Email: 707865 Autolearn: 0 AvgScore: 3.80 AvgScanTime: 1.36 sec Spam: 215011 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 1.51 sec Ham: 492854 Autolearn: 0 AvgScore: -0.48 AvgScanTime: 1.30 sec Time Spent Running SA: 268.35 hours Time Spent Processing Spam: 90.08 hours Time Spent Processing Ham: 178.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 207175 92.04 96.36 90.16 2 DKIM_SIGNED 183417 80.59 85.31 78.54 3 XM_DK_Pass 178657 79.17 83.09 77.46 4 DKIM_VALID 174878 77.34 81.33 75.59 5 DCC_CHECK 170690 53.88 79.39 42.75 6 RELAYCOUNTRY_US 168532 82.61 78.38 84.45 7 XM_B_Unicode 161921 74.08 75.31 73.54 8 XMListUnsubscribeExists 148139 58.03 68.90 53.28 9 XM_B_SpammyWords 146331 55.09 68.06 49.44 10 DKIM_VALID_AU 133725 58.70 62.19 57.18 11 XM_DK_Undo_02 102759 20.22 47.79 8.18 12 XM_B_SpammyWords2 87687 28.02 40.78 22.45 13 LOC_TINY_FONT_1 86819 30.62 40.38 26.36 14 XM_B_Unicode3 85472 42.90 39.75 44.28 15 TR_XM_DKIM_Undo 81335 15.47 37.83 5.72 16 BAYES_50 81142 49.88 37.74 55.17 17 HTML_FONT_LOW_CONTRAST 77239 31.08 35.92 28.97 18 BAYES_99 74806 13.95 34.79 4.85 19 MIME_HTML_ONLY 67994 26.21 31.62 23.85 20 RCVD_IN_MSPIKE_H2 66250 28.99 30.81 28.20 21 DKIM_VALID_EF 65693 29.12 30.55 28.49 22 TR_DCC_Bayes_99 60023 10.45 27.92 2.84 23 BAYES_999 58771 11.04 27.33 3.93 24 FVGT_m_MULTI_ODD 58125 24.31 27.03 23.12 25 T_KAM_HTML_FONT_INVALID 54317 20.80 25.26 18.85 26 XMSubLong 51004 22.57 23.72 22.07 27 T_TM2_M_HEADER_IN_MSG 45337 25.78 21.09 27.83 28 RELAYCOUNTRY_META 44161 9.61 20.54 4.85 29 XM_Body_Dirty_Words 43244 15.48 20.11 13.46 30 XM_Multi_Part_URI 42639 14.91 19.83 12.77 31 RCVD_IN_MSPIKE_WL 40828 26.83 18.99 30.25 32 DCC_CHECK_NEGATIVE 40348 44.13 18.77 55.19 33 XM_UncommonTLD01 34065 6.99 15.84 3.12 34 BOTNET 32619 5.91 15.17 1.86 35 XM_B_Unsub 32302 12.35 15.02 11.18 36 LOTS_OF_MONEY 29447 9.39 13.70 7.51 37 XM_B_SpammyWords3 29417 7.68 13.68 5.06 38 TR_XM_SpammyWords2 29003 4.54 13.49 0.64 39 UNTRUSTED_Relay 26888 5.19 12.51 2.00 40 TR_XM_SpammyWords4 25020 6.88 11.64 4.80 41 LotsOfNums_01 24938 9.96 11.60 9.24 42 FSL_BULK_SIG 24855 7.62 11.56 5.90 43 XM_Evil_Numbers_Gen 24214 9.75 11.26 9.08 44 BOTNET_IPINHOSTNAME 24040 6.81 11.18 4.90 45 RCVD_IN_MSPIKE_H3 22888 14.65 10.65 16.39 46 XMSexyCombo_05 22236 6.36 10.34 4.62 47 MPART_ALT_DIFF 21383 6.88 9.95 5.54 48 RCVD_IN_BL_SPAMCOP_NET 20444 4.02 9.51 1.62 49 