Email: 619952 Autolearn: 0 AvgScore: 1.93 AvgScanTime: 1.22 sec Spam: 118485 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.20 sec Ham: 501467 Autolearn: 0 AvgScore: -0.80 AvgScanTime: 1.23 sec Time Spent Running SA: 210.11 hours Time Spent Processing Spam: 39.44 hours Time Spent Processing Ham: 170.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 114686 98.31 96.79 98.66 2 HTML_MESSAGE 112403 90.28 94.87 89.20 3 XM_B_SpammyWords 83477 55.92 70.45 52.49 4 DKIM_SIGNED 80528 78.25 67.96 80.67 5 XM_DK_Pass 78095 76.88 65.91 79.47 6 RELAYCOUNTRY_US 75968 80.01 64.12 83.76 7 DKIM_VALID 75648 74.93 63.85 77.55 8 XM_B_Unicode 71466 70.39 60.32 72.77 9 XMListUnsubscribeExists 68252 55.84 57.60 55.42 10 DKIM_VALID_AU 55903 56.38 47.18 58.56 11 XM_B_SpammyWords2 54534 28.44 46.03 24.29 12 XM_DK_Undo_02 52945 18.67 44.68 12.53 13 MIME_HTML_ONLY 48722 25.32 41.12 21.59 14 RCVD_IN_MSPIKE_H2 48149 30.61 40.64 28.24 15 BAYES_99 47141 14.57 39.79 8.61 16 RELAYCOUNTRY_META 42567 11.12 35.93 5.26 17 DKIM_VALID_EF 36650 29.58 30.93 29.26 18 XM_B_Unicode3 36621 40.01 30.91 42.15 19 LOC_TINY_FONT_1 35527 27.56 29.98 26.99 20 BAYES_50 35102 48.53 29.63 53.00 21 BAYES_999 35060 11.34 29.59 7.03 22 BOTNET 32639 7.16 27.55 2.34 23 HTML_FONT_LOW_CONTRAST 30806 29.26 26.00 30.03 24 UNTRUSTED_Relay 28393 6.27 23.96 2.09 25 T_KAM_HTML_FONT_INVALID 27549 20.17 23.25 19.44 26 RCVD_IN_BL_SPAMCOP_NET 26616 5.77 22.46 1.83 27 XMSubLong 26487 22.20 22.35 22.17 28 FVGT_m_MULTI_ODD 23562 22.70 19.89 23.37 29 XM_UncommonTLD01 23035 6.21 19.44 3.08 30 XM_Multi_Part_URI 22856 14.44 19.29 13.30 31 RCVD_IN_PSBL 22275 3.66 18.80 0.08 32 HTML_MIME_NO_HTML_TAG 21759 5.27 18.36 2.17 33 T_TM2_M_HEADER_IN_MSG 21222 25.46 17.91 27.24 34 HTML_IMAGE_RATIO_08 21159 5.53 17.86 2.61 35 FROM_EXCESS_BASE64 21089 5.95 17.80 3.16 36 XM_Body_Dirty_Words 20637 15.13 17.42 14.59 37 RCVD_IN_RP_RNBL 20135 3.30 16.99 0.06 38 LOTS_OF_MONEY 17401 10.11 14.69 9.03 39 BOTNET_IPINHOSTNAME 17149 7.63 14.47 6.01 40 MPART_ALT_DIFF 14129 5.60 11.92 4.11 41 XM_B_Unsub 14063 11.97 11.87 12.00 42 XMSexyCombo_05 13791 6.04 11.64 4.72 43 XM_B_SpammyWords3 12812 7.19 10.81 6.33 44 XM_B_Phish_Phrases 12714 8.17 10.73 7.57 45 BAYES_80 12421 5.94 10.48 4.87 46 MIME_HTML_MOSTLY 12120 3.94 10.23 2.45 47 RCVD_IN_MSPIKE_BL 11142 2.55 9.40 0.94 48 RCVD_IN_MSPIKE_WL 10350 25.80 8.74 29.83 49 