Email: 624068 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 1.36 sec Spam: 132302 Autolearn: 0 AvgScore: 14.12 AvgScanTime: 1.71 sec Ham: 491766 Autolearn: 0 AvgScore: -4.67 AvgScanTime: 1.26 sec Time Spent Running SA: 234.95 hours Time Spent Processing Spam: 62.71 hours Time Spent Processing Ham: 172.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123659 89.52 93.47 88.46 2 DKIM_SIGNED 109913 63.66 83.08 58.43 3 XM_DK_Pass 103494 61.71 78.23 57.27 4 DKIM_VALID 100998 59.97 76.34 55.57 5 XM_B_Unicode 100980 73.80 76.33 73.12 6 DCC_CHECK 99618 41.50 75.30 32.41 7 RELAYCOUNTRY_US 97516 80.30 73.71 82.07 8 XM_B_SpammyWords 88841 49.05 67.15 44.18 9 XMListUnsubscribeExists 87956 41.60 66.48 34.90 10 DKIM_VALID_AU 74658 45.28 56.43 42.28 11 XM_DK_Undo_02 55884 13.80 42.24 6.14 12 XM_B_Unicode3 55201 44.50 41.72 45.25 13 BAYES_50 52525 47.82 39.70 50.01 14 XM_B_SpammyWords2 49060 19.30 37.08 14.52 15 LOC_TINY_FONT_1 46678 21.44 35.28 17.71 16 HTML_FONT_LOW_CONTRAST 44897 23.72 33.94 20.97 17 TR_XM_DKIM_Undo 43880 10.81 33.17 4.79 18 BAYES_99 42668 10.66 32.25 4.85 19 DKIM_VALID_EF 41117 24.98 31.08 23.34 20 MIME_HTML_ONLY 39490 25.55 29.85 24.39 21 T_KAM_HTML_FONT_INVALID 36645 16.55 27.70 13.55 22 FVGT_m_MULTI_ODD 36070 19.93 27.26 17.96 23 RCVD_IN_MSPIKE_H2 35994 21.21 27.21 19.60 24 XMSubLong 34439 20.73 26.03 19.30 25 BAYES_999 32752 8.32 24.76 3.90 26 TR_DCC_Bayes_99 32558 7.09 24.61 2.37 27 T_TM2_M_HEADER_IN_MSG 29580 24.26 22.36 24.77 28 RELAYCOUNTRY_META 29238 8.07 22.10 4.29 29 DCC_CHECK_NEGATIVE 29015 56.38 21.93 65.65 30 XM_Body_Dirty_Words 28201 11.34 21.32 8.66 31 RCVD_IN_MSPIKE_WL 27291 24.19 20.63 25.14 32 UNTRUSTED_Relay 23299 5.09 17.61 1.72 33 BOTNET 21864 4.42 16.53 1.16 34 XM_Multi_Part_URI 20858 10.30 15.77 8.83 35 XM_UncommonTLD01 20057 5.54 15.16 2.95 36 FSL_BULK_SIG 19884 9.02 15.03 7.41 37 LOTS_OF_MONEY 19763 7.68 14.94 5.73 38 XM_B_Unsub 18415 9.23 13.92 7.97 39 BOTNET_IPINHOSTNAME 18328 5.31 13.85 3.01 40 TR_XM_SpammyWords4 15716 5.21 11.88 3.42 41 XM_B_SpammyWords3 15684 5.36 11.85 3.61 42 TR_XM_SpammyWords2 14570 2.99 11.01 0.83 43 XMSexyCombo_05 14551 4.68 11.00 2.98 44 RCVD_IN_MSPIKE_H3 14542 12.21 10.99 12.54 45 UNPARSEABLE_RELAY 13749 6.69 10.39 5.70 46 TR_XM_UnparsRelay 13532 5.86 10.23 4.69 47 MPART_ALT_DIFF 13396 11.68 10.13 12.10 48 BAYES_80 12411 5.09 9.38 3.94 49 