Email: 649569 Autolearn: 0 AvgScore: 0.56 AvgScanTime: 1.95 sec Spam: 91061 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 3.91 sec Ham: 558508 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 1.63 sec Time Spent Running SA: 351.93 hours Time Spent Processing Spam: 98.86 hours Time Spent Processing Ham: 253.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 88153 98.04 96.81 98.24 2 HTML_MESSAGE 83509 90.61 91.71 90.44 3 DKIM_SIGNED 71984 78.36 79.05 78.25 4 XM_DK_Pass 69145 76.99 75.93 77.16 5 XM_B_Unicode 67742 73.24 74.39 73.05 6 XMListUnsubscribeExists 63187 57.50 69.39 55.56 7 RELAYCOUNTRY_US 59484 80.11 65.32 82.52 8 DKIM_VALID 57478 71.53 63.12 72.90 9 XM_DK_Undo_02 49256 18.18 54.09 12.33 10 DKIM_VALID_AU 42900 53.75 47.11 54.83 11 BAYES_99 35346 12.07 38.82 7.71 12 BAYES_50 32149 51.90 35.30 54.61 13 XM_B_Unicode3 31910 41.67 35.04 42.75 14 RELAYCOUNTRY_META 29594 9.63 32.50 5.90 15 DKIM_VALID_EF 29085 28.45 31.94 27.88 16 LOC_TINY_FONT_1 28547 26.51 31.35 25.72 17 BOTNET 28273 7.19 31.05 3.31 18 BAYES_999 26611 9.34 29.22 6.10 19 HTML_FONT_LOW_CONTRAST 25479 29.17 27.98 29.37 20 MIME_HTML_ONLY 23935 22.91 26.28 22.36 21 XMSubLong 23860 21.94 26.20 21.25 22 FVGT_m_MULTI_ODD 23190 24.50 25.47 24.34 23 RCVD_IN_MSPIKE_H2 22479 25.36 24.69 25.47 24 UNTRUSTED_Relay 22322 5.66 24.51 2.58 25 T_KAM_HTML_FONT_INVALID 21282 19.49 23.37 18.86 26 T_TM2_M_HEADER_IN_MSG 21113 27.74 23.19 28.48 27 XM_Body_Dirty_Words 18171 15.38 19.95 14.64 28 XM_Multi_Part_URI 16673 13.48 18.31 12.69 29 XM_UncommonTLD01 15927 5.10 17.49 3.08 30 DKIM_INVALID 14506 6.83 15.93 5.34 31 BOTNET_IPINHOSTNAME 14174 7.48 15.57 6.17 32 LOTS_OF_MONEY 13023 8.79 14.30 7.89 33 RCVD_IN_MSPIKE_BL 12230 2.81 13.43 1.07 34 NO_DNS_FOR_FROM 11334 4.24 12.45 2.90 35 XM_B_Unsub 10994 10.68 12.07 10.46 36 XMSexyCombo_05 10415 5.43 11.44 4.45 37 XM_B_Phish_Phrases 10226 8.31 11.23 7.84 38 MPART_ALT_DIFF 10131 5.75 11.13 4.87 39 RCVD_IN_BL_SPAMCOP_NET 8729 2.86 9.59 1.77 40 XM_Evil_Numbers_Gen 8549 9.40 9.39 9.40 41 LotsOfNums_01 7876 8.87 8.65 8.90 42 BAYES_80 7836 5.22 8.61 4.67 43 XM_SPF_SoftFail 7802 2.84 8.57 1.91 44 HTML_IMAGE_RATIO_02 7697 7.16 8.45 6.95 45 MIME_HTML_MOSTLY 7671 3.20 8.42 2.35 46 RCVD_IN_MSPIKE_WL 7564 25.17 8.31 27.92 47 SpammyFromTLD_01 7282 1.89 8.00 0.89 48 TR_XM_PhishingBody 7145 4.16 7.85 3.56 49 XM_UB99 