Email: 698159 Autolearn: 0 AvgScore: 3.34 AvgScanTime: 1.21 sec Spam: 188767 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.39 sec Ham: 509392 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 1.15 sec Time Spent Running SA: 234.90 hours Time Spent Processing Spam: 72.79 hours Time Spent Processing Ham: 162.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 173632 90.25 91.98 89.61 2 DKIM_SIGNED 144592 77.51 76.60 77.85 3 XM_DK_Pass 140726 76.01 74.55 76.55 4 XM_B_Unicode 140368 70.83 74.36 69.52 5 DCC_CHECK 140254 47.87 74.30 38.08 6 RELAYCOUNTRY_US 136526 79.32 72.33 81.91 7 DKIM_VALID 136142 73.71 72.12 74.30 8 XM_B_SpammyWords 127122 53.14 67.34 47.88 9 XMListUnsubscribeExists 123634 55.40 65.50 51.66 10 DKIM_VALID_AU 103800 55.35 54.99 55.49 11 XM_DK_Undo_02 75808 17.10 40.16 8.56 12 BAYES_50 73177 51.19 38.77 55.79 13 XM_B_SpammyWords2 70687 25.75 37.45 21.41 14 XM_B_Unicode3 69963 38.46 37.06 38.97 15 BAYES_99 61303 12.66 32.48 5.32 16 LOC_TINY_FONT_1 61220 25.54 32.43 22.98 17 HTML_FONT_LOW_CONTRAST 60368 28.20 31.98 26.79 18 MIME_HTML_ONLY 60131 23.22 31.85 20.03 19 RCVD_IN_MSPIKE_H2 52063 27.14 27.58 26.97 20 DKIM_VALID_EF 51085 28.61 27.06 29.18 21 FVGT_m_MULTI_ODD 49283 23.52 26.11 22.56 22 BAYES_999 47294 9.89 25.05 4.27 23 TR_DCC_Bayes_99 46995 8.52 24.90 2.45 24 T_KAM_HTML_FONT_INVALID 46761 20.75 24.77 19.26 25 DCC_CHECK_NEGATIVE 45515 50.12 24.11 59.76 26 XMSubLong 43921 21.55 23.27 20.92 27 T_TM2_M_HEADER_IN_MSG 43111 28.38 22.84 30.44 28 RELAYCOUNTRY_META 42384 10.13 22.45 5.56 29 XM_Multi_Part_URI 39651 14.36 21.01 11.89 30 UNTRUSTED_Relay 36654 6.76 19.42 2.07 31 XM_Body_Dirty_Words 34966 14.17 18.52 12.56 32 BOTNET 34808 6.40 18.44 1.94 33 LOTS_OF_MONEY 30934 9.80 16.39 7.35 34 RCVD_IN_MSPIKE_WL 30321 25.55 16.06 29.07 35 FSL_BULK_SIG 28332 7.65 15.01 4.93 36 TR_XM_SpammyWords2 23865 4.46 12.64 1.43 37 XM_B_SpammyWords3 23675 7.47 12.54 5.59 38 BOTNET_IPINHOSTNAME 22154 6.48 11.74 4.54 39 RCVD_IN_MSPIKE_BL 21887 3.55 11.59 0.58 40 XM_B_Phish_Phrases 20376 7.48 10.79 6.26 41 XM_B_Unsub 20258 11.34 10.73 11.57 42 XMSexyCombo_05 19738 5.48 10.46 3.64 43 XM_UncommonTLD01 19297 5.15 10.22 3.28 44 LotsOfNums_01 18875 9.51 10.00 9.33 45 XM_Evil_Numbers_Gen 17312 8.57 9.17 8.35 46 RCVD_IN_MSPIKE_H3 16286 14.15 8.63 16.20 47 MPART_ALT_DIFF 16043 4.99 8.50 3.69 48 T_REMOTE_IMAGE 16041 4.94 8.50 3.63 49 