Email: 644292 Autolearn: 0 AvgScore: 0.30 AvgScanTime: 2.63 sec Spam: 106077 Autolearn: 0 AvgScore: 12.41 AvgScanTime: 3.84 sec Ham: 538215 Autolearn: 0 AvgScore: -2.09 AvgScanTime: 2.39 sec Time Spent Running SA: 470.82 hours Time Spent Processing Spam: 113.03 hours Time Spent Processing Ham: 357.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 102746 97.85 96.86 98.05 2 HTML_MESSAGE 92006 88.72 86.74 89.11 3 DKIM_SIGNED 76879 76.13 72.47 76.85 4 XM_B_Unicode 74576 70.08 70.30 70.04 5 XM_DK_Pass 73717 74.62 69.49 75.63 6 RELAYCOUNTRY_US 66527 79.94 62.72 83.34 7 XMListUnsubscribeExists 66316 53.13 62.52 51.28 8 DKIM_VALID 61885 68.50 58.34 70.50 9 XM_DK_Undo_02 52589 17.30 49.58 10.94 10 DKIM_VALID_AU 46071 51.24 43.43 52.78 11 MIME_HTML_ONLY 43224 24.01 40.75 20.71 12 BAYES_99 42162 12.50 39.75 7.13 13 DKIM_VALID_EF 35391 28.93 33.36 28.05 14 BAYES_999 34566 10.10 32.59 5.67 15 BAYES_50 34164 49.32 32.21 52.70 16 RELAYCOUNTRY_META 31379 9.63 29.58 5.70 17 XM_B_Unicode3 31337 38.01 29.54 39.68 18 LOC_TINY_FONT_1 29142 24.59 27.47 24.03 19 BOTNET 28441 6.96 26.81 3.05 20 XM_UncommonTLD01 26223 6.96 24.72 3.46 21 HTML_FONT_LOW_CONTRAST 25017 27.00 23.58 27.68 22 T_KAM_HTML_FONT_INVALID 24633 19.40 23.22 18.65 23 UNTRUSTED_Relay 24621 5.48 23.21 1.98 24 XMSubLong 23973 21.52 22.60 21.30 25 RCVD_IN_MSPIKE_H2 23542 23.03 22.19 23.20 26 LOTS_OF_MONEY 20744 10.38 19.56 8.57 27 T_TM2_M_HEADER_IN_MSG 20738 28.12 19.55 29.81 28 FVGT_m_MULTI_ODD 20471 21.83 19.30 22.33 29 XM_Body_Dirty_Words 15386 13.56 14.50 13.37 30 DKIM_INVALID 14994 7.63 14.14 6.35 31 BOTNET_IPINHOSTNAME 14402 6.19 13.58 4.73 32 XM_Multi_Part_URI 13161 12.06 12.41 12.00 33 RCVD_IN_MSPIKE_BL 13028 2.60 12.28 0.70 34 BAYES_60 12383 7.09 11.67 6.19 35 XM_CamelCaseFrm001 12340 4.17 11.63 2.69 36 XM_SPF_SoftFail 12276 3.49 11.57 1.90 37 HTML_IMAGE_RATIO_02 12229 8.42 11.53 7.81 38 XM_B_Unsub 11318 11.32 10.67 11.44 39 NO_DNS_FOR_FROM 11026 4.61 10.39 3.47 40 URIBL_SBL_A 10609 1.92 10.00 0.33 41 XM_B_Phish_Phrases 10339 7.90 9.75 7.53 42 TR_XM_MaxBayes 10336 1.74 9.74 0.17 43 XMSexyCombo_05 10192 4.99 9.61 4.09 44 RCVD_IN_BL_SPAMCOP_NET 9182 2.38 8.66 1.14 45 XM_Evil_Numbers_Gen 8970 8.67 8.46 8.71 46 ALL_TRUSTED 8575 12.05 8.08 12.84 47 XM_UB99 8490 1.32 8.00 0.01 48 DKIM_ADSP_CUSTOM_MED 8269 2.33 7.80 1.25 49 NML_ADSP_CUSTOM_MED 