7102 1.10 7.80 0.01 50 XM_UB50 6961 2.22 7.64 1.33 51 BAYES_60 6960 7.35 7.64 7.30 52 XMSubMetaSx_00 6707 4.83 7.37 4.42 53 RELAYCOUNTRY_CA 6453 2.73 7.09 2.02 54 RCVD_IN_RP_RNBL 6355 1.09 6.98 0.13 55 RCVD_IN_MSPIKE_L5 5796 1.14 6.36 0.29 56 RCVD_IN_MSPIKE_L3 5657 1.49 6.21 0.72 57 TooManyTo_001 5416 7.80 5.95 8.10 58 RCVD_IN_PSBL 5365 0.83 5.89 0.01 59 URI_PHP_REDIR 5342 1.01 5.87 0.21 60 XM_B_COVIDMETA 5192 3.06 5.70 2.62 61 XM_H_Long_From01 5123 5.40 5.63 5.36 62 XM_B_Phish66 4965 2.43 5.45 1.93 63 HTML_IMAGE_RATIO_04 4898 6.40 5.38 6.57 64 UNPARSEABLE_RELAY 4817 7.18 5.29 7.49 65 RELAYCOUNTRY_RU 4791 1.12 5.26 0.44 66 RELAYCOUNTRY_FR 4694 1.02 5.15 0.35 67 TR_XM_COVIDMETA4 4576 1.42 5.03 0.83 68 XM_DIRTYINTL 4560 1.26 5.01 0.64 69 XM_UB999 4509 0.70 4.95 0.00 70 RCVD_IN_MSPIKE_H3 4496 14.17 4.94 15.67 71 BAYES_95 4399 3.00 4.83 2.71 72 XMNumbers 4312 3.48 4.74 3.28 73 BOTNET_NORDNS 4232 0.67 4.65 0.02 74 TR_XM_INV_DKIM 4039 0.72 4.44 0.11 75 SpammyFromTLD_02 4011 0.93 4.40 0.36 76 XM_B_SpammyTLD 3992 2.65 4.38 2.37 77 XM_OfRef6 3932 1.58 4.32 1.14 78 XM_SendGrid 3866 6.16 4.25 6.47 79 T_XMDrugObfuBody_08 3510 1.98 3.85 1.68 80 XMBody_17 3411 1.50 3.75 1.13 81 TR_XM_MaxSPIKE 3410 0.60 3.74 0.09 82 T_FILL_THIS_FORM_SHORT 3362 1.39 3.69 1.02 83 SUBJ_ALL_CAPS 3250 1.96 3.57 1.70 84 TR_XM_MaxWHORU 3175 0.53 3.49 0.05 85 TM2_M_URI_OPT_OUT 3068 4.31 3.37 4.46 86 XM_UB80 3026 0.54 3.32 0.09 87 XMStrtUSub 2945 4.69 3.23 4.93 88 TR_XM_COVIDMETA1 2939 0.90 3.23 0.52 89 RCVD_IN_MSPIKE_H4 2830 9.36 3.11 10.38 90 XM_URI_RBL 2764 0.63 3.04 0.24 91 XMDiploma_00 2676 2.05 2.94 1.91 92 TR_XM_PHPDW 2637 0.80 2.90 0.45 93 HTML_IMAGE_RATIO_08 2606 2.70 2.86 2.67 94 URIBL_SBL_A 2587 0.52 2.84 0.14 95 MIME_QP_LONG_LINE 2584 5.30 2.84 5.71 96 TR_XM_UnparsRelay 2561 0.85 2.81 0.53 97 XMBrknScrpt_02 2513 1.29 2.76 1.05 98 T_REMOTE_IMAGE 2472 3.39 2.71 3.50 99 XM_UB60 2462 0.56 2.70 0.21 100 HTML_IMAGE_RATIO_06 2458 3.29 2.70 3.39 101 T_XMDrugObfuBody_14 2430 2.36 2.67 2.31 102 TR_XM_MaxBayes 2400 0.41 2.64 0.04 103 KHOP_HELO_FCRDNS 2349 1.77 2.58 1.64 104 TR_XM_PHPForged 2325 0.71 2.55 0.41 105 XMSexyCombo_01 2313 1.59 2.54 1.43 106 TR_XM_FormFill2 2296 0.71 2.52 0.41 107 XM_H_PHPOS 2293 0.70 2.52 0.40 108 TR_LOTS_OF_MONEY3 2259 0.90 2.48 0.65 109 TR_Symld_Words 2132 1.87 2.34 1.80 110 TR_Mismatch_TLD_02 2131 0.42 2.34 