Email: 533704 Autolearn: 0 AvgScore: 3.34 AvgScanTime: 1.10 sec Spam: 150446 Autolearn: 0 AvgScore: 13.81 AvgScanTime: 1.30 sec Ham: 383258 Autolearn: 0 AvgScore: -0.78 AvgScanTime: 1.03 sec Time Spent Running SA: 163.49 hours Time Spent Processing Spam: 54.15 hours Time Spent Processing Ham: 109.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144254 88.82 95.88 86.04 2 DKIM_SIGNED 128117 75.60 85.16 71.85 3 XM_DK_Pass 124837 73.91 82.98 70.36 4 DKIM_VALID 121250 71.69 80.59 68.20 5 DCC_CHECK 115336 48.61 76.66 37.60 6 XM_B_Unicode 113795 70.32 75.64 68.24 7 RELAYCOUNTRY_US 112827 78.56 75.00 79.96 8 XMListUnsubscribeExists 107293 52.00 71.32 44.42 9 XM_B_SpammyWords 101154 51.38 67.24 45.16 10 DKIM_VALID_AU 90460 53.56 60.13 50.99 11 XM_DK_Undo_02 70963 18.33 47.17 7.00 12 XM_B_Unicode3 64483 40.24 42.86 39.21 13 XM_B_SpammyWords2 59786 24.21 39.74 18.12 14 BAYES_50 58590 51.37 38.94 56.24 15 LOC_TINY_FONT_1 56118 25.69 37.30 21.14 16 TR_XM_DKIM_Undo 53276 13.50 35.41 4.90 17 BAYES_99 51431 13.80 34.19 5.80 18 HTML_FONT_LOW_CONTRAST 49810 26.79 33.11 24.31 19 MIME_HTML_ONLY 48237 22.71 32.06 19.03 20 DKIM_VALID_EF 45904 29.57 30.51 29.20 21 FVGT_m_MULTI_ODD 42757 24.08 28.42 22.38 22 T_KAM_HTML_FONT_INVALID 41468 20.23 27.56 17.35 23 XMSubLong 40712 23.21 27.06 21.70 24 BAYES_999 40249 10.93 26.75 4.71 25 TR_DCC_Bayes_99 39113 9.07 26.00 2.42 26 RCVD_IN_MSPIKE_H2 37620 23.96 25.01 23.55 27 XM_Body_Dirty_Words 35474 14.20 23.58 10.52 28 T_TM2_M_HEADER_IN_MSG 33530 29.36 22.29 32.14 29 RCVD_IN_MSPIKE_WL 33149 28.91 22.03 31.60 30 RELAYCOUNTRY_META 32646 9.64 21.70 4.91 31 DCC_CHECK_NEGATIVE 31392 48.73 20.87 59.66 32 UNTRUSTED_Relay 26640 6.44 17.71 2.02 33 XM_UncommonTLD01 25373 7.35 16.87 3.61 34 XM_Multi_Part_URI 22684 11.45 15.08 10.03 35 BOTNET_IPINHOSTNAME 22459 7.07 14.93 3.98 36 BOTNET 22337 5.20 14.85 1.42 37 XMSexyCombo_05 21006 6.11 13.96 3.03 38 FSL_BULK_SIG 20924 9.07 13.91 7.17 39 XM_B_Unsub 19182 10.89 12.75 10.15 40 TR_XM_SpammyWords2 18374 4.04 12.21 0.83 41 LOTS_OF_MONEY 18353 8.18 12.20 6.60 42 XM_B_SpammyWords3 18216 6.03 12.11 3.65 43 RCVD_IN_MSPIKE_H3 17416 14.70 11.58 15.93 44 MPART_ALT_DIFF 16816 6.57 11.18 4.76 45 XM_Evil_Numbers_Gen 16768 8.59 11.15 7.59 46 TR_XM_SpammyWords4 15525 5.89 10.32 4.15 47 RCVD_IN_BL_SPAMCOP_NET 15164 3.33 10.08 0.68 48 RCVD_IN_MSPIKE_H4 14290 11.22 9.50 11.90 