Email: 370037 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 1.85 sec Spam: 64317 Autolearn: 0 AvgScore: 12.07 AvgScanTime: 2.56 sec Ham: 305720 Autolearn: 0 AvgScore: -2.48 AvgScanTime: 1.70 sec Time Spent Running SA: 190.17 hours Time Spent Processing Spam: 45.75 hours Time Spent Processing Ham: 144.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 59937 88.39 93.19 87.38 2 DKIM_SIGNED 51362 79.04 79.86 78.86 3 XM_DK_Pass 49693 77.61 77.26 77.68 4 XM_B_Unicode 46463 72.77 72.24 72.89 5 XMListUnsubscribeExists 45366 58.58 70.54 56.06 6 RELAYCOUNTRY_US 45143 80.18 70.19 82.29 7 DKIM_VALID 44630 73.01 69.39 73.77 8 DCC_CHECK_NEGATIVE 39889 78.99 62.02 82.56 9 DKIM_VALID_AU 34667 59.34 53.90 60.48 10 XM_DK_Undo_02 29874 15.87 46.45 9.43 11 MIME_HTML_ONLY 27026 27.70 42.02 24.69 12 XM_B_Unicode3 24679 42.62 38.37 43.51 13 BAYES_50 23611 47.94 36.71 50.30 14 DCC_CHECK 23409 19.88 36.40 16.40 15 BAYES_99 21968 11.36 34.16 6.56 16 LOC_TINY_FONT_1 21747 30.85 33.81 30.23 17 RELAYCOUNTRY_META 20959 10.40 32.59 5.74 18 DKIM_VALID_EF 20094 27.59 31.24 26.82 19 BAYES_999 17420 8.96 27.08 5.14 20 HTML_FONT_LOW_CONTRAST 17332 31.36 26.95 32.28 21 T_KAM_HTML_FONT_INVALID 17017 19.15 26.46 17.61 22 XMSubLong 15618 20.99 24.28 20.29 23 XM_UncommonTLD01 14875 7.55 23.13 4.27 24 FVGT_m_MULTI_ODD 14601 22.74 22.70 22.75 25 T_TM2_M_HEADER_IN_MSG 13964 23.16 21.71 23.46 26 BOTNET 12762 5.41 19.84 2.38 27 UNTRUSTED_Relay 12212 5.07 18.99 2.14 28 RCVD_IN_MSPIKE_H2 11677 18.12 18.16 18.11 29 XM_Body_Dirty_Words 11193 15.57 17.40 15.19 30 BOTNET_IPINHOSTNAME 10676 8.01 16.60 6.21 31 HTML_IMAGE_RATIO_02 10328 11.00 16.06 9.94 32 XM_Multi_Part_URI 9255 14.35 14.39 14.35 33 TR_DCC_Bayes_99 7528 2.57 11.70 0.65 34 RELAYCOUNTRY_CA 7165 3.70 11.14 2.14 35 RCVD_IN_MSPIKE_BL 6909 3.17 10.74 1.58 36 XMSexyCombo_05 6833 6.45 10.62 5.57 37 DKIM_INVALID 6732 6.03 10.47 5.10 38 LOTS_OF_MONEY 6538 8.29 10.17 7.89 39 KHOP_HELO_FCRDNS 6275 2.74 9.76 1.27 40 XM_B_Phish_Phrases 6176 8.47 9.60 8.24 41 XMSubMetaSx_00 6075 6.04 9.45 5.32 42 XM_UB50 5981 2.64 9.30 1.24 43 XM_CamelCaseFrm001 5918 3.67 9.20 2.51 44 XM_B_Unsub 5752 10.35 8.94 10.65 45 BAYES_80 5492 5.06 8.54 4.33 46 URIBL_SBL_A 5324 1.83 8.28 0.47 47 LotsOfNums_01 5085 8.40 7.91 8.51 48 RCVD_IN_MSPIKE_L3 4912 2.54 7.64 1.47 49 TR_XM_MaxBayes 4827 1.35 7.51 0.06 50 