Email: 724971 Autolearn: 0 AvgScore: 3.83 AvgScanTime: 1.27 sec Spam: 226252 Autolearn: 0 AvgScore: 13.68 AvgScanTime: 1.37 sec Ham: 498719 Autolearn: 0 AvgScore: -0.64 AvgScanTime: 1.22 sec Time Spent Running SA: 255.88 hours Time Spent Processing Spam: 86.39 hours Time Spent Processing Ham: 169.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204472 86.34 90.37 84.51 2 DCC_CHECK 172355 49.41 76.18 37.26 3 DKIM_SIGNED 171713 73.11 75.89 71.85 4 XM_DK_Pass 167337 71.69 73.96 70.66 5 DKIM_VALID 164055 69.95 72.51 68.79 6 XM_B_Unicode 163771 68.81 72.38 67.19 7 RELAYCOUNTRY_US 160815 75.91 71.08 78.11 8 XMListUnsubscribeExists 146347 52.98 64.68 47.66 9 XM_B_SpammyWords 142467 50.27 62.97 44.51 10 DKIM_VALID_AU 124703 52.00 55.12 50.58 11 XM_DK_Undo_02 99134 18.36 43.82 6.82 12 BAYES_99 83857 14.38 37.06 4.08 13 BAYES_50 81444 48.92 36.00 54.78 14 TR_XM_DKIM_Undo 80569 14.55 35.61 5.00 15 XM_B_SpammyWords2 78890 23.74 34.87 18.69 16 LOC_TINY_FONT_1 75939 25.47 33.56 21.80 17 HTML_FONT_LOW_CONTRAST 74263 27.85 32.82 25.60 18 XM_B_Unicode3 74019 35.82 32.72 37.23 19 BAYES_999 68477 11.69 30.27 3.26 20 MIME_HTML_ONLY 68473 23.27 30.26 20.10 21 RCVD_IN_MSPIKE_H2 67467 27.24 29.82 26.07 22 TR_DCC_Bayes_99 66078 10.41 29.21 1.89 23 DKIM_VALID_EF 57116 26.99 25.24 27.79 24 XMSubLong 55383 20.95 24.48 19.34 25 T_KAM_HTML_FONT_INVALID 55001 19.42 24.31 17.21 26 FVGT_m_MULTI_ODD 53251 22.50 23.54 22.03 27 DCC_CHECK_NEGATIVE 50917 48.75 22.50 60.66 28 RELAYCOUNTRY_META 49281 10.24 21.78 5.00 29 T_TM2_M_HEADER_IN_MSG 47725 25.88 21.09 28.05 30 XM_Multi_Part_URI 46969 13.84 20.76 10.70 31 FSL_BULK_SIG 39647 9.62 17.52 6.04 32 UNTRUSTED_Relay 39039 6.54 17.25 1.67 33 XM_Body_Dirty_Words 37382 13.38 16.52 11.95 34 RCVD_IN_MSPIKE_WL 35837 23.11 15.84 26.42 35 TR_XM_SpammyWords2 31056 4.68 13.73 0.58 36 BOTNET 30903 5.28 13.66 1.48 37 BOTNET_IPINHOSTNAME 30050 7.51 13.28 4.89 38 LotsOfNums_01 26707 9.27 11.80 8.13 39 XM_B_Unsub 24453 9.95 10.81 9.56 40 LOTS_OF_MONEY 24042 7.44 10.63 5.99 41 XMSexyCombo_05 22748 5.75 10.05 3.80 42 XM_B_SpammyWords3 22155 5.94 9.79 4.19 43 T_REMOTE_IMAGE 20794 5.17 9.19 3.34 44 TR_XM_SpammyWords4 20676 5.47 9.14 3.80 45 RCVD_IN_BL_SPAMCOP_NET 20499 3.76 9.06 1.36 46 HTML_MIME_NO_HTML_TAG 20050 4.14 8.86 2.00 47 RCVD_IN_MSPIKE_H3 19879 12.78 8.79 14.59 48 BAYES_80 19211 5.54 8.49 4.20 49 XM_Evil_Numbers_Gen 18707 