Email: 861338 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.89 sec Spam: 99269 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 3.99 sec Ham: 762069 Autolearn: 0 AvgScore: -2.84 AvgScanTime: 1.61 sec Time Spent Running SA: 451.20 hours Time Spent Processing Spam: 109.94 hours Time Spent Processing Ham: 341.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 96443 98.46 97.15 98.63 2 HTML_MESSAGE 91640 81.09 92.31 79.63 3 DKIM_SIGNED 71924 60.28 72.45 58.70 4 XM_B_Unicode 69625 63.46 70.14 62.60 5 XM_DK_Pass 68724 59.08 69.23 57.76 6 RELAYCOUNTRY_US 68171 69.64 68.67 69.76 7 XMListUnsubscribeExists 60450 41.91 60.90 39.44 8 DKIM_VALID 55518 54.25 55.93 54.04 9 XM_DK_Undo_02 48144 13.66 48.50 9.12 10 DKIM_VALID_AU 39696 40.84 39.99 40.95 11 BAYES_50 37780 44.24 38.06 45.05 12 BAYES_99 36767 9.12 37.04 5.49 13 XM_B_Unicode3 35416 35.27 35.68 35.21 14 MIME_HTML_ONLY 33705 21.08 33.95 19.40 15 BOTNET 33523 6.48 33.77 2.92 16 RELAYCOUNTRY_META 30555 7.49 30.78 4.46 17 LOC_TINY_FONT_1 29553 22.88 29.77 21.98 18 BAYES_999 28567 7.15 28.78 4.33 19 XMSubLong 28012 20.96 28.22 20.01 20 FVGT_m_MULTI_ODD 26290 20.02 26.48 19.18 21 DKIM_VALID_EF 24834 21.69 25.02 21.25 22 HTML_FONT_LOW_CONTRAST 24486 22.19 24.67 21.86 23 RCVD_IN_MSPIKE_H2 23108 18.37 23.28 17.73 24 UNTRUSTED_Relay 22132 3.93 22.29 1.54 25 T_TM2_M_HEADER_IN_MSG 20092 22.56 20.24 22.86 26 BOTNET_IPINHOSTNAME 19965 5.98 20.11 4.14 27 T_KAM_HTML_FONT_INVALID 19827 14.61 19.97 13.92 28 XM_UncommonTLD01 17992 4.15 18.12 2.33 29 XM_Body_Dirty_Words 17494 11.17 17.62 10.33 30 XM_Multi_Part_URI 16406 15.60 16.53 15.47 31 DKIM_INVALID 16406 6.03 16.53 4.66 32 LOTS_OF_MONEY 14635 7.15 14.74 6.16 33 XM_B_Unsub 13108 10.73 13.20 10.40 34 NO_DNS_FOR_FROM 12246 4.87 12.34 3.90 35 XM_B_Phish_Phrases 10797 7.44 10.88 7.00 36 XMSexyCombo_05 10202 3.93 10.28 3.11 37 RCVD_IN_MSPIKE_BL 9807 1.63 9.88 0.56 38 T_REMOTE_IMAGE 9736 3.40 9.81 2.57 39 XM_Evil_Numbers_Gen 9710 8.06 9.78 7.84 40 HTML_MIME_NO_HTML_TAG 9669 2.72 9.74 1.80 41 FROM_EXCESS_BASE64 9404 3.19 9.47 2.37 42 HTML_IMAGE_RATIO_02 9278 5.58 9.35 5.09 43 RCVD_IN_BL_SPAMCOP_NET 8598 1.96 8.66 1.08 44 XM_UB50 8552 1.83 8.61 0.94 45 LotsOfNums_01 8299 6.90 8.36 6.71 46 TR_XM_PhishingBody 8022 3.15 8.08 2.51 47 RCVD_IN_MSPIKE_WL 7778 18.31 7.84 19.68 48 BAYES_80 7717 3.71 7.77 3.19 49 HTML_TAG_BALANCE_CENTER 