Email: 637621 Autolearn: 0 AvgScore: -0.06 AvgScanTime: 2.28 sec Spam: 91413 Autolearn: 0 AvgScore: 12.53 AvgScanTime: 4.59 sec Ham: 546208 Autolearn: 0 AvgScore: -2.17 AvgScanTime: 1.90 sec Time Spent Running SA: 404.16 hours Time Spent Processing Spam: 116.48 hours Time Spent Processing Ham: 287.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 89086 98.00 97.45 98.09 2 HTML_MESSAGE 85925 89.91 94.00 89.22 3 DKIM_SIGNED 67908 75.85 74.29 76.11 4 XM_B_Unicode 67414 71.37 73.75 70.97 5 XM_DK_Pass 65052 74.37 71.16 74.90 6 RELAYCOUNTRY_US 59091 79.88 64.64 82.43 7 XMListUnsubscribeExists 58202 53.33 63.67 51.60 8 DKIM_VALID 51480 67.94 56.32 69.88 9 XM_DK_Undo_02 45128 16.66 49.37 11.19 10 DKIM_VALID_AU 37714 50.95 41.26 52.57 11 BAYES_99 35926 11.59 39.30 6.95 12 XM_B_Unicode3 35828 39.39 39.19 39.43 13 MIME_HTML_ONLY 35044 23.41 38.34 20.92 14 BAYES_50 33823 50.69 37.00 52.98 15 RELAYCOUNTRY_META 31443 10.06 34.40 5.98 16 BOTNET 30293 7.85 33.14 3.62 17 BAYES_999 29575 9.13 32.35 5.25 18 LOC_TINY_FONT_1 27556 25.02 30.14 24.17 19 XMSubLong 25419 22.89 27.81 22.07 20 DKIM_VALID_EF 25221 26.75 27.59 26.61 21 HTML_FONT_LOW_CONTRAST 23359 27.33 25.55 27.63 22 FVGT_m_MULTI_ODD 22899 23.16 25.05 22.84 23 UNTRUSTED_Relay 22857 5.36 25.00 2.07 24 T_KAM_HTML_FONT_INVALID 20273 19.17 22.18 18.67 25 RCVD_IN_MSPIKE_H2 18160 24.04 19.87 24.74 26 XM_Body_Dirty_Words 17994 14.31 19.68 13.41 27 T_TM2_M_HEADER_IN_MSG 16960 28.08 18.55 29.67 28 DKIM_INVALID 16428 7.91 17.97 6.23 29 BOTNET_IPINHOSTNAME 15730 6.77 17.21 5.02 30 XM_UncommonTLD01 14789 5.23 16.18 3.40 31 XM_Multi_Part_URI 13221 12.79 14.46 12.51 32 RCVD_IN_MSPIKE_BL 12995 2.56 14.22 0.61 33 NO_DNS_FOR_FROM 12190 4.92 13.34 3.51 34 LOTS_OF_MONEY 11066 8.73 12.11 8.17 35 HTML_IMAGE_RATIO_02 10546 7.53 11.54 6.86 36 XMSexyCombo_05 10238 4.81 11.20 3.74 37 XM_B_Phish_Phrases 10180 8.05 11.14 7.54 38 XM_UB99 10058 1.58 11.00 0.01 39 RCVD_IN_BL_SPAMCOP_NET 9997 2.52 10.94 1.11 40 XM_B_Unsub 9831 10.91 10.75 10.94 41 XM_Evil_Numbers_Gen 8703 8.82 9.52 8.70 42 XM_UB999 8507 1.34 9.31 0.00 43 T_REMOTE_IMAGE 7985 4.20 8.74 3.44 44 RCVD_IN_MSPIKE_L3 7744 1.57 8.47 0.41 45 LotsOfNums_01 7563 8.74 8.27 8.82 46 XMHTML_After_End 7161 2.04 7.83 1.08 47 BODY_URI_ONLY 7090 1.17 7.76 0.07 48 RELAYCOUNTRY_CA 6846 2.45 7.49 1.60 49 TR_XM_PhishingBody 6685 4.07 7.31 