Email: 407372 Autolearn: 0 AvgScore: 0.78 AvgScanTime: 1.59 sec Spam: 68069 Autolearn: 0 AvgScore: 12.83 AvgScanTime: 2.75 sec Ham: 339303 Autolearn: 0 AvgScore: -1.64 AvgScanTime: 1.36 sec Time Spent Running SA: 180.15 hours Time Spent Processing Spam: 51.91 hours Time Spent Processing Ham: 128.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 66807 98.76 98.15 98.88 2 HTML_MESSAGE 62437 82.75 91.73 80.95 3 DKIM_SIGNED 48916 73.95 71.86 74.37 4 XM_DK_Pass 47765 72.92 70.17 73.47 5 RELAYCOUNTRY_US 42863 74.24 62.97 76.50 6 XM_B_Unicode 42491 67.11 62.42 68.05 7 DKIM_VALID 42335 69.18 62.19 70.59 8 XMListUnsubscribeExists 41992 56.85 61.69 55.88 9 XM_DK_Undo_02 35910 20.07 52.76 13.52 10 DKIM_VALID_AU 31418 54.56 46.16 56.24 11 BAYES_99 29742 15.55 43.69 9.90 12 MIME_HTML_ONLY 27344 24.87 40.17 21.80 13 RELAYCOUNTRY_META 24373 10.37 35.81 5.27 14 BAYES_999 24201 12.57 35.55 7.96 15 DKIM_VALID_EF 22689 26.50 33.33 25.14 16 BAYES_50 21514 43.57 31.61 45.97 17 XM_B_Unicode3 20600 38.62 30.26 40.30 18 BOTNET 19808 6.97 29.10 2.53 19 UNTRUSTED_Relay 18658 6.07 27.41 1.79 20 LOC_TINY_FONT_1 18171 27.31 26.69 27.43 21 XMSubLong 17459 20.22 25.65 19.13 22 XM_UncommonTLD01 16764 7.22 24.63 3.72 23 FVGT_m_MULTI_ODD 16741 22.66 24.59 22.27 24 T_KAM_HTML_FONT_INVALID 15340 18.06 22.54 17.16 25 HTML_FONT_LOW_CONTRAST 14849 27.92 21.81 29.14 26 RCVD_IN_MSPIKE_H2 14335 22.19 21.06 22.42 27 T_TM2_M_HEADER_IN_MSG 12970 20.51 19.05 20.80 28 RCVD_IN_BL_SPAMCOP_NET 11051 4.07 16.23 1.63 29 BOTNET_IPINHOSTNAME 10758 7.54 15.80 5.88 30 LOTS_OF_MONEY 10439 10.21 15.34 9.18 31 XM_Multi_Part_URI 10292 16.84 15.12 17.18 32 RCVD_IN_MSPIKE_BL 10011 2.99 14.71 0.64 33 XM_Body_Dirty_Words 9058 13.61 13.31 13.67 34 XM_B_Unsub 8518 9.73 12.51 9.17 35 HTML_IMAGE_RATIO_02 8168 8.69 12.00 8.02 36 RCVD_IN_RP_RNBL 6797 1.77 9.99 0.12 37 URIBL_SBL_A 6732 2.23 9.89 0.70 38 XM_UB50 6656 2.48 9.78 1.01 39 NO_DNS_FOR_FROM 6606 3.21 9.70 1.91 40 DKIM_INVALID 6581 4.77 9.67 3.78 41 RELAYCOUNTRY_CA 6242 3.35 9.17 2.18 42 TR_XM_MaxBayes 6178 1.76 9.08 0.29 43 XM_CamelCaseFrm001 6013 3.55 8.83 2.49 44 RCVD_IN_PSBL 5817 1.53 8.55 0.12 45 RCVD_IN_MSPIKE_WL 5708 21.85 8.39 24.55 46 HTML_MIME_NO_HTML_TAG 5445 2.98 8.00 1.98 47 BAYES_60 5296 6.64 7.78 6.41 48 BAYES_80 5263 5.24 7.73 4.75 49 XM_UB99 5262 1.30 7.73 0.01 50 T_REMOTE_IMAGE 5122 4.03 