Email: 465115 Autolearn: 0 AvgScore: 0.50 AvgScanTime: 2.32 sec Spam: 81692 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 4.01 sec Ham: 383423 Autolearn: 0 AvgScore: -2.29 AvgScanTime: 1.96 sec Time Spent Running SA: 299.65 hours Time Spent Processing Spam: 91.10 hours Time Spent Processing Ham: 208.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 79347 98.50 97.13 98.79 2 HTML_MESSAGE 75384 89.25 92.28 88.60 3 DKIM_SIGNED 56930 77.31 69.69 78.94 4 XM_DK_Pass 54316 75.81 66.49 77.79 5 XM_B_Unicode 50487 70.60 61.80 72.48 6 XMListUnsubscribeExists 48233 59.11 59.04 59.13 7 RELAYCOUNTRY_US 47860 78.41 58.59 82.64 8 DKIM_VALID 44100 69.95 53.98 73.35 9 XM_DK_Undo_02 39611 19.87 48.49 13.77 10 MIME_HTML_ONLY 37287 27.31 45.64 23.40 11 RELAYCOUNTRY_META 34670 12.59 42.44 6.24 12 DKIM_VALID_AU 33081 54.69 40.49 57.71 13 BAYES_99 32876 14.57 40.24 9.10 14 BOTNET 31788 9.96 38.91 3.80 15 BAYES_50 28831 49.74 35.29 52.82 16 BAYES_999 27361 11.83 33.49 7.21 17 UNTRUSTED_Relay 26836 7.75 32.85 2.40 18 XM_B_Unicode3 25974 42.56 31.80 44.86 19 LOC_TINY_FONT_1 23271 29.47 28.49 29.68 20 DKIM_VALID_EF 22905 25.90 28.04 25.44 21 XMSubLong 19631 20.85 24.03 20.17 22 FVGT_m_MULTI_ODD 19205 23.61 23.51 23.63 23 XM_UncommonTLD01 17898 6.79 21.91 3.57 24 HTML_FONT_LOW_CONTRAST 17844 29.99 21.84 31.73 25 BOTNET_IPINHOSTNAME 17207 8.89 21.06 6.29 26 T_KAM_HTML_FONT_INVALID 16211 19.19 19.84 19.06 27 RCVD_IN_MSPIKE_H2 16019 23.66 19.61 24.53 28 RCVD_IN_MSPIKE_BL 13293 3.38 16.27 0.63 29 DKIM_INVALID 12830 7.36 15.71 5.59 30 T_TM2_M_HEADER_IN_MSG 12786 21.88 15.65 23.21 31 XM_Body_Dirty_Words 11729 14.59 14.36 14.64 32 HTML_IMAGE_RATIO_02 11247 11.55 13.77 11.08 33 XM_Multi_Part_URI 10224 13.36 12.52 13.54 34 RCVD_IN_BL_SPAMCOP_NET 9712 3.32 11.89 1.50 35 XM_UB50 9621 3.29 11.78 1.48 36 XM_UB99 9541 2.07 11.68 0.02 37 NO_DNS_FOR_FROM 8998 4.65 11.01 3.29 38 T_REMOTE_IMAGE 8956 4.30 10.96 2.88 39 LOTS_OF_MONEY 8898 8.68 10.89 8.21 40 RCVD_IN_RP_RNBL 8453 1.92 10.35 0.12 41 XM_B_Unsub 8451 10.41 10.34 10.42 42 BOTNET_NORDNS 8311 1.82 10.17 0.04 43 XM_UB999 8215 1.78 10.06 0.02 44 XMSexyCombo_05 7893 6.05 9.66 5.28 45 SpammyFromTLD_01 7607 2.12 9.31 0.59 46 RCVD_IN_MSPIKE_L3 7396 1.93 9.05 0.41 47 RELAYCOUNTRY_DE 7389 1.93 9.04 0.41 48 BODY_URI_ONLY 6685 1.49 8.18 0.06 49 XMHTML_After_End 6619 2.17 8.10 0.91 50 