XM_H_Long_From01 20327 7.10 9.45 6.08 50 UNPARSEABLE_RELAY 17563 8.35 8.17 8.43 51 TR_XM_UnparsRelay 17044 6.67 7.93 6.13 52 BAYES_80 16774 5.30 7.80 4.21 53 BAYES_60 16752 7.63 7.79 7.56 54 MIME_HTML_MOSTLY 16506 3.97 7.68 2.35 55 RCVD_IN_MSPIKE_H4 16426 10.05 7.64 11.10 56 XMSubMetaSx_00 16200 4.67 7.53 3.42 57 HTML_IMAGE_RATIO_02 16125 7.29 7.50 7.19 58 T_REMOTE_IMAGE 15675 4.59 7.29 3.42 59 TooManyTo_001 15353 7.85 7.14 8.16 60 XM_B_Phish_Phrases 15326 5.94 7.13 5.42 61 SpammyFromTLD_02 14628 2.36 6.80 0.42 62 RELAYCOUNTRY_CA 14176 2.97 6.59 1.39 63 XM_OfRef6 14017 2.92 6.52 1.35 64 XM_SendGrid 13917 7.24 6.47 7.57 65 TR_XM_PhishingBody 12882 4.00 5.99 3.13 66 HTML_IMAGE_RATIO_04 12633 5.74 5.88 5.68 67 HTML_SHORT_LINK_IMG_1 12257 1.75 5.70 0.03 68 KHOP_HELO_FCRDNS 11731 2.68 5.46 1.48 69 XM_UB50 11338 2.40 5.27 1.15 70 SpammyFromTLD_01 11194 2.11 5.21 0.76 71 TR_Mismatch_TLD_02 11079 1.62 5.15 0.07 72 XM_BadFromFormat 10622 1.68 4.94 0.26 73 XMNumbers 10330 3.35 4.80 2.71 74 RCVD_IN_RP_SAFE 10072 7.72 4.68 9.05 75 TR_XM_SpammyWords5 10036 2.55 4.67 1.63 76 XM_B_SpammyTLD 10002 2.95 4.65 2.21 77 BAYES_95 9618 3.12 4.47 2.54 78 FROM_MISSP_REPLYTO 9254 1.31 4.30 0.00 79 XMBody_17 9036 1.82 4.20 0.78 80 HTML_IMAGE_ONLY_12 8775 1.39 4.08 0.22 81 DKIM_INVALID 8539 3.26 3.97 2.94 82 XMStrtUSub 8362 4.53 3.89 4.82 83 RCVD_IN_RP_CERTIFIED 8330 6.96 3.87 8.31 84 HTML_IMAGE_RATIO_08 8293 2.60 3.86 2.06 85 BODY_URI_ONLY 8254 1.19 3.84 0.04 86 HTML_FONT_SIZE_LARGE 8076 1.20 3.76 0.08 87 XM_SPF_SoftFail 7742 2.19 3.60 1.57 88 TR_XM_DK_SendGrid 7692 4.48 3.58 4.88 89 TM2_M_URI_OPT_OUT 7657 3.19 3.56 3.03 90 RELAYCOUNTRY_FR 7594 1.26 3.53 0.27 91 HTML_IMAGE_RATIO_06 7570 4.12 3.52 4.38 92 XM_B_Phish66 7556 2.28 3.51 1.74 93 BOTNET_NORDNS 7506 1.07 3.49 0.02 94 RCVD_IN_MSPIKE_BL 7361 1.25 3.42 0.30 95 TR_XM_MSPIKECOMBO 7320 1.24 3.40 0.30 96 XM_DIRTYINTL 7296 1.31 3.39 0.41 97 HTML_MIME_NO_HTML_TAG 7114 2.64 3.31 2.36 98 XM_DK_Undo_01 7051 2.11 3.28 1.59 99 SUBJ_ALL_CAPS 6911 2.26 3.21 1.84 100 MIME_QP_LONG_LINE 6814 4.98 3.17 5.77 101 MIME_HTML_ONLY_MULTI 6729 3.47 3.13 3.62 102 TR_LOTS_OF_MONEY3 6530 1.28 3.04 0.51 103 URI_HEX 6307 2.05 2.93 1.66 104 XMDiploma_00 6150 2.08 2.86 1.74 105 URIBL_SBL_A 6042 1.05 2.81 0.28 106 FROM_EXCESS_BASE64 5996 3.51 2.79 3.82 107 XM_B_COVIDMETA 5702 1.36 2.65 0.80 108 TR_XM_SB_Phish 5309 2.25 2.47 2.15 109 