Email: 705173 Autolearn: 0 AvgScore: 3.96 AvgScanTime: 1.40 sec Spam: 232564 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 1.41 sec Ham: 472609 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.39 sec Time Spent Running SA: 273.61 hours Time Spent Processing Spam: 91.17 hours Time Spent Processing Ham: 182.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 222138 90.75 95.52 88.40 2 DKIM_SIGNED 196707 78.50 84.58 75.51 3 XM_DK_Pass 188147 76.45 80.90 74.27 4 DCC_CHECK 184607 52.23 79.38 38.87 5 DKIM_VALID 184319 74.69 79.26 72.44 6 RELAYCOUNTRY_US 170028 79.91 73.11 83.26 7 XM_B_Unicode 154090 69.66 66.26 71.33 8 DKIM_VALID_AU 146702 56.98 63.08 53.98 9 XM_B_SpammyWords 140472 52.44 60.40 48.53 10 XMListUnsubscribeExists 139981 53.61 60.19 50.37 11 XM_DK_Undo_02 101226 19.30 43.53 7.38 12 MIME_HTML_ONLY 86624 26.87 37.25 21.76 13 XM_B_SpammyWords2 82106 25.85 35.30 21.20 14 XM_B_Unicode3 81113 39.73 34.88 42.11 15 RCVD_IN_MSPIKE_H2 78300 29.37 33.67 27.26 16 BAYES_50 77946 47.50 33.52 54.38 17 BAYES_99 75438 13.94 32.44 4.83 18 HTML_FONT_LOW_CONTRAST 73978 28.67 31.81 27.13 19 TR_XM_DKIM_Undo 72213 13.77 31.05 5.27 20 LOC_TINY_FONT_1 70119 26.49 30.15 24.68 21 DKIM_VALID_EF 62574 28.00 26.91 28.53 22 RELAYCOUNTRY_META 59169 11.75 25.44 5.02 23 BAYES_999 57785 10.66 24.85 3.68 24 TR_DCC_Bayes_99 56593 9.54 24.33 2.27 25 XMSubLong 52753 21.12 22.68 20.34 26 FSL_BULK_SIG 52033 10.84 22.37 5.17 27 FVGT_m_MULTI_ODD 50599 22.03 21.76 22.16 28 UNTRUSTED_Relay 46931 8.20 20.18 2.31 29 T_KAM_HTML_FONT_INVALID 46407 19.39 19.95 19.12 30 DCC_CHECK_NEGATIVE 44246 45.91 19.03 59.15 31 T_TM2_M_HEADER_IN_MSG 43560 25.28 18.73 28.51 32 XM_Body_Dirty_Words 42796 15.15 18.40 13.55 33 XM_Multi_Part_URI 41494 13.69 17.84 11.65 34 BOTNET 41062 6.97 17.66 1.71 35 XM_B_Unsub 33911 12.23 14.58 11.07 36 HTML_MIME_NO_HTML_TAG 32649 6.15 14.04 2.27 37 RCVD_IN_MSPIKE_WL 31406 23.21 13.50 27.99 38 TR_XM_SpammyWords2 29511 4.67 12.69 0.73 39 XMSexyCombo_05 29363 7.02 12.63 4.26 40 BAYES_80 28411 7.15 12.22 4.66 41 LOTS_OF_MONEY 28050 9.50 12.06 8.24 42 XM_UncommonTLD01 27781 5.98 11.95 3.05 43 BOTNET_IPINHOSTNAME 27611 7.04 11.87 4.67 44 XM_B_SpammyWords3 26174 7.21 11.25 5.22 45 LotsOfNums_01 24400 9.31 10.49 8.73 46 MPART_ALT_DIFF 24025 7.60 10.33 6.25 47 RCVD_IN_BL_SPAMCOP_NET 22871 3.99 9.83 1.11 48 XMSubEmpty 22564 3.55 9.70 0.53 49 