Email: 764493 Autolearn: 0 AvgScore: 3.77 AvgScanTime: 1.23 sec Spam: 208409 Autolearn: 0 AvgScore: 14.23 AvgScanTime: 1.34 sec Ham: 556084 Autolearn: 0 AvgScore: -0.16 AvgScanTime: 1.19 sec Time Spent Running SA: 261.63 hours Time Spent Processing Spam: 77.77 hours Time Spent Processing Ham: 183.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 199006 91.80 95.49 90.42 2 DCC_CHECK 164215 54.26 78.79 45.07 3 DKIM_SIGNED 157854 72.25 75.74 70.94 4 XM_DK_Pass 152113 70.64 72.99 69.76 5 DKIM_VALID 148963 68.82 71.48 67.82 6 RELAYCOUNTRY_US 147920 75.08 70.98 76.62 7 XM_B_Unicode 145769 66.52 69.94 65.24 8 XMListUnsubscribeExists 131792 51.73 63.24 47.42 9 XM_B_SpammyWords 128054 49.38 61.44 44.85 10 DKIM_VALID_AU 116395 51.94 55.85 50.47 11 XM_DK_Undo_02 85075 15.91 40.82 6.57 12 MIME_HTML_ONLY 73871 25.21 35.45 21.37 13 XM_B_Unicode3 72820 36.35 34.94 36.88 14 XM_B_SpammyWords2 72024 23.78 34.56 19.74 15 BAYES_50 69342 51.94 33.27 58.94 16 BAYES_99 68996 12.01 33.11 4.10 17 TR_XM_DKIM_Undo 67640 12.30 32.46 4.75 18 HTML_FONT_LOW_CONTRAST 66810 26.73 32.06 24.73 19 LOC_TINY_FONT_1 64974 23.93 31.18 21.21 20 RELAYCOUNTRY_META 56116 10.68 26.93 4.59 21 DKIM_VALID_EF 55646 26.74 26.70 26.75 22 TR_DCC_Bayes_99 52371 8.33 25.13 2.04 23 RCVD_IN_MSPIKE_H2 52041 25.19 24.97 25.28 24 BAYES_999 51635 9.12 24.78 3.25 25 FVGT_m_MULTI_ODD 50743 21.83 24.35 20.88 26 T_KAM_HTML_FONT_INVALID 50644 19.26 24.30 17.37 27 XMSubLong 49945 20.34 23.96 18.98 28 UNTRUSTED_Relay 44092 7.10 21.16 1.83 29 FSL_BULK_SIG 42639 15.18 20.46 13.21 30 T_TM2_M_HEADER_IN_MSG 41970 31.08 20.14 35.18 31 BOTNET 41561 6.65 19.94 1.67 32 DCC_CHECK_NEGATIVE 39565 43.71 18.98 52.98 33 XM_Multi_Part_URI 36120 12.22 17.33 10.30 34 XM_Body_Dirty_Words 35646 13.24 17.10 11.79 35 RCVD_IN_MSPIKE_WL 34866 23.17 16.73 25.59 36 XM_B_Unsub 30182 11.09 14.48 9.82 37 BOTNET_IPINHOSTNAME 25935 6.57 12.44 4.37 38 T_REMOTE_IMAGE 24774 11.59 11.89 11.48 39 TR_XM_SpammyWords2 24498 3.77 11.75 0.78 40 XM_B_SpammyWords3 23625 6.58 11.34 4.79 41 XM_UncommonTLD01 23592 5.27 11.32 3.01 42 LOTS_OF_MONEY 22839 7.49 10.96 6.19 43 RCVD_IN_MSPIKE_BL 22240 3.51 10.67 0.82 44 BAYES_80 21909 5.61 10.51 3.78 45 XM_B_Phish_Phrases 21808 7.46 10.46 6.33 46 HTML_MIME_NO_HTML_TAG 21549 4.28 10.34 2.01 47 HTML_IMAGE_ONLY_12 21144 2.94 10.15 0.25 48 LotsOfNums_01 20795 9.06 9.98 8.71 49 XMSexyCombo_05 19868 