Email: 784357 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.76 sec Spam: 91363 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 4.15 sec Ham: 692994 Autolearn: 0 AvgScore: -1.93 AvgScanTime: 1.44 sec Time Spent Running SA: 382.43 hours Time Spent Processing Spam: 105.32 hours Time Spent Processing Ham: 277.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 89290 98.53 97.73 98.63 2 HTML_MESSAGE 85158 75.45 93.21 73.10 3 DKIM_SIGNED 69225 61.20 75.77 59.27 4 XM_B_Unicode 68369 60.10 74.83 58.16 5 XM_DK_Pass 66694 59.92 73.00 58.20 6 RELAYCOUNTRY_US 63913 66.10 69.96 65.59 7 XMListUnsubscribeExists 58731 43.30 64.28 40.54 8 DKIM_VALID 53620 55.32 58.69 54.88 9 XM_DK_Undo_02 49344 15.06 54.01 9.93 10 BAYES_99 37631 10.68 41.19 6.66 11 DKIM_VALID_AU 37443 40.82 40.98 40.80 12 XM_B_Unicode3 35892 33.19 39.29 32.38 13 BAYES_50 31640 42.42 34.63 43.45 14 BAYES_999 29933 8.58 32.76 5.39 15 MIME_HTML_ONLY 29123 19.67 31.88 18.06 16 LOC_TINY_FONT_1 29085 21.19 31.83 19.78 17 BOTNET 27626 5.97 30.24 2.77 18 RELAYCOUNTRY_META 24709 6.80 27.04 4.13 19 FVGT_m_MULTI_ODD 23950 17.82 26.21 16.71 20 RCVD_IN_MSPIKE_H2 23427 19.41 25.64 18.59 21 HTML_FONT_LOW_CONTRAST 22973 21.90 25.14 21.48 22 DKIM_VALID_EF 22304 21.29 24.41 20.88 23 XMSubLong 21404 17.97 23.43 17.25 24 XM_Body_Dirty_Words 20129 12.28 22.03 11.00 25 T_TM2_M_HEADER_IN_MSG 20079 21.57 21.98 21.52 26 T_KAM_HTML_FONT_INVALID 19641 17.30 21.50 16.74 27 XM_Multi_Part_URI 18944 19.06 20.73 18.84 28 DKIM_INVALID 15605 5.87 17.08 4.39 29 UNTRUSTED_Relay 15447 3.40 16.91 1.62 30 BOTNET_IPINHOSTNAME 14999 5.65 16.42 4.24 31 XM_UncommonTLD01 14718 3.81 16.11 2.19 32 LOTS_OF_MONEY 14407 7.69 15.77 6.63 33 XM_B_Unsub 11506 12.06 12.59 11.99 34 NO_DNS_FOR_FROM 11287 3.66 12.35 2.52 35 XM_B_Phish_Phrases 10990 6.12 12.03 5.34 36 XMSexyCombo_05 10561 4.59 11.56 3.67 37 RCVD_IN_MSPIKE_BL 9986 1.89 10.93 0.70 38 XM_Evil_Numbers_Gen 9367 6.81 10.25 6.36 39 RCVD_IN_MSPIKE_WL 8996 19.71 9.85 21.01 40 LotsOfNums_01 8622 7.30 9.44 7.01 41 RELAYCOUNTRY_CA 7884 2.31 8.63 1.47 42 RCVD_IN_BL_SPAMCOP_NET 7800 1.93 8.54 1.06 43 XMSubMetaSx_00 7657 3.51 8.38 2.87 44 HTML_IMAGE_RATIO_02 7595 6.06 8.31 5.77 45 TR_XM_PhishingBody 7542 3.17 8.25 2.50 46 MPART_ALT_DIFF 7109 5.49 7.78 5.18 47 BAYES_80 7059 4.05 7.73 3.56 48 BOTNET_NORDNS 6287 0.82 6.88 0.02 49 XM_B_COVIDMETA 6021 