Email: 671106 Autolearn: 0 AvgScore: 0.85 AvgScanTime: 1.79 sec Spam: 102759 Autolearn: 0 AvgScore: 13.52 AvgScanTime: 2.85 sec Ham: 568347 Autolearn: 0 AvgScore: -1.44 AvgScanTime: 1.60 sec Time Spent Running SA: 333.32 hours Time Spent Processing Spam: 81.37 hours Time Spent Processing Ham: 251.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 99685 97.95 97.01 98.12 2 HTML_MESSAGE 95538 90.55 92.97 90.12 3 XM_B_Unicode 71551 72.25 69.63 72.73 4 DKIM_SIGNED 70748 74.73 68.85 75.80 5 XM_DK_Pass 68609 73.49 66.77 74.70 6 RELAYCOUNTRY_US 64975 78.19 63.23 80.90 7 XMListUnsubscribeExists 61979 53.87 60.31 52.70 8 DKIM_VALID 59362 68.45 57.77 70.38 9 XM_DK_Undo_02 44820 16.06 43.62 11.08 10 DKIM_VALID_AU 43976 51.29 42.80 52.82 11 BAYES_99 41249 12.19 40.14 7.14 12 BAYES_50 36962 51.32 35.97 54.09 13 BAYES_999 32243 9.54 31.38 5.59 14 XM_B_Unicode3 32220 38.64 31.35 39.96 15 T_TM2_M_HEADER_IN_MSG 30756 28.80 29.93 28.59 16 MIME_HTML_ONLY 30029 22.18 29.22 20.91 17 RELAYCOUNTRY_META 29660 9.13 28.86 5.56 18 LOC_TINY_FONT_1 29133 25.33 28.35 24.79 19 UNTRUSTED_Relay 28750 6.25 27.98 2.33 20 BOTNET 28501 6.68 27.74 2.87 21 DKIM_VALID_EF 27752 27.36 27.01 27.42 22 RCVD_IN_MSPIKE_H2 26569 24.98 25.86 24.82 23 XM_UncommonTLD01 24844 6.33 24.18 3.11 24 FVGT_m_MULTI_ODD 24018 23.34 23.37 23.33 25 HTML_FONT_LOW_CONTRAST 21633 26.43 21.05 27.40 26 XMSubLong 21489 21.83 20.91 21.99 27 LOTS_OF_MONEY 21286 10.44 20.71 8.59 28 XM_Multi_Part_URI 21189 13.42 20.62 12.12 29 T_KAM_HTML_FONT_INVALID 20609 18.73 20.06 18.48 30 XM_Body_Dirty_Words 16972 14.32 16.52 13.92 31 XM_B_Phish_Phrases 16332 8.41 15.89 7.06 32 RCVD_IN_MSPIKE_BL 15600 3.11 15.18 0.93 33 BOTNET_IPINHOSTNAME 14928 6.76 14.53 5.36 34 XMSexyCombo_05 13752 5.43 13.38 3.99 35 RCVD_IN_BL_SPAMCOP_NET 13687 3.26 13.32 1.44 36 DKIM_INVALID 11386 6.28 11.08 5.41 37 XM_SPF_SoftFail 11265 3.27 10.96 1.88 38 RCVD_IN_RP_RNBL 11150 1.73 10.85 0.08 39 RCVD_IN_MSPIKE_L5 11119 1.90 10.82 0.29 40 XMSubMetaSx_00 11105 5.09 10.81 4.05 41 XM_UB50 10665 2.62 10.38 1.22 42 RCVD_IN_PSBL 10342 1.55 10.06 0.01 43 BOTNET_NORDNS 10232 1.54 9.96 0.02 44 SpammyFromTLD_01 10097 2.27 9.83 0.91 45 MPART_ALT_DIFF 9920 5.71 9.65 5.00 46 XMBody_17 9879 2.45 9.61 1.15 47 TR_LOTS_OF_MONEY3 9545 2.20 9.29 0.91 48 XM_B_Unsub 9468 10.50 9.21 10.73 49 XM_UB99 9464 1.41 9.21 0.00 50 LotsOfNums_01 