4.94 9.53 3.22 50 RCVD_IN_BL_SPAMCOP_NET 19529 3.25 9.37 0.96 51 XM_Evil_Numbers_Gen 18834 7.86 9.04 7.42 52 RCVD_IN_MSPIKE_H3 18708 12.99 8.98 14.50 53 KHOP_HELO_FCRDNS 18643 3.44 8.95 1.38 54 HTML_SHORT_LINK_IMG_1 18463 2.46 8.86 0.06 55 MPART_ALT_DIFF 17401 5.35 8.35 4.23 56 BAYES_60 17244 7.16 8.27 6.75 57 HTML_IMAGE_RATIO_02 14596 6.25 7.00 5.97 58 XMSubMetaSx_00 14447 4.18 6.93 3.15 59 RCVD_IN_MSPIKE_H4 14338 8.19 6.88 8.68 60 FROM_EXCESS_BASE64 14224 3.85 6.83 2.73 61 T_TooManySym_01 13638 4.77 6.54 4.10 62 RCVD_IN_PSBL 13511 1.78 6.48 0.01 63 MIME_HTML_MOSTLY 13186 3.11 6.33 1.90 64 DIET_1 13100 1.94 6.29 0.32 65 BOTNET_NORDNS 13052 1.72 6.26 0.02 66 BAYES_95 12847 3.41 6.16 2.38 67 XM_UB50 11957 2.26 5.74 0.96 68 TR_XM_SpammyWords3 11854 1.92 5.69 0.51 69 TR_XM_PhishingBody 11780 3.65 5.65 2.91 70 RELAYCOUNTRY_CA 11660 2.54 5.59 1.40 71 BODY_URI_ONLY 11467 1.54 5.50 0.06 72 TooManyTo_001 11181 7.05 5.36 7.68 73 SpammyFromTLD_01 11150 2.10 5.35 0.88 74 XMBrknScrpt_02 11084 2.08 5.32 0.87 75 RCVD_IN_MSPIKE_L3 10788 1.82 5.18 0.56 76 HTML_IMAGE_RATIO_04 10737 5.29 5.15 5.35 77 UNPARSEABLE_RELAY 10425 7.08 5.00 7.86 78 RCVD_IN_RP_RNBL 10339 1.42 4.96 0.10 79 URIBL_SBL_A 10056 1.44 4.83 0.17 80 XM_H_Long_From01 9735 4.75 4.67 4.78 81 XM_SPF_SoftFail 9416 2.35 4.52 1.54 82 RELAYCOUNTRY_FR 9383 1.38 4.50 0.22 83 RCVD_IN_MSPIKE_L5 9135 1.33 4.38 0.19 84 DKIM_INVALID 8891 3.43 4.27 3.12 85 XM_UB99 8500 1.11 4.08 0.00 86 XMNumbers 8176 3.26 3.92 3.02 87 XM_UB80 8076 1.07 3.88 0.02 88 XM_B_COVIDMETA 7957 1.88 3.82 1.15 89 DKIM_ADSP_NXDOMAIN 7951 1.38 3.82 0.47 90 XM_SendGrid 7706 6.24 3.70 7.20 91 T_FONT_INVIS_NAKED_TO 7594 2.18 3.64 1.63 92 XM_DIRTYINTL 7531 1.31 3.61 0.44 93 LOCALPART_IN_SUBJECT 7425 0.98 3.56 0.02 94 TO_NAME_SUBJ_NO_RDNS 7390 0.97 3.55 0.00 95 HTML_IMAGE_ONLY_08 7255 1.02 3.48 0.09 96 HDRS_MISSP 7217 0.96 3.46 0.03 97 INVALID_DATE 7076 0.94 3.40 0.02 98 T_XMDrugObfuBody_08 7016 2.06 3.37 1.57 99 XMBody_17 6981 1.37 3.35 0.63 100 HDRS_LCASE_IMGONLY 6901 0.92 3.31 0.02 101 BOGUS_MIME_VERSION 6870 0.90 3.30 0.00 102 RCVD_DOTEDU_SHORT 6867 0.92 3.29 0.02 103 XM_B_Phish66 6860 2.18 3.29 1.77 104 BAYES_40 6635 4.62 3.18 5.15 105 XM_UB60 6536 0.92 3.14 0.09 106 XM_OfRef6 6410 1.64 3.08 1.10 107 XM_B_SpammyTLD 6356 2.22 3.05 1.90 108 HTML_IMAGE_RATIO_06 6225 3.48 2.99 3.66 109 HTML_IMAGE_RATIO_08 6110 2.27 2.93 2.02 