Email: 837857 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.77 sec Spam: 108133 Autolearn: 0 AvgScore: 14.65 AvgScanTime: 3.64 sec Ham: 729724 Autolearn: 0 AvgScore: -2.85 AvgScanTime: 1.49 sec Time Spent Running SA: 412.21 hours Time Spent Processing Spam: 109.28 hours Time Spent Processing Ham: 302.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 103502 98.04 95.72 98.39 2 HTML_MESSAGE 101369 79.94 93.74 77.89 3 RELAYCOUNTRY_US 72171 70.99 66.74 71.62 4 XM_B_Unicode 70944 62.25 65.61 61.75 5 DKIM_SIGNED 67065 60.00 62.02 59.70 6 XM_DK_Pass 64200 58.82 59.37 58.74 7 XMListUnsubscribeExists 54855 40.97 50.73 39.52 8 DKIM_VALID 51784 54.20 47.89 55.14 9 MIME_HTML_ONLY 48624 22.91 44.97 19.65 10 BAYES_99 48163 10.75 44.54 5.74 11 XM_DK_Undo_02 45361 13.41 41.95 9.18 12 BOTNET 44035 7.77 40.72 2.88 13 RCVD_IN_MSPIKE_H2 42659 21.22 39.45 18.52 14 BAYES_999 38111 8.43 35.24 4.46 15 DKIM_VALID_AU 36227 40.61 33.50 41.67 16 RELAYCOUNTRY_META 35633 8.02 32.95 4.32 17 BAYES_50 35236 41.78 32.59 43.15 18 XM_B_Unicode3 34858 36.12 32.24 36.69 19 HTML_MIME_NO_HTML_TAG 26679 5.00 24.67 2.08 20 FVGT_m_MULTI_ODD 26087 17.99 24.12 17.08 21 LOC_TINY_FONT_1 25970 19.23 24.02 18.53 22 XMSubLong 25603 18.98 23.68 18.29 23 UNTRUSTED_Relay 25085 4.40 23.20 1.61 24 XM_Body_Dirty_Words 24666 13.02 22.81 11.57 25 RCVD_IN_BL_SPAMCOP_NET 24005 3.77 22.20 1.04 26 FROM_EXCESS_BASE64 22885 4.56 21.16 2.10 27 DKIM_VALID_EF 22873 22.10 21.15 22.24 28 HTML_FONT_LOW_CONTRAST 22312 20.82 20.63 20.85 29 RCVD_IN_PSBL 21561 2.58 19.94 0.00 30 HTML_IMAGE_RATIO_02 21313 6.85 19.71 4.94 31 XM_Multi_Part_URI 20220 16.98 18.70 16.73 32 T_TM2_M_HEADER_IN_MSG 19490 22.60 18.02 23.27 33 XM_B_Unsub 19225 11.27 17.78 10.30 34 T_KAM_HTML_FONT_INVALID 18627 14.32 17.23 13.89 35 BOTNET_IPINHOSTNAME 17286 5.84 15.99 4.34 36 BODY_URI_ONLY 15790 1.92 14.60 0.04 37 XMSexyCombo_05 15598 5.07 14.42 3.68 38 DKIM_INVALID 15281 5.80 14.13 4.56 39 XM_UncommonTLD01 14423 3.76 13.34 2.34 40 NO_DNS_FOR_FROM 12824 3.94 11.86 2.76 41 LOTS_OF_MONEY 12815 6.95 11.85 6.22 42 XMSubMetaSx_00 12689 4.05 11.73 2.92 43 XM_JunkDunk 12364 1.48 11.43 0.00 44 XMSubGiftCard1 10952 1.35 10.13 0.05 45 XM_B_Phish_Phrases 10624 6.33 9.82 5.81 46 XM_Evil_Numbers_Gen 9523 7.95 8.81 7.82 47 XM_UB99 9429 1.13 8.72 0.01 48 LotsOfNums_01 9091 7.07 8.41 6.87 49 XMSexyCombo_01 8695 1.41 8.04 