Email: 691356 Autolearn: 0 AvgScore: -1.76 AvgScanTime: 2.04 sec Spam: 81561 Autolearn: 0 AvgScore: 11.53 AvgScanTime: 3.11 sec Ham: 609795 Autolearn: 0 AvgScore: -3.53 AvgScanTime: 1.89 sec Time Spent Running SA: 391.24 hours Time Spent Processing Spam: 70.42 hours Time Spent Processing Ham: 320.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 79283 98.11 97.21 98.23 2 HTML_MESSAGE 77640 91.32 95.19 90.80 3 DKIM_SIGNED 67971 71.85 83.34 70.31 4 XM_DK_Pass 65896 70.53 80.79 69.15 5 XM_B_Unicode 60266 74.73 73.89 74.84 6 XMListUnsubscribeExists 58258 51.58 71.43 48.92 7 RELAYCOUNTRY_US 57503 81.52 70.50 83.00 8 DKIM_VALID 57190 65.61 70.12 65.01 9 XM_DK_Undo_02 43971 14.41 53.91 9.13 10 DKIM_VALID_AU 41440 49.38 50.81 49.19 11 MIME_HTML_ONLY 33743 24.76 41.37 22.54 12 BAYES_50 32681 46.74 40.07 47.64 13 BAYES_99 30658 9.43 37.59 5.66 14 XM_B_Unicode3 29564 43.58 36.25 44.56 15 DKIM_VALID_EF 28197 25.34 34.57 24.10 16 LOC_TINY_FONT_1 27782 24.26 34.06 22.95 17 RELAYCOUNTRY_META 25426 8.53 31.17 5.50 18 BAYES_999 24338 7.31 29.84 4.30 19 T_KAM_HTML_FONT_INVALID 22275 18.39 27.31 17.20 20 XMSubLong 21426 21.26 26.27 20.59 21 HTML_FONT_LOW_CONTRAST 21207 26.66 26.00 26.75 22 FVGT_m_MULTI_ODD 20965 21.49 25.70 20.93 23 BOTNET 20072 5.02 24.61 2.39 24 T_TM2_M_HEADER_IN_MSG 18457 25.05 22.63 25.38 25 RCVD_IN_MSPIKE_H2 17896 18.89 21.94 18.49 26 XM_UncommonTLD01 17648 5.54 21.64 3.38 27 UNTRUSTED_Relay 16122 4.11 19.77 2.02 28 BOTNET_IPINHOSTNAME 15508 6.37 19.01 4.68 29 XM_Body_Dirty_Words 14924 13.15 18.30 12.46 30 XM_Multi_Part_URI 13800 12.13 16.92 11.49 31 LOTS_OF_MONEY 11850 8.82 14.53 8.06 32 HTML_IMAGE_RATIO_02 11351 8.05 13.92 7.26 33 XM_B_Phish_Phrases 11108 7.87 13.62 7.10 34 DKIM_INVALID 10781 6.24 13.22 5.30 35 XM_B_Unsub 10654 9.58 13.06 9.12 36 XMSexyCombo_05 9218 4.89 11.30 4.03 37 XM_CamelCaseFrm001 8311 3.10 10.19 2.16 38 XM_Evil_Numbers_Gen 7989 9.08 9.80 8.99 39 RELAYCOUNTRY_CA 7938 2.54 9.73 1.57 40 XM_B_COVIDMETA 7897 3.07 9.68 2.18 41 RCVD_IN_MSPIKE_BL 7683 1.72 9.42 0.69 42 URIBL_SBL_A 7121 1.32 8.73 0.33 43 XM_UB50 7004 2.11 8.59 1.24 44 TR_XM_MaxBayes 6619 1.02 8.12 0.07 45 LotsOfNums_01 5993 7.97 7.35 8.05 46 XMSubMetaSx_00 5970 3.90 7.32 3.44 47 NO_DNS_FOR_FROM 5748 2.97 7.05 2.42 48 RCVD_IN_MSPIKE_L3 5695 1.33 6.98 0.58 49 TR_XM_PhishingBody 5625 3.98 6.90 3.59 50 