Email: 610998 Autolearn: 0 AvgScore: 2.02 AvgScanTime: 2.09 sec Spam: 141129 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 3.46 sec Ham: 469869 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.68 sec Time Spent Running SA: 354.70 hours Time Spent Processing Spam: 135.65 hours Time Spent Processing Ham: 219.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135057 90.56 95.70 89.02 2 DCC_CHECK 116370 52.05 82.46 42.92 3 XM_B_Unicode 111128 73.72 78.74 72.22 4 RELAYCOUNTRY_US 101324 78.66 71.80 80.72 5 DKIM_SIGNED 100869 73.10 71.47 73.58 6 XM_DK_Pass 98212 71.79 69.59 72.45 7 XMListUnsubscribeExists 86404 52.27 61.22 49.58 8 DKIM_VALID 84289 66.25 59.72 68.20 9 BAYES_50 64355 51.17 45.60 52.85 10 DKIM_VALID_AU 63186 49.46 44.77 50.87 11 XM_B_Unicode3 53585 39.40 37.97 39.83 12 XM_DK_Undo_02 51518 13.72 36.50 6.88 13 MIME_HTML_ONLY 48173 24.35 34.13 21.41 14 T_KAM_HTML_FONT_INVALID 47101 23.80 33.37 20.93 15 LOC_TINY_FONT_1 41763 25.28 29.59 23.98 16 HTML_FONT_LOW_CONTRAST 40181 28.29 28.47 28.24 17 DKIM_VALID_EF 35024 25.11 24.82 25.20 18 FVGT_m_MULTI_ODD 33032 22.16 23.41 21.78 19 BAYES_99 32820 8.10 23.26 3.55 20 XMSubLong 29586 20.65 20.96 20.55 21 XM_B_Unsub 29005 15.13 20.55 13.50 22 XM_UncommonTLD01 28766 7.07 20.38 3.08 23 BOTNET 27981 6.61 19.83 2.64 24 TR_DCC_Bayes_99 26745 5.75 18.95 1.79 25 RELAYCOUNTRY_META 25405 7.98 18.00 4.97 26 BAYES_999 25373 6.36 17.98 2.86 27 XM_Body_Dirty_Words 24111 13.60 17.08 12.56 28 T_TM2_M_HEADER_IN_MSG 23659 24.30 16.76 26.57 29 FSL_BULK_SIG 23443 9.69 16.61 7.61 30 DCC_CHECK_NEGATIVE 22572 46.02 15.99 55.04 31 TooManyTo_001 21230 11.69 15.04 10.68 32 XM_Multi_Part_URI 20603 12.35 14.60 11.68 33 XM_B_Phish_Phrases 19443 8.87 13.78 7.40 34 BOTNET_IPINHOSTNAME 18915 6.89 13.40 4.94 35 XM_B_Unsub2 18142 6.88 12.85 5.08 36 LOTS_OF_MONEY 17471 9.20 12.38 8.25 37 UNTRUSTED_Relay 16948 3.85 12.01 1.40 38 DKIM_INVALID 16580 6.85 11.75 5.38 39 XMSexyCombo_05 16137 5.54 11.43 3.77 40 ALL_TRUSTED 16130 15.03 11.43 16.11 41 XM_Evil_Numbers_Gen 14970 9.05 10.61 8.59 42 HTML_IMAGE_RATIO_02 14947 8.35 10.59 7.68 43 LotsOfNums_01 14694 9.06 10.41 8.65 44 TooManyTo_002 14171 5.41 10.04 4.02 45 NO_DNS_FOR_FROM 13888 4.43 9.84 2.80 46 XM_B_COVIDMETA 13567 4.26 9.61 2.65 47 BAYES_80 13290 4.50 9.42 3.02 48 TooManyTo_003 12771 4.19 9.05 2.74 49 BAYES_60 11619 6.45 8.23 5.92 50 