Email: 702746 Autolearn: 0 AvgScore: 0.15 AvgScanTime: 1.95 sec Spam: 99519 Autolearn: 0 AvgScore: 13.44 AvgScanTime: 4.11 sec Ham: 603227 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.60 sec Time Spent Running SA: 381.43 hours Time Spent Processing Spam: 113.62 hours Time Spent Processing Ham: 267.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 95804 97.89 96.27 98.16 2 HTML_MESSAGE 92237 87.34 92.68 86.45 3 RELAYCOUNTRY_US 69654 78.88 69.99 80.34 4 XM_B_Unicode 69158 68.78 69.49 68.67 5 DKIM_SIGNED 66796 72.49 67.12 73.37 6 XM_DK_Pass 64810 71.29 65.12 72.31 7 XMListUnsubscribeExists 55419 50.92 55.69 50.14 8 DKIM_VALID 51689 65.62 51.94 67.87 9 XM_DK_Undo_02 46094 16.70 46.32 11.82 10 MIME_HTML_ONLY 40501 23.12 40.70 20.23 11 DKIM_VALID_AU 37160 49.82 37.34 51.88 12 BAYES_50 35934 48.42 36.11 50.45 13 RCVD_IN_MSPIKE_H2 35792 25.32 35.96 23.56 14 XM_B_Unicode3 35300 40.22 35.47 41.00 15 BAYES_99 33237 11.25 33.40 7.59 16 BOTNET 32877 7.63 33.04 3.44 17 RELAYCOUNTRY_META 29636 9.23 29.78 5.85 18 LOC_TINY_FONT_1 28530 23.65 28.67 22.83 19 BAYES_999 25235 8.75 25.36 6.01 20 HTML_FONT_LOW_CONTRAST 24906 26.07 25.03 26.24 21 FVGT_m_MULTI_ODD 23403 22.02 23.52 21.78 22 DKIM_VALID_EF 22347 26.08 22.46 26.68 23 XMSubLong 21354 21.21 21.46 21.17 24 UNTRUSTED_Relay 20184 5.09 20.28 2.58 25 T_KAM_HTML_FONT_INVALID 19873 17.73 19.97 17.36 26 RCVD_IN_BL_SPAMCOP_NET 19345 3.88 19.44 1.31 27 T_TM2_M_HEADER_IN_MSG 19069 26.66 19.16 27.90 28 XM_Body_Dirty_Words 18480 13.30 18.57 12.43 29 XM_Multi_Part_URI 17543 14.46 17.63 13.93 30 HTML_MIME_NO_HTML_TAG 17370 4.20 17.45 2.01 31 FROM_EXCESS_BASE64 17051 4.73 17.13 2.68 32 T_REMOTE_IMAGE 16453 5.19 16.53 3.32 33 BOTNET_IPINHOSTNAME 16438 6.79 16.52 5.19 34 RCVD_IN_PSBL 15897 2.46 15.97 0.24 35 BODY_URI_ONLY 15705 2.28 15.78 0.05 36 HTML_SHORT_LINK_IMG_1 15557 2.24 15.63 0.03 37 DKIM_INVALID 15107 6.87 15.18 5.50 38 XM_UncommonTLD01 14693 4.55 14.76 2.86 39 NO_DNS_FOR_FROM 13673 4.73 13.74 3.24 40 HTML_IMAGE_ONLY_12 13191 2.05 13.25 0.20 41 LOTS_OF_MONEY 13066 8.43 13.13 7.66 42 XM_B_Unsub 12675 12.16 12.74 12.06 43 HTML_IMAGE_RATIO_02 12277 7.11 12.34 6.24 44 XM_B_Phish_Phrases 10822 7.56 10.87 7.02 45 XMSexyCombo_05 10461 4.62 10.51 3.64 46 BAYES_80 10461 4.95 10.51 4.04 47 RCVD_IN_MSPIKE_BL 8977 1.92 9.02 0.75 48 BAYES_60 8733 6.54 8.78 6.17 49 XMOffer 8560 