2.01 6.59 1.41 50 BAYES_60 6015 5.49 6.58 5.35 51 TooManyTo_001 5968 8.07 6.53 8.27 52 XM_UB50 5696 1.44 6.23 0.81 53 UNPARSEABLE_RELAY 5525 5.53 6.05 5.46 54 SpammyFromTLD_01 5329 1.14 5.83 0.52 55 RCVD_IN_RP_RNBL 5312 0.74 5.81 0.07 56 TR_XM_INV_DKIM 5253 0.91 5.75 0.27 57 RCVD_IN_MSPIKE_L3 5102 1.02 5.58 0.41 58 RCVD_IN_MSPIKE_H3 5092 11.22 5.57 11.96 59 XM_H_Long_From01 5058 4.51 5.54 4.37 60 XM_B_Phish66 5053 1.87 5.53 1.39 61 T_REMOTE_IMAGE 4979 2.93 5.45 2.60 62 XMBody_17 4953 1.26 5.42 0.71 63 FROM_EXCESS_BASE64 4896 2.82 5.36 2.48 64 HTML_IMAGE_RATIO_04 4846 5.37 5.30 5.38 65 TR_XM_COVIDMETA4 4824 1.15 5.28 0.61 66 SpammyFromTLD_02 4794 0.91 5.25 0.33 67 XMNumbers 4604 2.81 5.04 2.51 68 RCVD_IN_MSPIKE_L5 4569 0.78 5.00 0.23 69 HTML_MIME_NO_HTML_TAG 4554 2.28 4.98 1.93 70 XM_SendGrid 4532 4.92 4.96 4.91 71 XM_B_SpammyTLD 4519 2.47 4.95 2.14 72 MIME_HTML_MOSTLY 4470 2.36 4.89 2.02 73 XM_SPF_SoftFail 4442 1.76 4.86 1.35 74 XM_DIRTYINTL 4284 0.99 4.69 0.50 75 ALL_TRUSTED 4237 28.17 4.64 31.27 76 HTML_IMAGE_RATIO_06 4116 3.11 4.51 2.93 77 XM_UB99 3799 0.49 4.16 0.01 78 RCVD_IN_MSPIKE_H4 3795 7.31 4.15 7.72 79 TR_XM_MaxSPIKE 3752 0.52 4.11 0.04 80 TR_LOTS_OF_MONEY3 3722 1.02 4.07 0.62 81 FROM_SUSPICIOUS_NTLD 3681 0.49 4.03 0.03 82 FROM_SUSPICIOUS_NTLD_FP 3655 0.49 4.00 0.03 83 KHOP_HELO_FCRDNS 3637 1.67 3.98 1.37 84 BODY_URI_ONLY 3625 0.49 3.97 0.04 85 BAYES_95 3607 2.39 3.95 2.19 86 TR_XM_MaxWHORU 3572 0.51 3.91 0.06 87 XMSexyCombo_01 3506 1.00 3.84 0.63 88 XMBrknScrpt_02 3453 1.14 3.78 0.79 89 HTML_TAG_BALANCE_CENTER 3403 0.52 3.72 0.09 90 TR_XM_COVIDMETA1 3228 0.71 3.53 0.33 91 RCVD_IN_PSBL 3216 0.41 3.52 0.00 92 RELAYCOUNTRY_FR 3208 0.59 3.51 0.20 93 HDRS_MISSP 3086 0.43 3.38 0.04 94 URIBL_SBL_A 3056 0.59 3.34 0.22 95 TR_XM_UnparsRelay 3052 0.77 3.34 0.43 96 TM2_M_URI_OPT_OUT 3040 19.64 3.33 21.79 97 T_XMDrugObfuBody_08 3033 1.49 3.32 1.25 98 XM_OfRef6 3022 1.22 3.31 0.94 99 HTML_IMAGE_RATIO_08 2998 2.21 3.28 2.06 100 MIME_QP_LONG_LINE 2904 4.24 3.18 4.38 101 XMStrtUSub 2903 3.49 3.18 3.53 102 XM_UB999 2889 0.37 3.16 0.00 103 XM_URI_RBL 2875 0.53 3.15 0.18 104 XM_B_Unsub2 2822 5.19 3.09 5.46 105 T_TooManySym_01 2760 3.58 3.02 3.65 106 MISSING_HEADERS 2631 0.81 2.88 0.54 107 REPLYTO_WITHOUT_TO_CC 2602 0.57 2.85 0.27 108 BASE64_LENGTH_79_INF 2572 0.73 2.82 0.45 109 SUBJ_ALL_CAPS 2537 1.36 2.78 1.17 110 