Email: 741411 Autolearn: 0 AvgScore: 3.90 AvgScanTime: 1.57 sec Spam: 222127 Autolearn: 0 AvgScore: 13.67 AvgScanTime: 1.74 sec Ham: 519284 Autolearn: 0 AvgScore: -0.28 AvgScanTime: 1.50 sec Time Spent Running SA: 324.14 hours Time Spent Processing Spam: 107.61 hours Time Spent Processing Ham: 216.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 213365 91.84 96.06 90.03 2 DKIM_SIGNED 194901 82.23 87.74 79.87 3 XM_DK_Pass 185331 80.15 83.43 78.75 4 DKIM_VALID 181046 78.20 81.51 76.79 5 DCC_CHECK 176761 53.93 79.58 42.96 6 XM_B_Unicode 172661 74.61 77.73 73.27 7 RELAYCOUNTRY_US 167816 81.77 75.55 84.44 8 XMListUnsubscribeExists 155976 59.56 70.22 54.99 9 XM_B_SpammyWords 153151 55.49 68.95 49.74 10 DKIM_VALID_AU 139707 59.48 62.90 58.02 11 XM_DK_Undo_02 101267 19.95 45.59 8.98 12 LOC_TINY_FONT_1 95305 31.17 42.91 26.15 13 XM_B_Unicode3 94463 43.14 42.53 43.40 14 XM_B_SpammyWords2 93101 27.59 41.91 21.46 15 BAYES_50 86269 50.07 38.84 54.87 16 TR_XM_DKIM_Undo 85611 15.94 38.54 6.28 17 HTML_FONT_LOW_CONTRAST 81163 30.59 36.54 28.05 18 BAYES_99 73970 13.79 33.30 5.44 19 RCVD_IN_MSPIKE_H2 68037 29.39 30.63 28.86 20 MIME_HTML_ONLY 65982 23.82 29.70 21.31 21 DKIM_VALID_EF 61689 29.05 27.77 29.59 22 FVGT_m_MULTI_ODD 60177 24.83 27.09 23.86 23 TR_DCC_Bayes_99 59301 9.95 26.70 2.78 24 BAYES_999 59189 11.06 26.65 4.39 25 XMSubLong 56150 21.92 25.28 20.49 26 T_KAM_HTML_FONT_INVALID 55936 21.50 25.18 19.93 27 RELAYCOUNTRY_META 50944 10.39 22.93 5.02 28 T_TM2_M_HEADER_IN_MSG 49462 25.93 22.27 27.49 29 RCVD_IN_MSPIKE_WL 46056 28.01 20.73 31.13 30 XM_Body_Dirty_Words 44881 14.23 20.21 11.67 31 XM_Multi_Part_URI 42270 14.70 19.03 12.85 32 DCC_CHECK_NEGATIVE 40928 43.87 18.43 54.76 33 UNTRUSTED_Relay 36345 6.29 16.36 1.99 34 BOTNET 34441 6.02 15.51 1.97 35 XM_B_Unsub 34174 11.74 15.38 10.19 36 XM_UncommonTLD01 32521 6.67 14.64 3.26 37 LOTS_OF_MONEY 32162 8.71 14.48 6.25 38 XM_B_SpammyWords3 30442 8.00 13.70 5.56 39 TR_XM_SpammyWords2 29545 4.71 13.30 1.04 40 RCVD_IN_MSPIKE_H3 27611 15.55 12.43 16.88 41 TR_XM_SpammyWords4 27151 6.57 12.22 4.15 42 BOTNET_IPINHOSTNAME 25735 6.77 11.59 4.71 43 XMSexyCombo_05 25730 6.06 11.58 3.70 44 XM_Evil_Numbers_Gen 25098 10.09 11.30 9.57 45 LotsOfNums_01 24475 9.96 11.02 9.51 46 RCVD_IN_BL_SPAMCOP_NET 23819 4.41 10.72 1.71 47 MPART_ALT_DIFF 23748 6.20 10.69 4.27 48 HTML_IMAGE_RATIO_02 23506 8.23 10.58 7.23 