Email: 824320 Autolearn: 0 AvgScore: 0.23 AvgScanTime: 1.97 sec Spam: 108903 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 4.30 sec Ham: 715417 Autolearn: 0 AvgScore: -1.65 AvgScanTime: 1.62 sec Time Spent Running SA: 452.16 hours Time Spent Processing Spam: 130.04 hours Time Spent Processing Ham: 322.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106824 98.40 98.09 98.45 2 HTML_MESSAGE 100765 76.51 92.53 74.07 3 DKIM_SIGNED 82923 66.11 76.14 64.59 4 XM_DK_Pass 79551 64.75 73.05 63.49 5 RELAYCOUNTRY_US 78492 69.75 72.08 69.40 6 XM_B_Unicode 75985 60.27 69.77 58.82 7 XMListUnsubscribeExists 66322 46.62 60.90 44.44 8 DKIM_VALID 63952 59.44 58.72 59.55 9 XM_DK_Undo_02 55419 16.16 50.89 10.88 10 DKIM_VALID_AU 47531 44.28 43.65 44.38 11 BAYES_99 42996 11.07 39.48 6.74 12 BAYES_50 40594 43.17 37.28 44.06 13 XM_B_Unicode3 38432 33.92 35.29 33.71 14 FVGT_m_MULTI_ODD 34457 20.44 31.64 18.74 15 BAYES_999 34375 8.84 31.56 5.38 16 MIME_HTML_ONLY 33876 19.11 31.11 17.29 17 LOC_TINY_FONT_1 33261 21.33 30.54 19.93 18 BOTNET 31710 6.56 29.12 3.12 19 RELAYCOUNTRY_META 30572 7.78 28.07 4.69 20 DKIM_VALID_EF 29370 23.13 26.97 22.54 21 T_TM2_M_HEADER_IN_MSG 28393 24.42 26.07 24.17 22 LOTS_OF_MONEY 28209 9.65 25.90 7.17 23 RCVD_IN_MSPIKE_H2 27643 20.50 25.38 19.75 24 HTML_FONT_LOW_CONTRAST 26159 23.00 24.02 22.85 25 XMSubLong 24051 18.11 22.08 17.50 26 XM_Multi_Part_URI 23660 18.83 21.73 18.39 27 T_KAM_HTML_FONT_INVALID 22312 16.74 20.49 16.17 28 UNTRUSTED_Relay 21077 4.10 19.35 1.78 29 XM_Body_Dirty_Words 19221 11.89 17.65 11.01 30 DKIM_INVALID 18971 6.68 17.42 5.04 31 XM_UncommonTLD01 16551 4.18 15.20 2.51 32 BOTNET_IPINHOSTNAME 15632 5.75 14.35 4.44 33 NO_DNS_FOR_FROM 14747 4.45 13.54 3.06 34 XMBody_17 13245 2.21 12.16 0.70 35 XM_B_Unsub 12809 9.74 11.76 9.44 36 TR_LOTS_OF_MONEY3 12336 2.38 11.33 1.02 37 LotsOfNums_01 12153 8.19 11.16 7.73 38 RCVD_IN_MSPIKE_BL 11787 1.99 10.82 0.65 39 XM_B_Phish_Phrases 11247 7.27 10.33 6.80 40 XMSexyCombo_05 10861 4.18 9.97 3.30 41 RCVD_IN_MSPIKE_WL 9884 20.74 9.08 22.51 42 TR_XM_PhishingBody 9882 3.43 9.07 2.57 43 XM_Evil_Numbers_Gen 9081 7.55 8.34 7.43 44 HTML_MIME_NO_HTML_TAG 9053 2.50 8.31 1.62 45 HTML_IMAGE_RATIO_02 8608 5.84 7.90 5.52 46 BAYES_80 8598 4.38 7.90 3.85 47 RCVD_IN_BL_SPAMCOP_NET 8520 2.34 7.82 1.50 48 MPART_ALT_DIFF 8177 4.52 7.51 4.07 49 SUBJ_ALL_CAPS 8125 2.21 