Email: 688063 Autolearn: 0 AvgScore: 3.31 AvgScanTime: 1.36 sec Spam: 198644 Autolearn: 0 AvgScore: 13.54 AvgScanTime: 1.54 sec Ham: 489419 Autolearn: 0 AvgScore: -0.84 AvgScanTime: 1.29 sec Time Spent Running SA: 260.07 hours Time Spent Processing Spam: 84.79 hours Time Spent Processing Ham: 175.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 190905 89.67 96.10 87.06 2 DKIM_SIGNED 178888 81.68 90.05 78.29 3 XM_DK_Pass 175322 80.37 88.26 77.17 4 DKIM_VALID 171459 78.52 86.31 75.36 5 RELAYCOUNTRY_US 159670 83.58 80.38 84.88 6 XM_B_Unicode 159189 73.11 80.14 70.26 7 DCC_CHECK 153680 52.66 77.36 42.64 8 XM_B_SpammyWords 150797 57.18 75.91 49.58 9 XMListUnsubscribeExists 147348 57.51 74.18 50.75 10 DKIM_VALID_AU 131077 59.79 65.99 57.27 11 XM_DK_Undo_02 101072 20.33 50.88 7.93 12 TR_XM_DKIM_Undo 87975 16.95 44.29 5.86 13 XM_B_Unicode3 87543 42.43 44.07 41.76 14 XM_B_SpammyWords2 84206 26.59 42.39 20.18 15 LOC_TINY_FONT_1 79762 29.61 40.15 25.33 16 BAYES_50 73731 49.88 37.12 55.06 17 BAYES_99 71146 13.77 35.82 4.82 18 RCVD_IN_MSPIKE_H2 68332 30.01 34.40 28.23 19 HTML_FONT_LOW_CONTRAST 67418 29.60 33.94 27.83 20 DKIM_VALID_EF 61301 30.77 30.86 30.74 21 MIME_HTML_ONLY 60098 24.25 30.25 21.82 22 FVGT_m_MULTI_ODD 58182 24.92 29.29 23.14 23 BAYES_999 56824 10.96 28.61 3.79 24 T_KAM_HTML_FONT_INVALID 56100 21.68 28.24 19.02 25 TR_DCC_Bayes_99 54590 9.85 27.48 2.70 26 XMSubLong 49539 21.33 24.94 19.87 27 RCVD_IN_MSPIKE_WL 46052 29.20 23.18 31.65 28 XM_Body_Dirty_Words 41646 15.04 20.97 12.64 29 DCC_CHECK_NEGATIVE 41297 45.34 20.79 55.30 30 T_TM2_M_HEADER_IN_MSG 41079 25.72 20.68 27.77 31 RELAYCOUNTRY_META 39651 9.00 19.96 4.56 32 XM_Multi_Part_URI 31221 13.19 15.72 12.16 33 BOTNET 30856 5.69 15.53 1.69 34 TR_XM_SpammyWords2 29000 4.77 14.60 0.79 35 XM_B_SpammyWords3 28277 8.03 14.24 5.51 36 XM_B_Unsub 27743 11.31 13.97 10.24 37 LOTS_OF_MONEY 27714 9.06 13.95 7.07 38 RCVD_IN_MSPIKE_H3 26040 15.12 13.11 15.94 39 TR_XM_SpammyWords4 24573 6.98 12.37 4.80 40 BOTNET_IPINHOSTNAME 23927 6.66 12.05 4.48 41 RCVD_IN_BL_SPAMCOP_NET 23296 4.60 11.73 1.71 42 XM_Evil_Numbers_Gen 22060 9.56 11.11 8.93 43 XMSexyCombo_05 21701 6.14 10.92 4.20 44 UNTRUSTED_Relay 21288 4.32 10.72 1.73 45 MPART_ALT_DIFF 21027 6.94 10.59 5.46 46 XM_UncommonTLD01 20666 5.38 10.40 3.34 47 HTML_IMAGE_RATIO_02 19557 7.81 9.85 6.98 48 LotsOfNums_01 18266 9.10 9.20 9.06 