XM_Evil_Numbers_Gen 12065 8.36 9.12 8.16 50 RCVD_IN_MSPIKE_H4 11403 9.16 8.62 9.31 51 BAYES_60 11119 7.59 8.40 7.37 52 LotsOfNums_01 10757 7.16 8.13 6.89 53 XMSubMetaSx_00 10343 4.10 7.82 3.10 54 MIME_HTML_MOSTLY 9925 3.50 7.50 2.42 55 XM_SendGrid 9860 5.35 7.45 4.79 56 TR_XM_PhishingBody 9722 3.95 7.35 3.03 57 RCVD_IN_BL_SPAMCOP_NET 9643 2.17 7.29 0.79 58 XM_B_Phish_Phrases 9215 6.11 6.97 5.88 59 HTML_IMAGE_RATIO_02 9136 4.86 6.91 4.32 60 DKIM_INVALID 8915 3.68 6.74 2.86 61 XM_H_Long_From01 8417 4.80 6.36 4.38 62 RCVD_IN_MSPIKE_BL 8318 1.61 6.29 0.36 63 SpammyFromTLD_02 8178 1.54 6.18 0.29 64 TooManyTo_001 7986 6.99 6.04 7.25 65 T_REMOTE_IMAGE 7751 4.06 5.86 3.58 66 TR_XM_MSPIKECOMBO 7749 1.49 5.86 0.32 67 XM_UB50 7491 2.17 5.66 1.23 68 XM_SPF_SoftFail 7320 2.38 5.53 1.53 69 BAYES_95 7275 3.09 5.50 2.44 70 XM_B_SpammyTLD 7017 2.20 5.30 1.36 71 RCVD_IN_RP_RNBL 6996 1.16 5.29 0.05 72 HTML_IMAGE_RATIO_04 6789 17.49 5.13 20.81 73 HTML_MIME_NO_HTML_TAG 6638 2.73 5.02 2.12 74 RELAYCOUNTRY_CA 6451 1.72 4.88 0.87 75 KHOP_HELO_FCRDNS 6318 2.09 4.78 1.37 76 SpammyFromTLD_01 6194 1.51 4.68 0.65 77 TM2_M_URI_OPT_OUT 5569 2.68 4.21 2.27 78 XM_B_Phish66 5537 2.47 4.19 2.01 79 XMNumbers 5433 3.21 4.11 2.97 80 XM_UB99 5358 0.86 4.05 0.00 81 TR_XM_DK_SendGrid 5084 3.27 3.84 3.11 82 XMStrtUSub 5007 12.69 3.78 15.09 83 MIME_QP_LONG_LINE 4934 4.09 3.73 4.19 84 TR_XM_SpammyWords3 4662 0.95 3.52 0.26 85 T_HTML_TAG_BALANCE_CENTER 4473 0.81 3.38 0.11 86 RCVD_IN_RP_SAFE 4422 5.00 3.34 5.45 87 RCVD_IN_PSBL 4314 0.74 3.26 0.06 88 HTML_IMAGE_ONLY_08 4272 0.74 3.23 0.08 89 BOTNET_NORDNS 4263 0.72 3.22 0.05 90 BODY_URI_ONLY 4255 0.69 3.22 0.01 91 TR_XM_SpammyWords5 4247 1.64 3.21 1.21 92 MIME_HTML_ONLY_MULTI 4201 8.81 3.18 10.32 93 XM_B_COVIDMETA 4076 1.27 3.08 0.79 94 URIBL_DBL_SPAM 3977 0.64 3.01 0.01 95 XM_DIRTYINTL 3971 0.89 3.00 0.32 96 HTML_IMAGE_RATIO_06 3965 5.28 3.00 5.89 97 XM_OfRef6 3924 1.22 2.97 0.75 98 GOOG_STO_IMG_HTML 3770 0.60 2.85 0.00 99 PDS_OTHER_BAD_TLD 3769 0.71 2.85 0.13 100 RELAYCOUNTRY_FR 3762 0.79 2.84 0.24 101 T_XMDrugObfuBody_08 3669 1.78 2.77 1.52 102 RCVD_IN_MSPIKE_L3 3645 0.63 2.76 0.06 103 XM_UB60 3578 0.69 2.70 0.15 104 XMStockSpam_06 3546 1.35 2.68 0.99 105 XM_UB999 3514 0.56 2.66 0.00 106 XM_UB80 3481 0.59 2.63 0.04 107 RCVD_IN_RP_CERTIFIED 3456 4.42 2.61 4.91 108 MONEY_NOHTML 3354 0.60 2.54 0.07 109 RCVD_IN_IADB_LISTED 