Email: 650525 Autolearn: 0 AvgScore: 1.51 AvgScanTime: 1.20 sec Spam: 108946 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 1.29 sec Ham: 541579 Autolearn: 0 AvgScore: -0.89 AvgScanTime: 1.19 sec Time Spent Running SA: 217.72 hours Time Spent Processing Spam: 39.03 hours Time Spent Processing Ham: 178.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106571 98.53 97.82 98.67 2 HTML_MESSAGE 99638 88.68 91.46 88.13 3 DKIM_SIGNED 81621 77.02 74.92 77.45 4 XM_DK_Pass 78293 75.46 71.86 76.18 5 DKIM_VALID 75607 73.24 69.40 74.02 6 XM_B_Unicode 70950 70.03 65.12 71.02 7 RELAYCOUNTRY_US 69663 78.25 63.94 81.13 8 XM_B_SpammyWords 69034 53.01 63.37 50.92 9 XMListUnsubscribeExists 67843 54.34 62.27 52.75 10 DKIM_VALID_AU 56613 54.92 51.96 55.52 11 XM_DK_Undo_02 52744 17.68 48.41 11.49 12 BAYES_99 44152 13.07 40.53 7.55 13 XM_B_SpammyWords2 37276 25.21 34.22 23.40 14 LOC_TINY_FONT_1 37097 26.36 34.05 24.82 15 BAYES_50 36175 50.21 33.20 53.63 16 XM_B_Unicode3 35935 38.68 32.98 39.83 17 RELAYCOUNTRY_META 35148 10.14 32.26 5.69 18 DKIM_VALID_EF 35059 29.53 32.18 29.00 19 MIME_HTML_ONLY 35039 22.76 32.16 20.86 20 BAYES_999 34518 10.50 31.68 6.23 21 HTML_FONT_LOW_CONTRAST 30593 27.97 28.08 27.95 22 UNTRUSTED_Relay 29412 6.61 27.00 2.50 23 XMSubLong 28079 22.09 25.77 21.35 24 BOTNET 27555 6.13 25.29 2.27 25 RCVD_IN_MSPIKE_H2 27109 26.68 24.88 27.05 26 T_KAM_HTML_FONT_INVALID 25963 19.55 23.83 18.69 27 XM_UncommonTLD01 24600 6.62 22.58 3.41 28 T_TM2_M_HEADER_IN_MSG 24386 27.27 22.38 28.25 29 FVGT_m_MULTI_ODD 24090 22.58 22.11 22.67 30 XM_Multi_Part_URI 20752 13.81 19.05 12.76 31 XM_Body_Dirty_Words 19775 13.97 18.15 13.13 32 LOTS_OF_MONEY 17060 9.33 15.66 8.05 33 RCVD_IN_MSPIKE_BL 15641 3.21 14.36 0.97 34 BOTNET_IPINHOSTNAME 15472 6.84 14.20 5.35 35 XM_B_Unsub 12915 10.78 11.85 10.56 36 XM_B_Phish_Phrases 12648 7.71 11.61 6.93 37 RCVD_IN_MSPIKE_WL 12547 25.31 11.52 28.09 38 XM_B_SpammyWords3 12395 6.87 11.38 5.97 39 XMSexyCombo_05 11927 5.48 10.95 4.38 40 MPART_ALT_DIFF 11578 5.47 10.63 4.43 41 T_REMOTE_IMAGE 10728 4.70 9.85 3.67 42 RCVD_IN_BL_SPAMCOP_NET 10539 3.31 9.67 2.03 43 URIBL_SBL_A 10122 1.79 9.29 0.28 44 LotsOfNums_01 10005 9.48 9.18 9.54 45 HTML_IMAGE_RATIO_02 9833 7.44 9.03 7.12 46 MIME_HTML_MOSTLY 9645 3.82 8.85 2.81 47 SpammyFromTLD_02 9520 1.73 8.74 0.32 48 XM_Evil_Numbers_Gen 9459 8.59 8.68 8.57 49 XM_UB50 9348 