LotsOfNums_01 6508 9.13 7.97 9.37 51 BAYES_60 6229 6.81 7.62 6.64 52 RELAYCOUNTRY_CA 6090 2.66 7.45 1.63 53 HTML_MIME_NO_HTML_TAG 6060 3.26 7.42 2.37 54 XM_Evil_Numbers_Gen 6009 10.28 7.36 10.90 55 TR_XM_COVIDMETA4 5834 1.77 7.14 0.63 56 RCVD_IN_PSBL 5798 1.32 7.10 0.09 57 XM_B_Phish_Phrases 5738 7.34 7.02 7.41 58 BAYES_80 5708 5.11 6.99 4.71 59 KHOP_HELO_FCRDNS 5525 2.28 6.76 1.32 60 RELAYCOUNTRY_FR 5451 1.43 6.67 0.31 61 XM_H_Long_From01 5102 5.36 6.25 5.18 62 XM_SPF_SoftFail 5101 2.24 6.24 1.39 63 XMNumbers 5070 3.90 6.21 3.40 64 XMSubMetaSx_00 5039 4.25 6.17 3.84 65 TR_XM_MaxSPIKE 4992 1.09 6.11 0.02 66 TR_XM_PhishingBody 4914 3.43 6.02 2.88 67 FROM_EXCESS_BASE64 4896 4.59 5.99 4.29 68 XM_CamelCaseFrm001 4878 3.57 5.97 3.06 69 RCVD_IN_MSPIKE_L5 4474 1.07 5.48 0.13 70 URIBL_SBL_A 4434 1.07 5.43 0.14 71 XM_JunkDunk 4364 0.94 5.34 0.00 72 RCVD_IN_MSPIKE_WL 4344 20.39 5.32 23.60 73 TR_XM_INV_DKIM 4191 1.09 5.13 0.22 74 MIME_HTML_MOSTLY 4106 3.27 5.03 2.89 75 XM_B_SpammyTLD 4069 3.01 4.98 2.59 76 TooManyTo_001 4067 6.55 4.98 6.88 77 XM_OfRef6 4052 1.55 4.96 0.83 78 MPART_ALT_DIFF 4023 5.59 4.92 5.73 79 TR_XM_MaxBayes 3770 0.85 4.61 0.04 80 XM_DIRTYINTL 3730 1.31 4.57 0.62 81 HTML_IMAGE_RATIO_04 3480 5.66 4.26 5.95 82 SpammyFromTLD_02 3396 0.97 4.16 0.30 83 UNPARSEABLE_RELAY 3261 7.82 3.99 8.63 84 BAYES_95 3252 3.01 3.98 2.81 85 RELAYCOUNTRY_IN 3192 0.77 3.91 0.11 86 XM_OfRef7 3189 0.75 3.90 0.08 87 TR_Mismatch_TLD_02 3127 0.74 3.83 0.08 88 XMStrtUSub 3127 4.87 3.83 5.10 89 RDNS_DYNAMIC 3049 1.04 3.73 0.46 90 XM_B_Phish66 2987 1.63 3.66 1.20 91 DKIM_ADSP_NXDOMAIN 2798 0.85 3.43 0.30 92 XMStockSpam_06 2777 2.08 3.40 1.80 93 HDRS_MISSP 2772 0.67 3.39 0.09 94 RCVD_IN_MSPIKE_H3 2721 12.05 3.33 13.91 95 T_FILL_THIS_FORM_SHORT 2706 1.14 3.31 0.68 96 NO_FM_NAME_IP_HOSTN 2692 0.58 3.30 0.00 97 MIME_QP_LONG_LINE 2692 5.84 3.30 6.39 98 TM2_M_URI_OPT_OUT 2662 4.11 3.26 4.29 99 T_PDS_OTHER_BAD_TLD 2611 1.16 3.20 0.72 100 XM_BadFromFormat 2533 0.70 3.10 0.19 101 XM_SendGrid 2504 7.16 3.07 8.03 102 XM_B_COVIDMETA 2492 1.85 3.05 1.60 103 XM_UB60 2461 0.65 3.01 0.14 104 FROM_MISSP_REPLYTO 2435 0.53 2.98 0.01 105 DATE_IN_PAST_03_06 2431 0.63 2.98 0.13 106 XMBody_17 2416 1.04 2.96 0.63 107 HK_SCAM 2364 0.55 2.89 0.05 108 FROM_SUSPICIOUS_NTLD 2306 0.60 2.82 0.13 109 XM_DK_Undo_01 2305 1.71 2.82 1.48 110 HTML_IMAGE_ONLY_16 2299 