Email: 710052 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.40 sec Spam: 213418 Autolearn: 0 AvgScore: 13.60 AvgScanTime: 1.50 sec Ham: 496634 Autolearn: 0 AvgScore: -0.67 AvgScanTime: 1.36 sec Time Spent Running SA: 276.26 hours Time Spent Processing Spam: 88.96 hours Time Spent Processing Ham: 187.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 205566 91.26 96.32 89.08 2 DKIM_SIGNED 177864 79.35 83.34 77.63 3 XM_DK_Pass 171931 77.63 80.56 76.37 4 DKIM_VALID 168647 75.76 79.02 74.35 5 DCC_CHECK 163693 51.23 76.70 40.29 6 XM_B_Unicode 156250 72.19 73.21 71.74 7 RELAYCOUNTRY_US 154835 80.75 72.55 84.27 8 XM_B_SpammyWords 147498 55.32 69.11 49.39 9 XMListUnsubscribeExists 146401 56.77 68.60 51.68 10 DKIM_VALID_AU 132681 57.21 62.17 55.08 11 XM_DK_Undo_02 97820 18.88 45.83 7.30 12 XM_B_SpammyWords2 82452 26.67 38.63 21.53 13 XM_B_Unicode3 77708 39.36 36.41 40.63 14 BAYES_50 75842 49.07 35.54 54.89 15 BAYES_99 75609 13.91 35.43 4.66 16 TR_XM_DKIM_Undo 75449 14.37 35.35 5.35 17 HTML_FONT_LOW_CONTRAST 74940 29.41 35.11 26.95 18 LOC_TINY_FONT_1 72360 26.58 33.91 23.43 19 DKIM_VALID_EF 64863 29.60 30.39 29.25 20 MIME_HTML_ONLY 59846 22.29 28.04 19.82 21 TR_DCC_Bayes_99 58396 9.84 27.36 2.32 22 RCVD_IN_MSPIKE_H2 58297 27.51 27.32 27.60 23 BAYES_999 58123 10.71 27.23 3.61 24 RELAYCOUNTRY_META 54921 11.06 25.73 4.75 25 FVGT_m_MULTI_ODD 54532 23.90 25.55 23.20 26 T_KAM_HTML_FONT_INVALID 51923 20.91 24.33 19.44 27 T_TM2_M_HEADER_IN_MSG 51214 27.59 24.00 29.13 28 XMSubLong 48541 21.14 22.74 20.46 29 DCC_CHECK_NEGATIVE 46083 46.68 21.59 57.46 30 XM_Multi_Part_URI 42317 14.15 19.83 11.72 31 UNTRUSTED_Relay 41850 7.26 19.61 1.95 32 XM_Body_Dirty_Words 38751 14.64 18.16 13.12 33 RCVD_IN_MSPIKE_WL 35354 25.24 16.57 28.97 34 BOTNET 32948 5.83 15.44 1.70 35 LOTS_OF_MONEY 32514 9.51 15.23 7.05 36 TR_XM_SpammyWords2 30167 4.90 14.14 0.93 37 FSL_BULK_SIG 27953 7.61 13.10 5.25 38 XM_B_Unsub 27545 11.24 12.91 10.53 39 BOTNET_IPINHOSTNAME 25928 6.72 12.15 4.39 40 XM_UncommonTLD01 25593 5.85 11.99 3.21 41 XM_B_SpammyWords3 25262 7.10 11.84 5.06 42 LotsOfNums_01 23092 9.81 10.82 9.38 43 RCVD_IN_MSPIKE_BL 21103 3.41 9.89 0.62 44 MPART_ALT_DIFF 21084 6.25 9.88 4.69 45 XMSexyCombo_05 20365 5.27 9.54 3.44 46 BAYES_80 20043 5.95 9.39 4.47 47 RCVD_IN_MSPIKE_H3 19745 13.67 9.25 15.57 48 XM_Evil_Numbers_Gen 19052 8.24 8.93 7.95 49 BAYES_60 18254 7.66 