Email: 733478 Autolearn: 0 AvgScore: 4.09 AvgScanTime: 1.37 sec Spam: 239756 Autolearn: 0 AvgScore: 14.08 AvgScanTime: 1.45 sec Ham: 493722 Autolearn: 0 AvgScore: -0.75 AvgScanTime: 1.33 sec Time Spent Running SA: 279.56 hours Time Spent Processing Spam: 96.67 hours Time Spent Processing Ham: 182.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 230077 91.44 95.96 89.24 2 DKIM_SIGNED 197676 78.97 82.45 77.28 3 XM_DK_Pass 189561 76.99 79.06 75.99 4 DCC_CHECK 188361 52.85 78.56 40.37 5 DKIM_VALID 187378 75.23 78.15 73.81 6 XM_B_Unicode 180199 73.09 75.16 72.08 7 RELAYCOUNTRY_US 170846 79.27 71.26 83.16 8 XMListUnsubscribeExists 164293 57.60 68.53 52.29 9 XM_B_SpammyWords 159311 54.36 66.45 48.50 10 DKIM_VALID_AU 146640 57.29 61.16 55.41 11 XM_DK_Undo_02 118159 20.81 49.28 6.98 12 XM_B_SpammyWords2 94837 27.30 39.56 21.34 13 BAYES_99 91069 15.40 37.98 4.43 14 TR_XM_DKIM_Undo 90287 15.72 37.66 5.07 15 HTML_FONT_LOW_CONTRAST 84678 30.30 35.32 27.86 16 BAYES_50 84298 49.10 35.16 55.87 17 XM_B_Unicode3 84206 39.25 35.12 41.26 18 LOC_TINY_FONT_1 79573 26.92 33.19 23.87 19 DKIM_VALID_EF 78578 29.96 32.77 28.59 20 BAYES_999 74491 12.53 31.07 3.53 21 TR_DCC_Bayes_99 70715 11.09 29.49 2.16 22 MIME_HTML_ONLY 70492 23.19 29.40 20.18 23 RCVD_IN_MSPIKE_H2 69514 28.07 28.99 27.62 24 RELAYCOUNTRY_META 62764 12.05 26.18 5.19 25 T_KAM_HTML_FONT_INVALID 61531 21.15 25.66 18.95 26 FVGT_m_MULTI_ODD 61219 24.42 25.53 23.88 27 XMSubLong 59755 23.32 24.92 22.54 28 DCC_CHECK_NEGATIVE 47930 45.17 19.99 57.39 29 T_TM2_M_HEADER_IN_MSG 47518 26.53 19.82 29.79 30 UNTRUSTED_Relay 47432 7.96 19.78 2.21 31 BOTNET 43968 7.16 18.34 1.73 32 XM_Multi_Part_URI 42154 13.59 17.58 11.65 33 LOTS_OF_MONEY 40159 10.51 16.75 7.49 34 XM_Body_Dirty_Words 39492 14.07 16.47 12.90 35 TR_XM_SpammyWords2 37900 5.66 15.81 0.74 36 RCVD_IN_MSPIKE_WL 37143 24.35 15.49 28.65 37 FSL_BULK_SIG 34866 8.86 14.54 6.10 38 XM_B_Unsub 34705 12.30 14.48 11.24 39 TR_XM_SpammyWords4 34012 8.11 14.19 5.17 40 BOTNET_IPINHOSTNAME 32951 7.47 13.74 4.43 41 XM_UncommonTLD01 30548 6.59 12.74 3.60 42 XM_B_SpammyWords3 28036 7.70 11.69 5.77 43 RCVD_IN_MSPIKE_BL 24092 3.90 10.05 0.92 44 MPART_ALT_DIFF 24050 6.25 10.03 4.41 45 LotsOfNums_01 23066 9.12 9.62 8.88 46 XMSexyCombo_05 23035 5.64 9.61 3.71 47 XM_UB50 22375 3.89 9.33 1.24 48 HTML_MIME_NO_HTML_TAG 21199 4.44 8.84 2.30 49 T_REMOTE_IMAGE 20153 5.16 