Email: 711022 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 1.96 sec Spam: 100700 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.69 sec Ham: 610322 Autolearn: 0 AvgScore: -3.25 AvgScanTime: 1.68 sec Time Spent Running SA: 388.00 hours Time Spent Processing Spam: 103.17 hours Time Spent Processing Ham: 284.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97943 98.08 97.26 98.21 2 HTML_MESSAGE 94808 90.81 94.15 90.26 3 DKIM_SIGNED 78354 71.10 77.81 69.99 4 XM_DK_Pass 75541 69.67 75.02 68.79 5 XM_B_Unicode 73544 72.95 73.03 72.93 6 RELAYCOUNTRY_US 70240 81.32 69.75 83.22 7 XMListUnsubscribeExists 68537 50.72 68.06 47.86 8 DKIM_VALID 63801 64.40 63.36 64.57 9 XM_DK_Undo_02 53554 16.10 53.18 9.98 10 DKIM_VALID_AU 47824 48.42 47.49 48.57 11 MIME_HTML_ONLY 43150 25.96 42.85 23.18 12 BAYES_99 40223 10.86 39.94 6.07 13 BAYES_50 39014 47.51 38.74 48.96 14 XM_B_Unicode3 34819 41.73 34.58 42.91 15 DKIM_VALID_EF 34073 25.73 33.84 24.40 16 BAYES_999 33541 8.75 33.31 4.69 17 RELAYCOUNTRY_META 32614 9.31 32.39 5.50 18 BOTNET 30709 6.86 30.50 2.96 19 LOC_TINY_FONT_1 29895 23.60 29.69 22.60 20 T_KAM_HTML_FONT_INVALID 26166 18.72 25.98 17.52 21 HTML_FONT_LOW_CONTRAST 25320 25.09 25.14 25.08 22 XM_UncommonTLD01 24269 6.24 24.10 3.30 23 XMSubLong 23249 20.82 23.09 20.45 24 FVGT_m_MULTI_ODD 22815 21.25 22.66 21.02 25 RCVD_IN_MSPIKE_H2 22631 21.36 22.47 21.18 26 UNTRUSTED_Relay 21795 4.74 21.64 1.95 27 T_TM2_M_HEADER_IN_MSG 19576 25.21 19.44 26.16 28 XM_Body_Dirty_Words 17884 13.16 17.76 12.40 29 BOTNET_IPINHOSTNAME 17514 6.41 17.39 4.60 30 XM_Multi_Part_URI 15636 11.91 15.53 11.32 31 DKIM_INVALID 14553 6.70 14.45 5.42 32 LOTS_OF_MONEY 14324 9.23 14.22 8.41 33 XM_CamelCaseFrm001 12179 3.56 12.09 2.15 34 XM_B_Phish_Phrases 12123 7.80 12.04 7.10 35 NO_DNS_FOR_FROM 12116 4.27 12.03 2.99 36 RCVD_IN_RP_RNBL 11948 1.81 11.86 0.15 37 HTML_IMAGE_RATIO_02 11709 7.81 11.63 7.18 38 RCVD_IN_BL_SPAMCOP_NET 11004 2.69 10.93 1.33 39 RCVD_IN_MSPIKE_BL 10997 2.04 10.92 0.58 40 URIBL_SBL_A 10859 1.79 10.78 0.31 41 XM_B_Unsub 10826 10.09 10.75 9.98 42 XMSexyCombo_05 10660 4.90 10.59 3.97 43 XM_Evil_Numbers_Gen 10613 9.68 10.54 9.54 44 TR_XM_MaxBayes 10548 1.54 10.47 0.07 45 XM_UB50 8252 2.18 8.19 1.18 46 LotsOfNums_01 7928 7.81 7.87 7.80 47 RELAYCOUNTRY_CA 7867 2.39 7.81 1.50 48 XM_B_COVIDMETA 7723 2.68 7.67 1.86 49 T_REMOTE_IMAGE 