Email: 711039 Autolearn: 0 AvgScore: -0.75 AvgScanTime: 1.77 sec Spam: 102559 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 3.51 sec Ham: 608480 Autolearn: 0 AvgScore: -3.22 AvgScanTime: 1.48 sec Time Spent Running SA: 350.46 hours Time Spent Processing Spam: 99.92 hours Time Spent Processing Ham: 250.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97671 97.91 95.23 98.37 2 HTML_MESSAGE 93639 87.18 91.30 86.49 3 XM_B_Unicode 72300 68.07 70.50 67.66 4 RELAYCOUNTRY_US 68842 77.73 67.12 79.52 5 DKIM_SIGNED 62120 65.61 60.57 66.46 6 XM_DK_Pass 59941 64.27 58.45 65.25 7 XMListUnsubscribeExists 52563 46.14 51.25 45.28 8 DKIM_VALID 48327 59.28 47.12 61.33 9 MIME_HTML_ONLY 44316 25.11 43.21 22.06 10 XM_DK_Undo_02 42686 15.38 41.62 10.96 11 RCVD_IN_MSPIKE_H2 42116 24.42 41.07 21.61 12 BAYES_99 34766 10.91 33.90 7.04 13 XM_B_Unicode3 33973 40.75 33.13 42.04 14 DKIM_VALID_AU 33830 44.40 32.99 46.33 15 BAYES_50 32972 44.49 32.15 46.56 16 RELAYCOUNTRY_META 32706 9.29 31.89 5.49 17 BOTNET 30855 6.84 30.09 2.92 18 LOC_TINY_FONT_1 26857 22.14 26.19 21.46 19 RCVD_IN_BL_SPAMCOP_NET 26747 5.02 26.08 1.47 20 BAYES_999 25054 8.36 24.43 5.65 21 BODY_URI_ONLY 24097 3.44 23.50 0.06 22 UNTRUSTED_Relay 23537 5.34 22.95 2.37 23 HTML_MIME_NO_HTML_TAG 23481 5.14 22.90 2.15 24 T_REMOTE_IMAGE 23329 5.92 22.75 3.08 25 HTML_FONT_LOW_CONTRAST 22450 23.82 21.89 24.15 26 FVGT_m_MULTI_ODD 22426 19.19 21.87 18.74 27 RCVD_IN_PSBL 21889 3.13 21.34 0.06 28 DKIM_VALID_EF 21755 23.65 21.21 24.06 29 FROM_EXCESS_BASE64 21389 5.05 20.86 2.39 30 XMSubLong 20183 19.72 19.68 19.72 31 T_TM2_M_HEADER_IN_MSG 19545 24.71 19.06 25.66 32 HTML_IMAGE_RATIO_02 18768 8.34 18.30 6.66 33 XM_Multi_Part_URI 18692 13.77 18.23 13.02 34 T_KAM_HTML_FONT_INVALID 17598 16.12 17.16 15.94 35 XM_Body_Dirty_Words 16398 12.11 15.99 11.45 36 BOTNET_IPINHOSTNAME 14494 6.20 14.13 4.86 37 LOTS_OF_MONEY 13805 8.02 13.46 7.10 38 DKIM_INVALID 13793 6.32 13.45 5.12 39 BAYES_80 12939 5.12 12.62 3.86 40 XM_UncommonTLD01 12724 3.91 12.41 2.48 41 XMSubGiftCard1 12348 1.78 12.04 0.06 42 HTML_IMAGE_ONLY_12 12117 1.86 11.81 0.18 43 NO_DNS_FOR_FROM 11439 4.16 11.15 2.98 44 XM_B_Unsub 11311 11.82 11.03 11.96 45 XM_B_Phish_Phrases 10613 6.95 10.35 6.37 46 BAYES_60 10100 6.41 9.85 5.83 47 XMSexyCombo_05 9576 4.84 9.34 4.08 48 KHOP_HELO_FCRDNS 9498 2.80 9.26 1.71 49 XMBdyGiftCard01 9187 1.96 