Email: 729870 Autolearn: 0 AvgScore: 3.28 AvgScanTime: 1.30 sec Spam: 213238 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 1.42 sec Ham: 516632 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.26 sec Time Spent Running SA: 264.56 hours Time Spent Processing Spam: 84.35 hours Time Spent Processing Ham: 180.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204219 91.00 95.77 89.03 2 DKIM_SIGNED 181979 78.98 85.34 76.36 3 XM_DK_Pass 177392 77.52 83.19 75.18 4 DKIM_VALID 173320 75.49 81.28 73.10 5 DCC_CHECK 166649 51.89 78.15 41.06 6 XM_B_Unicode 165901 74.15 77.80 72.64 7 RELAYCOUNTRY_US 160028 81.48 75.05 84.13 8 XMListUnsubscribeExists 149632 56.22 70.17 50.47 9 XM_B_SpammyWords 147903 55.20 69.36 49.36 10 DKIM_VALID_AU 132256 57.10 62.02 55.08 11 XM_DK_Undo_02 99295 19.05 46.57 7.69 12 XM_B_SpammyWords2 87795 27.36 41.17 21.67 13 XM_B_Unicode3 80503 40.52 37.75 41.66 14 TR_XM_DKIM_Undo 78745 14.74 36.93 5.58 15 BAYES_99 77894 13.81 36.53 4.44 16 HTML_FONT_LOW_CONTRAST 77457 30.15 36.32 27.60 17 BAYES_50 75186 48.87 35.26 54.49 18 LOC_TINY_FONT_1 73943 26.92 34.68 23.71 19 DKIM_VALID_EF 64622 28.98 30.31 28.43 20 MIME_HTML_ONLY 61768 24.55 28.97 22.73 21 BAYES_999 60929 10.82 28.57 3.49 22 TR_DCC_Bayes_99 59036 9.60 27.69 2.14 23 RCVD_IN_MSPIKE_H2 58994 27.22 27.67 27.04 24 FVGT_m_MULTI_ODD 58320 23.72 27.35 22.23 25 T_KAM_HTML_FONT_INVALID 56335 21.16 26.42 18.99 26 XMSubLong 51766 21.99 24.28 21.04 27 RELAYCOUNTRY_META 50035 10.26 23.46 4.81 28 T_TM2_M_HEADER_IN_MSG 44588 26.44 20.91 28.72 29 XM_Multi_Part_URI 44313 13.97 20.78 11.16 30 DCC_CHECK_NEGATIVE 43093 46.17 20.21 56.88 31 XM_Body_Dirty_Words 41562 14.54 19.49 12.50 32 UNTRUSTED_Relay 35772 6.26 16.78 1.92 33 RCVD_IN_MSPIKE_WL 34203 24.51 16.04 28.00 34 BOTNET 32162 5.77 15.08 1.93 35 TR_XM_SpammyWords2 32112 4.90 15.06 0.70 36 LOTS_OF_MONEY 31519 9.90 14.78 7.89 37 BOTNET_IPINHOSTNAME 29910 7.42 14.03 4.70 38 XM_B_Unsub 29906 12.57 14.02 11.97 39 FSL_BULK_SIG 27228 7.90 12.77 5.90 40 XM_B_SpammyWords3 27156 7.80 12.74 5.77 41 LotsOfNums_01 24379 9.56 11.43 8.79 42 XM_UncommonTLD01 24347 5.49 11.42 3.04 43 XMSexyCombo_05 23257 5.66 10.91 3.49 44 RCVD_IN_MSPIKE_BL 20404 3.27 9.57 0.68 45 BAYES_80 20043 5.75 9.40 4.25 46 RCVD_IN_MSPIKE_H3 19267 13.49 9.04 15.32 47 XM_Evil_Numbers_Gen 19122 8.28 8.97 7.99 48 XM_B_Phish_Phrases 18593 8.70 8.72 8.69 49 