Email: 624498 Autolearn: 0 AvgScore: 3.84 AvgScanTime: 1.35 sec Spam: 196237 Autolearn: 0 AvgScore: 13.78 AvgScanTime: 1.58 sec Ham: 428261 Autolearn: 0 AvgScore: -0.72 AvgScanTime: 1.24 sec Time Spent Running SA: 233.82 hours Time Spent Processing Spam: 85.95 hours Time Spent Processing Ham: 147.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 190185 87.94 96.92 83.83 2 DKIM_SIGNED 170076 76.05 86.67 71.19 3 XM_DK_Pass 166615 74.79 84.90 70.15 4 DKIM_VALID 162869 72.95 83.00 68.34 5 DCC_CHECK 155548 50.93 79.27 37.94 6 XM_B_Unicode 150297 70.95 76.59 68.36 7 RELAYCOUNTRY_US 144933 76.67 73.86 77.96 8 XMListUnsubscribeExists 139667 55.36 71.17 48.11 9 XM_B_SpammyWords 134513 51.19 68.55 43.23 10 DKIM_VALID_AU 125394 55.87 63.90 52.19 11 XM_DK_Undo_02 99929 21.29 50.92 7.72 12 XM_B_Unicode3 82746 40.76 42.17 40.12 13 TR_XM_DKIM_Undo 81569 16.58 41.57 5.13 14 BAYES_99 77481 16.44 39.48 5.89 15 XM_B_SpammyWords2 77106 24.20 39.29 17.29 16 LOC_TINY_FONT_1 71542 27.62 36.46 23.57 17 BAYES_50 69373 48.28 35.35 54.20 18 HTML_FONT_LOW_CONTRAST 64123 28.49 32.68 26.58 19 MIME_HTML_ONLY 62852 23.57 32.03 19.69 20 BAYES_999 62650 13.35 31.93 4.84 21 TR_DCC_Bayes_99 60859 11.59 31.01 2.69 22 DKIM_VALID_EF 59204 27.48 30.17 26.25 23 RCVD_IN_MSPIKE_H2 57874 26.30 29.49 24.84 24 FVGT_m_MULTI_ODD 54735 25.03 27.89 23.72 25 T_KAM_HTML_FONT_INVALID 52622 20.52 26.82 17.64 26 RCVD_IN_MSPIKE_WL 44846 26.98 22.85 28.87 27 RELAYCOUNTRY_META 44644 10.02 22.75 4.18 28 XMSubLong 44230 19.79 22.54 18.53 29 T_TM2_M_HEADER_IN_MSG 40093 24.23 20.43 25.97 30 XM_Body_Dirty_Words 37858 13.85 19.29 11.36 31 DCC_CHECK_NEGATIVE 37301 47.14 19.01 60.04 32 UNTRUSTED_Relay 32681 6.34 16.65 1.62 33 XM_UncommonTLD01 32183 7.23 16.40 3.02 34 TR_XM_SpammyWords2 30698 5.54 15.64 0.92 35 LOTS_OF_MONEY 30595 9.73 15.59 7.04 36 XM_Multi_Part_URI 30111 14.14 15.34 13.58 37 XM_B_SpammyWords3 27694 7.08 14.11 3.86 38 TR_XM_SpammyWords4 27032 7.56 13.78 4.72 39 BOTNET 26475 5.26 13.49 1.49 40 XM_B_Unsub 24647 10.70 12.56 9.84 41 FSL_BULK_SIG 24645 8.13 12.56 6.10 42 RCVD_IN_MSPIKE_H3 24453 14.69 12.46 15.71 43 XM_Evil_Numbers_Gen 21581 9.21 11.00 8.39 44 BOTNET_IPINHOSTNAME 20581 6.36 10.49 4.47 45 XMSexyCombo_05 19783 5.52 10.08 3.42 46 MPART_ALT_DIFF 19443 6.31 9.91 4.66 47 LotsOfNums_01 18888 8.88 9.63 8.54 48 RCVD_IN_MSPIKE_H4 18570 10.31 9.46 10.70 49 