Email: 667489 Autolearn: 0 AvgScore: 2.38 AvgScanTime: 1.13 sec Spam: 140820 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.07 sec Ham: 526669 Autolearn: 0 AvgScore: -0.84 AvgScanTime: 1.14 sec Time Spent Running SA: 209.22 hours Time Spent Processing Spam: 41.78 hours Time Spent Processing Ham: 167.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 135025 97.97 95.88 98.53 2 HTML_MESSAGE 133023 88.13 94.46 86.44 3 XM_B_Unicode 91094 67.91 64.69 68.77 4 XM_B_SpammyWords 84813 51.90 60.23 49.68 5 RELAYCOUNTRY_US 79653 75.20 56.56 80.18 6 DKIM_SIGNED 73175 72.52 51.96 78.02 7 XM_DK_Pass 70927 71.20 50.37 76.77 8 DKIM_VALID 68762 69.18 48.83 74.62 9 MIME_HTML_ONLY 63605 25.97 45.17 20.84 10 RCVD_IN_MSPIKE_H2 61760 29.77 43.86 26.00 11 XMListUnsubscribeExists 60459 51.51 42.93 53.80 12 RELAYCOUNTRY_META 50411 11.74 35.80 5.31 13 DKIM_VALID_AU 49538 51.90 35.18 56.37 14 XM_B_SpammyWords2 47814 25.23 33.95 22.89 15 BAYES_99 46893 12.90 33.30 7.45 16 XM_DK_Undo_02 43683 15.46 31.02 11.29 17 BAYES_50 43034 48.45 30.56 53.23 18 HTML_MIME_NO_HTML_TAG 40355 8.27 28.66 2.82 19 RCVD_IN_BL_SPAMCOP_NET 40044 7.52 28.44 1.92 20 HTML_FONT_LOW_CONTRAST 36172 28.93 25.69 29.79 21 RCVD_IN_PSBL 36111 5.43 25.64 0.03 22 FVGT_m_MULTI_ODD 35113 23.34 24.93 22.92 23 XM_B_Unicode3 33688 36.43 23.92 39.77 24 BAYES_999 33500 9.59 23.79 5.79 25 UNTRUSTED_Relay 33425 6.74 23.74 2.19 26 LOC_TINY_FONT_1 32394 25.39 23.00 26.03 27 DKIM_VALID_EF 32305 27.15 22.94 28.28 28 XM_B_Unsub 31592 14.10 22.43 11.87 29 BOTNET 30048 6.31 21.34 2.29 30 XMSubLong 27612 20.70 19.61 20.99 31 XM_Multi_Part_URI 27563 13.58 19.57 11.98 32 XM_UncommonTLD01 24643 6.06 17.50 3.00 33 T_TM2_M_HEADER_IN_MSG 23466 24.83 16.66 27.01 34 FROM_EXCESS_BASE64 22941 5.92 16.29 3.15 35 T_KAM_HTML_FONT_INVALID 21810 18.54 15.49 19.36 36 T_REMOTE_IMAGE 19752 5.59 14.03 3.34 37 XM_Body_Dirty_Words 19652 14.29 13.96 14.38 38 BAYES_80 17561 6.42 12.47 4.80 39 BODY_URI_ONLY 17018 2.59 12.08 0.05 40 BOTNET_IPINHOSTNAME 16164 7.08 11.48 5.90 41 LOTS_OF_MONEY 15709 8.44 11.16 7.72 42 HTML_IMAGE_RATIO_02 15696 8.28 11.15 7.52 43 BAYES_60 15430 8.10 10.96 7.34 44 XM_B_Phish_Phrases 13479 7.59 9.57 7.06 45 LOCALPART_IN_SUBJECT 12885 1.95 9.15 0.02 46 SpammyFromTLD_02 12842 2.28 9.12 0.45 47 ALL_TRUSTED 12406 14.18 8.81 15.62 48 MPART_ALT_DIFF 11763 4.81 8.35 3.86 49 MIME_HTML_MOSTLY 