Email: 688268 Autolearn: 0 AvgScore: 3.35 AvgScanTime: 1.30 sec Spam: 181245 Autolearn: 0 AvgScore: 13.20 AvgScanTime: 1.41 sec Ham: 507023 Autolearn: 0 AvgScore: -0.17 AvgScanTime: 1.25 sec Time Spent Running SA: 247.71 hours Time Spent Processing Spam: 71.03 hours Time Spent Processing Ham: 176.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164469 89.85 90.74 89.53 2 DKIM_SIGNED 143221 79.31 79.02 79.42 3 XM_B_Unicode 140860 73.41 77.72 71.86 4 RELAYCOUNTRY_US 137032 81.16 75.61 83.14 5 XM_DK_Pass 135725 77.32 74.88 78.19 6 DCC_CHECK 132985 49.43 73.37 40.88 7 DKIM_VALID 132287 75.14 72.99 75.91 8 XM_B_SpammyWords 123349 54.92 68.06 50.23 9 XMListUnsubscribeExists 120403 56.72 66.43 53.24 10 DKIM_VALID_AU 99481 56.11 54.89 56.54 11 XM_DK_Undo_02 73609 17.24 40.61 8.89 12 BAYES_50 71844 52.39 39.64 56.95 13 XM_B_SpammyWords2 70569 26.53 38.94 22.10 14 XM_B_Unicode3 70479 39.78 38.89 40.09 15 LOC_TINY_FONT_1 59369 26.61 32.76 24.42 16 HTML_FONT_LOW_CONTRAST 58894 29.33 32.49 28.20 17 BAYES_99 58684 12.61 32.38 5.55 18 MIME_HTML_ONLY 55310 22.72 30.52 19.93 19 DKIM_VALID_EF 48983 28.48 27.03 29.00 20 RCVD_IN_MSPIKE_H2 48467 27.04 26.74 27.15 21 FVGT_m_MULTI_ODD 47223 24.27 26.05 23.63 22 T_KAM_HTML_FONT_INVALID 47065 21.41 25.97 19.78 23 TR_DCC_Bayes_99 45051 8.61 24.86 2.80 24 BAYES_999 44460 9.79 24.53 4.52 25 DCC_CHECK_NEGATIVE 44268 48.28 24.42 56.81 26 T_TM2_M_HEADER_IN_MSG 44209 28.75 24.39 30.31 27 XMSubLong 43430 22.11 23.96 21.45 28 RELAYCOUNTRY_META 41330 10.30 22.80 5.84 29 XM_Multi_Part_URI 36747 14.10 20.27 11.89 30 BOTNET 36642 6.71 20.22 1.89 31 XM_Body_Dirty_Words 33205 14.50 18.32 13.14 32 LOTS_OF_MONEY 29689 9.56 16.38 7.12 33 RCVD_IN_MSPIKE_WL 29581 26.27 16.32 29.82 34 UNTRUSTED_Relay 29105 5.89 16.06 2.26 35 FSL_BULK_SIG 23840 7.46 13.15 5.42 36 BOTNET_IPINHOSTNAME 23825 6.79 13.15 4.52 37 XM_B_SpammyWords3 23540 7.38 12.99 5.37 38 TR_XM_SpammyWords2 21724 4.11 11.99 1.30 39 XM_UncommonTLD01 21432 5.62 11.82 3.40 40 RCVD_IN_MSPIKE_BL 21108 3.59 11.65 0.71 41 XM_B_Phish_Phrases 20722 7.71 11.43 6.37 42 XM_B_Unsub 19609 11.19 10.82 11.33 43 LotsOfNums_01 17506 9.33 9.66 9.21 44 XMSexyCombo_05 17234 5.29 9.51 3.79 45 XM_Evil_Numbers_Gen 17198 9.16 9.49 9.04 46 HTML_IMAGE_RATIO_02 16736 7.32 9.23 6.64 47 BAYES_80 15847 5.43 8.74 4.25 48 RCVD_IN_MSPIKE_H3 15340 14.43 8.46 16.57 49 BAYES_60 13712 7.41 