Email: 668712 Autolearn: 0 AvgScore: 0.43 AvgScanTime: 1.90 sec Spam: 85591 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 3.94 sec Ham: 583121 Autolearn: 0 AvgScore: -1.29 AvgScanTime: 1.60 sec Time Spent Running SA: 352.20 hours Time Spent Processing Spam: 93.65 hours Time Spent Processing Ham: 258.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 83025 97.97 97.00 98.11 2 HTML_MESSAGE 79231 90.62 92.57 90.33 3 XM_B_Unicode 66268 69.66 77.42 68.53 4 DKIM_SIGNED 64296 73.91 75.12 73.73 5 XM_DK_Pass 62168 72.64 72.63 72.64 6 RELAYCOUNTRY_US 57848 77.06 67.59 78.45 7 XMListUnsubscribeExists 57036 53.45 66.64 51.51 8 DKIM_VALID 50763 67.32 59.31 68.49 9 XM_DK_Undo_02 44169 16.41 51.60 11.25 10 DKIM_VALID_AU 36084 50.03 42.16 51.18 11 BAYES_99 35646 11.63 41.65 7.23 12 XM_B_Unicode3 32650 38.99 38.15 39.12 13 BAYES_50 29755 52.90 34.76 55.56 14 BAYES_999 28032 9.10 32.75 5.63 15 LOC_TINY_FONT_1 27993 25.42 32.71 24.35 16 FVGT_m_MULTI_ODD 24304 22.88 28.40 22.07 17 HTML_FONT_LOW_CONTRAST 23109 26.16 27.00 26.04 18 BOTNET 23072 6.09 26.96 3.03 19 T_TM2_M_HEADER_IN_MSG 23002 30.70 26.87 31.26 20 MIME_HTML_ONLY 22987 21.45 26.86 20.66 21 RELAYCOUNTRY_META 22555 8.32 26.35 5.67 22 DKIM_VALID_EF 21653 26.03 25.30 26.14 23 RCVD_IN_MSPIKE_H2 21098 24.59 24.65 24.58 24 XMSubLong 20333 20.58 23.76 20.11 25 T_KAM_HTML_FONT_INVALID 18358 18.83 21.45 18.45 26 XM_Body_Dirty_Words 17897 15.56 20.91 14.77 27 XM_Multi_Part_URI 17447 12.96 20.38 11.87 28 UNTRUSTED_Relay 17245 4.71 20.15 2.44 29 XM_UncommonTLD01 13987 4.63 16.34 2.91 30 XM_B_Phish_Phrases 13900 8.33 16.24 7.17 31 DKIM_INVALID 13533 6.59 15.81 5.23 32 BOTNET_IPINHOSTNAME 13051 6.28 15.25 4.96 33 LOTS_OF_MONEY 11189 10.15 13.07 9.72 34 XM_B_Unsub 11121 10.22 12.99 9.81 35 RCVD_IN_MSPIKE_BL 11096 2.52 12.96 0.98 36 MPART_ALT_DIFF 10844 6.22 12.67 5.27 37 NO_DNS_FOR_FROM 10156 3.92 11.87 2.76 38 RCVD_IN_RP_RNBL 10150 1.66 11.86 0.16 39 XMSexyCombo_05 9841 5.24 11.50 4.32 40 XM_SPF_SoftFail 9815 3.08 11.47 1.85 41 XM_Evil_Numbers_Gen 9038 8.95 10.56 8.71 42 RCVD_IN_BL_SPAMCOP_NET 9024 2.56 10.54 1.39 43 LotsOfNums_01 8380 8.87 9.79 8.74 44 SpammyFromTLD_01 7506 1.80 8.77 0.78 45 RCVD_IN_MSPIKE_WL 7506 23.88 8.77 26.10 46 RELAYCOUNTRY_CA 7298 2.65 8.53 1.79 47 HTML_IMAGE_RATIO_02 7199 7.22 8.41 7.04 48 RCVD_IN_MSPIKE_L5 7197 1.32 8.41 0.28 49 TR_XM_PhishingBody 