Email: 704647 Autolearn: 0 AvgScore: 3.21 AvgScanTime: 1.39 sec Spam: 207119 Autolearn: 0 AvgScore: 13.76 AvgScanTime: 1.60 sec Ham: 497528 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 1.30 sec Time Spent Running SA: 271.10 hours Time Spent Processing Spam: 91.86 hours Time Spent Processing Ham: 179.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 199576 89.35 96.36 86.44 2 DKIM_SIGNED 182968 81.10 88.34 78.08 3 XM_DK_Pass 179206 79.76 86.52 76.95 4 DKIM_VALID 175490 77.95 84.73 75.12 5 DCC_CHECK 164349 54.11 79.35 43.60 6 XM_B_Unicode 163911 73.31 79.14 70.88 7 RELAYCOUNTRY_US 159176 82.66 76.85 85.08 8 XMListUnsubscribeExists 152551 56.89 73.65 49.91 9 XM_B_SpammyWords 148723 56.68 71.81 50.39 10 DKIM_VALID_AU 131837 59.26 63.65 57.43 11 XM_DK_Undo_02 103887 20.75 50.16 8.50 12 XM_B_Unicode3 88589 42.42 42.77 42.27 13 XM_B_SpammyWords2 87508 26.32 42.25 19.69 14 TR_XM_DKIM_Undo 85273 16.30 41.17 5.94 15 LOC_TINY_FONT_1 79572 29.05 38.42 25.15 16 BAYES_50 76849 49.06 37.10 54.04 17 BAYES_99 74868 14.47 36.15 5.45 18 HTML_FONT_LOW_CONTRAST 71348 29.94 34.45 28.06 19 DKIM_VALID_EF 67825 31.31 32.75 30.71 20 MIME_HTML_ONLY 66935 24.73 32.32 21.57 21 RCVD_IN_MSPIKE_H2 65704 28.42 31.72 27.05 22 BAYES_999 58983 11.46 28.48 4.37 23 TR_DCC_Bayes_99 57997 10.31 28.00 2.95 24 FVGT_m_MULTI_ODD 57505 23.96 27.76 22.37 25 T_KAM_HTML_FONT_INVALID 55288 20.77 26.69 18.30 26 XMSubLong 53375 22.00 25.77 20.43 27 RELAYCOUNTRY_META 45878 9.60 22.15 4.37 28 RCVD_IN_MSPIKE_WL 44917 29.67 21.69 32.99 29 T_TM2_M_HEADER_IN_MSG 40953 25.00 19.77 27.18 30 DCC_CHECK_NEGATIVE 39406 43.99 19.03 54.39 31 XM_Body_Dirty_Words 39268 14.70 18.96 12.93 32 XM_Multi_Part_URI 34063 13.42 16.45 12.15 33 BOTNET 30973 5.78 14.95 1.96 34 LOTS_OF_MONEY 30875 9.73 14.91 7.58 35 XM_B_SpammyWords3 30440 7.63 14.70 4.68 36 TR_XM_SpammyWords2 29125 4.62 14.06 0.69 37 UNTRUSTED_Relay 28501 5.22 13.76 1.66 38 XM_UncommonTLD01 27207 6.13 13.14 3.21 39 BOTNET_IPINHOSTNAME 27178 7.21 13.12 4.75 40 TR_XM_SpammyWords4 26590 7.34 12.84 5.05 41 XM_B_Unsub 25945 10.97 12.53 10.32 42 RCVD_IN_MSPIKE_H3 24650 14.87 11.90 16.11 43 RCVD_IN_BL_SPAMCOP_NET 22824 4.15 11.02 1.29 44 XM_Evil_Numbers_Gen 22485 9.61 10.86 9.08 45 HTML_IMAGE_RATIO_02 21968 7.96 10.61 6.86 46 MPART_ALT_DIFF 21504 6.89 10.38 5.43 47 XMSexyCombo_05 21459 6.10 10.36 4.32 48 FSL_BULK_SIG 19527 