MPART_ALT_DIFF 18465 7.43 8.66 6.93 50 HTML_IMAGE_RATIO_02 17495 7.07 8.20 6.60 51 T_REMOTE_IMAGE 17464 4.93 8.19 3.59 52 MIME_HTML_MOSTLY 17288 4.06 8.11 2.38 53 XMBrknScrpt_02 17107 3.08 8.02 1.04 54 BAYES_60 16956 7.44 7.95 7.22 55 XMSubMetaSx_00 16321 4.57 7.65 3.30 56 RCVD_IN_BL_SPAMCOP_NET 15773 3.23 7.40 1.51 57 TR_XM_SpammyWords3 14681 2.34 6.88 0.47 58 HTML_IMAGE_RATIO_06 14618 4.54 6.86 3.58 59 TooManyTo_001 14351 7.54 6.73 7.87 60 UNPARSEABLE_RELAY 14189 7.76 6.65 8.22 61 RCVD_IN_MSPIKE_L3 14019 2.28 6.57 0.51 62 TR_XM_PhishingBody 13819 4.01 6.48 2.98 63 XM_UB50 13269 2.55 6.22 1.04 64 RCVD_IN_MSPIKE_H4 13266 8.85 6.22 9.94 65 KHOP_HELO_FCRDNS 12960 2.89 6.08 1.58 66 RELAYCOUNTRY_CA 12768 2.86 5.99 1.57 67 URIBL_SBL_A 12544 1.89 5.88 0.24 68 BODY_URI_ONLY 12276 1.72 5.76 0.06 69 HTML_IMAGE_RATIO_04 11949 5.71 5.60 5.75 70 HTML_SHORT_LINK_IMG_1 11937 1.67 5.60 0.05 71 HTML_IMAGE_ONLY_12 11694 1.76 5.48 0.22 72 XM_SendGrid 11632 6.92 5.45 7.52 73 BAYES_95 11530 3.46 5.41 2.65 74 SpammyFromTLD_01 10832 2.08 5.08 0.84 75 XMNumbers 9883 3.41 4.63 2.90 76 XM_H_Long_From01 9855 5.18 4.62 5.41 77 RELAYCOUNTRY_FR 9361 1.50 4.39 0.30 78 XM_DIRTYINTL 9284 1.60 4.35 0.47 79 T_FONT_INVIS_NAKED_TO 9074 2.53 4.26 1.82 80 XM_OfRef6 8776 2.28 4.12 1.52 81 XM_B_Phish66 8756 2.48 4.11 1.81 82 DKIM_INVALID 8659 3.49 4.06 3.26 83 URI_HEX 8460 2.14 3.97 1.39 84 T_XMDrugObfuBody_08 8348 2.34 3.91 1.69 85 XM_UB99 7970 1.09 3.74 0.00 86 XM_SPF_SoftFail 7565 2.27 3.55 1.74 87 HTML_IMAGE_RATIO_08 7499 2.96 3.52 2.73 88 XM_B_COVIDMETA 7446 1.87 3.49 1.20 89 US_DOLLARS_3 7383 1.71 3.46 0.99 90 TR_LOTS_OF_MONEY3 7191 1.45 3.37 0.65 91 SpammyFromTLD_02 7188 1.18 3.37 0.27 92 TR_XM_MaxBayes 7118 0.99 3.34 0.02 93 XMStrtUSub 7107 4.69 3.33 5.26 94 XM_B_SpammyTLD 6984 2.26 3.28 1.84 95 XMBody_17 6947 1.46 3.26 0.72 96 TR_XM_MaxSPIKE 6906 0.96 3.24 0.02 97 XMDiploma_00 6661 2.22 3.12 1.85 98 TR_XM_DK_SendGrid 6585 4.19 3.09 4.64 99 URI_TRY_3LD 6455 1.87 3.03 1.39 100 TM2_M_URI_OPT_OUT 6306 4.19 2.96 4.70 101 RCVD_IN_RP_SAFE 6228 5.61 2.92 6.72 102 RCVD_IN_RP_RNBL 5987 0.85 2.81 0.04 103 XM_UB999 5896 0.81 2.76 0.00 104 LH_URI_DOM_IN_PATH 5864 2.14 2.75 1.89 105 RELAYCOUNTRY_UA 5818 0.81 2.73 0.01 106 XM_UB60 5802 0.86 2.72 0.10 107 MIME_QP_LONG_LINE 5783 4.68 2.71 5.49 108 XMSexyCombo_01 5776 1.23 2.71 0.61 109 T_XMHurry_00 5561 1.21 2.61 0.63 110 