XMSubMetaSx_00 10959 4.23 7.77 3.16 51 XM_CamelCaseFrm001 10949 3.39 7.76 2.08 52 MPART_ALT_DIFF 10744 6.31 7.61 5.91 53 XM_UB50 10612 2.36 7.52 0.82 54 TooManyTo_004 10564 3.20 7.49 1.91 55 RCVD_IN_MSPIKE_H2 10377 13.04 7.35 14.74 56 XM_H_Long_From01 9665 5.77 6.85 5.44 57 KHOP_HELO_FCRDNS 9452 3.06 6.70 1.97 58 URI_WP_HACKED_2 8490 1.90 6.02 0.67 59 RCVD_IN_MSPIKE_BL 7995 2.81 5.67 1.95 60 RCVD_IN_MSPIKE_L3 7781 2.77 5.51 1.94 61 SUSPICIOUS_RECIPS 7524 1.28 5.33 0.07 62 XM_SPF_SoftFail 7355 2.41 5.21 1.57 63 TooManyTo_005 7276 2.33 5.16 1.48 64 RDNS_DYNAMIC 7185 1.44 5.09 0.35 65 HTML_IMAGE_RATIO_04 6944 5.16 4.92 5.24 66 FROM_MISSP_REPLYTO 6887 1.13 4.88 0.01 67 UNPARSEABLE_RELAY 6813 7.11 4.83 7.80 68 XM_B_SpammyTLD 6735 2.80 4.77 2.21 69 MIME_QP_LONG_LINE 6487 5.73 4.60 6.07 70 RELAYCOUNTRY_CA 6465 2.21 4.58 1.50 71 XMStrtUSub 6222 3.95 4.41 3.81 72 FROM_MISSP_DYNIP 6170 1.01 4.37 0.00 73 RCVD_IN_BL_SPAMCOP_NET 6144 1.69 4.35 0.89 74 URIBL_SBL_A 6108 1.15 4.33 0.19 75 PDS_OTHER_BAD_TLD 6010 1.44 4.26 0.60 76 MIME_HTML_ONLY_MULTI 6004 4.04 4.25 3.97 77 BAYES_95 5980 2.30 4.24 1.71 78 FROM_SUSPICIOUS_NTLD 5943 0.99 4.21 0.03 79 MIME_HTML_MOSTLY 5909 3.29 4.19 3.02 80 FROM_SUSPICIOUS_NTLD_FP 5837 0.97 4.14 0.02 81 T_XMDrugObfuBody_08 5747 2.06 4.07 1.46 82 XM_SendGrid 5526 6.45 3.92 7.21 83 TR_XM_COVIDMETA4 5505 1.55 3.90 0.85 84 TM2_M_URI_OPT_OUT 5361 3.43 3.80 3.32 85 SpammyFromTLD_02 4964 1.03 3.52 0.28 86 TR_XM_MaxBayes 4947 0.83 3.51 0.02 87 RCVD_IN_RP_RNBL 4877 0.88 3.46 0.10 88 T_REMOTE_IMAGE 4847 3.53 3.43 3.56 89 BODY_URI_ONLY 4784 0.87 3.39 0.12 90 BOTNET_NORDNS 4642 0.77 3.29 0.01 91 XM_DIRTYINTL 4545 1.14 3.22 0.52 92 XMBody_17 4530 1.19 3.21 0.58 93 SpammyFromTLD_01 4219 1.21 2.99 0.68 94 HTML_IMAGE_RATIO_06 4198 3.59 2.97 3.78 95 XMNumbers 4198 3.08 2.97 3.11 96 BAYES_40 4192 5.03 2.97 5.65 97 TR_XM_PhishingBody 4102 1.68 2.91 1.32 98 DATE_IN_PAST_03_06 4043 0.78 2.86 0.16 99 FROM_EXCESS_BASE64 4032 2.84 2.86 2.84 100 TR_LOTS_OF_MONEY3 3981 1.00 2.82 0.45 101 RELAYCOUNTRY_FR 3895 0.82 2.76 0.24 102 RCVD_IN_MSPIKE_H3 3863 7.67 2.74 9.15 103 RCVD_IN_MSPIKE_WL 3863 7.67 2.74 9.15 104 XM_OfRef6 3832 1.34 2.72 0.93 105 LongTLD 3789 0.73 2.68 0.14 106 BAYES_20 3773 4.07 2.67 4.49 107 DATE_IN_PAST_06_12 3422 0.68 2.42 0.15 108 XMDiploma_00 3418 1.78 2.42 1.59 109 XM_URI_RBL 3348 0.68 2.37 0.17 110 HTML_MIME_NO_HTML_TAG 