Email: 708794 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.99 sec Spam: 102571 Autolearn: 0 AvgScore: 11.91 AvgScanTime: 3.54 sec Ham: 606223 Autolearn: 0 AvgScore: -3.07 AvgScanTime: 1.73 sec Time Spent Running SA: 392.23 hours Time Spent Processing Spam: 100.88 hours Time Spent Processing Ham: 291.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 98986 98.06 96.50 98.32 2 HTML_MESSAGE 94609 90.71 92.24 90.45 3 DKIM_SIGNED 75248 69.19 73.36 68.49 4 XM_B_Unicode 73266 72.92 71.43 73.17 5 XM_DK_Pass 73104 67.89 71.27 67.32 6 DKIM_VALID 68906 65.02 67.18 64.65 7 RELAYCOUNTRY_US 66085 79.26 64.43 81.77 8 XMListUnsubscribeExists 61406 48.87 59.87 47.01 9 XM_DK_Undo_02 53437 16.81 52.10 10.84 10 DKIM_VALID_AU 52293 48.76 50.98 48.39 11 BAYES_99 42599 11.44 41.53 6.35 12 XM_B_Unicode3 38269 42.14 37.31 42.95 13 MIME_HTML_ONLY 38110 24.40 37.15 22.24 14 DKIM_VALID_EF 36789 26.63 35.87 25.06 15 BAYES_999 35542 9.30 34.65 5.01 16 BAYES_50 35100 47.13 34.22 49.31 17 RELAYCOUNTRY_META 31789 9.07 30.99 5.36 18 BOTNET 29956 7.39 29.21 3.70 19 LOC_TINY_FONT_1 29197 23.30 28.47 22.42 20 T_KAM_HTML_FONT_INVALID 24842 18.34 24.22 17.34 21 RCVD_IN_MSPIKE_H2 23634 20.08 23.04 19.58 22 FVGT_m_MULTI_ODD 23073 21.00 22.49 20.75 23 HTML_FONT_LOW_CONTRAST 22718 26.43 22.15 27.16 24 T_TM2_M_HEADER_IN_MSG 22349 25.32 21.79 25.92 25 UNTRUSTED_Relay 21808 4.65 21.26 1.83 26 XM_UncommonTLD01 21573 6.03 21.03 3.49 27 XMSubLong 21475 20.95 20.94 20.95 28 LOTS_OF_MONEY 17333 10.36 16.90 9.25 29 BOTNET_IPINHOSTNAME 16722 6.24 16.30 4.53 30 XM_Body_Dirty_Words 15759 12.71 15.36 12.26 31 XM_Multi_Part_URI 14266 11.46 13.91 11.05 32 NO_DNS_FOR_FROM 13726 4.76 13.38 3.30 33 XM_B_Unsub 11864 9.72 11.57 9.41 34 XM_B_Phish_Phrases 10786 7.39 10.52 6.86 35 HTML_IMAGE_RATIO_02 10642 6.94 10.38 6.36 36 XM_CamelCaseFrm001 10625 3.24 10.36 2.03 37 RCVD_IN_MSPIKE_BL 10346 1.89 10.09 0.51 38 XMSexyCombo_05 9045 4.69 8.82 3.99 39 XM_Evil_Numbers_Gen 8924 8.91 8.70 8.94 40 URIBL_SBL_A 8862 1.51 8.64 0.31 41 TR_XM_MaxBayes 8543 1.31 8.33 0.12 42 RCVD_IN_BL_SPAMCOP_NET 8116 2.22 7.91 1.26 43 ALL_TRUSTED 8053 13.65 7.85 14.64 44 XM_UB50 7529 2.04 7.34 1.14 45 RELAYCOUNTRY_CA 7351 2.35 7.17 1.54 46 LotsOfNums_01 7309 7.82 7.13 7.94 47 XMNumbers 7281 3.55 7.10 2.95 48 XM_B_COVIDMETA 6883 2.62 6.71 1.93 49 BAYES_80 6871 4.47 6.70 4.09 50 BAYES_60 6711 