Email: 657099 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 3.86 sec Spam: 100190 Autolearn: 0 AvgScore: 12.01 AvgScanTime: 4.84 sec Ham: 556909 Autolearn: 0 AvgScore: -1.73 AvgScanTime: 3.69 sec Time Spent Running SA: 705.07 hours Time Spent Processing Spam: 134.74 hours Time Spent Processing Ham: 570.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97276 97.83 97.09 97.96 2 HTML_MESSAGE 94439 90.00 94.26 89.23 3 DKIM_SIGNED 82020 77.32 81.86 76.50 4 XM_DK_Pass 79265 75.86 79.11 75.28 5 DKIM_VALID 71460 71.12 71.32 71.08 6 RELAYCOUNTRY_US 71141 80.36 71.01 82.04 7 XM_B_Unicode 70135 71.33 70.00 71.57 8 XMListUnsubscribeExists 65570 54.69 65.45 52.76 9 DKIM_VALID_AU 54824 53.59 54.72 53.38 10 XM_DK_Undo_02 54183 18.52 54.08 12.12 11 DKIM_VALID_EF 41107 28.98 41.03 26.81 12 MIME_HTML_ONLY 40470 23.77 40.39 20.78 13 BAYES_99 39461 12.25 39.39 7.36 14 BAYES_50 38120 50.65 38.05 52.92 15 XM_B_Unicode3 35579 40.23 35.51 41.08 16 BAYES_999 32473 9.93 32.41 5.88 17 LOC_TINY_FONT_1 30578 26.07 30.52 25.27 18 RELAYCOUNTRY_META 28990 9.07 28.94 5.50 19 T_KAM_HTML_FONT_INVALID 27986 20.83 27.93 19.55 20 RCVD_IN_MSPIKE_H2 26516 22.92 26.47 22.28 21 BOTNET 24635 6.70 24.59 3.48 22 FVGT_m_MULTI_ODD 24511 23.05 24.46 22.79 23 HTML_FONT_LOW_CONTRAST 24185 28.47 24.14 29.25 24 XM_UncommonTLD01 22754 6.39 22.71 3.46 25 XMSubLong 20383 21.52 20.34 21.73 26 T_TM2_M_HEADER_IN_MSG 20164 27.33 20.13 28.63 27 UNTRUSTED_Relay 19873 4.57 19.84 1.82 28 XM_Body_Dirty_Words 17009 15.12 16.98 14.79 29 BOTNET_IPINHOSTNAME 15219 7.02 15.19 5.55 30 XM_Multi_Part_URI 15006 12.75 14.98 12.35 31 LOTS_OF_MONEY 14306 10.21 14.28 9.48 32 XM_B_Unsub 14098 11.78 14.07 11.36 33 XM_CamelCaseFrm001 11770 3.79 11.75 2.36 34 HTML_IMAGE_RATIO_02 11346 7.87 11.32 7.24 35 XM_B_Phish_Phrases 11157 8.37 11.14 7.88 36 DKIM_INVALID 10560 6.20 10.54 5.42 37 URIBL_SBL_A 10212 1.80 10.19 0.29 38 SpammyFromTLD_01 10113 2.32 10.09 0.93 39 RCVD_IN_BL_SPAMCOP_NET 10081 2.96 10.06 1.69 40 TR_XM_MaxBayes 9929 1.61 9.91 0.12 41 XMSexyCombo_05 9860 5.16 9.84 4.32 42 NO_DNS_FOR_FROM 9653 4.04 9.63 3.04 43 RCVD_IN_MSPIKE_BL 9361 1.87 9.34 0.52 44 XM_Evil_Numbers_Gen 8678 8.73 8.66 8.74 45 RELAYCOUNTRY_CA 8223 2.61 8.21 1.61 46 XM_B_COVIDMETA 7658 3.26 7.64 2.48 47 XMBody_17 7341 1.91 7.33 0.93 48 PDS_OTHER_BAD_TLD 7226 1.51 7.21 0.48 49 BAYES_80 6968 4.92 