7152 4.01 8.36 3.38 50 RCVD_IN_PSBL 7145 1.09 8.35 0.02 51 XMSubMetaSx_00 6860 4.38 8.01 3.84 52 XMDiploma_00 6698 2.85 7.83 2.12 53 T_XMDrugObfuBody_08 6504 2.55 7.60 1.80 54 XM_UB99 6390 0.96 7.47 0.00 55 BAYES_80 6154 4.78 7.19 4.42 56 TooManyTo_001 5505 7.67 6.43 7.85 57 XM_H_Long_From01 5430 5.40 6.34 5.26 58 BAYES_60 5319 6.59 6.21 6.65 59 XM_UB50 5288 1.90 6.18 1.27 60 XM_UB999 5246 0.79 6.13 0.00 61 XM_B_Phish66 4820 2.36 5.63 1.88 62 XM_DIRTYINTL 4769 1.26 5.57 0.63 63 XM_B_COVIDMETA 4720 2.14 5.51 1.64 64 UNPARSEABLE_RELAY 4662 7.17 5.45 7.42 65 RCVD_IN_MSPIKE_H3 4569 13.92 5.34 15.18 66 BOTNET_NORDNS 4321 0.66 5.05 0.02 67 XM_B_SpammyTLD 4310 2.41 5.04 2.02 68 TR_XM_COVIDMETA4 4253 1.27 4.97 0.72 69 MIME_HTML_MOSTLY 4085 2.67 4.77 2.36 70 TR_XM_INV_DKIM 4028 0.74 4.71 0.16 71 XMNumbers 3990 3.33 4.66 3.13 72 HTML_IMAGE_RATIO_04 3907 4.87 4.56 4.91 73 XM_SendGrid 3628 6.40 4.24 6.72 74 SUBJ_ALL_CAPS 3556 1.76 4.15 1.41 75 BAYES_95 3410 2.90 3.98 2.75 76 XM_B_Unsub2 3238 2.58 3.78 2.40 77 XMStrtUSub 3137 4.19 3.67 4.26 78 XMBody_17 3117 1.23 3.64 0.88 79 RCVD_IN_MSPIKE_L3 3091 1.02 3.61 0.63 80 TM2_M_URI_OPT_OUT 2968 3.12 3.47 3.07 81 TR_XM_MaxWHORU 2936 0.49 3.43 0.06 82 RELAYCOUNTRY_FR 2902 0.84 3.39 0.46 83 XM_URI_RBL 2868 0.60 3.35 0.20 84 T_REMOTE_IMAGE 2842 3.34 3.32 3.34 85 HTML_IMAGE_RATIO_06 2739 4.59 3.20 4.79 86 RCVD_IN_MSPIKE_H4 2721 8.37 3.18 9.13 87 XM_CamelCaseFrm001 2687 2.05 3.14 1.90 88 DKIM_ADSP_CUSTOM_MED 2681 1.33 3.13 1.07 89 URIBL_SBL_A 2664 0.58 3.11 0.21 90 SpammyFromTLD_02 2621 0.70 3.06 0.36 91 TR_XM_MaxBayes 2583 0.43 3.02 0.05 92 T_TooManySym_01 2564 4.37 3.00 4.57 93 NML_ADSP_CUSTOM_MED 2552 1.05 2.98 0.77 94 ALL_TRUSTED 2521 15.27 2.95 17.08 95 FORGED_GMAIL_RCVD 2466 0.85 2.88 0.55 96 HTML_IMAGE_RATIO_08 2436 2.97 2.85 2.99 97 TR_XM_COVIDMETA1 2426 0.71 2.83 0.39 98 TR_XM_UnparsRelay 2366 0.73 2.76 0.44 99 KHOP_HELO_FCRDNS 2326 1.76 2.72 1.62 100 XM_OfRef6 2325 1.58 2.72 1.42 101 TR_XM_PHPDW 2265 0.73 2.65 0.45 102 URI_HEX 2226 1.81 2.60 1.70 103 MIME_QP_LONG_LINE 2171 5.17 2.54 5.56 104 TM2_M_VERY_LONG_WORD 2169 1.35 2.53 1.18 105 XMSexyCombo_01 2137 1.09 2.50 0.89 106 MIME_HTML_ONLY_MULTI 2136 2.89 2.50 2.94 107 TR_XM_PHPForged 2104 0.69 2.46 0.43 108 HELO_NODOT 2098 1.56 2.45 1.43 109 HELO_NO_DOMAIN 2090 1.56 2.44 1.43 110 TR_XM_MaxSPIKE 2087 0.41 2.44 0.11 