Email: 680345 Autolearn: 0 AvgScore: -0.06 AvgScanTime: 2.22 sec Spam: 89384 Autolearn: 0 AvgScore: 11.30 AvgScanTime: 3.26 sec Ham: 590961 Autolearn: 0 AvgScore: -1.77 AvgScanTime: 2.06 sec Time Spent Running SA: 419.34 hours Time Spent Processing Spam: 80.83 hours Time Spent Processing Ham: 338.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 86929 97.91 97.25 98.01 2 HTML_MESSAGE 85533 90.73 95.69 89.98 3 DKIM_SIGNED 75762 78.77 84.76 77.87 4 XM_DK_Pass 73057 77.35 81.73 76.69 5 XM_B_Unicode 67111 73.42 75.08 73.17 6 XMListUnsubscribeExists 64778 57.45 72.47 55.18 7 RELAYCOUNTRY_US 64658 80.89 72.34 82.18 8 DKIM_VALID 64019 72.12 71.62 72.19 9 XM_DK_Undo_02 49309 15.83 55.17 9.88 10 DKIM_VALID_AU 45201 52.26 50.57 52.51 11 BAYES_99 35811 10.92 40.06 6.51 12 BAYES_50 34931 50.76 39.08 52.52 13 MIME_HTML_ONLY 34444 23.17 38.53 20.84 14 XM_B_Unicode3 34098 41.78 38.15 42.32 15 DKIM_VALID_EF 32054 27.74 35.86 26.52 16 LOC_TINY_FONT_1 30245 25.52 33.84 24.26 17 BAYES_999 28820 8.56 32.24 4.98 18 T_KAM_HTML_FONT_INVALID 27770 22.19 31.07 20.85 19 RELAYCOUNTRY_META 26896 8.99 30.09 5.80 20 FVGT_m_MULTI_ODD 25509 24.07 28.54 23.40 21 HTML_FONT_LOW_CONTRAST 24812 28.38 27.76 28.47 22 XMSubLong 22241 21.16 24.88 20.59 23 BOTNET 20496 4.92 22.93 2.19 24 T_TM2_M_HEADER_IN_MSG 20049 27.21 22.43 27.93 25 RCVD_IN_MSPIKE_H2 19465 19.97 21.78 19.70 26 XM_UncommonTLD01 18130 5.86 20.28 3.67 27 LOTS_OF_MONEY 16164 10.86 18.08 9.77 28 UNTRUSTED_Relay 15858 4.00 17.74 1.93 29 BOTNET_IPINHOSTNAME 15837 6.36 17.72 4.65 30 XM_Multi_Part_URI 15631 12.86 17.49 12.15 31 XM_Body_Dirty_Words 15046 12.89 16.83 12.30 32 XM_B_Phish_Phrases 11788 8.14 13.19 7.37 33 HTML_IMAGE_RATIO_02 11756 8.05 13.15 7.28 34 DKIM_INVALID 11743 6.66 13.14 5.68 35 XM_B_Unsub 11705 10.62 13.10 10.24 36 XM_Evil_Numbers_Gen 8571 9.21 9.59 9.15 37 XM_CamelCaseFrm001 8399 3.49 9.40 2.59 38 RELAYCOUNTRY_CA 8222 2.62 9.20 1.62 39 XMSexyCombo_05 8183 4.22 9.15 3.47 40 XM_B_COVIDMETA 8064 3.37 9.02 2.51 41 RCVD_IN_MSPIKE_BL 7845 2.45 8.78 1.49 42 LotsOfNums_01 7549 9.63 8.45 9.81 43 URIBL_SBL_A 6880 1.37 7.70 0.41 44 RCVD_IN_MSPIKE_L3 6770 2.20 7.57 1.39 45 TR_XM_MaxBayes 6510 1.02 7.28 0.08 46 NO_DNS_FOR_FROM 6261 3.02 7.00 2.42 47 TR_XM_COVIDMETA4 6154 2.16 6.88 1.44 48 XM_UB50 6077 1.98 6.80 1.25 49 XMSubMetaSx_00 6025 3.84 6.74 3.40 50 