Email: 706164 Autolearn: 0 AvgScore: 2.41 AvgScanTime: 1.17 sec Spam: 146796 Autolearn: 0 AvgScore: 14.72 AvgScanTime: 1.08 sec Ham: 559368 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 1.19 sec Time Spent Running SA: 229.61 hours Time Spent Processing Spam: 44.12 hours Time Spent Processing Ham: 185.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 141033 98.12 96.07 98.65 2 HTML_MESSAGE 136431 87.39 92.94 85.94 3 XM_B_Unicode 104446 70.93 71.15 70.87 4 XM_B_SpammyWords 92620 53.19 63.09 50.59 5 RELAYCOUNTRY_US 90315 76.71 61.52 80.70 6 DKIM_SIGNED 84515 73.71 57.57 77.94 7 XM_DK_Pass 81718 72.27 55.67 76.62 8 DKIM_VALID 79046 70.34 53.85 74.66 9 XMListUnsubscribeExists 72633 53.54 49.48 54.60 10 MIME_HTML_ONLY 67811 26.05 46.19 20.76 11 RCVD_IN_MSPIKE_H2 62875 30.77 42.83 27.60 12 DKIM_VALID_AU 60552 53.51 41.25 56.72 13 XM_B_Unicode3 57447 39.98 39.13 40.20 14 XM_DK_Undo_02 56330 17.08 38.37 11.49 15 BAYES_99 53870 13.68 36.70 7.64 16 RELAYCOUNTRY_META 52663 11.78 35.87 5.46 17 RCVD_IN_BL_SPAMCOP_NET 45204 7.92 30.79 1.92 18 BAYES_50 44222 46.60 30.12 50.92 19 BOTNET 43683 7.92 29.76 2.19 20 XM_B_SpammyWords2 43682 24.89 29.76 23.62 21 BAYES_999 40936 10.69 27.89 6.17 22 XMSubLong 39807 22.17 27.12 20.87 23 DKIM_VALID_EF 39420 27.80 26.85 28.05 24 HTML_MIME_NO_HTML_TAG 38383 7.21 26.15 2.24 25 HTML_FONT_LOW_CONTRAST 38132 28.44 25.98 29.09 26 LOC_TINY_FONT_1 37584 25.31 25.60 25.23 27 RCVD_IN_PSBL 36835 5.26 25.09 0.06 28 XM_B_Unsub 36546 13.09 24.90 9.99 29 UNTRUSTED_Relay 36515 7.01 24.87 2.32 30 XM_UncommonTLD01 30149 6.85 20.54 3.25 31 RCVD_IN_RP_RNBL 29128 4.18 19.84 0.07 32 XM_Multi_Part_URI 28689 14.41 19.54 13.06 33 T_KAM_HTML_FONT_INVALID 27514 19.10 18.74 19.19 34 FVGT_m_MULTI_ODD 26944 21.79 18.35 22.69 35 FROM_EXCESS_BASE64 26836 5.86 18.28 2.60 36 T_TM2_M_HEADER_IN_MSG 25145 25.55 17.13 27.75 37 T_TooManySym_01 20677 6.30 14.09 4.26 38 XM_Body_Dirty_Words 19837 13.28 13.51 13.22 39 BAYES_80 16780 5.91 11.43 4.46 40 BOTNET_IPINHOSTNAME 16765 6.66 11.42 5.41 41 SpammyFromTLD_02 16377 2.57 11.16 0.31 42 RCVD_IN_MSPIKE_BL 16142 3.12 11.00 1.05 43 XMSexyCombo_05 15687 5.58 10.69 4.24 44 MPART_ALT_DIFF 15266 5.54 10.40 4.27 45 XMSubGiftCard1 15128 2.25 10.31 0.13 46 HTML_IMAGE_RATIO_02 13990 8.14 9.53 7.78 47 BAYES_60 13743 7.38 9.36 6.86 48 LOTS_OF_MONEY 13704 7.96 9.34 7.60 49 MIME_HTML_MOSTLY 13567 