Email: 656702 Autolearn: 0 AvgScore: 1.44 AvgScanTime: 1.08 sec Spam: 112938 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 1.17 sec Ham: 543764 Autolearn: 0 AvgScore: -0.95 AvgScanTime: 1.06 sec Time Spent Running SA: 197.08 hours Time Spent Processing Spam: 36.62 hours Time Spent Processing Ham: 160.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 110420 98.51 97.77 98.66 2 HTML_MESSAGE 105462 87.98 93.38 86.86 3 DKIM_SIGNED 89482 78.23 79.23 78.02 4 XM_DK_Pass 85852 76.65 76.02 76.79 5 DKIM_VALID 83783 74.57 74.18 74.65 6 XM_B_Unicode 78925 70.30 69.88 70.38 7 XMListUnsubscribeExists 76806 54.56 68.01 51.77 8 RELAYCOUNTRY_US 73476 78.61 65.06 81.43 9 XM_B_SpammyWords 69222 52.01 61.29 50.08 10 DKIM_VALID_AU 64584 56.87 57.19 56.80 11 XM_DK_Undo_02 59852 18.94 53.00 11.86 12 BAYES_99 46631 13.72 41.29 7.99 13 DKIM_VALID_EF 41850 31.23 37.06 30.03 14 XM_B_SpammyWords2 38640 24.52 34.21 22.51 15 LOC_TINY_FONT_1 37628 26.45 33.32 25.02 16 RELAYCOUNTRY_META 37461 9.91 33.17 5.08 17 XM_B_Unicode3 37114 38.42 32.86 39.57 18 BAYES_50 36337 49.75 32.17 53.40 19 BAYES_999 35201 10.82 31.17 6.59 20 HTML_FONT_LOW_CONTRAST 32904 28.36 29.13 28.20 21 MIME_HTML_ONLY 32461 21.80 28.74 20.36 22 BOTNET 29467 6.29 26.09 2.18 23 UNTRUSTED_Relay 29073 6.76 25.74 2.81 24 RCVD_IN_MSPIKE_H2 28526 26.92 25.26 27.26 25 XMSubLong 27917 21.10 24.72 20.34 26 XM_UncommonTLD01 27317 6.85 24.19 3.24 27 FVGT_m_MULTI_ODD 26098 22.84 23.11 22.78 28 T_KAM_HTML_FONT_INVALID 25312 19.28 22.41 18.63 29 XM_Multi_Part_URI 24316 13.58 21.53 11.93 30 T_TM2_M_HEADER_IN_MSG 23467 27.92 20.78 29.40 31 LOTS_OF_MONEY 22525 10.76 19.94 8.85 32 XM_Body_Dirty_Words 18943 13.90 16.77 13.31 33 MPART_ALT_DIFF 16833 5.67 14.90 3.75 34 RCVD_IN_MSPIKE_BL 16528 4.08 14.63 1.89 35 BOTNET_IPINHOSTNAME 15935 6.77 14.11 5.25 36 MIME_HTML_MOSTLY 15204 4.16 13.46 2.22 37 URI_PHP_REDIR 13697 2.11 12.13 0.02 38 XMSexyCombo_05 12891 5.87 11.41 4.71 39 XM_B_SpammyWords3 12192 6.60 10.80 5.73 40 RCVD_IN_MSPIKE_WL 12103 24.85 10.72 27.78 41 RCVD_IN_BL_SPAMCOP_NET 12024 3.39 10.65 1.88 42 XM_B_Phish_Phrases 12011 7.47 10.64 6.81 43 SpammyFromTLD_02 11057 1.90 9.79 0.26 44 XM_B_Unsub 10987 11.34 9.73 11.68 45 SpammyFromTLD_01 10922 2.43 9.67 0.92 46 RCVD_IN_MSPIKE_L3 10234 2.16 9.06 0.73 47 XM_UB50 9931 3.07 8.79 1.88 48 XMBrknScrpt_02 9807 2.88 8.68 1.68 49 BAYES_80 9299 