Email: 652216 Autolearn: 0 AvgScore: 0.51 AvgScanTime: 1.81 sec Spam: 101269 Autolearn: 0 AvgScore: 12.15 AvgScanTime: 3.36 sec Ham: 550947 Autolearn: 0 AvgScore: -1.63 AvgScanTime: 1.52 sec Time Spent Running SA: 327.30 hours Time Spent Processing Spam: 94.53 hours Time Spent Processing Ham: 232.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 98853 98.06 97.61 98.14 2 HTML_MESSAGE 92698 87.82 91.54 87.14 3 RELAYCOUNTRY_US 67796 76.10 66.95 77.78 4 DKIM_SIGNED 65422 70.29 64.60 71.33 5 XM_DK_Pass 63403 69.11 62.61 70.30 6 XM_B_Unicode 63046 66.90 62.26 67.76 7 DKIM_VALID 53100 63.95 52.43 66.07 8 XMListUnsubscribeExists 51478 47.12 50.83 46.44 9 BAYES_50 46715 52.84 46.13 54.08 10 XM_DK_Undo_02 39400 14.87 38.91 10.45 11 DKIM_VALID_AU 39236 47.24 38.74 48.80 12 MIME_HTML_ONLY 39052 23.05 38.56 20.20 13 BAYES_99 31716 10.41 31.32 6.56 14 XM_B_Unicode3 30831 34.94 30.44 35.77 15 RELAYCOUNTRY_META 28431 9.49 28.07 6.07 16 FVGT_m_MULTI_ODD 27868 21.39 27.52 20.26 17 DKIM_VALID_EF 27770 26.32 27.42 26.12 18 BOTNET 27489 6.66 27.14 2.89 19 BAYES_999 25425 8.25 25.11 5.15 20 XMSubLong 25149 21.09 24.83 20.40 21 LOC_TINY_FONT_1 24485 21.78 24.18 21.34 22 UNTRUSTED_Relay 24162 5.39 23.86 2.00 23 RCVD_IN_MSPIKE_H2 23274 23.60 22.98 23.71 24 HTML_FONT_LOW_CONTRAST 20627 23.83 20.37 24.47 25 T_TM2_M_HEADER_IN_MSG 19833 28.71 19.58 30.38 26 T_KAM_HTML_FONT_INVALID 18449 17.12 18.22 16.91 27 LOTS_OF_MONEY 17950 11.16 17.73 9.95 28 XM_Body_Dirty_Words 16516 12.72 16.31 12.06 29 HTML_MIME_NO_HTML_TAG 16092 4.58 15.89 2.50 30 BOTNET_IPINHOSTNAME 16076 6.53 15.87 4.81 31 RCVD_IN_MSPIKE_BL 15629 3.04 15.43 0.76 32 XM_Multi_Part_URI 14829 12.84 14.64 12.50 33 XM_UncommonTLD01 13849 4.79 13.68 3.15 34 DKIM_INVALID 12322 6.34 12.17 5.27 35 XM_B_Phish_Phrases 10783 6.65 10.65 5.92 36 XM_UB50 10763 2.65 10.63 1.18 37 XM_B_Unsub 10336 11.24 10.21 11.43 38 LotsOfNums_01 10294 8.72 10.17 8.45 39 T_REMOTE_IMAGE 10005 4.63 9.88 3.66 40 XMSexyCombo_05 9899 4.93 9.77 4.04 41 SUBJ_ALL_CAPS 9859 3.08 9.74 1.86 42 MISSING_HEADERS 9571 2.41 9.45 1.11 43 HELO_NODOT 9562 3.03 9.44 1.85 44 HELO_NO_DOMAIN 9558 3.03 9.44 1.85 45 NO_DNS_FOR_FROM 9348 3.67 9.23 2.65 46 BODY_URI_ONLY 9220 1.56 9.10 0.18 47 REPLYTO_WITHOUT_TO_CC 9074 1.64 8.96 0.30 48 HTML_IMAGE_RATIO_02 8634 6.51 8.53 6.14 49 TR_XM_COVIDMETA4 8480 1.92 8.37 0.73 50 