Email: 785767 Autolearn: 0 AvgScore: 0.11 AvgScanTime: 1.89 sec Spam: 127037 Autolearn: 0 AvgScore: 15.22 AvgScanTime: 3.45 sec Ham: 658730 Autolearn: 0 AvgScore: -2.80 AvgScanTime: 1.59 sec Time Spent Running SA: 412.73 hours Time Spent Processing Spam: 121.74 hours Time Spent Processing Ham: 290.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 121277 97.98 95.47 98.46 2 HTML_MESSAGE 120062 85.50 94.51 83.77 3 RELAYCOUNTRY_US 79341 75.20 62.46 77.65 4 DKIM_SIGNED 69808 63.20 54.95 64.79 5 XM_DK_Pass 67642 62.00 53.25 63.69 6 XM_B_Unicode 66850 65.97 52.62 68.54 7 XMListUnsubscribeExists 61789 46.00 48.64 45.50 8 MIME_HTML_ONLY 60811 25.95 47.87 21.73 9 DKIM_VALID 55376 57.40 43.59 60.06 10 XM_DK_Undo_02 48567 14.63 38.23 10.08 11 BOTNET 46592 8.50 36.68 3.06 12 BAYES_99 44111 10.77 34.72 6.15 13 RELAYCOUNTRY_META 43448 9.68 34.20 4.95 14 RCVD_IN_MSPIKE_H2 42771 22.97 33.67 20.90 15 XMSubLong 41341 21.46 32.54 19.32 16 DKIM_VALID_AU 39720 43.29 31.27 45.61 17 HTML_MIME_NO_HTML_TAG 38642 6.56 30.42 1.95 18 BAYES_50 38551 42.66 30.35 45.04 19 T_REMOTE_IMAGE 37847 7.36 29.79 3.03 20 FROM_EXCESS_BASE64 37063 6.88 29.17 2.58 21 BODY_URI_ONLY 36288 4.66 28.56 0.05 22 XM_B_Unicode3 34064 38.99 26.81 41.33 23 UNTRUSTED_Relay 32877 6.01 25.88 2.18 24 HTML_IMAGE_RATIO_02 32182 8.97 25.33 5.82 25 BAYES_999 31306 8.01 24.64 4.81 26 LOC_TINY_FONT_1 28910 22.13 22.76 22.01 27 FVGT_m_MULTI_ODD 27023 19.50 21.27 19.16 28 XM_UncommonTLD01 26240 5.57 20.66 2.66 29 HTML_SHORT_LINK_IMG_1 25570 3.29 20.13 0.05 30 DKIM_VALID_EF 25325 22.69 19.94 23.23 31 RCVD_IN_PSBL 24945 3.18 19.64 0.01 32 HTML_FONT_LOW_CONTRAST 24342 23.44 19.16 24.27 33 T_TM2_M_HEADER_IN_MSG 23127 23.14 18.20 24.10 34 T_KAM_HTML_FONT_INVALID 21709 16.52 17.09 16.41 35 BOTNET_NORDNS 20726 2.65 16.31 0.02 36 XM_Multi_Part_URI 18352 14.37 14.45 14.35 37 XM_Body_Dirty_Words 18129 12.33 14.27 11.96 38 BOTNET_IPINHOSTNAME 17010 6.11 13.39 4.71 39 BAYES_80 16062 5.24 12.64 3.81 40 DKIM_INVALID 14432 5.80 11.36 4.72 41 LOTS_OF_MONEY 14213 7.71 11.19 7.04 42 XM_Combo_Sbj 14199 2.07 11.18 0.32 43 SpammyFromTLD_02 13623 2.01 10.72 0.33 44 HTML_IMAGE_ONLY_12 13588 1.88 10.70 0.18 45 RCVD_IN_MSPIKE_BL 13405 2.33 10.55 0.74 46 BAYES_60 12831 6.45 10.10 5.74 47 NO_DNS_FOR_FROM 12646 4.02 9.95 2.87 48 FROM_SUSPICIOUS_NTLD 12421 1.61 9.78 0.03 49 HTML_IMAGE_ONLY_08 12420 