Email: 731562 Autolearn: 0 AvgScore: -0.99 AvgScanTime: 1.81 sec Spam: 99413 Autolearn: 0 AvgScore: 12.04 AvgScanTime: 3.44 sec Ham: 632149 Autolearn: 0 AvgScore: -3.04 AvgScanTime: 1.55 sec Time Spent Running SA: 367.98 hours Time Spent Processing Spam: 95.09 hours Time Spent Processing Ham: 272.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 96939 98.29 97.51 98.41 2 HTML_MESSAGE 87856 87.28 88.37 87.10 3 XM_B_Unicode 62871 66.61 63.24 67.14 4 DKIM_SIGNED 62529 65.30 62.90 65.68 5 XM_DK_Pass 60388 64.03 60.74 64.55 6 RELAYCOUNTRY_US 59003 76.60 59.35 79.31 7 XMListUnsubscribeExists 50856 43.90 51.16 42.76 8 DKIM_VALID 49466 59.03 49.76 60.49 9 XM_DK_Undo_02 41276 14.06 41.52 9.74 10 BAYES_50 40230 48.65 40.47 49.94 11 DKIM_VALID_AU 35334 44.14 35.54 45.49 12 MIME_HTML_ONLY 35175 24.90 35.38 23.25 13 BAYES_99 33728 9.80 33.93 6.01 14 XM_B_Unicode3 32434 38.43 32.63 39.35 15 RELAYCOUNTRY_META 31171 8.84 31.36 5.30 16 UNTRUSTED_Relay 27547 5.39 27.71 1.88 17 BAYES_999 27208 7.81 27.37 4.73 18 BOTNET 26648 6.15 26.81 2.90 19 XMSubLong 25458 20.59 25.61 19.80 20 DKIM_VALID_EF 25065 24.69 25.21 24.61 21 FVGT_m_MULTI_ODD 23697 19.25 23.84 18.52 22 LOC_TINY_FONT_1 23231 20.36 23.37 19.89 23 RCVD_IN_MSPIKE_H2 21480 20.74 21.61 20.60 24 HTML_FONT_LOW_CONTRAST 21131 22.70 21.26 22.93 25 LOTS_OF_MONEY 20896 9.82 21.02 8.06 26 T_TM2_M_HEADER_IN_MSG 19515 24.21 19.63 24.93 27 T_KAM_HTML_FONT_INVALID 16574 15.60 16.67 15.43 28 XM_Body_Dirty_Words 16550 12.82 16.65 12.22 29 BOTNET_IPINHOSTNAME 15751 5.95 15.84 4.39 30 XM_UncommonTLD01 13854 4.35 13.94 2.85 31 RCVD_IN_MSPIKE_BL 13745 2.74 13.83 0.99 32 XM_Multi_Part_URI 13523 12.50 13.60 12.33 33 DKIM_INVALID 13063 6.27 13.14 5.19 34 XM_UB50 12157 2.71 12.23 1.21 35 HTML_MIME_NO_HTML_TAG 11727 4.13 11.80 2.93 36 RCVD_IN_BL_SPAMCOP_NET 10737 2.51 10.80 1.21 37 NO_DNS_FOR_FROM 10500 3.95 10.56 2.91 38 XM_B_Unsub 10405 11.74 10.47 11.95 39 XMSexyCombo_05 10029 4.95 10.09 4.15 40 MISSING_HEADERS 9945 2.25 10.00 1.03 41 XM_B_Phish_Phrases 9931 6.43 9.99 5.87 42 T_REMOTE_IMAGE 9873 4.10 9.93 3.19 43 REPLYTO_WITHOUT_TO_CC 9718 1.87 9.78 0.63 44 TR_LOTS_OF_MONEY1 9592 1.83 9.65 0.60 45 HELO_NODOT 9515 3.02 9.57 1.99 46 HELO_NO_DOMAIN 9513 3.02 9.57 1.99 47 XM_Evil_Numbers_Gen 9274 9.00 9.33 8.94 48 TR_XM_COVIDMETA4 9028 2.25 9.08 1.18 49 BODY_URI_ONLY 8451 1.29 8.50 0.16 50 