Email: 660395 Autolearn: 0 AvgScore: 2.09 AvgScanTime: 1.09 sec Spam: 144069 Autolearn: 0 AvgScore: 13.60 AvgScanTime: 1.01 sec Ham: 516326 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.11 sec Time Spent Running SA: 199.41 hours Time Spent Processing Spam: 40.33 hours Time Spent Processing Ham: 159.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 139076 98.15 96.53 98.60 2 HTML_MESSAGE 136892 89.17 95.02 87.54 3 XM_B_Unicode 93421 68.26 64.84 69.22 4 RELAYCOUNTRY_US 82977 76.31 57.60 81.53 5 MIME_HTML_ONLY 79570 28.03 55.23 20.44 6 XM_B_SpammyWords 77221 50.71 53.60 49.90 7 DKIM_SIGNED 71109 71.67 49.36 77.89 8 XM_DK_Pass 68773 70.29 47.74 76.59 9 DKIM_VALID 66696 68.27 46.29 74.40 10 XMListUnsubscribeExists 59003 49.72 40.95 52.16 11 XM_B_Unicode3 55670 38.53 38.64 38.50 12 XM_B_Unsub 54134 16.54 37.58 10.67 13 RCVD_IN_MSPIKE_H2 53419 29.31 37.08 27.14 14 DKIM_VALID_AU 49498 51.53 34.36 56.33 15 XM_B_SpammyWords2 46886 25.24 32.54 23.20 16 HTML_FONT_LOW_CONTRAST 46716 28.57 32.43 27.49 17 BAYES_99 45726 12.69 31.74 7.37 18 XM_DK_Undo_02 43919 14.94 30.48 10.61 19 BAYES_50 37764 47.50 26.21 53.44 20 RELAYCOUNTRY_META 37286 10.29 25.88 5.94 21 BAYES_999 33340 9.64 23.14 5.87 22 HTML_MIME_NO_HTML_TAG 31825 6.89 22.09 2.65 23 LOC_TINY_FONT_1 30613 24.66 21.25 25.61 24 DKIM_VALID_EF 30426 27.66 21.12 29.49 25 RCVD_IN_PSBL 29903 4.57 20.76 0.06 26 XM_Multi_Part_URI 29265 14.44 20.31 12.80 27 TooManyTo_001 27277 11.45 18.93 9.36 28 UNTRUSTED_Relay 26074 5.71 18.10 2.26 29 BOTNET 25047 5.46 17.39 2.13 30 XMDiploma_00 24736 5.25 17.17 1.92 31 ALL_TRUSTED 24714 14.85 17.15 14.20 32 BAYES_80 24149 7.30 16.76 4.66 33 T_KAM_HTML_FONT_INVALID 24135 18.45 16.75 18.92 34 XMGenDplmaNmb 23857 4.45 16.56 1.07 35 FVGT_m_MULTI_ODD 22848 21.73 15.86 23.37 36 XM_Combo_Sbj 22784 3.68 15.81 0.30 37 XMSubLong 22703 20.46 15.76 21.78 38 XMOemUri 22470 3.65 15.60 0.32 39 T_TM2_M_HEADER_IN_MSG 22251 26.77 15.44 29.93 40 TM2_M_OBFU_COMMENT 22128 3.37 15.36 0.02 41 XMSubGiftCard1 21245 3.30 14.75 0.10 42 XM_UncommonTLD01 19688 5.52 13.67 3.25 43 BAYES_95 18684 5.05 12.97 2.84 44 XM_Body_Dirty_Words 18012 13.27 12.50 13.49 45 RCVD_IN_BL_SPAMCOP_NET 17942 3.88 12.45 1.49 46 FROM_EXCESS_BASE64 16497 4.24 11.45 2.23 47 XMSubGiftCard2 14663 2.24 10.18 0.03 48 BOTNET_IPINHOSTNAME 14193 6.26 9.85 5.26 49 LOTS_OF_MONEY 12185 7.39 8.46 7.09 50 