Email: 622680 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 2.18 sec Spam: 93312 Autolearn: 0 AvgScore: 11.81 AvgScanTime: 4.21 sec Ham: 529368 Autolearn: 0 AvgScore: -2.60 AvgScanTime: 1.82 sec Time Spent Running SA: 376.77 hours Time Spent Processing Spam: 109.04 hours Time Spent Processing Ham: 267.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 90760 98.04 97.27 98.18 2 HTML_MESSAGE 88543 90.28 94.89 89.47 3 DKIM_SIGNED 74602 76.70 79.95 76.13 4 XM_DK_Pass 72401 75.32 77.59 74.92 5 XM_B_Unicode 69534 72.83 74.52 72.54 6 RELAYCOUNTRY_US 67520 81.15 72.36 82.70 7 XMListUnsubscribeExists 65325 54.81 70.01 52.13 8 DKIM_VALID 58934 69.15 63.16 70.20 9 XM_DK_Undo_02 52288 18.11 56.04 11.42 10 DKIM_VALID_AU 43381 51.55 46.49 52.44 11 MIME_HTML_ONLY 37544 25.31 40.23 22.67 12 BAYES_99 37383 12.15 40.06 7.23 13 XM_B_Unicode3 35047 42.02 37.56 42.81 14 BAYES_50 34007 50.07 36.44 52.47 15 BAYES_999 31422 9.86 33.67 5.66 16 LOC_TINY_FONT_1 30414 26.72 32.59 25.69 17 DKIM_VALID_EF 29208 26.61 31.30 25.78 18 BOTNET 28208 7.42 30.23 3.40 19 T_KAM_HTML_FONT_INVALID 25898 20.67 27.75 19.42 20 RELAYCOUNTRY_META 25736 9.02 27.58 5.75 21 HTML_FONT_LOW_CONTRAST 25260 28.88 27.07 29.20 22 XMSubLong 23685 21.31 25.38 20.59 23 FVGT_m_MULTI_ODD 23128 22.50 24.79 22.10 24 XM_UncommonTLD01 21266 6.25 22.79 3.34 25 RCVD_IN_MSPIKE_H2 20231 20.47 21.68 20.26 26 T_TM2_M_HEADER_IN_MSG 19533 26.36 20.93 27.32 27 XM_Body_Dirty_Words 16615 14.79 17.81 14.26 28 BOTNET_IPINHOSTNAME 15989 7.16 17.13 5.40 29 DKIM_INVALID 15668 7.55 16.79 5.92 30 UNTRUSTED_Relay 15661 4.10 16.78 1.86 31 LOTS_OF_MONEY 14491 10.92 15.53 10.11 32 XM_Multi_Part_URI 14201 12.79 15.22 12.36 33 XM_B_Phish_Phrases 12463 8.42 13.36 7.55 34 HTML_IMAGE_RATIO_02 11890 8.14 12.74 7.33 35 XM_B_Unsub 11881 11.64 12.73 11.44 36 NO_DNS_FOR_FROM 11477 4.70 12.30 3.36 37 XM_CamelCaseFrm001 9242 3.38 9.90 2.23 38 XM_Evil_Numbers_Gen 8632 9.07 9.25 9.04 39 XMSexyCombo_05 8542 5.58 9.15 4.95 40 XM_B_COVIDMETA 8162 3.26 8.75 2.29 41 RELAYCOUNTRY_CA 7912 2.70 8.48 1.68 42 URIBL_SBL_A 7665 1.40 8.21 0.20 43 TR_XM_MaxBayes 7351 1.26 7.88 0.09 44 RCVD_IN_MSPIKE_BL 7252 1.66 7.77 0.59 45 LotsOfNums_01 6881 9.04 7.37 9.33 46 MPART_ALT_DIFF 6758 6.25 7.24 6.07 47 TooManyTo_001 6650 8.00 7.13 8.15 48 TR_XM_COVIDMETA4 6317 1.94 6.77 1.08 49 XMSubMetaSx_00 6040 4.52 6.47 