Email: 779690 Autolearn: 0 AvgScore: -1.28 AvgScanTime: 2.03 sec Spam: 99935 Autolearn: 0 AvgScore: 12.56 AvgScanTime: 4.45 sec Ham: 679755 Autolearn: 0 AvgScore: -3.31 AvgScanTime: 1.68 sec Time Spent Running SA: 440.00 hours Time Spent Processing Spam: 123.57 hours Time Spent Processing Ham: 316.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97506 98.39 97.57 98.51 2 HTML_MESSAGE 89923 87.00 89.98 86.56 3 DKIM_SIGNED 76679 66.28 76.73 64.75 4 XM_DK_Pass 74306 65.08 74.35 63.72 5 XM_B_Unicode 73305 69.27 73.35 68.67 6 RELAYCOUNTRY_US 73125 78.56 73.17 79.35 7 XMListUnsubscribeExists 64458 46.50 64.50 43.85 8 DKIM_VALID 60259 59.76 60.30 59.68 9 XM_DK_Undo_02 49389 15.26 49.42 10.24 10 XM_B_Unicode3 41521 41.25 41.55 41.20 11 DKIM_VALID_AU 40316 43.64 40.34 44.12 12 BAYES_50 39493 46.45 39.52 47.47 13 BAYES_99 37020 10.09 37.04 6.12 14 BOTNET 32706 7.10 32.73 3.34 15 LOC_TINY_FONT_1 32349 22.08 32.37 20.56 16 HTML_FONT_LOW_CONTRAST 30297 24.82 30.32 24.01 17 RELAYCOUNTRY_META 29839 8.11 29.86 4.91 18 BAYES_999 29676 8.12 29.70 4.95 19 FVGT_m_MULTI_ODD 29627 19.54 29.65 18.06 20 MIME_HTML_ONLY 28154 23.18 28.17 22.44 21 DKIM_VALID_EF 27828 23.75 27.85 23.15 22 RCVD_IN_MSPIKE_H2 23225 21.05 23.24 20.73 23 T_TM2_M_HEADER_IN_MSG 23184 25.71 23.20 26.08 24 BOTNET_IPINHOSTNAME 22896 7.10 22.91 4.78 25 XMSubLong 22833 19.91 22.85 19.48 26 T_KAM_HTML_FONT_INVALID 20520 16.69 20.53 16.13 27 XM_Multi_Part_URI 20111 12.91 20.12 11.85 28 XM_Body_Dirty_Words 20049 12.68 20.06 11.59 29 UNTRUSTED_Relay 17648 4.10 17.66 2.10 30 XM_B_Phish_Phrases 17219 8.41 17.23 7.11 31 DKIM_INVALID 16420 6.52 16.43 5.07 32 LOTS_OF_MONEY 14255 7.74 14.26 6.78 33 XM_B_Unsub 13567 10.73 13.58 10.31 34 XM_UncommonTLD01 13278 4.31 13.29 2.99 35 NO_DNS_FOR_FROM 13180 4.66 13.19 3.41 36 XMSubMetaSx_00 12988 5.18 13.00 4.03 37 TR_XM_PhishingBody 12490 4.14 12.50 2.91 38 XMSexyCombo_05 11930 4.60 11.94 3.52 39 XM_B_COVIDMETA 10855 2.85 10.86 1.67 40 RCVD_IN_MSPIKE_BL 10734 2.02 10.74 0.73 41 XM_Evil_Numbers_Gen 9996 9.44 10.00 9.36 42 HTML_IMAGE_RATIO_04 8826 12.06 8.83 12.53 43 HTML_IMAGE_RATIO_02 8646 6.28 8.65 5.93 44 XM_B_Phish66 8593 2.65 8.60 1.77 45 TM2_M_URI_OPT_OUT 8553 7.48 8.56 7.32 46 LotsOfNums_01 8097 7.62 8.10 7.55 47 RCVD_IN_MSPIKE_WL 8029 21.01 8.03 22.92 48 RCVD_IN_RP_RNBL 7878 1.08 7.88 0.07 49 XM_SPF_SoftFail 7721 2.44 