Email: 687004 Autolearn: 0 AvgScore: 1.17 AvgScanTime: 1.12 sec Spam: 112796 Autolearn: 0 AvgScore: 14.00 AvgScanTime: 1.20 sec Ham: 574208 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 1.10 sec Time Spent Running SA: 213.82 hours Time Spent Processing Spam: 37.62 hours Time Spent Processing Ham: 176.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 110141 98.12 97.65 98.22 2 HTML_MESSAGE 104147 89.55 92.33 89.00 3 DKIM_SIGNED 79750 76.13 70.70 77.20 4 XM_DK_Pass 77223 74.77 68.46 76.01 5 DKIM_VALID 74510 72.53 66.06 73.80 6 RELAYCOUNTRY_US 70953 79.75 62.90 83.06 7 XM_B_Unicode 70370 69.66 62.39 71.09 8 XMListUnsubscribeExists 66941 54.68 59.35 53.77 9 XM_B_SpammyWords 65026 51.41 57.65 50.19 10 DKIM_VALID_AU 55007 54.52 48.77 55.65 11 XM_DK_Undo_02 49345 15.87 43.75 10.39 12 BAYES_99 43438 12.16 38.51 6.99 13 MIME_HTML_ONLY 41084 23.84 36.42 21.36 14 RELAYCOUNTRY_META 39110 10.18 34.67 5.36 15 XM_B_SpammyWords2 38803 24.88 34.40 23.01 16 BAYES_50 38220 50.01 33.88 53.18 17 DKIM_VALID_EF 35294 28.62 31.29 28.10 18 LOC_TINY_FONT_1 34058 25.72 30.19 24.85 19 XM_B_Unicode3 33957 38.26 30.10 39.86 20 BAYES_999 33547 9.47 29.74 5.49 21 XM_UncommonTLD01 32135 7.26 28.49 3.09 22 BOTNET 31285 6.32 27.74 2.11 23 XMSubLong 31161 22.61 27.63 21.63 24 RCVD_IN_MSPIKE_H2 30095 26.96 26.68 27.01 25 UNTRUSTED_Relay 29325 6.01 26.00 2.08 26 HTML_FONT_LOW_CONTRAST 28934 26.84 25.65 27.08 27 FVGT_m_MULTI_ODD 26326 22.75 23.34 22.63 28 T_KAM_HTML_FONT_INVALID 25098 20.07 22.25 19.64 29 BOTNET_IPINHOSTNAME 24883 8.15 22.06 5.42 30 T_TM2_M_HEADER_IN_MSG 23974 27.61 21.25 28.86 31 XM_Multi_Part_URI 22177 13.58 19.66 12.39 32 XM_Body_Dirty_Words 20494 13.90 18.17 13.06 33 SpammyFromTLD_02 19498 3.16 17.29 0.39 34 T_REMOTE_IMAGE 16899 5.10 14.98 3.16 35 LOTS_OF_MONEY 16705 8.65 14.81 7.44 36 KHOP_HELO_FCRDNS 14808 3.49 13.13 1.60 37 BODY_URI_ONLY 14386 2.22 12.75 0.15 38 XM_B_SpammyWords3 12942 7.11 11.47 6.25 39 RCVD_IN_MSPIKE_WL 12305 25.51 10.91 28.38 40 XM_B_Phish_Phrases 12118 7.42 10.74 6.77 41 XMSexyCombo_05 11997 5.15 10.64 4.08 42 XM_B_Unsub 11834 10.16 10.49 10.09 43 MPART_ALT_DIFF 11665 5.91 10.34 5.03 44 FROM_SUSPICIOUS_NTLD 11629 1.75 10.31 0.07 45 FROM_SUSPICIOUS_NTLD_FP 11549 1.73 10.24 0.05 46 DKIM_ADSP_NXDOMAIN 11045 2.05 9.79 0.52 47 MIME_HTML_MOSTLY 10919 3.63 9.68 2.44 48 T_HTML_TAG_BALANCE_CENTER 10882 1.69 