Email: 705408 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 1.99 sec Spam: 96834 Autolearn: 0 AvgScore: 12.26 AvgScanTime: 4.02 sec Ham: 608574 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 1.67 sec Time Spent Running SA: 389.73 hours Time Spent Processing Spam: 108.08 hours Time Spent Processing Ham: 281.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 93840 97.92 96.91 98.08 2 HTML_MESSAGE 90840 89.33 93.81 88.62 3 DKIM_SIGNED 72939 75.68 75.32 75.74 4 XM_DK_Pass 70590 74.35 72.90 74.58 5 XM_B_Unicode 69539 72.25 71.81 72.32 6 RELAYCOUNTRY_US 64749 78.76 66.87 80.65 7 XMListUnsubscribeExists 64088 55.19 66.18 53.44 8 DKIM_VALID 58274 68.75 60.18 70.12 9 XM_DK_Undo_02 49466 16.07 51.08 10.50 10 DKIM_VALID_AU 42167 50.33 43.55 51.41 11 MIME_HTML_ONLY 41957 23.38 43.33 20.21 12 BAYES_50 37106 52.48 38.32 54.73 13 BAYES_99 35229 10.53 36.38 6.42 14 XM_B_Unicode3 34611 39.71 35.74 40.34 15 RELAYCOUNTRY_META 34032 9.53 35.14 5.45 16 BOTNET 33184 7.32 34.27 3.03 17 DKIM_VALID_EF 30290 27.33 31.28 26.70 18 LOC_TINY_FONT_1 30275 25.46 31.26 24.53 19 BAYES_999 28240 8.35 29.16 5.03 20 HTML_FONT_LOW_CONTRAST 25034 26.62 25.85 26.74 21 T_KAM_HTML_FONT_INVALID 24802 19.58 25.61 18.62 22 UNTRUSTED_Relay 22913 4.88 23.66 1.90 23 FVGT_m_MULTI_ODD 22867 23.45 23.61 23.42 24 RCVD_IN_MSPIKE_H2 22860 24.99 23.61 25.21 25 XMSubLong 21193 21.09 21.89 20.97 26 BOTNET_IPINHOSTNAME 19460 6.70 20.10 4.57 27 XM_UncommonTLD01 19360 5.44 19.99 3.12 28 T_TM2_M_HEADER_IN_MSG 18555 26.61 19.16 27.79 29 XM_Body_Dirty_Words 17616 14.27 18.19 13.65 30 DKIM_INVALID 14665 6.93 15.14 5.62 31 LOTS_OF_MONEY 14230 9.79 14.70 9.01 32 XM_Multi_Part_URI 14121 12.23 14.58 11.85 33 RCVD_IN_MSPIKE_BL 12342 2.24 12.75 0.56 34 NO_DNS_FOR_FROM 11483 4.39 11.86 3.21 35 XM_B_Phish_Phrases 11409 8.31 11.78 7.75 36 HTML_IMAGE_RATIO_02 11223 8.20 11.59 7.66 37 RCVD_IN_BL_SPAMCOP_NET 10698 2.75 11.05 1.43 38 XM_B_Unsub 10168 10.76 10.50 10.81 39 XMSexyCombo_05 9982 5.14 10.31 4.32 40 T_REMOTE_IMAGE 8915 4.20 9.21 3.40 41 XM_Evil_Numbers_Gen 8515 8.22 8.79 8.13 42 RELAYCOUNTRY_CA 8306 2.57 8.58 1.61 43 XM_UB50 8175 2.19 8.44 1.19 44 RCVD_IN_RP_RNBL 8065 2.20 8.33 1.22 45 XM_CamelCaseFrm001 7667 2.91 7.92 2.11 46 RCVD_IN_MSPIKE_L3 7160 1.32 7.39 0.36 47 BAYES_80 7108 4.55 7.34 4.11 48 LotsOfNums_01 7002 8.47 7.23 8.66 49 XM_B_COVIDMETA 