3.53 50 TR_XM_COVIDMETA4 6597 1.87 7.22 0.98 51 BAYES_80 6544 4.60 7.16 4.17 52 XMSubMetaSx_00 6409 3.91 7.01 3.39 53 RELAYCOUNTRY_DE 6383 1.35 6.98 0.41 54 SpammyFromTLD_01 6275 1.78 6.86 0.93 55 XM_UB50 6213 2.11 6.80 1.32 56 XM_SPF_SoftFail 6159 2.63 6.74 1.94 57 XM_B_COVIDMETA 5968 3.00 6.53 2.41 58 XM_H_Long_From01 5960 5.78 6.52 5.66 59 BOTNET_NORDNS 5767 0.93 6.31 0.03 60 RCVD_IN_MSPIKE_WL 5703 20.67 6.24 23.08 61 TR_XM_MaxSPIKE 5600 0.90 6.13 0.03 62 RELAYCOUNTRY_FR 5498 1.19 6.01 0.39 63 BAYES_60 5338 6.37 5.84 6.46 64 HTML_IMAGE_RATIO_04 5320 5.36 5.82 5.28 65 TooManyTo_001 5308 8.00 5.81 8.37 66 SUBJECT_NEEDS_ENCODING 5032 0.80 5.50 0.01 67 SUBJ_ILLEGAL_CHARS 5031 0.80 5.50 0.01 68 XM_JunkDunk 4983 0.78 5.45 0.00 69 TR_XM_INV_DKIM 4772 0.89 5.22 0.16 70 MPART_ALT_DIFF 4724 4.58 5.17 4.48 71 HTML_MIME_NO_HTML_TAG 4635 2.93 5.07 2.57 72 XMNumbers 4568 3.60 5.00 3.36 73 RCVD_IN_RP_RNBL 4399 0.77 4.81 0.09 74 XM_DIRTYINTL 4337 1.25 4.74 0.67 75 UNPARSEABLE_RELAY 4297 6.99 4.70 7.38 76 MIME_QP_LONG_LINE 4108 5.96 4.49 6.21 77 XM_B_Phish66 4099 2.41 4.48 2.06 78 XMStrtUSub 3883 4.66 4.25 4.73 79 BAYES_95 3821 2.75 4.18 2.51 80 XM_CamelCaseFrm001 3771 2.34 4.13 2.05 81 XM_B_SpammyTLD 3755 2.19 4.11 1.87 82 RCVD_IN_MSPIKE_H3 3747 12.62 4.10 14.05 83 MIME_HTML_MOSTLY 3553 2.51 3.89 2.28 84 XM_SendGrid 3494 6.33 3.82 6.75 85 HTML_IMAGE_RATIO_06 3489 3.99 3.82 4.02 86 RCVD_IN_PSBL 3356 0.57 3.67 0.05 87 URIBL_SBL_A 3300 0.64 3.61 0.15 88 XM_OfRef6 3292 1.39 3.60 1.02 89 TM2_M_URI_OPT_OUT 3228 3.62 3.53 3.63 90 KHOP_HELO_FCRDNS 3197 2.28 3.50 2.07 91 XM_URI_RBL 3188 0.72 3.49 0.25 92 SpammyFromTLD_02 3121 0.74 3.41 0.30 93 T_XMDrugObfuBody_08 3096 1.88 3.39 1.63 94 T_TooManySym_01 2800 4.58 3.06 4.83 95 FROM_EXCESS_BASE64 2785 3.19 3.05 3.21 96 SUBJ_ALL_CAPS 2782 1.91 3.04 1.72 97 RCVD_IN_MSPIKE_L5 2740 0.54 3.00 0.13 98 T_PDS_OTHER_BAD_TLD 2698 0.89 2.95 0.55 99 TR_XM_MaxBayes 2679 0.45 2.93 0.04 100 XMSexyCombo_01 2641 1.17 2.89 0.88 101 TR_XM_PHPDW 2599 0.88 2.84 0.55 102 TR_XM_PHPForged 2584 0.86 2.83 0.53 103 TR_XM_FormFill2 2555 0.86 2.80 0.53 104 XM_H_PHPOS 2549 0.85 2.79 0.53 105 TR_XM_COVIDMETA1 2411 0.84 2.64 0.54 106 FROM_SUSPICIOUS_NTLD 2405 0.46 2.63 0.10 107 HTML_IMAGE_RATIO_08 2323 2.69 2.54 2.72 108 XMBody_17 2314 1.00 2.53 0.75 109 BAYES_40 2308 4.90 2.52 5.29 110 FROM_SUSPICIOUS_NTLD_FP 