9.65 0.13 49 XM_Evil_Numbers_Gen 10677 8.76 9.47 8.62 50 HTML_MIME_NO_HTML_TAG 10343 3.79 9.17 2.73 51 HDRS_MISSP 10255 1.52 9.09 0.03 52 XMBody_50 10185 1.48 9.03 0.00 53 RCVD_IN_BL_SPAMCOP_NET 10144 2.74 8.99 1.51 54 RCVD_IN_MSPIKE_BL 10075 2.38 8.93 1.09 55 BAYES_60 9187 6.96 8.14 6.73 56 LotsOfNums_01 9170 9.29 8.13 9.52 57 BAYES_80 8995 4.84 7.97 4.22 58 XM_UB50 8982 2.25 7.96 1.13 59 HTML_IMAGE_RATIO_02 8867 7.36 7.86 7.26 60 TR_XM_PhishingBody 8561 3.77 7.59 3.02 61 URI_PHP_REDIR 8371 1.25 7.42 0.03 62 RELAYCOUNTRY_CA 8328 2.72 7.38 1.80 63 RELAYCOUNTRY_IN 8202 1.27 7.27 0.10 64 FROM_EXCESS_BASE64 8144 3.47 7.22 2.73 65 XMSubMetaSx_00 7923 4.33 7.02 3.80 66 XM_UB99 7437 1.09 6.59 0.00 67 RCVD_IN_MSPIKE_H3 7226 14.47 6.41 16.06 68 RELAYCOUNTRY_FR 6736 1.22 5.97 0.29 69 SpammyFromTLD_01 6627 1.71 5.88 0.89 70 TR_Symld_Words 6545 2.62 5.80 1.99 71 XM_B_COVIDMETA 6330 2.12 5.61 1.43 72 XMBrknScrpt_02 6102 1.89 5.41 1.20 73 UNPARSEABLE_RELAY 6043 7.83 5.36 8.31 74 HTML_IMAGE_RATIO_04 6021 4.79 5.34 4.69 75 XMBody_17 5872 1.73 5.21 1.05 76 TooManyTo_001 5740 7.81 5.09 8.34 77 XM_SPF_SoftFail 5730 2.35 5.08 1.81 78 RCVD_IN_MSPIKE_L3 5656 1.33 5.01 0.60 79 XM_H_Long_From01 5589 5.63 4.95 5.76 80 BAYES_95 5574 3.07 4.94 2.70 81 HTML_FONT_TINY_NORDNS 5401 1.05 4.79 0.32 82 SHORTENED_URL_HREF 5367 1.05 4.76 0.32 83 XM_DIRTYINTL 5301 1.30 4.70 0.63 84 DKIM_INVALID 5240 3.60 4.65 3.40 85 XM_UB999 5226 0.76 4.63 0.00 86 TR_XM_SB_Phish 5117 2.42 4.54 2.00 87 XM_B_Phish66 5028 2.09 4.46 1.63 88 XMSubPhish11 4893 2.37 4.34 1.98 89 XM_SendGrid 4858 6.41 4.31 6.82 90 RCVD_IN_MSPIKE_H4 4818 9.41 4.27 10.41 91 XMNumbers 4617 3.14 4.09 2.95 92 RCVD_IN_RP_RNBL 4526 0.70 4.01 0.05 93 XM_UB60 4522 0.75 4.01 0.11 94 RELAYCOUNTRY_DE 4391 1.06 3.89 0.51 95 XM_B_SpammyTLD 4273 2.35 3.79 2.06 96 LH_URI_DOM_IN_PATH 4229 2.24 3.75 1.94 97 XMHTML_After_End 4152 1.34 3.68 0.88 98 HTML_SHORT_LINK_IMG_1 4150 0.62 3.68 0.02 99 SHORT_SHORTNER 4145 0.62 3.67 0.02 100 XM_BadFromFormat 4139 0.72 3.67 0.14 101 SHORTENED_URL_SRC 3969 0.58 3.52 0.00 102 XMStrtUSub 3961 4.26 3.51 4.41 103 XM_OfRef6 3956 1.62 3.51 1.25 104 SHORTENER_SHORT_IMG 3952 0.58 3.50 0.00 105 XM_JunkDunk 3949 0.57 3.50 0.00 106 T_XMDrugObfuBody_08 3921 1.89 3.48 1.58 107 ALL_TRUSTED 3665 11.41 3.25 13.02 108 TR_MetaPhish_Combo_01 3657 1.23 3.24 0.83 109 RCVD_IN_MSPIKE_L5 3628 