Email: 663081 Autolearn: 0 AvgScore: 1.72 AvgScanTime: 2.13 sec Spam: 140342 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 3.58 sec Ham: 522739 Autolearn: 0 AvgScore: -1.19 AvgScanTime: 1.74 sec Time Spent Running SA: 393.05 hours Time Spent Processing Spam: 139.72 hours Time Spent Processing Ham: 253.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133586 87.69 95.19 85.67 2 DCC_CHECK 113054 47.00 80.56 37.99 3 RELAYCOUNTRY_US 111560 79.69 79.49 79.74 4 DKIM_SIGNED 108173 72.52 77.08 71.29 5 XM_B_Unicode 105924 69.79 75.48 68.26 6 XM_DK_Pass 104501 71.06 74.46 70.14 7 XMListUnsubscribeExists 93858 51.98 66.88 47.98 8 DKIM_VALID 89036 65.41 63.44 65.94 9 DKIM_VALID_AU 66863 48.51 47.64 48.74 10 BAYES_50 63084 51.37 44.95 53.09 11 XM_B_Unicode3 56015 38.36 39.91 37.94 12 XM_DK_Undo_02 54772 13.11 39.03 6.15 13 MIME_HTML_ONLY 52616 24.38 37.49 20.86 14 HTML_FONT_LOW_CONTRAST 42825 26.12 30.51 24.94 15 LOC_TINY_FONT_1 42526 25.05 30.30 23.64 16 DKIM_VALID_EF 39522 25.58 28.16 24.89 17 FVGT_m_MULTI_ODD 36048 22.11 25.69 21.15 18 BAYES_99 35903 7.71 25.58 2.92 19 T_KAM_HTML_FONT_INVALID 35202 18.96 25.08 17.32 20 XMSubLong 34330 21.65 24.46 20.90 21 XM_UncommonTLD01 33849 10.31 24.12 6.60 22 BOTNET 31948 6.84 22.76 2.56 23 RELAYCOUNTRY_META 30705 8.87 21.88 5.38 24 TR_DCC_Bayes_99 28866 5.46 20.57 1.40 25 T_TM2_M_HEADER_IN_MSG 27537 26.48 19.62 28.32 26 FSL_BULK_SIG 27232 9.58 19.40 6.94 27 BAYES_999 26757 5.84 19.07 2.29 28 DCC_CHECK_NEGATIVE 24834 50.96 17.70 59.90 29 XM_Body_Dirty_Words 24633 12.91 17.55 11.66 30 XM_Multi_Part_URI 23054 12.27 16.43 11.16 31 BOTNET_IPINHOSTNAME 20301 6.36 14.47 4.18 32 UNTRUSTED_Relay 19807 4.27 14.11 1.63 33 DKIM_INVALID 19137 7.11 13.64 5.35 34 LOTS_OF_MONEY 17860 11.26 12.73 10.87 35 XM_B_Unsub 17143 10.59 12.22 10.15 36 XM_B_Phish_Phrases 16711 7.63 11.91 6.49 37 RCVD_IN_MSPIKE_H2 15622 13.68 11.13 14.36 38 HTML_IMAGE_RATIO_02 14241 7.54 10.15 6.84 39 NO_DNS_FOR_FROM 14226 4.38 10.14 2.83 40 XM_CamelCaseFrm001 14013 3.67 9.98 1.98 41 KHOP_HELO_FCRDNS 12292 4.04 8.76 2.77 42 XM_Evil_Numbers_Gen 12207 8.39 8.70 8.31 43 XMSexyCombo_05 12114 4.47 8.63 3.36 44 LotsOfNums_01 11923 8.48 8.50 8.48 45 XM_B_COVIDMETA 11334 3.23 8.08 1.92 46 BAYES_80 11266 3.78 8.03 2.64 47 XM_H_Long_From01 10919 6.09 7.78 5.63 48 XM_UB50 10858 2.42 7.74 0.99 49 SpammyFromTLD_02 10585 1.84 7.54 0.30 50 