Email: 681436 Autolearn: 0 AvgScore: 3.57 AvgScanTime: 1.36 sec Spam: 204172 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.47 sec Ham: 477264 Autolearn: 0 AvgScore: -0.85 AvgScanTime: 1.31 sec Time Spent Running SA: 256.90 hours Time Spent Processing Spam: 83.34 hours Time Spent Processing Ham: 173.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 194594 91.26 95.31 89.53 2 DKIM_SIGNED 168415 79.17 82.49 77.76 3 XM_DK_Pass 163818 77.63 80.24 76.52 4 DCC_CHECK 160840 51.74 78.78 40.18 5 DKIM_VALID 160004 75.55 78.37 74.35 6 XM_B_Unicode 145780 71.61 71.40 71.70 7 RELAYCOUNTRY_US 145340 80.21 71.19 84.07 8 XMListUnsubscribeExists 137558 56.03 67.37 51.18 9 XM_B_SpammyWords 135341 53.74 66.29 48.37 10 DKIM_VALID_AU 123970 57.70 60.72 56.40 11 XM_DK_Undo_02 92964 18.78 45.53 7.34 12 LOC_TINY_FONT_1 79070 28.87 38.73 24.65 13 XM_B_Unicode3 75490 40.09 36.97 41.43 14 XM_B_SpammyWords2 75007 26.28 36.74 21.80 15 BAYES_99 74510 14.18 36.49 4.64 16 TR_XM_DKIM_Undo 74283 14.85 36.38 5.64 17 BAYES_50 72014 49.69 35.27 55.86 18 HTML_FONT_LOW_CONTRAST 68028 29.60 33.32 28.02 19 DKIM_VALID_EF 65306 29.95 31.99 29.08 20 MIME_HTML_ONLY 63511 24.39 31.11 21.52 21 BAYES_999 59905 11.43 29.34 3.76 22 TR_DCC_Bayes_99 59402 10.23 29.09 2.16 23 RCVD_IN_MSPIKE_H2 56782 28.42 27.81 28.68 24 RELAYCOUNTRY_META 53912 11.57 26.41 5.22 25 FVGT_m_MULTI_ODD 49929 22.93 24.45 22.28 26 T_KAM_HTML_FONT_INVALID 47006 19.83 23.02 18.46 27 XMSubLong 45535 21.68 22.30 21.42 28 UNTRUSTED_Relay 41123 7.48 20.14 2.07 29 T_TM2_M_HEADER_IN_MSG 40795 27.37 19.98 30.54 30 DCC_CHECK_NEGATIVE 39539 46.15 19.37 57.61 31 XM_Multi_Part_URI 36564 13.75 17.91 11.97 32 RCVD_IN_MSPIKE_WL 36547 26.09 17.90 29.59 33 BOTNET 35939 6.50 17.60 1.76 34 XM_Body_Dirty_Words 33051 14.72 16.19 14.09 35 XM_UncommonTLD01 30066 6.72 14.73 3.30 36 FSL_BULK_SIG 28806 8.23 14.11 5.72 37 XM_B_Unsub 28048 11.38 13.74 10.38 38 LOTS_OF_MONEY 26629 8.74 13.04 6.90 39 XM_B_SpammyWords3 25227 7.73 12.36 5.75 40 BOTNET_IPINHOSTNAME 24965 6.75 12.23 4.40 41 TR_XM_SpammyWords2 24874 4.42 12.18 1.10 42 TR_XM_SpammyWords4 23197 6.75 11.36 4.78 43 MPART_ALT_DIFF 21787 6.72 10.67 5.02 44 LotsOfNums_01 21526 9.34 10.54 8.83 45 XMSexyCombo_05 20973 6.42 10.27 4.78 46 RCVD_IN_MSPIKE_H3 20751 14.59 10.16 16.48 47 HTML_IMAGE_RATIO_02 20187 8.01 9.89 7.21 48 BAYES_80 18678 5.57 9.15 4.04 49 BAYES_60 18480 