7556 0.96 7.61 0.09 50 BODY_URI_ONLY 7437 0.90 7.49 0.04 51 HDRS_MISSP 7095 0.85 7.15 0.03 52 RELAYCOUNTRY_CA 7029 2.16 7.08 1.52 53 TooManyTo_001 7012 6.45 7.06 6.37 54 BAYES_60 6929 5.22 6.98 4.99 55 XM_H_Long_From01 6654 5.41 6.70 5.25 56 SpammyFromTLD_02 6621 1.02 6.67 0.28 57 XM_SPF_SoftFail 6318 2.05 6.36 1.48 58 XMNumbers 5870 2.58 5.91 2.14 59 UNPARSEABLE_RELAY 5837 5.22 5.88 5.13 60 MPART_ALT_DIFF 5768 7.18 5.81 7.36 61 XM_B_COVIDMETA 5705 1.92 5.75 1.42 62 SpammyFromTLD_01 5654 1.22 5.70 0.64 63 XMSubMetaSx_00 5613 3.27 5.65 2.95 64 RCVD_IN_RP_RNBL 5436 0.69 5.48 0.06 65 XM_B_SpammyTLD 5431 2.14 5.47 1.71 66 RCVD_IN_MSPIKE_L3 5407 0.90 5.45 0.30 67 XM_B_Phish66 5406 1.90 5.45 1.43 68 TR_XM_COVIDMETA4 5379 1.14 5.42 0.59 69 XM_UB99 5322 0.62 5.36 0.01 70 XMBody_17 5231 1.30 5.27 0.79 71 XM_OfRef6 5150 1.49 5.19 1.00 72 BOTNET_NORDNS 5123 0.61 5.16 0.02 73 TR_XM_INV_DKIM 4988 0.73 5.02 0.17 74 HTML_IMAGE_RATIO_04 4859 9.99 4.89 10.66 75 XM_SendGrid 4603 4.57 4.64 4.56 76 BAYES_95 4538 2.25 4.57 1.95 77 RCVD_IN_PSBL 4471 0.53 4.50 0.01 78 RCVD_IN_MSPIKE_H3 4457 10.34 4.49 11.10 79 FROM_SUSPICIOUS_NTLD 4244 0.52 4.28 0.03 80 MIME_HTML_MOSTLY 4148 2.08 4.18 1.80 81 URIBL_SBL_A 4139 0.66 4.17 0.20 82 FROM_SUSPICIOUS_NTLD_FP 4128 0.50 4.16 0.03 83 XM_DIRTYINTL 3994 0.85 4.02 0.44 84 XM_UB999 3871 0.45 3.90 0.00 85 PDS_OTHER_BAD_TLD 3845 0.54 3.87 0.11 86 XMStrtUSub 3758 7.04 3.79 7.46 87 KHOP_HELO_FCRDNS 3710 1.77 3.74 1.51 88 RCVD_IN_MSPIKE_L5 3660 0.56 3.69 0.15 89 TR_XM_MaxWHORU 3432 0.44 3.46 0.04 90 XM_URI_RBL 3233 0.53 3.26 0.18 91 XMBrknScrpt_02 3232 1.10 3.26 0.82 92 RCVD_IN_MSPIKE_H4 3221 6.90 3.24 7.38 93 RELAYCOUNTRY_FR 3148 0.61 3.17 0.27 94 TR_XM_MaxSPIKE 3138 0.39 3.16 0.03 95 TR_XM_UnparsRelay 3118 0.60 3.14 0.27 96 TR_XM_MaxBayes 3088 0.39 3.11 0.03 97 TR_XM_COVIDMETA1 3053 0.70 3.08 0.39 98 TM2_M_URI_OPT_OUT 3052 13.64 3.07 15.02 99 MIME_QP_LONG_LINE 2971 4.12 2.99 4.27 100 XM_UB60 2964 0.43 2.99 0.10 101 RELAYCOUNTRY_JP 2960 0.37 2.98 0.03 102 SUBJ_ALL_CAPS 2889 1.38 2.91 1.18 103 XM_JunkDunk 2855 0.33 2.88 0.00 104 TR_Mismatch_TLD_02 2799 0.38 2.82 0.06 105 XM_B_Unsub2 2788 3.99 2.81 4.15 106 DKIM_ADSP_NXDOMAIN 2645 1.26 2.66 1.08 107 TR_Symld_Words 2628 1.36 2.65 1.19 108 TR_LOTS_OF_MONEY3 2557 0.78 2.58 0.55 109 XM_UB80 2551 0.33 2.57 0.04 110 TM2_M_VERY_LONG_WORD 2476 1.03 