Email: 730968 Autolearn: 0 AvgScore: 4.41 AvgScanTime: 1.36 sec Spam: 250098 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.37 sec Ham: 480870 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 1.36 sec Time Spent Running SA: 276.89 hours Time Spent Processing Spam: 94.99 hours Time Spent Processing Ham: 181.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 230537 91.07 92.18 90.49 2 DCC_CHECK 194506 53.13 77.77 40.31 3 XM_B_Unicode 193251 75.15 77.27 74.04 4 DKIM_SIGNED 163679 71.51 65.45 74.66 5 XM_DK_Pass 159711 70.26 63.86 73.59 6 DKIM_VALID 156343 68.60 62.51 71.77 7 XM_B_SpammyWords 151465 52.81 60.56 48.77 8 RELAYCOUNTRY_US 148024 74.28 59.19 82.13 9 XMListUnsubscribeExists 136674 52.13 54.65 50.83 10 DKIM_VALID_AU 119538 51.91 47.80 54.05 11 XM_B_Unicode3 118580 46.17 47.41 45.52 12 MIME_HTML_ONLY 102745 30.77 41.08 25.41 13 BAYES_50 102429 50.21 40.96 55.02 14 XM_DK_Undo_02 94452 18.10 37.77 7.87 15 BAYES_99 78265 14.11 31.29 5.17 16 TR_XM_DKIM_Undo 75013 14.06 29.99 5.78 17 LOC_TINY_FONT_1 73848 26.95 29.53 25.60 18 HTML_FONT_LOW_CONTRAST 72612 26.95 29.03 25.87 19 XM_B_SpammyWords2 72090 23.97 28.82 21.45 20 FSL_BULK_SIG 68016 13.49 27.20 6.36 21 BAYES_999 63546 11.42 25.41 4.15 22 RCVD_IN_MSPIKE_H2 62917 26.53 25.16 27.25 23 TR_DCC_Bayes_99 61166 10.20 24.46 2.78 24 FVGT_m_MULTI_ODD 57715 21.79 23.08 21.12 25 DKIM_VALID_EF 55844 24.95 22.33 26.31 26 XM_Body_Dirty_Words 54438 17.46 21.77 15.21 27 DCC_CHECK_NEGATIVE 52159 45.13 20.86 57.76 28 RELAYCOUNTRY_META 52058 9.97 20.82 4.34 29 XMSubLong 47913 19.54 19.16 19.74 30 T_KAM_HTML_FONT_INVALID 47879 18.60 19.14 18.32 31 ALL_TRUSTED 45911 15.87 18.36 14.58 32 XM_Multi_Part_URI 45697 14.03 18.27 11.82 33 UNTRUSTED_Relay 43511 7.05 17.40 1.66 34 DATE_IN_FUTURE_06_12 43409 7.84 17.36 2.90 35 T_HTML_ATTACH 41986 7.68 16.79 2.94 36 TO_IN_SUBJ 41929 7.65 16.77 2.91 37 OBFU_JVSCR_ESC 41883 7.63 16.75 2.89 38 FROM_IN_TO_AND_SUBJ 41843 7.62 16.73 2.89 39 XMSexyCombo_05 39820 9.17 15.92 5.66 40 T_TM2_M_HEADER_IN_MSG 39402 23.64 15.75 27.75 41 BOTNET 36887 6.08 14.75 1.57 42 RCVD_IN_MSPIKE_WL 35319 23.27 14.12 28.03 43 XM_UncommonTLD01 35153 7.58 14.06 4.20 44 BOTNET_IPINHOSTNAME 31722 7.05 12.68 4.11 45 LotsOfNums_01 28596 9.82 11.43 8.98 46 BAYES_60 27430 9.00 10.97 7.98 47 TR_XM_SpammyWords2 27043 4.23 10.81 0.81 48 T_FILL_THIS_FORM_SHORT 25298 4.97 10.12 2.29 49 