Email: 539537 Autolearn: 0 AvgScore: 1.97 AvgScanTime: 1.45 sec Spam: 133423 Autolearn: 0 AvgScore: 13.32 AvgScanTime: 1.60 sec Ham: 406114 Autolearn: 0 AvgScore: -1.76 AvgScanTime: 1.40 sec Time Spent Running SA: 217.44 hours Time Spent Processing Spam: 59.40 hours Time Spent Processing Ham: 158.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123984 85.84 92.93 83.51 2 DKIM_SIGNED 110757 73.48 83.01 70.34 3 XM_DK_Pass 106914 71.84 80.13 69.11 4 DKIM_VALID 104038 69.86 77.98 67.20 5 XM_B_Unicode 100062 68.72 75.00 66.66 6 DCC_CHECK 98635 48.71 73.93 40.42 7 RELAYCOUNTRY_US 97086 78.35 72.77 80.19 8 XM_B_SpammyWords 88415 50.98 66.27 45.96 9 XMListUnsubscribeExists 87372 47.39 65.48 41.44 10 DKIM_VALID_AU 73662 52.38 55.21 51.45 11 XM_DK_Undo_02 58544 16.94 43.88 8.09 12 XM_B_Unicode3 57836 40.33 43.35 39.34 13 BAYES_50 51095 50.91 38.30 55.06 14 XM_B_SpammyWords2 50942 22.98 38.18 17.99 15 BAYES_99 46976 14.03 35.21 7.07 16 TR_XM_DKIM_Undo 45594 12.82 34.17 5.80 17 LOC_TINY_FONT_1 44366 23.82 33.25 20.72 18 HTML_FONT_LOW_CONTRAST 43316 27.00 32.47 25.21 19 DKIM_VALID_EF 42663 30.01 31.98 29.36 20 MIME_HTML_ONLY 40295 23.70 30.20 21.56 21 RCVD_IN_MSPIKE_H2 38603 24.41 28.93 22.92 22 BAYES_999 37140 11.23 27.84 5.77 23 T_KAM_HTML_FONT_INVALID 37018 18.42 27.74 15.36 24 FVGT_m_MULTI_ODD 36708 22.75 27.51 21.19 25 TR_DCC_Bayes_99 32815 8.60 24.59 3.34 26 T_TM2_M_HEADER_IN_MSG 31469 27.81 23.59 29.20 27 DCC_CHECK_NEGATIVE 31460 48.93 23.58 57.25 28 XMSubLong 31178 20.57 23.37 19.65 29 XM_Body_Dirty_Words 29592 13.82 22.18 11.07 30 RELAYCOUNTRY_META 28458 8.57 21.33 4.37 31 RCVD_IN_MSPIKE_WL 26668 28.49 19.99 31.28 32 XM_Multi_Part_URI 21708 12.20 16.27 10.86 33 UNTRUSTED_Relay 21424 5.35 16.06 1.83 34 XM_UncommonTLD01 20825 6.56 15.61 3.59 35 XM_B_Unsub 20795 11.75 15.59 10.49 36 BOTNET 19737 4.77 14.79 1.48 37 FSL_BULK_SIG 18069 9.53 13.54 8.22 38 BOTNET_IPINHOSTNAME 17064 6.31 12.79 4.18 39 LOTS_OF_MONEY 16534 8.62 12.39 7.38 40 XMSexyCombo_05 16051 5.68 12.03 3.59 41 XM_B_SpammyWords3 15828 5.49 11.86 3.40 42 TR_XM_SpammyWords2 15790 3.68 11.83 1.01 43 UNPARSEABLE_RELAY 15495 7.98 11.61 6.78 44 TR_XM_UnparsRelay 15239 7.19 11.42 5.81 45 TR_XM_SpammyWords4 14658 6.03 10.99 4.40 46 RCVD_IN_MSPIKE_H3 13925 13.57 10.44 14.60 47 MPART_ALT_DIFF 13518 7.49 10.13 6.62 48 BAYES_80 12006 6.16 9.00 5.23 49 XM_SendGrid 11986 6.61 