Email: 702153 Autolearn: 0 AvgScore: 2.43 AvgScanTime: 1.14 sec Spam: 147599 Autolearn: 0 AvgScore: 14.76 AvgScanTime: 1.04 sec Ham: 554554 Autolearn: 0 AvgScore: -0.85 AvgScanTime: 1.17 sec Time Spent Running SA: 222.94 hours Time Spent Processing Spam: 42.62 hours Time Spent Processing Ham: 180.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 140978 97.89 95.51 98.52 2 HTML_MESSAGE 138289 88.67 93.69 87.34 3 XM_B_SpammyWords 98007 53.31 66.40 49.82 4 XM_B_Unicode 93937 69.24 63.64 70.74 5 RELAYCOUNTRY_US 93203 77.39 63.15 81.18 6 DKIM_SIGNED 78983 72.81 53.51 77.95 7 MIME_HTML_ONLY 77267 26.68 52.35 19.85 8 XM_DK_Pass 76004 71.37 51.49 76.67 9 DKIM_VALID 73589 69.40 49.86 74.61 10 RCVD_IN_MSPIKE_H2 72307 31.88 48.99 27.33 11 XMListUnsubscribeExists 65366 52.49 44.29 54.68 12 XM_B_Unicode3 58663 40.00 39.74 40.07 13 DKIM_VALID_AU 54091 51.80 36.65 55.83 14 RELAYCOUNTRY_META 53193 11.86 36.04 5.43 15 XM_DK_Undo_02 50146 15.72 33.97 10.86 16 HTML_MIME_NO_HTML_TAG 49491 8.99 33.53 2.46 17 BAYES_99 48201 12.60 32.66 7.26 18 BAYES_50 47904 47.62 32.46 51.66 19 RCVD_IN_PSBL 47025 6.74 31.86 0.06 20 XM_B_Unsub 43718 14.13 29.62 10.00 21 XM_B_SpammyWords2 41290 23.90 27.97 22.81 22 RCVD_IN_BL_SPAMCOP_NET 40182 7.10 27.22 1.74 23 BOTNET 39304 7.28 26.63 2.13 24 XMSubLong 38361 22.18 25.99 21.16 25 BAYES_999 35595 9.62 24.12 5.76 26 UNTRUSTED_Relay 35541 6.82 24.08 2.23 27 FROM_EXCESS_BASE64 34997 7.24 23.71 2.85 28 DKIM_VALID_EF 34352 26.92 23.27 27.89 29 LOC_TINY_FONT_1 32776 24.23 22.21 24.77 30 XM_Multi_Part_URI 29671 14.31 20.10 12.77 31 HTML_FONT_LOW_CONTRAST 27440 26.18 18.59 28.20 32 FVGT_m_MULTI_ODD 26310 21.63 17.83 22.65 33 T_KAM_HTML_FONT_INVALID 25908 19.19 17.55 19.63 34 XM_UncommonTLD01 25757 6.24 17.45 3.26 35 XMSubGiftCard1 25696 3.69 17.41 0.04 36 T_TM2_M_HEADER_IN_MSG 24843 26.05 16.83 28.50 37 RCVD_IN_RP_RNBL 24055 3.47 16.30 0.06 38 XM_Body_Dirty_Words 20218 12.77 13.70 12.53 39 BOTNET_IPINHOSTNAME 18941 7.08 12.83 5.55 40 BAYES_60 18403 8.09 12.47 6.93 41 LOTS_OF_MONEY 17173 8.18 11.63 7.27 42 BAYES_80 16644 6.00 11.28 4.59 43 KHOP_HELO_FCRDNS 13637 3.20 9.24 1.59 44 RCVD_IN_MSPIKE_BL 12970 2.67 8.79 1.04 45 XM_B_SpammyWords3 12892 6.70 8.73 6.15 46 SpammyFromTLD_02 12874 2.15 8.72 0.40 47 RCVD_IN_MSPIKE_WL 12772 24.65 8.65 28.91 48 XMSexyCombo_05 12191 4.67 8.26 3.72 49 XM_UB50 12115 2.59 8.21 1.10 50 