HTML_IMAGE_RATIO_02 8226 5.68 8.27 5.27 51 LotsOfNums_01 7846 7.36 7.89 7.28 52 RCVD_IN_RP_RNBL 7340 1.05 7.38 0.06 53 BAYES_60 7295 5.63 7.34 5.36 54 RCVD_IN_MSPIKE_WL 7203 19.93 7.25 21.92 55 SUBJ_ALL_CAPS 6886 2.54 6.93 1.86 56 BAYES_80 6674 3.90 6.71 3.46 57 TR_XM_PhishingBody 6585 3.51 6.62 3.02 58 XM_SPF_SoftFail 6265 2.13 6.30 1.47 59 BOTNET_NORDNS 6145 0.85 6.18 0.02 60 XM_OfRef6 6122 1.67 6.16 0.97 61 XMSubMetaSx_00 6071 3.61 6.11 3.22 62 RELAYCOUNTRY_CA 6010 2.15 6.05 1.54 63 FROM_EXCESS_BASE64 5960 2.99 6.00 2.52 64 RELAYCOUNTRY_FR 5946 1.16 5.98 0.41 65 XM_B_COVIDMETA 5837 2.09 5.87 1.49 66 RCVD_IN_MSPIKE_L3 5747 1.06 5.78 0.31 67 TooManyTo_001 5553 8.03 5.59 8.42 68 T_HTML_TAG_BALANCE_CENTER 5422 0.91 5.45 0.19 69 RELAYCOUNTRY_NG_I 5404 0.74 5.44 0.00 70 XM_H_Long_From01 5279 4.92 5.31 4.85 71 HTML_IMAGE_RATIO_04 5170 11.73 5.20 12.76 72 XM_UB99 5142 0.71 5.17 0.01 73 SpammyFromTLD_01 5124 1.33 5.15 0.73 74 XMNumbers 4987 2.93 5.02 2.60 75 XM_BadFromFormat 4982 0.88 5.01 0.23 76 RCVD_IN_MSPIKE_ZBI 4976 1.11 5.01 0.49 77 XM_B_SpammyTLD 4918 2.09 4.95 1.64 78 BAYES_40 4642 6.04 4.67 6.26 79 ALL_TRUSTED 4594 15.28 4.62 16.95 80 RCVD_IN_MSPIKE_H3 4589 11.61 4.62 12.71 81 XM_B_Phish66 4491 2.21 4.52 1.85 82 KHOP_HELO_FCRDNS 4443 1.92 4.47 1.52 83 HDRS_MISSP 4385 0.65 4.41 0.06 84 XM_DIRTYINTL 4341 1.10 4.37 0.58 85 UNPARSEABLE_RELAY 4281 5.45 4.31 5.63 86 RELAYCOUNTRY_DE 4011 0.87 4.03 0.37 87 MPART_ALT_DIFF 3992 7.49 4.02 8.03 88 HTML_SHORT_LINK_IMG_1 3989 0.63 4.01 0.10 89 HTML_IMAGE_ONLY_08 3974 0.69 4.00 0.17 90 SpammyFromTLD_02 3861 0.80 3.88 0.32 91 HDRS_LCASE_IMGONLY 3847 0.61 3.87 0.10 92 FILL_THIS_FORM 3788 0.67 3.81 0.18 93 XMSubEmpty 3689 0.69 3.71 0.22 94 XM_UB999 3673 0.51 3.69 0.00 95 TR_XM_INV_DKIM 3630 0.67 3.65 0.20 96 BAYES_95 3539 2.30 3.56 2.10 97 XM_SendGrid 3498 4.87 3.52 5.08 98 RELAYCOUNTRY_GB 3494 1.48 3.51 1.16 99 TR_Sbj_FN_Bdy 3467 0.64 3.49 0.19 100 TVD_SPACE_RATIO 3276 0.73 3.30 0.32 101 TM2_M_BODY_EMPTY 3095 0.73 3.11 0.36 102 FROM_SUSPICIOUS_NTLD 3090 0.48 3.11 0.07 103 RCVD_IN_PSBL 3082 0.43 3.10 0.01 104 XMEmptyBody_01 3059 0.50 3.08 0.09 105 FROM_SUSPICIOUS_NTLD_FP 3005 0.47 3.02 0.06 106 TR_XM_MaxSPIKE 3004 0.43 3.02 0.02 107 XMSubNoVowel 2965 3.19 2.98 3.22 108 XM_URI_RBL 2951 0.59 2.97 0.21 109 XM_OfRef7 2948 0.52 2.97 0.14 110 T_TooManySym_01 2939 3.23 2.96 3.28 111 