Email: 655321 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 2.08 sec Spam: 96511 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 4.03 sec Ham: 558810 Autolearn: 0 AvgScore: -1.94 AvgScanTime: 1.74 sec Time Spent Running SA: 378.29 hours Time Spent Processing Spam: 107.95 hours Time Spent Processing Ham: 270.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 94060 98.07 97.46 98.17 2 HTML_MESSAGE 84250 89.79 87.30 90.22 3 XM_B_Unicode 74639 71.83 77.34 70.88 4 DKIM_SIGNED 69452 74.47 71.96 74.90 5 XM_DK_Pass 66799 73.10 69.21 73.78 6 RELAYCOUNTRY_US 60861 78.57 63.06 81.25 7 XMListUnsubscribeExists 59703 53.18 61.86 51.68 8 DKIM_VALID 56096 67.88 58.12 69.57 9 XM_DK_Undo_02 48180 17.34 49.92 11.71 10 DKIM_VALID_AU 39760 49.97 41.20 51.48 11 MIME_HTML_ONLY 37391 23.04 38.74 20.33 12 BAYES_99 34645 11.53 35.90 7.32 13 BAYES_50 33863 50.20 35.09 52.81 14 XM_B_Unicode3 32843 39.02 34.03 39.88 15 DKIM_VALID_EF 29164 27.07 30.22 26.53 16 RELAYCOUNTRY_META 29048 9.34 30.10 5.75 17 LOC_TINY_FONT_1 29019 24.70 30.07 23.77 18 BAYES_999 27983 9.18 28.99 5.76 19 BOTNET 27740 7.11 28.74 3.38 20 T_KAM_HTML_FONT_INVALID 23681 19.63 24.54 18.79 21 T_TM2_M_HEADER_IN_MSG 22701 27.80 23.52 28.54 22 FVGT_m_MULTI_ODD 22093 22.80 22.89 22.79 23 XMSubLong 21435 21.79 22.21 21.72 24 HTML_FONT_LOW_CONTRAST 21292 26.58 22.06 27.36 25 LOTS_OF_MONEY 20115 12.16 20.84 10.66 26 RCVD_IN_MSPIKE_H2 20024 21.07 20.75 21.12 27 UNTRUSTED_Relay 19495 4.60 20.20 1.90 28 XM_UncommonTLD01 18135 5.80 18.79 3.55 29 XM_Body_Dirty_Words 17733 13.81 18.37 13.02 30 BOTNET_IPINHOSTNAME 17044 6.78 17.66 4.90 31 XM_Multi_Part_URI 13927 12.43 14.43 12.09 32 DKIM_INVALID 13356 6.59 13.84 5.33 33 XM_SPF_SoftFail 12297 3.44 12.74 1.83 34 BAYES_60 12272 7.65 12.72 6.77 35 NO_DNS_FOR_FROM 11592 4.50 12.01 3.20 36 XM_B_Unsub 11560 11.17 11.98 11.03 37 XMSexyCombo_05 10945 4.83 11.34 3.71 38 HTML_IMAGE_RATIO_02 10782 7.71 11.17 7.11 39 XM_B_Phish_Phrases 10513 7.71 10.89 7.16 40 ALL_TRUSTED 9361 14.08 9.70 14.83 41 RCVD_IN_MSPIKE_BL 9018 1.84 9.34 0.55 42 DKIM_ADSP_CUSTOM_MED 8943 2.41 9.27 1.23 43 NML_ADSP_CUSTOM_MED 8769 2.10 9.09 0.90 44 FORGED_GMAIL_RCVD 8698 1.79 9.01 0.54 45 XM_Evil_Numbers_Gen 8694 8.43 9.01 8.33 46 XM_ShortIntro_01 8601 1.78 8.91 0.54 47 XM_CamelCaseFrm001 8280 3.11 8.58 2.16 48 XM_Lotto 7916 1.24 8.20 0.04 49 XMSubject_48 