8.60 8.27 8.75 50 XM_UncommonTLD01 18175 4.66 8.03 3.13 51 BAYES_60 17949 7.30 7.93 7.01 52 HTML_IMAGE_RATIO_02 17273 6.98 7.63 6.68 53 BODY_URI_ONLY 16748 2.34 7.40 0.05 54 KHOP_HELO_FCRDNS 16400 3.37 7.25 1.62 55 HTML_IMAGE_ONLY_08 15711 2.23 6.94 0.09 56 XM_UB50 15609 2.84 6.90 0.99 57 RCVD_IN_MSPIKE_BL 15227 2.28 6.73 0.26 58 MPART_ALT_DIFF 15097 5.32 6.67 4.71 59 TR_XM_MSPIKECOMBO 14472 2.16 6.40 0.23 60 UNPARSEABLE_RELAY 14417 6.80 6.37 6.99 61 RCVD_IN_MSPIKE_H4 14240 8.52 6.29 9.54 62 XM_B_Phish_Phrases 14170 5.31 6.26 4.88 63 TR_XM_UnparsRelay 13794 5.27 6.10 4.90 64 T_TooManySym_01 13726 4.98 6.07 4.49 65 ALL_TRUSTED 13627 14.73 6.02 18.68 66 TR_XM_PhishingBody 13378 3.75 5.91 2.77 67 TR_Symld_Words 12845 2.75 5.68 1.42 68 TooManyTo_001 12697 7.25 5.61 8.00 69 HTML_IMAGE_RATIO_08 12534 3.34 5.54 2.34 70 TR_XM_PHPDW 12453 1.90 5.50 0.26 71 NO_DNS_FOR_FROM 12442 1.87 5.50 0.23 72 TR_XM_PHPForged 12403 1.86 5.48 0.22 73 TR_XM_FormFill2 12375 1.85 5.47 0.21 74 XM_H_PHPOS 12368 1.85 5.47 0.21 75 XMSubMetaSx_00 11890 4.54 5.26 4.21 76 XM_SendGrid 11753 5.98 5.19 6.34 77 XM_H_Long_From01 11689 5.05 5.17 4.99 78 DKIM_ADSP_NXDOMAIN 11555 1.76 5.11 0.25 79 RELAYCOUNTRY_CA 11539 2.54 5.10 1.37 80 MIME_HTML_MOSTLY 11474 3.04 5.07 2.12 81 RCVD_IN_RP_RNBL 11223 1.63 4.96 0.11 82 TR_XM_MaxWHORU 11081 1.60 4.90 0.10 83 BAYES_95 10559 3.17 4.67 2.49 84 T_TooManySym_02 10555 2.93 4.67 2.15 85 XMStrtUSub 9967 5.14 4.41 5.48 86 URIBL_SBL_A 9842 1.54 4.35 0.27 87 T_TooManySym_03 9841 1.83 4.35 0.68 88 XM_OfRef6 9704 2.74 4.29 2.04 89 XMNumbers 9685 3.44 4.28 3.06 90 T_TooManySym_04 9491 1.49 4.19 0.27 91 T_FONT_INVIS_NAKED_TO 9479 2.36 4.19 1.53 92 RCVD_IN_MSPIKE_L5 8451 1.21 3.74 0.07 93 XM_SPF_SoftFail 8367 2.35 3.70 1.74 94 HTML_IMAGE_RATIO_04 8332 4.42 3.68 4.76 95 XM_B_Phish66 8202 2.30 3.63 1.70 96 TR_XM_SpammyWords5 8086 2.06 3.57 1.37 97 XM_DIRTYINTL 7804 1.39 3.45 0.45 98 XM_UB60 7713 1.12 3.41 0.09 99 DKIM_INVALID 7658 3.16 3.38 3.06 100 HTML_IMAGE_RATIO_06 7264 3.52 3.21 3.66 101 RELAYCOUNTRY_IN 7151 1.07 3.16 0.12 102 URI_HEX 7140 1.79 3.16 1.17 103 XMBody_17 7094 1.32 3.14 0.50 104 T_XMDrugObfuBody_08 7009 1.94 3.10 1.41 105 RCVD_IN_RP_SAFE 6942 5.34 3.07 6.37 106 SpammyFromTLD_01 6895 1.47 3.05 0.75 107 TR_XM_MaxBayes 6795 0.95 3.00 0.01 108 RCVD_IN_PSBL 6750 1.00 2.98 0.09 109 T_XMHurry_00 6719 1.41 2.97 0.71 110 SUBJ_ALL_CAPS 