T_XMDrugObfuBody_08 2861 1.63 2.88 1.43 112 XM_UB60 2856 0.49 2.87 0.12 113 TM2_M_URI_OPT_OUT 2833 6.61 2.85 7.20 114 XMStrtUSub 2795 8.27 2.81 9.13 115 MIME_QP_LONG_LINE 2792 4.81 2.81 5.13 116 SCRIPT_GIBBERISH 2782 0.38 2.80 0.00 117 HTML_TAG_BALANCE_CENTER 2743 0.40 2.76 0.03 118 XM_DK_Undo_01 2671 1.65 2.69 1.49 119 FILL_THIS_FORM_LONG 2656 0.41 2.67 0.05 120 XMBody_17 2631 0.99 2.65 0.73 121 TR_XM_PHPDW 2598 1.19 2.61 0.96 122 TR_XM_COVIDMETA1 2586 0.75 2.60 0.45 123 TR_XM_PHPForged 2573 1.17 2.59 0.94 124 TR_XM_FormFill2 2542 1.16 2.56 0.94 125 RCVD_IN_MSPIKE_H4 2537 7.35 2.55 8.10 126 XM_H_PHPOS 2533 1.16 2.55 0.94 127 HK_SCAM 2506 0.38 2.52 0.04 128 XM_UB80 2467 0.37 2.48 0.04 129 TR_Mismatch_TLD_01 2447 0.54 2.46 0.24 130 XM_B_Unsub2 2433 4.17 2.45 4.45 131 HTML_IMAGE_RATIO_06 2425 4.26 2.44 4.55 132 TR_Mismatch_TLD_02 2329 0.39 2.34 0.09 133 MIME_HTML_MOSTLY 2323 2.28 2.34 2.27 134 T_FILL_THIS_FORM_SHORT 2304 0.95 2.32 0.73 135 HTML_IMAGE_RATIO_08 2225 1.93 2.24 1.89 136 RCVD_IN_MSPIKE_L5 2214 0.41 2.23 0.12 137 XMBrknScrpt_02 2118 0.95 2.13 0.77 138 DATE_IN_PAST_06_12 2066 0.45 2.08 0.19 139 URIBL_SBL_A 2051 0.45 2.06 0.20 140 LongTLD 2006 0.45 2.02 0.20 141 URI_PHP_REDIR 1979 0.28 1.99 0.01 142 HTML_IMAGE_ONLY_16 1963 0.46 1.97 0.22 143 DKIM_ADSP_CUSTOM_MED 1918 1.15 1.93 1.03 144 XM_CamelCaseFrm001 1889 1.66 1.90 1.63 145 T_XMDrugObfuBody_14 1852 1.31 1.86 1.23 146 XMDiploma_00 1795 1.61 1.81 1.58 147 MAILING_LIST_MULTI 1784 2.11 1.79 2.16 148 XMStockSpam_06 1772 1.42 1.78 1.36 149 XMSexyCombo_01 1771 0.73 1.78 0.56 150 XM_ShortIntro_01 1769 0.64 1.78 0.47 151 NML_ADSP_CUSTOM_MED 1769 0.89 1.78 0.75 152 MISSING_SUBJECT 1763 0.31 1.77 0.08 153 XMNoSubject 1763 0.31 1.77 0.08 154 T_XMDrugObfuBody_00 1761 0.70 1.77 0.54 155 XM_JunkDunk 1753 0.24 1.76 0.00 156 TR_XM_MaxBayes 1725 0.30 1.74 0.07 157 TR_Symld_Words 1686 1.66 1.70 1.65 158 MIME_CHARSET_FARAWAY 1683 0.31 1.69 0.10 159 TR_XM_RelayPhish 1652 0.33 1.66 0.12 160 XM_Nigeria_01 1631 0.28 1.64 0.06 161 CHARSET_FARAWAY_HEADER 1625 0.26 1.63 0.05 162 DKIM_ADSP_NXDOMAIN 1618 0.69 1.63 0.54 163 URI_HEX 1609 1.29 1.62 1.24 164 T_PDS_OTHER_BAD_TLD 1604 0.33 1.61 0.13 165 TR_XM_FormFill 1595 0.24 1.60 0.03 166 TR_MetaPhish_Combo_01 1586 0.75 1.60 0.62 167 DATE_IN_PAST_03_06 1559 0.31 1.57 0.11 168 BAYES_20 1555 4.48 1.56 4.94 169 TR_LOTS_OF_MONEY3 1548 0.61 1.56 