T_HTML_TAG_BALANCE_CENTER 8418 1.58 8.31 0.35 51 TR_XM_PhishingBody 8293 3.93 8.19 3.15 52 XM_Evil_Numbers_Gen 8113 8.50 8.01 8.59 53 TR_LOTS_OF_MONEY1 7617 1.36 7.52 0.23 54 RCVD_IN_BL_SPAMCOP_NET 7466 2.32 7.37 1.39 55 XM_DK_Undo_01 7421 2.53 7.33 1.65 56 BAYES_80 7139 4.40 7.05 3.91 57 FROM_EXCESS_BASE64 7050 3.23 6.96 2.54 58 RCVD_IN_MSPIKE_WL 6818 20.69 6.73 23.26 59 BAYES_60 6651 6.18 6.57 6.11 60 RCVD_IN_MSPIKE_ZBI 6617 1.20 6.53 0.22 61 XM_B_Phish66 6527 2.61 6.45 1.91 62 TR_Sbj_FN_Bdy 6448 1.23 6.37 0.28 63 XMSubEmpty 6210 1.21 6.13 0.31 64 RELAYCOUNTRY_CA 6139 2.49 6.06 1.84 65 XM_B_COVIDMETA 6069 2.29 5.99 1.61 66 RCVD_IN_MSPIKE_L3 5849 1.23 5.78 0.39 67 XMNoSubject 5842 1.01 5.77 0.14 68 MISSING_SUBJECT 5842 1.01 5.77 0.14 69 XM_UB99 5808 0.90 5.74 0.01 70 DEAR_SOMETHING 5783 1.09 5.71 0.24 71 HDRS_MISSP 5772 0.96 5.70 0.08 72 XM_SPF_SoftFail 5756 2.37 5.68 1.76 73 XMSubMetaSx_00 5653 3.50 5.58 3.12 74 BOTNET_NORDNS 5613 0.88 5.54 0.02 75 RCVD_IN_RP_RNBL 5397 0.89 5.33 0.07 76 TooManyTo_001 5364 8.79 5.30 9.43 77 SpammyFromTLD_01 5295 1.58 5.23 0.91 78 XM_OfRef6 5060 1.58 5.00 0.95 79 XMNumbers 4905 3.20 4.84 2.90 80 HTML_IMAGE_RATIO_04 4898 4.77 4.84 4.76 81 XM_H_Long_From01 4740 5.20 4.68 5.29 82 RELAYCOUNTRY_FR 4595 0.98 4.54 0.33 83 XM_UB999 4535 0.70 4.48 0.00 84 SCRIPT_GIBBERISH 4426 0.68 4.37 0.01 85 XMSubject_63 4425 0.68 4.37 0.00 86 UNPARSEABLE_RELAY 4398 6.52 4.34 6.93 87 XM_B_SpammyTLD 4384 1.96 4.33 1.52 88 XMLngstWrd_00 4374 0.94 4.32 0.32 89 RELAYCOUNTRY_NG_I 4235 0.65 4.18 0.00 90 XM_BadFromFormat 4126 0.89 4.07 0.30 91 MPART_ALT_DIFF 4077 4.46 4.03 4.54 92 KHOP_HELO_FCRDNS 4030 2.26 3.98 1.95 93 SpammyFromTLD_02 3856 0.93 3.81 0.40 94 T_XMDrugObfuBody_08 3850 1.99 3.80 1.65 95 RCVD_IN_MSPIKE_H3 3844 12.12 3.80 13.65 96 XM_DIRTYINTL 3686 1.05 3.64 0.57 97 BAYES_95 3676 2.59 3.63 2.40 98 TR_XM_INV_DKIM 3635 0.69 3.59 0.15 99 XM_SendGrid 3485 5.85 3.44 6.30 100 TR_XM_MaxSPIKE 3449 0.54 3.41 0.02 101 XMStrtUSub 3443 4.77 3.40 5.02 102 MIME_HTML_MOSTLY 3308 2.39 3.27 2.23 103 RELAYCOUNTRY_DE 3214 0.83 3.17 0.40 104 XM_URI_RBL 3152 0.67 3.11 0.22 105 TM2_M_URI_OPT_OUT 3051 5.39 3.01 5.83 106 HTML_IMAGE_ONLY_08 3014 0.64 2.98 0.22 107 HTML_SHORT_LINK_IMG_1 2999 0.57 2.96 0.13 108 XMLngstWrd_01 2966 0.69 2.93 0.28 109 T_TooManySym_01 2938 3.63 2.90 3.77 110 HDRS_LCASE_IMGONLY 2916 0.56 2.88 