1.67 9.78 0.10 50 XMSexyCombo_05 12364 4.70 9.73 3.73 51 FROM_SUSPICIOUS_NTLD_FP 12346 1.59 9.72 0.03 52 RCVD_IN_BL_SPAMCOP_NET 12080 2.52 9.51 1.17 53 XM_B_Unsub 11094 8.98 8.73 9.02 54 XMSubject_48 10912 1.51 8.59 0.15 55 XM_B_Phish_Phrases 10784 7.32 8.49 7.09 56 RELAYCOUNTRY_CA 10476 2.58 8.25 1.49 57 HDRS_MISSP 10379 1.36 8.17 0.04 58 DKIM_ADSP_NXDOMAIN 10325 1.77 8.13 0.55 59 BAYES_95 10032 3.24 7.90 2.34 60 RCVD_IN_RP_RNBL 9978 1.31 7.85 0.05 61 HTML_TAG_BALANCE_CENTER 9738 1.30 7.67 0.07 62 XM_UB50 9217 2.09 7.26 1.10 63 LotsOfNums_01 8898 7.43 7.00 7.51 64 XM_Evil_Numbers_Gen 8751 8.12 6.89 8.35 65 RCVD_IN_MSPIKE_L5 8740 1.30 6.88 0.23 66 XMSubMetaSx_00 8587 3.89 6.76 3.33 67 XM_UB99 8023 1.03 6.32 0.01 68 XM_JunkDunk 7880 1.00 6.20 0.00 69 XM_SPF_SoftFail 7637 2.22 6.01 1.49 70 XMSubGiftCard1 7634 1.04 6.01 0.08 71 SpammyFromTLD_01 7585 1.58 5.97 0.73 72 KHOP_HELO_FCRDNS 7525 2.12 5.92 1.39 73 HK_RANDOM_FROM 7364 1.03 5.80 0.11 74 MPART_ALT_DIFF 7265 7.85 5.72 8.27 75 RCVD_IN_MSPIKE_WL 6949 19.49 5.47 22.20 76 XM_H_Long_From01 6418 4.68 5.05 4.61 77 TR_XM_PhishingBody 6407 3.41 5.04 3.10 78 RELAYCOUNTRY_FR 6099 0.98 4.80 0.24 79 XM_UB80 6006 0.82 4.73 0.06 80 UNPARSEABLE_RELAY 5685 5.59 4.48 5.81 81 TooManyTo_001 5671 6.38 4.46 6.75 82 XM_B_COVIDMETA 5590 2.33 4.40 1.93 83 XM_UB60 5071 0.76 3.99 0.13 84 TR_XM_COVIDMETA4 5002 1.28 3.94 0.77 85 HTML_IMAGE_RATIO_04 4996 11.90 3.93 13.44 86 XMBody_17 4842 1.46 3.81 1.00 87 MIME_HTML_MOSTLY 4783 2.46 3.77 2.21 88 XMSubGiftCard2 4700 0.64 3.70 0.05 89 RELAYCOUNTRY_KR 4696 0.61 3.70 0.02 90 XMNumbers 4552 2.83 3.58 2.68 91 XM_UB999 4528 0.58 3.56 0.00 92 HTML_IMAGE_RATIO_06 4246 4.34 3.34 4.54 93 RELAYCOUNTRY_IL 4233 0.54 3.33 0.01 94 XM_SendGrid 4214 4.78 3.32 5.06 95 TR_XM_INV_DKIM 4202 0.65 3.31 0.14 96 XM_DIRTYINTL 4109 1.08 3.23 0.67 97 HTML_IMAGE_RATIO_08 4108 2.34 3.23 2.16 98 RCVD_IN_MSPIKE_H3 4103 11.36 3.23 12.92 99 T_XMDrugObfuBody_08 3913 1.87 3.08 1.63 100 XM_BadFromFormat 3904 0.59 3.07 0.11 101 XM_B_SpammyTLD 3846 1.83 3.03 1.60 102 XM_B_Phish66 3741 1.82 2.94 1.61 103 FROM_MISSP_REPLYTO 3701 0.48 2.91 0.01 104 RELAYCOUNTRY_GB 3684 1.08 2.90 0.73 105 RCVD_IN_MSPIKE_L3 3524 0.77 2.77 0.39 106 URIBL_SBL_A 3520 0.62 2.77 0.21 107 XM_UB95 3388 0.45 2.67 0.02 108 TR_XM_MaxWHORU 3344 0.46 2.63 0.04 109 TM2_M_URI_OPT_OUT 3285 9.12 2.59 10.38 110 