Email: 741673 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 1.95 sec Spam: 91096 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 4.41 sec Ham: 650577 Autolearn: 0 AvgScore: -1.67 AvgScanTime: 1.61 sec Time Spent Running SA: 402.10 hours Time Spent Processing Spam: 111.67 hours Time Spent Processing Ham: 290.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 88601 98.15 97.26 98.28 2 HTML_MESSAGE 84429 80.78 92.68 79.12 3 DKIM_SIGNED 69416 69.99 76.20 69.12 4 XM_B_Unicode 67082 62.92 73.64 61.42 5 RELAYCOUNTRY_US 65077 73.34 71.44 73.60 6 XM_DK_Pass 64056 68.45 70.32 68.19 7 XMListUnsubscribeExists 62298 48.77 68.39 46.03 8 DKIM_VALID 50981 62.97 55.96 63.96 9 XM_DK_Undo_02 44102 15.34 48.41 10.70 10 BAYES_50 37607 47.19 41.28 48.02 11 XM_B_Unicode3 36842 36.49 40.44 35.94 12 DKIM_VALID_AU 35810 46.78 39.31 47.82 13 BOTNET 31757 7.09 34.86 3.20 14 BAYES_99 30700 9.96 33.70 6.64 15 LOC_TINY_FONT_1 30097 23.04 33.04 21.64 16 MIME_HTML_ONLY 29055 20.13 31.89 18.49 17 HTML_FONT_LOW_CONTRAST 26412 24.59 28.99 23.98 18 FVGT_m_MULTI_ODD 26266 21.06 28.83 19.97 19 RELAYCOUNTRY_META 25990 7.91 28.53 5.03 20 BAYES_999 24119 7.82 26.48 5.21 21 DKIM_VALID_EF 22182 25.17 24.35 25.29 22 XMSubLong 21052 19.85 23.11 19.40 23 XM_UncommonTLD01 20631 5.32 22.65 2.89 24 RCVD_IN_MSPIKE_H2 20542 21.24 22.55 21.06 25 T_KAM_HTML_FONT_INVALID 18825 17.73 20.67 17.31 26 DKIM_INVALID 18435 7.01 20.24 5.16 27 UNTRUSTED_Relay 17209 3.76 18.89 1.64 28 XM_Body_Dirty_Words 17156 12.89 18.83 12.06 29 BOTNET_IPINHOSTNAME 16798 6.41 18.44 4.72 30 T_TM2_M_HEADER_IN_MSG 16766 24.15 18.40 24.95 31 XM_Multi_Part_URI 15786 17.08 17.33 17.05 32 HTML_IMAGE_RATIO_02 14692 6.97 16.13 5.69 33 NO_DNS_FOR_FROM 12356 4.11 13.56 2.79 34 XMSexyCombo_05 11075 4.68 12.16 3.64 35 XM_B_Unsub 11020 12.33 12.10 12.36 36 LOTS_OF_MONEY 10940 8.44 12.01 7.94 37 SpammyFromTLD_02 10420 1.68 11.44 0.31 38 XM_B_Phish_Phrases 9854 7.52 10.82 7.06 39 XM_Evil_Numbers_Gen 9045 7.91 9.93 7.63 40 MPART_ALT_DIFF 8621 4.85 9.46 4.20 41 FROM_SUSPICIOUS_NTLD 8251 1.16 9.06 0.05 42 FROM_SUSPICIOUS_NTLD_FP 8156 1.14 8.95 0.05 43 PDS_OTHER_BAD_TLD 7758 1.19 8.52 0.16 44 LotsOfNums_01 7546 8.17 8.28 8.16 45 RCVD_IN_MSPIKE_BL 7399 1.34 8.12 0.40 46 TR_XM_PhishingBody 7374 3.83 8.09 3.23 47 RCVD_IN_MSPIKE_WL 7174 21.58 7.88 23.50 48 RELAYCOUNTRY_CA 7080 2.35 7.77 1.59 49 