5.11 8.23 4.46 50 RELAYCOUNTRY_FR 9068 1.59 8.03 0.25 51 T_REMOTE_IMAGE 8618 4.43 7.63 3.76 52 HTML_IMAGE_RATIO_02 8569 6.78 7.59 6.62 53 XMSubMetaSx_00 8503 4.40 7.53 3.75 54 XM_Evil_Numbers_Gen 7787 8.90 6.89 9.31 55 BAYES_60 7635 6.76 6.76 6.76 56 XMBody_17 7616 2.35 6.74 1.44 57 RELAYCOUNTRY_CA 7503 2.67 6.64 1.84 58 TR_XM_PhishingBody 7413 3.63 6.56 3.02 59 TooManyTo_001 6958 7.91 6.16 8.28 60 XM_UB99 6937 1.07 6.14 0.01 61 XM_SPF_SoftFail 6833 2.58 6.05 1.85 62 HTML_IMAGE_RATIO_06 6741 4.07 5.97 3.68 63 LotsOfNums_01 6558 7.84 5.81 8.27 64 BAYES_95 6370 3.30 5.64 2.82 65 RCVD_IN_MSPIKE_H3 6330 13.96 5.60 15.69 66 XM_H_Long_From01 6025 5.09 5.33 5.04 67 XMNumbers 6006 3.96 5.32 3.68 68 XM_DIRTYINTL 5707 1.31 5.05 0.54 69 DKIM_INVALID 5699 3.66 5.05 3.37 70 RCVD_IN_RP_RNBL 5605 0.90 4.96 0.06 71 BODY_URI_ONLY 5593 0.89 4.95 0.05 72 UNPARSEABLE_RELAY 5527 7.28 4.89 7.78 73 FROM_SUSPICIOUS_NTLD 5496 0.89 4.87 0.07 74 RCVD_IN_MSPIKE_H4 5438 9.26 4.82 10.18 75 URIBL_SBL_A 5412 1.03 4.79 0.25 76 XM_B_SpammyTLD 5384 2.51 4.77 2.04 77 KHOP_HELO_FCRDNS 5342 2.06 4.73 1.51 78 FROM_SUSPICIOUS_NTLD_FP 5340 0.86 4.73 0.06 79 BOTNET_NORDNS 5293 0.86 4.69 0.06 80 XM_B_COVIDMETA 5233 2.09 4.63 1.56 81 RCVD_IN_MSPIKE_L5 4934 0.97 4.37 0.26 82 TR_XM_MaxBayes 4917 0.78 4.35 0.04 83 TR_XM_MaxSPIKE 4861 0.82 4.30 0.10 84 RELAYCOUNTRY_IN 4755 0.82 4.21 0.11 85 XM_OfRef6 4688 1.93 4.15 1.47 86 TR_LOTS_OF_MONEY3 4584 1.80 4.06 1.33 87 SUBJ_ALL_CAPS 4555 1.90 4.03 1.46 88 HTML_IMAGE_RATIO_04 4465 4.77 3.95 4.94 89 XM_SendGrid 4306 6.53 3.81 7.10 90 XM_B_Phish66 4218 2.12 3.73 1.78 91 HTML_MIME_NO_HTML_TAG 4064 2.47 3.60 2.23 92 FROM_EXCESS_BASE64 3989 2.98 3.53 2.87 93 T_PDS_OTHER_BAD_TLD 3981 0.99 3.52 0.46 94 URI_TRY_3LD 3850 1.94 3.41 1.63 95 T_XMDrugObfuBody_08 3837 1.96 3.40 1.66 96 XM_UB999 3792 0.59 3.36 0.01 97 HTML_IMAGE_RATIO_08 3740 2.49 3.31 2.32 98 XM_UB60 3731 0.66 3.30 0.12 99 TR_Symld_Words 3713 2.10 3.29 1.85 100 RCVD_IN_PSBL 3661 0.59 3.24 0.03 101 TM2_M_URI_OPT_OUT 3510 3.29 3.11 3.32 102 HTML_IMAGE_ONLY_08 3493 0.67 3.09 0.16 103 SHORT_SHORTNER 3482 0.54 3.08 0.01 104 SHORT_URI_3 3467 0.59 3.07 0.07 105 HTML_SHORT_LINK_IMG_1 3451 0.55 3.06 0.03 106 SHORTENED_URL_SRC 3397 0.52 3.01 0.01 107 SHORTENER_SHORT_IMG 3383 0.52 3.00 0.00 108 T_FILL_THIS_FORM_SHORT 3332 1.23 2.95 0.87 109 XM_UB80 3255 0.53 2.88 0.04 110 XMStrtUSub 