Email: 746438 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 1.82 sec Spam: 102553 Autolearn: 0 AvgScore: 13.80 AvgScanTime: 3.61 sec Ham: 643885 Autolearn: 0 AvgScore: -1.79 AvgScanTime: 1.54 sec Time Spent Running SA: 377.46 hours Time Spent Processing Spam: 102.80 hours Time Spent Processing Ham: 274.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 99801 98.27 97.32 98.43 2 HTML_MESSAGE 94724 81.93 92.37 80.26 3 RELAYCOUNTRY_US 70108 70.98 68.36 71.40 4 DKIM_SIGNED 68113 65.43 66.42 65.27 5 XM_B_Unicode 67475 63.96 65.80 63.66 6 XM_DK_Pass 64244 64.05 62.64 64.27 7 XMListUnsubscribeExists 62500 46.11 60.94 43.75 8 DKIM_VALID 51816 58.97 50.53 60.32 9 XM_DK_Undo_02 46070 14.89 44.92 10.10 10 BOTNET 40903 7.89 39.88 2.79 11 MIME_HTML_ONLY 39392 21.53 38.41 18.84 12 BAYES_50 38925 47.12 37.96 48.58 13 DKIM_VALID_AU 37848 44.42 36.91 45.61 14 XM_B_Unicode3 35931 34.45 35.04 34.36 15 BAYES_99 34891 10.24 34.02 6.45 16 RELAYCOUNTRY_META 32453 8.61 31.65 4.94 17 LOC_TINY_FONT_1 28476 24.68 27.77 24.19 18 XM_UncommonTLD01 27474 5.99 26.79 2.68 19 BAYES_999 27168 8.02 26.49 5.08 20 FVGT_m_MULTI_ODD 25293 22.61 24.66 22.28 21 HTML_FONT_LOW_CONTRAST 24520 23.84 23.91 23.83 22 DKIM_VALID_EF 23632 23.51 23.04 23.59 23 XMSubLong 22453 21.65 21.89 21.61 24 RCVD_IN_MSPIKE_H2 20715 21.00 20.20 21.12 25 T_TM2_M_HEADER_IN_MSG 20201 25.12 19.70 25.98 26 UNTRUSTED_Relay 20176 4.17 19.67 1.70 27 BOTNET_IPINHOSTNAME 19955 6.40 19.46 4.32 28 T_KAM_HTML_FONT_INVALID 17782 16.05 17.34 15.85 29 XM_Body_Dirty_Words 17209 12.33 16.78 11.62 30 SpammyFromTLD_02 16588 2.41 16.18 0.22 31 FROM_SUSPICIOUS_NTLD 16396 2.23 15.99 0.04 32 FROM_SUSPICIOUS_NTLD_FP 16297 2.21 15.89 0.03 33 DKIM_INVALID 16297 6.46 15.89 4.95 34 XM_Multi_Part_URI 15136 15.41 14.76 15.52 35 HTML_IMAGE_RATIO_02 13624 7.26 13.28 6.30 36 NO_DNS_FOR_FROM 13426 4.15 13.09 2.73 37 FROM_EXCESS_BASE64 13027 3.65 12.70 2.20 38 T_REMOTE_IMAGE 12717 4.41 12.40 3.13 39 HTML_MIME_NO_HTML_TAG 12672 3.45 12.36 2.03 40 XM_B_Unsub 12089 10.66 11.79 10.48 41 BOTNET_NORDNS 11679 1.58 11.39 0.02 42 XMSexyCombo_05 11453 4.40 11.17 3.32 43 XM_B_Phish_Phrases 11144 7.76 10.87 7.26 44 LOTS_OF_MONEY 10744 7.28 10.48 6.77 45 HDRS_MISSP 10532 1.43 10.27 0.02 46 DKIM_ADSP_NXDOMAIN 9773 1.52 9.53 0.25 47 BAYES_60 9677 6.19 9.44 5.67 48 BODY_URI_ONLY 9628 1.32 9.39 0.04 49 RCVD_IN_MSPIKE_BL 