Email: 634776 Autolearn: 0 AvgScore: 1.70 AvgScanTime: 2.12 sec Spam: 126896 Autolearn: 0 AvgScore: 11.80 AvgScanTime: 3.82 sec Ham: 507880 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.69 sec Time Spent Running SA: 373.22 hours Time Spent Processing Spam: 134.82 hours Time Spent Processing Ham: 238.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121087 90.01 95.42 88.66 2 DKIM_SIGNED 105925 77.88 83.47 76.49 3 RELAYCOUNTRY_US 103959 82.81 81.92 83.03 4 XM_DK_Pass 103320 76.41 81.42 75.16 5 DCC_CHECK 101542 49.10 80.02 41.37 6 XM_B_Unicode 98664 73.21 77.75 72.08 7 XMListUnsubscribeExists 90095 56.64 71.00 53.05 8 DKIM_VALID 87135 70.22 68.67 70.61 9 DKIM_VALID_AU 63713 51.60 50.21 51.95 10 BAYES_50 59142 51.16 46.61 52.30 11 XM_DK_Undo_02 53462 13.95 42.13 6.91 12 XM_B_Unicode3 53377 41.20 42.06 40.98 13 MIME_HTML_ONLY 44391 23.48 34.98 20.60 14 LOC_TINY_FONT_1 44368 26.27 34.96 24.09 15 HTML_FONT_LOW_CONTRAST 39550 27.30 31.17 26.33 16 DKIM_VALID_EF 36038 26.24 28.40 25.70 17 FVGT_m_MULTI_ODD 34485 23.40 27.18 22.46 18 T_KAM_HTML_FONT_INVALID 34061 21.28 26.84 19.89 19 BAYES_99 33569 7.99 26.45 3.38 20 XMSubLong 33428 22.11 26.34 21.05 21 BOTNET 28501 6.79 22.46 2.88 22 T_TM2_M_HEADER_IN_MSG 26804 27.39 21.12 28.96 23 TR_DCC_Bayes_99 26730 5.37 21.06 1.44 24 BAYES_999 26039 6.26 20.52 2.70 25 RELAYCOUNTRY_META 24276 8.41 19.13 5.74 26 XM_Body_Dirty_Words 24217 13.67 19.08 12.31 27 DCC_CHECK_NEGATIVE 23112 48.90 18.21 56.57 28 XM_UncommonTLD01 22946 6.31 18.08 3.37 29 XM_Multi_Part_URI 22752 13.48 17.93 12.37 30 DKIM_INVALID 18790 7.66 14.81 5.87 31 XM_B_Phish_Phrases 18584 8.94 14.65 7.52 32 FSL_BULK_SIG 18256 8.89 14.39 7.52 33 BOTNET_IPINHOSTNAME 17950 6.63 14.15 4.75 34 LOTS_OF_MONEY 17676 9.69 13.93 8.63 35 XM_B_Unsub 15481 10.05 12.20 9.51 36 UNTRUSTED_Relay 14357 3.67 11.31 1.76 37 NO_DNS_FOR_FROM 14296 4.75 11.27 3.12 38 HTML_IMAGE_RATIO_02 14005 8.29 11.04 7.61 39 XM_Evil_Numbers_Gen 13285 8.86 10.47 8.46 40 RCVD_IN_MSPIKE_H2 12989 14.04 10.24 14.99 41 XMSexyCombo_05 12330 4.91 9.72 3.71 42 XM_B_COVIDMETA 12133 3.78 9.56 2.33 43 LotsOfNums_01 12040 9.59 9.49 9.62 44 XM_H_Long_From01 10673 6.07 8.41 5.49 45 XM_CamelCaseFrm001 9965 3.27 7.85 2.12 46 RCVD_IN_MSPIKE_BL 9441 3.30 7.44 2.27 47 XM_UB50 9363 2.28 7.38 1.00 48 XMSubMetaSx_00 9221 4.57 7.27 3.90 49 RCVD_IN_MSPIKE_L3 9097 3.23 7.17 2.24 