Email: 659382 Autolearn: 0 AvgScore: 3.16 AvgScanTime: 1.21 sec Spam: 179960 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 1.32 sec Ham: 479422 Autolearn: 0 AvgScore: -0.76 AvgScanTime: 1.16 sec Time Spent Running SA: 221.04 hours Time Spent Processing Spam: 66.22 hours Time Spent Processing Ham: 154.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171880 90.82 95.51 89.06 2 DKIM_SIGNED 141558 76.61 78.66 75.84 3 DCC_CHECK 139560 48.49 77.55 37.58 4 XM_DK_Pass 137615 75.11 76.47 74.60 5 DKIM_VALID 134435 73.00 74.70 72.36 6 XM_B_Unicode 131998 70.45 73.35 69.36 7 RELAYCOUNTRY_US 127579 79.39 70.89 82.58 8 XMListUnsubscribeExists 118575 53.17 65.89 48.40 9 XM_B_SpammyWords 117496 52.92 65.29 48.28 10 DKIM_VALID_AU 105562 55.28 58.66 54.01 11 XM_DK_Undo_02 79895 17.33 44.40 7.18 12 XM_B_Unicode3 67677 38.48 37.61 38.80 13 XM_B_SpammyWords2 67035 25.90 37.25 21.63 14 TR_XM_DKIM_Undo 64332 13.72 35.75 5.45 15 BAYES_99 62915 13.02 34.96 4.78 16 BAYES_50 62187 50.43 34.56 56.38 17 HTML_FONT_LOW_CONTRAST 59364 28.52 32.99 26.84 18 LOC_TINY_FONT_1 59233 25.80 32.91 23.12 19 MIME_HTML_ONLY 57377 23.75 31.88 20.70 20 DKIM_VALID_EF 49364 29.12 27.43 29.75 21 FVGT_m_MULTI_ODD 48202 23.32 26.78 22.02 22 BAYES_999 48184 10.08 26.77 3.81 23 RELAYCOUNTRY_META 47678 10.87 26.49 5.01 24 TR_DCC_Bayes_99 47069 8.92 26.16 2.45 25 T_KAM_HTML_FONT_INVALID 45640 19.90 25.36 17.85 26 RCVD_IN_MSPIKE_H2 44752 27.17 24.87 28.04 27 XMSubLong 43971 21.58 24.43 20.52 28 T_TM2_M_HEADER_IN_MSG 41691 29.50 23.17 31.87 29 UNTRUSTED_Relay 38195 7.30 21.22 2.07 30 DCC_CHECK_NEGATIVE 36859 49.57 20.48 60.48 31 XM_Multi_Part_URI 34143 13.74 18.97 11.77 32 XM_Body_Dirty_Words 31951 14.55 17.75 13.35 33 BOTNET 31847 5.89 17.70 1.45 34 RCVD_IN_MSPIKE_WL 30035 24.48 16.69 27.40 35 FSL_BULK_SIG 29267 8.26 16.26 5.26 36 TR_XM_SpammyWords2 24847 4.48 13.81 0.98 37 XM_B_Unsub 24654 11.93 13.70 11.27 38 BOTNET_IPINHOSTNAME 23776 6.64 13.21 4.17 39 XM_B_SpammyWords3 21361 7.29 11.87 5.57 40 LOTS_OF_MONEY 20615 8.73 11.46 7.71 41 XM_UncommonTLD01 18924 5.27 10.52 3.30 42 RCVD_IN_MSPIKE_BL 18669 3.40 10.37 0.78 43 LotsOfNums_01 18037 8.94 10.02 8.53 44 XM_B_Phish_Phrases 17906 7.91 9.95 7.14 45 XMSexyCombo_05 17626 5.61 9.79 4.04 46 BAYES_80 17402 5.56 9.67 4.01 47 RCVD_IN_MSPIKE_H3 16977 13.71 9.43 15.32 48 XM_Evil_Numbers_Gen 16799 8.58 9.33 8.30 49 T_REMOTE_IMAGE 