RCVD_IN_RP_RNBL 11483 1.85 7.97 0.15 51 XM_B_Phish_Phrases 11423 7.12 7.93 6.90 52 XM_B_SpammyWords3 11286 7.18 7.83 7.00 53 XMSexyCombo_05 11214 5.09 7.78 4.34 54 HTML_IMAGE_ONLY_20 10785 1.99 7.49 0.46 55 BAYES_60 10450 7.00 7.25 6.92 56 RCVD_IN_MSPIKE_BL 10383 2.51 7.21 1.20 57 RCVD_IN_MSPIKE_WL 10212 23.66 7.09 28.29 58 MPART_ALT_DIFF 9757 4.46 6.77 3.81 59 XM_Evil_Numbers_Gen 8779 8.21 6.09 8.80 60 SpammyFromTLD_02 8599 1.50 5.97 0.25 61 KHOP_HELO_FCRDNS 8432 2.69 5.85 1.81 62 MIME_HTML_MOSTLY 8400 3.25 5.83 2.53 63 LotsOfNums_01 8362 8.01 5.80 8.63 64 HK_RANDOM_FROM 8215 1.35 5.70 0.14 65 XM_UB50 8092 2.19 5.62 1.23 66 T_REMOTE_IMAGE 7646 3.92 5.31 3.54 67 HTML_IMAGE_RATIO_02 7344 6.58 5.10 6.99 68 XMSubMetaSx_00 7338 4.35 5.09 4.14 69 BOTNET_NORDNS 7203 1.10 5.00 0.01 70 URI_PHP_REDIR 6834 1.05 4.74 0.02 71 TR_XM_PhishingBody 6699 4.03 4.65 3.85 72 RELAYCOUNTRY_CA 6585 2.48 4.57 1.89 73 XM_UB99 6326 0.96 4.39 0.00 74 HTML_FONT_TINY_NORDNS 6238 1.04 4.33 0.12 75 SpammyFromTLD_01 6133 1.69 4.26 0.97 76 NO_DNS_FOR_FROM 6069 1.29 4.21 0.48 77 XM_H_Long_From01 5939 5.11 4.12 5.39 78 XM_SPF_SoftFail 5638 2.48 3.91 2.08 79 RCVD_IN_MSPIKE_H3 5631 13.28 3.91 15.89 80 SUBJ_ALL_CAPS 5600 2.34 3.89 1.91 81 HTML_SHORT_LINK_IMG_1 5586 0.86 3.88 0.02 82 RCVD_IN_MSPIKE_L3 5459 1.45 3.79 0.80 83 XM_B_COVIDMETA 5375 1.95 3.73 1.45 84 XM_DIRTYINTL 5327 1.32 3.70 0.66 85 XMBody_17 5236 1.69 3.63 1.15 86 RELAYCOUNTRY_FR 4877 1.01 3.39 0.35 87 UNPARSEABLE_RELAY 4814 7.09 3.34 8.13 88 RELAYCOUNTRY_GB 4696 1.47 3.26 0.97 89 SHORTENED_URL_HREF 4597 0.96 3.19 0.34 90 XM_UB999 4506 0.68 3.13 0.00 91 XMStrtUSub 4495 4.39 3.12 4.75 92 HTML_IMAGE_RATIO_04 4485 4.41 3.11 4.78 93 DKIM_ADSP_NXDOMAIN 4467 1.11 3.10 0.56 94 DKIM_INVALID 4413 3.40 3.06 3.49 95 BODY_URI_ONLY 4365 0.69 3.03 0.04 96 XM_B_Phish66 4335 2.47 3.01 2.32 97 XM_B_SpammyTLD 4332 2.22 3.01 2.01 98 LH_URI_DOM_IN_PATH 4285 2.16 2.97 1.93 99 RELAYCOUNTRY_IN 4246 0.80 2.95 0.20 100 HTML_IMAGE_ONLY_08 4229 0.73 2.94 0.12 101 RCVD_IN_MSPIKE_H4 4201 8.86 2.92 10.52 102 XMBrknScrpt_02 4102 1.57 2.85 1.22 103 XMBdyGiftCard01 4100 1.26 2.85 0.82 104 RCVD_IN_MSPIKE_L5 4022 0.82 2.79 0.27 105 SHORT_SHORTNER 4009 0.62 2.78 0.02 106 SHORTENED_URL_SRC 3987 0.61 2.77 0.00 107 SHORTENER_SHORT_IMG 3971 0.60 2.76 0.00 108 SHORT_URI_3 3903 0.65 2.71 0.08 109 XM_CamelCaseFrm001 3716 2.01 2.58 1.86 110 