3.65 9.24 2.18 50 T_REMOTE_IMAGE 13291 4.42 9.05 3.21 51 XM_UB50 13069 2.82 8.90 1.22 52 XM_B_SpammyWords3 12900 6.95 8.79 6.47 53 XM_B_Phish_Phrases 12608 6.89 8.59 6.44 54 RCVD_IN_MSPIKE_WL 12179 24.33 8.30 28.54 55 URI_PHP_REDIR 12025 1.72 8.19 0.02 56 KHOP_HELO_FCRDNS 11158 2.66 7.60 1.37 57 RCVD_IN_MSPIKE_L3 10640 2.06 7.25 0.70 58 XM_H_Long_From01 10598 6.00 7.22 5.69 59 BOTNET_NORDNS 10557 1.51 7.19 0.02 60 SpammyFromTLD_01 10448 2.31 7.12 1.05 61 HTML_FONT_TINY_NORDNS 10348 1.57 7.05 0.13 62 XM_Evil_Numbers_Gen 10286 8.35 7.01 8.71 63 BAYES_95 10227 3.62 6.97 2.74 64 XMSubMetaSx_00 10011 4.77 6.82 4.23 65 XMNumbers 9870 4.17 6.72 3.50 66 XM_UB99 9180 1.30 6.25 0.01 67 BODY_URI_ONLY 9162 1.33 6.24 0.04 68 HK_RANDOM_FROM 9083 1.37 6.19 0.11 69 RELAYCOUNTRY_FR 8602 1.44 5.86 0.28 70 LotsOfNums_01 8560 8.54 5.83 9.25 71 HTML_IMAGE_RATIO_08 7373 2.81 5.02 2.23 72 RELAYCOUNTRY_CA 7314 2.48 4.98 1.82 73 RELAYCOUNTRY_GB 7253 1.74 4.94 0.90 74 XMBrknScrpt_02 7171 2.30 4.89 1.62 75 XM_DIRTYINTL 7012 1.48 4.78 0.61 76 XM_SPF_SoftFail 6809 2.33 4.64 1.73 77 XM_UB999 6607 0.94 4.50 0.00 78 TR_XM_PhishingBody 6592 3.50 4.49 3.25 79 RCVD_IN_MSPIKE_H3 6560 13.66 4.47 16.08 80 RELAYCOUNTRY_IN 6069 0.94 4.13 0.10 81 TooManyTo_001 5943 7.56 4.05 8.48 82 SHORTENED_URL_HREF 5942 1.06 4.05 0.28 83 HTML_SHORT_LINK_IMG_1 5634 0.81 3.84 0.02 84 T_FILL_THIS_FORM_SHORT 5518 1.48 3.76 0.88 85 UNPARSEABLE_RELAY 5495 6.89 3.74 7.72 86 DKIM_INVALID 5469 3.37 3.73 3.28 87 FROM_SUSPICIOUS_NTLD 5402 0.81 3.68 0.06 88 SHORT_SHORTNER 5345 0.77 3.64 0.02 89 FROM_SUSPICIOUS_NTLD_FP 5329 0.79 3.63 0.05 90 XMBody_17 5296 1.71 3.61 1.21 91 XM_B_COVIDMETA 5284 1.75 3.60 1.27 92 SHORTENED_URL_SRC 5269 0.75 3.59 0.01 93 XM_B_SpammyTLD 5263 2.39 3.59 2.08 94 SHORTENER_SHORT_IMG 5246 0.74 3.57 0.00 95 URIBL_SBL_A 5199 0.98 3.54 0.30 96 RCVD_IN_MSPIKE_H4 5150 8.97 3.51 10.40 97 HTML_IMAGE_RATIO_04 4975 4.73 3.39 5.08 98 LH_URI_DOM_IN_PATH 4952 2.22 3.37 1.92 99 RCVD_IN_MSPIKE_L5 4856 0.91 3.31 0.28 100 DKIM_ADSP_NXDOMAIN 4836 1.24 3.29 0.70 101 T_TooManySym_02 4622 2.51 3.15 2.34 102 TR_XM_MaxBayes 4608 0.68 3.14 0.03 103 ALL_TRUSTED 4379 12.44 2.98 14.93 104 XM_UB60 4375 0.72 2.98 0.12 105 XM_SendGrid 4345 6.15 2.96 6.99 106 TR_XM_MaxSPIKE 4268 0.71 2.91 0.13 107 T_HTML_TAG_BALANCE_CENTER 4180 0.71 2.85 0.15 108 HTML_IMAGE_ONLY_20 4110 0.95 2.80 0.47 109 HDRS_MISSP 