Email: 676929 Autolearn: 0 AvgScore: 0.47 AvgScanTime: 1.84 sec Spam: 89056 Autolearn: 0 AvgScore: 13.16 AvgScanTime: 3.84 sec Ham: 587873 Autolearn: 0 AvgScore: -1.45 AvgScanTime: 1.54 sec Time Spent Running SA: 346.90 hours Time Spent Processing Spam: 94.97 hours Time Spent Processing Ham: 251.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 86452 98.15 97.08 98.31 2 HTML_MESSAGE 81435 82.14 91.44 80.74 3 DKIM_SIGNED 64525 70.35 72.45 70.03 4 XM_B_Unicode 63383 64.80 71.17 63.84 5 XM_DK_Pass 62046 68.98 69.67 68.87 6 RELAYCOUNTRY_US 61404 73.81 68.95 74.55 7 XMListUnsubscribeExists 57078 49.35 64.09 47.12 8 DKIM_VALID 50723 63.75 56.96 64.78 9 XM_DK_Undo_02 44244 15.94 49.68 10.83 10 BAYES_99 37397 11.68 41.99 7.08 11 DKIM_VALID_AU 35649 48.00 40.03 49.20 12 XM_B_Unicode3 31755 35.60 35.66 35.60 13 BAYES_50 30328 47.12 34.05 49.10 14 BAYES_999 29974 9.29 33.66 5.60 15 MIME_HTML_ONLY 28379 20.30 31.87 18.55 16 BOTNET 27750 6.73 31.16 3.03 17 LOC_TINY_FONT_1 25132 23.18 28.22 22.42 18 FVGT_m_MULTI_ODD 24992 21.87 28.06 20.93 19 RELAYCOUNTRY_META 23867 8.93 26.80 6.22 20 DKIM_VALID_EF 22385 26.40 25.14 26.59 21 RCVD_IN_MSPIKE_H2 22211 23.03 24.94 22.74 22 XMSubLong 21949 21.26 24.65 20.75 23 HTML_FONT_LOW_CONTRAST 21048 25.69 23.63 26.00 24 T_TM2_M_HEADER_IN_MSG 21010 27.75 23.59 28.38 25 XM_UncommonTLD01 18995 5.41 21.33 3.00 26 UNTRUSTED_Relay 18736 5.14 21.04 2.73 27 T_KAM_HTML_FONT_INVALID 17101 17.10 19.20 16.78 28 XM_Multi_Part_URI 16206 15.90 18.20 15.55 29 XM_Body_Dirty_Words 15839 12.67 17.79 11.90 30 BOTNET_IPINHOSTNAME 14019 6.17 15.74 4.72 31 DKIM_INVALID 13802 6.59 15.50 5.24 32 NO_DNS_FOR_FROM 11267 4.16 12.65 2.87 33 LOTS_OF_MONEY 11260 7.62 12.64 6.86 34 RCVD_IN_MSPIKE_BL 11143 2.30 12.51 0.76 35 XMSexyCombo_05 9737 4.97 10.93 4.07 36 RCVD_IN_BL_SPAMCOP_NET 9689 2.40 10.88 1.11 37 XM_B_Phish_Phrases 9491 7.36 10.66 6.87 38 XM_B_Unsub 9371 10.45 10.52 10.43 39 XM_SPF_SoftFail 8618 2.70 9.68 1.65 40 RCVD_IN_RP_RNBL 8338 1.30 9.36 0.08 41 BOTNET_NORDNS 7877 1.18 8.84 0.02 42 HTML_IMAGE_RATIO_02 7772 6.92 8.73 6.64 43 XM_Evil_Numbers_Gen 7506 7.94 8.43 7.86 44 RCVD_IN_MSPIKE_L5 7348 1.31 8.25 0.26 45 RCVD_IN_MSPIKE_WL 7318 21.26 8.22 23.24 46 SpammyFromTLD_01 7221 1.79 8.11 0.83 47 RCVD_IN_PSBL 7085 1.08 7.96 0.03 48 SpammyFromTLD_02 7077 1.26 7.95 0.25 49 LotsOfNums_01 7049 7.82 7.92 