Email: 659652 Autolearn: 0 AvgScore: 2.19 AvgScanTime: 2.15 sec Spam: 145380 Autolearn: 0 AvgScore: 12.28 AvgScanTime: 3.71 sec Ham: 514272 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 1.71 sec Time Spent Running SA: 393.71 hours Time Spent Processing Spam: 149.89 hours Time Spent Processing Ham: 243.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138849 88.97 95.51 87.12 2 DKIM_SIGNED 117045 75.38 80.51 73.92 3 XM_DK_Pass 112881 73.88 77.65 72.81 4 RELAYCOUNTRY_US 112059 79.51 77.08 80.20 5 DCC_CHECK 110850 47.64 76.25 39.55 6 XM_B_Unicode 107152 71.10 73.70 70.36 7 XMListUnsubscribeExists 100226 54.18 68.94 50.01 8 DKIM_VALID 96224 67.95 66.19 68.45 9 DKIM_VALID_AU 71936 50.29 49.48 50.52 10 BAYES_50 65723 52.11 45.21 54.07 11 XM_DK_Undo_02 62198 14.70 42.78 6.76 12 XM_B_Unicode3 56812 39.01 39.08 38.99 13 MIME_HTML_ONLY 56591 23.66 38.93 19.34 14 LOC_TINY_FONT_1 46207 24.70 31.78 22.70 15 HTML_FONT_LOW_CONTRAST 45795 29.13 31.50 28.46 16 DKIM_VALID_EF 41223 26.50 28.36 25.97 17 FVGT_m_MULTI_ODD 39220 23.37 26.98 22.35 18 BAYES_99 39106 8.69 26.90 3.54 19 T_KAM_HTML_FONT_INVALID 38454 20.00 26.45 18.18 20 XMSubLong 35973 21.92 24.74 21.12 21 DCC_CHECK_NEGATIVE 32256 50.32 22.19 58.27 22 RELAYCOUNTRY_META 31927 9.43 21.96 5.88 23 TR_DCC_Bayes_99 31530 5.92 21.69 1.46 24 BAYES_999 30374 6.78 20.89 2.79 25 BOTNET 29303 6.57 20.16 2.73 26 T_TM2_M_HEADER_IN_MSG 28094 26.90 19.32 29.04 27 XM_Body_Dirty_Words 26118 13.61 17.97 12.38 28 XM_Multi_Part_URI 24314 12.64 16.72 11.48 29 DKIM_INVALID 20821 7.42 14.32 5.47 30 XM_B_Unsub 20597 11.74 14.17 11.06 31 BOTNET_IPINHOSTNAME 20513 6.56 14.11 4.42 32 LOTS_OF_MONEY 20466 9.63 14.08 8.37 33 XM_UncommonTLD01 19865 5.71 13.66 3.46 34 UNTRUSTED_Relay 18734 4.15 12.89 1.67 35 XM_B_Phish_Phrases 18549 8.53 12.76 7.34 36 FSL_BULK_SIG 17991 8.20 12.38 7.02 37 NO_DNS_FOR_FROM 17160 4.90 11.80 2.95 38 HTML_IMAGE_RATIO_02 14554 7.56 10.01 6.87 39 RCVD_IN_MSPIKE_H2 14459 13.41 9.95 14.39 40 XMSexyCombo_05 14174 4.82 9.75 3.42 41 XM_Evil_Numbers_Gen 14168 8.34 9.75 7.95 42 LotsOfNums_01 12715 8.86 8.75 8.89 43 XM_B_COVIDMETA 11771 3.47 8.10 2.16 44 BAYES_80 11610 4.20 7.99 3.13 45 XM_CamelCaseFrm001 11572 3.39 7.96 2.10 46 XM_UB50 10887 2.45 7.49 1.03 47 BAYES_60 10565 6.52 7.27 6.31 48 HTML_IMAGE_RATIO_04 9842 5.99 6.77 5.78 49 XMSubMetaSx_00 9808 3.96 6.75 3.17 50 