XM_B_Phish_Phrases 11719 6.64 7.94 6.29 51 HK_RANDOM_FROM 11669 1.77 7.91 0.14 52 MPART_ALT_DIFF 11617 4.54 7.87 3.66 53 T_REMOTE_IMAGE 10804 4.04 7.32 3.17 54 XM_Evil_Numbers_Gen 9952 8.21 6.74 8.60 55 MIME_HTML_MOSTLY 9687 3.08 6.56 2.15 56 RELAYCOUNTRY_CA 9569 2.69 6.48 1.68 57 BOTNET_NORDNS 8946 1.28 6.06 0.01 58 BAYES_95 8880 3.44 6.02 2.76 59 LotsOfNums_01 8392 8.63 5.69 9.41 60 SpammyFromTLD_01 8372 1.95 5.67 0.96 61 BODY_URI_ONLY 8235 1.22 5.58 0.06 62 XMSubMetaSx_00 8154 4.15 5.52 3.79 63 RCVD_IN_MSPIKE_L3 7842 1.67 5.31 0.71 64 RCVD_IN_MSPIKE_H3 7717 13.89 5.23 16.19 65 HTML_IMAGE_RATIO_02 7567 6.27 5.13 6.57 66 LOCALPART_IN_SUBJECT 7505 1.09 5.08 0.03 67 RELAYCOUNTRY_GB 7442 1.83 5.04 0.97 68 HTML_IMAGE_ONLY_16 7414 1.25 5.02 0.25 69 URI_PHP_REDIR 7382 1.06 5.00 0.02 70 TR_XM_PhishingBody 7115 3.80 4.82 3.53 71 XM_UB99 6938 1.00 4.70 0.01 72 T_FILL_THIS_FORM_SHORT 6603 1.68 4.47 0.94 73 XM_SPF_SoftFail 6542 2.40 4.43 1.87 74 XM_H_Long_From01 6208 5.25 4.21 5.53 75 RELAYCOUNTRY_FR 6107 1.16 4.14 0.37 76 HTML_FONT_TINY_NORDNS 6037 0.95 4.09 0.12 77 FROM_SUSPICIOUS_NTLD 5944 0.90 4.03 0.06 78 XM_UB60 5863 0.94 3.97 0.14 79 RELAYCOUNTRY_IN 5855 0.93 3.97 0.13 80 FROM_SUSPICIOUS_NTLD_FP 5847 0.87 3.96 0.05 81 SUBJ_ALL_CAPS 5746 2.45 3.89 2.07 82 XMNumbers 5722 3.59 3.88 3.52 83 HTML_IMAGE_RATIO_04 5708 4.54 3.87 4.72 84 DKIM_INVALID 5394 3.41 3.65 3.34 85 XM_UB80 5237 0.79 3.55 0.06 86 DKIM_ADSP_NXDOMAIN 5208 1.20 3.53 0.58 87 TooManyTo_001 5159 7.53 3.50 8.61 88 XM_OfRef6 5149 1.68 3.49 1.20 89 FROM_LOCAL_NOVOWEL 4923 0.72 3.34 0.02 90 UNPARSEABLE_RELAY 4873 7.02 3.30 8.01 91 XM_B_COVIDMETA 4857 1.82 3.29 1.43 92 XMBody_17 4828 1.55 3.27 1.10 93 XM_B_SpammyTLD 4823 2.30 3.27 2.04 94 URIBL_SBL_A 4791 0.87 3.25 0.24 95 XM_DIRTYINTL 4784 1.13 3.24 0.57 96 RCVD_IN_MSPIKE_H4 4702 9.06 3.19 10.62 97 T_HTML_TAG_BALANCE_CENTER 4685 0.82 3.17 0.19 98 HDRS_MISSP 4618 0.72 3.13 0.08 99 XMBody_50 4477 0.64 3.03 0.00 100 XM_UB999 4435 0.64 3.00 0.01 101 SHORTENED_URL_HREF 4339 0.89 2.94 0.34 102 TR_XM_MaxBayes 4306 0.67 2.92 0.07 103 XMStrtUSub 4260 3.95 2.89 4.23 104 XM_B_Phish66 4253 2.15 2.88 1.96 105 XMBdyGiftCard01 4220 1.08 2.86 0.60 106 T_XMDrugObfuBody_08 4153 2.01 2.81 1.79 107 HTML_IMAGE_ONLY_20 4068 0.90 2.76 0.40 108 RCVD_IN_MSPIKE_L5 3988 0.72 2.70 0.20 109 LH_URI_DOM_IN_PATH 3979 2.19 2.70 2.05 110 XM_CamelCaseFrm001 