9294 9.13 9.04 9.14 51 HTML_MIME_NO_HTML_TAG 8985 3.56 8.74 2.62 52 XM_Evil_Numbers_Gen 8677 8.42 8.44 8.42 53 FROM_SUSPICIOUS_NTLD 8032 1.23 7.82 0.04 54 FROM_SUSPICIOUS_NTLD_FP 7958 1.21 7.74 0.03 55 RCVD_IN_MSPIKE_WL 7731 23.59 7.52 26.49 56 XM_UB999 7711 1.15 7.50 0.00 57 BAYES_80 7575 5.33 7.37 4.96 58 T_XMDrugObfuBody_08 7348 2.59 7.15 1.77 59 NO_DNS_FOR_FROM 7263 3.12 7.07 2.41 60 HTML_IMAGE_RATIO_02 7010 6.87 6.82 6.88 61 SpammyFromTLD_02 6982 1.36 6.79 0.38 62 RELAYCOUNTRY_CA 6813 2.57 6.63 1.83 63 TR_XM_PhishingBody 6545 3.90 6.37 3.45 64 BAYES_60 6395 7.49 6.22 7.72 65 T_REMOTE_IMAGE 6362 3.68 6.19 3.23 66 XMDiploma_00 6003 2.28 5.84 1.64 67 SUBJ_ALL_CAPS 5872 2.10 5.71 1.44 68 XM_H_Long_From01 5837 5.56 5.68 5.53 69 XM_B_COVIDMETA 5461 2.14 5.31 1.56 70 UNPARSEABLE_RELAY 5445 6.98 5.30 7.29 71 BODY_URI_ONLY 5303 0.84 5.16 0.05 72 DKIM_ADSP_NXDOMAIN 5267 1.24 5.13 0.54 73 TooManyTo_001 5090 7.71 4.95 8.20 74 BAYES_95 5077 3.15 4.94 2.83 75 HDRS_MISSP 4915 0.77 4.78 0.05 76 HTML_TAG_BALANCE_CENTER 4867 0.83 4.74 0.12 77 XM_B_SEO 4821 0.87 4.69 0.17 78 MISSING_HEADERS 4817 1.25 4.69 0.63 79 XMBrknScrpt_02 4797 1.83 4.67 1.32 80 XM_OfRef6 4725 1.82 4.60 1.32 81 REPLYTO_WITHOUT_TO_CC 4529 0.72 4.41 0.06 82 HTML_IMAGE_RATIO_04 4510 5.48 4.39 5.67 83 XM_DIRTYINTL 4509 1.20 4.39 0.62 84 MIME_HTML_MOSTLY 4482 2.64 4.36 2.33 85 FROM_EXCESS_BASE64 4372 2.94 4.25 2.70 86 HELO_NODOT 4367 2.05 4.25 1.66 87 HELO_NO_DOMAIN 4367 2.05 4.25 1.66 88 LOADSA_MONEY_COMBO 4362 0.77 4.24 0.15 89 RCVD_IN_MSPIKE_H3 4335 13.47 4.22 15.14 90 XMStrtUSub 4266 4.30 4.15 4.33 91 XM_B_Phish66 3986 2.28 3.88 1.99 92 TR_XM_COVIDMETA4 3971 1.26 3.86 0.78 93 TR_LOTS_OF_MONEY1 3958 0.61 3.85 0.02 94 XM_SendGrid 3817 6.01 3.71 6.43 95 RCVD_IN_MSPIKE_L3 3814 1.07 3.71 0.59 96 TM2_M_URI_OPT_OUT 3621 3.35 3.52 3.31 97 XM_B_SpammyTLD 3547 2.12 3.45 1.88 98 XFER_LOTSA_MONEY 3528 0.59 3.43 0.07 99 ADVANCE_FEE_2_NEW_MONEY 3462 0.53 3.37 0.02 100 TR_XM_INV_DKIM 3409 0.68 3.32 0.20 101 TR_XM_UnparsRelay 3384 0.99 3.29 0.57 102 TR_Mismatch_TLD_02 3373 0.61 3.28 0.13 103 URIBL_SBL_A 3360 0.66 3.27 0.19 104 PDS_OTHER_BAD_TLD 3345 0.78 3.26 0.34 105 HTML_IMAGE_RATIO_08 3262 2.79 3.17 2.72 106 XMNumbers 3209 3.31 3.12 3.34 107 RCVD_IN_MSPIKE_H4 3172 8.55 3.09 9.54 108 HTML_IMAGE_RATIO_06 3143 4.01 3.06 4.18 109 TR_Orig_Subnet 3131 0.48 3.05 0.02 