Email: 699679 Autolearn: 0 AvgScore: 1.17 AvgScanTime: 1.20 sec Spam: 108836 Autolearn: 0 AvgScore: 12.76 AvgScanTime: 1.37 sec Ham: 590843 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.17 sec Time Spent Running SA: 233.36 hours Time Spent Processing Spam: 41.38 hours Time Spent Processing Ham: 191.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106315 98.52 97.68 98.68 2 HTML_MESSAGE 99851 88.68 91.74 88.12 3 DKIM_SIGNED 85184 78.43 78.27 78.46 4 XM_DK_Pass 82063 76.96 75.40 77.25 5 DKIM_VALID 79304 74.84 72.87 75.21 6 XM_B_Unicode 73190 70.21 67.25 70.75 7 XMListUnsubscribeExists 72575 55.37 66.68 53.29 8 RELAYCOUNTRY_US 70070 78.96 64.38 81.65 9 XM_B_SpammyWords 69893 53.70 64.22 51.77 10 DKIM_VALID_AU 58734 55.09 53.97 55.30 11 XM_DK_Undo_02 53553 17.21 49.21 11.32 12 BAYES_99 43444 12.62 39.92 7.59 13 XM_B_SpammyWords2 41098 25.58 37.76 23.34 14 LOC_TINY_FONT_1 39457 26.02 36.25 24.13 15 XM_B_Unicode3 38041 39.09 34.95 39.85 16 DKIM_VALID_EF 37449 29.92 34.41 29.09 17 RELAYCOUNTRY_META 36899 10.07 33.90 5.68 18 BAYES_50 36306 50.89 33.36 54.12 19 MIME_HTML_ONLY 33577 21.47 30.85 19.74 20 BAYES_999 32890 9.92 30.22 6.18 21 HTML_FONT_LOW_CONTRAST 32679 28.16 30.03 27.81 22 RCVD_IN_MSPIKE_H2 27124 26.82 24.92 27.17 23 UNTRUSTED_Relay 26590 5.60 24.43 2.13 24 BOTNET 26255 5.60 24.12 2.18 25 XM_UncommonTLD01 24516 6.40 22.53 3.43 26 T_TM2_M_HEADER_IN_MSG 24385 28.35 22.41 29.44 27 XMSubLong 24090 21.08 22.13 20.89 28 FVGT_m_MULTI_ODD 23806 23.15 21.87 23.39 29 T_KAM_HTML_FONT_INVALID 23308 20.04 21.42 19.79 30 XM_Body_Dirty_Words 22103 14.52 20.31 13.45 31 XM_Multi_Part_URI 20714 13.48 19.03 12.46 32 LOTS_OF_MONEY 16646 8.57 15.29 7.33 33 BOTNET_IPINHOSTNAME 15913 7.37 14.62 6.04 34 RCVD_IN_MSPIKE_BL 15907 2.94 14.62 0.79 35 XM_B_SpammyWords3 14479 6.55 13.30 5.30 36 XM_B_Phish_Phrases 13249 8.33 12.17 7.62 37 MPART_ALT_DIFF 12981 4.89 11.93 3.59 38 XMSexyCombo_05 12809 5.27 11.77 4.08 39 RCVD_IN_MSPIKE_WL 12491 25.51 11.48 28.09 40 XM_B_Unsub 11962 10.99 10.99 10.98 41 MIME_HTML_MOSTLY 11187 3.70 10.28 2.49 42 LotsOfNums_01 11135 9.87 10.23 9.80 43 RCVD_IN_BL_SPAMCOP_NET 10597 2.94 9.74 1.69 44 SpammyFromTLD_01 10309 2.17 9.47 0.82 45 TR_XM_PhishingBody 10123 4.24 9.30 3.31 46 XM_Evil_Numbers_Gen 9052 9.93 8.32 10.22 47 BAYES_80 9047 5.07 8.31 4.48 48 SpammyFromTLD_02 8757 1.56 8.05 0.36 49 HTML_IMAGE_RATIO_02 