6702 1.93 2.96 1.46 111 TR_XM_DK_SendGrid 6661 3.60 2.94 3.90 112 XMDiploma_00 6609 2.14 2.92 1.79 113 TM2_M_URI_OPT_OUT 6575 7.01 2.91 8.87 114 HTML_FONT_SIZE_LARGE 6397 0.95 2.83 0.10 115 XM_B_SpammyTLD 6081 2.14 2.69 1.90 116 TR_XM_SpammyWords3 6030 0.92 2.67 0.13 117 XM_DK_Undo_01 6001 1.95 2.65 1.63 118 DATE_IN_PAST_03_06 5939 0.86 2.62 0.06 119 MIME_QP_LONG_LINE 5920 4.64 2.62 5.55 120 URI_TRY_3LD 5902 1.79 2.61 1.42 121 SpammyFromTLD_02 5828 1.02 2.58 0.31 122 XM_UB80 5772 0.82 2.55 0.03 123 XMBrknScrpt_02 5755 1.27 2.54 0.69 124 RELAYCOUNTRY_UA 5708 0.81 2.52 0.03 125 RCVD_IN_RP_CERTIFIED 5309 4.66 2.35 5.70 126 TR_LOTS_OF_MONEY3 5017 0.92 2.22 0.33 127 MIME_HTML_ONLY_MULTI 4895 2.77 2.16 3.04 128 TR_XM_SB_Phish 4869 2.04 2.15 1.99 129 XM_B_COVIDMETA 4851 1.50 2.14 1.21 130 RCVD_IN_MSPIKE_L3 4787 0.74 2.12 0.11 131 XM_UB99 4771 0.66 2.11 0.00 132 BOTNET_NORDNS 4745 0.67 2.10 0.02 133 RELAYCOUNTRY_FR 4677 0.84 2.07 0.29 134 T_FILL_THIS_FORM_SHORT 4620 1.38 2.04 1.07 135 XM_B_Unsub2 4546 1.88 2.01 1.82 136 XMSubPhish11 4494 1.98 1.99 1.97 137 BAYES_40 4374 3.83 1.93 4.70 138 TM2_M_VERY_LONG_WORD 4240 1.29 1.87 1.03 139 XMSubNoVowel 4219 1.84 1.86 1.83 140 MAILING_LIST_MULTI 4205 2.57 1.86 2.90 141 FROM_EXCESS_BASE64 4041 2.23 1.79 2.43 142 TR_XM_RelayPhish 3913 0.58 1.73 0.07 143 BAYES_00 3893 10.51 1.72 14.50 144 XM_URI_RBL 3884 0.64 1.72 0.15 145 T_Symld_Words_02 3851 0.88 1.70 0.51 146 XM_CamelCaseFrm001 3743 1.82 1.65 1.89 147 RCVD_IN_IADB_LISTED 3732 4.11 1.65 5.22 148 INVALID_DATE 3709 0.53 1.64 0.02 149 XMSlimDrugH 3566 0.65 1.58 0.24 150 T_XMDrugObfuBody_14 3474 1.56 1.54 1.57 151 T_XMDrugObfuBody_00 3427 0.83 1.51 0.53 152 XMHTML_After_End 3418 1.03 1.51 0.81 153 XMGenDplmaNmb 3404 1.10 1.50 0.92 154 RCVD_IN_IADB_SPF 3333 3.59 1.47 4.55 155 XM_UB999 3249 0.45 1.44 0.00 156 XM_B_SpammyWords4 3229 0.86 1.43 0.60 157 NO_FM_NAME_IP_HOSTN 3207 0.44 1.42 0.00 158 BAYES_20 3187 2.96 1.41 3.66 159 RCVD_IN_IADB_DK 3139 3.15 1.39 3.95 160 RCVD_IN_IADB_SENDERID 3112 3.24 1.38 4.09 161 XMSexyCombo_01 3092 1.00 1.37 0.83 162 RDNS_DYNAMIC 3084 0.72 1.36 0.43 163 TR_Caps_n_Bayes_99 3049 0.46 1.35 0.05 164 TR_XM_INV_DKIM 2988 0.47 1.32 0.09 165 PDS_BTC_ID 2952 0.43 1.30 0.03 166 XMStockSpam_06 2908 1.17 1.29 1.12 167 XM_B_Crypto 2873 0.42 1.27 0.04 168 TR_XM_FormFill 2853 0.41 1.26 0.03 169 TR_XM_COVIDMETA4 2839 0.67 1.25 