6.95 4.55 50 LotsOfNums_01 6847 8.50 6.83 8.80 51 XM_UB99 6766 1.04 6.75 0.01 52 TR_XM_PhishingBody 6584 3.97 6.57 3.50 53 BAYES_60 6449 6.32 6.44 6.30 54 MPART_ALT_DIFF 6394 5.16 6.38 4.93 55 XM_UB50 6366 1.91 6.35 1.11 56 RELAYCOUNTRY_FR 6179 1.20 6.17 0.30 57 RCVD_IN_RP_RNBL 6118 1.00 6.11 0.08 58 TR_Mismatch_TLD_01 6035 1.14 6.02 0.26 59 XMSubMetaSx_00 5706 4.09 5.70 3.80 60 RCVD_IN_MSPIKE_WL 5654 21.54 5.64 24.40 61 RCVD_IN_MSPIKE_L3 5653 1.20 5.64 0.40 62 XM_UB999 5478 0.84 5.47 0.01 63 PDS_FROM_2_EMAILS 5377 0.86 5.37 0.05 64 HTML_IMAGE_RATIO_04 5234 5.96 5.22 6.09 65 TR_XM_COVIDMETA4 5131 1.61 5.12 0.98 66 XM_H_Long_From01 5121 5.64 5.11 5.74 67 T_XMDrugObfuBody_08 5028 2.71 5.02 2.30 68 BOTNET_NORDNS 4916 0.77 4.91 0.02 69 XM_B_SpammyTLD 4853 2.43 4.84 1.99 70 TooManyTo_001 4787 7.83 4.78 8.38 71 PDS_SHORT_SPOOFED_URL 4699 0.73 4.69 0.02 72 PDS_NO_FULL_NAME_SPOOFED_URL 4699 0.73 4.69 0.02 73 XM_SPF_SoftFail 4684 2.12 4.68 1.66 74 UNPARSEABLE_RELAY 4580 7.13 4.57 7.59 75 XMNumbers 4443 3.33 4.43 3.14 76 MIME_HTML_MOSTLY 4415 2.78 4.41 2.49 77 XM_B_Phish66 4231 2.28 4.22 1.93 78 XM_DIRTYINTL 4168 1.11 4.16 0.56 79 HTML_MIME_NO_HTML_TAG 4066 2.57 4.06 2.30 80 XM_OfRef6 4013 2.62 4.01 2.37 81 TR_XM_MaxSPIKE 3813 0.59 3.81 0.02 82 TR_XM_INV_DKIM 3800 0.69 3.79 0.13 83 XMSlimDrugH 3632 0.89 3.63 0.39 84 SpammyFromTLD_02 3574 0.82 3.57 0.33 85 XM_URI_RBL 3511 0.73 3.50 0.23 86 BAYES_95 3507 2.62 3.50 2.46 87 XM_SendGrid 3444 6.53 3.44 7.08 88 XMStrtUSub 3407 4.30 3.40 4.46 89 FROM_EXCESS_BASE64 3364 3.05 3.36 3.00 90 TR_XM_COVIDMETA1 3331 0.95 3.32 0.52 91 XM_DK_Undo_01 3284 2.06 3.28 1.84 92 FROM_SUSPICIOUS_NTLD 3165 0.54 3.16 0.07 93 RCVD_IN_MSPIKE_H3 3105 11.51 3.10 13.03 94 RCVD_IN_PSBL 3081 0.53 3.08 0.08 95 FROM_SUSPICIOUS_NTLD_FP 3051 0.52 3.05 0.06 96 TM2_M_URI_OPT_OUT 3009 3.27 3.00 3.32 97 DATE_IN_PAST_03_06 2894 0.52 2.89 0.10 98 TR_LOTS_OF_MONEY3 2825 0.91 2.82 0.56 99 XMSubEmpty 2806 0.65 2.80 0.27 100 RCVD_IN_MSPIKE_L5 2700 0.46 2.69 0.06 101 URI_OPTOUT_3LD 2639 0.47 2.63 0.08 102 LongTLD 2624 0.58 2.62 0.21 103 MIME_QP_LONG_LINE 2614 5.41 2.61 5.92 104 TR_Sbj_FN_Bdy 2597 0.56 2.59 0.20 105 DATE_IN_PAST_06_12 2588 0.44 2.58 0.06 106 RCVD_IN_MSPIKE_H4 2525 9.51 2.52 10.77 107 ALL_TRUSTED 2521 12.36 2.52 14.13 108 HTML_IMAGE_RATIO_06 2511 3.62 2.51 3.82 109 HTML_IMAGE_RATIO_08 2476 2.44 