Email: 804957 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 1.86 sec Spam: 118173 Autolearn: 0 AvgScore: 14.38 AvgScanTime: 3.63 sec Ham: 686784 Autolearn: 0 AvgScore: -2.31 AvgScanTime: 1.55 sec Time Spent Running SA: 415.73 hours Time Spent Processing Spam: 119.23 hours Time Spent Processing Ham: 296.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 112218 97.87 94.96 98.37 2 HTML_MESSAGE 109391 78.68 92.57 76.29 3 RELAYCOUNTRY_US 75242 69.93 63.67 71.01 4 DKIM_SIGNED 68429 64.57 57.91 65.72 5 XM_B_Unicode 66863 59.05 56.58 59.48 6 XM_DK_Pass 65484 63.39 55.41 64.76 7 XMListUnsubscribeExists 58746 44.36 49.71 43.44 8 MIME_HTML_ONLY 56843 21.94 48.10 17.44 9 DKIM_VALID 52338 58.15 44.29 60.54 10 RCVD_IN_MSPIKE_H2 49467 23.01 41.86 19.77 11 BOTNET 47798 8.46 40.45 2.95 12 XM_DK_Undo_02 45644 14.16 38.62 9.94 13 RELAYCOUNTRY_META 42156 9.78 35.67 5.33 14 BAYES_50 41671 44.84 35.26 46.49 15 HTML_IMAGE_RATIO_02 38427 9.57 32.52 5.62 16 DKIM_VALID_AU 37968 43.88 32.13 45.91 17 XM_B_Unicode3 36097 33.38 30.55 33.86 18 BAYES_99 34748 9.62 29.40 6.22 19 RCVD_IN_BL_SPAMCOP_NET 33295 5.12 28.17 1.15 20 HTML_MIME_NO_HTML_TAG 32521 5.64 27.52 1.87 21 FROM_EXCESS_BASE64 30813 5.93 26.07 2.47 22 UNTRUSTED_Relay 29780 5.46 25.20 2.06 23 BODY_URI_ONLY 29273 3.68 24.77 0.05 24 RCVD_IN_PSBL 29248 3.64 24.75 0.00 25 LOC_TINY_FONT_1 28669 20.98 24.26 20.42 26 BAYES_999 26935 7.56 22.79 4.93 27 FVGT_m_MULTI_ODD 24455 19.09 20.69 18.82 28 DKIM_VALID_EF 24081 23.66 20.38 24.23 29 XMSubGiftCard1 24061 3.05 20.36 0.08 30 HTML_FONT_LOW_CONTRAST 23515 21.65 19.90 21.95 31 T_TM2_M_HEADER_IN_MSG 21397 24.31 18.11 25.37 32 XMSubLong 21349 18.59 18.07 18.68 33 T_KAM_HTML_FONT_INVALID 19907 15.52 16.85 15.29 34 XM_Body_Dirty_Words 19163 12.54 16.22 11.91 35 XMStrtUSub 17723 5.91 15.00 4.35 36 DKIM_INVALID 16091 6.42 13.62 5.18 37 XM_Multi_Part_URI 16011 16.58 13.55 17.10 38 BAYES_80 15626 5.27 13.22 3.90 39 BOTNET_IPINHOSTNAME 15004 5.66 12.70 4.45 40 HTML_IMAGE_ONLY_32 14895 2.14 12.60 0.33 41 XM_Walgreens_Forge 14665 1.85 12.41 0.04 42 BAYES_60 13818 6.68 11.69 5.81 43 NO_DNS_FOR_FROM 13526 4.12 11.45 2.86 44 LOTS_OF_MONEY 12795 7.18 10.83 6.56 45 XM_B_Unsub 12176 11.41 10.30 11.60 46 XM_UncommonTLD01 12117 3.77 10.25 2.66 47 XMSexyCombo_05 11419 4.61 9.66 3.74 48 XM_B_Phish_Phrases 11318 6.70 9.58 6.20 49 XM_UB50 10087 2.17 