8.98 5.83 50 XM_Evil_Numbers_Gen 11847 8.08 8.88 7.82 51 RCVD_IN_MSPIKE_H4 11348 10.95 8.51 11.76 52 LotsOfNums_01 11209 8.11 8.40 8.02 53 BAYES_60 11124 8.81 8.34 8.97 54 SpammyFromTLD_02 10357 2.18 7.76 0.35 55 MIME_HTML_MOSTLY 10334 3.65 7.75 2.30 56 RCVD_IN_BL_SPAMCOP_NET 10132 2.52 7.59 0.86 57 XM_B_Phish_Phrases 9527 7.83 7.14 8.06 58 XM_H_Long_From01 8964 5.67 6.72 5.32 59 HTML_IMAGE_RATIO_02 8908 5.74 6.68 5.44 60 XMSubMetaSx_00 8757 4.27 6.56 3.51 61 TR_XM_PhishingBody 8624 3.90 6.46 3.06 62 RELAYCOUNTRY_CA 8578 2.30 6.43 0.94 63 XM_UB50 7964 2.43 5.97 1.27 64 KHOP_HELO_FCRDNS 7488 2.91 5.61 2.02 65 TooManyTo_001 7270 7.41 5.45 8.05 66 T_REMOTE_IMAGE 7168 3.76 5.37 3.23 67 DKIM_INVALID 6719 3.61 5.04 3.15 68 XM_B_SpammyTLD 6578 2.54 4.93 1.75 69 BAYES_95 6553 3.85 4.91 3.51 70 TR_XM_DK_SendGrid 6510 3.94 4.88 3.63 71 HTML_IMAGE_RATIO_04 6360 6.53 4.77 7.11 72 SpammyFromTLD_01 6114 1.71 4.58 0.76 73 MIME_QP_LONG_LINE 5749 4.74 4.31 4.89 74 RELAYCOUNTRY_FR 5666 1.34 4.25 0.38 75 HTML_FONT_SIZE_LARGE 5561 1.10 4.17 0.10 76 XM_DIRTYINTL 5403 1.27 4.05 0.35 77 ALL_TRUSTED 5396 13.53 4.04 16.64 78 XMNumbers 5243 3.30 3.93 3.09 79 HTML_IMAGE_ONLY_12 5092 1.08 3.82 0.18 80 XM_SPF_SoftFail 5017 2.23 3.76 1.73 81 XM_B_Phish66 4991 2.31 3.74 1.84 82 TR_XM_SpammyWords5 4911 1.93 3.68 1.35 83 XMStrtUSub 4658 6.65 3.49 7.69 84 TM2_M_URI_OPT_OUT 4469 3.27 3.35 3.25 85 T_XMDrugObfuBody_08 4362 2.02 3.27 1.60 86 XM_OfRef6 4323 1.40 3.24 0.79 87 XM_UB99 4302 0.80 3.22 0.00 88 HTML_IMAGE_RATIO_06 4222 3.68 3.16 3.85 89 TR_XM_SB_Phish 4189 2.57 3.14 2.38 90 RCVD_IN_RP_SAFE 4162 5.78 3.12 6.66 91 MIME_HTML_ONLY_MULTI 4112 4.16 3.08 4.52 92 TM2_M_BODY_EMPTY 4050 1.54 3.04 1.05 93 BODY_URI_ONLY 4037 0.76 3.03 0.01 94 XMEmptyBody_01 4005 1.21 3.00 0.62 95 XMDiploma_00 4002 1.71 3.00 1.29 96 XMSubPhish11 3967 2.51 2.97 2.36 97 XM_B_COVIDMETA 3891 1.47 2.92 1.00 98 RCVD_IN_IADB_LISTED 3887 4.54 2.91 5.08 99 T_XMDrugObfuBody_14 3834 2.37 2.87 2.21 100 XM_UB60 3737 0.81 2.80 0.16 101 XM_B_Unsub2 3571 1.65 2.68 1.32 102 RCVD_IN_MSPIKE_BL 3529 0.88 2.64 0.30 103 JH_SPAMMY_PATTERN01 3502 0.65 2.62 0.00 104 RCVD_IN_IADB_SPF 3456 3.93 2.59 4.37 105 TR_XM_MSPIKECOMBO 3449 0.86 2.59 0.29 106 HTML_IMAGE_RATIO_08 3291 2.14 2.47 2.03 107 RCVD_IN_IADB_DK 3257 3.39 2.44 3.70 108 RCVD_IN_IADB_SENDERID 3245 3.49 2.43 3.84 109 TM2_M_VERY_LONG_WORD 3243 