XM_B_SpammyTLD 10346 3.14 7.37 2.00 51 BAYES_60 9918 5.78 7.07 5.44 52 RCVD_IN_MSPIKE_BL 9753 2.98 6.95 1.92 53 TR_XM_COVIDMETA4 8888 2.50 6.33 1.47 54 RCVD_IN_MSPIKE_L3 8483 2.77 6.04 1.89 55 URIBL_SBL_A 8436 1.46 6.01 0.24 56 HTML_IMAGE_RATIO_04 8128 5.09 5.79 4.90 57 XMSubMetaSx_00 8123 3.30 5.79 2.63 58 XM_SPF_SoftFail 7847 2.71 5.59 1.94 59 RELAYCOUNTRY_CA 7695 2.47 5.48 1.67 60 RDNS_DYNAMIC 7470 1.41 5.32 0.36 61 MPART_ALT_DIFF 7369 5.62 5.25 5.72 62 T_XMDrugObfuBody_08 7328 2.37 5.22 1.61 63 MIME_QP_LONG_LINE 7226 5.70 5.15 5.85 64 UNPARSEABLE_RELAY 7017 6.67 5.00 7.11 65 TooManyTo_001 6817 7.68 4.86 8.44 66 XMHTML_After_End 6361 1.50 4.53 0.68 67 XMBody_17 6214 1.48 4.43 0.69 68 T_REMOTE_IMAGE 6055 3.85 4.31 3.73 69 XM_SendGrid 6037 6.03 4.30 6.50 70 BAYES_95 5814 2.14 4.14 1.60 71 TR_XM_MaxBayes 5664 0.87 4.04 0.02 72 BOTNET_NORDNS 5639 0.87 4.02 0.02 73 RCVD_IN_RP_RNBL 5587 0.92 3.98 0.10 74 HTML_MIME_NO_HTML_TAG 5562 2.44 3.96 2.03 75 NORDNS_LOW_CONTRAST 5534 0.84 3.94 0.01 76 BODY_URI_ONLY 5482 0.94 3.91 0.14 77 XMStrtUSub 5421 3.83 3.86 3.82 78 FROM_MISSP_REPLYTO 5384 0.82 3.84 0.01 79 FROM_SUSPICIOUS_NTLD 5204 0.82 3.71 0.05 80 XMNumbers 5202 3.02 3.71 2.83 81 FROM_SUSPICIOUS_NTLD_FP 5116 0.81 3.65 0.05 82 RELAYCOUNTRY_FR 5107 0.99 3.64 0.28 83 XM_URI_RBL 4965 0.90 3.54 0.19 84 PDS_OTHER_BAD_TLD 4796 1.16 3.42 0.55 85 MIME_HTML_MOSTLY 4787 2.58 3.41 2.36 86 RCVD_IN_BL_SPAMCOP_NET 4659 1.43 3.32 0.93 87 LongTLD 4594 0.84 3.27 0.18 88 BAYES_40 4562 5.31 3.25 5.87 89 TR_XM_PhishingBody 4502 1.69 3.21 1.28 90 XM_DIRTYINTL 4491 1.07 3.20 0.50 91 FROM_MISSP_DYNIP 4421 0.67 3.15 0.00 92 TM2_M_URI_OPT_OUT 4345 3.01 3.10 2.98 93 FROM_EXCESS_BASE64 4249 2.80 3.03 2.74 94 HTML_IMAGE_RATIO_06 4132 3.67 2.94 3.86 95 SpammyFromTLD_01 4082 1.31 2.91 0.88 96 TR_LOTS_OF_MONEY3 4036 0.97 2.88 0.46 97 DATE_IN_PAST_06_12 3999 0.73 2.85 0.17 98 RCVD_IN_MSPIKE_WL 3868 7.29 2.76 8.50 99 RCVD_IN_MSPIKE_H3 3868 7.29 2.76 8.50 100 BAYES_00 3799 16.66 2.71 20.40 101 T_XMHurry_00 3693 0.90 2.63 0.43 102 TR_Mismatch_TLD_02 3559 3.16 2.54 3.33 103 BAYES_20 3529 4.31 2.51 4.79 104 URI_HEX 3460 1.66 2.47 1.44 105 MIME_HTML_ONLY_MULTI 3352 3.57 2.39 3.89 106 XM_B_Unsub2 3331 2.21 2.37 2.16 107 T_TooManySym_01 3266 3.76 2.33 4.15 108 RCVD_IN_PSBL 3197 0.52 2.28 0.05 109 TR_XM_INV_DKIM 3113 0.52 2.22 0.07 110 XM_OfRef6 3081 1.24 2.20 0.99 111 