XM_CamelCaseFrm001 5283 2.17 2.46 2.05 110 BAYES_40 5186 4.43 2.41 5.31 111 XMSubPhish11 5177 2.21 2.41 2.12 112 XM_UB99 5160 0.73 2.40 0.00 113 DKIM_ADSP_NXDOMAIN 5134 0.89 2.39 0.23 114 XM_B_SpammyWords4 5092 1.16 2.37 0.63 115 XMSexyCombo_01 5087 1.09 2.37 0.53 116 XM_B_Unsub2 5080 2.01 2.36 1.86 117 T_XMDrugObfuBody_08 5011 1.63 2.33 1.33 118 RCVD_IN_PSBL 4937 0.84 2.30 0.20 119 XMBrknScrpt_02 4887 1.22 2.27 0.76 120 RCVD_IN_RP_RNBL 4874 0.72 2.27 0.04 121 FORGED_GMAIL_RCVD 4861 1.17 2.26 0.69 122 URI_TRY_3LD 4772 1.52 2.22 1.22 123 RCVD_IN_IADB_LISTED 4735 4.69 2.20 5.78 124 T_XMDrugObfuBody_14 4653 2.07 2.16 2.03 125 T_FILL_THIS_FORM_SHORT 4615 1.22 2.15 0.82 126 T_TooManySym_01 4476 3.88 2.08 4.66 127 TM2_M_VERY_LONG_WORD 4398 1.52 2.05 1.29 128 BAYES_00 4374 10.38 2.03 14.02 129 T_XMHurry_00 4354 1.15 2.03 0.77 130 RCVD_IN_MSPIKE_L5 4326 0.65 2.01 0.06 131 XM_UB60 4320 0.72 2.01 0.16 132 RCVD_IN_IADB_SPF 4315 4.10 2.01 5.02 133 TR_Symld_Words 4273 1.70 1.99 1.58 134 HTML_IMAGE_ONLY_08 4213 0.66 1.96 0.10 135 BAYES_20 4176 3.33 1.94 3.94 136 HDRS_MISSP 4122 0.71 1.92 0.18 137 RCVD_IN_IADB_DK 4056 3.58 1.89 4.32 138 XMStockSpam_06 4055 1.48 1.89 1.31 139 RCVD_IN_IADB_SENDERID 4039 3.67 1.88 4.45 140 MIME_HEADER_CTYPE_ONLY 3952 0.61 1.84 0.08 141 HDRS_LCASE_IMGONLY 3931 0.59 1.83 0.05 142 XMSubMetaSxObfu_03 3879 1.00 1.80 0.65 143 XM_UB999 3816 0.54 1.77 0.00 144 T_XMDrugObfuBody_00 3793 1.55 1.76 1.46 145 TR_XM_SpammyWords3 3673 0.67 1.71 0.22 146 TR_XM_MaxBayes 3597 0.51 1.67 0.01 147 XMBdyGiftCard01 3576 1.17 1.66 0.95 148 RELAYCOUNTRY_GB 3566 1.14 1.66 0.92 149 HTML_FONT_SIZE_HUGE 3430 0.66 1.60 0.25 150 TR_XM_DK_Bayes 3365 7.81 1.57 10.53 151 TR_XM_DK_Bayes1 3289 7.60 1.53 10.25 152 XM_URI_RBL 3286 0.60 1.53 0.19 153 XM_Body_Dirty_Words_01 3235 0.97 1.50 0.74 154 T_HTML_TAG_BALANCE_CENTER 3214 0.74 1.49 0.41 155 PDS_OTHER_BAD_TLD 3142 0.95 1.46 0.73 156 XM_OfRef7 3080 0.54 1.43 0.15 157 DIET_1 3039 0.83 1.41 0.57 158 URI_NOVOWEL 2976 2.60 1.38 3.12 159 URIBL_BLACK 2955 0.45 1.37 0.04 160 TR_XM_COVIDMETA4 2943 0.67 1.37 0.37 161 DATE_IN_PAST_12_24 2925 0.50 1.36 0.13 162 XMSlimDrugH 2918 0.63 1.36 0.31 163 MAILING_LIST_MULTI 2872 2.19 1.34 2.56 164 XMGenDplmaNmb 2857 0.95 1.33 0.78 165 TR_XM_DK_Bayes2 2846 6.70 1.32 9.04 166 URIBL_DBL_ABUSE_REDIR 2739 0.39 1.27 0.00 167 TR_Caps_n_Bayes_99 2692 0.40 1.25 0.03 168 