3127 2.38 2.22 2.43 111 BAYES_00 3010 15.57 2.13 19.61 112 NORDNS_LOW_CONTRAST 2952 0.50 2.09 0.02 113 RCVD_IN_IADB_LISTED 2951 4.44 2.09 5.15 114 RELAYCOUNTRY_IN 2945 0.54 2.09 0.07 115 TM2_M_VERY_LONG_WORD 2836 1.41 2.01 1.23 116 T_TooManySym_01 2817 3.69 2.00 4.19 117 URI_HEX 2751 1.42 1.95 1.27 118 SORTED_RECIPS 2721 0.46 1.93 0.01 119 RCVD_IN_IADB_SPF 2677 3.89 1.90 4.49 120 XMSexyCombo_01 2642 0.76 1.87 0.43 121 DATE_IN_PAST_12_24 2637 0.46 1.87 0.04 122 SUBJECT_NEEDS_ENCODING 2610 0.43 1.85 0.01 123 SUBJ_ILLEGAL_CHARS 2601 0.43 1.84 0.01 124 RCVD_IN_IADB_SENDERID 2593 3.47 1.84 3.96 125 T_XMDrugObfuBody_14 2590 1.55 1.84 1.46 126 RCVD_IN_IADB_DK 2573 3.41 1.82 3.89 127 HTML_IMAGE_RATIO_08 2560 2.21 1.81 2.32 128 TR_XM_INV_DKIM 2472 0.46 1.75 0.07 129 NO_FM_NAME_IP_HOSTN 2311 0.38 1.64 0.00 130 TR_Mismatch_TLD_02 2283 0.43 1.62 0.07 131 TR_XM_DK_Bayes 2250 10.13 1.59 12.69 132 TR_XM_PHPDW 2226 0.69 1.58 0.42 133 T_FILL_THIS_FORM_SHORT 2210 1.16 1.57 1.03 134 TR_XM_PHPForged 2195 0.67 1.56 0.41 135 XMHTML_After_End 2190 0.71 1.55 0.46 136 TR_XM_DK_SendGrid 2169 3.35 1.54 3.90 137 TR_XM_FormFill2 2167 0.66 1.54 0.40 138 XM_H_PHPOS 2157 0.66 1.53 0.40 139 SUBJ_ALL_CAPS 2132 1.57 1.51 1.59 140 BAYES_05 2081 2.81 1.47 3.21 141 XMMoneyMeta_00 1989 0.83 1.41 0.66 142 XMStockSpam_06 1981 1.34 1.40 1.32 143 XMPhish30 1972 0.63 1.40 0.40 144 HEXHASH_WORD 1937 0.32 1.37 0.00 145 URI_TRY_3LD 1900 1.26 1.35 1.23 146 TR_Symld_Words 1884 1.31 1.33 1.31 147 XMBdyGiftCard01 1882 1.21 1.33 1.17 148 HTML_TITLE_SUBJ_DIFF 1810 0.34 1.28 0.06 149 XM_Combo_Sbj 1801 0.52 1.28 0.29 150 TR_XM_MaxSPIKE 1784 0.42 1.26 0.16 151 T_XMHurry_00 1767 0.60 1.25 0.40 152 XM_DK_Undo_01 1750 1.71 1.24 1.85 153 TR_MetaPhish_Combo_01 1748 1.02 1.24 0.95 154 XM_UB99 1717 0.28 1.22 0.00 155 DKIM_ADSP_NXDOMAIN 1712 0.50 1.21 0.29 156 TR_XM_RelayPhish 1692 0.39 1.20 0.14 157 RELAYCOUNTRY_DE 1688 0.54 1.20 0.34 158 XMGenDplmaNmb 1670 1.10 1.18 1.08 159 RCVD_IN_RP_SAFE 1612 6.46 1.14 8.06 160 MAILING_LIST_MULTI 1608 2.02 1.14 2.29 161 RCVD_IN_PSBL 1593 0.31 1.13 0.06 162 XM_UB60 1542 0.29 1.09 0.05 163 TR_XM_DK_Bayes1 1465 9.41 1.04 11.92 164 RELAYCOUNTRY_GB 1458 1.09 1.03 1.11 165 T_XMDrugObfuBody_00 1455 0.94 1.03 0.91 166 XM_Body_Obfu01 1447 0.47 1.03 0.30 167 XM_BadFromFormat 1427 0.34 1.01 0.14 168 XM_OfRef7 1414 0.33 1.00 0.13 169 TR_Mismatch_TLD_01 