XM_B_Unsub 25127 10.58 10.05 10.85 50 LOTS_OF_MONEY 24848 8.26 9.94 7.38 51 RCVD_IN_BL_SPAMCOP_NET 23435 4.09 9.37 1.35 52 XM_SPF_SoftFail 23018 4.31 9.20 1.76 53 XM_B_SpammyWords3 21928 6.56 8.77 5.41 54 TR_XM_SpammyWords4 21249 5.84 8.50 4.46 55 RCVD_IN_MSPIKE_H3 20175 13.17 8.07 15.82 56 BAYES_80 18718 5.31 7.48 4.19 57 XM_Evil_Numbers_Gen 17780 7.95 7.11 8.38 58 RCVD_IN_MSPIKE_BL 17590 2.58 7.03 0.27 59 XM_UB50 17374 2.99 6.95 0.93 60 TR_XM_MSPIKECOMBO 17200 2.53 6.88 0.27 61 T_REMOTE_IMAGE 16837 4.43 6.73 3.24 62 HTML_IMAGE_RATIO_02 16126 7.09 6.45 7.42 63 MPART_ALT_DIFF 15934 6.77 6.37 6.97 64 HTML_MIME_NO_HTML_TAG 15911 3.43 6.36 1.90 65 UNPARSEABLE_RELAY 15116 7.10 6.04 7.65 66 TooManyTo_001 14797 7.06 5.92 7.66 67 TR_XM_UnparsRelay 14297 5.55 5.72 5.47 68 RCVD_IN_MSPIKE_H4 13340 8.29 5.33 9.83 69 XMSubMetaSx_00 13340 3.63 5.33 2.74 70 BODY_URI_ONLY 13230 1.83 5.29 0.04 71 XM_B_SpammyTLD 12986 3.16 5.19 2.10 72 MIME_HTML_MOSTLY 12885 3.38 5.15 2.46 73 KHOP_HELO_FCRDNS 12768 2.68 5.11 1.41 74 XM_H_Long_From01 12361 5.60 4.94 5.94 75 XM_SendGrid 12350 6.25 4.94 6.93 76 XM_B_Phish_Phrases 12316 5.15 4.92 5.27 77 HTML_IMAGE_RATIO_08 12049 3.55 4.82 2.89 78 RCVD_IN_MSPIKE_L5 11920 1.68 4.77 0.08 79 RCVD_IN_PSBL 11606 1.62 4.64 0.05 80 RCVD_IN_RP_RNBL 11578 1.63 4.63 0.07 81 HTML_IMAGE_ONLY_08 11437 1.62 4.57 0.09 82 SpammyFromTLD_02 11326 1.82 4.53 0.41 83 XMNumbers 10990 3.42 4.39 2.91 84 TM2_M_VERY_LONG_WORD 10843 2.38 4.34 1.36 85 RELAYCOUNTRY_CA 10746 2.29 4.30 1.25 86 BAYES_95 10660 3.19 4.26 2.63 87 TR_XM_PhishingBody 10517 3.99 4.21 3.88 88 HTML_IMAGE_RATIO_06 10450 4.04 4.18 3.96 89 TVD_SPACE_RATIO 10161 1.70 4.06 0.47 90 TR_XM_SpammyWords5 10042 2.84 4.02 2.22 91 HTML_IMAGE_RATIO_04 10037 5.20 4.01 5.82 92 PDS_FROM_2_EMAILS 9737 1.35 3.89 0.03 93 FROM_2_EMAILS_SHORT 9672 1.33 3.87 0.01 94 SpammyFromTLD_01 9397 1.87 3.76 0.89 95 TM2_M_URI_OPT_OUT 9320 3.74 3.73 3.75 96 PDS_TO_EQ_FROM_NAME 9173 1.26 3.67 0.01 97 RELAYCOUNTRY_IN 8464 1.22 3.38 0.10 98 NO_FM_NAME_IP_HOSTN 8264 1.14 3.30 0.01 99 XM_UB60 8227 1.18 3.29 0.09 100 LONG_JUNK_URI 7924 1.14 3.17 0.08 101 TO_NO_BRKTS_HTML_ONLY 7751 1.15 3.10 0.14 102 URI_HEX 7597 1.93 3.04 1.36 103 URI_WP_HACKED 7560 1.05 3.02 0.03 104 DKIM_INVALID 7336 2.91 2.93 2.89 105 XM_UB99 7272 1.00 2.91 0.01 106 TVD_SPACE_RATIO_MINFP 7261 1.00 2.90 0.01 107 RCVD_IN_RP_SAFE 7257 6.17 2.90 7.87 108 