7.52 3.32 51 XM_B_Phish_Phrases 5061 7.37 7.44 7.36 52 RCVD_IN_MSPIKE_L3 5012 1.44 7.36 0.25 53 XMSexyCombo_05 4946 5.05 7.27 4.61 54 BOTNET_NORDNS 4698 1.17 6.90 0.02 55 RELAYCOUNTRY_DE 4524 1.43 6.65 0.38 56 BODY_URI_ONLY 4456 1.13 6.55 0.04 57 RCVD_IN_MSPIKE_L5 4383 1.23 6.44 0.18 58 LotsOfNums_01 4347 8.15 6.39 8.50 59 FROM_EXCESS_BASE64 4294 3.88 6.31 3.39 60 SpammyFromTLD_01 4225 1.54 6.21 0.60 61 XMBody_17 4182 2.25 6.14 1.47 62 XM_SPF_SoftFail 4116 1.94 6.05 1.11 63 XM_UB999 3918 0.97 5.76 0.01 64 XM_Evil_Numbers_Gen 3866 8.27 5.68 8.79 65 XM_H_Long_From01 3827 5.48 5.62 5.45 66 SCRIPT_GIBBERISH 3661 0.91 5.38 0.01 67 TR_XM_PhishingBody 3635 3.30 5.34 2.89 68 T_HTML_TAG_BALANCE_CENTER 3627 1.04 5.33 0.17 69 XMSubMetaSx_00 3563 4.37 5.23 4.19 70 HTML_IMAGE_RATIO_06 3546 4.19 5.21 3.98 71 HDRS_MISSP 3510 0.95 5.16 0.10 72 RELAYCOUNTRY_FR 3408 1.07 5.01 0.28 73 RCVD_IN_MSPIKE_H3 3364 12.73 4.94 14.30 74 TooManyTo_001 3355 6.13 4.93 6.38 75 XM_B_SpammyTLD 3346 2.83 4.92 2.41 76 MPART_ALT_DIFF 3277 5.14 4.81 5.21 77 XMBrknScrpt_02 3211 2.11 4.72 1.59 78 T_PDS_OTHER_BAD_TLD 3017 1.36 4.43 0.74 79 SpammyFromTLD_02 3003 0.93 4.41 0.23 80 BAYES_95 2963 3.18 4.35 2.94 81 T_Symld_Words_02 2885 1.01 4.24 0.37 82 HTML_IMAGE_RATIO_04 2875 5.80 4.22 6.12 83 FROM_SUSPICIOUS_NTLD 2792 0.76 4.10 0.08 84 FROM_SUSPICIOUS_NTLD_FP 2727 0.73 4.01 0.08 85 MIME_HTML_MOSTLY 2693 2.90 3.96 2.68 86 XM_DIRTYINTL 2654 1.12 3.90 0.56 87 TR_XM_MaxSPIKE 2633 0.68 3.87 0.04 88 DATE_IN_PAST_06_12 2513 0.83 3.69 0.25 89 XM_B_Phish66 2494 1.72 3.66 1.33 90 T_XMDrugObfuBody_08 2486 2.15 3.65 1.85 91 XM_UB60 2479 0.71 3.64 0.12 92 UNPARSEABLE_RELAY 2375 7.34 3.49 8.11 93 LongTLD 2374 0.73 3.49 0.17 94 HTML_IMAGE_ONLY_16 2341 0.79 3.44 0.26 95 TR_XM_INV_DKIM 2318 0.76 3.41 0.23 96 DATE_IN_PAST_12_24 2297 0.64 3.37 0.09 97 RCVD_IN_MSPIKE_H4 2288 8.08 3.36 9.03 98 TR_XM_COVIDMETA4 2283 1.05 3.35 0.59 99 XM_UB80 2240 0.59 3.29 0.05 100 XM_B_COVIDMETA 2178 2.17 3.20 1.96 101 XM_Combo_Sbj 2157 0.73 3.17 0.24 102 MISSING_HEADERS 2153 0.90 3.16 0.44 103 HK_SCAM 2147 0.56 3.15 0.03 104 XMNumbers 2140 3.21 3.14 3.22 105 TR_Mismatch_TLD_02 2136 0.60 3.14 0.10 106 NUMERIC_HTTP_ADDR 2097 0.88 3.08 0.44 107 XMStrtUSub 2087 3.71 3.07 3.83 108 XM_OfRef6 2048 1.34 3.01 1.01 109 XMSubEmpty 2046 0.67 3.01 0.20 110 KHOP_HELO_FCRDNS 2027 1.41 2.98 