7.57 7.36 50 MPART_ALT_DIFF 13383 4.68 7.38 3.71 51 TR_XM_SpammyWords3 12960 2.18 7.15 0.40 52 RCVD_IN_BL_SPAMCOP_NET 12748 3.11 7.03 1.71 53 RCVD_IN_MSPIKE_H4 12727 9.92 7.02 10.95 54 UNPARSEABLE_RELAY 12387 7.97 6.83 8.38 55 RCVD_IN_RP_RNBL 12376 1.87 6.83 0.10 56 XM_UB50 12362 2.66 6.82 1.18 57 XMSubMetaSx_00 11963 4.22 6.60 3.36 58 KHOP_HELO_FCRDNS 11557 2.98 6.38 1.77 59 T_REMOTE_IMAGE 11388 4.32 6.28 3.61 60 RELAYCOUNTRY_CA 11074 2.93 6.11 1.79 61 DKIM_INVALID 10934 4.17 6.03 3.51 62 TR_XM_PhishingBody 10736 3.93 5.92 3.21 63 TooManyTo_001 10640 8.15 5.87 8.97 64 XMBrknScrpt_02 10411 2.22 5.74 0.96 65 RCVD_IN_MSPIKE_L5 10396 1.67 5.74 0.22 66 XM_SendGrid 10252 7.19 5.66 7.74 67 RCVD_IN_PSBL 10122 1.49 5.58 0.02 68 MIME_HTML_MOSTLY 9836 2.94 5.43 2.05 69 SpammyFromTLD_01 9411 2.08 5.19 0.97 70 XMBody_17 9379 1.91 5.17 0.74 71 XM_OfRef6 9129 2.22 5.04 1.21 72 RCVD_IN_MSPIKE_L3 9104 1.65 5.02 0.44 73 BAYES_95 9050 3.27 4.99 2.65 74 DATE_IN_PAST_03_06 8895 1.38 4.91 0.12 75 XM_SPF_SoftFail 8639 2.59 4.77 1.81 76 HTML_IMAGE_RATIO_04 8440 5.08 4.66 5.23 77 XM_H_Long_From01 8101 5.27 4.47 5.55 78 XM_B_COVIDMETA 8057 2.12 4.45 1.29 79 HTML_SHORT_LINK_IMG_1 7923 1.18 4.37 0.05 80 T_FONT_INVIS_NAKED_TO 7902 2.60 4.36 1.96 81 BODY_URI_ONLY 7737 1.17 4.27 0.07 82 BOUNCE_MESSAGE 7647 3.04 4.22 2.61 83 ANY_BOUNCE_MESSAGE 7647 3.04 4.22 2.61 84 TR_XM_COVIDMETA4 7616 1.38 4.20 0.38 85 URIBL_SBL_A 7588 1.27 4.19 0.22 86 XMStrtUSub 7394 4.24 4.08 4.30 87 XM_Lotto 7004 1.07 3.86 0.07 88 XM_B_SpammyTLD 6869 2.52 3.79 2.07 89 T_XMDrugObfuBody_08 6747 2.18 3.72 1.63 90 XMNumbers 6745 3.44 3.72 3.34 91 URI_HEX 6685 1.94 3.69 1.31 92 BOTNET_NORDNS 6447 0.95 3.56 0.02 93 XM_B_Phish66 6390 2.50 3.53 2.13 94 XM_DIRTYINTL 6265 1.28 3.46 0.51 95 HTML_MIME_NO_HTML_TAG 6103 2.54 3.37 2.25 96 RELAYCOUNTRY_FR 6095 1.12 3.36 0.31 97 SUBJ_ALL_CAPS 6078 2.05 3.35 1.59 98 TR_XM_DK_SendGrid 5770 4.29 3.18 4.69 99 XMDiploma_00 5715 2.24 3.15 1.91 100 LH_URI_DOM_IN_PATH 5480 2.80 3.02 2.72 101 MIME_QP_LONG_LINE 5426 5.40 2.99 6.26 102 HTML_IMAGE_RATIO_08 5301 2.48 2.92 2.32 103 HTML_IMAGE_RATIO_06 5295 3.25 2.92 3.37 104 TM2_M_URI_OPT_OUT 5279 2.56 2.91 2.43 105 FROM_EXCESS_BASE64 5266 2.97 2.91 2.99 106 SpammyFromTLD_02 5113 0.99 2.82 0.34 107 URI_TRY_3LD 5097 1.73 2.81 1.35 108 TR_XM_UnparsRelay 5073 1.08 2.80 0.47 109 XM_UB99 5064 0.74 2.79 0.01 110 