Email: 718224 Autolearn: 0 AvgScore: 4.49 AvgScanTime: 1.38 sec Spam: 238623 Autolearn: 0 AvgScore: 14.68 AvgScanTime: 1.45 sec Ham: 479601 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 1.34 sec Time Spent Running SA: 275.24 hours Time Spent Processing Spam: 96.27 hours Time Spent Processing Ham: 178.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 223410 90.95 93.62 89.62 2 DKIM_SIGNED 194502 78.17 81.51 76.50 3 XM_DK_Pass 189888 76.65 79.58 75.19 4 DCC_CHECK 189532 53.72 79.43 40.93 5 DKIM_VALID 185479 74.73 77.73 73.23 6 XM_B_Unicode 179704 73.93 75.31 73.25 7 RELAYCOUNTRY_US 174624 79.97 73.18 83.34 8 XMListUnsubscribeExists 165870 57.63 69.51 51.71 9 XM_B_SpammyWords 159316 54.28 66.76 48.07 10 DKIM_VALID_AU 141014 55.71 59.09 54.03 11 XM_DK_Undo_02 114230 20.53 47.87 6.92 12 BAYES_99 96414 16.42 40.40 4.49 13 XM_B_SpammyWords2 95724 27.46 40.12 21.16 14 TR_XM_DKIM_Undo 90453 15.94 37.91 5.02 15 HTML_FONT_LOW_CONTRAST 85608 30.64 35.88 28.03 16 XM_B_Unicode3 82958 39.83 34.77 42.35 17 LOC_TINY_FONT_1 81218 28.27 34.04 25.40 18 BAYES_999 78585 13.30 32.93 3.53 19 TR_DCC_Bayes_99 76697 12.08 32.14 2.10 20 RCVD_IN_MSPIKE_H2 76658 29.32 32.13 27.93 21 BAYES_50 74930 47.46 31.40 55.45 22 MIME_HTML_ONLY 71642 25.12 30.02 22.69 23 DKIM_VALID_EF 70934 28.39 29.73 27.73 24 FVGT_m_MULTI_ODD 63638 24.03 26.67 22.72 25 T_KAM_HTML_FONT_INVALID 57173 20.78 23.96 19.20 26 RELAYCOUNTRY_META 56741 11.04 23.78 4.71 27 T_TM2_M_HEADER_IN_MSG 51367 26.26 21.53 28.61 28 XMSubLong 49378 20.78 20.69 20.83 29 XM_Multi_Part_URI 47329 14.50 19.83 11.84 30 DCC_CHECK_NEGATIVE 45486 44.46 19.06 57.10 31 UNTRUSTED_Relay 43432 7.32 18.20 1.91 32 XM_Body_Dirty_Words 40175 14.22 16.84 12.92 33 LOTS_OF_MONEY 39959 10.73 16.75 7.74 34 TR_XM_SpammyWords2 39439 5.87 16.53 0.57 35 FSL_BULK_SIG 36874 9.46 15.45 6.47 36 BOTNET 36407 6.11 15.26 1.55 37 TR_XM_SpammyWords4 34976 8.22 14.66 5.01 38 RCVD_IN_MSPIKE_WL 34808 24.00 14.59 28.69 39 BOTNET_IPINHOSTNAME 34564 7.63 14.48 4.23 40 XM_B_Unsub 29654 12.10 12.43 11.94 41 XM_B_SpammyWords3 28011 7.48 11.74 5.37 42 LotsOfNums_01 27967 10.29 11.72 9.58 43 RCVD_IN_MSPIKE_BL 25587 3.93 10.72 0.55 44 XM_UncommonTLD01 24738 5.56 10.37 3.17 45 XMSexyCombo_05 22944 5.80 9.62 3.90 46 BAYES_80 21672 5.93 9.08 4.36 47 HTML_MIME_NO_HTML_TAG 19825 4.18 8.31 2.13 48 BAYES_60 19754 7.92 8.28 7.75 49 RCVD_IN_BL_SPAMCOP_NET 