Email: 713062 Autolearn: 0 AvgScore: 3.74 AvgScanTime: 1.43 sec Spam: 205897 Autolearn: 0 AvgScore: 14.02 AvgScanTime: 1.60 sec Ham: 507165 Autolearn: 0 AvgScore: -0.43 AvgScanTime: 1.36 sec Time Spent Running SA: 283.63 hours Time Spent Processing Spam: 91.53 hours Time Spent Processing Ham: 192.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 195194 89.30 94.80 87.06 2 DKIM_SIGNED 167979 75.98 81.58 73.71 3 XM_DK_Pass 161181 74.10 78.28 72.40 4 DCC_CHECK 160214 49.12 77.81 37.47 5 DKIM_VALID 157541 72.15 76.51 70.37 6 XM_B_Unicode 153684 70.02 74.64 68.14 7 RELAYCOUNTRY_US 147174 77.37 71.48 79.76 8 XMListUnsubscribeExists 137782 54.64 66.92 49.65 9 XM_B_SpammyWords 136221 53.37 66.16 48.18 10 DKIM_VALID_AU 120705 54.23 58.62 52.45 11 XM_DK_Undo_02 90245 17.29 43.83 6.51 12 XM_B_Unicode3 78481 39.13 38.12 39.54 13 XM_B_SpammyWords2 76451 26.66 37.13 22.40 14 BAYES_50 73489 50.45 35.69 56.44 15 HTML_FONT_LOW_CONTRAST 73236 29.07 35.57 26.43 16 TR_XM_DKIM_Undo 71121 13.66 34.54 5.18 17 LOC_TINY_FONT_1 68092 25.73 33.07 22.75 18 BAYES_99 66970 12.23 32.53 3.98 19 MIME_HTML_ONLY 63477 22.79 30.83 19.52 20 DKIM_VALID_EF 60051 28.53 29.17 28.27 21 RCVD_IN_MSPIKE_H2 56791 26.71 27.58 26.35 22 T_KAM_HTML_FONT_INVALID 56435 20.85 27.41 18.19 23 FVGT_m_MULTI_ODD 55996 23.44 27.20 21.92 24 RELAYCOUNTRY_META 54712 11.34 26.57 5.16 25 BAYES_999 51728 9.51 25.12 3.17 26 XMSubLong 51142 22.56 24.84 21.64 27 TR_DCC_Bayes_99 49892 8.33 24.23 1.88 28 T_TM2_M_HEADER_IN_MSG 46964 27.92 22.81 29.99 29 UNTRUSTED_Relay 42322 7.43 20.55 2.10 30 DCC_CHECK_NEGATIVE 42112 48.93 20.45 60.49 31 BOTNET 39043 6.65 18.96 1.66 32 XM_Body_Dirty_Words 37936 13.89 18.42 12.05 33 XM_Multi_Part_URI 37214 12.91 18.07 10.81 34 XM_B_Unsub 34170 11.78 16.60 9.83 35 RCVD_IN_MSPIKE_WL 33066 23.98 16.06 27.19 36 FSL_BULK_SIG 31380 7.61 15.24 4.51 37 LOTS_OF_MONEY 28253 9.66 13.72 8.01 38 BOTNET_IPINHOSTNAME 27917 7.10 13.56 4.48 39 XM_B_SpammyWords3 26239 7.47 12.74 5.33 40 TR_XM_SpammyWords2 25266 3.95 12.27 0.57 41 XMSexyCombo_05 23395 5.80 11.36 3.54 42 XM_UncommonTLD01 23006 5.63 11.17 3.38 43 XM_B_Phish_Phrases 22974 8.01 11.16 6.74 44 LotsOfNums_01 21125 9.12 10.26 8.66 45 RCVD_IN_MSPIKE_BL 20518 3.59 9.97 1.00 46 XM_Evil_Numbers_Gen 19598 7.79 9.52 7.09 47 BAYES_80 19340 5.90 9.39 4.48 48 MPART_ALT_DIFF 19165 6.06 9.31 4.74 49 RCVD_IN_MSPIKE_H3 18530 13.24 9.00 