Email: 627659 Autolearn: 0 AvgScore: 0.23 AvgScanTime: 1.14 sec Spam: 94489 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 1.27 sec Ham: 533170 Autolearn: 0 AvgScore: -1.99 AvgScanTime: 1.12 sec Time Spent Running SA: 199.61 hours Time Spent Processing Spam: 33.21 hours Time Spent Processing Ham: 166.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 91644 98.17 96.99 98.38 2 HTML_MESSAGE 87165 90.16 92.25 89.79 3 DKIM_SIGNED 72761 75.67 77.00 75.43 4 XM_DK_Pass 70113 74.35 74.20 74.37 5 DKIM_VALID 67765 72.32 71.72 72.42 6 RELAYCOUNTRY_US 65698 81.94 69.53 84.14 7 XM_B_Unicode 63364 72.12 67.06 73.02 8 XM_B_SpammyWords 60064 53.35 63.57 51.54 9 XMListUnsubscribeExists 59948 53.93 63.44 52.24 10 DKIM_VALID_AU 50295 54.28 53.23 54.47 11 XM_DK_Undo_02 43260 16.07 45.78 10.80 12 BAYES_99 36417 11.97 38.54 7.26 13 XM_B_SpammyWords2 34542 26.79 36.56 25.06 14 MIME_HTML_ONLY 34476 25.64 36.49 23.71 15 BAYES_50 32875 48.83 34.79 51.32 16 LOC_TINY_FONT_1 32872 27.86 34.79 26.63 17 XM_B_Unicode3 32512 42.48 34.41 43.91 18 DKIM_VALID_EF 32296 28.31 34.18 27.26 19 RCVD_IN_MSPIKE_H2 27882 26.02 29.51 25.40 20 RELAYCOUNTRY_META 27710 8.44 29.33 4.74 21 BAYES_999 26891 9.15 28.46 5.73 22 XMSubLong 26415 21.65 27.96 20.53 23 HTML_FONT_LOW_CONTRAST 26062 29.03 27.58 29.29 24 XM_UncommonTLD01 23077 6.36 24.42 3.16 25 BOTNET 22652 5.37 23.97 2.07 26 T_KAM_HTML_FONT_INVALID 22193 19.00 23.49 18.21 27 T_TM2_M_HEADER_IN_MSG 21467 28.71 22.72 29.77 28 XM_Body_Dirty_Words 21271 15.35 22.51 14.08 29 FVGT_m_MULTI_ODD 21198 21.81 22.43 21.70 30 UNTRUSTED_Relay 20034 4.96 21.20 2.08 31 XM_Multi_Part_URI 17982 13.56 19.03 12.59 32 LOTS_OF_MONEY 16208 10.37 17.15 9.17 33 BOTNET_IPINHOSTNAME 13625 6.91 14.42 5.57 34 XM_B_Phish_Phrases 13046 8.08 13.81 7.07 35 XMSexyCombo_05 12637 6.16 13.37 4.89 36 SpammyFromTLD_02 11768 2.28 12.45 0.48 37 XM_B_SpammyWords3 11542 6.90 12.22 5.96 38 MPART_ALT_DIFF 10823 8.14 11.45 7.56 39 XM_B_Unsub 10777 11.92 11.41 12.01 40 XM_Evil_Numbers_Gen 10338 9.04 10.94 8.71 41 T_REMOTE_IMAGE 9950 4.81 10.53 3.80 42 RCVD_IN_MSPIKE_WL 9838 25.62 10.41 28.32 43 RCVD_IN_MSPIKE_BL 8790 2.31 9.30 1.07 44 FROM_SUSPICIOUS_NTLD 8432 1.40 8.92 0.07 45 MIME_HTML_MOSTLY 8384 3.46 8.87 2.50 46 FROM_SUSPICIOUS_NTLD_FP 8319 1.38 8.80 0.06 47 HTML_MIME_NO_HTML_TAG 8193 3.09 8.67 2.10 48 FROM_EXCESS_BASE64 8004 4.01 