49 RCVD_IN_MSPIKE_H4 18121 10.84 9.12 11.53 50 UNPARSEABLE_RELAY 17138 8.30 8.63 8.17 51 TR_XM_UnparsRelay 16671 6.80 8.39 6.15 52 XM_B_Phish_Phrases 15897 7.91 8.00 7.87 53 BAYES_80 15439 5.61 7.77 4.73 54 MIME_HTML_MOSTLY 15367 3.96 7.74 2.43 55 FSL_BULK_SIG 14545 6.19 7.32 5.73 56 XM_H_Long_From01 14319 6.08 7.21 5.62 57 XMSubMetaSx_00 14052 4.51 7.07 3.47 58 BAYES_60 13879 7.30 6.99 7.42 59 RELAYCOUNTRY_CA 13845 2.99 6.97 1.37 60 XM_SendGrid 13689 7.23 6.89 7.37 61 TR_XM_PhishingBody 13608 4.10 6.85 2.98 62 TR_XM_SpammyWords5 13036 3.10 6.56 1.70 63 URIBL_SBL_A 11970 3.04 6.03 1.83 64 HTML_IMAGE_RATIO_04 11681 5.98 5.88 6.02 65 XM_OfRef6 10624 2.20 5.35 0.92 66 SpammyFromTLD_01 10608 2.26 5.34 1.01 67 TooManyTo_001 10577 7.13 5.32 7.87 68 XMNumbers 9992 3.60 5.03 3.01 69 BAYES_95 9347 3.22 4.71 2.62 70 RCVD_IN_RP_SAFE 9306 7.10 4.68 8.07 71 XM_DK_Undo_01 8619 2.42 4.34 1.64 72 XM_SPF_SoftFail 8445 2.32 4.25 1.54 73 FROM_EXCESS_BASE64 8337 3.24 4.20 2.85 74 XM_B_SpammyTLD 8335 2.77 4.20 2.18 75 TM2_M_URI_OPT_OUT 8315 3.29 4.19 2.93 76 XMBody_17 8055 1.63 4.05 0.65 77 RELAYCOUNTRY_FR 7647 1.29 3.85 0.25 78 DKIM_INVALID 7429 3.16 3.74 2.93 79 XM_UB50 7415 1.79 3.73 1.00 80 TR_XM_DK_SendGrid 7413 4.61 3.73 4.97 81 XMStrtUSub 7329 6.50 3.69 7.65 82 XM_B_Phish66 7260 2.34 3.65 1.81 83 HTML_MIME_NO_HTML_TAG 7243 2.50 3.65 2.03 84 BOTNET_NORDNS 7219 1.06 3.63 0.02 85 MIME_HTML_ONLY_MULTI 6942 3.48 3.49 3.48 86 RCVD_IN_RP_CERTIFIED 6832 6.20 3.44 7.32 87 TR_XM_MaxBayes 6747 1.00 3.40 0.02 88 SUBJ_ALL_CAPS 6689 2.16 3.37 1.67 89 RCVD_IN_MSPIKE_BL 6451 1.09 3.25 0.21 90 TR_XM_MSPIKECOMBO 6435 1.08 3.24 0.20 91 MIME_QP_LONG_LINE 6220 4.95 3.13 5.68 92 HTML_IMAGE_RATIO_06 6174 3.59 3.11 3.79 93 XMDiploma_00 6117 1.92 3.08 1.45 94 XM_UB99 6033 0.88 3.04 0.00 95 BAYES_20 5798 3.60 2.92 3.87 96 HTML_IMAGE_RATIO_08 5781 2.62 2.91 2.50 97 SpammyFromTLD_02 5640 1.08 2.84 0.37 98 XM_B_Unsub2 5606 1.84 2.82 1.44 99 XM_B_COVIDMETA 5556 1.43 2.80 0.88 100 XM_CamelCaseFrm001 5449 2.13 2.74 1.88 101 XMBrknScrpt_02 5421 1.25 2.73 0.65 102 URI_HEX 5400 1.71 2.72 1.30 103 XMBdyGiftCard01 5378 1.35 2.71 0.80 104 DKIM_ADSP_NXDOMAIN 5242 0.93 2.64 0.24 105 T_TooManySym_01 5221 3.98 2.63 4.53 106 HDRS_MISSP 5199 0.86 2.62 0.15 107 TR_LOTS_OF_MONEY3 5116 1.03 2.58 0.40 108 FORGED_GMAIL_RCVD 4966 1.10 2.50 0.54 109 RCVD_IN_PSBL 4842 0.73 2.44 0.04 110 