4046 0.64 2.76 0.08 110 T_XMDrugObfuBody_08 3997 1.94 2.72 1.74 111 HTML_SHORT_LINK_IMG_3 3980 0.61 2.71 0.06 112 XM_B_Phish66 3956 2.03 2.69 1.86 113 XM_UB80 3910 0.59 2.66 0.05 114 FROM_LOCAL_NOVOWEL 3816 0.56 2.60 0.02 115 XMBody_50 3793 0.54 2.58 0.00 116 HTML_IMAGE_ONLY_08 3753 0.61 2.56 0.10 117 XM_URI_RBL 3694 0.69 2.52 0.21 118 XM_OfRef6 3694 1.51 2.52 1.25 119 XM_CamelCaseFrm001 3565 2.00 2.43 1.89 120 TM2_M_URI_OPT_OUT 3515 2.97 2.39 3.12 121 SHORT_URI_3 3509 0.53 2.39 0.04 122 NORDNS_LOW_CONTRAST 3443 0.50 2.35 0.01 123 DKIM_ADSP_CUSTOM_MED 3149 1.31 2.15 1.10 124 XMBody_06 3109 0.44 2.12 0.01 125 XMStrtUSub 3029 3.75 2.06 4.19 126 NML_ADSP_CUSTOM_MED 3025 1.05 2.06 0.78 127 TR_XM_SB_Phish 3015 2.21 2.05 2.25 128 FVGT_m_MULTI_ODD_EMAIL 2996 0.46 2.04 0.04 129 XMSubPhish11 2950 2.18 2.01 2.23 130 TR_XM_FormFill 2875 0.42 1.96 0.02 131 RELAYCOUNTRY_DE 2853 0.83 1.94 0.54 132 XM_B_Unsub2 2840 2.00 1.93 2.02 133 FORGED_GMAIL_RCVD 2825 0.84 1.92 0.56 134 TR_XM_PHPDW 2800 0.69 1.91 0.36 135 TR_XM_PHPForged 2786 0.67 1.90 0.35 136 XM_UB95 2767 0.41 1.88 0.03 137 TR_XM_FormFill2 2739 0.66 1.87 0.35 138 XM_H_PHPOS 2732 0.66 1.86 0.34 139 URI_TRY_3LD 2669 1.69 1.82 1.66 140 HTML_IMAGE_RATIO_06 2655 2.96 1.81 3.26 141 RELAYCOUNTRY_AU 2599 0.70 1.77 0.42 142 BAYES_40 2526 4.30 1.72 4.98 143 T_XMDrugObfuBody_00 2512 1.22 1.71 1.09 144 XM_JunkDunk 2481 0.35 1.69 0.00 145 XM_B_SpammyWords4 2478 1.11 1.69 0.95 146 TR_XM_COVIDMETA4 2461 0.74 1.68 0.49 147 BAYES_20 2458 4.96 1.67 5.82 148 XMDiploma_00 2439 1.69 1.66 1.69 149 SUBJ_ALL_CAPS 2327 1.40 1.59 1.35 150 MIME_QP_LONG_LINE 2309 4.89 1.57 5.76 151 URI_HEX 2301 1.57 1.57 1.58 152 TR_XM_UnparsRelay 2260 0.72 1.54 0.51 153 TR_XM_COVIDMETA1 2241 0.62 1.53 0.38 154 TM2_M_VERY_LONG_WORD 2239 1.31 1.53 1.26 155 TR_LOTS_OF_MONEY3 2238 0.80 1.52 0.61 156 SHORT_URI_2 2192 0.33 1.49 0.03 157 TM2_M_BODY_EMPTY 2068 0.67 1.41 0.48 158 TR_XM_INV_DKIM 2047 0.39 1.39 0.12 159 XMEmptyBody_01 2032 0.43 1.38 0.18 160 HTML_IMAGE_ONLY_04 2015 0.32 1.37 0.04 161 TO_NO_BRKTS_HTML_ONLY 2009 0.40 1.37 0.15 162 TR_XM_RelayPhish 1994 0.39 1.36 0.14 163 URI_NO_WWW_BIZ_CGI 1961 0.30 1.34 0.02 164 T_PDS_OTHER_BAD_TLD 1905 0.66 1.30 0.50 165 XMSexyCombo_01 1870 0.95 1.27 0.87 166 XM_BadFromFormat 1867 0.42 1.27 0.19 167 MIME_HTML_ONLY_MULTI 1857 2.14 1.27 2.37 168 TR_Symld_Words 1771 1.81 1.21 1.97 169 