7.46 1.41 50 RELAYCOUNTRY_CA 8095 2.43 7.43 1.67 51 XM_UB50 7800 1.70 7.16 0.87 52 XMBrknScrpt_02 7694 1.81 7.07 1.01 53 XM_B_Phish66 7448 2.28 6.84 1.59 54 BOTNET_NORDNS 6900 0.86 6.34 0.03 55 XMSubMetaSx_00 6837 3.92 6.28 3.56 56 UNPARSEABLE_RELAY 6412 6.07 5.89 6.09 57 BAYES_60 6301 5.76 5.79 5.75 58 TR_XM_INV_DKIM 6162 0.90 5.66 0.18 59 HTML_IMAGE_RATIO_04 6118 4.21 5.62 4.00 60 RCVD_IN_MSPIKE_L5 6111 0.94 5.61 0.23 61 MIME_HTML_MOSTLY 6107 2.28 5.61 1.78 62 XMSubEmpty 5912 0.86 5.43 0.16 63 RCVD_IN_MSPIKE_H3 5861 11.86 5.38 12.85 64 XM_DK_Undo_01 5839 1.78 5.36 1.23 65 URIBL_SBL_A 5816 0.88 5.34 0.20 66 SpammyFromTLD_02 5764 0.96 5.29 0.30 67 TooManyTo_001 5681 6.52 5.22 6.72 68 XM_B_COVIDMETA 5441 2.00 5.00 1.54 69 XM_H_Long_From01 5345 4.80 4.91 4.78 70 TR_XM_COVIDMETA4 5295 1.19 4.86 0.63 71 FROM_EXCESS_BASE64 5266 2.79 4.84 2.48 72 RCVD_IN_MSPIKE_L3 5216 0.97 4.79 0.39 73 XM_SPF_SoftFail 5206 2.03 4.78 1.61 74 TR_Sbj_FN_Bdy 5142 0.72 4.72 0.11 75 SpammyFromTLD_01 5046 1.24 4.63 0.73 76 T_REMOTE_IMAGE 4998 3.13 4.59 2.91 77 TR_XM_MaxBayes 4985 0.64 4.58 0.04 78 XM_UB99 4977 0.61 4.57 0.00 79 HELO_NODOT 4950 1.63 4.55 1.18 80 HELO_NO_DOMAIN 4949 1.63 4.54 1.18 81 XMNoSubject 4855 0.63 4.46 0.05 82 MISSING_SUBJECT 4855 0.63 4.46 0.05 83 TR_XM_MaxWHORU 4785 0.63 4.39 0.06 84 RCVD_IN_RP_RNBL 4753 0.63 4.36 0.06 85 XMStrtUSub 4740 3.40 4.35 3.25 86 XM_SendGrid 4724 5.38 4.34 5.54 87 MISSING_HEADERS 4724 0.89 4.34 0.36 88 XMNumbers 4715 2.86 4.33 2.63 89 BAYES_95 4587 2.58 4.21 2.33 90 REPLYTO_WITHOUT_TO_CC 4536 0.59 4.17 0.05 91 XM_ShortIntro_01 4527 0.89 4.16 0.40 92 XM_DIRTYINTL 4341 0.98 3.99 0.52 93 TR_LOTS_OF_MONEY1 4322 0.54 3.97 0.01 94 FROM_SUSPICIOUS_NTLD 4235 0.55 3.89 0.04 95 FROM_SUSPICIOUS_NTLD_FP 4174 0.54 3.83 0.04 96 RELAYCOUNTRY_FR 4106 0.71 3.77 0.24 97 HTML_IMAGE_RATIO_08 4027 2.38 3.70 2.17 98 XM_B_SpammyTLD 4021 1.82 3.69 1.53 99 RCVD_IN_MSPIKE_H4 3905 7.37 3.59 7.94 100 BODY_URI_ONLY 3821 0.52 3.51 0.06 101 URI_TRY_3LD 3795 1.45 3.48 1.14 102 T_XMDrugObfuBody_08 3789 1.84 3.48 1.59 103 XM_UB999 3749 0.46 3.44 0.00 104 XMLngstWrd_00 3700 0.73 3.40 0.32 105 KHOP_HELO_FCRDNS 3640 1.80 3.34 1.57 106 TR_XM_UnparsRelay 3636 0.92 3.34 0.55 107 TR_XM_MaxSPIKE 3623 0.49 3.33 0.05 108 HTML_IMAGE_RATIO_06 3555 3.26 3.26 3.26 109 TM2_M_URI_OPT_OUT 3352 17.67 3.08 19.89 110 T_XMDrugObfuBody_00 3314 