Email: 682177 Autolearn: 0 AvgScore: 1.82 AvgScanTime: 1.23 sec Spam: 124666 Autolearn: 0 AvgScore: 13.01 AvgScanTime: 1.44 sec Ham: 557511 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 1.19 sec Time Spent Running SA: 233.54 hours Time Spent Processing Spam: 49.75 hours Time Spent Processing Ham: 183.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 121214 98.01 97.23 98.19 2 HTML_MESSAGE 112717 89.94 90.42 89.84 3 RELAYCOUNTRY_US 88474 78.62 70.97 80.33 4 DKIM_SIGNED 84874 75.13 68.08 76.71 5 XM_B_Unicode 82830 69.14 66.44 69.74 6 XM_DK_Pass 81665 73.59 65.51 75.40 7 XM_B_SpammyWords 80583 54.47 64.64 52.19 8 DKIM_VALID 79372 71.42 63.67 73.16 9 XMListUnsubscribeExists 68647 52.96 55.06 52.49 10 DKIM_VALID_AU 56925 53.17 45.66 54.85 11 XM_DK_Undo_02 53354 16.54 42.80 10.67 12 XM_B_SpammyWords2 46752 26.84 37.50 24.45 13 BAYES_99 46720 12.23 37.48 6.58 14 BAYES_50 45318 52.13 36.35 55.66 15 MIME_HTML_ONLY 41629 22.64 33.39 20.24 16 XM_B_Unicode3 39744 37.87 31.88 39.21 17 BOTNET 39282 7.90 31.51 2.62 18 BAYES_999 36563 9.65 29.33 5.25 19 RCVD_IN_MSPIKE_H2 35445 26.66 28.43 26.27 20 LOC_TINY_FONT_1 33997 25.22 27.27 24.77 21 HTML_FONT_LOW_CONTRAST 31399 26.84 25.19 27.21 22 FVGT_m_MULTI_ODD 31018 22.67 24.88 22.17 23 DKIM_VALID_EF 30480 27.79 24.45 28.54 24 RELAYCOUNTRY_META 29541 9.08 23.70 5.82 25 T_TM2_M_HEADER_IN_MSG 28498 29.13 22.86 30.53 26 XMSubLong 27128 21.50 21.76 21.45 27 UNTRUSTED_Relay 26203 5.94 21.02 2.57 28 XM_Multi_Part_URI 23911 13.62 19.18 12.38 29 T_KAM_HTML_FONT_INVALID 22243 18.38 17.84 18.50 30 RCVD_IN_MSPIKE_BL 20708 3.87 16.61 1.02 31 XM_Body_Dirty_Words 20479 13.45 16.43 12.79 32 TR_XM_SpammyWords2 18158 3.98 14.57 1.61 33 T_REMOTE_IMAGE 18109 5.52 14.53 3.50 34 XM_B_Phish_Phrases 17825 8.01 14.30 6.60 35 XM_UncommonTLD01 17743 5.32 14.23 3.33 36 LOTS_OF_MONEY 17553 10.20 14.08 9.34 37 XM_B_Unsub 17062 11.15 13.69 10.58 38 BOTNET_IPINHOSTNAME 16963 6.84 13.61 5.32 39 XM_B_SpammyWords3 15776 7.24 12.65 6.03 40 RCVD_IN_MSPIKE_WL 13997 25.13 11.23 28.24 41 LotsOfNums_01 12977 9.40 10.41 9.18 42 RCVD_IN_RP_RNBL 12904 1.95 10.35 0.07 43 HTML_IMAGE_RATIO_02 12863 7.58 10.32 6.97 44 TR_XM_SpammyWords3 12359 2.21 9.91 0.49 45 RCVD_IN_MSPIKE_L5 12091 1.94 9.70 0.20 46 XMSexyCombo_05 11754 5.38 9.43 4.48 47 XM_UB50 10834 2.74 8.69 1.41 48 HTML_MIME_NO_HTML_TAG 10127 3.18 8.12 2.08 49 