3245 4.16 2.87 4.43 111 XM_URI_RBL 3029 0.65 2.68 0.22 112 XMDiploma_00 2986 2.43 2.64 2.39 113 TR_XM_UnparsRelay 2953 0.89 2.61 0.53 114 XM_UB95 2854 0.45 2.53 0.02 115 RELAYCOUNTRY_DE 2833 0.78 2.51 0.43 116 TR_XM_SB_Phish 2813 2.21 2.49 2.15 117 T_TooManySym_01 2770 4.82 2.45 5.31 118 TR_XM_PHPDW 2732 0.75 2.42 0.40 119 TR_XM_PHPForged 2703 0.73 2.39 0.38 120 TR_XM_FormFill2 2681 0.73 2.37 0.38 121 XM_H_PHPOS 2678 0.72 2.37 0.38 122 XMSubPhish11 2672 2.16 2.37 2.11 123 DKIM_ADSP_NXDOMAIN 2662 1.08 2.36 0.81 124 XM_CamelCaseFrm001 2550 1.66 2.26 1.54 125 T_XMHurry_00 2548 1.04 2.26 0.79 126 T_FONT_INVIS_MSGID 2486 1.03 2.20 0.79 127 XMSexyCombo_01 2442 0.85 2.16 0.58 128 XM_B_SpammyWords4 2421 0.92 2.14 0.67 129 ALL_TRUSTED 2418 11.85 2.14 13.87 130 XMHTML_After_End 2365 1.00 2.09 0.77 131 T_HTML_TAG_BALANCE_CENTER 2327 0.48 2.06 0.16 132 BAYES_40 2273 4.28 2.01 4.75 133 TR_XM_RelayPhish 2266 0.46 2.01 0.14 134 XM_B_Unsub2 2237 3.26 1.98 3.53 135 LongTLD 2219 0.52 1.96 0.21 136 TR_XM_DK_SendGrid 2196 3.78 1.94 4.16 137 TR_Caps_n_Bayes_99 2193 0.38 1.94 0.06 138 T_XMDrugObfuBody_14 2163 1.55 1.92 1.47 139 TR_XM_COVIDMETA4 2059 0.72 1.82 0.49 140 TR_XM_COVIDMETA1 2047 0.55 1.81 0.28 141 MISSING_HEADERS 2045 1.37 1.81 1.27 142 HDRS_MISSP 2043 0.36 1.81 0.06 143 XM_BadFromFormat 2039 0.45 1.81 0.17 144 TR_XM_INV_DKIM 2029 0.42 1.80 0.14 145 T_XMDrugObfuBody_00 2015 0.75 1.78 0.54 146 HELO_NODOT 1962 2.29 1.74 2.40 147 HELO_NO_DOMAIN 1962 2.29 1.74 2.40 148 DKIM_ADSP_CUSTOM_MED 1955 1.14 1.73 1.01 149 RELAYCOUNTRY_GB 1943 0.96 1.72 0.81 150 XMSubNoVowel 1932 0.83 1.71 0.65 151 URI_NO_WWW_BIZ_CGI 1906 0.30 1.69 0.01 152 MIME_QP_LONG_LINE 1895 4.61 1.68 5.22 153 URI_HEX 1890 1.63 1.67 1.62 154 BAYES_20 1884 3.92 1.67 4.39 155 TM2_M_VERY_LONG_WORD 1863 1.38 1.65 1.32 156 SUBJ_OBFU_PUNCT_FEW 1821 0.33 1.61 0.06 157 NML_ADSP_CUSTOM_MED 1807 0.88 1.60 0.73 158 RDNS_DYNAMIC 1794 0.64 1.59 0.45 159 XM_PDF 1690 4.73 1.50 5.40 160 MIME_HTML_ONLY_MULTI 1662 2.03 1.47 2.14 161 XMSubMetaSxObfu_03 1641 0.68 1.45 0.52 162 FORGED_GMAIL_RCVD 1633 0.67 1.45 0.50 163 XM_S_SpammyWords 1621 0.50 1.44 0.31 164 TR_XM_Spammywords 1619 0.50 1.43 0.31 165 XMStockSpam_06 1614 1.31 1.43 1.28 166 MIME_CHARSET_FARAWAY 1594 0.35 1.41 0.13 167 XMGenDplmaNmb 1592 1.00 1.41 0.91 168 DATE_IN_PAST_06_12 1571 0.35 1.39 0.14 169 BAYES_00 1460 11.01 1.29 13.03 