8.47 3.22 49 BODY_URI_ONLY 8000 1.30 8.47 0.04 50 RCVD_IN_BL_SPAMCOP_NET 7683 2.62 8.13 1.65 51 LotsOfNums_01 7679 8.79 8.13 8.91 52 BAYES_80 7652 4.96 8.10 4.40 53 BOTNET_NORDNS 7622 1.22 8.07 0.01 54 HTML_IMAGE_RATIO_02 7487 7.14 7.92 7.01 55 XM_B_COVIDMETA 7141 2.25 7.56 1.31 56 XMSubMetaSx_00 6952 4.82 7.36 4.37 57 URI_PHP_REDIR 6615 1.12 7.00 0.08 58 DKIM_ADSP_NXDOMAIN 6398 1.60 6.77 0.69 59 XM_UB99 6283 1.01 6.65 0.01 60 RELAYCOUNTRY_CA 6266 2.32 6.63 1.55 61 TR_XM_PhishingBody 6151 3.69 6.51 3.19 62 XM_UB50 6076 1.90 6.43 1.10 63 HTML_IMAGE_RATIO_04 6073 7.24 6.43 7.39 64 BAYES_60 6047 6.71 6.40 6.76 65 RCVD_IN_MSPIKE_L3 5983 1.52 6.33 0.67 66 XM_DIRTYINTL 5919 1.48 6.26 0.63 67 XM_OfRef6 5887 1.94 6.23 1.18 68 T_HTML_TAG_BALANCE_CENTER 5746 1.03 6.08 0.14 69 RCVD_IN_MSPIKE_H3 5711 14.54 6.04 16.04 70 SpammyFromTLD_01 5665 1.61 6.00 0.83 71 HDRS_MISSP 5604 0.92 5.93 0.04 72 RELAYCOUNTRY_FR 5583 1.09 5.91 0.24 73 XMBody_50 5526 0.88 5.85 0.00 74 XM_H_Long_From01 5456 5.72 5.77 5.71 75 TooManyTo_001 5429 7.50 5.75 7.81 76 UNPARSEABLE_RELAY 5044 6.75 5.34 7.00 77 DKIM_INVALID 4996 3.35 5.29 3.01 78 BAYES_95 4741 3.05 5.02 2.71 79 XMBody_17 4728 1.63 5.00 1.03 80 XM_UB999 4469 0.72 4.73 0.00 81 XM_SendGrid 4200 5.94 4.44 6.21 82 XMNumbers 4137 3.40 4.38 3.23 83 XM_SPF_SoftFail 4118 2.03 4.36 1.62 84 XM_B_Phish66 3995 1.98 4.23 1.58 85 RCVD_IN_MSPIKE_H4 3907 9.36 4.13 10.29 86 KHOP_HELO_FCRDNS 3812 1.94 4.03 1.57 87 XM_B_SpammyTLD 3765 2.28 3.98 1.98 88 RELAYCOUNTRY_IN 3522 0.66 3.73 0.12 89 XMBrknScrpt_02 3480 1.45 3.68 1.06 90 T_XMDrugObfuBody_08 3376 2.44 3.57 2.24 91 TM2_M_URI_OPT_OUT 3369 4.43 3.57 4.58 92 TR_XM_MaxSPIKE 3361 0.61 3.56 0.08 93 TR_Mismatch_TLD_02 3313 0.62 3.51 0.11 94 XMStrtUSub 3242 4.22 3.43 4.36 95 XMDiploma_00 3121 2.05 3.30 1.83 96 XM_OfRef7 3104 0.62 3.29 0.14 97 URI_HEX 3099 2.10 3.28 1.89 98 T_PDS_OTHER_BAD_TLD 2960 0.70 3.13 0.27 99 XM_JunkDunk 2941 0.47 3.11 0.00 100 RCVD_IN_RP_RNBL 2907 0.51 3.08 0.06 101 XMMoneyMeta_00 2905 0.95 3.07 0.57 102 URIBL_SBL_A 2857 0.69 3.02 0.28 103 HTML_IMAGE_RATIO_08 2843 2.75 3.01 2.70 104 TR_XM_PHPDW 2828 0.75 2.99 0.36 105 TR_XM_PHPForged 2773 0.70 2.93 0.31 106 T_XMHurry_00 2746 0.89 2.91 0.54 107 RELAYCOUNTRY_DE 2739 0.81 2.90 0.44 108 TR_XM_FormFill2 2727 0.70 2.89 0.31 109 XM_H_PHPOS 2721 0.69 2.88 0.30 110 TR_XM_COVIDMETA4 2713 0.81 