7180 4.10 7.13 3.60 50 RCVD_IN_MSPIKE_WL 6865 18.03 6.82 19.87 51 TR_XM_PhishingBody 6527 3.72 6.48 3.26 52 BOTNET_NORDNS 6453 0.93 6.41 0.02 53 XM_H_Long_From01 6448 5.63 6.40 5.51 54 RCVD_IN_MSPIKE_L3 6395 1.23 6.35 0.39 55 TR_XM_COVIDMETA4 6354 1.66 6.31 0.89 56 BAYES_80 6299 4.07 6.26 3.70 57 XMSubMetaSx_00 6268 3.95 6.22 3.57 58 XM_UB99 6070 0.86 6.03 0.01 59 BAYES_60 5691 5.73 5.65 5.75 60 XMHTML_After_End 5669 1.51 5.63 0.83 61 BODY_URI_ONLY 5473 0.82 5.43 0.06 62 RELAYCOUNTRY_FR 5472 1.08 5.43 0.36 63 T_XMDrugObfuBody_08 5250 2.51 5.21 2.06 64 SpammyFromTLD_01 5250 1.53 5.21 0.92 65 XM_SPF_SoftFail 5181 2.15 5.14 1.65 66 XMNumbers 5086 3.32 5.05 3.03 67 XM_OfRef6 5078 1.61 5.04 1.04 68 XM_DIRTYINTL 4963 1.26 4.93 0.66 69 HTML_IMAGE_RATIO_04 4957 12.23 4.92 13.44 70 XM_UB999 4956 0.70 4.92 0.01 71 TooManyTo_001 4845 7.25 4.81 7.65 72 RCVD_IN_MSPIKE_H3 4781 11.21 4.75 12.27 73 XMBody_17 4709 1.32 4.68 0.77 74 MPART_ALT_DIFF 4694 7.75 4.66 8.26 75 MIME_HTML_MOSTLY 4573 2.83 4.54 2.55 76 T_PDS_OTHER_BAD_TLD 4519 1.06 4.49 0.50 77 RELAYCOUNTRY_DE 4379 1.05 4.35 0.50 78 XM_B_Phish66 4372 2.23 4.34 1.88 79 XM_B_SpammyTLD 4269 2.06 4.24 1.70 80 UNPARSEABLE_RELAY 4195 6.19 4.17 6.52 81 RCVD_IN_PSBL 4061 0.63 4.03 0.07 82 FROM_EXCESS_BASE64 4033 3.06 4.00 2.90 83 TR_XM_INV_DKIM 3987 0.69 3.96 0.15 84 HTML_MIME_NO_HTML_TAG 3763 2.53 3.74 2.33 85 XMStrtUSub 3514 7.73 3.49 8.43 86 BAYES_95 3513 2.44 3.49 2.26 87 XM_URI_RBL 3496 0.67 3.47 0.21 88 HTML_IMAGE_RATIO_06 3398 4.28 3.37 4.43 89 TR_LOTS_OF_MONEY3 3333 0.90 3.31 0.50 90 TM2_M_URI_OPT_OUT 3285 3.51 3.26 3.55 91 SpammyFromTLD_02 3214 0.74 3.19 0.33 92 TR_XM_MaxSPIKE 3188 0.47 3.17 0.02 93 MIME_QP_LONG_LINE 3182 5.04 3.16 5.35 94 KHOP_HELO_FCRDNS 3123 1.90 3.10 1.70 95 TR_Mismatch_TLD_01 3009 0.58 2.99 0.18 96 FROM_SUSPICIOUS_NTLD 3004 0.49 2.98 0.08 97 TR_XM_PHPForged 2978 0.83 2.96 0.48 98 XM_SendGrid 2968 5.56 2.95 5.99 99 DATE_IN_PAST_03_06 2901 0.48 2.88 0.09 100 FROM_SUSPICIOUS_NTLD_FP 2893 0.47 2.87 0.07 101 TR_XM_PHPDW 2855 0.84 2.84 0.51 102 TR_XM_COVIDMETA1 2838 0.86 2.82 0.54 103 RCVD_IN_MSPIKE_L5 2810 0.49 2.79 0.11 104 DATE_IN_PAST_06_12 2754 0.53 2.73 0.16 105 XMDiploma_00 2751 1.69 2.73 1.52 106 TR_XM_FormFill2 2707 0.79 2.69 0.48 107 XM_H_PHPOS 2697 0.79 2.68 0.48 108 SCRIPT_GIBBERISH 2695 0.38 2.68 0.00 109 XMSexyCombo_01 2623 