TR_Sbj_FN_Bdy 22300 3.31 9.59 0.22 50 XMNoSubject 21826 3.15 9.38 0.08 51 MISSING_SUBJECT 21826 3.15 9.38 0.08 52 MIME_HTML_MOSTLY 21524 4.69 9.26 2.44 53 XM_B_Phish_Phrases 21267 8.25 9.14 7.81 54 RCVD_IN_MSPIKE_BL 20433 3.61 8.79 1.06 55 BAYES_60 19379 7.79 8.33 7.52 56 XM_Evil_Numbers_Gen 18630 7.88 8.01 7.82 57 T_REMOTE_IMAGE 18545 4.85 7.97 3.31 58 HTML_IMAGE_RATIO_02 18397 6.89 7.91 6.39 59 XMSubMetaSx_00 18232 4.83 7.84 3.34 60 RCVD_IN_MSPIKE_H3 17023 12.49 7.32 15.03 61 RELAYCOUNTRY_FR 15626 2.40 6.72 0.27 62 XM_UB50 14975 2.86 6.44 1.10 63 HTML_SHORT_LINK_IMG_1 14562 2.09 6.26 0.03 64 RCVD_IN_MSPIKE_L3 14313 2.43 6.15 0.60 65 BAYES_95 14228 4.18 6.12 3.23 66 XMBrknScrpt_02 13893 2.68 5.97 1.07 67 TR_XM_PhishingBody 13493 3.87 5.80 2.92 68 TR_XM_SpammyWords3 13316 2.27 5.73 0.57 69 URIBL_SBL_A 13068 2.03 5.62 0.26 70 TooManyTo_001 12923 7.13 5.56 7.91 71 RCVD_IN_MSPIKE_H4 12713 8.59 5.47 10.13 72 DKIM_INVALID 12388 3.82 5.33 3.08 73 XM_UB99 11981 1.70 5.15 0.00 74 KHOP_HELO_FCRDNS 11532 2.64 4.96 1.50 75 BODY_URI_ONLY 11245 1.82 4.84 0.34 76 RELAYCOUNTRY_CA 11194 2.62 4.81 1.54 77 SpammyFromTLD_01 11145 2.06 4.79 0.72 78 UNPARSEABLE_RELAY 10881 6.94 4.68 8.05 79 XM_DIRTYINTL 10876 1.83 4.68 0.42 80 HTML_IMAGE_RATIO_06 10155 4.19 4.37 4.10 81 HTML_IMAGE_RATIO_04 10028 5.59 4.31 6.21 82 HTML_IMAGE_ONLY_12 9968 1.54 4.29 0.18 83 XM_H_Long_From01 9838 4.88 4.23 5.19 84 XM_B_SpammyTLD 9795 2.74 4.21 2.02 85 XM_OfRef6 9644 2.19 4.15 1.22 86 SpammyFromTLD_02 9598 1.63 4.13 0.40 87 XMNumbers 9508 3.46 4.09 3.14 88 XM_SendGrid 8869 6.09 3.81 7.21 89 XM_B_Phish66 8726 2.32 3.75 1.62 90 BOTNET_NORDNS 8629 1.23 3.71 0.01 91 HTML_IMAGE_RATIO_08 8485 2.81 3.65 2.39 92 XMStrtUSub 8265 4.83 3.55 5.46 93 T_FONT_INVIS_NAKED_TO 8127 2.42 3.49 1.90 94 TR_LOTS_OF_MONEY3 7881 1.63 3.39 0.76 95 XM_UB999 7812 1.11 3.36 0.00 96 DKIM_ADSP_NXDOMAIN 7589 1.47 3.26 0.59 97 URI_HEX 7498 1.90 3.22 1.25 98 XMBody_17 7344 1.44 3.16 0.59 99 XM_B_COVIDMETA 7311 1.70 3.14 0.99 100 XM_B_Unsub2 7225 2.37 3.11 2.01 101 PDS_OTHER_BAD_TLD 7207 1.37 3.10 0.53 102 T_XMDrugObfuBody_08 7153 2.10 3.08 1.62 103 XM_SPF_SoftFail 7133 2.05 3.07 1.55 104 TR_XM_MaxSPIKE 7046 1.01 3.03 0.02 105 RCVD_IN_RP_RNBL 7013 1.04 3.02 0.06 106 TM2_M_URI_OPT_OUT 6993 3.87 3.01 4.29 107 MIME_HTML_ONLY_MULTI 6860 3.91 2.95 4.38 108 XM_UB80 6618 0.95 2.85 0.02 109 TR_XM_MaxBayes 6532 