170 TM2_M_A_HREF_HREF 1457 0.53 1.29 0.37 171 URI_NOVOWEL 1445 2.27 1.28 2.47 172 SPOOFED_URL 1422 0.80 1.26 0.71 173 CHARSET_FARAWAY_HEADER 1402 0.26 1.24 0.05 174 XMPhish08 1400 0.55 1.24 0.41 175 XMBody_50 1352 0.21 1.20 0.00 176 RELAYCOUNTRY_CN 1343 0.26 1.19 0.07 177 XMSexyCombo_04 1337 0.34 1.18 0.16 178 RCVD_IN_IADB_LISTED 1305 4.28 1.16 4.92 179 SHORT_URI_2 1295 0.22 1.15 0.03 180 SPOOFED_URL_HOST 1284 0.72 1.14 0.63 181 XM_OfRef7 1279 0.32 1.13 0.15 182 XMBody_78 1279 0.56 1.13 0.44 183 REMOVE_BEFORE_LINK 1274 0.42 1.13 0.27 184 TR_Mismatch_TLD_02 1240 0.26 1.10 0.08 185 XMSubMetaSSx_00 1233 0.34 1.09 0.19 186 MAILING_LIST_MULTI 1228 2.26 1.09 2.51 187 INVALID_MSGID 1226 1.30 1.09 1.35 188 HTTPS_HTTP_MISMATCH 1222 0.86 1.08 0.82 189 DATE_IN_PAST_03_06 1222 0.28 1.08 0.11 190 T_Symld_Words_02 1218 0.57 1.08 0.46 191 XMPhish14 1201 0.57 1.06 0.47 192 PDS_RDNS_DYNAMIC_FP 1174 0.22 1.04 0.05 193 XMGppyBdWords 1160 0.31 1.03 0.16 194 RELAYCOUNTRY_NL 1156 0.37 1.02 0.24 195 XM_TLDProd2 1142 0.32 1.01 0.17 196 URIBL_DBL_SPAM 1141 0.18 1.01 0.01 197 TR_MetaPhish_Combo_01 1129 0.80 1.00 0.75 198 RCVD_IN_IADB_SPF 1111 3.69 0.98 4.26 199 XM_H_TOP 1082 0.17 0.96 0.00 200 TR_Mismatch_TLD_01 1068 0.33 0.95 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 536465 98.51 97.77 98.66 2 HTML_MESSAGE 472334 87.98 93.38 86.86 3 RELAYCOUNTRY_US 442773 78.61 65.06 81.43 4 DKIM_SIGNED 424263 78.23 79.23 78.02 5 XM_DK_Pass 417534 76.65 76.02 76.79 6 DKIM_VALID 405919 74.57 74.18 74.65 7 XM_B_Unicode 382711 70.30 69.88 70.38 8 DKIM_VALID_AU 308869 56.87 57.19 56.80 9 BAYES_50 290344 49.75 32.17 53.40 10 XMListUnsubscribeExists 281501 54.56 68.01 51.77 11 XM_B_SpammyWords 272341 52.01 61.29 50.08 12 XM_B_Unicode3 215186 38.42 32.86 39.57 13 DKIM_VALID_EF 163269 31.23 37.06 30.03 14 T_TM2_M_HEADER_IN_MSG 159875 27.92 20.78 29.40 15 HTML_FONT_LOW_CONTRAST 153340 28.36 29.13 28.20 16 RCVD_IN_MSPIKE_WL 151083 24.85 10.72 27.78 17 RCVD_IN_MSPIKE_H2 148250 26.92 25.26 27.26 18 LOC_TINY_FONT_1 136070 26.45 33.32 25.02 19 FVGT_m_MULTI_ODD 123895 22.84 23.11 22.78 20 XM_B_SpammyWords2 122375 24.52 34.21 22.51 21 MIME_HTML_ONLY 110725 21.80 28.74 20.36 22 XMSubLong 110627 21.10 24.72 20.34 23 T_KAM_HTML_FONT_INVALID 101327 19.28 22.41 18.63 24 RCVD_IN_MSPIKE_H3 85314 13.96 5.60 15.69 25 ALL_TRUSTED 75399 11.85 2.14 13.87 26 XM_Body_Dirty_Words 