49 MIME_HTML_MOSTLY 14179 4.49 9.42 2.55 50 LotsOfNums_01 14077 8.52 9.36 8.20 51 UNPARSEABLE_RELAY 13914 7.85 9.25 7.29 52 TR_XM_UnparsRelay 13675 6.96 9.09 6.12 53 BAYES_80 13519 5.94 8.99 4.75 54 BAYES_60 11991 8.68 7.97 8.95 55 XM_B_Phish_Phrases 11900 5.94 7.91 5.17 56 XM_SendGrid 11504 6.94 7.65 6.67 57 HTML_IMAGE_RATIO_02 11030 6.05 7.33 5.55 58 SpammyFromTLD_01 10465 2.58 6.96 0.86 59 XMSubMetaSx_00 10009 4.48 6.65 3.62 60 SpammyFromTLD_02 10006 2.14 6.65 0.36 61 RCVD_IN_MSPIKE_BL 9707 1.93 6.45 0.16 62 TR_XM_MSPIKECOMBO 9606 1.90 6.39 0.14 63 TR_XM_PhishingBody 9327 4.00 6.20 3.14 64 XMNumbers 9253 4.09 6.15 3.28 65 XM_H_Long_From01 8972 5.67 5.96 5.55 66 KHOP_HELO_FCRDNS 8964 2.97 5.96 1.79 67 XM_UB50 8751 2.63 5.82 1.38 68 HTML_IMAGE_RATIO_04 8541 6.24 5.68 6.46 69 XM_DIRTYINTL 8285 1.87 5.51 0.44 70 TooManyTo_001 8222 8.02 5.47 9.02 71 RELAYCOUNTRY_CA 8101 2.34 5.38 1.15 72 T_REMOTE_IMAGE 8009 4.04 5.32 3.54 73 BAYES_95 7983 3.68 5.31 3.04 74 TR_XM_SpammyWords5 7334 2.52 4.87 1.60 75 RELAYCOUNTRY_FR 7156 1.54 4.76 0.28 76 TR_XM_DK_SendGrid 7098 4.10 4.72 3.85 77 TM2_M_URI_OPT_OUT 7015 3.67 4.66 3.29 78 DKIM_INVALID 6867 3.91 4.56 3.65 79 XM_B_SpammyTLD 6534 2.65 4.34 1.98 80 TR_XM_SpammyWords3 6068 1.20 4.03 0.09 81 XM_SPF_SoftFail 5911 2.69 3.93 2.20 82 RCVD_IN_RP_SAFE 5891 5.76 3.92 6.49 83 XM_UB99 5875 1.10 3.91 0.00 84 HTML_IMAGE_ONLY_12 5859 1.26 3.89 0.22 85 HTML_FONT_SIZE_LARGE 5665 1.15 3.77 0.12 86 RCVD_IN_MSPIKE_L5 5565 1.08 3.70 0.05 87 RCVD_IN_RP_RNBL 5475 1.05 3.64 0.04 88 XMStrtUSub 5428 5.60 3.61 6.38 89 RCVD_IN_PSBL 5346 1.06 3.55 0.08 90 HTML_IMAGE_RATIO_06 5185 3.71 3.45 3.82 91 MIME_QP_LONG_LINE 5050 4.97 3.36 5.60 92 XM_B_Phish66 4952 2.36 3.29 2.00 93 URIBL_DBL_SPAM 4915 0.93 3.27 0.01 94 HTML_IMAGE_RATIO_08 4876 2.56 3.24 2.29 95 BODY_URI_ONLY 4876 0.92 3.24 0.01 96 XM_OfRef6 4853 1.52 3.23 0.85 97 MIME_HTML_ONLY_MULTI 4730 2.97 3.14 2.90 98 T_XMDrugObfuBody_08 4599 2.01 3.06 1.60 99 XM_B_COVIDMETA 4540 1.48 3.02 0.88 100 XM_UB60 4483 0.95 2.98 0.15 101 RCVD_IN_RP_CERTIFIED 4480 4.96 2.98 5.74 102 TR_XM_SB_Phish 4381 2.55 2.91 2.40 103 XMSubPhish11 4298 2.47 2.86 2.32 104 XM_B_Unsub2 4268 2.14 2.84 1.86 105 T_XMDrugObfuBody_14 4242 2.19 2.82 1.95 106 FROM_EXCESS_BASE64 4227 2.34 2.81 2.15 107 XM_UB80 4097 0.79 2.72 0.04 108 URI_HEX 4061 1.68 2.70 1.28 109 TM2_M_VERY_LONG_WORD 4032 