6.38 6.54 6.36 51 TR_XM_PhishingBody 6547 3.79 6.38 3.36 52 TooManyTo_001 6370 7.39 6.21 7.59 53 DKIM_INVALID 6342 4.18 6.18 3.84 54 RCVD_IN_MSPIKE_L3 6096 1.18 5.94 0.38 55 XM_SPF_SoftFail 6020 2.24 5.87 1.63 56 RCVD_IN_RP_RNBL 5832 0.88 5.69 0.06 57 XM_H_Long_From01 5745 4.97 5.60 4.87 58 RCVD_IN_MSPIKE_WL 5671 20.20 5.53 22.68 59 XM_UB99 5667 0.81 5.52 0.01 60 SpammyFromTLD_01 5634 1.68 5.49 1.03 61 XMBody_17 5495 1.44 5.36 0.77 62 RELAYCOUNTRY_FR 5420 1.05 5.28 0.33 63 T_XMDrugObfuBody_08 5288 2.17 5.16 1.66 64 HTML_MIME_NO_HTML_TAG 5248 2.60 5.12 2.18 65 KHOP_HELO_FCRDNS 5178 2.10 5.05 1.60 66 TM2_M_A_HREF_HREF 5178 1.57 5.05 0.98 67 XMSubMetaSx_00 5132 3.77 5.00 3.56 68 PDS_OTHER_BAD_TLD 5021 1.10 4.90 0.46 69 BOTNET_NORDNS 5005 0.79 4.88 0.10 70 XM_B_SpammyTLD 4861 2.35 4.74 1.94 71 MPART_ALT_DIFF 4632 7.75 4.52 8.30 72 DKIM_ADSP_NXDOMAIN 4436 1.17 4.32 0.63 73 XM_UB999 4436 0.63 4.32 0.01 74 XM_B_Phish66 4379 2.30 4.27 1.97 75 RCVD_IN_PSBL 4292 0.66 4.18 0.07 76 T_REMOTE_IMAGE 4177 3.31 4.07 3.18 77 MIME_HTML_MOSTLY 4113 2.81 4.01 2.61 78 HTML_IMAGE_RATIO_04 4026 11.17 3.93 12.40 79 SUBJ_ALL_CAPS 4021 1.71 3.92 1.34 80 UNPARSEABLE_RELAY 3971 6.08 3.87 6.45 81 TR_LOTS_OF_MONEY3 3933 1.37 3.83 0.95 82 XM_URI_RBL 3788 0.72 3.69 0.22 83 XMStrtUSub 3765 7.76 3.67 8.45 84 SpammyFromTLD_02 3683 0.83 3.59 0.36 85 XM_OfRef6 3650 1.57 3.56 1.24 86 TR_XM_COVIDMETA4 3639 1.12 3.55 0.70 87 FROM_SUSPICIOUS_NTLD 3598 0.57 3.51 0.08 88 XM_DIRTYINTL 3584 0.95 3.49 0.52 89 MISSING_HEADERS 3501 1.26 3.41 0.89 90 FROM_SUSPICIOUS_NTLD_FP 3488 0.55 3.40 0.07 91 DATE_IN_FUTURE_03_06 3444 0.94 3.36 0.53 92 TR_XM_MaxSPIKE 3442 0.50 3.36 0.01 93 T_FILL_THIS_FORM_SHORT 3320 1.17 3.24 0.82 94 RELAYCOUNTRY_IN 3309 0.56 3.23 0.10 95 DATE_IN_PAST_03_06 3263 0.57 3.18 0.13 96 BAYES_95 3189 2.36 3.11 2.23 97 TM2_M_URI_OPT_OUT 3122 2.91 3.04 2.89 98 XM_SendGrid 3093 5.54 3.02 5.97 99 BAYES_40 3011 5.15 2.94 5.52 100 XM_B_Unsub2 3002 2.14 2.93 2.01 101 XM_UB80 2991 0.45 2.92 0.04 102 RCVD_IN_MSPIKE_H4 2937 10.54 2.86 11.83 103 XM_BadFromFormat 2901 0.53 2.83 0.14 104 MIME_QP_LONG_LINE 2837 4.90 2.77 5.26 105 BODY_URI_ONLY 2819 0.43 2.75 0.03 106 TR_Mismatch_TLD_01 2786 0.57 2.72 0.20 107 RCVD_IN_MSPIKE_L5 2782 0.45 2.71 0.06 108 HDRS_MISSP 2727 0.43 2.66 0.05 109 RCVD_IN_MSPIKE_H3 2686 9.09 2.62 10.19 110 URI_NOVOWEL 2641 0.67 2.57 