Email: 755003 Autolearn: 0 AvgScore: 3.08 AvgScanTime: 1.61 sec Spam: 226263 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.81 sec Ham: 528740 Autolearn: 0 AvgScore: -1.62 AvgScanTime: 1.52 sec Time Spent Running SA: 337.38 hours Time Spent Processing Spam: 113.96 hours Time Spent Processing Ham: 223.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 214608 91.61 94.85 90.22 2 DKIM_SIGNED 188762 77.30 83.43 74.68 3 DCC_CHECK 177672 52.98 78.52 42.05 4 XM_DK_Pass 176298 74.96 77.92 73.70 5 DKIM_VALID 173502 73.37 76.68 71.95 6 XM_B_Unicode 170417 75.38 75.32 75.40 7 RELAYCOUNTRY_US 166058 82.08 73.39 85.80 8 XMListUnsubscribeExists 155845 57.16 68.88 52.14 9 XM_B_SpammyWords 145954 54.20 64.51 49.79 10 DKIM_VALID_AU 132640 55.07 58.62 53.55 11 XM_DK_Undo_02 95821 17.84 42.35 7.35 12 BAYES_50 95210 48.65 42.08 51.46 13 XM_B_Unicode3 91884 45.20 40.61 47.17 14 XM_B_SpammyWords2 85349 25.65 37.72 20.48 15 LOC_TINY_FONT_1 84436 28.04 37.32 24.07 16 HTML_FONT_LOW_CONTRAST 77551 29.26 34.27 27.11 17 TR_XM_DKIM_Undo 77074 13.73 34.06 5.02 18 MIME_HTML_ONLY 69439 25.02 30.69 22.60 19 RCVD_IN_MSPIKE_H2 69110 27.79 30.54 26.61 20 BAYES_99 63145 11.23 27.91 4.10 21 DKIM_VALID_EF 62552 27.11 27.65 26.89 22 FVGT_m_MULTI_ODD 62106 23.54 27.45 21.87 23 RELAYCOUNTRY_META 55626 10.54 24.58 4.53 24 T_KAM_HTML_FONT_INVALID 54577 20.52 24.12 18.98 25 XMSubLong 54088 21.28 23.90 20.15 26 BOTNET 50578 8.09 22.35 1.99 27 BAYES_999 48823 8.68 21.58 3.16 28 TR_DCC_Bayes_99 48303 8.01 21.35 2.30 29 T_TM2_M_HEADER_IN_MSG 45044 22.79 19.91 24.02 30 DCC_CHECK_NEGATIVE 43886 45.02 19.40 55.98 31 XM_Body_Dirty_Words 43869 14.16 19.39 11.92 32 RCVD_IN_MSPIKE_WL 42945 26.55 18.98 29.78 33 UNTRUSTED_Relay 40259 6.73 17.79 2.00 34 XM_Multi_Part_URI 36749 12.89 16.24 11.45 35 LOTS_OF_MONEY 34171 8.57 15.10 5.77 36 XM_B_SpammyWords3 34056 8.48 15.05 5.66 37 BOTNET_IPINHOSTNAME 31683 7.40 14.00 4.57 38 XM_UncommonTLD01 29814 5.96 13.18 2.87 39 XM_B_Unsub 28932 10.35 12.79 9.30 40 RCVD_IN_BL_SPAMCOP_NET 27448 4.67 12.13 1.48 41 XMSexyCombo_05 26657 6.30 11.78 3.96 42 FSL_BULK_SIG 25278 7.36 11.17 5.73 43 TR_XM_SpammyWords4 24425 6.01 10.79 3.97 44 RCVD_IN_MSPIKE_H3 24279 14.21 10.73 15.70 45 TR_XM_SpammyWords2 23823 3.72 10.53 0.81 46 XM_Evil_Numbers_Gen 23010 9.51 10.17 9.23 47 MPART_ALT_DIFF 20656 8.03 9.13 7.56 48 LotsOfNums_01 20537 9.53 9.08 9.73 49 