Email: 525427 Autolearn: 0 AvgScore: 3.02 AvgScanTime: 1.35 sec Spam: 141128 Autolearn: 0 AvgScore: 14.17 AvgScanTime: 1.58 sec Ham: 384299 Autolearn: 0 AvgScore: -1.08 AvgScanTime: 1.27 sec Time Spent Running SA: 197.36 hours Time Spent Processing Spam: 61.94 hours Time Spent Processing Ham: 135.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134100 89.38 95.02 87.31 2 DKIM_SIGNED 117899 75.49 83.54 72.54 3 XM_DK_Pass 112715 73.45 79.87 71.09 4 DCC_CHECK 109353 49.58 77.48 39.33 5 DKIM_VALID 109315 71.22 77.46 68.93 6 XM_B_Unicode 102728 70.23 72.79 69.29 7 RELAYCOUNTRY_US 99920 77.62 70.80 80.13 8 XMListUnsubscribeExists 91246 51.36 64.65 46.48 9 XM_B_SpammyWords 89906 50.27 63.71 45.33 10 DKIM_VALID_AU 82836 52.73 58.70 50.54 11 XM_DK_Undo_02 61037 17.33 43.25 7.81 12 XM_B_Unicode3 56545 39.65 40.07 39.50 13 BAYES_50 55090 51.80 39.04 56.49 14 LOC_TINY_FONT_1 48955 25.62 34.69 22.29 15 XM_B_SpammyWords2 48281 22.40 34.21 18.06 16 DKIM_VALID_EF 45457 28.05 32.21 26.52 17 TR_XM_DKIM_Undo 44678 12.81 31.66 5.89 18 BAYES_99 44267 12.69 31.37 5.83 19 HTML_FONT_LOW_CONTRAST 43166 26.42 30.59 24.89 20 T_KAM_HTML_FONT_INVALID 42043 21.12 29.79 17.94 21 MIME_HTML_ONLY 41532 22.27 29.43 19.64 22 RCVD_IN_MSPIKE_H2 38518 26.25 27.29 25.86 23 FVGT_m_MULTI_ODD 37077 23.70 26.27 22.76 24 XMSubLong 34891 21.86 24.72 20.80 25 TR_DCC_Bayes_99 34051 8.73 24.13 3.08 26 RELAYCOUNTRY_META 33535 10.00 23.76 4.95 27 BAYES_999 32318 9.50 22.90 4.58 28 DCC_CHECK_NEGATIVE 31712 50.36 22.47 60.61 29 UNTRUSTED_Relay 30656 7.27 21.72 1.96 30 T_TM2_M_HEADER_IN_MSG 29967 28.99 21.23 31.84 31 RCVD_IN_MSPIKE_WL 27459 26.04 19.46 28.45 32 XM_Body_Dirty_Words 26738 13.21 18.95 11.10 33 BOTNET 26694 6.18 18.91 1.51 34 XM_UncommonTLD01 23424 7.08 16.60 3.59 35 FSL_BULK_SIG 21883 9.70 15.51 7.56 36 XM_Multi_Part_URI 21616 11.99 15.32 10.76 37 XM_B_Unsub 20671 11.13 14.65 9.84 38 MPART_ALT_DIFF 19669 7.48 13.94 5.11 39 BOTNET_IPINHOSTNAME 18292 6.59 12.96 4.26 40 LOTS_OF_MONEY 16303 8.00 11.55 6.69 41 XM_B_SpammyWords3 16156 5.98 11.45 3.97 42 XMSexyCombo_05 15872 5.25 11.25 3.05 43 MIME_HTML_MOSTLY 15747 4.63 11.16 2.24 44 UNPARSEABLE_RELAY 14984 8.68 10.62 7.97 45 TR_XM_UnparsRelay 14634 7.70 10.37 6.71 46 RCVD_IN_MSPIKE_H3 14621 13.86 10.36 15.14 47 TR_XM_SpammyWords4 14189 5.76 10.05 4.19 48 TR_XM_SpammyWords2 14175 3.57 10.04 1.19 49 BAYES_80 