0.93 2.81 0.01 110 XMDiploma_00 6493 2.04 2.79 1.68 111 RCVD_IN_RP_SAFE 6485 5.60 2.79 6.99 112 BAYES_40 6469 4.22 2.78 4.93 113 XM_UB60 6454 0.97 2.78 0.08 114 LH_URI_DOM_IN_PATH 6272 2.09 2.70 1.79 115 URI_NOVOWEL 6006 2.76 2.58 2.84 116 HTML_IMAGE_ONLY_08 5904 0.91 2.54 0.10 117 INVALID_DATE 5817 0.85 2.50 0.03 118 HDRS_LCASE_IMGONLY 5735 0.83 2.47 0.03 119 BOGUS_MIME_VERSION 5683 0.81 2.44 0.00 120 FROM_SUSPICIOUS_NTLD 5638 0.88 2.42 0.12 121 XMSexyCombo_01 5621 1.20 2.42 0.60 122 MIME_QP_LONG_LINE 5608 4.43 2.41 5.42 123 BAYES_20 5524 3.36 2.38 3.84 124 RELAYCOUNTRY_IN 5397 1.07 2.32 0.46 125 URI_TRY_3LD 5395 1.79 2.32 1.52 126 RCVD_IN_RP_CERTIFIED 5093 5.06 2.19 6.47 127 RCVD_IN_PSBL 5068 0.74 2.18 0.03 128 HDRS_MISSP 4949 0.75 2.13 0.07 129 RCVD_IN_IADB_LISTED 4935 4.85 2.12 6.19 130 FROM_EXCESS_BASE64 4830 2.49 2.08 2.69 131 RCVD_IN_MSPIKE_L5 4716 0.75 2.03 0.12 132 TR_XM_DK_SendGrid 4654 3.63 2.00 4.42 133 XM_CamelCaseFrm001 4519 1.97 1.94 1.99 134 XM_B_SpammyWords4 4419 1.22 1.90 0.88 135 XMSubMetaSxObfu_03 4394 0.95 1.89 0.49 136 T_XMDrugObfuBody_14 4332 2.01 1.86 2.08 137 T_XMHurry_00 4301 1.08 1.85 0.71 138 RCVD_IN_IADB_SPF 4282 4.22 1.84 5.40 139 XMGenDplmaNmb 4260 1.13 1.83 0.79 140 TR_XM_SB_Phish 4198 2.11 1.81 2.27 141 FROM_SUSPICIOUS_NTLD_FP 4164 0.67 1.79 0.11 142 URI_PHP_REDIR 4154 0.59 1.79 0.00 143 SUBJ_ALL_CAPS 4137 1.73 1.78 1.71 144 XM_UB95 4123 0.59 1.77 0.01 145 T_TooManySym_01 4048 3.54 1.74 4.43 146 XMSubPhish11 3975 2.07 1.71 2.24 147 RELAYCOUNTRY_UA 3965 0.56 1.70 0.00 148 HTML_FONT_SIZE_LARGE 3946 0.69 1.70 0.19 149 RCVD_IN_IADB_SENDERID 3928 3.76 1.69 4.78 150 RCVD_IN_IADB_DK 3870 3.65 1.66 4.63 151 TM2_M_VERY_LONG_WORD 3868 1.43 1.66 1.31 152 TR_XM_COVIDMETA4 3679 0.76 1.58 0.36 153 RELAYCOUNTRY_DE 3616 0.84 1.55 0.49 154 T_FILL_THIS_FORM_SHORT 3580 1.21 1.54 1.05 155 XMSexyCombo_04 3505 0.63 1.51 0.20 156 LongTLD 3479 0.60 1.50 0.16 157 XM_DK_Undo_01 3459 1.52 1.49 1.54 158 US_DOLLARS_3 3450 0.94 1.48 0.68 159 XM_BadFromFormat 3404 0.61 1.46 0.19 160 TR_XM_INV_DKIM 3387 0.56 1.46 0.13 161 XMSlimDrugH 3265 0.66 1.40 0.30 162 XM_ProductURIs 3185 1.63 1.37 1.76 163 FROM_MISSP_REPLYTO 3133 0.45 1.35 0.01 164 RELAYCOUNTRY_GB 3071 0.97 1.32 0.79 165 XMStockSpam_06 2952 1.21 1.27 1.19 166 XMBdyGiftCard01 2948 0.99 1.27 0.86 167 TR_Symld_Words 2924 1.68 1.26 1.89 168 NUMERIC_HTTP_ADDR 2880 0.82 