1399 0.38 0.99 0.20 170 SUBJ_DOLLARS 1392 0.48 0.99 0.33 171 XMSexyCombo_04 1320 0.36 0.94 0.18 172 DKIM_ADSP_CUSTOM_MED 1298 1.20 0.92 1.28 173 XMSubMetaI_00 1278 0.57 0.91 0.47 174 XM_UB999 1266 0.21 0.90 0.00 175 T_MONEY_PERCENT 1244 0.44 0.88 0.31 176 TR_LOTS_OF_MONEY2 1244 0.44 0.88 0.31 177 HTTPS_HTTP_MISMATCH 1244 0.81 0.88 0.79 178 TR_XM_DK_Bayes2 1236 8.33 0.88 10.56 179 XM_H_MailChimp 1194 0.33 0.85 0.18 180 XMPhish08 1193 0.52 0.85 0.42 181 RCVD_IN_RP_CERTIFIED 1191 5.77 0.84 7.25 182 XMSubMetaSxObfu_03 1123 0.51 0.80 0.43 183 FORGED_GMAIL_RCVD 1120 0.58 0.79 0.52 184 XM_SPF_Unknown 1117 0.58 0.79 0.52 185 MISSING_HEADERS 1110 0.59 0.79 0.53 186 AC_SPAMMY_URI_PATTERNS4 1098 0.19 0.78 0.01 187 NML_ADSP_CUSTOM_MED 1086 0.91 0.77 0.95 188 URIBL_BLACK 1084 0.19 0.77 0.02 189 TR_XM_COVIDMETA1 1056 0.35 0.75 0.23 190 HDRS_MISSP 1051 0.21 0.74 0.05 191 XM_H_Long_From02 1029 0.96 0.73 1.03 192 TR_Caps_n_Bayes_99 1017 0.32 0.72 0.20 193 HK_RANDOM_REPLYTO 1015 0.33 0.72 0.21 194 XMSubNoVowel 1009 1.18 0.71 1.32 195 LOADSA_MONEY_COMBO 1006 0.19 0.71 0.04 196 XM_H_PHPMailer 1006 0.54 0.71 0.49 197 XM_ProductURIs 1004 0.59 0.71 0.55 198 URI_NO_WWW_INFO_CGI 991 0.18 0.70 0.02 199 REPLYTO_WITHOUT_TO_CC 974 0.22 0.69 0.07 200 XMSubEmpty 964 0.36 0.68 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 418271 90.56 95.70 89.02 2 RELAYCOUNTRY_US 379274 78.66 71.80 80.72 3 DKIM_SIGNED 345749 73.10 71.47 73.58 4 XM_DK_Pass 340439 71.79 69.59 72.45 5 XM_B_Unicode 339326 73.72 78.74 72.22 6 DKIM_VALID 320470 66.25 59.72 68.20 7 DCC_CHECK_NEGATIVE 258629 46.02 15.99 55.04 8 BAYES_50 248321 51.17 45.60 52.85 9 DKIM_VALID_AU 239027 49.46 44.77 50.87 10 XMListUnsubscribeExists 232980 52.27 61.22 49.58 11 DCC_CHECK 201682 52.05 82.46 42.92 12 XM_B_Unicode3 187129 39.40 37.97 39.83 13 HTML_FONT_LOW_CONTRAST 132698 28.29 28.47 28.24 14 T_TM2_M_HEADER_IN_MSG 124828 24.30 16.76 26.57 15 DKIM_VALID_EF 118385 25.11 24.82 25.20 16 LOC_TINY_FONT_1 112677 25.28 29.59 23.98 17 FVGT_m_MULTI_ODD 102357 22.16 23.41 21.78 18 MIME_HTML_ONLY 100603 24.35 34.13 21.41 19 T_KAM_HTML_FONT_INVALID 98341 23.80 33.37 20.93 20 XMSubLong 96570 20.65 20.96 20.55 21 BAYES_00 92118 15.57 2.13 19.61 22 ALL_TRUSTED 75693 15.03 11.43 16.11 23 RCVD_IN_MSPIKE_H2 69268 13.04 7.35 14.74 24 XM_B_Unsub 63428 15.13 20.55 13.50 25 TR_XM_DK_Bayes 59617 10.13 1.59 