Email: 652486 Autolearn: 0 AvgScore: 3.23 AvgScanTime: 1.17 sec Spam: 173509 Autolearn: 0 AvgScore: 13.51 AvgScanTime: 1.34 sec Ham: 478977 Autolearn: 0 AvgScore: -0.50 AvgScanTime: 1.11 sec Time Spent Running SA: 211.84 hours Time Spent Processing Spam: 64.42 hours Time Spent Processing Ham: 147.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156757 89.72 90.35 89.50 2 DKIM_SIGNED 135274 77.00 77.96 76.65 3 XM_DK_Pass 131633 75.56 75.87 75.45 4 DCC_CHECK 131397 46.64 75.73 36.10 5 XM_B_Unicode 129632 70.72 74.71 69.28 6 DKIM_VALID 128290 73.27 73.94 73.03 7 RELAYCOUNTRY_US 127883 79.29 73.70 81.31 8 XM_B_SpammyWords 118417 54.29 68.25 49.23 9 XMListUnsubscribeExists 111998 53.54 64.55 49.55 10 DKIM_VALID_AU 100028 55.42 57.65 54.61 11 BAYES_50 69187 52.22 39.88 56.70 12 XM_DK_Undo_02 68182 16.93 39.30 8.83 13 XM_B_Unicode3 65544 38.16 37.78 38.30 14 XM_B_SpammyWords2 61327 25.46 35.35 21.88 15 LOC_TINY_FONT_1 59221 26.37 34.13 23.56 16 HTML_FONT_LOW_CONTRAST 56590 29.06 32.62 27.78 17 BAYES_99 55771 12.63 32.14 5.56 18 MIME_HTML_ONLY 53493 22.22 30.83 19.10 19 DKIM_VALID_EF 52190 30.01 30.08 29.99 20 RCVD_IN_MSPIKE_H2 48497 27.69 27.95 27.59 21 BAYES_999 43526 9.96 25.09 4.48 22 TR_DCC_Bayes_99 43447 8.56 25.04 2.59 23 FVGT_m_MULTI_ODD 42196 24.32 24.32 24.32 24 T_KAM_HTML_FONT_INVALID 41458 20.21 23.89 18.88 25 RELAYCOUNTRY_META 40529 10.03 23.36 5.20 26 DCC_CHECK_NEGATIVE 39003 51.31 22.48 61.76 27 XMSubLong 37636 21.47 21.69 21.40 28 T_TM2_M_HEADER_IN_MSG 37343 30.23 21.52 33.39 29 XM_Multi_Part_URI 34408 13.63 19.83 11.38 30 BOTNET 33857 6.80 19.51 2.20 31 UNTRUSTED_Relay 32941 6.50 18.99 1.97 32 LOTS_OF_MONEY 32373 11.35 18.66 8.70 33 XM_Body_Dirty_Words 32235 14.75 18.58 13.36 34 FSL_BULK_SIG 27336 7.78 15.75 4.89 35 RCVD_IN_MSPIKE_WL 25701 25.14 14.81 28.88 36 RCVD_IN_MSPIKE_BL 22435 3.87 12.93 0.58 37 XM_UncommonTLD01 20634 5.61 11.89 3.34 38 TR_XM_SpammyWords2 20529 4.00 11.83 1.16 39 BOTNET_IPINHOSTNAME 19980 6.66 11.52 4.90 40 XM_B_SpammyWords3 19135 6.86 11.03 5.35 41 XM_B_Unsub 18466 10.86 10.64 10.94 42 XMSexyCombo_05 18095 5.58 10.43 3.82 43 XM_B_Phish_Phrases 17639 7.55 10.17 6.60 44 MPART_ALT_DIFF 17616 5.37 10.15 3.64 45 XM_Evil_Numbers_Gen 16749 8.80 9.65 8.49 46 RCVD_IN_RP_RNBL 16284 2.59 9.39 0.13 47 LotsOfNums_01 16062 8.73 9.26 8.54 48 BAYES_80 13626 4.98 7.85 3.94 49 RCVD_IN_MSPIKE_H3 13559 14.08 7.81 