DATE_IN_PAST_03_06 1767 0.33 1.20 0.11 170 T_XMDrugObfuBody_14 1759 1.51 1.20 1.59 171 HELO_NODOT 1711 1.47 1.17 1.55 172 HELO_NO_DOMAIN 1707 1.47 1.16 1.55 173 XMGenDplmaNmb 1702 0.95 1.16 0.90 174 XMHTML_After_End 1661 0.87 1.13 0.80 175 BAYES_00 1660 11.20 1.13 13.85 176 RELAYCOUNTRY_IE 1620 0.37 1.10 0.18 177 RDNS_DYNAMIC 1615 0.60 1.10 0.47 178 T_XMHurry_00 1586 0.81 1.08 0.74 179 XMBody_78 1576 0.55 1.07 0.42 180 TR_XM_DK_SendGrid 1568 3.49 1.07 4.12 181 RCVD_IN_IADB_LISTED 1528 4.26 1.04 5.11 182 RELAYCOUNTRY_JP 1519 0.26 1.03 0.06 183 XMStockSpam_06 1518 1.19 1.03 1.23 184 XMSubNoVowel 1505 0.75 1.03 0.68 185 MAILING_LIST_MULTI 1483 2.07 1.01 2.35 186 MIME_CHARSET_FARAWAY 1458 0.29 0.99 0.11 187 TR_Mismatch_TLD_02 1441 0.29 0.98 0.11 188 RELAYCOUNTRY_IL 1425 0.21 0.97 0.01 189 XMSubMetaSSx_00 1422 0.35 0.97 0.19 190 XM_PDF 1422 3.35 0.97 3.98 191 XMSlimDrugH 1415 0.49 0.96 0.37 192 RELAYCOUNTRY_KR 1409 0.21 0.96 0.02 193 XM_SPF_Unknown 1379 0.75 0.94 0.69 194 CHARSET_FARAWAY_HEADER 1374 0.23 0.94 0.05 195 XMGppyBdWords 1332 0.31 0.91 0.15 196 LOW_PRICE 1319 0.38 0.90 0.25 197 TR_MetaPhish_Combo_01 1310 0.86 0.89 0.85 198 RELAYCOUNTRY_NL 1310 0.35 0.89 0.21 199 BAYES_05 1301 2.34 0.89 2.72 200 HTTPS_HTTP_MISMATCH 1284 0.80 0.87 0.79 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 551825 98.12 96.07 98.65 2 HTML_MESSAGE 480707 87.39 92.94 85.94 3 RELAYCOUNTRY_US 451393 76.71 61.52 80.70 4 DKIM_SIGNED 435990 73.71 57.57 77.94 5 XM_DK_Pass 428608 72.27 55.67 76.62 6 DKIM_VALID 417647 70.34 53.85 74.66 7 XM_B_Unicode 396422 70.93 71.15 70.87 8 DKIM_VALID_AU 317298 53.51 41.25 56.72 9 XMListUnsubscribeExists 305417 53.54 49.48 54.60 10 BAYES_50 284826 46.60 30.12 50.92 11 XM_B_SpammyWords 283000 53.19 63.09 50.59 12 XM_B_Unicode3 224863 39.98 39.13 40.20 13 HTML_FONT_LOW_CONTRAST 162698 28.44 25.98 29.09 14 RCVD_IN_MSPIKE_WL 159632 24.33 8.30 28.54 15 DKIM_VALID_EF 156915 27.80 26.85 28.05 16 T_TM2_M_HEADER_IN_MSG 155245 25.55 17.13 27.75 17 RCVD_IN_MSPIKE_H2 154400 30.77 42.83 27.60 18 LOC_TINY_FONT_1 141142 25.31 25.60 25.23 19 XM_B_SpammyWords2 132116 24.89 29.76 23.62 20 FVGT_m_MULTI_ODD 126914 21.79 18.35 22.69 21 XMSubLong 116724 22.17 27.12 20.87 22 MIME_HTML_ONLY 116110 26.05 46.19 20.76 23 T_KAM_HTML_FONT_INVALID 107354 19.10 18.74 19.19 24 RCVD_IN_MSPIKE_H3 89919 13.66 4.47 16.08 25 ALL_TRUSTED 83494 12.44 2.98 