Email: 345214 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 2.23 sec Spam: 56907 Autolearn: 0 AvgScore: 12.87 AvgScanTime: 4.23 sec Ham: 288307 Autolearn: 0 AvgScore: -2.47 AvgScanTime: 1.83 sec Time Spent Running SA: 213.47 hours Time Spent Processing Spam: 66.82 hours Time Spent Processing Ham: 146.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 55616 98.80 97.73 99.01 2 HTML_MESSAGE 49854 87.38 87.61 87.33 3 DKIM_SIGNED 43601 79.46 76.62 80.03 4 XM_DK_Pass 42002 78.14 73.81 78.99 5 XM_B_Unicode 39210 73.21 68.90 74.06 6 XMListUnsubscribeExists 38319 60.68 67.34 59.37 7 RELAYCOUNTRY_US 37783 80.02 66.39 82.71 8 DKIM_VALID 34708 72.62 60.99 74.92 9 XM_DK_Undo_02 32022 20.49 56.27 13.43 10 DKIM_VALID_AU 25672 58.26 45.11 60.86 11 BAYES_99 23191 14.45 40.75 9.26 12 XM_B_Unicode3 21059 44.64 37.01 46.15 13 RELAYCOUNTRY_META 20939 10.28 36.80 5.05 14 MIME_HTML_ONLY 20398 25.56 35.84 23.53 15 BAYES_50 19408 48.80 34.10 51.70 16 BAYES_999 19262 11.72 33.85 7.36 17 LOC_TINY_FONT_1 18783 32.93 33.01 32.91 18 BOTNET 18656 8.16 32.78 3.29 19 DKIM_VALID_EF 15940 26.70 28.01 26.44 20 HTML_FONT_LOW_CONTRAST 14857 33.55 26.11 35.02 21 FVGT_m_MULTI_ODD 14637 24.14 25.72 23.83 22 XM_UncommonTLD01 13982 7.26 24.57 3.84 23 T_KAM_HTML_FONT_INVALID 13703 19.29 24.08 18.35 24 XMSubLong 13364 23.37 23.48 23.35 25 UNTRUSTED_Relay 13322 5.45 23.41 1.91 26 BOTNET_IPINHOSTNAME 12946 9.28 22.75 6.62 27 RCVD_IN_MSPIKE_H2 11952 24.10 21.00 24.72 28 RCVD_IN_MSPIKE_BL 10144 3.54 17.83 0.72 29 XM_Body_Dirty_Words 9850 16.15 17.31 15.93 30 T_TM2_M_HEADER_IN_MSG 9295 20.27 16.33 21.05 31 DKIM_INVALID 8893 6.84 15.63 5.11 32 XM_Multi_Part_URI 8886 15.50 15.61 15.48 33 LOTS_OF_MONEY 8184 9.47 14.38 8.50 34 HTML_IMAGE_RATIO_02 8178 11.02 14.37 10.36 35 RCVD_IN_RP_RNBL 8034 2.41 14.12 0.10 36 XMSexyCombo_05 6732 6.80 11.83 5.80 37 SpammyFromTLD_01 6422 2.28 11.29 0.51 38 RCVD_IN_BL_SPAMCOP_NET 6409 2.96 11.26 1.32 39 NO_DNS_FOR_FROM 6229 4.34 10.95 3.04 40 XM_B_Unsub 5974 10.63 10.50 10.66 41 RELAYCOUNTRY_CA 5780 3.42 10.16 2.09 42 XM_UB50 5605 2.56 9.85 1.12 43 RCVD_IN_MSPIKE_L3 5468 1.99 9.61 0.49 44 XM_B_Phish_Phrases 5050 8.65 8.87 8.61 45 URIBL_SBL_A 5049 1.66 8.87 0.24 46 XMSubMetaSx_00 5046 5.51 8.87 4.84 47 RCVD_IN_PSBL 4848 1.50 8.52 0.11 48 BAYES_60 4357 7.39 7.66 7.33 49 XM_CamelCaseFrm001 4339 3.36 7.62 