3330 3.69 2.52 4.00 110 TR_XM_COVIDMETA1 3299 0.95 2.49 0.54 111 XM_B_Unsub2 3284 1.52 2.48 1.26 112 TM2_M_VERY_LONG_WORD 3268 1.26 2.47 0.93 113 XMDiploma_00 3225 1.33 2.44 1.03 114 MIXED_FONT_CASE 3181 0.51 2.40 0.00 115 TR_XM_SB_Phish 3174 1.95 2.40 1.83 116 HTML_IMAGE_RATIO_08 3171 2.09 2.40 2.01 117 XMBrknScrpt_02 3161 1.06 2.39 0.70 118 RCVD_IN_MSPIKE_L5 3156 0.61 2.39 0.13 119 MIXED_HREF_CASE 3141 0.50 2.37 0.00 120 MIXED_IMG_CASE 3140 0.51 2.37 0.00 121 DKIM_ADSP_CUSTOM_MED 3127 1.11 2.36 0.78 122 HTML_FONT_SIZE_LARGE 3125 0.56 2.36 0.07 123 XM_DK_Undo_01 3086 1.61 2.33 1.42 124 T_XMDrugObfuBody_14 3072 1.89 2.32 1.77 125 RCVD_IN_IADB_SPF 3045 3.23 2.30 3.49 126 XM_CamelCaseFrm001 3044 1.52 2.30 1.31 127 XMSexyCombo_01 3025 0.87 2.29 0.49 128 T_TooManySym_01 3009 3.56 2.27 3.91 129 ALL_TRUSTED 3003 12.16 2.27 14.82 130 XM_B_SpammyWords4 2983 0.71 2.25 0.29 131 XMSubPhish11 2918 1.88 2.21 1.79 132 MAILING_LIST_MULTI 2891 2.20 2.19 2.20 133 RCVD_IN_IADB_SENDERID 2883 2.93 2.18 3.13 134 RCVD_IN_IADB_DK 2877 2.84 2.17 3.02 135 NML_ADSP_CUSTOM_MED 2738 0.84 2.07 0.51 136 URI_PHP_REDIR 2729 0.44 2.06 0.00 137 XM_URI_RBL 2691 0.53 2.03 0.13 138 XM_UB95 2667 0.44 2.02 0.01 139 TR_XM_PHPDW 2614 0.63 1.98 0.27 140 TR_XM_COVIDMETA4 2597 0.64 1.96 0.28 141 URI_HEX 2536 1.33 1.92 1.18 142 TR_XM_PHPForged 2518 0.58 1.90 0.23 143 TR_XM_FormFill2 2485 0.58 1.88 0.23 144 URIBL_BLACK 2482 0.44 1.88 0.05 145 XM_H_PHPOS 2481 0.57 1.88 0.22 146 TR_Mismatch_TLD_02 2477 0.44 1.87 0.06 147 RELAYCOUNTRY_GB 2427 1.25 1.83 1.10 148 SUBJ_ALL_CAPS 2388 1.34 1.80 1.21 149 BAYES_40 2382 4.61 1.80 5.37 150 FROM_EXCESS_BASE64 2357 2.14 1.78 2.24 151 XMBody_17 2312 0.62 1.75 0.31 152 RELAYCOUNTRY_IN 2303 0.44 1.74 0.09 153 XM_H_Undi_Recip 2237 0.49 1.69 0.17 154 T_FILL_THIS_FORM_SHORT 2208 0.87 1.67 0.66 155 FORGED_GMAIL_RCVD 2174 0.67 1.64 0.40 156 T_XMHurry_00 2159 0.67 1.63 0.41 157 FILL_THIS_FORM 2120 0.53 1.60 0.24 158 LOADSA_MONEY_COMBO 2081 0.41 1.57 0.09 159 T_XMDrugObfuBody_00 2032 0.75 1.54 0.54 160 MILLION_USD 2027 0.33 1.53 0.01 161 XFER_LOTSA_MONEY 2020 0.35 1.53 0.03 162 MONEY_FORM 1951 0.32 1.47 0.01 163 TR_Symld_Words 1915 1.52 1.45 1.55 164 TR_XM_INV_DKIM 1883 0.34 1.42 0.05 165 XM_Body_Dirty_Words_01 1858 0.40 1.40 0.13 166 URI_NOVOWEL 1828 1.95 1.38 2.10 167 XM_PDF 1814 3.58 1.37 4.18 168 XMGenDplmaNmb 1799 0.76 1.36 0.60 