Email: 652936 Autolearn: 0 AvgScore: 0.12 AvgScanTime: 1.93 sec Spam: 94806 Autolearn: 0 AvgScore: 11.91 AvgScanTime: 3.78 sec Ham: 558130 Autolearn: 0 AvgScore: -1.88 AvgScanTime: 1.61 sec Time Spent Running SA: 349.15 hours Time Spent Processing Spam: 99.59 hours Time Spent Processing Ham: 249.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 92132 97.89 97.18 98.01 2 HTML_MESSAGE 89411 90.58 94.31 89.94 3 DKIM_SIGNED 74504 77.63 78.59 77.47 4 XM_DK_Pass 70946 76.00 74.83 76.19 5 XM_B_Unicode 67405 71.68 71.10 71.78 6 RELAYCOUNTRY_US 67360 81.60 71.05 83.40 7 XMListUnsubscribeExists 65737 55.64 69.34 53.31 8 DKIM_VALID 59097 70.46 62.33 71.84 9 XM_DK_Undo_02 50477 17.92 53.24 11.92 10 DKIM_VALID_AU 44005 52.71 46.42 53.77 11 BAYES_99 38052 12.42 40.14 7.72 12 MIME_HTML_ONLY 36970 23.87 39.00 21.30 13 XM_B_Unicode3 34884 40.58 36.80 41.22 14 BAYES_50 32757 51.33 34.55 54.18 15 BAYES_999 31189 10.00 32.90 6.11 16 LOC_TINY_FONT_1 30985 26.00 32.68 24.87 17 DKIM_VALID_EF 29475 27.65 31.09 27.07 18 RELAYCOUNTRY_META 29204 9.48 30.80 5.85 19 BOTNET 25705 6.70 27.11 3.23 20 T_KAM_HTML_FONT_INVALID 24849 20.30 26.21 19.29 21 FVGT_m_MULTI_ODD 24094 23.64 25.41 23.34 22 HTML_FONT_LOW_CONTRAST 24013 27.60 25.33 27.99 23 XMSubLong 22253 22.13 23.47 21.90 24 RCVD_IN_MSPIKE_H2 20990 25.03 22.14 25.53 25 XM_UncommonTLD01 20106 5.96 21.21 3.38 26 UNTRUSTED_Relay 18431 4.45 19.44 1.90 27 T_TM2_M_HEADER_IN_MSG 18386 27.11 19.39 28.42 28 XM_Body_Dirty_Words 17478 14.51 18.44 13.84 29 BOTNET_IPINHOSTNAME 16156 6.94 17.04 5.23 30 DKIM_INVALID 15407 7.17 16.25 5.63 31 LOTS_OF_MONEY 14729 10.22 15.54 9.31 32 XM_Multi_Part_URI 14556 12.84 15.35 12.41 33 XM_B_Phish_Phrases 11965 8.29 12.62 7.55 34 HTML_IMAGE_RATIO_02 11936 7.97 12.59 7.19 35 NO_DNS_FOR_FROM 10766 4.02 11.36 2.77 36 XM_B_Unsub 10121 11.40 10.68 11.53 37 XMSexyCombo_05 9996 5.08 10.54 4.16 38 RCVD_IN_MSPIKE_BL 9357 1.77 9.87 0.39 39 XM_Evil_Numbers_Gen 9278 9.13 9.79 9.01 40 T_REMOTE_IMAGE 7396 4.30 7.80 3.71 41 LotsOfNums_01 7392 8.71 7.80 8.87 42 RELAYCOUNTRY_CA 7279 2.72 7.68 1.87 43 TR_XM_PhishingBody 7230 4.26 7.63 3.69 44 HTML_MIME_NO_HTML_TAG 7189 3.48 7.58 2.78 45 BAYES_80 7115 4.82 7.50 4.36 46 BAYES_60 6893 7.03 7.27 6.99 47 XM_B_COVIDMETA 6760 2.78 7.13 2.04 48 RCVD_IN_MSPIKE_WL 6757 22.17 7.13 24.73 49 XM_UB99 6726 1.03 7.09 0.01 50 