Email: 369785 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 2.03 sec Spam: 58339 Autolearn: 0 AvgScore: 11.98 AvgScanTime: 3.75 sec Ham: 311446 Autolearn: 0 AvgScore: -2.52 AvgScanTime: 1.70 sec Time Spent Running SA: 208.24 hours Time Spent Processing Spam: 60.83 hours Time Spent Processing Ham: 147.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 57375 98.79 98.35 98.87 2 HTML_MESSAGE 54455 88.47 93.34 87.55 3 DKIM_SIGNED 46694 80.03 80.04 80.02 4 XM_DK_Pass 45598 78.96 78.16 79.12 5 XM_B_Unicode 42859 74.02 73.47 74.12 6 XMListUnsubscribeExists 41687 60.38 71.46 58.30 7 RELAYCOUNTRY_US 41542 80.70 71.21 82.48 8 DKIM_VALID 38180 73.39 65.45 74.88 9 XM_DK_Undo_02 35393 21.34 60.67 13.98 10 DKIM_VALID_AU 27047 57.99 46.36 60.16 11 BAYES_99 26054 14.88 44.66 9.30 12 MIME_HTML_ONLY 25247 26.93 43.28 23.86 13 BAYES_999 21802 12.12 37.37 7.39 14 XM_B_Unicode3 20921 43.32 35.86 44.72 15 BAYES_50 19262 47.70 33.02 50.45 16 DKIM_VALID_EF 18943 28.45 32.47 27.70 17 LOC_TINY_FONT_1 17579 30.70 30.13 30.81 18 RELAYCOUNTRY_META 17342 9.28 29.73 5.45 19 BOTNET 17005 7.57 29.15 3.53 20 T_KAM_HTML_FONT_INVALID 14984 19.59 25.68 18.45 21 XM_UncommonTLD01 14168 7.42 24.29 4.26 22 FVGT_m_MULTI_ODD 14129 23.41 24.22 23.26 23 XMSubLong 13703 21.23 23.49 20.80 24 RCVD_IN_MSPIKE_H2 13346 21.36 22.88 21.07 25 HTML_FONT_LOW_CONTRAST 13187 31.09 22.60 32.68 26 T_TM2_M_HEADER_IN_MSG 11640 20.83 19.95 20.99 27 UNTRUSTED_Relay 10528 4.63 18.05 2.11 28 BOTNET_IPINHOSTNAME 9989 8.56 17.12 6.95 29 XM_Multi_Part_URI 9292 14.73 15.93 14.50 30 XM_Body_Dirty_Words 9203 14.89 15.78 14.72 31 LOTS_OF_MONEY 9162 10.45 15.70 9.47 32 DKIM_INVALID 8514 6.64 14.59 5.15 33 HTML_IMAGE_RATIO_02 7602 9.63 13.03 8.99 34 RELAYCOUNTRY_CA 7145 3.65 12.25 2.04 35 XMSexyCombo_05 6866 6.25 11.77 5.22 36 NO_DNS_FOR_FROM 6573 4.34 11.27 3.04 37 XM_CamelCaseFrm001 6532 4.03 11.20 2.68 38 URIBL_SBL_A 6181 1.97 10.59 0.36 39 RCVD_IN_MSPIKE_BL 6097 2.22 10.45 0.68 40 TR_XM_MaxBayes 5806 1.67 9.95 0.12 41 XMSubMetaSx_00 5736 5.76 9.83 4.99 42 XM_B_Phish_Phrases 5674 7.75 9.73 7.38 43 XM_B_Unsub 5405 10.53 9.26 10.77 44 RCVD_IN_RP_RNBL 4584 1.37 7.86 0.16 45 XM_UB50 4439 2.33 7.61 1.34 46 RCVD_IN_MSPIKE_L3 4417 1.68 7.57 0.57 47 XMBody_17 4082 1.88 7.00 0.92 48 LotsOfNums_01 4028 8.63 6.90 8.95 49 XM_Evil_Numbers_Gen 4019 9.63 6.89 