8.55 7.27 50 XM_UB50 18026 3.26 8.45 1.03 51 MIME_HTML_MOSTLY 17971 4.05 8.42 2.17 52 HTML_IMAGE_RATIO_02 16422 6.82 7.69 6.44 53 T_REMOTE_IMAGE 16070 4.83 7.53 3.68 54 RCVD_IN_BL_SPAMCOP_NET 15578 2.92 7.30 1.03 55 XM_B_Phish_Phrases 15429 6.40 7.23 6.04 56 RCVD_IN_MSPIKE_L3 14992 2.45 7.02 0.48 57 TR_XM_PhishingBody 14341 4.32 6.72 3.29 58 RCVD_IN_MSPIKE_H4 13890 9.43 6.51 10.68 59 TR_XM_SpammyWords3 13834 2.26 6.48 0.45 60 TR_XM_SpammyWords4 13462 3.38 6.31 2.12 61 XMBody_17 13416 2.38 6.29 0.70 62 TooManyTo_001 13357 7.77 6.26 8.42 63 KHOP_HELO_FCRDNS 13013 3.04 6.10 1.73 64 UNPARSEABLE_RELAY 12799 7.72 6.00 8.46 65 URIBL_SBL_A 12523 1.92 5.87 0.22 66 BAYES_95 12179 3.82 5.71 3.01 67 XMSubMetaSx_00 11958 4.06 5.60 3.39 68 HTML_IMAGE_RATIO_04 11941 5.53 5.60 5.50 69 RELAYCOUNTRY_CA 11885 2.63 5.57 1.37 70 TR_LOTS_OF_MONEY3 11683 2.16 5.47 0.74 71 HTML_SHORT_LINK_IMG_1 11572 1.65 5.42 0.04 72 BODY_URI_ONLY 11546 1.67 5.41 0.07 73 XM_H_Long_From01 11144 5.29 5.22 5.31 74 SpammyFromTLD_01 10974 2.14 5.14 0.85 75 XMBrknScrpt_02 10926 2.18 5.12 0.92 76 RELAYCOUNTRY_FR 9955 1.60 4.66 0.29 77 XM_SendGrid 9848 6.80 4.61 7.74 78 XMNumbers 9847 3.78 4.61 3.42 79 SpammyFromTLD_02 9245 1.56 4.33 0.37 80 DKIM_INVALID 9217 3.59 4.32 3.28 81 HTML_IMAGE_RATIO_06 9161 4.09 4.29 4.01 82 SUBJ_ALL_CAPS 9129 2.28 4.28 1.42 83 SHORTENED_URL_HREF 8980 1.50 4.21 0.33 84 T_FONT_INVIS_NAKED_TO 8772 2.56 4.11 1.89 85 XM_B_Phish66 8509 2.66 3.99 2.10 86 XM_DIRTYINTL 8211 1.50 3.85 0.49 87 T_XMDrugObfuBody_08 8102 2.24 3.80 1.57 88 HTML_IMAGE_RATIO_08 8068 2.82 3.78 2.41 89 XM_SPF_SoftFail 7720 2.39 3.62 1.86 90 URI_HEX 7630 1.94 3.58 1.23 91 HTML_IMAGE_ONLY_08 7552 1.14 3.54 0.10 92 XM_UB60 7493 1.12 3.51 0.09 93 SHORT_URI_3 7396 1.07 3.47 0.04 94 SHORT_SHORTNER 7349 1.04 3.44 0.01 95 XMStrtUSub 7293 4.84 3.42 5.46 96 SHORTENER_SHORT_IMG 7288 1.03 3.41 0.00 97 SHORTENED_URL_SRC 7269 1.02 3.41 0.00 98 RCVD_IN_RP_SAFE 7253 6.06 3.40 7.20 99 T_XMHurry_00 7157 1.59 3.35 0.83 100 XM_OfRef6 7034 1.80 3.30 1.16 101 TR_XM_MaxBayes 6859 0.98 3.21 0.02 102 XM_B_SpammyTLD 6765 2.35 3.17 1.99 103 TR_XM_MaxSPIKE 6391 0.91 2.99 0.01 104 TR_XM_SB_Phish 6261 2.33 2.93 2.06 105 RCVD_IN_RP_CERTIFIED 6197 5.45 2.90 6.55 106 XM_UB99 6129 0.87 2.87 0.01 107 TM2_M_URI_OPT_OUT 6080 2.97 2.85 3.02 108 RELAYCOUNTRY_IN 5974 0.93 2.80 0.13 109 XMSubPhish11 5952 2.26 2.79 2.03 