0.10 111 DKIM_ADSP_CUSTOM_MED 2121 1.27 2.33 1.10 112 RELAYCOUNTRY_GB 1971 1.02 2.16 0.83 113 T_TooManySym_01 1948 3.91 2.14 4.20 114 XM_CamelCaseFrm001 1943 1.90 2.13 1.87 115 NML_ADSP_CUSTOM_MED 1941 0.94 2.13 0.75 116 XM_B_Unsub2 1930 2.24 2.12 2.26 117 ALL_TRUSTED 1928 11.15 2.12 12.63 118 HTML_MIME_NO_HTML_TAG 1914 3.01 2.10 3.16 119 XMGppyBdWords 1913 0.52 2.10 0.26 120 RELAYCOUNTRY_DE 1898 0.57 2.08 0.32 121 XM_UB95 1879 0.31 2.06 0.03 122 URI_HEX 1865 1.83 2.05 1.79 123 T_XMDrugObfuBody_00 1839 0.91 2.02 0.73 124 TM2_M_VERY_LONG_WORD 1838 1.33 2.02 1.22 125 T_PDS_OTHER_BAD_TLD 1796 0.66 1.97 0.44 126 FORGED_GMAIL_RCVD 1789 0.75 1.96 0.55 127 FROM_EXCESS_BASE64 1772 2.76 1.95 2.89 128 BAYES_40 1726 4.12 1.90 4.48 129 MIME_HTML_ONLY_MULTI 1711 2.87 1.88 3.03 130 FROM_SUSPICIOUS_NTLD 1695 0.33 1.86 0.08 131 XM_OfRef7 1695 0.37 1.86 0.13 132 TR_Caps_n_Bayes_99 1681 0.31 1.85 0.06 133 TR_XM_RelayPhish 1647 0.40 1.81 0.17 134 MAILING_LIST_MULTI 1635 2.17 1.80 2.23 135 TR_XM_FormFill 1576 0.30 1.73 0.06 136 FROM_SUSPICIOUS_NTLD_FP 1569 0.30 1.72 0.07 137 URI_TRY_3LD 1529 1.86 1.68 1.88 138 TR_MetaPhish_Combo_01 1472 0.84 1.62 0.71 139 TR_XM_DK_SendGrid 1404 3.47 1.54 3.78 140 HELO_NODOT 1397 1.44 1.53 1.42 141 HELO_NO_DOMAIN 1397 1.44 1.53 1.42 142 RDNS_DYNAMIC 1389 0.52 1.53 0.35 143 XMSexyCombo_04 1381 0.34 1.52 0.15 144 XMSubNoVowel 1333 0.89 1.46 0.79 145 HTML_IMAGE_ONLY_12 1314 0.38 1.44 0.21 146 XMStockSpam_06 1314 1.06 1.44 0.99 147 XMHTML_After_End 1313 0.98 1.44 0.91 148 IMG_ONLY_FM_DOM_INFO 1288 0.20 1.41 0.00 149 XMSubject_38 1265 0.20 1.39 0.00 150 URI_NOVOWEL 1265 1.99 1.39 2.09 151 XM_PDF 1260 3.85 1.38 4.26 152 LongTLD 1257 0.32 1.38 0.15 153 XM_SPF_Unknown 1256 0.73 1.38 0.62 154 XMGenDplmaNmb 1241 1.25 1.36 1.23 155 BAYES_20 1232 3.04 1.35 3.32 156 DATE_IN_PAST_03_06 1219 0.32 1.34 0.15 157 XMDateMe_00 1217 0.45 1.34 0.30 158 RELAYCOUNTRY_IN 1196 0.26 1.31 0.09 159 HK_RANDOM_REPLYTO 1182 0.40 1.30 0.26 160 NUMERIC_HTTP_ADDR 1171 0.62 1.29 0.51 161 XM_BadFromFormat 1170 0.36 1.28 0.21 162 XMMoneyMeta_00 1159 0.70 1.27 0.61 163 T_XMHurry_00 1156 0.80 1.27 0.73 164 XMBody_78 1152 0.53 1.27 0.41 165 XM_H_PHPMailer 1134 0.63 1.25 0.53 166 XM_DK_Undo_01 1131 1.65 1.24 1.71 167 RCVD_IN_IADB_LISTED 1118 4.29 1.23 4.79 168 XMSubMetaSxObfu_03 1058 1.12 1.16 1.11 169 FSL_HELO_NON_FQDN_1 1056 0.18 