Email: 786477 Autolearn: 0 AvgScore: 2.05 AvgScanTime: 1.77 sec Spam: 142444 Autolearn: 0 AvgScore: 15.24 AvgScanTime: 3.02 sec Ham: 644033 Autolearn: 0 AvgScore: -0.86 AvgScanTime: 1.49 sec Time Spent Running SA: 386.47 hours Time Spent Processing Spam: 119.56 hours Time Spent Processing Ham: 266.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135839 85.21 95.36 82.97 2 DCC_CHECK_NEGATIVE 134732 97.78 94.59 98.49 3 RELAYCOUNTRY_US 84603 69.78 59.39 72.08 4 MIME_HTML_ONLY 75411 25.56 52.94 19.50 5 XM_B_Unicode 71404 61.37 50.13 63.86 6 DKIM_SIGNED 71271 64.33 50.03 67.49 7 XM_DK_Pass 68783 63.09 48.29 66.36 8 RCVD_IN_MSPIKE_H2 63270 26.37 44.42 22.38 9 XMListUnsubscribeExists 62876 47.13 44.14 47.79 10 DKIM_VALID 56266 58.48 39.50 62.68 11 RELAYCOUNTRY_META 52452 11.25 36.82 5.59 12 HTML_MIME_NO_HTML_TAG 50525 8.32 35.47 2.32 13 RCVD_IN_BL_SPAMCOP_NET 49214 7.24 34.55 1.20 14 XM_DK_Undo_02 48681 14.35 34.18 9.96 15 T_REMOTE_IMAGE 48633 8.56 34.14 2.90 16 HTML_IMAGE_RATIO_02 48093 11.16 33.76 6.16 17 BOTNET 47834 8.37 33.58 2.80 18 BODY_URI_ONLY 47365 6.07 33.25 0.06 19 BAYES_50 46264 46.18 32.48 49.21 20 BAYES_99 45646 11.05 32.04 6.41 21 RCVD_IN_PSBL 45578 5.82 32.00 0.03 22 FROM_EXCESS_BASE64 44206 7.76 31.03 2.61 23 DKIM_VALID_AU 40437 44.04 28.39 47.50 24 HTML_SHORT_LINK_IMG_1 40187 5.16 28.21 0.07 25 UNTRUSTED_Relay 34869 6.63 24.48 2.68 26 XM_B_Unicode3 34619 34.12 24.30 36.29 27 BAYES_999 33101 8.25 23.24 4.93 28 XMSubLong 30468 19.10 21.39 18.60 29 LOC_TINY_FONT_1 29390 21.86 20.63 22.13 30 FVGT_m_MULTI_ODD 27908 19.90 19.59 19.97 31 T_TM2_M_HEADER_IN_MSG 24402 22.96 17.13 24.24 32 DKIM_VALID_EF 24113 22.40 16.93 23.61 33 XM_UncommonTLD01 23797 5.22 16.71 2.69 34 HTML_FONT_LOW_CONTRAST 23349 23.31 16.39 24.84 35 HTML_IMAGE_ONLY_12 21864 2.93 15.35 0.19 36 XM_Body_Dirty_Words 20792 13.42 14.60 13.16 37 BOTNET_NORDNS 19801 2.53 13.90 0.02 38 T_KAM_HTML_FONT_INVALID 19451 16.10 13.66 16.64 39 BAYES_80 19317 6.26 13.56 4.65 40 HTML_IMAGE_ONLY_08 18601 2.45 13.06 0.10 41 XM_Multi_Part_URI 18498 15.09 12.99 15.55 42 XMSubGiftCard1 18090 2.41 12.70 0.13 43 LOTS_OF_MONEY 17730 8.20 12.45 7.27 44 BAYES_60 17583 8.42 12.34 7.56 45 XM_Combo_Sbj 16888 2.49 11.86 0.42 46 BOTNET_IPINHOSTNAME 15607 5.64 10.96 4.46 47 DKIM_INVALID 15005 5.84 10.53 4.81 48 NO_DNS_FOR_FROM 13897 3.97 9.76 2.69 49 RELAYCOUNTRY_CA 13377 