RCVD_IN_RP_RNBL 15939 2.38 8.44 0.13 50 XM_UB50 15576 2.98 8.25 1.02 51 BAYES_80 15422 5.22 8.17 4.13 52 BAYES_60 13717 7.62 7.27 7.75 53 HTML_IMAGE_RATIO_02 13698 6.92 7.26 6.79 54 RCVD_IN_BL_SPAMCOP_NET 13356 2.91 7.08 1.37 55 TR_XM_SpammyWords3 13212 2.13 7.00 0.32 56 XMSubMetaSx_00 12932 4.21 6.85 3.23 57 RCVD_IN_MSPIKE_H4 12857 9.51 6.81 10.50 58 RCVD_IN_MSPIKE_L5 12519 1.92 6.63 0.17 59 MIME_HTML_MOSTLY 12273 3.37 6.50 2.21 60 TR_XM_PhishingBody 12169 4.00 6.45 3.09 61 UNPARSEABLE_RELAY 12048 7.66 6.38 8.14 62 SHORTENED_URL_HREF 11780 1.90 6.24 0.29 63 KHOP_HELO_FCRDNS 11699 2.86 6.20 1.63 64 RCVD_IN_PSBL 11611 1.67 6.15 0.01 65 RELAYCOUNTRY_CA 11535 2.85 6.11 1.64 66 BODY_URI_ONLY 11189 1.65 5.93 0.06 67 TooManyTo_001 10883 7.67 5.77 8.38 68 SHORT_SHORTNER 10617 1.53 5.62 0.02 69 HTML_IMAGE_ONLY_08 10611 1.59 5.62 0.10 70 SHORT_URI_3 10479 1.53 5.55 0.04 71 HTML_SHORT_LINK_IMG_1 10424 1.52 5.52 0.03 72 SHORTENER_SHORT_IMG 10339 1.48 5.48 0.00 73 SHORTENED_URL_SRC 10336 1.48 5.48 0.00 74 BAYES_95 9736 3.23 5.16 2.52 75 XM_H_Long_From01 9604 5.98 5.09 6.32 76 XM_SendGrid 9357 6.82 4.96 7.51 77 XMBrknScrpt_02 9251 1.99 4.90 0.91 78 HTML_IMAGE_RATIO_04 9250 4.72 4.90 4.65 79 URIBL_SBL_A 8989 1.42 4.76 0.18 80 TR_XM_COVIDMETA4 8840 1.61 4.68 0.47 81 ANY_BOUNCE_MESSAGE 8589 3.24 4.55 2.76 82 BOUNCE_MESSAGE 8589 3.24 4.55 2.76 83 T_FONT_INVIS_NAKED_TO 8582 2.66 4.55 1.96 84 XMNumbers 8469 3.70 4.49 3.41 85 DKIM_INVALID 8450 3.80 4.48 3.55 86 XM_SPF_SoftFail 8299 2.41 4.40 1.67 87 XMBody_17 8057 1.70 4.27 0.74 88 XM_B_COVIDMETA 7988 2.06 4.23 1.26 89 SpammyFromTLD_01 7987 1.80 4.23 0.90 90 RCVD_IN_MSPIKE_L3 7870 1.39 4.17 0.36 91 XM_Lotto 7774 1.16 4.12 0.07 92 XM_B_Phish66 7665 2.36 4.06 1.73 93 XM_B_SpammyTLD 7408 2.55 3.92 2.05 94 XM_OfRef6 7385 1.88 3.91 1.13 95 XMStrtUSub 6723 4.25 3.56 4.50 96 DATE_IN_PAST_03_06 6386 0.98 3.38 0.09 97 HTML_IMAGE_RATIO_06 6332 3.40 3.35 3.41 98 RELAYCOUNTRY_FR 6215 1.09 3.29 0.28 99 URI_HEX 6151 1.83 3.26 1.30 100 XM_DIRTYINTL 6142 1.25 3.25 0.51 101 TR_LOTS_OF_MONEY3 6060 1.45 3.21 0.79 102 SpammyFromTLD_02 5852 1.09 3.10 0.34 103 FROM_EXCESS_BASE64 5705 2.76 3.02 2.67 104 TM2_M_URI_OPT_OUT 5537 2.78 2.93 2.73 105 BAYES_40 5478 4.28 2.90 4.79 106 TR_XM_MaxBayes 5323 0.78 2.82 0.02 107 URI_PHP_REDIR 5253 0.77 2.78 0.02 108 XMDiploma_00 5198 2.26 2.75 2.08 109 LH_URI_DOM_IN_PATH 5162 2.36 2.73 2.23 110 