SpammyFromTLD_02 9789 1.95 8.26 0.45 50 URI_PHP_REDIR 9623 1.56 8.12 0.01 51 BAYES_60 9141 7.24 7.71 7.12 52 XM_Evil_Numbers_Gen 8719 8.51 7.36 8.79 53 XM_UB50 8602 2.27 7.26 1.09 54 XMSubMetaSx_00 8275 4.40 6.98 3.79 55 T_TooManySym_01 7938 4.64 6.70 4.15 56 BAYES_95 7711 3.59 6.51 2.90 57 HTML_IMAGE_RATIO_02 7633 7.35 6.44 7.56 58 SpammyFromTLD_01 7448 1.81 6.29 0.75 59 T_REMOTE_IMAGE 7422 3.90 6.26 3.34 60 RELAYCOUNTRY_CA 7038 2.65 5.94 1.88 61 XM_UB99 6987 1.13 5.90 0.01 62 TR_XM_PhishingBody 6794 3.85 5.73 3.40 63 LotsOfNums_01 6676 8.77 5.63 9.51 64 XM_B_COVIDMETA 6604 2.14 5.57 1.33 65 RCVD_IN_MSPIKE_L3 6318 1.53 5.33 0.64 66 TooManyTo_001 5776 7.74 4.87 8.42 67 RCVD_IN_MSPIKE_H3 5652 14.51 4.77 16.81 68 KHOP_HELO_FCRDNS 5502 2.03 4.64 1.41 69 XM_DIRTYINTL 5470 1.31 4.62 0.53 70 RELAYCOUNTRY_GB 5433 1.62 4.59 0.92 71 HK_RANDOM_FROM 5391 0.96 4.55 0.12 72 BOTNET_NORDNS 5308 0.88 4.48 0.03 73 XMBrknScrpt_02 5230 2.20 4.41 1.67 74 RELAYCOUNTRY_FR 5204 1.04 4.39 0.24 75 RELAYCOUNTRY_IN 5144 0.91 4.34 0.10 76 XM_SPF_SoftFail 5032 2.16 4.25 1.67 77 XM_H_Long_From01 4962 5.91 4.19 6.32 78 DKIM_INVALID 4880 3.32 4.12 3.13 79 XM_B_SpammyTLD 4850 2.69 4.09 2.36 80 HTML_IMAGE_RATIO_04 4738 5.53 4.00 5.89 81 UNPARSEABLE_RELAY 4707 7.54 3.97 8.38 82 XMNumbers 4624 3.54 3.90 3.46 83 XM_UB80 4578 0.77 3.86 0.03 84 XM_OfRef6 4372 1.73 3.69 1.27 85 XM_UB999 4365 0.71 3.68 0.00 86 XM_B_Phish66 4220 2.27 3.56 1.96 87 RCVD_IN_MSPIKE_H4 4167 9.39 3.52 10.78 88 URIBL_SBL_A 4164 0.83 3.51 0.19 89 TR_LOTS_OF_MONEY3 4008 1.49 3.38 1.04 90 XM_UB60 3908 0.72 3.30 0.11 91 RELAYCOUNTRY_DE 3860 0.93 3.26 0.39 92 TR_XM_MaxSPIKE 3822 0.70 3.23 0.11 93 TR_XM_SB_Phish 3733 2.81 3.15 2.73 94 XM_SendGrid 3685 6.78 3.11 7.64 95 XMSubPhish11 3649 2.77 3.08 2.70 96 RCVD_IN_MSPIKE_L5 3632 0.78 3.07 0.23 97 TR_XM_MaxBayes 3607 0.61 3.04 0.04 98 XMBody_17 3581 1.39 3.02 1.00 99 XM_B_Unsub2 3549 3.02 3.00 3.03 100 T_XMDrugObfuBody_08 3479 1.94 2.94 1.71 101 HTML_IMAGE_RATIO_06 3470 3.43 2.93 3.55 102 HTML_FONT_TINY_NORDNS 3457 0.61 2.92 0.06 103 TM2_M_URI_OPT_OUT 3330 3.08 2.81 3.14 104 BODY_URI_ONLY 2979 0.53 2.51 0.06 105 HTML_SHORT_LINK_IMG_1 2949 0.49 2.49 0.02 106 XMStrtUSub 2917 4.09 2.46 4.47 107 XMDiploma_00 2847 1.98 2.40 1.88 108 URI_HEX 2844 2.01 2.40 1.92 109 XM_B_SpammyWords4 2760 1.11 2.33 0.83 110 XM_CamelCaseFrm001 2698 2.02 2.28 1.96 111 