6955 3.08 7.18 2.43 50 TR_XM_PhishingBody 6590 3.87 6.81 3.41 51 URIBL_SBL_A 6435 1.27 6.65 0.41 52 BOTNET_NORDNS 6127 0.89 6.33 0.02 53 BAYES_60 6002 7.01 6.20 7.14 54 TR_XM_MaxBayes 5994 0.88 6.19 0.03 55 HTML_IMAGE_RATIO_04 5920 5.67 6.11 5.60 56 TR_XM_COVIDMETA4 5844 1.64 6.04 0.94 57 RCVD_IN_MSPIKE_WL 5834 19.34 6.02 21.46 58 XMHTML_After_End 5820 1.65 6.01 0.96 59 XM_UB99 5718 0.81 5.90 0.00 60 XM_H_Long_From01 5650 5.66 5.83 5.63 61 XMSubMetaSx_00 5472 3.60 5.65 3.28 62 MPART_ALT_DIFF 5286 4.97 5.46 4.89 63 XM_SPF_SoftFail 5160 2.25 5.33 1.77 64 XMNumbers 5092 3.36 5.26 3.05 65 TooManyTo_001 5006 7.44 5.17 7.81 66 SpammyFromTLD_01 4940 1.46 5.10 0.89 67 T_XMDrugObfuBody_08 4932 2.17 5.09 1.71 68 HTML_MIME_NO_HTML_TAG 4932 2.59 5.09 2.19 69 KHOP_HELO_FCRDNS 4832 2.24 4.99 1.81 70 RELAYCOUNTRY_FR 4586 0.89 4.74 0.28 71 SpammyFromTLD_02 4543 0.95 4.69 0.36 72 XMBody_17 4429 1.31 4.57 0.79 73 BODY_URI_ONLY 4420 0.74 4.56 0.14 74 UNPARSEABLE_RELAY 4402 6.82 4.55 7.18 75 DKIM_ADSP_NXDOMAIN 4397 0.86 4.54 0.27 76 XM_UB999 4361 0.62 4.50 0.00 77 BAYES_95 4265 2.64 4.40 2.36 78 RCVD_IN_MSPIKE_H3 4210 12.30 4.35 13.57 79 XM_DIRTYINTL 4154 1.14 4.29 0.63 80 RELAYCOUNTRY_IN 4149 0.69 4.28 0.12 81 XM_B_Phish66 4141 2.13 4.28 1.79 82 MIME_HTML_MOSTLY 4008 2.58 4.14 2.33 83 TR_XM_INV_DKIM 3930 0.70 4.06 0.16 84 XM_B_SpammyTLD 3810 2.18 3.93 1.90 85 RELAYCOUNTRY_DE 3653 0.96 3.77 0.51 86 XM_OfRef6 3651 1.72 3.77 1.39 87 T_PDS_OTHER_BAD_TLD 3629 0.96 3.75 0.52 88 XM_SendGrid 3616 6.18 3.73 6.57 89 XM_URI_RBL 3591 0.70 3.71 0.22 90 DIET_1 3423 0.76 3.53 0.32 91 MISSING_HEADERS 3420 0.91 3.53 0.49 92 HTML_IMAGE_RATIO_06 3392 3.93 3.50 4.00 93 TR_XM_MaxSPIKE 3343 0.50 3.45 0.03 94 RCVD_IN_PSBL 3268 0.52 3.37 0.07 95 TM2_M_URI_OPT_OUT 3263 3.38 3.37 3.38 96 FROM_EXCESS_BASE64 3223 2.86 3.33 2.79 97 MIME_QP_LONG_LINE 3196 5.56 3.30 5.92 98 RCVD_IN_MSPIKE_L5 3149 0.54 3.25 0.11 99 FROM_SUSPICIOUS_NTLD 2886 0.46 2.98 0.06 100 NO_FM_NAME_IP_HOSTN 2785 0.40 2.88 0.00 101 FROM_SUSPICIOUS_NTLD_FP 2780 0.44 2.87 0.06 102 TR_LOTS_OF_MONEY3 2747 1.07 2.84 0.79 103 TR_XM_PHPDW 2736 0.81 2.83 0.49 104 TR_XM_PHPForged 2720 0.79 2.81 0.47 105 XM_UB60 2697 0.49 2.79 0.12 106 HTML_TITLE_SUBJ_DIFF 2686 0.43 2.77 0.06 107 TR_XM_FormFill2 2677 0.78 2.76 0.46 108 XM_H_PHPOS 2671 0.77 2.76 0.46 109 HDRS_MISSP 2579 0.41 2.66 0.06 110 