T_XMDrugObfuBody_08 5085 1.92 2.69 1.63 111 XM_UB99 5027 0.72 2.66 0.00 112 URI_TRY_3LD 4960 1.72 2.63 1.38 113 BOTNET_NORDNS 4879 0.72 2.58 0.02 114 TR_XM_DK_SendGrid 4846 4.08 2.57 4.65 115 TR_Symld_Words 4732 2.13 2.51 2.00 116 MIME_QP_LONG_LINE 4602 5.16 2.44 6.17 117 TR_XM_SB_Phish 4598 2.54 2.44 2.57 118 HTML_MIME_NO_HTML_TAG 4588 2.76 2.43 2.89 119 XM_B_Unsub2 4586 2.92 2.43 3.10 120 HTML_IMAGE_RATIO_08 4382 2.27 2.32 2.25 121 MIME_HTML_ONLY_MULTI 4340 1.99 2.30 1.87 122 XMSubPhish11 4338 2.47 2.30 2.53 123 T_XMHurry_00 4299 1.19 2.28 0.78 124 XM_URI_RBL 4201 0.74 2.23 0.18 125 TR_XM_UnparsRelay 4166 0.89 2.21 0.40 126 XM_CamelCaseFrm001 4151 1.92 2.20 1.82 127 BAYES_20 4120 3.25 2.18 3.64 128 T_TooManySym_01 4052 4.20 2.15 4.97 129 XM_UB60 4050 0.65 2.15 0.09 130 RCVD_IN_RP_SAFE 4045 5.95 2.14 7.36 131 T_XMDrugObfuBody_00 4036 1.48 2.14 1.23 132 XMStockSpam_06 4024 1.20 2.13 0.86 133 XM_B_SpammyWords4 3898 1.16 2.06 0.82 134 BAYES_00 3676 10.52 1.95 13.69 135 DATE_IN_PAST_06_12 3654 0.65 1.94 0.17 136 TR_XM_MaxSPIKE 3639 0.53 1.93 0.01 137 TM2_M_VERY_LONG_WORD 3615 1.31 1.92 1.08 138 SUBJ_ALL_CAPS 3550 1.68 1.88 1.61 139 XMGenDplmaNmb 3512 1.36 1.86 1.17 140 XM_OfRef7 3479 0.61 1.84 0.15 141 RCVD_IN_IADB_LISTED 3439 4.74 1.82 5.82 142 XMSexyCombo_01 3361 0.87 1.78 0.54 143 XM_UB999 3361 0.48 1.78 0.00 144 T_PDS_OTHER_BAD_TLD 3345 0.82 1.77 0.47 145 RCVD_IN_RP_CERTIFIED 3318 5.45 1.76 6.81 146 ALL_TRUSTED 3304 10.86 1.75 14.24 147 RELAYCOUNTRY_IN 3302 0.55 1.75 0.11 148 RELAYCOUNTRY_TR 3278 0.48 1.74 0.01 149 XM_UB80 3274 0.49 1.73 0.03 150 HELO_NODOT 3115 1.70 1.65 1.71 151 HELO_NO_DOMAIN 3113 1.69 1.65 1.71 152 TR_XM_PHPDW 3060 0.70 1.62 0.35 153 TR_XM_PHPForged 3014 0.68 1.60 0.34 154 TR_XM_FormFill2 2979 0.67 1.58 0.34 155 XM_H_PHPOS 2973 0.67 1.57 0.33 156 T_FILL_THIS_FORM_SHORT 2965 1.18 1.57 1.04 157 RCVD_IN_IADB_SPF 2922 4.10 1.55 5.04 158 XMBdyGiftCard01 2831 0.69 1.50 0.39 159 XM_BadFromFormat 2759 0.53 1.46 0.18 160 XMSlimDrugH 2745 0.64 1.45 0.33 161 T_XMDrugObfuBody_14 2736 1.47 1.45 1.48 162 RCVD_IN_IADB_SENDERID 2723 3.68 1.44 4.51 163 TR_XM_COVIDMETA1 2723 0.70 1.44 0.42 164 XMMoneyMeta_00 2718 0.84 1.44 0.62 165 RCVD_IN_IADB_DK 2697 3.55 1.43 4.34 166 FROM_SUSPICIOUS_NTLD 2609 0.43 1.38 0.08 167 TR_XM_INV_DKIM 2602 0.45 1.38 0.11 168 XMHTML_After_End 2594 0.96 1.37 0.80 169 FROM_SUSPICIOUS_NTLD_FP 2546 0.42 