Email: 661901 Autolearn: 0 AvgScore: 3.36 AvgScanTime: 1.18 sec Spam: 188701 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 1.26 sec Ham: 473200 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 1.15 sec Time Spent Running SA: 216.79 hours Time Spent Processing Spam: 66.26 hours Time Spent Processing Ham: 150.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 177636 90.93 94.14 89.65 2 DCC_CHECK 146132 49.83 77.44 38.82 3 XM_B_Unicode 142328 72.20 75.43 70.91 4 DKIM_SIGNED 134081 75.20 71.05 76.85 5 XM_DK_Pass 130460 73.57 69.14 75.34 6 XM_B_SpammyWords 127288 54.33 67.45 49.09 7 DKIM_VALID 126832 71.34 67.21 72.98 8 RELAYCOUNTRY_US 123012 78.23 65.19 83.43 9 XMListUnsubscribeExists 116644 52.91 61.81 49.36 10 DKIM_VALID_AU 99371 54.72 52.66 55.54 11 XM_B_Unicode3 81507 41.30 43.19 40.54 12 HTML_FONT_LOW_CONTRAST 73154 30.92 38.77 27.79 13 XM_DK_Undo_02 72867 17.09 38.62 8.51 14 MIME_HTML_ONLY 70813 25.15 37.53 20.22 15 BAYES_99 64026 13.69 33.93 5.62 16 XM_B_SpammyWords2 63362 25.74 33.58 22.61 17 BAYES_50 61078 48.85 32.37 55.43 18 LOC_TINY_FONT_1 57495 26.11 30.47 24.38 19 BAYES_999 51184 11.03 27.12 4.61 20 TR_DCC_Bayes_99 50472 9.81 26.75 3.06 21 DKIM_VALID_EF 48493 28.52 25.70 29.65 22 T_KAM_HTML_FONT_INVALID 46674 19.79 24.73 17.82 23 RCVD_IN_MSPIKE_H2 44916 26.12 23.80 27.04 24 RELAYCOUNTRY_META 44787 10.63 23.73 5.40 25 FVGT_m_MULTI_ODD 44123 22.87 23.38 22.66 26 XMSubLong 40153 21.31 21.28 21.32 27 DCC_CHECK_NEGATIVE 39787 48.24 21.08 59.07 28 T_TM2_M_HEADER_IN_MSG 38978 27.46 20.66 30.17 29 FSL_BULK_SIG 38106 9.65 20.19 5.45 30 UNTRUSTED_Relay 37234 7.20 19.73 2.20 31 XM_B_Unsub 32399 13.18 17.17 11.59 32 XM_Multi_Part_URI 32203 13.38 17.07 11.91 33 BOTNET 29930 5.86 15.86 1.86 34 XM_Body_Dirty_Words 29280 13.88 15.52 13.22 35 RCVD_IN_MSPIKE_WL 27237 23.92 14.43 27.71 36 TooManyTo_001 27120 10.32 14.37 8.70 37 BAYES_80 26550 7.04 14.07 4.24 38 LOTS_OF_MONEY 24313 9.04 12.88 7.51 39 TR_XM_SpammyWords2 24106 4.96 12.77 1.84 40 BOTNET_IPINHOSTNAME 23783 6.82 12.60 4.52 41 XM_UncommonTLD01 22229 5.75 11.78 3.34 42 RCVD_IN_MSPIKE_BL 20162 3.61 10.68 0.79 43 XMDiploma_00 20153 4.32 10.68 1.79 44 XM_B_SpammyWords3 19931 7.29 10.56 5.99 45 XMGenDplmaNmb 17679 3.29 9.37 0.86 46 ALL_TRUSTED 17362 11.67 9.20 12.65 47 T_REMOTE_IMAGE 17256 5.18 9.14 3.60 48 XMSexyCombo_05 16851 5.60 8.93 4.27 49 LotsOfNums_01 16724 8.42 