BOTNET_NORDNS 19605 2.61 8.66 0.01 50 HTML_IMAGE_RATIO_02 19323 7.22 8.54 6.65 51 RCVD_IN_MSPIKE_BL 19205 2.66 8.49 0.17 52 BAYES_60 19076 7.61 8.43 7.26 53 BAYES_80 18910 5.49 8.36 4.26 54 UNPARSEABLE_RELAY 18403 7.87 8.13 7.76 55 TR_XM_MSPIKECOMBO 18391 2.55 8.13 0.16 56 TooManyTo_001 18372 7.34 8.12 7.00 57 XM_UB50 18057 3.21 7.98 1.17 58 TR_XM_UnparsRelay 17785 6.21 7.86 5.51 59 XM_B_Phish_Phrases 17205 6.23 7.60 5.64 60 RCVD_IN_MSPIKE_H4 16903 9.71 7.47 10.67 61 XMSubMetaSx_00 16526 4.17 7.30 2.84 62 T_REMOTE_IMAGE 16128 4.38 7.13 3.20 63 MIME_HTML_MOSTLY 15905 3.68 7.03 2.25 64 DKIM_INVALID 15260 3.93 6.74 2.73 65 XM_SendGrid 15223 6.89 6.73 6.96 66 XM_H_Long_From01 14937 5.86 6.60 5.55 67 XMNumbers 14889 3.85 6.58 2.68 68 RCVD_IN_MSPIKE_L5 14872 2.02 6.57 0.07 69 RELAYCOUNTRY_CA 14508 2.94 6.41 1.46 70 XMStrtUSub 13987 8.81 6.18 9.93 71 RCVD_IN_RP_RNBL 13149 1.79 5.81 0.06 72 TR_XM_PhishingBody 13133 3.76 5.80 2.88 73 RELAYCOUNTRY_FR 12253 1.81 5.42 0.26 74 HTML_IMAGE_RATIO_04 12187 10.90 5.39 13.25 75 XM_SPF_SoftFail 12066 2.57 5.33 1.39 76 XM_OfRef6 11845 2.25 5.24 0.97 77 HTML_MIME_NO_HTML_TAG 11735 2.81 5.19 1.79 78 SpammyFromTLD_01 11186 1.89 4.94 0.59 79 RCVD_IN_PSBL 10412 1.43 4.60 0.07 80 BAYES_95 10154 3.16 4.49 2.59 81 TR_LOTS_OF_MONEY3 9838 1.65 4.35 0.50 82 RCVD_IN_RP_SAFE 9588 7.22 4.24 8.49 83 TR_XM_SpammyWords5 9268 2.43 4.10 1.71 84 XM_DIRTYINTL 9252 1.48 4.09 0.37 85 T_XMDrugObfuBody_08 8890 2.31 3.93 1.62 86 XMDiploma_00 8849 2.04 3.91 1.24 87 TR_XM_DK_SendGrid 8628 4.15 3.81 4.29 88 TM2_M_URI_OPT_OUT 8601 2.83 3.80 2.42 89 XM_DK_Undo_01 8407 1.99 3.72 1.26 90 DKIM_ADSP_NXDOMAIN 8297 1.27 3.67 0.24 91 URIBL_SBL_A 7812 1.15 3.45 0.17 92 HTML_IMAGE_RATIO_08 7768 2.51 3.43 2.11 93 SpammyFromTLD_02 7755 1.21 3.43 0.26 94 RCVD_IN_RP_CERTIFIED 7739 6.48 3.42 7.79 95 XM_B_SpammyTLD 7705 2.35 3.41 1.89 96 MIME_QP_LONG_LINE 7619 5.28 3.37 6.09 97 HDRS_MISSP 7411 1.10 3.28 0.17 98 FROM_EXCESS_BASE64 7370 3.29 3.26 3.31 99 HTML_IMAGE_RATIO_06 7352 3.90 3.25 4.19 100 MIME_HEADER_CTYPE_ONLY 7306 1.02 3.23 0.07 101 KHOP_HELO_FCRDNS 7247 1.88 3.20 1.32 102 HDRS_LCASE_IMGONLY 7151 0.98 3.16 0.05 103 XM_B_Phish66 6569 1.99 2.90 1.60 104 SUBJ_ALL_CAPS 6476 2.13 2.86 1.81 105 BAYES_40 6436 4.34 2.84 4.98 106 DATE_IN_PAST_03_06 6400 0.96 2.83 0.16 107 HTML_SHORT_LINK_IMG_1 6329 0.85 2.80 0.01 108 MIME_HTML_ONLY_MULTI 6201 4.86 