2.47 2.43 110 SUBJ_ALL_CAPS 2474 1.76 2.47 1.63 111 KHOP_HELO_FCRDNS 2428 1.84 2.42 1.74 112 XMDiploma_00 2385 1.72 2.38 1.60 113 TR_XM_PHPDW 2356 0.74 2.35 0.45 114 XM_UB80 2326 0.39 2.32 0.04 115 T_REMOTE_IMAGE 2319 3.49 2.31 3.70 116 TR_XM_PHPForged 2316 0.72 2.31 0.43 117 TR_XM_FormFill2 2294 0.72 2.29 0.43 118 XM_H_PHPOS 2290 0.71 2.29 0.42 119 RELAYCOUNTRY_DE 2242 0.68 2.24 0.40 120 MISSING_SUBJECT 2229 0.41 2.22 0.08 121 XMNoSubject 2229 0.41 2.22 0.08 122 T_XMDrugObfuBody_14 2210 1.71 2.21 1.62 123 T_TooManySym_01 2195 3.75 2.19 4.03 124 XMHTML_After_End 2150 1.23 2.15 1.06 125 BAYES_40 2139 4.48 2.13 4.91 126 TR_XM_RelayPhish 2135 0.50 2.13 0.21 127 XM_B_Unsub2 2096 2.41 2.09 2.47 128 T_XMHurry_00 2075 0.84 2.07 0.61 129 XMSexyCombo_01 2030 1.11 2.03 0.95 130 URI_HEX 1998 1.65 1.99 1.59 131 DIET_1 1986 0.64 1.98 0.40 132 TM2_M_VERY_LONG_WORD 1941 1.36 1.94 1.26 133 XM_UB60 1874 0.38 1.87 0.11 134 HTML_IMAGE_ONLY_16 1850 0.50 1.85 0.25 135 XMBdyGiftCard01 1784 1.07 1.78 0.94 136 XMBrknScrpt_02 1779 0.92 1.78 0.77 137 MIME_HTML_ONLY_MULTI 1731 2.60 1.73 2.76 138 HTML_SHORT_LINK_IMG_2 1728 0.32 1.72 0.07 139 DATE_IN_PAST_12_24 1713 0.30 1.71 0.05 140 T_FILL_THIS_FORM_SHORT 1697 0.91 1.69 0.76 141 TR_XM_DK_SendGrid 1616 3.66 1.61 4.03 142 URI_WP_DIRINDEX 1594 0.30 1.59 0.07 143 MAILING_LIST_MULTI 1580 2.36 1.58 2.50 144 BAYES_20 1529 3.43 1.53 3.77 145 TR_Symld_Words 1451 1.56 1.45 1.58 146 MY_SERVERS_FOUND 1420 0.30 1.42 0.10 147 HK_SCAM 1411 0.25 1.41 0.05 148 DKIM_ADSP_CUSTOM_MED 1379 1.22 1.38 1.19 149 URI_WP_HACKED_2 1370 0.26 1.37 0.06 150 XMStockSpam_06 1369 1.21 1.37 1.19 151 T_XMDrugObfuBody_00 1361 0.89 1.36 0.81 152 RELAYCOUNTRY_IN 1348 0.30 1.35 0.12 153 RELAYCOUNTRY_GB 1335 1.15 1.33 1.12 154 URIBL_BLACK 1334 0.24 1.33 0.04 155 DEAR_BENEFICIARY 1329 0.21 1.33 0.01 156 XMGenDplmaNmb 1285 0.98 1.28 0.93 157 NML_ADSP_CUSTOM_MED 1238 0.95 1.24 0.90 158 URI_TRY_3LD 1231 1.32 1.23 1.34 159 TR_XM_COVIDMETA3 1231 0.23 1.23 0.05 160 XMBody_78 1224 0.54 1.22 0.42 161 XM_UB95 1189 0.20 1.19 0.02 162 XM_H_PHPMailer 1162 0.81 1.16 0.74 163 BAYES_00 1151 13.10 1.15 15.25 164 DKIM_ADSP_NXDOMAIN 1140 1.18 1.14 1.19 165 REMOVE_BEFORE_LINK 1073 0.54 1.07 0.45 166 FORGED_GMAIL_RCVD 1056 0.58 1.05 0.49 167 XMSexyCombo_04 1026 0.59 1.02 0.51 168 XM_PDF 1024 3.74 1.02 4.23 169 XMSubNoVowel 1020 0.85 1.02 