Email: 624721 Autolearn: 0 AvgScore: 0.69 AvgScanTime: 1.82 sec Spam: 95810 Autolearn: 0 AvgScore: 13.09 AvgScanTime: 3.46 sec Ham: 528911 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 1.52 sec Time Spent Running SA: 315.61 hours Time Spent Processing Spam: 92.03 hours Time Spent Processing Ham: 223.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 91922 97.78 95.94 98.12 2 HTML_MESSAGE 88099 88.65 91.95 88.05 3 RELAYCOUNTRY_US 64881 79.43 67.72 81.56 4 DKIM_SIGNED 64173 74.91 66.98 76.34 5 XM_B_Unicode 62514 69.51 65.25 70.28 6 XM_DK_Pass 62252 73.51 64.97 75.06 7 XMListUnsubscribeExists 56927 52.82 59.42 51.63 8 DKIM_VALID 51522 68.20 53.78 70.81 9 XM_DK_Undo_02 42462 16.80 44.32 11.82 10 DKIM_VALID_AU 37887 51.27 39.54 53.40 11 BAYES_99 34585 12.04 36.10 7.68 12 MIME_HTML_ONLY 34162 23.59 35.66 21.40 13 BAYES_50 32904 50.67 34.34 53.63 14 XM_B_Unicode3 32107 38.42 33.51 39.31 15 BOTNET 30276 7.53 31.60 3.17 16 RCVD_IN_MSPIKE_H2 29762 26.41 31.06 25.56 17 RELAYCOUNTRY_META 26590 9.98 27.75 6.76 18 BAYES_999 26048 9.34 27.19 6.10 19 LOC_TINY_FONT_1 25551 25.71 26.67 25.53 20 XMSubLong 23806 23.46 24.85 23.21 21 DKIM_VALID_EF 23538 28.26 24.57 28.92 22 FVGT_m_MULTI_ODD 22780 22.23 23.78 21.95 23 UNTRUSTED_Relay 22677 6.17 23.67 2.99 24 T_TM2_M_HEADER_IN_MSG 22105 29.39 23.07 30.54 25 HTML_FONT_LOW_CONTRAST 21351 27.22 22.28 28.11 26 T_KAM_HTML_FONT_INVALID 17676 18.75 18.45 18.80 27 XM_UncommonTLD01 15634 5.26 16.32 3.25 28 RCVD_IN_PSBL 15467 2.50 16.14 0.03 29 XM_Body_Dirty_Words 15429 13.65 16.10 13.21 30 XM_Multi_Part_URI 15005 12.69 15.66 12.16 31 BOTNET_IPINHOSTNAME 14435 6.68 15.07 5.16 32 HTML_IMAGE_RATIO_02 14399 8.34 15.03 7.13 33 FROM_EXCESS_BASE64 13132 4.09 13.71 2.34 34 T_REMOTE_IMAGE 12943 4.99 13.51 3.45 35 DKIM_INVALID 12651 6.71 13.20 5.53 36 HTML_MIME_NO_HTML_TAG 12538 3.79 13.09 2.11 37 LOTS_OF_MONEY 12538 9.20 13.09 8.50 38 RCVD_IN_MSPIKE_BL 11553 2.86 12.06 1.19 39 XM_B_Phish_Phrases 10776 7.90 11.25 7.29 40 RCVD_IN_BL_SPAMCOP_NET 10753 2.92 11.22 1.41 41 NO_DNS_FOR_FROM 10644 4.18 11.11 2.92 42 HTML_IMAGE_ONLY_16 10518 1.95 10.98 0.31 43 BAYES_80 10406 5.49 10.86 4.52 44 BOTNET_NORDNS 10022 1.62 10.46 0.02 45 XM_B_Unsub 9740 10.23 10.17 10.24 46 XM_SPF_SoftFail 9645 3.26 10.07 2.02 47 XMSexyCombo_05 8746 4.91 9.13 4.15 48 HTML_SHORT_LINK_IMG_2 8448 1.41 8.82 0.06 49 RCVD_IN_RP_RNBL 