2.87 0.45 111 MIME_HTML_ONLY_MULTI 2653 5.22 2.81 5.65 112 BAYES_40 2562 4.36 2.71 4.66 113 LH_URI_DOM_IN_PATH 2537 2.16 2.68 2.06 114 TR_XM_UnparsRelay 2525 0.74 2.67 0.40 115 HTML_SHORT_LINK_IMG_1 2503 0.42 2.65 0.02 116 TR_XM_COVIDMETA1 2497 0.67 2.64 0.32 117 HTML_IMAGE_RATIO_06 2468 4.19 2.61 4.47 118 XM_URI_RBL 2425 0.53 2.57 0.17 119 XM_UB60 2410 0.46 2.55 0.10 120 HTML_IMAGE_ONLY_08 2391 0.47 2.53 0.11 121 SHORT_SHORTNER 2365 0.42 2.50 0.05 122 ALL_TRUSTED 2352 10.60 2.49 12.04 123 SUBJ_ALL_CAPS 2350 1.94 2.49 1.85 124 XMGenDplmaNmb 2349 1.13 2.49 0.89 125 TR_LOTS_OF_MONEY3 2339 0.94 2.48 0.66 126 XM_B_Unsub2 2319 2.39 2.45 2.38 127 XM_B_SpammyWords4 2218 0.96 2.35 0.71 128 TR_XM_MaxBayes 2215 0.38 2.34 0.03 129 BAYES_20 2201 3.44 2.33 3.64 130 RCVD_IN_MSPIKE_L5 2187 0.62 2.31 0.32 131 T_Symld_Words_02 2168 0.88 2.29 0.62 132 MIME_QP_LONG_LINE 2156 5.09 2.28 5.59 133 T_XMDrugObfuBody_14 2154 2.07 2.28 2.03 134 T_FILL_THIS_FORM_SHORT 2119 1.01 2.24 0.79 135 URI_TRY_3LD 2114 1.57 2.24 1.46 136 XM_UB80 2097 0.37 2.22 0.04 137 RCVD_IN_PSBL 2068 0.37 2.19 0.05 138 SHORT_URI_3 2052 0.40 2.17 0.09 139 XM_CamelCaseFrm001 2051 2.01 2.17 1.99 140 TR_XM_DK_SendGrid 2000 3.41 2.12 3.63 141 T_XMDrugObfuBody_00 1958 1.03 2.07 0.85 142 SUBJ_DOLLARS 1917 0.68 2.03 0.45 143 T_TooManySym_01 1916 4.50 2.03 4.94 144 TR_XM_INV_DKIM 1889 0.37 2.00 0.08 145 XMHTML_After_End 1875 0.91 1.98 0.72 146 TR_XM_SB_Phish 1870 1.23 1.98 1.10 147 XMSexyCombo_01 1850 1.44 1.96 1.35 148 TR_XM_RelayPhish 1763 0.38 1.87 0.11 149 XMSubPhish11 1741 1.19 1.84 1.07 150 MISSING_HEADERS 1685 0.60 1.78 0.39 151 MILLION_HUNDRED 1628 0.26 1.72 0.00 152 XM_UB95 1618 0.27 1.71 0.02 153 TR_Symld_Words 1608 1.57 1.70 1.55 154 HK_SCAM 1574 0.26 1.67 0.01 155 RCVD_IN_IADB_LISTED 1554 4.75 1.64 5.30 156 TM2_M_VERY_LONG_WORD 1519 1.35 1.61 1.30 157 XMSubMetaSxObfu_03 1494 0.89 1.58 0.76 158 FILL_THIS_FORM 1481 0.57 1.57 0.39 159 REPLYTO_WITHOUT_TO_CC 1391 0.27 1.47 0.05 160 FROM_ADDR_WS 1380 0.22 1.46 0.00 161 LongTLD 1377 0.38 1.46 0.19 162 FILL_THIS_FORM_LONG 1370 0.25 1.45 0.03 163 TR_LOTS_OF_MONEY1 1365 0.24 1.44 0.02 164 XMStockSpam_06 1341 1.47 1.42 1.48 165 XM_XX_Yahoo 1312 0.28 1.39 0.08 166 T_MONEY_PERCENT 1275 0.41 1.35 0.25 167 TR_LOTS_OF_MONEY2 1275 0.41 1.35 0.25 168 MAILING_LIST_MULTI 1267 1.81 1.34 1.89 169 MONEY_FRAUD_3 1249 0.20 1.32 