Email: 687081 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 1.90 sec Spam: 85302 Autolearn: 0 AvgScore: 11.63 AvgScanTime: 4.00 sec Ham: 601779 Autolearn: 0 AvgScore: -3.71 AvgScanTime: 1.60 sec Time Spent Running SA: 361.99 hours Time Spent Processing Spam: 94.80 hours Time Spent Processing Ham: 267.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 82930 98.14 97.22 98.27 2 HTML_MESSAGE 79560 90.56 93.27 90.18 3 DKIM_SIGNED 67471 70.65 79.10 69.45 4 XM_DK_Pass 64649 69.22 75.79 68.29 5 XM_B_Unicode 63154 72.75 74.04 72.56 6 RELAYCOUNTRY_US 62153 82.10 72.86 83.41 7 XMListUnsubscribeExists 57032 49.71 66.86 47.28 8 DKIM_VALID 53485 63.97 62.70 64.15 9 XM_DK_Undo_02 45311 15.24 53.12 9.87 10 DKIM_VALID_AU 38861 48.04 45.56 48.39 11 BAYES_99 33265 10.30 39.00 6.23 12 XM_B_Unicode3 32872 42.09 38.54 42.59 13 BAYES_50 31369 48.03 36.77 49.62 14 MIME_HTML_ONLY 29245 24.44 34.28 23.05 15 BAYES_999 27189 8.20 31.87 4.85 16 LOC_TINY_FONT_1 26961 22.69 31.61 21.43 17 DKIM_VALID_EF 23971 24.96 28.10 24.51 18 HTML_FONT_LOW_CONTRAST 23947 26.28 28.07 26.03 19 RELAYCOUNTRY_META 23892 8.28 28.01 5.48 20 FVGT_m_MULTI_ODD 23641 21.50 27.71 20.62 21 BOTNET 23556 5.87 27.61 2.78 22 XMSubLong 23125 21.96 27.11 21.24 23 T_KAM_HTML_FONT_INVALID 21376 17.91 25.06 16.90 24 T_TM2_M_HEADER_IN_MSG 18140 25.47 21.27 26.07 25 RCVD_IN_MSPIKE_H2 18047 22.29 21.16 22.45 26 XM_Body_Dirty_Words 16603 13.32 19.46 12.45 27 BOTNET_IPINHOSTNAME 15831 6.34 18.56 4.61 28 XM_UncommonTLD01 15825 5.01 18.55 3.09 29 XM_Multi_Part_URI 15478 11.78 18.14 10.88 30 UNTRUSTED_Relay 15043 3.79 17.63 1.83 31 DKIM_INVALID 13986 6.67 16.40 5.30 32 LOTS_OF_MONEY 12668 9.23 14.85 8.43 33 XM_B_Unsub 12061 10.56 14.14 10.06 34 NO_DNS_FOR_FROM 10737 4.08 12.59 2.87 35 XM_B_Phish_Phrases 9938 7.51 11.65 6.92 36 XM_Evil_Numbers_Gen 9048 8.80 10.61 8.54 37 HTML_IMAGE_RATIO_02 8998 6.76 10.55 6.23 38 XMSexyCombo_05 8471 4.47 9.93 3.70 39 LotsOfNums_01 8216 8.03 9.63 7.80 40 RCVD_IN_MSPIKE_WL 8010 19.59 9.39 21.04 41 RCVD_IN_MSPIKE_BL 7792 1.63 9.13 0.57 42 RELAYCOUNTRY_CA 6877 2.52 8.06 1.74 43 TR_XM_PhishingBody 6502 3.79 7.62 3.25 44 XM_B_COVIDMETA 6492 2.64 7.61 1.93 45 TR_XM_COVIDMETA4 6250 1.69 7.33 0.89 46 BAYES_80 6144 4.19 7.20 3.76 47 XM_H_Long_From01 6077 5.27 7.12 5.01 48 XM_SPF_SoftFail 5743 2.32 6.73 1.70 49 RCVD_IN_BL_SPAMCOP_NET 