8056 2.05 7.59 0.96 50 FORGED_GMAIL_RCVD 7998 1.69 7.54 0.53 51 XM_Lotto 7968 1.29 7.51 0.07 52 RCVD_IN_MSPIKE_L3 7686 1.53 7.25 0.40 53 XM_ShortIntro_01 7518 1.63 7.09 0.56 54 RCVD_IN_RP_RNBL 7457 1.25 7.03 0.11 55 XM_UB50 7152 2.00 6.74 1.06 56 XMSubject_48 7141 1.13 6.73 0.03 57 HK_LOTTO 7107 1.12 6.70 0.02 58 BAYES_80 7100 4.48 6.69 4.05 59 LotsOfNums_01 7089 8.06 6.68 8.34 60 XMBody_17 6983 2.04 6.58 1.14 61 RELAYCOUNTRY_CA 6777 2.25 6.39 1.43 62 XM_B_COVIDMETA 6775 2.75 6.39 2.03 63 BOTNET_NORDNS 6774 1.07 6.39 0.02 64 TR_XM_PhishingBody 6704 3.78 6.32 3.28 65 XM_UB999 6674 1.04 6.29 0.01 66 XMNumbers 6661 3.87 6.28 3.39 67 RELAYCOUNTRY_FR 6524 1.28 6.15 0.32 68 XMSubMetaSx_00 6445 3.67 6.08 3.19 69 RCVD_IN_MSPIKE_WL 6127 18.71 5.78 21.26 70 TR_XM_COVIDMETA4 6071 1.87 5.72 1.11 71 XM_B_SpammyTLD 5893 2.63 5.56 2.05 72 T_REMOTE_IMAGE 5561 4.04 5.24 3.80 73 XM_H_Long_From01 5490 5.58 5.18 5.66 74 T_XMDrugObfuBody_08 5436 2.26 5.12 1.70 75 XMHTML_After_End 5329 1.64 5.02 0.97 76 SpammyFromTLD_02 5322 1.06 5.02 0.27 77 TooManyTo_001 5303 7.87 5.00 8.43 78 SpammyFromTLD_01 5292 1.60 4.99 0.93 79 XM_OfRef6 5113 1.64 4.82 1.01 80 MPART_ALT_DIFF 5074 4.90 4.78 4.92 81 RELAYCOUNTRY_DE 5074 1.11 4.78 0.38 82 TR_XM_MaxSPIKE 4979 0.79 4.69 0.02 83 XM_URI_RBL 4481 0.86 4.22 0.20 84 XM_B_Phish66 4429 2.35 4.18 1.99 85 FROM_SUSPICIOUS_NTLD 4405 0.75 4.15 0.08 86 TR_XM_INV_DKIM 4387 0.83 4.14 0.17 87 UNPARSEABLE_RELAY 4335 6.55 4.09 7.04 88 FROM_SUSPICIOUS_NTLD_FP 4278 0.73 4.03 0.08 89 BODY_URI_ONLY 4159 0.70 3.92 0.06 90 BAYES_95 4001 2.67 3.77 2.46 91 HTML_IMAGE_RATIO_04 3954 5.14 3.73 5.42 92 RCVD_IN_MSPIKE_H3 3894 11.38 3.67 12.90 93 PDS_OTHER_BAD_TLD 3869 1.00 3.65 0.48 94 LongTLD 3782 0.75 3.57 0.20 95 XM_DIRTYINTL 3742 1.05 3.53 0.56 96 XM_SendGrid 3630 6.04 3.42 6.56 97 MIME_HTML_MOSTLY 3584 2.76 3.38 2.64 98 FROM_EXCESS_BASE64 3514 2.92 3.31 2.84 99 RCVD_IN_PSBL 3272 0.58 3.08 0.09 100 TR_XM_COVIDMETA1 3226 0.90 3.04 0.48 101 XMStrtUSub 3201 4.39 3.02 4.67 102 T_TooManySym_01 3199 4.23 3.02 4.47 103 MIME_QP_LONG_LINE 3170 5.16 2.99 5.59 104 TM2_M_URI_OPT_OUT 3151 3.54 2.97 3.66 105 XM_JunkDunk 3104 0.48 2.93 0.00 106 RCVD_IN_MSPIKE_L5 3030 0.56 2.86 0.11 107 DATE_IN_PAST_03_06 2982 0.55 2.81 0.11 108 SUBJ_ALL_CAPS 2928 1.78 2.76 1.59 109 XM_UB60 2798 0.53 2.64 0.11 110 XM_UB80 2623 0.45 2.47 0.06 