Email: 368000 Autolearn: 0 AvgScore: 1.72 AvgScanTime: 2.02 sec Spam: 88220 Autolearn: 0 AvgScore: 12.02 AvgScanTime: 3.26 sec Ham: 279780 Autolearn: 0 AvgScore: -1.53 AvgScanTime: 1.63 sec Time Spent Running SA: 206.45 hours Time Spent Processing Spam: 79.81 hours Time Spent Processing Ham: 126.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82297 87.54 93.29 85.73 2 DKIM_SIGNED 76463 80.40 86.67 78.42 3 XM_DK_Pass 74590 79.11 84.55 77.40 4 DCC_CHECK 69312 54.81 78.57 47.31 5 XM_B_Unicode 69252 72.89 78.50 71.13 6 RELAYCOUNTRY_US 67798 79.31 76.85 80.09 7 XMListUnsubscribeExists 65622 58.97 74.38 54.10 8 DKIM_VALID 65429 73.66 74.17 73.50 9 DKIM_VALID_AU 49291 58.29 55.87 59.05 10 XM_DK_Undo_02 43139 18.35 48.90 8.72 11 XM_B_Unicode3 37272 42.72 42.25 42.87 12 BAYES_50 36023 49.25 40.83 51.91 13 LOC_TINY_FONT_1 31791 31.03 36.04 29.46 14 MIME_HTML_ONLY 30836 25.83 34.95 22.96 15 BAYES_99 27950 11.63 31.68 5.30 16 DKIM_VALID_EF 26522 27.87 30.06 27.18 17 HTML_FONT_LOW_CONTRAST 26194 30.74 29.69 31.07 18 T_KAM_HTML_FONT_INVALID 25374 19.97 28.76 17.20 19 TR_DCC_Bayes_99 22121 7.97 25.07 2.57 20 BAYES_999 21861 9.02 24.78 4.05 21 FVGT_m_MULTI_ODD 21492 22.79 24.36 22.30 22 RELAYCOUNTRY_META 20901 9.79 23.69 5.40 23 XMSubLong 20624 20.76 23.38 19.94 24 XM_UncommonTLD01 17579 7.50 19.93 3.58 25 DCC_CHECK_NEGATIVE 17557 43.97 19.90 51.56 26 RCVD_IN_MSPIKE_H2 17508 18.83 19.85 18.51 27 BOTNET 16326 6.53 18.51 2.75 28 XM_Body_Dirty_Words 16261 15.20 18.43 14.18 29 T_TM2_M_HEADER_IN_MSG 15622 20.67 17.71 21.61 30 XM_Multi_Part_URI 14326 14.82 16.24 14.37 31 HTML_IMAGE_RATIO_02 13590 10.65 15.40 9.16 32 BOTNET_IPINHOSTNAME 12334 8.09 13.98 6.23 33 LOTS_OF_MONEY 12132 10.42 13.75 9.37 34 XM_B_Unsub 11779 12.26 13.35 11.91 35 UNTRUSTED_Relay 11492 4.67 13.03 2.03 36 DKIM_INVALID 11034 6.73 12.51 4.91 37 XM_B_Phish_Phrases 9728 8.77 11.03 8.06 38 XMSexyCombo_05 8721 6.13 9.89 4.95 39 FSL_BULK_SIG 7944 9.69 9.00 9.90 40 LotsOfNums_01 7735 8.71 8.77 8.70 41 RELAYCOUNTRY_CA 7655 3.47 8.68 1.83 42 BAYES_80 7602 5.16 8.62 4.07 43 XM_Evil_Numbers_Gen 7569 9.80 8.58 10.18 44 XMSubMetaSx_00 7249 5.44 8.22 4.56 45 NO_DNS_FOR_FROM 7210 3.99 8.17 2.67 46 XM_CamelCaseFrm001 7193 3.90 8.15 2.55 47 RCVD_IN_MSPIKE_BL 6975 3.03 7.91 1.49 48 RCVD_IN_BL_SPAMCOP_NET 6667 2.65 7.56 1.10 49 TooManyTo_001 6626 7.25 7.51 7.16 