RCVD_IN_BL_SPAMCOP_NET 6705 2.26 7.07 1.44 51 SpammyFromTLD_01 6603 1.90 6.96 1.04 52 XM_CamelCaseFrm001 6541 2.99 6.90 2.33 53 RELAYCOUNTRY_FR 6488 1.22 6.84 0.27 54 TR_XM_COVIDMETA4 6451 1.77 6.80 0.91 55 MPART_ALT_DIFF 6016 4.95 6.35 4.71 56 BODY_URI_ONLY 6007 1.07 6.34 0.18 57 RCVD_IN_MSPIKE_L3 5973 1.11 6.30 0.23 58 URIBL_SBL_A 5903 1.09 6.23 0.21 59 TooManyTo_001 5672 8.10 5.98 8.46 60 XMNumbers 5541 3.68 5.84 3.31 61 XM_SPF_SoftFail 5505 2.34 5.81 1.75 62 XM_UB50 5425 1.83 5.72 1.17 63 XMSubMetaSx_00 5408 4.15 5.70 3.89 64 XM_UB999 5360 0.82 5.65 0.00 65 XM_H_Long_From01 5358 5.81 5.65 5.84 66 MIME_HTML_MOSTLY 5339 2.82 5.63 2.34 67 T_HTML_TAG_BALANCE_CENTER 5210 1.05 5.50 0.29 68 TR_XM_MaxBayes 5156 0.84 5.44 0.06 69 HTML_IMAGE_RATIO_04 5055 5.88 5.33 5.97 70 XM_B_SpammyTLD 4873 2.46 5.14 2.00 71 RCVD_IN_RP_RNBL 4842 0.81 5.11 0.08 72 UNPARSEABLE_RELAY 4627 7.33 4.88 7.75 73 KHOP_HELO_FCRDNS 4586 2.27 4.84 1.84 74 TR_XM_INV_DKIM 4578 0.84 4.83 0.16 75 FROM_EXCESS_BASE64 4517 3.07 4.76 2.78 76 XMStrtUSub 4445 4.35 4.69 4.30 77 XM_DIRTYINTL 4348 1.24 4.59 0.67 78 XM_B_Phish66 4333 2.33 4.57 1.95 79 RCVD_IN_MSPIKE_H3 4299 13.34 4.53 14.83 80 SpammyFromTLD_02 4283 0.96 4.52 0.36 81 BOTNET_NORDNS 4254 0.67 4.49 0.02 82 BAYES_95 4164 2.83 4.39 2.56 83 T_XMDrugObfuBody_08 3940 2.12 4.16 1.78 84 XM_URI_RBL 3827 0.80 4.04 0.25 85 TR_XM_COVIDMETA1 3717 1.08 3.92 0.60 86 XM_SendGrid 3655 6.60 3.86 7.07 87 TR_XM_MaxSPIKE 3647 0.57 3.85 0.01 88 T_PDS_OTHER_BAD_TLD 3555 1.04 3.75 0.58 89 XM_OfRef6 3426 1.52 3.61 1.16 90 FROM_SUSPICIOUS_NTLD 3403 0.62 3.59 0.11 91 TM2_M_URI_OPT_OUT 3365 3.62 3.55 3.63 92 FROM_SUSPICIOUS_NTLD_FP 3356 0.60 3.54 0.11 93 XMDiploma_00 3029 1.97 3.19 1.76 94 XM_BadFromFormat 2904 0.70 3.06 0.30 95 MIME_QP_LONG_LINE 2901 5.80 3.06 6.27 96 XMBrknScrpt_02 2796 1.47 2.95 1.22 97 HTML_IMAGE_ONLY_08 2786 0.64 2.94 0.25 98 T_TooManySym_01 2776 4.04 2.93 4.22 99 TR_LOTS_OF_MONEY3 2758 1.03 2.91 0.71 100 RCVD_IN_PSBL 2698 0.48 2.85 0.08 101 HTML_IMAGE_RATIO_06 2691 3.53 2.84 3.65 102 HDRS_MISSP 2661 0.48 2.81 0.08 103 TR_Mismatch_TLD_02 2624 0.47 2.77 0.08 104 HTML_SHORT_LINK_IMG_1 2611 0.52 2.75 0.14 105 LongTLD 2582 0.57 2.72 0.20 106 HDRS_LCASE_IMGONLY 2532 0.50 2.67 0.13 107 HTML_IMAGE_RATIO_08 2449 2.52 2.58 2.51 108 RCVD_IN_MSPIKE_H4 2400 7.91 2.53 8.82 109 RELAYCOUNTRY_DE 2339 0.78 