KHOP_HELO_FCRDNS 9651 2.95 6.64 1.91 51 RELAYCOUNTRY_CA 9411 2.65 6.47 1.56 52 TR_XM_COVIDMETA4 9319 2.61 6.41 1.54 53 RCVD_IN_MSPIKE_BL 9080 3.02 6.25 2.11 54 RCVD_IN_MSPIKE_L3 8350 2.88 5.74 2.07 55 URIBL_SBL_A 8187 1.38 5.63 0.18 56 MPART_ALT_DIFF 8115 4.77 5.58 4.54 57 TooManyTo_001 7722 8.01 5.31 8.78 58 XM_H_Long_From01 7664 5.59 5.27 5.68 59 T_XMDrugObfuBody_08 7629 2.57 5.25 1.81 60 MIME_QP_LONG_LINE 7512 6.10 5.17 6.36 61 UNPARSEABLE_RELAY 7428 6.61 5.11 7.03 62 HTML_MIME_NO_HTML_TAG 7096 2.85 4.88 2.28 63 RDNS_DYNAMIC 6830 1.35 4.70 0.40 64 TR_XM_MaxBayes 6651 1.02 4.57 0.02 65 XM_SPF_SoftFail 6615 2.26 4.55 1.61 66 XM_B_SpammyTLD 6535 2.66 4.50 2.14 67 ALL_TRUSTED 6453 13.62 4.44 16.21 68 XMBody_17 6292 1.46 4.33 0.65 69 XM_SendGrid 6261 5.93 4.31 6.38 70 XMNumbers 6235 3.25 4.29 2.96 71 XMHTML_After_End 6126 1.44 4.21 0.66 72 RCVD_IN_BL_SPAMCOP_NET 5796 1.40 3.99 0.67 73 BAYES_95 5529 2.25 3.80 1.81 74 XM_DIRTYINTL 5473 1.29 3.76 0.58 75 TR_LOTS_OF_MONEY3 5386 1.24 3.70 0.54 76 URI_WP_DIRINDEX 5179 1.46 3.56 0.86 77 XMStrtUSub 5166 3.83 3.55 3.91 78 XM_URI_RBL 5078 0.90 3.49 0.17 79 PDS_OTHER_BAD_TLD 4888 1.34 3.36 0.77 80 HTML_IMAGE_RATIO_06 4864 3.64 3.35 3.73 81 RELAYCOUNTRY_FR 4762 0.94 3.28 0.28 82 BAYES_40 4722 5.00 3.25 5.49 83 MIME_HTML_MOSTLY 4573 2.64 3.15 2.49 84 SpammyFromTLD_02 4436 0.91 3.05 0.30 85 URI_WP_HACKED_2 4356 1.12 3.00 0.59 86 XM_OfRef6 4344 1.77 2.99 1.43 87 DKIM_ADSP_NXDOMAIN 4305 0.89 2.96 0.31 88 TM2_M_URI_OPT_OUT 4265 3.40 2.93 3.53 89 DATE_IN_PAST_06_12 4209 0.75 2.90 0.14 90 FROM_EXCESS_BASE64 4144 2.46 2.85 2.35 91 RCVD_IN_RP_RNBL 4056 0.67 2.79 0.06 92 SpammyFromTLD_01 3849 1.20 2.65 0.80 93 RCVD_IN_MSPIKE_H3 3848 7.46 2.65 8.82 94 RCVD_IN_MSPIKE_WL 3848 7.46 2.65 8.82 95 DATE_IN_PAST_03_06 3846 0.73 2.65 0.19 96 FROM_SUSPICIOUS_NTLD 3672 0.76 2.53 0.26 97 URI_HEX 3640 1.75 2.50 1.54 98 MIME_HTML_ONLY_MULTI 3627 2.52 2.49 2.53 99 SUBJ_ALL_CAPS 3606 1.79 2.48 1.60 100 HTML_IMAGE_RATIO_08 3586 2.47 2.47 2.48 101 BAYES_20 3577 3.91 2.46 4.32 102 FROM_SUSPICIOUS_NTLD_FP 3564 0.74 2.45 0.25 103 T_XMHurry_00 3450 0.98 2.37 0.58 104 HTML_TITLE_SUBJ_DIFF 3436 0.80 2.36 0.36 105 TR_XM_INV_DKIM 3417 0.61 2.35 0.11 106 TR_XM_PhishingBody 3393 1.49 2.33 1.25 107 T_REMOTE_IMAGE 3326 3.41 2.29 3.72 108 BODY_URI_ONLY 3272 0.60 2.25 0.13 109 T_FILL_THIS_FORM_SHORT 3247 1.47 2.23 1.26 