50 URIBL_SBL_A 6130 1.82 6.95 0.20 51 XM_UB50 6032 2.58 6.84 1.23 52 MPART_ALT_DIFF 5948 5.79 6.74 5.49 53 BAYES_60 5557 6.78 6.30 6.93 54 RCVD_IN_MSPIKE_L3 5353 2.48 6.07 1.35 55 XM_H_Long_From01 5224 5.89 5.92 5.88 56 SpammyFromTLD_02 5069 1.51 5.75 0.17 57 UNPARSEABLE_RELAY 5006 7.86 5.67 8.56 58 HTML_IMAGE_RATIO_04 4968 6.64 5.63 6.96 59 TR_XM_MaxBayes 4931 1.36 5.59 0.03 60 XMBody_17 4828 1.91 5.47 0.79 61 XM_B_COVIDMETA 4528 2.74 5.13 1.98 62 TR_XM_PhishingBody 4321 3.36 4.90 2.87 63 TR_LOTS_OF_MONEY3 4291 1.47 4.86 0.40 64 RELAYCOUNTRY_FR 4252 1.35 4.82 0.26 65 BAYES_95 4245 3.01 4.81 2.44 66 XM_SendGrid 4097 6.98 4.64 7.72 67 FROM_SUSPICIOUS_NTLD 3952 1.10 4.48 0.03 68 FROM_SUSPICIOUS_NTLD_FP 3923 1.09 4.45 0.03 69 MIME_HTML_MOSTLY 3906 3.20 4.43 2.81 70 TR_XM_COVIDMETA4 3785 1.63 4.29 0.79 71 XM_B_SpammyTLD 3695 2.77 4.19 2.32 72 XMNumbers 3615 3.40 4.10 3.17 73 PDS_OTHER_BAD_TLD 3587 1.60 4.07 0.82 74 XM_B_Unsub2 3563 2.71 4.04 2.29 75 HTML_IMAGE_RATIO_06 3313 4.22 3.76 4.36 76 XMStrtUSub 3307 4.53 3.75 4.78 77 RCVD_IN_MSPIKE_WL 3249 12.45 3.68 15.21 78 MISSING_HEADERS 3058 1.10 3.47 0.36 79 SpammyFromTLD_01 3046 1.15 3.45 0.42 80 FROM_EXCESS_BASE64 3022 3.50 3.43 3.53 81 XM_OfRef6 3000 1.62 3.40 1.06 82 KHOP_HELO_FCRDNS 2939 1.73 3.33 1.23 83 XM_DIRTYINTL 2883 1.14 3.27 0.48 84 ALL_TRUSTED 2830 12.76 3.21 15.78 85 RCVD_IN_RP_SAFE 2770 9.44 3.14 11.42 86 MIME_QP_LONG_LINE 2703 4.13 3.06 4.47 87 TM2_M_URI_OPT_OUT 2587 3.51 2.93 3.70 88 TR_XM_INV_DKIM 2524 0.88 2.86 0.26 89 TR_Mismatch_TLD_02 2519 0.73 2.86 0.06 90 T_XMDrugObfuBody_08 2477 1.60 2.81 1.22 91 XMStockSpam_06 2384 1.87 2.70 1.61 92 XMSubNoVowel 2355 1.09 2.67 0.60 93 DATE_IN_PAST_03_06 2353 0.78 2.67 0.19 94 XM_SPF_SoftFail 2334 1.39 2.65 1.00 95 XMSexyCombo_01 2321 1.68 2.63 1.38 96 REPLYTO_WITHOUT_TO_CC 2313 0.68 2.62 0.06 97 DATE_IN_PAST_06_12 2299 0.67 2.61 0.06 98 RCVD_IN_MSPIKE_H3 2263 8.51 2.57 10.38 99 XMSubEmpty 2246 0.76 2.55 0.20 100 XM_B_Phish66 2235 1.63 2.53 1.35 101 LongTLD 2206 0.74 2.50 0.18 102 TR_XM_MaxSPIKE 2176 0.72 2.47 0.16 103 BAYES_40 2141 4.37 2.43 4.98 104 MIME_HTML_ONLY_MULTI 2108 2.89 2.39 3.05 105 T_TooManySym_01 2064 4.86 2.34 5.65 106 DATE_IN_PAST_12_24 2047 0.60 2.32 0.06 107 RCVD_IN_RP_CERTIFIED 2007 8.70 2.27 10.72 108 URI_HEX 1990 1.50 2.26 1.27 109 BAYES_20 1920 3.56 2.18 4.00 110 TooManyTo_002 