2.47 0.49 110 XMHTML_After_End 2337 1.31 2.47 1.11 111 DATE_IN_PAST_12_24 2271 0.38 2.40 0.04 112 DKIM_ADSP_NXDOMAIN 2245 0.58 2.37 0.27 113 TR_XM_PHPDW 2237 0.80 2.36 0.54 114 XMBody_17 2232 0.99 2.35 0.76 115 TR_XM_RelayPhish 2217 0.52 2.34 0.21 116 TR_XM_PHPForged 2216 0.77 2.34 0.50 117 BAYES_40 2198 4.35 2.32 4.69 118 RCVD_IN_MSPIKE_L5 2197 0.43 2.32 0.11 119 TR_XM_FormFill2 2194 0.77 2.31 0.51 120 XM_H_PHPOS 2178 0.76 2.30 0.50 121 XM_UB60 2173 0.45 2.29 0.13 122 RELAYCOUNTRY_GB 2173 1.32 2.29 1.16 123 MIME_HTML_ONLY_MULTI 2147 2.83 2.26 2.93 124 DATE_IN_PAST_03_06 2142 0.40 2.26 0.08 125 T_Symld_Words_02 2075 0.85 2.19 0.63 126 HTML_IMAGE_ONLY_16 2006 0.58 2.12 0.32 127 MAILING_LIST_MULTI 1975 2.64 2.08 2.73 128 XM_UB80 1968 0.34 2.08 0.04 129 DATE_IN_PAST_06_12 1954 0.36 2.06 0.07 130 XM_B_Unsub2 1952 3.08 2.06 3.25 131 DKIM_ADSP_CUSTOM_MED 1920 1.34 2.03 1.22 132 T_XMDrugObfuBody_14 1886 1.63 1.99 1.57 133 URI_PHP_REDIR 1837 0.33 1.94 0.06 134 T_XMDrugObfuBody_00 1825 1.14 1.92 1.01 135 URI_HEX 1802 1.66 1.90 1.61 136 BAYES_20 1790 3.26 1.89 3.49 137 NML_ADSP_CUSTOM_MED 1733 1.06 1.83 0.93 138 XMSexyCombo_01 1716 1.08 1.81 0.96 139 TM2_M_VERY_LONG_WORD 1687 1.50 1.78 1.46 140 TR_Mismatch_TLD_01 1641 0.47 1.73 0.25 141 URI_NO_WWW_INFO_CGI 1638 0.29 1.73 0.04 142 FORGED_GMAIL_RCVD 1608 0.63 1.70 0.45 143 XMGenDplmaNmb 1579 1.10 1.67 1.00 144 SCRIPT_GIBBERISH 1553 0.24 1.64 0.01 145 T_XMHurry_00 1547 0.96 1.63 0.84 146 HTML_SHORT_LINK_IMG_2 1535 0.27 1.62 0.05 147 TR_XM_DK_SendGrid 1439 3.72 1.52 4.10 148 SUBJ_ALL_CAPS 1435 1.55 1.51 1.55 149 TR_Symld_Words 1431 1.58 1.51 1.60 150 XM_UB95 1404 0.24 1.48 0.02 151 XMBody_78 1398 0.67 1.47 0.53 152 URI_TRY_3LD 1338 1.48 1.41 1.50 153 XMStockSpam_06 1325 1.31 1.40 1.29 154 XMSubNoVowel 1315 1.01 1.39 0.95 155 T_TooManySym_02 1308 1.85 1.38 1.93 156 XM_HighProb1 1307 0.21 1.38 0.01 157 ALL_TRUSTED 1265 10.89 1.33 12.51 158 XM_Nigeria_01 1263 0.26 1.33 0.08 159 RELAYCOUNTRY_NL 1256 0.39 1.32 0.23 160 XM_ProductURIs 1218 1.19 1.28 1.17 161 XM_OfRef7 1211 0.36 1.28 0.20 162 DIET_1 1198 0.58 1.26 0.47 163 RCVD_IN_MSPIKE_L4 1165 0.23 1.23 0.06 164 XM_H_Long_From02 1162 1.25 1.23 1.25 165 TR_MetaPhish_Combo_01 1160 1.04 1.22 1.01 166 XMPhish14 1153 0.73 1.22 0.65 167 RELAYCOUNTRY_IN 1126 0.27 1.19 0.11 168 XM_XX_Yahoo 1094 0.25 1.15 0.10 169 RDNS_DYNAMIC 