T_TooManySym_01 4892 3.92 2.70 4.36 111 HTML_IMAGE_ONLY_08 4744 0.77 2.62 0.11 112 MIME_HTML_ONLY_MULTI 4679 2.12 2.58 1.95 113 BAYES_40 4651 4.14 2.57 4.70 114 TR_XM_MaxSPIKE 4605 0.68 2.54 0.02 115 SHORT_URI_3 4564 0.70 2.52 0.05 116 T_FILL_THIS_FORM_SHORT 4495 1.31 2.48 0.89 117 SHORT_SHORTNER 4467 0.66 2.46 0.01 118 XM_CamelCaseFrm001 4289 2.03 2.37 1.91 119 TR_LOTS_OF_MONEY3 4266 0.93 2.35 0.42 120 XM_UB60 4263 0.71 2.35 0.12 121 SHORTENED_URL_SRC 4255 0.62 2.35 0.00 122 SHORTENER_SHORT_IMG 4242 0.62 2.34 0.00 123 TM2_M_VERY_LONG_WORD 4220 1.53 2.33 1.24 124 XMSexyCombo_01 4136 0.98 2.28 0.51 125 HTML_IMAGE_ONLY_12 4034 0.80 2.23 0.28 126 XM_B_Unsub2 3935 3.07 2.17 3.39 127 XM_B_SpammyWords4 3815 0.93 2.10 0.51 128 T_XMHurry_00 3695 0.99 2.04 0.61 129 XM_URI_RBL 3646 0.66 2.01 0.17 130 RCVD_IN_IADB_LISTED 3579 4.93 1.97 5.99 131 BAYES_20 3540 2.97 1.95 3.33 132 TR_XM_SB_Phish 3537 1.97 1.95 1.97 133 FROM_SUSPICIOUS_NTLD 3431 0.55 1.89 0.07 134 URI_PHP_REDIR 3402 0.50 1.88 0.00 135 XMSubPhish11 3362 1.92 1.85 1.95 136 TR_XM_COVIDMETA1 3339 0.87 1.84 0.52 137 XM_UB999 3294 0.48 1.82 0.00 138 FROM_SUSPICIOUS_NTLD_FP 3283 0.52 1.81 0.06 139 RCVD_IN_RP_SAFE 3281 5.95 1.81 7.44 140 TR_XM_RelayPhish 3255 0.59 1.80 0.16 141 TR_XM_MaxBayes 3231 0.48 1.78 0.02 142 T_PDS_OTHER_BAD_TLD 3207 0.81 1.77 0.47 143 RCVD_IN_IADB_SPF 3160 4.28 1.74 5.19 144 XM_UB80 3130 0.48 1.73 0.04 145 TR_Mismatch_TLD_01 3049 0.69 1.68 0.34 146 HK_RANDOM_REPLYTO 3041 0.60 1.68 0.21 147 TR_XM_PHPDW 3024 0.74 1.67 0.41 148 T_XMDrugObfuBody_00 3016 1.02 1.66 0.79 149 XM_OfRef7 3012 0.52 1.66 0.11 150 RCVD_IN_IADB_DK 2968 3.72 1.64 4.46 151 RCVD_IN_IADB_SENDERID 2956 3.84 1.63 4.63 152 T_XMDrugObfuBody_14 2949 1.54 1.63 1.51 153 TR_XM_PHPForged 2945 0.71 1.62 0.39 154 TR_XM_FormFill2 2925 0.71 1.61 0.39 155 XMBdyGiftCard01 2923 0.90 1.61 0.64 156 XM_H_PHPOS 2910 0.70 1.61 0.38 157 TR_Symld_Words 2908 1.92 1.60 2.04 158 XM_BadFromFormat 2795 0.57 1.54 0.22 159 XMGenDplmaNmb 2792 1.12 1.54 0.97 160 XMStockSpam_06 2726 1.26 1.50 1.17 161 ADVANCE_FEE_3_NEW_MONEY 2678 0.42 1.48 0.04 162 MAILING_LIST_MULTI 2626 2.29 1.45 2.59 163 RELAYCOUNTRY_GB 2497 1.17 1.38 1.09 164 RELAYCOUNTRY_DE 2440 0.76 1.35 0.56 165 XMHTML_After_End 2425 0.95 1.34 0.81 166 T_Symld_Words_02 2424 0.89 1.34 0.72 167 RDNS_DYNAMIC 2417 0.77 1.33 0.56 168 RCVD_IN_RP_CERTIFIED 2363 5.35 1.30 6.80 