XM_Evil_Numbers_Gen 10109 8.25 8.11 8.28 50 MIME_HTML_MOSTLY 9973 3.82 8.00 2.89 51 BAYES_80 9816 5.18 7.87 4.58 52 BODY_URI_ONLY 9768 1.47 7.84 0.04 53 FROM_EXCESS_BASE64 9612 3.37 7.71 2.40 54 MPART_ALT_DIFF 9470 5.13 7.60 4.58 55 ANY_BOUNCE_MESSAGE 9458 4.36 7.59 3.63 56 BOUNCE_MESSAGE 9458 4.36 7.59 3.63 57 RCVD_IN_BL_SPAMCOP_NET 9450 2.80 7.58 1.73 58 XMSubMetaSx_00 9051 4.59 7.26 3.99 59 BOTNET_NORDNS 8851 1.51 7.10 0.27 60 XMNumbers 8636 4.17 6.93 3.56 61 BAYES_60 8132 6.92 6.52 7.01 62 SpammyFromTLD_02 7750 1.42 6.22 0.35 63 XM_B_COVIDMETA 7598 2.18 6.09 1.31 64 KHOP_HELO_FCRDNS 7459 2.32 5.98 1.51 65 RCVD_IN_PSBL 7309 1.09 5.86 0.03 66 TM2_M_URI_OPT_OUT 7289 3.72 5.85 3.25 67 XM_B_SpammyTLD 7208 2.58 5.78 1.86 68 RCVD_IN_MSPIKE_L3 7205 1.63 5.78 0.70 69 RCVD_IN_MSPIKE_H3 7204 13.89 5.78 15.71 70 TR_XM_COVIDMETA4 7186 1.48 5.76 0.52 71 SHORTENED_URL_HREF 7048 1.31 5.65 0.34 72 HTML_SHORT_LINK_IMG_1 6944 1.06 5.57 0.05 73 XM_SPF_SoftFail 6905 2.45 5.54 1.76 74 HTML_IMAGE_ONLY_08 6904 1.11 5.54 0.12 75 RELAYCOUNTRY_CA 6878 2.47 5.52 1.79 76 SHORT_URI_3 6579 1.00 5.28 0.04 77 SHORTENER_SHORT_IMG 6532 0.96 5.24 0.00 78 RCVD_IN_MSPIKE_H4 6517 9.37 5.23 10.30 79 SHORTENED_URL_SRC 6516 0.96 5.23 0.00 80 TooManyTo_001 6506 7.41 5.22 7.90 81 TR_XM_PhishingBody 6121 3.40 4.91 3.06 82 XM_H_Long_From01 6087 5.40 4.88 5.51 83 XMBrknScrpt_02 5992 2.17 4.81 1.59 84 URIBL_SBL_A 5948 1.06 4.77 0.24 85 XM_B_Unsub2 5896 3.00 4.73 2.61 86 SpammyFromTLD_01 5536 1.66 4.44 1.03 87 DKIM_INVALID 5502 3.71 4.41 3.55 88 BAYES_95 5406 3.08 4.34 2.80 89 XM_Lotto 5389 0.89 4.32 0.12 90 UNPARSEABLE_RELAY 5347 6.81 4.29 7.37 91 XM_OfRef6 5271 1.74 4.23 1.18 92 HTML_SHORT_LINK_IMG_3 4849 0.77 3.89 0.08 93 RELAYCOUNTRY_FR 4815 1.07 3.86 0.45 94 T_FONT_INVIS_NAKED_TO 4812 2.41 3.86 2.09 95 SHORT_SHORTNER 4746 0.71 3.81 0.01 96 HTML_IMAGE_ONLY_20 4644 1.08 3.73 0.49 97 T_XMDrugObfuBody_08 4596 2.19 3.69 1.85 98 XM_UB99 4427 0.66 3.55 0.01 99 XMStrtUSub 4419 4.56 3.54 4.78 100 TR_XM_MaxBayes 4279 0.66 3.43 0.03 101 HTML_IMAGE_RATIO_04 4242 5.35 3.40 5.79 102 XM_SendGrid 4195 6.11 3.36 6.72 103 XM_DIRTYINTL 4087 1.04 3.28 0.54 104 HTML_IMAGE_RATIO_06 4033 3.60 3.24 3.68 105 FROM_SUSPICIOUS_NTLD 4006 0.64 3.21 0.07 106 FROM_SUSPICIOUS_NTLD_FP 3931 0.62 3.15 0.06 107 DATE_IN_PAST_96_XX 3900 0.59 3.13 0.03 108 BAYES_40 3895 4.56 3.12 4.88 109 HTML_IMAGE_RATIO_08 