TR_Mismatch_TLD_01 2565 0.57 2.65 0.24 111 T_XMHurry_00 2528 0.80 2.61 0.51 112 HTML_IMAGE_RATIO_08 2517 2.61 2.60 2.61 113 XMStrtUSub 2492 3.90 2.57 4.11 114 XM_UB80 2492 0.38 2.57 0.03 115 DATE_IN_PAST_12_24 2472 0.40 2.55 0.06 116 BAYES_40 2467 4.48 2.55 4.79 117 TR_XM_COVIDMETA1 2448 0.77 2.53 0.49 118 DATE_IN_PAST_03_06 2441 0.43 2.52 0.09 119 HTML_IMAGE_ONLY_08 2402 0.42 2.48 0.09 120 MIME_HEADER_CTYPE_ONLY 2380 0.50 2.46 0.19 121 HDRS_LCASE_IMGONLY 2356 0.34 2.43 0.01 122 HTML_SHORT_LINK_IMG_1 2349 0.34 2.43 0.01 123 XMDiploma_00 2347 1.82 2.42 1.72 124 T_TooManySym_01 2256 3.73 2.33 3.95 125 XM_JunkDunk 2199 0.31 2.27 0.00 126 XMStockSpam_06 2170 1.36 2.24 1.22 127 XM_B_Unsub2 2127 2.65 2.20 2.72 128 LongTLD 2081 0.45 2.15 0.18 129 DATE_IN_PAST_06_12 2022 0.42 2.09 0.16 130 RELAYCOUNTRY_NL 1940 0.44 2.00 0.19 131 BAYES_20 1937 3.37 2.00 3.59 132 T_XMDrugObfuBody_14 1930 1.43 1.99 1.34 133 ALL_TRUSTED 1913 13.59 1.98 15.44 134 XM_UB95 1906 0.28 1.97 0.01 135 XM_OfRef7 1880 0.37 1.94 0.12 136 URI_HEX 1874 1.47 1.94 1.39 137 RCVD_IN_MSPIKE_L4 1862 0.34 1.92 0.08 138 MIME_HTML_ONLY_MULTI 1824 2.76 1.88 2.90 139 XMGenDplmaNmb 1823 0.97 1.88 0.82 140 RELAYCOUNTRY_GB 1776 1.12 1.83 1.01 141 DKIM_ADSP_CUSTOM_MED 1713 1.21 1.77 1.12 142 SUBJ_ALL_CAPS 1671 1.63 1.73 1.61 143 TR_XM_RelayPhish 1660 0.38 1.71 0.17 144 REPLYTO_WITHOUT_TO_CC 1610 0.34 1.66 0.13 145 TM2_M_VERY_LONG_WORD 1591 1.36 1.64 1.32 146 RCVD_IN_MSPIKE_H4 1581 6.47 1.63 7.24 147 NML_ADSP_CUSTOM_MED 1547 0.98 1.60 0.88 148 XMSexyCombo_01 1520 0.66 1.57 0.52 149 BAYES_00 1511 12.60 1.56 14.36 150 TR_Mismatch_TLD_02 1501 0.27 1.55 0.07 151 XM_DK_Undo_01 1475 1.65 1.52 1.67 152 TR_Symld_Words 1475 1.43 1.52 1.42 153 XM_H_PHPMailer 1433 0.63 1.48 0.50 154 SCRIPT_GIBBERISH 1415 0.20 1.46 0.00 155 MAILING_LIST_MULTI 1399 2.08 1.44 2.18 156 T_XMDrugObfuBody_00 1391 0.83 1.44 0.74 157 RDNS_DYNAMIC 1335 0.47 1.38 0.33 158 T_Symld_Words_02 1302 0.94 1.34 0.88 159 TR_XM_DK_SendGrid 1283 3.47 1.32 3.81 160 FORGED_GMAIL_RCVD 1275 0.64 1.32 0.53 161 TR_LOTS_OF_MONEY2 1263 0.42 1.30 0.28 162 T_MONEY_PERCENT 1263 0.42 1.30 0.28 163 XM_H_PHPOS_M 1254 0.33 1.29 0.17 164 HK_RANDOM_REPLYTO 1252 0.34 1.29 0.19 165 BAYES_05 1200 2.33 1.24 2.50 166 XMMoneyMeta_00 1167 0.95 1.21 0.91 167 XMGppyBdWords 1161 0.33 1.20 0.19 168 URI_TRY_3LD 1161 1.56 1.20 1.62 169 