Email: 685907 Autolearn: 0 AvgScore: 1.84 AvgScanTime: 2.30 sec Spam: 153148 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 4.04 sec Ham: 532759 Autolearn: 0 AvgScore: -1.14 AvgScanTime: 1.80 sec Time Spent Running SA: 438.19 hours Time Spent Processing Spam: 172.04 hours Time Spent Processing Ham: 266.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147494 89.89 96.31 88.05 2 DKIM_SIGNED 130910 77.41 85.48 75.09 3 XM_DK_Pass 127231 75.99 83.08 73.96 4 RELAYCOUNTRY_US 123883 81.56 80.89 81.76 5 DCC_CHECK 120791 47.96 78.87 39.07 6 XM_B_Unicode 120394 72.07 78.61 70.19 7 XMListUnsubscribeExists 115243 55.50 75.25 49.82 8 DKIM_VALID 107830 69.62 70.41 69.40 9 DKIM_VALID_AU 79944 51.25 52.20 50.97 10 XM_DK_Undo_02 71550 16.32 46.72 7.58 11 XM_B_Unicode3 63495 39.20 41.46 38.55 12 BAYES_50 62718 50.16 40.95 52.80 13 LOC_TINY_FONT_1 54932 26.42 35.87 23.71 14 MIME_HTML_ONLY 51804 23.92 33.83 21.07 15 BAYES_99 48238 10.25 31.50 4.14 16 HTML_FONT_LOW_CONTRAST 45083 26.85 29.44 26.11 17 DKIM_VALID_EF 43475 27.10 28.39 26.74 18 FVGT_m_MULTI_ODD 43154 23.38 28.18 22.00 19 T_KAM_HTML_FONT_INVALID 41483 20.38 27.09 18.45 20 TR_DCC_Bayes_99 39180 7.18 25.58 1.89 21 BAYES_999 37535 7.99 24.51 3.24 22 XMSubLong 35753 21.70 23.35 21.22 23 T_TM2_M_HEADER_IN_MSG 35405 27.44 23.12 28.68 24 BOTNET 32952 7.05 21.52 2.89 25 RELAYCOUNTRY_META 32411 9.36 21.16 5.97 26 RCVD_IN_MSPIKE_H2 30046 19.98 19.62 20.08 27 XM_Body_Dirty_Words 30022 14.07 19.60 12.48 28 DCC_CHECK_NEGATIVE 29711 49.92 19.40 58.70 29 XM_Multi_Part_URI 29055 13.20 18.97 11.54 30 LOTS_OF_MONEY 27267 11.46 17.80 9.63 31 BOTNET_IPINHOSTNAME 23122 6.82 15.10 4.44 32 DKIM_INVALID 23080 7.78 15.07 5.69 33 XM_UncommonTLD01 21948 5.61 14.33 3.10 34 XM_B_Phish_Phrases 20125 9.21 13.14 8.08 35 UNTRUSTED_Relay 18610 4.43 12.15 2.22 36 XM_B_Unsub 17464 10.86 11.40 10.70 37 HTML_IMAGE_RATIO_02 17197 8.08 11.23 7.18 38 NO_DNS_FOR_FROM 17140 4.93 11.19 3.13 39 FSL_BULK_SIG 16366 7.68 10.69 6.82 40 LotsOfNums_01 15650 8.89 10.22 8.51 41 XMSexyCombo_05 14970 5.06 9.77 3.71 42 XM_Evil_Numbers_Gen 14641 8.82 9.56 8.61 43 XM_B_COVIDMETA 11945 3.50 7.80 2.26 44 BAYES_80 11590 4.38 7.57 3.47 45 TR_XM_PhishingBody 11134 4.27 7.27 3.40 46 XM_CamelCaseFrm001 10951 3.21 7.15 2.08 47 MPART_ALT_DIFF 9982 5.71 6.52 5.48 48 URIBL_SBL_A 9783 1.55 6.39 0.16 49 TooManyTo_001 9588 7.80 6.26 8.24 