110 RELAYCOUNTRY_MU 3073 0.46 2.99 0.00 111 XM_URI_RBL 2998 0.62 2.92 0.21 112 XMHTML_After_End 2941 1.49 2.86 1.24 113 RELAYCOUNTRY_FR 2907 0.67 2.83 0.28 114 DATE_IN_PAST_03_06 2783 0.52 2.71 0.12 115 TR_XM_MaxBayes 2726 0.44 2.65 0.04 116 RELAYCOUNTRY_RU 2689 0.67 2.62 0.32 117 XM_UB80 2681 0.45 2.61 0.06 118 XM_JunkDunk 2666 0.40 2.59 0.00 119 XMSubEmpty 2625 0.57 2.55 0.22 120 TR_Sbj_FN_Bdy 2601 0.51 2.53 0.14 121 KHOP_HELO_FCRDNS 2567 1.85 2.50 1.73 122 TR_Symld_Words 2565 1.74 2.50 1.61 123 TR_XM_MaxSPIKE 2560 0.43 2.49 0.06 124 DATE_IN_PAST_06_12 2429 0.43 2.36 0.07 125 TR_XM_COVIDMETA1 2333 0.84 2.27 0.58 126 XM_H_UnderscoreDoc 2318 0.36 2.26 0.02 127 TR_XM_MaxWHORU 2274 0.38 2.21 0.04 128 HTML_FONT_TINY_NORDNS 2269 0.57 2.21 0.27 129 BAYES_40 2262 4.14 2.20 4.49 130 MISSING_SUBJECT 2259 0.41 2.20 0.08 131 XMNoSubject 2259 0.41 2.20 0.08 132 XM_CamelCaseFrm001 2248 1.86 2.19 1.80 133 XM_UB60 2225 0.48 2.17 0.18 134 XMSubMetaSSx_00 2191 0.70 2.13 0.44 135 XM_UB95 2117 0.33 2.06 0.02 136 URI_HEX 2113 3.58 2.06 3.85 137 TR_XM_PHPForged 2103 0.68 2.05 0.43 138 TR_XM_PHPDW 2097 0.68 2.04 0.43 139 XM_ShortIntro_01 2091 0.76 2.03 0.53 140 MIME_QP_LONG_LINE 2090 5.04 2.03 5.58 141 TR_XM_FormFill2 2075 0.67 2.02 0.43 142 XM_H_PHPOS 2068 0.66 2.01 0.42 143 T_TooManySym_01 2067 3.99 2.01 4.34 144 IMG_ONLY_FM_DOM_INFO 1939 0.29 1.89 0.00 145 XM_B_Unsub2 1876 2.91 1.83 3.10 146 URI_TRY_3LD 1842 1.43 1.79 1.37 147 MIME_HTML_ONLY_MULTI 1825 2.97 1.78 3.18 148 XMSexyCombo_01 1813 0.89 1.76 0.73 149 T_XMDrugObfuBody_14 1795 1.60 1.75 1.57 150 TR_XM_RelayPhish 1771 0.39 1.72 0.15 151 URI_PHP_REDIR 1755 0.27 1.71 0.01 152 XMReplyNow 1648 0.35 1.60 0.12 153 TR_XM_DK_SendGrid 1641 3.35 1.60 3.67 154 RELAYCOUNTRY_NL 1635 0.43 1.59 0.22 155 RELAYCOUNTRY_JP 1624 0.27 1.58 0.03 156 BAYES_20 1609 3.14 1.57 3.43 157 T_Symld_Words_02 1587 0.75 1.54 0.61 158 ALL_TRUSTED 1582 12.70 1.54 14.72 159 TM2_M_VERY_LONG_WORD 1541 1.12 1.50 1.06 160 XM_PDF 1521 3.93 1.48 4.37 161 T_FILL_THIS_FORM_SHORT 1511 0.99 1.47 0.90 162 HTML_IMAGE_ONLY_16 1481 0.44 1.44 0.25 163 XMSubNoVowel 1472 3.16 1.43 3.48 164 DKIM_ADSP_CUSTOM_MED 1432 1.07 1.39 1.01 165 TR_Caps_n_Bayes_99 1416 0.32 1.38 0.13 166 RELAYCOUNTRY_GB 1412 0.97 1.37 0.89 167 XMGppyBdWords 1386 0.35 1.35 0.17 168 RDNS_DYNAMIC 1352 0.48 1.32 0.33 169 RELAYCOUNTRY_IN 1336 0.31 