1.24 2.60 1.02 110 XM_UB80 2604 0.40 2.59 0.04 111 XM_JunkDunk 2486 0.35 2.47 0.00 112 XM_UB60 2453 0.45 2.44 0.13 113 T_XMDrugObfuBody_14 2417 1.48 2.40 1.32 114 XM_B_Unsub2 2384 2.41 2.37 2.42 115 T_TooManySym_01 2299 3.67 2.28 3.90 116 RELAYCOUNTRY_NL 2264 0.48 2.25 0.19 117 BAYES_40 2181 5.31 2.17 5.82 118 T_XMHurry_00 2119 0.78 2.10 0.56 119 HTML_IMAGE_RATIO_08 2071 2.29 2.06 2.33 120 LongTLD 2069 0.44 2.05 0.17 121 DKIM_ADSP_NXDOMAIN 2045 0.78 2.03 0.57 122 SUBJ_ALL_CAPS 2044 1.54 2.03 1.46 123 RCVD_IN_MSPIKE_H4 2041 6.22 2.03 6.91 124 DKIM_ADSP_CUSTOM_MED 1858 1.28 1.85 1.19 125 XMBrknScrpt_02 1842 0.90 1.83 0.75 126 XM_H_PHPMailer 1841 0.70 1.83 0.51 127 BAYES_20 1790 4.46 1.78 4.91 128 ALL_TRUSTED 1754 11.30 1.74 12.87 129 URI_HEX 1751 1.43 1.74 1.38 130 TR_XM_RelayPhish 1749 0.42 1.74 0.21 131 MIME_HTML_ONLY_MULTI 1745 5.69 1.73 6.34 132 NML_ADSP_CUSTOM_MED 1680 0.93 1.67 0.81 133 T_FILL_THIS_FORM_SHORT 1644 0.91 1.63 0.79 134 TR_Mismatch_TLD_02 1638 0.30 1.63 0.08 135 RELAYCOUNTRY_GB 1595 1.32 1.58 1.28 136 XMBody_78 1515 0.61 1.50 0.46 137 XM_XX_Yahoo 1512 0.25 1.50 0.04 138 MAILING_LIST_MULTI 1475 2.23 1.46 2.35 139 TM2_M_VERY_LONG_WORD 1457 1.23 1.45 1.20 140 XM_OfRef7 1436 0.29 1.43 0.10 141 XM_DK_Undo_01 1427 1.53 1.42 1.54 142 RCVD_IN_MSPIKE_L4 1425 0.26 1.42 0.07 143 T_XMDrugObfuBody_00 1423 0.73 1.41 0.62 144 XM_UB95 1401 0.22 1.39 0.02 145 HELO_NODOT 1378 1.62 1.37 1.66 146 HELO_NO_DOMAIN 1375 1.62 1.37 1.66 147 RDNS_DYNAMIC 1365 0.45 1.36 0.30 148 FORGED_GMAIL_RCVD 1351 0.68 1.34 0.58 149 T_HTML_TAG_BALANCE_CENTER 1349 0.32 1.34 0.15 150 DIET_1 1338 0.52 1.33 0.38 151 TR_Symld_Words 1321 1.49 1.31 1.52 152 URI_TRY_3LD 1321 1.36 1.31 1.36 153 XMStockSpam_06 1300 1.19 1.29 1.17 154 XMGenDplmaNmb 1277 0.97 1.27 0.92 155 XMBdyGiftCard01 1277 0.74 1.27 0.65 156 XMSlimDrugH 1265 0.40 1.26 0.25 157 URI_PHP_REDIR 1262 0.21 1.25 0.04 158 HK_RANDOM_REPLYTO 1245 0.30 1.24 0.15 159 TR_XM_DK_SendGrid 1218 3.09 1.21 3.40 160 TR_LOTS_OF_MONEY2 1213 0.58 1.20 0.47 161 T_MONEY_PERCENT 1213 0.58 1.20 0.47 162 HDRS_MISSP 1205 0.22 1.20 0.06 163 XM_H_PHPOS_M 1176 0.31 1.17 0.17 164 XMSubMetaSxObfu_03 1161 1.08 1.15 1.07 165 DATE_IN_PAST_12_24 1098 0.19 1.09 0.04 166 TR_MetaPhish_Combo_01 1096 0.79 1.09 0.74 167 BAYES_00 1089 16.39 1.08 18.92 168 XMNoVowels 1056 0.67 1.05 0.60 169 URIBL_BLACK 1022 0.17 