Email: 669536 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 2.15 sec Spam: 92161 Autolearn: 0 AvgScore: 11.98 AvgScanTime: 4.33 sec Ham: 577375 Autolearn: 0 AvgScore: -2.06 AvgScanTime: 1.80 sec Time Spent Running SA: 399.19 hours Time Spent Processing Spam: 110.84 hours Time Spent Processing Ham: 288.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 89737 98.23 97.37 98.37 2 HTML_MESSAGE 87553 90.47 95.00 89.74 3 XM_B_Unicode 70450 73.53 76.44 73.07 4 DKIM_SIGNED 70342 72.94 76.33 72.40 5 XM_DK_Pass 67979 71.54 73.76 71.18 6 RELAYCOUNTRY_US 66679 77.53 72.35 78.36 7 XMListUnsubscribeExists 60562 52.75 65.71 50.68 8 DKIM_VALID 54897 65.73 59.57 66.71 9 XM_DK_Undo_02 49192 16.73 53.38 10.88 10 MIME_HTML_ONLY 39612 24.02 42.98 21.00 11 DKIM_VALID_AU 39514 48.49 42.87 49.38 12 BAYES_99 36935 11.34 40.08 6.75 13 BAYES_50 35338 52.84 38.34 55.15 14 XM_B_Unicode3 34637 39.10 37.58 39.34 15 BAYES_999 30446 9.09 33.04 5.27 16 BOTNET 29164 7.05 31.64 3.12 17 DKIM_VALID_EF 28657 24.97 31.09 24.00 18 T_KAM_HTML_FONT_INVALID 27242 25.04 29.56 24.32 19 RCVD_IN_MSPIKE_H2 26413 24.43 28.66 23.75 20 LOC_TINY_FONT_1 23840 23.92 25.87 23.61 21 XMSubLong 23750 20.64 25.77 19.82 22 RELAYCOUNTRY_META 23494 7.90 25.49 5.09 23 HTML_FONT_LOW_CONTRAST 23329 26.08 25.31 26.20 24 FVGT_m_MULTI_ODD 23127 21.74 25.09 21.21 25 XM_UncommonTLD01 19377 5.47 21.03 2.99 26 T_TM2_M_HEADER_IN_MSG 18199 24.90 19.75 25.73 27 XM_Body_Dirty_Words 16604 13.93 18.02 13.27 28 BOTNET_IPINHOSTNAME 16565 6.62 17.97 4.81 29 UNTRUSTED_Relay 15948 3.88 17.30 1.74 30 XM_Multi_Part_URI 15770 17.51 17.11 17.58 31 DKIM_INVALID 15445 7.21 16.76 5.68 32 LOTS_OF_MONEY 13985 9.34 15.17 8.41 33 XM_B_Unsub 13912 16.03 15.10 16.18 34 XM_B_Phish_Phrases 11918 8.16 12.93 7.40 35 XM_CamelCaseFrm001 11843 3.78 12.85 2.33 36 NO_DNS_FOR_FROM 11760 4.44 12.76 3.11 37 RCVD_IN_RP_RNBL 10468 1.73 11.36 0.19 38 URIBL_SBL_A 9200 1.64 9.98 0.31 39 RCVD_IN_BL_SPAMCOP_NET 9010 2.57 9.78 1.41 40 XMSexyCombo_05 8985 4.81 9.75 4.03 41 TR_XM_MaxBayes 8750 1.36 9.49 0.06 42 XM_Evil_Numbers_Gen 8570 7.99 9.30 7.78 43 RCVD_IN_MSPIKE_BL 8462 1.72 9.18 0.53 44 XMNumbers 7725 3.88 8.38 3.16 45 XM_B_COVIDMETA 7423 2.94 8.05 2.12 46 TR_XM_COVIDMETA4 7180 1.86 7.79 0.91 47 T_XMDrugObfuBody_08 7118 2.61 7.72 1.79 48 HTML_IMAGE_RATIO_02 6944 7.50 7.53 7.49 49 LotsOfNums_01 6791 