7.73 1.66 50 MPART_ALT_DIFF 7655 9.29 7.66 9.54 51 XMStrtUSub 7629 8.83 7.63 9.00 52 RELAYCOUNTRY_CA 7543 2.26 7.55 1.48 53 XM_OfRef6 7466 2.06 7.47 1.27 54 T_XMDrugObfuBody_00 6712 1.41 6.72 0.63 55 RCVD_IN_BL_SPAMCOP_NET 6656 1.96 6.66 1.27 56 XM_H_Long_From01 6523 5.33 6.53 5.16 57 BOTNET_NORDNS 6503 0.85 6.51 0.02 58 BAYES_80 6498 3.95 6.50 3.58 59 UNPARSEABLE_RELAY 6165 6.05 6.17 6.03 60 BAYES_60 6116 5.57 6.12 5.49 61 TR_XM_COVIDMETA1 6103 1.18 6.11 0.45 62 XMNumbers 6080 3.26 6.08 2.84 63 XMSubMetaSxObfu_03 6070 1.69 6.07 1.04 64 MIME_HTML_MOSTLY 5983 2.84 5.99 2.38 65 TooManyTo_001 5893 6.85 5.90 6.98 66 XMBody_17 5875 1.36 5.88 0.69 67 RCVD_IN_MSPIKE_L5 5832 0.95 5.84 0.24 68 XM_UB50 5828 1.69 5.83 1.08 69 XM_UB99 5393 0.70 5.40 0.01 70 XM_SendGrid 4962 5.46 4.97 5.54 71 TR_XM_COVIDMETA4 4895 1.21 4.90 0.66 72 SpammyFromTLD_01 4883 1.31 4.89 0.78 73 TR_XM_INV_DKIM 4790 0.77 4.79 0.18 74 XMPhish14 4739 0.98 4.74 0.43 75 RCVD_IN_MSPIKE_H3 4650 12.15 4.65 13.25 76 XMBrknScrpt_02 4502 1.16 4.50 0.67 77 RCVD_IN_MSPIKE_L3 4406 0.96 4.41 0.46 78 XMClaimOffer 4293 0.64 4.30 0.10 79 RELAYCOUNTRY_FR 4288 0.82 4.29 0.30 80 XM_UB999 4267 0.55 4.27 0.00 81 XMPhishDuo 3986 0.52 3.99 0.01 82 XM_B_SpammyTLD 3974 1.79 3.98 1.47 83 TVD_PH_BODY_ACCOUNTS_PRE 3930 0.61 3.93 0.12 84 HTML_IMAGE_RATIO_06 3907 4.32 3.91 4.38 85 XM_DIRTYINTL 3891 0.97 3.89 0.54 86 SUBJ_ALL_CAPS 3865 1.69 3.87 1.37 87 T_FILL_THIS_FORM_SHORT 3761 1.21 3.76 0.83 88 XM_GRM 3759 0.72 3.76 0.27 89 TR_XM_MaxWHORU 3759 0.54 3.76 0.07 90 URIBL_SBL_A 3612 0.59 3.61 0.15 91 SpammyFromTLD_02 3582 0.70 3.58 0.27 92 BAYES_95 3580 2.30 3.58 2.11 93 RELAYCOUNTRY_RU 3553 0.61 3.56 0.17 94 KHOP_HELO_FCRDNS 3479 1.88 3.48 1.64 95 TR_XM_UnparsRelay 3276 0.71 3.28 0.33 96 RCVD_IN_MSPIKE_H4 3211 7.34 3.21 7.95 97 HTML_IMAGE_RATIO_08 3146 2.20 3.15 2.06 98 XMSexyCombo_01 3111 0.95 3.11 0.63 99 XM_URI_RBL 3090 0.59 3.09 0.22 100 TM2_M_VERY_LONG_WORD 3010 1.17 3.01 0.90 101 T_XMHurry_00 2989 0.88 2.99 0.57 102 HTML_MIME_NO_HTML_TAG 2982 2.17 2.98 2.05 103 MIME_QP_LONG_LINE 2936 4.66 2.94 4.91 104 TR_XM_MaxBayes 2828 0.39 2.83 0.03 105 XM_B_Unsub2 2765 2.84 2.77 2.85 106 FROM_SUSPICIOUS_NTLD 2653 0.37 2.65 0.03 107 BAYES_40 2630 5.05 2.63 5.40 108 FROM_EXCESS_BASE64 2627 2.01 2.63 1.92 109 T_XMDrugObfuBody_08 2569 1.62 2.57 1.48 110 FROM_SUSPICIOUS_NTLD_FP 2525 0.35 