110 SUBJ_ALL_CAPS 5841 1.84 2.80 1.48 111 LH_URI_DOM_IN_PATH 5777 2.28 2.77 2.10 112 XMStrtUSub 5774 4.16 2.77 4.68 113 XMDiploma_00 5693 1.95 2.73 1.66 114 SpammyFromTLD_02 5651 0.98 2.71 0.34 115 URI_HEX 5553 1.49 2.66 1.05 116 RCVD_IN_RP_SAFE 5547 5.49 2.66 6.55 117 TM2_M_URI_OPT_OUT 5403 2.74 2.59 2.79 118 BAYES_20 5354 3.16 2.57 3.38 119 RELAYCOUNTRY_UA 5345 0.72 2.56 0.03 120 XM_CamelCaseFrm001 5262 1.79 2.52 1.51 121 TR_XM_SB_Phish 5189 2.08 2.49 1.93 122 MIME_QP_LONG_LINE 5166 4.61 2.48 5.41 123 XM_UB999 5129 0.67 2.46 0.00 124 TR_XM_MaxSPIKE 5073 0.68 2.43 0.02 125 MIME_HTML_ONLY_MULTI 5037 2.66 2.42 2.75 126 URI_TRY_3LD 4858 1.67 2.33 1.42 127 XMSubPhish11 4715 2.00 2.26 1.90 128 PDS_OTHER_BAD_TLD 4694 0.87 2.25 0.36 129 TR_LOTS_OF_MONEY3 4634 0.99 2.22 0.52 130 XMSexyCombo_01 4569 1.03 2.19 0.60 131 XM_B_SpammyWords4 4562 1.15 2.19 0.76 132 XM_B_Unsub2 4524 2.46 2.17 2.56 133 TM2_M_VERY_LONG_WORD 4496 1.37 2.16 1.07 134 XM_UB95 4472 0.59 2.15 0.01 135 XM_DK_Undo_01 4393 1.68 2.11 1.52 136 RCVD_IN_IADB_LISTED 4362 4.68 2.09 5.66 137 HK_RANDOM_FROM 4322 0.66 2.07 0.13 138 TR_XM_MaxBayes 4285 0.57 2.06 0.01 139 FROM_SUSPICIOUS_NTLD 4276 0.61 2.05 0.07 140 FROM_SUSPICIOUS_NTLD_FP 4198 0.59 2.01 0.06 141 RCVD_IN_RP_CERTIFIED 4176 4.92 2.00 6.01 142 XMSlimDrugH 4098 0.79 1.97 0.36 143 TR_XM_DK_SendGrid 4004 3.68 1.92 4.34 144 RELAYCOUNTRY_DE 3983 0.89 1.91 0.51 145 BAYES_00 3934 10.22 1.89 13.34 146 TR_XM_COVIDMETA4 3920 0.77 1.88 0.36 147 RCVD_IN_IADB_SPF 3825 4.08 1.84 4.92 148 TVD_SPACE_RATIO 3793 0.75 1.82 0.35 149 T_XMHurry_00 3747 0.82 1.80 0.45 150 T_FILL_THIS_FORM_SHORT 3713 1.06 1.78 0.79 151 TR_XM_UnparsRelay 3646 0.72 1.75 0.33 152 XM_URI_RBL 3645 0.58 1.75 0.14 153 TR_XM_RelayPhish 3642 0.56 1.75 0.11 154 RCVD_IN_IADB_SENDERID 3580 3.67 1.72 4.40 155 RCVD_IN_IADB_DK 3540 3.56 1.70 4.26 156 URI_PHP_REDIR 3507 0.46 1.68 0.01 157 T_XMDrugObfuBody_14 3495 1.86 1.68 1.94 158 RELAYCOUNTRY_RU 3494 0.48 1.68 0.03 159 TR_XM_COVIDMETA1 3430 0.66 1.65 0.29 160 LongTLD 3418 0.57 1.64 0.18 161 XMStockSpam_06 3143 1.04 1.51 0.87 162 FVGT_m_MULTI_ODD_EMAIL 3129 0.43 1.50 0.03 163 URI_NOVOWEL 3127 2.16 1.50 2.41 164 XMGenDplmaNmb 3113 1.03 1.49 0.86 165 RELAYCOUNTRY_IN 3094 0.52 1.48 0.16 166 TR_XM_PHPDW 3087 0.62 1.48 0.30 167 XMHTML_After_End 3070 0.91 1.47 0.69 168 T_XMDrugObfuBody_00 3067 0.96 1.47 0.76 169 TR_XM_PHPForged 