MPART_ALT_DIFF 4756 6.93 7.39 6.84 51 XM_Evil_Numbers_Gen 4337 10.19 6.74 10.91 52 BAYES_60 4276 6.75 6.65 6.77 53 FSL_BULK_SIG 3978 3.25 6.18 2.63 54 MIME_HTML_MOSTLY 3976 3.85 6.18 3.35 55 RDNS_DYNAMIC 3756 1.41 5.84 0.47 56 FROM_SUSPICIOUS_NTLD 3754 1.25 5.84 0.29 57 FROM_SUSPICIOUS_NTLD_FP 3748 1.25 5.83 0.29 58 NO_DNS_FOR_FROM 3668 2.77 5.70 2.15 59 RCVD_IN_BL_SPAMCOP_NET 3554 1.76 5.53 0.96 60 BAYES_95 3545 3.06 5.51 2.54 61 XM_H_Long_From01 3527 5.61 5.48 5.64 62 TooManyTo_001 3493 6.51 5.43 6.74 63 HTML_IMAGE_RATIO_04 3408 7.23 5.30 7.63 64 XMStrtUSub 3393 6.49 5.28 6.75 65 XM_B_SpammyTLD 3338 2.82 5.19 2.32 66 SpammyFromTLD_02 3286 1.08 5.11 0.23 67 XMBody_17 3282 2.03 5.10 1.38 68 XMNumbers 3279 3.68 5.10 3.39 69 DATE_IN_PAST_03_06 3260 1.09 5.07 0.25 70 XM_URI_RBL 3105 1.04 4.83 0.24 71 TR_XM_PhishingBody 3051 3.21 4.74 2.88 72 RELAYCOUNTRY_FR 3002 1.18 4.67 0.44 73 T_REMOTE_IMAGE 3000 3.42 4.66 3.16 74 HTML_IMAGE_RATIO_06 2884 4.47 4.48 4.46 75 XM_B_COVIDMETA 2877 2.39 4.47 1.95 76 PDS_OTHER_BAD_TLD 2829 1.57 4.40 0.98 77 XM_DIRTYINTL 2807 1.16 4.36 0.49 78 TR_XM_COVIDMETA4 2773 1.47 4.31 0.87 79 DATE_IN_PAST_06_12 2717 0.99 4.22 0.31 80 RELAYCOUNTRY_DE 2632 1.10 4.09 0.48 81 XM_SPF_SoftFail 2628 1.57 4.09 1.04 82 HTML_MIME_NO_HTML_TAG 2618 1.78 4.07 1.30 83 XMHTML_After_End 2566 1.16 3.99 0.56 84 BODY_URI_ONLY 2537 0.78 3.94 0.11 85 SpammyFromTLD_01 2522 1.20 3.92 0.63 86 UNPARSEABLE_RELAY 2520 7.81 3.92 8.63 87 XM_OfRef6 2510 1.73 3.90 1.27 88 RCVD_IN_MSPIKE_WL 2371 14.81 3.69 17.16 89 XMSexyCombo_01 2313 2.09 3.60 1.77 90 LongTLD 2300 0.92 3.58 0.36 91 TR_XM_MaxSPIKE 2159 0.72 3.36 0.17 92 BAYES_40 2000 4.42 3.11 4.70 93 TM2_M_URI_OPT_OUT 1979 3.80 3.08 3.96 94 T_XMHurry_00 1949 1.24 3.03 0.87 95 RCVD_IN_RP_SAFE 1927 10.59 3.00 12.19 96 MIME_QP_LONG_LINE 1859 3.70 2.89 3.87 97 TR_XM_INV_DKIM 1857 0.71 2.89 0.25 98 TR_XM_PHPDW 1823 0.88 2.83 0.46 99 TR_XM_PHPForged 1790 0.86 2.78 0.45 100 XM_B_Phish66 1784 1.58 2.77 1.33 101 TR_XM_FormFill2 1769 0.85 2.75 0.45 102 XM_H_PHPOS 1764 0.84 2.74 0.44 103 RCVD_IN_PSBL 1667 0.47 2.59 0.02 104 DKIM_ADSP_NXDOMAIN 1667 0.79 2.59 0.41 105 T_TooManySym_01 1658 4.62 2.58 5.05 106 XM_SendGrid 1618 6.72 2.52 7.60 107 HTML_IMAGE_RATIO_08 1603 2.60 2.49 2.63 108 HTML_TAG_BALANCE_BODY 1542 1.10 2.40 0.83 109 XM_UB60 1525 0.51 2.37 0.12 110 BAYES_20 1519 