16291 5.11 9.05 3.63 50 HTML_SHORT_LINK_IMG_1 14959 2.32 8.31 0.07 51 BAYES_60 14938 7.07 8.30 6.61 52 MPART_ALT_DIFF 14875 5.77 8.27 4.84 53 HTML_IMAGE_ONLY_12 14220 2.39 7.90 0.32 54 KHOP_HELO_FCRDNS 13962 3.40 7.76 1.77 55 HTML_IMAGE_RATIO_02 13896 7.07 7.72 6.83 56 RCVD_IN_BL_SPAMCOP_NET 13596 2.75 7.56 0.95 57 XM_UB50 12874 2.72 7.15 1.06 58 BODY_URI_ONLY 12711 1.99 7.06 0.09 59 XMSubMetaSx_00 11566 4.02 6.43 3.12 60 RCVD_IN_MSPIKE_H4 11426 8.90 6.35 9.85 61 MIME_HTML_MOSTLY 11081 3.36 6.16 2.31 62 XMBrknScrpt_02 10957 2.31 6.09 0.90 63 RCVD_IN_MSPIKE_L3 10641 1.97 5.91 0.48 64 TR_XM_SpammyWords3 10319 1.93 5.73 0.51 65 TooManyTo_001 10203 7.88 5.67 8.71 66 BAYES_95 10042 3.42 5.58 2.61 67 RELAYCOUNTRY_CA 9816 2.59 5.45 1.51 68 URIBL_SBL_A 9621 1.61 5.35 0.20 69 XM_H_Long_From01 9560 5.45 5.31 5.50 70 TR_XM_PhishingBody 9527 3.80 5.29 3.24 71 XMBody_17 9006 1.86 5.00 0.69 72 UNPARSEABLE_RELAY 9004 7.35 5.00 8.22 73 SpammyFromTLD_01 8571 1.95 4.76 0.90 74 XM_OfRef6 8170 2.16 4.54 1.27 75 HTML_IMAGE_RATIO_04 8138 4.64 4.52 4.68 76 XM_SPF_SoftFail 8060 2.80 4.48 2.17 77 XM_B_COVIDMETA 8022 2.20 4.46 1.35 78 XMNumbers 7635 3.68 4.24 3.48 79 XM_SendGrid 7595 6.77 4.22 7.73 80 RELAYCOUNTRY_FR 7403 1.34 4.11 0.29 81 RCVD_IN_RP_RNBL 7259 1.19 4.03 0.12 82 DKIM_INVALID 7123 3.61 3.96 3.48 83 T_FONT_INVIS_NAKED_TO 7115 2.44 3.95 1.87 84 RCVD_IN_MSPIKE_L5 6815 1.17 3.79 0.19 85 HTML_IMAGE_RATIO_08 6590 2.68 3.66 2.31 86 XM_B_SpammyTLD 6357 2.46 3.53 2.06 87 XM_UB60 6305 1.04 3.50 0.12 88 XM_UB99 6251 0.95 3.47 0.00 89 RCVD_IN_RP_SAFE 6200 6.20 3.45 7.23 90 BOTNET_NORDNS 6080 0.93 3.38 0.02 91 XM_UB80 6024 0.93 3.35 0.03 92 SUBJ_ALL_CAPS 5923 2.14 3.29 1.71 93 SpammyFromTLD_02 5742 1.02 3.19 0.20 94 URI_HEX 5668 1.91 3.15 1.45 95 RELAYCOUNTRY_UA 5530 0.85 3.07 0.01 96 HTML_IMAGE_RATIO_06 5517 3.60 3.07 3.81 97 HTML_MIME_NO_HTML_TAG 5480 2.60 3.05 2.43 98 XM_DIRTYINTL 5350 1.18 2.97 0.50 99 URI_TRY_3LD 5344 1.48 2.97 0.93 100 T_XMDrugObfuBody_08 5286 1.94 2.94 1.57 101 TR_XM_MaxSPIKE 5247 0.81 2.92 0.02 102 XM_B_Phish66 5189 2.26 2.88 2.02 103 TM2_M_URI_OPT_OUT 5150 3.09 2.86 3.17 104 LH_URI_DOM_IN_PATH 5142 2.54 2.86 2.42 105 TR_XM_MaxBayes 5030 0.78 2.80 0.02 106 TR_LOTS_OF_MONEY3 4904 1.17 2.73 0.58 107 RCVD_IN_RP_CERTIFIED 4884 5.56 2.71 6.62 108 RCVD_IN_PSBL 4754 0.73 2.64 0.01 109 XMStrtUSub 4658 4.39 2.59 5.07 110 TR_XM_DK_SendGrid 