Email: 642833 Autolearn: 0 AvgScore: 0.17 AvgScanTime: 1.79 sec Spam: 81854 Autolearn: 0 AvgScore: 11.94 AvgScanTime: 3.76 sec Ham: 560979 Autolearn: 0 AvgScore: -1.55 AvgScanTime: 1.50 sec Time Spent Running SA: 318.80 hours Time Spent Processing Spam: 85.50 hours Time Spent Processing Ham: 233.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 79818 98.18 97.51 98.27 2 HTML_MESSAGE 75874 84.79 92.69 83.63 3 DKIM_SIGNED 65420 72.01 79.92 70.86 4 XM_DK_Pass 63451 70.60 77.52 69.59 5 XM_B_Unicode 62759 67.87 76.67 66.59 6 RELAYCOUNTRY_US 60066 75.88 73.38 76.25 7 XMListUnsubscribeExists 54220 51.57 66.24 49.43 8 DKIM_VALID 52570 65.60 64.22 65.80 9 XM_DK_Undo_02 43846 17.80 53.57 12.58 10 DKIM_VALID_AU 37082 49.36 45.30 49.95 11 XM_B_Unicode3 33573 40.19 41.02 40.07 12 BAYES_99 33073 12.63 40.40 8.58 13 BAYES_50 29651 46.95 36.22 48.51 14 MIME_HTML_ONLY 27825 22.84 33.99 21.21 15 RCVD_IN_MSPIKE_H2 26855 24.15 32.81 22.88 16 BAYES_999 26636 10.23 32.54 6.97 17 LOC_TINY_FONT_1 25667 24.76 31.36 23.80 18 FVGT_m_MULTI_ODD 24625 22.14 30.08 20.98 19 DKIM_VALID_EF 23948 25.30 29.26 24.73 20 HTML_FONT_LOW_CONTRAST 21669 26.64 26.47 26.66 21 BOTNET 21536 5.98 26.31 3.02 22 RELAYCOUNTRY_META 20807 9.05 25.42 6.66 23 T_TM2_M_HEADER_IN_MSG 20701 27.00 25.29 27.25 24 XMSubLong 19798 19.99 24.19 19.38 25 XM_Body_Dirty_Words 16942 14.76 20.70 13.90 26 T_KAM_HTML_FONT_INVALID 16858 17.36 20.60 16.89 27 XM_Multi_Part_URI 16630 16.20 20.32 15.60 28 UNTRUSTED_Relay 13436 5.27 16.41 3.64 29 BOTNET_IPINHOSTNAME 13062 6.57 15.96 5.20 30 DKIM_INVALID 12850 6.41 15.70 5.06 31 LOTS_OF_MONEY 12145 9.48 14.84 8.70 32 XM_B_Phish_Phrases 11738 8.93 14.34 8.14 33 XM_UncommonTLD01 11006 4.12 13.45 2.76 34 XMSexyCombo_05 10831 5.77 13.23 4.68 35 NO_DNS_FOR_FROM 10709 3.98 13.08 2.65 36 LotsOfNums_01 9871 8.52 12.06 8.00 37 XM_B_Unsub 9682 10.66 11.83 10.49 38 TR_XM_PhishingBody 8606 3.94 10.51 2.99 39 RCVD_IN_MSPIKE_BL 8046 1.86 9.83 0.69 40 RCVD_IN_BL_SPAMCOP_NET 7912 2.52 9.67 1.48 41 XM_Evil_Numbers_Gen 7655 8.40 9.35 8.27 42 RCVD_IN_MSPIKE_WL 7123 22.61 8.70 24.64 43 HTML_IMAGE_RATIO_02 6831 7.07 8.35 6.89 44 XM_B_Phish66 6770 2.45 8.27 1.60 45 RELAYCOUNTRY_CA 6722 2.63 8.21 1.82 46 UNPARSEABLE_RELAY 6388 7.27 7.80 7.19 47 MPART_ALT_DIFF 6183 6.25 7.55 6.06 48 BAYES_80 6102 4.52 7.45 4.09 49 HTML_MIME_NO_HTML_TAG 6072 