7707 1.19 7.99 0.02 50 RELAYCOUNTRY_CA 7679 2.66 7.96 1.74 51 HK_LOTTO 7678 1.18 7.96 0.00 52 LotsOfNums_01 7562 8.96 7.84 9.16 53 XM_UB50 7229 2.11 7.49 1.18 54 XM_URI_RBL 6877 1.25 7.13 0.24 55 URIBL_SBL_A 6857 1.23 7.10 0.22 56 BAYES_80 6773 4.55 7.02 4.12 57 TR_XM_MaxBayes 6482 1.08 6.72 0.11 58 XM_B_COVIDMETA 6388 2.63 6.62 1.94 59 TR_XM_COVIDMETA4 6257 1.74 6.48 0.93 60 RCVD_IN_MSPIKE_L3 6098 1.26 6.32 0.38 61 RCVD_IN_BL_SPAMCOP_NET 6009 2.24 6.23 1.55 62 TR_XM_PhishingBody 5921 3.83 6.14 3.43 63 XMSubMetaSx_00 5921 4.29 6.14 3.97 64 XM_UB99 5781 0.89 5.99 0.01 65 RCVD_IN_MSPIKE_WL 5651 22.26 5.86 25.09 66 RELAYCOUNTRY_FR 5574 1.11 5.78 0.31 67 HTML_MIME_NO_HTML_TAG 5310 2.57 5.50 2.06 68 KHOP_HELO_FCRDNS 5258 2.39 5.45 1.86 69 RCVD_IN_RP_RNBL 5105 0.84 5.29 0.07 70 TooManyTo_001 5041 7.73 5.22 8.17 71 MPART_ALT_DIFF 4923 6.10 5.10 6.27 72 HTML_IMAGE_RATIO_04 4662 5.47 4.83 5.58 73 XM_H_Long_From01 4618 5.55 4.78 5.68 74 XMNumbers 4344 3.23 4.50 3.01 75 RELAYCOUNTRY_DE 4300 1.03 4.46 0.44 76 T_XMDrugObfuBody_08 4268 2.27 4.42 1.90 77 XM_UB999 4230 0.65 4.38 0.01 78 BOTNET_NORDNS 4083 0.64 4.23 0.02 79 SpammyFromTLD_01 4071 1.40 4.22 0.91 80 XM_DIRTYINTL 3995 1.18 4.14 0.67 81 XMBody_17 3985 1.28 4.13 0.79 82 UNPARSEABLE_RELAY 3944 6.99 4.09 7.49 83 TR_XM_INV_DKIM 3882 0.75 4.02 0.18 84 MIME_HTML_MOSTLY 3778 3.79 3.91 3.77 85 HTML_TAG_BALANCE_BODY 3680 0.94 3.81 0.44 86 PDS_OTHER_BAD_TLD 3675 1.00 3.81 0.52 87 TR_XM_MaxSPIKE 3635 0.57 3.77 0.01 88 XM_B_SpammyTLD 3578 2.40 3.71 2.18 89 HTML_FONT_SIZE_LARGE 3555 0.64 3.68 0.11 90 HTML_IMAGE_ONLY_28 3505 0.93 3.63 0.46 91 TM2_M_URI_OPT_OUT 3493 3.43 3.62 3.40 92 XM_B_Phish66 3491 2.23 3.62 1.99 93 XM_OfRef6 3401 1.70 3.52 1.39 94 BAYES_95 3374 2.60 3.50 2.45 95 FROM_SUSPICIOUS_NTLD 3330 0.59 3.45 0.10 96 FROM_SUSPICIOUS_NTLD_FP 3263 0.57 3.38 0.08 97 RCVD_IN_MSPIKE_H4 3132 11.64 3.25 13.09 98 XM_SendGrid 3124 6.31 3.24 6.84 99 XMStrtUSub 3034 4.07 3.14 4.23 100 FROM_EXCESS_BASE64 2997 2.91 3.11 2.87 101 HTML_IMAGE_RATIO_06 2898 4.22 3.00 4.43 102 LongTLD 2868 0.63 2.97 0.23 103 MIME_QP_LONG_LINE 2814 5.42 2.92 5.86 104 TR_XM_PHPDW 2631 1.26 2.73 1.01 105 TR_XM_PHPForged 2613 1.24 2.71 0.99 106 TR_XM_FormFill2 2585 1.24 2.68 0.99 107 XM_H_PHPOS 2574 1.23 2.67 0.98 108 RCVD_IN_PSBL 2539 0.46 2.63 0.08 109 RCVD_IN_MSPIKE_H3 2467 10.01 2.56 11.30 