Email: 778053 Autolearn: 0 AvgScore: 0.35 AvgScanTime: 1.79 sec Spam: 113546 Autolearn: 0 AvgScore: 12.50 AvgScanTime: 3.65 sec Ham: 664507 Autolearn: 0 AvgScore: -1.72 AvgScanTime: 1.48 sec Time Spent Running SA: 387.67 hours Time Spent Processing Spam: 115.04 hours Time Spent Processing Ham: 272.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 110545 98.31 97.36 98.48 2 HTML_MESSAGE 103586 77.05 91.23 74.63 3 DKIM_SIGNED 79136 65.40 69.70 64.66 4 XM_DK_Pass 76890 64.25 67.72 63.65 5 RELAYCOUNTRY_US 75990 69.35 66.92 69.76 6 XM_B_Unicode 69161 58.30 60.91 57.85 7 DKIM_VALID 63136 59.10 55.60 59.70 8 XMListUnsubscribeExists 59295 44.10 52.22 42.71 9 XM_DK_Undo_02 50570 15.40 44.54 10.42 10 DKIM_VALID_AU 47309 44.85 41.67 45.40 11 BAYES_50 43233 44.18 38.08 45.22 12 BAYES_99 38529 10.68 33.93 6.71 13 MIME_HTML_ONLY 37834 19.59 33.32 17.24 14 RELAYCOUNTRY_META 37554 8.82 33.07 4.67 15 FVGT_m_MULTI_ODD 35177 21.06 30.98 19.37 16 XM_B_Unicode3 33562 32.35 29.56 32.83 17 BOTNET 32683 6.79 28.78 3.03 18 DKIM_VALID_EF 31632 24.89 27.86 24.38 19 RCVD_IN_MSPIKE_H2 30836 20.91 27.16 19.85 20 BAYES_999 30369 8.45 26.75 5.32 21 LOC_TINY_FONT_1 29747 20.99 26.20 20.09 22 LOTS_OF_MONEY 29291 9.65 25.80 6.90 23 T_TM2_M_HEADER_IN_MSG 27380 25.01 24.11 25.16 24 UNTRUSTED_Relay 25479 4.91 22.44 1.91 25 HTML_FONT_LOW_CONTRAST 24823 22.89 21.86 23.07 26 XMSubLong 24092 18.68 21.22 18.24 27 T_KAM_HTML_FONT_INVALID 20290 15.80 17.87 15.45 28 XM_Multi_Part_URI 18862 17.73 16.61 17.92 29 XM_Body_Dirty_Words 18583 11.89 16.37 11.13 30 BOTNET_IPINHOSTNAME 16686 5.80 14.70 4.28 31 DKIM_INVALID 16000 6.30 14.09 4.97 32 XM_UncommonTLD01 14831 4.12 13.06 2.59 33 LotsOfNums_01 14458 7.78 12.73 6.93 34 XM_OfRef6 14192 2.67 12.50 0.99 35 HTML_MIME_NO_HTML_TAG 13856 3.26 12.20 1.74 36 NO_DNS_FOR_FROM 13417 4.24 11.82 2.95 37 RCVD_IN_MSPIKE_BL 12329 2.20 10.86 0.72 38 TR_XM_PhishingBody 12327 3.93 10.86 2.75 39 XMSexyCombo_05 12088 4.62 10.65 3.59 40 XM_B_Phish_Phrases 11643 6.59 10.25 5.96 41 BAYES_40 10837 5.10 9.54 4.35 42 HELO_NODOT 10761 2.51 9.48 1.32 43 HELO_NO_DOMAIN 10760 2.51 9.48 1.32 44 XM_B_Unsub 10679 10.51 9.40 10.70 45 DEAR_FRIEND 10275 1.40 9.05 0.09 46 MISSING_HEADERS 10252 1.64 9.03 0.38 47 MONEY_FORM_SHORT 10147 1.31 8.94 0.01 48 REPLYTO_WITHOUT_TO_CC 10087 1.34 8.88 0.05 49 XM_DK_Undo_01 10062 2.43 8.86 1.33 50 