8.44 7.37 8.61 50 XMSubMetaSx_00 6578 3.78 7.14 3.24 51 XM_UB50 6441 1.85 6.99 1.03 52 RELAYCOUNTRY_CA 6333 2.31 6.87 1.58 53 TooManyTo_001 6254 11.71 6.79 12.50 54 T_REMOTE_IMAGE 5917 3.77 6.42 3.34 55 BOTNET_NORDNS 5809 0.88 6.30 0.02 56 XMBody_17 5782 1.62 6.27 0.88 57 TR_XM_PhishingBody 5633 3.84 6.11 3.48 58 RCVD_IN_MSPIKE_WL 5575 19.24 6.05 21.34 59 XM_SPF_SoftFail 5464 2.26 5.93 1.67 60 XMHTML_After_End 5402 1.46 5.86 0.76 61 BAYES_60 5364 5.80 5.82 5.79 62 BAYES_80 5331 4.09 5.78 3.82 63 XM_H_Long_From01 5088 5.70 5.52 5.73 64 UNPARSEABLE_RELAY 5061 6.81 5.49 7.02 65 XM_OfRef6 4844 1.56 5.26 0.98 66 BODY_URI_ONLY 4577 0.73 4.97 0.05 67 RCVD_IN_MSPIKE_L3 4514 0.98 4.90 0.36 68 MPART_ALT_DIFF 4426 5.70 4.80 5.84 69 XM_B_Unsub2 4411 7.72 4.79 8.19 70 FROM_EXCESS_BASE64 4362 3.32 4.73 3.10 71 XM_B_SpammyTLD 4310 2.97 4.68 2.70 72 XM_UB99 4190 0.64 4.55 0.01 73 TR_XM_INV_DKIM 4183 0.78 4.54 0.18 74 RCVD_IN_MSPIKE_H3 4161 11.83 4.51 13.00 75 XM_SendGrid 4010 6.07 4.35 6.34 76 HTML_IMAGE_RATIO_04 3980 6.00 4.32 6.27 77 SpammyFromTLD_01 3954 1.26 4.29 0.78 78 TM2_M_URI_OPT_OUT 3807 3.68 4.13 3.60 79 XM_B_Phish66 3628 2.27 3.94 2.00 80 XM_URI_RBL 3561 0.73 3.86 0.22 81 XM_DIRTYINTL 3496 1.07 3.79 0.63 82 RCVD_IN_PSBL 3460 0.57 3.75 0.06 83 XMStrtUSub 3410 4.08 3.70 4.14 84 XM_UB999 3329 0.51 3.61 0.01 85 ALL_TRUSTED 3285 16.01 3.56 18.00 86 MIME_QP_LONG_LINE 3238 5.92 3.51 6.31 87 RELAYCOUNTRY_DE 3120 0.85 3.39 0.45 88 T_TooManySym_01 3031 3.75 3.29 3.82 89 XMDiploma_00 3004 2.08 3.26 1.89 90 BAYES_95 2966 2.45 3.22 2.32 91 TR_LOTS_OF_MONEY3 2746 0.87 2.98 0.53 92 KHOP_HELO_FCRDNS 2711 1.90 2.94 1.73 93 MIME_HTML_MOSTLY 2701 2.64 2.93 2.60 94 HTML_MIME_NO_HTML_TAG 2596 2.45 2.82 2.40 95 SpammyFromTLD_02 2525 0.77 2.74 0.46 96 TR_Mismatch_TLD_01 2519 0.57 2.73 0.23 97 TooManyTo_002 2512 5.40 2.73 5.83 98 T_XMHurry_00 2506 0.91 2.72 0.62 99 HTML_IMAGE_RATIO_06 2497 3.57 2.71 3.70 100 TR_XM_MaxSPIKE 2493 0.39 2.71 0.02 101 TR_XM_PHPDW 2435 0.76 2.64 0.45 102 BAYES_40 2434 4.44 2.64 4.72 103 XMSexyCombo_01 2424 0.89 2.63 0.61 104 TR_XM_COVIDMETA1 2411 1.01 2.62 0.75 105 TR_XM_PHPForged 2408 0.74 2.61 0.44 106 TR_XM_FormFill2 2389 0.73 2.59 0.43 107 XM_H_PHPOS 2388 0.72 2.59 0.43 108 RELAYCOUNTRY_NL 2228 0.51 2.42 0.20 109 XM_OfRef7 2223 0.45 2.41 0.14 110 RCVD_IN_MSPIKE_L5 2211 0.43 2.40 0.11 111 