4571 4.18 2.54 4.80 111 FROM_EXCESS_BASE64 4486 2.47 2.49 2.47 112 MIME_QP_LONG_LINE 4449 4.55 2.47 5.33 113 BAYES_40 4358 4.27 2.42 4.96 114 XMDiploma_00 4256 2.20 2.36 2.14 115 XM_CamelCaseFrm001 4111 1.85 2.28 1.69 116 XM_UB999 4071 0.62 2.26 0.00 117 XM_B_Unsub2 4000 2.59 2.22 2.72 118 TM2_M_VERY_LONG_WORD 3936 1.47 2.19 1.20 119 TR_XM_SB_Phish 3849 2.19 2.14 2.20 120 MIME_HTML_ONLY_MULTI 3848 2.79 2.14 3.03 121 RCVD_IN_IADB_LISTED 3781 4.55 2.10 5.46 122 XM_DK_Undo_01 3738 1.79 2.08 1.68 123 T_TooManySym_01 3733 4.04 2.07 4.78 124 XMSubPhish11 3684 2.14 2.05 2.17 125 DKIM_ADSP_NXDOMAIN 3591 0.94 2.00 0.55 126 TR_XM_COVIDMETA4 3559 0.88 1.98 0.47 127 XM_B_SpammyWords4 3548 0.93 1.97 0.54 128 XM_BadFromFormat 3467 0.68 1.93 0.22 129 BAYES_20 3338 3.22 1.85 3.73 130 XMSexyCombo_01 3256 0.87 1.81 0.51 131 PDS_OTHER_BAD_TLD 3231 0.85 1.80 0.50 132 RELAYCOUNTRY_IN 3221 0.56 1.79 0.10 133 XM_URI_RBL 3212 0.60 1.78 0.15 134 XM_UB95 3157 0.49 1.75 0.02 135 RCVD_IN_IADB_SPF 3157 3.92 1.75 4.73 136 T_XMDrugObfuBody_00 3155 0.97 1.75 0.68 137 BAYES_00 3154 11.06 1.75 14.55 138 MAILING_LIST_MULTI 3006 2.17 1.67 2.36 139 RELAYCOUNTRY_GB 2993 1.16 1.66 0.97 140 XMStockSpam_06 2991 1.82 1.66 1.88 141 TR_XM_PHPDW 2974 0.71 1.65 0.35 142 XMSlimDrugH 2972 0.65 1.65 0.27 143 TR_XM_UnparsRelay 2971 0.73 1.65 0.38 144 TR_XM_PHPForged 2914 0.69 1.62 0.34 145 RCVD_IN_IADB_SENDERID 2898 3.50 1.61 4.21 146 TR_XM_FormFill2 2895 0.68 1.61 0.34 147 XM_H_PHPOS 2893 0.68 1.61 0.33 148 RCVD_IN_IADB_DK 2852 3.39 1.58 4.07 149 URI_NOVOWEL 2811 2.41 1.56 2.73 150 TR_Caps_n_Bayes_99 2785 0.44 1.55 0.02 151 FROM_SUSPICIOUS_NTLD 2784 0.47 1.55 0.07 152 HDRS_MISSP 2742 0.47 1.52 0.08 153 URI_PHP_REDIR 2723 0.42 1.51 0.00 154 T_XMDrugObfuBody_14 2696 1.55 1.50 1.58 155 TR_Symld_Words 2693 2.11 1.50 2.34 156 T_FILL_THIS_FORM_SHORT 2681 1.10 1.49 0.95 157 FROM_SUSPICIOUS_NTLD_FP 2677 0.45 1.49 0.06 158 T_XMHurry_00 2578 0.76 1.43 0.50 159 XMBdyGiftCard01 2523 1.00 1.40 0.85 160 DIET_1 2477 0.66 1.38 0.39 161 XMGenDplmaNmb 2453 1.00 1.36 0.87 162 HTML_IMAGE_ONLY_08 2423 0.44 1.35 0.10 163 TR_XM_COVIDMETA1 2368 0.58 1.32 0.30 164 ALL_TRUSTED 2361 10.23 1.31 13.57 165 TR_XM_INV_DKIM 2336 0.39 1.30 0.04 166 RDNS_DYNAMIC 2334 0.68 1.30 0.45 167 URI_NO_WWW_BIZ_CGI 2315 0.35 1.29 0.00 168 XMSubNoVowel 2293 1.08 1.27 1.01 169 INVALID_DATE 2289 0.37 1.27 0.03 170 TR_XM_RelayPhish 