13035 5.73 9.24 4.44 50 XM_Evil_Numbers_Gen 12680 8.24 8.98 7.97 51 RCVD_IN_BL_SPAMCOP_NET 12663 3.10 8.97 0.94 52 XMSubMetaSx_00 12589 5.46 8.92 4.19 53 BAYES_60 11757 8.61 8.33 8.71 54 HTML_IMAGE_RATIO_02 11734 6.37 8.31 5.66 55 RCVD_IN_MSPIKE_H4 11506 9.97 8.15 10.64 56 SpammyFromTLD_01 11286 2.76 8.00 0.84 57 TR_XM_PhishingBody 10998 4.83 7.79 3.74 58 XM_SendGrid 10482 7.19 7.43 7.10 59 LotsOfNums_01 9941 8.61 7.04 9.18 60 XM_B_Phish_Phrases 9838 4.63 6.97 3.77 61 XM_UB50 9828 2.78 6.96 1.24 62 SpammyFromTLD_02 8903 1.98 6.31 0.39 63 RCVD_IN_MSPIKE_BL 8658 1.93 6.13 0.38 64 HTML_MIME_NO_HTML_TAG 8612 3.18 6.10 2.11 65 DKIM_INVALID 8584 4.28 6.08 3.61 66 XM_H_Long_From01 7952 5.65 5.63 5.65 67 BAYES_95 7833 3.49 5.55 2.74 68 TooManyTo_001 7832 8.02 5.55 8.92 69 T_REMOTE_IMAGE 7578 4.14 5.37 3.69 70 RELAYCOUNTRY_FR 7412 1.64 5.25 0.31 71 XM_B_Phish66 7180 3.16 5.09 2.45 72 TR_XM_MSPIKECOMBO 6964 1.56 4.93 0.32 73 XM_B_SpammyTLD 6704 2.75 4.75 2.02 74 HTML_IMAGE_RATIO_04 6518 4.95 4.62 5.07 75 XMNumbers 6176 3.57 4.38 3.28 76 RELAYCOUNTRY_CA 5902 2.07 4.18 1.29 77 XM_UB99 5890 1.12 4.17 0.00 78 TR_XM_DK_SendGrid 5857 4.21 4.15 4.24 79 URIBL_DBL_SPAM 5822 1.12 4.13 0.01 80 XM_SPF_SoftFail 5555 2.83 3.94 2.42 81 HTML_IMAGE_RATIO_06 5540 4.28 3.93 4.41 82 KHOP_HELO_FCRDNS 5364 2.37 3.80 1.84 83 T_HTML_TAG_BALANCE_CENTER 5227 1.10 3.70 0.15 84 TM2_M_URI_OPT_OUT 5197 3.18 3.68 2.99 85 TR_XM_SpammyWords3 4773 1.11 3.38 0.27 86 RCVD_IN_MSPIKE_L5 4668 0.96 3.31 0.09 87 BODY_URI_ONLY 4664 0.91 3.30 0.03 88 TR_XM_SpammyWords5 4648 1.86 3.29 1.34 89 XMStrtUSub 4624 4.24 3.28 4.60 90 BOTNET_NORDNS 4607 0.89 3.26 0.01 91 URI_PHP_REDIR 4539 0.87 3.22 0.01 92 XM_UB60 4486 0.96 3.18 0.14 93 HTML_IMAGE_ONLY_08 4462 0.93 3.16 0.10 94 MIME_QP_LONG_LINE 4407 5.00 3.12 5.69 95 PDS_OTHER_BAD_TLD 4377 1.07 3.10 0.33 96 URIBL_DBL_ABUSE_SPAM 4320 0.85 3.06 0.04 97 XM_UB80 4207 0.83 2.98 0.04 98 HTML_FONT_SIZE_LARGE 4179 0.88 2.96 0.11 99 T_XMDrugObfuBody_14 4120 2.37 2.92 2.17 100 RCVD_IN_RP_SAFE 4095 5.44 2.90 6.37 101 MIME_HTML_ONLY_MULTI 4073 3.27 2.89 3.41 102 T_XMDrugObfuBody_08 4005 1.93 2.84 1.60 103 GOOG_STO_IMG_HTML 3981 0.76 2.82 0.00 104 RCVD_IN_RP_RNBL 3894 0.76 2.76 0.03 105 XM_OfRef6 3874 1.49 2.75 1.04 106 RELAYCOUNTRY_IN 3847 0.81 2.73 0.11 107 TM2_M_VERY_LONG_WORD 3821 1.66 2.71 1.28 108 RCVD_IN_PSBL 3815 0.80 2.70 0.11 