0.71 2.81 0.27 111 XM_URI_RBL 2241 0.65 2.74 0.20 112 TR_Sbj_FN_Bdy 2230 0.66 2.73 0.22 113 SUBJ_ALL_CAPS 2198 1.76 2.69 1.56 114 XM_OfRef8 2198 0.48 2.69 0.01 115 FROM_MISSP_EH_MATCH 2160 0.47 2.64 0.00 116 BAYES_40 2142 4.13 2.62 4.45 117 FROM_SUSPICIOUS_NTLD_FP 2113 0.55 2.59 0.12 118 XMSubEmpty 2101 0.60 2.57 0.18 119 T_TooManySym_01 2082 4.35 2.55 4.73 120 T_XMDrugObfuBody_08 2077 1.65 2.54 1.46 121 DATE_IN_PAST_06_12 2077 0.69 2.54 0.30 122 TR_XM_PHPDW 2073 0.86 2.54 0.50 123 TR_XM_PHPForged 2053 0.83 2.51 0.47 124 TR_XM_FormFill2 2029 0.82 2.48 0.47 125 XM_H_PHPOS 2026 0.81 2.48 0.46 126 HDRS_LCASE_IMGONLY 2023 0.44 2.48 0.01 127 HTML_IMAGE_RATIO_06 2021 4.65 2.47 5.11 128 XM_UB80 2019 0.48 2.47 0.05 129 HTML_IMAGE_ONLY_08 2008 0.50 2.46 0.08 130 HTML_SHORT_LINK_IMG_1 2002 0.44 2.45 0.01 131 SUBJECT_NEEDS_ENCODING 1990 0.44 2.44 0.01 132 SUBJ_ILLEGAL_CHARS 1990 0.44 2.44 0.01 133 MONEY_FORM_SHORT 1984 0.45 2.43 0.03 134 MIME_HEADER_CTYPE_ONLY 1984 0.66 2.43 0.28 135 XMSlimDrugH 1943 0.60 2.38 0.22 136 FROM_MISSP_DYNIP 1930 0.42 2.36 0.00 137 DKIM_ADSP_CUSTOM_MED 1774 1.37 2.17 1.20 138 LongTLD 1710 0.51 2.09 0.17 139 HTML_SHORT_LINK_IMG_2 1688 0.41 2.07 0.06 140 MISSING_SUBJECT 1678 0.41 2.05 0.06 141 XMNoSubject 1678 0.41 2.05 0.06 142 XMLngstWrd_00 1655 0.73 2.03 0.45 143 URI_PHP_REDIR 1648 0.42 2.02 0.08 144 NML_ADSP_CUSTOM_MED 1634 1.08 2.00 0.88 145 RCVD_IN_MSPIKE_H4 1595 7.51 1.95 8.69 146 TR_Mismatch_TLD_01 1589 0.54 1.95 0.24 147 URI_NO_WWW_INFO_CGI 1497 0.37 1.83 0.06 148 XMSexyCombo_01 1463 1.08 1.79 0.93 149 HTML_IMAGE_RATIO_08 1446 2.45 1.77 2.59 150 T_XMHurry_00 1386 1.53 1.70 1.49 151 BAYES_20 1377 2.80 1.69 3.03 152 TR_Symld_Words 1367 1.64 1.67 1.64 153 RELAYCOUNTRY_NL 1363 0.50 1.67 0.26 154 RCVD_IN_MSPIKE_L4 1330 0.35 1.63 0.08 155 XM_UB95 1304 0.30 1.60 0.03 156 TR_XM_COVIDMETA1 1289 0.51 1.58 0.28 157 TR_XM_RelayPhish 1280 0.40 1.57 0.16 158 TM2_M_VERY_LONG_WORD 1276 1.49 1.56 1.47 159 ALL_TRUSTED 1265 10.41 1.55 12.30 160 T_Symld_Words_02 1263 0.64 1.55 0.45 161 SCRIPT_GIBBERISH 1246 0.27 1.53 0.01 162 XM_B_Unsub2 1241 2.16 1.52 2.29 163 FORGED_GMAIL_RCVD 1229 0.73 1.50 0.57 164 XMSubNoVowel 1226 1.31 1.50 1.27 165 DATE_IN_PAST_12_24 1218 0.34 1.49 0.09 166 RELAYCOUNTRY_GB 1214 1.55 1.49 1.57 167 URI_HEX 1201 1.39 1.47 1.37 168 MIME_HTML_ONLY_MULTI 1193 3.14 1.46 3.50 169 