4.77 3.04 5.03 111 XM_UB80 3196 0.43 2.93 0.05 112 XM_URI_RBL 3129 0.56 2.87 0.20 113 RCVD_IN_PSBL 3010 0.38 2.76 0.02 114 TR_XM_COVIDMETA1 2999 0.65 2.75 0.33 115 TR_XM_PHPDW 2953 0.77 2.71 0.47 116 DKIM_ADSP_NXDOMAIN 2942 0.69 2.70 0.39 117 TR_XM_PHPForged 2922 0.75 2.68 0.46 118 TR_XM_FormFill2 2891 0.75 2.65 0.46 119 XM_H_PHPOS 2884 0.74 2.65 0.45 120 MPART_ALT_DIFF_COUNT 2852 0.58 2.62 0.27 121 XM_OfRef6 2844 1.30 2.61 1.10 122 TM2_M_VERY_LONG_WORD 2766 1.12 2.54 0.91 123 TR_Caps_n_Bayes_99 2691 0.41 2.47 0.10 124 PDS_OTHER_BAD_TLD 2678 0.60 2.46 0.32 125 MIME_QP_LONG_LINE 2658 4.44 2.44 4.74 126 HDRS_MISSP 2656 0.35 2.44 0.03 127 XM_B_Unsub2 2608 2.99 2.39 3.08 128 HTML_TAG_BALANCE_CENTER 2600 0.38 2.39 0.08 129 XMLngstWrd_01 2598 0.56 2.39 0.29 130 XM_UB60 2369 0.40 2.18 0.13 131 T_XMDrugObfuBody_14 2368 1.40 2.17 1.28 132 XM_CamelCaseFrm001 2334 1.68 2.14 1.61 133 URI_HEX 2321 1.50 2.13 1.41 134 RELAYCOUNTRY_RO 2245 0.28 2.06 0.00 135 TR_Symld_Words 2239 1.53 2.06 1.45 136 T_TooManySym_01 2238 3.26 2.06 3.44 137 XMDiploma_00 2167 1.31 1.99 1.21 138 XMSexyCombo_01 2147 0.72 1.97 0.53 139 T_XMHurry_00 2108 0.88 1.94 0.71 140 RELAYCOUNTRY_IT 2100 0.34 1.93 0.10 141 URI_PHP_REDIR 2084 0.25 1.91 0.00 142 BAYES_40 2006 3.60 1.84 3.87 143 XMSubNoVowel 1951 1.22 1.79 1.13 144 MIME_HTML_ONLY_MULTI 1931 2.63 1.77 2.76 145 TR_XM_RelayPhish 1889 0.35 1.73 0.14 146 BAYES_20 1865 3.82 1.71 4.14 147 PDS_FROM_2_EMAILS 1781 0.24 1.64 0.03 148 XMGppyBdWords 1772 0.33 1.63 0.13 149 FROM_2_EMAILS_SHORT 1758 0.21 1.61 0.00 150 SUBJ_BUY 1749 0.23 1.61 0.02 151 TR_XM_DK_SendGrid 1726 2.85 1.58 3.05 152 DATE_IN_PAST_03_06 1682 0.28 1.54 0.09 153 NO_FM_NAME_IP_HOSTN 1677 0.20 1.54 0.00 154 XMSubMetaD_00 1653 0.26 1.52 0.07 155 PDS_TO_EQ_FROM_NAME 1645 0.20 1.51 0.00 156 XM_PDF 1634 3.41 1.50 3.70 157 XM_UB95 1620 0.21 1.49 0.02 158 MAILING_LIST_MULTI 1596 2.11 1.47 2.21 159 XMLngstWrd_02 1593 0.40 1.46 0.24 160 TR_Mismatch_TLD_02 1571 0.26 1.44 0.08 161 XMHTML_After_End 1558 0.83 1.43 0.74 162 HK_RANDOM_REPLYTO 1483 0.36 1.36 0.21 163 RELAYCOUNTRY_DE 1476 0.45 1.36 0.32 164 XMObfuSubjects 1436 0.19 1.32 0.02 165 TR_XM_SpoofStaff 1403 0.23 1.29 0.07 166 ALL_TRUSTED 1389 23.65 1.28 27.06 167 XMSpoofStaff2 1380 0.23 1.27 0.07 168 RDNS_DYNAMIC 1373 0.39 1.26 0.26 169 HTML_FONT_TINY_NORDNS 1368 0.41 1.26 0.28 170 XMStockSpam_06 1359 