RELAYCOUNTRY_FR 7096 1.14 2.84 0.26 109 XM_OfRef6 6856 1.53 2.74 0.90 110 DATE_IN_PAST_03_06 6756 1.00 2.70 0.12 111 T_FONT_INVIS_NAKED_TO 6749 2.10 2.70 1.78 112 XMStrtUSub 6624 3.84 2.65 4.46 113 TR_XM_DK_SendGrid 6510 3.78 2.60 4.39 114 URIBL_SBL_A 6441 0.97 2.58 0.14 115 RCVD_IN_RP_CERTIFIED 5945 5.60 2.38 7.27 116 XMDiploma_00 5906 1.86 2.36 1.61 117 FROM_EXCESS_BASE64 5712 2.82 2.28 3.09 118 MIME_QP_LONG_LINE 5660 4.44 2.26 5.57 119 XM_B_Phish66 5621 2.21 2.25 2.19 120 SUBJ_ALL_CAPS 5614 2.24 2.24 2.23 121 XM_UB999 5528 0.76 2.21 0.00 122 XM_UB80 5465 0.76 2.19 0.03 123 XM_DK_Undo_01 5432 1.84 2.17 1.66 124 TR_XM_SB_Phish 5259 2.11 2.10 2.12 125 MIMEOLE_DIRECT_TO_MX 5104 0.70 2.04 0.01 126 XMSubPhish11 5001 2.07 2.00 2.10 127 URI_TRY_3LD 4938 1.64 1.97 1.46 128 MIME_HTML_ONLY_MULTI 4903 3.68 1.96 4.57 129 T_TooManySym_01 4895 3.65 1.96 4.53 130 XM_DIRTYINTL 4887 0.93 1.95 0.40 131 TR_Symld_Words 4876 1.82 1.95 1.76 132 TR_LOTS_OF_MONEY3 4821 1.08 1.93 0.64 133 T_XMDrugObfuBody_08 4689 1.67 1.87 1.57 134 HTML_FONT_SIZE_LARGE 4672 0.70 1.87 0.10 135 RCVD_IN_IADB_LISTED 4667 4.65 1.87 6.11 136 TR_XM_SpoofStaff 4628 0.68 1.85 0.07 137 XMSpoofStaff2 4560 0.67 1.82 0.07 138 BAYES_40 4383 3.73 1.75 4.76 139 URI_ONLY_MSGID_MALF 4208 0.58 1.68 0.01 140 XM_B_Unsub2 4202 1.68 1.68 1.68 141 BITCOIN_XPRIO 4201 0.58 1.68 0.00 142 XMMoneyMeta_00 4120 0.98 1.65 0.64 143 XMSubMetaSxObfu_03 4072 0.86 1.63 0.46 144 XM_LoanWordsFrm 4041 0.60 1.62 0.07 145 XMSubNoVowel 4034 1.99 1.61 2.19 146 RCVD_IN_IADB_SPF 4020 4.00 1.61 5.25 147 HDR_ORDER_FTSDMCXX_DIRECT 4013 0.55 1.60 0.00 148 XMBrknScrpt_02 3963 0.96 1.58 0.64 149 XM_CamelCaseFrm001 3936 1.75 1.57 1.84 150 XMSexyCombo_01 3927 0.83 1.57 0.45 151 XMBody_17 3919 0.98 1.57 0.68 152 URI_PHP_REDIR 3913 0.54 1.56 0.01 153 RCVD_IN_MSPIKE_L3 3882 0.59 1.55 0.09 154 BOTNET_NORDNS 3840 0.53 1.54 0.01 155 DATE_IN_PAST_06_12 3825 0.61 1.53 0.13 156 XM_B_COVIDMETA 3790 1.02 1.52 0.77 157 TR_XM_SpoofStaff2 3692 0.51 1.48 0.00 158 XMGenDplmaNmb 3692 1.05 1.48 0.83 159 RCVD_IN_IADB_SENDERID 3689 3.57 1.48 4.66 160 RCVD_IN_IADB_DK 3682 3.45 1.47 4.48 161 T_XMDrugObfuBody_14 3655 1.82 1.46 2.01 162 TR_XM_PSC1 3649 0.55 1.46 0.07 163 TR_XM_SpammyWords3 3627 0.59 1.45 0.14 164 XM_H_SpoofStaff4 3625 0.55 1.45 0.08 165 PDS_OTHER_BAD_TLD 3589 0.88 1.44 0.59 166 XM_URI_RBL 3454 0.58 1.38 0.17 167 XM_B_SpammyWords4 