50 BAYES_60 9470 6.14 6.18 6.13 51 RELAYCOUNTRY_CA 9394 2.63 6.13 1.62 52 TR_XM_COVIDMETA4 9362 2.66 6.11 1.67 53 XM_H_Long_From01 9074 5.63 5.92 5.54 54 HTML_IMAGE_RATIO_04 9041 5.87 5.90 5.86 55 XMSubMetaSx_00 9039 3.66 5.90 3.02 56 XM_UB50 9025 2.45 5.89 1.47 57 MIME_QP_LONG_LINE 8859 6.27 5.78 6.41 58 UNPARSEABLE_RELAY 8127 7.18 5.31 7.71 59 KHOP_HELO_FCRDNS 7766 3.36 5.07 2.87 60 TR_XM_MaxBayes 7725 1.15 5.04 0.03 61 RCVD_IN_MSPIKE_BL 7361 2.59 4.81 1.95 62 XM_B_Phish66 7331 2.75 4.79 2.16 63 XMBody_17 7113 1.57 4.64 0.68 64 XMStrtUSub 6981 4.10 4.56 3.97 65 RCVD_IN_BL_SPAMCOP_NET 6925 1.69 4.52 0.87 66 RCVD_IN_MSPIKE_WL 6820 11.10 4.45 13.01 67 XM_SendGrid 6810 6.42 4.45 6.98 68 T_XMDrugObfuBody_08 6772 2.25 4.42 1.63 69 HTML_IMAGE_RATIO_06 6765 3.88 4.42 3.72 70 BAYES_95 6532 2.55 4.27 2.05 71 MIME_HTML_MOSTLY 6327 2.84 4.13 2.46 72 FROM_SUSPICIOUS_NTLD 6325 0.96 4.13 0.05 73 XM_SPF_SoftFail 6163 2.14 4.02 1.59 74 FROM_SUSPICIOUS_NTLD_FP 6139 0.93 4.01 0.04 75 SpammyFromTLD_02 6086 1.15 3.97 0.34 76 TR_LOTS_OF_MONEY3 5972 1.42 3.90 0.70 77 RCVD_IN_MSPIKE_L3 5821 1.96 3.80 1.43 78 XM_B_SpammyTLD 5777 2.43 3.77 2.05 79 BAYES_40 5628 5.24 3.67 5.69 80 TM2_M_URI_OPT_OUT 5445 3.46 3.56 3.44 81 HTML_MIME_NO_HTML_TAG 5320 3.16 3.47 3.07 82 XM_DIRTYINTL 5297 1.13 3.46 0.47 83 URI_TRY_3LD 5273 1.75 3.44 1.27 84 XMNumbers 5239 3.24 3.42 3.18 85 RELAYCOUNTRY_FR 5060 0.92 3.30 0.24 86 T_REMOTE_IMAGE 4847 3.70 3.16 3.86 87 RCVD_IN_MSPIKE_H3 4788 8.08 3.13 9.50 88 XM_URI_RBL 4623 0.83 3.02 0.20 89 URI_HEX 4469 1.88 2.92 1.58 90 XM_OfRef6 4443 1.72 2.90 1.38 91 XMDiploma_00 4387 1.72 2.86 1.39 92 BAYES_20 4372 4.00 2.85 4.32 93 TR_XM_INV_DKIM 4323 0.76 2.82 0.16 94 PDS_OTHER_BAD_TLD 4291 1.01 2.80 0.50 95 XMHTML_After_End 4270 1.17 2.79 0.70 96 DKIM_ADSP_NXDOMAIN 4195 0.84 2.74 0.29 97 LongTLD 4091 0.75 2.67 0.20 98 MIME_HTML_ONLY_MULTI 4073 3.31 2.66 3.50 99 RCVD_IN_IADB_LISTED 4038 4.73 2.64 5.33 100 SpammyFromTLD_01 4001 1.16 2.61 0.74 101 T_XMHurry_00 3989 1.01 2.60 0.55 102 DATE_IN_PAST_03_06 3822 0.72 2.50 0.20 103 RCVD_IN_IADB_SPF 3712 4.15 2.42 4.65 104 RELAYCOUNTRY_IN 3619 0.59 2.36 0.08 105 RCVD_IN_IADB_DK 3597 3.66 2.35 4.03 106 RCVD_IN_IADB_SENDERID 3593 3.69 2.35 4.08 107 XMSexyCombo_01 3557 0.99 2.32 0.61 108 FROM_EXCESS_BASE64 3548 2.58 2.32 2.66 109 RCVD_IN_RP_SAFE 3543 6.62 2.31 7.85 110 T_TooManySym_01 3527 