BAYES_80 6937 4.16 7.62 3.67 50 XM_UB50 6872 1.83 7.54 1.03 51 MIME_HTML_MOSTLY 6740 2.76 7.40 2.11 52 XMSubMetaSx_00 6691 3.69 7.34 3.17 53 XM_B_SpammyTLD 6686 2.18 7.34 1.46 54 BAYES_60 6337 5.77 6.96 5.61 55 RCVD_IN_BL_SPAMCOP_NET 6299 2.03 6.91 1.34 56 XM_B_COVIDMETA 5750 2.51 6.31 1.98 57 TooManyTo_001 5712 7.13 6.27 7.25 58 XM_H_Long_From01 5711 4.91 6.27 4.72 59 UNPARSEABLE_RELAY 5693 6.18 6.25 6.17 60 HTML_TAG_BALANCE_CENTER 5676 0.84 6.23 0.09 61 XM_SPF_SoftFail 5433 1.95 5.96 1.39 62 XM_B_Phish66 5078 2.26 5.57 1.79 63 TR_XM_INV_DKIM 5032 0.81 5.52 0.15 64 TR_XM_COVIDMETA4 4979 1.23 5.47 0.64 65 XMNumbers 4793 3.14 5.26 2.85 66 FROM_EXCESS_BASE64 4657 3.03 5.11 2.74 67 BOTNET_NORDNS 4646 0.65 5.10 0.02 68 RELAYCOUNTRY_FR 4602 0.87 5.05 0.29 69 SpammyFromTLD_01 4597 1.48 5.05 0.98 70 T_REMOTE_IMAGE 4557 3.19 5.00 2.93 71 HTML_IMAGE_RATIO_04 4538 5.00 4.98 5.01 72 XM_DIRTYINTL 4477 1.14 4.91 0.61 73 RCVD_IN_MSPIKE_L3 4408 0.86 4.84 0.30 74 HTML_MIME_NO_HTML_TAG 4361 2.64 4.79 2.34 75 REPLYTO_WITHOUT_TO_CC 4146 0.59 4.55 0.04 76 RCVD_IN_RP_RNBL 4098 0.61 4.50 0.06 77 KHOP_HELO_FCRDNS 4064 1.88 4.46 1.52 78 NORDNS_LOW_CONTRAST 4048 0.55 4.44 0.00 79 RCVD_IN_MSPIKE_H3 4032 12.32 4.43 13.43 80 MPART_ALT_DIFF_COUNT 3956 0.86 4.34 0.37 81 XM_SendGrid 3806 5.55 4.18 5.74 82 XM_UB99 3735 0.51 4.10 0.01 83 BAYES_95 3617 2.46 3.97 2.25 84 TM2_M_URI_OPT_OUT 3555 14.17 3.90 15.61 85 XM_URI_RBL 3424 0.62 3.76 0.18 86 TR_Symld_Words 3264 1.82 3.58 1.58 87 XMStrtUSub 3066 4.55 3.37 4.71 88 RCVD_IN_MSPIKE_H4 3043 8.01 3.34 8.66 89 BODY_URI_ONLY 3011 0.44 3.31 0.04 90 XM_OfRef6 2980 1.54 3.27 1.30 91 XM_UB999 2913 0.40 3.20 0.00 92 MIME_QP_LONG_LINE 2870 4.92 3.15 5.17 93 TR_XM_COVIDMETA1 2864 0.74 3.14 0.40 94 RCVD_IN_PSBL 2804 0.39 3.08 0.01 95 HDRS_MISSP 2674 0.38 2.94 0.02 96 T_XMDrugObfuBody_14 2645 1.76 2.90 1.60 97 T_XMDrugObfuBody_08 2581 1.77 2.83 1.62 98 HTML_IMAGE_RATIO_06 2559 3.49 2.81 3.58 99 TR_XM_MaxSPIKE 2474 0.36 2.72 0.03 100 LongTLD 2465 0.50 2.71 0.19 101 XM_UB60 2406 0.40 2.64 0.09 102 HTML_IMAGE_RATIO_08 2402 2.21 2.64 2.15 103 TR_XM_PHPDW 2363 0.72 2.59 0.46 104 TR_XM_PHPForged 2358 0.69 2.59 0.43 105 TR_XM_FormFill2 2317 0.69 2.54 0.43 106 XM_H_PHPOS 2308 0.68 2.53 0.42 107 URIBL_SBL_A 2271 0.54 2.49 0.26 108 SUBJ_ALL_CAPS 2240 1.68 2.46 1.57 109 RCVD_IN_MSPIKE_L5 2224 0.35 2.44 0.06 110 