50 BAYES_80 9025 3.63 7.11 2.76 51 MPART_ALT_DIFF 8750 5.24 6.90 4.83 52 HTML_IMAGE_RATIO_04 7502 5.37 5.91 5.24 53 BAYES_60 7432 5.44 5.86 5.34 54 MIME_QP_LONG_LINE 7364 6.20 5.80 6.29 55 RELAYCOUNTRY_CA 7282 2.41 5.74 1.58 56 TooManyTo_001 7158 8.37 5.64 9.05 57 UNPARSEABLE_RELAY 6701 7.93 5.28 8.60 58 T_XMDrugObfuBody_08 6394 2.31 5.04 1.63 59 XM_SPF_SoftFail 6228 2.40 4.91 1.78 60 XM_SendGrid 5815 6.32 4.58 6.76 61 URIBL_SBL_A 5774 1.09 4.55 0.23 62 MIME_HTML_MOSTLY 5233 2.67 4.12 2.30 63 T_REMOTE_IMAGE 5040 3.91 3.97 3.89 64 HTML_IMAGE_RATIO_06 4988 3.76 3.93 3.71 65 XMBody_17 4827 1.34 3.80 0.73 66 FROM_SUSPICIOUS_NTLD 4804 0.80 3.79 0.05 67 XM_OfRef6 4791 1.62 3.78 1.09 68 PDS_OTHER_BAD_TLD 4738 1.20 3.73 0.57 69 FROM_SUSPICIOUS_NTLD_FP 4708 0.78 3.71 0.05 70 BAYES_95 4644 2.01 3.66 1.60 71 TR_XM_PhishingBody 4580 1.62 3.61 1.12 72 KHOP_HELO_FCRDNS 4578 2.37 3.61 2.06 73 T_XMHurry_00 4538 1.08 3.58 0.46 74 RCVD_IN_MSPIKE_WL 4516 8.49 3.56 9.72 75 RCVD_IN_MSPIKE_H3 4516 8.49 3.56 9.72 76 MIME_HTML_ONLY_MULTI 4506 3.10 3.55 2.99 77 T_TooManySym_01 4416 4.19 3.48 4.37 78 BAYES_40 4311 5.35 3.40 5.84 79 RELAYCOUNTRY_FR 4269 0.85 3.36 0.23 80 TR_XM_MaxBayes 4259 0.69 3.36 0.02 81 SpammyFromTLD_02 4233 0.88 3.34 0.26 82 XMStrtUSub 4175 3.92 3.29 4.08 83 XM_DIRTYINTL 4173 1.07 3.29 0.52 84 RCVD_IN_BL_SPAMCOP_NET 4112 1.38 3.24 0.91 85 XM_B_SpammyTLD 4052 2.27 3.19 2.03 86 XMNumbers 4020 2.92 3.17 2.86 87 FROM_EXCESS_BASE64 4000 3.12 3.15 3.11 88 TR_XM_COVIDMETA4 3986 1.06 3.14 0.54 89 TM2_M_URI_OPT_OUT 3938 3.31 3.10 3.36 90 LongTLD 3868 0.74 3.05 0.16 91 XM_URI_RBL 3843 0.76 3.03 0.19 92 SpammyFromTLD_01 3743 1.26 2.95 0.84 93 BAYES_20 3690 4.28 2.91 4.62 94 HTML_MIME_NO_HTML_TAG 3630 2.33 2.86 2.20 95 XMDiploma_00 3617 1.73 2.85 1.45 96 SUBJ_ALL_CAPS 3505 1.89 2.76 1.67 97 RDNS_DYNAMIC 3353 0.83 2.64 0.37 98 FROM_MISSP_REPLYTO 3316 0.60 2.61 0.09 99 XM_B_Unsub2 3226 1.92 2.54 1.76 100 RCVD_IN_RP_RNBL 3205 0.59 2.53 0.11 101 URI_HEX 3195 1.79 2.52 1.61 102 HTML_IMAGE_RATIO_08 3183 2.39 2.51 2.36 103 BAYES_00 2986 17.22 2.35 20.94 104 RCVD_IN_IADB_LISTED 2976 4.82 2.35 5.44 105 TR_XM_INV_DKIM 2833 0.53 2.23 0.11 106 TR_MetaPhish_Combo_01 2783 1.14 2.19 0.87 107 RCVD_IN_IADB_SPF 2713 4.23 2.14 4.75 108 T_FILL_THIS_FORM_SHORT 2649 1.34 2.09 1.15 109 T_XMDrugObfuBody_14 2628 1.56 2.07 1.43 110 BOTNET_NORDNS 2627 0.42 2.07 