TooManyTo_003 2207 4.15 2.39 4.43 112 MIME_HTML_ONLY_MULTI 2098 3.70 2.28 3.93 113 URI_WP_HACKED_2 2080 2.07 2.26 2.05 114 XM_JunkDunk 2036 0.30 2.21 0.00 115 T_Symld_Words_02 1980 0.80 2.15 0.59 116 HTML_IMAGE_RATIO_08 1949 2.38 2.11 2.43 117 T_XMDrugObfuBody_14 1900 1.76 2.06 1.72 118 TooManyTo_004 1893 3.14 2.05 3.32 119 URI_PHP_REDIR 1863 0.28 2.02 0.00 120 XM_UB60 1822 0.36 1.98 0.10 121 TR_XM_RelayPhish 1807 0.40 1.96 0.15 122 BAYES_20 1759 3.25 1.91 3.47 123 XM_DK_Undo_01 1759 1.83 1.91 1.81 124 RELAYCOUNTRY_FR 1743 0.45 1.89 0.22 125 TM2_M_VERY_LONG_WORD 1741 1.33 1.89 1.24 126 DKIM_ADSP_NXDOMAIN 1737 0.52 1.88 0.30 127 T_TooManySym_02 1724 1.77 1.87 1.75 128 XMStockSpam_06 1722 1.15 1.87 1.04 129 XMSlimDrugH 1698 0.50 1.84 0.29 130 URI_NO_WWW_INFO_CGI 1652 0.27 1.79 0.03 131 SCRIPT_GIBBERISH 1651 0.25 1.79 0.00 132 RCVD_IN_MSPIKE_L4 1637 0.29 1.78 0.06 133 T_PDS_OTHER_BAD_TLD 1621 0.74 1.76 0.58 134 TR_Mismatch_TLD_02 1599 0.30 1.74 0.07 135 TR_XM_DK_SendGrid 1598 3.38 1.73 3.65 136 RELAYCOUNTRY_GB 1574 1.10 1.71 1.00 137 TooManyTo_005 1572 2.22 1.71 2.30 138 XMSubEmpty 1566 0.44 1.70 0.24 139 SUBJ_ALL_CAPS 1542 1.71 1.67 1.71 140 T_TooManySym_03 1470 0.71 1.60 0.57 141 FROM_SUSPICIOUS_NTLD 1456 0.28 1.58 0.07 142 MAILING_LIST_MULTI 1381 2.09 1.50 2.18 143 XM_UB80 1374 0.23 1.49 0.03 144 RCVD_IN_MSPIKE_H4 1364 6.74 1.48 7.58 145 URI_HEX 1344 1.53 1.46 1.54 146 FROM_SUSPICIOUS_NTLD_FP 1342 0.25 1.46 0.06 147 XMSubMetaSxObfu_03 1332 0.65 1.45 0.52 148 XMGenDplmaNmb 1323 0.93 1.44 0.85 149 T_XMDrugObfuBody_00 1318 0.68 1.43 0.56 150 FILL_THIS_FORM 1308 0.46 1.42 0.31 151 DKIM_ADSP_CUSTOM_MED 1300 1.27 1.41 1.24 152 HK_RANDOM_REPLYTO 1235 0.34 1.34 0.18 153 XMSubNoVowel 1223 1.13 1.33 1.10 154 REPLYTO_WITHOUT_TO_CC 1209 0.26 1.31 0.09 155 T_FILL_THIS_FORM_SHORT 1172 0.85 1.27 0.78 156 MISSING_HEADERS 1161 0.60 1.26 0.50 157 NML_ADSP_CUSTOM_MED 1140 0.95 1.24 0.91 158 XM_H_MailChimp 1128 0.36 1.22 0.22 159 XM_H_PHPMailer 1117 0.58 1.21 0.48 160 BAYES_05 1101 2.29 1.19 2.47 161 TR_Symld_Words 1090 1.40 1.18 1.43 162 HK_SCAM 1082 0.27 1.17 0.13 163 DATE_IN_PAST_03_06 1073 0.23 1.16 0.08 164 XM_B_SEO 1055 0.35 1.14 0.23 165 FORGED_GMAIL_RCVD 1054 0.65 1.14 0.57 166 TR_Sbj_FN_Bdy 1021 0.33 1.11 0.21 167 URIBL_BLACK 1018 0.17 1.10 0.02 168 XMBrknScrpt_02 1007 0.80 1.09 0.75 169 DIET_1 1005 0.40 1.09 