110 TR_XM_DK_SendGrid 5853 4.04 2.74 4.59 111 RCVD_IN_RP_RNBL 5784 0.84 2.71 0.04 112 BOTNET_NORDNS 5645 0.81 2.65 0.02 113 MIME_QP_LONG_LINE 5612 5.10 2.63 6.16 114 XM_B_COVIDMETA 5484 1.48 2.57 1.01 115 URI_TRY_3LD 5356 1.49 2.51 1.05 116 XMDiploma_00 5244 1.88 2.46 1.64 117 XM_UB80 5177 0.75 2.43 0.03 118 MISSING_HEADERS 5148 1.02 2.41 0.43 119 XM_B_Unsub2 5063 2.32 2.37 2.30 120 LH_URI_DOM_IN_PATH 5000 2.10 2.34 2.00 121 HELO_NODOT 4879 1.98 2.29 1.84 122 HELO_NO_DOMAIN 4874 1.97 2.28 1.84 123 XM_DK_Undo_01 4840 1.81 2.27 1.61 124 RCVD_IN_MSPIKE_L5 4817 0.74 2.26 0.09 125 REPLYTO_WITHOUT_TO_CC 4653 0.68 2.18 0.03 126 RELAYCOUNTRY_UA 4636 0.66 2.17 0.01 127 RCVD_IN_IADB_LISTED 4601 4.92 2.16 6.11 128 MIME_HTML_ONLY_MULTI 4588 2.79 2.15 3.06 129 XM_B_SpammyWords4 4587 1.16 2.15 0.74 130 FROM_EXCESS_BASE64 4559 2.49 2.14 2.64 131 MILLION_USD 4556 0.65 2.13 0.02 132 TM2_M_VERY_LONG_WORD 4506 1.47 2.11 1.20 133 TR_LOTS_OF_MONEY1 4505 0.64 2.11 0.01 134 XM_URI_RBL 4414 0.72 2.07 0.15 135 BAYES_40 4399 4.07 2.06 4.94 136 HTML_IMAGE_ONLY_12 4336 0.78 2.03 0.25 137 T_TooManySym_01 4317 3.86 2.02 4.64 138 DEAR_SOMETHING 4254 0.70 1.99 0.14 139 XM_CamelCaseFrm001 4207 1.83 1.97 1.77 140 RCVD_IN_IADB_SPF 4056 4.34 1.90 5.39 141 HTML_MIME_NO_HTML_TAG 3948 2.00 1.85 2.06 142 TR_XM_COVIDMETA4 3880 0.81 1.82 0.38 143 PDS_OTHER_BAD_TLD 3828 0.86 1.79 0.45 144 T_XMDrugObfuBody_14 3774 1.58 1.77 1.51 145 RCVD_IN_IADB_DK 3753 3.81 1.76 4.69 146 RCVD_IN_IADB_SENDERID 3742 3.92 1.75 4.84 147 RCVD_IN_PSBL 3721 0.55 1.74 0.03 148 URI_PHP_REDIR 3712 0.53 1.74 0.01 149 TR_Orig_Subnet 3671 0.53 1.72 0.02 150 T_FILL_THIS_FORM_SHORT 3661 1.18 1.72 0.94 151 MONEY_FROM_41 3651 0.51 1.71 0.00 152 RELAYCOUNTRY_KE 3639 0.51 1.71 0.00 153 XM_UB999 3544 0.50 1.66 0.00 154 TR_XM_UnparsRelay 3524 0.72 1.65 0.32 155 XM_UB95 3471 0.50 1.63 0.01 156 TR_XM_SpammyWords5 3350 0.91 1.57 0.62 157 XMSexyCombo_01 3318 0.94 1.55 0.67 158 BAYES_20 3308 3.13 1.55 3.80 159 MAILING_LIST_MULTI 3205 2.15 1.50 2.43 160 URI_NOVOWEL 3063 2.26 1.44 2.62 161 FROM_SUSPICIOUS_NTLD 3060 0.48 1.43 0.07 162 T_XMDrugObfuBody_00 2999 0.84 1.41 0.60 163 RELAYCOUNTRY_GB 2957 1.07 1.39 0.93 164 XMGenDplmaNmb 2904 1.04 1.36 0.90 165 FROM_SUSPICIOUS_NTLD_FP 2895 0.45 1.36 0.05 166 TR_XM_PHPDW 2838 0.61 1.33 0.30 167 TR_XM_PHPForged 2813 0.58 1.32 0.26 168 TR_XM_FormFill2 2762 0.57 1.29 0.26 169 