3.09 9.39 1.69 50 RCVD_IN_MSPIKE_BL 12350 2.16 8.67 0.71 51 XM_B_Unsub 11803 10.37 8.29 10.84 52 XMSexyCombo_05 11292 4.80 7.93 4.11 53 LotsOfNums_01 10902 8.13 7.65 8.23 54 XM_B_Phish_Phrases 10692 7.00 7.51 6.89 55 HK_RANDOM_FROM 10577 1.43 7.43 0.11 56 XM_UB50 10197 2.33 7.16 1.26 57 KHOP_HELO_FCRDNS 10028 2.50 7.04 1.49 58 RCVD_IN_RP_RNBL 9596 1.27 6.74 0.06 59 BAYES_95 9349 3.39 6.56 2.68 60 SpammyFromTLD_02 9331 1.46 6.55 0.34 61 XM_UB99 9051 1.15 6.35 0.00 62 XM_JunkDunk 9044 1.15 6.35 0.00 63 XM_SPF_SoftFail 8762 2.30 6.15 1.45 64 SpammyFromTLD_01 8471 1.67 5.95 0.72 65 RCVD_IN_MSPIKE_WL 8282 20.35 5.81 23.56 66 XM_Evil_Numbers_Gen 8191 7.23 5.75 7.55 67 XMSubMetaSx_00 8155 5.44 5.73 5.38 68 RELAYCOUNTRY_GB 7992 1.63 5.61 0.75 69 TR_XM_PhishingBody 7937 3.42 5.57 2.95 70 FROM_SUSPICIOUS_NTLD 7821 1.04 5.49 0.05 71 FROM_SUSPICIOUS_NTLD_FP 7750 1.01 5.44 0.03 72 DKIM_ADSP_NXDOMAIN 7692 1.41 5.40 0.53 73 TooManyTo_001 6920 9.38 4.86 10.38 74 RELAYCOUNTRY_KR 6854 0.89 4.81 0.02 75 RCVD_IN_MSPIKE_L5 6777 1.05 4.76 0.24 76 HDRS_MISSP 6735 0.90 4.73 0.06 77 RELAYCOUNTRY_FR 6677 1.09 4.69 0.29 78 HTML_TAG_BALANCE_CENTER 6473 0.91 4.54 0.11 79 XMStrtUSub 6210 3.61 4.36 3.45 80 XM_UB80 6118 0.82 4.30 0.06 81 MPART_ALT_DIFF 5994 4.30 4.21 4.32 82 UNPARSEABLE_RELAY 5655 6.07 3.97 6.54 83 XM_UB999 5608 0.71 3.94 0.00 84 XM_H_Long_From01 5561 4.62 3.90 4.77 85 XM_B_Phish66 5435 2.06 3.82 1.68 86 XM_UB60 5411 0.81 3.80 0.14 87 XM_B_COVIDMETA 5261 2.49 3.69 2.22 88 TR_XM_COVIDMETA4 5223 1.25 3.67 0.71 89 RCVD_IN_MSPIKE_H3 4982 11.75 3.50 13.57 90 RCVD_IN_MSPIKE_L3 4775 0.94 3.35 0.40 91 XM_DIRTYINTL 4740 1.06 3.33 0.56 92 XM_SendGrid 4668 5.39 3.28 5.85 93 HTML_IMAGE_RATIO_04 4560 4.66 3.20 4.98 94 XM_B_SEO 4558 0.70 3.20 0.14 95 FROM_LOCAL_NOVOWEL 4542 0.60 3.19 0.02 96 MIME_HTML_MOSTLY 4471 2.24 3.14 2.04 97 XMSubject_48 4453 0.59 3.13 0.02 98 XM_B_SpammyTLD 4354 2.32 3.06 2.16 99 XM_URI_RBL 4265 0.74 2.99 0.24 100 TR_XM_INV_DKIM 4122 0.65 2.89 0.16 101 XMBody_17 3994 1.26 2.80 0.92 102 IMG_ONLY_FM_DOM_INFO 3974 0.51 2.79 0.00 103 XM_CamelCaseFrm001 3946 2.07 2.77 1.91 104 T_XMDrugObfuBody_08 3873 1.87 2.72 1.68 105 TR_XM_MaxWHORU 3479 0.48 2.44 0.04 106 RELAYCOUNTRY_NL 3401 0.60 2.39 0.20 107 URIBL_SBL_A 3336 0.59 2.34 0.20 108 XMNumbers 3329 2.71 2.34 2.79 109 XMSexyCombo_01 3327 1.48 2.34 1.30 110 XM_UB95 3318 0.44 