2.52 50 TR_XM_MaxBayes 4081 1.24 7.17 0.07 51 LotsOfNums_01 4058 8.48 7.13 8.75 52 BAYES_80 3969 5.35 6.97 5.03 53 TR_XM_COVIDMETA4 3923 1.76 6.89 0.74 54 XM_SPF_SoftFail 3883 2.05 6.82 1.11 55 XM_Evil_Numbers_Gen 3764 9.37 6.61 9.91 56 XM_H_Long_From01 3481 5.63 6.12 5.54 57 XMNumbers 3318 3.83 5.83 3.44 58 RCVD_IN_MSPIKE_WL 3273 22.11 5.75 25.34 59 XM_DIRTYINTL 3234 1.43 5.68 0.59 60 TR_XM_MaxSPIKE 3206 0.95 5.63 0.02 61 HTML_IMAGE_RATIO_04 3155 7.33 5.54 7.68 62 MPART_ALT_DIFF 3150 6.53 5.54 6.73 63 TooManyTo_001 3094 6.46 5.44 6.66 64 RCVD_IN_MSPIKE_L5 3076 1.05 5.41 0.19 65 XM_OfRef6 2992 1.79 5.26 1.11 66 XM_UB99 2893 0.84 5.08 0.01 67 BOTNET_NORDNS 2857 0.85 5.02 0.03 68 TR_Mismatch_TLD_02 2809 0.91 4.94 0.12 69 TR_XM_INV_DKIM 2790 0.98 4.90 0.21 70 XMBody_17 2649 1.84 4.65 1.29 71 MIME_HTML_MOSTLY 2566 4.06 4.51 3.98 72 SpammyFromTLD_02 2477 0.97 4.35 0.30 73 RELAYCOUNTRY_FR 2467 0.93 4.34 0.25 74 XM_UB999 2403 0.70 4.22 0.00 75 UNPARSEABLE_RELAY 2374 8.39 4.17 9.22 76 TR_XM_PhishingBody 2371 2.98 4.17 2.75 77 XM_B_SpammyTLD 2325 2.59 4.09 2.30 78 FROM_EXCESS_BASE64 2307 3.99 4.05 3.98 79 XM_OfRef7 2297 0.82 4.04 0.19 80 BAYES_95 2277 3.09 4.00 2.91 81 XMStrtUSub 2182 5.62 3.83 5.98 82 RCVD_IN_MSPIKE_H3 2109 13.03 3.71 14.87 83 NO_FM_NAME_IP_HOSTN 1950 0.57 3.43 0.00 84 XM_B_COVIDMETA 1902 2.31 3.34 2.11 85 XM_UB60 1888 0.63 3.32 0.10 86 DATE_IN_PAST_03_06 1870 0.64 3.29 0.11 87 TR_Mismatch_TLD_01 1843 0.73 3.24 0.23 88 XM_SendGrid 1804 7.25 3.17 8.06 89 T_XMDrugObfuBody_08 1794 1.61 3.15 1.30 90 XMSexyCombo_01 1785 1.21 3.14 0.82 91 T_REMOTE_IMAGE 1755 3.14 3.08 3.15 92 HK_SCAM 1716 0.52 3.02 0.02 93 TR_XM_PHPDW 1693 0.87 2.98 0.46 94 T_TooManySym_01 1680 5.12 2.95 5.55 95 TR_LOTS_OF_MONEY3 1669 0.99 2.93 0.61 96 XMStockSpam_06 1665 1.93 2.93 1.74 97 TR_XM_PHPForged 1658 0.84 2.91 0.43 98 TR_XM_FormFill2 1652 0.84 2.90 0.43 99 XM_H_PHPOS 1643 0.83 2.89 0.42 100 KHOP_HELO_FCRDNS 1630 1.45 2.86 1.17 101 RDNS_DYNAMIC 1616 0.88 2.84 0.49 102 HTML_IMAGE_RATIO_08 1607 3.12 2.82 3.18 103 XM_URI_RBL 1561 0.63 2.74 0.22 104 XMHTML_After_End 1534 1.08 2.70 0.76 105 BODY_URI_ONLY 1499 0.48 2.63 0.05 106 RCVD_IN_MSPIKE_L4 1462 0.46 2.57 0.04 107 T_FILL_THIS_FORM_SHORT 1458 0.80 2.56 0.46 108 TM2_M_URI_OPT_OUT 1441 4.32 2.53 4.67 109 TVD_SPACE_RATIO 1437 0.65 2.53 0.28 110 RELAYCOUNTRY_DE 1423 0.62 