2288 0.44 2.50 0.09 111 ALL_TRUSTED 2270 11.92 2.48 13.50 112 XM_UB80 2231 0.39 2.44 0.04 113 DATE_IN_PAST_03_06 2164 0.48 2.37 0.16 114 XM_B_Unsub2 2041 2.87 2.23 2.98 115 HELO_NODOT 1961 1.74 2.15 1.67 116 TR_LOTS_OF_MONEY3 1880 0.75 2.06 0.54 117 XM_UB60 1880 0.41 2.06 0.13 118 DATE_IN_PAST_06_12 1876 0.48 2.05 0.21 119 RCVD_IN_MSPIKE_H4 1870 7.16 2.05 8.02 120 HELO_NO_DOMAIN 1861 1.73 2.04 1.67 121 TR_XM_RelayPhish 1859 0.45 2.03 0.18 122 MIME_HTML_ONLY_MULTI 1828 2.75 2.00 2.87 123 T_XMDrugObfuBody_14 1808 1.62 1.98 1.56 124 DKIM_ADSP_CUSTOM_MED 1773 1.46 1.94 1.39 125 URI_PHP_REDIR 1764 0.33 1.93 0.06 126 T_XMDrugObfuBody_00 1758 0.98 1.92 0.83 127 XMDiploma_00 1756 1.50 1.92 1.43 128 MAILING_LIST_MULTI 1746 2.56 1.91 2.67 129 LongTLD 1736 0.43 1.90 0.19 130 XM_DK_Undo_01 1706 1.81 1.87 1.80 131 URI_HEX 1693 1.39 1.85 1.31 132 BAYES_20 1660 3.55 1.82 3.84 133 NML_ADSP_CUSTOM_MED 1598 1.14 1.75 1.04 134 XM_UB95 1597 0.27 1.75 0.02 135 TM2_M_A_HREF_HREF 1581 0.60 1.73 0.42 136 RELAYCOUNTRY_GB 1568 1.18 1.72 1.10 137 TR_Symld_Words 1538 1.68 1.68 1.68 138 TM2_M_VERY_LONG_WORD 1531 1.38 1.67 1.33 139 MISSING_HEADERS 1517 0.79 1.66 0.65 140 RCVD_IN_MSPIKE_L4 1513 0.29 1.66 0.06 141 XMSubMetaSxObfu_03 1499 0.72 1.64 0.57 142 XMStockSpam_06 1498 0.92 1.64 0.80 143 RELAYCOUNTRY_IN 1487 0.33 1.63 0.11 144 T_TooManySym_02 1443 2.05 1.58 2.13 145 XM_OfRef7 1435 0.33 1.57 0.13 146 FORGED_GMAIL_RCVD 1417 0.72 1.55 0.58 147 DATE_IN_PAST_12_24 1382 0.26 1.51 0.05 148 T_XMHurry_00 1379 0.74 1.51 0.61 149 T_Symld_Words_02 1370 0.70 1.50 0.57 150 HK_RANDOM_REPLYTO 1362 0.40 1.49 0.22 151 T_HTML_TAG_BALANCE_CENTER 1350 0.38 1.48 0.20 152 XMBrknScrpt_02 1350 1.14 1.48 1.09 153 XMBody_78 1340 0.67 1.47 0.54 154 TR_XM_DK_SendGrid 1300 3.69 1.42 4.07 155 XMGenDplmaNmb 1291 0.91 1.41 0.83 156 T_FILL_THIS_FORM_SHORT 1270 0.98 1.39 0.91 157 HDRS_MISSP 1255 0.26 1.37 0.07 158 TR_Sbj_FN_Bdy 1228 0.37 1.34 0.20 159 URG_BIZ 1215 0.26 1.33 0.08 160 XMSubEmpty 1202 0.41 1.31 0.26 161 XMSubNoVowel 1188 1.04 1.30 1.00 162 TR_Mismatch_TLD_01 1159 0.37 1.27 0.23 163 TR_Mismatch_TLD_02 1154 0.26 1.26 0.10 164 DIET_1 1140 0.50 1.25 0.38 165 URI_NO_WWW_INFO_CGI 1139 0.21 1.25 0.04 166 XMReplyNow 1102 0.30 1.21 0.15 167 SCRIPT_GIBBERISH 1080 0.17 1.18 0.01 168 XMSexyCombo_04 1069 0.39 1.17 0.26 169 XMPhish30 1057 0.67 1.16 