14.93 26 BAYES_00 77452 11.20 1.13 13.85 27 XM_Body_Dirty_Words 73940 13.28 13.51 13.22 28 XM_Multi_Part_URI 73071 14.41 19.54 13.06 29 XM_DK_Undo_02 64271 17.08 38.37 11.49 30 TR_XM_DK_Bayes 58160 8.28 0.22 10.40 31 RCVD_IN_MSPIKE_H4 58158 8.97 3.51 10.40 32 TR_XM_DK_Bayes1 56336 8.02 0.21 10.07 33 XM_B_Unsub 55865 13.09 24.90 9.99 34 LotsOfNums_01 51730 8.54 5.83 9.25 35 TR_XM_DK_Bayes2 50447 7.18 0.17 9.02 36 XM_Evil_Numbers_Gen 48710 8.35 7.01 8.71 37 TooManyTo_001 47423 7.56 4.05 8.48 38 HTML_IMAGE_RATIO_02 43501 8.14 9.53 7.78 39 UNPARSEABLE_RELAY 43173 6.89 3.74 7.72 40 BAYES_99 42761 13.68 36.70 7.64 41 RCVD_IN_RP_SAFE 42606 6.12 0.44 7.62 42 LOTS_OF_MONEY 42526 7.96 9.34 7.60 43 XM_DKIMWhitelistDomains 40249 5.70 0.00 7.20 44 RCVD_IN_RP_CERTIFIED 40233 5.76 0.32 7.19 45 XM_SendGrid 39080 6.15 2.96 6.99 46 BAYES_60 38395 7.38 9.36 6.86 47 XM_B_SpammyWords3 36190 6.95 8.79 6.47 48 XM_B_Phish_Phrases 36020 6.89 8.59 6.44 49 BAYES_999 34536 10.69 27.89 6.17 50 BAYES_20 32578 4.96 1.67 5.82 51 MIME_QP_LONG_LINE 32231 4.89 1.57 5.76 52 XM_H_Long_From01 31807 6.00 7.22 5.69 53 ANY_BOUNCE_MESSAGE 30578 4.42 0.44 5.47 54 BOUNCE_MESSAGE 30577 4.42 0.43 5.47 55 RELAYCOUNTRY_META 30528 11.78 35.87 5.46 56 IN_ZIMBRA_NJ_WHITELIST 30523 4.33 0.04 5.46 57 BOTNET_IPINHOSTNAME 30234 6.66 11.42 5.41 58 RCVD_IN_IADB_LISTED 28572 4.26 1.04 5.11 59 HTML_IMAGE_RATIO_04 28425 4.73 3.39 5.08 60 BAYES_40 27846 4.30 1.72 4.98 61 RCVD_IN_IADB_SPF 25092 3.73 0.87 4.49 62 BAYES_80 24941 5.91 11.43 4.46 63 MPART_ALT_DIFF 23880 5.54 10.40 4.27 64 T_TooManySym_01 23822 6.30 14.09 4.26 65 XMSexyCombo_05 23712 5.58 10.69 4.24 66 XMSubMetaSx_00 23647 4.77 6.82 4.23 67 XMStrtUSub 23430 3.75 2.06 4.19 68 TR_XM_DK_SendGrid 23065 3.49 1.07 4.12 69 RCVD_IN_IADB_SENDERID 22597 3.37 0.81 4.04 70 XM_PDF 22241 3.35 0.97 3.98 71 RCVD_IN_IADB_DK 22046 3.29 0.80 3.94 72 XMNumbers 19562 4.17 6.72 3.50 73 DKIM_INVALID 18343 3.37 3.73 3.28 74 HTML_IMAGE_RATIO_06 18256 2.96 1.81 3.26 75 XM_UncommonTLD01 18198 6.85 20.54 3.25 76 TR_XM_PhishingBody 18156 3.50 4.49 3.25 77 T_REMOTE_IMAGE 17943 4.42 9.05 3.21 78 TM2_M_URI_OPT_OUT 17476 2.97 2.39 3.12 79 RCVD_IN_IADB_VOUCHED 16812 2.50 0.58 3.01 80 BAYES_95 15326 3.62 6.97 2.74 81 BAYES_05 15226 2.34 0.89 2.72 82 FROM_EXCESS_BASE64 14539 5.86 18.28 2.60 83 MIME_HTML_ONLY_MULTI 13275 2.14 1.27 2.37 84 MAILING_LIST_MULTI 