0.43 50 RCVD_IN_MSPIKE_WL 8579 18.88 7.93 20.50 51 RCVD_IN_MSPIKE_BL 8563 1.54 7.92 0.60 52 TR_XM_PhishingBody 7895 3.14 7.30 2.52 53 HTML_IMAGE_ONLY_16 7780 1.14 7.19 0.24 54 BAYES_80 7766 4.09 7.18 3.63 55 XM_UB50 7733 1.67 7.15 0.86 56 XMSubMetaSSx_00 7629 1.09 7.06 0.21 57 XM_UB999 7594 0.91 7.02 0.01 58 RELAYCOUNTRY_CA 7271 2.17 6.72 1.50 59 HTML_SHORT_LINK_IMG_2 7257 0.91 6.71 0.05 60 KHOP_HELO_FCRDNS 7121 2.10 6.59 1.44 61 XMSexyCombo_04 6994 0.91 6.47 0.09 62 XM_DIRTYINTL 6824 1.21 6.31 0.45 63 BAYES_60 6338 5.53 5.86 5.48 64 HTML_IMAGE_ONLY_08 6295 0.82 5.82 0.08 65 HTML_SHORT_LINK_IMG_1 6250 0.76 5.78 0.01 66 XM_H_Long_From01 6139 4.45 5.68 4.27 67 HK_RANDOM_FROM 6047 0.82 5.59 0.11 68 XMNumbers 5981 2.85 5.53 2.46 69 XM_B_COVIDMETA 5889 1.94 5.45 1.43 70 TooManyTo_001 5863 6.43 5.42 6.57 71 MPART_ALT_DIFF 5588 7.18 5.17 7.48 72 UNPARSEABLE_RELAY 5283 5.24 4.89 5.29 73 XM_B_Phish66 5268 1.92 4.87 1.48 74 RCVD_IN_MSPIKE_H3 5180 10.66 4.79 11.53 75 XM_SPF_SoftFail 5179 1.75 4.79 1.30 76 BAYES_95 5031 2.51 4.65 2.19 77 RCVD_IN_RP_RNBL 4693 0.61 4.34 0.06 78 TR_XM_COVIDMETA4 4688 1.02 4.34 0.53 79 TR_XM_INV_DKIM 4657 0.70 4.31 0.17 80 BOTNET_NORDNS 4656 0.57 4.31 0.02 81 RCVD_IN_MSPIKE_L3 4503 0.85 4.16 0.36 82 SpammyFromTLD_01 4416 1.08 4.08 0.64 83 FVGT_m_MULTI_ODD_EMAIL 4384 0.55 4.05 0.03 84 HTML_IMAGE_RATIO_04 4343 10.18 4.02 11.10 85 XM_SendGrid 4293 4.65 3.97 4.75 86 XM_B_SpammyTLD 4279 1.61 3.96 1.26 87 TR_XM_MaxWHORU 4046 0.52 3.74 0.04 88 FROM_SUSPICIOUS_NTLD 4030 0.50 3.73 0.03 89 FROM_SUSPICIOUS_NTLD_FP 3988 0.50 3.69 0.02 90 HTML_IMAGE_ONLY_32 3833 0.71 3.54 0.29 91 LongTLD 3780 0.56 3.50 0.13 92 RELAYCOUNTRY_FR 3715 0.62 3.44 0.20 93 MIME_HTML_MOSTLY 3681 2.25 3.40 2.07 94 LOCALPART_IN_SUBJECT 3630 0.44 3.36 0.01 95 XM_Walgreens_Forge 3597 0.49 3.33 0.07 96 URIBL_SBL_A 3595 0.65 3.32 0.25 97 XMStrtUSub 3560 7.65 3.29 8.29 98 DKIM_ADSP_NXDOMAIN 3542 0.87 3.28 0.52 99 XM_URI_RBL 3501 0.64 3.24 0.26 100 TM2_M_URI_OPT_OUT 3258 14.83 3.01 16.59 101 HDRS_MISSP 3203 0.41 2.96 0.04 102 URI_NOVOWEL 3086 0.66 2.85 0.33 103 RCVD_IN_MSPIKE_H4 3081 7.13 2.85 7.76 104 T_XMDrugObfuBody_08 3068 1.43 2.84 1.23 105 RCVD_IN_MSPIKE_L5 3044 0.53 2.82 0.19 106 TO_NAME_SUBJ_NO_RDNS 3012 0.36 2.79 0.00 107 XM_OfRef6 2951 1.13 2.73 0.89 108 MIME_QP_LONG_LINE 2921 4.18 2.70 4.40 109 TR_XM_MaxSPIKE 2834 0.36 2.62 0.03 110 