8.96 0.78 50 BOTNET_NORDNS 8659 1.23 8.44 0.01 51 HTML_SHORT_LINK_IMG_1 8567 1.23 8.35 0.03 52 XMSubGiftCard2 8379 1.20 8.17 0.02 53 LotsOfNums_01 8015 7.66 7.82 7.63 54 XM_Evil_Numbers_Gen 7914 7.71 7.72 7.71 55 HTML_SHORT_LINK_IMG_2 7856 1.14 7.66 0.04 56 TR_XM_PhishingBody 7316 3.93 7.13 3.38 57 XM_UB50 7206 1.96 7.03 1.11 58 RCVD_IN_MSPIKE_WL 7006 20.31 6.83 22.58 59 RCVD_IN_MSPIKE_BL 6998 1.60 6.82 0.71 60 BAYES_95 6581 2.86 6.42 2.26 61 RELAYCOUNTRY_CA 6356 2.31 6.20 1.66 62 TooManyTo_001 5772 6.94 5.63 7.16 63 XM_B_COVIDMETA 5672 1.93 5.53 1.33 64 HK_RANDOM_FROM 5577 0.87 5.44 0.10 65 RCVD_IN_RP_RNBL 5556 0.89 5.42 0.12 66 XMSubMetaSx_00 5551 3.77 5.41 3.50 67 XM_SPF_SoftFail 5495 2.02 5.36 1.45 68 XMBody_17 5351 1.34 5.22 0.69 69 UNPARSEABLE_RELAY 5131 6.09 5.00 6.27 70 MPART_ALT_DIFF 4943 7.56 4.82 8.02 71 XM_UB99 4756 0.67 4.64 0.01 72 XM_DIRTYINTL 4741 1.13 4.62 0.54 73 XM_B_Phish66 4731 2.28 4.61 1.89 74 XM_H_Long_From01 4671 4.87 4.55 4.92 75 XM_UB80 4620 0.70 4.50 0.06 76 HTML_IMAGE_ONLY_08 4470 0.73 4.36 0.11 77 XMBody_50 4349 0.61 4.24 0.00 78 SpammyFromTLD_01 4325 1.12 4.22 0.60 79 TR_XM_COVIDMETA4 4296 1.13 4.19 0.61 80 TR_XM_INV_DKIM 4252 0.79 4.15 0.23 81 HTML_IMAGE_RATIO_04 4158 5.52 4.05 5.77 82 XMOffer 4157 0.61 4.05 0.03 83 RCVD_IN_MSPIKE_H3 4121 11.80 4.02 13.11 84 XM_SendGrid 4104 5.18 4.00 5.37 85 XMStrtUSub 4056 3.77 3.95 3.73 86 XM_B_SpammyTLD 3999 2.15 3.90 1.86 87 XM_UB60 3590 0.61 3.50 0.12 88 RELAYCOUNTRY_JP 3507 0.57 3.42 0.09 89 T_XMDrugObfuBody_08 3440 2.24 3.35 2.05 90 SUBJ_ALL_CAPS 3422 1.74 3.34 1.47 91 TR_XM_MaxWHORU 3322 0.52 3.24 0.06 92 XMSubNoVowel 3261 5.80 3.18 6.24 93 RCVD_IN_MSPIKE_L3 3258 0.83 3.18 0.43 94 XM_OfRef6 3244 1.24 3.16 0.92 95 XMNumbers 3203 3.13 3.12 3.14 96 SpammyFromTLD_02 3102 0.77 3.02 0.39 97 RCVD_IN_MSPIKE_L5 3062 0.64 2.99 0.25 98 MIME_HTML_MOSTLY 3054 2.56 2.98 2.49 99 TM2_M_URI_OPT_OUT 3037 7.22 2.96 7.94 100 XMBrknScrpt_02 2982 1.09 2.91 0.78 101 URIBL_SBL_A 2949 0.54 2.88 0.15 102 FROM_SUSPICIOUS_NTLD 2945 0.44 2.87 0.03 103 TR_XM_COVIDMETA1 2899 0.98 2.83 0.67 104 FROM_SUSPICIOUS_NTLD_FP 2839 0.42 2.77 0.03 105 RCVD_IN_MSPIKE_H4 2726 7.40 2.66 8.20 106 TR_XM_UnparsRelay 2725 0.72 2.66 0.39 107 XM_CamelCaseFrm001 2703 1.95 2.64 1.83 108 XMSubEmpty 2592 0.52 2.53 0.18 109 HTML_IMAGE_RATIO_06 2583 3.88 2.52 4.11 110 XM_JunkDunk 2505 0.35 2.44 