2.49 0.83 111 XM_CamelCaseFrm001 2475 1.61 2.49 1.49 112 TR_XM_PHPDW 2456 0.90 2.47 0.69 113 TR_XM_PHPForged 2444 0.88 2.46 0.68 114 TR_XM_FormFill2 2419 0.88 2.44 0.68 115 HTML_IMAGE_RATIO_06 2410 3.77 2.43 3.95 116 XM_H_PHPOS 2408 0.87 2.43 0.67 117 T_XMDrugObfuBody_08 2367 1.32 2.38 1.18 118 DATE_IN_PAST_03_06 2304 0.34 2.32 0.08 119 URI_HEX 2284 1.33 2.30 1.21 120 RELAYCOUNTRY_SG 2278 0.35 2.29 0.10 121 HTML_IMAGE_RATIO_08 2229 2.02 2.25 1.99 122 URI_TRY_3LD 2183 1.08 2.20 0.94 123 XMDiploma_00 2176 1.51 2.19 1.42 124 T_XMDrugObfuBody_14 2067 1.39 2.08 1.30 125 XM_OfRef7 2009 0.36 2.02 0.14 126 BAYES_40 1998 4.80 2.01 5.16 127 T_XMDrugObfuBody_00 1987 4.51 2.00 4.84 128 MAILING_LIST_MULTI 1956 2.13 1.97 2.15 129 XMHTML_After_End 1948 1.09 1.96 0.98 130 URI_PHP_REDIR 1880 0.25 1.89 0.04 131 T_TooManySym_01 1873 3.24 1.89 3.42 132 TR_XM_DK_SendGrid 1811 2.37 1.82 2.44 133 ALL_TRUSTED 1765 24.12 1.78 27.03 134 MIME_HTML_ONLY_MULTI 1744 5.16 1.76 5.60 135 HTML_IMAGE_ONLY_16 1743 0.39 1.76 0.21 136 TR_XM_RelayPhish 1700 0.31 1.71 0.13 137 RELAYCOUNTRY_GB 1699 0.89 1.71 0.78 138 XMSexyCombo_01 1677 0.82 1.69 0.71 139 LongTLD 1656 0.30 1.67 0.12 140 XM_BadFromFormat 1637 0.28 1.65 0.10 141 FILL_THIS_FORM 1621 0.33 1.63 0.17 142 T_XMHurry_00 1616 0.58 1.63 0.44 143 XM_PDF 1613 2.91 1.62 3.08 144 XM_UB95 1596 0.21 1.61 0.03 145 TM2_M_A_HREF_HREF 1576 0.42 1.59 0.27 146 BAYES_20 1559 3.85 1.57 4.14 147 XMMoneyMeta_00 1495 0.68 1.51 0.57 148 XMGenDplmaNmb 1459 0.83 1.47 0.75 149 T_FILL_THIS_FORM_SHORT 1448 0.73 1.46 0.64 150 XMSubNoVowel 1440 2.75 1.45 2.92 151 XMStockSpam_06 1438 1.01 1.45 0.95 152 HK_RANDOM_REPLYTO 1422 0.35 1.43 0.21 153 T_Symld_Words_02 1411 0.51 1.42 0.39 154 MPART_ALT_DIFF_COUNT 1308 0.73 1.32 0.65 155 DKIM_ADSP_CUSTOM_MED 1297 0.89 1.31 0.83 156 RDNS_DYNAMIC 1288 0.38 1.30 0.26 157 LONG_JUNK_URI 1285 0.20 1.29 0.06 158 URI_WP_DIRINDEX 1266 0.15 1.28 0.01 159 DATE_IN_PAST_06_12 1249 0.25 1.26 0.12 160 XM_H_Undi_Recip 1210 0.26 1.22 0.13 161 ANY_BOUNCE_MESSAGE 1207 13.82 1.22 15.46 162 BOUNCE_MESSAGE 1200 13.82 1.21 15.46 163 HTML_FONT_SIZE_HUGE 1176 2.62 1.18 2.81 164 NML_ADSP_CUSTOM_MED 1174 0.67 1.18 0.60 165 XM_DK_Undo_01 1158 1.16 1.17 1.16 166 URIBL_BLACK 1146 0.15 1.15 0.02 167 FILL_THIS_FORM_LONG 1144 0.19 1.15 0.06 168 URI_WP_HACKED_2 1142 0.15 1.15 0.02 169 RELAYCOUNTRY_NL 1130 