XM_H_PHPOS 2750 0.56 1.29 0.25 170 XMStockSpam_06 2723 0.96 1.28 0.82 171 TR_XM_INV_DKIM 2695 0.42 1.26 0.05 172 XMBdyGiftCard01 2660 0.66 1.25 0.41 173 TR_Symld_Words 2639 1.69 1.24 1.89 174 XMClaimOffer 2617 0.48 1.23 0.15 175 XMHTML_After_End 2590 0.85 1.21 0.70 176 LongTLD 2518 0.47 1.18 0.17 177 TR_Caps_n_Bayes_99 2476 0.38 1.16 0.05 178 ALL_TRUSTED 2385 8.73 1.12 12.00 179 REMOVE_BEFORE_LINK 2374 0.50 1.11 0.24 180 TR_Mismatch_TLD_01 2350 0.48 1.10 0.21 181 XMPhish30 2343 0.56 1.10 0.33 182 URI_NO_WWW_BIZ_CGI 2271 0.33 1.06 0.02 183 T_Symld_Words_02 2242 0.71 1.05 0.57 184 RCVD_IN_IADB_VOUCHED 2150 2.85 1.01 3.64 185 TR_XM_RelayPhish 2126 0.37 1.00 0.10 186 XMSlimDrugH 2122 0.56 0.99 0.38 187 HTML_TAG_BALANCE_BODY 2114 0.60 0.99 0.44 188 HTML_IMAGE_ONLY_16 2078 0.48 0.97 0.27 189 XMMoneyMeta_00 2054 0.69 0.96 0.57 190 RELAYCOUNTRY_DE 2052 0.59 0.96 0.43 191 XM_Lotto 2043 0.38 0.96 0.13 192 TR_XM_FormFill 2000 0.29 0.94 0.01 193 BAYES_00 1970 10.45 0.92 14.54 194 TR_MetaPhish_Combo_01 1955 0.80 0.92 0.75 195 DIET_1 1929 0.56 0.90 0.42 196 XMGppyBdWords 1903 0.34 0.89 0.10 197 TR_Mismatch_TLD_02 1899 0.32 0.89 0.08 198 XM_SPF_Unknown 1876 0.73 0.88 0.66 199 RELAYCOUNTRY_NL 1866 0.38 0.87 0.16 200 DKIM_ADSP_CUSTOM_MED 1852 1.02 0.87 1.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 442403 91.26 96.32 89.08 2 RELAYCOUNTRY_US 418528 80.75 72.55 84.27 3 DKIM_SIGNED 385541 79.35 83.34 77.63 4 XM_DK_Pass 379287 77.63 80.56 76.37 5 DKIM_VALID 369256 75.76 79.02 74.35 6 XM_B_Unicode 356306 72.19 73.21 71.74 7 DCC_CHECK_NEGATIVE 285342 46.68 21.59 57.46 8 DKIM_VALID_AU 273522 57.21 62.17 55.08 9 BAYES_50 272592 49.07 35.54 54.89 10 XMListUnsubscribeExists 256661 56.77 68.60 51.68 11 XM_B_SpammyWords 245274 55.32 69.11 49.39 12 XM_B_Unicode3 201767 39.36 36.41 40.63 13 DCC_CHECK 200092 51.23 76.70 40.29 14 DKIM_VALID_EF 145290 29.60 30.39 29.25 15 T_TM2_M_HEADER_IN_MSG 144659 27.59 24.00 29.13 16 RCVD_IN_MSPIKE_WL 143864 25.24 16.57 28.97 17 RCVD_IN_MSPIKE_H2 137059 27.51 27.32 27.60 18 HTML_FONT_LOW_CONTRAST 133852 29.41 35.11 26.95 19 LOC_TINY_FONT_1 116379 26.58 33.91 23.43 20 FVGT_m_MULTI_ODD 115202 23.90 25.55 23.20 21 XM_B_SpammyWords2 106912 26.67 38.63 21.53 22 XMSubLong 101594 21.14 22.74 20.46 23 MIME_HTML_ONLY 98443 22.29 28.04 19.82 24 T_KAM_HTML_FONT_INVALID 96564 20.91 24.33 19.44 25 RCVD_IN_MSPIKE_H3 77309 13.67 