Email: 451144 Autolearn: 0 AvgScore: 1.52 AvgScanTime: 1.56 sec Spam: 90087 Autolearn: 0 AvgScore: 12.16 AvgScanTime: 2.31 sec Ham: 361057 Autolearn: 0 AvgScore: -1.14 AvgScanTime: 1.38 sec Time Spent Running SA: 195.96 hours Time Spent Processing Spam: 57.85 hours Time Spent Processing Ham: 138.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 88779 98.96 98.55 99.07 2 HTML_MESSAGE 83496 83.88 92.68 81.69 3 XM_B_Unicode 52409 66.09 58.18 68.06 4 DKIM_SIGNED 52326 66.22 58.08 68.25 5 XM_DK_Pass 50867 65.05 56.46 67.19 6 RELAYCOUNTRY_US 48739 67.66 54.10 71.05 7 DKIM_VALID 45348 61.82 50.34 64.69 8 XMListUnsubscribeExists 43562 49.56 48.36 49.87 9 RELAYCOUNTRY_META 39285 18.45 43.61 12.17 10 BAYES_50 39110 48.13 43.41 49.31 11 XM_DK_Undo_02 36989 17.94 41.06 12.17 12 UNTRUSTED_Relay 34951 15.31 38.80 9.45 13 DKIM_VALID_AU 34347 50.07 38.13 53.04 14 BAYES_99 30638 14.09 34.01 9.11 15 LOTS_OF_MONEY 29931 14.05 33.22 9.26 16 MIME_HTML_ONLY 27892 21.89 30.96 19.63 17 BAYES_999 25517 11.56 28.32 7.38 18 DKIM_VALID_EF 22739 23.90 25.24 23.57 19 XMSubLong 22257 19.62 24.71 18.35 20 XM_B_Unicode3 21710 34.36 24.10 36.93 21 FVGT_m_MULTI_ODD 21294 20.59 23.64 19.83 22 T_TM2_M_HEADER_IN_MSG 20788 19.51 23.08 18.62 23 BOTNET 20768 6.48 23.05 2.35 24 MISSING_HEADERS 20195 10.84 22.42 7.95 25 XM_UB50 20090 11.38 22.30 8.65 26 XM_OfRef6 20002 10.52 22.20 7.60 27 HELO_NODOT 19949 11.29 22.14 8.58 28 HELO_NO_DOMAIN 19949 11.29 22.14 8.58 29 REPLYTO_WITHOUT_TO_CC 19428 10.50 21.57 7.74 30 LOC_TINY_FONT_1 18852 25.84 20.93 27.06 31 XM_Body_Dirty_Words 18797 14.14 20.87 12.47 32 TR_LOTS_OF_MONEY1 17704 5.46 19.65 1.92 33 RCVD_IN_MSPIKE_H2 16198 20.84 17.98 21.55 34 RELAYCOUNTRY_UG 15680 9.55 17.41 7.59 35 XMSexyCombo_05 15564 6.82 17.28 4.21 36 T_KAM_HTML_FONT_INVALID 15222 15.60 16.90 15.27 37 XM_UncommonTLD01 14795 6.15 16.42 3.59 38 XM_Multi_Part_URI 13973 16.32 15.51 16.53 39 HTML_FONT_LOW_CONTRAST 13798 24.23 15.32 26.46 40 SUBJ_ALL_CAPS 13208 5.46 14.66 3.16 41 BOTNET_IPINHOSTNAME 11027 7.01 12.24 5.70 42 FILL_THIS_FORM 10423 7.48 11.57 6.46 43 XM_OfRef7 10346 7.48 11.48 6.48 44 XM_DIRTYINTL 9899 2.61 10.99 0.53 45 TR_LOTS_OF_MONEY3 9762 2.85 10.84 0.86 46 FILL_THIS_FORM_LONG 9636 7.19 10.70 6.32 47 T_TooManySym_01 9336 5.54 10.36 4.34 48 RCVD_IN_MSPIKE_BL 9276 2.48 10.30 0.52 49 DEAR_FRIEND 8828 2.03 9.80 0.09 50 