0.58 170 XM_H_MailChimp 1050 0.36 1.15 0.23 171 FILL_THIS_FORM 1050 0.43 1.15 0.31 172 BAYES_00 1049 13.22 1.15 15.23 173 XM_H_PHPMailer 1034 0.66 1.13 0.59 174 RELAYCOUNTRY_NG_I 1022 0.16 1.12 0.00 175 XMSubMetaSSx_00 1016 0.33 1.11 0.19 176 T_TooManySym_03 1005 0.76 1.10 0.70 177 RCVD_IN_MSPIKE_ZBI 998 0.16 1.09 0.00 178 TR_MetaPhish_Combo_01 992 1.07 1.09 1.07 179 HTTPS_HTTP_MISMATCH 977 0.88 1.07 0.85 180 RELAYCOUNTRY_JP 971 0.20 1.06 0.06 181 BAYES_05 938 2.34 1.03 2.56 182 XM_H_PHPOS_M 936 0.32 1.02 0.21 183 RDNS_DYNAMIC 932 0.43 1.02 0.33 184 XMSlimDrugH 926 0.44 1.01 0.35 185 XMSubMetaI_00 912 0.78 1.00 0.74 186 REMOVE_BEFORE_LINK 907 0.45 0.99 0.36 187 URIBL_BLACK 907 0.16 0.99 0.03 188 XMLngstWrd_00 905 0.45 0.99 0.36 189 T_MONEY_PERCENT 898 0.39 0.98 0.29 190 TR_LOTS_OF_MONEY2 898 0.39 0.98 0.29 191 RCVD_IN_IADB_LISTED 886 4.33 0.97 4.90 192 XMBdyGiftCard01 882 1.03 0.96 1.04 193 XMMoneyMeta_00 868 0.72 0.95 0.68 194 XMPhish14 846 0.49 0.93 0.42 195 XM_HighProb1 842 0.14 0.92 0.01 196 XM_H_Long_From02 831 1.19 0.91 1.23 197 XM_XX_Yahoo 830 0.18 0.91 0.06 198 XM_PDF 820 3.83 0.90 4.32 199 XMPhish08 817 0.51 0.89 0.45 200 URIBL_DBL_SPAM 815 0.14 0.89 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 535791 98.00 97.45 98.09 2 HTML_MESSAGE 487334 89.91 94.00 89.22 3 RELAYCOUNTRY_US 450219 79.88 64.64 82.43 4 DKIM_SIGNED 415734 75.85 74.29 76.11 5 XM_DK_Pass 409128 74.37 71.16 74.90 6 XM_B_Unicode 387654 71.37 73.75 70.97 7 DKIM_VALID 381710 67.94 56.32 69.88 8 BAYES_50 289358 50.69 37.00 52.98 9 DKIM_VALID_AU 287130 50.95 41.26 52.57 10 XMListUnsubscribeExists 281837 53.33 63.67 51.60 11 XM_B_Unicode3 215346 39.39 39.19 39.43 12 T_TM2_M_HEADER_IN_MSG 162074 28.08 18.55 29.67 13 HTML_FONT_LOW_CONTRAST 150916 27.33 25.55 27.63 14 DKIM_VALID_EF 145357 26.75 27.59 26.61 15 RCVD_IN_MSPIKE_H2 135112 24.04 19.87 24.74 16 LOC_TINY_FONT_1 131996 25.02 30.14 24.17 17 RCVD_IN_MSPIKE_WL 126080 20.67 6.24 23.08 18 FVGT_m_MULTI_ODD 124773 23.16 25.05 22.84 19 XMSubLong 120554 22.89 27.81 22.07 20 MIME_HTML_ONLY 114246 23.41 38.34 20.92 21 T_KAM_HTML_FONT_INVALID 101971 19.17 22.18 18.67 22 BAYES_00 83214 13.22 1.15 15.23 23 RCVD_IN_MSPIKE_H3 76729 12.62 4.10 14.05 24 ALL_TRUSTED 73761 11.92 2.48 13.50 25 XM_Body_Dirty_Words 73268 14.31 19.68 13.41 26 XM_Multi_Part_URI 68313 12.79 14.46 12.51 27 