8.54 1.08 50 HTML_IMAGE_ONLY_16 9810 1.40 8.30 0.21 51 HTML_SHORT_LINK_IMG_2 9420 1.20 7.97 0.04 52 RCVD_IN_MSPIKE_BL 9266 1.67 7.84 0.61 53 XM_Evil_Numbers_Gen 8805 7.44 7.45 7.44 54 HK_RANDOM_FROM 8556 1.16 7.24 0.11 55 LotsOfNums_01 7865 7.33 6.66 7.45 56 RCVD_IN_MSPIKE_WL 7766 20.45 6.57 22.83 57 XMSubMetaSx_00 7464 3.77 6.32 3.33 58 RELAYCOUNTRY_CA 7446 2.24 6.30 1.54 59 TR_XM_PhishingBody 7200 3.32 6.09 2.84 60 BAYES_95 7076 2.85 5.99 2.31 61 MPART_ALT_DIFF 6403 4.33 5.42 4.14 62 XM_UB80 6137 0.80 5.19 0.04 63 XM_B_COVIDMETA 6014 1.98 5.09 1.44 64 BOTNET_NORDNS 5970 0.76 5.05 0.02 65 UNPARSEABLE_RELAY 5939 5.95 5.03 6.11 66 XM_SPF_SoftFail 5641 2.30 4.77 1.87 67 TooManyTo_001 5634 7.02 4.77 7.40 68 RCVD_IN_RP_RNBL 5218 0.70 4.42 0.06 69 TR_XM_COVIDMETA4 5179 1.17 4.38 0.62 70 XM_UB60 5174 0.73 4.38 0.10 71 XM_H_Long_From01 5128 4.72 4.34 4.79 72 RCVD_IN_MSPIKE_L3 5046 0.95 4.27 0.38 73 XMNumbers 4873 2.77 4.12 2.54 74 MIME_HTML_MOSTLY 4871 2.16 4.12 1.82 75 KHOP_HELO_FCRDNS 4827 2.22 4.08 1.90 76 RCVD_IN_MSPIKE_H3 4710 11.85 3.99 13.21 77 HTML_IMAGE_RATIO_04 4662 4.51 3.95 4.60 78 XM_B_SpammyTLD 4631 2.13 3.92 1.82 79 XM_SendGrid 4555 5.27 3.85 5.51 80 TR_XM_INV_DKIM 4513 0.72 3.82 0.19 81 XM_DIRTYINTL 4498 1.01 3.81 0.53 82 T_REMOTE_IMAGE 4423 2.84 3.74 2.69 83 XM_UB99 4407 0.55 3.73 0.01 84 XM_B_Phish66 4401 1.91 3.72 1.60 85 HTML_IMAGE_ONLY_08 4388 0.63 3.71 0.10 86 HTML_SHORT_LINK_IMG_1 4303 0.55 3.64 0.02 87 RELAYCOUNTRY_FR 4230 0.88 3.58 0.42 88 SpammyFromTLD_01 3946 1.19 3.34 0.81 89 FROM_LOCAL_NOVOWEL 3667 0.48 3.10 0.03 90 RCVD_IN_MSPIKE_L5 3622 0.62 3.06 0.20 91 XM_OfRef6 3565 1.38 3.02 1.09 92 RELAYCOUNTRY_JP 3557 0.48 3.01 0.04 93 TR_XM_MaxWHORU 3469 0.48 2.94 0.05 94 PDS_OTHER_BAD_TLD 3401 0.66 2.88 0.28 95 SpammyFromTLD_02 3333 0.66 2.82 0.29 96 URIBL_SBL_A 3264 0.61 2.76 0.24 97 XM_URI_RBL 3186 0.56 2.70 0.19 98 XM_UB999 3173 0.40 2.69 0.00 99 TR_XM_UnparsRelay 3147 0.76 2.66 0.43 100 T_XMDrugObfuBody_08 3131 1.66 2.65 1.49 101 TM2_M_URI_OPT_OUT 3009 14.84 2.55 16.96 102 TR_XM_MaxSPIKE 2991 0.40 2.53 0.04 103 XMDiploma_00 2942 1.95 2.49 1.86 104 RELAYCOUNTRY_GB 2921 1.12 2.47 0.89 105 XM_CamelCaseFrm001 2914 1.95 2.47 1.87 106 XMBody_17 2887 1.00 2.44 0.75 107 HTML_IMAGE_RATIO_08 2849 2.11 2.41 2.06 108 T_TooManySym_01 2841 4.05 2.40 4.33 109 RCVD_IN_MSPIKE_H4 2829 7.46 2.39 8.33 110 