19517 3.44 8.18 1.08 50 T_REMOTE_IMAGE 19267 4.96 8.07 3.41 51 URIBL_SBL_A 19034 2.84 7.98 0.29 52 XM_Evil_Numbers_Gen 18690 8.24 7.83 8.44 53 HTML_IMAGE_RATIO_02 18442 6.96 7.73 6.58 54 RCVD_IN_MSPIKE_H3 18273 13.23 7.66 16.00 55 MPART_ALT_DIFF 17883 6.44 7.49 5.92 56 KHOP_HELO_FCRDNS 17143 3.36 7.18 1.46 57 XM_B_Phish_Phrases 16249 4.98 6.81 4.06 58 TR_LOTS_OF_MONEY3 15874 2.70 6.65 0.74 59 TooManyTo_001 15845 7.47 6.64 7.88 60 BODY_URI_ONLY 15483 2.19 6.49 0.05 61 TR_XM_SpammyWords3 15254 2.37 6.39 0.36 62 RCVD_IN_MSPIKE_L3 15067 2.35 6.31 0.38 63 MIME_HTML_MOSTLY 15067 3.64 6.31 2.30 64 XMSubMetaSx_00 14871 4.76 6.23 4.02 65 XM_UB50 14735 2.72 6.18 1.01 66 RCVD_IN_MSPIKE_H4 14376 8.84 6.02 10.25 67 RELAYCOUNTRY_CA 14368 3.05 6.02 1.57 68 HTML_IMAGE_RATIO_08 14258 3.56 5.98 2.35 69 HTML_IMAGE_ONLY_08 14240 2.05 5.97 0.10 70 HTML_IMAGE_RATIO_04 14112 6.17 5.91 6.30 71 XM_H_Long_From01 12978 5.33 5.44 5.27 72 BAYES_95 12977 3.60 5.44 2.68 73 UNPARSEABLE_RELAY 12796 7.52 5.36 8.60 74 TR_XM_SpammyWords5 12226 2.73 5.12 1.54 75 TR_XM_PhishingBody 12165 3.81 5.10 3.17 76 XM_B_SpammyTLD 11648 2.89 4.88 1.90 77 XMNumbers 11505 3.60 4.82 2.99 78 TR_XM_MaxBayes 11399 1.60 4.78 0.02 79 TM2_M_URI_OPT_OUT 11051 4.31 4.63 4.15 80 T_FONT_INVIS_NAKED_TO 10491 2.90 4.40 2.16 81 XM_SendGrid 10324 6.43 4.33 7.48 82 RCVD_IN_RP_RNBL 9896 1.43 4.15 0.08 83 SpammyFromTLD_01 9888 1.90 4.14 0.78 84 XM_OfRef6 9413 2.09 3.94 1.16 85 XMBody_17 9215 1.70 3.86 0.63 86 DKIM_INVALID 9023 3.44 3.78 3.27 87 RCVD_IN_MSPIKE_L5 8942 1.32 3.75 0.12 88 XM_UB60 8838 1.29 3.70 0.10 89 DATE_IN_PAST_03_06 8702 1.25 3.65 0.06 90 TR_XM_MaxSPIKE 8521 1.20 3.57 0.03 91 RCVD_IN_PSBL 8341 1.23 3.50 0.10 92 XMStrtUSub 8298 3.90 3.48 4.11 93 TR_XM_MSPIKECOMBO 8289 1.20 3.47 0.08 94 RCVD_IN_RP_SAFE 8283 6.16 3.47 7.49 95 T_XMDrugObfuBody_08 7989 2.34 3.35 1.83 96 RELAYCOUNTRY_FR 7968 1.30 3.34 0.29 97 SUBJ_ALL_CAPS 7819 2.30 3.28 1.82 98 XM_UB99 7762 1.08 3.25 0.00 99 SpammyFromTLD_02 7731 1.28 3.24 0.30 100 XMSlimDrugH 7620 1.27 3.19 0.31 101 XMDiploma_00 7566 2.16 3.17 1.66 102 XMBrknScrpt_02 7438 1.59 3.12 0.84 103 TM2_M_VERY_LONG_WORD 7360 1.86 3.08 1.25 104 URI_HEX 7356 1.87 3.08 1.27 105 XM_B_Phish66 7302 2.22 3.06 1.81 106 XM_DIRTYINTL 7209 1.31 3.02 0.45 107 HTML_IMAGE_RATIO_06 7158 3.67 3.00 4.01 108 XM_SPF_SoftFail 7127 1.98 2.99 1.48 109 XM_UB80 6834 0.97 2.86 0.03 