1.24 8.60 0.02 50 XM_Evil_Numbers_Gen 8248 8.07 8.29 8.03 51 BOTNET_NORDNS 8194 1.18 8.23 0.02 52 XM_UB50 8029 2.18 8.07 1.21 53 LotsOfNums_01 7819 8.26 7.86 8.33 54 TR_XM_PhishingBody 7593 3.91 7.63 3.30 55 RCVD_IN_MSPIKE_WL 7310 22.64 7.35 25.16 56 RELAYCOUNTRY_CA 7097 2.48 7.13 1.71 57 KHOP_HELO_FCRDNS 7027 2.43 7.06 1.66 58 XMSubMetaSx_00 6705 4.06 6.74 3.62 59 RCVD_IN_RP_RNBL 5954 0.91 5.98 0.08 60 MPART_ALT_DIFF 5905 5.36 5.93 5.26 61 XM_B_COVIDMETA 5648 2.47 5.68 1.95 62 TooManyTo_001 5540 7.36 5.57 7.66 63 BAYES_95 5357 2.91 5.38 2.50 64 UNPARSEABLE_RELAY 5233 6.59 5.26 6.81 65 SpammyFromTLD_01 5132 1.41 5.16 0.80 66 XMBdyGiftCard01 5117 1.57 5.14 0.98 67 HTML_IMAGE_RATIO_04 5003 5.60 5.03 5.69 68 XM_H_Long_From01 4943 5.04 4.97 5.05 69 XM_SPF_SoftFail 4933 2.00 4.96 1.51 70 XM_B_Phish66 4914 2.28 4.94 1.84 71 XMStrtUSub 4647 4.55 4.67 4.54 72 XMSubGiftCard1 4557 0.76 4.58 0.13 73 XMBody_17 4524 1.47 4.55 0.96 74 XMSubGiftCard2 4490 0.73 4.51 0.10 75 FROM_SUSPICIOUS_NTLD 4423 0.66 4.44 0.03 76 FROM_SUSPICIOUS_NTLD_FP 4319 0.64 4.34 0.03 77 TR_XM_INV_DKIM 4307 0.78 4.33 0.20 78 RCVD_IN_MSPIKE_L3 4251 0.96 4.27 0.41 79 TR_XM_COVIDMETA4 4249 1.22 4.27 0.72 80 XM_SendGrid 4139 5.81 4.16 6.08 81 RCVD_IN_MSPIKE_L5 4097 0.84 4.12 0.30 82 XM_DIRTYINTL 3935 1.12 3.95 0.66 83 RCVD_IN_MSPIKE_H3 3913 13.14 3.93 14.65 84 SpammyFromTLD_02 3886 0.81 3.90 0.31 85 XM_B_SpammyTLD 3854 2.09 3.87 1.80 86 HK_RANDOM_FROM 3801 0.66 3.82 0.13 87 XMNumbers 3770 3.18 3.79 3.08 88 TR_XM_MaxWHORU 3644 0.58 3.66 0.07 89 MIME_HTML_MOSTLY 3586 2.34 3.60 2.13 90 XM_UB99 3498 0.50 3.51 0.01 91 RELAYCOUNTRY_DE 3390 0.83 3.41 0.41 92 XMBrknScrpt_02 3322 1.28 3.34 0.95 93 RCVD_IN_MSPIKE_H4 3277 8.27 3.29 9.10 94 DKIM_ADSP_NXDOMAIN 3262 0.84 3.28 0.44 95 TM2_M_URI_OPT_OUT 3249 7.36 3.26 8.04 96 T_XMDrugObfuBody_08 3114 1.93 3.13 1.73 97 XM_UB60 3034 0.55 3.05 0.14 98 TR_XM_UnparsRelay 3009 0.98 3.02 0.64 99 XM_OfRef6 2961 1.39 2.98 1.13 100 TR_XM_COVIDMETA1 2942 0.79 2.96 0.44 101 HDRS_MISSP 2924 0.47 2.94 0.07 102 HTML_IMAGE_RATIO_06 2899 3.60 2.91 3.71 103 MIME_QP_LONG_LINE 2839 4.94 2.85 5.28 104 URIBL_SBL_A 2836 0.56 2.85 0.18 105 FVGT_m_MULTI_ODD_EMAIL 2800 0.42 2.81 0.03 106 XM_UB80 2773 0.44 2.79 0.05 107 XM_URI_RBL 2745 0.57 2.76 0.21 108 XMSubNoVowel 2627 2.74 2.64 2.76 109 XMSexyCombo_01 2607 0.79 2.62 0.49 110 MIME_HEADER_CTYPE_ONLY 