1913 1.89 2.17 1.80 111 XM_URI_RBL 1875 0.69 2.13 0.24 112 TR_XM_PHPDW 1872 0.90 2.12 0.52 113 TR_LOTS_OF_MONEY1 1855 0.52 2.10 0.02 114 TR_XM_PHPForged 1850 0.88 2.10 0.50 115 TR_XM_FormFill2 1829 0.87 2.07 0.49 116 XM_H_PHPOS 1826 0.87 2.07 0.49 117 TM2_M_VERY_LONG_WORD 1816 1.59 2.06 1.44 118 T_XMHurry_00 1770 0.88 2.01 0.52 119 TR_XM_DK_SendGrid 1727 3.89 1.96 4.50 120 XMBdyGiftCard01 1696 1.58 1.92 1.47 121 TooManyTo_003 1681 1.42 1.91 1.27 122 T_FILL_THIS_FORM_SHORT 1621 1.47 1.84 1.35 123 BAYES_00 1575 13.93 1.79 17.76 124 RCVD_IN_PSBL 1516 0.43 1.72 0.02 125 XMHTML_After_End 1490 0.85 1.69 0.58 126 RDNS_DYNAMIC 1479 0.78 1.68 0.49 127 URI_TRY_3LD 1466 1.51 1.66 1.47 128 RCVD_IN_IADB_LISTED 1464 3.22 1.66 3.71 129 TooManyTo_004 1459 1.16 1.65 1.01 130 T_REMOTE_IMAGE 1387 3.31 1.57 3.86 131 HTML_IMAGE_RATIO_08 1337 1.98 1.52 2.13 132 XM_UB99 1334 0.37 1.51 0.01 133 RCVD_IN_IADB_SPF 1310 2.83 1.48 3.25 134 XM_UB60 1300 0.41 1.47 0.07 135 HTML_FONT_SIZE_HUGE 1278 0.55 1.45 0.26 136 URI_WP_HACKED_2 1278 0.49 1.45 0.18 137 TR_XM_RelayPhish 1266 0.45 1.44 0.14 138 XMBrknScrpt_02 1257 1.14 1.42 1.06 139 T_XMDrugObfuBody_14 1255 1.78 1.42 1.89 140 RCVD_IN_IADB_DK 1254 2.49 1.42 2.83 141 RCVD_IN_IADB_SENDERID 1243 2.56 1.41 2.93 142 XMDiploma_00 1237 1.18 1.40 1.11 143 RELAYCOUNTRY_DE 1236 0.78 1.40 0.59 144 TR_XM_COVIDMETA1 1233 0.60 1.40 0.35 145 XM_ProductURIs 1221 1.06 1.38 0.95 146 BAYES_05 1202 2.30 1.36 2.60 147 RELAYCOUNTRY_GB 1198 1.02 1.36 0.91 148 HTML_MIME_NO_HTML_TAG 1167 1.52 1.32 1.58 149 XM_UB80 1164 0.33 1.32 0.02 150 RCVD_IN_RP_RNBL 1143 0.34 1.30 0.04 151 TR_XM_DK_Bayes 1136 10.73 1.29 13.71 152 DIET_1 1106 0.56 1.25 0.34 153 MPART_ALT_DIFF_COUNT 1095 0.61 1.24 0.41 154 XMSubMetaSSx_00 1068 0.49 1.21 0.27 155 TooManyTo_005 1064 0.95 1.21 0.87 156 XMSlimDrugH 1055 0.52 1.20 0.30 157 PLING_QUERY 1046 0.77 1.19 0.63 158 XMSexyCombo_04 1002 0.89 1.14 0.81 159 SUBJ_ALL_CAPS 999 1.23 1.13 1.26 160 URI_NOVOWEL 993 0.64 1.13 0.49 161 RCVD_IN_MSPIKE_H4 979 3.92 1.11 4.81 162 DATE_IN_PAST_24_48 964 0.27 1.09 0.01 163 XMPhish30 962 0.66 1.09 0.52 164 XM_H_PHPMailer 932 0.68 1.06 0.56 165 SUSPICIOUS_RECIPS 920 0.26 1.04 0.01 166 RCVD_IN_MSPIKE_L5 913 0.28 1.03 0.04 167 MIME_HEADER_CTYPE_ONLY 889 0.45 1.01 0.27 168 XM_DK_Undo_01 879 1.33 1.00 1.43 169 BODY_URI_ONLY 874 0.27 0.99 0.04 170 