0.25 1.14 0.13 170 HELO_NODOT 1120 1.16 1.13 1.17 171 HELO_NO_DOMAIN 1117 1.16 1.13 1.16 172 BAYES_00 1116 23.14 1.12 26.01 173 TR_Mismatch_TLD_01 1112 0.29 1.12 0.18 174 RELAYCOUNTRY_IN 1071 0.20 1.08 0.09 175 PDS_FROM_2_EMAILS 1066 0.15 1.07 0.03 176 TR_LOTS_OF_MONEY2 1052 0.28 1.06 0.18 177 T_MONEY_PERCENT 1052 0.28 1.06 0.18 178 LOADSA_MONEY_COMBO 1050 0.20 1.06 0.08 179 FORGED_GMAIL_RCVD 1044 0.45 1.05 0.38 180 FROM_2_EMAILS_SHORT 1035 0.12 1.04 0.00 181 XMBdyGiftCard01 1029 0.72 1.04 0.68 182 RELAYCOUNTRY_RU 1029 0.14 1.04 0.02 183 XM_XX_Yahoo 1016 0.16 1.02 0.04 184 MIME_CHARSET_FARAWAY 1005 0.25 1.01 0.15 185 PDS_TO_EQ_FROM_NAME 987 0.12 0.99 0.00 186 XMPhish14 985 0.44 0.99 0.37 187 XMPhish08 967 0.41 0.97 0.34 188 XFER_LOTSA_MONEY 960 0.16 0.97 0.05 189 REPLYTO_WITHOUT_TO_CC 952 0.16 0.96 0.06 190 RELAYCOUNTRY_HU 942 0.12 0.95 0.01 191 MISSING_HEADERS 939 0.40 0.95 0.32 192 CHARSET_FARAWAY_HEADER 939 0.14 0.95 0.03 193 HK_SCAM 931 0.12 0.94 0.02 194 TR_XM_SpoofStaff 923 0.18 0.93 0.08 195 XMBody_78 921 0.40 0.93 0.33 196 XM_H_MailChimp 915 0.26 0.92 0.17 197 RELAYCOUNTRY_DE 910 0.42 0.92 0.35 198 DIET_1 902 0.41 0.91 0.35 199 XM_H_Long_From02 888 0.95 0.89 0.96 200 XMSpoofStaff2 885 0.18 0.89 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 751662 98.46 97.15 98.63 2 HTML_MESSAGE 606839 81.09 92.31 79.63 3 RELAYCOUNTRY_US 531656 69.64 68.67 69.76 4 XM_B_Unicode 477018 63.46 70.14 62.60 5 DKIM_SIGNED 447303 60.28 72.45 58.70 6 XM_DK_Pass 440185 59.08 69.23 57.76 7 DKIM_VALID 411795 54.25 55.93 54.04 8 BAYES_50 343302 44.24 38.06 45.05 9 DKIM_VALID_AU 312037 40.84 39.99 40.95 10 XMListUnsubscribeExists 300572 41.91 60.90 39.44 11 XM_B_Unicode3 268358 35.27 35.68 35.21 12 ALL_TRUSTED 206018 24.12 1.78 27.03 13 BAYES_00 198230 23.14 1.12 26.01 14 T_TM2_M_HEADER_IN_MSG 174244 22.56 20.24 22.86 15 LOC_TINY_FONT_1 167514 22.88 29.77 21.98 16 HTML_FONT_LOW_CONTRAST 166616 22.19 24.67 21.86 17 DKIM_VALID_EF 161955 21.69 25.02 21.25 18 XMSubLong 152503 20.96 28.22 20.01 19 RCVD_IN_MSPIKE_WL 149975 18.31 7.84 19.68 20 MIME_HTML_ONLY 147866 21.08 33.95 19.40 21 FVGT_m_MULTI_ODD 146176 20.02 26.48 19.18 22 RCVD_IN_MSPIKE_H2 135105 18.37 23.28 17.73 23 XM_Multi_Part_URI 117928 15.60 16.53 15.47 24 ANY_BOUNCE_MESSAGE 117809 13.82 1.22 15.46 25 BOUNCE_MESSAGE 117806 13.82 1.21 15.46 26 TM2_M_URI_OPT_OUT 114466 