110 XMDiploma_00 3155 1.70 2.17 1.56 111 RCVD_IN_IADB_LISTED 3078 4.59 2.12 5.28 112 XMMoneyMeta_00 2898 1.10 1.99 0.85 113 T_TooManySym_01 2895 3.92 1.99 4.47 114 HTML_SHORT_LINK_IMG_1 2880 0.45 1.98 0.02 115 XM_B_Unsub2 2876 1.98 1.98 1.98 116 TO_MALFORMED 2840 1.51 1.95 1.39 117 XMSexyCombo_01 2775 0.77 1.91 0.45 118 RCVD_IN_IADB_SPF 2770 4.03 1.91 4.64 119 TR_XM_MaxSPIKE 2770 0.55 1.91 0.16 120 HTML_IMAGE_ONLY_04 2754 0.46 1.89 0.06 121 TR_XM_PHPDW 2744 0.79 1.89 0.48 122 TR_Symld_Words 2742 1.49 1.89 1.38 123 TM2_M_VERY_LONG_WORD 2693 1.40 1.85 1.28 124 TR_XM_PHPForged 2692 0.76 1.85 0.46 125 TR_XM_DK_SendGrid 2678 3.08 1.84 3.43 126 LongTLD 2676 0.53 1.84 0.16 127 RCVD_IN_IADB_SENDERID 2664 3.58 1.83 4.07 128 TR_XM_FormFill2 2657 0.76 1.83 0.46 129 RCVD_IN_IADB_DK 2657 3.57 1.83 4.06 130 DKIM_ADSP_CUSTOM_MED 2652 1.39 1.82 1.27 131 XM_H_PHPOS 2648 0.75 1.82 0.45 132 XM_DK_Undo_01 2507 1.97 1.72 2.04 133 T_XMDrugObfuBody_14 2506 1.64 1.72 1.61 134 BAYES_00 2484 14.72 1.71 18.40 135 NML_ADSP_CUSTOM_MED 2483 1.15 1.71 0.99 136 T_XMDrugObfuBody_00 2481 0.92 1.71 0.69 137 FORGED_GMAIL_RCVD 2476 0.75 1.70 0.48 138 URI_TRY_3LD 2407 1.18 1.66 1.05 139 XMStockSpam_06 2367 1.23 1.63 1.11 140 TVD_RCVD_IP 2328 2.35 1.60 2.56 141 RELAYCOUNTRY_IN 2186 0.39 1.50 0.07 142 XM_iOS_Forged_Message 2185 0.48 1.50 0.19 143 XMNoVowels 2163 1.09 1.49 0.98 144 TR_XM_RelayPhish 2162 0.44 1.49 0.15 145 RCVD_IN_RP_SAFE 2133 6.34 1.47 7.72 146 BAYES_05 2050 2.60 1.41 2.94 147 BOTNET_NORDNS 2041 0.32 1.40 0.01 148 RCVD_IN_PSBL 2007 0.36 1.38 0.07 149 XM_UB99 1939 0.30 1.33 0.00 150 XM_UB60 1928 0.34 1.33 0.07 151 TR_XM_DK_Bayes 1899 9.63 1.31 11.98 152 RELAYCOUNTRY_GB 1882 1.19 1.29 1.16 153 MAILING_LIST_MULTI 1800 2.63 1.24 3.02 154 HDRS_MISSP 1785 0.32 1.23 0.06 155 XMGenDplmaNmb 1712 0.99 1.18 0.93 156 LONGWORDS 1699 0.44 1.17 0.23 157 XMSubMetaI_00 1678 0.61 1.15 0.46 158 XMBdyGiftCard01 1674 1.11 1.15 1.10 159 MISSING_HEADERS 1656 0.68 1.14 0.55 160 URI_NOVOWEL 1615 0.57 1.11 0.41 161 DATE_IN_PAST_12_24 1568 0.31 1.08 0.09 162 XM_ProductURIs 1554 0.69 1.07 0.58 163 REPLYTO_WITHOUT_TO_CC 1511 0.29 1.04 0.08 164 NO_FM_NAME_IP_HOSTN 1495 0.23 1.03 0.00 165 T_Symld_Words_02 1495 0.67 1.03 0.57 166 XMSubEmpty 1481 0.44 1.02 0.28 167 URI_OPTOUT_3LD 1480 0.31 1.02 0.11 168 TR_XM_COVIDMETA3 1455 0.25 1.00 0.04 169 TR_LOTS_OF_MONEY2 1447 