3.26 7.42 2.66 50 XM_SPF_SoftFail 5947 2.29 7.27 1.56 51 XMSubMetaSx_00 5917 4.50 7.23 4.10 52 TooManyTo_001 5523 7.53 6.75 7.64 53 XM_B_COVIDMETA 5508 2.73 6.73 2.15 54 RCVD_IN_RP_RNBL 5047 0.87 6.17 0.10 55 TR_XM_COVIDMETA4 4816 1.41 5.88 0.76 56 XM_SendGrid 4772 6.25 5.83 6.31 57 XM_H_Long_From01 4765 5.70 5.82 5.68 58 SpammyFromTLD_01 4730 1.40 5.78 0.76 59 BAYES_60 4529 5.79 5.53 5.82 60 RCVD_IN_MSPIKE_H3 4340 13.30 5.30 14.47 61 HTML_IMAGE_RATIO_04 4240 6.17 5.18 6.31 62 RCVD_IN_MSPIKE_L5 4210 0.87 5.14 0.24 63 XM_UB50 4208 1.81 5.14 1.33 64 XM_UB99 4040 0.64 4.94 0.01 65 XM_DK_Undo_01 4033 1.95 4.93 1.52 66 TR_XM_INV_DKIM 4015 0.84 4.91 0.25 67 TR_XM_UnparsRelay 3964 1.10 4.84 0.55 68 XMSubEmpty 3744 0.76 4.57 0.20 69 BOTNET_NORDNS 3736 0.60 4.56 0.02 70 RCVD_IN_PSBL 3674 0.68 4.49 0.12 71 TR_Sbj_FN_Bdy 3616 0.73 4.42 0.20 72 T_XMDrugObfuBody_08 3594 1.88 4.39 1.52 73 XM_DIRTYINTL 3536 1.02 4.32 0.53 74 XMNumbers 3387 3.64 4.14 3.56 75 MIME_HTML_MOSTLY 3363 2.77 4.11 2.57 76 URIBL_SBL_A 3353 0.69 4.10 0.20 77 MISSING_SUBJECT 3307 0.57 4.04 0.07 78 XMNoSubject 3307 0.57 4.04 0.07 79 RCVD_IN_MSPIKE_L3 3300 0.85 4.03 0.39 80 XMLngstWrd_00 3289 0.88 4.02 0.42 81 XMDiploma_00 3250 1.90 3.97 1.60 82 BAYES_95 3244 2.73 3.96 2.55 83 XM_UB999 3220 0.51 3.93 0.01 84 XMStrtUSub 3196 3.60 3.90 3.56 85 TR_XM_MaxWHORU 3023 0.52 3.69 0.06 86 XM_B_SpammyTLD 2906 2.39 3.55 2.22 87 XMLngstWrd_01 2821 0.76 3.45 0.37 88 TM2_M_URI_OPT_OUT 2751 9.13 3.36 9.98 89 TR_LOTS_OF_MONEY3 2714 1.92 3.32 1.71 90 TR_XM_MaxBayes 2703 0.47 3.30 0.06 91 HTML_IMAGE_RATIO_08 2662 2.41 3.25 2.29 92 RCVD_IN_MSPIKE_H4 2635 8.14 3.22 8.86 93 SpammyFromTLD_02 2610 0.72 3.19 0.36 94 TR_XM_PHPDW 2603 0.75 3.18 0.40 95 TR_XM_PHPForged 2603 0.74 3.18 0.38 96 TR_XM_FormFill2 2573 0.73 3.14 0.38 97 XM_OfRef6 2570 1.34 3.14 1.08 98 XM_H_PHPOS 2564 0.73 3.13 0.38 99 FROM_SUSPICIOUS_NTLD 2554 0.42 3.12 0.03 100 FROM_EXCESS_BASE64 2490 2.58 3.04 2.51 101 HTML_IMAGE_RATIO_06 2438 3.48 2.98 3.56 102 TR_XM_COVIDMETA1 2413 0.78 2.95 0.46 103 KHOP_HELO_FCRDNS 2402 1.74 2.93 1.57 104 MIME_QP_LONG_LINE 2321 4.67 2.84 4.93 105 XMBody_17 2211 0.85 2.70 0.58 106 HK_SCAM 2203 0.36 2.69 0.02 107 XM_B_Unsub2 2201 2.39 2.69 2.34 108 XM_URI_RBL 2150 0.52 2.63 0.21 109 XM_CamelCaseFrm001 2106 2.10 2.57 2.03 110 RELAYCOUNTRY_FR 2092 0.55 2.56 0.26 111 