Email: 673650 Autolearn: 0 AvgScore: -0.03 AvgScanTime: 2.10 sec Spam: 107936 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 3.80 sec Ham: 565714 Autolearn: 0 AvgScore: -2.39 AvgScanTime: 1.77 sec Time Spent Running SA: 392.35 hours Time Spent Processing Spam: 113.78 hours Time Spent Processing Ham: 278.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 104891 97.96 97.18 98.10 2 HTML_MESSAGE 100685 89.89 93.28 89.24 3 DKIM_SIGNED 80322 76.67 74.42 77.09 4 XM_DK_Pass 77150 74.94 71.48 75.60 5 XM_B_Unicode 74644 71.10 69.16 71.47 6 RELAYCOUNTRY_US 70822 80.06 65.61 82.81 7 XMListUnsubscribeExists 68620 54.68 63.57 52.98 8 DKIM_VALID 63822 68.96 59.13 70.83 9 XM_DK_Undo_02 55074 17.32 51.02 10.88 10 DKIM_VALID_AU 47752 52.01 44.24 53.50 11 MIME_HTML_ONLY 46734 24.58 43.30 21.00 12 BAYES_99 44641 12.20 41.36 6.64 13 BAYES_50 37913 50.54 35.13 53.48 14 BAYES_999 37015 9.86 34.29 5.20 15 RELAYCOUNTRY_META 36971 10.55 34.25 6.03 16 XM_B_Unicode3 34667 39.09 32.12 40.42 17 BOTNET 33342 7.81 30.89 3.40 18 DKIM_VALID_EF 33231 26.69 30.79 25.90 19 LOC_TINY_FONT_1 29418 25.39 27.26 25.04 20 T_KAM_HTML_FONT_INVALID 27522 20.50 25.50 19.55 21 UNTRUSTED_Relay 26831 5.75 24.86 2.11 22 HTML_FONT_LOW_CONTRAST 25197 27.48 23.34 28.27 23 XM_UncommonTLD01 23961 6.64 22.20 3.67 24 FVGT_m_MULTI_ODD 23590 22.68 21.86 22.84 25 T_TM2_M_HEADER_IN_MSG 23309 28.03 21.60 29.25 26 XMSubLong 22721 21.02 21.05 21.01 27 RCVD_IN_MSPIKE_H2 22430 21.92 20.78 22.14 28 BOTNET_IPINHOSTNAME 16794 6.85 15.56 5.19 29 XM_Body_Dirty_Words 16733 13.69 15.50 13.35 30 DKIM_INVALID 16500 7.71 15.29 6.26 31 LOTS_OF_MONEY 14985 10.02 13.88 9.29 32 XM_Multi_Part_URI 14311 12.51 13.26 12.37 33 RCVD_IN_BL_SPAMCOP_NET 12981 3.13 12.03 1.43 34 XM_B_Unsub 12776 11.32 11.84 11.22 35 NO_DNS_FOR_FROM 12703 5.12 11.77 3.85 36 HTML_IMAGE_RATIO_02 12133 8.33 11.24 7.78 37 XM_CamelCaseFrm001 12124 3.70 11.23 2.26 38 RCVD_IN_MSPIKE_BL 11548 2.28 10.70 0.67 39 XM_B_Phish_Phrases 11258 8.32 10.43 7.91 40 T_REMOTE_IMAGE 10985 4.53 10.18 3.45 41 URIBL_SBL_A 10705 1.83 9.92 0.29 42 XMSexyCombo_05 10366 4.82 9.60 3.90 43 TR_XM_MaxBayes 10233 1.59 9.48 0.08 44 BODY_URI_ONLY 9441 1.47 8.75 0.08 45 RCVD_IN_RP_RNBL 9348 1.49 8.66 0.12 46 XM_Evil_Numbers_Gen 9087 9.30 8.42 9.47 47 XM_UB50 8684 2.44 8.05 1.37 48 XMHTML_After_End 8382 2.03 7.77 0.93 49 RELAYCOUNTRY_DE 8319 