Email: 703096 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 2.02 sec Spam: 96296 Autolearn: 0 AvgScore: 13.03 AvgScanTime: 4.25 sec Ham: 606800 Autolearn: 0 AvgScore: -1.65 AvgScanTime: 1.67 sec Time Spent Running SA: 395.08 hours Time Spent Processing Spam: 113.79 hours Time Spent Processing Ham: 281.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 92595 97.85 96.16 98.11 2 HTML_MESSAGE 87888 86.34 91.27 85.56 3 XM_B_Unicode 73780 67.60 76.62 66.17 4 DKIM_SIGNED 66933 72.74 69.51 73.26 5 RELAYCOUNTRY_US 65781 76.78 68.31 78.13 6 XM_DK_Pass 64884 71.44 67.38 72.09 7 XMListUnsubscribeExists 56970 50.79 59.16 49.46 8 DKIM_VALID 52054 65.92 54.06 67.80 9 XM_DK_Undo_02 45324 16.20 47.07 11.30 10 DKIM_VALID_AU 36944 49.29 38.37 51.02 11 BAYES_99 34808 11.10 36.15 7.12 12 XM_B_Unicode3 34589 37.28 35.92 37.50 13 BAYES_50 33193 49.41 34.47 51.79 14 MIME_HTML_ONLY 32771 21.22 34.03 19.19 15 RCVD_IN_MSPIKE_H2 30107 24.55 31.27 23.48 16 LOC_TINY_FONT_1 29024 24.17 30.14 23.22 17 BOTNET 28853 7.06 29.96 3.42 18 RELAYCOUNTRY_META 27435 9.04 28.49 5.96 19 BAYES_999 26246 8.53 27.26 5.56 20 FVGT_m_MULTI_ODD 24136 21.74 25.06 21.21 21 HTML_FONT_LOW_CONTRAST 23856 25.70 24.77 25.85 22 DKIM_VALID_EF 23572 26.97 24.48 27.37 23 XMSubLong 22652 20.76 23.52 20.32 24 T_TM2_M_HEADER_IN_MSG 22383 28.94 23.24 29.85 25 UNTRUSTED_Relay 20086 5.06 20.86 2.55 26 T_KAM_HTML_FONT_INVALID 18561 17.96 19.27 17.75 27 XM_Multi_Part_URI 17862 14.09 18.55 13.39 28 XM_Body_Dirty_Words 16721 13.68 17.36 13.09 29 RCVD_IN_BL_SPAMCOP_NET 16466 3.49 17.10 1.33 30 BOTNET_IPINHOSTNAME 16464 6.62 17.10 4.96 31 DKIM_INVALID 14879 6.83 15.45 5.46 32 XM_UncommonTLD01 13631 4.35 14.16 2.80 33 NO_DNS_FOR_FROM 12515 4.51 13.00 3.16 34 RCVD_IN_PSBL 11979 1.73 12.44 0.03 35 LOTS_OF_MONEY 11607 8.83 12.05 8.32 36 XM_B_Phish_Phrases 11481 7.65 11.92 6.98 37 T_REMOTE_IMAGE 10471 4.35 10.87 3.31 38 XM_B_Unsub 10344 11.65 10.74 11.80 39 HTML_MIME_NO_HTML_TAG 10307 3.09 10.70 1.88 40 RCVD_IN_MSPIKE_BL 9814 1.92 10.19 0.60 41 BAYES_80 9318 4.87 9.68 4.10 42 XMSexyCombo_05 9070 4.58 9.42 3.82 43 BODY_URI_ONLY 8665 1.28 9.00 0.05 44 XM_Evil_Numbers_Gen 8521 8.25 8.85 8.15 45 HTML_IMAGE_ONLY_08 8124 1.26 8.44 0.12 46 BAYES_60 7922 6.69 8.23 6.45 47 HTML_SHORT_LINK_IMG_1 7889 1.15 8.19 0.03 48 LotsOfNums_01 7805 8.23 8.11 8.26 49 XMSubGiftCard1 7771 1.14 8.07 0.04 