HELO_DYNAMIC_IPADDR 1189 0.26 1.46 0.01 170 T_TooManySym_02 1185 2.13 1.45 2.27 171 TO_NO_BRKTS_FROM_MSSP 1167 0.27 1.43 0.02 172 XMLngstWrd_01 1144 0.52 1.40 0.33 173 FILL_THIS_FORM 1137 0.56 1.39 0.38 174 FORM_FRAUD 1136 0.24 1.39 0.00 175 T_XMDrugObfuBody_14 1110 1.91 1.36 2.03 176 MISSING_HEADERS 1106 1.32 1.35 1.32 177 DEAR_FRIEND 1090 0.29 1.33 0.07 178 HK_RANDOM_REPLYTO 1086 0.43 1.33 0.24 179 MILLION_HUNDRED 1070 0.25 1.31 0.02 180 T_LOTTO_AGENT 1051 0.23 1.29 0.00 181 XMBrknScrpt_02 1049 1.06 1.28 1.02 182 XM_XX_Yahoo 1032 0.28 1.26 0.07 183 XMSubMetaI_00 989 1.12 1.21 1.10 184 XM_H_PHPMailer 974 0.73 1.19 0.63 185 T_TooManySym_03 941 0.79 1.15 0.72 186 T_HTML_TAG_BALANCE_CENTER 939 0.33 1.15 0.16 187 MIME_CHARSET_FARAWAY 936 0.31 1.15 0.13 188 XMPhish30 926 0.64 1.13 0.53 189 XMSubMetaSxObfu_03 925 0.63 1.13 0.52 190 DIET_1 915 0.66 1.12 0.56 191 RELAYCOUNTRY_JP 907 0.23 1.11 0.05 192 CHARSET_FARAWAY_HEADER 903 0.25 1.11 0.06 193 XMDiploma_00 890 1.35 1.09 1.40 194 RCVD_IN_RP_SAFE 884 9.07 1.08 10.78 195 MAILING_LIST_MULTI 878 2.04 1.07 2.25 196 T_XMDrugObfuBody_00 877 0.70 1.07 0.62 197 RELAYCOUNTRY_CN 836 0.28 1.02 0.12 198 TVD_RCVD_IP 827 2.04 1.01 2.25 199 URIBL_BLACK 826 0.20 1.01 0.03 200 XM_H_PHPOS_M 825 0.36 1.01 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 378769 98.50 97.13 98.79 2 HTML_MESSAGE 339715 89.25 92.28 88.60 3 RELAYCOUNTRY_US 316852 78.41 58.59 82.64 4 DKIM_SIGNED 302668 77.31 69.69 78.94 5 XM_DK_Pass 298278 75.81 66.49 77.79 6 DKIM_VALID 281245 69.95 53.98 73.35 7 XM_B_Unicode 277896 70.60 61.80 72.48 8 XMListUnsubscribeExists 226714 59.11 59.04 59.13 9 DKIM_VALID_AU 221290 54.69 40.49 57.71 10 BAYES_50 202533 49.74 35.29 52.82 11 XM_B_Unicode3 171991 42.56 31.80 44.86 12 HTML_FONT_LOW_CONTRAST 121648 29.99 21.84 31.73 13 LOC_TINY_FONT_1 113809 29.47 28.49 29.68 14 DKIM_VALID_EF 97556 25.90 28.04 25.44 15 RCVD_IN_MSPIKE_H2 94041 23.66 19.61 24.53 16 FVGT_m_MULTI_ODD 90595 23.61 23.51 23.63 17 RCVD_IN_MSPIKE_WL 90497 20.39 5.32 23.60 18 MIME_HTML_ONLY 89738 27.31 45.64 23.40 19 T_TM2_M_HEADER_IN_MSG 88997 21.88 15.65 23.21 20 XMSubLong 77328 20.85 24.03 20.17 21 T_KAM_HTML_FONT_INVALID 73063 19.19 19.84 19.06 22 XM_Body_Dirty_Words 56115 14.59 14.36 14.64 23 BAYES_00 54590 11.86 0.71 14.24 24 RCVD_IN_MSPIKE_H3 53324 12.05 3.33 13.91 25 XM_DK_Undo_02 52800 19.87 