0.13 111 RCVD_IN_MSPIKE_H4 2900 7.60 2.86 8.47 112 TR_Mismatch_TLD_01 2900 0.64 2.86 0.24 113 RCVD_IN_PSBL 2894 0.48 2.86 0.05 114 XM_OfRef7 2891 0.60 2.85 0.19 115 XM_JunkDunk 2845 0.44 2.81 0.00 116 XM_UB80 2829 0.48 2.79 0.05 117 HTML_IMAGE_RATIO_06 2770 3.87 2.74 4.08 118 TR_LOTS_OF_MONEY3 2696 0.82 2.66 0.48 119 TR_XM_COVIDMETA1 2687 0.73 2.65 0.38 120 HK_SCAM 2658 0.43 2.62 0.03 121 TR_XM_PHPDW 2648 0.94 2.61 0.63 122 TR_XM_PHPForged 2624 0.92 2.59 0.61 123 TR_XM_FormFill2 2600 0.91 2.57 0.61 124 XM_H_PHPOS 2591 0.91 2.56 0.60 125 XMBrknScrpt_02 2503 1.10 2.47 0.84 126 MIME_QP_LONG_LINE 2447 5.14 2.42 5.64 127 XM_CamelCaseFrm001 2443 2.01 2.41 1.93 128 XM_B_Unsub2 2431 3.48 2.40 3.68 129 TR_XM_RelayPhish 2421 0.50 2.39 0.15 130 HTML_IMAGE_RATIO_08 2358 2.35 2.33 2.36 131 TR_Mismatch_TLD_02 2326 0.44 2.30 0.09 132 FROM_SUSPICIOUS_NTLD 2305 0.41 2.28 0.06 133 RCVD_IN_MSPIKE_L5 2255 0.42 2.23 0.09 134 XM_UB60 2252 0.46 2.22 0.13 135 FILL_THIS_FORM 2241 0.55 2.21 0.24 136 RELAYCOUNTRY_GB 2219 1.31 2.19 1.15 137 FROM_SUSPICIOUS_NTLD_FP 2217 0.39 2.19 0.06 138 T_PDS_OTHER_BAD_TLD 2053 0.49 2.03 0.20 139 TR_Symld_Words 2052 1.83 2.03 1.80 140 MAILING_LIST_MULTI 2042 2.26 2.02 2.30 141 BAYES_40 1943 4.73 1.92 5.24 142 DKIM_ADSP_CUSTOM_MED 1899 1.30 1.88 1.19 143 ALL_TRUSTED 1815 15.47 1.79 17.98 144 XMDiploma_00 1811 1.42 1.79 1.36 145 XMBody_17 1800 0.79 1.78 0.61 146 XMStockSpam_06 1771 1.21 1.75 1.11 147 XMSexyCombo_01 1765 0.68 1.74 0.48 148 URIBL_SBL_A 1752 0.38 1.73 0.13 149 URI_HEX 1746 1.46 1.72 1.41 150 HTML_IMAGE_ONLY_16 1730 0.54 1.71 0.33 151 URI_PHP_REDIR 1725 0.32 1.70 0.07 152 NML_ADSP_CUSTOM_MED 1724 1.02 1.70 0.89 153 TM2_M_VERY_LONG_WORD 1724 1.11 1.70 1.00 154 T_FILL_THIS_FORM_SHORT 1712 0.97 1.69 0.84 155 PDS_NAKED_TO_NUMERO 1691 0.26 1.67 0.00 156 BAYES_20 1647 3.49 1.63 3.83 157 T_XMDrugObfuBody_00 1640 0.71 1.62 0.54 158 RELAYCOUNTRY_IN 1602 0.53 1.58 0.34 159 MIME_HTML_ONLY_MULTI 1590 2.70 1.57 2.90 160 XMLngstWrd_02 1561 0.43 1.54 0.22 161 FORGED_GMAIL_RCVD 1526 0.70 1.51 0.55 162 TR_XM_MaxBayes 1523 0.26 1.50 0.03 163 T_TooManySym_02 1490 1.86 1.47 1.93 164 URG_BIZ 1483 0.42 1.46 0.23 165 T_Symld_Words_02 1470 0.68 1.45 0.54 166 XM_UB95 1421 0.24 1.40 0.02 167 T_XMDrugObfuBody_14 1394 1.41 1.38 1.42 168 DKIM_ADSP_NXDOMAIN 1365 0.47 1.35 0.31 169 XMGppyBdWords 1359 0.32 1.34 0.14 