XM_BadFromFormat 3586 0.63 2.49 0.11 111 XM_SendGrid 3569 6.15 2.48 7.18 112 FROM_LOCAL_NOVOWEL 3568 0.56 2.48 0.03 113 LOCALPART_IN_SUBJECT 3563 0.56 2.47 0.02 114 URIBL_SBL_A 3509 0.76 2.44 0.29 115 XM_UB60 3433 0.63 2.38 0.14 116 XM_UB80 3249 0.53 2.26 0.05 117 TR_XM_MaxSPIKE 3247 0.54 2.25 0.07 118 T_XMDrugObfuBody_08 3214 2.00 2.23 1.93 119 T_XMDrugObfuBody_14 3210 2.13 2.23 2.10 120 XMNumbers 3210 3.20 2.23 3.47 121 XM_S_GiftBonus 2973 0.45 2.06 0.00 122 HTML_IMAGE_RATIO_08 2935 2.44 2.04 2.55 123 TO_NO_BRKTS_HTML_ONLY 2916 0.57 2.02 0.16 124 XMOffer 2916 0.46 2.02 0.03 125 FVGT_m_MULTI_ODD_EMAIL 2877 0.46 2.00 0.03 126 URI_HEX 2877 1.82 2.00 1.77 127 TR_XM_MaxBayes 2856 0.46 1.98 0.04 128 TM2_M_URI_OPT_OUT 2856 2.81 1.98 3.04 129 TR_XM_PHPDW 2828 0.74 1.96 0.40 130 XMHTML_After_End 2776 1.10 1.93 0.87 131 TR_Caps_n_Bayes_99 2773 0.55 1.92 0.17 132 TR_XM_PHPForged 2764 0.72 1.92 0.38 133 TR_XM_FormFill2 2752 0.71 1.91 0.38 134 XM_URI_RBL 2750 0.57 1.91 0.20 135 XM_H_PHPOS 2744 0.71 1.90 0.37 136 T_TooManySym_01 2716 4.57 1.89 5.32 137 T_XMDrugObfuBody_00 2702 0.99 1.88 0.75 138 TR_Mismatch_TLD_01 2676 0.60 1.86 0.25 139 XM_B_Unsub2 2644 2.53 1.84 2.72 140 RELAYCOUNTRY_DE 2611 0.86 1.81 0.60 141 XM_OfRef6 2552 1.27 1.77 1.13 142 T_PDS_OTHER_BAD_TLD 2513 0.77 1.74 0.49 143 HTML_IMAGE_RATIO_06 2456 3.03 1.70 3.40 144 BAYES_40 2424 4.12 1.68 4.80 145 TR_XM_COVIDMETA1 2387 0.74 1.66 0.48 146 TR_XM_UnparsRelay 2335 0.65 1.62 0.38 147 BAYES_20 2335 3.58 1.62 4.13 148 TM2_M_VERY_LONG_WORD 2304 1.30 1.60 1.21 149 XM_UB95 2225 0.36 1.54 0.03 150 TR_XM_SB_Phish 2176 2.03 1.51 2.17 151 TR_Symld_Words 2126 1.82 1.48 1.92 152 TR_XM_RelayPhish 2120 0.47 1.47 0.19 153 XMSubPhish11 2113 1.98 1.47 2.12 154 XM_B_SpammyWords4 2093 0.86 1.45 0.70 155 TR_XM_COVIDMETA4 2067 0.72 1.43 0.52 156 MIME_QP_LONG_LINE 2046 4.47 1.42 5.32 157 DATE_IN_PAST_03_06 1966 0.45 1.36 0.20 158 XMSexyCombo_01 1950 0.84 1.35 0.69 159 URI_TRY_3LD 1817 1.56 1.26 1.65 160 XMSubMetaSxObfu_03 1799 0.68 1.25 0.52 161 TR_XM_DK_SendGrid 1791 3.58 1.24 4.23 162 HTML_IMAGE_ONLY_12 1730 0.46 1.20 0.25 163 DKIM_ADSP_CUSTOM_MED 1719 1.16 1.19 1.16 164 MIME_HTML_ONLY_MULTI 1693 1.83 1.18 2.01 165 XM_PDF 1688 3.98 1.17 4.76 166 TR_XM_INV_DKIM 1638 0.37 1.14 0.16 167 TR_LOTS_OF_MONEY3 1609 0.57 1.12 0.41 168 XMStockSpam_06 1595 1.17 1.11 1.19 169 DATE_IN_PAST_06_12 1582 