URIBL_BLACK 860 0.25 0.97 0.02 171 XM_UB999 859 0.24 0.97 0.00 172 TR_MetaPhish_Combo_01 849 1.07 0.96 1.10 173 HK_RANDOM_REPLYTO 838 0.37 0.95 0.19 174 XM_XX_Yahoo 826 0.24 0.94 0.02 175 HTML_IMAGE_ONLY_08 817 0.35 0.93 0.16 176 TR_Mismatch_TLD_01 809 0.39 0.92 0.22 177 XMSubMetaSxObfu_03 802 0.53 0.91 0.40 178 BOTNET_NORDNS 801 0.24 0.91 0.03 179 XMBody_78 784 0.50 0.89 0.38 180 XM_OfRef7 781 0.33 0.89 0.15 181 HTML_SHORT_LINK_IMG_1 770 0.24 0.87 0.03 182 T_XMDrugObfuBody_00 764 0.59 0.87 0.50 183 HDRS_LCASE_IMGONLY 761 0.22 0.86 0.02 184 XMHTMLBadTable_001 756 0.71 0.86 0.67 185 SUBJ_DOLLARS 751 0.55 0.85 0.45 186 T_MONEY_PERCENT 730 0.42 0.83 0.29 187 TR_LOTS_OF_MONEY2 730 0.42 0.83 0.29 188 FROM_ILLEGAL_CHARS 720 0.20 0.82 0.00 189 SHORT_IMG_SUSP_NTLD 718 0.20 0.81 0.00 190 XMGppyBdWords 714 0.29 0.81 0.12 191 XMReplyNow 710 0.25 0.80 0.07 192 RCVD_IN_MSPIKE_L4 709 0.27 0.80 0.11 193 XM_H_PHPOS_M 708 0.37 0.80 0.24 194 MAILING_LIST_MULTI 702 1.72 0.80 2.01 195 XM_UB95 694 0.19 0.79 0.01 196 TR_XM_DK_Bayes1 687 10.01 0.78 12.92 197 T_HTML_TAG_BALANCE_CENTER 679 0.37 0.77 0.24 198 INVESTMENT_ADVICE 664 0.24 0.75 0.07 199 DKIM_ADSP_NXDOMAIN 661 0.47 0.75 0.38 200 HTTPS_HTTP_MISMATCH 660 0.58 0.75 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239845 87.54 93.29 85.73 2 RELAYCOUNTRY_US 224079 79.31 76.85 80.09 3 DKIM_SIGNED 219391 80.40 86.67 78.42 4 XM_DK_Pass 216544 79.11 84.55 77.40 5 DKIM_VALID 205651 73.66 74.17 73.50 6 XM_B_Unicode 199001 72.89 78.50 71.13 7 DKIM_VALID_AU 165198 58.29 55.87 59.05 8 XMListUnsubscribeExists 151373 58.97 74.38 54.10 9 BAYES_50 145231 49.25 40.83 51.91 10 DCC_CHECK_NEGATIVE 144243 43.97 19.90 51.56 11 DCC_CHECK 132373 54.81 78.57 47.31 12 XM_B_Unicode3 119938 42.72 42.25 42.87 13 HTML_FONT_LOW_CONTRAST 86939 30.74 29.69 31.07 14 LOC_TINY_FONT_1 82416 31.03 36.04 29.46 15 DKIM_VALID_EF 76054 27.87 30.06 27.18 16 MIME_HTML_ONLY 64226 25.83 34.95 22.96 17 FVGT_m_MULTI_ODD 62387 22.79 24.36 22.30 18 T_TM2_M_HEADER_IN_MSG 60457 20.67 17.71 21.61 19 XMSubLong 55786 20.76 23.38 19.94 20 RCVD_IN_MSPIKE_H2 51774 18.83 19.85 18.51 21 BAYES_00 49701 13.93 1.79 17.76 22 T_KAM_HTML_FONT_INVALID 48127 19.97 28.76 17.20 23 ALL_TRUSTED 44136 12.76 3.21 15.78 24 RCVD_IN_MSPIKE_WL 42563 12.45 3.68 15.21 25 XM_Multi_Part_URI 40212 14.82 16.24 14.37 26 XM_Body_Dirty_Words 