110 TR_XM_COVIDMETA1 2379 0.89 2.47 0.61 111 T_TooManySym_01 2363 4.99 2.45 5.43 112 XM_B_Unsub2 2319 2.41 2.40 2.42 113 SpammyFromTLD_02 2262 0.66 2.34 0.37 114 T_REMOTE_IMAGE 2262 3.43 2.34 3.62 115 BAYES_40 2210 4.33 2.29 4.68 116 T_XMHurry_00 2179 0.88 2.26 0.65 117 SUBJ_ALL_CAPS 2142 1.86 2.22 1.79 118 HTML_IMAGE_RATIO_08 2141 2.78 2.22 2.88 119 XM_UB60 2139 0.43 2.22 0.12 120 XMDiploma_00 2108 1.84 2.18 1.79 121 XMBdyGiftCard01 2081 1.00 2.16 0.80 122 XMBrknScrpt_02 2080 0.99 2.16 0.79 123 TR_LOTS_OF_MONEY3 2018 0.76 2.09 0.53 124 RCVD_IN_MSPIKE_L5 1999 0.36 2.07 0.07 125 TR_XM_RelayPhish 1989 0.48 2.06 0.21 126 DATE_IN_PAST_12_24 1951 0.34 2.02 0.05 127 T_XMDrugObfuBody_14 1891 1.55 1.96 1.48 128 XM_UB80 1881 0.32 1.95 0.04 129 XMSexyCombo_01 1811 1.10 1.88 0.97 130 TR_Symld_Words 1746 1.59 1.81 1.55 131 XMHTML_After_End 1709 1.15 1.77 1.04 132 URI_HEX 1691 1.64 1.75 1.61 133 BAYES_20 1620 3.32 1.68 3.60 134 MIME_HTML_ONLY_MULTI 1586 2.94 1.64 3.16 135 XMHTMLBadTable_001 1545 0.63 1.60 0.46 136 MAILING_LIST_MULTI 1532 2.38 1.59 2.52 137 TM2_M_VERY_LONG_WORD 1526 1.34 1.58 1.30 138 XM_DK_Undo_01 1503 1.92 1.56 1.98 139 DATE_IN_PAST_06_12 1490 0.41 1.54 0.22 140 TR_Mismatch_TLD_02 1473 0.29 1.53 0.08 141 T_XMDrugObfuBody_00 1453 0.82 1.51 0.70 142 TR_Mismatch_TLD_01 1449 1.59 1.50 1.61 143 DATE_IN_PAST_03_06 1410 0.29 1.46 0.09 144 XMGenDplmaNmb 1389 0.99 1.44 0.92 145 XMBody_78 1333 0.62 1.38 0.49 146 XMSlimDrugH 1330 0.60 1.38 0.46 147 XM_UB95 1315 0.21 1.36 0.02 148 XMStockSpam_06 1306 1.08 1.35 1.03 149 XM_HighProb1 1291 0.21 1.34 0.01 150 ADMITS_SPAM 1288 0.23 1.33 0.04 151 XM_H_PHPMailer 1262 0.63 1.31 0.51 152 HK_RANDOM_REPLYTO 1229 0.38 1.27 0.22 153 URI_TRY_3LD 1176 1.22 1.22 1.22 154 T_FILL_THIS_FORM_SHORT 1170 0.92 1.21 0.87 155 TR_XM_COVIDMETA3 1140 0.22 1.18 0.05 156 TR_XM_DK_SendGrid 1139 3.56 1.18 3.97 157 RELAYCOUNTRY_GB 1137 1.10 1.18 1.08 158 RELAYCOUNTRY_IN 1136 0.28 1.18 0.13 159 XMMoneyMeta_00 1125 0.85 1.17 0.79 160 URIBL_BLACK 1118 0.20 1.16 0.03 161 TR_LOTS_OF_MONEY2 1111 0.42 1.15 0.30 162 T_MONEY_PERCENT 1111 0.42 1.15 0.30 163 HTTPS_HTTP_MISMATCH 1093 0.88 1.13 0.84 164 XMPhish08 1074 0.56 1.11 0.47 165 XMReplyNow 1074 0.29 1.11 0.14 166 DIET_1 1060 0.55 1.10 0.46 167 XM_H_PHPOS_M 1048 0.31 1.09 0.18 168 HELO_NODOT 1037 1.47 1.07 1.54 169 HELO_NO_DOMAIN 1035 1.47 1.07 