8.41 3.58 50 XM_Evil_Numbers_Gen 20131 8.08 8.40 7.93 51 MIME_HTML_MOSTLY 20033 4.13 8.36 2.08 52 RCVD_IN_MSPIKE_H3 19793 13.21 8.26 15.61 53 HTML_IMAGE_RATIO_02 19437 7.27 8.11 6.86 54 BAYES_60 19241 7.63 8.03 7.44 55 BAYES_80 19195 5.40 8.01 4.13 56 XMSubMetaSx_00 18668 5.16 7.79 3.89 57 RCVD_IN_BL_SPAMCOP_NET 18400 3.17 7.67 0.98 58 TR_XM_SpammyWords3 17320 2.68 7.22 0.47 59 TooManyTo_001 17287 7.82 7.21 8.12 60 KHOP_HELO_FCRDNS 16970 3.67 7.08 2.01 61 TR_XM_PhishingBody 16152 4.50 6.74 3.42 62 BODY_URI_ONLY 16031 2.21 6.69 0.03 63 RELAYCOUNTRY_CA 15890 3.17 6.63 1.50 64 RCVD_IN_MSPIKE_L3 15481 2.44 6.46 0.50 65 TR_LOTS_OF_MONEY3 15336 2.57 6.40 0.71 66 RCVD_IN_MSPIKE_H4 15210 9.15 6.34 10.51 67 URIBL_SBL_A 14724 2.18 6.14 0.26 68 XMNumbers 14375 3.97 6.00 2.99 69 XM_B_Phish_Phrases 14287 4.91 5.96 4.40 70 UNPARSEABLE_RELAY 12877 7.46 5.37 8.48 71 T_FONT_INVIS_NAKED_TO 12642 2.97 5.27 1.85 72 SpammyFromTLD_01 12298 2.56 5.13 1.31 73 BAYES_95 11645 3.23 4.86 2.43 74 XM_B_SpammyTLD 11457 3.04 4.78 2.19 75 HTML_IMAGE_ONLY_08 11428 1.63 4.77 0.11 76 XM_B_Phish66 10886 2.74 4.54 1.86 77 XM_H_Long_From01 10721 5.80 4.47 6.45 78 XM_SendGrid 10579 6.43 4.41 7.41 79 HTML_IMAGE_RATIO_08 10552 2.99 4.40 2.30 80 DKIM_INVALID 10298 3.74 4.30 3.47 81 TR_XM_SpammyWords5 9909 2.30 4.13 1.41 82 HTML_IMAGE_RATIO_04 9735 4.90 4.06 5.31 83 XM_OfRef6 9717 2.35 4.05 1.53 84 XM_SPF_SoftFail 9692 2.71 4.04 2.07 85 TM2_M_URI_OPT_OUT 9645 3.43 4.02 3.14 86 XMStrtUSub 9480 4.15 3.95 4.25 87 HTML_IMAGE_RATIO_06 9474 4.07 3.95 4.13 88 XMBody_17 9352 1.70 3.90 0.63 89 RELAYCOUNTRY_FR 9324 1.47 3.89 0.30 90 XM_UB60 9127 1.31 3.81 0.10 91 TR_XM_MaxSPIKE 9093 1.26 3.79 0.02 92 TR_XM_MaxBayes 9047 1.25 3.77 0.02 93 PDS_OTHER_BAD_TLD 8861 1.52 3.70 0.47 94 BOTNET_NORDNS 8595 1.20 3.58 0.03 95 T_XMDrugObfuBody_08 8314 2.32 3.47 1.77 96 RELAYCOUNTRY_IN 8312 1.21 3.47 0.11 97 RCVD_IN_RP_RNBL 8253 1.18 3.44 0.08 98 RCVD_IN_RP_SAFE 7744 6.00 3.23 7.35 99 XMBrknScrpt_02 7481 1.58 3.12 0.83 100 URI_HEX 7481 2.02 3.12 1.48 101 SpammyFromTLD_02 7470 1.23 3.12 0.31 102 XMDiploma_00 7283 2.02 3.04 1.52 103 XM_DIRTYINTL 7257 1.33 3.03 0.51 104 RCVD_IN_MSPIKE_L5 7222 1.09 3.01 0.16 105 URI_TRY_3LD 7200 1.72 3.00 1.09 106 T_FILL_THIS_FORM_SHORT 6838 1.59 2.85 0.98 107 TR_XM_DK_SendGrid 6431 4.04 2.68 4.70 108 DATE_IN_PAST_03_06 6151 0.90 2.57 0.09 109 MIME_QP_LONG_LINE 