1.30 0.13 170 XM_DK_Undo_01 1335 1.66 1.30 1.73 171 MAILING_LIST_MULTI 1330 2.13 1.29 2.28 172 NML_ADSP_CUSTOM_MED 1305 0.82 1.27 0.74 173 MPART_ALT_DIFF_COUNT 1294 0.42 1.26 0.26 174 T_XMHurry_00 1290 0.78 1.26 0.69 175 RELAYCOUNTRY_CN 1273 0.26 1.24 0.08 176 XMStockSpam_06 1268 1.05 1.23 1.02 177 RCVD_IN_RP_SAFE 1244 5.89 1.21 6.74 178 TR_XM_DocInvoice 1214 0.18 1.18 0.00 179 XM_RXBody 1205 0.49 1.17 0.37 180 XMGenDplmaNmb 1199 1.02 1.17 0.99 181 FILL_THIS_FORM 1193 0.35 1.16 0.20 182 URI_NOVOWEL 1189 2.08 1.16 2.25 183 XMBody_78 1182 0.57 1.15 0.47 184 FORGED_GMAIL_RCVD 1182 0.60 1.15 0.50 185 T_XMDrugObfuBody_00 1116 0.74 1.09 0.67 186 TR_Mismatch_TLD_01 1109 0.37 1.08 0.24 187 URG_BIZ 1108 0.21 1.08 0.05 188 XMMoneyMeta_00 1090 0.84 1.06 0.80 189 XMPhish14 1052 0.59 1.02 0.52 190 FILL_THIS_FORM_LONG 1051 0.22 1.02 0.07 191 XMSubMetaSxObfu_03 1031 0.64 1.00 0.58 192 SUBJ_DOLLARS 1015 0.57 0.99 0.49 193 URIBL_BLACK 993 0.17 0.97 0.03 194 PDS_BTC_ID 993 0.17 0.97 0.03 195 MIME_CHARSET_FARAWAY 979 0.23 0.95 0.10 196 TR_MetaPhish_Combo_01 963 0.91 0.94 0.90 197 T_FILL_THIS_FORM_LOAN 932 0.19 0.91 0.06 198 RCVD_IN_IADB_LISTED 929 4.40 0.90 5.03 199 XM_OfRef7 923 0.26 0.90 0.14 200 BAYES_00 903 11.30 0.88 13.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 557635 97.95 97.01 98.12 2 HTML_MESSAGE 512179 90.55 92.97 90.12 3 RELAYCOUNTRY_US 459787 78.19 63.23 80.90 4 DKIM_SIGNED 430790 74.73 68.85 75.80 5 XM_DK_Pass 424563 73.49 66.77 74.70 6 XM_B_Unicode 413339 72.25 69.63 72.73 7 DKIM_VALID 400016 68.45 57.77 70.38 8 BAYES_50 307427 51.32 35.97 54.09 9 DKIM_VALID_AU 300214 51.29 42.80 52.82 10 XMListUnsubscribeExists 299515 53.87 60.31 52.70 11 XM_B_Unicode3 227110 38.64 31.35 39.96 12 T_TM2_M_HEADER_IN_MSG 162499 28.80 29.93 28.59 13 DKIM_VALID_EF 155866 27.36 27.01 27.42 14 HTML_FONT_LOW_CONTRAST 155711 26.43 21.05 27.40 15 RCVD_IN_MSPIKE_WL 150566 23.59 7.52 26.49 16 RCVD_IN_MSPIKE_H2 141065 24.98 25.86 24.82 17 LOC_TINY_FONT_1 140889 25.33 28.35 24.79 18 FVGT_m_MULTI_ODD 132623 23.34 23.37 23.33 19 XMSubLong 124997 21.83 20.91 21.99 20 MIME_HTML_ONLY 118841 22.18 29.22 20.91 21 T_KAM_HTML_FONT_INVALID 105057 18.73 20.06 18.48 22 RCVD_IN_MSPIKE_H3 86075 13.47 4.22 15.14 23 ALL_TRUSTED 83675 12.70 1.54 14.72 24 XM_Body_Dirty_Words 79101 14.32 16.52 13.92 25 BAYES_00 74906 11.30 0.88 13.18 26 XM_Multi_Part_URI 