2.33 0.02 111 FVGT_m_MULTI_ODD_EMAIL 3281 0.44 2.30 0.03 112 XM_OfRef6 3245 1.32 2.28 1.11 113 TM2_M_URI_OPT_OUT 3204 9.88 2.25 11.57 114 HTML_IMAGE_RATIO_08 3190 2.21 2.24 2.20 115 SUBJ_ALL_CAPS 3180 1.60 2.23 1.46 116 HTML_IMAGE_RATIO_06 3179 3.15 2.23 3.36 117 DIET_1 3165 0.68 2.22 0.34 118 RCVD_IN_MSPIKE_H4 3103 7.37 2.18 8.52 119 HTML_IMAGE_ONLY_20 3098 0.77 2.17 0.46 120 TR_XM_UnparsRelay 2994 0.72 2.10 0.41 121 ALL_TRUSTED 2955 19.50 2.07 23.35 122 DATE_IN_PAST_03_06 2919 0.46 2.05 0.11 123 MISSING_HEADERS 2890 1.63 2.03 1.54 124 T_FILL_THIS_FORM_SHORT 2689 0.96 1.89 0.75 125 TR_XM_COVIDMETA1 2588 0.66 1.82 0.41 126 MIME_QP_LONG_LINE 2539 4.40 1.78 4.98 127 XMSubject_09 2470 0.33 1.73 0.01 128 TR_XM_MaxBayes 2468 0.35 1.73 0.04 129 TR_XM_MaxSPIKE 2456 0.36 1.72 0.06 130 SUBJECT_DIET 2397 0.31 1.68 0.00 131 XM_B_Unsub2 2397 2.34 1.68 2.49 132 TR_XM_PHPDW 2373 0.60 1.67 0.37 133 XMBrknScrpt_02 2360 0.90 1.66 0.73 134 TR_XM_PHPForged 2359 0.59 1.66 0.36 135 TR_XM_FormFill2 2336 0.59 1.64 0.36 136 XM_H_PHPOS 2331 0.59 1.64 0.35 137 T_TooManySym_01 2308 3.12 1.62 3.46 138 TooManyTo_002 2155 4.02 1.51 4.57 139 DATE_IN_PAST_06_12 2134 0.39 1.50 0.14 140 URI_TRY_3LD 2099 1.36 1.47 1.33 141 URI_HEX 2037 1.41 1.43 1.40 142 XMDiploma_00 1995 1.50 1.40 1.52 143 RELAYCOUNTRY_IL 1941 0.26 1.36 0.01 144 TR_XM_DK_SendGrid 1938 2.88 1.36 3.22 145 TM2_M_VERY_LONG_WORD 1898 1.15 1.33 1.10 146 XM_DK_Undo_01 1872 1.42 1.31 1.44 147 TR_LOTS_OF_MONEY3 1870 0.62 1.31 0.47 148 ANY_BOUNCE_MESSAGE 1835 9.89 1.29 11.79 149 BOUNCE_MESSAGE 1835 9.89 1.29 11.79 150 TR_Sbj_FN_Bdy 1818 0.58 1.28 0.43 151 XMMoneyMeta_00 1817 0.69 1.28 0.57 152 TooManyTo_003 1814 3.04 1.27 3.43 153 XMLngstWrd_00 1792 0.59 1.26 0.44 154 FROM_MISSPACED 1779 0.24 1.25 0.02 155 MIME_HTML_ONLY_MULTI 1777 2.43 1.25 2.69 156 LongTLD 1754 0.34 1.23 0.15 157 BAYES_40 1745 3.75 1.23 4.31 158 XMSubNoVowel 1729 0.78 1.21 0.69 159 T_XMDrugObfuBody_14 1685 1.34 1.18 1.37 160 HTML_FONT_TINY_NORDNS 1663 0.44 1.17 0.28 161 TR_Symld_Words 1662 1.43 1.17 1.49 162 T_XMDrugObfuBody_00 1634 0.67 1.15 0.56 163 FROM_MISSP_REPLYTO 1610 0.21 1.13 0.01 164 TR_XM_RelayPhish 1601 0.31 1.12 0.14 165 XMStockSpam_06 1558 0.91 1.09 0.86 166 TooManyTo_004 1545 2.28 1.08 2.54 167 REPLYTO_WITHOUT_TO_CC 1545 1.12 1.08 1.13 168 RELAYCOUNTRY_CN 1534 0.29 1.08 0.12 169 PDS_OTHER_BAD_TLD 1521 0.56 