RELAYCOUNTRY_DE 3008 0.82 2.14 0.46 112 HTML_SHORT_LINK_IMG_1 2973 0.47 2.12 0.03 113 TM2_M_VERY_LONG_WORD 2972 1.37 2.12 1.17 114 DKIM_ADSP_NXDOMAIN 2963 0.67 2.11 0.28 115 XMDiploma_00 2956 1.51 2.11 1.35 116 RCVD_IN_IADB_LISTED 2940 4.51 2.09 5.15 117 HTML_IMAGE_RATIO_08 2917 2.20 2.08 2.23 118 TR_XM_DK_SendGrid 2768 3.28 1.97 3.63 119 HDRS_LCASE_IMGONLY 2752 0.42 1.96 0.01 120 RCVD_IN_IADB_SPF 2707 3.98 1.93 4.52 121 DATE_IN_PAST_03_06 2706 0.53 1.93 0.15 122 XMBody_78 2679 0.73 1.91 0.42 123 RCVD_IN_IADB_DK 2631 3.51 1.87 3.95 124 RCVD_IN_IADB_SENDERID 2615 3.54 1.86 3.98 125 URI_TRY_3LD 2594 1.20 1.85 1.03 126 TR_XM_PHPDW 2558 1.15 1.82 0.96 127 TR_XM_PHPForged 2508 1.13 1.79 0.95 128 TR_XM_FormFill2 2488 1.13 1.77 0.95 129 XM_H_PHPOS 2478 1.12 1.77 0.95 130 BAYES_05 2461 2.93 1.75 3.25 131 XM_DK_Undo_01 2363 1.86 1.68 1.91 132 T_XMDrugObfuBody_14 2352 1.36 1.68 1.28 133 DATE_IN_PAST_12_24 2337 0.38 1.67 0.04 134 MIME_HEADER_CTYPE_ONLY 2299 0.51 1.64 0.21 135 XMSexyCombo_01 2245 0.63 1.60 0.37 136 XMMoneyMeta_00 2200 1.06 1.57 0.93 137 XM_UB60 2180 0.39 1.55 0.08 138 TR_XM_MaxSPIKE 2149 0.37 1.53 0.06 139 SUBJ_ALL_CAPS 2024 1.39 1.44 1.37 140 TR_XM_DK_Bayes 2002 10.24 1.43 12.61 141 XMStockSpam_06 1980 1.17 1.41 1.11 142 REPLYTO_WITHOUT_TO_CC 1966 0.36 1.40 0.08 143 MAILING_LIST_MULTI 1952 2.41 1.39 2.68 144 TR_MetaPhish_Combo_01 1926 1.12 1.37 1.05 145 RCVD_IN_RP_SAFE 1878 6.37 1.34 7.72 146 XMPhish08 1829 0.57 1.30 0.37 147 TR_XM_COVIDMETA1 1816 0.61 1.29 0.42 148 RELAYCOUNTRY_GB 1815 1.12 1.29 1.07 149 XMBrknScrpt_02 1791 0.90 1.28 0.80 150 MONEY_FRAUD_8 1772 0.27 1.26 0.00 151 TR_XM_RelayPhish 1722 0.36 1.23 0.12 152 HTML_TITLE_SUBJ_DIFF 1711 0.30 1.22 0.05 153 HTTPS_HTTP_MISMATCH 1696 0.93 1.21 0.86 154 HDRS_MISSP 1681 0.31 1.20 0.07 155 T_FILL_THIS_FORM_SHORT 1671 1.16 1.19 1.15 156 T_XMDrugObfuBody_00 1640 0.69 1.17 0.56 157 XMGenDplmaNmb 1597 0.86 1.14 0.78 158 URI_NOVOWEL 1575 0.59 1.12 0.44 159 RELAYCOUNTRY_JP 1564 0.27 1.11 0.04 160 TR_LOTS_OF_MONEY2 1554 0.43 1.11 0.25 161 T_MONEY_PERCENT 1554 0.43 1.11 0.25 162 HTML_IMAGE_ONLY_08 1541 0.33 1.10 0.12 163 T_Symld_Words_02 1534 0.69 1.09 0.58 164 XMSubNoVowel 1532 1.33 1.09 1.39 165 NO_FM_NAME_IP_HOSTN 1513 0.23 1.08 0.00 166 ALL_TRUSTED 1494 13.44 1.06 16.77 167 XM_H_MailChimp 1459 0.36 1.04 0.17 168 XMSubMetaSxObfu_03 1448 0.57 1.03 0.45 169 HK_RANDOM_REPLYTO 