1.01 0.03 170 TR_XM_COVIDMETA3 1015 0.19 1.01 0.06 171 RELAYCOUNTRY_IN 1014 0.24 1.01 0.12 172 XMMoneyMeta_00 988 0.75 0.98 0.71 173 T_Symld_Words_02 986 0.56 0.98 0.49 174 XM_H_Long_From02 983 0.98 0.98 0.98 175 MISSING_HEADERS 980 0.60 0.97 0.54 176 HELO_DYNAMIC_IPADDR 963 0.14 0.96 0.01 177 XMSexyCombo_04 954 0.60 0.95 0.54 178 LOW_PRICE 940 0.43 0.93 0.35 179 XM_PDF 938 3.39 0.93 3.80 180 TM2_M_A_HREF_HREF 916 0.48 0.91 0.41 181 XM_HighProb1 908 0.13 0.90 0.01 182 RELAYCOUNTRY_IT 898 0.18 0.89 0.06 183 BAYES_05 895 3.21 0.89 3.60 184 RELAYCOUNTRY_CN 885 0.19 0.88 0.07 185 XMSubMetaSSx_00 885 0.27 0.88 0.17 186 RELAYCOUNTRY_AT 873 0.28 0.87 0.18 187 TR_Sbj_FN_Bdy 863 0.28 0.86 0.19 188 XM_H_MailChimp 861 0.29 0.86 0.20 189 XMPhish08 861 0.54 0.86 0.49 190 REMOVE_BEFORE_LINK 834 0.37 0.83 0.29 191 XMSubEmpty 816 0.33 0.81 0.25 192 RCVD_IN_IADB_LISTED 797 4.10 0.79 4.64 193 URI_GOOGLE_PROXY 792 0.15 0.79 0.04 194 XM_ShortIntro_01 791 0.68 0.79 0.66 195 MONEY_FORM_SHORT 787 0.14 0.78 0.03 196 HTML_IMAGE_ONLY_16 771 0.42 0.77 0.37 197 HTTPS_HTTP_MISMATCH 771 0.69 0.77 0.68 198 BILLION_DOLLARS 770 0.12 0.76 0.02 199 XMReplyNow 763 0.21 0.76 0.12 200 URI_NO_WWW_INFO_CGI 761 0.13 0.76 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 599418 98.08 97.26 98.21 2 HTML_MESSAGE 550890 90.81 94.15 90.26 3 RELAYCOUNTRY_US 507937 81.32 69.75 83.22 4 XM_B_Unicode 445127 72.95 73.03 72.93 5 DKIM_SIGNED 427156 71.10 77.81 69.99 6 XM_DK_Pass 419862 69.67 75.02 68.79 7 DKIM_VALID 394071 64.40 63.36 64.57 8 BAYES_50 298823 47.51 38.74 48.96 9 DKIM_VALID_AU 296439 48.42 47.49 48.57 10 XMListUnsubscribeExists 292087 50.72 68.06 47.86 11 XM_B_Unicode3 261902 41.73 34.58 42.91 12 T_TM2_M_HEADER_IN_MSG 159681 25.21 19.44 26.16 13 HTML_FONT_LOW_CONTRAST 153041 25.09 25.14 25.08 14 DKIM_VALID_EF 148906 25.73 33.84 24.40 15 MIME_HTML_ONLY 141453 25.96 42.85 23.18 16 LOC_TINY_FONT_1 137923 23.60 29.69 22.60 17 RCVD_IN_MSPIKE_H2 129249 21.36 22.47 21.18 18 FVGT_m_MULTI_ODD 128294 21.25 22.66 21.02 19 XMSubLong 124782 20.82 23.09 20.45 20 RCVD_IN_MSPIKE_WL 121297 18.03 6.82 19.87 21 BAYES_00 115464 16.39 1.08 18.92 22 T_KAM_HTML_FONT_INVALID 106905 18.72 25.98 17.52 23 HTML_IMAGE_RATIO_04 82014 12.23 4.92 13.44 24 ALL_TRUSTED 78577 11.30 1.74 12.87 25 XM_Body_Dirty_Words 75690 13.16 17.76 12.40 26 RCVD_IN_MSPIKE_H3 74900 11.21 