4.17 50 TR_XM_PhishingBody 5862 3.73 6.28 3.28 51 RCVD_IN_MSPIKE_L3 5856 1.33 6.28 0.45 52 RCVD_IN_RP_RNBL 5739 1.05 6.15 0.15 53 BAYES_80 5539 4.32 5.94 4.03 54 XM_UB50 5485 1.84 5.88 1.13 55 XMBody_17 5387 1.43 5.77 0.66 56 T_XMDrugObfuBody_08 5354 2.52 5.74 1.95 57 XMNumbers 5109 3.64 5.48 3.32 58 SpammyFromTLD_02 5091 1.12 5.46 0.35 59 RCVD_IN_MSPIKE_WL 5058 19.52 5.42 22.01 60 XM_H_Long_From01 5000 5.56 5.36 5.60 61 RELAYCOUNTRY_FR 4970 1.01 5.33 0.25 62 TR_XM_INV_DKIM 4854 0.88 5.20 0.11 63 BAYES_60 4792 6.04 5.14 6.20 64 XM_UB99 4703 0.76 5.04 0.01 65 UNPARSEABLE_RELAY 4626 7.20 4.96 7.60 66 MIME_HTML_MOSTLY 4574 2.86 4.90 2.50 67 HTML_IMAGE_RATIO_04 4482 6.76 4.80 7.11 68 BOTNET_NORDNS 4453 0.80 4.77 0.10 69 SpammyFromTLD_01 4423 1.39 4.74 0.81 70 XM_B_SpammyTLD 4418 2.49 4.73 2.09 71 KHOP_HELO_FCRDNS 4344 2.33 4.66 1.93 72 XM_SPF_SoftFail 4291 2.26 4.60 1.85 73 XM_URI_RBL 4183 0.86 4.48 0.22 74 XM_B_Unsub2 4136 2.55 4.43 2.22 75 RCVD_IN_BL_SPAMCOP_NET 4072 1.79 4.36 1.34 76 XM_UB999 4048 0.65 4.34 0.00 77 T_REMOTE_IMAGE 4024 3.63 4.31 3.50 78 TR_XM_MaxSPIKE 3915 0.65 4.20 0.02 79 TM2_M_URI_OPT_OUT 3878 3.78 4.16 3.71 80 ALL_TRUSTED 3826 12.09 4.10 13.50 81 XM_SendGrid 3790 6.46 4.06 6.89 82 XM_B_Phish66 3693 2.12 3.96 1.80 83 XM_OfRef6 3593 1.60 3.85 1.20 84 TR_LOTS_OF_MONEY3 3403 1.26 3.65 0.84 85 DATE_IN_PAST_03_06 3291 0.62 3.53 0.11 86 XMStrtUSub 3214 3.89 3.44 3.97 87 BAYES_95 3139 2.56 3.36 2.42 88 PDS_OTHER_BAD_TLD 3088 0.96 3.31 0.55 89 XM_DIRTYINTL 3039 1.01 3.26 0.61 90 HTML_IMAGE_RATIO_06 2961 4.46 3.17 4.69 91 TR_XM_COVIDMETA1 2907 1.00 3.12 0.63 92 MIME_HTML_ONLY_MULTI 2889 3.96 3.10 4.11 93 HTML_SHORT_LINK_IMG_1 2872 0.48 3.08 0.02 94 MIME_QP_LONG_LINE 2851 5.77 3.06 6.25 95 HTML_IMAGE_RATIO_08 2799 2.82 3.00 2.78 96 FROM_SUSPICIOUS_NTLD 2784 0.54 2.98 0.11 97 HTML_MIME_NO_HTML_TAG 2768 2.40 2.97 2.30 98 REPLYTO_WITHOUT_TO_CC 2735 0.53 2.93 0.10 99 BODY_URI_ONLY 2689 0.48 2.88 0.05 100 RCVD_IN_MSPIKE_H4 2688 9.76 2.88 10.97 101 FROM_SUSPICIOUS_NTLD_FP 2665 0.51 2.86 0.10 102 BAYES_40 2616 4.51 2.80 4.81 103 TooManyTo_002 2593 2.25 2.78 2.16 104 T_TooManySym_01 2577 4.18 2.76 4.43 105 TR_XM_PHPDW 2571 0.77 2.76 0.42 106 TR_XM_PHPForged 2556 0.76 2.74 0.41 107 TR_XM_FormFill2 2528 0.75 2.71 0.41 108 XM_H_PHPOS 2519 0.75 2.70 0.40 109 DATE_IN_PAST_06_12 2502 0.55 2.68 0.18 110 