8.86 8.24 50 XM_B_Phish_Phrases 16405 7.13 8.69 6.51 51 XM_Combo_Sbj 16269 2.64 8.62 0.25 52 BAYES_60 16041 7.48 8.50 7.07 53 KHOP_HELO_FCRDNS 15879 3.66 8.41 1.76 54 MPART_ALT_DIFF 15558 5.61 8.24 4.56 55 XMBrknScrpt_02 15521 3.17 8.23 1.15 56 XMOemUri 15440 2.53 8.18 0.27 57 TM2_M_OBFU_COMMENT 15206 2.32 8.06 0.04 58 XM_Evil_Numbers_Gen 15199 8.36 8.05 8.49 59 RCVD_IN_MSPIKE_H3 14299 13.44 7.58 15.78 60 XM_UB50 14228 2.97 7.54 1.15 61 HTML_IMAGE_ONLY_12 13341 2.23 7.07 0.29 62 BODY_URI_ONLY 13174 2.05 6.98 0.08 63 HTML_SHORT_LINK_IMG_1 12750 1.97 6.76 0.07 64 RCVD_IN_BL_SPAMCOP_NET 12744 2.68 6.75 1.05 65 HTML_IMAGE_RATIO_02 12489 6.63 6.62 6.63 66 XMSubMetaSx_00 12103 4.52 6.41 3.76 67 RCVD_IN_MSPIKE_H4 12002 8.87 6.36 9.87 68 TR_XM_SpammyWords3 11305 2.06 5.99 0.49 69 TR_XM_PhishingBody 11088 4.08 5.88 3.36 70 MIME_HTML_MOSTLY 11040 3.35 5.85 2.35 71 RCVD_IN_RP_RNBL 10618 1.66 5.63 0.08 72 RCVD_IN_MSPIKE_L3 10543 1.98 5.59 0.54 73 BAYES_95 10427 3.37 5.53 2.50 74 UNPARSEABLE_RELAY 9908 7.30 5.25 8.11 75 XMNumbers 9873 4.04 5.23 3.57 76 RELAYCOUNTRY_CA 9744 2.57 5.16 1.54 77 XM_H_Long_From01 9739 5.14 5.16 5.13 78 SpammyFromTLD_01 8795 2.03 4.66 0.97 79 XM_UB99 8709 1.33 4.62 0.02 80 XM_SPF_SoftFail 8582 2.51 4.55 1.70 81 URIBL_SBL_A 7685 1.29 4.07 0.18 82 HTML_IMAGE_RATIO_04 7609 4.63 4.03 4.87 83 XM_SendGrid 7546 6.49 4.00 7.48 84 RCVD_IN_MSPIKE_L5 7483 1.28 3.97 0.21 85 DKIM_INVALID 7249 3.86 3.84 3.87 86 XM_UB60 7232 1.16 3.83 0.09 87 SpammyFromTLD_02 7163 1.23 3.80 0.21 88 T_FONT_INVIS_NAKED_TO 7078 2.44 3.75 1.92 89 HTML_IMAGE_RATIO_08 7070 3.07 3.75 2.79 90 XM_OfRef6 6954 2.03 3.69 1.36 91 XM_UB999 6890 1.05 3.65 0.02 92 RCVD_IN_PSBL 6857 1.05 3.63 0.02 93 TR_LOTS_OF_MONEY3 6822 1.87 3.62 1.17 94 XM_B_Phish66 6738 2.69 3.57 2.34 95 SUBJ_ALL_CAPS 6582 2.15 3.49 1.62 96 XM_B_SpammyTLD 6580 2.40 3.49 1.96 97 XMBody_17 6564 1.55 3.48 0.78 98 HTML_IMAGE_RATIO_06 6488 3.96 3.44 4.17 99 XM_B_COVIDMETA 6478 1.78 3.43 1.12 100 RELAYCOUNTRY_FR 6074 1.10 3.22 0.26 101 XMStrtUSub 5622 4.76 2.98 5.48 102 TR_XM_MaxSPIKE 5507 0.84 2.92 0.01 103 T_XMDrugObfuBody_08 5315 1.94 2.82 1.59 104 TR_XM_MaxBayes 5283 0.81 2.80 0.02 105 TM2_M_URI_OPT_OUT 5116 2.80 2.71 2.84 106 MIME_HTML_ONLY_MULTI 5072 2.78 2.69 2.81 107 XM_DIRTYINTL 4837 1.15 2.56 0.59 108 BOTNET_NORDNS 4833 0.74 2.56 0.02 109 URI_TRY_3LD 4785 1.72 2.54 1.39 110 HTML_FONT_SIZE_LARGE 