2.54 8.58 1.32 50 RCVD_IN_MSPIKE_L3 9023 1.92 8.28 0.63 51 XM_SPF_SoftFail 8711 2.99 8.00 1.99 52 RCVD_IN_RP_RNBL 8616 1.37 7.91 0.05 53 SpammyFromTLD_01 8552 2.23 7.85 1.10 54 XM_UB99 8291 1.28 7.61 0.01 55 BAYES_80 8108 4.96 7.44 4.46 56 BAYES_60 7801 6.98 7.16 6.95 57 HTML_SHORT_LINK_IMG_1 7693 1.20 7.06 0.02 58 XMSubMetaSx_00 7514 4.25 6.90 3.72 59 TR_XM_PhishingBody 7431 3.91 6.82 3.32 60 XM_H_Long_From01 7146 5.40 6.56 5.17 61 TooManyTo_001 6939 7.94 6.37 8.26 62 RCVD_IN_MSPIKE_H3 6747 14.51 6.19 16.18 63 RELAYCOUNTRY_CA 6578 2.54 6.04 1.83 64 XMBrknScrpt_02 6483 2.07 5.95 1.29 65 BODY_URI_ONLY 6331 1.01 5.81 0.05 66 URI_PHP_REDIR 6311 0.98 5.79 0.01 67 SHORT_SHORTNER 6288 0.98 5.77 0.02 68 KHOP_HELO_FCRDNS 6206 2.30 5.70 1.62 69 XM_UB999 6203 0.96 5.69 0.00 70 XMNumbers 6157 3.78 5.65 3.41 71 DKIM_INVALID 6014 3.78 5.52 3.43 72 SHORTENED_URL_SRC 5938 0.92 5.45 0.01 73 SHORTENER_SHORT_IMG 5930 0.91 5.44 0.00 74 XM_B_SpammyTLD 5776 2.46 5.30 1.88 75 TR_XM_MaxBayes 5749 0.92 5.28 0.04 76 RCVD_IN_MSPIKE_L5 5662 1.05 5.20 0.22 77 XM_B_COVIDMETA 5643 2.01 5.18 1.37 78 XM_DIRTYINTL 5538 1.33 5.08 0.58 79 BAYES_95 5490 3.01 5.04 2.61 80 RCVD_IN_MSPIKE_H4 5350 8.95 4.91 9.76 81 UNPARSEABLE_RELAY 5336 6.72 4.90 7.09 82 SUBJ_ALL_CAPS 5178 2.12 4.75 1.59 83 HTML_IMAGE_RATIO_04 5108 5.84 4.69 6.07 84 XM_OfRef6 4998 1.81 4.59 1.25 85 RELAYCOUNTRY_FR 4848 1.02 4.45 0.33 86 XM_B_Phish66 4829 2.26 4.43 1.83 87 BOTNET_NORDNS 4670 0.73 4.29 0.01 88 XMBody_17 4404 1.39 4.04 0.86 89 TR_XM_MaxSPIKE 4385 0.72 4.02 0.06 90 TR_LOTS_OF_MONEY3 4370 1.18 4.01 0.62 91 T_PDS_OTHER_BAD_TLD 4352 0.92 3.99 0.30 92 HTML_MIME_NO_HTML_TAG 4316 2.59 3.96 2.31 93 RCVD_IN_PSBL 4181 0.67 3.84 0.03 94 RELAYCOUNTRY_IN 4100 0.72 3.76 0.10 95 XM_SendGrid 4018 5.95 3.69 6.40 96 HTML_IMAGE_RATIO_06 3925 3.68 3.60 3.70 97 XM_UB60 3900 0.73 3.58 0.16 98 HTML_IMAGE_ONLY_08 3861 0.69 3.54 0.12 99 T_XMDrugObfuBody_08 3794 2.02 3.48 1.72 100 TM2_M_URI_OPT_OUT 3655 2.79 3.35 2.67 101 HTML_IMAGE_RATIO_08 3548 2.46 3.26 2.29 102 FROM_SUSPICIOUS_NTLD 3546 0.60 3.25 0.07 103 FROM_SUSPICIOUS_NTLD_FP 3407 0.57 3.13 0.06 104 XM_BadFromFormat 3344 0.71 3.07 0.23 105 TR_XM_SB_Phish 3258 2.47 2.99 2.36 106 SHORT_URI_3 3248 0.54 2.98 0.05 107 SHORT_URI_2 3229 0.52 2.96 0.03 108 TR_Caps_n_Bayes_99 3183 0.58 2.92 0.11 109 XMStrtUSub 3168 4.78 2.91 5.15 110 XMSubPhish11 3130 2.43 