4.75 12.27 27 XM_Multi_Part_URI 69080 11.91 15.53 11.32 28 XM_H_Trusted_IP 62388 8.77 0.00 10.22 29 HTML_FONT_FACE_BAD 61085 8.65 0.41 10.01 30 XM_DK_Undo_02 60917 16.10 53.18 9.98 31 XM_B_Unsub 60909 10.09 10.75 9.98 32 TR_XM_DK_Bayes 59005 8.37 0.53 9.67 33 XM_Evil_Numbers_Gen 58243 9.68 10.54 9.54 34 TR_XM_DK_Bayes1 54730 7.74 0.30 8.97 35 XMStrtUSub 51420 7.73 3.49 8.43 36 LOTS_OF_MONEY 51323 9.23 14.22 8.41 37 MPART_ALT_DIFF 50420 7.75 4.66 8.26 38 TR_XM_DK_Bayes2 48204 6.82 0.28 7.90 39 LotsOfNums_01 47585 7.81 7.87 7.80 40 TooManyTo_001 46715 7.25 4.81 7.65 41 RCVD_IN_RP_SAFE 44335 6.31 0.54 7.26 42 HTML_IMAGE_RATIO_02 43834 7.81 11.63 7.18 43 XM_B_Phish_Phrases 43338 7.80 12.04 7.10 44 RCVD_IN_MSPIKE_H4 42184 6.22 2.03 6.91 45 RCVD_IN_RP_CERTIFIED 40889 5.81 0.42 6.70 46 UNPARSEABLE_RELAY 39815 6.19 4.17 6.52 47 MIME_HTML_ONLY_MULTI 38695 5.69 1.73 6.34 48 BAYES_99 37024 10.86 39.94 6.07 49 XM_SendGrid 36546 5.56 2.95 5.99 50 BAYES_40 35546 5.31 2.17 5.82 51 XM_DKIMWhitelistDomains 35338 4.97 0.01 5.79 52 BAYES_60 35065 5.73 5.65 5.75 53 IN_ZIMBRA_NJ_WHITELIST 34761 4.89 0.04 5.70 54 XM_H_Long_From01 33611 5.63 6.40 5.51 55 RELAYCOUNTRY_META 33596 9.31 32.39 5.50 56 DKIM_INVALID 33085 6.70 14.45 5.42 57 MIME_QP_LONG_LINE 32669 5.04 3.16 5.35 58 BAYES_20 29957 4.46 1.78 4.91 59 BAYES_999 28647 8.75 33.31 4.69 60 RCVD_IN_IADB_LISTED 28336 4.10 0.79 4.64 61 BOTNET_IPINHOSTNAME 28092 6.41 17.39 4.60 62 HTML_IMAGE_RATIO_06 27029 4.28 3.37 4.43 63 RCVD_IN_IADB_SPF 24892 3.60 0.72 4.08 64 XMSexyCombo_05 24212 4.90 10.59 3.97 65 T_TooManySym_01 23815 3.67 2.28 3.90 66 XM_PDF 23177 3.39 0.93 3.80 67 BAYES_80 22605 4.07 6.26 3.70 68 RCVD_IN_IADB_SENDERID 22007 3.19 0.70 3.61 69 T_REMOTE_IMAGE 21972 4.10 7.13 3.60 70 BAYES_05 21952 3.21 0.89 3.60 71 RCVD_IN_IADB_DK 21935 3.18 0.71 3.59 72 XMSubMetaSx_00 21792 3.95 6.22 3.57 73 TM2_M_URI_OPT_OUT 21668 3.51 3.26 3.55 74 TR_XM_DK_SendGrid 20737 3.09 1.21 3.40 75 XMSubNoVowel 20626 3.00 0.69 3.38 76 ANY_BOUNCE_MESSAGE 20574 2.98 0.61 3.37 77 BOUNCE_MESSAGE 20572 2.98 0.61 3.37 78 XM_UncommonTLD01 20121 6.24 24.10 3.30 79 TR_XM_PhishingBody 19927 3.72 6.48 3.26 80 XMNumbers 18513 3.32 5.05 3.03 81 NO_DNS_FOR_FROM 18262 4.27 12.03 2.99 82 BOTNET 18042 6.86 30.50 2.96 83 FROM_EXCESS_BASE64 17710 3.06 4.00 2.90 84 RCVD_IN_IADB_VOUCHED 17360 2.47 0.21 2.84 85 