1.16 0.02 170 MPART_ALT_DIFF_COUNT 1055 0.51 1.16 0.40 171 FROM_WORDY 1052 0.18 1.16 0.02 172 XM_Nigeria_01 1045 0.23 1.15 0.08 173 MISSING_HEADERS 1035 0.52 1.14 0.41 174 RCVD_IN_IADB_SPF 1008 3.75 1.11 4.19 175 RCVD_IN_IADB_DK 973 3.29 1.07 3.65 176 RCVD_IN_IADB_SENDERID 969 3.38 1.06 3.76 177 MIME_CHARSET_FARAWAY 955 0.22 1.05 0.09 178 ADVANCE_FEE_3_NEW 954 0.15 1.05 0.00 179 URI_WP_HACKED_2 943 0.17 1.04 0.03 180 TR_Mismatch_TLD_01 936 0.36 1.03 0.25 181 URI_WP_DIRINDEX 931 0.15 1.02 0.00 182 THIS_AD 923 0.45 1.01 0.36 183 DATE_IN_PAST_06_12 913 0.23 1.00 0.10 184 RELAYCOUNTRY_IT 905 0.18 0.99 0.04 185 REMOVE_BEFORE_LINK 893 0.43 0.98 0.34 186 MONEY_FRAUD_5 876 0.14 0.96 0.01 187 XMSubMetaI_00 875 0.95 0.96 0.95 188 T_Symld_Words_02 866 0.60 0.95 0.54 189 DIET_1 865 0.63 0.95 0.58 190 XM_H_Long_From02 853 1.29 0.94 1.34 191 FILL_THIS_FORM 852 0.31 0.94 0.21 192 DKIM_ADSP_NXDOMAIN 851 0.71 0.93 0.68 193 CHARSET_FARAWAY_HEADER 851 0.17 0.93 0.04 194 HELO_MISC_IP 847 1.29 0.93 1.35 195 URIBL_BLACK 846 0.15 0.93 0.03 196 XMPhish08 846 0.58 0.93 0.52 197 XMReplyNow 831 0.26 0.91 0.15 198 HTML_TITLE_SUBJ_DIFF 829 0.18 0.91 0.06 199 INVESTMENT_ADVICE 825 0.25 0.91 0.14 200 XM_H_MailChimp 824 0.32 0.90 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 548683 98.04 96.81 98.24 2 HTML_MESSAGE 505096 90.61 91.71 90.44 3 RELAYCOUNTRY_US 460874 80.11 65.32 82.52 4 DKIM_SIGNED 437011 78.36 79.05 78.25 5 XM_DK_Pass 430932 76.99 75.93 77.16 6 XM_B_Unicode 407974 73.24 74.39 73.05 7 DKIM_VALID 407178 71.53 63.12 72.90 8 XMListUnsubscribeExists 310327 57.50 69.39 55.56 9 DKIM_VALID_AU 306216 53.75 47.11 54.83 10 BAYES_50 304982 51.90 35.30 54.61 11 XM_B_Unicode3 238781 41.67 35.04 42.75 12 HTML_FONT_LOW_CONTRAST 164008 29.17 27.98 29.37 13 T_TM2_M_HEADER_IN_MSG 159089 27.74 23.19 28.48 14 RCVD_IN_MSPIKE_WL 155949 25.17 8.31 27.92 15 DKIM_VALID_EF 155721 28.45 31.94 27.88 16 LOC_TINY_FONT_1 143640 26.51 31.35 25.72 17 RCVD_IN_MSPIKE_H2 142263 25.36 24.69 25.47 18 FVGT_m_MULTI_ODD 135943 24.50 25.47 24.34 19 MIME_HTML_ONLY 124880 22.91 26.28 22.36 20 XMSubLong 118673 21.94 26.20 21.25 21 T_KAM_HTML_FONT_INVALID 105317 19.49 23.37 18.86 22 RCVD_IN_MSPIKE_H3 87522 14.17 4.94 15.67 23 XM_Body_Dirty_Words 81743 15.38 19.95 14.64 24 BAYES_00 72649 11.29 0.78 13.01 25 XM_Multi_Part_URI 70892 13.48 18.31 12.69 26 ALL_TRUSTED 