11405 3.72 8.10 2.54 50 XMSexyCombo_05 11235 5.29 7.98 4.57 51 XM_B_SpammyWords3 11135 6.56 7.91 6.20 52 BAYES_95 10739 3.91 7.63 2.92 53 XM_UB50 10153 2.43 7.21 1.15 54 RCVD_IN_MSPIKE_WL 10139 24.45 7.20 29.06 55 LONGWORDS 9856 2.11 7.00 0.80 56 HTML_IMAGE_ONLY_16 9648 1.68 6.85 0.29 57 BOTNET_NORDNS 9447 1.43 6.71 0.01 58 RCVD_IN_MSPIKE_BL 9273 2.36 6.59 1.22 59 SUBJ_ALL_CAPS 9166 2.62 6.51 1.58 60 XM_Evil_Numbers_Gen 9010 8.10 6.40 8.56 61 HK_RANDOM_FROM 8987 1.42 6.38 0.10 62 HTML_SHORT_LINK_IMG_2 8908 1.38 6.33 0.06 63 XM_UB99 8829 1.33 6.27 0.01 64 URI_PHP_REDIR 8727 1.34 6.20 0.04 65 LotsOfNums_01 8701 8.27 6.18 8.83 66 URI_WP_DIRINDEX 8530 1.35 6.06 0.10 67 XMSubMetaSx_00 8320 4.49 5.91 4.11 68 XMSubGiftCard1 8164 1.26 5.80 0.05 69 XMSubGiftCard2 8129 1.23 5.77 0.02 70 KHOP_HELO_FCRDNS 8097 2.37 5.75 1.47 71 RELAYCOUNTRY_CA 7935 2.59 5.63 1.78 72 FROM_SUSPICIOUS_NTLD 7635 1.19 5.42 0.06 73 XM_B_SpammyTLD 7585 2.71 5.39 1.99 74 FROM_SUSPICIOUS_NTLD_FP 7565 1.17 5.37 0.05 75 HTML_FONT_TINY_NORDNS 7379 1.19 5.24 0.11 76 TR_XM_PhishingBody 7176 3.71 5.10 3.34 77 RELAYCOUNTRY_GB 7172 1.80 5.09 0.92 78 SpammyFromTLD_01 6948 1.67 4.93 0.80 79 URI_WP_HACKED_2 6872 1.06 4.88 0.04 80 DKIM_ADSP_NXDOMAIN 6528 1.85 4.64 1.11 81 RELAYCOUNTRY_FR 6465 1.17 4.59 0.25 82 RCVD_IN_RP_RNBL 6384 1.00 4.53 0.06 83 XM_B_COVIDMETA 6249 2.07 4.44 1.44 84 XM_UB999 6012 0.90 4.27 0.00 85 RCVD_IN_MSPIKE_H3 5870 13.67 4.17 16.22 86 T_HTML_TAG_BALANCE_CENTER 5716 0.95 4.06 0.11 87 HDRS_MISSP 5615 0.86 3.99 0.03 88 XM_SPF_SoftFail 5554 2.13 3.94 1.64 89 XMBody_50 5537 0.83 3.93 0.00 90 TooManyTo_001 5448 7.40 3.87 8.34 91 XM_H_Long_From01 5246 5.20 3.73 5.60 92 XMNumbers 5163 3.56 3.67 3.53 93 UNPARSEABLE_RELAY 5156 6.56 3.66 7.33 94 XM_JunkDunk 5141 0.77 3.65 0.00 95 XM_DIRTYINTL 5125 1.25 3.64 0.61 96 RCVD_IN_MSPIKE_L3 5065 1.37 3.60 0.77 97 XM_UB80 4966 0.77 3.53 0.04 98 XM_UB60 4954 0.85 3.52 0.14 99 XM_B_Phish66 4593 1.98 3.26 1.64 100 HTML_IMAGE_RATIO_04 4578 5.25 3.25 5.79 101 DKIM_INVALID 4413 3.34 3.13 3.40 102 LH_URI_DOM_IN_PATH 4395 1.93 3.12 1.61 103 TM2_M_URI_OPT_OUT 4160 3.17 2.95 3.23 104 XM_OfRef6 4116 1.56 2.92 1.19 105 T_XMDrugObfuBody_00 4027 1.18 2.86 0.73 106 TR_Caps_n_Bayes_99 4008 0.78 2.85 0.22 107 RCVD_IN_MSPIKE_H4 3950 9.08 2.80 10.75 108 XM_SendGrid 3940 5.71 2.80 6.49 109 T_XMDrugObfuBody_08 3928 1.89 2.79 