0.00 170 XM_H_PHPMailer 1241 0.74 1.31 0.63 171 RCVD_IN_IADB_SPF 1237 4.08 1.31 4.57 172 DATE_IN_PAST_06_12 1228 0.44 1.30 0.29 173 TR_MetaPhish_Combo_01 1226 0.69 1.30 0.58 174 XMSlimDrugH 1225 0.66 1.30 0.55 175 XM_PDF 1219 3.63 1.29 4.04 176 XM_H_Undi_Recip 1199 0.35 1.27 0.19 177 XMBdyGiftCard01 1193 0.91 1.26 0.85 178 URI_NOVOWEL 1177 2.21 1.25 2.39 179 INVESTMENT_ADVICE 1167 0.28 1.24 0.11 180 RELAYCOUNTRY_NL 1162 0.37 1.23 0.21 181 RELAYCOUNTRY_HK 1157 0.22 1.22 0.04 182 RCVD_IN_IADB_SENDERID 1147 3.63 1.21 4.06 183 RCVD_IN_IADB_DK 1140 3.51 1.21 3.92 184 RDNS_DYNAMIC 1118 0.55 1.18 0.43 185 HTTPS_HTTP_MISMATCH 1102 0.72 1.17 0.64 186 BAYES_00 1098 14.33 1.16 16.67 187 TR_XM_Undi_Recip5 1086 0.19 1.15 0.02 188 FROM_MISSP_REPLYTO 1081 0.18 1.14 0.01 189 XM_H_PHPOS_M 1038 0.30 1.10 0.15 190 XMSubNoVowel 1030 1.37 1.09 1.42 191 DKIM_ADSP_CUSTOM_MED 1016 1.19 1.08 1.21 192 XM_S_SpammyWords 1005 0.40 1.06 0.28 193 TR_XM_Spammywords 1004 0.40 1.06 0.28 194 SPOOFED_URL 996 0.63 1.05 0.56 195 PLING_QUERY 992 0.80 1.05 0.75 196 XM_H_SupportSpoof 969 0.37 1.03 0.25 197 XMBody_78 941 0.61 1.00 0.55 198 HELO_NODOT 928 1.20 0.98 1.24 199 HELO_NO_DOMAIN 928 1.20 0.98 1.24 200 TR_Mismatch_TLD_01 925 0.36 0.98 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 524542 98.17 96.99 98.38 2 HTML_MESSAGE 478742 90.16 92.25 89.79 3 RELAYCOUNTRY_US 448609 81.94 69.53 84.14 4 DKIM_SIGNED 402192 75.67 77.00 75.43 5 XM_DK_Pass 396521 74.35 74.20 74.37 6 XM_B_Unicode 389303 72.12 67.06 73.02 7 DKIM_VALID 386140 72.32 71.72 72.42 8 DKIM_VALID_AU 290428 54.28 53.23 54.47 9 XMListUnsubscribeExists 278540 53.93 63.44 52.24 10 XM_B_SpammyWords 274790 53.35 63.57 51.54 11 BAYES_50 273629 48.83 34.79 51.32 12 XM_B_Unicode3 234125 42.48 34.41 43.91 13 T_TM2_M_HEADER_IN_MSG 158715 28.71 22.72 29.77 14 HTML_FONT_LOW_CONTRAST 156145 29.03 27.58 29.29 15 RCVD_IN_MSPIKE_WL 150998 25.62 10.41 28.32 16 DKIM_VALID_EF 145364 28.31 34.18 27.26 17 LOC_TINY_FONT_1 141984 27.86 34.79 26.63 18 RCVD_IN_MSPIKE_H2 135404 26.02 29.51 25.40 19 XM_B_SpammyWords2 133633 26.79 36.56 25.06 20 MIME_HTML_ONLY 126429 25.64 36.49 23.71 21 FVGT_m_MULTI_ODD 115723 21.81 22.43 21.70 22 XMSubLong 109469 21.65 27.96 20.53 23 T_KAM_HTML_FONT_INVALID 97072 19.00 23.49 18.21 24 BAYES_00 88871 14.33 1.16 16.67 25 RCVD_IN_MSPIKE_H3 85524 14.54 6.04 16.04 26 