0.01 111 RCVD_IN_IADB_SENDERID 2625 3.75 2.07 4.17 112 RCVD_IN_IADB_DK 2625 3.69 2.07 4.10 113 NORDNS_LOW_CONTRAST 2579 0.46 2.03 0.06 114 TR_XM_PHPDW 2556 0.78 2.01 0.47 115 TR_XM_PHPForged 2523 0.77 1.99 0.46 116 TM2_M_VERY_LONG_WORD 2489 1.47 1.96 1.35 117 TR_XM_FormFill2 2488 0.76 1.96 0.46 118 TR_XM_MaxSPIKE 2484 0.49 1.96 0.13 119 XM_H_PHPOS 2483 0.76 1.96 0.46 120 BODY_URI_ONLY 2475 0.48 1.95 0.11 121 REPLYTO_WITHOUT_TO_CC 2467 0.47 1.94 0.10 122 DATE_IN_PAST_03_06 2414 0.52 1.90 0.17 123 TR_LOTS_OF_MONEY3 2310 0.81 1.82 0.56 124 XMSexyCombo_01 2274 0.63 1.79 0.34 125 TR_XM_DK_SendGrid 2214 3.23 1.74 3.61 126 URI_TRY_3LD 2205 1.33 1.74 1.23 127 DKIM_ADSP_CUSTOM_MED 2179 1.36 1.72 1.27 128 TR_XM_DK_Bayes 2177 12.17 1.72 14.78 129 XMStockSpam_06 2173 1.27 1.71 1.16 130 TR_Mismatch_TLD_01 2162 0.51 1.70 0.22 131 BAYES_05 2097 2.91 1.65 3.22 132 HTML_SHORT_LINK_IMG_1 2092 0.34 1.65 0.01 133 FROM_MISSP_DYNIP 2059 0.32 1.62 0.00 134 MAILING_LIST_MULTI 2035 2.47 1.60 2.68 135 FORGED_GMAIL_RCVD 2030 0.75 1.60 0.54 136 XMGenDplmaNmb 2005 1.06 1.58 0.93 137 RCVD_IN_RP_SAFE 1997 7.07 1.57 8.44 138 DATE_IN_PAST_06_12 1962 0.34 1.55 0.04 139 MIME_HEADER_CTYPE_ONLY 1950 0.50 1.54 0.24 140 NML_ADSP_CUSTOM_MED 1930 1.05 1.52 0.94 141 HDRS_LCASE_IMGONLY 1878 0.30 1.48 0.01 142 T_XMDrugObfuBody_00 1851 0.83 1.46 0.68 143 RELAYCOUNTRY_DE 1712 0.76 1.35 0.61 144 T_Symld_Words_02 1708 0.70 1.35 0.54 145 XMPhish14 1693 0.50 1.33 0.29 146 XM_DK_Undo_01 1676 1.76 1.32 1.87 147 XMHTML_After_End 1665 0.86 1.31 0.75 148 TR_Symld_Words 1635 1.32 1.29 1.33 149 RELAYCOUNTRY_GB 1599 1.12 1.26 1.09 150 SHORT_SHORTNER 1575 0.27 1.24 0.03 151 TR_Mismatch_TLD_02 1550 0.30 1.22 0.07 152 TR_XM_RelayPhish 1540 0.42 1.21 0.22 153 DATE_IN_PAST_12_24 1522 0.27 1.20 0.04 154 XMMoneyMeta_00 1510 0.81 1.19 0.71 155 XMPhish08 1490 0.59 1.17 0.44 156 XMSubMetaI_00 1483 0.63 1.17 0.50 157 T_MONEY_PERCENT 1456 0.46 1.15 0.29 158 TR_LOTS_OF_MONEY2 1456 0.46 1.15 0.29 159 SHORT_URI_2 1456 0.26 1.15 0.04 160 XM_ProductURIs 1453 0.74 1.15 0.63 161 RELAYCOUNTRY_IN 1452 0.30 1.14 0.09 162 HTML_IMAGE_ONLY_04 1450 0.28 1.14 0.06 163 T_TooManySym_02 1444 1.91 1.14 2.10 164 XM_H_MailChimp 1436 0.41 1.13 0.23 165 SUBJECT_NEEDS_ENCODING 1418 0.23 1.12 0.01 166 SUBJ_ILLEGAL_CHARS 1418 0.23 1.12 0.01 167 TR_XM_COVIDMETA1 1418 0.33 1.12 0.13 168 RCVD_IN_RP_CERTIFIED 1400 