TR_XM_UnparsRelay 3250 0.70 2.56 0.34 111 XM_URI_RBL 3143 0.55 2.47 0.18 112 SUBJ_ALL_CAPS 3104 1.43 2.44 1.24 113 DATE_IN_PAST_03_06 3099 0.49 2.44 0.11 114 XM_CamelCaseFrm001 2998 1.67 2.36 1.54 115 XM_B_Unsub2 2952 2.48 2.32 2.51 116 FROM_LOCAL_NOVOWEL 2950 0.39 2.32 0.02 117 XM_B_SEO 2941 0.49 2.32 0.14 118 XM_OfRef6 2830 1.33 2.23 1.15 119 TM2_M_VERY_LONG_WORD 2743 1.18 2.16 0.99 120 T_TooManySym_01 2716 3.37 2.14 3.60 121 IMG_ONLY_FM_DOM_INFO 2687 0.34 2.12 0.00 122 RCVD_IN_MSPIKE_H4 2674 7.02 2.10 7.97 123 FVGT_m_MULTI_ODD_EMAIL 2624 0.36 2.07 0.03 124 XMStrtUSub 2573 7.21 2.03 8.22 125 PDS_OTHER_BAD_TLD 2551 0.55 2.01 0.27 126 MIME_QP_LONG_LINE 2525 4.17 1.99 4.59 127 XMDiploma_00 2522 1.67 1.99 1.61 128 TR_XM_PHPForged 2470 0.63 1.94 0.38 129 TR_XM_PHPDW 2453 0.63 1.93 0.38 130 XMSexyCombo_01 2430 0.97 1.91 0.79 131 TR_XM_FormFill2 2427 0.62 1.91 0.37 132 XM_H_PHPOS 2424 0.62 1.91 0.37 133 XMBrknScrpt_02 2407 1.08 1.89 0.92 134 TR_XM_MaxBayes 2395 0.34 1.89 0.04 135 URI_PHP_REDIR 2351 0.31 1.85 0.01 136 RELAYCOUNTRY_NL 2323 0.47 1.83 0.21 137 TR_XM_COVIDMETA1 2222 0.68 1.75 0.47 138 TR_XM_MaxSPIKE 2160 0.29 1.70 0.02 139 HTML_IMAGE_ONLY_20 2090 0.59 1.65 0.39 140 URI_HEX 2036 1.65 1.60 1.65 141 BAYES_40 1977 4.73 1.56 5.35 142 XMAntiAgeing 1909 0.25 1.50 0.01 143 TR_LOTS_OF_MONEY3 1897 0.62 1.49 0.45 144 DATE_IN_PAST_06_12 1871 0.34 1.47 0.12 145 XMSubNoVowel 1869 3.04 1.47 3.34 146 TR_Symld_Words 1859 1.73 1.46 1.78 147 LongTLD 1779 0.35 1.40 0.15 148 MIME_HTML_ONLY_MULTI 1771 5.66 1.39 6.49 149 T_XMDrugObfuBody_14 1757 1.35 1.38 1.35 150 URI_TRY_3LD 1737 1.26 1.37 1.24 151 DIET_1 1683 0.63 1.32 0.49 152 IMPOTENCE 1679 0.24 1.32 0.03 153 ALL_TRUSTED 1665 15.77 1.31 18.56 154 BAYES_20 1631 5.26 1.28 6.03 155 RDNS_DYNAMIC 1631 0.43 1.28 0.27 156 TR_XM_RelayPhish 1618 0.32 1.27 0.14 157 XMMoneyMeta_00 1586 0.74 1.25 0.64 158 TVD_SPACE_RATIO_MINFP 1573 0.21 1.24 0.01 159 TR_XM_DK_SendGrid 1567 2.53 1.23 2.78 160 PDS_FROM_2_EMAILS 1543 0.22 1.21 0.03 161 LONG_JUNK_URI2 1531 0.24 1.21 0.05 162 TR_Mismatch_TLD_02 1525 0.26 1.20 0.08 163 SUBJ_BUY 1515 0.23 1.19 0.04 164 XMHTML_After_End 1490 0.88 1.17 0.83 165 T_XMHurry_00 1462 0.76 1.15 0.69 166 MISSING_HEADERS 1427 0.48 1.12 0.36 167 RELAYCOUNTRY_DE 1420 0.44 1.12 0.31 168 XM_PDF 1395 3.23 1.10 3.64 169 FROM_2_EMAILS_SHORT 1368 0.18 1.08 0.00 170 HELO_NODOT 