7.69 9.05 7.10 50 XM_Evil_Numbers_Gen 18405 9.41 9.01 9.58 51 MIME_HTML_MOSTLY 18227 4.28 8.93 2.29 52 T_REMOTE_IMAGE 16908 5.09 8.28 3.72 53 RCVD_IN_BL_SPAMCOP_NET 16545 3.10 8.10 0.97 54 UNPARSEABLE_RELAY 15367 7.62 7.53 7.66 55 TooManyTo_001 15156 8.30 7.42 8.68 56 KHOP_HELO_FCRDNS 15035 3.56 7.36 1.93 57 XMSubMetaSx_00 14984 4.56 7.34 3.37 58 TR_XM_UnparsRelay 14780 5.88 7.24 5.29 59 RCVD_IN_MSPIKE_H4 14283 9.42 7.00 10.46 60 XM_B_Phish_Phrases 14011 5.85 6.86 5.41 61 RELAYCOUNTRY_CA 13549 3.04 6.64 1.50 62 XM_UB50 13387 2.83 6.56 1.24 63 TR_XM_PhishingBody 12302 3.96 6.03 3.08 64 SpammyFromTLD_01 12222 2.42 5.99 0.89 65 HTML_IMAGE_RATIO_04 11817 5.50 5.79 5.37 66 XM_SendGrid 11717 6.55 5.74 6.90 67 XM_H_Long_From01 11124 6.06 5.45 6.33 68 HTML_IMAGE_ONLY_12 10990 1.80 5.38 0.27 69 RELAYCOUNTRY_FR 10710 1.84 5.25 0.38 70 HTML_SHORT_LINK_IMG_1 10614 1.58 5.20 0.04 71 BODY_URI_ONLY 10580 1.59 5.18 0.06 72 RCVD_IN_MSPIKE_BL 10409 1.76 5.10 0.33 73 XMNumbers 10332 3.93 5.06 3.44 74 TR_XM_MSPIKECOMBO 10269 1.73 5.03 0.32 75 XM_OfRef6 10077 2.44 4.94 1.37 76 XM_UB99 9960 1.46 4.88 0.00 77 XM_B_SpammyTLD 9620 2.93 4.71 2.17 78 BAYES_95 9614 3.20 4.71 2.55 79 TR_XM_SpammyWords5 9331 2.64 4.57 1.81 80 RCVD_IN_RP_SAFE 9255 7.06 4.53 8.14 81 HTML_IMAGE_RATIO_08 9169 2.94 4.49 2.27 82 XM_SPF_SoftFail 8798 2.78 4.31 2.13 83 DKIM_INVALID 8411 3.62 4.12 3.41 84 URIBL_SBL_A 8332 1.37 4.08 0.21 85 SpammyFromTLD_02 8080 1.32 3.96 0.19 86 RCVD_IN_RP_CERTIFIED 7767 6.42 3.80 7.54 87 PDS_OTHER_BAD_TLD 7734 1.61 3.79 0.68 88 XM_UB999 7674 1.13 3.76 0.00 89 HTML_IMAGE_RATIO_06 7517 3.54 3.68 3.48 90 XM_UB60 7186 1.18 3.52 0.18 91 TM2_M_URI_OPT_OUT 7170 2.61 3.51 2.23 92 TR_XM_DK_SendGrid 6982 4.19 3.42 4.52 93 TR_LOTS_OF_MONEY3 6929 1.24 3.39 0.32 94 XM_B_Phish66 6730 2.40 3.30 2.01 95 XM_DK_Undo_01 6699 2.17 3.28 1.69 96 FROM_SUSPICIOUS_NTLD 6673 1.02 3.27 0.06 97 XM_UB80 6601 1.00 3.23 0.04 98 FROM_SUSPICIOUS_NTLD_FP 6495 0.99 3.18 0.05 99 XM_DIRTYINTL 6420 1.26 3.14 0.45 100 T_FILL_THIS_FORM_SHORT 6355 1.58 3.11 0.92 101 RCVD_IN_PSBL 6204 1.06 3.04 0.21 102 RCVD_IN_RP_RNBL 5959 0.91 2.92 0.05 103 URI_HEX 5825 2.06 2.85 1.72 104 RCVD_IN_MSPIKE_L5 5783 0.91 2.83 0.09 105 XMStrtUSub 5771 4.56 2.83 5.30 106 SUBJ_ALL_CAPS 5757 1.93 2.82 1.55 107 XM_B_COVIDMETA 5637 1.57 2.76 1.07 108 XMDiploma_00 5610 2.09 2.75 1.81 109 XMBrknScrpt_02 5606 1.38 2.75 