2.53 0.03 111 XM_CamelCaseFrm001 2470 1.72 2.47 1.61 112 TR_XM_MaxSPIKE 2454 0.35 2.46 0.04 113 RCVD_IN_PSBL 2436 0.36 2.44 0.06 114 MISSING_HEADERS 2436 0.63 2.44 0.37 115 TR_XM_PHPDW 2416 0.71 2.42 0.45 116 TR_XM_PHPForged 2385 0.69 2.39 0.44 117 T_TooManySym_01 2382 3.64 2.38 3.83 118 TR_XM_FormFill2 2372 0.68 2.37 0.44 119 BAYES_20 2364 4.77 2.37 5.12 120 XM_H_PHPOS 2361 0.68 2.36 0.43 121 URI_TRY_3LD 2248 1.11 2.25 0.94 122 TR_XM_DK_SendGrid 2176 2.85 2.18 2.94 123 T_REMOTE_IMAGE 2161 3.09 2.16 3.22 124 PDS_OTHER_BAD_TLD 2129 0.39 2.13 0.13 125 TR_LOTS_OF_MONEY3 2127 0.53 2.13 0.29 126 XMBdyGiftCard01 2098 0.90 2.10 0.72 127 LongTLD 2069 0.42 2.07 0.17 128 URI_PHP_REDIR 2059 0.32 2.06 0.06 129 TR_XM_FormFill 2040 0.30 2.04 0.05 130 XM_UB60 1972 0.34 1.97 0.10 131 PDS_FROM_2_EMAILS 1957 0.28 1.96 0.03 132 URI_HEX 1930 1.41 1.93 1.34 133 FROM_2_EMAILS_SHORT 1929 0.25 1.93 0.00 134 XM_UB80 1915 0.28 1.92 0.04 135 XMDiploma_00 1895 1.38 1.90 1.31 136 TR_Symld_Words 1861 1.61 1.86 1.57 137 XMSubNoVowel 1858 3.67 1.86 3.93 138 T_XMDrugObfuBody_14 1857 1.59 1.86 1.56 139 XMGppyBdWords 1857 0.39 1.86 0.17 140 XMSexyCombo_04 1824 0.30 1.83 0.08 141 MIME_HTML_ONLY_MULTI 1819 6.87 1.82 7.61 142 XMPhish08 1816 0.49 1.82 0.30 143 HELO_NODOT 1801 1.31 1.80 1.24 144 PDS_TO_EQ_FROM_NAME 1798 0.24 1.80 0.01 145 HELO_NO_DOMAIN 1798 1.31 1.80 1.24 146 XM_PDF 1770 4.09 1.77 4.43 147 NO_FM_NAME_IP_HOSTN 1763 0.23 1.76 0.00 148 XMSubject_48 1754 0.25 1.76 0.03 149 ADVANCE_FEE_3_NEW 1739 0.23 1.74 0.01 150 TR_XM_RelayPhish 1729 0.35 1.73 0.15 151 MAILING_LIST_MULTI 1715 2.06 1.72 2.11 152 FORM_FRAUD_3 1710 0.22 1.71 0.00 153 TR_XM_SpoofStaff 1634 0.34 1.64 0.15 154 XMSpoofStaff2 1603 0.34 1.60 0.15 155 NUMERIC_HTTP_ADDR 1565 0.45 1.57 0.28 156 DATE_IN_PAST_03_06 1539 0.31 1.54 0.13 157 RCVD_IN_RP_SAFE 1520 5.10 1.52 5.62 158 DKIM_ADSP_NXDOMAIN 1518 0.75 1.52 0.63 159 XM_OfRef7 1507 0.30 1.51 0.12 160 ALL_TRUSTED 1497 15.01 1.50 16.99 161 SUBJ_BUY 1494 0.23 1.49 0.04 162 RDNS_DYNAMIC 1456 0.41 1.46 0.26 163 XMSubMetaD_00 1433 0.26 1.43 0.09 164 LONG_JUNK_URI2 1417 0.24 1.42 0.06 165 DKIM_ADSP_CUSTOM_MED 1407 1.01 1.41 0.95 166 XM_ShortIntro_01 1401 0.57 1.40 0.45 167 XM_H_SpoofStaff4 1389 0.33 1.39 0.18 168 TR_XM_PSC1 1388 0.31 1.39 0.15 169 MPART_ALT_DIFF_COUNT 1372 0.44 1.37 0.30 170 REPLYTO_WITHOUT_TO_CC 1369 0.21 1.37 