14.96 50 BAYES_60 17986 8.28 8.74 8.10 51 RCVD_IN_BL_SPAMCOP_NET 17355 3.15 8.43 1.01 52 XMSubMetaSx_00 17190 4.77 8.35 3.31 53 HTML_IMAGE_RATIO_02 15723 6.53 7.64 6.08 54 MIME_HTML_MOSTLY 15520 3.79 7.54 2.26 55 HTML_SHORT_LINK_IMG_1 15342 2.20 7.45 0.06 56 T_REMOTE_IMAGE 14469 4.43 7.03 3.38 57 RELAYCOUNTRY_FR 14143 2.22 6.87 0.33 58 XMBrknScrpt_02 13866 2.60 6.73 0.93 59 UNPARSEABLE_RELAY 13344 7.31 6.48 7.65 60 RCVD_IN_MSPIKE_H4 12833 8.66 6.23 9.64 61 TR_XM_SpammyWords3 12480 2.19 6.06 0.62 62 XM_UB50 12465 2.55 6.05 1.13 63 KHOP_HELO_FCRDNS 12236 2.86 5.94 1.60 64 TR_XM_PhishingBody 12185 3.92 5.92 3.11 65 RCVD_IN_MSPIKE_L3 11403 2.09 5.54 0.69 66 BAYES_95 11379 3.35 5.53 2.47 67 TooManyTo_001 11362 7.44 5.52 8.22 68 XM_SendGrid 11223 6.49 5.45 6.92 69 RELAYCOUNTRY_CA 11169 2.68 5.42 1.57 70 SpammyFromTLD_01 11011 2.29 5.35 1.06 71 BODY_URI_ONLY 10510 1.52 5.10 0.06 72 URIBL_SBL_A 10458 1.61 5.08 0.20 73 HTML_IMAGE_ONLY_12 10441 1.63 5.07 0.24 74 DKIM_INVALID 10438 3.84 5.07 3.33 75 XM_H_Long_From01 10432 5.29 5.07 5.39 76 XM_B_COVIDMETA 10030 2.25 4.87 1.18 77 HTML_IMAGE_RATIO_04 10005 5.23 4.86 5.39 78 RCVD_IN_RP_RNBL 9791 1.45 4.76 0.11 79 XM_OfRef6 9686 2.26 4.70 1.26 80 XMNumbers 9374 3.72 4.55 3.38 81 HTML_IMAGE_RATIO_06 8680 3.47 4.22 3.17 82 XM_UB99 8417 1.18 4.09 0.01 83 T_FONT_INVIS_NAKED_TO 8350 2.43 4.06 1.77 84 XM_SPF_SoftFail 8265 2.37 4.01 1.70 85 XM_DIRTYINTL 8260 1.56 4.01 0.56 86 HTML_MIME_NO_HTML_TAG 8092 2.68 3.93 2.17 87 BOTNET_NORDNS 7923 1.12 3.85 0.02 88 RCVD_IN_MSPIKE_L5 7796 1.24 3.79 0.20 89 XM_B_Phish66 7784 2.33 3.78 1.74 90 XM_UB60 7783 1.16 3.78 0.09 91 T_XMDrugObfuBody_08 7543 2.20 3.66 1.61 92 XMBody_17 7472 1.52 3.63 0.66 93 SpammyFromTLD_02 7328 1.25 3.56 0.32 94 XM_B_SpammyTLD 6932 2.45 3.37 2.08 95 TR_LOTS_OF_MONEY3 6796 1.35 3.30 0.56 96 US_DOLLARS_3 6764 1.64 3.29 0.97 97 TR_XM_DK_SendGrid 6752 3.85 3.28 4.09 98 XMStrtUSub 6735 4.07 3.27 4.39 99 LH_URI_DOM_IN_PATH 6292 2.23 3.06 1.89 100 HTML_IMAGE_RATIO_08 6264 2.90 3.04 2.85 101 XMSexyCombo_01 6242 1.25 3.03 0.53 102 TM2_M_VERY_LONG_WORD 6176 1.69 3.00 1.15 103 DKIM_ADSP_NXDOMAIN 6104 1.26 2.96 0.57 104 XM_UB999 6087 0.86 2.96 0.00 105 URI_HEX 6085 1.85 2.96 1.40 106 RCVD_IN_RP_SAFE 6054 5.69 2.94 6.81 107 BAYES_00 6052 10.49 2.94 13.56 108 TR_XM_MaxSPIKE 5892 0.85 2.86 0.03 109 XM_UB80 5820 0.84 2.83 0.04 110 TM2_M_URI_OPT_OUT 5810 2.99 