8118 1.43 8.47 0.16 50 BAYES_60 8069 6.95 8.42 6.69 51 XM_Evil_Numbers_Gen 7626 8.56 7.96 8.67 52 LotsOfNums_01 7485 8.16 7.81 8.22 53 SpammyFromTLD_01 6999 1.91 7.31 0.94 54 XMStrtUSub 6992 4.70 7.30 4.23 55 RCVD_IN_MSPIKE_L5 6939 1.41 7.24 0.35 56 RCVD_IN_MSPIKE_WL 6629 22.96 6.92 25.87 57 XM_UB50 6543 2.36 6.83 1.55 58 XM_UB99 6253 1.01 6.53 0.01 59 TR_XM_PhishingBody 6091 3.63 6.36 3.13 60 UNPARSEABLE_RELAY 6082 7.65 6.35 7.88 61 XMNumbers 6036 4.34 6.30 3.98 62 RELAYCOUNTRY_CA 5926 2.66 6.19 2.02 63 XMSubMetaSx_00 5825 3.98 6.08 3.61 64 TooManyTo_001 5551 8.14 5.79 8.56 65 XM_H_Long_From01 5503 5.49 5.74 5.44 66 MPART_ALT_DIFF 5264 5.20 5.49 5.14 67 XM_B_COVIDMETA 5163 2.30 5.39 1.74 68 XM_Combo_Sbj 5073 1.09 5.29 0.33 69 BAYES_95 5038 3.19 5.26 2.81 70 SpammyFromTLD_02 4874 1.04 5.09 0.30 71 XM_SendGrid 4864 6.83 5.08 7.15 72 PLING_QUERY 4747 1.18 4.95 0.50 73 XM_UB999 4499 0.72 4.70 0.01 74 RELAYCOUNTRY_RU 4428 1.31 4.62 0.71 75 LOCALPART_IN_SUBJECT 4137 0.69 4.32 0.03 76 TR_XM_COVIDMETA4 4111 1.27 4.29 0.73 77 RCVD_IN_MSPIKE_L3 4037 1.29 4.21 0.76 78 HTML_IMAGE_RATIO_04 4031 5.32 4.21 5.52 79 IMG_ONLY_FM_DOM_INFO 3903 0.63 4.07 0.00 80 T_XMDrugObfuBody_08 3874 2.63 4.04 2.37 81 XM_B_Phish66 3869 2.22 4.04 1.89 82 TR_XM_INV_DKIM 3847 0.78 4.02 0.19 83 XMBody_17 3808 1.55 3.97 1.11 84 FROM_SUSPICIOUS_NTLD 3772 0.64 3.94 0.04 85 XM_UB80 3752 0.65 3.92 0.06 86 FROM_SUSPICIOUS_NTLD_FP 3695 0.62 3.86 0.03 87 DKIM_ADSP_NXDOMAIN 3587 1.05 3.74 0.57 88 RCVD_IN_MSPIKE_H3 3586 13.01 3.74 14.68 89 XM_DIRTYINTL 3499 1.11 3.65 0.65 90 MIME_HTML_MOSTLY 3399 2.60 3.55 2.43 91 XM_OfRef6 3368 1.78 3.52 1.47 92 XM_B_SpammyTLD 3353 2.23 3.50 2.00 93 TR_XM_UnparsRelay 3336 0.97 3.48 0.52 94 URIBL_SBL_A 3246 0.77 3.39 0.30 95 TM2_M_URI_OPT_OUT 3182 3.28 3.32 3.27 96 BODY_URI_ONLY 3140 0.54 3.28 0.05 97 TR_XM_MaxWHORU 2909 0.52 3.04 0.06 98 HTML_TAG_BALANCE_CENTER 2891 0.57 3.02 0.12 99 HTML_IMAGE_RATIO_06 2888 3.62 3.01 3.73 100 RCVD_IN_MSPIKE_H4 2863 8.55 2.99 9.56 101 HDRS_MISSP 2824 0.51 2.95 0.06 102 XM_UB60 2814 0.66 2.94 0.24 103 HTML_IMAGE_RATIO_08 2747 2.71 2.87 2.68 104 TR_XM_MaxBayes 2619 0.46 2.73 0.05 105 XM_URI_RBL 2609 0.62 2.72 0.24 106 TR_LOTS_OF_MONEY3 2606 1.19 2.72 0.91 107 XMDiploma_00 2602 2.55 2.72 2.52 108 XMHTML_After_End 2541 1.44 2.65 1.22 109 XMBrknScrpt_02 2502 1.39 2.61 1.17 110 KHOP_HELO_FCRDNS 