8564 7.04 7.87 6.88 50 XMSubMetaSx_00 8397 4.87 7.72 4.35 51 URI_PHP_REDIR 8146 1.17 7.48 0.01 52 XM_UB50 7990 2.06 7.34 1.08 53 RCVD_IN_MSPIKE_L3 7937 1.61 7.29 0.56 54 XM_UB99 7746 1.11 7.12 0.00 55 T_REMOTE_IMAGE 7650 4.41 7.03 3.93 56 XMBrknScrpt_02 7631 2.08 7.01 1.17 57 RCVD_IN_RP_RNBL 7458 1.11 6.85 0.06 58 XM_SPF_SoftFail 7427 2.62 6.82 1.85 59 RELAYCOUNTRY_CA 7337 2.48 6.74 1.69 60 BAYES_60 7292 6.89 6.70 6.93 61 XM_B_Phish66 7251 2.59 6.66 1.84 62 TooManyTo_001 7094 8.11 6.52 8.40 63 RCVD_IN_MSPIKE_L5 6829 1.13 6.27 0.19 64 RCVD_IN_MSPIKE_H3 6674 14.61 6.13 16.17 65 RELAYCOUNTRY_FR 6237 1.19 5.73 0.35 66 HTML_IMAGE_RATIO_04 6026 5.38 5.54 5.35 67 XM_DIRTYINTL 5957 1.38 5.47 0.62 68 KHOP_HELO_FCRDNS 5905 2.08 5.43 1.46 69 DKIM_INVALID 5880 3.59 5.40 3.25 70 XM_B_COVIDMETA 5827 2.19 5.35 1.60 71 XM_H_Long_From01 5801 5.47 5.33 5.50 72 RCVD_IN_PSBL 5621 0.83 5.16 0.03 73 XM_B_SpammyTLD 5535 2.50 5.09 2.02 74 BAYES_95 5509 2.94 5.06 2.55 75 RCVD_IN_MSPIKE_H4 5327 9.05 4.89 9.82 76 XM_UB999 5288 0.76 4.86 0.00 77 UNPARSEABLE_RELAY 4950 7.45 4.55 7.98 78 XMBody_17 4898 1.30 4.50 0.71 79 TR_LOTS_OF_MONEY3 4843 1.13 4.45 0.52 80 HTML_IMAGE_RATIO_06 4787 3.79 4.40 3.67 81 HTML_IMAGE_ONLY_08 4770 0.78 4.38 0.11 82 XM_OfRef6 4747 1.66 4.36 1.16 83 BODY_URI_ONLY 4653 0.70 4.28 0.04 84 T_XMDrugObfuBody_08 4650 2.05 4.27 1.64 85 HTML_SHORT_LINK_IMG_1 4607 0.68 4.23 0.02 86 SHORT_SHORTNER 4561 0.67 4.19 0.02 87 TR_XM_MaxSPIKE 4518 0.69 4.15 0.05 88 SHORTENED_URL_SRC 4510 0.65 4.14 0.00 89 SHORT_URI_3 4466 0.68 4.10 0.05 90 SHORTENER_SHORT_IMG 4455 0.64 4.09 0.00 91 URIBL_SBL_A 4401 0.77 4.04 0.16 92 RELAYCOUNTRY_IN 4332 0.70 3.98 0.10 93 XMNumbers 4038 3.35 3.71 3.29 94 SUBJ_ALL_CAPS 4012 2.05 3.69 1.75 95 BOTNET_NORDNS 3954 0.59 3.63 0.02 96 XMDiploma_00 3932 2.25 3.61 2.00 97 TR_XM_SB_Phish 3861 2.50 3.55 2.31 98 XM_SendGrid 3772 6.68 3.47 7.27 99 XMSubPhish11 3767 2.46 3.46 2.28 100 TM2_M_URI_OPT_OUT 3453 3.64 3.17 3.73 101 XMStrtUSub 3381 6.21 3.11 6.79 102 TR_XM_MaxBayes 3347 0.50 3.08 0.02 103 RELAYCOUNTRY_GB 3339 1.27 3.07 0.93 104 XM_UB60 3294 0.59 3.03 0.14 105 TR_XM_COVIDMETA4 3271 0.92 3.01 0.54 106 T_PDS_OTHER_BAD_TLD 3209 0.81 2.95 0.42 107 XM_CamelCaseFrm001 3186 2.16 2.93 2.02 108 XM_B_Unsub2 3128 3.09 2.87 3.13 109 FROM_EXCESS_BASE64 3101 2.78 2.85 2.76 110 XM_B_SpammyWords4 3031 0.97 2.78 0.64 