XMSexyCombo_01 2179 0.76 2.39 0.54 111 XM_B_Unsub2 2165 4.79 2.38 5.13 112 PLING_QUERY 2152 0.52 2.36 0.27 113 BAYES_40 2144 3.95 2.35 4.17 114 XMBody_17 2135 0.97 2.34 0.78 115 XM_BadFromFormat 2081 0.38 2.28 0.11 116 DKIM_ADSP_NXDOMAIN 2039 0.49 2.24 0.24 117 XM_UB80 2028 0.31 2.23 0.04 118 XMDiploma_00 2000 1.88 2.20 1.84 119 URI_TRY_3LD 2000 1.24 2.20 1.11 120 INVALID_MSGID 1969 1.26 2.16 1.13 121 TR_Mismatch_TLD_02 1933 0.32 2.12 0.06 122 XM_CamelCaseFrm001 1930 1.78 2.12 1.73 123 XMSubjUTF8 1829 0.25 2.01 0.00 124 MAILING_LIST_MULTI 1821 2.03 2.00 2.04 125 URI_HEX 1814 1.51 1.99 1.44 126 MIME_HTML_ONLY_MULTI 1803 2.55 1.98 2.63 127 TM2_M_VERY_LONG_WORD 1795 1.14 1.97 1.02 128 XMStockSpam_06 1752 0.92 1.92 0.78 129 RELAYCOUNTRY_IN 1726 0.32 1.89 0.10 130 TR_XM_RelayPhish 1725 0.39 1.89 0.18 131 T_TooManySym_01 1712 3.42 1.88 3.64 132 DKIM_ADSP_CUSTOM_MED 1653 1.11 1.81 1.02 133 BAYES_20 1647 3.16 1.81 3.35 134 ALL_TRUSTED 1633 20.30 1.79 22.90 135 DIET_1 1616 0.47 1.77 0.29 136 T_XMDrugObfuBody_00 1605 4.31 1.76 4.67 137 HTML_IMAGE_ONLY_16 1573 0.37 1.73 0.18 138 TR_LOTS_OF_MONEY3 1521 0.89 1.67 0.78 139 NML_ADSP_CUSTOM_MED 1487 0.86 1.63 0.75 140 TR_XM_MaxBayes 1483 0.22 1.63 0.02 141 RELAYCOUNTRY_GB 1474 1.06 1.62 0.98 142 FORGED_GMAIL_RCVD 1467 0.62 1.61 0.48 143 XMSubNoVowel 1466 0.86 1.61 0.75 144 XMHTML_After_End 1430 1.02 1.57 0.95 145 RELAYCOUNTRY_DE 1427 0.62 1.57 0.49 146 XMSlimDrugH 1415 0.53 1.55 0.38 147 XM_XX_Yahoo 1394 0.23 1.53 0.05 148 TR_XM_DK_SendGrid 1394 2.81 1.53 2.98 149 XMGenDplmaNmb 1378 0.98 1.51 0.91 150 XMSexyCombo_04 1374 0.39 1.51 0.24 151 XMBrknScrpt_02 1349 0.81 1.48 0.72 152 DATE_IN_PAST_06_12 1340 0.33 1.47 0.17 153 HK_RANDOM_REPLYTO 1290 0.37 1.42 0.23 154 XM_PDF 1257 3.31 1.38 3.59 155 DATE_IN_PAST_03_06 1235 1.44 1.36 1.46 156 T_FILL_THIS_FORM_SHORT 1194 0.75 1.31 0.68 157 XMBody_78 1176 0.53 1.29 0.43 158 HTML_FONT_TINY_NORDNS 1173 0.43 1.29 0.31 159 XMSubMetaSxObfu_03 1137 0.54 1.25 0.44 160 TR_Mismatch_TLD_01 1137 0.32 1.25 0.19 161 DATE_IN_PAST_12_24 1129 0.22 1.24 0.07 162 HTML_SHORT_LINK_IMG_3 1106 0.20 1.21 0.06 163 T_XMHurry_00 1106 0.65 1.21 0.57 164 XM_UB95 1095 0.17 1.20 0.02 165 XM_HighProb1 1094 0.15 1.20 0.01 166 XM_H_Long_From02 1079 1.32 1.18 1.34 167 RELAYCOUNTRY_HU 1076 0.15 1.18 0.01 168 BAYES_00 1071 20.38 1.18 23.07 169 XM_H_MailChimp 1046 0.33 1.15 0.22 