10.15 50 BAYES_80 3891 4.85 6.67 4.50 51 FROM_SUSPICIOUS_NTLD 3668 1.12 6.29 0.15 52 BAYES_60 3586 6.62 6.15 6.70 53 FROM_SUSPICIOUS_NTLD_FP 3527 1.07 6.05 0.14 54 XMNumbers 3397 3.83 5.82 3.46 55 RCVD_IN_BL_SPAMCOP_NET 3263 2.16 5.59 1.52 56 TR_LOTS_OF_MONEY3 3224 1.57 5.53 0.83 57 XM_B_COVIDMETA 3080 2.02 5.28 1.41 58 LongTLD 3048 1.03 5.22 0.24 59 XM_H_Long_From01 2992 5.87 5.13 6.01 60 TR_XM_COVIDMETA4 2959 1.39 5.07 0.70 61 TR_XM_INV_DKIM 2955 0.94 5.07 0.17 62 T_XMDrugObfuBody_08 2899 2.33 4.97 1.83 63 TooManyTo_001 2864 6.82 4.91 7.17 64 XM_SPF_SoftFail 2849 1.77 4.88 1.19 65 BOTNET_NORDNS 2841 0.78 4.87 0.02 66 HTML_IMAGE_RATIO_04 2824 6.96 4.84 7.35 67 RELAYCOUNTRY_FR 2783 1.01 4.77 0.31 68 MPART_ALT_DIFF 2759 5.68 4.73 5.86 69 RCVD_IN_MSPIKE_WL 2744 21.26 4.70 24.36 70 MIME_HTML_MOSTLY 2732 3.05 4.68 2.75 71 KHOP_HELO_FCRDNS 2674 1.67 4.58 1.13 72 XM_UB99 2652 0.72 4.55 0.01 73 TR_XM_MaxSPIKE 2594 0.73 4.45 0.03 74 PDS_OTHER_BAD_TLD 2569 1.46 4.40 0.91 75 TR_XM_PhishingBody 2554 3.01 4.38 2.76 76 UNPARSEABLE_RELAY 2451 8.30 4.20 9.07 77 SpammyFromTLD_01 2438 1.25 4.18 0.70 78 T_REMOTE_IMAGE 2419 3.39 4.15 3.25 79 XM_DIRTYINTL 2400 1.11 4.11 0.54 80 DATE_IN_PAST_03_06 2339 0.74 4.01 0.13 81 XM_B_SpammyTLD 2330 2.61 3.99 2.35 82 XMStrtUSub 2288 4.58 3.92 4.70 83 FROM_EXCESS_BASE64 2277 3.78 3.90 3.76 84 XM_URI_RBL 2209 0.78 3.79 0.21 85 XM_UB999 2172 0.59 3.72 0.01 86 BAYES_95 2083 2.94 3.57 2.82 87 HTML_MIME_NO_HTML_TAG 1857 1.95 3.18 1.72 88 HTML_IMAGE_RATIO_08 1836 2.77 3.15 2.69 89 DATE_IN_PAST_06_12 1795 0.72 3.08 0.28 90 RDNS_DYNAMIC 1789 0.93 3.07 0.53 91 XM_SendGrid 1788 7.40 3.06 8.21 92 TR_XM_PHPDW 1786 0.85 3.06 0.44 93 TR_XM_PHPForged 1751 0.82 3.00 0.42 94 TR_XM_FormFill2 1736 0.82 2.98 0.41 95 T_TooManySym_01 1735 5.34 2.97 5.79 96 XM_H_PHPOS 1731 0.81 2.97 0.40 97 BODY_URI_ONLY 1722 0.51 2.95 0.05 98 HTML_IMAGE_RATIO_06 1634 4.12 2.80 4.37 99 URI_HEX 1616 1.57 2.77 1.34 100 XMBdyGiftCard01 1578 1.44 2.70 1.20 101 TM2_M_URI_OPT_OUT 1555 3.66 2.67 3.84 102 HTML_SHORT_LINK_IMG_2 1516 0.45 2.60 0.05 103 RCVD_IN_PSBL 1497 0.53 2.57 0.14 104 RCVD_IN_MSPIKE_H4 1495 10.92 2.56 12.49 105 SpammyFromTLD_02 1469 0.57 2.52 0.21 106 HTML_IMAGE_ONLY_16 1462 0.54 2.51 0.18 107 SUBJ_ALL_CAPS 1458 1.60 2.50 1.43 108 XM_OfRef6 1430 1.20 2.45 0.96 109 T_XMHurry_00 1427 0.91 2.45 0.62 