Email: 682232 Autolearn: 0 AvgScore: -0.04 AvgScanTime: 3.75 sec Spam: 97434 Autolearn: 0 AvgScore: 11.88 AvgScanTime: 4.64 sec Ham: 584798 Autolearn: 0 AvgScore: -2.02 AvgScanTime: 3.60 sec Time Spent Running SA: 711.00 hours Time Spent Processing Spam: 125.47 hours Time Spent Processing Ham: 585.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 94697 98.13 97.19 98.29 2 HTML_MESSAGE 87970 85.64 90.29 84.87 3 DKIM_SIGNED 74748 72.41 76.72 71.69 4 XM_DK_Pass 72463 71.00 74.37 70.43 5 XM_B_Unicode 71492 73.58 73.37 73.62 6 RELAYCOUNTRY_US 65291 77.43 67.01 79.17 7 XMListUnsubscribeExists 65082 52.32 66.80 49.91 8 DKIM_VALID 62187 65.68 63.82 65.99 9 XM_DK_Undo_02 52497 16.97 53.88 10.82 10 DKIM_VALID_AU 44718 49.04 45.90 49.56 11 MIME_HTML_ONLY 40791 25.09 41.87 22.30 12 BAYES_99 40632 11.89 41.70 6.93 13 BAYES_999 33982 9.69 34.88 5.49 14 DKIM_VALID_EF 33402 25.35 34.28 23.87 15 BAYES_50 32891 49.44 33.76 52.06 16 XM_B_Unicode3 30672 38.13 31.48 39.24 17 RELAYCOUNTRY_META 29933 8.87 30.72 5.23 18 LOC_TINY_FONT_1 29057 24.92 29.82 24.11 19 T_KAM_HTML_FONT_INVALID 26883 19.45 27.59 18.09 20 XM_UncommonTLD01 25384 6.62 26.05 3.39 21 RCVD_IN_MSPIKE_H2 24586 21.21 25.23 20.54 22 BOTNET 23934 5.92 24.56 2.81 23 HTML_FONT_LOW_CONTRAST 23183 26.19 23.79 26.59 24 XMSubLong 22411 20.15 23.00 19.68 25 T_TM2_M_HEADER_IN_MSG 21682 25.49 22.25 26.03 26 FVGT_m_MULTI_ODD 21592 21.40 22.16 21.27 27 XM_Body_Dirty_Words 20484 16.31 21.02 15.52 28 UNTRUSTED_Relay 18997 4.35 19.50 1.83 29 LOTS_OF_MONEY 18022 13.01 18.50 12.10 30 BOTNET_IPINHOSTNAME 16359 6.78 16.79 5.11 31 XM_Multi_Part_URI 13996 12.11 14.36 11.74 32 XM_CamelCaseFrm001 13273 3.97 13.62 2.36 33 DKIM_INVALID 12561 6.73 12.89 5.70 34 URIBL_SBL_A 11452 1.98 11.75 0.35 35 XM_B_Phish_Phrases 11155 8.16 11.45 7.61 36 XMBody_17 11076 4.97 11.37 3.91 37 TR_XM_MaxBayes 11018 1.75 11.31 0.15 38 XM_B_Unsub 10590 10.82 10.87 10.82 39 HTML_IMAGE_RATIO_02 10521 7.63 10.80 7.10 40 XMSexyCombo_05 9097 4.47 9.34 3.66 41 BAYES_60 8819 7.24 9.05 6.94 42 XM_Evil_Numbers_Gen 8478 7.99 8.70 7.87 43 RCVD_IN_MSPIKE_BL 8317 1.72 8.54 0.58 44 NO_DNS_FOR_FROM 8299 3.85 8.52 3.07 45 XM_OfRef6 8050 5.25 8.26 4.74 46 RELAYCOUNTRY_CA 7846 2.49 8.05 1.56 47 RCVD_IN_BL_SPAMCOP_NET 7783 2.37 7.99 1.43 48 XM_B_COVIDMETA 7619 2.78 7.82 1.94 49 XMNumbers 6954 3.83 7.14 3.28 50 