1.24 0.62 169 T_XMDrugObfuBody_00 2860 0.92 1.23 0.76 170 TR_XM_UnparsRelay 2830 0.66 1.22 0.38 171 TR_XM_COVIDMETA1 2755 0.61 1.18 0.32 172 MAILING_LIST_MULTI 2728 1.96 1.17 2.35 173 XMHTML_After_End 2686 0.89 1.15 0.76 174 XM_URI_RBL 2683 0.50 1.15 0.18 175 XM_JunkDunk 2680 0.38 1.15 0.00 176 TR_XM_PHPDW 2642 0.57 1.14 0.30 177 XMSubMetaI_00 2641 0.75 1.14 0.56 178 BAYES_00 2639 9.95 1.13 14.29 179 DATE_IN_PAST_06_12 2592 0.51 1.11 0.22 180 TR_XM_PHPForged 2555 0.55 1.10 0.28 181 TR_XM_FormFill2 2542 0.55 1.09 0.29 182 XM_H_PHPOS 2540 0.55 1.09 0.28 183 DIET_1 2534 0.76 1.09 0.60 184 BAYES_05 2530 1.90 1.09 2.31 185 NO_DNS_FOR_FROM 2502 0.73 1.08 0.56 186 ANY_BOUNCE_MESSAGE 2486 2.44 1.07 3.12 187 BOUNCE_MESSAGE 2484 2.44 1.07 3.12 188 RCVD_IN_IADB_VOUCHED 2472 2.96 1.06 3.89 189 XMSubNoVowel 2376 1.45 1.02 1.66 190 TR_Mismatch_TLD_02 2374 0.39 1.02 0.08 191 HTML_TITLE_SUBJ_DIFF 2369 0.35 1.02 0.03 192 STY_INVIS_DIRECT 2325 0.35 1.00 0.03 193 ALL_TRUSTED 2203 8.81 0.95 12.68 194 FVGT_m_MULTI_ODD_EMAIL 2193 0.33 0.94 0.03 195 XMBody_78 2170 0.61 0.93 0.45 196 RELAYCOUNTRY_SG 2168 0.34 0.93 0.05 197 HELO_NO_DOMAIN 2058 1.54 0.88 1.87 198 HELO_NODOT 2058 1.54 0.88 1.87 199 TR_XM_RelayPhish 2021 0.34 0.87 0.09 200 INVALID_MSGID 2009 1.34 0.86 1.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 417772 90.75 95.52 88.40 2 RELAYCOUNTRY_US 393493 79.91 73.11 83.26 3 DKIM_SIGNED 356889 78.50 84.58 75.51 4 XM_DK_Pass 350987 76.45 80.90 74.27 5 DKIM_VALID 342347 74.69 79.26 72.44 6 XM_B_Unicode 337108 69.66 66.26 71.33 7 DCC_CHECK_NEGATIVE 279529 45.91 19.03 59.15 8 BAYES_50 256997 47.50 33.52 54.38 9 DKIM_VALID_AU 255106 56.98 63.08 53.98 10 XMListUnsubscribeExists 238046 53.61 60.19 50.37 11 XM_B_SpammyWords 229346 52.44 60.40 48.53 12 XM_B_Unicode3 199021 39.73 34.88 42.11 13 DCC_CHECK 183713 52.23 79.38 38.87 14 DKIM_VALID_EF 134846 28.00 26.91 28.53 15 T_TM2_M_HEADER_IN_MSG 134740 25.28 18.73 28.51 16 RCVD_IN_MSPIKE_WL 132279 23.21 13.50 27.99 17 RCVD_IN_MSPIKE_H2 128844 29.37 33.67 27.26 18 HTML_FONT_LOW_CONTRAST 128214 28.67 31.81 27.13 19 LOC_TINY_FONT_1 116656 26.49 30.15 24.68 20 FVGT_m_MULTI_ODD 104722 22.03 21.76 22.16 21 MIME_HTML_ONLY 102861 26.87 37.25 21.76 22 XM_B_SpammyWords2 100205 25.85 35.30 21.20 23 XMSubLong 96147 21.12 22.68 20.34 24 T_KAM_HTML_FONT_INVALID 90360 19.39 19.95 19.12 25 RCVD_IN_MSPIKE_H3 71042 