39685 15.20 18.43 14.18 27 TR_XM_DK_Bayes 38345 10.73 1.29 13.71 28 TR_XM_DK_Bayes1 36134 10.01 0.78 12.92 29 TR_XM_DK_Bayes2 33601 9.30 0.70 12.01 30 XM_B_Unsub 33320 12.26 13.35 11.91 31 RCVD_IN_RP_SAFE 31957 9.44 3.14 11.42 32 XM_DKIMWhitelistDomains 31272 8.53 0.12 11.18 33 RCVD_IN_RP_CERTIFIED 29994 8.70 2.27 10.72 34 RCVD_IN_MSPIKE_H3 29041 8.51 2.57 10.38 35 XM_Evil_Numbers_Gen 28493 9.80 8.58 10.18 36 FSL_BULK_SIG 27706 9.69 9.00 9.90 37 LOTS_OF_MONEY 26206 10.42 13.75 9.37 38 HTML_IMAGE_RATIO_02 25615 10.65 15.40 9.16 39 XM_DK_Undo_02 24405 18.35 48.90 8.72 40 LotsOfNums_01 24329 8.71 8.77 8.70 41 UNPARSEABLE_RELAY 23937 7.86 5.67 8.56 42 XM_B_Phish_Phrases 22551 8.77 11.03 8.06 43 XM_SendGrid 21589 6.98 4.64 7.72 44 TooManyTo_001 20044 7.25 7.51 7.16 45 HTML_IMAGE_RATIO_04 19474 6.64 5.63 6.96 46 BAYES_60 19398 6.78 6.30 6.93 47 BOTNET_IPINHOSTNAME 17420 8.09 13.98 6.23 48 XM_H_Long_From01 16442 5.89 5.92 5.88 49 T_TooManySym_01 15810 4.86 2.34 5.65 50 MPART_ALT_DIFF 15356 5.79 6.74 5.49 51 RELAYCOUNTRY_META 15112 9.79 23.69 5.40 52 BAYES_99 14839 11.63 31.68 5.30 53 BAYES_40 13943 4.37 2.43 4.98 54 XMSexyCombo_05 13847 6.13 9.89 4.95 55 DKIM_INVALID 13740 6.73 12.51 4.91 56 RCVD_IN_MSPIKE_H4 13453 3.92 1.11 4.81 57 XMStrtUSub 13371 4.53 3.75 4.78 58 XMSubMetaSx_00 12759 5.44 8.22 4.56 59 TR_XM_DK_SendGrid 12586 3.89 1.96 4.50 60 MIME_QP_LONG_LINE 12507 4.13 3.06 4.47 61 HTML_IMAGE_RATIO_06 12207 4.22 3.76 4.36 62 ANY_BOUNCE_MESSAGE 11859 3.29 0.29 4.24 63 BOUNCE_MESSAGE 11856 3.29 0.29 4.24 64 BAYES_80 11380 5.16 8.62 4.07 65 BAYES_999 11342 9.02 24.78 4.05 66 BAYES_20 11187 3.56 2.18 4.00 67 T_REMOTE_IMAGE 10796 3.31 1.57 3.86 68 RCVD_IN_IADB_LISTED 10380 3.22 1.66 3.71 69 TM2_M_URI_OPT_OUT 10348 3.51 2.93 3.70 70 XM_UncommonTLD01 10004 7.50 19.93 3.58 71 FROM_EXCESS_BASE64 9866 3.50 3.43 3.53 72 RCVD_IN_IADB_SPF 9105 2.83 1.48 3.25 73 XMNumbers 8883 3.40 4.10 3.17 74 TVD_RCVD_IP 8777 2.44 0.25 3.14 75 MIME_HTML_ONLY_MULTI 8540 2.89 2.39 3.05 76 IN_ZIMBRA_NJ_WHITELIST 8384 2.28 0.01 3.00 77 RCVD_IN_IADB_SENDERID 8186 2.56 1.41 2.93 78 T_TooManySym_02 8138 2.36 0.60 2.91 79 TR_XM_PhishingBody 8041 3.36 4.90 2.87 80 RCVD_IN_IADB_DK 7914 2.49 1.42 2.83 81 MIME_HTML_MOSTLY 7863 3.20 4.43 2.81 82 BOTNET 7699 6.53 18.51 2.75 83 NO_DNS_FOR_FROM 7464 3.99 8.17 2.67 84 BAYES_05 7261 2.30 1.36 2.60 