XM_UB50 6780 1.94 6.96 1.10 51 ALL_TRUSTED 6614 15.57 6.79 17.03 52 LotsOfNums_01 6531 8.22 6.70 8.47 53 T_REMOTE_IMAGE 6207 4.01 6.37 3.62 54 BAYES_80 6153 4.13 6.32 3.77 55 XM_UB99 6112 0.90 6.27 0.01 56 TooManyTo_001 6039 7.89 6.20 8.18 57 RCVD_IN_RP_RNBL 5968 0.95 6.13 0.08 58 TR_XM_PhishingBody 5959 3.81 6.12 3.43 59 RCVD_IN_MSPIKE_WL 5723 19.34 5.87 21.58 60 RCVD_IN_MSPIKE_L3 5651 1.19 5.80 0.42 61 TR_XM_COVIDMETA4 5626 1.70 5.77 1.02 62 T_XMDrugObfuBody_08 5549 2.13 5.70 1.54 63 RELAYCOUNTRY_FR 5334 1.06 5.47 0.32 64 HTML_IMAGE_RATIO_04 5262 5.89 5.40 5.98 65 XM_H_Long_From01 5196 5.37 5.33 5.38 66 XM_OfRef7 5172 1.86 5.31 1.29 67 XM_UB999 5145 0.76 5.28 0.00 68 XMSubMetaSx_00 5133 4.40 5.27 4.26 69 SpammyFromTLD_01 5095 1.53 5.23 0.91 70 FILL_THIS_FORM 4681 3.93 4.80 3.78 71 TR_XM_INV_DKIM 4652 0.86 4.77 0.21 72 XM_B_SpammyTLD 4642 2.43 4.76 2.04 73 MPART_ALT_DIFF 4539 6.74 4.66 7.09 74 XM_SPF_SoftFail 4360 1.96 4.47 1.54 75 XM_Lotto 4359 2.98 4.47 2.74 76 TO_MALFORMED 4343 5.97 4.46 6.22 77 TR_Orig_Subnet 4280 4.96 4.39 5.05 78 XMSubject_48 4263 2.94 4.38 2.70 79 UNPARSEABLE_RELAY 4158 6.27 4.27 6.61 80 BODY_URI_ONLY 4100 0.65 4.21 0.05 81 KHOP_HELO_FCRDNS 4064 2.05 4.17 1.70 82 XM_DIRTYINTL 4023 1.03 4.13 0.52 83 HTML_MIME_NO_HTML_TAG 3888 2.56 3.99 2.33 84 BOTNET_NORDNS 3831 0.57 3.93 0.01 85 RELAYCOUNTRY_DE 3706 0.86 3.80 0.37 86 FROM_SUSPICIOUS_NTLD 3669 0.62 3.77 0.10 87 XMHTML_After_End 3571 1.41 3.67 1.03 88 FROM_SUSPICIOUS_NTLD_FP 3562 0.60 3.66 0.09 89 XM_B_Phish66 3486 2.13 3.58 1.89 90 XM_SendGrid 3464 5.69 3.56 6.04 91 MIME_HTML_MOSTLY 3421 2.92 3.51 2.82 92 TR_XM_MaxSPIKE 3364 0.51 3.45 0.02 93 BAYES_95 3364 2.49 3.45 2.33 94 XM_URI_RBL 3293 0.66 3.38 0.21 95 PDS_OTHER_BAD_TLD 3187 0.87 3.27 0.47 96 LongTLD 3144 0.66 3.23 0.23 97 XM_B_Unsub2 3140 2.44 3.22 2.30 98 XMStrtUSub 3060 3.86 3.14 3.98 99 TM2_M_URI_OPT_OUT 3009 4.17 3.09 4.35 100 SpammyFromTLD_02 2996 0.81 3.07 0.43 101 RCVD_IN_MSPIKE_H3 2910 10.61 2.99 11.88 102 MIME_QP_LONG_LINE 2906 5.23 2.98 5.60 103 RCVD_IN_MSPIKE_H4 2766 8.26 2.84 9.16 104 TR_LOTS_OF_MONEY3 2764 1.03 2.84 0.73 105 HTML_IMAGE_RATIO_06 2760 3.59 2.83 3.72 106 TR_XM_PHPDW 2660 0.76 2.73 0.43 107 TR_XM_PHPForged 2657 0.74 2.73 0.41 108 TR_XM_FormFill2 2591 0.73 2.66 0.41 109 TR_XM_COVIDMETA1 2588 0.87 2.66 0.57 110 XM_H_PHPOS 2584 0.73 2.65 0.41 111 