2556 0.43 2.57 0.08 111 T_XMDrugObfuBody_14 2514 1.66 2.53 1.52 112 HDRS_LCASE_IMGONLY 2470 0.37 2.48 0.02 113 URI_HEX 2451 1.92 2.46 1.83 114 HTML_IMAGE_RATIO_08 2447 2.28 2.46 2.25 115 SHORT_IMG_SUSP_NTLD 2442 0.35 2.45 0.00 116 XM_B_Unsub2 2409 3.89 2.42 4.14 117 LongTLD 2376 0.49 2.39 0.18 118 XM_CamelCaseFrm001 2376 2.03 2.39 1.98 119 XMDiploma_00 2322 2.05 2.33 2.01 120 BAYES_40 2253 4.06 2.26 4.36 121 TR_XM_PHPDW 2251 0.67 2.26 0.41 122 XM_UB999 2230 0.32 2.24 0.00 123 TR_XM_PHPForged 2228 0.64 2.24 0.38 124 TR_XM_FormFill2 2218 0.64 2.23 0.38 125 XM_H_PHPOS 2204 0.64 2.21 0.38 126 TM2_M_VERY_LONG_WORD 2184 1.25 2.19 1.10 127 PDS_OTHER_BAD_TLD 2127 0.57 2.14 0.31 128 TR_XM_MaxSPIKE 2127 0.35 2.14 0.05 129 RELAYCOUNTRY_FR 2109 0.52 2.12 0.25 130 TR_XM_RelayPhish 2079 0.46 2.09 0.19 131 T_TooManySym_01 2064 3.76 2.07 4.04 132 SUBJ_ALL_CAPS 2014 1.61 2.02 1.54 133 TR_XM_MaxBayes 2005 0.31 2.01 0.03 134 MIME_HTML_ONLY_MULTI 1963 3.31 1.97 3.53 135 RELAYCOUNTRY_JP 1955 0.31 1.96 0.04 136 DIET_1 1927 0.64 1.94 0.42 137 HTML_IMAGE_ONLY_08 1892 0.36 1.90 0.10 138 DATE_IN_PAST_03_06 1800 0.36 1.81 0.12 139 BAYES_20 1798 4.01 1.81 4.38 140 RELAYCOUNTRY_AU 1742 0.59 1.75 0.40 141 MPART_ALT_DIFF_COUNT 1740 0.62 1.75 0.44 142 TR_XM_DK_SendGrid 1694 3.16 1.70 3.40 143 XMHTML_After_End 1639 0.95 1.65 0.84 144 NUMERIC_HTTP_ADDR 1636 0.56 1.64 0.38 145 HK_RANDOM_REPLYTO 1576 0.43 1.58 0.24 146 TVD_SPACE_RATIO_MINFP 1566 0.23 1.57 0.01 147 FROM_LOCAL_NOVOWEL 1541 0.23 1.55 0.02 148 RELAYCOUNTRY_RU 1521 0.72 1.53 0.59 149 XMStockSpam_06 1509 1.03 1.52 0.95 150 XM_UB95 1502 0.23 1.51 0.02 151 ALL_TRUSTED 1501 13.22 1.51 15.15 152 RELAYCOUNTRY_NL 1479 0.42 1.49 0.24 153 T_XMDrugObfuBody_00 1413 0.76 1.42 0.65 154 TR_Symld_Words 1409 1.57 1.42 1.60 155 MAILING_LIST_MULTI 1401 2.25 1.41 2.39 156 DKIM_ADSP_CUSTOM_MED 1385 1.12 1.39 1.07 157 TR_Mismatch_TLD_02 1336 0.26 1.34 0.08 158 XMGenDplmaNmb 1327 1.22 1.33 1.20 159 MIME_CHARSET_FARAWAY 1325 0.30 1.33 0.13 160 T_XMHurry_00 1320 0.78 1.33 0.69 161 URI_TRY_3LD 1304 1.55 1.31 1.59 162 T_FILL_THIS_FORM_SHORT 1282 0.81 1.29 0.73 163 XM_PDF 1272 3.61 1.28 4.00 164 XM_DK_Undo_01 1262 1.70 1.27 1.77 165 XMSubEmpty 1223 0.36 1.23 0.22 166 TR_MetaPhish_Combo_01 1214 0.84 1.22 0.77 167 NML_ADSP_CUSTOM_MED 1192 0.86 1.20 0.80 168 TR_LOTS_OF_MONEY2 1187 0.45 1.19 0.33 169 