1075 0.45 1.13 0.34 170 HK_RANDOM_REPLYTO 1069 0.37 1.13 0.24 171 URI_NOVOWEL 1068 0.56 1.13 0.47 172 BAYES_05 1051 2.25 1.11 2.44 173 T_FILL_THIS_FORM_SHORT 1050 0.96 1.11 0.94 174 XM_H_PHPMailer 1031 0.67 1.09 0.60 175 TR_LOTS_OF_MONEY2 1021 0.48 1.08 0.38 176 T_MONEY_PERCENT 1021 0.48 1.08 0.38 177 XMPhish30 991 0.59 1.05 0.52 178 XM_DK_Undo_01 977 1.66 1.03 1.77 179 URIBL_BLACK 963 0.18 1.02 0.04 180 XMPhish08 943 0.63 0.99 0.56 181 RCVD_IN_IADB_LISTED 921 4.59 0.97 5.21 182 XM_H_MailChimp 920 0.31 0.97 0.20 183 T_TooManySym_03 911 0.67 0.96 0.62 184 TR_XM_COVIDMETA3 901 0.16 0.95 0.03 185 FILL_THIS_FORM 892 0.38 0.94 0.29 186 HELO_NODOT 880 1.57 0.93 1.68 187 XMBdyGiftCard01 879 1.05 0.93 1.07 188 HELO_NO_DOMAIN 872 1.57 0.92 1.68 189 XM_H_PHPOS_M 864 0.29 0.91 0.18 190 XMMoneyMeta_00 836 0.69 0.88 0.65 191 URIBL_DBL_SPAM 832 0.15 0.88 0.02 192 RCVD_IN_IADB_SPF 825 4.03 0.87 4.56 193 XMReplyNow 815 0.24 0.86 0.13 194 RCVD_IN_IADB_DK 792 3.53 0.84 3.99 195 TooManyTo_002 784 1.94 0.83 2.13 196 RCVD_IN_IADB_SENDERID 780 3.52 0.82 3.97 197 BAYES_00 773 11.72 0.82 13.58 198 BILLION_DOLLARS 771 0.12 0.81 0.00 199 XMSubMetaSxObfu_03 763 0.52 0.80 0.47 200 XM_PDF 743 3.93 0.78 4.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 547041 97.89 97.18 98.01 2 HTML_MESSAGE 501994 90.58 94.31 89.94 3 RELAYCOUNTRY_US 465467 81.60 71.05 83.40 4 DKIM_SIGNED 432365 77.63 78.59 77.47 5 XM_DK_Pass 425263 76.00 74.83 76.19 6 DKIM_VALID 400953 70.46 62.33 71.84 7 XM_B_Unicode 400642 71.68 71.10 71.78 8 BAYES_50 302368 51.33 34.55 54.18 9 DKIM_VALID_AU 300129 52.71 46.42 53.77 10 XMListUnsubscribeExists 297533 55.64 69.34 53.31 11 XM_B_Unicode3 230061 40.58 36.80 41.22 12 T_TM2_M_HEADER_IN_MSG 158644 27.11 19.39 28.42 13 HTML_FONT_LOW_CONTRAST 156200 27.60 25.33 27.99 14 DKIM_VALID_EF 151060 27.65 31.09 27.07 15 RCVD_IN_MSPIKE_H2 142465 25.03 22.14 25.53 16 LOC_TINY_FONT_1 138811 26.00 32.68 24.87 17 RCVD_IN_MSPIKE_WL 138015 22.17 7.13 24.73 18 FVGT_m_MULTI_ODD 130247 23.64 25.41 23.34 19 XMSubLong 122243 22.13 23.47 21.90 20 MIME_HTML_ONLY 118859 23.87 39.00 21.30 21 T_KAM_HTML_FONT_INVALID 107670 20.30 26.21 19.29 22 RCVD_IN_MSPIKE_H3 82778 13.34 4.53 14.83 23 XM_Body_Dirty_Words 77252 14.51 18.44 13.84 24 BAYES_00 75767 11.72 0.82 13.58 25 ALL_TRUSTED 69812 10.89 1.33 12.51 26 XM_Multi_Part_URI 69258 12.84 