12.49 7.32 15.03 26 BAYES_00 67556 9.95 1.13 14.29 27 XM_Body_Dirty_Words 64057 15.15 18.40 13.55 28 ALL_TRUSTED 59948 8.81 0.95 12.68 29 XM_Multi_Part_URI 55037 13.69 17.84 11.65 30 XM_B_Unsub 52339 12.23 14.58 11.07 31 RCVD_IN_MSPIKE_H4 47880 8.59 5.47 10.13 32 XM_DKIMWhitelistDomains 44749 6.37 0.06 9.47 33 TR_XM_DK_Bayes 43574 6.46 0.86 9.22 34 TR_XM_DK_Bayes1 42393 6.28 0.82 8.97 35 LotsOfNums_01 41243 9.31 10.49 8.73 36 LOTS_OF_MONEY 38928 9.50 12.06 8.24 37 UNPARSEABLE_RELAY 38068 6.94 4.68 8.05 38 TR_XM_DK_Bayes2 37872 5.59 0.67 8.01 39 TooManyTo_001 37371 7.13 5.56 7.91 40 XM_Evil_Numbers_Gen 36972 7.88 8.01 7.82 41 XM_B_Phish_Phrases 36915 8.25 9.14 7.81 42 BAYES_60 35562 7.79 8.33 7.52 43 XM_DK_Undo_02 34894 19.30 43.53 7.38 44 XM_SendGrid 34076 6.09 3.81 7.21 45 RCVD_IN_RP_SAFE 33024 5.60 2.79 6.99 46 RCVD_IN_RP_CERTIFIED 30569 5.06 2.19 6.47 47 HTML_IMAGE_RATIO_02 30204 6.89 7.91 6.39 48 MPART_ALT_DIFF 29550 7.60 10.33 6.25 49 HTML_IMAGE_RATIO_04 29360 5.59 4.31 6.21 50 RCVD_IN_IADB_LISTED 29265 4.85 2.12 6.19 51 IN_ZIMBRA_NJ_WHITELIST 28287 4.03 0.05 5.99 52 XMStrtUSub 25814 4.83 3.55 5.46 53 MIME_QP_LONG_LINE 25637 4.43 2.41 5.42 54 RCVD_IN_IADB_SPF 25504 4.22 1.84 5.40 55 TR_XM_DKIM_Undo 24918 13.77 31.05 5.27 56 XM_B_SpammyWords3 24670 7.21 11.25 5.22 57 XM_H_Long_From01 24551 4.88 4.23 5.19 58 FSL_BULK_SIG 24439 10.84 22.37 5.17 59 RELAYCOUNTRY_META 23709 11.75 25.44 5.02 60 XM_H_Trusted_IP 23368 3.31 0.00 4.94 61 BAYES_40 23310 4.22 2.78 4.93 62 BAYES_99 22832 13.94 32.44 4.83 63 RCVD_IN_IADB_SENDERID 22600 3.76 1.69 4.78 64 BOTNET_IPINHOSTNAME 22056 7.04 11.87 4.67 65 BAYES_80 22017 7.15 12.22 4.66 66 RCVD_IN_IADB_DK 21902 3.65 1.66 4.63 67 T_TooManySym_01 20922 3.54 1.74 4.43 68 TR_XM_DK_SendGrid 20911 3.63 2.00 4.42 69 MIME_HTML_ONLY_MULTI 20716 3.91 2.95 4.38 70 TM2_M_URI_OPT_OUT 20276 3.87 3.01 4.29 71 XMSexyCombo_05 20127 7.02 12.63 4.26 72 XM_PDF 19630 3.01 0.70 4.15 73 HTML_IMAGE_RATIO_06 19383 4.19 4.37 4.10 74 RCVD_IN_IADB_VOUCHED 18370 2.96 1.06 3.89 75 BAYES_20 18162 3.36 2.38 3.84 76 BAYES_999 17382 10.66 24.85 3.68 77 XMSubMetaSx_00 15794 4.83 7.84 3.34 78 T_REMOTE_IMAGE 15627 4.85 7.97 3.31 79 BAYES_95 15268 4.18 6.12 3.23 80 XMNumbers 14861 3.46 4.09 3.14 81 ANY_BOUNCE_MESSAGE 14742 2.44 1.07 3.12 82 BOUNCE_MESSAGE 14741 2.44 1.07 3.12 83 DKIM_INVALID 14542 3.82 5.33 3.08 84 XM_UncommonTLD01 