FVGT_m_MULTI_ODD_EMAIL 2801 0.37 2.37 0.03 111 HTML_IMAGE_RATIO_06 2797 3.41 2.37 3.59 112 XM_UB95 2785 0.37 2.36 0.03 113 FROM_SUSPICIOUS_NTLD 2784 0.38 2.36 0.04 114 XMBrknScrpt_02 2733 1.08 2.31 0.87 115 FROM_SUSPICIOUS_NTLD_FP 2708 0.36 2.29 0.03 116 DATE_IN_PAST_03_06 2704 0.51 2.29 0.20 117 MIME_QP_LONG_LINE 2651 4.33 2.24 4.69 118 RELAYCOUNTRY_SG 2470 0.38 2.09 0.08 119 TR_XM_PHPDW 2442 0.65 2.07 0.40 120 TR_XM_COVIDMETA1 2421 0.57 2.05 0.32 121 TR_Mismatch_TLD_01 2415 0.46 2.04 0.18 122 TR_XM_PHPForged 2400 0.63 2.03 0.39 123 TR_XM_FormFill2 2373 0.63 2.01 0.39 124 XM_H_PHPOS 2360 0.62 2.00 0.38 125 RELAYCOUNTRY_KR 2333 0.31 1.97 0.03 126 XM_B_Unsub2 2286 4.44 1.93 4.87 127 TM2_M_VERY_LONG_WORD 2231 1.13 1.89 1.00 128 XMSexyCombo_01 2212 0.70 1.87 0.50 129 RELAYCOUNTRY_HK 2198 0.30 1.86 0.04 130 ALL_TRUSTED 2137 21.68 1.81 25.10 131 BAYES_40 2135 4.02 1.81 4.40 132 SUBJ_ALL_CAPS 2133 1.32 1.80 1.24 133 TR_XM_MaxBayes 2130 0.29 1.80 0.03 134 LongTLD 2129 0.41 1.80 0.17 135 TR_Symld_Words 2111 1.73 1.79 1.72 136 URI_HEX 2069 1.35 1.75 1.29 137 RELAYCOUNTRY_AU 1926 0.57 1.63 0.38 138 BAD_ENC_HEADER 1911 0.25 1.62 0.02 139 TR_XM_DK_SendGrid 1896 2.93 1.60 3.16 140 TR_LOTS_OF_MONEY3 1889 0.62 1.60 0.46 141 URI_TRY_3LD 1887 1.07 1.60 0.98 142 XMGenDplmaNmb 1833 0.90 1.55 0.79 143 MAILING_LIST_MULTI 1814 2.16 1.54 2.27 144 RELAYCOUNTRY_NL 1778 0.65 1.50 0.50 145 XM_JunkDunk 1767 0.22 1.50 0.00 146 TR_XM_RelayPhish 1745 0.32 1.48 0.12 147 MIME_HTML_ONLY_MULTI 1736 2.47 1.47 2.65 148 T_FILL_THIS_FORM_SHORT 1698 0.88 1.44 0.78 149 DKIM_ADSP_CUSTOM_MED 1694 1.00 1.43 0.92 150 T_XMDrugObfuBody_14 1687 1.25 1.43 1.22 151 T_Symld_Words_02 1669 0.66 1.41 0.53 152 SUBJ_ILLEGAL_CHARS 1607 0.21 1.36 0.01 153 T_XMHurry_00 1607 0.62 1.36 0.49 154 XM_DK_Undo_01 1600 1.42 1.35 1.43 155 XMStockSpam_06 1585 1.05 1.34 1.00 156 XM_OfRef7 1559 0.41 1.32 0.26 157 NML_ADSP_CUSTOM_MED 1546 0.77 1.31 0.67 158 T_XMDrugObfuBody_00 1507 2.01 1.28 2.13 159 BAYES_20 1495 4.13 1.27 4.62 160 HTML_FONT_TINY_NORDNS 1492 0.42 1.26 0.28 161 XMHTML_After_End 1489 0.82 1.26 0.75 162 RELAYCOUNTRY_NG 1459 0.18 1.23 0.00 163 XMBdyGiftCard01 1450 0.78 1.23 0.70 164 HK_RANDOM_REPLYTO 1431 0.35 1.21 0.20 165 XM_BadFromFormat 1430 0.28 1.21 0.13 166 FORGED_GMAIL_RCVD 1398 0.56 1.18 0.45 167 RELAYCOUNTRY_DE 1369 0.46 1.16 0.34 168 HELO_NODOT 1355 1.37 1.15 1.41 