RCVD_IN_IADB_LISTED 5220 4.96 2.45 6.00 111 TR_XM_SB_Phish 5211 2.90 2.44 3.08 112 HTML_FONT_SIZE_LARGE 5067 0.85 2.38 0.22 113 XM_UB80 5039 0.71 2.36 0.03 114 RCVD_IN_RP_CERTIFIED 4976 5.06 2.33 6.19 115 FROM_EXCESS_BASE64 4963 2.91 2.33 3.14 116 RELAYCOUNTRY_IN 4900 0.75 2.30 0.11 117 RCVD_IN_MSPIKE_L5 4805 0.73 2.25 0.10 118 T_TooManySym_01 4769 3.79 2.24 4.43 119 TM2_M_VERY_LONG_WORD 4690 1.53 2.20 1.25 120 XM_CamelCaseFrm001 4636 1.90 2.17 1.79 121 MIME_HTML_ONLY_MULTI 4556 4.09 2.14 4.89 122 SUBJ_ALL_CAPS 4494 1.81 2.11 1.69 123 T_XMDrugObfuBody_14 4431 1.86 2.08 1.77 124 RCVD_IN_IADB_SPF 4405 4.31 2.07 5.23 125 TR_XM_COVIDMETA4 4344 0.84 2.04 0.35 126 TR_XM_UnparsRelay 4314 0.99 2.02 0.56 127 XM_B_SpammyWords4 4287 1.02 2.01 0.61 128 BAYES_40 4230 4.07 1.98 4.93 129 XMSubPhish11 4087 2.71 1.92 3.04 130 XM_B_Unsub2 4031 2.08 1.89 2.16 131 PDS_OTHER_BAD_TLD 3994 0.91 1.87 0.52 132 XMGenDplmaNmb 3990 1.16 1.87 0.87 133 RCVD_IN_IADB_SENDERID 3974 3.86 1.86 4.69 134 RCVD_IN_IADB_DK 3900 3.75 1.83 4.54 135 XM_DK_Undo_01 3680 1.63 1.73 1.59 136 TR_XM_COVIDMETA1 3578 0.71 1.68 0.32 137 XMStockSpam_06 3576 1.13 1.68 0.90 138 TR_Symld_Words 3455 1.72 1.62 1.76 139 BOTNET_NORDNS 3416 0.48 1.60 0.02 140 T_FILL_THIS_FORM_SHORT 3413 1.15 1.60 0.97 141 MAILING_LIST_MULTI 3375 2.20 1.58 2.45 142 XM_URI_RBL 3363 0.59 1.58 0.19 143 XM_H_Long_From02 3318 1.37 1.56 1.30 144 XMMoneyMeta_00 3243 0.86 1.52 0.59 145 BAYES_20 3196 3.05 1.50 3.69 146 HTML_MIME_NO_HTML_TAG 3178 1.92 1.49 2.09 147 RCVD_IN_IADB_VOUCHED 3153 3.08 1.48 3.73 148 RCVD_IN_PSBL 3144 0.45 1.47 0.03 149 XMSubMetaSxObfu_03 3076 0.66 1.44 0.33 150 URI_NOVOWEL 3065 2.32 1.44 2.68 151 FROM_SUSPICIOUS_NTLD 3022 0.47 1.42 0.08 152 FROM_SUSPICIOUS_NTLD_FP 2926 0.45 1.37 0.07 153 XM_Combo_Sbj 2911 0.59 1.37 0.27 154 TR_XM_RelayPhish 2882 0.49 1.35 0.13 155 TR_XM_PHPDW 2860 0.64 1.34 0.35 156 T_XMDrugObfuBody_00 2849 0.90 1.34 0.72 157 TR_XM_PHPForged 2848 0.61 1.34 0.31 158 TR_XM_FormFill2 2804 0.60 1.31 0.31 159 XM_H_PHPOS 2797 0.60 1.31 0.30 160 XMSlimDrugH 2789 0.57 1.31 0.27 161 RELAYCOUNTRY_GB 2739 1.04 1.28 0.93 162 XMSexyCombo_04 2701 0.43 1.27 0.08 163 XM_UB95 2661 0.37 1.25 0.01 164 XMBdyGiftCard01 2651 0.87 1.24 0.72 165 TR_XM_INV_DKIM 2522 0.41 1.18 0.09 166 REMOVE_BEFORE_LINK 2478 0.57 1.16 0.32 167 ALL_TRUSTED 2462 8.94 1.15 12.15 168 LongTLD 2453 0.46 1.15 0.17 169 