XM_DK_Undo_02 61094 16.66 49.37 11.19 28 XM_B_Unsub 59744 10.91 10.75 10.94 29 TR_XM_DK_Bayes 52276 8.30 0.69 9.57 30 LotsOfNums_01 48168 8.74 8.27 8.82 31 TR_XM_DK_Bayes1 48132 7.59 0.30 8.81 32 XM_Evil_Numbers_Gen 47506 8.82 9.52 8.70 33 TooManyTo_001 45732 8.00 5.81 8.37 34 LOTS_OF_MONEY 44601 8.73 12.11 8.17 35 RCVD_IN_MSPIKE_H4 43793 7.16 2.05 8.02 36 TR_XM_DK_Bayes2 42797 6.75 0.25 7.84 37 XM_B_Phish_Phrases 41177 8.05 11.14 7.54 38 UNPARSEABLE_RELAY 40290 6.99 4.70 7.38 39 RCVD_IN_RP_SAFE 40027 6.36 0.54 7.33 40 BAYES_99 37971 11.59 39.30 6.95 41 HTML_IMAGE_RATIO_02 37446 7.53 11.54 6.86 42 RCVD_IN_RP_CERTIFIED 37113 5.87 0.33 6.79 43 XM_SendGrid 36877 6.33 3.82 6.75 44 XM_DKIMWhitelistDomains 35961 5.64 0.00 6.58 45 BAYES_60 35293 6.37 5.84 6.46 46 DKIM_INVALID 34024 7.91 17.97 6.23 47 IN_ZIMBRA_NJ_WHITELIST 33956 5.33 0.05 6.22 48 MIME_QP_LONG_LINE 33894 5.96 4.49 6.21 49 RELAYCOUNTRY_META 32686 10.06 34.40 5.98 50 XM_H_Long_From01 30917 5.78 6.52 5.66 51 BAYES_40 28904 4.90 2.52 5.29 52 HTML_IMAGE_RATIO_04 28858 5.36 5.82 5.28 53 BAYES_999 28665 9.13 32.35 5.25 54 BOTNET_IPINHOSTNAME 27415 6.77 17.21 5.02 55 RCVD_IN_IADB_LISTED 26747 4.33 0.97 4.90 56 T_TooManySym_01 26396 4.58 3.06 4.83 57 XMStrtUSub 25823 4.66 4.25 4.73 58 MPART_ALT_DIFF 24485 4.58 5.17 4.48 59 XM_PDF 23583 3.83 0.90 4.32 60 RCVD_IN_IADB_SPF 23343 3.78 0.86 4.27 61 BAYES_80 22803 4.60 7.16 4.17 62 TR_XM_DK_SendGrid 22231 3.69 1.42 4.07 63 HTML_IMAGE_RATIO_06 21945 3.99 3.82 4.02 64 BAYES_20 20997 3.55 1.82 3.84 65 RCVD_IN_IADB_SENDERID 20591 3.35 0.83 3.77 66 RCVD_IN_IADB_DK 20413 3.32 0.82 3.74 67 XMSexyCombo_05 20408 4.81 11.20 3.74 68 TM2_M_URI_OPT_OUT 19848 3.62 3.53 3.63 69 BOTNET 19786 7.85 33.14 3.62 70 TR_XM_PhishingBody 19260 4.07 7.31 3.53 71 NO_DNS_FOR_FROM 19163 4.92 13.34 3.51 72 T_REMOTE_IMAGE 18813 4.20 8.74 3.44 73 XM_UncommonTLD01 18569 5.23 16.18 3.40 74 XMSubMetaSx_00 18533 3.91 7.01 3.39 75 XMNumbers 18365 3.60 5.00 3.36 76 FROM_EXCESS_BASE64 17552 3.19 3.05 3.21 77 RCVD_IN_IADB_VOUCHED 16939 2.70 0.30 3.10 78 XM_B_Unsub2 16269 2.87 2.23 2.98 79 ANY_BOUNCE_MESSAGE 16131 2.61 0.55 2.95 80 BOUNCE_MESSAGE 16125 2.61 0.55 2.95 81 MIME_HTML_ONLY_MULTI 15699 2.75 2.00 2.87 82 HTML_IMAGE_RATIO_08 14850 2.69 2.54 2.72 83 MAILING_LIST_MULTI 14582 2.56 1.91 2.67 84 XM_H_Trusted_IP 14208 2.23 0.00 2.60 85 