RCVD_IN_BL_SPAMCOP_NET 17933 3.49 9.14 0.90 50 UNPARSEABLE_RELAY 17400 8.14 8.87 7.81 51 SpammyFromTLD_02 17216 2.91 8.77 0.23 52 TR_XM_UnparsRelay 16966 7.07 8.65 6.34 53 MIME_HTML_MOSTLY 16619 4.18 8.47 2.21 54 HTML_IMAGE_RATIO_02 16572 6.99 8.44 6.32 55 BAYES_60 16117 8.65 8.21 8.84 56 BAYES_80 15921 5.65 8.11 4.53 57 RELAYCOUNTRY_CA 15792 3.41 8.05 1.29 58 XMSubMetaSx_00 14251 4.51 7.26 3.25 59 XM_UB50 14179 2.93 7.23 0.96 60 XM_H_Long_From01 13165 5.73 6.71 5.28 61 KHOP_HELO_FCRDNS 13146 3.36 6.70 1.83 62 XM_SendGrid 12739 6.98 6.49 7.20 63 XM_B_Phish_Phrases 12584 4.68 6.41 3.88 64 HTML_FONT_SIZE_LARGE 11340 1.89 5.78 0.11 65 HTML_IMAGE_ONLY_12 11301 1.93 5.76 0.18 66 HTML_SHORT_LINK_IMG_1 11080 1.78 5.65 0.02 67 BODY_URI_ONLY 11068 1.78 5.64 0.01 68 TR_XM_PhishingBody 10975 3.76 5.59 2.92 69 T_REMOTE_IMAGE 10960 4.22 5.59 3.60 70 SpammyFromTLD_01 10836 2.21 5.52 0.69 71 URIBL_SBL_A 10724 2.73 5.46 1.48 72 XM_OfRef6 10572 2.35 5.39 0.96 73 HTML_IMAGE_RATIO_04 10567 4.92 5.38 4.70 74 TooManyTo_001 9952 6.89 5.07 7.73 75 XM_DK_Undo_01 9855 2.63 5.02 1.53 76 BAYES_95 9658 3.43 4.92 2.74 77 XMNumbers 9600 3.60 4.89 3.01 78 TR_XM_SpammyWords5 9412 2.44 4.80 1.37 79 RCVD_IN_RP_SAFE 9269 6.58 4.72 7.43 80 TR_LOTS_OF_MONEY3 8822 1.97 4.50 0.81 81 T_XMHurry_00 8472 2.00 4.32 0.93 82 XMStrtUSub 8130 4.51 4.14 4.67 83 RELAYCOUNTRY_FR 7881 1.42 4.02 0.22 84 TR_XM_DK_SendGrid 7356 4.20 3.75 4.41 85 DKIM_INVALID 7207 3.11 3.67 2.85 86 XMBody_17 7055 1.47 3.60 0.49 87 RCVD_IN_RP_CERTIFIED 6863 5.80 3.50 6.86 88 URI_HEX 6369 2.01 3.25 1.45 89 TM2_M_URI_OPT_OUT 6360 6.30 3.24 7.70 90 XM_UB99 6353 1.02 3.24 0.00 91 XM_B_SpammyTLD 6291 2.30 3.21 1.89 92 HTML_IMAGE_RATIO_06 6209 3.73 3.16 3.98 93 TR_XM_MaxBayes 6177 1.01 3.15 0.03 94 MIME_QP_LONG_LINE 6113 4.73 3.12 5.47 95 XM_DIRTYINTL 5991 1.22 3.05 0.38 96 XM_B_Phish66 5854 2.19 2.98 1.82 97 FROM_EXCESS_BASE64 5778 2.71 2.94 2.60 98 MIME_HTML_ONLY_MULTI 5712 2.77 2.91 2.71 99 XM_UB60 5615 1.00 2.86 0.15 100 FORGED_GMAIL_RCVD 5552 1.27 2.83 0.55 101 RCVD_IN_MSPIKE_BL 5477 0.96 2.79 0.12 102 TR_XM_MSPIKECOMBO 5449 0.95 2.78 0.12 103 XM_SPF_SoftFail 5385 2.10 2.74 1.80 104 T_FILL_THIS_FORM_SHORT 5356 1.41 2.73 0.80 105 URI_TRY_3LD 5048 1.62 2.57 1.19 106 XMDiploma_00 4951 1.76 2.52 1.41 107 XMBrknScrpt_02 4935 1.32 2.51 0.78 108 HTML_IMAGE_RATIO_08 4895 2.38 2.49 2.32 109 SUBJ_ALL_CAPS 4871 