3829 2.48 3.07 2.35 110 DKIM_ADSP_NXDOMAIN 3828 1.14 3.07 0.71 111 XM_B_Phish66 3776 2.02 3.03 1.79 112 T_HTML_TAG_BALANCE_CENTER 3625 0.69 2.91 0.19 113 XMDiploma_00 3589 1.94 2.88 1.73 114 XM_URI_RBL 3520 0.70 2.82 0.22 115 TR_XM_MaxSPIKE 3498 0.53 2.81 0.02 116 HDRS_MISSP 3484 0.57 2.79 0.07 117 URI_OPTOUT_3LD 3463 0.57 2.78 0.08 118 URI_TRY_3LD 3440 1.67 2.76 1.42 119 XM_UB60 3258 0.63 2.61 0.19 120 XM_B_SpammyWords4 3172 0.94 2.54 0.58 121 RELAYCOUNTRY_IN 3169 0.56 2.54 0.11 122 XM_UB80 3155 0.51 2.53 0.06 123 TO_IN_SUBJ 3147 0.51 2.52 0.06 124 XM_UB999 3143 0.47 2.52 0.01 125 TR_XM_UnparsRelay 3052 0.78 2.45 0.40 126 NUMERIC_HTTP_ADDR 3002 0.89 2.41 0.55 127 XMBody_17 2961 1.18 2.38 0.92 128 TM2_M_VERY_LONG_WORD 2923 1.39 2.34 1.17 129 URI_PHP_REDIR 2915 0.43 2.34 0.01 130 NORMAL_HTTP_TO_IP 2778 0.45 2.23 0.06 131 MIME_CHARSET_FARAWAY 2738 0.50 2.20 0.12 132 URI_HEX 2734 1.76 2.19 1.66 133 TR_XM_SB_Phish 2724 2.62 2.19 2.72 134 XMLngstWrd_00 2723 0.74 2.18 0.41 135 TR_XM_PHPForged 2721 0.66 2.18 0.32 136 TR_XM_PHPDW 2706 0.67 2.17 0.33 137 XM_CamelCaseFrm001 2704 1.90 2.17 1.84 138 T_TooManySym_01 2702 3.94 2.17 4.34 139 TR_XM_FormFill2 2665 0.65 2.14 0.32 140 XM_H_PHPOS 2655 0.64 2.13 0.31 141 XMSubPhish11 2651 2.57 2.13 2.68 142 BAYES_20 2630 3.43 2.11 3.73 143 XM_OfRef7 2614 0.52 2.10 0.17 144 MIME_QP_LONG_LINE 2587 5.07 2.08 5.74 145 XM_SPF_Unknown 2511 0.97 2.01 0.73 146 CHARSET_FARAWAY_HEADER 2474 0.41 1.98 0.06 147 LH_URI_DOM_IN_PATH 2470 2.12 1.98 2.15 148 MIMEOLE_DIRECT_TO_MX 2428 0.36 1.95 0.00 149 XMSubNoVowel 2413 0.84 1.94 0.59 150 XMSexyCombo_01 2290 0.99 1.84 0.80 151 TR_LOTS_OF_MONEY3 2280 0.77 1.83 0.54 152 T_FILL_THIS_FORM_SHORT 2258 1.09 1.81 0.92 153 T_XMDrugObfuBody_00 2213 0.93 1.78 0.74 154 DATE_IN_PAST_03_06 2202 0.41 1.77 0.10 155 DOS_OE_TO_MX 2161 0.32 1.73 0.00 156 T_XMDrugObfuBody_14 2154 1.68 1.73 1.66 157 ALL_TRUSTED 2136 12.69 1.71 15.15 158 SUBJ_ALL_CAPS 2113 1.70 1.69 1.71 159 TR_XM_DK_SendGrid 2043 3.64 1.64 4.09 160 XMLngstWrd_01 2042 0.60 1.64 0.37 161 HK_RANDOM_FROM 2009 0.41 1.61 0.14 162 RELAYCOUNTRY_GB 1956 1.11 1.57 1.01 163 TVD_SPACE_RATIO_MINFP 1937 0.29 1.55 0.01 164 TR_XM_COVIDMETA1 1934 0.54 1.55 0.32 165 DIET_1 1921 0.61 1.54 0.40 166 TR_XM_RelayPhish 1889 0.37 1.52 0.12 167 T_PDS_OTHER_BAD_TLD 1872 0.52 1.50 0.30 168 TR_XM_INV_DKIM 1863 0.43 1.49 0.19 169 TR_Symld_Words 