1439 0.36 1.03 0.18 170 HTML_IMAGE_ONLY_12 1438 0.35 1.02 0.17 171 XM_BadFromFormat 1432 0.35 1.02 0.17 172 TR_Symld_Words 1429 1.32 1.02 1.40 173 XMReplyNow 1409 0.30 1.00 0.11 174 TR_Mismatch_TLD_01 1402 0.35 1.00 0.18 175 TO_MALFORMED 1399 1.29 1.00 1.37 176 RELAYCOUNTRY_IN 1395 0.28 0.99 0.09 177 XMPhish30 1392 0.60 0.99 0.50 178 XMSubEmpty 1376 0.44 0.98 0.30 179 SHORT_IMG_SUSP_NTLD 1367 0.21 0.97 0.00 180 MISSING_HEADERS 1339 0.61 0.95 0.52 181 XM_UB80 1332 0.22 0.95 0.02 182 XM_ProductURIs 1328 0.80 0.95 0.76 183 RELAYCOUNTRY_RU 1323 0.26 0.94 0.08 184 XM_H_PHPMailer 1316 0.57 0.94 0.47 185 RCVD_IN_RP_CERTIFIED 1289 5.54 0.92 6.78 186 TVD_RCVD_IP 1281 1.77 0.91 2.00 187 XM_UB99 1269 0.19 0.90 0.00 188 XMPhish14 1255 0.49 0.89 0.38 189 SHORT_URI_2 1248 0.22 0.89 0.05 190 DEAR_FRIEND 1185 0.24 0.84 0.07 191 XMSubMetaI_00 1176 0.86 0.84 0.87 192 AC_SPAMMY_URI_PATTERNS4 1163 0.18 0.83 0.00 193 RELAYCOUNTRY_FI 1162 0.19 0.83 0.02 194 REMOVE_BEFORE_LINK 1157 0.40 0.82 0.29 195 TR_XM_DK_Bayes1 1155 9.42 0.82 11.73 196 XM_H_Long_From02 1153 1.19 0.82 1.28 197 XM_Combo_Sbj 1148 0.47 0.82 0.38 198 DKIM_ADSP_CUSTOM_MED 1147 1.20 0.82 1.30 199 RCVD_IN_MSPIKE_L5 1146 0.18 0.82 0.01 200 HTML_TAG_BALANCE_BODY 1133 0.45 0.81 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 447854 87.69 95.19 85.67 2 RELAYCOUNTRY_US 416827 79.69 79.49 79.74 3 DKIM_SIGNED 372671 72.52 77.08 71.29 4 XM_DK_Pass 366670 71.06 74.46 70.14 5 XM_B_Unicode 356809 69.79 75.48 68.26 6 DKIM_VALID 344690 65.41 63.44 65.94 7 DCC_CHECK_NEGATIVE 313104 50.96 17.70 59.90 8 BAYES_50 277539 51.37 44.95 53.09 9 DKIM_VALID_AU 254765 48.51 47.64 48.74 10 XMListUnsubscribeExists 250816 51.98 66.88 47.98 11 DCC_CHECK 198608 47.00 80.56 37.99 12 XM_B_Unicode3 198351 38.36 39.91 37.94 13 T_TM2_M_HEADER_IN_MSG 148054 26.48 19.62 28.32 14 HTML_FONT_LOW_CONTRAST 130354 26.12 30.51 24.94 15 DKIM_VALID_EF 130106 25.58 28.16 24.89 16 LOC_TINY_FONT_1 123594 25.05 30.30 23.64 17 FVGT_m_MULTI_ODD 110564 22.11 25.69 21.15 18 XMSubLong 109229 21.65 24.46 20.90 19 MIME_HTML_ONLY 109055 24.38 37.49 20.86 20 BAYES_00 106648 16.66 2.71 20.40 21 T_KAM_HTML_FONT_INVALID 90532 18.96 25.08 17.32 22 ALL_TRUSTED 87649 13.44 1.06 16.77 23 RCVD_IN_MSPIKE_H2 75090 13.68 11.13 14.36 24 TR_XM_DK_Bayes 65910 10.24 1.43 12.61 25 TR_XM_DK_Bayes1 61300 9.42 0.82 11.73 26 XM_Body_Dirty_Words 