Email: 787523 Autolearn: 0 AvgScore: 0.20 AvgScanTime: 1.94 sec Spam: 97137 Autolearn: 0 AvgScore: 13.12 AvgScanTime: 4.34 sec Ham: 690386 Autolearn: 0 AvgScore: -1.62 AvgScanTime: 1.61 sec Time Spent Running SA: 425.19 hours Time Spent Processing Spam: 117.05 hours Time Spent Processing Ham: 308.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 94379 98.28 97.16 98.44 2 HTML_MESSAGE 90990 78.66 93.67 76.54 3 XM_B_Unicode 74819 61.66 77.02 59.50 4 DKIM_SIGNED 70917 65.86 73.01 64.86 5 XM_DK_Pass 68264 64.55 70.28 63.74 6 RELAYCOUNTRY_US 63470 69.37 65.34 69.93 7 XMListUnsubscribeExists 62716 47.08 64.56 44.62 8 DKIM_VALID 54347 59.09 55.95 59.53 9 XM_DK_Undo_02 48502 15.30 49.93 10.43 10 DKIM_VALID_AU 39337 44.70 40.50 45.29 11 BAYES_99 38956 10.86 40.10 6.74 12 XM_B_Unicode3 35753 34.61 36.81 34.30 13 MIME_HTML_ONLY 35309 19.71 36.35 17.37 14 BAYES_50 33475 45.45 34.46 46.99 15 RELAYCOUNTRY_META 33409 8.18 34.39 4.49 16 BOTNET 33037 6.68 34.01 2.84 17 BAYES_999 30735 8.67 31.64 5.44 18 LOC_TINY_FONT_1 29681 22.66 30.56 21.55 19 RCVD_IN_MSPIKE_H2 24869 20.78 25.60 20.10 20 DKIM_VALID_EF 24767 23.30 25.50 22.99 21 HTML_FONT_LOW_CONTRAST 24672 22.56 25.40 22.16 22 FVGT_m_MULTI_ODD 24501 20.29 25.22 19.60 23 UNTRUSTED_Relay 23263 4.25 23.95 1.47 24 XMSubLong 21769 19.03 22.41 18.55 25 XM_UncommonTLD01 20954 4.87 21.57 2.52 26 T_KAM_HTML_FONT_INVALID 20529 16.32 21.13 15.64 27 T_TM2_M_HEADER_IN_MSG 20084 23.32 20.68 23.69 28 XM_Body_Dirty_Words 17765 12.30 18.29 11.45 29 BOTNET_IPINHOSTNAME 17326 6.00 17.84 4.34 30 XM_Multi_Part_URI 17248 18.02 17.76 18.06 31 DKIM_INVALID 16570 6.77 17.06 5.32 32 XM_B_Unsub 12548 11.32 12.92 11.09 33 LOTS_OF_MONEY 12544 7.28 12.91 6.49 34 NO_DNS_FOR_FROM 12475 3.90 12.84 2.65 35 XM_B_Phish_Phrases 12341 6.95 12.70 6.14 36 XMSexyCombo_05 12130 4.42 12.49 3.28 37 HTML_IMAGE_RATIO_02 11482 6.74 11.82 6.03 38 HTML_MIME_NO_HTML_TAG 11377 3.19 11.71 1.99 39 T_REMOTE_IMAGE 10203 3.94 10.50 3.01 40 FROM_SUSPICIOUS_NTLD 10027 1.32 10.32 0.05 41 FROM_SUSPICIOUS_NTLD_FP 9913 1.29 10.21 0.04 42 XM_Evil_Numbers_Gen 9640 7.78 9.92 7.48 43 RCVD_IN_MSPIKE_BL 8901 1.61 9.16 0.54 44 LotsOfNums_01 8858 8.13 9.12 7.99 45 XMSubMetaSx_00 8603 3.99 8.86 3.30 46 SpammyFromTLD_02 8544 1.34 8.80 0.29 47 TR_XM_PhishingBody 8457 3.56 8.71 2.83 48 FROM_EXCESS_BASE64 7975 3.31 8.21 2.63 49 BAYES_80 7895 