XM_Body_Dirty_Words 75047 15.35 22.51 14.08 27 XM_Multi_Part_URI 67124 13.56 19.03 12.59 28 ALL_TRUSTED 64202 10.60 2.49 12.04 29 XM_B_Unsub 64041 11.92 11.41 12.01 30 XM_DK_Undo_02 57603 16.07 45.78 10.80 31 RCVD_IN_MSPIKE_H4 54845 9.36 4.13 10.29 32 LOTS_OF_MONEY 48882 10.37 17.15 9.17 33 LotsOfNums_01 47480 8.79 8.13 8.91 34 TR_XM_DK_Bayes 46449 7.48 0.51 8.71 35 XM_Evil_Numbers_Gen 46431 9.04 10.94 8.71 36 TR_XM_DK_Bayes1 44902 7.23 0.48 8.42 37 TooManyTo_001 41650 7.50 5.75 7.81 38 XM_DKIMWhitelistDomains 40984 6.54 0.04 7.69 39 MPART_ALT_DIFF 40289 8.14 11.45 7.56 40 TR_XM_DK_Bayes2 40014 6.44 0.43 7.50 41 HTML_IMAGE_RATIO_04 39397 7.24 6.43 7.39 42 BAYES_99 38727 11.97 38.54 7.26 43 XM_B_Phish_Phrases 37679 8.08 13.81 7.07 44 HTML_IMAGE_RATIO_02 37357 7.14 7.92 7.01 45 UNPARSEABLE_RELAY 37333 6.75 5.34 7.00 46 RCVD_IN_RP_SAFE 36991 5.99 0.64 6.94 47 BAYES_60 36060 6.71 6.40 6.76 48 RCVD_IN_RP_CERTIFIED 34551 5.57 0.41 6.48 49 XM_H_Trusted_IP 33828 5.39 0.00 6.34 50 XM_SendGrid 33098 5.94 4.44 6.21 51 XM_B_SpammyWords3 31782 6.90 12.22 5.96 52 BAYES_999 30529 9.15 28.46 5.73 53 XM_H_Long_From01 30424 5.72 5.77 5.71 54 IN_ZIMBRA_NJ_WHITELIST 30246 4.82 0.02 5.67 55 MIME_HTML_ONLY_MULTI 30103 5.22 2.81 5.65 56 MIME_QP_LONG_LINE 29783 5.09 2.28 5.59 57 BOTNET_IPINHOSTNAME 29720 6.91 14.42 5.57 58 RCVD_IN_IADB_LISTED 28255 4.75 1.64 5.30 59 T_TooManySym_01 26352 4.50 2.03 4.94 60 XMSexyCombo_05 26048 6.16 13.37 4.89 61 RELAYCOUNTRY_META 25295 8.44 29.33 4.74 62 BAYES_40 24834 4.36 2.71 4.66 63 TM2_M_URI_OPT_OUT 24416 4.43 3.57 4.58 64 RCVD_IN_IADB_SPF 24352 4.08 1.31 4.57 65 HTML_IMAGE_RATIO_06 23835 4.19 2.61 4.47 66 BAYES_80 23486 4.96 8.10 4.40 67 XMSubMetaSx_00 23320 4.82 7.36 4.37 68 XMStrtUSub 23268 4.22 3.43 4.36 69 RCVD_IN_IADB_SENDERID 21625 3.63 1.21 4.06 70 XM_PDF 21551 3.63 1.29 4.04 71 RCVD_IN_IADB_DK 20918 3.51 1.21 3.92 72 T_REMOTE_IMAGE 20268 4.81 10.53 3.80 73 BAYES_20 19382 3.44 2.33 3.64 74 TR_XM_DK_SendGrid 19376 3.41 2.12 3.63 75 RCVD_IN_IADB_VOUCHED 17762 2.95 0.81 3.33 76 ANY_BOUNCE_MESSAGE 17230 2.89 0.97 3.23 77 XMNumbers 17206 3.40 4.38 3.23 78 FROM_EXCESS_BASE64 17168 4.01 8.47 3.22 79 BOUNCE_MESSAGE 16995 2.85 0.94 3.19 80 TR_XM_PhishingBody 16990 3.69 6.51 3.19 81 XM_UncommonTLD01 16861 6.36 24.42 3.16 82 DKIM_INVALID 16052 3.35 5.29 3.01 83 BAYES_95 14423 3.05 5.02 2.71 84 