169 HTTPS_HTTP_MISMATCH 1747 0.74 1.32 0.58 170 BAYES_20 1744 4.88 1.32 5.83 171 URI_TRY_3LD 1737 0.77 1.31 0.63 172 TR_XM_BayesRelay 1710 0.28 1.29 0.01 173 TR_LOTS_OF_MONEY3 1702 0.41 1.29 0.17 174 XM_H_Long_From02 1678 0.86 1.27 0.75 175 XM_B_SEO 1669 0.38 1.26 0.14 176 RELAYCOUNTRY_NL 1623 0.41 1.23 0.19 177 XMSubMetaSxObfu_03 1592 0.55 1.20 0.37 178 TO_NO_BRKTS_PCNT 1555 0.25 1.18 0.01 179 XMPhish14 1543 0.51 1.17 0.33 180 USER_IN_DEF_DKIM_WL 1518 7.36 1.15 9.03 181 XMBdyGiftCard01 1499 0.70 1.13 0.58 182 XMHTML_After_End 1480 1.08 1.12 1.07 183 URIBL_SBL_A 1478 0.36 1.12 0.16 184 TR_XM_SEO4 1477 0.30 1.12 0.08 185 TR_BOTNET_NEGATE 1472 0.47 1.11 0.30 186 XMBody_78 1467 0.48 1.11 0.31 187 XM_H_PHPMailer 1446 0.66 1.09 0.54 188 RELAYCOUNTRY_DE 1417 0.67 1.07 0.56 189 HTML_FONT_SIZE_HUGE 1416 0.30 1.07 0.09 190 RELAYCOUNTRY_JP 1393 0.25 1.05 0.03 191 XM_Lotto 1365 0.30 1.03 0.10 192 RCVD_IN_MSPIKE_H5 1346 2.82 1.02 3.30 193 BAYES_00 1336 13.30 1.01 16.60 194 TooManyTo_002 1316 1.78 0.99 2.00 195 XMSubMetaI_00 1291 0.53 0.98 0.41 196 XMMoneyMeta_00 1286 0.57 0.97 0.46 197 FILL_THIS_FORM_LONG 1268 0.28 0.96 0.10 198 DATE_IN_PAST_03_06 1256 0.40 0.95 0.25 199 XMPhish30 1243 0.56 0.94 0.46 200 XMPhish08 1234 0.31 0.93 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 435026 89.52 93.47 88.46 2 RELAYCOUNTRY_US 403590 80.30 73.71 82.07 3 XM_B_Unicode 359564 73.80 76.33 73.12 4 DCC_CHECK_NEGATIVE 322823 56.38 21.93 65.65 5 DKIM_SIGNED 287349 63.66 83.08 58.43 6 XM_DK_Pass 281636 61.71 78.23 57.27 7 DKIM_VALID 273283 59.97 76.34 55.57 8 BAYES_50 245934 47.82 39.70 50.01 9 XM_B_Unicode3 222540 44.50 41.72 45.25 10 XM_B_SpammyWords 217270 49.05 67.15 44.18 11 DKIM_VALID_AU 207914 45.28 56.43 42.28 12 XMListUnsubscribeExists 171632 41.60 66.48 34.90 13 DCC_CHECK 159372 41.50 75.30 32.41 14 RCVD_IN_MSPIKE_WL 123644 24.19 20.63 25.14 15 T_TM2_M_HEADER_IN_MSG 121825 24.26 22.36 24.77 16 MIME_HTML_ONLY 119938 25.55 29.85 24.39 17 DKIM_VALID_EF 114802 24.98 31.08 23.34 18 HTML_FONT_LOW_CONTRAST 103125 23.72 33.94 20.97 19 HTML_IMAGE_RATIO_04 102348 17.49 5.13 20.81 20 XM_H_Trusted_IP 102109 16.36 0.00 20.76 21 HTML_FONT_FACE_BAD 99885 16.18 0.85 20.31 22 RCVD_IN_MSPIKE_H2 96365 21.21 27.21 19.60 23 XMSubLong 94902 20.73 26.03 19.30 24 FVGT_m_MULTI_ODD 88312 19.93 27.26 17.96 25 LOC_TINY_FONT_1 87108 21.44 35.28 17.71 26 BAYES_00 