TR_XM_COVIDMETA1 2657 0.56 1.24 0.27 169 FROM_SUSPICIOUS_NTLD 2633 0.44 1.22 0.10 170 RELAYCOUNTRY_IN 2627 0.44 1.22 0.10 171 TR_XM_INV_DKIM 2617 0.43 1.22 0.09 172 XMSubMetaI_00 2596 0.72 1.21 0.51 173 SHORTENER_SHORT_IMG 2575 0.36 1.20 0.00 174 FROM_SUSPICIOUS_NTLD_FP 2558 0.43 1.19 0.10 175 XM_UB80 2500 0.40 1.16 0.07 176 ALL_TRUSTED 2475 8.60 1.15 11.86 177 TR_MetaPhish_Combo_01 2446 0.81 1.14 0.66 178 GOOGLE_DOC_SUSP 2426 0.37 1.13 0.04 179 TR_XM_BayesRelay 2416 0.35 1.12 0.01 180 XM_S_SpammyWords 2387 0.52 1.11 0.26 181 TR_XM_Spammywords 2387 0.52 1.11 0.26 182 T_Symld_Words_02 2333 0.89 1.09 0.81 183 SUBJ_DOLLARS 2315 0.52 1.08 0.28 184 TR_XM_FormFill 2304 0.35 1.07 0.03 185 XMSexyCombo_04 2277 0.46 1.06 0.20 186 XM_H_Long_From02 2266 1.20 1.05 1.26 187 XM_ProductURIs 2262 1.46 1.05 1.64 188 HTTPS_HTTP_MISMATCH 2238 0.77 1.04 0.66 189 XM_RXBody 2228 0.43 1.04 0.17 190 XMPhish08 2222 0.54 1.03 0.33 191 TR_XM_PHPDW 2209 0.52 1.03 0.30 192 BAYES_05 2154 1.93 1.00 2.34 193 TR_XM_PHPForged 2149 0.49 1.00 0.27 194 TR_XM_FormFill2 2130 0.49 0.99 0.27 195 XM_H_PHPOS 2127 0.48 0.99 0.26 196 URI_NO_WWW_INFO_CGI 2087 0.30 0.97 0.01 197 LongTLD 2080 0.41 0.97 0.17 198 HTML_IMAGE_ONLY_16 2074 0.49 0.96 0.29 199 URG_BIZ 2057 0.34 0.96 0.07 200 RCVD_IN_MSPIKE_L3 2053 0.44 0.95 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 444372 92.04 96.36 90.16 2 RELAYCOUNTRY_US 416227 82.61 78.38 84.45 3 DKIM_SIGNED 387072 80.59 85.31 78.54 4 XM_DK_Pass 381758 79.17 83.09 77.46 5 DKIM_VALID 372558 77.34 81.33 75.59 6 XM_B_Unicode 362447 74.08 75.31 73.54 7 DKIM_VALID_AU 281819 58.70 62.19 57.18 8 DCC_CHECK_NEGATIVE 272025 44.13 18.77 55.19 9 BAYES_50 271923 49.88 37.74 55.17 10 XMListUnsubscribeExists 262602 58.03 68.90 53.28 11 XM_B_SpammyWords 243661 55.09 68.06 49.44 12 XM_B_Unicode3 218219 42.90 39.75 44.28 13 DCC_CHECK 210692 53.88 79.39 42.75 14 RCVD_IN_MSPIKE_WL 149093 26.83 18.99 30.25 15 HTML_FONT_LOW_CONTRAST 142760 31.08 35.92 28.97 16 DKIM_VALID_EF 140431 29.12 30.55 28.49 17 RCVD_IN_MSPIKE_H2 138974 28.99 30.81 28.20 18 T_TM2_M_HEADER_IN_MSG 137152 25.78 21.09 27.83 19 LOC_TINY_FONT_1 129937 30.62 40.38 26.36 20 MIME_HTML_ONLY 117569 26.21 31.62 23.85 21 FVGT_m_MULTI_ODD 113970 24.31 27.03 23.12 22 XM_B_SpammyWords2 110650 28.02 40.78 22.45 23 XMSubLong 108759 22.57 23.72 22.07 24 T_KAM_HTML_FONT_INVALID 92907 20.80 25.26 18.85 25 