7.80 50 HTML_MIME_NO_HTML_TAG 6865 2.71 7.71 1.95 51 BAYES_80 6863 4.58 7.71 4.11 52 TR_XM_PhishingBody 6860 3.49 7.70 2.85 53 RELAYCOUNTRY_CA 6755 2.56 7.59 1.80 54 XMSubMetaSx_00 6637 4.15 7.45 3.65 55 FROM_SUSPICIOUS_NTLD 6312 0.97 7.09 0.04 56 XM_UB99 6076 0.90 6.82 0.01 57 XM_UB50 6024 2.09 6.76 1.38 58 BAYES_60 5682 6.14 6.38 6.11 59 FROM_EXCESS_BASE64 5632 2.98 6.32 2.47 60 T_REMOTE_IMAGE 5432 3.52 6.10 3.13 61 FROM_SUSPICIOUS_NTLD_FP 5358 0.82 6.02 0.04 62 XM_H_Long_From01 5082 5.03 5.71 4.92 63 TooManyTo_001 5067 7.76 5.69 8.08 64 UNPARSEABLE_RELAY 5027 6.36 5.64 6.47 65 XMNumbers 5023 3.93 5.64 3.67 66 XM_B_COVIDMETA 4891 2.08 5.49 1.56 67 XM_BadFromFormat 4788 0.85 5.38 0.16 68 XM_UB999 4752 0.70 5.34 0.00 69 XM_B_Phish66 4677 2.15 5.25 1.68 70 TR_XM_COVIDMETA4 4598 1.35 5.16 0.77 71 DKIM_ADSP_NXDOMAIN 4568 1.08 5.13 0.46 72 MPART_ALT_DIFF 4498 4.61 5.05 4.54 73 RCVD_IN_MSPIKE_H3 4376 12.58 4.91 13.74 74 TR_XM_INV_DKIM 4272 0.77 4.80 0.16 75 BODY_URI_ONLY 4261 0.69 4.78 0.07 76 FROM_MISSP_REPLYTO 4046 0.61 4.54 0.01 77 HTML_IMAGE_ONLY_16 4043 0.87 4.54 0.31 78 HDRS_MISSP 4000 0.65 4.49 0.07 79 HTML_IMAGE_RATIO_04 3884 5.21 4.36 5.34 80 XM_SendGrid 3660 5.53 4.11 5.74 81 XM_DIRTYINTL 3642 1.04 4.09 0.57 82 HTML_TAG_BALANCE_CENTER 3579 0.70 4.02 0.19 83 BAYES_95 3506 2.67 3.94 2.47 84 IMG_ONLY_FM_DOM_INFO 3455 0.51 3.88 0.00 85 XM_B_SpammyTLD 3296 1.98 3.70 1.71 86 XMBody_17 3230 1.13 3.63 0.75 87 TR_XM_MaxWHORU 3198 0.52 3.59 0.05 88 RCVD_IN_MSPIKE_L3 3196 0.87 3.59 0.46 89 URIBL_SBL_A 3180 0.60 3.57 0.15 90 TM2_M_URI_OPT_OUT 3088 11.10 3.47 12.26 91 TR_XM_PHPForged 2989 0.85 3.36 0.47 92 TR_XM_PHPDW 2983 0.85 3.35 0.48 93 TR_XM_FormFill2 2956 0.84 3.32 0.46 94 XM_H_PHPOS 2943 0.83 3.30 0.46 95 TR_XM_COVIDMETA1 2881 0.72 3.24 0.34 96 XMStrtUSub 2848 3.78 3.20 3.87 97 RCVD_IN_MSPIKE_H4 2823 7.54 3.17 8.21 98 XM_OfRef6 2809 1.33 3.15 1.05 99 TR_XM_UnparsRelay 2796 0.85 3.14 0.50 100 XM_JunkDunk 2762 0.41 3.10 0.00 101 XM_URI_RBL 2737 0.58 3.07 0.20 102 T_XMDrugObfuBody_08 2696 1.79 3.03 1.61 103 XM_CamelCaseFrm001 2693 2.00 3.02 1.84 104 MIME_HTML_MOSTLY 2674 2.26 3.00 2.14 105 TR_Mismatch_TLD_02 2622 0.46 2.94 0.08 106 TR_XM_MaxBayes 2572 0.41 2.89 0.03 107 KHOP_HELO_FCRDNS 2532 1.74 2.84 1.57 108 RELAYCOUNTRY_RU 2522 0.91 2.83 0.62 109 HTML_IMAGE_RATIO_06 2473 2.93 2.78 2.95 110 