111 HTML_IMAGE_RATIO_06 2604 3.54 2.45 3.76 112 TR_XM_PHPDW 2496 0.83 2.35 0.53 113 KHOP_HELO_FCRDNS 2460 2.03 2.32 1.98 114 TR_XM_PHPForged 2439 0.80 2.30 0.50 115 TR_XM_FormFill2 2427 0.80 2.29 0.50 116 XM_H_PHPOS 2418 0.79 2.28 0.50 117 MISSING_HEADERS 2280 0.93 2.15 0.69 118 RCVD_IN_MSPIKE_H4 2193 6.90 2.07 7.85 119 DATE_IN_PAST_06_12 2185 0.41 2.06 0.08 120 HTML_MIME_NO_HTML_TAG 2170 2.18 2.05 2.21 121 TR_LOTS_OF_MONEY3 2158 0.73 2.03 0.48 122 XM_OfRef7 2133 0.46 2.01 0.15 123 BAYES_40 2111 4.49 1.99 4.98 124 XM_B_Unsub2 1878 3.06 1.77 3.31 125 HELO_NODOT 1837 1.78 1.73 1.79 126 HELO_NO_DOMAIN 1837 1.78 1.73 1.79 127 XMSubNoVowel 1823 1.18 1.72 1.08 128 XMDiploma_00 1810 1.71 1.71 1.71 129 URI_HEX 1792 1.37 1.69 1.30 130 TR_XM_RelayPhish 1792 0.43 1.69 0.18 131 T_XMDrugObfuBody_14 1776 1.53 1.67 1.50 132 XMStockSpam_06 1773 1.26 1.67 1.18 133 HTML_IMAGE_RATIO_08 1750 2.39 1.65 2.54 134 BAYES_20 1705 3.45 1.61 3.81 135 XM_PDF 1696 3.96 1.60 4.42 136 TR_Symld_Words 1682 1.53 1.59 1.52 137 TM2_M_VERY_LONG_WORD 1680 1.40 1.58 1.37 138 XM_UB95 1659 0.28 1.56 0.03 139 MIME_HTML_ONLY_MULTI 1658 2.72 1.56 2.95 140 HTML_IMAGE_ONLY_16 1626 0.51 1.53 0.31 141 T_XMHurry_00 1573 0.76 1.48 0.62 142 TR_XM_DK_SendGrid 1558 3.15 1.47 3.48 143 URI_NO_WWW_INFO_CGI 1554 0.27 1.46 0.03 144 XMSexyCombo_01 1552 0.66 1.46 0.50 145 MAILING_LIST_MULTI 1551 2.44 1.46 2.63 146 T_XMDrugObfuBody_00 1525 0.86 1.44 0.75 147 URI_TRY_3LD 1490 1.42 1.40 1.42 148 BAYES_00 1459 13.73 1.38 16.16 149 XMBrknScrpt_02 1458 0.98 1.37 0.91 150 XMSubEmpty 1383 0.45 1.30 0.28 151 TR_Mismatch_TLD_02 1381 0.29 1.30 0.09 152 TR_Mismatch_TLD_01 1367 0.40 1.29 0.22 153 TM2_M_A_HREF_HREF 1354 0.57 1.28 0.43 154 RELAYCOUNTRY_IN 1340 0.30 1.26 0.12 155 RELAYCOUNTRY_GB 1313 1.16 1.24 1.15 156 DKIM_ADSP_NXDOMAIN 1294 0.48 1.22 0.34 157 REPLYTO_WITHOUT_TO_CC 1283 0.31 1.21 0.13 158 XMGenDplmaNmb 1278 1.04 1.20 1.00 159 XM_XX_Yahoo 1236 0.22 1.17 0.04 160 URG_BIZ 1234 0.33 1.16 0.17 161 HTML_SHORT_LINK_IMG_2 1212 0.25 1.14 0.08 162 XM_HighProb1 1206 0.20 1.14 0.01 163 HK_RANDOM_REPLYTO 1165 0.36 1.10 0.21 164 RCVD_IN_MSPIKE_L4 1157 0.24 1.09 0.08 165 RCVD_IN_MSPIKE_ZBI 1155 0.28 1.09 0.11 166 XM_H_PHPMailer 1153 0.66 1.09 0.58 167 TR_LOTS_OF_MONEY1 1121 0.25 1.06 0.09 168 SCRIPT_GIBBERISH 1092 0.17 1.03 0.00 169 URI_PHP_REDIR 1083 0.21 1.02 0.04 