1849 1.84 1.48 1.92 170 URI_NOVOWEL 1800 2.31 1.44 2.50 171 T_XMHurry_00 1769 0.77 1.42 0.63 172 RDNS_DYNAMIC 1768 0.65 1.42 0.47 173 XMGppyBdWords 1747 0.53 1.40 0.34 174 XMHTML_After_End 1741 0.98 1.40 0.88 175 XM_UB95 1694 0.27 1.36 0.03 176 FILL_THIS_FORM 1655 0.40 1.33 0.19 177 T_FILL_THIS_FORM_LONG 1583 0.33 1.27 0.12 178 XMGenDplmaNmb 1578 1.02 1.27 0.96 179 SUBJ_BUY 1573 0.29 1.26 0.07 180 MIME_HTML_ONLY_MULTI 1563 2.10 1.25 2.29 181 HTTPS_HTTP_MISMATCH 1555 0.90 1.25 0.82 182 DKIM_ADSP_CUSTOM_MED 1555 1.05 1.25 1.00 183 XMStockSpam_06 1542 3.30 1.24 3.76 184 HELO_NODOT 1510 1.48 1.21 1.54 185 TR_XM_FormFill 1490 0.27 1.20 0.06 186 HELO_NO_DOMAIN 1478 1.47 1.19 1.54 187 NO_FM_NAME_IP_HOSTN 1463 0.22 1.17 0.00 188 XM_PDF 1457 3.44 1.17 3.94 189 XM_XX_Yahoo 1448 0.29 1.16 0.10 190 MAILING_LIST_MULTI 1441 2.22 1.16 2.45 191 NML_ADSP_CUSTOM_MED 1433 0.77 1.15 0.69 192 BAYES_00 1428 10.44 1.15 12.51 193 RCVD_IN_IADB_LISTED 1415 4.56 1.14 5.33 194 RELAYCOUNTRY_NL 1377 0.43 1.10 0.28 195 XM_DK_Undo_01 1364 1.90 1.09 2.08 196 DATE_IN_PAST_06_12 1360 0.44 1.09 0.29 197 XMSubMetaSxObfu_02 1345 0.64 1.08 0.55 198 XMLngstWrd_02 1338 0.44 1.07 0.30 199 TR_Mismatch_TLD_02 1335 0.30 1.07 0.12 200 ADVANCE_FEE_2_NEW_FORM 1334 0.20 1.07 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 547405 98.01 97.23 98.19 2 HTML_MESSAGE 500854 89.94 90.42 89.84 3 RELAYCOUNTRY_US 447864 78.62 70.97 80.33 4 DKIM_SIGNED 427643 75.13 68.08 76.71 5 XM_DK_Pass 420379 73.59 65.51 75.40 6 DKIM_VALID 407862 71.42 63.67 73.16 7 XM_B_Unicode 388816 69.14 66.44 69.74 8 BAYES_50 310329 52.13 36.35 55.66 9 DKIM_VALID_AU 305780 53.17 45.66 54.85 10 XMListUnsubscribeExists 292615 52.96 55.06 52.49 11 XM_B_SpammyWords 290980 54.47 64.64 52.19 12 XM_B_Unicode3 218620 37.87 31.88 39.21 13 T_TM2_M_HEADER_IN_MSG 170234 29.13 22.86 30.53 14 DKIM_VALID_EF 159121 27.79 24.45 28.54 15 RCVD_IN_MSPIKE_WL 157460 25.13 11.23 28.24 16 HTML_FONT_LOW_CONTRAST 151722 26.84 25.19 27.21 17 RCVD_IN_MSPIKE_H2 146445 26.66 28.43 26.27 18 LOC_TINY_FONT_1 138080 25.22 27.27 24.77 19 XM_B_SpammyWords2 136320 26.84 37.50 24.45 20 FVGT_m_MULTI_ODD 123627 22.67 24.88 22.17 21 XMSubLong 119570 21.50 21.76 21.45 22 MIME_HTML_ONLY 112837 22.64 33.39 20.24 23 T_KAM_HTML_FONT_INVALID 103143 18.38 17.84 18.50 24 RCVD_IN_MSPIKE_H3 87563 13.89 5.78 15.71 25 ALL_TRUSTED 84462 12.69 1.71 