6.79 9.43 5.70 49 LotsOfNums_01 19445 9.05 9.39 8.91 50 RCVD_IN_MSPIKE_H4 18134 10.89 8.76 11.78 51 UNPARSEABLE_RELAY 17104 8.12 8.26 8.07 52 XM_B_Phish_Phrases 16873 8.40 8.15 8.50 53 TR_XM_UnparsRelay 16611 6.63 8.02 6.05 54 MIME_HTML_MOSTLY 16196 3.97 7.82 2.37 55 BAYES_80 16055 5.69 7.75 4.83 56 XM_H_Long_From01 15882 6.21 7.67 5.61 57 RELAYCOUNTRY_CA 15443 3.09 7.46 1.27 58 BAYES_60 15316 7.56 7.39 7.62 59 TR_XM_PhishingBody 13719 3.81 6.62 2.64 60 SpammyFromTLD_02 13651 2.20 6.59 0.38 61 XM_SendGrid 13350 6.95 6.45 7.16 62 XMSubMetaSx_00 13030 4.51 6.29 3.77 63 TooManyTo_001 12820 7.34 6.19 7.82 64 URIBL_SBL_A 12736 3.15 6.15 1.90 65 HTML_IMAGE_RATIO_04 12365 6.39 5.97 6.56 66 XMNumbers 11003 3.76 5.31 3.12 67 T_REMOTE_IMAGE 10582 3.83 5.11 3.30 68 RCVD_IN_RP_SAFE 10199 7.29 4.92 8.28 69 KHOP_HELO_FCRDNS 9956 2.57 4.81 1.64 70 TR_XM_SpammyWords5 9935 2.41 4.80 1.41 71 BAYES_95 9770 3.55 4.72 3.06 72 XM_OfRef6 9234 1.97 4.46 0.93 73 SpammyFromTLD_01 9223 1.82 4.45 0.72 74 XM_UB50 8761 1.96 4.23 1.02 75 FROM_EXCESS_BASE64 8521 3.20 4.11 2.82 76 TR_XM_MaxBayes 8348 1.22 4.03 0.05 77 TM2_M_URI_OPT_OUT 8284 3.04 4.00 2.64 78 XM_B_SpammyTLD 8202 2.72 3.96 2.20 79 XM_DK_Undo_01 8038 2.16 3.88 1.44 80 XM_UB99 8026 1.14 3.88 0.00 81 RELAYCOUNTRY_FR 7820 1.29 3.78 0.25 82 XMBody_17 7798 1.66 3.76 0.78 83 MIME_QP_LONG_LINE 7686 5.27 3.71 5.92 84 RCVD_IN_RP_CERTIFIED 7578 6.42 3.66 7.57 85 DKIM_INVALID 7478 3.15 3.61 2.96 86 URI_HEX 7454 2.09 3.60 1.46 87 TR_XM_DK_SendGrid 7379 4.31 3.56 4.62 88 BODY_URI_ONLY 7275 1.05 3.51 0.03 89 XM_SPF_SoftFail 6939 2.16 3.35 1.67 90 RELAYCOUNTRY_IN 6846 1.05 3.31 0.11 91 XMBdyGiftCard01 6712 1.58 3.24 0.89 92 XM_UB999 6688 0.95 3.23 0.00 93 MIME_HTML_ONLY_MULTI 6652 3.52 3.21 3.64 94 TR_LOTS_OF_MONEY3 6647 1.25 3.21 0.43 95 T_FILL_THIS_FORM_SHORT 6551 1.48 3.16 0.78 96 XMStrtUSub 6475 6.94 3.13 8.52 97 HTML_IMAGE_ONLY_12 6466 1.05 3.12 0.19 98 XM_B_Phish66 6435 1.99 3.11 1.53 99 HTML_SHORT_LINK_IMG_1 6004 0.88 2.90 0.04 100 HTML_IMAGE_RATIO_06 5842 3.59 2.82 3.91 101 HTML_IMAGE_RATIO_08 5799 2.49 2.80 2.37 102 T_TooManySym_01 5702 4.06 2.75 4.60 103 RCVD_IN_PSBL 5677 0.89 2.74 0.11 104 T_XMDrugObfuBody_08 5568 1.90 2.69 1.57 105 TM2_M_VERY_LONG_WORD 5492 1.79 2.65 1.44 106 RCVD_IN_MSPIKE_BL 5482 0.91 2.65 0.19 107 HTML_FONT_SIZE_LARGE 5473 0.85 2.64 0.11 108 TR_XM_MSPIKECOMBO 5393 0.89 2.60 