Email: 682519 Autolearn: 0 AvgScore: 1.13 AvgScanTime: 1.18 sec Spam: 114897 Autolearn: 0 AvgScore: 12.49 AvgScanTime: 1.36 sec Ham: 567622 Autolearn: 0 AvgScore: -1.17 AvgScanTime: 1.14 sec Time Spent Running SA: 223.45 hours Time Spent Processing Spam: 43.43 hours Time Spent Processing Ham: 180.02 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 112811 98.59 98.18 98.67 2 HTML_MESSAGE 106623 88.72 92.80 87.89 3 DKIM_SIGNED 84498 77.72 73.54 78.56 4 XM_DK_Pass 81591 76.28 71.01 77.35 5 XM_B_Unicode 81433 69.31 70.87 68.99 6 RELAYCOUNTRY_US 80055 79.15 69.68 81.06 7 DKIM_VALID 79390 74.32 69.10 75.37 8 XM_B_SpammyWords 76648 55.21 66.71 52.89 9 XMListUnsubscribeExists 67840 53.97 59.04 52.94 10 DKIM_VALID_AU 57422 55.85 49.98 57.04 11 XM_DK_Undo_02 52527 17.03 45.72 11.22 12 XM_B_SpammyWords2 47750 27.66 41.56 24.84 13 BAYES_50 42008 50.83 36.56 53.72 14 XM_B_Unicode3 41333 38.84 35.97 39.42 15 BAYES_99 40708 11.91 35.43 7.14 16 MIME_HTML_ONLY 37193 21.75 32.37 19.60 17 HTML_FONT_LOW_CONTRAST 34030 27.84 29.62 27.47 18 LOC_TINY_FONT_1 32177 25.63 28.01 25.15 19 BAYES_999 31608 9.42 27.51 5.76 20 DKIM_VALID_EF 31583 29.53 27.49 29.94 21 RCVD_IN_MSPIKE_H2 31385 26.16 27.32 25.92 22 FVGT_m_MULTI_ODD 31250 23.26 27.20 22.47 23 BOTNET 28961 6.41 25.21 2.60 24 RELAYCOUNTRY_META 28311 9.03 24.64 5.87 25 T_TM2_M_HEADER_IN_MSG 28168 28.56 24.52 29.38 26 UNTRUSTED_Relay 24985 5.80 21.75 2.57 27 XMSubLong 24436 21.08 21.27 21.05 28 T_KAM_HTML_FONT_INVALID 22455 19.32 19.54 19.27 29 XM_Multi_Part_URI 21049 12.96 18.32 11.87 30 XM_Body_Dirty_Words 18779 13.38 16.34 12.79 31 TR_XM_SpammyWords2 18281 4.16 15.91 1.78 32 BOTNET_IPINHOSTNAME 16949 6.91 14.75 5.33 33 XM_B_Unsub 16934 11.53 14.74 10.88 34 LOTS_OF_MONEY 16881 9.28 14.69 8.19 35 XM_B_SpammyWords3 16747 7.43 14.58 5.98 36 RCVD_IN_MSPIKE_BL 16605 3.14 14.45 0.85 37 XM_B_Phish_Phrases 16036 7.83 13.96 6.59 38 XM_UncommonTLD01 15817 4.92 13.77 3.13 39 RCVD_IN_MSPIKE_WL 13659 25.37 11.89 28.10 40 LotsOfNums_01 12910 9.58 11.24 9.24 41 T_REMOTE_IMAGE 12213 4.48 10.63 3.24 42 XMSexyCombo_05 11754 4.85 10.23 3.76 43 XM_Evil_Numbers_Gen 11533 8.83 10.04 8.59 44 RCVD_IN_BL_SPAMCOP_NET 10073 2.90 8.77 1.71 45 MIME_HTML_MOSTLY 9763 3.32 8.50 2.28 46 SHORT_URI_3 9070 1.36 7.89 0.04 47 XMNumbers 9013 4.20 7.84 3.47 48 SHORTENED_URL_HREF 9000 1.55 7.83 0.27 49 XM_UB50 8916 2.32 7.76 