1.57 2.43 1.29 110 SUBJ_ALL_CAPS 3210 1.71 2.41 1.48 111 XM_DK_Undo_01 3165 1.77 2.37 1.58 112 T_XMHurry_00 3154 0.95 2.36 0.48 113 RCVD_IN_RP_RNBL 3097 0.64 2.32 0.09 114 MIXED_FONT_CASE 3091 0.57 2.32 0.00 115 XM_UB999 3063 0.57 2.30 0.00 116 XM_UB80 3063 0.59 2.30 0.03 117 HTML_SHORT_LINK_IMG_1 2930 0.55 2.20 0.01 118 XM_CamelCaseFrm001 2876 1.79 2.16 1.68 119 T_TooManySym_01 2871 3.93 2.15 4.51 120 XM_B_SpammyWords4 2830 0.76 2.12 0.31 121 BOTNET_NORDNS 2771 0.52 2.08 0.01 122 XMGenDplmaNmb 2767 1.10 2.07 0.78 123 URIBL_DBL_SPAM 2724 0.51 2.04 0.01 124 RCVD_IN_RP_CERTIFIED 2668 4.88 2.00 5.82 125 FROM_EXCESS_BASE64 2659 2.35 1.99 2.47 126 HTML_MIME_NO_HTML_TAG 2634 2.49 1.97 2.65 127 PDS_OTHER_BAD_TLD 2609 0.62 1.96 0.18 128 MAILING_LIST_MULTI 2565 2.09 1.92 2.15 129 TR_XM_COVIDMETA1 2562 0.70 1.92 0.30 130 XMStockSpam_06 2343 1.27 1.76 1.11 131 XM_URI_RBL 2340 0.53 1.75 0.13 132 XMBody_17 2329 0.70 1.75 0.36 133 XMSexyCombo_01 2310 0.88 1.73 0.60 134 URI_HEX 2308 1.57 1.73 1.52 135 URIBL_BLACK 2307 0.45 1.73 0.03 136 TR_Symld_Words 2303 1.64 1.73 1.61 137 TR_XM_COVIDMETA4 2231 0.74 1.67 0.44 138 TR_XM_PHPDW 2225 0.63 1.67 0.30 139 XM_PDF 2219 4.64 1.66 5.62 140 RCVD_IN_PSBL 2214 0.50 1.66 0.12 141 URI_TRY_3LD 2160 1.12 1.62 0.95 142 BAYES_40 2154 3.77 1.61 4.48 143 T_XMDrugObfuBody_00 2142 0.80 1.61 0.54 144 URIBL_SBL_A 2117 0.53 1.59 0.18 145 TR_XM_PHPForged 2053 0.57 1.54 0.26 146 TR_XM_FormFill2 2032 0.57 1.52 0.26 147 URI_NOVOWEL 2023 2.53 1.52 2.86 148 XM_H_PHPOS 2020 0.56 1.51 0.25 149 T_FILL_THIS_FORM_SHORT 2014 1.00 1.51 0.83 150 TR_XM_BayesRelay 1938 0.37 1.45 0.01 151 XMSlimDrugH 1918 0.62 1.44 0.35 152 TR_LOTS_OF_MONEY3 1918 0.52 1.44 0.22 153 TR_XM_SpammyWords3 1880 0.52 1.41 0.23 154 XM_UB95 1822 0.35 1.37 0.02 155 XMBrknScrpt_02 1797 0.92 1.35 0.78 156 USER_IN_DEF_DKIM_WL 1786 8.31 1.34 10.60 157 XM_Body_Dirty_Words_01 1783 0.43 1.34 0.13 158 URI_PHP_REDIR 1775 0.33 1.33 0.00 159 XMBdyGiftCard01 1769 0.79 1.33 0.61 160 XM_H_Long_From02 1689 1.06 1.27 1.00 161 RCVD_IN_MSPIKE_L5 1663 0.33 1.25 0.03 162 RELAYCOUNTRY_GB 1621 1.08 1.21 1.03 163 BAYES_20 1618 3.20 1.21 3.85 164 XMSubMetaI_00 1584 0.71 1.19 0.55 165 RCVD_IN_IADB_VOUCHED 1547 2.76 1.16 3.29 166 HTML_IMAGE_ONLY_20 1512 1.38 1.13 1.47 167 XMPhish30 1506 0.72 1.13 0.58 168 HTML_SHORT_LINK_IMG_2 1505 0.30 1.13 0.03 169 XMLngstWrd_00 1505 0.81 