111 HTML_IMAGE_RATIO_08 3025 2.28 2.78 2.18 112 XM_UB80 3004 0.47 2.76 0.05 113 XM_URI_RBL 2995 0.59 2.75 0.19 114 RELAYCOUNTRY_DE 2963 0.80 2.72 0.44 115 TR_XM_PHPDW 2789 0.75 2.56 0.42 116 TR_XM_PHPForged 2776 0.74 2.55 0.40 117 TR_XM_FormFill2 2746 0.73 2.52 0.40 118 XM_H_PHPOS 2742 0.73 2.52 0.40 119 MIME_QP_LONG_LINE 2663 5.46 2.45 6.01 120 FROM_SUSPICIOUS_NTLD 2642 0.42 2.43 0.05 121 TR_XM_UnparsRelay 2540 0.70 2.33 0.40 122 FROM_SUSPICIOUS_NTLD_FP 2517 0.39 2.31 0.04 123 HTML_MIME_NO_HTML_TAG 2499 2.28 2.30 2.28 124 T_XMDrugObfuBody_00 2474 0.93 2.27 0.68 125 DKIM_ADSP_CUSTOM_MED 2464 1.33 2.26 1.15 126 BAYES_40 2461 4.35 2.26 4.74 127 NML_ADSP_CUSTOM_MED 2370 1.03 2.18 0.82 128 DATE_IN_PAST_06_12 2363 0.51 2.17 0.20 129 TR_XM_COVIDMETA1 2345 0.59 2.15 0.30 130 URI_HEX 2335 1.47 2.15 1.35 131 XMSubNoVowel 2308 0.82 2.12 0.58 132 T_XMHurry_00 2300 0.82 2.11 0.58 133 TM2_M_VERY_LONG_WORD 2232 1.44 2.05 1.33 134 SPOOFED_URL 2215 0.93 2.04 0.73 135 XMGenDplmaNmb 2207 1.07 2.03 0.89 136 ALL_TRUSTED 2126 12.28 1.95 14.18 137 T_TooManySym_01 2124 4.53 1.95 5.00 138 RDNS_DYNAMIC 2110 0.67 1.94 0.44 139 XMSexyCombo_01 2075 0.78 1.91 0.58 140 SPOOFED_URL_HOST 2061 0.83 1.89 0.63 141 FORGED_GMAIL_RCVD 2037 0.83 1.87 0.64 142 MIME_CHARSET_FARAWAY 2019 0.38 1.86 0.11 143 TR_XM_RelayPhish 2000 0.41 1.84 0.14 144 BAYES_20 1986 3.46 1.82 3.76 145 TR_Caps_n_Bayes_99 1983 0.39 1.82 0.13 146 URI_TRY_3LD 1976 1.34 1.82 1.26 147 T_FILL_THIS_FORM_SHORT 1920 1.09 1.76 0.97 148 XM_UB95 1904 0.29 1.75 0.02 149 XM_SPF_Unknown 1859 1.19 1.71 1.09 150 XM_PDF 1853 4.71 1.70 5.27 151 DATE_IN_PAST_03_06 1834 0.35 1.69 0.10 152 TR_XM_DK_SendGrid 1797 3.95 1.65 4.37 153 CHARSET_FARAWAY_HEADER 1790 0.29 1.64 0.04 154 T_XMDrugObfuBody_14 1773 1.52 1.63 1.50 155 XM_DK_Undo_01 1762 1.84 1.62 1.88 156 TR_XM_INV_DKIM 1748 0.39 1.61 0.17 157 XMStockSpam_06 1717 1.26 1.58 1.20 158 T_FONT_INVIS_MSGID 1716 0.90 1.58 0.77 159 TR_Symld_Words 1666 1.74 1.53 1.78 160 TR_XM_Spammywords 1651 0.48 1.52 0.29 161 XM_S_SpammyWords 1651 0.48 1.52 0.29 162 URI_NO_WWW_BIZ_CGI 1649 0.24 1.52 0.01 163 URIBL_DBL_SPAM 1623 0.24 1.49 0.01 164 MIME_HTML_ONLY_MULTI 1521 1.77 1.40 1.84 165 XMSubMetaSxObfu_03 1519 1.33 1.40 1.31 166 XMHTML_After_End 1510 0.88 1.39 0.78 167 BAYES_00 1489 11.60 1.37 13.48 168 PDS_RDNS_DYNAMIC_FP 1473 0.25 1.35 0.05 169 URI_NOVOWEL 1453 2.52 