1362 1.23 1.07 1.26 171 HELO_NO_DOMAIN 1361 1.23 1.07 1.26 172 T_FILL_THIS_FORM_SHORT 1354 0.81 1.07 0.76 173 NO_FM_NAME_IP_HOSTN 1352 0.17 1.06 0.00 174 PDS_TO_EQ_FROM_NAME 1327 0.17 1.04 0.00 175 TR_Caps_n_Bayes_99 1312 0.21 1.03 0.05 176 XMSubMetaI_00 1309 0.70 1.03 0.64 177 T_XMDrugObfuBody_00 1308 0.60 1.03 0.52 178 ONE_TIME 1298 0.46 1.02 0.36 179 HK_RANDOM_REPLYTO 1295 0.34 1.02 0.20 180 XMStockSpam_06 1293 1.06 1.02 1.07 181 MIME_CHARSET_FARAWAY 1291 0.24 1.02 0.09 182 MAILING_LIST_MULTI 1284 1.84 1.01 1.99 183 MPART_ALT_DIFF_COUNT 1281 0.47 1.01 0.37 184 DKIM_ADSP_CUSTOM_MED 1267 0.98 1.00 0.98 185 TRACKER_ID 1262 0.26 0.99 0.12 186 URI_NOVOWEL 1222 1.63 0.96 1.76 187 XMGenDplmaNmb 1199 0.93 0.94 0.92 188 RELAYCOUNTRY_RU 1181 0.53 0.93 0.45 189 CHARSET_FARAWAY_HEADER 1166 0.19 0.92 0.05 190 XM_CreditScore_03 1158 0.17 0.91 0.03 191 TM2_M_A_HREF_HREF 1144 0.40 0.90 0.30 192 RELAYCOUNTRY_JP 1140 0.18 0.90 0.04 193 URIBL_BLACK 1129 0.16 0.89 0.02 194 NML_ADSP_CUSTOM_MED 1115 0.71 0.88 0.68 195 TR_XM_SpoofStaff 1104 0.19 0.87 0.06 196 XMBody_78 1087 0.53 0.86 0.47 197 HTML_IMAGE_ONLY_16 1079 0.30 0.85 0.20 198 HTML_FONT_TINY_NORDNS 1077 0.37 0.85 0.28 199 XMSpoofStaff2 1070 0.18 0.84 0.06 200 PLING_QUERY 1062 0.61 0.84 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 648582 97.98 95.47 98.46 2 HTML_MESSAGE 551799 85.50 94.51 83.77 3 RELAYCOUNTRY_US 511522 75.20 62.46 77.65 4 XM_B_Unicode 451523 65.97 52.62 68.54 5 DKIM_SIGNED 426771 63.20 54.95 64.79 6 XM_DK_Pass 419553 62.00 53.25 63.69 7 DKIM_VALID 395665 57.40 43.59 60.06 8 DKIM_VALID_AU 300422 43.29 31.27 45.61 9 XMListUnsubscribeExists 299701 46.00 48.64 45.50 10 BAYES_50 296664 42.66 30.35 45.04 11 XM_B_Unicode3 272271 38.99 26.81 41.33 12 HTML_FONT_LOW_CONTRAST 159868 23.44 19.16 24.27 13 T_TM2_M_HEADER_IN_MSG 158734 23.14 18.20 24.10 14 DKIM_VALID_EF 152998 22.69 19.94 23.23 15 RCVD_IN_MSPIKE_WL 146220 19.49 5.47 22.20 16 LOC_TINY_FONT_1 144994 22.13 22.76 22.01 17 MIME_HTML_ONLY 143118 25.95 47.87 21.73 18 RCVD_IN_MSPIKE_H2 137689 22.97 33.67 20.90 19 XMSubLong 127283 21.46 32.54 19.32 20 FVGT_m_MULTI_ODD 126236 19.50 21.27 19.16 21 ALL_TRUSTED 122238 15.77 1.31 18.56 22 BAYES_00 117969 15.14 0.79 17.91 23 T_KAM_HTML_FONT_INVALID 108121 16.52 17.09 16.41 24 XM_Multi_Part_URI 94535 14.37 14.45 14.35 25 HTML_IMAGE_RATIO_04 88530 11.90 