BAYES_40 4833 4.56 2.43 5.42 111 XM_UB999 4819 0.70 2.43 0.00 112 TM2_M_VERY_LONG_WORD 4812 1.72 2.42 1.44 113 HTML_IMAGE_ONLY_08 4713 0.75 2.37 0.09 114 URIBL_DBL_ABUSE_REDIR 4701 0.69 2.37 0.01 115 HDRS_LCASE_IMGONLY 4662 0.73 2.35 0.07 116 HTML_SHORT_LINK_IMG_1 4661 0.70 2.35 0.03 117 RCVD_IN_IADB_LISTED 4655 5.02 2.34 6.11 118 XM_DIRTYINTL 4613 0.96 2.32 0.41 119 XM_B_SpammyWords4 4568 1.04 2.30 0.53 120 SHORTENER_SHORT_IMG 4552 0.66 2.29 0.00 121 TR_XM_SpammyWords3 4432 0.72 2.23 0.11 122 URI_NOVOWEL 4271 2.88 2.15 3.17 123 T_FILL_THIS_FORM_SHORT 4268 1.14 2.15 0.73 124 URI_TRY_3LD 4160 1.46 2.09 1.20 125 RCVD_IN_IADB_SPF 4143 4.38 2.09 5.31 126 T_XMDrugObfuBody_08 4139 1.81 2.08 1.71 127 TR_XM_SB_Phish 4113 2.16 2.07 2.20 128 RCVD_IN_RP_RNBL 4099 0.64 2.06 0.06 129 T_XMDrugObfuBody_14 4033 2.05 2.03 2.06 130 XMSubPhish11 3975 2.12 2.00 2.16 131 RCVD_IN_IADB_DK 3910 3.84 1.97 4.60 132 RCVD_IN_IADB_SENDERID 3888 3.95 1.96 4.76 133 TR_XM_PHPDW 3836 1.03 1.93 0.66 134 TR_XM_PHPForged 3766 0.99 1.90 0.62 135 TR_XM_BayesRelay 3763 0.56 1.89 0.02 136 XMStockSpam_06 3762 1.37 1.89 1.16 137 TR_XM_FormFill2 3754 0.99 1.89 0.62 138 XM_H_PHPOS 3750 0.98 1.89 0.61 139 T_REMOTE_IMAGE 3715 3.23 1.87 3.78 140 XMGenDplmaNmb 3507 1.07 1.77 0.78 141 PDS_OTHER_BAD_TLD 3438 1.00 1.73 0.71 142 XM_URI_RBL 3302 0.60 1.66 0.17 143 T_XMHurry_00 3185 0.94 1.60 0.67 144 RELAYCOUNTRY_GB 3183 1.11 1.60 0.91 145 XMSexyCombo_01 3050 0.82 1.54 0.53 146 T_XMDrugObfuBody_00 3007 1.03 1.51 0.83 147 RCVD_IN_MSPIKE_L5 3007 0.50 1.51 0.09 148 URI_PHP_REDIR 2953 0.43 1.49 0.00 149 XM_OfRef7 2887 0.51 1.45 0.13 150 XM_Body_Dirty_Words_01 2887 0.93 1.45 0.71 151 XMPhish08 2864 0.60 1.44 0.27 152 KHOP_HELO_FCRDNS 2858 1.45 1.44 1.45 153 TR_XM_COVIDMETA1 2838 0.61 1.43 0.27 154 HK_RANDOM_REPLYTO 2810 0.52 1.41 0.16 155 MAILING_LIST_MULTI 2798 2.07 1.41 2.34 156 URIBL_BLACK 2785 0.43 1.40 0.03 157 TR_Symld_Words 2778 1.38 1.40 1.37 158 TR_Sbj_FN_Bdy 2745 0.50 1.38 0.14 159 TR_XM_INV_DKIM 2721 0.47 1.37 0.11 160 MALE_ENHANCE 2607 0.39 1.31 0.01 161 XMSubMetaI_00 2576 0.84 1.30 0.65 162 XM_H_Long_From02 2539 1.16 1.28 1.11 163 XM_UB60 2497 0.44 1.26 0.11 164 XMSubject_48 2462 0.37 1.24 0.02 165 XMSubject_47 2458 0.36 1.24 0.00 166 HTTPS_HTTP_MISMATCH 2425 0.84 1.22 0.69 167 XMHTML_After_End 2416 0.94 1.22 0.82 168 NUMERIC_HTTP_ADDR 2414 0.66 1.22 0.43 169 