0.41 170 SHORTENED_URL_HREF 2818 0.82 1.25 0.62 171 XMMoneyMeta_00 2771 0.84 1.22 0.66 172 BITCOIN_EXTORT_01 2748 0.38 1.21 0.00 173 FROM_SUSPICIOUS_NTLD 2672 0.43 1.18 0.09 174 PDS_OTHER_BAD_TLD 2671 0.69 1.18 0.47 175 HK_RANDOM_REPLYTO 2655 0.50 1.17 0.20 176 URI_NOVOWEL 2642 2.06 1.17 2.47 177 XMBdyGiftCard01 2640 0.82 1.17 0.66 178 XM_UB95 2546 0.36 1.13 0.02 179 XMSubMetaD_00 2539 0.42 1.12 0.10 180 FROM_SUSPICIOUS_NTLD_FP 2502 0.40 1.11 0.08 181 TR_XM_BayesRelay 2452 0.34 1.08 0.01 182 TR_XM_Crypto2 2420 0.34 1.07 0.00 183 XMSubMetaI_00 2397 0.79 1.06 0.67 184 HTML_TAG_BALANCE_BODY 2385 0.69 1.05 0.53 185 XMSubEmpty 2347 0.91 1.04 0.85 186 XMBody_78 2322 0.59 1.03 0.39 187 TVD_SPACE_RATIO_MINFP 2312 0.33 1.02 0.02 188 TR_Mismatch_TLD_01 2289 0.61 1.01 0.43 189 TVD_SPACE_RATIO 2243 0.59 0.99 0.40 190 MIMEOLE_DIRECT_TO_MX 2240 0.31 0.99 0.00 191 TR_Mismatch_TLD_02 2238 0.36 0.99 0.07 192 TR_MetaPhish_Combo_01 2219 0.78 0.98 0.69 193 TR_XM_COVIDMETA1 2146 0.47 0.95 0.26 194 XM_OfRef7 2084 0.41 0.92 0.18 195 XM_ProductURIs 2055 1.08 0.91 1.15 196 DRUGS_ERECTILE 2043 0.30 0.90 0.02 197 HTTPS_HTTP_MISMATCH 2003 0.81 0.89 0.78 198 MIME_CHARSET_FARAWAY 1977 0.36 0.87 0.13 199 HELO_NODOT 1974 1.40 0.87 1.64 200 HELO_NO_DOMAIN 1967 1.40 0.87 1.64 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 421490 86.34 90.37 84.51 2 RELAYCOUNTRY_US 389527 75.91 71.08 78.11 3 DKIM_SIGNED 358337 73.11 75.89 71.85 4 XM_DK_Pass 352412 71.69 73.96 70.66 5 DKIM_VALID 343069 69.95 72.51 68.79 6 XM_B_Unicode 335082 68.81 72.38 67.19 7 DCC_CHECK_NEGATIVE 302513 48.75 22.50 60.66 8 BAYES_50 273191 48.92 36.00 54.78 9 DKIM_VALID_AU 252261 52.00 55.12 50.58 10 XMListUnsubscribeExists 237708 52.98 64.68 47.66 11 XM_B_SpammyWords 222000 50.27 62.97 44.51 12 DCC_CHECK 185830 49.41 76.18 37.26 13 XM_B_Unicode3 185665 35.82 32.72 37.23 14 T_TM2_M_HEADER_IN_MSG 139913 25.88 21.09 28.05 15 DKIM_VALID_EF 138572 26.99 25.24 27.79 16 RCVD_IN_MSPIKE_WL 131740 23.11 15.84 26.42 17 RCVD_IN_MSPIKE_H2 130006 27.24 29.82 26.07 18 HTML_FONT_LOW_CONTRAST 127665 27.85 32.82 25.60 19 FVGT_m_MULTI_ODD 109849 22.50 23.54 22.03 20 LOC_TINY_FONT_1 108706 25.47 33.56 21.80 21 MIME_HTML_ONLY 100219 23.27 30.26 20.10 22 XMSubLong 96467 20.95 24.48 19.34 23 XM_B_SpammyWords2 93209 23.74 34.87 18.69 24 ALL_TRUSTED 93172 14.73 6.02 18.68 25 T_KAM_HTML_FONT_INVALID 85812 19.42 24.31 