4.39 8.13 3.86 50 HDRS_MISSP 7869 1.03 8.10 0.03 51 XM_UB99 7834 1.00 8.06 0.00 52 RCVD_IN_MSPIKE_WL 7713 20.97 7.94 22.80 53 BOTNET_NORDNS 7665 0.99 7.89 0.02 54 RCVD_IN_BL_SPAMCOP_NET 7482 2.10 7.70 1.31 55 XM_B_COVIDMETA 7166 2.31 7.38 1.60 56 DKIM_ADSP_NXDOMAIN 7107 1.10 7.32 0.23 57 RELAYCOUNTRY_CA 6986 2.21 7.19 1.51 58 BODY_URI_ONLY 6972 0.93 7.18 0.05 59 MPART_ALT_DIFF 6896 4.52 7.10 4.16 60 XM_UB50 6672 1.61 6.87 0.87 61 BAYES_60 6581 5.90 6.77 5.78 62 HTML_TAG_BALANCE_CENTER 6572 0.91 6.77 0.08 63 UNPARSEABLE_RELAY 6214 6.15 6.40 6.11 64 TooManyTo_001 6145 6.42 6.33 6.43 65 XM_UB999 6113 0.78 6.29 0.00 66 RELAYCOUNTRY_FR 6098 0.96 6.28 0.21 67 XM_H_Long_From01 5878 4.99 6.05 4.84 68 XM_B_Phish66 5789 2.15 5.96 1.62 69 TR_XM_COVIDMETA4 5308 1.25 5.46 0.66 70 SpammyFromTLD_01 5272 1.31 5.43 0.73 71 MIME_HTML_MOSTLY 5181 2.33 5.33 1.91 72 KHOP_HELO_FCRDNS 5149 1.98 5.30 1.52 73 XM_SendGrid 5038 5.43 5.19 5.47 74 TR_XM_INV_DKIM 4970 0.83 5.12 0.23 75 HTML_IMAGE_RATIO_04 4936 5.22 5.08 5.25 76 XMNumbers 4902 2.85 5.05 2.55 77 RCVD_IN_MSPIKE_L3 4875 0.92 5.02 0.34 78 XM_SPF_SoftFail 4731 1.84 4.87 1.41 79 BAYES_95 4729 2.54 4.87 2.21 80 RCVD_IN_MSPIKE_H3 4610 12.08 4.75 13.11 81 XM_B_SpammyTLD 4308 1.86 4.43 1.49 82 RCVD_IN_RP_RNBL 4066 0.55 4.19 0.04 83 PDS_OTHER_BAD_TLD 3995 0.77 4.11 0.30 84 URIBL_SBL_A 3990 0.68 4.11 0.20 85 XM_DIRTYINTL 3828 0.88 3.94 0.45 86 LongTLD 3704 0.60 3.81 0.15 87 TR_XM_MaxWHORU 3678 0.52 3.79 0.06 88 RCVD_IN_MSPIKE_L5 3607 0.60 3.71 0.16 89 XMBrknScrpt_02 3593 1.24 3.70 0.89 90 T_XMDrugObfuBody_08 3520 1.62 3.62 1.34 91 TR_XM_MaxSPIKE 3432 0.48 3.53 0.05 92 XMStrtUSub 3369 4.21 3.47 4.32 93 XM_URI_RBL 3348 0.70 3.45 0.31 94 TR_XM_UnparsRelay 3342 0.88 3.44 0.52 95 XMDiploma_00 3259 2.48 3.36 2.36 96 TR_XM_COVIDMETA1 3231 0.75 3.33 0.39 97 TR_XM_MaxBayes 3193 0.47 3.29 0.07 98 XM_JunkDunk 3081 0.39 3.17 0.00 99 MIME_QP_LONG_LINE 3039 4.86 3.13 5.10 100 HTML_IMAGE_RATIO_06 2932 3.08 3.02 3.09 101 RCVD_IN_MSPIKE_H4 2908 7.67 2.99 8.33 102 XMBody_17 2887 1.01 2.97 0.74 103 XMHTML_After_End 2885 1.36 2.97 1.13 104 DATE_IN_PAST_03_06 2789 0.42 2.87 0.08 105 TM2_M_URI_OPT_OUT 2788 16.23 2.87 18.11 106 XM_UB80 2763 0.38 2.84 0.03 107 RCVD_IN_PSBL 2707 0.34 2.79 0.00 108 XM_OfRef6 2681 1.19 2.76 0.97 109 RELAYCOUNTRY_DE 2646 0.61 2.72 0.31 110 XM_UB60 2508 0.41 2.58 0.10 111 