Email: 819278 Autolearn: 0 AvgScore: 1.16 AvgScanTime: 1.54 sec Spam: 216826 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.88 sec Ham: 602452 Autolearn: 0 AvgScore: -3.36 AvgScanTime: 1.42 sec Time Spent Running SA: 351.04 hours Time Spent Processing Spam: 113.15 hours Time Spent Processing Ham: 237.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 208357 92.26 96.09 90.88 2 DKIM_SIGNED 181998 70.83 83.94 66.12 3 XM_DK_Pass 175252 69.19 80.83 65.00 4 DCC_CHECK 172675 47.91 79.64 36.49 5 DKIM_VALID 172615 67.64 79.61 63.33 6 RELAYCOUNTRY_US 165589 83.51 76.37 86.07 7 XM_B_Unicode 163628 75.46 75.47 75.46 8 XMListUnsubscribeExists 149263 49.54 68.84 42.59 9 XM_B_SpammyWords 145886 52.58 67.28 47.28 10 DKIM_VALID_AU 135257 52.27 62.38 48.64 11 XM_DK_Undo_02 100257 17.16 46.24 6.69 12 XM_B_Unicode3 90380 45.46 41.68 46.82 13 BAYES_50 84375 46.14 38.91 48.74 14 XM_B_SpammyWords2 83460 22.83 38.49 17.20 15 TR_XM_DKIM_Undo 80298 13.18 37.03 4.60 16 LOC_TINY_FONT_1 78822 25.48 36.35 21.57 17 BAYES_99 70951 11.52 32.72 3.89 18 RCVD_IN_MSPIKE_H2 70352 26.61 32.45 24.51 19 MIME_HTML_ONLY 68651 27.20 31.66 25.59 20 HTML_FONT_LOW_CONTRAST 66927 26.56 30.87 25.01 21 DKIM_VALID_EF 62236 26.35 28.70 25.51 22 FVGT_m_MULTI_ODD 60388 21.67 27.85 19.44 23 BAYES_999 56998 9.27 26.29 3.14 24 T_KAM_HTML_FONT_INVALID 55647 17.91 25.66 15.12 25 TR_DCC_Bayes_99 55092 8.24 25.41 2.06 26 RELAYCOUNTRY_META 53083 9.57 24.48 4.20 27 XMSubLong 51760 20.64 23.87 19.48 28 RCVD_IN_MSPIKE_WL 47252 25.14 21.79 26.34 29 T_TM2_M_HEADER_IN_MSG 45364 23.71 20.92 24.71 30 BOTNET 44778 6.69 20.65 1.66 31 XM_Body_Dirty_Words 42502 12.72 19.60 10.24 32 DCC_CHECK_NEGATIVE 40193 50.26 18.54 61.68 33 XM_B_Unsub 31802 10.05 14.67 8.39 34 UNTRUSTED_Relay 30657 4.85 14.14 1.50 35 XM_Multi_Part_URI 30045 11.04 13.86 10.03 36 BOTNET_IPINHOSTNAME 29548 6.55 13.63 4.00 37 XM_B_SpammyWords3 28667 6.42 13.22 3.97 38 LOTS_OF_MONEY 28246 7.97 13.03 6.15 39 TR_XM_SpammyWords2 26272 3.80 12.12 0.81 40 RCVD_IN_BL_SPAMCOP_NET 26187 4.13 12.08 1.27 41 RCVD_IN_MSPIKE_H3 25765 13.27 11.88 13.76 42 TR_XM_SpammyWords4 24254 5.90 11.19 4.00 43 FSL_BULK_SIG 22889 7.27 10.56 6.08 44 XM_UncommonTLD01 22790 4.72 10.51 2.63 45 XM_Evil_Numbers_Gen 22764 8.85 10.50 8.26 46 XMSexyCombo_05 21594 5.27 9.96 3.58 47 MPART_ALT_DIFF 21254 11.10 9.80 11.57 48 XM_B_Phish_Phrases 19717 6.07 9.09 4.98 