6115 4.78 2.55 5.86 110 T_XMHurry_00 5789 1.37 2.41 0.86 111 FROM_EXCESS_BASE64 5657 2.61 2.36 2.73 112 RELAYCOUNTRY_UA 5608 0.77 2.34 0.01 113 MIME_HTML_ONLY_MULTI 5566 2.67 2.32 2.84 114 HTML_FONT_SIZE_LARGE 5560 0.81 2.32 0.08 115 BAYES_40 5479 4.30 2.29 5.28 116 SUBJ_ALL_CAPS 5396 1.69 2.25 1.41 117 TR_Symld_Words 5259 1.94 2.19 1.82 118 XM_UB99 5212 0.71 2.17 0.00 119 RCVD_IN_RP_CERTIFIED 5205 5.16 2.17 6.61 120 XM_B_COVIDMETA 5171 1.17 2.16 0.69 121 XM_DK_Undo_01 5166 1.80 2.15 1.63 122 HTML_IMAGE_ONLY_12 5160 0.84 2.15 0.20 123 RCVD_IN_PSBL 5080 0.75 2.12 0.08 124 RELAYCOUNTRY_DE 5070 1.00 2.11 0.47 125 XM_B_Unsub2 4978 2.49 2.08 2.69 126 XM_UB80 4963 0.69 2.07 0.02 127 XM_CamelCaseFrm001 4952 1.92 2.07 1.85 128 T_TooManySym_01 4836 3.95 2.02 4.89 129 TM2_M_VERY_LONG_WORD 4788 1.47 2.00 1.22 130 TR_XM_SB_Phish 4783 2.46 1.99 2.69 131 XM_URI_RBL 4678 0.75 1.95 0.16 132 T_Symld_Words_02 4659 0.92 1.94 0.42 133 TO_NO_BRKTS_HTML_ONLY 4523 0.74 1.89 0.18 134 TR_XM_FormFill 4489 0.62 1.87 0.01 135 XMSubPhish11 4327 2.38 1.80 2.67 136 RCVD_IN_IADB_LISTED 4203 4.52 1.75 5.87 137 TR_XM_UnparsRelay 4172 0.82 1.74 0.37 138 XMMoneyMeta_00 4090 0.89 1.71 0.50 139 FROM_SUSPICIOUS_NTLD 3961 0.58 1.65 0.07 140 XM_B_SpammyWords4 3941 1.07 1.64 0.80 141 TR_XM_COVIDMETA4 3928 0.82 1.64 0.42 142 BAYES_20 3888 3.03 1.62 3.72 143 XMGenDplmaNmb 3854 1.11 1.61 0.87 144 FROM_SUSPICIOUS_NTLD_FP 3844 0.56 1.60 0.06 145 T_XMDrugObfuBody_14 3666 1.57 1.53 1.59 146 LongTLD 3654 0.59 1.52 0.14 147 T_XMDrugObfuBody_00 3627 0.96 1.51 0.70 148 XMStockSpam_06 3624 1.32 1.51 1.23 149 RCVD_IN_IADB_SPF 3605 3.92 1.50 5.10 150 URI_NOVOWEL 3542 2.46 1.48 2.94 151 XMSexyCombo_01 3534 0.78 1.47 0.45 152 XM_UB999 3485 0.48 1.45 0.00 153 XMSubNoVowel 3418 1.39 1.43 1.37 154 RCVD_IN_IADB_SENDERID 3322 3.51 1.39 4.54 155 RCVD_IN_IADB_DK 3301 3.40 1.38 4.39 156 TR_XM_INV_DKIM 3247 0.50 1.35 0.09 157 SUBJ_DOLLARS 3204 0.67 1.34 0.35 158 TR_Mismatch_TLD_01 3190 0.71 1.33 0.41 159 ALL_TRUSTED 3114 8.95 1.30 12.67 160 XMSubMetaSSx_00 3029 0.52 1.26 0.16 161 RELAYCOUNTRY_GB 2959 1.05 1.23 0.96 162 DATE_IN_PAST_06_12 2952 0.55 1.23 0.21 163 TR_XM_PHPDW 2940 0.69 1.23 0.44 164 TR_XM_PHPForged 2917 0.66 1.22 0.39 165 XMHTML_After_End 2875 0.97 1.20 0.86 166 XM_UB95 2875 0.40 1.20 0.01 167 TR_XM_FormFill2 2864 0.65 1.19 0.39 168 XMBody_78 2856 0.76 1.19 0.55 169 XM_H_PHPOS 2850 