0.29 170 XMSexyCombo_04 972 0.32 1.05 0.20 171 URI_OPTOUT_3LD 963 0.30 1.04 0.19 172 TR_LOTS_OF_MONEY2 950 0.46 1.03 0.37 173 T_MONEY_PERCENT 950 0.46 1.03 0.37 174 XM_H_PHPOS_M 943 0.28 1.02 0.16 175 HTML_IMAGE_ONLY_16 938 0.33 1.02 0.22 176 XMBody_78 924 0.59 1.00 0.52 177 RDNS_DYNAMIC 924 0.40 1.00 0.31 178 BAYES_00 919 13.51 1.00 15.51 179 RCVD_IN_IADB_LISTED 916 4.79 0.99 5.39 180 TR_XM_COVIDMETA3 906 0.17 0.98 0.04 181 XM_HighProb1 888 0.14 0.96 0.00 182 RELAYCOUNTRY_IT 876 0.17 0.95 0.05 183 MPART_ALT_DIFF_COUNT 850 0.45 0.92 0.37 184 XMPhish30 849 0.59 0.92 0.53 185 XMReplyNow 847 0.22 0.92 0.11 186 URI_TRY_3LD 844 1.41 0.92 1.48 187 XMOemUri 838 0.47 0.91 0.40 188 RELAYCOUNTRY_AT 835 0.29 0.91 0.19 189 TR_LOTS_OF_MONEY1 834 0.20 0.90 0.08 190 XMSubMetaI_00 833 0.63 0.90 0.58 191 RCVD_IN_IADB_SPF 832 4.14 0.90 4.66 192 XMBdyGiftCard01 832 1.02 0.90 1.04 193 XM_UB95 831 0.14 0.90 0.02 194 RELAYCOUNTRY_PL 822 0.15 0.89 0.04 195 HTML_SHORT_LINK_IMG_2 822 0.17 0.89 0.05 196 MY_SERVERS_FOUND 815 0.20 0.88 0.09 197 FROM_MISSP_REPLYTO 805 0.12 0.87 0.00 198 FROM_MISSP_EH_MATCH 802 0.13 0.87 0.01 199 RCVD_IN_IADB_DK 794 3.60 0.86 4.03 200 RCVD_IN_IADB_SENDERID 788 3.64 0.86 4.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 567944 98.23 97.37 98.37 2 HTML_MESSAGE 518153 90.47 95.00 89.74 3 RELAYCOUNTRY_US 452406 77.53 72.35 78.36 4 XM_B_Unicode 421887 73.53 76.44 73.07 5 DKIM_SIGNED 418010 72.94 76.33 72.40 6 XM_DK_Pass 410979 71.54 73.76 71.18 7 DKIM_VALID 385188 65.73 59.57 66.71 8 BAYES_50 318446 52.84 38.34 55.15 9 XMListUnsubscribeExists 292603 52.75 65.71 50.68 10 DKIM_VALID_AU 285118 48.49 42.87 49.38 11 XM_B_Unicode3 227127 39.10 37.58 39.34 12 HTML_FONT_LOW_CONTRAST 151295 26.08 25.31 26.20 13 T_TM2_M_HEADER_IN_MSG 148536 24.90 19.75 25.73 14 T_KAM_HTML_FONT_INVALID 140396 25.04 29.56 24.32 15 DKIM_VALID_EF 138552 24.97 31.09 24.00 16 RCVD_IN_MSPIKE_H2 137122 24.43 28.66 23.75 17 LOC_TINY_FONT_1 136343 23.92 25.87 23.61 18 RCVD_IN_MSPIKE_WL 123234 19.24 6.05 21.34 19 FVGT_m_MULTI_ODD 122457 21.74 25.09 21.21 20 MIME_HTML_ONLY 121240 24.02 42.98 21.00 21 XMSubLong 114412 20.64 25.77 19.82 22 ALL_TRUSTED 103918 16.01 3.56 18.00 23 XM_Multi_Part_URI 101479 17.51 17.11 17.58 24 XM_B_Unsub 93429 16.03 15.10 16.18 25 BAYES_00 89532 13.51 1.00 15.51 26 XM_Body_Dirty_Words 76629 13.93 18.02 