0.18 109 XM_CamelCaseFrm001 5367 2.01 2.59 1.77 110 URIBL_DBL_SPAM 5359 0.77 2.59 0.01 111 XM_DIRTYINTL 5199 0.99 2.51 0.35 112 RCVD_IN_IADB_LISTED 5134 4.96 2.48 5.99 113 XM_B_COVIDMETA 5098 1.39 2.46 0.95 114 XMDiploma_00 4780 1.81 2.31 1.60 115 RCVD_IN_RP_RNBL 4711 0.69 2.27 0.03 116 SUBJ_ALL_CAPS 4705 1.77 2.27 1.57 117 T_XMDrugObfuBody_14 4647 2.23 2.24 2.22 118 RCVD_IN_IADB_SPF 4607 4.33 2.22 5.21 119 PDS_OTHER_BAD_TLD 4594 1.12 2.22 0.66 120 XM_B_Unsub2 4572 1.78 2.21 1.61 121 BAYES_40 4498 4.35 2.17 5.26 122 TR_XM_SB_Phish 4481 2.04 2.16 1.99 123 XMBrknScrpt_02 4471 1.11 2.16 0.67 124 RCVD_IN_IADB_SENDERID 4346 3.90 2.10 4.65 125 RCVD_IN_IADB_DK 4341 3.79 2.10 4.49 126 TR_Symld_Words 4326 1.60 2.09 1.40 127 XMSubPhish11 4277 1.99 2.06 1.96 128 BAYES_20 4200 3.26 2.03 3.78 129 XM_URI_RBL 4101 0.71 1.98 0.18 130 XM_B_SpammyWords4 4093 0.96 1.98 0.53 131 T_XMHurry_00 4001 1.01 1.93 0.62 132 XM_UB60 3982 0.63 1.92 0.10 133 HK_RANDOM_REPLYTO 3924 0.67 1.89 0.17 134 HTML_MIME_NO_HTML_TAG 3858 1.98 1.86 2.03 135 TR_XM_BayesRelay 3835 0.56 1.85 0.02 136 XMStockSpam_06 3682 1.73 1.78 1.71 137 URI_TRY_3LD 3664 1.34 1.77 1.15 138 FORGED_GMAIL_RCVD 3625 0.88 1.75 0.52 139 RCVD_IN_MSPIKE_L5 3571 0.57 1.72 0.08 140 TR_XM_COVIDMETA1 3525 0.69 1.70 0.27 141 XMPhish08 3439 0.62 1.66 0.19 142 BAYES_00 3422 10.10 1.65 13.62 143 MAILING_LIST_MULTI 3421 2.14 1.65 2.34 144 TR_XM_FormFill 3397 0.49 1.64 0.01 145 URI_PHP_REDIR 3381 0.49 1.63 0.02 146 BOTNET_NORDNS 3185 0.46 1.54 0.01 147 FROM_SUSPICIOUS_NTLD 3182 0.50 1.54 0.07 148 XMSexyCombo_01 3171 1.20 1.53 1.07 149 FROM_SUSPICIOUS_NTLD_FP 3116 0.48 1.50 0.06 150 URI_NOVOWEL 2947 2.80 1.42 3.37 151 XM_Body_Dirty_Words_01 2875 0.61 1.39 0.28 152 NUMERIC_HTTP_ADDR 2850 0.65 1.38 0.35 153 T_XMDrugObfuBody_00 2776 0.91 1.34 0.73 154 TR_XM_SpammyWords3 2773 0.46 1.34 0.10 155 XM_UB80 2718 0.40 1.31 0.03 156 XMGenDplmaNmb 2715 1.00 1.31 0.87 157 TR_XM_PHPDW 2697 0.60 1.30 0.31 158 RELAYCOUNTRY_GB 2617 0.99 1.26 0.87 159 URIBL_BLACK 2606 0.39 1.26 0.03 160 XM_OfRef7 2583 0.44 1.25 0.10 161 TR_XM_COVIDMETA4 2570 0.59 1.24 0.32 162 XM_TLDProd2 2564 0.49 1.24 0.18 163 TR_XM_PHPForged 2544 0.54 1.23 0.25 164 GOOGLE_DOC_SUSP 2544 0.37 1.23 0.01 165 TR_XM_FormFill2 2527 0.54 1.22 0.25 166 XM_H_PHPOS 2510 0.53 1.21 0.24 167 XMHTML_After_End 2448 0.97 1.18 0.88 168 XM_H_Long_From02 2299 1.05 1.11 