2.74 5.77 109 URI_HEX 6170 1.91 2.73 1.55 110 XM_UB60 6131 0.94 2.71 0.18 111 TR_XM_SpammyWords3 6063 0.86 2.68 0.09 112 FORGED_GMAIL_RCVD 5986 1.25 2.65 0.65 113 TR_XM_COVIDMETA4 5973 0.99 2.64 0.28 114 XMBody_17 5932 1.24 2.62 0.65 115 T_TooManySym_01 5903 3.65 2.61 4.10 116 XM_B_COVIDMETA 5739 1.31 2.54 0.78 117 XM_B_Unsub2 5689 1.93 2.51 1.68 118 GOOGLE_DOC_SUSP 5564 0.76 2.46 0.03 119 XM_OfRef7 5549 0.81 2.45 0.11 120 T_XMHurry_00 5540 1.23 2.45 0.71 121 DIET_1 5311 0.89 2.35 0.27 122 XMBrknScrpt_02 5087 1.25 2.25 0.83 123 TR_Mismatch_TLD_02 5067 0.73 2.24 0.08 124 XM_UB99 5031 0.67 2.22 0.00 125 NORDNS_LOW_CONTRAST 5022 0.68 2.22 0.02 126 T_XMDrugObfuBody_00 5000 1.34 2.21 0.97 127 MAILING_LIST_MULTI 4937 2.33 2.18 2.39 128 XMSubMetaSxObfu_03 4851 0.92 2.14 0.40 129 BAYES_00 4848 13.11 2.14 17.80 130 XM_B_SpammyWords4 4827 1.05 2.13 0.58 131 TR_XM_MaxBayes 4721 0.63 2.09 0.01 132 TM2_M_VERY_LONG_WORD 4562 1.48 2.02 1.24 133 HTML_IMAGE_ONLY_08 4529 0.67 2.00 0.10 134 RCVD_IN_IADB_LISTED 4511 5.01 1.99 6.30 135 XM_UB80 4510 0.64 1.99 0.07 136 BAYES_20 4477 3.72 1.98 4.46 137 TR_XM_SB_Phish 4465 1.94 1.97 1.92 138 XMLngstWrd_00 4419 0.89 1.95 0.44 139 XMBdyGiftCard01 4398 1.55 1.94 1.39 140 XM_CamelCaseFrm001 4376 1.89 1.93 1.87 141 XMLngstWrd_01 4364 0.86 1.93 0.40 142 T_FILL_THIS_FORM_SHORT 4298 0.98 1.90 0.58 143 XMSubPhish11 4293 1.89 1.90 1.89 144 HTML_IMAGE_ONLY_16 4234 0.72 1.87 0.23 145 XMLngstWrd_02 4176 0.77 1.85 0.32 146 URI_PHP_REDIR 4171 0.56 1.84 0.00 147 T_XMDrugObfuBody_14 4160 1.82 1.84 1.82 148 XMGenDplmaNmb 4154 1.06 1.84 0.73 149 RCVD_IN_IADB_SPF 4121 4.40 1.82 5.51 150 RELAYCOUNTRY_GB 4067 1.05 1.80 0.73 151 GOOG_STO_IMG_HTML 3988 0.53 1.76 0.00 152 XMLngstWrd_03 3984 0.70 1.76 0.25 153 RCVD_IN_IADB_DK 3972 3.89 1.76 4.80 154 BAYES_05 3958 2.68 1.75 3.08 155 RCVD_IN_IADB_SENDERID 3953 3.98 1.75 4.94 156 XMSexyCombo_01 3898 0.79 1.72 0.39 157 DEAR_BENEFICIARY 3853 0.51 1.70 0.00 158 XMLngstWrd_04 3762 0.63 1.66 0.19 159 HK_RANDOM_REPLYTO 3729 0.67 1.65 0.24 160 HTML_TITLE_SUBJ_DIFF 3724 0.62 1.65 0.19 161 XM_UB999 3703 0.49 1.64 0.00 162 URI_TRY_3LD 3682 1.27 1.63 1.12 163 RDNS_DYNAMIC 3674 0.84 1.62 0.51 164 XM_URI_RBL 3670 0.60 1.62 0.17 165 FILL_THIS_FORM 3577 0.60 1.58 0.18 166 XMStockSpam_06 3497 1.29 1.55 1.18 167 HTML_SHORT_LINK_IMG_2 3484 0.48 1.54 0.03 168 MONEY_FORM 3412 0.46 1.51 0.01 169 