81641 13.30 1.01 16.60 27 XMStrtUSub 74192 12.69 3.78 15.09 28 ALL_TRUSTED 72874 12.16 2.27 14.82 29 XM_B_SpammyWords2 71387 19.30 37.08 14.52 30 T_KAM_HTML_FONT_INVALID 66647 16.55 27.70 13.55 31 RCVD_IN_MSPIKE_H3 61656 12.21 10.99 12.54 32 MPART_ALT_DIFF 59503 11.68 10.13 12.10 33 MIME_HTML_ONLY_MULTI 50760 8.81 3.18 10.32 34 RCVD_IN_MSPIKE_H4 45759 9.16 8.62 9.31 35 USER_IN_DEF_DKIM_WL 44415 7.36 1.15 9.03 36 XM_Multi_Part_URI 43426 10.30 15.77 8.83 37 XM_Body_Dirty_Words 42570 11.34 21.32 8.66 38 XM_Evil_Numbers_Gen 40133 8.36 9.12 8.16 39 XM_B_Unsub 39200 9.23 13.92 7.97 40 XM_DKIMWhitelistDomains 38859 6.26 0.14 7.90 41 FSL_BULK_SIG 36424 9.02 15.03 7.41 42 BAYES_60 36250 7.59 8.40 7.37 43 TooManyTo_001 35650 6.99 6.04 7.25 44 XMSubNoVowel 35632 5.89 0.87 7.25 45 LotsOfNums_01 33902 7.16 8.13 6.89 46 XM_DK_Undo_02 30218 13.80 42.24 6.14 47 HTML_IMAGE_RATIO_06 28977 5.28 3.00 5.89 48 XM_B_Phish_Phrases 28931 6.11 6.97 5.88 49 BAYES_20 28689 4.88 1.32 5.83 50 LOTS_OF_MONEY 28188 7.68 14.94 5.73 51 UNPARSEABLE_RELAY 28008 6.69 10.39 5.70 52 RCVD_IN_RP_SAFE 26798 5.00 3.34 5.45 53 BAYES_40 26418 4.61 1.80 5.37 54 TR_XM_DK_Bayes 24911 4.12 0.59 5.07 55 RCVD_IN_RP_CERTIFIED 24126 4.42 2.61 4.91 56 TR_XM_DK_Bayes1 24012 3.97 0.56 4.88 57 BAYES_99 23835 10.66 32.25 4.85 58 XM_SendGrid 23558 5.35 7.45 4.79 59 TR_XM_DKIM_Undo 23553 10.81 33.17 4.79 60 TR_XM_UnparsRelay 23068 5.86 10.23 4.69 61 XM_H_Long_From01 21525 4.80 6.36 4.38 62 HTML_IMAGE_RATIO_02 21222 4.86 6.91 4.32 63 RELAYCOUNTRY_META 21108 8.07 22.10 4.29 64 TR_XM_DK_Bayes2 20807 3.41 0.37 4.23 65 MIME_QP_LONG_LINE 20586 4.09 3.73 4.19 66 IN_ZIMBRA_NJ_WHITELIST 20582 3.31 0.06 4.19 67 XM_PDF 20558 3.58 1.37 4.18 68 RCVD_IN_IADB_LISTED 19678 3.69 2.52 4.00 69 BAYES_80 19351 5.09 9.38 3.94 70 T_TooManySym_01 19232 3.56 2.27 3.91 71 BAYES_999 19190 8.32 24.76 3.90 72 XM_B_SpammyWords3 17762 5.36 11.85 3.61 73 BAYES_05 17663 2.96 0.63 3.59 74 T_REMOTE_IMAGE 17614 4.06 5.86 3.58 75 RCVD_IN_IADB_SPF 17140 3.23 2.30 3.49 76 TR_XM_SpammyWords4 16807 5.21 11.88 3.42 77 ANY_BOUNCE_MESSAGE 16573 2.80 0.68 3.37 78 BOUNCE_MESSAGE 16572 2.79 0.66 3.37 79 RCVD_IN_MSPIKE_H5 16229 2.82 1.02 3.30 80 XMSubGarbage 15621 2.55 0.23 3.18 81 RCVD_IN_IADB_SENDERID 15380 2.93 2.18 3.13 82 XMSubLongNoVowel 15349 2.52 0.27 3.12 83 TR_XM_DK_SendGrid 15297 3.27 3.84 3.11 84 XMSubMetaSx_00 