0.04 171 BODY_URI_ONLY 1343 0.22 1.34 0.06 172 XMStockSpam_06 1333 1.86 1.33 1.94 173 FVGT_m_MULTI_ODD_EMAIL 1328 0.20 1.33 0.04 174 RELAYCOUNTRY_IT 1287 0.20 1.29 0.04 175 XMHTML_After_End 1277 0.84 1.28 0.78 176 HDRS_MISSP 1274 0.21 1.27 0.05 177 RCVD_IN_RP_CERTIFIED 1270 4.63 1.27 5.13 178 RELAYCOUNTRY_GB 1258 1.00 1.26 0.97 179 TR_Mismatch_TLD_01 1250 0.40 1.25 0.27 180 XMPhish30 1247 0.51 1.25 0.40 181 XMObfuSubjects 1241 0.20 1.24 0.04 182 TR_XM_SpoofStaff2 1231 0.16 1.23 0.00 183 NML_ADSP_CUSTOM_MED 1230 0.76 1.23 0.69 184 XM_H_Long_From02 1228 0.94 1.23 0.90 185 URIBL_BLACK 1203 0.18 1.20 0.03 186 HTML_FONT_TINY_NORDNS 1182 0.39 1.18 0.27 187 XMGenDplmaNmb 1180 0.80 1.18 0.75 188 URI_WP_HACKED_2 1160 0.18 1.16 0.03 189 BAYES_05 1156 5.00 1.16 5.57 190 XMBody_78 1152 0.46 1.15 0.35 191 DATE_IN_PAST_06_12 1142 0.33 1.14 0.21 192 XM_UB95 1136 0.16 1.14 0.02 193 XM_DK_Undo_01 1125 1.31 1.13 1.34 194 MONEY_FRAUD_8 1124 0.15 1.12 0.00 195 XM_H_MailChimp 1121 0.31 1.12 0.20 196 TR_LOTS_OF_MONEY2 1117 0.33 1.12 0.21 197 T_MONEY_PERCENT 1117 0.33 1.12 0.21 198 RELAYCOUNTRY_IN 1111 0.24 1.11 0.11 199 TR_LOTS_OF_MONEY1 1107 0.15 1.11 0.01 200 FILL_THIS_FORM_FRAUD_PHISH 1073 0.16 1.07 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 669614 98.39 97.57 98.51 2 HTML_MESSAGE 588406 87.00 89.98 86.56 3 RELAYCOUNTRY_US 539362 78.56 73.17 79.35 4 XM_B_Unicode 466769 69.27 73.35 68.67 5 DKIM_SIGNED 440133 66.28 76.73 64.75 6 XM_DK_Pass 433153 65.08 74.35 63.72 7 DKIM_VALID 405682 59.76 60.30 59.68 8 BAYES_50 322669 46.45 39.52 47.47 9 DKIM_VALID_AU 299920 43.64 40.34 44.12 10 XMListUnsubscribeExists 298088 46.50 64.50 43.85 11 XM_B_Unicode3 280085 41.25 41.55 41.20 12 T_TM2_M_HEADER_IN_MSG 177249 25.71 23.20 26.08 13 HTML_FONT_LOW_CONTRAST 163219 24.82 30.32 24.01 14 DKIM_VALID_EF 157366 23.75 27.85 23.15 15 RCVD_IN_MSPIKE_WL 155794 21.01 8.03 22.92 16 MIME_HTML_ONLY 152565 23.18 28.17 22.44 17 RCVD_IN_MSPIKE_H2 140926 21.05 23.24 20.73 18 LOC_TINY_FONT_1 139770 22.08 32.37 20.56 19 XMSubLong 132389 19.91 22.85 19.48 20 BAYES_00 130091 16.82 1.06 19.14 21 FVGT_m_MULTI_ODD 122755 19.54 29.65 18.06 22 ALL_TRUSTED 115523 15.01 1.50 16.99 23 T_KAM_HTML_FONT_INVALID 109637 16.69 20.53 16.13 24 RCVD_IN_MSPIKE_H3 90069 12.15 4.65 13.25 25 HTML_IMAGE_RATIO_04 85188 12.06 8.83 12.53 26 XM_Multi_Part_URI 80562 12.91 20.12 