3.88 2.30 4.34 111 TR_XM_COVIDMETA1 3419 0.82 2.23 0.41 112 MISSING_HEADERS 3327 0.94 2.17 0.58 113 HTML_IMAGE_RATIO_08 3225 2.20 2.11 2.22 114 XM_B_Unsub2 3197 2.52 2.09 2.64 115 TR_XM_PHPDW 3052 0.87 1.99 0.55 116 HTML_SHORT_LINK_IMG_1 3016 0.45 1.97 0.01 117 TR_XM_PHPForged 3006 0.86 1.96 0.54 118 TR_XM_FormFill2 2972 0.85 1.94 0.53 119 T_XMDrugObfuBody_14 2970 1.58 1.94 1.47 120 XM_H_PHPOS 2963 0.84 1.93 0.53 121 TM2_M_VERY_LONG_WORD 2954 1.36 1.93 1.20 122 MIME_HEADER_CTYPE_ONLY 2906 0.62 1.90 0.25 123 SUBJ_ALL_CAPS 2826 1.61 1.85 1.54 124 RCVD_IN_RP_RNBL 2824 0.48 1.84 0.08 125 TR_XM_DK_SendGrid 2821 3.34 1.84 3.77 126 RDNS_DYNAMIC 2776 0.68 1.81 0.36 127 DATE_IN_PAST_06_12 2770 0.51 1.81 0.14 128 MAILING_LIST_MULTI 2726 2.71 1.78 2.97 129 HDRS_LCASE_IMGONLY 2698 0.40 1.76 0.01 130 HTML_TITLE_SUBJ_DIFF 2679 0.42 1.75 0.04 131 BAYES_00 2622 14.67 1.71 18.40 132 RCVD_IN_RP_CERTIFIED 2610 6.00 1.70 7.23 133 XMGenDplmaNmb 2580 1.02 1.68 0.83 134 HDRS_MISSP 2531 0.44 1.65 0.09 135 T_XMDrugObfuBody_00 2524 0.93 1.65 0.72 136 SHORT_IMG_SUSP_NTLD 2497 0.36 1.63 0.00 137 BOTNET_NORDNS 2493 0.38 1.63 0.02 138 TVD_SPACE_RATIO 2416 0.62 1.58 0.35 139 XMStockSpam_06 2406 1.28 1.57 1.20 140 TVD_SPACE_RATIO_MINFP 2333 0.34 1.52 0.01 141 XM_UB99 2228 0.34 1.45 0.02 142 TR_XM_RelayPhish 2172 0.44 1.42 0.16 143 RELAYCOUNTRY_DE 2161 1.11 1.41 1.03 144 TR_XM_DK_Bayes 2127 10.10 1.39 12.60 145 TR_XM_MaxSPIKE 2043 0.39 1.33 0.12 146 RCVD_IN_MSPIKE_H4 2032 3.02 1.33 3.51 147 ALL_TRUSTED 2020 11.17 1.32 14.00 148 XMBrknScrpt_02 2008 1.00 1.31 0.90 149 HTML_IMAGE_ONLY_12 1996 0.44 1.30 0.20 150 RELAYCOUNTRY_GB 1988 1.12 1.30 1.07 151 XM_DK_Undo_01 1987 1.84 1.30 2.00 152 XM_H_MailChimp 1973 0.42 1.29 0.17 153 BAYES_05 1971 2.61 1.29 3.00 154 XMBody_78 1903 0.66 1.24 0.49 155 XM_UB60 1851 0.34 1.21 0.09 156 XMBdyGiftCard01 1850 1.05 1.21 1.00 157 T_FILL_THIS_FORM_SHORT 1845 1.47 1.20 1.55 158 XMPhish30 1736 0.58 1.13 0.42 159 T_MONEY_PERCENT 1670 0.56 1.09 0.41 160 TR_LOTS_OF_MONEY2 1670 0.56 1.09 0.41 161 T_Symld_Words_02 1669 0.64 1.09 0.52 162 BODY_URI_ONLY 1641 0.28 1.07 0.05 163 XM_ProductURIs 1629 1.01 1.06 0.99 164 SUBJ_DOLLARS 1608 0.48 1.05 0.31 165 RCVD_IN_PSBL 1556 0.24 1.02 0.02 166 TR_Symld_Words 1548 1.51 1.01 1.66 167 TR_MetaPhish_Combo_01 1545 0.86 1.01 0.82 168 XM_UB80 1533 0.24 1.00 0.03 169 HTML_IMAGE_ONLY_08 1527 0.30 