0.65 1.19 0.39 170 XMSlimDrugH 2762 0.59 1.15 0.31 171 BAYES_00 2759 10.02 1.15 14.32 172 DIET_1 2665 0.62 1.11 0.38 173 INVALID_DATE 2651 0.38 1.11 0.03 174 REMOVE_BEFORE_LINK 2646 0.53 1.10 0.26 175 URI_PHP_REDIR 2625 0.36 1.09 0.00 176 XM_H_Long_From02 2624 1.36 1.09 1.49 177 MAILING_LIST_MULTI 2606 2.18 1.09 2.71 178 XM_S_ServInvoice 2520 0.36 1.05 0.03 179 RDNS_DYNAMIC 2489 0.67 1.04 0.50 180 XMBdyGiftCard01 2462 0.87 1.03 0.79 181 TR_Caps_n_Bayes_99 2446 0.37 1.02 0.06 182 DKIM_ADSP_CUSTOM_MED 2424 1.06 1.01 1.09 183 XM_BadFromFormat 2406 0.42 1.00 0.13 184 URI_NO_WWW_BIZ_CGI 2386 0.34 1.00 0.02 185 HK_RANDOM_REPLYTO 2380 0.51 0.99 0.28 186 TR_XM_COVIDMETA1 2347 0.54 0.98 0.32 187 HTML_TAG_BALANCE_BODY 2301 0.73 0.96 0.62 188 TR_MetaPhish_Combo_01 2222 0.78 0.93 0.70 189 XM_ProductURIs 2191 0.89 0.91 0.87 190 RCVD_IN_MSPIKE_H5 2140 1.99 0.89 2.52 191 BAYES_05 2135 1.88 0.89 2.36 192 XMSubMetaD_03 2130 0.30 0.89 0.02 193 RCVD_IN_IADB_VOUCHED 2111 2.76 0.88 3.67 194 TR_XM_RelayPhish 2090 0.48 0.87 0.28 195 TR_LOTS_OF_MONEY2 2085 0.45 0.87 0.25 196 T_MONEY_PERCENT 2085 0.45 0.87 0.25 197 XMSubMetaI_00 2071 0.68 0.86 0.58 198 NML_ADSP_CUSTOM_MED 2007 0.75 0.84 0.71 199 LH_URI_DOM_IN_PATH 1996 0.85 0.83 0.86 200 TVD_SPACE_RATIO 1975 0.58 0.82 0.46 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 440588 91.44 95.96 89.24 2 RELAYCOUNTRY_US 410555 79.27 71.26 83.16 3 DKIM_SIGNED 381529 78.97 82.45 77.28 4 XM_DK_Pass 375175 76.99 79.06 75.99 5 DKIM_VALID 364398 75.23 78.15 73.81 6 XM_B_Unicode 355893 73.09 75.16 72.08 7 DCC_CHECK_NEGATIVE 283359 45.17 19.99 57.39 8 BAYES_50 275854 49.10 35.16 55.87 9 DKIM_VALID_AU 273561 57.29 61.16 55.41 10 XMListUnsubscribeExists 258188 57.60 68.53 52.29 11 XM_B_SpammyWords 239442 54.36 66.45 48.50 12 XM_B_Unicode3 203715 39.25 35.12 41.26 13 DCC_CHECK 199299 52.85 78.56 40.37 14 T_TM2_M_HEADER_IN_MSG 147058 26.53 19.82 29.79 15 RCVD_IN_MSPIKE_WL 141444 24.35 15.49 28.65 16 DKIM_VALID_EF 141167 29.96 32.77 28.59 17 HTML_FONT_LOW_CONTRAST 137536 30.30 35.32 27.86 18 RCVD_IN_MSPIKE_H2 136364 28.07 28.99 27.62 19 FVGT_m_MULTI_ODD 117886 24.42 25.53 23.88 20 LOC_TINY_FONT_1 117874 26.92 33.19 23.87 21 XMSubLong 111291 23.32 24.92 22.54 22 XM_B_SpammyWords2 105382 27.30 39.56 21.34 23 MIME_HTML_ONLY 99614 23.19 29.40 20.18 24 T_KAM_HTML_FONT_INVALID 93574 21.15 25.66 18.95 25 RCVD_IN_MSPIKE_H3 