11.85 27 XM_H_Trusted_IP 79423 10.19 0.00 11.68 28 XM_Body_Dirty_Words 78785 12.68 20.06 11.59 29 XM_B_Unsub 70060 10.73 13.58 10.31 30 XM_DK_Undo_02 69617 15.26 49.42 10.24 31 HTML_FONT_FACE_BAD 66074 8.58 0.84 9.72 32 MPART_ALT_DIFF 64815 9.29 7.66 9.54 33 XM_Evil_Numbers_Gen 63600 9.44 10.00 9.36 34 XMStrtUSub 61209 8.83 7.63 9.00 35 RCVD_IN_MSPIKE_H4 54022 7.34 3.21 7.95 36 TR_XM_DK_Bayes 51996 6.74 0.55 7.65 37 MIME_HTML_ONLY_MULTI 51748 6.87 1.82 7.61 38 LotsOfNums_01 51312 7.62 8.10 7.55 39 TM2_M_URI_OPT_OUT 49746 7.48 8.56 7.32 40 XM_B_Phish_Phrases 48334 8.41 17.23 7.11 41 TR_XM_DK_Bayes1 48282 6.23 0.29 7.10 42 TooManyTo_001 47479 6.85 5.90 6.98 43 LOTS_OF_MONEY 46102 7.74 14.26 6.78 44 ANY_BOUNCE_MESSAGE 43501 5.67 0.72 6.40 45 BOUNCE_MESSAGE 43484 5.67 0.72 6.40 46 TR_XM_DK_Bayes2 42470 5.47 0.21 6.25 47 BAYES_99 41630 10.09 37.04 6.12 48 UNPARSEABLE_RELAY 41018 6.05 6.17 6.03 49 XM_DKIMWhitelistDomains 40803 5.24 0.01 6.00 50 HTML_IMAGE_RATIO_02 40337 6.28 8.65 5.93 51 IN_ZIMBRA_NJ_WHITELIST 39626 5.09 0.05 5.83 52 RCVD_IN_RP_SAFE 38220 5.10 1.52 5.62 53 BAYES_05 37847 5.00 1.16 5.57 54 XM_SendGrid 37640 5.46 4.97 5.54 55 BAYES_60 37302 5.57 6.12 5.49 56 BAYES_40 36734 5.05 2.63 5.40 57 XM_H_Long_From01 35043 5.33 6.53 5.16 58 RCVD_IN_RP_CERTIFIED 34838 4.63 1.27 5.13 59 BAYES_20 34792 4.77 2.37 5.12 60 DKIM_INVALID 34451 6.52 16.43 5.07 61 BAYES_999 33650 8.12 29.70 4.95 62 RELAYCOUNTRY_META 33408 8.11 29.86 4.91 63 MIME_QP_LONG_LINE 33397 4.66 2.94 4.91 64 RCVD_IN_IADB_LISTED 33375 4.41 1.00 4.91 65 BOTNET_IPINHOSTNAME 32478 7.10 22.91 4.78 66 XM_PDF 30106 4.09 1.77 4.43 67 HTML_IMAGE_RATIO_06 29771 4.32 3.91 4.38 68 RCVD_IN_IADB_SPF 29072 3.84 0.86 4.28 69 XMSubMetaSx_00 27385 5.18 13.00 4.03 70 XMSubNoVowel 26733 3.67 1.86 3.93 71 T_TooManySym_01 26023 3.64 2.38 3.83 72 RCVD_IN_IADB_SENDERID 25506 3.38 0.82 3.75 73 RCVD_IN_IADB_DK 25246 3.34 0.82 3.71 74 BAYES_80 24321 3.95 6.50 3.58 75 XMSexyCombo_05 23928 4.60 11.94 3.52 76 NO_DNS_FOR_FROM 23146 4.66 13.19 3.41 77 BOTNET 22686 7.10 32.73 3.34 78 T_REMOTE_IMAGE 21917 3.09 2.16 3.22 79 XM_UncommonTLD01 20306 4.31 13.29 2.99 80 TR_XM_DK_SendGrid 20017 2.85 2.18 2.94 81 RCVD_IN_IADB_VOUCHED 20004 2.62 0.41 2.94 82 TR_XM_PhishingBody 19807 4.14 12.50 2.91 83 XM_B_Unsub2 19351 2.84 2.77 2.85 84 XMNumbers 19310 3.26 6.08 2.84 85 MIME_HTML_MOSTLY 