0.78 3.22 0.30 110 BOTNET_NORDNS 3599 0.54 3.19 0.02 111 XMDiploma_00 3441 2.39 3.05 2.26 112 TM2_M_URI_OPT_OUT 3381 3.43 3.00 3.51 113 FROM_MISSP_REPLYTO 3367 0.49 2.99 0.00 114 XM_UB80 3350 0.52 2.97 0.04 115 TR_XM_UnparsRelay 3275 0.83 2.90 0.42 116 RCVD_IN_PSBL 3261 0.50 2.89 0.04 117 XM_URI_RBL 3233 0.62 2.87 0.18 118 URIBL_SBL_A 3163 0.62 2.80 0.19 119 XM_B_SpammyWords4 3132 1.13 2.78 0.80 120 TR_XM_MaxSPIKE 3131 0.49 2.78 0.04 121 XM_B_Unsub2 2998 2.74 2.66 2.76 122 TR_XM_COVIDMETA4 2967 0.92 2.63 0.59 123 TR_XM_COVIDMETA1 2918 0.68 2.59 0.31 124 BAYES_20 2851 3.60 2.53 3.81 125 HTML_IMAGE_RATIO_06 2776 4.05 2.46 4.36 126 HTML_IMAGE_ONLY_08 2775 0.50 2.46 0.11 127 SHORT_URI_3 2773 0.46 2.46 0.07 128 HTML_IMAGE_RATIO_08 2724 2.42 2.41 2.42 129 TR_XM_DK_SendGrid 2679 3.83 2.38 4.11 130 SUBJ_ALL_CAPS 2628 1.89 2.33 1.80 131 TR_LOTS_OF_MONEY3 2622 0.91 2.32 0.63 132 TR_XM_PHPDW 2559 0.64 2.27 0.32 133 TR_XM_PHPForged 2534 0.61 2.25 0.28 134 TR_XM_FormFill2 2496 0.60 2.21 0.28 135 XM_CamelCaseFrm001 2492 2.01 2.21 1.97 136 XM_H_PHPOS 2487 0.59 2.20 0.28 137 NO_FM_NAME_IP_HOSTN 2486 0.36 2.20 0.00 138 URI_HEX 2433 1.58 2.16 1.46 139 ZMIvirSobY_SUB39 2396 0.35 2.12 0.00 140 XM_UB95 2371 0.36 2.10 0.02 141 T_FILL_THIS_FORM_SHORT 2338 1.10 2.07 0.91 142 TR_XM_MaxBayes 2314 0.36 2.05 0.02 143 XMGenDplmaNmb 2302 1.32 2.04 1.18 144 MIME_QP_LONG_LINE 2278 5.20 2.02 5.82 145 TM2_M_VERY_LONG_WORD 2275 1.34 2.02 1.20 146 BAYES_40 2233 4.33 1.98 4.80 147 T_TooManySym_01 2147 3.87 1.90 4.26 148 DIET_1 2096 0.70 1.86 0.47 149 TR_XM_INV_DKIM 2075 0.38 1.84 0.10 150 TR_XM_RelayPhish 2022 0.41 1.79 0.14 151 T_XMDrugObfuBody_00 1995 0.94 1.77 0.78 152 RELAYCOUNTRY_GB 1928 1.06 1.71 0.93 153 XMSlimDrugH 1903 0.61 1.69 0.40 154 T_XMDrugObfuBody_14 1873 1.88 1.66 1.92 155 T_XMHurry_00 1860 0.85 1.65 0.70 156 XMSexyCombo_01 1852 0.87 1.64 0.71 157 T_PDS_OTHER_BAD_TLD 1798 0.67 1.59 0.48 158 URI_TRY_3LD 1757 1.50 1.56 1.49 159 XMPhish08 1729 0.68 1.53 0.51 160 MIME_HTML_ONLY_MULTI 1675 3.06 1.48 3.37 161 MAILING_LIST_MULTI 1658 2.24 1.47 2.39 162 DKIM_ADSP_CUSTOM_MED 1647 1.17 1.46 1.12 163 XM_DK_Undo_01 1639 1.77 1.45 1.83 164 XMStockSpam_06 1637 0.96 1.45 0.87 165 TM2_M_BODY_EMPTY 1614 0.80 1.43 0.67 166 MISSING_HEADERS 1598 0.79 1.42 0.67 167 XMSubNoVowel 1590 1.01 1.41 0.93 168 DATE_IN_PAST_03_06 1590 0.34 1.41 0.13 169 XMEmptyBody_01 