2.82 3.06 111 RELAYCOUNTRY_UA 5800 0.83 2.82 0.03 112 MIME_QP_LONG_LINE 5624 5.06 2.73 6.00 113 XMDiploma_00 5441 2.18 2.64 1.99 114 FROM_EXCESS_BASE64 5335 2.29 2.59 2.17 115 SUBJ_ALL_CAPS 5325 2.05 2.59 1.83 116 HTML_IMAGE_ONLY_08 5299 0.83 2.57 0.12 117 RCVD_IN_PSBL 5206 0.73 2.53 0.01 118 URI_TRY_3LD 5122 1.76 2.49 1.47 119 TR_XM_MaxBayes 5035 0.71 2.45 0.01 120 URI_NOVOWEL 5029 2.57 2.44 2.63 121 HDRS_MISSP 4977 0.75 2.42 0.07 122 BAYES_40 4954 4.25 2.41 4.99 123 INVALID_DATE 4940 0.71 2.40 0.03 124 RCVD_IN_IADB_LISTED 4827 4.77 2.34 5.75 125 HDRS_LCASE_IMGONLY 4785 0.69 2.32 0.03 126 LOCALPART_IN_SUBJECT 4760 0.68 2.31 0.02 127 RCVD_DOTEDU_SHORT 4754 0.69 2.31 0.03 128 TR_XM_COVIDMETA4 4752 0.98 2.31 0.44 129 BOGUS_MIME_VERSION 4751 0.67 2.31 0.00 130 TO_NAME_SUBJ_NO_RDNS 4737 0.66 2.30 0.00 131 XM_CamelCaseFrm001 4695 1.84 2.28 1.66 132 XM_B_Unsub2 4678 2.26 2.27 2.25 133 T_TooManySym_01 4601 5.13 2.23 6.31 134 XMSlimDrugH 4542 0.89 2.21 0.36 135 HTML_FONT_SIZE_LARGE 4517 0.69 2.19 0.09 136 RCVD_IN_RP_CERTIFIED 4481 5.07 2.18 6.24 137 XM_B_SpammyWords4 4448 1.01 2.16 0.54 138 MIME_HTML_ONLY_MULTI 4342 2.83 2.11 3.12 139 RCVD_IN_IADB_SPF 4177 4.19 2.03 5.06 140 TR_XM_SB_Phish 4143 2.02 2.01 2.02 141 PDS_OTHER_BAD_TLD 4130 0.89 2.01 0.44 142 XMSexyCombo_04 4097 0.64 1.99 0.09 143 XM_DK_Undo_01 4075 1.82 1.98 1.76 144 XMSubPhish11 4028 1.98 1.96 1.99 145 TR_XM_UnparsRelay 3978 0.78 1.93 0.31 146 T_XMHurry_00 3942 0.92 1.91 0.52 147 RCVD_IN_IADB_SENDERID 3787 3.77 1.84 4.55 148 T_XMDrugObfuBody_14 3772 1.74 1.83 1.70 149 URI_PHP_REDIR 3754 0.53 1.82 0.00 150 RCVD_IN_IADB_DK 3752 3.67 1.82 4.43 151 MAILING_LIST_MULTI 3658 2.17 1.78 2.33 152 BAYES_20 3598 3.15 1.75 3.72 153 T_Symld_Words_02 3535 0.91 1.72 0.58 154 XM_UB95 3430 0.49 1.67 0.02 155 TR_XM_RelayPhish 3337 0.55 1.62 0.12 156 XM_URI_RBL 3308 0.64 1.61 0.24 157 TR_XM_COVIDMETA1 3276 0.64 1.59 0.25 158 XMStockSpam_06 3183 2.08 1.55 2.30 159 PDS_FROM_2_EMAILS 3162 0.47 1.54 0.03 160 FROM_2_EMAILS_SHORT 3105 0.44 1.51 0.00 161 TR_Symld_Words 3103 3.02 1.51 3.64 162 XMSubMetaSx_01 3049 0.47 1.48 0.06 163 RELAYCOUNTRY_IN 3025 0.53 1.47 0.15 164 NO_FM_NAME_IP_HOSTN 3012 0.42 1.46 0.00 165 XMBdyGiftCard01 2939 0.96 1.43 0.77 166 PDS_TO_EQ_FROM_NAME 2938 0.41 1.43 0.00 167 T_XMDrugObfuBody_00 2935 0.90 1.43 0.68 168 LONG_JUNK_URI 2929 0.44 1.42 0.05 169 FROM_SUSPICIOUS_NTLD 2893 0.45 