TR_LOTS_OF_MONEY1 9712 1.27 8.55 0.02 51 XM_B_Phish66 9683 2.57 8.53 1.55 52 RELAYCOUNTRY_UG 9408 1.21 8.29 0.00 53 XMSubEmpty 9381 1.43 8.26 0.26 54 TR_Sbj_FN_Bdy 9294 1.40 8.19 0.24 55 RCVD_IN_BL_SPAMCOP_NET 9199 2.14 8.10 1.12 56 XMNoSubject 9042 1.27 7.96 0.12 57 MISSING_SUBJECT 9042 1.27 7.96 0.12 58 RELAYCOUNTRY_CA 8554 2.41 7.53 1.53 59 RCVD_IN_MSPIKE_WL 8483 19.81 7.47 21.92 60 HTML_IMAGE_RATIO_02 8359 6.58 7.36 6.44 61 XM_Evil_Numbers_Gen 8119 7.02 7.15 6.99 62 XMLngstWrd_00 7712 1.22 6.79 0.27 63 RCVD_IN_RP_RNBL 7350 1.00 6.47 0.07 64 BAYES_80 7168 4.17 6.31 3.81 65 BOTNET_NORDNS 7158 0.94 6.30 0.02 66 XMSubMetaSx_00 7091 3.61 6.25 3.16 67 RCVD_IN_MSPIKE_L5 7017 1.12 6.18 0.26 68 XMBrknScrpt_02 6983 1.75 6.15 1.00 69 BAYES_60 6889 5.68 6.07 5.61 70 XMBody_17 6423 1.62 5.66 0.93 71 XM_B_COVIDMETA 6384 1.99 5.62 1.37 72 XM_UB50 6339 1.69 5.58 1.02 73 XM_SPF_SoftFail 6103 2.11 5.37 1.56 74 UNPARSEABLE_RELAY 6064 5.92 5.34 6.01 75 MPART_ALT_DIFF 5864 4.54 5.16 4.43 76 TooManyTo_001 5692 7.14 5.01 7.50 77 FROM_EXCESS_BASE64 5536 2.67 4.88 2.29 78 XMLngstWrd_01 5503 0.91 4.85 0.24 79 SpammyFromTLD_02 5448 0.86 4.80 0.19 80 XM_H_Long_From01 5182 4.48 4.56 4.47 81 RCVD_IN_MSPIKE_H3 5117 11.67 4.51 12.89 82 T_REMOTE_IMAGE 5091 2.99 4.48 2.74 83 TR_XM_COVIDMETA4 5083 1.16 4.48 0.59 84 TR_XM_INV_DKIM 4968 0.77 4.38 0.15 85 SpammyFromTLD_01 4893 1.28 4.31 0.76 86 XM_SendGrid 4815 5.33 4.24 5.51 87 XMNumbers 4751 2.84 4.18 2.61 88 RCVD_IN_MSPIKE_L3 4696 0.96 4.14 0.42 89 URIBL_SBL_A 4238 0.73 3.73 0.22 90 T_XMDrugObfuBody_08 4206 1.91 3.70 1.60 91 FROM_SUSPICIOUS_NTLD 4177 0.57 3.68 0.04 92 FROM_SUSPICIOUS_NTLD_FP 4120 0.56 3.63 0.03 93 XM_DIRTYINTL 4031 0.98 3.55 0.54 94 XMStrtUSub 4024 3.94 3.54 4.01 95 XM_B_SpammyTLD 3944 1.80 3.47 1.52 96 HTML_IMAGE_RATIO_04 3943 4.51 3.47 4.69 97 XM_UB99 3925 0.51 3.46 0.01 98 XMDiploma_00 3923 1.80 3.45 1.52 99 BAYES_95 3786 2.50 3.33 2.36 100 TR_XM_MaxWHORU 3699 0.52 3.26 0.05 101 BODY_URI_ONLY 3573 0.50 3.15 0.05 102 MIME_HTML_MOSTLY 3515 2.08 3.10 1.90 103 KHOP_HELO_FCRDNS 3468 1.74 3.05 1.52 104 XMLngstWrd_02 3459 0.60 3.05 0.18 105 TR_XM_MaxBayes 3439 0.48 3.03 0.04 106 DKIM_ADSP_NXDOMAIN 3385 0.78 2.98 0.40 107 HTML_IMAGE_RATIO_08 3380 2.08 2.98 1.93 108 RCVD_IN_PSBL 3367 0.45 2.97 0.02 109 TR_XM_MaxSPIKE 3327 0.48 2.93 0.06 110 HTML_TAG_BALANCE_CENTER 3291 0.51 2.90 0.10 