49 HTML_IMAGE_RATIO_02 19358 6.50 8.93 5.63 50 RCVD_IN_MSPIKE_H4 19340 9.41 8.92 9.58 51 UNPARSEABLE_RELAY 18639 7.17 8.60 6.66 52 TR_XM_UnparsRelay 18046 5.82 8.32 4.92 53 LotsOfNums_01 17908 7.51 8.26 7.24 54 BOTNET_NORDNS 16023 1.97 7.39 0.01 55 BAYES_80 15697 4.31 7.24 3.25 56 XM_H_Long_From01 15604 5.50 7.20 4.89 57 XM_SendGrid 15433 6.38 7.12 6.11 58 HTML_MIME_NO_HTML_TAG 15328 3.12 7.07 1.69 59 MIME_HTML_MOSTLY 15301 3.78 7.06 2.59 60 RCVD_IN_MSPIKE_BL 14516 1.90 6.69 0.18 61 RELAYCOUNTRY_CA 14450 2.61 6.66 1.15 62 TR_XM_PhishingBody 14163 3.53 6.53 2.45 63 BAYES_60 14002 6.22 6.46 6.14 64 XM_UB50 13605 2.36 6.27 0.95 65 HTML_IMAGE_RATIO_04 13435 15.35 6.20 18.65 66 XMSubMetaSx_00 12816 3.89 5.91 3.16 67 TR_XM_MSPIKECOMBO 12766 1.67 5.89 0.15 68 DKIM_ADSP_NXDOMAIN 12042 1.62 5.55 0.21 69 TooManyTo_001 11628 6.60 5.36 7.05 70 HTML_SHORT_LINK_IMG_1 11492 1.42 5.30 0.02 71 HDRS_MISSP 11426 1.52 5.27 0.17 72 HTML_IMAGE_ONLY_08 11249 1.44 5.19 0.09 73 XMStrtUSub 11102 11.52 5.12 13.83 74 HDRS_LCASE_IMGONLY 11087 1.41 5.11 0.07 75 RCVD_IN_RP_SAFE 11025 6.40 5.08 6.88 76 BAYES_20 10104 5.32 4.66 5.55 77 XM_SPF_SoftFail 9955 2.25 4.59 1.41 78 RCVD_IN_MSPIKE_L5 9706 1.24 4.48 0.08 79 DKIM_INVALID 9383 3.19 4.33 2.78 80 SpammyFromTLD_01 9358 1.67 4.32 0.72 81 TR_XM_DK_SendGrid 9289 4.11 4.28 4.05 82 BAYES_95 9265 2.60 4.27 1.99 83 RCVD_IN_RP_RNBL 9202 1.16 4.24 0.04 84 RELAYCOUNTRY_FR 8922 1.26 4.11 0.23 85 RCVD_IN_RP_CERTIFIED 8802 5.72 4.06 6.32 86 TM2_M_URI_OPT_OUT 8763 2.55 4.04 2.02 87 XM_OfRef6 8759 1.70 4.04 0.86 88 TR_XM_SpammyWords5 8497 2.17 3.92 1.54 89 XMNumbers 8219 2.82 3.79 2.47 90 HTML_IMAGE_RATIO_06 8202 5.14 3.78 5.63 91 HTML_TITLE_SUBJ_DIFF 7914 0.99 3.65 0.04 92 T_XMDrugObfuBody_08 7664 1.89 3.53 1.29 93 XM_B_SpammyTLD 7547 2.15 3.48 1.68 94 URIBL_SBL_A 7428 0.99 3.43 0.11 95 XM_DIRTYINTL 7425 1.14 3.42 0.31 96 BAYES_40 7026 5.02 3.24 5.66 97 RCVD_IN_PSBL 6988 0.87 3.22 0.02 98 XM_B_Phish66 6950 1.99 3.21 1.56 99 MIME_QP_LONG_LINE 6807 4.12 3.14 4.47 100 XMDiploma_00 6746 1.82 3.11 1.35 101 XM_DK_Undo_01 6684 1.93 3.08 1.52 102 MIME_HTML_ONLY_MULTI 6498 7.68 3.00 9.36 103 TR_LOTS_OF_MONEY3 6460 1.20 2.98 0.56 104 FROM_EXCESS_BASE64 6274 2.84 2.89 2.83 105 XMBrknScrpt_02 6251 1.24 2.88 0.65 106 XMBody_17 6145 1.15 2.83 0.54 107 SpammyFromTLD_02 6113 0.94 2.82 0.26 108 HTML_IMAGE_RATIO_08 6081 2.21 2.80 1.99 