TR_XM_MaxBayes 2412 0.34 2.64 0.03 111 IMPOTENCE 2404 0.32 2.63 0.01 112 URI_HEX 2334 1.54 2.55 1.40 113 XMHTML_After_End 2283 0.91 2.50 0.70 114 PDS_OTHER_BAD_TLD 2279 0.43 2.49 0.15 115 MPART_ALT_DIFF_COUNT 2186 0.51 2.39 0.26 116 TR_Mismatch_TLD_01 2182 0.47 2.39 0.21 117 MIME_HTML_ONLY_MULTI 2172 3.58 2.38 3.73 118 T_XMHurry_00 2153 1.07 2.36 0.90 119 XM_CamelCaseFrm001 2112 1.73 2.31 1.66 120 TR_XM_PHPDW 2056 0.53 2.25 0.30 121 T_XMDrugObfuBody_14 2044 1.32 2.24 1.19 122 TR_XM_PHPForged 2021 0.51 2.21 0.29 123 XMDiploma_00 1994 1.43 2.18 1.33 124 TR_XM_FormFill2 1992 0.51 2.18 0.29 125 XM_H_PHPOS 1982 0.50 2.17 0.28 126 SHORT_URI_3 1982 0.36 2.17 0.12 127 TM2_M_VERY_LONG_WORD 1972 1.00 2.16 0.85 128 TR_XM_RelayPhish 1945 0.33 2.13 0.09 129 XM_UB80 1931 0.28 2.11 0.04 130 SHORT_URI_4 1842 0.37 2.02 0.15 131 XM_UB60 1792 0.32 1.96 0.10 132 TR_XM_DK_SendGrid 1776 2.61 1.94 2.70 133 TR_MetaPhish_Combo_01 1760 0.93 1.93 0.80 134 XM_JunkDunk 1720 0.22 1.88 0.00 135 XM_DK_Undo_01 1690 1.36 1.85 1.30 136 BAYES_40 1676 3.53 1.83 3.76 137 RELAYCOUNTRY_GB 1621 0.84 1.77 0.72 138 MAILING_LIST_MULTI 1606 1.75 1.76 1.75 139 URI_TRY_3LD 1597 1.08 1.75 0.99 140 BILLION_DOLLARS 1596 0.25 1.75 0.05 141 BAYES_20 1583 4.11 1.73 4.42 142 XMStockSpam_06 1477 0.94 1.62 0.85 143 DATE_IN_PAST_03_06 1444 0.27 1.58 0.09 144 TR_Symld_Words 1429 1.43 1.56 1.41 145 PDS_BTC_ID 1426 0.21 1.56 0.03 146 TVD_SPACE_RATIO_MINFP 1413 0.19 1.55 0.01 147 HK_RANDOM_REPLYTO 1362 0.33 1.49 0.18 148 DKIM_ADSP_CUSTOM_MED 1351 1.02 1.48 0.96 149 BAYES_00 1347 22.14 1.47 24.86 150 DATE_IN_PAST_06_12 1276 0.33 1.40 0.19 151 XMSubNoVowel 1275 1.60 1.40 1.63 152 FUZZY_BITCOIN 1263 0.16 1.38 0.00 153 BITCOIN_SPAM_03 1253 0.16 1.37 0.00 154 URI_OPTOUT_3LD 1250 0.33 1.37 0.20 155 OBFU_BITCOIN 1246 0.16 1.36 0.00 156 T_XMDrugObfuBody_00 1236 4.32 1.35 4.71 157 NML_ADSP_CUSTOM_MED 1224 0.79 1.34 0.71 158 T_FILL_THIS_FORM_SHORT 1223 0.64 1.34 0.55 159 TR_Sbj_FN_Bdy 1222 0.30 1.34 0.17 160 XMBody_78 1210 0.48 1.32 0.37 161 XM_H_Long_From02 1208 0.82 1.32 0.75 162 RELAYCOUNTRY_DE 1202 0.41 1.32 0.29 163 XM_PDF 1193 2.98 1.31 3.20 164 XMBdyGiftCard01 1185 0.87 1.30 0.82 165 XMPhish30 1171 0.54 1.28 0.44 166 SUSP_UTF8_WORD_MANY 1159 0.15 1.27 0.00 167 TooManyTo_002 1122 2.99 1.23 3.22 168 RELAYCOUNTRY_NL 1121 0.29 1.23 0.17 169 FORGED_GMAIL_RCVD 1112 0.53 1.22 0.44 