1.41 0.07 170 RELAYCOUNTRY_GB 2872 1.08 1.39 0.95 171 FROM_SUSPICIOUS_NTLD_FP 2821 0.44 1.37 0.06 172 XMSexyCombo_02 2816 0.42 1.37 0.03 173 ALL_TRUSTED 2813 11.89 1.37 16.16 174 DKIM_ADSP_CUSTOM_MED 2808 1.24 1.36 1.19 175 DATE_IN_PAST_03_06 2789 0.47 1.35 0.11 176 TR_XM_PHPDW 2765 1.23 1.34 1.19 177 SHORT_URI 2742 0.40 1.33 0.03 178 SHORT_SHORTNER 2730 0.39 1.33 0.02 179 TR_XM_PHPForged 2715 1.21 1.32 1.16 180 XMMoneyMeta_00 2681 0.72 1.30 0.49 181 TR_XM_FormFill2 2672 1.20 1.30 1.16 182 XM_H_PHPOS 2666 1.19 1.29 1.15 183 RCVD_IN_IADB_VOUCHED 2622 2.82 1.27 3.45 184 NML_ADSP_CUSTOM_MED 2540 0.93 1.23 0.81 185 XMSubMetaI_00 2479 0.70 1.20 0.49 186 TR_XM_INV_DKIM 2464 0.43 1.20 0.12 187 FORGED_GMAIL_RCVD 2462 0.82 1.20 0.66 188 TR_MetaPhish_Combo_01 2405 0.82 1.17 0.67 189 T_FILL_THIS_FORM_SHORT 2403 0.93 1.17 0.84 190 XMGenDplmaNmb 2368 1.23 1.15 1.26 191 TM2_M_A_HREF_HREF 2291 0.67 1.11 0.49 192 XMHTML_After_End 2226 0.89 1.08 0.82 193 BAYES_05 2129 1.90 1.03 2.26 194 TR_XM_SpoofStaff 2125 0.35 1.03 0.07 195 TR_XM_DK_Bayes 2124 7.00 1.03 9.42 196 MIMEOLE_DIRECT_TO_MX 2110 0.30 1.02 0.00 197 HTML_TAG_BALANCE_BODY 2107 0.71 1.02 0.58 198 TR_Caps_n_Bayes_99 2106 0.38 1.02 0.12 199 MPART_ALT_DIFF_COUNT 2091 0.59 1.02 0.41 200 TR_XM_DK_Bayes1 2085 6.81 1.01 9.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 441548 89.30 94.80 87.06 2 RELAYCOUNTRY_US 404516 77.37 71.48 79.76 3 DKIM_SIGNED 373825 75.98 81.58 73.71 4 XM_DK_Pass 367187 74.10 78.28 72.40 5 DKIM_VALID 356916 72.15 76.51 70.37 6 XM_B_Unicode 345599 70.02 74.64 68.14 7 DCC_CHECK_NEGATIVE 306806 48.93 20.45 60.49 8 BAYES_50 286246 50.45 35.69 56.44 9 DKIM_VALID_AU 265988 54.23 58.62 52.45 10 XMListUnsubscribeExists 251812 54.64 66.92 49.65 11 XM_B_SpammyWords 244349 53.37 66.16 48.18 12 XM_B_Unicode3 200526 39.13 38.12 39.54 13 DCC_CHECK 190057 49.12 77.81 37.47 14 T_TM2_M_HEADER_IN_MSG 152109 27.92 22.81 29.99 15 DKIM_VALID_EF 143361 28.53 29.17 28.27 16 RCVD_IN_MSPIKE_WL 137895 23.98 16.06 27.19 17 HTML_FONT_LOW_CONTRAST 134030 29.07 35.57 26.43 18 RCVD_IN_MSPIKE_H2 133648 26.71 27.58 26.35 19 LOC_TINY_FONT_1 115360 25.73 33.07 22.75 20 XM_B_SpammyWords2 113630 26.66 37.13 22.40 21 FVGT_m_MULTI_ODD 111159 23.44 27.20 21.92 22 XMSubLong 109744 22.56 24.84 21.64 23 MIME_HTML_ONLY 99000 22.79 30.83 19.52 24 T_KAM_HTML_FONT_INVALID 92270 20.85 27.41 18.19 25 ALL_TRUSTED 81975 