50 TR_XM_PhishingBody 7535 4.07 7.82 3.47 51 RCVD_IN_MSPIKE_WL 7103 22.50 7.38 24.90 52 RCVD_IN_RP_RNBL 7088 1.10 7.36 0.11 53 HTML_IMAGE_RATIO_02 7050 6.58 7.32 6.47 54 XM_SPF_SoftFail 6959 2.54 7.23 1.80 55 RELAYCOUNTRY_CA 6825 2.43 7.09 1.70 56 XMSubMetaSx_00 6761 4.25 7.02 3.81 57 XM_UB50 6754 2.02 7.01 1.22 58 TooManyTo_001 6011 7.98 6.24 8.25 59 SpammyFromTLD_01 5992 1.53 6.22 0.78 60 XM_H_Long_From01 5742 5.52 5.96 5.45 61 BAYES_95 5689 2.97 5.91 2.51 62 MPART_ALT_DIFF 5643 4.64 5.86 4.45 63 RCVD_IN_MSPIKE_L5 5572 0.98 5.79 0.22 64 UNPARSEABLE_RELAY 5549 7.01 5.76 7.20 65 KHOP_HELO_FCRDNS 5534 2.35 5.75 1.81 66 XM_B_COVIDMETA 5345 2.29 5.55 1.77 67 BOTNET_NORDNS 4849 0.71 5.04 0.02 68 HTML_IMAGE_RATIO_04 4794 5.10 4.98 5.12 69 XM_B_SpammyTLD 4720 2.26 4.90 1.84 70 XM_B_Phish66 4612 2.42 4.79 2.05 71 XM_SendGrid 4423 6.27 4.59 6.54 72 TR_XM_COVIDMETA4 4422 1.24 4.59 0.71 73 XM_OfRef6 4346 1.67 4.51 1.22 74 RCVD_IN_MSPIKE_H3 4227 13.23 4.39 14.63 75 TR_XM_INV_DKIM 4019 0.81 4.17 0.27 76 XM_UB99 4016 0.58 4.17 0.00 77 URIBL_SBL_A 3941 0.69 4.09 0.15 78 T_XMDrugObfuBody_08 3932 2.05 4.08 1.73 79 XMDiploma_00 3715 2.10 3.86 1.82 80 XM_DIRTYINTL 3471 0.98 3.60 0.56 81 XMBody_17 3456 1.27 3.59 0.90 82 TR_XM_MaxWHORU 3452 0.55 3.58 0.07 83 TM2_M_URI_OPT_OUT 3431 7.18 3.56 7.76 84 MIME_HTML_MOSTLY 3380 2.43 3.51 2.26 85 TR_XM_MaxBayes 3338 0.50 3.47 0.03 86 XMNumbers 3294 3.08 3.42 3.03 87 XM_URI_RBL 3172 0.64 3.29 0.22 88 TR_XM_PHPDW 3147 0.83 3.27 0.44 89 XM_UB60 3143 0.58 3.26 0.15 90 TR_XM_PHPForged 3111 0.80 3.23 0.42 91 TR_XM_FormFill2 3093 0.80 3.21 0.42 92 XM_UB80 3090 0.50 3.21 0.06 93 XM_H_PHPOS 3079 0.79 3.20 0.41 94 RCVD_IN_MSPIKE_L3 3016 0.72 3.13 0.33 95 SpammyFromTLD_02 2980 0.70 3.09 0.32 96 TR_XM_COVIDMETA1 2966 0.78 3.08 0.42 97 HTML_IMAGE_RATIO_06 2965 3.63 3.08 3.72 98 TR_XM_UnparsRelay 2959 0.80 3.07 0.44 99 XMStrtUSub 2936 4.29 3.05 4.49 100 PDS_OTHER_BAD_TLD 2903 0.70 3.01 0.34 101 ALL_TRUSTED 2810 15.45 2.92 17.43 102 RCVD_IN_MSPIKE_H4 2723 8.15 2.83 8.99 103 XM_UB999 2702 0.39 2.81 0.00 104 TM2_M_VERY_LONG_WORD 2614 1.35 2.71 1.13 105 DATE_IN_PAST_03_06 2558 0.51 2.66 0.17 106 MIME_QP_LONG_LINE 2540 4.91 2.64 5.27 107 XMSubNoVowel 2533 1.18 2.63 0.95 108 SUBJ_ALL_CAPS 2495 1.76 2.59 1.62 109 HTML_IMAGE_RATIO_08 2472 2.34 2.57 2.30 110 T_TooManySym_01 2469 4.25 2.56 4.51 111 HK_RANDOM_FROM 