T_MONEY_PERCENT 1187 0.45 1.19 0.33 170 CHARSET_FARAWAY_HEADER 1182 0.21 1.19 0.04 171 NORMAL_HTTP_TO_IP 1170 0.20 1.18 0.04 172 TR_Mismatch_TLD_01 1146 0.36 1.15 0.23 173 RELAYCOUNTRY_GB 1129 0.96 1.13 0.93 174 RELAYCOUNTRY_IN 1125 0.27 1.13 0.13 175 XM_JunkDunk 1113 0.16 1.12 0.00 176 LONG_JUNK_URI 1098 0.19 1.10 0.04 177 RELAYCOUNTRY_HK 1092 0.17 1.10 0.02 178 XMSexyCombo_04 1076 0.24 1.08 0.10 179 TR_LOTS_OF_MONEY3 1061 0.53 1.07 0.44 180 URI_NOVOWEL 1059 0.50 1.06 0.41 181 RDNS_DYNAMIC 1054 0.46 1.06 0.36 182 PDS_BTC_ID 1043 0.18 1.05 0.03 183 XMPhish14 1042 0.58 1.05 0.51 184 XMSubLongNoVowel 1028 0.17 1.03 0.02 185 FROM_NTLD_LINKBAIT 1020 0.15 1.02 0.00 186 FORGED_GMAIL_RCVD 1006 0.55 1.01 0.47 187 XM_H_MailChimp 1000 0.31 1.00 0.19 188 ONLINE_PHARMACY 998 0.19 1.00 0.05 189 HELO_NODOT 998 1.27 1.00 1.31 190 XMBody_78 998 0.46 1.00 0.38 191 HELO_NO_DOMAIN 998 1.27 1.00 1.31 192 TVD_VISIT_PHARMA 993 0.19 1.00 0.05 193 BAYES_00 977 13.01 0.98 14.99 194 HTML_TITLE_SUBJ_DIFF 977 0.17 0.98 0.03 195 INVESTMENT_ADVICE 968 0.26 0.97 0.14 196 HTML_FONT_TINY_NORDNS 955 0.53 0.96 0.46 197 URIBL_BLACK 948 0.16 0.95 0.03 198 XMPhish08 945 0.50 0.95 0.43 199 TVD_SPACE_RATIO 943 0.40 0.95 0.31 200 XMPhish30 937 0.58 0.94 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 592129 97.89 96.27 98.16 2 HTML_MESSAGE 521514 87.34 92.68 86.45 3 RELAYCOUNTRY_US 484638 78.88 69.99 80.34 4 DKIM_SIGNED 442617 72.49 67.12 73.37 5 XM_DK_Pass 436181 71.29 65.12 72.31 6 XM_B_Unicode 414209 68.78 69.49 68.67 7 DKIM_VALID 409433 65.62 51.94 67.87 8 DKIM_VALID_AU 312956 49.82 37.34 51.88 9 BAYES_50 304346 48.42 36.11 50.45 10 XMListUnsubscribeExists 302432 50.92 55.69 50.14 11 XM_B_Unicode3 247348 40.22 35.47 41.00 12 T_TM2_M_HEADER_IN_MSG 168275 26.66 19.16 27.90 13 DKIM_VALID_EF 160915 26.08 22.46 26.68 14 HTML_FONT_LOW_CONTRAST 158315 26.07 25.03 26.24 15 RCVD_IN_MSPIKE_WL 151797 22.64 7.35 25.16 16 RCVD_IN_MSPIKE_H2 142126 25.32 35.96 23.56 17 LOC_TINY_FONT_1 137699 23.65 28.67 22.83 18 FVGT_m_MULTI_ODD 131361 22.02 23.52 21.78 19 XMSubLong 127685 21.21 21.46 21.17 20 MIME_HTML_ONLY 122005 23.12 40.70 20.23 21 T_KAM_HTML_FONT_INVALID 104742 17.73 19.97 17.36 22 ALL_TRUSTED 91412 13.22 1.51 15.15 23 BAYES_00 90449 13.01 0.98 14.99 24 RCVD_IN_MSPIKE_H3 88394 13.14 3.93 14.65 25 XM_Multi_Part_URI 84058 14.46 17.63 13.93 26 XM_Body_Dirty_Words 