1.03 169 ALL_TRUSTED 2258 8.59 1.09 11.71 170 TR_XM_DK_Bayes 2243 6.98 1.08 9.44 171 TR_XM_INV_DKIM 2239 0.41 1.08 0.13 172 TR_XM_DK_Bayes1 2191 6.75 1.06 9.12 173 XMSubMetaI_00 2181 0.80 1.05 0.69 174 RCVD_IN_MSPIKE_H5 2133 3.90 1.03 5.09 175 BAYES_05 2109 1.95 1.02 2.33 176 XMPhish30 2054 0.59 0.99 0.43 177 RCVD_IN_IADB_VOUCHED 2050 2.91 0.99 3.71 178 TM2_M_A_HREF_HREF 2015 0.66 0.97 0.52 179 XMSlimDrugH 1967 0.43 0.95 0.21 180 TR_MetaPhish_Combo_01 1946 0.71 0.94 0.61 181 XM_Body_Obfu01 1940 0.50 0.94 0.32 182 T_MONEY_PERCENT 1938 0.42 0.94 0.21 183 TR_LOTS_OF_MONEY2 1938 0.42 0.94 0.21 184 TR_BOTNET_NEGATE 1896 0.59 0.92 0.45 185 TR_XM_DK_Bayes2 1812 5.80 0.87 7.85 186 TR_XM_RelayPhish 1799 0.31 0.87 0.08 187 NAME_EMAIL_DIFF 1781 0.31 0.86 0.08 188 TR_Caps_n_Bayes_99 1735 0.29 0.84 0.06 189 LongTLD 1725 0.33 0.83 0.13 190 HTTPS_HTTP_MISMATCH 1702 0.81 0.82 0.80 191 HTML_TAG_BALANCE_BODY 1694 0.45 0.82 0.30 192 DIET_1 1673 0.55 0.81 0.45 193 MPART_ALT_DIFF_COUNT 1672 0.48 0.81 0.34 194 XMOemUri 1663 0.46 0.80 0.32 195 T_HTML_TAG_BALANCE_CENTER 1661 0.35 0.80 0.16 196 DEAR_FRIEND 1659 0.29 0.80 0.08 197 XMPhish14 1627 0.53 0.79 0.42 198 XM_UB95 1624 0.24 0.78 0.01 199 RELAYCOUNTRY_NL 1617 0.37 0.78 0.20 200 XM_PDF 1600 3.01 0.77 3.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 430052 89.35 96.36 86.44 2 RELAYCOUNTRY_US 423313 82.66 76.85 85.08 3 DKIM_SIGNED 388479 81.10 88.34 78.08 4 XM_DK_Pass 382839 79.76 86.52 76.95 5 DKIM_VALID 373754 77.95 84.73 75.12 6 XM_B_Unicode 352646 73.31 79.14 70.88 7 DKIM_VALID_AU 285720 59.26 63.65 57.43 8 DCC_CHECK_NEGATIVE 270584 43.99 19.03 54.39 9 BAYES_50 268867 49.06 37.10 54.04 10 XM_B_SpammyWords 250694 56.68 71.81 50.39 11 XMListUnsubscribeExists 248321 56.89 73.65 49.91 12 DCC_CHECK 216929 54.11 79.35 43.60 13 XM_B_Unicode3 210307 42.42 42.77 42.27 14 RCVD_IN_MSPIKE_WL 164130 29.67 21.69 32.99 15 DKIM_VALID_EF 152798 31.31 32.75 30.71 16 HTML_FONT_LOW_CONTRAST 139625 29.94 34.45 28.06 17 T_TM2_M_HEADER_IN_MSG 135209 25.00 19.77 27.18 18 RCVD_IN_MSPIKE_H2 134578 28.42 31.72 27.05 19 LOC_TINY_FONT_1 125113 29.05 38.42 25.15 20 FVGT_m_MULTI_ODD 111296 23.96 27.76 22.37 21 MIME_HTML_ONLY 107306 24.73 32.32 21.57 22 XMSubLong 101638 22.00 25.77 20.43 23 XM_B_SpammyWords2 97980 26.32 42.25 19.69 24 T_KAM_HTML_FONT_INVALID 91044 20.77 26.69 18.30 25 RCVD_IN_MSPIKE_H3 80165 14.87 