170 XMWghtMeta_00 1014 0.18 1.11 0.05 171 BAYES_05 1007 2.96 1.11 3.22 172 URIBL_BLACK 1003 0.16 1.10 0.03 173 MIME_CHARSET_FARAWAY 1001 0.23 1.10 0.11 174 TR_MetaPhish_Combo_01 979 0.84 1.07 0.80 175 URI_PHP_REDIR 973 0.13 1.07 0.00 176 XM_H_PHPMailer 969 0.55 1.06 0.48 177 XM_DK_Undo_01 939 1.43 1.03 1.48 178 T_MONEY_PERCENT 932 0.36 1.02 0.27 179 TR_LOTS_OF_MONEY2 932 0.36 1.02 0.27 180 HTML_IMAGE_ONLY_20 912 0.46 1.00 0.39 181 HELO_NO_DOMAIN 912 1.19 1.00 1.21 182 HELO_NODOT 912 1.19 1.00 1.21 183 XM_Body_Dirty_Words_01 903 0.14 0.99 0.02 184 XMMoneyMeta_00 899 0.63 0.99 0.58 185 XMSlimDrugs 897 0.16 0.98 0.04 186 HTML_SHORT_LINK_IMG_2 897 0.15 0.98 0.03 187 CHARSET_FARAWAY_HEADER 868 0.15 0.95 0.03 188 LOADSA_MONEY_COMBO 868 0.21 0.95 0.10 189 REMOVE_BEFORE_LINK 862 0.42 0.95 0.35 190 XM_H_Undi_Recip 858 0.33 0.94 0.25 191 SUBJECT_DIET 854 0.13 0.94 0.02 192 T_Symld_Words_02 853 0.59 0.94 0.54 193 TR_XM_COVIDMETA3 852 0.14 0.94 0.02 194 RDNS_DYNAMIC 846 0.36 0.93 0.28 195 XM_H_PHPOS_M 827 0.25 0.91 0.16 196 XMLngstWrd_00 823 0.47 0.90 0.41 197 XM_ProductURIs 822 0.70 0.90 0.67 198 RCVD_IN_IADB_LISTED 820 4.27 0.90 4.74 199 XMPhish14 809 0.57 0.89 0.52 200 XMSubMetaI_00 805 0.51 0.88 0.46 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 639387 98.15 97.26 98.28 2 HTML_MESSAGE 514713 80.78 92.68 79.12 3 RELAYCOUNTRY_US 478851 73.34 71.44 73.60 4 DKIM_SIGNED 449669 69.99 76.20 69.12 5 XM_DK_Pass 443622 68.45 70.32 68.19 6 DKIM_VALID 416087 62.97 55.96 63.96 7 XM_B_Unicode 399581 62.92 73.64 61.42 8 BAYES_50 312411 47.19 41.28 48.02 9 DKIM_VALID_AU 311123 46.78 39.31 47.82 10 XMListUnsubscribeExists 299450 48.77 68.39 46.03 11 XM_B_Unicode3 233802 36.49 40.44 35.94 12 DKIM_VALID_EF 164504 25.17 24.35 25.29 13 T_TM2_M_HEADER_IN_MSG 162313 24.15 18.40 24.95 14 HTML_FONT_LOW_CONTRAST 155977 24.59 28.99 23.98 15 RCVD_IN_MSPIKE_WL 152904 21.58 7.88 23.50 16 BAYES_00 150067 20.38 1.18 23.07 17 ALL_TRUSTED 148960 20.30 1.79 22.90 18 LOC_TINY_FONT_1 140795 23.04 33.04 21.64 19 RCVD_IN_MSPIKE_H2 137016 21.24 22.55 21.06 20 FVGT_m_MULTI_ODD 129951 21.06 28.83 19.97 21 XMSubLong 126196 19.85 23.11 19.40 22 MIME_HTML_ONLY 120260 20.13 31.89 18.49 23 T_KAM_HTML_FONT_INVALID 112638 17.73 20.67 17.31 24 XM_Multi_Part_URI 110903 17.08 17.33 17.05 25 TM2_M_URI_OPT_OUT 101527 14.17 3.90 15.61 26 ANY_BOUNCE_MESSAGE 98102 