110 XMBrknScrpt_02 1371 1.09 2.35 0.86 111 XM_B_Phish66 1328 1.39 2.28 1.22 112 XMSexyCombo_01 1306 1.70 2.24 1.60 113 T_HTML_TAG_BALANCE_CENTER 1305 0.43 2.24 0.09 114 SCRIPT_GIBBERISH 1286 0.35 2.20 0.00 115 XM_UB60 1286 0.45 2.20 0.12 116 DKIM_ADSP_CUSTOM_MED 1272 1.31 2.18 1.15 117 MIME_QP_LONG_LINE 1270 4.39 2.18 4.81 118 RCVD_IN_MSPIKE_H3 1226 9.57 2.10 10.97 119 BAYES_40 1225 4.02 2.10 4.38 120 TR_Mismatch_TLD_01 1218 0.51 2.09 0.22 121 TR_XM_RelayPhish 1201 0.45 2.06 0.15 122 XM_B_Unsub2 1173 1.60 2.01 1.52 123 NML_ADSP_CUSTOM_MED 1171 1.03 2.01 0.85 124 XMStockSpam_06 1109 1.73 1.90 1.70 125 XMHTML_After_End 1092 1.03 1.87 0.87 126 TM2_M_VERY_LONG_WORD 1048 1.61 1.80 1.58 127 URI_TRY_3LD 982 1.88 1.68 1.92 128 FORGED_GMAIL_RCVD 980 0.74 1.68 0.56 129 HK_RANDOM_REPLYTO 961 0.43 1.65 0.21 130 THIS_AD 958 0.60 1.64 0.40 131 T_XMDrugObfuBody_14 953 1.46 1.63 1.43 132 BAYES_20 950 3.09 1.63 3.37 133 XM_JunkDunk 945 0.26 1.62 0.00 134 RCVD_IN_MSPIKE_L5 942 0.30 1.61 0.05 135 XM_UB80 917 0.28 1.57 0.04 136 URIBL_BLACK 915 0.27 1.57 0.03 137 XM_H_PHPMailer 889 0.67 1.52 0.51 138 ALL_TRUSTED 888 11.22 1.52 13.03 139 XMSlimDrugH 850 0.47 1.46 0.29 140 DATE_IN_PAST_12_24 838 0.31 1.44 0.10 141 DIET_1 837 0.72 1.43 0.59 142 XMDiploma_00 835 1.33 1.43 1.31 143 NO_FM_NAME_IP_HOSTN 828 0.23 1.42 0.00 144 SUBJECT_NEEDS_ENCODING 819 0.23 1.40 0.01 145 SUBJ_ILLEGAL_CHARS 815 0.23 1.40 0.01 146 XM_XX_Yahoo 806 0.33 1.38 0.13 147 MIME_HTML_ONLY_MULTI 800 3.35 1.37 3.72 148 MPART_ALT_DIFF_COUNT 788 0.55 1.35 0.40 149 T_XMDrugObfuBody_00 783 1.30 1.34 1.30 150 XM_H_PHPOS_M 760 0.38 1.30 0.20 151 XM_DK_Undo_01 744 1.41 1.28 1.44 152 XMSubMetaSSx_00 736 0.55 1.26 0.41 153 MISSING_HEADERS 731 0.46 1.25 0.31 154 HELO_NO_DOMAIN 718 0.72 1.23 0.63 155 HELO_NODOT 718 0.72 1.23 0.63 156 RCVD_IN_RP_SAFE 711 9.69 1.22 11.28 157 RELAYCOUNTRY_IN 708 0.27 1.21 0.10 158 T_FILL_THIS_FORM_SHORT 703 1.21 1.21 1.21 159 BAYES_00 701 13.69 1.20 16.03 160 XM_BadFromFormat 670 0.30 1.15 0.14 161 RCVD_IN_RP_CERTIFIED 669 9.01 1.15 10.48 162 XM_HighProb1 667 0.19 1.14 0.01 163 TR_MetaPhish_Combo_01 664 0.87 1.14 0.82 164 REPLYTO_WITHOUT_TO_CC 658 0.27 1.13 0.11 165 TR_XM_COVIDMETA1 658 0.43 1.13 0.30 166 XMReplyNow 656 0.26 1.12 0.09 167 BASE64_LENGTH_79_INF 644 0.46 1.10 0.34 168 XMSubNoVowel 639 1.05 1.10 1.04 169 