11.90 16.11 26 BAYES_00 67752 10.10 1.65 13.62 27 XM_Body_Dirty_Words 64306 14.70 18.96 12.93 28 XM_DKIMWhitelistDomains 63324 9.01 0.09 12.73 29 XM_Multi_Part_URI 60473 13.42 16.45 12.15 30 RCVD_IN_MSPIKE_H4 58623 10.89 8.76 11.78 31 ALL_TRUSTED 58237 8.59 1.09 11.71 32 XM_B_Unsub 51350 10.97 12.53 10.32 33 TR_XM_DK_Bayes 46942 6.98 1.08 9.44 34 TR_XM_DK_Bayes1 45368 6.75 1.06 9.12 35 XM_Evil_Numbers_Gen 45198 9.61 10.86 9.08 36 LotsOfNums_01 44333 9.05 9.39 8.91 37 XMStrtUSub 42411 6.94 3.13 8.52 38 XM_B_Phish_Phrases 42304 8.40 8.15 8.50 39 XM_DK_Undo_02 42294 20.75 50.16 8.50 40 RCVD_IN_RP_SAFE 41180 7.29 4.92 8.28 41 UNPARSEABLE_RELAY 40148 8.12 8.26 8.07 42 TR_XM_DK_Bayes2 39068 5.80 0.87 7.85 43 TooManyTo_001 38907 7.34 6.19 7.82 44 BAYES_60 37925 7.56 7.39 7.62 45 LOTS_OF_MONEY 37720 9.73 14.91 7.58 46 RCVD_IN_RP_CERTIFIED 37664 6.42 3.66 7.57 47 XM_SendGrid 35640 6.95 6.45 7.16 48 HTML_IMAGE_RATIO_02 34126 7.96 10.61 6.86 49 HTML_IMAGE_RATIO_04 32660 6.39 5.97 6.56 50 TR_XM_UnparsRelay 30119 6.63 8.02 6.05 51 RCVD_IN_IADB_LISTED 29824 4.96 2.48 5.99 52 TR_XM_DKIM_Undo 29568 16.30 41.17 5.94 53 MIME_QP_LONG_LINE 29436 5.27 3.71 5.92 54 FSL_BULK_SIG 28347 6.79 9.43 5.70 55 XM_H_Long_From01 27887 6.21 7.67 5.61 56 BAYES_99 27105 14.47 36.15 5.45 57 MPART_ALT_DIFF 27019 6.89 10.38 5.43 58 IN_ZIMBRA_NJ_WHITELIST 26629 3.80 0.07 5.35 59 BAYES_40 26168 4.35 2.17 5.26 60 RCVD_IN_IADB_SPF 25939 4.33 2.22 5.21 61 RCVD_IN_MSPIKE_H5 25342 3.90 1.03 5.09 62 TR_XM_SpammyWords4 25106 7.34 12.84 5.05 63 BAYES_80 24033 5.69 7.75 4.83 64 BOTNET_IPINHOSTNAME 23649 7.21 13.12 4.75 65 XM_B_SpammyWords3 23296 7.63 14.70 4.68 66 RCVD_IN_IADB_SENDERID 23117 3.90 2.10 4.65 67 TR_XM_DK_SendGrid 22998 4.31 3.56 4.62 68 T_TooManySym_01 22880 4.06 2.75 4.60 69 RCVD_IN_IADB_DK 22360 3.79 2.10 4.49 70 RELAYCOUNTRY_META 21749 9.60 22.15 4.37 71 BAYES_999 21741 11.46 28.48 4.37 72 XMSexyCombo_05 21510 6.10 10.36 4.32 73 XM_H_Trusted_IP 19675 2.79 0.00 3.95 74 XM_PDF 19605 3.01 0.77 3.94 75 HTML_IMAGE_RATIO_06 19466 3.59 2.82 3.91 76 BAYES_20 18795 3.26 2.03 3.78 77 XMSubMetaSx_00 18768 4.51 6.29 3.77 78 RCVD_IN_IADB_VOUCHED 18442 2.91 0.99 3.71 79 MIME_HTML_ONLY_MULTI 18129 3.52 3.21 3.64 80 URI_NOVOWEL 16756 2.80 1.42 3.37 81 T_REMOTE_IMAGE 16420 3.83 5.11 3.30 82 XM_UncommonTLD01 15983 6.13 13.14 3.21 83 XMNumbers 15505 3.76 5.31 3.12 84 