5685 1.98 6.66 1.32 50 XMSubMetaSx_00 5562 3.64 6.52 3.23 51 SpammyFromTLD_01 5499 1.60 6.45 0.91 52 XM_UB50 5449 1.74 6.39 1.08 53 BAYES_60 5238 5.86 6.14 5.82 54 RCVD_IN_RP_RNBL 4994 0.79 5.85 0.08 55 XMNumbers 4896 3.32 5.74 2.98 56 RCVD_IN_MSPIKE_L3 4851 1.02 5.69 0.36 57 TooManyTo_001 4806 7.34 5.63 7.58 58 XM_CamelCaseFrm001 4658 2.36 5.46 1.92 59 XM_UB99 4528 0.66 5.31 0.00 60 MPART_ALT_DIFF 4464 8.04 5.23 8.44 61 URIBL_SBL_A 4424 0.81 5.19 0.19 62 RCVD_IN_MSPIKE_H3 4346 11.65 5.09 12.58 63 UNPARSEABLE_RELAY 4291 6.54 5.03 6.75 64 XMBody_17 4290 1.23 5.03 0.69 65 KHOP_HELO_FCRDNS 4216 2.17 4.94 1.78 66 XM_B_Unsub2 4175 3.14 4.89 2.89 67 HTML_IMAGE_RATIO_04 4081 11.79 4.78 12.78 68 TR_XM_INV_DKIM 4057 0.77 4.76 0.20 69 XM_OfRef6 3882 1.87 4.55 1.49 70 XM_DIRTYINTL 3858 1.05 4.52 0.55 71 TR_XM_MaxBayes 3849 0.60 4.51 0.04 72 HTML_MIME_NO_HTML_TAG 3823 2.64 4.48 2.38 73 RELAYCOUNTRY_FR 3771 0.81 4.42 0.30 74 XM_B_Phish66 3764 2.24 4.41 1.94 75 RCVD_IN_MSPIKE_H4 3588 7.12 4.21 7.53 76 MIME_HTML_MOSTLY 3573 2.65 4.19 2.43 77 XM_UB999 3568 0.52 4.18 0.00 78 T_REMOTE_IMAGE 3559 3.42 4.17 3.32 79 XM_URI_RBL 3500 0.71 4.10 0.23 80 XMStrtUSub 3464 8.62 4.06 9.27 81 XM_SendGrid 3463 5.65 4.06 5.87 82 TR_LOTS_OF_MONEY3 3458 1.15 4.05 0.74 83 HTML_IMAGE_RATIO_06 3442 5.01 4.04 5.14 84 BAYES_95 3389 2.40 3.97 2.18 85 T_XMDrugObfuBody_08 3351 1.84 3.93 1.54 86 FROM_EXCESS_BASE64 3275 2.75 3.84 2.60 87 XM_B_SpammyTLD 3169 2.23 3.72 2.02 88 TR_XM_MaxSPIKE 3082 0.47 3.61 0.02 89 BOTNET_NORDNS 3067 0.46 3.60 0.02 90 TM2_M_URI_OPT_OUT 3018 3.19 3.54 3.15 91 RCVD_IN_PSBL 2942 0.49 3.45 0.07 92 MIME_QP_LONG_LINE 2905 5.24 3.41 5.50 93 HTML_IMAGE_RATIO_08 2830 2.45 3.32 2.33 94 T_PDS_OTHER_BAD_TLD 2708 0.83 3.17 0.50 95 SpammyFromTLD_02 2642 0.73 3.10 0.40 96 FROM_SUSPICIOUS_NTLD 2589 0.46 3.04 0.10 97 TR_XM_PHPForged 2533 1.05 2.97 0.77 98 TR_XM_PHPDW 2529 1.07 2.96 0.80 99 TR_XM_COVIDMETA1 2523 0.96 2.96 0.67 100 FROM_SUSPICIOUS_NTLD_FP 2521 0.45 2.96 0.09 101 XMBrknScrpt_02 2520 1.07 2.95 0.80 102 T_TooManySym_01 2503 4.00 2.93 4.15 103 TR_XM_FormFill2 2485 1.04 2.91 0.77 104 BODY_URI_ONLY 2476 0.40 2.90 0.05 105 XM_H_PHPOS 2475 1.03 2.90 0.77 106 TR_Mismatch_TLD_02 2413 0.43 2.83 0.09 107 BAYES_40 2266 5.52 2.66 5.93 108 URI_HEX 2222 1.71 2.60 1.58 109 XMDiploma_00 2111 1.53 2.47 1.40 110 T_XMDrugObfuBody_14 2093 