17.21 26 RCVD_IN_MSPIKE_H3 72757 12.78 8.79 14.59 27 BAYES_00 72333 10.51 1.72 14.50 28 XM_Body_Dirty_Words 59595 13.38 16.52 11.95 29 XM_Multi_Part_URI 53351 13.84 20.76 10.70 30 TR_XM_DK_Bayes 49547 7.05 0.69 9.93 31 TR_XM_DK_Bayes1 48110 6.84 0.67 9.65 32 XM_B_Unsub 47688 9.95 10.81 9.56 33 RCVD_IN_MSPIKE_H4 47561 8.52 6.29 9.54 34 TM2_M_URI_OPT_OUT 44212 7.01 2.91 8.87 35 XM_Evil_Numbers_Gen 43614 8.60 8.27 8.75 36 TR_XM_DK_Bayes2 42294 6.00 0.52 8.48 37 XM_DKIMWhitelistDomains 40659 5.62 0.04 8.15 38 LotsOfNums_01 40524 9.27 11.80 8.13 39 TooManyTo_001 39881 7.25 5.61 8.00 40 ANY_BOUNCE_MESSAGE 35518 5.02 0.40 7.12 41 BOUNCE_MESSAGE 35517 5.02 0.40 7.12 42 BAYES_60 34976 7.30 7.93 7.01 43 UNPARSEABLE_RELAY 34871 6.80 6.37 6.99 44 XM_DK_Undo_02 33988 18.36 43.82 6.82 45 HTML_IMAGE_RATIO_02 33312 6.98 7.63 6.68 46 RCVD_IN_RP_SAFE 31786 5.34 3.07 6.37 47 XM_SendGrid 31629 5.98 5.19 6.34 48 FSL_BULK_SIG 30123 9.62 17.52 6.04 49 LOTS_OF_MONEY 29892 7.44 10.63 5.99 50 RCVD_IN_RP_CERTIFIED 28440 4.66 2.35 5.70 51 IN_ZIMBRA_NJ_WHITELIST 28232 3.92 0.07 5.66 52 MIME_QP_LONG_LINE 27694 4.64 2.62 5.55 53 XMStrtUSub 27312 5.14 4.41 5.48 54 RCVD_IN_IADB_LISTED 26033 4.11 1.65 5.22 55 RELAYCOUNTRY_META 24952 10.24 21.78 5.00 56 TR_XM_DKIM_Undo 24936 14.55 35.61 5.00 57 XM_H_Long_From01 24908 5.05 5.17 4.99 58 TR_XM_UnparsRelay 24424 5.27 6.10 4.90 59 BOTNET_IPINHOSTNAME 24377 7.51 13.28 4.89 60 XM_B_Phish_Phrases 24327 5.31 6.26 4.88 61 XM_PDF 24315 3.61 0.82 4.88 62 HTML_IMAGE_RATIO_04 23726 4.42 3.68 4.76 63 MPART_ALT_DIFF 23506 5.32 6.67 4.71 64 BAYES_40 23424 3.83 1.93 4.70 65 BAYES_05 22791 3.38 0.77 4.57 66 RCVD_IN_IADB_SPF 22687 3.59 1.47 4.55 67 T_TooManySym_01 22398 4.98 6.07 4.49 68 XMSubMetaSx_00 21018 4.54 5.26 4.21 69 BAYES_80 20929 5.54 8.49 4.20 70 XM_B_SpammyWords3 20917 5.94 9.79 4.19 71 RCVD_IN_IADB_SENDERID 20404 3.24 1.38 4.09 72 BAYES_99 20364 14.38 37.06 4.08 73 RCVD_IN_IADB_DK 19724 3.15 1.39 3.95 74 TR_XM_DK_SendGrid 19439 3.60 2.94 3.90 75 TR_XM_SpammyWords4 18955 5.47 9.14 3.80 76 XMSexyCombo_05 18933 5.75 10.05 3.80 77 HTML_IMAGE_RATIO_06 18264 3.52 3.21 3.66 78 BAYES_20 18262 2.96 1.41 3.66 79 T_REMOTE_IMAGE 16663 5.17 9.19 3.34 80 BAYES_999 16274 11.69 30.27 3.26 81 RCVD_IN_IADB_VOUCHED 16071 2.42 0.66 3.22 82 XM_UncommonTLD01 15586 4.66 8.03 3.13 83 DKIM_INVALID 15268 3.16 3.38 3.06 84 XMNumbers 15243 3.44 