15.35 12.41 27 XM_DK_Undo_02 66534 17.92 53.24 11.92 28 XM_B_Unsub 64334 11.40 10.68 11.53 29 LOTS_OF_MONEY 51982 10.22 15.54 9.31 30 XM_Evil_Numbers_Gen 50303 9.13 9.79 9.01 31 LotsOfNums_01 49502 8.71 7.80 8.87 32 RCVD_IN_MSPIKE_H4 49226 7.91 2.53 8.82 33 TR_XM_DK_Bayes 49023 7.58 0.48 8.78 34 TooManyTo_001 47242 8.10 5.98 8.46 35 TR_XM_DK_Bayes1 45729 7.04 0.24 8.19 36 RCVD_IN_RP_SAFE 44257 6.86 0.55 7.93 37 UNPARSEABLE_RELAY 43247 7.33 4.88 7.75 38 BAYES_99 43066 12.42 40.14 7.72 39 XM_B_Phish_Phrases 42160 8.29 12.62 7.55 40 TR_XM_DK_Bayes2 41551 6.39 0.21 7.44 41 RCVD_IN_RP_CERTIFIED 40805 6.29 0.29 7.31 42 HTML_IMAGE_RATIO_02 40126 7.97 12.59 7.19 43 XM_SendGrid 39434 6.60 3.86 7.07 44 BAYES_60 38993 7.03 7.27 6.99 45 XM_DKIMWhitelistDomains 37762 5.79 0.03 6.77 46 IN_ZIMBRA_NJ_WHITELIST 37491 5.75 0.03 6.72 47 MIME_QP_LONG_LINE 35000 5.80 3.06 6.27 48 BAYES_999 34076 10.00 32.90 6.11 49 HTML_IMAGE_RATIO_04 33314 5.88 5.33 5.97 50 RELAYCOUNTRY_META 32670 9.48 30.80 5.85 51 XM_H_Long_From01 32591 5.81 5.65 5.84 52 DKIM_INVALID 31412 7.17 16.25 5.63 53 BOTNET_IPINHOSTNAME 29172 6.94 17.04 5.23 54 RCVD_IN_IADB_LISTED 29069 4.59 0.97 5.21 55 MPART_ALT_DIFF 26278 4.95 6.35 4.71 56 BAYES_40 26189 4.35 2.32 4.69 57 RCVD_IN_IADB_SPF 25476 4.03 0.87 4.56 58 XM_PDF 24937 3.93 0.78 4.47 59 BAYES_80 24329 4.82 7.50 4.36 60 XMStrtUSub 23986 4.35 4.69 4.30 61 T_TooManySym_01 23580 4.04 2.93 4.22 62 XMSexyCombo_05 23199 5.08 10.54 4.16 63 TR_XM_DK_SendGrid 22877 3.72 1.52 4.10 64 RCVD_IN_IADB_DK 22263 3.53 0.84 3.99 65 RCVD_IN_IADB_SENDERID 22176 3.52 0.82 3.97 66 XMSubMetaSx_00 21718 4.15 5.70 3.89 67 T_REMOTE_IMAGE 20686 4.30 7.80 3.71 68 TR_XM_PhishingBody 20605 4.26 7.63 3.69 69 HTML_IMAGE_RATIO_06 20352 3.53 2.84 3.65 70 TM2_M_URI_OPT_OUT 20258 3.62 3.55 3.63 71 BAYES_20 19480 3.26 1.89 3.49 72 XM_UncommonTLD01 18841 5.96 21.21 3.38 73 XMNumbers 18492 3.68 5.84 3.31 74 XM_B_Unsub2 18153 3.08 2.06 3.25 75 RCVD_IN_IADB_VOUCHED 18073 2.81 0.29 3.24 76 BOTNET 18048 6.70 27.11 3.23 77 MIME_HTML_ONLY_MULTI 16327 2.83 2.26 2.93 78 FROM_EXCESS_BASE64 15507 3.07 4.76 2.78 79 HTML_MIME_NO_HTML_TAG 15506 3.48 7.58 2.78 80 NO_DNS_FOR_FROM 15471 4.02 11.36 2.77 81 MAILING_LIST_MULTI 15232 2.64 2.08 2.73 82 BAYES_95 14314 2.83 4.39 2.56 83 ANY_BOUNCE_MESSAGE 14132 2.25 0.58 2.53 84 BOUNCE_MESSAGE 14132 2.25 0.58 