1.13 0.70 170 TR_XM_INV_DKIM 1481 0.32 1.11 0.07 171 TR_XM_RelayPhish 1465 0.35 1.10 0.11 172 XMHTML_After_End 1461 1.07 1.10 1.06 173 XMLngstWrd_01 1452 0.75 1.09 0.64 174 FSL_THIS_IS_ADV 1449 0.32 1.09 0.07 175 HTTPS_HTTP_MISMATCH 1439 0.74 1.08 0.63 176 ADMITS_SPAM 1418 0.34 1.06 0.10 177 DIET_1 1404 0.67 1.05 0.55 178 RCVD_IN_MSPIKE_H5 1395 3.96 1.05 4.92 179 TR_Mismatch_TLD_01 1386 0.56 1.04 0.41 180 T_MONEY_PERCENT 1360 0.42 1.02 0.22 181 TR_LOTS_OF_MONEY2 1360 0.42 1.02 0.22 182 XM_B_SEO 1360 0.40 1.02 0.19 183 HTML_SHORT_LINK_IMG_3 1336 0.30 1.00 0.07 184 RELAYCOUNTRY_IN 1333 0.32 1.00 0.10 185 TR_Mismatch_TLD_02 1321 0.30 0.99 0.07 186 TR_XM_SEO4 1270 0.35 0.95 0.15 187 SHOPIFY_IMG_NOT_RCVD_SFY 1258 0.41 0.94 0.24 188 ANY_BOUNCE_MESSAGE 1254 2.57 0.94 3.10 189 DKIM_ADSP_CUSTOM_MED 1249 0.91 0.94 0.90 190 BOUNCE_MESSAGE 1241 2.56 0.93 3.10 191 RELAYCOUNTRY_DE 1240 0.53 0.93 0.40 192 RELAYCOUNTRY_AU 1228 0.44 0.92 0.28 193 TR_BOTNET_NEGATE 1226 0.47 0.92 0.32 194 TR_MetaPhish_Combo_01 1205 0.74 0.90 0.68 195 TR_XM_MaxBayes 1198 0.22 0.90 0.00 196 XMBody_78 1181 0.53 0.89 0.41 197 XMPhish08 1141 0.34 0.86 0.17 198 HK_RANDOM_REPLYTO 1125 0.30 0.84 0.12 199 MPART_ALT_DIFF_COUNT 1116 0.47 0.84 0.34 200 HTML_FONT_FACE_BAD 1116 1.68 0.84 1.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 339153 85.84 92.93 83.51 2 RELAYCOUNTRY_US 325655 78.35 72.77 80.19 3 DKIM_SIGNED 285680 73.48 83.01 70.34 4 XM_DK_Pass 280672 71.84 80.13 69.11 5 DKIM_VALID 272900 69.86 77.98 67.20 6 XM_B_Unicode 270702 68.72 75.00 66.66 7 DCC_CHECK_NEGATIVE 232514 48.93 23.58 57.25 8 BAYES_50 223599 50.91 38.30 55.06 9 DKIM_VALID_AU 208960 52.38 55.21 51.45 10 XM_B_SpammyWords 186651 50.98 66.27 45.96 11 XMListUnsubscribeExists 168289 47.39 65.48 41.44 12 DCC_CHECK 164167 48.71 73.93 40.42 13 XM_B_Unicode3 159767 40.33 43.35 39.34 14 RCVD_IN_MSPIKE_WL 127034 28.49 19.99 31.28 15 DKIM_VALID_EF 119251 30.01 31.98 29.36 16 T_TM2_M_HEADER_IN_MSG 118580 27.81 23.59 29.20 17 HTML_FONT_LOW_CONTRAST 102366 27.00 32.47 25.21 18 RCVD_IN_MSPIKE_H2 93084 24.41 28.93 22.92 19 MIME_HTML_ONLY 87575 23.70 30.20 21.56 20 FVGT_m_MULTI_ODD 86047 22.75 27.51 21.19 21 LOC_TINY_FONT_1 84143 23.82 33.25 20.72 22 XMSubLong 79796 20.57 23.37 19.65 23 XM_B_SpammyWords2 73053 22.98 38.18 17.99 24 ALL_TRUSTED 67585 13.53 4.04 16.64 25 T_KAM_HTML_FONT_INVALID 62361 18.42 27.74 