9.25 15.57 26 BAYES_00 72211 10.45 0.92 14.54 27 XM_Body_Dirty_Words 65177 14.64 18.16 13.12 28 ALL_TRUSTED 59608 8.73 1.12 12.00 29 XM_Multi_Part_URI 58188 14.15 19.83 11.72 30 RCVD_IN_MSPIKE_H4 53061 9.43 6.51 10.68 31 XM_B_Unsub 52275 11.24 12.91 10.53 32 TR_XM_DK_Bayes 48060 6.98 0.69 9.68 33 TR_XM_DK_Bayes1 46841 6.79 0.64 9.43 34 LotsOfNums_01 46579 9.81 10.82 9.38 35 UNPARSEABLE_RELAY 42013 7.72 6.00 8.46 36 TooManyTo_001 41792 7.77 6.26 8.42 37 TR_XM_DK_Bayes2 41789 6.05 0.55 8.41 38 XM_DKIMWhitelistDomains 40008 5.64 0.01 8.06 39 XM_Evil_Numbers_Gen 39474 8.24 8.93 7.95 40 XM_SendGrid 38458 6.80 4.61 7.74 41 XM_DK_Undo_02 36236 18.88 45.83 7.30 42 BAYES_60 36121 7.66 8.55 7.27 43 RCVD_IN_RP_SAFE 35765 6.06 3.40 7.20 44 LOTS_OF_MONEY 34998 9.51 15.23 7.05 45 RCVD_IN_RP_CERTIFIED 32521 5.45 2.90 6.55 46 HTML_IMAGE_RATIO_02 31984 6.82 7.69 6.44 47 IN_ZIMBRA_NJ_WHITELIST 31808 4.49 0.05 6.40 48 MIME_QP_LONG_LINE 30580 5.10 2.63 6.16 49 RCVD_IN_IADB_LISTED 30354 4.92 2.16 6.11 50 XM_B_Phish_Phrases 30006 6.40 7.23 6.04 51 HTML_IMAGE_RATIO_04 27319 5.53 5.60 5.50 52 XMStrtUSub 27092 4.84 3.42 5.46 53 RCVD_IN_IADB_SPF 26744 4.34 1.90 5.39 54 TR_XM_DKIM_Undo 26566 14.37 35.35 5.35 55 XM_H_Long_From01 26387 5.29 5.22 5.31 56 FSL_BULK_SIG 26050 7.61 13.10 5.25 57 XM_B_SpammyWords3 25154 7.10 11.84 5.06 58 BAYES_40 24534 4.07 2.06 4.94 59 RCVD_IN_IADB_SENDERID 24060 3.92 1.75 4.84 60 RELAYCOUNTRY_META 23586 11.06 25.73 4.75 61 MPART_ALT_DIFF 23286 6.25 9.88 4.69 62 RCVD_IN_IADB_DK 23272 3.81 1.76 4.69 63 BAYES_99 23163 13.91 35.43 4.66 64 T_TooManySym_01 23064 3.86 2.02 4.64 65 TR_XM_DK_SendGrid 22812 4.04 2.74 4.59 66 BAYES_80 22177 5.95 9.39 4.47 67 XM_PDF 21854 3.34 0.86 4.40 68 BOTNET_IPINHOSTNAME 21804 6.72 12.15 4.39 69 HTML_IMAGE_RATIO_06 19911 4.09 4.29 4.01 70 BAYES_20 18887 3.13 1.55 3.80 71 T_REMOTE_IMAGE 18257 4.83 7.53 3.68 72 RCVD_IN_IADB_VOUCHED 18087 2.85 1.01 3.64 73 BAYES_999 17937 10.71 27.23 3.61 74 XMSexyCombo_05 17070 5.27 9.54 3.44 75 XMNumbers 16966 3.78 4.61 3.42 76 XMSubMetaSx_00 16847 4.06 5.60 3.39 77 TR_XM_PhishingBody 16326 4.32 6.72 3.29 78 DKIM_INVALID 16285 3.59 4.32 3.28 79 XM_UncommonTLD01 15933 5.85 11.99 3.21 80 MIME_HTML_ONLY_MULTI 15195 2.79 2.15 3.06 81 XM_H_Trusted_IP 15115 2.13 0.00 3.04 82 TM2_M_URI_OPT_OUT 15022 2.97 2.85 3.02 83 BAYES_95 14940 3.82 5.71 3.01 84 RCVD_IN_MSPIKE_H5 13494 