1.69 2.68 1.30 110 XM_UB999 4025 0.76 2.68 0.00 111 XM_CamelCaseFrm001 3775 1.99 2.51 1.79 112 XMDiploma_00 3747 1.84 2.49 1.59 113 URI_PHP_REDIR 3742 0.70 2.49 0.00 114 XMBrknScrpt_02 3694 1.11 2.46 0.58 115 PDS_OTHER_BAD_TLD 3611 0.89 2.40 0.29 116 XM_B_SpammyWords4 3380 0.90 2.25 0.37 117 XMBdyGiftCard01 3371 0.91 2.24 0.38 118 T_TooManySym_01 3354 4.37 2.23 5.21 119 XM_DK_Undo_01 3298 1.80 2.19 1.64 120 HTML_SHORT_LINK_IMG_2 3253 0.64 2.16 0.04 121 SUBJ_ALL_CAPS 3214 1.67 2.14 1.49 122 XM_URI_RBL 3130 0.72 2.08 0.18 123 HTML_MIME_NO_HTML_TAG 3034 2.42 2.02 2.57 124 RCVD_IN_IADB_LISTED 3004 4.33 2.00 5.24 125 RELAYCOUNTRY_DE 2886 0.92 1.92 0.53 126 TR_XM_COVIDMETA4 2868 0.79 1.91 0.35 127 TR_XM_BayesRelay 2756 0.53 1.83 0.01 128 T_XMHurry_00 2756 0.91 1.83 0.55 129 BAYES_40 2744 4.02 1.82 4.89 130 MAILING_LIST_MULTI 2661 2.54 1.77 2.84 131 HTML_SHORT_LINK_IMG_1 2659 0.51 1.77 0.01 132 XMSexyCombo_01 2659 0.74 1.77 0.34 133 RCVD_IN_IADB_SPF 2618 3.78 1.74 4.58 134 XM_UB95 2582 0.50 1.72 0.02 135 URIBL_BLACK 2560 0.50 1.70 0.03 136 T_FILL_THIS_FORM_SHORT 2532 1.15 1.68 0.94 137 TR_XM_PHPDW 2520 0.69 1.68 0.30 138 T_XMDrugObfuBody_00 2519 0.89 1.67 0.58 139 URIBL_SBL_A 2503 0.64 1.66 0.24 140 HTTPS_HTTP_MISMATCH 2484 1.04 1.65 0.81 141 URI_NOVOWEL 2463 2.41 1.64 2.71 142 RCVD_IN_IADB_DK 2449 3.30 1.63 3.95 143 RCVD_IN_IADB_SENDERID 2425 3.40 1.61 4.10 144 HTML_TITLE_SUBJ_DIFF 2410 0.48 1.60 0.04 145 XMBody_17 2404 0.69 1.60 0.33 146 TR_XM_PHPForged 2283 0.61 1.52 0.26 147 TR_XM_INV_DKIM 2264 0.53 1.50 0.14 148 XMStockSpam_06 2263 1.24 1.50 1.14 149 TR_XM_COVIDMETA1 2259 0.60 1.50 0.25 150 XMGenDplmaNmb 2241 1.06 1.49 0.89 151 XM_Body_Dirty_Words_01 2235 0.53 1.49 0.16 152 TR_XM_FormFill2 2230 0.60 1.48 0.25 153 XM_H_PHPOS 2220 0.59 1.48 0.25 154 HK_RANDOM_REPLYTO 2215 0.55 1.47 0.19 155 RCVD_IN_MSPIKE_L4 2192 0.43 1.46 0.02 156 URI_TRY_3LD 2145 1.34 1.43 1.31 157 URI_NO_WWW_BIZ_CGI 2124 0.40 1.41 0.01 158 TR_Symld_Words 2121 1.65 1.41 1.75 159 BAYES_20 2066 3.34 1.37 4.11 160 XMHTML_After_End 2022 1.38 1.34 1.39 161 RELAYCOUNTRY_GB 1966 1.10 1.31 1.02 162 ANY_BOUNCE_MESSAGE 1957 2.80 1.30 3.39 163 BOUNCE_MESSAGE 1955 2.80 1.30 3.39 164 XMSubMetaI_00 1937 0.77 1.29 0.56 165 ALL_TRUSTED 1919 12.27 1.28 16.58 166 RCVD_IN_MSPIKE_L3 1849 0.39 1.23 0.06 167 XMMoneyMeta_00 1736 0.75 1.15 0.60 168 XMPhish30 1719 0.66 1.14 0.48 