0.34 111 HTML_IMAGE_RATIO_06 2612 4.17 2.55 4.45 112 FROM_EXCESS_BASE64 2597 2.67 2.53 2.70 113 TR_XM_COVIDMETA1 2582 0.88 2.52 0.60 114 TR_XM_INV_DKIM 2557 0.49 2.49 0.16 115 DKIM_ADSP_CUSTOM_MED 2484 1.29 2.42 1.10 116 HTML_SHORT_LINK_IMG_1 2437 0.36 2.38 0.02 117 LongTLD 2437 0.50 2.38 0.18 118 T_XMDrugObfuBody_14 2410 1.53 2.35 1.39 119 TR_XM_PHPDW 2367 0.71 2.31 0.43 120 TR_XM_PHPForged 2350 0.70 2.29 0.43 121 HDRS_LCASE_IMGONLY 2347 0.34 2.29 0.01 122 NML_ADSP_CUSTOM_MED 2342 0.99 2.28 0.77 123 NO_FM_NAME_IP_HOSTN 2340 0.33 2.28 0.00 124 TR_XM_FormFill2 2316 0.69 2.26 0.42 125 XM_H_PHPOS 2313 0.68 2.26 0.42 126 HTML_IMAGE_ONLY_04 2313 0.36 2.26 0.04 127 BODY_SINGLE_URI 2271 0.33 2.21 0.01 128 FORGED_GMAIL_RCVD 2258 0.74 2.20 0.49 129 MIME_HEADER_CTYPE_ONLY 2256 0.49 2.20 0.20 130 BAYES_20 2216 4.41 2.16 4.79 131 HTML_SHORT_CENTER 2192 0.31 2.14 0.00 132 HTML_IMAGE_RATIO_08 2127 2.07 2.07 2.06 133 TR_XM_RelayPhish 2123 0.46 2.07 0.18 134 BODY_SINGLE_WORD 2099 0.31 2.05 0.02 135 XM_ShortIntro_01 2093 0.71 2.04 0.48 136 XM_UB60 2002 0.40 1.95 0.14 137 T_XMHurry_00 1991 0.72 1.94 0.51 138 T_TooManySym_01 1957 3.57 1.91 3.86 139 DATE_IN_PAST_06_12 1858 0.42 1.81 0.18 140 XMDiploma_00 1832 1.75 1.79 1.74 141 MONEY_FORM_SHORT 1822 0.28 1.78 0.03 142 FORM_FRAUD_5 1804 0.26 1.76 0.00 143 TM2_M_VERY_LONG_WORD 1791 1.30 1.75 1.22 144 XM_Lotto 1787 0.30 1.74 0.05 145 PDS_FROM_2_EMAILS 1767 0.28 1.72 0.04 146 XMBdyGiftCard01 1716 0.85 1.67 0.71 147 XMSubject_48 1715 0.29 1.67 0.06 148 T_FILL_THIS_FORM_FRAUD_PHISH 1684 0.28 1.64 0.04 149 RELAYCOUNTRY_BG 1680 0.25 1.64 0.01 150 XMHTML_After_End 1672 1.10 1.63 1.01 151 MAILING_LIST_MULTI 1664 2.29 1.62 2.40 152 MIME_HTML_ONLY_MULTI 1628 5.52 1.59 6.19 153 HELO_NODOT 1627 1.80 1.59 1.83 154 HELO_NO_DOMAIN 1626 1.80 1.59 1.83 155 TR_Symld_Words 1619 2.56 1.58 2.72 156 XM_DK_Undo_01 1618 1.76 1.58 1.79 157 XMSexyCombo_01 1608 0.98 1.57 0.88 158 BAYES_00 1598 15.34 1.56 17.67 159 TR_XM_DK_SendGrid 1580 3.27 1.54 3.56 160 XMBrknScrpt_02 1568 0.81 1.53 0.69 161 TR_Caps_n_Bayes_80 1549 0.26 1.51 0.05 162 PDS_SHORT_SPOOFED_URL 1535 0.23 1.50 0.02 163 PDS_NO_FULL_NAME_SPOOFED_URL 1533 0.23 1.49 0.02 164 URI_HEX 1522 1.62 1.48 1.64 165 HK_LOTTO 1504 0.21 1.47 0.00 166 RELAYCOUNTRY_DE 1463 0.50 1.43 0.34 167 RELAYCOUNTRY_RU 1454 0.22 1.42 0.02 168 XMMoneyMeta_00 1454 0.88 1.42 0.79 