TR_XM_PhishingBody 5828 3.86 6.52 3.45 51 TR_LOTS_OF_MONEY3 5605 2.13 6.27 1.50 52 RELAYCOUNTRY_FR 5471 1.14 6.12 0.39 53 BAYES_80 5334 4.44 5.97 4.21 54 XMBody_17 5205 1.56 5.82 0.92 55 MPART_ALT_DIFF 5066 4.99 5.67 4.88 56 XM_H_Long_From01 4902 5.87 5.48 5.93 57 BAYES_60 4815 6.22 5.39 6.35 58 HTML_IMAGE_RATIO_04 4748 5.33 5.31 5.34 59 RCVD_IN_BL_SPAMCOP_NET 4728 2.07 5.29 1.58 60 SpammyFromTLD_02 4482 1.00 5.01 0.39 61 XM_URI_RBL 4427 0.85 4.95 0.22 62 T_XMDrugObfuBody_08 4421 2.22 4.95 1.81 63 XM_UB99 4405 0.65 4.93 0.01 64 TooManyTo_001 4374 7.51 4.89 7.90 65 SpammyFromTLD_01 4297 1.42 4.81 0.91 66 XMNumbers 4235 3.46 4.74 3.27 67 RCVD_IN_MSPIKE_WL 4139 17.77 4.63 19.76 68 XM_B_SpammyTLD 4047 2.29 4.53 1.95 69 UNPARSEABLE_RELAY 4029 7.28 4.51 7.70 70 XM_SPF_SoftFail 3915 2.06 4.38 1.71 71 TR_XM_INV_DKIM 3791 0.67 4.24 0.13 72 XM_B_Phish66 3788 2.19 4.24 1.88 73 TM2_M_URI_OPT_OUT 3712 3.47 4.15 3.36 74 TR_XM_MaxSPIKE 3696 0.61 4.13 0.08 75 XM_DIRTYINTL 3592 1.13 4.02 0.69 76 XMStrtUSub 3543 4.35 3.96 4.40 77 MIME_QP_LONG_LINE 3502 6.60 3.92 7.01 78 MIME_HTML_MOSTLY 3388 2.57 3.79 2.38 79 XM_OfRef6 3302 1.49 3.69 1.15 80 XM_SendGrid 3222 6.67 3.60 7.13 81 BAYES_95 3201 2.71 3.58 2.58 82 XM_B_Unsub2 2981 2.18 3.34 2.00 83 XM_UB999 2938 0.44 3.29 0.00 84 URI_HEX 2891 1.78 3.23 1.56 85 TR_XM_COVIDMETA1 2807 0.90 3.14 0.56 86 HTML_IMAGE_RATIO_06 2793 4.17 3.12 4.33 87 PDS_OTHER_BAD_TLD 2578 0.90 2.88 0.60 88 TR_XM_PHPDW 2565 1.22 2.87 0.97 89 TR_XM_PHPForged 2525 1.21 2.82 0.96 90 DATE_IN_PAST_06_12 2523 0.55 2.82 0.20 91 KHOP_HELO_FCRDNS 2522 1.90 2.82 1.76 92 TR_XM_FormFill2 2490 1.20 2.79 0.96 93 XM_H_PHPOS 2484 1.20 2.78 0.96 94 BOTNET_NORDNS 2470 0.38 2.76 0.02 95 DATE_IN_PAST_03_06 2462 0.46 2.75 0.11 96 HTML_IMAGE_RATIO_08 2439 2.73 2.73 2.73 97 FROM_SUSPICIOUS_NTLD 2429 0.48 2.72 0.14 98 T_XMHurry_00 2395 0.90 2.68 0.63 99 FROM_SUSPICIOUS_NTLD_FP 2377 0.47 2.66 0.13 100 RCVD_IN_MSPIKE_H3 2329 9.18 2.61 10.18 101 SUBJ_ALL_CAPS 2219 1.46 2.48 1.30 102 BAYES_40 2093 4.86 2.34 5.24 103 TR_XM_RelayPhish 2032 0.48 2.27 0.21 104 HTML_MIME_NO_HTML_TAG 1999 1.99 2.24 1.96 105 XMDiploma_00 1991 1.83 2.23 1.77 106 LongTLD 1986 0.54 2.22 0.28 107 RCVD_IN_RP_RNBL 1981 0.37 2.22 0.09 108 XM_DK_Undo_01 1974 1.91 2.21 1.86 109 RELAYCOUNTRY_IN 1922 0.41 2.15 0.15 110 TR_MetaPhish_Combo_01 1907 1.29 2.13 1.17 