T_TooManySym_02 1160 1.70 1.20 1.78 170 RELAYCOUNTRY_IT 1153 0.21 1.19 0.06 171 XM_H_FedEx_Spoof 1126 0.21 1.16 0.06 172 XMBrknScrpt_02 1124 0.85 1.16 0.80 173 XM_H_MailChimp 1100 0.36 1.14 0.24 174 XMSubMetaSxObfu_03 1099 0.68 1.13 0.60 175 URIBL_BLACK 1073 0.20 1.11 0.06 176 XMBody_78 1053 0.47 1.09 0.37 177 XM_HighProb1 1013 0.15 1.05 0.00 178 XMSubNoVowel 1012 0.86 1.05 0.83 179 URI_NO_WWW_INFO_CGI 969 0.17 1.00 0.04 180 HELO_NODOT 966 1.34 1.00 1.40 181 HELO_NO_DOMAIN 965 1.34 1.00 1.40 182 T_FILL_THIS_FORM_SHORT 947 0.79 0.98 0.76 183 XMSlimDrugH 943 0.38 0.97 0.28 184 RELAYCOUNTRY_CN 935 0.20 0.97 0.08 185 XMBdyGiftCard01 924 0.93 0.95 0.93 186 BILLION_DOLLARS 904 0.14 0.93 0.02 187 XMPhish30 889 0.58 0.92 0.53 188 XMPhish08 880 0.56 0.91 0.50 189 RELAYCOUNTRY_AT 876 0.24 0.90 0.14 190 TR_XM_COVIDMETA3 868 0.15 0.90 0.04 191 NORDNS_LOW_CONTRAST 868 0.13 0.90 0.00 192 XMPhish14 861 0.61 0.89 0.56 193 XMSubEmpty 857 0.32 0.89 0.23 194 XM_PDF 855 3.31 0.88 3.70 195 REMOVE_BEFORE_LINK 851 0.44 0.88 0.37 196 XMNoVowels 844 0.57 0.87 0.53 197 XMReplyNow 808 0.20 0.83 0.10 198 TR_MetaPhish_Combo_01 803 1.00 0.83 1.03 199 RCVD_IN_IADB_LISTED 782 4.58 0.81 5.19 200 XM_BadFromFormat 774 0.24 0.80 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 596913 97.92 96.91 98.08 2 HTML_MESSAGE 539290 89.33 93.81 88.62 3 RELAYCOUNTRY_US 490818 78.76 66.87 80.65 4 DKIM_SIGNED 460915 75.68 75.32 75.74 5 XM_DK_Pass 453880 74.35 72.90 74.58 6 XM_B_Unicode 440136 72.25 71.81 72.32 7 DKIM_VALID 426707 68.75 60.18 70.12 8 BAYES_50 333066 52.48 38.32 54.73 9 XMListUnsubscribeExists 325195 55.19 66.18 53.44 10 DKIM_VALID_AU 312858 50.33 43.55 51.41 11 XM_B_Unicode3 245508 39.71 35.74 40.34 12 T_TM2_M_HEADER_IN_MSG 169151 26.61 19.16 27.79 13 HTML_FONT_LOW_CONTRAST 162745 26.62 25.85 26.74 14 DKIM_VALID_EF 162482 27.33 31.28 26.70 15 RCVD_IN_MSPIKE_H2 153431 24.99 23.61 25.21 16 LOC_TINY_FONT_1 149307 25.46 31.26 24.53 17 FVGT_m_MULTI_ODD 142535 23.45 23.61 23.42 18 RCVD_IN_MSPIKE_WL 130584 19.34 6.02 21.46 19 XMSubLong 127609 21.09 21.89 20.97 20 MIME_HTML_ONLY 122970 23.38 43.33 20.21 21 T_KAM_HTML_FONT_INVALID 113319 19.58 25.61 18.62 22 ALL_TRUSTED 93968 13.59 1.98 15.44 23 BAYES_00 87379 12.60 1.56 14.36 24 XM_Body_Dirty_Words 83068 14.27 18.19 13.65 25 RCVD_IN_MSPIKE_H3 82574 12.30 4.35 13.57 26 XM_Multi_Part_URI 