3933 2.19 2.66 2.07 111 XM_SendGrid 3900 6.32 2.64 7.30 112 TR_Mismatch_TLD_01 3868 0.76 2.62 0.26 113 HTML_SHORT_LINK_IMG_1 3830 0.57 2.59 0.03 114 HTML_IMAGE_ONLY_08 3824 0.63 2.59 0.11 115 T_TooManySym_01 3816 3.76 2.59 4.07 116 TM2_M_URI_OPT_OUT 3755 2.98 2.54 3.10 117 XMSubGiftCard2 3746 0.55 2.54 0.02 118 XMOffer 3710 0.55 2.51 0.03 119 SHORT_URI_3 3705 0.59 2.51 0.08 120 SHORT_SHORTNER 3648 0.53 2.47 0.01 121 SHORTENED_URL_SRC 3605 0.51 2.44 0.00 122 SHORTENER_SHORT_IMG 3593 0.51 2.43 0.00 123 FVGT_m_MULTI_ODD_EMAIL 3516 0.53 2.38 0.04 124 T_XMHurry_00 3478 1.09 2.36 0.75 125 HTML_IMAGE_RATIO_06 3455 3.39 2.34 3.67 126 TR_XM_FormFill 3343 0.50 2.26 0.03 127 TR_XM_SB_Phish 3241 2.00 2.20 1.95 128 XM_B_SpammyWords4 3224 1.06 2.18 0.76 129 XM_B_Unsub2 3200 2.32 2.17 2.35 130 RELAYCOUNTRY_NL 3163 0.61 2.14 0.21 131 XM_BadFromFormat 3144 0.61 2.13 0.20 132 XMSubPhish11 3127 1.95 2.12 1.91 133 TR_XM_MaxSPIKE 3098 0.51 2.10 0.08 134 XM_UB95 3079 0.47 2.09 0.04 135 XM_URI_RBL 3018 0.58 2.04 0.19 136 TR_XM_PHPDW 2925 0.71 1.98 0.37 137 TR_XM_PHPForged 2856 0.69 1.93 0.35 138 TR_XM_FormFill2 2843 0.68 1.93 0.35 139 XM_H_PHPOS 2838 0.68 1.92 0.35 140 TR_LOTS_OF_MONEY3 2767 0.88 1.87 0.62 141 XMDiploma_00 2747 1.71 1.86 1.68 142 T_XMDrugObfuBody_00 2614 0.97 1.77 0.75 143 XMBrknScrpt_02 2596 1.21 1.76 1.07 144 BAYES_40 2592 4.38 1.76 5.08 145 XM_JunkDunk 2585 0.37 1.75 0.00 146 TR_XM_COVIDMETA4 2561 0.73 1.74 0.46 147 RELAYCOUNTRY_JP 2530 0.39 1.71 0.04 148 BAYES_20 2468 4.64 1.67 5.43 149 RELAYCOUNTRY_IE 2439 0.49 1.65 0.18 150 TR_XM_RelayPhish 2427 0.46 1.64 0.14 151 TM2_M_VERY_LONG_WORD 2413 1.25 1.63 1.15 152 RELAYCOUNTRY_DE 2411 0.72 1.63 0.48 153 ALL_TRUSTED 2401 11.89 1.63 14.63 154 XMSexyCombo_01 2388 0.90 1.62 0.70 155 MIME_QP_LONG_LINE 2384 5.10 1.62 6.02 156 URI_HEX 2366 1.50 1.60 1.48 157 XM_CreditScore_03 2314 0.37 1.57 0.05 158 TR_XM_UnparsRelay 2296 0.70 1.56 0.47 159 TR_Caps_n_Bayes_99 2287 0.68 1.55 0.45 160 T_DEAR_BENEFICIARY 2257 0.33 1.53 0.01 161 DKIM_ADSP_CUSTOM_MED 2170 1.21 1.47 1.14 162 TO_NAME_SUBJ_NO_RDNS 2153 0.31 1.46 0.01 163 XM_OfRef7 2151 0.43 1.46 0.15 164 XMStockSpam_06 2145 0.95 1.45 0.82 165 T_XMDrugObfuBody_14 2117 1.46 1.43 1.46 166 TR_XM_INV_DKIM 2097 0.42 1.42 0.16 167 XMMoneyMeta_00 2045 0.95 1.39 0.83 168 TR_XM_COVIDMETA1 2026 0.54 1.37 0.32 169 NML_ADSP_CUSTOM_MED 2023 0.89 1.37 