4736 0.82 2.51 0.15 111 RELAYCOUNTRY_UA 4705 0.72 2.49 0.01 112 FROM_EXCESS_BASE64 4537 2.31 2.40 2.28 113 XM_B_SpammyWords4 4421 1.04 2.34 0.52 114 TM2_M_VERY_LONG_WORD 4292 1.51 2.27 1.21 115 LH_URI_DOM_IN_PATH 4156 2.22 2.20 2.22 116 URI_PHP_REDIR 4127 0.63 2.19 0.01 117 TR_XM_DK_SendGrid 4065 3.92 2.15 4.63 118 RCVD_IN_RP_SAFE 4005 6.08 2.12 7.66 119 T_XMDrugObfuBody_00 3910 1.02 2.07 0.60 120 DATE_IN_PAST_03_06 3894 0.66 2.06 0.10 121 TR_XM_UnparsRelay 3754 0.82 1.99 0.35 122 URI_HEX 3688 1.57 1.95 1.41 123 XM_CamelCaseFrm001 3663 1.76 1.94 1.69 124 MIME_QP_LONG_LINE 3632 4.42 1.92 5.41 125 T_TooManySym_01 3628 3.91 1.92 4.70 126 XMSubNoVowel 3606 1.36 1.91 1.14 127 T_XMHurry_00 3574 0.97 1.89 0.60 128 XMSexyCombo_01 3553 1.22 1.88 0.95 129 TR_XM_COVIDMETA4 3525 0.81 1.87 0.39 130 BAYES_40 3514 4.05 1.86 4.92 131 HTML_MIME_NO_HTML_TAG 3513 2.41 1.86 2.63 132 XM_UB80 3508 0.55 1.86 0.02 133 MIME_CHARSET_FARAWAY 3470 0.61 1.84 0.11 134 TR_XM_SB_Phish 3234 2.10 1.71 2.26 135 XM_URI_RBL 3202 0.61 1.70 0.18 136 RELAYCOUNTRY_IN 3201 0.58 1.70 0.13 137 BAYES_20 3161 3.15 1.68 3.73 138 XMSubPhish11 3093 2.05 1.64 2.22 139 RCVD_IN_RP_CERTIFIED 3074 5.52 1.63 7.07 140 XM_B_Unsub2 3021 2.38 1.60 2.70 141 T_FILL_THIS_FORM_SHORT 3010 1.11 1.60 0.92 142 MIMEOLE_DIRECT_TO_MX 2993 0.45 1.59 0.00 143 TR_XM_PHPDW 2883 0.68 1.53 0.34 144 TR_XM_PHPForged 2870 0.66 1.52 0.32 145 XMStockSpam_06 2847 1.35 1.51 1.28 146 TR_XM_FormFill2 2833 0.66 1.50 0.32 147 XM_H_PHPOS 2823 0.65 1.50 0.31 148 TR_Symld_Words 2809 1.79 1.49 1.91 149 RCVD_IN_IADB_LISTED 2724 4.11 1.44 5.17 150 DKIM_ADSP_CUSTOM_MED 2665 1.32 1.41 1.28 151 CHARSET_FARAWAY_HEADER 2618 0.42 1.39 0.04 152 T_PDS_OTHER_BAD_TLD 2609 0.80 1.38 0.56 153 DOS_OE_TO_MX 2569 0.39 1.36 0.00 154 XM_SPF_Unknown 2548 0.94 1.35 0.78 155 TR_Caps_n_Bayes_99 2541 0.49 1.35 0.14 156 NML_ADSP_CUSTOM_MED 2502 1.07 1.33 0.96 157 TR_XM_INV_DKIM 2479 0.46 1.31 0.11 158 FROM_SUSPICIOUS_NTLD 2477 0.43 1.31 0.08 159 NUMERIC_HTTP_ADDR 2453 0.71 1.30 0.48 160 RELAYCOUNTRY_HK 2360 0.37 1.25 0.02 161 RCVD_IN_IADB_SPF 2334 3.60 1.24 4.54 162 XMSubMetaI_00 2325 0.96 1.23 0.85 163 FROM_SUSPICIOUS_NTLD_FP 2313 0.40 1.23 0.07 164 T_XMDrugObfuBody_14 2273 1.46 1.20 1.57 165 XMGppyBdWords 2252 0.46 1.19 0.16 166 XMBdyGiftCard01 2248 0.63 1.19 0.41 167 XMBody_78 2201 0.65 1.17 0.44 168 URI_NOVOWEL 2181 1.98 1.16 2.31 169 