1.09 111 XM_JunkDunk 1994 0.49 2.93 0.00 112 DKIM_ADSP_NXDOMAIN 1946 0.84 2.86 0.43 113 T_TooManySym_01 1919 4.71 2.82 5.08 114 HTML_SHORT_LINK_IMG_2 1887 0.50 2.77 0.04 115 HELO_NODOT 1880 1.04 2.76 0.69 116 HELO_NO_DOMAIN 1879 1.04 2.76 0.69 117 NORMAL_HTTP_TO_IP 1870 0.49 2.75 0.04 118 MSGID_FROM_MTA_HEADER 1867 0.63 2.74 0.21 119 XM_SendGrid 1856 6.37 2.73 7.10 120 XM_URI_RBL 1769 0.62 2.60 0.23 121 REPLYTO_WITHOUT_TO_CC 1767 0.60 2.60 0.20 122 DATE_IN_PAST_03_06 1753 0.55 2.58 0.14 123 TR_Sbj_FN_Bdy 1729 0.63 2.54 0.25 124 T_XMHurry_00 1721 1.26 2.53 1.00 125 TR_XM_PHPDW 1664 0.79 2.44 0.45 126 URI_PHP_REDIR 1652 0.50 2.43 0.11 127 TR_XM_PHPForged 1650 0.75 2.42 0.42 128 TR_LOTS_OF_MONEY3 1646 1.36 2.42 1.15 129 XMHTML_After_End 1646 1.07 2.42 0.80 130 TM2_M_URI_OPT_OUT 1637 10.19 2.40 11.75 131 TR_XM_FormFill2 1633 0.74 2.40 0.41 132 XM_H_PHPOS 1623 0.74 2.38 0.41 133 XM_DK_Undo_01 1615 1.60 2.37 1.44 134 SUBJ_ALL_CAPS 1550 1.26 2.28 1.06 135 TR_Mismatch_TLD_01 1474 0.61 2.17 0.30 136 RELAYCOUNTRY_GB 1413 0.95 2.08 0.73 137 T_XMDrugObfuBody_00 1379 1.05 2.03 0.86 138 RELAYCOUNTRY_NG_I 1378 0.34 2.02 0.00 139 XMSubNoVowel 1372 0.95 2.02 0.74 140 URI_WP_DIRINDEX 1316 0.33 1.93 0.01 141 XM_UB95 1313 0.35 1.93 0.03 142 TR_XM_RelayPhish 1308 0.47 1.92 0.18 143 DATE_IN_PAST_24_48 1308 0.34 1.92 0.02 144 BAYES_40 1302 3.73 1.91 4.10 145 TR_Orig_Subnet 1292 0.33 1.90 0.02 146 HTML_IMAGE_RATIO_08 1218 2.25 1.79 2.34 147 URI_TRY_3LD 1217 1.81 1.79 1.81 148 DKIM_ADSP_CUSTOM_MED 1189 1.12 1.75 1.00 149 HK_RANDOM_REPLYTO 1188 0.46 1.75 0.20 150 ADVANCE_FEE_5_NEW 1175 0.29 1.73 0.00 151 MISSING_SUBJECT 1163 0.35 1.71 0.07 152 XMNoSubject 1163 0.35 1.71 0.07 153 T_TooManySym_02 1131 2.48 1.66 2.64 154 MIME_QP_LONG_LINE 1128 4.19 1.66 4.70 155 T_XMDrugObfuBody_14 1118 1.32 1.64 1.26 156 URI_HEX 1096 1.73 1.61 1.75 157 NML_ADSP_CUSTOM_MED 1094 0.87 1.61 0.72 158 AC_DIV_BONANZA 1070 0.38 1.57 0.14 159 MIME_CHARSET_FARAWAY 1051 0.34 1.54 0.10 160 XM_OfRef7 1048 0.35 1.54 0.12 161 TM2_M_VERY_LONG_WORD 1039 1.37 1.53 1.34 162 URI_NO_WWW_INFO_CGI 1038 0.28 1.52 0.03 163 CHARSET_FARAWAY_HEADER 1037 0.29 1.52 0.05 164 XM_B_Unsub2 1023 1.40 1.50 1.38 165 URIBL_DBL_SPAM 1012 0.27 1.49 0.03 166 XMSexyCombo_01 996 0.95 1.46 0.85 167 MIME_HTML_ONLY_MULTI 987 2.86 1.45 3.14 168 BAYES_20 980 3.21 1.44 3.57 169 XM_ShortIntro_01 