13.27 27 RCVD_IN_MSPIKE_H3 75057 11.83 4.51 13.00 28 TooManyTo_001 72152 11.71 6.79 12.50 29 XM_DK_Undo_02 62845 16.73 53.38 10.88 30 TR_XM_DK_Bayes 54700 8.24 0.50 9.47 31 TR_XM_DK_Bayes1 50598 7.59 0.22 8.76 32 LotsOfNums_01 49727 8.44 7.37 8.61 33 LOTS_OF_MONEY 48571 9.34 15.17 8.41 34 XM_B_Unsub2 47302 7.72 4.79 8.19 35 TR_XM_DK_Bayes2 45149 6.77 0.20 7.82 36 XM_Evil_Numbers_Gen 44912 7.99 9.30 7.78 37 RCVD_IN_MSPIKE_H4 43770 6.74 1.48 7.58 38 HTML_IMAGE_RATIO_02 43247 7.50 7.53 7.49 39 XM_B_Phish_Phrases 42716 8.16 12.93 7.40 40 UNPARSEABLE_RELAY 40534 6.81 5.49 7.02 41 RCVD_IN_RP_SAFE 40393 6.14 0.75 7.00 42 BAYES_99 38964 11.34 40.08 6.75 43 RCVD_IN_RP_CERTIFIED 37104 5.62 0.57 6.43 44 XM_SendGrid 36604 6.07 4.35 6.34 45 MIME_QP_LONG_LINE 36416 5.92 3.51 6.31 46 HTML_IMAGE_RATIO_04 36197 6.00 4.32 6.27 47 XM_DKIMWhitelistDomains 34688 5.18 0.01 6.01 48 IN_ZIMBRA_NJ_WHITELIST 34125 5.10 0.04 5.91 49 MPART_ALT_DIFF 33740 5.70 4.80 5.84 50 TooManyTo_002 33648 5.40 2.73 5.83 51 BAYES_60 33454 5.80 5.82 5.79 52 XM_H_Long_From01 33063 5.70 5.52 5.73 53 DKIM_INVALID 32822 7.21 16.76 5.68 54 RCVD_IN_IADB_LISTED 31129 4.79 0.99 5.39 55 BAYES_999 30420 9.09 33.04 5.27 56 RELAYCOUNTRY_META 29375 7.90 25.49 5.09 57 BOTNET_IPINHOSTNAME 27770 6.62 17.97 4.81 58 BAYES_40 27272 4.44 2.64 4.72 59 RCVD_IN_IADB_SPF 26919 4.14 0.90 4.66 60 TooManyTo_003 25592 4.15 2.39 4.43 61 XMStrtUSub 23888 4.08 3.70 4.14 62 RCVD_IN_IADB_SENDERID 23613 3.64 0.86 4.09 63 RCVD_IN_IADB_DK 23288 3.60 0.86 4.03 64 XMSexyCombo_05 23242 4.81 9.75 4.03 65 MIME_HTML_ONLY_MULTI 22703 3.70 2.28 3.93 66 T_TooManySym_01 22083 3.75 3.29 3.82 67 BAYES_80 22032 4.09 5.78 3.82 68 XM_PDF 22009 3.39 0.78 3.81 69 HTML_IMAGE_RATIO_06 21381 3.57 2.71 3.70 70 XM_H_Trusted_IP 21249 3.17 0.00 3.68 71 TR_XM_DK_SendGrid 21060 3.38 1.73 3.65 72 TM2_M_URI_OPT_OUT 20799 3.68 4.13 3.60 73 RCVD_IN_IADB_VOUCHED 20182 3.05 0.27 3.50 74 TR_XM_PhishingBody 20109 3.84 6.11 3.48 75 BAYES_20 20008 3.25 1.91 3.47 76 T_REMOTE_IMAGE 19304 3.77 6.42 3.34 77 TooManyTo_004 19152 3.14 2.05 3.32 78 XMSubMetaSx_00 18720 3.78 7.14 3.24 79 XMNumbers 18260 3.88 8.38 3.16 80 BOTNET 18013 7.05 31.64 3.12 81 NO_DNS_FOR_FROM 17939 4.44 12.76 3.11 82 FROM_EXCESS_BASE64 17898 3.32 4.73 3.10 83 XM_UncommonTLD01 17246 5.47 21.03 2.99 84 XM_B_SpammyTLD 15595 2.97 4.68 2.70 85 