170 ADVANCE_FEE_2_NEW_MONEY 1349 0.22 1.33 0.01 171 DATE_IN_PAST_06_12 1341 0.31 1.32 0.12 172 LongTLD 1296 0.39 1.28 0.22 173 TR_XM_DK_SendGrid 1282 3.21 1.27 3.57 174 HK_RANDOM_FROM 1272 0.32 1.26 0.15 175 DATE_IN_PAST_03_06 1252 0.33 1.24 0.16 176 HTML_SHORT_LINK_IMG_2 1250 0.23 1.23 0.04 177 XM_XX_Yahoo 1246 0.22 1.23 0.03 178 RDNS_DYNAMIC 1244 0.48 1.23 0.35 179 XMSubNoVowel 1238 1.03 1.22 1.00 180 XMHTML_After_End 1231 0.70 1.22 0.60 181 DIET_1 1173 0.49 1.16 0.37 182 XMDateMe_00 1172 0.47 1.16 0.34 183 XM_PDF 1157 3.87 1.14 4.37 184 XMGenDplmaNmb 1148 0.86 1.13 0.81 185 MIME_CHARSET_FARAWAY 1138 0.27 1.12 0.11 186 URI_NO_WWW_INFO_CGI 1137 0.20 1.12 0.04 187 XM_OfRef8 1091 0.19 1.08 0.02 188 TR_MetaPhish_Combo_01 1072 0.86 1.06 0.82 189 XM_H_PHPMailer 1066 0.65 1.05 0.58 190 T_XMHurry_00 1054 3.25 1.04 3.66 191 XM_H_Undi_Recip 1048 0.36 1.03 0.23 192 CHARSET_FARAWAY_HEADER 1046 0.20 1.03 0.05 193 ANY_BOUNCE_MESSAGE 1027 4.87 1.01 5.57 194 BOUNCE_MESSAGE 1027 4.86 1.01 5.57 195 RELAYCOUNTRY_NL 1021 0.37 1.01 0.25 196 FILL_THIS_FORM_LONG 1021 0.23 1.01 0.09 197 XMBody_78 1016 0.47 1.00 0.37 198 URI_OPTOUT_3LD 985 0.37 0.97 0.25 199 URI_NOVOWEL 981 0.53 0.97 0.45 200 URIBL_BLACK 965 0.17 0.95 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 540716 98.06 97.61 98.14 2 HTML_MESSAGE 480080 87.82 91.54 87.14 3 RELAYCOUNTRY_US 428525 76.10 66.95 77.78 4 DKIM_SIGNED 393017 70.29 64.60 71.33 5 XM_DK_Pass 387325 69.11 62.61 70.30 6 XM_B_Unicode 373308 66.90 62.26 67.76 7 DKIM_VALID 364008 63.95 52.43 66.07 8 BAYES_50 297935 52.84 46.13 54.08 9 DKIM_VALID_AU 268880 47.24 38.74 48.80 10 XMListUnsubscribeExists 255844 47.12 50.83 46.44 11 XM_B_Unicode3 197084 34.94 30.44 35.77 12 T_TM2_M_HEADER_IN_MSG 167398 28.71 19.58 30.38 13 DKIM_VALID_EF 143910 26.32 27.42 26.12 14 HTML_FONT_LOW_CONTRAST 134824 23.83 20.37 24.47 15 RCVD_IN_MSPIKE_H2 130628 23.60 22.98 23.71 16 RCVD_IN_MSPIKE_WL 128143 20.69 6.73 23.26 17 LOC_TINY_FONT_1 117560 21.78 24.18 21.34 18 XMSubLong 112386 21.09 24.83 20.40 19 FVGT_m_MULTI_ODD 111617 21.39 27.52 20.26 20 MIME_HTML_ONLY 111309 23.05 38.56 20.20 21 ALL_TRUSTED 99073 15.47 1.79 17.98 22 T_KAM_HTML_FONT_INVALID 93189 17.12 18.22 16.91 23 BAYES_00 84164 13.03 0.82 15.28 24 RCVD_IN_MSPIKE_H3 75182 12.12 3.80 13.65 25 XM_Multi_Part_URI 68893 12.84 14.64 12.50 26 XM_Body_Dirty_Words 