6.34 1.10 7.65 169 XM_UB60 1391 0.27 1.10 0.07 170 MISSING_HEADERS 1391 0.68 1.10 0.58 171 ALL_TRUSTED 1366 10.76 1.08 13.17 172 XMPhish30 1360 0.51 1.07 0.37 173 TR_Sbj_FN_Bdy 1351 0.37 1.06 0.19 174 XM_H_PHPMailer 1347 0.63 1.06 0.52 175 XMBrknScrpt_02 1326 0.82 1.04 0.76 176 XM_Body_Obfu01 1322 0.53 1.04 0.40 177 TR_XM_DK_Bayes1 1313 11.31 1.03 13.88 178 XMCapTrack 1308 1.25 1.03 1.31 179 SUBJ_DOLLARS 1275 0.43 1.00 0.28 180 TO_EQ_FM_DOM_HTML_IMG 1259 0.21 0.99 0.01 181 HTML_SHORT_CENTER 1253 0.20 0.99 0.00 182 TR_XM_DK_Bayes2 1233 9.63 0.97 11.79 183 DIET_1 1233 0.49 0.97 0.37 184 HTTPS_HTTP_MISMATCH 1219 0.90 0.96 0.89 185 URIBL_BLACK 1216 0.22 0.96 0.03 186 XMSubPhish11 1212 0.31 0.96 0.15 187 HK_SCAM 1209 0.21 0.95 0.03 188 HK_RANDOM_REPLYTO 1205 0.33 0.95 0.17 189 PLING_QUERY 1165 0.40 0.92 0.27 190 DKIM_ADSP_NXDOMAIN 1109 0.38 0.87 0.26 191 TR_LOTS_OF_MONEY1 1099 0.19 0.87 0.02 192 REMOVE_BEFORE_LINK 1080 0.54 0.85 0.46 193 XMBody_78 1013 0.54 0.80 0.48 194 XM_H_PHPOS_M 1001 0.28 0.79 0.15 195 TR_MetaPhish_Combo_01b 1000 0.33 0.79 0.22 196 XMSubMetaSxObfu_03 992 1.07 0.78 1.14 197 MONEY_FRAUD_5 976 0.17 0.77 0.02 198 XMBdyGiftCard01 976 0.99 0.77 1.05 199 LOADSA_MONEY_COMBO 967 0.20 0.76 0.05 200 RELAYCOUNTRY_AU 966 0.60 0.76 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 450292 90.01 95.42 88.66 2 RELAYCOUNTRY_US 421704 82.81 81.92 83.03 3 DKIM_SIGNED 388456 77.88 83.47 76.49 4 XM_DK_Pass 381723 76.41 81.42 75.16 5 XM_B_Unicode 366060 73.21 77.75 72.08 6 DKIM_VALID 358626 70.22 68.67 70.61 7 DCC_CHECK_NEGATIVE 287325 48.90 18.21 56.57 8 XMListUnsubscribeExists 269437 56.64 71.00 53.05 9 BAYES_50 265622 51.16 46.61 52.30 10 DKIM_VALID_AU 263860 51.60 50.21 51.95 11 DCC_CHECK 210135 49.10 80.02 41.37 12 XM_B_Unicode3 208120 41.20 42.06 40.98 13 T_TM2_M_HEADER_IN_MSG 147090 27.39 21.12 28.96 14 HTML_FONT_LOW_CONTRAST 133725 27.30 31.17 26.33 15 DKIM_VALID_EF 130548 26.24 28.40 25.70 16 LOC_TINY_FONT_1 122372 26.27 34.96 24.09 17 FVGT_m_MULTI_ODD 114045 23.40 27.18 22.46 18 XMSubLong 106908 22.11 26.34 21.05 19 BAYES_00 106334 17.22 2.35 20.94 20 MIME_HTML_ONLY 104632 23.48 34.98 20.60 21 T_KAM_HTML_FONT_INVALID 101004 21.28 26.84 19.89 22 RCVD_IN_MSPIKE_H2 76119 14.04 10.24 14.99 23 TR_XM_DK_Bayes 75069 12.17 1.72 14.78 24 TR_XM_DK_Bayes1 70492 11.31 1.03 13.88 25 ALL_TRUSTED 66910 10.76 1.08 13.17 26 