MIME_HTML_MOSTLY 15562 2.83 4.54 2.55 86 XM_B_Unsub2 14763 2.41 2.37 2.42 87 MAILING_LIST_MULTI 14354 2.23 1.46 2.35 88 HTML_MIME_NO_HTML_TAG 14228 2.53 3.74 2.33 89 HTML_IMAGE_RATIO_08 14207 2.29 2.06 2.33 90 BAYES_95 13823 2.44 3.49 2.26 91 XM_CamelCaseFrm001 13141 3.56 12.09 2.15 92 T_XMDrugObfuBody_08 12581 2.51 5.21 2.06 93 TooManyTo_002 11909 1.76 0.60 1.95 94 UNTRUSTED_Relay 11881 4.74 21.64 1.95 95 XM_B_Phish66 11499 2.23 4.34 1.88 96 XM_B_COVIDMETA 11352 2.68 7.67 1.86 97 RCVD_IN_IADB_OPTIN 10798 1.55 0.21 1.77 98 T_TooManySym_02 10476 1.56 0.64 1.72 99 XM_B_SpammyTLD 10395 2.06 4.24 1.70 100 KHOP_HELO_FCRDNS 10383 1.90 3.10 1.70 101 HELO_NODOT 10117 1.62 1.37 1.66 102 HELO_NO_DOMAIN 10116 1.62 1.37 1.66 103 XM_SPF_SoftFail 10079 2.15 5.14 1.65 104 XM_DK_Undo_01 9420 1.53 1.42 1.54 105 TR_Symld_Words 9278 1.49 1.31 1.52 106 XMDiploma_00 9272 1.69 2.73 1.52 107 RELAYCOUNTRY_CA 9130 2.39 7.81 1.50 108 TVD_RCVD_IP 8895 1.33 0.58 1.46 109 SUBJ_ALL_CAPS 8894 1.54 2.03 1.46 110 URI_HEX 8440 1.43 1.74 1.38 111 URI_TRY_3LD 8320 1.36 1.31 1.36 112 TooManyTo_003 8190 1.22 0.45 1.34 113 RCVD_IN_BL_SPAMCOP_NET 8129 2.69 10.93 1.33 114 T_XMDrugObfuBody_14 8082 1.48 2.40 1.32 115 RELAYCOUNTRY_GB 7797 1.32 1.58 1.28 116 INVALID_MSGID 7718 1.10 0.13 1.26 117 IN_HORDE_ADDRESS_BOOK 7655 1.09 0.06 1.25 118 XMSubLongNoVowel 7432 1.06 0.12 1.22 119 XMSubGarbage 7391 1.04 0.02 1.21 120 TM2_M_VERY_LONG_WORD 7296 1.23 1.45 1.20 121 DKIM_ADSP_CUSTOM_MED 7264 1.28 1.85 1.19 122 XM_UB50 7226 2.18 8.19 1.18 123 XMStockSpam_06 7154 1.19 1.29 1.17 124 XMCapTrack 6855 1.04 0.52 1.12 125 XM_GoogleGroups 6848 1.03 0.48 1.12 126 TO_MALFORMED 6812 0.96 0.01 1.12 127 XMSubMetaSxObfu_03 6550 1.08 1.15 1.07 128 XM_OfRef6 6368 1.61 5.04 1.04 129 XMSexyCombo_01 6221 1.24 2.60 1.02 130 TooManyTo_004 6127 0.92 0.39 1.00 131 XM_H_Long_From02 5981 0.98 0.98 0.98 132 SpammyFromTLD_01 5625 1.53 5.21 0.92 133 XMGenDplmaNmb 5603 0.97 1.27 0.92 134 TR_XM_COVIDMETA4 5460 1.66 6.31 0.89 135 XMHTML_After_End 5048 1.51 5.63 0.83 136 TooManyTo_005 5021 0.75 0.33 0.82 137 TR_MSPIKEBAYES00 5003 0.70 0.01 0.82 138 XM_E_Blogspot 4923 0.70 0.08 0.81 139 NML_ADSP_CUSTOM_MED 4920 0.93 1.67 0.81 140 USER_IN_DEF_DKIM_WL 4888 0.69 0.00 0.80 141 XMGappySubj_01 4871 0.71 0.20 0.80 142 T_FILL_THIS_FORM_SHORT 4811 0.91 1.63 0.79 143 XMBody_17 4699 1.32 4.68 0.77 