15.15 26 XM_Body_Dirty_Words 71282 13.45 16.43 12.79 27 BAYES_00 69766 10.44 1.15 12.51 28 XM_Multi_Part_URI 69014 13.62 19.18 12.38 29 XM_DK_Undo_02 59488 16.54 42.80 10.67 30 XM_B_Unsub 58984 11.15 13.69 10.58 31 RCVD_IN_MSPIKE_H4 57405 9.37 5.23 10.30 32 TR_XM_DK_Bayes 52693 7.79 0.37 9.45 33 LOTS_OF_MONEY 52053 10.20 14.08 9.34 34 LotsOfNums_01 51169 9.40 10.41 9.18 35 TR_XM_DK_Bayes1 51116 7.56 0.36 9.17 36 XM_Evil_Numbers_Gen 46166 8.25 8.11 8.28 37 TR_XM_DK_Bayes2 45261 6.69 0.31 8.12 38 TooManyTo_001 44064 7.41 5.22 7.90 39 UNPARSEABLE_RELAY 41087 6.81 4.29 7.37 40 BAYES_60 39084 6.92 6.52 7.01 41 RCVD_IN_RP_SAFE 39037 5.86 0.76 7.00 42 HTML_IMAGE_RATIO_02 38871 7.58 10.32 6.97 43 XM_SendGrid 37488 6.11 3.36 6.72 44 XM_B_Phish_Phrases 36810 8.01 14.30 6.60 45 BAYES_99 36702 12.23 37.48 6.58 46 RCVD_IN_RP_CERTIFIED 36301 5.41 0.47 6.51 47 XM_DKIMWhitelistDomains 35651 5.23 0.00 6.39 48 IN_ZIMBRA_NJ_WHITELIST 34568 5.08 0.05 6.20 49 XM_B_SpammyWords3 33602 7.24 12.65 6.03 50 RELAYCOUNTRY_META 32434 9.08 23.70 5.82 51 HTML_IMAGE_RATIO_04 32264 5.35 3.40 5.79 52 MIME_QP_LONG_LINE 31978 5.07 2.08 5.74 53 XM_H_Long_From01 30734 5.40 4.88 5.51 54 RCVD_IN_IADB_LISTED 29712 4.56 1.14 5.33 55 BOTNET_IPINHOSTNAME 29683 6.84 13.61 5.32 56 BAYES_999 29276 9.65 29.33 5.25 57 BAYES_40 27227 4.56 3.12 4.88 58 XMStrtUSub 26668 4.56 3.54 4.78 59 RCVD_IN_IADB_SPF 26010 3.98 0.93 4.67 60 BAYES_80 25545 5.18 7.87 4.58 61 MPART_ALT_DIFF 25543 5.13 7.60 4.58 62 XMSexyCombo_05 24952 5.38 9.43 4.48 63 T_TooManySym_01 24188 3.94 2.17 4.34 64 RCVD_IN_IADB_SENDERID 23297 3.57 0.87 4.18 65 TR_XM_DK_SendGrid 22793 3.64 1.64 4.09 66 RCVD_IN_IADB_DK 22584 3.47 0.87 4.05 67 XMSubMetaSx_00 22246 4.59 7.26 3.99 68 XM_PDF 21990 3.44 1.17 3.94 69 XMStockSpam_06 20971 3.30 1.24 3.76 70 BAYES_20 20782 3.43 2.11 3.73 71 HTML_IMAGE_RATIO_06 20537 3.60 3.24 3.68 72 ANY_BOUNCE_MESSAGE 20263 4.36 7.59 3.63 73 BOUNCE_MESSAGE 20260 4.36 7.59 3.63 74 XMNumbers 19836 4.17 6.93 3.56 75 DKIM_INVALID 19781 3.71 4.41 3.55 76 T_REMOTE_IMAGE 19528 5.52 14.53 3.50 77 XM_UncommonTLD01 18541 5.32 14.23 3.33 78 TM2_M_URI_OPT_OUT 18099 3.72 5.85 3.25 79 RCVD_IN_IADB_VOUCHED 18065 2.76 0.59 3.24 80 TR_XM_PhishingBody 17079 3.40 4.91 3.06 81 MIME_HTML_MOSTLY 16090 3.82 8.00 2.89 82 BAYES_95 15597 3.08 4.34 2.80 83 TR_XM_SB_Phish 15169 2.62 2.19 2.72 84 XMSubPhish11 14914 2.57 