Email: 656619 Autolearn: 0 AvgScore: 0.76 AvgScanTime: 1.68 sec Spam: 96429 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 2.45 sec Ham: 560190 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.55 sec Time Spent Running SA: 307.07 hours Time Spent Processing Spam: 65.62 hours Time Spent Processing Ham: 241.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 93596 98.02 97.06 98.18 2 HTML_MESSAGE 88727 89.93 92.01 89.57 3 DKIM_SIGNED 71200 77.92 73.84 78.63 4 XM_DK_Pass 69166 76.53 71.73 77.36 5 XM_B_Unicode 66634 72.31 69.10 72.86 6 XMListUnsubscribeExists 65562 57.40 67.99 55.57 7 RELAYCOUNTRY_US 64355 80.93 66.74 83.37 8 DKIM_VALID 60815 71.58 63.07 73.05 9 XM_DK_Undo_02 48569 18.07 50.37 12.51 10 DKIM_VALID_AU 45127 53.80 46.80 55.01 11 BAYES_99 42633 13.58 44.21 8.30 12 BAYES_999 33711 10.68 34.96 6.50 13 XM_B_Unicode3 31676 40.81 32.85 42.18 14 BAYES_50 31497 49.85 32.66 52.80 15 LOC_TINY_FONT_1 31495 26.94 32.66 25.95 16 MIME_HTML_ONLY 28258 22.84 29.30 21.73 17 FVGT_m_MULTI_ODD 27869 24.47 28.90 23.71 18 DKIM_VALID_EF 27259 27.68 28.27 27.57 19 RELAYCOUNTRY_META 26296 9.29 27.27 6.20 20 RCVD_IN_MSPIKE_H2 25876 25.60 26.83 25.39 21 T_TM2_M_HEADER_IN_MSG 25787 28.66 26.74 28.99 22 BOTNET 25406 6.26 26.35 2.80 23 T_KAM_HTML_FONT_INVALID 23955 20.63 24.84 19.91 24 UNTRUSTED_Relay 23794 6.10 24.68 2.90 25 HTML_FONT_LOW_CONTRAST 23672 28.00 24.55 28.59 26 XM_UncommonTLD01 22118 6.03 22.94 3.12 27 LOTS_OF_MONEY 21788 11.70 22.59 9.83 28 XM_Multi_Part_URI 21281 13.79 22.07 12.37 29 XMSubLong 20257 22.31 21.01 22.54 30 XM_Body_Dirty_Words 19137 14.93 19.85 14.09 31 BOTNET_IPINHOSTNAME 14164 6.80 14.69 5.45 32 RCVD_IN_MSPIKE_BL 14155 3.09 14.68 1.10 33 RCVD_IN_BL_SPAMCOP_NET 13245 3.64 13.74 1.90 34 XM_B_Unsub 12639 11.54 13.11 11.27 35 XMSexyCombo_05 12225 5.46 12.68 4.22 36 XM_B_Phish_Phrases 11728 8.67 12.16 8.07 37 TR_XM_PhishingBody 10512 4.72 10.90 3.66 38 MPART_ALT_DIFF 10463 5.91 10.85 5.06 39 DKIM_INVALID 10385 6.34 10.77 5.58 40 XM_SPF_SoftFail 9596 3.09 9.95 1.91 41 SpammyFromTLD_01 9292 2.20 9.64 0.92 42 RCVD_IN_MSPIKE_WL 9280 25.72 9.62 28.49 43 RCVD_IN_RP_RNBL 9253 1.48 9.60 0.09 44 XM_UB99 9107 1.39 9.44 0.01 45 RCVD_IN_MSPIKE_L5 8852 1.62 9.18 0.31 46 LotsOfNums_01 8688 9.14 9.01 9.16 47 XM_UB50 8447 2.87 8.76 1.85 48 XM_B_Phish66 8175 3.09 8.48 2.16 49 SpammyFromTLD_02 8021 