2477 2.03 2.59 1.93 111 SUBJ_ALL_CAPS 2462 1.67 2.57 1.51 112 XM_CamelCaseFrm001 2433 2.00 2.54 1.90 113 HK_RANDOM_FROM 2385 0.51 2.49 0.15 114 TR_XM_COVIDMETA1 2317 0.67 2.42 0.35 115 XMGppyBdWords 2267 0.61 2.37 0.30 116 TR_XM_PHPForged 2188 0.77 2.28 0.50 117 XMSexyCombo_01 2185 0.88 2.28 0.63 118 TR_XM_PHPDW 2160 0.78 2.25 0.52 119 TR_XM_FormFill2 2133 0.76 2.23 0.50 120 XM_H_PHPOS 2124 0.76 2.22 0.49 121 HTML_IMAGE_ONLY_24 2096 0.62 2.19 0.34 122 TO_NAME_SUBJ_NO_RDNS 2077 0.33 2.17 0.00 123 DATE_IN_PAST_03_06 2040 0.44 2.13 0.13 124 TR_Symld_Words 2035 2.18 2.12 2.19 125 TR_XM_MaxSPIKE 2035 0.38 2.12 0.06 126 MIME_QP_LONG_LINE 2013 4.58 2.10 5.03 127 T_TooManySym_01 1975 4.98 2.06 5.51 128 ALL_TRUSTED 1962 11.68 2.05 13.42 129 BAYES_40 1934 4.51 2.02 4.96 130 XM_B_Unsub2 1916 2.32 2.00 2.38 131 XM_UB95 1900 0.33 1.98 0.02 132 MIME_HTML_ONLY_MULTI 1845 3.05 1.93 3.26 133 TR_XM_RelayPhish 1839 0.46 1.92 0.20 134 TR_XM_DK_SendGrid 1833 3.49 1.91 3.77 135 URI_HEX 1752 1.75 1.83 1.74 136 RELAYCOUNTRY_FR 1744 0.60 1.82 0.38 137 T_XMDrugObfuBody_14 1727 1.82 1.80 1.82 138 XMSubNoVowel 1725 1.22 1.80 1.11 139 T_FILL_THIS_FORM_SHORT 1669 1.22 1.74 1.12 140 MISSING_HEADERS 1667 0.75 1.74 0.58 141 XMMoneyMeta_00 1637 0.76 1.71 0.59 142 URI_TRY_3LD 1617 1.32 1.69 1.25 143 XMGenDplmaNmb 1570 1.16 1.64 1.07 144 XM_H_Long_From02 1556 1.09 1.62 0.99 145 FROM_MISSP_REPLYTO 1529 0.25 1.60 0.01 146 RDNS_DYNAMIC 1505 0.54 1.57 0.35 147 DATE_IN_PAST_06_12 1488 0.32 1.55 0.10 148 REPLYTO_WITHOUT_TO_CC 1480 0.37 1.54 0.16 149 T_XMHurry_00 1450 0.94 1.51 0.83 150 DKIM_ADSP_CUSTOM_MED 1443 1.17 1.51 1.11 151 TM2_M_VERY_LONG_WORD 1440 1.25 1.50 1.20 152 T_XMDrugObfuBody_00 1418 0.85 1.48 0.73 153 XMStockSpam_06 1412 1.28 1.47 1.25 154 XMSubject_38 1411 0.23 1.47 0.01 155 RELAYCOUNTRY_GB 1376 0.98 1.44 0.90 156 RELAYCOUNTRY_CN 1374 0.28 1.43 0.08 157 RELAYCOUNTRY_NL 1372 0.57 1.43 0.41 158 BAYES_20 1356 3.28 1.42 3.62 159 NML_ADSP_CUSTOM_MED 1324 0.89 1.38 0.80 160 XMBody_78 1312 0.61 1.37 0.47 161 TR_LOTS_OF_MONEY1 1265 0.22 1.32 0.02 162 URI_PHP_REDIR 1244 0.22 1.30 0.02 163 RELAYCOUNTRY_SG 1236 0.26 1.29 0.08 164 XMSexyCombo_04 1232 0.33 1.29 0.16 165 XM_PDF 1220 3.59 1.27 4.01 166 MAILING_LIST_MULTI 1199 2.39 1.25 2.60 167 MPART_ALT_DIFF_COUNT 1156 0.47 1.21 0.34 168 MIME_CHARSET_FARAWAY 1150 0.28 1.20 0.11 169 XM_JunkDunk 1149 0.18 