4.28 3.06 85 MIME_HTML_ONLY_MULTI 15156 2.77 2.16 3.04 86 MAILING_LIST_MULTI 14447 2.57 1.86 2.90 87 XM_H_Trusted_IP 14117 1.95 0.00 2.83 88 TR_XM_PhishingBody 13831 3.75 5.91 2.77 89 BAYES_95 12396 3.17 4.67 2.49 90 URI_NOVOWEL 12312 2.06 1.17 2.47 91 FROM_EXCESS_BASE64 12132 2.23 1.79 2.43 92 HTML_IMAGE_RATIO_08 11673 3.34 5.54 2.34 93 RCVD_IN_MSPIKE_H5 11422 1.81 0.76 2.29 94 T_TooManySym_02 10720 2.93 4.67 2.15 95 MIME_HTML_MOSTLY 10586 3.04 5.07 2.12 96 RCVD_IN_IADB_OPTIN 10376 1.58 0.48 2.08 97 XM_OfRef6 10154 2.74 4.29 2.04 98 TooManyTo_002 10152 1.57 0.54 2.04 99 HTML_MIME_NO_HTML_TAG 9957 4.14 8.86 2.00 100 TR_XM_SB_Phish 9948 2.04 2.15 1.99 101 XMSubPhish11 9834 1.98 1.99 1.97 102 XM_B_SpammyTLD 9452 2.14 2.69 1.90 103 XM_CamelCaseFrm001 9442 1.82 1.65 1.89 104 TR_DCC_Bayes_99 9425 10.41 29.21 1.89 105 XMSubNoVowel 9106 1.84 1.86 1.83 106 XM_B_Unsub2 9095 1.88 2.01 1.82 107 XMDiploma_00 8930 2.14 2.92 1.79 108 XM_SPF_SoftFail 8676 2.35 3.70 1.74 109 XM_B_Phish66 8466 2.30 3.63 1.70 110 UNTRUSTED_Relay 8353 6.54 17.25 1.67 111 HELO_NODOT 8203 1.40 0.87 1.64 112 HELO_NO_DOMAIN 8201 1.40 0.87 1.64 113 XM_DK_Undo_01 8142 1.95 2.65 1.63 114 KHOP_HELO_FCRDNS 8057 3.37 7.25 1.62 115 T_XMDrugObfuBody_14 7826 1.56 1.54 1.57 116 TVD_RCVD_IP 7824 1.24 0.51 1.57 117 T_FONT_INVIS_NAKED_TO 7621 2.36 4.19 1.53 118 BOTNET 7362 5.28 13.66 1.48 119 SUBJ_ALL_CAPS 7291 1.93 2.96 1.46 120 INVALID_MSGID 7272 1.17 0.55 1.46 121 IN_HORDE_ADDRESS_BOOK 7268 1.05 0.16 1.46 122 URI_TRY_3LD 7097 1.79 2.61 1.42 123 TR_Symld_Words 7075 2.75 5.68 1.42 124 T_XMDrugObfuBody_08 7041 1.94 3.10 1.41 125 RELAYCOUNTRY_CA 6848 2.54 5.10 1.37 126 TR_XM_SpammyWords5 6831 2.06 3.57 1.37 127 RCVD_IN_BL_SPAMCOP_NET 6776 3.76 9.06 1.36 128 TO_MALFORMED 6580 0.91 0.02 1.32 129 TooManyTo_003 6573 1.05 0.45 1.32 130 MSGID_NOFQDN1 6453 0.90 0.03 1.29 131 XMCapTrack 6122 0.95 0.35 1.23 132 XM_B_COVIDMETA 6059 1.50 2.14 1.21 133 T_OBFU_PDF_ATTACH 6031 0.89 0.20 1.21 134 URI_HEX 5841 1.79 3.16 1.17 135 CK_HELO_DYNAMIC_SPLIT_IP 5802 1.04 0.76 1.16 136 HELO_MISC_IP 5800 0.89 0.29 1.16 137 XMSubMetaSxObfu_03 5742 0.99 0.64 1.15 138 XM_ProductURIs 5739 1.08 0.91 1.15 139 XM_GoogleGroups 5730 0.91 0.40 1.15 140 XMStockSpam_06 5588 1.17 1.29 1.12 141 T_FILL_THIS_FORM_SHORT 5349 1.38 2.04 1.07 142 XMGappySubj_01 5225 0.79 0.22 1.05 143 TM2_M_VERY_LONG_WORD 5134 1.29 1.87 1.03 