3.14 47 RCVD_IN_MSPIKE_H3 16164 14.24 9.70 15.84 48 BAYES_60 15518 7.82 9.31 7.30 49 BAYES_80 14689 5.49 8.82 4.32 50 HTML_IMAGE_RATIO_02 14248 7.27 8.55 6.81 51 MPART_ALT_DIFF 13411 6.83 8.05 6.40 52 BODY_URI_ONLY 13172 2.28 7.91 0.31 53 RCVD_IN_MSPIKE_BL 13141 2.47 7.89 0.56 54 RCVD_IN_BL_SPAMCOP_NET 12865 2.99 7.72 1.33 55 XMSubMetaSx_00 12278 4.56 7.37 3.58 56 RCVD_IN_MSPIKE_H4 12219 9.57 7.33 10.36 57 HTML_IMAGE_ONLY_12 11396 2.13 6.84 0.48 58 KHOP_HELO_FCRDNS 11394 3.13 6.84 1.82 59 HTML_SHORT_LINK_IMG_1 11295 1.97 6.78 0.28 60 XM_UB50 11129 2.68 6.68 1.27 61 XM_H_Long_From01 10472 5.85 6.28 5.70 62 TR_XM_PhishingBody 10109 3.99 6.07 3.26 63 RELAYCOUNTRY_CA 9958 2.60 5.98 1.42 64 TooManyTo_001 9749 7.37 5.85 7.90 65 MIME_HTML_MOSTLY 9703 3.14 5.82 2.19 66 HTML_IMAGE_RATIO_04 9554 6.13 5.73 6.27 67 UNPARSEABLE_RELAY 9053 7.53 5.43 8.27 68 XM_B_COVIDMETA 8346 2.37 5.01 1.45 69 RCVD_IN_MSPIKE_L3 8022 1.54 4.81 0.39 70 TR_XM_SpammyWords3 7985 1.51 4.79 0.36 71 XM_UB60 7851 1.45 4.71 0.30 72 BAYES_95 7756 3.17 4.65 2.65 73 XM_SendGrid 7447 6.79 4.47 7.61 74 SpammyFromTLD_01 7437 1.75 4.46 0.80 75 XM_SPF_SoftFail 7363 2.45 4.42 1.76 76 XMBrknScrpt_02 7329 1.75 4.40 0.82 77 XM_OfRef6 7101 1.97 4.26 1.17 78 RCVD_IN_RP_SAFE 6961 5.83 4.18 6.41 79 XMStrtUSub 6960 4.76 4.18 4.97 80 HTML_IMAGE_RATIO_06 6837 3.98 4.10 3.94 81 T_FONT_INVIS_NAKED_TO 6659 2.54 4.00 2.02 82 XMNumbers 6638 3.37 3.98 3.16 83 XM_BadFromFormat 6488 1.12 3.89 0.15 84 XM_B_SpammyTLD 6480 2.57 3.89 2.10 85 DKIM_INVALID 6441 3.40 3.87 3.24 86 XMBody_17 6273 1.51 3.76 0.72 87 BOTNET_NORDNS 6245 0.99 3.75 0.02 88 XM_B_Phish66 6117 2.31 3.67 1.84 89 SUBJ_ALL_CAPS 6081 2.25 3.65 1.75 90 RCVD_IN_RP_CERTIFIED 5771 5.18 3.46 5.78 91 RCVD_IN_RP_RNBL 5754 0.97 3.45 0.10 92 URI_HEX 5736 1.81 3.44 1.23 93 HTML_MIME_NO_HTML_TAG 5547 2.78 3.33 2.59 94 LH_URI_DOM_IN_PATH 5405 2.49 3.24 2.23 95 XM_DIRTYINTL 5359 1.23 3.22 0.53 96 T_XMDrugObfuBody_08 5103 2.06 3.06 1.71 97 MIME_HTML_ONLY_MULTI 4996 4.05 3.00 4.42 98 MIME_QP_LONG_LINE 4974 5.18 2.99 5.95 99 TM2_M_URI_OPT_OUT 4906 3.46 2.94 3.64 100 T_TooManySym_01 4760 4.18 2.86 4.64 101 RELAYCOUNTRY_FR 4656 0.94 2.79 0.29 102 SpammyFromTLD_02 4548 1.03 2.73 0.43 103 RCVD_IN_IADB_LISTED 4531 5.22 2.72 6.10 104 XM_UB80 4529 0.73 2.72 0.03 105 XMDiploma_00 4516 2.04 2.71 1.80 106 FROM_EXCESS_BASE64 4500 2.50 2.70 2.43 107 RCVD_IN_MSPIKE_L5 4460 