1574 0.52 1.40 0.35 170 TR_Mismatch_TLD_02 1557 0.32 1.38 0.11 171 NML_ADSP_CUSTOM_MED 1518 0.87 1.35 0.78 172 SHORT_URI_2 1476 0.25 1.31 0.04 173 XMMoneyMeta_00 1455 0.75 1.29 0.65 174 XM_OfRef7 1407 0.37 1.25 0.20 175 MIME_CHARSET_FARAWAY 1391 0.28 1.23 0.09 176 RCVD_IN_IADB_LISTED 1380 4.67 1.22 5.34 177 HTML_IMAGE_ONLY_04 1375 0.24 1.22 0.04 178 XM_PDF 1362 3.61 1.21 4.08 179 XMBody_78 1348 0.62 1.20 0.50 180 TR_XM_FormFill 1348 0.22 1.20 0.03 181 HTTPS_HTTP_MISMATCH 1347 0.81 1.19 0.73 182 ANY_BOUNCE_MESSAGE 1343 2.90 1.19 3.23 183 BOUNCE_MESSAGE 1342 2.90 1.19 3.23 184 TR_LOTS_OF_MONEY2 1336 0.34 1.18 0.17 185 T_MONEY_PERCENT 1336 0.34 1.18 0.17 186 RDNS_DYNAMIC 1332 0.56 1.18 0.43 187 FORGED_GMAIL_RCVD 1301 0.67 1.15 0.58 188 XM_Nigeria_01 1273 0.22 1.13 0.05 189 XMSubMetaSxObfu_03 1263 0.57 1.12 0.46 190 NO_DNS_FOR_FROM 1230 0.53 1.09 0.42 191 HELO_NODOT 1230 1.62 1.09 1.72 192 XMBdyGiftCard01 1230 0.94 1.09 0.91 193 HELO_NO_DOMAIN 1219 1.61 1.08 1.72 194 BAYES_00 1187 12.69 1.05 14.98 195 T_Symld_Words_02 1180 0.70 1.05 0.63 196 TR_Mismatch_TLD_01 1151 0.42 1.02 0.30 197 REPLYTO_WITHOUT_TO_CC 1139 0.42 1.01 0.30 198 URI_NOVOWEL 1130 2.28 1.00 2.53 199 RCVD_IN_IADB_SPF 1129 4.05 1.00 4.65 200 XM_Combo_Sbj 1125 0.34 1.00 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 563966 98.12 97.65 98.22 2 HTML_MESSAGE 511043 89.55 92.33 89.00 3 RELAYCOUNTRY_US 476929 79.75 62.90 83.06 4 DKIM_SIGNED 443289 76.13 70.70 77.20 5 XM_DK_Pass 436464 74.77 68.46 76.01 6 DKIM_VALID 423785 72.53 66.06 73.80 7 XM_B_Unicode 408226 69.66 62.39 71.09 8 DKIM_VALID_AU 319551 54.52 48.77 55.65 9 XMListUnsubscribeExists 308727 54.68 59.35 53.77 10 BAYES_50 305362 50.01 33.88 53.18 11 XM_B_SpammyWords 288184 51.41 57.65 50.19 12 XM_B_Unicode3 228857 38.26 30.10 39.86 13 T_TM2_M_HEADER_IN_MSG 165740 27.61 21.25 28.86 14 RCVD_IN_MSPIKE_WL 162976 25.51 10.91 28.38 15 DKIM_VALID_EF 161353 28.62 31.29 28.10 16 HTML_FONT_LOW_CONTRAST 155480 26.84 25.65 27.08 17 RCVD_IN_MSPIKE_H2 155118 26.96 26.68 27.01 18 LOC_TINY_FONT_1 142670 25.72 30.19 24.85 19 XM_B_SpammyWords2 132099 24.88 34.40 23.01 20 FVGT_m_MULTI_ODD 129951 22.75 23.34 22.63 21 XMSubLong 124174 22.61 27.63 21.63 22 MIME_HTML_ONLY 122676 23.84 36.42 21.36 23 T_KAM_HTML_FONT_INVALID 112763 20.07 22.25 19.64 24 RCVD_IN_MSPIKE_H3 92207 14.47 6.41 16.06 25 BAYES_00 86011 12.69 