111 RCVD_IN_MSPIKE_H4 3223 7.03 2.84 7.75 112 HDRS_MISSP 3164 0.45 2.79 0.05 113 TR_XM_UnparsRelay 3090 0.83 2.72 0.50 114 HTML_IMAGE_RATIO_06 3068 2.62 2.70 2.61 115 HK_SCAM 3048 0.41 2.68 0.03 116 XM_UB999 2981 0.39 2.63 0.00 117 TR_XM_PHPDW 2896 0.74 2.55 0.43 118 TR_XM_PHPForged 2857 0.71 2.52 0.40 119 TR_XM_FormFill2 2819 0.71 2.48 0.40 120 XM_H_PHPOS 2802 0.70 2.47 0.40 121 SUBJ_ALL_CAPS 2784 1.45 2.45 1.27 122 TM2_M_URI_OPT_OUT 2736 16.17 2.41 18.52 123 RELAYCOUNTRY_GB 2728 1.08 2.40 0.86 124 TR_LOTS_OF_MONEY3 2707 0.98 2.38 0.73 125 MIME_QP_LONG_LINE 2651 3.98 2.33 4.26 126 TR_XM_COVIDMETA1 2644 0.62 2.33 0.33 127 SCRIPT_GIBBERISH 2635 0.34 2.32 0.00 128 T_TooManySym_01 2634 3.85 2.32 4.11 129 T_FILL_THIS_FORM_SHORT 2626 0.90 2.31 0.66 130 T_XMDrugObfuBody_00 2605 2.27 2.29 2.27 131 XM_URI_RBL 2601 0.53 2.29 0.23 132 URI_TRY_3LD 2582 1.50 2.27 1.36 133 XM_CamelCaseFrm001 2573 1.79 2.27 1.71 134 RELAYCOUNTRY_FR 2570 0.58 2.26 0.29 135 XMHTML_After_End 2459 1.11 2.17 0.93 136 TM2_M_VERY_LONG_WORD 2423 1.22 2.13 1.07 137 TR_XM_RelayPhish 2321 0.44 2.04 0.16 138 XMSexyCombo_01 2299 0.89 2.02 0.69 139 TR_LOTS_OF_MONEY2 2245 0.46 1.98 0.20 140 T_MONEY_PERCENT 2245 0.46 1.98 0.20 141 MONEY_FRAUD_8 2236 0.29 1.97 0.00 142 ALL_TRUSTED 2201 23.07 1.94 26.68 143 TR_Symld_Words 2195 1.70 1.93 1.66 144 XM_UB60 2123 0.36 1.87 0.11 145 ADVANCE_FEE_5_NEW_MONEY 2090 0.27 1.84 0.00 146 RELAYCOUNTRY_JP 2079 0.29 1.83 0.03 147 TR_Mismatch_TLD_02 2075 0.32 1.83 0.06 148 XM_B_Unsub2 2072 3.67 1.82 3.99 149 MIME_HTML_ONLY_MULTI 2036 2.63 1.79 2.77 150 TR_XM_DK_SendGrid 2025 2.82 1.78 3.00 151 XM_UB80 2022 0.29 1.78 0.03 152 TR_Mismatch_TLD_01 2006 0.41 1.77 0.18 153 PDS_OTHER_BAD_TLD 1939 0.55 1.71 0.35 154 URI_HEX 1929 1.27 1.70 1.19 155 T_XMDrugObfuBody_14 1864 1.41 1.64 1.37 156 XM_JunkDunk 1858 0.24 1.64 0.00 157 XM_PDF 1818 3.48 1.60 3.80 158 DATE_IN_PAST_03_06 1754 0.34 1.54 0.13 159 T_XMHurry_00 1752 0.80 1.54 0.67 160 RDNS_DYNAMIC 1740 0.47 1.53 0.28 161 XMStockSpam_06 1730 1.07 1.52 0.99 162 DEAR_SOMETHING 1676 0.37 1.48 0.19 163 XMSubMetaSxObfu_03 1551 0.59 1.37 0.45 164 RELAYCOUNTRY_NG 1546 0.20 1.36 0.00 165 BAYES_20 1541 4.41 1.36 4.93 166 XMGppyBdWords 1532 0.40 1.35 0.24 167 MPART_ALT_DIFF_COUNT 1499 0.46 1.32 0.31 168 RELAYCOUNTRY_IT 1488 0.22 1.31 0.03 169 XMSubject_63 1440 0.19 1.27 0.00 170 DKIM_ADSP_CUSTOM_MED 