Email: 710985 Autolearn: 0 AvgScore: 4.07 AvgScanTime: 1.33 sec Spam: 223859 Autolearn: 0 AvgScore: 14.13 AvgScanTime: 1.46 sec Ham: 487126 Autolearn: 0 AvgScore: -0.55 AvgScanTime: 1.26 sec Time Spent Running SA: 261.87 hours Time Spent Processing Spam: 90.76 hours Time Spent Processing Ham: 171.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 208560 89.79 93.17 88.23 2 DCC_CHECK 176358 53.42 78.78 41.77 3 DKIM_SIGNED 175669 77.65 78.47 77.27 4 XM_DK_Pass 169993 76.09 75.94 76.17 5 DKIM_VALID 167591 74.36 74.86 74.13 6 RELAYCOUNTRY_US 158535 79.10 70.82 82.91 7 XM_B_Unicode 157927 71.31 70.55 71.66 8 XMListUnsubscribeExists 147946 55.29 66.09 50.33 9 XM_B_SpammyWords 141723 53.46 63.31 48.94 10 DKIM_VALID_AU 131701 56.87 58.83 55.97 11 XM_DK_Undo_02 98003 19.55 43.78 8.42 12 XM_B_Unicode3 82075 40.13 36.66 41.72 13 BAYES_50 80312 49.26 35.88 55.41 14 TR_XM_DKIM_Undo 78715 15.35 35.16 6.25 15 LOC_TINY_FONT_1 77331 27.44 34.54 24.17 16 BAYES_99 76396 14.15 34.13 4.96 17 HTML_FONT_LOW_CONTRAST 74765 28.47 33.40 26.20 18 XM_B_SpammyWords2 74322 24.96 33.20 21.18 19 MIME_HTML_ONLY 68480 24.03 30.59 21.02 20 RCVD_IN_MSPIKE_H2 66285 28.12 29.61 27.44 21 DKIM_VALID_EF 61356 29.08 27.41 29.85 22 BAYES_999 61238 11.32 27.36 3.96 23 TR_DCC_Bayes_99 60168 10.32 26.88 2.71 24 FVGT_m_MULTI_ODD 58501 23.90 26.13 22.87 25 RELAYCOUNTRY_META 56609 11.26 25.29 4.81 26 XMSubLong 52316 22.02 23.37 21.40 27 T_KAM_HTML_FONT_INVALID 50568 19.70 22.59 18.37 28 UNTRUSTED_Relay 48999 8.21 21.89 1.93 29 XM_Multi_Part_URI 47479 14.40 21.21 11.27 30 DCC_CHECK_NEGATIVE 43899 44.65 19.61 56.16 31 T_TM2_M_HEADER_IN_MSG 42722 25.38 19.08 28.27 32 BOTNET 40021 6.91 17.88 1.87 33 FSL_BULK_SIG 39106 10.06 17.47 6.65 34 RCVD_IN_MSPIKE_WL 37533 25.86 16.77 30.04 35 XM_Body_Dirty_Words 35540 14.00 15.88 13.14 36 BOTNET_IPINHOSTNAME 30385 7.27 13.57 4.37 37 LotsOfNums_01 28394 10.01 12.68 8.77 38 XM_B_Unsub 27631 11.78 12.34 11.52 39 LOTS_OF_MONEY 25631 8.36 11.45 6.94 40 XM_UncommonTLD01 24969 5.83 11.15 3.38 41 TR_XM_SpammyWords2 24885 3.92 11.12 0.62 42 XM_B_SpammyWords3 24148 6.84 10.79 5.03 43 HTML_MIME_NO_HTML_TAG 22570 4.52 10.08 1.97 44 XMSexyCombo_05 21701 5.93 9.69 4.20 45 BAYES_60 21554 8.42 9.63 7.86 46 T_REMOTE_IMAGE 21383 5.40 9.55 3.50 47 XM_Evil_Numbers_Gen 21337 8.99 9.53 8.74 48 TR_XM_SpammyWords4 21116 6.09 9.43 4.56 49 HTML_IMAGE_RATIO_02 