MPART_ALT_DIFF 5459 8.13 6.69 8.32 51 XM_H_Long_From01 5327 5.81 6.53 5.71 52 TR_XM_COVIDMETA4 5039 1.71 6.18 1.11 53 BAYES_80 4950 3.98 6.07 3.71 54 TooManyTo_001 4804 7.44 5.89 7.65 55 XMNumbers 4673 3.23 5.73 2.89 56 SpammyFromTLD_02 4660 0.96 5.71 0.32 57 RELAYCOUNTRY_FR 4600 0.99 5.64 0.36 58 RCVD_IN_BL_SPAMCOP_NET 4338 1.80 5.32 1.33 59 BAYES_60 4126 5.52 5.06 5.58 60 UNPARSEABLE_RELAY 4102 6.52 5.03 6.72 61 RCVD_IN_MSPIKE_WL 4096 17.30 5.02 18.94 62 RCVD_IN_RP_RNBL 3990 0.66 4.89 0.10 63 XM_SPF_SoftFail 3906 2.07 4.79 1.71 64 XM_B_SpammyTLD 3882 2.20 4.76 1.86 65 XM_B_Phish66 3804 2.25 4.66 1.92 66 SpammyFromTLD_01 3803 1.30 4.66 0.85 67 HTML_IMAGE_RATIO_04 3716 12.03 4.56 13.03 68 XM_URI_RBL 3602 0.73 4.42 0.23 69 XM_DIRTYINTL 3544 0.98 4.35 0.53 70 T_XMDrugObfuBody_08 3400 2.10 4.17 1.82 71 TR_XM_INV_DKIM 3343 0.57 4.10 0.10 72 XMBody_17 3303 1.35 4.05 0.99 73 DATE_IN_PAST_06_12 3193 0.61 3.91 0.17 74 MIME_HTML_MOSTLY 3182 2.72 3.90 2.56 75 TM2_M_URI_OPT_OUT 3170 3.05 3.89 2.94 76 XM_SendGrid 3148 5.78 3.86 6.04 77 XMStrtUSub 3092 7.69 3.79 8.21 78 XM_OfRef6 3086 1.41 3.78 1.09 79 XM_UB99 3078 0.45 3.77 0.01 80 MIME_QP_LONG_LINE 3039 5.27 3.73 5.48 81 T_TooManySym_01 3025 4.09 3.71 4.14 82 TR_LOTS_OF_MONEY3 2955 0.92 3.62 0.56 83 BAYES_95 2852 2.40 3.50 2.26 84 TR_XM_COVIDMETA1 2693 1.14 3.30 0.85 85 HTML_IMAGE_RATIO_08 2689 2.25 3.30 2.11 86 KHOP_HELO_FCRDNS 2589 1.90 3.17 1.73 87 BOTNET_NORDNS 2587 0.39 3.17 0.01 88 HTML_MIME_NO_HTML_TAG 2573 2.01 3.15 1.86 89 XM_B_Unsub2 2494 1.86 3.06 1.70 90 PDS_OTHER_BAD_TLD 2460 0.82 3.02 0.53 91 TR_XM_MaxSPIKE 2425 0.36 2.97 0.01 92 T_XMHurry_00 2397 0.85 2.94 0.57 93 HTML_IMAGE_RATIO_06 2378 4.36 2.92 4.55 94 T_XMDrugObfuBody_14 2358 1.78 2.89 1.63 95 TR_XM_PHPDW 2342 0.75 2.87 0.47 96 TR_XM_PHPForged 2319 0.73 2.84 0.45 97 TR_XM_RelayPhish 2281 0.53 2.80 0.22 98 TR_XM_FormFill2 2272 0.72 2.79 0.45 99 XM_H_PHPOS 2263 0.72 2.77 0.44 100 URI_HEX 2220 1.59 2.72 1.44 101 FROM_EXCESS_BASE64 2210 2.63 2.71 2.62 102 RELAYCOUNTRY_IN 2192 0.45 2.69 0.15 103 BAYES_40 2187 5.49 2.68 5.86 104 XM_UB999 2069 0.30 2.54 0.00 105 FROM_SUSPICIOUS_NTLD 2066 0.40 2.53 0.12 106 RCVD_IN_MSPIKE_H4 2063 8.38 2.53 9.16 107 FROM_SUSPICIOUS_NTLD_FP 2009 0.39 2.46 0.11 108 RCVD_IN_MSPIKE_H3 1965 8.56 2.41 9.38 109 T_REMOTE_IMAGE 1850 3.25 2.27 3.38 110 LongTLD 1792 