72364 13.90 16.77 13.31 27 BAYES_00 70826 11.01 1.29 13.03 28 XM_Multi_Part_URI 64890 13.58 21.53 11.93 29 XM_DK_Undo_02 64516 18.94 53.00 11.86 30 XM_B_Unsub 63485 11.34 9.73 11.68 31 RCVD_IN_MSPIKE_H4 55341 9.26 4.82 10.18 32 TR_XM_DK_Bayes 51354 7.88 0.33 9.44 33 XM_Evil_Numbers_Gen 50635 8.90 6.89 9.31 34 TR_XM_DK_Bayes1 49862 7.65 0.31 9.17 35 LOTS_OF_MONEY 48108 10.76 19.94 8.85 36 TooManyTo_001 45000 7.91 6.16 8.28 37 LotsOfNums_01 44957 7.84 5.81 8.27 38 TR_XM_DK_Bayes2 43953 6.74 0.25 8.08 39 BAYES_99 43440 13.72 41.29 7.99 40 UNPARSEABLE_RELAY 42286 7.28 4.89 7.78 41 RCVD_IN_RP_SAFE 41324 6.38 0.53 7.60 42 XM_DKIMWhitelistDomains 40358 6.15 0.00 7.42 43 RCVD_IN_RP_CERTIFIED 38634 5.95 0.37 7.10 44 XM_SendGrid 38604 6.53 3.81 7.10 45 IN_ZIMBRA_NJ_WHITELIST 37364 5.70 0.07 6.87 46 XM_B_Phish_Phrases 37043 7.47 10.64 6.81 47 BAYES_60 36760 6.76 6.76 6.76 48 HTML_IMAGE_RATIO_02 35982 6.78 7.59 6.62 49 BAYES_999 35849 10.82 31.17 6.59 50 XM_B_SpammyWords3 31162 6.60 10.80 5.73 51 XM_PDF 29347 4.73 1.50 5.40 52 T_TooManySym_01 28897 4.82 2.45 5.31 53 BOTNET_IPINHOSTNAME 28548 6.77 14.11 5.25 54 MIME_QP_LONG_LINE 28390 4.61 1.68 5.22 55 RELAYCOUNTRY_META 27616 9.91 33.17 5.08 56 XM_H_Long_From01 27389 5.09 5.33 5.04 57 HTML_IMAGE_RATIO_04 26844 4.77 3.95 4.94 58 RCVD_IN_IADB_LISTED 26780 4.28 1.16 4.92 59 BAYES_40 25802 4.28 2.01 4.75 60 XMSexyCombo_05 25632 5.87 11.41 4.71 61 BAYES_80 24228 5.11 8.23 4.46 62 XMStrtUSub 24086 4.16 2.87 4.43 63 BAYES_20 23862 3.92 1.67 4.39 64 RCVD_IN_IADB_SPF 23150 3.69 0.98 4.26 65 TR_XM_DK_SendGrid 22618 3.78 1.94 4.16 66 ANY_BOUNCE_MESSAGE 20819 3.28 0.65 3.83 67 RCVD_IN_IADB_SENDERID 20601 3.29 0.91 3.79 68 BOUNCE_MESSAGE 20516 3.24 0.65 3.77 69 T_REMOTE_IMAGE 20451 4.43 7.63 3.76 70 MPART_ALT_DIFF 20406 5.67 14.90 3.75 71 XMSubMetaSx_00 20391 4.40 7.53 3.75 72 XMNumbers 20027 3.96 5.32 3.68 73 HTML_IMAGE_RATIO_06 19984 4.07 5.97 3.68 74 RCVD_IN_IADB_DK 19887 3.18 0.90 3.66 75 XM_B_Unsub2 19196 3.26 1.98 3.53 76 DKIM_INVALID 18344 3.66 5.05 3.37 77 TM2_M_URI_OPT_OUT 18071 3.29 3.11 3.32 78 XM_UncommonTLD01 17636 6.85 24.19 3.24 79 RCVD_IN_IADB_VOUCHED 17022 2.69 0.56 3.13 80 TR_XM_PhishingBody 16442 3.63 6.56 3.02 81 FROM_EXCESS_BASE64 15595 2.98 3.53 2.87 82 BAYES_95 15321 3.30 5.64 2.82 83 UNTRUSTED_Relay 15295 6.76 25.74 2.81 84 MAILING_LIST_MULTI 13624 2.26 1.09 2.51 85 