RCVD_IN_IADB_SENDERID 2178 3.26 1.15 4.10 170 NO_FM_NAME_IP_HOSTN 2169 0.33 1.15 0.00 171 RCVD_IN_IADB_DK 2156 3.18 1.14 3.99 172 RDNS_DYNAMIC 2138 0.70 1.13 0.52 173 SUBJ_BUY 2130 0.36 1.13 0.05 174 XM_PDF 2111 4.09 1.12 5.27 175 TR_Mismatch_TLD_02 2075 0.36 1.10 0.07 176 RELAYCOUNTRY_GB 2054 1.13 1.09 1.15 177 PDS_FROM_2_EMAILS 2045 0.36 1.08 0.07 178 FORGED_GMAIL_RCVD 2020 0.68 1.07 0.53 179 TR_XM_RelayPhish 2017 0.40 1.07 0.13 180 URI_IN_URI_5 2009 0.34 1.06 0.06 181 XMHTML_After_End 1993 0.90 1.06 0.84 182 NORMAL_HTTP_TO_IP 1964 0.32 1.04 0.03 183 BAYES_00 1963 10.40 1.04 14.14 184 FROM_2_EMAILS_SHORT 1946 0.30 1.03 0.00 185 XM_UB95 1942 0.30 1.03 0.01 186 BAYES_05 1939 1.97 1.03 2.34 187 REMOVE_BEFORE_LINK 1912 0.47 1.01 0.26 188 TR_XM_COVIDMETA1 1874 0.45 0.99 0.24 189 RELAYCOUNTRY_NL 1872 0.44 0.99 0.21 190 PDS_TO_EQ_FROM_NAME 1863 0.28 0.99 0.00 191 SUBJ_DOLLARS 1860 0.48 0.99 0.27 192 T_Symld_Words_02 1851 0.70 0.98 0.59 193 TR_LOTS_OF_MONEY2 1798 0.47 0.95 0.27 194 T_MONEY_PERCENT 1798 0.47 0.95 0.27 195 XMSubMetaD_00 1783 0.33 0.94 0.08 196 DATE_IN_PAST_06_12 1745 0.38 0.92 0.17 197 TR_MetaPhish_Combo_01 1742 0.83 0.92 0.79 198 HK_RANDOM_REPLYTO 1738 0.41 0.92 0.21 199 RCVD_IN_MSPIKE_L4 1734 0.29 0.92 0.04 200 MAILING_LIST_MULTI 1712 2.26 0.91 2.80 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 424221 90.93 94.14 89.65 2 RELAYCOUNTRY_US 394808 78.23 65.19 83.43 3 DKIM_SIGNED 363655 75.20 71.05 76.85 4 XM_DK_Pass 356516 73.57 69.14 75.34 5 DKIM_VALID 345339 71.34 67.21 72.98 6 XM_B_Unicode 335550 72.20 75.43 70.91 7 DCC_CHECK_NEGATIVE 279517 48.24 21.08 59.07 8 DKIM_VALID_AU 262792 54.72 52.66 55.54 9 BAYES_50 262284 48.85 32.37 55.43 10 XMListUnsubscribeExists 233564 52.91 61.81 49.36 11 XM_B_SpammyWords 232311 54.33 67.45 49.09 12 XM_B_Unicode3 191850 41.30 43.19 40.54 13 DCC_CHECK 183681 49.83 77.44 38.82 14 T_TM2_M_HEADER_IN_MSG 142775 27.46 20.66 30.17 15 DKIM_VALID_EF 140307 28.52 25.70 29.65 16 HTML_FONT_LOW_CONTRAST 131494 30.92 38.77 27.79 17 RCVD_IN_MSPIKE_WL 131115 23.92 14.43 27.71 18 RCVD_IN_MSPIKE_H2 127969 26.12 23.80 27.04 19 LOC_TINY_FONT_1 115347 26.11 30.47 24.38 20 FVGT_m_MULTI_ODD 107248 22.87 23.38 22.66 21 XM_B_SpammyWords2 107010 25.74 33.58 22.61 22 XMSubLong 100890 21.31 21.28 21.32 23 MIME_HTML_ONLY 95671 25.15 37.53 20.22 24 T_KAM_HTML_FONT_INVALID 84325 19.79 24.73 17.82 25 RCVD_IN_MSPIKE_H3 74693 