XM_Multi_Part_URI 62843 13.48 17.93 12.37 27 XM_Body_Dirty_Words 62539 13.67 19.08 12.31 28 TR_XM_DK_Bayes2 59877 9.63 0.97 11.79 29 RCVD_IN_MSPIKE_H3 49383 8.49 3.56 9.72 30 RCVD_IN_MSPIKE_WL 49383 8.49 3.56 9.72 31 LotsOfNums_01 48859 9.59 9.49 9.62 32 XM_B_Unsub 48292 10.05 12.20 9.51 33 TooManyTo_001 45962 8.37 5.64 9.05 34 LOTS_OF_MONEY 43817 9.69 13.93 8.63 35 UNPARSEABLE_RELAY 43658 7.93 5.28 8.60 36 XM_Evil_Numbers_Gen 42953 8.86 10.47 8.46 37 RCVD_IN_RP_SAFE 42853 7.07 1.57 8.44 38 RCVD_IN_RP_CERTIFIED 38872 6.34 1.10 7.65 39 HTML_IMAGE_RATIO_02 38625 8.29 11.04 7.61 40 FSL_BULK_SIG 38192 8.89 14.39 7.52 41 XM_B_Phish_Phrases 38180 8.94 14.65 7.52 42 XM_DKIMWhitelistDomains 35196 5.55 0.03 6.93 43 XM_DK_Undo_02 35099 13.95 42.13 6.91 44 XM_SendGrid 34322 6.32 4.58 6.76 45 MIME_QP_LONG_LINE 31962 6.20 5.80 6.29 46 DKIM_INVALID 29830 7.66 14.81 5.87 47 BAYES_40 29645 5.35 3.40 5.84 48 RELAYCOUNTRY_META 29140 8.41 19.13 5.74 49 XM_H_Long_From01 27888 6.07 8.41 5.49 50 RCVD_IN_IADB_LISTED 27639 4.82 2.35 5.44 51 BAYES_60 27131 5.44 5.86 5.34 52 HTML_IMAGE_RATIO_04 26613 5.37 5.91 5.24 53 MPART_ALT_DIFF 24523 5.24 6.90 4.83 54 BOTNET_IPINHOSTNAME 24131 6.63 14.15 4.75 55 RCVD_IN_IADB_SPF 24120 4.23 2.14 4.75 56 BAYES_20 23482 4.28 2.91 4.62 57 T_TooManySym_01 22195 4.19 3.48 4.37 58 XM_PDF 21696 3.56 0.69 4.27 59 RCVD_IN_IADB_SENDERID 21156 3.75 2.07 4.17 60 RCVD_IN_IADB_DK 20824 3.69 2.07 4.10 61 XMStrtUSub 20728 3.92 3.29 4.08 62 XMSubMetaSx_00 19792 4.57 7.27 3.90 63 T_REMOTE_IMAGE 19750 3.91 3.97 3.89 64 IN_ZIMBRA_NJ_WHITELIST 19427 3.06 0.01 3.83 65 XMSexyCombo_05 18857 4.91 9.72 3.71 66 HTML_IMAGE_RATIO_06 18853 3.76 3.93 3.71 67 TR_XM_DK_SendGrid 18311 3.23 1.74 3.61 68 RCVD_IN_IADB_VOUCHED 17343 2.88 0.73 3.41 69 BAYES_99 17141 7.99 26.45 3.38 70 XM_UncommonTLD01 17100 6.31 18.08 3.37 71 TM2_M_URI_OPT_OUT 17054 3.31 3.10 3.36 72 BAYES_05 16377 2.91 1.65 3.22 73 NO_DNS_FOR_FROM 15838 4.75 11.27 3.12 74 FROM_EXCESS_BASE64 15774 3.12 3.15 3.11 75 MIME_HTML_ONLY_MULTI 15202 3.10 3.55 2.99 76 ANY_BOUNCE_MESSAGE 14844 2.42 0.39 2.92 77 BOUNCE_MESSAGE 14838 2.42 0.39 2.92 78 BOTNET 14608 6.79 22.46 2.88 79 XMNumbers 14546 2.92 3.17 2.86 80 BAYES_80 14025 3.63 7.11 2.76 81 BAYES_999 13692 6.26 20.52 2.70 82 MAILING_LIST_MULTI 13617 2.47 1.60 2.68 83 HTML_IMAGE_RATIO_08 11998 2.39 2.51 2.36 84 TooManyTo_002 11863 