169 HELO_NO_DOMAIN 1353 1.37 1.14 1.41 170 XMSubNoVowel 1334 1.20 1.13 1.22 171 RELAYCOUNTRY_IE 1329 0.32 1.12 0.18 172 RDNS_DYNAMIC 1319 0.41 1.12 0.29 173 TR_Mismatch_TLD_02 1296 0.23 1.10 0.08 174 HTTPS_HTTP_MISMATCH 1289 0.68 1.09 0.61 175 XM_H_Long_From02 1280 1.12 1.08 1.12 176 XMBody_78 1278 0.55 1.08 0.46 177 RELAYCOUNTRY_BR 1251 0.17 1.06 0.02 178 FILL_THIS_FORM 1238 0.44 1.05 0.33 179 XMSubEmpty 1228 0.33 1.04 0.21 180 FILL_THIS_FORM_LONG 1216 0.34 1.03 0.22 181 THIS_AD 1197 0.41 1.01 0.31 182 XM_PDF 1192 3.32 1.01 3.72 183 XMSubMetaSxObfu_03 1191 0.52 1.01 0.44 184 DIET_1 1177 0.48 1.00 0.40 185 LONG_JUNK_URI 1156 0.18 0.98 0.04 186 MIME_CHARSET_FARAWAY 1141 0.22 0.97 0.09 187 RELAYCOUNTRY_IN 1107 0.22 0.94 0.10 188 XM_HighProb1 1100 0.14 0.93 0.01 189 XM_OfRef8 1097 0.30 0.93 0.19 190 TR_MetaPhish_Combo_01 1088 0.73 0.92 0.70 191 XMPhish14 1080 0.51 0.91 0.45 192 URI_PHP_REDIR 1075 0.14 0.91 0.01 193 XMPhish30 1075 0.50 0.91 0.42 194 T_TooManySym_02 1070 1.98 0.91 2.16 195 REPLYTO_WITHOUT_TO_CC 1064 0.33 0.90 0.23 196 XM_H_Undi_Recip 1059 0.31 0.90 0.20 197 URIBL_BLACK 1051 0.14 0.89 0.02 198 URI_WP_DIRINDEX 1046 0.20 0.89 0.08 199 PDS_FROM_2_EMAILS 1045 0.15 0.88 0.03 200 NO_FM_NAME_IP_HOSTN 1008 0.13 0.85 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 675577 97.87 94.96 98.37 2 HTML_MESSAGE 523969 78.68 92.57 76.29 3 RELAYCOUNTRY_US 487695 69.93 63.67 71.01 4 DKIM_SIGNED 451362 64.57 57.91 65.72 5 XM_DK_Pass 444779 63.39 55.41 64.76 6 DKIM_VALID 415778 58.15 44.29 60.54 7 XM_B_Unicode 408476 59.05 56.58 59.48 8 BAYES_50 319297 44.84 35.26 46.49 9 DKIM_VALID_AU 315286 43.88 32.13 45.91 10 XMListUnsubscribeExists 298329 44.36 49.71 43.44 11 XM_B_Unicode3 232579 33.38 30.55 33.86 12 T_TM2_M_HEADER_IN_MSG 174249 24.31 18.11 25.37 13 ALL_TRUSTED 172387 21.68 1.81 25.10 14 DKIM_VALID_EF 166389 23.66 20.38 24.23 15 RCVD_IN_MSPIKE_WL 156819 20.45 6.57 22.83 16 HTML_FONT_LOW_CONTRAST 150779 21.65 19.90 21.95 17 BAYES_00 143803 17.97 0.72 20.94 18 LOC_TINY_FONT_1 140244 20.98 24.26 20.42 19 RCVD_IN_MSPIKE_H2 135781 23.01 41.86 19.77 20 FVGT_m_MULTI_ODD 129234 19.09 20.69 18.82 21 XMSubLong 128274 18.59 18.07 18.68 22 MIME_HTML_ONLY 119784 21.94 48.10 17.44 23 XM_Multi_Part_URI 117466 16.58 13.55 17.10 24 TM2_M_URI_OPT_OUT 116447 14.84 2.55 16.96 25 ANY_BOUNCE_MESSAGE 115564 14.45 0.63 16.83 26 