RCVD_IN_MSPIKE_L3 2379 0.40 1.20 0.08 170 RELAYCOUNTRY_DE 2335 0.66 1.18 0.45 171 TR_XM_COVIDMETA4 2326 0.58 1.17 0.34 172 BAYES_00 2297 10.10 1.16 13.73 173 TR_XM_FormFill 2245 0.34 1.13 0.02 174 SHORT_SHORTNER 2221 0.33 1.12 0.02 175 DEAR_BENEFICIARY 2213 0.32 1.11 0.00 176 BAYES_05 2170 1.96 1.09 2.31 177 XM_UB80 2163 0.34 1.09 0.03 178 T_Symld_Words_02 2054 0.68 1.03 0.54 179 GOOGLE_DOC_SUSP 2035 0.30 1.02 0.01 180 XMPhish30 1983 0.58 1.00 0.42 181 FROM_SUSPICIOUS_NTLD 1958 0.33 0.99 0.06 182 RCVD_IN_IADB_VOUCHED 1922 2.98 0.97 3.80 183 FROM_SUSPICIOUS_NTLD_FP 1902 0.32 0.96 0.06 184 RCVD_IN_MSPIKE_H5 1891 3.25 0.95 4.18 185 XM_B_SEO 1884 0.36 0.95 0.12 186 RELAYCOUNTRY_NL 1883 0.42 0.95 0.20 187 TR_XM_SEO4 1812 0.31 0.91 0.06 188 TR_BOTNET_NEGATE 1789 0.55 0.90 0.40 189 TR_XM_RelayPhish 1760 0.30 0.89 0.07 190 XMBody_78 1747 0.60 0.88 0.49 191 XM_ProductURIs 1737 0.86 0.87 0.85 192 T_MONEY_PERCENT 1688 0.33 0.85 0.11 193 TR_LOTS_OF_MONEY2 1688 0.33 0.85 0.11 194 HTML_TAG_BALANCE_BODY 1678 0.56 0.84 0.45 195 ALL_TRUSTED 1654 8.63 0.83 11.79 196 URI_NO_WWW_BIZ_CGI 1637 0.24 0.82 0.01 197 TR_XM_DK_Bayes 1633 7.17 0.82 9.74 198 TR_MetaPhish_Combo_01 1623 0.75 0.82 0.72 199 HTML_FONT_SIZE_HUGE 1584 0.38 0.80 0.22 200 TR_XM_DK_Bayes1 1579 6.95 0.79 9.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 426065 89.67 96.10 87.06 2 RELAYCOUNTRY_US 415441 83.58 80.38 84.88 3 DKIM_SIGNED 383143 81.68 90.05 78.29 4 XM_DK_Pass 377677 80.37 88.26 77.17 5 DKIM_VALID 368816 78.52 86.31 75.36 6 XM_B_Unicode 343844 73.11 80.14 70.26 7 DKIM_VALID_AU 280296 59.79 65.99 57.27 8 DCC_CHECK_NEGATIVE 270640 45.34 20.79 55.30 9 BAYES_50 269489 49.88 37.12 55.06 10 XMListUnsubscribeExists 248361 57.51 74.18 50.75 11 XM_B_SpammyWords 242636 57.18 75.91 49.58 12 DCC_CHECK 208664 52.66 77.36 42.64 13 XM_B_Unicode3 204376 42.43 44.07 41.76 14 RCVD_IN_MSPIKE_WL 154891 29.20 23.18 31.65 15 DKIM_VALID_EF 150426 30.77 30.86 30.74 16 RCVD_IN_MSPIKE_H2 138152 30.01 34.40 28.23 17 HTML_FONT_LOW_CONTRAST 136220 29.60 33.94 27.83 18 T_TM2_M_HEADER_IN_MSG 135900 25.72 20.68 27.77 19 LOC_TINY_FONT_1 123980 29.61 40.15 25.33 20 FVGT_m_MULTI_ODD 113261 24.92 29.29 23.14 21 MIME_HTML_ONLY 106777 24.25 30.25 21.82 22 XM_B_SpammyWords2 98756 26.59 42.39 20.18 23 XMSubLong 97236 21.33 24.94 19.87 24 T_KAM_HTML_FONT_INVALID 93073 21.68 28.24 19.02 25 RCVD_IN_MSPIKE_H3 