BAYES_95 15237 3.55 4.72 3.06 85 DKIM_INVALID 14725 3.15 3.61 2.96 86 TR_DCC_Bayes_99 14680 10.31 28.00 2.95 87 FROM_EXCESS_BASE64 14013 3.20 4.11 2.82 88 TM2_M_URI_OPT_OUT 13151 3.04 4.00 2.64 89 TR_XM_PhishingBody 13117 3.81 6.62 2.64 90 T_TooManySym_02 11907 1.87 0.62 2.39 91 RCVD_IN_IADB_OPTIN 11894 1.88 0.66 2.39 92 MIME_HTML_MOSTLY 11777 3.97 7.82 2.37 93 HTML_IMAGE_RATIO_08 11771 2.49 2.80 2.37 94 MAILING_LIST_MULTI 11652 2.14 1.65 2.34 95 BAYES_05 11606 1.95 1.02 2.33 96 T_XMDrugObfuBody_14 11045 2.23 2.24 2.22 97 XM_B_SpammyTLD 10932 2.72 3.96 2.20 98 ANY_BOUNCE_MESSAGE 10626 1.64 0.46 2.14 99 BOUNCE_MESSAGE 10624 1.64 0.46 2.14 100 HTML_MIME_NO_HTML_TAG 10095 1.98 1.86 2.03 101 TR_XM_SB_Phish 9896 2.04 2.16 1.99 102 BOTNET 9774 5.78 14.95 1.96 103 XMSubPhish11 9758 1.99 2.06 1.96 104 TooManyTo_002 9699 1.56 0.63 1.95 105 URIBL_SBL_A 9430 3.15 6.15 1.90 106 XM_CamelCaseFrm001 8789 2.01 2.59 1.77 107 HELO_NODOT 8679 1.35 0.40 1.74 108 HELO_NO_DOMAIN 8678 1.35 0.40 1.74 109 TVD_RCVD_IP 8515 1.29 0.28 1.71 110 XMStockSpam_06 8485 1.73 1.78 1.71 111 XM_SPF_SoftFail 8305 2.16 3.35 1.67 112 UNTRUSTED_Relay 8279 5.22 13.76 1.66 113 HTML_FONT_FACE_BAD 8194 1.34 0.61 1.65 114 KHOP_HELO_FCRDNS 8181 2.57 4.81 1.64 115 XM_B_Unsub2 8001 1.78 2.21 1.61 116 XMDiploma_00 7981 1.81 2.31 1.60 117 T_XMDrugObfuBody_08 7790 1.90 2.69 1.57 118 SUBJ_ALL_CAPS 7787 1.77 2.27 1.57 119 XM_B_Phish66 7590 1.99 3.11 1.53 120 IN_HORDE_ADDRESS_BOOK 7583 1.12 0.16 1.52 121 INVALID_MSGID 7459 1.18 0.40 1.50 122 URI_HEX 7260 2.09 3.60 1.46 123 XM_DK_Undo_01 7187 2.16 3.88 1.44 124 TM2_M_VERY_LONG_WORD 7142 1.79 2.65 1.44 125 TR_XM_SpammyWords5 7022 2.41 4.80 1.41 126 TR_Symld_Words 6976 1.60 2.09 1.40 127 MSGID_NOFQDN1 6757 0.97 0.04 1.36 128 TooManyTo_003 6540 1.08 0.52 1.31 129 RCVD_IN_BL_SPAMCOP_NET 6419 4.15 11.02 1.29 130 TO_MALFORMED 6402 0.91 0.01 1.29 131 RELAYCOUNTRY_CA 6314 3.09 7.46 1.27 132 XMSubNoVowel 6158 1.06 0.62 1.24 133 USER_IN_DEF_DKIM_WL 6154 0.89 0.06 1.24 134 HELO_MISC_IP 6087 0.92 0.20 1.22 135 URI_TRY_3LD 5745 1.34 1.77 1.15 136 XMSexyCombo_01 5302 1.20 1.53 1.07 137 XM_GoogleGroups 5217 0.87 0.44 1.05 138 XM_H_Long_From02 5131 1.05 1.11 1.03 139 XM_UB50 5074 1.96 4.23 1.02 140 TR_MSPIKEBAYES00 5053 0.74 0.08 1.02 141 XMCapTrack 4990 0.79 0.28 1.00 142 XMGappySubj_01 4947 0.75 0.17 0.99 143 XMBSHREFv2 4904 0.77 0.24 0.99 144 