111 TR_XM_FormFill2 2073 0.68 2.42 0.42 112 XMHTML_After_End 2064 1.07 2.41 0.88 113 XM_H_PHPOS 2062 0.67 2.41 0.42 114 FROM_EXCESS_BASE64 1970 2.55 2.30 2.58 115 T_XMDrugObfuBody_14 1907 1.89 2.23 1.84 116 HTML_MIME_NO_HTML_TAG 1857 2.12 2.17 2.11 117 DATE_IN_PAST_06_12 1816 0.49 2.12 0.25 118 DATE_IN_PAST_03_06 1805 0.37 2.11 0.12 119 BAYES_40 1796 4.08 2.10 4.37 120 RELAYCOUNTRY_RU 1763 0.44 2.06 0.20 121 XM_UB80 1746 0.33 2.04 0.08 122 XMGenDplmaNmb 1705 1.19 1.99 1.07 123 XM_UB60 1705 0.39 1.99 0.16 124 TR_XM_RelayPhish 1697 0.38 1.98 0.15 125 TR_XM_DK_SendGrid 1680 3.68 1.96 3.94 126 FSL_HELO_NON_FQDN_1 1667 0.28 1.95 0.03 127 XMBody_78 1666 0.68 1.95 0.49 128 TR_Symld_Words 1630 2.15 1.90 2.19 129 MAILING_LIST_MULTI 1629 2.19 1.90 2.23 130 URI_TRY_3LD 1595 1.78 1.86 1.77 131 URI_PHP_REDIR 1546 0.24 1.81 0.01 132 FROM_SUSPICIOUS_NTLD 1531 0.29 1.79 0.07 133 BAYES_20 1527 3.24 1.78 3.45 134 RDNS_DYNAMIC 1523 0.50 1.78 0.31 135 XMBrknScrpt_02 1508 0.97 1.76 0.86 136 RELAYCOUNTRY_SG 1488 0.29 1.74 0.08 137 XM_DK_Undo_01 1457 1.68 1.70 1.68 138 FROM_SUSPICIOUS_NTLD_FP 1457 0.27 1.70 0.06 139 TR_LOTS_OF_MONEY3 1456 0.73 1.70 0.59 140 XMStockSpam_06 1448 4.67 1.69 5.11 141 T_XMDrugObfuBody_00 1448 0.84 1.69 0.72 142 XMSubNoVowel 1430 1.11 1.67 1.03 143 URI_NOVOWEL 1412 2.19 1.65 2.27 144 XMGppyBdWords 1405 0.35 1.64 0.17 145 TR_Sbj_FN_Bdy 1402 0.39 1.64 0.21 146 XM_PDF 1372 3.69 1.60 4.00 147 T_PDS_OTHER_BAD_TLD 1339 0.63 1.56 0.50 148 RELAYCOUNTRY_GB 1321 0.97 1.54 0.88 149 T_FILL_THIS_FORM_SHORT 1314 1.03 1.54 0.96 150 XMSubMetaI_00 1313 0.77 1.53 0.66 151 MPART_ALT_DIFF_COUNT 1243 0.51 1.45 0.38 152 BAYES_00 1196 11.89 1.40 13.43 153 XM_SPF_Unknown 1173 0.73 1.37 0.63 154 ADVANCE_FEE_4_NEW 1164 0.18 1.36 0.01 155 XM_BadFromFormat 1121 0.32 1.31 0.17 156 TR_Mismatch_TLD_02 1117 0.26 1.31 0.11 157 ANY_BOUNCE_MESSAGE 1101 2.56 1.29 2.74 158 BOUNCE_MESSAGE 1100 2.56 1.29 2.74 159 LongTLD 1070 0.31 1.25 0.17 160 TR_Mismatch_TLD_01 1038 0.37 1.21 0.25 161 XM_UB95 1031 0.18 1.20 0.03 162 XMSexyCombo_04 999 0.30 1.17 0.17 163 TR_Caps_n_Bayes_99 984 0.21 1.15 0.07 164 BASE64_LENGTH_79_INF 962 0.55 1.12 0.47 165 HTML_IMAGE_ONLY_32 948 0.59 1.11 0.51 166 T_XMHurry_00 943 0.48 1.10 0.39 167 XMPhish14 923 0.61 1.08 0.54 168 RCVD_IN_IADB_LISTED 896 4.32 1.05 4.80 169 INVESTMENT_ADVICE 891 0.24 1.04 0.12 170 