1.50 2.45 1.36 111 T_HTML_TAG_BALANCE_CENTER 2083 0.48 2.44 0.20 112 RCVD_IN_MSPIKE_L5 2018 0.42 2.37 0.14 113 MIME_HTML_ONLY_MULTI 1878 5.93 2.20 6.46 114 HDRS_MISSP 1873 0.33 2.20 0.06 115 URI_PHP_REDIR 1822 0.31 2.14 0.05 116 XMSexyCombo_01 1819 0.77 2.13 0.58 117 DKIM_ADSP_CUSTOM_MED 1817 1.22 2.13 1.10 118 LongTLD 1768 0.43 2.07 0.20 119 BAYES_20 1695 4.70 1.99 5.08 120 NML_ADSP_CUSTOM_MED 1688 0.98 1.98 0.84 121 TR_XM_RelayPhish 1688 0.37 1.98 0.14 122 DATE_IN_PAST_03_06 1660 0.35 1.95 0.12 123 FORGED_GMAIL_RCVD 1621 0.64 1.90 0.46 124 XM_UB60 1621 0.33 1.90 0.10 125 XM_UB80 1606 0.27 1.88 0.04 126 MAILING_LIST_MULTI 1604 2.27 1.88 2.32 127 ALL_TRUSTED 1587 11.33 1.86 12.67 128 SUBJ_ALL_CAPS 1578 1.67 1.85 1.65 129 DKIM_ADSP_NXDOMAIN 1567 0.61 1.84 0.43 130 RELAYCOUNTRY_DE 1566 0.66 1.84 0.50 131 HTML_IMAGE_ONLY_16 1559 0.46 1.83 0.26 132 TR_Symld_Words 1532 1.47 1.80 1.42 133 T_XMDrugObfuBody_00 1530 0.85 1.79 0.72 134 XM_OfRef7 1492 0.45 1.75 0.26 135 XM_Nigeria_01 1475 0.29 1.73 0.09 136 XMHTML_After_End 1457 0.99 1.71 0.88 137 TR_MetaPhish_Combo_01 1450 0.89 1.70 0.77 138 T_Symld_Words_02 1442 0.71 1.69 0.57 139 BILLION_DOLLARS 1439 0.24 1.69 0.04 140 DATE_IN_PAST_06_12 1420 0.34 1.66 0.15 141 XMGenDplmaNmb 1411 0.97 1.65 0.87 142 TM2_M_VERY_LONG_WORD 1392 1.20 1.63 1.14 143 T_XMHurry_00 1368 0.63 1.60 0.49 144 T_TooManySym_02 1318 1.76 1.55 1.79 145 RELAYCOUNTRY_IN 1304 0.27 1.53 0.09 146 XMSubNoVowel 1266 3.36 1.48 3.62 147 TR_Mismatch_TLD_01 1240 0.38 1.45 0.23 148 MPART_ALT_DIFF_COUNT 1226 0.52 1.44 0.40 149 XMOemUri 1189 0.35 1.39 0.20 150 TR_XM_DK_SendGrid 1185 3.26 1.39 3.52 151 URI_NO_WWW_INFO_CGI 1170 0.19 1.37 0.02 152 DEAR_FRIEND 1164 0.25 1.36 0.09 153 RELAYCOUNTRY_GB 1140 1.10 1.34 1.07 154 XM_H_PHPMailer 1138 0.87 1.33 0.80 155 T_FILL_THIS_FORM_SHORT 1115 0.87 1.31 0.81 156 XMSlimDrugH 1102 0.44 1.29 0.31 157 XMPhish08 1083 0.55 1.27 0.44 158 XMBody_78 1078 0.54 1.26 0.44 159 HK_RANDOM_REPLYTO 1059 0.33 1.24 0.20 160 XMMoneyMeta_00 1057 0.77 1.24 0.70 161 XM_ShortIntro_01 1050 0.58 1.23 0.48 162 XM_UB95 1041 0.16 1.22 0.01 163 URIBL_BLACK 1024 0.17 1.20 0.03 164 BAYES_00 1012 15.58 1.19 17.61 165 XM_HighProb1 1002 0.15 1.17 0.01 166 TR_LOTS_OF_MONEY2 1001 0.53 1.17 0.44 167 T_MONEY_PERCENT 1001 0.53 1.17 0.44 168 XM_H_PHPOS_M 999 0.56 1.17 0.47 169 RELAYCOUNTRY_CN 991 0.20 