1.65 7.71 0.50 50 BAYES_80 8205 4.58 7.60 4.01 51 XM_UB99 8078 1.21 7.48 0.01 52 RELAYCOUNTRY_CA 8060 2.57 7.47 1.64 53 LotsOfNums_01 8056 8.47 7.46 8.66 54 RCVD_IN_MSPIKE_WL 7342 19.52 6.80 21.95 55 XM_SPF_SoftFail 7149 2.57 6.62 1.80 56 BOTNET_NORDNS 7070 1.08 6.55 0.03 57 RCVD_IN_MSPIKE_L3 7050 1.43 6.53 0.46 58 TR_XM_COVIDMETA4 7002 1.86 6.49 0.98 59 XM_B_COVIDMETA 6929 3.02 6.42 2.37 60 XMSubMetaSx_00 6635 3.72 6.15 3.26 61 XM_UB999 6483 0.97 6.01 0.00 62 BAYES_60 6254 6.26 5.79 6.34 63 TR_XM_PhishingBody 6073 4.03 5.63 3.73 64 XM_H_Long_From01 5792 5.62 5.37 5.67 65 T_XMDrugObfuBody_08 5746 2.39 5.32 1.83 66 HTML_IMAGE_RATIO_04 5276 5.01 4.89 5.03 67 KHOP_HELO_FCRDNS 5269 2.37 4.88 1.89 68 XMBody_17 5249 1.41 4.86 0.75 69 XMStrtUSub 5243 4.38 4.86 4.29 70 MPART_ALT_DIFF 5232 4.84 4.85 4.83 71 RELAYCOUNTRY_FR 5214 1.15 4.83 0.45 72 TooManyTo_001 4979 7.73 4.61 8.32 73 SpammyFromTLD_01 4971 1.68 4.61 1.13 74 UNPARSEABLE_RELAY 4958 6.93 4.59 7.38 75 XMNumbers 4949 3.40 4.59 3.17 76 BAYES_95 4856 2.73 4.50 2.39 77 TR_XM_INV_DKIM 4847 0.87 4.49 0.18 78 RCVD_IN_MSPIKE_H3 4847 12.16 4.49 13.63 79 HTML_MIME_NO_HTML_TAG 4498 2.47 4.17 2.14 80 XM_B_SpammyTLD 4404 2.29 4.08 1.95 81 XM_JunkDunk 4300 0.64 3.98 0.00 82 XM_DIRTYINTL 4219 1.12 3.91 0.59 83 XM_URI_RBL 3861 0.77 3.58 0.23 84 RCVD_IN_PSBL 3814 0.64 3.53 0.09 85 FROM_EXCESS_BASE64 3803 3.22 3.52 3.16 86 MIME_HTML_MOSTLY 3796 2.62 3.52 2.45 87 XM_SendGrid 3725 6.26 3.45 6.80 88 TR_XM_MaxSPIKE 3676 0.56 3.41 0.02 89 XM_UB80 3648 0.58 3.38 0.04 90 SpammyFromTLD_02 3645 0.85 3.38 0.37 91 XM_OfRef6 3626 1.64 3.36 1.32 92 XM_B_Phish66 3598 2.20 3.33 1.98 93 SUBJ_ALL_CAPS 3536 1.83 3.28 1.55 94 MIME_QP_LONG_LINE 3535 5.47 3.28 5.89 95 XM_B_Unsub2 3384 2.77 3.14 2.70 96 DKIM_ADSP_CUSTOM_MED 3361 1.45 3.11 1.14 97 TM2_M_URI_OPT_OUT 3261 3.36 3.02 3.43 98 MISSING_HEADERS 3194 1.16 2.96 0.81 99 NML_ADSP_CUSTOM_MED 3158 1.18 2.93 0.84 100 DATE_IN_PAST_03_06 3151 0.60 2.92 0.16 101 FROM_SUSPICIOUS_NTLD 3096 0.53 2.87 0.09 102 FORGED_GMAIL_RCVD 3074 0.86 2.85 0.48 103 FROM_SUSPICIOUS_NTLD_FP 3006 0.51 2.78 0.08 104 HTML_IMAGE_RATIO_06 2986 3.83 2.77 4.04 105 DKIM_ADSP_NXDOMAIN 2950 0.68 2.73 0.29 106 ALL_TRUSTED 2925 11.20 2.71 12.82 107 RCVD_IN_MSPIKE_L5 2924 0.52 2.71 0.10 108 TR_LOTS_OF_MONEY3 2857 0.91 2.65 0.58 109 T_XMHurry_00 2776 1.01 2.57 0.71 110 XM_UB60 