110 URI_TRY_3LD 6829 1.81 2.86 1.28 111 RELAYCOUNTRY_IN 6706 1.00 2.81 0.10 112 TR_Symld_Words 6614 2.12 2.77 1.80 113 PDS_OTHER_BAD_TLD 6484 1.22 2.72 0.47 114 T_XMHurry_00 6475 1.36 2.71 0.69 115 HTML_FONT_SIZE_LARGE 6402 0.95 2.68 0.09 116 T_FILL_THIS_FORM_SHORT 6370 1.46 2.67 0.87 117 T_Symld_Words_02 6257 1.19 2.62 0.48 118 MIME_HTML_ONLY_MULTI 6239 3.66 2.61 4.18 119 RCVD_IN_RP_CERTIFIED 6237 5.37 2.61 6.74 120 MIME_QP_LONG_LINE 6175 4.81 2.59 5.91 121 RELAYCOUNTRY_UA 6137 0.86 2.57 0.01 122 XM_B_Unsub2 6110 2.01 2.56 1.74 123 TVD_SPACE_RATIO 5925 1.11 2.48 0.43 124 TR_XM_UnparsRelay 5774 1.96 2.42 1.73 125 TR_XM_DK_SendGrid 5703 3.92 2.39 4.67 126 TO_NO_BRKTS_HTML_ONLY 5678 0.90 2.38 0.17 127 XM_UB999 5547 0.77 2.32 0.00 128 PDS_FROM_2_EMAILS 5530 0.80 2.32 0.04 129 FROM_2_EMAILS_SHORT 5505 0.77 2.31 0.01 130 XM_B_COVIDMETA 5352 1.43 2.24 1.03 131 T_TooManySym_01 5245 4.29 2.20 5.33 132 PDS_TO_EQ_FROM_NAME 5176 0.73 2.17 0.01 133 XM_DK_Undo_01 5161 1.80 2.16 1.61 134 BOTNET_NORDNS 5133 0.73 2.15 0.02 135 TR_XM_SB_Phish 4924 2.05 2.06 2.04 136 XM_CamelCaseFrm001 4920 2.08 2.06 2.09 137 FROM_EXCESS_BASE64 4898 2.75 2.05 3.10 138 BAYES_40 4827 3.93 2.02 4.88 139 T_XMDrugObfuBody_14 4719 2.09 1.98 2.14 140 TR_XM_FormFill 4699 0.66 1.97 0.01 141 NO_FM_NAME_IP_HOSTN 4639 0.65 1.94 0.01 142 XMSubPhish11 4574 1.98 1.92 2.02 143 TVD_SPACE_RATIO_MINFP 4567 0.64 1.91 0.01 144 FROM_SUSPICIOUS_NTLD 4493 0.68 1.88 0.08 145 DRUGS_ERECTILE 4470 0.65 1.87 0.05 146 LONG_JUNK_URI 4436 0.65 1.86 0.05 147 XMSubMetaD_00 4332 0.64 1.82 0.06 148 FROM_SUSPICIOUS_NTLD_FP 4328 0.65 1.81 0.07 149 RCVD_IN_IADB_LISTED 4323 4.67 1.81 6.09 150 XMSubMetaD_03 4301 0.62 1.80 0.03 151 XM_B_SpammyWords4 4209 0.89 1.76 0.46 152 TR_Mismatch_TLD_01 4188 0.86 1.76 0.41 153 XMSubNoVowel 4135 1.75 1.73 1.75 154 SERGIO_SUBJECT_VIAGRA01 4059 0.57 1.70 0.00 155 XMSubMetaD_01 4052 0.57 1.70 0.01 156 XMSubMetaD_02 4050 0.57 1.70 0.00 157 SUBJECT_DRUG_GAP_C 4048 0.57 1.70 0.00 158 XM_UB95 4022 0.57 1.69 0.01 159 SUBJECT_DRUG_GAP_L 3968 0.56 1.66 0.00 160 XMSexyCombo_01 3815 1.23 1.60 1.04 161 RCVD_IN_IADB_SPF 3778 4.06 1.58 5.29 162 XMGenDplmaNmb 3677 1.07 1.54 0.84 163 TR_Caps_n_Bayes_99 3660 0.57 1.53 0.10 164 ANY_BOUNCE_MESSAGE 3643 2.17 1.53 2.49 165 BOUNCE_MESSAGE 3636 2.17 1.52 2.49 166 TR_XM_COVIDMETA4 3618 0.73 1.52 0.34 167 RCVD_IN_IADB_DK 3477 3.54 1.46 4.58 