3.93 13.44 26 RCVD_IN_MSPIKE_H3 85134 11.36 3.23 12.92 27 XM_Body_Dirty_Words 78754 12.33 14.27 11.96 28 HTML_FONT_FACE_BAD 71228 9.19 0.78 10.81 29 XM_H_Trusted_IP 70696 9.00 0.01 10.73 30 ANY_BOUNCE_MESSAGE 69668 8.95 0.53 10.58 31 BOUNCE_MESSAGE 69637 8.95 0.52 10.57 32 TM2_M_URI_OPT_OUT 68393 9.12 2.59 10.38 33 XM_DK_Undo_02 66373 14.63 38.23 10.08 34 XM_B_Unsub 59439 8.98 8.73 9.02 35 XM_Evil_Numbers_Gen 55034 8.12 6.89 8.35 36 MPART_ALT_DIFF 54453 7.85 5.72 8.27 37 XMStrtUSub 54115 7.21 2.03 8.22 38 RCVD_IN_MSPIKE_H4 52496 7.02 2.10 7.97 39 BAYES_05 50126 6.49 0.66 7.61 40 LotsOfNums_01 49496 7.43 7.00 7.51 41 TR_XM_DK_Bayes 48264 6.20 0.34 7.33 42 XM_B_Phish_Phrases 46695 7.32 8.49 7.09 43 LOTS_OF_MONEY 46397 7.71 11.19 7.04 44 TR_XM_DK_Bayes1 45007 5.76 0.21 6.83 45 TooManyTo_001 44496 6.38 4.46 6.75 46 RCVD_IN_RP_SAFE 44005 5.67 0.46 6.68 47 MIME_HTML_ONLY_MULTI 42726 5.66 1.39 6.49 48 RCVD_IN_RP_CERTIFIED 41468 5.34 0.37 6.30 49 BAYES_99 40482 10.77 34.72 6.15 50 TR_XM_DK_Bayes2 39982 5.12 0.17 6.07 51 BAYES_20 39719 5.26 1.28 6.03 52 HTML_IMAGE_RATIO_02 38316 8.97 25.33 5.82 53 UNPARSEABLE_RELAY 38266 5.59 4.48 5.81 54 BAYES_60 37820 6.45 10.10 5.74 55 XM_DKIMWhitelistDomains 35743 4.55 0.01 5.43 56 BAYES_40 35212 4.73 1.56 5.35 57 IN_ZIMBRA_NJ_WHITELIST 34652 4.42 0.05 5.26 58 XM_SendGrid 33360 4.78 3.32 5.06 59 RELAYCOUNTRY_META 32585 9.68 34.20 4.95 60 BAYES_999 31660 8.01 24.64 4.81 61 DKIM_INVALID 31106 5.80 11.36 4.72 62 BOTNET_IPINHOSTNAME 31009 6.11 13.39 4.71 63 XM_H_Long_From01 30375 4.68 5.05 4.61 64 MIME_QP_LONG_LINE 30236 4.17 1.99 4.59 65 HTML_IMAGE_RATIO_06 29879 4.34 3.34 4.54 66 RCVD_IN_IADB_LISTED 26347 3.45 0.59 4.00 67 BAYES_80 25128 5.24 12.64 3.81 68 XMSexyCombo_05 24556 4.70 9.73 3.73 69 XM_PDF 24004 3.23 1.10 3.64 70 T_TooManySym_01 23738 3.37 2.14 3.60 71 RCVD_IN_IADB_SPF 23059 3.02 0.52 3.50 72 XMSubNoVowel 22003 3.04 1.47 3.34 73 XMSubMetaSx_00 21944 3.89 6.76 3.33 74 RCVD_IN_IADB_SENDERID 20617 2.71 0.50 3.13 75 TR_XM_PhishingBody 20404 3.41 5.04 3.10 76 BOTNET 20179 8.50 36.68 3.06 77 RCVD_IN_IADB_DK 20145 2.65 0.51 3.06 78 T_REMOTE_IMAGE 19961 7.36 29.79 3.03 79 NO_DNS_FOR_FROM 18921 4.02 9.95 2.87 80 TR_XM_DK_SendGrid 18329 2.53 1.23 2.78 81 XMNumbers 17664 2.83 3.58 2.68 82 XM_UncommonTLD01 17515 5.57 20.66 2.66 83 FROM_EXCESS_BASE64 16974 6.88 29.17 2.58 84 XM_B_Unsub2 