0.89 1.25 0.84 171 DKIM_ADSP_CUSTOM_MED 1353 0.94 1.24 0.90 172 REMOVE_BEFORE_LINK 1352 0.40 1.24 0.27 173 LongTLD 1323 0.31 1.21 0.17 174 XMSlimDrugH 1305 0.54 1.20 0.44 175 T_FILL_THIS_FORM_SHORT 1286 0.71 1.18 0.64 176 XMSubMetaSxObfu_03 1278 0.73 1.17 0.67 177 TR_MetaPhish_Combo_01 1235 0.92 1.13 0.89 178 XMGenDplmaNmb 1227 0.80 1.13 0.75 179 TR_XM_PSC1 1217 0.21 1.12 0.07 180 XM_H_SpoofStaff4 1217 0.21 1.12 0.07 181 RELAYCOUNTRY_JP 1216 0.19 1.12 0.05 182 RELAYCOUNTRY_GB 1202 0.80 1.10 0.75 183 XM_H_MailChimp 1200 0.32 1.10 0.20 184 LONG_JUNK_URI2 1194 0.18 1.10 0.04 185 DATE_IN_PAST_06_12 1180 0.28 1.08 0.16 186 RELAYCOUNTRY_NL 1177 0.27 1.08 0.15 187 XM_H_PHPMailer 1175 0.52 1.08 0.43 188 T_Symld_Words_02 1168 0.60 1.07 0.53 189 DRUGS_ERECTILE 1150 0.15 1.06 0.01 190 NML_ADSP_CUSTOM_MED 1145 0.67 1.05 0.61 191 URI_WP_HACKED_2 1132 0.16 1.04 0.02 192 TVD_SPACE_RATIO_MINFP 1129 0.14 1.04 0.00 193 XMPhish30 1115 0.41 1.02 0.31 194 RELAYCOUNTRY_CN 1103 0.18 1.01 0.05 195 DEAR_FRIEND 1098 0.21 1.01 0.09 196 XM_BadFromFormat 1088 0.25 1.00 0.14 197 XMMoneyMeta_00 1082 0.67 0.99 0.62 198 XM_Combo_Sbj 1070 0.31 0.98 0.21 199 XM_HighProb1 1062 0.13 0.98 0.01 200 URIBL_BLACK 1051 0.17 0.97 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 704348 98.40 98.09 98.45 2 HTML_MESSAGE 529885 76.51 92.53 74.07 3 RELAYCOUNTRY_US 496484 69.75 72.08 69.40 4 DKIM_SIGNED 462060 66.11 76.14 64.59 5 XM_DK_Pass 454210 64.75 73.05 63.49 6 DKIM_VALID 425996 59.44 58.72 59.55 7 XM_B_Unicode 420834 60.27 69.77 58.82 8 XMListUnsubscribeExists 317937 46.62 60.90 44.44 9 DKIM_VALID_AU 317467 44.28 43.65 44.38 10 BAYES_50 315225 43.17 37.28 44.06 11 XM_B_Unicode3 241201 33.92 35.29 33.71 12 ALL_TRUSTED 193598 23.65 1.28 27.06 13 T_TM2_M_HEADER_IN_MSG 172925 24.42 26.07 24.17 14 BAYES_00 171394 20.92 0.95 23.96 15 HTML_FONT_LOW_CONTRAST 163440 23.00 24.02 22.85 16 DKIM_VALID_EF 161275 23.13 26.97 22.54 17 RCVD_IN_MSPIKE_WL 161063 20.74 9.08 22.51 18 LOC_TINY_FONT_1 142552 21.33 30.54 19.93 19 TM2_M_URI_OPT_OUT 142277 17.67 3.08 19.89 20 RCVD_IN_MSPIKE_H2 141330 20.50 25.38 19.75 21 ANY_BOUNCE_MESSAGE 139516 17.02 0.69 19.50 22 BOUNCE_MESSAGE 139508 17.02 0.69 19.50 23 FVGT_m_MULTI_ODD 134058 20.44 31.64 18.74 24 XM_Multi_Part_URI 131595 18.83 21.73 18.39 25 XMSubLong 125198 18.11 22.08 17.50 26 MIME_HTML_ONLY 123682 19.11 31.11 17.29 