0.00 111 RELAYCOUNTRY_AU 2413 0.59 2.35 0.30 112 PDS_OTHER_BAD_TLD 2402 0.59 2.34 0.30 113 XM_URI_RBL 2396 0.49 2.34 0.17 114 XM_UB999 2389 0.34 2.33 0.00 115 XMDiploma_00 2354 1.86 2.30 1.79 116 TR_XM_MaxBayes 2324 0.35 2.27 0.03 117 MIME_QP_LONG_LINE 2315 4.42 2.26 4.79 118 FROM_LOCAL_NOVOWEL 2295 0.34 2.24 0.02 119 TR_XM_PHPDW 2255 0.63 2.20 0.36 120 TR_XM_PHPForged 2228 0.60 2.17 0.34 121 TR_LOTS_OF_MONEY3 2221 0.63 2.17 0.37 122 TR_XM_FormFill2 2208 0.60 2.15 0.34 123 XM_H_PHPOS 2195 0.59 2.14 0.33 124 XM_UB95 2174 0.32 2.12 0.02 125 MIME_HTML_ONLY_MULTI 2105 5.42 2.05 5.99 126 XM_B_Unsub2 2078 3.94 2.03 4.26 127 T_TooManySym_01 2059 3.65 2.01 3.92 128 TR_XM_MaxSPIKE 2018 0.34 1.97 0.06 129 DIET_1 1959 0.51 1.91 0.27 130 RELAYCOUNTRY_IE 1947 0.39 1.90 0.14 131 TR_XM_RelayPhish 1925 0.36 1.88 0.11 132 BAYES_40 1904 3.74 1.86 4.05 133 FVGT_m_MULTI_ODD_EMAIL 1887 0.29 1.84 0.03 134 TR_Mismatch_TLD_02 1858 0.31 1.81 0.06 135 DKIM_ADSP_NXDOMAIN 1849 0.63 1.80 0.43 136 HTML_IMAGE_RATIO_08 1840 2.37 1.79 2.47 137 ALL_TRUSTED 1839 14.25 1.79 16.35 138 RELAYCOUNTRY_NL 1807 0.46 1.76 0.24 139 RELAYCOUNTRY_FR 1799 0.45 1.75 0.24 140 TR_XM_DK_SendGrid 1774 2.81 1.73 2.99 141 RELAYCOUNTRY_DE 1755 0.63 1.71 0.45 142 T_XMDrugObfuBody_14 1739 1.37 1.70 1.31 143 CTYPE_NULL 1738 0.25 1.69 0.00 144 XMSexyCombo_01 1723 0.68 1.68 0.51 145 HELO_NODOT 1673 1.25 1.63 1.18 146 HELO_NO_DOMAIN 1667 1.25 1.63 1.18 147 XM_ShortIntro_01 1662 0.60 1.62 0.43 148 RELAYCOUNTRY_HK 1661 0.27 1.62 0.04 149 TR_Caps_n_Bayes_99 1645 0.32 1.60 0.10 150 URI_TRY_3LD 1615 1.23 1.57 1.17 151 XMGenDplmaNmb 1608 0.92 1.57 0.81 152 DATE_IN_PAST_03_06 1608 0.36 1.57 0.15 153 URI_HEX 1605 1.44 1.56 1.42 154 RDNS_DYNAMIC 1567 0.48 1.53 0.31 155 DATE_IN_PAST_06_12 1552 0.39 1.51 0.20 156 BAYES_20 1547 4.24 1.51 4.70 157 MAILING_LIST_MULTI 1528 1.98 1.49 2.06 158 HTML_TAG_BALANCE_CENTER 1502 0.30 1.46 0.10 159 TR_Symld_Words 1489 1.54 1.45 1.56 160 HDRS_MISSP 1377 0.24 1.34 0.06 161 T_XMHurry_00 1358 0.69 1.32 0.58 162 MIME_CHARSET_FARAWAY 1349 0.27 1.32 0.09 163 XMStockSpam_06 1342 1.12 1.31 1.08 164 FROM_MISSP_REPLYTO 1332 0.19 1.30 0.01 165 XM_DK_Undo_01 1331 1.61 1.30 1.66 166 TM2_M_VERY_LONG_WORD 1295 1.04 1.26 1.00 167 RELAYCOUNTRY_SG 1284 0.27 1.25 0.11 168 XMGppyBdWords 1272 0.31 1.24 0.15 169 RELAYCOUNTRY_RU 1271 0.63 1.24 0.53 170 REMOVE_BEFORE_LINK 