RELAYCOUNTRY_GB 2442 1.05 2.51 0.84 112 XM_BadFromFormat 2359 0.40 2.43 0.11 113 SUBJ_ILLEGAL_CHARS 2280 0.35 2.35 0.07 114 T_XMDrugObfuBody_14 2226 1.46 2.29 1.34 115 FVGT_m_MULTI_ODD_EMAIL 2214 0.32 2.28 0.04 116 SUBJ_ALL_CAPS 2207 1.48 2.27 1.37 117 BAYES_40 2203 3.56 2.27 3.74 118 T_TooManySym_01 2158 3.18 2.22 3.31 119 URI_HEX 2143 1.43 2.21 1.32 120 BAD_ENC_HEADER 2135 0.28 2.20 0.01 121 XMSexyCombo_01 2124 0.84 2.19 0.65 122 XM_B_Unsub2 2112 4.59 2.17 4.93 123 TR_XM_DK_SendGrid 2093 3.01 2.15 3.13 124 TR_XM_RelayPhish 2083 0.38 2.14 0.14 125 TR_XM_PHPDW 2065 0.57 2.13 0.35 126 TR_XM_PHPForged 2060 0.55 2.12 0.33 127 RELAYCOUNTRY_JP 2047 0.29 2.11 0.03 128 TR_Symld_Words 2047 1.43 2.11 1.33 129 HTML_TITLE_SUBJ_DIFF 2045 0.30 2.11 0.05 130 TR_XM_FormFill2 2040 0.55 2.10 0.33 131 XM_H_PHPOS 2032 0.54 2.09 0.32 132 TR_LOTS_OF_MONEY3 2028 0.76 2.09 0.57 133 XM_UB95 2015 0.28 2.07 0.02 134 ALL_TRUSTED 1940 23.78 2.00 26.85 135 HTML_IMAGE_RATIO_08 1852 2.01 1.91 2.03 136 TM2_M_VERY_LONG_WORD 1843 1.09 1.90 0.98 137 MIME_HTML_ONLY_MULTI 1838 2.67 1.89 2.77 138 XM_CamelCaseFrm001 1783 1.77 1.84 1.76 139 RELAYCOUNTRY_BE 1706 0.26 1.76 0.05 140 XMBody_78 1686 0.48 1.74 0.30 141 XMSubNoVowel 1641 1.24 1.69 1.17 142 HTML_IMAGE_ONLY_08 1628 0.28 1.68 0.09 143 URI_TRY_3LD 1573 1.42 1.62 1.40 144 XMGenDplmaNmb 1545 1.13 1.59 1.07 145 HTML_SHORT_LINK_IMG_1 1543 0.21 1.59 0.02 146 T_XMDrugObfuBody_00 1530 4.98 1.58 5.46 147 MIME_HEADER_CTYPE_ONLY 1520 0.39 1.56 0.22 148 TM2_M_A_HREF_HREF 1519 0.43 1.56 0.27 149 HDRS_LCASE_IMGONLY 1502 0.21 1.55 0.02 150 RELAYCOUNTRY_IT 1430 0.22 1.47 0.05 151 BAYES_20 1427 3.30 1.47 3.56 152 MAILING_LIST_MULTI 1415 1.87 1.46 1.93 153 SHORT_IMG_SUSP_NTLD 1402 0.18 1.44 0.00 154 URI_PHP_REDIR 1396 0.20 1.44 0.03 155 HK_RANDOM_FROM 1391 0.27 1.43 0.11 156 RCVD_IN_RP_SAFE 1348 5.40 1.39 5.96 157 HK_RANDOM_REPLYTO 1325 0.33 1.36 0.19 158 XM_PDF 1315 3.49 1.35 3.79 159 MISSING_HEADERS 1299 0.49 1.34 0.38 160 T_FILL_THIS_FORM_SHORT 1289 0.79 1.33 0.71 161 T_XMHurry_00 1263 0.69 1.30 0.60 162 DKIM_ADSP_CUSTOM_MED 1260 0.95 1.30 0.90 163 XM_ProductURIs 1226 1.35 1.26 1.36 164 TR_Mismatch_TLD_01 1194 0.30 1.23 0.17 165 RELAYCOUNTRY_IN 1191 0.23 1.23 0.09 166 XMStockSpam_06 1183 0.79 1.22 0.73 167 TR_Mismatch_TLD_02 1179 0.20 1.21 0.06 168 XM_H_MailChimp 1113 0.31 1.15 0.19 169 XM_XX_Yahoo 1112 0.18 