60976 12.91 17.55 11.66 27 XM_Multi_Part_URI 58327 12.27 16.43 11.16 28 LOTS_OF_MONEY 56809 11.26 12.73 10.87 29 TR_XM_DK_Bayes2 53661 8.25 0.76 10.27 30 XM_B_Unsub 53077 10.59 12.22 10.15 31 RCVD_IN_MSPIKE_H3 44441 7.29 2.76 8.50 32 RCVD_IN_MSPIKE_WL 44441 7.29 2.76 8.50 33 LotsOfNums_01 44305 8.48 8.50 8.48 34 TooManyTo_001 44094 7.68 4.86 8.44 35 XM_Evil_Numbers_Gen 43455 8.39 8.70 8.31 36 RCVD_IN_RP_SAFE 40343 6.37 1.34 7.72 37 UNPARSEABLE_RELAY 37183 6.67 5.00 7.11 38 FSL_BULK_SIG 36299 9.58 19.40 6.94 39 HTML_IMAGE_RATIO_02 35774 7.54 10.15 6.84 40 RCVD_IN_RP_CERTIFIED 35467 5.54 0.92 6.78 41 XM_DKIMWhitelistDomains 34887 5.27 0.06 6.67 42 XM_UncommonTLD01 34517 10.31 24.12 6.60 43 XM_SendGrid 33971 6.03 4.30 6.50 44 XM_B_Phish_Phrases 33904 7.63 11.91 6.49 45 XM_DK_Undo_02 32149 13.11 39.03 6.15 46 BAYES_40 30672 5.31 3.25 5.87 47 MIME_QP_LONG_LINE 30562 5.70 5.15 5.85 48 MPART_ALT_DIFF 29888 5.62 5.25 5.72 49 XM_H_Long_From01 29433 6.09 7.78 5.63 50 BAYES_60 28422 5.78 7.07 5.44 51 RELAYCOUNTRY_META 28107 8.87 21.88 5.38 52 DKIM_INVALID 27981 7.11 13.64 5.35 53 RCVD_IN_IADB_LISTED 26939 4.51 2.09 5.15 54 HTML_IMAGE_RATIO_04 25626 5.09 5.79 4.90 55 BAYES_20 25051 4.31 2.51 4.79 56 RCVD_IN_IADB_SPF 23652 3.98 1.93 4.52 57 IN_ZIMBRA_NJ_WHITELIST 22441 3.39 0.02 4.29 58 XM_PDF 22032 3.45 0.60 4.21 59 BOTNET_IPINHOSTNAME 21850 6.36 14.47 4.18 60 T_TooManySym_01 21688 3.76 2.33 4.15 61 RCVD_IN_IADB_SENDERID 20830 3.54 1.86 3.98 62 RCVD_IN_IADB_DK 20632 3.51 1.87 3.95 63 MIME_HTML_ONLY_MULTI 20346 3.57 2.39 3.89 64 HTML_IMAGE_RATIO_06 20177 3.67 2.94 3.86 65 XMStrtUSub 19969 3.83 3.86 3.82 66 XM_ShortIntro_01 19621 3.02 0.29 3.75 67 T_REMOTE_IMAGE 19494 3.85 4.31 3.73 68 TR_XM_DK_SendGrid 18979 3.28 1.97 3.63 69 XMSexyCombo_05 17540 4.47 8.63 3.36 70 TR_Mismatch_TLD_02 17382 3.16 2.54 3.33 71 TO_NO_BRKTS_FROM_MSSP 17035 2.59 0.09 3.26 72 FROM_MISSP_EH_MATCH 17014 2.60 0.15 3.25 73 BAYES_05 16972 2.93 1.75 3.25 74 MONEY_FROM_MISSP 16972 2.57 0.04 3.25 75 FROM_MISSPACED 16968 2.58 0.11 3.25 76 RCVD_IN_IADB_VOUCHED 16940 2.69 0.64 3.24 77 TM2_M_URI_OPT_OUT 15595 3.01 3.10 2.98 78 BAYES_99 15245 7.71 25.58 2.92 79 NO_DNS_FOR_FROM 14813 4.38 10.14 2.83 80 XMNumbers 14813 3.02 3.71 2.83 81 KHOP_HELO_FCRDNS 14465 4.04 8.76 2.77 82 ANY_BOUNCE_MESSAGE 14459 2.26 0.39 2.77 83 BOUNCE_MESSAGE 14454 2.26 0.39 2.77 84 FROM_EXCESS_BASE64 