1.00 0.10 170 XM_Nigeria_01 1513 0.25 0.99 0.04 171 XM_H_Long_From02 1506 1.17 0.98 1.23 172 DATE_IN_PAST_12_24 1504 0.23 0.98 0.01 173 XM_H_PHPMailer 1453 0.65 0.95 0.56 174 XMMoneyMeta_00 1451 0.75 0.95 0.69 175 HTTPS_HTTP_MISMATCH 1437 0.82 0.94 0.79 176 XM_UB999 1420 0.22 0.93 0.02 177 TR_XM_COVIDMETA3 1411 0.27 0.92 0.08 178 XM_UCStrings02 1408 0.29 0.92 0.11 179 HTML_FONT_FACE_BAD 1380 1.74 0.90 1.99 180 HK_RANDOM_REPLYTO 1371 0.37 0.90 0.21 181 SUBJECT_NEEDS_ENCODING 1349 0.20 0.88 0.00 182 LONG_HEX_URI 1347 0.34 0.88 0.18 183 SUBJ_ILLEGAL_CHARS 1346 0.20 0.88 0.00 184 MPART_ALT_DIFF_COUNT 1340 0.50 0.87 0.39 185 XMSubMetaI_00 1317 0.51 0.86 0.41 186 LOADSA_MONEY_COMBO 1314 0.24 0.86 0.06 187 XM_H_PHPOS_M 1299 0.34 0.85 0.19 188 DKIM_ADSP_CUSTOM_MED 1291 1.21 0.84 1.32 189 RCVD_IN_IADB_VOUCHED 1290 2.83 0.84 3.40 190 ANY_BOUNCE_MESSAGE 1287 3.26 0.84 3.96 191 BOUNCE_MESSAGE 1285 3.26 0.84 3.96 192 XMSubMetaSxObfu_03 1241 0.48 0.81 0.39 193 DIET_1 1238 0.34 0.81 0.21 194 XM_PDF 1212 4.01 0.79 4.93 195 XMSexyCombo_04 1171 0.28 0.76 0.14 196 XMPhish08 1161 0.52 0.76 0.46 197 BILLION_DOLLARS 1156 0.18 0.75 0.01 198 REMOVE_BEFORE_LINK 1139 0.37 0.74 0.27 199 XM_OfRef7 1135 0.25 0.74 0.11 200 TR_XM_DK_Bayes1 1115 9.27 0.73 11.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 469081 89.89 96.31 88.05 2 RELAYCOUNTRY_US 435576 81.56 80.89 81.76 3 DKIM_SIGNED 400043 77.41 85.48 75.09 4 XM_DK_Pass 394008 75.99 83.08 73.96 5 XM_B_Unicode 373923 72.07 78.61 70.19 6 DKIM_VALID 369732 69.62 70.41 69.40 7 DCC_CHECK_NEGATIVE 312716 49.92 19.40 58.70 8 BAYES_50 281306 50.16 40.95 52.80 9 DKIM_VALID_AU 271550 51.25 52.20 50.97 10 XMListUnsubscribeExists 265408 55.50 75.25 49.82 11 DCC_CHECK 208140 47.96 78.87 39.07 12 XM_B_Unicode3 205394 39.20 41.46 38.55 13 T_TM2_M_HEADER_IN_MSG 152795 27.44 23.12 28.68 14 DKIM_VALID_EF 142434 27.10 28.39 26.74 15 HTML_FONT_LOW_CONTRAST 139090 26.85 29.44 26.11 16 LOC_TINY_FONT_1 126315 26.42 35.87 23.71 17 FVGT_m_MULTI_ODD 117216 23.38 28.18 22.00 18 XMSubLong 113060 21.70 23.35 21.22 19 MIME_HTML_ONLY 112273 23.92 33.83 21.07 20 RCVD_IN_MSPIKE_H2 106981 19.98 19.62 20.08 21 T_KAM_HTML_FONT_INVALID 98281 20.38 27.09 18.45 22 BAYES_00 98007 14.67 1.71 18.40 23 ALL_TRUSTED 74574 11.17 1.32 14.00 24 RCVD_IN_MSPIKE_WL 69312 11.10 4.45 13.01 25 TR_XM_DK_Bayes 67134 10.10 1.39 12.60 26 XM_Body_Dirty_Words 