109 XM_UB999 3705 0.71 2.63 0.00 110 XM_DIRTYINTL 3669 1.01 2.60 0.43 111 XM_B_COVIDMETA 3631 1.28 2.57 0.80 112 XMDiploma_00 3620 1.71 2.57 1.40 113 XM_CamelCaseFrm001 3563 2.21 2.52 2.10 114 MIXED_HREF_CASE 3532 0.67 2.50 0.00 115 XM_B_Unsub2 3436 2.06 2.43 1.92 116 XM_B_SpammyWords4 3404 1.03 2.41 0.52 117 ALL_TRUSTED 3305 12.50 2.34 16.22 118 TR_XM_SB_Phish 3299 2.27 2.34 2.25 119 MIXED_FONT_CASE 3286 0.63 2.33 0.00 120 MIXED_IMG_CASE 3273 0.63 2.32 0.00 121 HELO_NODOT 3261 2.32 2.31 2.32 122 HELO_NO_DOMAIN 3250 2.32 2.30 2.32 123 HTML_IMAGE_RATIO_08 3228 2.34 2.29 2.36 124 T_TooManySym_01 3190 4.45 2.26 5.25 125 XM_URI_RBL 3130 0.69 2.22 0.12 126 XMSexyCombo_01 3089 1.03 2.19 0.60 127 XM_UB95 3055 0.60 2.16 0.03 128 XMSubPhish11 3037 2.20 2.15 2.22 129 RCVD_IN_RP_CERTIFIED 3037 4.79 2.15 5.76 130 MISSING_HEADERS 3031 1.00 2.15 0.58 131 RCVD_IN_IADB_LISTED 3010 4.74 2.13 5.70 132 MAILING_LIST_MULTI 2973 2.82 2.11 3.08 133 URI_NO_WWW_BIZ_CGI 2951 0.57 2.09 0.02 134 BAYES_00 2907 8.26 2.06 10.54 135 XM_ShortIntro_01 2861 1.17 2.03 0.85 136 URI_HEX 2827 1.55 2.00 1.38 137 BAYES_40 2770 4.12 1.96 4.92 138 XMBody_17 2691 0.81 1.91 0.41 139 XM_DK_Undo_01 2688 1.82 1.90 1.80 140 TR_XM_PHPDW 2636 0.71 1.87 0.28 141 RCVD_IN_IADB_SPF 2617 4.11 1.85 4.94 142 REPLYTO_WITHOUT_TO_CC 2540 0.59 1.80 0.14 143 TR_XM_COVIDMETA4 2506 0.74 1.78 0.35 144 RCVD_IN_IADB_DK 2477 3.57 1.76 4.23 145 RCVD_IN_IADB_SENDERID 2445 3.68 1.73 4.40 146 XMBrknScrpt_02 2441 1.21 1.73 1.01 147 URIBL_SBL_A 2438 0.61 1.73 0.20 148 FROM_EXCESS_BASE64 2420 2.38 1.71 2.63 149 TR_XM_PHPForged 2385 0.63 1.69 0.24 150 TR_XM_COVIDMETA1 2382 1.01 1.69 0.76 151 BODY_EMPTY 2363 0.46 1.67 0.02 152 TR_XM_FormFill2 2360 0.63 1.67 0.24 153 XM_H_PHPOS 2347 0.61 1.66 0.23 154 XMGenDplmaNmb 2341 1.10 1.66 0.89 155 RELAYCOUNTRY_NG_I 2246 0.51 1.59 0.12 156 TR_Sbj_FN_Bdy 2241 0.52 1.59 0.12 157 XMStockSpam_06 2155 1.05 1.53 0.87 158 URIBL_BLACK 2141 0.43 1.52 0.03 159 XMSubEmpty 2139 0.59 1.52 0.24 160 SUBJ_ALL_CAPS 2089 1.38 1.48 1.35 161 MISSING_SUBJECT 2036 0.45 1.44 0.08 162 XMNoSubject 2036 0.45 1.44 0.08 163 T_FILL_THIS_FORM_SHORT 2010 1.05 1.42 0.91 164 RELAYCOUNTRY_GB 1968 1.04 1.39 0.92 165 T_XMDrugObfuBody_00 1942 0.85 1.38 0.66 166 BAYES_20 1924 3.33 1.36 4.05 167 HTTPS_HTTP_MISMATCH 1884 1.19 1.33 1.14 168 TR_XM_INV_DKIM 1884 0.44 1.33 0.11 169 URI_TRY_3LD 