13.44 7.58 15.78 26 BAYES_00 66899 10.40 1.04 14.14 27 XM_Body_Dirty_Words 62572 13.88 15.52 13.22 28 ALL_TRUSTED 59867 11.67 9.20 12.65 29 XM_Multi_Part_URI 56368 13.38 17.07 11.91 30 XM_B_Unsub 54845 13.18 17.17 11.59 31 RCVD_IN_MSPIKE_H4 46711 8.87 6.36 9.87 32 TR_XM_DK_Bayes 45009 6.99 0.65 9.51 33 TR_XM_DK_Bayes1 43536 6.76 0.64 9.20 34 TooManyTo_001 41182 10.32 14.37 8.70 35 XM_DKIMWhitelistDomains 40339 6.10 0.03 8.52 36 XM_DK_Undo_02 40249 17.09 38.62 8.51 37 XM_Evil_Numbers_Gen 40160 8.36 8.05 8.49 38 LotsOfNums_01 38977 8.42 8.86 8.24 39 UNPARSEABLE_RELAY 38384 7.30 5.25 8.11 40 TR_XM_DK_Bayes2 38241 5.90 0.43 8.08 41 RCVD_IN_RP_SAFE 36250 6.08 2.12 7.66 42 LOTS_OF_MONEY 35533 9.04 12.88 7.51 43 XM_SendGrid 35407 6.49 4.00 7.48 44 IN_ZIMBRA_NJ_WHITELIST 34283 5.20 0.06 7.24 45 RCVD_IN_RP_CERTIFIED 33469 5.52 1.63 7.07 46 BAYES_60 33467 7.48 8.50 7.07 47 HTML_IMAGE_RATIO_02 31391 6.63 6.62 6.63 48 XM_B_Phish_Phrases 30816 7.13 8.69 6.51 49 XM_B_SpammyWords3 28345 7.29 10.56 5.99 50 BAYES_99 26582 13.69 33.93 5.62 51 XMStrtUSub 25915 4.76 2.98 5.48 52 FSL_BULK_SIG 25767 9.65 20.19 5.45 53 MIME_QP_LONG_LINE 25605 4.42 1.92 5.41 54 RELAYCOUNTRY_META 25540 10.63 23.73 5.40 55 XM_PDF 24947 4.09 1.12 5.27 56 RCVD_IN_IADB_LISTED 24460 4.11 1.44 5.17 57 XM_H_Long_From01 24272 5.14 5.16 5.13 58 BAYES_40 23279 4.05 1.86 4.92 59 HTML_IMAGE_RATIO_04 23035 4.63 4.03 4.87 60 T_TooManySym_01 22243 3.91 1.92 4.70 61 TR_XM_DK_SendGrid 21907 3.92 2.15 4.63 62 BAYES_999 21804 11.03 27.12 4.61 63 MPART_ALT_DIFF 21587 5.61 8.24 4.56 64 RCVD_IN_IADB_SPF 21484 3.60 1.24 4.54 65 BOTNET_IPINHOSTNAME 21368 6.82 12.60 4.52 66 XMSexyCombo_05 20209 5.60 8.93 4.27 67 BAYES_80 20067 7.04 14.07 4.24 68 HTML_IMAGE_RATIO_06 19709 3.96 3.44 4.17 69 RCVD_IN_IADB_SENDERID 19407 3.26 1.15 4.10 70 RCVD_IN_IADB_DK 18864 3.18 1.14 3.99 71 DKIM_INVALID 18316 3.86 3.84 3.87 72 XMSubMetaSx_00 17782 4.52 6.41 3.76 73 BAYES_20 17663 3.15 1.68 3.73 74 T_REMOTE_IMAGE 17020 5.18 9.14 3.60 75 XMNumbers 16882 4.04 5.23 3.57 76 TR_XM_PhishingBody 15916 4.08 5.88 3.36 77 XM_UncommonTLD01 15818 5.75 11.78 3.34 78 TR_DCC_Bayes_99 14486 9.81 26.75 3.06 79 RCVD_IN_IADB_VOUCHED 14285 2.36 0.71 3.02 80 XM_H_Trusted_IP 14194 2.14 0.00 3.00 81 TM2_M_URI_OPT_OUT 13432 2.80 2.71 2.84 82 MIME_HTML_ONLY_MULTI 13314 2.78 2.69 2.81 83 MAILING_LIST_MULTI 13259 2.26 0.91 2.80 84 HTML_IMAGE_RATIO_08 