170 XM_DK_Undo_01 1059 1.67 1.00 1.80 171 XM_SPF_Unknown 1053 0.73 0.99 0.68 172 T_FILL_THIS_FORM_SHORT 1044 0.97 0.98 0.96 173 RDNS_DYNAMIC 1034 0.44 0.97 0.33 174 XM_RXBody 1016 0.98 0.96 0.99 175 XMMoneyMeta_00 1014 0.83 0.96 0.80 176 FILL_THIS_FORM 1014 0.40 0.96 0.29 177 RELAYCOUNTRY_CN 999 0.22 0.94 0.07 178 TR_XM_COVIDMETA3 990 0.19 0.93 0.04 179 DIET_1 986 0.49 0.93 0.41 180 URIBL_BLACK 970 0.18 0.91 0.03 181 URIBL_DBL_SPAM 968 0.16 0.91 0.01 182 TR_LOTS_OF_MONEY2 966 0.42 0.91 0.32 183 T_MONEY_PERCENT 966 0.42 0.91 0.32 184 T_Symld_Words_02 965 0.62 0.91 0.56 185 BAYES_05 956 2.25 0.90 2.51 186 XMPhish08 952 0.51 0.90 0.43 187 RCVD_IN_IADB_LISTED 952 4.13 0.90 4.76 188 XMSubMetaSSxObfu_00 942 0.18 0.89 0.04 189 XMBdyGiftCard01 928 0.97 0.87 0.99 190 HK_SCAM 924 0.20 0.87 0.07 191 RCVD_IN_RP_SAFE 912 6.44 0.86 7.54 192 ACT_NOW_CAPS 907 0.21 0.86 0.09 193 XMBody_78 891 0.48 0.84 0.41 194 RCVD_IN_IADB_SPF 885 3.56 0.83 4.10 195 XM_H_PHPOS_M 882 0.31 0.83 0.21 196 MONEY_FRAUD_8 876 0.14 0.83 0.01 197 DATE_IN_PAST_12_24 870 0.17 0.82 0.04 198 RELAYCOUNTRY_AT 864 0.30 0.81 0.19 199 RCVD_IN_IADB_DK 863 3.09 0.81 3.54 200 RCVD_IN_IADB_SENDERID 859 3.13 0.81 3.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 527713 97.85 96.86 98.05 2 HTML_MESSAGE 479619 88.72 86.74 89.11 3 RELAYCOUNTRY_US 448524 79.94 62.72 83.34 4 DKIM_SIGNED 413629 76.13 72.47 76.85 5 XM_DK_Pass 407044 74.62 69.49 75.63 6 DKIM_VALID 379467 68.50 58.34 70.50 7 XM_B_Unicode 376972 70.08 70.30 70.04 8 DKIM_VALID_AU 284044 51.24 43.43 52.78 9 BAYES_50 283626 49.32 32.21 52.70 10 XMListUnsubscribeExists 275970 53.13 62.52 51.28 11 XM_B_Unicode3 213580 38.01 29.54 39.68 12 T_TM2_M_HEADER_IN_MSG 160430 28.12 19.55 29.81 13 DKIM_VALID_EF 150989 28.93 33.36 28.05 14 HTML_FONT_LOW_CONTRAST 148969 27.00 23.58 27.68 15 LOC_TINY_FONT_1 129318 24.59 27.47 24.03 16 RCVD_IN_MSPIKE_H2 124866 23.03 22.19 23.20 17 FVGT_m_MULTI_ODD 120210 21.83 19.30 22.33 18 XMSubLong 114649 21.52 22.60 21.30 19 RCVD_IN_MSPIKE_WL 114432 18.71 5.78 21.26 20 MIME_HTML_ONLY 111491 24.01 40.75 20.71 21 T_KAM_HTML_FONT_INVALID 100355 19.40 23.22 18.65 22 BAYES_00 86971 13.73 1.38 16.16 23 XM_Body_Dirty_Words 71957 13.56 14.50 13.37 24 RCVD_IN_MSPIKE_H3 69453 11.38 3.67 12.90 25 ALL_TRUSTED 69092 12.05 8.08 12.84 26 XM_Multi_Part_URI 64560 12.06 12.41 12.00 