1.79 2.48 1.47 110 XM_UB999 4708 0.76 2.40 0.00 111 T_TooManySym_01 4686 4.05 2.39 4.81 112 XM_CamelCaseFrm001 4663 2.10 2.38 1.98 113 XM_B_Unsub2 4556 1.97 2.32 1.80 114 RCVD_IN_IADB_LISTED 4499 4.33 2.29 5.26 115 RELAYCOUNTRY_DE 4371 0.96 2.23 0.38 116 XMBdyGiftCard01 4328 0.99 2.21 0.43 117 TR_XM_BayesRelay 4194 0.69 2.14 0.03 118 XMSexyCombo_01 4141 0.90 2.11 0.34 119 TM2_M_VERY_LONG_WORD 4079 1.51 2.08 1.26 120 RCVD_IN_IADB_SPF 4034 3.79 2.06 4.59 121 T_XMDrugObfuBody_08 3974 1.52 2.03 1.29 122 T_XMDrugObfuBody_14 3866 1.81 1.97 1.74 123 RCVD_IN_RP_RNBL 3819 0.63 1.95 0.03 124 GOOGLE_DOC_SUSP 3800 0.61 1.94 0.00 125 XMSubMetaSxObfu_03 3754 1.12 1.91 0.75 126 RCVD_IN_IADB_SENDERID 3751 3.41 1.91 4.10 127 RCVD_IN_IADB_DK 3660 3.28 1.87 3.93 128 TR_XM_SpammyWords3 3655 0.62 1.86 0.05 129 RCVD_IN_PSBL 3608 0.63 1.84 0.08 130 XM_B_COVIDMETA 3588 1.37 1.83 1.16 131 URI_NOVOWEL 3587 2.47 1.83 2.77 132 TR_XM_SB_Phish 3565 2.03 1.82 2.13 133 BOTNET_NORDNS 3544 0.58 1.81 0.01 134 XM_B_SpammyWords4 3477 0.88 1.77 0.48 135 XMSubPhish11 3463 1.99 1.76 2.10 136 PDS_OTHER_BAD_TLD 3416 0.95 1.74 0.59 137 XM_OfRef7 3388 0.63 1.73 0.13 138 URIBL_DBL_SPAM 3373 0.55 1.72 0.01 139 TR_XM_FormFill 3362 0.61 1.71 0.10 140 HK_RANDOM_REPLYTO 3330 0.65 1.70 0.16 141 XM_UB80 3285 0.55 1.67 0.04 142 XMSubMetaI_00 3222 0.96 1.64 0.65 143 BAYES_40 3206 4.71 1.63 6.13 144 RELAYCOUNTRY_IN 3143 0.56 1.60 0.08 145 RCVD_IN_MSPIKE_L5 3046 0.52 1.55 0.05 146 HTML_MIME_NO_HTML_TAG 2965 1.95 1.51 2.15 147 XM_URI_RBL 2956 0.61 1.51 0.19 148 XMStockSpam_06 2946 1.29 1.50 1.20 149 URIBL_BLACK 2834 0.48 1.44 0.04 150 T_Symld_Words_02 2717 0.88 1.38 0.65 151 XMGenDplmaNmb 2601 0.82 1.33 0.59 152 TR_XM_INV_DKIM 2586 0.47 1.32 0.08 153 URI_PHP_REDIR 2542 0.41 1.30 0.00 154 TR_XM_PHPDW 2509 0.62 1.28 0.31 155 MAILING_LIST_MULTI 2485 1.99 1.27 2.32 156 TR_XM_COVIDMETA4 2475 0.66 1.26 0.38 157 TR_Sbj_FN_Bdy 2332 0.47 1.19 0.14 158 URG_BIZ 2328 0.41 1.19 0.06 159 TR_XM_PHPForged 2299 0.54 1.17 0.25 160 DIET_1 2287 0.71 1.17 0.50 161 T_MONEY_PERCENT 2283 0.45 1.16 0.13 162 TR_LOTS_OF_MONEY2 2283 0.45 1.16 0.13 163 TR_XM_FormFill2 2263 0.53 1.15 0.25 164 XM_H_PHPOS 2254 0.53 1.15 0.24 165 BAYES_20 2203 2.41 1.12 2.99 166 XM_UB95 2130 0.35 1.09 0.01 167 T_XMDrugObfuBody_00 2098 1.72 1.07 2.02 168 FILL_THIS_FORM 2090 0.48 1.07 0.22 169 HTTPS_HTTP_MISMATCH 2035 0.96 1.04 