77087 13.21 8.26 15.61 26 BAYES_00 70723 10.02 1.15 14.32 27 XM_Body_Dirty_Words 63690 14.07 16.47 12.90 28 ALL_TRUSTED 62532 8.95 1.30 12.67 29 XM_Multi_Part_URI 57507 13.59 17.58 11.65 30 XM_B_Unsub 55514 12.30 14.48 11.24 31 RCVD_IN_MSPIKE_H4 51895 9.15 6.34 10.51 32 TR_XM_DK_Bayes 48251 6.82 0.75 9.77 33 TR_XM_DK_Bayes1 46759 6.61 0.73 9.47 34 LotsOfNums_01 43857 9.12 9.62 8.88 35 UNPARSEABLE_RELAY 41862 7.46 5.37 8.48 36 TR_XM_DK_Bayes2 40761 5.74 0.57 8.26 37 TooManyTo_001 40089 7.82 7.21 8.12 38 XM_Evil_Numbers_Gen 39153 8.08 8.40 7.93 39 XM_DKIMWhitelistDomains 37716 5.17 0.08 7.64 40 LOTS_OF_MONEY 36961 10.51 16.75 7.49 41 BAYES_60 36727 7.63 8.03 7.44 42 XM_SendGrid 36581 6.43 4.41 7.41 43 RCVD_IN_RP_SAFE 36297 6.00 3.23 7.35 44 XM_DK_Undo_02 34461 20.81 49.28 6.98 45 HTML_IMAGE_RATIO_02 33865 7.27 8.11 6.86 46 RCVD_IN_RP_CERTIFIED 32633 5.16 2.17 6.61 47 XM_H_Long_From01 31831 5.80 4.47 6.45 48 IN_ZIMBRA_NJ_WHITELIST 31230 4.28 0.06 6.33 49 FSL_BULK_SIG 30117 8.86 14.54 6.10 50 RCVD_IN_IADB_LISTED 28985 4.52 1.75 5.87 51 MIME_QP_LONG_LINE 28939 4.78 2.55 5.86 52 XM_B_SpammyWords3 28465 7.70 11.69 5.77 53 HTML_IMAGE_RATIO_04 26222 4.90 4.06 5.31 54 BAYES_40 26081 4.30 2.29 5.28 55 RELAYCOUNTRY_META 25642 12.05 26.18 5.19 56 TR_XM_SpammyWords4 25509 8.11 14.19 5.17 57 RCVD_IN_IADB_SPF 25171 3.92 1.50 5.10 58 TR_XM_DKIM_Undo 25033 15.72 37.66 5.07 59 T_TooManySym_01 24166 3.95 2.02 4.89 60 XM_PDF 23705 3.46 0.71 4.80 61 TR_XM_DK_SendGrid 23227 4.04 2.68 4.70 62 RCVD_IN_IADB_SENDERID 22404 3.51 1.39 4.54 63 BAYES_99 21891 15.40 37.98 4.43 64 BOTNET_IPINHOSTNAME 21848 7.47 13.74 4.43 65 MPART_ALT_DIFF 21768 6.25 10.03 4.41 66 XM_B_Phish_Phrases 21704 4.91 5.96 4.40 67 RCVD_IN_IADB_DK 21652 3.40 1.38 4.39 68 XMStrtUSub 20962 4.15 3.95 4.25 69 BAYES_80 20394 5.40 8.01 4.13 70 HTML_IMAGE_RATIO_06 20392 4.07 3.95 4.13 71 XMSubMetaSx_00 19197 5.16 7.79 3.89 72 BAYES_20 18367 3.03 1.62 3.72 73 XMSexyCombo_05 18338 5.64 9.61 3.71 74 RCVD_IN_IADB_VOUCHED 18127 2.76 0.88 3.67 75 XM_UncommonTLD01 17787 6.59 12.74 3.60 76 T_REMOTE_IMAGE 17682 5.16 8.41 3.58 77 BAYES_999 17447 12.53 31.07 3.53 78 DKIM_INVALID 17131 3.74 4.30 3.47 79 TR_XM_PhishingBody 16863 4.50 6.74 3.42 80 TM2_M_URI_OPT_OUT 15500 3.43 4.02 3.14 81 XMNumbers 14749 3.97 6.00 2.99 82 URI_NOVOWEL 14504 2.46 1.48 2.94 83 MIME_HTML_ONLY_MULTI 14003 2.67 2.32 2.84 84 