85 TR_DCC_Bayes_99 7202 7.97 25.07 2.57 86 XM_CamelCaseFrm001 7141 3.90 8.15 2.55 87 INVALID_MSGID 7111 1.98 0.22 2.54 88 HELO_MISC_IP 7070 1.94 0.08 2.53 89 CK_HELO_DYNAMIC_SPLIT_IP 7069 1.94 0.07 2.53 90 BAYES_95 6840 3.01 4.81 2.44 91 XM_B_SpammyTLD 6493 2.77 4.19 2.32 92 RCVD_IN_IADB_VOUCHED 6486 1.91 0.63 2.32 93 XM_B_Unsub2 6408 2.71 4.04 2.29 94 TO_MALFORMED 6274 1.72 0.05 2.24 95 HTML_IMAGE_RATIO_08 5946 1.98 1.52 2.13 96 XM_PDF 5689 1.65 0.42 2.03 97 UNTRUSTED_Relay 5680 4.67 13.03 2.03 98 MAILING_LIST_MULTI 5622 1.72 0.80 2.01 99 XM_B_COVIDMETA 5547 2.74 5.13 1.98 100 IN_HORDE_ADDRESS_BOOK 5527 1.51 0.03 1.98 101 XM_H_Trusted_IP 5357 1.46 0.00 1.91 102 T_XMDrugObfuBody_14 5281 1.78 1.42 1.89 103 USER_IN_DEF_DKIM_WL 5151 1.40 0.00 1.84 104 RELAYCOUNTRY_CA 5113 3.47 8.68 1.83 105 TooManyTo_002 5048 1.89 2.17 1.80 106 XMStockSpam_06 4502 1.87 2.70 1.61 107 HTML_MIME_NO_HTML_TAG 4432 1.52 1.32 1.58 108 RCVD_IN_MSPIKE_BL 4182 3.03 7.91 1.49 109 XMBdyGiftCard01 4112 1.58 1.92 1.47 110 URI_TRY_3LD 4100 1.51 1.66 1.47 111 TM2_M_VERY_LONG_WORD 4034 1.59 2.06 1.44 112 RCVD_IN_IADB_OPTIN 4002 1.21 0.51 1.43 113 XM_DK_Undo_01 4001 1.33 1.00 1.43 114 XM_GoogleGroups 3954 1.16 0.36 1.41 115 XMSexyCombo_01 3872 1.68 2.63 1.38 116 RCVD_IN_MSPIKE_L3 3784 2.48 6.07 1.35 117 XM_B_Phish66 3776 1.63 2.53 1.35 118 T_FILL_THIS_FORM_SHORT 3772 1.47 1.84 1.35 119 TR_Symld_Words 3666 1.16 0.69 1.31 120 TooManyTo_003 3554 1.42 1.91 1.27 121 URI_HEX 3547 1.50 2.26 1.27 122 SUBJ_ALL_CAPS 3533 1.23 1.13 1.26 123 XM_UB50 3447 2.58 6.84 1.23 124 KHOP_HELO_FCRDNS 3432 1.73 3.33 1.23 125 T_XMDrugObfuBody_08 3412 1.60 2.81 1.22 126 XM_H_Long_From02 3365 1.03 0.46 1.20 127 DKIM_ADSP_CUSTOM_MED 3264 1.06 0.74 1.17 128 XMGappySubj_01 3239 0.94 0.26 1.16 129 XMDiploma_00 3119 1.18 1.40 1.11 130 RCVD_IN_BL_SPAMCOP_NET 3087 2.65 7.56 1.10 131 TR_MetaPhish_Combo_01 3077 1.07 0.96 1.10 132 XM_OfRef6 2969 1.62 3.40 1.06 133 XMBrknScrpt_02 2953 1.14 1.42 1.06 134 TooManyTo_004 2822 1.16 1.65 1.01 135 HTML_FONT_FACE_BAD 2802 0.88 0.50 1.00 136 XM_SPF_SoftFail 2793 1.39 2.65 1.00 137 XM_ProductURIs 2670 1.06 1.38 0.95 138 RELAYCOUNTRY_GB 2554 1.02 1.36 0.91 139 TooManyTo_005 2426 0.95 1.21 0.87 140 T_TooManySym_03 2426 0.71 0.21 0.87 141 NML_ADSP_CUSTOM_MED 2315 0.77 0.59 0.83 142 PDS_OTHER_BAD_TLD 2290 1.60 4.07 0.82 143 XMSexyCombo_04 