169 RELAYCOUNTRY_IN 2350 0.43 1.30 0.12 170 ALL_TRUSTED 2328 9.50 1.28 12.44 171 XM_DK_Undo_01 2293 1.74 1.27 1.91 172 TR_XM_INV_DKIM 2194 0.40 1.21 0.11 173 XMSubNoVowel 2178 0.52 1.20 0.28 174 RELAYCOUNTRY_NL 2177 0.52 1.20 0.27 175 XMBody_78 2156 0.61 1.19 0.41 176 URI_NOVOWEL 2113 2.23 1.17 2.61 177 XMSexyCombo_04 2103 0.38 1.16 0.10 178 TR_MetaPhish_Combo_01 2090 0.80 1.15 0.67 179 DKIM_ADSP_NXDOMAIN 2077 0.83 1.15 0.71 180 BAYES_05 2015 1.84 1.11 2.10 181 MIME_CHARSET_FARAWAY 2014 0.47 1.11 0.24 182 NO_DNS_FOR_FROM 1989 0.69 1.10 0.54 183 FILL_THIS_FORM 1922 0.42 1.06 0.19 184 HTTPS_HTTP_MISMATCH 1896 0.87 1.05 0.80 185 XM_Combo_Sbj 1856 0.49 1.02 0.30 186 BAYES_00 1845 9.93 1.02 13.11 187 FILL_THIS_FORM_LONG 1826 0.35 1.01 0.11 188 DKIM_ADSP_CUSTOM_MED 1795 1.09 0.99 1.12 189 TR_Mismatch_TLD_02 1786 0.32 0.99 0.08 190 HTML_IMAGE_ONLY_32 1785 0.55 0.98 0.39 191 RELAYCOUNTRY_RU 1785 0.28 0.98 0.03 192 MONEY_FORM_SHORT 1767 0.29 0.97 0.05 193 XM_PDF 1735 3.61 0.96 4.56 194 XM_UB95 1727 0.26 0.95 0.01 195 XMMoneyMeta_00 1724 0.74 0.95 0.67 196 XMGppyBdWords 1720 0.35 0.95 0.14 197 LongTLD 1675 0.38 0.92 0.19 198 SENDGRID_REDIR 1653 0.61 0.91 0.50 199 XMPhish30 1652 0.49 0.91 0.35 200 CHARSET_FARAWAY_HEADER 1635 0.28 0.90 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 453950 89.85 90.74 89.53 2 RELAYCOUNTRY_US 421533 81.16 75.61 83.14 3 DKIM_SIGNED 402657 79.31 79.02 79.42 4 XM_DK_Pass 396446 77.32 74.88 78.19 5 DKIM_VALID 384870 75.14 72.99 75.91 6 XM_B_Unicode 364364 73.41 77.72 71.86 7 BAYES_50 288767 52.39 39.64 56.95 8 DCC_CHECK_NEGATIVE 288028 48.28 24.42 56.81 9 DKIM_VALID_AU 286675 56.11 54.89 56.54 10 XMListUnsubscribeExists 269955 56.72 66.43 53.24 11 XM_B_SpammyWords 254681 54.92 68.06 50.23 12 DCC_CHECK 207259 49.43 73.37 40.88 13 XM_B_Unicode3 203280 39.78 38.89 40.09 14 T_TM2_M_HEADER_IN_MSG 153690 28.75 24.39 30.31 15 RCVD_IN_MSPIKE_WL 151196 26.27 16.32 29.82 16 DKIM_VALID_EF 147029 28.48 27.03 29.00 17 HTML_FONT_LOW_CONTRAST 143001 29.33 32.49 28.20 18 RCVD_IN_MSPIKE_H2 137650 27.04 26.74 27.15 19 LOC_TINY_FONT_1 123804 26.61 32.76 24.42 20 FVGT_m_MULTI_ODD 119821 24.27 26.05 23.63 21 XM_B_SpammyWords2 112027 26.53 38.94 22.10 22 XMSubLong 108767 22.11 23.96 21.45 23 MIME_HTML_ONLY 101037 22.72 30.52 19.93 24 T_KAM_HTML_FONT_INVALID 100272 21.41 25.97 19.78 25 RCVD_IN_MSPIKE_H3 83989 14.43 8.46 16.57 