49 FSL_BULK_SIG 21454 6.53 9.66 5.19 50 BAYES_80 18767 5.57 8.45 4.34 51 XM_B_Phish_Phrases 18631 6.44 8.39 5.61 52 UNPARSEABLE_RELAY 17722 8.48 7.98 8.69 53 MIME_HTML_MOSTLY 17488 4.04 7.87 2.41 54 TR_XM_UnparsRelay 17013 6.60 7.66 6.15 55 TooManyTo_001 16890 7.82 7.60 7.91 56 RCVD_IN_MSPIKE_H4 16870 10.05 7.59 11.10 57 BAYES_60 16833 7.55 7.58 7.54 58 XM_H_Long_From01 16087 6.31 7.24 5.90 59 XMSubMetaSx_00 15816 4.45 7.12 3.31 60 XM_SendGrid 14847 7.56 6.68 7.93 61 DKIM_INVALID 13855 4.03 6.24 3.08 62 TR_XM_PhishingBody 13824 4.13 6.22 3.23 63 RELAYCOUNTRY_CA 13488 2.87 6.07 1.49 64 XM_UB50 12825 2.53 5.77 1.14 65 HTML_IMAGE_RATIO_04 12355 5.36 5.56 5.27 66 RCVD_IN_MSPIKE_BL 12062 1.86 5.43 0.33 67 SpammyFromTLD_01 12027 2.30 5.41 0.96 68 TR_XM_MSPIKECOMBO 11986 1.84 5.40 0.32 69 RELAYCOUNTRY_FR 11572 1.78 5.21 0.32 70 BAYES_95 10157 3.19 4.57 2.60 71 T_REMOTE_IMAGE 10115 3.81 4.55 3.49 72 XM_SPF_SoftFail 10106 2.51 4.55 1.64 73 TR_XM_SpammyWords5 9720 2.49 4.38 1.69 74 SpammyFromTLD_02 9365 1.49 4.22 0.32 75 XM_UB99 9269 1.25 4.17 0.00 76 XM_OfRef6 9041 1.96 4.07 1.05 77 TM2_M_URI_OPT_OUT 8668 2.90 3.90 2.48 78 HTML_IMAGE_RATIO_06 8441 3.59 3.80 3.50 79 XM_DK_Undo_01 8400 2.31 3.78 1.69 80 TR_XM_DK_SendGrid 8349 4.68 3.76 5.08 81 XMDiploma_00 8312 2.26 3.74 1.63 82 RCVD_IN_RP_SAFE 8245 7.28 3.71 8.81 83 URIBL_SBL_A 8128 1.26 3.66 0.23 84 HTML_IMAGE_RATIO_08 8012 2.63 3.61 2.22 85 BOTNET_NORDNS 7942 1.08 3.58 0.02 86 RCVD_IN_RP_RNBL 7933 1.12 3.57 0.07 87 XMNumbers 7822 3.17 3.52 3.01 88 HTML_MIME_NO_HTML_TAG 7662 2.63 3.45 2.28 89 RCVD_IN_PSBL 7624 1.17 3.43 0.21 90 KHOP_HELO_FCRDNS 7613 2.11 3.43 1.55 91 XM_UB999 7448 1.01 3.35 0.00 92 RCVD_IN_MSPIKE_L5 7416 1.04 3.34 0.06 93 XM_B_SpammyTLD 7383 2.44 3.32 2.06 94 MIME_HTML_ONLY_MULTI 7166 2.66 3.23 2.41 95 RCVD_IN_RP_CERTIFIED 7029 6.64 3.16 8.13 96 XMBody_17 6908 1.43 3.11 0.71 97 MIME_QP_LONG_LINE 6831 5.08 3.08 5.94 98 XM_DIRTYINTL 6703 1.18 3.02 0.40 99 T_XMDrugObfuBody_08 6644 1.87 2.99 1.40 100 FORGED_GMAIL_RCVD 6632 1.36 2.99 0.66 101 XMStrtUSub 6620 4.95 2.98 5.80 102 XM_B_Unsub2 6608 2.30 2.97 2.02 103 TR_LOTS_OF_MONEY3 6568 1.23 2.96 0.49 104 XM_B_Phish66 6534 2.26 2.94 1.97 105 SUBJ_ALL_CAPS 6425 1.96 2.89 1.56 106 T_FILL_THIS_FORM_SHORT 6104 1.35 2.75 0.75 107 XM_B_COVIDMETA 6034 1.45 2.72 0.91 108 FROM_EXCESS_BASE64 5982 3.56 2.69 3.94 109 TR_XM_INV_DKIM 