170 XMSubMetaSxObfu_03 1112 0.53 1.22 0.44 171 XMSubEmpty 1104 0.33 1.21 0.22 172 XM_BadFromFormat 1096 0.24 1.20 0.12 173 ANY_BOUNCE_MESSAGE 1083 18.91 1.19 21.25 174 BOUNCE_MESSAGE 1078 18.91 1.18 21.24 175 HTML_FONT_TINY_NORDNS 1067 0.46 1.17 0.37 176 RELAYCOUNTRY_JP 1066 0.16 1.17 0.03 177 XM_UB95 1040 0.15 1.14 0.02 178 XMGenDplmaNmb 1037 0.72 1.14 0.67 179 INVALID_MSGID 1024 1.07 1.12 1.07 180 LongTLD 999 0.24 1.09 0.13 181 TR_LOTS_OF_MONEY2 977 0.30 1.07 0.20 182 T_MONEY_PERCENT 977 0.30 1.07 0.20 183 XM_H_MailChimp 974 0.28 1.07 0.17 184 HTML_TAG_BALANCE_BODY 972 0.54 1.06 0.47 185 TR_XM_DK_Bayes 968 5.24 1.06 5.79 186 XMSexyCombo_04 943 0.20 1.03 0.09 187 RCVD_IN_IADB_LISTED 943 4.05 1.03 4.45 188 MIME_CHARSET_FARAWAY 933 0.16 1.02 0.05 189 XM_H_PHPMailer 909 0.42 0.99 0.34 190 RDNS_DYNAMIC 899 0.35 0.98 0.26 191 XMLngstWrd_00 897 0.44 0.98 0.37 192 DKIM_ADSP_NXDOMAIN 896 0.46 0.98 0.39 193 XMSubMetaI_00 887 0.63 0.97 0.58 194 RELAYCOUNTRY_HU 882 0.12 0.97 0.01 195 TooManyTo_003 879 2.19 0.96 2.35 196 URIBL_BLACK 873 0.12 0.96 0.01 197 XMReplyNow 867 0.20 0.95 0.10 198 TR_Mismatch_TLD_02 860 0.16 0.94 0.06 199 FROM_LOCAL_HEX 853 0.16 0.93 0.06 200 XMLngstWrd_01 851 0.39 0.93 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 683523 98.53 97.73 98.63 2 HTML_MESSAGE 506602 75.45 93.21 73.10 3 RELAYCOUNTRY_US 454568 66.10 69.96 65.59 4 DKIM_SIGNED 410768 61.20 75.77 59.27 5 XM_DK_Pass 403319 59.92 73.00 58.20 6 XM_B_Unicode 403062 60.10 74.83 58.16 7 DKIM_VALID 380312 55.32 58.69 54.88 8 BAYES_50 301105 42.42 34.63 43.45 9 DKIM_VALID_AU 282721 40.82 40.98 40.80 10 XMListUnsubscribeExists 280921 43.30 64.28 40.54 11 XM_B_Unicode3 224417 33.19 39.29 32.38 12 ALL_TRUSTED 216681 28.17 4.64 31.27 13 BAYES_00 172296 22.14 1.47 24.86 14 TM2_M_URI_OPT_OUT 151035 19.64 3.33 21.79 15 T_TM2_M_HEADER_IN_MSG 149109 21.57 21.98 21.52 16 HTML_FONT_LOW_CONTRAST 148824 21.90 25.14 21.48 17 ANY_BOUNCE_MESSAGE 147229 18.91 1.19 21.25 18 BOUNCE_MESSAGE 147223 18.91 1.18 21.24 19 RCVD_IN_MSPIKE_WL 145632 19.71 9.85 21.01 20 DKIM_VALID_EF 144716 21.29 24.41 20.88 21 LOC_TINY_FONT_1 137102 21.19 31.83 19.78 22 XM_Multi_Part_URI 130558 19.06 20.73 18.84 23 RCVD_IN_MSPIKE_H2 128836 19.41 25.64 18.59 24 MIME_HTML_ONLY 125131 19.67 31.88 18.06 25 XMSubLong 119518 17.97 23.43 17.25 26 T_KAM_HTML_FONT_INVALID 116020 17.30 21.50 