HTML_IMAGE_RATIO_08 2398 2.29 2.69 2.23 111 TR_LOTS_OF_MONEY3 2370 0.88 2.66 0.61 112 DATE_IN_PAST_03_06 2367 0.47 2.66 0.14 113 XM_B_Unsub2 2346 3.47 2.63 3.60 114 MIME_QP_LONG_LINE 2261 4.48 2.54 4.78 115 XMBrknScrpt_02 2237 1.10 2.51 0.88 116 RELAYCOUNTRY_FR 2235 0.72 2.51 0.45 117 XM_UB80 2200 0.40 2.47 0.09 118 ALL_TRUSTED 2147 18.45 2.41 20.88 119 TR_XM_MaxSPIKE 2138 0.38 2.40 0.07 120 T_TooManySym_01 2111 4.18 2.37 4.45 121 XM_UB60 2063 0.46 2.32 0.18 122 BAYES_40 2049 4.20 2.30 4.49 123 XMSubNoVowel 1950 1.04 2.19 0.87 124 PDS_OTHER_BAD_TLD 1931 0.54 2.17 0.30 125 SUBJ_ALL_CAPS 1921 1.46 2.16 1.36 126 MIME_HTML_ONLY_MULTI 1917 2.71 2.15 2.79 127 TM2_M_VERY_LONG_WORD 1908 1.20 2.14 1.06 128 XMHTML_After_End 1796 0.97 2.02 0.81 129 TR_Symld_Words 1791 1.64 2.01 1.58 130 URI_HEX 1717 1.42 1.93 1.35 131 XMSexyCombo_01 1696 0.75 1.90 0.57 132 URI_TRY_3LD 1687 1.32 1.89 1.23 133 XMDiploma_00 1631 1.86 1.83 1.87 134 TR_XM_RelayPhish 1580 0.41 1.77 0.20 135 T_XMDrugObfuBody_00 1577 0.86 1.77 0.72 136 TR_XM_DK_SendGrid 1543 3.00 1.73 3.20 137 DKIM_ADSP_CUSTOM_MED 1536 1.18 1.72 1.10 138 RDNS_DYNAMIC 1480 0.47 1.66 0.29 139 MISSING_HEADERS 1469 0.59 1.65 0.43 140 BAYES_20 1468 4.70 1.65 5.16 141 XMGppyBdWords 1419 0.64 1.59 0.49 142 T_XMHurry_00 1393 0.73 1.56 0.60 143 MPART_ALT_DIFF_COUNT 1377 0.51 1.55 0.36 144 T_XMDrugObfuBody_14 1369 1.34 1.54 1.31 145 NML_ADSP_CUSTOM_MED 1348 0.83 1.51 0.73 146 HELO_NODOT 1337 1.80 1.50 1.85 147 HELO_NO_DOMAIN 1336 1.80 1.50 1.85 148 DATE_IN_PAST_06_12 1323 0.27 1.49 0.08 149 RELAYCOUNTRY_GB 1274 1.00 1.43 0.93 150 XMStockSpam_06 1272 1.31 1.43 1.29 151 XMSubMetaI_00 1266 1.00 1.42 0.94 152 XM_PDF 1260 3.61 1.41 3.94 153 TR_Mismatch_TLD_01 1234 0.38 1.39 0.23 154 REPLYTO_WITHOUT_TO_CC 1228 0.25 1.38 0.08 155 MAILING_LIST_MULTI 1203 2.42 1.35 2.58 156 URI_NOVOWEL 1184 1.73 1.33 1.79 157 DEAR_SOMETHING 1177 0.27 1.32 0.11 158 T_FILL_THIS_FORM_SHORT 1157 0.86 1.30 0.80 159 FORGED_GMAIL_RCVD 1152 0.67 1.29 0.57 160 MIME_CHARSET_FARAWAY 1118 0.29 1.26 0.14 161 XM_H_PHPMailer 1101 0.59 1.24 0.49 162 RELAYCOUNTRY_NL 1092 0.61 1.23 0.52 163 TVD_SPACE_RATIO_MINFP 1081 0.17 1.21 0.02 164 XMMoneyMeta_00 1071 0.61 1.20 0.52 165 TR_LOTS_OF_MONEY2 1062 0.60 1.19 0.51 166 T_MONEY_PERCENT 1062 0.60 1.19 0.51 167 PDS_BTC_ID 1061 0.18 1.19 0.03 168 XMGenDplmaNmb 1057 0.96 1.19 0.92 169 