1.22 50 MPART_ALT_DIFF 8815 4.79 7.67 4.20 51 BODY_URI_ONLY 8810 1.34 7.67 0.06 52 BAYES_80 8808 5.08 7.67 4.55 53 HTML_IMAGE_ONLY_08 8758 1.38 7.62 0.12 54 HTML_SHORT_LINK_IMG_1 8755 1.31 7.62 0.03 55 KHOP_HELO_FCRDNS 8753 2.49 7.62 1.45 56 SHORT_SHORTNER 8685 1.29 7.56 0.02 57 SHORTENED_URL_SRC 8597 1.26 7.48 0.00 58 SHORTENER_SHORT_IMG 8592 1.26 7.48 0.00 59 XMSubMetaSx_00 8452 4.51 7.36 3.94 60 RCVD_IN_MSPIKE_L3 8032 1.67 6.99 0.59 61 TR_XM_SpammyWords3 8008 1.61 6.97 0.52 62 RCVD_IN_RP_RNBL 7679 1.17 6.68 0.05 63 HTML_IMAGE_RATIO_02 7660 7.10 6.67 7.18 64 BOTNET_NORDNS 7628 1.49 6.64 0.45 65 RCVD_IN_MSPIKE_L5 7548 1.27 6.57 0.19 66 BAYES_60 7508 6.81 6.53 6.87 67 XM_B_COVIDMETA 7288 2.49 6.34 1.71 68 TM2_M_URI_OPT_OUT 7270 3.74 6.33 3.22 69 RCVD_IN_MSPIKE_H3 7206 14.22 6.27 15.83 70 RELAYCOUNTRY_CA 7169 2.54 6.24 1.79 71 TR_XM_PhishingBody 7023 3.93 6.11 3.49 72 TooManyTo_001 6519 8.74 5.67 9.36 73 XM_SPF_SoftFail 6338 2.61 5.52 2.02 74 UNPARSEABLE_RELAY 6021 7.27 5.24 7.68 75 SpammyFromTLD_01 6005 1.67 5.23 0.95 76 XM_B_SpammyTLD 5974 2.38 5.20 1.81 77 RCVD_IN_MSPIKE_H4 5912 9.32 5.15 10.17 78 XMBrknScrpt_02 5871 1.87 5.11 1.22 79 XM_H_Long_From01 5616 5.52 4.89 5.65 80 ANY_BOUNCE_MESSAGE 5429 3.56 4.73 3.32 81 BOUNCE_MESSAGE 5429 3.56 4.73 3.32 82 XM_B_Unsub2 5237 3.39 4.56 3.15 83 URIBL_SBL_A 5188 0.98 4.52 0.26 84 BAYES_95 5159 2.99 4.49 2.68 85 RELAYCOUNTRY_IN 5128 0.86 4.46 0.13 86 DKIM_INVALID 5108 3.40 4.45 3.19 87 RCVD_IN_PSBL 4981 0.78 4.34 0.06 88 XMStrtUSub 4960 4.97 4.32 5.10 89 HTML_IMAGE_RATIO_04 4846 4.88 4.22 5.02 90 SpammyFromTLD_02 4640 0.88 4.04 0.24 91 FROM_EXCESS_BASE64 4598 2.79 4.00 2.55 92 XM_SendGrid 4505 6.48 3.92 6.99 93 XM_B_Phish66 4419 1.94 3.85 1.55 94 T_FONT_INVIS_NAKED_TO 4354 2.41 3.79 2.13 95 XM_OfRef6 4205 1.76 3.66 1.38 96 XMBody_17 4004 1.22 3.48 0.76 97 XM_UB99 3944 0.59 3.43 0.01 98 BAYES_40 3858 4.88 3.36 5.18 99 T_XMDrugObfuBody_08 3838 2.10 3.34 1.85 100 TR_XM_COVIDMETA4 3803 0.95 3.31 0.47 101 TR_XM_MaxSPIKE 3780 0.58 3.29 0.03 102 TR_LOTS_OF_MONEY3 3673 1.07 3.20 0.64 103 XM_DIRTYINTL 3660 0.96 3.19 0.51 104 XM_B_SpammyWords4 3481 1.09 3.03 0.70 105 HTML_IMAGE_RATIO_08 3401 2.53 2.96 2.44 106 TR_XM_UnparsRelay 3386 0.89 2.95 0.47 107 TR_XM_MaxBayes 3284 0.52 2.86 0.05 108 SUBJ_ALL_CAPS 3235 1.56 2.82 1.30 109 XM_URI_RBL 3227 0.64 2.81 0.20 110 XM_UB60 3220 0.58 2.80 0.13 