16.74 27 FVGT_m_MULTI_ODD 115823 17.82 26.21 16.71 28 XM_B_Unsub 83063 12.06 12.59 11.99 29 RCVD_IN_MSPIKE_H3 82910 11.22 5.57 11.96 30 XM_Body_Dirty_Words 76215 12.28 22.03 11.00 31 XM_DK_Undo_02 68817 15.06 54.01 9.93 32 TooManyTo_001 57345 8.07 6.53 8.27 33 RCVD_IN_MSPIKE_H4 53506 7.31 4.15 7.72 34 LotsOfNums_01 48603 7.30 9.44 7.01 35 BAYES_99 46167 10.68 41.19 6.66 36 LOTS_OF_MONEY 45916 7.69 15.77 6.63 37 XM_Evil_Numbers_Gen 44067 6.81 10.25 6.36 38 TR_XM_DK_Bayes 40155 5.24 1.06 5.79 39 HTML_IMAGE_RATIO_02 39953 6.06 8.31 5.77 40 BAYES_05 39843 5.18 0.87 5.75 41 IN_ZIMBRA_NJ_WHITELIST 39765 5.07 0.04 5.74 42 RCVD_IN_RP_SAFE 39555 5.12 0.68 5.71 43 XM_DKIMWhitelistDomains 38481 4.91 0.01 5.55 44 XM_B_Unsub2 37859 5.19 3.09 5.46 45 UNPARSEABLE_RELAY 37822 5.53 6.05 5.46 46 BAYES_999 37369 8.58 32.76 5.39 47 HTML_IMAGE_RATIO_04 37313 5.37 5.30 5.38 48 TR_XM_DK_Bayes1 37255 4.85 0.85 5.38 49 BAYES_60 37064 5.49 6.58 5.35 50 XM_B_Phish_Phrases 37017 6.12 12.03 5.34 51 RCVD_IN_RP_CERTIFIED 36315 4.69 0.50 5.24 52 MPART_ALT_DIFF 35917 5.49 7.78 5.18 53 XM_SendGrid 34049 4.92 4.96 4.91 54 T_XMDrugObfuBody_00 32625 4.32 1.35 4.71 55 TR_XM_DK_Bayes2 32489 4.20 0.54 4.69 56 RCVD_IN_IADB_LISTED 30842 4.05 1.03 4.45 57 BAYES_20 30643 4.11 1.73 4.42 58 DKIM_INVALID 30456 5.87 17.08 4.39 59 MIME_QP_LONG_LINE 30387 4.24 3.18 4.38 60 XM_H_Long_From01 30312 4.51 5.54 4.37 61 XM_H_Trusted_IP 29432 3.75 0.00 4.25 62 BOTNET_IPINHOSTNAME 29350 5.65 16.42 4.24 63 RELAYCOUNTRY_META 28626 6.80 27.04 4.13 64 RCVD_IN_IADB_SPF 26606 3.50 0.93 3.84 65 BAYES_40 26023 3.53 1.83 3.76 66 MIME_HTML_ONLY_MULTI 25880 3.58 2.38 3.73 67 XMSexyCombo_05 25414 4.59 11.56 3.67 68 T_TooManySym_01 25305 3.58 3.02 3.65 69 BAYES_80 24690 4.05 7.73 3.56 70 XMStrtUSub 24442 3.49 3.18 3.53 71 RCVD_IN_IADB_SENDERID 23258 3.07 0.88 3.36 72 RCVD_IN_IADB_DK 22973 3.03 0.89 3.32 73 TooManyTo_002 22319 2.99 1.23 3.22 74 XM_PDF 22161 2.98 1.31 3.20 75 HTML_IMAGE_RATIO_06 20284 3.11 4.51 2.93 76 XMSubMetaSx_00 19895 3.51 8.38 2.87 77 RCVD_IN_IADB_VOUCHED 19380 2.51 0.30 2.80 78 BOTNET 19171 5.97 30.24 2.77 79 TR_XM_DK_SendGrid 18720 2.61 1.94 2.70 80 T_REMOTE_IMAGE 18033 2.93 5.45 2.60 81 NO_DNS_FOR_FROM 17448 3.66 12.35 2.52 82 XMNumbers 17402 2.81 5.04 2.51 83 TR_XM_PhishingBody 17342 3.17 8.25 2.50 84 FROM_EXCESS_BASE64 17205 2.82 5.36 2.48 85 TooManyTo_003 