1.20 0.00 170 URI_NOVOWEL 1144 1.98 1.19 2.12 171 PDS_OTHER_BAD_TLD 1144 0.54 1.19 0.42 172 HK_SCAM 1140 0.20 1.19 0.02 173 FROM_MISSP_EH_MATCH 1139 0.19 1.19 0.01 174 DIET_1 1100 0.59 1.15 0.49 175 DEAR_SOMETHING 1091 0.28 1.14 0.13 176 CHARSET_FARAWAY_HEADER 1085 0.22 1.13 0.05 177 TR_MetaPhish_Combo_01 1050 0.93 1.10 0.90 178 REMOVE_BEFORE_LINK 1048 0.40 1.09 0.28 179 TooManyTo_002 1015 2.00 1.06 2.17 180 XMSubMetaI_00 1010 0.87 1.05 0.83 181 HTML_FONT_TINY_NORDNS 995 0.42 1.04 0.30 182 RELAYCOUNTRY_HK 993 0.24 1.04 0.10 183 FVGT_m_MULTI_ODD_EMAIL 991 0.18 1.03 0.03 184 TR_Mismatch_TLD_02 989 0.31 1.03 0.18 185 FROM_MISSPACED 987 0.16 1.03 0.01 186 TR_Mismatch_TLD_01 980 0.36 1.02 0.24 187 FORGED_GMAIL_RCVD 971 0.58 1.01 0.51 188 FROM_LOCAL_NOVOWEL 970 0.18 1.01 0.03 189 XMOemUri 967 0.48 1.01 0.38 190 MONEY_FROM_MISSP 956 0.16 1.00 0.00 191 XM_BadFromFormat 951 0.28 0.99 0.15 192 FROM_MISSP_MSFT 941 0.15 0.98 0.00 193 HELO_NODOT 939 1.61 0.98 1.72 194 TO_NO_BRKTS_FROM_MSSP 937 0.16 0.98 0.01 195 HELO_NO_DOMAIN 935 1.61 0.98 1.72 196 FSL_CTYPE_WIN1251 935 0.15 0.98 0.00 197 XM_ShortIntro_01 931 0.69 0.97 0.64 198 HK_RANDOM_REPLYTO 919 0.34 0.96 0.23 199 RELAYCOUNTRY_JP 913 0.17 0.95 0.03 200 RELAYCOUNTRY_AT 899 0.33 0.94 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 518946 97.78 95.94 98.12 2 HTML_MESSAGE 465688 88.65 91.95 88.05 3 RELAYCOUNTRY_US 431361 79.43 67.72 81.56 4 DKIM_SIGNED 403789 74.91 66.98 76.34 5 XM_DK_Pass 397008 73.51 64.97 75.06 6 DKIM_VALID 374541 68.20 53.78 70.81 7 XM_B_Unicode 371710 69.51 65.25 70.28 8 BAYES_50 283656 50.67 34.34 53.63 9 DKIM_VALID_AU 282424 51.27 39.54 53.40 10 XMListUnsubscribeExists 273073 52.82 59.42 51.63 11 XM_B_Unicode3 207898 38.42 33.51 39.31 12 T_TM2_M_HEADER_IN_MSG 161518 29.39 23.07 30.54 13 DKIM_VALID_EF 152987 28.26 24.57 28.92 14 HTML_FONT_LOW_CONTRAST 148695 27.22 22.28 28.11 15 RCVD_IN_MSPIKE_WL 136835 22.96 6.92 25.87 16 RCVD_IN_MSPIKE_H2 135199 26.41 31.06 25.56 17 LOC_TINY_FONT_1 135039 25.71 26.67 25.53 18 XMSubLong 122745 23.46 24.85 23.21 19 FVGT_m_MULTI_ODD 116070 22.23 23.78 21.95 20 MIME_HTML_ONLY 113208 23.59 35.66 21.40 21 T_KAM_HTML_FONT_INVALID 99435 18.75 18.45 18.80 22 RCVD_IN_MSPIKE_H3 77659 13.01 3.74 14.68 23 BAYES_00 73044 11.81 0.80 13.81 24 ALL_TRUSTED 70981 11.68 2.05 13.42 25 XM_Body_Dirty_Words 69858 13.65 16.10 13.21 26 