3.70 2.36 3.98 111 FILL_THIS_FORM 1497 0.78 2.33 0.45 112 T_XMDrugObfuBody_08 1490 1.45 2.32 1.27 113 TR_Mismatch_TLD_02 1482 0.46 2.30 0.08 114 XMBdyGiftCard01 1474 2.85 2.29 2.97 115 XMStockSpam_06 1448 1.58 2.25 1.44 116 TR_LOTS_OF_MONEY3 1436 0.66 2.23 0.33 117 XM_UB99 1433 0.39 2.23 0.01 118 XM_OfRef7 1413 0.51 2.20 0.16 119 RCVD_IN_MSPIKE_H3 1400 8.97 2.18 10.40 120 SUBJ_ALL_CAPS 1371 1.35 2.13 1.18 121 RCVD_IN_RP_RNBL 1344 0.46 2.09 0.11 122 RCVD_IN_RP_CERTIFIED 1309 9.66 2.04 11.26 123 HTML_IMAGE_ONLY_24 1302 0.53 2.02 0.22 124 TR_XM_RelayPhish 1292 0.46 2.01 0.14 125 T_HTML_TAG_BALANCE_CENTER 1285 0.57 2.00 0.26 126 DATE_IN_PAST_12_24 1271 0.41 1.98 0.08 127 MISSING_HEADERS 1266 0.68 1.97 0.41 128 HTML_FONT_SIZE_LARGE 1263 0.41 1.96 0.08 129 URI_HEX 1261 1.46 1.96 1.35 130 FROM_EXCESS_BASE64 1250 3.90 1.94 4.32 131 RELAYCOUNTRY_IN 1240 0.42 1.93 0.11 132 MIME_HTML_ONLY_MULTI 1182 3.89 1.84 4.32 133 XM_UB95 1146 0.32 1.78 0.02 134 XM_UB80 1139 0.34 1.77 0.03 135 TM2_M_VERY_LONG_WORD 1132 1.48 1.76 1.42 136 RCVD_IN_MSPIKE_L5 1113 0.34 1.73 0.05 137 XMReplyNow 1077 0.35 1.67 0.07 138 BOTNET_NORDNS 1068 0.30 1.66 0.01 139 DIET_1 1011 0.60 1.57 0.40 140 RELAYCOUNTRY_GB 1010 0.97 1.57 0.84 141 MIME_HEADER_CTYPE_ONLY 1005 0.47 1.56 0.24 142 HK_RANDOM_REPLYTO 994 0.44 1.55 0.21 143 T_XMDrugObfuBody_14 986 1.54 1.53 1.55 144 XMDiploma_00 986 1.38 1.53 1.35 145 FROM_ILLEGAL_CHARS 983 0.30 1.53 0.05 146 BAYES_00 974 15.23 1.51 18.11 147 RCVD_IN_MSPIKE_H4 967 5.79 1.50 6.69 148 XM_B_Unsub2 954 1.14 1.48 1.07 149 XM_H_PHPMailer 947 0.74 1.47 0.59 150 RCVD_IN_IADB_LISTED 945 2.84 1.47 3.13 151 ALL_TRUSTED 945 11.23 1.47 13.28 152 BAYES_05 930 2.48 1.45 2.70 153 XMSlimDrugH 926 0.61 1.44 0.43 154 XM_BadFromFormat 915 0.42 1.42 0.21 155 HTML_SHORT_LINK_IMG_1 908 0.26 1.41 0.01 156 XM_ProductURIs 888 1.23 1.38 1.20 157 TR_Mismatch_TLD_01 885 0.39 1.38 0.18 158 RCVD_IN_MSPIKE_L4 884 0.29 1.37 0.06 159 HDRS_LCASE_IMGONLY 854 0.24 1.33 0.01 160 XMSubMetaSxObfu_03 848 1.10 1.32 1.05 161 SHORT_IMG_SUSP_NTLD 846 0.23 1.32 0.00 162 XM_UB999 835 0.23 1.30 0.00 163 DKIM_ADSP_CUSTOM_MED 831 1.21 1.29 1.20 164 RELAYCOUNTRY_IT 829 0.27 1.29 0.05 165 XMMoneyMeta_00 824 0.47 1.28 0.30 166 XMSubMetaSSx_00 815 0.55 1.27 0.39 167 T_FILL_THIS_FORM_SHORT 815 1.19 1.27 1.17 168 XM_H_PHPOS_M 812 0.40 1.26 0.21 169 RCVD_IN_IADB_SPF 