0.93 170 ALL_TRUSTED 2031 13.31 1.03 18.94 171 XMHTML_After_End 2029 0.95 1.03 0.91 172 RCVD_IN_IADB_VOUCHED 2022 2.63 1.03 3.37 173 TR_XM_RelayPhish 1975 0.36 1.01 0.07 174 FROM_SUSPICIOUS_NTLD 1961 0.37 1.00 0.08 175 XMMoneyMeta_00 1956 0.68 1.00 0.53 176 TR_XM_COVIDMETA1 1943 0.51 0.99 0.29 177 MONEY_FORM 1941 0.32 0.99 0.01 178 XMPhish08 1939 0.46 0.99 0.22 179 FILL_THIS_FORM_LONG 1916 0.35 0.98 0.07 180 XM_Body_Dirty_Words_01 1902 0.43 0.97 0.19 181 HTML_TAG_BALANCE_BODY 1898 0.51 0.97 0.31 182 MPART_ALT_DIFF_COUNT 1875 0.68 0.96 0.55 183 URI_NO_WWW_INFO_CGI 1874 0.31 0.95 0.01 184 TR_Symld_Words 1850 1.22 0.94 1.35 185 DKIM_ADSP_CUSTOM_MED 1849 0.94 0.94 0.94 186 XMSexyCombo_04 1842 0.35 0.94 0.08 187 XMSlimDrugH 1825 0.51 0.93 0.32 188 RCVD_IN_MSPIKE_H5 1823 1.98 0.93 2.46 189 XM_H_Long_From02 1797 0.98 0.92 1.02 190 TR_Caps_n_Bayes_99 1795 0.33 0.91 0.07 191 FROM_SUSPICIOUS_NTLD_FP 1766 0.33 0.90 0.07 192 XMPhish30 1754 0.56 0.89 0.40 193 HTML_FONT_FACE_BAD 1732 0.88 0.88 0.88 194 TR_MetaPhish_Combo_01 1712 0.81 0.87 0.78 195 NUMERIC_HTTP_ADDR 1709 0.48 0.87 0.30 196 HELO_NODOT 1702 1.39 0.87 1.62 197 XM_Body_Obfu01 1702 0.51 0.87 0.34 198 URI_NO_WWW_BIZ_CGI 1674 0.29 0.85 0.03 199 RELAYCOUNTRY_NL 1648 0.41 0.84 0.22 200 RELAYCOUNTRY_GB 1639 0.79 0.84 0.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 359029 87.94 96.92 83.83 2 RELAYCOUNTRY_US 333884 76.67 73.86 77.96 3 DKIM_SIGNED 304880 76.05 86.67 71.19 4 XM_DK_Pass 300441 74.79 84.90 70.15 5 XM_B_Unicode 292761 70.95 76.59 68.36 6 DKIM_VALID 292692 72.95 83.00 68.34 7 DCC_CHECK_NEGATIVE 257112 47.14 19.01 60.04 8 BAYES_50 232125 48.28 35.35 54.20 9 DKIM_VALID_AU 223518 55.87 63.90 52.19 10 XMListUnsubscribeExists 206036 55.36 71.17 48.11 11 XM_B_SpammyWords 185145 51.19 68.55 43.23 12 XM_B_Unicode3 171830 40.76 42.17 40.12 13 DCC_CHECK 162490 50.93 79.27 37.94 14 RCVD_IN_MSPIKE_WL 123626 26.98 22.85 28.87 15 HTML_FONT_LOW_CONTRAST 113819 28.49 32.68 26.58 16 DKIM_VALID_EF 112416 27.48 30.17 26.25 17 T_TM2_M_HEADER_IN_MSG 111207 24.23 20.43 25.97 18 RCVD_IN_MSPIKE_H2 106386 26.30 29.49 24.84 19 FVGT_m_MULTI_ODD 101565 25.03 27.89 23.72 20 LOC_TINY_FONT_1 100952 27.62 36.46 23.57 21 MIME_HTML_ONLY 84317 23.57 32.03 19.69 22 ALL_TRUSTED 81117 13.31 1.03 18.94 23 XMSubLong 79353 19.79 22.54 18.53 24 T_KAM_HTML_FONT_INVALID 75528 20.52 26.82 17.64 25 XM_B_SpammyWords2 