HTML_MIME_NO_HTML_TAG 14056 2.93 5.07 2.57 86 BAYES_05 13976 2.34 1.03 2.56 87 BAYES_95 13688 2.75 4.18 2.51 88 XM_B_COVIDMETA 13165 3.00 6.53 2.41 89 MIME_HTML_MOSTLY 12434 2.51 3.89 2.28 90 TooManyTo_002 11850 1.97 0.74 2.17 91 T_TooManySym_02 11608 2.05 1.58 2.13 92 KHOP_HELO_FCRDNS 11313 2.28 3.50 2.07 93 UNTRUSTED_Relay 11312 5.36 25.00 2.07 94 XM_B_Phish66 11266 2.41 4.48 2.06 95 XM_CamelCaseFrm001 11170 2.34 4.13 2.05 96 RCVD_IN_IADB_OPTIN 10740 1.73 0.30 1.97 97 XM_SPF_SoftFail 10580 2.63 6.74 1.94 98 XM_B_SpammyTLD 10207 2.19 4.11 1.87 99 XM_DK_Undo_01 9826 1.81 1.87 1.80 100 SUBJ_ALL_CAPS 9393 1.91 3.04 1.72 101 TR_Symld_Words 9184 1.68 1.68 1.68 102 HELO_NODOT 9148 1.74 2.15 1.67 103 HELO_NO_DOMAIN 9145 1.73 2.04 1.67 104 TVD_RCVD_IP 9035 1.47 0.35 1.65 105 T_XMDrugObfuBody_08 8890 1.88 3.39 1.63 106 RELAYCOUNTRY_CA 8765 2.45 7.49 1.60 107 T_XMDrugObfuBody_14 8526 1.62 1.98 1.56 108 TooManyTo_003 7953 1.33 0.58 1.46 109 XMDiploma_00 7799 1.50 1.92 1.43 110 DKIM_ADSP_CUSTOM_MED 7568 1.46 1.94 1.39 111 IN_HORDE_ADDRESS_BOOK 7471 1.18 0.03 1.37 112 INVALID_MSGID 7349 1.17 0.16 1.35 113 TM2_M_VERY_LONG_WORD 7257 1.38 1.67 1.33 114 XM_UB50 7227 2.11 6.80 1.32 115 URI_HEX 7150 1.39 1.85 1.31 116 XM_GoogleGroups 6896 1.15 0.49 1.26 117 XMCapTrack 6811 1.16 0.61 1.25 118 XM_H_Long_From02 6739 1.19 0.91 1.23 119 URI_TRY_3LD 6600 1.15 0.83 1.21 120 TO_MALFORMED 6502 1.02 0.01 1.19 121 TooManyTo_004 6202 1.05 0.52 1.14 122 RCVD_IN_BL_SPAMCOP_NET 6047 2.52 10.94 1.11 123 RELAYCOUNTRY_GB 5981 1.18 1.72 1.10 124 XMBrknScrpt_02 5942 1.14 1.48 1.09 125 XMHTML_After_End 5873 2.04 7.83 1.08 126 TR_MSPIKEBAYES00 5856 0.92 0.00 1.07 127 TR_MetaPhish_Combo_01 5826 1.07 1.09 1.07 128 USER_IN_DEF_DKIM_WL 5760 0.90 0.00 1.05 129 NML_ADSP_CUSTOM_MED 5684 1.14 1.75 1.04 130 XMBdyGiftCard01 5679 1.03 0.96 1.04 131 XM_OfRef6 5561 1.39 3.60 1.02 132 RCVD_IN_MSPIKE_H5 5558 0.89 0.09 1.02 133 XMSubNoVowel 5436 1.04 1.30 1.00 134 HTML_FONT_FACE_BAD 5351 0.92 0.56 0.98 135 TR_XM_COVIDMETA4 5342 1.87 7.22 0.98 136 XMGappySubj_01 5274 0.87 0.28 0.97 137 TooManyTo_005 5113 0.86 0.42 0.94 138 SpammyFromTLD_01 5060 1.78 6.86 0.93 139 T_FILL_THIS_FORM_SHORT 4987 0.98 1.39 0.91 140 XMSexyCombo_01 4793 1.17 2.89 0.88 141 HTTPS_HTTP_MISMATCH 4643 0.88 1.07 0.85 142 XM_ProductURIs 4634 0.85 0.86 0.85 143 FROM_GOV_DKIM_AU 4516 0.72 0.06 