16155 2.84 5.99 2.38 86 BAYES_95 14321 2.30 3.58 2.11 87 MAILING_LIST_MULTI 14320 2.06 1.72 2.11 88 UNTRUSTED_Relay 14307 4.10 17.66 2.10 89 HTML_IMAGE_RATIO_08 13994 2.20 3.15 2.06 90 HTML_MIME_NO_HTML_TAG 13955 2.17 2.98 2.05 91 XMStockSpam_06 13155 1.86 1.33 1.94 92 FROM_EXCESS_BASE64 13038 2.01 2.63 1.92 93 T_TooManySym_02 12762 1.71 0.57 1.88 94 RCVD_IN_IADB_OPTIN 12607 1.67 0.38 1.85 95 XM_B_Phish66 12057 2.65 8.60 1.77 96 RCVD_IN_MSPIKE_H5 11703 1.52 0.17 1.72 97 TooManyTo_002 11363 1.57 0.88 1.67 98 XM_B_COVIDMETA 11352 2.85 10.86 1.67 99 XM_SPF_SoftFail 11312 2.44 7.73 1.66 100 KHOP_HELO_FCRDNS 11160 1.88 3.48 1.64 101 XM_CamelCaseFrm001 10944 1.72 2.47 1.61 102 TR_Symld_Words 10671 1.61 1.86 1.57 103 T_XMDrugObfuBody_14 10576 1.59 1.86 1.56 104 TVD_RCVD_IP 10541 1.44 0.69 1.55 105 RELAYCOUNTRY_CA 10057 2.26 7.55 1.48 106 T_XMDrugObfuBody_08 10041 1.62 2.57 1.48 107 XM_B_SpammyTLD 9987 1.79 3.98 1.47 108 SUBJ_ALL_CAPS 9320 1.69 3.87 1.37 109 XM_DK_Undo_01 9082 1.31 1.13 1.34 110 URI_HEX 9076 1.41 1.93 1.34 111 XMDiploma_00 8900 1.38 1.90 1.31 112 XM_OfRef6 8611 2.06 7.47 1.27 113 RCVD_IN_BL_SPAMCOP_NET 8602 1.96 6.66 1.27 114 HELO_NODOT 8443 1.31 1.80 1.24 115 HELO_NO_DOMAIN 8440 1.31 1.80 1.24 116 T_OBFU_PDF_ATTACH 7964 1.06 0.32 1.17 117 IN_HORDE_ADDRESS_BOOK 7815 1.05 0.33 1.15 118 XMSubGarbage 7661 1.00 0.12 1.13 119 XMSubLongNoVowel 7660 1.03 0.39 1.13 120 TooManyTo_003 7623 1.06 0.63 1.12 121 HELO_MISC_IP 7557 1.05 0.60 1.11 122 CK_HELO_DYNAMIC_SPLIT_IP 7551 1.07 0.82 1.11 123 INVALID_MSGID 7548 1.10 1.02 1.11 124 XM_UB50 7339 1.69 5.83 1.08 125 XMSubMetaSxObfu_03 7102 1.69 6.07 1.04 126 XM_GoogleGroups 6965 0.95 0.47 1.02 127 XM_E_Blogspot 6760 0.88 0.07 0.99 128 TO_MALFORMED 6634 0.86 0.05 0.98 129 RELAYCOUNTRY_GB 6566 1.00 1.26 0.97 130 DKIM_ADSP_CUSTOM_MED 6475 1.01 1.41 0.95 131 URI_TRY_3LD 6408 1.11 2.25 0.94 132 XMGappySubj_01 6365 0.84 0.22 0.94 133 XMCapTrack 6252 0.87 0.51 0.92 134 TM2_M_VERY_LONG_WORD 6094 1.17 3.01 0.90 135 USER_IN_DEF_DKIM_WL 6094 0.78 0.00 0.90 136 XM_H_Long_From02 6085 0.94 1.23 0.90 137 XM_SPF_Unknown 5893 0.86 0.81 0.87 138 T_FILL_THIS_FORM_SHORT 5664 1.21 3.76 0.83 139 TooManyTo_004 5637 0.79 0.54 0.83 140 SpammyFromTLD_01 5296 1.31 4.89 0.78 141 XMHTML_After_End 5290 0.84 1.28 0.78 142 HTTPS_HTTP_MISMATCH 5129 0.77 0.86 0.75 143 XMGenDplmaNmb 5074 0.80 