T_REMOTE_IMAGE 2817 2.68 2.61 2.69 111 XMDiploma_00 2797 1.66 2.59 1.53 112 RELAYCOUNTRY_DE 2775 0.61 2.57 0.31 113 SpammyFromTLD_02 2772 0.56 2.56 0.26 114 XMBody_17 2751 0.85 2.54 0.60 115 RELAYCOUNTRY_GB 2675 1.02 2.47 0.80 116 TR_XM_MaxBayes 2660 0.34 2.46 0.02 117 XM_B_Unsub2 2614 4.04 2.42 4.28 118 TR_XM_UnparsRelay 2592 0.56 2.40 0.29 119 RELAYCOUNTRY_JP 2591 0.34 2.40 0.03 120 XM_CamelCaseFrm001 2564 1.65 2.37 1.54 121 TR_LOTS_OF_MONEY3 2559 0.78 2.37 0.54 122 TR_XM_PHPDW 2507 0.63 2.32 0.38 123 HTML_IMAGE_RATIO_06 2502 3.88 2.31 4.11 124 BAYES_40 2495 4.66 2.31 5.00 125 FROM_LOCAL_NOVOWEL 2485 0.32 2.30 0.02 126 HDRS_LCASE_IMGONLY 2483 0.30 2.30 0.01 127 TR_XM_PHPForged 2466 0.61 2.28 0.36 128 TR_XM_FormFill2 2448 0.61 2.26 0.36 129 XM_UB80 2446 0.32 2.26 0.03 130 MIME_HEADER_CTYPE_ONLY 2445 0.48 2.26 0.22 131 XM_H_PHPOS 2439 0.60 2.26 0.36 132 XM_DK_Undo_01 2392 1.31 2.21 1.18 133 SHORT_IMG_SUSP_NTLD 2375 0.28 2.20 0.00 134 TR_XM_COVIDMETA1 2282 0.57 2.11 0.34 135 XMStockSpam_06 2261 1.10 2.09 0.95 136 XM_UB60 2257 0.35 2.09 0.09 137 HTML_IMAGE_RATIO_08 2236 1.77 2.07 1.73 138 SUBJ_ALL_CAPS 2063 1.30 1.91 1.21 139 XMSubEmpty 2027 0.39 1.87 0.17 140 TR_XM_RelayPhish 2020 0.35 1.87 0.12 141 T_TooManySym_01 2013 3.26 1.86 3.47 142 XMSexyCombo_03 1980 0.24 1.83 0.01 143 XMBrknScrpt_02 1972 0.79 1.82 0.64 144 T_XMDrugObfuBody_14 1957 1.33 1.81 1.26 145 URI_TRY_3LD 1932 1.05 1.79 0.94 146 PDS_OTHER_BAD_TLD 1921 0.32 1.78 0.11 147 URI_HEX 1909 1.32 1.77 1.25 148 RELAYCOUNTRY_SG 1908 0.30 1.76 0.08 149 HTML_FONT_TINY_NORDNS 1877 0.47 1.74 0.28 150 XMGenDplmaNmb 1838 0.94 1.70 0.83 151 TR_Symld_Words 1832 1.60 1.69 1.59 152 TR_Sbj_FN_Bdy 1829 0.35 1.69 0.15 153 ALL_TRUSTED 1828 22.12 1.69 25.14 154 MAILING_LIST_MULTI 1791 1.74 1.66 1.75 155 MIME_HTML_ONLY_MULTI 1704 5.34 1.58 5.90 156 RELAYCOUNTRY_KR 1669 0.22 1.54 0.02 157 TR_XM_DK_SendGrid 1661 2.45 1.54 2.59 158 RELAYCOUNTRY_HK 1642 0.22 1.52 0.03 159 HELO_NODOT 1613 1.19 1.49 1.14 160 HELO_NO_DOMAIN 1612 1.19 1.49 1.14 161 XMNoSubject 1573 0.24 1.45 0.06 162 MISSING_SUBJECT 1573 0.24 1.45 0.06 163 ANY_BOUNCE_MESSAGE 1565 15.00 1.45 17.00 164 BOUNCE_MESSAGE 1565 15.00 1.45 17.00 165 TM2_M_VERY_LONG_WORD 1560 0.92 1.44 0.85 166 MISSING_HEADERS 1533 0.89 1.42 0.81 167 XM_UB95 1528 0.20 1.41 0.02 168 BAYES_20 1462 4.83 1.35 5.34 169 URI_OPTOUT_3LD 1453 0.35 1.34 