3442 1.03 1.38 0.85 168 TR_XM_MaxBayes 3408 0.47 1.36 0.01 169 XMBdyGiftCard01 3387 1.28 1.35 1.24 170 BAYES_20 3380 2.90 1.35 3.70 171 URI_NOVOWEL 3375 2.67 1.35 3.36 172 XM_UB95 3279 0.46 1.31 0.01 173 DOS_OE_TO_MX 3234 0.44 1.29 0.00 174 TR_XM_COVIDMETA1 3116 0.74 1.25 0.48 175 RDNS_DYNAMIC 3086 0.73 1.23 0.47 176 FROM_SUSPICIOUS_NTLD 2998 0.46 1.20 0.08 177 FROM_SUSPICIOUS_NTLD_FP 2924 0.45 1.17 0.07 178 XMStockSpam_06 2882 1.18 1.15 1.19 179 TR_XM_PHPDW 2863 0.56 1.14 0.25 180 INVALID_DATE 2862 0.41 1.14 0.03 181 T_XMDrugObfuBody_00 2784 0.95 1.11 0.86 182 MAILING_LIST_MULTI 2764 1.81 1.11 2.18 183 TR_XM_PHPForged 2744 0.51 1.10 0.21 184 TR_XM_FormFill2 2725 0.51 1.09 0.21 185 XM_H_PHPOS 2722 0.51 1.09 0.20 186 TR_XM_COVIDMETA4 2708 0.55 1.08 0.27 187 CK_HELO_DYNAMIC_SPLIT_IP 2695 1.13 1.08 1.16 188 XM_OfRef7 2687 0.44 1.07 0.11 189 XM_SPF_Unknown 2671 0.79 1.07 0.65 190 XMSlimDrugH 2655 0.62 1.06 0.39 191 BAYES_00 2632 9.69 1.05 14.19 192 XM_ProductURIs 2509 1.42 1.00 1.63 193 XMSubEmpty 2474 1.06 0.99 1.10 194 FORGED_GMAIL_RCVD 2426 0.72 0.97 0.59 195 DOS_OUTLOOK_TO_MX 2422 0.44 0.97 0.17 196 TR_Mismatch_TLD_01 2380 0.65 0.95 0.49 197 T_XMHurry_00 2300 0.66 0.92 0.53 198 TR_MetaPhish_Combo_01 2257 0.75 0.90 0.67 199 RELAYCOUNTRY_BR 2252 0.32 0.90 0.01 200 HK_RANDOM_REPLYTO 2215 0.43 0.89 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435150 91.07 92.18 90.49 2 RELAYCOUNTRY_US 394944 74.28 59.19 82.13 3 DKIM_SIGNED 359040 71.51 65.45 74.66 4 XM_B_Unicode 356057 75.15 77.27 74.04 5 XM_DK_Pass 353856 70.26 63.86 73.59 6 DKIM_VALID 345123 68.60 62.51 71.77 7 DCC_CHECK_NEGATIVE 277751 45.13 20.86 57.76 8 BAYES_50 264561 50.21 40.96 55.02 9 DKIM_VALID_AU 259894 51.91 47.80 54.05 10 XMListUnsubscribeExists 244405 52.13 54.65 50.83 11 XM_B_SpammyWords 234529 52.81 60.56 48.77 12 XM_B_Unicode3 218898 46.17 47.41 45.52 13 DCC_CHECK 193842 53.13 77.77 40.31 14 RCVD_IN_MSPIKE_WL 134784 23.27 14.12 28.03 15 T_TM2_M_HEADER_IN_MSG 133427 23.64 15.75 27.75 16 RCVD_IN_MSPIKE_H2 131019 26.53 25.16 27.25 17 DKIM_VALID_EF 126524 24.95 22.33 26.31 18 HTML_FONT_LOW_CONTRAST 124387 26.95 29.03 25.87 19 LOC_TINY_FONT_1 123119 26.95 29.53 25.60 20 MIME_HTML_ONLY 122206 30.77 41.08 25.41 21 XM_B_SpammyWords2 103130 23.97 28.82 21.45 22 FVGT_m_MULTI_ODD 101577 21.79 23.08 21.12 23 XMSubLong 94936 19.54 19.16 19.74 24 T_KAM_HTML_FONT_INVALID 88101 