TR_XM_MaxSPIKE 2076 0.38 2.54 0.07 112 T_REMOTE_IMAGE 2071 3.08 2.53 3.16 113 SUBJ_ALL_CAPS 1972 1.59 2.41 1.48 114 TR_XM_RelayPhish 1956 0.46 2.39 0.17 115 URI_HEX 1953 1.71 2.39 1.62 116 BAYES_40 1932 3.86 2.36 4.08 117 TR_XM_DK_SendGrid 1929 3.62 2.36 3.80 118 XMBrknScrpt_02 1912 1.01 2.34 0.81 119 XM_B_SEO 1866 0.42 2.28 0.15 120 XMSexyCombo_01 1799 1.26 2.20 1.12 121 MIME_HTML_ONLY_MULTI 1768 3.86 2.16 4.10 122 T_XMDrugObfuBody_14 1733 1.63 2.12 1.56 123 TR_Symld_Words 1730 1.62 2.11 1.54 124 T_TooManySym_01 1721 4.01 2.10 4.28 125 XM_UB80 1675 0.33 2.05 0.08 126 TM2_M_VERY_LONG_WORD 1672 1.31 2.04 1.20 127 FROM_SUSPICIOUS_NTLD_FP 1646 0.28 2.01 0.03 128 XMLngstWrd_02 1614 0.51 1.97 0.30 129 PDS_OTHER_BAD_TLD 1537 0.85 1.88 0.70 130 IMG_ONLY_FM_DOM_INFO 1535 0.24 1.88 0.00 131 XMGppyBdWords 1532 0.46 1.87 0.25 132 RELAYCOUNTRY_RU 1491 0.70 1.82 0.54 133 MAILING_LIST_MULTI 1485 2.16 1.81 2.21 134 BAYES_20 1465 4.15 1.79 4.49 135 XMSubNoVowel 1464 1.02 1.79 0.91 136 ALL_TRUSTED 1459 16.16 1.78 18.26 137 T_XMDrugObfuBody_00 1435 0.82 1.75 0.69 138 T_FILL_THIS_FORM_SHORT 1409 0.83 1.72 0.70 139 HTML_IMAGE_ONLY_28 1389 1.02 1.70 0.92 140 TR_Mismatch_TLD_02 1361 0.28 1.66 0.08 141 MPART_ALT_DIFF_COUNT 1343 0.49 1.64 0.33 142 URI_TRY_3LD 1308 1.25 1.60 1.20 143 DKIM_ADSP_NXDOMAIN 1299 0.66 1.59 0.53 144 XMGenDplmaNmb 1298 0.98 1.59 0.89 145 DATE_IN_PAST_03_06 1281 0.31 1.56 0.13 146 T_XMHurry_00 1279 0.71 1.56 0.59 147 XMStockSpam_06 1257 1.16 1.54 1.11 148 DKIM_ADSP_CUSTOM_MED 1254 1.68 1.53 1.70 149 XM_UB60 1253 0.33 1.53 0.15 150 MIME_CHARSET_FARAWAY 1251 0.26 1.53 0.08 151 TR_Mismatch_TLD_01 1224 0.41 1.50 0.26 152 RELAYCOUNTRY_GB 1224 0.92 1.50 0.84 153 XMBody_78 1135 0.59 1.39 0.47 154 XMHTML_After_End 1134 0.81 1.39 0.73 155 NML_ADSP_CUSTOM_MED 1127 1.37 1.38 1.37 156 REMOVE_BEFORE_LINK 1124 0.39 1.37 0.25 157 FORGED_GMAIL_RCVD 1056 1.12 1.29 1.10 158 XMBdyGiftCard01 1051 0.98 1.28 0.93 159 XM_PDF 1038 3.30 1.27 3.60 160 CHARSET_FARAWAY_HEADER 1014 0.18 1.24 0.02 161 HELO_NODOT 1004 2.11 1.23 2.24 162 RDNS_DYNAMIC 997 0.43 1.22 0.31 163 XM_H_PHPMailer 976 0.54 1.19 0.44 164 TR_MetaPhish_Combo_01 975 0.71 1.19 0.64 165 INVESTMENT_ADVICE 968 0.26 1.18 0.13 166 HELO_NO_DOMAIN 963 2.10 1.18 2.24 167 RELAYCOUNTRY_NL 958 0.36 1.17 0.25 168 URIBL_BLACK 951 0.17 1.16 0.03 169 DIET_1 945 0.45 1.15 0.34 