MIME_CHARSET_FARAWAY 891 0.23 1.04 0.11 171 XM_HighProb1 877 0.13 1.02 0.00 172 XM_H_PHPMailer 875 0.53 1.02 0.46 173 RELAYCOUNTRY_DE 874 0.51 1.02 0.44 174 TooManyTo_002 861 1.76 1.01 1.87 175 XMReplyNow 859 0.26 1.00 0.15 176 HK_RANDOM_REPLYTO 847 0.27 0.99 0.17 177 MISSING_HEADERS 839 2.01 0.98 2.16 178 NUMERIC_HTTP_ADDR 839 0.55 0.98 0.48 179 XM_ProductURIs 838 0.98 0.98 0.99 180 XMMoneyMeta_00 834 0.71 0.97 0.67 181 XMSubMetaSxObfu_03 832 0.50 0.97 0.43 182 TR_MetaPhish_Combo_01 831 0.87 0.97 0.85 183 XM_H_MailChimp 830 0.32 0.97 0.23 184 DKIM_ADSP_NXDOMAIN 829 0.60 0.97 0.54 185 URIBL_BLACK 826 0.15 0.97 0.03 186 REMOVE_BEFORE_LINK 825 0.34 0.96 0.25 187 RELAYCOUNTRY_NL 817 0.32 0.95 0.23 188 HTTPS_HTTP_MISMATCH 817 0.78 0.95 0.75 189 XMPhish08 804 0.54 0.94 0.48 190 BAYES_05 784 1.98 0.92 2.13 191 TR_LOTS_OF_MONEY2 782 0.32 0.91 0.23 192 T_MONEY_PERCENT 782 0.32 0.91 0.23 193 XM_B_COPY_HTML 779 0.47 0.91 0.41 194 RELAYCOUNTRY_IN 758 0.20 0.89 0.10 195 RCVD_IN_MSPIKE_L4 757 0.17 0.88 0.06 196 RCVD_IN_IADB_SPF 742 3.76 0.87 4.18 197 LONG_JUNK_URI 740 0.16 0.86 0.05 198 T_TooManySym_02 735 2.05 0.86 2.23 199 TR_XM_DK_Bayes 735 7.43 0.86 8.39 200 T_HTML_TAG_BALANCE_CENTER 730 0.25 0.85 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 572087 97.97 97.00 98.11 2 HTML_MESSAGE 526760 90.62 92.57 90.33 3 RELAYCOUNTRY_US 457483 77.06 67.59 78.45 4 DKIM_SIGNED 429924 73.91 75.12 73.73 5 XM_DK_Pass 423569 72.64 72.63 72.64 6 XM_B_Unicode 399585 69.66 77.42 68.53 7 DKIM_VALID 399400 67.32 59.31 68.49 8 BAYES_50 323979 52.90 34.76 55.56 9 XMListUnsubscribeExists 300373 53.45 66.64 51.51 10 DKIM_VALID_AU 298445 50.03 42.16 51.18 11 XM_B_Unicode3 228091 38.99 38.15 39.12 12 T_TM2_M_HEADER_IN_MSG 182306 30.70 26.87 31.26 13 DKIM_VALID_EF 152441 26.03 25.30 26.14 14 RCVD_IN_MSPIKE_WL 152168 23.88 8.77 26.10 15 HTML_FONT_LOW_CONTRAST 151816 26.16 27.00 26.04 16 RCVD_IN_MSPIKE_H2 143307 24.59 24.65 24.58 17 LOC_TINY_FONT_1 141994 25.42 32.71 24.35 18 FVGT_m_MULTI_ODD 128722 22.88 28.40 22.07 19 MIME_HTML_ONLY 120471 21.45 26.86 20.66 20 XMSubLong 117288 20.58 23.76 20.11 21 T_KAM_HTML_FONT_INVALID 107589 18.83 21.45 18.45 22 ALL_TRUSTED 99572 15.27 2.95 17.08 23 RCVD_IN_MSPIKE_H3 88534 13.92 5.34 15.18 24 XM_Body_Dirty_Words 86146 15.56 20.91 14.77 25 BAYES_00 78329 11.89 1.40 13.43 26 XM_Multi_Part_URI 69197 12.96 20.38 