2.13 2.68 85 BOTNET 14612 7.90 31.51 2.62 86 XM_B_Unsub2 14569 3.00 4.73 2.61 87 UNTRUSTED_Relay 14335 5.94 21.02 2.57 88 URI_NOVOWEL 13930 2.31 1.44 2.50 89 MAILING_LIST_MULTI 13681 2.22 1.16 2.45 90 FROM_EXCESS_BASE64 13403 3.37 7.71 2.40 91 HTML_IMAGE_RATIO_08 13086 2.48 3.07 2.35 92 MIME_HTML_ONLY_MULTI 12788 2.10 1.25 2.29 93 RCVD_IN_MSPIKE_H5 12492 1.87 0.22 2.24 94 BAYES_05 12444 2.00 0.94 2.23 95 LH_URI_DOM_IN_PATH 12004 2.12 1.98 2.15 96 T_TooManySym_02 11944 1.86 0.59 2.14 97 RCVD_IN_IADB_OPTIN 11860 1.82 0.43 2.13 98 T_FONT_INVIS_NAKED_TO 11646 2.41 3.86 2.09 99 XM_DK_Undo_01 11582 1.90 1.09 2.08 100 HTML_MIME_NO_HTML_TAG 11573 3.18 8.12 2.08 101 TooManyTo_002 11113 1.77 0.76 1.99 102 TR_Symld_Words 10722 1.84 1.48 1.92 103 XM_B_SpammyTLD 10370 2.58 5.78 1.86 104 T_XMDrugObfuBody_08 10315 2.19 3.69 1.85 105 XM_CamelCaseFrm001 10276 1.90 2.17 1.84 106 RELAYCOUNTRY_CA 10002 2.47 5.52 1.79 107 XM_B_Phish66 9990 2.02 3.03 1.79 108 XM_SPF_SoftFail 9812 2.45 5.54 1.76 109 XMDiploma_00 9668 1.94 2.88 1.73 110 RCVD_IN_BL_SPAMCOP_NET 9639 2.80 7.58 1.73 111 SUBJ_ALL_CAPS 9514 1.70 1.69 1.71 112 T_XMDrugObfuBody_14 9274 1.68 1.73 1.66 113 URI_HEX 9251 1.76 2.19 1.66 114 TR_XM_SpammyWords2 8983 3.98 14.57 1.61 115 XMBrknScrpt_02 8844 2.17 4.81 1.59 116 TVD_RCVD_IP 8827 1.35 0.32 1.58 117 HELO_NODOT 8580 1.48 1.21 1.54 118 HELO_NO_DOMAIN 8578 1.47 1.19 1.54 119 HTML_FONT_FACE_BAD 8421 1.36 0.67 1.51 120 KHOP_HELO_FCRDNS 8392 2.32 5.98 1.51 121 URI_TRY_3LD 7934 1.67 2.76 1.42 122 XM_UB50 7886 2.74 8.69 1.41 123 IN_HORDE_ADDRESS_BOOK 7614 1.15 0.21 1.37 124 TooManyTo_003 7575 1.21 0.56 1.36 125 INVALID_MSGID 7518 1.17 0.38 1.35 126 XM_B_COVIDMETA 7283 2.18 6.09 1.31 127 HELO_MISC_IP 6844 1.08 0.41 1.23 128 CK_HELO_DYNAMIC_SPLIT_IP 6840 1.11 0.59 1.23 129 XMGappySubj_01 6800 1.04 0.24 1.22 130 XMCapTrack 6687 1.06 0.42 1.20 131 XM_OfRef6 6578 1.74 4.23 1.18 132 TM2_M_VERY_LONG_WORD 6541 1.39 2.34 1.17 133 TO_MALFORMED 6360 0.94 0.06 1.14 134 XM_GoogleGroups 6329 1.00 0.37 1.14 135 SpammyFromTLD_01 5766 1.66 4.44 1.03 136 RCVD_IN_MSPIKE_BL 5699 3.87 16.61 1.02 137 RELAYCOUNTRY_GB 5636 1.11 1.57 1.01 138 XMBSHREFv2 5602 0.87 0.25 1.00 139 DKIM_ADSP_CUSTOM_MED 5587 1.05 1.25 1.00 140 XM_H_Long_From02 5445 0.90 0.55 0.98 141 XMBdyGiftCard01 5443 0.90 0.54 0.98 142 XMGenDplmaNmb 5372 1.02 1.27 0.96 143 TooManyTo_004 5348 0.87 0.47 