2.14 0.81 2.72 85 FROM_EXCESS_BASE64 13120 2.49 2.14 2.64 86 URI_NOVOWEL 13005 2.26 1.44 2.62 87 MAILING_LIST_MULTI 12077 2.15 1.50 2.43 88 BAYES_05 12005 1.95 0.85 2.42 89 HTML_IMAGE_RATIO_08 11982 2.82 3.78 2.41 90 RCVD_IN_IADB_OPTIN 11830 1.89 0.75 2.38 91 TR_DCC_Bayes_99 11505 9.84 27.36 2.32 92 T_TooManySym_02 11489 1.83 0.71 2.31 93 XM_B_Unsub2 11444 2.32 2.37 2.30 94 MIME_HTML_MOSTLY 10783 4.05 8.42 2.17 95 TooManyTo_002 10688 1.71 0.66 2.15 96 TR_XM_SpammyWords4 10522 3.38 6.31 2.12 97 XM_B_Phish66 10410 2.66 3.99 2.10 98 BOUNCE_MESSAGE 10399 1.72 0.84 2.09 99 ANY_BOUNCE_MESSAGE 10399 1.72 0.84 2.09 100 TR_XM_SB_Phish 10248 2.33 2.93 2.06 101 HTML_MIME_NO_HTML_TAG 10244 2.00 1.85 2.06 102 XMSubPhish11 10070 2.26 2.79 2.03 103 LH_URI_DOM_IN_PATH 9945 2.10 2.34 2.00 104 XM_B_SpammyTLD 9902 2.35 3.17 1.99 105 UNTRUSTED_Relay 9671 7.26 19.61 1.95 106 T_FONT_INVIS_NAKED_TO 9387 2.56 4.11 1.89 107 TR_Symld_Words 9382 1.69 1.24 1.89 108 XM_SPF_SoftFail 9229 2.39 3.62 1.86 109 HELO_NODOT 9152 1.98 2.29 1.84 110 HELO_NO_DOMAIN 9149 1.97 2.28 1.84 111 XM_CamelCaseFrm001 8791 1.83 1.97 1.77 112 KHOP_HELO_FCRDNS 8568 3.04 6.10 1.73 113 BOTNET 8464 5.83 15.44 1.70 114 XMDiploma_00 8123 1.88 2.46 1.64 115 XM_DK_Undo_01 7989 1.81 2.27 1.61 116 T_XMDrugObfuBody_08 7816 2.24 3.80 1.57 117 TVD_RCVD_IP 7663 1.15 0.23 1.54 118 IN_HORDE_ADDRESS_BOOK 7533 1.08 0.08 1.52 119 T_XMDrugObfuBody_14 7480 1.58 1.77 1.51 120 INVALID_MSGID 7278 1.08 0.19 1.47 121 SUBJ_ALL_CAPS 7033 2.28 4.28 1.42 122 TooManyTo_003 6969 1.15 0.55 1.40 123 RELAYCOUNTRY_CA 6824 2.63 5.57 1.37 124 XMGappySubj_01 6637 1.04 0.36 1.34 125 XMCapTrack 6541 1.03 0.37 1.32 126 XM_H_Long_From02 6537 1.16 0.78 1.32 127 USER_IN_DEF_DKIM_WL 6444 0.91 0.00 1.30 128 TO_MALFORMED 6442 0.91 0.02 1.30 129 URI_HEX 6117 1.94 3.58 1.23 130 TM2_M_VERY_LONG_WORD 5953 1.47 2.11 1.20 131 XM_OfRef6 5778 1.80 3.30 1.16 132 XMSubNoVowel 5572 1.00 0.73 1.12 133 HELO_MISC_IP 5551 0.84 0.18 1.12 134 CK_HELO_DYNAMIC_SPLIT_IP 5548 0.83 0.18 1.12 135 XM_GoogleGroups 5533 0.90 0.42 1.11 136 DKIM_ADSP_CUSTOM_MED 5387 1.02 0.87 1.08 137 HTML_FONT_FACE_BAD 5332 0.95 0.67 1.07 138 URI_TRY_3LD 5207 1.49 2.51 1.05 139 RCVD_IN_BL_SPAMCOP_NET 5140 2.92 7.30 1.03 140 XM_UB50 5128 3.26 8.45 1.03 141 XM_B_COVIDMETA 5028 1.48 2.57 1.01 142 TooManyTo_004 4956 0.85 0.49 1.00 143 XMBSHREFv2 4847 0.80 0.39 0.98 144 