0.47 2.20 0.24 111 XM_UB60 1736 0.39 2.13 0.15 112 BAYES_20 1704 4.74 2.09 5.10 113 XMSexyCombo_01 1666 0.87 2.04 0.71 114 MIME_HTML_ONLY_MULTI 1616 5.93 1.98 6.45 115 DATE_IN_PAST_03_06 1614 0.32 1.98 0.10 116 RELAYCOUNTRY_DE 1613 0.70 1.98 0.53 117 XM_UB80 1611 0.27 1.98 0.04 118 URI_TRY_3LD 1570 1.41 1.92 1.34 119 DKIM_ADSP_CUSTOM_MED 1556 1.18 1.91 1.08 120 TM2_M_VERY_LONG_WORD 1554 1.38 1.91 1.31 121 XM_DK_Undo_01 1551 1.71 1.90 1.68 122 XMDiploma_00 1548 1.50 1.90 1.44 123 ALL_TRUSTED 1478 11.73 1.81 13.05 124 XMStockSpam_06 1474 1.22 1.81 1.14 125 TR_Symld_Words 1463 1.45 1.79 1.40 126 TR_XM_COVIDMETA3 1453 0.28 1.78 0.08 127 TR_XM_DK_SendGrid 1430 3.25 1.75 3.45 128 BAYES_00 1421 17.99 1.74 20.16 129 NML_ADSP_CUSTOM_MED 1410 0.90 1.73 0.79 130 RELAYCOUNTRY_GB 1398 1.16 1.71 1.09 131 RCVD_IN_PSBL 1297 0.23 1.59 0.05 132 RCVD_IN_MSPIKE_L5 1230 0.24 1.51 0.07 133 SUBJ_ALL_CAPS 1208 1.25 1.48 1.22 134 DIET_1 1204 0.56 1.48 0.43 135 URIBL_BLACK 1194 0.22 1.46 0.05 136 T_XMDrugObfuBody_00 1189 0.81 1.46 0.72 137 DATE_IN_PAST_12_24 1176 0.27 1.44 0.11 138 XM_UB95 1160 0.18 1.42 0.01 139 XMHTML_After_End 1154 0.84 1.41 0.77 140 TR_Mismatch_TLD_02 1095 0.23 1.34 0.08 141 T_FILL_THIS_FORM_SHORT 1091 0.77 1.34 0.69 142 XM_XX_Yahoo 1072 0.22 1.31 0.07 143 FORGED_GMAIL_RCVD 1071 0.57 1.31 0.47 144 TR_Mismatch_TLD_01 1063 0.31 1.30 0.18 145 XM_H_PHPMailer 1053 0.61 1.29 0.52 146 TR_MetaPhish_Combo_01 1048 0.90 1.28 0.85 147 XMGenDplmaNmb 1042 0.90 1.28 0.85 148 MPART_ALT_DIFF_COUNT 1038 0.50 1.27 0.40 149 MAILING_LIST_MULTI 1036 2.11 1.27 2.22 150 XMBody_78 1032 0.59 1.27 0.50 151 XM_SPF_Unknown 1022 0.59 1.25 0.50 152 XM_PDF 984 3.24 1.21 3.52 153 BAYES_05 969 3.71 1.19 4.05 154 XMBdyGiftCard01 949 0.98 1.16 0.96 155 HDRS_MISSP 945 0.16 1.16 0.02 156 RELAYCOUNTRY_CN 923 0.24 1.13 0.12 157 XMClaimOffer 922 0.38 1.13 0.28 158 HK_RANDOM_REPLYTO 914 0.28 1.12 0.16 159 T_Symld_Words_02 897 0.61 1.10 0.54 160 XMSlimDrugH 891 0.37 1.09 0.27 161 T_TooManySym_02 884 1.81 1.08 1.91 162 XM_ProductURIs 880 0.68 1.08 0.63 163 DKIM_ADSP_NXDOMAIN 866 0.52 1.06 0.44 164 T_MONEY_PERCENT 864 0.39 1.06 0.31 165 TR_LOTS_OF_MONEY2 864 0.39 1.06 0.31 166 RELAYCOUNTRY_NL 854 0.30 1.05 0.20 167 RCVD_IN_IADB_LISTED 837 4.11 1.03 4.52 168 RELAYCOUNTRY_AT 829 0.28 1.02 0.18 169 XMSubMetaSxObfu_03 827 0.48 1.01 0.41 