111 TM2_M_VERY_LONG_WORD 1887 1.64 2.11 1.57 112 DKIM_ADSP_CUSTOM_MED 1882 1.35 2.11 1.23 113 T_TooManySym_01 1880 3.76 2.10 4.01 114 T_XMDrugObfuBody_14 1852 1.61 2.07 1.54 115 RCVD_IN_MSPIKE_H4 1787 8.36 2.00 9.33 116 RCVD_IN_PSBL 1771 0.28 1.98 0.02 117 T_REMOTE_IMAGE 1759 3.45 1.97 3.68 118 TR_Symld_Words 1742 1.52 1.95 1.46 119 NML_ADSP_CUSTOM_MED 1684 1.01 1.88 0.88 120 MIME_HTML_ONLY_MULTI 1640 2.78 1.83 2.93 121 XMSexyCombo_01 1629 0.77 1.82 0.61 122 RELAYCOUNTRY_GB 1628 1.31 1.82 1.23 123 MAILING_LIST_MULTI 1572 2.49 1.76 2.60 124 T_XMDrugObfuBody_00 1548 0.81 1.73 0.67 125 ALL_TRUSTED 1542 12.09 1.73 13.65 126 XM_UB60 1537 0.36 1.72 0.15 127 XM_UB80 1499 0.25 1.68 0.04 128 XMBody_78 1493 0.72 1.67 0.58 129 BAYES_20 1453 3.78 1.63 4.11 130 XMGenDplmaNmb 1449 1.16 1.62 1.09 131 FROM_EXCESS_BASE64 1428 2.79 1.60 2.96 132 TR_XM_COVIDMETA3 1418 0.25 1.59 0.05 133 DEAR_FRIEND 1413 0.34 1.58 0.15 134 TR_Mismatch_TLD_02 1404 0.28 1.57 0.08 135 TR_XM_DK_SendGrid 1318 3.54 1.47 3.85 136 HK_RANDOM_REPLYTO 1316 0.43 1.47 0.27 137 XMHTML_After_End 1297 0.97 1.45 0.89 138 XMSlimDrugH 1270 0.49 1.42 0.34 139 XMStockSpam_06 1263 0.97 1.41 0.91 140 RELAYCOUNTRY_DE 1231 0.60 1.38 0.48 141 T_FILL_THIS_FORM_SHORT 1220 1.19 1.36 1.16 142 XM_UB95 1218 0.20 1.36 0.02 143 XM_H_PHPMailer 1192 0.61 1.33 0.50 144 TR_XM_COVIDMETA2 1191 0.37 1.33 0.23 145 RCVD_IN_IADB_LISTED 1190 5.29 1.33 5.89 146 XMMoneyMeta_00 1176 0.79 1.32 0.71 147 RDNS_DYNAMIC 1153 0.47 1.29 0.35 148 HELO_NODOT 1146 0.53 1.28 0.42 149 HELO_NO_DOMAIN 1145 0.53 1.28 0.42 150 XM_XX_Yahoo 1138 0.26 1.27 0.11 151 URIBL_BLACK 1116 0.19 1.25 0.02 152 TR_LOTS_OF_MONEY2 1091 0.43 1.22 0.32 153 T_MONEY_PERCENT 1091 0.43 1.22 0.32 154 FORGED_GMAIL_RCVD 1063 0.67 1.19 0.59 155 RCVD_IN_IADB_SPF 1061 4.66 1.19 5.18 156 XMPhish08 1054 0.61 1.18 0.52 157 TR_Mismatch_TLD_01 1050 0.32 1.17 0.19 158 XMBdyGiftCard01 1029 0.99 1.15 0.96 159 RCVD_IN_IADB_DK 995 4.11 1.11 4.56 160 RCVD_IN_IADB_SENDERID 988 4.12 1.11 4.58 161 FSL_HELO_NON_FQDN_1 976 0.15 1.09 0.01 162 XM_H_PHPOS_M 961 0.29 1.08 0.17 163 XMBrknScrpt_02 943 0.98 1.05 0.97 164 RELAYCOUNTRY_JP 935 0.18 1.05 0.04 165 URI_TRY_3LD 932 1.16 1.04 1.18 166 TR_Caps_n_Bayes_99 930 0.19 1.04 0.06 167 DIET_1 925 0.44 1.03 0.35 168 REMOVE_BEFORE_LINK 923 0.50 1.03 0.42 169 XM_HighProb1 915 0.14 1.02 0.01 170 BAYES_05 