16.35 50 XM_UB50 13157 2.69 7.58 0.92 51 TR_XM_SpammyWords3 12865 2.20 7.41 0.31 52 BAYES_60 12832 6.78 7.40 6.56 53 RCVD_IN_MSPIKE_L5 12767 2.09 7.36 0.18 54 T_REMOTE_IMAGE 12560 4.61 7.24 3.66 55 HTML_IMAGE_RATIO_02 12364 6.57 7.13 6.36 56 RCVD_IN_PSBL 12289 1.89 7.08 0.01 57 MIME_HTML_MOSTLY 12185 3.38 7.02 2.06 58 XMBrknScrpt_02 12020 2.47 6.93 0.85 59 XMSubMetaSx_00 11569 4.78 6.67 4.10 60 RCVD_IN_BL_SPAMCOP_NET 11458 2.59 6.60 1.14 61 RCVD_IN_MSPIKE_H4 11136 9.41 6.42 10.49 62 RELAYCOUNTRY_CA 10769 2.83 6.21 1.61 63 TR_XM_PhishingBody 10419 3.90 6.00 3.13 64 XM_H_Long_From01 10218 5.64 5.89 5.55 65 TooManyTo_001 10146 8.18 5.85 9.02 66 DATE_IN_PAST_03_06 9684 1.55 5.58 0.09 67 BODY_URI_ONLY 9666 1.51 5.57 0.04 68 URIBL_SBL_A 9465 1.58 5.46 0.18 69 XMNumbers 9365 4.05 5.40 3.57 70 KHOP_HELO_FCRDNS 9299 2.66 5.36 1.68 71 HTML_SHORT_LINK_IMG_1 9216 1.42 5.31 0.01 72 HTML_IMAGE_ONLY_08 9055 1.50 5.22 0.15 73 HTML_IMAGE_RATIO_04 8983 4.98 5.18 4.91 74 UNPARSEABLE_RELAY 8968 6.98 5.17 7.63 75 SHORTENER_SHORT_IMG 8588 1.32 4.95 0.00 76 SHORT_URI_3 8576 1.34 4.94 0.04 77 BAYES_95 8563 3.08 4.94 2.40 78 SHORTENED_URL_HREF 8515 1.55 4.91 0.34 79 SHORTENED_URL_SRC 8477 1.30 4.89 0.00 80 TR_XM_COVIDMETA4 8450 1.62 4.87 0.44 81 SpammyFromTLD_01 8407 1.98 4.85 0.95 82 RCVD_IN_MSPIKE_L3 8388 1.54 4.83 0.35 83 XM_B_SpammyTLD 8103 2.79 4.67 2.11 84 RELAYCOUNTRY_FR 8000 1.41 4.61 0.25 85 BOUNCE_MESSAGE 7969 2.68 4.59 1.98 86 ANY_BOUNCE_MESSAGE 7969 2.68 4.59 1.99 87 XM_B_COVIDMETA 7581 2.21 4.37 1.43 88 XM_Lotto 7454 1.26 4.30 0.16 89 SHORT_SHORTNER 7361 1.14 4.24 0.02 90 T_FONT_INVIS_NAKED_TO 7265 2.40 4.19 1.75 91 XM_OfRef6 7238 2.09 4.17 1.34 92 XM_SPF_SoftFail 7138 2.44 4.11 1.84 93 XM_SendGrid 7098 6.31 4.09 7.11 94 XMBody_17 7006 1.67 4.04 0.81 95 DKIM_INVALID 6984 3.73 4.03 3.63 96 SpammyFromTLD_02 6428 1.14 3.70 0.20 97 XM_B_Phish66 6296 2.43 3.63 1.99 98 XM_DIRTYINTL 6288 1.39 3.62 0.59 99 HTML_IMAGE_RATIO_06 5979 3.35 3.45 3.31 100 HTML_IMAGE_RATIO_08 5798 2.57 3.34 2.29 101 XMStrtUSub 5766 4.15 3.32 4.45 102 T_XMDrugObfuBody_08 5622 2.14 3.24 1.74 103 SUBJ_ALL_CAPS 5552 1.99 3.20 1.55 104 URI_PHP_REDIR 5472 0.85 3.15 0.01 105 XMDiploma_00 5102 2.59 2.94 2.46 106 TR_LOTS_OF_MONEY3 5068 1.38 2.92 0.82 107 BOTNET_NORDNS 4991 0.78 2.88 0.02 108 XM_UB99 4965 0.76 2.86 0.00 109 BAYES_40 4874 4.43 2.81 5.01 110 URI_TRY_3LD 4692 1.45 2.70 1.00 