13221 3.07 3.75 2.79 85 XM_B_Unsub2 12757 2.38 1.60 2.70 86 HTML_MIME_NO_HTML_TAG 12430 2.41 1.86 2.63 87 BAYES_95 11851 3.37 5.53 2.50 88 T_TooManySym_02 11692 1.91 0.50 2.47 89 MIME_HTML_MOSTLY 11122 3.35 5.85 2.35 90 BAYES_05 11093 1.97 1.03 2.34 91 XM_B_Phish66 11058 2.69 3.57 2.34 92 URI_NOVOWEL 10947 1.98 1.16 2.31 93 TooManyTo_002 10798 1.81 0.61 2.28 94 FROM_EXCESS_BASE64 10786 2.31 2.40 2.28 95 TR_XM_SB_Phish 10671 2.10 1.71 2.26 96 LH_URI_DOM_IN_PATH 10511 2.22 2.20 2.22 97 XMSubPhish11 10506 2.05 1.64 2.22 98 UNTRUSTED_Relay 10413 7.20 19.73 2.20 99 ANY_BOUNCE_MESSAGE 10163 1.78 0.86 2.15 100 BOUNCE_MESSAGE 10163 1.78 0.86 2.15 101 RCVD_IN_MSPIKE_H5 9711 1.61 0.50 2.05 102 XM_DK_Undo_01 9554 1.68 0.83 2.02 103 XM_B_SpammyTLD 9298 2.40 3.49 1.96 104 RCVD_IN_IADB_OPTIN 9291 1.55 0.50 1.96 105 T_FONT_INVIS_NAKED_TO 9099 2.44 3.75 1.92 106 TR_Symld_Words 9027 1.79 1.49 1.91 107 BOTNET 8825 5.86 15.86 1.86 108 TR_XM_SpammyWords2 8722 4.96 12.77 1.84 109 HELO_NODOT 8641 1.51 0.73 1.83 110 HELO_NO_DOMAIN 8637 1.51 0.73 1.83 111 XMDiploma_00 8458 4.32 10.68 1.79 112 KHOP_HELO_FCRDNS 8324 3.66 8.41 1.76 113 XM_SPF_SoftFail 8023 2.51 4.55 1.70 114 XM_CamelCaseFrm001 7993 1.76 1.94 1.69 115 SUBJ_ALL_CAPS 7677 2.15 3.49 1.62 116 T_XMDrugObfuBody_08 7542 1.94 2.82 1.59 117 IN_HORDE_ADDRESS_BOOK 7493 1.18 0.18 1.58 118 T_XMDrugObfuBody_14 7409 1.46 1.20 1.57 119 TVD_RCVD_IP 7390 1.22 0.37 1.56 120 RELAYCOUNTRY_CA 7270 2.57 5.16 1.54 121 TooManyTo_003 7242 1.22 0.44 1.53 122 INVALID_MSGID 7169 1.26 0.61 1.52 123 USER_IN_DEF_DKIM_WL 7115 1.08 0.01 1.50 124 URI_HEX 6678 1.57 1.95 1.41 125 URI_TRY_3LD 6569 1.72 2.54 1.39 126 TO_MALFORMED 6489 0.98 0.01 1.37 127 XM_OfRef6 6451 2.03 3.69 1.36 128 XMCapTrack 6392 1.06 0.32 1.35 129 HELO_MISC_IP 6144 1.03 0.36 1.30 130 CK_HELO_DYNAMIC_SPLIT_IP 6142 1.10 0.62 1.30 131 XMStockSpam_06 6069 1.35 1.51 1.28 132 DKIM_ADSP_CUSTOM_MED 6067 1.32 1.41 1.28 133 HTML_FONT_FACE_BAD 5970 1.08 0.64 1.26 134 XM_GoogleGroups 5967 1.00 0.36 1.26 135 TM2_M_VERY_LONG_WORD 5705 1.51 2.27 1.21 136 XMGappySubj_01 5677 0.90 0.13 1.20 137 XMBody_95 5557 0.86 0.08 1.17 138 TR_LOTS_OF_MONEY3 5524 1.87 3.62 1.17 139 XM_UB50 5455 2.97 7.54 1.15 140 RELAYCOUNTRY_GB 5455 1.13 1.09 1.15 141 XMBrknScrpt_02 5432 3.17 8.23 1.15 142 XMSubNoVowel 5407 1.36 1.91 1.14 143 XM_ProductURIs 5373 1.01 0.70 1.14 144 XM_B_COVIDMETA 