0.82 170 T_MONEY_PERCENT 1011 0.63 1.01 0.56 171 TR_LOTS_OF_MONEY2 1011 0.63 1.01 0.56 172 TR_MetaPhish_Combo_01 1003 0.95 1.00 0.94 173 XMPhish08 990 0.64 0.99 0.58 174 URIBL_ABUSE_SURBL 990 0.20 0.99 0.06 175 HELO_NODOT 988 1.43 0.99 1.51 176 XM_H_PHPOS_M 984 0.29 0.98 0.17 177 HELO_NO_DOMAIN 983 1.43 0.98 1.51 178 HTTPS_HTTP_MISMATCH 967 0.75 0.97 0.71 179 ADVANCE_FEE_4_NEW 961 0.15 0.96 0.00 180 HTML_TAG_BALANCE_BODY 948 0.63 0.95 0.58 181 XMReplyNow 944 0.23 0.94 0.10 182 RDNS_DYNAMIC 939 0.44 0.94 0.35 183 XM_HighProb1 937 0.15 0.94 0.00 184 URIBL_DBL_SPAM 913 0.15 0.91 0.02 185 XM_ProductURIs 913 0.86 0.91 0.85 186 RELAYCOUNTRY_CN 909 0.21 0.91 0.09 187 TR_Mismatch_TLD_02 888 0.20 0.89 0.08 188 RCVD_IN_IADB_LISTED 879 4.42 0.88 5.06 189 XMSubMetaSxObfu_03 861 0.87 0.86 0.87 190 FORM_FRAUD_5 859 0.13 0.86 0.00 191 BAYES_05 854 2.22 0.85 2.47 192 TVD_SPACE_RATIO 839 0.43 0.84 0.36 193 BODY_URI_ONLY 833 0.18 0.83 0.06 194 XM_OfRef7 805 0.26 0.80 0.17 195 XMPhish30 798 0.57 0.80 0.53 196 TooManyTo_002 796 1.93 0.79 2.13 197 XM_Nigeria_01 793 0.17 0.79 0.05 198 NO_FM_NAME_IP_HOSTN 789 0.12 0.79 0.00 199 RCVD_IN_IADB_SPF 776 3.85 0.77 4.40 200 RELAYCOUNTRY_BG 772 0.13 0.77 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 545540 97.83 97.09 97.96 2 HTML_MESSAGE 496957 90.00 94.26 89.23 3 RELAYCOUNTRY_US 456894 80.36 71.01 82.04 4 DKIM_SIGNED 426061 77.32 81.86 76.50 5 XM_DK_Pass 419227 75.86 79.11 75.28 6 XM_B_Unicode 398556 71.33 70.00 71.57 7 DKIM_VALID 395878 71.12 71.32 71.08 8 DKIM_VALID_AU 297286 53.59 54.72 53.38 9 BAYES_50 294705 50.65 38.05 52.92 10 XMListUnsubscribeExists 293806 54.69 65.45 52.76 11 XM_B_Unicode3 228770 40.23 35.51 41.08 12 HTML_FONT_LOW_CONTRAST 162912 28.47 24.14 29.25 13 T_TM2_M_HEADER_IN_MSG 159444 27.33 20.13 28.63 14 DKIM_VALID_EF 149321 28.98 41.03 26.81 15 LOC_TINY_FONT_1 140731 26.07 30.52 25.27 16 RCVD_IN_MSPIKE_WL 135899 21.54 5.64 24.40 17 FVGT_m_MULTI_ODD 126936 23.05 24.46 22.79 18 RCVD_IN_MSPIKE_H2 124070 22.92 26.47 22.28 19 XMSubLong 121033 21.52 20.34 21.73 20 MIME_HTML_ONLY 115712 23.77 40.39 20.78 21 T_KAM_HTML_FONT_INVALID 108900 20.83 27.93 19.55 22 BAYES_00 84930 13.10 1.15 15.25 23 XM_Body_Dirty_Words 82341 15.12 16.98 14.79 24 ALL_TRUSTED 78719 12.36 2.52 14.13 25 RCVD_IN_MSPIKE_H3 72539 11.51 3.10 13.03 26 XM_Multi_Part_URI 68759 12.75 14.98 12.35 