170 URIBL_DBL_SPAM 825 0.14 1.01 0.02 171 XM_TLDProd2 822 0.30 1.01 0.20 172 XM_HighProb1 802 0.12 0.98 0.00 173 HELO_NODOT 799 0.52 0.98 0.45 174 XMSubMetaI_00 799 0.54 0.98 0.48 175 HELO_NO_DOMAIN 798 0.52 0.98 0.45 176 XM_H_PHPOS_M 798 0.28 0.98 0.18 177 XMPhish08 787 0.55 0.96 0.49 178 HTML_TAG_BALANCE_BODY 779 0.51 0.96 0.45 179 BASE64_LENGTH_79_INF 768 0.35 0.94 0.27 180 RCVD_IN_IADB_SPF 761 3.61 0.93 3.96 181 TooManyTo_002 756 1.83 0.93 1.95 182 XMMoneyMeta_00 756 0.81 0.93 0.80 183 TR_XM_DK_Bayes 745 9.31 0.91 10.43 184 RCVD_IN_IADB_DK 737 3.16 0.90 3.46 185 XM_OfRef7 736 0.32 0.90 0.24 186 XM_BadFromFormat 734 0.20 0.90 0.10 187 XMReplyNow 728 0.18 0.89 0.08 188 RCVD_IN_IADB_SENDERID 728 3.20 0.89 3.51 189 TR_Sbj_FN_Bdy 715 0.30 0.88 0.22 190 XMSexyCombo_04 705 0.19 0.86 0.10 191 HTML_FONT_SIZE_HUGE 693 0.20 0.85 0.11 192 RDNS_DYNAMIC 684 0.37 0.84 0.31 193 REMOVE_BEFORE_LINK 666 0.33 0.82 0.26 194 DEAR_FRIEND 663 0.16 0.81 0.07 195 XMSubNoVowel 662 3.80 0.81 4.20 196 XMPhish30 642 0.68 0.79 0.67 197 XMBrknScrpt_02 631 0.76 0.77 0.75 198 ACT_NOW_CAPS 628 0.18 0.77 0.10 199 FSL_HELO_NON_FQDN_1 610 0.09 0.75 0.01 200 HTML_TITLE_SUBJ_DIFF 610 0.12 0.75 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 598989 98.11 97.21 98.23 2 HTML_MESSAGE 553675 91.32 95.19 90.80 3 RELAYCOUNTRY_US 506100 81.52 70.50 83.00 4 XM_B_Unicode 456361 74.73 73.89 74.84 5 DKIM_SIGNED 428741 71.85 83.34 70.31 6 XM_DK_Pass 421702 70.53 80.79 69.15 7 DKIM_VALID 396398 65.61 70.12 65.01 8 DKIM_VALID_AU 299980 49.38 50.81 49.19 9 XMListUnsubscribeExists 298337 51.58 71.43 48.92 10 BAYES_50 290482 46.74 40.07 47.64 11 XM_B_Unicode3 271718 43.58 36.25 44.56 12 HTML_FONT_LOW_CONTRAST 163116 26.66 26.00 26.75 13 T_TM2_M_HEADER_IN_MSG 154740 25.05 22.63 25.38 14 DKIM_VALID_EF 146984 25.34 34.57 24.10 15 LOC_TINY_FONT_1 139962 24.26 34.06 22.95 16 MIME_HTML_ONLY 137423 24.76 41.37 22.54 17 FVGT_m_MULTI_ODD 127625 21.49 25.70 20.93 18 XMSubLong 125538 21.26 26.27 20.59 19 BAYES_00 122930 17.99 1.74 20.16 20 RCVD_IN_MSPIKE_WL 115487 17.30 5.02 18.94 21 RCVD_IN_MSPIKE_H2 112721 18.89 21.94 18.49 22 T_KAM_HTML_FONT_INVALID 104897 18.39 27.31 17.20 23 ALL_TRUSTED 79586 11.73 1.81 13.05 24 HTML_IMAGE_RATIO_04 79438 12.03 4.56 13.03 25 XM_Body_Dirty_Words 75967 13.15 18.30 12.46 26 XM_Multi_Part_URI 70058 12.13 16.92 11.49 