1.05 14.98 26 XM_Body_Dirty_Words 75004 13.90 18.17 13.06 27 ALL_TRUSTED 74744 11.41 3.25 13.02 28 XM_Multi_Part_URI 71126 13.58 19.66 12.39 29 RCVD_IN_MSPIKE_H4 59796 9.41 4.27 10.41 30 XM_DK_Undo_02 59669 15.87 43.75 10.39 31 XM_B_Unsub 57963 10.16 10.49 10.09 32 TR_XM_DK_Bayes 55634 8.15 0.32 9.69 33 LotsOfNums_01 54666 9.29 8.13 9.52 34 TR_XM_DK_Bayes1 54077 7.92 0.29 9.42 35 XM_Evil_Numbers_Gen 49501 8.76 9.47 8.62 36 TR_XM_DK_Bayes2 48377 7.08 0.26 8.42 37 TooManyTo_001 47917 7.81 5.09 8.34 38 UNPARSEABLE_RELAY 47725 7.83 5.36 8.31 39 LOTS_OF_MONEY 42725 8.65 14.81 7.44 40 HTML_IMAGE_RATIO_02 41671 7.36 7.86 7.26 41 RCVD_IN_RP_SAFE 40512 5.99 0.59 7.06 42 BAYES_99 40136 12.16 38.51 6.99 43 XM_SendGrid 39168 6.41 4.31 6.82 44 XM_B_Phish_Phrases 38887 7.42 10.74 6.77 45 BAYES_60 38618 6.96 8.14 6.73 46 RCVD_IN_RP_CERTIFIED 37784 5.53 0.20 6.58 47 XM_DKIMWhitelistDomains 37745 5.49 0.00 6.57 48 XM_B_SpammyWords3 35910 7.11 11.47 6.25 49 IN_ZIMBRA_NJ_WHITELIST 34275 5.00 0.05 5.97 50 MIME_QP_LONG_LINE 33441 5.20 2.02 5.82 51 XM_H_Long_From01 33066 5.63 4.95 5.76 52 BAYES_999 31513 9.47 29.74 5.49 53 BOTNET_IPINHOSTNAME 31133 8.15 22.06 5.42 54 RELAYCOUNTRY_META 30794 10.18 34.67 5.36 55 RCVD_IN_IADB_LISTED 30680 4.67 1.22 5.34 56 MPART_ALT_DIFF 28908 5.91 10.34 5.03 57 BAYES_40 27544 4.33 1.98 4.80 58 HTML_IMAGE_RATIO_04 26914 4.79 5.34 4.69 59 RCVD_IN_IADB_SPF 26729 4.05 1.00 4.65 60 XMStrtUSub 25317 4.26 3.51 4.41 61 HTML_IMAGE_RATIO_06 25022 4.05 2.46 4.36 62 T_TooManySym_01 24450 3.87 1.90 4.26 63 BAYES_80 24229 4.84 7.97 4.22 64 RCVD_IN_IADB_SENDERID 23963 3.64 0.91 4.17 65 TR_XM_DK_SendGrid 23615 3.83 2.38 4.11 66 XM_PDF 23418 3.61 1.21 4.08 67 XMSexyCombo_05 23411 5.15 10.64 4.08 68 RCVD_IN_IADB_DK 23278 3.54 0.90 4.05 69 BAYES_20 21857 3.60 2.53 3.81 70 XMSubMetaSx_00 21824 4.33 7.02 3.80 71 TM2_M_URI_OPT_OUT 20177 3.43 3.00 3.51 72 DKIM_INVALID 19504 3.60 4.65 3.40 73 MIME_HTML_ONLY_MULTI 19336 3.06 1.48 3.37 74 ANY_BOUNCE_MESSAGE 18559 2.90 1.19 3.23 75 BOUNCE_MESSAGE 18553 2.90 1.19 3.23 76 RCVD_IN_IADB_VOUCHED 18493 2.81 0.70 3.22 77 T_REMOTE_IMAGE 18125 5.10 14.98 3.16 78 XM_UncommonTLD01 17747 7.26 28.49 3.09 79 TR_XM_PhishingBody 17366 3.77 7.59 3.02 80 XMNumbers 16958 3.14 4.09 2.95 81 XM_H_Trusted_IP 16095 2.34 0.00 2.80 82 XM_B_Unsub2 15837 2.74 2.66 2.76 83 HTML_MIME_NO_HTML_TAG 15686 3.79 9.17 