75008 13.30 18.57 12.43 27 XM_B_Unsub 72778 12.16 12.74 12.06 28 XM_DK_Undo_02 71274 16.70 46.32 11.82 29 RCVD_IN_MSPIKE_H4 54869 8.27 3.29 9.10 30 LotsOfNums_01 50229 8.26 7.86 8.33 31 TM2_M_URI_OPT_OUT 48502 7.36 3.26 8.04 32 XM_Evil_Numbers_Gen 48466 8.07 8.29 8.03 33 TooManyTo_001 46199 7.36 5.57 7.66 34 LOTS_OF_MONEY 46183 8.43 13.13 7.66 35 TR_XM_DK_Bayes 46091 6.62 0.45 7.64 36 BAYES_99 45804 11.25 33.40 7.59 37 IN_ZIMBRA_NJ_WHITELIST 43405 6.18 0.05 7.20 38 TR_XM_DK_Bayes1 42603 6.09 0.22 7.06 39 XM_B_Phish_Phrases 42319 7.56 10.87 7.02 40 XM_DKIMWhitelistDomains 41599 5.92 0.01 6.90 41 ANY_BOUNCE_MESSAGE 41321 5.97 0.61 6.85 42 BOUNCE_MESSAGE 41290 5.96 0.60 6.84 43 UNPARSEABLE_RELAY 41106 6.59 5.26 6.81 44 RCVD_IN_RP_SAFE 40441 5.82 0.49 6.70 45 TR_XM_DK_Bayes2 37861 5.41 0.19 6.28 46 HTML_IMAGE_RATIO_02 37662 7.11 12.34 6.24 47 BAYES_60 37231 6.54 8.78 6.17 48 XM_SendGrid 36662 5.81 4.16 6.08 49 RCVD_IN_RP_CERTIFIED 36612 5.25 0.29 6.07 50 BAYES_999 36260 8.75 25.36 6.01 51 RELAYCOUNTRY_META 35262 9.23 29.78 5.85 52 HTML_IMAGE_RATIO_04 34337 5.60 5.03 5.69 53 DKIM_INVALID 33184 6.87 15.18 5.50 54 BAYES_05 32764 4.77 0.77 5.43 55 MIME_QP_LONG_LINE 31874 4.94 2.85 5.28 56 MPART_ALT_DIFF 31758 5.36 5.93 5.26 57 BOTNET_IPINHOSTNAME 31311 6.79 16.52 5.19 58 XM_H_Long_From01 30459 5.04 4.97 5.05 59 XM_H_Trusted_IP 30384 4.32 0.00 5.04 60 RCVD_IN_IADB_LISTED 27414 4.01 0.79 4.54 61 XMStrtUSub 27357 4.55 4.67 4.54 62 BAYES_20 26399 4.01 1.81 4.38 63 BAYES_40 26299 4.06 2.26 4.36 64 XM_B_Unsub2 24954 3.89 2.42 4.14 65 T_TooManySym_01 24376 3.76 2.07 4.04 66 BAYES_80 24359 4.95 10.51 4.04 67 XM_PDF 24122 3.61 1.28 4.00 68 RCVD_IN_IADB_SPF 23864 3.50 0.70 3.96 69 HTML_IMAGE_RATIO_06 22394 3.60 2.91 3.71 70 XMSexyCombo_05 21979 4.62 10.51 3.64 71 XMSubMetaSx_00 21818 4.06 6.74 3.62 72 RCVD_IN_IADB_SENDERID 21300 3.13 0.68 3.53 73 MIME_HTML_ONLY_MULTI 21275 3.31 1.97 3.53 74 BOTNET 20765 7.63 33.04 3.44 75 RCVD_IN_IADB_DK 20734 3.05 0.68 3.44 76 TR_XM_DK_SendGrid 20495 3.16 1.70 3.40 77 T_REMOTE_IMAGE 20002 5.19 16.53 3.32 78 TR_XM_PhishingBody 19889 3.91 7.63 3.30 79 NO_DNS_FOR_FROM 19574 4.73 13.74 3.24 80 XMNumbers 18570 3.18 3.79 3.08 81 XM_UncommonTLD01 17254 4.55 14.76 2.86 82 RCVD_IN_IADB_VOUCHED 16684 2.41 0.26 2.77 83 XMSubNoVowel 16656 2.74 2.64 2.76 84 FROM_EXCESS_BASE64 16181 4.73 17.13 2.68 