1.50 8.32 0.33 50 RCVD_IN_PSBL 7995 1.23 8.29 0.02 51 UNPARSEABLE_RELAY 7770 8.12 8.06 8.13 52 XM_Evil_Numbers_Gen 7654 8.63 7.94 8.75 53 HTML_IMAGE_RATIO_02 7617 7.66 7.90 7.62 54 XM_UB999 7449 1.14 7.72 0.00 55 BAYES_80 7150 5.52 7.41 5.19 56 BOTNET_NORDNS 7090 1.10 7.35 0.02 57 MIME_HTML_MOSTLY 7065 2.98 7.33 2.23 58 XMBrknScrpt_02 7055 2.25 7.32 1.38 59 RELAYCOUNTRY_CA 6899 2.57 7.15 1.78 60 XMSubMetaSx_00 6673 4.28 6.92 3.82 61 XMBody_17 6611 2.19 6.86 1.39 62 HTML_MIME_NO_HTML_TAG 6493 3.11 6.73 2.48 63 XM_B_SEO 6030 1.10 6.25 0.21 64 FROM_EXCESS_BASE64 5997 3.35 6.22 2.86 65 T_REMOTE_IMAGE 5984 3.70 6.21 3.27 66 NO_DNS_FOR_FROM 5936 2.99 6.16 2.44 67 FROM_SUSPICIOUS_NTLD 5851 0.96 6.07 0.08 68 RCVD_IN_MSPIKE_H3 5843 14.67 6.06 16.16 69 FROM_SUSPICIOUS_NTLD_FP 5802 0.94 6.02 0.07 70 XM_H_Long_From01 5748 5.40 5.96 5.31 71 BAYES_60 5665 7.21 5.87 7.44 72 HTML_IMAGE_ONLY_28 5599 1.22 5.81 0.43 73 IMG_ONLY_FM_DOM_INFO 5433 0.83 5.63 0.00 74 T_XMDrugObfuBody_08 5424 2.19 5.62 1.59 75 TooManyTo_001 5366 7.52 5.56 7.86 76 XM_DIRTYINTL 5231 1.30 5.42 0.59 77 TR_XM_SEO4 5206 0.80 5.40 0.00 78 TR_LOTS_OF_MONEY3 4878 1.89 5.06 1.35 79 XM_B_COVIDMETA 4852 2.10 5.03 1.60 80 RCVD_IN_MSPIKE_L3 4658 1.33 4.83 0.73 81 BAYES_95 4568 3.35 4.74 3.11 82 RELAYCOUNTRY_FR 4550 0.94 4.72 0.29 83 DKIM_ADSP_NXDOMAIN 4541 1.14 4.71 0.53 84 URIBL_SBL_A 4527 0.92 4.69 0.28 85 T_HTML_TAG_BALANCE_CENTER 4495 0.83 4.66 0.17 86 XM_B_Unsub2 4412 3.03 4.58 2.77 87 BODY_URI_ONLY 4377 0.72 4.54 0.07 88 HDRS_MISSP 4266 0.70 4.42 0.06 89 TR_XM_MaxBayes 4203 0.68 4.36 0.04 90 XM_SendGrid 4027 6.75 4.18 7.19 91 TR_XM_COVIDMETA4 3805 1.26 3.95 0.79 92 URI_PHP_REDIR 3771 0.63 3.91 0.06 93 XM_OfRef6 3698 1.79 3.83 1.44 94 TR_XM_INV_DKIM 3656 0.77 3.79 0.25 95 XMDiploma_00 3564 1.93 3.70 1.63 96 HTML_IMAGE_RATIO_04 3480 5.59 3.61 5.93 97 HTML_IMAGE_RATIO_06 3418 3.53 3.54 3.53 98 XM_B_SpammyTLD 3362 2.50 3.49 2.33 99 TR_XM_UnparsRelay 3195 1.04 3.31 0.65 100 RCVD_IN_MSPIKE_H4 3184 9.52 3.30 10.59 101 XM_URI_RBL 3167 0.72 3.28 0.28 102 HTML_IMAGE_RATIO_08 3142 2.87 3.26 2.80 103 XMStrtUSub 3097 3.69 3.21 3.77 104 ANY_BOUNCE_MESSAGE 2997 2.80 3.11 2.75 105 BOUNCE_MESSAGE 2997 2.80 3.11 2.75 106 XMNumbers 2950 3.38 3.06 3.43 107 TM2_M_URI_OPT_OUT 2940 3.54 3.05 3.63 108 URI_TRY_3LD 2808 1.71 2.91 1.50 109 TR_XM_COVIDMETA1 2776 0.80 2.88 0.44 110 