11.89 1.37 16.16 26 RCVD_IN_MSPIKE_H3 75862 13.24 9.00 14.96 27 BAYES_00 68754 10.49 2.94 13.56 28 XM_Body_Dirty_Words 61099 13.89 18.42 12.05 29 XM_Multi_Part_URI 54815 12.91 18.07 10.81 30 XM_B_Unsub 49833 11.78 16.60 9.83 31 RCVD_IN_MSPIKE_H4 48892 8.66 6.23 9.64 32 TR_XM_DK_Bayes 47775 7.00 1.03 9.42 33 TR_XM_DK_Bayes1 46442 6.81 1.01 9.16 34 LotsOfNums_01 43914 9.12 10.26 8.66 35 TooManyTo_001 41666 7.44 5.52 8.22 36 BAYES_60 41064 8.28 8.74 8.10 37 TR_XM_DK_Bayes2 40898 5.99 0.88 8.06 38 LOTS_OF_MONEY 40629 9.66 13.72 8.01 39 UNPARSEABLE_RELAY 38773 7.31 6.48 7.65 40 XM_DKIMWhitelistDomains 38467 5.40 0.01 7.58 41 XM_Evil_Numbers_Gen 35946 7.79 9.52 7.09 42 XM_SendGrid 35079 6.49 5.45 6.92 43 RCVD_IN_RP_SAFE 34531 5.69 2.94 6.81 44 XM_B_Phish_Phrases 34162 8.01 11.16 6.74 45 XM_DK_Undo_02 33039 17.29 43.83 6.51 46 T_TooManySym_01 32008 5.13 2.23 6.31 47 IN_ZIMBRA_NJ_WHITELIST 31665 4.47 0.11 6.24 48 RCVD_IN_RP_CERTIFIED 31639 5.07 2.18 6.24 49 HTML_IMAGE_RATIO_02 30841 6.53 7.64 6.08 50 MIME_QP_LONG_LINE 30438 5.06 2.73 6.00 51 RCVD_IN_IADB_LISTED 29173 4.77 2.34 5.75 52 HTML_IMAGE_RATIO_04 27323 5.23 4.86 5.39 53 XM_H_Long_From01 27319 5.29 5.07 5.39 54 XM_B_SpammyWords3 27014 7.47 12.74 5.33 55 TR_XM_DKIM_Undo 26283 13.66 34.54 5.18 56 RELAYCOUNTRY_META 26177 11.34 26.57 5.16 57 RCVD_IN_IADB_SPF 25687 4.19 2.03 5.06 58 BAYES_40 25317 4.25 2.41 4.99 59 MPART_ALT_DIFF 24023 6.06 9.31 4.74 60 RCVD_IN_IADB_SENDERID 23084 3.77 1.84 4.55 61 FSL_BULK_SIG 22882 7.61 15.24 4.51 62 BOTNET_IPINHOSTNAME 22713 7.10 13.56 4.48 63 BAYES_80 22698 5.90 9.39 4.48 64 RCVD_IN_IADB_DK 22448 3.67 1.82 4.43 65 XMStrtUSub 22284 4.07 3.27 4.39 66 XM_PDF 22232 3.37 0.88 4.38 67 TR_XM_DK_SendGrid 20728 3.85 3.28 4.09 68 BAYES_99 20204 12.23 32.53 3.98 69 BAYES_20 18881 3.15 1.75 3.72 70 TR_Symld_Words 18440 3.02 1.51 3.64 71 XMSexyCombo_05 17970 5.80 11.36 3.54 72 RCVD_IN_IADB_VOUCHED 17508 2.82 1.27 3.45 73 T_REMOTE_IMAGE 17143 4.43 7.03 3.38 74 XMNumbers 17131 3.72 4.55 3.38 75 XM_UncommonTLD01 17129 5.63 11.17 3.38 76 DKIM_INVALID 16909 3.84 5.07 3.33 77 XMSubMetaSx_00 16812 4.77 8.35 3.31 78 BAYES_999 16069 9.51 25.12 3.17 79 HTML_IMAGE_RATIO_06 16058 3.47 4.22 3.17 80 MIME_HTML_ONLY_MULTI 15818 2.83 2.11 3.12 81 TR_XM_PhishingBody 15765 3.92 5.92 3.11 82 TM2_M_URI_OPT_OUT 15502 2.99 2.82 3.06 83 XM_H_Trusted_IP 14610 2.05 0.00 2.88 84 