2669 0.51 2.47 0.14 111 LongTLD 2616 0.57 2.42 0.22 112 BAYES_40 2564 4.67 2.38 5.11 113 HDRS_MISSP 2555 0.43 2.37 0.06 114 TR_XM_COVIDMETA1 2505 0.95 2.32 0.69 115 RCVD_IN_MSPIKE_H4 2440 6.85 2.26 7.72 116 TR_XM_PHPDW 2430 0.79 2.25 0.51 117 TR_XM_PHPForged 2394 0.76 2.22 0.49 118 HTML_IMAGE_RATIO_08 2385 2.52 2.21 2.58 119 TR_XM_FormFill2 2373 0.76 2.20 0.49 120 XM_H_PHPOS 2369 0.75 2.19 0.48 121 XM_UB95 2353 0.37 2.18 0.03 122 URI_HEX 2231 1.58 2.07 1.49 123 XM_ShortIntro_01 2137 0.93 1.98 0.73 124 XMDiploma_00 2100 1.69 1.95 1.65 125 TR_Mismatch_TLD_01 2059 0.50 1.91 0.23 126 RELAYCOUNTRY_IN 2041 0.42 1.89 0.14 127 T_TooManySym_01 2036 4.02 1.89 4.43 128 DATE_IN_PAST_06_12 2007 0.48 1.86 0.22 129 BODY_SINGLE_URI 2000 0.31 1.85 0.01 130 PDS_OTHER_BAD_TLD 1992 0.63 1.85 0.40 131 T_XMDrugObfuBody_14 1984 1.40 1.84 1.32 132 HTML_SHORT_LINK_IMG_1 1981 0.35 1.84 0.07 133 NO_FM_NAME_IP_HOSTN 1966 0.29 1.82 0.00 134 XMSexyCombo_01 1952 0.72 1.81 0.51 135 HTML_IMAGE_ONLY_04 1949 0.34 1.81 0.06 136 TR_Mismatch_TLD_02 1937 0.38 1.79 0.11 137 HDRS_LCASE_IMGONLY 1916 0.32 1.78 0.05 138 XMSlimDrugH 1911 0.70 1.77 0.49 139 MIME_HEADER_CTYPE_ONLY 1898 0.46 1.76 0.21 140 XM_Lotto 1894 0.34 1.75 0.07 141 MIME_HTML_ONLY_MULTI 1856 2.71 1.72 2.90 142 XM_DK_Undo_01 1855 1.81 1.72 1.83 143 HTML_SHORT_CENTER 1824 0.27 1.69 0.00 144 TR_XM_RelayPhish 1715 0.37 1.59 0.14 145 T_XMDrugObfuBody_00 1690 0.93 1.57 0.81 146 URI_TRY_3LD 1685 1.31 1.56 1.26 147 XMBrknScrpt_02 1684 1.06 1.56 0.96 148 T_PDS_OTHER_BAD_TLD 1652 0.32 1.53 0.09 149 BAYES_20 1641 3.43 1.52 3.79 150 HK_LOTTO 1625 0.24 1.51 0.00 151 HELO_NO_DOMAIN 1625 1.79 1.51 1.84 152 HELO_NODOT 1625 1.79 1.51 1.85 153 XMSubject_48 1619 0.26 1.50 0.02 154 RELAYCOUNTRY_GB 1612 1.41 1.49 1.39 155 TM2_M_VERY_LONG_WORD 1570 1.32 1.45 1.30 156 XMMoneyMeta_00 1569 0.93 1.45 0.83 157 MAILING_LIST_MULTI 1566 2.26 1.45 2.42 158 RCVD_IN_MSPIKE_L4 1502 0.30 1.39 0.10 159 XMSubNoVowel 1464 1.00 1.36 0.93 160 TR_MetaPhish_Combo_01 1335 0.94 1.24 0.88 161 XMGenDplmaNmb 1325 0.98 1.23 0.94 162 XMSubEmpty 1322 0.41 1.22 0.26 163 XMBody_78 1321 0.57 1.22 0.44 164 HK_RANDOM_REPLYTO 1308 0.39 1.21 0.23 165 SCRIPT_GIBBERISH 1302 0.20 1.21 0.00 166 TR_Symld_Words 1289 1.40 1.19 1.44 167 RELAYCOUNTRY_NL 1287 0.37 1.19 0.21 168 XM_Body_Obfu01 1282 0.53 1.19 0.40 169 XM_OfRef7 1259 0.38 1.17 0.23 170 