5859 0.85 2.64 0.08 110 XMStockSpam_06 5802 1.54 2.61 1.08 111 TR_XM_SpammyWords3 5799 0.95 2.61 0.23 112 HTML_SHORT_LINK_IMG_1 5694 0.78 2.56 0.01 113 URI_HEX 5557 1.72 2.50 1.39 114 BAYES_40 5537 4.20 2.49 4.92 115 XM_CamelCaseFrm001 5459 2.23 2.46 2.14 116 XM_UB60 5248 0.80 2.36 0.13 117 DATE_IN_PAST_12_24 5098 0.71 2.30 0.03 118 TR_Mismatch_TLD_02 5070 0.73 2.28 0.07 119 T_XMDrugObfuBody_00 4982 1.58 2.24 1.30 120 T_TooManySym_01 4936 3.65 2.22 4.26 121 TR_XM_MaxBayes 4893 0.66 2.20 0.01 122 XMSexyCombo_01 4860 0.95 2.19 0.41 123 XMBdyGiftCard01 4816 1.21 2.17 0.81 124 XMBrknScrpt_02 4780 1.24 2.15 0.84 125 XMGenDplmaNmb 4676 1.22 2.11 0.84 126 XMSubMetaSxObfu_03 4671 1.14 2.10 0.73 127 TM2_M_VERY_LONG_WORD 4632 1.54 2.09 1.30 128 DIET_1 4497 0.85 2.02 0.34 129 XM_B_SpammyWords4 4451 1.03 2.00 0.61 130 PDS_OTHER_BAD_TLD 4384 1.07 1.97 0.69 131 RCVD_IN_IADB_LISTED 4357 4.85 1.96 6.08 132 XM_URI_RBL 4274 0.74 1.92 0.24 133 GOOGLE_DOC_SUSP 4125 0.57 1.86 0.02 134 BAYES_00 4113 10.52 1.85 14.22 135 DKIM_ADSP_NXDOMAIN 4105 0.72 1.85 0.24 136 BAYES_20 4066 3.15 1.83 3.72 137 XM_UB80 4013 0.58 1.81 0.05 138 TR_XM_SB_Phish 4000 2.14 1.80 2.28 139 MAILING_LIST_MULTI 3962 2.36 1.78 2.60 140 URI_TRY_3LD 3947 1.44 1.78 1.30 141 T_XMDrugObfuBody_14 3885 1.71 1.75 1.70 142 RCVD_IN_IADB_SPF 3867 4.25 1.74 5.32 143 T_XMHurry_00 3854 1.31 1.74 1.13 144 XMSubPhish11 3810 2.08 1.72 2.23 145 TR_Sbj_FN_Bdy 3717 0.60 1.67 0.13 146 RCVD_IN_IADB_DK 3682 3.72 1.66 4.60 147 RCVD_IN_IADB_SENDERID 3670 3.83 1.65 4.77 148 TR_XM_COVIDMETA4 3579 0.72 1.61 0.35 149 HTML_IMAGE_ONLY_08 3563 0.55 1.60 0.09 150 URIBL_BLACK 3462 0.51 1.56 0.06 151 XM_BadFromFormat 3409 0.65 1.53 0.27 152 RELAYCOUNTRY_GB 3319 1.11 1.49 0.95 153 HDRS_MISSP 3318 0.57 1.49 0.18 154 TR_XM_RelayPhish 3301 0.50 1.49 0.08 155 MIME_HEADER_CTYPE_ONLY 3288 0.50 1.48 0.08 156 XMSubMetaI_00 3204 0.90 1.44 0.66 157 FROM_MISSP_REPLYTO 3176 0.43 1.43 0.01 158 XMSexyCombo_04 3153 0.55 1.42 0.18 159 HDRS_LCASE_IMGONLY 3145 0.46 1.42 0.05 160 GOOG_STO_IMG_HTML 3096 0.42 1.39 0.00 161 TR_XM_DK_Bayes 3044 8.11 1.37 11.00 162 XM_OfRef7 3033 0.49 1.37 0.11 163 XM_RXBody 3026 0.54 1.36 0.19 164 TR_XM_DK_Bayes1 2975 7.88 1.34 10.68 165 FROM_SUSPICIOUS_NTLD 2861 0.43 1.29 0.06 166 XMPhish08 2832 0.51 1.27 0.18 167 RCVD_IN_MSPIKE_L3 2810 0.55 1.27 0.24 168 TR_XM_PHPDW 2768 0.61 1.25 0.34 169 