RCVD_IN_BL_SPAMCOP_NET 8219 2.72 9.12 1.12 51 MONEY_FORM_SHORT 8113 1.82 9.01 0.02 52 XM_B_Unsub 8105 8.39 9.00 8.24 53 URIBL_SBL_A 8068 2.33 8.96 0.68 54 HTML_MIME_NO_HTML_TAG 7803 3.00 8.66 1.59 55 RCVD_IN_MSPIKE_WL 7741 20.48 8.59 23.44 56 MILLION_HUNDRED 7552 1.71 8.38 0.05 57 HTML_IMAGE_RATIO_02 7431 7.48 8.25 7.29 58 TR_XM_MaxBayes 7421 1.90 8.24 0.32 59 BOTNET_NORDNS 7394 1.65 8.21 0.01 60 LotsOfNums_01 7020 7.63 7.79 7.59 61 DKIM_INVALID 6978 4.39 7.75 3.56 62 BAYES_80 6808 5.06 7.56 4.44 63 XM_B_SpammyTLD 6706 3.13 7.44 2.06 64 RELAYCOUNTRY_CA 6635 2.92 7.37 1.81 65 XM_B_Phish_Phrases 5920 7.06 6.57 7.18 66 XM_SPF_SoftFail 5821 2.05 6.46 0.95 67 BAYES_60 5816 6.23 6.46 6.18 68 RCVD_IN_MSPIKE_L3 5803 1.57 6.44 0.36 69 XMBrknScrpt_02 5654 2.60 6.28 1.68 70 NO_DNS_FOR_FROM 5578 2.68 6.19 1.80 71 RCVD_IN_RP_RNBL 5552 1.31 6.16 0.10 72 XM_CamelCaseFrm001 5416 2.98 6.01 2.22 73 FROM_EXCESS_BASE64 5332 3.55 5.92 2.96 74 TR_XM_PhishingBody 5052 3.62 5.61 3.12 75 XMBody_17 4861 1.96 5.40 1.10 76 XMSubMetaSx_00 4778 4.69 5.30 4.54 77 SpammyFromTLD_01 4719 1.59 5.24 0.68 78 TR_Mismatch_TLD_01 4498 1.17 4.99 0.21 79 TR_XM_COVIDMETA4 4484 1.35 4.98 0.45 80 XMSubEmpty 4424 1.18 4.91 0.24 81 XM_UB99 4343 0.97 4.82 0.01 82 XM_DK_Undo_01 4223 2.11 4.69 1.46 83 TR_Sbj_FN_Bdy 4147 1.13 4.60 0.26 84 RCVD_IN_MSPIKE_H4 4123 8.04 4.58 8.90 85 XM_Evil_Numbers_Gen 4027 7.41 4.47 8.15 86 TooManyTo_001 3996 5.58 4.44 5.87 87 XM_B_Phish66 3856 1.82 4.28 1.21 88 XM_UB80 3829 0.89 4.25 0.05 89 T_REMOTE_IMAGE 3824 2.80 4.24 2.44 90 MISSING_SUBJECT 3673 0.91 4.08 0.12 91 XMNoSubject 3673 0.91 4.08 0.12 92 HTML_IMAGE_RATIO_04 3652 6.10 4.05 6.62 93 RCVD_IN_MSPIKE_H3 3586 11.63 3.98 13.54 94 XMStrtUSub 3577 5.27 3.97 5.59 95 BODY_URI_ONLY 3553 0.82 3.94 0.04 96 TR_XM_MaxSPIKE 3524 0.80 3.91 0.03 97 RELAYCOUNTRY_DE 3512 1.05 3.90 0.34 98 XM_UB999 3495 0.78 3.88 0.00 99 RCVD_IN_PSBL 3466 0.87 3.85 0.12 100 XMLngstWrd_00 3325 1.04 3.69 0.37 101 T_XMDrugObfuBody_14 3242 1.87 3.60 1.44 102 T_XMHurry_00 3175 1.36 3.52 0.82 103 XM_H_Long_From01 3115 4.35 3.46 4.57 104 T_XMDrugObfuBody_08 3106 1.65 3.45 1.21 105 XM_UB60 3064 0.79 3.40 0.14 106 MPART_ALT_DIFF 2995 4.50 3.32 4.79 107 BAYES_95 2838 2.78 3.15 2.69 108 XMNumbers 2773 3.06 3.08 3.06 109 SpammyFromTLD_02 2738 0.81 3.04 0.25 110 TR_XM_INV_DKIM 2644 0.73 2.93 0.18 111 URI_TRY_3LD 