0.46 170 MIME_HTML_ONLY_MULTI 1536 5.55 1.55 6.18 171 XMLngstWrd_00 1534 0.52 1.54 0.35 172 TM2_M_VERY_LONG_WORD 1514 0.99 1.52 0.91 173 XMBody_78 1511 0.46 1.52 0.29 174 XMHTML_After_End 1476 0.92 1.48 0.83 175 RELAYCOUNTRY_IN 1457 0.30 1.47 0.11 176 T_FILL_THIS_FORM_FRAUD_PHISH 1455 0.22 1.46 0.02 177 T_TooManySym_02 1421 1.65 1.43 1.68 178 FORGED_GMAIL_RCVD 1421 0.58 1.43 0.44 179 XM_UB95 1403 0.21 1.41 0.02 180 TR_XM_DK_SendGrid 1386 2.46 1.39 2.63 181 MILLION_HUNDRED 1371 0.20 1.38 0.01 182 XM_Nigeria_02 1365 0.19 1.37 0.01 183 T_XMHurry_00 1354 0.80 1.36 0.71 184 DEAR_SOMETHING 1353 0.37 1.36 0.22 185 XM_OfRef8 1351 0.21 1.36 0.03 186 XM_XX_Yahoo 1339 0.22 1.35 0.04 187 XMGenDplmaNmb 1297 0.78 1.30 0.70 188 T_Symld_Words_02 1229 0.53 1.24 0.42 189 HTML_SHORT_LINK_IMG_2 1218 0.19 1.23 0.03 190 DIET_1 1191 0.55 1.20 0.45 191 T_DEAR_BENEFICIARY 1160 0.62 1.17 0.53 192 URI_NO_WWW_INFO_CGI 1145 0.18 1.15 0.03 193 XMSubMetaSxObfu_03 1112 0.58 1.12 0.50 194 RELAYCOUNTRY_NL 1107 0.33 1.11 0.21 195 XM_PDF 1104 3.35 1.11 3.70 196 PDS_OTHER_BAD_TLD 1099 0.19 1.11 0.05 197 RDNS_DYNAMIC 1093 0.41 1.10 0.30 198 XMLngstWrd_01 1084 0.42 1.09 0.32 199 XM_H_PHPMailer 1082 0.55 1.09 0.47 200 FROM_MISSP_REPLYTO 1058 0.15 1.06 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 622119 98.29 97.51 98.41 2 HTML_MESSAGE 550620 87.28 88.37 87.10 3 RELAYCOUNTRY_US 501350 76.60 59.35 79.31 4 XM_B_Unicode 424438 66.61 63.24 67.14 5 DKIM_SIGNED 415210 65.30 62.90 65.68 6 XM_DK_Pass 408048 64.03 60.74 64.55 7 DKIM_VALID 382380 59.03 49.76 60.49 8 BAYES_50 315676 48.65 40.47 49.94 9 DKIM_VALID_AU 287565 44.14 35.54 45.49 10 XMListUnsubscribeExists 270284 43.90 51.16 42.76 11 XM_B_Unicode3 248740 38.43 32.63 39.35 12 T_TM2_M_HEADER_IN_MSG 157571 24.21 19.63 24.93 13 DKIM_VALID_EF 155565 24.69 25.21 24.61 14 MIME_HTML_ONLY 146950 24.90 35.38 23.25 15 HTML_FONT_LOW_CONTRAST 144948 22.70 21.26 22.93 16 RCVD_IN_MSPIKE_WL 138585 19.93 7.25 21.92 17 RCVD_IN_MSPIKE_H2 130244 20.74 21.61 20.60 18 LOC_TINY_FONT_1 125707 20.36 23.37 19.89 19 XMSubLong 125147 20.59 25.61 19.80 20 FVGT_m_MULTI_ODD 117103 19.25 23.84 18.52 21 BAYES_00 114819 15.82 0.94 18.16 22 ALL_TRUSTED 107155 15.28 4.62 16.95 23 T_KAM_HTML_FONT_INVALID 97523 15.60 16.67 15.43 24 HTML_IMAGE_RATIO_04 80677 11.73 5.20 12.76 25 RCVD_IN_MSPIKE_H3 80353 11.61 4.62 12.71 26 XM_Multi_Part_URI 