2.87 2.34 111 XM_B_Unsub2 3128 2.76 2.87 2.73 112 RELAYCOUNTRY_DE 3097 0.90 2.84 0.51 113 HTML_IMAGE_ONLY_04 3088 0.51 2.83 0.04 114 TR_XM_UnparsRelay 3070 0.80 2.82 0.39 115 XM_URI_RBL 3041 0.66 2.79 0.23 116 XM_UB80 2910 0.49 2.67 0.05 117 HDRS_MISSP 2877 0.55 2.64 0.13 118 T_FILL_THIS_FORM_SHORT 2816 1.15 2.58 0.86 119 TR_XM_SpammyWords2 2804 0.66 2.57 0.27 120 TR_XM_PHPDW 2758 0.71 2.53 0.34 121 TR_XM_PHPForged 2749 0.70 2.52 0.33 122 XMDiploma_00 2745 2.09 2.52 2.00 123 TR_XM_FormFill2 2716 0.69 2.49 0.33 124 XM_H_PHPOS 2700 0.68 2.48 0.32 125 TR_XM_COVIDMETA1 2684 0.72 2.46 0.36 126 TR_XM_INV_DKIM 2645 0.61 2.43 0.25 127 TR_XM_COVIDMETA4 2644 0.84 2.43 0.52 128 TR_Mismatch_TLD_01 2589 0.61 2.38 0.25 129 RELAYCOUNTRY_GB 2564 1.18 2.35 0.94 130 BAYES_40 2558 4.62 2.35 5.07 131 DKIM_ADSP_NXDOMAIN 2556 1.21 2.35 0.99 132 TR_XM_SpammyWords3 2516 0.45 2.31 0.08 133 MIME_QP_LONG_LINE 2471 5.28 2.27 5.89 134 XMSexyCombo_01 2429 0.95 2.23 0.70 135 FROM_MISSP_REPLYTO 2374 0.38 2.18 0.01 136 XM_CamelCaseFrm001 2330 1.77 2.14 1.69 137 XM_B_SpammyWords4 2327 0.86 2.14 0.60 138 T_TooManySym_01 2258 4.00 2.07 4.38 139 URI_HEX 2253 1.76 2.07 1.70 140 XM_UB95 2238 0.36 2.05 0.02 141 TM2_M_VERY_LONG_WORD 2186 1.43 2.01 1.32 142 TR_Symld_Words 2182 2.08 2.00 2.10 143 T_XMHurry_00 2168 1.10 1.99 0.92 144 XMBody_78 2130 0.75 1.96 0.50 145 DATE_IN_PAST_06_12 2100 0.39 1.93 0.08 146 T_XMDrugObfuBody_14 2096 1.69 1.92 1.64 147 BAYES_20 2095 4.36 1.92 4.85 148 XMSubNoVowel 2082 0.85 1.91 0.63 149 FROM_EXCESS_BASE64 2069 2.61 1.90 2.75 150 LongTLD 1991 0.46 1.83 0.18 151 MIME_CHARSET_FARAWAY 1982 0.41 1.82 0.12 152 URI_TRY_3LD 1971 1.46 1.81 1.39 153 DKIM_ADSP_CUSTOM_MED 1913 1.21 1.76 1.10 154 CHARSET_FARAWAY_HEADER 1895 0.33 1.74 0.05 155 TR_XM_FormFill 1879 0.32 1.72 0.04 156 ALL_TRUSTED 1842 12.31 1.69 14.44 157 T_FONT_INVIS_MSGID 1839 0.83 1.69 0.66 158 TR_XM_DK_SendGrid 1832 3.41 1.68 3.76 159 MIME_HEADER_CTYPE_ONLY 1820 0.34 1.67 0.07 160 T_XMDrugObfuBody_00 1818 0.89 1.67 0.74 161 NML_ADSP_CUSTOM_MED 1817 0.94 1.67 0.79 162 RDNS_DYNAMIC 1813 0.69 1.66 0.49 163 TR_XM_RelayPhish 1773 0.39 1.63 0.14 164 XM_OfRef7 1727 0.35 1.59 0.11 165 RELAYCOUNTRY_CN 1713 0.31 1.57 0.06 166 XMStockSpam_06 1711 1.48 1.57 1.46 167 SPOOFED_URL 1697 0.80 1.56 0.65 168 MIME_HTML_ONLY_MULTI 1687 2.11 1.55 2.23 169 HDRS_LCASE_IMGONLY 1678 0.27 1.54 0.01 