1.14 0.05 170 DATE_IN_PAST_06_12 1109 0.26 1.14 0.14 171 MIME_CHARSET_FARAWAY 1105 0.24 1.14 0.12 172 MPART_ALT_DIFF_COUNT 1104 0.39 1.14 0.29 173 XMSexyCombo_04 1091 0.29 1.12 0.17 174 XM_DK_Undo_01 1090 1.31 1.12 1.34 175 NML_ADSP_CUSTOM_MED 1088 0.72 1.12 0.67 176 XM_RXBody 1069 0.39 1.10 0.29 177 XMSubMetaSxObfu_03 1067 0.45 1.10 0.36 178 URIBL_BLACK 1061 0.16 1.09 0.03 179 XMSubMetaI_00 1057 0.51 1.09 0.42 180 XMBdyGiftCard01 1057 0.86 1.09 0.83 181 FORGED_GMAIL_RCVD 1054 0.47 1.09 0.38 182 T_Symld_Words_02 1044 0.59 1.07 0.52 183 XMPhish14 1037 0.48 1.07 0.40 184 REMOVE_BEFORE_LINK 1028 0.41 1.06 0.31 185 HK_SCAM 1022 0.15 1.05 0.02 186 TR_LOTS_OF_MONEY2 1021 0.42 1.05 0.33 187 T_MONEY_PERCENT 1021 0.42 1.05 0.33 188 XMPhish08 1021 0.50 1.05 0.42 189 CHARSET_FARAWAY_HEADER 1007 0.16 1.04 0.04 190 RDNS_DYNAMIC 999 0.36 1.03 0.27 191 DIET_1 997 0.32 1.03 0.22 192 XM_HighProb1 996 0.23 1.03 0.12 193 HELO_NODOT 987 1.13 1.02 1.15 194 XM_H_Undi_Recip 984 0.26 1.01 0.15 195 HELO_NO_DOMAIN 977 1.13 1.01 1.15 196 TR_MetaPhish_Combo_01 948 0.81 0.98 0.79 197 BAYES_00 945 20.44 0.97 23.18 198 BAYES_05 924 3.57 0.95 3.93 199 TR_LOTS_OF_MONEY1 918 0.13 0.95 0.02 200 LONG_JUNK_URI 917 0.16 0.94 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 679617 98.28 97.16 98.44 2 HTML_MESSAGE 528455 78.66 93.67 76.54 3 RELAYCOUNTRY_US 482797 69.37 65.34 69.93 4 DKIM_SIGNED 447758 65.86 73.01 64.86 5 XM_DK_Pass 440068 64.55 70.28 63.74 6 DKIM_VALID 411011 59.09 55.95 59.53 7 XM_B_Unicode 410763 61.66 77.02 59.50 8 BAYES_50 324419 45.45 34.46 46.99 9 DKIM_VALID_AU 312668 44.70 40.50 45.29 10 XMListUnsubscribeExists 308052 47.08 64.56 44.62 11 XM_B_Unicode3 236777 34.61 36.81 34.30 12 ALL_TRUSTED 185363 23.78 2.00 26.85 13 T_TM2_M_HEADER_IN_MSG 163576 23.32 20.68 23.69 14 BAYES_00 160040 20.44 0.97 23.18 15 DKIM_VALID_EF 158729 23.30 25.50 22.99 16 RCVD_IN_MSPIKE_WL 157392 20.97 7.94 22.80 17 HTML_FONT_LOW_CONTRAST 152972 22.56 25.40 22.16 18 LOC_TINY_FONT_1 148751 22.66 30.56 21.55 19 RCVD_IN_MSPIKE_H2 138768 20.78 25.60 20.10 20 FVGT_m_MULTI_ODD 135325 20.29 25.22 19.60 21 XMSubLong 128095 19.03 22.41 18.55 22 TM2_M_URI_OPT_OUT 124996 16.23 2.87 18.11 23 XM_Multi_Part_URI 124679 18.02 17.76 18.06 24 ANY_BOUNCE_MESSAGE 122038 15.59 0.77 17.68 25 BOUNCE_MESSAGE 122034 15.59 0.76 17.68 26 MIME_HTML_ONLY 119921 19.71 36.35 