BOUNCE_MESSAGE 115558 14.45 0.63 16.83 27 T_KAM_HTML_FONT_INVALID 105008 15.52 16.85 15.29 28 RCVD_IN_MSPIKE_H3 90691 11.85 3.99 13.21 29 XM_Body_Dirty_Words 81779 12.54 16.22 11.91 30 XM_B_Unsub 79689 11.41 10.30 11.60 31 XM_DK_Undo_02 68299 14.16 38.62 9.94 32 RCVD_IN_MSPIKE_H4 57212 7.46 2.39 8.33 33 IN_ZIMBRA_NJ_WHITELIST 53027 6.59 0.03 7.72 34 LotsOfNums_01 51150 7.33 6.66 7.45 35 XM_Evil_Numbers_Gen 51065 7.44 7.45 7.44 36 TooManyTo_001 50846 7.02 4.77 7.40 37 TR_XM_DK_Bayes 47715 5.98 0.37 6.95 38 LOTS_OF_MONEY 45034 7.18 10.83 6.56 39 TR_XM_DK_Bayes1 44282 5.53 0.20 6.45 40 BAYES_99 42726 9.62 29.40 6.22 41 XM_B_Phish_Phrases 42604 6.70 9.58 6.20 42 XM_DKIMWhitelistDomains 42087 5.24 0.05 6.13 43 UNPARSEABLE_RELAY 41950 5.95 5.03 6.11 44 BAYES_60 39930 6.68 11.69 5.81 45 RCVD_IN_RP_SAFE 38996 4.89 0.34 5.68 46 HTML_IMAGE_RATIO_02 38599 9.57 32.52 5.62 47 TR_XM_DK_Bayes2 38582 4.82 0.16 5.62 48 XM_SendGrid 37829 5.27 3.85 5.51 49 RELAYCOUNTRY_META 36590 9.78 35.67 5.33 50 BAYES_05 36393 4.61 0.63 5.30 51 RCVD_IN_RP_CERTIFIED 36074 4.51 0.23 5.25 52 DKIM_INVALID 35584 6.42 13.62 5.18 53 BAYES_999 33889 7.56 22.79 4.93 54 XM_B_Unsub2 33436 4.44 1.93 4.87 55 XM_H_Long_From01 32871 4.72 4.34 4.79 56 MIME_QP_LONG_LINE 32238 4.33 2.24 4.69 57 BAYES_20 31713 4.13 1.27 4.62 58 HTML_IMAGE_RATIO_04 31605 4.51 3.95 4.60 59 BOTNET_IPINHOSTNAME 30592 5.66 12.70 4.45 60 BAYES_40 30228 4.02 1.81 4.40 61 XMStrtUSub 29855 5.91 15.00 4.35 62 T_TooManySym_01 29759 4.05 2.40 4.33 63 RCVD_IN_IADB_LISTED 28590 3.66 0.75 4.16 64 MPART_ALT_DIFF 28438 4.33 5.42 4.14 65 BAYES_80 26791 5.27 13.22 3.90 66 XMSexyCombo_05 25658 4.61 9.66 3.74 67 XM_PDF 25560 3.32 1.01 3.72 68 RCVD_IN_IADB_SPF 25065 3.21 0.66 3.65 69 HTML_IMAGE_RATIO_06 24688 3.41 2.37 3.59 70 XMSubMetaSx_00 22876 3.77 6.32 3.33 71 RCVD_IN_IADB_SENDERID 22102 2.84 0.63 3.22 72 RCVD_IN_IADB_DK 21795 2.80 0.63 3.17 73 TR_XM_DK_SendGrid 21701 2.93 1.60 3.16 74 BOTNET 20267 8.46 40.45 2.95 75 NO_DNS_FOR_FROM 19619 4.12 11.45 2.86 76 TR_XM_PhishingBody 19525 3.32 6.09 2.84 77 T_REMOTE_IMAGE 18471 2.84 3.74 2.69 78 XM_UncommonTLD01 18238 3.77 10.25 2.66 79 MIME_HTML_ONLY_MULTI 18175 2.47 1.47 2.65 80 XMNumbers 17452 2.77 4.12 2.54 81 XM_H_Trusted_IP 17303 2.15 0.00 2.52 82 RCVD_IN_IADB_VOUCHED 17259 2.19 0.32 2.51 83 FROM_EXCESS_BASE64 16961 5.93 26.07 2.47 84 BAYES_95 15868 2.85 