803 2.45 1.25 2.71 170 XM_XX_Yahoo 799 0.35 1.24 0.17 171 XMSubMetaI_00 778 0.94 1.21 0.88 172 RCVD_IN_IADB_DK 776 2.15 1.21 2.35 173 RCVD_IN_IADB_SENDERID 772 2.21 1.20 2.42 174 TR_XM_COVIDMETA1 757 0.54 1.18 0.40 175 XMSexyCombo_04 729 1.37 1.13 1.42 176 NML_ADSP_CUSTOM_MED 725 0.91 1.13 0.87 177 RELAYCOUNTRY_NG 718 0.19 1.12 0.00 178 HTML_IMAGE_ONLY_04 709 0.28 1.10 0.10 179 TR_XM_COVIDMETA3 709 0.21 1.10 0.03 180 HTML_FONT_SIZE_HUGE 708 0.39 1.10 0.24 181 TR_XM_DK_Bayes 708 10.27 1.10 12.20 182 MPART_ALT_DIFF_COUNT 698 0.58 1.09 0.48 183 URI_TRY_3LD 692 1.50 1.08 1.59 184 T_TooManySym_02 676 2.63 1.05 2.97 185 URIBL_BLACK 675 0.19 1.05 0.01 186 XMGappySubj_01 671 1.15 1.04 1.17 187 URI_NOVOWEL 646 0.73 1.00 0.67 188 XMSubNoVowel 640 1.04 1.00 1.05 189 TO_NO_BRKTS_FROM_MSSP 640 0.18 1.00 0.01 190 TR_Symld_Words 631 1.56 0.98 1.68 191 XMSubGiftCard1 628 0.23 0.98 0.07 192 RELAYCOUNTRY_AT 621 0.30 0.97 0.17 193 XMSubMetaSx_01 604 0.27 0.94 0.13 194 XM_DK_Undo_01 599 1.50 0.93 1.62 195 TR_XM_DK_SendGrid 595 4.02 0.93 4.68 196 XM_RXBody 591 1.04 0.92 1.06 197 XMGppyBdWords 586 0.31 0.91 0.18 198 TR_MetaPhish_Combo_01 574 0.97 0.89 0.99 199 SUBJ_DOLLARS 566 0.49 0.88 0.41 200 XMBrknScrpt_02 562 1.23 0.87 1.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 267124 88.39 93.19 87.38 2 DCC_CHECK_NEGATIVE 252403 78.99 62.02 82.56 3 RELAYCOUNTRY_US 251562 80.18 70.19 82.29 4 DKIM_SIGNED 241104 79.04 79.86 78.86 5 XM_DK_Pass 237475 77.61 77.26 77.68 6 DKIM_VALID 225524 73.01 69.39 73.77 7 XM_B_Unicode 222831 72.77 72.24 72.89 8 DKIM_VALID_AU 184913 59.34 53.90 60.48 9 XMListUnsubscribeExists 171388 58.58 70.54 56.06 10 BAYES_50 153781 47.94 36.71 50.30 11 XM_B_Unicode3 133019 42.62 38.37 43.51 12 HTML_FONT_LOW_CONTRAST 98698 31.36 26.95 32.28 13 LOC_TINY_FONT_1 92409 30.85 33.81 30.23 14 DKIM_VALID_EF 81983 27.59 31.24 26.82 15 MIME_HTML_ONLY 75491 27.70 42.02 24.69 16 T_TM2_M_HEADER_IN_MSG 71724 23.16 21.71 23.46 17 FVGT_m_MULTI_ODD 69559 22.74 22.70 22.75 18 XMSubLong 62039 20.99 24.28 20.29 19 RCVD_IN_MSPIKE_H2 55379 18.12 18.16 18.11 20 BAYES_00 55374 15.23 1.51 18.11 21 T_KAM_HTML_FONT_INVALID 53852 19.15 26.46 17.61 22 RCVD_IN_MSPIKE_WL 52449 14.81 3.69 17.16 23 DCC_CHECK 50137 19.88 36.40 16.40 24 XM_Body_Dirty_Words 46430 15.57 17.40 15.19 25 XM_Multi_Part_URI 43862 14.35 14.39 14.35 26 