1.65 110 XM_iOS_Forged_Message 3896 0.61 2.77 0.04 111 XMBody_17 3876 1.32 2.75 0.94 112 T_PDS_OTHER_BAD_TLD 3873 0.80 2.75 0.28 113 RELAYCOUNTRY_IN 3871 0.66 2.75 0.10 114 FROM_LOCAL_NOVOWEL 3745 0.58 2.66 0.03 115 T_TooManySym_01 3655 4.47 2.60 4.97 116 XMBrknScrpt_02 3653 1.24 2.59 0.88 117 RCVD_IN_MSPIKE_L5 3527 0.82 2.50 0.37 118 XM_B_Unsub2 3348 2.76 2.38 2.86 119 XM_CamelCaseFrm001 3297 1.99 2.34 1.90 120 URIBL_SBL_A 3286 0.74 2.33 0.31 121 TR_XM_SB_Phish 3282 2.04 2.33 1.96 122 XMSubPhish11 3203 2.01 2.27 1.93 123 HTML_TITLE_SUBJ_DIFF 3127 0.65 2.22 0.24 124 RELAYCOUNTRY_NL 3081 0.64 2.19 0.23 125 URI_HEX 3070 1.67 2.18 1.54 126 XM_UB95 3014 0.47 2.14 0.02 127 XMDiploma_00 3005 2.39 2.13 2.46 128 SHORTENED_URL_HREF 2975 0.65 2.11 0.26 129 XM_BadFromFormat 2942 0.56 2.09 0.15 130 XM_URI_RBL 2924 0.59 2.08 0.19 131 XMStrtUSub 2819 3.81 2.00 4.29 132 DRUGS_ERECTILE 2787 0.45 1.98 0.05 133 FVGT_m_MULTI_ODD_EMAIL 2767 0.44 1.96 0.03 134 SHORT_SHORTNER 2753 0.42 1.95 0.02 135 SHORT_URI_3 2745 0.46 1.95 0.06 136 DIET_1 2730 0.75 1.94 0.44 137 BOUNCE_MESSAGE 2699 4.44 1.92 5.12 138 ANY_BOUNCE_MESSAGE 2699 4.44 1.92 5.12 139 TR_XM_COVIDMETA1 2688 0.88 1.91 0.61 140 TM2_M_VERY_LONG_WORD 2677 1.41 1.90 1.28 141 HTML_IMAGE_ONLY_08 2650 0.49 1.88 0.12 142 HTML_SHORT_LINK_IMG_1 2650 0.41 1.88 0.02 143 BAYES_40 2642 3.95 1.88 4.50 144 TR_XM_MaxSPIKE 2577 0.47 1.83 0.11 145 TR_XM_COVIDMETA4 2522 0.77 1.79 0.50 146 HTML_IMAGE_RATIO_06 2501 2.93 1.78 3.24 147 XMSubEmpty 2496 0.89 1.77 0.66 148 TR_XM_MaxBayes 2474 0.40 1.76 0.04 149 TR_XM_PHPDW 2445 1.04 1.74 0.85 150 SHORTENED_URL_SRC 2445 0.37 1.74 0.00 151 SHORTENER_SHORT_IMG 2442 0.37 1.73 0.00 152 XMSexyCombo_01 2422 0.97 1.72 0.77 153 TR_XM_PHPForged 2420 1.02 1.72 0.84 154 XM_B_SpammyWords4 2403 0.79 1.71 0.55 155 TR_LOTS_OF_MONEY3 2397 0.82 1.70 0.58 156 TR_XM_FormFill2 2394 1.02 1.70 0.83 157 XM_H_PHPOS 2384 1.01 1.69 0.83 158 BAYES_20 2357 4.14 1.67 4.80 159 DRUGS_ERECTILE_OBFU 2355 0.37 1.67 0.02 160 HTML_IMAGE_RATIO_08 2346 1.99 1.67 2.07 161 TR_XM_UnparsRelay 2283 0.66 1.62 0.41 162 RELAYCOUNTRY_DE 2208 0.69 1.57 0.45 163 URI_OPTOUT_3LD 2151 0.39 1.53 0.09 164 RELAYCOUNTRY_HK 2147 0.35 1.52 0.04 165 SUBJ_OBFU_PUNCT_FEW 2145 0.35 1.52 0.04 166 XMNoSubject 2124 0.71 1.51 0.50 167 MISSING_SUBJECT 2124 0.71 1.51 0.50 168 T_XMDrugObfuBody_14 2013 1.56 1.43 1.60 169 