111 MIME_HTML_ONLY_MULTI 4526 2.14 2.61 1.98 112 TM2_M_URI_OPT_OUT 4503 2.54 2.60 2.52 113 URI_HEX 4490 1.71 2.59 1.40 114 TR_XM_MaxBayes 4449 0.70 2.56 0.02 115 XM_UB60 4421 0.74 2.55 0.08 116 TR_XM_SB_Phish 4403 2.34 2.54 2.27 117 XMSubPhish11 4325 2.30 2.49 2.23 118 XM_CamelCaseFrm001 4097 1.88 2.36 1.70 119 FROM_EXCESS_BASE64 4086 2.52 2.35 2.58 120 HTML_MIME_NO_HTML_TAG 4059 2.28 2.34 2.26 121 TR_XM_MaxSPIKE 4027 0.63 2.32 0.01 122 T_FILL_THIS_FORM_SHORT 3945 1.31 2.27 0.96 123 LH_URI_DOM_IN_PATH 3913 1.99 2.26 1.90 124 TR_XM_DK_SendGrid 3813 3.71 2.20 4.26 125 TR_Sbj_FN_Bdy 3786 0.77 2.18 0.25 126 T_TooManySym_01 3734 4.03 2.15 4.71 127 MISSING_HEADERS 3722 0.96 2.15 0.54 128 MIME_QP_LONG_LINE 3712 4.63 2.14 5.53 129 XM_B_Unsub2 3606 2.60 2.08 2.79 130 BAYES_00 3532 10.70 2.04 13.84 131 XM_OfRef7 3513 0.69 2.02 0.20 132 TR_XM_UnparsRelay 3511 0.79 2.02 0.35 133 XM_URI_RBL 3466 0.64 2.00 0.15 134 XM_UB999 3413 0.53 1.97 0.00 135 UNCLAIMED_MONEY 3355 0.56 1.93 0.06 136 XM_UB80 3349 0.53 1.93 0.03 137 XMSexyCombo_01 3325 1.21 1.92 0.95 138 BAYES_20 3268 3.20 1.88 3.67 139 XMSubNoVowel 3223 1.04 1.86 0.74 140 REPLYTO_WITHOUT_TO_CC 3178 0.55 1.83 0.09 141 RCVD_IN_RP_SAFE 3167 6.24 1.83 7.84 142 XM_B_SpammyWords4 3131 0.78 1.80 0.41 143 TR_LOTS_OF_MONEY1 3057 0.51 1.76 0.06 144 TM2_M_VERY_LONG_WORD 3031 1.34 1.75 1.19 145 XMStockSpam_06 2870 2.21 1.65 2.40 146 RELAYCOUNTRY_TR 2757 0.43 1.59 0.01 147 XMBdyGiftCard01 2714 0.73 1.56 0.42 148 T_XMHurry_00 2688 0.80 1.55 0.52 149 XMMoneyMeta_00 2668 0.85 1.54 0.60 150 RELAYCOUNTRY_IN 2639 0.49 1.52 0.12 151 TR_Symld_Words 2588 1.87 1.49 2.01 152 URI_NOVOWEL 2558 2.41 1.47 2.75 153 XMGenDplmaNmb 2521 1.30 1.45 1.25 154 RCVD_IN_RP_CERTIFIED 2519 5.79 1.45 7.37 155 T_XMDrugObfuBody_14 2518 1.48 1.45 1.49 156 T_PDS_OTHER_BAD_TLD 2459 0.74 1.42 0.49 157 TR_XM_PHPDW 2453 0.68 1.41 0.41 158 TR_XM_PHPForged 2425 0.65 1.40 0.38 159 XM_SPF_Unknown 2409 0.97 1.39 0.82 160 TR_Caps_n_Bayes_99 2400 0.42 1.38 0.07 161 TR_XM_FormFill2 2397 0.64 1.38 0.38 162 XM_H_PHPOS 2376 0.64 1.37 0.37 163 RCVD_IN_IADB_LISTED 2355 4.26 1.36 5.30 164 TR_XM_INV_DKIM 2241 0.46 1.29 0.16 165 FILL_THIS_FORM 2224 0.51 1.28 0.24 166 MIME_CHARSET_FARAWAY 2209 0.45 1.27 0.15 167 FROM_SUSPICIOUS_NTLD 2206 0.38 1.27 0.05 168 FROM_MISSPACED 2185 0.34 1.26 0.01 169 TR_MetaPhish_Combo_01 2148 0.91 1.24 0.79 170 RELAYCOUNTRY_DE 