0.80 2.68 0.14 108 XM_UB99 4246 0.67 2.55 0.00 109 XM_CamelCaseFrm001 4177 2.18 2.51 2.06 110 TM2_M_VERY_LONG_WORD 4148 1.55 2.49 1.22 111 XMSlimDrugH 4123 0.92 2.47 0.38 112 BAYES_40 4074 4.35 2.45 5.03 113 TR_XM_DK_SendGrid 4066 4.13 2.44 4.72 114 TR_XM_SB_Phish 4005 2.20 2.40 2.13 115 XMSexyCombo_01 3987 1.31 2.39 0.93 116 TR_LOTS_OF_MONEY3 3971 1.07 2.38 0.61 117 TR_XM_MaxSPIKE 3925 0.62 2.36 0.01 118 XMSubPhish11 3909 2.17 2.35 2.11 119 URI_TRY_3LD 3811 1.41 2.29 1.10 120 RCVD_IN_IADB_SPF 3806 4.48 2.28 5.25 121 XM_B_Unsub2 3785 2.73 2.27 2.89 122 TR_XM_COVIDMETA4 3783 0.94 2.27 0.47 123 HTML_IMAGE_RATIO_08 3744 2.38 2.25 2.42 124 T_XMDrugObfuBody_14 3693 1.86 2.22 1.74 125 XMBody_78 3692 0.90 2.22 0.44 126 URIBL_SBL_A 3689 0.67 2.21 0.13 127 XM_DK_Undo_01 3530 1.82 2.12 1.72 128 RELAYCOUNTRY_NL 3469 0.72 2.08 0.24 129 RCVD_IN_IADB_SENDERID 3446 3.98 2.07 4.65 130 RELAYCOUNTRY_IN 3396 0.58 2.04 0.07 131 RCVD_IN_IADB_DK 3379 3.84 2.03 4.48 132 XM_B_SpammyWords4 3319 0.88 1.99 0.50 133 RELAYCOUNTRY_UA 3293 0.68 1.98 0.22 134 XM_UB999 3285 0.51 1.97 0.00 135 URI_PHP_REDIR 3200 0.50 1.92 0.01 136 RCVD_IN_PSBL 3186 0.51 1.91 0.02 137 T_XMDrugObfuBody_00 3166 1.05 1.90 0.76 138 BAYES_20 3165 3.39 1.90 3.91 139 XM_URI_RBL 3055 0.60 1.83 0.17 140 T_FILL_THIS_FORM_SHORT 3052 1.22 1.83 1.00 141 TR_XM_COVIDMETA1 3023 0.90 1.81 0.58 142 PDS_OTHER_BAD_TLD 3016 0.74 1.81 0.36 143 XMStockSpam_06 3011 1.49 1.81 1.38 144 T_XMHurry_00 3005 0.82 1.80 0.47 145 TR_XM_UnparsRelay 2983 0.71 1.79 0.33 146 TR_XM_Spammywords 2938 0.68 1.76 0.30 147 XM_S_SpammyWords 2938 0.68 1.76 0.30 148 DKIM_ADSP_NXDOMAIN 2906 0.87 1.74 0.56 149 HTML_FONT_SIZE_LARGE 2876 0.55 1.73 0.13 150 DIET_1 2861 0.92 1.72 0.64 151 XMGenDplmaNmb 2760 1.13 1.66 0.94 152 TR_XM_MaxBayes 2738 0.43 1.64 0.01 153 TR_XM_PHPDW 2737 0.70 1.64 0.36 154 TR_XM_PHPForged 2666 0.67 1.60 0.35 155 URI_NOVOWEL 2662 2.46 1.60 2.76 156 TR_XM_FormFill2 2636 0.67 1.58 0.34 157 XM_H_PHPOS 2626 0.66 1.58 0.34 158 RELAYCOUNTRY_GB 2624 1.05 1.57 0.87 159 FROM_MISSP_REPLYTO 2623 0.42 1.57 0.01 160 FROM_SUSPICIOUS_NTLD 2562 0.45 1.54 0.07 161 XMMoneyMeta_00 2525 0.75 1.52 0.48 162 TR_MetaPhish_Combo_01 2469 0.92 1.48 0.72 163 TR_XM_RelayPhish 2463 0.45 1.48 0.09 164 RCVD_IN_IADB_VOUCHED 2457 3.33 1.47 3.98 165 HDRS_MISSP 2434 0.41 1.46 0.05 166 TR_Caps_n_Bayes_99 2427 0.42 1.46 0.06 167 XMSubNoVowel 2427 1.11 1.46 