48.49 13.77 26 XM_Multi_Part_URI 51898 13.36 12.52 13.54 27 ALL_TRUSTED 47159 10.41 1.55 12.30 28 HTML_IMAGE_RATIO_02 42465 11.55 13.77 11.08 29 XM_Evil_Numbers_Gen 41786 10.28 7.36 10.90 30 RCVD_IN_RP_SAFE 41320 9.07 1.08 10.78 31 XM_B_Unsub 39962 10.41 10.34 10.42 32 RCVD_IN_RP_CERTIFIED 39138 8.53 0.63 10.21 33 LotsOfNums_01 35937 9.13 7.97 9.37 34 BAYES_99 34886 14.57 40.24 9.10 35 XM_DKIMWhitelistDomains 34395 7.40 0.01 8.97 36 TR_XM_DK_Bayes 34215 7.43 0.44 8.92 37 RCVD_IN_MSPIKE_H4 33319 7.51 1.95 8.69 38 UNPARSEABLE_RELAY 33095 7.82 3.99 8.63 39 TR_XM_DK_Bayes1 31711 6.86 0.24 8.27 40 LOTS_OF_MONEY 31492 8.68 10.89 8.21 41 XM_SendGrid 30796 7.16 3.07 8.03 42 TR_XM_DK_Bayes2 28705 6.21 0.21 7.49 43 XM_B_Phish_Phrases 28415 7.34 7.02 7.41 44 BAYES_999 27659 11.83 33.49 7.21 45 TooManyTo_001 26387 6.55 4.98 6.88 46 BAYES_60 25443 6.81 7.62 6.64 47 MIME_QP_LONG_LINE 24491 5.84 3.30 6.39 48 BOTNET_IPINHOSTNAME 24129 8.89 21.06 6.29 49 RELAYCOUNTRY_META 23911 12.59 42.44 6.24 50 HTML_IMAGE_RATIO_04 22826 5.66 4.26 5.95 51 MPART_ALT_DIFF 21985 5.59 4.92 5.73 52 DKIM_INVALID 21423 7.36 15.71 5.59 53 XMSexyCombo_05 20245 6.05 9.66 5.28 54 XM_H_Long_From01 19843 5.36 6.25 5.18 55 HTML_IMAGE_RATIO_06 19608 4.65 2.47 5.11 56 XMStrtUSub 19545 4.87 3.83 5.10 57 IN_ZIMBRA_NJ_WHITELIST 19412 4.18 0.04 5.06 58 T_TooManySym_01 18149 4.35 2.55 4.73 59 BAYES_80 18055 5.11 6.99 4.71 60 BAYES_40 17048 4.13 2.62 4.45 61 FROM_EXCESS_BASE64 16460 4.59 5.99 4.29 62 TM2_M_URI_OPT_OUT 16455 4.11 3.26 4.29 63 RCVD_IN_IADB_LISTED 16338 3.63 0.66 4.26 64 TR_XM_DK_SendGrid 15349 3.45 0.83 4.00 65 XMSubMetaSx_00 14722 4.25 6.17 3.84 66 BOTNET 14556 9.96 38.91 3.80 67 RCVD_IN_IADB_SPF 14439 3.22 0.63 3.77 68 XM_UncommonTLD01 13680 6.79 21.91 3.57 69 MIME_HTML_ONLY_MULTI 13429 3.14 1.46 3.50 70 RCVD_IN_IADB_SENDERID 13090 2.92 0.62 3.41 71 XMNumbers 13054 3.90 6.21 3.40 72 XM_H_Trusted_IP 12909 2.78 0.00 3.37 73 RCVD_IN_IADB_DK 12760 2.85 0.62 3.33 74 NO_DNS_FOR_FROM 12625 4.65 11.01 3.29 75 ANY_BOUNCE_MESSAGE 12350 2.77 0.65 3.22 76 BOUNCE_MESSAGE 12348 2.77 0.65 3.22 77 XM_CamelCaseFrm001 11733 3.57 5.97 3.06 78 BAYES_20 11629 2.80 1.69 3.03 79 MIME_HTML_MOSTLY 11083 3.27 5.03 2.89 80 TR_XM_PhishingBody 11061 3.43 6.02 2.88 81 T_REMOTE_IMAGE 11035 4.30 10.96 2.88 82 BAYES_95 10764 3.01 3.98 2.81 83 HTML_IMAGE_RATIO_08 9939 2.45 