T_TooManySym_02 2689 2.27 2.27 2.27 112 T_PDS_OTHER_BAD_TLD 2682 0.94 2.26 0.62 113 SHORT_SHORTNER 2668 0.45 2.25 0.02 114 SHORTENED_URL_SRC 2638 0.43 2.23 0.00 115 XM_URI_RBL 2611 0.57 2.20 0.19 116 TR_Symld_Words 2601 1.83 2.20 1.75 117 TR_XM_PHPForged 2590 0.71 2.19 0.37 118 TR_XM_PHPDW 2584 0.73 2.18 0.39 119 TR_XM_FormFill2 2552 0.71 2.15 0.37 120 XM_H_PHPOS 2540 0.70 2.14 0.36 121 SHORTENER_SHORT_IMG 2536 0.41 2.14 0.00 122 XMSexyCombo_01 2512 1.09 2.12 0.85 123 TR_XM_UnparsRelay 2507 0.80 2.12 0.49 124 HTML_IMAGE_ONLY_08 2466 0.48 2.08 0.10 125 XM_UB95 2435 0.41 2.06 0.02 126 T_XMDrugObfuBody_14 2420 1.76 2.04 1.69 127 MIME_QP_LONG_LINE 2388 5.44 2.02 6.25 128 T_XMDrugObfuBody_00 2365 1.00 2.00 0.76 129 FROM_SUSPICIOUS_NTLD 2344 0.42 1.98 0.05 130 TR_XM_COVIDMETA4 2297 0.76 1.94 0.49 131 SUBJ_ALL_CAPS 2291 1.72 1.93 1.67 132 FROM_SUSPICIOUS_NTLD_FP 2290 0.41 1.93 0.05 133 FROM_LOCAL_NOVOWEL 2268 0.39 1.91 0.03 134 ALL_TRUSTED 2262 10.17 1.91 12.12 135 TM2_M_VERY_LONG_WORD 2211 1.46 1.87 1.36 136 SHORTENED_URL_HREF 2198 0.42 1.86 0.09 137 T_FILL_THIS_FORM_SHORT 2178 1.14 1.84 0.97 138 LH_URI_DOM_IN_PATH 2133 1.00 1.80 0.82 139 SHORT_URI_3 2118 0.41 1.79 0.08 140 BAYES_40 2067 4.42 1.74 5.05 141 TR_XM_COVIDMETA1 2052 0.64 1.73 0.38 142 TR_XM_INV_DKIM 1968 0.40 1.66 0.11 143 BAYES_20 1946 3.16 1.64 3.51 144 URI_TRY_3LD 1935 1.55 1.63 1.53 145 BAYES_00 1912 10.56 1.61 12.68 146 RELAYCOUNTRY_NL 1888 0.49 1.59 0.23 147 TR_XM_DK_SendGrid 1831 4.06 1.55 4.65 148 RCVD_IN_IADB_LISTED 1798 4.79 1.52 5.56 149 MIME_HTML_ONLY_MULTI 1785 2.11 1.51 2.25 150 TM2_M_A_HREF_HREF 1775 0.65 1.50 0.45 151 TR_XM_RelayPhish 1762 0.39 1.49 0.13 152 FVGT_m_MULTI_ODD_EMAIL 1711 0.30 1.44 0.04 153 XMNoVowels 1685 0.78 1.42 0.63 154 LongTLD 1664 0.42 1.40 0.18 155 XMGenDplmaNmb 1570 1.08 1.33 1.03 156 DKIM_ADSP_CUSTOM_MED 1556 1.23 1.31 1.21 157 RELAYCOUNTRY_KR 1491 0.25 1.26 0.01 158 XMHTML_After_End 1481 0.86 1.25 0.77 159 DATE_IN_PAST_03_06 1458 0.31 1.23 0.09 160 XMStockSpam_06 1452 1.28 1.23 1.29 161 NML_ADSP_CUSTOM_MED 1440 0.91 1.22 0.84 162 RCVD_IN_IADB_SPF 1411 4.15 1.19 4.84 163 TR_MetaPhish_Combo_01 1400 0.90 1.18 0.84 164 XM_PDF 1394 3.54 1.18 4.10 165 RELAYCOUNTRY_JP 1382 0.26 1.17 0.05 166 XMGppyBdWords 1374 0.35 1.16 0.16 167 T_XMHurry_00 1346 0.93 1.14 0.88 168 RDNS_DYNAMIC 1327 0.60 1.12 0.47 169 URI_NOVOWEL 1325 2.28 1.12 2.56 170 