SHORT_SHORTNER 2481 0.41 2.66 0.02 111 LongTLD 2466 0.60 2.64 0.23 112 HTML_IMAGE_ONLY_08 2442 0.52 2.62 0.15 113 MIME_HEADER_CTYPE_ONLY 2340 0.53 2.51 0.18 114 RCVD_IN_MSPIKE_H3 2336 9.28 2.50 10.47 115 HDRS_LCASE_IMGONLY 2286 0.38 2.45 0.01 116 XMLongAddy 2272 0.42 2.43 0.06 117 TooManyTo_003 2241 1.62 2.40 1.49 118 T_XMHurry_00 2207 0.74 2.37 0.45 119 SHORTENER_SHORT_IMG 2186 0.35 2.34 0.00 120 XMSexyCombo_01 2136 1.35 2.29 1.18 121 RELAYCOUNTRY_IN 2112 0.46 2.26 0.14 122 BAYES_00 2016 14.60 2.16 16.79 123 SHORT_URI_3 2004 0.39 2.15 0.07 124 BAYES_05 1967 2.46 2.11 2.52 125 TooManyTo_004 1926 1.24 2.06 1.10 126 BAYES_20 1850 3.29 1.98 3.52 127 TR_XM_RelayPhish 1845 0.46 1.98 0.19 128 XMDiploma_00 1843 1.41 1.98 1.31 129 XMBdyGiftCard01 1733 1.18 1.86 1.06 130 TR_Symld_Words 1716 1.56 1.84 1.51 131 T_XMDrugObfuBody_14 1660 1.64 1.78 1.62 132 RCVD_IN_PSBL 1640 0.33 1.76 0.08 133 URI_HEX 1618 1.39 1.73 1.33 134 DKIM_ADSP_CUSTOM_MED 1600 1.40 1.71 1.34 135 SUBJ_ALL_CAPS 1584 1.79 1.70 1.81 136 FVGT_m_MULTI_ODD_EMAIL 1573 0.28 1.69 0.03 137 XMBrknScrpt_02 1555 0.98 1.67 0.86 138 TM2_M_VERY_LONG_WORD 1551 1.40 1.66 1.35 139 FROM_EXCESS_BASE64 1547 3.23 1.66 3.50 140 RDNS_DYNAMIC 1518 0.55 1.63 0.36 141 TR_MetaPhish_Combo_01 1514 0.86 1.62 0.72 142 XMStockSpam_06 1493 1.60 1.60 1.60 143 T_FILL_THIS_FORM_SHORT 1470 0.88 1.58 0.76 144 HTML_FONT_SIZE_HUGE 1450 0.34 1.55 0.13 145 HK_RANDOM_REPLYTO 1437 0.37 1.54 0.16 146 NML_ADSP_CUSTOM_MED 1428 1.07 1.53 0.99 147 TR_XM_DK_SendGrid 1417 3.50 1.52 3.85 148 XM_UB80 1365 0.25 1.46 0.03 149 TooManyTo_005 1362 0.99 1.46 0.91 150 XMGenDplmaNmb 1353 0.88 1.45 0.78 151 T_XMDrugObfuBody_00 1335 0.77 1.43 0.65 152 XM_UB60 1290 0.31 1.38 0.12 153 URI_TRY_3LD 1288 1.35 1.38 1.34 154 RELAYCOUNTRY_GB 1278 1.04 1.37 0.98 155 RELAYCOUNTRY_NL 1275 0.56 1.37 0.41 156 XM_DK_Undo_01 1272 1.81 1.36 1.89 157 URI_WP_HACKED_2 1257 0.26 1.35 0.06 158 XM_H_PHPMailer 1249 0.57 1.34 0.44 159 XM_OfRef7 1233 0.31 1.32 0.13 160 XMBody_78 1219 0.57 1.31 0.44 161 T_MONEY_PERCENT 1198 0.48 1.28 0.34 162 TR_LOTS_OF_MONEY2 1198 0.48 1.28 0.34 163 BASE64_LENGTH_79_INF 1197 0.45 1.28 0.30 164 T_Symld_Words_02 1194 0.54 1.28 0.41 165 TR_Mismatch_TLD_01 1165 0.38 1.25 0.22 166 MAILING_LIST_MULTI 1124 2.19 1.20 2.36 167 XMSubMetaSxObfu_03 1118 0.90 1.20 0.85 168 HTML_FONT_FACE_BAD 1116 2.19 1.20 2.36 