RCVD_IN_MSPIKE_H3 80790 14.65 10.65 16.39 26 BAYES_00 69111 10.38 2.03 14.02 27 XM_Body_Dirty_Words 66338 15.48 20.11 13.46 28 XM_Multi_Part_URI 62933 14.91 19.83 12.77 29 ALL_TRUSTED 58435 8.60 1.15 11.86 30 XM_B_Unsub 55108 12.35 15.02 11.18 31 RCVD_IN_MSPIKE_H4 54730 10.05 7.64 11.10 32 TR_XM_DK_Bayes 51907 7.81 1.57 10.53 33 TR_XM_DK_Bayes1 50509 7.60 1.53 10.25 34 XM_DKIMWhitelistDomains 46478 6.75 0.61 9.43 35 LotsOfNums_01 45534 9.96 11.60 9.24 36 XM_Evil_Numbers_Gen 44771 9.75 11.26 9.08 37 RCVD_IN_RP_SAFE 44596 7.72 4.68 9.05 38 TR_XM_DK_Bayes2 44546 6.70 1.32 9.04 39 UNPARSEABLE_RELAY 41527 8.35 8.17 8.43 40 RCVD_IN_RP_CERTIFIED 40968 6.96 3.87 8.31 41 XM_DK_Undo_02 40339 20.22 47.79 8.18 42 TooManyTo_001 40210 7.85 7.14 8.16 43 XM_SendGrid 37324 7.24 6.47 7.57 44 BAYES_60 37257 7.63 7.79 7.56 45 LOTS_OF_MONEY 36994 9.39 13.70 7.51 46 HTML_IMAGE_RATIO_02 35449 7.29 7.50 7.19 47 TR_XM_UnparsRelay 30188 6.67 7.93 6.13 48 XM_H_Long_From01 29942 7.10 9.45 6.08 49 IN_ZIMBRA_NJ_WHITELIST 29520 4.19 0.05 5.99 50 FSL_BULK_SIG 29076 7.62 11.56 5.90 51 RCVD_IN_IADB_LISTED 28483 4.69 2.20 5.78 52 MIME_QP_LONG_LINE 28452 4.98 3.17 5.77 53 TR_XM_DKIM_Undo 28176 15.47 37.83 5.72 54 HTML_IMAGE_RATIO_04 28015 5.74 5.88 5.68 55 MPART_ALT_DIFF 27284 6.88 9.95 5.54 56 XM_B_Phish_Phrases 26723 5.94 7.13 5.42 57 BAYES_40 26153 4.43 2.41 5.31 58 XM_B_SpammyWords3 24956 7.68 13.68 5.06 59 RCVD_IN_IADB_SPF 24731 4.10 2.01 5.02 60 BOTNET_IPINHOSTNAME 24157 6.81 11.18 4.90 61 TR_XM_DK_SendGrid 24046 4.48 3.58 4.88 62 BAYES_99 23925 13.95 34.79 4.85 63 RELAYCOUNTRY_META 23897 9.61 20.54 4.85 64 XMStrtUSub 23735 4.53 3.89 4.82 65 TR_XM_SpammyWords4 23674 6.88 11.64 4.80 66 T_TooManySym_01 22972 3.88 2.08 4.66 67 XMSexyCombo_05 22772 6.36 10.34 4.62 68 XM_PDF 22672 3.43 0.76 4.60 69 RCVD_IN_IADB_SENDERID 21935 3.67 1.88 4.45 70 HTML_IMAGE_RATIO_06 21593 4.12 3.52 4.38 71 RCVD_IN_IADB_DK 21293 3.58 1.89 4.32 72 BAYES_80 20748 5.30 7.80 4.21 73 BAYES_20 19419 3.33 1.94 3.94 74 BAYES_999 19371 11.04 27.33 3.93 75 FROM_EXCESS_BASE64 18844 3.51 2.79 3.82 76 RCVD_IN_IADB_VOUCHED 17978 2.78 0.80 3.65 77 MIME_HTML_ONLY_MULTI 17831 3.47 3.13 3.62 78 T_REMOTE_IMAGE 16848 4.59 7.29 3.42 79 XMSubMetaSx_00 16840 4.67 7.53 3.42 80 XM_H_Trusted_IP 16202 2.29 0.00 3.29 81 TR_XM_PhishingBody 15435 4.00 5.99 3.13 82 URI_NOVOWEL 15399 2.60 1.38 3.12 83 XM_UncommonTLD01 15383 