2280 0.42 1.27 0.11 171 XMHTML_After_End 2265 1.01 1.26 0.92 172 HDRS_LCASE_IMGONLY 2201 0.35 1.22 0.02 173 BOGUS_MIME_VERSION 2134 0.32 1.19 0.00 174 LOCALPART_IN_SUBJECT 2125 0.34 1.18 0.02 175 RELAYCOUNTRY_TR 2116 0.33 1.18 0.02 176 LongTLD 2115 0.43 1.18 0.15 177 TO_NAME_SUBJ_NO_RDNS 2104 0.32 1.17 0.00 178 XMSubMetaD_00 2081 0.38 1.16 0.08 179 RCVD_DOTEDU_SHORT 2063 0.33 1.15 0.03 180 RCVD_IN_IADB_VOUCHED 2061 2.81 1.15 3.43 181 TR_MetaPhish_Combo_01 2041 0.88 1.13 0.78 182 RELAYCOUNTRY_NL 1947 0.55 1.08 0.35 183 DKIM_ADSP_CUSTOM_MED 1924 1.16 1.07 1.19 184 T_HTML_TAG_BALANCE_CENTER 1892 0.39 1.05 0.15 185 XMBody_78 1886 0.56 1.05 0.38 186 REMOVE_BEFORE_LINK 1875 0.47 1.04 0.25 187 XM_SPF_Unknown 1851 0.85 1.03 0.78 188 HELO_NODOT 1849 1.78 1.03 2.07 189 HELO_NO_DOMAIN 1848 1.78 1.03 2.07 190 HK_RANDOM_FROM 1822 0.39 1.01 0.15 191 XM_PDF 1811 3.87 1.01 4.94 192 XMMoneyMeta_00 1744 0.69 0.97 0.58 193 DRUGS_ERECTILE 1709 0.26 0.95 0.00 194 TR_Mismatch_TLD_01 1697 0.44 0.94 0.26 195 HTML_TAG_BALANCE_BODY 1686 0.59 0.94 0.47 196 MIME_CHARSET_FARAWAY 1673 0.34 0.93 0.12 197 HK_RANDOM_REPLYTO 1644 0.41 0.91 0.22 198 RCVD_IN_MSPIKE_H5 1632 1.87 0.91 2.23 199 XMPhish08 1631 0.66 0.91 0.56 200 FVGT_m_MULTI_ODD_EMAIL 1629 0.27 0.91 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 426975 90.82 95.51 89.06 2 RELAYCOUNTRY_US 395917 79.39 70.89 82.58 3 DKIM_SIGNED 363586 76.61 78.66 75.84 4 XM_DK_Pass 357641 75.11 76.47 74.60 5 DKIM_VALID 346887 73.00 74.70 72.36 6 XM_B_Unicode 332523 70.45 73.35 69.36 7 DCC_CHECK_NEGATIVE 289967 49.57 20.48 60.48 8 BAYES_50 270322 50.43 34.56 56.38 9 DKIM_VALID_AU 258912 55.28 58.66 54.01 10 XMListUnsubscribeExists 232033 53.17 65.89 48.40 11 XM_B_SpammyWords 231470 52.92 65.29 48.28 12 XM_B_Unicode3 186035 38.48 37.61 38.80 13 DCC_CHECK 180156 48.49 77.55 37.58 14 T_TM2_M_HEADER_IN_MSG 152809 29.50 23.17 31.87 15 DKIM_VALID_EF 142639 29.12 27.43 29.75 16 RCVD_IN_MSPIKE_H2 134413 27.17 24.87 28.04 17 RCVD_IN_MSPIKE_WL 131377 24.48 16.69 27.40 18 HTML_FONT_LOW_CONTRAST 128660 28.52 32.99 26.84 19 LOC_TINY_FONT_1 110864 25.80 32.91 23.12 20 FVGT_m_MULTI_ODD 105589 23.32 26.78 22.02 21 XM_B_SpammyWords2 103713 25.90 37.25 21.63 22 MIME_HTML_ONLY 99217 23.75 31.88 20.70 23 XMSubLong 98354 21.58 24.43 20.52 24 T_KAM_HTML_FONT_INVALID 85554 19.90 25.36 17.85 25 RCVD_IN_MSPIKE_H3 73441 13.71 9.43 