TR_XM_MaxSPIKE 2775 0.49 2.88 0.08 111 XMBounce_01 2741 0.58 2.84 0.19 112 SUBJ_ALL_CAPS 2705 1.75 2.81 1.57 113 XMHTML_After_End 2703 1.50 2.80 1.28 114 LONG_JUNK_URI2 2700 0.57 2.80 0.19 115 XMLngstWrd_00 2669 0.81 2.77 0.47 116 XM_JunkDunk 2664 0.41 2.76 0.00 117 LONG_JUNK_URI3 2565 0.56 2.66 0.19 118 DATE_IN_PAST_03_06 2511 0.50 2.60 0.13 119 RELAYCOUNTRY_AE 2504 0.52 2.60 0.16 120 URI_HEX 2456 1.90 2.55 1.79 121 TR_XM_MaxWHORU 2345 0.40 2.43 0.05 122 KHOP_HELO_FCRDNS 2257 1.80 2.34 1.70 123 XMSexyCombo_01 2215 0.93 2.30 0.69 124 DATE_IN_PAST_06_12 2205 0.41 2.29 0.08 125 XM_UB60 2190 0.47 2.27 0.16 126 XM_CamelCaseFrm001 2167 1.95 2.25 1.89 127 TR_XM_PHPDW 2137 0.70 2.22 0.44 128 TR_XM_PHPForged 2111 0.67 2.19 0.41 129 TR_XM_FormFill2 2088 0.67 2.17 0.41 130 XM_H_PHPOS 2087 0.67 2.16 0.41 131 T_PDS_OTHER_BAD_TLD 1979 0.95 2.05 0.75 132 XM_UB80 1949 0.35 2.02 0.07 133 RELAYCOUNTRY_IL 1863 0.30 1.93 0.02 134 BAYES_40 1839 3.91 1.91 4.26 135 T_FILL_THIS_FORM_SHORT 1833 1.15 1.90 1.03 136 MIME_QP_LONG_LINE 1805 5.02 1.87 5.56 137 TR_XM_DK_SendGrid 1800 3.82 1.87 4.15 138 MIME_HTML_ONLY_MULTI 1778 3.01 1.84 3.21 139 T_XMHurry_00 1740 0.96 1.80 0.82 140 HK_RANDOM_REPLYTO 1673 0.49 1.73 0.27 141 XMEqualsVooDoo_00 1663 0.27 1.72 0.02 142 XMLngstWrd_01 1639 0.57 1.70 0.37 143 T_TooManySym_01 1637 3.85 1.70 4.23 144 XMEqualsVooDoo_01 1616 0.25 1.68 0.00 145 XMEqualsVooDoo_02 1615 0.25 1.67 0.00 146 TM2_M_VERY_LONG_WORD 1614 1.31 1.67 1.25 147 XMEqualsVooDoo_03 1607 0.24 1.67 0.00 148 XM_PDF 1600 3.86 1.66 4.23 149 LongTLD 1576 0.40 1.63 0.19 150 T_XMDrugObfuBody_14 1562 1.92 1.62 1.97 151 BAYES_20 1541 3.14 1.60 3.40 152 ALL_TRUSTED 1518 10.24 1.57 11.73 153 XM_UB95 1505 0.25 1.56 0.03 154 TR_XM_RelayPhish 1473 0.35 1.53 0.15 155 RELAYCOUNTRY_DE 1425 0.59 1.48 0.44 156 TR_Symld_Words 1422 1.52 1.47 1.53 157 XM_ShortIntro_01 1420 0.67 1.47 0.54 158 XMStockSpam_06 1378 1.37 1.43 1.36 159 REMOVE_BEFORE_LINK 1374 0.43 1.42 0.26 160 RDNS_DYNAMIC 1346 0.50 1.40 0.34 161 DKIM_ADSP_CUSTOM_MED 1331 1.11 1.38 1.06 162 URI_NOVOWEL 1284 2.45 1.33 2.65 163 T_XMDrugObfuBody_00 1280 0.84 1.33 0.76 164 FSL_THIS_IS_ADV 1265 0.22 1.31 0.04 165 XMLngstWrd_02 1249 0.41 1.30 0.26 166 MAILING_LIST_MULTI 1238 2.08 1.28 2.21 167 TR_Caps_n_Bayes_99 1225 0.33 1.27 0.16 168 NML_ADSP_CUSTOM_MED 1221 0.85 1.27 0.78 169 XMSubNoVowel 