T_FILL_THIS_FORM_SHORT 4683 1.18 1.72 0.94 145 TR_XM_SpammyWords2 4631 4.90 14.14 0.93 146 RELAYCOUNTRY_GB 4628 1.07 1.39 0.93 147 XMBrknScrpt_02 4560 2.18 5.12 0.92 148 XM_ProductURIs 4481 0.85 0.71 0.90 149 XMGenDplmaNmb 4458 1.04 1.36 0.90 150 T_TooManySym_03 4454 0.68 0.16 0.90 151 TR_MSPIKEBAYES00 4417 0.62 0.01 0.89 152 SpammyFromTLD_01 4230 2.14 5.14 0.85 153 FROM_GOV_DKIM_AU 4124 0.62 0.13 0.83 154 T_XMHurry_00 4105 1.59 3.35 0.83 155 XMStockSpam_06 4064 0.96 1.28 0.82 156 TooManyTo_005 4010 0.69 0.42 0.81 157 HTTPS_HTTP_MISMATCH 3894 0.79 0.80 0.78 158 XMBody_95 3811 0.56 0.09 0.77 159 XM_ShortIntro_01 3774 0.72 0.64 0.76 160 TR_MetaPhish_Combo_01 3743 0.80 0.92 0.75 161 TR_LOTS_OF_MONEY3 3669 2.16 5.47 0.74 162 XM_B_SpammyWords4 3662 1.16 2.15 0.74 163 XMBody_17 3486 2.38 6.29 0.70 164 XMHTML_After_End 3463 0.85 1.21 0.70 165 NML_ADSP_CUSTOM_MED 3389 0.70 0.75 0.68 166 XMSexyCombo_01 3328 0.94 1.55 0.67 167 XM_SPF_Unknown 3276 0.73 0.88 0.66 168 FORGED_GMAIL_RCVD 3231 0.69 0.79 0.65 169 T_OBFU_PDF_ATTACH 3216 0.50 0.16 0.65 170 TR_XM_SpammyWords5 3088 0.91 1.57 0.62 171 RCVD_IN_MSPIKE_BL 3086 3.41 9.89 0.62 172 T_XMDrugObfuBody_00 2980 0.84 1.41 0.60 173 XMNoVowels 2977 0.54 0.40 0.60 174 XMMoneyMeta_00 2818 0.69 0.96 0.57 175 T_Symld_Words_02 2806 0.71 1.05 0.57 176 SHORT_HELO_AND_INLINE_IMAGE 2731 0.41 0.07 0.55 177 DKIM_ADSP_NXDOMAIN 2708 0.50 0.41 0.55 178 RCVD_IN_SORBS_DUL 2650 0.42 0.14 0.53 179 XMOemUri 2624 0.42 0.17 0.53 180 XM_H_PHPMailer 2606 0.52 0.52 0.52 181 HTML_IMAGE_ONLY_20 2602 0.46 0.31 0.52 182 NO_DNS_FOR_FROM 2569 0.46 0.31 0.52 183 XMHTMLBadTable_001 2530 0.53 0.57 0.51 184 T_TooManySym_04 2501 0.37 0.07 0.50 185 XMBody_78 2439 0.59 0.84 0.49 186 XM_DIRTYINTL 2422 1.50 3.85 0.49 187 FROM_GOV_SPOOF 2419 0.39 0.15 0.49 188 TM2_M_BODY_EMPTY 2415 0.35 0.05 0.49 189 RDNS_DYNAMIC 2414 0.57 0.78 0.49 190 RCVD_IN_MSPIKE_L3 2401 2.45 7.02 0.48 191 XMSubMetaI_00 2400 0.59 0.84 0.48 192 NUMERIC_HTTP_ADDR 2399 0.43 0.30 0.48 193 XM_S_SubURI 2282 0.34 0.06 0.46 194 XMLngstWrd_00 2256 0.50 0.60 0.45 195 HTML_IMAGE_ONLY_32 2248 0.40 0.29 0.45 196 PDS_OTHER_BAD_TLD 2247 0.86 1.79 0.45 197 TR_XM_SpammyWords3 2223 2.26 6.48 0.45 198 XMPhish08 2189 0.56 0.83 0.44 199 HTML_TAG_BALANCE_BODY 2164 0.60 0.99 0.44 200 SENDGRID_REDIR 2161 0.52 0.71 0.44 ----------------------------------------------------------------------