26 XM_Body_Dirty_Words 66613 14.50 18.32 13.14 27 BAYES_00 66485 9.93 1.02 13.11 28 ALL_TRUSTED 63063 9.50 1.28 12.44 29 XM_Multi_Part_URI 60284 14.10 20.27 11.89 30 XM_B_Unsub 57427 11.19 10.82 11.33 31 RCVD_IN_MSPIKE_H4 55532 9.92 7.02 10.95 32 TR_XM_DK_Bayes 50130 7.45 0.62 9.89 33 TR_XM_DK_Bayes1 48589 7.22 0.60 9.58 34 LotsOfNums_01 46678 9.33 9.66 9.21 35 XM_Evil_Numbers_Gen 45842 9.16 9.49 9.04 36 TooManyTo_001 45457 8.15 5.87 8.97 37 XM_DK_Undo_02 45050 17.24 40.61 8.89 38 TR_XM_DK_Bayes2 43263 6.41 0.46 8.53 39 UNPARSEABLE_RELAY 42499 7.97 6.83 8.38 40 XM_DKIMWhitelistDomains 40128 5.83 0.00 7.91 41 XM_SendGrid 39246 7.19 5.66 7.74 42 RCVD_IN_RP_SAFE 37703 5.95 1.81 7.44 43 BAYES_60 37297 7.41 7.57 7.36 44 IN_ZIMBRA_NJ_WHITELIST 37231 5.42 0.04 7.34 45 LOTS_OF_MONEY 36108 9.56 16.38 7.12 46 RCVD_IN_RP_CERTIFIED 34489 5.35 1.30 6.80 47 HTML_IMAGE_RATIO_02 33664 7.32 9.23 6.64 48 XM_B_Phish_Phrases 32322 7.71 11.43 6.37 49 MIME_QP_LONG_LINE 31725 5.40 2.99 6.26 50 RCVD_IN_IADB_LISTED 30361 4.93 1.97 5.99 51 RELAYCOUNTRY_META 29590 10.30 22.80 5.84 52 XM_H_Long_From01 28149 5.27 4.47 5.55 53 BAYES_99 28127 12.61 32.38 5.55 54 FSL_BULK_SIG 27499 7.46 13.15 5.42 55 XM_B_SpammyWords3 27234 7.38 12.99 5.37 56 HTML_IMAGE_RATIO_04 26514 5.08 4.66 5.23 57 RCVD_IN_IADB_SPF 26326 4.28 1.74 5.19 58 BAYES_40 23824 4.14 2.57 4.70 59 TR_XM_DK_SendGrid 23768 4.29 3.18 4.69 60 RCVD_IN_IADB_SENDERID 23459 3.84 1.63 4.63 61 XM_PDF 23101 3.61 0.96 4.56 62 BAYES_999 22924 9.79 24.53 4.52 63 BOTNET_IPINHOSTNAME 22898 6.79 13.15 4.52 64 RCVD_IN_IADB_DK 22623 3.72 1.64 4.46 65 T_TooManySym_01 22112 3.92 2.70 4.36 66 XMStrtUSub 21815 4.24 4.08 4.30 67 BAYES_80 21539 5.43 8.74 4.25 68 RCVD_IN_IADB_VOUCHED 19251 3.03 0.87 3.80 69 XMSexyCombo_05 19204 5.29 9.51 3.79 70 MPART_ALT_DIFF 18817 4.68 7.38 3.71 71 T_REMOTE_IMAGE 18315 4.32 6.28 3.61 72 DKIM_INVALID 17787 4.17 6.03 3.51 73 XM_UncommonTLD01 17253 5.62 11.82 3.40 74 XM_B_Unsub2 17211 3.07 2.17 3.39 75 HTML_IMAGE_RATIO_06 17063 3.25 2.92 3.37 76 XMSubMetaSx_00 17060 4.22 6.60 3.36 77 XMNumbers 16929 3.44 3.72 3.34 78 BAYES_20 16894 2.97 1.95 3.33 79 TR_XM_PhishingBody 16297 3.93 5.92 3.21 80 FROM_EXCESS_BASE64 15158 2.97 2.91 2.99 81 TR_DCC_Bayes_99 14191 8.61 24.86 2.80 82 LH_URI_DOM_IN_PATH 13772 2.80 3.02 2.72 83 BAYES_95 13426 3.27 4.99 2.65 84 ANY_BOUNCE_MESSAGE 13256 3.04 4.22 