1.07 0.44 170 XMLngstWrd_01 1516 0.51 1.06 0.38 171 MAILING_LIST_MULTI 1501 1.89 1.05 2.07 172 HTML_IMAGE_ONLY_28 1496 0.48 1.05 0.36 173 XM_ShortIntro_01 1472 1.96 1.03 2.16 174 XM_BadFromFormat 1444 0.30 1.01 0.14 175 DKIM_ADSP_CUSTOM_MED 1431 0.91 1.00 0.89 176 XMSubEmpty 1426 0.57 1.00 0.48 177 XMSubGiftCard2 1407 0.25 0.99 0.09 178 XMGenDplmaNmb 1368 0.88 0.96 0.86 179 T_MONEY_PERCENT 1368 0.48 0.96 0.37 180 TR_LOTS_OF_MONEY2 1368 0.48 0.96 0.37 181 HK_RANDOM_REPLYTO 1325 0.35 0.93 0.22 182 RDNS_DYNAMIC 1308 0.39 0.92 0.27 183 XMHTML_After_End 1290 0.79 0.91 0.76 184 NML_ADSP_CUSTOM_MED 1288 0.68 0.90 0.63 185 XMBody_78 1280 0.49 0.90 0.40 186 DEAR_SOMETHING 1277 0.26 0.90 0.12 187 MISSING_SUBJECT 1273 0.47 0.89 0.37 188 XMNoSubject 1273 0.47 0.89 0.37 189 XMSubMetaSxObfu_03 1268 0.75 0.89 0.72 190 TR_LOTS_OF_MONEY1 1262 0.17 0.89 0.02 191 MIME_CHARSET_FARAWAY 1261 0.29 0.89 0.16 192 URI_NOVOWEL 1249 1.66 0.88 1.84 193 BAYES_20 1238 4.22 0.87 4.96 194 FROM_MISSP_EH_MATCH 1234 0.17 0.87 0.01 195 PDS_BTC_ID 1219 0.18 0.86 0.03 196 XM_PDF 1202 2.90 0.84 3.36 197 URI_WP_HACKED_2 1174 1.81 0.82 2.03 198 TooManyTo_005 1163 1.63 0.82 1.81 199 CHARSET_FARAWAY_HEADER 1129 0.21 0.79 0.08 200 MIMEOLE_DIRECT_TO_MX 1117 0.14 0.78 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 634284 97.78 94.59 98.49 2 HTML_MESSAGE 534349 85.21 95.36 82.97 3 RELAYCOUNTRY_US 464222 69.78 59.39 72.08 4 DKIM_SIGNED 434649 64.33 50.03 67.49 5 XM_DK_Pass 427368 63.09 48.29 66.36 6 XM_B_Unicode 411293 61.37 50.13 63.86 7 DKIM_VALID 403689 58.48 39.50 62.68 8 BAYES_50 316958 46.18 32.48 49.21 9 XMListUnsubscribeExists 307752 47.13 44.14 47.79 10 DKIM_VALID_AU 305889 44.04 28.39 47.50 11 XM_B_Unicode3 233731 34.12 24.30 36.29 12 HTML_FONT_LOW_CONTRAST 159959 23.31 16.39 24.84 13 T_TM2_M_HEADER_IN_MSG 156145 22.96 17.13 24.24 14 DKIM_VALID_EF 152057 22.40 16.93 23.61 15 RCVD_IN_MSPIKE_WL 151735 20.35 5.81 23.56 16 ALL_TRUSTED 150373 19.50 2.07 23.35 17 RCVD_IN_MSPIKE_H2 144121 26.37 44.42 22.38 18 LOC_TINY_FONT_1 142509 21.86 20.63 22.13 19 FVGT_m_MULTI_ODD 128592 19.90 19.59 19.97 20 MIME_HTML_ONLY 125589 25.56 52.94 19.50 21 XMSubLong 119783 19.10 21.39 18.60 22 T_KAM_HTML_FONT_INVALID 107162 16.10 13.66 16.64 23 XM_Multi_Part_URI 100159 15.09 12.99 15.55 24 RCVD_IN_MSPIKE_H3 87424 11.75 3.50 13.57 25 BAYES_00 86867 11.13 0.47 13.49 26 