DKIM_ADSP_NXDOMAIN 2542 0.60 2.61 0.27 112 URI_NOVOWEL 2536 0.65 2.60 0.32 113 T_TooManySym_01 2525 3.61 2.59 3.78 114 HTML_IMAGE_RATIO_08 2492 2.50 2.56 2.49 115 T_XMHurry_00 2481 0.78 2.55 0.48 116 NO_FM_NAME_IP_HOSTN 2366 0.35 2.43 0.00 117 DATE_IN_PAST_06_12 2277 0.53 2.34 0.23 118 HDRS_MISSP 2274 0.39 2.33 0.07 119 RCVD_IN_PSBL 2270 0.39 2.33 0.07 120 DATE_IN_PAST_03_06 2256 0.42 2.32 0.10 121 TR_XM_RelayPhish 2194 0.45 2.25 0.15 122 MIME_HEADER_CTYPE_ONLY 2149 0.54 2.21 0.26 123 XM_UB80 2113 0.34 2.17 0.03 124 HTML_SHORT_LINK_IMG_1 2088 0.32 2.14 0.02 125 HDRS_LCASE_IMGONLY 2076 0.31 2.13 0.01 126 BAYES_40 2063 5.02 2.12 5.51 127 T_XMDrugObfuBody_14 1972 1.78 2.02 1.74 128 TR_Symld_Words 1922 1.48 1.97 1.40 129 XMBrknScrpt_02 1917 0.90 1.97 0.72 130 XM_UB60 1902 0.37 1.95 0.11 131 XM_JunkDunk 1805 0.26 1.85 0.00 132 FROM_EXCESS_BASE64 1791 2.78 1.84 2.93 133 XMSexyCombo_01 1760 1.58 1.81 1.54 134 URI_HEX 1729 1.59 1.77 1.55 135 MIME_HTML_ONLY_MULTI 1724 4.51 1.77 4.97 136 SUBJ_ALL_CAPS 1720 1.87 1.77 1.88 137 URIBL_BLACK 1708 0.28 1.75 0.03 138 RELAYCOUNTRY_FI 1677 0.26 1.72 0.02 139 XMDiploma_00 1653 1.63 1.70 1.62 140 XMBdyGiftCard01 1620 0.93 1.66 0.80 141 TooManyTo_002 1589 2.26 1.63 2.36 142 HTML_IMAGE_ONLY_04 1571 0.29 1.61 0.07 143 BAYES_20 1554 3.56 1.59 3.89 144 XMSlimDrugH 1509 0.50 1.55 0.33 145 BODY_SINGLE_URI 1476 0.23 1.51 0.01 146 RCVD_IN_MSPIKE_L5 1461 0.29 1.50 0.09 147 XMStockSpam_06 1440 1.25 1.48 1.22 148 URI_TRY_3LD 1438 1.38 1.48 1.36 149 TR_Mismatch_TLD_02 1431 0.27 1.47 0.07 150 DATE_IN_PAST_12_24 1428 0.25 1.47 0.05 151 T_XMDrugObfuBody_00 1419 0.78 1.46 0.66 152 TM2_M_VERY_LONG_WORD 1386 1.28 1.42 1.25 153 TR_Mismatch_TLD_01 1382 0.41 1.42 0.24 154 RELAYCOUNTRY_GB 1370 1.06 1.41 1.00 155 TR_XM_DK_SendGrid 1358 3.10 1.39 3.39 156 TooManyTo_003 1350 1.58 1.39 1.61 157 BODY_SINGLE_WORD 1339 0.21 1.37 0.02 158 MAILING_LIST_MULTI 1270 2.15 1.30 2.29 159 XM_UB95 1234 0.19 1.27 0.01 160 DKIM_ADSP_CUSTOM_MED 1186 1.18 1.22 1.17 161 XM_DK_Undo_01 1185 1.67 1.22 1.74 162 TooManyTo_004 1169 1.20 1.20 1.20 163 TR_XM_COVIDMETA3 1162 0.20 1.19 0.04 164 URI_WP_HACKED_2 1132 0.36 1.16 0.23 165 XMGenDplmaNmb 1122 0.99 1.15 0.96 166 XM_PDF 1085 3.44 1.11 3.83 167 XMBody_78 1074 0.62 1.10 0.54 168 XM_H_PHPMailer 1051 0.56 1.08 0.47 169 DIET_1 1051 0.52 1.08 0.43 170 T_FILL_THIS_FORM_SHORT 