XM_Multi_Part_URI 64292 12.69 15.66 12.16 27 XM_DK_Undo_02 62499 16.80 44.32 11.82 28 XM_B_Unsub 54186 10.23 10.17 10.24 29 RCVD_IN_MSPIKE_H4 50557 8.55 2.99 9.56 30 XM_Evil_Numbers_Gen 45841 8.56 7.96 8.67 31 TooManyTo_001 45282 8.14 5.79 8.56 32 LOTS_OF_MONEY 44962 9.20 13.09 8.50 33 LotsOfNums_01 43463 8.16 7.81 8.22 34 TR_XM_DK_Bayes 43110 6.96 0.41 8.15 35 UNPARSEABLE_RELAY 41699 7.65 6.35 7.88 36 BAYES_99 40631 12.04 36.10 7.68 37 TR_XM_DK_Bayes1 40248 6.48 0.25 7.61 38 XM_B_Phish_Phrases 38584 7.90 11.25 7.29 39 XM_DKIMWhitelistDomains 37877 6.06 0.01 7.16 40 XM_SendGrid 37798 6.83 5.08 7.15 41 HTML_IMAGE_RATIO_02 37703 8.34 15.03 7.13 42 RCVD_IN_RP_SAFE 37458 6.06 0.41 7.08 43 RELAYCOUNTRY_META 35764 9.98 27.75 6.76 44 BAYES_60 35377 6.95 8.42 6.69 45 TR_XM_DK_Bayes2 35296 5.69 0.23 6.67 46 RCVD_IN_RP_CERTIFIED 33906 5.45 0.18 6.41 47 BAYES_999 32270 9.34 27.19 6.10 48 IN_ZIMBRA_NJ_WHITELIST 30283 4.85 0.02 5.73 49 DKIM_INVALID 29248 6.71 13.20 5.53 50 HTML_IMAGE_RATIO_04 29221 5.32 4.21 5.52 51 T_TooManySym_01 29162 4.98 2.06 5.51 52 XM_H_Long_From01 28794 5.49 5.74 5.44 53 BOTNET_IPINHOSTNAME 27283 6.68 15.07 5.16 54 MPART_ALT_DIFF 27192 5.20 5.49 5.14 55 MIME_QP_LONG_LINE 26588 4.58 2.10 5.03 56 BAYES_40 26257 4.51 2.02 4.96 57 BAYES_80 23903 5.49 10.86 4.52 58 RCVD_IN_IADB_LISTED 23269 3.82 0.64 4.40 59 XMStrtUSub 22362 4.70 7.30 4.23 60 XMSexyCombo_05 21950 4.91 9.13 4.15 61 XM_PDF 21215 3.59 1.27 4.01 62 XMNumbers 21059 4.34 6.30 3.98 63 RCVD_IN_IADB_SPF 20349 3.34 0.56 3.85 64 TR_XM_DK_SendGrid 19942 3.49 1.91 3.77 65 HTML_IMAGE_RATIO_06 19743 3.62 3.01 3.73 66 BAYES_20 19135 3.28 1.42 3.62 67 XMSubMetaSx_00 19070 3.98 6.08 3.61 68 T_REMOTE_IMAGE 18256 4.99 13.51 3.45 69 RCVD_IN_IADB_SENDERID 18226 3.00 0.54 3.45 70 RCVD_IN_IADB_DK 17754 2.93 0.55 3.36 71 TM2_M_URI_OPT_OUT 17313 3.28 3.32 3.27 72 MIME_HTML_ONLY_MULTI 17235 3.05 1.93 3.26 73 XM_UncommonTLD01 17215 5.26 16.32 3.25 74 BOTNET 16782 7.53 31.60 3.17 75 TR_XM_PhishingBody 16566 3.63 6.36 3.13 76 BOUNCE_MESSAGE 16438 2.74 0.69 3.11 77 ANY_BOUNCE_MESSAGE 16438 2.74 0.69 3.11 78 T_TooManySym_02 16414 2.72 0.58 3.10 79 UNTRUSTED_Relay 15838 6.17 23.67 2.99 80 NO_DNS_FOR_FROM 15441 4.18 11.11 2.92 81 BAYES_95 14868 3.19 5.26 2.81 82 XM_H_Trusted_IP 14689 2.35 0.00 2.78 83 HTML_IMAGE_RATIO_08 14176 2.71 2.87 2.68 84 RCVD_IN_IADB_VOUCHED 14084 2.29 