2332 0.45 2.42 0.14 112 RELAYCOUNTRY_FR 2299 0.61 2.39 0.33 113 XM_B_Unsub2 2234 4.15 2.32 4.44 114 FROM_SUSPICIOUS_NTLD 2193 0.34 2.28 0.04 115 XMSexyCombo_01 2181 1.01 2.26 0.81 116 MIME_CHARSET_FARAWAY 2178 0.47 2.26 0.18 117 XM_CamelCaseFrm001 2131 2.00 2.21 1.97 118 XM_JunkDunk 2085 0.30 2.17 0.00 119 FROM_SUSPICIOUS_NTLD_FP 2074 0.32 2.15 0.03 120 BAYES_40 2073 4.08 2.15 4.38 121 NO_FM_NAME_IP_HOSTN 2038 0.29 2.12 0.00 122 DKIM_ADSP_CUSTOM_MED 2012 1.11 2.09 0.95 123 T_XMDrugObfuBody_14 2005 1.71 2.08 1.66 124 MPART_ALT_DIFF_COUNT 2003 0.71 2.08 0.49 125 TR_LOTS_OF_MONEY3 1971 0.87 2.05 0.68 126 XMHTML_After_End 1962 1.06 2.04 0.91 127 URI_HEX 1946 1.66 2.02 1.60 128 URI_TRY_3LD 1928 1.26 2.00 1.15 129 TR_XM_DK_SendGrid 1892 3.39 1.96 3.62 130 XMBrknScrpt_02 1869 1.01 1.94 0.86 131 XM_UB95 1868 0.28 1.94 0.01 132 NML_ADSP_CUSTOM_MED 1845 0.85 1.92 0.68 133 XMGenDplmaNmb 1836 1.13 1.91 1.01 134 TR_XM_MaxSPIKE 1787 0.30 1.86 0.05 135 FROM_EXCESS_BASE64 1765 2.64 1.83 2.77 136 LONG_JUNK_URI 1762 0.29 1.83 0.04 137 RELAYCOUNTRY_JP 1746 0.29 1.81 0.04 138 XM_H_PHPMailer 1716 0.76 1.78 0.60 139 TR_XM_RelayPhish 1659 0.35 1.72 0.13 140 TR_Mismatch_TLD_02 1653 0.31 1.72 0.09 141 TR_Symld_Words 1651 1.65 1.71 1.64 142 MIME_HTML_ONLY_MULTI 1648 2.70 1.71 2.86 143 TVD_SPACE_RATIO_MINFP 1642 0.24 1.71 0.01 144 TVD_SPACE_RATIO 1608 0.51 1.67 0.33 145 FORGED_GMAIL_RCVD 1589 0.62 1.65 0.46 146 ONLINE_PHARMACY 1585 0.27 1.65 0.05 147 BAYES_20 1579 3.93 1.64 4.29 148 TVD_VISIT_PHARMA 1579 0.27 1.64 0.05 149 PDS_FROM_2_EMAILS 1529 0.25 1.59 0.03 150 XMStockSpam_06 1506 0.91 1.56 0.81 151 RDNS_DYNAMIC 1504 0.51 1.56 0.34 152 T_FILL_THIS_FORM_SHORT 1490 0.91 1.55 0.81 153 XM_H_PHPOS_M 1465 0.36 1.52 0.18 154 DATE_IN_PAST_06_12 1464 0.41 1.52 0.24 155 XM_B_SEO 1457 0.31 1.51 0.12 156 HELO_NODOT 1457 1.42 1.51 1.41 157 FROM_2_EMAILS_SHORT 1454 0.21 1.51 0.00 158 HELO_NO_DOMAIN 1437 1.42 1.49 1.41 159 T_XMDrugObfuBody_00 1405 0.79 1.46 0.69 160 RELAYCOUNTRY_AU 1400 0.53 1.45 0.38 161 MAILING_LIST_MULTI 1387 2.29 1.44 2.42 162 XM_OfRef7 1380 0.35 1.43 0.18 163 FILL_THIS_FORM 1356 0.39 1.41 0.22 164 TR_Mismatch_TLD_01 1314 0.37 1.36 0.21 165 XMPhish08 1299 0.61 1.35 0.49 166 XMSubLongNoVowel 1277 0.20 1.33 0.02 167 PDS_TO_EQ_FROM_NAME 1262 0.18 1.31 0.00 168 URI_PHP_REDIR 1238 0.20 1.29 0.02 169 RELAYCOUNTRY_RU 1226 0.64 1.27 0.54 