FROM_EXCESS_BASE64 13489 2.61 2.36 2.73 85 MAILING_LIST_MULTI 13392 2.18 1.09 2.71 86 XM_B_Unsub2 13302 2.49 2.08 2.69 87 TR_XM_SB_Phish 13274 2.46 1.99 2.69 88 XMSubPhish11 13164 2.38 1.80 2.67 89 RCVD_IN_MSPIKE_H5 12462 1.99 0.89 2.52 90 XM_H_Trusted_IP 12052 1.64 0.00 2.44 91 BAYES_95 12019 3.23 4.86 2.43 92 T_TooManySym_02 11828 1.79 0.54 2.40 93 BAYES_05 11655 1.88 0.89 2.36 94 RCVD_IN_IADB_OPTIN 11610 1.78 0.60 2.35 95 HTML_IMAGE_RATIO_08 11378 2.99 4.40 2.30 96 HTML_MIME_NO_HTML_TAG 11358 4.44 8.84 2.30 97 UNTRUSTED_Relay 10923 7.96 19.78 2.21 98 XM_B_SpammyTLD 10810 3.04 4.78 2.19 99 TR_DCC_Bayes_99 10650 11.09 29.49 2.16 100 TooManyTo_002 10368 1.63 0.68 2.10 101 MIME_HTML_MOSTLY 10261 4.13 8.36 2.08 102 XM_SPF_SoftFail 10199 2.71 4.04 2.07 103 KHOP_HELO_FCRDNS 9939 3.67 7.08 2.01 104 ANY_BOUNCE_MESSAGE 9293 1.42 0.48 1.88 105 BOUNCE_MESSAGE 9293 1.42 0.48 1.88 106 XM_B_Phish66 9195 2.74 4.54 1.86 107 XM_CamelCaseFrm001 9135 1.92 2.07 1.85 108 T_FONT_INVIS_NAKED_TO 9129 2.97 5.27 1.85 109 TVD_RCVD_IP 9003 1.34 0.35 1.82 110 TR_Symld_Words 8988 1.94 2.19 1.82 111 T_XMDrugObfuBody_08 8734 2.32 3.47 1.77 112 HELO_NODOT 8643 1.42 0.74 1.75 113 HELO_NO_DOMAIN 8642 1.42 0.74 1.75 114 BOTNET 8559 7.16 18.34 1.73 115 XM_DK_Undo_01 8067 1.80 2.15 1.63 116 T_XMDrugObfuBody_14 7826 1.57 1.53 1.59 117 IN_HORDE_ADDRESS_BOOK 7792 1.12 0.17 1.58 118 XM_OfRef6 7556 2.35 4.05 1.53 119 XMDiploma_00 7497 2.02 3.04 1.52 120 RELAYCOUNTRY_CA 7395 3.17 6.63 1.50 121 XM_H_Long_From02 7364 1.36 1.09 1.49 122 INVALID_MSGID 7360 1.14 0.42 1.49 123 URI_HEX 7305 2.02 3.12 1.48 124 SUBJ_ALL_CAPS 6972 1.69 2.25 1.41 125 TR_XM_SpammyWords5 6969 2.30 4.13 1.41 126 TooManyTo_003 6851 1.10 0.51 1.39 127 XMSubNoVowel 6781 1.39 1.43 1.37 128 TO_MALFORMED 6626 0.90 0.00 1.34 129 MSGID_NOFQDN1 6597 0.91 0.03 1.34 130 USER_IN_DEF_DKIM_WL 6482 0.89 0.02 1.31 131 SpammyFromTLD_01 6449 2.56 5.13 1.31 132 XMGappySubj_01 6337 0.95 0.25 1.28 133 XM_GoogleGroups 6273 1.00 0.44 1.27 134 XM_UB50 6121 3.89 9.33 1.24 135 XMStockSpam_06 6092 1.32 1.51 1.23 136 HTML_FONT_FACE_BAD 6010 1.00 0.56 1.22 137 TM2_M_VERY_LONG_WORD 6000 1.47 2.00 1.22 138 XMCapTrack 5705 0.86 0.26 1.16 139 HELO_MISC_IP 5447 0.82 0.25 1.10 140 CK_HELO_DYNAMIC_SPLIT_IP 5437 0.88 0.41 1.10 141 URI_TRY_3LD 5397 1.72 3.00 1.09 142 DKIM_ADSP_CUSTOM_MED 5384 1.06 1.01 1.09 143 XMBSHREFv2 5042 0.79 0.32 