169 XMMoneyMeta_00 1101 0.80 1.18 0.73 170 SUSPICIOUS_RECIPS 1083 0.18 1.16 0.00 171 XM_H_PHPOS_M 1071 0.30 1.15 0.15 172 XMSexyCombo_04 1069 0.63 1.15 0.54 173 FORGED_GMAIL_RCVD 1055 0.65 1.13 0.56 174 XM_HighProb1 1052 0.17 1.13 0.01 175 DIET_1 1043 0.41 1.12 0.29 176 XM_H_MailChimp 1039 0.38 1.11 0.25 177 HTML_TAG_BALANCE_BODY 997 0.54 1.07 0.45 178 TR_Sbj_FN_Bdy 981 0.38 1.05 0.26 179 MPART_ALT_DIFF_COUNT 966 0.59 1.04 0.51 180 TR_XM_COVIDMETA2 956 0.31 1.02 0.19 181 XMSubMetaI_00 951 0.53 1.02 0.44 182 T_HTML_TAG_BALANCE_CENTER 949 0.28 1.02 0.15 183 XMPhish08 939 0.54 1.01 0.46 184 XMHTML_After_End 912 0.91 0.98 0.90 185 XMSlimDrugH 912 0.43 0.98 0.34 186 MONEY_BACK 906 0.19 0.97 0.05 187 DKIM_ADSP_NXDOMAIN 905 0.42 0.97 0.32 188 XM_BadFromFormat 902 0.25 0.97 0.13 189 FILL_THIS_FORM 896 0.52 0.96 0.44 190 URIBL_BLACK 884 0.17 0.95 0.03 191 RCVD_IN_IADB_LISTED 838 4.56 0.90 5.21 192 SUBJ_BUY 836 0.24 0.90 0.12 193 XM_XX_Yahoo 835 0.21 0.89 0.09 194 SHORT_URI_2 834 0.16 0.89 0.04 195 HTML_FONT_SIZE_LARGE 829 0.22 0.89 0.11 196 RELAYCOUNTRY_DE 826 0.50 0.89 0.44 197 TR_Mismatch_TLD_02 822 0.21 0.88 0.09 198 XM_PDF 820 3.56 0.88 4.03 199 TR_XM_COVIDMETA3 816 0.17 0.87 0.04 200 XM_UB95 797 0.14 0.85 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 519725 98.04 97.27 98.18 2 HTML_MESSAGE 473629 90.28 94.89 89.47 3 RELAYCOUNTRY_US 437765 81.15 72.36 82.70 4 DKIM_SIGNED 402982 76.70 79.95 76.13 5 XM_DK_Pass 396594 75.32 77.59 74.92 6 XM_B_Unicode 383988 72.83 74.52 72.54 7 DKIM_VALID 371636 69.15 63.16 70.20 8 BAYES_50 277776 50.07 36.44 52.47 9 DKIM_VALID_AU 277627 51.55 46.49 52.44 10 XMListUnsubscribeExists 275973 54.81 70.01 52.13 11 XM_B_Unicode3 226627 42.02 37.56 42.81 12 HTML_FONT_LOW_CONTRAST 154590 28.88 27.07 29.20 13 T_TM2_M_HEADER_IN_MSG 144606 26.36 20.93 27.32 14 DKIM_VALID_EF 136478 26.61 31.30 25.78 15 LOC_TINY_FONT_1 135991 26.72 32.59 25.69 16 MIME_HTML_ONLY 120029 25.31 40.23 22.67 17 FVGT_m_MULTI_ODD 116979 22.50 24.79 22.10 18 RCVD_IN_MSPIKE_WL 116520 19.52 5.42 22.01 19 XMSubLong 108985 21.31 25.38 20.59 20 RCVD_IN_MSPIKE_H2 107254 20.47 21.68 20.26 21 T_KAM_HTML_FONT_INVALID 102797 20.67 27.75 19.42 22 BAYES_00 88899 14.60 2.16 16.79 23 XM_Body_Dirty_Words 75482 14.79 17.81 14.26 24 ALL_TRUSTED 71473 12.09 4.10 13.50 25 XM_Multi_Part_URI 65452 12.79 15.22 12.36 26 XM_B_Unsub 