TR_XM_DK_SendGrid 1228 3.25 1.14 3.66 171 XMSubMetaSxObfu_03 1227 0.64 1.14 0.54 172 T_FILL_THIS_FORM_SHORT 1204 0.90 1.12 0.86 173 XM_HighProb1 1194 0.18 1.11 0.01 174 XMStockSpam_06 1189 1.16 1.10 1.17 175 XMSexyCombo_04 1150 0.24 1.07 0.08 176 REPLYTO_WITHOUT_TO_CC 1131 0.49 1.05 0.38 177 RCVD_IN_IADB_LISTED 1109 4.32 1.03 4.95 178 DIET_1 1072 0.45 0.99 0.35 179 XMGppyBdWords 1071 0.30 0.99 0.17 180 URI_WP_DIRINDEX 1064 0.18 0.99 0.02 181 T_MONEY_PERCENT 1061 0.55 0.98 0.46 182 TR_LOTS_OF_MONEY2 1061 0.55 0.98 0.46 183 URI_PHP_REDIR 1058 0.16 0.98 0.01 184 XM_SPF_Unknown 1057 0.71 0.98 0.66 185 XM_H_MailChimp 1051 0.35 0.97 0.23 186 XM_H_PHPMailer 1050 0.58 0.97 0.51 187 RELAYCOUNTRY_ID 1046 0.16 0.97 0.01 188 T_Symld_Words_02 1034 0.65 0.96 0.59 189 URIBL_BLACK 1028 0.17 0.95 0.03 190 RCVD_IN_IADB_SPF 1019 3.80 0.94 4.34 191 FROM_MISSP_REPLYTO 984 0.15 0.91 0.01 192 RCVD_IN_IADB_DK 983 3.33 0.91 3.79 193 RCVD_IN_IADB_SENDERID 982 3.36 0.91 3.82 194 XMWghtMeta_00 975 0.21 0.90 0.07 195 TR_LOTS_OF_MONEY1 972 0.28 0.90 0.16 196 BAYES_00 969 13.40 0.90 15.78 197 T_HTML_TAG_BALANCE_CENTER 961 0.33 0.89 0.22 198 TR_XM_COVIDMETA3 952 0.17 0.88 0.03 199 XM_H_Undi_Recip 940 0.40 0.87 0.31 200 XMPhish08 924 0.57 0.86 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 554991 97.96 97.18 98.10 2 HTML_MESSAGE 504830 89.89 93.28 89.24 3 RELAYCOUNTRY_US 468491 80.06 65.61 82.81 4 DKIM_SIGNED 436135 76.67 74.42 77.09 5 XM_DK_Pass 427681 74.94 71.48 75.60 6 XM_B_Unicode 404294 71.10 69.16 71.47 7 DKIM_VALID 400701 68.96 59.13 70.83 8 DKIM_VALID_AU 302633 52.01 44.24 53.50 9 BAYES_50 302543 50.54 35.13 53.48 10 XMListUnsubscribeExists 299742 54.68 63.57 52.98 11 XM_B_Unicode3 228682 39.09 32.12 40.42 12 T_TM2_M_HEADER_IN_MSG 165498 28.03 21.60 29.25 13 HTML_FONT_LOW_CONTRAST 159949 27.48 23.34 28.27 14 DKIM_VALID_EF 146538 26.69 30.79 25.90 15 LOC_TINY_FONT_1 141627 25.39 27.26 25.04 16 FVGT_m_MULTI_ODD 129205 22.68 21.86 22.84 17 RCVD_IN_MSPIKE_H2 125262 21.92 20.78 22.14 18 RCVD_IN_MSPIKE_WL 124175 19.52 6.80 21.95 19 XMSubLong 118877 21.02 21.05 21.01 20 MIME_HTML_ONLY 118819 24.58 43.30 21.00 21 T_KAM_HTML_FONT_INVALID 110597 20.50 25.50 19.55 22 BAYES_00 89297 13.40 0.90 15.78 23 RCVD_IN_MSPIKE_H3 77083 12.16 4.49 13.63 24 XM_Body_Dirty_Words 75520 13.69 15.50 13.35 25 ALL_TRUSTED 72522 11.20 2.71 12.82 26 