16317 2.19 0.96 2.35 86 XM_UncommonTLD01 15202 3.81 16.11 2.19 87 BAYES_95 15146 2.39 3.95 2.19 88 XM_B_SpammyTLD 14860 2.47 4.95 2.14 89 HTML_IMAGE_RATIO_08 14303 2.21 3.28 2.06 90 MIME_HTML_MOSTLY 14003 2.36 4.89 2.02 91 HTML_MIME_NO_HTML_TAG 13355 2.28 4.98 1.93 92 TooManyTo_004 12149 1.65 0.84 1.75 93 MAILING_LIST_MULTI 12121 1.75 1.76 1.75 94 RCVD_IN_IADB_OPTIN 12016 1.57 0.32 1.73 95 T_TooManySym_02 11811 1.61 0.89 1.70 96 XM_CamelCaseFrm001 11474 1.73 2.31 1.66 97 XMSubNoVowel 11303 1.60 1.40 1.63 98 UNTRUSTED_Relay 11256 3.40 16.91 1.62 99 RELAYCOUNTRY_CA 10219 2.31 8.63 1.47 100 TVD_RCVD_IP 10025 1.33 0.43 1.45 101 XM_B_COVIDMETA 9770 2.01 6.59 1.41 102 TR_Symld_Words 9769 1.43 1.56 1.41 103 URI_HEX 9734 1.54 2.55 1.40 104 XM_B_Phish66 9634 1.87 5.53 1.39 105 HTML_FONT_FACE_BAD 9583 1.29 0.55 1.38 106 URI_WP_HACKED_2 9560 1.30 0.69 1.38 107 KHOP_HELO_FCRDNS 9486 1.67 3.98 1.37 108 XM_SPF_SoftFail 9350 1.76 4.86 1.35 109 RCVD_IN_MSPIKE_H5 9216 1.19 0.12 1.33 110 XMDiploma_00 9193 1.43 2.18 1.33 111 XM_DK_Undo_01 8987 1.36 1.85 1.30 112 TooManyTo_005 8775 1.19 0.65 1.27 113 T_XMDrugObfuBody_08 8677 1.49 3.32 1.25 114 T_XMDrugObfuBody_14 8279 1.32 2.24 1.19 115 SUBJ_ALL_CAPS 8132 1.36 2.78 1.17 116 HELO_MISC_IP 7494 1.03 0.61 1.08 117 CK_HELO_DYNAMIC_SPLIT_IP 7493 1.02 0.55 1.08 118 INVALID_MSGID 7405 1.07 1.12 1.07 119 RCVD_IN_BL_SPAMCOP_NET 7340 1.93 8.54 1.06 120 IN_HORDE_ADDRESS_BOOK 7310 0.95 0.14 1.05 121 HELO_NODOT 7000 0.99 0.82 1.01 122 HELO_NO_DOMAIN 6998 0.99 0.81 1.01 123 URI_TRY_3LD 6869 1.08 1.75 0.99 124 XMGappySubj_01 6805 0.88 0.11 0.98 125 XM_GoogleGroups 6660 0.91 0.49 0.96 126 DKIM_ADSP_CUSTOM_MED 6657 1.02 1.48 0.96 127 TO_MALFORMED 6598 0.84 0.02 0.95 128 XM_OfRef6 6516 1.22 3.31 0.94 129 T_XMHurry_00 6246 1.07 2.36 0.90 130 XMStockSpam_06 5920 0.94 1.62 0.85 131 TM2_M_VERY_LONG_WORD 5872 1.00 2.16 0.85 132 XMBdyGiftCard01 5667 0.87 1.30 0.82 133 XM_UB50 5631 1.44 6.23 0.81 134 TR_MetaPhish_Combo_01 5557 0.93 1.93 0.80 135 XMBrknScrpt_02 5483 1.14 3.78 0.79 136 XMCapTrack 5254 0.73 0.48 0.76 137 XM_H_Long_From02 5215 0.82 1.32 0.75 138 RELAYCOUNTRY_GB 4965 0.84 1.77 0.72 139 NML_ADSP_CUSTOM_MED 4943 0.79 1.34 0.71 140 USER_IN_DEF_DKIM_WL 4928 0.63 0.00 0.71 141 XMBody_17 4914 1.26 5.42 0.71 142 XMHTML_After_End 4885 0.91 2.50 0.70 143 RCVD_IN_MSPIKE_BL 4830 1.89 10.93 0.70 144 