1.35 0.07 170 RELAYCOUNTRY_GB 2516 1.25 1.33 1.23 171 FSL_HELO_NON_FQDN_1 2480 0.37 1.31 0.02 172 XM_DK_Undo_01 2431 1.83 1.29 2.03 173 TR_XM_RelayPhish 2413 0.57 1.28 0.31 174 REMOVE_BEFORE_LINK 2393 0.47 1.27 0.18 175 FILL_THIS_FORM 2380 0.50 1.26 0.22 176 DKIM_ADSP_CUSTOM_MED 2374 1.63 1.26 1.77 177 XMSubNoVowel 2312 0.84 1.22 0.70 178 XM_ProductURIs 2294 1.26 1.22 1.28 179 T_FILL_THIS_FORM_LONG 2255 0.43 1.19 0.14 180 MISSING_HEADERS 2251 0.73 1.19 0.56 181 MAILING_LIST_MULTI 2217 2.45 1.17 2.92 182 TR_MetaPhish_Combo_01 2180 1.12 1.15 1.10 183 T_LONG_INVISIBLE_TEXT 2149 0.69 1.14 0.52 184 SUBJ_DOLLARS 2134 0.51 1.13 0.27 185 XMBody_78 2120 0.56 1.12 0.35 186 RELAYCOUNTRY_NL 2119 0.62 1.12 0.44 187 MIME_HEADER_CTYPE_ONLY 2061 0.44 1.09 0.20 188 XM_UB95 2054 0.31 1.09 0.02 189 HTTPS_HTTP_MISMATCH 2041 0.86 1.08 0.77 190 HTML_FONT_SIZE_HUGE 2038 0.40 1.08 0.15 191 FORGED_GMAIL_RCVD 2022 1.18 1.07 1.23 192 URI_NOVOWEL 1997 2.10 1.06 2.49 193 XM_PDF 1980 3.75 1.05 4.75 194 DKIM_ADSP_NXDOMAIN 1979 0.70 1.05 0.57 195 TO_NO_BRKTS_HTML_ONLY 1945 0.46 1.03 0.25 196 HTML_IMAGE_ONLY_12 1942 0.74 1.03 0.63 197 SENDGRID_REDIR 1910 0.62 1.01 0.48 198 NML_ADSP_CUSTOM_MED 1907 1.34 1.01 1.46 199 XMSubMetaI_00 1887 0.78 1.00 0.69 200 BAYES_05 1873 1.98 0.99 2.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 456442 90.25 91.98 89.61 2 RELAYCOUNTRY_US 417244 79.32 72.33 81.91 3 DKIM_SIGNED 396582 77.51 76.60 77.85 4 XM_DK_Pass 389946 76.01 74.55 76.55 5 DKIM_VALID 378491 73.71 72.12 74.30 6 XM_B_Unicode 354134 70.83 74.36 69.52 7 DCC_CHECK_NEGATIVE 304436 50.12 24.11 59.76 8 BAYES_50 284198 51.19 38.77 55.79 9 DKIM_VALID_AU 282653 55.35 54.99 55.49 10 XMListUnsubscribeExists 263145 55.40 65.50 51.66 11 XM_B_SpammyWords 243880 53.14 67.34 47.88 12 XM_B_Unicode3 198518 38.46 37.06 38.97 13 DCC_CHECK 193985 47.87 74.30 38.08 14 T_TM2_M_HEADER_IN_MSG 155050 28.38 22.84 30.44 15 DKIM_VALID_EF 148638 28.61 27.06 29.18 16 RCVD_IN_MSPIKE_WL 148066 25.55 16.06 29.07 17 RCVD_IN_MSPIKE_H2 137398 27.14 27.58 26.97 18 HTML_FONT_LOW_CONTRAST 136480 28.20 31.98 26.79 19 LOC_TINY_FONT_1 117081 25.54 32.43 22.98 20 FVGT_m_MULTI_ODD 114894 23.52 26.11 22.56 21 XM_B_SpammyWords2 109061 25.75 37.45 21.41 22 XMSubLong 106551 21.55 23.27 20.92 23 MIME_HTML_ONLY 102006 23.22 31.85 20.03 24 T_KAM_HTML_FONT_INVALID 98112 20.75 24.77 19.26 25 RCVD_IN_MSPIKE_H3 82518 