0.76 170 URI_TRY_3LD 2021 1.30 1.37 1.28 171 HTML_IMAGE_RATIO_08 1993 2.17 1.35 2.39 172 DATE_IN_PAST_03_06 1980 0.36 1.34 0.10 173 MIME_HTML_ONLY_MULTI 1976 1.84 1.34 1.97 174 MISSING_HEADERS 1935 0.62 1.31 0.43 175 XMHTML_After_End 1923 0.92 1.30 0.82 176 XM_S_SpammyWords 1917 0.55 1.30 0.35 177 T_Symld_Words_02 1915 0.86 1.30 0.74 178 TR_XM_Spammywords 1914 0.55 1.30 0.35 179 TR_Symld_Words 1912 1.87 1.30 2.03 180 RELAYCOUNTRY_KR 1814 0.28 1.23 0.02 181 FORGED_GMAIL_RCVD 1783 0.74 1.21 0.62 182 RELAYCOUNTRY_CN 1736 0.29 1.18 0.06 183 XMGenDplmaNmb 1732 1.01 1.17 0.97 184 TR_XM_DK_SendGrid 1729 3.61 1.17 4.26 185 RELAYCOUNTRY_AE 1724 0.25 1.17 0.00 186 RCVD_IN_IADB_LISTED 1685 4.37 1.14 5.23 187 RELAYCOUNTRY_HK 1669 0.27 1.13 0.04 188 TR_Mismatch_TLD_02 1657 0.31 1.12 0.10 189 MAILING_LIST_MULTI 1652 2.08 1.12 2.33 190 REPLYTO_WITHOUT_TO_CC 1596 0.29 1.08 0.07 191 TR_XM_SpoofStaff 1569 0.29 1.06 0.08 192 XMSpoofStaff2 1547 0.28 1.05 0.08 193 URI_NOVOWEL 1525 2.21 1.03 2.52 194 T_PDS_OTHER_BAD_TLD 1504 0.53 1.02 0.40 195 XMSubMetaSxObfu_03 1478 0.59 1.00 0.49 196 ACT_NOW_CAPS 1462 0.26 0.99 0.06 197 XMSubMetaD_00 1416 0.27 0.96 0.09 198 RCVD_IN_IADB_SPF 1403 3.79 0.95 4.54 199 MPART_ALT_DIFF_COUNT 1382 0.55 0.94 0.45 200 BAYES_00 1369 11.00 0.93 13.69 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 546334 97.89 95.51 98.52 2 HTML_MESSAGE 484332 88.67 93.69 87.34 3 RELAYCOUNTRY_US 450201 77.39 63.15 81.18 4 DKIM_SIGNED 432256 72.81 53.51 77.95 5 XM_DK_Pass 425149 71.37 51.49 76.67 6 DKIM_VALID 413731 69.40 49.86 74.61 7 XM_B_Unicode 392265 69.24 63.64 70.74 8 DKIM_VALID_AU 309609 51.80 36.65 55.83 9 XMListUnsubscribeExists 303222 52.49 44.29 54.68 10 BAYES_50 286481 47.62 32.46 51.66 11 XM_B_SpammyWords 276288 53.31 66.40 49.82 12 XM_B_Unicode3 222183 40.00 39.74 40.07 13 RCVD_IN_MSPIKE_WL 160338 24.65 8.65 28.91 14 T_TM2_M_HEADER_IN_MSG 158047 26.05 16.83 28.50 15 HTML_FONT_LOW_CONTRAST 156378 26.18 18.59 28.20 16 DKIM_VALID_EF 154664 26.92 23.27 27.89 17 RCVD_IN_MSPIKE_H2 151569 31.88 48.99 27.33 18 LOC_TINY_FONT_1 137384 24.23 22.21 24.77 19 XM_B_SpammyWords2 126495 23.90 27.97 22.81 20 FVGT_m_MULTI_ODD 125583 21.63 17.83 22.65 21 XMSubLong 117356 22.18 25.99 21.16 22 MIME_HTML_ONLY 110082 26.68 52.35 19.85 23 T_KAM_HTML_FONT_INVALID 108869 19.19 17.55 19.63 24 RCVD_IN_MSPIKE_H3 89788 13.89 5.23 16.19 25 ALL_TRUSTED 