0.99 168 XMBdyGiftCard01 2377 0.99 1.43 0.84 169 DATE_IN_PAST_03_06 2361 0.41 1.42 0.06 170 TR_Symld_Words 2330 1.81 1.40 1.95 171 URIBL_BLACK 2265 0.37 1.36 0.02 172 MIME_CHARSET_FARAWAY 2215 0.43 1.33 0.11 173 MIME_HEADER_CTYPE_ONLY 2199 0.40 1.32 0.08 174 XMHTML_After_End 2192 0.86 1.32 0.70 175 FROM_SUSPICIOUS_NTLD_FP 2192 0.39 1.32 0.07 176 HK_RANDOM_REPLYTO 2121 0.45 1.27 0.16 177 TR_XM_INV_DKIM 2108 0.45 1.27 0.17 178 MAILING_LIST_MULTI 2098 2.07 1.26 2.35 179 HTML_TAG_BALANCE_BODY 2063 0.71 1.24 0.52 180 STY_INVIS_DIRECT 2059 0.37 1.24 0.06 181 SUSP_UTF8_WORD_FROM 2052 0.37 1.23 0.06 182 ALL_TRUSTED 2037 9.22 1.22 12.03 183 DEAR_BENEFICIARY 2000 0.33 1.20 0.02 184 RCVD_DOTEDU_SUSP 1932 0.31 1.16 0.01 185 XM_OfRef7 1925 0.39 1.16 0.12 186 CHARSET_FARAWAY_HEADER 1892 0.31 1.14 0.02 187 FROM_MISSPACED 1857 0.30 1.11 0.01 188 RCVD_DOTEDU_SHORT 1846 0.30 1.11 0.02 189 XMPhish30 1799 0.78 1.08 0.68 190 LongTLD 1795 0.40 1.08 0.16 191 URI_NO_WWW_BIZ_CGI 1782 0.28 1.07 0.01 192 XM_SPF_Unknown 1744 0.74 1.05 0.63 193 BAYES_00 1726 11.10 1.04 14.63 194 DKIM_ADSP_CUSTOM_MED 1712 1.14 1.03 1.18 195 RCVD_IN_MSPIKE_H5 1706 1.89 1.02 2.20 196 HK_RANDOM_FROM 1694 0.37 1.02 0.14 197 RCVD_IN_IADB_OPTIN 1665 2.16 1.00 2.56 198 BAYES_05 1664 2.11 1.00 2.50 199 XM_UB95 1654 0.27 0.99 0.01 200 XM_PDF 1650 3.84 0.99 4.84 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 423842 90.47 93.46 89.41 2 RELAYCOUNTRY_US 397969 81.07 72.85 83.95 3 DKIM_SIGNED 362131 77.43 80.37 76.39 4 XM_DK_Pass 355812 75.91 78.33 75.06 5 DKIM_VALID 346768 74.02 76.51 73.15 6 XM_B_Unicode 329475 70.89 74.85 69.50 7 DCC_CHECK_NEGATIVE 283728 50.03 22.08 59.85 8 BAYES_50 260155 50.00 36.12 54.88 9 DKIM_VALID_AU 257032 55.22 58.08 54.22 10 XM_B_SpammyWords 233846 54.52 69.27 49.33 11 XMListUnsubscribeExists 232608 53.96 67.87 49.07 12 XM_B_Unicode3 195165 41.07 40.77 41.17 13 DCC_CHECK 180914 47.97 75.87 38.16 14 DKIM_VALID_EF 139474 28.88 27.35 29.42 15 T_TM2_M_HEADER_IN_MSG 136705 27.53 23.80 28.84 16 RCVD_IN_MSPIKE_WL 134602 25.71 18.06 28.40 17 HTML_FONT_LOW_CONTRAST 130089 28.91 33.07 27.44 18 RCVD_IN_MSPIKE_H2 129958 27.04 25.96 27.42 19 LOC_TINY_FONT_1 110635 25.96 33.41 23.34 20 MIME_HTML_ONLY 108723 25.49 32.76 22.94 21 XM_B_SpammyWords2 105457 26.67 39.24 22.25 22 XMSubLong 101868 22.27 24.49 21.49 23 FVGT_m_MULTI_ODD 100839 22.41 25.64 21.27 24 T_KAM_HTML_FONT_INVALID 