14.15 8.63 16.20 26 ALL_TRUSTED 72539 10.86 1.75 14.24 27 BAYES_00 69750 10.52 1.95 13.69 28 XM_Body_Dirty_Words 63957 14.17 18.52 12.56 29 XM_Multi_Part_URI 60582 14.36 21.01 11.89 30 XM_B_Unsub 58920 11.34 10.73 11.57 31 RCVD_IN_MSPIKE_H4 53510 9.51 6.81 10.50 32 TR_XM_DK_Bayes 52182 7.60 0.48 10.24 33 TR_XM_DK_Bayes1 50561 7.37 0.46 9.93 34 LotsOfNums_01 47509 9.51 10.00 9.33 35 TR_XM_DK_Bayes2 44623 6.51 0.42 8.76 36 XM_DK_Undo_02 43584 17.10 40.16 8.56 37 TooManyTo_001 42680 7.67 5.77 8.38 38 XM_Evil_Numbers_Gen 42541 8.57 9.17 8.35 39 UNPARSEABLE_RELAY 41445 7.66 6.38 8.14 40 BAYES_60 39486 7.62 7.27 7.75 41 XM_SendGrid 38255 6.82 4.96 7.51 42 XM_DKIMWhitelistDomains 38177 5.47 0.01 7.49 43 RCVD_IN_RP_SAFE 37513 5.95 2.14 7.36 44 LOTS_OF_MONEY 37452 9.80 16.39 7.35 45 IN_ZIMBRA_NJ_WHITELIST 36452 5.23 0.04 7.16 46 RCVD_IN_RP_CERTIFIED 34706 5.45 1.76 6.81 47 HTML_IMAGE_RATIO_02 34613 6.92 7.26 6.79 48 XM_H_Long_From01 32179 5.98 5.09 6.32 49 XM_B_Phish_Phrases 31872 7.48 10.79 6.26 50 MIME_QP_LONG_LINE 31427 5.16 2.44 6.17 51 RCVD_IN_IADB_LISTED 29626 4.74 1.82 5.82 52 XM_B_SpammyWords3 28458 7.47 12.54 5.59 53 RELAYCOUNTRY_META 28312 10.13 22.45 5.56 54 BAYES_99 27105 12.66 32.48 5.32 55 RCVD_IN_IADB_SPF 25679 4.10 1.55 5.04 56 T_TooManySym_01 25299 4.20 2.15 4.97 57 FSL_BULK_SIG 25099 7.65 15.01 4.93 58 BAYES_40 24387 4.28 2.90 4.79 59 XM_PDF 24187 3.75 1.05 4.75 60 HTML_IMAGE_RATIO_04 23712 4.72 4.90 4.65 61 TR_XM_DK_SendGrid 23668 4.08 2.57 4.65 62 BOTNET_IPINHOSTNAME 23117 6.48 11.74 4.54 63 RCVD_IN_IADB_SENDERID 22960 3.68 1.44 4.51 64 XMStrtUSub 22931 4.25 3.56 4.50 65 RCVD_IN_IADB_DK 22117 3.55 1.43 4.34 66 BAYES_999 21742 9.89 25.05 4.27 67 BAYES_80 21055 5.22 8.17 4.13 68 MPART_ALT_DIFF 18813 4.99 8.50 3.69 69 BAYES_20 18536 3.25 2.18 3.64 70 XMSexyCombo_05 18531 5.48 10.46 3.64 71 T_REMOTE_IMAGE 18478 4.94 8.50 3.63 72 RCVD_IN_IADB_VOUCHED 18403 2.86 0.84 3.61 73 DKIM_INVALID 18091 3.80 4.48 3.55 74 HTML_IMAGE_RATIO_06 17377 3.40 3.35 3.41 75 XMNumbers 17375 3.70 4.49 3.41 76 XM_UncommonTLD01 16692 5.15 10.22 3.28 77 XMSubMetaSx_00 16470 4.21 6.85 3.23 78 XM_B_Unsub2 15795 2.92 2.43 3.10 79 TR_XM_PhishingBody 15738 4.00 6.45 3.09 80 MAILING_LIST_MULTI 14888 2.45 1.17 2.92 81 HTML_MIME_NO_HTML_TAG 14713 2.76 2.43 2.89 82 ANY_BOUNCE_MESSAGE 14040 3.24 4.55 2.76 83 BOUNCE_MESSAGE 14039 3.24 4.55 2.76 84 TM2_M_URI_OPT_OUT 