169 XMSubMetaSSx_00 1715 0.43 1.14 0.15 170 LongTLD 1688 0.43 1.12 0.16 171 FROM_SUSPICIOUS_NTLD 1649 0.33 1.10 0.04 172 BOTNET_NORDNS 1616 0.32 1.07 0.02 173 XM_PDF 1611 3.88 1.07 4.99 174 TR_Mismatch_TLD_02 1605 0.36 1.07 0.08 175 XM_B_SEO 1568 0.38 1.04 0.12 176 FROM_SUSPICIOUS_NTLD_FP 1565 0.31 1.04 0.03 177 XM_Combo_Sbj 1529 0.42 1.02 0.18 178 HTML_FONT_SIZE_HUGE 1501 0.46 1.00 0.25 179 XM_ShortIntro_01 1462 0.72 0.97 0.62 180 RCVD_IN_MSPIKE_H5 1443 2.99 0.96 3.78 181 TR_XM_SEO4 1406 0.31 0.93 0.06 182 XMSexyCombo_04 1404 0.30 0.93 0.05 183 TR_MetaPhish_Combo_01 1398 0.91 0.93 0.91 184 XMPhish08 1361 0.39 0.90 0.18 185 TR_BOTNET_NEGATE 1357 0.51 0.90 0.36 186 TR_XM_FormFill 1350 0.26 0.90 0.01 187 RCVD_IN_IADB_VOUCHED 1349 2.58 0.90 3.24 188 XM_SPF_Unknown 1348 0.74 0.90 0.68 189 XM_H_PHPMailer 1342 0.66 0.89 0.56 190 TooManyTo_002 1341 2.17 0.89 2.67 191 XMLngstWrd_00 1323 0.66 0.88 0.57 192 XM_H_Long_From02 1314 1.21 0.87 1.34 193 TR_XM_MaxBayes 1296 0.25 0.86 0.00 194 DIET_1 1291 0.53 0.86 0.40 195 TR_Caps_n_Bayes_99 1273 0.27 0.85 0.04 196 XMNoVowels 1247 0.88 0.83 0.91 197 RELAYCOUNTRY_IN 1244 0.34 0.83 0.14 198 T_Symld_Words_02 1241 0.64 0.82 0.56 199 TO_IN_SUBJ 1232 0.25 0.82 0.02 200 TR_XM_RelayPhish 1232 0.29 0.82 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 329773 88.82 95.88 86.04 2 RELAYCOUNTRY_US 306469 78.56 75.00 79.96 3 DKIM_SIGNED 275362 75.60 85.16 71.85 4 XM_DK_Pass 269646 73.91 82.98 70.36 5 XM_B_Unicode 261528 70.32 75.64 68.24 6 DKIM_VALID 261381 71.69 80.59 68.20 7 DCC_CHECK_NEGATIVE 228663 48.73 20.87 59.66 8 BAYES_50 215555 51.37 38.94 56.24 9 DKIM_VALID_AU 195416 53.56 60.13 50.99 10 XM_B_SpammyWords 173075 51.38 67.24 45.16 11 XMListUnsubscribeExists 170255 52.00 71.32 44.42 12 XM_B_Unicode3 150266 40.24 42.86 39.21 13 DCC_CHECK 144101 48.61 76.66 37.60 14 T_TM2_M_HEADER_IN_MSG 123189 29.36 22.29 32.14 15 RCVD_IN_MSPIKE_WL 121128 28.91 22.03 31.60 16 DKIM_VALID_EF 111919 29.57 30.51 29.20 17 HTML_FONT_LOW_CONTRAST 93154 26.79 33.11 24.31 18 RCVD_IN_MSPIKE_H2 90245 23.96 25.01 23.55 19 FVGT_m_MULTI_ODD 85777 24.08 28.42 22.38 20 XMSubLong 83182 23.21 27.06 21.70 21 LOC_TINY_FONT_1 81003 25.69 37.30 21.14 22 MIME_HTML_ONLY 72943 22.71 32.06 19.03 23 XM_B_SpammyWords2 69443 24.21 39.74 18.12 24 T_KAM_HTML_FONT_INVALID 66507 20.23 27.56 17.35 25 ALL_TRUSTED 63546 12.27 1.28 16.58 