887 2.38 0.99 2.59 171 XM_H_MailChimp 878 0.37 0.98 0.28 172 NUMERIC_HTTP_ADDR 868 0.33 0.97 0.24 173 T_HTML_TAG_BALANCE_CENTER 866 0.34 0.97 0.24 174 T_Symld_Words_02 861 0.64 0.96 0.60 175 RELAYCOUNTRY_NL 836 0.30 0.94 0.20 176 XM_OfRef7 827 0.24 0.93 0.14 177 XMSubMetaI_00 818 0.81 0.92 0.80 178 XM_ProductURIs 815 0.81 0.91 0.79 179 XM_BadFromFormat 807 0.22 0.90 0.11 180 BAYES_00 805 13.82 0.90 15.77 181 DATE_IN_PAST_12_24 784 0.16 0.88 0.05 182 TR_Sbj_FN_Bdy 775 0.27 0.87 0.18 183 T_TooManySym_02 757 1.78 0.85 1.92 184 RELAYCOUNTRY_IE 753 0.29 0.84 0.21 185 RELAYCOUNTRY_AT 752 0.23 0.84 0.13 186 XM_PDF 734 3.50 0.82 3.90 187 MISSING_HEADERS 727 0.60 0.81 0.56 188 XMReplyNow 711 0.20 0.80 0.11 189 XMSubMetaSxObfu_03 708 0.41 0.79 0.35 190 TR_MetaPhish_Combo_01b 695 0.26 0.78 0.18 191 MPART_ALT_DIFF_COUNT 695 0.37 0.78 0.31 192 XM_H_Long_From02 692 1.16 0.77 1.22 193 XMSexyCombo_04 689 0.22 0.77 0.14 194 TVD_RCVD_IP 686 1.53 0.77 1.64 195 RELAYCOUNTRY_AU 685 0.57 0.77 0.54 196 HTML_TAG_BALANCE_BODY 675 0.46 0.76 0.41 197 HTML_FONT_SIZE_HUGE 675 0.20 0.76 0.11 198 XMSubEmpty 668 0.28 0.75 0.21 199 URI_NO_WWW_BIZ_CGI 663 0.10 0.74 0.01 200 HDRS_MISSP 653 0.12 0.73 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 579227 97.91 97.25 98.01 2 HTML_MESSAGE 531763 90.73 95.69 89.98 3 RELAYCOUNTRY_US 485651 80.89 72.34 82.18 4 DKIM_SIGNED 460166 78.77 84.76 77.87 5 XM_DK_Pass 453203 77.35 81.73 76.69 6 XM_B_Unicode 432388 73.42 75.08 73.17 7 DKIM_VALID 426615 72.12 71.62 72.19 8 XMListUnsubscribeExists 326074 57.45 72.47 55.18 9 BAYES_50 310389 50.76 39.08 52.52 10 DKIM_VALID_AU 310315 52.26 50.57 52.51 11 XM_B_Unicode3 250119 41.78 38.15 42.32 12 HTML_FONT_LOW_CONTRAST 168259 28.38 27.76 28.47 13 T_TM2_M_HEADER_IN_MSG 165080 27.21 22.43 27.93 14 DKIM_VALID_EF 156705 27.74 35.86 26.52 15 LOC_TINY_FONT_1 143382 25.52 33.84 24.26 16 FVGT_m_MULTI_ODD 138281 24.07 28.54 23.40 17 T_KAM_HTML_FONT_INVALID 123203 22.19 31.07 20.85 18 MIME_HTML_ONLY 123175 23.17 38.53 20.84 19 XMSubLong 121699 21.16 24.88 20.59 20 RCVD_IN_MSPIKE_WL 116757 17.77 4.63 19.76 21 RCVD_IN_MSPIKE_H2 116427 19.97 21.78 19.70 22 BAYES_00 93186 13.82 0.90 15.77 23 ALL_TRUSTED 80679 12.09 1.73 13.65 24 XM_Body_Dirty_Words 72661 12.89 16.83 12.30 25 XM_Multi_Part_URI 71831 12.86 17.49 12.15 26 TR_XM_DK_Bayes 63809 9.43 0.37 10.80 