5286 1.78 3.43 1.12 145 TooManyTo_004 5201 0.90 0.39 1.10 146 RCVD_IN_BL_SPAMCOP_NET 4982 2.68 6.75 1.05 147 XM_H_Long_From02 4957 0.94 0.66 1.05 148 XMBSHREFv2 4874 0.82 0.28 1.03 149 SpammyFromTLD_01 4610 2.03 4.66 0.97 150 NML_ADSP_CUSTOM_MED 4563 1.07 1.33 0.96 151 XMSexyCombo_01 4498 1.22 1.88 0.95 152 T_TooManySym_03 4470 0.71 0.12 0.94 153 TooManyTo_005 4373 0.76 0.35 0.92 154 T_FILL_THIS_FORM_SHORT 4360 1.11 1.60 0.92 155 HTTPS_HTTP_MISMATCH 4290 0.87 0.79 0.91 156 XMGenDplmaNmb 4080 3.29 9.37 0.86 157 XMSubMetaI_00 4023 0.96 1.23 0.85 158 XMHTML_After_End 3994 0.90 1.06 0.84 159 TR_MetaPhish_Combo_01 3753 0.83 0.92 0.79 160 RCVD_IN_MSPIKE_BL 3726 3.61 10.68 0.79 161 XMBody_17 3697 1.55 3.48 0.78 162 XM_SPF_Unknown 3695 0.94 1.35 0.78 163 T_OBFU_PDF_ATTACH 3554 0.61 0.27 0.75 164 XM_ShortIntro_01 3530 0.66 0.43 0.75 165 XM_E_Blogspot 3334 0.52 0.06 0.70 166 RELAYCOUNTRY_DE 3332 0.75 0.88 0.70 167 TR_MSPIKEBAYES00 3068 0.47 0.02 0.65 168 XM_RXBody 2991 0.52 0.25 0.63 169 XMHTMLBadTable_001 2863 0.64 0.74 0.61 170 T_XMDrugObfuBody_00 2839 1.02 2.07 0.60 171 T_XMHurry_00 2828 0.97 1.89 0.60 172 XMNoVowels 2814 0.51 0.29 0.59 173 XM_DIRTYINTL 2795 1.15 2.56 0.59 174 T_Symld_Words_02 2781 0.70 0.98 0.59 175 DKIM_ADSP_NXDOMAIN 2762 0.64 0.79 0.58 176 T_PDS_OTHER_BAD_TLD 2667 0.80 1.38 0.56 177 XMSexyCombo_04 2623 0.60 0.73 0.55 178 T_TooManySym_04 2586 0.40 0.05 0.55 179 XMMoneyMeta_00 2577 0.61 0.77 0.54 180 HTML_IMAGE_ONLY_20 2575 0.54 0.54 0.54 181 RCVD_IN_SORBS_DUL 2559 0.51 0.43 0.54 182 PLING_QUERY 2557 0.48 0.34 0.54 183 RCVD_IN_MSPIKE_L3 2535 1.98 5.59 0.54 184 MSGID_FROM_MTA_HEADER 2491 0.41 0.12 0.53 185 FROM_GOV_DKIM_AU 2485 0.39 0.05 0.53 186 FORGED_GMAIL_RCVD 2485 0.68 1.07 0.53 187 TM2_M_BODY_EMPTY 2482 0.39 0.07 0.52 188 RDNS_DYNAMIC 2468 0.70 1.13 0.52 189 XM_H_PHPMailer 2453 0.53 0.55 0.52 190 XM_B_SpammyWords4 2442 1.04 2.34 0.52 191 MPART_ALT_DIFF_COUNT 2442 0.60 0.82 0.52 192 NO_DNS_FOR_FROM 2438 0.56 0.68 0.52 193 HTML_TAG_BALANCE_BODY 2331 0.54 0.64 0.49 194 SHORT_HELO_AND_INLINE_IMAGE 2311 0.37 0.06 0.49 195 TR_XM_SpammyWords3 2308 2.06 5.99 0.49 196 XM_B_REG_HTML 2294 0.45 0.37 0.48 197 MISSING_HEADERS 2278 0.46 0.41 0.48 198 XM_S_SubURI 2270 0.35 0.04 0.48 199 NUMERIC_HTTP_ADDR 2255 0.71 1.30 0.48 200 XMSubMetaSxObfu_04 2211 0.47 0.47 0.47 ----------------------------------------------------------------------