111 URI_OPTOUT_3LD 3211 0.60 2.79 0.15 112 URI_PHP_REDIR 3119 0.47 2.71 0.01 113 TR_XM_SB_Phish 3118 2.59 2.71 2.57 114 XMDiploma_00 3069 2.24 2.67 2.15 115 XMSubPhish11 3047 2.55 2.65 2.53 116 TO_IN_SUBJ 3046 0.49 2.65 0.05 117 BAYES_20 2948 3.84 2.57 4.10 118 HTML_IMAGE_RATIO_06 2882 3.34 2.51 3.50 119 MIME_CHARSET_FARAWAY 2850 0.51 2.48 0.12 120 XM_UB999 2808 0.42 2.44 0.01 121 RELAYCOUNTRY_FR 2788 0.63 2.43 0.27 122 XM_UB80 2783 0.44 2.42 0.04 123 FROM_SUSPICIOUS_NTLD 2711 0.45 2.36 0.06 124 T_TooManySym_01 2679 4.09 2.33 4.44 125 XMSubNoVowel 2667 0.98 2.32 0.71 126 T_PDS_OTHER_BAD_TLD 2666 0.78 2.32 0.47 127 TR_XM_PHPDW 2610 0.68 2.27 0.35 128 XMLngstWrd_00 2610 0.70 2.27 0.38 129 URI_TRY_3LD 2609 1.73 2.27 1.62 130 MIME_QP_LONG_LINE 2604 5.12 2.27 5.70 131 T_FILL_THIS_FORM_SHORT 2598 1.27 2.26 1.07 132 T_XMHurry_00 2598 1.05 2.26 0.81 133 TR_XM_COVIDMETA1 2560 0.69 2.23 0.38 134 TR_XM_PHPForged 2555 0.66 2.22 0.34 135 TR_XM_FormFill2 2543 0.65 2.21 0.34 136 XM_H_PHPOS 2535 0.65 2.21 0.33 137 TM2_M_VERY_LONG_WORD 2521 1.26 2.19 1.07 138 FROM_SUSPICIOUS_NTLD_FP 2470 0.41 2.15 0.05 139 LH_URI_DOM_IN_PATH 2470 1.86 2.15 1.80 140 HTML_MIME_NO_HTML_TAG 2452 2.32 2.13 2.36 141 TR_XM_DK_SendGrid 2439 3.88 2.12 4.24 142 TR_Symld_Words 2406 1.91 2.09 1.87 143 ALL_TRUSTED 2374 12.29 2.07 14.36 144 XM_CamelCaseFrm001 2361 1.92 2.05 1.89 145 BAYES_00 2320 11.18 2.02 13.04 146 CHARSET_FARAWAY_HEADER 2268 0.37 1.97 0.04 147 XMSexyCombo_01 2154 0.83 1.87 0.62 148 XMStockSpam_06 2079 2.79 1.81 2.99 149 URI_HEX 2054 1.46 1.79 1.39 150 XM_UB95 2054 0.32 1.79 0.02 151 NUMERIC_HTTP_ADDR 2031 0.81 1.77 0.61 152 XMHTML_After_End 1969 1.03 1.71 0.89 153 T_XMDrugObfuBody_14 1968 1.52 1.71 1.48 154 XMLngstWrd_01 1947 0.55 1.69 0.32 155 TR_XM_INV_DKIM 1913 0.37 1.66 0.11 156 T_XMDrugObfuBody_00 1891 0.90 1.65 0.75 157 RDNS_DYNAMIC 1848 0.66 1.61 0.46 158 MIME_HTML_ONLY_MULTI 1811 2.03 1.58 2.12 159 XMGenDplmaNmb 1747 1.18 1.52 1.11 160 XM_Lotto 1718 0.35 1.50 0.12 161 XM_BadFromFormat 1715 0.41 1.49 0.19 162 XM_OfRef7 1705 0.45 1.48 0.25 163 TR_Mismatch_TLD_01 1680 0.52 1.46 0.32 164 RELAYCOUNTRY_DE 1676 0.84 1.46 0.71 165 XM_SPF_Unknown 1667 0.76 1.45 0.62 166 DKIM_ADSP_CUSTOM_MED 1629 1.14 1.42 1.08 167 TR_MetaPhish_Combo_01 1589 1.10 1.38 1.04 168 NORMAL_HTTP_TO_IP 1579 0.29 1.37 0.07 169 TR_XM_RelayPhish 1567 0.36 1.36 0.16 170 NO_DNS_FOR_FROM 