78003 15.12 13.11 15.94 26 BAYES_00 67198 10.10 1.16 13.73 27 XM_Body_Dirty_Words 61843 15.04 20.97 12.64 28 XM_Multi_Part_URI 59532 13.19 15.72 12.16 29 XM_DKIMWhitelistDomains 58441 8.50 0.04 11.94 30 ALL_TRUSTED 57712 8.63 0.83 11.79 31 RCVD_IN_MSPIKE_H4 56450 10.84 9.12 11.53 32 XM_B_Unsub 50100 11.31 13.97 10.24 33 TR_XM_DK_Bayes 47684 7.17 0.82 9.74 34 TR_XM_DK_Bayes1 46224 6.95 0.79 9.44 35 LotsOfNums_01 44353 9.10 9.20 9.06 36 XM_Evil_Numbers_Gen 43703 9.56 11.11 8.93 37 TR_XM_DK_Bayes2 39982 6.01 0.70 8.17 38 UNPARSEABLE_RELAY 39976 8.30 8.63 8.17 39 RCVD_IN_RP_SAFE 39517 7.10 4.68 8.07 40 XM_DK_Undo_02 38824 20.33 50.88 7.93 41 XM_B_Phish_Phrases 38526 7.91 8.00 7.87 42 TooManyTo_001 38513 7.13 5.32 7.87 43 XMStrtUSub 37419 6.50 3.69 7.65 44 BAYES_60 36336 7.30 6.99 7.42 45 XM_SendGrid 36077 7.23 6.89 7.37 46 RCVD_IN_RP_CERTIFIED 35839 6.20 3.44 7.32 47 LOTS_OF_MONEY 34613 9.06 13.95 7.07 48 HTML_IMAGE_RATIO_02 34166 7.81 9.85 6.98 49 TR_XM_UnparsRelay 30096 6.80 8.39 6.15 50 RCVD_IN_IADB_LISTED 29915 5.02 2.34 6.11 51 HTML_IMAGE_RATIO_04 29445 5.98 5.88 6.02 52 TR_XM_DKIM_Undo 28663 16.95 44.29 5.86 53 FSL_BULK_SIG 28050 6.19 7.32 5.73 54 MIME_QP_LONG_LINE 27819 4.95 3.13 5.68 55 XM_H_Long_From01 27496 6.08 7.21 5.62 56 XM_B_SpammyWords3 26950 8.03 14.24 5.51 57 MPART_ALT_DIFF 26708 6.94 10.59 5.46 58 BAYES_40 26517 4.56 2.43 5.42 59 IN_ZIMBRA_NJ_WHITELIST 26486 3.87 0.06 5.41 60 RCVD_IN_IADB_SPF 26011 4.38 2.09 5.31 61 TR_XM_DK_SendGrid 24340 4.61 3.73 4.97 62 BAYES_99 23581 13.77 35.82 4.82 63 TR_XM_SpammyWords4 23480 6.98 12.37 4.80 64 RCVD_IN_IADB_SENDERID 23290 3.95 1.96 4.76 65 BAYES_80 23169 5.61 7.77 4.73 66 RCVD_IN_IADB_DK 22491 3.84 1.97 4.60 67 RELAYCOUNTRY_META 22301 9.00 19.96 4.56 68 T_TooManySym_01 22170 3.98 2.63 4.53 69 BOTNET_IPINHOSTNAME 21928 6.66 12.05 4.48 70 XM_PDF 20643 3.23 0.79 4.22 71 XMSexyCombo_05 20558 6.14 10.92 4.20 72 RCVD_IN_MSPIKE_H5 20438 3.25 0.95 4.18 73 BAYES_20 18958 3.60 2.92 3.87 74 RCVD_IN_IADB_VOUCHED 18574 2.98 0.97 3.80 75 BAYES_999 18564 10.96 28.61 3.79 76 HTML_IMAGE_RATIO_06 18532 3.59 3.11 3.79 77 T_REMOTE_IMAGE 18522 3.23 1.87 3.78 78 MIME_HTML_ONLY_MULTI 17035 3.48 3.49 3.48 79 XMSubMetaSx_00 16967 4.51 7.07 3.47 80 XM_H_Trusted_IP 16645 2.42 0.00 3.40 81 XM_UncommonTLD01 16329 5.38 10.40 3.34 82 URI_NOVOWEL 15514 2.88 2.15 3.17 83 XMNumbers 14752 3.60 5.03 