URI_NOVOWEL 13458 2.27 1.28 2.47 86 T_TooManySym_02 13356 2.15 0.65 2.46 87 BAYES_05 13141 2.14 0.82 2.42 88 HELO_NODOT 13048 2.29 1.74 2.40 89 HELO_NO_DOMAIN 13047 2.29 1.74 2.40 90 XMDiploma_00 12982 2.43 2.64 2.39 91 HTML_IMAGE_RATIO_08 12641 2.49 3.31 2.32 92 HTML_MIME_NO_HTML_TAG 12130 2.47 3.60 2.23 93 MIME_HTML_MOSTLY 12091 4.16 13.46 2.22 94 BOTNET 11859 6.29 26.09 2.18 95 TR_XM_SB_Phish 11687 2.21 2.49 2.15 96 MIME_HTML_ONLY_MULTI 11648 2.03 1.47 2.14 97 XMSubPhish11 11491 2.16 2.37 2.11 98 TooManyTo_002 11309 1.87 0.87 2.08 99 RCVD_IN_IADB_OPTIN 11269 1.79 0.43 2.07 100 XM_B_SpammyTLD 11105 2.51 4.77 2.04 101 RCVD_IN_MSPIKE_H5 10428 1.64 0.30 1.92 102 RCVD_IN_MSPIKE_BL 10252 4.08 14.63 1.89 103 RCVD_IN_BL_SPAMCOP_NET 10222 3.39 10.65 1.88 104 XM_UB50 10202 3.07 8.79 1.88 105 XM_SPF_SoftFail 10080 2.58 6.05 1.85 106 TR_Symld_Words 10064 2.10 3.29 1.85 107 RELAYCOUNTRY_CA 10025 2.67 6.64 1.84 108 XM_B_Phish66 9685 2.12 3.73 1.78 109 XM_DK_Undo_01 9221 1.56 0.90 1.70 110 XMBrknScrpt_02 9110 2.88 8.68 1.68 111 T_XMDrugObfuBody_08 9023 1.96 3.40 1.66 112 URI_TRY_3LD 8858 1.94 3.41 1.63 113 URI_HEX 8813 1.63 1.67 1.62 114 XM_B_COVIDMETA 8492 2.09 4.63 1.56 115 XM_CamelCaseFrm001 8367 1.66 2.26 1.54 116 TVD_RCVD_IP 8320 1.34 0.42 1.53 117 KHOP_HELO_FCRDNS 8193 2.06 4.73 1.51 118 T_XMDrugObfuBody_14 8017 1.55 1.92 1.47 119 XM_OfRef6 7993 1.93 4.15 1.47 120 SUBJ_ALL_CAPS 7927 1.90 4.03 1.46 121 XMBody_17 7833 2.35 6.74 1.44 122 TooManyTo_003 7665 1.27 0.62 1.41 123 XM_GoogleGroups 7479 1.21 0.42 1.38 124 INVALID_MSGID 7327 1.30 1.09 1.35 125 IN_HORDE_ADDRESS_BOOK 7229 1.12 0.12 1.33 126 TR_LOTS_OF_MONEY3 7223 1.80 4.06 1.33 127 TM2_M_VERY_LONG_WORD 7190 1.38 1.65 1.32 128 HELO_MISC_IP 7059 1.14 0.37 1.30 129 CK_HELO_DYNAMIC_SPLIT_IP 7057 1.17 0.55 1.30 130 USER_IN_DEF_DKIM_WL 7015 1.07 0.00 1.29 131 XMStockSpam_06 6985 1.31 1.43 1.28 132 MISSING_HEADERS 6927 1.37 1.81 1.27 133 XMCapTrack 6656 1.10 0.51 1.22 134 XM_H_Long_From02 6545 1.13 0.78 1.20 135 TO_MALFORMED 6402 0.98 0.01 1.18 136 XMGappySubj_01 5707 0.89 0.09 1.05 137 DKIM_ADSP_CUSTOM_MED 5514 1.14 1.73 1.01 138 TooManyTo_004 5472 0.92 0.53 1.01 139 SpammyFromTLD_01 5023 2.43 9.67 0.92 140 TR_MSPIKEBAYES00 4976 0.76 0.01 0.92 141 XMGenDplmaNmb 4954 1.00 1.41 0.91 142 T_TooManySym_03 4925 0.77 0.13 0.91 143 T_OBFU_PDF_ATTACH 4730 0.76 0.21 0.87 144 T_FILL_THIS_FORM_SHORT 