66451 12.72 16.31 12.06 27 XM_B_Unsub 62965 11.24 10.21 11.43 28 XM_DK_Undo_02 57555 14.87 38.91 10.45 29 LOTS_OF_MONEY 54811 11.16 17.73 9.95 30 TooManyTo_001 51954 8.79 5.30 9.43 31 XM_Evil_Numbers_Gen 47326 8.50 8.01 8.59 32 RCVD_IN_MSPIKE_H4 46687 7.60 2.86 8.47 33 LotsOfNums_01 46556 8.72 10.17 8.45 34 TR_XM_DK_Bayes 45993 7.10 0.30 8.35 35 TR_XM_DK_Bayes1 42556 6.56 0.22 7.72 36 IN_ZIMBRA_NJ_WHITELIST 38619 5.93 0.03 7.01 37 UNPARSEABLE_RELAY 38158 6.52 4.34 6.93 38 TR_XM_DK_Bayes2 36830 5.68 0.20 6.68 39 BAYES_99 36151 10.41 31.32 6.56 40 XM_SendGrid 34695 5.85 3.44 6.30 41 RCVD_IN_RP_SAFE 33952 5.32 0.76 6.16 42 HTML_IMAGE_RATIO_02 33838 6.51 8.53 6.14 43 BAYES_60 33654 6.18 6.57 6.11 44 RELAYCOUNTRY_META 33467 9.49 28.07 6.07 45 XM_DKIMWhitelistDomains 33399 5.12 0.00 6.06 46 XM_B_Phish_Phrases 32589 6.65 10.65 5.92 47 TM2_M_URI_OPT_OUT 32133 5.39 3.01 5.83 48 MIME_QP_LONG_LINE 31097 5.14 2.42 5.64 49 RCVD_IN_RP_CERTIFIED 30952 4.80 0.38 5.62 50 ANY_BOUNCE_MESSAGE 30711 4.87 1.01 5.57 51 BOUNCE_MESSAGE 30695 4.86 1.01 5.57 52 XM_H_Long_From01 29164 5.20 4.68 5.29 53 DKIM_INVALID 29009 6.34 12.17 5.27 54 BAYES_40 28875 4.73 1.92 5.24 55 BAYES_999 28380 8.25 25.11 5.15 56 RCVD_IN_IADB_LISTED 28032 4.42 0.80 5.09 57 XMStrtUSub 27685 4.77 3.40 5.02 58 BOTNET_IPINHOSTNAME 26508 6.53 15.87 4.81 59 HTML_IMAGE_RATIO_04 26239 4.77 4.84 4.76 60 MPART_ALT_DIFF 25000 4.46 4.03 4.54 61 RCVD_IN_IADB_SPF 24370 3.85 0.73 4.42 62 XM_PDF 24098 3.87 1.14 4.37 63 HTML_IMAGE_RATIO_06 22460 3.87 2.74 4.08 64 XMSexyCombo_05 22249 4.93 9.77 4.04 65 BAYES_80 21568 4.40 7.05 3.91 66 RCVD_IN_IADB_SENDERID 21568 3.41 0.68 3.91 67 RCVD_IN_IADB_DK 21130 3.35 0.69 3.84 68 BAYES_20 21109 3.49 1.63 3.83 69 T_TooManySym_01 20756 3.63 2.90 3.77 70 XM_B_Unsub2 20280 3.48 2.40 3.68 71 T_XMHurry_00 20175 3.25 1.04 3.66 72 T_REMOTE_IMAGE 20168 4.63 9.88 3.66 73 TR_XM_DK_SendGrid 19650 3.21 1.27 3.57 74 RCVD_IN_IADB_VOUCHED 17897 2.80 0.38 3.25 75 XM_UncommonTLD01 17365 4.79 13.68 3.15 76 TR_XM_PhishingBody 17340 3.93 8.19 3.15 77 XMSubMetaSx_00 17168 3.50 5.58 3.12 78 MIME_HTML_ONLY_MULTI 15988 2.70 1.57 2.90 79 XMNumbers 15975 3.20 4.84 2.90 80 BOTNET 15935 6.66 27.14 2.89 81 NO_DNS_FOR_FROM 14583 3.67 9.23 2.65 82 BAYES_05 14224 2.32 0.87 2.58 83 FROM_EXCESS_BASE64 14002 3.23 6.96 2.54 84 XM_H_Trusted_IP 13974 2.14 0.00 2.54 85 