1416 0.99 1.25 0.95 171 HELO_LH_HOME 1410 0.18 1.24 0.00 172 XMLngstWrd_03 1390 0.29 1.22 0.13 173 NO_FM_NAME_IP_HOSTN 1383 0.18 1.22 0.00 174 XMSubNoVowel 1356 1.21 1.19 1.22 175 HTML_FONT_TINY_NORDNS 1345 0.42 1.18 0.29 176 REMOVE_BEFORE_LINK 1337 0.47 1.18 0.35 177 XM_OfRef7 1318 0.28 1.16 0.12 178 SUBJ_BUY 1310 0.22 1.15 0.06 179 TR_Caps_n_Bayes_99 1289 0.26 1.14 0.11 180 NML_ADSP_CUSTOM_MED 1266 0.73 1.11 0.67 181 XMGenDplmaNmb 1237 0.82 1.09 0.78 182 XMBody_78 1233 0.45 1.09 0.34 183 LONG_JUNK_URI 1218 0.21 1.07 0.07 184 HTML_IMAGE_ONLY_16 1215 0.35 1.07 0.23 185 DATE_IN_PAST_06_12 1212 0.21 1.07 0.07 186 PDS_FROM_2_EMAILS 1202 0.18 1.06 0.03 187 MAILING_LIST_MULTI 1200 1.99 1.06 2.15 188 XMBdyGiftCard01 1184 0.74 1.04 0.69 189 XM_BadFromFormat 1170 0.26 1.03 0.13 190 XM_H_PHPMailer 1169 0.54 1.03 0.45 191 FROM_2_EMAILS_SHORT 1148 0.15 1.01 0.00 192 XMSexyCombo_04 1120 0.35 0.99 0.24 193 XMSubMetaD_00 1109 0.19 0.98 0.06 194 TR_MetaPhish_Combo_01 1099 0.73 0.97 0.69 195 PDS_TO_EQ_FROM_NAME 1097 0.14 0.97 0.00 196 PDS_BTC_ID 1097 0.17 0.97 0.03 197 FORGED_GMAIL_RCVD 1089 0.50 0.96 0.42 198 XMPhish08 1081 0.47 0.95 0.39 199 XM_UB95 1081 0.15 0.95 0.01 200 LOADSA_MONEY_COMBO 1079 0.21 0.95 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 654380 98.31 97.36 98.48 2 HTML_MESSAGE 495915 77.05 91.23 74.63 3 RELAYCOUNTRY_US 463560 69.35 66.92 69.76 4 DKIM_SIGNED 429703 65.40 69.70 64.66 5 XM_DK_Pass 422973 64.25 67.72 63.65 6 DKIM_VALID 396708 59.10 55.60 59.70 7 XM_B_Unicode 384415 58.30 60.91 57.85 8 DKIM_VALID_AU 301653 44.85 41.67 45.40 9 BAYES_50 300476 44.18 38.08 45.22 10 XMListUnsubscribeExists 283827 44.10 52.22 42.71 11 XM_B_Unicode3 218163 32.35 29.56 32.83 12 ALL_TRUSTED 177322 23.07 1.94 26.68 13 T_TM2_M_HEADER_IN_MSG 167187 25.01 24.11 25.16 14 DKIM_VALID_EF 162003 24.89 27.86 24.38 15 HTML_FONT_LOW_CONTRAST 153310 22.89 21.86 23.07 16 RCVD_IN_MSPIKE_WL 145635 19.81 7.47 21.92 17 BAYES_00 140740 18.19 0.72 21.18 18 LOC_TINY_FONT_1 133530 20.99 26.20 20.09 19 RCVD_IN_MSPIKE_H2 131878 20.91 27.16 19.85 20 FVGT_m_MULTI_ODD 128687 21.06 30.98 19.37 21 TM2_M_URI_OPT_OUT 123075 16.17 2.41 18.52 22 ANY_BOUNCE_MESSAGE 122539 15.87 0.82 18.44 23 BOUNCE_MESSAGE 122463 15.86 0.81 18.43 24 XMSubLong 121239 18.68 21.22 18.24 25 XM_Multi_Part_URI 119104 17.73 16.61 17.92 26 MIME_HTML_ONLY 114591 19.59 