MIME_HTML_ONLY_MULTI 1991 1.89 1.41 2.02 170 XMGenDplmaNmb 1981 1.20 1.41 1.15 171 SUBJ_BUY 1955 0.34 1.39 0.06 172 RELAYCOUNTRY_JP 1948 0.32 1.38 0.03 173 EMPTY_MESSAGE 1942 0.31 1.38 0.02 174 XM_H_MAILSPLOIT 1939 0.29 1.38 0.00 175 RELAYCOUNTRY_KR 1911 0.30 1.36 0.02 176 SUBJ_OBFU_PUNCT_MANY 1862 0.28 1.32 0.01 177 SUBJECT_DIET 1857 0.28 1.32 0.00 178 RELAYCOUNTRY_AU 1856 0.57 1.32 0.37 179 MIME_QP_LONG_LINE 1828 4.73 1.30 5.64 180 TR_XM_DK_SendGrid 1824 3.06 1.30 3.53 181 RELAYCOUNTRY_SG 1755 0.35 1.25 0.11 182 XMStockSpam_06 1742 1.23 1.24 1.23 183 RELAYCOUNTRY_AE 1690 0.25 1.20 0.00 184 RCVD_IN_IADB_LISTED 1688 4.36 1.20 5.20 185 TR_XM_RelayPhish 1655 0.37 1.18 0.15 186 URI_TRY_3LD 1642 1.41 1.17 1.47 187 T_XMHurry_00 1640 0.92 1.16 0.86 188 TR_XM_INV_DKIM 1612 0.36 1.14 0.14 189 DKIM_ADSP_CUSTOM_MED 1576 1.17 1.12 1.18 190 MIME_CHARSET_FARAWAY 1537 0.32 1.09 0.12 191 NML_ADSP_CUSTOM_MED 1523 0.89 1.08 0.83 192 FUZZY_VPILL 1516 0.23 1.08 0.00 193 RELAYCOUNTRY_IE 1516 0.38 1.08 0.20 194 XMGppyBdWords 1500 0.34 1.07 0.15 195 XMLngstWrd_00 1498 0.56 1.06 0.43 196 T_FILL_THIS_FORM_SHORT 1491 0.88 1.06 0.83 197 CHARSET_FARAWAY_HEADER 1457 0.27 1.03 0.07 198 TR_Symld_Words 1456 1.56 1.03 1.70 199 XMSubNoVowel 1451 0.45 1.03 0.29 200 URI_NOVOWEL 1446 2.10 1.03 2.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 518939 97.97 95.88 98.53 2 HTML_MESSAGE 455267 88.13 94.46 86.44 3 RELAYCOUNTRY_US 422283 75.20 56.56 80.18 4 DKIM_SIGNED 410887 72.52 51.96 78.02 5 XM_DK_Pass 404311 71.20 50.37 76.77 6 DKIM_VALID 392986 69.18 48.83 74.62 7 XM_B_Unicode 362182 67.91 64.69 68.77 8 DKIM_VALID_AU 296889 51.90 35.18 56.37 9 XMListUnsubscribeExists 283369 51.51 42.93 53.80 10 BAYES_50 280369 48.45 30.56 53.23 11 XM_B_SpammyWords 261645 51.90 60.23 49.68 12 XM_B_Unicode3 209460 36.43 23.92 39.77 13 HTML_FONT_LOW_CONTRAST 156908 28.93 25.69 29.79 14 RCVD_IN_MSPIKE_WL 153036 24.45 7.20 29.06 15 DKIM_VALID_EF 148935 27.15 22.94 28.28 16 T_TM2_M_HEADER_IN_MSG 142255 24.83 16.66 27.01 17 LOC_TINY_FONT_1 137086 25.39 23.00 26.03 18 RCVD_IN_MSPIKE_H2 136944 29.77 43.86 26.00 19 FVGT_m_MULTI_ODD 120707 23.34 24.93 22.92 20 XM_B_SpammyWords2 120572 25.23 33.95 22.89 21 XMSubLong 110565 20.70 19.61 20.99 22 MIME_HTML_ONLY 109762 25.97 45.17 20.84 23 T_KAM_HTML_FONT_INVALID 101975 18.54 15.49 19.36 24 RCVD_IN_MSPIKE_H3 85408 13.67 4.17 16.22 