0.52 1.00 0.39 170 T_MONEY_PERCENT 1447 0.52 1.00 0.39 171 RELAYCOUNTRY_ID 1445 0.23 0.99 0.01 172 XM_UB80 1443 0.23 0.99 0.02 173 DIET_1 1422 0.41 0.98 0.24 174 RCVD_IN_RP_CERTIFIED 1419 5.62 0.98 6.93 175 XM_H_MailChimp 1414 0.34 0.97 0.16 176 HTML_IMAGE_ONLY_20 1375 0.59 0.95 0.49 177 XMPhish30 1351 0.47 0.93 0.33 178 XM_H_PHPMailer 1329 0.57 0.91 0.47 179 XM_H_Long_From02 1320 1.24 0.91 1.34 180 XM_H_ZimbraSpoof2 1314 0.20 0.90 0.00 181 REMOVE_BEFORE_LINK 1310 0.49 0.90 0.37 182 RELAYCOUNTRY_JP 1309 0.23 0.90 0.04 183 XM_UB999 1297 0.20 0.89 0.00 184 XMSlimDrugH 1292 0.42 0.89 0.29 185 SHORT_SHORTNER 1289 0.21 0.89 0.02 186 RELAYCOUNTRY_DE 1240 0.55 0.85 0.46 187 XMBrknScrpt_02 1232 0.96 0.85 0.99 188 XMPhish08 1228 0.61 0.84 0.54 189 XMSubMetaSxObfu_03 1228 0.62 0.84 0.56 190 TR_Mismatch_TLD_02 1204 0.23 0.83 0.06 191 TR_Sbj_FN_Bdy 1202 0.36 0.83 0.22 192 RCVD_IN_IADB_VOUCHED 1201 2.71 0.83 3.25 193 HTML_SHORT_LINK_IMG_3 1188 0.24 0.82 0.08 194 TR_MetaPhish_Combo_01 1173 0.75 0.81 0.73 195 TR_Mismatch_TLD_01 1170 0.32 0.80 0.19 196 HTTPS_HTTP_MISMATCH 1167 0.79 0.80 0.79 197 XMBody_78 1138 0.49 0.78 0.40 198 XM_Combo_Sbj 1119 0.31 0.77 0.18 199 URIBL_BLACK 1111 0.19 0.76 0.03 200 XM_SPF_Unknown 1109 0.60 0.76 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 448021 88.97 95.51 87.12 2 RELAYCOUNTRY_US 412421 79.51 77.08 80.20 3 DKIM_SIGNED 380173 75.38 80.51 73.92 4 XM_DK_Pass 374441 73.88 77.65 72.81 5 XM_B_Unicode 361865 71.10 73.70 70.36 6 DKIM_VALID 352032 67.95 66.19 68.45 7 DCC_CHECK_NEGATIVE 299663 50.32 22.19 58.27 8 BAYES_50 278042 52.11 45.21 54.07 9 DKIM_VALID_AU 259817 50.29 49.48 50.52 10 XMListUnsubscribeExists 257196 54.18 68.94 50.01 11 DCC_CHECK 203377 47.64 76.25 39.55 12 XM_B_Unicode3 200531 39.01 39.08 38.99 13 T_TM2_M_HEADER_IN_MSG 149367 26.90 19.32 29.04 14 HTML_FONT_LOW_CONTRAST 146360 29.13 31.50 28.46 15 DKIM_VALID_EF 133576 26.50 28.36 25.97 16 LOC_TINY_FONT_1 116746 24.70 31.78 22.70 17 FVGT_m_MULTI_ODD 114943 23.37 26.98 22.35 18 XMSubLong 108598 21.92 24.74 21.12 19 MIME_HTML_ONLY 99483 23.66 38.93 19.34 20 BAYES_00 94633 14.72 1.71 18.40 21 T_KAM_HTML_FONT_INVALID 93492 20.00 26.45 18.18 22 ALL_TRUSTED 83383 13.62 4.44 16.21 23 RCVD_IN_MSPIKE_H2 74028 13.41 9.95 14.39 24 XM_Body_Dirty_Words 63671 13.61 17.97 12.38 25 TR_XM_DK_Bayes 61615 9.63 1.31 11.98 26 XM_Multi_Part_URI 