33.32 17.24 27 T_KAM_HTML_FONT_INVALID 102677 15.80 17.87 15.45 28 RCVD_IN_MSPIKE_H3 85684 11.67 4.51 12.89 29 XM_Body_Dirty_Words 73934 11.89 16.37 11.13 30 XM_B_Unsub 71073 10.51 9.40 10.70 31 XM_DK_Undo_02 69224 15.40 44.54 10.42 32 RCVD_IN_MSPIKE_H4 51497 7.03 2.84 7.75 33 TooManyTo_001 49827 7.14 5.01 7.50 34 XM_Evil_Numbers_Gen 46469 7.02 7.15 6.99 35 LotsOfNums_01 46058 7.78 12.73 6.93 36 LOTS_OF_MONEY 45819 9.65 25.80 6.90 37 TR_XM_DK_Bayes 45496 5.90 0.36 6.85 38 BAYES_99 44587 10.68 33.93 6.71 39 IN_ZIMBRA_NJ_WHITELIST 44474 5.72 0.06 6.69 40 HTML_IMAGE_RATIO_02 42811 6.58 7.36 6.44 41 TR_XM_DK_Bayes1 42215 5.45 0.19 6.35 42 UNPARSEABLE_RELAY 39970 5.92 5.34 6.01 43 RCVD_IN_RP_SAFE 39731 5.19 0.57 5.98 44 XM_DKIMWhitelistDomains 39712 5.11 0.01 5.98 45 XM_B_Phish_Phrases 39635 6.59 10.25 5.96 46 BAYES_05 38753 5.08 0.65 5.83 47 TR_XM_DK_Bayes2 37499 4.84 0.15 5.64 48 BAYES_60 37267 5.68 6.07 5.61 49 RCVD_IN_RP_CERTIFIED 36905 4.81 0.43 5.55 50 XM_SendGrid 36618 5.33 4.24 5.51 51 BAYES_999 35349 8.45 26.75 5.32 52 DKIM_INVALID 32995 6.30 14.09 4.97 53 BAYES_20 32746 4.41 1.36 4.93 54 HTML_IMAGE_RATIO_04 31143 4.51 3.47 4.69 55 RELAYCOUNTRY_META 31062 8.82 33.07 4.67 56 XM_H_Long_From01 29679 4.48 4.56 4.47 57 MPART_ALT_DIFF 29447 4.54 5.16 4.43 58 BAYES_40 28873 5.10 9.54 4.35 59 BOTNET_IPINHOSTNAME 28446 5.80 14.70 4.28 60 MIME_QP_LONG_LINE 28327 3.98 2.33 4.26 61 T_TooManySym_01 27307 3.85 2.32 4.11 62 XMStrtUSub 26626 3.94 3.54 4.01 63 XM_B_Unsub2 26485 3.67 1.82 3.99 64 RCVD_IN_IADB_LISTED 25737 3.39 0.53 3.87 65 BAYES_80 25313 4.17 6.31 3.81 66 XM_PDF 25236 3.48 1.60 3.80 67 XMSexyCombo_05 23833 4.62 10.65 3.59 68 RCVD_IN_IADB_SPF 22423 2.95 0.47 3.37 69 XMSubMetaSx_00 20995 3.61 6.25 3.16 70 BOTNET 20114 6.79 28.78 3.03 71 TR_XM_DK_SendGrid 19937 2.82 1.78 3.00 72 RCVD_IN_IADB_SENDERID 19694 2.60 0.45 2.96 73 NO_DNS_FOR_FROM 19590 4.24 11.82 2.95 74 RCVD_IN_IADB_DK 19578 2.58 0.45 2.95 75 MIME_HTML_ONLY_MULTI 18419 2.63 1.79 2.77 76 TR_XM_PhishingBody 18284 3.93 10.86 2.75 77 T_REMOTE_IMAGE 18199 2.99 4.48 2.74 78 XMNumbers 17350 2.84 4.18 2.61 79 HTML_IMAGE_RATIO_06 17311 2.62 2.70 2.61 80 XM_UncommonTLD01 17229 4.12 13.06 2.59 81 XM_H_Trusted_IP 16991 2.18 0.00 2.56 82 RCVD_IN_IADB_VOUCHED 16035 2.08 0.16 2.41 83 BAYES_95 15700 2.50 3.33 2.36 84 FROM_EXCESS_BASE64 15225 2.67 4.88 2.29 85 