15.32 26 BAYES_00 69778 11.06 1.75 14.55 27 ALL_TRUSTED 65073 10.23 1.31 13.57 28 XM_Body_Dirty_Words 63986 14.55 17.75 13.35 29 XM_Multi_Part_URI 56435 13.74 18.97 11.77 30 XM_B_Unsub 54022 11.93 13.70 11.27 31 TR_XM_DK_Bayes 47239 7.36 0.70 9.85 32 RCVD_IN_MSPIKE_H4 47238 8.90 6.35 9.85 33 TR_XM_DK_Bayes1 46022 7.17 0.68 9.60 34 TooManyTo_001 41773 7.88 5.67 8.71 35 TR_XM_DK_Bayes2 41121 6.41 0.64 8.58 36 LotsOfNums_01 40900 8.94 10.02 8.53 37 XM_Evil_Numbers_Gen 39791 8.58 9.33 8.30 38 UNPARSEABLE_RELAY 39430 7.35 5.00 8.22 39 XM_SendGrid 37075 6.77 4.22 7.73 40 LOTS_OF_MONEY 36954 8.73 11.46 7.71 41 XM_DKIMWhitelistDomains 36842 5.59 0.01 7.68 42 RCVD_IN_RP_SAFE 34669 6.20 3.45 7.23 43 XM_DK_Undo_02 34404 17.33 44.40 7.18 44 XM_B_Phish_Phrases 34251 7.91 9.95 7.14 45 IN_ZIMBRA_NJ_WHITELIST 33982 5.17 0.07 7.09 46 HTML_IMAGE_RATIO_02 32742 7.07 7.72 6.83 47 RCVD_IN_RP_CERTIFIED 31749 5.56 2.71 6.62 48 BAYES_60 31706 7.07 8.30 6.61 49 XM_B_SpammyWords3 26683 7.29 11.87 5.57 50 XM_H_Long_From01 26345 5.45 5.31 5.50 51 RCVD_IN_IADB_LISTED 26199 4.55 2.10 5.46 52 TR_XM_DKIM_Undo 26131 13.72 35.75 5.45 53 MIME_QP_LONG_LINE 25553 4.55 2.47 5.33 54 FSL_BULK_SIG 25196 8.26 16.26 5.26 55 XMStrtUSub 24298 4.39 2.59 5.07 56 RELAYCOUNTRY_META 24023 10.87 26.49 5.01 57 BAYES_40 23786 4.27 2.42 4.96 58 XM_PDF 23701 3.87 1.01 4.94 59 MPART_ALT_DIFF 23186 5.77 8.27 4.84 60 TR_XM_DK_SendGrid 23002 4.18 2.54 4.80 61 T_TooManySym_01 22936 4.04 2.07 4.78 62 BAYES_99 22923 13.02 34.96 4.78 63 RCVD_IN_IADB_SPF 22679 3.92 1.75 4.73 64 HTML_IMAGE_RATIO_04 22442 4.64 4.52 4.68 65 RCVD_IN_IADB_SENDERID 20194 3.50 1.61 4.21 66 BOTNET_IPINHOSTNAME 19993 6.64 13.21 4.17 67 RCVD_IN_IADB_DK 19505 3.39 1.58 4.07 68 XMSexyCombo_05 19345 5.61 9.79 4.04 69 BAYES_80 19230 5.56 9.67 4.01 70 BAYES_999 18252 10.08 26.77 3.81 71 HTML_IMAGE_RATIO_06 18250 3.60 3.07 3.81 72 BAYES_20 17866 3.22 1.85 3.73 73 T_REMOTE_IMAGE 17390 5.11 9.05 3.63 74 DKIM_INVALID 16699 3.61 3.96 3.48 75 XMNumbers 16660 3.68 4.24 3.48 76 RCVD_IN_IADB_VOUCHED 16446 2.81 1.15 3.43 77 XM_UncommonTLD01 15799 5.27 10.52 3.30 78 TR_XM_PhishingBody 15555 3.80 5.29 3.24 79 TM2_M_URI_OPT_OUT 15221 3.09 2.86 3.17 80 XMSubMetaSx_00 14965 4.02 6.43 3.12 81 MIME_HTML_ONLY_MULTI 14531 2.79 2.14 3.03 82 XM_H_Trusted_IP 13259 2.01 0.00 2.77 83 URI_NOVOWEL 13111 2.41 1.56 2.73 84 XM_B_Unsub2 13057 2.59 2.22 