XM_Multi_Part_URI 69979 12.51 13.26 12.37 27 XM_B_Unsub 63469 11.32 11.84 11.22 28 XM_DK_Undo_02 61575 17.32 51.02 10.88 29 TR_XM_DK_Bayes 58867 8.81 0.45 10.41 30 TR_XM_DK_Bayes1 54425 8.11 0.19 9.62 31 XM_Evil_Numbers_Gen 53552 9.30 8.42 9.47 32 LOTS_OF_MONEY 52547 10.02 13.88 9.29 33 LotsOfNums_01 48969 8.47 7.46 8.66 34 TR_XM_DK_Bayes2 48735 7.26 0.17 8.61 35 TooManyTo_001 47069 7.73 4.61 8.32 36 XM_B_Phish_Phrases 44756 8.32 10.43 7.91 37 HTML_IMAGE_RATIO_02 44008 8.33 11.24 7.78 38 RCVD_IN_RP_SAFE 43964 6.61 0.55 7.77 39 RCVD_IN_MSPIKE_H4 43675 6.85 2.26 7.72 40 UNPARSEABLE_RELAY 41759 6.93 4.59 7.38 41 RCVD_IN_RP_CERTIFIED 40287 6.04 0.39 7.12 42 XM_SendGrid 38471 6.26 3.45 6.80 43 BAYES_99 37560 12.20 41.36 6.64 44 XM_DKIMWhitelistDomains 36907 5.48 0.00 6.52 45 BAYES_60 35886 6.26 5.79 6.34 46 DKIM_INVALID 35434 7.71 15.29 6.26 47 IN_ZIMBRA_NJ_WHITELIST 34697 5.16 0.04 6.13 48 RELAYCOUNTRY_META 34106 10.55 34.25 6.03 49 MIME_QP_LONG_LINE 33328 5.47 3.28 5.89 50 XM_H_Long_From01 32100 5.62 5.37 5.67 51 BAYES_999 29412 9.86 34.29 5.20 52 BOTNET_IPINHOSTNAME 29334 6.85 15.56 5.19 53 BAYES_40 28918 4.67 2.38 5.11 54 HTML_IMAGE_RATIO_04 28470 5.01 4.89 5.03 55 RCVD_IN_IADB_LISTED 27980 4.32 1.03 4.95 56 MPART_ALT_DIFF 27341 4.84 4.85 4.83 57 T_TooManySym_01 25042 4.02 1.89 4.43 58 RCVD_IN_IADB_SPF 24559 3.80 0.94 4.34 59 XMStrtUSub 24266 4.38 4.86 4.29 60 XM_PDF 23204 3.55 0.68 4.10 61 HTML_IMAGE_RATIO_06 22848 3.83 2.77 4.04 62 BAYES_80 22660 4.58 7.60 4.01 63 XMSexyCombo_05 22090 4.82 9.60 3.90 64 NO_DNS_FOR_FROM 21797 5.12 11.77 3.85 65 RCVD_IN_IADB_SENDERID 21633 3.36 0.91 3.82 66 BAYES_20 21467 3.43 1.52 3.79 67 RCVD_IN_IADB_DK 21457 3.33 0.91 3.79 68 TR_XM_PhishingBody 21081 4.03 5.63 3.73 69 XM_UncommonTLD01 20788 6.64 22.20 3.67 70 TR_XM_DK_SendGrid 20677 3.25 1.14 3.66 71 T_REMOTE_IMAGE 19515 4.53 10.18 3.45 72 TM2_M_URI_OPT_OUT 19392 3.36 3.02 3.43 73 BOTNET 19253 7.81 30.89 3.40 74 XMSubMetaSx_00 18435 3.72 6.15 3.26 75 XMNumbers 17941 3.40 4.59 3.17 76 FROM_EXCESS_BASE64 17860 3.22 3.52 3.16 77 RCVD_IN_IADB_VOUCHED 17527 2.64 0.25 3.10 78 MIME_HTML_ONLY_MULTI 16389 2.71 1.72 2.90 79 ANY_BOUNCE_MESSAGE 16001 2.46 0.54 2.83 80 BOUNCE_MESSAGE 15997 2.46 0.54 2.83 81 XM_B_Unsub2 15286 2.77 3.14 2.70 82 HTML_IMAGE_RATIO_08 14610 2.52 2.21 2.58 83 XM_H_Trusted_IP 14134 2.10 0.00 2.50 84 MIME_HTML_MOSTLY 