20670 7.40 9.23 6.56 50 RCVD_IN_MSPIKE_H3 20196 13.85 9.02 16.07 51 BAYES_80 20089 5.92 8.97 4.52 52 XM_UB50 19200 3.43 8.58 1.06 53 MPART_ALT_DIFF 18206 5.79 8.13 4.72 54 RCVD_IN_BL_SPAMCOP_NET 18172 3.75 8.12 1.74 55 BODY_URI_ONLY 18166 2.59 8.11 0.05 56 KHOP_HELO_FCRDNS 17745 3.52 7.93 1.50 57 HTML_IMAGE_ONLY_08 16198 2.37 7.24 0.14 58 RCVD_IN_MSPIKE_H4 15599 9.37 6.97 10.47 59 UNPARSEABLE_RELAY 15532 7.57 6.94 7.86 60 XMSubMetaSx_00 14938 4.32 6.67 3.24 61 TR_XM_UnparsRelay 14915 5.85 6.66 5.48 62 MIME_HTML_MOSTLY 14745 3.56 6.59 2.17 63 RCVD_IN_MSPIKE_BL 14413 2.19 6.44 0.24 64 TooManyTo_001 14192 7.50 6.34 8.03 65 TR_XM_MSPIKECOMBO 14099 2.14 6.30 0.23 66 XM_H_Long_From01 13784 6.03 6.16 5.97 67 XMNumbers 13503 3.72 6.03 2.65 68 HTML_IMAGE_RATIO_08 13252 3.56 5.92 2.48 69 XM_B_Phish_Phrases 13140 6.09 5.87 6.19 70 XM_SendGrid 13034 6.72 5.82 7.13 71 BAYES_95 11888 3.57 5.31 2.77 72 HTML_IMAGE_RATIO_06 11784 4.85 5.26 4.65 73 TR_XM_PhishingBody 11488 3.71 5.13 3.06 74 XM_B_SpammyTLD 10682 3.10 4.77 2.34 75 XM_UB60 10433 1.55 4.66 0.12 76 RCVD_IN_RP_RNBL 10309 1.50 4.61 0.07 77 RELAYCOUNTRY_CA 10116 2.31 4.52 1.30 78 XM_SPF_SoftFail 9731 2.54 4.35 1.71 79 SpammyFromTLD_01 9676 2.03 4.32 0.98 80 TM2_M_URI_OPT_OUT 9517 3.58 4.25 3.27 81 HTML_IMAGE_RATIO_04 9453 5.00 4.22 5.36 82 TO_NO_BRKTS_HTML_ONLY 9371 1.43 4.19 0.16 83 TR_XM_SpammyWords5 9102 2.29 4.07 1.47 84 RCVD_IN_MSPIKE_L5 8979 1.33 4.01 0.10 85 RELAYCOUNTRY_IN 8653 1.29 3.87 0.10 86 XM_OfRef6 8375 1.79 3.74 0.90 87 DKIM_INVALID 8078 3.29 3.61 3.15 88 HTML_FONT_SIZE_LARGE 8053 1.18 3.60 0.07 89 TM2_M_VERY_LONG_WORD 7791 1.89 3.48 1.16 90 RCVD_IN_PSBL 7762 1.13 3.47 0.05 91 T_FONT_INVIS_NAKED_TO 7721 2.19 3.45 1.61 92 SpammyFromTLD_02 7698 1.29 3.44 0.30 93 RELAYCOUNTRY_FR 7632 1.25 3.41 0.26 94 RCVD_IN_RP_SAFE 7473 6.45 3.34 7.88 95 TR_XM_DK_SendGrid 7433 3.94 3.32 4.22 96 XMStrtUSub 7368 5.36 3.29 6.31 97 URIBL_SBL_A 7122 1.08 3.18 0.11 98 XM_DIRTYINTL 7092 1.32 3.17 0.48 99 SUBJ_ALL_CAPS 6942 2.05 3.10 1.56 100 XM_UB80 6595 0.97 2.95 0.06 101 MIME_QP_LONG_LINE 6578 4.67 2.94 5.47 102 URI_HEX 6551 1.98 2.93 1.54 103 XMBody_17 6535 1.30 2.92 0.55 104 XM_B_Phish66 6385 2.13 2.85 1.80 105 XMDiploma_00 6301 2.05 2.81 1.70 106 XM_UB99 6197 0.87 2.77 0.00 107 XM_DK_Undo_01 6196 2.06 2.77 1.74 108 T_XMDrugObfuBody_08 5880 2.05 2.63 1.79 109 T_XMDrugObfuBody_14 5860 2.08 2.62 