1.54 170 XM_PDF 963 3.43 1.00 3.85 171 DKIM_ADSP_NXDOMAIN 959 1.53 0.99 1.62 172 RDNS_DYNAMIC 941 0.41 0.98 0.32 173 XMSubMetaSxObfu_03 920 0.51 0.95 0.43 174 XM_OfRef7 908 0.27 0.94 0.16 175 XMPhish30 891 0.68 0.92 0.64 176 BAYES_00 886 13.65 0.92 15.85 177 TooManyTo_002 876 1.94 0.91 2.12 178 BAYES_05 865 2.17 0.90 2.39 179 HK_SCAM 848 0.16 0.88 0.03 180 RCVD_IN_IADB_LISTED 846 4.68 0.88 5.33 181 TR_MetaPhish_Combo_01 845 0.91 0.88 0.91 182 XM_H_Long_From02 845 1.07 0.88 1.11 183 MISSING_HEADERS 827 0.56 0.86 0.51 184 REMOVE_BEFORE_LINK 825 0.40 0.85 0.32 185 RELAYCOUNTRY_NL 813 0.29 0.84 0.20 186 XM_H_MailChimp 810 0.29 0.84 0.20 187 XMSubNoVowel 748 1.00 0.78 1.03 188 RELAYCOUNTRY_CN 738 0.20 0.76 0.11 189 RCVD_IN_IADB_SPF 726 4.05 0.75 4.62 190 RCVD_IN_MSPIKE_L4 723 0.17 0.75 0.07 191 MPART_ALT_DIFF_COUNT 719 0.61 0.74 0.58 192 RELAYCOUNTRY_AU 715 0.48 0.74 0.43 193 T_TooManySym_02 711 1.79 0.74 1.97 194 XM_Nigeria_01 701 0.15 0.73 0.05 195 XM_ProductURIs 697 0.80 0.72 0.81 196 RCVD_IN_IADB_DK 696 3.52 0.72 4.00 197 URIBL_DBL_SPAM 695 0.12 0.72 0.01 198 TooManyTo_003 694 1.35 0.72 1.46 199 XMSexyCombo_04 694 0.29 0.72 0.22 200 XM_BadFromFormat 688 0.24 0.71 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 548610 98.07 97.46 98.17 2 HTML_MESSAGE 504163 89.79 87.30 90.22 3 RELAYCOUNTRY_US 454046 78.57 63.06 81.25 4 DKIM_SIGNED 418554 74.47 71.96 74.90 5 XM_DK_Pass 412269 73.10 69.21 73.78 6 XM_B_Unicode 396064 71.83 77.34 70.88 7 DKIM_VALID 388742 67.88 58.12 69.57 8 BAYES_50 295122 50.20 35.09 52.81 9 XMListUnsubscribeExists 288790 53.18 61.86 51.68 10 DKIM_VALID_AU 287698 49.97 41.20 51.48 11 XM_B_Unicode3 222861 39.02 34.03 39.88 12 T_TM2_M_HEADER_IN_MSG 159477 27.80 23.52 28.54 13 HTML_FONT_LOW_CONTRAST 152878 26.58 22.06 27.36 14 DKIM_VALID_EF 148232 27.07 30.22 26.53 15 RCVD_IN_MSPIKE_WL 140214 22.26 5.86 25.09 16 LOC_TINY_FONT_1 132836 24.70 30.07 23.77 17 FVGT_m_MULTI_ODD 127329 22.80 22.89 22.79 18 XMSubLong 121375 21.79 22.21 21.72 19 RCVD_IN_MSPIKE_H2 118048 21.07 20.75 21.12 20 MIME_HTML_ONLY 113600 23.04 38.74 20.33 21 T_KAM_HTML_FONT_INVALID 104977 19.63 24.54 18.79 22 BAYES_00 88578 13.65 0.92 15.85 23 ALL_TRUSTED 82890 14.08 9.70 14.83 24 RCVD_IN_MSPIKE_H4 73170 11.64 3.25 13.09 25 XM_Body_Dirty_Words 72777 13.81 18.37 13.02 26 XM_Multi_Part_URI 67559 12.43 14.43 12.09 27 XM_DK_Undo_02 