TR_Symld_Words 630 1.38 1.08 1.44 170 RELAYCOUNTRY_AT 624 0.40 1.07 0.27 171 RELAYCOUNTRY_GB 617 0.85 1.06 0.81 172 TM2_M_A_HREF_HREF 615 0.43 1.05 0.31 173 SUBJ_DOLLARS 615 0.69 1.05 0.62 174 TR_Sbj_FN_Bdy 605 0.33 1.04 0.20 175 MAILING_LIST_MULTI 599 1.83 1.03 1.98 176 INVESTMENT_ADVICE 597 0.24 1.02 0.09 177 RELAYCOUNTRY_CN 596 0.24 1.02 0.09 178 RCVD_IN_MSPIKE_L4 581 0.19 1.00 0.04 179 BAYES_05 578 2.21 0.99 2.44 180 FROM_MISSP_REPLYTO 569 0.16 0.98 0.00 181 RELAYCOUNTRY_DE 556 0.39 0.95 0.28 182 RELAYCOUNTRY_NL 541 0.29 0.93 0.17 183 TR_XM_DK_SendGrid 540 4.13 0.93 4.73 184 TR_Mismatch_TLD_02 532 0.29 0.91 0.18 185 XMSexyCombo_04 532 0.90 0.91 0.90 186 XM_ProductURIs 532 0.96 0.91 0.97 187 XMWghtMeta_00 524 0.16 0.90 0.02 188 XM_OfRef7 523 0.20 0.90 0.07 189 XM_UB95 522 0.15 0.89 0.01 190 XMPhish08 515 0.61 0.88 0.56 191 T_MONEY_PERCENT 499 0.50 0.86 0.43 192 TR_LOTS_OF_MONEY2 499 0.50 0.86 0.43 193 HTML_FONT_SIZE_HUGE 497 0.24 0.85 0.12 194 TR_XM_COVIDMETA3 492 0.16 0.84 0.03 195 XMGenDplmaNmb 488 0.83 0.84 0.83 196 XM_RXBody 486 0.67 0.83 0.64 197 XMSubEmpty 444 0.28 0.76 0.20 198 TR_XM_DK_Bayes 441 9.68 0.76 11.35 199 DEAR_FRIEND 435 0.18 0.75 0.07 200 XMSubMetaI_00 427 0.95 0.73 1.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 307936 98.79 98.35 98.87 2 HTML_MESSAGE 272678 88.47 93.34 87.55 3 RELAYCOUNTRY_US 256885 80.70 71.21 82.48 4 DKIM_SIGNED 249233 80.03 80.04 80.02 5 XM_DK_Pass 246401 78.96 78.16 79.12 6 DKIM_VALID 233196 73.39 65.45 74.88 7 XM_B_Unicode 230850 74.02 73.47 74.12 8 DKIM_VALID_AU 187380 57.99 46.36 60.16 9 XMListUnsubscribeExists 181585 60.38 71.46 58.30 10 BAYES_50 157127 47.70 33.02 50.45 11 XM_B_Unicode3 139267 43.32 35.86 44.72 12 HTML_FONT_LOW_CONTRAST 101785 31.09 22.60 32.68 13 LOC_TINY_FONT_1 95943 30.70 30.13 30.81 14 DKIM_VALID_EF 86255 28.45 32.47 27.70 15 RCVD_IN_MSPIKE_WL 75877 21.26 4.70 24.36 16 MIME_HTML_ONLY 74322 26.93 43.28 23.86 17 FVGT_m_MULTI_ODD 72441 23.41 24.22 23.26 18 RCVD_IN_MSPIKE_H2 65633 21.36 22.88 21.07 19 T_TM2_M_HEADER_IN_MSG 65373 20.83 19.95 20.99 20 XMSubLong 64789 21.23 23.49 20.80 21 T_KAM_HTML_FONT_INVALID 57452 19.59 25.68 18.45 22 BAYES_00 49922 13.69 1.20 16.03 23 XM_Body_Dirty_Words 45840 14.89 15.78 14.72 24 XM_Multi_Part_URI 45160 14.73 15.93 14.50 25 XM_DK_Undo_02 43525 21.34 60.67 13.98 26 ALL_TRUSTED 40587 