13.32 0.72 15.08 27 BOUNCE_MESSAGE 98099 13.31 0.71 15.08 28 RCVD_IN_MSPIKE_H3 87358 12.32 4.43 13.43 29 XM_B_Unsub 80398 12.33 12.10 12.36 30 XM_Body_Dirty_Words 78430 12.89 18.83 12.06 31 XM_DK_Undo_02 69642 15.34 48.41 10.70 32 RCVD_IN_MSPIKE_H4 56336 8.01 3.34 8.66 33 LotsOfNums_01 53078 8.17 8.28 8.16 34 TR_XM_DK_Bayes 51959 7.08 0.61 7.99 35 LOTS_OF_MONEY 51626 8.44 12.01 7.94 36 IN_ZIMBRA_NJ_WHITELIST 50881 6.86 0.03 7.82 37 XM_Evil_Numbers_Gen 49625 7.91 9.93 7.63 38 TR_XM_DK_Bayes1 48170 6.54 0.34 7.40 39 TooManyTo_001 47141 7.13 6.27 7.25 40 XM_B_Phish_Phrases 45902 7.52 10.82 7.06 41 BAYES_99 43189 9.96 33.70 6.64 42 TR_XM_DK_Bayes2 42175 5.72 0.25 6.48 43 RCVD_IN_RP_SAFE 40154 5.51 0.74 6.17 44 UNPARSEABLE_RELAY 40139 6.18 6.25 6.17 45 XM_DKIMWhitelistDomains 37386 5.04 0.01 5.75 46 XM_SendGrid 37366 5.55 4.18 5.74 47 HTML_IMAGE_RATIO_02 37023 6.97 16.13 5.69 48 BAYES_60 36489 5.77 6.96 5.61 49 RCVD_IN_RP_CERTIFIED 35706 4.85 0.29 5.49 50 BAYES_999 33870 7.82 26.48 5.21 51 MIME_QP_LONG_LINE 33613 4.92 3.15 5.17 52 DKIM_INVALID 33582 7.01 20.24 5.16 53 XM_B_Unsub2 33365 4.79 2.38 5.13 54 RELAYCOUNTRY_META 32703 7.91 28.53 5.03 55 HTML_IMAGE_RATIO_04 32578 5.00 4.98 5.01 56 RCVD_IN_IADB_LISTED 30835 4.27 0.90 4.74 57 XM_H_Long_From01 30714 4.91 6.27 4.72 58 BOTNET_IPINHOSTNAME 30713 6.41 18.44 4.72 59 XMStrtUSub 30649 4.55 3.37 4.71 60 T_XMDrugObfuBody_00 30357 4.31 1.76 4.67 61 MPART_ALT_DIFF 27331 4.85 9.46 4.20 62 BAYES_40 27128 3.95 2.35 4.17 63 RCVD_IN_IADB_SPF 27095 3.75 0.79 4.16 64 RCVD_IN_IADB_SENDERID 23915 3.32 0.75 3.68 65 BAYES_80 23906 4.16 7.62 3.67 66 RCVD_IN_IADB_DK 23773 3.30 0.75 3.65 67 T_TooManySym_01 23664 3.42 1.88 3.64 68 XMSexyCombo_05 23661 4.68 12.16 3.64 69 XM_PDF 23328 3.31 1.38 3.59 70 HTML_IMAGE_RATIO_06 23291 3.49 2.81 3.58 71 BAYES_20 21823 3.16 1.81 3.35 72 TR_XM_PhishingBody 21001 3.83 8.09 3.23 73 BAYES_05 20927 2.96 1.11 3.22 74 BOTNET 20796 7.09 34.86 3.20 75 XMSubMetaSx_00 20642 3.69 7.34 3.17 76 TR_XM_DK_SendGrid 19418 2.81 1.53 2.98 77 RCVD_IN_IADB_VOUCHED 19301 2.64 0.32 2.97 78 T_REMOTE_IMAGE 19085 3.19 5.00 2.93 79 XM_UncommonTLD01 18808 5.32 22.65 2.89 80 XMNumbers 18522 3.14 5.26 2.85 81 NO_DNS_FOR_FROM 18126 4.11 13.56 2.79 82 FROM_EXCESS_BASE64 17811 3.03 5.11 2.74 83 MIME_HTML_ONLY_MULTI 17108 2.55 1.98 2.63 84 HTML_MIME_NO_HTML_TAG 15256 2.64 4.79 2.34 