1268 0.42 1.24 0.29 171 MISSING_HEADERS 1230 0.49 1.20 0.37 172 T_FILL_THIS_FORM_SHORT 1200 0.79 1.17 0.72 173 CHARSET_FARAWAY_HEADER 1198 0.20 1.17 0.03 174 T_XMDrugObfuBody_00 1180 0.76 1.15 0.70 175 XMHTML_After_End 1179 0.76 1.15 0.69 176 TR_Mismatch_TLD_01 1168 0.33 1.14 0.20 177 DKIM_ADSP_CUSTOM_MED 1155 1.06 1.13 1.05 178 ANY_BOUNCE_MESSAGE 1139 6.05 1.11 6.88 179 BOUNCE_MESSAGE 1110 6.04 1.08 6.88 180 HK_RANDOM_REPLYTO 1105 0.31 1.08 0.18 181 FILL_THIS_FORM 1097 0.40 1.07 0.28 182 XM_PDF 1076 3.23 1.05 3.60 183 XMBody_78 1075 0.56 1.05 0.48 184 TVD_RCVD_IP 1068 1.51 1.04 1.58 185 PDS_BTC_ID 1065 0.17 1.04 0.02 186 FUZZY_CREDIT 1062 0.19 1.04 0.05 187 FILL_THIS_FORM_LONG 1053 0.21 1.03 0.07 188 NML_ADSP_CUSTOM_MED 1029 0.85 1.00 0.82 189 XMPhish30 1026 0.68 1.00 0.63 190 XM_H_PHPMailer 1020 0.54 0.99 0.47 191 HTML_FONT_TINY_NORDNS 1010 0.83 0.98 0.81 192 REPLYTO_WITHOUT_TO_CC 1008 0.18 0.98 0.04 193 LOADSA_MONEY_COMBO 991 0.21 0.97 0.08 194 MPART_ALT_DIFF_COUNT 982 0.37 0.96 0.27 195 RELAYCOUNTRY_GB 979 0.91 0.95 0.91 196 FUZZY_BITCOIN 977 0.14 0.95 0.00 197 OBFU_BITCOIN 976 0.14 0.95 0.00 198 INVESTMENT_ADVICE 967 0.23 0.94 0.11 199 TR_XM_COVIDMETA3 966 0.16 0.94 0.03 200 XMSubMetaSxObfu_03 958 0.53 0.93 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 598538 97.91 95.23 98.37 2 HTML_MESSAGE 526271 87.18 91.30 86.49 3 RELAYCOUNTRY_US 483838 77.73 67.12 79.52 4 XM_B_Unicode 411700 68.07 70.50 67.66 5 DKIM_SIGNED 404379 65.61 60.57 66.46 6 XM_DK_Pass 397013 64.27 58.45 65.25 7 DKIM_VALID 373203 59.28 47.12 61.33 8 BAYES_50 283337 44.49 32.15 46.56 9 DKIM_VALID_AU 281906 44.40 32.99 46.33 10 XMListUnsubscribeExists 275516 46.14 51.25 45.28 11 XM_B_Unicode3 255785 40.75 33.13 42.04 12 T_TM2_M_HEADER_IN_MSG 156132 24.71 19.06 25.66 13 HTML_FONT_LOW_CONTRAST 146955 23.82 21.89 24.15 14 DKIM_VALID_EF 146429 23.65 21.21 24.06 15 RCVD_IN_MSPIKE_WL 137418 20.31 6.83 22.58 16 MIME_HTML_ONLY 134211 25.11 43.21 22.06 17 RCVD_IN_MSPIKE_H2 131522 24.42 41.07 21.61 18 LOC_TINY_FONT_1 130600 22.14 26.19 21.46 19 XMSubLong 120004 19.72 19.68 19.72 20 FVGT_m_MULTI_ODD 114044 19.19 21.87 18.74 21 BAYES_00 113492 16.07 0.74 18.65 22 ALL_TRUSTED 99474 14.25 1.79 16.35 23 T_KAM_HTML_FONT_INVALID 97003 16.12 17.16 15.94 24 RCVD_IN_MSPIKE_H3 79787 11.80 4.02 13.11 25 XM_Multi_Part_URI 79220 13.77 18.23 13.02 26 XM_B_Unsub 