977 0.56 1.44 0.38 170 RELAYCOUNTRY_NL 973 0.43 1.43 0.23 171 URI_WP_HACKED_2 933 0.26 1.37 0.03 172 T_TooManySym_03 927 0.86 1.36 0.76 173 XMDiploma_00 886 1.14 1.30 1.11 174 XMLngstWrd_00 878 0.61 1.29 0.48 175 FILL_THIS_FORM 854 0.36 1.25 0.18 176 XM_XX_Yahoo 823 0.27 1.21 0.09 177 TVD_SPACE_ENCODED 820 0.20 1.20 0.00 178 TR_XM_COVIDMETA1 817 0.51 1.20 0.37 179 XMStockSpam_06 806 0.88 1.18 0.81 180 ALL_TRUSTED 777 16.33 1.14 19.38 181 XMReplyNow 775 0.26 1.14 0.09 182 XM_ProductURIs 773 1.22 1.14 1.24 183 URIBL_BLACK 763 0.20 1.12 0.01 184 FORGED_GMAIL_RCVD 750 0.64 1.10 0.55 185 XM_H_PHPMailer 737 0.66 1.08 0.57 186 TR_Symld_Words 737 1.59 1.08 1.69 187 MAILING_LIST_MULTI 737 1.75 1.08 1.89 188 RDNS_DYNAMIC 729 0.52 1.07 0.41 189 RELAYCOUNTRY_IT 691 0.20 1.02 0.04 190 TVD_SPACE_RATIO_MINFP 679 0.17 1.00 0.01 191 XMLngstWrd_01 665 0.52 0.98 0.43 192 BASE64_LENGTH_79_INF 658 0.46 0.97 0.36 193 PDS_TINYSUBJ_URISHRT 644 0.17 0.95 0.01 194 TR_XM_DK_SendGrid 634 3.62 0.93 4.16 195 RELAYCOUNTRY_PL 632 0.19 0.93 0.04 196 CHARSET_FARAWAY 624 0.15 0.92 0.00 197 RELAYCOUNTRY_NG 618 0.15 0.91 0.00 198 T_FILL_THIS_FORM_SHORT 608 0.59 0.89 0.53 199 XMHTML_ManyTags1 603 0.15 0.89 0.01 200 XM_HighProb1 599 0.16 0.88 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 335508 98.76 98.15 98.88 2 HTML_MESSAGE 274654 82.75 91.73 80.95 3 RELAYCOUNTRY_US 259576 74.24 62.97 76.50 4 DKIM_SIGNED 252337 73.95 71.86 74.37 5 XM_DK_Pass 249297 72.92 70.17 73.47 6 DKIM_VALID 239498 69.18 62.19 70.59 7 XM_B_Unicode 230898 67.11 62.42 68.05 8 DKIM_VALID_AU 190824 54.56 46.16 56.24 9 XMListUnsubscribeExists 189614 56.85 61.69 55.88 10 BAYES_50 155983 43.57 31.61 45.97 11 XM_B_Unicode3 136724 38.62 30.26 40.30 12 HTML_FONT_LOW_CONTRAST 98876 27.92 21.81 29.14 13 LOC_TINY_FONT_1 93062 27.31 26.69 27.43 14 DKIM_VALID_EF 85284 26.50 33.33 25.14 15 RCVD_IN_MSPIKE_WL 83293 21.85 8.39 24.55 16 RCVD_IN_MSPIKE_H2 76075 22.19 21.06 22.42 17 FVGT_m_MULTI_ODD 75573 22.66 24.59 22.27 18 MIME_HTML_ONLY 73973 24.87 40.17 21.80 19 T_TM2_M_HEADER_IN_MSG 70562 20.51 19.05 20.80 20 ALL_TRUSTED 65755 16.33 1.14 19.38 21 BAYES_00 64920 16.05 0.68 19.13 22 XMSubLong 64915 20.22 25.65 19.13 23 XM_Multi_Part_URI 58309 16.84 15.12 17.18 24 T_KAM_HTML_FONT_INVALID 58228 18.06 22.54 17.16 25 RCVD_IN_MSPIKE_H3 48506 12.73 4.94 14.30 26 