27 XM_DK_Undo_02 67479 18.52 54.08 12.12 28 XM_B_Unsub 63283 11.78 14.07 11.36 29 RCVD_IN_MSPIKE_H4 59954 9.51 2.52 10.77 30 TR_XM_DK_Bayes 58748 9.04 0.63 10.55 31 TR_XM_DK_Bayes1 54974 8.44 0.47 9.87 32 LOTS_OF_MONEY 52805 10.21 14.28 9.48 33 TR_XM_DK_Bayes2 49275 7.56 0.40 8.85 34 LotsOfNums_01 48991 8.50 6.83 8.80 35 XM_Evil_Numbers_Gen 48654 8.73 8.66 8.74 36 TooManyTo_001 46670 7.83 4.78 8.38 37 XM_B_Phish_Phrases 43867 8.37 11.14 7.88 38 UNPARSEABLE_RELAY 42297 7.13 4.57 7.59 39 RCVD_IN_RP_SAFE 41870 6.46 0.57 7.52 40 BAYES_99 41016 12.25 39.39 7.36 41 HTML_IMAGE_RATIO_02 40343 7.87 11.32 7.24 42 XM_SendGrid 39435 6.53 3.44 7.08 43 RCVD_IN_RP_CERTIFIED 38611 5.94 0.43 6.93 44 XM_DKIMWhitelistDomains 38206 5.81 0.00 6.86 45 BAYES_60 35102 6.32 6.44 6.30 46 HTML_IMAGE_RATIO_04 33937 5.96 5.22 6.09 47 MIME_QP_LONG_LINE 32951 5.41 2.61 5.92 48 BAYES_999 32755 9.93 32.41 5.88 49 XM_H_Long_From01 31968 5.64 5.11 5.74 50 BOTNET_IPINHOSTNAME 30887 7.02 15.19 5.55 51 RELAYCOUNTRY_META 30632 9.07 28.94 5.50 52 DKIM_INVALID 30183 6.20 10.54 5.42 53 IN_ZIMBRA_NJ_WHITELIST 30147 4.59 0.05 5.41 54 RCVD_IN_IADB_LISTED 28179 4.42 0.88 5.06 55 MPART_ALT_DIFF 27483 5.16 6.38 4.93 56 BAYES_40 27330 4.48 2.13 4.91 57 BAYES_80 25355 4.92 6.95 4.55 58 XMStrtUSub 24858 4.30 3.40 4.46 59 RCVD_IN_IADB_SPF 24510 3.85 0.77 4.40 60 XMSexyCombo_05 24069 5.16 9.84 4.32 61 XM_PDF 23534 3.74 1.02 4.23 62 T_TooManySym_01 22441 3.75 2.19 4.03 63 TR_XM_DK_SendGrid 22432 3.66 1.61 4.03 64 RCVD_IN_IADB_SENDERID 21457 3.38 0.73 3.85 65 RCVD_IN_IADB_DK 21347 3.36 0.73 3.83 66 HTML_IMAGE_RATIO_06 21293 3.62 2.51 3.82 67 XMSubMetaSx_00 21161 4.09 5.70 3.80 68 BAYES_20 20984 3.43 1.53 3.77 69 T_REMOTE_IMAGE 20629 3.49 2.31 3.70 70 TR_XM_PhishingBody 19504 3.97 6.57 3.50 71 BOTNET 19396 6.70 24.59 3.48 72 XM_UncommonTLD01 19260 6.39 22.71 3.46 73 TM2_M_URI_OPT_OUT 18491 3.27 3.00 3.32 74 RCVD_IN_IADB_VOUCHED 17915 2.78 0.36 3.22 75 XMNumbers 17464 3.33 4.43 3.14 76 NO_DNS_FOR_FROM 16917 4.04 9.63 3.04 77 FROM_EXCESS_BASE64 16700 3.05 3.36 3.00 78 ANY_BOUNCE_MESSAGE 15692 2.50 0.74 2.82 79 BOUNCE_MESSAGE 15677 2.50 0.73 2.82 80 MIME_HTML_ONLY_MULTI 15380 2.60 1.73 2.76 81 MAILING_LIST_MULTI 13938 2.36 1.58 2.50 82 MIME_HTML_MOSTLY 13842 2.78 4.41 2.49 83 XM_B_COVIDMETA 13785 3.26 7.64 2.48 84 BAYES_05 13765 2.22 0.85 2.47 85 XM_B_Unsub2 