68892 13.42 20.62 12.12 27 XM_DK_Undo_02 62993 16.06 43.62 11.08 28 XM_B_Unsub 60990 10.50 9.21 10.73 29 RCVD_IN_MSPIKE_H4 54202 8.55 3.09 9.54 30 LotsOfNums_01 51965 9.13 9.04 9.14 31 LOTS_OF_MONEY 48810 10.44 20.71 8.59 32 XM_Evil_Numbers_Gen 47854 8.42 8.44 8.42 33 TooManyTo_001 46625 7.71 4.95 8.20 34 TR_XM_DK_Bayes 44868 6.77 0.56 7.89 35 BAYES_60 43890 7.49 6.22 7.72 36 TR_XM_DK_Bayes1 41947 6.31 0.41 7.38 37 UNPARSEABLE_RELAY 41413 6.98 5.30 7.29 38 BAYES_99 40564 12.19 40.14 7.14 39 XM_B_Phish_Phrases 40132 8.41 15.89 7.06 40 HTML_IMAGE_RATIO_02 39119 6.87 6.82 6.88 41 RCVD_IN_RP_SAFE 38282 5.89 1.21 6.74 42 XM_DKIMWhitelistDomains 37285 5.56 0.00 6.56 43 TR_XM_DK_Bayes2 37158 5.57 0.23 6.54 44 XM_SendGrid 36524 6.01 3.71 6.43 45 IN_ZIMBRA_NJ_WHITELIST 36214 5.40 0.02 6.37 46 RCVD_IN_RP_CERTIFIED 36105 5.51 0.82 6.35 47 HTML_IMAGE_RATIO_04 32238 5.48 4.39 5.67 48 BAYES_999 31790 9.54 31.38 5.59 49 MIME_QP_LONG_LINE 31734 5.04 2.03 5.58 50 RELAYCOUNTRY_META 31627 9.13 28.86 5.56 51 XM_H_Long_From01 31456 5.56 5.68 5.53 52 DKIM_INVALID 30774 6.28 11.08 5.41 53 BOTNET_IPINHOSTNAME 30464 6.76 14.53 5.36 54 RCVD_IN_IADB_LISTED 28612 4.40 0.90 5.03 55 MPART_ALT_DIFF 28433 5.71 9.65 5.00 56 BAYES_80 28193 5.33 7.37 4.96 57 BAYES_40 25540 4.14 2.20 4.49 58 RCVD_IN_IADB_SPF 25037 3.86 0.81 4.41 59 XM_PDF 24834 3.93 1.48 4.37 60 T_TooManySym_01 24678 3.99 2.01 4.34 61 XMStrtUSub 24604 4.30 4.15 4.33 62 HTML_IMAGE_RATIO_06 23758 4.01 3.06 4.18 63 XMSubMetaSx_00 23029 5.09 10.81 4.05 64 XMSexyCombo_05 22674 5.43 13.38 3.99 65 RCVD_IN_IADB_SENDERID 22572 3.48 0.78 3.97 66 RCVD_IN_IADB_DK 21974 3.39 0.77 3.87 67 URI_HEX 21885 3.58 2.06 3.85 68 TR_XM_DK_SendGrid 20851 3.35 1.60 3.67 69 XMSubNoVowel 19757 3.16 1.43 3.48 70 TR_XM_PhishingBody 19608 3.90 6.37 3.45 71 BAYES_20 19476 3.14 1.57 3.43 72 XMNumbers 18983 3.31 3.12 3.34 73 TM2_M_URI_OPT_OUT 18837 3.35 3.52 3.31 74 T_REMOTE_IMAGE 18353 3.68 6.19 3.23 75 MIME_HTML_ONLY_MULTI 18101 2.97 1.78 3.18 76 XM_UncommonTLD01 17654 6.33 24.18 3.11 77 XM_B_Unsub2 17645 2.91 1.83 3.10 78 RCVD_IN_IADB_VOUCHED 17089 2.59 0.28 3.01 79 BOTNET 16296 6.68 27.74 2.87 80 BAYES_95 16088 3.15 4.94 2.83 81 HTML_IMAGE_RATIO_08 15438 2.79 3.17 2.72 82 FROM_EXCESS_BASE64 15348 2.94 4.25 2.70 83 ANY_BOUNCE_MESSAGE 15155 2.36 0.69 2.67 84 BOUNCE_MESSAGE 15152 2.36 0.69 2.67 85 