9401 1.73 9.17 0.55 50 HTML_TAG_BALANCE_CENTER 9325 1.37 9.09 0.14 51 XM_Evil_Numbers_Gen 9299 7.99 9.07 7.82 52 BAYES_80 8749 4.46 8.53 3.81 53 PDS_OTHER_BAD_TLD 8166 1.21 7.96 0.13 54 XM_UB50 7803 1.95 7.61 1.05 55 TR_XM_PhishingBody 7802 3.63 7.61 2.99 56 RELAYCOUNTRY_CA 7603 2.44 7.41 1.64 57 LotsOfNums_01 7496 7.28 7.31 7.27 58 RCVD_IN_MSPIKE_WL 7444 20.01 7.26 22.04 59 RCVD_IN_BL_SPAMCOP_NET 6922 1.91 6.75 1.14 60 RCVD_IN_RP_RNBL 6805 0.97 6.64 0.07 61 XMSubMetaSx_00 6777 3.54 6.61 3.06 62 XM_B_SpammyTLD 6742 2.01 6.57 1.29 63 XMNumbers 6622 3.19 6.46 2.67 64 UNPARSEABLE_RELAY 6447 6.16 6.29 6.14 65 TR_XM_COVIDMETA4 6252 1.40 6.10 0.65 66 MPART_ALT_DIFF 6247 5.41 6.09 5.30 67 XM_SPF_SoftFail 6195 2.15 6.04 1.53 68 XM_B_COVIDMETA 6119 2.11 5.97 1.50 69 XM_H_Long_From01 5655 4.91 5.51 4.81 70 XM_B_Phish66 5426 2.15 5.29 1.65 71 TooManyTo_001 5221 7.11 5.09 7.43 72 RCVD_IN_MSPIKE_L3 5160 1.02 5.03 0.38 73 XM_DIRTYINTL 5132 1.14 5.00 0.53 74 XM_SendGrid 4825 5.52 4.70 5.65 75 SpammyFromTLD_01 4820 1.30 4.70 0.76 76 MIME_HTML_MOSTLY 4629 2.32 4.51 1.97 77 XMHTML_After_End 4555 1.41 4.44 0.93 78 SCRIPT_GIBBERISH 4452 0.60 4.34 0.00 79 KHOP_HELO_FCRDNS 4438 1.95 4.33 1.58 80 TR_XM_INV_DKIM 4345 0.71 4.24 0.14 81 BAYES_95 4199 2.51 4.09 2.26 82 RCVD_IN_MSPIKE_H3 4148 11.20 4.04 12.33 83 XMMoneyMeta_00 4017 1.01 3.92 0.55 84 RELAYCOUNTRY_GB 3982 1.29 3.88 0.88 85 XM_UB99 3879 0.53 3.78 0.01 86 HTML_IMAGE_RATIO_04 3844 4.48 3.75 4.60 87 RELAYCOUNTRY_FR 3748 0.73 3.65 0.26 88 TM2_M_URI_OPT_OUT 3693 13.30 3.60 14.84 89 SUBJ_ALL_CAPS 3658 1.75 3.57 1.46 90 URIBL_SBL_A 3534 0.65 3.45 0.20 91 T_XMDrugObfuBody_08 3494 1.64 3.41 1.36 92 XMBody_17 3464 1.31 3.38 0.98 93 TR_XM_PHPDW 3463 0.87 3.38 0.47 94 TR_XM_PHPForged 3454 0.85 3.37 0.45 95 TR_XM_FormFill2 3429 0.84 3.34 0.45 96 XM_H_PHPOS 3414 0.84 3.33 0.44 97 XMStrtUSub 3391 3.98 3.31 4.08 98 XM_OfRef6 3353 1.45 3.27 1.16 99 XM_URI_RBL 3290 0.63 3.21 0.22 100 TR_XM_MaxSPIKE 3205 0.47 3.13 0.05 101 TR_XM_MaxWHORU 3203 0.47 3.12 0.05 102 RCVD_IN_PSBL 3196 0.45 3.12 0.02 103 RCVD_IN_MSPIKE_H4 3181 7.70 3.10 8.43 104 XM_UB60 3151 0.51 3.07 0.10 105 RCVD_IN_MSPIKE_L5 3128 0.51 3.05 0.11 106 HDRS_LCASE_IMGONLY 3055 0.42 2.98 0.01 107 MIME_HEADER_CTYPE_ONLY 3006 0.63 2.93 0.27 108 HTML_SHORT_LINK_IMG_1 2965 0.41 2.89 0.01 109 TR_XM_MaxBayes 2949 0.41 2.88 0.02 110 SHORT_IMG_SUSP_NTLD 