1868 1.11 1.32 1.04 170 TR_Mismatch_TLD_02 1858 0.42 1.32 0.08 171 FROM_SUSPICIOUS_NTLD 1791 0.37 1.27 0.04 172 USER_IN_DEF_DKIM_WL 1755 8.37 1.24 10.99 173 T_XMHurry_00 1754 0.64 1.24 0.43 174 URI_NOVOWEL 1751 2.36 1.24 2.78 175 XM_JunkDunk 1750 0.33 1.24 0.00 176 TR_Symld_Words 1738 1.47 1.23 1.55 177 TR_XM_BayesRelay 1735 0.34 1.23 0.01 178 XM_PDF 1719 3.96 1.22 4.97 179 FROM_SUSPICIOUS_NTLD_FP 1708 0.35 1.21 0.04 180 RCVD_IN_MSPIKE_ZBI 1694 0.37 1.20 0.06 181 RELAYCOUNTRY_DE 1658 0.71 1.17 0.55 182 XMBdyGiftCard01 1601 0.78 1.13 0.65 183 T_Symld_Words_02 1600 0.66 1.13 0.48 184 XM_H_Long_From02 1582 1.24 1.12 1.28 185 XM_H_PHPMailer 1545 0.79 1.09 0.68 186 BAYES_05 1545 1.97 1.09 2.29 187 LUCRATIVE 1540 0.38 1.09 0.12 188 XMPhish30 1538 0.66 1.09 0.51 189 TR_BOTNET_NEGATE 1526 0.55 1.08 0.35 190 HTML_FONT_SIZE_HUGE 1483 0.35 1.05 0.09 191 XM_B_SEO 1483 0.39 1.05 0.15 192 ANY_BOUNCE_MESSAGE 1476 2.32 1.05 2.78 193 BOUNCE_MESSAGE 1470 2.31 1.04 2.78 194 XM_Body_Dirty_Words_01 1455 0.38 1.03 0.14 195 XMSubMetaSxObfu_03 1434 0.60 1.02 0.45 196 XM_H_Undi_Recip 1421 0.41 1.01 0.19 197 LongTLD 1384 0.38 0.98 0.16 198 DKIM_ADSP_CUSTOM_MED 1383 0.97 0.98 0.97 199 XMHTML_After_End 1374 1.09 0.97 1.13 200 TR_Mismatch_TLD_01 1373 0.74 0.97 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 335519 89.38 95.02 87.31 2 RELAYCOUNTRY_US 307940 77.62 70.80 80.13 3 DKIM_SIGNED 278772 75.49 83.54 72.54 4 XM_DK_Pass 273212 73.45 79.87 71.09 5 XM_B_Unicode 266271 70.23 72.79 69.29 6 DKIM_VALID 264893 71.22 77.46 68.93 7 DCC_CHECK_NEGATIVE 232910 50.36 22.47 60.61 8 BAYES_50 217094 51.80 39.04 56.49 9 DKIM_VALID_AU 194227 52.73 58.70 50.54 10 XMListUnsubscribeExists 178637 51.36 64.65 46.48 11 XM_B_SpammyWords 174206 50.27 63.71 45.33 12 XM_B_Unicode3 151805 39.65 40.07 39.50 13 DCC_CHECK 151151 49.58 77.48 39.33 14 T_TM2_M_HEADER_IN_MSG 122352 28.99 21.23 31.84 15 RCVD_IN_MSPIKE_WL 109350 26.04 19.46 28.45 16 DKIM_VALID_EF 101928 28.05 32.21 26.52 17 RCVD_IN_MSPIKE_H2 99381 26.25 27.29 25.86 18 HTML_FONT_LOW_CONTRAST 95646 26.42 30.59 24.89 19 FVGT_m_MULTI_ODD 87468 23.70 26.27 22.76 20 LOC_TINY_FONT_1 85673 25.62 34.69 22.29 21 XMSubLong 79948 21.86 24.72 20.80 22 MIME_HTML_ONLY 75470 22.27 29.43 19.64 23 XM_B_SpammyWords2 69392 22.40 34.21 18.06 24 T_KAM_HTML_FONT_INVALID 68938 21.12 29.79 17.94 25 ALL_TRUSTED 62351 12.50 2.34 