0.21 170 XM_BadFromFormat 1440 0.28 1.33 0.12 171 RELAYCOUNTRY_NL 1401 0.31 1.30 0.16 172 HK_RANDOM_REPLYTO 1396 0.36 1.29 0.22 173 XM_PDF 1387 3.10 1.28 3.37 174 T_XMHurry_00 1344 0.55 1.24 0.45 175 DKIM_ADSP_CUSTOM_MED 1319 0.85 1.22 0.79 176 T_XMDrugObfuBody_00 1309 2.70 1.21 2.92 177 T_FILL_THIS_FORM_SHORT 1297 0.71 1.20 0.64 178 RDNS_DYNAMIC 1283 0.37 1.19 0.24 179 XMSubNoVowel 1259 2.89 1.16 3.14 180 XM_E_Blogspot 1230 1.11 1.14 1.11 181 XMBody_78 1229 0.47 1.14 0.37 182 RELAYCOUNTRY_RU 1221 0.18 1.13 0.04 183 TR_Mismatch_TLD_02 1219 0.22 1.13 0.08 184 XMLngstWrd_00 1207 0.49 1.12 0.40 185 MPART_ALT_DIFF_COUNT 1190 0.37 1.10 0.26 186 TM2_M_A_HREF_HREF 1174 0.37 1.09 0.27 187 NML_ADSP_CUSTOM_MED 1172 0.62 1.08 0.55 188 HTML_TAG_BALANCE_CENTER 1150 0.20 1.06 0.07 189 XMPhish14 1139 0.43 1.05 0.34 190 TR_MetaPhish_Combo_01 1138 0.71 1.05 0.66 191 URI_PHP_REDIR 1131 0.16 1.05 0.03 192 TR_Mismatch_TLD_01 1122 0.37 1.04 0.27 193 XM_HighProb1 1121 0.18 1.04 0.05 194 XMHTML_After_End 1119 0.76 1.03 0.72 195 MIME_CHARSET_FARAWAY 1114 0.19 1.03 0.07 196 FORGED_GMAIL_RCVD 1103 0.45 1.02 0.36 197 XM_H_Long_From02 1096 0.91 1.01 0.90 198 XMMoneyMeta_00 1088 0.58 1.01 0.52 199 XMBdyGiftCard01 1040 0.79 0.96 0.76 200 XMReplyNow 1040 0.21 0.96 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 717956 98.04 95.72 98.39 2 HTML_MESSAGE 568374 79.94 93.74 77.89 3 RELAYCOUNTRY_US 522604 70.99 66.74 71.62 4 XM_B_Unicode 450611 62.25 65.61 61.75 5 DKIM_SIGNED 435617 60.00 62.02 59.70 6 XM_DK_Pass 428614 58.82 59.37 58.74 7 DKIM_VALID 402337 54.20 47.89 55.14 8 BAYES_50 314846 41.78 32.59 43.15 9 DKIM_VALID_AU 304052 40.61 33.50 41.67 10 XMListUnsubscribeExists 288413 40.97 50.73 39.52 11 XM_B_Unicode3 267767 36.12 32.24 36.69 12 ALL_TRUSTED 183469 22.12 1.69 25.14 13 BAYES_00 171392 20.56 0.81 23.49 14 T_TM2_M_HEADER_IN_MSG 169824 22.60 18.02 23.27 15 DKIM_VALID_EF 162300 22.10 21.15 22.24 16 HTML_FONT_LOW_CONTRAST 152165 20.82 20.63 20.85 17 RCVD_IN_MSPIKE_WL 149599 18.88 7.93 20.50 18 MIME_HTML_ONLY 143361 22.91 44.97 19.65 19 LOC_TINY_FONT_1 135186 19.23 24.02 18.53 20 RCVD_IN_MSPIKE_H2 135157 21.22 39.45 18.52 21 XMSubLong 133448 18.98 23.68 18.29 22 FVGT_m_MULTI_ODD 124631 17.99 24.12 17.08 23 ANY_BOUNCE_MESSAGE 124088 15.00 1.45 17.00 24 BOUNCE_MESSAGE 124085 15.00 1.45 17.00 25 XM_Multi_Part_URI 122057 16.98 18.70 16.73 26 