26 RCVD_IN_MSPIKE_H3 61039 14.70 11.58 15.93 27 RCVD_IN_MSPIKE_H4 45600 11.22 9.50 11.90 28 XM_Body_Dirty_Words 40312 14.20 23.58 10.52 29 XM_B_Unsub 38918 10.89 12.75 10.15 30 XM_Multi_Part_URI 38435 11.45 15.08 10.03 31 XM_DKIMWhitelistDomains 38418 7.21 0.03 10.02 32 BAYES_00 38180 7.35 0.71 9.96 33 TooManyTo_001 34571 8.02 5.47 9.02 34 BAYES_60 34320 8.68 7.97 8.95 35 LotsOfNums_01 31412 8.52 9.36 8.20 36 XM_Evil_Numbers_Gen 29085 8.59 11.15 7.59 37 UNPARSEABLE_RELAY 27956 7.85 9.25 7.29 38 FSL_BULK_SIG 27489 9.07 13.91 7.17 39 XM_DK_Undo_02 26843 18.33 47.17 7.00 40 XM_SendGrid 25553 6.94 7.65 6.67 41 LOTS_OF_MONEY 25310 8.18 12.20 6.60 42 RCVD_IN_RP_SAFE 24868 5.76 3.92 6.49 43 HTML_IMAGE_RATIO_04 24769 6.24 5.68 6.46 44 XMStrtUSub 24439 5.60 3.61 6.38 45 TR_XM_UnparsRelay 23446 6.96 9.09 6.12 46 TR_XM_DK_Bayes 22532 4.35 0.47 5.88 47 BAYES_99 22231 13.80 34.19 5.80 48 RCVD_IN_RP_CERTIFIED 22003 4.96 2.98 5.74 49 TR_XM_DK_Bayes1 21731 4.20 0.45 5.67 50 MIME_QP_LONG_LINE 21473 4.97 3.36 5.60 51 HTML_IMAGE_RATIO_02 21270 6.05 7.33 5.55 52 XM_H_Long_From01 21269 5.67 5.96 5.55 53 IN_ZIMBRA_NJ_WHITELIST 20875 3.93 0.05 5.45 54 RCVD_IN_IADB_LISTED 20088 4.33 2.00 5.24 55 T_TooManySym_01 19986 4.37 2.23 5.21 56 XM_B_Phish_Phrases 19822 5.94 7.91 5.17 57 XM_PDF 19107 3.88 1.07 4.99 58 RELAYCOUNTRY_META 18814 9.64 21.70 4.91 59 TR_XM_DKIM_Undo 18768 13.50 35.41 4.90 60 BAYES_40 18729 4.02 1.82 4.89 61 TR_XM_DK_Bayes2 18345 3.56 0.43 4.79 62 MPART_ALT_DIFF 18239 6.57 11.18 4.76 63 BAYES_80 18200 5.94 8.99 4.75 64 BAYES_999 18069 10.93 26.75 4.71 65 RCVD_IN_IADB_SPF 17554 3.78 1.74 4.58 66 TR_XM_SpammyWords4 15913 5.89 10.32 4.15 67 BAYES_20 15769 3.34 1.37 4.11 68 RCVD_IN_IADB_SENDERID 15710 3.40 1.61 4.10 69 BOTNET_IPINHOSTNAME 15265 7.07 14.93 3.98 70 RCVD_IN_IADB_DK 15151 3.30 1.63 3.95 71 TR_XM_DK_SendGrid 14758 4.10 4.72 3.85 72 HTML_IMAGE_RATIO_06 14624 3.71 3.45 3.82 73 XM_H_Trusted_IP 14591 2.73 0.00 3.81 74 RCVD_IN_MSPIKE_H5 14489 2.99 0.96 3.78 75 XM_B_SpammyWords3 13991 6.03 12.11 3.65 76 DKIM_INVALID 13981 3.91 4.56 3.65 77 XMSubMetaSx_00 13876 4.48 6.65 3.62 78 XM_UncommonTLD01 13854 7.35 16.87 3.61 79 T_REMOTE_IMAGE 13578 4.04 5.32 3.54 80 ANY_BOUNCE_MESSAGE 13005 2.80 1.30 3.39 81 BOUNCE_MESSAGE 13002 2.80 1.30 3.39 82 TM2_M_URI_OPT_OUT 12598 3.67 4.66 3.29 83 XMNumbers 12557 4.09 6.15 3.28 84 RCVD_IN_IADB_VOUCHED 