169 URI_TRY_3LD 1411 1.19 1.38 1.16 170 T_MONEY_PERCENT 1409 0.52 1.37 0.38 171 TR_LOTS_OF_MONEY2 1409 0.52 1.37 0.38 172 T_XMDrugObfuBody_00 1364 0.81 1.33 0.72 173 BAYES_05 1275 3.33 1.24 3.68 174 XMGenDplmaNmb 1254 0.96 1.22 0.91 175 RELAYCOUNTRY_GB 1238 1.14 1.21 1.13 176 TR_Mismatch_TLD_02 1234 0.25 1.20 0.09 177 XM_H_PHPMailer 1229 0.74 1.20 0.66 178 HK_SCAM 1225 0.22 1.19 0.05 179 DATE_IN_PAST_12_24 1208 0.22 1.18 0.06 180 XMBody_78 1204 0.53 1.17 0.43 181 RDNS_DYNAMIC 1189 0.42 1.16 0.30 182 TR_XM_COVIDMETA3 1179 0.20 1.15 0.05 183 DIET_1 1172 0.58 1.14 0.49 184 REMOVE_BEFORE_LINK 1168 0.48 1.14 0.37 185 XMSlimDrugH 1152 0.43 1.12 0.31 186 XMSubEmpty 1152 0.45 1.12 0.34 187 REPLYTO_WITHOUT_TO_CC 1124 0.61 1.10 0.53 188 XMStockSpam_06 1113 0.97 1.09 0.95 189 XM_OfRef7 1104 0.30 1.08 0.17 190 XM_PDF 1099 3.14 1.07 3.49 191 RELAYCOUNTRY_IT 1089 0.19 1.06 0.05 192 TR_Caps_n_Bayes_99 1076 0.25 1.05 0.12 193 XMReplyNow 1065 0.24 1.04 0.10 194 XM_UB95 1054 0.16 1.03 0.02 195 URIBL_BLACK 1051 0.17 1.02 0.03 196 RELAYCOUNTRY_CN 1023 0.24 1.00 0.11 197 RELAYCOUNTRY_JP 1017 0.19 0.99 0.05 198 RELAYCOUNTRY_PL 1004 0.20 0.98 0.06 199 ANY_BOUNCE_MESSAGE 992 3.15 0.97 3.52 200 TR_LOTS_OF_MONEY1 991 0.56 0.97 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 596042 98.06 96.50 98.32 2 HTML_MESSAGE 548317 90.71 92.24 90.45 3 RELAYCOUNTRY_US 495734 79.26 64.43 81.77 4 XM_B_Unicode 443553 72.92 71.43 73.17 5 DKIM_SIGNED 415179 69.19 73.36 68.49 6 XM_DK_Pass 408131 67.89 71.27 67.32 7 DKIM_VALID 391925 65.02 67.18 64.65 8 BAYES_50 298946 47.13 34.22 49.31 9 DKIM_VALID_AU 293332 48.76 50.98 48.39 10 XMListUnsubscribeExists 285001 48.87 59.87 47.01 11 XM_B_Unicode3 260382 42.14 37.31 42.95 12 HTML_FONT_LOW_CONTRAST 164621 26.43 22.15 27.16 13 T_TM2_M_HEADER_IN_MSG 157127 25.32 21.79 25.92 14 DKIM_VALID_EF 151933 26.63 35.87 25.06 15 RCVD_IN_MSPIKE_WL 137502 20.20 5.53 22.68 16 LOC_TINY_FONT_1 135940 23.30 28.47 22.42 17 MIME_HTML_ONLY 134838 24.40 37.15 22.24 18 XMSubLong 127033 20.95 20.94 20.95 19 FVGT_m_MULTI_ODD 125795 21.00 22.49 20.75 20 RCVD_IN_MSPIKE_H2 118713 20.08 23.04 19.58 21 BAYES_00 107149 15.34 1.56 17.67 22 T_KAM_HTML_FONT_INVALID 105146 18.34 24.22 17.34 23 ALL_TRUSTED 88732 13.65 7.85 14.64 24 HTML_IMAGE_RATIO_04 75168 11.17 3.93 12.40 25 XM_Body_Dirty_Words 74349 12.71 15.36 12.26 26 RCVD_IN_MSPIKE_H4 