27 XM_B_Unsub 60525 10.62 13.10 10.24 28 RCVD_IN_MSPIKE_H3 60149 9.18 2.61 10.18 29 TR_XM_DK_Bayes1 59056 8.71 0.22 9.99 30 XM_DK_Undo_02 58411 15.83 55.17 9.88 31 LotsOfNums_01 57952 9.63 8.45 9.81 32 LOTS_OF_MONEY 57737 10.86 18.08 9.77 33 RCVD_IN_MSPIKE_H4 55114 8.36 2.00 9.33 34 XM_Evil_Numbers_Gen 54067 9.21 9.59 9.15 35 TR_XM_DK_Bayes2 51627 7.61 0.17 8.74 36 TooManyTo_001 46709 7.51 4.89 7.90 37 RCVD_IN_RP_SAFE 46163 6.87 0.63 7.81 38 UNPARSEABLE_RELAY 45504 7.28 4.51 7.70 39 XM_B_Phish_Phrases 43582 8.14 13.19 7.37 40 HTML_IMAGE_RATIO_02 43003 8.05 13.15 7.28 41 XM_SendGrid 42136 6.67 3.60 7.13 42 MIME_QP_LONG_LINE 41423 6.60 3.92 7.01 43 RCVD_IN_RP_CERTIFIED 41159 6.09 0.31 6.96 44 XM_DKIMWhitelistDomains 38642 5.68 0.01 6.54 45 BAYES_99 38469 10.92 40.06 6.51 46 BAYES_60 37527 6.22 5.39 6.35 47 XM_H_Long_From01 35038 5.87 5.48 5.93 48 RCVD_IN_IADB_LISTED 34826 5.29 1.33 5.89 49 RELAYCOUNTRY_META 34267 8.99 30.09 5.80 50 DKIM_INVALID 33551 6.66 13.14 5.68 51 HTML_IMAGE_RATIO_04 31547 5.33 5.31 5.34 52 BAYES_40 30972 4.86 2.34 5.24 53 IN_ZIMBRA_NJ_WHITELIST 30833 4.53 0.02 5.22 54 RCVD_IN_IADB_SPF 30629 4.66 1.19 5.18 55 BAYES_999 29409 8.56 32.24 4.98 56 MPART_ALT_DIFF 28850 4.99 5.67 4.88 57 BOTNET_IPINHOSTNAME 27466 6.36 17.72 4.65 58 RCVD_IN_IADB_SENDERID 27039 4.12 1.11 4.58 59 RCVD_IN_IADB_DK 26965 4.11 1.11 4.56 60 XMStrtUSub 26021 4.35 3.96 4.40 61 HTML_IMAGE_RATIO_06 25567 4.17 3.12 4.33 62 BAYES_80 24852 4.44 5.97 4.21 63 BAYES_20 24276 3.78 1.63 4.11 64 T_TooManySym_01 23689 3.76 2.10 4.01 65 XM_PDF 23076 3.50 0.82 3.90 66 RCVD_IN_IADB_VOUCHED 22870 3.45 0.65 3.87 67 TR_XM_DK_SendGrid 22763 3.54 1.47 3.85 68 T_REMOTE_IMAGE 21746 3.45 1.97 3.68 69 XM_UncommonTLD01 21712 5.86 20.28 3.67 70 XMSexyCombo_05 20501 4.22 9.15 3.47 71 TR_XM_PhishingBody 20416 3.86 6.52 3.45 72 XMSubMetaSx_00 20099 3.84 6.74 3.40 73 TM2_M_URI_OPT_OUT 19863 3.47 4.15 3.36 74 XMNumbers 19321 3.46 4.74 3.27 75 FROM_EXCESS_BASE64 17521 2.79 1.60 2.96 76 MIME_HTML_ONLY_MULTI 17300 2.78 1.83 2.93 77 ANY_BOUNCE_MESSAGE 16338 2.48 0.60 2.76 78 BOUNCE_MESSAGE 16334 2.48 0.60 2.76 79 HTML_IMAGE_RATIO_08 16159 2.73 2.73 2.73 80 MAILING_LIST_MULTI 15348 2.49 1.76 2.60 81 XM_CamelCaseFrm001 15315 3.49 9.40 2.59 82 BAYES_05 15287 2.38 0.99 2.59 83 BAYES_95 15232 2.71 3.58 2.58 84 XM_B_COVIDMETA 14860 3.37 9.02 2.51 