170 XMBody_78 1201 0.60 1.25 0.49 171 XM_PDF 1198 3.56 1.24 3.93 172 HK_RANDOM_REPLYTO 1195 0.36 1.24 0.22 173 XM_DK_Undo_01 1183 1.59 1.23 1.65 174 MIMEOLE_DIRECT_TO_MX 1179 0.17 1.22 0.00 175 XMGppyBdWords 1155 0.32 1.20 0.18 176 PDS_BTC_ID 1144 0.20 1.19 0.04 177 RELAYCOUNTRY_DE 1136 0.43 1.18 0.31 178 T_XMHurry_00 1135 0.61 1.18 0.52 179 XM_HighProb1 1117 0.16 1.16 0.01 180 CHARSET_FARAWAY_HEADER 1115 0.20 1.16 0.04 181 RELAYCOUNTRY_HK 1081 0.19 1.12 0.04 182 TR_XM_SpoofStaff 1071 0.27 1.11 0.14 183 HTML_IMAGE_ONLY_16 1067 0.34 1.11 0.22 184 TR_MetaPhish_Combo_01 1067 0.89 1.11 0.85 185 XMSpoofStaff2 1051 0.27 1.09 0.14 186 RELAYCOUNTRY_GB 1045 0.96 1.09 0.93 187 HDR_ORDER_FTSDMCXX_DIRECT 1043 0.15 1.08 0.00 188 RELAYCOUNTRY_CN 1015 0.21 1.05 0.08 189 TM2_M_A_HREF_HREF 1015 0.48 1.05 0.39 190 XM_H_Long_From02 1010 1.15 1.05 1.16 191 RELAYCOUNTRY_IN 998 0.23 1.04 0.10 192 MISSING_HEADERS 997 0.45 1.04 0.35 193 TooManyTo_002 993 1.79 1.03 1.91 194 XMSubMetaSxObfu_03 978 0.57 1.02 0.50 195 TR_Caps_n_Bayes_99 977 0.23 1.01 0.11 196 LongTLD 964 0.32 1.00 0.21 197 RELAYCOUNTRY_KR 963 0.15 1.00 0.02 198 FROM_LOCAL_NOVOWEL 957 0.15 0.99 0.02 199 IMG_ONLY_FM_DOM_INFO 957 0.14 0.99 0.00 200 DOS_OUTLOOK_TO_MX 950 0.22 0.99 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 595354 97.85 96.16 98.11 2 HTML_MESSAGE 519154 86.34 91.27 85.56 3 RELAYCOUNTRY_US 474069 76.78 68.31 78.13 4 DKIM_SIGNED 444532 72.74 69.51 73.26 5 XM_DK_Pass 437433 71.44 67.38 72.09 6 DKIM_VALID 411412 65.92 54.06 67.80 7 XM_B_Unicode 401541 67.60 76.62 66.17 8 BAYES_50 314236 49.41 34.47 51.79 9 DKIM_VALID_AU 309600 49.29 38.37 51.02 10 XMListUnsubscribeExists 300108 50.79 59.16 49.46 11 XM_B_Unicode3 227547 37.28 35.92 37.50 12 T_TM2_M_HEADER_IN_MSG 181126 28.94 23.24 29.85 13 DKIM_VALID_EF 166081 26.97 24.48 27.37 14 HTML_FONT_LOW_CONTRAST 156845 25.70 24.77 25.85 15 RCVD_IN_MSPIKE_WL 151094 22.50 7.38 24.90 16 RCVD_IN_MSPIKE_H2 142490 24.55 31.27 23.48 17 LOC_TINY_FONT_1 140896 24.17 30.14 23.22 18 FVGT_m_MULTI_ODD 128698 21.74 25.06 21.21 19 XMSubLong 123316 20.76 23.52 20.32 20 MIME_HTML_ONLY 116435 21.22 34.03 19.19 21 T_KAM_HTML_FONT_INVALID 107717 17.96 19.27 17.75 22 ALL_TRUSTED 105789 15.45 2.92 17.43 23 RCVD_IN_MSPIKE_H3 88790 13.23 4.39 14.63 24 BAYES_00 88198 12.65 0.77 14.53 25 XM_Multi_Part_URI 81234 14.09 18.55 13.39 26 