2601 1.98 2.89 1.75 112 UNPARSEABLE_RELAY 2569 6.44 2.85 7.34 113 KHOP_HELO_FCRDNS 2457 1.27 2.73 0.90 114 MIME_HTML_MOSTLY 2423 2.93 2.69 2.99 115 RELAYCOUNTRY_FR 2418 0.71 2.68 0.21 116 XMHTML_After_End 2383 1.32 2.65 0.99 117 XMLngstWrd_01 2343 0.80 2.60 0.35 118 TR_Caps_n_Bayes_80 2207 0.57 2.45 0.09 119 XM_B_COVIDMETA 2207 1.85 2.45 1.70 120 RCVD_IN_MSPIKE_L5 2189 0.58 2.43 0.12 121 T_Symld_Words_02 2147 0.70 2.38 0.28 122 DATE_IN_PAST_03_06 2142 0.57 2.38 0.12 123 FROM_SUSPICIOUS_NTLD 2123 0.55 2.36 0.09 124 DEAR_SOMETHING 2101 0.65 2.33 0.24 125 FROM_SUSPICIOUS_NTLD_FP 2081 0.53 2.31 0.09 126 UPPERCASE_75_100 2041 0.54 2.27 0.11 127 XMSubNoVowel 2040 1.19 2.26 0.93 128 T_PDS_OTHER_BAD_TLD 1947 0.98 2.16 0.69 129 T_DEAR_BENEFICIARY 1945 0.48 2.16 0.07 130 TM2_M_URI_OPT_OUT 1926 9.31 2.14 11.09 131 XM_SendGrid 1920 5.68 2.13 6.57 132 ADVANCE_FEE_5_NEW 1891 0.47 2.10 0.06 133 URI_PHP_REDIR 1873 0.49 2.08 0.10 134 XM_JunkDunk 1785 0.40 1.98 0.00 135 T_HTML_TAG_BALANCE_CENTER 1770 0.57 1.96 0.22 136 BAYES_40 1769 3.31 1.96 3.64 137 HDRS_MISSP 1706 0.45 1.89 0.10 138 TR_XM_PHPDW 1670 0.68 1.85 0.39 139 TR_XM_PHPForged 1648 0.66 1.83 0.37 140 TR_XM_FormFill2 1632 0.66 1.81 0.37 141 XM_H_PHPOS 1624 0.65 1.80 0.36 142 HTML_IMAGE_RATIO_06 1588 3.20 1.76 3.56 143 XM_URI_RBL 1574 0.52 1.75 0.21 144 SCRIPT_GIBBERISH 1560 0.35 1.73 0.01 145 XMLngstWrd_02 1542 0.59 1.71 0.31 146 RELAYCOUNTRY_HK 1518 0.36 1.69 0.03 147 TR_XM_RelayPhish 1491 0.42 1.66 0.11 148 MIME_CHARSET_FARAWAY 1475 0.42 1.64 0.12 149 SUBJ_DOLLARS 1469 0.78 1.63 0.56 150 CHARSET_FARAWAY_HEADER 1451 0.36 1.61 0.04 151 LongTLD 1433 0.43 1.59 0.14 152 HTML_IMAGE_RATIO_08 1410 2.40 1.57 2.61 153 TR_Mismatch_TLD_02 1367 0.37 1.52 0.08 154 BAYES_20 1341 2.93 1.49 3.29 155 URI_NO_WWW_INFO_CGI 1340 0.32 1.49 0.03 156 DKIM_ADSP_CUSTOM_MED 1329 1.10 1.48 1.01 157 DATE_IN_PAST_06_12 1283 0.47 1.42 0.23 158 XM_UB95 1279 0.31 1.42 0.03 159 RELAYCOUNTRY_ZA 1254 0.31 1.39 0.04 160 NML_ADSP_CUSTOM_MED 1251 0.85 1.39 0.71 161 TM2_M_A_HREF_HREF 1247 0.49 1.38 0.27 162 XMSexyCombo_01 1245 1.31 1.38 1.29 163 TVD_SPACE_RATIO_MINFP 1237 0.28 1.37 0.00 164 MIME_QP_LONG_LINE 1202 2.99 1.33 3.40 165 T_TooManySym_02 1179 2.15 1.31 2.36 166 TR_Symld_Words 1111 1.23 1.23 1.23 167 TR_XM_COVIDMETA1 1107 0.57 1.23 0.40 168 LOADSA_MONEY_COMBO 1078 0.31 1.20 0.09 169 