71739 10.54 2.86 11.83 27 XM_Multi_Part_URI 66969 11.46 13.91 11.05 28 XM_DK_Undo_02 65715 16.81 52.10 10.84 29 RCVD_IN_MSPIKE_H3 61769 9.09 2.62 10.19 30 HTML_FONT_FACE_BAD 60611 8.66 0.73 10.00 31 XM_H_Trusted_IP 59556 8.40 0.00 9.82 32 XM_B_Unsub 57065 9.72 11.57 9.41 33 LOTS_OF_MONEY 56100 10.36 16.90 9.25 34 XM_Evil_Numbers_Gen 54204 8.91 8.70 8.94 35 TR_XM_DK_Bayes 53635 7.64 0.52 8.85 36 TR_XM_DK_Bayes1 51482 7.33 0.49 8.49 37 XMStrtUSub 51215 7.76 3.67 8.45 38 MPART_ALT_DIFF 50317 7.75 4.52 8.30 39 LotsOfNums_01 48136 7.82 7.13 7.94 40 TooManyTo_001 45991 7.39 6.21 7.59 41 TR_XM_DK_Bayes2 45560 6.49 0.46 7.52 42 XM_B_Phish_Phrases 41603 7.39 10.52 6.86 43 RCVD_IN_RP_SAFE 40584 5.80 0.50 6.69 44 UNPARSEABLE_RELAY 39112 6.08 3.87 6.45 45 HTML_IMAGE_RATIO_02 38556 6.94 10.38 6.36 46 BAYES_60 38538 6.38 6.54 6.36 47 BAYES_99 38468 11.44 41.53 6.35 48 MIME_HTML_ONLY_MULTI 37507 5.52 1.59 6.19 49 RCVD_IN_RP_CERTIFIED 37378 5.33 0.37 6.17 50 XM_SendGrid 36208 5.54 3.02 5.97 51 XM_DKIMWhitelistDomains 35409 5.00 0.00 5.84 52 BAYES_40 33469 5.15 2.94 5.52 53 RELAYCOUNTRY_META 32499 9.07 30.99 5.36 54 MIME_QP_LONG_LINE 31909 4.90 2.77 5.26 55 IN_ZIMBRA_NJ_WHITELIST 31210 4.41 0.03 5.15 56 BAYES_999 30373 9.30 34.65 5.01 57 XM_H_Long_From01 29495 4.97 5.60 4.87 58 BAYES_20 29019 4.41 2.16 4.79 59 BOTNET_IPINHOSTNAME 27482 6.24 16.30 4.53 60 HTML_IMAGE_RATIO_06 26963 4.17 2.55 4.45 61 RCVD_IN_IADB_LISTED 25904 3.75 0.64 4.27 62 BAYES_80 24785 4.47 6.70 4.09 63 XMSexyCombo_05 24192 4.69 8.82 3.99 64 T_TooManySym_01 23380 3.57 1.91 3.86 65 DKIM_INVALID 23254 4.18 6.18 3.84 66 RCVD_IN_IADB_SPF 22796 3.30 0.57 3.76 67 BOTNET 22427 7.39 29.21 3.70 68 BAYES_05 22332 3.33 1.24 3.68 69 XMSubMetaSx_00 21593 3.77 5.00 3.56 70 TR_XM_DK_SendGrid 21575 3.27 1.54 3.56 71 ANY_BOUNCE_MESSAGE 21350 3.15 0.97 3.52 72 BOUNCE_MESSAGE 21346 3.15 0.97 3.52 73 XM_UncommonTLD01 21172 6.03 21.03 3.49 74 XM_PDF 21132 3.14 1.07 3.49 75 TR_XM_PhishingBody 20350 3.79 6.38 3.36 76 XMSubNoVowel 20077 2.97 0.95 3.31 77 RCVD_IN_IADB_DK 20046 2.91 0.55 3.31 78 NO_DNS_FOR_FROM 20014 4.76 13.38 3.30 79 RCVD_IN_IADB_SENDERID 19662 2.85 0.56 3.24 80 T_REMOTE_IMAGE 19255 3.31 4.07 3.18 81 XMNumbers 17893 3.55 7.10 2.95 82 TM2_M_URI_OPT_OUT 17491 2.91 3.04 2.89 83 RCVD_IN_IADB_VOUCHED 16526 2.36 0.22 2.73 84 TR_Symld_Words 16498 2.56 1.58 2.72 85 