XM_Body_Dirty_Words 79457 13.68 17.36 13.09 27 XM_B_Unsub 71585 11.65 10.74 11.80 28 XM_DK_Undo_02 68561 16.20 47.07 11.30 29 RCVD_IN_MSPIKE_H4 54580 8.15 2.83 8.99 30 LOTS_OF_MONEY 50478 8.83 12.05 8.32 31 TR_XM_DK_Bayes 50265 7.20 0.40 8.28 32 LotsOfNums_01 50092 8.23 8.11 8.26 33 TooManyTo_001 50091 7.98 6.24 8.25 34 XM_Evil_Numbers_Gen 49450 8.25 8.85 8.15 35 TM2_M_URI_OPT_OUT 47072 7.18 3.56 7.76 36 TR_XM_DK_Bayes1 46818 6.69 0.20 7.72 37 IN_ZIMBRA_NJ_WHITELIST 44343 6.32 0.09 7.31 38 UNPARSEABLE_RELAY 43713 7.01 5.76 7.20 39 BAYES_99 43207 11.10 36.15 7.12 40 ANY_BOUNCE_MESSAGE 42486 6.16 0.86 7.00 41 BOUNCE_MESSAGE 42475 6.16 0.86 7.00 42 XM_B_Phish_Phrases 42332 7.65 11.92 6.98 43 TR_XM_DK_Bayes2 41007 5.86 0.17 6.76 44 RCVD_IN_RP_SAFE 39767 5.73 0.56 6.55 45 XM_SendGrid 39677 6.27 4.59 6.54 46 HTML_IMAGE_RATIO_02 39236 6.58 7.32 6.47 47 BAYES_60 39150 6.69 8.23 6.45 48 XM_DKIMWhitelistDomains 38470 5.48 0.03 6.34 49 RCVD_IN_RP_CERTIFIED 36822 5.30 0.44 6.07 50 RELAYCOUNTRY_META 36135 9.04 28.49 5.96 51 BAYES_999 33762 8.53 27.26 5.56 52 DKIM_INVALID 33120 6.83 15.45 5.46 53 XM_H_Long_From01 33077 5.52 5.96 5.45 54 MIME_QP_LONG_LINE 31995 4.91 2.64 5.27 55 HTML_IMAGE_RATIO_04 31067 5.10 4.98 5.12 56 BOTNET_IPINHOSTNAME 30108 6.62 17.10 4.96 57 BAYES_05 28887 4.23 0.91 4.76 58 RCVD_IN_IADB_LISTED 27636 4.05 0.85 4.55 59 T_TooManySym_01 27384 4.25 2.56 4.51 60 XMStrtUSub 27234 4.29 3.05 4.49 61 MPART_ALT_DIFF 26983 4.64 5.86 4.45 62 XM_B_Unsub2 26917 4.15 2.32 4.44 63 BAYES_40 26608 4.08 2.15 4.38 64 BAYES_20 26023 3.93 1.64 4.29 65 BAYES_80 24894 4.87 9.68 4.10 66 RCVD_IN_IADB_SPF 23958 3.51 0.74 3.95 67 XM_PDF 23863 3.56 1.24 3.93 68 XMSexyCombo_05 23159 4.58 9.42 3.82 69 XMSubMetaSx_00 23115 4.25 7.02 3.81 70 HTML_IMAGE_RATIO_06 22588 3.63 3.08 3.72 71 TR_XM_DK_SendGrid 21968 3.39 1.96 3.62 72 RCVD_IN_IADB_SENDERID 21379 3.14 0.70 3.52 73 TR_XM_PhishingBody 21057 4.07 7.82 3.47 74 BOTNET 20764 7.06 29.96 3.42 75 RCVD_IN_IADB_DK 20702 3.04 0.71 3.41 76 T_REMOTE_IMAGE 20092 4.35 10.87 3.31 77 NO_DNS_FOR_FROM 19193 4.51 13.00 3.16 78 XMNumbers 18390 3.08 3.42 3.03 79 MIME_HTML_ONLY_MULTI 17333 2.70 1.71 2.86 80 XM_UncommonTLD01 16984 4.35 14.16 2.80 81 RCVD_IN_IADB_VOUCHED 16883 2.44 0.28 2.78 82 FROM_EXCESS_BASE64 16804 2.64 1.83 2.77 83 UNTRUSTED_Relay 15493 5.06 20.86 2.55 84 BAYES_95 15215 2.97 5.91 2.51 85 