17.37 27 T_KAM_HTML_FONT_INVALID 107987 16.32 21.13 15.64 28 RCVD_IN_MSPIKE_H3 90510 12.08 4.75 13.11 29 XM_Body_Dirty_Words 79073 12.30 18.29 11.45 30 XM_B_Unsub 76570 11.32 12.92 11.09 31 XM_DK_Undo_02 71996 15.30 49.93 10.43 32 RCVD_IN_MSPIKE_H4 57486 7.67 2.99 8.33 33 LotsOfNums_01 55180 8.13 9.12 7.99 34 XM_Evil_Numbers_Gen 51663 7.78 9.92 7.48 35 BAYES_99 46534 10.86 40.10 6.74 36 IN_ZIMBRA_NJ_WHITELIST 46182 5.87 0.04 6.69 37 LOTS_OF_MONEY 44824 7.28 12.91 6.49 38 TooManyTo_001 44424 6.42 6.33 6.43 39 TR_XM_DK_Bayes 44281 5.68 0.47 6.41 40 XM_B_Phish_Phrases 42356 6.95 12.70 6.14 41 UNPARSEABLE_RELAY 42192 6.15 6.40 6.11 42 HTML_IMAGE_RATIO_02 41613 6.74 11.82 6.03 43 RCVD_IN_RP_SAFE 41165 5.40 1.39 5.96 44 TR_XM_DK_Bayes1 41123 5.25 0.26 5.96 45 XM_DKIMWhitelistDomains 40697 5.17 0.02 5.89 46 BAYES_60 39901 5.90 6.77 5.78 47 XM_SendGrid 37734 5.43 5.19 5.47 48 T_XMDrugObfuBody_00 37702 4.98 1.58 5.46 49 BAYES_999 37550 8.67 31.64 5.44 50 RCVD_IN_RP_CERTIFIED 37204 4.83 0.87 5.39 51 TR_XM_DK_Bayes2 37139 4.74 0.23 5.38 52 DKIM_INVALID 36747 6.77 17.06 5.32 53 HTML_IMAGE_RATIO_04 36211 5.22 5.08 5.25 54 MIME_QP_LONG_LINE 35216 4.86 3.13 5.10 55 XM_B_Unsub2 34058 4.59 2.17 4.93 56 XM_H_Long_From01 33445 4.99 6.05 4.84 57 RELAYCOUNTRY_META 31011 8.18 34.39 4.49 58 BOTNET_IPINHOSTNAME 29955 6.00 17.84 4.34 59 XMStrtUSub 29792 4.21 3.47 4.32 60 RCVD_IN_IADB_LISTED 29595 3.87 0.88 4.29 61 MPART_ALT_DIFF 28686 4.52 7.10 4.16 62 BAYES_05 27165 3.57 0.95 3.93 63 BAYES_80 26648 4.39 8.13 3.86 64 XM_PDF 26161 3.49 1.35 3.79 65 RCVD_IN_IADB_SPF 26016 3.40 0.78 3.77 66 BAYES_40 25850 3.56 2.27 3.74 67 BAYES_20 24555 3.30 1.47 3.56 68 RCVD_IN_IADB_SENDERID 23171 3.03 0.74 3.36 69 RCVD_IN_IADB_DK 22987 3.01 0.75 3.33 70 T_TooManySym_01 22855 3.18 2.22 3.31 71 XMSubMetaSx_00 22789 3.99 8.86 3.30 72 XMSexyCombo_05 22649 4.42 12.49 3.28 73 TR_XM_DK_SendGrid 21628 3.01 2.15 3.13 74 HTML_IMAGE_RATIO_06 21356 3.08 3.02 3.09 75 T_REMOTE_IMAGE 20799 3.94 10.50 3.01 76 BOTNET 19598 6.68 34.01 2.84 77 TR_XM_PhishingBody 19555 3.56 8.71 2.83 78 MIME_HTML_ONLY_MULTI 19156 2.67 1.89 2.77 79 NO_DNS_FOR_FROM 18272 3.90 12.84 2.65 80 FROM_EXCESS_BASE64 18127 3.31 8.21 2.63 81 XMNumbers 17578 2.85 5.05 2.55 82 XM_UncommonTLD01 17392 4.87 21.57 2.52 83 XM_H_Trusted_IP 17281 2.19 0.00 2.50 84 RCVD_IN_IADB_VOUCHED 17254 2.22 0.27 2.50 