2909 0.39 2.84 0.00 111 MPART_ALT_DIFF_COUNT 2887 0.63 2.82 0.29 112 LongTLD 2864 0.51 2.79 0.14 113 XMSubNoVowel 2859 1.66 2.79 1.48 114 XM_UB999 2785 0.38 2.72 0.01 115 REPLYTO_WITHOUT_TO_CC 2733 0.42 2.66 0.06 116 T_XMDrugObfuBody_14 2678 1.54 2.61 1.37 117 TR_XM_UnparsRelay 2654 0.56 2.59 0.23 118 MIME_QP_LONG_LINE 2636 4.30 2.57 4.57 119 XM_CamelCaseFrm001 2508 1.79 2.45 1.69 120 T_TooManySym_01 2478 3.35 2.42 3.50 121 RELAYCOUNTRY_DE 2472 0.77 2.41 0.51 122 HTML_IMAGE_RATIO_06 2466 3.02 2.40 3.12 123 XM_UB80 2415 0.36 2.35 0.04 124 HTML_IMAGE_ONLY_08 2395 0.41 2.34 0.10 125 TR_XM_COVIDMETA1 2361 0.64 2.30 0.38 126 T_XMDrugObfuBody_00 2338 2.82 2.28 2.90 127 XMBrknScrpt_02 2305 0.98 2.25 0.77 128 XM_BadFromFormat 2280 0.42 2.22 0.13 129 BAYES_40 2279 3.89 2.22 4.16 130 NORDNS_LOW_CONTRAST 2259 0.31 2.20 0.01 131 XM_JunkDunk 2256 0.30 2.20 0.00 132 XMSexyCombo_01 2222 0.92 2.17 0.72 133 HK_SCAM 2176 0.31 2.12 0.02 134 XMDiploma_00 2091 1.68 2.04 1.62 135 HTML_TITLE_SUBJ_DIFF 2071 0.31 2.02 0.04 136 URI_TRY_3LD 2069 1.26 2.02 1.14 137 ALL_TRUSTED 2038 21.95 1.99 25.13 138 FVGT_m_MULTI_ODD_EMAIL 2022 0.30 1.97 0.03 139 TR_XM_DK_SendGrid 2011 2.90 1.96 3.05 140 XM_B_Unsub2 1990 2.97 1.94 3.13 141 HTML_IMAGE_ONLY_16 1973 0.49 1.92 0.26 142 URI_PHP_REDIR 1937 0.28 1.89 0.02 143 TR_Symld_Words 1933 1.45 1.88 1.38 144 TM2_M_VERY_LONG_WORD 1918 1.09 1.87 0.96 145 DKIM_ADSP_CUSTOM_MED 1916 1.08 1.87 0.96 146 RDNS_DYNAMIC 1908 0.51 1.86 0.29 147 NUMERIC_HTTP_ADDR 1807 0.45 1.76 0.24 148 RELAYCOUNTRY_IT 1783 0.28 1.74 0.04 149 MIME_HTML_ONLY_MULTI 1718 3.50 1.68 3.79 150 BAYES_20 1697 3.20 1.65 3.44 151 HTML_IMAGE_RATIO_08 1691 1.87 1.65 1.91 152 TR_XM_RelayPhish 1686 0.39 1.64 0.19 153 DATE_IN_PAST_03_06 1680 0.32 1.64 0.11 154 URI_HEX 1674 1.38 1.63 1.34 155 NML_ADSP_CUSTOM_MED 1668 0.82 1.63 0.69 156 XMSubEmpty 1662 0.41 1.62 0.21 157 NORMAL_HTTP_TO_IP 1645 0.26 1.60 0.04 158 XM_XX_Yahoo 1606 0.28 1.57 0.08 159 TR_LOTS_OF_MONEY3 1600 0.89 1.56 0.79 160 TR_Mismatch_TLD_02 1499 0.27 1.46 0.08 161 MAILING_LIST_MULTI 1431 1.89 1.40 1.97 162 MISSING_HEADERS 1412 0.55 1.38 0.41 163 XM_PDF 1394 3.25 1.36 3.55 164 FORGED_GMAIL_RCVD 1380 0.55 1.35 0.42 165 XMSubMetaSxObfu_03 1319 0.49 1.29 0.36 166 FILL_THIS_FORM 1301 0.34 1.27 0.19 167 HTML_IMAGE_ONLY_20 1299 0.58 1.27 0.47 168 BAYES_00 1284 19.51 1.25 22.42 169 XMStockSpam_06 