77939 12.50 13.60 12.33 27 XM_Body_Dirty_Words 77223 12.82 16.65 12.22 28 XM_B_Unsub 75511 11.74 10.47 11.95 29 XM_H_Trusted_IP 64851 8.86 0.00 10.26 30 HTML_FONT_FACE_BAD 64033 8.84 0.64 10.13 31 XM_DK_Undo_02 61590 14.06 41.52 9.74 32 XMStrtUSub 57708 8.27 2.81 9.13 33 XM_Evil_Numbers_Gen 56541 9.00 9.33 8.94 34 TooManyTo_001 53226 8.03 5.59 8.42 35 RCVD_IN_MSPIKE_H4 51218 7.35 2.55 8.10 36 LOTS_OF_MONEY 50975 9.82 21.02 8.06 37 MPART_ALT_DIFF 50792 7.49 4.02 8.03 38 IN_ZIMBRA_NJ_WHITELIST 47468 6.49 0.03 7.51 39 TR_XM_DK_Bayes 46815 6.46 0.45 7.41 40 LotsOfNums_01 46019 7.36 7.89 7.28 41 TM2_M_URI_OPT_OUT 45495 6.61 2.85 7.20 42 ANY_BOUNCE_MESSAGE 45034 6.27 0.81 7.12 43 BOUNCE_MESSAGE 45031 6.27 0.81 7.12 44 TR_XM_DK_Bayes1 43543 5.98 0.23 6.89 45 BAYES_40 39558 6.04 4.67 6.26 46 XM_DKIMWhitelistDomains 39539 5.41 0.01 6.25 47 MIME_HTML_ONLY_MULTI 39049 5.55 1.55 6.18 48 TR_XM_DK_Bayes2 38394 5.28 0.21 6.07 49 BAYES_99 37965 9.80 33.93 6.01 50 XM_B_Phish_Phrases 37100 6.43 9.99 5.87 51 RCVD_IN_RP_SAFE 36628 5.07 0.46 5.79 52 UNPARSEABLE_RELAY 35576 5.45 4.31 5.63 53 RCVD_IN_RP_CERTIFIED 34552 4.75 0.23 5.47 54 BAYES_60 33885 5.63 7.34 5.36 55 RELAYCOUNTRY_META 33495 8.84 31.36 5.30 56 HTML_IMAGE_RATIO_02 33321 5.68 8.27 5.27 57 DKIM_INVALID 32830 6.27 13.14 5.19 58 MIME_QP_LONG_LINE 32422 4.81 2.81 5.13 59 XM_SendGrid 32140 4.87 3.52 5.08 60 BAYES_20 31236 4.48 1.56 4.94 61 XM_H_Long_From01 30685 4.92 5.31 4.85 62 BAYES_999 29916 7.81 27.37 4.73 63 HTML_IMAGE_RATIO_06 28736 4.26 2.44 4.55 64 XM_B_Unsub2 28103 4.17 2.45 4.45 65 BOTNET_IPINHOSTNAME 27748 5.95 15.84 4.39 66 RCVD_IN_IADB_LISTED 27025 3.81 0.85 4.28 67 XMSexyCombo_05 26203 4.95 10.09 4.15 68 BAYES_05 23843 3.37 0.81 3.77 69 RCVD_IN_IADB_SPF 23614 3.33 0.75 3.74 70 XM_PDF 23389 3.35 1.11 3.70 71 BAYES_80 21859 3.90 6.71 3.46 72 T_TooManySym_01 20709 3.23 2.96 3.28 73 RCVD_IN_IADB_DK 20511 2.90 0.72 3.24 74 RCVD_IN_IADB_SENDERID 20509 2.90 0.72 3.24 75 XMSubMetaSx_00 20347 3.61 6.11 3.22 76 XMSubNoVowel 20338 3.19 2.98 3.22 77 T_REMOTE_IMAGE 20134 4.10 9.93 3.19 78 TR_XM_PhishingBody 19104 3.51 6.62 3.02 79 HTML_MIME_NO_HTML_TAG 18505 4.13 11.80 2.93 80 NO_DNS_FOR_FROM 18400 3.95 10.56 2.91 81 BOTNET 18317 6.15 26.81 2.90 82 XM_UncommonTLD01 17989 4.35 13.94 2.85 83 TR_XM_DK_SendGrid 16595 2.46 1.39 2.63 84 RCVD_IN_IADB_VOUCHED 16592 2.31 0.31 