XMSubNoVowel 2434 1.48 1.14 1.62 170 XMHTML_After_End 2430 0.87 1.14 0.76 171 XMBody_78 2412 0.62 1.13 0.41 172 T_Symld_Words_02 2376 0.75 1.11 0.60 173 RCVD_IN_IADB_OPTIN 2325 2.04 1.09 2.43 174 BAYES_05 2126 1.95 1.00 2.34 175 MIME_CHARSET_FARAWAY 2113 0.40 0.99 0.16 176 BAYES_00 2075 11.60 0.97 15.98 177 TR_BOTNET_NEGATE 2061 0.54 0.97 0.36 178 SUBJ_BUY 2029 0.33 0.95 0.08 179 XM_S_SpammyWords 2019 0.59 0.95 0.44 180 TR_XM_Spammywords 2019 0.59 0.95 0.44 181 HTTPS_HTTP_MISMATCH 1930 0.96 0.91 0.98 182 RELAYCOUNTRY_DE 1915 0.62 0.90 0.51 183 XMPhish30 1894 0.54 0.89 0.40 184 XM_SPF_Unknown 1850 0.66 0.87 0.58 185 XMSubMetaI_00 1845 0.65 0.87 0.56 186 XM_ProductURIs 1844 1.09 0.86 1.18 187 XMSubMetaSSx_00 1835 0.38 0.86 0.18 188 DIET_1 1824 0.48 0.86 0.33 189 TR_Mismatch_TLD_02 1812 0.31 0.85 0.08 190 URI_PHP_REDIR 1809 0.25 0.85 0.01 191 XM_PDF 1808 3.42 0.85 4.48 192 CHARSET_FARAWAY_HEADER 1764 0.28 0.83 0.05 193 HTML_TAG_BALANCE_BODY 1761 0.59 0.83 0.49 194 SENDGRID_REDIR 1754 0.56 0.82 0.46 195 RELAYCOUNTRY_NL 1748 0.35 0.82 0.16 196 TR_XM_FormFill 1699 0.24 0.80 0.01 197 XMGppyBdWords 1698 0.39 0.80 0.22 198 RCVD_IN_MSPIKE_H5 1670 2.17 0.78 2.74 199 HTML_IMAGE_ONLY_16 1669 0.41 0.78 0.25 200 TVD_SPACE_RATIO_MINFP 1663 0.23 0.78 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 459980 91.00 95.77 89.03 2 RELAYCOUNTRY_US 434667 81.48 75.05 84.13 3 DKIM_SIGNED 394483 78.98 85.34 76.36 4 XM_DK_Pass 388426 77.52 83.19 75.18 5 DKIM_VALID 377656 75.49 81.28 73.10 6 XM_B_Unicode 375301 74.15 77.80 72.64 7 DCC_CHECK_NEGATIVE 293878 46.17 20.21 56.88 8 DKIM_VALID_AU 284536 57.10 62.02 55.08 9 BAYES_50 281499 48.87 35.26 54.49 10 XMListUnsubscribeExists 260725 56.22 70.17 50.47 11 XM_B_SpammyWords 255008 55.20 69.36 49.36 12 XM_B_Unicode3 215222 40.52 37.75 41.66 13 DCC_CHECK 212104 51.89 78.15 41.06 14 T_TM2_M_HEADER_IN_MSG 148354 26.44 20.91 28.72 15 DKIM_VALID_EF 146864 28.98 30.31 28.43 16 RCVD_IN_MSPIKE_WL 144669 24.51 16.04 28.00 17 HTML_FONT_LOW_CONTRAST 142606 30.15 36.32 27.60 18 RCVD_IN_MSPIKE_H2 139706 27.22 27.67 27.04 19 LOC_TINY_FONT_1 122511 26.92 34.68 23.71 20 MIME_HTML_ONLY 117406 24.55 28.97 22.73 21 FVGT_m_MULTI_ODD 114823 23.72 27.35 22.23 22 XM_B_SpammyWords2 111933 27.36 41.17 21.67 23 XMSubLong 108697 21.99 24.28 21.04 24 T_KAM_HTML_FONT_INVALID 98104 21.16 26.42 18.99 25 BAYES_00 82573 11.60 0.97 15.98 26 