1194 0.79 1.24 0.71 170 XMSubMetaSxObfu_03 1156 0.88 1.20 0.83 171 XMGenDplmaNmb 1112 0.98 1.15 0.96 172 FORGED_GMAIL_RCVD 1103 0.62 1.14 0.53 173 XMSexyCombo_04 1094 0.34 1.13 0.21 174 RELAYCOUNTRY_GB 1068 0.90 1.11 0.86 175 URIBL_BLACK 1057 0.19 1.10 0.03 176 TR_Mismatch_TLD_01 1010 0.32 1.05 0.20 177 T_Symld_Words_02 1010 0.70 1.05 0.64 178 XMBody_78 985 0.57 1.02 0.49 179 MPART_ALT_DIFF_COUNT 976 0.49 1.01 0.40 180 TR_Mismatch_TLD_02 966 0.23 1.00 0.10 181 HELO_NODOT 966 1.74 1.00 1.87 182 HELO_NO_DOMAIN 964 1.74 1.00 1.87 183 XM_DK_Undo_01 964 1.66 1.00 1.77 184 T_MONEY_PERCENT 956 0.39 0.99 0.29 185 TR_LOTS_OF_MONEY2 956 0.39 0.99 0.29 186 XM_TLDProd2 954 0.31 0.99 0.20 187 XMPhish08 938 0.54 0.97 0.46 188 XM_HighProb1 933 0.16 0.97 0.02 189 RCVD_IN_IADB_LISTED 921 4.59 0.96 5.22 190 XMPhish14 918 0.57 0.95 0.50 191 DIET_1 857 0.57 0.89 0.51 192 XMSlimDrugH 854 0.51 0.89 0.45 193 TooManyTo_002 847 1.71 0.88 1.86 194 RCVD_IN_IADB_SPF 835 3.99 0.87 4.52 195 XM_Body_Obfu01 830 0.37 0.86 0.29 196 HTML_FONT_FACE_BAD 823 1.16 0.85 1.21 197 BODY_QUOTE_MALF_MSGID 821 0.49 0.85 0.43 198 RCVD_IN_IADB_SENDERID 810 3.56 0.84 4.02 199 RCVD_IN_IADB_DK 808 3.45 0.84 3.91 200 XM_H_PHPMailer 807 0.49 0.84 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 549990 98.02 97.06 98.18 2 HTML_MESSAGE 501782 89.93 92.01 89.57 3 RELAYCOUNTRY_US 467023 80.93 66.74 83.37 4 DKIM_SIGNED 440470 77.92 73.84 78.63 5 XM_DK_Pass 433372 76.53 71.73 77.36 6 DKIM_VALID 409213 71.58 63.07 73.05 7 XM_B_Unicode 408180 72.31 69.10 72.86 8 XMListUnsubscribeExists 311305 57.40 67.99 55.57 9 DKIM_VALID_AU 308155 53.80 46.80 55.01 10 BAYES_50 295797 49.85 32.66 52.80 11 XM_B_Unicode3 236312 40.81 32.85 42.18 12 T_TM2_M_HEADER_IN_MSG 162424 28.66 26.74 28.99 13 HTML_FONT_LOW_CONTRAST 160172 28.00 24.55 28.59 14 RCVD_IN_MSPIKE_WL 159613 25.72 9.62 28.49 15 DKIM_VALID_EF 154471 27.68 28.27 27.57 16 LOC_TINY_FONT_1 145380 26.94 32.66 25.95 17 RCVD_IN_MSPIKE_H2 142248 25.60 26.83 25.39 18 FVGT_m_MULTI_ODD 132805 24.47 28.90 23.71 19 XMSubLong 126254 22.31 21.01 22.54 20 MIME_HTML_ONLY 121725 22.84 29.30 21.73 21 T_KAM_HTML_FONT_INVALID 111535 20.63 24.84 19.91 22 RCVD_IN_MSPIKE_H3 90514 14.67 6.06 16.16 23 XM_Body_Dirty_Words 78917 14.93 19.85 14.09 24 BAYES_00 74442 11.46 0.82 13.29 25 XM_DK_Undo_02 70064 18.07 50.37 12.51 26 XM_Multi_Part_URI 