2270 0.89 1.14 0.81 144 TR_XM_COVIDMETA4 2221 1.63 4.29 0.79 145 TR_MSPIKEBAYES00 2221 0.60 0.00 0.79 146 XMBody_17 2205 1.91 5.47 0.79 147 XMHTMLBadTable_001 1870 0.71 0.86 0.67 148 THIS_AD 1867 0.65 0.60 0.67 149 USER_IN_WHITELIST 1812 0.49 0.00 0.65 150 PLING_QUERY 1773 0.77 1.19 0.63 151 XMSubMetaI_00 1771 0.63 0.61 0.63 152 TR_MetaPhish_Combo_01b 1687 0.49 0.12 0.60 153 XMSubNoVowel 1673 1.09 2.67 0.60 154 HTML_TAG_BALANCE_BODY 1655 0.61 0.67 0.59 155 XMGenDplmaNmb 1653 0.62 0.72 0.59 156 RELAYCOUNTRY_DE 1647 0.78 1.40 0.59 157 XMHTML_After_End 1629 0.85 1.69 0.58 158 BASE64_LENGTH_79_INF 1605 0.53 0.40 0.57 159 XMPhish08 1558 0.59 0.72 0.56 160 XM_H_PHPMailer 1557 0.68 1.06 0.56 161 TM2_M_A_HREF_HREF 1548 0.55 0.56 0.55 162 HTML_IMAGE_ONLY_20 1507 0.55 0.58 0.54 163 HTTPS_HTTP_MISMATCH 1475 0.58 0.75 0.53 164 XM_B_REG_HTML 1471 0.56 0.66 0.53 165 XMBody_95 1468 0.42 0.08 0.52 166 XMPhish30 1467 0.66 1.09 0.52 167 HTML_OBFUSCATE_05_10 1465 0.42 0.07 0.52 168 T_XMHurry_00 1459 0.88 2.01 0.52 169 XMSubMetaSxObfu_02 1457 0.56 0.68 0.52 170 FORGED_GMAIL_RCVD 1448 0.54 0.61 0.52 171 TR_XM_PHPDW 1442 0.90 2.12 0.52 172 XMCapTrack 1426 0.47 0.33 0.51 173 T_XMDrugObfuBody_00 1399 0.59 0.87 0.50 174 TR_XM_PHPForged 1388 0.88 2.10 0.50 175 TR_XM_FormFill2 1380 0.87 2.07 0.49 176 URI_NOVOWEL 1378 0.64 1.13 0.49 177 RDNS_DYNAMIC 1375 0.78 1.68 0.49 178 XM_H_PHPOS 1359 0.87 2.07 0.49 179 XMLngstWrd_00 1351 0.44 0.30 0.48 180 HELO_NODOT 1350 0.49 0.50 0.48 181 HELO_NO_DOMAIN 1349 0.49 0.50 0.48 182 XMRcvdHeader_15 1345 0.37 0.00 0.48 183 XM_B_COPY_HTML 1339 0.53 0.68 0.48 184 XM_RXBody 1333 0.49 0.55 0.48 185 XM_DIRTYINTL 1329 1.14 3.27 0.48 186 TVD_SPACE_RATIO 1306 0.38 0.10 0.47 187 SUBJ_DOLLARS 1272 0.55 0.85 0.45 188 XMSolicitRefs_0 1256 0.41 0.27 0.45 189 XMLngstWrd_01 1231 0.40 0.28 0.44 190 XMPhish14 1222 0.49 0.64 0.44 191 XMBSHREFv2 1202 0.36 0.15 0.43 192 SpammyFromTLD_01 1169 1.15 3.45 0.42 193 XM_ShortIntro_01 1163 0.37 0.23 0.42 194 MPART_ALT_DIFF_COUNT 1146 0.61 1.24 0.41 195 TO_NO_BRKTS_HTML_ONLY 1138 0.35 0.19 0.41 196 TR_LOTS_OF_MONEY3 1130 1.47 4.86 0.40 197 XMSubMetaSxObfu_03 1130 0.53 0.91 0.40 198 T_OBFU_PDF_ATTACH 1065 0.32 0.14 0.38 199 DKIM_ADSP_NXDOMAIN 1062 0.47 0.75 0.38 200 XMBody_78 1055 0.50 0.89 0.38 ----------------------------------------------------------------------