109 URI_HEX 5861 1.67 2.70 1.29 110 TM2_M_VERY_LONG_WORD 5808 1.49 2.68 1.06 111 XMBdyGiftCard01 5795 1.29 2.67 0.79 112 T_TooManySym_01 5743 3.50 2.65 3.80 113 SUBJ_ALL_CAPS 5536 1.87 2.55 1.62 114 XM_B_SpammyWords4 5465 1.09 2.52 0.58 115 XM_B_COVIDMETA 5410 1.14 2.50 0.66 116 TR_XM_MaxBayes 5408 0.66 2.49 0.01 117 TR_XM_SpammyWords3 5294 0.70 2.44 0.07 118 XM_CamelCaseFrm001 5187 1.90 2.39 1.72 119 RELAYCOUNTRY_GB 5168 1.35 2.38 0.98 120 PDS_OTHER_BAD_TLD 5054 0.91 2.33 0.40 121 XM_UB99 4704 0.58 2.17 0.00 122 XM_B_Unsub2 4639 1.64 2.14 1.45 123 T_XMDrugObfuBody_14 4485 1.48 2.07 1.27 124 KHOP_HELO_FCRDNS 4401 1.59 2.03 1.43 125 FORGED_GMAIL_RCVD 4387 0.93 2.02 0.54 126 XMSexyCombo_01 4387 0.85 2.02 0.43 127 T_REMOTE_IMAGE 4378 3.11 2.02 3.50 128 HK_RANDOM_REPLYTO 4307 0.64 1.99 0.16 129 MAILING_LIST_MULTI 4125 2.18 1.90 2.28 130 T_XMHurry_00 4027 0.96 1.86 0.64 131 RCVD_IN_IADB_LISTED 3947 3.71 1.82 4.39 132 URI_PHP_REDIR 3928 0.48 1.81 0.01 133 URI_TRY_3LD 3862 1.27 1.78 1.09 134 XMStockSpam_06 3861 1.21 1.78 1.00 135 RDNS_DYNAMIC 3787 0.80 1.75 0.46 136 TR_XM_SB_Phish 3760 1.85 1.73 1.89 137 T_FILL_THIS_FORM_SHORT 3721 1.03 1.72 0.78 138 TR_Symld_Words 3711 1.35 1.71 1.22 139 RCVD_IN_IADB_SPF 3670 3.23 1.69 3.79 140 T_XMDrugObfuBody_00 3644 1.03 1.68 0.79 141 XMSubPhish11 3619 1.82 1.67 1.87 142 XM_UB999 3601 0.44 1.66 0.00 143 TR_XM_BayesRelay 3591 0.45 1.66 0.02 144 XM_URI_RBL 3539 0.55 1.63 0.16 145 XM_UB60 3527 0.50 1.63 0.09 146 FROM_SUSPICIOUS_NTLD 3502 0.46 1.62 0.05 147 RCVD_IN_IADB_DK 3494 2.84 1.61 3.28 148 RCVD_IN_IADB_SENDERID 3493 2.91 1.61 3.38 149 XMGenDplmaNmb 3470 0.95 1.60 0.71 150 FROM_SUSPICIOUS_NTLD_FP 3410 0.45 1.57 0.05 151 XMPhish08 3364 0.51 1.55 0.13 152 TR_XM_COVIDMETA4 3345 0.62 1.54 0.29 153 URI_NOVOWEL 3263 2.13 1.50 2.35 154 URIBL_BLACK 3222 0.42 1.49 0.03 155 XMSubMetaI_00 3189 0.84 1.47 0.62 156 GOOGLE_DOC_SUSP 2948 0.40 1.36 0.05 157 FVGT_m_MULTI_ODD_EMAIL 2947 0.38 1.36 0.03 158 LongTLD 2935 0.44 1.35 0.11 159 HK_RANDOM_FROM 2912 0.42 1.34 0.09 160 NUMERIC_HTTP_ADDR 2844 0.58 1.31 0.32 161 TR_XM_PHPDW 2839 0.57 1.31 0.30 162 BAYES_00 2830 15.69 1.31 20.86 163 TR_Mismatch_TLD_02 2800 0.39 1.29 0.06 164 PDS_RDNS_DYNAMIC_FP 2779 0.43 1.28 0.12 165 TR_XM_PHPForged 2757 0.53 1.27 0.26 166 TR_XM_FormFill2 2733 0.53 1.26 0.27 167 XM_H_PHPOS 2729 0.52 1.26 0.26 168 RELAYCOUNTRY_DE 2694 0.73 1.24 