72143 12.23 14.58 11.85 27 XM_B_Unsub 65768 10.76 10.50 10.81 28 XM_DK_Undo_02 63907 16.07 51.08 10.50 29 TR_XM_DK_Bayes 59839 8.57 0.60 9.83 30 TR_XM_DK_Bayes1 55455 7.90 0.31 9.11 31 LOTS_OF_MONEY 54852 9.79 14.70 9.01 32 LotsOfNums_01 52714 8.47 7.23 8.66 33 TR_XM_DK_Bayes2 49541 7.06 0.27 8.14 34 XM_Evil_Numbers_Gen 49500 8.22 8.79 8.13 35 TooManyTo_001 47504 7.44 5.17 7.81 36 XM_B_Phish_Phrases 47178 8.31 11.78 7.75 37 HTML_IMAGE_RATIO_02 46637 8.20 11.59 7.66 38 RCVD_IN_MSPIKE_H4 44081 6.47 1.63 7.24 39 UNPARSEABLE_RELAY 43714 6.82 4.55 7.18 40 BAYES_60 43461 7.01 6.20 7.14 41 RCVD_IN_RP_SAFE 41734 6.00 0.60 6.86 42 XM_SendGrid 39982 6.18 3.73 6.57 43 BAYES_99 39044 10.53 36.38 6.42 44 RCVD_IN_RP_CERTIFIED 38346 5.48 0.31 6.30 45 XM_DKIMWhitelistDomains 38246 5.42 0.01 6.28 46 MIME_QP_LONG_LINE 36044 5.56 3.30 5.92 47 IN_ZIMBRA_NJ_WHITELIST 36010 5.11 0.03 5.92 48 XM_H_Long_From01 34260 5.66 5.83 5.63 49 DKIM_INVALID 34208 6.93 15.14 5.62 50 HTML_IMAGE_RATIO_04 34092 5.67 6.11 5.60 51 RELAYCOUNTRY_META 33170 9.53 35.14 5.45 52 RCVD_IN_IADB_LISTED 31556 4.58 0.81 5.19 53 BAYES_999 30630 8.35 29.16 5.03 54 MPART_ALT_DIFF 29767 4.97 5.46 4.89 55 BAYES_40 29122 4.48 2.55 4.79 56 RCVD_IN_IADB_SPF 27810 4.04 0.72 4.57 57 BOTNET_IPINHOSTNAME 27783 6.70 20.10 4.57 58 XMSexyCombo_05 26300 5.14 10.31 4.32 59 BAYES_80 25005 4.55 7.34 4.11 60 XMStrtUSub 24989 3.90 2.57 4.11 61 RCVD_IN_IADB_SENDERID 24704 3.60 0.70 4.06 62 RCVD_IN_IADB_DK 24499 3.57 0.71 4.03 63 HTML_IMAGE_RATIO_06 24327 3.93 3.50 4.00 64 T_TooManySym_01 24023 3.73 2.33 3.95 65 TR_XM_DK_SendGrid 23178 3.47 1.32 3.81 66 XM_PDF 22527 3.31 0.88 3.70 67 BAYES_20 21841 3.37 2.00 3.59 68 TR_XM_PhishingBody 20742 3.87 6.81 3.41 69 T_REMOTE_IMAGE 20682 4.20 9.21 3.40 70 TM2_M_URI_OPT_OUT 20599 3.38 3.37 3.38 71 XMSubMetaSx_00 19956 3.60 5.65 3.28 72 NO_DNS_FOR_FROM 19512 4.39 11.86 3.21 73 RCVD_IN_IADB_VOUCHED 19351 2.77 0.23 3.18 74 XM_UncommonTLD01 19006 5.44 19.99 3.12 75 XMNumbers 18589 3.36 5.26 3.05 76 BOTNET 18443 7.32 34.27 3.03 77 MIME_HTML_ONLY_MULTI 17620 2.76 1.88 2.90 78 FROM_EXCESS_BASE64 16983 2.86 3.33 2.79 79 XM_B_Unsub2 16557 2.65 2.20 2.72 80 HTML_IMAGE_RATIO_08 15879 2.61 2.60 2.61 81 BAYES_05 15227 2.33 1.24 2.50 82 XM_B_COVIDMETA 14783 3.08 7.18 2.43 83 ANY_BOUNCE_MESSAGE 14721 2.19 0.74 2.42 84 BOUNCE_MESSAGE 14705 2.18 0.73 