13887 2.78 2.93 2.73 85 FROM_EXCESS_BASE64 13595 2.76 3.02 2.67 86 TR_XM_SB_Phish 13111 2.54 2.44 2.57 87 XMSubPhish11 12898 2.47 2.30 2.53 88 BAYES_95 12815 3.23 5.16 2.52 89 URI_NOVOWEL 12686 2.10 1.06 2.49 90 TR_DCC_Bayes_99 12463 8.52 24.90 2.45 91 T_TooManySym_02 12346 1.94 0.62 2.42 92 RCVD_IN_MSPIKE_H5 12038 1.89 0.62 2.36 93 BAYES_05 11964 1.98 0.99 2.35 94 RCVD_IN_IADB_OPTIN 11876 1.86 0.59 2.33 95 TooManyTo_002 11494 1.86 0.77 2.26 96 HTML_IMAGE_RATIO_08 11446 2.27 2.32 2.25 97 LH_URI_DOM_IN_PATH 11337 2.36 2.73 2.23 98 MIME_HTML_MOSTLY 11236 3.37 6.50 2.21 99 XMDiploma_00 10596 2.26 2.75 2.08 100 UNTRUSTED_Relay 10541 6.76 19.42 2.07 101 XM_B_SpammyTLD 10418 2.55 3.92 2.05 102 XM_DK_Undo_01 10364 1.83 1.29 2.03 103 TR_Symld_Words 10165 2.13 2.51 2.00 104 T_FONT_INVIS_NAKED_TO 9982 2.66 4.55 1.96 105 BOTNET 9906 6.40 18.44 1.94 106 MIME_HTML_ONLY_MULTI 9534 1.99 2.30 1.87 107 XM_CamelCaseFrm001 9283 1.92 2.20 1.82 108 DKIM_ADSP_CUSTOM_MED 9015 1.63 1.26 1.77 109 XM_B_Phish66 8790 2.36 4.06 1.73 110 HELO_NODOT 8720 1.70 1.65 1.71 111 HELO_NO_DOMAIN 8716 1.69 1.65 1.71 112 XM_SPF_SoftFail 8523 2.41 4.40 1.67 113 RELAYCOUNTRY_CA 8373 2.85 6.11 1.64 114 T_XMDrugObfuBody_08 8309 1.92 2.69 1.63 115 KHOP_HELO_FCRDNS 8285 2.86 6.20 1.63 116 SUBJ_ALL_CAPS 8176 1.68 1.88 1.61 117 XMGappySubj_01 8086 1.23 0.25 1.59 118 IN_HORDE_ADDRESS_BOOK 8021 1.17 0.09 1.57 119 TooManyTo_003 7862 1.30 0.66 1.54 120 TVD_RCVD_IP 7735 1.16 0.20 1.52 121 T_XMDrugObfuBody_14 7531 1.47 1.45 1.48 122 NML_ADSP_CUSTOM_MED 7456 1.34 1.01 1.46 123 INVALID_MSGID 7420 1.13 0.25 1.46 124 TR_XM_SpammyWords2 7288 4.46 12.64 1.43 125 XMCapTrack 7170 1.13 0.40 1.41 126 XM_H_Long_From02 7043 1.24 0.84 1.38 127 URI_TRY_3LD 7030 1.72 2.63 1.38 128 RCVD_IN_BL_SPAMCOP_NET 6979 2.91 7.08 1.37 129 URI_HEX 6623 1.83 3.26 1.30 130 TO_MALFORMED 6580 0.95 0.01 1.29 131 XM_ProductURIs 6512 1.26 1.22 1.28 132 XM_GoogleGroups 6456 1.04 0.44 1.27 133 XM_B_COVIDMETA 6412 2.06 4.23 1.26 134 T_XMDrugObfuBody_00 6268 1.48 2.14 1.23 135 FORGED_GMAIL_RCVD 6242 1.18 1.07 1.23 136 RELAYCOUNTRY_GB 6241 1.25 1.33 1.23 137 HELO_MISC_IP 6143 0.94 0.24 1.21 138 CK_HELO_DYNAMIC_SPLIT_IP 6142 0.99 0.40 1.21 139 XMGenDplmaNmb 5976 1.36 1.86 1.17 140 TooManyTo_004 5776 0.99 0.59 1.13 141 XM_OfRef6 5744 1.88 3.91 1.13 142 XMBSHREFv2 5741 0.91 0.33 1.13 143 TR_MetaPhish_Combo_01 5622 1.12 1.15 1.10 