2.61 85 BOUNCE_MESSAGE 13255 3.04 4.22 2.61 86 URI_NOVOWEL 13223 2.23 1.17 2.61 87 MAILING_LIST_MULTI 13153 2.29 1.45 2.59 88 RCVD_IN_IADB_OPTIN 12538 1.98 0.60 2.47 89 TM2_M_URI_OPT_OUT 12331 2.56 2.91 2.43 90 HTML_IMAGE_RATIO_08 11740 2.48 2.92 2.32 91 RCVD_IN_MSPIKE_H5 11675 1.92 0.84 2.30 92 T_TooManySym_02 11552 1.85 0.65 2.28 93 UNTRUSTED_Relay 11466 5.89 16.06 2.26 94 HTML_MIME_NO_HTML_TAG 11399 2.54 3.37 2.25 95 TooManyTo_002 11007 1.78 0.68 2.17 96 XM_B_Phish66 10810 2.50 3.53 2.13 97 BAYES_05 10648 1.84 1.11 2.10 98 XM_B_SpammyTLD 10489 2.52 3.79 2.07 99 MIME_HTML_MOSTLY 10413 2.94 5.43 2.05 100 TR_Symld_Words 10330 1.92 1.60 2.04 101 TR_XM_SB_Phish 10001 1.97 1.95 1.97 102 T_FONT_INVIS_NAKED_TO 9962 2.60 4.36 1.96 103 MIME_HTML_ONLY_MULTI 9902 2.12 2.58 1.95 104 XMSubPhish11 9872 1.92 1.85 1.95 105 XMDiploma_00 9707 2.24 3.15 1.91 106 XM_CamelCaseFrm001 9694 2.03 2.37 1.91 107 XM_DK_Undo_01 9674 1.74 1.27 1.91 108 BOTNET 9565 6.71 20.22 1.89 109 XM_SPF_SoftFail 9170 2.59 4.77 1.81 110 RELAYCOUNTRY_CA 9067 2.93 6.11 1.79 111 KHOP_HELO_FCRDNS 8952 2.98 6.38 1.77 112 RCVD_IN_BL_SPAMCOP_NET 8667 3.11 7.03 1.71 113 HELO_NODOT 8509 1.47 0.90 1.68 114 HELO_NO_DOMAIN 8505 1.47 0.89 1.68 115 TVD_RCVD_IP 8472 1.34 0.40 1.67 116 T_XMDrugObfuBody_08 8245 2.18 3.72 1.63 117 SUBJ_ALL_CAPS 8049 2.05 3.35 1.59 118 INVALID_MSGID 7927 1.24 0.34 1.56 119 IN_HORDE_ADDRESS_BOOK 7906 1.19 0.15 1.56 120 T_XMDrugObfuBody_14 7671 1.54 1.63 1.51 121 TooManyTo_003 7349 1.20 0.51 1.45 122 URI_TRY_3LD 6844 1.73 2.81 1.35 123 XM_H_Long_From02 6738 1.21 0.89 1.33 124 URI_HEX 6659 1.94 3.69 1.31 125 TR_XM_SpammyWords2 6571 4.11 11.99 1.30 126 XM_B_COVIDMETA 6559 2.12 4.45 1.29 127 TO_MALFORMED 6440 0.94 0.01 1.27 128 XMGappySubj_01 6377 0.96 0.13 1.26 129 XMCapTrack 6314 1.04 0.45 1.25 130 TM2_M_VERY_LONG_WORD 6300 1.53 2.33 1.24 131 XM_OfRef6 6147 2.22 5.04 1.21 132 HELO_MISC_IP 6017 0.96 0.31 1.19 133 CK_HELO_DYNAMIC_SPLIT_IP 6000 0.99 0.45 1.18 134 XM_UB50 5958 2.66 6.82 1.18 135 XMStockSpam_06 5912 1.26 1.50 1.17 136 XM_GoogleGroups 5890 0.97 0.42 1.16 137 DKIM_ADSP_CUSTOM_MED 5674 1.09 0.99 1.12 138 RELAYCOUNTRY_GB 5525 1.17 1.38 1.09 139 TooManyTo_004 5433 0.91 0.45 1.07 140 USER_IN_DEF_DKIM_WL 5430 0.79 0.00 1.07 141 XMBSHREFv2 5044 0.81 0.30 0.99 142 SpammyFromTLD_01 4926 2.08 5.19 0.97 143 XMGenDplmaNmb 4911 1.12 1.54 0.97 144 T_TooManySym_03 