2.50 0.25 111 URI_PHP_REDIR 1420 0.42 2.50 0.01 112 FROM_SUSPICIOUS_NTLD 1412 0.52 2.48 0.14 113 HTML_IMAGE_RATIO_06 1396 3.64 2.45 3.87 114 FROM_MISSP_REPLYTO 1396 0.41 2.45 0.00 115 T_PDS_OTHER_BAD_TLD 1394 1.12 2.45 0.86 116 DATE_IN_PAST_06_12 1371 0.63 2.41 0.28 117 FROM_MISSP_EH_MATCH 1335 0.39 2.35 0.00 118 BAYES_40 1329 3.92 2.34 4.24 119 URI_NO_WWW_INFO_CGI 1315 0.41 2.31 0.04 120 FROM_SUSPICIOUS_NTLD_FP 1308 0.48 2.30 0.12 121 BODY_SINGLE_URI 1302 0.39 2.29 0.01 122 MIME_QP_LONG_LINE 1292 3.76 2.27 4.05 123 XMSubNoVowel 1273 1.28 2.24 1.10 124 RELAYCOUNTRY_NL 1258 0.64 2.21 0.33 125 XM_BadFromFormat 1250 0.58 2.20 0.26 126 LongTLD 1222 0.50 2.15 0.17 127 XMSexyCombo_04 1185 0.61 2.08 0.32 128 XM_UB80 1183 0.38 2.08 0.04 129 XM_B_Phish66 1169 1.26 2.05 1.11 130 RELAYCOUNTRY_IN 1157 0.41 2.03 0.09 131 TM2_M_VERY_LONG_WORD 1135 1.54 1.99 1.45 132 RCVD_IN_MSPIKE_H4 1117 8.23 1.96 9.47 133 HELO_DYNAMIC_IPADDR 1115 0.33 1.96 0.01 134 SUBJ_ALL_CAPS 1105 1.51 1.94 1.43 135 DKIM_ADSP_CUSTOM_MED 1091 1.17 1.92 1.02 136 URI_HEX 1090 1.49 1.92 1.41 137 TVD_SPACE_RATIO_MINFP 1090 0.33 1.92 0.02 138 T_TooManySym_02 1065 2.69 1.87 2.85 139 T_Symld_Words_02 1064 0.69 1.87 0.45 140 HK_RANDOM_REPLYTO 1057 0.46 1.86 0.19 141 RELAYCOUNTRY_RU 1031 0.33 1.81 0.04 142 BAYES_20 1010 2.91 1.77 3.13 143 XMBrknScrpt_02 987 1.34 1.73 1.26 144 TO_NO_BRKTS_FROM_MSSP 970 0.30 1.70 0.02 145 HTML_MIME_NO_HTML_TAG 968 2.05 1.70 2.12 146 NML_ADSP_CUSTOM_MED 968 0.90 1.70 0.74 147 MONEY_FORM_SHORT 967 0.30 1.70 0.02 148 DKIM_ADSP_NXDOMAIN 961 0.60 1.69 0.39 149 MIME_HTML_ONLY_MULTI 954 3.40 1.68 3.74 150 TR_XM_RelayPhish 949 0.39 1.67 0.14 151 HTTPS_HTTP_MISMATCH 946 0.72 1.66 0.53 152 XMSubMetaI_00 918 1.22 1.61 1.14 153 XM_B_Unsub2 904 1.32 1.59 1.27 154 FORM_FRAUD 901 0.26 1.58 0.00 155 T_XMHurry_00 885 1.16 1.56 1.09 156 XM_OfRef8 882 0.27 1.55 0.02 157 FORGED_GMAIL_RCVD 877 0.66 1.54 0.49 158 XM_H_PHPMailer 871 0.74 1.53 0.58 159 FROM_MISSP_DYNIP 864 0.25 1.52 0.00 160 T_LOTTO_AGENT 861 0.25 1.51 0.00 161 DEAR_FRIEND 844 0.29 1.48 0.05 162 MISSING_HEADERS 839 0.57 1.47 0.39 163 REPLYTO_WITHOUT_TO_CC 837 0.32 1.47 0.10 164 XMDiploma_00 835 1.34 1.47 1.32 165 URI_TRY_3LD 821 1.65 1.44 1.69 166 T_XMDrugObfuBody_14 820 1.58 1.44 1.60 167 MIMEOLE_DIRECT_TO_MX 818 0.24 1.44 0.00 168 T_TooManySym_03 797 0.95 1.40 0.86 169 