FROM_EXCESS_BASE64 16361 2.67 2.53 2.70 86 MIME_HTML_MOSTLY 15797 2.81 4.01 2.61 87 MAILING_LIST_MULTI 14557 2.29 1.62 2.40 88 BAYES_95 13513 2.36 3.11 2.23 89 HTML_MIME_NO_HTML_TAG 13213 2.60 5.12 2.18 90 HTML_IMAGE_RATIO_08 12515 2.07 2.07 2.06 91 XM_CamelCaseFrm001 12321 3.24 10.36 2.03 92 XM_B_Unsub2 12171 2.14 2.93 2.01 93 XM_B_Phish66 11922 2.30 4.27 1.97 94 XM_B_SpammyTLD 11769 2.35 4.74 1.94 95 XM_B_COVIDMETA 11713 2.62 6.71 1.93 96 TooManyTo_002 11515 1.74 0.82 1.90 97 UNTRUSTED_Relay 11121 4.65 21.26 1.83 98 HELO_NODOT 11104 1.80 1.59 1.83 99 HELO_NO_DOMAIN 11103 1.80 1.59 1.83 100 T_TooManySym_02 10869 1.63 0.64 1.79 101 XM_DK_Undo_01 10866 1.76 1.58 1.79 102 XMDiploma_00 10570 1.75 1.79 1.74 103 T_XMDrugObfuBody_08 10090 2.17 5.16 1.66 104 URI_HEX 9958 1.62 1.48 1.64 105 XM_SPF_SoftFail 9892 2.24 5.87 1.63 106 KHOP_HELO_FCRDNS 9700 2.10 5.05 1.60 107 RCVD_IN_IADB_OPTIN 9514 1.37 0.21 1.57 108 RELAYCOUNTRY_CA 9308 2.35 7.17 1.54 109 TVD_RCVD_IP 9140 1.34 0.34 1.51 110 T_XMDrugObfuBody_14 8436 1.53 2.35 1.39 111 SUBJ_ALL_CAPS 8133 1.71 3.92 1.34 112 TooManyTo_003 7929 1.21 0.62 1.31 113 XM_GoogleGroups 7829 1.18 0.50 1.29 114 INVALID_MSGID 7754 1.11 0.14 1.28 115 RCVD_IN_BL_SPAMCOP_NET 7616 2.22 7.91 1.26 116 XM_OfRef6 7500 1.57 3.56 1.24 117 IN_HORDE_ADDRESS_BOOK 7475 1.06 0.03 1.23 118 TM2_M_VERY_LONG_WORD 7410 1.30 1.75 1.22 119 HELO_MISC_IP 7266 1.04 0.13 1.20 120 CK_HELO_DYNAMIC_SPLIT_IP 7258 1.05 0.15 1.20 121 XMSubLongNoVowel 7113 1.02 0.15 1.17 122 XMSubGarbage 7068 1.00 0.03 1.17 123 URI_TRY_3LD 7048 1.19 1.38 1.16 124 TO_MALFORMED 6978 1.00 0.09 1.15 125 XM_UB50 6918 2.04 7.34 1.14 126 RELAYCOUNTRY_GB 6833 1.14 1.21 1.13 127 XMCapTrack 6645 1.02 0.56 1.10 128 DKIM_ADSP_CUSTOM_MED 6644 1.29 2.42 1.10 129 USER_IN_DEF_DKIM_WL 6529 0.93 0.03 1.08 130 SpammyFromTLD_01 6254 1.68 5.49 1.03 131 XMHTML_After_End 6105 1.10 1.63 1.01 132 TooManyTo_004 6087 0.93 0.52 1.00 133 TM2_M_A_HREF_HREF 5967 1.57 5.05 0.98 134 TR_LOTS_OF_MONEY3 5778 1.37 3.83 0.95 135 XMStockSpam_06 5771 0.97 1.09 0.95 136 XM_H_Long_From02 5638 0.93 0.91 0.93 137 XMGenDplmaNmb 5537 0.96 1.22 0.91 138 MISSING_HEADERS 5403 1.26 3.41 0.89 139 XMSexyCombo_01 5365 0.98 1.57 0.88 140 XM_E_Blogspot 5136 0.74 0.09 0.85 141 XM_ProductURIs 5090 0.84 0.81 0.84 142 TooManyTo_005 5020 0.77 0.44 0.83 143 XMGappySubj_01 5008 0.73 0.16 0.83 144 