T_FILL_THIS_FORM_SHORT 1063 0.65 1.18 0.52 170 HK_SCAM 1056 0.25 1.17 0.02 171 ALL_TRUSTED 1034 14.43 1.15 17.75 172 XM_B_Unsub2 1027 0.96 1.14 0.92 173 MPART_ALT_DIFF_COUNT 1015 0.54 1.13 0.39 174 DKIM_ADSP_NXDOMAIN 1001 0.52 1.11 0.37 175 DIET_1 983 0.67 1.09 0.57 176 TM2_M_VERY_LONG_WORD 971 1.20 1.08 1.24 177 XM_ShortIntro_01 961 0.50 1.07 0.36 178 URI_HEX 948 1.08 1.05 1.08 179 T_TooManySym_03 939 0.76 1.04 0.69 180 XM_H_Undi_Recip 934 0.38 1.04 0.22 181 BAYES_00 928 14.80 1.03 18.24 182 FROM_MISSP_REPLYTO 920 0.21 1.02 0.00 183 XM_XX_Yahoo 902 0.22 1.00 0.03 184 DATE_IN_PAST_12_24 890 0.25 0.99 0.07 185 FORGED_GMAIL_RCVD 878 0.56 0.97 0.46 186 ANY_BOUNCE_MESSAGE 867 8.32 0.96 10.15 187 BOUNCE_MESSAGE 863 8.32 0.96 10.15 188 RELAYCOUNTRY_NL 828 0.38 0.92 0.24 189 BAYES_05 818 2.66 0.91 3.10 190 HK_RANDOM_REPLYTO 810 0.29 0.90 0.14 191 URIBL_ABUSE_SURBL 803 0.23 0.89 0.07 192 URIBL_DBL_SPAM 798 0.19 0.89 0.02 193 URIBL_BLACK 790 0.18 0.88 0.01 194 MIME_HTML_ONLY_MULTI 788 2.31 0.87 2.67 195 TVD_SPACE_ENCODED 779 0.17 0.86 0.00 196 XMStockSpam_06 777 1.10 0.86 1.16 197 RELAYCOUNTRY_IN 766 0.21 0.85 0.05 198 XMSubMetaSxObfu_03 757 1.27 0.84 1.37 199 BILLION_DOLLARS 754 0.20 0.84 0.04 200 XMLngstWrd_03 747 0.38 0.83 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 357688 98.96 98.55 99.07 2 HTML_MESSAGE 294938 83.88 92.68 81.69 3 RELAYCOUNTRY_US 256519 67.66 54.10 71.05 4 DKIM_SIGNED 246410 66.22 58.08 68.25 5 XM_B_Unicode 245751 66.09 58.18 68.06 6 XM_DK_Pass 242604 65.05 56.46 67.19 7 DKIM_VALID 233563 61.82 50.34 64.69 8 DKIM_VALID_AU 191521 50.07 38.13 53.04 9 XMListUnsubscribeExists 180043 49.56 48.36 49.87 10 BAYES_50 178024 48.13 43.41 49.31 11 XM_B_Unicode3 133322 34.36 24.10 36.93 12 LOC_TINY_FONT_1 97705 25.84 20.93 27.06 13 HTML_FONT_LOW_CONTRAST 95526 24.23 15.32 26.46 14 DKIM_VALID_EF 85092 23.90 25.24 23.57 15 RCVD_IN_MSPIKE_WL 84643 20.48 8.59 23.44 16 RCVD_IN_MSPIKE_H2 77823 20.84 17.98 21.55 17 FVGT_m_MULTI_ODD 71591 20.59 23.64 19.83 18 MIME_HTML_ONLY 70877 21.89 30.96 19.63 19 T_TM2_M_HEADER_IN_MSG 67212 19.51 23.08 18.62 20 XMSubLong 66264 19.62 24.71 18.35 21 BAYES_00 65862 14.80 1.03 18.24 22 ALL_TRUSTED 64083 14.43 1.15 17.75 23 XM_Multi_Part_URI 59676 16.32 15.51 16.53 24 T_KAM_HTML_FONT_INVALID 55137 15.60 16.90 15.27 25 RCVD_IN_MSPIKE_H3 48890 11.63 3.98 13.54 26 XM_Body_Dirty_Words 