3002 0.60 1.44 0.29 170 TR_XM_FormFill2 2985 0.60 1.43 0.29 171 XM_H_PHPOS 2983 0.60 1.43 0.29 172 HTML_TAG_BALANCE_BODY 2970 0.68 1.43 0.40 173 RELAYCOUNTRY_GB 2942 1.04 1.41 0.90 174 ALL_TRUSTED 2673 14.79 1.28 19.85 175 DKIM_ADSP_CUSTOM_MED 2656 1.09 1.27 1.02 176 XMBdyGiftCard01 2580 0.77 1.24 0.60 177 XMMoneyMeta_00 2527 0.67 1.21 0.47 178 MAILING_LIST_MULTI 2507 2.09 1.20 2.42 179 XMGappySubj_01 2487 1.24 1.19 1.25 180 TR_Caps_n_Bayes_99 2480 0.37 1.19 0.06 181 TR_Sbj_FN_Bdy 2458 0.51 1.18 0.25 182 XMSubNoVowel 2449 1.02 1.18 0.96 183 XM_H_Long_From02 2419 1.17 1.16 1.18 184 TR_Symld_Words 2371 1.52 1.14 1.66 185 FORGED_GMAIL_RCVD 2332 0.69 1.12 0.53 186 NML_ADSP_CUSTOM_MED 2322 0.84 1.11 0.73 187 PLING_QUERY 2232 0.67 1.07 0.52 188 XMGappySubj_02 2222 0.37 1.07 0.11 189 TR_Mismatch_TLD_02 2218 0.34 1.06 0.07 190 RDNS_DYNAMIC 2186 0.60 1.05 0.43 191 RCVD_IN_MSPIKE_L4 2160 0.32 1.04 0.05 192 XM_BadFromFormat 2145 0.39 1.03 0.16 193 BAYES_05 2117 1.86 1.02 2.18 194 HELO_NODOT 2099 1.44 1.01 1.60 195 HELO_NO_DOMAIN 2095 1.44 1.01 1.60 196 US_DOLLARS_3 2055 0.45 0.99 0.25 197 RELAYCOUNTRY_NL 2040 0.37 0.98 0.15 198 TR_XM_INV_DKIM 2012 0.32 0.97 0.08 199 TR_MetaPhish_Combo_01 2003 0.77 0.96 0.69 200 DATE_IN_PAST_03_06 1998 0.34 0.96 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 502819 91.80 95.49 90.42 2 RELAYCOUNTRY_US 426060 75.08 70.98 76.62 3 DKIM_SIGNED 394491 72.25 75.74 70.94 4 XM_DK_Pass 387909 70.64 72.99 69.76 5 DKIM_VALID 377142 68.82 71.48 67.82 6 XM_B_Unicode 362795 66.52 69.94 65.24 7 BAYES_50 327740 51.94 33.27 58.94 8 DCC_CHECK_NEGATIVE 294622 43.71 18.98 52.98 9 DKIM_VALID_AU 280680 51.94 55.85 50.47 10 XMListUnsubscribeExists 263673 51.73 63.24 47.42 11 DCC_CHECK 250608 54.26 78.79 45.07 12 XM_B_SpammyWords 249418 49.38 61.44 44.85 13 XM_B_Unicode3 205103 36.35 34.94 36.88 14 T_TM2_M_HEADER_IN_MSG 195610 31.08 20.14 35.18 15 DKIM_VALID_EF 148744 26.74 26.70 26.75 16 RCVD_IN_MSPIKE_WL 142289 23.17 16.73 25.59 17 RCVD_IN_MSPIKE_H2 140558 25.19 24.97 25.28 18 HTML_FONT_LOW_CONTRAST 137517 26.73 32.06 24.73 19 MIME_HTML_ONLY 118832 25.21 35.45 21.37 20 LOC_TINY_FONT_1 117967 23.93 31.18 21.21 21 FVGT_m_MULTI_ODD 116131 21.83 24.35 20.88 22 ALL_TRUSTED 110391 14.79 1.28 19.85 23 XM_B_SpammyWords2 109771 23.78 34.56 19.74 24 XMSubLong 105560 20.34 23.96 18.98 25 T_KAM_HTML_FONT_INVALID 96581 19.26 24.30 