ALL_TRUSTED 40614 11.23 1.47 13.28 27 TR_XM_DK_Bayes 37290 10.27 1.10 12.20 28 RCVD_IN_RP_SAFE 37255 10.59 3.00 12.19 29 TR_XM_DK_Bayes1 34957 9.59 0.84 11.43 30 RCVD_IN_RP_CERTIFIED 34432 9.66 2.04 11.26 31 XM_DKIMWhitelistDomains 34323 9.29 0.06 11.23 32 XM_Evil_Numbers_Gen 33358 10.19 6.74 10.91 33 XM_B_Unsub 32554 10.35 8.94 10.65 34 TR_XM_DK_Bayes2 32512 8.90 0.68 10.63 35 RCVD_IN_MSPIKE_H3 31788 8.97 2.18 10.40 36 HTML_IMAGE_RATIO_02 30392 11.00 16.06 9.94 37 XM_DK_Undo_02 28833 15.87 46.45 9.43 38 UNPARSEABLE_RELAY 26371 7.81 3.92 8.63 39 LotsOfNums_01 26011 8.40 7.91 8.51 40 XM_B_Phish_Phrases 25179 8.47 9.60 8.24 41 LOTS_OF_MONEY 24127 8.29 10.17 7.89 42 HTML_IMAGE_RATIO_04 23339 7.23 5.30 7.63 43 XM_SendGrid 23245 6.72 2.52 7.60 44 MPART_ALT_DIFF 20896 6.93 7.39 6.84 45 BAYES_60 20702 6.75 6.65 6.77 46 XMStrtUSub 20637 6.49 5.28 6.75 47 TooManyTo_001 20605 6.51 5.43 6.74 48 RCVD_IN_MSPIKE_H4 20454 5.79 1.50 6.69 49 BAYES_99 20055 11.36 34.16 6.56 50 BOTNET_IPINHOSTNAME 18979 8.01 16.60 6.21 51 RELAYCOUNTRY_META 17542 10.40 32.59 5.74 52 XM_H_Long_From01 17248 5.61 5.48 5.64 53 XMSexyCombo_05 17031 6.45 10.62 5.57 54 XMSubMetaSx_00 16270 6.04 9.45 5.32 55 BAYES_999 15720 8.96 27.08 5.14 56 DKIM_INVALID 15580 6.03 10.47 5.10 57 T_TooManySym_01 15451 4.62 2.58 5.05 58 BAYES_40 14362 4.42 3.11 4.70 59 TR_XM_DK_SendGrid 14295 4.02 0.93 4.68 60 HTML_IMAGE_RATIO_06 13642 4.47 4.48 4.46 61 IN_ZIMBRA_NJ_WHITELIST 13442 3.64 0.02 4.40 62 BAYES_80 13248 5.06 8.54 4.33 63 MIME_HTML_ONLY_MULTI 13201 3.89 1.84 4.32 64 FROM_EXCESS_BASE64 13193 3.90 1.94 4.32 65 XM_UncommonTLD01 13050 7.55 23.13 4.27 66 BAYES_20 12176 3.70 2.36 3.98 67 TM2_M_URI_OPT_OUT 12098 3.80 3.08 3.96 68 MIME_QP_LONG_LINE 11830 3.70 2.89 3.87 69 XM_H_Trusted_IP 11807 3.19 0.00 3.86 70 BOUNCE_MESSAGE 10653 2.92 0.22 3.48 71 ANY_BOUNCE_MESSAGE 10653 2.92 0.22 3.48 72 XMNumbers 10351 3.68 5.10 3.39 73 MIME_HTML_MOSTLY 10252 3.85 6.18 3.35 74 T_REMOTE_IMAGE 9665 3.42 4.66 3.16 75 RCVD_IN_IADB_LISTED 9558 2.84 1.47 3.13 76 XMBdyGiftCard01 9087 2.85 2.29 2.97 77 T_TooManySym_02 9066 2.63 1.05 2.97 78 TVD_RCVD_IP 8989 2.47 0.23 2.94 79 TR_XM_PhishingBody 8811 3.21 4.74 2.88 80 RCVD_IN_IADB_SPF 8278 2.45 1.25 2.71 81 BAYES_05 8248 2.48 1.45 2.70 82 FSL_BULK_SIG 8039 3.25 6.18 2.63 83 HTML_IMAGE_RATIO_08 8031 2.60 2.49 2.63 84 INVALID_MSGID 