RCVD_IN_MSPIKE_H3 79166 13.49 9.04 15.32 27 XM_Body_Dirty_Words 64554 14.54 19.49 12.50 28 ALL_TRUSTED 62757 8.94 1.15 12.15 29 XM_B_Unsub 61839 12.57 14.02 11.97 30 XM_Multi_Part_URI 57631 13.97 20.78 11.16 31 TR_XM_DK_Bayes 53884 7.60 0.76 10.43 32 TR_XM_DK_Bayes1 52315 7.38 0.74 10.13 33 RCVD_IN_MSPIKE_H4 51354 8.85 6.22 9.94 34 XM_DKIMWhitelistDomains 47908 6.59 0.10 9.27 35 TR_XM_DK_Bayes2 46819 6.61 0.67 9.06 36 LotsOfNums_01 45407 9.56 11.43 8.79 37 XM_B_Phish_Phrases 44915 8.70 8.72 8.69 38 UNPARSEABLE_RELAY 42479 7.76 6.65 8.22 39 XM_Evil_Numbers_Gen 41280 8.28 8.97 7.99 40 LOTS_OF_MONEY 40747 9.90 14.78 7.89 41 TooManyTo_001 40651 7.54 6.73 7.87 42 XM_DK_Undo_02 39748 19.05 46.57 7.69 43 XM_SendGrid 38853 6.92 5.45 7.52 44 BAYES_60 37311 7.44 7.95 7.22 45 MPART_ALT_DIFF 35786 7.43 8.66 6.93 46 RCVD_IN_RP_SAFE 34695 5.61 2.92 6.72 47 HTML_IMAGE_RATIO_02 34122 7.07 8.20 6.60 48 RCVD_IN_RP_CERTIFIED 31982 5.06 2.33 6.19 49 IN_ZIMBRA_NJ_WHITELIST 30998 4.26 0.06 6.00 50 RCVD_IN_IADB_LISTED 30989 4.96 2.45 6.00 51 FSL_BULK_SIG 30464 7.90 12.77 5.90 52 XM_B_SpammyWords3 29788 7.80 12.74 5.77 53 HTML_IMAGE_RATIO_04 29732 5.71 5.60 5.75 54 TR_XM_DKIM_Undo 28823 14.74 36.93 5.58 55 MIME_QP_LONG_LINE 28387 4.68 2.71 5.49 56 XM_H_Long_From01 27930 5.18 4.62 5.41 57 XMStrtUSub 27160 4.69 3.33 5.26 58 RCVD_IN_IADB_SPF 27017 4.31 2.07 5.23 59 BAYES_40 25482 4.07 1.98 4.93 60 MIME_HTML_ONLY_MULTI 25260 4.09 2.14 4.89 61 RELAYCOUNTRY_META 24852 10.26 23.46 4.81 62 TM2_M_URI_OPT_OUT 24300 4.19 2.96 4.70 63 BOTNET_IPINHOSTNAME 24266 7.42 14.03 4.70 64 RCVD_IN_IADB_SENDERID 24231 3.86 1.86 4.69 65 TR_XM_DK_SendGrid 23994 4.19 3.09 4.64 66 RCVD_IN_IADB_DK 23434 3.75 1.83 4.54 67 XM_H_Trusted_IP 23394 3.21 0.00 4.53 68 XM_PDF 23138 3.42 0.85 4.48 69 BAYES_99 22925 13.81 36.53 4.44 70 T_TooManySym_01 22886 3.79 2.24 4.43 71 BAYES_80 21941 5.75 9.40 4.25 72 RCVD_IN_IADB_VOUCHED 19294 3.08 1.48 3.73 73 BAYES_20 19079 3.05 1.50 3.69 74 T_REMOTE_IMAGE 18540 4.93 8.19 3.59 75 HTML_IMAGE_RATIO_06 18510 4.54 6.86 3.58 76 BAYES_999 18044 10.82 28.57 3.49 77 XMSexyCombo_05 18043 5.66 10.91 3.49 78 XMSubMetaSx_00 17030 4.57 7.65 3.30 79 DKIM_INVALID 16827 3.49 4.06 3.26 80 FROM_EXCESS_BASE64 16241 2.91 2.33 3.14 81 TR_XM_SB_Phish 15925 2.90 2.44 3.08 82 XM_UncommonTLD01 15703 5.49 11.42 3.04 83 XMSubPhish11 15698 2.71 1.92 3.04 84 TR_XM_PhishingBody 