XM_Body_Dirty_Words 46378 13.61 13.31 13.67 27 XM_DK_Undo_02 45868 20.07 52.76 13.52 28 TM2_M_URI_OPT_OUT 39867 10.19 2.40 11.75 29 ANY_BOUNCE_MESSAGE 36857 9.10 0.32 10.86 30 BOUNCE_MESSAGE 36857 9.10 0.32 10.86 31 RCVD_IN_RP_SAFE 33831 8.39 0.51 9.97 32 BAYES_99 33592 15.55 43.69 9.90 33 RCVD_IN_RP_CERTIFIED 31751 7.83 0.23 9.36 34 LOTS_OF_MONEY 31158 10.21 15.34 9.18 35 XM_B_Unsub 31121 9.73 12.51 9.17 36 TR_XM_DK_Bayes 31058 7.67 0.29 9.15 37 RCVD_IN_MSPIKE_H4 30630 8.08 3.36 9.03 38 XM_Evil_Numbers_Gen 29830 8.27 5.68 8.79 39 TR_XM_DK_Bayes1 29708 7.32 0.14 8.76 40 LotsOfNums_01 28845 8.15 6.39 8.50 41 XM_DKIMWhitelistDomains 28079 6.89 0.00 8.28 42 TR_XM_DK_Bayes2 27682 6.81 0.12 8.16 43 UNPARSEABLE_RELAY 27509 7.34 3.49 8.11 44 HTML_IMAGE_RATIO_02 27225 8.69 12.00 8.02 45 BAYES_999 26993 12.57 35.55 7.96 46 XM_B_Phish_Phrases 24973 7.37 7.44 7.36 47 XM_SendGrid 24094 6.37 2.73 7.10 48 BAYES_60 21765 6.64 7.78 6.41 49 TooManyTo_001 21633 6.13 4.93 6.38 50 HTML_IMAGE_RATIO_04 20770 5.80 4.22 6.12 51 BOTNET_IPINHOSTNAME 19952 7.54 15.80 5.88 52 XM_H_Long_From01 18505 5.48 5.62 5.45 53 RELAYCOUNTRY_META 17885 10.37 35.81 5.27 54 MPART_ALT_DIFF 17665 5.14 4.81 5.21 55 T_TooManySym_01 17250 4.71 2.82 5.08 56 BAYES_80 16102 5.24 7.73 4.75 57 MIME_QP_LONG_LINE 15938 4.19 1.66 4.70 58 XMSexyCombo_05 15639 5.05 7.27 4.61 59 IN_ZIMBRA_NJ_WHITELIST 14565 3.58 0.02 4.29 60 XMSubMetaSx_00 14226 4.37 5.23 4.19 61 TR_XM_DK_SendGrid 14116 3.62 0.93 4.16 62 BAYES_40 13910 3.73 1.91 4.10 63 HTML_IMAGE_RATIO_06 13512 4.19 5.21 3.98 64 RCVD_IN_IADB_LISTED 13401 3.42 0.75 3.95 65 XMStrtUSub 13012 3.71 3.07 3.83 66 DKIM_INVALID 12839 4.77 9.67 3.78 67 XM_UncommonTLD01 12636 7.22 24.63 3.72 68 BAYES_20 12106 3.21 1.44 3.57 69 RCVD_IN_IADB_SPF 11590 2.96 0.66 3.42 70 FROM_EXCESS_BASE64 11513 3.88 6.31 3.39 71 T_REMOTE_IMAGE 11275 4.03 7.52 3.32 72 BAYES_05 10935 2.81 0.77 3.22 73 XMNumbers 10931 3.21 3.14 3.22 74 MIME_HTML_ONLY_MULTI 10665 2.86 1.45 3.14 75 RCVD_IN_IADB_SENDERID 10096 2.59 0.64 2.98 76 BAYES_95 9990 3.18 4.35 2.94 77 RCVD_IN_IADB_DK 9973 2.55 0.64 2.94 78 TR_XM_PhishingBody 9812 3.30 5.34 2.89 79 MIME_HTML_MOSTLY 9104 2.90 3.96 2.68 80 T_TooManySym_02 8953 2.48 1.66 2.64 81 RCVD_IN_IADB_VOUCHED 8640 2.16 0.23 2.55 82 BOTNET 8579 6.97 29.10 2.53 83 XM_CamelCaseFrm001 8446 3.55 8.83 2.49 84 XM_B_SpammyTLD 