0.43 1.10 0.25 170 T_FILL_THIS_FORM_SHORT 1568 1.02 1.09 1.00 171 RCVD_IN_IADB_LISTED 1562 4.07 1.08 4.90 172 NML_ADSP_CUSTOM_MED 1559 0.88 1.08 0.83 173 RELAYCOUNTRY_IE 1521 0.38 1.06 0.19 174 TR_Mismatch_TLD_02 1477 0.30 1.03 0.10 175 XM_SPF_Unknown 1468 0.76 1.02 0.69 176 T_XMHurry_00 1455 0.77 1.01 0.70 177 NUMERIC_HTTP_ADDR 1446 0.60 1.00 0.49 178 TR_XM_MaxWHORU 1416 0.21 0.98 0.00 179 HELO_NO_DOMAIN 1385 1.51 0.96 1.66 180 HELO_NODOT 1385 1.51 0.96 1.66 181 FORGED_GMAIL_RCVD 1381 0.63 0.96 0.54 182 MISSING_HEADERS 1378 0.57 0.96 0.46 183 XMMoneyMeta_00 1372 0.67 0.95 0.60 184 RDNS_DYNAMIC 1365 0.63 0.95 0.54 185 MIME_CHARSET_FARAWAY 1316 0.30 0.91 0.13 186 RELAYCOUNTRY_JP 1307 0.23 0.91 0.04 187 URI_NOVOWEL 1299 2.07 0.90 2.39 188 BAYES_00 1282 10.73 0.89 13.47 189 XMGppyBdWords 1273 0.40 0.88 0.26 190 BAYES_05 1248 2.04 0.87 2.37 191 RCVD_IN_IADB_SPF 1243 3.50 0.86 4.24 192 XMSlimDrugH 1230 0.54 0.85 0.45 193 FROM_SUSPICIOUS_NTLD 1229 0.22 0.85 0.04 194 HK_RANDOM_REPLYTO 1214 0.38 0.84 0.25 195 DRUGS_ERECTILE 1200 0.20 0.83 0.02 196 MAILING_LIST_MULTI 1182 2.32 0.82 2.73 197 RELAYCOUNTRY_NL 1161 0.52 0.81 0.44 198 MPART_ALT_DIFF_COUNT 1157 0.49 0.80 0.41 199 HTTPS_HTTP_MISMATCH 1157 0.76 0.80 0.74 200 CHARSET_FARAWAY_HEADER 1139 0.21 0.79 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 509103 98.15 96.53 98.60 2 HTML_MESSAGE 451972 89.17 95.02 87.54 3 RELAYCOUNTRY_US 420948 76.31 57.60 81.53 4 DKIM_SIGNED 402169 71.67 49.36 77.89 5 XM_DK_Pass 395439 70.29 47.74 76.59 6 DKIM_VALID 384145 68.27 46.29 74.40 7 XM_B_Unicode 357383 68.26 64.84 69.22 8 DKIM_VALID_AU 290824 51.53 34.36 56.33 9 BAYES_50 275899 47.50 26.21 53.44 10 XMListUnsubscribeExists 269319 49.72 40.95 52.16 11 XM_B_SpammyWords 257657 50.71 53.60 49.90 12 XM_B_Unicode3 198810 38.53 38.64 38.50 13 T_TM2_M_HEADER_IN_MSG 154511 26.77 15.44 29.93 14 DKIM_VALID_EF 152246 27.66 21.12 29.49 15 RCVD_IN_MSPIKE_WL 146063 23.66 7.09 28.29 16 HTML_FONT_LOW_CONTRAST 141932 28.57 32.43 27.49 17 RCVD_IN_MSPIKE_H2 140144 29.31 37.08 27.14 18 LOC_TINY_FONT_1 132220 24.66 21.25 25.61 19 FVGT_m_MULTI_ODD 120667 21.73 15.86 23.37 20 XM_B_SpammyWords2 119767 25.24 32.54 23.20 21 XMSubLong 112446 20.46 15.76 21.78 22 MIME_HTML_ONLY 105513 28.03 55.23 20.44 23 T_KAM_HTML_FONT_INVALID 97702 18.45 16.75 18.92 24 RCVD_IN_MSPIKE_H3 82056 13.28 3.91 15.89 25 ALL_TRUSTED 73343 