RELAYCOUNTRY_IN 1038 0.27 1.17 0.14 170 XM_DK_Undo_01 1029 1.50 1.16 1.55 171 RELAYCOUNTRY_CN 1023 0.22 1.15 0.08 172 XMSubLongNoVowel 1011 0.16 1.14 0.02 173 URIBL_BLACK 1010 0.17 1.13 0.02 174 XM_UB95 989 0.17 1.11 0.02 175 CHARSET_FARAWAY_HEADER 979 0.19 1.10 0.05 176 REMOVE_BEFORE_LINK 952 0.36 1.07 0.25 177 HK_RANDOM_REPLYTO 946 0.29 1.06 0.18 178 TR_MetaPhish_Combo_01 939 0.70 1.05 0.65 179 BAYES_00 931 12.33 1.05 14.04 180 XMBody_78 931 0.44 1.05 0.35 181 XM_H_Long_From02 931 0.94 1.05 0.92 182 XMPhish14 918 0.43 1.03 0.34 183 XMSexyCombo_04 914 0.24 1.03 0.12 184 XM_Nigeria_01 912 0.19 1.02 0.06 185 XM_H_PHPOS_M 910 0.26 1.02 0.15 186 XM_SPF_Unknown 901 0.73 1.01 0.69 187 BOGUS_MIME_VERSION 900 0.13 1.01 0.00 188 LongTLD 900 0.27 1.01 0.16 189 XMBody_50 895 0.13 1.00 0.00 190 HTTPS_HTTP_MISMATCH 890 0.69 1.00 0.65 191 XM_HighProb1 888 0.14 1.00 0.01 192 OBFU_BITCOIN 881 0.13 0.99 0.00 193 FUZZY_BITCOIN 881 0.13 0.99 0.00 194 RELAYCOUNTRY_JP 880 0.17 0.99 0.04 195 TR_LOTS_OF_MONEY1 866 0.15 0.97 0.03 196 XMPhish08 855 0.47 0.96 0.40 197 TooManyTo_002 847 1.80 0.95 1.93 198 DIET_1 839 0.53 0.94 0.46 199 XMPhish30 825 0.48 0.93 0.42 200 FSL_HELO_NON_FQDN_1 820 0.13 0.92 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 577938 98.15 97.08 98.31 2 HTML_MESSAGE 474621 82.14 91.44 80.74 3 RELAYCOUNTRY_US 438253 73.81 68.95 74.55 4 DKIM_SIGNED 411679 70.35 72.45 70.03 5 XM_DK_Pass 404891 68.98 69.67 68.87 6 DKIM_VALID 380849 63.75 56.96 64.78 7 XM_B_Unicode 375277 64.80 71.17 63.84 8 DKIM_VALID_AU 289261 48.00 40.03 49.20 9 BAYES_50 288644 47.12 34.05 49.10 10 XMListUnsubscribeExists 276991 49.35 64.09 47.12 11 XM_B_Unicode3 209262 35.60 35.66 35.60 12 T_TM2_M_HEADER_IN_MSG 166823 27.75 23.59 28.38 13 DKIM_VALID_EF 156316 26.40 25.14 26.59 14 HTML_FONT_LOW_CONTRAST 152822 25.69 23.63 26.00 15 RCVD_IN_MSPIKE_WL 136630 21.26 8.22 23.24 16 RCVD_IN_MSPIKE_H2 133694 23.03 24.94 22.74 17 LOC_TINY_FONT_1 131772 23.18 28.22 22.42 18 FVGT_m_MULTI_ODD 123028 21.87 28.06 20.93 19 ALL_TRUSTED 122734 18.45 2.41 20.88 20 XMSubLong 121969 21.26 24.65 20.75 21 MIME_HTML_ONLY 109055 20.30 31.87 18.55 22 T_KAM_HTML_FONT_INVALID 98653 17.10 19.20 16.78 23 XM_Multi_Part_URI 91441 15.90 18.20 15.55 24 BAYES_00 82509 12.33 1.05 14.04 25 RCVD_IN_MSPIKE_H3 80785 12.58 4.91 13.74 26 TM2_M_URI_OPT_OUT 72045 11.10 3.47 12.26 