FILL_THIS_FORM 796 0.54 1.40 0.37 170 ALL_TRUSTED 794 11.27 1.40 13.22 171 HDR_ORDER_FTSDMCXX_DIRECT 793 0.24 1.39 0.02 172 RELAYCOUNTRY_GB 790 0.78 1.39 0.66 173 SCRIPT_GIBBERISH 782 0.23 1.37 0.01 174 BAYES_00 775 12.07 1.36 14.19 175 RELAYCOUNTRY_AT 744 0.43 1.31 0.25 176 XM_ShortIntro_01 730 0.50 1.28 0.35 177 URI_WP_DIRINDEX 717 0.21 1.26 0.01 178 URIBL_BLACK 708 0.22 1.24 0.02 179 RELAYCOUNTRY_JP 701 0.23 1.23 0.04 180 XM_H_PHPOS_M 692 0.37 1.22 0.20 181 TR_XM_COVIDMETA1 689 0.55 1.21 0.42 182 MAILING_LIST_MULTI 681 1.78 1.20 1.90 183 XPRIO_SHORT_SUBJ 680 0.20 1.19 0.00 184 XMBdyGiftCard01 676 1.88 1.19 2.02 185 DOS_OE_TO_MX 664 0.21 1.17 0.02 186 XMNoVowels 656 0.50 1.15 0.37 187 XMReplyNow 639 0.27 1.12 0.11 188 XM_H_Undi_Recip 638 0.36 1.12 0.21 189 XMPhish30 632 0.78 1.11 0.72 190 MIME_CHARSET_FARAWAY 630 0.31 1.11 0.15 191 TR_LOTS_OF_MONEY2 628 0.52 1.10 0.40 192 T_MONEY_PERCENT 628 0.52 1.10 0.40 193 DATE_IN_FUTURE_06_12 626 0.19 1.10 0.01 194 URI_WP_HACKED_2 620 0.22 1.09 0.05 195 TR_LOTS_OF_MONEY1 618 0.19 1.09 0.02 196 TR_XM_DK_SendGrid 607 4.10 1.07 4.70 197 URIBL_DBL_SPAM 606 0.19 1.06 0.02 198 XM_UB95 606 0.19 1.06 0.01 199 CHARSET_FARAWAY_HEADER 605 0.22 1.06 0.05 200 ADVANCE_FEE_3_NEW 586 0.17 1.03 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 285462 98.80 97.73 99.01 2 HTML_MESSAGE 251790 87.38 87.61 87.33 3 RELAYCOUNTRY_US 238449 80.02 66.39 82.71 4 DKIM_SIGNED 230722 79.46 76.62 80.03 5 XM_DK_Pass 227734 78.14 73.81 78.99 6 DKIM_VALID 216000 72.62 60.99 74.92 7 XM_B_Unicode 213531 73.21 68.90 74.06 8 DKIM_VALID_AU 175457 58.26 45.11 60.86 9 XMListUnsubscribeExists 171157 60.68 67.34 59.37 10 BAYES_50 149044 48.80 34.10 51.70 11 XM_B_Unicode3 133058 44.64 37.01 46.15 12 HTML_FONT_LOW_CONTRAST 100967 33.55 26.11 35.02 13 LOC_TINY_FONT_1 94885 32.93 33.01 32.91 14 DKIM_VALID_EF 76220 26.70 28.01 26.44 15 RCVD_IN_MSPIKE_WL 73061 22.11 5.75 25.34 16 RCVD_IN_MSPIKE_H2 71260 24.10 21.00 24.72 17 FVGT_m_MULTI_ODD 68696 24.14 25.72 23.83 18 MIME_HTML_ONLY 67847 25.56 35.84 23.53 19 XMSubLong 67314 23.37 23.48 23.35 20 T_TM2_M_HEADER_IN_MSG 60679 20.27 16.33 21.05 21 T_KAM_HTML_FONT_INVALID 52893 19.29 24.08 18.35 22 XM_Body_Dirty_Words 45915 16.15 17.31 15.93 23 XM_Multi_Part_URI 44626 15.50 15.61 15.48 24 RCVD_IN_MSPIKE_H3 42860 13.03 3.71 14.87 25 BAYES_00 40898 12.07 1.36 