PDS_OTHER_BAD_TLD 3378 0.90 1.49 0.65 170 DKIM_ADSP_CUSTOM_MED 3359 1.13 1.48 0.98 171 T_FILL_THIS_FORM_LONG 3289 0.46 1.45 0.03 172 SHORTENER_SHORT_IMG 3279 0.43 1.45 0.00 173 XMSubMetaI_00 3225 1.07 1.43 0.92 174 URIBL_DBL_ABUSE_REDIR 3221 0.43 1.42 0.00 175 TR_XM_COVIDMETA1 3208 0.60 1.42 0.24 176 XM_OfRef8 3196 0.44 1.41 0.02 177 T_FILL_THIS_FORM_LOAN 3174 0.46 1.40 0.05 178 URI_NOVOWEL 3133 2.54 1.38 3.04 179 MONEY_FRAUD_3 3130 0.42 1.38 0.00 180 XMSubGiftCard1 3111 0.44 1.37 0.04 181 URIBL_BLACK 3107 0.44 1.37 0.04 182 TR_XM_RelayPhish 2987 0.45 1.32 0.08 183 NUMERIC_HTTP_ADDR 2969 0.69 1.31 0.42 184 FORM_FRAUD_3 2940 0.39 1.30 0.00 185 XMPhish08 2934 0.51 1.30 0.17 186 TR_XM_DK_Bayes 2818 7.43 1.25 10.07 187 FROM_MISSP_REPLYTO 2812 0.38 1.24 0.01 188 NML_ADSP_CUSTOM_MED 2809 0.83 1.24 0.66 189 XM_BadFromFormat 2800 0.55 1.24 0.26 190 AMAZON_IMG_NOT_RCVD_AMZN 2792 0.41 1.23 0.05 191 TR_XM_DK_Bayes1 2763 7.25 1.22 9.83 192 PDS_RDNS_DYNAMIC_FP 2681 0.43 1.18 0.11 193 TR_Symld_Words 2637 1.13 1.17 1.11 194 XM_Body_Dirty_Words_01 2596 0.61 1.15 0.39 195 TR_XM_PHPDW 2531 0.53 1.12 0.28 196 TR_XM_INV_DKIM 2485 0.38 1.10 0.08 197 XM_S_ServInvoice 2481 0.33 1.10 0.01 198 TR_XM_PHPForged 2471 0.50 1.09 0.24 199 TR_Sbj_FN_Bdy 2466 0.42 1.09 0.14 200 TR_XM_FormFill2 2439 0.50 1.08 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 477041 91.61 94.85 90.22 2 RELAYCOUNTRY_US 453659 82.08 73.39 85.80 3 XM_B_Unicode 398672 75.38 75.32 75.40 4 DKIM_SIGNED 394844 77.30 83.43 74.68 5 XM_DK_Pass 389661 74.96 77.92 73.70 6 DKIM_VALID 380412 73.37 76.68 71.95 7 DCC_CHECK_NEGATIVE 296002 45.02 19.40 55.98 8 DKIM_VALID_AU 283117 55.07 58.62 53.55 9 XMListUnsubscribeExists 275696 57.16 68.88 52.14 10 BAYES_50 272096 48.65 42.08 51.46 11 XM_B_SpammyWords 263254 54.20 64.51 49.79 12 XM_B_Unicode3 249392 45.20 40.61 47.17 13 DCC_CHECK 222325 52.98 78.52 42.05 14 RCVD_IN_MSPIKE_WL 157472 26.55 18.98 29.78 15 HTML_FONT_LOW_CONTRAST 143354 29.26 34.27 27.11 16 DKIM_VALID_EF 142156 27.11 27.65 26.89 17 RCVD_IN_MSPIKE_H2 140724 27.79 30.54 26.61 18 LOC_TINY_FONT_1 127271 28.04 37.32 24.07 19 T_TM2_M_HEADER_IN_MSG 126998 22.79 19.91 24.02 20 MIME_HTML_ONLY 119473 25.02 30.69 22.60 21 FVGT_m_MULTI_ODD 115614 23.54 27.45 21.87 22 XM_B_SpammyWords2 108277 25.65 37.72 20.48 23 XMSubLong 106557 21.28 23.90 20.15 24 T_KAM_HTML_FONT_INVALID 100367 20.52 24.12 18.98 