1.34 2.74 170 XMMoneyMeta_00 1410 0.76 1.30 0.66 171 RCVD_IN_IADB_LISTED 1382 5.16 1.27 5.88 172 MAILING_LIST_MULTI 1362 2.47 1.25 2.70 173 MIMEOLE_DIRECT_TO_MX 1359 0.20 1.25 0.00 174 NUMERIC_HTTP_ADDR 1357 0.56 1.25 0.44 175 XMBody_78 1322 0.58 1.21 0.47 176 HTTPS_HTTP_MISMATCH 1319 0.87 1.21 0.81 177 RELAYCOUNTRY_RU 1305 0.20 1.20 0.02 178 HK_RANDOM_REPLYTO 1289 0.39 1.18 0.24 179 RELAYCOUNTRY_AU 1265 0.60 1.16 0.49 180 DOS_OE_TO_MX 1244 0.18 1.14 0.00 181 TooManyTo_002 1230 1.91 1.13 2.06 182 XMSubLongNoVowel 1168 0.18 1.07 0.02 183 HELO_NODOT 1164 1.36 1.07 1.41 184 HELO_NO_DOMAIN 1163 1.36 1.07 1.41 185 BAYES_05 1155 2.14 1.06 2.34 186 MPART_ALT_DIFF_COUNT 1147 0.57 1.05 0.48 187 RELAYCOUNTRY_NL 1142 0.62 1.05 0.55 188 NORMAL_HTTP_TO_IP 1141 0.20 1.05 0.04 189 XMPhish08 1131 0.56 1.04 0.47 190 NO_DNS_FOR_FROM 1126 0.58 1.03 0.50 191 RCVD_IN_IADB_SPF 1114 4.47 1.02 5.11 192 XM_BadFromFormat 1110 0.36 1.02 0.24 193 XM_H_Long_From02 1104 1.33 1.01 1.39 194 LongTLD 1093 0.37 1.00 0.26 195 RCVD_IN_MSPIKE_L4 1089 0.19 1.00 0.04 196 TR_Mismatch_TLD_02 1083 0.26 1.00 0.13 197 TR_Mismatch_TLD_01 1058 0.33 0.97 0.22 198 TR_MetaPhish_Combo_01 1044 0.84 0.96 0.82 199 INVESTMENT_ADVICE 1030 0.24 0.95 0.11 200 HTML_IMAGE_ONLY_32 1027 0.48 0.94 0.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 583036 98.52 97.68 98.68 2 HTML_MESSAGE 520647 88.68 91.74 88.12 3 RELAYCOUNTRY_US 482425 78.96 64.38 81.65 4 DKIM_SIGNED 463574 78.43 78.27 78.46 5 XM_DK_Pass 456412 76.96 75.40 77.25 6 DKIM_VALID 444355 74.84 72.87 75.21 7 XM_B_Unicode 418037 70.21 67.25 70.75 8 DKIM_VALID_AU 326751 55.09 53.97 55.30 9 BAYES_50 319784 50.89 33.36 54.12 10 XMListUnsubscribeExists 314837 55.37 66.68 53.29 11 XM_B_SpammyWords 305869 53.70 64.22 51.77 12 XM_B_Unicode3 235444 39.09 34.95 39.85 13 T_TM2_M_HEADER_IN_MSG 173944 28.35 22.41 29.44 14 DKIM_VALID_EF 171881 29.92 34.41 29.09 15 RCVD_IN_MSPIKE_WL 165991 25.51 11.48 28.09 16 HTML_FONT_LOW_CONTRAST 164334 28.16 30.03 27.81 17 RCVD_IN_MSPIKE_H2 160557 26.82 24.92 27.17 18 LOC_TINY_FONT_1 142578 26.02 36.25 24.13 19 FVGT_m_MULTI_ODD 138182 23.15 21.87 23.39 20 XM_B_SpammyWords2 137910 25.58 37.76 23.34 21 XMSubLong 123424 21.08 22.13 20.89 22 T_KAM_HTML_FONT_INVALID 116933 20.04 21.42 19.79 23 MIME_HTML_ONLY 116613 21.47 30.85 19.74 24 RCVD_IN_MSPIKE_H3 95522 14.61 6.13 16.17 25 ALL_TRUSTED 83805 