2.62 85 XMNumbers 16412 2.93 5.02 2.60 86 FROM_EXCESS_BASE64 15942 2.99 6.00 2.52 87 MIME_HTML_MOSTLY 14350 2.28 2.34 2.27 88 MAILING_LIST_MULTI 13664 2.11 1.79 2.16 89 BAYES_95 13266 2.30 3.56 2.10 90 HELO_NODOT 12579 3.02 9.57 1.99 91 HELO_NO_DOMAIN 12578 3.02 9.57 1.99 92 HTML_IMAGE_RATIO_08 11919 1.93 2.24 1.89 93 UNTRUSTED_Relay 11885 5.39 27.71 1.88 94 SUBJ_ALL_CAPS 11728 2.54 6.93 1.86 95 XM_B_Phish66 11665 2.21 4.52 1.85 96 TooManyTo_002 11042 1.61 0.72 1.75 97 T_TooManySym_02 10615 1.65 1.43 1.68 98 TR_Symld_Words 10431 1.66 1.70 1.65 99 XM_B_SpammyTLD 10395 2.09 4.95 1.64 100 XM_CamelCaseFrm001 10287 1.66 1.90 1.63 101 RCVD_IN_IADB_OPTIN 10048 1.41 0.27 1.59 102 XMDiploma_00 9996 1.61 1.81 1.58 103 RELAYCOUNTRY_CA 9744 2.15 6.05 1.54 104 KHOP_HELO_FCRDNS 9633 1.92 4.47 1.52 105 XM_B_COVIDMETA 9445 2.09 5.87 1.49 106 XM_DK_Undo_01 9435 1.65 2.69 1.49 107 XM_SPF_SoftFail 9298 2.13 6.30 1.47 108 T_XMDrugObfuBody_08 9041 1.63 2.88 1.43 109 XMStockSpam_06 8587 1.42 1.78 1.36 110 TVD_RCVD_IP 8544 1.22 0.41 1.35 111 URI_HEX 7829 1.29 1.62 1.24 112 T_XMDrugObfuBody_14 7757 1.31 1.86 1.23 113 IN_HORDE_ADDRESS_BOOK 7719 1.06 0.04 1.22 114 RCVD_IN_BL_SPAMCOP_NET 7660 2.51 10.80 1.21 115 XM_UB50 7641 2.71 12.23 1.21 116 XMSubLongNoVowel 7570 1.08 0.30 1.20 117 XMSubGarbage 7548 1.04 0.07 1.19 118 TR_XM_COVIDMETA4 7467 2.25 9.08 1.18 119 INVALID_MSGID 7435 1.09 0.58 1.18 120 RELAYCOUNTRY_GB 7344 1.48 3.51 1.16 121 TooManyTo_003 7254 1.07 0.57 1.15 122 URI_TRY_3LD 7234 1.11 0.86 1.14 123 XM_GoogleGroups 7177 1.04 0.44 1.14 124 RCVD_IN_MSPIKE_H5 7014 0.97 0.08 1.11 125 XMCapTrack 6541 0.99 0.69 1.03 126 TO_MALFORMED 6518 0.90 0.05 1.03 127 MISSING_HEADERS 6485 2.25 10.00 1.03 128 DKIM_ADSP_CUSTOM_MED 6485 1.15 1.93 1.03 129 RCVD_IN_MSPIKE_BL 6274 2.74 13.83 0.99 130 XM_OfRef6 6111 1.67 6.16 0.97 131 TR_XM_PHPDW 6078 1.19 2.61 0.96 132 TR_XM_PHPForged 5968 1.17 2.59 0.94 133 TR_XM_FormFill2 5953 1.16 2.56 0.94 134 XM_H_PHPOS 5919 1.16 2.55 0.94 135 TM2_M_VERY_LONG_WORD 5735 0.99 1.52 0.91 136 XM_E_Blogspot 5299 0.74 0.09 0.84 137 TooManyTo_004 5294 0.79 0.47 0.84 138 XMHTML_After_End 5263 0.92 1.48 0.83 139 TR_MSPIKEBAYES00 5172 0.71 0.01 0.82 140 XM_H_Long_From02 5159 0.80 0.73 0.82 141 USER_IN_DEF_DKIM_WL 5120 0.70 0.01 0.81 142 T_OBFU_PDF_ATTACH 5059 0.72 0.22 0.80 143 XMGappySubj_01 5045 0.72 0.19 0.80 144 XMBrknScrpt_02 