TM2_M_URI_OPT_OUT 121038 14.83 3.01 16.59 27 T_KAM_HTML_FONT_INVALID 101382 14.32 17.23 13.89 28 XM_Body_Dirty_Words 84407 13.02 22.81 11.57 29 RCVD_IN_MSPIKE_H3 84112 10.66 4.79 11.53 30 HTML_IMAGE_RATIO_04 80969 10.18 4.02 11.10 31 XM_B_Unsub 75164 11.27 17.78 10.30 32 XM_H_Trusted_IP 69813 8.33 0.00 9.57 33 XM_DK_Undo_02 66955 13.41 41.95 9.18 34 HTML_FONT_FACE_BAD 66756 8.04 0.59 9.15 35 XMStrtUSub 60521 7.65 3.29 8.29 36 XM_Evil_Numbers_Gen 57071 7.95 8.81 7.82 37 RCVD_IN_MSPIKE_H4 56658 7.13 2.85 7.76 38 MPART_ALT_DIFF 54569 7.18 5.17 7.48 39 LotsOfNums_01 50159 7.07 8.41 6.87 40 IN_ZIMBRA_NJ_WHITELIST 49468 5.91 0.04 6.78 41 TooManyTo_001 47972 6.43 5.42 6.57 42 TR_XM_DK_Bayes 46031 5.55 0.46 6.31 43 LOTS_OF_MONEY 45386 6.95 11.85 6.22 44 BAYES_05 43628 5.30 0.70 5.98 45 MIME_HTML_ONLY_MULTI 43072 5.34 1.58 5.90 46 TR_XM_DK_Bayes1 42805 5.14 0.22 5.87 47 XM_B_Phish_Phrases 42425 6.33 9.82 5.81 48 BAYES_99 41880 10.75 44.54 5.74 49 BAYES_60 40023 5.53 5.86 5.48 50 RCVD_IN_RP_SAFE 39835 4.80 0.35 5.46 51 BAYES_20 38977 4.83 1.35 5.34 52 UNPARSEABLE_RELAY 38587 5.24 4.89 5.29 53 XM_DKIMWhitelistDomains 37668 4.50 0.04 5.16 54 TR_XM_DK_Bayes2 36948 4.43 0.19 5.06 55 RCVD_IN_RP_CERTIFIED 36858 4.43 0.24 5.05 56 BAYES_40 36518 4.66 2.31 5.00 57 HTML_IMAGE_RATIO_02 36043 6.85 19.71 4.94 58 XM_SendGrid 34627 4.65 3.97 4.75 59 DKIM_INVALID 33280 5.80 14.13 4.56 60 BAYES_999 32537 8.43 35.24 4.46 61 MIME_QP_LONG_LINE 32085 4.18 2.70 4.40 62 BOTNET_IPINHOSTNAME 31652 5.84 15.99 4.34 63 RELAYCOUNTRY_META 31529 8.02 32.95 4.32 64 XM_B_Unsub2 31247 4.04 2.42 4.28 65 XM_H_Long_From01 31157 4.45 5.68 4.27 66 HTML_IMAGE_RATIO_06 29993 3.88 2.31 4.11 67 RCVD_IN_IADB_LISTED 28923 3.55 0.79 3.96 68 XMSexyCombo_05 26885 5.07 14.42 3.68 69 BAYES_80 26484 4.09 7.18 3.63 70 RCVD_IN_IADB_SPF 25441 3.13 0.71 3.49 71 T_TooManySym_01 25324 3.26 1.86 3.47 72 XM_PDF 24624 3.10 1.28 3.37 73 XMSubNoVowel 22931 2.89 1.16 3.14 74 RCVD_IN_IADB_SENDERID 22646 2.79 0.70 3.10 75 RCVD_IN_IADB_DK 22354 2.76 0.70 3.06 76 T_XMDrugObfuBody_00 21329 2.70 1.21 2.92 77 XMSubMetaSx_00 21280 4.05 11.73 2.92 78 BOTNET 21026 7.77 40.72 2.88 79 NO_DNS_FOR_FROM 20155 3.94 11.86 2.76 80 T_REMOTE_IMAGE 19627 2.68 2.61 2.69 81 TR_XM_DK_SendGrid 18903 2.45 1.54 2.59 82 TR_XM_PhishingBody 18375 3.14 7.30 2.52 83 XMNumbers 17929 2.85 5.53 2.46 84 XM_UncommonTLD01 