12417 2.58 0.90 3.24 85 TR_XM_PhishingBody 12045 4.00 6.20 3.14 86 BAYES_95 11658 3.68 5.31 3.04 87 XMSexyCombo_05 11618 6.11 13.96 3.03 88 MIME_HTML_ONLY_MULTI 11117 2.97 3.14 2.90 89 MAILING_LIST_MULTI 10869 2.54 1.77 2.84 90 T_TooManySym_02 10723 2.20 0.69 2.80 91 URI_NOVOWEL 10393 2.41 1.64 2.71 92 TooManyTo_002 10215 2.17 0.89 2.67 93 HTML_MIME_NO_HTML_TAG 9866 2.42 2.02 2.57 94 MIME_HTML_MOSTLY 9759 4.49 9.42 2.55 95 TR_DCC_Bayes_99 9270 9.07 26.00 2.42 96 TR_XM_SB_Phish 9202 2.55 2.91 2.40 97 XMSubPhish11 8890 2.47 2.86 2.32 98 HTML_IMAGE_RATIO_08 8783 2.56 3.24 2.29 99 BAYES_05 8616 1.81 0.70 2.25 100 XM_SPF_SoftFail 8438 2.69 3.93 2.20 101 FROM_EXCESS_BASE64 8240 2.34 2.81 2.15 102 RCVD_IN_IADB_OPTIN 8187 1.70 0.58 2.14 103 HELO_NODOT 7833 1.61 0.50 2.04 104 HELO_NO_DOMAIN 7829 1.61 0.50 2.04 105 UNTRUSTED_Relay 7750 6.44 17.71 2.02 106 XM_B_Phish66 7654 2.36 3.29 2.00 107 XM_B_SpammyTLD 7598 2.65 4.34 1.98 108 T_XMDrugObfuBody_14 7462 2.19 2.82 1.95 109 IN_HORDE_ADDRESS_BOOK 7141 1.36 0.09 1.86 110 XM_B_Unsub2 7127 2.14 2.84 1.86 111 INVALID_MSGID 7094 1.41 0.28 1.85 112 KHOP_HELO_FCRDNS 6865 2.97 5.96 1.79 113 XM_CamelCaseFrm001 6845 1.99 2.51 1.79 114 TR_Symld_Words 6709 1.65 1.41 1.75 115 TooManyTo_003 6565 1.45 0.78 1.71 116 MSGID_NOFQDN1 6511 1.26 0.16 1.70 117 XM_DK_Undo_01 6290 1.80 2.19 1.64 118 TO_MALFORMED 6268 1.18 0.01 1.64 119 XMSubNoVowel 6198 1.33 0.61 1.62 120 T_XMDrugObfuBody_08 6150 2.01 3.06 1.60 121 TR_XM_SpammyWords5 6117 2.52 4.87 1.60 122 XMDiploma_00 6092 1.84 2.49 1.59 123 TVD_RCVD_IP 5957 1.19 0.25 1.55 124 SUBJ_ALL_CAPS 5713 1.67 2.14 1.49 125 XMCapTrack 5522 1.15 0.41 1.44 126 BOTNET 5430 5.20 14.85 1.42 127 XMHTML_After_End 5342 1.38 1.34 1.39 128 XM_UB50 5293 2.63 5.82 1.38 129 XM_H_Long_From02 5154 1.21 0.87 1.34 130 URI_TRY_3LD 5004 1.34 1.43 1.31 131 TM2_M_VERY_LONG_WORD 4973 1.69 2.68 1.30 132 URI_HEX 4917 1.68 2.70 1.28 133 TooManyTo_004 4727 1.08 0.69 1.23 134 XM_GoogleGroups 4642 1.07 0.71 1.21 135 XMGappySubj_01 4639 0.91 0.15 1.21 136 RELAYCOUNTRY_CA 4395 2.34 5.38 1.15 137 XMStockSpam_06 4359 1.24 1.50 1.14 138 HTML_IMAGE_ONLY_20 4228 0.98 0.68 1.10 139 HTML_FONT_FACE_BAD 3998 0.97 0.80 1.04 140 RELAYCOUNTRY_GB 3924 1.10 1.31 1.02 141 TooManyTo_005 3800 0.89 0.61 0.99 142 USER_IN_DEF_DKIM_WL 3711 0.70 0.02 0.97 143 DKIM_ADSP_CUSTOM_MED 3648 0.90 0.77 0.95 144 