14401 5.98 11.95 3.05 85 TR_XM_PhishingBody 13818 3.87 5.80 2.92 86 URI_NOVOWEL 13439 2.76 2.58 2.84 87 RCVD_IN_MSPIKE_H5 13357 2.13 0.72 2.83 88 FROM_EXCESS_BASE64 12706 2.49 2.08 2.69 89 RCVD_IN_IADB_OPTIN 12216 1.99 0.77 2.58 90 MIME_HTML_MOSTLY 11535 4.69 9.26 2.44 91 HTML_IMAGE_RATIO_08 11310 2.81 3.65 2.39 92 T_TooManySym_02 11198 1.74 0.48 2.37 93 MAILING_LIST_MULTI 11113 1.96 1.17 2.35 94 UNTRUSTED_Relay 10904 8.20 20.18 2.31 95 BAYES_05 10902 1.90 1.09 2.31 96 HTML_MIME_NO_HTML_TAG 10723 6.15 14.04 2.27 97 TR_XM_SB_Phish 10716 2.11 1.81 2.27 98 TR_DCC_Bayes_99 10709 9.54 24.33 2.27 99 XMSubPhish11 10600 2.07 1.71 2.24 100 T_XMDrugObfuBody_14 9844 2.01 1.86 2.08 101 XM_B_SpammyTLD 9548 2.74 4.21 2.02 102 XM_B_Unsub2 9488 2.37 3.11 2.01 103 XM_CamelCaseFrm001 9402 1.97 1.94 1.99 104 HTML_FONT_FACE_BAD 9140 1.45 0.48 1.93 105 TooManyTo_002 9057 1.43 0.45 1.92 106 T_FONT_INVIS_NAKED_TO 8967 2.42 3.49 1.90 107 TR_Symld_Words 8930 1.68 1.26 1.89 108 HELO_NODOT 8828 1.54 0.88 1.87 109 HELO_NO_DOMAIN 8827 1.54 0.88 1.87 110 LH_URI_DOM_IN_PATH 8475 2.09 2.70 1.79 111 XM_ProductURIs 8309 1.63 1.37 1.76 112 BOTNET 8068 6.97 17.66 1.71 113 SUBJ_ALL_CAPS 8065 1.73 1.78 1.71 114 XMDiploma_00 7921 2.04 2.79 1.68 115 XMSubNoVowel 7856 1.45 1.02 1.66 116 XM_B_Phish66 7650 2.32 3.75 1.62 117 T_XMDrugObfuBody_08 7639 2.10 3.08 1.62 118 INVALID_MSGID 7466 1.34 0.86 1.58 119 XM_SPF_SoftFail 7330 2.05 3.07 1.55 120 XM_DK_Undo_01 7290 1.52 1.49 1.54 121 RELAYCOUNTRY_CA 7281 2.62 4.81 1.54 122 URI_TRY_3LD 7206 1.79 2.32 1.52 123 IN_HORDE_ADDRESS_BOOK 7169 1.06 0.13 1.52 124 KHOP_HELO_FCRDNS 7068 2.64 4.96 1.50 125 TVD_RCVD_IP 7005 1.05 0.16 1.48 126 TO_MALFORMED 6486 1.04 0.36 1.37 127 XMGappySubj_01 6263 0.92 0.11 1.33 128 TM2_M_VERY_LONG_WORD 6214 1.43 1.66 1.31 129 HELO_MISC_IP 5968 0.93 0.26 1.26 130 CK_HELO_DYNAMIC_SPLIT_IP 5966 0.93 0.25 1.26 131 URI_HEX 5912 1.90 3.22 1.25 132 TooManyTo_003 5888 0.95 0.36 1.25 133 DKIM_ADSP_CUSTOM_MED 5815 1.06 0.70 1.23 134 XM_OfRef6 5781 2.19 4.15 1.22 135 XMStockSpam_06 5602 1.21 1.27 1.19 136 XMBSHREFv2 5429 0.85 0.24 1.15 137 RCVD_IN_BL_SPAMCOP_NET 5250 3.99 9.83 1.11 138 XM_UB50 5182 2.86 6.44 1.10 139 XM_GoogleGroups 5168 0.85 0.36 1.09 140 XM_H_Long_From02 5166 0.94 0.62 1.09 141 USER_IN_DEF_DKIM_WL 5096 0.73 0.02 1.08 142 XMBrknScrpt_02 5036 2.68 5.97 1.07 143 RCVD_IN_MSPIKE_BL 5021 