66513 14.07 19.60 12.48 27 TR_XM_DK_Bayes1 62473 9.27 0.73 11.73 28 XM_Multi_Part_URI 61471 13.20 18.97 11.54 29 XM_B_Unsub 57029 10.86 11.40 10.70 30 TR_XM_DK_Bayes2 55162 8.19 0.64 10.35 31 LOTS_OF_MONEY 51307 11.46 17.80 9.63 32 RCVD_IN_MSPIKE_H3 50624 8.08 3.13 9.50 33 XM_Evil_Numbers_Gen 45856 8.82 9.56 8.61 34 LotsOfNums_01 45348 8.89 10.22 8.51 35 TooManyTo_001 43884 7.80 6.26 8.24 36 XM_B_Phish_Phrases 43022 9.21 13.14 8.08 37 RCVD_IN_RP_SAFE 41845 6.62 2.31 7.85 38 UNPARSEABLE_RELAY 41095 7.18 5.31 7.71 39 XM_DK_Undo_02 40362 16.32 46.72 7.58 40 XM_DKIMWhitelistDomains 40167 5.86 0.01 7.54 41 RCVD_IN_RP_CERTIFIED 38542 6.00 1.70 7.23 42 HTML_IMAGE_RATIO_02 38255 8.08 11.23 7.18 43 XM_SendGrid 37204 6.42 4.45 6.98 44 FSL_BULK_SIG 36344 7.68 10.69 6.82 45 MIME_QP_LONG_LINE 34157 6.27 5.78 6.41 46 BAYES_60 32645 6.14 6.18 6.13 47 RELAYCOUNTRY_META 31813 9.36 21.16 5.97 48 HTML_IMAGE_RATIO_04 31209 5.87 5.90 5.86 49 BAYES_40 30318 5.24 3.67 5.69 50 DKIM_INVALID 30311 7.78 15.07 5.69 51 XM_H_Long_From01 29533 5.63 5.92 5.54 52 MPART_ALT_DIFF 29196 5.71 6.52 5.48 53 RCVD_IN_IADB_LISTED 28383 4.73 2.64 5.33 54 XM_PDF 26265 4.01 0.79 4.93 55 RCVD_IN_IADB_SPF 24763 4.15 2.42 4.65 56 BOTNET_IPINHOSTNAME 23653 6.82 15.10 4.44 57 T_TooManySym_01 23120 3.88 2.30 4.34 58 IN_ZIMBRA_NJ_WHITELIST 23108 3.37 0.02 4.34 59 BAYES_20 23034 4.00 2.85 4.32 60 BAYES_99 22081 10.25 31.50 4.14 61 RCVD_IN_IADB_SENDERID 21730 3.69 2.35 4.08 62 RCVD_IN_IADB_DK 21483 3.66 2.35 4.03 63 XMStrtUSub 21151 4.10 4.56 3.97 64 ANY_BOUNCE_MESSAGE 21081 3.26 0.84 3.96 65 BOUNCE_MESSAGE 21075 3.26 0.84 3.96 66 T_REMOTE_IMAGE 20551 3.70 3.16 3.86 67 TR_XM_DK_SendGrid 20097 3.34 1.84 3.77 68 HTML_IMAGE_RATIO_06 19814 3.88 4.42 3.72 69 XMSexyCombo_05 19763 5.06 9.77 3.71 70 RCVD_IN_MSPIKE_H4 18688 3.02 1.33 3.51 71 MIME_HTML_ONLY_MULTI 18630 3.31 2.66 3.50 72 BAYES_80 18461 4.38 7.57 3.47 73 TM2_M_URI_OPT_OUT 18309 3.46 3.56 3.44 74 TR_XM_PhishingBody 18122 4.27 7.27 3.40 75 RCVD_IN_IADB_VOUCHED 18108 2.83 0.84 3.40 76 BAYES_999 17245 7.99 24.51 3.24 77 XMNumbers 16957 3.24 3.42 3.18 78 NO_DNS_FOR_FROM 16681 4.93 11.19 3.13 79 XM_UncommonTLD01 16541 5.61 14.33 3.10 80 HTML_MIME_NO_HTML_TAG 16358 3.16 3.47 3.07 81 XMSubMetaSx_00 16078 3.66 5.90 3.02 82 BAYES_05 15958 2.61 1.29 3.00 83 MAILING_LIST_MULTI 15842 2.71 1.78 2.97 84 BOTNET 15411 7.05 