74035 24.20 39.29 17.29 26 RCVD_IN_MSPIKE_H3 67263 14.69 12.46 15.71 27 XM_Multi_Part_URI 58175 14.14 15.34 13.58 28 BAYES_00 54520 8.91 0.59 12.73 29 XM_Body_Dirty_Words 48630 13.85 19.29 11.36 30 RCVD_IN_MSPIKE_H4 45824 10.31 9.46 10.70 31 XM_B_Unsub 42151 10.70 12.56 9.84 32 XM_DKIMWhitelistDomains 38318 6.15 0.06 8.95 33 BAYES_60 37877 8.65 8.21 8.84 34 LotsOfNums_01 36581 8.88 9.63 8.54 35 XM_Evil_Numbers_Gen 35919 9.21 11.00 8.39 36 UNPARSEABLE_RELAY 33459 8.14 8.87 7.81 37 ANY_BOUNCE_MESSAGE 33346 5.49 0.49 7.79 38 BOUNCE_MESSAGE 33336 5.49 0.49 7.78 39 TooManyTo_001 33097 6.89 5.07 7.73 40 XM_DK_Undo_02 33042 21.29 50.92 7.72 41 TM2_M_URI_OPT_OUT 32967 6.30 3.24 7.70 42 RCVD_IN_RP_SAFE 31837 6.58 4.72 7.43 43 TR_XM_DK_Bayes 30884 5.09 0.46 7.21 44 XM_SendGrid 30847 6.98 6.49 7.20 45 LOTS_OF_MONEY 30149 9.73 15.59 7.04 46 TR_XM_DK_Bayes1 30032 4.95 0.45 7.01 47 RCVD_IN_RP_CERTIFIED 29373 5.80 3.50 6.86 48 TR_XM_UnparsRelay 27165 7.07 8.65 6.34 49 HTML_IMAGE_RATIO_02 27053 6.99 8.44 6.32 50 TR_XM_DK_Bayes2 26640 4.40 0.42 6.22 51 BAYES_40 26239 4.71 1.63 6.13 52 FSL_BULK_SIG 26137 8.13 12.56 6.10 53 BAYES_99 25215 16.44 39.48 5.89 54 MIME_QP_LONG_LINE 23429 4.73 3.12 5.47 55 IN_ZIMBRA_NJ_WHITELIST 22923 3.68 0.04 5.35 56 XM_H_Long_From01 22603 5.73 6.71 5.28 57 RCVD_IN_IADB_LISTED 22541 4.33 2.29 5.26 58 TR_XM_DKIM_Undo 21975 16.58 41.57 5.13 59 BAYES_999 20743 13.35 31.93 4.84 60 T_TooManySym_01 20620 4.05 2.39 4.81 61 XM_PDF 20337 3.45 0.63 4.75 62 TR_XM_SpammyWords4 20197 7.56 13.78 4.72 63 HTML_IMAGE_RATIO_04 20147 4.92 5.38 4.70 64 XMStrtUSub 20008 4.51 4.14 4.67 65 MPART_ALT_DIFF 19967 6.31 9.91 4.66 66 RCVD_IN_IADB_SPF 19639 3.79 2.06 4.59 67 BAYES_80 19386 5.65 8.11 4.53 68 BOTNET_IPINHOSTNAME 19148 6.36 10.49 4.47 69 TR_XM_DK_SendGrid 18885 4.20 3.75 4.41 70 RELAYCOUNTRY_META 17916 10.02 22.75 4.18 71 RCVD_IN_IADB_SENDERID 17549 3.41 1.91 4.10 72 HTML_IMAGE_RATIO_06 17060 3.73 3.16 3.98 73 RCVD_IN_IADB_DK 16815 3.28 1.87 3.93 74 XM_B_Phish_Phrases 16617 4.68 6.41 3.88 75 XM_B_SpammyWords3 16539 7.08 14.11 3.86 76 T_REMOTE_IMAGE 15420 4.22 5.59 3.60 77 XMSexyCombo_05 14662 5.52 10.08 3.42 78 RCVD_IN_IADB_VOUCHED 14422 2.63 1.03 3.37 79 XMSubMetaSx_00 13931 4.51 7.26 3.25 80 XM_H_Trusted_IP 13101 2.10 0.00 3.06 81 XM_UncommonTLD01 12945 7.23 16.40 3.02 82 XMNumbers 12882 3.60 4.89 3.01 83 BAYES_20 12817 