65423 17.34 49.92 11.71 28 RCVD_IN_MSPIKE_H3 63151 10.01 2.56 11.30 29 XM_B_Unsub 61660 11.17 11.98 11.03 30 LOTS_OF_MONEY 59551 12.16 20.84 10.66 31 TR_XM_DK_Bayes 56303 8.67 0.50 10.08 32 TR_XM_DK_Bayes1 52514 8.05 0.27 9.40 33 LotsOfNums_01 51180 8.96 7.84 9.16 34 TR_XM_DK_Bayes2 46958 7.20 0.20 8.40 35 XM_Evil_Numbers_Gen 46569 8.43 9.01 8.33 36 TooManyTo_001 45640 7.73 5.22 8.17 37 UNPARSEABLE_RELAY 41832 6.99 4.09 7.49 38 RCVD_IN_RP_SAFE 40952 6.34 0.59 7.33 39 BAYES_99 40908 11.53 35.90 7.32 40 XM_B_Phish_Phrases 40005 7.71 10.89 7.16 41 HTML_IMAGE_RATIO_02 39716 7.71 11.17 7.11 42 XM_SendGrid 38199 6.31 3.24 6.84 43 RCVD_IN_RP_CERTIFIED 38051 5.87 0.42 6.81 44 BAYES_60 37855 7.65 12.72 6.77 45 MPART_ALT_DIFF 35040 6.10 5.10 6.27 46 XM_DKIMWhitelistDomains 33402 5.10 0.01 5.98 47 MIME_QP_LONG_LINE 32726 5.42 2.92 5.86 48 BAYES_999 32195 9.18 28.99 5.76 49 RELAYCOUNTRY_META 32143 9.34 30.10 5.75 50 IN_ZIMBRA_NJ_WHITELIST 31955 4.88 0.02 5.72 51 XM_H_Long_From01 31730 5.55 4.78 5.68 52 HTML_IMAGE_RATIO_04 31202 5.47 4.83 5.58 53 T_TooManySym_01 30345 4.99 2.45 5.43 54 DKIM_INVALID 29812 6.59 13.84 5.33 55 RCVD_IN_IADB_LISTED 29806 4.68 0.88 5.33 56 BOTNET_IPINHOSTNAME 27379 6.78 17.66 4.90 57 BAYES_40 26165 4.33 2.29 4.68 58 RCVD_IN_IADB_SPF 25836 4.05 0.75 4.62 59 HTML_IMAGE_RATIO_06 24771 4.22 3.00 4.43 60 XMStrtUSub 23618 4.07 3.14 4.23 61 BAYES_80 23024 4.55 7.02 4.12 62 RCVD_IN_IADB_SENDERID 22553 3.55 0.71 4.04 63 RCVD_IN_IADB_DK 22342 3.52 0.72 4.00 64 XMSubMetaSx_00 22198 4.29 6.14 3.97 65 TR_XM_DK_SendGrid 22168 3.56 1.18 3.97 66 XM_PDF 21518 3.43 1.00 3.85 67 MIME_HTML_MOSTLY 21044 3.79 3.91 3.77 68 XMSexyCombo_05 20714 4.83 11.34 3.71 69 T_REMOTE_IMAGE 20227 3.43 2.34 3.62 70 BAYES_20 20124 3.32 1.68 3.60 71 XM_UncommonTLD01 19850 5.80 18.79 3.55 72 TR_XM_PhishingBody 19158 3.83 6.14 3.43 73 RCVD_IN_IADB_VOUCHED 19002 2.96 0.38 3.40 74 TM2_M_URI_OPT_OUT 18987 3.43 3.62 3.40 75 BOTNET 18868 7.11 28.74 3.38 76 NO_DNS_FOR_FROM 17894 4.50 12.01 3.20 77 MIME_HTML_ONLY_MULTI 17678 2.94 1.64 3.16 78 XMNumbers 16817 3.23 4.50 3.01 79 ANY_BOUNCE_MESSAGE 16700 2.63 0.59 2.99 80 BOUNCE_MESSAGE 16694 2.63 0.58 2.99 81 XM_H_Trusted_IP 16427 2.51 0.00 2.94 82 HTML_IMAGE_RATIO_08 16071 2.78 2.22 2.88 83 FROM_EXCESS_BASE64 16049 2.91 3.11 2.87 84 MAILING_LIST_MULTI 14081 2.38 1.59 2.52 85 BAYES_95 