27 XM_Body_Dirty_Words 69930 12.67 17.79 11.90 28 ANY_BOUNCE_MESSAGE 68527 10.22 0.72 11.66 29 BOUNCE_MESSAGE 68524 10.22 0.72 11.66 30 XM_DK_Undo_02 63673 15.94 49.68 10.83 31 XM_B_Unsub 61341 10.45 10.52 10.43 32 RCVD_IN_MSPIKE_H4 48244 7.54 3.17 8.21 33 TooManyTo_001 47489 7.76 5.69 8.08 34 XM_Evil_Numbers_Gen 46231 7.94 8.43 7.86 35 LotsOfNums_01 45861 7.82 7.92 7.80 36 TR_XM_DK_Bayes 43680 6.51 0.46 7.43 37 BAYES_05 43310 6.51 0.86 7.37 38 BAYES_99 41649 11.68 41.99 7.08 39 TR_XM_DK_Bayes1 40600 6.04 0.31 6.91 40 XM_B_Phish_Phrases 40364 7.36 10.66 6.87 41 LOTS_OF_MONEY 40351 7.62 12.64 6.86 42 XM_DKIMWhitelistDomains 40263 5.95 0.02 6.85 43 HTML_IMAGE_RATIO_02 39043 6.92 8.73 6.64 44 RCVD_IN_RP_SAFE 38805 5.82 0.66 6.60 45 UNPARSEABLE_RELAY 38055 6.36 5.64 6.47 46 IN_ZIMBRA_NJ_WHITELIST 37667 5.57 0.05 6.41 47 RELAYCOUNTRY_META 36557 8.93 26.80 6.22 48 BAYES_60 35907 6.14 6.38 6.11 49 TR_XM_DK_Bayes2 35702 5.30 0.19 6.07 50 RCVD_IN_RP_CERTIFIED 35256 5.26 0.42 6.00 51 XM_SendGrid 33761 5.53 4.11 5.74 52 BAYES_999 32945 9.29 33.66 5.60 53 HTML_IMAGE_RATIO_04 31407 5.21 4.36 5.34 54 DKIM_INVALID 30830 6.59 15.50 5.24 55 BAYES_20 30356 4.70 1.65 5.16 56 XM_H_Long_From01 28946 5.03 5.71 4.92 57 MIME_QP_LONG_LINE 28093 4.48 2.54 4.78 58 BOTNET_IPINHOSTNAME 27730 6.17 15.74 4.72 59 MPART_ALT_DIFF 26693 4.61 5.05 4.54 60 BAYES_40 26401 4.20 2.30 4.49 61 T_TooManySym_01 26155 4.18 2.37 4.45 62 BAYES_80 24138 4.58 7.71 4.11 63 XMSexyCombo_05 23923 4.97 10.93 4.07 64 RCVD_IN_IADB_LISTED 23921 3.64 0.85 4.07 65 XM_PDF 23186 3.61 1.41 3.94 66 XMStrtUSub 22761 3.78 3.20 3.87 67 XMNumbers 21571 3.93 5.64 3.67 68 XMSubMetaSx_00 21476 4.15 7.45 3.65 69 XM_B_Unsub2 21175 3.47 2.63 3.60 70 RCVD_IN_IADB_SPF 20789 3.17 0.75 3.54 71 TR_XM_DK_SendGrid 18788 3.00 1.73 3.20 72 RCVD_IN_IADB_SENDERID 18534 2.83 0.73 3.15 73 T_REMOTE_IMAGE 18383 3.52 6.10 3.13 74 RCVD_IN_IADB_DK 17989 2.75 0.73 3.06 75 BOTNET 17819 6.73 31.16 3.03 76 XM_UncommonTLD01 17632 5.41 21.33 3.00 77 HTML_IMAGE_RATIO_06 17331 2.93 2.78 2.95 78 NO_DNS_FOR_FROM 16895 4.16 12.65 2.87 79 TR_XM_PhishingBody 16734 3.49 7.70 2.85 80 MIME_HTML_ONLY_MULTI 16406 2.71 2.15 2.79 81 UNTRUSTED_Relay 16039 5.14 21.04 2.73 82 MAILING_LIST_MULTI 15193 2.42 1.35 2.58 83 RCVD_IN_IADB_VOUCHED 14720 2.21 0.26 2.50 84 BAYES_95 14549 2.67 3.94 2.47 85 FROM_EXCESS_BASE64 