16.22 26 RCVD_IN_MSPIKE_H3 58196 13.86 10.36 15.14 27 XM_Body_Dirty_Words 42665 13.21 18.95 11.10 28 USER_IN_DEF_DKIM_WL 42237 8.37 1.24 10.99 29 XM_Multi_Part_URI 41360 11.99 15.32 10.76 30 RCVD_IN_MSPIKE_H4 40886 9.97 8.15 10.64 31 BAYES_00 40513 8.26 2.06 10.54 32 XM_B_Unsub 37805 11.13 14.65 9.84 33 LotsOfNums_01 35287 8.61 7.04 9.18 34 TooManyTo_001 34282 8.02 5.55 8.92 35 BAYES_60 33456 8.61 8.33 8.71 36 XM_Evil_Numbers_Gen 30633 8.24 8.98 7.97 37 UNPARSEABLE_RELAY 30627 8.68 10.62 7.97 38 XM_DKIMWhitelistDomains 30329 5.77 0.01 7.89 39 XM_DK_Undo_02 30017 17.33 43.25 7.81 40 FSL_BULK_SIG 29068 9.70 15.51 7.56 41 XM_SendGrid 27299 7.19 7.43 7.10 42 TR_XM_UnparsRelay 25800 7.70 10.37 6.71 43 LOTS_OF_MONEY 25706 8.00 11.55 6.69 44 RCVD_IN_RP_SAFE 24494 5.44 2.90 6.37 45 TR_XM_DK_Bayes 23978 4.77 0.77 6.24 46 TR_XM_DK_Bayes1 23204 4.62 0.75 6.04 47 TR_XM_DKIM_Undo 22645 12.81 31.66 5.89 48 BAYES_99 22391 12.69 31.37 5.83 49 RCVD_IN_RP_CERTIFIED 22119 4.79 2.15 5.76 50 RCVD_IN_IADB_LISTED 21914 4.74 2.13 5.70 51 MIME_QP_LONG_LINE 21860 5.00 3.12 5.69 52 HTML_IMAGE_RATIO_02 21761 6.37 8.31 5.66 53 XM_H_Long_From01 21725 5.65 5.63 5.65 54 IN_ZIMBRA_NJ_WHITELIST 21088 4.03 0.05 5.49 55 T_TooManySym_01 20172 4.45 2.26 5.25 56 TR_XM_DK_Bayes2 19911 3.94 0.56 5.18 57 MPART_ALT_DIFF 19642 7.48 13.94 5.11 58 HTML_IMAGE_RATIO_04 19487 4.95 4.62 5.07 59 XM_PDF 19100 3.96 1.22 4.97 60 RELAYCOUNTRY_META 19011 10.00 23.76 4.95 61 RCVD_IN_IADB_SPF 18998 4.11 1.85 4.94 62 BAYES_40 18890 4.12 1.96 4.92 63 XMStrtUSub 17668 4.24 3.28 4.60 64 BAYES_999 17602 9.50 22.90 4.58 65 BAYES_80 17076 5.73 9.24 4.44 66 HTML_IMAGE_RATIO_06 16956 4.28 3.93 4.41 67 RCVD_IN_IADB_SENDERID 16902 3.68 1.73 4.40 68 BOTNET_IPINHOSTNAME 16357 6.59 12.96 4.26 69 TR_XM_DK_SendGrid 16282 4.21 4.15 4.24 70 RCVD_IN_IADB_DK 16263 3.57 1.76 4.23 71 XMSubMetaSx_00 16112 5.46 8.92 4.19 72 TR_XM_SpammyWords4 16088 5.76 10.05 4.19 73 BAYES_20 15560 3.33 1.36 4.05 74 XM_H_Trusted_IP 15271 2.91 0.00 3.97 75 XM_B_SpammyWords3 15245 5.98 11.45 3.97 76 XM_B_Phish_Phrases 14477 4.63 6.97 3.77 77 TR_XM_PhishingBody 14382 4.83 7.79 3.74 78 T_REMOTE_IMAGE 14179 4.14 5.37 3.69 79 DKIM_INVALID 13879 4.28 6.08 3.61 80 XM_UncommonTLD01 13792 7.08 16.60 3.59 81 RCVD_IN_IADB_VOUCHED 13715 2.86 0.94 3.57 82 MIME_HTML_ONLY_MULTI 13116 3.27 2.89 3.41 83 XMNumbers 12588 3.57 4.38 