25 ALL_TRUSTED 82252 14.18 8.81 15.62 26 XM_Body_Dirty_Words 75712 14.29 13.96 14.38 27 BAYES_00 66027 10.04 0.69 12.54 28 XM_Multi_Part_URI 63104 13.58 19.57 11.98 29 XM_B_Unsub 62514 14.10 22.43 11.87 30 XM_DK_Undo_02 59480 15.46 31.02 11.29 31 RCVD_IN_MSPIKE_H4 56634 9.08 2.80 10.75 32 TR_XM_DK_Bayes 48378 7.30 0.23 9.19 33 TR_XM_DK_Bayes1 46778 7.05 0.21 8.88 34 LotsOfNums_01 46501 8.27 6.18 8.83 35 XM_Evil_Numbers_Gen 45073 8.10 6.40 8.56 36 TooManyTo_001 43927 7.40 3.87 8.34 37 TR_XM_DK_Bayes2 42044 6.33 0.17 7.98 38 RCVD_IN_RP_SAFE 40868 6.21 0.41 7.76 39 LOTS_OF_MONEY 40634 8.44 11.16 7.72 40 HTML_IMAGE_RATIO_02 39596 8.28 11.15 7.52 41 BAYES_99 39246 12.90 33.30 7.45 42 XM_DKIMWhitelistDomains 38774 5.81 0.00 7.36 43 RCVD_IN_RP_CERTIFIED 38728 5.86 0.26 7.35 44 BAYES_60 38633 8.10 10.96 7.34 45 UNPARSEABLE_RELAY 38624 6.56 3.66 7.33 46 XM_B_Phish_Phrases 37201 7.59 9.57 7.06 47 XM_SendGrid 34188 5.71 2.80 6.49 48 IN_ZIMBRA_NJ_WHITELIST 32824 4.93 0.05 6.23 49 XM_B_SpammyWords3 32628 6.56 7.91 6.20 50 BOTNET_IPINHOSTNAME 31083 7.08 11.48 5.90 51 BAYES_999 30508 9.59 23.79 5.79 52 HTML_IMAGE_RATIO_04 30482 5.25 3.25 5.79 53 MIME_QP_LONG_LINE 29716 4.73 1.30 5.64 54 XM_H_Long_From01 29496 5.20 3.73 5.60 55 RELAYCOUNTRY_META 27967 11.74 35.80 5.31 56 RCVD_IN_IADB_LISTED 27390 4.36 1.20 5.20 57 ANY_BOUNCE_MESSAGE 26961 4.44 1.92 5.12 58 BOUNCE_MESSAGE 26960 4.44 1.92 5.12 59 T_TooManySym_01 26197 4.47 2.60 4.97 60 BAYES_20 25300 4.14 1.67 4.80 61 BAYES_80 25292 6.42 12.47 4.80 62 XMSexyCombo_05 24054 5.29 7.98 4.57 63 RCVD_IN_IADB_SPF 23766 3.76 0.94 4.51 64 BAYES_40 23717 3.95 1.88 4.50 65 XMStrtUSub 22588 3.81 2.00 4.29 66 XM_PDF 22345 3.54 0.90 4.24 67 XMSubMetaSx_00 21644 4.49 5.91 4.11 68 RCVD_IN_IADB_SENDERID 21236 3.36 0.84 4.03 69 RCVD_IN_IADB_DK 20561 3.26 0.83 3.90 70 MPART_ALT_DIFF 20352 4.81 8.35 3.86 71 XMNumbers 18614 3.56 3.67 3.53 72 TR_XM_DK_SendGrid 18588 3.06 1.30 3.53 73 DKIM_INVALID 17901 3.34 3.13 3.40 74 TR_XM_PhishingBody 17596 3.71 5.10 3.34 75 T_REMOTE_IMAGE 17587 5.59 14.03 3.34 76 HTML_IMAGE_RATIO_06 17045 2.93 1.78 3.24 77 TM2_M_URI_OPT_OUT 17012 3.17 2.95 3.23 78 RCVD_IN_IADB_VOUCHED 16896 2.68 0.70 3.21 79 FROM_EXCESS_BASE64 16571 5.92 16.29 3.15 80 XM_UncommonTLD01 15789 6.06 17.50 3.00 81 BAYES_95 15367 3.91 7.63 2.92 82 XM_B_Unsub2 15082 2.76 2.38 2.86 83 HTML_MIME_NO_HTML_TAG 