11.22 1.52 13.03 27 RCVD_IN_MSPIKE_H4 38896 10.92 2.56 12.49 28 TR_XM_DK_Bayes 35348 9.68 0.76 11.35 29 RCVD_IN_RP_SAFE 35133 9.69 1.22 11.28 30 RCVD_IN_MSPIKE_H3 34160 9.57 2.10 10.97 31 XM_B_Unsub 33550 10.53 9.26 10.77 32 TR_XM_DK_Bayes1 33036 9.02 0.53 10.61 33 RCVD_IN_RP_CERTIFIED 32649 9.01 1.15 10.48 34 XM_DKIMWhitelistDomains 31975 8.65 0.01 10.27 35 XM_Evil_Numbers_Gen 31604 9.63 6.89 10.15 36 TR_XM_DK_Bayes2 30851 8.41 0.40 9.91 37 LOTS_OF_MONEY 29486 10.45 15.70 9.47 38 BAYES_99 28974 14.88 44.66 9.30 39 UNPARSEABLE_RELAY 28256 8.30 4.20 9.07 40 HTML_IMAGE_RATIO_02 28013 9.63 13.03 8.99 41 LotsOfNums_01 27873 8.63 6.90 8.95 42 XM_SendGrid 25582 7.40 3.06 8.21 43 BAYES_999 23004 12.12 37.37 7.39 44 XM_B_Phish_Phrases 22977 7.75 9.73 7.38 45 HTML_IMAGE_RATIO_04 22902 6.96 4.84 7.35 46 TooManyTo_001 22343 6.82 4.91 7.17 47 BOTNET_IPINHOSTNAME 21658 8.56 17.12 6.95 48 BAYES_60 20880 6.62 6.15 6.70 49 XM_H_Long_From01 18725 5.87 5.13 6.01 50 MPART_ALT_DIFF 18241 5.68 4.73 5.86 51 T_TooManySym_01 18029 5.34 2.97 5.79 52 RELAYCOUNTRY_META 16978 9.28 29.73 5.45 53 XMSexyCombo_05 16251 6.25 11.77 5.22 54 DKIM_INVALID 16037 6.64 14.59 5.15 55 XMSubMetaSx_00 15556 5.76 9.83 4.99 56 MIME_QP_LONG_LINE 14979 4.39 2.18 4.81 57 TR_XM_DK_SendGrid 14741 4.13 0.93 4.73 58 XMStrtUSub 14645 4.58 3.92 4.70 59 IN_ZIMBRA_NJ_WHITELIST 14135 3.83 0.03 4.54 60 BAYES_80 14028 4.85 6.67 4.50 61 BAYES_40 13652 4.02 2.10 4.38 62 HTML_IMAGE_RATIO_06 13608 4.12 2.80 4.37 63 XM_UncommonTLD01 13264 7.42 24.29 4.26 64 TM2_M_URI_OPT_OUT 11962 3.66 2.67 3.84 65 RCVD_IN_IADB_LISTED 11891 3.33 0.71 3.82 66 FROM_EXCESS_BASE64 11706 3.78 3.90 3.76 67 MIME_HTML_ONLY_MULTI 11585 3.35 1.37 3.72 68 ANY_BOUNCE_MESSAGE 10996 3.02 0.32 3.53 69 BOUNCE_MESSAGE 10994 3.02 0.31 3.53 70 BOTNET 10994 7.57 29.15 3.53 71 XMNumbers 10780 3.83 5.82 3.46 72 BAYES_20 10486 3.09 1.63 3.37 73 RCVD_IN_IADB_SPF 10381 2.90 0.62 3.33 74 T_REMOTE_IMAGE 10107 3.39 4.15 3.25 75 T_TooManySym_02 10084 2.84 0.71 3.24 76 NO_DNS_FOR_FROM 9483 4.34 11.27 3.04 77 RCVD_IN_IADB_SENDERID 9324 2.61 0.58 2.99 78 RCVD_IN_IADB_DK 9083 2.55 0.58 2.92 79 XM_H_Trusted_IP 9058 2.45 0.00 2.91 80 TVD_RCVD_IP 8950 2.45 0.21 2.87 81 BAYES_95 8772 2.94 3.57 2.82 82 TR_XM_PhishingBody 8593 3.01 4.38 2.76 83 MIME_HTML_MOSTLY 8550 3.05 4.68 2.75 84 HTML_IMAGE_RATIO_08 8391 