2.41 1.12 2.99 84 TR_XM_PhishingBody 12489 3.76 5.59 2.92 85 DKIM_INVALID 12188 3.11 3.67 2.85 86 URI_NOVOWEL 11846 2.47 1.83 2.77 87 BAYES_95 11747 3.43 4.92 2.74 88 MIME_HTML_ONLY_MULTI 11613 2.77 2.91 2.71 89 TR_DCC_Bayes_99 11534 11.59 31.01 2.69 90 FROM_EXCESS_BASE64 11120 2.71 2.94 2.60 91 RCVD_IN_MSPIKE_H5 10539 1.98 0.93 2.46 92 MAILING_LIST_MULTI 9953 1.99 1.27 2.32 93 HTML_IMAGE_RATIO_08 9950 2.38 2.49 2.32 94 T_TooManySym_02 9716 1.69 0.44 2.27 95 MIME_HTML_MOSTLY 9461 4.18 8.47 2.21 96 RCVD_IN_IADB_OPTIN 9405 1.73 0.73 2.20 97 HTML_MIME_NO_HTML_TAG 9192 1.95 1.51 2.15 98 TR_XM_SB_Phish 9121 2.03 1.82 2.13 99 TVD_RCVD_IP 9025 1.48 0.12 2.11 100 XMSubPhish11 8977 1.99 1.76 2.10 101 T_XMDrugObfuBody_00 8664 1.72 1.07 2.02 102 XM_CamelCaseFrm001 8470 2.10 2.38 1.98 103 BAYES_05 8330 1.51 0.57 1.95 104 XM_B_SpammyTLD 8075 2.30 3.21 1.89 105 TooManyTo_002 7954 1.45 0.57 1.86 106 KHOP_HELO_FCRDNS 7832 3.36 6.70 1.83 107 XM_B_Phish66 7792 2.19 2.98 1.82 108 XM_B_Unsub2 7725 1.97 2.32 1.80 109 XM_SPF_SoftFail 7723 2.10 2.74 1.80 110 T_XMDrugObfuBody_14 7431 1.81 1.97 1.74 111 HELO_NODOT 6948 1.39 0.87 1.62 112 HELO_NO_DOMAIN 6947 1.33 0.71 1.62 113 UNTRUSTED_Relay 6919 6.34 16.65 1.62 114 INVALID_MSGID 6916 1.25 0.44 1.61 115 IN_HORDE_ADDRESS_BOOK 6696 1.09 0.05 1.56 116 XM_DK_Undo_01 6558 2.63 5.02 1.53 117 USER_IN_DEF_DKIM_WL 6474 1.05 0.03 1.51 118 BOTNET 6370 5.26 13.49 1.49 119 URIBL_SBL_A 6355 2.73 5.46 1.48 120 MSGID_NOFQDN1 6325 1.02 0.03 1.48 121 SUBJ_ALL_CAPS 6302 1.79 2.48 1.47 122 TO_MALFORMED 6277 1.04 0.10 1.47 123 URI_HEX 6209 2.01 3.25 1.45 124 XMDiploma_00 6051 1.76 2.52 1.41 125 TR_XM_SpammyWords5 5852 2.44 4.80 1.37 126 TR_Symld_Words 5763 1.22 0.94 1.35 127 T_XMDrugObfuBody_08 5534 1.52 2.03 1.29 128 RELAYCOUNTRY_CA 5514 3.41 8.05 1.29 129 HELO_MISC_IP 5422 0.89 0.06 1.27 130 TM2_M_VERY_LONG_WORD 5382 1.51 2.08 1.26 131 XMBSHREFv2 5363 0.95 0.28 1.25 132 XMSubNoVowel 5355 1.05 0.62 1.25 133 TooManyTo_003 5269 0.98 0.42 1.23 134 XMStockSpam_06 5123 1.29 1.50 1.20 135 URI_TRY_3LD 5098 1.62 2.57 1.19 136 XM_B_COVIDMETA 4972 1.37 1.83 1.16 137 TR_MSPIKEBAYES00 4626 0.75 0.02 1.08 138 XM_H_Long_From02 4349 0.98 0.92 1.02 139 XM_GoogleGroups 4347 0.83 0.42 1.02 140 XMGappySubj_01 4159 0.71 0.14 0.97 141 XM_UB50 4112 2.93 7.23 0.96 142 XM_OfRef6 4094 2.35 5.39 0.96 143 XMCapTrack 4051 0.73 0.26 0.95 144 