1.83 110 RCVD_IN_RP_CERTIFIED 5788 5.81 2.59 7.30 111 BOTNET_NORDNS 5781 0.83 2.58 0.02 112 T_FILL_THIS_FORM_SHORT 5777 1.36 2.58 0.79 113 TR_Symld_Words 5725 1.79 2.56 1.43 114 DATE_IN_PAST_03_06 5690 0.85 2.54 0.08 115 URI_TRY_3LD 5684 1.49 2.54 1.00 116 RELAYCOUNTRY_UA 5625 0.82 2.51 0.04 117 T_TooManySym_01 5371 3.53 2.40 4.05 118 TR_XM_SB_Phish 5359 2.72 2.39 2.88 119 BAYES_40 5342 4.27 2.39 5.14 120 XM_B_Unsub2 5295 2.47 2.37 2.52 121 XM_CamelCaseFrm001 5261 1.96 2.35 1.79 122 XMBrknScrpt_02 5188 1.23 2.32 0.73 123 TR_XM_SpammyWords3 5178 0.81 2.31 0.12 124 XMSubPhish11 5161 2.69 2.31 2.86 125 XM_B_SpammyWords4 5153 1.05 2.30 0.48 126 MIME_HTML_ONLY_MULTI 5084 2.83 2.27 3.09 127 FROM_EXCESS_BASE64 4990 2.90 2.23 3.20 128 RCVD_IN_IADB_LISTED 4902 4.59 2.19 5.69 129 T_XMDrugObfuBody_00 4888 1.13 2.18 0.65 130 TR_LOTS_OF_MONEY3 4846 1.01 2.16 0.49 131 TVD_SPACE_RATIO 4757 0.96 2.12 0.43 132 XM_B_COVIDMETA 4704 1.32 2.10 0.96 133 PDS_FROM_2_EMAILS 4693 0.68 2.10 0.03 134 FROM_2_EMAILS_SHORT 4633 0.66 2.07 0.01 135 RCVD_IN_IADB_SPF 4429 4.00 1.98 4.93 136 PDS_TO_EQ_FROM_NAME 4384 0.62 1.96 0.01 137 XMSubNoVowel 4333 2.07 1.94 2.13 138 XM_UB999 4327 0.61 1.93 0.00 139 URI_PHP_REDIR 4319 0.61 1.93 0.01 140 RCVD_IN_IADB_SENDERID 4179 3.60 1.87 4.40 141 RCVD_IN_IADB_DK 4169 3.51 1.86 4.27 142 NO_FM_NAME_IP_HOSTN 4140 0.59 1.85 0.00 143 ALL_TRUSTED 4125 9.82 1.84 13.48 144 XMGenDplmaNmb 4120 1.22 1.84 0.93 145 TR_XM_MaxBayes 4101 0.58 1.83 0.01 146 TVD_SPACE_RATIO_MINFP 4053 0.57 1.81 0.01 147 XM_URI_RBL 4019 0.71 1.80 0.22 148 RELAYCOUNTRY_DE 3882 0.85 1.73 0.45 149 XMSlimDrugH 3874 0.75 1.73 0.30 150 XM_UB95 3862 0.55 1.73 0.02 151 FORGED_GMAIL_RCVD 3818 0.92 1.71 0.56 152 RCVD_IN_MSPIKE_L3 3807 0.59 1.70 0.08 153 PDS_OTHER_BAD_TLD 3710 1.05 1.66 0.77 154 BAYES_20 3661 3.06 1.64 3.72 155 XMSexyCombo_01 3653 0.98 1.63 0.68 156 FROM_SUSPICIOUS_NTLD 3632 0.57 1.62 0.09 157 FROM_SUSPICIOUS_NTLD_FP 3521 0.55 1.57 0.08 158 TR_XM_PHPDW 3351 0.81 1.50 0.50 159 XMMoneyMeta_00 3333 0.83 1.49 0.53 160 TR_XM_PHPForged 3261 0.78 1.46 0.46 161 TR_XM_COVIDMETA4 3244 0.70 1.45 0.35 162 TR_XM_FormFill2 3237 0.77 1.45 0.46 163 XM_H_PHPOS 3231 0.77 1.44 0.46 164 TR_Caps_n_Bayes_99 3224 0.48 1.44 0.04 165 MAILING_LIST_MULTI 3198 2.02 1.43 2.29 166 LONG_JUNK_URI 3195 0.47 1.43 0.03 167 URI_NOVOWEL 3112 2.38 1.39 2.83 168 TO_NO_BRKTS_PCNT 3087 0.44 