27 T_KAM_HTML_FONT_INVALID 115701 16.74 20.49 16.17 28 RCVD_IN_MSPIKE_H3 91938 11.86 5.38 12.85 29 XM_Body_Dirty_Words 78785 11.89 17.65 11.01 30 XM_DK_Undo_02 77832 16.16 50.89 10.88 31 XM_B_Unsub 67519 9.74 11.76 9.44 32 RCVD_IN_MSPIKE_H4 56817 7.37 3.59 7.94 33 LotsOfNums_01 55330 8.19 11.16 7.73 34 XM_Evil_Numbers_Gen 53174 7.55 8.34 7.43 35 LOTS_OF_MONEY 51317 9.65 25.90 7.17 36 TR_XM_DK_Bayes 49565 6.09 0.60 6.93 37 XM_B_Phish_Phrases 48658 7.27 10.33 6.80 38 BAYES_99 48220 11.07 39.48 6.74 39 TooManyTo_001 48063 6.52 5.22 6.72 40 TR_XM_DK_Bayes1 45912 5.62 0.39 6.42 41 UNPARSEABLE_RELAY 43598 6.07 5.89 6.09 42 IN_ZIMBRA_NJ_WHITELIST 42681 5.19 0.06 5.97 43 XM_DKIMWhitelistDomains 42342 5.14 0.01 5.92 44 BAYES_60 41169 5.76 5.79 5.75 45 TR_XM_DK_Bayes2 39665 4.84 0.18 5.54 46 XM_SendGrid 39665 5.38 4.34 5.54 47 HTML_IMAGE_RATIO_02 39492 5.84 7.90 5.52 48 RCVD_IN_RP_SAFE 39034 4.80 0.49 5.46 49 BAYES_999 38483 8.84 31.56 5.38 50 BAYES_05 37917 4.71 0.83 5.30 51 DKIM_INVALID 36064 6.68 17.42 5.04 52 T_XMDrugObfuBody_00 36003 4.77 3.04 5.03 53 RCVD_IN_RP_CERTIFIED 35530 4.36 0.38 4.97 54 XM_H_Long_From01 34231 4.80 4.91 4.78 55 MIME_QP_LONG_LINE 33922 4.44 2.44 4.74 56 RELAYCOUNTRY_META 33554 7.78 28.07 4.69 57 RCVD_IN_IADB_LISTED 32988 4.10 0.78 4.61 58 BOTNET_IPINHOSTNAME 31761 5.75 14.35 4.44 59 BAYES_20 29623 3.82 1.71 4.14 60 RCVD_IN_IADB_SPF 29264 3.64 0.71 4.09 61 MPART_ALT_DIFF 29109 4.52 7.51 4.07 62 HTML_IMAGE_RATIO_04 28605 4.21 5.62 4.00 63 BAYES_40 27651 3.60 1.84 3.87 64 BAYES_80 27534 4.38 7.90 3.85 65 XM_PDF 26451 3.41 1.50 3.70 66 RCVD_IN_IADB_SENDERID 26136 3.26 0.69 3.65 67 RCVD_IN_IADB_DK 26084 3.25 0.69 3.65 68 XMSubMetaSx_00 25473 3.92 6.28 3.56 69 T_TooManySym_01 24602 3.26 2.06 3.44 70 XMSexyCombo_05 23589 4.18 9.97 3.30 71 HTML_IMAGE_RATIO_06 23349 3.26 3.26 3.26 72 XMStrtUSub 23282 3.40 4.35 3.25 73 BOTNET 22341 6.56 29.12 3.12 74 XM_B_Unsub2 22053 2.99 2.39 3.08 75 NO_DNS_FOR_FROM 21900 4.45 13.54 3.06 76 TR_XM_DK_SendGrid 21798 2.85 1.58 3.05 77 T_REMOTE_IMAGE 20805 3.13 4.59 2.91 78 MIME_HTML_ONLY_MULTI 19746 2.63 1.77 2.76 79 XMNumbers 18824 2.86 4.33 2.63 80 TR_XM_PhishingBody 18373 3.43 9.07 2.57 81 XM_H_Trusted_IP 18247 2.21 0.00 2.55 82 RCVD_IN_IADB_VOUCHED 18189 2.23 0.21 2.54 83 XM_UncommonTLD01 17924 4.18 15.20 2.51 84 FROM_EXCESS_BASE64 17730 2.79 4.84 2.48 85 BAYES_95 