1.16 0.07 170 XMPhish14 964 0.52 1.13 0.43 171 XMStockSpam_06 960 0.91 1.13 0.88 172 XM_DK_Undo_01 959 1.48 1.12 1.53 173 XMSexyCombo_04 950 0.27 1.11 0.15 174 XMNoVowels 946 0.63 1.11 0.56 175 FILL_THIS_FORM 941 0.46 1.10 0.37 176 TR_XM_COVIDMETA2 937 0.26 1.10 0.15 177 T_TooManySym_03 933 0.61 1.09 0.54 178 RELAYCOUNTRY_JP 929 0.17 1.09 0.04 179 URI_TRY_3LD 929 1.28 1.09 1.30 180 BAYES_05 924 3.43 1.08 3.76 181 URIBL_DBL_SPAM 900 0.15 1.06 0.02 182 HELO_NODOT 894 1.58 1.05 1.66 183 TR_XM_COVIDMETA3 893 0.16 1.05 0.03 184 DATE_IN_PAST_12_24 891 0.16 1.04 0.04 185 HELO_NO_DOMAIN 885 1.58 1.04 1.66 186 RCVD_IN_IADB_LISTED 860 3.89 1.01 4.30 187 XM_B_SEO 860 0.29 1.01 0.19 188 XMSubMetaSxObfu_03 859 0.45 1.01 0.37 189 XM_PDF 854 3.66 1.00 4.03 190 DIET_1 854 0.59 1.00 0.53 191 XM_H_MailChimp 849 0.29 1.00 0.19 192 XMReplyNow 843 0.23 0.99 0.12 193 XM_ProductURIs 819 0.57 0.96 0.52 194 HTML_SHORT_LINK_IMG_2 816 0.15 0.96 0.03 195 XMPhish30 808 0.49 0.95 0.42 196 RDNS_DYNAMIC 807 0.38 0.95 0.30 197 RCVD_IN_IADB_SPF 772 3.42 0.91 3.78 198 RCVD_IN_IADB_DK 754 3.00 0.88 3.29 199 RELAYCOUNTRY_IT 751 0.16 0.88 0.05 200 RCVD_IN_IADB_SENDERID 747 3.00 0.88 3.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 591358 98.14 97.22 98.27 2 HTML_MESSAGE 542669 90.56 93.27 90.18 3 RELAYCOUNTRY_US 501970 82.10 72.86 83.41 4 XM_B_Unicode 436668 72.75 74.04 72.56 5 DKIM_SIGNED 417929 70.65 79.10 69.45 6 XM_DK_Pass 410944 69.22 75.79 68.29 7 DKIM_VALID 386054 63.97 62.70 64.15 8 BAYES_50 298620 48.03 36.77 49.62 9 DKIM_VALID_AU 291183 48.04 45.56 48.39 10 XMListUnsubscribeExists 284509 49.71 66.86 47.28 11 XM_B_Unicode3 256294 42.09 38.54 42.59 12 T_TM2_M_HEADER_IN_MSG 156867 25.47 21.27 26.07 13 HTML_FONT_LOW_CONTRAST 156616 26.28 28.07 26.03 14 DKIM_VALID_EF 147500 24.96 28.10 24.51 15 MIME_HTML_ONLY 138707 24.44 34.28 23.05 16 RCVD_IN_MSPIKE_H2 135129 22.29 21.16 22.45 17 LOC_TINY_FONT_1 128966 22.69 31.61 21.43 18 XMSubLong 127790 21.96 27.11 21.24 19 RCVD_IN_MSPIKE_WL 126604 19.59 9.39 21.04 20 FVGT_m_MULTI_ODD 124100 21.50 27.71 20.62 21 BAYES_00 106002 15.58 1.19 17.61 22 T_KAM_HTML_FONT_INVALID 101682 17.91 25.06 16.90 23 HTML_IMAGE_RATIO_04 76909 11.79 4.78 12.78 24 ALL_TRUSTED 76225 11.33 1.86 12.67 25 RCVD_IN_MSPIKE_H3 75718 11.65 5.09 12.58 26 XM_Body_Dirty_Words 74904 13.32 19.46 12.45 27 XM_H_Trusted_IP 