14513 2.98 6.32 2.47 86 T_TooManySym_02 14002 2.16 0.68 2.38 87 XM_H_Trusted_IP 13294 1.96 0.00 2.26 88 HTML_IMAGE_RATIO_08 13137 2.29 2.69 2.23 89 MIME_HTML_MOSTLY 12596 2.26 3.00 2.14 90 HTML_MIME_NO_HTML_TAG 11482 2.71 7.71 1.95 91 TooManyTo_002 11341 1.80 0.95 1.93 92 XMDiploma_00 10983 1.86 1.83 1.87 93 HELO_NODOT 10860 1.80 1.50 1.85 94 HELO_NO_DOMAIN 10857 1.80 1.50 1.85 95 XM_CamelCaseFrm001 10819 2.00 3.02 1.84 96 RELAYCOUNTRY_CA 10600 2.56 7.59 1.80 97 URI_NOVOWEL 10543 1.73 1.33 1.79 98 XM_B_SpammyTLD 10074 1.98 3.70 1.71 99 XM_B_Phish66 9894 2.15 5.25 1.68 100 XM_SPF_SoftFail 9683 2.70 9.68 1.65 101 RCVD_IN_IADB_OPTIN 9670 1.47 0.28 1.64 102 T_XMDrugObfuBody_08 9440 1.79 3.03 1.61 103 TVD_RCVD_IP 9380 1.43 0.31 1.60 104 TR_Symld_Words 9289 1.64 2.01 1.58 105 KHOP_HELO_FCRDNS 9242 1.74 2.84 1.57 106 XM_B_COVIDMETA 9182 2.08 5.49 1.56 107 XM_DK_Undo_01 9130 1.50 1.16 1.55 108 XM_UB50 8133 2.09 6.76 1.38 109 SUBJ_ALL_CAPS 7971 1.46 2.16 1.36 110 URI_HEX 7919 1.42 1.93 1.35 111 HELO_MISC_IP 7827 1.22 0.48 1.33 112 CK_HELO_DYNAMIC_SPLIT_IP 7816 1.22 0.50 1.33 113 T_XMDrugObfuBody_14 7685 1.34 1.54 1.31 114 RCVD_IN_MSPIKE_H5 7601 1.14 0.13 1.29 115 TooManyTo_003 7589 1.21 0.68 1.29 116 XMStockSpam_06 7576 1.31 1.43 1.29 117 INVALID_MSGID 7394 1.19 0.71 1.26 118 IN_HORDE_ADDRESS_BOOK 7378 1.11 0.14 1.26 119 URI_TRY_3LD 7227 1.32 1.89 1.23 120 XM_GoogleGroups 7217 1.13 0.48 1.23 121 RCVD_IN_BL_SPAMCOP_NET 6524 2.40 10.88 1.11 122 TO_MALFORMED 6487 0.96 0.02 1.10 123 DKIM_ADSP_CUSTOM_MED 6469 1.18 1.72 1.10 124 TM2_M_VERY_LONG_WORD 6221 1.20 2.14 1.06 125 XMCapTrack 6210 0.99 0.54 1.06 126 XM_OfRef6 6176 1.33 3.15 1.05 127 XMGappySubj_01 6112 0.93 0.19 1.04 128 HTML_FONT_FACE_BAD 5714 0.96 0.91 0.97 129 TooManyTo_004 5673 0.92 0.59 0.97 130 T_TooManySym_03 5550 0.85 0.22 0.94 131 XMSubMetaI_00 5530 1.00 1.42 0.94 132 RELAYCOUNTRY_GB 5488 1.00 1.43 0.93 133 XMGenDplmaNmb 5411 0.96 1.19 0.92 134 XM_H_Long_From02 5405 0.94 1.05 0.92 135 USER_IN_DEF_DKIM_WL 5400 0.80 0.00 0.92 136 XM_ProductURIs 5359 0.88 0.66 0.91 137 XMBrknScrpt_02 5180 1.10 2.51 0.88 138 XMSubNoVowel 5114 1.04 2.19 0.87 139 XMNoVowels 4995 0.83 0.69 0.85 140 SpammyFromTLD_01 4885 1.79 8.11 0.83 141 XMHTML_After_End 4738 0.97 2.02 0.81 142 TooManyTo_005 4704 0.76 0.49 0.80 143 T_FILL_THIS_FORM_SHORT 4687 0.86 1.30 0.80 144 