168 RCVD_IN_IADB_SENDERID 3456 3.63 1.45 4.71 169 T_XMDrugObfuBody_00 3453 1.02 1.45 0.81 170 XM_URI_RBL 3396 0.60 1.42 0.20 171 ALL_TRUSTED 3381 9.06 1.42 12.86 172 BAYES_20 3370 2.97 1.41 3.75 173 TR_XM_SpoofStaff 3364 0.51 1.41 0.06 174 XMSpoofStaff2 3330 0.50 1.40 0.06 175 TR_Mismatch_TLD_02 3317 0.53 1.39 0.09 176 TR_XM_INV_DKIM 3248 0.53 1.36 0.12 177 XMHTML_After_End 3202 1.04 1.34 0.89 178 XMBdyGiftCard01 3197 0.89 1.34 0.67 179 XMStockSpam_06 3189 1.23 1.34 1.17 180 URI_PHP_REDIR 3187 0.45 1.34 0.01 181 RELAYCOUNTRY_GB 3135 1.05 1.31 0.92 182 HK_RANDOM_REPLYTO 3112 0.56 1.30 0.19 183 TR_XM_COVIDMETA1 3001 0.64 1.26 0.34 184 MIMEOLE_DIRECT_TO_MX 2975 0.42 1.25 0.00 185 XMBody_78 2809 0.68 1.18 0.44 186 BAYES_00 2772 9.96 1.16 14.33 187 HTML_IMAGE_ONLY_20 2660 0.75 1.11 0.57 188 TR_XM_SpoofStaff2 2636 0.37 1.10 0.00 189 XMMoneyMeta_00 2605 0.71 1.09 0.52 190 XM_H_SpoofStaff4 2598 0.40 1.09 0.06 191 TR_XM_PSC1 2597 0.40 1.09 0.06 192 LongTLD 2529 0.45 1.06 0.15 193 TR_XM_PHPDW 2514 0.54 1.05 0.28 194 URI_NO_WWW_BIZ_CGI 2472 0.36 1.04 0.02 195 XM_OfRef7 2460 0.45 1.03 0.16 196 URI_NOVOWEL 2431 2.27 1.02 2.89 197 TR_XM_PHPForged 2410 0.49 1.01 0.24 198 TR_XM_FormFill2 2396 0.49 1.00 0.24 199 XM_H_PHPOS 2394 0.49 1.00 0.23 200 URI_ONLY_MSGID_MALF 2390 0.33 1.00 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 429835 90.95 93.62 89.62 2 RELAYCOUNTRY_US 399721 79.97 73.18 83.34 3 DKIM_SIGNED 366911 78.17 81.51 76.50 4 XM_DK_Pass 360601 76.65 79.58 75.19 5 XM_B_Unicode 351310 73.93 75.31 73.25 6 DKIM_VALID 351233 74.73 77.73 73.23 7 DCC_CHECK_NEGATIVE 273835 44.46 19.06 57.10 8 BAYES_50 265920 47.46 31.40 55.45 9 DKIM_VALID_AU 259106 55.71 59.09 54.03 10 XMListUnsubscribeExists 248007 57.63 69.51 51.71 11 XM_B_SpammyWords 230555 54.28 66.76 48.07 12 XM_B_Unicode3 203106 39.83 34.77 42.35 13 DCC_CHECK 196303 53.72 79.43 40.93 14 RCVD_IN_MSPIKE_WL 137592 24.00 14.59 28.69 15 T_TM2_M_HEADER_IN_MSG 137223 26.26 21.53 28.61 16 HTML_FONT_LOW_CONTRAST 134433 30.64 35.88 28.03 17 RCVD_IN_MSPIKE_H2 133932 29.32 32.13 27.93 18 DKIM_VALID_EF 132978 28.39 29.73 27.73 19 LOC_TINY_FONT_1 121811 28.27 34.04 25.40 20 FVGT_m_MULTI_ODD 108969 24.03 26.67 22.72 21 MIME_HTML_ONLY 108803 25.12 30.02 22.69 22 XM_B_SpammyWords2 101468 27.46 40.12 21.16 23 XMSubLong 99901 20.78 20.69 20.83 24 T_KAM_HTML_FONT_INVALID 92094 20.78 23.96 19.20 25 