8168 2.83 4.92 2.41 85 TVD_RCVD_IP 8127 2.09 0.54 2.40 86 HTML_IMAGE_RATIO_08 7943 2.25 1.79 2.34 87 RELAYCOUNTRY_CA 7409 3.35 9.17 2.18 88 INVALID_MSGID 7395 1.93 0.69 2.18 89 HTML_MIME_NO_HTML_TAG 6709 2.98 8.00 1.98 90 XM_B_COVIDMETA 6654 2.17 3.20 1.96 91 NO_DNS_FOR_FROM 6481 3.21 9.70 1.91 92 TO_MALFORMED 6472 1.59 0.00 1.91 93 MAILING_LIST_MULTI 6398 1.75 1.08 1.89 94 XM_H_Trusted_IP 6337 1.56 0.00 1.87 95 T_XMDrugObfuBody_08 6285 2.15 3.65 1.85 96 URI_TRY_3LD 6141 1.81 1.79 1.81 97 XM_PDF 6126 1.58 0.45 1.81 98 UNTRUSTED_Relay 6070 6.07 27.41 1.79 99 URI_HEX 5949 1.73 1.61 1.75 100 TR_Symld_Words 5730 1.59 1.08 1.69 101 RCVD_IN_BL_SPAMCOP_NET 5547 4.07 16.23 1.63 102 XMBrknScrpt_02 5399 2.11 4.72 1.59 103 RCVD_IN_IADB_OPTIN 5363 1.37 0.33 1.58 104 XMBdyGiftCard01 5346 1.43 0.69 1.58 105 IN_HORDE_ADDRESS_BOOK 5133 1.26 0.02 1.51 106 XMBody_17 5001 2.25 6.14 1.47 107 USER_IN_DEF_DKIM_WL 4961 1.22 0.00 1.46 108 XM_DK_Undo_01 4892 1.60 2.37 1.44 109 XM_B_Unsub2 4675 1.40 1.50 1.38 110 TM2_M_VERY_LONG_WORD 4562 1.37 1.53 1.34 111 XM_B_Phish66 4504 1.72 3.66 1.33 112 T_XMDrugObfuBody_14 4267 1.32 1.64 1.26 113 XM_ProductURIs 4194 1.22 1.14 1.24 114 XM_GoogleGroups 4176 1.08 0.35 1.23 115 RCVD_IN_MSPIKE_H5 4157 1.03 0.08 1.23 116 XMGappySubj_01 4157 1.03 0.07 1.23 117 HTML_FONT_FACE_BAD 4067 1.09 0.53 1.20 118 TooManyTo_002 3955 1.04 0.39 1.17 119 TR_LOTS_OF_MONEY3 3889 1.36 2.42 1.15 120 XMDiploma_00 3776 1.14 1.30 1.11 121 XM_SPF_SoftFail 3776 1.94 6.05 1.11 122 KHOP_HELO_FCRDNS 3699 1.41 2.98 1.09 123 SUBJ_ALL_CAPS 3581 1.26 2.28 1.06 124 XM_H_Long_From02 3497 0.95 0.55 1.03 125 XM_UB50 3429 2.48 9.78 1.01 126 XM_OfRef6 3411 1.34 3.01 1.01 127 T_XMHurry_00 3398 1.26 2.53 1.00 128 DKIM_ADSP_CUSTOM_MED 3378 1.12 1.75 1.00 129 TR_MSPIKEBAYES00 3298 0.81 0.00 0.97 130 T_XMDrugObfuBody_00 2904 1.05 2.03 0.86 131 XMSexyCombo_01 2879 0.95 1.46 0.85 132 TooManyTo_003 2819 0.74 0.28 0.83 133 XMStockSpam_06 2764 0.88 1.18 0.81 134 XMHTML_After_End 2710 1.07 2.42 0.80 135 T_TooManySym_03 2563 0.86 1.36 0.76 136 T_PDS_OTHER_BAD_TLD 2520 1.36 4.43 0.74 137 XMSubNoVowel 2514 0.95 2.02 0.74 138 RELAYCOUNTRY_GB 2475 0.95 2.08 0.73 139 NML_ADSP_CUSTOM_MED 2434 0.87 1.61 0.72 140 HTML_TAG_BALANCE_BODY 2426 0.69 0.56 0.71 141 TR_MetaPhish_Combo_01 2418 0.72 0.75 0.71 142 URIBL_SBL_A 2367 2.23 9.89 0.70 143 HELO_NODOT 