HTML_IMAGE_RATIO_08 14408 2.75 3.01 2.70 85 BAYES_05 13752 2.33 0.94 2.58 86 HTML_FONT_FACE_BAD 13470 2.22 0.49 2.53 87 MIME_HTML_MOSTLY 13324 3.46 8.87 2.50 88 URI_NOVOWEL 12722 2.21 1.25 2.39 89 XM_B_Unsub2 12669 2.39 2.45 2.38 90 T_XMDrugObfuBody_08 11955 2.44 3.57 2.24 91 RCVD_IN_IADB_OPTIN 11646 1.94 0.55 2.18 92 T_TooManySym_02 11408 1.91 0.61 2.14 93 HTML_MIME_NO_HTML_TAG 11206 3.09 8.67 2.10 94 UNTRUSTED_Relay 11112 4.96 21.20 2.08 95 BOTNET 11053 5.37 23.97 2.07 96 LH_URI_DOM_IN_PATH 10990 2.16 2.68 2.06 97 T_XMDrugObfuBody_14 10827 2.07 2.28 2.03 98 RCVD_IN_MSPIKE_H5 10629 1.73 0.23 1.99 99 XM_CamelCaseFrm001 10589 2.01 2.17 1.99 100 XM_B_SpammyTLD 10543 2.28 3.98 1.98 101 URI_HEX 10096 2.10 3.28 1.89 102 MAILING_LIST_MULTI 10086 1.81 1.34 1.89 103 TooManyTo_002 10046 1.72 0.82 1.88 104 SUBJ_ALL_CAPS 9849 1.94 2.49 1.85 105 XMDiploma_00 9735 2.05 3.30 1.83 106 TVD_RCVD_IP 9415 1.52 0.15 1.77 107 XM_DK_Undo_01 9207 1.61 0.97 1.73 108 RCVD_IN_BL_SPAMCOP_NET 8793 2.62 8.13 1.65 109 XM_SPF_SoftFail 8644 2.03 4.36 1.62 110 XM_B_Phish66 8433 1.98 4.23 1.58 111 KHOP_HELO_FCRDNS 8382 1.94 4.03 1.57 112 RELAYCOUNTRY_CA 8289 2.32 6.63 1.55 113 TR_Symld_Words 8242 1.57 1.70 1.55 114 XMStockSpam_06 7904 1.47 1.42 1.48 115 HELO_MISC_IP 7769 1.33 0.65 1.46 116 CK_HELO_DYNAMIC_SPLIT_IP 7761 1.33 0.65 1.46 117 URI_TRY_3LD 7758 1.57 2.24 1.46 118 XMSubNoVowel 7579 1.37 1.09 1.42 119 INVALID_MSGID 7514 1.31 0.76 1.41 120 IN_HORDE_ADDRESS_BOOK 7430 1.19 0.04 1.39 121 XMSexyCombo_01 7216 1.44 1.96 1.35 122 XM_B_COVIDMETA 6982 2.25 7.56 1.31 123 XMGappySubj_01 6957 1.14 0.19 1.30 124 TM2_M_VERY_LONG_WORD 6929 1.35 1.61 1.30 125 TooManyTo_003 6679 1.16 0.64 1.25 126 HELO_NODOT 6630 1.20 0.98 1.24 127 HELO_NO_DOMAIN 6629 1.20 0.98 1.24 128 DKIM_ADSP_CUSTOM_MED 6451 1.19 1.08 1.21 129 TO_MALFORMED 6436 1.03 0.04 1.21 130 XM_OfRef6 6282 1.94 6.23 1.18 131 XM_H_Long_From02 6060 1.08 0.78 1.14 132 XM_UB50 5861 1.90 6.43 1.10 133 TR_XM_SB_Phish 5845 1.23 1.98 1.10 134 RCVD_IN_MSPIKE_BL 5720 2.31 9.30 1.07 135 XMSubPhish11 5706 1.19 1.84 1.07 136 XMBrknScrpt_02 5643 1.45 3.68 1.06 137 XM_ProductURIs 5643 0.99 0.59 1.06 138 XMBody_17 5509 1.63 5.00 1.03 139 DIET_1 5331 0.99 0.96 1.00 140 TR_MSPIKEBAYES00 5228 0.83 0.01 0.98 141 USER_IN_DEF_DKIM_WL 5130 0.82 0.01 0.96 142 XMCapTrack 5073 0.88 0.47 0.95 143 XM_GoogleGroups 4916 0.85 