13746 2.41 2.09 2.47 86 BAYES_95 13715 2.62 3.50 2.46 87 HTML_IMAGE_RATIO_08 13560 2.44 2.47 2.43 88 XM_OfRef6 13173 2.62 4.01 2.37 89 XM_CamelCaseFrm001 13143 3.79 11.75 2.36 90 T_XMDrugObfuBody_08 12796 2.71 5.02 2.30 91 HTML_MIME_NO_HTML_TAG 12793 2.57 4.06 2.30 92 TooManyTo_002 11871 1.93 0.79 2.13 93 XM_H_Trusted_IP 11345 1.73 0.00 2.04 94 XM_B_SpammyTLD 11085 2.43 4.84 1.99 95 T_TooManySym_02 11057 1.78 0.66 1.99 96 RCVD_IN_IADB_OPTIN 11019 1.73 0.32 1.98 97 XM_B_Phish66 10731 2.28 4.22 1.93 98 XM_DK_Undo_01 10223 2.06 3.28 1.84 99 UNTRUSTED_Relay 10161 4.57 19.84 1.82 100 TVD_RCVD_IP 9692 1.55 0.47 1.74 101 KHOP_HELO_FCRDNS 9687 1.84 2.42 1.74 102 XMMoneyMeta_00 9440 1.55 0.76 1.70 103 RCVD_IN_BL_SPAMCOP_NET 9388 2.96 10.06 1.69 104 XM_SPF_SoftFail 9244 2.12 4.68 1.66 105 SUBJ_ALL_CAPS 9077 1.76 2.47 1.63 106 T_XMDrugObfuBody_14 8995 1.71 2.21 1.62 107 RELAYCOUNTRY_CA 8952 2.61 8.21 1.61 108 XMDiploma_00 8918 1.72 2.38 1.60 109 URI_HEX 8863 1.65 1.99 1.59 110 TR_Symld_Words 8775 1.56 1.45 1.58 111 HELO_NODOT 8425 1.43 0.99 1.51 112 HELO_NO_DOMAIN 8424 1.43 0.98 1.51 113 HELO_MISC_IP 8067 1.27 0.27 1.45 114 CK_HELO_DYNAMIC_SPLIT_IP 8054 1.29 0.39 1.45 115 TooManyTo_003 8009 1.31 0.62 1.44 116 IN_HORDE_ADDRESS_BOOK 7786 1.20 0.13 1.40 117 INVALID_MSGID 7783 1.22 0.26 1.40 118 XM_ShortIntro_01 7707 1.24 0.42 1.38 119 URI_TRY_3LD 7457 1.32 1.23 1.34 120 XM_H_Long_From02 7281 1.20 0.61 1.31 121 XM_GoogleGroups 7193 1.17 0.49 1.29 122 TM2_M_VERY_LONG_WORD 6991 1.36 1.94 1.26 123 TO_MALFORMED 6789 1.04 0.05 1.22 124 FILL_THIS_FORM 6699 1.11 0.59 1.20 125 DKIM_ADSP_NXDOMAIN 6636 1.18 1.14 1.19 126 DKIM_ADSP_CUSTOM_MED 6623 1.22 1.38 1.19 127 XMStockSpam_06 6602 1.21 1.37 1.19 128 XMCapTrack 6561 1.10 0.65 1.18 129 RELAYCOUNTRY_GB 6237 1.15 1.33 1.12 130 XM_UB50 6199 1.91 6.35 1.11 131 TooManyTo_004 5972 0.99 0.54 1.07 132 XMHTML_After_End 5900 1.23 2.15 1.06 133 FILL_THIS_FORM_LONG 5874 0.96 0.43 1.05 134 USER_IN_DEF_DKIM_WL 5868 0.89 0.00 1.05 135 HTML_FONT_FACE_BAD 5677 0.96 0.60 1.02 136 TR_XM_COVIDMETA4 5469 1.61 5.12 0.98 137 TR_MSPIKEBAYES00 5391 0.82 0.00 0.97 138 XMSexyCombo_01 5278 1.11 2.03 0.95 139 XMBdyGiftCard01 5258 1.07 1.78 0.94 140 TR_MetaPhish_Combo_01 5214 0.95 1.00 0.94 141 XMBody_17 5201 1.91 7.33 0.93 142 XMGenDplmaNmb 5181 0.98 1.28 0.93 143 SpammyFromTLD_01 5164 2.32 10.09 0.93 