TR_XM_PHPForged 2708 0.58 1.22 0.30 170 TR_XM_FormFill2 2707 0.58 1.22 0.31 171 XM_H_PHPOS 2698 0.57 1.21 0.30 172 TR_XM_COVIDMETA1 2698 0.62 1.21 0.36 173 URI_NOVOWEL 2696 2.63 1.21 3.23 174 BODY_URI_ONLY 2692 0.38 1.21 0.02 175 TR_XM_DK_Bayes2 2643 6.95 1.19 9.42 176 DKIM_ADSP_CUSTOM_MED 2611 1.05 1.18 1.00 177 HTML_IMAGE_ONLY_12 2603 0.49 1.17 0.20 178 XM_ProductURIs 2603 1.44 1.17 1.56 179 FROM_SUSPICIOUS_NTLD_FP 2544 0.39 1.15 0.06 180 XMHTML_After_End 2535 0.86 1.14 0.74 181 RELAYCOUNTRY_NL 2519 0.49 1.13 0.21 182 XM_Body_Dirty_Words_01 2495 0.50 1.12 0.23 183 MPART_ALT_DIFF_COUNT 2438 0.57 1.10 0.35 184 TR_XM_BayesRelay 2390 0.34 1.08 0.02 185 NML_ADSP_CUSTOM_MED 2390 0.83 1.08 0.72 186 BAYES_05 2377 1.92 1.07 2.29 187 HTML_FONT_SIZE_LARGE 2343 0.38 1.05 0.09 188 SUBJ_DOLLARS 2337 0.70 1.05 0.55 189 XM_B_SEO 2301 0.41 1.04 0.14 190 MONEY_FORM_SHORT 2297 0.32 1.03 0.01 191 XMPhish14 2267 0.70 1.02 0.56 192 TR_Symld_Words 2204 1.17 0.99 1.24 193 NUMERIC_HTTP_ADDR 2202 0.56 0.99 0.37 194 XM_H_Long_From02 2194 1.16 0.99 1.24 195 RELAYCOUNTRY_UA 2194 0.33 0.99 0.05 196 TR_XM_FormFill 2146 0.30 0.97 0.01 197 URI_PHP_REDIR 2118 0.29 0.95 0.00 198 XMSlimDrugH 2104 0.45 0.95 0.23 199 XMPhish30 2100 0.60 0.95 0.45 200 RELAYCOUNTRY_IN 2070 0.36 0.93 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 467516 91.84 96.06 90.03 2 RELAYCOUNTRY_US 438467 81.77 75.55 84.44 3 DKIM_SIGNED 414776 82.23 87.74 79.87 4 XM_DK_Pass 408918 80.15 83.43 78.75 5 DKIM_VALID 398759 78.20 81.51 76.79 6 XM_B_Unicode 380477 74.61 77.73 73.27 7 DKIM_VALID_AU 301273 59.48 62.90 58.02 8 XMListUnsubscribeExists 285574 59.56 70.22 54.99 9 BAYES_50 284933 50.07 38.84 54.87 10 DCC_CHECK_NEGATIVE 284338 43.87 18.43 54.76 11 XM_B_SpammyWords 258280 55.49 68.95 49.74 12 XM_B_Unicode3 225386 43.14 42.53 43.40 13 DCC_CHECK 223092 53.93 79.58 42.96 14 RCVD_IN_MSPIKE_WL 161633 28.01 20.73 31.13 15 DKIM_VALID_EF 153676 29.05 27.77 29.59 16 RCVD_IN_MSPIKE_H2 149862 29.39 30.63 28.86 17 HTML_FONT_LOW_CONTRAST 145660 30.59 36.54 28.05 18 T_TM2_M_HEADER_IN_MSG 142751 25.93 22.27 27.49 19 LOC_TINY_FONT_1 135772 31.17 42.91 26.15 20 FVGT_m_MULTI_ODD 123908 24.83 27.09 23.86 21 XM_B_SpammyWords2 111427 27.59 41.91 21.46 22 MIME_HTML_ONLY 110651 23.82 29.70 21.31 23 XMSubLong 106384 21.92 25.28 20.49 24 T_KAM_HTML_FONT_INVALID 103491 21.50 25.18 19.93 25 RCVD_IN_MSPIKE_H3 87671 