25 BAYES_00 94113 13.11 2.14 17.80 26 RCVD_IN_MSPIKE_H3 83010 14.21 10.73 15.70 27 HTML_IMAGE_RATIO_04 70076 10.90 5.39 13.25 28 XM_Body_Dirty_Words 63037 14.16 19.39 11.92 29 XM_Multi_Part_URI 60538 12.89 16.24 11.45 30 RCVD_IN_MSPIKE_H4 56394 9.71 7.47 10.67 31 ALL_TRUSTED 55908 7.69 0.95 10.57 32 TR_XM_DK_Bayes 53253 7.43 1.25 10.07 33 XMStrtUSub 52499 8.81 6.18 9.93 34 TR_XM_DK_Bayes1 51985 7.25 1.22 9.83 35 LotsOfNums_01 51440 9.53 9.08 9.73 36 XM_B_Unsub 49180 10.35 12.79 9.30 37 XM_Evil_Numbers_Gen 48825 9.51 10.17 9.23 38 XM_H_Trusted_IP 47375 6.27 0.00 8.96 39 HTML_FONT_FACE_BAD 47201 6.42 0.55 8.93 40 XM_DKIMWhitelistDomains 46878 6.22 0.04 8.87 41 TR_XM_DK_Bayes2 45648 6.36 1.06 8.63 42 RCVD_IN_RP_SAFE 44897 7.22 4.24 8.49 43 RCVD_IN_RP_CERTIFIED 41192 6.48 3.42 7.79 44 UNPARSEABLE_RELAY 41028 7.87 8.13 7.76 45 MPART_ALT_DIFF 39980 8.03 9.13 7.56 46 XM_DK_Undo_02 38847 17.84 42.35 7.35 47 BAYES_60 38361 7.61 8.43 7.26 48 TooManyTo_001 37032 7.34 8.12 7.00 49 XM_SendGrid 36776 6.89 6.73 6.96 50 HTML_IMAGE_RATIO_02 35179 7.22 8.54 6.65 51 RCVD_IN_IADB_LISTED 33311 5.01 1.99 6.30 52 MIME_QP_LONG_LINE 32225 5.28 3.37 6.09 53 LOTS_OF_MONEY 30517 8.57 15.10 5.77 54 MIME_HTML_ONLY_MULTI 30515 4.86 2.74 5.77 55 FSL_BULK_SIG 30302 7.36 11.17 5.73 56 XM_B_SpammyWords3 29945 8.48 15.05 5.66 57 XM_B_Phish_Phrases 29834 6.23 7.60 5.64 58 XM_H_Long_From01 29331 5.86 6.60 5.55 59 RCVD_IN_IADB_SPF 29121 4.40 1.82 5.51 60 TR_XM_UnparsRelay 29118 6.21 7.86 5.51 61 IN_ZIMBRA_NJ_WHITELIST 26951 3.59 0.06 5.10 62 TR_XM_DKIM_Undo 26564 13.73 34.06 5.02 63 BAYES_40 26325 4.34 2.84 4.98 64 RCVD_IN_IADB_SENDERID 26133 3.98 1.75 4.94 65 RCVD_IN_IADB_DK 25362 3.89 1.76 4.80 66 BOTNET_IPINHOSTNAME 24167 7.40 14.00 4.57 67 RELAYCOUNTRY_META 23970 10.54 24.58 4.53 68 BAYES_20 23596 3.72 1.98 4.46 69 TR_XM_DK_SendGrid 22693 4.15 3.81 4.29 70 BAYES_80 22510 5.49 8.36 4.26 71 HTML_IMAGE_RATIO_06 22130 3.90 3.25 4.19 72 BAYES_99 21678 11.23 27.91 4.10 73 T_TooManySym_01 21668 3.65 2.61 4.10 74 TR_XM_SpammyWords4 20981 6.01 10.79 3.97 75 XMSexyCombo_05 20918 6.30 11.78 3.96 76 RCVD_IN_IADB_VOUCHED 19826 2.83 0.69 3.75 77 XM_PDF 18810 2.69 0.66 3.56 78 RCVD_IN_MSPIKE_H5 18068 2.63 0.78 3.42 79 FROM_EXCESS_BASE64 17479 3.29 3.26 3.31 80 XMSubNoVowel 17175 2.60 1.08 3.25 81 T_REMOTE_IMAGE 16910 4.38 7.13 3.20 82 BAYES_999 16725 8.68 21.58 3.16 83 BAYES_05 