TR_Mismatch_TLD_02 1313 0.28 1.11 0.08 171 FORGED_GMAIL_RCVD 1277 0.70 1.08 0.61 172 XM_SPF_Unknown 1260 0.77 1.06 0.70 173 RCVD_IN_IADB_SENDERID 1250 3.72 1.05 4.35 174 T_Symld_Words_02 1237 0.67 1.04 0.58 175 RCVD_IN_IADB_DK 1231 3.61 1.04 4.22 176 MIME_CHARSET_FARAWAY 1230 0.27 1.04 0.09 177 RELAYCOUNTRY_AU 1227 0.51 1.04 0.39 178 TR_XM_DK_Bayes 1217 7.55 1.03 9.09 179 T_HTML_ATTACH 1201 0.25 1.01 0.07 180 TR_XM_DK_Bayes1 1195 7.31 1.01 8.79 181 TR_Caps_n_Bayes_99 1192 0.31 1.01 0.15 182 DIET_1 1170 0.41 0.99 0.28 183 XMSubMetaD_00 1167 0.24 0.98 0.07 184 RCVD_IN_IADB_VOUCHED 1142 2.87 0.96 3.32 185 CHARSET_FARAWAY_HEADER 1136 0.21 0.96 0.03 186 RELAYCOUNTRY_CM 1129 0.18 0.95 0.00 187 XM_H_ZimbraSpoof2 1126 0.18 0.95 0.00 188 DATE_IN_PAST_06_12 1124 0.26 0.95 0.10 189 XMSubNoVowel 1119 1.00 0.94 1.02 190 RCVD_IN_MSPIKE_L4 1115 0.23 0.94 0.07 191 RELAYCOUNTRY_IE 1106 0.31 0.93 0.16 192 XMPhish30 1105 0.63 0.93 0.55 193 XMSexyCombo_04 1100 0.34 0.93 0.20 194 TR_XM_FormFill 1082 0.21 0.91 0.05 195 URIBL_DBL_SPAM 1070 0.18 0.90 0.01 196 XMBdyGiftCard01 1064 0.86 0.90 0.85 197 DKIM_ADSP_NXDOMAIN 1061 0.78 0.90 0.76 198 MIMEOLE_DIRECT_TO_MX 1056 0.17 0.89 0.00 199 RELAYCOUNTRY_AE 1052 0.17 0.89 0.00 200 INVESTMENT_ADVICE 1043 0.28 0.88 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 494768 98.31 96.79 98.66 2 HTML_MESSAGE 447302 90.28 94.87 89.20 3 RELAYCOUNTRY_US 420029 80.01 64.12 83.76 4 DKIM_SIGNED 404557 78.25 67.96 80.67 5 XM_DK_Pass 398518 76.88 65.91 79.47 6 DKIM_VALID 388882 74.93 63.85 77.55 7 XM_B_Unicode 364915 70.39 60.32 72.77 8 DKIM_VALID_AU 293642 56.38 47.18 58.56 9 XMListUnsubscribeExists 277916 55.84 57.60 55.42 10 BAYES_50 265782 48.53 29.63 53.00 11 XM_B_SpammyWords 263226 55.92 70.45 52.49 12 XM_B_Unicode3 211392 40.01 30.91 42.15 13 HTML_FONT_LOW_CONTRAST 150594 29.26 26.00 30.03 14 RCVD_IN_MSPIKE_WL 149588 25.80 8.74 29.83 15 DKIM_VALID_EF 146732 29.58 30.93 29.26 16 RCVD_IN_MSPIKE_H2 141620 30.61 40.64 28.24 17 T_TM2_M_HEADER_IN_MSG 136595 25.46 17.91 27.24 18 LOC_TINY_FONT_1 135361 27.56 29.98 26.99 19 XM_B_SpammyWords2 121785 28.44 46.03 24.29 20 FVGT_m_MULTI_ODD 117178 22.70 19.89 23.37 21 XMSubLong 111164 22.20 22.35 22.17 22 MIME_HTML_ONLY 108258 25.32 41.12 21.59 23 T_KAM_HTML_FONT_INVALID 97505 20.17 23.25 19.44 24 RCVD_IN_MSPIKE_H3 84321 14.51 4.77 16.81 25 XM_Body_Dirty_Words 73183 