17053 3.76 13.34 2.34 85 RCVD_IN_IADB_VOUCHED 16932 2.04 0.18 2.32 86 BAYES_95 15970 2.51 4.65 2.19 87 FROM_EXCESS_BASE64 15292 4.56 21.16 2.10 88 HTML_MIME_NO_HTML_TAG 15174 5.00 24.67 2.08 89 MIME_HTML_MOSTLY 15129 2.25 3.40 2.07 90 MAILING_LIST_MULTI 12763 1.74 1.66 1.75 91 HTML_IMAGE_RATIO_08 12614 1.77 2.07 1.73 92 T_TooManySym_02 12187 1.53 0.56 1.67 93 UNTRUSTED_Relay 11766 4.40 23.20 1.61 94 TR_Symld_Words 11577 1.60 1.69 1.59 95 XM_CamelCaseFrm001 11219 1.65 2.37 1.54 96 XMDiploma_00 11134 1.66 2.59 1.53 97 TooManyTo_002 11010 1.41 0.70 1.51 98 RELAYCOUNTRY_CA 10937 2.17 6.72 1.50 99 XM_B_Phish66 10836 1.92 4.87 1.48 100 KHOP_HELO_FCRDNS 10500 2.10 6.59 1.44 101 RCVD_IN_IADB_OPTIN 10499 1.28 0.19 1.44 102 XM_B_COVIDMETA 10403 1.94 5.45 1.43 103 XM_SPF_SoftFail 9461 1.75 4.79 1.30 104 XM_B_SpammyTLD 9204 1.61 3.96 1.26 105 T_XMDrugObfuBody_14 9172 1.33 1.81 1.26 106 URI_HEX 9115 1.32 1.77 1.25 107 TVD_RCVD_IP 8977 1.13 0.43 1.23 108 T_XMDrugObfuBody_08 8945 1.43 2.84 1.23 109 RCVD_IN_MSPIKE_H5 8829 1.09 0.29 1.21 110 SUBJ_ALL_CAPS 8811 1.30 1.91 1.21 111 XM_DK_Undo_01 8576 1.31 2.21 1.18 112 HELO_NODOT 8351 1.19 1.49 1.14 113 HELO_NO_DOMAIN 8349 1.19 1.49 1.14 114 XMSubGarbage 8087 0.97 0.03 1.11 115 XM_E_Blogspot 8085 1.11 1.14 1.11 116 XMSubLongNoVowel 8010 1.00 0.31 1.10 117 IN_HORDE_ADDRESS_BOOK 7655 0.92 0.04 1.05 118 RCVD_IN_BL_SPAMCOP_NET 7555 3.77 22.20 1.04 119 HELO_MISC_IP 7509 0.97 0.54 1.03 120 CK_HELO_DYNAMIC_SPLIT_IP 7500 0.95 0.41 1.03 121 INVALID_MSGID 7378 0.91 0.20 1.01 122 TooManyTo_003 7250 0.93 0.52 0.99 123 XM_GoogleGroups 6984 0.88 0.40 0.96 124 XMStockSpam_06 6960 1.10 2.09 0.95 125 URI_TRY_3LD 6877 1.05 1.79 0.94 126 TO_MALFORMED 6672 0.80 0.03 0.91 127 XM_ProductURIs 6573 0.85 0.54 0.90 128 XM_H_Long_From02 6566 0.91 1.01 0.90 129 XM_OfRef6 6524 1.13 2.73 0.89 130 XMGappySubj_01 6345 0.78 0.17 0.87 131 XM_UB50 6291 1.67 7.15 0.86 132 XMCapTrack 6267 0.82 0.58 0.86 133 TM2_M_VERY_LONG_WORD 6168 0.92 1.44 0.85 134 XMGenDplmaNmb 6060 0.94 1.70 0.83 135 MISSING_HEADERS 5906 0.89 1.42 0.81 136 RELAYCOUNTRY_GB 5853 1.02 2.47 0.80 137 DKIM_ADSP_CUSTOM_MED 5796 0.85 1.22 0.79 138 T_OBFU_PDF_ATTACH 5743 0.71 0.22 0.79 139 XMBdyGiftCard01 5547 0.79 0.96 0.76 140 USER_IN_DEF_DKIM_WL 5427 0.65 0.00 0.74 141 TooManyTo_004 5366 0.70 0.44 0.74 142 XMHTML_After_End 5227 0.76 1.03 0.72 143 T_TooManySym_03 