XM_Body_Dirty_Words 84775 13.42 14.60 13.16 27 ANY_BOUNCE_MESSAGE 75927 9.89 1.29 11.79 28 BOUNCE_MESSAGE 75922 9.89 1.29 11.79 29 TM2_M_URI_OPT_OUT 74533 9.88 2.25 11.57 30 XM_B_Unsub 69788 10.37 8.29 10.84 31 TooManyTo_001 66819 9.38 4.86 10.38 32 XM_DK_Undo_02 64155 14.35 34.18 9.96 33 RCVD_IN_MSPIKE_H4 54881 7.37 2.18 8.52 34 LotsOfNums_01 53006 8.13 7.65 8.23 35 BAYES_60 48668 8.42 12.34 7.56 36 XM_Evil_Numbers_Gen 48642 7.23 5.75 7.55 37 LOTS_OF_MONEY 46798 8.20 12.45 7.27 38 XM_B_Phish_Phrases 44372 7.00 7.51 6.89 39 TR_XM_DK_Bayes 43659 5.60 0.27 6.78 40 BAYES_05 43325 5.59 0.44 6.73 41 UNPARSEABLE_RELAY 42100 6.07 3.97 6.54 42 RCVD_IN_RP_SAFE 42020 5.42 0.41 6.52 43 BAYES_99 41287 11.05 32.04 6.41 44 TR_XM_DK_Bayes1 40644 5.20 0.16 6.31 45 HTML_IMAGE_RATIO_02 39697 11.16 33.76 6.16 46 XM_DKIMWhitelistDomains 38905 4.95 0.01 6.04 47 RCVD_IN_RP_CERTIFIED 38166 4.91 0.29 5.93 48 XM_SendGrid 37695 5.39 3.28 5.85 49 RELAYCOUNTRY_META 36008 11.25 36.82 5.59 50 TR_XM_DK_Bayes2 35878 4.58 0.11 5.57 51 IN_ZIMBRA_NJ_WHITELIST 34987 4.46 0.04 5.43 52 XMSubMetaSx_00 34651 5.44 5.73 5.38 53 MIME_QP_LONG_LINE 32091 4.40 1.78 4.98 54 HTML_IMAGE_RATIO_04 32069 4.66 3.20 4.98 55 BAYES_20 31949 4.22 0.87 4.96 56 BAYES_999 31772 8.25 23.24 4.93 57 DKIM_INVALID 30960 5.84 10.53 4.81 58 XM_H_Long_From01 30735 4.62 3.90 4.77 59 BAYES_80 29934 6.26 13.56 4.65 60 TooManyTo_002 29460 4.02 1.51 4.57 61 BOTNET_IPINHOSTNAME 28721 5.64 10.96 4.46 62 RCVD_IN_IADB_LISTED 27843 3.64 0.54 4.32 63 MPART_ALT_DIFF 27802 4.30 4.21 4.32 64 BAYES_40 27752 3.75 1.23 4.31 65 XMSexyCombo_05 26489 4.80 7.93 4.11 66 RCVD_IN_IADB_SPF 24502 3.20 0.49 3.80 67 T_TooManySym_01 22269 3.12 1.62 3.46 68 XMStrtUSub 22198 3.61 4.36 3.45 69 RCVD_IN_IADB_SENDERID 22140 2.90 0.47 3.44 70 TooManyTo_003 22117 3.04 1.27 3.43 71 HTML_IMAGE_RATIO_06 21611 3.15 2.23 3.36 72 XM_PDF 21610 2.90 0.84 3.36 73 RCVD_IN_IADB_DK 21439 2.81 0.48 3.33 74 TR_XM_DK_SendGrid 20739 2.88 1.36 3.22 75 TR_XM_PhishingBody 18998 3.42 5.57 2.95 76 T_REMOTE_IMAGE 18668 8.56 34.14 2.90 77 BOTNET 18020 8.37 33.58 2.80 78 XMNumbers 17996 2.71 2.34 2.79 79 MIME_HTML_ONLY_MULTI 17348 2.43 1.25 2.69 80 NO_DNS_FOR_FROM 17323 3.97 9.76 2.69 81 XM_UncommonTLD01 17296 5.22 16.71 2.69 82 BAYES_95 17283 3.39 6.56 2.68 83 UNTRUSTED_Relay 17261 6.63 24.48 2.68 84 FROM_EXCESS_BASE64 16807 7.76 31.03 