14.19 26 XM_DK_Undo_02 38706 20.49 56.27 13.43 27 ALL_TRUSTED 38105 11.27 1.40 13.22 28 RCVD_IN_RP_SAFE 33900 9.98 0.95 11.76 29 RCVD_IN_RP_CERTIFIED 31761 9.32 0.70 11.02 30 XM_B_Unsub 30732 10.63 10.50 10.66 31 XM_DKIMWhitelistDomains 30423 8.81 0.01 10.55 32 HTML_IMAGE_RATIO_02 29879 11.02 14.37 10.36 33 XM_Evil_Numbers_Gen 28570 9.37 6.61 9.91 34 RCVD_IN_MSPIKE_H4 27309 8.23 1.96 9.47 35 TR_XM_DK_Bayes 27189 7.95 0.48 9.43 36 BAYES_99 26696 14.45 40.75 9.26 37 UNPARSEABLE_RELAY 26587 8.39 4.17 9.22 38 TR_XM_DK_Bayes1 25249 7.36 0.29 8.76 39 LotsOfNums_01 25221 8.48 7.13 8.75 40 XM_B_Phish_Phrases 24813 8.65 8.87 8.61 41 LOTS_OF_MONEY 24506 9.47 14.38 8.50 42 TR_XM_DK_Bayes2 23544 6.86 0.27 8.17 43 XM_SendGrid 23228 7.25 3.17 8.06 44 HTML_IMAGE_RATIO_04 22140 7.33 5.54 7.68 45 BAYES_999 21209 11.72 33.85 7.36 46 BAYES_60 21147 7.39 7.66 7.33 47 MPART_ALT_DIFF 19408 6.53 5.54 6.73 48 TooManyTo_001 19210 6.46 5.44 6.66 49 BOTNET_IPINHOSTNAME 19080 9.28 22.75 6.62 50 XMStrtUSub 17233 5.62 3.83 5.98 51 XMSexyCombo_05 16736 6.80 11.83 5.80 52 T_TooManySym_01 16010 5.12 2.95 5.55 53 XM_H_Long_From01 15958 5.63 6.12 5.54 54 DKIM_INVALID 14722 6.84 15.63 5.11 55 RELAYCOUNTRY_META 14561 10.28 36.80 5.05 56 BAYES_80 14488 5.35 6.97 5.03 57 XMSubMetaSx_00 13960 5.51 8.87 4.84 58 TR_XM_DK_SendGrid 13544 4.10 1.07 4.70 59 TM2_M_URI_OPT_OUT 13475 4.32 2.53 4.67 60 IN_ZIMBRA_NJ_WHITELIST 12641 3.67 0.03 4.38 61 BAYES_40 12212 3.92 2.34 4.24 62 MIME_QP_LONG_LINE 11681 3.76 2.27 4.05 63 FROM_EXCESS_BASE64 11481 3.99 4.05 3.98 64 MIME_HTML_MOSTLY 11461 4.06 4.51 3.98 65 HTML_IMAGE_RATIO_06 11153 3.64 2.45 3.87 66 XM_UncommonTLD01 11077 7.26 24.57 3.84 67 MIME_HTML_ONLY_MULTI 10769 3.40 1.68 3.74 68 RCVD_IN_IADB_LISTED 10214 3.08 0.73 3.54 69 XMNumbers 9914 3.83 5.83 3.44 70 BOTNET 9497 8.16 32.78 3.29 71 HTML_IMAGE_RATIO_08 9163 3.12 2.82 3.18 72 T_REMOTE_IMAGE 9077 3.14 3.08 3.15 73 BAYES_20 9024 2.91 1.77 3.13 74 RCVD_IN_IADB_SPF 8953 2.71 0.69 3.11 75 ANY_BOUNCE_MESSAGE 8908 2.65 0.42 3.09 76 BOUNCE_MESSAGE 8907 2.65 0.42 3.09 77 NO_DNS_FOR_FROM 8763 4.34 10.95 3.04 78 BAYES_95 8394 3.09 4.00 2.91 79 XM_H_Trusted_IP 8318 2.41 0.00 2.89 80 T_TooManySym_02 8223 2.69 1.87 2.85 81 RCVD_IN_IADB_SENDERID 8126 2.46 0.66 2.82 82 TR_XM_PhishingBody 7931 2.98 4.17 2.75 83 RCVD_IN_IADB_DK 7861 2.39 0.67 2.73 84 TVD_RCVD_IP 