2358 1.04 2.76 0.69 144 HELO_NO_DOMAIN 2357 1.04 2.76 0.69 145 TooManyTo_004 2261 0.60 0.25 0.67 146 XM_B_REG_HTML 2238 0.58 0.17 0.66 147 RCVD_IN_MSPIKE_BL 2179 2.99 14.71 0.64 148 SpammyFromTLD_01 2039 1.54 6.21 0.60 149 TR_XM_COVIDMETA4 1994 1.05 3.35 0.59 150 TooManyTo_005 1956 0.51 0.19 0.58 151 XMPhish30 1943 0.61 0.79 0.57 152 XM_H_PHPMailer 1941 0.66 1.08 0.57 153 XMGenDplmaNmb 1934 0.60 0.76 0.57 154 XM_DIRTYINTL 1898 1.12 3.90 0.56 155 XMPhish08 1879 0.55 0.53 0.55 156 FORGED_GMAIL_RCVD 1864 0.64 1.10 0.55 157 USER_IN_WHITELIST 1802 0.44 0.00 0.53 158 XM_RXBody 1794 0.51 0.42 0.53 159 T_FILL_THIS_FORM_SHORT 1787 0.59 0.89 0.53 160 SUBJ_DOLLARS 1742 0.46 0.21 0.51 161 XM_B_COPY_HTML 1712 0.50 0.47 0.50 162 HTML_OBFUSCATE_05_10 1694 0.44 0.15 0.50 163 XMSubMetaSxObfu_02 1650 0.44 0.21 0.49 164 XMSubMetaI_00 1635 0.52 0.70 0.48 165 XMHTMLBadTable_001 1626 0.47 0.42 0.48 166 XMBody_95 1625 0.41 0.06 0.48 167 XMBody_78 1621 0.49 0.54 0.48 168 PLING_QUERY 1618 0.44 0.25 0.48 169 XMLngstWrd_00 1612 0.61 1.29 0.48 170 TR_XM_PHPDW 1539 0.79 2.44 0.45 171 MPART_ALT_DIFF_COUNT 1522 0.51 0.81 0.45 172 XMPhish14 1508 0.43 0.35 0.44 173 MISSING_HEADERS 1503 0.90 3.16 0.44 174 XMSolicitRefs_0 1495 0.42 0.31 0.44 175 NUMERIC_HTTP_ADDR 1484 0.88 3.08 0.44 176 DKIM_ADSP_NXDOMAIN 1473 0.84 2.86 0.43 177 HTTPS_HTTP_MISMATCH 1468 0.44 0.48 0.43 178 TM2_M_A_HREF_HREF 1455 0.44 0.47 0.43 179 DIET_1 1455 0.48 0.76 0.43 180 XMLngstWrd_01 1445 0.52 0.98 0.43 181 TR_XM_PHPForged 1420 0.75 2.42 0.42 182 RDNS_DYNAMIC 1407 0.52 1.07 0.41 183 TR_XM_FormFill2 1399 0.74 2.40 0.41 184 HTML_IMAGE_ONLY_20 1397 0.39 0.29 0.41 185 XM_H_PHPOS 1387 0.74 2.38 0.41 186 XMSubMetaSxObfu_03 1364 0.46 0.77 0.40 187 XMCapTrack 1335 0.40 0.45 0.39 188 RELAYCOUNTRY_DE 1298 1.43 6.65 0.38 189 XM_ShortIntro_01 1291 0.56 1.44 0.38 190 TR_XM_COVIDMETA1 1271 0.51 1.20 0.37 191 T_Symld_Words_02 1242 1.01 4.24 0.37 192 URI_NOVOWEL 1242 0.42 0.71 0.37 193 BASE64_LENGTH_79_INF 1230 0.46 0.97 0.36 194 XMSlimDrugH 1230 0.39 0.51 0.36 195 XMBSHREFv2 1205 0.32 0.12 0.36 196 HTML_TEXT_INVISIBLE_STYLE 1191 0.36 0.38 0.35 197 XMLngstWrd_02 1184 0.40 0.63 0.35 198 XM_SPF_Unknown 1150 0.35 0.40 0.34 199 T_OBFU_PDF_ATTACH 1136 0.29 0.05 0.33 200 T_TooManySym_04 1131 0.31 0.22 0.33 ----------------------------------------------------------------------