14305 2.80 3.03 2.74 85 MAILING_LIST_MULTI 14024 2.41 1.39 2.68 86 BAYES_80 13823 3.78 8.03 2.64 87 XMSubMetaSx_00 13774 3.30 5.79 2.63 88 BOTNET 13388 6.84 22.76 2.56 89 XM_H_Trusted_IP 13191 1.99 0.00 2.52 90 TooManyTo_002 12601 2.01 0.52 2.41 91 MIME_HTML_MOSTLY 12351 2.58 3.41 2.36 92 BAYES_999 11946 5.84 19.07 2.29 93 HTML_IMAGE_RATIO_08 11681 2.20 2.08 2.23 94 HTML_FONT_FACE_BAD 11543 1.85 0.53 2.21 95 XM_B_Unsub2 11297 2.21 2.37 2.16 96 HTML_MIME_NO_HTML_TAG 10625 2.44 3.96 2.03 97 RCVD_IN_IADB_OPTIN 10624 1.69 0.42 2.03 98 XM_B_SpammyTLD 10462 3.14 7.37 2.00 99 TVD_RCVD_IP 10438 1.77 0.91 2.00 100 XM_CamelCaseFrm001 10340 3.67 9.98 1.98 101 T_TooManySym_02 10332 1.73 0.81 1.98 102 XM_SPF_SoftFail 10134 2.71 5.59 1.94 103 XM_B_COVIDMETA 10056 3.23 8.08 1.92 104 RCVD_IN_MSPIKE_BL 10027 2.98 6.95 1.92 105 XM_DK_Undo_01 9972 1.86 1.68 1.91 106 RCVD_IN_MSPIKE_L3 9891 2.77 6.04 1.89 107 RELAYCOUNTRY_CA 8708 2.47 5.48 1.67 108 HELO_NODOT 8687 1.42 0.54 1.66 109 HELO_NO_DOMAIN 8684 1.42 0.54 1.66 110 TooManyTo_003 8639 1.38 0.37 1.65 111 UNTRUSTED_Relay 8511 4.27 14.11 1.63 112 T_XMDrugObfuBody_08 8396 2.37 5.22 1.61 113 BAYES_95 8358 2.14 4.14 1.60 114 IN_HORDE_ADDRESS_BOOK 7926 1.21 0.05 1.52 115 TR_XM_COVIDMETA4 7698 2.50 6.33 1.47 116 INVALID_MSGID 7688 1.21 0.26 1.47 117 URI_HEX 7517 1.66 2.47 1.44 118 TR_Symld_Words 7334 1.32 1.02 1.40 119 TR_DCC_Bayes_99 7334 5.46 20.57 1.40 120 XM_GoogleGroups 7296 1.21 0.50 1.40 121 XMSubNoVowel 7280 1.33 1.09 1.39 122 SUBJ_ALL_CAPS 7187 1.39 1.44 1.37 123 TO_MALFORMED 7153 1.29 1.00 1.37 124 CK_HELO_DYNAMIC_SPLIT_IP 7052 1.11 0.22 1.35 125 HELO_DYNAMIC_IPADDR2 7043 1.08 0.10 1.35 126 XMDiploma_00 7039 1.51 2.11 1.35 127 DKIM_ADSP_CUSTOM_MED 6803 1.20 0.82 1.30 128 TooManyTo_004 6743 1.08 0.30 1.29 129 TR_XM_PhishingBody 6708 1.69 3.21 1.28 130 XM_H_Long_From02 6707 1.19 0.82 1.28 131 T_XMDrugObfuBody_14 6698 1.36 1.68 1.28 132 XMCapTrack 6680 1.17 0.76 1.28 133 XMBdyGiftCard01 6404 1.13 0.76 1.23 134 TM2_M_VERY_LONG_WORD 6100 1.37 2.12 1.17 135 T_FILL_THIS_FORM_SHORT 6008 1.16 1.19 1.15 136 TooManyTo_005 5813 0.93 0.25 1.11 137 XMStockSpam_06 5796 1.17 1.41 1.11 138 USER_IN_DEF_DKIM_WL 5755 0.87 0.00 1.10 139 RELAYCOUNTRY_GB 5613 1.12 1.29 1.07 140 TR_MetaPhish_Combo_01 5494 1.12 1.37 1.05 141 URI_TRY_3LD 5361 1.20 1.85 1.03 142 XMSolicitRefs_0 5203 0.91 0.61 1.00 143 