16641 2.58 4.21 2.33 86 MAILING_LIST_MULTI 15828 2.11 1.47 2.21 87 HTML_IMAGE_RATIO_08 15559 2.38 3.70 2.17 88 MIME_HTML_MOSTLY 12726 2.28 5.61 1.78 89 UNTRUSTED_Relay 12702 4.10 19.35 1.78 90 T_TooManySym_02 12524 1.61 0.67 1.75 91 RCVD_IN_MSPIKE_H5 12308 1.51 0.11 1.72 92 RELAYCOUNTRY_CA 11962 2.43 7.43 1.67 93 HTML_MIME_NO_HTML_TAG 11585 2.50 8.31 1.62 94 XM_CamelCaseFrm001 11505 1.68 2.14 1.61 95 XM_SPF_SoftFail 11489 2.03 4.78 1.61 96 XM_B_Phish66 11344 2.28 6.84 1.59 97 T_XMDrugObfuBody_08 11343 1.84 3.48 1.59 98 RCVD_IN_IADB_OPTIN 11285 1.40 0.23 1.58 99 KHOP_HELO_FCRDNS 11203 1.80 3.34 1.57 100 XM_B_COVIDMETA 11013 2.00 5.00 1.54 101 XM_B_SpammyTLD 10970 1.82 3.69 1.53 102 TooManyTo_002 10858 1.41 0.68 1.52 103 RCVD_IN_BL_SPAMCOP_NET 10734 2.34 7.82 1.50 104 TR_Symld_Words 10376 1.53 2.06 1.45 105 SUBJ_ALL_CAPS 10089 2.21 7.46 1.41 106 URI_HEX 10071 1.50 2.13 1.41 107 TVD_RCVD_IP 9924 1.25 0.37 1.39 108 T_XMDrugObfuBody_14 9192 1.40 2.17 1.28 109 XM_DK_Undo_01 8831 1.78 5.36 1.23 110 XM_GoogleGroups 8826 1.13 0.48 1.23 111 XMDiploma_00 8666 1.31 1.99 1.21 112 HELO_NODOT 8465 1.63 4.55 1.18 113 HELO_NO_DOMAIN 8461 1.63 4.54 1.18 114 URI_TRY_3LD 8176 1.45 3.48 1.14 115 IN_HORDE_ADDRESS_BOOK 8143 1.03 0.29 1.14 116 XMSubNoVowel 8080 1.22 1.79 1.13 117 XM_OfRef6 7889 1.30 2.61 1.10 118 INVALID_MSGID 7850 0.98 0.20 1.10 119 HELO_MISC_IP 7729 1.02 0.62 1.08 120 CK_HELO_DYNAMIC_SPLIT_IP 7725 1.02 0.66 1.08 121 USER_IN_DEF_DKIM_WL 7349 0.89 0.01 1.03 122 TR_LOTS_OF_MONEY3 7263 2.38 11.33 1.02 123 XM_H_Long_From02 7209 0.97 0.73 1.01 124 XMBrknScrpt_02 7193 1.81 7.07 1.01 125 TooManyTo_003 7159 0.93 0.48 1.00 126 XMGappySubj_01 6600 0.83 0.22 0.92 127 TO_MALFORMED 6593 0.80 0.03 0.92 128 TM2_M_VERY_LONG_WORD 6479 1.12 2.54 0.91 129 HTML_FONT_FACE_BAD 6466 0.85 0.52 0.90 130 DKIM_ADSP_CUSTOM_MED 6410 0.94 1.24 0.90 131 XMCapTrack 6341 0.84 0.57 0.89 132 TR_MetaPhish_Combo_01 6334 0.92 1.13 0.89 133 XM_UB50 6212 1.70 7.16 0.87 134 XMStockSpam_06 6016 0.89 1.25 0.84 135 TooManyTo_004 5395 0.71 0.41 0.75 136 XMGenDplmaNmb 5376 0.80 1.13 0.75 137 RELAYCOUNTRY_GB 5364 0.80 1.10 0.75 138 HTTPS_HTTP_MISMATCH 5339 0.76 0.85 0.75 139 XMHTML_After_End 5315 0.83 1.43 0.74 140 T_TooManySym_03 5280 0.67 0.22 0.74 141 SpammyFromTLD_01 5209 1.24 4.63 0.73 142 T_XMHurry_00 5106 0.88 1.94 0.71 143 TR_MSPIKEBAYES00 5002 0.61 0.01 0.70 