ANY_BOUNCE_MESSAGE 15440 2.39 0.64 2.67 86 BOUNCE_MESSAGE 15430 2.39 0.64 2.67 87 MIME_HTML_MOSTLY 15006 2.64 2.93 2.60 88 BAYES_05 14237 2.29 1.19 2.47 89 HTML_IMAGE_RATIO_08 14012 2.38 2.11 2.43 90 HTML_MIME_NO_HTML_TAG 13831 2.45 2.82 2.40 91 XM_CamelCaseFrm001 13440 3.78 12.85 2.33 92 BAYES_95 13419 2.45 3.22 2.32 93 TooManyTo_005 13290 2.22 1.71 2.30 94 MAILING_LIST_MULTI 12615 2.09 1.50 2.18 95 RCVD_IN_IADB_OPTIN 12605 1.92 0.28 2.18 96 XM_B_COVIDMETA 12250 2.94 8.05 2.12 97 URI_WP_HACKED_2 11809 2.07 2.26 2.05 98 XM_B_Phish66 11553 2.27 3.94 2.00 99 XMDiploma_00 10914 2.08 3.26 1.89 100 XM_DK_Undo_01 10461 1.83 1.91 1.81 101 T_XMDrugObfuBody_08 10353 2.61 7.72 1.79 102 T_TooManySym_02 10106 1.77 1.87 1.75 103 UNTRUSTED_Relay 10021 3.88 17.30 1.74 104 KHOP_HELO_FCRDNS 10015 1.90 2.94 1.73 105 T_XMDrugObfuBody_14 9905 1.76 2.06 1.72 106 SUBJ_ALL_CAPS 9890 1.71 1.67 1.71 107 XM_SPF_SoftFail 9671 2.26 5.93 1.67 108 HTML_FONT_FACE_BAD 9310 1.44 0.35 1.61 109 TVD_RCVD_IP 9202 1.43 0.37 1.59 110 RELAYCOUNTRY_CA 9143 2.31 6.87 1.58 111 URI_HEX 8911 1.53 1.46 1.54 112 URI_TRY_3LD 8565 1.41 0.92 1.48 113 TR_Symld_Words 8265 1.40 1.18 1.43 114 RCVD_IN_BL_SPAMCOP_NET 8169 2.57 9.78 1.41 115 INVALID_MSGID 7668 1.16 0.14 1.33 116 IN_HORDE_ADDRESS_BOOK 7481 1.12 0.05 1.30 117 DKIM_ADSP_CUSTOM_MED 7188 1.27 1.41 1.24 118 TM2_M_VERY_LONG_WORD 7170 1.33 1.89 1.24 119 HELO_NODOT 6955 1.15 0.81 1.20 120 HELO_NO_DOMAIN 6954 1.15 0.81 1.20 121 TO_MALFORMED 6705 1.00 0.01 1.16 122 XM_GoogleGroups 6649 1.06 0.49 1.15 123 XMSubNoVowel 6328 1.13 1.33 1.10 124 XMGappySubj_01 6064 0.92 0.13 1.05 125 XMStockSpam_06 5976 1.15 1.87 1.04 126 XMBdyGiftCard01 5976 1.02 0.90 1.04 127 XM_H_Long_From02 5926 0.98 0.71 1.03 128 XM_UB50 5920 1.85 6.99 1.03 129 RELAYCOUNTRY_GB 5768 1.10 1.71 1.00 130 XM_OfRef6 5633 1.56 5.26 0.98 131 TR_MSPIKEBAYES00 5553 0.83 0.01 0.96 132 XMCapTrack 5515 0.90 0.57 0.96 133 USER_IN_DEF_DKIM_WL 5494 0.82 0.00 0.95 134 TR_XM_COVIDMETA4 5278 1.86 7.79 0.91 135 NML_ADSP_CUSTOM_MED 5232 0.95 1.24 0.91 136 XMBody_17 5085 1.62 6.27 0.88 137 XMGenDplmaNmb 4917 0.93 1.44 0.85 138 T_FILL_THIS_FORM_SHORT 4528 0.85 1.27 0.78 139 SpammyFromTLD_01 4493 1.26 4.29 0.78 140 RCVD_IN_MSPIKE_H5 4407 0.67 0.05 0.76 141 XMHTML_After_End 4383 1.46 5.86 0.76 142 XMBrknScrpt_02 4355 0.80 1.09 0.75 143 TR_XM_COVIDMETA1 4328 1.01 