81104 11.89 1.63 14.63 26 BAYES_00 75892 11.00 0.93 13.69 27 XM_Multi_Part_URI 70825 14.31 20.10 12.77 28 XM_Body_Dirty_Words 69474 12.77 13.70 12.53 29 XM_DK_Undo_02 60229 15.72 33.97 10.86 30 RCVD_IN_MSPIKE_H4 58894 9.06 3.19 10.62 31 XM_B_Unsub 55478 14.13 29.62 10.00 32 TR_XM_DK_Bayes 55015 7.90 0.32 9.92 33 TR_XM_DK_Bayes1 53115 7.63 0.31 9.58 34 LotsOfNums_01 52198 8.63 5.69 9.41 35 TooManyTo_001 47727 7.53 3.50 8.61 36 XM_Evil_Numbers_Gen 47669 8.21 6.74 8.60 37 TR_XM_DK_Bayes2 47096 6.75 0.21 8.49 38 UNPARSEABLE_RELAY 44419 7.02 3.30 8.01 39 RCVD_IN_RP_SAFE 42324 6.07 0.19 7.63 40 XM_SendGrid 40473 6.32 2.64 7.30 41 LOTS_OF_MONEY 40293 8.18 11.63 7.27 42 BAYES_99 40243 12.60 32.66 7.26 43 RCVD_IN_RP_CERTIFIED 39820 5.69 0.10 7.18 44 BAYES_60 38413 8.09 12.47 6.93 45 XM_DKIMWhitelistDomains 36919 5.26 0.00 6.66 46 HTML_IMAGE_RATIO_02 36438 6.27 5.13 6.57 47 XM_B_Phish_Phrases 34881 6.64 7.94 6.29 48 XM_B_SpammyWords3 34119 6.70 8.73 6.15 49 MIME_QP_LONG_LINE 33401 5.10 1.62 6.02 50 IN_ZIMBRA_NJ_WHITELIST 32202 4.59 0.04 5.81 51 BAYES_999 31940 9.62 24.12 5.76 52 BOTNET_IPINHOSTNAME 30758 7.08 12.83 5.55 53 XM_H_Long_From01 30676 5.25 4.21 5.53 54 BAYES_20 30132 4.64 1.67 5.43 55 RELAYCOUNTRY_META 30115 11.86 36.04 5.43 56 RCVD_IN_IADB_LISTED 29011 4.37 1.14 5.23 57 ANY_BOUNCE_MESSAGE 28182 4.13 0.54 5.08 58 BAYES_40 28180 4.38 1.76 5.08 59 BOUNCE_MESSAGE 28176 4.13 0.54 5.08 60 HTML_IMAGE_RATIO_04 26188 4.54 3.87 4.72 61 BAYES_80 25458 6.00 11.28 4.59 62 RCVD_IN_IADB_SPF 25203 3.79 0.95 4.54 63 TR_XM_DK_SendGrid 23648 3.61 1.17 4.26 64 XMStrtUSub 23476 3.95 2.89 4.23 65 XM_PDF 22906 3.45 0.90 4.13 66 T_TooManySym_01 22587 3.76 2.59 4.07 67 RCVD_IN_IADB_SENDERID 22485 3.38 0.85 4.05 68 RCVD_IN_IADB_DK 21780 3.28 0.84 3.93 69 XMSubMetaSx_00 21013 4.15 5.52 3.79 70 XMSexyCombo_05 20624 4.67 8.26 3.72 71 HTML_IMAGE_RATIO_06 20373 3.39 2.34 3.67 72 MPART_ALT_DIFF 20275 4.54 7.87 3.66 73 TR_XM_PhishingBody 19553 3.80 4.82 3.53 74 XMNumbers 19499 3.59 3.88 3.52 75 DKIM_INVALID 18525 3.41 3.65 3.34 76 RCVD_IN_IADB_VOUCHED 18115 2.72 0.65 3.27 77 XM_UncommonTLD01 18088 6.24 17.45 3.26 78 T_REMOTE_IMAGE 17575 4.04 7.32 3.17 79 TM2_M_URI_OPT_OUT 17170 2.98 2.54 3.10 80 FROM_EXCESS_BASE64 15812 7.24 23.71 2.85 81 BAYES_95 15297 3.44 6.02 2.76 82 BAYES_05 14453 2.22 0.77 2.61 83 URI_NOVOWEL 13987 2.21 1.03 2.52 84 