HTML_MIME_NO_HTML_TAG 13788 4.58 15.89 2.50 86 BAYES_95 13242 2.59 3.63 2.40 87 HTML_IMAGE_RATIO_08 12995 2.35 2.33 2.36 88 MAILING_LIST_MULTI 12677 2.26 2.02 2.30 89 MIME_HTML_MOSTLY 12269 2.39 3.27 2.23 90 RCVD_IN_IADB_OPTIN 11724 1.86 0.40 2.13 91 TooManyTo_002 11381 1.86 0.74 2.07 92 UNTRUSTED_Relay 10993 5.39 23.86 2.00 93 KHOP_HELO_FCRDNS 10728 2.26 3.98 1.95 94 XM_CamelCaseFrm001 10658 2.01 2.41 1.93 95 T_TooManySym_02 10643 1.86 1.47 1.93 96 XM_B_Phish66 10500 2.61 6.45 1.91 97 SUBJ_ALL_CAPS 10256 3.08 9.74 1.86 98 HELO_NODOT 10190 3.03 9.44 1.85 99 HELO_NO_DOMAIN 10186 3.03 9.44 1.85 100 RELAYCOUNTRY_CA 10112 2.49 6.06 1.84 101 TR_Symld_Words 9891 1.83 2.03 1.80 102 XM_SPF_SoftFail 9711 2.37 5.68 1.76 103 TVD_RCVD_IP 9520 1.52 0.37 1.73 104 T_XMDrugObfuBody_08 9111 1.99 3.80 1.65 105 XM_DK_Undo_01 9095 2.53 7.33 1.65 106 XM_B_COVIDMETA 8853 2.29 5.99 1.61 107 XM_B_SpammyTLD 8381 1.96 4.33 1.52 108 INVALID_MSGID 8141 1.33 0.55 1.48 109 T_XMDrugObfuBody_14 7832 1.41 1.38 1.42 110 URI_HEX 7748 1.46 1.72 1.41 111 RCVD_IN_BL_SPAMCOP_NET 7685 2.32 7.37 1.39 112 TooManyTo_003 7651 1.26 0.57 1.39 113 XMDiploma_00 7479 1.42 1.79 1.36 114 IN_HORDE_ADDRESS_BOOK 7432 1.14 0.02 1.35 115 XMCapTrack 6836 1.16 0.70 1.24 116 XM_GoogleGroups 6593 1.07 0.37 1.20 117 DKIM_ADSP_CUSTOM_MED 6576 1.30 1.88 1.19 118 TO_MALFORMED 6522 1.00 0.02 1.18 119 XM_UB50 6497 2.65 10.63 1.18 120 URI_TRY_3LD 6486 1.11 0.73 1.18 121 RELAYCOUNTRY_GB 6326 1.31 2.19 1.15 122 RCVD_IN_MSPIKE_H5 6274 0.97 0.07 1.14 123 MISSING_HEADERS 6129 2.41 9.45 1.11 124 XMStockSpam_06 6121 1.21 1.75 1.11 125 TooManyTo_004 5773 0.96 0.49 1.05 126 XM_H_Long_From02 5744 1.02 0.87 1.04 127 USER_IN_DEF_DKIM_WL 5554 0.85 0.00 1.01 128 TM2_M_VERY_LONG_WORD 5514 1.11 1.70 1.00 129 XMSubNoVowel 5502 1.03 1.22 1.00 130 XMGappySubj_01 5293 0.83 0.14 0.96 131 XM_OfRef6 5242 1.58 5.00 0.95 132 SpammyFromTLD_01 5008 1.58 5.23 0.91 133 NML_ADSP_CUSTOM_MED 4928 1.02 1.70 0.89 134 TooManyTo_005 4802 0.80 0.40 0.87 135 XMBrknScrpt_02 4641 1.10 2.47 0.84 136 T_FILL_THIS_FORM_SHORT 4640 0.97 1.69 0.84 137 HTML_FONT_FACE_BAD 4556 0.79 0.57 0.83 138 TR_MetaPhish_Combo_01 4529 0.86 1.06 0.82 139 T_OBFU_PDF_ATTACH 4492 0.73 0.29 0.82 140 TR_MSPIKEBAYES00 4490 0.69 0.00 0.81 141 XMGenDplmaNmb 4473 0.86 1.13 0.81 142 XMBdyGiftCard01 4372 0.80 0.85 0.79 143 RCVD_IN_MSPIKE_BL 4207 