T_FILL_THIS_FORM_SHORT 4991 1.17 3.24 0.82 145 XMMoneyMeta_00 4812 0.88 1.42 0.79 146 TR_MSPIKEBAYES00 4718 0.67 0.00 0.78 147 XMBody_17 4689 1.44 5.36 0.77 148 NML_ADSP_CUSTOM_MED 4664 0.99 2.28 0.77 149 XMSubMetaSxObfu_03 4486 0.72 0.63 0.74 150 HTTPS_HTTP_MISMATCH 4410 0.74 0.81 0.73 151 T_XMDrugObfuBody_00 4386 0.81 1.33 0.72 152 XMBdyGiftCard01 4334 0.85 1.67 0.71 153 TR_XM_COVIDMETA4 4273 1.12 3.55 0.70 154 XMBrknScrpt_02 4167 0.81 1.53 0.69 155 XM_H_PHPMailer 4027 0.74 1.20 0.66 156 RCVD_IN_MSPIKE_H5 3994 0.57 0.05 0.66 157 TR_MetaPhish_Combo_01 3896 0.68 0.92 0.64 158 DKIM_ADSP_NXDOMAIN 3849 1.17 4.32 0.63 159 TR_XM_COVIDMETA1 3665 0.88 2.52 0.60 160 T_TooManySym_03 3610 0.55 0.27 0.60 161 XMNoVowels 3382 0.55 0.48 0.56 162 XM_SPF_Unknown 3305 0.57 0.72 0.55 163 T_OBFU_PDF_ATTACH 3252 0.51 0.38 0.54 164 REPLYTO_WITHOUT_TO_CC 3206 0.61 1.10 0.53 165 DATE_IN_FUTURE_03_06 3199 0.94 3.36 0.53 166 XM_DIRTYINTL 3144 0.95 3.49 0.52 167 T_XMHurry_00 3093 0.72 1.94 0.51 168 RCVD_IN_MSPIKE_BL 3071 1.89 10.09 0.51 169 T_Symld_Words_02 3034 0.50 0.50 0.50 170 FORGED_GMAIL_RCVD 2972 0.74 2.20 0.49 171 TR_LOTS_OF_MONEY1 2963 0.56 0.97 0.49 172 DIET_1 2959 0.58 1.14 0.49 173 XM_ShortIntro_01 2923 0.71 2.04 0.48 174 FROM_GOV_DKIM_AU 2880 0.42 0.07 0.48 175 XMPhish14 2839 0.46 0.43 0.47 176 XMPhish08 2835 0.54 0.96 0.47 177 PDS_OTHER_BAD_TLD 2780 1.10 4.90 0.46 178 XMLngstWrd_00 2750 0.50 0.81 0.45 179 MY_SERVERS_FOUND 2691 0.39 0.10 0.44 180 RCVD_IN_SORBS_DUL 2683 0.42 0.27 0.44 181 XMSubMetaI_00 2678 0.45 0.47 0.44 182 XMPhish30 2675 0.49 0.78 0.44 183 XMSexyCombo_04 2644 0.47 0.69 0.44 184 TR_XM_PHPDW 2637 0.71 2.31 0.43 185 THIS_AD 2631 0.43 0.43 0.43 186 TM2_M_BODY_EMPTY 2630 0.39 0.14 0.43 187 TR_XM_PHPForged 2603 0.70 2.29 0.43 188 MPART_ALT_DIFF_COUNT 2582 0.49 0.90 0.43 189 XMBody_78 2580 0.53 1.17 0.43 190 TR_XM_FormFill2 2547 0.69 2.26 0.42 191 XM_H_PHPOS 2518 0.68 2.26 0.42 192 SUBJ_DOLLARS 2389 0.46 0.83 0.39 193 XMLngstWrd_01 2384 0.44 0.71 0.39 194 XMHTMLBadTable_001 2381 0.45 0.76 0.39 195 TVD_PH_BODY_ACCOUNTS_PRE 2376 0.38 0.28 0.39 196 XM_B_REG_HTML 2371 0.35 0.12 0.39 197 HTML_IMAGE_ONLY_20 2345 0.40 0.50 0.39 198 NUMERIC_HTTP_ADDR 2332 0.38 0.35 0.38 199 XM_B_COPY_HTML 2327 0.40 0.50 0.38 200 TR_LOTS_OF_MONEY2 2290 0.52 1.37 0.38 ----------------------------------------------------------------------