HTML_MIME_NO_HTML_TAG 13625 8.99 33.53 2.46 85 HTML_IMAGE_RATIO_08 13232 2.17 1.35 2.39 86 XM_B_Unsub2 13058 2.32 2.17 2.35 87 MAILING_LIST_MULTI 12935 2.08 1.12 2.33 88 UNTRUSTED_Relay 12363 6.82 24.08 2.23 89 RCVD_IN_IADB_OPTIN 12051 1.82 0.50 2.17 90 T_TooManySym_02 11926 1.80 0.49 2.15 91 MIME_HTML_MOSTLY 11921 3.08 6.56 2.15 92 BOTNET 11806 7.28 26.63 2.13 93 RCVD_IN_MSPIKE_H5 11656 1.71 0.24 2.10 94 SUBJ_ALL_CAPS 11488 2.45 3.89 2.07 95 XM_CamelCaseFrm001 11474 2.19 2.66 2.07 96 LH_URI_DOM_IN_PATH 11387 2.19 2.70 2.05 97 XM_B_SpammyTLD 11336 2.30 3.27 2.04 98 TR_Symld_Words 11233 1.87 1.30 2.03 99 MIME_HTML_ONLY_MULTI 10923 1.84 1.34 1.97 100 TooManyTo_002 10875 1.69 0.69 1.96 101 XM_B_Phish66 10845 2.15 2.88 1.96 102 TR_XM_SB_Phish 10837 2.00 2.20 1.95 103 XMSubPhish11 10593 1.95 2.12 1.91 104 XM_SPF_SoftFail 10343 2.40 4.43 1.87 105 T_XMDrugObfuBody_08 9944 2.01 2.81 1.79 106 XM_DK_Undo_01 9681 1.50 0.58 1.75 107 RCVD_IN_BL_SPAMCOP_NET 9672 7.10 27.22 1.74 108 RELAYCOUNTRY_CA 9316 2.69 6.48 1.68 109 XMDiploma_00 9290 1.71 1.86 1.68 110 TVD_RCVD_IP 9018 1.32 0.18 1.63 111 KHOP_HELO_FCRDNS 8822 3.20 9.24 1.59 112 URI_HEX 8194 1.50 1.60 1.48 113 T_XMDrugObfuBody_14 8103 1.46 1.43 1.46 114 HELO_NODOT 7987 1.30 0.78 1.44 115 HELO_NO_DOMAIN 7984 1.30 0.78 1.44 116 XM_B_COVIDMETA 7956 1.82 3.29 1.43 117 IN_HORDE_ADDRESS_BOOK 7442 1.08 0.11 1.34 118 HELO_MISC_IP 7308 1.13 0.43 1.32 119 CK_HELO_DYNAMIC_SPLIT_IP 7298 1.15 0.52 1.32 120 INVALID_MSGID 7284 1.10 0.29 1.31 121 XM_H_Long_From02 7180 1.20 0.84 1.29 122 TooManyTo_003 7108 1.12 0.53 1.28 123 URI_TRY_3LD 7078 1.30 1.37 1.28 124 XMGappySubj_01 7000 1.03 0.16 1.26 125 XM_OfRef6 6662 1.68 3.49 1.20 126 TR_MSPIKEBAYES00 6523 0.93 0.01 1.18 127 XMCapTrack 6392 0.99 0.38 1.15 128 TO_MALFORMED 6381 0.91 0.03 1.15 129 TM2_M_VERY_LONG_WORD 6355 1.25 1.63 1.15 130 DKIM_ADSP_CUSTOM_MED 6307 1.21 1.47 1.14 131 XM_UB50 6103 2.59 8.21 1.10 132 XMBody_17 6076 1.55 3.27 1.10 133 XM_GoogleGroups 6047 0.92 0.28 1.09 134 XMBrknScrpt_02 5907 1.21 1.76 1.07 135 RCVD_IN_MSPIKE_BL 5761 2.67 8.79 1.04 136 USER_IN_DEF_DKIM_WL 5713 0.81 0.00 1.03 137 RELAYCOUNTRY_GB 5404 1.83 5.04 0.97 138 XMGenDplmaNmb 5361 1.01 1.17 0.97 139 SpammyFromTLD_01 5301 1.95 5.67 0.96 140 TooManyTo_004 5234 0.85 0.48 0.94 141 T_FILL_THIS_FORM_SHORT 5211 1.68 4.47 0.94 142 T_TooManySym_03 4921 0.73 0.13 0.89 143 XMMoneyMeta_00 