69280 13.79 22.07 12.37 27 ALL_TRUSTED 65698 10.24 1.57 11.73 28 XM_B_Unsub 63117 11.54 13.11 11.27 29 RCVD_IN_MSPIKE_H4 59338 9.52 3.30 10.59 30 LOTS_OF_MONEY 55045 11.70 22.59 9.83 31 LotsOfNums_01 51315 9.14 9.01 9.16 32 XM_Evil_Numbers_Gen 49012 8.63 7.94 8.75 33 BAYES_99 46514 13.58 44.21 8.30 34 TR_XM_DK_Bayes 46116 7.11 0.57 8.23 35 UNPARSEABLE_RELAY 45569 8.12 8.06 8.13 36 XM_B_Phish_Phrases 45232 8.67 12.16 8.07 37 TooManyTo_001 44029 7.52 5.56 7.86 38 TR_XM_DK_Bayes1 43150 6.64 0.46 7.70 39 RCVD_IN_RP_SAFE 42715 6.59 0.59 7.63 40 HTML_IMAGE_RATIO_02 42693 7.66 7.90 7.62 41 BAYES_60 41674 7.21 5.87 7.44 42 XM_SendGrid 40302 6.75 4.18 7.19 43 RCVD_IN_RP_CERTIFIED 40119 6.18 0.46 7.16 44 TR_XM_DK_Bayes2 38735 5.92 0.14 6.91 45 XM_DKIMWhitelistDomains 38019 5.79 0.01 6.79 46 BAYES_999 36390 10.68 34.96 6.50 47 RELAYCOUNTRY_META 34721 9.29 27.27 6.20 48 IN_ZIMBRA_NJ_WHITELIST 34239 5.22 0.03 6.11 49 HTML_IMAGE_RATIO_04 33230 5.59 3.61 5.93 50 DKIM_INVALID 31257 6.34 10.77 5.58 51 MIME_QP_LONG_LINE 31133 5.02 1.87 5.56 52 BOTNET_IPINHOSTNAME 30504 6.80 14.69 5.45 53 XM_H_Long_From01 29729 5.40 5.96 5.31 54 RCVD_IN_IADB_LISTED 29239 4.59 0.96 5.22 55 BAYES_80 29093 5.52 7.41 5.19 56 MPART_ALT_DIFF 28365 5.91 10.85 5.06 57 RCVD_IN_IADB_SPF 25346 3.99 0.87 4.52 58 BAYES_40 23845 3.91 1.91 4.26 59 XM_PDF 23722 3.86 1.66 4.23 60 T_TooManySym_01 23675 3.85 1.70 4.23 61 XMSexyCombo_05 23639 5.46 12.68 4.22 62 TR_XM_DK_SendGrid 23268 3.82 1.87 4.15 63 RCVD_IN_IADB_SENDERID 22535 3.56 0.84 4.02 64 RCVD_IN_IADB_DK 21877 3.45 0.84 3.91 65 XMSubMetaSx_00 21418 4.28 6.92 3.82 66 XMStrtUSub 21121 3.69 3.21 3.77 67 TR_XM_PhishingBody 20498 4.72 10.90 3.66 68 TM2_M_URI_OPT_OUT 20327 3.54 3.05 3.63 69 HTML_IMAGE_RATIO_06 19766 3.53 3.54 3.53 70 XMNumbers 19219 3.38 3.06 3.43 71 BAYES_20 19067 3.14 1.60 3.40 72 T_REMOTE_IMAGE 18291 3.70 6.21 3.27 73 RCVD_IN_IADB_VOUCHED 18006 2.79 0.31 3.21 74 MIME_HTML_ONLY_MULTI 17978 3.01 1.84 3.21 75 XM_UncommonTLD01 17456 6.03 22.94 3.12 76 BAYES_95 17427 3.35 4.74 3.11 77 UNTRUSTED_Relay 16262 6.10 24.68 2.90 78 FROM_EXCESS_BASE64 16009 3.35 6.22 2.86 79 BOTNET 15712 6.26 26.35 2.80 80 HTML_IMAGE_RATIO_08 15676 2.87 3.26 2.80 81 XM_B_Unsub2 15492 3.03 4.58 2.77 82 ANY_BOUNCE_MESSAGE 15409 2.80 3.11 2.75 83 BOUNCE_MESSAGE 15409 2.80 3.11 2.75 84 URI_NOVOWEL 14831 2.45 1.33 2.65 