RCVD_IN_MSPIKE_H3 76716 13.23 7.66 16.00 26 BAYES_00 68742 9.96 1.16 14.33 27 XM_Body_Dirty_Words 61972 14.22 16.84 12.92 28 ALL_TRUSTED 61657 9.06 1.42 12.86 29 XM_B_Unsub 57287 12.10 12.43 11.94 30 XM_Multi_Part_URI 56786 14.50 19.83 11.84 31 RCVD_IN_MSPIKE_H4 49150 8.84 6.02 10.25 32 TR_XM_DK_Bayes 45974 6.71 0.94 9.59 33 LotsOfNums_01 45969 10.29 11.72 9.58 34 TR_XM_DK_Bayes1 44502 6.48 0.85 9.28 35 UNPARSEABLE_RELAY 41229 7.52 5.36 8.60 36 XM_Evil_Numbers_Gen 40467 8.24 7.83 8.44 37 TR_XM_DK_Bayes2 39256 5.73 0.79 8.19 38 XM_DKIMWhitelistDomains 38541 5.38 0.05 8.04 39 TooManyTo_001 37772 7.47 6.64 7.88 40 BAYES_60 37149 7.92 8.28 7.75 41 LOTS_OF_MONEY 37104 10.73 16.75 7.74 42 RCVD_IN_RP_SAFE 35935 6.16 3.47 7.49 43 XM_SendGrid 35856 6.43 4.33 7.48 44 XM_DK_Undo_02 33194 20.53 47.87 6.92 45 RCVD_IN_RP_CERTIFIED 32327 5.37 2.61 6.74 46 HTML_IMAGE_RATIO_02 31554 6.96 7.73 6.58 47 FSL_BULK_SIG 31043 9.46 15.45 6.47 48 HTML_IMAGE_RATIO_04 30197 6.17 5.91 6.30 49 RCVD_IN_IADB_LISTED 29193 4.67 1.81 6.09 50 MPART_ALT_DIFF 28371 6.44 7.49 5.92 51 MIME_QP_LONG_LINE 28367 4.81 2.59 5.91 52 IN_ZIMBRA_NJ_WHITELIST 28353 3.99 0.12 5.91 53 XM_B_SpammyWords3 25733 7.48 11.74 5.37 54 T_TooManySym_01 25551 4.29 2.20 5.33 55 RCVD_IN_IADB_SPF 25369 4.06 1.58 5.29 56 XM_H_Long_From01 25275 5.33 5.44 5.27 57 TR_XM_DKIM_Undo 24064 15.94 37.91 5.02 58 TR_XM_SpammyWords4 24045 8.22 14.66 5.01 59 BAYES_40 23424 3.93 2.02 4.88 60 RCVD_IN_IADB_SENDERID 22599 3.63 1.45 4.71 61 RELAYCOUNTRY_META 22583 11.04 23.78 4.71 62 TR_XM_DK_SendGrid 22420 3.92 2.39 4.67 63 RCVD_IN_IADB_DK 21943 3.54 1.46 4.58 64 BAYES_99 21539 16.42 40.40 4.49 65 XM_PDF 21234 3.15 0.59 4.43 66 XM_H_Trusted_IP 20995 2.92 0.00 4.38 67 BAYES_80 20919 5.93 9.08 4.36 68 BOTNET_IPINHOSTNAME 20269 7.63 14.48 4.23 69 MIME_HTML_ONLY_MULTI 20061 3.66 2.61 4.18 70 TM2_M_URI_OPT_OUT 19915 4.31 4.63 4.15 71 XMStrtUSub 19723 3.90 3.48 4.11 72 XM_B_Phish_Phrases 19489 4.98 6.81 4.06 73 XMSubMetaSx_00 19293 4.76 6.23 4.02 74 HTML_IMAGE_RATIO_06 19228 3.67 3.00 4.01 75 XMSexyCombo_05 18701 5.80 9.62 3.90 76 RCVD_IN_IADB_VOUCHED 18518 2.88 0.91 3.86 77 BAYES_20 17963 2.97 1.41 3.75 78 BAYES_999 16920 13.30 32.93 3.53 79 T_REMOTE_IMAGE 16337 4.96 8.07 3.41 80 DKIM_INVALID 15678 3.44 3.78 3.27 81 XM_UncommonTLD01 15224 5.56 10.37 3.17 82 TR_XM_PhishingBody 15210 3.81 5.10 3.17 83 FROM_EXCESS_BASE64 14860 