13153 2.07 1.01 2.35 85 T_TooManySym_02 13108 2.51 3.15 2.34 86 UNTRUSTED_Relay 12970 7.01 24.87 2.32 87 TR_XM_SB_Phish 12579 2.21 2.05 2.25 88 HTML_MIME_NO_HTML_TAG 12544 7.21 26.15 2.24 89 HTML_IMAGE_RATIO_08 12493 2.81 5.02 2.23 90 XMSubPhish11 12455 2.18 2.01 2.23 91 URI_NOVOWEL 12370 1.92 0.82 2.21 92 BOTNET 12223 7.92 29.76 2.19 93 MIME_HTML_MOSTLY 12214 3.65 9.24 2.18 94 XM_B_SpammyTLD 11642 2.39 3.59 2.08 95 RCVD_IN_MSPIKE_H5 11555 1.70 0.32 2.07 96 XM_B_Unsub2 11299 2.00 1.93 2.02 97 TR_Symld_Words 11037 1.81 1.21 1.97 98 RCVD_IN_IADB_OPTIN 11021 1.65 0.45 1.97 99 RCVD_IN_BL_SPAMCOP_NET 10742 7.92 30.79 1.92 100 TooManyTo_002 10738 1.66 0.67 1.92 101 LH_URI_DOM_IN_PATH 10737 2.22 3.37 1.92 102 XM_CamelCaseFrm001 10575 2.00 2.43 1.89 103 XM_B_Phish66 10411 2.03 2.69 1.86 104 RELAYCOUNTRY_CA 10180 2.48 4.98 1.82 105 T_XMDrugObfuBody_08 9729 1.94 2.72 1.74 106 XM_SPF_SoftFail 9665 2.33 4.64 1.73 107 XMDiploma_00 9464 1.69 1.66 1.69 108 URI_TRY_3LD 9273 1.69 1.82 1.66 109 XM_DK_Undo_01 9142 1.44 0.68 1.63 110 XMBrknScrpt_02 9081 2.30 4.89 1.62 111 T_XMDrugObfuBody_14 8872 1.51 1.20 1.59 112 URI_HEX 8813 1.57 1.57 1.58 113 HELO_NODOT 8691 1.47 1.17 1.55 114 HELO_NO_DOMAIN 8690 1.47 1.16 1.55 115 TVD_RCVD_IP 8425 1.27 0.37 1.51 116 KHOP_HELO_FCRDNS 7643 2.66 7.60 1.37 117 SUBJ_ALL_CAPS 7559 1.40 1.59 1.35 118 INVALID_MSGID 7447 1.16 0.52 1.33 119 IN_HORDE_ADDRESS_BOOK 7295 1.06 0.12 1.30 120 XM_H_Long_From02 7219 1.18 0.75 1.29 121 TooManyTo_003 7137 1.11 0.49 1.28 122 XM_B_COVIDMETA 7092 1.75 3.60 1.27 123 TM2_M_VERY_LONG_WORD 7036 1.31 1.53 1.26 124 HELO_MISC_IP 7024 1.12 0.58 1.26 125 CK_HELO_DYNAMIC_SPLIT_IP 7021 1.15 0.75 1.26 126 XM_OfRef6 6997 1.51 2.52 1.25 127 XMStockSpam_06 6895 1.19 1.03 1.23 128 XM_UB50 6830 2.82 8.90 1.22 129 XMBody_17 6763 1.71 3.61 1.21 130 XM_GoogleGroups 6674 1.01 0.29 1.19 131 XMCapTrack 6447 1.00 0.43 1.15 132 XMGappySubj_01 6365 0.92 0.11 1.14 133 TO_MALFORMED 6277 0.89 0.01 1.12 134 DKIM_ADSP_CUSTOM_MED 6127 1.31 2.15 1.10 135 T_XMDrugObfuBody_00 6105 1.22 1.71 1.09 136 SpammyFromTLD_01 5883 2.31 7.12 1.05 137 RCVD_IN_MSPIKE_BL 5873 3.12 11.00 1.05 138 USER_IN_DEF_DKIM_WL 5461 0.77 0.00 0.98 139 XM_B_SpammyWords4 5339 1.11 1.69 0.95 140 TR_MSPIKEBAYES00 5307 0.75 0.01 0.95 141 T_TooManySym_03 5218 0.79 0.24 0.93 142 TooManyTo_004 5090 0.81 0.42 0.91 143 XMGenDplmaNmb 5030 0.95 1.16 0.90 