27 XM_H_Trusted_IP 67666 9.79 0.00 11.10 28 TR_XM_DK_Bayes 63624 9.31 0.91 10.43 29 HTML_FONT_FACE_BAD 62772 9.15 0.61 10.29 30 TR_XM_DK_Bayes1 59046 8.61 0.62 9.68 31 RCVD_IN_MSPIKE_H3 57210 8.56 2.41 9.38 32 RCVD_IN_MSPIKE_H4 55885 8.38 2.53 9.16 33 XM_DK_Undo_02 55649 14.41 53.91 9.13 34 XM_B_Unsub 55610 9.58 13.06 9.12 35 XM_Evil_Numbers_Gen 54820 9.08 9.80 8.99 36 TR_XM_DK_Bayes2 51875 7.55 0.42 8.51 37 MPART_ALT_DIFF 50741 8.13 6.69 8.32 38 XMStrtUSub 50052 7.69 3.79 8.21 39 LOTS_OF_MONEY 49139 8.82 14.53 8.06 40 LotsOfNums_01 49100 7.97 7.35 8.05 41 TooManyTo_001 46622 7.44 5.89 7.65 42 RCVD_IN_RP_SAFE 45065 6.59 0.64 7.39 43 HTML_IMAGE_RATIO_02 44297 8.05 13.92 7.26 44 XM_B_Phish_Phrases 43276 7.87 13.62 7.10 45 RCVD_IN_RP_CERTIFIED 41754 6.10 0.52 6.85 46 UNPARSEABLE_RELAY 40961 6.52 5.03 6.72 47 MIME_HTML_ONLY_MULTI 39355 5.93 1.98 6.45 48 XM_SendGrid 36818 5.78 3.86 6.04 49 BAYES_40 35735 5.49 2.68 5.86 50 XM_DKIMWhitelistDomains 35684 5.16 0.00 5.85 51 XM_H_Long_From01 34837 5.81 6.53 5.71 52 BAYES_99 34538 9.43 37.59 5.66 53 BAYES_60 34008 5.52 5.06 5.58 54 RELAYCOUNTRY_META 33528 8.53 31.17 5.50 55 MIME_QP_LONG_LINE 33396 5.27 3.73 5.48 56 DKIM_INVALID 32343 6.24 13.22 5.30 57 BAYES_20 31079 4.74 2.09 5.10 58 IN_ZIMBRA_NJ_WHITELIST 29666 4.29 0.03 4.86 59 BOTNET_IPINHOSTNAME 28520 6.37 19.01 4.68 60 HTML_IMAGE_RATIO_06 27752 4.36 2.92 4.55 61 RCVD_IN_IADB_LISTED 27566 4.11 1.03 4.52 62 BAYES_999 26192 7.31 29.84 4.30 63 XMSubNoVowel 25634 3.80 0.81 4.20 64 T_TooManySym_01 25253 4.09 3.71 4.14 65 BAYES_05 24667 3.71 1.19 4.05 66 XMSexyCombo_05 24582 4.89 11.30 4.03 67 RCVD_IN_IADB_SPF 24176 3.61 0.93 3.96 68 BAYES_80 22597 3.98 6.07 3.71 69 TR_XM_PhishingBody 21917 3.98 6.90 3.59 70 XM_PDF 21445 3.24 1.21 3.52 71 RCVD_IN_IADB_SENDERID 21409 3.20 0.89 3.51 72 RCVD_IN_IADB_DK 21127 3.16 0.90 3.46 73 TR_XM_DK_SendGrid 21018 3.25 1.75 3.45 74 ANY_BOUNCE_MESSAGE 20984 3.12 0.70 3.44 75 XMSubMetaSx_00 20959 3.90 7.32 3.44 76 BOUNCE_MESSAGE 20875 3.10 0.70 3.42 77 XM_UncommonTLD01 20630 5.54 21.64 3.38 78 T_REMOTE_IMAGE 20592 3.25 2.27 3.38 79 TM2_M_URI_OPT_OUT 17936 3.05 3.89 2.94 80 RCVD_IN_IADB_VOUCHED 17855 2.63 0.39 2.93 81 XMNumbers 17638 3.23 5.73 2.89 82 FROM_EXCESS_BASE64 15955 2.63 2.71 2.62 83 MIME_HTML_MOSTLY 15632 2.72 3.90 2.56 84 NO_DNS_FOR_FROM 14760 2.97 7.05 2.42 