12.69 26 XM_Body_Dirty_Words 59001 13.60 17.08 12.56 27 TR_XM_DK_Bayes1 56001 9.41 1.04 11.92 28 XM_Multi_Part_URI 54870 12.35 14.60 11.68 29 TooManyTo_001 50184 11.69 15.04 10.68 30 TR_XM_DK_Bayes2 49638 8.33 0.88 10.56 31 RCVD_IN_MSPIKE_H3 43002 7.67 2.74 9.15 32 RCVD_IN_MSPIKE_WL 43002 7.67 2.74 9.15 33 LotsOfNums_01 40645 9.06 10.41 8.65 34 XM_Evil_Numbers_Gen 40344 9.05 10.61 8.59 35 LOTS_OF_MONEY 38765 9.20 12.38 8.25 36 RCVD_IN_RP_SAFE 37878 6.46 1.14 8.06 37 UNPARSEABLE_RELAY 36635 7.11 4.83 7.80 38 HTML_IMAGE_RATIO_02 36081 8.35 10.59 7.68 39 FSL_BULK_SIG 35742 9.69 16.61 7.61 40 XM_DKIMWhitelistDomains 35272 5.79 0.07 7.51 41 XM_B_Phish_Phrases 34773 8.87 13.78 7.40 42 RCVD_IN_RP_CERTIFIED 34074 5.77 0.84 7.25 43 XM_SendGrid 33894 6.45 3.92 7.21 44 XM_DK_Undo_02 32330 13.72 36.50 6.88 45 MIME_QP_LONG_LINE 28531 5.73 4.60 6.07 46 BAYES_60 27802 6.45 8.23 5.92 47 MPART_ALT_DIFF 27787 6.31 7.61 5.91 48 BAYES_40 26534 5.03 2.97 5.65 49 XM_H_Long_From01 25573 5.77 6.85 5.44 50 DKIM_INVALID 25279 6.85 11.75 5.38 51 HTML_IMAGE_RATIO_04 24611 5.16 4.92 5.24 52 RCVD_IN_IADB_LISTED 24193 4.44 2.09 5.15 53 XM_B_Unsub2 23890 6.88 12.85 5.08 54 RELAYCOUNTRY_META 23366 7.98 18.00 4.97 55 BOTNET_IPINHOSTNAME 23207 6.89 13.40 4.94 56 RCVD_IN_IADB_SPF 21112 3.89 1.90 4.49 57 BAYES_20 21109 4.07 2.67 4.49 58 XM_PDF 19703 3.36 0.58 4.19 59 T_TooManySym_01 19701 3.69 2.00 4.19 60 TooManyTo_002 18900 5.41 10.04 4.02 61 MIME_HTML_ONLY_MULTI 18650 4.04 4.25 3.97 62 RCVD_IN_IADB_SENDERID 18618 3.47 1.84 3.96 63 TR_XM_DK_SendGrid 18304 3.35 1.54 3.90 64 RCVD_IN_IADB_DK 18275 3.41 1.82 3.89 65 XMStrtUSub 17888 3.95 4.41 3.81 66 HTML_IMAGE_RATIO_06 17763 3.59 2.97 3.78 67 XMSexyCombo_05 17723 5.54 11.43 3.77 68 IN_ZIMBRA_NJ_WHITELIST 16899 2.77 0.01 3.60 69 T_REMOTE_IMAGE 16748 3.53 3.43 3.56 70 BAYES_99 16670 8.10 23.26 3.55 71 TM2_M_URI_OPT_OUT 15616 3.43 3.80 3.32 72 XM_H_Trusted_IP 15603 2.55 0.00 3.32 73 BAYES_05 15069 2.81 1.47 3.21 74 XMSubMetaSx_00 14858 4.23 7.77 3.16 75 RCVD_IN_IADB_VOUCHED 14798 2.56 0.61 3.15 76 XMNumbers 14606 3.08 2.97 3.11 77 XM_UncommonTLD01 14456 7.07 20.38 3.08 78 MIME_HTML_MOSTLY 14204 3.29 4.19 3.02 79 BAYES_80 14197 4.50 9.42 3.02 80 BAYES_999 13456 6.36 17.98 2.86 81 FROM_EXCESS_BASE64 13337 2.84 2.86 2.84 82 NO_DNS_FOR_FROM 13166 4.43 9.84 2.80 83 TooManyTo_003 12855 4.19 9.05 2.74 84 ANY_BOUNCE_MESSAGE 