3.28 84 TR_DCC_Bayes_99 11841 8.73 24.13 3.08 85 MAILING_LIST_MULTI 11839 2.82 2.11 3.08 86 XMSexyCombo_05 11710 5.25 11.25 3.05 87 TM2_M_URI_OPT_OUT 11509 3.18 3.68 2.99 88 ANY_BOUNCE_MESSAGE 10694 2.32 1.05 2.78 89 BOUNCE_MESSAGE 10693 2.31 1.04 2.78 90 URI_NOVOWEL 10668 2.36 1.24 2.78 91 BAYES_95 10513 3.49 5.55 2.74 92 RCVD_IN_MSPIKE_H5 10268 2.21 0.94 2.67 93 T_TooManySym_02 10232 2.12 0.65 2.66 94 FROM_EXCESS_BASE64 10100 2.38 1.71 2.63 95 XM_B_Phish66 9407 3.16 5.09 2.45 96 TooManyTo_002 9338 1.99 0.78 2.43 97 XM_SPF_SoftFail 9310 2.83 3.94 2.42 98 HTML_IMAGE_RATIO_08 9063 2.34 2.29 2.36 99 HELO_NODOT 8922 2.32 2.31 2.32 100 HELO_NO_DOMAIN 8920 2.32 2.30 2.32 101 BAYES_05 8802 1.97 1.09 2.29 102 RCVD_IN_IADB_OPTIN 8788 1.84 0.61 2.29 103 TR_XM_SB_Phish 8647 2.27 2.34 2.25 104 MIME_HTML_MOSTLY 8601 4.63 11.16 2.24 105 XMSubPhish11 8538 2.20 2.15 2.22 106 T_XMDrugObfuBody_14 8330 2.37 2.92 2.17 107 HTML_MIME_NO_HTML_TAG 8118 3.18 6.10 2.11 108 XM_CamelCaseFrm001 8059 2.21 2.52 2.10 109 XM_B_SpammyTLD 7747 2.75 4.75 2.02 110 UNTRUSTED_Relay 7533 7.27 21.72 1.96 111 XM_B_Unsub2 7369 2.06 2.43 1.92 112 IN_HORDE_ADDRESS_BOOK 7338 1.43 0.11 1.91 113 KHOP_HELO_FCRDNS 7081 2.37 3.80 1.84 114 INVALID_MSGID 7018 1.43 0.33 1.83 115 XM_DK_Undo_01 6901 1.82 1.90 1.80 116 TO_MALFORMED 6249 1.19 0.00 1.63 117 TooManyTo_003 6172 1.34 0.63 1.61 118 T_XMDrugObfuBody_08 6139 1.93 2.84 1.60 119 TR_Symld_Words 5961 1.47 1.23 1.55 120 TVD_RCVD_IP 5909 1.23 0.38 1.54 121 BOTNET 5797 6.18 18.91 1.51 122 XMCapTrack 5670 1.22 0.53 1.48 123 XMDiploma_00 5380 1.71 2.57 1.40 124 URI_HEX 5291 1.55 2.00 1.38 125 XM_GoogleGroups 5265 1.24 0.90 1.37 126 SUBJ_ALL_CAPS 5182 1.38 1.48 1.35 127 TR_XM_SpammyWords5 5146 1.86 3.29 1.34 128 RELAYCOUNTRY_CA 4960 2.07 4.18 1.29 129 XM_H_Long_From02 4912 1.24 1.12 1.28 130 TM2_M_VERY_LONG_WORD 4903 1.66 2.71 1.28 131 XMSubNoVowel 4874 1.17 0.91 1.27 132 XM_UB50 4775 2.78 6.96 1.24 133 XMGappySubj_01 4657 0.92 0.11 1.21 134 TR_XM_SpammyWords2 4583 3.57 10.04 1.19 135 TooManyTo_004 4441 0.99 0.53 1.16 136 HTTPS_HTTP_MISMATCH 4372 1.19 1.33 1.14 137 XMHTML_After_End 4342 1.09 0.97 1.13 138 HTML_FONT_FACE_BAD 4217 0.97 0.62 1.10 139 URI_TRY_3LD 3978 1.11 1.32 1.04 140 XM_OfRef6 3978 1.49 2.75 1.04 141 XMBrknScrpt_02 3899 1.21 1.73 1.01 142 DKIM_ADSP_CUSTOM_MED 3712 0.97 0.98 0.97 143 RCVD_IN_BL_SPAMCOP_NET 