1263 0.99 1.23 0.95 170 T_XMHurry_00 1260 0.56 1.23 0.45 171 T_Symld_Words_02 1252 0.59 1.22 0.49 172 XMGenDplmaNmb 1246 0.96 1.21 0.92 173 TR_Mismatch_TLD_01 1203 0.32 1.17 0.18 174 RELAYCOUNTRY_CZ 1174 0.17 1.14 0.01 175 RELAYCOUNTRY_RU 1156 0.17 1.13 0.02 176 XMBody_78 1144 0.54 1.12 0.45 177 T_TVD_MIME_NO_HEADERS 1129 0.16 1.10 0.01 178 XM_OfRef7 1126 0.25 1.10 0.11 179 XM_HighProb1 1123 0.16 1.10 0.01 180 XM_UB95 1106 0.17 1.08 0.02 181 T_FILL_THIS_FORM_SHORT 1102 0.73 1.07 0.68 182 MIME_CHARSET_FARAWAY 1100 0.27 1.07 0.14 183 URIBL_DBL_SPAM 1086 0.15 1.06 0.01 184 RELAYCOUNTRY_IN 1083 0.23 1.06 0.10 185 HTML_FONT_SIZE_HUGE 1061 2.94 1.03 3.24 186 XMSexyCombo_04 1050 0.27 1.02 0.15 187 CTYPE_NULL 1032 0.14 1.01 0.00 188 TR_MetaPhish_Combo_01 1025 0.65 1.00 0.59 189 RELAYCOUNTRY_JP 1022 0.16 1.00 0.03 190 ANY_BOUNCE_MESSAGE 1019 11.84 0.99 13.56 191 BOUNCE_MESSAGE 1015 11.84 0.99 13.56 192 HELO_NODOT 1012 1.29 0.99 1.34 193 HELO_NO_DOMAIN 1006 1.29 0.98 1.34 194 CHARSET_FARAWAY_HEADER 1005 0.17 0.98 0.04 195 HK_RANDOM_FROM 997 0.23 0.97 0.12 196 HTML_SHORT_LINK_IMG_3 971 0.21 0.95 0.09 197 DATE_IN_PAST_06_12 967 0.27 0.94 0.16 198 SUBJ_OBFU_PUNCT_FEW 959 0.17 0.94 0.04 199 DIET_1 955 0.39 0.93 0.30 200 XMSubMetaSx_01 954 0.20 0.93 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 633744 98.27 97.32 98.43 2 HTML_MESSAGE 516803 81.93 92.37 80.26 3 RELAYCOUNTRY_US 459734 70.98 68.36 71.40 4 DKIM_SIGNED 420266 65.43 66.42 65.27 5 XM_DK_Pass 413846 64.05 62.64 64.27 6 XM_B_Unicode 409915 63.96 65.80 63.66 7 DKIM_VALID 388363 58.97 50.53 60.32 8 BAYES_50 312815 47.12 37.96 48.58 9 DKIM_VALID_AU 293708 44.42 36.91 45.61 10 XMListUnsubscribeExists 281710 46.11 60.94 43.75 11 XM_B_Unicode3 221248 34.45 35.04 34.36 12 T_TM2_M_HEADER_IN_MSG 167303 25.12 19.70 25.98 13 ALL_TRUSTED 161806 21.95 1.99 25.13 14 LOC_TINY_FONT_1 155772 24.68 27.77 24.19 15 HTML_FONT_LOW_CONTRAST 153420 23.84 23.91 23.83 16 DKIM_VALID_EF 151869 23.51 23.04 23.59 17 BAYES_00 144379 19.51 1.25 22.42 18 FVGT_m_MULTI_ODD 143475 22.61 24.66 22.28 19 RCVD_IN_MSPIKE_WL 141903 20.01 7.26 22.04 20 XMSubLong 139137 21.65 21.89 21.61 21 RCVD_IN_MSPIKE_H2 136008 21.00 20.20 21.12 22 MIME_HTML_ONLY 121320 21.53 38.41 18.84 23 T_KAM_HTML_FONT_INVALID 102030 16.05 17.34 15.85 24 XM_Multi_Part_URI 99918 15.41 14.76 15.52 25 TM2_M_URI_OPT_OUT 95580 13.30 3.60 