17.37 26 RCVD_IN_MSPIKE_H3 80607 12.99 8.98 14.50 27 BAYES_00 74172 10.22 1.89 13.34 28 FSL_BULK_SIG 73431 15.18 20.46 13.21 29 XM_Body_Dirty_Words 65558 13.24 17.10 11.79 30 T_REMOTE_IMAGE 63857 11.59 11.89 11.48 31 XM_Multi_Part_URI 57302 12.22 17.33 10.30 32 XM_B_Unsub 54596 11.09 14.48 9.82 33 TR_XM_DK_Bayes 50209 6.76 0.70 9.03 34 XMNoVowels 49521 6.63 0.55 8.91 35 NUMERIC_HTTP_ADDR 49457 6.66 0.71 8.89 36 TR_XM_DK_Bayes1 48895 6.58 0.68 8.79 37 LotsOfNums_01 48455 9.06 9.98 8.71 38 RCVD_IN_MSPIKE_H4 48288 8.19 6.88 8.68 39 T_HTML_ATTACH 47416 6.29 0.32 8.53 40 UNPARSEABLE_RELAY 43712 7.08 5.00 7.86 41 TR_XM_DK_Bayes2 43381 5.85 0.64 7.80 42 TooManyTo_001 42710 7.05 5.36 7.68 43 XM_Evil_Numbers_Gen 41273 7.86 9.04 7.42 44 XM_DKIMWhitelistDomains 41261 5.40 0.02 7.42 45 XM_SendGrid 40026 6.24 3.70 7.20 46 BAYES_60 37509 7.16 8.27 6.75 47 XM_DK_Undo_02 36532 15.91 40.82 6.57 48 RCVD_IN_RP_SAFE 36428 5.49 2.66 6.55 49 XM_B_Phish_Phrases 35186 7.46 10.46 6.33 50 IN_ZIMBRA_NJ_WHITELIST 34890 4.58 0.05 6.27 51 LOTS_OF_MONEY 34443 7.49 10.96 6.19 52 RCVD_IN_RP_CERTIFIED 33424 4.92 2.00 6.01 53 HTML_IMAGE_RATIO_02 33193 6.25 7.00 5.97 54 RCVD_IN_IADB_LISTED 31450 4.68 2.09 5.66 55 T_TVD_MIME_NO_HEADERS 31270 4.16 0.27 5.62 56 MIME_QP_LONG_LINE 30087 4.61 2.48 5.41 57 HTML_IMAGE_RATIO_04 29736 5.29 5.15 5.35 58 BAYES_40 28662 4.62 3.18 5.15 59 RCVD_IN_IADB_SPF 27387 4.08 1.84 4.92 60 XM_B_SpammyWords3 26643 6.58 11.34 4.79 61 XM_H_Long_From01 26594 4.75 4.67 4.78 62 TR_XM_DKIM_Undo 26391 12.30 32.46 4.75 63 XMStrtUSub 26021 4.16 2.77 4.68 64 RELAYCOUNTRY_META 25516 10.68 26.93 4.59 65 RCVD_IN_IADB_SENDERID 24486 3.67 1.72 4.40 66 BOTNET_IPINHOSTNAME 24280 6.57 12.44 4.37 67 TR_XM_DK_SendGrid 24147 3.68 1.92 4.34 68 RCVD_IN_IADB_DK 23671 3.56 1.70 4.26 69 MPART_ALT_DIFF 23533 5.35 8.35 4.23 70 XM_PDF 23148 3.28 0.94 4.16 71 BAYES_99 22826 12.01 33.11 4.10 72 T_TooManySym_01 22816 4.77 6.54 4.10 73 BAYES_80 20995 5.61 10.51 3.78 74 HTML_IMAGE_RATIO_06 20359 3.48 2.99 3.66 75 RCVD_IN_IADB_VOUCHED 19362 2.77 0.88 3.48 76 BAYES_20 18795 3.16 2.57 3.38 77 BAYES_999 18065 9.12 24.78 3.25 78 XMSexyCombo_05 17900 4.94 9.53 3.22 79 XMSubMetaSx_00 17507 4.18 6.93 3.15 80 DKIM_INVALID 17349 3.43 4.27 3.12 81 XMNumbers 16780 3.26 3.92 3.02 82 XM_UncommonTLD01 16712 5.27 11.32 3.01 83 TR_XM_PhishingBody 16157 3.65 5.65 2.91 84 TM2_M_URI_OPT_OUT 