15.55 12.43 16.88 26 BAYES_00 73860 10.52 1.85 14.22 27 XM_Multi_Part_URI 66753 14.70 19.03 12.85 28 ALL_TRUSTED 61031 8.50 0.89 11.75 29 XM_Body_Dirty_Words 60590 14.23 20.21 11.67 30 RCVD_IN_MSPIKE_H4 57638 10.05 7.59 11.10 31 TR_XM_DK_Bayes 57113 8.11 1.37 11.00 32 TR_XM_DK_Bayes1 55484 7.88 1.34 10.68 33 XM_B_Unsub 52900 11.74 15.38 10.19 34 XM_DKIMWhitelistDomains 50392 7.06 0.88 9.70 35 XM_Evil_Numbers_Gen 49693 10.09 11.30 9.57 36 LotsOfNums_01 49387 9.96 11.02 9.51 37 TR_XM_DK_Bayes2 48903 6.95 1.19 9.42 38 XM_DK_Undo_02 46610 19.95 45.59 8.98 39 RCVD_IN_RP_SAFE 45748 7.28 3.71 8.81 40 UNPARSEABLE_RELAY 45132 8.48 7.98 8.69 41 RCVD_IN_RP_CERTIFIED 42198 6.64 3.16 8.13 42 XM_SendGrid 41199 7.56 6.68 7.93 43 TooManyTo_001 41099 7.82 7.60 7.91 44 BAYES_60 39152 7.55 7.58 7.54 45 HTML_IMAGE_RATIO_02 37525 8.23 10.58 7.23 46 TR_XM_DKIM_Undo 32596 15.94 38.54 6.28 47 LOTS_OF_MONEY 32441 8.71 14.48 6.25 48 TR_XM_UnparsRelay 31926 6.60 7.66 6.15 49 RCVD_IN_IADB_LISTED 31583 4.85 1.96 6.08 50 MIME_QP_LONG_LINE 30844 5.08 3.08 5.94 51 XM_H_Long_From01 30660 6.31 7.24 5.90 52 XMStrtUSub 30100 4.95 2.98 5.80 53 IN_ZIMBRA_NJ_WHITELIST 29583 4.01 0.05 5.70 54 XM_B_Phish_Phrases 29136 6.44 8.39 5.61 55 XM_B_SpammyWords3 28890 8.00 13.70 5.56 56 BAYES_99 28251 13.79 33.30 5.44 57 RCVD_IN_IADB_SPF 27609 4.25 1.74 5.32 58 HTML_IMAGE_RATIO_04 27371 5.36 5.56 5.27 59 FSL_BULK_SIG 26928 6.53 9.66 5.19 60 TR_XM_DK_SendGrid 26377 4.68 3.76 5.08 61 RELAYCOUNTRY_META 26067 10.39 22.93 5.02 62 BAYES_40 25574 4.20 2.49 4.92 63 RCVD_IN_IADB_SENDERID 24750 3.83 1.65 4.77 64 BOTNET_IPINHOSTNAME 24440 6.77 11.59 4.71 65 XM_PDF 24383 3.51 0.73 4.70 66 RCVD_IN_IADB_DK 23905 3.72 1.66 4.60 67 BAYES_999 22786 11.06 26.65 4.39 68 BAYES_80 22512 5.57 8.45 4.34 69 MPART_ALT_DIFF 22199 6.20 10.69 4.27 70 T_TooManySym_01 22107 3.65 2.22 4.26 71 TR_XM_SpammyWords4 21538 6.57 12.22 4.15 72 FROM_EXCESS_BASE64 20446 3.56 2.69 3.94 73 BAYES_20 19321 3.15 1.83 3.72 74 RCVD_IN_IADB_VOUCHED 19301 2.83 0.77 3.72 75 XMSexyCombo_05 19235 6.06 11.58 3.70 76 HTML_IMAGE_RATIO_06 18195 3.59 3.80 3.50 77 T_REMOTE_IMAGE 18144 3.81 4.55 3.49 78 XMSubMetaSx_00 17206 4.45 7.12 3.31 79 XM_UncommonTLD01 16908 6.67 14.64 3.26 80 URI_NOVOWEL 16796 2.63 1.21 3.23 81 TR_XM_PhishingBody 16770 4.13 6.22 3.23 82 RCVD_IN_MSPIKE_H5 16324 2.41 0.71 3.14 83 DKIM_INVALID 16017 4.03 6.24 