15258 4.10 7.82 3.10 85 TR_XM_PhishingBody 14905 3.95 7.35 3.03 86 RCVD_IN_IADB_DK 14870 2.84 2.17 3.02 87 BOTNET_IPINHOSTNAME 14816 5.31 13.85 3.01 88 XMSexyCombo_05 14658 4.68 11.00 2.98 89 XMNumbers 14587 3.21 4.11 2.97 90 XM_UncommonTLD01 14499 5.54 15.16 2.95 91 DKIM_INVALID 14066 3.68 6.74 2.86 92 BAYES_95 11983 3.09 5.50 2.44 93 RCVD_IN_IADB_VOUCHED 11913 2.10 0.92 2.42 94 MIME_HTML_MOSTLY 11887 3.50 7.50 2.42 95 TR_DCC_Bayes_99 11677 7.09 24.61 2.37 96 TM2_M_URI_OPT_OUT 11179 2.68 4.21 2.27 97 FROM_EXCESS_BASE64 10998 2.14 1.78 2.24 98 MAILING_LIST_MULTI 10831 2.20 2.19 2.20 99 HTML_MIME_NO_HTML_TAG 10405 2.73 5.02 2.12 100 URI_NOVOWEL 10321 1.95 1.38 2.10 101 XM_B_Phish66 9866 2.47 4.19 2.01 102 HTML_IMAGE_RATIO_08 9863 2.09 2.40 2.01 103 TooManyTo_002 9815 1.78 0.99 2.00 104 T_TooManySym_02 9534 1.67 0.68 1.94 105 TR_XM_SB_Phish 9004 1.95 2.40 1.83 106 XMSubPhish11 8786 1.88 2.21 1.79 107 T_XMDrugObfuBody_14 8711 1.89 2.32 1.77 108 UNTRUSTED_Relay 8467 5.09 17.61 1.72 109 HELO_NODOT 8310 1.48 0.71 1.69 110 HELO_NO_DOMAIN 8309 1.48 0.71 1.69 111 RCVD_IN_IADB_OPTIN 7643 1.36 0.63 1.55 112 TR_Symld_Words 7602 1.52 1.45 1.55 113 XM_SPF_SoftFail 7515 2.38 5.53 1.53 114 T_XMDrugObfuBody_08 7460 1.78 2.77 1.52 115 IN_HORDE_ADDRESS_BOOK 7398 1.21 0.13 1.50 116 INVALID_MSGID 7159 1.27 0.57 1.46 117 XM_DK_Undo_01 6969 1.61 2.33 1.42 118 KHOP_HELO_FCRDNS 6744 2.09 4.78 1.37 119 XM_B_SpammyTLD 6704 2.20 5.30 1.36 120 TooManyTo_003 6589 1.23 0.82 1.34 121 XM_CamelCaseFrm001 6423 1.52 2.30 1.31 122 TO_MALFORMED 6298 1.01 0.03 1.28 123 XM_E_Blogspot 6275 1.02 0.06 1.28 124 XM_B_Unsub2 6214 1.52 2.48 1.26 125 XM_UB50 6044 2.17 5.66 1.23 126 TR_XM_SpammyWords5 5963 1.64 3.21 1.21 127 SUBJ_ALL_CAPS 5958 1.34 1.80 1.21 128 URI_HEX 5795 1.33 1.92 1.18 129 XMCapTrack 5713 1.02 0.49 1.16 130 BOTNET 5699 4.42 16.53 1.16 131 TVD_RCVD_IP 5508 0.97 0.40 1.12 132 RELAYCOUNTRY_GB 5390 1.25 1.83 1.10 133 TR_MetaPhish_Combo_01 5358 1.02 0.76 1.09 134 XMHTML_After_End 5252 1.08 1.12 1.07 135 XM_GoogleGroups 5179 0.96 0.64 1.05 136 XMDiploma_00 5068 1.33 2.44 1.03 137 XMStockSpam_06 4857 1.35 2.68 0.99 138 TooManyTo_004 4833 0.92 0.68 0.98 139 XMGappySubj_01 4784 0.79 0.13 0.97 140 TM2_M_VERY_LONG_WORD 4589 1.26 2.47 0.93 141 RELAYCOUNTRY_CA 4279 1.72 4.88 0.87 142 TR_XM_SpammyWords2 4061 2.99 11.01 0.83 143 MISSING_HEADERS 4051 0.77 