2.77 3.15 2.69 85 XM_CamelCaseFrm001 8361 4.03 11.20 2.68 86 HELO_MISC_IP 8162 2.24 0.19 2.62 87 CK_HELO_DYNAMIC_SPLIT_IP 8155 2.22 0.12 2.62 88 INVALID_MSGID 7687 2.10 0.15 2.47 89 BAYES_05 7603 2.21 0.99 2.44 90 XM_B_SpammyTLD 7322 2.61 3.99 2.35 91 RCVD_IN_IADB_VOUCHED 7178 1.99 0.29 2.30 92 TO_MALFORMED 6840 1.87 0.13 2.20 93 UNTRUSTED_Relay 6582 4.63 18.05 2.11 94 RELAYCOUNTRY_CA 6356 3.65 12.25 2.04 95 MAILING_LIST_MULTI 6168 1.83 1.03 1.98 96 URI_TRY_3LD 5973 1.88 1.68 1.92 97 XM_PDF 5867 1.64 0.37 1.88 98 T_XMDrugObfuBody_08 5711 2.33 4.97 1.83 99 HTML_MIME_NO_HTML_TAG 5349 1.95 3.18 1.72 100 XMStockSpam_06 5301 1.73 1.90 1.70 101 HTML_FONT_FACE_BAD 5179 1.49 0.57 1.66 102 IN_HORDE_ADDRESS_BOOK 5110 1.39 0.04 1.64 103 XMSexyCombo_01 4988 1.70 2.24 1.60 104 TM2_M_VERY_LONG_WORD 4917 1.61 1.80 1.58 105 XM_B_Unsub2 4744 1.60 2.01 1.52 106 RCVD_IN_BL_SPAMCOP_NET 4729 2.16 5.59 1.52 107 TooManyTo_002 4511 1.31 0.57 1.45 108 TR_Symld_Words 4478 1.38 1.08 1.44 109 XM_DK_Undo_01 4472 1.41 1.28 1.44 110 RCVD_IN_IADB_OPTIN 4464 1.25 0.29 1.43 111 T_XMDrugObfuBody_14 4447 1.46 1.63 1.43 112 SUBJ_ALL_CAPS 4445 1.60 2.50 1.43 113 XM_B_COVIDMETA 4404 2.02 5.28 1.41 114 USER_IN_DEF_DKIM_WL 4375 1.18 0.00 1.40 115 URI_HEX 4175 1.57 2.77 1.34 116 XM_UB50 4173 2.33 7.61 1.34 117 XMDiploma_00 4065 1.33 1.43 1.31 118 T_XMDrugObfuBody_00 4035 1.30 1.34 1.30 119 XM_GoogleGroups 3975 1.15 0.45 1.28 120 XM_B_Phish66 3802 1.39 2.28 1.22 121 T_FILL_THIS_FORM_SHORT 3769 1.21 1.21 1.21 122 XMBdyGiftCard01 3735 1.44 2.70 1.20 123 XM_SPF_SoftFail 3695 1.77 4.88 1.19 124 DKIM_ADSP_CUSTOM_MED 3587 1.31 2.18 1.15 125 KHOP_HELO_FCRDNS 3509 1.67 4.58 1.13 126 XMGappySubj_01 3468 0.95 0.07 1.11 127 XM_H_Long_From02 3451 1.01 0.47 1.11 128 TooManyTo_003 3347 0.97 0.42 1.07 129 XMSubNoVowel 3236 1.05 1.10 1.04 130 XMSubMetaI_00 3099 0.95 0.73 1.00 131 XM_ProductURIs 3022 0.96 0.91 0.97 132 XM_OfRef6 2993 1.20 2.45 0.96 133 XMSubMetaSxObfu_03 2896 0.89 0.65 0.93 134 XMBody_17 2869 1.88 7.00 0.92 135 PDS_OTHER_BAD_TLD 2830 1.46 4.40 0.91 136 RCVD_IN_MSPIKE_H5 2821 0.77 0.04 0.91 137 XMSexyCombo_04 2794 0.90 0.91 0.90 138 XM_B_REG_HTML 2779 0.79 0.27 0.89 139 TooManyTo_004 2711 0.79 0.37 0.87 140 XMHTML_After_End 2708 1.03 1.87 0.87 141 XMBrknScrpt_02 2677 1.09 2.35 0.86 142 NML_ADSP_CUSTOM_MED 2632 1.03 2.01 0.85 143 