59063 12.64 16.72 11.48 27 TR_XM_DK_Bayes1 57424 8.86 0.70 11.17 28 XM_B_Unsub 56865 11.74 14.17 11.06 29 TR_XM_DK_Bayes2 51128 7.87 0.55 9.94 30 LotsOfNums_01 45710 8.86 8.75 8.89 31 RCVD_IN_MSPIKE_WL 45347 7.46 2.65 8.82 32 RCVD_IN_MSPIKE_H3 45347 7.46 2.65 8.82 33 TooManyTo_001 45141 8.01 5.31 8.78 34 LOTS_OF_MONEY 43066 9.63 14.08 8.37 35 XM_Evil_Numbers_Gen 40872 8.34 9.75 7.95 36 RCVD_IN_RP_SAFE 39678 6.34 1.47 7.72 37 XM_B_Phish_Phrases 37749 8.53 12.76 7.34 38 XM_DKIMWhitelistDomains 36702 5.57 0.03 7.14 39 UNPARSEABLE_RELAY 36150 6.61 5.11 7.03 40 FSL_BULK_SIG 36086 8.20 12.38 7.02 41 RCVD_IN_RP_CERTIFIED 35655 5.62 0.98 6.93 42 HTML_IMAGE_RATIO_02 35315 7.56 10.01 6.87 43 XM_DK_Undo_02 34744 14.70 42.78 6.76 44 XM_SendGrid 32835 5.93 4.31 6.38 45 MIME_QP_LONG_LINE 32703 6.10 5.17 6.36 46 BAYES_60 32443 6.52 7.27 6.31 47 RELAYCOUNTRY_META 30246 9.43 21.96 5.88 48 HTML_IMAGE_RATIO_04 29702 5.99 6.77 5.78 49 XM_H_Long_From01 29209 5.59 5.27 5.68 50 BAYES_40 28234 5.00 3.25 5.49 51 DKIM_INVALID 28141 7.42 14.32 5.47 52 RCVD_IN_IADB_LISTED 27177 4.59 2.12 5.28 53 RCVD_IN_IADB_SPF 23842 4.03 1.91 4.64 54 MPART_ALT_DIFF 23330 4.77 5.58 4.54 55 T_TooManySym_01 22977 3.92 1.99 4.47 56 BOTNET_IPINHOSTNAME 22731 6.56 14.11 4.42 57 XM_PDF 22520 3.56 0.66 4.38 58 BAYES_20 22226 3.91 2.46 4.32 59 RCVD_IN_IADB_SENDERID 20928 3.58 1.83 4.07 60 RCVD_IN_IADB_DK 20868 3.57 1.83 4.06 61 XMStrtUSub 20131 3.83 3.55 3.91 62 HTML_IMAGE_RATIO_06 19175 3.64 3.35 3.73 63 T_REMOTE_IMAGE 19148 3.41 2.29 3.72 64 BAYES_99 18197 8.69 26.90 3.54 65 TM2_M_URI_OPT_OUT 18132 3.40 2.93 3.53 66 XM_UncommonTLD01 17790 5.71 13.66 3.46 67 TR_XM_DK_SendGrid 17616 3.08 1.84 3.43 68 XMSexyCombo_05 17590 4.82 9.75 3.42 69 IN_ZIMBRA_NJ_WHITELIST 17315 2.63 0.01 3.37 70 RCVD_IN_IADB_VOUCHED 16692 2.71 0.83 3.25 71 XMSubMetaSx_00 16304 3.96 6.75 3.17 72 ANY_BOUNCE_MESSAGE 16224 2.62 0.72 3.15 73 BOUNCE_MESSAGE 16217 2.62 0.72 3.15 74 BAYES_80 16107 4.20 7.99 3.13 75 MAILING_LIST_MULTI 15548 2.63 1.24 3.02 76 XMNumbers 15203 3.25 4.29 2.96 77 NO_DNS_FOR_FROM 15154 4.90 11.80 2.95 78 BAYES_05 15104 2.60 1.41 2.94 79 BAYES_999 14323 6.78 20.89 2.79 80 BOTNET 14027 6.57 20.16 2.73 81 TVD_RCVD_IP 13188 2.35 1.60 2.56 82 MIME_HTML_ONLY_MULTI 13017 2.52 2.49 2.53 83 XM_H_Trusted_IP 12943 1.96 0.00 2.52 84 MIME_HTML_MOSTLY 12810 2.64 3.15 2.49 85 