4868 0.95 2.13 0.77 145 XM_ProductURIs 4755 0.74 0.65 0.75 146 NML_ADSP_CUSTOM_MED 4751 0.89 1.78 0.75 147 T_FILL_THIS_FORM_SHORT 4646 0.95 2.32 0.73 148 SpammyFromTLD_01 4606 1.33 5.15 0.73 149 XMBody_17 4599 0.99 2.65 0.73 150 T_XMHurry_00 4506 0.80 1.36 0.71 151 TooManyTo_005 4401 0.66 0.40 0.70 152 XMGenDplmaNmb 4395 0.78 1.30 0.70 153 FROM_GOV_DKIM_AU 4142 0.58 0.09 0.66 154 XM_RXBody 4089 0.61 0.34 0.65 155 XMBdyGiftCard01 3990 0.64 0.72 0.63 156 REPLYTO_WITHOUT_TO_CC 3951 1.87 9.78 0.63 157 TR_MetaPhish_Combo_01 3904 0.75 1.60 0.62 158 TO_NO_BRKTS_HTML_ONLY 3801 0.59 0.51 0.60 159 TR_LOTS_OF_MONEY1 3791 1.83 9.65 0.60 160 XMSubMetaI_00 3786 0.64 0.88 0.60 161 HTTPS_HTTP_MISMATCH 3717 0.60 0.71 0.59 162 XM_DIRTYINTL 3677 1.10 4.37 0.58 163 MONEY_FORM_SHORT 3656 0.61 0.83 0.58 164 XMSexyCombo_01 3571 0.73 1.78 0.56 165 XMMoneyMeta_00 3558 0.57 0.64 0.56 166 DKIM_ADSP_NXDOMAIN 3434 0.69 1.63 0.54 167 T_XMDrugObfuBody_00 3393 0.70 1.77 0.54 168 T_DEAR_BENEFICIARY 3352 0.62 1.17 0.53 169 XM_SPF_Unknown 3297 0.53 0.56 0.52 170 T_TooManySym_03 3284 0.58 0.94 0.52 171 XMSubMetaSxObfu_03 3147 0.58 1.12 0.50 172 RCVD_IN_MSPIKE_ZBI 3112 1.11 5.01 0.49 173 XM_H_PHPMailer 2964 0.55 1.09 0.47 174 XM_ShortIntro_01 2947 0.64 1.78 0.47 175 TR_LOTS_OF_MONEY3 2886 0.61 1.56 0.46 176 TR_XM_COVIDMETA1 2865 0.75 2.60 0.45 177 FROM_GOV_SPOOF 2830 0.43 0.35 0.45 178 DIET_1 2830 0.55 1.20 0.45 179 HELO_MISC_IP 2812 0.45 0.46 0.44 180 CK_HELO_DYNAMIC_SPLIT_IP 2808 0.44 0.43 0.44 181 FORGED_GMAIL_RCVD 2795 0.58 1.43 0.44 182 RCVD_IN_SORBS_DUL 2763 0.44 0.47 0.44 183 T_Symld_Words_02 2673 0.53 1.24 0.42 184 XMBody_95 2664 0.37 0.06 0.42 185 XMNoVowels 2581 0.49 0.98 0.41 186 XM_B_REG_HTML 2578 0.38 0.17 0.41 187 RELAYCOUNTRY_FR 2564 1.16 5.98 0.41 188 TR_BOTNET_NEGATE 2557 0.40 0.38 0.40 189 XMPhish30 2543 0.45 0.77 0.40 190 MPART_ALT_DIFF_COUNT 2456 0.41 0.58 0.39 191 XMPhish08 2425 0.43 0.73 0.38 192 XM_B_COPY_HTML 2415 0.38 0.37 0.38 193 XMPhish14 2385 0.42 0.68 0.38 194 RELAYCOUNTRY_DE 2365 0.87 4.03 0.37 195 HTML_TAG_BALANCE_BODY 2343 0.38 0.46 0.37 196 RELAYCOUNTRY_AU 2310 0.38 0.45 0.37 197 HTML_IMAGE_ONLY_32 2309 0.33 0.13 0.37 198 HTML_IMAGE_ONLY_20 2297 0.37 0.39 0.36 199 NUMERIC_HTTP_ADDR 2284 0.37 0.46 0.36 200 TM2_M_BODY_EMPTY 2254 0.73 3.11 0.36 ----------------------------------------------------------------------