27 XM_B_Unsub 61593 11.32 10.67 11.44 28 XM_DK_Undo_02 58904 17.30 49.58 10.94 29 TR_XM_DK_Bayes 56526 8.86 0.50 10.50 30 TR_XM_DK_Bayes1 52082 8.13 0.31 9.68 31 XM_Evil_Numbers_Gen 46886 8.67 8.46 8.71 32 TR_XM_DK_Bayes2 46185 7.22 0.29 8.58 33 LOTS_OF_MONEY 46120 10.38 19.56 8.57 34 TooManyTo_001 45384 7.87 5.00 8.43 35 LotsOfNums_01 44872 8.06 6.68 8.34 36 RCVD_IN_MSPIKE_H4 42238 6.90 2.07 7.85 37 HTML_IMAGE_RATIO_02 42044 8.42 11.53 7.81 38 RCVD_IN_RP_SAFE 40588 6.44 0.86 7.54 39 XM_B_Phish_Phrases 40534 7.90 9.75 7.53 40 BAYES_99 38399 12.50 39.75 7.13 41 XM_DKIMWhitelistDomains 38228 5.94 0.06 7.10 42 RCVD_IN_RP_CERTIFIED 38208 6.02 0.55 7.10 43 UNPARSEABLE_RELAY 37882 6.55 4.09 7.04 44 IN_ZIMBRA_NJ_WHITELIST 35998 5.59 0.04 6.69 45 XM_SendGrid 35313 6.04 3.42 6.56 46 DKIM_INVALID 34162 7.63 14.14 6.35 47 BAYES_60 33322 7.09 11.67 6.19 48 RELAYCOUNTRY_META 30660 9.63 29.58 5.70 49 BAYES_999 30503 10.10 32.59 5.67 50 XM_H_Long_From01 30466 5.58 5.18 5.66 51 MIME_QP_LONG_LINE 30080 5.16 2.99 5.59 52 HTML_IMAGE_RATIO_04 29161 5.14 3.73 5.42 53 BAYES_40 26812 4.49 1.99 4.98 54 MPART_ALT_DIFF 26478 4.90 4.78 4.92 55 RCVD_IN_IADB_LISTED 25635 4.13 0.90 4.76 56 BOTNET_IPINHOSTNAME 25472 6.19 13.58 4.73 57 XMStrtUSub 25110 4.39 3.02 4.67 58 T_TooManySym_01 24075 4.23 3.02 4.47 59 XM_PDF 23786 3.96 1.60 4.42 60 RCVD_IN_IADB_SPF 22051 3.56 0.83 4.10 61 XMSexyCombo_05 21987 4.99 9.61 4.09 62 BAYES_80 21782 4.48 6.69 4.05 63 BAYES_20 20493 3.45 1.61 3.81 64 T_REMOTE_IMAGE 20456 4.04 5.24 3.80 65 HTML_IMAGE_RATIO_06 20223 3.54 2.45 3.76 66 TM2_M_URI_OPT_OUT 19685 3.54 2.97 3.66 67 RCVD_IN_IADB_SENDERID 19322 3.13 0.81 3.59 68 RCVD_IN_IADB_DK 19043 3.09 0.81 3.54 69 TR_XM_DK_SendGrid 18719 3.15 1.47 3.48 70 NO_DNS_FOR_FROM 18681 4.61 10.39 3.47 71 XM_UncommonTLD01 18617 6.96 24.72 3.46 72 XMNumbers 18266 3.87 6.28 3.39 73 XM_B_Unsub2 17833 3.06 1.77 3.31 74 TR_XM_PhishingBody 17627 3.78 6.32 3.28 75 XMSubMetaSx_00 17179 3.67 6.08 3.19 76 RCVD_IN_IADB_VOUCHED 16894 2.66 0.25 3.14 77 BOTNET 16427 6.96 26.81 3.05 78 MIME_HTML_ONLY_MULTI 15886 2.72 1.56 2.95 79 FROM_EXCESS_BASE64 15297 2.92 3.31 2.84 80 ANY_BOUNCE_MESSAGE 14838 2.38 0.45 2.76 81 BOUNCE_MESSAGE 14830 2.38 0.45 2.76 82 XM_CamelCaseFrm001 14500 4.17 11.63 2.69 83 MIME_HTML_MOSTLY 14198 2.76 3.38 2.64 84 MAILING_LIST_MULTI 14167 2.44 1.46 2.63 