1534 0.60 1.34 0.46 171 MIMEOLE_DIRECT_TO_MX 1533 0.23 1.33 0.00 172 NML_ADSP_CUSTOM_MED 1519 0.87 1.32 0.77 173 XMBody_78 1503 0.67 1.31 0.54 174 TR_XM_FormFill 1500 0.25 1.31 0.04 175 DATE_IN_PAST_03_06 1485 0.31 1.29 0.11 176 HELO_NODOT 1475 1.40 1.28 1.42 177 HELO_NO_DOMAIN 1475 1.40 1.28 1.42 178 DOS_OE_TO_MX 1455 0.21 1.27 0.00 179 MAILING_LIST_MULTI 1450 2.25 1.26 2.45 180 SUBJ_ILLEGAL_CHARS 1407 0.21 1.22 0.01 181 SUBJECT_NEEDS_ENCODING 1407 0.21 1.22 0.01 182 HK_RANDOM_REPLYTO 1393 0.38 1.21 0.21 183 RELAYCOUNTRY_GB 1367 0.94 1.19 0.89 184 URI_NOVOWEL 1364 2.20 1.19 2.41 185 BAYES_05 1337 2.44 1.16 2.70 186 RCVD_IN_IADB_LISTED 1321 4.49 1.15 5.17 187 XM_PDF 1303 3.07 1.13 3.46 188 RELAYCOUNTRY_NL 1288 0.58 1.12 0.47 189 FORGED_GMAIL_RCVD 1287 0.66 1.12 0.57 190 XMSubMetaSxObfu_03 1279 0.68 1.11 0.59 191 TR_Caps_n_Bayes_99 1278 0.26 1.11 0.09 192 XMLngstWrd_02 1272 0.39 1.11 0.25 193 RELAYCOUNTRY_JP 1268 0.22 1.10 0.04 194 TR_Mismatch_TLD_02 1254 0.25 1.09 0.08 195 XM_S_SpammyWords 1249 0.50 1.09 0.38 196 TR_XM_Spammywords 1248 0.50 1.09 0.38 197 REMOVE_BEFORE_LINK 1237 0.38 1.08 0.24 198 HTTPS_HTTP_MISMATCH 1202 0.73 1.05 0.67 199 XMMoneyMeta_00 1195 0.61 1.04 0.52 200 XMGppyBdWords 1121 0.37 0.98 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 560095 98.59 98.18 98.67 2 HTML_MESSAGE 498905 88.72 92.80 87.89 3 RELAYCOUNTRY_US 460136 79.15 69.68 81.06 4 DKIM_SIGNED 445949 77.72 73.54 78.56 5 XM_DK_Pass 439042 76.28 71.01 77.35 6 DKIM_VALID 427842 74.32 69.10 75.37 7 XM_B_Unicode 391611 69.31 70.87 68.99 8 DKIM_VALID_AU 323779 55.85 49.98 57.04 9 BAYES_50 304942 50.83 36.56 53.72 10 XMListUnsubscribeExists 300482 53.97 59.04 52.94 11 XM_B_SpammyWords 300193 55.21 66.71 52.89 12 XM_B_Unicode3 223735 38.84 35.97 39.42 13 DKIM_VALID_EF 169942 29.53 27.49 29.94 14 T_TM2_M_HEADER_IN_MSG 166780 28.56 24.52 29.38 15 RCVD_IN_MSPIKE_WL 159523 25.37 11.89 28.10 16 HTML_FONT_LOW_CONTRAST 155954 27.84 29.62 27.47 17 RCVD_IN_MSPIKE_H2 147133 26.16 27.32 25.92 18 LOC_TINY_FONT_1 142769 25.63 28.01 25.15 19 XM_B_SpammyWords2 141025 27.66 41.56 24.84 20 FVGT_m_MULTI_ODD 127537 23.26 27.20 22.47 21 XMSubLong 119470 21.08 21.27 21.05 22 MIME_HTML_ONLY 111281 21.75 32.37 19.60 23 T_KAM_HTML_FONT_INVALID 109383 19.32 19.54 19.27 24 RCVD_IN_MSPIKE_H3 89878 14.22 6.27 15.83 25 ALL_TRUSTED 81518 12.29 2.07 14.36 26 BAYES_00 