144 XMGappySubj_01 5082 0.80 0.14 0.91 145 NML_ADSP_CUSTOM_MED 5028 0.95 1.24 0.90 146 TooManyTo_005 4968 0.83 0.46 0.89 147 FROM_GOV_DKIM_AU 4884 0.75 0.07 0.88 148 XMSubMetaSxObfu_03 4851 0.87 0.86 0.87 149 XM_ProductURIs 4747 0.86 0.91 0.85 150 XMSubNoVowel 4553 0.85 1.02 0.82 151 T_XMDrugObfuBody_00 4519 0.89 1.36 0.81 152 XMBrknScrpt_02 4278 0.92 1.78 0.77 153 T_FILL_THIS_FORM_SHORT 4250 0.91 1.69 0.76 154 XM_H_PHPMailer 4130 0.81 1.16 0.74 155 TM2_M_A_HREF_HREF 3983 0.70 0.62 0.72 156 HTTPS_HTTP_MISMATCH 3945 0.75 0.97 0.71 157 T_TooManySym_03 3805 0.61 0.22 0.68 158 XM_SPF_Unknown 3519 0.61 0.48 0.63 159 T_XMHurry_00 3416 0.84 2.07 0.61 160 RCVD_IN_MSPIKE_H5 3406 0.52 0.02 0.61 161 XMSubMetaI_00 3384 0.61 0.66 0.61 162 T_OBFU_PDF_ATTACH 3330 0.55 0.27 0.60 163 XMPhish08 3225 0.64 0.99 0.58 164 TR_XM_COVIDMETA5 3218 0.50 0.04 0.58 165 HTML_TAG_BALANCE_BODY 3206 0.63 0.95 0.58 166 TR_LOTS_OF_MONEY3 3129 0.91 2.82 0.56 167 T_MONEY_PERCENT 3128 0.63 1.01 0.56 168 TR_LOTS_OF_MONEY2 3128 0.63 1.01 0.56 169 XM_DIRTYINTL 3123 1.11 4.16 0.56 170 T_Symld_Words_02 3002 0.55 0.60 0.54 171 XMPhish30 2964 0.57 0.80 0.53 172 MISSING_HEADERS 2928 0.52 0.52 0.53 173 RCVD_IN_MSPIKE_BL 2905 1.87 9.34 0.52 174 TR_XM_COVIDMETA1 2882 0.95 3.32 0.52 175 XMSexyCombo_04 2859 0.59 1.02 0.51 176 RCVD_IN_SORBS_DUL 2805 0.48 0.33 0.50 177 XMNoVowels 2771 0.48 0.38 0.50 178 HTML_IMAGE_ONLY_20 2750 0.49 0.49 0.49 179 FORGED_GMAIL_RCVD 2729 0.58 1.05 0.49 180 PDS_OTHER_BAD_TLD 2699 1.51 7.21 0.48 181 URI_NOVOWEL 2569 0.47 0.52 0.46 182 XMPhish14 2518 0.49 0.69 0.45 183 TR_XM_PHPDW 2510 0.74 2.35 0.45 184 REMOVE_BEFORE_LINK 2497 0.54 1.07 0.45 185 NUMERIC_HTTP_ADDR 2444 0.45 0.50 0.44 186 TR_XM_FormFill2 2413 0.72 2.29 0.43 187 MPART_ALT_DIFF_COUNT 2401 0.46 0.61 0.43 188 RELAYCOUNTRY_AU 2400 0.45 0.54 0.43 189 HTML_IMAGE_ONLY_28 2399 0.43 0.40 0.43 190 TR_XM_PHPForged 2397 0.72 2.31 0.43 191 FROM_GOV_SPOOF 2388 0.41 0.33 0.43 192 XM_H_PHPOS 2365 0.71 2.29 0.42 193 XMBody_78 2331 0.54 1.22 0.42 194 RELAYCOUNTRY_DE 2219 0.68 2.24 0.40 195 RCVD_IN_MSPIKE_L3 2216 1.20 5.64 0.40 196 XMHTMLBadTable_001 2215 0.38 0.28 0.40 197 DIET_1 2201 0.64 1.98 0.40 198 XMSlimDrugH 2192 0.89 3.63 0.39 199 XM_B_COPY_HTML 2191 0.39 0.36 0.39 200 XM_B_REG_HTML 2184 0.36 0.16 0.39 ----------------------------------------------------------------------