11.87 27 XM_DK_Undo_02 65579 16.41 51.60 11.25 28 XM_B_Unsub 57230 10.22 12.99 9.81 29 LOTS_OF_MONEY 56703 10.15 13.07 9.72 30 RCVD_IN_MSPIKE_H4 53261 8.37 3.18 9.13 31 LotsOfNums_01 50949 8.87 9.79 8.74 32 XM_Evil_Numbers_Gen 50802 8.95 10.56 8.71 33 TR_XM_DK_Bayes 48939 7.43 0.86 8.39 34 TooManyTo_001 45768 7.67 6.43 7.85 35 TR_XM_DK_Bayes1 45717 6.91 0.60 7.84 36 UNPARSEABLE_RELAY 43295 7.17 5.45 7.42 37 BAYES_99 42132 11.63 41.65 7.23 38 XM_B_Phish_Phrases 41786 8.33 16.24 7.17 39 HTML_IMAGE_RATIO_02 41051 7.22 8.41 7.04 40 TR_XM_DK_Bayes2 40819 6.13 0.24 7.00 41 XM_DKIMWhitelistDomains 39866 5.97 0.04 6.84 42 RCVD_IN_RP_SAFE 39588 5.97 0.36 6.79 43 XM_SendGrid 39176 6.40 4.24 6.72 44 BAYES_60 38759 6.59 6.21 6.65 45 RCVD_IN_RP_CERTIFIED 36678 5.52 0.24 6.29 46 RELAYCOUNTRY_META 33053 8.32 26.35 5.67 47 BAYES_999 32836 9.10 32.75 5.63 48 MIME_QP_LONG_LINE 32407 5.17 2.54 5.56 49 IN_ZIMBRA_NJ_WHITELIST 32260 4.83 0.03 5.53 50 MPART_ALT_DIFF 30729 6.22 12.67 5.27 51 XM_H_Long_From01 30697 5.40 6.34 5.26 52 DKIM_INVALID 30524 6.59 15.81 5.23 53 XMStockSpam_06 29774 4.67 1.69 5.11 54 BOTNET_IPINHOSTNAME 28939 6.28 15.25 4.96 55 HTML_IMAGE_RATIO_04 28645 4.87 4.56 4.91 56 RCVD_IN_IADB_LISTED 27976 4.32 1.05 4.80 57 HTML_IMAGE_RATIO_06 27928 4.59 3.20 4.79 58 T_TooManySym_01 26648 4.37 3.00 4.57 59 BAYES_80 25786 4.78 7.19 4.42 60 BAYES_40 25465 4.08 2.10 4.37 61 XMSexyCombo_05 25167 5.24 11.50 4.32 62 XMStrtUSub 24854 4.19 3.67 4.26 63 RCVD_IN_IADB_SPF 24376 3.76 0.87 4.18 64 XM_PDF 23313 3.69 1.60 4.00 65 TR_XM_DK_SendGrid 22952 3.68 1.96 3.94 66 XMSubMetaSx_00 22411 4.38 8.01 3.84 67 RCVD_IN_IADB_SENDERID 21779 3.36 0.80 3.73 68 RCVD_IN_IADB_DK 21177 3.27 0.79 3.63 69 BAYES_20 20145 3.24 1.78 3.45 70 TR_XM_PhishingBody 19684 4.01 8.36 3.38 71 T_REMOTE_IMAGE 19475 3.34 3.32 3.34 72 XMNumbers 18262 3.33 4.66 3.13 73 TM2_M_URI_OPT_OUT 17905 3.12 3.47 3.07 74 BOTNET 17642 6.09 26.96 3.03 75 HTML_IMAGE_RATIO_08 17409 2.97 2.85 2.99 76 RCVD_IN_IADB_VOUCHED 17239 2.64 0.47 2.96 77 MIME_HTML_ONLY_MULTI 17168 2.89 2.50 2.94 78 XM_UncommonTLD01 16971 4.63 16.34 2.91 79 NO_DNS_FOR_FROM 16082 3.92 11.87 2.76 80 BAYES_95 16010 2.90 3.98 2.75 81 ANY_BOUNCE_MESSAGE 16002 2.56 1.29 2.74 82 BOUNCE_MESSAGE 15997 2.56 1.29 2.74 83 FROM_EXCESS_BASE64 15058 2.55 2.30 2.58 84 XM_H_Trusted_IP 14803 2.21 0.00 2.54 85 UNTRUSTED_Relay 