12.28 1.95 14.18 26 BAYES_00 79675 11.60 1.37 13.48 27 XM_Body_Dirty_Words 79477 14.52 20.31 13.45 28 XM_Multi_Part_URI 73602 13.48 19.03 12.46 29 XM_DK_Undo_02 66862 17.21 49.21 11.32 30 XM_B_Unsub 64901 10.99 10.99 10.98 31 XM_Evil_Numbers_Gen 60395 9.93 8.32 10.22 32 RCVD_IN_MSPIKE_H4 58020 9.05 4.89 9.82 33 LotsOfNums_01 57930 9.87 10.23 9.80 34 TR_XM_DK_Bayes 54724 7.90 0.48 9.26 35 TR_XM_DK_Bayes1 53138 7.66 0.44 8.99 36 TooManyTo_001 49630 8.11 6.52 8.40 37 UNPARSEABLE_RELAY 47172 7.45 4.55 7.98 38 TR_XM_DK_Bayes2 46816 6.75 0.40 7.92 39 XM_B_Phish_Phrases 45028 8.33 12.17 7.62 40 BAYES_99 44821 12.62 39.92 7.59 41 LOTS_OF_MONEY 43311 8.57 15.29 7.33 42 XM_SendGrid 42964 6.68 3.47 7.27 43 RCVD_IN_RP_SAFE 42157 6.12 0.61 7.14 44 XM_DKIMWhitelistDomains 41660 5.95 0.00 7.05 45 BAYES_60 40918 6.89 6.70 6.93 46 HTML_IMAGE_RATIO_02 40675 7.04 7.87 6.88 47 XMStrtUSub 40094 6.21 3.11 6.79 48 RCVD_IN_RP_CERTIFIED 39265 5.69 0.51 6.65 49 BAYES_999 36518 9.92 30.22 6.18 50 BOTNET_IPINHOSTNAME 35672 7.37 14.62 6.04 51 MIME_QP_LONG_LINE 35532 5.46 2.45 6.01 52 IN_ZIMBRA_NJ_WHITELIST 34967 5.00 0.04 5.92 53 RCVD_IN_IADB_LISTED 34722 5.16 1.27 5.88 54 RELAYCOUNTRY_META 33580 10.07 33.90 5.68 55 XM_H_Long_From01 32488 5.47 5.33 5.50 56 HTML_IMAGE_RATIO_04 31627 5.38 5.54 5.35 57 XM_B_SpammyWords3 31327 6.55 13.30 5.30 58 XM_PDF 31124 4.71 1.70 5.27 59 RCVD_IN_IADB_SPF 30175 4.47 1.02 5.11 60 T_TooManySym_01 29561 4.53 1.95 5.00 61 BAYES_40 27980 4.35 2.26 4.74 62 RCVD_IN_IADB_SENDERID 26883 3.99 0.94 4.55 63 BAYES_80 26454 5.07 8.31 4.48 64 RCVD_IN_IADB_DK 26100 3.87 0.93 4.42 65 TR_XM_DK_SendGrid 25839 3.95 1.65 4.37 66 XMSubMetaSx_00 25705 4.87 7.72 4.35 67 XMSexyCombo_05 24081 5.27 11.77 4.08 68 T_REMOTE_IMAGE 23209 4.41 7.03 3.93 69 BAYES_20 22238 3.46 1.82 3.76 70 TM2_M_URI_OPT_OUT 22040 3.64 3.17 3.73 71 HTML_IMAGE_RATIO_06 21710 3.79 4.40 3.67 72 RCVD_IN_IADB_VOUCHED 21682 3.21 0.70 3.67 73 MPART_ALT_DIFF 21199 4.89 11.93 3.59 74 XM_UncommonTLD01 20237 6.40 22.53 3.43 75 TR_XM_PhishingBody 19549 4.24 9.30 3.31 76 XMNumbers 19426 3.35 3.71 3.29 77 DKIM_INVALID 19219 3.59 5.40 3.25 78 XM_B_Unsub2 18516 3.09 2.87 3.13 79 FROM_EXCESS_BASE64 16328 2.78 2.85 2.76 80 URI_NOVOWEL 16186 2.52 1.34 2.74 81 ANY_BOUNCE_MESSAGE 15978 2.39 0.69 2.70 82 BOUNCE_MESSAGE 15974 2.39 0.69 2.70 83 MAILING_LIST_MULTI 15943 2.47 1.25 2.70 