1.02 144 T_FILL_THIS_FORM_SHORT 4857 1.59 2.85 0.98 145 RCVD_IN_BL_SPAMCOP_NET 4831 3.17 7.67 0.98 146 TooManyTo_004 4786 0.76 0.34 0.97 147 RELAYCOUNTRY_GB 4760 1.05 1.23 0.96 148 T_TooManySym_03 4618 0.68 0.15 0.94 149 RCVD_IN_MSPIKE_BL 4526 3.90 10.05 0.92 150 TR_MSPIKEBAYES00 4329 0.59 0.01 0.88 151 XMGenDplmaNmb 4320 1.11 1.61 0.87 152 XM_ProductURIs 4306 0.89 0.91 0.87 153 T_XMHurry_00 4262 1.37 2.41 0.86 154 XMHTML_After_End 4259 0.97 1.20 0.86 155 LH_URI_DOM_IN_PATH 4241 0.85 0.83 0.86 156 T_OBFU_PDF_ATTACH 4210 0.62 0.13 0.85 157 HTTPS_HTTP_MISMATCH 4183 0.84 0.81 0.85 158 XMBrknScrpt_02 4115 1.58 3.12 0.83 159 XMBody_95 4035 0.60 0.17 0.82 160 XM_B_SpammyWords4 3942 1.07 1.64 0.80 161 TooManyTo_005 3937 0.64 0.31 0.80 162 XMBdyGiftCard01 3896 0.87 1.03 0.79 163 FROM_GOV_DKIM_AU 3773 0.55 0.10 0.76 164 TR_XM_SpammyWords2 3637 5.66 15.81 0.74 165 TR_LOTS_OF_MONEY3 3521 2.57 6.40 0.71 166 NML_ADSP_CUSTOM_MED 3489 0.75 0.84 0.71 167 TR_MetaPhish_Combo_01 3472 0.78 0.93 0.70 168 T_XMDrugObfuBody_00 3445 0.96 1.51 0.70 169 XMSubEmpty 3408 0.62 0.47 0.69 170 XM_B_COVIDMETA 3385 1.17 2.16 0.69 171 XMNoVowels 3324 0.63 0.55 0.67 172 FORGED_GMAIL_RCVD 3280 0.71 0.81 0.66 173 NO_DNS_FOR_FROM 3264 0.56 0.35 0.66 174 DKIM_ADSP_NXDOMAIN 3250 0.66 0.66 0.66 175 XMPhish30 3098 0.67 0.77 0.63 176 XMBody_17 3096 1.70 3.90 0.63 177 PLING_QUERY 3081 0.62 0.61 0.62 178 HTML_TAG_BALANCE_BODY 3044 0.73 0.96 0.62 179 MISSING_HEADERS 3015 0.53 0.37 0.61 180 XMSubMetaI_00 2882 0.68 0.86 0.58 181 XM_H_PHPMailer 2870 0.54 0.47 0.58 182 SHORTENED_URL_HREF 2804 0.63 0.76 0.57 183 XM_SPF_Unknown 2804 0.60 0.65 0.57 184 NUMERIC_HTTP_ADDR 2742 0.51 0.42 0.56 185 XMBody_78 2709 0.76 1.19 0.55 186 XM_ShortIntro_01 2682 0.49 0.38 0.54 187 T_TooManySym_04 2603 0.37 0.04 0.53 188 SENDGRID_REDIR 2517 0.58 0.72 0.51 189 XM_DIRTYINTL 2499 1.33 3.03 0.51 190 XMHTMLBadTable_001 2489 0.50 0.48 0.50 191 RDNS_DYNAMIC 2455 0.67 1.04 0.50 192 RCVD_IN_MSPIKE_L3 2450 2.44 6.46 0.50 193 XMMoneyMeta_00 2449 0.89 1.71 0.50 194 TM2_M_BODY_EMPTY 2404 0.35 0.05 0.49 195 HTML_IMAGE_ONLY_20 2389 0.45 0.37 0.48 196 XMPhish08 2364 0.52 0.60 0.48 197 PDS_OTHER_BAD_TLD 2307 1.52 3.70 0.47 198 TR_XM_SpammyWords3 2301 2.68 7.22 0.47 199 RELAYCOUNTRY_DE 2300 1.00 2.11 0.47 200 TVD_SPACE_RATIO 2284 0.58 0.82 0.46 ----------------------------------------------------------------------