5.99 2.31 85 MAILING_LIST_MULTI 15594 2.16 1.54 2.27 86 T_TooManySym_02 14850 1.98 0.91 2.16 87 T_XMDrugObfuBody_00 14655 2.01 1.28 2.13 88 UNTRUSTED_Relay 14181 5.46 25.20 2.06 89 HTML_IMAGE_RATIO_08 14156 2.11 2.41 2.06 90 KHOP_HELO_FCRDNS 13018 2.22 4.08 1.90 91 HTML_MIME_NO_HTML_TAG 12859 5.64 27.52 1.87 92 XM_SPF_SoftFail 12848 2.30 4.77 1.87 93 XM_CamelCaseFrm001 12818 1.95 2.47 1.87 94 XMDiploma_00 12779 1.95 2.49 1.86 95 XM_B_SpammyTLD 12514 2.13 3.92 1.82 96 TVD_RCVD_IP 12500 1.64 0.60 1.82 97 MIME_HTML_MOSTLY 12491 2.16 4.12 1.82 98 TR_Symld_Words 11839 1.73 1.79 1.72 99 TooManyTo_002 11092 1.47 0.66 1.62 100 XM_B_Phish66 11009 1.91 3.72 1.60 101 RCVD_IN_IADB_OPTIN 10884 1.39 0.26 1.58 102 RELAYCOUNTRY_CA 10564 2.24 6.30 1.54 103 T_XMDrugObfuBody_08 10230 1.66 2.65 1.49 104 XM_B_COVIDMETA 9914 1.98 5.09 1.44 105 XM_DK_Undo_01 9803 1.42 1.35 1.43 106 HELO_NODOT 9685 1.37 1.15 1.41 107 HELO_NO_DOMAIN 9681 1.37 1.14 1.41 108 RCVD_IN_MSPIKE_H5 8916 1.14 0.19 1.30 109 URI_HEX 8833 1.35 1.75 1.29 110 SUBJ_ALL_CAPS 8510 1.32 1.80 1.24 111 T_XMDrugObfuBody_14 8391 1.25 1.43 1.22 112 XMSubNoVowel 8354 1.20 1.13 1.22 113 RCVD_IN_BL_SPAMCOP_NET 7924 5.12 28.17 1.15 114 HELO_MISC_IP 7732 1.04 0.57 1.13 115 CK_HELO_DYNAMIC_SPLIT_IP 7721 1.04 0.53 1.12 116 XM_H_Long_From02 7707 1.12 1.08 1.12 117 IN_HORDE_ADDRESS_BOOK 7649 0.97 0.16 1.11 118 TooManyTo_003 7552 1.01 0.47 1.10 119 XM_OfRef6 7510 1.38 3.02 1.09 120 XM_UB50 7401 2.17 8.54 1.08 121 INVALID_MSGID 7257 0.96 0.40 1.06 122 XMNoVowels 7177 1.00 0.77 1.05 123 TM2_M_VERY_LONG_WORD 6885 1.13 1.89 1.00 124 XMStockSpam_06 6869 1.05 1.34 1.00 125 XM_GoogleGroups 6807 0.91 0.42 0.99 126 URI_TRY_3LD 6702 1.07 1.60 0.98 127 XMGappySubj_01 6631 0.88 0.40 0.97 128 XMCapTrack 6576 0.87 0.37 0.96 129 TO_MALFORMED 6552 0.82 0.01 0.95 130 XM_ProductURIs 6493 0.93 0.85 0.95 131 DKIM_ADSP_CUSTOM_MED 6328 1.00 1.43 0.92 132 RELAYCOUNTRY_GB 6103 1.12 2.47 0.89 133 TR_MSPIKEBAYES00 5998 0.75 0.01 0.87 134 XMBrknScrpt_02 5956 1.08 2.31 0.87 135 T_TooManySym_03 5805 0.75 0.22 0.85 136 T_OBFU_PDF_ATTACH 5670 0.72 0.14 0.83 137 USER_IN_DEF_DKIM_WL 5649 0.70 0.00 0.82 138 TooManyTo_004 5645 0.76 0.40 0.82 139 SpammyFromTLD_01 5596 1.19 3.34 0.81 140 XMGenDplmaNmb 5428 0.90 1.55 0.79 141 T_FILL_THIS_FORM_SHORT 5387 0.88 1.44 0.78 142 XMBody_17 5161 1.00 2.44 0.75 143 XMHTML_After_End 