85 HTML_MIME_NO_HTML_TAG 13896 3.11 6.73 2.48 86 NO_DNS_FOR_FROM 13678 2.99 6.16 2.44 87 XM_B_SpammyTLD 13042 2.50 3.49 2.33 88 XM_H_Trusted_IP 12775 1.95 0.00 2.28 89 MIME_HTML_MOSTLY 12492 2.98 7.33 2.23 90 MAILING_LIST_MULTI 12388 2.08 1.28 2.21 91 BAYES_05 12326 1.99 0.76 2.20 92 XM_B_Phish66 12097 3.09 8.48 2.16 93 T_TooManySym_02 12072 1.92 0.54 2.15 94 RCVD_IN_IADB_OPTIN 11781 1.84 0.35 2.10 95 T_XMDrugObfuBody_14 11046 1.92 1.62 1.97 96 XM_SPF_SoftFail 10693 3.09 9.95 1.91 97 RCVD_IN_BL_SPAMCOP_NET 10628 3.64 13.74 1.90 98 XM_CamelCaseFrm001 10613 1.95 2.25 1.89 99 HELO_NODOT 10452 1.74 1.00 1.87 100 HELO_NO_DOMAIN 10451 1.74 1.00 1.87 101 TooManyTo_002 10407 1.71 0.88 1.86 102 XM_UB50 10391 2.87 8.76 1.85 103 TVD_RCVD_IP 10256 1.61 0.36 1.83 104 URI_HEX 10040 1.90 2.55 1.79 105 RELAYCOUNTRY_CA 9980 2.57 7.15 1.78 106 XM_DK_Undo_01 9941 1.66 1.00 1.77 107 RCVD_IN_MSPIKE_H5 9761 1.53 0.26 1.74 108 KHOP_HELO_FCRDNS 9534 1.80 2.34 1.70 109 XMDiploma_00 9107 1.93 3.70 1.63 110 XM_B_COVIDMETA 8955 2.10 5.03 1.60 111 T_XMDrugObfuBody_08 8932 2.19 5.62 1.59 112 SUBJ_ALL_CAPS 8798 1.75 2.81 1.57 113 TR_Symld_Words 8546 1.52 1.47 1.53 114 URI_TRY_3LD 8410 1.71 2.91 1.50 115 XM_OfRef6 8083 1.79 3.83 1.44 116 HELO_MISC_IP 7947 1.28 0.46 1.42 117 CK_HELO_DYNAMIC_SPLIT_IP 7915 1.26 0.39 1.41 118 XMBody_17 7762 2.19 6.86 1.39 119 XMBrknScrpt_02 7745 2.25 7.32 1.38 120 IN_HORDE_ADDRESS_BOOK 7725 1.18 0.03 1.38 121 XMStockSpam_06 7641 1.37 1.43 1.36 122 XM_H_Long_From02 7635 1.27 0.72 1.36 123 TR_LOTS_OF_MONEY3 7560 1.89 5.06 1.35 124 INVALID_MSGID 7292 1.14 0.21 1.30 125 XMHTML_After_End 7177 1.50 2.80 1.28 126 XM_GoogleGroups 7018 1.13 0.43 1.25 127 TM2_M_VERY_LONG_WORD 6997 1.31 1.67 1.25 128 TooManyTo_003 6977 1.15 0.59 1.25 129 HTML_FONT_FACE_BAD 6803 1.16 0.85 1.21 130 XM_ProductURIs 6757 1.14 0.75 1.21 131 USER_IN_DEF_DKIM_WL 6736 1.03 0.02 1.20 132 XMGappySubj_01 6616 1.04 0.21 1.18 133 XMBody_95 6539 1.01 0.13 1.17 134 TO_MALFORMED 6394 0.98 0.02 1.14 135 RCVD_IN_MSPIKE_BL 6151 3.09 14.68 1.10 136 XMCapTrack 6007 0.98 0.44 1.07 137 DKIM_ADSP_CUSTOM_MED 5950 1.11 1.38 1.06 138 T_FILL_THIS_FORM_SHORT 5748 1.15 1.90 1.03 139 XMGenDplmaNmb 5353 0.98 1.15 0.96 140 SpammyFromTLD_01 5169 2.20 9.64 0.92 141 TooManyTo_004 5071 0.85 0.51 0.91 142 XMBdyGiftCard01 5066 0.89 0.81 0.90 143 T_TooManySym_03 4829 