MAILING_LIST_MULTI 14702 2.29 1.44 2.42 86 HTML_IMAGE_RATIO_08 13954 2.34 2.57 2.30 87 MIME_HTML_MOSTLY 13728 2.43 3.51 2.26 88 XM_H_Trusted_IP 13715 1.95 0.00 2.26 89 T_TooManySym_02 13310 1.97 0.59 2.19 90 XM_B_Phish66 12419 2.42 4.79 2.05 91 XM_CamelCaseFrm001 11940 2.00 2.21 1.97 92 TooManyTo_002 11577 1.79 1.03 1.91 93 HTML_MIME_NO_HTML_TAG 11438 3.09 10.70 1.88 94 RCVD_IN_IADB_OPTIN 11416 1.66 0.29 1.88 95 XM_B_SpammyTLD 11145 2.26 4.90 1.84 96 XMDiploma_00 11035 2.10 3.86 1.82 97 KHOP_HELO_FCRDNS 10991 2.35 5.75 1.81 98 XM_SPF_SoftFail 10901 2.54 7.23 1.80 99 TVD_RCVD_IP 10890 1.60 0.39 1.79 100 XM_B_COVIDMETA 10749 2.29 5.55 1.77 101 T_XMDrugObfuBody_08 10479 2.05 4.08 1.73 102 RELAYCOUNTRY_CA 10288 2.43 7.09 1.70 103 T_XMDrugObfuBody_14 10051 1.71 2.08 1.66 104 XM_DK_Undo_01 10012 1.59 1.23 1.65 105 TR_Symld_Words 9928 1.65 1.71 1.64 106 SUBJ_ALL_CAPS 9851 1.76 2.59 1.62 107 URI_HEX 9714 1.66 2.02 1.60 108 HELO_NODOT 8530 1.42 1.51 1.41 109 HELO_NO_DOMAIN 8526 1.42 1.49 1.41 110 RCVD_IN_BL_SPAMCOP_NET 8091 3.49 17.10 1.33 111 IN_HORDE_ADDRESS_BOOK 7790 1.15 0.31 1.28 112 RCVD_IN_MSPIKE_H5 7724 1.12 0.16 1.27 113 HELO_MISC_IP 7708 1.19 0.71 1.27 114 CK_HELO_DYNAMIC_SPLIT_IP 7689 1.20 0.81 1.27 115 TooManyTo_003 7463 1.16 0.72 1.23 116 XM_UB50 7433 2.02 7.01 1.22 117 XM_OfRef6 7399 1.67 4.51 1.22 118 INVALID_MSGID 7339 1.10 0.41 1.21 119 XM_GoogleGroups 7307 1.12 0.62 1.20 120 XM_H_Long_From02 7042 1.15 1.05 1.16 121 URI_TRY_3LD 6950 1.26 2.00 1.15 122 TM2_M_VERY_LONG_WORD 6853 1.35 2.71 1.13 123 XMBdyGiftCard01 6712 1.04 0.60 1.11 124 XMGappySubj_01 6573 1.00 0.46 1.08 125 TO_MALFORMED 6504 0.93 0.02 1.07 126 XMGenDplmaNmb 6124 1.13 1.91 1.01 127 XMCapTrack 6109 0.94 0.55 1.01 128 TR_MSPIKEBAYES00 6025 0.86 0.02 0.99 129 USER_IN_DEF_DKIM_WL 5942 0.85 0.00 0.98 130 DKIM_ADSP_CUSTOM_MED 5794 1.11 2.09 0.95 131 XMSubNoVowel 5766 1.18 2.63 0.95 132 RELAYCOUNTRY_GB 5672 0.96 1.09 0.93 133 TooManyTo_004 5599 0.88 0.62 0.92 134 XMHTML_After_End 5513 1.06 2.04 0.91 135 XMBody_17 5478 1.27 3.59 0.90 136 HTML_FONT_FACE_BAD 5361 0.85 0.68 0.88 137 XMBrknScrpt_02 5213 1.01 1.94 0.86 138 TR_MetaPhish_Combo_01 5161 0.89 1.11 0.85 139 T_TooManySym_03 5158 0.76 0.16 0.85 140 T_FILL_THIS_FORM_SHORT 4924 0.91 1.55 0.81 141 XMStockSpam_06 4921 0.91 1.56 0.81 142 XMSexyCombo_01 4912 1.01 2.26 0.81 143 T_OBFU_PDF_ATTACH 4792 0.70 