6.99 15.84 3.12 84 TM2_M_URI_OPT_OUT 14956 3.19 3.56 3.03 85 DKIM_INVALID 14514 3.26 3.97 2.94 86 TR_DCC_Bayes_99 13983 10.45 27.92 2.84 87 RCVD_IN_MSPIKE_H5 13573 2.13 0.70 2.75 88 XMNumbers 13357 3.35 4.80 2.71 89 MAILING_LIST_MULTI 12621 2.19 1.34 2.56 90 BAYES_95 12497 3.12 4.47 2.54 91 RCVD_IN_IADB_OPTIN 11763 1.84 0.59 2.39 92 HTML_MIME_NO_HTML_TAG 11607 2.64 3.31 2.36 93 MIME_HTML_MOSTLY 11596 3.97 7.68 2.35 94 BAYES_05 11525 1.93 1.00 2.34 95 XM_B_SpammyTLD 10868 2.95 4.65 2.21 96 TR_XM_SB_Phish 10617 2.25 2.47 2.15 97 XMSubPhish11 10448 2.21 2.41 2.12 98 TooManyTo_002 10376 1.65 0.62 2.11 99 HTML_IMAGE_RATIO_08 10143 2.60 3.86 2.06 100 XM_CamelCaseFrm001 10098 2.17 2.46 2.05 101 T_XMDrugObfuBody_14 10027 2.07 2.16 2.03 102 UNTRUSTED_Relay 9835 5.19 12.51 2.00 103 T_TooManySym_02 9769 1.56 0.60 1.98 104 BOTNET 9191 5.91 15.17 1.86 105 XM_B_Unsub2 9182 2.01 2.36 1.86 106 SUBJ_ALL_CAPS 9066 2.26 3.21 1.84 107 ANY_BOUNCE_MESSAGE 8754 1.34 0.33 1.78 108 BOUNCE_MESSAGE 8750 1.34 0.33 1.78 109 XMDiploma_00 8595 2.08 2.86 1.74 110 XM_B_Phish66 8563 2.28 3.51 1.74 111 URI_HEX 8201 2.05 2.93 1.66 112 XM_ProductURIs 8092 1.46 1.05 1.64 113 TR_XM_SpammyWords5 8037 2.55 4.67 1.63 114 RCVD_IN_BL_SPAMCOP_NET 8001 4.02 9.51 1.62 115 IN_HORDE_ADDRESS_BOOK 7947 1.15 0.08 1.61 116 TVD_RCVD_IP 7931 1.17 0.15 1.61 117 XM_DK_Undo_01 7861 2.11 3.28 1.59 118 TR_Symld_Words 7783 1.70 1.99 1.58 119 XM_SPF_SoftFail 7731 2.19 3.60 1.57 120 INVALID_MSGID 7587 1.19 0.40 1.54 121 HELO_NO_DOMAIN 7426 1.23 0.61 1.51 122 HELO_NODOT 7426 1.24 0.61 1.51 123 KHOP_HELO_FCRDNS 7275 2.68 5.46 1.48 124 T_XMDrugObfuBody_00 7200 1.55 1.76 1.46 125 TooManyTo_003 7020 1.15 0.53 1.42 126 HELO_MISC_IP 6932 1.04 0.21 1.41 127 RELAYCOUNTRY_CA 6863 2.97 6.59 1.39 128 MSGID_NOFQDN1 6805 0.98 0.05 1.38 129 USER_IN_DEF_DKIM_WL 6698 0.95 0.03 1.36 130 XM_OfRef6 6661 2.92 6.52 1.35 131 T_XMDrugObfuBody_08 6532 1.63 2.33 1.33 132 TO_MALFORMED 6528 0.93 0.01 1.32 133 XMStockSpam_06 6452 1.48 1.89 1.31 134 TM2_M_VERY_LONG_WORD 6365 1.52 2.05 1.29 135 HTML_FONT_FACE_BAD 6251 1.07 0.60 1.27 136 XM_H_Long_From02 6217 1.20 1.05 1.26 137 URI_TRY_3LD 6015 1.52 2.22 1.22 138 XMBSHREFv2 5939 0.93 0.29 1.21 139 TR_MSPIKEBAYES00 5827 0.83 0.02 1.18 140 XM_UB50 5646 2.40 5.27 1.15 141 XM_GoogleGroups 5428 0.91 0.47 1.10 142 XMCapTrack 5207 0.83 0.30 1.06 143 XMSubNoVowel 5136 0.99 0.87 