2.61 85 RCVD_IN_IADB_VOUCHED 16637 2.14 0.16 2.58 86 TooManyTo_004 16362 2.28 1.08 2.54 87 XM_B_Unsub2 16025 2.34 1.68 2.49 88 HTML_MIME_NO_HTML_TAG 14912 8.32 35.47 2.32 89 XM_B_COVIDMETA 14303 2.49 3.69 2.22 90 HELO_NODOT 14219 1.93 0.65 2.21 91 HELO_NO_DOMAIN 14217 1.92 0.65 2.21 92 HTML_IMAGE_RATIO_08 14169 2.21 2.24 2.20 93 XM_ShortIntro_01 13904 1.96 1.03 2.16 94 XM_B_SpammyTLD 13893 2.32 3.06 2.16 95 MAILING_LIST_MULTI 13326 1.89 1.05 2.07 96 MIME_HTML_MOSTLY 13110 2.24 3.14 2.04 97 URI_WP_HACKED_2 13099 1.81 0.82 2.03 98 XM_H_Trusted_IP 12334 1.57 0.00 1.92 99 XM_CamelCaseFrm001 12321 2.07 2.77 1.91 100 URI_NOVOWEL 11840 1.66 0.88 1.84 101 T_TooManySym_02 11830 1.61 0.56 1.84 102 TooManyTo_005 11654 1.63 0.82 1.81 103 RELAYCOUNTRY_CA 10914 3.09 9.39 1.69 104 T_XMDrugObfuBody_08 10801 1.87 2.72 1.68 105 RCVD_IN_IADB_OPTIN 10799 1.40 0.16 1.68 106 XM_B_Phish66 10799 2.06 3.82 1.68 107 MISSING_HEADERS 9940 1.63 2.03 1.54 108 XMDiploma_00 9775 1.50 1.40 1.52 109 PLING_QUERY 9742 1.35 0.64 1.51 110 KHOP_HELO_FCRDNS 9626 2.50 7.04 1.49 111 TR_Symld_Words 9568 1.43 1.17 1.49 112 RCVD_IN_MSPIKE_H5 9430 1.22 0.14 1.46 113 SUBJ_ALL_CAPS 9396 1.60 2.23 1.46 114 XM_SPF_SoftFail 9345 2.30 6.15 1.45 115 XM_DK_Undo_01 9279 1.42 1.31 1.44 116 TVD_RCVD_IP 9216 1.24 0.35 1.43 117 XM_ProductURIs 9182 1.27 0.54 1.43 118 URI_HEX 9025 1.41 1.43 1.40 119 T_XMDrugObfuBody_14 8835 1.34 1.18 1.37 120 URI_TRY_3LD 8567 1.36 1.47 1.33 121 XMSexyCombo_01 8348 1.48 2.34 1.30 122 XM_UB50 8142 2.33 7.16 1.26 123 HELO_MISC_IP 7975 1.08 0.35 1.24 124 CK_HELO_DYNAMIC_SPLIT_IP 7966 1.08 0.35 1.24 125 RCVD_IN_BL_SPAMCOP_NET 7712 7.24 34.55 1.20 126 IN_HORDE_ADDRESS_BOOK 7521 0.96 0.04 1.17 127 INVALID_MSGID 7409 0.97 0.13 1.15 128 REPLYTO_WITHOUT_TO_CC 7254 1.12 1.08 1.13 129 XM_GoogleGroups 7234 0.99 0.36 1.12 130 XM_OfRef6 7167 1.32 2.28 1.11 131 XM_H_Long_From02 7119 1.02 0.61 1.11 132 TM2_M_VERY_LONG_WORD 7113 1.15 1.33 1.10 133 XMGappySubj_01 6911 0.92 0.23 1.07 134 USER_IN_DEF_DKIM_WL 6554 0.83 0.01 1.02 135 TO_MALFORMED 6493 0.83 0.01 1.01 136 HTML_FONT_FACE_BAD 6472 0.95 0.72 1.00 137 XMBody_17 5910 1.26 2.80 0.92 138 DKIM_ADSP_CUSTOM_MED 5736 0.91 1.00 0.89 139 TR_MetaPhish_Combo_01 5599 0.82 0.57 0.87 140 XMStockSpam_06 5560 0.91 1.09 0.86 141 XMGenDplmaNmb 5535 0.88 0.96 0.86 142 XMCapTrack 5459 0.76 0.37 0.85 143 XMHTML_After_End 