0.55 169 TR_XM_COVIDMETA1 2674 0.49 1.23 0.22 170 RELAYCOUNTRY_IT 2632 0.36 1.21 0.06 171 DKIM_ADSP_CUSTOM_MED 2616 0.92 1.21 0.82 172 XM_UB80 2586 0.33 1.19 0.02 173 BAYES_05 2564 3.18 1.18 3.90 174 XMHTML_After_End 2547 0.81 1.17 0.68 175 XM_Body_Dirty_Words_01 2536 0.43 1.17 0.16 176 RELAYCOUNTRY_IN 2489 0.38 1.15 0.10 177 TR_XM_RelayPhish 2468 0.36 1.14 0.07 178 TR_Mismatch_TLD_01 2465 0.45 1.14 0.20 179 RELAYCOUNTRY_NL 2454 0.40 1.13 0.14 180 TR_XM_INV_DKIM 2251 0.33 1.04 0.07 181 XMSubNoVowel 2232 4.31 1.03 5.49 182 TR_Caps_n_Bayes_99 2216 0.46 1.02 0.26 183 T_Symld_Words_02 2161 0.71 1.00 0.60 184 XM_B_Crypto 2155 0.29 0.99 0.04 185 RCVD_IN_MSPIKE_H5 2147 2.46 0.99 2.99 186 TR_XM_FormFill 2116 0.26 0.98 0.01 187 NML_ADSP_CUSTOM_MED 2103 0.69 0.97 0.58 188 XMPhish30 2049 0.50 0.94 0.34 189 HTTPS_HTTP_MISMATCH 2037 0.74 0.94 0.67 190 TR_BOTNET_NEGATE 1993 0.49 0.92 0.33 191 XM_H_Long_From02 1992 1.02 0.92 1.06 192 XMMoneyMeta_00 1989 0.56 0.92 0.43 193 BITCOIN_YOUR_INFO 1978 0.27 0.91 0.04 194 NO_DNS_FOR_FROM 1958 0.37 0.90 0.18 195 URI_GOOGLE_PROXY 1930 0.33 0.89 0.12 196 PDS_BTC_ID 1915 0.26 0.88 0.03 197 DIET_1 1913 0.49 0.88 0.34 198 XM_B_SEO 1856 0.34 0.86 0.16 199 RELAYCOUNTRY_JP 1826 0.24 0.84 0.03 200 THIS_AD 1819 0.45 0.84 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 547519 92.26 96.09 90.88 2 RELAYCOUNTRY_US 518550 83.51 76.37 86.07 3 XM_B_Unicode 454582 75.46 75.47 75.46 4 DKIM_SIGNED 398317 70.83 83.94 66.12 5 XM_DK_Pass 391615 69.19 80.83 65.00 6 DKIM_VALID 381560 67.64 79.61 63.33 7 DCC_CHECK_NEGATIVE 371616 50.26 18.54 61.68 8 BAYES_50 293651 46.14 38.91 48.74 9 DKIM_VALID_AU 293004 52.27 62.38 48.64 10 XM_B_SpammyWords 284864 52.58 67.28 47.28 11 XM_B_Unicode3 282075 45.46 41.68 46.82 12 XMListUnsubscribeExists 256597 49.54 68.84 42.59 13 DCC_CHECK 219834 47.91 79.64 36.49 14 RCVD_IN_MSPIKE_WL 158677 25.14 21.79 26.34 15 MIME_HTML_ONLY 154172 27.20 31.66 25.59 16 DKIM_VALID_EF 153678 26.35 28.70 25.51 17 HTML_FONT_LOW_CONTRAST 150665 26.56 30.87 25.01 18 T_TM2_M_HEADER_IN_MSG 148848 23.71 20.92 24.71 19 RCVD_IN_MSPIKE_H2 147660 26.61 32.45 24.51 20 LOC_TINY_FONT_1 129963 25.48 36.35 21.57 21 BAYES_00 125699 15.69 1.31 20.86 22 XMSubLong 117358 20.64 23.87 19.48 23 FVGT_m_MULTI_ODD 117110 21.67 27.85 19.44 24 HTML_IMAGE_RATIO_04 112345 15.35 6.20 18.65 25 HTML_FONT_FACE_BAD 103979 12.86 0.64 17.26 