13663 2.60 3.50 2.45 86 XM_B_Unsub2 13504 2.41 2.40 2.42 87 BAYES_05 13367 2.17 0.90 2.39 88 XM_B_SpammyTLD 12158 2.40 3.71 2.18 89 XM_CamelCaseFrm001 12077 3.11 8.58 2.16 90 RCVD_IN_IADB_OPTIN 12033 1.88 0.29 2.15 91 TooManyTo_002 11846 1.94 0.91 2.12 92 HTML_MIME_NO_HTML_TAG 11530 2.57 5.50 2.06 93 XM_B_Phish66 11101 2.23 3.62 1.99 94 XM_DK_Undo_01 11071 1.92 1.56 1.98 95 T_TooManySym_02 11029 1.79 0.74 1.97 96 XM_B_COVIDMETA 10860 2.63 6.62 1.94 97 UNTRUSTED_Relay 10637 4.60 20.20 1.90 98 T_XMDrugObfuBody_08 10637 2.27 4.42 1.90 99 KHOP_HELO_FCRDNS 10391 2.39 5.45 1.86 100 XM_SPF_SoftFail 10250 3.44 12.74 1.83 101 SUBJ_ALL_CAPS 10020 1.86 2.22 1.79 102 XMDiploma_00 9977 1.84 2.18 1.79 103 RELAYCOUNTRY_CA 9739 2.66 7.96 1.74 104 TVD_RCVD_IP 9710 1.55 0.46 1.74 105 DKIM_ADSP_NXDOMAIN 9053 1.53 0.99 1.62 106 URI_HEX 9024 1.64 1.75 1.61 107 TR_Mismatch_TLD_01 8992 1.59 1.50 1.61 108 RCVD_IN_BL_SPAMCOP_NET 8667 2.24 6.23 1.55 109 TR_Symld_Words 8661 1.59 1.81 1.55 110 HELO_NODOT 8622 1.47 1.07 1.54 111 HELO_NO_DOMAIN 8618 1.47 1.07 1.54 112 T_XMDrugObfuBody_14 8272 1.55 1.96 1.48 113 XMSubject_78 8225 1.29 0.22 1.47 114 TooManyTo_003 8133 1.35 0.72 1.46 115 SHORT_URI_3 8002 1.27 0.35 1.43 116 HTML_FONT_FACE_BAD 7884 1.28 0.52 1.41 117 XM_GoogleGroups 7867 1.30 0.70 1.41 118 BAD_ENC_HEADER 7830 1.22 0.18 1.40 119 INVALID_MSGID 7778 1.22 0.21 1.39 120 XM_OfRef6 7744 1.70 3.52 1.39 121 HELO_MISC_IP 7692 1.20 0.17 1.38 122 CK_HELO_DYNAMIC_SPLIT_IP 7687 1.19 0.15 1.38 123 IN_HORDE_ADDRESS_BOOK 7686 1.18 0.04 1.38 124 TM2_M_VERY_LONG_WORD 7283 1.34 1.58 1.30 125 XMCapTrack 6939 1.14 0.56 1.24 126 DKIM_ADSP_CUSTOM_MED 6869 2.41 9.27 1.23 127 URI_TRY_3LD 6822 1.22 1.22 1.22 128 TO_MALFORMED 6806 1.04 0.02 1.22 129 XM_UB50 6582 2.11 7.49 1.18 130 TM2_M_A_HREF_HREF 6266 1.04 0.59 1.12 131 XM_H_Long_From02 6185 1.07 0.88 1.11 132 TooManyTo_004 6137 1.03 0.63 1.10 133 RELAYCOUNTRY_GB 6056 1.10 1.18 1.08 134 USER_IN_DEF_DKIM_WL 6015 0.92 0.00 1.08 135 XMHTML_After_End 5836 1.15 1.77 1.04 136 XMSubNoVowel 5774 1.00 0.78 1.03 137 XMStockSpam_06 5741 1.08 1.35 1.03 138 TR_XM_PHPDW 5620 1.26 2.73 1.01 139 TR_XM_PHPForged 5527 1.24 2.71 0.99 140 TR_XM_FormFill2 5521 1.24 2.68 0.99 141 XM_H_PHPOS 5490 1.23 2.67 0.98 142 XMSexyCombo_01 5424 1.10 1.88 0.97 143 TR_XM_COVIDMETA4 5171 1.74 6.48 0.93 144 TR_MSPIKEBAYES00 5150 