0.17 0.79 144 SpammyFromTLD_01 4733 1.53 6.22 0.78 145 TooManyTo_005 4537 0.71 0.50 0.75 146 XM_ProductURIs 4398 0.75 0.90 0.72 147 TR_XM_COVIDMETA4 4278 1.24 4.59 0.71 148 XMMoneyMeta_00 4240 0.73 0.91 0.70 149 XMBody_95 4209 0.61 0.10 0.69 150 T_XMDrugObfuBody_00 4169 0.79 1.46 0.69 151 NML_ADSP_CUSTOM_MED 4155 0.85 1.92 0.68 152 TR_LOTS_OF_MONEY3 4150 0.87 2.05 0.68 153 XMSubMetaI_00 4097 0.65 0.52 0.68 154 HTTPS_HTTP_MISMATCH 4034 0.68 0.77 0.66 155 TR_BOTNET_NEGATE 3997 0.66 0.64 0.66 156 XM_SPF_Unknown 3775 0.66 0.90 0.62 157 XMNoVowels 3773 0.61 0.54 0.62 158 RCVD_IN_MSPIKE_BL 3665 1.92 10.19 0.60 159 XM_H_PHPMailer 3624 0.76 1.78 0.60 160 T_Symld_Words_02 3565 0.59 0.63 0.59 161 XM_DIRTYINTL 3392 0.98 3.60 0.56 162 RELAYCOUNTRY_RU 3269 0.64 1.27 0.54 163 NUMERIC_HTTP_ADDR 3233 0.55 0.62 0.53 164 FROM_GOV_DKIM_AU 3232 0.47 0.06 0.53 165 T_XMHurry_00 3175 0.61 1.18 0.52 166 XMSubMetaSxObfu_03 3054 0.57 1.02 0.50 167 XMBody_78 3003 0.60 1.25 0.49 168 XMPhish14 2974 0.54 0.84 0.49 169 XM_RXBody 2965 0.52 0.73 0.49 170 MPART_ALT_DIFF_COUNT 2956 0.71 2.08 0.49 171 XMPhish08 2956 0.61 1.35 0.49 172 DKIM_ADSP_NXDOMAIN 2952 0.54 0.86 0.49 173 XM_ShortIntro_01 2800 0.47 0.53 0.46 174 FORGED_GMAIL_RCVD 2800 0.62 1.65 0.46 175 LOW_PRICE 2737 0.45 0.43 0.45 176 T_TooManySym_04 2694 0.39 0.04 0.44 177 TR_XM_PHPDW 2675 0.83 3.27 0.44 178 TR_XM_UnparsRelay 2670 0.80 3.07 0.44 179 XMPhish30 2635 0.51 0.97 0.43 180 XMHTMLBadTable_001 2634 0.43 0.39 0.43 181 URI_NOVOWEL 2574 0.47 0.76 0.42 182 TR_XM_COVIDMETA1 2548 0.78 3.08 0.42 183 TR_XM_FormFill2 2543 0.80 3.21 0.42 184 TR_XM_PHPForged 2537 0.80 3.23 0.42 185 XM_H_PHPOS 2501 0.79 3.20 0.41 186 FROM_GOV_SPOOF 2459 0.39 0.26 0.41 187 HTML_IMAGE_ONLY_28 2450 0.40 0.35 0.40 188 HTML_TAG_BALANCE_BODY 2437 0.44 0.69 0.40 189 HTML_IMAGE_ONLY_32 2404 0.39 0.33 0.40 190 TM2_M_A_HREF_HREF 2371 0.48 1.05 0.39 191 RELAYCOUNTRY_IE 2367 0.45 0.83 0.39 192 RCVD_IN_SORBS_DUL 2357 0.39 0.43 0.39 193 SHORT_HELO_AND_INLINE_IMAGE 2346 0.35 0.09 0.39 194 XM_B_REG_HTML 2346 0.37 0.28 0.39 195 HTML_IMAGE_ONLY_20 2336 0.38 0.32 0.38 196 RELAYCOUNTRY_AU 2317 0.53 1.45 0.38 197 XM_S_SubURI 2291 0.43 0.73 0.38 198 TM2_M_BODY_EMPTY 2256 0.34 0.13 0.37 199 RELAYCOUNTRY_NL 2202 0.44 0.93 0.36 200 XM_Body_Obfu01 2161 0.34 0.26 0.36 ----------------------------------------------------------------------