26 XM_B_SpammyWords2 103592 22.83 38.49 17.20 27 XM_H_Trusted_IP 101117 12.34 0.00 16.78 28 T_KAM_HTML_FONT_INVALID 91106 17.91 25.66 15.12 29 XMStrtUSub 83303 11.52 5.12 13.83 30 RCVD_IN_MSPIKE_H3 82920 13.27 11.88 13.76 31 MPART_ALT_DIFF 69685 11.10 9.80 11.57 32 ALL_TRUSTED 66145 8.27 0.74 10.98 33 XM_Body_Dirty_Words 61672 12.72 19.60 10.24 34 XM_Multi_Part_URI 60403 11.04 13.86 10.03 35 RCVD_IN_MSPIKE_H4 57724 9.41 8.92 9.58 36 MIME_HTML_ONLY_MULTI 56396 7.68 3.00 9.36 37 XM_DKIMWhitelistDomains 55179 6.74 0.02 9.16 38 TR_XM_DK_Bayes 54148 6.81 0.78 8.99 39 TR_XM_DK_Bayes1 52350 6.59 0.75 8.69 40 XM_B_Unsub 50532 10.05 14.67 8.39 41 XM_Evil_Numbers_Gen 49770 8.85 10.50 8.26 42 TR_XM_DK_Bayes2 45545 5.74 0.70 7.56 43 LotsOfNums_01 43598 7.51 8.26 7.24 44 TooManyTo_001 42478 6.60 5.36 7.05 45 RCVD_IN_RP_SAFE 41424 6.40 5.08 6.88 46 XM_DK_Undo_02 40331 17.16 46.24 6.69 47 UNPARSEABLE_RELAY 40131 7.17 8.60 6.66 48 RCVD_IN_RP_CERTIFIED 38073 5.72 4.06 6.32 49 LOTS_OF_MONEY 37060 7.97 13.03 6.15 50 BAYES_60 36980 6.22 6.46 6.14 51 XM_SendGrid 36803 6.38 7.12 6.11 52 FSL_BULK_SIG 36646 7.27 10.56 6.08 53 BAYES_40 34108 5.02 3.24 5.66 54 HTML_IMAGE_RATIO_02 33903 6.50 8.93 5.63 55 HTML_IMAGE_RATIO_06 33890 5.14 3.78 5.63 56 BAYES_20 33448 5.32 4.66 5.55 57 XMSubNoVowel 33102 4.31 1.03 5.49 58 XM_B_Phish_Phrases 29988 6.07 9.09 4.98 59 TR_XM_UnparsRelay 29641 5.82 8.32 4.92 60 XM_H_Long_From01 29441 5.50 7.20 4.89 61 IN_ZIMBRA_NJ_WHITELIST 29404 3.60 0.05 4.88 62 TR_XM_DKIM_Undo 27718 13.18 37.03 4.60 63 MIME_QP_LONG_LINE 26943 4.12 3.14 4.47 64 RCVD_IN_IADB_LISTED 26419 3.71 1.82 4.39 65 RELAYCOUNTRY_META 25330 9.57 24.48 4.20 66 TR_XM_DK_SendGrid 24391 4.11 4.28 4.05 67 TR_XM_SpammyWords4 24098 5.90 11.19 4.00 68 BOTNET_IPINHOSTNAME 24082 6.55 13.63 4.00 69 XM_B_SpammyWords3 23915 6.42 13.22 3.97 70 BAYES_05 23523 3.18 1.18 3.90 71 BAYES_99 23432 11.52 32.72 3.89 72 T_TooManySym_01 22903 3.50 2.65 3.80 73 XM_PDF 22866 2.98 0.72 3.80 74 RCVD_IN_IADB_SPF 22832 3.23 1.69 3.79 75 XMSexyCombo_05 21575 5.27 9.96 3.58 76 T_REMOTE_IMAGE 21103 3.11 2.02 3.50 77 RCVD_IN_IADB_SENDERID 20368 2.91 1.61 3.38 78 RCVD_IN_IADB_DK 19733 2.84 1.61 3.28 79 BAYES_80 19577 4.31 7.24 3.25 80 XMSubMetaSx_00 19021 3.89 5.91 3.16 81 BAYES_999 18910 9.27 26.29 3.14 82 RCVD_IN_MSPIKE_H5 18033 2.46 0.99 2.99 83 FROM_EXCESS_BASE64 17031 2.84 2.89 2.83 84 