XM_ProductURIs 3628 0.84 0.57 0.95 145 HELO_MISC_IP 3609 0.69 0.06 0.94 146 T_FILL_THIS_FORM_SHORT 3593 1.15 1.68 0.94 147 XMBSHREFv2 3541 0.76 0.35 0.92 148 TR_MetaPhish_Combo_01 3481 0.91 0.93 0.91 149 XMNoVowels 3472 0.88 0.83 0.91 150 XMGenDplmaNmb 3417 1.06 1.49 0.89 151 XM_B_COVIDMETA 3360 1.48 3.02 0.88 152 TVD_SPACE_RATIO 3347 0.66 0.11 0.87 153 SpammyFromTLD_01 3283 2.58 6.96 0.86 154 XM_OfRef6 3240 1.52 3.23 0.85 155 TR_XM_SpammyWords2 3197 4.04 12.21 0.83 156 HTTPS_HTTP_MISMATCH 3086 1.04 1.65 0.81 157 T_TooManySym_03 2805 0.59 0.24 0.73 158 XMBody_95 2802 0.56 0.13 0.73 159 FROM_GOV_SPOOF 2717 0.55 0.13 0.71 160 RCVD_IN_BL_SPAMCOP_NET 2602 3.33 10.08 0.68 161 XM_SPF_Unknown 2593 0.74 0.90 0.68 162 RCVD_IN_SORBS_DUL 2552 0.52 0.16 0.67 163 NML_ADSP_CUSTOM_MED 2466 0.63 0.59 0.64 164 SHORT_HELO_AND_INLINE_IMAGE 2431 0.48 0.10 0.63 165 XM_ShortIntro_01 2368 0.72 0.97 0.62 166 T_OBFU_PDF_ATTACH 2316 0.49 0.18 0.60 167 XMMoneyMeta_00 2282 0.75 1.15 0.60 168 T_XMDrugObfuBody_00 2223 0.89 1.67 0.58 169 TVD_SPACE_RATIO_MINFP 2222 0.49 0.27 0.58 170 XMBrknScrpt_02 2208 1.11 2.46 0.58 171 XMLngstWrd_00 2196 0.66 0.88 0.57 172 T_Symld_Words_02 2164 0.64 0.82 0.56 173 XM_H_PHPMailer 2162 0.66 0.89 0.56 174 XMSubMetaI_00 2151 0.77 1.29 0.56 175 XMHTMLBadTable_001 2146 0.61 0.75 0.56 176 FROM_GOV_DKIM_AU 2144 0.47 0.23 0.56 177 T_XMHurry_00 2108 0.91 1.83 0.55 178 TR_MSPIKEBAYES00 2078 0.39 0.01 0.54 179 XMSubMetaSxObfu_03 2049 0.61 0.80 0.53 180 RELAYCOUNTRY_DE 2028 0.92 1.92 0.53 181 XMLngstWrd_01 1986 0.56 0.68 0.52 182 TM2_M_BODY_EMPTY 1981 0.39 0.07 0.52 183 XM_B_REG_HTML 1942 0.51 0.51 0.51 184 XM_B_COPY_HTML 1929 0.55 0.67 0.50 185 MISSING_HEADERS 1883 0.50 0.54 0.49 186 XMPhish30 1828 0.66 1.14 0.48 187 HTML_TAG_BALANCE_BODY 1795 0.55 0.76 0.47 188 FORGED_GMAIL_RCVD 1788 0.52 0.66 0.47 189 URI_DOTEDU 1782 0.34 0.03 0.46 190 HTML_IMAGE_ONLY_32 1757 0.38 0.19 0.46 191 XMLngstWrd_02 1702 0.46 0.48 0.44 192 XM_DIRTYINTL 1680 1.87 5.51 0.44 193 HTML_IMAGE_ONLY_28 1647 0.46 0.53 0.43 194 HTML_IMAGE_ONLY_24 1561 0.35 0.21 0.41 195 XMDateMe_00 1551 0.43 0.50 0.40 196 DIET_1 1531 0.53 0.86 0.40 197 SHOPIFY_IMG_NOT_RCVD_SFY 1528 0.42 0.46 0.40 198 XMPhish14 1515 0.49 0.75 0.40 199 RDNS_DYNAMIC 1501 0.50 0.78 0.39 200 XMBdyGiftCard01 1469 0.91 2.24 0.38 ----------------------------------------------------------------------