12587 2.13 0.32 2.68 85 BOUNCE_MESSAGE 12583 2.13 0.31 2.68 86 XM_B_COVIDMETA 12475 4.26 9.61 2.65 87 BOTNET 12423 6.61 19.83 2.64 88 HTML_MIME_NO_HTML_TAG 11396 2.38 2.22 2.43 89 HTML_IMAGE_RATIO_08 10915 2.21 1.81 2.32 90 MAILING_LIST_MULTI 10738 2.02 1.14 2.29 91 XM_B_SpammyTLD 10363 2.80 4.77 2.21 92 XM_CamelCaseFrm001 9792 3.39 7.76 2.08 93 RCVD_IN_IADB_OPTIN 9325 1.62 0.39 1.98 94 HTML_FONT_FACE_BAD 9254 1.65 0.60 1.97 95 KHOP_HELO_FCRDNS 9244 3.06 6.70 1.97 96 T_TooManySym_02 9197 1.60 0.42 1.96 97 RCVD_IN_MSPIKE_BL 9185 2.81 5.67 1.95 98 TVD_RCVD_IP 9142 1.64 0.62 1.95 99 RCVD_IN_MSPIKE_L3 9114 2.77 5.51 1.94 100 TooManyTo_004 8977 3.20 7.49 1.91 101 XM_DK_Undo_01 8671 1.71 1.24 1.85 102 TR_DCC_Bayes_99 8388 5.75 18.95 1.79 103 BAYES_95 8047 2.30 4.24 1.71 104 CK_HELO_DYNAMIC_SPLIT_IP 7731 1.31 0.17 1.65 105 HELO_DYNAMIC_IPADDR2 7728 1.29 0.11 1.64 106 IN_HORDE_ADDRESS_BOOK 7665 1.26 0.04 1.63 107 INVALID_MSGID 7619 1.29 0.17 1.62 108 XMDiploma_00 7468 1.78 2.42 1.59 109 SUBJ_ALL_CAPS 7450 1.57 1.51 1.59 110 XM_SPF_SoftFail 7372 2.41 5.21 1.57 111 TO_MALFORMED 7142 1.17 0.01 1.52 112 RELAYCOUNTRY_CA 7035 2.21 4.58 1.50 113 TooManyTo_005 6968 2.33 5.16 1.48 114 T_XMDrugObfuBody_14 6859 1.55 1.84 1.46 115 T_XMDrugObfuBody_08 6856 2.06 4.07 1.46 116 HELO_NODOT 6788 1.23 0.51 1.44 117 HELO_NO_DOMAIN 6787 1.23 0.51 1.44 118 XMGappySubj_01 6735 1.15 0.19 1.43 119 UNTRUSTED_Relay 6580 3.85 12.01 1.40 120 XM_GoogleGroups 6565 1.18 0.45 1.40 121 XMStockSpam_06 6211 1.34 1.40 1.32 122 TR_XM_PhishingBody 6187 1.68 2.91 1.32 123 XMSubNoVowel 6184 1.18 0.71 1.32 124 TR_Symld_Words 6142 1.31 1.33 1.31 125 DKIM_ADSP_CUSTOM_MED 6033 1.20 0.92 1.28 126 URI_HEX 5951 1.42 1.95 1.27 127 TM2_M_VERY_LONG_WORD 5775 1.41 2.01 1.23 128 URI_TRY_3LD 5774 1.26 1.35 1.23 129 XMBdyGiftCard01 5518 1.21 1.33 1.17 130 XMCapTrack 5438 1.01 0.52 1.16 131 USER_IN_DEF_DKIM_WL 5291 0.87 0.00 1.13 132 RELAYCOUNTRY_GB 5194 1.09 1.03 1.11 133 XMGenDplmaNmb 5066 1.10 1.18 1.08 134 T_FILL_THIS_FORM_SHORT 4856 1.16 1.57 1.03 135 XM_H_Long_From02 4830 0.96 0.73 1.03 136 TR_MetaPhish_Combo_01 4485 1.02 1.24 0.95 137 NML_ADSP_CUSTOM_MED 4469 0.91 0.77 0.95 138 XM_OfRef6 4354 1.34 2.72 0.93 139 T_XMDrugObfuBody_00 4290 0.94 1.03 0.91 140 RCVD_IN_BL_SPAMCOP_NET 4159 1.69 4.35 0.89 141 TR_XM_COVIDMETA4 3988 1.55 3.90 0.85 142 XMSolicitRefs_0 3834 0.77 