HTML_IMAGE_RATIO_08 14448 2.90 3.04 2.85 85 URI_NOVOWEL 13322 2.57 2.44 2.63 86 RCVD_IN_MSPIKE_H5 13141 2.08 0.83 2.59 87 BAYES_95 12541 3.35 5.53 2.47 88 ANY_BOUNCE_MESSAGE 11988 1.86 0.63 2.36 89 BOUNCE_MESSAGE 11987 1.86 0.63 2.36 90 MAILING_LIST_MULTI 11826 2.17 1.78 2.33 91 XMStockSpam_06 11647 2.08 1.55 2.30 92 MIME_HTML_MOSTLY 11487 3.79 7.54 2.26 93 BAYES_05 11441 1.90 1.03 2.26 94 XM_B_Unsub2 11412 2.26 2.27 2.25 95 RCVD_IN_IADB_OPTIN 11168 1.85 0.97 2.20 96 T_TooManySym_02 11078 1.73 0.61 2.18 97 HTML_MIME_NO_HTML_TAG 10998 2.68 3.93 2.17 98 FROM_EXCESS_BASE64 10987 2.29 2.59 2.17 99 TooManyTo_002 10969 1.72 0.63 2.16 100 UNTRUSTED_Relay 10651 7.43 20.55 2.10 101 XM_B_SpammyTLD 10528 2.45 3.37 2.08 102 TR_XM_SB_Phish 10257 2.02 2.01 2.02 103 XMSubPhish11 10104 1.98 1.96 1.99 104 XMDiploma_00 10082 2.18 2.64 1.99 105 FORGED_MUA_OUTLOOK 9953 1.47 0.25 1.96 106 LH_URI_DOM_IN_PATH 9589 2.23 3.06 1.89 107 TR_DCC_Bayes_99 9523 8.33 24.23 1.88 108 SUBJ_ALL_CAPS 9258 2.05 2.59 1.83 109 HELO_NODOT 9179 1.55 0.90 1.81 110 HELO_NO_DOMAIN 9174 1.55 0.90 1.81 111 T_FONT_INVIS_NAKED_TO 9002 2.43 4.06 1.77 112 XM_DK_Undo_01 8917 1.82 1.98 1.76 113 XM_B_Phish66 8833 2.33 3.78 1.74 114 T_XMDrugObfuBody_14 8619 1.74 1.83 1.70 115 XM_SPF_SoftFail 8606 2.37 4.01 1.70 116 XM_CamelCaseFrm001 8434 1.84 2.28 1.66 117 BOTNET 8409 6.65 18.96 1.66 118 T_XMDrugObfuBody_08 8145 2.20 3.66 1.61 119 KHOP_HELO_FCRDNS 8124 2.86 5.94 1.60 120 INVALID_MSGID 7961 1.20 0.27 1.57 121 RELAYCOUNTRY_CA 7955 2.68 5.42 1.57 122 IN_HORDE_ADDRESS_BOOK 7660 1.17 0.34 1.51 123 XM_ProductURIs 7447 1.28 0.82 1.47 124 URI_TRY_3LD 7445 1.76 2.49 1.47 125 TVD_RCVD_IP 7367 1.12 0.29 1.45 126 URI_HEX 7097 1.85 2.96 1.40 127 TooManyTo_003 7023 1.12 0.46 1.38 128 XM_H_Long_From02 6679 1.14 0.69 1.32 129 USER_IN_DEF_DKIM_WL 6525 0.92 0.02 1.29 130 TO_MALFORMED 6520 0.92 0.01 1.29 131 XM_OfRef6 6406 2.26 4.70 1.26 132 XMGenDplmaNmb 6384 1.23 1.15 1.26 133 XMGappySubj_01 6258 1.00 0.43 1.23 134 XMCapTrack 6056 0.94 0.31 1.19 135 TR_XM_PHPDW 6031 1.23 1.34 1.19 136 DKIM_ADSP_CUSTOM_MED 6012 1.24 1.36 1.19 137 XM_B_COVIDMETA 5981 2.25 4.87 1.18 138 TR_XM_PHPForged 5891 1.21 1.32 1.16 139 TR_XM_FormFill2 5890 1.20 1.30 1.16 140 HTML_FONT_FACE_BAD 5871 1.00 0.62 1.16 141 HELO_MISC_IP 5846 0.91 0.31 1.15 142 XM_H_PHPOS 5845 1.19 1.29 1.15 143 TM2_M_VERY_LONG_WORD 5844 1.69 3.00 1.15 144 