87225 20.43 26.21 18.40 25 RCVD_IN_MSPIKE_H3 75077 14.24 9.70 15.84 26 BAYES_00 69362 11.10 1.04 14.63 27 XM_Body_Dirty_Words 59657 14.64 20.50 12.58 28 XM_B_Unsub 57909 11.93 11.13 12.22 29 ALL_TRUSTED 57035 9.22 1.22 12.03 30 XM_Multi_Part_URI 54632 12.90 16.81 11.52 31 RCVD_IN_MSPIKE_H4 49106 9.57 7.33 10.36 32 TR_XM_DK_Bayes 47049 7.51 0.65 9.93 33 TR_XM_DK_Bayes1 46101 7.36 0.63 9.73 34 TR_XM_DK_Bayes2 41401 6.61 0.58 8.73 35 XM_Evil_Numbers_Gen 41309 9.14 10.37 8.71 36 LotsOfNums_01 40966 9.04 10.17 8.64 37 LOTS_OF_MONEY 39398 9.51 12.94 8.31 38 UNPARSEABLE_RELAY 39191 7.53 5.43 8.27 39 XM_DKIMWhitelistDomains 37630 5.88 0.04 7.94 40 TooManyTo_001 37466 7.37 5.85 7.90 41 XM_SendGrid 36084 6.79 4.47 7.61 42 XM_DK_Undo_02 35087 17.21 45.10 7.40 43 IN_ZIMBRA_NJ_WHITELIST 35016 5.48 0.06 7.39 44 BAYES_60 34595 7.82 9.31 7.30 45 XM_B_Phish_Phrases 32749 7.95 10.90 6.91 46 HTML_IMAGE_RATIO_02 32296 7.27 8.55 6.81 47 FSL_BULK_SIG 30446 8.86 15.81 6.42 48 RCVD_IN_RP_SAFE 30371 5.83 4.18 6.41 49 MPART_ALT_DIFF 30338 6.83 8.05 6.40 50 HTML_IMAGE_RATIO_04 29728 6.13 5.73 6.27 51 RCVD_IN_IADB_LISTED 28919 5.22 2.72 6.10 52 MIME_QP_LONG_LINE 28191 5.18 2.99 5.95 53 RCVD_IN_RP_CERTIFIED 27389 5.18 3.46 5.78 54 XM_H_Long_From01 27018 5.85 6.28 5.70 55 TR_XM_DKIM_Undo 25992 13.74 37.22 5.48 56 RCVD_IN_IADB_SPF 24897 4.48 2.28 5.25 57 XM_B_SpammyWords3 23942 7.05 12.74 5.05 58 BAYES_40 23821 4.35 2.45 5.03 59 XMStrtUSub 23550 4.76 4.18 4.97 60 XM_PDF 22949 3.84 0.99 4.84 61 RELAYCOUNTRY_META 22852 9.88 24.27 4.82 62 BAYES_99 22644 12.56 34.72 4.78 63 TR_XM_DK_SendGrid 22397 4.13 2.44 4.72 64 RCVD_IN_IADB_SENDERID 22042 3.98 2.07 4.65 65 T_TooManySym_01 21998 4.18 2.86 4.64 66 RCVD_IN_IADB_DK 21226 3.84 2.03 4.48 67 MIME_HTML_ONLY_MULTI 20975 4.05 3.00 4.42 68 BOTNET_IPINHOSTNAME 20742 6.88 13.99 4.38 69 T_REMOTE_IMAGE 20725 5.91 10.27 4.37 70 BAYES_80 20501 5.49 8.82 4.32 71 XM_H_Trusted_IP 20336 3.17 0.00 4.29 72 RCVD_IN_IADB_VOUCHED 18868 3.33 1.47 3.98 73 HTML_IMAGE_RATIO_06 18674 3.98 4.10 3.94 74 BAYES_20 18550 3.39 1.90 3.91 75 XMSexyCombo_05 18260 5.60 10.55 3.85 76 BAYES_999 18085 9.88 27.12 3.82 77 TM2_M_URI_OPT_OUT 17259 3.46 2.94 3.64 78 XMSubMetaSx_00 16956 4.56 7.37 3.58 79 TR_XM_PhishingBody 15466 3.99 6.07 3.26 80 DKIM_INVALID 15363 3.40 3.87 3.24 81 XMNumbers 14963 3.37 3.98 3.16 82 XM_UncommonTLD01 14908 4.92 9.96 3.14 83 XM_B_Unsub2 