70520 11.15 2.12 12.63 27 XM_DK_Undo_02 68847 18.18 54.09 12.33 28 XM_B_Unsub 58409 10.68 12.07 10.46 29 RCVD_IN_MSPIKE_H4 57978 9.36 3.11 10.38 30 XM_Evil_Numbers_Gen 52492 9.40 9.39 9.40 31 LotsOfNums_01 49730 8.87 8.65 8.90 32 TR_XM_DK_Bayes 45400 7.06 0.47 8.13 33 TooManyTo_001 45219 7.80 5.95 8.10 34 LOTS_OF_MONEY 44072 8.79 14.30 7.89 35 XM_B_Phish_Phrases 43765 8.31 11.23 7.84 36 BAYES_99 43035 12.07 38.82 7.71 37 TR_XM_DK_Bayes1 42249 6.54 0.26 7.56 38 RCVD_IN_RP_SAFE 42233 6.54 0.27 7.56 39 UNPARSEABLE_RELAY 41805 7.18 5.29 7.49 40 BAYES_60 40755 7.35 7.64 7.30 41 XM_DKIMWhitelistDomains 39955 6.15 0.01 7.15 42 RCVD_IN_RP_CERTIFIED 39913 6.17 0.20 7.15 43 HTML_IMAGE_RATIO_02 38821 7.16 8.45 6.95 44 TR_XM_DK_Bayes2 37850 5.86 0.22 6.78 45 HTML_IMAGE_RATIO_04 36670 6.40 5.38 6.57 46 XM_SendGrid 36139 6.16 4.25 6.47 47 BOTNET_IPINHOSTNAME 34440 7.48 15.57 6.17 48 BAYES_999 34084 9.34 29.22 6.10 49 RELAYCOUNTRY_META 32978 9.63 32.50 5.90 50 MIME_QP_LONG_LINE 31872 5.30 2.84 5.71 51 IN_ZIMBRA_NJ_WHITELIST 30363 4.68 0.03 5.44 52 XM_H_Long_From01 29944 5.40 5.63 5.36 53 DKIM_INVALID 29833 6.83 15.93 5.34 54 XMStrtUSub 27547 4.69 3.23 4.93 55 MPART_ALT_DIFF 27216 5.75 11.13 4.87 56 RCVD_IN_IADB_LISTED 26727 4.29 1.23 4.79 57 BAYES_80 26076 5.22 8.61 4.67 58 BAYES_40 25027 4.12 1.90 4.48 59 TM2_M_URI_OPT_OUT 24916 4.31 3.37 4.46 60 XMSexyCombo_05 24849 5.43 11.44 4.45 61 XMSubMetaSx_00 24692 4.83 7.37 4.42 62 XM_PDF 23768 3.85 1.38 4.26 63 T_TooManySym_01 23433 3.91 2.14 4.20 64 RCVD_IN_IADB_SPF 23383 3.75 1.11 4.19 65 TR_XM_DK_SendGrid 21112 3.47 1.54 3.78 66 RCVD_IN_IADB_SENDERID 20990 3.38 1.06 3.76 67 RCVD_IN_IADB_DK 20392 3.29 1.07 3.65 68 TR_XM_PhishingBody 19885 4.16 7.85 3.56 69 T_REMOTE_IMAGE 19553 3.39 2.71 3.50 70 HTML_IMAGE_RATIO_06 18925 3.29 2.70 3.39 71 BAYES_20 18517 3.04 1.35 3.32 72 BOTNET 18460 7.19 31.05 3.31 73 XMNumbers 18304 3.48 4.74 3.28 74 HTML_MIME_NO_HTML_TAG 17653 3.01 2.10 3.16 75 XM_UncommonTLD01 17198 5.10 17.49 3.08 76 MIME_HTML_ONLY_MULTI 16920 2.87 1.88 3.03 77 NO_DNS_FOR_FROM 16221 4.24 12.45 2.90 78 RCVD_IN_IADB_VOUCHED 16180 2.54 0.39 2.90 79 FROM_EXCESS_BASE64 16168 2.76 1.95 2.89 80 BAYES_95 15115 3.00 4.83 2.71 81 HTML_IMAGE_RATIO_08 14926 2.70 2.86 2.67 82 XM_B_COVIDMETA 14653 3.06 5.70 2.62 83 UNTRUSTED_Relay 14421 5.66 24.51 2.58 84 ANY_BOUNCE_MESSAGE 