144 RELAYCOUNTRY_GB 5030 1.74 4.94 0.90 145 T_FILL_THIS_FORM_SHORT 4923 1.48 3.76 0.88 146 XMSexyCombo_01 4871 0.95 1.27 0.87 147 TR_MetaPhish_Combo_01 4730 0.86 0.89 0.85 148 HTML_FONT_FACE_BAD 4481 0.72 0.42 0.80 149 XMHTML_After_End 4461 0.87 1.13 0.80 150 HTTPS_HTTP_MISMATCH 4397 0.80 0.87 0.79 151 NML_ADSP_CUSTOM_MED 4362 1.05 2.06 0.78 152 XMBdyGiftCard01 4306 0.77 0.78 0.77 153 XM_ProductURIs 4259 0.71 0.52 0.76 154 T_XMHurry_00 4140 0.81 1.08 0.74 155 TooManyTo_005 4029 0.64 0.33 0.72 156 XM_ShortIntro_01 3936 0.64 0.38 0.70 157 DKIM_ADSP_NXDOMAIN 3908 1.24 3.29 0.70 158 RCVD_IN_MSPIKE_L3 3889 2.06 7.25 0.70 159 XM_SPF_Unknown 3886 0.75 0.94 0.69 160 XM_H_Trusted_IP 3859 0.55 0.02 0.69 161 TR_BOTNET_NEGATE 3827 0.63 0.40 0.68 162 XMSubNoVowel 3783 0.75 1.03 0.68 163 XMSubMetaI_00 3517 0.60 0.47 0.63 164 TR_LOTS_OF_MONEY3 3424 0.80 1.52 0.61 165 XM_DIRTYINTL 3418 1.48 4.78 0.61 166 XMBody_95 3403 0.49 0.06 0.61 167 XMMoneyMeta_00 3400 0.64 0.78 0.61 168 T_OBFU_PDF_ATTACH 3378 0.50 0.11 0.60 169 XMNoVowels 3195 0.51 0.29 0.57 170 FROM_GOV_DKIM_AU 3157 0.46 0.08 0.56 171 T_Symld_Words_02 3147 0.57 0.60 0.56 172 FORGED_GMAIL_RCVD 3122 0.84 1.92 0.56 173 XMHTMLBadTable_001 3081 0.51 0.36 0.55 174 RELAYCOUNTRY_DE 3018 0.83 1.94 0.54 175 HTML_TAG_BALANCE_BODY 2945 0.56 0.69 0.53 176 TR_XM_UnparsRelay 2852 0.72 1.54 0.51 177 XMPhish14 2791 0.50 0.51 0.50 178 T_PDS_OTHER_BAD_TLD 2774 0.66 1.30 0.50 179 TR_XM_COVIDMETA4 2762 0.74 1.68 0.49 180 MPART_ALT_DIFF_COUNT 2742 0.52 0.62 0.49 181 T_TooManySym_04 2728 0.39 0.03 0.49 182 TM2_M_BODY_EMPTY 2694 0.67 1.41 0.48 183 XM_H_PHPMailer 2679 0.51 0.65 0.48 184 RDNS_DYNAMIC 2652 0.60 1.10 0.47 185 NUMERIC_HTTP_ADDR 2635 0.53 0.75 0.47 186 XMPhish30 2633 0.51 0.67 0.47 187 HTML_IMAGE_ONLY_20 2620 0.95 2.80 0.47 188 NO_DNS_FOR_FROM 2529 0.53 0.80 0.45 189 XM_S_SubURI 2467 0.36 0.07 0.44 190 HTML_IMAGE_ONLY_28 2435 0.40 0.26 0.44 191 XMSubMetaSxObfu_03 2370 0.47 0.65 0.42 192 RELAYCOUNTRY_AU 2370 0.70 1.77 0.42 193 XMPhish08 2354 0.48 0.72 0.42 194 XMBody_78 2341 0.55 1.07 0.42 195 XM_B_REG_HTML 2310 0.36 0.18 0.41 196 TM2_M_A_HREF_HREF 2290 0.44 0.58 0.41 197 RCVD_IN_SORBS_DUL 2270 0.39 0.31 0.41 198 HTML_IMAGE_ONLY_32 2263 0.41 0.43 0.40 199 XMSolicitRefs_0 2250 0.40 0.38 0.40 200 MISSING_HEADERS 2236 0.44 0.59 0.40 ----------------------------------------------------------------------