45013 14.14 20.87 12.47 27 RELAYCOUNTRY_META 43950 18.45 43.61 12.17 28 XM_DK_Undo_02 43943 17.94 41.06 12.17 29 TM2_M_URI_OPT_OUT 40057 9.31 2.14 11.09 30 RCVD_IN_RP_SAFE 37656 8.45 0.52 10.43 31 ANY_BOUNCE_MESSAGE 36655 8.32 0.96 10.15 32 BOUNCE_MESSAGE 36652 8.32 0.96 10.15 33 RCVD_IN_RP_CERTIFIED 35507 7.93 0.28 9.83 34 UNTRUSTED_Relay 34128 15.31 38.80 9.45 35 LOTS_OF_MONEY 33449 14.05 33.22 9.26 36 BAYES_99 32909 14.09 34.01 9.11 37 RCVD_IN_MSPIKE_H4 32127 8.04 4.58 8.90 38 XM_UB50 31232 11.38 22.30 8.65 39 HELO_NODOT 30974 11.29 22.14 8.58 40 HELO_NO_DOMAIN 30967 11.29 22.14 8.58 41 XM_DKIMWhitelistDomains 30166 6.69 0.00 8.35 42 XM_B_Unsub 29761 8.39 9.00 8.24 43 TR_XM_DK_Bayes 29716 6.67 0.41 8.23 44 XM_Evil_Numbers_Gen 29420 7.41 4.47 8.15 45 MISSING_HEADERS 28689 10.84 22.42 7.95 46 TR_XM_DK_Bayes1 28313 6.33 0.29 7.84 47 REPLYTO_WITHOUT_TO_CC 27959 10.50 21.57 7.74 48 XM_OfRef6 27441 10.52 22.20 7.60 49 LotsOfNums_01 27422 7.63 7.79 7.59 50 RELAYCOUNTRY_UG 27395 9.55 17.41 7.59 51 BAYES_999 26650 11.56 28.32 7.38 52 TR_XM_DK_Bayes2 26612 5.95 0.27 7.37 53 UNPARSEABLE_RELAY 26494 6.44 2.85 7.34 54 HTML_IMAGE_RATIO_02 26320 7.48 8.25 7.29 55 XM_B_Phish_Phrases 25924 7.06 6.57 7.18 56 HTML_IMAGE_RATIO_04 23888 6.10 4.05 6.62 57 XM_SendGrid 23725 5.68 2.13 6.57 58 XM_OfRef7 23389 7.48 11.48 6.48 59 FILL_THIS_FORM 23334 7.48 11.57 6.46 60 FILL_THIS_FORM_LONG 22817 7.19 10.70 6.32 61 XM_OfRef8 22563 5.05 0.23 6.25 62 BAYES_60 22312 6.23 6.46 6.18 63 TooManyTo_001 21200 5.58 4.44 5.87 64 BOTNET_IPINHOSTNAME 20579 7.01 12.24 5.70 65 XMStrtUSub 20195 5.27 3.97 5.59 66 MPART_ALT_DIFF 17290 4.50 3.32 4.79 67 XM_H_Long_From01 16503 4.35 3.46 4.57 68 XMSubMetaSx_00 16391 4.69 5.30 4.54 69 BAYES_80 16017 5.06 7.56 4.44 70 T_TooManySym_01 15675 5.54 10.36 4.34 71 XMSexyCombo_05 15201 6.82 17.28 4.21 72 TR_XM_DK_SendGrid 14570 3.39 0.80 4.04 73 IN_ZIMBRA_NJ_WHITELIST 13565 3.01 0.01 3.76 74 BAYES_40 13142 3.31 1.96 3.64 75 XM_UncommonTLD01 12958 6.15 16.42 3.59 76 DKIM_INVALID 12847 4.39 7.75 3.56 77 HTML_IMAGE_RATIO_06 12841 3.20 1.76 3.56 78 MIME_QP_LONG_LINE 12277 2.99 1.33 3.40 79 BAYES_20 11878 2.93 1.49 3.29 80 SUBJ_ALL_CAPS 11405 5.46 14.66 3.16 81 TR_XM_PhishingBody 11267 3.62 5.61 3.12 82 BAYES_05 11187 2.66 0.91 3.10 83 XMNumbers 11043 3.06 3.08 3.06 84 MIME_HTML_MOSTLY 10779 2.93 2.69 2.99 