0.20 2.66 85 MAILING_LIST_MULTI 13750 2.39 1.25 2.60 86 XMDiploma_00 13330 2.55 2.72 2.52 87 MIME_HTML_MOSTLY 12850 2.60 3.55 2.43 88 XM_B_Unsub2 12597 2.32 2.00 2.38 89 T_XMDrugObfuBody_08 12558 2.63 4.04 2.37 90 FROM_EXCESS_BASE64 12399 4.09 13.71 2.34 91 BAYES_05 12023 2.05 0.79 2.27 92 TR_Symld_Words 11575 2.18 2.12 2.19 93 TooManyTo_002 11457 2.00 1.06 2.17 94 URI_NOVOWEL 11219 1.98 1.19 2.12 95 HTML_MIME_NO_HTML_TAG 11134 3.79 13.09 2.11 96 XM_SPF_SoftFail 10695 3.26 10.07 2.02 97 RELAYCOUNTRY_CA 10694 2.66 6.19 2.02 98 XM_B_SpammyTLD 10582 2.23 3.50 2.00 99 TVD_RCVD_IP 10293 1.72 0.47 1.95 100 KHOP_HELO_FCRDNS 10193 2.03 2.59 1.93 101 XM_CamelCaseFrm001 10062 2.00 2.54 1.90 102 XM_B_Phish66 9990 2.22 4.04 1.89 103 T_XMDrugObfuBody_14 9635 1.82 1.80 1.82 104 RCVD_IN_IADB_OPTIN 9492 1.55 0.23 1.79 105 XM_B_COVIDMETA 9229 2.30 5.39 1.74 106 URI_HEX 9208 1.75 1.83 1.74 107 HELO_NODOT 9106 1.61 0.98 1.72 108 HELO_NO_DOMAIN 9104 1.61 0.98 1.72 109 XM_DK_Undo_01 8898 1.55 0.85 1.68 110 RCVD_IN_MSPIKE_H5 8619 1.41 0.19 1.63 111 XM_UB50 8172 2.36 6.83 1.55 112 SUBJ_ALL_CAPS 7991 1.67 2.57 1.51 113 HELO_MISC_IP 7837 1.35 0.60 1.48 114 INVALID_MSGID 7811 1.29 0.28 1.48 115 CK_HELO_DYNAMIC_SPLIT_IP 7801 1.34 0.61 1.47 116 XM_OfRef6 7753 1.78 3.52 1.47 117 RCVD_IN_BL_SPAMCOP_NET 7481 2.92 11.22 1.41 118 TooManyTo_003 7450 1.31 0.79 1.41 119 XM_GoogleGroups 7185 1.22 0.47 1.36 120 IN_HORDE_ADDRESS_BOOK 7155 1.15 0.03 1.35 121 URI_TRY_3LD 6624 1.32 1.69 1.25 122 XMStockSpam_06 6615 1.28 1.47 1.25 123 TO_MALFORMED 6511 1.05 0.02 1.23 124 XMHTML_After_End 6440 1.44 2.65 1.22 125 TM2_M_VERY_LONG_WORD 6364 1.25 1.50 1.20 126 USER_IN_DEF_DKIM_WL 6337 1.02 0.01 1.20 127 XMCapTrack 6315 1.12 0.69 1.19 128 RCVD_IN_MSPIKE_BL 6305 2.86 12.06 1.19 129 XMGappySubj_01 6258 1.04 0.27 1.18 130 XMBrknScrpt_02 6171 1.39 2.61 1.17 131 T_FILL_THIS_FORM_SHORT 5922 1.22 1.74 1.12 132 XMSubNoVowel 5896 1.22 1.80 1.11 133 DKIM_ADSP_CUSTOM_MED 5889 1.17 1.51 1.11 134 XMBody_17 5879 1.55 3.97 1.11 135 HTML_FONT_FACE_BAD 5778 1.03 0.72 1.09 136 XMGenDplmaNmb 5668 1.16 1.64 1.07 137 TooManyTo_004 5525 0.99 0.67 1.04 138 XM_ProductURIs 5470 1.00 0.79 1.03 139 XM_H_Long_From02 5237 1.09 1.62 0.99 140 T_TooManySym_03 5101 0.84 0.14 0.96 141 SpammyFromTLD_01 4947 1.91 7.31 0.94 142 TR_LOTS_OF_MONEY3 4811 1.19 2.72 0.91 143 TR_MetaPhish_Combo_01 4769 0.93 