1.98 0.58 2.34 85 XM_B_COVIDMETA 11851 3.78 9.56 2.33 86 MIME_HTML_MOSTLY 11688 2.67 4.12 2.30 87 RCVD_IN_MSPIKE_BL 11509 3.30 7.44 2.27 88 RCVD_IN_MSPIKE_L3 11381 3.23 7.17 2.24 89 HTML_MIME_NO_HTML_TAG 11186 2.33 2.86 2.20 90 RCVD_IN_IADB_OPTIN 10847 1.80 0.44 2.14 91 XM_CamelCaseFrm001 10781 3.27 7.85 2.12 92 T_TooManySym_02 10673 1.91 1.14 2.10 93 KHOP_HELO_FCRDNS 10453 2.37 3.61 2.06 94 XM_B_SpammyTLD 10334 2.27 3.19 2.03 95 XM_H_Trusted_IP 10261 1.62 0.00 2.02 96 XM_DK_Undo_01 9473 1.76 1.32 1.87 97 XM_SPF_SoftFail 9038 2.40 4.91 1.78 98 TVD_RCVD_IP 8958 1.53 0.62 1.76 99 UNTRUSTED_Relay 8955 3.67 11.31 1.76 100 XM_B_Unsub2 8947 1.92 2.54 1.76 101 SUBJ_ALL_CAPS 8464 1.89 2.76 1.67 102 TooManyTo_003 8376 1.41 0.45 1.65 103 T_XMDrugObfuBody_08 8289 2.31 5.04 1.63 104 HELO_NODOT 8257 1.44 0.71 1.63 105 HELO_NO_DOMAIN 8256 1.44 0.71 1.63 106 URI_HEX 8195 1.79 2.52 1.61 107 BAYES_95 8119 2.01 3.66 1.60 108 INVALID_MSGID 8101 1.31 0.15 1.60 109 RELAYCOUNTRY_CA 8024 2.41 5.74 1.58 110 IN_HORDE_ADDRESS_BOOK 7836 1.24 0.04 1.54 111 XM_GoogleGroups 7584 1.29 0.48 1.49 112 CK_HELO_DYNAMIC_SPLIT_IP 7349 1.20 0.21 1.45 113 XMDiploma_00 7348 1.73 2.85 1.45 114 HELO_DYNAMIC_IPADDR2 7343 1.17 0.09 1.45 115 TR_DCC_Bayes_99 7332 5.37 21.06 1.44 116 T_XMDrugObfuBody_14 7268 1.56 2.07 1.43 117 TO_MALFORMED 7139 1.15 0.14 1.41 118 HTML_FONT_FACE_BAD 6915 1.18 0.48 1.36 119 TM2_M_VERY_LONG_WORD 6844 1.47 1.96 1.35 120 TR_Symld_Words 6742 1.32 1.29 1.33 121 XMCapTrack 6638 1.25 1.03 1.31 122 TooManyTo_004 6618 1.12 0.38 1.30 123 DKIM_ADSP_CUSTOM_MED 6464 1.36 1.72 1.27 124 URI_TRY_3LD 6261 1.33 1.74 1.23 125 XMStockSpam_06 5891 1.27 1.71 1.16 126 T_FILL_THIS_FORM_SHORT 5858 1.34 2.09 1.15 127 XMSubMetaSxObfu_03 5810 1.07 0.78 1.14 128 TooManyTo_005 5749 0.97 0.32 1.13 129 TR_XM_PhishingBody 5709 1.62 3.61 1.12 130 USER_IN_DEF_DKIM_WL 5659 0.89 0.00 1.11 131 XM_OfRef6 5520 1.62 3.78 1.09 132 RELAYCOUNTRY_GB 5512 1.12 1.26 1.09 133 XMBdyGiftCard01 5313 0.99 0.77 1.05 134 XMGappySubj_01 5234 0.85 0.10 1.03 135 XM_H_Long_From02 5208 0.97 0.74 1.03 136 XMSubNoVowel 5131 0.95 0.70 1.01 137 XM_UB50 5104 2.28 7.38 1.00 138 TR_MSPIKEBAYES00 5023 0.81 0.09 0.99 139 NML_ADSP_CUSTOM_MED 4752 1.05 1.52 0.94 140 XMGenDplmaNmb 4711 1.06 1.58 0.93 141 RCVD_IN_BL_SPAMCOP_NET 4646 1.38 3.24 0.91 142 HTTPS_HTTP_MISMATCH 4511 0.90 0.96 0.89 143 