15.13 17.42 14.59 26 XM_Multi_Part_URI 66675 14.44 19.29 13.30 27 BAYES_00 63580 10.56 1.61 12.68 28 XM_DK_Undo_02 62822 18.67 44.68 12.53 29 ALL_TRUSTED 60775 10.17 1.91 12.12 30 XM_B_Unsub 60169 11.97 11.87 12.00 31 RCVD_IN_MSPIKE_H4 54062 9.39 3.52 10.78 32 LotsOfNums_01 47693 8.77 5.63 9.51 33 TR_XM_DK_Bayes 45601 7.55 1.03 9.09 34 LOTS_OF_MONEY 45258 10.11 14.69 9.03 35 TR_XM_DK_Bayes1 44093 7.31 1.01 8.79 36 XM_Evil_Numbers_Gen 44059 8.51 7.36 8.79 37 BAYES_99 43167 14.57 39.79 8.61 38 TooManyTo_001 42209 7.74 4.87 8.42 39 UNPARSEABLE_RELAY 42041 7.54 3.97 8.38 40 RCVD_IN_RP_SAFE 40302 6.62 0.62 8.04 41 TR_XM_DK_Bayes2 38921 6.43 0.82 7.76 42 RCVD_IN_RP_CERTIFIED 38375 6.28 0.49 7.65 43 XM_SendGrid 38325 6.78 3.11 7.64 44 XM_DKIMWhitelistDomains 38095 6.15 0.00 7.60 45 XM_B_Phish_Phrases 37945 8.17 10.73 7.57 46 HTML_IMAGE_RATIO_02 37906 7.35 6.44 7.56 47 BAYES_60 35728 7.24 7.71 7.12 48 BAYES_999 35261 11.34 29.59 7.03 49 XM_B_SpammyWords3 31757 7.19 10.81 6.33 50 XM_H_Long_From01 31689 5.91 4.19 6.32 51 MIME_QP_LONG_LINE 31350 5.44 2.02 6.25 52 BOTNET_IPINHOSTNAME 30144 7.63 14.47 6.01 53 IN_ZIMBRA_NJ_WHITELIST 29615 4.79 0.07 5.91 54 HTML_IMAGE_RATIO_04 29545 5.53 4.00 5.89 55 RCVD_IN_IADB_LISTED 27885 4.79 1.52 5.56 56 RELAYCOUNTRY_META 26389 11.12 35.93 5.26 57 BAYES_40 25349 4.42 1.74 5.05 58 BAYES_80 24399 5.94 10.48 4.87 59 RCVD_IN_IADB_SPF 24291 4.15 1.19 4.84 60 XMSexyCombo_05 23673 6.04 11.64 4.72 61 TR_XM_DK_SendGrid 23342 4.06 1.55 4.65 62 XMStrtUSub 22422 4.09 2.46 4.47 63 RCVD_IN_IADB_SENDERID 21790 3.72 1.05 4.35 64 RCVD_IN_IADB_DK 21157 3.61 1.04 4.22 65 T_TooManySym_01 20809 4.64 6.70 4.15 66 MPART_ALT_DIFF 20586 5.60 11.92 4.11 67 XM_PDF 20546 3.54 1.18 4.10 68 XMSubMetaSx_00 18985 4.40 6.98 3.79 69 HTML_IMAGE_RATIO_06 17816 3.43 2.93 3.55 70 BAYES_20 17623 3.16 1.64 3.51 71 XMNumbers 17330 3.54 3.90 3.46 72 TR_XM_PhishingBody 17059 3.85 5.73 3.40 73 T_REMOTE_IMAGE 16727 3.90 6.26 3.34 74 RCVD_IN_IADB_VOUCHED 16670 2.87 0.96 3.32 75 FROM_EXCESS_BASE64 15822 5.95 17.80 3.16 76 TM2_M_URI_OPT_OUT 15736 3.08 2.81 3.14 77 DKIM_INVALID 15675 3.32 4.12 3.13 78 XM_UncommonTLD01 15465 6.21 19.44 3.08 79 XM_B_Unsub2 15188 3.02 3.00 3.03 80 BAYES_95 14560 3.59 6.51 2.90 81 ANY_BOUNCE_MESSAGE 13712 2.34 0.65 2.73 82 TR_XM_SB_Phish 13711 2.81 3.15 2.73 83 BOUNCE_MESSAGE 13704 2.33 0.64 2.73 84 XMSubPhish11 13526 