0.58 0.82 144 TooManyTo_005 3945 0.76 0.58 0.80 145 RCVD_IN_BL_SPAMCOP_NET 3874 2.17 7.29 0.79 146 XM_B_COVIDMETA 3861 1.27 3.08 0.79 147 DKIM_ADSP_CUSTOM_MED 3824 1.11 2.36 0.78 148 XM_OfRef6 3693 1.22 2.97 0.75 149 XM_H_Long_From02 3685 0.86 1.27 0.75 150 XMBrknScrpt_02 3455 1.06 2.39 0.70 151 XMBSHREFv2 3308 0.61 0.39 0.67 152 HTML_IMAGE_ONLY_20 3266 0.66 0.64 0.66 153 T_FILL_THIS_FORM_SHORT 3238 0.87 1.67 0.66 154 SpammyFromTLD_01 3201 1.51 4.68 0.65 155 TM2_M_BODY_EMPTY 3183 0.54 0.16 0.65 156 XM_SPF_Unknown 3180 0.66 0.69 0.65 157 XM_RXBody 3124 0.66 0.77 0.64 158 URI_TRY_3LD 3074 0.77 1.31 0.63 159 XM_H_SpoofStaff4 3052 0.54 0.22 0.62 160 RCVD_IN_SORBS_DUL 2998 0.54 0.26 0.61 161 T_TooManySym_03 2967 0.52 0.21 0.60 162 XMGenDplmaNmb 2939 0.76 1.36 0.60 163 T_OBFU_PDF_ATTACH 2871 0.51 0.24 0.58 164 HTTPS_HTTP_MISMATCH 2871 0.74 1.32 0.58 165 XMBdyGiftCard01 2850 0.70 1.13 0.58 166 RELAYCOUNTRY_DE 2751 0.67 1.07 0.56 167 T_XMDrugObfuBody_00 2678 0.75 1.54 0.54 168 XM_H_PHPMailer 2669 0.66 1.09 0.54 169 XMNoVowels 2652 0.59 0.78 0.54 170 TR_MSPIKEBAYES00 2652 0.43 0.02 0.54 171 TR_XM_COVIDMETA1 2637 0.95 2.49 0.54 172 XM_ShortIntro_01 2597 0.57 0.72 0.53 173 XMBody_95 2522 0.44 0.15 0.51 174 NML_ADSP_CUSTOM_MED 2513 0.84 2.07 0.51 175 XMLngstWrd_00 2473 0.51 0.54 0.50 176 FROM_GOV_SPOOF 2430 0.43 0.17 0.49 177 XM_B_COPY_HTML 2424 0.52 0.60 0.49 178 XMSUPPORT 2400 0.38 0.00 0.49 179 XMSexyCombo_01 2388 0.87 2.29 0.49 180 MSGID_NOFQDN1 2382 0.39 0.05 0.48 181 XM_ProductURIs 2367 0.52 0.68 0.48 182 SHORT_HELO_AND_INLINE_IMAGE 2275 0.41 0.19 0.46 183 XMPhish30 2258 0.56 0.94 0.46 184 XMMoneyMeta_00 2248 0.57 0.97 0.46 185 XMLngstWrd_01 2226 0.46 0.48 0.45 186 MY_SERVERS_FOUND 2107 0.37 0.17 0.43 187 T_XMHurry_00 2028 0.67 1.63 0.41 188 XMSubMetaI_00 2009 0.53 0.98 0.41 189 FORGED_GMAIL_RCVD 1981 0.67 1.64 0.40 190 FROM_GOV_DKIM_AU 1958 0.40 0.43 0.40 191 XMHTMLBadTable_001 1925 0.44 0.63 0.39 192 TVD_SPACE_RATIO_MINFP 1900 0.44 0.63 0.39 193 HTML_IMAGE_ONLY_28 1836 0.39 0.44 0.37 194 TVD_SPACE_RATIO 1833 0.36 0.30 0.37 195 XMSubMetaSxObfu_03 1810 0.55 1.20 0.37 196 RDNS_DYNAMIC 1795 0.46 0.80 0.37 197 XM_B_REG_HTML 1794 0.44 0.73 0.36 198 XMLngstWrd_02 1788 0.37 0.41 0.36 199 RCVD_IN_MSPIKE_BL 1760 1.61 6.29 0.36 200 PLING_QUERY 1738 0.44 0.77 0.35 ----------------------------------------------------------------------