1050 1.48 1.08 1.54 171 TR_MetaPhish_Combo_01 1033 0.81 1.06 0.77 172 RELAYCOUNTRY_PL 1016 0.19 1.04 0.05 173 RELAYCOUNTRY_IN 1011 0.24 1.04 0.11 174 NML_ADSP_CUSTOM_MED 1008 0.88 1.03 0.85 175 XMSubMetaSxObfu_03 1002 0.85 1.03 0.82 176 RCVD_IN_IADB_LISTED 997 4.47 1.02 5.04 177 BAYES_05 986 2.14 1.01 2.32 178 BAYES_00 966 14.07 0.99 16.25 179 T_TooManySym_02 954 1.67 0.98 1.78 180 MISSING_HEADERS 951 0.75 0.98 0.71 181 XMMoneyMeta_00 945 0.60 0.97 0.54 182 XMPhish30 941 0.60 0.97 0.54 183 XMSubNoVowel 926 1.25 0.95 1.31 184 XMPhish08 898 0.54 0.92 0.47 185 XM_HighProb1 877 0.13 0.90 0.00 186 HELO_NODOT 875 1.48 0.90 1.58 187 HELO_NO_DOMAIN 874 1.48 0.90 1.58 188 XMReplyNow 874 0.21 0.90 0.10 189 TooManyTo_005 871 0.96 0.89 0.97 190 RELAYCOUNTRY_NL 870 0.32 0.89 0.23 191 FORGED_GMAIL_RCVD 867 0.57 0.89 0.51 192 HTML_IMAGE_ONLY_08 861 0.22 0.88 0.11 193 RCVD_IN_IADB_SPF 846 3.87 0.87 4.37 194 XMSubMetaI_00 843 0.60 0.87 0.56 195 XMSexyCombo_04 829 0.56 0.85 0.51 196 RCVD_IN_MSPIKE_L4 829 0.17 0.85 0.06 197 XM_H_MailChimp 819 0.32 0.84 0.23 198 RCVD_IN_IADB_SENDERID 802 3.40 0.82 3.83 199 XM_H_PHPOS_M 801 0.24 0.82 0.14 200 RCVD_IN_IADB_DK 798 3.35 0.82 3.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 574811 98.13 97.19 98.29 2 HTML_MESSAGE 496323 85.64 90.29 84.87 3 RELAYCOUNTRY_US 462992 77.43 67.01 79.17 4 XM_B_Unicode 430500 73.58 73.37 73.62 5 DKIM_SIGNED 419266 72.41 76.72 71.69 6 XM_DK_Pass 411894 71.00 74.37 70.43 7 DKIM_VALID 385924 65.68 63.82 65.99 8 BAYES_50 304420 49.44 33.76 52.06 9 XMListUnsubscribeExists 291886 52.32 66.80 49.91 10 DKIM_VALID_AU 289821 49.04 45.90 49.56 11 XM_B_Unicode3 229446 38.13 31.48 39.24 12 HTML_FONT_LOW_CONTRAST 155490 26.19 23.79 26.59 13 T_TM2_M_HEADER_IN_MSG 152209 25.49 22.25 26.03 14 LOC_TINY_FONT_1 140974 24.92 29.82 24.11 15 DKIM_VALID_EF 139569 25.35 34.28 23.87 16 MIME_HTML_ONLY 130397 25.09 41.87 22.30 17 RCVD_IN_MSPIKE_WL 126212 19.34 5.87 21.58 18 FVGT_m_MULTI_ODD 124391 21.40 22.16 21.27 19 RCVD_IN_MSPIKE_H2 120123 21.21 25.23 20.54 20 XMSubLong 115085 20.15 23.00 19.68 21 T_KAM_HTML_FONT_INVALID 105799 19.45 27.59 18.09 22 ALL_TRUSTED 99598 15.57 6.79 17.03 23 BAYES_00 95056 14.07 0.99 16.25 24 XM_Body_Dirty_Words 90763 16.31 21.02 15.52 25 LOTS_OF_MONEY 70746 13.01 18.50 12.10 26 RCVD_IN_MSPIKE_H3 69477 10.61 2.99 11.88 27 