170 XM_UB95 917 0.16 1.12 0.02 171 BAYES_05 914 5.27 1.12 5.88 172 XMOemUri 896 0.38 1.09 0.28 173 XM_BadFromFormat 894 0.28 1.09 0.16 174 XMSubMetaI_00 891 0.69 1.09 0.63 175 XMSubject_38 884 0.17 1.08 0.03 176 URI_NOVOWEL 880 0.44 1.08 0.35 177 BAYES_00 878 14.07 1.07 15.96 178 BOGUS_MIME_VERSION 868 0.14 1.06 0.00 179 XMBody_50 867 0.13 1.06 0.00 180 RCVD_IN_IADB_LISTED 865 4.17 1.06 4.62 181 XM_SPF_Unknown 859 0.66 1.05 0.60 182 XM_ProductURIs 850 0.95 1.04 0.94 183 LongTLD 824 0.27 1.01 0.17 184 XMSubMetaSxObfu_03 812 0.54 0.99 0.48 185 XMPhish30 805 0.57 0.98 0.51 186 MISSING_HEADERS 800 1.39 0.98 1.45 187 TooManyTo_002 795 1.67 0.97 1.77 188 DATE_IN_PAST_06_12 794 0.34 0.97 0.25 189 ANY_BOUNCE_MESSAGE 787 8.23 0.96 9.29 190 BOUNCE_MESSAGE 786 8.23 0.96 9.29 191 FROM_MISSP_REPLYTO 786 0.13 0.96 0.01 192 HTML_TAG_BALANCE_BODY 783 0.52 0.96 0.46 193 XM_H_PHPOS_M 781 0.25 0.95 0.14 194 XMLngstWrd_03 779 0.31 0.95 0.21 195 HK_RANDOM_REPLYTO 778 0.24 0.95 0.14 196 BODY_URI_ONLY 772 0.17 0.94 0.05 197 RELAYCOUNTRY_JP 770 1.10 0.94 1.13 198 XM_H_MailChimp 767 0.28 0.94 0.18 199 TR_Caps_n_Bayes_99 761 0.20 0.93 0.10 200 RELAYCOUNTRY_AT 759 0.25 0.93 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 551301 98.18 97.51 98.27 2 HTML_MESSAGE 469164 84.79 92.69 83.63 3 RELAYCOUNTRY_US 427734 75.88 73.38 76.25 4 DKIM_SIGNED 397495 72.01 79.92 70.86 5 XM_DK_Pass 390361 70.60 77.52 69.59 6 XM_B_Unicode 373543 67.87 76.67 66.59 7 DKIM_VALID 369129 65.60 64.22 65.80 8 DKIM_VALID_AU 280225 49.36 45.30 49.95 9 XMListUnsubscribeExists 277287 51.57 66.24 49.43 10 BAYES_50 272142 46.95 36.22 48.51 11 XM_B_Unicode3 224794 40.19 41.02 40.07 12 T_TM2_M_HEADER_IN_MSG 152876 27.00 25.29 27.25 13 HTML_FONT_LOW_CONTRAST 149567 26.64 26.47 26.66 14 DKIM_VALID_EF 138720 25.30 29.26 24.73 15 RCVD_IN_MSPIKE_WL 138248 22.61 8.70 24.64 16 LOC_TINY_FONT_1 133515 24.76 31.36 23.80 17 RCVD_IN_MSPIKE_H2 128361 24.15 32.81 22.88 18 MIME_HTML_ONLY 118992 22.84 33.99 21.21 19 FVGT_m_MULTI_ODD 117689 22.14 30.08 20.98 20 XMSubLong 108719 19.99 24.19 19.38 21 ALL_TRUSTED 102407 16.16 1.78 18.26 22 T_KAM_HTML_FONT_INVALID 94739 17.36 20.60 16.89 23 BAYES_00 89538 14.07 1.07 15.96 24 XM_Multi_Part_URI 87508 16.20 20.32 15.60 25 RCVD_IN_MSPIKE_H3 81181 13.30 5.30 14.47 26 XM_Body_Dirty_Words 77956 14.76 20.70 13.90 27 XM_DK_Undo_02 