4865 0.60 0.15 0.67 144 TR_MetaPhish_Combo_01 4789 0.71 1.05 0.66 145 T_FILL_THIS_FORM_SHORT 4692 0.71 1.20 0.64 146 XMBrknScrpt_02 4645 0.79 1.82 0.64 147 SpammyFromTLD_01 4644 1.08 4.08 0.64 148 FROM_GOV_DKIM_AU 4420 0.55 0.21 0.61 149 XMBody_17 4366 0.85 2.54 0.60 150 RCVD_IN_MSPIKE_BL 4356 1.54 7.92 0.60 151 TooManyTo_005 4297 0.56 0.38 0.59 152 TR_MSPIKEBAYES00 4110 0.49 0.00 0.56 153 HTTPS_HTTP_MISMATCH 4035 0.58 0.78 0.55 154 NML_ADSP_CUSTOM_MED 4034 0.62 1.08 0.55 155 TR_LOTS_OF_MONEY3 3937 0.78 2.37 0.54 156 TR_XM_COVIDMETA4 3844 1.02 4.34 0.53 157 REPLYTO_WITHOUT_TO_CC 3839 0.55 0.71 0.53 158 DKIM_ADSP_NXDOMAIN 3776 0.87 3.28 0.52 159 XMMoneyMeta_00 3773 0.58 1.01 0.52 160 TR_BOTNET_NEGATE 3716 0.54 0.72 0.51 161 XMSolicitRefs_0 3568 0.46 0.27 0.49 162 XMSubMetaI_00 3544 0.53 0.81 0.49 163 XM_RXBody 3328 0.45 0.41 0.46 164 XM_DIRTYINTL 3303 1.21 6.31 0.45 165 XM_SPF_Unknown 3292 0.49 0.77 0.45 166 XMNoVowels 3287 0.47 0.62 0.45 167 T_XMHurry_00 3250 0.55 1.24 0.45 168 XMBody_95 3167 0.39 0.13 0.43 169 NUMERIC_HTTP_ADDR 3116 0.43 0.44 0.43 170 XMSexyCombo_01 3102 1.41 8.04 0.43 171 T_Symld_Words_02 3049 0.43 0.50 0.42 172 XM_H_PHPMailer 2993 0.47 0.89 0.41 173 XM_B_REG_HTML 2947 0.38 0.20 0.40 174 XM_ShortIntro_01 2905 0.44 0.75 0.40 175 XMLngstWrd_00 2895 0.49 1.12 0.40 176 HTML_IMAGE_ONLY_20 2833 0.44 0.82 0.39 177 XMPhish30 2812 0.44 0.82 0.39 178 TR_XM_PHPDW 2770 0.63 2.32 0.38 179 FROM_GOV_SPOOF 2728 0.36 0.26 0.37 180 XMBody_78 2721 0.47 1.14 0.37 181 XM_B_COPY_HTML 2676 0.37 0.39 0.37 182 TR_XM_FormFill2 2647 0.61 2.26 0.36 183 TR_XM_PHPForged 2643 0.61 2.28 0.36 184 FORGED_GMAIL_RCVD 2630 0.45 1.02 0.36 185 T_TooManySym_04 2623 0.32 0.07 0.36 186 XM_H_PHPOS 2608 0.60 2.26 0.36 187 XMLngstWrd_01 2600 0.43 0.90 0.36 188 RCVD_IN_MSPIKE_L3 2596 0.85 4.16 0.36 189 TR_XM_COVIDMETA1 2503 0.57 2.11 0.34 190 XMPhish14 2481 0.43 1.05 0.34 191 LOW_PRICE 2449 0.40 0.80 0.34 192 URI_NOVOWEL 2407 0.66 2.85 0.33 193 XMSubMetaSxObfu_03 2395 0.40 0.89 0.33 194 RCVD_IN_SORBS_DUL 2371 0.33 0.34 0.32 195 TM2_M_BODY_EMPTY 2329 0.34 0.50 0.32 196 SHORT_HELO_AND_INLINE_IMAGE 2326 0.29 0.09 0.32 197 PLING_QUERY 2323 0.31 0.28 0.32 198 RELAYCOUNTRY_DE 2298 0.61 2.57 0.31 199 XMHTMLBadTable_001 2286 0.31 0.33 0.31 200 XM_S_SubURI 2249 0.28 0.06 0.31 ----------------------------------------------------------------------