3.01 84 TR_XM_PhishingBody 14576 4.10 6.85 2.98 85 TM2_M_URI_OPT_OUT 14347 3.29 4.19 2.93 86 DKIM_INVALID 14327 3.16 3.74 2.93 87 FROM_EXCESS_BASE64 13924 3.24 4.20 2.85 88 TR_DCC_Bayes_99 13218 9.85 27.48 2.70 89 BAYES_95 12832 3.22 4.71 2.62 90 HTML_IMAGE_RATIO_08 12259 2.62 2.91 2.50 91 RCVD_IN_IADB_OPTIN 12129 1.96 0.67 2.48 92 MIME_HTML_MOSTLY 11889 3.96 7.74 2.43 93 MAILING_LIST_MULTI 11442 2.07 1.41 2.34 94 BAYES_05 11322 1.96 1.09 2.31 95 TR_XM_SB_Phish 10771 2.16 2.07 2.20 96 T_TooManySym_02 10755 1.78 0.75 2.20 97 XM_B_SpammyTLD 10691 2.77 4.20 2.18 98 XMSubPhish11 10592 2.12 2.00 2.16 99 T_XMDrugObfuBody_14 10063 2.05 2.03 2.06 100 HTML_MIME_NO_HTML_TAG 9937 2.50 3.65 2.03 101 TooManyTo_002 9766 1.58 0.55 2.00 102 ANY_BOUNCE_MESSAGE 9269 1.48 0.46 1.89 103 BOUNCE_MESSAGE 9268 1.48 0.46 1.89 104 XM_CamelCaseFrm001 9198 2.13 2.74 1.88 105 URIBL_SBL_A 8979 3.04 6.03 1.83 106 XM_B_Phish66 8873 2.34 3.65 1.81 107 UNTRUSTED_Relay 8453 4.32 10.72 1.73 108 RCVD_IN_BL_SPAMCOP_NET 8384 4.60 11.73 1.71 109 T_XMDrugObfuBody_08 8345 1.81 2.08 1.71 110 TR_XM_SpammyWords5 8324 3.10 6.56 1.70 111 BOTNET 8265 5.69 15.53 1.69 112 SUBJ_ALL_CAPS 8170 2.16 3.37 1.67 113 HTML_FONT_FACE_BAD 8032 1.37 0.71 1.64 114 XM_DK_Undo_01 8020 2.42 4.34 1.64 115 HELO_NODOT 7923 1.31 0.55 1.62 116 HELO_NO_DOMAIN 7923 1.31 0.54 1.62 117 INVALID_MSGID 7558 1.22 0.43 1.54 118 XM_SPF_SoftFail 7536 2.32 4.25 1.54 119 IN_HORDE_ADDRESS_BOOK 7432 1.10 0.08 1.52 120 TVD_RCVD_IP 7216 1.08 0.11 1.47 121 XMDiploma_00 7114 1.92 3.08 1.45 122 KHOP_HELO_FCRDNS 7097 1.45 1.44 1.45 123 XM_B_Unsub2 7064 1.84 2.82 1.44 124 TM2_M_VERY_LONG_WORD 7036 1.72 2.42 1.44 125 RELAYCOUNTRY_CA 6720 2.99 6.97 1.37 126 TR_Symld_Words 6719 1.38 1.40 1.37 127 MSGID_NOFQDN1 6673 0.98 0.04 1.36 128 TooManyTo_003 6454 1.07 0.46 1.32 129 TO_MALFORMED 6440 0.94 0.00 1.32 130 URI_HEX 6352 1.71 2.72 1.30 131 HELO_MISC_IP 6161 0.96 0.22 1.26 132 USER_IN_DEF_DKIM_WL 5966 0.87 0.02 1.22 133 TR_MSPIKEBAYES00 5946 0.87 0.01 1.21 134 URI_TRY_3LD 5873 1.46 2.09 1.20 135 XMStockSpam_06 5694 1.37 1.89 1.16 136 XMCapTrack 5440 0.92 0.46 1.11 137 XM_H_Long_From02 5416 1.16 1.28 1.11 138 XM_GoogleGroups 5255 0.92 0.52 1.07 139 XMBSHREFv2 5159 0.82 0.23 1.05 140 SpammyFromTLD_01 4966 2.26 5.34 1.01 141 XM_UB50 4882 1.79 3.73 1.00 142 XMGappySubj_01 4714 0.73 0.17 0.96 143 XMSubNoVowel 4694 0.82 