1.38 0.00 169 XMStockSpam_06 3012 1.42 1.35 1.46 170 TR_XM_SpoofStaff 3009 0.48 1.34 0.08 171 XMSpoofStaff2 2965 0.47 1.32 0.08 172 XMBdyGiftCard01 2925 0.92 1.31 0.74 173 DATE_IN_PAST_12_24 2838 0.45 1.27 0.07 174 HTML_IMAGE_ONLY_20 2794 0.79 1.25 0.58 175 T_Symld_Words_02 2753 0.80 1.23 0.61 176 LongTLD 2753 0.49 1.23 0.15 177 MIMEOLE_DIRECT_TO_MX 2724 0.39 1.22 0.00 178 TR_XM_COVIDMETA1 2715 0.58 1.21 0.29 179 RDNS_DYNAMIC 2647 0.69 1.18 0.47 180 XMSubEmpty 2555 1.23 1.14 1.28 181 XMSubMetaSSx_00 2536 0.51 1.13 0.23 182 DKIM_ADSP_CUSTOM_MED 2516 1.03 1.12 0.98 183 TR_XM_PSC1 2506 0.40 1.12 0.08 184 TR_Mismatch_TLD_01 2501 0.69 1.12 0.49 185 XM_H_SpoofStaff4 2498 0.41 1.12 0.09 186 T_XMHurry_00 2491 0.82 1.11 0.68 187 RELAYCOUNTRY_GB 2460 0.98 1.10 0.93 188 XM_LoanWordsFrm 2395 0.37 1.07 0.05 189 HTML_IMAGE_ONLY_12 2378 0.50 1.06 0.25 190 MIME_CHARSET_FARAWAY 2375 0.44 1.06 0.15 191 XMHTML_After_End 2371 0.83 1.06 0.73 192 BAYES_00 2367 9.39 1.06 13.23 193 XMBody_78 2349 0.69 1.05 0.52 194 TR_XM_INV_DKIM 2304 0.42 1.03 0.14 195 NML_ADSP_CUSTOM_MED 2302 0.80 1.03 0.69 196 XM_BadFromFormat 2296 0.48 1.03 0.23 197 HTML_SHORT_LINK_IMG_3 2292 0.38 1.02 0.09 198 XM_OfRef7 2281 0.40 1.02 0.11 199 INVALID_DATE 2259 0.34 1.01 0.03 200 XM_ProductURIs 2216 1.07 0.99 1.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 429803 89.79 93.17 88.23 2 RELAYCOUNTRY_US 403852 79.10 70.82 82.91 3 DKIM_SIGNED 376421 77.65 78.47 77.27 4 XM_DK_Pass 371020 76.09 75.94 76.17 5 DKIM_VALID 361099 74.36 74.86 74.13 6 XM_B_Unicode 349053 71.31 70.55 71.66 7 DCC_CHECK_NEGATIVE 273547 44.65 19.61 56.16 8 DKIM_VALID_AU 272658 56.87 58.83 55.97 9 BAYES_50 269914 49.26 35.88 55.41 10 XMListUnsubscribeExists 245166 55.29 66.09 50.33 11 XM_B_SpammyWords 238387 53.46 63.31 48.94 12 DCC_CHECK 203462 53.42 78.78 41.77 13 XM_B_Unicode3 203234 40.13 36.66 41.72 14 RCVD_IN_MSPIKE_WL 146328 25.86 16.77 30.04 15 DKIM_VALID_EF 145427 29.08 27.41 29.85 16 T_TM2_M_HEADER_IN_MSG 137691 25.38 19.08 28.27 17 RCVD_IN_MSPIKE_H2 133676 28.12 29.61 27.44 18 HTML_FONT_LOW_CONTRAST 127641 28.47 33.40 26.20 19 LOC_TINY_FONT_1 117759 27.44 34.54 24.17 20 FVGT_m_MULTI_ODD 111421 23.90 26.13 22.87 21 XMSubLong 104248 22.02 23.37 21.40 22 XM_B_SpammyWords2 103151 24.96 33.20 21.18 23 MIME_HTML_ONLY 102400 24.03 30.59 21.02 24 T_KAM_HTML_FONT_INVALID 89478 19.70 22.59 18.37 25 