XMGappySubj_01 5175 0.80 0.11 0.99 144 XM_UB50 5172 2.42 7.74 0.99 145 XM_OfRef6 5170 1.24 2.20 0.99 146 TR_XM_PHPDW 5044 1.15 1.82 0.96 147 NML_ADSP_CUSTOM_MED 4985 0.89 0.66 0.95 148 TR_XM_FormFill2 4979 1.13 1.77 0.95 149 TR_XM_PHPForged 4975 1.13 1.79 0.95 150 XM_H_PHPOS 4944 1.12 1.77 0.95 151 RCVD_IN_BL_SPAMCOP_NET 4855 1.43 3.32 0.93 152 XMMoneyMeta_00 4854 1.06 1.57 0.93 153 SpammyFromTLD_01 4626 1.31 2.91 0.88 154 XMSubMetaI_00 4538 0.86 0.84 0.87 155 HTTPS_HTTP_MISMATCH 4476 0.93 1.21 0.86 156 XMBrknScrpt_02 4197 0.90 1.28 0.80 157 XMGenDplmaNmb 4103 0.86 1.14 0.78 158 XM_ProductURIs 3970 0.80 0.95 0.76 159 TR_MSPIKEBAYES00 3700 0.56 0.00 0.71 160 TO_NO_BRKTS_HTML_ONLY 3633 0.57 0.12 0.69 161 XMBody_17 3617 1.48 4.43 0.69 162 XM_RXBody 3608 0.62 0.34 0.69 163 XM_SPF_Unknown 3595 0.71 0.77 0.69 164 XMHTML_After_End 3580 1.50 4.53 0.68 165 T_TooManySym_03 3177 0.52 0.20 0.61 166 T_Symld_Words_02 3042 0.69 1.09 0.58 167 RCVD_IN_SORBS_DUL 3030 0.47 0.07 0.58 168 PLING_QUERY 2978 0.57 0.58 0.57 169 XMNoVowels 2968 0.55 0.50 0.57 170 T_OBFU_PDF_ATTACH 2936 0.48 0.18 0.56 171 T_XMDrugObfuBody_00 2924 0.69 1.17 0.56 172 PDS_OTHER_BAD_TLD 2869 1.16 3.42 0.55 173 FORGED_GMAIL_RCVD 2853 0.58 0.69 0.55 174 FROM_GOV_DKIM_AU 2819 0.45 0.11 0.54 175 FROM_GOV_SPOOF 2816 0.49 0.30 0.54 176 MISSING_HEADERS 2709 0.61 0.95 0.52 177 XMPhish30 2615 0.60 0.99 0.50 178 XM_DIRTYINTL 2594 1.07 3.20 0.50 179 XM_H_PHPMailer 2470 0.57 0.94 0.47 180 RELAYCOUNTRY_AU 2448 0.48 0.54 0.47 181 RELAYCOUNTRY_DE 2409 0.82 2.14 0.46 182 TR_LOTS_OF_MONEY3 2386 0.97 2.88 0.46 183 XMSubMetaSxObfu_03 2347 0.57 1.03 0.45 184 URI_NOVOWEL 2325 0.59 1.12 0.44 185 XMHTMLBadTable_001 2271 0.47 0.63 0.43 186 T_XMHurry_00 2256 0.90 2.63 0.43 187 HTML_IMAGE_ONLY_20 2252 0.41 0.35 0.43 188 TR_XM_COVIDMETA1 2200 0.61 1.29 0.42 189 SHORT_HELO_AND_INLINE_IMAGE 2189 0.34 0.06 0.42 190 XMBody_78 2184 0.73 1.91 0.42 191 TM2_M_BODY_EMPTY 2127 0.34 0.11 0.41 192 HTML_IMAGE_ONLY_32 2021 0.35 0.20 0.39 193 HTML_IMAGE_ONLY_28 2018 0.37 0.32 0.39 194 XMPhish14 1999 0.49 0.89 0.38 195 XM_Combo_Sbj 1974 0.47 0.82 0.38 196 XMPhish08 1950 0.57 1.30 0.37 197 XMSexyCombo_01 1913 0.63 1.60 0.37 198 MPART_ALT_DIFF_COUNT 1877 0.43 0.70 0.36 199 RDNS_DYNAMIC 1874 1.41 5.32 0.36 200 HTML_TAG_BALANCE_BODY 1818 0.45 0.81 0.35 ----------------------------------------------------------------------