15419 4.01 6.48 2.98 85 XMNumbers 14980 3.41 4.63 2.90 86 RCVD_IN_MSPIKE_H5 14149 2.17 0.78 2.74 87 HTML_IMAGE_RATIO_08 14088 2.96 3.52 2.73 88 URI_NOVOWEL 13850 2.32 1.44 2.68 89 BAYES_95 13711 3.46 5.41 2.65 90 ANY_BOUNCE_MESSAGE 12909 1.90 0.44 2.50 91 BOUNCE_MESSAGE 12905 1.90 0.44 2.50 92 MAILING_LIST_MULTI 12680 2.20 1.58 2.45 93 RCVD_IN_IADB_OPTIN 12534 2.04 1.09 2.43 94 MIME_HTML_MOSTLY 12318 4.06 8.11 2.38 95 BAYES_05 12084 1.95 1.00 2.34 96 T_TooManySym_02 11571 1.74 0.52 2.24 97 XM_B_Unsub2 11175 2.08 1.89 2.16 98 TR_DCC_Bayes_99 11037 9.60 27.69 2.14 99 HTML_MIME_NO_HTML_TAG 10801 1.92 1.49 2.09 100 TooManyTo_002 10054 1.55 0.59 1.95 101 BOTNET 9979 5.77 15.08 1.93 102 UNTRUSTED_Relay 9941 6.26 16.78 1.92 103 LH_URI_DOM_IN_PATH 9769 2.14 2.75 1.89 104 XMDiploma_00 9534 2.22 3.12 1.85 105 XM_B_SpammyTLD 9526 2.26 3.28 1.84 106 T_FONT_INVIS_NAKED_TO 9421 2.53 4.26 1.82 107 XM_B_Phish66 9343 2.48 4.11 1.81 108 XM_CamelCaseFrm001 9234 1.90 2.17 1.79 109 T_XMDrugObfuBody_14 9144 1.86 2.08 1.77 110 TR_Symld_Words 9110 1.72 1.62 1.76 111 XM_SPF_SoftFail 8996 2.27 3.55 1.74 112 T_XMDrugObfuBody_08 8734 2.34 3.91 1.69 113 SUBJ_ALL_CAPS 8716 1.81 2.11 1.69 114 XMSubNoVowel 8347 1.48 1.14 1.62 115 HELO_NODOT 8345 1.31 0.57 1.62 116 HELO_NO_DOMAIN 8344 1.31 0.57 1.62 117 XM_DK_Undo_01 8235 1.63 1.73 1.59 118 KHOP_HELO_FCRDNS 8145 2.89 6.08 1.58 119 RELAYCOUNTRY_CA 8092 2.86 5.99 1.57 120 XM_OfRef6 7834 2.28 4.12 1.52 121 RCVD_IN_BL_SPAMCOP_NET 7826 3.23 7.40 1.51 122 IN_HORDE_ADDRESS_BOOK 7551 1.07 0.13 1.46 123 TVD_RCVD_IP 7328 1.05 0.17 1.42 124 INVALID_MSGID 7282 1.09 0.33 1.41 125 URI_TRY_3LD 7176 1.87 3.03 1.39 126 URI_HEX 7169 2.14 3.97 1.39 127 XM_H_Long_From02 6707 1.37 1.56 1.30 128 TooManyTo_003 6651 1.05 0.47 1.29 129 USER_IN_DEF_DKIM_WL 6560 0.91 0.02 1.27 130 TO_MALFORMED 6469 0.91 0.08 1.25 131 TM2_M_VERY_LONG_WORD 6452 1.53 2.20 1.25 132 XM_B_COVIDMETA 6221 1.87 3.49 1.20 133 XM_ProductURIs 6076 1.09 0.86 1.18 134 XMGappySubj_01 5987 0.87 0.16 1.16 135 HTML_FONT_FACE_BAD 5903 0.98 0.60 1.14 136 HELO_MISC_IP 5894 0.95 0.48 1.14 137 CK_HELO_DYNAMIC_SPLIT_IP 5889 0.90 0.30 1.14 138 XMCapTrack 5726 0.89 0.35 1.11 139 XM_GoogleGroups 5580 0.91 0.48 1.08 140 XM_UB50 5373 2.55 6.22 1.04 141 XMBrknScrpt_02 5353 3.08 8.02 1.04 142 US_DOLLARS_3 5128 1.71 3.46 0.99 143 DKIM_ADSP_CUSTOM_MED 5100 0.92 0.74 0.99 144 XMBSHREFv2 