14872 8.27 28.66 2.82 84 MIME_HTML_MOSTLY 13393 3.72 8.10 2.54 85 XMDiploma_00 12965 2.39 2.13 2.46 86 BAYES_05 12702 2.08 0.85 2.41 87 URI_NOVOWEL 12548 2.10 1.03 2.38 88 T_TooManySym_02 12463 1.93 0.31 2.37 89 MAILING_LIST_MULTI 12364 2.03 0.84 2.35 90 BOTNET 12045 6.31 21.34 2.29 91 UNTRUSTED_Relay 11554 6.74 23.74 2.19 92 RCVD_IN_MSPIKE_H5 10994 1.69 0.23 2.09 93 RCVD_IN_IADB_OPTIN 10963 1.74 0.47 2.08 94 HTML_IMAGE_RATIO_08 10920 1.99 1.67 2.07 95 MIME_HTML_ONLY_MULTI 10644 1.89 1.41 2.02 96 XM_B_SpammyTLD 10498 2.71 5.39 1.99 97 TR_XM_SB_Phish 10332 2.04 2.33 1.96 98 XMSubPhish11 10189 2.01 2.27 1.93 99 RCVD_IN_BL_SPAMCOP_NET 10138 7.52 28.44 1.92 100 TooManyTo_002 10023 1.65 0.72 1.90 101 XM_CamelCaseFrm001 10012 1.99 2.34 1.90 102 XM_DK_Undo_01 9998 1.69 0.90 1.90 103 TVD_RCVD_IP 9739 1.60 0.68 1.85 104 RELAYCOUNTRY_CA 9349 2.59 5.63 1.78 105 TR_Symld_Words 8934 1.56 1.03 1.70 106 T_XMDrugObfuBody_08 8699 1.89 2.79 1.65 107 XM_SPF_SoftFail 8660 2.13 3.94 1.64 108 XM_B_Phish66 8640 1.98 3.26 1.64 109 LH_URI_DOM_IN_PATH 8490 1.93 3.12 1.61 110 T_XMDrugObfuBody_14 8424 1.56 1.43 1.60 111 SUBJ_ALL_CAPS 8344 2.62 6.51 1.58 112 URI_HEX 8101 1.67 2.18 1.54 113 XMGappySubj_01 8080 1.25 0.20 1.53 114 URI_TRY_3LD 7766 1.41 1.17 1.47 115 KHOP_HELO_FCRDNS 7745 2.37 5.75 1.47 116 XM_B_COVIDMETA 7600 2.07 4.44 1.44 117 IN_HORDE_ADDRESS_BOOK 7338 1.12 0.12 1.39 118 HELO_MISC_IP 7245 1.20 0.55 1.38 119 CK_HELO_DYNAMIC_SPLIT_IP 7239 1.20 0.56 1.37 120 INVALID_MSGID 6927 1.22 0.84 1.32 121 TM2_M_VERY_LONG_WORD 6743 1.41 1.90 1.28 122 TooManyTo_003 6677 1.11 0.53 1.27 123 HELO_NODOT 6621 1.13 0.67 1.26 124 HELO_NO_DOMAIN 6618 1.13 0.67 1.26 125 XMStockSpam_06 6468 1.23 1.24 1.23 126 RCVD_IN_MSPIKE_BL 6447 2.36 6.59 1.22 127 XM_OfRef6 6292 1.56 2.92 1.19 128 TR_MSPIKEBAYES00 6283 0.95 0.03 1.19 129 XM_GoogleGroups 6231 0.99 0.27 1.18 130 DKIM_ADSP_CUSTOM_MED 6212 1.17 1.12 1.18 131 TO_MALFORMED 6136 0.92 0.02 1.17 132 XM_UB50 6080 2.43 7.21 1.15 133 XMGenDplmaNmb 6039 1.20 1.41 1.15 134 DKIM_ADSP_NXDOMAIN 5836 1.85 4.64 1.11 135 USER_IN_DEF_DKIM_WL 5654 0.85 0.00 1.07 136 XM_ProductURIs 5465 0.91 0.42 1.04 137 XM_H_Long_From02 5319 0.90 0.51 1.01 138 NO_DNS_FOR_FROM 5293 0.94 0.71 1.00 139 XMCapTrack 5242 0.87 0.38 1.00 140 XMBody_17 4962 1.32 2.75 0.94 141 T_TooManySym_03 4859 0.75 0.10 0.92 142 RELAYCOUNTRY_GB 4825 1.80 5.09 