XM_ProductURIs 4901 0.91 0.75 0.99 145 TooManyTo_004 4744 0.81 0.45 0.95 146 XM_B_COVIDMETA 4709 1.39 2.46 0.95 147 XM_OfRef6 4617 1.97 4.46 0.93 148 XMBdyGiftCard01 4449 1.58 3.24 0.89 149 DKIM_ADSP_CUSTOM_MED 4371 0.82 0.69 0.88 150 XMHTML_After_End 4360 0.97 1.18 0.88 151 RELAYCOUNTRY_GB 4325 0.99 1.26 0.87 152 XMGenDplmaNmb 4319 1.00 1.31 0.87 153 HTTPS_HTTP_MISMATCH 3990 0.81 0.82 0.80 154 TooManyTo_005 3921 0.68 0.41 0.79 155 XMBody_17 3896 1.66 3.76 0.78 156 T_FILL_THIS_FORM_SHORT 3863 1.48 3.16 0.78 157 XMBody_95 3817 0.58 0.14 0.77 158 XMSubMetaSxObfu_03 3655 0.73 0.72 0.73 159 T_XMDrugObfuBody_00 3646 0.91 1.34 0.73 160 FROM_GOV_DKIM_AU 3603 0.55 0.14 0.72 161 SpammyFromTLD_01 3587 1.82 4.45 0.72 162 HTML_IMAGE_ONLY_20 3565 0.57 0.23 0.72 163 TR_XM_SpammyWords2 3454 4.62 14.06 0.69 164 XMSubMetaI_00 3441 0.80 1.05 0.69 165 XMBrknScrpt_02 3355 1.11 2.16 0.67 166 PDS_OTHER_BAD_TLD 3287 1.12 2.22 0.66 167 TVD_SPACE_RATIO 3210 0.60 0.50 0.65 168 T_XMHurry_00 3085 1.01 1.93 0.62 169 TR_MetaPhish_Combo_01 3049 0.71 0.94 0.61 170 NML_ADSP_CUSTOM_MED 2944 0.59 0.58 0.59 171 T_TooManySym_03 2835 0.46 0.19 0.57 172 DKIM_ADSP_NXDOMAIN 2810 0.50 0.36 0.56 173 PLING_QUERY 2768 0.57 0.62 0.56 174 XM_SPF_Unknown 2729 0.58 0.64 0.55 175 RDNS_DYNAMIC 2653 0.60 0.76 0.53 176 XM_B_SpammyWords4 2648 0.96 1.98 0.53 177 T_Symld_Words_02 2617 0.56 0.66 0.53 178 TM2_M_A_HREF_HREF 2601 0.66 0.97 0.52 179 XM_RXBody 2599 0.49 0.41 0.52 180 FORGED_GMAIL_RCVD 2565 0.88 1.75 0.52 181 SHORT_HELO_AND_INLINE_IMAGE 2556 0.38 0.05 0.51 182 TVD_SPACE_RATIO_MINFP 2519 0.53 0.59 0.51 183 XM_B_COPY_HTML 2506 0.50 0.49 0.50 184 T_OBFU_PDF_ATTACH 2494 0.39 0.13 0.50 185 XM_H_PHPMailer 2488 0.50 0.49 0.50 186 XMSexyCombo_04 2483 0.52 0.58 0.50 187 XMGppyBdWords 2475 0.53 0.61 0.50 188 XMHTMLBadTable_001 2419 0.50 0.54 0.49 189 XM_ShortIntro_01 2371 0.47 0.44 0.48 190 TM2_M_BODY_EMPTY 2281 0.34 0.06 0.46 191 TR_BOTNET_NEGATE 2249 0.59 0.92 0.45 192 XMLngstWrd_00 2246 0.48 0.56 0.45 193 XMBody_78 2245 0.51 0.64 0.45 194 RELAYCOUNTRY_DE 2238 0.54 0.76 0.45 195 DIET_1 2236 0.55 0.81 0.45 196 XMMoneyMeta_00 2235 0.51 0.64 0.45 197 MISSING_HEADERS 2232 0.40 0.29 0.45 198 TR_LOTS_OF_MONEY3 2156 1.25 3.21 0.43 199 XMPhish30 2137 0.59 0.99 0.43 200 SHOPIFY_IMG_NOT_RCVD_SFY 2110 0.41 0.38 0.42 ----------------------------------------------------------------------