21.52 2.89 85 KHOP_HELO_FCRDNS 15281 3.36 5.07 2.87 86 XM_H_Trusted_IP 14925 2.18 0.00 2.80 87 FROM_EXCESS_BASE64 14180 2.58 2.32 2.66 88 XM_B_Unsub2 14085 2.52 2.09 2.64 89 MIME_HTML_MOSTLY 13130 2.84 4.13 2.46 90 XM_B_COVIDMETA 12049 3.50 7.80 2.26 91 HTML_IMAGE_RATIO_08 11848 2.20 2.11 2.22 92 UNTRUSTED_Relay 11805 4.43 12.15 2.22 93 TooManyTo_002 11645 1.83 0.60 2.19 94 XM_B_Phish66 11532 2.75 4.79 2.16 95 RCVD_IN_IADB_OPTIN 11457 1.80 0.57 2.15 96 T_TooManySym_02 11354 1.79 0.59 2.13 97 XM_CamelCaseFrm001 11072 3.21 7.15 2.08 98 BAYES_95 10930 2.55 4.27 2.05 99 XM_B_SpammyTLD 10914 2.43 3.77 2.05 100 XM_DK_Undo_01 10660 1.84 1.30 2.00 101 HTML_FONT_FACE_BAD 10589 1.74 0.90 1.99 102 TVD_RCVD_IP 10580 1.60 0.27 1.99 103 RCVD_IN_MSPIKE_BL 10391 2.59 4.81 1.95 104 TR_DCC_Bayes_99 10062 7.18 25.58 1.89 105 TR_XM_COVIDMETA4 8873 2.66 6.11 1.67 106 TR_Symld_Words 8819 1.51 1.01 1.66 107 HELO_NODOT 8770 1.41 0.59 1.65 108 HELO_NO_DOMAIN 8769 1.41 0.59 1.65 109 T_XMDrugObfuBody_08 8660 2.25 4.42 1.63 110 XM_GoogleGroups 8648 1.37 0.49 1.62 111 RELAYCOUNTRY_CA 8645 2.63 6.13 1.62 112 XM_SPF_SoftFail 8495 2.14 4.02 1.59 113 URI_HEX 8415 1.88 2.92 1.58 114 T_FILL_THIS_FORM_SHORT 8247 1.47 1.20 1.55 115 SUBJ_ALL_CAPS 8183 1.61 1.85 1.54 116 T_XMDrugObfuBody_14 7838 1.58 1.94 1.47 117 XM_UB50 7810 2.45 5.89 1.47 118 TooManyTo_003 7725 1.23 0.46 1.45 119 IN_HORDE_ADDRESS_BOOK 7721 1.13 0.04 1.45 120 INVALID_MSGID 7637 1.17 0.25 1.43 121 RCVD_IN_MSPIKE_L3 7624 1.96 3.80 1.43 122 XMDiploma_00 7396 1.72 2.86 1.39 123 XM_OfRef6 7355 1.72 2.90 1.38 124 HELO_MISC_IP 7335 1.09 0.08 1.38 125 CK_HELO_DYNAMIC_SPLIT_IP 7325 1.08 0.07 1.37 126 TO_MALFORMED 7322 1.11 0.20 1.37 127 USER_IN_DEF_DKIM_WL 7254 1.06 0.00 1.36 128 XMSubNoVowel 7034 1.14 0.53 1.32 129 DKIM_ADSP_CUSTOM_MED 7029 1.21 0.84 1.32 130 XMCapTrack 6889 1.11 0.46 1.29 131 URI_TRY_3LD 6758 1.75 3.44 1.27 132 XM_H_Long_From02 6542 1.17 0.98 1.23 133 TM2_M_VERY_LONG_WORD 6397 1.36 1.93 1.20 134 XMStockSpam_06 6379 1.28 1.57 1.20 135 TooManyTo_004 5960 0.96 0.39 1.12 136 RELAYCOUNTRY_GB 5711 1.12 1.30 1.07 137 XMGappySubj_01 5587 0.85 0.15 1.05 138 RELAYCOUNTRY_DE 5467 1.11 1.41 1.03 139 XMBdyGiftCard01 5325 1.05 1.21 1.00 140 NML_ADSP_CUSTOM_MED 5306 0.91 0.62 1.00 141 T_OBFU_PDF_ATTACH 5278 0.82 0.24 0.99 142 XM_ProductURIs 5271 1.01 1.06 0.99 143 DEAR_SOMETHING 5142 0.91 0.71 