1.04 144 DKIM_ADSP_CUSTOM_MED 5060 0.98 0.88 1.03 145 XMGappySubj_01 4988 0.75 0.16 1.01 146 TooManyTo_004 4756 0.81 0.47 0.96 147 XMBdyGiftCard01 4689 1.17 1.66 0.95 148 RELAYCOUNTRY_GB 4539 1.14 1.66 0.92 149 T_FILL_THIS_FORM_SHORT 4046 1.22 2.15 0.82 150 T_Symld_Words_02 3991 0.89 1.09 0.81 151 XMBody_95 3980 0.61 0.15 0.81 152 XM_B_COVIDMETA 3922 1.36 2.65 0.80 153 TooManyTo_005 3917 0.68 0.42 0.79 154 HTML_IMAGE_ONLY_20 3864 0.73 0.61 0.78 155 XMBody_17 3844 1.82 4.20 0.78 156 XMGenDplmaNmb 3833 0.95 1.33 0.78 157 T_XMHurry_00 3788 1.15 2.03 0.77 158 XMBrknScrpt_02 3770 1.22 2.27 0.76 159 SpammyFromTLD_01 3750 2.11 5.21 0.76 160 XMHTML_After_End 3717 0.78 0.84 0.75 161 XM_Body_Dirty_Words_01 3665 0.97 1.50 0.74 162 PDS_OTHER_BAD_TLD 3598 0.95 1.46 0.73 163 NML_ADSP_CUSTOM_MED 3551 0.73 0.74 0.72 164 RDNS_DYNAMIC 3491 0.74 0.80 0.71 165 T_OBFU_PDF_ATTACH 3461 0.54 0.16 0.70 166 FORGED_GMAIL_RCVD 3425 1.17 2.26 0.69 167 XMPhish30 3317 0.73 0.85 0.67 168 TR_MetaPhish_Combo_01 3269 0.81 1.14 0.66 169 XMHTMLBadTable_001 3268 0.62 0.51 0.66 170 HTTPS_HTTP_MISMATCH 3238 0.77 1.04 0.66 171 XMSubMetaSxObfu_03 3203 1.00 1.80 0.65 172 TR_XM_SpammyWords2 3164 4.54 13.49 0.64 173 XM_B_SpammyWords4 3112 1.16 2.37 0.63 174 XMNoVowels 3012 0.55 0.41 0.61 175 XM_SPF_Unknown 2960 0.64 0.75 0.60 176 T_TooManySym_03 2959 0.47 0.17 0.60 177 DIET_1 2819 0.83 1.41 0.57 178 FROM_GOV_DKIM_AU 2661 0.41 0.11 0.54 179 XMSexyCombo_01 2616 1.09 2.37 0.53 180 XMMoneyMeta_00 2607 0.60 0.76 0.53 181 NUMERIC_HTTP_ADDR 2594 0.64 0.88 0.53 182 XMOemUri 2554 0.43 0.22 0.52 183 XM_ShortIntro_01 2544 0.49 0.43 0.52 184 XMSubMetaI_00 2527 0.72 1.21 0.51 185 XM_H_PHPMailer 2505 0.46 0.36 0.51 186 TR_LOTS_OF_MONEY3 2497 1.28 3.04 0.51 187 XM_B_REG_HTML 2261 0.40 0.27 0.46 188 MISSING_HEADERS 2195 0.43 0.41 0.45 189 XM_Body_Obfu01 2192 0.44 0.44 0.44 190 FROM_GOV_SPOOF 2189 0.37 0.19 0.44 191 TM2_M_BODY_EMPTY 2162 0.32 0.04 0.44 192 SHORT_HELO_AND_INLINE_IMAGE 2140 0.32 0.05 0.43 193 RCVD_IN_SORBS_DUL 2106 0.35 0.18 0.43 194 XMBody_78 2100 0.54 0.79 0.43 195 SpammyFromTLD_02 2064 2.36 6.80 0.42 196 T_HTML_TAG_BALANCE_CENTER 2026 0.74 1.49 0.41 197 XM_DIRTYINTL 2010 1.31 3.39 0.41 198 TR_BOTNET_NEGATE 1997 0.48 0.65 0.41 199 RELAYCOUNTRY_DE 1974 0.52 0.78 0.40 200 XM_B_COPY_HTML 1957 0.46 0.61 0.40 ----------------------------------------------------------------------