144 XMBody_17 4981 2.21 12.16 0.70 145 XMSubMetaSxObfu_03 4778 0.73 1.17 0.67 146 XMBdyGiftCard01 4659 0.69 0.93 0.65 147 RCVD_IN_MSPIKE_BL 4652 1.99 10.82 0.65 148 XM_ProductURIs 4621 0.64 0.63 0.65 149 T_FILL_THIS_FORM_SHORT 4593 0.71 1.18 0.64 150 TR_XM_COVIDMETA4 4477 1.19 4.86 0.63 151 XMMoneyMeta_00 4461 0.67 0.99 0.62 152 T_OBFU_PDF_ATTACH 4452 0.56 0.16 0.62 153 TooManyTo_005 4418 0.58 0.30 0.62 154 NML_ADSP_CUSTOM_MED 4391 0.67 1.05 0.61 155 XMSubMetaI_00 4255 0.60 0.61 0.59 156 XMBody_95 4038 0.51 0.14 0.56 157 FROM_GOV_DKIM_AU 3989 0.50 0.11 0.56 158 TR_XM_UnparsRelay 3957 0.92 3.34 0.55 159 TR_BOTNET_NEGATE 3889 0.53 0.47 0.54 160 XMSexyCombo_01 3763 0.72 1.97 0.53 161 T_Symld_Words_02 3761 0.60 1.07 0.53 162 XM_DIRTYINTL 3735 0.98 3.99 0.52 163 XM_SPF_Unknown 3720 0.57 0.87 0.52 164 TR_XM_PHPDW 3361 0.77 2.71 0.47 165 TR_XM_PHPForged 3277 0.75 2.68 0.46 166 TR_XM_FormFill2 3276 0.75 2.65 0.46 167 XM_H_PHPOS 3232 0.74 2.65 0.45 168 FORGED_GMAIL_RCVD 3219 0.51 0.90 0.45 169 XMSlimDrugH 3163 0.54 1.20 0.44 170 XMNoVowels 3105 0.47 0.67 0.43 171 XMHTMLBadTable_001 3105 0.43 0.38 0.43 172 HTML_TAG_BALANCE_BODY 3078 0.44 0.49 0.43 173 XM_H_PHPMailer 3076 0.52 1.08 0.43 174 XMBody_78 2888 0.47 0.92 0.40 175 XM_ShortIntro_01 2837 0.89 4.16 0.40 176 FROM_GOV_SPOOF 2836 0.39 0.33 0.40 177 XM_B_REG_HTML 2825 0.36 0.16 0.39 178 DKIM_ADSP_NXDOMAIN 2766 0.69 2.70 0.39 179 RCVD_IN_MSPIKE_L3 2758 0.97 4.79 0.39 180 PLING_QUERY 2742 0.42 0.63 0.38 181 HTML_IMAGE_ONLY_20 2697 0.45 0.90 0.38 182 T_TooManySym_04 2692 0.34 0.09 0.38 183 HTML_IMAGE_ONLY_28 2677 0.43 0.78 0.37 184 RELAYCOUNTRY_AU 2665 0.39 0.53 0.37 185 MISSING_HEADERS 2599 0.89 4.34 0.36 186 XM_RXBody 2512 0.36 0.39 0.35 187 TM2_M_BODY_EMPTY 2499 0.33 0.17 0.35 188 TM2_M_A_HREF_HREF 2462 0.37 0.57 0.34 189 URI_NOVOWEL 2437 0.38 0.67 0.34 190 RCVD_IN_SORBS_DUL 2424 0.34 0.32 0.34 191 XMPhish08 2409 0.40 0.79 0.34 192 SUBJ_DOLLARS 2353 0.38 0.74 0.33 193 TR_XM_COVIDMETA1 2329 0.65 2.75 0.33 194 TVD_SPACE_RATIO 2294 0.30 0.13 0.32 195 XM_S_SubURI 2294 0.29 0.05 0.32 196 XMLngstWrd_00 2291 0.73 3.40 0.32 197 PDS_OTHER_BAD_TLD 2286 0.60 2.46 0.32 198 HTML_IMAGE_ONLY_32 2281 0.30 0.19 0.32 199 TVD_PH_BODY_ACCOUNTS_PRE 2279 0.29 0.09 0.32 200 SHORT_HELO_AND_INLINE_IMAGE 2263 0.28 0.07 0.32 ----------------------------------------------------------------------