5130 0.82 1.26 0.75 144 HTML_FONT_FACE_BAD 5091 0.70 0.46 0.74 145 XMBdyGiftCard01 4832 0.78 1.23 0.70 146 TR_MetaPhish_Combo_01 4803 0.73 0.92 0.70 147 XMSubMetaI_00 4700 0.69 0.73 0.68 148 NML_ADSP_CUSTOM_MED 4620 0.77 1.31 0.67 149 TooManyTo_005 4540 0.61 0.34 0.66 150 XM_RXBody 4517 0.62 0.38 0.66 151 TR_XM_COVIDMETA4 4236 1.17 4.38 0.62 152 RCVD_IN_MSPIKE_BL 4205 1.67 7.84 0.61 153 HTTPS_HTTP_MISMATCH 4179 0.68 1.09 0.61 154 XMMoneyMeta_00 4060 0.62 0.78 0.59 155 XMBody_95 4031 0.52 0.12 0.59 156 PLING_QUERY 3752 0.55 0.60 0.55 157 XM_SPF_Unknown 3725 0.55 0.59 0.54 158 XM_shorewaves_Whitelist 3610 0.45 0.00 0.53 159 T_Symld_Words_02 3607 0.66 1.41 0.53 160 XM_DIRTYINTL 3606 1.01 3.81 0.53 161 MISSING_HEADERS 3568 0.57 0.84 0.52 162 XMSexyCombo_01 3447 0.70 1.87 0.50 163 RELAYCOUNTRY_NL 3427 0.65 1.50 0.50 164 T_XMHurry_00 3374 0.62 1.36 0.49 165 T_TooManySym_04 3271 0.42 0.06 0.48 166 TR_BOTNET_NEGATE 3146 0.43 0.27 0.46 167 XMBody_78 3146 0.55 1.08 0.46 168 XMSolicitRefs_0 3142 0.42 0.21 0.46 169 TR_LOTS_OF_MONEY3 3141 0.62 1.60 0.46 170 XM_ShortIntro_01 3139 0.47 0.54 0.46 171 FORGED_GMAIL_RCVD 3097 0.56 1.18 0.45 172 XMPhish14 3063 0.51 0.91 0.45 173 XMSubMetaSxObfu_03 3023 0.52 1.01 0.44 174 TR_XM_UnparsRelay 2969 0.76 2.66 0.43 175 XMPhish30 2910 0.50 0.91 0.42 176 FROM_GOV_DKIM_AU 2898 0.38 0.14 0.42 177 RELAYCOUNTRY_FR 2880 0.88 3.58 0.42 178 HTML_IMAGE_ONLY_20 2874 0.45 0.62 0.42 179 XM_H_PHPMailer 2855 0.48 0.83 0.42 180 DKIM_ADSP_NXDOMAIN 2848 0.47 0.77 0.41 181 TR_XM_PHPDW 2774 0.65 2.07 0.40 182 DIET_1 2722 0.48 1.00 0.40 183 XMLKML 2678 0.33 0.00 0.39 184 URI_NOVOWEL 2668 0.43 0.70 0.39 185 TR_XM_FormFill2 2663 0.63 2.01 0.39 186 TR_XM_PHPForged 2662 0.63 2.03 0.39 187 RELAYCOUNTRY_AU 2627 0.57 1.63 0.38 188 XM_H_PHPOS 2624 0.62 2.00 0.38 189 RCVD_IN_MSPIKE_L3 2596 0.95 4.27 0.38 190 XMHTMLBadTable_001 2596 0.37 0.34 0.38 191 FROM_GOV_SPOOF 2592 0.35 0.21 0.38 192 XM_B_REG_HTML 2582 0.35 0.20 0.38 193 HTML_TAG_BALANCE_BODY 2578 0.40 0.51 0.38 194 XMSlimDrugH 2550 0.40 0.60 0.37 195 XMPhish08 2499 0.43 0.82 0.36 196 NUMERIC_HTTP_ADDR 2483 0.37 0.39 0.36 197 XMLngstWrd_00 2439 0.40 0.69 0.36 198 HTML_IMAGE_ONLY_28 2395 0.35 0.34 0.35 199 SHORT_HELO_AND_INLINE_IMAGE 2372 0.30 0.07 0.35 200 RELAYCOUNTRY_DE 2337 0.46 1.16 0.34 ----------------------------------------------------------------------