144 TM2_M_VERY_LONG_WORD 5502 1.31 1.92 1.08 145 T_FILL_THIS_FORM_SHORT 5307 1.18 1.57 1.04 146 TR_MSPIKEBAYES00 5226 0.75 0.01 1.03 147 XM_UB50 5199 2.98 8.25 1.02 148 USER_IN_DEF_DKIM_WL 5169 0.74 0.01 1.01 149 T_TooManySym_03 4858 0.75 0.20 0.95 150 XMBrknScrpt_02 4611 1.99 4.90 0.91 151 SpammyFromTLD_01 4596 1.80 4.23 0.90 152 TooManyTo_005 4536 0.75 0.39 0.89 153 XM_H_Trusted_IP 4473 0.64 0.00 0.88 154 XMStockSpam_06 4373 1.20 2.13 0.86 155 XM_B_SpammyWords4 4194 1.16 2.06 0.82 156 XMHTML_After_End 4074 0.96 1.37 0.80 157 TR_LOTS_OF_MONEY3 4045 1.45 3.21 0.79 158 XMNoVowels 4000 0.68 0.39 0.79 159 T_XMHurry_00 3986 1.19 2.28 0.78 160 HTTPS_HTTP_MISMATCH 3939 0.86 1.08 0.77 161 XMBody_95 3937 0.58 0.07 0.77 162 T_OBFU_PDF_ATTACH 3869 0.60 0.18 0.76 163 RELAYCOUNTRY_DE 3842 0.72 0.64 0.75 164 XMBody_17 3793 1.70 4.27 0.74 165 XM_SPF_Unknown 3637 0.75 0.86 0.71 166 XMSubNoVowel 3548 0.84 1.22 0.70 167 XMSubMetaI_00 3534 0.78 1.00 0.69 168 XM_ShortIntro_01 3405 0.58 0.35 0.67 169 FROM_GOV_DKIM_AU 3326 0.50 0.09 0.65 170 HTML_IMAGE_ONLY_12 3213 0.74 1.03 0.63 171 XMHTMLBadTable_001 3183 0.62 0.61 0.62 172 XMMoneyMeta_00 3161 0.84 1.44 0.62 173 RCVD_IN_MSPIKE_BL 2930 3.55 11.59 0.58 174 DKIM_ADSP_NXDOMAIN 2928 0.70 1.05 0.57 175 MISSING_HEADERS 2850 0.73 1.19 0.56 176 HTML_FONT_FACE_BAD 2842 0.59 0.69 0.56 177 T_Symld_Words_02 2798 0.56 0.58 0.55 178 XMPhish14 2777 0.63 0.87 0.55 179 RCVD_IN_SORBS_DUL 2743 0.53 0.51 0.54 180 XMSexyCombo_01 2737 0.87 1.78 0.54 181 T_TooManySym_04 2731 0.41 0.06 0.54 182 T_LONG_INVISIBLE_TEXT 2644 0.69 1.14 0.52 183 HTML_IMAGE_ONLY_20 2632 0.45 0.26 0.52 184 NO_DNS_FOR_FROM 2625 0.58 0.77 0.52 185 TVD_SPACE_RATIO 2613 0.54 0.63 0.51 186 XM_DIRTYINTL 2595 1.25 3.25 0.51 187 XM_H_PHPMailer 2485 0.48 0.47 0.49 188 TM2_M_BODY_EMPTY 2462 0.37 0.05 0.48 189 SENDGRID_REDIR 2430 0.62 1.01 0.48 190 SHORT_HELO_AND_INLINE_IMAGE 2426 0.37 0.08 0.48 191 TR_XM_COVIDMETA4 2417 1.61 4.68 0.47 192 T_PDS_OTHER_BAD_TLD 2405 0.82 1.77 0.47 193 RDNS_DYNAMIC 2398 0.58 0.88 0.47 194 FROM_GOV_SPOOF 2354 0.38 0.15 0.46 195 TR_BOTNET_NEGATE 2354 0.56 0.82 0.46 196 HTML_TAG_BALANCE_BODY 2303 0.58 0.91 0.45 197 XM_S_SubURI 2279 0.34 0.04 0.45 198 XM_Body_Obfu01 2269 0.42 0.37 0.45 199 RELAYCOUNTRY_NL 2234 0.62 1.12 0.44 200 NUMERIC_HTTP_ADDR 2155 0.51 0.75 0.42 ----------------------------------------------------------------------