170 XM_PDF 1675 3.89 1.54 4.36 171 XMGenDplmaNmb 1668 1.08 1.53 0.99 172 DATE_IN_PAST_03_06 1615 0.33 1.48 0.10 173 FORGED_GMAIL_RCVD 1602 0.69 1.47 0.53 174 NUMERIC_HTTP_ADDR 1595 0.65 1.46 0.48 175 XM_SPF_Unknown 1588 0.85 1.46 0.73 176 MAILING_LIST_MULTI 1546 2.17 1.42 2.33 177 XMMoneyMeta_00 1534 0.78 1.41 0.66 178 MIMEOLE_DIRECT_TO_MX 1495 0.23 1.37 0.00 179 RCVD_IN_IADB_LISTED 1477 4.61 1.36 5.27 180 XMSubMetaSxObfu_03 1456 0.67 1.34 0.54 181 TR_Mismatch_TLD_02 1445 0.29 1.33 0.08 182 XMHTML_After_End 1434 0.99 1.32 0.92 183 SPOOFED_URL_HOST 1433 0.70 1.32 0.58 184 URI_NOVOWEL 1379 2.36 1.27 2.58 185 XM_H_Undi_Recip 1377 0.39 1.26 0.22 186 RELAYCOUNTRY_SG 1363 0.27 1.25 0.08 187 HTML_IMAGE_ONLY_12 1363 0.39 1.25 0.21 188 RELAYCOUNTRY_RU 1320 0.23 1.21 0.03 189 BAYES_00 1306 10.43 1.20 12.29 190 XMSexyCombo_04 1288 0.45 1.18 0.30 191 TR_MetaPhish_Combo_01 1246 0.88 1.14 0.83 192 FILL_THIS_FORM 1229 0.34 1.13 0.19 193 RCVD_IN_IADB_SPF 1229 4.02 1.13 4.60 194 DOS_OE_TO_MX 1219 0.19 1.12 0.00 195 LH_URI_DOM_IN_PATH 1216 0.52 1.12 0.40 196 MONEY_FORM_SHORT 1203 0.19 1.10 0.00 197 HTTPS_HTTP_MISMATCH 1191 0.87 1.09 0.83 198 XM_DK_Undo_01 1184 1.79 1.09 1.93 199 XMPhish08 1182 0.69 1.08 0.61 200 FROM_MISSPACED 1182 0.20 1.08 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 534382 98.53 97.82 98.67 2 HTML_MESSAGE 477277 88.68 91.46 88.13 3 RELAYCOUNTRY_US 439396 78.25 63.94 81.13 4 DKIM_SIGNED 419443 77.02 74.92 77.45 5 XM_DK_Pass 412585 75.46 71.86 76.18 6 DKIM_VALID 400856 73.24 69.40 74.02 7 XM_B_Unicode 384629 70.03 65.12 71.02 8 DKIM_VALID_AU 300687 54.92 51.96 55.52 9 BAYES_50 290457 50.21 33.20 53.63 10 XMListUnsubscribeExists 285683 54.34 62.27 52.75 11 XM_B_SpammyWords 275791 53.01 63.37 50.92 12 XM_B_Unicode3 215707 38.68 32.98 39.83 13 DKIM_VALID_EF 157043 29.53 32.18 29.00 14 T_TM2_M_HEADER_IN_MSG 153004 27.27 22.38 28.25 15 RCVD_IN_MSPIKE_WL 152121 25.31 11.52 28.09 16 HTML_FONT_LOW_CONTRAST 151347 27.97 28.08 27.95 17 RCVD_IN_MSPIKE_H2 146477 26.68 24.88 27.05 18 LOC_TINY_FONT_1 134411 26.36 34.05 24.82 19 XM_B_SpammyWords2 126743 25.21 34.22 23.40 20 FVGT_m_MULTI_ODD 122786 22.58 22.11 22.67 21 XMSubLong 115610 22.09 25.77 21.35 22 MIME_HTML_ONLY 113000 22.76 32.16 20.86 23 T_KAM_HTML_FONT_INVALID 101241 19.55 23.83 18.69 24 RCVD_IN_MSPIKE_H3 87622 14.51 6.19 16.18 25 ALL_TRUSTED 78219 12.31 1.69 14.44 