85 BAYES_95 14626 2.46 3.97 2.25 86 XM_H_Trusted_IP 14583 1.97 0.00 2.24 87 HTML_IMAGE_RATIO_08 13962 2.21 2.64 2.15 88 MIME_HTML_MOSTLY 13700 2.76 7.40 2.11 89 MAILING_LIST_MULTI 13270 2.03 2.00 2.04 90 XM_B_COVIDMETA 12862 2.51 6.31 1.98 91 RCVD_IN_IADB_OPTIN 12125 1.67 0.30 1.86 92 XMDiploma_00 11946 1.88 2.20 1.84 93 XM_B_Phish66 11650 2.26 5.57 1.79 94 T_TooManySym_02 11604 1.64 0.60 1.78 95 XM_CamelCaseFrm001 11243 1.78 2.12 1.73 96 TooManyTo_002 10773 1.56 0.86 1.66 97 UNTRUSTED_Relay 10667 3.76 18.89 1.64 98 T_XMDrugObfuBody_08 10550 1.77 2.83 1.62 99 T_XMDrugObfuBody_14 10432 1.76 2.90 1.60 100 RELAYCOUNTRY_CA 10350 2.35 7.77 1.59 101 TR_Symld_Words 10264 1.82 3.58 1.58 102 SUBJ_ALL_CAPS 10232 1.68 2.46 1.57 103 KHOP_HELO_FCRDNS 9900 1.88 4.46 1.52 104 XM_DK_Undo_01 9630 1.43 1.03 1.48 105 XM_B_SpammyTLD 9519 2.18 7.34 1.46 106 DATE_IN_PAST_03_06 9474 1.44 1.36 1.46 107 URI_HEX 9378 1.51 1.99 1.44 108 RCVD_IN_MSPIKE_H5 9210 1.26 0.11 1.42 109 XM_SPF_SoftFail 9045 1.95 5.96 1.39 110 TVD_RCVD_IP 8995 1.26 0.39 1.38 111 RCVD_IN_BL_SPAMCOP_NET 8736 2.03 6.91 1.34 112 XM_H_Long_From02 8704 1.32 1.18 1.34 113 XM_OfRef6 8472 1.54 3.27 1.30 114 HELO_NODOT 7903 1.19 1.00 1.21 115 HELO_NO_DOMAIN 7902 1.19 1.00 1.21 116 IN_HORDE_ADDRESS_BOOK 7779 1.05 0.03 1.20 117 HELO_MISC_IP 7612 1.12 0.79 1.17 118 CK_HELO_DYNAMIC_SPLIT_IP 7593 1.11 0.68 1.17 119 INVALID_MSGID 7384 1.26 2.16 1.13 120 URI_TRY_3LD 7206 1.24 2.20 1.11 121 HTML_FONT_FACE_BAD 7101 1.03 0.56 1.09 122 XM_GoogleGroups 7083 1.02 0.51 1.09 123 TooManyTo_003 7027 1.03 0.63 1.08 124 XM_UB50 6692 1.83 7.54 1.03 125 TM2_M_VERY_LONG_WORD 6632 1.14 1.97 1.02 126 USER_IN_DEF_DKIM_WL 6628 0.89 0.01 1.02 127 DKIM_ADSP_CUSTOM_MED 6608 1.11 1.81 1.02 128 TO_MALFORMED 6493 0.88 0.00 1.00 129 SpammyFromTLD_01 6379 1.48 5.05 0.98 130 RELAYCOUNTRY_GB 6379 1.06 1.62 0.98 131 XMCapTrack 6211 0.90 0.55 0.95 132 XMHTML_After_End 6161 1.02 1.57 0.95 133 XMGenDplmaNmb 5891 0.98 1.51 0.91 134 TR_MSPIKEBAYES00 5575 0.75 0.01 0.86 135 TooManyTo_004 5251 0.78 0.55 0.81 136 TR_MetaPhish_Combo_01 5222 0.84 1.07 0.80 137 XMBdyGiftCard01 5158 0.79 0.76 0.79 138 TR_LOTS_OF_MONEY3 5095 0.89 1.67 0.78 139 XMBody_17 5057 0.97 2.34 0.78 140 XMStockSpam_06 5048 0.92 1.92 0.78 141 XMGappySubj_01 4982 0.74 0.57 0.77 142 XMSubNoVowel 4881 0.86 1.61 0.75 143 NML_ADSP_CUSTOM_MED 4860 0.86 