8018 2.22 0.28 2.62 85 BAYES_95 7767 3.06 5.51 2.54 86 XM_CamelCaseFrm001 7665 3.67 9.20 2.51 87 HELO_MISC_IP 7554 2.07 0.18 2.47 88 CK_HELO_DYNAMIC_SPLIT_IP 7550 2.08 0.21 2.47 89 HTML_FONT_FACE_BAD 7515 2.13 0.59 2.46 90 RCVD_IN_IADB_SENDERID 7407 2.21 1.20 2.42 91 BOTNET 7270 5.41 19.84 2.38 92 RCVD_IN_IADB_DK 7184 2.15 1.21 2.35 93 XM_B_SpammyTLD 7087 2.82 5.19 2.32 94 TO_MALFORMED 6899 1.87 0.02 2.26 95 NO_DNS_FOR_FROM 6573 2.77 5.70 2.15 96 RELAYCOUNTRY_CA 6531 3.70 11.14 2.14 97 UNTRUSTED_Relay 6531 5.07 18.99 2.14 98 XM_B_COVIDMETA 5949 2.39 4.47 1.95 99 RCVD_IN_IADB_VOUCHED 5945 1.68 0.45 1.94 100 MAILING_LIST_MULTI 5737 1.70 0.84 1.88 101 XMSexyCombo_01 5425 2.09 3.60 1.77 102 TR_Symld_Words 5146 1.56 0.98 1.68 103 IN_HORDE_ADDRESS_BOOK 5024 1.36 0.03 1.64 104 XM_DK_Undo_01 4960 1.50 0.93 1.62 105 USER_IN_DEF_DKIM_WL 4922 1.33 0.01 1.61 106 URI_TRY_3LD 4856 1.50 1.08 1.59 107 RCVD_IN_MSPIKE_BL 4832 3.17 10.74 1.58 108 XM_PDF 4731 1.39 0.62 1.55 109 T_XMDrugObfuBody_14 4728 1.54 1.53 1.55 110 RCVD_IN_MSPIKE_L3 4485 2.54 7.64 1.47 111 XMStockSpam_06 4412 1.58 2.25 1.44 112 TM2_M_VERY_LONG_WORD 4349 1.48 1.76 1.42 113 XMSexyCombo_04 4349 1.37 1.13 1.42 114 XMBody_17 4224 2.03 5.10 1.38 115 URI_HEX 4134 1.46 1.96 1.35 116 XMDiploma_00 4131 1.38 1.53 1.35 117 XM_B_Phish66 4052 1.58 2.77 1.33 118 TooManyTo_002 4038 1.17 0.45 1.32 119 XMBrknScrpt_02 3997 1.23 0.87 1.31 120 HTML_MIME_NO_HTML_TAG 3964 1.78 4.07 1.30 121 XM_OfRef6 3893 1.73 3.90 1.27 122 T_XMDrugObfuBody_08 3881 1.45 2.32 1.27 123 KHOP_HELO_FCRDNS 3868 2.74 9.76 1.27 124 XM_GoogleGroups 3823 1.09 0.35 1.25 125 XM_UB50 3802 2.64 9.30 1.24 126 RCVD_IN_IADB_OPTIN 3730 1.07 0.36 1.22 127 XM_ProductURIs 3666 1.23 1.38 1.20 128 DKIM_ADSP_CUSTOM_MED 3659 1.21 1.29 1.20 129 SUBJ_ALL_CAPS 3621 1.35 2.13 1.18 130 XMGappySubj_01 3582 1.15 1.04 1.17 131 T_FILL_THIS_FORM_SHORT 3570 1.19 1.27 1.17 132 XM_B_Unsub2 3269 1.14 1.48 1.07 133 XM_RXBody 3248 1.04 0.92 1.06 134 XMSubMetaSxObfu_03 3223 1.10 1.32 1.05 135 XMSubNoVowel 3213 1.04 1.00 1.05 136 TR_MSPIKEBAYES00 3199 0.87 0.01 1.05 137 XM_SPF_SoftFail 3174 1.57 4.09 1.04 138 T_TooManySym_03 3061 0.90 0.43 1.00 139 TooManyTo_003 3057 0.88 0.31 1.00 140 TR_MetaPhish_Combo_01 3031 0.97 0.89 0.99 141 PDS_OTHER_BAD_TLD 2991 1.57 4.40 0.98 142 RCVD_IN_BL_SPAMCOP_NET 2943 1.76 5.53 0.96 143 