0.96 144 T_FILL_THIS_FORM_SHORT 5149 1.09 1.81 0.92 145 XMBody_17 5109 1.18 2.38 0.92 146 USER_IN_DEF_DKIM_WL 4996 0.73 0.00 0.90 147 XMHTML_After_End 4929 0.98 1.40 0.88 148 XM_ProductURIs 4878 0.81 0.50 0.87 149 T_TooManySym_03 4849 0.74 0.16 0.87 150 TR_MSPIKEBAYES00 4676 0.69 0.00 0.84 151 HTTPS_HTTP_MISMATCH 4569 0.90 1.25 0.82 152 FROM_GOV_DKIM_AU 4507 0.68 0.08 0.81 153 XMSexyCombo_01 4464 0.99 1.84 0.80 154 SENDGRID_REDIR 4399 0.73 0.47 0.79 155 TooManyTo_005 4346 0.70 0.37 0.78 156 TR_MetaPhish_Combo_01 4326 0.82 1.02 0.78 157 T_XMDrugObfuBody_00 4114 0.93 1.78 0.74 158 XM_SPF_Unknown 4087 0.97 2.01 0.73 159 DKIM_ADSP_NXDOMAIN 3979 1.14 3.07 0.71 160 RCVD_IN_MSPIKE_L3 3890 1.63 5.78 0.70 161 NML_ADSP_CUSTOM_MED 3844 0.77 1.15 0.69 162 XM_ShortIntro_01 3839 0.65 0.50 0.69 163 TR_BOTNET_NEGATE 3672 0.64 0.55 0.66 164 XMSubMetaI_00 3542 0.62 0.56 0.64 165 T_XMHurry_00 3492 0.77 1.42 0.63 166 T_Symld_Words_02 3431 0.63 0.68 0.62 167 XMMoneyMeta_00 3407 0.64 0.76 0.61 168 T_OBFU_PDF_ATTACH 3314 0.52 0.19 0.59 169 XMSubNoVowel 3301 0.84 1.94 0.59 170 XM_H_Trusted_IP 3296 0.48 0.00 0.59 171 XM_B_SpammyWords4 3249 0.94 2.54 0.58 172 XMBody_95 3214 0.48 0.05 0.58 173 XMHTMLBadTable_001 3175 0.56 0.49 0.57 174 XMBody_78 3145 0.65 1.03 0.56 175 TM2_M_BODY_EMPTY 3127 0.49 0.18 0.56 176 XM_RXBody 3100 0.53 0.39 0.56 177 NUMERIC_HTTP_ADDR 3065 0.89 2.41 0.55 178 XMSubMetaSxObfu_02 3053 0.64 1.08 0.55 179 XMNoVowels 3037 0.52 0.41 0.54 180 TR_LOTS_OF_MONEY3 3000 0.77 1.83 0.54 181 XM_DIRTYINTL 2993 1.04 3.28 0.54 182 RELAYCOUNTRY_DE 2986 0.63 1.06 0.54 183 TR_XM_COVIDMETA4 2906 1.48 5.76 0.52 184 TR_XM_SpammyWords3 2716 2.21 9.91 0.49 185 HTML_IMAGE_ONLY_20 2705 1.08 3.73 0.49 186 FORGED_GMAIL_RCVD 2702 0.56 0.91 0.48 187 XMSlimDrugH 2681 0.55 0.85 0.48 188 TM2_M_A_HREF_HREF 2668 0.51 0.66 0.48 189 RDNS_DYNAMIC 2648 0.65 1.42 0.47 190 XM_B_REG_HTML 2633 0.41 0.10 0.47 191 FROM_GOV_SPOOF 2627 0.42 0.19 0.47 192 HTML_IMAGE_ONLY_28 2600 0.45 0.36 0.47 193 XMSolicitRefs_0 2597 0.47 0.47 0.47 194 RCVD_IN_SORBS_DUL 2592 0.43 0.29 0.46 195 T_TooManySym_04 2588 0.39 0.06 0.46 196 XM_H_PHPMailer 2568 0.53 0.82 0.46 197 XMPhish08 2545 0.50 0.71 0.46 198 NO_DNS_FOR_FROM 2492 0.54 0.98 0.45 199 MISSING_HEADERS 2491 0.49 0.67 0.45 200 RELAYCOUNTRY_FR 2487 1.07 3.86 0.45 ----------------------------------------------------------------------