2140 0.61 1.23 0.38 171 FROM_SUSPICIOUS_NTLD_FP 2135 0.36 1.23 0.04 172 T_FILL_THIS_FORM_LONG 2131 0.44 1.23 0.15 173 NUMERIC_HTTP_ADDR 2104 0.68 1.21 0.49 174 MPART_ALT_DIFF_COUNT 2100 0.66 1.21 0.45 175 XMHTML_After_End 2091 0.95 1.21 0.86 176 RCVD_IN_IADB_SPF 2053 3.66 1.18 4.56 177 FORM_FRAUD 2048 0.32 1.18 0.01 178 CHARSET_FARAWAY_HEADER 2044 0.35 1.18 0.05 179 HTTPS_HTTP_MISMATCH 2001 0.94 1.15 0.86 180 ALL_TRUSTED 1991 11.24 1.15 14.90 181 XM_UB95 1982 0.31 1.14 0.01 182 DKIM_ADSP_CUSTOM_MED 1960 1.22 1.13 1.26 183 XM_H_Long_From02 1940 1.06 1.12 1.03 184 TR_XM_COVIDMETA1 1931 0.50 1.11 0.28 185 XM_S_SpammyWords 1931 0.45 1.11 0.21 186 TR_XM_Spammywords 1931 0.45 1.11 0.20 187 XM_PDF 1928 3.89 1.11 4.90 188 ADVANCE_FEE_3_NEW_MONEY 1922 0.31 1.11 0.02 189 RCVD_IN_IADB_DK 1912 3.17 1.10 3.92 190 RCVD_IN_IADB_SENDERID 1909 3.25 1.10 4.03 191 TR_XM_RelayPhish 1892 0.38 1.09 0.12 192 HK_RANDOM_REPLYTO 1875 0.46 1.08 0.23 193 MAILING_LIST_MULTI 1853 2.15 1.07 2.54 194 XMSubMetaSxObfu_03 1812 0.87 1.04 0.81 195 NO_DNS_FOR_FROM 1805 0.65 1.04 0.51 196 XM_DK_Undo_01 1797 1.78 1.04 2.06 197 ADVANCE_FEE_2_NEW_FORM 1791 0.28 1.03 0.01 198 TR_XM_FormFill 1789 0.30 1.03 0.03 199 BAYES_05 1760 1.96 1.01 2.30 200 NML_ADSP_CUSTOM_MED 1755 0.89 1.01 0.85 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 428661 89.72 90.35 89.50 2 RELAYCOUNTRY_US 389477 79.29 73.70 81.31 3 DKIM_SIGNED 367150 77.00 77.96 76.65 4 XM_DK_Pass 361385 75.56 75.87 75.45 5 DKIM_VALID 349786 73.27 73.94 73.03 6 XM_B_Unicode 331833 70.72 74.71 69.28 7 DCC_CHECK_NEGATIVE 295814 51.31 22.48 61.76 8 BAYES_50 271561 52.22 39.88 56.70 9 DKIM_VALID_AU 261551 55.42 57.65 54.61 10 XMListUnsubscribeExists 237332 53.54 64.55 49.55 11 XM_B_SpammyWords 235813 54.29 68.25 49.23 12 XM_B_Unicode3 183428 38.16 37.78 38.30 13 DCC_CHECK 172893 46.64 75.73 36.10 14 T_TM2_M_HEADER_IN_MSG 159914 30.23 21.52 33.39 15 DKIM_VALID_EF 143647 30.01 30.08 29.99 16 RCVD_IN_MSPIKE_WL 138351 25.14 14.81 28.88 17 HTML_FONT_LOW_CONTRAST 133039 29.06 32.62 27.78 18 RCVD_IN_MSPIKE_H2 132161 27.69 27.95 27.59 19 FVGT_m_MULTI_ODD 116507 24.32 24.32 24.32 20 LOC_TINY_FONT_1 112867 26.37 34.13 23.56 21 XM_B_SpammyWords2 104824 25.46 35.35 21.88 22 XMSubLong 102484 21.47 21.69 21.40 23 MIME_HTML_ONLY 91503 22.22 30.83 19.10 24 T_KAM_HTML_FONT_INVALID 90410 20.21 23.89 18.88 25 RCVD_IN_MSPIKE_H3 78289 14.08 