74014 11.18 2.02 13.04 27 XM_Body_Dirty_Words 72571 13.38 16.34 12.79 28 XM_Multi_Part_URI 67385 12.96 18.32 11.87 29 XM_DK_Undo_02 63673 17.03 45.72 11.22 30 XM_B_Unsub 61755 11.53 14.74 10.88 31 TR_XM_DK_Bayes 57796 8.55 0.51 10.18 32 RCVD_IN_MSPIKE_H4 57701 9.32 5.15 10.17 33 TR_XM_DK_Bayes1 56453 8.35 0.49 9.95 34 TooManyTo_001 53102 8.74 5.67 9.36 35 LotsOfNums_01 52454 9.58 11.24 9.24 36 TR_XM_DK_Bayes2 50441 7.46 0.41 8.89 37 XM_Evil_Numbers_Gen 48732 8.83 10.04 8.59 38 XM_DKIMWhitelistDomains 47550 6.97 0.01 8.38 39 LOTS_OF_MONEY 46468 9.28 14.69 8.19 40 UNPARSEABLE_RELAY 43589 7.27 5.24 7.68 41 RCVD_IN_RP_SAFE 42038 6.29 0.76 7.41 42 HTML_IMAGE_RATIO_02 40777 7.10 6.67 7.18 43 BAYES_99 40548 11.91 35.43 7.14 44 XM_SendGrid 39699 6.48 3.92 6.99 45 RCVD_IN_RP_CERTIFIED 39497 5.87 0.48 6.96 46 BAYES_60 39000 6.81 6.53 6.87 47 XM_B_Phish_Phrases 37410 7.83 13.96 6.59 48 IN_ZIMBRA_NJ_WHITELIST 37189 5.45 0.03 6.55 49 XM_B_SpammyWords3 33935 7.43 14.58 5.98 50 RELAYCOUNTRY_META 33308 9.03 24.64 5.87 51 BAYES_999 32711 9.42 27.51 5.76 52 MIME_QP_LONG_LINE 32374 5.12 2.27 5.70 53 XM_H_Long_From01 32056 5.52 4.89 5.65 54 BOTNET_IPINHOSTNAME 30232 6.91 14.75 5.33 55 BAYES_40 29427 4.88 3.36 5.18 56 RCVD_IN_IADB_LISTED 29329 4.49 1.15 5.17 57 XMStrtUSub 28976 4.97 4.32 5.10 58 HTML_IMAGE_RATIO_04 28481 4.88 4.22 5.02 59 BAYES_80 25838 5.08 7.67 4.55 60 RCVD_IN_IADB_SPF 25436 3.89 0.96 4.48 61 T_TooManySym_01 25215 4.09 2.33 4.44 62 TR_XM_DK_SendGrid 24059 3.88 2.12 4.24 63 MPART_ALT_DIFF 23844 4.79 7.67 4.20 64 BAYES_20 23271 3.84 2.57 4.10 65 RCVD_IN_IADB_SENDERID 22614 3.46 0.88 3.98 66 XMSubMetaSx_00 22343 4.51 7.36 3.94 67 RCVD_IN_IADB_DK 21906 3.36 0.89 3.86 68 XMSexyCombo_05 21333 4.85 10.23 3.76 69 HTML_IMAGE_RATIO_06 19895 3.34 2.51 3.50 70 TR_XM_PhishingBody 19800 3.93 6.11 3.49 71 XMNumbers 19670 4.20 7.84 3.47 72 XM_PDF 19648 3.07 1.13 3.46 73 TooManyTo_002 18922 2.90 0.74 3.33 74 ANY_BOUNCE_MESSAGE 18853 3.56 4.73 3.32 75 BOUNCE_MESSAGE 18851 3.56 4.73 3.32 76 RCVD_IN_IADB_VOUCHED 18508 2.81 0.58 3.26 77 T_REMOTE_IMAGE 18382 4.48 10.63 3.24 78 TM2_M_URI_OPT_OUT 18274 3.74 6.33 3.22 79 DKIM_INVALID 18107 3.40 4.45 3.19 80 XM_B_Unsub2 17884 3.39 4.56 3.15 81 XM_UncommonTLD01 17739 4.92 13.77 3.13 82 XMStockSpam_06 16985 2.79 1.81 2.99 83 BAYES_05 15309 2.44 1.16 2.70 84 BAYES_95 15232 2.99 4.49 2.68 85 BOTNET 14774 