13610 2.18 0.59 2.44 85 BOUNCE_MESSAGE 13607 2.18 0.59 2.44 86 XM_B_SpammyTLD 13239 2.65 4.38 2.37 87 MIME_HTML_MOSTLY 13144 3.20 8.42 2.35 88 T_XMDrugObfuBody_14 12878 2.36 2.67 2.31 89 XM_H_Trusted_IP 12720 1.96 0.00 2.28 90 XM_B_Unsub2 12596 2.24 2.12 2.26 91 MAILING_LIST_MULTI 12477 2.17 1.80 2.23 92 BAYES_05 12349 2.01 0.77 2.21 93 T_TooManySym_02 11965 1.92 0.57 2.14 94 URI_NOVOWEL 11669 1.99 1.39 2.09 95 RELAYCOUNTRY_CA 11289 2.73 7.09 2.02 96 XM_B_Phish66 10804 2.43 5.45 1.93 97 XM_SPF_SoftFail 10669 2.84 8.57 1.91 98 XMDiploma_00 10659 2.05 2.94 1.91 99 RCVD_IN_IADB_OPTIN 10571 1.67 0.33 1.89 100 URI_TRY_3LD 10524 1.86 1.68 1.88 101 RCVD_IN_MSPIKE_H5 10449 1.65 0.26 1.87 102 XM_CamelCaseFrm001 10424 1.90 2.13 1.87 103 TooManyTo_002 10324 1.71 0.89 1.85 104 TR_Symld_Words 10038 1.87 2.34 1.80 105 URI_HEX 9992 1.83 2.05 1.79 106 RCVD_IN_BL_SPAMCOP_NET 9878 2.86 9.59 1.77 107 XM_ProductURIs 9600 1.58 0.76 1.72 108 XM_DK_Undo_01 9566 1.65 1.24 1.71 109 SUBJ_ALL_CAPS 9469 1.96 3.57 1.70 110 T_XMDrugObfuBody_08 9367 1.98 3.85 1.68 111 TVD_RCVD_IP 9320 1.47 0.22 1.67 112 KHOP_HELO_FCRDNS 9172 1.77 2.58 1.64 113 XMSexyCombo_01 8005 1.59 2.54 1.43 114 HELO_NODOT 7953 1.44 1.53 1.42 115 HELO_NO_DOMAIN 7952 1.44 1.53 1.42 116 INVALID_MSGID 7783 1.27 0.52 1.39 117 IN_HORDE_ADDRESS_BOOK 7694 1.19 0.04 1.38 118 HELO_MISC_IP 7523 1.29 0.93 1.35 119 CK_HELO_DYNAMIC_SPLIT_IP 7516 1.28 0.88 1.35 120 XM_H_Long_From02 7503 1.29 0.94 1.34 121 XM_UB50 7433 2.22 7.64 1.33 122 XM_GoogleGroups 7228 1.18 0.50 1.29 123 XMGenDplmaNmb 6871 1.25 1.36 1.23 124 TM2_M_VERY_LONG_WORD 6792 1.33 2.02 1.22 125 TooManyTo_003 6789 1.13 0.61 1.22 126 XMGappySubj_01 6663 1.05 0.20 1.19 127 TO_MALFORMED 6403 0.99 0.03 1.15 128 XM_OfRef6 6352 1.58 4.32 1.14 129 XMBody_17 6332 1.50 3.75 1.13 130 XMSubMetaSxObfu_03 6186 1.12 1.16 1.11 131 DKIM_ADSP_CUSTOM_MED 6117 1.27 2.33 1.10 132 XMCapTrack 5999 1.00 0.54 1.07 133 RCVD_IN_MSPIKE_BL 5996 2.81 13.43 1.07 134 HTML_FONT_FACE_BAD 5990 0.99 0.45 1.07 135 XMBrknScrpt_02 5867 1.29 2.76 1.05 136 T_FILL_THIS_FORM_SHORT 5676 1.39 3.69 1.02 137 XMStockSpam_06 5545 1.06 1.44 0.99 138 USER_IN_DEF_DKIM_WL 5350 0.82 0.01 0.96 139 XMBdyGiftCard01 5324 0.93 0.80 0.95 140 XMSubMetaI_00 5302 0.95 0.96 0.95 141 XMHTML_After_End 5061 0.98 1.44 0.91 142 SpammyFromTLD_01 4981 1.89 8.00 0.89 143 TooManyTo_004 