HTML_MIME_NO_HTML_TAG 14903 3.56 8.74 2.62 86 XM_H_Trusted_IP 14042 2.09 0.00 2.47 87 NO_DNS_FOR_FROM 13704 3.12 7.07 2.41 88 MIME_HTML_MOSTLY 13242 2.64 4.36 2.33 89 UNTRUSTED_Relay 13218 6.25 27.98 2.33 90 MAILING_LIST_MULTI 12969 2.13 1.29 2.28 91 URI_NOVOWEL 12772 2.08 1.16 2.25 92 BAYES_05 12250 1.93 0.71 2.16 93 T_TooManySym_02 12152 1.92 0.73 2.14 94 RCVD_IN_IADB_OPTIN 11356 1.74 0.29 2.00 95 XM_B_Phish66 11332 2.28 3.88 1.99 96 TooManyTo_002 10834 1.73 0.77 1.91 97 XM_SPF_SoftFail 10680 3.27 10.96 1.88 98 XM_B_SpammyTLD 10669 2.12 3.45 1.88 99 RELAYCOUNTRY_CA 10415 2.57 6.63 1.83 100 RCVD_IN_MSPIKE_H5 10289 1.57 0.22 1.81 101 XM_CamelCaseFrm001 10239 1.86 2.19 1.80 102 T_XMDrugObfuBody_08 10067 2.59 7.15 1.77 103 TVD_RCVD_IP 10014 1.55 0.37 1.76 104 XM_DK_Undo_01 9834 1.66 1.30 1.73 105 KHOP_HELO_FCRDNS 9827 1.85 2.50 1.73 106 HELO_NODOT 9416 2.05 4.25 1.66 107 HELO_NO_DOMAIN 9411 2.05 4.25 1.66 108 XMDiploma_00 9322 2.28 5.84 1.64 109 TR_Symld_Words 9132 1.74 2.50 1.61 110 T_XMDrugObfuBody_14 8911 1.60 1.75 1.57 111 XM_B_COVIDMETA 8886 2.14 5.31 1.56 112 RCVD_IN_BL_SPAMCOP_NET 8202 3.26 13.32 1.44 113 SUBJ_ALL_CAPS 8188 2.10 5.71 1.44 114 URI_TRY_3LD 7763 1.43 1.79 1.37 115 HELO_MISC_IP 7753 1.23 0.49 1.36 116 CK_HELO_DYNAMIC_SPLIT_IP 7748 1.24 0.55 1.36 117 IN_HORDE_ADDRESS_BOOK 7579 1.13 0.03 1.33 118 XM_OfRef6 7512 1.82 4.60 1.32 119 XMBrknScrpt_02 7490 1.83 4.67 1.32 120 INVALID_MSGID 7425 1.13 0.16 1.31 121 TooManyTo_003 7395 1.18 0.54 1.30 122 XMHTML_After_End 7064 1.49 2.86 1.24 123 XM_UB50 6941 2.62 10.38 1.22 124 XM_GoogleGroups 6792 1.08 0.42 1.20 125 XM_H_Long_From02 6688 1.11 0.73 1.18 126 XMBody_17 6535 2.45 9.61 1.15 127 HTML_FONT_FACE_BAD 6480 1.09 0.79 1.14 128 TO_MALFORMED 6478 0.97 0.03 1.14 129 XMGappySubj_01 6403 0.98 0.17 1.13 130 XM_ProductURIs 6353 1.05 0.67 1.12 131 USER_IN_DEF_DKIM_WL 6196 0.92 0.00 1.09 132 XMCapTrack 6077 1.00 0.60 1.07 133 TM2_M_VERY_LONG_WORD 5997 1.12 1.50 1.06 134 XMStockSpam_06 5809 1.05 1.23 1.02 135 DKIM_ADSP_CUSTOM_MED 5749 1.07 1.39 1.01 136 XMGenDplmaNmb 5613 1.02 1.17 0.99 137 TooManyTo_004 5524 0.89 0.47 0.97 138 RCVD_IN_MSPIKE_BL 5261 3.11 15.18 0.93 139 TR_LOTS_OF_MONEY3 5186 2.20 9.29 0.91 140 SpammyFromTLD_01 5164 2.27 9.83 0.91 141 T_FILL_THIS_FORM_SHORT 5121 0.99 1.47 0.90 142 TR_MetaPhish_Combo_01 5115 0.91 0.94 0.90 143 RELAYCOUNTRY_GB 