0.79 110 XMBody_17 5471 1.34 2.68 0.77 111 MIME_QP_LONG_LINE 5241 4.58 2.57 5.45 112 RELAYCOUNTRY_UA 5058 0.79 2.48 0.07 113 MIME_HTML_ONLY_MULTI 4978 2.99 2.44 3.23 114 TR_XM_MaxBayes 4856 0.72 2.38 0.01 115 DATE_IN_PAST_03_06 4687 0.75 2.30 0.09 116 HTML_MIME_NO_HTML_TAG 4612 2.16 2.26 2.12 117 T_XMDrugObfuBody_08 4522 1.80 2.21 1.62 118 FROM_EXCESS_BASE64 4487 2.81 2.20 3.07 119 T_TooManySym_01 4385 3.90 2.15 4.64 120 TM2_M_VERY_LONG_WORD 4317 1.48 2.11 1.21 121 XM_CamelCaseFrm001 4299 2.06 2.11 2.04 122 HTML_FONT_SIZE_LARGE 4294 0.71 2.10 0.11 123 TR_XM_SB_Phish 4232 2.00 2.07 1.97 124 XM_B_Unsub2 4145 2.04 2.03 2.04 125 URI_TRY_3LD 4109 1.33 2.01 1.04 126 XMSubPhish11 4080 1.95 2.00 1.94 127 TR_XM_SpammyWords3 4064 0.76 1.99 0.24 128 BOTNET_NORDNS 4046 0.61 1.98 0.02 129 BAYES_40 4029 4.18 1.97 5.13 130 XM_B_SpammyWords4 4022 0.94 1.97 0.50 131 URI_NOVOWEL 3896 2.57 1.91 2.86 132 XM_URI_RBL 3820 0.68 1.87 0.18 133 T_XMDrugObfuBody_14 3692 1.70 1.81 1.65 134 TR_XM_FormFill 3586 0.54 1.76 0.02 135 FORGED_GMAIL_RCVD 3568 0.97 1.75 0.64 136 XMGenDplmaNmb 3400 1.12 1.67 0.88 137 RCVD_IN_IADB_LISTED 3372 4.23 1.65 5.33 138 T_XMHurry_00 3356 1.01 1.64 0.74 139 XMBdyGiftCard01 3343 1.35 1.64 1.23 140 XMStockSpam_06 3311 1.62 1.62 1.62 141 RELAYCOUNTRY_AL 3111 0.46 1.52 0.01 142 TR_Mismatch_TLD_02 3098 0.51 1.52 0.08 143 TR_Symld_Words 3090 1.57 1.51 1.60 144 TR_XM_COVIDMETA1 3086 0.64 1.51 0.27 145 XM_UB95 3032 0.45 1.49 0.01 146 XMHTML_After_End 2939 1.13 1.44 1.00 147 RCVD_IN_IADB_SPF 2905 3.67 1.42 4.64 148 TR_XM_COVIDMETA4 2903 0.72 1.42 0.42 149 RCVD_IN_MSPIKE_L4 2876 0.44 1.41 0.03 150 BAYES_20 2859 3.17 1.40 3.93 151 DATE_IN_PAST_06_12 2859 0.56 1.40 0.20 152 RCVD_IN_IADB_DK 2748 3.20 1.35 4.00 153 XM_DrugUnitList 2748 0.40 1.35 0.00 154 ALIBABA_IMG_NOT_RCVD_ALI 2746 0.40 1.34 0.00 155 HTML_IMAGE_ONLY_20 2741 0.77 1.34 0.52 156 ALL_TRUSTED 2710 8.90 1.33 12.14 157 RCVD_IN_IADB_SENDERID 2701 3.30 1.32 4.14 158 XMSexyCombo_01 2673 0.82 1.31 0.61 159 URI_PHP_REDIR 2662 0.40 1.30 0.01 160 T_Symld_Words_02 2658 0.75 1.30 0.51 161 TR_XM_PHPDW 2651 0.67 1.30 0.41 162 TR_XM_PHPForged 2597 0.63 1.27 0.36 163 TR_XM_FormFill2 2579 0.63 1.26 0.36 164 XM_H_PHPOS 2574 0.63 1.26 0.35 165 XM_BadFromFormat 2570 0.56 1.26 0.26 166 HOSTED_IMG_DIRECT_MX 2558 0.38 1.25 0.00 167 XMSubMetaI_00 2554 0.77 1.25 0.56 168 XMSubMetaSxObfu_03 2535 0.72 