26 XM_Body_Dirty_Words 71127 13.97 18.15 13.13 27 XM_Multi_Part_URI 69097 13.81 19.05 12.76 28 BAYES_00 66556 10.43 1.20 12.29 29 XM_DK_Undo_02 62250 17.68 48.41 11.49 30 XM_B_Unsub 57180 10.78 11.85 10.56 31 RCVD_IN_MSPIKE_H4 52875 8.95 4.91 9.76 32 LotsOfNums_01 51678 9.48 9.18 9.54 33 TR_XM_DK_Bayes 48490 7.50 0.30 8.95 34 TR_XM_DK_Bayes1 46909 7.26 0.29 8.66 35 XM_Evil_Numbers_Gen 46414 8.59 8.68 8.57 36 TooManyTo_001 44733 7.94 6.37 8.26 37 LOTS_OF_MONEY 43609 9.33 15.66 8.05 38 TR_XM_DK_Bayes2 41748 6.46 0.27 7.71 39 BAYES_99 40894 13.07 40.53 7.55 40 RCVD_IN_RP_SAFE 40784 6.39 0.75 7.53 41 HTML_IMAGE_RATIO_02 38547 7.44 9.03 7.12 42 UNPARSEABLE_RELAY 38371 6.72 4.90 7.09 43 BAYES_60 37636 6.98 7.16 6.95 44 XM_B_Phish_Phrases 37530 7.71 11.61 6.93 45 RCVD_IN_RP_CERTIFIED 36907 5.74 0.41 6.81 46 XM_DKIMWhitelistDomains 36318 5.58 0.01 6.71 47 IN_ZIMBRA_NJ_WHITELIST 35304 5.44 0.06 6.52 48 XM_SendGrid 34659 5.95 3.69 6.40 49 BAYES_999 33755 10.50 31.68 6.23 50 HTML_IMAGE_RATIO_04 32897 5.84 4.69 6.07 51 XM_B_SpammyWords3 32325 6.87 11.38 5.97 52 MIME_QP_LONG_LINE 31905 5.28 2.27 5.89 53 RELAYCOUNTRY_META 30796 10.14 32.26 5.69 54 BOTNET_IPINHOSTNAME 28992 6.84 14.20 5.35 55 RCVD_IN_IADB_LISTED 28541 4.61 1.36 5.27 56 XM_H_Long_From01 27999 5.40 6.56 5.17 57 XMStrtUSub 27901 4.78 2.91 5.15 58 BAYES_40 27466 4.62 2.35 5.07 59 BAYES_20 26262 4.36 1.92 4.85 60 RCVD_IN_IADB_SPF 24918 4.02 1.13 4.60 61 ANY_BOUNCE_MESSAGE 24673 3.91 0.69 4.56 62 BOUNCE_MESSAGE 24672 3.91 0.69 4.56 63 BAYES_80 24173 4.96 7.44 4.46 64 MPART_ALT_DIFF 23981 5.47 10.63 4.43 65 T_TooManySym_01 23748 4.00 2.07 4.38 66 XMSexyCombo_05 23734 5.48 10.95 4.38 67 XM_PDF 23602 3.89 1.54 4.36 68 RCVD_IN_IADB_SENDERID 22354 3.61 1.05 4.13 69 RCVD_IN_IADB_DK 21641 3.50 1.04 4.00 70 TR_XM_DK_SendGrid 20365 3.41 1.68 3.76 71 XMSubMetaSx_00 20140 4.25 6.90 3.72 72 HTML_IMAGE_RATIO_06 20046 3.68 3.60 3.70 73 T_REMOTE_IMAGE 19869 4.70 9.85 3.67 74 DKIM_INVALID 18587 3.78 5.52 3.43 75 XM_UncommonTLD01 18478 6.62 22.58 3.41 76 XMNumbers 18453 3.78 5.65 3.41 77 TR_XM_PhishingBody 18003 3.91 6.82 3.32 78 RCVD_IN_IADB_VOUCHED 17621 2.82 0.67 3.25 79 MIME_HTML_MOSTLY 15216 3.82 8.85 2.81 80 FROM_EXCESS_BASE64 14911 2.61 1.90 2.75 81 XM_B_Unsub2 14804 2.76 2.87 2.73 82 TM2_M_URI_OPT_OUT 14475 2.79 3.35 2.67 83 BAYES_95 14116 3.01 5.04 2.61 84 URI_NOVOWEL 13983 2.36 