85 XM_H_Trusted_IP 13956 2.17 0.00 2.59 86 HTML_IMAGE_RATIO_08 13679 2.39 1.65 2.54 87 BAYES_05 13524 2.25 0.90 2.51 88 BAYES_95 13217 2.67 3.77 2.46 89 TooManyTo_002 12256 2.02 0.70 2.28 90 T_TooManySym_02 11988 1.99 0.76 2.23 91 HTML_MIME_NO_HTML_TAG 11890 2.18 2.05 2.21 92 XM_B_SpammyTLD 11024 2.63 5.56 2.05 93 XM_B_COVIDMETA 10939 2.75 6.39 2.03 94 XM_B_Phish66 10699 2.35 4.18 1.99 95 UNTRUSTED_Relay 10659 5.48 23.21 1.98 96 KHOP_HELO_FCRDNS 10630 2.03 2.32 1.98 97 RCVD_IN_IADB_OPTIN 10572 1.68 0.21 1.96 98 XM_SPF_SoftFail 10203 3.49 11.57 1.90 99 XM_DK_Undo_01 9670 1.67 1.00 1.80 100 HELO_NODOT 9631 1.78 1.73 1.79 101 HELO_NO_DOMAIN 9629 1.78 1.73 1.79 102 XMDiploma_00 9179 1.71 1.71 1.71 103 T_XMDrugObfuBody_08 9153 2.26 5.12 1.70 104 TVD_RCVD_IP 8815 1.43 0.38 1.64 105 SUBJ_ALL_CAPS 8548 1.78 2.76 1.59 106 TooManyTo_003 8514 1.41 0.53 1.58 107 TR_Symld_Words 8199 1.53 1.59 1.52 108 T_XMDrugObfuBody_14 8077 1.53 1.67 1.50 109 IN_HORDE_ADDRESS_BOOK 7787 1.21 0.03 1.45 110 RELAYCOUNTRY_CA 7722 2.25 6.39 1.43 111 URI_TRY_3LD 7666 1.42 1.40 1.42 112 INVALID_MSGID 7637 1.22 0.20 1.42 113 TM2_M_VERY_LONG_WORD 7359 1.40 1.58 1.37 114 HELO_MISC_IP 7060 1.13 0.21 1.31 115 CK_HELO_DYNAMIC_SPLIT_IP 7040 1.13 0.22 1.31 116 URI_HEX 7005 1.37 1.69 1.30 117 TO_MALFORMED 6837 1.08 0.12 1.27 118 DKIM_ADSP_CUSTOM_MED 6714 2.33 7.80 1.25 119 XMCapTrack 6661 1.15 0.68 1.24 120 XM_GoogleGroups 6617 1.10 0.46 1.23 121 TooManyTo_004 6432 1.08 0.47 1.20 122 XMStockSpam_06 6347 1.26 1.67 1.18 123 RELAYCOUNTRY_GB 6181 1.16 1.24 1.15 124 RCVD_IN_BL_SPAMCOP_NET 6158 2.38 8.66 1.14 125 XMBody_17 6157 2.04 6.58 1.14 126 TR_XM_COVIDMETA4 5994 1.87 5.72 1.11 127 USER_IN_DEF_DKIM_WL 5921 0.92 0.00 1.10 128 XMSubNoVowel 5806 1.18 1.72 1.08 129 XM_UB50 5711 2.00 6.74 1.06 130 HTML_FONT_FACE_BAD 5660 0.93 0.32 1.05 131 TooManyTo_005 5470 0.91 0.38 1.02 132 XM_H_Long_From02 5455 0.97 0.73 1.01 133 XM_OfRef6 5434 1.64 4.82 1.01 134 XMGenDplmaNmb 5400 1.04 1.20 1.00 135 XM_RXBody 5325 0.98 0.96 0.99 136 XMBdyGiftCard01 5312 0.97 0.87 0.99 137 XMHTML_After_End 5215 1.64 5.02 0.97 138 T_FILL_THIS_FORM_SHORT 5180 0.97 0.98 0.96 139 NML_ADSP_CUSTOM_MED 5167 2.05 7.59 0.96 140 TR_MSPIKEBAYES00 5050 0.79 0.01 0.94 141 SpammyFromTLD_01 4995 1.60 4.99 0.93 142 XMGappySubj_01 4934 0.81 0.28 0.92 143 XMBrknScrpt_02 4886 0.98 1.37 0.91 