7.81 16.35 26 ALL_TRUSTED 71372 11.24 1.15 14.90 27 BAYES_00 66311 10.70 2.04 13.84 28 XM_Body_Dirty_Words 63979 14.75 18.58 13.36 29 XM_Multi_Part_URI 54522 13.63 19.83 11.38 30 XM_B_Unsub 52419 10.86 10.64 10.94 31 RCVD_IN_MSPIKE_H4 50256 9.41 6.42 10.49 32 TR_XM_DK_Bayes 49772 7.81 0.69 10.39 33 TR_XM_DK_Bayes1 48247 7.57 0.67 10.07 34 TooManyTo_001 43211 8.18 5.85 9.02 35 TR_XM_DK_Bayes2 42388 6.61 0.44 8.85 36 XM_DK_Undo_02 42285 16.93 39.30 8.83 37 LOTS_OF_MONEY 41657 11.35 18.66 8.70 38 LotsOfNums_01 40907 8.73 9.26 8.54 39 XM_Evil_Numbers_Gen 40682 8.80 9.65 8.49 40 XM_DKIMWhitelistDomains 39566 6.08 0.05 8.26 41 RCVD_IN_RP_SAFE 37569 6.24 1.83 7.84 42 UNPARSEABLE_RELAY 36546 6.98 5.17 7.63 43 RCVD_IN_RP_CERTIFIED 35280 5.79 1.45 7.37 44 XM_SendGrid 34065 6.31 4.09 7.11 45 IN_ZIMBRA_NJ_WHITELIST 32662 5.02 0.05 6.82 46 XM_B_Phish_Phrases 31616 7.55 10.17 6.60 47 BAYES_60 31433 6.78 7.40 6.56 48 HTML_IMAGE_RATIO_02 30480 6.57 7.13 6.36 49 BAYES_99 26625 12.63 32.14 5.56 50 XM_H_Long_From01 26576 5.64 5.89 5.55 51 MIME_QP_LONG_LINE 26495 4.63 2.14 5.53 52 XM_B_SpammyWords3 25623 6.86 11.03 5.35 53 RCVD_IN_IADB_LISTED 25409 4.26 1.36 5.30 54 RELAYCOUNTRY_META 24897 10.03 23.36 5.20 55 BAYES_40 24001 4.43 2.81 5.01 56 HTML_IMAGE_RATIO_04 23507 4.98 5.18 4.91 57 XM_PDF 23480 3.89 1.11 4.90 58 BOTNET_IPINHOSTNAME 23468 6.66 11.52 4.90 59 FSL_BULK_SIG 23439 7.78 15.75 4.89 60 T_TooManySym_01 22570 4.03 2.15 4.71 61 RCVD_IN_IADB_SPF 21836 3.66 1.18 4.56 62 BAYES_999 21446 9.96 25.09 4.48 63 XMStrtUSub 21298 4.15 3.32 4.45 64 TR_XM_DK_SendGrid 20408 3.71 2.20 4.26 65 XMSubMetaSx_00 19617 4.78 6.67 4.10 66 RCVD_IN_IADB_SENDERID 19309 3.25 1.10 4.03 67 BAYES_80 18891 4.98 7.85 3.94 68 RCVD_IN_IADB_DK 18764 3.17 1.10 3.92 69 XMSexyCombo_05 18283 5.58 10.43 3.82 70 BAYES_20 17579 3.20 1.88 3.67 71 T_REMOTE_IMAGE 17539 4.61 7.24 3.66 72 MPART_ALT_DIFF 17446 5.37 10.15 3.64 73 DKIM_INVALID 17364 3.73 4.03 3.63 74 XMNumbers 17077 4.05 5.40 3.57 75 RCVD_IN_IADB_VOUCHED 16608 2.71 0.62 3.47 76 XM_UncommonTLD01 15975 5.61 11.89 3.34 77 HTML_IMAGE_RATIO_06 15856 3.35 3.45 3.31 78 TR_XM_PhishingBody 15003 3.90 6.00 3.13 79 XM_B_Unsub2 13369 2.60 2.08 2.79 80 URI_NOVOWEL 13176 2.41 1.47 2.75 81 TR_DCC_Bayes_99 12429 8.56 25.04 2.59 82 FROM_EXCESS_BASE64 12374 2.52 2.35 2.58 83 MAILING_LIST_MULTI 12144 2.15 1.07 2.54 84 TM2_M_URI_OPT_OUT 12072 2.54 