RCVD_IN_MSPIKE_H3 78287 13.85 9.02 16.07 26 ALL_TRUSTED 65672 9.82 1.84 13.48 27 BAYES_00 64423 9.39 1.06 13.23 28 XM_Body_Dirty_Words 64028 14.00 15.88 13.14 29 XM_B_Unsub 56113 11.78 12.34 11.52 30 XM_Multi_Part_URI 54899 14.40 21.21 11.27 31 RCVD_IN_MSPIKE_H4 51023 9.37 6.97 10.47 32 XM_DKIMWhitelistDomains 49366 6.95 0.02 10.13 33 TR_XM_DK_Bayes 46433 6.77 0.76 9.53 34 TR_XM_DK_Bayes1 44972 6.56 0.74 9.23 35 LotsOfNums_01 42742 10.01 12.68 8.77 36 XM_Evil_Numbers_Gen 42564 8.99 9.53 8.74 37 XM_DK_Undo_02 41019 19.55 43.78 8.42 38 TR_XM_DK_Bayes2 39970 5.82 0.63 8.21 39 TooManyTo_001 39130 7.50 6.34 8.03 40 RCVD_IN_RP_SAFE 38378 6.45 3.34 7.88 41 UNPARSEABLE_RELAY 38309 7.57 6.94 7.86 42 BAYES_60 38305 8.42 9.63 7.86 43 RCVD_IN_RP_CERTIFIED 35545 5.81 2.59 7.30 44 XM_SendGrid 34745 6.72 5.82 7.13 45 LOTS_OF_MONEY 33811 8.36 11.45 6.94 46 FSL_BULK_SIG 32417 10.06 17.47 6.65 47 HTML_IMAGE_RATIO_02 31946 7.40 9.23 6.56 48 XMStrtUSub 30728 5.36 3.29 6.31 49 TR_XM_DKIM_Undo 30435 15.35 35.16 6.25 50 XM_B_Phish_Phrases 30161 6.09 5.87 6.19 51 XM_H_Long_From01 29099 6.03 6.16 5.97 52 IN_ZIMBRA_NJ_WHITELIST 28238 4.00 0.10 5.80 53 RCVD_IN_IADB_LISTED 27736 4.59 2.19 5.69 54 TR_XM_UnparsRelay 26692 5.85 6.66 5.48 55 MIME_QP_LONG_LINE 26637 4.67 2.94 5.47 56 HTML_IMAGE_RATIO_04 26088 5.00 4.22 5.36 57 BAYES_40 25027 4.27 2.39 5.14 58 XM_B_SpammyWords3 24503 6.84 10.79 5.03 59 BAYES_99 24181 14.15 34.13 4.96 60 RCVD_IN_IADB_SPF 24038 4.00 1.98 4.93 61 RELAYCOUNTRY_META 23443 11.26 25.29 4.81 62 MPART_ALT_DIFF 22984 5.79 8.13 4.72 63 HTML_IMAGE_RATIO_06 22670 4.85 5.26 4.65 64 TR_XM_SpammyWords4 22204 6.09 9.43 4.56 65 BAYES_80 22013 5.92 8.97 4.52 66 XM_PDF 21883 3.32 0.77 4.49 67 RCVD_IN_IADB_SENDERID 21447 3.60 1.87 4.40 68 BOTNET_IPINHOSTNAME 21278 7.27 13.57 4.37 69 RCVD_IN_IADB_DK 20793 3.51 1.86 4.27 70 TR_XM_DK_SendGrid 20568 3.94 3.32 4.22 71 XMSexyCombo_05 20459 5.93 9.69 4.20 72 T_TooManySym_01 19735 3.53 2.40 4.05 73 BAYES_999 19273 11.32 27.36 3.96 74 BAYES_20 18107 3.06 1.64 3.72 75 RCVD_IN_IADB_VOUCHED 17051 2.66 0.84 3.50 76 T_REMOTE_IMAGE 17034 5.40 9.55 3.50 77 RCVD_IN_MSPIKE_H5 17018 2.64 0.78 3.49 78 XM_UncommonTLD01 16482 5.83 11.15 3.38 79 TM2_M_URI_OPT_OUT 15913 3.58 4.25 3.27 80 XMSubMetaSx_00 15784 4.32 6.67 3.24 81 FROM_EXCESS_BASE64 15605 2.90 2.23 3.20 82 DKIM_INVALID 15322 3.29 3.61 3.15 83 MIME_HTML_ONLY_MULTI 