2.73 84 FROM_EXCESS_BASE64 15675 3.47 7.22 2.73 85 BAYES_95 15501 3.07 4.94 2.70 86 BAYES_05 14942 2.34 0.98 2.60 87 URI_NOVOWEL 14500 2.28 1.00 2.53 88 MIME_HTML_MOSTLY 13994 3.63 9.68 2.44 89 HTML_IMAGE_RATIO_08 13873 2.42 2.41 2.42 90 MAILING_LIST_MULTI 13731 2.24 1.47 2.39 91 XMDiploma_00 12951 2.39 3.05 2.26 92 BOTNET 12127 6.32 27.74 2.11 93 RCVD_IN_IADB_OPTIN 12083 1.84 0.52 2.10 94 T_TooManySym_02 12079 1.88 0.73 2.10 95 UNTRUSTED_Relay 11950 6.01 26.00 2.08 96 XM_B_SpammyTLD 11844 2.35 3.79 2.06 97 TR_XM_SB_Phish 11511 2.42 4.54 2.00 98 TR_Symld_Words 11443 2.62 5.80 1.99 99 XMSubPhish11 11374 2.37 4.34 1.98 100 XM_CamelCaseFrm001 11339 2.01 2.21 1.97 101 LH_URI_DOM_IN_PATH 11158 2.24 3.75 1.94 102 TooManyTo_002 11129 1.76 0.84 1.94 103 T_XMDrugObfuBody_14 11047 1.88 1.66 1.92 104 RCVD_IN_MSPIKE_H5 10973 1.64 0.23 1.91 105 XM_DK_Undo_01 10536 1.77 1.45 1.83 106 XM_SPF_SoftFail 10421 2.35 5.08 1.81 107 SUBJ_ALL_CAPS 10342 1.89 2.33 1.80 108 RELAYCOUNTRY_CA 10336 2.72 7.38 1.80 109 IN_HORDE_ADDRESS_BOOK 10295 1.52 0.13 1.79 110 XM_GoogleGroups 10044 1.53 0.42 1.75 111 HELO_NODOT 9868 1.62 1.09 1.72 112 HELO_NO_DOMAIN 9851 1.61 1.08 1.72 113 TVD_RCVD_IP 9732 1.47 0.34 1.69 114 XM_B_Phish66 9343 2.09 4.46 1.63 115 KHOP_HELO_FCRDNS 9163 3.49 13.13 1.60 116 T_XMDrugObfuBody_08 9048 1.89 3.48 1.58 117 RCVD_IN_BL_SPAMCOP_NET 8683 2.74 8.99 1.51 118 URI_TRY_3LD 8564 1.50 1.56 1.49 119 URI_HEX 8411 1.58 2.16 1.46 120 XM_B_COVIDMETA 8232 2.12 5.61 1.43 121 HELO_MISC_IP 8115 1.25 0.44 1.41 122 CK_HELO_DYNAMIC_SPLIT_IP 8083 1.26 0.49 1.41 123 XM_H_Long_From02 7547 1.25 0.92 1.31 124 INVALID_MSGID 7343 1.15 0.49 1.28 125 TooManyTo_003 7303 1.17 0.64 1.27 126 XM_OfRef6 7195 1.62 3.51 1.25 127 XMGappySubj_01 6931 1.04 0.18 1.21 128 TM2_M_VERY_LONG_WORD 6903 1.34 2.02 1.20 129 XMBrknScrpt_02 6896 1.89 5.41 1.20 130 HTML_FONT_FACE_BAD 6814 1.09 0.61 1.19 131 XMGenDplmaNmb 6793 1.32 2.04 1.18 132 XMCapTrack 6640 1.05 0.52 1.16 133 XM_ShortIntro_01 6535 1.07 0.74 1.14 134 XM_UB50 6500 2.25 7.96 1.13 135 DKIM_ADSP_CUSTOM_MED 6421 1.17 1.46 1.12 136 TO_MALFORMED 6368 0.93 0.01 1.11 137 RCVD_IN_MSPIKE_BL 6266 2.38 8.93 1.09 138 XMBody_17 6035 1.73 5.21 1.05 139 RELAYCOUNTRY_GB 5347 1.06 1.71 0.93 140 XMSubNoVowel 5326 1.01 1.41 0.93 141 USER_IN_DEF_DKIM_WL 5231 0.76 0.00 0.91 142 TR_MSPIKEBAYES00 5230 0.76 0.01 0.91 143 