14249 4.71 20.15 2.44 86 XM_B_Unsub2 14020 2.58 3.78 2.40 87 MIME_HTML_MOSTLY 13771 2.67 4.77 2.36 88 URI_NOVOWEL 13262 2.19 1.65 2.27 89 MAILING_LIST_MULTI 13001 2.19 1.90 2.23 90 T_TooManySym_02 12999 2.05 0.86 2.23 91 TR_Symld_Words 12769 2.15 1.90 2.19 92 MISSING_HEADERS 12583 2.01 0.98 2.16 93 BAYES_05 12444 1.98 0.92 2.13 94 XMDiploma_00 12388 2.85 7.83 2.12 95 HTML_MIME_NO_HTML_TAG 12329 2.12 2.17 2.11 96 XM_B_SpammyTLD 11778 2.41 5.04 2.02 97 RCVD_IN_IADB_OPTIN 11341 1.75 0.42 1.94 98 XM_CamelCaseFrm001 11053 2.05 3.14 1.90 99 XM_B_Phish66 10950 2.36 5.63 1.88 100 TooManyTo_002 10895 1.76 1.01 1.87 101 XM_SPF_SoftFail 10801 3.08 11.47 1.85 102 T_XMDrugObfuBody_14 10755 1.89 2.23 1.84 103 T_XMDrugObfuBody_08 10521 2.55 7.60 1.80 104 RELAYCOUNTRY_CA 10412 2.65 8.53 1.79 105 RCVD_IN_MSPIKE_H5 10373 1.58 0.25 1.78 106 URI_TRY_3LD 10294 1.78 1.86 1.77 107 URI_HEX 9892 1.81 2.60 1.70 108 XM_DK_Undo_01 9806 1.68 1.70 1.68 109 XM_B_COVIDMETA 9584 2.14 5.51 1.64 110 KHOP_HELO_FCRDNS 9419 1.76 2.72 1.62 111 TVD_RCVD_IP 9083 1.42 0.46 1.56 112 HELO_NODOT 8329 1.56 2.45 1.43 113 HELO_NO_DOMAIN 8326 1.56 2.44 1.43 114 XM_OfRef6 8271 1.58 2.72 1.42 115 SUBJ_ALL_CAPS 8230 1.76 4.15 1.41 116 RCVD_IN_BL_SPAMCOP_NET 8090 2.56 10.54 1.39 117 HELO_MISC_IP 7577 1.21 0.60 1.30 118 CK_HELO_DYNAMIC_SPLIT_IP 7570 1.21 0.59 1.30 119 IN_HORDE_ADDRESS_BOOK 7566 1.14 0.09 1.30 120 XM_UB50 7406 1.90 6.18 1.27 121 INVALID_MSGID 7385 1.14 0.31 1.27 122 TooManyTo_003 7027 1.14 0.72 1.21 123 XM_GoogleGroups 6935 1.10 0.52 1.19 124 XM_H_Long_From02 6898 1.14 0.84 1.18 125 TM2_M_VERY_LONG_WORD 6884 1.35 2.53 1.18 126 XMGappySubj_01 6482 0.98 0.11 1.11 127 TO_MALFORMED 6356 0.95 0.01 1.09 128 XMCapTrack 6314 1.03 0.66 1.08 129 XMGenDplmaNmb 6250 1.19 1.99 1.07 130 DKIM_ADSP_CUSTOM_MED 6221 1.33 3.13 1.07 131 TO_NO_BRKTS_HTML_IMG 6135 0.93 0.10 1.05 132 XMSubNoVowel 6021 1.11 1.67 1.03 133 HTML_FONT_FACE_BAD 5778 0.95 0.70 0.99 134 XM_ProductURIs 5744 0.98 0.98 0.99 135 RCVD_IN_MSPIKE_BL 5726 2.52 12.96 0.98 136 T_FILL_THIS_FORM_SHORT 5604 1.03 1.54 0.96 137 USER_IN_DEF_DKIM_WL 5277 0.79 0.00 0.90 138 XMSexyCombo_01 5181 1.09 2.50 0.89 139 RELAYCOUNTRY_GB 5153 0.97 1.54 0.88 140 XMBody_17 5119 1.23 3.64 0.88 141 XMHTML_After_End 5110 1.07 2.41 0.88 142 TooManyTo_004 5069 0.84 0.61 0.87 143 XMBrknScrpt_02 5008 0.97 1.76 0.86 144 