15.36 26 RCVD_IN_MSPIKE_H3 59286 13.57 10.44 14.60 27 RCVD_IN_MSPIKE_H4 47753 10.95 8.51 11.76 28 XM_DKIMWhitelistDomains 47235 8.76 0.02 11.63 29 XM_Body_Dirty_Words 44962 13.82 22.18 11.07 30 XM_Multi_Part_URI 44104 12.20 16.27 10.86 31 USER_IN_DEF_DKIM_WL 43036 8.31 1.34 10.60 32 XM_B_Unsub 42582 11.75 15.59 10.49 33 BAYES_00 39502 7.50 0.73 9.73 34 BAYES_60 36409 8.81 8.34 8.97 35 FSL_BULK_SIG 33369 9.53 13.54 8.22 36 XM_DK_Undo_02 32848 16.94 43.88 8.09 37 XM_B_Phish_Phrases 32713 7.83 7.14 8.06 38 TooManyTo_001 32700 7.41 5.45 8.05 39 LotsOfNums_01 32564 8.11 8.40 8.02 40 XM_Evil_Numbers_Gen 31759 8.08 8.88 7.82 41 XMStrtUSub 31233 6.65 3.49 7.69 42 LOTS_OF_MONEY 29988 8.62 12.39 7.38 43 HTML_IMAGE_RATIO_04 28884 6.53 4.77 7.11 44 BAYES_99 28695 14.03 35.21 7.07 45 UNPARSEABLE_RELAY 27545 7.98 11.61 6.78 46 RCVD_IN_RP_SAFE 27041 5.78 3.12 6.66 47 MPART_ALT_DIFF 26871 7.49 10.13 6.62 48 XM_H_Trusted_IP 25745 4.77 0.00 6.34 49 XM_SendGrid 23668 6.61 8.98 5.83 50 RCVD_IN_RP_CERTIFIED 23654 4.88 2.00 5.82 51 TR_XM_UnparsRelay 23576 7.19 11.42 5.81 52 TR_XM_DKIM_Undo 23564 12.82 34.17 5.80 53 BAYES_999 23447 11.23 27.84 5.77 54 XM_PDF 22842 4.64 1.66 5.62 55 TR_XM_DK_Bayes 22494 4.28 0.45 5.54 56 HTML_IMAGE_RATIO_02 22088 5.74 6.68 5.44 57 TR_XM_DK_Bayes1 21780 4.14 0.43 5.36 58 XM_H_Long_From01 21623 5.67 6.72 5.32 59 BAYES_80 21240 6.16 9.00 5.23 60 RCVD_IN_IADB_LISTED 20634 4.54 2.91 5.08 61 RCVD_IN_MSPIKE_H5 19995 3.96 1.05 4.92 62 MIME_QP_LONG_LINE 19839 4.74 4.31 4.89 63 IN_ZIMBRA_NJ_WHITELIST 19436 3.61 0.05 4.79 64 TR_XM_DK_Bayes2 18755 3.55 0.29 4.62 65 MIME_HTML_ONLY_MULTI 18337 4.16 3.08 4.52 66 T_TooManySym_01 18310 3.93 2.15 4.51 67 BAYES_40 18189 3.77 1.61 4.48 68 TR_XM_SpammyWords4 17871 6.03 10.99 4.40 69 RELAYCOUNTRY_META 17761 8.57 21.33 4.37 70 RCVD_IN_IADB_SPF 17730 3.93 2.59 4.37 71 BOTNET_IPINHOSTNAME 16970 6.31 12.79 4.18 72 BAYES_20 15629 3.20 1.21 3.85 73 HTML_IMAGE_RATIO_06 15620 3.68 3.16 3.85 74 RCVD_IN_IADB_SENDERID 15607 3.49 2.43 3.84 75 RCVD_IN_IADB_DK 15019 3.39 2.44 3.70 76 TR_XM_DK_SendGrid 14743 3.94 4.88 3.63 77 XMSexyCombo_05 14575 5.68 12.03 3.59 78 XM_UncommonTLD01 14574 6.56 15.61 3.59 79 XMSubMetaSx_00 14274 4.27 6.56 3.51 80 BAYES_95 14235 3.85 4.91 3.51 81 XM_B_SpammyWords3 13791 5.49 11.86 3.40 82 TR_DCC_Bayes_99 13561 8.60 24.59 3.34 83 RCVD_IN_IADB_VOUCHED 13361 2.76 1.16 