XM_Multi_Part_URI 68650 12.11 14.36 11.74 28 XM_DK_Undo_02 63299 16.97 53.88 10.82 29 XM_B_Unsub 63251 10.82 10.87 10.82 30 TR_XM_DK_Bayes 55815 8.26 0.52 9.54 31 RCVD_IN_MSPIKE_H4 53592 8.26 2.84 9.16 32 TR_XM_DK_Bayes1 51733 7.63 0.31 8.85 33 LotsOfNums_01 49547 8.22 6.70 8.47 34 TooManyTo_001 47813 7.89 6.20 8.18 35 TR_XM_DK_Bayes2 46193 6.81 0.26 7.90 36 XM_Evil_Numbers_Gen 46016 7.99 8.70 7.87 37 XM_B_Phish_Phrases 44524 8.16 11.45 7.61 38 RCVD_IN_RP_SAFE 41709 6.17 0.40 7.13 39 HTML_IMAGE_RATIO_02 41547 7.63 10.80 7.10 40 MPART_ALT_DIFF 41433 6.74 4.66 7.09 41 BAYES_60 40560 7.24 9.05 6.94 42 BAYES_99 40511 11.89 41.70 6.93 43 UNPARSEABLE_RELAY 38648 6.27 4.27 6.61 44 XM_DKIMWhitelistDomains 38576 5.65 0.00 6.60 45 RCVD_IN_RP_CERTIFIED 37921 5.60 0.30 6.48 46 TO_MALFORMED 36364 5.97 4.46 6.22 47 XM_SendGrid 35341 5.69 3.56 6.04 48 HTML_IMAGE_RATIO_04 34948 5.89 5.40 5.98 49 DKIM_INVALID 33342 6.73 12.89 5.70 50 MIME_QP_LONG_LINE 32745 5.23 2.98 5.60 51 BAYES_40 32197 5.02 2.12 5.51 52 BAYES_999 32117 9.69 34.88 5.49 53 XM_H_Long_From01 31440 5.37 5.33 5.38 54 RELAYCOUNTRY_META 30613 8.87 30.72 5.23 55 BOTNET_IPINHOSTNAME 29867 6.78 16.79 5.11 56 TR_Orig_Subnet 29540 4.96 4.39 5.05 57 RCVD_IN_IADB_LISTED 29493 4.47 1.02 5.04 58 IN_ZIMBRA_NJ_WHITELIST 29160 4.28 0.03 4.99 59 MIME_HTML_ONLY_MULTI 29040 4.51 1.77 4.97 60 XM_OfRef6 27737 5.25 8.26 4.74 61 XM_H_Trusted_IP 26633 3.90 0.00 4.55 62 RCVD_IN_IADB_SPF 25576 3.87 0.87 4.37 63 TM2_M_URI_OPT_OUT 25425 4.17 3.09 4.35 64 XMSubMetaSx_00 24892 4.40 5.27 4.26 65 XMStrtUSub 23303 3.86 3.14 3.98 66 XMBody_17 22842 4.97 11.37 3.91 67 BAYES_20 22761 3.56 1.59 3.89 68 RCVD_IN_IADB_SENDERID 22382 3.40 0.82 3.83 69 XM_PDF 22379 3.44 1.11 3.83 70 FILL_THIS_FORM 22123 3.93 4.80 3.78 71 T_TooManySym_01 22113 3.61 2.59 3.78 72 RCVD_IN_IADB_DK 22053 3.35 0.82 3.77 73 BAYES_80 22045 4.13 6.32 3.77 74 HTML_IMAGE_RATIO_06 21763 3.59 2.83 3.72 75 XMSexyCombo_05 21389 4.47 9.34 3.66 76 T_REMOTE_IMAGE 21155 4.01 6.37 3.62 77 TR_XM_PhishingBody 20049 3.81 6.12 3.43 78 XM_UncommonTLD01 19807 6.62 26.05 3.39 79 TR_XM_DK_SendGrid 19802 3.10 1.39 3.39 80 XMNumbers 19181 3.83 7.14 3.28 81 RCVD_IN_IADB_VOUCHED 18979 2.84 0.43 3.25 82 NO_DNS_FOR_FROM 17955 3.85 8.52 3.07 83 FROM_EXCESS_BASE64 17147 2.78 1.84 2.93 84 MIME_HTML_MOSTLY 16496 2.92 3.51 2.82 85 BOTNET 