1.24 0.49 169 XMSubNoVowel 2510 1.16 1.23 1.14 170 HK_RANDOM_REPLYTO 2461 0.49 1.21 0.19 171 RELAYCOUNTRY_IN 2450 0.42 1.20 0.09 172 MAILING_LIST_MULTI 2423 2.35 1.19 2.84 173 LongTLD 2403 0.46 1.18 0.15 174 TR_XM_INV_DKIM 2385 0.39 1.17 0.06 175 RELAYCOUNTRY_DE 2334 0.63 1.14 0.41 176 T_XMDrugObfuBody_00 2326 0.80 1.14 0.66 177 BAYES_00 2228 10.20 1.09 14.09 178 URI_NO_WWW_BIZ_CGI 2216 0.34 1.09 0.02 179 LOADSA_MONEY_COMBO 2198 0.36 1.08 0.05 180 DKIM_ADSP_CUSTOM_MED 2192 1.10 1.07 1.11 181 URI_GOOGLE_PROXY 2141 0.41 1.05 0.14 182 XM_OfRef7 2105 0.39 1.03 0.11 183 HTTPS_HTTP_MISMATCH 2078 0.95 1.02 0.92 184 XFER_LOTSA_MONEY 2076 0.33 1.02 0.03 185 XMPhish08 2057 0.50 1.01 0.28 186 RELAYCOUNTRY_GB 2046 1.05 1.00 1.07 187 TR_XM_BayesRelay 2045 0.30 1.00 0.01 188 XMPhish30 2038 0.53 1.00 0.33 189 XMReplyNow 2036 0.38 1.00 0.11 190 TR_Caps_n_Bayes_99 2020 0.31 0.99 0.02 191 XM_H_Long_From02 1988 1.20 0.97 1.30 192 XM_ProductURIs 1958 1.43 0.96 1.64 193 TR_XM_RelayPhish 1944 0.35 0.95 0.10 194 HTML_IMAGE_ONLY_16 1905 0.47 0.93 0.28 195 NUMERIC_HTTP_ADDR 1893 0.54 0.93 0.37 196 NML_ADSP_CUSTOM_MED 1888 0.81 0.92 0.76 197 TR_MetaPhish_Combo_01 1867 0.67 0.91 0.57 198 TR_LOTS_OF_MONEY2 1833 0.40 0.90 0.19 199 T_MONEY_PERCENT 1833 0.40 0.90 0.19 200 XM_PDF 1786 3.56 0.87 4.70 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 427293 91.26 95.31 89.53 2 RELAYCOUNTRY_US 401232 80.21 71.19 84.07 3 DKIM_SIGNED 371103 79.17 82.49 77.76 4 XM_DK_Pass 365209 77.63 80.24 76.52 5 DKIM_VALID 354852 75.55 78.37 74.35 6 XM_B_Unicode 342196 71.61 71.40 71.70 7 DCC_CHECK_NEGATIVE 274965 46.15 19.37 57.61 8 DKIM_VALID_AU 269198 57.70 60.72 56.40 9 BAYES_50 266620 49.69 35.27 55.86 10 XMListUnsubscribeExists 244271 56.03 67.37 51.18 11 XM_B_SpammyWords 230834 53.74 66.29 48.37 12 XM_B_Unicode3 197725 40.09 36.97 41.43 13 DCC_CHECK 191744 51.74 78.78 40.18 14 T_TM2_M_HEADER_IN_MSG 145747 27.37 19.98 30.54 15 RCVD_IN_MSPIKE_WL 141244 26.09 17.90 29.59 16 DKIM_VALID_EF 138779 29.95 31.99 29.08 17 RCVD_IN_MSPIKE_H2 136893 28.42 27.81 28.68 18 HTML_FONT_LOW_CONTRAST 133709 29.60 33.32 28.02 19 LOC_TINY_FONT_1 117637 28.87 38.73 24.65 20 FVGT_m_MULTI_ODD 106347 22.93 24.45 22.28 21 XM_B_SpammyWords2 104054 26.28 36.74 21.80 22 MIME_HTML_ONLY 102717 24.39 31.11 21.52 23 XMSubLong 102232 21.68 22.30 21.42 24 T_KAM_HTML_FONT_INVALID 88103 19.83 23.02 18.46 25 