2.75 2.05 3.10 84 XMNumbers 14317 3.60 4.82 2.99 85 URI_NOVOWEL 13867 2.27 1.02 2.89 86 BAYES_95 12848 3.60 5.44 2.68 87 T_TooManySym_02 12177 1.94 0.75 2.54 88 RCVD_IN_IADB_OPTIN 12059 1.89 0.64 2.51 89 ANY_BOUNCE_MESSAGE 11944 2.17 1.53 2.49 90 BOUNCE_MESSAGE 11942 2.17 1.52 2.49 91 MAILING_LIST_MULTI 11754 1.92 0.86 2.45 92 RCVD_IN_MSPIKE_H5 11726 1.93 0.90 2.44 93 HTML_IMAGE_RATIO_08 11284 3.56 5.98 2.35 94 BAYES_05 11086 1.81 0.80 2.31 95 MIME_HTML_MOSTLY 11051 3.64 6.31 2.30 96 T_FONT_INVIS_NAKED_TO 10370 2.90 4.40 2.16 97 T_XMDrugObfuBody_14 10277 2.09 1.98 2.14 98 HTML_MIME_NO_HTML_TAG 10216 4.18 8.31 2.13 99 TR_DCC_Bayes_99 10071 12.08 32.14 2.10 100 XM_CamelCaseFrm001 10010 2.08 2.06 2.09 101 TooManyTo_002 9890 1.54 0.50 2.06 102 TR_XM_SB_Phish 9797 2.05 2.06 2.04 103 XMSubPhish11 9680 1.98 1.92 2.02 104 HTML_FONT_FACE_BAD 9270 1.45 0.48 1.93 105 UNTRUSTED_Relay 9161 7.32 18.20 1.91 106 XM_B_SpammyTLD 9118 2.89 4.88 1.90 107 T_XMDrugObfuBody_08 8796 2.34 3.35 1.83 108 SUBJ_ALL_CAPS 8736 2.30 3.28 1.82 109 XM_B_Phish66 8671 2.22 3.06 1.81 110 TR_Symld_Words 8616 2.12 2.77 1.80 111 XMSubNoVowel 8414 1.75 1.73 1.75 112 XM_B_Unsub2 8359 2.01 2.56 1.74 113 TR_XM_UnparsRelay 8293 1.96 2.42 1.73 114 XMDiploma_00 7971 2.16 3.17 1.66 115 XM_DK_Undo_01 7739 1.80 2.16 1.61 116 IN_HORDE_ADDRESS_BOOK 7569 1.21 0.47 1.58 117 RELAYCOUNTRY_CA 7543 3.05 6.02 1.57 118 BOTNET 7452 6.11 15.26 1.55 119 INVALID_MSGID 7388 1.16 0.39 1.54 120 TR_XM_SpammyWords5 7382 2.73 5.12 1.54 121 XM_SPF_SoftFail 7121 1.98 2.99 1.48 122 KHOP_HELO_FCRDNS 7012 3.36 7.18 1.46 123 TVD_RCVD_IP 6857 1.08 0.38 1.43 124 MSGID_NOFQDN1 6688 0.94 0.03 1.39 125 TooManyTo_003 6626 1.06 0.40 1.38 126 TO_MALFORMED 6601 0.92 0.01 1.38 127 HELO_NODOT 6467 1.12 0.67 1.35 128 HELO_NO_DOMAIN 6466 1.12 0.67 1.35 129 URI_TRY_3LD 6160 1.81 2.86 1.28 130 URI_HEX 6094 1.87 3.08 1.27 131 TM2_M_VERY_LONG_WORD 6013 1.86 3.08 1.25 132 XMGappySubj_01 5984 0.88 0.13 1.25 133 CK_HELO_DYNAMIC_SPLIT_IP 5724 1.04 0.74 1.19 134 HELO_MISC_IP 5722 0.91 0.34 1.19 135 XMStockSpam_06 5631 1.23 1.34 1.17 136 XM_OfRef6 5573 2.09 3.94 1.16 137 DKIM_ADSP_CUSTOM_MED 5561 1.06 0.87 1.16 138 XM_GoogleGroups 5542 0.90 0.39 1.16 139 RCVD_IN_BL_SPAMCOP_NET 5169 3.44 8.18 1.08 140 USER_IN_DEF_DKIM_WL 5135 0.72 0.00 1.07 141 XMSexyCombo_01 5005 1.23 1.60 1.04 142 XM_H_Long_From02 4959 0.98 0.87 1.03 143 