60582 11.64 12.73 11.44 27 XM_DK_Undo_02 60449 18.11 56.04 11.42 28 RCVD_IN_MSPIKE_H4 58095 9.76 2.88 10.97 29 RCVD_IN_MSPIKE_H3 55425 9.28 2.50 10.47 30 LOTS_OF_MONEY 53516 10.92 15.53 10.11 31 TR_XM_DK_Bayes 51732 8.42 0.76 9.77 32 LotsOfNums_01 49388 9.04 7.37 9.33 33 XM_Evil_Numbers_Gen 47842 9.07 9.25 9.04 34 TR_XM_DK_Bayes1 47382 7.68 0.47 8.95 35 TooManyTo_001 43151 8.00 7.13 8.15 36 TR_XM_DK_Bayes2 42538 6.89 0.38 8.04 37 RCVD_IN_RP_SAFE 41194 6.74 0.81 7.78 38 UNPARSEABLE_RELAY 40206 7.20 4.96 7.60 39 XM_B_Phish_Phrases 39961 8.42 13.36 7.55 40 HTML_IMAGE_RATIO_02 38783 8.14 12.74 7.33 41 RCVD_IN_RP_CERTIFIED 38265 6.25 0.69 7.23 42 BAYES_99 38258 12.15 40.06 7.23 43 XM_DKIMWhitelistDomains 37619 6.04 0.02 7.11 44 HTML_IMAGE_RATIO_04 37615 6.76 4.80 7.11 45 XM_SendGrid 36448 6.46 4.06 6.89 46 MIME_QP_LONG_LINE 33065 5.77 3.06 6.25 47 BAYES_60 32843 6.04 5.14 6.20 48 MPART_ALT_DIFF 32144 6.25 7.24 6.07 49 DKIM_INVALID 31346 7.55 16.79 5.92 50 RELAYCOUNTRY_META 30432 9.02 27.58 5.75 51 BAYES_999 29969 9.86 33.67 5.66 52 XM_H_Long_From01 29639 5.56 5.36 5.60 53 BOTNET_IPINHOSTNAME 28567 7.16 17.13 5.40 54 IN_ZIMBRA_NJ_WHITELIST 28470 4.58 0.04 5.38 55 RCVD_IN_IADB_LISTED 27581 4.56 0.90 5.21 56 XMSexyCombo_05 26187 5.58 9.15 4.95 57 BAYES_40 25459 4.51 2.80 4.81 58 HTML_IMAGE_RATIO_06 24834 4.46 3.17 4.69 59 RCVD_IN_IADB_SPF 24166 4.00 0.80 4.57 60 XM_H_Trusted_IP 23728 3.81 0.00 4.48 61 T_TooManySym_01 23426 4.18 2.76 4.43 62 XMSubMetaSx_00 22086 4.52 6.47 4.17 63 MIME_HTML_ONLY_MULTI 21765 3.96 3.10 4.11 64 RCVD_IN_IADB_SENDERID 21644 3.59 0.75 4.09 65 XM_PDF 21349 3.56 0.88 4.03 66 BAYES_80 21342 4.32 5.94 4.03 67 RCVD_IN_IADB_DK 21159 3.51 0.76 4.00 68 XMStrtUSub 21031 3.89 3.44 3.97 69 TR_XM_DK_SendGrid 20392 3.50 1.52 3.85 70 TM2_M_URI_OPT_OUT 19658 3.78 4.16 3.71 71 BAYES_20 18647 3.29 1.98 3.52 72 T_REMOTE_IMAGE 18552 3.63 4.31 3.50 73 FROM_EXCESS_BASE64 18542 3.23 1.66 3.50 74 BOTNET 18022 7.42 30.23 3.40 75 NO_DNS_FOR_FROM 17803 4.70 12.30 3.36 76 XM_UncommonTLD01 17666 6.25 22.79 3.34 77 XMNumbers 17566 3.64 5.48 3.32 78 TR_XM_PhishingBody 17387 3.73 6.28 3.28 79 ANY_BOUNCE_MESSAGE 16352 2.72 0.61 3.09 80 BOUNCE_MESSAGE 16346 2.72 0.61 3.09 81 RCVD_IN_IADB_VOUCHED 16022 2.63 0.41 3.03 82 HTML_IMAGE_RATIO_08 14734 2.82 3.00 2.78 83 BAYES_05 13331 2.46 2.11 2.52 84 MIME_HTML_MOSTLY 