65517 9.54 0.00 10.89 28 XM_Multi_Part_URI 65456 11.78 18.14 10.88 29 HTML_FONT_FACE_BAD 64432 9.45 0.60 10.71 30 XM_B_Unsub 60515 10.56 14.14 10.06 31 XM_DK_Undo_02 59391 15.24 53.12 9.87 32 XMStrtUSub 55769 8.62 4.06 9.27 33 XM_Evil_Numbers_Gen 51382 8.80 10.61 8.54 34 MPART_ALT_DIFF 50800 8.04 5.23 8.44 35 LOTS_OF_MONEY 50743 9.23 14.85 8.43 36 TR_XM_DK_Bayes 48729 7.18 0.71 8.10 37 LotsOfNums_01 46953 8.03 9.63 7.80 38 TooManyTo_001 45598 7.34 5.63 7.58 39 RCVD_IN_MSPIKE_H4 45331 7.12 4.21 7.53 40 TR_XM_DK_Bayes1 44918 6.59 0.46 7.46 41 XM_B_Phish_Phrases 41649 7.51 11.65 6.92 42 UNPARSEABLE_RELAY 40644 6.54 5.03 6.75 43 TR_XM_DK_Bayes2 39510 5.81 0.44 6.57 44 RCVD_IN_RP_SAFE 39499 5.81 0.46 6.56 45 MIME_HTML_ONLY_MULTI 38853 5.93 2.20 6.46 46 BAYES_99 37486 10.30 39.00 6.23 47 HTML_IMAGE_RATIO_02 37469 6.76 10.55 6.23 48 IN_ZIMBRA_NJ_WHITELIST 36873 5.37 0.02 6.13 49 RCVD_IN_RP_CERTIFIED 36703 5.38 0.28 6.10 50 XM_DKIMWhitelistDomains 36261 5.28 0.00 6.03 51 BAYES_40 35679 5.52 2.66 5.93 52 XM_SendGrid 35341 5.65 4.06 5.87 53 BAYES_60 35045 5.86 6.14 5.82 54 MIME_QP_LONG_LINE 33102 5.24 3.41 5.50 55 RELAYCOUNTRY_META 32996 8.28 28.01 5.48 56 DKIM_INVALID 31875 6.67 16.40 5.30 57 HTML_IMAGE_RATIO_06 30961 5.01 4.04 5.14 58 BAYES_20 30565 4.70 1.99 5.08 59 XM_H_Long_From01 30154 5.27 7.12 5.01 60 BAYES_999 29170 8.20 31.87 4.85 61 BOTNET_IPINHOSTNAME 27735 6.34 18.56 4.61 62 RCVD_IN_IADB_LISTED 25882 3.89 1.01 4.30 63 T_TooManySym_01 24969 4.00 2.93 4.15 64 XM_PDF 24276 3.66 1.00 4.03 65 RCVD_IN_IADB_SPF 22720 3.42 0.91 3.78 66 BAYES_05 22654 3.43 1.08 3.76 67 BAYES_80 22619 4.19 7.20 3.76 68 XMSexyCombo_05 22246 4.47 9.93 3.70 69 XMSubNoVowel 21812 3.36 1.48 3.62 70 TR_XM_DK_SendGrid 21184 3.26 1.39 3.52 71 T_REMOTE_IMAGE 19956 3.42 4.17 3.32 72 RCVD_IN_IADB_SENDERID 19872 3.00 0.88 3.30 73 RCVD_IN_IADB_DK 19825 3.00 0.88 3.29 74 TR_XM_PhishingBody 19538 3.79 7.62 3.25 75 XMSubMetaSx_00 19418 3.64 6.52 3.23 76 TM2_M_URI_OPT_OUT 18934 3.19 3.54 3.15 77 ANY_BOUNCE_MESSAGE 18677 2.81 0.75 3.10 78 BOUNCE_MESSAGE 18675 2.81 0.75 3.10 79 XM_UncommonTLD01 18621 5.01 18.55 3.09 80 XMNumbers 17936 3.32 5.74 2.98 81 XM_B_Unsub2 17374 3.14 4.89 2.89 82 NO_DNS_FOR_FROM 17291 4.08 12.59 2.87 83 BOTNET 16746 5.87 27.61 2.78 84 RCVD_IN_IADB_VOUCHED 15929 2.36 0.32 2.65 85 FROM_EXCESS_BASE64 15647 2.75 3.84 