7820 2.37 0.62 2.71 85 INVALID_MSGID 7619 2.24 0.18 2.64 86 XM_CamelCaseFrm001 7256 3.36 7.62 2.52 87 XM_B_SpammyTLD 6626 2.59 4.09 2.30 88 TO_MALFORMED 6474 1.88 0.02 2.25 89 BAYES_05 6399 2.02 0.98 2.22 90 RCVD_IN_IADB_VOUCHED 6225 1.83 0.16 2.16 91 HTML_MIME_NO_HTML_TAG 6118 2.05 1.70 2.12 92 XM_B_COVIDMETA 6083 2.31 3.34 2.11 93 RELAYCOUNTRY_CA 6033 3.42 10.16 2.09 94 XM_PDF 5846 1.72 0.15 2.03 95 XMBdyGiftCard01 5830 1.88 1.19 2.02 96 UNTRUSTED_Relay 5504 5.45 23.41 1.91 97 MAILING_LIST_MULTI 5472 1.78 1.20 1.90 98 XMStockSpam_06 5012 1.93 2.93 1.74 99 URI_TRY_3LD 4877 1.65 1.44 1.69 100 HTML_FONT_FACE_BAD 4734 1.43 0.36 1.64 101 T_XMDrugObfuBody_14 4621 1.58 1.44 1.60 102 IN_HORDE_ADDRESS_BOOK 4610 1.34 0.02 1.60 103 TM2_M_VERY_LONG_WORD 4167 1.54 1.99 1.45 104 TR_MSPIKEBAYES00 4154 1.20 0.00 1.44 105 SUBJ_ALL_CAPS 4124 1.51 1.94 1.43 106 URI_HEX 4055 1.49 1.92 1.41 107 USER_IN_DEF_DKIM_WL 3978 1.15 0.00 1.38 108 RCVD_IN_BL_SPAMCOP_NET 3817 2.96 11.26 1.32 109 XMDiploma_00 3802 1.34 1.47 1.32 110 T_XMDrugObfuBody_08 3760 1.61 3.15 1.30 111 RCVD_IN_IADB_OPTIN 3715 1.12 0.25 1.29 112 XMBody_17 3708 1.84 4.65 1.29 113 XM_B_Unsub2 3661 1.32 1.59 1.27 114 XMBrknScrpt_02 3647 1.34 1.73 1.26 115 XM_GoogleGroups 3620 1.13 0.50 1.26 116 TR_Symld_Words 3619 1.21 0.99 1.26 117 XM_ProductURIs 3595 1.21 0.99 1.25 118 XM_DK_Undo_01 3559 1.20 1.01 1.23 119 TooManyTo_002 3445 1.10 0.61 1.19 120 KHOP_HELO_FCRDNS 3367 1.45 2.86 1.17 121 XMSubMetaI_00 3297 1.22 1.61 1.14 122 XM_UB50 3219 2.56 9.85 1.12 123 XM_SPF_SoftFail 3192 2.05 6.82 1.11 124 XM_OfRef6 3187 1.79 5.26 1.11 125 XM_B_Phish66 3186 1.26 2.05 1.11 126 XMSubNoVowel 3157 1.28 2.24 1.10 127 T_XMHurry_00 3136 1.16 1.56 1.09 128 XMGappySubj_01 3018 0.88 0.05 1.05 129 DKIM_ADSP_CUSTOM_MED 2955 1.17 1.92 1.02 130 RCVD_IN_MSPIKE_H5 2892 0.85 0.08 1.00 131 XM_RXBody 2838 0.96 0.83 0.98 132 XM_H_Long_From02 2649 0.89 0.72 0.92 133 T_TooManySym_03 2483 0.95 1.40 0.86 134 T_PDS_OTHER_BAD_TLD 2468 1.12 2.45 0.86 135 TooManyTo_003 2439 0.79 0.52 0.85 136 XMSubMetaSxObfu_02 2408 0.76 0.41 0.84 137 XMSexyCombo_01 2376 1.21 3.14 0.82 138 XM_B_REG_HTML 2360 0.74 0.34 0.82 139 XMHTML_After_End 2193 1.08 2.70 0.76 140 TR_XM_COVIDMETA4 2137 1.76 6.89 0.74 141 NML_ADSP_CUSTOM_MED 2130 0.90 1.70 0.74 142 RCVD_IN_MSPIKE_BL 2089 3.54 17.83 0.72 143 SUBJ_DOLLARS 