0.48 0.96 144 DKIM_ADSP_CUSTOM_MED 4604 0.89 0.77 0.94 145 TooManyTo_004 4571 0.78 0.41 0.93 146 XM_OfRef6 4490 2.20 5.35 0.92 147 RELAYCOUNTRY_GB 4437 1.11 1.60 0.91 148 XM_B_COVIDMETA 4313 1.43 2.80 0.88 149 XM_ProductURIs 4148 0.86 0.87 0.85 150 T_XMDrugObfuBody_00 4064 1.03 1.51 0.83 151 XMHTML_After_End 4020 0.94 1.22 0.82 152 XMBdyGiftCard01 3913 1.35 2.71 0.80 153 TR_XM_SpammyWords2 3849 4.77 14.60 0.79 154 XMGenDplmaNmb 3833 1.07 1.77 0.78 155 XMBody_95 3772 0.58 0.11 0.77 156 TooManyTo_005 3747 0.65 0.36 0.77 157 T_FILL_THIS_FORM_SHORT 3588 1.14 2.15 0.73 158 TR_MetaPhish_Combo_01 3508 0.75 0.82 0.72 159 XM_Body_Dirty_Words_01 3487 0.93 1.45 0.71 160 PDS_OTHER_BAD_TLD 3472 1.00 1.73 0.71 161 DIET_1 3392 0.69 0.69 0.69 162 HTTPS_HTTP_MISMATCH 3367 0.84 1.22 0.69 163 T_XMHurry_00 3269 0.94 1.60 0.67 164 TR_XM_PHPDW 3234 1.03 1.93 0.66 165 XMBrknScrpt_02 3185 1.25 2.73 0.65 166 XMSubMetaI_00 3179 0.84 1.30 0.65 167 XMBody_17 3176 1.63 4.05 0.65 168 XMHTMLBadTable_001 3158 0.64 0.61 0.65 169 T_TooManySym_03 3077 0.52 0.26 0.63 170 NML_ADSP_CUSTOM_MED 3066 0.61 0.56 0.63 171 TR_XM_FormFill2 3037 0.99 1.89 0.62 172 TR_XM_PHPForged 3035 0.99 1.90 0.62 173 XM_H_PHPOS 3002 0.98 1.89 0.61 174 HTML_IMAGE_ONLY_20 2945 0.48 0.18 0.60 175 FROM_GOV_DKIM_AU 2767 0.44 0.13 0.57 176 T_OBFU_PDF_ATTACH 2753 0.45 0.16 0.56 177 XMNoVowels 2740 0.50 0.37 0.56 178 XM_SPF_Unknown 2681 0.54 0.52 0.55 179 XMLngstWrd_00 2655 0.56 0.60 0.54 180 XM_RXBody 2651 0.51 0.42 0.54 181 FORGED_GMAIL_RCVD 2635 1.10 2.50 0.54 182 T_Symld_Words_02 2625 0.68 1.03 0.54 183 XM_ShortIntro_01 2616 0.46 0.28 0.53 184 XM_B_SpammyWords4 2603 1.04 2.30 0.53 185 XM_H_PHPMailer 2599 0.51 0.45 0.53 186 XMSexyCombo_01 2578 0.82 1.54 0.53 187 RDNS_DYNAMIC 2529 0.58 0.74 0.52 188 TVD_SPACE_RATIO 2525 0.39 0.07 0.52 189 XMBody_78 2412 0.60 0.88 0.49 190 XMLngstWrd_01 2402 0.51 0.56 0.49 191 RCVD_IN_SORBS_DUL 2361 0.39 0.15 0.48 192 XMMoneyMeta_00 2337 0.55 0.74 0.48 193 SHORT_HELO_AND_INLINE_IMAGE 2261 0.35 0.08 0.46 194 RELAYCOUNTRY_DE 2221 0.66 1.18 0.45 195 XMSubMetaSxObfu_03 2215 0.53 0.72 0.45 196 HTML_TAG_BALANCE_BODY 2190 0.56 0.84 0.45 197 XM_B_COPY_HTML 2147 0.49 0.63 0.44 198 MISSING_HEADERS 2135 0.40 0.33 0.44 199 NUMERIC_HTTP_ADDR 2111 0.66 1.22 0.43 200 FROM_GOV_SPOOF 2053 0.34 0.14 0.42 ----------------------------------------------------------------------