2.60 86 MIME_HTML_MOSTLY 14621 2.65 4.19 2.43 87 HTML_MIME_NO_HTML_TAG 14304 2.64 4.48 2.38 88 HTML_IMAGE_RATIO_08 13994 2.45 3.32 2.33 89 MAILING_LIST_MULTI 13968 2.27 1.88 2.32 90 BAYES_95 13108 2.40 3.97 2.18 91 XM_B_SpammyTLD 12162 2.23 3.72 2.02 92 XM_B_Phish66 11645 2.24 4.41 1.94 93 XM_B_COVIDMETA 11641 2.64 7.61 1.93 94 XM_CamelCaseFrm001 11575 2.36 5.46 1.92 95 TooManyTo_002 11524 1.78 0.85 1.91 96 UNTRUSTED_Relay 11005 3.79 17.63 1.83 97 T_TooManySym_02 10747 1.76 1.55 1.79 98 KHOP_HELO_FCRDNS 10700 2.17 4.94 1.78 99 RELAYCOUNTRY_CA 10465 2.52 8.06 1.74 100 XM_SPF_SoftFail 10212 2.32 6.73 1.70 101 HELO_NODOT 9985 1.58 1.05 1.66 102 HELO_NO_DOMAIN 9984 1.58 1.04 1.66 103 SUBJ_ALL_CAPS 9909 1.67 1.85 1.65 104 RCVD_IN_IADB_OPTIN 9682 1.44 0.28 1.61 105 URI_HEX 9521 1.71 2.60 1.58 106 TVD_RCVD_IP 9286 1.40 0.36 1.54 107 T_XMDrugObfuBody_08 9274 1.84 3.93 1.54 108 XM_DK_Undo_01 9183 1.48 1.12 1.53 109 XM_OfRef6 8970 1.87 4.55 1.49 110 TR_Symld_Words 8570 1.47 1.80 1.42 111 XMDiploma_00 8432 1.53 2.47 1.40 112 T_XMDrugObfuBody_14 8181 1.50 2.45 1.36 113 XMSubLongNoVowel 7946 1.21 0.40 1.32 114 RCVD_IN_BL_SPAMCOP_NET 7924 1.98 6.66 1.32 115 XMSubGarbage 7913 1.18 0.24 1.31 116 URI_TRY_3LD 7846 1.28 1.09 1.30 117 TooManyTo_003 7617 1.19 0.67 1.27 118 IN_HORDE_ADDRESS_BOOK 7544 1.10 0.03 1.25 119 XM_GoogleGroups 7391 1.15 0.57 1.23 120 INVALID_MSGID 7368 1.10 0.25 1.22 121 XM_H_Long_From02 7121 1.13 0.72 1.18 122 TM2_M_VERY_LONG_WORD 6866 1.20 1.63 1.14 123 DKIM_ADSP_CUSTOM_MED 6598 1.22 2.13 1.10 124 XM_UB50 6528 1.74 6.39 1.08 125 XMCapTrack 6526 1.01 0.45 1.08 126 TO_MALFORMED 6494 0.95 0.01 1.08 127 RELAYCOUNTRY_GB 6430 1.10 1.34 1.07 128 XMGappySubj_01 5978 0.90 0.21 0.99 129 TooManyTo_004 5649 0.89 0.58 0.94 130 RCVD_IN_MSPIKE_H5 5555 0.82 0.09 0.92 131 SpammyFromTLD_01 5490 1.60 6.45 0.91 132 TR_XM_COVIDMETA4 5378 1.69 7.33 0.89 133 XM_E_Blogspot 5344 0.79 0.12 0.89 134 XMHTML_After_End 5315 0.99 1.71 0.88 135 XMStockSpam_06 5268 0.91 1.13 0.88 136 XMGenDplmaNmb 5261 0.97 1.65 0.87 137 XMBdyGiftCard01 5083 0.82 0.68 0.84 138 NML_ADSP_CUSTOM_MED 5036 0.98 1.98 0.84 139 USER_IN_DEF_DKIM_WL 5019 0.73 0.00 0.83 140 T_FILL_THIS_FORM_SHORT 4895 0.87 1.31 0.81 141 XM_H_PHPMailer 4830 0.87 1.33 0.80 142 XMBrknScrpt_02 4825 1.07 2.95 0.80 143 TR_XM_PHPDW 4800 1.07 2.96 0.80 144 TR_XM_FormFill2 4662 