72763 11.82 11.03 11.96 27 XM_Body_Dirty_Words 69693 12.11 15.99 11.45 28 XM_H_Trusted_IP 69602 9.79 0.00 11.44 29 XM_DK_Undo_02 66702 15.38 41.62 10.96 30 RCVD_IN_MSPIKE_H4 49902 7.40 2.66 8.20 31 MPART_ALT_DIFF 48803 7.56 4.82 8.02 32 TM2_M_URI_OPT_OUT 48306 7.22 2.96 7.94 33 XM_Evil_Numbers_Gen 46915 7.71 7.72 7.71 34 LotsOfNums_01 46442 7.66 7.82 7.63 35 TooManyTo_001 43568 6.94 5.63 7.16 36 TR_XM_DK_Bayes 43476 6.16 0.33 7.15 37 LOTS_OF_MONEY 43203 8.02 13.46 7.10 38 BAYES_99 42843 10.91 33.90 7.04 39 BAYES_05 42498 6.10 0.85 6.98 40 ANY_BOUNCE_MESSAGE 41867 6.05 1.11 6.88 41 BOUNCE_MESSAGE 41842 6.04 1.08 6.88 42 HTML_IMAGE_RATIO_02 40545 8.34 18.30 6.66 43 TR_XM_DK_Bayes1 40344 5.70 0.16 6.63 44 XM_B_Phish_Phrases 38778 6.95 10.35 6.37 45 XM_DKIMWhitelistDomains 38662 5.45 0.11 6.35 46 RCVD_IN_RP_SAFE 38212 5.45 0.49 6.28 47 UNPARSEABLE_RELAY 38158 6.09 5.00 6.27 48 XMSubNoVowel 37960 5.80 3.18 6.24 49 MIME_HTML_ONLY_MULTI 36461 5.42 2.05 5.99 50 IN_ZIMBRA_NJ_WHITELIST 36176 5.09 0.04 5.95 51 TR_XM_DK_Bayes2 35538 5.02 0.14 5.84 52 BAYES_60 35444 6.41 9.85 5.83 53 HTML_IMAGE_RATIO_04 35084 5.52 4.05 5.77 54 RCVD_IN_RP_CERTIFIED 34372 4.88 0.35 5.65 55 BAYES_999 34356 8.36 24.43 5.65 56 RELAYCOUNTRY_META 33381 9.29 31.89 5.49 57 XM_SendGrid 32703 5.18 4.00 5.37 58 DKIM_INVALID 31176 6.32 13.45 5.12 59 XM_H_Long_From01 29936 4.87 4.55 4.92 60 BOTNET_IPINHOSTNAME 29565 6.20 14.13 4.86 61 MIME_QP_LONG_LINE 29134 4.42 2.26 4.79 62 BAYES_20 28571 4.24 1.51 4.70 63 XM_B_Unsub2 25904 3.94 2.03 4.26 64 RCVD_IN_IADB_LISTED 25310 3.68 0.83 4.16 65 HTML_IMAGE_RATIO_06 25037 3.88 2.52 4.11 66 XMSexyCombo_05 24820 4.84 9.34 4.08 67 BAYES_40 24671 3.74 1.86 4.05 68 T_TooManySym_01 23877 3.65 2.01 3.92 69 BAYES_80 23469 5.12 12.62 3.86 70 XMStrtUSub 22725 3.77 3.95 3.73 71 RCVD_IN_IADB_SPF 22072 3.21 0.74 3.63 72 XM_PDF 21901 3.23 1.05 3.60 73 XMSubMetaSx_00 21287 3.77 5.41 3.50 74 TR_XM_PhishingBody 20593 3.93 7.13 3.38 75 RCVD_IN_IADB_SENDERID 19839 2.89 0.71 3.26 76 RCVD_IN_IADB_DK 19232 2.81 0.72 3.16 77 XMNumbers 19083 3.13 3.12 3.14 78 T_REMOTE_IMAGE 18756 5.92 22.75 3.08 79 TR_XM_DK_SendGrid 18216 2.81 1.73 2.99 80 NO_DNS_FOR_FROM 18151 4.16 11.15 2.98 81 BOTNET 17782 6.84 30.09 2.92 82 RCVD_IN_IADB_VOUCHED 15500 2.22 0.26 2.55 83 MIME_HTML_MOSTLY 15173 2.56 2.98 2.49 84 XM_UncommonTLD01 15074 3.91 12.41 2.48 85 