13.64 3.07 15.02 27 T_KAM_HTML_FONT_INVALID 106054 14.61 19.97 13.92 28 RCVD_IN_MSPIKE_H3 84580 10.34 4.49 11.10 29 HTML_IMAGE_RATIO_04 81218 9.99 4.89 10.66 30 XM_B_Unsub 79272 10.73 13.20 10.40 31 XM_Body_Dirty_Words 78701 11.17 17.62 10.33 32 XM_DK_Undo_02 69522 13.66 48.50 9.12 33 XM_H_Trusted_IP 67754 7.87 0.00 8.89 34 HTML_FONT_FACE_BAD 63382 7.42 0.54 8.32 35 XM_Evil_Numbers_Gen 59719 8.06 9.78 7.84 36 XMStrtUSub 56871 7.04 3.79 7.46 37 RCVD_IN_MSPIKE_H4 56225 6.90 3.24 7.38 38 MPART_ALT_DIFF 56114 7.18 5.81 7.36 39 XM_B_Phish_Phrases 53329 7.44 10.88 7.00 40 TR_XM_DK_Bayes 51357 6.03 0.59 6.74 41 LotsOfNums_01 51113 6.90 8.36 6.71 42 TooManyTo_001 48541 6.45 7.06 6.37 43 TR_XM_DK_Bayes1 47546 5.56 0.31 6.24 44 LOTS_OF_MONEY 46972 7.15 14.74 6.16 45 IN_ZIMBRA_NJ_WHITELIST 45695 5.31 0.05 6.00 46 MIME_HTML_ONLY_MULTI 42694 5.16 1.76 5.60 47 RCVD_IN_RP_SAFE 42328 4.98 0.56 5.55 48 BAYES_99 41830 9.12 37.04 5.49 49 TR_XM_DK_Bayes2 41644 4.86 0.21 5.46 50 XM_H_Long_From01 39978 5.41 6.70 5.25 51 XM_DKIMWhitelistDomains 39801 4.62 0.01 5.22 52 BAYES_40 39324 4.80 2.01 5.16 53 UNPARSEABLE_RELAY 39110 5.22 5.88 5.13 54 RCVD_IN_RP_CERTIFIED 38876 4.55 0.28 5.10 55 HTML_IMAGE_RATIO_02 38760 5.58 9.35 5.09 56 BAYES_60 38005 5.22 6.98 4.99 57 T_XMDrugObfuBody_00 36879 4.51 2.00 4.84 58 DKIM_INVALID 35508 6.03 16.53 4.66 59 XM_SendGrid 34734 4.57 4.64 4.56 60 RELAYCOUNTRY_META 33982 7.49 30.78 4.46 61 BAYES_999 32987 7.15 28.78 4.33 62 MIME_QP_LONG_LINE 32513 4.12 2.99 4.27 63 XM_B_Unsub2 31608 3.99 2.81 4.15 64 BOTNET_IPINHOSTNAME 31572 5.98 20.11 4.14 65 BAYES_20 31563 3.85 1.57 4.14 66 BAYES_05 30653 3.66 0.87 4.02 67 HTML_IMAGE_RATIO_06 30078 3.77 2.43 3.95 68 NO_DNS_FOR_FROM 29689 4.87 12.34 3.90 69 RCVD_IN_IADB_LISTED 27052 3.22 0.70 3.55 70 T_TooManySym_01 26040 3.24 1.89 3.42 71 BAYES_80 24279 3.71 7.77 3.19 72 XMSexyCombo_05 23665 3.93 10.28 3.11 73 RCVD_IN_IADB_SPF 23644 2.81 0.59 3.10 74 XM_PDF 23477 2.91 1.62 3.08 75 XMSubMetaSx_00 22511 3.27 5.65 2.95 76 BOTNET 22269 6.48 33.77 2.92 77 XMSubNoVowel 22263 2.75 1.45 2.92 78 HTML_FONT_SIZE_HUGE 21412 2.62 1.18 2.81 79 RCVD_IN_IADB_SENDERID 20776 2.48 0.55 2.73 80 RCVD_IN_IADB_DK 20667 2.46 0.55 2.71 81 T_REMOTE_IMAGE 19583 3.40 9.81 2.57 82 TR_XM_PhishingBody 19136 3.15 8.08 2.51 83 TR_XM_DK_SendGrid 18574 2.37 1.82 2.44 84 FROM_EXCESS_BASE64 18036 