1.27 2.58 85 BAYES_05 13978 2.32 1.01 2.58 86 UNTRUSTED_Relay 13557 6.61 27.00 2.50 87 TR_XM_SB_Phish 12806 2.47 2.99 2.36 88 XMSubPhish11 12661 2.43 2.87 2.34 89 MAILING_LIST_MULTI 12600 2.17 1.42 2.33 90 HTML_MIME_NO_HTML_TAG 12520 2.59 3.96 2.31 91 HTML_IMAGE_RATIO_08 12428 2.46 3.26 2.29 92 BOTNET 12313 6.13 25.29 2.27 93 MIME_HTML_ONLY_MULTI 12068 2.11 1.55 2.23 94 RCVD_IN_MSPIKE_H5 11624 1.86 0.41 2.15 95 RCVD_IN_IADB_OPTIN 11619 1.87 0.48 2.15 96 T_TooManySym_02 11527 1.88 0.66 2.13 97 TR_Symld_Words 11362 2.08 2.00 2.10 98 RCVD_IN_BL_SPAMCOP_NET 10977 3.31 9.67 2.03 99 XMDiploma_00 10855 2.09 2.52 2.00 100 XM_SPF_SoftFail 10762 2.99 8.00 1.99 101 TooManyTo_002 10695 1.80 0.92 1.97 102 XM_DK_Undo_01 10477 1.79 1.09 1.93 103 XM_B_SpammyTLD 10198 2.46 5.30 1.88 104 RELAYCOUNTRY_CA 9931 2.54 6.04 1.83 105 XM_B_Phish66 9893 2.26 4.43 1.83 106 T_XMDrugObfuBody_08 9330 2.02 3.48 1.72 107 URI_HEX 9211 1.76 2.07 1.70 108 XM_CamelCaseFrm001 9175 1.77 2.14 1.69 109 HELO_NODOT 9087 1.56 0.98 1.68 110 HELO_NO_DOMAIN 9085 1.56 0.97 1.68 111 TVD_RCVD_IP 9073 1.47 0.46 1.68 112 T_XMDrugObfuBody_14 8889 1.69 1.92 1.64 113 KHOP_HELO_FCRDNS 8760 2.30 5.70 1.62 114 HTML_FONT_FACE_BAD 8745 1.44 0.57 1.61 115 SUBJ_ALL_CAPS 8605 2.12 4.75 1.59 116 XMStockSpam_06 7910 1.48 1.57 1.46 117 URI_TRY_3LD 7547 1.46 1.81 1.39 118 IN_HORDE_ADDRESS_BOOK 7484 1.18 0.15 1.38 119 XM_B_COVIDMETA 7415 2.01 5.18 1.37 120 INVALID_MSGID 7375 1.20 0.41 1.36 121 HELO_MISC_IP 7222 1.18 0.45 1.33 122 CK_HELO_DYNAMIC_SPLIT_IP 7221 1.22 0.63 1.33 123 XM_UB50 7168 2.54 8.58 1.32 124 TM2_M_VERY_LONG_WORD 7136 1.43 2.01 1.32 125 TooManyTo_003 7035 1.20 0.71 1.30 126 XMBrknScrpt_02 7008 2.07 5.95 1.29 127 XMGappySubj_01 6879 1.11 0.31 1.27 128 XM_OfRef6 6748 1.81 4.59 1.25 129 XMCapTrack 6472 1.09 0.54 1.20 130 TO_MALFORMED 6334 0.98 0.02 1.17 131 XM_GoogleGroups 6170 1.03 0.47 1.14 132 DKIM_ADSP_CUSTOM_MED 5967 1.21 1.76 1.10 133 SpammyFromTLD_01 5960 2.23 7.85 1.10 134 XM_H_Long_From02 5729 0.97 0.54 1.06 135 XMGenDplmaNmb 5370 1.08 1.53 0.99 136 DKIM_ADSP_NXDOMAIN 5347 1.21 2.35 0.99 137 RCVD_IN_MSPIKE_BL 5249 3.21 14.36 0.97 138 RELAYCOUNTRY_GB 5096 1.18 2.35 0.94 139 USER_IN_DEF_DKIM_WL 5060 0.78 0.01 0.93 140 TooManyTo_004 5047 0.88 0.64 0.93 141 XMHTML_After_End 5001 0.99 1.32 0.92 142 T_XMHurry_00 4971 1.10 1.99 0.92 143 TR_MSPIKEBAYES00 4917 0.76 0.00 0.91 