0.75 0.11 0.86 144 RELAYCOUNTRY_GB 4809 0.90 1.11 0.86 145 XMSubMetaSxObfu_03 4623 0.88 1.20 0.83 146 T_XMHurry_00 4584 0.96 1.80 0.82 147 MISSING_HEADERS 4573 0.80 0.68 0.82 148 TR_MSPIKEBAYES00 4527 0.69 0.01 0.81 149 TR_BOTNET_NEGATE 4516 0.77 0.56 0.81 150 TR_XM_COVIDMETA4 4444 1.26 3.95 0.79 151 NML_ADSP_CUSTOM_MED 4364 0.85 1.27 0.78 152 XMSubMetaI_00 4332 0.74 0.52 0.77 153 T_XMDrugObfuBody_00 4239 0.84 1.33 0.76 154 T_PDS_OTHER_BAD_TLD 4228 0.95 2.05 0.75 155 TooManyTo_005 4108 0.69 0.43 0.73 156 HTTPS_HTTP_MISMATCH 4099 0.71 0.61 0.73 157 RCVD_IN_MSPIKE_L3 4075 1.33 4.83 0.73 158 XMHTMLBadTable_001 4045 0.67 0.40 0.72 159 XMSubNoVowel 3988 0.79 1.24 0.71 160 XMSexyCombo_01 3877 0.93 2.30 0.69 161 TR_MetaPhish_Combo_01 3796 0.68 0.73 0.68 162 XM_RXBody 3705 0.62 0.41 0.66 163 TR_XM_UnparsRelay 3639 1.04 3.31 0.65 164 T_Symld_Words_02 3606 0.70 1.05 0.64 165 XM_DIRTYINTL 3321 1.30 5.42 0.59 166 T_OBFU_PDF_ATTACH 3269 0.57 0.52 0.58 167 XM_SPF_Unknown 3240 0.59 0.66 0.58 168 XMMoneyMeta_00 3196 0.60 0.80 0.57 169 XMNoVowels 3146 0.54 0.39 0.56 170 XM_ShortIntro_01 3002 0.67 1.47 0.54 171 PLING_QUERY 2987 0.51 0.35 0.53 172 FROM_GOV_DKIM_AU 2964 0.47 0.11 0.53 173 FORGED_GMAIL_RCVD 2954 0.62 1.14 0.53 174 DKIM_ADSP_NXDOMAIN 2950 1.14 4.71 0.53 175 XMPhish30 2926 0.54 0.67 0.52 176 HTML_TAG_BALANCE_BODY 2924 0.56 0.80 0.52 177 DIET_1 2865 0.57 0.89 0.51 178 XMPhish14 2804 0.57 0.95 0.50 179 HTML_IMAGE_ONLY_20 2736 0.46 0.31 0.49 180 XMBody_78 2735 0.57 1.02 0.49 181 T_TooManySym_04 2709 0.42 0.03 0.48 182 XMBSHREFv2 2676 0.48 0.47 0.48 183 XMLngstWrd_00 2648 0.81 2.77 0.47 184 XMPhish08 2581 0.54 0.97 0.46 185 XM_B_COPY_HTML 2516 0.45 0.47 0.45 186 TR_Orig_Subnet 2513 0.39 0.08 0.45 187 XM_B_REG_HTML 2511 0.40 0.14 0.45 188 XMSlimDrugH 2508 0.51 0.89 0.45 189 RELAYCOUNTRY_MU 2493 0.38 0.00 0.45 190 FROM_GOV_SPOOF 2488 0.45 0.48 0.44 191 TR_XM_COVIDMETA1 2487 0.80 2.88 0.44 192 SUBJ_DOLLARS 2486 0.43 0.35 0.44 193 RELAYCOUNTRY_DE 2444 0.59 1.48 0.44 194 TR_XM_PHPDW 2437 0.70 2.22 0.44 195 RELAYCOUNTRY_AU 2426 0.43 0.44 0.43 196 BODY_QUOTE_MALF_MSGID 2419 0.49 0.85 0.43 197 XM_H_PHPMailer 2416 0.49 0.84 0.43 198 HTML_IMAGE_ONLY_28 2410 1.22 5.81 0.43 199 TM2_M_A_HREF_HREF 2407 0.45 0.56 0.43 200 NUMERIC_HTTP_ADDR 2389 0.47 0.71 0.43 ----------------------------------------------------------------------