85 NO_DNS_FOR_FROM 14272 3.02 7.00 2.42 86 MIME_HTML_MOSTLY 14085 2.57 3.79 2.38 87 RCVD_IN_IADB_OPTIN 13076 1.99 0.52 2.21 88 BOTNET 12969 4.92 22.93 2.19 89 XM_H_Trusted_IP 12740 1.87 0.00 2.16 90 XM_B_Unsub2 11820 2.18 3.34 2.00 91 TooManyTo_002 11629 1.80 0.69 1.97 92 HTML_MIME_NO_HTML_TAG 11560 1.99 2.24 1.96 93 XM_B_SpammyTLD 11537 2.29 4.53 1.95 94 UNTRUSTED_Relay 11388 4.00 17.74 1.93 95 T_TooManySym_02 11360 1.78 0.85 1.92 96 XM_B_Phish66 11133 2.19 4.24 1.88 97 XM_DK_Undo_01 10987 1.91 2.21 1.86 98 T_XMDrugObfuBody_08 10715 2.22 4.95 1.81 99 XMDiploma_00 10440 1.83 2.23 1.77 100 KHOP_HELO_FCRDNS 10427 1.90 2.82 1.76 101 XM_SPF_SoftFail 10103 2.06 4.38 1.71 102 TVD_RCVD_IP 9702 1.53 0.77 1.64 103 RELAYCOUNTRY_CA 9593 2.62 9.20 1.62 104 RCVD_IN_BL_SPAMCOP_NET 9342 2.07 5.29 1.58 105 TM2_M_VERY_LONG_WORD 9285 1.64 2.11 1.57 106 URI_HEX 9202 1.78 3.23 1.56 107 T_XMDrugObfuBody_14 9089 1.61 2.07 1.54 108 TR_LOTS_OF_MONEY3 8881 2.13 6.27 1.50 109 RCVD_IN_MSPIKE_BL 8815 2.45 8.78 1.49 110 TR_Symld_Words 8618 1.52 1.95 1.46 111 IN_HORDE_ADDRESS_BOOK 8531 1.26 0.05 1.44 112 TR_XM_COVIDMETA4 8523 2.16 6.88 1.44 113 RCVD_IN_MSPIKE_L3 8228 2.20 7.57 1.39 114 TooManyTo_003 7883 1.23 0.52 1.33 115 SUBJ_ALL_CAPS 7698 1.46 2.48 1.30 116 INVALID_MSGID 7652 1.15 0.18 1.29 117 HELO_MISC_IP 7565 1.13 0.15 1.28 118 CK_HELO_DYNAMIC_SPLIT_IP 7560 1.13 0.12 1.28 119 XM_UB50 7365 1.98 6.80 1.25 120 DKIM_ADSP_CUSTOM_MED 7281 1.35 2.11 1.23 121 RELAYCOUNTRY_GB 7278 1.31 1.82 1.23 122 XM_GoogleGroups 7247 1.12 0.43 1.23 123 XM_H_Long_From02 7223 1.16 0.77 1.22 124 URI_TRY_3LD 6993 1.16 1.04 1.18 125 TO_MALFORMED 6939 1.02 0.02 1.17 126 TR_MetaPhish_Combo_01 6899 1.29 2.13 1.17 127 XMCapTrack 6896 1.09 0.55 1.17 128 T_FILL_THIS_FORM_SHORT 6863 1.19 1.36 1.16 129 XM_OfRef6 6808 1.49 3.69 1.15 130 XMGenDplmaNmb 6465 1.16 1.62 1.09 131 HTML_FONT_FACE_BAD 6460 1.01 0.44 1.09 132 TooManyTo_004 5997 0.94 0.46 1.01 133 TR_XM_PHPDW 5750 1.22 2.87 0.97 134 XMBrknScrpt_02 5725 0.98 1.05 0.97 135 TR_XM_PHPForged 5699 1.21 2.82 0.96 136 XMBdyGiftCard01 5698 0.99 1.15 0.96 137 TR_XM_FormFill2 5693 1.20 2.79 0.96 138 USER_IN_DEF_DKIM_WL 5679 0.84 0.00 0.96 139 XM_H_PHPOS 5652 1.20 2.78 0.96 140 XMBody_17 5409 1.56 5.82 0.92 141 SpammyFromTLD_01 5390 1.42 4.81 0.91 142 XMStockSpam_06 5357 0.97 1.41 0.91 143 XMGappySubj_01 5347 