2.62 0.75 144 TR_MetaPhish_Combo_01 4207 0.74 0.80 0.73 145 HTTPS_HTTP_MISMATCH 3802 0.66 0.65 0.66 146 FROM_GOV_DKIM_AU 3677 0.56 0.07 0.64 147 XMMoneyMeta_00 3667 0.64 0.67 0.64 148 XM_DIRTYINTL 3656 1.07 3.79 0.63 149 T_XMHurry_00 3589 0.91 2.72 0.62 150 XMSexyCombo_01 3549 0.89 2.63 0.61 151 T_OBFU_PDF_ATTACH 3493 0.54 0.10 0.60 152 T_Symld_Words_02 3391 0.80 2.15 0.59 153 XMSubMetaI_00 3363 0.63 0.90 0.58 154 T_PDS_OTHER_BAD_TLD 3341 0.74 1.76 0.58 155 XM_SPF_Unknown 3316 0.61 0.81 0.57 156 T_TooManySym_03 3305 0.71 1.60 0.57 157 FORGED_GMAIL_RCVD 3273 0.65 1.14 0.57 158 HTML_IMAGE_ONLY_20 3255 0.53 0.32 0.56 159 T_XMDrugObfuBody_00 3217 0.68 1.43 0.56 160 TR_LOTS_OF_MONEY3 3083 0.87 2.98 0.53 161 XMPhish30 3077 0.59 0.92 0.53 162 RCVD_IN_MSPIKE_BL 3069 1.72 9.18 0.53 163 XM_RXBody 3055 0.57 0.79 0.53 164 XMSubMetaSxObfu_03 3019 0.65 1.45 0.52 165 XMPhish08 3005 0.56 0.79 0.52 166 XMBody_78 3005 0.59 1.00 0.52 167 MISSING_HEADERS 2869 0.60 1.26 0.50 168 XM_ProductURIs 2858 0.52 0.68 0.49 169 XM_ShortIntro_01 2846 0.49 0.47 0.49 170 XM_H_PHPMailer 2795 0.58 1.21 0.48 171 XM_B_COPY_HTML 2752 0.47 0.39 0.48 172 XM_B_REG_HTML 2686 0.44 0.27 0.47 173 XMHTMLBadTable_001 2668 0.45 0.37 0.46 174 PLING_QUERY 2665 0.45 0.39 0.46 175 SpammyFromTLD_02 2662 0.77 2.74 0.46 176 TR_XM_PHPDW 2624 0.76 2.64 0.45 177 RELAYCOUNTRY_DE 2578 0.85 3.39 0.45 178 TR_XM_PHPForged 2529 0.74 2.61 0.44 179 HTML_TAG_BALANCE_BODY 2515 0.44 0.43 0.44 180 TR_XM_FormFill2 2498 0.73 2.59 0.43 181 XM_H_PHPOS 2465 0.72 2.59 0.43 182 XMPhish14 2420 0.45 0.65 0.42 183 URI_NOVOWEL 2405 0.45 0.70 0.42 184 XMSubMetaSxObfu_02 2386 0.44 0.63 0.41 185 XMOemUri 2329 0.47 0.91 0.40 186 REMOVE_BEFORE_LINK 2276 0.40 0.45 0.39 187 HTML_IMAGE_ONLY_32 2243 0.35 0.13 0.39 188 XM_Combo_Sbj 2220 0.42 0.67 0.38 189 XMLngstWrd_00 2218 0.43 0.69 0.38 190 XMNoVowels 2211 0.42 0.65 0.38 191 RCVD_IN_SORBS_DUL 2201 0.36 0.26 0.38 192 T_MONEY_PERCENT 2158 0.46 1.03 0.37 193 TR_LOTS_OF_MONEY2 2158 0.46 1.03 0.37 194 MPART_ALT_DIFF_COUNT 2135 0.45 0.92 0.37 195 HTML_IMAGE_ONLY_28 2131 0.35 0.21 0.37 196 FROM_GOV_SPOOF 2119 0.36 0.33 0.37 197 TM2_M_BODY_EMPTY 2115 0.33 0.08 0.37 198 XMBody_95 2096 0.33 0.13 0.36 199 RCVD_IN_MSPIKE_L3 2070 0.98 4.90 0.36 200 XMLngstWrd_01 2016 0.39 0.64 0.35 ----------------------------------------------------------------------