13872 2.62 3.52 2.45 85 BAYES_05 13792 2.17 0.79 2.44 86 MAILING_LIST_MULTI 13670 2.26 1.45 2.42 87 BAYES_95 13538 2.73 4.50 2.39 88 XM_B_COVIDMETA 13402 3.02 6.42 2.37 89 XM_CamelCaseFrm001 12801 3.70 11.23 2.26 90 HTML_MIME_NO_HTML_TAG 12125 2.47 4.17 2.14 91 UNTRUSTED_Relay 11932 5.75 24.86 2.11 92 TooManyTo_002 11749 1.85 0.66 2.08 93 XM_B_Phish66 11223 2.20 3.33 1.98 94 XM_B_SpammyTLD 11032 2.29 4.08 1.95 95 RCVD_IN_IADB_OPTIN 10800 1.64 0.24 1.91 96 KHOP_HELO_FCRDNS 10674 2.37 4.88 1.89 97 T_TooManySym_02 10506 1.66 0.61 1.86 98 HELO_NODOT 10440 1.79 1.51 1.85 99 HELO_NO_DOMAIN 10437 1.79 1.51 1.84 100 XM_DK_Undo_01 10369 1.81 1.72 1.83 101 T_XMDrugObfuBody_08 10338 2.39 5.32 1.83 102 XM_SPF_SoftFail 10155 2.57 6.62 1.80 103 TVD_RCVD_IP 9748 1.49 0.26 1.72 104 XMDiploma_00 9316 1.69 1.95 1.65 105 RELAYCOUNTRY_CA 9280 2.57 7.47 1.64 106 SUBJ_ALL_CAPS 8782 1.83 3.28 1.55 107 URI_HEX 8446 1.58 2.07 1.49 108 TooManyTo_003 8155 1.29 0.48 1.44 109 TR_Symld_Words 8140 1.40 1.19 1.44 110 RCVD_IN_BL_SPAMCOP_NET 8096 3.13 12.03 1.43 111 IN_HORDE_ADDRESS_BOOK 7957 1.19 0.06 1.41 112 RELAYCOUNTRY_GB 7862 1.41 1.49 1.39 113 INVALID_MSGID 7728 1.18 0.23 1.37 114 XM_UB50 7723 2.44 8.05 1.37 115 T_XMDrugObfuBody_14 7478 1.40 1.84 1.32 116 XM_OfRef6 7446 1.64 3.36 1.32 117 XM_H_Long_From02 7362 1.20 0.68 1.30 118 TM2_M_VERY_LONG_WORD 7347 1.32 1.45 1.30 119 URI_TRY_3LD 7111 1.31 1.56 1.26 120 XM_GoogleGroups 7027 1.12 0.46 1.24 121 TO_MALFORMED 6820 1.02 0.08 1.21 122 XMCapTrack 6723 1.06 0.40 1.19 123 XMStockSpam_06 6593 1.16 1.10 1.17 124 TR_MSPIKEBAYES00 6524 0.97 0.00 1.15 125 DKIM_ADSP_CUSTOM_MED 6429 1.45 3.11 1.14 126 SpammyFromTLD_01 6374 1.68 4.61 1.13 127 TooManyTo_004 6317 1.00 0.39 1.12 128 USER_IN_DEF_DKIM_WL 5757 0.86 0.00 1.02 129 XM_ProductURIs 5539 0.95 0.77 0.98 130 TR_XM_COVIDMETA4 5534 1.86 6.49 0.98 131 XMBrknScrpt_02 5451 1.06 1.56 0.96 132 XMBdyGiftCard01 5418 0.92 0.71 0.96 133 XMGenDplmaNmb 5307 0.98 1.23 0.94 134 XMHTML_After_End 5281 2.03 7.77 0.93 135 XMSubNoVowel 5259 1.00 1.36 0.93 136 XMSubMetaI_00 5237 0.88 0.66 0.93 137 TooManyTo_005 5177 0.82 0.32 0.92 138 HTML_FONT_FACE_BAD 5167 0.84 0.48 0.91 139 XMGappySubj_01 5038 0.77 0.14 0.89 140 TR_MetaPhish_Combo_01 4980 0.94 1.24 0.88 141 T_FILL_THIS_FORM_SHORT 4868 0.90 1.12 0.86 142 XMNoVowels 4836 0.79 0.48 0.85 143 NML_ADSP_CUSTOM_MED 