RCVD_IN_MSPIKE_H3 78641 14.59 10.16 16.48 26 BAYES_00 67258 10.20 1.09 14.09 27 XM_Body_Dirty_Words 67256 14.72 16.19 14.09 28 ALL_TRUSTED 57940 8.90 1.33 12.14 29 XM_Multi_Part_URI 57144 13.75 17.91 11.97 30 RCVD_IN_MSPIKE_H4 49913 9.42 7.00 10.46 31 XM_B_Unsub 49523 11.38 13.74 10.38 32 TR_XM_DK_Bayes 49120 7.46 0.85 10.29 33 TR_XM_DK_Bayes1 47494 7.22 0.82 9.95 34 XM_Evil_Numbers_Gen 45736 9.41 9.01 9.58 35 XM_DKIMWhitelistDomains 44297 6.51 0.05 9.28 36 LotsOfNums_01 42120 9.34 10.54 8.83 37 TooManyTo_001 41421 8.30 7.42 8.68 38 TR_XM_DK_Bayes2 40784 6.19 0.69 8.55 39 RCVD_IN_RP_SAFE 38851 7.06 4.53 8.14 40 UNPARSEABLE_RELAY 36566 7.62 7.53 7.66 41 RCVD_IN_RP_CERTIFIED 36008 6.42 3.80 7.54 42 XM_DK_Undo_02 35038 18.78 45.53 7.34 43 HTML_IMAGE_RATIO_02 34390 8.01 9.89 7.21 44 BAYES_60 33900 7.69 9.05 7.10 45 LOTS_OF_MONEY 32943 8.74 13.04 6.90 46 XM_SendGrid 32936 6.55 5.74 6.90 47 XM_H_Long_From01 30203 6.06 5.45 6.33 48 IN_ZIMBRA_NJ_WHITELIST 29720 4.38 0.06 6.23 49 XM_B_SpammyWords3 27430 7.73 12.36 5.75 50 FSL_BULK_SIG 27307 8.23 14.11 5.72 51 TR_XM_DKIM_Undo 26903 14.85 36.38 5.64 52 MIME_QP_LONG_LINE 25996 4.58 2.57 5.45 53 XM_B_Phish_Phrases 25842 5.85 6.86 5.41 54 HTML_IMAGE_RATIO_04 25633 5.50 5.79 5.37 55 RCVD_IN_IADB_LISTED 25419 4.23 1.65 5.33 56 XMStrtUSub 25297 4.56 2.83 5.30 57 TR_XM_UnparsRelay 25264 5.88 7.24 5.29 58 RELAYCOUNTRY_META 24932 11.57 26.41 5.22 59 BAYES_40 24489 4.18 1.97 5.13 60 MPART_ALT_DIFF 23976 6.72 10.67 5.02 61 TR_XM_SpammyWords4 22823 6.75 11.36 4.78 62 XMSexyCombo_05 22801 6.42 10.27 4.78 63 XM_PDF 22449 3.56 0.87 4.70 64 T_TooManySym_01 22162 3.90 2.15 4.64 65 RCVD_IN_IADB_SPF 22126 3.67 1.42 4.64 66 BAYES_99 22122 14.18 36.49 4.64 67 TR_XM_DK_SendGrid 21593 4.19 3.42 4.52 68 BOTNET_IPINHOSTNAME 21017 6.75 12.23 4.40 69 RCVD_IN_IADB_SENDERID 19782 3.30 1.32 4.14 70 BAYES_80 19298 5.57 9.15 4.04 71 RCVD_IN_IADB_DK 19089 3.20 1.35 4.00 72 BAYES_20 18762 3.17 1.40 3.93 73 BAYES_999 17956 11.43 29.34 3.76 74 T_REMOTE_IMAGE 17769 5.09 8.28 3.72 75 HTML_IMAGE_RATIO_06 16619 3.54 3.68 3.48 76 XMNumbers 16436 3.93 5.06 3.44 77 DKIM_INVALID 16251 3.62 4.12 3.41 78 XMSubMetaSx_00 16065 4.56 7.34 3.37 79 XM_UncommonTLD01 15741 6.72 14.73 3.30 80 RCVD_IN_IADB_VOUCHED 15665 2.53 0.77 3.28 81 MIME_HTML_ONLY_MULTI 15405 2.99 2.44 3.23 82 TR_XM_PhishingBody 14692 3.96 6.03 3.08 83 FROM_EXCESS_BASE64 