HTML_IMAGE_RATIO_08 15003 2.37 1.79 2.47 86 FROM_EXCESS_BASE64 14541 5.05 20.86 2.39 87 HTML_FONT_FACE_BAD 14503 2.11 0.51 2.38 88 UNTRUSTED_Relay 14427 5.34 22.95 2.37 89 BAYES_95 13780 2.86 6.42 2.26 90 HTML_MIME_NO_HTML_TAG 13063 5.14 22.90 2.15 91 T_TooManySym_02 12653 1.85 0.52 2.08 92 MAILING_LIST_MULTI 12543 1.98 1.49 2.06 93 T_XMDrugObfuBody_08 12483 2.24 3.35 2.05 94 XM_B_Phish66 11489 2.28 4.61 1.89 95 XM_B_SpammyTLD 11294 2.15 3.90 1.86 96 XM_CamelCaseFrm001 11158 1.95 2.64 1.83 97 XMDiploma_00 10899 1.86 2.30 1.79 98 KHOP_HELO_FCRDNS 10402 2.80 9.26 1.71 99 TooManyTo_002 10393 1.59 0.90 1.71 100 XM_DK_Undo_01 10119 1.61 1.30 1.66 101 RELAYCOUNTRY_CA 10072 2.31 6.20 1.66 102 RCVD_IN_IADB_OPTIN 10065 1.46 0.28 1.65 103 TVD_RCVD_IP 9644 1.51 1.04 1.58 104 TR_Symld_Words 9488 1.54 1.45 1.56 105 RCVD_IN_BL_SPAMCOP_NET 8961 5.02 26.08 1.47 106 SUBJ_ALL_CAPS 8945 1.74 3.34 1.47 107 XM_SPF_SoftFail 8853 2.02 5.36 1.45 108 URI_HEX 8641 1.44 1.56 1.42 109 XM_B_COVIDMETA 8072 1.93 5.53 1.33 110 T_XMDrugObfuBody_14 7978 1.37 1.70 1.31 111 RCVD_IN_MSPIKE_H5 7729 1.11 0.16 1.27 112 HELO_MISC_IP 7525 1.12 0.44 1.24 113 CK_HELO_DYNAMIC_SPLIT_IP 7519 1.12 0.45 1.24 114 XMGappySubj_01 7482 1.09 0.27 1.23 115 HELO_NODOT 7210 1.25 1.63 1.18 116 HELO_NO_DOMAIN 7208 1.25 1.63 1.18 117 IN_HORDE_ADDRESS_BOOK 7205 1.02 0.05 1.18 118 INVALID_MSGID 7197 1.10 0.61 1.18 119 URI_TRY_3LD 7099 1.23 1.57 1.17 120 TooManyTo_003 6832 1.05 0.63 1.12 121 XM_GoogleGroups 6800 1.03 0.48 1.12 122 XM_UB50 6757 1.96 7.03 1.11 123 XMStockSpam_06 6587 1.12 1.31 1.08 124 TO_MALFORMED 6488 0.94 0.18 1.07 125 DKIM_ADSP_CUSTOM_MED 6383 1.06 1.13 1.05 126 TM2_M_VERY_LONG_WORD 6097 1.04 1.26 1.00 127 XM_ProductURIs 5832 0.91 0.66 0.96 128 XM_OfRef6 5583 1.24 3.16 0.92 129 RELAYCOUNTRY_GB 5523 0.91 0.95 0.91 130 T_TooManySym_03 5517 0.80 0.18 0.91 131 USER_IN_DEF_DKIM_WL 5444 0.77 0.01 0.89 132 XMCapTrack 5332 0.82 0.46 0.88 133 XM_UCStrings02 5270 0.75 0.06 0.87 134 XM_H_Long_From02 5016 0.80 0.67 0.82 135 NML_ADSP_CUSTOM_MED 4998 0.85 1.00 0.82 136 XMGenDplmaNmb 4915 0.92 1.57 0.81 137 HTML_FONT_TINY_NORDNS 4915 0.83 0.98 0.81 138 TooManyTo_004 4868 0.76 0.52 0.80 139 XMBrknScrpt_02 4768 1.09 2.91 0.78 140 XMBdyGiftCard01 4758 1.96 8.96 0.78 141 XMBody_95 4481 0.65 0.15 0.74 142 T_FILL_THIS_FORM_SHORT 4394 0.79 1.17 0.72 143 RCVD_IN_MSPIKE_BL 4347 1.60 