TR_XM_COVIDMETA4 4508 1.35 5.16 0.77 145 RCVD_IN_MSPIKE_BL 4451 2.30 12.51 0.76 146 XMBdyGiftCard01 4445 0.75 0.74 0.76 147 XMBody_17 4433 1.13 3.63 0.75 148 NML_ADSP_CUSTOM_MED 4289 0.83 1.51 0.73 149 T_XMDrugObfuBody_00 4261 0.86 1.77 0.72 150 TR_MSPIKEBAYES00 4087 0.60 0.00 0.70 151 XM_SPF_Unknown 4036 0.73 1.01 0.69 152 AC_DIV_BONANZA 3869 0.59 0.11 0.66 153 HTTPS_HTTP_MISMATCH 3811 0.69 1.00 0.65 154 XMBody_95 3807 0.58 0.15 0.65 155 TR_MetaPhish_Combo_01 3793 0.70 1.05 0.65 156 RELAYCOUNTRY_RU 3622 0.91 2.83 0.62 157 TR_LOTS_OF_MONEY3 3560 0.88 2.66 0.61 158 T_XMHurry_00 3518 0.73 1.56 0.60 159 TR_BOTNET_NEGATE 3487 0.59 0.57 0.59 160 T_OBFU_PDF_ATTACH 3379 0.53 0.21 0.57 161 FORGED_GMAIL_RCVD 3369 0.67 1.29 0.57 162 XM_DIRTYINTL 3368 1.04 4.09 0.57 163 XMSexyCombo_01 3352 0.75 1.90 0.57 164 XM_E_Blogspot 3334 0.51 0.16 0.57 165 XM_ShortIntro_01 3063 0.51 0.46 0.52 166 RELAYCOUNTRY_NL 3036 0.61 1.23 0.52 167 XMMoneyMeta_00 3032 0.61 1.20 0.52 168 TR_LOTS_OF_MONEY2 3014 0.60 1.19 0.51 169 T_MONEY_PERCENT 3014 0.60 1.19 0.51 170 T_TooManySym_04 2980 0.45 0.05 0.51 171 TR_XM_UnparsRelay 2934 0.85 3.14 0.50 172 XMGppyBdWords 2906 0.64 1.59 0.49 173 XM_H_PHPMailer 2879 0.59 1.24 0.49 174 TR_XM_PHPDW 2798 0.85 3.35 0.48 175 TR_XM_PHPForged 2756 0.85 3.36 0.47 176 DIET_1 2730 0.53 0.94 0.46 177 TR_XM_FormFill2 2725 0.84 3.32 0.46 178 RCVD_IN_MSPIKE_L3 2709 0.87 3.59 0.46 179 DKIM_ADSP_NXDOMAIN 2709 1.08 5.13 0.46 180 XM_H_PHPOS 2697 0.83 3.30 0.46 181 HTML_IMAGE_ONLY_20 2632 0.46 0.51 0.45 182 T_Symld_Words_02 2628 0.50 0.84 0.45 183 RELAYCOUNTRY_FR 2619 0.72 2.51 0.45 184 RCVD_IN_SORBS_DUL 2584 0.42 0.30 0.44 185 THIS_AD 2558 0.50 0.91 0.44 186 HTML_TAG_BALANCE_BODY 2549 0.47 0.73 0.43 187 XMHTMLBadTable_001 2531 0.48 0.79 0.43 188 FROM_GOV_SPOOF 2519 0.41 0.29 0.43 189 MISSING_HEADERS 2518 0.59 1.65 0.43 190 TM2_M_BODY_EMPTY 2487 0.39 0.14 0.42 191 XMSubMetaSxObfu_03 2486 0.48 0.88 0.42 192 XMLKML 2482 0.37 0.00 0.42 193 XMPhish30 2457 0.48 0.93 0.42 194 XM_B_REG_HTML 2423 0.39 0.27 0.41 195 SHORT_HELO_AND_INLINE_IMAGE 2362 0.36 0.11 0.40 196 NUMERIC_HTTP_ADDR 2346 0.42 0.55 0.40 197 XMPhish08 2337 0.47 0.96 0.40 198 FROM_GOV_DKIM_AU 2302 0.35 0.06 0.39 199 HTML_IMAGE_ONLY_28 2287 0.39 0.37 0.39 200 XM_S_SubURI 2285 0.35 0.06 0.39 ----------------------------------------------------------------------