14.84 26 ANY_BOUNCE_MESSAGE 87338 11.84 0.99 13.56 27 BOUNCE_MESSAGE 87337 11.84 0.99 13.56 28 RCVD_IN_MSPIKE_H3 79417 11.20 4.04 12.33 29 XM_Body_Dirty_Words 74841 12.33 16.78 11.62 30 XM_B_Unsub 67477 10.66 11.79 10.48 31 XM_DK_Undo_02 65049 14.89 44.92 10.10 32 RCVD_IN_MSPIKE_H4 54268 7.70 3.10 8.43 33 XM_Evil_Numbers_Gen 50320 7.99 9.07 7.82 34 TooManyTo_001 47816 7.11 5.09 7.43 35 LotsOfNums_01 46837 7.28 7.31 7.27 36 XM_B_Phish_Phrases 46746 7.76 10.87 7.26 37 TR_XM_DK_Bayes 46611 6.30 0.42 7.24 38 LOTS_OF_MONEY 43565 7.28 10.48 6.77 39 TR_XM_DK_Bayes1 43183 5.82 0.24 6.71 40 XM_DKIMWhitelistDomains 41877 5.61 0.01 6.50 41 BAYES_99 41526 10.24 34.02 6.45 42 HTML_IMAGE_RATIO_02 40587 7.26 13.28 6.30 43 RCVD_IN_RP_SAFE 40042 5.46 0.67 6.22 44 UNPARSEABLE_RELAY 39549 6.16 6.29 6.14 45 TR_XM_DK_Bayes2 37837 5.10 0.20 5.88 46 BAYES_60 36513 6.19 9.44 5.67 47 XM_SendGrid 36397 5.52 4.70 5.65 48 RCVD_IN_RP_CERTIFIED 36275 4.91 0.35 5.63 49 IN_ZIMBRA_NJ_WHITELIST 36200 4.86 0.05 5.62 50 MPART_ALT_DIFF 34109 5.41 6.09 5.30 51 BAYES_999 32717 8.02 26.49 5.08 52 DKIM_INVALID 31903 6.46 15.89 4.95 53 RELAYCOUNTRY_META 31840 8.61 31.65 4.94 54 XM_H_Long_From01 30994 4.91 5.51 4.81 55 HTML_IMAGE_RATIO_04 29616 4.48 3.75 4.60 56 MIME_QP_LONG_LINE 29443 4.30 2.57 4.57 57 BOTNET_IPINHOSTNAME 27791 6.40 19.46 4.32 58 BAYES_40 26755 3.89 2.22 4.16 59 XMStrtUSub 26287 3.98 3.31 4.08 60 RCVD_IN_IADB_LISTED 26057 3.60 0.80 4.05 61 BAYES_80 24540 4.46 8.53 3.81 62 MIME_HTML_ONLY_MULTI 24415 3.50 1.68 3.79 63 XM_H_Trusted_IP 23792 3.19 0.00 3.70 64 XM_PDF 22890 3.25 1.36 3.55 65 RCVD_IN_IADB_SPF 22768 3.15 0.73 3.54 66 T_TooManySym_01 22518 3.35 2.42 3.50 67 BAYES_20 22179 3.20 1.65 3.44 68 XMSexyCombo_05 21406 4.40 11.17 3.32 69 HTML_FONT_SIZE_HUGE 20892 2.94 1.03 3.24 70 BAYES_05 20643 2.88 0.83 3.21 71 XM_B_Unsub2 20180 2.97 1.94 3.13 72 T_REMOTE_IMAGE 20168 4.41 12.40 3.13 73 RCVD_IN_IADB_SENDERID 20147 2.80 0.71 3.13 74 HTML_IMAGE_RATIO_06 20077 3.02 2.40 3.12 75 RCVD_IN_IADB_DK 19872 2.76 0.71 3.09 76 XMSubMetaSx_00 19682 3.54 6.61 3.06 77 TR_XM_DK_SendGrid 19651 2.90 1.96 3.05 78 TR_XM_PhishingBody 19276 3.63 7.61 2.99 79 T_XMDrugObfuBody_00 18688 2.82 2.28 2.90 80 BOTNET 17984 7.89 39.88 2.79 81 NO_DNS_FOR_FROM 17581 4.15 13.09 2.73 82 XM_UncommonTLD01 17226 5.99 26.79 2.68 83 XMNumbers 17202 3.19 6.46 2.67 84 RCVD_IN_IADB_VOUCHED 