84 BAYES_95 15083 2.94 5.06 2.55 85 MIME_HTML_MOSTLY 14716 3.70 10.28 2.49 86 RCVD_IN_IADB_OPTIN 14078 2.09 0.51 2.38 87 BAYES_05 13836 2.14 1.06 2.34 88 TR_XM_SB_Phish 13633 2.50 3.55 2.31 89 HTML_MIME_NO_HTML_TAG 13459 2.28 2.30 2.28 90 XMSubPhish11 13443 2.46 3.46 2.28 91 T_TooManySym_02 13071 1.95 0.54 2.21 92 HTML_IMAGE_RATIO_08 12898 2.28 2.78 2.18 93 BOTNET 12896 5.60 24.12 2.18 94 UNTRUSTED_Relay 12609 5.60 24.43 2.13 95 RCVD_IN_MSPIKE_H5 12449 1.85 0.45 2.11 96 TooManyTo_002 12156 1.91 1.13 2.06 97 XM_B_SpammyTLD 11959 2.50 5.09 2.02 98 XM_CamelCaseFrm001 11955 2.16 2.93 2.02 99 XMDiploma_00 11818 2.25 3.61 2.00 100 XM_DK_Undo_01 11105 1.84 1.62 1.88 101 XM_SPF_SoftFail 10926 2.62 6.82 1.85 102 MIME_HTML_ONLY_MULTI 10881 1.77 1.40 1.84 103 XM_B_Phish66 10844 2.59 6.66 1.84 104 TR_Symld_Words 10536 1.74 1.53 1.78 105 SUBJ_ALL_CAPS 10328 2.05 3.69 1.75 106 RELAYCOUNTRY_CA 10010 2.48 6.74 1.69 107 RCVD_IN_BL_SPAMCOP_NET 9993 2.94 9.74 1.69 108 T_XMDrugObfuBody_08 9683 2.05 4.27 1.64 109 XM_B_COVIDMETA 9481 2.19 5.35 1.60 110 TVD_RCVD_IP 9032 1.34 0.31 1.53 111 T_XMDrugObfuBody_14 8889 1.52 1.63 1.50 112 KHOP_HELO_FCRDNS 8650 2.08 5.43 1.46 113 HELO_NODOT 8357 1.36 1.07 1.41 114 HELO_NO_DOMAIN 8354 1.36 1.07 1.41 115 XM_H_Long_From02 8201 1.33 1.01 1.39 116 TooManyTo_003 8022 1.29 0.91 1.36 117 URI_HEX 7971 1.47 2.15 1.35 118 T_OBFU_PDF_ATTACH 7909 1.17 0.28 1.34 119 TM2_M_VERY_LONG_WORD 7856 1.44 2.05 1.33 120 IN_HORDE_ADDRESS_BOOK 7823 1.14 0.12 1.32 121 XMSubMetaSxObfu_03 7757 1.33 1.40 1.31 122 INVALID_MSGID 7500 1.17 0.65 1.27 123 URI_TRY_3LD 7422 1.34 1.82 1.26 124 CK_HELO_DYNAMIC_SPLIT_IP 7410 1.14 0.55 1.25 125 HELO_MISC_IP 7409 1.13 0.44 1.25 126 XMGappySubj_01 7090 1.04 0.14 1.20 127 XMStockSpam_06 7071 1.26 1.58 1.20 128 XMBrknScrpt_02 6930 2.08 7.01 1.17 129 XM_OfRef6 6860 1.66 4.36 1.16 130 DKIM_ADSP_CUSTOM_MED 6824 1.33 2.26 1.15 131 XMCapTrack 6656 1.03 0.53 1.13 132 USER_IN_DEF_DKIM_WL 6511 0.93 0.00 1.10 133 XM_SPF_Unknown 6461 1.19 1.71 1.09 134 TO_MALFORMED 6452 0.92 0.00 1.09 135 XMNoVowels 6425 1.01 0.60 1.09 136 XM_UB50 6403 2.06 7.34 1.08 137 XM_GoogleGroups 6351 0.98 0.43 1.07 138 TooManyTo_004 5832 0.96 0.82 0.99 139 XM_ProductURIs 5769 0.94 0.75 0.98 140 T_FILL_THIS_FORM_SHORT 5721 1.09 1.76 0.97 141 XM_GRM 5675 0.81 0.00 0.96 142 RELAYCOUNTRY_GB 5512 1.27 3.07 0.93 143 TR_MSPIKEBAYES00 