4871 0.76 0.18 0.96 145 XMBrknScrpt_02 4853 2.22 5.74 0.96 146 TR_MSPIKEBAYES00 4641 0.68 0.00 0.92 147 T_FILL_THIS_FORM_SHORT 4496 1.31 2.48 0.89 148 TooManyTo_005 4284 0.72 0.38 0.84 149 T_OBFU_PDF_ATTACH 4239 0.65 0.12 0.84 150 NML_ADSP_CUSTOM_MED 4135 0.83 0.88 0.82 151 XMHTML_After_End 4117 0.95 1.34 0.81 152 HTTPS_HTTP_MISMATCH 4079 0.87 1.05 0.80 153 T_XMDrugObfuBody_00 4013 1.02 1.66 0.79 154 XM_ShortIntro_01 3817 0.73 0.67 0.75 155 XMBody_17 3761 1.91 5.17 0.74 156 XMBody_95 3730 0.57 0.10 0.74 157 T_Symld_Words_02 3673 0.89 1.34 0.72 158 RCVD_IN_MSPIKE_BL 3611 3.59 11.65 0.71 159 DKIM_ADSP_NXDOMAIN 3605 0.83 1.15 0.71 160 XM_ProductURIs 3593 0.72 0.74 0.71 161 XM_SPF_Unknown 3455 0.73 0.88 0.68 162 TR_MetaPhish_Combo_01 3407 0.80 1.15 0.67 163 XMMoneyMeta_00 3379 0.74 0.95 0.67 164 XMBdyGiftCard01 3247 0.90 1.61 0.64 165 T_XMHurry_00 3106 0.99 2.04 0.61 166 XMNoVowels 3085 0.62 0.64 0.61 167 FROM_GOV_DKIM_AU 3067 0.46 0.07 0.60 168 XMHTMLBadTable_001 3027 0.65 0.80 0.60 169 FORGED_GMAIL_RCVD 2862 0.63 0.80 0.56 170 RDNS_DYNAMIC 2853 0.77 1.33 0.56 171 MISSING_HEADERS 2843 0.57 0.58 0.56 172 RELAYCOUNTRY_DE 2815 0.76 1.35 0.56 173 XMSubMetaI_00 2777 0.63 0.85 0.55 174 HTML_FONT_FACE_BAD 2753 0.61 0.78 0.54 175 XM_H_PHPMailer 2752 0.57 0.64 0.54 176 NO_DNS_FOR_FROM 2729 0.69 1.10 0.54 177 TR_XM_COVIDMETA1 2622 0.87 1.84 0.52 178 T_TooManySym_04 2617 0.39 0.05 0.52 179 XM_B_SpammyWords4 2591 0.93 2.10 0.51 180 XMSexyCombo_01 2583 0.98 2.28 0.51 181 XM_DIRTYINTL 2577 1.28 3.46 0.51 182 MPART_ALT_DIFF_COUNT 2545 0.56 0.71 0.50 183 RELAYCOUNTRY_AU 2518 0.55 0.70 0.50 184 SENDGRID_REDIR 2516 0.61 0.91 0.50 185 HTML_TAG_BALANCE_BODY 2502 0.50 0.53 0.49 186 TM2_M_BODY_EMPTY 2460 0.37 0.05 0.49 187 XMLngstWrd_00 2460 0.46 0.38 0.49 188 XM_B_REG_HTML 2438 0.46 0.40 0.48 189 RCVD_IN_SORBS_DUL 2416 0.42 0.25 0.48 190 T_PDS_OTHER_BAD_TLD 2390 0.81 1.77 0.47 191 TR_XM_UnparsRelay 2380 1.08 2.80 0.47 192 NUMERIC_HTTP_ADDR 2365 0.54 0.74 0.47 193 XMSubMetaSxObfu_03 2342 0.57 0.87 0.46 194 XM_B_COPY_HTML 2331 0.51 0.67 0.46 195 XM_S_SubURI 2303 0.35 0.05 0.45 196 RCVD_IN_MSPIKE_L3 2239 1.65 5.02 0.44 197 FROM_GOV_SPOOF 2204 0.37 0.19 0.43 198 XMSolicitRefs_0 2166 0.43 0.45 0.43 199 XMLngstWrd_01 2159 0.41 0.36 0.43 200 TR_LOTS_OF_MONEY3 2148 0.93 2.35 0.42 ----------------------------------------------------------------------