16446 5.92 24.56 2.81 86 XM_Lotto 15998 2.98 4.47 2.74 87 XMSubject_48 15789 2.94 4.38 2.70 88 ANY_BOUNCE_MESSAGE 15138 2.30 0.54 2.59 89 BOUNCE_MESSAGE 15131 2.30 0.54 2.59 90 HTML_IMAGE_RATIO_08 14565 2.50 2.56 2.49 91 XM_CamelCaseFrm001 13822 3.97 13.62 2.36 92 TooManyTo_002 13821 2.26 1.63 2.36 93 BAYES_95 13653 2.49 3.45 2.33 94 HTML_MIME_NO_HTML_TAG 13607 2.56 3.99 2.33 95 BAYES_05 13595 2.14 1.01 2.32 96 XM_B_Unsub2 13476 2.44 3.22 2.30 97 MAILING_LIST_MULTI 13392 2.15 1.30 2.29 98 RCVD_IN_IADB_OPTIN 12046 1.81 0.32 2.06 99 XM_B_SpammyTLD 11944 2.43 4.76 2.04 100 XM_B_COVIDMETA 11372 2.78 7.82 1.94 101 XM_B_Phish66 11044 2.13 3.58 1.89 102 SUBJ_ALL_CAPS 11012 1.87 1.77 1.88 103 UNTRUSTED_Relay 10676 4.35 19.50 1.83 104 T_TooManySym_02 10428 1.67 0.98 1.78 105 T_XMDrugObfuBody_14 10195 1.78 2.02 1.74 106 XM_DK_Undo_01 10186 1.67 1.22 1.74 107 HTML_FONT_FACE_BAD 9958 1.51 0.32 1.70 108 KHOP_HELO_FCRDNS 9928 2.05 4.17 1.70 109 XMDiploma_00 9484 1.63 1.70 1.62 110 TooManyTo_003 9442 1.58 1.39 1.61 111 HELO_NODOT 9231 1.48 0.90 1.58 112 HELO_NO_DOMAIN 9230 1.48 0.90 1.58 113 RELAYCOUNTRY_CA 9146 2.49 8.05 1.56 114 URI_HEX 9090 1.59 1.77 1.55 115 T_FILL_THIS_FORM_SHORT 9026 1.48 1.08 1.54 116 XM_SPF_SoftFail 9025 1.96 4.47 1.54 117 XMSexyCombo_01 9016 1.58 1.81 1.54 118 T_XMDrugObfuBody_08 8991 2.13 5.70 1.54 119 TVD_RCVD_IP 8595 1.29 0.22 1.47 120 RCVD_IN_BL_SPAMCOP_NET 8380 2.37 7.99 1.43 121 TR_Symld_Words 8159 1.48 1.97 1.40 122 FUZZY_CREDIT 7980 1.19 0.12 1.36 123 URI_TRY_3LD 7965 1.38 1.48 1.36 124 IN_HORDE_ADDRESS_BOOK 7851 1.16 0.08 1.34 125 INVALID_MSGID 7821 1.17 0.19 1.34 126 XMSubNoVowel 7635 1.25 0.95 1.31 127 XM_OfRef7 7527 1.86 5.31 1.29 128 XM_H_Long_From02 7351 1.18 0.69 1.26 129 TM2_M_VERY_LONG_WORD 7322 1.28 1.42 1.25 130 XM_GoogleGroups 7242 1.13 0.47 1.24 131 HELO_MISC_IP 7211 1.08 0.16 1.23 132 CK_HELO_DYNAMIC_SPLIT_IP 7201 1.07 0.13 1.23 133 XMStockSpam_06 7120 1.25 1.48 1.22 134 TooManyTo_004 6989 1.20 1.20 1.20 135 DKIM_ADSP_CUSTOM_MED 6864 1.18 1.22 1.17 136 XM_UB50 6425 1.94 6.96 1.10 137 XMHTML_After_End 6020 1.41 3.67 1.03 138 TR_XM_COVIDMETA4 5983 1.70 5.77 1.02 139 RELAYCOUNTRY_GB 5870 1.06 1.41 1.00 140 USER_IN_DEF_DKIM_WL 5845 0.86 0.01 1.00 141 XMCapTrack 5689 0.93 0.68 0.97 142 TooManyTo_005 5670 0.96 0.89 0.97 143 XMGenDplmaNmb 5628 0.99 1.15 0.96 144 XMGappySubj_01 