6.41 25.21 2.60 86 UNTRUSTED_Relay 14599 5.80 21.75 2.57 87 TR_XM_SB_Phish 14560 2.59 2.71 2.57 88 FROM_EXCESS_BASE64 14449 2.79 4.00 2.55 89 XMSubPhish11 14352 2.55 2.65 2.53 90 MAILING_LIST_MULTI 13883 2.25 1.26 2.45 91 HTML_IMAGE_RATIO_08 13835 2.53 2.96 2.44 92 URI_NOVOWEL 13658 2.20 1.19 2.41 93 HTML_MIME_NO_HTML_TAG 13403 2.32 2.13 2.36 94 T_TooManySym_02 13197 2.03 0.56 2.32 95 MIME_HTML_MOSTLY 12927 3.32 8.50 2.28 96 RCVD_IN_IADB_OPTIN 12246 1.87 0.46 2.16 97 XMDiploma_00 12202 2.24 2.67 2.15 98 T_FONT_INVIS_NAKED_TO 12064 2.41 3.79 2.13 99 MIME_HTML_ONLY_MULTI 12038 2.03 1.58 2.12 100 RCVD_IN_MSPIKE_H5 11944 1.83 0.47 2.10 101 XM_SPF_SoftFail 11452 2.61 5.52 2.02 102 XM_CamelCaseFrm001 10744 1.92 2.05 1.89 103 TR_Symld_Words 10627 1.91 2.09 1.87 104 T_XMDrugObfuBody_08 10492 2.10 3.34 1.85 105 XM_B_SpammyTLD 10263 2.38 5.20 1.81 106 LH_URI_DOM_IN_PATH 10226 1.86 2.15 1.80 107 RELAYCOUNTRY_CA 10134 2.54 6.24 1.79 108 TR_XM_SpammyWords2 10132 4.16 15.91 1.78 109 XM_DK_Undo_01 10057 1.63 0.95 1.77 110 RCVD_IN_BL_SPAMCOP_NET 9705 2.90 8.77 1.71 111 XM_B_COVIDMETA 9703 2.49 6.34 1.71 112 URI_TRY_3LD 9221 1.73 2.27 1.62 113 XM_B_Phish66 8790 1.94 3.85 1.55 114 TVD_RCVD_IP 8587 1.31 0.32 1.51 115 T_XMDrugObfuBody_14 8404 1.52 1.71 1.48 116 KHOP_HELO_FCRDNS 8217 2.49 7.62 1.45 117 HELO_NODOT 8079 1.40 1.28 1.42 118 HELO_NO_DOMAIN 8072 1.40 1.28 1.42 119 URI_HEX 7899 1.46 1.79 1.39 120 XM_OfRef6 7841 1.76 3.66 1.38 121 INVALID_MSGID 7709 1.22 0.56 1.36 122 IN_HORDE_ADDRESS_BOOK 7700 1.15 0.15 1.36 123 TooManyTo_003 7629 1.21 0.56 1.34 124 SUBJ_ALL_CAPS 7407 1.56 2.82 1.30 125 XM_UB50 6917 2.32 7.76 1.22 126 XMBrknScrpt_02 6898 1.87 5.11 1.22 127 CK_HELO_DYNAMIC_SPLIT_IP 6859 1.13 0.72 1.21 128 HELO_MISC_IP 6857 1.08 0.43 1.21 129 XM_H_Long_From02 6739 1.14 0.90 1.19 130 XMGappySubj_01 6598 0.99 0.13 1.16 131 XMCapTrack 6494 1.02 0.42 1.14 132 TO_MALFORMED 6463 0.95 0.01 1.14 133 XM_GoogleGroups 6444 1.01 0.40 1.14 134 XMBSHREFv2 6313 1.00 0.43 1.11 135 XMGenDplmaNmb 6297 1.18 1.52 1.11 136 DKIM_ADSP_CUSTOM_MED 6145 1.14 1.42 1.08 137 USER_IN_DEF_DKIM_WL 6102 0.90 0.01 1.08 138 TM2_M_VERY_LONG_WORD 6050 1.26 2.19 1.07 139 T_FILL_THIS_FORM_SHORT 6049 1.27 2.26 1.07 140 TR_MetaPhish_Combo_01 5923 1.10 1.38 1.04 141 TooManyTo_004 5737 0.92 0.46 1.01 142 SpammyFromTLD_01 5395 1.67 5.23 0.95 143 XMHTML_After_End 5045 1.03 1.71 