18.60 19.14 18.32 25 RCVD_IN_MSPIKE_H3 76067 13.17 8.07 15.82 26 XM_Body_Dirty_Words 73160 17.46 21.77 15.21 27 ALL_TRUSTED 70100 15.87 18.36 14.58 28 BAYES_00 68223 9.69 1.05 14.19 29 XM_Multi_Part_URI 56841 14.03 18.27 11.82 30 XM_B_Unsub 52179 10.58 10.05 10.85 31 TR_XM_DK_Bayes 49482 7.01 0.70 10.29 32 TR_XM_DK_Bayes1 48124 6.82 0.68 10.01 33 RCVD_IN_MSPIKE_H4 47254 8.29 5.33 9.83 34 LotsOfNums_01 43175 9.82 11.43 8.98 35 TR_XM_DK_Bayes2 42708 6.03 0.56 8.88 36 XM_DKIMWhitelistDomains 42201 5.78 0.03 8.78 37 XM_Evil_Numbers_Gen 40320 7.95 7.11 8.38 38 BAYES_60 38363 9.00 10.97 7.98 39 XM_DK_Undo_02 37860 18.10 37.77 7.87 40 RCVD_IN_RP_SAFE 37841 6.17 2.90 7.87 41 TooManyTo_001 36817 7.06 5.92 7.66 42 UNPARSEABLE_RELAY 36775 7.10 6.04 7.65 43 HTML_IMAGE_RATIO_02 35668 7.09 6.45 7.42 44 LOTS_OF_MONEY 35510 8.26 9.94 7.38 45 RCVD_IN_RP_CERTIFIED 34983 5.60 2.38 7.27 46 MPART_ALT_DIFF 33540 6.77 6.37 6.97 47 XM_SendGrid 33305 6.25 4.94 6.93 48 FSL_BULK_SIG 30584 13.49 27.20 6.36 49 RCVD_IN_IADB_LISTED 29359 4.65 1.87 6.11 50 XM_H_Long_From01 28540 5.60 4.94 5.94 51 HTML_IMAGE_RATIO_04 27992 5.20 4.01 5.82 52 TR_XM_DKIM_Undo 27789 14.06 29.99 5.78 53 IN_ZIMBRA_NJ_WHITELIST 27614 3.83 0.15 5.74 54 XMSexyCombo_05 27218 9.17 15.92 5.66 55 MIME_QP_LONG_LINE 26771 4.44 2.26 5.57 56 TR_XM_UnparsRelay 26297 5.55 5.72 5.47 57 XM_B_SpammyWords3 26020 6.56 8.77 5.41 58 XM_B_Phish_Phrases 25329 5.15 4.92 5.27 59 RCVD_IN_IADB_SPF 25244 4.00 1.61 5.25 60 BAYES_99 24876 14.11 31.29 5.17 61 XM_H_Trusted_IP 23285 3.19 0.00 4.84 62 BAYES_40 22879 3.73 1.75 4.76 63 RCVD_IN_IADB_SENDERID 22389 3.57 1.48 4.66 64 MIME_HTML_ONLY_MULTI 21976 3.68 1.96 4.57 65 T_TooManySym_01 21801 3.65 1.96 4.53 66 RCVD_IN_IADB_DK 21522 3.45 1.47 4.48 67 XMStrtUSub 21465 3.84 2.65 4.46 68 TR_XM_SpammyWords4 21455 5.84 8.50 4.46 69 TR_XM_DK_SendGrid 21094 3.78 2.60 4.39 70 RELAYCOUNTRY_META 20854 9.97 20.82 4.34 71 XM_UncommonTLD01 20219 7.58 14.06 4.20 72 BAYES_80 20131 5.31 7.48 4.19 73 BAYES_999 19945 11.42 25.41 4.15 74 BOTNET_IPINHOSTNAME 19787 7.05 12.68 4.11 75 XM_PDF 19589 2.92 0.69 4.07 76 HTML_IMAGE_RATIO_06 19058 4.04 4.18 3.96 77 TR_XM_PhishingBody 18668 3.99 4.21 3.88 78 RCVD_IN_IADB_VOUCHED 18482 2.83 0.88 3.84 79 TM2_M_URI_OPT_OUT 18018 3.74 3.73 3.75 80 BAYES_20 17802 2.90 1.35 3.70 81 URI_NOVOWEL 16142 2.67 1.35 3.36 82 T_REMOTE_IMAGE 15561 4.43 6.73 3.24 83 