2076 0.69 0.54 0.72 144 XMPhish30 2071 0.78 1.11 0.72 145 TooManyTo_004 2050 0.67 0.47 0.71 146 XMGenDplmaNmb 1991 0.68 0.63 0.69 147 RELAYCOUNTRY_GB 1908 0.78 1.39 0.66 148 TR_MetaPhish_Combo_01 1904 0.67 0.72 0.66 149 XMBody_95 1894 0.56 0.09 0.66 150 PLING_QUERY 1818 0.66 0.80 0.63 151 TooManyTo_005 1758 0.57 0.40 0.61 152 TR_LOTS_OF_MONEY3 1752 0.99 2.93 0.61 153 XMBody_78 1747 0.60 0.56 0.61 154 XM_DIRTYINTL 1696 1.43 5.68 0.59 155 XM_H_PHPMailer 1682 0.74 1.53 0.58 156 USER_IN_WHITELIST 1668 0.48 0.00 0.58 157 HTML_TAG_BALANCE_BODY 1599 0.55 0.50 0.55 158 T_XMDrugObfuBody_00 1594 0.62 0.95 0.55 159 HTTPS_HTTP_MISMATCH 1540 0.72 1.66 0.53 160 XMPhish08 1514 0.54 0.60 0.53 161 XMHTMLBadTable_001 1488 0.51 0.50 0.52 162 SpammyFromTLD_01 1465 2.28 11.29 0.51 163 RDNS_DYNAMIC 1420 0.88 2.84 0.49 164 RCVD_IN_MSPIKE_L3 1415 1.99 9.61 0.49 165 FORGED_GMAIL_RCVD 1408 0.66 1.54 0.49 166 HTML_IMAGE_ONLY_20 1398 0.49 0.51 0.48 167 HELO_NODOT 1388 0.53 0.76 0.48 168 HELO_NO_DOMAIN 1383 0.53 0.76 0.48 169 DIET_1 1381 0.55 0.91 0.48 170 XM_B_COPY_HTML 1354 0.50 0.63 0.47 171 TR_XM_PHPDW 1327 0.87 2.98 0.46 172 T_FILL_THIS_FORM_SHORT 1318 0.80 2.56 0.46 173 T_Symld_Words_02 1311 0.69 1.87 0.45 174 XMLngstWrd_00 1268 0.44 0.44 0.44 175 URI_NOVOWEL 1262 0.50 0.84 0.44 176 TR_XM_FormFill2 1244 0.84 2.90 0.43 177 TR_XM_PHPForged 1243 0.84 2.91 0.43 178 MPART_ALT_DIFF_COUNT 1237 0.53 1.01 0.43 179 XM_H_PHPOS 1222 0.83 2.89 0.42 180 XMSubMetaSSx_00 1222 0.43 0.44 0.42 181 TR_XM_COVIDMETA1 1204 0.55 1.21 0.42 182 XMSlimDrugH 1201 0.46 0.70 0.42 183 T_TooManySym_04 1181 0.35 0.07 0.41 184 TR_LOTS_OF_MONEY2 1167 0.52 1.10 0.40 185 T_MONEY_PERCENT 1167 0.52 1.10 0.40 186 XM_Body_Obfu01 1160 0.35 0.08 0.40 187 SHOPIFY_IMG_NOT_RCVD_SFY 1158 0.42 0.51 0.40 188 XMLngstWrd_01 1153 0.40 0.41 0.40 189 XMPhish14 1149 0.41 0.45 0.40 190 XMCapTrack 1147 0.36 0.20 0.40 191 MISSING_HEADERS 1137 0.57 1.47 0.39 192 DKIM_ADSP_NXDOMAIN 1127 0.60 1.69 0.39 193 BASE64_LENGTH_79_INF 1096 0.45 0.79 0.38 194 XMBSHREFv2 1085 0.34 0.13 0.38 195 XMNoVowels 1072 0.50 1.15 0.37 196 FILL_THIS_FORM 1069 0.54 1.40 0.37 197 XM_Akamai 1050 0.31 0.01 0.36 198 XM_ShortIntro_01 1003 0.50 1.28 0.35 199 HTML_OBFUSCATE_05_10 997 0.31 0.10 0.35 200 TR_BOTNET_NEGATE 983 0.31 0.16 0.34 ----------------------------------------------------------------------