70551 17.80 53.57 12.58 28 XM_B_Unsub 58839 10.66 11.83 10.49 29 TM2_M_URI_OPT_OUT 55971 9.13 3.36 9.98 30 ANY_BOUNCE_MESSAGE 52115 8.23 0.96 9.29 31 BOUNCE_MESSAGE 52112 8.23 0.96 9.29 32 RCVD_IN_MSPIKE_H4 49676 8.14 3.22 8.86 33 LOTS_OF_MONEY 48795 9.48 14.84 8.70 34 BAYES_99 48111 12.63 40.40 8.58 35 RCVD_IN_RP_SAFE 46391 7.28 0.48 8.27 36 XM_Evil_Numbers_Gen 46368 8.40 9.35 8.27 37 XM_B_Phish_Phrases 45646 8.93 14.34 8.14 38 LotsOfNums_01 44889 8.52 12.06 8.00 39 TooManyTo_001 42882 7.53 6.75 7.64 40 RCVD_IN_RP_CERTIFIED 42839 6.70 0.30 7.64 41 TR_XM_DK_Bayes 42439 6.68 0.59 7.57 42 UNPARSEABLE_RELAY 40352 7.27 7.80 7.19 43 TR_XM_DK_Bayes1 39736 6.22 0.33 7.08 44 BAYES_999 39096 10.23 32.54 6.97 45 HTML_IMAGE_RATIO_02 38625 7.07 8.35 6.89 46 RELAYCOUNTRY_META 37383 9.05 25.42 6.66 47 XM_DKIMWhitelistDomains 37263 5.80 0.01 6.64 48 TR_XM_DK_Bayes2 36074 5.64 0.26 6.43 49 HTML_IMAGE_RATIO_04 35420 6.17 5.18 6.31 50 XM_SendGrid 35389 6.25 5.83 6.31 51 MPART_ALT_DIFF 33999 6.25 7.55 6.06 52 BAYES_05 32984 5.27 1.12 5.88 53 BAYES_60 32672 5.79 5.53 5.82 54 XM_H_Long_From01 31887 5.70 5.82 5.68 55 IN_ZIMBRA_NJ_WHITELIST 31049 4.83 0.04 5.53 56 BOTNET_IPINHOSTNAME 29152 6.57 15.96 5.20 57 DKIM_INVALID 28366 6.41 15.70 5.06 58 MIME_QP_LONG_LINE 27676 4.67 2.84 4.93 59 XMSexyCombo_05 26247 5.77 13.23 4.68 60 RCVD_IN_IADB_LISTED 25910 4.17 1.06 4.62 61 BAYES_20 25188 4.15 1.79 4.49 62 T_TooManySym_01 24027 4.01 2.10 4.28 63 MIME_HTML_ONLY_MULTI 23018 3.86 2.16 4.10 64 XMSubMetaSx_00 22989 4.50 7.23 4.10 65 BAYES_80 22955 4.52 7.45 4.09 66 BAYES_40 22901 3.86 2.36 4.08 67 RCVD_IN_IADB_SPF 22682 3.64 0.92 4.04 68 TR_XM_DK_SendGrid 21331 3.62 2.36 3.80 69 XM_H_Trusted_IP 20561 3.20 0.00 3.67 70 UNTRUSTED_Relay 20423 5.27 16.41 3.64 71 RCVD_IN_IADB_SENDERID 20241 3.26 0.87 3.61 72 XM_PDF 20191 3.30 1.27 3.60 73 XMNumbers 19991 3.64 4.14 3.56 74 HTML_IMAGE_RATIO_06 19962 3.48 2.98 3.56 75 XMStrtUSub 19955 3.60 3.90 3.56 76 RCVD_IN_IADB_DK 19771 3.19 0.87 3.52 77 T_REMOTE_IMAGE 17712 3.08 2.53 3.16 78 BOTNET 16914 5.98 26.31 3.02 79 TR_XM_PhishingBody 16752 3.94 10.51 2.99 80 RCVD_IN_IADB_VOUCHED 15625 2.48 0.38 2.79 81 XM_UncommonTLD01 15495 4.12 13.45 2.76 82 HTML_MIME_NO_HTML_TAG 14907 3.26 7.42 2.66 83 NO_DNS_FOR_FROM 14844 3.98 13.08 2.65 84 MIME_HTML_MOSTLY 14413 2.77 4.11 2.57 85 BAYES_95 14326 