T_TooManySym_03 4692 0.62 0.18 0.68 145 XMGenDplmaNmb 4649 0.72 1.14 0.67 146 XM_ProductURIs 4509 0.65 0.62 0.65 147 XMSexyCombo_01 4367 1.00 3.84 0.63 148 TR_LOTS_OF_MONEY3 4295 1.02 4.07 0.62 149 TR_MSPIKEBAYES00 4291 0.55 0.00 0.62 150 TR_XM_COVIDMETA4 4208 1.15 5.28 0.61 151 HTML_FONT_SIZE_HUGE 4147 0.61 0.69 0.60 152 XMSubMetaI_00 4032 0.63 0.97 0.58 153 TR_BOTNET_NEGATE 3845 0.54 0.44 0.55 154 T_FILL_THIS_FORM_SHORT 3822 0.64 1.34 0.55 155 MISSING_HEADERS 3718 0.81 2.88 0.54 156 T_OBFU_PDF_ATTACH 3657 0.49 0.17 0.53 157 SpammyFromTLD_01 3598 1.14 5.83 0.52 158 XM_DIRTYINTL 3450 0.99 4.69 0.50 159 HTTPS_HTTP_MISMATCH 3285 0.48 0.50 0.47 160 HTML_TAG_BALANCE_BODY 3229 0.54 1.06 0.47 161 XM_B_COPY_HTML 3167 0.47 0.60 0.46 162 BASE64_LENGTH_79_INF 3130 0.73 2.82 0.45 163 HTML_IMAGE_ONLY_20 3108 0.49 0.83 0.45 164 FORGED_GMAIL_RCVD 3076 0.53 1.22 0.44 165 XMSubMetaSxObfu_03 3042 0.53 1.22 0.44 166 XMBody_95 3036 0.40 0.13 0.44 167 FROM_GOV_DKIM_AU 3036 0.40 0.11 0.44 168 XMPhish30 3029 0.54 1.28 0.44 169 XM_SPF_Unknown 3020 0.48 0.85 0.44 170 TR_XM_UnparsRelay 2986 0.77 3.34 0.43 171 XMNoVowels 2921 0.47 0.83 0.42 172 RCVD_IN_MSPIKE_L3 2867 1.02 5.58 0.41 173 TM2_M_A_HREF_HREF 2806 0.44 0.69 0.40 174 XM_ShortIntro_01 2784 0.43 0.62 0.40 175 T_Symld_Words_02 2755 0.43 0.70 0.40 176 DKIM_ADSP_NXDOMAIN 2728 0.46 0.98 0.39 177 XMPhish08 2694 0.44 0.80 0.39 178 XMMoneyMeta_00 2689 0.44 0.81 0.39 179 XM_UCStrings02 2636 0.34 0.07 0.38 180 XMBody_78 2567 0.48 1.32 0.37 181 T_TooManySym_04 2562 0.33 0.06 0.37 182 HTML_FONT_TINY_NORDNS 2544 0.46 1.17 0.37 183 XMLngstWrd_00 2543 0.44 0.98 0.37 184 XM_B_REG_HTML 2519 0.34 0.17 0.36 185 XMDateMe_00 2511 0.39 0.63 0.36 186 FROM_GOV_SPOOF 2446 0.34 0.25 0.35 187 XM_H_PHPMailer 2354 0.42 0.99 0.34 188 XMHTMLBadTable_001 2353 0.33 0.24 0.34 189 SpammyFromTLD_02 2318 0.91 5.25 0.33 190 TR_XM_COVIDMETA1 2314 0.71 3.53 0.33 191 XM_S_SubURI 2296 0.30 0.07 0.33 192 NUMERIC_HTTP_ADDR 2263 0.33 0.39 0.33 193 XMLngstWrd_01 2180 0.39 0.93 0.31 194 XM_Combo_Sbj 2173 0.34 0.57 0.31 195 TR_XM_PHPDW 2109 0.53 2.25 0.30 196 RELAYCOUNTRY_AU 2107 0.32 0.45 0.30 197 LOW_PRICE 2101 0.35 0.72 0.30 198 TM2_M_BODY_EMPTY 2020 0.28 0.15 0.29 199 SHORT_HELO_AND_INLINE_IMAGE 2001 0.26 0.08 0.29 200 RCVD_IN_SORBS_DUL 1999 0.29 0.33 0.29 ----------------------------------------------------------------------