FROM_EXCESS_BASE64 14865 2.82 2.28 3.09 84 T_HTML_ATTACH 14136 7.68 16.79 2.94 85 TO_IN_SUBJ 14006 7.65 16.77 2.91 86 XMNumbers 14002 3.42 4.39 2.91 87 DATE_IN_FUTURE_06_12 13922 7.84 17.36 2.90 88 DKIM_INVALID 13917 2.91 2.93 2.89 89 HTML_IMAGE_RATIO_08 13899 3.55 4.82 2.89 90 OBFU_JVSCR_ESC 13897 7.63 16.75 2.89 91 FROM_IN_TO_AND_SUBJ 13881 7.62 16.73 2.89 92 TR_DCC_Bayes_99 13384 10.20 24.46 2.78 93 XMSubMetaSx_00 13174 3.63 5.33 2.74 94 BAYES_95 12666 3.19 4.26 2.63 95 RCVD_IN_IADB_OPTIN 12135 1.87 0.61 2.52 96 MIME_HTML_MOSTLY 11825 3.38 5.15 2.46 97 RCVD_IN_MSPIKE_H5 11463 1.81 0.72 2.38 98 BAYES_05 11112 1.80 0.81 2.31 99 T_FILL_THIS_FORM_SHORT 11000 4.97 10.12 2.29 100 SUBJ_ALL_CAPS 10732 2.24 2.24 2.23 101 TR_XM_SpammyWords5 10693 2.84 4.02 2.22 102 XM_B_Phish66 10548 2.21 2.25 2.19 103 XMSubNoVowel 10522 1.99 1.61 2.19 104 MAILING_LIST_MULTI 10492 1.81 1.11 2.18 105 TR_XM_SB_Phish 10192 2.11 2.10 2.12 106 XM_B_SpammyTLD 10114 3.16 5.19 2.10 107 XMSubPhish11 10105 2.07 2.00 2.10 108 T_XMDrugObfuBody_14 9642 1.82 1.46 2.01 109 TooManyTo_002 9364 1.45 0.50 1.95 110 T_TooManySym_02 9255 1.48 0.63 1.92 111 HTML_MIME_NO_HTML_TAG 9155 3.43 6.36 1.90 112 XM_CamelCaseFrm001 8841 1.75 1.57 1.84 113 HTML_FONT_FACE_BAD 8621 1.31 0.39 1.79 114 T_FONT_INVIS_NAKED_TO 8569 2.10 2.70 1.78 115 XM_SPF_SoftFail 8484 4.31 9.20 1.76 116 TR_Symld_Words 8463 1.82 1.95 1.76 117 XM_B_Unsub2 8078 1.68 1.68 1.68 118 XM_DK_Undo_01 7993 1.84 2.17 1.66 119 UNTRUSTED_Relay 7992 7.05 17.40 1.66 120 BOUNCE_MESSAGE 7875 1.34 0.76 1.64 121 ANY_BOUNCE_MESSAGE 7875 1.34 0.76 1.64 122 XM_ProductURIs 7841 1.42 1.00 1.63 123 XMDiploma_00 7720 1.86 2.36 1.61 124 BOTNET 7568 6.08 14.75 1.57 125 INVALID_MSGID 7550 1.17 0.41 1.57 126 T_XMDrugObfuBody_08 7534 1.67 1.87 1.57 127 IN_HORDE_ADDRESS_BOOK 7522 1.23 0.58 1.56 128 URI_TRY_3LD 7034 1.64 1.97 1.46 129 HELO_NO_DOMAIN 6948 1.19 0.69 1.44 130 HELO_NODOT 6948 1.19 0.71 1.44 131 MSGID_NOFQDN1 6843 0.95 0.03 1.42 132 KHOP_HELO_FCRDNS 6803 2.68 5.11 1.41 133 TO_MALFORMED 6693 0.92 0.01 1.39 134 TVD_RCVD_IP 6618 1.09 0.54 1.38 135 URI_HEX 6532 1.93 3.04 1.36 136 TM2_M_VERY_LONG_WORD 6529 2.38 4.34 1.36 137 RCVD_IN_BL_SPAMCOP_NET 6477 4.09 9.37 1.35 138 TooManyTo_003 6212 0.99 0.42 1.29 139 RELAYCOUNTRY_CA 6025 2.29 4.30 1.25 140 XMBdyGiftCard01 5981 1.28 1.35 1.24 141 XM_H_Long_From02 5773 1.07 0.81 1.20 142 TR_MSPIKEBAYES00 