2.73 3.96 2.55 86 FROM_EXCESS_BASE64 14103 2.58 3.04 2.51 87 XM_B_Unsub2 13134 2.39 2.69 2.34 88 HTML_IMAGE_RATIO_08 12829 2.41 3.25 2.29 89 T_TooManySym_02 12725 2.05 0.56 2.27 90 HELO_NODOT 12547 2.11 1.23 2.24 91 HELO_NO_DOMAIN 12545 2.10 1.18 2.24 92 XM_B_SpammyTLD 12470 2.39 3.55 2.22 93 MAILING_LIST_MULTI 12399 2.16 1.81 2.21 94 XM_B_COVIDMETA 12068 2.73 6.73 2.15 95 XM_CamelCaseFrm001 11389 2.10 2.57 2.03 96 RCVD_IN_IADB_OPTIN 10293 1.65 0.35 1.83 97 RELAYCOUNTRY_CA 10205 2.63 8.21 1.82 98 TooManyTo_002 9952 1.67 0.97 1.77 99 TVD_RCVD_IP 9698 1.54 0.26 1.73 100 TR_LOTS_OF_MONEY3 9609 1.92 3.32 1.71 101 DKIM_ADSP_CUSTOM_MED 9518 1.68 1.53 1.70 102 HTML_FONT_FACE_BAD 9144 1.51 0.66 1.63 103 URI_HEX 9063 1.71 2.39 1.62 104 XMDiploma_00 8993 1.90 3.97 1.60 105 XM_B_Phish66 8957 2.45 8.27 1.60 106 KHOP_HELO_FCRDNS 8813 1.74 2.93 1.57 107 XM_SPF_SoftFail 8767 2.29 7.27 1.56 108 T_XMDrugObfuBody_14 8741 1.63 2.12 1.56 109 TR_Symld_Words 8659 1.62 2.11 1.54 110 XM_DK_Undo_01 8527 1.95 4.93 1.52 111 T_XMDrugObfuBody_08 8504 1.88 4.39 1.52 112 RCVD_IN_BL_SPAMCOP_NET 8282 2.52 9.67 1.48 113 SUBJ_ALL_CAPS 8277 1.59 2.41 1.48 114 MISSING_HEADERS 8117 1.39 0.98 1.45 115 HELO_MISC_IP 8020 1.33 0.68 1.43 116 CK_HELO_DYNAMIC_SPLIT_IP 8015 1.32 0.61 1.43 117 NML_ADSP_CUSTOM_MED 7693 1.37 1.38 1.37 118 XM_UB50 7459 1.81 5.14 1.33 119 IN_HORDE_ADDRESS_BOOK 7430 1.16 0.06 1.32 120 RCVD_IN_MSPIKE_H5 7391 1.17 0.18 1.32 121 INVALID_MSGID 7344 1.22 0.59 1.31 122 XM_GoogleGroups 7034 1.16 0.53 1.25 123 TooManyTo_003 6793 1.14 0.65 1.21 124 URI_TRY_3LD 6721 1.25 1.60 1.20 125 TM2_M_VERY_LONG_WORD 6721 1.31 2.04 1.20 126 XMGappySubj_01 6518 1.11 0.77 1.16 127 TO_MALFORMED 6466 1.01 0.01 1.15 128 REPLYTO_WITHOUT_TO_CC 6418 1.11 0.90 1.14 129 RELAYCOUNTRY_JP 6322 1.10 0.94 1.13 130 XMSexyCombo_01 6308 1.26 2.20 1.12 131 TR_LOTS_OF_MONEY1 6228 1.00 0.26 1.11 132 XMStockSpam_06 6210 1.16 1.54 1.11 133 FORGED_GMAIL_RCVD 6155 1.12 1.29 1.10 134 XM_OfRef6 6073 1.34 3.14 1.08 135 USER_IN_DEF_DKIM_WL 5952 0.93 0.02 1.06 136 XM_H_Long_From02 5304 0.94 0.90 0.95 137 XM_ProductURIs 5254 0.95 1.04 0.94 138 XMBdyGiftCard01 5229 0.98 1.28 0.93 139 HTML_IMAGE_ONLY_28 5162 1.02 1.70 0.92 140 XMSubNoVowel 5085 1.02 1.79 0.91 141 TooManyTo_004 5018 0.85 0.56 0.89 142 XMGenDplmaNmb 5008 0.98 1.59 0.89 143 XMCapTrack 4900 0.82 0.49 