5526 0.84 0.20 0.94 145 SpammyFromTLD_01 5319 1.53 5.23 0.91 146 FILL_THIS_FORM_LONG 5123 0.81 0.38 0.88 147 T_FILL_THIS_FORM_LOAN 5094 0.77 0.19 0.87 148 NML_ADSP_CUSTOM_MED 4984 0.88 1.03 0.85 149 TR_MSPIKEBAYES00 4961 0.73 0.01 0.85 150 XMSubMetaSxObfu_03 4781 0.85 1.03 0.82 151 XMBdyGiftCard01 4699 0.93 1.66 0.80 152 XM_ProductURIs 4571 0.78 0.75 0.78 153 TR_MetaPhish_Combo_01 4481 0.81 1.06 0.77 154 TR_LOTS_OF_MONEY3 4240 1.03 2.84 0.73 155 XMBrknScrpt_02 4209 0.90 1.97 0.72 156 MISSING_HEADERS 4170 0.75 0.98 0.71 157 HTTPS_HTTP_MISMATCH 3962 0.68 0.68 0.68 158 T_XMDrugObfuBody_00 3875 0.78 1.46 0.66 159 HTML_IMAGE_ONLY_20 3822 0.61 0.37 0.65 160 XMNoVowels 3666 0.60 0.44 0.63 161 TM2_M_A_HREF_HREF 3605 0.60 0.53 0.62 162 FROM_GOV_DKIM_AU 3476 0.56 0.32 0.59 163 RCVD_IN_MSPIKE_BL 3418 1.72 8.54 0.58 164 TR_XM_COVIDMETA1 3334 0.87 2.66 0.57 165 XMSubMetaI_00 3275 0.60 0.87 0.56 166 T_TooManySym_03 3272 0.54 0.39 0.56 167 XM_SPF_Unknown 3208 0.53 0.44 0.55 168 XMMoneyMeta_00 3182 0.60 0.97 0.54 169 RCVD_IN_MSPIKE_H5 3143 0.47 0.05 0.54 170 XMBody_78 3141 0.62 1.10 0.54 171 XMPhish30 3132 0.60 0.97 0.54 172 T_OBFU_PDF_ATTACH 3116 0.48 0.17 0.53 173 XMPhish14 3049 0.56 0.76 0.52 174 XM_DIRTYINTL 3029 1.03 4.13 0.52 175 XMSexyCombo_04 3007 0.56 0.85 0.51 176 FORGED_GMAIL_RCVD 2993 0.57 0.89 0.51 177 XM_B_COPY_HTML 2976 0.49 0.39 0.51 178 T_Symld_Words_02 2821 0.51 0.68 0.48 179 T_XMHurry_00 2811 0.78 2.55 0.48 180 XMLngstWrd_00 2806 0.48 0.48 0.48 181 XM_H_PHPMailer 2774 0.56 1.08 0.47 182 XMPhish08 2769 0.54 0.92 0.47 183 XM_ShortIntro_01 2766 0.45 0.28 0.47 184 PDS_OTHER_BAD_TLD 2735 0.87 3.27 0.47 185 MONEY_FORM_SHORT 2640 0.40 0.06 0.45 186 RELAYCOUNTRY_AU 2635 0.46 0.53 0.45 187 XM_B_REG_HTML 2549 0.39 0.11 0.44 188 XMLngstWrd_01 2544 0.44 0.45 0.44 189 TR_XM_PHPDW 2540 0.76 2.73 0.43 190 SpammyFromTLD_02 2531 0.81 3.07 0.43 191 HTML_TAG_BALANCE_BODY 2528 0.44 0.47 0.43 192 DIET_1 2497 0.52 1.08 0.43 193 RCVD_IN_SORBS_DUL 2452 0.38 0.16 0.42 194 RCVD_IN_MSPIKE_L3 2440 1.19 5.80 0.42 195 TR_XM_PHPForged 2424 0.74 2.73 0.41 196 TR_XM_FormFill2 2414 0.73 2.66 0.41 197 FROM_GOV_SPOOF 2401 0.40 0.31 0.41 198 XM_H_PHPOS 2380 0.73 2.65 0.41 199 PLING_QUERY 2372 0.39 0.32 0.41 200 MPART_ALT_DIFF_COUNT 2335 0.44 0.70 0.40 ----------------------------------------------------------------------