16542 2.48 2.32 2.51 85 RCVD_IN_IADB_VOUCHED 15614 2.02 0.20 2.37 86 BAYES_95 15428 3.24 7.90 2.34 87 MIME_HTML_MOSTLY 14546 2.46 3.77 2.21 88 UNTRUSTED_Relay 14371 6.01 25.88 2.18 89 HTML_IMAGE_RATIO_08 14242 2.34 3.23 2.16 90 MAILING_LIST_MULTI 13137 1.84 1.01 1.99 91 HTML_MIME_NO_HTML_TAG 12876 6.56 30.42 1.95 92 XM_B_COVIDMETA 12722 2.33 4.40 1.93 93 T_TooManySym_02 12026 1.62 0.58 1.83 94 TR_Symld_Words 11701 1.73 1.46 1.78 95 URI_NOVOWEL 11562 1.63 0.96 1.76 96 URI_HEX 10893 1.65 1.60 1.65 97 TooManyTo_002 10756 1.47 0.62 1.63 98 T_XMDrugObfuBody_08 10752 1.87 3.08 1.63 99 XMDiploma_00 10589 1.67 1.99 1.61 100 XM_B_Phish66 10580 1.82 2.94 1.61 101 XM_B_SpammyTLD 10521 1.83 3.03 1.60 102 XM_CamelCaseFrm001 10162 1.67 2.36 1.54 103 RCVD_IN_IADB_OPTIN 10111 1.32 0.20 1.53 104 XM_SPF_SoftFail 9825 2.22 6.01 1.49 105 RELAYCOUNTRY_CA 9810 2.58 8.25 1.49 106 TVD_RCVD_IP 9398 1.25 0.30 1.43 107 KHOP_HELO_FCRDNS 9161 2.12 5.92 1.39 108 XM_DK_Undo_01 9073 1.27 0.68 1.38 109 T_XMDrugObfuBody_14 8876 1.35 1.38 1.35 110 RCVD_IN_MSPIKE_H5 8590 1.12 0.14 1.30 111 XMSubGarbage 8405 1.14 0.45 1.28 112 HELO_NODOT 8308 1.23 1.07 1.26 113 HELO_NO_DOMAIN 8303 1.23 1.07 1.26 114 XMSubLongNoVowel 8186 1.15 0.65 1.24 115 URI_TRY_3LD 8181 1.26 1.37 1.24 116 SUBJ_ALL_CAPS 8165 1.43 2.44 1.24 117 CK_HELO_DYNAMIC_SPLIT_IP 7882 1.11 0.65 1.20 118 HELO_MISC_IP 7882 1.09 0.53 1.20 119 RCVD_IN_BL_SPAMCOP_NET 7725 2.52 9.51 1.17 120 XM_OfRef6 7588 1.33 2.23 1.15 121 INVALID_MSGID 7385 0.97 0.20 1.12 122 XM_UB50 7229 2.09 7.26 1.10 123 IN_HORDE_ADDRESS_BOOK 7208 0.95 0.21 1.09 124 XM_GoogleGroups 7147 0.97 0.36 1.08 125 TooManyTo_003 7087 0.98 0.45 1.08 126 XMStockSpam_06 7040 1.06 1.02 1.07 127 XMGappySubj_01 6821 0.90 0.17 1.04 128 XMBody_17 6603 1.46 3.81 1.00 129 TM2_M_VERY_LONG_WORD 6493 1.18 2.16 0.99 130 TO_MALFORMED 6484 0.83 0.01 0.98 131 DKIM_ADSP_CUSTOM_MED 6447 0.98 1.00 0.98 132 XMBdyGiftCard01 6438 0.92 0.65 0.98 133 XMBrknScrpt_02 6089 1.08 1.89 0.92 134 XMGenDplmaNmb 6079 0.93 0.94 0.92 135 XM_H_Long_From02 5930 0.85 0.59 0.90 136 XMCapTrack 5785 0.81 0.47 0.88 137 XM_E_Blogspot 5695 0.74 0.09 0.86 138 USER_IN_DEF_DKIM_WL 5688 0.72 0.00 0.86 139 XMHTML_After_End 5447 0.88 1.17 0.83 140 TooManyTo_004 5259 0.73 0.39 0.80 141 XMSexyCombo_01 5183 0.97 1.91 0.79 142 TR_XM_COVIDMETA4 5041 1.28 3.94 0.77 143 T_FILL_THIS_FORM_SHORT 