6.82 0.71 144 T_XMDrugObfuBody_00 4252 0.76 1.15 0.70 145 XMHTML_After_End 4201 0.76 1.15 0.69 146 XMBody_17 4193 1.34 5.22 0.69 147 TR_MSPIKEBAYES00 4136 0.58 0.00 0.68 148 TR_XM_COVIDMETA1 4103 0.98 2.83 0.67 149 TooManyTo_005 3987 0.62 0.42 0.66 150 XMPhish30 3835 0.68 1.00 0.63 151 T_OBFU_PDF_ATTACH 3759 0.54 0.09 0.62 152 TR_XM_COVIDMETA4 3732 1.13 4.19 0.61 153 XM_RXBody 3729 0.59 0.48 0.61 154 HTML_IMAGE_ONLY_20 3683 0.55 0.25 0.61 155 SpammyFromTLD_01 3674 1.12 4.22 0.60 156 T_XMHurry_00 3540 0.69 1.32 0.58 157 TR_MetaPhish_Combo_01 3465 0.62 0.89 0.57 158 FROM_GOV_DKIM_AU 3379 0.48 0.06 0.56 159 TR_BOTNET_NEGATE 3326 0.52 0.38 0.55 160 HTTPS_HTTP_MISMATCH 3303 0.53 0.48 0.54 161 XM_DIRTYINTL 3261 1.13 4.62 0.54 162 RELAYCOUNTRY_RU 3221 0.63 1.24 0.53 163 XMSexyCombo_01 3080 0.68 1.68 0.51 164 XM_SPF_Unknown 3012 0.51 0.62 0.50 165 T_Symld_Words_02 2981 0.53 0.76 0.49 166 XMBody_78 2928 0.56 1.05 0.48 167 XMSubMetaSxObfu_03 2842 0.53 0.93 0.47 168 XM_H_PHPMailer 2838 0.54 0.99 0.47 169 HTML_TAG_BALANCE_BODY 2807 0.50 0.71 0.46 170 XMMoneyMeta_00 2764 0.50 0.75 0.45 171 RELAYCOUNTRY_DE 2754 0.63 1.71 0.45 172 RCVD_IN_MSPIKE_L3 2638 0.83 3.18 0.43 173 DKIM_ADSP_NXDOMAIN 2617 0.63 1.80 0.43 174 XM_ShortIntro_01 2605 0.60 1.62 0.43 175 XMPhish08 2602 0.48 0.81 0.43 176 T_TooManySym_04 2594 0.37 0.04 0.43 177 FROM_GOV_SPOOF 2562 0.39 0.19 0.42 178 HTML_IMAGE_ONLY_24 2556 0.40 0.29 0.42 179 XMNoVowels 2522 0.41 0.35 0.41 180 TR_Sbj_FN_Bdy 2439 0.44 0.68 0.40 181 XM_B_REG_HTML 2430 0.38 0.25 0.40 182 XMSubMetaI_00 2408 0.44 0.73 0.40 183 TR_XM_UnparsRelay 2396 0.72 2.66 0.39 184 SpammyFromTLD_02 2384 0.77 3.02 0.39 185 XM_E_Blogspot 2325 0.34 0.09 0.38 186 XM_B_COPY_HTML 2325 0.39 0.40 0.38 187 XMPhish14 2312 0.43 0.70 0.38 188 TM2_M_BODY_EMPTY 2291 0.34 0.16 0.38 189 FORGED_GMAIL_RCVD 2286 0.44 0.80 0.38 190 NUMERIC_HTTP_ADDR 2284 0.39 0.45 0.38 191 TM2_M_A_HREF_HREF 2277 0.42 0.71 0.37 192 HTML_IMAGE_ONLY_32 2268 0.34 0.17 0.37 193 MISSING_HEADERS 2252 0.49 1.20 0.37 194 XM_S_SubURI 2243 0.32 0.06 0.37 195 TR_LOTS_OF_MONEY3 2239 0.63 2.17 0.37 196 TR_XM_PHPDW 2194 0.63 2.20 0.36 197 XMLngstWrd_00 2174 0.41 0.74 0.36 198 XMHTMLBadTable_001 2153 0.35 0.34 0.35 199 USER_IN_WHITELIST 2091 0.29 0.00 0.34 200 RCVD_IN_SORBS_DUL 2070 0.32 0.23 0.34 ----------------------------------------------------------------------