0.97 144 XM_SPF_Unknown 5095 0.89 0.65 0.96 145 TooManyTo_005 5001 0.80 0.33 0.94 146 XMBrknScrpt_02 4817 1.00 1.31 0.90 147 RCVD_IN_BL_SPAMCOP_NET 4656 1.69 4.52 0.87 148 TR_MSPIKEBAYES00 4571 0.67 0.00 0.86 149 FROM_GOV_DKIM_AU 4541 0.70 0.16 0.85 150 XMGenDplmaNmb 4415 1.02 1.68 0.83 151 TR_MetaPhish_Combo_01 4382 0.86 1.01 0.82 152 HTTPS_HTTP_MISMATCH 4221 0.82 0.94 0.79 153 XMDateMe_00 4090 0.67 0.31 0.77 154 SpammyFromTLD_01 3922 1.16 2.61 0.74 155 T_XMDrugObfuBody_00 3848 0.93 1.65 0.72 156 XMHTML_After_End 3743 1.17 2.79 0.70 157 TR_LOTS_OF_MONEY3 3734 1.42 3.90 0.70 158 XMMoneyMeta_00 3686 0.75 0.95 0.69 159 ADVANCE_FEE_4_NEW_MONEY 3658 0.64 0.48 0.69 160 XMBody_17 3627 1.57 4.64 0.68 161 T_TooManySym_03 3343 0.54 0.23 0.63 162 BASE64_LENGTH_79_INF 3341 0.54 0.23 0.63 163 XMSexyCombo_01 3236 0.99 2.32 0.61 164 TM2_M_A_HREF_HREF 3212 0.62 0.67 0.60 165 XM_ShortIntro_01 3180 0.53 0.29 0.60 166 MISSING_HEADERS 3089 0.94 2.17 0.58 167 FORGED_GMAIL_RCVD 2990 0.59 0.67 0.56 168 XM_H_PHPMailer 2985 0.65 0.95 0.56 169 TR_XM_PHPDW 2944 0.87 1.99 0.55 170 T_XMHurry_00 2927 1.01 2.60 0.55 171 MONEY_FRAUD_5 2920 0.54 0.50 0.55 172 FROM_GOV_SPOOF 2898 0.48 0.27 0.54 173 TR_XM_PHPForged 2880 0.86 1.96 0.54 174 TR_XM_FormFill2 2850 0.85 1.94 0.53 175 XM_H_PHPOS 2828 0.84 1.93 0.53 176 XMNoVowels 2814 0.54 0.57 0.53 177 T_Symld_Words_02 2754 0.64 1.09 0.52 178 XMLngstWrd_00 2703 0.49 0.44 0.51 179 XMSubEmpty 2696 0.50 0.46 0.51 180 PDS_OTHER_BAD_TLD 2648 1.01 2.80 0.50 181 RCVD_IN_MSPIKE_L4 2640 0.51 0.55 0.50 182 XMBody_78 2629 0.66 1.24 0.49 183 RELAYCOUNTRY_AU 2625 0.53 0.67 0.49 184 HTML_IMAGE_ONLY_20 2601 0.46 0.35 0.49 185 HTML_IMAGE_ONLY_28 2598 0.46 0.37 0.49 186 RCVD_IN_SORBS_DUL 2577 0.39 0.07 0.48 187 HTML_TAG_BALANCE_BODY 2492 0.52 0.70 0.47 188 XM_DIRTYINTL 2486 1.13 3.46 0.47 189 XMPhish08 2438 0.52 0.76 0.46 190 XMSlimDrugH 2434 0.47 0.50 0.46 191 TM2_M_BODY_EMPTY 2430 0.40 0.20 0.46 192 TR_XM_COVIDMETA5 2418 0.37 0.09 0.45 193 XMSubject_78 2403 0.36 0.04 0.45 194 XM_D_omniadmin_Whitelist 2391 0.35 0.00 0.45 195 XMBounce_01 2342 0.40 0.28 0.44 196 XMLngstWrd_01 2248 0.42 0.40 0.42 197 XMPhish30 2229 0.58 1.13 0.42 198 SHORT_HELO_AND_INLINE_IMAGE 2228 0.33 0.04 0.42 199 XMSubMetaI_00 2189 0.51 0.86 0.41 200 TR_XM_COVIDMETA1 2185 0.82 2.23 0.41 ----------------------------------------------------------------------