16286 2.68 1.75 3.08 84 URI_NOVOWEL 16053 2.54 1.38 3.04 85 TR_XM_PhishingBody 15218 3.76 5.80 2.88 86 XM_UncommonTLD01 15175 5.96 13.18 2.87 87 XMSubMetaSx_00 14990 4.17 7.30 2.84 88 DKIM_INVALID 14432 3.93 6.74 2.73 89 XMNumbers 14176 3.85 6.58 2.68 90 BAYES_95 13685 3.16 4.49 2.59 91 ANY_BOUNCE_MESSAGE 13253 1.91 0.52 2.51 92 BOUNCE_MESSAGE 13250 1.91 0.52 2.51 93 RCVD_IN_IADB_OPTIN 12886 1.84 0.44 2.44 94 TM2_M_URI_OPT_OUT 12781 2.83 3.80 2.42 95 MAILING_LIST_MULTI 12645 2.33 2.18 2.39 96 TR_DCC_Bayes_99 12163 8.01 21.35 2.30 97 MIME_HTML_MOSTLY 11880 3.68 7.03 2.25 98 HTML_IMAGE_RATIO_08 11170 2.51 3.43 2.11 99 UNTRUSTED_Relay 10551 6.73 17.79 2.00 100 BOTNET 10524 8.09 22.35 1.99 101 T_TooManySym_02 10306 1.54 0.58 1.95 102 TR_XM_SB_Phish 10147 1.94 1.97 1.92 103 XM_B_SpammyTLD 10015 2.35 3.41 1.89 104 XMSubPhish11 9970 1.89 1.90 1.89 105 XM_CamelCaseFrm001 9899 1.89 1.93 1.87 106 T_XMDrugObfuBody_14 9615 1.82 1.84 1.82 107 SUBJ_ALL_CAPS 9584 2.13 2.86 1.81 108 HTML_MIME_NO_HTML_TAG 9477 2.81 5.19 1.79 109 TooManyTo_002 9305 1.43 0.67 1.76 110 TR_XM_SpammyWords5 9049 2.43 4.10 1.71 111 XM_B_Unsub2 8898 1.93 2.51 1.68 112 T_XMDrugObfuBody_08 8547 2.31 3.93 1.62 113 XM_B_Phish66 8435 1.99 2.90 1.60 114 URI_HEX 8217 1.91 2.73 1.55 115 RCVD_IN_BL_SPAMCOP_NET 7829 4.67 12.13 1.48 116 RELAYCOUNTRY_CA 7697 2.94 6.41 1.46 117 IN_HORDE_ADDRESS_BOOK 7617 1.06 0.17 1.44 118 XM_SPF_SoftFail 7365 2.57 5.33 1.39 119 XMBdyGiftCard01 7334 1.55 1.94 1.39 120 INVALID_MSGID 7295 1.26 0.96 1.38 121 TR_MSPIKEBAYES00 7211 0.96 0.01 1.36 122 KHOP_HELO_FCRDNS 6959 1.88 3.20 1.32 123 TVD_RCVD_IP 6770 1.11 0.70 1.28 124 XM_DK_Undo_01 6651 1.99 3.72 1.26 125 TM2_M_VERY_LONG_WORD 6580 1.48 2.02 1.24 126 XMDiploma_00 6567 2.04 3.91 1.24 127 TO_MALFORMED 6475 0.88 0.07 1.22 128 MSGID_NOFQDN1 6463 0.98 0.42 1.22 129 HELO_NO_DOMAIN 6267 1.00 0.58 1.19 130 HELO_NODOT 6267 1.01 0.59 1.19 131 XMStockSpam_06 6227 1.29 1.55 1.18 132 XM_UB50 6203 3.21 7.98 1.17 133 TooManyTo_003 6188 0.98 0.52 1.17 134 USER_IN_DEF_DKIM_WL 6143 0.83 0.06 1.16 135 HELO_MISC_IP 5928 0.88 0.32 1.12 136 URI_TRY_3LD 5922 1.27 1.63 1.12 137 XMSubGarbage 5893 0.84 0.21 1.11 138 TR_Symld_Words 5864 1.13 1.17 1.11 139 XMSubLongNoVowel 5806 0.85 0.28 1.10 140 XMGappySubj_01 5572 0.80 0.20 1.05 141 XM_H_Long_From02 5461 0.99 0.89 1.03 142 XM_GoogleGroups 5389 0.85 0.47 1.02 143 