1.77 2.59 84 XM_B_SpammyTLD 9920 3.01 4.98 2.59 85 RCVD_IN_IADB_VOUCHED 9776 2.13 0.13 2.55 86 UNTRUSTED_Relay 9221 7.75 32.85 2.40 87 HTML_MIME_NO_HTML_TAG 9104 3.26 7.42 2.37 88 XM_B_Unsub2 8791 2.16 1.52 2.29 89 T_TooManySym_02 8709 2.13 1.45 2.27 90 TVD_RCVD_IP 8639 2.04 1.01 2.25 91 MAILING_LIST_MULTI 8633 2.04 1.07 2.25 92 BAYES_05 8475 1.97 0.84 2.21 93 T_XMDrugObfuBody_14 7765 1.91 1.36 2.03 94 INVALID_MSGID 6964 1.51 0.09 1.82 95 XMStockSpam_06 6883 2.08 3.40 1.80 96 XMBdyGiftCard01 6827 1.62 0.89 1.78 97 TO_MALFORMED 6532 1.41 0.02 1.70 98 TR_Symld_Words 6278 1.64 1.67 1.64 99 RELAYCOUNTRY_CA 6261 2.66 7.45 1.63 100 HELO_NODOT 6253 1.52 1.00 1.63 101 HELO_NO_DOMAIN 6251 1.52 1.00 1.63 102 XM_PDF 6228 1.39 0.31 1.62 103 XM_B_COVIDMETA 6118 1.85 3.05 1.60 104 RELAYCOUNTRY_GB 6013 1.55 1.49 1.57 105 SUBJ_ALL_CAPS 5984 1.76 2.69 1.56 106 RCVD_IN_IADB_OPTIN 5959 1.32 0.22 1.55 107 URI_TRY_3LD 5892 1.42 0.86 1.54 108 RCVD_IN_BL_SPAMCOP_NET 5735 3.32 11.89 1.50 109 T_XMHurry_00 5711 1.53 1.70 1.49 110 XM_UB50 5677 3.29 11.78 1.48 111 XM_DK_Undo_01 5659 1.71 2.82 1.48 112 TM2_M_VERY_LONG_WORD 5645 1.49 1.56 1.47 113 T_XMDrugObfuBody_08 5602 1.65 2.54 1.46 114 XMDiploma_00 5378 1.35 1.09 1.40 115 XM_SPF_SoftFail 5336 2.24 6.24 1.39 116 URI_HEX 5244 1.39 1.47 1.37 117 IN_HORDE_ADDRESS_BOOK 5111 1.10 0.03 1.33 118 TooManyTo_002 5092 1.18 0.51 1.33 119 KHOP_HELO_FCRDNS 5071 2.28 6.76 1.32 120 MISSING_HEADERS 5044 1.32 1.35 1.32 121 XM_ShortIntro_01 4920 1.19 0.76 1.28 122 XM_ProductURIs 4888 1.19 0.79 1.27 123 XMSubNoVowel 4858 1.31 1.50 1.27 124 XM_H_Long_From02 4753 1.14 0.68 1.24 125 XM_B_Phish66 4601 1.63 3.66 1.20 126 DKIM_ADSP_CUSTOM_MED 4589 1.37 2.17 1.20 127 XM_GoogleGroups 4503 1.03 0.35 1.17 128 HTML_FONT_FACE_BAD 4234 0.97 0.36 1.10 129 XMSubMetaI_00 4229 1.12 1.21 1.10 130 USER_IN_DEF_DKIM_WL 4111 0.88 0.00 1.07 131 XMBrknScrpt_02 3895 1.06 1.28 1.02 132 RCVD_IN_MSPIKE_H5 3854 0.83 0.03 1.01 133 TooManyTo_003 3658 0.85 0.35 0.95 134 XMSexyCombo_01 3558 1.08 1.79 0.93 135 XMHTML_After_End 3488 2.17 8.10 0.91 136 NML_ADSP_CUSTOM_MED 3369 1.08 2.00 0.88 137 XMGappySubj_01 3349 0.73 0.05 0.87 138 REPLYTO_WITHOUT_TO_CC 3243 0.87 1.00 0.85 139 XM_OfRef6 3176 1.55 4.96 0.83 140 TR_LOTS_OF_MONEY1 3111 0.82 0.85 0.81 141 TooManyTo_004 3022 0.70 0.31 0.79 142 TR_MSPIKEBAYES00 3015 0.65 0.00 0.79 143 