15519 2.74 2.59 2.79 85 MIME_HTML_ONLY_MULTI 15282 2.66 2.42 2.75 86 FROM_EXCESS_BASE64 15177 3.85 6.83 2.73 87 XM_H_Trusted_IP 14794 1.94 0.00 2.66 88 XM_B_Unsub2 14251 2.46 2.17 2.56 89 MAILING_LIST_MULTI 13444 2.09 1.20 2.42 90 URI_NOVOWEL 13405 2.16 1.50 2.41 91 RCVD_IN_MSPIKE_H5 13394 1.99 0.87 2.41 92 BAYES_95 13219 3.41 6.16 2.38 93 RCVD_IN_IADB_OPTIN 12385 1.80 0.65 2.23 94 BAYES_05 12140 1.86 1.02 2.18 95 LH_URI_DOM_IN_PATH 11654 2.28 2.77 2.10 96 ANY_BOUNCE_MESSAGE 11559 1.61 0.37 2.08 97 BOUNCE_MESSAGE 11557 1.61 0.36 2.08 98 TR_DCC_Bayes_99 11322 8.33 25.13 2.04 99 T_TooManySym_02 11276 1.68 0.76 2.03 100 HTML_IMAGE_RATIO_08 11242 2.27 2.93 2.02 101 HTML_MIME_NO_HTML_TAG 11186 4.28 10.34 2.01 102 TooManyTo_002 11057 1.63 0.66 1.99 103 T_XMDrugObfuBody_14 10761 1.86 1.68 1.94 104 TR_XM_SB_Phish 10727 2.08 2.49 1.93 105 XM_B_SpammyTLD 10590 2.22 3.05 1.90 106 MIME_HTML_MOSTLY 10580 3.11 6.33 1.90 107 XMSubPhish11 10542 2.00 2.26 1.90 108 UNTRUSTED_Relay 10173 7.10 21.16 1.83 109 XM_B_Phish66 9841 2.18 3.29 1.77 110 BOTNET 9306 6.65 19.94 1.67 111 XMDiploma_00 9238 1.95 2.73 1.66 112 TR_Symld_Words 9230 1.52 1.14 1.66 113 T_FONT_INVIS_NAKED_TO 9047 2.18 3.64 1.63 114 HELO_NODOT 8896 1.44 1.01 1.60 115 HELO_NO_DOMAIN 8892 1.44 1.01 1.60 116 T_XMDrugObfuBody_08 8706 2.06 3.37 1.57 117 XM_SPF_SoftFail 8548 2.35 4.52 1.54 118 XM_DK_Undo_01 8471 1.68 2.11 1.52 119 TVD_RCVD_IP 8435 1.15 0.17 1.52 120 XM_CamelCaseFrm001 8409 1.79 2.52 1.51 121 SUBJ_ALL_CAPS 8214 1.84 2.80 1.48 122 IN_HORDE_ADDRESS_BOOK 8032 1.07 0.08 1.44 123 URI_TRY_3LD 7879 1.67 2.33 1.42 124 RELAYCOUNTRY_CA 7765 2.54 5.59 1.40 125 KHOP_HELO_FCRDNS 7681 3.44 8.95 1.38 126 TooManyTo_003 7415 1.10 0.47 1.33 127 INVALID_MSGID 7314 1.13 0.65 1.32 128 XMGappySubj_01 6961 1.24 1.19 1.25 129 XM_H_Long_From02 6545 1.17 1.16 1.18 130 TO_MALFORMED 6475 0.85 0.01 1.16 131 XM_B_COVIDMETA 6378 1.88 3.82 1.15 132 XMCapTrack 6311 0.92 0.34 1.13 133 HELO_MISC_IP 6204 0.90 0.32 1.12 134 CK_HELO_DYNAMIC_SPLIT_IP 6184 0.91 0.37 1.11 135 XM_OfRef6 6102 1.64 3.08 1.10 136 TM2_M_VERY_LONG_WORD 5955 1.37 2.16 1.07 137 URI_HEX 5850 1.49 2.66 1.05 138 XM_GoogleGroups 5832 0.89 0.45 1.05 139 DKIM_ADSP_CUSTOM_MED 5696 1.09 1.27 1.02 140 XMSubNoVowel 5331 1.02 1.18 0.96 141 RCVD_IN_BL_SPAMCOP_NET 5327 3.25 9.37 0.96 142 XM_UB50 5322 2.26 5.74 0.96 143 USER_IN_DEF_DKIM_WL 5213 0.68 0.01 