5756 0.79 0.02 1.20 143 XMStockSpam_06 5735 1.18 1.15 1.19 144 CK_HELO_DYNAMIC_SPLIT_IP 5590 1.13 1.08 1.16 145 HELO_MISC_IP 5585 0.89 0.36 1.16 146 USER_IN_DEF_DKIM_WL 5376 0.74 0.01 1.12 147 XMSubEmpty 5274 1.06 0.99 1.10 148 XM_GoogleGroups 5082 0.81 0.34 1.06 149 XMGappySubj_01 5061 0.76 0.19 1.05 150 XMCapTrack 4959 0.79 0.34 1.03 151 XMBSHREFv2 4755 0.70 0.16 0.99 152 DKIM_ADSP_CUSTOM_MED 4688 0.88 0.70 0.97 153 XM_UB50 4474 2.99 6.95 0.93 154 TooManyTo_004 4353 0.72 0.36 0.91 155 XM_OfRef6 4330 1.53 2.74 0.90 156 SpammyFromTLD_01 4301 1.87 3.76 0.89 157 T_XMDrugObfuBody_00 4157 0.95 1.11 0.86 158 XM_B_SpammyWords4 4106 1.03 1.38 0.85 159 XMGenDplmaNmb 4005 1.05 1.48 0.83 160 RELAYCOUNTRY_GB 3959 0.81 0.79 0.82 161 NUMERIC_HTTP_ADDR 3934 0.66 0.35 0.82 162 TR_XM_SpammyWords2 3876 4.23 10.81 0.81 163 XMBody_95 3788 0.54 0.07 0.79 164 XM_B_COVIDMETA 3682 1.02 1.52 0.77 165 TooManyTo_005 3616 0.61 0.32 0.75 166 FROM_GOV_DKIM_AU 3441 0.52 0.13 0.72 167 SHORTENED_URL_HREF 3425 0.74 0.80 0.71 168 DIET_1 3363 0.65 0.55 0.70 169 HTTPS_HTTP_MISMATCH 3361 0.75 0.84 0.70 170 NML_ADSP_CUSTOM_MED 3287 0.66 0.62 0.68 171 XMBody_17 3252 0.98 1.57 0.68 172 TR_MetaPhish_Combo_01 3225 0.75 0.90 0.67 173 XMHTML_After_End 3185 0.67 0.69 0.66 174 XM_SPF_Unknown 3123 0.79 1.07 0.65 175 XMBrknScrpt_02 3075 0.96 1.58 0.64 176 TR_LOTS_OF_MONEY3 3064 1.08 1.93 0.64 177 XMMoneyMeta_00 3060 0.98 1.65 0.64 178 XMPhish08 3053 0.61 0.57 0.63 179 XMOemUri 2942 0.50 0.30 0.61 180 PLING_QUERY 2924 0.53 0.39 0.61 181 T_Symld_Words_02 2889 0.65 0.75 0.60 182 HTML_IMAGE_ONLY_20 2843 0.46 0.21 0.59 183 FORGED_GMAIL_RCVD 2836 0.72 0.97 0.59 184 PDS_OTHER_BAD_TLD 2816 0.88 1.44 0.59 185 T_TooManySym_03 2812 0.47 0.24 0.58 186 T_OBFU_PDF_ATTACH 2800 0.42 0.12 0.58 187 XMPhish14 2780 0.58 0.58 0.58 188 T_XMHurry_00 2560 0.66 0.92 0.53 189 XM_ShortIntro_01 2470 0.41 0.21 0.51 190 XMSubMetaI_00 2436 0.63 0.86 0.51 191 TR_Mismatch_TLD_01 2364 0.65 0.95 0.49 192 TR_XM_COVIDMETA1 2313 0.74 1.25 0.48 193 XMBody_78 2296 0.61 0.88 0.48 194 RDNS_DYNAMIC 2273 0.73 1.23 0.47 195 XMNoVowels 2272 0.41 0.30 0.47 196 TVD_SPACE_RATIO 2238 1.70 4.06 0.47 197 XM_H_PHPMailer 2235 0.44 0.40 0.46 198 XMSubMetaSxObfu_03 2205 0.86 1.63 0.46 199 XM_B_COPY_HTML 2174 0.46 0.48 0.45 200 XMSexyCombo_01 2168 0.83 1.57 0.45 ----------------------------------------------------------------------