85 BOTNET 14604 5.02 24.61 2.39 86 BAYES_95 13752 2.40 3.50 2.26 87 MAILING_LIST_MULTI 13518 2.11 1.27 2.22 88 XM_B_COVIDMETA 13324 3.07 9.68 2.18 89 XM_CamelCaseFrm001 13145 3.10 10.19 2.16 90 HTML_IMAGE_RATIO_08 12882 2.25 3.30 2.11 91 UNTRUSTED_Relay 12311 4.11 19.77 2.02 92 TooManyTo_002 11919 1.83 0.93 1.95 93 XM_B_Phish66 11732 2.25 4.66 1.92 94 T_TooManySym_02 11619 1.81 1.08 1.91 95 HTML_MIME_NO_HTML_TAG 11343 2.01 3.15 1.86 96 XM_B_SpammyTLD 11313 2.20 4.76 1.86 97 T_XMDrugObfuBody_08 11105 2.10 4.17 1.82 98 KHOP_HELO_FCRDNS 10575 1.90 3.17 1.73 99 RCVD_IN_IADB_OPTIN 10550 1.56 0.27 1.73 100 XM_SPF_SoftFail 10401 2.07 4.79 1.71 101 XM_B_Unsub2 10372 1.86 3.06 1.70 102 XM_DK_Undo_01 10275 1.71 1.90 1.68 103 T_XMDrugObfuBody_14 9939 1.78 2.89 1.63 104 TVD_RCVD_IP 9766 1.44 0.26 1.60 105 RELAYCOUNTRY_CA 9591 2.54 9.73 1.57 106 XMDiploma_00 8805 1.50 1.90 1.44 107 URI_HEX 8755 1.59 2.72 1.44 108 TR_Symld_Words 8554 1.45 1.79 1.40 109 TooManyTo_003 8207 1.27 0.74 1.35 110 URI_TRY_3LD 8195 1.41 1.92 1.34 111 RCVD_IN_BL_SPAMCOP_NET 8126 1.80 5.32 1.33 112 TM2_M_VERY_LONG_WORD 7980 1.38 1.91 1.31 113 IN_HORDE_ADDRESS_BOOK 7916 1.15 0.04 1.30 114 INVALID_MSGID 7653 1.13 0.16 1.26 115 XM_UB50 7582 2.11 8.59 1.24 116 XM_GoogleGroups 7575 1.15 0.46 1.24 117 HELO_MISC_IP 7513 1.11 0.18 1.23 118 CK_HELO_DYNAMIC_SPLIT_IP 7505 1.11 0.17 1.23 119 SUBJ_ALL_CAPS 7457 1.25 1.48 1.22 120 XMSubLongNoVowel 7078 1.03 0.09 1.16 121 XMSubGarbage 7036 1.02 0.05 1.15 122 XMCapTrack 6959 1.09 0.71 1.14 123 XMStockSpam_06 6934 1.22 1.81 1.14 124 TO_MALFORMED 6906 1.00 0.01 1.13 125 TR_XM_COVIDMETA4 6756 1.71 6.18 1.11 126 XM_OfRef6 6667 1.41 3.78 1.09 127 RELAYCOUNTRY_GB 6640 1.16 1.71 1.09 128 DKIM_ADSP_CUSTOM_MED 6578 1.18 1.91 1.08 129 TooManyTo_004 6204 0.97 0.64 1.02 130 XMBody_17 6035 1.35 4.05 0.99 131 XMBdyGiftCard01 5834 0.98 1.16 0.96 132 USER_IN_DEF_DKIM_WL 5683 0.82 0.00 0.93 133 XM_H_Long_From02 5444 0.86 0.60 0.89 134 XM_E_Blogspot 5248 0.78 0.14 0.86 135 TooManyTo_005 5216 0.82 0.53 0.86 136 HTML_IMAGE_ONLY_20 5193 0.79 0.31 0.85 137 SpammyFromTLD_01 5191 1.30 4.66 0.85 138 TR_XM_COVIDMETA1 5171 1.14 3.30 0.85 139 TR_MetaPhish_Combo_01 5165 0.90 1.28 0.85 140 XMGenDplmaNmb 5160 0.90 1.28 0.85 141 XMGappySubj_01 4976 0.74 0.20 0.82 142 XMMoneyMeta_00 4865 0.81 0.93 0.80 143 NML_ADSP_CUSTOM_MED 