85 UNTRUSTED_Relay 15560 5.09 20.28 2.58 86 BAYES_95 15087 2.91 5.38 2.50 87 MAILING_LIST_MULTI 14398 2.25 1.41 2.39 88 HTML_IMAGE_RATIO_08 13572 2.28 2.46 2.25 89 MIME_HTML_MOSTLY 12855 2.34 3.60 2.13 90 T_TooManySym_02 12465 1.88 0.77 2.07 91 HTML_MIME_NO_HTML_TAG 12133 4.20 17.45 2.01 92 XMDiploma_00 12114 2.05 2.33 2.01 93 XM_CamelCaseFrm001 11920 2.03 2.39 1.98 94 XM_B_COVIDMETA 11733 2.47 5.68 1.95 95 XM_B_Phish66 11108 2.28 4.94 1.84 96 URI_HEX 11065 1.92 2.46 1.83 97 TooManyTo_002 10939 1.67 0.79 1.81 98 RCVD_IN_IADB_OPTIN 10882 1.59 0.27 1.80 99 XM_B_SpammyTLD 10851 2.09 3.87 1.80 100 XM_DK_Undo_01 10706 1.70 1.27 1.77 101 T_XMDrugObfuBody_08 10443 1.93 3.13 1.73 102 RELAYCOUNTRY_CA 10320 2.48 7.13 1.71 103 KHOP_HELO_FCRDNS 10021 2.43 7.06 1.66 104 TR_Symld_Words 9642 1.57 1.42 1.60 105 URI_TRY_3LD 9577 1.55 1.31 1.59 106 SUBJ_ALL_CAPS 9297 1.61 2.02 1.54 107 T_XMDrugObfuBody_14 9169 1.66 2.53 1.52 108 XM_SPF_SoftFail 9097 2.00 4.96 1.51 109 TVD_RCVD_IP 9043 1.36 0.50 1.50 110 XM_GoogleGroups 8673 1.30 0.48 1.44 111 RCVD_IN_MSPIKE_H5 8534 1.23 0.12 1.41 112 HTML_FONT_FACE_BAD 8163 1.26 0.67 1.35 113 RCVD_IN_BL_SPAMCOP_NET 7925 3.88 19.44 1.31 114 HELO_NODOT 7909 1.27 1.00 1.31 115 HELO_NO_DOMAIN 7907 1.27 1.00 1.31 116 IN_HORDE_ADDRESS_BOOK 7684 1.12 0.18 1.27 117 HELO_MISC_IP 7639 1.16 0.53 1.27 118 CK_HELO_DYNAMIC_SPLIT_IP 7632 1.17 0.56 1.27 119 XM_UB50 7282 2.18 8.07 1.21 120 INVALID_MSGID 7279 1.10 0.48 1.21 121 XMGenDplmaNmb 7265 1.22 1.33 1.20 122 TooManyTo_003 7233 1.11 0.55 1.20 123 XM_H_Long_From02 7225 1.13 0.74 1.20 124 XM_OfRef6 6841 1.39 2.98 1.13 125 USER_IN_DEF_DKIM_WL 6825 0.97 0.01 1.13 126 TM2_M_VERY_LONG_WORD 6628 1.25 2.19 1.10 127 TO_MALFORMED 6503 0.93 0.05 1.08 128 DKIM_ADSP_CUSTOM_MED 6453 1.12 1.39 1.07 129 XMGappySubj_01 6260 0.91 0.14 1.04 130 XMBdyGiftCard01 5932 1.57 5.14 0.98 131 XMCapTrack 5927 0.92 0.56 0.98 132 XMBody_17 5810 1.47 4.55 0.96 133 XMStockSpam_06 5745 1.03 1.52 0.95 134 XMBrknScrpt_02 5708 1.28 3.34 0.95 135 XM_ProductURIs 5697 0.92 0.78 0.94 136 RELAYCOUNTRY_GB 5615 0.96 1.13 0.93 137 TooManyTo_004 5355 0.83 0.47 0.89 138 XMHTML_After_End 5059 0.95 1.65 0.84 139 T_TooManySym_03 5037 0.75 0.20 0.84 140 XMSubMetaI_00 4980 0.84 0.89 0.83 141 NML_ADSP_CUSTOM_MED 4840 0.86 1.20 0.80 142 SpammyFromTLD_01 4810 1.41 5.16 0.80 143 TR_MetaPhish_Combo_01 4658 0.84 