DKIM_INVALID 16757 3.19 4.33 2.78 85 RCVD_IN_IADB_VOUCHED 16279 2.15 0.63 2.70 86 XM_UncommonTLD01 15853 4.72 10.51 2.63 87 MIME_HTML_MOSTLY 15631 3.78 7.06 2.59 88 XMSubGarbage 14982 1.83 0.02 2.49 89 ANY_BOUNCE_MESSAGE 14974 1.97 0.52 2.49 90 BOUNCE_MESSAGE 14974 1.97 0.52 2.49 91 XMSubLongNoVowel 14911 1.85 0.12 2.48 92 XMNumbers 14856 2.82 3.79 2.47 93 TR_XM_PhishingBody 14734 3.53 6.53 2.45 94 URI_NOVOWEL 14181 2.13 1.50 2.35 95 MAILING_LIST_MULTI 13707 2.18 1.90 2.28 96 TR_DCC_Bayes_99 12392 8.24 25.41 2.06 97 TM2_M_URI_OPT_OUT 12152 2.55 4.04 2.02 98 BAYES_95 12012 2.60 4.27 1.99 99 HTML_IMAGE_RATIO_08 12008 2.21 2.80 1.99 100 TR_XM_SB_Phish 11384 1.85 1.73 1.89 101 XMSubPhish11 11267 1.82 1.67 1.87 102 TooManyTo_002 11249 1.52 0.56 1.87 103 RCVD_IN_IADB_OPTIN 10534 1.40 0.44 1.75 104 XM_CamelCaseFrm001 10364 1.90 2.39 1.72 105 HTML_MIME_NO_HTML_TAG 10210 3.12 7.07 1.69 106 XM_B_SpammyTLD 10101 2.15 3.48 1.68 107 BOTNET 9995 6.69 20.65 1.66 108 T_TooManySym_02 9807 1.38 0.68 1.63 109 SUBJ_ALL_CAPS 9756 1.87 2.55 1.62 110 XM_B_Phish66 9369 1.99 3.21 1.56 111 TR_XM_SpammyWords5 9295 2.17 3.92 1.54 112 XM_DK_Undo_01 9151 1.93 3.08 1.52 113 HELO_NODOT 9100 1.28 0.65 1.51 114 HELO_NO_DOMAIN 9098 1.28 0.64 1.51 115 UNTRUSTED_Relay 9050 4.85 14.14 1.50 116 XM_B_Unsub2 8760 1.64 2.14 1.45 117 KHOP_HELO_FCRDNS 8642 1.59 2.03 1.43 118 TVD_RCVD_IP 8488 1.19 0.57 1.41 119 XM_SPF_SoftFail 8476 2.25 4.59 1.41 120 XMDiploma_00 8137 1.82 3.11 1.35 121 IN_HORDE_ADDRESS_BOOK 8024 0.99 0.06 1.33 122 URI_HEX 7799 1.67 2.70 1.29 123 T_XMDrugObfuBody_08 7796 1.89 3.53 1.29 124 RCVD_IN_BL_SPAMCOP_NET 7671 4.13 12.08 1.27 125 T_XMDrugObfuBody_14 7625 1.48 2.07 1.27 126 TR_Symld_Words 7355 1.35 1.71 1.22 127 INVALID_MSGID 7333 1.11 0.82 1.22 128 TooManyTo_003 7195 1.00 0.46 1.19 129 RELAYCOUNTRY_CA 6938 2.61 6.66 1.15 130 HELO_MISC_IP 6775 0.90 0.28 1.12 131 TR_MSPIKEBAYES00 6668 0.82 0.02 1.11 132 URI_TRY_3LD 6575 1.27 1.78 1.09 133 MSGID_NOFQDN1 6563 0.91 0.42 1.09 134 TO_MALFORMED 6422 0.78 0.00 1.07 135 XMCapTrack 6404 0.88 0.36 1.06 136 XM_H_Long_From02 6375 1.02 0.92 1.06 137 TM2_M_VERY_LONG_WORD 6372 1.49 2.68 1.06 138 USER_IN_DEF_DKIM_WL 6317 0.77 0.01 1.05 139 XM_E_Blogspot 6175 0.77 0.06 1.02 140 XMStockSpam_06 6040 1.21 1.78 1.00 141 RELAYCOUNTRY_GB 5923 1.35 2.38 0.98 142 XM_UB50 5720 2.36 6.27 0.95 143 XMBSHREFv2 5679 0.75 0.23 0.94 