13678 2.73 2.27 2.89 84 URI_NOVOWEL 13099 2.46 1.60 2.76 85 BAYES_95 12577 3.17 4.65 2.65 86 HTML_MIME_NO_HTML_TAG 12284 2.78 3.33 2.59 87 RCVD_IN_IADB_OPTIN 12143 2.16 1.00 2.56 88 BAYES_05 11828 2.11 1.00 2.50 89 FROM_EXCESS_BASE64 11512 2.50 2.70 2.43 90 HTML_IMAGE_RATIO_08 11473 2.38 2.25 2.42 91 MAILING_LIST_MULTI 11159 2.07 1.26 2.35 92 UNTRUSTED_Relay 11050 6.61 18.79 2.33 93 ANY_BOUNCE_MESSAGE 11011 1.93 0.82 2.32 94 BOUNCE_MESSAGE 11004 1.93 0.82 2.32 95 T_TooManySym_02 10703 1.82 0.57 2.26 96 LH_URI_DOM_IN_PATH 10553 2.49 3.24 2.23 97 RCVD_IN_MSPIKE_H5 10419 1.89 1.02 2.20 98 MIME_HTML_MOSTLY 10387 3.14 5.82 2.19 99 TR_XM_SB_Phish 10085 2.20 2.40 2.13 100 XMSubPhish11 9980 2.17 2.35 2.11 101 XM_B_SpammyTLD 9956 2.57 3.89 2.10 102 TR_DCC_Bayes_99 9945 8.18 25.48 2.10 103 XM_CamelCaseFrm001 9763 2.18 2.51 2.06 104 T_FONT_INVIS_NAKED_TO 9592 2.54 4.00 2.02 105 TooManyTo_002 9266 1.62 0.68 1.95 106 TR_Symld_Words 9259 1.81 1.40 1.95 107 XM_B_Phish66 8707 2.31 3.67 1.84 108 KHOP_HELO_FCRDNS 8635 3.13 6.84 1.82 109 XMDiploma_00 8527 2.04 2.71 1.80 110 HTML_FONT_FACE_BAD 8371 1.45 0.55 1.77 111 XM_SPF_SoftFail 8365 2.45 4.42 1.76 112 SUBJ_ALL_CAPS 8304 2.25 3.65 1.75 113 T_XMDrugObfuBody_14 8239 1.86 2.22 1.74 114 XM_DK_Undo_01 8146 1.82 2.12 1.72 115 T_XMDrugObfuBody_08 8123 2.06 3.06 1.71 116 TVD_RCVD_IP 7753 1.25 0.16 1.64 117 IN_HORDE_ADDRESS_BOOK 7716 1.24 0.16 1.63 118 HELO_NODOT 7354 1.38 0.90 1.55 119 HELO_NO_DOMAIN 7352 1.38 0.90 1.55 120 BOTNET 7348 5.39 16.30 1.55 121 INVALID_MSGID 7267 1.25 0.45 1.53 122 XM_B_COVIDMETA 6853 2.37 5.01 1.45 123 RELAYCOUNTRY_CA 6727 2.60 5.98 1.42 124 XMStockSpam_06 6542 1.49 1.81 1.38 125 XMGappySubj_01 6502 1.10 0.33 1.37 126 TO_MALFORMED 6426 1.01 0.02 1.36 127 RCVD_IN_BL_SPAMCOP_NET 6305 2.99 7.72 1.33 128 HELO_MISC_IP 6104 1.05 0.37 1.29 129 CK_HELO_DYNAMIC_SPLIT_IP 6095 1.07 0.45 1.29 130 XM_UB50 6029 2.68 6.68 1.27 131 TooManyTo_003 5968 1.06 0.51 1.26 132 URI_HEX 5840 1.81 3.44 1.23 133 TM2_M_VERY_LONG_WORD 5784 1.55 2.49 1.22 134 USER_IN_DEF_DKIM_WL 5635 0.89 0.04 1.19 135 DKIM_ADSP_CUSTOM_MED 5605 1.14 1.03 1.18 136 XMBSHREFv2 5582 0.94 0.26 1.18 137 XM_OfRef6 5540 1.97 4.26 1.17 138 XM_GoogleGroups 5309 0.95 0.45 1.12 139 XMCapTrack 5258 0.91 0.35 1.11 140 URI_TRY_3LD 5218 1.41 2.29 1.10 141 XM_H_Long_From02 4943 1.00 0.86 1.04 142 T_FILL_THIS_FORM_SHORT 4749 1.22 1.83 1.00 143 