3.29 84 TM2_M_URI_OPT_OUT 13194 3.27 3.35 3.25 85 T_REMOTE_IMAGE 13135 3.76 5.37 3.23 86 DKIM_INVALID 12780 3.61 5.04 3.15 87 ANY_BOUNCE_MESSAGE 12596 2.57 0.94 3.10 88 BOUNCE_MESSAGE 12585 2.56 0.93 3.10 89 XMNumbers 12548 3.30 3.93 3.09 90 TR_XM_PhishingBody 12417 3.90 6.46 3.06 91 URI_NOVOWEL 11622 2.53 1.52 2.86 92 HTML_MIME_NO_HTML_TAG 10777 2.49 1.97 2.65 93 FROM_EXCESS_BASE64 10011 2.35 1.99 2.47 94 TR_XM_SB_Phish 9669 2.57 3.14 2.38 95 T_TooManySym_02 9615 1.94 0.63 2.37 96 XMSubPhish11 9580 2.51 2.97 2.36 97 MIME_HTML_MOSTLY 9339 3.65 7.75 2.30 98 T_XMDrugObfuBody_14 8957 2.37 2.87 2.21 99 RCVD_IN_IADB_OPTIN 8833 1.84 0.81 2.18 100 TooManyTo_002 8778 1.83 0.82 2.16 101 MAILING_LIST_MULTI 8723 2.09 1.92 2.15 102 BAYES_05 8616 1.77 0.69 2.12 103 HTML_IMAGE_RATIO_08 8253 2.14 2.47 2.03 104 KHOP_HELO_FCRDNS 8201 2.91 5.61 2.02 105 XMSubNoVowel 7958 1.66 0.76 1.96 106 HTML_FONT_FACE_BAD 7942 1.68 0.84 1.96 107 XM_B_Phish66 7469 2.31 3.74 1.84 108 UNTRUSTED_Relay 7425 5.35 16.06 1.83 109 INVALID_MSGID 7259 1.43 0.34 1.79 110 XM_B_SpammyTLD 7115 2.54 4.93 1.75 111 IN_HORDE_ADDRESS_BOOK 7102 1.34 0.08 1.75 112 XM_SPF_SoftFail 7019 2.23 3.76 1.73 113 XM_CamelCaseFrm001 6806 1.79 2.16 1.68 114 HELO_NODOT 6622 1.39 0.67 1.63 115 HELO_NO_DOMAIN 6622 1.39 0.66 1.63 116 TR_Symld_Words 6538 1.64 1.73 1.61 117 T_XMDrugObfuBody_08 6510 2.02 3.27 1.60 118 XM_DK_Undo_01 6401 1.77 2.37 1.58 119 TO_MALFORMED 6309 1.18 0.03 1.55 120 URI_HEX 6174 1.57 1.73 1.52 121 BOTNET 6024 4.77 14.79 1.48 122 SUBJ_ALL_CAPS 5993 1.71 2.41 1.48 123 HTML_IMAGE_ONLY_20 5954 1.38 1.13 1.47 124 TVD_RCVD_IP 5894 1.13 0.16 1.45 125 TooManyTo_003 5764 1.23 0.67 1.42 126 TR_XM_SpammyWords5 5494 1.93 3.68 1.35 127 XM_B_Unsub2 5343 1.65 2.68 1.32 128 TM2_M_VERY_LONG_WORD 5242 1.57 2.43 1.29 129 XMDiploma_00 5224 1.71 3.00 1.29 130 XM_UB50 5151 2.43 5.97 1.27 131 XMCapTrack 4896 1.03 0.48 1.21 132 XMStockSpam_06 4528 1.27 1.76 1.11 133 XMGappySubj_01 4407 0.86 0.19 1.09 134 XM_GoogleGroups 4345 0.97 0.65 1.07 135 XMHTML_After_End 4323 1.07 1.10 1.06 136 TM2_M_BODY_EMPTY 4249 1.54 3.04 1.05 137 RELAYCOUNTRY_GB 4191 1.08 1.21 1.03 138 TooManyTo_004 4133 0.90 0.56 1.02 139 TR_XM_SpammyWords2 4085 3.68 11.83 1.01 140 XM_B_COVIDMETA 4067 1.47 2.92 1.00 141 XM_H_Long_From02 4045 1.06 1.27 1.00 142 URI_TRY_3LD 3862 1.12 1.62 0.95 143 RELAYCOUNTRY_CA 3828 2.30 6.43 