HTML_IMAGE_RATIO_08 12740 2.47 2.47 2.48 86 TooManyTo_002 12654 2.03 0.52 2.46 87 FROM_EXCESS_BASE64 12074 2.46 2.85 2.35 88 HTML_MIME_NO_HTML_TAG 11721 2.85 4.88 2.28 89 T_TooManySym_02 11546 1.87 0.56 2.25 90 XM_B_COVIDMETA 11133 3.47 8.10 2.16 91 XM_B_SpammyTLD 11015 2.66 4.50 2.14 92 RCVD_IN_MSPIKE_BL 10869 3.02 6.25 2.11 93 XM_CamelCaseFrm001 10807 3.39 7.96 2.10 94 RCVD_IN_MSPIKE_L3 10632 2.88 5.74 2.07 95 XM_DK_Undo_01 10496 1.97 1.72 2.04 96 XM_B_Unsub2 10197 1.98 1.98 1.98 97 RCVD_IN_IADB_OPTIN 10180 1.64 0.45 1.98 98 KHOP_HELO_FCRDNS 9830 2.95 6.64 1.91 99 T_XMDrugObfuBody_08 9293 2.57 5.25 1.81 100 BAYES_95 9284 2.25 3.80 1.81 101 TooManyTo_003 8769 1.42 0.42 1.71 102 UNTRUSTED_Relay 8610 4.15 12.89 1.67 103 XM_SPF_SoftFail 8300 2.26 4.55 1.61 104 T_XMDrugObfuBody_14 8296 1.64 1.72 1.61 105 SUBJ_ALL_CAPS 8205 1.79 2.48 1.60 106 HELO_NODOT 8094 1.35 0.57 1.57 107 HELO_NO_DOMAIN 8093 1.35 0.57 1.57 108 RELAYCOUNTRY_CA 8039 2.65 6.47 1.56 109 XMDiploma_00 8037 1.70 2.17 1.56 110 IN_HORDE_ADDRESS_BOOK 8009 1.22 0.03 1.56 111 TR_XM_COVIDMETA4 7930 2.61 6.41 1.54 112 URI_HEX 7912 1.75 2.50 1.54 113 INVALID_MSGID 7733 1.24 0.32 1.50 114 TR_DCC_Bayes_99 7534 5.92 21.69 1.46 115 XM_GoogleGroups 7482 1.25 0.51 1.45 116 XM_OfRef6 7353 1.77 2.99 1.43 117 CK_HELO_DYNAMIC_SPLIT_IP 7338 1.13 0.10 1.43 118 HELO_DYNAMIC_IPADDR2 7319 1.12 0.04 1.42 119 TO_MALFORMED 7141 1.51 1.95 1.39 120 TR_Symld_Words 7118 1.49 1.89 1.38 121 XM_H_Long_From02 6874 1.24 0.91 1.34 122 TooManyTo_004 6771 1.11 0.36 1.32 123 TM2_M_VERY_LONG_WORD 6561 1.40 1.85 1.28 124 DKIM_ADSP_CUSTOM_MED 6548 1.39 1.82 1.27 125 XMCapTrack 6515 1.08 0.42 1.27 126 T_FILL_THIS_FORM_SHORT 6480 1.47 2.23 1.26 127 TR_XM_PhishingBody 6409 1.49 2.33 1.25 128 USER_IN_DEF_DKIM_WL 6261 0.95 0.00 1.22 129 RELAYCOUNTRY_GB 5940 1.19 1.29 1.16 130 HTML_FONT_FACE_BAD 5918 1.02 0.54 1.15 131 XMStockSpam_06 5719 1.23 1.63 1.11 132 TooManyTo_005 5681 0.93 0.30 1.10 133 XMBdyGiftCard01 5664 1.11 1.15 1.10 134 XMGappySubj_01 5653 0.89 0.17 1.10 135 URI_TRY_3LD 5406 1.18 1.66 1.05 136 XM_UB50 5304 2.45 7.49 1.03 137 XMBrknScrpt_02 5103 0.96 0.85 0.99 138 NML_ADSP_CUSTOM_MED 5101 1.15 1.71 0.99 139 XMNoVowels 5044 1.09 1.49 0.98 140 XMSubNoVowel 4903 0.86 0.54 0.95 141 XMGenDplmaNmb 4801 0.99 1.18 0.93 142 URI_WP_DIRINDEX 4432 1.46 3.56 0.86 143 XMMoneyMeta_00 4374 1.10 1.99 0.85 