T_XMDrugObfuBody_00 15076 2.27 2.29 2.27 86 MAILING_LIST_MULTI 14283 1.99 1.06 2.15 87 T_TooManySym_02 13983 1.88 0.58 2.10 88 HTML_IMAGE_RATIO_08 12830 2.08 2.98 1.93 89 UNTRUSTED_Relay 12714 4.91 22.44 1.91 90 MIME_HTML_MOSTLY 12631 2.08 3.10 1.90 91 TooManyTo_002 11595 1.60 0.77 1.74 92 HTML_MIME_NO_HTML_TAG 11542 3.26 12.20 1.74 93 XM_CamelCaseFrm001 11359 1.79 2.27 1.71 94 TR_Symld_Words 11045 1.70 1.93 1.66 95 T_XMDrugObfuBody_08 10663 1.91 3.70 1.60 96 XM_SPF_SoftFail 10344 2.11 5.37 1.56 97 XM_B_Phish66 10323 2.57 8.53 1.55 98 RELAYCOUNTRY_CA 10166 2.41 7.53 1.53 99 XMDiploma_00 10091 1.80 3.45 1.52 100 KHOP_HELO_FCRDNS 10090 1.74 3.05 1.52 101 XM_B_SpammyTLD 10085 1.80 3.47 1.52 102 RCVD_IN_IADB_OPTIN 9896 1.30 0.19 1.49 103 TVD_RCVD_IP 9563 1.31 0.55 1.44 104 T_XMDrugObfuBody_14 9113 1.41 1.64 1.37 105 XM_B_COVIDMETA 9086 1.99 5.62 1.37 106 URI_TRY_3LD 9053 1.50 2.27 1.36 107 XM_DK_Undo_01 8826 2.43 8.86 1.33 108 HELO_NODOT 8756 2.51 9.48 1.32 109 HELO_NO_DOMAIN 8753 2.51 9.48 1.32 110 SUBJ_ALL_CAPS 8459 1.45 2.45 1.27 111 RCVD_IN_MSPIKE_H5 8454 1.10 0.13 1.27 112 XMSubNoVowel 8093 1.21 1.19 1.22 113 URI_HEX 7931 1.27 1.70 1.19 114 IN_HORDE_ADDRESS_BOOK 7576 1.00 0.20 1.14 115 TooManyTo_003 7541 1.05 0.56 1.13 116 CK_HELO_DYNAMIC_SPLIT_IP 7487 1.08 0.82 1.13 117 HELO_MISC_IP 7480 1.05 0.63 1.13 118 RCVD_IN_BL_SPAMCOP_NET 7416 2.14 8.10 1.12 119 INVALID_MSGID 7313 0.97 0.17 1.10 120 TM2_M_VERY_LONG_WORD 7091 1.22 2.13 1.07 121 XM_GoogleGroups 7029 0.96 0.36 1.06 122 TO_MALFORMED 6904 0.89 0.04 1.04 123 XM_UB50 6774 1.69 5.58 1.02 124 XMBrknScrpt_02 6666 1.75 6.15 1.00 125 XMStockSpam_06 6605 1.07 1.52 0.99 126 XM_OfRef6 6564 2.67 12.50 0.99 127 XMCapTrack 6320 0.91 0.67 0.95 128 XM_ProductURIs 6303 0.89 0.52 0.95 129 DKIM_ADSP_CUSTOM_MED 6299 0.99 1.25 0.95 130 XMBody_17 6208 1.62 5.66 0.93 131 XMHTML_After_End 6175 1.11 2.17 0.93 132 USER_IN_DEF_DKIM_WL 6020 0.77 0.00 0.91 133 XMGappySubj_01 6016 0.80 0.16 0.91 134 HTML_FONT_FACE_BAD 6014 0.87 0.69 0.91 135 XM_H_Long_From02 5936 0.87 0.77 0.89 136 T_TooManySym_03 5858 0.77 0.15 0.88 137 RELAYCOUNTRY_GB 5686 1.08 2.40 0.86 138 TooManyTo_004 5669 0.80 0.47 0.85 139 XMGenDplmaNmb 5156 0.82 1.09 0.78 140 SpammyFromTLD_01 5072 1.28 4.31 0.76 141 TR_LOTS_OF_MONEY3 4881 0.98 2.38 0.73 142 RCVD_IN_MSPIKE_BL 4787 2.20 10.86 0.72 143 TooManyTo_005 4684 0.65 0.34 