3.19 9.47 2.37 85 XM_UncommonTLD01 17774 4.15 18.12 2.33 86 RCVD_IN_IADB_VOUCHED 16695 1.97 0.28 2.19 87 MAILING_LIST_MULTI 16356 2.13 1.97 2.15 88 XMNumbers 16319 2.58 5.91 2.14 89 HTML_IMAGE_RATIO_08 15190 2.02 2.25 1.99 90 BAYES_95 14878 2.25 4.57 1.95 91 MIME_HTML_MOSTLY 13735 2.08 4.18 1.80 92 HTML_MIME_NO_HTML_TAG 13725 2.72 9.74 1.80 93 T_TooManySym_02 13385 1.63 0.66 1.76 94 XM_B_SpammyTLD 13032 2.14 5.47 1.71 95 UNTRUSTED_Relay 11714 3.93 22.29 1.54 96 RELAYCOUNTRY_CA 11586 2.16 7.08 1.52 97 TooManyTo_002 11585 1.44 0.84 1.52 98 KHOP_HELO_FCRDNS 11528 1.77 3.74 1.51 99 XM_CamelCaseFrm001 11371 1.61 2.49 1.49 100 XM_SPF_SoftFail 11305 2.05 6.36 1.48 101 TVD_RCVD_IP 10955 1.31 0.33 1.44 102 XM_B_Phish66 10932 1.90 5.45 1.43 103 XMDiploma_00 10824 1.51 2.19 1.42 104 XM_B_COVIDMETA 10815 1.92 5.75 1.42 105 RCVD_IN_IADB_OPTIN 10258 1.22 0.26 1.35 106 T_XMDrugObfuBody_14 9933 1.39 2.08 1.30 107 URI_HEX 9201 1.33 2.30 1.21 108 RCVD_IN_MSPIKE_H5 9170 1.08 0.10 1.20 109 TR_Symld_Words 9078 1.36 2.65 1.19 110 T_XMDrugObfuBody_08 8972 1.32 2.38 1.18 111 SUBJ_ALL_CAPS 8957 1.38 2.91 1.18 112 HELO_NODOT 8880 1.16 1.13 1.17 113 HELO_NO_DOMAIN 8878 1.16 1.13 1.16 114 XM_DK_Undo_01 8849 1.16 1.17 1.16 115 XMPhish11 8713 1.08 0.61 1.14 116 XM_H_PHPMailer 8352 1.06 0.78 1.10 117 RCVD_IN_BL_SPAMCOP_NET 8261 1.96 8.66 1.08 118 DKIM_ADSP_NXDOMAIN 8207 1.26 2.66 1.08 119 TooManyTo_003 7661 0.96 0.60 1.01 120 XM_OfRef6 7658 1.49 5.19 1.00 121 HELO_MISC_IP 7480 0.97 0.86 0.98 122 CK_HELO_DYNAMIC_SPLIT_IP 7474 0.96 0.83 0.98 123 XMHTML_After_End 7446 1.09 1.96 0.98 124 IN_HORDE_ADDRESS_BOOK 7431 0.89 0.20 0.98 125 XMSubLongNoVowel 7329 0.92 0.57 0.96 126 INVALID_MSGID 7321 0.91 0.53 0.96 127 XMSubGarbage 7320 0.89 0.32 0.96 128 XM_H_Long_From02 7311 0.95 0.89 0.96 129 XM_GoogleGroups 7281 0.90 0.51 0.96 130 XMStockSpam_06 7222 1.01 1.45 0.95 131 XM_UB50 7168 1.83 8.61 0.94 132 URI_TRY_3LD 7130 1.08 2.20 0.94 133 HTML_FONT_SIZE_LARGE 6709 0.82 0.35 0.88 134 XMCapTrack 6688 0.85 0.67 0.88 135 TO_MALFORMED 6500 0.76 0.01 0.85 136 TM2_M_VERY_LONG_WORD 6361 1.03 2.49 0.83 137 DKIM_ADSP_CUSTOM_MED 6340 0.89 1.31 0.83 138 XMBrknScrpt_02 6275 1.10 3.26 0.82 139 XMBody_17 5991 1.30 5.27 0.79 140 RELAYCOUNTRY_GB 5946 0.89 1.71 0.78 141 TooManyTo_004 5724 0.72 0.51 0.75 142 XMGenDplmaNmb 5703 0.83 1.47 0.75 143 USER_IN_DEF_DKIM_WL 