0.44 0.92 144 XMSexyCombo_04 4888 0.91 0.90 0.92 145 TooManyTo_004 4781 0.84 0.54 0.90 146 XMGenDplmaNmb 4737 1.13 2.49 0.89 147 NML_ADSP_CUSTOM_MED 4577 0.87 0.96 0.86 148 T_XMDrugObfuBody_00 4523 1.03 2.07 0.85 149 XMBdyGiftCard01 4518 0.91 1.26 0.85 150 RELAYCOUNTRY_GB 4487 0.86 0.95 0.84 151 SpammyFromTLD_01 4416 1.61 6.00 0.83 152 T_TooManySym_03 4318 0.72 0.18 0.81 153 T_FILL_THIS_FORM_SHORT 4224 1.01 2.24 0.79 154 XMPhish30 4164 0.80 0.88 0.78 155 XMSubMetaSxObfu_03 4068 0.89 1.58 0.76 156 PLING_QUERY 4006 0.80 1.05 0.75 157 TooManyTo_005 3887 0.68 0.39 0.73 158 XMHTML_After_End 3844 0.91 1.98 0.72 159 XM_B_SpammyWords4 3792 0.96 2.35 0.71 160 XM_SPF_Unknown 3789 0.74 0.92 0.71 161 DKIM_ADSP_NXDOMAIN 3657 1.60 6.77 0.69 162 T_OBFU_PDF_ATTACH 3605 0.60 0.14 0.68 163 RCVD_IN_MSPIKE_L3 3577 1.52 6.33 0.67 164 TR_LOTS_OF_MONEY3 3539 0.94 2.48 0.66 165 XM_RXBody 3469 0.67 0.76 0.65 166 HTTPS_HTTP_MISMATCH 3435 0.72 1.17 0.64 167 FROM_GOV_DKIM_AU 3384 0.56 0.12 0.63 168 XM_H_PHPMailer 3381 0.74 1.31 0.63 169 XM_DIRTYINTL 3372 1.48 6.26 0.63 170 XM_ShortIntro_01 3345 0.61 0.49 0.63 171 T_Symld_Words_02 3331 0.88 2.29 0.62 172 XMHTMLBadTable_001 3318 0.58 0.37 0.62 173 HTML_IMAGE_ONLY_20 3299 0.57 0.33 0.62 174 XMBody_95 3281 0.54 0.11 0.62 175 XMSubMetaI_00 3245 0.62 0.70 0.61 176 TR_MetaPhish_Combo_01 3106 0.69 1.30 0.58 177 XMMoneyMeta_00 3060 0.95 3.07 0.57 178 FORGED_GMAIL_RCVD 3049 0.62 0.91 0.57 179 SPOOFED_URL 2966 0.63 1.05 0.56 180 XMBody_78 2917 0.61 1.00 0.55 181 XMSlimDrugH 2917 0.66 1.30 0.55 182 T_XMHurry_00 2859 0.89 2.91 0.54 183 XM_B_REG_HTML 2855 0.48 0.17 0.54 184 TR_BOTNET_NEGATE 2849 0.57 0.77 0.53 185 XMOemUri 2835 0.50 0.34 0.53 186 XMBSHREFv2 2834 0.49 0.26 0.53 187 NUMERIC_HTTP_ADDR 2833 0.55 0.68 0.53 188 XMLngstWrd_00 2665 0.48 0.37 0.50 189 HTML_IMAGE_ONLY_28 2661 0.46 0.27 0.50 190 XM_B_COPY_HTML 2641 0.56 0.93 0.50 191 SPOOFED_URL_HOST 2605 0.55 0.92 0.49 192 SpammyFromTLD_02 2540 2.28 12.45 0.48 193 XMNoVowels 2538 0.45 0.31 0.48 194 T_TooManySym_04 2528 0.42 0.08 0.47 195 XM_USANA_RCVD 2523 0.40 0.00 0.47 196 HTML_TAG_BALANCE_BODY 2503 0.52 0.78 0.47 197 XMSubMetaSx_01 2422 0.45 0.41 0.45 198 TR_XM_COVIDMETA4 2395 0.81 2.87 0.45 199 SUBJ_DOLLARS 2380 0.68 2.03 0.45 200 NO_DNS_FOR_FROM 2352 0.51 0.88 0.44 ----------------------------------------------------------------------