14.85 17.15 14.20 26 XM_Body_Dirty_Words 69644 13.27 12.50 13.49 27 BAYES_00 69557 10.73 0.89 13.47 28 XM_Multi_Part_URI 66094 14.44 20.31 12.80 29 XM_B_Unsub 55092 16.54 37.58 10.67 30 XM_DK_Undo_02 54772 14.94 30.48 10.61 31 RCVD_IN_MSPIKE_H4 54299 8.86 2.92 10.52 32 TR_XM_DK_Bayes 50326 7.67 0.25 9.75 33 TR_XM_DK_Bayes1 48643 7.42 0.23 9.42 34 TooManyTo_001 48329 11.45 18.93 9.36 35 XM_Evil_Numbers_Gen 45426 8.21 6.09 8.80 36 LotsOfNums_01 44568 8.01 5.80 8.63 37 TR_XM_DK_Bayes2 43616 6.65 0.20 8.45 38 UNPARSEABLE_RELAY 41993 7.09 3.34 8.13 39 RCVD_IN_RP_SAFE 39211 5.98 0.18 7.59 40 XM_DKIMWhitelistDomains 39135 5.93 0.00 7.58 41 BAYES_99 38070 12.69 31.74 7.37 42 RCVD_IN_RP_CERTIFIED 37081 5.63 0.09 7.18 43 XM_SendGrid 37052 6.15 2.48 7.18 44 LOTS_OF_MONEY 36625 7.39 8.46 7.09 45 XM_B_SpammyWords3 36162 7.18 7.83 7.00 46 HTML_IMAGE_RATIO_02 36086 6.58 5.10 6.99 47 BAYES_60 35752 7.00 7.25 6.92 48 XM_B_Phish_Phrases 35606 7.12 7.93 6.90 49 IN_ZIMBRA_NJ_WHITELIST 32260 4.89 0.04 6.25 50 RELAYCOUNTRY_META 30688 10.29 25.88 5.94 51 BAYES_999 30328 9.64 23.14 5.87 52 XM_H_Long_From01 27831 5.11 4.12 5.39 53 MIME_QP_LONG_LINE 27488 4.47 1.42 5.32 54 T_TooManySym_01 27472 4.57 1.89 5.32 55 BOTNET_IPINHOSTNAME 27152 6.26 9.85 5.26 56 RCVD_IN_IADB_LISTED 25309 4.07 1.08 4.90 57 BAYES_40 24759 4.12 1.68 4.80 58 HTML_IMAGE_RATIO_04 24659 4.41 3.11 4.78 59 XM_PDF 24594 3.98 1.17 4.76 60 XMStrtUSub 24522 4.39 3.12 4.75 61 BAYES_80 24074 7.30 16.76 4.66 62 XMSexyCombo_05 22389 5.09 7.78 4.34 63 RCVD_IN_IADB_SPF 21878 3.50 0.86 4.24 64 TR_XM_DK_SendGrid 21862 3.58 1.24 4.23 65 XMSubMetaSx_00 21368 4.35 5.09 4.14 66 BAYES_20 21323 3.58 1.62 4.13 67 TR_XM_PhishingBody 19885 4.03 4.65 3.85 68 MPART_ALT_DIFF 19686 4.46 6.77 3.81 69 RCVD_IN_IADB_SENDERID 19548 3.13 0.76 3.79 70 RCVD_IN_IADB_DK 18955 3.03 0.75 3.67 71 T_REMOTE_IMAGE 18268 3.92 5.31 3.54 72 DKIM_INVALID 18024 3.40 3.06 3.49 73 XMNumbers 17891 3.20 2.23 3.47 74 HTML_IMAGE_RATIO_06 17559 3.03 1.70 3.40 75 ANY_BOUNCE_MESSAGE 17546 2.76 0.48 3.40 76 BOUNCE_MESSAGE 17543 2.76 0.48 3.40 77 XM_UncommonTLD01 16784 5.52 13.67 3.25 78 RCVD_IN_IADB_VOUCHED 16121 2.58 0.64 3.12 79 TM2_M_URI_OPT_OUT 15689 2.81 1.98 3.04 80 BAYES_95 14655 5.05 12.97 2.84 81 MAILING_LIST_MULTI 14112 2.32 0.82 2.73 82 XM_B_Unsub2 14044 2.53 1.84 2.72 83 HTML_MIME_NO_HTML_TAG 13657 6.89 22.09 2.65 84 