0.92 143 TooManyTo_004 4803 0.81 0.45 0.91 144 XMBrknScrpt_02 4640 1.24 2.59 0.88 145 T_XMHurry_00 4508 0.92 1.16 0.86 146 TR_XM_PHPDW 4486 1.04 1.74 0.85 147 TR_XM_PHPForged 4404 1.02 1.72 0.84 148 TR_XM_FormFill2 4394 1.02 1.70 0.83 149 NML_ADSP_CUSTOM_MED 4391 0.89 1.08 0.83 150 XM_H_PHPOS 4366 1.01 1.69 0.83 151 T_FILL_THIS_FORM_SHORT 4355 0.88 1.06 0.83 152 XMBdyGiftCard01 4317 0.85 0.97 0.82 153 XMHTML_After_End 4309 0.85 0.95 0.82 154 XMPhish30 4247 0.78 0.67 0.81 155 LONGWORDS 4219 2.11 7.00 0.80 156 SpammyFromTLD_01 4216 1.67 4.93 0.80 157 XMSexyCombo_01 4060 0.97 1.72 0.77 158 RCVD_IN_MSPIKE_L3 4052 1.37 3.60 0.77 159 T_OBFU_PDF_ATTACH 4004 0.62 0.11 0.76 160 TR_MetaPhish_Combo_01 3882 0.77 0.89 0.74 161 XM_RXBody 3838 0.63 0.25 0.73 162 T_XMDrugObfuBody_00 3835 1.18 2.86 0.73 163 TooManyTo_005 3814 0.65 0.37 0.72 164 HTML_FONT_FACE_BAD 3629 0.62 0.34 0.69 165 XM_ShortIntro_01 3572 0.65 0.56 0.68 166 TR_BOTNET_NEGATE 3499 0.62 0.46 0.66 167 HTTPS_HTTP_MISMATCH 3480 0.65 0.63 0.66 168 XMSubEmpty 3460 0.89 1.77 0.66 169 XMSubMetaI_00 3435 0.62 0.50 0.65 170 XMBody_95 3354 0.52 0.07 0.64 171 TR_Sbj_FN_Bdy 3353 0.59 0.40 0.64 172 XM_SPF_Unknown 3287 0.63 0.63 0.62 173 FROM_GOV_DKIM_AU 3282 0.51 0.07 0.62 174 TR_XM_COVIDMETA1 3204 0.88 1.91 0.61 175 XM_DIRTYINTL 3192 1.25 3.64 0.61 176 T_Symld_Words_02 3181 0.59 0.54 0.60 177 TR_LOTS_OF_MONEY3 3052 0.82 1.70 0.58 178 XMHTMLBadTable_001 3038 0.52 0.29 0.58 179 XM_B_COPY_HTML 2934 0.59 0.74 0.56 180 XM_B_SpammyWords4 2889 0.79 1.71 0.55 181 FORGED_GMAIL_RCVD 2799 0.59 0.81 0.53 182 XMMoneyMeta_00 2751 0.58 0.80 0.52 183 PLING_QUERY 2751 0.49 0.38 0.52 184 NUMERIC_HTTP_ADDR 2723 0.50 0.46 0.52 185 T_TooManySym_04 2691 0.41 0.04 0.51 186 TM2_M_BODY_EMPTY 2663 0.42 0.08 0.51 187 XMNoSubject 2646 0.71 1.51 0.50 188 MISSING_SUBJECT 2646 0.71 1.51 0.50 189 HTML_TAG_BALANCE_BODY 2642 0.49 0.45 0.50 190 TR_XM_COVIDMETA4 2616 0.77 1.79 0.50 191 XMNoVowels 2550 0.44 0.27 0.48 192 XMBody_78 2530 0.53 0.70 0.48 193 TM2_M_A_HREF_HREF 2438 0.51 0.70 0.46 194 XMPhish14 2389 0.53 0.80 0.45 195 XMSubMetaSxObfu_03 2387 0.56 0.94 0.45 196 RELAYCOUNTRY_DE 2365 0.69 1.57 0.45 197 SpammyFromTLD_02 2360 2.28 9.12 0.45 198 THIS_AD 2350 0.41 0.30 0.45 199 XMPhish08 2319 0.45 0.47 0.44 200 DIET_1 2303 0.75 1.94 0.44 ----------------------------------------------------------------------