3.61 8.79 1.06 144 T_FILL_THIS_FORM_SHORT 4948 1.21 1.54 1.05 145 XMCapTrack 4835 0.76 0.23 1.02 146 XM_B_COVIDMETA 4666 1.70 3.14 0.99 147 T_TooManySym_03 4357 0.66 0.12 0.92 148 TooManyTo_004 4285 0.71 0.32 0.91 149 TR_MSPIKEBAYES00 4272 0.62 0.03 0.90 150 FROM_GOV_DKIM_AU 4224 0.64 0.13 0.89 151 XM_B_SpammyWords4 4175 1.22 1.90 0.88 152 XMBdyGiftCard01 4041 0.99 1.27 0.86 153 NML_ADSP_CUSTOM_MED 4039 0.78 0.63 0.85 154 XMBody_95 3941 0.59 0.09 0.83 155 RELAYCOUNTRY_GB 3743 0.97 1.32 0.79 156 XMGenDplmaNmb 3742 1.13 1.83 0.79 157 MISSING_HEADERS 3609 0.78 0.83 0.76 158 T_XMDrugObfuBody_00 3594 0.92 1.23 0.76 159 TR_LOTS_OF_MONEY3 3587 1.63 3.39 0.76 160 XMHTML_After_End 3579 0.89 1.15 0.76 161 TR_XM_SpammyWords2 3443 4.67 12.69 0.73 162 SpammyFromTLD_01 3396 2.06 4.79 0.72 163 TooManyTo_005 3393 0.57 0.27 0.72 164 XM_ShortIntro_01 3366 0.60 0.37 0.71 165 T_XMHurry_00 3337 1.08 1.85 0.71 166 FORGED_GMAIL_RCVD 3318 0.65 0.55 0.70 167 HTML_IMAGE_ONLY_20 3284 0.65 0.56 0.69 168 US_DOLLARS_3 3194 0.94 1.48 0.68 169 TR_LOTS_OF_MONEY2 3171 0.64 0.59 0.67 170 T_MONEY_PERCENT 3171 0.64 0.59 0.67 171 HTTPS_HTTP_MISMATCH 3055 0.68 0.75 0.65 172 TR_MetaPhish_Combo_01 2966 0.64 0.67 0.63 173 NUMERIC_HTTP_ADDR 2909 0.82 1.24 0.62 174 XMNoVowels 2875 0.55 0.42 0.61 175 XMSexyCombo_01 2855 1.20 2.42 0.60 176 T_Symld_Words_02 2855 0.63 0.70 0.60 177 RCVD_IN_MSPIKE_L3 2830 2.43 6.15 0.60 178 DIET_1 2827 0.76 1.09 0.60 179 T_OBFU_PDF_ATTACH 2812 0.43 0.10 0.59 180 DKIM_ADSP_NXDOMAIN 2797 1.47 3.26 0.59 181 XMBody_17 2792 1.44 3.16 0.59 182 XM_SPF_Unknown 2748 0.63 0.73 0.58 183 TR_XM_SpammyWords3 2693 2.27 5.73 0.57 184 XMSubMetaI_00 2655 0.75 1.14 0.56 185 XM_H_PHPMailer 2641 0.54 0.49 0.56 186 NO_DNS_FOR_FROM 2636 0.73 1.08 0.56 187 SENDGRID_REDIR 2617 0.56 0.56 0.55 188 PLING_QUERY 2536 0.48 0.36 0.54 189 XMSubEmpty 2501 3.55 9.70 0.53 190 T_TooManySym_04 2493 0.36 0.03 0.53 191 PDS_OTHER_BAD_TLD 2487 1.37 3.10 0.53 192 SHORT_HELO_AND_INLINE_IMAGE 2334 0.35 0.04 0.49 193 RELAYCOUNTRY_DE 2310 0.84 1.55 0.49 194 XMSubMetaSxObfu_03 2307 0.95 1.89 0.49 195 XM_S_SubURI 2283 0.34 0.04 0.48 196 XMLngstWrd_00 2253 0.58 0.80 0.48 197 XMMoneyMeta_00 2248 0.55 0.71 0.48 198 XMPhish08 2247 0.50 0.55 0.48 199 RDNS_DYNAMIC 2208 0.55 0.73 0.47 200 TM2_M_A_HREF_HREF 2169 0.51 0.62 0.46 ----------------------------------------------------------------------