3.08 84 XMNumbers 15644 3.17 3.52 3.01 85 TR_DCC_Bayes_99 14440 9.95 26.70 2.78 86 MAILING_LIST_MULTI 13510 2.36 1.78 2.60 87 BAYES_95 13487 3.19 4.57 2.60 88 TM2_M_URI_OPT_OUT 12854 2.90 3.90 2.48 89 RCVD_IN_IADB_OPTIN 12810 1.89 0.54 2.47 90 MIME_HTML_ONLY_MULTI 12528 2.66 3.23 2.41 91 MIME_HTML_MOSTLY 12492 4.04 7.87 2.41 92 BAYES_05 11867 1.92 1.07 2.29 93 HTML_MIME_NO_HTML_TAG 11841 2.63 3.45 2.28 94 TR_XM_SB_Phish 11839 2.14 1.80 2.28 95 XMSubPhish11 11577 2.08 1.72 2.23 96 HTML_IMAGE_RATIO_08 11513 2.63 3.61 2.22 97 XM_CamelCaseFrm001 11108 2.23 2.46 2.14 98 TooManyTo_002 10719 1.62 0.58 2.06 99 XM_B_SpammyTLD 10706 2.44 3.32 2.06 100 XM_B_Unsub2 10470 2.30 2.97 2.02 101 UNTRUSTED_Relay 10323 6.29 16.36 1.99 102 XM_B_Phish66 10225 2.26 2.94 1.97 103 BOTNET 10225 6.02 15.51 1.97 104 T_TooManySym_02 9762 1.50 0.62 1.88 105 ANY_BOUNCE_MESSAGE 9717 1.43 0.42 1.87 106 BOUNCE_MESSAGE 9715 1.43 0.41 1.87 107 RCVD_IN_BL_SPAMCOP_NET 8874 4.41 10.72 1.71 108 T_XMDrugObfuBody_14 8810 1.71 1.75 1.70 109 XM_DK_Undo_01 8762 2.31 3.78 1.69 110 TR_XM_SpammyWords5 8757 2.49 4.38 1.69 111 XM_SPF_SoftFail 8524 2.51 4.55 1.64 112 XMDiploma_00 8455 2.26 3.74 1.63 113 XM_H_Trusted_IP 8186 1.10 0.00 1.58 114 XM_ProductURIs 8083 1.44 1.17 1.56 115 SUBJ_ALL_CAPS 8081 1.96 2.89 1.56 116 KHOP_HELO_FCRDNS 8032 2.11 3.43 1.55 117 IN_HORDE_ADDRESS_BOOK 7962 1.10 0.09 1.53 118 XMBody_95 7925 1.12 0.16 1.53 119 HELO_NODOT 7782 1.23 0.59 1.50 120 HELO_NO_DOMAIN 7779 1.22 0.58 1.50 121 RELAYCOUNTRY_CA 7762 2.87 6.07 1.49 122 T_XMDrugObfuBody_08 7250 1.87 2.99 1.40 123 URI_HEX 7214 1.72 2.50 1.39 124 TVD_RCVD_IP 7181 1.01 0.14 1.38 125 TooManyTo_003 7180 1.11 0.46 1.38 126 INVALID_MSGID 7135 1.17 0.70 1.37 127 USER_IN_DEF_DKIM_WL 6903 0.93 0.01 1.33 128 TR_MSPIKEBAYES00 6825 0.93 0.02 1.31 129 TM2_M_VERY_LONG_WORD 6749 1.54 2.09 1.30 130 URI_TRY_3LD 6743 1.44 1.78 1.30 131 T_XMDrugObfuBody_00 6735 1.58 2.24 1.30 132 TO_MALFORMED 6466 0.87 0.00 1.25 133 TR_Symld_Words 6459 1.17 0.99 1.24 134 XM_H_Long_From02 6429 1.16 0.99 1.24 135 MSGID_NOFQDN1 6411 0.95 0.27 1.23 136 XMCapTrack 6075 0.93 0.37 1.17 137 XM_UB50 5909 2.53 5.77 1.14 138 HELO_MISC_IP 5849 0.86 0.23 1.13 139 T_XMHurry_00 5846 1.31 1.74 1.13 140 XMStockSpam_06 5613 1.54 2.61 1.08 141 XM_GoogleGroups 5531 0.89 0.48 1.07 142 XM_OfRef6 5455 1.96 4.07 1.05 143 TR_XM_SpammyWords2 5400 4.71 13.30 