5072 0.76 0.23 0.98 145 HTTPS_HTTP_MISMATCH 5051 0.96 0.91 0.98 146 TR_MSPIKEBAYES00 5040 0.70 0.04 0.98 147 T_FILL_THIS_FORM_SHORT 5016 1.15 1.60 0.97 148 FROM_GOV_DKIM_AU 4853 0.70 0.12 0.94 149 RELAYCOUNTRY_GB 4824 1.04 1.28 0.93 150 TooManyTo_004 4713 0.77 0.43 0.91 151 T_TooManySym_03 4710 0.69 0.17 0.91 152 XMStockSpam_06 4648 1.13 1.68 0.90 153 XMBody_95 4531 0.66 0.14 0.88 154 XMGenDplmaNmb 4482 1.16 1.87 0.87 155 SpammyFromTLD_01 4332 2.08 5.08 0.84 156 TR_MetaPhish_Combo_01 3912 0.75 0.73 0.76 157 XMHTML_After_End 3910 0.87 1.14 0.76 158 TooManyTo_005 3895 0.65 0.38 0.75 159 XMBody_17 3733 1.46 3.26 0.72 160 T_XMDrugObfuBody_00 3723 0.90 1.34 0.72 161 XMBdyGiftCard01 3696 0.87 1.24 0.72 162 TR_XM_SpammyWords2 3629 4.90 15.06 0.70 163 NML_ADSP_CUSTOM_MED 3542 0.67 0.63 0.69 164 XM_ShortIntro_01 3506 0.68 0.67 0.68 165 RCVD_IN_MSPIKE_BL 3497 3.27 9.57 0.68 166 T_OBFU_PDF_ATTACH 3407 0.50 0.13 0.66 167 TR_LOTS_OF_MONEY3 3378 1.45 3.37 0.65 168 T_XMHurry_00 3278 1.21 2.61 0.63 169 XMSexyCombo_01 3170 1.23 2.71 0.61 170 XM_B_SpammyWords4 3142 1.02 2.01 0.61 171 T_Symld_Words_02 3120 0.75 1.11 0.60 172 XMMoneyMeta_00 3048 0.86 1.52 0.59 173 XM_SPF_Unknown 2974 0.66 0.87 0.58 174 XMSubMetaI_00 2896 0.65 0.87 0.56 175 TR_XM_UnparsRelay 2881 0.99 2.02 0.56 176 XM_H_PHPMailer 2839 0.53 0.49 0.55 177 XMNoVowels 2807 0.54 0.53 0.54 178 HTML_IMAGE_ONLY_20 2804 0.46 0.25 0.54 179 FORGED_GMAIL_RCVD 2738 0.53 0.54 0.53 180 DKIM_ADSP_NXDOMAIN 2718 0.57 0.67 0.53 181 PDS_OTHER_BAD_TLD 2664 0.91 1.87 0.52 182 RCVD_IN_MSPIKE_L3 2656 2.28 6.57 0.51 183 RDNS_DYNAMIC 2650 0.59 0.77 0.51 184 XMOemUri 2632 0.42 0.19 0.51 185 RELAYCOUNTRY_DE 2620 0.62 0.90 0.51 186 T_TooManySym_04 2558 0.37 0.05 0.50 187 MISSING_HEADERS 2543 0.47 0.40 0.49 188 NO_DNS_FOR_FROM 2523 0.54 0.67 0.49 189 HTML_TAG_BALANCE_BODY 2515 0.59 0.83 0.49 190 NUMERIC_HTTP_ADDR 2460 0.47 0.47 0.48 191 XMHTMLBadTable_001 2416 0.50 0.59 0.47 192 XM_DIRTYINTL 2415 1.60 4.35 0.47 193 RCVD_IN_SORBS_DUL 2410 0.36 0.11 0.47 194 TR_XM_SpammyWords3 2409 2.34 6.88 0.47 195 FROM_GOV_SPOOF 2403 0.37 0.13 0.47 196 MIME_BOUND_DD_DIGITS 2375 0.37 0.14 0.46 197 SENDGRID_REDIR 2352 0.56 0.82 0.46 198 XM_S_SubURI 2304 0.33 0.06 0.45 199 SHORT_HELO_AND_INLINE_IMAGE 2303 0.33 0.07 0.45 200 SUBJ_DOLLARS 2298 0.48 0.56 0.44 ----------------------------------------------------------------------