2.60 2.52 85 TooManyTo_002 11963 2.01 0.66 2.50 86 XMDiploma_00 11795 2.59 2.94 2.46 87 T_TooManySym_02 11770 1.97 0.63 2.46 88 XMStockSpam_06 11518 2.21 1.65 2.40 89 BAYES_95 11502 3.08 4.94 2.40 90 BAYES_05 11038 1.96 1.01 2.30 91 HTML_IMAGE_RATIO_08 10983 2.57 3.34 2.29 92 TR_XM_SB_Phish 10865 2.34 2.54 2.27 93 HTML_MIME_NO_HTML_TAG 10820 2.28 2.34 2.26 94 XMSubPhish11 10696 2.30 2.49 2.23 95 RCVD_IN_IADB_OPTIN 10655 1.75 0.45 2.22 96 BOTNET 10516 6.80 19.51 2.20 97 XM_B_SpammyTLD 10102 2.79 4.67 2.11 98 MIME_HTML_MOSTLY 9881 3.38 7.02 2.06 99 XM_DK_Undo_01 9848 1.78 1.04 2.06 100 RCVD_IN_MSPIKE_H5 9806 1.66 0.58 2.05 101 TR_Symld_Words 9637 1.87 1.49 2.01 102 XM_B_Phish66 9544 2.43 3.63 1.99 103 ANY_BOUNCE_MESSAGE 9521 2.68 4.59 1.99 104 BOUNCE_MESSAGE 9503 2.68 4.59 1.98 105 MIME_HTML_ONLY_MULTI 9464 2.14 2.61 1.98 106 UNTRUSTED_Relay 9444 6.50 18.99 1.97 107 LH_URI_DOM_IN_PATH 9102 1.99 2.26 1.90 108 HELO_NODOT 8941 1.55 0.67 1.87 109 HELO_NO_DOMAIN 8940 1.55 0.67 1.87 110 XM_SPF_SoftFail 8799 2.44 4.11 1.84 111 T_FONT_INVIS_NAKED_TO 8406 2.40 4.19 1.75 112 T_XMDrugObfuBody_08 8332 2.14 3.24 1.74 113 TVD_RCVD_IP 8255 1.31 0.17 1.72 114 XM_CamelCaseFrm001 8153 1.88 2.36 1.70 115 TooManyTo_003 8131 1.38 0.52 1.70 116 KHOP_HELO_FCRDNS 8063 2.66 5.36 1.68 117 RELAYCOUNTRY_CA 7695 2.83 6.21 1.61 118 IN_HORDE_ADDRESS_BOOK 7603 1.19 0.09 1.59 119 SUBJ_ALL_CAPS 7403 1.99 3.20 1.55 120 INVALID_MSGID 7382 1.24 0.41 1.54 121 T_XMDrugObfuBody_14 7120 1.48 1.45 1.49 122 HELO_MISC_IP 6907 1.14 0.32 1.44 123 CK_HELO_DYNAMIC_SPLIT_IP 6874 1.16 0.40 1.44 124 XM_B_COVIDMETA 6855 2.21 4.37 1.43 125 XMCapTrack 6825 1.15 0.39 1.42 126 URI_HEX 6695 1.71 2.59 1.40 127 TO_MALFORMED 6555 1.01 0.01 1.37 128 XM_OfRef6 6401 2.09 4.17 1.34 129 XM_GoogleGroups 6302 1.06 0.37 1.32 130 XMGappySubj_01 6170 0.99 0.15 1.29 131 TooManyTo_004 6111 1.06 0.45 1.28 132 DKIM_ADSP_CUSTOM_MED 6031 1.22 1.13 1.26 133 USER_IN_DEF_DKIM_WL 6000 0.92 0.01 1.25 134 XMGenDplmaNmb 5979 1.30 1.45 1.25 135 TM2_M_VERY_LONG_WORD 5708 1.34 1.75 1.19 136 XMBSHREFv2 5602 0.94 0.32 1.17 137 TR_XM_SpammyWords2 5571 4.00 11.83 1.16 138 RCVD_IN_BL_SPAMCOP_NET 5466 2.59 6.60 1.14 139 RELAYCOUNTRY_GB 5401 1.09 0.98 1.13 140 XM_H_Long_From02 4944 1.06 1.12 1.03 141 TR_MSPIKEBAYES00 4940 0.76 0.01 1.03 142 TooManyTo_005 4860 0.84 0.36 1.01 143 T_TooManySym_03 4842 0.78 0.15 1.01 144 URI_TRY_3LD 