1.22 0.77 144 RCVD_IN_MSPIKE_BL 4527 1.92 9.02 0.75 145 TooManyTo_005 4471 0.69 0.39 0.74 146 T_FILL_THIS_FORM_SHORT 4398 0.81 1.29 0.73 147 TR_MSPIKEBAYES00 4371 0.62 0.01 0.72 148 TR_XM_COVIDMETA4 4355 1.22 4.27 0.72 149 XMBody_95 4337 0.64 0.13 0.72 150 T_XMHurry_00 4187 0.78 1.33 0.69 151 TR_BOTNET_NEGATE 3988 0.63 0.44 0.66 152 XM_DIRTYINTL 3967 1.12 3.95 0.66 153 T_XMDrugObfuBody_00 3901 0.76 1.42 0.65 154 TR_XM_UnparsRelay 3868 0.98 3.02 0.64 155 HTTPS_HTTP_MISMATCH 3781 0.64 0.74 0.63 156 T_OBFU_PDF_ATTACH 3680 0.55 0.21 0.61 157 XMMoneyMeta_00 3602 0.63 0.82 0.60 158 RELAYCOUNTRY_RU 3542 0.72 1.53 0.59 159 T_Symld_Words_02 3478 0.61 0.82 0.58 160 XM_SPF_Unknown 3258 0.59 0.89 0.54 161 XMPhish30 3165 0.58 0.94 0.52 162 XMPhish14 3056 0.58 1.05 0.51 163 XM_ShortIntro_01 3014 0.53 0.73 0.50 164 XMSexyCombo_01 2961 0.79 2.62 0.49 165 XM_H_PHPMailer 2919 0.55 0.93 0.48 166 HTML_TAG_BALANCE_BODY 2896 0.53 0.81 0.48 167 FROM_GOV_DKIM_AU 2875 0.41 0.03 0.48 168 FORGED_GMAIL_RCVD 2855 0.55 1.01 0.47 169 HTML_FONT_TINY_NORDNS 2761 0.53 0.96 0.46 170 XM_B_COPY_HTML 2756 0.44 0.34 0.46 171 HTML_IMAGE_ONLY_20 2668 0.43 0.37 0.44 172 TM2_M_BODY_EMPTY 2653 0.42 0.33 0.44 173 DKIM_ADSP_NXDOMAIN 2652 0.84 3.28 0.44 174 MPART_ALT_DIFF_COUNT 2649 0.62 1.75 0.44 175 TR_XM_COVIDMETA1 2644 0.79 2.96 0.44 176 TR_LOTS_OF_MONEY3 2642 0.53 1.07 0.44 177 XMNoVowels 2628 0.43 0.43 0.44 178 T_TooManySym_04 2627 0.39 0.10 0.44 179 XMPhish08 2594 0.50 0.95 0.43 180 XMHTMLBadTable_001 2576 0.45 0.59 0.43 181 DIET_1 2543 0.64 1.94 0.42 182 HTML_IMAGE_ONLY_32 2531 0.40 0.25 0.42 183 HTML_IMAGE_ONLY_28 2525 0.42 0.43 0.42 184 RCVD_IN_MSPIKE_L3 2481 0.96 4.27 0.41 185 URI_NOVOWEL 2468 0.50 1.06 0.41 186 TR_XM_PHPDW 2456 0.67 2.26 0.41 187 PLING_QUERY 2454 0.45 0.73 0.41 188 RELAYCOUNTRY_DE 2445 0.83 3.41 0.41 189 RELAYCOUNTRY_AU 2395 0.59 1.75 0.40 190 XMSolicitRefs_0 2372 0.37 0.23 0.39 191 XM_B_REG_HTML 2353 0.36 0.21 0.39 192 XM_Body_Obfu01 2350 0.44 0.73 0.39 193 MISSING_HEADERS 2324 0.44 0.76 0.39 194 TR_XM_FormFill2 2300 0.64 2.23 0.38 195 TR_XM_PHPForged 2299 0.64 2.24 0.38 196 RCVD_IN_SORBS_DUL 2292 0.37 0.31 0.38 197 XM_H_PHPOS 2272 0.64 2.21 0.38 198 NUMERIC_HTTP_ADDR 2270 0.56 1.64 0.38 199 XMBody_78 2264 0.46 1.00 0.38 200 XM_S_SubURI 2236 0.32 0.04 0.37 ----------------------------------------------------------------------