0.70 144 XMSubMetaI_00 4674 0.71 0.76 0.70 145 TR_MSPIKEBAYES00 4635 0.60 0.00 0.70 146 TR_MetaPhish_Combo_01 4610 0.73 0.97 0.69 147 XMSexyCombo_01 4596 0.89 2.02 0.69 148 XMBdyGiftCard01 4582 0.74 1.04 0.69 149 XMNoVowels 4581 0.67 0.56 0.69 150 T_OBFU_PDF_ATTACH 4497 0.60 0.17 0.68 151 T_XMHurry_00 4462 0.80 1.54 0.67 152 NML_ADSP_CUSTOM_MED 4429 0.73 1.11 0.67 153 T_FILL_THIS_FORM_SHORT 4398 0.90 2.31 0.66 154 HTTPS_HTTP_MISMATCH 4362 0.68 0.79 0.66 155 XM_SPF_Unknown 3944 0.60 0.64 0.59 156 TR_XM_COVIDMETA4 3935 1.16 4.48 0.59 157 T_Symld_Words_02 3921 0.61 0.74 0.59 158 XMHTMLBadTable_001 3883 0.57 0.45 0.58 159 XMBody_95 3833 0.51 0.13 0.58 160 XM_E_Blogspot 3714 0.49 0.07 0.56 161 XM_DIRTYINTL 3616 0.98 3.55 0.54 162 TR_XM_UnparsRelay 3346 0.83 2.72 0.50 163 XM_RXBody 3343 0.50 0.48 0.50 164 TR_BOTNET_NEGATE 3329 0.49 0.46 0.50 165 T_TooManySym_04 3217 0.42 0.05 0.48 166 XMMoneyMeta_00 3019 0.50 0.75 0.45 167 XMSubMetaSxObfu_03 3019 0.59 1.37 0.45 168 XM_H_PHPMailer 2995 0.54 1.03 0.45 169 XM_ShortIntro_01 2927 0.47 0.65 0.44 170 TM2_M_BODY_EMPTY 2891 0.39 0.15 0.44 171 TR_XM_PHPDW 2835 0.74 2.55 0.43 172 RCVD_IN_MSPIKE_L3 2792 0.96 4.14 0.42 173 FORGED_GMAIL_RCVD 2776 0.50 0.96 0.42 174 TVD_SPACE_RATIO 2769 0.42 0.46 0.42 175 DKIM_ADSP_NXDOMAIN 2690 0.78 2.98 0.40 176 HTML_TAG_BALANCE_BODY 2689 0.45 0.68 0.40 177 XMPhish14 2683 0.46 0.76 0.40 178 TR_XM_PHPForged 2679 0.71 2.52 0.40 179 TR_XM_FormFill2 2670 0.71 2.48 0.40 180 XMLKML 2642 0.34 0.00 0.40 181 PLING_QUERY 2639 0.41 0.48 0.40 182 XMPhish30 2634 0.44 0.71 0.40 183 XM_H_PHPOS 2630 0.70 2.47 0.40 184 RCVD_IN_SORBS_DUL 2607 0.37 0.25 0.39 185 XMPhish08 2560 0.47 0.95 0.39 186 MISSING_HEADERS 2509 1.64 9.03 0.38 187 FROM_GOV_DKIM_AU 2494 0.33 0.07 0.38 188 HTML_IMAGE_ONLY_20 2474 0.40 0.56 0.37 189 XM_B_REG_HTML 2461 0.33 0.12 0.37 190 HTML_IMAGE_ONLY_32 2412 0.33 0.13 0.36 191 REMOVE_BEFORE_LINK 2348 0.47 1.18 0.35 192 PDS_OTHER_BAD_TLD 2328 0.55 1.71 0.35 193 FROM_GOV_SPOOF 2270 0.31 0.12 0.34 194 XM_S_SubURI 2264 0.30 0.06 0.34 195 XMBody_78 2259 0.45 1.09 0.34 196 SHORT_HELO_AND_INLINE_IMAGE 2241 0.30 0.07 0.34 197 XM_B_COPY_HTML 2224 0.34 0.36 0.33 198 HTML_IMAGE_ONLY_28 2181 0.31 0.18 0.33 199 TR_XM_COVIDMETA1 2165 0.62 2.33 0.33 200 TM2_M_A_HREF_HREF 2114 0.36 0.57 0.32 ----------------------------------------------------------------------