0.61 0.82 143 XM_UB50 3833 2.36 7.52 0.82 144 HTTPS_HTTP_MISMATCH 3693 0.81 0.88 0.79 145 XMBrknScrpt_02 3243 0.68 0.66 0.69 146 SpammyFromTLD_01 3198 1.21 2.99 0.68 147 URI_WP_HACKED_2 3138 1.90 6.02 0.67 148 TR_MSPIKEBAYES00 3103 0.51 0.01 0.66 149 XMMoneyMeta_00 3100 0.83 1.41 0.66 150 FROM_GOV_DKIM_AU 2857 0.52 0.22 0.61 151 XM_RXBody 2826 0.53 0.30 0.60 152 PDS_OTHER_BAD_TLD 2804 1.44 4.26 0.60 153 T_TooManySym_03 2784 0.48 0.11 0.59 154 HTML_IMAGE_ONLY_20 2730 0.51 0.28 0.58 155 XMBody_17 2724 1.19 3.21 0.58 156 XMHTMLBadTable_001 2703 0.58 0.58 0.58 157 XMNoVowels 2590 0.57 0.63 0.55 158 XM_ProductURIs 2579 0.59 0.71 0.55 159 FROM_GOV_SPOOF 2512 0.47 0.23 0.53 160 T_Symld_Words_02 2505 0.52 0.49 0.53 161 MISSING_HEADERS 2504 0.59 0.79 0.53 162 XM_DIRTYINTL 2446 1.14 3.22 0.52 163 XMGappySubj_02 2438 0.43 0.13 0.52 164 FORGED_GMAIL_RCVD 2422 0.58 0.79 0.52 165 XM_SPF_Unknown 2421 0.58 0.79 0.52 166 XM_H_PHPMailer 2316 0.54 0.71 0.49 167 T_OBFU_PDF_ATTACH 2295 0.41 0.13 0.49 168 XMPhish14 2276 0.52 0.62 0.48 169 PLING_QUERY 2241 0.52 0.67 0.48 170 RCVD_IN_SORBS_DUL 2195 0.40 0.16 0.47 171 XMSubMetaI_00 2194 0.57 0.91 0.47 172 XM_ShortIntro_01 2190 0.45 0.41 0.47 173 XMHTML_After_End 2155 0.71 1.55 0.46 174 TR_LOTS_OF_MONEY3 2111 1.00 2.82 0.45 175 URI_NOVOWEL 2102 0.46 0.49 0.45 176 XMSexyCombo_01 2010 0.76 1.87 0.43 177 XMSubMetaSxObfu_03 1999 0.51 0.80 0.43 178 XMPhish08 1963 0.52 0.85 0.42 179 TR_XM_PHPDW 1962 0.69 1.58 0.42 180 XMLngstWrd_00 1946 0.45 0.59 0.41 181 XM_B_COPY_HTML 1945 0.45 0.55 0.41 182 T_MANY_PILL_PRICE 1916 0.31 0.00 0.41 183 HTML_IMAGE_ONLY_28 1914 0.40 0.37 0.41 184 TR_XM_PHPForged 1904 0.67 1.56 0.41 185 T_XMHurry_00 1895 0.60 1.25 0.40 186 XMPhish30 1894 0.63 1.40 0.40 187 TR_XM_FormFill2 1892 0.66 1.54 0.40 188 XM_H_PHPOS 1874 0.66 1.53 0.40 189 XMBody_95 1872 0.33 0.10 0.40 190 HTML_TAG_BALANCE_BODY 1850 0.41 0.45 0.39 191 FILL_THIS_FORM 1802 0.43 0.58 0.38 192 USER_IN_WHITELIST 1796 0.29 0.00 0.38 193 XMRcvdHeader_15 1793 0.29 0.00 0.38 194 XMLngstWrd_01 1789 0.41 0.53 0.38 195 XMSlimDrugH 1787 0.43 0.58 0.38 196 TM2_M_BODY_EMPTY 1779 0.30 0.06 0.38 197 XMClaimOffer 1773 0.37 0.36 0.38 198 XMSubMetaSxObfu_02 1771 0.32 0.15 0.38 199 MPART_ALT_DIFF_COUNT 1739 0.44 0.65 0.37 200 HTML_IMAGE_ONLY_32 1654 0.30 0.13 0.35 ----------------------------------------------------------------------