16310 2.21 0.19 2.53 85 BAYES_95 14520 2.51 4.09 2.26 86 FROM_EXCESS_BASE64 14188 3.65 12.70 2.20 87 HTML_MIME_NO_HTML_TAG 13097 3.45 12.36 2.03 88 MIME_HTML_MOSTLY 12670 2.32 4.51 1.97 89 MAILING_LIST_MULTI 12656 1.89 1.40 1.97 90 HTML_IMAGE_RATIO_08 12294 1.87 1.65 1.91 91 TooManyTo_002 12179 1.74 0.78 1.89 92 T_TooManySym_02 11363 1.61 0.65 1.76 93 UNTRUSTED_Relay 10941 4.17 19.67 1.70 94 XM_CamelCaseFrm001 10873 1.79 2.45 1.69 95 XM_B_Phish66 10618 2.15 5.29 1.65 96 RELAYCOUNTRY_CA 10589 2.44 7.41 1.64 97 XMDiploma_00 10440 1.68 2.04 1.62 98 KHOP_HELO_FCRDNS 10143 1.95 4.33 1.58 99 RCVD_IN_IADB_OPTIN 9908 1.35 0.19 1.54 100 XM_SPF_SoftFail 9871 2.15 6.04 1.53 101 XM_B_COVIDMETA 9628 2.11 5.97 1.50 102 XMSubNoVowel 9507 1.66 2.79 1.48 103 SUBJ_ALL_CAPS 9376 1.75 3.57 1.46 104 TVD_RCVD_IP 9316 1.33 0.63 1.45 105 TR_Symld_Words 8867 1.45 1.88 1.38 106 T_XMDrugObfuBody_14 8830 1.54 2.61 1.37 107 T_XMDrugObfuBody_08 8749 1.64 3.41 1.36 108 XM_DK_Undo_01 8634 1.27 0.86 1.34 109 URI_HEX 8628 1.38 1.63 1.34 110 HELO_NODOT 8607 1.29 0.99 1.34 111 HELO_NO_DOMAIN 8604 1.29 0.98 1.34 112 XM_B_SpammyTLD 8274 2.01 6.57 1.29 113 RCVD_IN_MSPIKE_H5 8218 1.12 0.11 1.28 114 TooManyTo_003 8160 1.17 0.58 1.27 115 HELO_MISC_IP 7676 1.12 0.68 1.19 116 CK_HELO_DYNAMIC_SPLIT_IP 7669 1.15 0.92 1.19 117 XM_OfRef6 7467 1.45 3.27 1.16 118 IN_HORDE_ADDRESS_BOOK 7454 1.02 0.14 1.16 119 RCVD_IN_BL_SPAMCOP_NET 7332 1.91 6.75 1.14 120 URI_TRY_3LD 7331 1.26 2.02 1.14 121 INVALID_MSGID 7325 1.01 0.21 1.14 122 XM_GoogleGroups 7150 1.03 0.49 1.11 123 XMCapTrack 6968 1.02 0.64 1.08 124 XM_UB50 6768 1.95 7.61 1.05 125 TO_MALFORMED 6490 0.87 0.01 1.01 126 USER_IN_DEF_DKIM_WL 6374 0.85 0.01 0.99 127 XMBody_17 6318 1.31 3.38 0.98 128 TM2_M_VERY_LONG_WORD 6191 1.09 1.87 0.96 129 DKIM_ADSP_CUSTOM_MED 6168 1.08 1.87 0.96 130 XMStockSpam_06 6138 0.99 1.23 0.95 131 TooManyTo_004 6094 0.89 0.51 0.95 132 XMHTML_After_End 5996 1.41 4.44 0.93 133 XMGenDplmaNmb 5899 0.96 1.21 0.92 134 XM_H_Long_From02 5858 0.89 0.73 0.91 135 RELAYCOUNTRY_GB 5646 1.29 3.88 0.88 136 HTML_FONT_FACE_BAD 5431 0.79 0.48 0.84 137 XMBdyGiftCard01 5097 0.78 0.70 0.79 138 TR_LOTS_OF_MONEY3 5077 0.89 1.56 0.79 139 TooManyTo_005 5059 0.74 0.43 0.79 140 XMBrknScrpt_02 4989 0.98 2.25 0.77 141 SpammyFromTLD_01 4885 1.30 4.70 0.76 142 XM_ProductURIs 4809 0.75 0.77 0.75 143 XMSexyCombo_01 4666 