0.94 144 XM_ProductURIs 3760 0.89 0.77 0.93 145 DKIM_ADSP_CUSTOM_MED 3635 0.91 0.94 0.90 146 XMBSHREFv2 3577 0.73 0.27 0.88 147 RCVD_IN_BL_SPAMCOP_NET 3490 2.52 7.59 0.86 148 T_FILL_THIS_FORM_SHORT 3389 1.00 1.51 0.83 149 TooManyTo_005 3326 0.74 0.50 0.82 150 XM_OfRef6 3207 1.40 3.24 0.79 151 XMBrknScrpt_02 3177 0.92 1.35 0.78 152 XMGenDplmaNmb 3167 1.10 2.07 0.78 153 SpammyFromTLD_01 3102 1.71 4.58 0.76 154 XMBody_95 2931 0.64 0.39 0.72 155 XMLngstWrd_00 2851 0.81 1.13 0.70 156 T_TooManySym_03 2787 0.58 0.24 0.69 157 TR_MetaPhish_Combo_01 2761 0.74 0.90 0.68 158 FROM_GOV_SPOOF 2706 0.56 0.25 0.67 159 TVD_SPACE_RATIO_MINFP 2678 0.59 0.39 0.66 160 XMLngstWrd_01 2582 0.75 1.09 0.64 161 HTTPS_HTTP_MISMATCH 2540 0.74 1.08 0.63 162 T_OBFU_PDF_ATTACH 2527 0.52 0.20 0.62 163 XMEmptyBody_01 2526 1.21 3.00 0.62 164 XMBdyGiftCard01 2481 0.79 1.33 0.61 165 MSGID_NOFQDN1 2455 0.46 0.03 0.60 166 XMSexyCombo_01 2451 0.88 1.73 0.60 167 RCVD_IN_SORBS_DUL 2447 0.52 0.28 0.60 168 NML_ADSP_CUSTOM_MED 2445 0.63 0.73 0.60 169 XM_H_PHPMailer 2379 0.64 0.79 0.59 170 XMPhish30 2370 0.72 1.13 0.58 171 XM_SPF_Unknown 2275 0.59 0.66 0.56 172 XMSubMetaI_00 2248 0.71 1.19 0.55 173 MY_SERVERS_FOUND 2246 0.60 0.74 0.55 174 DIET_1 2236 0.67 1.05 0.55 175 XM_ShortIntro_01 2235 0.54 0.50 0.55 176 XM_B_COPY_HTML 2199 0.58 0.71 0.54 177 T_XMDrugObfuBody_00 2176 0.80 1.61 0.54 178 XMHTMLBadTable_001 2095 0.55 0.66 0.52 179 XMNoVowels 2094 0.52 0.55 0.52 180 XMMoneyMeta_00 2071 0.57 0.75 0.51 181 TR_MSPIKEBAYES00 1993 0.37 0.02 0.49 182 T_XMHurry_00 1952 0.95 2.36 0.48 183 FORGED_GMAIL_RCVD 1934 0.56 0.83 0.48 184 TVD_SPACE_RATIO 1888 0.37 0.07 0.46 185 SHORT_HELO_AND_INLINE_IMAGE 1857 0.39 0.18 0.46 186 FROM_GOV_DKIM_AU 1841 0.38 0.16 0.45 187 XM_D_tchamptons_WL 1838 0.34 0.01 0.45 188 T_Symld_Words_02 1812 0.53 0.77 0.45 189 TR_XM_COVIDMETA4 1770 0.74 1.67 0.44 190 MISSING_HEADERS 1731 0.48 0.63 0.43 191 XMSubMetaSxObfu_03 1726 0.49 0.71 0.43 192 XM_B_REG_HTML 1666 0.38 0.28 0.41 193 HTML_IMAGE_ONLY_32 1662 0.34 0.14 0.41 194 RDNS_DYNAMIC 1656 0.44 0.54 0.41 195 XMBody_78 1655 0.53 0.89 0.41 196 TR_Mismatch_TLD_01 1647 0.56 1.04 0.41 197 RELAYCOUNTRY_DE 1636 0.53 0.93 0.40 198 GMD_PDF_EMPTY_BODY 1624 0.31 0.05 0.40 199 XMLngstWrd_02 1573 0.45 0.63 0.39 200 XMPhish14 1564 0.43 0.58 0.39 ----------------------------------------------------------------------