85 FROM_EXCESS_BASE64 10704 3.55 5.92 2.96 86 BAYES_95 9725 2.78 3.15 2.69 87 MIME_HTML_ONLY_MULTI 9647 2.31 0.87 2.67 88 RCVD_IN_IADB_LISTED 9596 2.25 0.63 2.66 89 HTML_IMAGE_RATIO_08 9414 2.40 1.57 2.61 90 T_REMOTE_IMAGE 8814 2.80 4.24 2.44 91 XM_H_Trusted_IP 8531 1.89 0.00 2.36 92 T_TooManySym_02 8506 2.15 1.31 2.36 93 BOTNET 8485 6.48 23.05 2.35 94 MAILING_LIST_MULTI 8436 2.02 0.74 2.34 95 RCVD_IN_IADB_SPF 8386 1.97 0.56 2.32 96 TVD_RCVD_IP 8323 1.90 0.27 2.31 97 XM_CamelCaseFrm001 8031 2.98 6.01 2.22 98 INVALID_MSGID 7786 1.82 0.46 2.16 99 RCVD_IN_IADB_SENDERID 7585 1.79 0.55 2.10 100 XM_B_SpammyTLD 7435 3.13 7.44 2.06 101 RCVD_IN_IADB_DK 7430 1.76 0.55 2.06 102 XM_PDF 7106 1.66 0.44 1.97 103 TR_LOTS_OF_MONEY1 6943 5.46 19.65 1.92 104 RELAYCOUNTRY_CA 6547 2.92 7.37 1.81 105 NO_DNS_FOR_FROM 6507 2.68 6.19 1.80 106 TO_MALFORMED 6470 1.44 0.03 1.79 107 XM_GoogleGroups 6389 1.48 0.32 1.77 108 URI_TRY_3LD 6321 1.98 2.89 1.75 109 XMBdyGiftCard01 6301 1.54 0.70 1.75 110 XM_B_COVIDMETA 6155 1.85 2.45 1.70 111 XMBrknScrpt_02 6060 2.60 6.28 1.68 112 HTML_MIME_NO_HTML_TAG 5733 3.00 8.66 1.59 113 RCVD_IN_IADB_VOUCHED 5712 1.29 0.12 1.58 114 USER_IN_DEF_DKIM_WL 5310 1.18 0.00 1.47 115 XM_DK_Undo_01 5274 2.11 4.69 1.46 116 IN_HORDE_ADDRESS_BOOK 5220 1.16 0.01 1.45 117 T_XMDrugObfuBody_14 5214 1.87 3.60 1.44 118 XMSubMetaSxObfu_03 4956 1.27 0.84 1.37 119 HTML_FONT_FACE_BAD 4671 1.09 0.29 1.29 120 XMSexyCombo_01 4658 1.31 1.38 1.29 121 TM2_M_VERY_LONG_WORD 4462 1.20 1.08 1.24 122 TR_Symld_Words 4442 1.23 1.23 1.23 123 T_XMDrugObfuBody_08 4358 1.65 3.45 1.21 124 XM_B_Phish66 4356 1.82 4.28 1.21 125 XMDiploma_00 4338 1.08 0.60 1.20 126 T_XMDrugObfuBody_00 4261 1.10 0.76 1.18 127 XMStockSpam_06 4193 1.10 0.86 1.16 128 XM_ProductURIs 4153 1.04 0.61 1.15 129 RCVD_IN_BL_SPAMCOP_NET 4049 2.72 9.12 1.12 130 XMBody_17 3961 1.96 5.40 1.10 131 URI_HEX 3912 1.08 1.05 1.08 132 TooManyTo_002 3906 0.95 0.43 1.08 133 DKIM_ADSP_CUSTOM_MED 3649 1.10 1.48 1.01 134 RCVD_IN_MSPIKE_H5 3626 0.81 0.04 1.00 135 XMHTML_After_End 3584 1.32 2.65 0.99 136 TR_MSPIKEBAYES00 3553 0.79 0.00 0.98 137 RCVD_IN_IADB_OPTIN 3530 0.82 0.18 0.98 138 XMGappySubj_01 3529 0.80 0.09 0.98 139 XM_SPF_SoftFail 3415 2.05 6.46 0.95 140 XMSubNoVowel 3346 1.19 2.26 0.93 141 XM_B_Unsub2 3313 0.96 1.14 0.92 142 KHOP_HELO_FCRDNS 3264 1.27 2.73 0.90 143 TR_LOTS_OF_MONEY3 