0.89 144 RELAYCOUNTRY_GB 5037 0.94 1.19 0.89 145 T_TooManySym_03 5021 0.76 0.16 0.88 146 TR_MSPIKEBAYES00 4916 0.72 0.00 0.87 147 RCVD_IN_MSPIKE_BL 4817 3.14 14.45 0.85 148 XM_ProductURIs 4783 0.80 0.58 0.84 149 TooManyTo_005 4639 0.74 0.38 0.82 150 XMSubMetaI_00 4577 0.80 0.80 0.81 151 T_XMHurry_00 4571 1.05 2.26 0.81 152 XM_H_Trusted_IP 4392 0.64 0.00 0.77 153 NML_ADSP_CUSTOM_MED 4386 0.87 1.32 0.77 154 XMBody_17 4321 1.22 3.48 0.76 155 TR_BOTNET_NEGATE 4308 0.72 0.56 0.76 156 XMPhish14 4277 0.77 0.84 0.75 157 T_XMDrugObfuBody_00 4230 0.90 1.65 0.75 158 XMNoVowels 4085 0.71 0.68 0.72 159 RELAYCOUNTRY_DE 4040 0.84 1.46 0.71 160 XMSubNoVowel 4024 0.98 2.32 0.71 161 XM_ShortIntro_01 4018 0.69 0.59 0.71 162 XM_B_SpammyWords4 3987 1.09 3.03 0.70 163 T_Symld_Words_02 3968 0.72 0.85 0.70 164 HTTPS_HTTP_MISMATCH 3803 0.73 1.05 0.67 165 XMBody_95 3749 0.56 0.09 0.66 166 TR_LOTS_OF_MONEY3 3615 1.07 3.20 0.64 167 XMPhish08 3598 0.66 0.78 0.63 168 XMHTMLBadTable_001 3555 0.57 0.31 0.63 169 XMSexyCombo_01 3518 0.83 1.87 0.62 170 XM_SPF_Unknown 3506 0.76 1.45 0.62 171 NUMERIC_HTTP_ADDR 3469 0.81 1.77 0.61 172 XMSubMetaSxObfu_03 3372 0.68 1.11 0.59 173 RCVD_IN_MSPIKE_L3 3371 1.67 6.99 0.59 174 HTML_FONT_FACE_BAD 3267 0.58 0.63 0.58 175 FORGED_GMAIL_RCVD 3244 0.66 1.12 0.57 176 SENDGRID_REDIR 3242 0.57 0.54 0.57 177 XMBdyGiftCard01 3221 0.59 0.71 0.57 178 T_OBFU_PDF_ATTACH 3182 0.49 0.15 0.56 179 DKIM_ADSP_NXDOMAIN 3158 0.60 0.79 0.56 180 XMPhish30 3099 0.58 0.77 0.55 181 XMBody_78 3080 0.67 1.31 0.54 182 TR_XM_SpammyWords3 2950 1.61 6.97 0.52 183 XMMoneyMeta_00 2937 0.61 1.04 0.52 184 XM_DIRTYINTL 2915 0.96 3.19 0.51 185 FROM_GOV_DKIM_AU 2904 0.44 0.07 0.51 186 T_TooManySym_04 2800 0.42 0.07 0.49 187 XM_B_COPY_HTML 2728 0.50 0.60 0.48 188 HTML_TAG_BALANCE_BODY 2720 0.52 0.70 0.48 189 MISSING_HEADERS 2716 0.50 0.62 0.48 190 RELAYCOUNTRY_NL 2682 0.58 1.12 0.47 191 TR_XM_UnparsRelay 2679 0.89 2.95 0.47 192 TR_XM_COVIDMETA4 2671 0.95 3.31 0.47 193 T_PDS_OTHER_BAD_TLD 2658 0.78 2.32 0.47 194 RDNS_DYNAMIC 2627 0.66 1.61 0.46 195 HTML_IMAGE_ONLY_20 2606 0.46 0.45 0.46 196 NO_DNS_FOR_FROM 2592 0.60 1.34 0.46 197 HTML_IMAGE_ONLY_24 2566 0.43 0.34 0.45 198 HTML_IMAGE_ONLY_28 2554 0.42 0.29 0.45 199 BOTNET_NORDNS 2543 1.49 6.64 0.45 200 TM2_M_BODY_EMPTY 2523 0.38 0.07 0.44 ----------------------------------------------------------------------