2.53 85 HTML_IMAGE_RATIO_08 14000 2.52 2.58 2.51 86 BAYES_05 13613 2.25 1.11 2.44 87 XM_H_Trusted_IP 13235 2.03 0.00 2.37 88 MIME_HTML_MOSTLY 13043 2.82 5.63 2.34 89 XM_CamelCaseFrm001 13005 2.99 6.90 2.33 90 TooManyTo_002 11871 1.94 0.83 2.13 91 XM_B_COVIDMETA 11411 2.78 7.13 2.04 92 XM_B_SpammyTLD 11168 2.46 5.14 2.00 93 RCVD_IN_IADB_OPTIN 10991 1.72 0.27 1.97 94 XM_B_Phish66 10860 2.33 4.57 1.95 95 T_TooManySym_02 10769 1.85 1.38 1.93 96 UNTRUSTED_Relay 10606 4.45 19.44 1.90 97 RELAYCOUNTRY_CA 10449 2.72 7.68 1.87 98 KHOP_HELO_FCRDNS 10242 2.27 4.84 1.84 99 T_XMDrugObfuBody_08 9928 2.12 4.16 1.78 100 XM_DK_Undo_01 9854 1.66 1.03 1.77 101 XMDiploma_00 9804 1.97 3.19 1.76 102 XM_SPF_SoftFail 9764 2.34 5.81 1.75 103 HELO_NODOT 9354 1.57 0.93 1.68 104 HELO_NO_DOMAIN 9353 1.57 0.92 1.68 105 TVD_RCVD_IP 9182 1.47 0.41 1.65 106 URI_HEX 9006 1.66 1.90 1.61 107 TR_Symld_Words 8917 1.58 1.51 1.60 108 T_XMDrugObfuBody_14 8769 1.63 1.99 1.57 109 SUBJ_ALL_CAPS 8665 1.55 1.51 1.55 110 URI_TRY_3LD 8345 1.48 1.41 1.50 111 TM2_M_VERY_LONG_WORD 8124 1.50 1.78 1.46 112 RCVD_IN_BL_SPAMCOP_NET 8047 2.26 7.07 1.44 113 TooManyTo_003 7987 1.32 0.64 1.43 114 XM_GoogleGroups 7700 1.26 0.53 1.38 115 INVALID_MSGID 7603 1.22 0.38 1.36 116 IN_HORDE_ADDRESS_BOOK 7498 1.15 0.03 1.34 117 XMStockSpam_06 7221 1.31 1.40 1.29 118 XM_H_Long_From02 6997 1.25 1.23 1.25 119 XMBrknScrpt_02 6822 1.47 2.95 1.22 120 DKIM_ADSP_CUSTOM_MED 6806 1.34 2.03 1.22 121 XMCapTrack 6674 1.08 0.39 1.20 122 XM_ProductURIs 6558 1.19 1.28 1.17 123 XM_UB50 6555 1.83 5.72 1.17 124 TO_MALFORMED 6505 1.00 0.02 1.17 125 XM_OfRef6 6489 1.52 3.61 1.16 126 RELAYCOUNTRY_GB 6460 1.32 2.29 1.16 127 USER_IN_DEF_DKIM_WL 6443 0.99 0.01 1.15 128 HTML_FONT_FACE_BAD 6196 1.05 0.67 1.11 129 XMHTML_After_End 6185 1.31 2.47 1.11 130 RCVD_IN_MSPIKE_H5 6011 0.93 0.06 1.08 131 XMBdyGiftCard01 5967 1.05 0.93 1.07 132 TooManyTo_004 5861 0.97 0.53 1.05 133 SpammyFromTLD_01 5827 1.90 6.96 1.04 134 TR_MetaPhish_Combo_01 5656 1.04 1.22 1.01 135 T_XMDrugObfuBody_00 5611 1.14 1.92 1.01 136 XMGenDplmaNmb 5584 1.10 1.67 1.00 137 XMSexyCombo_01 5353 1.08 1.81 0.96 138 XMSubNoVowel 5277 1.01 1.39 0.95 139 T_FILL_THIS_FORM_SHORT 5241 0.96 1.11 0.94 140 NML_ADSP_CUSTOM_MED 5209 1.06 1.83 0.93 141 TR_MSPIKEBAYES00 5143 0.79 0.01 0.92 142 TR_XM_COVIDMETA4 5089 1.77 6.80 0.91 143 XMGappySubj_01 