3626 3.10 8.97 0.94 144 TooManyTo_005 3624 0.81 0.46 0.94 145 TR_MetaPhish_Combo_01 3598 0.92 0.88 0.94 146 RELAYCOUNTRY_GB 3519 1.04 1.39 0.92 147 T_FILL_THIS_FORM_SHORT 3489 1.05 1.42 0.91 148 XMGenDplmaNmb 3433 1.10 1.66 0.89 149 XMStockSpam_06 3348 1.05 1.53 0.87 150 XMBSHREFv2 3305 0.69 0.21 0.86 151 XM_ShortIntro_01 3263 1.17 2.03 0.85 152 SpammyFromTLD_01 3235 2.76 8.00 0.84 153 XM_SPF_Unknown 3130 0.81 0.78 0.81 154 XM_B_COVIDMETA 3089 1.28 2.57 0.80 155 XMBody_95 3010 0.62 0.19 0.78 156 T_TooManySym_03 2928 0.62 0.24 0.76 157 TR_XM_COVIDMETA1 2910 1.01 1.69 0.76 158 RCVD_IN_SORBS_DUL 2771 0.60 0.28 0.72 159 XMNoVowels 2743 0.70 0.66 0.71 160 XM_H_PHPMailer 2604 0.79 1.09 0.68 161 TR_MSPIKEBAYES00 2600 0.50 0.01 0.68 162 T_XMDrugObfuBody_00 2536 0.85 1.38 0.66 163 TR_Mismatch_TLD_01 2515 0.74 0.97 0.65 164 XMBdyGiftCard01 2487 0.78 1.13 0.65 165 NML_ADSP_CUSTOM_MED 2463 0.66 0.71 0.64 166 SHORT_HELO_AND_INLINE_IMAGE 2462 0.51 0.17 0.64 167 MSGID_NOFQDN1 2419 0.46 0.02 0.63 168 XMMoneyMeta_00 2394 0.71 0.96 0.62 169 XMSexyCombo_01 2314 1.03 2.19 0.60 170 XMSubMetaI_00 2297 0.69 0.92 0.60 171 T_OBFU_PDF_ATTACH 2279 0.50 0.26 0.59 172 XM_ProductURIs 2258 0.64 0.77 0.59 173 MISSING_HEADERS 2223 1.00 2.15 0.58 174 HTML_IMAGE_ONLY_20 2147 0.60 0.72 0.56 175 XMLngstWrd_00 2132 0.60 0.71 0.55 176 TM2_M_BODY_EMPTY 2113 0.63 0.85 0.55 177 RELAYCOUNTRY_DE 2096 0.71 1.17 0.55 178 XM_B_COPY_HTML 2078 0.55 0.57 0.54 179 XMHTMLBadTable_001 2047 0.54 0.56 0.53 180 XM_B_SpammyWords4 2016 1.03 2.41 0.52 181 FROM_GOV_SPOOF 1997 0.42 0.13 0.52 182 XMPhish30 1947 0.66 1.09 0.51 183 FROM_GOV_DKIM_AU 1916 0.42 0.19 0.50 184 FORGED_GMAIL_RCVD 1913 0.59 0.84 0.50 185 TVD_SPACE_RATIO 1878 0.43 0.29 0.49 186 T_Symld_Words_02 1857 0.66 1.13 0.48 187 XMLngstWrd_01 1856 0.52 0.63 0.48 188 XMPhish14 1842 0.50 0.57 0.48 189 XM_B_REG_HTML 1827 0.48 0.48 0.48 190 XMOemUri 1783 0.40 0.23 0.46 191 HTML_IMAGE_ONLY_32 1756 0.38 0.16 0.46 192 XM_Body_Obfu01 1739 0.48 0.57 0.45 193 HTML_IMAGE_ONLY_28 1719 0.51 0.68 0.45 194 XMSubMetaSxObfu_03 1719 0.60 1.02 0.45 195 RDNS_DYNAMIC 1709 0.54 0.81 0.44 196 XMDateMe_00 1694 0.42 0.37 0.44 197 XM_DIRTYINTL 1650 1.01 2.60 0.43 198 RELAYCOUNTRY_AU 1634 0.54 0.87 0.43 199 T_XMHurry_00 1634 0.64 1.24 0.43 200 XMBody_17 1557 0.81 1.91 0.41 ----------------------------------------------------------------------