0.79 0.00 0.92 145 XMGenDplmaNmb 5123 0.99 1.44 0.92 146 SpammyFromTLD_01 5098 1.40 4.22 0.91 147 TooManyTo_005 5091 0.85 0.49 0.91 148 TR_MetaPhish_Combo_01 5090 0.91 0.88 0.91 149 NML_ADSP_CUSTOM_MED 5022 2.10 9.09 0.90 150 T_FILL_THIS_FORM_SHORT 4838 0.92 1.21 0.87 151 HTTPS_HTTP_MISMATCH 4694 0.88 1.13 0.84 152 XM_ProductURIs 4529 0.80 0.72 0.81 153 XMBdyGiftCard01 4495 1.00 2.16 0.80 154 XMGappySubj_01 4465 0.70 0.11 0.80 155 XMBody_17 4429 1.28 4.13 0.79 156 XMMoneyMeta_00 4420 0.85 1.17 0.79 157 XMBrknScrpt_02 4398 0.99 2.16 0.79 158 T_XMDrugObfuBody_00 3912 0.82 1.51 0.70 159 RCVD_IN_MSPIKE_H5 3893 0.60 0.05 0.70 160 XMSubMetaI_00 3819 0.67 0.61 0.68 161 XM_DIRTYINTL 3765 1.18 4.14 0.67 162 TO_NO_BRKTS_HTML_ONLY 3753 0.66 0.58 0.67 163 TVD_PH_BODY_ACCOUNTS_PRE 3732 0.60 0.23 0.67 164 T_XMHurry_00 3610 0.88 2.26 0.65 165 T_Symld_Words_02 3574 0.63 0.59 0.64 166 XMPhish30 3550 0.68 0.92 0.64 167 T_TooManySym_03 3473 0.58 0.35 0.62 168 TR_XM_COVIDMETA1 3433 0.89 2.47 0.61 169 T_OBFU_PDF_ATTACH 3384 0.56 0.29 0.61 170 MPART_ALT_DIFF_COUNT 3257 0.61 0.74 0.58 171 XM_SPF_Unknown 3232 0.58 0.60 0.58 172 RCVD_IN_MSPIKE_BL 3064 1.84 9.34 0.55 173 XM_ShortIntro_01 3031 1.78 8.91 0.54 174 FORGED_GMAIL_RCVD 3022 1.79 9.01 0.54 175 TR_LOTS_OF_MONEY3 2962 0.76 2.09 0.53 176 RCVD_IN_SORBS_DUL 2885 0.49 0.32 0.52 177 PDS_OTHER_BAD_TLD 2882 1.00 3.81 0.52 178 XM_H_PHPMailer 2877 0.63 1.31 0.51 179 MISSING_HEADERS 2839 0.56 0.86 0.51 180 FROM_GOV_DKIM_AU 2835 0.45 0.10 0.51 181 XMBody_78 2759 0.62 1.38 0.49 182 HTML_IMAGE_ONLY_20 2690 0.49 0.54 0.48 183 XMPhish08 2603 0.56 1.11 0.47 184 XMHTMLBadTable_001 2585 0.63 1.60 0.46 185 DIET_1 2577 0.55 1.10 0.46 186 XMSlimDrugH 2575 0.60 1.38 0.46 187 HTML_IMAGE_ONLY_32 2573 0.45 0.38 0.46 188 HTML_IMAGE_ONLY_28 2571 0.93 3.63 0.46 189 XMNoVowels 2468 0.44 0.40 0.44 190 FROM_GOV_SPOOF 2466 0.41 0.25 0.44 191 HTML_TAG_BALANCE_BODY 2454 0.94 3.81 0.44 192 RELAYCOUNTRY_DE 2452 1.03 4.46 0.44 193 RELAYCOUNTRY_AU 2418 0.48 0.74 0.43 194 XMSubMetaSxObfu_03 2416 0.51 0.95 0.43 195 THIS_AD 2371 0.42 0.37 0.42 196 XMLngstWrd_00 2332 0.42 0.41 0.42 197 URI_NOVOWEL 2302 0.42 0.48 0.41 198 HTML_IMAGE_ONLY_24 2202 0.40 0.41 0.39 199 XMSubMetaSxObfu_02 2185 0.39 0.37 0.39 200 TM2_M_BODY_EMPTY 2179 0.35 0.10 0.39 ----------------------------------------------------------------------