4607 0.95 1.39 0.83 144 XMHTML_After_End 4548 0.92 1.30 0.82 145 XMStockSpam_06 4532 0.95 1.45 0.82 146 XM_ProductURIs 4387 0.76 0.62 0.79 147 HTTPS_HTTP_MISMATCH 4279 0.76 0.70 0.77 148 TooManyTo_005 4224 0.67 0.31 0.76 149 XM_B_SpammyWords4 4220 1.06 2.18 0.76 150 TR_MetaPhish_Combo_01 4217 0.78 0.87 0.76 151 NML_ADSP_CUSTOM_MED 4199 0.89 1.37 0.76 152 T_XMDrugObfuBody_00 4175 0.97 1.77 0.75 153 T_XMHurry_00 4151 1.09 2.36 0.75 154 T_Symld_Words_02 4127 0.86 1.30 0.74 155 XMBody_95 3990 0.58 0.07 0.72 156 RCVD_IN_MSPIKE_L3 3919 1.67 5.31 0.71 157 XMSexyCombo_01 3899 0.90 1.62 0.70 158 XMPhish30 3734 0.66 0.62 0.67 159 XM_ShortIntro_01 3732 0.61 0.36 0.67 160 XMHTMLBadTable_001 3610 0.57 0.28 0.65 161 XMSubMetaI_00 3528 0.63 0.62 0.64 162 XM_SPF_Unknown 3527 0.66 0.77 0.64 163 FROM_GOV_DKIM_AU 3513 0.52 0.08 0.63 164 FORGED_GMAIL_RCVD 3438 0.74 1.21 0.62 165 TR_LOTS_OF_MONEY3 3424 0.88 1.87 0.62 166 XMBdyGiftCard01 3342 1.08 2.86 0.60 167 XMNoVowels 3301 0.55 0.39 0.60 168 T_OBFU_PDF_ATTACH 3298 0.50 0.13 0.59 169 DKIM_ADSP_NXDOMAIN 3225 1.20 3.53 0.58 170 XM_DIRTYINTL 3150 1.13 3.24 0.57 171 HTML_TAG_BALANCE_BODY 3125 0.56 0.56 0.56 172 TR_BOTNET_NEGATE 3079 0.56 0.59 0.56 173 HTML_FONT_FACE_BAD 3004 0.52 0.44 0.54 174 XMBody_78 2864 0.59 0.87 0.52 175 XMSubNoVowel 2789 0.56 0.76 0.50 176 XMPhish08 2768 0.53 0.65 0.50 177 XMSubMetaSxObfu_03 2690 0.59 1.00 0.49 178 RELAYCOUNTRY_DE 2675 0.72 1.63 0.48 179 TR_XM_UnparsRelay 2629 0.70 1.56 0.47 180 DIET_1 2627 0.48 0.50 0.47 181 XM_H_Trusted_IP 2615 0.37 0.00 0.47 182 XM_H_PHPMailer 2614 0.51 0.65 0.47 183 RDNS_DYNAMIC 2610 0.55 0.84 0.47 184 XM_B_REG_HTML 2591 0.38 0.06 0.47 185 RELAYCOUNTRY_AU 2575 0.56 0.91 0.46 186 FROM_GOV_SPOOF 2552 0.38 0.10 0.46 187 TR_XM_COVIDMETA4 2543 0.73 1.74 0.46 188 T_TooManySym_04 2534 0.37 0.03 0.46 189 XM_B_COPY_HTML 2513 0.44 0.39 0.45 190 TR_Caps_n_Bayes_99 2509 0.68 1.55 0.45 191 MPART_ALT_DIFF_COUNT 2478 0.55 0.94 0.45 192 XMSolicitRefs_0 2454 0.41 0.29 0.44 193 NO_DNS_FOR_FROM 2444 0.45 0.47 0.44 194 MISSING_HEADERS 2389 0.62 1.31 0.43 195 THIS_AD 2361 0.42 0.40 0.43 196 BASE64_LENGTH_79_INF 2356 0.40 0.31 0.42 197 NUMERIC_HTTP_ADDR 2306 0.43 0.50 0.42 198 XM_S_SubURI 2303 0.34 0.06 0.42 199 RCVD_IN_SORBS_DUL 2268 0.36 0.18 0.41 200 XMPhish14 2264 0.49 0.82 0.41 ----------------------------------------------------------------------