0.94 144 XMBSHREFv2 5208 0.76 0.30 0.94 145 TooManyTo_004 5172 0.79 0.41 0.93 146 TR_MSPIKEBAYES00 5148 0.68 0.04 0.93 147 RELAYCOUNTRY_GB 4997 1.04 1.41 0.90 148 HTML_FONT_FACE_BAD 4923 0.79 0.53 0.89 149 SpammyFromTLD_01 4912 2.10 5.35 0.88 150 XMBrknScrpt_02 4852 2.08 5.32 0.87 151 XMStockSpam_06 4811 1.04 1.51 0.87 152 XMGenDplmaNmb 4797 1.03 1.49 0.86 153 XM_ShortIntro_01 4694 0.80 0.67 0.84 154 T_TooManySym_03 4626 0.65 0.15 0.83 155 RCVD_IN_MSPIKE_BL 4565 3.51 10.67 0.82 156 XM_ProductURIs 4558 0.77 0.65 0.82 157 FROM_GOV_DKIM_AU 4425 0.63 0.18 0.80 158 T_FILL_THIS_FORM_SHORT 4390 1.06 1.78 0.79 159 TR_XM_SpammyWords2 4344 3.77 11.75 0.78 160 T_XMDrugObfuBody_00 4239 0.96 1.47 0.76 161 XM_B_SpammyWords4 4224 1.15 2.19 0.76 162 XMBody_95 4213 0.58 0.10 0.76 163 TooManyTo_005 4105 0.63 0.33 0.74 164 NML_ADSP_CUSTOM_MED 4082 0.84 1.11 0.73 165 HTTPS_HTTP_MISMATCH 4002 0.71 0.69 0.72 166 XMHTML_After_End 3863 0.91 1.47 0.69 167 TR_MetaPhish_Combo_01 3852 0.77 0.96 0.69 168 T_OBFU_PDF_ATTACH 3584 0.53 0.22 0.64 169 XMBody_17 3501 1.37 3.35 0.63 170 XMBdyGiftCard01 3329 0.77 1.24 0.60 171 XMSexyCombo_01 3319 1.03 2.19 0.60 172 XMSubMetaI_00 3298 0.64 0.77 0.59 173 XM_SPF_Unknown 3258 0.69 0.96 0.59 174 RCVD_IN_MSPIKE_L3 3117 1.82 5.18 0.56 175 FORGED_GMAIL_RCVD 2973 0.69 1.12 0.53 176 TR_LOTS_OF_MONEY3 2915 0.99 2.22 0.52 177 PLING_QUERY 2864 0.67 1.07 0.52 178 RELAYCOUNTRY_DE 2841 0.89 1.91 0.51 179 TR_XM_SpammyWords3 2819 1.92 5.69 0.51 180 XMHTMLBadTable_001 2800 0.52 0.58 0.50 181 XMSubMetaSxObfu_02 2751 0.45 0.34 0.49 182 RCVD_IN_SORBS_DUL 2727 0.44 0.32 0.49 183 MISSING_HEADERS 2705 0.46 0.40 0.49 184 DKIM_ADSP_NXDOMAIN 2634 1.38 3.82 0.47 185 XMMoneyMeta_00 2601 0.67 1.21 0.47 186 SENDGRID_REDIR 2599 0.49 0.54 0.47 187 T_Symld_Words_02 2596 0.57 0.85 0.47 188 MPART_ALT_DIFF_COUNT 2575 0.46 0.45 0.46 189 XM_H_PHPMailer 2552 0.46 0.47 0.46 190 T_TooManySym_04 2542 0.34 0.04 0.46 191 FROM_GOV_SPOOF 2541 0.38 0.17 0.46 192 TM2_M_BODY_EMPTY 2500 0.36 0.11 0.45 193 T_XMHurry_00 2494 0.82 1.80 0.45 194 HTML_IMAGE_ONLY_20 2470 0.50 0.64 0.44 195 XM_DIRTYINTL 2469 1.31 3.61 0.44 196 NO_DNS_FOR_FROM 2422 0.41 0.34 0.44 197 RDNS_DYNAMIC 2369 0.60 1.05 0.43 198 XM_S_SubURI 2320 0.32 0.05 0.42 199 XMPhish14 2300 0.55 0.92 0.41 200 XMLngstWrd_00 2240 0.35 0.23 0.40 ----------------------------------------------------------------------