144 XMMoneyMeta_00 4307 0.83 0.96 0.80 145 XMNoVowels 4201 0.72 0.41 0.78 146 T_XMDrugObfuBody_00 4015 0.86 1.44 0.75 147 HTTPS_HTTP_MISMATCH 3994 0.72 0.64 0.74 148 T_OBFU_PDF_ATTACH 3938 0.63 0.10 0.73 149 T_TooManySym_03 3831 0.65 0.36 0.71 150 XM_ProductURIs 3817 0.70 0.66 0.71 151 RCVD_IN_MSPIKE_BL 3744 2.60 12.28 0.70 152 MISSING_HEADERS 3702 0.93 2.15 0.69 153 XM_SPF_Unknown 3642 0.73 0.99 0.68 154 XMSubMetaI_00 3594 0.66 0.61 0.67 155 TR_MetaPhish_Combo_01 3490 0.64 0.60 0.65 156 XM_E_Blogspot 3389 0.54 0.09 0.63 157 T_XMHurry_00 3319 0.76 1.48 0.62 158 NUMERIC_HTTP_ADDR 3261 0.59 0.48 0.61 159 XM_H_PHPMailer 3129 0.66 1.09 0.58 160 RCVD_IN_SORBS_DUL 3052 0.50 0.17 0.57 161 THIS_AD 3046 0.57 0.59 0.57 162 XM_DIRTYINTL 3013 1.05 3.53 0.56 163 XM_ShortIntro_01 3012 1.63 7.09 0.56 164 T_Symld_Words_02 3004 0.62 0.91 0.56 165 FROM_GOV_SPOOF 2910 0.49 0.24 0.54 166 FORGED_GMAIL_RCVD 2867 1.69 7.54 0.53 167 TR_XM_PHPDW 2841 0.83 2.35 0.53 168 RCVD_IN_MSPIKE_H5 2741 0.43 0.04 0.51 169 TR_XM_FormFill2 2717 0.80 2.29 0.50 170 TR_XM_PHPForged 2716 0.80 2.30 0.50 171 XM_H_PHPOS 2685 0.79 2.28 0.50 172 XMSexyCombo_01 2682 0.66 1.46 0.50 173 RELAYCOUNTRY_NL 2681 0.50 0.53 0.50 174 TR_XM_COVIDMETA1 2591 0.90 3.04 0.48 175 TR_LOTS_OF_MONEY3 2576 0.73 2.03 0.48 176 PDS_OTHER_BAD_TLD 2568 1.00 3.65 0.48 177 HTML_TAG_BALANCE_BODY 2529 0.45 0.35 0.47 178 FROM_GOV_DKIM_AU 2511 0.40 0.07 0.47 179 TM2_M_BODY_EMPTY 2501 0.43 0.22 0.46 180 HTML_IMAGE_ONLY_20 2475 0.44 0.35 0.46 181 XMHTMLBadTable_001 2470 0.44 0.33 0.46 182 XMOemUri 2467 0.45 0.42 0.46 183 XMSubMetaSxObfu_03 2453 0.51 0.76 0.46 184 HTML_IMAGE_ONLY_32 2422 0.40 0.13 0.45 185 MPART_ALT_DIFF_COUNT 2397 0.47 0.59 0.45 186 XM_B_REG_HTML 2385 0.39 0.13 0.44 187 URI_NOVOWEL 2385 0.46 0.52 0.44 188 RELAYCOUNTRY_AU 2384 0.46 0.55 0.44 189 XMPhish30 2360 0.48 0.69 0.44 190 XMPhish08 2338 0.51 0.90 0.43 191 XM_H_Undi_Recip 2334 0.43 0.42 0.43 192 TM2_M_A_HREF_HREF 2289 0.57 1.28 0.43 193 XMPhish14 2240 0.45 0.65 0.42 194 REMOVE_BEFORE_LINK 2240 0.45 0.61 0.42 195 XMBody_78 2194 0.48 0.84 0.41 196 DIET_1 2193 0.49 0.93 0.41 197 XMBody_95 2168 0.34 0.05 0.40 198 RCVD_IN_MSPIKE_L3 2145 1.53 7.25 0.40 199 PLING_QUERY 2094 0.37 0.26 0.39 200 SHORT_HELO_AND_INLINE_IMAGE 2073 0.33 0.07 0.39 ----------------------------------------------------------------------