15071 2.83 2.27 3.09 84 TR_XM_PhishingBody 14892 3.71 5.13 3.06 85 TR_XM_SB_Phish 14008 2.72 2.39 2.88 86 XMSubPhish11 13939 2.69 2.31 2.86 87 URI_NOVOWEL 13774 2.38 1.39 2.83 88 BAYES_95 13487 3.57 5.31 2.77 89 TR_DCC_Bayes_99 13224 10.32 26.88 2.71 90 XM_H_Trusted_IP 13080 1.84 0.00 2.69 91 XMNumbers 12917 3.72 6.03 2.65 92 XM_B_Unsub2 12262 2.47 2.37 2.52 93 HTML_IMAGE_RATIO_08 12087 3.56 5.92 2.48 94 XM_B_SpammyTLD 11382 3.10 4.77 2.34 95 BAYES_05 11367 1.90 0.95 2.33 96 MAILING_LIST_MULTI 11137 2.02 1.43 2.29 97 RCVD_IN_IADB_OPTIN 11130 1.76 0.61 2.28 98 MIME_HTML_MOSTLY 10592 3.56 6.59 2.17 99 XMSubNoVowel 10373 2.07 1.94 2.13 100 TooManyTo_002 10153 1.64 0.66 2.08 101 ANY_BOUNCE_MESSAGE 10034 1.56 0.47 2.06 102 BOUNCE_MESSAGE 10026 1.56 0.46 2.06 103 T_TooManySym_02 9801 1.57 0.60 2.01 104 HTML_MIME_NO_HTML_TAG 9592 4.52 10.08 1.97 105 UNTRUSTED_Relay 9389 8.21 21.89 1.93 106 BOTNET 9093 6.91 17.88 1.87 107 T_XMDrugObfuBody_14 8916 2.08 2.62 1.83 108 XM_B_Phish66 8768 2.13 2.85 1.80 109 T_XMDrugObfuBody_08 8718 2.05 2.63 1.79 110 XM_CamelCaseFrm001 8697 1.96 2.35 1.79 111 RCVD_IN_BL_SPAMCOP_NET 8490 3.75 8.12 1.74 112 XM_DK_Undo_01 8467 2.06 2.77 1.74 113 XM_SPF_SoftFail 8354 2.54 4.35 1.71 114 XMDiploma_00 8259 2.05 2.81 1.70 115 T_FONT_INVIS_NAKED_TO 7828 2.19 3.45 1.61 116 SUBJ_ALL_CAPS 7616 2.05 3.10 1.56 117 URI_HEX 7515 1.98 2.93 1.54 118 HELO_NODOT 7420 1.26 0.70 1.52 119 HELO_NO_DOMAIN 7418 1.26 0.70 1.52 120 INVALID_MSGID 7363 1.19 0.50 1.51 121 IN_HORDE_ADDRESS_BOOK 7340 1.15 0.39 1.51 122 KHOP_HELO_FCRDNS 7289 3.52 7.93 1.50 123 TR_XM_SpammyWords5 7172 2.29 4.07 1.47 124 XMStockSpam_06 7105 1.42 1.35 1.46 125 TR_Symld_Words 6974 1.79 2.56 1.43 126 TooManyTo_003 6821 1.13 0.53 1.40 127 MSGID_NOFQDN1 6683 0.95 0.02 1.37 128 TO_MALFORMED 6602 0.96 0.08 1.36 129 USER_IN_DEF_DKIM_WL 6529 0.93 0.03 1.34 130 RELAYCOUNTRY_CA 6332 2.31 4.52 1.30 131 TVD_RCVD_IP 6275 1.02 0.44 1.29 132 XMSubEmpty 6214 1.23 1.14 1.28 133 XM_H_Long_From02 6182 1.08 0.65 1.27 134 XMCapTrack 5814 0.92 0.31 1.19 135 XM_GoogleGroups 5711 0.93 0.41 1.17 136 TM2_M_VERY_LONG_WORD 5630 1.89 3.48 1.16 137 XM_ProductURIs 5381 1.07 0.99 1.10 138 HTML_FONT_FACE_BAD 5191 0.91 0.57 1.07 139 XM_UB50 5157 3.43 8.58 1.06 140 HELO_MISC_IP 5028 0.82 0.37 1.03 141 CK_HELO_DYNAMIC_SPLIT_IP 5020 0.91 0.66 1.03 142 URI_TRY_3LD 4894 1.49 2.54 1.00 143 DKIM_ADSP_CUSTOM_MED 