0.92 2.17 0.72 144 NML_ADSP_CUSTOM_MED 4436 0.82 1.63 0.69 145 XMGappySubj_01 4407 0.71 0.86 0.68 146 XM_E_Blogspot 4360 0.60 0.11 0.68 147 T_FILL_THIS_FORM_SHORT 4352 0.73 1.07 0.68 148 XMBody_95 4257 0.59 0.12 0.66 149 TR_LOTS_OF_MONEY2 4214 0.68 0.87 0.65 150 T_MONEY_PERCENT 4214 0.68 0.87 0.65 151 TR_XM_COVIDMETA4 4184 1.40 6.10 0.65 152 XMSubMetaI_00 4013 0.64 0.76 0.62 153 TR_MSPIKEBAYES00 3965 0.53 0.00 0.62 154 TR_MetaPhish_Combo_01 3824 0.65 1.00 0.59 155 HTTPS_HTTP_MISMATCH 3767 0.59 0.63 0.59 156 T_OBFU_PDF_ATTACH 3754 0.54 0.28 0.58 157 XM_SPF_Unknown 3749 0.60 0.68 0.58 158 XMPhish08 3613 0.60 0.87 0.56 159 XMNoVowels 3561 0.59 0.79 0.55 160 RCVD_IN_MSPIKE_BL 3540 1.73 9.17 0.55 161 XMMoneyMeta_00 3521 1.01 3.92 0.55 162 T_TooManySym_03 3485 0.49 0.17 0.54 163 XM_DIRTYINTL 3390 1.14 5.00 0.53 164 RELAYCOUNTRY_DE 3256 0.77 2.41 0.51 165 T_Symld_Words_02 3130 0.59 1.22 0.49 166 XM_H_PHPMailer 3064 0.53 0.87 0.48 167 HTML_IMAGE_ONLY_20 3034 0.58 1.27 0.47 168 TR_XM_PHPDW 3026 0.87 3.38 0.47 169 XM_ShortIntro_01 2951 0.49 0.70 0.46 170 T_XMHurry_00 2921 0.56 1.23 0.45 171 XMBody_78 2916 0.54 1.12 0.45 172 TR_XM_PHPForged 2908 0.85 3.37 0.45 173 TR_XM_FormFill2 2878 0.84 3.34 0.45 174 XM_H_PHPOS 2849 0.84 3.33 0.44 175 XMDateMe_00 2847 0.43 0.37 0.44 176 THIS_AD 2784 0.42 0.32 0.43 177 TM2_M_BODY_EMPTY 2771 0.39 0.11 0.43 178 FORGED_GMAIL_RCVD 2701 0.55 1.35 0.42 179 XMPhish14 2678 0.45 0.67 0.42 180 MISSING_HEADERS 2666 0.55 1.38 0.41 181 TR_BOTNET_NEGATE 2654 0.41 0.38 0.41 182 HTML_TAG_BALANCE_BODY 2642 0.42 0.48 0.41 183 XM_B_REG_HTML 2547 0.36 0.14 0.40 184 RCVD_IN_SORBS_DUL 2525 0.37 0.25 0.39 185 URI_OPTOUT_3LD 2506 0.41 0.51 0.39 186 XM_B_COPY_HTML 2491 0.38 0.34 0.39 187 FROM_GOV_DKIM_AU 2456 0.34 0.08 0.38 188 TR_XM_COVIDMETA1 2446 0.64 2.30 0.38 189 RCVD_IN_MSPIKE_L3 2432 1.02 5.03 0.38 190 FROM_GOV_SPOOF 2431 0.37 0.29 0.38 191 PLING_QUERY 2365 0.40 0.57 0.37 192 XMSubMetaSxObfu_03 2307 0.49 1.29 0.36 193 HTML_IMAGE_ONLY_32 2295 0.33 0.20 0.36 194 RELAYCOUNTRY_AU 2231 0.36 0.43 0.35 195 URI_NOVOWEL 2203 0.37 0.51 0.34 196 XMPhish30 2194 0.41 0.84 0.34 197 XMHTMLBadTable_001 2181 0.33 0.29 0.34 198 SHORT_HELO_AND_INLINE_IMAGE 2166 0.30 0.09 0.34 199 HTML_IMAGE_ONLY_28 2131 0.32 0.26 0.33 200 TM2_M_A_HREF_HREF 1956 0.35 0.64 0.30 ----------------------------------------------------------------------