DKIM_ADSP_CUSTOM_MED 5157 1.13 1.48 0.98 144 T_XMDrugObfuBody_00 5147 1.34 2.21 0.97 145 XM_OfRef6 5141 2.25 5.24 0.97 146 XM_E_Blogspot 5094 0.69 0.06 0.96 147 XMBSHREFv2 4890 0.74 0.32 0.92 148 XMSubMetaI_00 4890 1.07 1.43 0.92 149 XMCapTrack 4809 0.74 0.33 0.91 150 XM_ProductURIs 4672 0.91 0.98 0.88 151 XMBrknScrpt_02 4383 1.25 2.25 0.83 152 TooManyTo_004 4329 0.72 0.48 0.82 153 TR_XM_SpammyWords2 4283 3.72 10.53 0.81 154 XM_B_COVIDMETA 4131 1.31 2.54 0.78 155 TR_MetaPhish_Combo_01 4021 0.77 0.80 0.76 156 XMHTML_After_End 3877 0.83 1.05 0.73 157 RELAYCOUNTRY_GB 3872 1.05 1.80 0.73 158 XMGenDplmaNmb 3854 1.06 1.84 0.73 159 T_TooManySym_03 3776 0.53 0.10 0.71 160 T_XMHurry_00 3770 1.23 2.45 0.71 161 TooManyTo_005 3539 0.60 0.42 0.67 162 NML_ADSP_CUSTOM_MED 3478 0.83 1.24 0.66 163 FORGED_GMAIL_RCVD 3445 1.25 2.65 0.65 164 PDS_OTHER_BAD_TLD 3443 0.90 1.49 0.65 165 XMBody_17 3442 1.24 2.62 0.65 166 HTTPS_HTTP_MISMATCH 3199 0.71 0.96 0.61 167 XMPhish14 3096 0.64 0.77 0.59 168 SpammyFromTLD_01 3094 1.89 4.94 0.59 169 T_FILL_THIS_FORM_SHORT 3091 0.98 1.90 0.58 170 XM_B_SpammyWords4 3068 1.05 2.13 0.58 171 XMHTMLBadTable_001 3010 0.57 0.56 0.57 172 XM_S_SpammyWords 2983 0.60 0.68 0.56 173 TR_XM_Spammywords 2982 0.60 0.68 0.56 174 FROM_GOV_DKIM_AU 2950 0.52 0.42 0.56 175 XM_Body_Obfu01 2869 0.54 0.54 0.54 176 XMBody_95 2848 0.41 0.12 0.54 177 XM_B_REG_HTML 2724 0.48 0.41 0.52 178 XM_RXBody 2717 0.46 0.34 0.51 179 T_OBFU_PDF_ATTACH 2685 0.41 0.18 0.51 180 RDNS_DYNAMIC 2677 0.84 1.62 0.51 181 XMPhish30 2623 0.59 0.81 0.50 182 TR_LOTS_OF_MONEY3 2619 1.65 4.35 0.50 183 MISSING_HEADERS 2584 0.47 0.41 0.49 184 PLING_QUERY 2558 0.46 0.41 0.48 185 XM_ShortIntro_01 2513 0.43 0.31 0.48 186 TR_BOTNET_NEGATE 2507 0.60 0.89 0.47 187 XM_SPF_Unknown 2408 0.50 0.61 0.46 188 XMMoneyMeta_00 2396 0.54 0.73 0.45 189 T_Symld_Words_02 2384 0.58 0.88 0.45 190 SHOPIFY_IMG_NOT_RCVD_SFY 2350 0.40 0.30 0.44 191 XM_H_PHPMailer 2327 0.43 0.40 0.44 192 HTML_IMAGE_ONLY_20 2326 0.41 0.36 0.44 193 XMLngstWrd_00 2305 0.89 1.95 0.44 194 NUMERIC_HTTP_ADDR 2241 0.69 1.31 0.42 195 XMNoVowels 2184 0.45 0.55 0.41 196 XMLngstWrd_01 2109 0.86 1.93 0.40 197 XMSubMetaSxObfu_03 2102 0.92 2.14 0.40 198 TM2_M_BODY_EMPTY 2096 0.29 0.04 0.40 199 XMSexyCombo_01 2071 0.79 1.72 0.39 200 HTML_IMAGE_ONLY_32 2066 0.46 0.62 0.39 ----------------------------------------------------------------------