85 XMDiploma_00 16292 2.48 3.36 2.36 86 BAYES_95 15267 2.54 4.87 2.21 87 HTML_IMAGE_RATIO_08 14016 2.01 1.91 2.03 88 HTML_MIME_NO_HTML_TAG 13742 3.19 11.71 1.99 89 MAILING_LIST_MULTI 13293 1.87 1.46 1.93 90 MIME_HTML_MOSTLY 13162 2.33 5.33 1.91 91 XM_CamelCaseFrm001 12157 1.77 1.84 1.76 92 T_TooManySym_02 12079 1.63 0.75 1.75 93 XM_B_Phish66 11153 2.15 5.96 1.62 94 XM_B_COVIDMETA 11030 2.31 7.38 1.60 95 TooManyTo_002 10807 1.47 0.82 1.57 96 RCVD_IN_IADB_OPTIN 10475 1.36 0.25 1.52 97 KHOP_HELO_FCRDNS 10470 1.98 5.30 1.52 98 RELAYCOUNTRY_CA 10413 2.21 7.19 1.51 99 XM_B_SpammyTLD 10303 1.86 4.43 1.49 100 UNTRUSTED_Relay 10179 4.25 23.95 1.47 101 XM_SPF_SoftFail 9761 1.84 4.87 1.41 102 TVD_RCVD_IP 9678 1.27 0.31 1.40 103 URI_TRY_3LD 9636 1.42 1.62 1.40 104 SUBJ_ALL_CAPS 9475 1.48 2.27 1.37 105 RCVD_IN_MSPIKE_H5 9396 1.22 0.20 1.36 106 XM_ProductURIs 9387 1.35 1.26 1.36 107 T_XMDrugObfuBody_08 9254 1.62 3.62 1.34 108 T_XMDrugObfuBody_14 9251 1.46 2.29 1.34 109 XM_DK_Undo_01 9250 1.31 1.12 1.34 110 TR_Symld_Words 9176 1.43 2.11 1.33 111 URI_HEX 9105 1.43 2.21 1.32 112 RCVD_IN_BL_SPAMCOP_NET 9022 2.10 7.70 1.31 113 XMSubNoVowel 8093 1.24 1.69 1.17 114 HELO_NODOT 7944 1.13 1.02 1.15 115 HELO_NO_DOMAIN 7942 1.13 1.01 1.15 116 XMHTML_After_End 7796 1.36 2.97 1.13 117 IN_HORDE_ADDRESS_BOOK 7725 1.00 0.13 1.12 118 HELO_MISC_IP 7672 1.09 0.93 1.11 119 CK_HELO_DYNAMIC_SPLIT_IP 7666 1.09 0.91 1.11 120 INVALID_MSGID 7460 0.99 0.37 1.08 121 XMGenDplmaNmb 7391 1.13 1.59 1.07 122 TooManyTo_003 7323 1.00 0.60 1.06 123 TM2_M_VERY_LONG_WORD 6767 1.09 1.90 0.98 124 XM_GoogleGroups 6738 0.93 0.58 0.98 125 XM_OfRef6 6716 1.19 2.76 0.97 126 TO_MALFORMED 6499 0.83 0.01 0.94 127 HTML_FONT_FACE_BAD 6417 0.89 0.63 0.93 128 XMCapTrack 6373 0.89 0.66 0.92 129 T_OBFU_PDF_ATTACH 6253 0.82 0.19 0.91 130 USER_IN_DEF_DKIM_WL 6229 0.79 0.01 0.90 131 DKIM_ADSP_CUSTOM_MED 6192 0.95 1.30 0.90 132 XMBrknScrpt_02 6161 1.24 3.70 0.89 133 XM_UB50 5992 1.61 6.87 0.87 134 XM_H_Long_From02 5923 0.85 0.76 0.86 135 RELAYCOUNTRY_GB 5815 1.05 2.51 0.84 136 XMBdyGiftCard01 5725 0.86 1.09 0.83 137 TR_MetaPhish_Combo_01 5443 0.81 0.98 0.79 138 TooManyTo_004 5436 0.75 0.52 0.79 139 HTML_FONT_SIZE_HUGE 5219 0.73 0.58 0.76 140 XMGappySubj_01 5162 0.67 0.14 0.75 141 XMBody_17 5079 1.01 2.97 0.74 142 SpammyFromTLD_01 5019 1.31 5.43 0.73 143 XMStockSpam_06 5017 0.79 