3099 2.85 10.84 0.86 144 T_XMHurry_00 2960 1.36 3.52 0.82 145 XMSexyCombo_04 2840 0.74 0.55 0.79 146 XMPhish08 2794 0.71 0.46 0.77 147 XMSubMetaI_00 2762 0.71 0.47 0.76 148 XMPhish30 2727 0.72 0.59 0.76 149 TooManyTo_003 2721 0.67 0.32 0.75 150 XM_H_Long_From02 2691 0.69 0.47 0.75 151 XM_B_REG_HTML 2609 0.62 0.19 0.72 152 NML_ADSP_CUSTOM_MED 2581 0.85 1.39 0.71 153 T_PDS_OTHER_BAD_TLD 2479 0.98 2.16 0.69 154 T_TooManySym_03 2478 0.76 1.04 0.69 155 SpammyFromTLD_01 2440 1.59 5.24 0.68 156 URIBL_SBL_A 2438 2.33 8.96 0.68 157 TooManyTo_004 2293 0.57 0.30 0.64 158 RCVD_IN_SORBS_DUL 2256 0.55 0.25 0.62 159 RELAYCOUNTRY_GB 2251 0.66 0.83 0.62 160 TVD_PH_BODY_ACCOUNTS_PRE 2105 0.50 0.19 0.58 161 DIET_1 2053 0.67 1.09 0.57 162 SUBJ_DOLLARS 2032 0.78 1.63 0.56 163 TooManyTo_005 1993 0.49 0.25 0.55 164 TR_MetaPhish_Combo_01 1964 0.56 0.63 0.54 165 XMBody_78 1956 0.50 0.33 0.54 166 XM_RXBody 1939 0.47 0.22 0.54 167 XMGenDplmaNmb 1928 0.50 0.36 0.53 168 HTML_TAG_BALANCE_BODY 1918 0.49 0.33 0.53 169 XM_DIRTYINTL 1897 2.61 10.99 0.53 170 RCVD_IN_MSPIKE_BL 1895 2.48 10.30 0.52 171 T_FILL_THIS_FORM_SHORT 1865 0.65 1.18 0.52 172 HTTPS_HTTP_MISMATCH 1788 0.47 0.39 0.50 173 SUBJ_OBFU_PUNCT_FEW 1767 0.43 0.20 0.49 174 XM_B_COPY_HTML 1766 0.44 0.23 0.49 175 XM_H_PHPMailer 1760 0.55 0.82 0.49 176 USER_IN_WHITELIST 1757 0.39 0.00 0.49 177 XMSubGiftCard1 1699 0.44 0.30 0.47 178 FORGED_GMAIL_RCVD 1647 0.56 0.97 0.46 179 XMHTMLBadTable_001 1632 0.42 0.27 0.45 180 TR_XM_COVIDMETA4 1629 1.35 4.98 0.45 181 XMSubMetaSxObfu_02 1612 0.38 0.13 0.45 182 XMBody_95 1601 0.38 0.12 0.44 183 PLING_QUERY 1530 0.41 0.38 0.42 184 TR_XM_COVIDMETA1 1458 0.57 1.23 0.40 185 MPART_ALT_DIFF_COUNT 1423 0.54 1.13 0.39 186 TR_XM_PHPDW 1416 0.68 1.85 0.39 187 URI_NOVOWEL 1377 0.39 0.44 0.38 188 XMPhish14 1368 0.37 0.36 0.38 189 RDNS_DYNAMIC 1354 0.40 0.52 0.38 190 XMLngstWrd_00 1353 1.04 3.69 0.37 191 XMCapTrack 1339 0.37 0.39 0.37 192 DKIM_ADSP_NXDOMAIN 1339 0.52 1.11 0.37 193 TR_XM_PHPForged 1333 0.66 1.83 0.37 194 TR_XM_FormFill2 1331 0.66 1.81 0.37 195 XM_H_PHPOS 1302 0.65 1.80 0.36 196 HTML_IMAGE_ONLY_20 1296 0.33 0.21 0.36 197 XM_ShortIntro_01 1295 0.50 1.07 0.36 198 RCVD_IN_MSPIKE_L3 1293 1.57 6.44 0.36 199 XMLngstWrd_01 1255 0.80 2.60 0.35 200 XMSlimDrugH 1246 0.36 0.44 0.35 ----------------------------------------------------------------------