0.80 0.13 0.90 144 XMHTML_After_End 5282 0.97 1.45 0.89 145 NML_ADSP_CUSTOM_MED 5183 1.01 1.88 0.88 146 XMSubNoVowel 5175 0.85 0.72 0.88 147 TooManyTo_005 4948 0.78 0.38 0.84 148 HTTPS_HTTP_MISMATCH 4833 0.80 0.70 0.82 149 XMSubMetaI_00 4700 0.81 0.92 0.80 150 XM_ProductURIs 4691 0.81 0.91 0.79 151 XMMoneyMeta_00 4219 0.79 1.32 0.71 152 XM_DIRTYINTL 4084 1.13 4.02 0.69 153 TR_MSPIKEBAYES00 4008 0.59 0.01 0.68 154 T_XMDrugObfuBody_00 3975 0.81 1.73 0.67 155 T_XMHurry_00 3730 0.90 2.68 0.63 156 TO_NO_BRKTS_HTML_ONLY 3678 0.61 0.51 0.62 157 SUBJ_DOLLARS 3666 0.61 0.56 0.62 158 T_OBFU_PDF_ATTACH 3625 0.55 0.14 0.61 159 XMSexyCombo_01 3585 0.77 1.82 0.61 160 PDS_OTHER_BAD_TLD 3535 0.90 2.88 0.60 161 T_Symld_Words_02 3518 0.64 0.96 0.60 162 FORGED_GMAIL_RCVD 3512 0.67 1.19 0.59 163 XM_SPF_Unknown 3477 0.60 0.65 0.59 164 XMBody_78 3414 0.72 1.67 0.58 165 XM_ShortIntro_01 3400 0.56 0.43 0.58 166 XMPhish14 3384 0.57 0.55 0.57 167 MISSING_HEADERS 3335 0.60 0.81 0.56 168 T_TooManySym_03 3326 0.53 0.29 0.56 169 TR_XM_COVIDMETA1 3308 0.90 3.14 0.56 170 RELAYCOUNTRY_AU 3191 0.57 0.77 0.54 171 XMPhish08 3081 0.61 1.18 0.52 172 XM_Body_Obfu01 3045 0.53 0.62 0.52 173 XM_H_PHPMailer 2973 0.61 1.33 0.50 174 XM_B_COPY_HTML 2951 0.49 0.46 0.50 175 XMHTMLBadTable_001 2912 0.49 0.49 0.49 176 FROM_GOV_SPOOF 2845 0.45 0.22 0.48 177 RELAYCOUNTRY_DE 2828 0.60 1.38 0.48 178 THIS_AD 2797 0.45 0.33 0.47 179 XMPhish30 2782 0.50 0.67 0.47 180 HTML_IMAGE_ONLY_20 2767 0.46 0.40 0.47 181 XM_B_REG_HTML 2760 0.43 0.22 0.47 182 URI_NOVOWEL 2753 0.48 0.56 0.47 183 XMNoVowels 2730 0.46 0.46 0.46 184 TM2_M_A_HREF_HREF 2696 0.47 0.60 0.46 185 FROM_GOV_DKIM_AU 2691 0.41 0.09 0.46 186 PLING_QUERY 2599 0.45 0.48 0.44 187 HELO_NODOT 2482 0.53 1.28 0.42 188 HELO_NO_DOMAIN 2479 0.53 1.28 0.42 189 REMOVE_BEFORE_LINK 2454 0.50 1.03 0.42 190 HTML_TAG_BALANCE_BODY 2444 0.46 0.76 0.41 191 URIBL_SBL_A 2437 1.37 7.70 0.41 192 RELAYCOUNTRY_FR 2313 1.14 6.12 0.39 193 SpammyFromTLD_02 2304 1.00 5.01 0.39 194 HTML_IMAGE_ONLY_28 2284 0.37 0.25 0.39 195 HTML_IMAGE_ONLY_32 2184 0.34 0.13 0.37 196 TVD_SPACE_RATIO 2121 0.33 0.15 0.36 197 TM2_M_BODY_EMPTY 2083 0.32 0.11 0.35 198 XMSubMetaSxObfu_03 2079 0.41 0.79 0.35 199 AC_DIV_BONANZA 2075 0.32 0.14 0.35 200 RDNS_DYNAMIC 2057 0.47 1.29 0.35 ----------------------------------------------------------------------