144 XMBdyGiftCard01 4817 0.85 0.64 0.89 145 T_TooManySym_03 4708 0.75 0.15 0.87 146 XMBody_17 4663 1.39 4.04 0.86 147 T_FILL_THIS_FORM_SHORT 4662 1.15 2.58 0.86 148 TR_MetaPhish_Combo_01 4496 0.88 1.14 0.83 149 XM_ProductURIs 4482 0.80 0.64 0.83 150 HTTPS_HTTP_MISMATCH 4478 0.87 1.09 0.83 151 NML_ADSP_CUSTOM_MED 4271 0.94 1.67 0.79 152 PLING_QUERY 4254 0.74 0.51 0.79 153 TooManyTo_005 4141 0.72 0.52 0.76 154 T_XMDrugObfuBody_00 3990 0.89 1.67 0.74 155 XM_SPF_Unknown 3955 0.85 1.46 0.73 156 T_OBFU_PDF_ATTACH 3954 0.66 0.32 0.73 157 T_Symld_Words_02 3850 0.74 0.91 0.71 158 XM_ShortIntro_01 3830 0.69 0.58 0.71 159 XMSexyCombo_01 3781 0.95 2.23 0.70 160 T_FONT_INVIS_MSGID 3576 0.83 1.69 0.66 161 XMMoneyMeta_00 3566 0.78 1.41 0.66 162 XMBody_95 3526 0.57 0.15 0.65 163 SPOOFED_URL 3525 0.80 1.56 0.65 164 TR_BOTNET_NEGATE 3451 0.61 0.47 0.64 165 RCVD_IN_MSPIKE_L3 3435 1.92 8.28 0.63 166 XMSubNoVowel 3426 0.85 1.91 0.63 167 TR_LOTS_OF_MONEY3 3337 1.18 4.01 0.62 168 XMPhish08 3318 0.69 1.08 0.61 169 XMNoVowels 3308 0.61 0.59 0.61 170 XMHTMLBadTable_001 3294 0.57 0.35 0.61 171 XM_H_Trusted_IP 3266 0.50 0.00 0.60 172 XM_B_SpammyWords4 3249 0.86 2.14 0.60 173 XM_DIRTYINTL 3135 1.33 5.08 0.58 174 SPOOFED_URL_HOST 3120 0.70 1.32 0.58 175 XMSubMetaI_00 3108 0.64 0.95 0.57 176 FROM_GOV_DKIM_AU 2964 0.47 0.09 0.55 177 XMSubMetaSxObfu_03 2927 0.67 1.34 0.54 178 HTML_TAG_BALANCE_BODY 2924 0.58 0.79 0.54 179 FORGED_GMAIL_RCVD 2880 0.69 1.47 0.53 180 RCVD_IN_SORBS_DUL 2814 0.47 0.22 0.52 181 TR_XM_COVIDMETA4 2798 0.84 2.43 0.52 182 XM_B_REG_HTML 2795 0.44 0.09 0.52 183 RELAYCOUNTRY_DE 2783 0.90 2.84 0.51 184 XMBody_78 2728 0.75 1.96 0.50 185 MPART_ALT_DIFF_COUNT 2679 0.55 0.82 0.49 186 HTML_IMAGE_ONLY_20 2665 0.48 0.43 0.49 187 RDNS_DYNAMIC 2660 0.69 1.66 0.49 188 NUMERIC_HTTP_ADDR 2625 0.65 1.46 0.48 189 HTML_IMAGE_ONLY_28 2602 0.44 0.26 0.48 190 NO_DNS_FOR_FROM 2581 0.55 0.91 0.48 191 T_TooManySym_04 2555 0.40 0.06 0.47 192 XM_H_PHPMailer 2545 0.53 0.80 0.47 193 XMPhish30 2464 0.52 0.84 0.45 194 TM2_M_BODY_EMPTY 2419 0.39 0.09 0.45 195 DIET_1 2414 0.51 0.84 0.45 196 SUBJ_DOLLARS 2400 0.50 0.80 0.44 197 XM_B_COPY_HTML 2380 0.51 0.83 0.44 198 FROM_GOV_SPOOF 2356 0.39 0.15 0.44 199 HTML_IMAGE_ONLY_32 2354 0.49 0.77 0.43 200 SHORT_HELO_AND_INLINE_IMAGE 2345 0.38 0.11 0.43 ----------------------------------------------------------------------