2.72 85 BAYES_95 12508 3.42 5.58 2.61 86 FROM_EXCESS_BASE64 11820 2.47 2.49 2.47 87 TR_DCC_Bayes_99 11729 8.92 26.16 2.45 88 HTML_MIME_NO_HTML_TAG 11654 2.60 3.05 2.43 89 LH_URI_DOM_IN_PATH 11611 2.54 2.86 2.42 90 T_TooManySym_02 11563 1.93 0.63 2.41 91 TooManyTo_002 11381 1.94 0.78 2.37 92 MAILING_LIST_MULTI 11329 2.17 1.67 2.36 93 BAYES_05 11275 1.96 0.90 2.35 94 TR_Symld_Words 11234 2.11 1.50 2.34 95 MIME_HTML_MOSTLY 11075 3.36 6.16 2.31 96 HTML_IMAGE_RATIO_08 11053 2.68 3.66 2.31 97 RCVD_IN_IADB_OPTIN 10715 1.84 0.78 2.23 98 RCVD_IN_MSPIKE_H5 10698 1.87 0.91 2.23 99 TR_XM_SB_Phish 10562 2.19 2.14 2.20 100 XMSubPhish11 10411 2.14 2.05 2.17 101 XM_SPF_SoftFail 10395 2.80 4.48 2.17 102 XMDiploma_00 10251 2.20 2.36 2.14 103 ANY_BOUNCE_MESSAGE 10218 1.73 0.65 2.13 104 BOUNCE_MESSAGE 10218 1.73 0.65 2.13 105 UNTRUSTED_Relay 9922 7.30 21.22 2.07 106 HELO_NODOT 9905 1.78 1.03 2.07 107 HELO_NO_DOMAIN 9903 1.78 1.03 2.07 108 XM_B_SpammyTLD 9855 2.46 3.53 2.06 109 XM_B_Phish66 9695 2.26 2.88 2.02 110 XMStockSpam_06 9012 1.82 1.66 1.88 111 T_FONT_INVIS_NAKED_TO 8962 2.44 3.95 1.87 112 KHOP_HELO_FCRDNS 8469 3.40 7.76 1.77 113 SUBJ_ALL_CAPS 8175 2.14 3.29 1.71 114 XM_CamelCaseFrm001 8105 1.85 2.28 1.69 115 XM_DK_Undo_01 8057 1.79 2.08 1.68 116 IN_HORDE_ADDRESS_BOOK 7697 1.21 0.17 1.61 117 TooManyTo_003 7683 1.33 0.59 1.60 118 T_XMDrugObfuBody_14 7554 1.55 1.50 1.58 119 T_XMDrugObfuBody_08 7524 1.94 2.94 1.57 120 INVALID_MSGID 7463 1.20 0.27 1.56 121 TVD_RCVD_IP 7394 1.20 0.29 1.54 122 RELAYCOUNTRY_CA 7236 2.59 5.45 1.51 123 BOTNET 6964 5.89 17.70 1.45 124 URI_HEX 6959 1.91 3.15 1.45 125 XM_B_COVIDMETA 6491 2.20 4.46 1.35 126 XMCapTrack 6487 1.07 0.31 1.35 127 TO_MALFORMED 6473 0.99 0.04 1.35 128 USER_IN_DEF_DKIM_WL 6342 0.97 0.02 1.32 129 XM_OfRef6 6096 2.16 4.54 1.27 130 HELO_MISC_IP 5783 0.98 0.38 1.21 131 CK_HELO_DYNAMIC_SPLIT_IP 5772 1.01 0.49 1.20 132 TM2_M_VERY_LONG_WORD 5734 1.47 2.19 1.20 133 DKIM_ADSP_CUSTOM_MED 5722 1.16 1.07 1.19 134 TooManyTo_004 5588 0.98 0.50 1.17 135 XMGappySubj_01 5399 0.88 0.21 1.13 136 XM_ProductURIs 5167 0.98 0.73 1.08 137 XM_GoogleGroups 5147 0.89 0.41 1.07 138 XM_UB50 5093 2.72 7.15 1.06 139 HTML_FONT_FACE_BAD 5075 0.96 0.68 1.06 140 XM_H_Long_From02 4985 0.93 0.65 1.04 141 XMBSHREFv2 4845 0.80 0.23 1.01 142 XMSubNoVowel 4825 1.08 1.27 1.01 143 TR_XM_SpammyWords2 4720 4.48 13.81 0.98 144 RELAYCOUNTRY_GB 