XM_H_Long_From02 2801 0.87 0.66 0.92 144 XMSubMetaI_00 2691 0.94 1.21 0.88 145 TR_XM_COVIDMETA4 2671 1.47 4.31 0.87 146 T_XMHurry_00 2655 1.24 3.03 0.87 147 NML_ADSP_CUSTOM_MED 2651 0.91 1.13 0.87 148 RELAYCOUNTRY_GB 2574 0.97 1.57 0.84 149 TooManyTo_004 2544 0.74 0.28 0.83 150 HTML_TAG_BALANCE_BODY 2537 1.10 2.40 0.83 151 THIS_AD 2380 0.80 0.87 0.78 152 XMGenDplmaNmb 2220 0.74 0.79 0.73 153 TooManyTo_005 2220 0.64 0.23 0.73 154 URI_NOVOWEL 2043 0.73 1.00 0.67 155 TR_DCC_Bayes_99 1983 2.57 11.70 0.65 156 XM_B_REG_HTML 1970 0.66 0.71 0.64 157 SpammyFromTLD_01 1927 1.20 3.92 0.63 158 T_MANY_PILL_PRICE 1901 0.52 0.06 0.62 159 XMPhish08 1885 0.65 0.79 0.62 160 T_XMDrugObfuBody_00 1871 0.63 0.74 0.61 161 XM_H_PHPMailer 1808 0.74 1.47 0.59 162 XMPhish30 1796 0.61 0.72 0.59 163 XMHTML_After_End 1727 1.16 3.99 0.56 164 USER_IN_WHITELIST 1714 0.46 0.00 0.56 165 HTTPS_HTTP_MISMATCH 1689 0.56 0.58 0.55 166 XMHTMLBadTable_001 1573 0.47 0.23 0.51 167 PLING_QUERY 1523 0.56 0.85 0.50 168 FORGED_GMAIL_RCVD 1507 0.55 0.83 0.49 169 XM_DIRTYINTL 1500 1.16 4.36 0.49 170 XMLngstWrd_00 1494 0.45 0.28 0.49 171 XMSubMetaSxObfu_02 1480 0.48 0.49 0.48 172 XMBody_95 1479 0.41 0.06 0.48 173 XMCapTrack 1476 0.49 0.51 0.48 174 MPART_ALT_DIFF_COUNT 1454 0.58 1.09 0.48 175 RELAYCOUNTRY_DE 1454 1.10 4.09 0.48 176 URIBL_SBL_A 1446 1.83 8.28 0.47 177 XMBody_78 1445 0.47 0.45 0.47 178 RDNS_DYNAMIC 1444 1.41 5.84 0.47 179 TR_XM_PHPDW 1421 0.88 2.83 0.46 180 HTML_IMAGE_ONLY_20 1416 0.46 0.42 0.46 181 HELO_NODOT 1414 0.50 0.65 0.46 182 HELO_NO_DOMAIN 1409 0.49 0.65 0.46 183 XM_ShortIntro_01 1405 0.43 0.27 0.46 184 TR_XM_PHPForged 1384 0.86 2.78 0.45 185 XM_B_COPY_HTML 1380 0.46 0.50 0.45 186 FILL_THIS_FORM 1378 0.78 2.33 0.45 187 XMLngstWrd_01 1377 0.42 0.25 0.45 188 TR_XM_FormFill2 1376 0.85 2.75 0.45 189 BASE64_LENGTH_79_INF 1366 0.51 0.82 0.45 190 TM2_M_A_HREF_HREF 1359 0.47 0.61 0.44 191 RELAYCOUNTRY_FR 1355 1.18 4.67 0.44 192 XM_H_SpoofStaff4 1350 0.41 0.28 0.44 193 XM_H_PHPOS 1348 0.84 2.74 0.44 194 XMBSHREFv2 1341 0.40 0.23 0.44 195 XMSlimDrugH 1326 0.61 1.44 0.43 196 XM_Body_Obfu01 1323 0.38 0.14 0.43 197 MISSING_HEADERS 1267 0.68 1.97 0.41 198 SUBJ_DOLLARS 1259 0.49 0.88 0.41 199 DKIM_ADSP_NXDOMAIN 1246 0.79 2.59 0.41 200 TR_XM_COVIDMETA1 1229 0.54 1.18 0.40 ----------------------------------------------------------------------