13220 2.86 4.90 2.50 85 BAYES_95 12813 2.56 3.36 2.42 86 HTML_FONT_FACE_BAD 12516 2.19 1.20 2.36 87 MAILING_LIST_MULTI 12504 2.19 1.20 2.36 88 HTML_MIME_NO_HTML_TAG 12167 2.40 2.97 2.30 89 XM_B_COVIDMETA 12142 3.26 8.75 2.29 90 XM_CamelCaseFrm001 11811 3.38 9.90 2.23 91 XM_B_Unsub2 11749 2.55 4.43 2.22 92 TooManyTo_002 11423 2.25 2.78 2.16 93 XM_B_SpammyTLD 11059 2.49 4.73 2.09 94 T_TooManySym_02 10718 1.83 0.74 2.02 95 TVD_RCVD_IP 10498 1.73 0.30 1.98 96 T_XMDrugObfuBody_08 10313 2.52 5.74 1.95 97 KHOP_HELO_FCRDNS 10192 2.33 4.66 1.93 98 XM_DK_Undo_01 10005 1.81 1.36 1.89 99 RCVD_IN_IADB_OPTIN 9989 1.66 0.37 1.89 100 UNTRUSTED_Relay 9846 4.10 16.78 1.86 101 XM_SPF_SoftFail 9791 2.26 4.60 1.85 102 SUBJ_ALL_CAPS 9582 1.79 1.70 1.81 103 XM_B_Phish66 9531 2.12 3.96 1.80 104 RELAYCOUNTRY_CA 8878 2.70 8.48 1.68 105 T_XMDrugObfuBody_14 8564 1.64 1.78 1.62 106 XMStockSpam_06 8496 1.60 1.60 1.60 107 TR_Symld_Words 8005 1.56 1.84 1.51 108 HELO_MISC_IP 7904 1.29 0.12 1.49 109 CK_HELO_DYNAMIC_SPLIT_IP 7899 1.29 0.16 1.49 110 TooManyTo_003 7872 1.62 2.40 1.49 111 INVALID_MSGID 7746 1.27 0.18 1.46 112 IN_HORDE_ADDRESS_BOOK 7666 1.24 0.04 1.45 113 XM_ProductURIs 7365 1.31 0.82 1.39 114 TM2_M_VERY_LONG_WORD 7157 1.40 1.66 1.35 115 URI_TRY_3LD 7104 1.35 1.38 1.34 116 DKIM_ADSP_CUSTOM_MED 7100 1.40 1.71 1.34 117 RCVD_IN_BL_SPAMCOP_NET 7098 1.79 4.36 1.34 118 URI_HEX 7046 1.39 1.73 1.33 119 XMDiploma_00 6956 1.41 1.98 1.31 120 TO_MALFORMED 6799 1.19 0.68 1.28 121 XM_GoogleGroups 6692 1.15 0.51 1.26 122 XMSubNoVowel 6643 1.18 0.74 1.25 123 XM_OfRef6 6374 1.60 3.85 1.20 124 XMSexyCombo_01 6258 1.35 2.29 1.18 125 XM_UB50 5997 1.84 5.88 1.13 126 TooManyTo_004 5801 1.24 2.06 1.10 127 TR_XM_COVIDMETA4 5734 1.94 6.77 1.08 128 XMCapTrack 5635 1.00 0.61 1.06 129 XM_H_Long_From02 5624 1.01 0.69 1.06 130 XMBdyGiftCard01 5612 1.18 1.86 1.06 131 NML_ADSP_CUSTOM_MED 5219 1.07 1.53 0.99 132 RELAYCOUNTRY_GB 5182 1.04 1.37 0.98 133 XMGappySubj_01 5119 0.86 0.27 0.97 134 USER_IN_DEF_DKIM_WL 5067 0.82 0.01 0.96 135 TooManyTo_005 4826 0.99 1.46 0.91 136 XMHTML_After_End 4771 0.91 0.98 0.90 137 XMBrknScrpt_02 4531 0.98 1.67 0.86 138 XMSubMetaSxObfu_03 4479 0.90 1.20 0.85 139 TR_LOTS_OF_MONEY3 4443 1.26 3.65 0.84 140 SpammyFromTLD_01 4263 1.39 4.74 0.81 141 TR_MSPIKEBAYES00 4181 0.67 0.00 0.79 142 XMGenDplmaNmb 4130 0.88 1.45 0.78 143 