3.04 15.43 0.76 144 XM_ProductURIs 4068 0.74 0.75 0.74 145 XMMoneyMeta_00 4053 0.75 0.81 0.74 146 TR_XM_COVIDMETA4 4021 1.92 8.37 0.73 147 HTTPS_HTTP_MISMATCH 3804 0.68 0.64 0.69 148 XM_SPF_Unknown 3672 0.66 0.60 0.67 149 TR_XM_PHPDW 3459 0.94 2.61 0.63 150 T_TooManySym_03 3448 0.67 0.92 0.63 151 TR_XM_FormFill2 3361 0.91 2.57 0.61 152 TR_XM_PHPForged 3359 0.92 2.59 0.61 153 XMBody_17 3341 0.79 1.78 0.61 154 XM_H_PHPOS 3327 0.91 2.56 0.60 155 XMHTML_After_End 3308 0.70 1.22 0.60 156 FROM_GOV_DKIM_AU 3277 0.51 0.07 0.59 157 XM_H_PHPMailer 3173 0.65 1.05 0.58 158 XM_DIRTYINTL 3147 1.05 3.64 0.57 159 XM_ShortIntro_01 3026 0.58 0.77 0.55 160 FORGED_GMAIL_RCVD 3014 0.70 1.51 0.55 161 T_XMDrugObfuBody_00 2961 0.71 1.62 0.54 162 T_Symld_Words_02 2956 0.68 1.45 0.54 163 XMNoVowels 2943 0.57 0.80 0.53 164 XMSubMetaI_00 2880 0.53 0.58 0.52 165 XM_RXBody 2781 0.53 0.67 0.50 166 FROM_GOV_SPOOF 2688 0.47 0.36 0.49 167 XMSexyCombo_01 2646 0.68 1.74 0.48 168 TR_LOTS_OF_MONEY3 2622 0.82 2.66 0.48 169 HTML_IMAGE_ONLY_20 2606 0.46 0.40 0.47 170 XM_Body_Obfu01 2588 0.43 0.20 0.47 171 XMSubMetaSxObfu_02 2586 0.49 0.57 0.47 172 HTML_IMAGE_ONLY_28 2571 0.44 0.28 0.47 173 RCVD_IN_SORBS_DUL 2561 0.45 0.36 0.46 174 RELAYCOUNTRY_AU 2540 0.49 0.64 0.46 175 URI_NOVOWEL 2464 0.53 0.97 0.45 176 XMPhish08 2460 0.48 0.67 0.45 177 HTML_IMAGE_ONLY_32 2444 0.42 0.30 0.44 178 TM2_M_BODY_EMPTY 2393 0.38 0.09 0.43 179 XM_B_REG_HTML 2348 0.40 0.25 0.43 180 XMHTMLBadTable_001 2305 0.41 0.35 0.42 181 XMSubMetaSxObfu_03 2302 0.50 0.94 0.42 182 XMPhish30 2275 0.45 0.67 0.41 183 SHORT_HELO_AND_INLINE_IMAGE 2263 0.36 0.08 0.41 184 TM2_M_A_HREF_HREF 2250 0.44 0.60 0.41 185 RELAYCOUNTRY_DE 2226 0.83 3.17 0.40 186 HTML_TAG_BALANCE_BODY 2213 0.43 0.56 0.40 187 TVD_SPACE_RATIO 2208 0.42 0.56 0.40 188 XMBody_95 2202 0.36 0.14 0.40 189 SpammyFromTLD_02 2198 0.93 3.81 0.40 190 SUBJ_DOLLARS 2179 0.40 0.42 0.40 191 RCVD_IN_MSPIKE_L3 2161 1.23 5.78 0.39 192 TR_XM_COVIDMETA1 2094 0.73 2.65 0.38 193 XMBody_78 2064 0.47 1.00 0.37 194 TR_BOTNET_NEGATE 2058 0.34 0.18 0.37 195 USER_IN_WHITELIST 2039 0.31 0.00 0.37 196 XMPhish14 2031 0.39 0.49 0.37 197 DIET_1 2026 0.49 1.16 0.37 198 NUMERIC_HTTP_ADDR 1977 0.41 0.68 0.36 199 AC_DIV_BONANZA 1930 0.34 0.30 0.35 200 RDNS_DYNAMIC 1908 0.48 1.23 0.35 ----------------------------------------------------------------------