4779 1.18 2.93 0.84 144 XMMoneyMeta_00 4674 0.93 1.45 0.83 145 MISSING_HEADERS 4607 1.16 2.96 0.81 146 T_XMDrugObfuBody_00 4575 0.93 1.57 0.81 147 HELO_MISC_IP 4504 0.69 0.10 0.80 148 CK_HELO_DYNAMIC_SPLIT_IP 4500 0.68 0.08 0.80 149 HTTPS_HTTP_MISMATCH 4480 0.79 0.77 0.79 150 XMPhish30 4415 0.78 0.80 0.78 151 XMBody_17 4226 1.41 4.86 0.75 152 XM_ShortIntro_01 4126 0.93 1.98 0.73 153 T_XMHurry_00 4035 1.01 2.57 0.71 154 TR_XM_COVIDMETA1 3918 0.95 2.32 0.69 155 RCVD_IN_MSPIKE_BL 3783 2.28 10.70 0.67 156 XM_SPF_Unknown 3723 0.71 0.98 0.66 157 FROM_GOV_DKIM_AU 3520 0.54 0.08 0.62 158 T_OBFU_PDF_ATTACH 3468 0.53 0.11 0.61 159 RCVD_IN_MSPIKE_H5 3417 0.52 0.05 0.60 160 XMHTMLBadTable_001 3405 0.55 0.28 0.60 161 T_Symld_Words_02 3345 0.65 0.96 0.59 162 XM_DIRTYINTL 3322 1.12 3.91 0.59 163 T_TooManySym_03 3309 0.53 0.27 0.58 164 TR_LOTS_OF_MONEY3 3259 0.91 2.65 0.58 165 XMSubMetaSxObfu_03 3077 0.64 1.14 0.54 166 FILL_THIS_FORM 2981 0.55 0.65 0.53 167 XMSexyCombo_01 2911 0.72 1.81 0.51 168 XMRcvdHeader_15 2890 0.43 0.00 0.51 169 XMPhish08 2888 0.57 0.86 0.51 170 RCVD_IN_SORBS_DUL 2879 0.47 0.25 0.51 171 TR_XM_PHPDW 2874 0.79 2.25 0.51 172 XM_H_PHPMailer 2872 0.58 0.97 0.51 173 RELAYCOUNTRY_DE 2816 1.65 7.71 0.50 174 XMSlimDrugH 2776 0.70 1.77 0.49 175 TR_XM_FormFill2 2759 0.76 2.20 0.49 176 TR_XM_PHPForged 2757 0.76 2.22 0.49 177 HTML_TAG_BALANCE_BODY 2741 0.48 0.47 0.48 178 XM_H_PHPOS 2715 0.75 2.19 0.48 179 FORGED_GMAIL_RCVD 2690 0.86 2.85 0.48 180 TR_LOTS_OF_MONEY2 2621 0.55 0.98 0.46 181 T_MONEY_PERCENT 2621 0.55 0.98 0.46 182 RELAYCOUNTRY_AU 2610 0.49 0.64 0.46 183 RCVD_IN_MSPIKE_L3 2609 1.43 6.53 0.46 184 FROM_GOV_SPOOF 2600 0.43 0.26 0.46 185 URI_NOVOWEL 2597 0.46 0.46 0.46 186 XMDateMe_00 2571 0.44 0.36 0.45 187 RELAYCOUNTRY_FR 2547 1.15 4.83 0.45 188 HTML_IMAGE_ONLY_20 2534 0.44 0.38 0.45 189 XMPhish14 2518 0.48 0.69 0.45 190 PLING_QUERY 2511 0.45 0.47 0.44 191 XMBody_78 2493 0.57 1.22 0.44 192 XMSUPPORT 2470 0.37 0.00 0.44 193 SUBJ_DOLLARS 2462 0.45 0.50 0.44 194 TM2_M_BODY_EMPTY 2401 0.37 0.08 0.42 195 XM_H_SpoofStaff4 2317 0.38 0.22 0.41 196 HTML_IMAGE_ONLY_32 2285 0.36 0.15 0.40 197 XM_Body_Obfu01 2273 0.53 1.19 0.40 198 TM2_M_A_HREF_HREF 2262 0.44 0.63 0.40 199 PDS_OTHER_BAD_TLD 2238 0.63 1.85 0.40 200 XMBody_95 2225 0.34 0.07 0.39 ----------------------------------------------------------------------