T_FILL_THIS_FORM_SHORT 3999 0.88 1.58 0.76 144 XMMoneyMeta_00 3873 0.80 1.18 0.73 145 TR_MetaPhish_Combo_01 3826 0.86 1.62 0.72 146 XMNoVowels 3776 0.67 0.40 0.71 147 HTML_IMAGE_ONLY_20 3540 0.64 0.46 0.67 148 T_TooManySym_03 3500 0.62 0.37 0.66 149 XMBody_17 3488 1.43 5.77 0.66 150 T_XMDrugObfuBody_00 3464 0.77 1.43 0.65 151 XMPhish30 3461 0.68 0.82 0.65 152 TR_XM_COVIDMETA1 3347 1.00 3.12 0.63 153 XM_RXBody 3295 0.63 0.67 0.62 154 XM_DIRTYINTL 3220 1.01 3.26 0.61 155 HTTPS_HTTP_MISMATCH 3210 0.61 0.65 0.61 156 RCVD_IN_MSPIKE_BL 3111 1.66 7.77 0.59 157 RCVD_IN_MSPIKE_H5 3000 0.49 0.04 0.57 158 FORGED_GMAIL_RCVD 2967 0.65 1.13 0.56 159 XM_SPF_Unknown 2961 0.58 0.68 0.56 160 T_OBFU_PDF_ATTACH 2953 0.49 0.11 0.56 161 PDS_OTHER_BAD_TLD 2919 0.96 3.31 0.55 162 MISSING_HEADERS 2888 0.59 0.83 0.55 163 XMSexyCombo_04 2860 0.63 1.15 0.54 164 XMHTMLBadTable_001 2719 0.46 0.16 0.51 165 XM_ShortIntro_01 2705 0.49 0.40 0.51 166 MPART_ALT_DIFF_COUNT 2698 0.59 1.04 0.51 167 XMSubMetaSx_01 2503 0.44 0.26 0.47 168 HELO_NODOT 2500 0.51 0.75 0.47 169 HELO_NO_DOMAIN 2495 0.51 0.75 0.47 170 XMPhish08 2419 0.54 1.01 0.46 171 T_XMHurry_00 2405 0.74 2.37 0.45 172 RCVD_IN_MSPIKE_L3 2399 1.33 6.28 0.45 173 HTML_TAG_BALANCE_BODY 2383 0.54 1.07 0.45 174 XM_USANA_RCVD 2366 0.38 0.00 0.45 175 XMSubMetaI_00 2348 0.53 1.02 0.44 176 XMBody_78 2348 0.57 1.31 0.44 177 XMLngstWrd_00 2338 0.44 0.41 0.44 178 FILL_THIS_FORM 2332 0.52 0.96 0.44 179 FROM_GOV_DKIM_AU 2322 0.39 0.10 0.44 180 XM_H_PHPMailer 2321 0.57 1.34 0.44 181 RELAYCOUNTRY_DE 2306 0.50 0.89 0.44 182 SUBJ_DOLLARS 2293 0.47 0.66 0.43 183 XMSubMetaSxObfu_02 2290 0.45 0.56 0.43 184 TM2_M_BODY_EMPTY 2272 0.39 0.20 0.43 185 TR_XM_PHPDW 2229 0.77 2.76 0.42 186 HTML_IMAGE_ONLY_28 2197 0.48 0.82 0.42 187 XM_B_REG_HTML 2195 0.37 0.14 0.41 188 RELAYCOUNTRY_NL 2187 0.56 1.37 0.41 189 TR_XM_FormFill2 2173 0.75 2.71 0.41 190 TR_XM_PHPForged 2170 0.76 2.74 0.41 191 T_Symld_Words_02 2161 0.54 1.28 0.41 192 XMBody_95 2156 0.36 0.10 0.41 193 XM_B_COPY_HTML 2153 0.39 0.32 0.41 194 XM_H_PHPOS 2138 0.75 2.70 0.40 195 XMSexyCombo_02 2136 0.37 0.16 0.40 196 URI_NOVOWEL 2133 0.44 0.65 0.40 197 PLING_QUERY 2113 0.40 0.38 0.40 198 XMFunnyHTTP 2087 0.34 0.00 0.39 199 THIS_AD 2074 0.42 0.57 0.39 200 XMLngstWrd_01 2047 0.39 0.38 0.39 ----------------------------------------------------------------------