XMGenDplmaNmb 2594 0.83 0.84 0.83 144 TR_LOTS_OF_MONEY3 2573 1.57 5.53 0.83 145 TR_MetaPhish_Combo_01 2545 0.87 1.14 0.82 146 T_TooManySym_03 2532 0.73 0.26 0.81 147 RELAYCOUNTRY_GB 2520 0.85 1.06 0.81 148 TooManyTo_005 2408 0.70 0.31 0.77 149 XMSubMetaSxObfu_02 2370 0.73 0.59 0.76 150 XMSubMetaSx_01 2280 0.68 0.37 0.73 151 XMHTMLBadTable_001 2269 0.65 0.23 0.73 152 TR_XM_COVIDMETA4 2191 1.39 5.07 0.70 153 SpammyFromTLD_01 2185 1.25 4.18 0.70 154 RCVD_IN_MSPIKE_BL 2109 2.22 10.45 0.68 155 XMSexyCombo_02 2067 0.60 0.23 0.66 156 TR_MSPIKEBAYES00 2030 0.55 0.00 0.65 157 HTML_TAG_BALANCE_BODY 2011 0.65 0.67 0.65 158 XM_RXBody 1979 0.67 0.83 0.64 159 XMBody_95 1950 0.54 0.08 0.63 160 HELO_NODOT 1948 0.72 1.23 0.63 161 HELO_NO_DOMAIN 1947 0.72 1.23 0.63 162 SUBJ_DOLLARS 1932 0.69 1.05 0.62 163 T_XMHurry_00 1929 0.91 2.45 0.62 164 XMPhish30 1871 0.61 0.63 0.60 165 DIET_1 1822 0.72 1.43 0.59 166 XMBSHREFv2 1819 0.52 0.21 0.58 167 HTML_IMAGE_ONLY_20 1800 0.58 0.57 0.58 168 RCVD_IN_MSPIKE_L3 1789 1.68 7.57 0.57 169 USER_IN_WHITELIST 1784 0.48 0.00 0.57 170 XMPhish08 1752 0.61 0.88 0.56 171 XMBody_78 1748 0.56 0.53 0.56 172 FORGED_GMAIL_RCVD 1742 0.74 1.68 0.56 173 XM_DIRTYINTL 1691 1.11 4.11 0.54 174 RDNS_DYNAMIC 1658 0.93 3.07 0.53 175 XMLngstWrd_00 1655 0.51 0.39 0.53 176 XM_H_PHPMailer 1581 0.67 1.52 0.51 177 HTTPS_HTTP_MISMATCH 1549 0.51 0.58 0.50 178 URI_NOVOWEL 1464 0.50 0.66 0.47 179 XM_B_COPY_HTML 1422 0.46 0.46 0.46 180 XMLngstWrd_01 1415 0.44 0.33 0.45 181 TR_XM_PHPDW 1370 0.85 3.06 0.44 182 XMCapTrack 1362 0.41 0.28 0.44 183 T_Symld_Words_02 1361 0.48 0.71 0.44 184 TR_LOTS_OF_MONEY2 1349 0.50 0.86 0.43 185 T_MONEY_PERCENT 1349 0.50 0.86 0.43 186 TR_XM_SB_Phish 1348 0.41 0.28 0.43 187 PLING_QUERY 1333 0.46 0.64 0.43 188 FILL_THIS_FORM 1310 0.43 0.48 0.42 189 XMSubPhish11 1297 0.38 0.18 0.42 190 TR_XM_PHPForged 1294 0.82 3.00 0.42 191 XMSubMetaSSx_00 1289 0.55 1.26 0.41 192 TR_XM_FormFill2 1279 0.82 2.98 0.41 193 XMNoVowels 1278 0.39 0.30 0.41 194 XM_ShortIntro_01 1261 0.40 0.39 0.40 195 XM_H_PHPOS 1258 0.81 2.97 0.40 196 THIS_AD 1249 0.60 1.64 0.40 197 MPART_ALT_DIFF_COUNT 1245 0.55 1.35 0.40 198 HTML_TEXT_INVISIBLE_STYLE 1226 0.36 0.17 0.39 199 XM_Ancestry_Forge 1211 0.34 0.11 0.39 200 XMPhish14 1150 0.41 0.64 0.37 ----------------------------------------------------------------------