4991 0.81 1.07 0.76 144 XM_ProductURIs 4937 0.71 0.52 0.75 145 RCVD_IN_MSPIKE_BL 4877 2.33 10.55 0.74 146 RELAYCOUNTRY_GB 4821 1.08 2.90 0.73 147 SpammyFromTLD_01 4811 1.58 5.97 0.73 148 T_TooManySym_03 4668 0.61 0.11 0.71 149 HTTPS_HTTP_MISMATCH 4639 0.71 0.75 0.70 150 TR_MetaPhish_Combo_01 4557 0.70 0.73 0.69 151 T_XMHurry_00 4546 0.76 1.15 0.69 152 NML_ADSP_CUSTOM_MED 4492 0.71 0.88 0.68 153 XM_DIRTYINTL 4407 1.08 3.23 0.67 154 TR_MSPIKEBAYES00 4362 0.56 0.00 0.66 155 TooManyTo_005 4320 0.60 0.31 0.66 156 FROM_GOV_DKIM_AU 4242 0.56 0.11 0.64 157 XMSubMetaI_00 4226 0.70 1.03 0.64 158 XMMoneyMeta_00 4216 0.74 1.25 0.64 159 XMPhish30 4193 0.65 0.75 0.64 160 T_Symld_Words_02 4178 0.62 0.55 0.63 161 T_OBFU_PDF_ATTACH 4144 0.56 0.17 0.63 162 TR_BOTNET_NEGATE 3761 0.55 0.45 0.57 163 PLING_QUERY 3720 0.61 0.84 0.56 164 DKIM_ADSP_NXDOMAIN 3593 1.77 8.13 0.55 165 XM_SPF_Unknown 3469 0.55 0.64 0.53 166 NUMERIC_HTTP_ADDR 3464 0.55 0.66 0.53 167 T_XMDrugObfuBody_00 3442 0.60 1.03 0.52 168 FORGED_GMAIL_RCVD 3320 0.54 0.74 0.50 169 DIET_1 3257 0.63 1.32 0.49 170 TR_XM_COVIDMETA1 3089 0.68 1.75 0.47 171 XMBody_78 3087 0.53 0.86 0.47 172 XMBody_95 3056 0.40 0.05 0.46 173 TR_LOTS_OF_MONEY3 2997 0.62 1.49 0.45 174 XMPhish08 2996 0.49 0.69 0.45 175 XMHTMLBadTable_001 2970 0.43 0.33 0.45 176 RELAYCOUNTRY_RU 2955 0.53 0.93 0.45 177 FROM_GOV_SPOOF 2912 0.40 0.20 0.44 178 XM_B_REG_HTML 2850 0.39 0.20 0.43 179 XM_ShortIntro_01 2785 0.41 0.36 0.42 180 XMSubMetaSxObfu_03 2780 0.47 0.70 0.42 181 XM_B_COPY_HTML 2718 0.40 0.36 0.41 182 THIS_AD 2654 0.41 0.46 0.40 183 T_TooManySym_04 2602 0.33 0.02 0.40 184 XM_H_PHPMailer 2584 0.46 0.80 0.39 185 HTML_IMAGE_ONLY_20 2574 0.59 1.65 0.39 186 HTML_TAG_BALANCE_BODY 2561 0.41 0.54 0.39 187 XMNoVowels 2553 0.40 0.49 0.39 188 RCVD_IN_MSPIKE_L3 2547 0.77 2.77 0.39 189 XMPhish14 2540 0.44 0.75 0.39 190 TR_XM_PHPDW 2529 0.63 1.93 0.38 191 TR_XM_PHPForged 2472 0.63 1.94 0.38 192 XMLngstWrd_00 2471 0.39 0.48 0.38 193 TR_XM_FormFill2 2464 0.62 1.91 0.37 194 XM_H_PHPOS 2431 0.62 1.91 0.37 195 MPART_ALT_DIFF_COUNT 2430 0.47 1.01 0.37 196 RCVD_IN_SORBS_DUL 2369 0.34 0.25 0.36 197 MISSING_HEADERS 2357 0.48 1.12 0.36 198 ONE_TIME 2339 0.46 1.02 0.36 199 XMBSHREFv2 2304 0.33 0.26 0.35 200 HTML_IMAGE_ONLY_28 2279 0.38 0.56 0.35 ----------------------------------------------------------------------