144 XM_GoogleGroups 5598 0.82 0.52 0.93 145 XM_OfRef6 5190 1.70 4.04 0.86 146 TooManyTo_004 5152 0.74 0.41 0.86 147 DKIM_ADSP_CUSTOM_MED 4955 0.92 1.21 0.82 148 TR_XM_SpammyWords2 4897 3.80 12.12 0.81 149 T_XMDrugObfuBody_00 4779 1.03 1.68 0.79 150 XMGappySubj_01 4772 0.62 0.16 0.79 151 XMBdyGiftCard01 4733 1.29 2.67 0.79 152 T_FILL_THIS_FORM_SHORT 4681 1.03 1.72 0.78 153 XMBody_95 4570 0.57 0.06 0.76 154 SpammyFromTLD_01 4312 1.67 4.32 0.72 155 XMGenDplmaNmb 4297 0.95 1.60 0.71 156 TooManyTo_005 4179 0.60 0.36 0.69 157 XMHTML_After_End 4110 0.81 1.17 0.68 158 HTTPS_HTTP_MISMATCH 4036 0.74 0.94 0.67 159 XM_B_COVIDMETA 3966 1.14 2.50 0.66 160 XMBrknScrpt_02 3896 1.24 2.88 0.65 161 T_XMHurry_00 3861 0.96 1.86 0.64 162 XMSubMetaI_00 3711 0.84 1.47 0.62 163 TR_MetaPhish_Combo_01 3669 0.63 0.69 0.61 164 T_Symld_Words_02 3632 0.71 1.00 0.60 165 NML_ADSP_CUSTOM_MED 3516 0.69 0.97 0.58 166 XM_B_SpammyWords4 3502 1.09 2.52 0.58 167 TR_LOTS_OF_MONEY3 3350 1.20 2.98 0.56 168 FROM_GOV_DKIM_AU 3326 0.53 0.46 0.55 169 XM_ProductURIs 3305 0.58 0.66 0.55 170 RELAYCOUNTRY_DE 3302 0.73 1.24 0.55 171 FORGED_GMAIL_RCVD 3263 0.93 2.02 0.54 172 MSGID_FROM_MTA_HEADER 3247 0.45 0.22 0.54 173 XMBody_17 3239 1.15 2.83 0.54 174 XM_SPF_Unknown 3172 0.56 0.65 0.53 175 T_OBFU_PDF_ATTACH 3154 0.43 0.16 0.52 176 T_TooManySym_03 2948 0.38 0.09 0.49 177 XM_ShortIntro_01 2881 0.44 0.34 0.48 178 XM_H_PHPMailer 2880 0.47 0.46 0.48 179 HTML_IMAGE_ONLY_20 2787 0.47 0.48 0.46 180 RDNS_DYNAMIC 2767 0.80 1.75 0.46 181 XMNoVowels 2741 0.43 0.37 0.45 182 XMHTMLBadTable_001 2730 0.54 0.77 0.45 183 XMLngstWrd_00 2657 0.44 0.42 0.44 184 RCVD_IN_SORBS_DUL 2638 0.40 0.28 0.44 185 TM2_M_BODY_EMPTY 2625 0.34 0.07 0.44 186 SHORT_HELO_AND_INLINE_IMAGE 2610 0.33 0.06 0.43 187 XMMoneyMeta_00 2586 0.56 0.92 0.43 188 XMSexyCombo_01 2583 0.85 2.02 0.43 189 MY_SERVERS_FOUND 2432 0.33 0.12 0.40 190 PDS_OTHER_BAD_TLD 2417 0.91 2.33 0.40 191 XMSubMetaSxObfu_03 2384 0.47 0.69 0.40 192 XMLngstWrd_01 2364 0.39 0.39 0.39 193 XMSubMetaSxObfu_02 2317 0.49 0.79 0.38 194 HTML_IMAGE_ONLY_32 2238 0.40 0.47 0.37 195 MISSING_HEADERS 2199 0.37 0.39 0.37 196 PLING_QUERY 2142 0.42 0.62 0.36 197 HTML_IMAGE_ONLY_28 2107 0.33 0.27 0.35 198 XMPhish30 2073 0.50 0.94 0.34 199 DIET_1 2070 0.49 0.88 0.34 200 FROM_GOV_SPOOF 2056 0.28 0.10 0.34 ----------------------------------------------------------------------