XM_E_Blogspot 2967 0.66 0.10 0.77 144 XM_RXBody 2920 0.79 0.94 0.76 145 T_PDS_OTHER_BAD_TLD 2774 1.16 3.20 0.72 146 T_TooManySym_03 2743 0.79 1.15 0.72 147 XMPhish08 2736 0.73 0.82 0.71 148 XMGenDplmaNmb 2624 0.65 0.51 0.68 149 T_FILL_THIS_FORM_SHORT 2604 1.14 3.31 0.68 150 XMBody_78 2595 0.69 0.76 0.68 151 TooManyTo_005 2587 0.60 0.26 0.67 152 XMBody_17 2434 1.04 2.96 0.63 153 XM_H_PHPMailer 2432 0.73 1.19 0.63 154 RCVD_IN_MSPIKE_BL 2431 3.38 16.27 0.63 155 TR_XM_COVIDMETA4 2403 1.77 7.14 0.63 156 XM_H_Undi_Recip 2402 0.66 0.84 0.63 157 T_XMDrugObfuBody_00 2388 0.70 1.07 0.62 158 XM_DIRTYINTL 2376 1.31 4.57 0.62 159 XMSubMetaSxObfu_02 2351 0.58 0.41 0.61 160 SpammyFromTLD_01 2255 2.12 9.31 0.59 161 FORGED_GMAIL_RCVD 2181 0.73 1.50 0.57 162 TR_MetaPhish_Combo_01 2173 0.61 0.83 0.57 163 XM_B_REG_HTML 2166 0.51 0.24 0.56 164 XM_B_COPY_HTML 2151 0.54 0.42 0.56 165 DIET_1 2137 0.66 1.12 0.56 166 HTTPS_HTTP_MISMATCH 2126 0.52 0.37 0.55 167 TM2_M_A_HREF_HREF 2081 0.57 0.67 0.54 168 XMBody_95 2080 0.46 0.09 0.54 169 XMPhish30 2047 0.64 1.13 0.53 170 XMSubMetaSxObfu_03 1997 0.63 1.13 0.52 171 XMHTMLBadTable_001 1971 0.47 0.27 0.51 172 TR_XM_PHPDW 1914 0.86 2.54 0.50 173 NUMERIC_HTTP_ADDR 1873 0.46 0.35 0.49 174 TR_XM_PHPForged 1811 0.83 2.51 0.47 175 XMCapTrack 1808 0.44 0.31 0.47 176 TR_XM_FormFill2 1792 0.82 2.48 0.47 177 RDNS_DYNAMIC 1782 1.04 3.73 0.46 178 XM_H_PHPOS 1763 0.81 2.48 0.46 179 TR_BOTNET_NEGATE 1754 0.40 0.14 0.46 180 USER_IN_WHITELIST 1742 0.37 0.00 0.45 181 XMLngstWrd_00 1736 0.73 2.03 0.45 182 T_Symld_Words_02 1726 0.64 1.55 0.45 183 PLING_QUERY 1698 0.45 0.46 0.44 184 XMPhish14 1673 0.45 0.51 0.44 185 HTML_TAG_BALANCE_BODY 1662 0.45 0.56 0.43 186 HTML_IMAGE_ONLY_20 1632 0.42 0.38 0.43 187 RCVD_IN_MSPIKE_L3 1573 1.93 9.05 0.41 188 RELAYCOUNTRY_DE 1565 1.93 9.04 0.41 189 MPART_ALT_DIFF_COUNT 1461 0.45 0.77 0.38 190 XMOemUri 1453 0.36 0.29 0.38 191 FILL_THIS_FORM 1449 0.56 1.39 0.38 192 XMSubMetaSSx_00 1430 0.37 0.36 0.37 193 XMNoVowels 1422 0.42 0.65 0.37 194 XM_USANA_RCVD 1389 0.30 0.00 0.36 195 URI_NOVOWEL 1342 0.42 0.77 0.35 196 SUBJ_DOLLARS 1331 0.33 0.27 0.35 197 T_OBFU_PDF_ATTACH 1280 0.28 0.05 0.33 198 XMLngstWrd_01 1265 0.52 1.40 0.33 199 XMMoneyMeta_00 1248 0.37 0.57 0.33 200 XM_OverStock_LProb 1228 0.34 0.41 0.32 ----------------------------------------------------------------------