5384 0.77 0.01 0.91 144 XMGenDplmaNmb 5263 1.07 2.03 0.89 145 T_TooManySym_03 5119 0.75 0.15 0.87 146 DKIM_ADSP_NXDOMAIN 5065 0.83 0.69 0.86 147 SpammyFromTLD_01 4872 2.17 9.47 0.82 148 TR_MetaPhish_Combo_01 4817 0.84 0.96 0.82 149 NML_ADSP_CUSTOM_MED 4816 1.03 2.18 0.82 150 HTTPS_HTTP_MISMATCH 4765 0.87 1.21 0.81 151 XMBdyGiftCard01 4741 0.80 0.79 0.80 152 RCVD_IN_MSPIKE_BL 4680 2.94 14.62 0.79 153 TooManyTo_005 4671 0.77 0.67 0.79 154 XMHTML_After_End 4638 0.88 1.39 0.78 155 T_FONT_INVIS_MSGID 4565 0.90 1.58 0.77 156 XMHTMLBadTable_001 4457 0.72 0.52 0.75 157 XMSubMetaI_00 4317 0.71 0.61 0.73 158 SPOOFED_URL 4300 0.93 2.04 0.73 159 XMBody_17 4205 1.30 4.50 0.71 160 XM_ShortIntro_01 4143 0.65 0.35 0.70 161 HTML_TAG_BALANCE_BODY 4103 0.72 0.83 0.69 162 T_XMDrugObfuBody_00 4019 0.93 2.27 0.68 163 XMBody_95 3949 0.58 0.08 0.67 164 XMMoneyMeta_00 3875 0.76 1.30 0.66 165 FORGED_GMAIL_RCVD 3783 0.83 1.87 0.64 166 XM_B_SpammyWords4 3765 0.97 2.78 0.64 167 SPOOFED_URL_HOST 3738 0.83 1.89 0.63 168 FROM_GOV_DKIM_AU 3725 0.58 0.28 0.63 169 XM_DIRTYINTL 3688 1.38 5.47 0.62 170 T_Symld_Words_02 3530 0.61 0.65 0.60 171 TR_BOTNET_NEGATE 3511 0.60 0.60 0.59 172 XMSexyCombo_01 3410 0.78 1.91 0.58 173 T_XMHurry_00 3406 0.82 2.11 0.58 174 XMSubNoVowel 3404 0.82 2.12 0.58 175 RCVD_IN_MSPIKE_L3 3335 1.61 7.29 0.56 176 HTML_FONT_FACE_BAD 3327 0.61 0.86 0.56 177 RELAYCOUNTRY_NL 3229 0.62 1.05 0.55 178 XMPhish14 3200 0.60 0.91 0.54 179 TR_XM_COVIDMETA4 3175 0.92 3.01 0.54 180 HTML_IMAGE_ONLY_20 3094 0.52 0.47 0.52 181 TR_LOTS_OF_MONEY3 3049 1.13 4.45 0.52 182 XM_H_Trusted_IP 2982 0.43 0.00 0.50 183 XM_H_PHPMailer 2954 0.54 0.76 0.50 184 NO_DNS_FOR_FROM 2943 0.58 1.03 0.50 185 RELAYCOUNTRY_AU 2923 0.60 1.16 0.49 186 T_TooManySym_04 2837 0.41 0.04 0.48 187 MPART_ALT_DIFF_COUNT 2836 0.57 1.05 0.48 188 PLING_QUERY 2829 0.46 0.38 0.48 189 XMPhish08 2784 0.56 1.04 0.47 190 XM_B_REG_HTML 2783 0.42 0.17 0.47 191 XMPhish30 2757 0.52 0.79 0.47 192 XMBody_78 2749 0.58 1.21 0.47 193 DIET_1 2630 0.49 0.76 0.45 194 RELAYCOUNTRY_DE 2618 0.80 2.72 0.44 195 RDNS_DYNAMIC 2600 0.67 1.94 0.44 196 RCVD_IN_SORBS_DUL 2575 0.42 0.36 0.44 197 NUMERIC_HTTP_ADDR 2573 0.56 1.25 0.44 198 TM2_M_A_HREF_HREF 2546 0.46 0.61 0.43 199 XM_RXBody 2526 0.44 0.53 0.43 200 MISSING_HEADERS 2509 0.48 0.79 0.42 ----------------------------------------------------------------------