1.10 0.90 144 RELAYCOUNTRY_GB 4767 0.98 1.44 0.90 145 TooManyTo_005 4617 0.82 0.51 0.87 146 XMSubMetaI_00 4409 0.87 1.05 0.83 147 T_XMHurry_00 4397 0.94 1.51 0.83 148 XMNoVowels 4330 0.76 0.47 0.82 149 XMBdyGiftCard01 4329 0.81 0.74 0.82 150 NML_ADSP_CUSTOM_MED 4240 0.89 1.38 0.80 151 XMBody_95 4055 0.66 0.06 0.77 152 RCVD_IN_MSPIKE_L3 4012 1.29 4.21 0.76 153 HTTPS_HTTP_MISMATCH 3912 0.74 0.73 0.74 154 XM_SPF_Unknown 3888 0.72 0.63 0.74 155 T_XMDrugObfuBody_00 3874 0.85 1.48 0.73 156 TR_XM_COVIDMETA4 3854 1.27 4.29 0.73 157 RELAYCOUNTRY_RU 3777 1.31 4.62 0.71 158 T_Symld_Words_02 3713 0.73 0.85 0.70 159 XM_RXBody 3693 0.65 0.37 0.70 160 XM_E_Blogspot 3624 0.59 0.09 0.69 161 TR_MSPIKEBAYES00 3619 0.58 0.00 0.68 162 XM_DIRTYINTL 3452 1.11 3.65 0.65 163 TR_BOTNET_NEGATE 3410 0.59 0.27 0.64 164 XM_ShortIntro_01 3383 0.69 0.97 0.64 165 T_OBFU_PDF_ATTACH 3371 0.57 0.18 0.64 166 XMSexyCombo_01 3335 0.88 2.28 0.63 167 XMMoneyMeta_00 3132 0.76 1.71 0.59 168 MISSING_HEADERS 3044 0.75 1.74 0.58 169 XMHTMLBadTable_001 3035 0.59 0.71 0.57 170 DKIM_ADSP_NXDOMAIN 2994 1.05 3.74 0.57 171 XM_H_PHPMailer 2871 0.58 0.79 0.54 172 HTML_IMAGE_ONLY_20 2870 0.57 0.69 0.54 173 T_TooManySym_04 2800 0.45 0.03 0.53 174 RELAYCOUNTRY_DE 2760 0.52 0.51 0.52 175 TR_XM_PHPDW 2725 0.78 2.25 0.52 176 TR_XM_UnparsRelay 2724 0.97 3.48 0.52 177 NUMERIC_HTTP_ADDR 2700 0.49 0.37 0.51 178 FORGED_GMAIL_RCVD 2679 0.58 1.01 0.51 179 TR_XM_PHPForged 2643 0.77 2.28 0.50 180 RCVD_IN_SORBS_DUL 2640 0.47 0.28 0.50 181 TR_XM_FormFill2 2626 0.76 2.23 0.50 182 PLING_QUERY 2619 1.18 4.95 0.50 183 TM2_M_BODY_EMPTY 2595 0.43 0.10 0.49 184 XM_H_PHPOS 2595 0.76 2.22 0.49 185 DIET_1 2581 0.59 1.15 0.49 186 FROM_GOV_SPOOF 2566 0.44 0.20 0.49 187 XM_B_REG_HTML 2534 0.45 0.28 0.48 188 XMBody_78 2491 0.61 1.37 0.47 189 XMBSHREFv2 2447 0.44 0.29 0.46 190 HTML_IMAGE_ONLY_32 2399 0.41 0.15 0.45 191 FROM_GOV_DKIM_AU 2383 0.39 0.06 0.45 192 XMPhish08 2376 0.49 0.74 0.45 193 HTML_TAG_BALANCE_BODY 2328 0.47 0.61 0.44 194 BASE64_LENGTH_79_INF 2314 0.49 0.81 0.44 195 TM2_M_A_HREF_HREF 2303 0.47 0.64 0.44 196 XM_S_SubURI 2302 0.37 0.04 0.44 197 HTML_IMAGE_ONLY_28 2219 0.42 0.45 0.42 198 PDS_OTHER_BAD_TLD 2215 0.54 1.19 0.42 199 SHORT_HELO_AND_INLINE_IMAGE 2192 0.37 0.11 0.41 200 RELAYCOUNTRY_NL 2189 0.57 1.43 0.41 ----------------------------------------------------------------------