5540 0.64 0.00 0.73 144 XMSexyCombo_01 5373 0.82 1.69 0.71 145 XM_E_Blogspot 5348 0.63 0.07 0.70 146 TR_XM_PHPDW 5290 0.90 2.47 0.69 147 TR_XM_PHPForged 5165 0.88 2.46 0.68 148 XMBdyGiftCard01 5161 0.72 1.04 0.68 149 TR_XM_FormFill2 5154 0.88 2.44 0.68 150 XMGappySubj_01 5140 0.62 0.19 0.67 151 XM_H_PHPOS 5125 0.87 2.43 0.67 152 TR_MSPIKEBAYES00 5002 0.58 0.03 0.66 153 MPART_ALT_DIFF_COUNT 4965 0.73 1.32 0.65 154 T_FILL_THIS_FORM_SHORT 4856 0.73 1.46 0.64 155 SpammyFromTLD_01 4853 1.22 5.70 0.64 156 T_TooManySym_03 4762 0.58 0.23 0.62 157 TooManyTo_005 4742 0.60 0.39 0.62 158 T_OBFU_PDF_ATTACH 4597 0.59 0.49 0.60 159 NML_ADSP_CUSTOM_MED 4587 0.67 1.18 0.60 160 TR_XM_COVIDMETA4 4459 1.14 5.42 0.59 161 XMMoneyMeta_00 4334 0.68 1.51 0.57 162 RCVD_IN_MSPIKE_BL 4252 1.63 9.88 0.56 163 HTTPS_HTTP_MISMATCH 4221 0.56 0.62 0.55 164 PLING_QUERY 4195 0.55 0.59 0.55 165 TR_LOTS_OF_MONEY3 4173 0.78 2.58 0.55 166 FROM_GOV_DKIM_AU 4128 0.49 0.08 0.54 167 XM_ProductURIs 4055 0.55 0.65 0.53 168 TR_MetaPhish_Combo_01 4024 0.56 0.84 0.53 169 XMSubMetaSxObfu_03 4017 0.57 0.88 0.53 170 TO_NO_BRKTS_HTML_ONLY 3738 0.47 0.29 0.49 171 XM_RXBody 3702 0.47 0.39 0.49 172 TR_BOTNET_NEGATE 3682 0.49 0.57 0.48 173 T_XMHurry_00 3390 0.58 1.63 0.44 174 XM_DIRTYINTL 3357 0.85 4.02 0.44 175 XMBody_95 3349 0.41 0.18 0.44 176 XM_SPF_Unknown 3326 0.47 0.72 0.44 177 XMSubMetaI_00 3224 0.47 0.83 0.42 178 T_TVD_MIME_NO_HEADERS 3157 0.37 0.05 0.41 179 THIS_AD 3019 0.41 0.50 0.40 180 TR_XM_COVIDMETA1 2986 0.70 3.08 0.39 181 T_Symld_Words_02 2965 0.51 1.42 0.39 182 XM_ShortIntro_01 2884 0.42 0.77 0.38 183 FORGED_GMAIL_RCVD 2859 0.45 1.05 0.38 184 URI_OPTOUT_3LD 2817 0.42 0.77 0.37 185 XMPhish14 2792 0.44 0.99 0.37 186 RCVD_IN_SORBS_DUL 2740 0.34 0.19 0.36 187 XMPhish30 2732 0.42 0.85 0.36 188 RELAYCOUNTRY_DE 2675 0.42 0.92 0.35 189 DIET_1 2660 0.41 0.91 0.35 190 HTML_IMAGE_ONLY_20 2656 0.40 0.84 0.35 191 XM_B_COPY_HTML 2628 0.35 0.41 0.34 192 XM_B_REG_HTML 2607 0.32 0.14 0.34 193 TM2_M_BODY_EMPTY 2607 0.32 0.18 0.34 194 XMHTMLBadTable_001 2599 0.34 0.37 0.34 195 XMPhish08 2592 0.41 0.97 0.34 196 XMSolicitRefs_0 2577 0.36 0.51 0.34 197 RELAYCOUNTRY_AU 2562 0.36 0.52 0.34 198 XMBody_78 2498 0.40 0.93 0.33 199 MISSING_HEADERS 2467 0.40 0.95 0.32 200 XMNoVowels 2459 0.38 0.82 0.32 ----------------------------------------------------------------------