14638 2.81 2.20 3.07 84 URI_NOVOWEL 13635 2.57 1.91 2.86 85 MAILING_LIST_MULTI 13566 2.35 1.19 2.84 86 RCVD_IN_MSPIKE_H5 12690 2.08 0.74 2.66 87 BAYES_05 12374 2.07 0.86 2.59 88 BAYES_95 12176 3.20 4.71 2.55 89 XM_H_Trusted_IP 11888 1.74 0.00 2.49 90 TooManyTo_002 11755 1.91 0.63 2.46 91 MIME_HTML_MOSTLY 10914 4.28 8.93 2.29 92 HTML_IMAGE_RATIO_08 10832 2.94 4.49 2.27 93 T_TooManySym_02 10777 1.77 0.64 2.26 94 TM2_M_URI_OPT_OUT 10644 2.61 3.51 2.23 95 RCVD_IN_IADB_OPTIN 10448 1.69 0.52 2.19 96 XM_B_SpammyTLD 10341 2.93 4.71 2.17 97 TR_DCC_Bayes_99 10311 10.23 29.09 2.16 98 XM_SPF_SoftFail 10148 2.78 4.31 2.13 99 HTML_MIME_NO_HTML_TAG 10119 2.16 2.26 2.12 100 UNTRUSTED_Relay 9875 7.48 20.14 2.07 101 XM_CamelCaseFrm001 9755 2.06 2.11 2.04 102 XM_B_Unsub2 9742 2.04 2.03 2.04 103 XM_B_Phish66 9608 2.40 3.30 2.01 104 TR_XM_SB_Phish 9395 2.00 2.07 1.97 105 XMSubPhish11 9238 1.95 2.00 1.94 106 KHOP_HELO_FCRDNS 9206 3.56 7.36 1.93 107 TR_XM_SpammyWords5 8661 2.64 4.57 1.81 108 XMDiploma_00 8623 2.09 2.75 1.81 109 HELO_NO_DOMAIN 8518 1.50 0.82 1.78 110 HELO_NODOT 8518 1.50 0.82 1.78 111 BOTNET 8376 6.50 17.60 1.76 112 URI_HEX 8231 2.06 2.85 1.72 113 TVD_RCVD_IP 8200 1.27 0.22 1.72 114 XM_DK_Undo_01 8061 2.17 3.28 1.69 115 TooManyTo_003 7908 1.31 0.51 1.66 116 T_XMDrugObfuBody_14 7862 1.70 1.81 1.65 117 XM_ProductURIs 7811 1.43 0.96 1.64 118 T_XMDrugObfuBody_08 7748 1.80 2.21 1.62 119 XMStockSpam_06 7744 1.62 1.62 1.62 120 IN_HORDE_ADDRESS_BOOK 7690 1.17 0.14 1.61 121 TR_Symld_Words 7627 1.57 1.51 1.60 122 ANY_BOUNCE_MESSAGE 7534 1.23 0.40 1.58 123 BOUNCE_MESSAGE 7527 1.22 0.40 1.58 124 SUBJ_ALL_CAPS 7408 1.93 2.82 1.55 125 INVALID_MSGID 7166 1.16 0.37 1.50 126 RELAYCOUNTRY_CA 7144 3.04 6.64 1.50 127 XMCapTrack 7076 1.15 0.38 1.48 128 TO_MALFORMED 6581 0.97 0.02 1.38 129 MSGID_NOFQDN1 6519 0.98 0.07 1.37 130 XM_OfRef6 6518 2.44 4.94 1.37 131 XM_GoogleGroups 6484 1.09 0.46 1.36 132 USER_IN_DEF_DKIM_WL 6239 0.93 0.03 1.31 133 XM_H_Long_From02 6214 1.20 0.97 1.30 134 XM_UB50 5910 2.83 6.56 1.24 135 XMBdyGiftCard01 5876 1.35 1.64 1.23 136 TM2_M_VERY_LONG_WORD 5785 1.48 2.11 1.21 137 TooManyTo_004 5692 0.96 0.42 1.19 138 TR_MSPIKEBAYES00 5508 0.81 0.01 1.15 139 HELO_MISC_IP 5505 0.90 0.30 1.15 140 XMSubNoVowel 5420 1.16 1.23 1.14 141 DKIM_ADSP_CUSTOM_MED 5296 1.10 1.07 1.11 142 TR_XM_SpammyWords2 5255 4.42 12.18 1.10 143 RELAYCOUNTRY_GB 5115 1.05 