4821 0.90 1.73 0.79 144 TR_MSPIKEBAYES00 4751 0.69 0.00 0.78 145 XMHTML_After_End 4672 0.84 1.41 0.77 146 XMBrknScrpt_02 4590 0.76 0.77 0.75 147 T_XMDrugObfuBody_00 4393 0.81 1.46 0.72 148 HTTPS_HTTP_MISMATCH 4370 0.71 0.70 0.72 149 XMSexyCombo_01 4338 0.87 2.04 0.71 150 T_FILL_THIS_FORM_SHORT 4218 0.77 1.34 0.69 151 RCVD_IN_MSPIKE_BL 4191 1.72 9.42 0.69 152 XMPhish30 4064 0.68 0.79 0.67 153 XM_RXBody 3974 0.63 0.47 0.65 154 FROM_GOV_DKIM_AU 3885 0.58 0.15 0.64 155 XM_ProductURIs 3816 0.68 1.08 0.63 156 T_TooManySym_03 3787 0.60 0.43 0.62 157 RCVD_IN_MSPIKE_L3 3518 1.33 6.98 0.58 158 T_XMHurry_00 3488 0.85 2.94 0.57 159 TR_LOTS_OF_MONEY3 3414 0.92 3.62 0.56 160 T_Symld_Words_02 3304 0.61 1.10 0.54 161 T_OBFU_PDF_ATTACH 3269 0.51 0.32 0.54 162 XMPhish14 3259 0.54 0.59 0.53 163 XM_DIRTYINTL 3238 0.98 4.35 0.53 164 PDS_OTHER_BAD_TLD 3230 0.82 3.02 0.53 165 RELAYCOUNTRY_DE 3217 0.70 1.98 0.53 166 XM_H_PHPMailer 3152 0.61 1.29 0.52 167 XMBody_78 3053 0.59 1.27 0.50 168 XM_SPF_Unknown 3053 0.59 1.25 0.50 169 MISSING_HEADERS 3029 0.52 0.68 0.50 170 XMNoVowels 3006 0.48 0.42 0.49 171 XMHTMLBadTable_001 3003 0.46 0.19 0.49 172 XMPhish08 2987 0.55 0.96 0.49 173 XMSubMetaI_00 2900 0.54 0.98 0.48 174 FORGED_GMAIL_RCVD 2875 0.57 1.31 0.47 175 TR_XM_PHPDW 2872 0.75 2.87 0.47 176 XM_ShortIntro_01 2820 0.44 0.27 0.46 177 HELO_NODOT 2764 0.52 0.98 0.45 178 HELO_NO_DOMAIN 2763 0.52 0.98 0.45 179 TR_XM_PHPForged 2761 0.73 2.84 0.45 180 HTML_TAG_BALANCE_BODY 2749 0.51 0.96 0.45 181 TR_XM_FormFill2 2731 0.72 2.79 0.45 182 DKIM_ADSP_NXDOMAIN 2707 0.52 1.06 0.44 183 XM_H_PHPOS 2705 0.72 2.77 0.44 184 DIET_1 2643 0.56 1.48 0.43 185 XMLngstWrd_00 2610 0.44 0.51 0.43 186 XM_B_COPY_HTML 2584 0.43 0.48 0.42 187 PLING_QUERY 2557 0.45 0.71 0.42 188 XMSubMetaSxObfu_03 2526 0.48 1.01 0.41 189 MPART_ALT_DIFF_COUNT 2440 0.50 1.27 0.40 190 RCVD_IN_MSPIKE_H5 2392 0.36 0.08 0.39 191 TM2_M_BODY_EMPTY 2336 0.36 0.19 0.38 192 FROM_GOV_SPOOF 2231 0.36 0.33 0.37 193 URI_NOVOWEL 2231 0.37 0.44 0.37 194 RELAYCOUNTRY_FR 2211 0.99 5.64 0.36 195 XMLngstWrd_01 2204 0.37 0.46 0.36 196 RELAYCOUNTRY_AU 2179 0.38 0.57 0.36 197 HTML_IMAGE_ONLY_28 2058 0.33 0.30 0.34 198 XMBody_95 2055 0.31 0.10 0.34 199 SUBJ_DOLLARS 2028 0.36 0.59 0.33 200 URIBL_SBL_A 2023 1.32 8.73 0.33 ----------------------------------------------------------------------