HTML_IMAGE_RATIO_08 13152 2.44 2.04 2.55 85 MIME_HTML_MOSTLY 13083 3.25 5.83 2.53 86 T_TooManySym_02 13011 2.09 0.55 2.52 87 URI_NOVOWEL 12345 2.07 0.90 2.39 88 BAYES_05 12228 2.04 0.87 2.37 89 XM_B_Phish66 11959 2.47 3.01 2.32 90 TooManyTo_002 11899 1.97 0.77 2.30 91 UNTRUSTED_Relay 11667 5.71 18.10 2.26 92 FROM_EXCESS_BASE64 11535 4.24 11.45 2.23 93 TR_XM_SB_Phish 11204 2.03 1.51 2.17 94 BOTNET 10997 5.46 17.39 2.13 95 XMSubPhish11 10966 1.98 1.47 2.12 96 T_XMDrugObfuBody_14 10860 2.13 2.23 2.10 97 XM_SPF_SoftFail 10759 2.48 3.91 2.08 98 RCVD_IN_IADB_OPTIN 10519 1.69 0.46 2.04 99 MIME_HTML_ONLY_MULTI 10384 1.83 1.18 2.01 100 XM_B_SpammyTLD 10357 2.22 3.01 2.01 101 T_XMDrugObfuBody_08 9988 2.00 2.23 1.93 102 LH_URI_DOM_IN_PATH 9987 2.16 2.97 1.93 103 TR_Symld_Words 9912 1.82 1.48 1.92 104 XMDiploma_00 9909 5.25 17.17 1.92 105 SUBJ_ALL_CAPS 9867 2.34 3.89 1.91 106 RELAYCOUNTRY_CA 9773 2.48 4.57 1.89 107 RCVD_IN_MSPIKE_H5 9708 1.53 0.26 1.88 108 XM_CamelCaseFrm001 9580 2.01 2.58 1.86 109 KHOP_HELO_FCRDNS 9362 2.69 5.85 1.81 110 URI_HEX 9153 1.82 2.00 1.77 111 TVD_RCVD_IP 8932 1.39 0.17 1.73 112 XM_DK_Undo_01 8808 1.49 0.73 1.71 113 HELO_NODOT 8565 1.51 0.96 1.66 114 HELO_NO_DOMAIN 8564 1.51 0.96 1.66 115 URI_TRY_3LD 8509 1.56 1.26 1.65 116 TooManyTo_003 8208 1.37 0.56 1.59 117 RCVD_IN_BL_SPAMCOP_NET 7680 3.88 12.45 1.49 118 XM_B_COVIDMETA 7512 1.95 3.73 1.45 119 IN_HORDE_ADDRESS_BOOK 7501 1.16 0.12 1.45 120 HELO_MISC_IP 7274 1.21 0.51 1.41 121 CK_HELO_DYNAMIC_SPLIT_IP 7246 1.22 0.56 1.40 122 INVALID_MSGID 7141 1.21 0.59 1.38 123 XMCapTrack 6423 1.05 0.36 1.24 124 XM_UB50 6360 2.19 5.62 1.23 125 XMBrknScrpt_02 6297 1.57 2.85 1.22 126 TM2_M_VERY_LONG_WORD 6273 1.30 1.60 1.21 127 TO_MALFORMED 6244 0.96 0.05 1.21 128 RCVD_IN_MSPIKE_BL 6178 2.51 7.21 1.20 129 XMStockSpam_06 6129 1.17 1.11 1.19 130 USER_IN_DEF_DKIM_WL 6122 0.93 0.00 1.19 131 XMGappySubj_01 6027 0.94 0.13 1.17 132 TooManyTo_004 5972 1.00 0.46 1.16 133 DKIM_ADSP_CUSTOM_MED 5965 1.16 1.19 1.16 134 XMBody_17 5929 1.69 3.63 1.15 135 XM_OfRef6 5855 1.27 1.77 1.13 136 XM_GoogleGroups 5847 0.94 0.27 1.13 137 XMGenDplmaNmb 5520 4.45 16.56 1.07 138 XM_H_Long_From02 5433 0.93 0.51 1.05 139 T_TooManySym_03 5407 0.85 0.15 1.05 140 T_FILL_THIS_FORM_SHORT 5174 1.02 1.09 1.00 141 RELAYCOUNTRY_GB 5027 1.47 3.26 0.97 142 TR_MSPIKEBAYES00 5027 0.76 0.01 0.97 143 SpammyFromTLD_01 5019 