2.42 85 BAYES_95 14356 2.64 4.40 2.36 86 MIME_HTML_MOSTLY 14205 2.58 4.14 2.33 87 HTML_MIME_NO_HTML_TAG 13342 2.59 5.09 2.19 88 MAILING_LIST_MULTI 13277 2.08 1.44 2.18 89 XM_H_Trusted_IP 13014 1.84 0.00 2.14 90 XM_CamelCaseFrm001 12843 2.91 7.92 2.11 91 TooManyTo_002 11863 1.77 0.67 1.95 92 RCVD_IN_IADB_OPTIN 11553 1.67 0.24 1.90 93 XM_B_SpammyTLD 11548 2.18 3.93 1.90 94 TVD_RCVD_IP 11541 1.71 0.54 1.90 95 UNTRUSTED_Relay 11533 4.88 23.66 1.90 96 KHOP_HELO_FCRDNS 10986 2.24 4.99 1.81 97 XM_B_Phish66 10896 2.13 4.28 1.79 98 T_TooManySym_02 10811 1.70 1.20 1.78 99 XM_SPF_SoftFail 10742 2.25 5.33 1.77 100 XMDiploma_00 10496 1.82 2.42 1.72 101 T_XMDrugObfuBody_08 10401 2.17 5.09 1.71 102 XM_DK_Undo_01 10172 1.65 1.52 1.67 103 URI_TRY_3LD 9832 1.56 1.20 1.62 104 RELAYCOUNTRY_CA 9816 2.57 8.58 1.61 105 SUBJ_ALL_CAPS 9804 1.63 1.73 1.61 106 RCVD_IN_BL_SPAMCOP_NET 8719 2.75 11.05 1.43 107 TR_Symld_Words 8632 1.43 1.52 1.42 108 HELO_NODOT 8497 1.34 1.00 1.40 109 HELO_NO_DOMAIN 8496 1.34 1.00 1.40 110 URI_HEX 8485 1.47 1.94 1.39 111 XM_OfRef6 8468 1.72 3.77 1.39 112 T_XMDrugObfuBody_14 8149 1.43 1.99 1.34 113 TooManyTo_003 8119 1.22 0.51 1.33 114 TM2_M_VERY_LONG_WORD 8004 1.36 1.64 1.32 115 INVALID_MSGID 7875 1.17 0.39 1.29 116 IN_HORDE_ADDRESS_BOOK 7806 1.11 0.04 1.28 117 XM_H_Long_From02 7485 1.16 0.70 1.23 118 RCVD_IN_RP_RNBL 7449 2.20 8.33 1.22 119 SHORT_URI_3 7428 1.12 0.45 1.22 120 XMStockSpam_06 7395 1.36 2.24 1.22 121 XM_UB50 7248 2.19 8.44 1.19 122 XM_GoogleGroups 7059 1.07 0.51 1.16 123 XM_ProductURIs 6883 1.08 0.73 1.13 124 DKIM_ADSP_CUSTOM_MED 6836 1.21 1.77 1.12 125 TO_MALFORMED 6818 0.97 0.01 1.12 126 USER_IN_DEF_DKIM_WL 6317 0.90 0.00 1.04 127 TR_MetaPhish_Combo_01 6281 1.00 0.83 1.03 128 XMCapTrack 6229 0.97 0.61 1.02 129 RELAYCOUNTRY_GB 6154 1.12 1.83 1.01 130 TooManyTo_004 6080 0.92 0.44 1.00 131 TR_MSPIKEBAYES00 6071 0.86 0.00 1.00 132 XMHTML_After_End 5817 1.65 6.01 0.96 133 HTML_FONT_FACE_BAD 5712 0.87 0.41 0.94 134 TR_XM_COVIDMETA4 5703 1.64 6.04 0.94 135 XMBdyGiftCard01 5660 0.93 0.95 0.93 136 XMMoneyMeta_00 5549 0.95 1.21 0.91 137 SpammyFromTLD_01 5388 1.46 5.10 0.89 138 XMGappySubj_01 5358 0.78 0.12 0.88 139 NML_ADSP_CUSTOM_MED 5353 0.98 1.60 0.88 140 T_Symld_Words_02 5350 0.94 1.34 0.88 141 XMSubNoVowel 5038 0.86 1.05 0.83 142 XMGenDplmaNmb 5014 0.97 1.88 0.82 143 TooManyTo_005 4915 