TR_MetaPhish_Combo_01 4979 0.87 0.97 0.85 145 T_TooManySym_03 4764 0.74 0.21 0.82 146 REPLYTO_WITHOUT_TO_CC 4660 0.78 0.63 0.80 147 XMBdyGiftCard01 4568 0.75 0.53 0.78 148 SpammyFromTLD_01 4544 1.80 8.77 0.78 149 NML_ADSP_CUSTOM_MED 4501 1.05 2.98 0.77 150 TR_MSPIKEBAYES00 4485 0.67 0.01 0.77 151 HTTPS_HTTP_MISMATCH 4398 0.78 0.95 0.75 152 XM_ShortIntro_01 4269 0.75 0.83 0.73 153 XMNoVowels 4266 0.73 0.69 0.73 154 TR_XM_COVIDMETA4 4221 1.27 4.97 0.72 155 TooManyTo_005 4212 0.69 0.45 0.72 156 T_XMDrugObfuBody_00 4187 0.84 1.69 0.72 157 XMMoneyMeta_00 3894 0.71 0.97 0.67 158 XMBody_95 3846 0.59 0.14 0.66 159 XMSubMetaI_00 3828 0.77 1.53 0.66 160 T_OBFU_PDF_ATTACH 3793 0.59 0.20 0.65 161 RCVD_IN_MSPIKE_L3 3700 1.02 3.61 0.63 162 XM_SPF_Unknown 3684 0.73 1.37 0.63 163 XM_DIRTYINTL 3683 1.26 5.57 0.63 164 XMHTMLBadTable_001 3519 0.57 0.31 0.60 165 TR_BOTNET_NEGATE 3475 0.57 0.36 0.60 166 XMOemUri 3457 0.57 0.44 0.59 167 T_Symld_Words_02 3451 0.61 0.73 0.59 168 TR_LOTS_OF_MONEY3 3446 0.73 1.70 0.59 169 FORGED_GMAIL_RCVD 3197 0.85 2.88 0.55 170 XMPhish14 3178 0.61 1.08 0.54 171 DKIM_ADSP_NXDOMAIN 3167 0.60 0.97 0.54 172 HTML_TAG_BALANCE_BODY 3122 0.56 0.75 0.54 173 FROM_GOV_DKIM_AU 3081 0.48 0.13 0.53 174 HTML_IMAGE_ONLY_32 2976 0.59 1.11 0.51 175 XM_RXBody 2933 0.50 0.46 0.50 176 T_PDS_OTHER_BAD_TLD 2898 0.63 1.56 0.50 177 XMBody_78 2870 0.68 1.95 0.49 178 NUMERIC_HTTP_ADDR 2806 0.55 0.98 0.48 179 XMPhish08 2806 0.54 0.94 0.48 180 BODY_QUOTE_MALF_MSGID 2773 0.50 0.70 0.48 181 XM_B_REG_HTML 2751 0.44 0.26 0.47 182 RELAYCOUNTRY_AU 2738 0.48 0.57 0.47 183 XMPhish30 2713 0.51 0.84 0.47 184 BASE64_LENGTH_79_INF 2712 0.55 1.12 0.47 185 RELAYCOUNTRY_FR 2699 0.84 3.39 0.46 186 XM_H_PHPMailer 2657 0.53 1.02 0.46 187 HTML_IMAGE_ONLY_20 2648 0.45 0.39 0.45 188 TR_XM_PHPDW 2634 0.73 2.65 0.45 189 DIET_1 2623 0.48 0.72 0.45 190 XMSolicitRefs_0 2619 0.44 0.38 0.45 191 T_TooManySym_04 2595 0.40 0.09 0.45 192 TR_XM_UnparsRelay 2542 0.73 2.76 0.44 193 RELAYCOUNTRY_DE 2541 0.51 1.02 0.44 194 HTML_IMAGE_ONLY_28 2530 0.43 0.44 0.43 195 XMSubMetaSxObfu_03 2498 0.50 0.97 0.43 196 TR_XM_PHPForged 2481 0.69 2.46 0.43 197 TR_XM_FormFill2 2474 0.68 2.42 0.42 198 RCVD_IN_SORBS_DUL 2446 0.42 0.39 0.42 199 XM_H_PHPOS 2443 0.67 2.41 0.42 200 PLING_QUERY 2426 0.41 0.38 0.42 ----------------------------------------------------------------------