CK_HELO_DYNAMIC_SPLIT_IP 5838 0.98 0.57 1.15 145 XM_UB50 5715 2.55 6.05 1.13 146 XM_GoogleGroups 5649 0.91 0.41 1.11 147 XMSubNoVowel 5499 1.06 1.00 1.08 148 SpammyFromTLD_01 5351 2.29 5.35 1.06 149 RCVD_IN_BL_SPAMCOP_NET 5126 3.15 8.43 1.01 150 RCVD_IN_MSPIKE_BL 5070 3.59 9.97 1.00 151 XMBSHREFv2 4981 0.77 0.25 0.98 152 US_DOLLARS_3 4940 1.64 3.29 0.97 153 TooManyTo_004 4935 0.80 0.36 0.97 154 RELAYCOUNTRY_GB 4810 1.08 1.39 0.95 155 XMBrknScrpt_02 4695 2.60 6.73 0.93 156 XM_ShortIntro_01 4618 0.82 0.61 0.91 157 T_TooManySym_03 4407 0.66 0.16 0.87 158 FROM_GOV_DKIM_AU 4401 0.66 0.14 0.87 159 T_FILL_THIS_FORM_SHORT 4250 0.93 1.17 0.84 160 XMNoVowels 4152 0.67 0.29 0.82 161 XMHTML_After_End 4148 0.89 1.08 0.82 162 NML_ADSP_CUSTOM_MED 4113 0.93 1.23 0.81 163 HTTPS_HTTP_MISMATCH 4063 0.80 0.80 0.80 164 XMBody_95 4023 0.58 0.06 0.79 165 TR_MSPIKEBAYES00 3953 0.56 0.01 0.78 166 XMBdyGiftCard01 3911 0.96 1.43 0.77 167 TooManyTo_005 3891 0.63 0.30 0.77 168 HTML_IMAGE_ONLY_20 3890 0.69 0.49 0.77 169 RCVD_IN_MSPIKE_L3 3500 2.09 5.54 0.69 170 T_XMDrugObfuBody_00 3451 0.90 1.43 0.68 171 TR_MetaPhish_Combo_01 3411 0.82 1.17 0.67 172 FORGED_GMAIL_RCVD 3369 0.82 1.20 0.66 173 XMBody_17 3347 1.52 3.63 0.66 174 XM_SPF_Unknown 3211 0.68 0.80 0.63 175 NUMERIC_HTTP_ADDR 3175 0.65 0.72 0.63 176 TR_XM_SpammyWords3 3134 2.19 6.06 0.62 177 MISSING_HEADERS 3122 0.57 0.44 0.62 178 XM_H_PHPMailer 3104 0.59 0.53 0.61 179 T_OBFU_PDF_ATTACH 3090 0.48 0.15 0.61 180 T_Symld_Words_02 2957 0.91 1.72 0.58 181 HTML_TAG_BALANCE_BODY 2932 0.71 1.02 0.58 182 TR_XM_SpammyWords2 2894 3.95 12.27 0.57 183 DKIM_ADSP_NXDOMAIN 2889 1.26 2.96 0.57 184 XM_DIRTYINTL 2856 1.56 4.01 0.56 185 XMPhish08 2848 0.58 0.64 0.56 186 TR_LOTS_OF_MONEY3 2815 1.35 3.30 0.56 187 XMHTMLBadTable_001 2754 0.54 0.53 0.54 188 XM_B_SpammyWords4 2720 1.01 2.16 0.54 189 XMSexyCombo_01 2698 1.25 3.03 0.53 190 XMSubMetaSxObfu_03 2676 0.60 0.77 0.53 191 T_XMHurry_00 2642 0.92 1.91 0.52 192 RELAYCOUNTRY_DE 2573 0.51 0.52 0.51 193 SHORT_HELO_AND_INLINE_IMAGE 2565 0.45 0.30 0.51 194 T_TooManySym_04 2536 0.37 0.05 0.50 195 XMSubMetaI_00 2508 0.70 1.20 0.49 196 TM2_M_A_HREF_HREF 2481 0.67 1.11 0.49 197 XMMoneyMeta_00 2467 0.72 1.30 0.49 198 RCVD_IN_SORBS_DUL 2463 0.48 0.48 0.49 199 NO_DNS_FOR_FROM 2425 0.49 0.51 0.48 200 PLING_QUERY 2416 0.52 0.62 0.48 ----------------------------------------------------------------------