144 USER_IN_DEF_DKIM_WL 5129 0.71 0.00 1.03 145 DKIM_ADSP_CUSTOM_MED 4957 0.95 0.85 0.99 146 XM_UB50 4947 2.84 6.90 0.99 147 TooManyTo_004 4709 0.77 0.39 0.94 148 TR_MSPIKEBAYES00 4670 0.65 0.01 0.94 149 XMBSHREFv2 4631 0.71 0.22 0.93 150 XM_H_Long_From02 4611 0.85 0.68 0.92 151 XMGenDplmaNmb 4573 1.10 1.50 0.92 152 HTML_FONT_FACE_BAD 4430 0.80 0.60 0.89 153 XMNoVowels 4402 0.75 0.44 0.88 154 XMBody_95 4292 0.64 0.14 0.86 155 RELAYCOUNTRY_GB 4274 0.86 0.86 0.86 156 XMSubEmpty 4256 0.91 1.04 0.85 157 XM_S_SpammyWords 4245 0.81 0.72 0.85 158 TR_XM_Spammywords 4242 0.70 0.35 0.85 159 XMSexyCombo_01 4131 1.00 1.37 0.83 160 XM_GRM 4104 0.57 0.00 0.82 161 XMHTML_After_End 4023 1.03 1.51 0.81 162 HTTPS_HTTP_MISMATCH 3894 0.81 0.89 0.78 163 TooManyTo_005 3847 0.63 0.33 0.77 164 SpammyFromTLD_01 3755 1.47 3.05 0.75 165 T_XMHurry_00 3526 1.41 2.97 0.71 166 TR_MetaPhish_Combo_01 3445 0.78 0.98 0.69 167 XMBrknScrpt_02 3431 1.27 2.54 0.69 168 T_TooManySym_03 3390 1.83 4.35 0.68 169 XMSubMetaI_00 3332 0.79 1.06 0.67 170 XMMoneyMeta_00 3292 0.84 1.22 0.66 171 XMBdyGiftCard01 3282 0.82 1.17 0.66 172 XM_SPF_Unknown 3215 0.62 0.57 0.64 173 NML_ADSP_CUSTOM_MED 3209 0.66 0.70 0.64 174 SHORTENED_URL_HREF 3101 0.82 1.25 0.62 175 FORGED_GMAIL_RCVD 3100 0.67 0.78 0.62 176 RELAYCOUNTRY_NL 3086 0.60 0.56 0.62 177 XM_B_SpammyWords4 2987 0.86 1.43 0.60 178 TR_XM_SpammyWords2 2879 4.68 13.73 0.58 179 HTML_TAG_BALANCE_BODY 2641 0.69 1.05 0.53 180 FROM_GOV_DKIM_AU 2634 0.39 0.08 0.53 181 T_XMDrugObfuBody_00 2626 0.83 1.51 0.53 182 T_Symld_Words_02 2559 0.88 1.70 0.51 183 XM_ShortIntro_01 2528 0.47 0.39 0.51 184 XMBody_17 2498 1.32 3.14 0.50 185 XMSexyCombo_04 2431 0.54 0.66 0.49 186 XMHTMLBadTable_001 2430 0.48 0.46 0.49 187 RELAYCOUNTRY_DE 2396 0.55 0.69 0.48 188 XM_H_PHPMailer 2370 0.44 0.36 0.48 189 PDS_OTHER_BAD_TLD 2325 0.69 1.18 0.47 190 RCVD_IN_SORBS_DUL 2288 0.42 0.33 0.46 191 HTML_IMAGE_ONLY_20 2276 0.45 0.43 0.46 192 TM2_M_BODY_EMPTY 2265 0.33 0.04 0.45 193 XM_DIRTYINTL 2248 1.39 3.45 0.45 194 FROM_GOV_SPOOF 2243 0.36 0.17 0.45 195 SHORT_HELO_AND_INLINE_IMAGE 2240 0.34 0.09 0.45 196 MISSING_HEADERS 2211 0.52 0.68 0.44 197 HTML_IMAGE_ONLY_32 2185 0.37 0.23 0.44 198 RDNS_DYNAMIC 2167 0.72 1.36 0.43 199 TR_Mismatch_TLD_01 2150 0.61 1.01 0.43 200 USER_IN_WHITELIST 2104 0.29 0.00 0.42 ----------------------------------------------------------------------