144 XMBrknScrpt_02 4547 0.90 1.83 0.75 145 TR_MetaPhish_Combo_01 4540 0.79 1.09 0.74 146 XM_ProductURIs 4435 0.72 0.67 0.73 147 XMMoneyMeta_00 4322 0.75 0.98 0.71 148 RCVD_IN_MSPIKE_H5 4213 0.60 0.04 0.69 149 HTTPS_HTTP_MISMATCH 4141 0.69 0.77 0.68 150 XM_DIRTYINTL 4021 1.26 4.93 0.66 151 XM_ShortIntro_01 4018 0.68 0.79 0.66 152 XMBdyGiftCard01 3964 0.74 1.27 0.65 153 XMSubMetaI_00 3874 0.63 0.59 0.63 154 T_XMDrugObfuBody_00 3772 0.73 1.41 0.62 155 XM_SPF_Unknown 3721 0.60 0.53 0.61 156 T_OBFU_PDF_ATTACH 3690 0.56 0.26 0.60 157 XMNoVowels 3688 0.67 1.05 0.60 158 RCVD_IN_MSPIKE_BL 3533 2.04 10.92 0.58 159 FORGED_GMAIL_RCVD 3515 0.68 1.34 0.58 160 DKIM_ADSP_NXDOMAIN 3481 0.78 2.03 0.57 161 T_XMHurry_00 3445 0.78 2.10 0.56 162 TR_XM_COVIDMETA1 3310 0.86 2.82 0.54 163 XMSexyCombo_04 3302 0.60 0.95 0.54 164 T_TooManySym_03 3284 0.50 0.24 0.54 165 MISSING_HEADERS 3271 0.60 0.97 0.54 166 TR_XM_PHPDW 3106 0.84 2.84 0.51 167 XM_H_PHPMailer 3104 0.70 1.83 0.51 168 RCVD_IN_SORBS_DUL 3071 0.48 0.36 0.50 169 RELAYCOUNTRY_DE 3070 1.05 4.35 0.50 170 TR_LOTS_OF_MONEY3 3053 0.90 3.31 0.50 171 T_PDS_OTHER_BAD_TLD 3050 1.06 4.49 0.50 172 T_Symld_Words_02 3018 0.56 0.98 0.49 173 XMPhish08 3005 0.54 0.86 0.49 174 TR_XM_PHPForged 2950 0.83 2.96 0.48 175 TR_XM_FormFill2 2941 0.79 2.69 0.48 176 XM_H_PHPOS 2913 0.79 2.68 0.48 177 TR_LOTS_OF_MONEY2 2898 0.58 1.20 0.47 178 T_MONEY_PERCENT 2898 0.58 1.20 0.47 179 XMHTMLBadTable_001 2821 0.46 0.45 0.46 180 XMBody_78 2806 0.61 1.50 0.46 181 XMPhish14 2752 0.48 0.66 0.45 182 FROM_GOV_DKIM_AU 2716 0.39 0.06 0.45 183 XMDateMe_00 2696 0.44 0.43 0.44 184 XM_B_COPY_HTML 2682 0.46 0.57 0.44 185 MPART_ALT_DIFF_COUNT 2678 0.48 0.70 0.44 186 XM_B_REG_HTML 2626 0.39 0.17 0.43 187 XMPhish30 2592 0.46 0.66 0.42 188 TM2_M_A_HREF_HREF 2519 0.48 0.91 0.41 189 THIS_AD 2502 0.44 0.65 0.41 190 HTML_IMAGE_ONLY_28 2498 0.44 0.59 0.41 191 XM_RXBody 2483 0.43 0.54 0.41 192 XMLngstWrd_00 2453 0.45 0.71 0.40 193 HTML_TAG_BALANCE_BODY 2444 0.43 0.60 0.40 194 RCVD_IN_MSPIKE_L3 2355 1.23 6.35 0.39 195 TM2_M_BODY_EMPTY 2333 0.34 0.11 0.38 196 DIET_1 2332 0.52 1.33 0.38 197 SHORT_HELO_AND_INLINE_IMAGE 2330 0.34 0.06 0.38 198 HTML_IMAGE_ONLY_20 2303 0.38 0.36 0.38 199 HTML_IMAGE_ONLY_16 2241 0.42 0.77 0.37 200 FROM_GOV_SPOOF 2215 0.34 0.22 0.36 ----------------------------------------------------------------------