1.69 4.26 0.97 144 XM_ProductURIs 4680 0.79 0.39 0.91 145 TooManyTo_005 4635 0.77 0.33 0.90 146 XMHTML_After_End 4515 1.10 1.93 0.87 147 TR_MetaPhish_Combo_01 4431 0.82 0.70 0.86 148 XMNoVowels 4354 0.74 0.39 0.84 149 XMBody_95 4298 0.67 0.10 0.83 150 NML_ADSP_CUSTOM_MED 4273 0.88 1.08 0.83 151 XMBdyGiftCard01 4237 1.26 2.85 0.82 152 T_Symld_Words_02 4229 0.80 0.75 0.82 153 RCVD_IN_MSPIKE_L3 4142 1.45 3.79 0.80 154 XM_ShortIntro_01 4076 0.72 0.48 0.79 155 T_OBFU_PDF_ATTACH 3910 0.64 0.22 0.76 156 XM_RXBody 3898 0.64 0.24 0.75 157 T_XMDrugObfuBody_00 3851 0.99 1.88 0.75 158 HTTPS_HTTP_MISMATCH 3843 0.76 0.80 0.74 159 XMPhish14 3636 0.67 0.55 0.70 160 T_XMHurry_00 3612 0.77 1.01 0.70 161 XM_B_SpammyWords4 3603 0.86 1.45 0.70 162 XMSexyCombo_01 3572 0.84 1.35 0.69 163 XM_SPF_Unknown 3545 0.76 1.02 0.69 164 XM_H_Trusted_IP 3454 0.52 0.00 0.67 165 XM_DIRTYINTL 3387 1.32 3.70 0.66 166 HTML_FONT_FACE_BAD 3334 0.60 0.43 0.65 167 TR_BOTNET_NEGATE 3254 0.56 0.32 0.63 168 XMSubMetaI_00 3178 0.62 0.66 0.62 169 XMSubNoVowel 3137 0.62 0.66 0.61 170 RELAYCOUNTRY_DE 3087 0.86 1.81 0.60 171 XMMoneyMeta_00 3077 0.67 0.95 0.60 172 T_TooManySym_04 3047 0.47 0.06 0.59 173 FROM_GOV_SPOOF 2922 0.47 0.15 0.57 174 DKIM_ADSP_NXDOMAIN 2866 1.11 3.10 0.56 175 RDNS_DYNAMIC 2805 0.63 0.95 0.54 176 XM_H_PHPMailer 2775 0.55 0.59 0.54 177 FORGED_GMAIL_RCVD 2763 0.63 0.96 0.54 178 XMSubMetaSxObfu_03 2693 0.68 1.25 0.52 179 TR_XM_COVIDMETA4 2666 0.72 1.43 0.52 180 DIET_1 2648 0.55 0.67 0.51 181 XMHTMLBadTable_001 2623 0.49 0.41 0.51 182 XMSolicitRefs_0 2600 0.44 0.22 0.50 183 T_PDS_OTHER_BAD_TLD 2544 0.77 1.74 0.49 184 NUMERIC_HTTP_ADDR 2530 0.60 1.00 0.49 185 TM2_M_BODY_EMPTY 2511 0.40 0.08 0.49 186 TR_XM_COVIDMETA1 2500 0.74 1.66 0.48 187 XMBody_78 2498 0.53 0.69 0.48 188 NO_DNS_FOR_FROM 2458 1.29 4.21 0.48 189 RCVD_IN_SORBS_DUL 2412 0.40 0.18 0.47 190 HTML_TAG_BALANCE_BODY 2411 0.47 0.50 0.47 191 FROM_GOV_DKIM_AU 2389 0.40 0.19 0.46 192 MISSING_HEADERS 2381 0.57 0.96 0.46 193 HTML_IMAGE_ONLY_20 2357 1.99 7.49 0.46 194 XMSlimDrugH 2348 0.54 0.85 0.45 195 XM_S_SubURI 2278 0.35 0.03 0.44 196 RELAYCOUNTRY_NL 2265 0.52 0.81 0.44 197 SHORT_HELO_AND_INLINE_IMAGE 2254 0.36 0.10 0.44 198 XMLKML 2231 0.34 0.00 0.43 199 HTML_IMAGE_ONLY_32 2230 0.39 0.24 0.43 200 XMPhish08 2208 0.45 0.51 0.43 ----------------------------------------------------------------------