1.18 0.75 144 T_TooManySym_03 5032 0.68 0.25 0.74 145 RCVD_IN_MSPIKE_BL 4995 2.02 10.74 0.73 146 XMBdyGiftCard01 4920 0.90 2.10 0.72 147 TR_MSPIKEBAYES00 4831 0.62 0.01 0.71 148 TooManyTo_005 4730 0.66 0.43 0.70 149 NML_ADSP_CUSTOM_MED 4714 0.76 1.23 0.69 150 XMBody_17 4699 1.36 5.88 0.69 151 XM_ProductURIs 4691 0.70 0.79 0.69 152 TR_MetaPhish_Combo_01 4646 0.71 0.93 0.68 153 XMBrknScrpt_02 4541 1.16 4.50 0.67 154 XMBody_95 4536 0.60 0.10 0.67 155 TR_XM_COVIDMETA4 4519 1.21 4.90 0.66 156 DKIM_ADSP_NXDOMAIN 4302 0.75 1.52 0.63 157 XMSexyCombo_01 4270 0.95 3.11 0.63 158 T_XMDrugObfuBody_00 4264 1.41 6.72 0.63 159 XMSubMetaI_00 4018 0.62 0.81 0.59 160 TR_BOTNET_NEGATE 3930 0.59 0.63 0.58 161 T_XMHurry_00 3864 0.88 2.99 0.57 162 XM_DIRTYINTL 3678 0.97 3.89 0.54 163 T_Symld_Words_02 3531 0.54 0.72 0.52 164 XMMoneyMeta_00 3495 0.55 0.82 0.51 165 FROM_GOV_DKIM_AU 3443 0.48 0.27 0.51 166 XM_RXBody 3433 0.47 0.25 0.51 167 FORGED_GMAIL_RCVD 3160 0.54 1.05 0.46 168 RCVD_IN_MSPIKE_L3 3100 0.96 4.41 0.46 169 HTML_IMAGE_ONLY_20 3093 0.53 1.07 0.46 170 TR_XM_PHPDW 3087 0.71 2.42 0.45 171 TR_XM_COVIDMETA1 3063 1.18 6.11 0.45 172 XM_H_PHPMailer 3042 0.52 1.01 0.45 173 XM_ShortIntro_01 3040 0.57 1.40 0.45 174 XMNoVowels 3006 0.46 0.55 0.44 175 TR_XM_PHPForged 2987 0.69 2.39 0.44 176 TR_XM_FormFill2 2965 0.68 2.37 0.44 177 XM_H_PHPOS 2940 0.68 2.36 0.43 178 XM_B_COPY_HTML 2922 0.43 0.41 0.43 179 XMPhish14 2904 0.98 4.74 0.43 180 FROM_GOV_SPOOF 2866 0.40 0.23 0.42 181 XMPhish30 2744 0.51 1.25 0.40 182 HTML_TAG_BALANCE_BODY 2741 0.43 0.64 0.40 183 T_TooManySym_04 2670 0.36 0.14 0.39 184 XMHTMLBadTable_001 2573 0.38 0.37 0.38 185 XM_B_REG_HTML 2571 0.36 0.22 0.38 186 HTML_IMAGE_ONLY_28 2561 0.36 0.25 0.38 187 RELAYCOUNTRY_DE 2554 0.45 0.95 0.38 188 FILL_THIS_FORM 2494 0.35 0.25 0.37 189 MISSING_HEADERS 2491 0.63 2.44 0.37 190 XMSubMetaSxObfu_02 2479 0.35 0.27 0.36 191 TM2_M_BODY_EMPTY 2465 0.33 0.12 0.36 192 RCVD_IN_SORBS_DUL 2428 0.35 0.30 0.36 193 XMLngstWrd_00 2414 0.36 0.40 0.36 194 XMBody_78 2411 0.46 1.15 0.35 195 URI_NOVOWEL 2406 0.43 0.99 0.35 196 SUBJ_DOLLARS 2383 0.38 0.59 0.35 197 SHORT_HELO_AND_INLINE_IMAGE 2322 0.31 0.07 0.34 198 XM_S_SubURI 2281 0.30 0.06 0.34 199 HTML_IMAGE_ONLY_24 2272 0.36 0.57 0.33 200 TR_XM_UnparsRelay 2238 0.71 3.28 0.33 ----------------------------------------------------------------------