1.63 0.75 144 XMBrknScrpt_02 4671 0.81 1.48 0.72 145 TooManyTo_005 4488 0.66 0.44 0.69 146 T_FILL_THIS_FORM_SHORT 4405 0.75 1.31 0.68 147 XM_ProductURIs 4376 0.70 0.90 0.67 148 T_OBFU_PDF_ATTACH 4188 0.60 0.28 0.64 149 TR_XM_COVIDMETA4 4160 1.23 5.47 0.64 150 HTTPS_HTTP_MISMATCH 4153 0.65 0.77 0.64 151 XM_DIRTYINTL 3948 1.14 4.91 0.61 152 XMMoneyMeta_00 3805 0.63 0.99 0.58 153 T_XMHurry_00 3697 0.65 1.21 0.57 154 XMBody_95 3600 0.50 0.09 0.55 155 T_Symld_Words_02 3512 0.59 0.94 0.54 156 FROM_GOV_DKIM_AU 3495 0.48 0.08 0.54 157 XMSexyCombo_01 3484 0.76 2.39 0.54 158 T_TooManySym_03 3413 0.48 0.16 0.52 159 XMPhish14 3401 0.57 0.89 0.52 160 XMPhish08 3253 0.55 0.88 0.50 161 TR_BOTNET_NEGATE 3209 0.48 0.41 0.49 162 RELAYCOUNTRY_DE 3156 0.62 1.57 0.49 163 FORGED_GMAIL_RCVD 3154 0.62 1.61 0.48 164 XM_H_PHPMailer 3137 0.55 1.06 0.48 165 XM_SPF_Unknown 3071 0.52 0.83 0.47 166 XMHTMLBadTable_001 3029 0.49 0.63 0.47 167 XMSubMetaI_00 2991 0.51 0.88 0.46 168 HTML_TAG_BALANCE_BODY 2985 0.51 0.86 0.46 169 TR_XM_PHPDW 2970 0.72 2.59 0.46 170 XMSubMetaSxObfu_03 2860 0.54 1.25 0.44 171 XM_B_REG_HTML 2814 0.41 0.21 0.43 172 TR_XM_FormFill2 2806 0.69 2.54 0.43 173 TR_XM_PHPForged 2783 0.69 2.59 0.43 174 XMBody_78 2766 0.53 1.29 0.43 175 XM_ShortIntro_01 2758 0.46 0.70 0.42 176 XM_H_PHPOS 2754 0.68 2.53 0.42 177 XMLngstWrd_00 2695 0.47 0.90 0.41 178 RELAYCOUNTRY_AU 2649 0.44 0.66 0.41 179 URI_OPTOUT_3LD 2642 0.38 0.23 0.41 180 XMPhish30 2633 0.46 0.88 0.40 181 RCVD_IN_SORBS_DUL 2612 0.40 0.41 0.40 182 TR_XM_COVIDMETA1 2589 0.74 3.14 0.40 183 RCVD_IN_MSPIKE_BL 2570 1.34 8.12 0.40 184 HTML_IMAGE_ONLY_20 2508 0.46 1.00 0.39 185 FROM_GOV_SPOOF 2489 0.37 0.27 0.38 186 XMSlimDrugH 2483 0.53 1.55 0.38 187 URI_NOVOWEL 2479 0.43 0.78 0.38 188 XM_B_COPY_HTML 2464 0.38 0.38 0.38 189 XMNoVowels 2438 0.42 0.70 0.37 190 MPART_ALT_DIFF_COUNT 2434 0.86 4.34 0.37 191 HTML_IMAGE_ONLY_28 2340 0.37 0.41 0.36 192 TM2_M_BODY_EMPTY 2284 0.32 0.09 0.35 193 REMOVE_BEFORE_LINK 2264 0.42 0.95 0.35 194 XMLngstWrd_01 2176 0.40 0.86 0.33 195 MISSING_HEADERS 2135 0.39 0.87 0.33 196 HTML_IMAGE_ONLY_32 2083 0.32 0.31 0.32 197 XM_Body_Obfu01 2056 0.35 0.58 0.32 198 TVD_SPACE_RATIO 2042 0.30 0.20 0.31 199 SpammyFromTLD_02 2031 1.68 11.44 0.31 200 SHORT_HELO_AND_INLINE_IMAGE 2003 0.28 0.09 0.31 ----------------------------------------------------------------------