1.00 1.07 144 XM_B_COVIDMETA 5083 1.57 2.76 1.07 145 URI_TRY_3LD 4987 1.33 2.01 1.04 146 XMHTML_After_End 4789 1.13 1.44 1.00 147 TooManyTo_005 4710 0.79 0.34 0.99 148 XMBSHREFv2 4626 0.78 0.32 0.97 149 RCVD_IN_BL_SPAMCOP_NET 4612 3.10 8.10 0.97 150 HTML_FONT_FACE_BAD 4606 0.90 0.74 0.97 151 HTTPS_HTTP_MISMATCH 4405 0.95 1.02 0.92 152 T_FILL_THIS_FORM_SHORT 4381 1.58 3.11 0.92 153 XMBody_95 4371 0.71 0.22 0.92 154 XMGappySubj_01 4315 0.69 0.19 0.90 155 SpammyFromTLD_01 4254 2.42 5.99 0.89 156 XMGenDplmaNmb 4209 1.12 1.67 0.88 157 XMBrknScrpt_02 3787 1.38 2.75 0.79 158 XMBody_17 3654 1.34 2.68 0.77 159 NML_ADSP_CUSTOM_MED 3627 0.81 0.92 0.76 160 T_OBFU_PDF_ATTACH 3558 0.57 0.17 0.75 161 T_XMHurry_00 3533 1.01 1.64 0.74 162 XM_E_Blogspot 3379 0.52 0.06 0.71 163 XM_SPF_Unknown 3348 0.66 0.56 0.70 164 PDS_OTHER_BAD_TLD 3245 1.61 3.79 0.68 165 T_XMDrugObfuBody_00 3136 0.80 1.14 0.66 166 XM_ShortIntro_01 3076 0.54 0.29 0.64 167 XMNoVowels 3072 0.59 0.45 0.64 168 FORGED_GMAIL_RCVD 3051 0.97 1.75 0.64 169 XMMoneyMeta_00 3024 0.68 0.80 0.63 170 FROM_GOV_DKIM_AU 2998 0.46 0.08 0.63 171 T_TooManySym_03 2927 0.48 0.17 0.61 172 XMSexyCombo_01 2892 0.82 1.31 0.61 173 TM2_M_BODY_EMPTY 2792 0.42 0.05 0.59 174 XM_H_PHPMailer 2752 0.51 0.37 0.58 175 TR_MetaPhish_Combo_01 2706 0.67 0.91 0.57 176 XMSubMetaI_00 2676 0.77 1.25 0.56 177 XM_RXBody 2669 0.57 0.58 0.56 178 RCVD_IN_SORBS_DUL 2609 0.48 0.31 0.55 179 FROM_GOV_SPOOF 2600 0.42 0.13 0.54 180 XMOemUri 2592 0.43 0.18 0.54 181 XMHTMLBadTable_001 2592 0.55 0.55 0.54 182 HTML_IMAGE_ONLY_20 2496 0.77 1.34 0.52 183 SHORT_HELO_AND_INLINE_IMAGE 2494 0.41 0.14 0.52 184 T_Symld_Words_02 2427 0.75 1.30 0.51 185 XM_B_SpammyWords4 2410 0.94 1.97 0.50 186 RDNS_DYNAMIC 2371 0.60 0.86 0.50 187 XMSubMetaSxObfu_03 2356 0.72 1.24 0.49 188 MISSING_HEADERS 2330 0.58 0.79 0.49 189 XM_Body_Obfu01 2259 0.45 0.41 0.47 190 XM_B_COPY_HTML 2240 0.48 0.49 0.47 191 DIET_1 2234 0.56 0.76 0.47 192 XM_DIRTYINTL 2165 1.26 3.14 0.45 193 XMLngstWrd_00 2079 0.41 0.36 0.44 194 TVD_SPACE_RATIO 2034 0.47 0.56 0.43 195 TR_XM_COVIDMETA4 2021 0.72 1.42 0.42 196 HTML_IMAGE_ONLY_28 2014 0.47 0.60 0.42 197 HTML_IMAGE_ONLY_32 2002 0.49 0.65 0.42 198 T_MANY_PILL_PRICE 1950 0.29 0.02 0.41 199 HTML_TAG_BALANCE_BODY 1950 0.50 0.71 0.41 200 RELAYCOUNTRY_DE 1936 0.63 1.14 0.41 ----------------------------------------------------------------------