4885 0.82 0.49 0.87 144 RELAYCOUNTRY_GB 4663 1.02 2.16 0.83 145 TR_XM_COVIDMETA4 4657 1.42 5.03 0.83 146 T_TooManySym_03 4612 0.73 0.16 0.83 147 XMSubNoVowel 4432 0.89 1.46 0.79 148 NML_ADSP_CUSTOM_MED 4184 0.94 2.13 0.75 149 T_XMDrugObfuBody_00 4068 0.91 2.02 0.73 150 T_XMHurry_00 4063 0.80 1.27 0.73 151 HTTPS_HTTP_MISMATCH 4044 0.75 0.89 0.72 152 RCVD_IN_MSPIKE_L3 4029 1.49 6.21 0.72 153 TR_MetaPhish_Combo_01 3982 0.84 1.62 0.71 154 TR_MSPIKEBAYES00 3973 0.61 0.00 0.71 155 XMBody_95 3956 0.66 0.39 0.71 156 TooManyTo_005 3954 0.66 0.40 0.71 157 XM_GRM 3934 0.61 0.00 0.70 158 DKIM_ADSP_NXDOMAIN 3791 0.71 0.93 0.68 159 TR_BOTNET_NEGATE 3701 0.62 0.35 0.66 160 XM_RXBody 3638 0.62 0.43 0.65 161 TR_LOTS_OF_MONEY3 3613 0.90 2.48 0.65 162 XM_DIRTYINTL 3594 1.26 5.01 0.64 163 XM_SPF_Unknown 3455 0.73 1.38 0.62 164 XMMoneyMeta_00 3394 0.70 1.27 0.61 165 T_OBFU_PDF_ATTACH 3323 0.54 0.19 0.59 166 XMHTMLBadTable_001 3295 0.58 0.54 0.59 167 DIET_1 3243 0.63 0.95 0.58 168 FROM_GOV_DKIM_AU 3234 0.51 0.11 0.58 169 XM_ShortIntro_01 3156 0.55 0.48 0.57 170 HTML_TAG_BALANCE_BODY 3115 0.59 0.79 0.56 171 XMPhish30 3088 0.58 0.73 0.55 172 FORGED_GMAIL_RCVD 3072 0.75 1.96 0.55 173 T_Symld_Words_02 3024 0.60 0.95 0.54 174 XMPhish14 3006 0.57 0.80 0.54 175 TR_XM_UnparsRelay 2950 0.85 2.81 0.53 176 XM_H_PHPMailer 2943 0.63 1.25 0.53 177 XMPhish08 2916 0.58 0.93 0.52 178 BODY_QUOTE_MALF_MSGID 2889 0.52 0.54 0.52 179 TR_XM_COVIDMETA1 2881 0.90 3.23 0.52 180 HTML_IMAGE_ONLY_20 2873 0.52 0.56 0.51 181 NUMERIC_HTTP_ADDR 2847 0.62 1.29 0.51 182 XMOemUri 2721 0.48 0.46 0.49 183 RELAYCOUNTRY_AU 2591 0.47 0.52 0.46 184 T_TooManySym_04 2554 0.40 0.05 0.46 185 RCVD_IN_SORBS_DUL 2538 0.42 0.19 0.45 186 TR_XM_PHPDW 2538 0.80 2.90 0.45 187 T_PDS_OTHER_BAD_TLD 2470 0.66 1.97 0.44 188 SUBJ_BUY 2462 0.39 0.06 0.44 189 RELAYCOUNTRY_RU 2459 1.12 5.26 0.44 190 XM_B_REG_HTML 2403 0.40 0.19 0.43 191 XMSubMetaSxObfu_02 2384 0.40 0.22 0.43 192 XM_B_COPY_HTML 2364 0.45 0.62 0.42 193 XMBSHREFv2 2353 0.42 0.38 0.42 194 XM_S_SubURI 2319 0.37 0.12 0.42 195 MISSING_HEADERS 2312 0.52 1.14 0.41 196 HTML_IMAGE_ONLY_32 2307 0.43 0.57 0.41 197 TR_XM_FormFill2 2301 0.71 2.52 0.41 198 XMBody_78 2300 0.53 1.27 0.41 199 TR_XM_PHPForged 2287 0.71 2.55 0.41 200 HTML_IMAGE_ONLY_28 2264 0.42 0.49 0.41 ----------------------------------------------------------------------