1.04 144 XMGappySubj_01 5324 0.79 0.25 1.03 145 DKIM_ADSP_CUSTOM_MED 5180 1.05 1.18 1.00 146 XMBSHREFv2 5143 0.75 0.19 0.99 147 SpammyFromTLD_01 5010 2.30 5.41 0.96 148 TooManyTo_004 4985 0.79 0.41 0.96 149 RELAYCOUNTRY_GB 4923 1.11 1.49 0.95 150 XM_B_COVIDMETA 4743 1.45 2.72 0.91 151 XMBrknScrpt_02 4384 1.24 2.15 0.84 152 XMGenDplmaNmb 4372 1.22 2.11 0.84 153 XMBdyGiftCard01 4190 1.21 2.17 0.81 154 T_OBFU_PDF_ATTACH 4140 0.60 0.15 0.80 155 TR_MetaPhish_Combo_01 4114 0.80 0.83 0.79 156 TooManyTo_005 4032 0.64 0.33 0.78 157 FROM_GOV_DKIM_AU 3969 0.57 0.11 0.76 158 T_FILL_THIS_FORM_SHORT 3911 1.35 2.75 0.75 159 XMHTML_After_End 3868 0.86 1.14 0.74 160 HTML_FONT_FACE_BAD 3837 0.72 0.68 0.74 161 HTTPS_HTTP_MISMATCH 3834 0.76 0.83 0.74 162 XMSubMetaSxObfu_03 3770 1.14 2.10 0.73 163 NML_ADSP_CUSTOM_MED 3743 0.83 1.08 0.72 164 XMBody_17 3662 1.43 3.11 0.71 165 PDS_OTHER_BAD_TLD 3577 1.07 1.97 0.69 166 FORGED_GMAIL_RCVD 3451 1.36 2.99 0.66 167 XMSubMetaI_00 3443 0.90 1.44 0.66 168 XM_B_SpammyWords4 3174 1.03 2.00 0.61 169 XMSubNoVowel 3137 0.68 0.86 0.60 170 XM_SPF_Unknown 3097 0.63 0.71 0.60 171 T_TooManySym_03 3000 0.46 0.18 0.58 172 XMMoneyMeta_00 2974 0.68 0.93 0.57 173 XMPhish14 2916 0.70 1.02 0.56 174 SUBJ_DOLLARS 2863 0.70 1.05 0.55 175 XM_ShortIntro_01 2805 0.53 0.50 0.54 176 XMNoVowels 2732 0.49 0.40 0.53 177 RDNS_DYNAMIC 2710 0.64 0.91 0.52 178 FROM_GOV_SPOOF 2620 0.39 0.13 0.50 179 TR_LOTS_OF_MONEY3 2543 1.23 2.96 0.49 180 XMHTMLBadTable_001 2531 0.51 0.56 0.49 181 T_Symld_Words_02 2525 0.57 0.75 0.49 182 TR_BOTNET_NEGATE 2458 0.59 0.88 0.47 183 XM_H_PHPMailer 2419 0.45 0.42 0.47 184 RCVD_IN_SORBS_DUL 2360 0.38 0.19 0.45 185 XMPhish30 2332 0.60 0.95 0.45 186 XM_B_COPY_HTML 2331 0.46 0.47 0.45 187 HTML_IMAGE_ONLY_20 2304 0.39 0.27 0.44 188 SHORT_HELO_AND_INLINE_IMAGE 2294 0.33 0.06 0.44 189 PLING_QUERY 2264 0.58 0.93 0.44 190 RELAYCOUNTRY_DE 2256 0.52 0.72 0.43 191 XM_Body_Obfu01 2208 0.48 0.61 0.43 192 XMBody_78 2205 0.57 0.91 0.42 193 XM_B_REG_HTML 2174 0.40 0.34 0.42 194 XMLngstWrd_00 2161 0.42 0.43 0.42 195 XMSexyCombo_01 2150 0.95 2.19 0.41 196 MISSING_HEADERS 2144 0.40 0.37 0.41 197 HTML_IMAGE_ONLY_28 2111 0.46 0.58 0.41 198 TM2_M_BODY_EMPTY 2090 0.30 0.05 0.40 199 XM_DIRTYINTL 2052 1.18 3.02 0.40 200 SHOPIFY_IMG_NOT_RCVD_SFY 2042 0.38 0.35 0.39 ----------------------------------------------------------------------