XMSubNoVowel 4676 1.11 1.46 0.99 144 TR_XM_SpammyWords2 4564 4.44 14.32 0.96 145 T_TooManySym_03 4493 0.74 0.13 0.95 146 XMGenDplmaNmb 4466 1.13 1.66 0.94 147 XMSexyCombo_01 4416 1.31 2.39 0.93 148 TR_MSPIKEBAYES00 4341 0.70 0.08 0.92 149 TooManyTo_004 4243 0.78 0.45 0.90 150 NML_ADSP_CUSTOM_MED 4114 0.87 0.87 0.87 151 RELAYCOUNTRY_GB 4102 1.05 1.57 0.87 152 XMBdyGiftCard01 3986 0.99 1.43 0.84 153 XMBrknScrpt_02 3906 1.75 4.40 0.82 154 XM_ProductURIs 3816 0.80 0.80 0.81 155 SpammyFromTLD_01 3786 1.75 4.46 0.80 156 HTTPS_HTTP_MISMATCH 3745 0.78 0.75 0.79 157 XMBody_95 3592 0.58 0.09 0.76 158 T_XMDrugObfuBody_00 3590 1.05 1.90 0.76 159 T_OBFU_PDF_ATTACH 3529 0.59 0.17 0.74 160 TR_MetaPhish_Combo_01 3430 0.92 1.48 0.72 161 XMBody_17 3397 1.51 3.76 0.72 162 TooManyTo_005 3331 0.61 0.36 0.70 163 XMHTML_After_End 3309 0.86 1.32 0.70 164 FROM_GOV_DKIM_AU 3258 0.57 0.25 0.69 165 XMPhish30 3229 0.78 1.08 0.68 166 XM_ShortIntro_01 3178 0.63 0.50 0.67 167 DIET_1 3026 0.92 1.72 0.64 168 XM_SPF_Unknown 2982 0.74 1.05 0.63 169 FORGED_GMAIL_RCVD 2894 0.65 0.77 0.61 170 TR_LOTS_OF_MONEY3 2892 1.07 2.38 0.61 171 HTML_IMAGE_ONLY_20 2880 0.51 0.25 0.61 172 TM2_M_A_HREF_HREF 2857 0.62 0.66 0.60 173 TR_XM_COVIDMETA1 2765 0.90 1.81 0.58 174 RCVD_IN_MSPIKE_BL 2674 2.47 7.89 0.56 175 DKIM_ADSP_NXDOMAIN 2672 0.87 1.74 0.56 176 T_TooManySym_04 2585 0.41 0.03 0.55 177 XM_H_PHPMailer 2566 0.55 0.58 0.54 178 XM_DIRTYINTL 2530 1.23 3.22 0.53 179 NUMERIC_HTTP_ADDR 2526 0.59 0.74 0.53 180 NO_DNS_FOR_FROM 2503 0.51 0.47 0.53 181 HTML_TAG_BALANCE_BODY 2455 0.71 1.24 0.52 182 XMSexyCombo_04 2429 0.59 0.82 0.51 183 XM_D_tchamptons_WL 2404 0.38 0.00 0.51 184 TM2_M_BODY_EMPTY 2361 0.38 0.06 0.50 185 XMHTMLBadTable_001 2350 0.54 0.65 0.50 186 XM_B_SpammyWords4 2347 0.88 1.99 0.50 187 XMNoVowels 2341 0.47 0.39 0.49 188 SENDGRID_REDIR 2328 0.51 0.57 0.49 189 XM_S_SubURI 2289 0.37 0.06 0.48 190 RDNS_DYNAMIC 2284 0.59 0.88 0.48 191 XMMoneyMeta_00 2265 0.75 1.52 0.48 192 HTML_IMAGE_ONLY_12 2261 2.13 6.84 0.48 193 T_Symld_Words_02 2256 0.50 0.55 0.48 194 T_XMHurry_00 2228 0.82 1.80 0.47 195 TR_XM_COVIDMETA4 2219 0.94 2.27 0.47 196 RCVD_IN_SORBS_DUL 2198 0.40 0.22 0.46 197 MISSING_HEADERS 2179 0.55 0.80 0.46 198 XM_B_COPY_HTML 2093 0.53 0.76 0.44 199 XMBody_78 2087 0.90 2.22 0.44 200 FROM_GOV_SPOOF 2060 0.37 0.18 0.43 ----------------------------------------------------------------------