0.87 144 RELAYCOUNTRY_GB 4714 0.92 1.50 0.84 145 T_TooManySym_03 4708 0.75 0.13 0.84 146 XMBrknScrpt_02 4555 1.01 2.34 0.81 147 SpammyFromTLD_01 4270 1.40 5.78 0.76 148 TR_XM_COVIDMETA4 4262 1.41 5.88 0.76 149 XMHTML_After_End 4103 0.81 1.39 0.73 150 TooManyTo_005 4078 0.69 0.44 0.73 151 T_FILL_THIS_FORM_SHORT 3934 0.83 1.72 0.70 152 PDS_OTHER_BAD_TLD 3918 0.85 1.88 0.70 153 RCVD_IN_MSPIKE_BL 3894 1.86 9.83 0.69 154 T_XMDrugObfuBody_00 3860 0.82 1.75 0.69 155 TR_MSPIKEBAYES00 3836 0.60 0.00 0.68 156 TR_MetaPhish_Combo_01 3589 0.71 1.19 0.64 157 XMSubMetaI_00 3546 0.69 1.09 0.63 158 HTML_IMAGE_ONLY_20 3420 0.58 0.35 0.61 159 XMBody_95 3372 0.55 0.20 0.60 160 XM_SPF_Unknown 3354 0.66 1.05 0.60 161 TR_BOTNET_NEGATE 3337 0.59 0.56 0.59 162 T_XMHurry_00 3294 0.71 1.56 0.59 163 XMMoneyMeta_00 3253 0.61 0.85 0.58 164 XMBody_17 3244 0.85 2.70 0.58 165 T_OBFU_PDF_ATTACH 3113 0.51 0.22 0.55 166 TR_XM_UnparsRelay 3087 1.10 4.84 0.55 167 HTTPS_HTTP_MISMATCH 3043 0.57 0.78 0.54 168 RELAYCOUNTRY_RU 3033 0.70 1.82 0.54 169 XM_B_COPY_HTML 3006 0.55 0.65 0.54 170 XM_DIRTYINTL 3000 1.02 4.32 0.53 171 DKIM_ADSP_NXDOMAIN 2952 0.66 1.59 0.53 172 T_Symld_Words_02 2926 0.56 0.84 0.52 173 XMSexyCombo_04 2870 0.56 0.86 0.51 174 XM_B_REG_HTML 2861 0.47 0.22 0.51 175 TM2_M_A_HREF_HREF 2858 0.53 0.68 0.51 176 XMPhish08 2851 0.55 0.83 0.51 177 XMPhish30 2838 0.57 0.98 0.51 178 FROM_GOV_DKIM_AU 2836 0.45 0.08 0.51 179 XMSubMetaSxObfu_03 2682 0.54 0.99 0.48 180 NUMERIC_HTTP_ADDR 2658 0.52 0.86 0.47 181 XMBody_78 2648 0.59 1.39 0.47 182 TR_XM_COVIDMETA1 2608 0.78 2.95 0.46 183 SUBJ_DOLLARS 2585 0.50 0.76 0.46 184 HTML_TAG_BALANCE_BODY 2585 0.52 0.96 0.46 185 PLING_QUERY 2584 0.50 0.75 0.46 186 XMNoVowels 2580 0.50 0.78 0.46 187 T_TooManySym_04 2535 0.40 0.03 0.45 188 XM_ShortIntro_01 2496 0.48 0.73 0.44 189 XM_H_PHPMailer 2471 0.54 1.19 0.44 190 RELAYCOUNTRY_DE 2378 0.48 0.85 0.42 191 XMLngstWrd_00 2339 0.88 4.02 0.42 192 FROM_GOV_SPOOF 2280 0.38 0.18 0.41 193 XM_S_SubURI 2271 0.37 0.11 0.40 194 TR_XM_PHPDW 2241 0.75 3.18 0.40 195 RCVD_IN_MSPIKE_L3 2164 0.85 4.03 0.39 196 TR_XM_PHPForged 2147 0.74 3.18 0.38 197 TR_XM_FormFill2 2145 0.73 3.14 0.38 198 HTML_FONT_TINY_NORDNS 2142 0.43 0.75 0.38 199 THIS_AD 2123 0.38 0.39 0.38 200 XM_H_PHPOS 2123 0.73 3.13 0.38 ----------------------------------------------------------------------