4774 1.45 2.70 1.00 145 T_FILL_THIS_FORM_SHORT 4579 1.31 2.27 0.96 146 XMSexyCombo_01 4546 1.21 1.92 0.95 147 SpammyFromTLD_01 4540 1.98 4.85 0.95 148 XM_UB50 4423 2.69 7.58 0.92 149 XMBody_95 4360 0.68 0.05 0.91 150 HTTPS_HTTP_MISMATCH 4113 0.94 1.15 0.86 151 XMHTML_After_End 4096 0.95 1.21 0.86 152 XMBrknScrpt_02 4078 2.47 6.93 0.85 153 NML_ADSP_CUSTOM_MED 4059 0.89 1.01 0.85 154 TR_LOTS_OF_MONEY3 3907 1.38 2.92 0.82 155 XM_SPF_Unknown 3905 0.97 1.39 0.82 156 XMSubMetaSxObfu_03 3897 0.87 1.04 0.81 157 XMBody_17 3879 1.67 4.04 0.81 158 XM_ShortIntro_01 3841 0.70 0.40 0.80 159 TR_MetaPhish_Combo_01 3802 0.91 1.24 0.79 160 T_OBFU_PDF_ATTACH 3792 0.62 0.14 0.79 161 T_XMDrugObfuBody_00 3697 0.83 0.97 0.77 162 XM_ProductURIs 3633 0.73 0.67 0.76 163 XMSubNoVowel 3566 1.04 1.86 0.74 164 FROM_GOV_DKIM_AU 3206 0.51 0.08 0.67 165 HTML_FONT_FACE_BAD 3088 0.65 0.67 0.64 166 FORGED_GMAIL_RCVD 2953 0.71 0.97 0.62 167 XMMoneyMeta_00 2878 0.85 1.54 0.60 168 XMSubMetaI_00 2858 0.65 0.81 0.60 169 XM_DIRTYINTL 2813 1.39 3.62 0.59 170 RCVD_IN_MSPIKE_BL 2794 3.87 12.93 0.58 171 XMNoVowels 2765 0.55 0.47 0.58 172 DKIM_ADSP_NXDOMAIN 2741 0.63 0.80 0.57 173 TVD_SPACE_RATIO 2731 0.44 0.09 0.57 174 RCVD_IN_SORBS_DUL 2729 0.48 0.24 0.57 175 T_TooManySym_04 2685 0.42 0.02 0.56 176 SENDGRID_REDIR 2641 0.55 0.55 0.55 177 XM_H_Trusted_IP 2637 0.40 0.00 0.55 178 XM_H_PHPMailer 2592 0.53 0.51 0.54 179 MISSING_HEADERS 2569 0.96 2.15 0.54 180 PLING_QUERY 2550 0.55 0.60 0.53 181 T_XMHurry_00 2508 0.80 1.55 0.52 182 HTML_TAG_BALANCE_BODY 2497 0.53 0.56 0.52 183 XMHTMLBadTable_001 2495 0.55 0.63 0.52 184 TM2_M_BODY_EMPTY 2485 0.41 0.11 0.52 185 HTML_IMAGE_ONLY_20 2450 0.51 0.50 0.51 186 FROM_GOV_SPOOF 2446 0.41 0.15 0.51 187 XMSexyCombo_04 2443 0.62 0.93 0.51 188 NO_DNS_FOR_FROM 2433 0.65 1.04 0.51 189 RDNS_DYNAMIC 2403 0.63 1.00 0.50 190 XMSubMetaSxObfu_02 2390 0.53 0.60 0.50 191 NUMERIC_HTTP_ADDR 2360 0.68 1.21 0.49 192 T_PDS_OTHER_BAD_TLD 2353 0.74 1.42 0.49 193 TR_BOTNET_NEGATE 2351 0.57 0.77 0.49 194 SHORT_HELO_AND_INLINE_IMAGE 2294 0.37 0.09 0.48 195 XM_S_SubURI 2291 0.36 0.05 0.48 196 XMSubMetaSx_01 2259 0.42 0.28 0.47 197 MPART_ALT_DIFF_COUNT 2176 0.66 1.21 0.45 198 HTML_IMAGE_ONLY_32 2137 0.40 0.26 0.45 199 USER_IN_WHITELIST 2136 0.33 0.00 0.45 200 USER_IN_WELCOMELIST 2136 0.33 0.00 0.45 ----------------------------------------------------------------------