DKIM_ADSP_CUSTOM_MED 4043 0.94 0.94 0.94 145 XMBody_95 4014 0.67 0.09 0.94 146 T_XMHurry_00 3988 2.00 4.32 0.93 147 HTTPS_HTTP_MISMATCH 3970 0.96 1.04 0.93 148 TR_XM_SpammyWords2 3922 5.54 15.64 0.92 149 XMHTML_After_End 3898 0.95 1.03 0.91 150 RCVD_IN_BL_SPAMCOP_NET 3860 3.49 9.14 0.90 151 TooManyTo_004 3820 0.73 0.36 0.89 152 HTML_FONT_FACE_BAD 3771 0.88 0.88 0.88 153 XM_ProductURIs 3472 0.78 0.70 0.81 154 TR_LOTS_OF_MONEY3 3461 1.97 4.50 0.81 155 TVD_SPACE_RATIO 3440 0.57 0.06 0.80 156 T_FILL_THIS_FORM_SHORT 3424 1.41 2.73 0.80 157 XMSolicitRefs_0 3409 0.62 0.24 0.80 158 TR_MetaPhish_Combo_01 3347 0.81 0.87 0.78 159 XMBrknScrpt_02 3332 1.32 2.51 0.78 160 RELAYCOUNTRY_GB 3316 0.79 0.84 0.77 161 XMSubMetaSxObfu_03 3232 1.12 1.91 0.75 162 TooManyTo_005 3126 0.59 0.30 0.73 163 SpammyFromTLD_01 2967 2.21 5.52 0.69 164 NML_ADSP_CUSTOM_MED 2827 0.70 0.79 0.66 165 XMSubMetaI_00 2792 0.96 1.64 0.65 166 T_Symld_Words_02 2777 0.88 1.38 0.65 167 XM_RXBody 2749 0.60 0.50 0.64 168 XMHTMLBadTable_001 2619 0.66 0.77 0.61 169 XM_ShortIntro_01 2556 0.49 0.27 0.60 170 PDS_OTHER_BAD_TLD 2530 0.95 1.74 0.59 171 XMGenDplmaNmb 2509 0.82 1.33 0.59 172 T_TooManySym_03 2461 0.43 0.13 0.57 173 HTML_IMAGE_ONLY_20 2409 0.52 0.43 0.56 174 XM_SPF_Unknown 2397 0.63 0.78 0.56 175 T_OBFU_PDF_ATTACH 2358 0.42 0.12 0.55 176 FORGED_GMAIL_RCVD 2351 1.27 2.83 0.55 177 MPART_ALT_DIFF_COUNT 2346 0.68 0.96 0.55 178 XMMoneyMeta_00 2262 0.68 1.00 0.53 179 TM2_M_BODY_EMPTY 2214 0.38 0.07 0.52 180 XMNoVowels 2211 0.48 0.41 0.52 181 XMLngstWrd_00 2153 0.43 0.29 0.50 182 DIET_1 2153 0.71 1.17 0.50 183 RDNS_DYNAMIC 2120 0.56 0.71 0.50 184 XMBody_17 2107 1.47 3.60 0.49 185 XM_B_SpammyWords4 2038 0.88 1.77 0.48 186 XM_H_PHPMailer 1971 0.51 0.60 0.46 187 RCVD_IN_SORBS_DUL 1902 0.34 0.12 0.44 188 SHORT_HELO_AND_INLINE_IMAGE 1902 0.32 0.04 0.44 189 XMLngstWrd_01 1876 0.38 0.25 0.44 190 XMBdyGiftCard01 1836 0.99 2.21 0.43 191 USER_IN_WELCOMELIST 1836 0.29 0.00 0.43 192 USER_IN_WHITELIST 1836 0.29 0.00 0.43 193 XMPhish14 1813 0.49 0.64 0.42 194 XMBody_78 1739 0.54 0.83 0.41 195 XMPhish30 1713 0.56 0.89 0.40 196 XM_B_COPY_HTML 1705 0.45 0.57 0.40 197 TR_XM_COVIDMETA4 1646 0.66 1.26 0.38 198 XM_DIRTYINTL 1643 1.22 3.05 0.38 199 GMD_PDF_EMPTY_BODY 1643 0.28 0.04 0.38 200 RELAYCOUNTRY_DE 1635 0.96 2.23 0.38 ----------------------------------------------------------------------