2.77 3.08 2.70 85 HTML_IMAGE_RATIO_08 13111 5.53 17.86 2.61 86 URI_NOVOWEL 12824 2.28 1.12 2.56 87 MIME_HTML_MOSTLY 12296 3.94 10.23 2.45 88 XM_B_SpammyTLD 11833 2.69 4.09 2.36 89 BOTNET 11758 7.16 27.55 2.34 90 T_TooManySym_02 11370 2.27 2.27 2.27 91 MIME_HTML_ONLY_MULTI 11278 2.11 1.51 2.25 92 BAYES_05 11256 1.98 0.87 2.24 93 RCVD_IN_MSPIKE_H5 11205 1.89 0.45 2.23 94 HTML_MIME_NO_HTML_TAG 10886 5.27 18.36 2.17 95 RCVD_IN_IADB_OPTIN 10849 1.88 0.68 2.16 96 MAILING_LIST_MULTI 10725 1.90 0.88 2.14 97 UNTRUSTED_Relay 10466 6.27 23.96 2.09 98 XM_B_Phish66 9853 2.27 3.56 1.96 99 XM_CamelCaseFrm001 9823 2.02 2.28 1.96 100 XM_DK_Undo_01 9693 1.73 0.86 1.93 101 TooManyTo_002 9662 1.69 0.71 1.93 102 URI_HEX 9640 2.01 2.40 1.92 103 XMDiploma_00 9411 1.98 2.40 1.88 104 RELAYCOUNTRY_CA 9406 2.65 5.94 1.88 105 RCVD_IN_BL_SPAMCOP_NET 9180 5.77 22.46 1.83 106 TR_Symld_Words 8752 1.83 2.20 1.75 107 T_XMDrugObfuBody_08 8570 1.94 2.94 1.71 108 T_XMDrugObfuBody_14 8462 1.76 2.04 1.69 109 XMBrknScrpt_02 8391 2.20 4.41 1.67 110 SUBJ_ALL_CAPS 8384 1.72 1.93 1.67 111 XM_SPF_SoftFail 8378 2.16 4.25 1.67 112 TVD_RCVD_IP 8029 1.37 0.37 1.60 113 XM_ProductURIs 7955 1.38 0.50 1.59 114 URI_TRY_3LD 7687 1.55 1.63 1.53 115 IN_HORDE_ADDRESS_BOOK 7664 1.26 0.14 1.53 116 INVALID_MSGID 7269 1.25 0.39 1.45 117 HELO_MISC_IP 7087 1.28 0.72 1.41 118 KHOP_HELO_FCRDNS 7078 2.03 4.64 1.41 119 CK_HELO_DYNAMIC_SPLIT_IP 7073 1.31 0.87 1.41 120 XMGappySubj_01 7063 1.17 0.14 1.41 121 TM2_M_VERY_LONG_WORD 6821 1.46 1.87 1.36 122 XM_B_COVIDMETA 6670 2.14 5.57 1.33 123 XM_H_Long_From02 6661 1.24 0.84 1.33 124 XMStockSpam_06 6461 1.28 1.23 1.29 125 USER_IN_DEF_DKIM_WL 6399 1.03 0.01 1.28 126 TooManyTo_003 6387 1.13 0.53 1.27 127 XM_OfRef6 6351 1.73 3.69 1.27 128 HELO_NODOT 6332 1.18 0.82 1.26 129 HELO_NO_DOMAIN 6331 1.18 0.81 1.26 130 TO_MALFORMED 6294 1.02 0.01 1.26 131 DKIM_ADSP_CUSTOM_MED 6062 1.23 1.31 1.21 132 HTML_FONT_FACE_BAD 5689 0.99 0.38 1.13 133 XM_GoogleGroups 5513 0.96 0.36 1.10 134 XM_UB50 5466 2.27 7.26 1.09 135 XMCapTrack 5316 0.94 0.42 1.06 136 TR_LOTS_OF_MONEY3 5219 1.49 3.38 1.04 137 XMGenDplmaNmb 5148 1.08 1.33 1.03 138 XMSubNoVowel 5097 1.00 0.94 1.02 139 XMBody_17 5020 1.39 3.02 1.00 140 T_FILL_THIS_FORM_SHORT 4886 1.14 1.84 0.97 141 RCVD_IN_MSPIKE_BL 4696 2.55 9.40 0.94 142 TooManyTo_004 4636 0.84 0.46 0.92 143 RELAYCOUNTRY_GB 4592 1.62 4.59 0.92 