4774 1.03 1.12 0.98 144 SpammyFromTLD_01 4774 2.03 4.32 0.98 145 TooManyTo_004 4740 0.77 0.33 0.97 146 XM_B_COVIDMETA 4696 1.32 2.10 0.96 147 RELAYCOUNTRY_GB 4536 0.98 1.10 0.93 148 XMGenDplmaNmb 4524 1.22 1.84 0.93 149 XMGappySubj_01 4491 0.69 0.17 0.92 150 TR_MSPIKEBAYES00 4437 0.63 0.02 0.91 151 XM_OfRef6 4374 1.79 3.74 0.90 152 XMBSHREFv2 4303 0.69 0.28 0.88 153 T_OBFU_PDF_ATTACH 4185 0.63 0.14 0.86 154 SHORTENED_URL_HREF 4104 0.86 0.88 0.84 155 XMBody_95 3937 0.58 0.09 0.81 156 TooManyTo_005 3894 0.63 0.26 0.80 157 T_FILL_THIS_FORM_SHORT 3871 1.36 2.58 0.79 158 PDS_OTHER_BAD_TLD 3758 1.05 1.66 0.77 159 HTTPS_HTTP_MISMATCH 3723 0.79 0.84 0.76 160 FROM_GOV_DKIM_AU 3717 0.62 0.29 0.76 161 TR_MetaPhish_Combo_01 3673 0.80 0.91 0.75 162 XMBdyGiftCard01 3607 0.92 1.31 0.74 163 XMBrknScrpt_02 3559 1.23 2.32 0.73 164 XMHTML_After_End 3544 0.83 1.06 0.73 165 NML_ADSP_CUSTOM_MED 3353 0.80 1.03 0.69 166 T_XMHurry_00 3317 0.82 1.11 0.68 167 XMSexyCombo_01 3317 0.98 1.63 0.68 168 T_XMDrugObfuBody_00 3169 1.13 2.18 0.65 169 TR_XM_SpammyWords2 3009 3.92 11.12 0.62 170 NUMERIC_HTTP_ADDR 2968 0.55 0.41 0.61 171 T_TooManySym_03 2955 0.50 0.27 0.61 172 T_Symld_Words_02 2954 0.80 1.23 0.61 173 XM_ShortIntro_01 2921 0.52 0.35 0.60 174 XMSubMetaSxObfu_03 2869 0.69 0.92 0.59 175 HTML_IMAGE_ONLY_20 2840 0.79 1.25 0.58 176 XMHTMLBadTable_001 2838 0.64 0.76 0.58 177 XM_SPF_Unknown 2769 0.59 0.64 0.57 178 FORGED_GMAIL_RCVD 2705 0.92 1.71 0.56 179 XMBody_17 2678 1.30 2.92 0.55 180 XMMoneyMeta_00 2596 0.83 1.49 0.53 181 XMSubMetaI_00 2564 0.64 0.87 0.53 182 XMBody_78 2531 0.69 1.05 0.52 183 TR_XM_PHPDW 2436 0.81 1.50 0.50 184 SENDGRID_REDIR 2402 0.62 0.89 0.49 185 PLING_QUERY 2399 0.48 0.45 0.49 186 TR_Mismatch_TLD_01 2399 0.69 1.12 0.49 187 TR_LOTS_OF_MONEY3 2370 1.01 2.16 0.49 188 RCVD_IN_SORBS_DUL 2328 0.43 0.32 0.48 189 XM_B_SpammyWords4 2323 1.05 2.30 0.48 190 XM_S_SpammyWords 2322 0.50 0.56 0.48 191 TR_XM_Spammywords 2321 0.50 0.56 0.48 192 XM_DIRTYINTL 2320 1.32 3.17 0.48 193 XMNoVowels 2307 0.46 0.44 0.47 194 RDNS_DYNAMIC 2294 0.69 1.18 0.47 195 TR_XM_PHPForged 2257 0.78 1.46 0.46 196 TR_XM_FormFill2 2241 0.77 1.45 0.46 197 XM_H_PHPOS 2218 0.77 1.44 0.46 198 XMPhish30 2190 0.58 0.86 0.45 199 RELAYCOUNTRY_DE 2186 0.85 1.73 0.45 200 XM_H_PHPMailer 2181 0.41 0.33 0.45 ----------------------------------------------------------------------