144 FROM_GOV_DKIM_AU 4189 0.66 0.13 0.81 145 SpammyFromTLD_01 4096 1.20 2.65 0.80 146 HTTPS_HTTP_MISMATCH 4076 0.79 0.80 0.79 147 PDS_OTHER_BAD_TLD 3970 1.34 3.36 0.77 148 TR_MetaPhish_Combo_01 3754 0.75 0.81 0.73 149 T_XMDrugObfuBody_00 3568 0.92 1.71 0.69 150 RCVD_IN_BL_SPAMCOP_NET 3449 1.40 3.99 0.67 151 T_TooManySym_03 3438 0.56 0.16 0.67 152 XM_ShortIntro_01 3432 0.60 0.35 0.67 153 XMHTML_After_End 3405 1.44 4.21 0.66 154 XMBody_17 3342 1.46 4.33 0.65 155 URI_WP_HACKED_2 3009 1.12 3.00 0.59 156 T_XMHurry_00 3005 0.98 2.37 0.58 157 XM_DIRTYINTL 3005 1.29 3.76 0.58 158 XM_ProductURIs 2999 0.69 1.07 0.58 159 T_Symld_Words_02 2921 0.67 1.03 0.57 160 XMSubMetaSxObfu_03 2868 0.62 0.84 0.56 161 XM_SPF_Unknown 2857 0.60 0.76 0.56 162 MISSING_HEADERS 2808 0.68 1.14 0.55 163 T_OBFU_PDF_ATTACH 2797 0.46 0.15 0.54 164 XMPhish08 2786 0.61 0.84 0.54 165 TR_LOTS_OF_MONEY3 2777 1.24 3.70 0.54 166 TR_MSPIKEBAYES00 2772 0.42 0.00 0.54 167 FROM_GOV_SPOOF 2761 0.46 0.19 0.54 168 RCVD_IN_SORBS_DUL 2718 0.48 0.30 0.53 169 RELAYCOUNTRY_NL 2638 0.50 0.47 0.51 170 HTML_IMAGE_ONLY_20 2514 0.59 0.95 0.49 171 FORGED_GMAIL_RCVD 2484 0.75 1.70 0.48 172 HTML_TAG_BALANCE_BODY 2453 0.52 0.69 0.48 173 TR_XM_PHPDW 2453 0.79 1.89 0.48 174 XM_H_PHPMailer 2440 0.57 0.91 0.47 175 RELAYCOUNTRY_AU 2417 0.52 0.69 0.47 176 XMOemUri 2404 0.43 0.29 0.47 177 RELAYCOUNTRY_DE 2386 0.55 0.85 0.46 178 XMSubMetaI_00 2367 0.61 1.15 0.46 179 TR_XM_FormFill2 2348 0.76 1.83 0.46 180 TR_XM_PHPForged 2340 0.76 1.85 0.46 181 TM2_M_BODY_EMPTY 2316 0.37 0.10 0.45 182 XMSexyCombo_01 2302 0.77 1.91 0.45 183 XM_H_PHPOS 2302 0.75 1.82 0.45 184 XMLKML 2220 0.34 0.00 0.43 185 XMHTMLBadTable_001 2150 0.45 0.54 0.42 186 XM_RXBody 2148 0.39 0.30 0.42 187 TR_XM_COVIDMETA5 2145 0.34 0.07 0.42 188 URI_NOVOWEL 2126 0.57 1.11 0.41 189 SHORT_HELO_AND_INLINE_IMAGE 2108 0.33 0.03 0.41 190 HTML_IMAGE_ONLY_28 2097 0.42 0.48 0.41 191 XMBody_78 2078 0.49 0.78 0.40 192 MPART_ALT_DIFF_COUNT 2048 0.48 0.75 0.40 193 RDNS_DYNAMIC 2047 1.35 4.70 0.40 194 HTML_IMAGE_ONLY_32 2009 0.34 0.18 0.39 195 AC_DIV_BONANZA 2006 0.32 0.09 0.39 196 TR_LOTS_OF_MONEY2 1997 0.52 1.00 0.39 197 T_MONEY_PERCENT 1997 0.52 1.00 0.39 198 REMOVE_BEFORE_LINK 1907 0.49 0.90 0.37 199 XMDateMe_00 1905 0.37 0.35 0.37 200 XMBody_95 1888 0.34 0.23 0.37 ----------------------------------------------------------------------