TR_MetaPhish_Combo_01 4429 1.14 2.19 0.87 144 SpammyFromTLD_01 4275 1.26 2.95 0.84 145 XMBrknScrpt_02 3874 0.82 1.04 0.76 146 XMHTML_After_End 3787 0.86 1.31 0.75 147 XMBody_17 3704 1.34 3.80 0.73 148 XMMoneyMeta_00 3615 0.81 1.19 0.71 149 T_XMDrugObfuBody_00 3446 0.83 1.46 0.68 150 XM_ProductURIs 3222 0.74 1.15 0.63 151 T_TooManySym_03 3187 0.53 0.13 0.63 152 RELAYCOUNTRY_DE 3115 0.76 1.35 0.61 153 FROM_GOV_DKIM_AU 3023 0.52 0.20 0.60 154 XM_RXBody 2955 0.56 0.45 0.58 155 MISSING_HEADERS 2945 0.68 1.10 0.58 156 PDS_OTHER_BAD_TLD 2874 1.20 3.73 0.57 157 RELAYCOUNTRY_AU 2854 0.60 0.76 0.56 158 TR_LOTS_OF_MONEY3 2832 0.81 1.82 0.56 159 XMSolicitRefs_0 2790 0.55 0.54 0.55 160 XM_SPF_Unknown 2775 0.55 0.55 0.55 161 FORGED_GMAIL_RCVD 2733 0.75 1.60 0.54 162 T_Symld_Words_02 2732 0.70 1.35 0.54 163 TR_XM_COVIDMETA4 2728 1.06 3.14 0.54 164 RCVD_IN_SORBS_DUL 2656 0.44 0.09 0.52 165 XM_DIRTYINTL 2636 1.07 3.29 0.52 166 FROM_GOV_SPOOF 2634 0.46 0.22 0.52 167 XM_H_PHPMailer 2625 0.63 1.06 0.52 168 T_OBFU_PDF_ATTACH 2623 0.45 0.17 0.52 169 XM_ShortIntro_01 2576 0.51 0.50 0.51 170 XMNoVowels 2560 0.50 0.50 0.50 171 XMSubMetaI_00 2547 0.63 1.17 0.50 172 MPART_ALT_DIFF_COUNT 2434 0.53 0.74 0.48 173 HTML_IMAGE_ONLY_20 2418 0.45 0.33 0.48 174 XMBody_78 2416 0.54 0.80 0.48 175 TR_XM_PHPDW 2412 0.78 2.01 0.47 176 TR_XM_PHPForged 2361 0.77 1.99 0.46 177 TR_XM_FormFill2 2356 0.76 1.96 0.46 178 REMOVE_BEFORE_LINK 2338 0.54 0.85 0.46 179 XM_H_PHPOS 2331 0.76 1.96 0.46 180 URI_NOVOWEL 2324 0.52 0.75 0.46 181 T_XMHurry_00 2314 1.08 3.58 0.46 182 XMPhish08 2255 0.59 1.17 0.44 183 HTML_IMAGE_ONLY_28 2243 0.41 0.29 0.44 184 XMHTMLBadTable_001 2234 0.45 0.47 0.44 185 HTML_TAG_BALANCE_BODY 2213 0.49 0.72 0.44 186 SHORT_HELO_AND_INLINE_IMAGE 2103 0.34 0.02 0.41 187 XM_Body_Obfu01 2011 0.53 1.04 0.40 188 XMSlimDrugH 1943 0.41 0.52 0.38 189 HTML_IMAGE_ONLY_32 1898 0.34 0.19 0.37 190 XMPhish30 1892 0.51 1.07 0.37 191 RDNS_DYNAMIC 1891 0.83 2.64 0.37 192 DIET_1 1879 0.49 0.97 0.37 193 USER_IN_WHITELIST 1864 0.29 0.00 0.37 194 TM2_M_BODY_EMPTY 1858 0.32 0.11 0.37 195 XMBody_95 1809 0.31 0.14 0.36 196 MSGID_FROM_MTA_HEADER 1788 0.31 0.16 0.35 197 AC_DIV_BONANZA 1766 0.30 0.09 0.35 198 TVD_SPACE_RATIO 1741 0.32 0.25 0.34 199 XMSexyCombo_01 1722 0.63 1.79 0.34 200 XMDateMe_00 1709 0.32 0.26 0.34 ----------------------------------------------------------------------