4717 1.23 2.95 0.87 145 RCVD_IN_MSPIKE_ZBI 4582 0.79 0.54 0.84 146 RELAYCOUNTRY_NG_I 4558 0.78 0.50 0.84 147 TooManyTo_005 4531 0.76 0.43 0.83 148 HTTPS_HTTP_MISMATCH 4454 0.86 1.08 0.82 149 DKIM_ADSP_NXDOMAIN 4398 1.08 2.36 0.81 150 RELAYCOUNTRY_GB 4383 0.96 1.72 0.81 151 XM_ProductURIs 4351 0.76 0.54 0.80 152 T_XMHurry_00 4309 1.04 2.26 0.79 153 XM_RXBody 4294 0.73 0.44 0.79 154 T_FONT_INVIS_MSGID 4271 1.03 2.20 0.79 155 XM_SPF_Unknown 4251 0.80 0.91 0.78 156 XMHTML_After_End 4172 1.00 2.09 0.77 157 TR_MetaPhish_Combo_01 4101 0.80 1.00 0.75 158 NML_ADSP_CUSTOM_MED 3961 0.88 1.60 0.73 159 RCVD_IN_MSPIKE_L3 3948 2.16 9.06 0.73 160 XMBdyGiftCard01 3900 0.70 0.65 0.72 161 SPOOFED_URL 3853 0.80 1.26 0.71 162 XM_ShortIntro_01 3714 0.67 0.58 0.68 163 XMBody_95 3642 0.57 0.06 0.67 164 XM_B_SpammyWords4 3619 0.92 2.14 0.67 165 XMHTMLBadTable_001 3573 0.61 0.36 0.66 166 HTML_FONT_FACE_BAD 3526 0.64 0.61 0.65 167 XMSubNoVowel 3511 0.83 1.71 0.65 168 T_MONEY_PERCENT 3480 0.65 0.69 0.64 169 TR_LOTS_OF_MONEY2 3480 0.65 0.69 0.64 170 SPOOFED_URL_HOST 3447 0.72 1.14 0.63 171 XMMoneyMeta_00 3324 0.67 0.93 0.61 172 XMSexyCombo_01 3131 0.85 2.16 0.58 173 TR_BOTNET_NEGATE 3080 0.54 0.42 0.57 174 FROM_GOV_DKIM_AU 2949 0.46 0.09 0.54 175 XM_DIRTYINTL 2926 1.31 5.05 0.54 176 T_XMDrugObfuBody_00 2922 0.75 1.78 0.54 177 XM_H_Trusted_IP 2900 0.44 0.00 0.53 178 TR_XM_UnparsRelay 2891 0.89 2.61 0.53 179 XMSubMetaSxObfu_03 2852 0.68 1.45 0.52 180 FORGED_GMAIL_RCVD 2746 0.67 1.45 0.50 181 XM_H_PHPMailer 2739 0.55 0.76 0.50 182 XMSubMetaI_00 2725 0.55 0.77 0.50 183 TR_XM_COVIDMETA4 2644 0.72 1.82 0.49 184 T_TooManySym_04 2638 0.41 0.04 0.49 185 XMPhish14 2545 0.57 1.06 0.47 186 PLING_QUERY 2545 0.51 0.73 0.47 187 NO_DNS_FOR_FROM 2531 0.49 0.63 0.47 188 T_Symld_Words_02 2520 0.57 1.08 0.46 189 TM2_M_BODY_EMPTY 2516 0.41 0.15 0.46 190 XMNoVowels 2513 0.48 0.59 0.46 191 TVD_PH_BODY_ACCOUNTS_PRE 2508 0.40 0.11 0.46 192 MPART_ALT_DIFF_COUNT 2498 0.51 0.77 0.46 193 T_PDS_OTHER_BAD_TLD 2488 0.99 3.52 0.46 194 RCVD_IN_SORBS_DUL 2430 0.45 0.44 0.45 195 RDNS_DYNAMIC 2423 0.64 1.59 0.45 196 HTML_TAG_BALANCE_BODY 2422 0.52 0.89 0.45 197 HTML_IMAGE_ONLY_20 2374 0.44 0.43 0.44 198 XMBody_78 2371 0.56 1.13 0.44 199 HTML_IMAGE_ONLY_28 2334 0.41 0.29 0.43 200 DIET_1 2327 0.50 0.85 0.43 ----------------------------------------------------------------------