XMSubMetaSxObfu_03 4953 0.96 0.81 1.03 144 XMCapTrack 4939 0.77 0.25 1.03 145 XM_B_COVIDMETA 4916 1.43 2.24 1.03 146 XMBSHREFv2 4881 0.75 0.21 1.02 147 XM_UB50 4829 2.72 6.18 1.01 148 TooManyTo_004 4750 0.78 0.35 0.99 149 TR_MSPIKEBAYES00 4595 0.64 0.01 0.96 150 RELAYCOUNTRY_GB 4429 1.05 1.31 0.92 151 T_TooManySym_03 4343 0.65 0.13 0.91 152 XM_ProductURIs 4339 0.80 0.60 0.90 153 XMHTML_After_End 4274 1.04 1.34 0.89 154 T_FILL_THIS_FORM_SHORT 4149 1.46 2.67 0.87 155 XMBrknScrpt_02 4013 1.59 3.12 0.84 156 XMGenDplmaNmb 4011 1.07 1.54 0.84 157 T_XMDrugObfuBody_00 3886 1.02 1.45 0.81 158 TooManyTo_005 3830 0.63 0.30 0.80 159 SpammyFromTLD_01 3752 1.90 4.14 0.78 160 XMSubEmpty 3671 0.75 0.73 0.77 161 XMBody_95 3645 0.55 0.12 0.76 162 TR_LOTS_OF_MONEY3 3539 2.70 6.65 0.74 163 DIET_1 3502 0.77 0.86 0.73 164 NML_ADSP_CUSTOM_MED 3398 0.69 0.66 0.71 165 FORGED_GMAIL_RCVD 3319 0.69 0.68 0.69 166 T_XMHurry_00 3302 1.36 2.71 0.69 167 T_OBFU_PDF_ATTACH 3284 0.49 0.09 0.68 168 HTTPS_HTTP_MISMATCH 3264 0.69 0.71 0.68 169 FROM_GOV_DKIM_AU 3251 0.53 0.22 0.68 170 XMBdyGiftCard01 3214 0.89 1.34 0.67 171 XMSubMetaI_00 3078 0.70 0.81 0.64 172 XM_SPF_Unknown 3043 0.59 0.50 0.63 173 TR_MetaPhish_Combo_01 3037 0.66 0.70 0.63 174 XMBody_17 3003 1.70 3.86 0.63 175 SHORTENED_URL_HREF 2874 0.65 0.77 0.60 176 NUMERIC_HTTP_ADDR 2784 0.53 0.42 0.58 177 DKIM_ADSP_NXDOMAIN 2776 0.52 0.39 0.58 178 HTML_IMAGE_ONLY_20 2757 0.75 1.11 0.57 179 TR_XM_SpammyWords2 2738 5.87 16.53 0.57 180 NO_DNS_FOR_FROM 2736 0.47 0.28 0.57 181 RCVD_IN_MSPIKE_BL 2656 3.93 10.72 0.55 182 XMHTMLBadTable_001 2566 0.54 0.55 0.54 183 XMSubMetaSxObfu_02 2559 0.42 0.19 0.53 184 T_TooManySym_04 2492 0.36 0.02 0.52 185 XMMoneyMeta_00 2481 0.71 1.09 0.52 186 XM_ShortIntro_01 2406 0.52 0.55 0.50 187 XMSexyCombo_04 2405 0.56 0.68 0.50 188 XM_B_COPY_HTML 2358 0.50 0.52 0.49 189 XMNoVowels 2357 0.56 0.69 0.49 190 XMPhish30 2346 0.58 0.75 0.49 191 T_Symld_Words_02 2297 1.19 2.62 0.48 192 HTML_TAG_BALANCE_BODY 2286 0.62 0.90 0.48 193 XM_S_SubURI 2284 0.33 0.03 0.48 194 PDS_OTHER_BAD_TLD 2268 1.22 2.72 0.47 195 TM2_M_BODY_EMPTY 2219 0.33 0.05 0.46 196 XMSubMetaSx_01 2214 0.50 0.56 0.46 197 XM_B_SpammyWords4 2211 0.89 1.76 0.46 198 RDNS_DYNAMIC 2188 0.63 0.97 0.46 199 XM_H_PHPMailer 2171 0.43 0.39 0.45 200 XM_DIRTYINTL 2167 1.31 3.02 0.45 ----------------------------------------------------------------------