5082 0.97 1.37 0.89 144 T_TooManySym_03 4877 0.75 0.18 0.86 145 TR_MSPIKEBAYES00 4829 0.72 0.01 0.85 146 XMMoneyMeta_00 4554 0.84 1.06 0.80 147 TR_XM_COVIDMETA4 4452 1.26 3.86 0.78 148 TooManyTo_005 4375 0.71 0.37 0.77 149 XMBody_95 4327 0.66 0.11 0.76 150 XMBdyGiftCard01 4323 0.73 0.55 0.76 151 TR_BOTNET_NEGATE 4187 0.67 0.33 0.74 152 NML_ADSP_CUSTOM_MED 4186 0.82 1.27 0.74 153 XMSexyCombo_01 4162 0.89 1.76 0.73 154 T_XMHurry_00 3949 0.78 1.26 0.69 155 T_XMDrugObfuBody_00 3828 0.74 1.09 0.67 156 HTTPS_HTTP_MISMATCH 3762 0.66 0.62 0.66 157 MISSING_HEADERS 3562 1.25 4.69 0.63 158 XMHTMLBadTable_001 3562 0.59 0.36 0.63 159 XM_DIRTYINTL 3537 1.20 4.39 0.62 160 T_Symld_Words_02 3447 0.75 1.54 0.61 161 XM_SPF_Unknown 3431 0.64 0.85 0.60 162 RCVD_IN_MSPIKE_L3 3351 1.07 3.71 0.59 163 TR_XM_COVIDMETA1 3300 0.84 2.27 0.58 164 XMSubMetaSxObfu_03 3281 0.64 1.00 0.58 165 TR_XM_UnparsRelay 3247 0.99 3.29 0.57 166 T_OBFU_PDF_ATTACH 3106 0.50 0.22 0.55 167 DKIM_ADSP_NXDOMAIN 3066 1.24 5.13 0.54 168 XM_ShortIntro_01 2997 0.76 2.03 0.53 169 XMPhish14 2929 0.59 1.02 0.52 170 XMOemUri 2912 0.51 0.47 0.51 171 FORGED_GMAIL_RCVD 2846 0.60 1.15 0.50 172 SUBJ_DOLLARS 2798 0.57 0.99 0.49 173 XMPhish30 2784 0.53 0.78 0.49 174 XMSubMetaI_00 2722 0.51 0.69 0.48 175 FROM_GOV_SPOOF 2667 0.43 0.19 0.47 176 FROM_GOV_DKIM_AU 2656 0.40 0.05 0.47 177 XMNoVowels 2653 0.46 0.44 0.47 178 XMBody_78 2652 0.57 1.15 0.47 179 HTML_TAG_BALANCE_BODY 2607 0.49 0.68 0.46 180 XM_B_REG_HTML 2587 0.41 0.18 0.46 181 RELAYCOUNTRY_AU 2575 0.47 0.55 0.45 182 HTML_IMAGE_ONLY_20 2554 0.43 0.30 0.45 183 XMPhish08 2509 0.49 0.75 0.44 184 XMSubMetaSSx_00 2507 0.70 2.13 0.44 185 T_TooManySym_04 2506 0.38 0.07 0.44 186 XMBSHREFv2 2485 0.42 0.34 0.44 187 TR_XM_PHPDW 2452 0.68 2.04 0.43 188 HTML_IMAGE_ONLY_32 2447 0.41 0.27 0.43 189 TR_XM_PHPForged 2430 0.68 2.05 0.43 190 TR_XM_FormFill2 2428 0.67 2.02 0.43 191 NUMERIC_HTTP_ADDR 2413 0.44 0.51 0.42 192 XMLngstWrd_00 2411 0.47 0.73 0.42 193 XM_H_PHPOS 2386 0.66 2.01 0.42 194 RCVD_IN_SORBS_DUL 2379 0.40 0.31 0.42 195 XM_H_PHPMailer 2377 0.47 0.79 0.42 196 HTML_IMAGE_ONLY_28 2299 0.41 0.47 0.40 197 XM_S_SubURI 2297 0.35 0.04 0.40 198 DIET_1 2294 0.47 0.86 0.40 199 PLING_QUERY 2267 0.42 0.57 0.40 200 SHORT_HELO_AND_INLINE_IMAGE 2190 0.34 0.10 0.39 ----------------------------------------------------------------------