0.75 0.36 0.81 144 XMBrknScrpt_02 4891 0.85 1.16 0.80 145 XMBody_17 4823 1.31 4.57 0.79 146 TR_LOTS_OF_MONEY3 4801 1.07 2.84 0.79 147 T_FILL_THIS_FORM_SHORT 4629 0.79 0.98 0.76 148 T_XMDrugObfuBody_00 4484 0.83 1.44 0.74 149 HTTPS_HTTP_MISMATCH 4270 0.71 0.75 0.70 150 RCVD_IN_MSPIKE_H5 3929 0.56 0.04 0.65 151 T_OBFU_PDF_ATTACH 3869 0.57 0.18 0.64 152 XM_DIRTYINTL 3853 1.14 4.29 0.63 153 XM_SPF_Unknown 3808 0.61 0.49 0.63 154 XMSubMetaSxObfu_03 3671 0.68 1.13 0.60 155 XMSubMetaI_00 3664 0.62 0.74 0.60 156 RCVD_IN_MSPIKE_BL 3424 2.24 12.75 0.56 157 XMPhish14 3414 0.61 0.89 0.56 158 T_TooManySym_03 3355 0.54 0.45 0.55 159 FROM_GOV_DKIM_AU 3280 0.47 0.06 0.54 160 FORGED_GMAIL_RCVD 3245 0.64 1.32 0.53 161 XMNoVowels 3199 0.57 0.87 0.53 162 XMPhish30 3197 0.58 0.92 0.53 163 T_PDS_OTHER_BAD_TLD 3153 0.96 3.75 0.52 164 XMSexyCombo_01 3148 0.66 1.57 0.52 165 T_XMHurry_00 3100 0.80 2.61 0.51 166 RELAYCOUNTRY_DE 3095 0.96 3.77 0.51 167 XMPhish08 3044 0.56 0.91 0.50 168 XM_H_PHPMailer 3042 0.63 1.48 0.50 169 PLING_QUERY 3037 0.50 0.51 0.50 170 MISSING_HEADERS 3009 0.91 3.53 0.49 171 TR_XM_PHPDW 2983 0.81 2.83 0.49 172 TR_XM_COVIDMETA1 2980 0.77 2.53 0.49 173 XM_ShortIntro_01 2907 0.48 0.48 0.48 174 TR_XM_PHPForged 2836 0.79 2.81 0.47 175 RCVD_IN_SORBS_DUL 2836 0.43 0.24 0.47 176 SHORT_URI_2 2831 0.47 0.50 0.47 177 XMHTMLBadTable_001 2831 0.47 0.53 0.47 178 TR_XM_FormFill2 2828 0.78 2.76 0.46 179 XM_H_PHPOS 2792 0.77 2.76 0.46 180 RELAYCOUNTRY_AU 2780 0.50 0.77 0.46 181 HTML_TAG_BALANCE_BODY 2734 0.45 0.48 0.45 182 LOW_PRICE 2695 0.44 0.43 0.44 183 HTML_IMAGE_ONLY_20 2622 0.42 0.36 0.43 184 SUBJ_DOLLARS 2581 0.47 0.79 0.42 185 URI_NOVOWEL 2519 0.43 0.54 0.41 186 URIBL_SBL_A 2497 1.27 6.65 0.41 187 XM_B_REG_HTML 2480 0.37 0.15 0.41 188 XM_B_COPY_HTML 2350 0.39 0.41 0.39 189 XM_RXBody 2348 0.42 0.63 0.39 190 MPART_ALT_DIFF_COUNT 2347 0.44 0.75 0.39 191 XMOemUri 2328 0.43 0.74 0.38 192 XM_Body_Obfu01 2285 0.38 0.38 0.38 193 XMBody_78 2255 0.47 1.09 0.37 194 REMOVE_BEFORE_LINK 2234 0.44 0.88 0.37 195 XMLngstWrd_00 2226 0.41 0.67 0.37 196 SHORT_HELO_AND_INLINE_IMAGE 2222 0.33 0.08 0.37 197 FROM_GOV_SPOOF 2205 0.35 0.27 0.36 198 SpammyFromTLD_02 2191 0.95 4.69 0.36 199 HTML_IMAGE_ONLY_28 2180 0.36 0.34 0.36 200 RCVD_IN_MSPIKE_L3 2174 1.32 7.39 0.36 ----------------------------------------------------------------------