4656 1.16 1.66 0.97 145 T_FILL_THIS_FORM_SHORT 4567 1.10 1.49 0.95 146 RCVD_IN_BL_SPAMCOP_NET 4532 2.75 7.56 0.95 147 T_TooManySym_03 4462 0.71 0.12 0.93 148 URI_TRY_3LD 4440 1.48 2.97 0.93 149 TooManyTo_005 4399 0.77 0.38 0.92 150 XMHTML_After_End 4395 1.01 1.26 0.92 151 XMBody_95 4339 0.68 0.07 0.91 152 SpammyFromTLD_01 4317 1.95 4.76 0.90 153 XMBrknScrpt_02 4297 2.31 6.09 0.90 154 XMGenDplmaNmb 4172 1.00 1.36 0.87 155 HTTPS_HTTP_MISMATCH 4130 0.85 0.83 0.86 156 XMBdyGiftCard01 4088 1.00 1.40 0.85 157 TR_MSPIKEBAYES00 4049 0.63 0.05 0.84 158 NML_ADSP_CUSTOM_MED 4020 0.86 0.90 0.84 159 T_OBFU_PDF_ATTACH 3833 0.62 0.14 0.80 160 XM_SPF_Unknown 3756 0.85 1.03 0.78 161 TR_MetaPhish_Combo_01 3749 0.88 1.13 0.78 162 RCVD_IN_MSPIKE_BL 3746 3.40 10.37 0.78 163 XM_ShortIntro_01 3726 0.73 0.59 0.78 164 XMSubMetaI_00 3527 0.77 0.85 0.74 165 XMBody_17 3290 1.86 5.00 0.69 166 T_XMDrugObfuBody_00 3264 0.97 1.75 0.68 167 XM_E_Blogspot 3185 0.50 0.08 0.66 168 XMNoVowels 3129 0.63 0.56 0.65 169 RCVD_IN_SORBS_DUL 2972 0.50 0.17 0.62 170 XM_H_PHPMailer 2936 0.60 0.58 0.61 171 NUMERIC_HTTP_ADDR 2904 0.61 0.63 0.61 172 FORGED_GMAIL_RCVD 2863 0.66 0.82 0.60 173 XMMoneyMeta_00 2802 0.69 0.97 0.58 174 TR_LOTS_OF_MONEY3 2796 1.17 2.73 0.58 175 XMPhish08 2695 0.66 0.91 0.56 176 XMHTMLBadTable_001 2661 0.55 0.54 0.56 177 T_TooManySym_04 2657 0.41 0.04 0.55 178 TM2_M_BODY_EMPTY 2640 0.42 0.05 0.55 179 SHORT_HELO_AND_INLINE_IMAGE 2628 0.42 0.09 0.55 180 DKIM_ADSP_NXDOMAIN 2628 0.94 2.00 0.55 181 XM_B_SpammyWords4 2574 0.93 1.97 0.54 182 NO_DNS_FOR_FROM 2533 0.62 0.87 0.53 183 XMSexyCombo_01 2451 0.87 1.81 0.51 184 FROM_GOV_SPOOF 2436 0.42 0.20 0.51 185 TR_XM_SpammyWords3 2431 1.93 5.73 0.51 186 T_XMHurry_00 2405 0.76 1.43 0.50 187 XM_DIRTYINTL 2399 1.18 2.97 0.50 188 PDS_OTHER_BAD_TLD 2394 0.85 1.80 0.50 189 MISSING_HEADERS 2389 0.53 0.63 0.50 190 SENDGRID_REDIR 2372 0.54 0.64 0.49 191 RCVD_IN_MSPIKE_L3 2320 1.97 5.91 0.48 192 XM_S_SubURI 2310 0.37 0.07 0.48 193 HTML_IMAGE_ONLY_20 2308 0.47 0.45 0.48 194 T_Symld_Words_02 2273 0.59 0.89 0.47 195 FROM_GOV_DKIM_AU 2255 0.37 0.11 0.47 196 HTML_TAG_BALANCE_BODY 2237 0.59 0.94 0.47 197 TR_XM_COVIDMETA4 2230 0.88 1.98 0.47 198 HTML_IMAGE_ONLY_28 2228 0.43 0.33 0.46 199 HTML_IMAGE_ONLY_32 2218 0.39 0.20 0.46 200 RDNS_DYNAMIC 2158 0.68 1.30 0.45 ----------------------------------------------------------------------