5048 0.79 0.14 0.90 144 TooManyTo_005 4817 0.80 0.42 0.86 145 T_XMHurry_00 4708 0.96 1.63 0.84 146 XM_RXBody 4432 0.74 0.41 0.79 147 HTTPS_HTTP_MISMATCH 4334 0.76 0.68 0.78 148 XMBody_17 4239 0.99 2.35 0.76 149 TR_LOTS_OF_MONEY3 3951 1.03 2.91 0.71 150 XM_DIRTYINTL 3734 1.24 4.59 0.67 151 T_OBFU_PDF_ATTACH 3689 0.58 0.13 0.66 152 XMMoneyMeta_00 3653 0.69 0.88 0.65 153 XMPhish14 3633 0.73 1.22 0.65 154 XM_SPF_Unknown 3621 0.65 0.64 0.65 155 HTML_TAG_BALANCE_BODY 3546 0.61 0.44 0.64 156 T_Symld_Words_02 3490 0.85 2.19 0.63 157 T_TooManySym_03 3462 0.67 0.96 0.62 158 XM_H_PHPMailer 3353 0.67 1.09 0.60 159 TR_XM_COVIDMETA1 3329 1.08 3.92 0.60 160 T_PDS_OTHER_BAD_TLD 3215 1.04 3.75 0.58 161 PLING_QUERY 3186 0.57 0.57 0.57 162 XMPhish08 3138 0.63 0.99 0.56 163 MISSING_HEADERS 3080 0.54 0.46 0.55 164 FROM_GOV_DKIM_AU 3048 0.48 0.07 0.55 165 TR_XM_PHPDW 2997 0.80 2.36 0.54 166 XMBody_78 2955 0.67 1.47 0.53 167 XMSubMetaI_00 2909 0.52 0.50 0.52 168 XMPhish30 2891 0.59 1.05 0.52 169 TR_XM_FormFill2 2862 0.77 2.31 0.51 170 XMSexyCombo_04 2829 0.54 0.74 0.51 171 TR_XM_PHPForged 2814 0.77 2.34 0.50 172 FROM_GOV_SPOOF 2802 0.48 0.36 0.50 173 XM_ShortIntro_01 2791 0.52 0.63 0.50 174 XM_H_PHPOS 2772 0.76 2.30 0.50 175 RELAYCOUNTRY_DE 2758 0.78 2.47 0.49 176 XMNoVowels 2746 0.53 0.76 0.49 177 XM_B_REG_HTML 2690 0.43 0.16 0.48 178 XMHTMLBadTable_001 2672 0.49 0.54 0.48 179 RCVD_IN_SORBS_DUL 2667 0.45 0.26 0.48 180 RELAYCOUNTRY_AU 2630 0.51 0.73 0.47 181 URI_NOVOWEL 2618 0.56 1.13 0.47 182 DIET_1 2612 0.58 1.26 0.47 183 XMSubMetaSxObfu_03 2600 0.52 0.80 0.47 184 TR_BOTNET_NEGATE 2541 0.42 0.23 0.46 185 FORGED_GMAIL_RCVD 2538 0.63 1.70 0.45 186 HTML_IMAGE_ONLY_20 2511 0.44 0.35 0.45 187 TM2_M_A_HREF_HREF 2418 0.46 0.62 0.43 188 XM_Body_Obfu01 2355 0.41 0.36 0.42 189 SHORT_HELO_AND_INLINE_IMAGE 2293 0.36 0.08 0.41 190 XMDateMe_00 2243 0.41 0.43 0.40 191 TM2_M_BODY_EMPTY 2242 0.36 0.10 0.40 192 RCVD_IN_MSPIKE_BL 2201 1.77 9.87 0.39 193 XMBody_95 2164 0.34 0.08 0.39 194 XMLngstWrd_00 2135 0.40 0.49 0.38 195 TR_LOTS_OF_MONEY2 2128 0.48 1.08 0.38 196 T_MONEY_PERCENT 2128 0.48 1.08 0.38 197 XM_B_COPY_HTML 2109 0.39 0.43 0.38 198 HTML_IMAGE_ONLY_32 2103 0.38 0.38 0.38 199 HTML_IMAGE_ONLY_28 2094 0.36 0.30 0.38 200 XMSubGiftCard1 2067 0.37 0.39 0.37 ----------------------------------------------------------------------