144 XM_H_Trusted_IP 4568 0.74 0.00 0.91 145 TR_MSPIKEBAYES00 4474 0.72 0.01 0.89 146 T_TooManySym_03 4456 0.77 0.26 0.89 147 T_XMHurry_00 4389 0.93 1.14 0.88 148 XMBdyGiftCard01 4251 0.86 0.90 0.85 149 XMSexyCombo_01 4249 1.09 2.12 0.85 150 TR_MetaPhish_Combo_01 4200 0.90 1.18 0.84 151 NML_ADSP_CUSTOM_MED 4199 0.91 1.22 0.84 152 XM_B_SpammyWords4 4138 1.11 2.33 0.83 153 LH_URI_DOM_IN_PATH 4095 1.00 1.80 0.82 154 XMHTML_After_End 3863 0.86 1.25 0.77 155 T_XMDrugObfuBody_00 3810 1.00 2.00 0.76 156 DKIM_ADSP_NXDOMAIN 3803 0.78 0.90 0.76 157 SpammyFromTLD_01 3770 1.81 6.29 0.75 158 TooManyTo_005 3762 0.68 0.38 0.75 159 XMSubMetaI_00 3539 0.68 0.57 0.71 160 HTTPS_HTTP_MISMATCH 3528 0.72 0.80 0.70 161 XM_SPF_Unknown 3515 0.77 1.06 0.70 162 HTML_IMAGE_ONLY_20 3331 0.59 0.25 0.66 163 XM_ShortIntro_01 3303 0.60 0.34 0.66 164 XMBody_95 3277 0.55 0.09 0.65 165 FROM_GOV_DKIM_AU 3272 0.55 0.12 0.65 166 TR_BOTNET_NEGATE 3204 0.62 0.56 0.64 167 RCVD_IN_MSPIKE_L3 3186 1.53 5.33 0.64 168 T_OBFU_PDF_ATTACH 3162 0.54 0.14 0.63 169 XMNoVowels 3141 0.78 1.42 0.63 170 T_PDS_OTHER_BAD_TLD 3129 0.94 2.26 0.62 171 FORGED_GMAIL_RCVD 3051 0.70 1.08 0.61 172 SUBJ_DOLLARS 2975 0.60 0.61 0.59 173 XMHTMLBadTable_001 2891 0.53 0.34 0.58 174 T_Symld_Words_02 2886 0.67 1.04 0.58 175 XMMoneyMeta_00 2876 0.62 0.80 0.57 176 XMPhish30 2772 0.63 0.93 0.55 177 XMBody_78 2645 0.58 0.78 0.53 178 XM_DIRTYINTL 2640 1.31 4.62 0.53 179 TM2_M_BODY_EMPTY 2625 0.44 0.09 0.52 180 XM_H_PHPMailer 2610 0.56 0.75 0.52 181 XM_B_COPY_HTML 2512 0.50 0.50 0.50 182 T_TooManySym_04 2511 0.42 0.08 0.50 183 NUMERIC_HTTP_ADDR 2499 0.57 0.85 0.50 184 TR_XM_UnparsRelay 2476 0.80 2.12 0.49 185 NO_DNS_FOR_FROM 2446 0.53 0.72 0.49 186 TR_XM_COVIDMETA4 2437 0.76 1.94 0.49 187 HTML_TAG_BALANCE_BODY 2392 0.50 0.60 0.48 188 XMPhish14 2377 0.51 0.67 0.47 189 RDNS_DYNAMIC 2375 0.60 1.12 0.47 190 T_FONT_INVIS_MSGID 2373 0.53 0.77 0.47 191 XM_S_SubURI 2367 0.40 0.11 0.47 192 MPART_ALT_DIFF_COUNT 2277 0.49 0.66 0.45 193 SpammyFromTLD_02 2272 1.95 8.26 0.45 194 TM2_M_A_HREF_HREF 2248 0.65 1.50 0.45 195 XM_B_REG_HTML 2244 0.38 0.11 0.45 196 XMSolicitRefs_0 2161 0.40 0.28 0.43 197 XMSubMetaSxObfu_03 2135 0.47 0.67 0.43 198 HTML_IMAGE_ONLY_24 2021 0.37 0.23 0.40 199 XMPhish08 2006 0.44 0.61 0.40 200 SPOOFED_URL 1973 0.45 0.70 0.39 ----------------------------------------------------------------------