0.83 144 T_XMDrugObfuBody_00 4514 0.98 1.92 0.83 145 XMGenDplmaNmb 4508 0.91 1.41 0.83 146 XMStockSpam_06 4375 0.92 1.64 0.80 147 XMBody_17 4079 1.00 2.53 0.75 148 XMSubMetaI_00 4051 0.78 1.00 0.74 149 T_TooManySym_03 3814 0.76 1.10 0.70 150 T_OBFU_PDF_ATTACH 3744 0.61 0.17 0.69 151 XMMoneyMeta_00 3722 0.72 0.95 0.68 152 XM_DIRTYINTL 3663 1.25 4.74 0.67 153 XM_SPF_Unknown 3660 0.68 0.76 0.67 154 MISSING_HEADERS 3528 0.79 1.66 0.65 155 XMNoVowels 3500 0.67 0.83 0.64 156 RCVD_IN_MSPIKE_BL 3353 2.56 14.22 0.61 157 T_XMHurry_00 3342 0.74 1.51 0.61 158 XM_ShortIntro_01 3214 0.63 0.87 0.59 159 XM_H_PHPMailer 3199 0.66 1.13 0.59 160 XMPhish30 3189 0.67 1.16 0.58 161 FORGED_GMAIL_RCVD 3151 0.72 1.55 0.58 162 XMSubMetaSxObfu_03 3118 0.72 1.64 0.57 163 T_Symld_Words_02 3097 0.70 1.50 0.57 164 TR_XM_PHPDW 3016 0.88 2.84 0.55 165 HTML_TAG_BALANCE_BODY 3008 0.55 0.53 0.55 166 T_PDS_OTHER_BAD_TLD 3002 0.89 2.95 0.55 167 TR_XM_COVIDMETA1 2972 0.84 2.64 0.54 168 XMBody_78 2948 0.67 1.47 0.54 169 TR_LOTS_OF_MONEY3 2931 0.75 2.06 0.54 170 TR_XM_FormFill2 2920 0.86 2.80 0.53 171 TR_XM_PHPForged 2919 0.86 2.83 0.53 172 XM_H_PHPOS 2883 0.85 2.79 0.53 173 XMHTMLBadTable_001 2768 0.52 0.58 0.51 174 RCVD_IN_SORBS_DUL 2753 0.48 0.31 0.50 175 RELAYCOUNTRY_AU 2741 0.54 0.74 0.50 176 HTML_IMAGE_ONLY_20 2619 0.46 0.36 0.48 177 NUMERIC_HTTP_ADDR 2592 0.49 0.58 0.47 178 HTML_IMAGE_ONLY_28 2533 0.45 0.39 0.46 179 XMPhish08 2465 0.51 0.89 0.45 180 URI_NOVOWEL 2404 0.48 0.72 0.44 181 XM_B_REG_HTML 2403 0.41 0.26 0.44 182 XMDateMe_00 2401 0.43 0.40 0.44 183 RELAYCOUNTRY_NL 2395 0.49 0.78 0.44 184 FROM_GOV_SPOOF 2388 0.43 0.38 0.44 185 XM_B_COPY_HTML 2372 0.44 0.48 0.43 186 SHORT_HELO_AND_INLINE_IMAGE 2309 0.37 0.08 0.42 187 XMPhish14 2279 0.49 0.93 0.42 188 TM2_M_A_HREF_HREF 2270 0.60 1.73 0.42 189 RCVD_IN_MSPIKE_L3 2254 1.57 8.47 0.41 190 XMBody_95 2250 0.36 0.08 0.41 191 RELAYCOUNTRY_DE 2219 1.35 6.98 0.41 192 TR_BOTNET_NEGATE 2209 0.38 0.22 0.40 193 HTML_IMAGE_ONLY_32 2209 0.37 0.20 0.40 194 TM2_M_BODY_EMPTY 2200 0.36 0.11 0.40 195 PLING_QUERY 2168 0.38 0.30 0.40 196 RELAYCOUNTRY_FR 2104 1.19 6.01 0.39 197 MPART_ALT_DIFF_COUNT 2083 0.43 0.69 0.38 198 DIET_1 2054 0.50 1.25 0.38 199 REMOVE_BEFORE_LINK 1963 0.45 0.99 0.36 200 TR_XM_COVIDMETA5 1961 0.31 0.03 0.36 ----------------------------------------------------------------------