4906 0.79 0.91 0.76 144 HTTPS_HTTP_MISMATCH 4872 0.73 0.60 0.76 145 RELAYCOUNTRY_GB 4852 1.63 5.61 0.75 146 T_FILL_THIS_FORM_SHORT 4822 0.96 1.89 0.75 147 XMBrknScrpt_02 4705 0.90 1.66 0.73 148 T_TooManySym_03 4692 0.62 0.10 0.73 149 SpammyFromTLD_01 4668 1.67 5.95 0.72 150 XMSubMetaSxObfu_03 4622 0.75 0.89 0.72 151 RCVD_IN_MSPIKE_BL 4604 2.16 8.67 0.71 152 TR_XM_COVIDMETA4 4580 1.25 3.67 0.71 153 XMSubNoVowel 4442 0.78 1.21 0.69 154 XMBdyGiftCard01 4349 0.66 0.60 0.68 155 NML_ADSP_CUSTOM_MED 4087 0.68 0.90 0.63 156 XMSubMetaSSx_00 3970 0.61 0.61 0.62 157 TR_MSPIKEBAYES00 3816 0.49 0.00 0.59 158 TR_BOTNET_NEGATE 3747 0.56 0.48 0.58 159 XMMoneyMeta_00 3646 0.69 1.28 0.57 160 T_XMDrugObfuBody_00 3630 0.67 1.15 0.56 161 XM_DIRTYINTL 3585 1.06 3.33 0.56 162 XMBody_95 3549 0.47 0.09 0.55 163 DKIM_ADSP_NXDOMAIN 3420 1.41 5.40 0.53 164 XMSubMetaI_00 3403 0.53 0.56 0.53 165 T_XMHurry_00 3344 0.56 0.75 0.52 166 XMHTMLBadTable_001 3329 0.49 0.35 0.52 167 T_OBFU_PDF_ATTACH 3299 0.44 0.11 0.51 168 FROM_GOV_SPOOF 3255 0.43 0.10 0.51 169 RCVD_IN_SORBS_DUL 3252 0.45 0.20 0.50 170 XM_SPF_Unknown 3191 0.51 0.58 0.50 171 XMSubEmpty 3089 0.57 1.00 0.48 172 XMNoVowels 3078 0.46 0.37 0.48 173 HTML_IMAGE_ONLY_32 3061 0.41 0.11 0.48 174 T_Symld_Words_02 3043 0.51 0.65 0.47 175 TR_LOTS_OF_MONEY3 3022 0.62 1.31 0.47 176 FROM_GOV_DKIM_AU 2960 0.39 0.08 0.46 177 HTML_IMAGE_ONLY_20 2957 0.77 2.17 0.46 178 SUBJ_DOLLARS 2916 0.41 0.20 0.45 179 TM2_M_A_HREF_HREF 2871 0.47 0.57 0.45 180 PDS_OTHER_BAD_TLD 2862 0.56 1.07 0.44 181 XMLngstWrd_00 2862 0.59 1.26 0.44 182 XMPhish30 2836 0.47 0.62 0.44 183 TR_Sbj_FN_Bdy 2771 0.58 1.28 0.43 184 RELAYCOUNTRY_AU 2746 0.43 0.43 0.43 185 XMPhish08 2740 0.46 0.61 0.43 186 XM_H_PHPMailer 2730 0.46 0.60 0.42 187 XM_Combo_Sbj 2713 2.49 11.86 0.42 188 FORGED_GMAIL_RCVD 2665 0.47 0.70 0.41 189 TR_XM_UnparsRelay 2632 0.72 2.10 0.41 190 TR_XM_COVIDMETA1 2616 0.66 1.82 0.41 191 RCVD_IN_MSPIKE_L3 2606 0.94 3.35 0.40 192 XMBody_78 2589 0.49 0.90 0.40 193 T_TooManySym_04 2586 0.33 0.03 0.40 194 XMPhish14 2579 0.43 0.58 0.40 195 XM_B_COPY_HTML 2556 0.39 0.37 0.40 196 HTML_TAG_BALANCE_BODY 2536 0.42 0.55 0.39 197 XMLngstWrd_01 2463 0.51 1.06 0.38 198 THIS_AD 2426 0.37 0.33 0.38 199 XMNoSubject 2392 0.47 0.89 0.37 200 MISSING_SUBJECT 2392 0.47 0.89 0.37 ----------------------------------------------------------------------