1.22 0.73 144 T_FILL_THIS_FORM_SHORT 4912 0.79 1.33 0.71 145 HTTPS_HTTP_MISMATCH 4753 0.70 0.79 0.69 146 NML_ADSP_CUSTOM_MED 4607 0.72 1.12 0.67 147 TooManyTo_005 4534 0.63 0.40 0.66 148 TR_XM_COVIDMETA4 4528 1.25 5.46 0.66 149 XMSexyCombo_01 4497 0.84 2.19 0.65 150 T_XMHurry_00 4135 0.69 1.30 0.60 151 TR_MSPIKEBAYES00 4047 0.51 0.01 0.59 152 T_TooManySym_03 4040 0.55 0.30 0.59 153 TR_LOTS_OF_MONEY3 3933 0.76 2.09 0.57 154 XMBody_95 3771 0.51 0.22 0.55 155 RCVD_IN_MSPIKE_BL 3749 1.61 9.16 0.54 156 HTML_TAG_BALANCE_BODY 3680 0.58 0.88 0.53 157 T_Symld_Words_02 3592 0.59 1.07 0.52 158 TR_XM_UnparsRelay 3564 0.88 3.44 0.52 159 FROM_GOV_DKIM_AU 3498 0.47 0.18 0.51 160 XM_SPF_Unknown 3407 0.51 0.66 0.49 161 XMMoneyMeta_00 3342 0.51 0.71 0.48 162 XMNoVowels 3160 0.51 0.90 0.46 163 XM_DIRTYINTL 3128 0.88 3.94 0.45 164 TR_BOTNET_NEGATE 3075 0.43 0.34 0.45 165 NUMERIC_HTTP_ADDR 2999 0.45 0.58 0.43 166 XMPhish08 2925 0.50 1.05 0.42 167 XMSubMetaI_00 2923 0.51 1.09 0.42 168 XM_H_PHPMailer 2909 0.48 0.86 0.42 169 HTML_IMAGE_ONLY_20 2882 0.45 0.69 0.42 170 XM_Body_Obfu01 2870 0.43 0.57 0.42 171 XM_B_COPY_HTML 2835 0.41 0.39 0.41 172 FROM_GOV_SPOOF 2823 0.39 0.22 0.41 173 XMPhish14 2734 0.48 1.07 0.40 174 XMPhish30 2702 0.45 0.90 0.39 175 TR_XM_COVIDMETA1 2687 0.75 3.33 0.39 176 XM_ShortIntro_01 2665 0.40 0.52 0.39 177 FORGED_GMAIL_RCVD 2649 0.47 1.09 0.38 178 MISSING_HEADERS 2596 0.49 1.34 0.38 179 URI_NOVOWEL 2513 0.41 0.72 0.36 180 HTML_IMAGE_ONLY_28 2501 0.36 0.35 0.36 181 THIS_AD 2492 0.37 0.41 0.36 182 XMSubMetaSxObfu_03 2487 0.45 1.10 0.36 183 XMHTMLBadTable_001 2485 0.37 0.41 0.36 184 RELAYCOUNTRY_AU 2464 0.40 0.70 0.36 185 TR_XM_PHPDW 2410 0.57 2.13 0.35 186 XMLngstWrd_00 2407 0.35 0.36 0.35 187 RCVD_IN_MSPIKE_L3 2358 0.92 5.02 0.34 188 XM_B_REG_HTML 2356 0.33 0.29 0.34 189 TM2_M_BODY_EMPTY 2304 0.30 0.10 0.33 190 RCVD_IN_SORBS_DUL 2277 0.31 0.20 0.33 191 TR_LOTS_OF_MONEY2 2275 0.42 1.05 0.33 192 T_MONEY_PERCENT 2275 0.42 1.05 0.33 193 TR_XM_PHPForged 2259 0.55 2.12 0.33 194 TR_XM_FormFill2 2257 0.55 2.10 0.33 195 XM_H_PHPOS 2221 0.54 2.09 0.32 196 REMOVE_BEFORE_LINK 2169 0.41 1.06 0.31 197 RELAYCOUNTRY_DE 2166 0.61 2.72 0.31 198 XM_URI_RBL 2161 0.70 3.45 0.31 199 XMSubMetaSxObfu_02 2142 0.33 0.48 0.31 200 AC_DIV_BONANZA 2137 0.29 0.11 0.31 ----------------------------------------------------------------------