T_FILL_THIS_FORM_SHORT 5228 1.10 2.07 0.91 144 XMBdyGiftCard01 5228 0.94 1.09 0.91 145 SpammyFromTLD_01 5096 1.71 5.88 0.89 146 XMHTML_After_End 5046 1.34 3.68 0.88 147 TooManyTo_004 5040 0.82 0.53 0.88 148 XMStockSpam_06 4968 0.96 1.45 0.87 149 T_TooManySym_03 4834 0.73 0.19 0.84 150 XM_ProductURIs 4833 0.79 0.54 0.84 151 TR_MetaPhish_Combo_01 4771 1.23 3.24 0.83 152 XM_B_SpammyWords4 4613 1.13 2.78 0.80 153 T_XMDrugObfuBody_00 4479 0.94 1.77 0.78 154 NML_ADSP_CUSTOM_MED 4457 0.87 1.35 0.78 155 HTTPS_HTTP_MISMATCH 4202 0.81 1.19 0.73 156 T_OBFU_PDF_ATTACH 4177 0.63 0.15 0.73 157 TooManyTo_005 4144 0.67 0.41 0.72 158 XMSexyCombo_01 4092 0.87 1.64 0.71 159 XMBody_95 4013 0.60 0.09 0.70 160 T_XMHurry_00 4006 0.85 1.65 0.70 161 TM2_M_BODY_EMPTY 3864 0.80 1.43 0.67 162 MISSING_HEADERS 3849 0.79 1.42 0.67 163 XMMoneyMeta_00 3714 0.75 1.29 0.65 164 XM_SPF_Unknown 3678 0.69 0.92 0.64 165 XM_H_PHPMailer 3650 0.68 0.88 0.64 166 T_Symld_Words_02 3635 0.70 1.05 0.63 167 XM_DIRTYINTL 3596 1.30 4.70 0.63 168 TR_LOTS_OF_MONEY3 3596 0.91 2.32 0.63 169 FROM_GOV_DKIM_AU 3475 0.52 0.11 0.61 170 XMSubEmpty 3469 0.57 0.38 0.60 171 RCVD_IN_MSPIKE_L3 3449 1.33 5.01 0.60 172 HTML_TAG_BALANCE_BODY 3446 0.62 0.73 0.60 173 TR_XM_COVIDMETA4 3386 0.92 2.63 0.59 174 FORGED_GMAIL_RCVD 3317 0.67 1.15 0.58 175 XMHTMLBadTable_001 3301 0.53 0.29 0.57 176 PLING_QUERY 3290 0.58 0.62 0.57 177 XMNoVowels 3243 0.55 0.45 0.56 178 XMSubMetaI_00 3216 0.58 0.71 0.56 179 TR_BOTNET_NEGATE 3206 0.58 0.67 0.56 180 TR_Sbj_FN_Bdy 3196 0.56 0.55 0.56 181 DKIM_ADSP_NXDOMAIN 3008 2.05 9.79 0.52 182 XMPhish08 2937 0.68 1.53 0.51 183 XMOemUri 2925 0.46 0.19 0.51 184 RELAYCOUNTRY_DE 2908 1.06 3.89 0.51 185 XMBody_78 2891 0.62 1.20 0.50 186 T_PDS_OTHER_BAD_TLD 2781 0.67 1.59 0.48 187 DIET_1 2694 0.70 1.86 0.47 188 HTML_IMAGE_ONLY_20 2660 0.42 0.18 0.46 189 T_TooManySym_04 2646 0.40 0.07 0.46 190 XMPhish14 2631 0.52 0.82 0.46 191 XMSubMetaSxObfu_03 2620 0.57 1.12 0.46 192 NUMERIC_HTTP_ADDR 2605 0.51 0.80 0.45 193 XMNoSubject 2604 0.40 0.15 0.45 194 MISSING_SUBJECT 2604 0.40 0.15 0.45 195 HTML_IMAGE_ONLY_32 2590 0.48 0.61 0.45 196 XMPhish30 2514 0.52 0.93 0.44 197 HTML_IMAGE_ONLY_28 2503 0.44 0.43 0.44 198 XMDateMe_00 2486 0.43 0.38 0.43 199 RDNS_DYNAMIC 2482 0.56 1.18 0.43 200 XM_B_REG_HTML 2475 0.38 0.11 0.43 ----------------------------------------------------------------------