1.04 2.91 0.77 145 TR_XM_PHPForged 4661 1.05 2.97 0.77 146 TR_MetaPhish_Combo_01 4636 0.89 1.70 0.77 147 XM_H_PHPOS 4630 1.03 2.90 0.77 148 TooManyTo_005 4559 0.72 0.42 0.76 149 TR_LOTS_OF_MONEY3 4448 1.15 4.05 0.74 150 TR_MSPIKEBAYES00 4433 0.65 0.01 0.74 151 T_XMDrugObfuBody_00 4340 0.85 1.79 0.72 152 XMMoneyMeta_00 4226 0.77 1.24 0.70 153 XMBody_17 4127 1.23 5.03 0.69 154 TR_XM_COVIDMETA1 4051 0.96 2.96 0.67 155 HTTPS_HTTP_MISMATCH 3853 0.65 0.73 0.64 156 XM_SPF_Unknown 3735 0.62 0.63 0.62 157 MISSING_HEADERS 3696 0.61 0.61 0.61 158 T_OBFU_PDF_ATTACH 3578 0.55 0.21 0.59 159 TM2_M_A_HREF_HREF 3483 0.58 0.63 0.58 160 XMSexyCombo_01 3477 0.77 2.13 0.58 161 RCVD_IN_MSPIKE_BL 3438 1.63 9.13 0.57 162 T_Symld_Words_02 3417 0.71 1.69 0.57 163 XMNoVowels 3374 0.63 1.11 0.56 164 XM_DIRTYINTL 3336 1.05 4.52 0.55 165 T_TooManySym_03 3277 0.61 1.09 0.54 166 FROM_GOV_DKIM_AU 3202 0.47 0.07 0.53 167 DIET_1 3177 0.59 1.00 0.53 168 XM_ProductURIs 3119 0.57 0.96 0.52 169 RELAYCOUNTRY_DE 2998 0.66 1.84 0.50 170 T_PDS_OTHER_BAD_TLD 2983 0.83 3.17 0.50 171 T_XMHurry_00 2957 0.63 1.60 0.49 172 XM_ShortIntro_01 2907 0.58 1.23 0.48 173 HTML_IMAGE_ONLY_20 2818 0.51 0.79 0.47 174 XM_H_PHPOS_M 2818 0.56 1.17 0.47 175 FORGED_GMAIL_RCVD 2772 0.64 1.90 0.46 176 XMSubMetaI_00 2751 0.51 0.85 0.46 177 RCVD_IN_SORBS_DUL 2738 0.43 0.26 0.45 178 XMPhish08 2668 0.55 1.27 0.44 179 XMBody_78 2647 0.54 1.26 0.44 180 T_MONEY_PERCENT 2642 0.53 1.17 0.44 181 TR_LOTS_OF_MONEY2 2642 0.53 1.17 0.44 182 XMPhish14 2599 0.52 1.13 0.43 183 DKIM_ADSP_NXDOMAIN 2599 0.61 1.84 0.43 184 HTML_TAG_BALANCE_BODY 2585 0.45 0.58 0.43 185 HTML_IMAGE_ONLY_28 2568 0.46 0.69 0.43 186 XMPhish30 2549 0.49 0.95 0.42 187 XMHTMLBadTable_001 2525 0.43 0.52 0.42 188 HTML_OBFUSCATE_05_10 2436 0.38 0.20 0.40 189 SHORT_HELO_AND_INLINE_IMAGE 2420 0.36 0.10 0.40 190 SpammyFromTLD_02 2399 0.73 3.10 0.40 191 MPART_ALT_DIFF_COUNT 2380 0.52 1.44 0.40 192 XM_B_COPY_HTML 2342 0.41 0.58 0.39 193 TM2_M_BODY_EMPTY 2338 0.36 0.13 0.39 194 RELAYCOUNTRY_AU 2307 0.41 0.57 0.38 195 FILL_THIS_FORM 2232 0.46 1.10 0.37 196 XMSubMetaSxObfu_03 2231 0.45 1.01 0.37 197 URI_NOVOWEL 2214 0.42 0.82 0.37 198 FROM_GOV_SPOOF 2206 0.35 0.25 0.37 199 XMRcvdHeader_15 2189 0.32 0.00 0.36 200 RCVD_IN_MSPIKE_L3 2164 1.02 5.69 0.36 ----------------------------------------------------------------------