Email: 678822 Autolearn: 0 AvgScore: 0.56 AvgScanTime: 1.81 sec Spam: 100989 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 3.46 sec Ham: 577833 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 1.53 sec Time Spent Running SA: 342.03 hours Time Spent Processing Spam: 97.17 hours Time Spent Processing Ham: 244.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 98231 98.02 97.27 98.15 2 HTML_MESSAGE 92615 86.53 91.71 85.63 3 DKIM_SIGNED 66377 71.67 65.73 72.71 4 RELAYCOUNTRY_US 63903 76.03 63.28 78.26 5 XM_DK_Pass 63452 70.22 62.83 71.51 6 XM_B_Unicode 63231 65.24 62.61 65.70 7 DKIM_VALID 52791 65.18 52.27 67.44 8 XMListUnsubscribeExists 51786 48.72 51.28 48.27 9 BAYES_50 46158 50.93 45.71 51.84 10 XM_DK_Undo_02 42084 15.77 41.67 11.25 11 DKIM_VALID_AU 39268 48.82 38.88 50.55 12 MIME_HTML_ONLY 38146 22.76 37.77 20.13 13 RELAYCOUNTRY_META 35506 10.79 35.16 6.53 14 BOTNET 34130 7.63 33.80 3.06 15 XM_B_Unicode3 33989 36.86 33.66 37.42 16 XMSubLong 31927 21.79 31.61 20.07 17 BAYES_99 30619 10.71 30.32 7.28 18 FVGT_m_MULTI_ODD 27307 21.44 27.04 20.46 19 DKIM_VALID_EF 27276 27.10 27.01 27.11 20 UNTRUSTED_Relay 26858 6.29 26.59 2.74 21 LOC_TINY_FONT_1 25001 23.07 24.76 22.77 22 BAYES_999 23940 8.43 23.71 5.75 23 XM_Body_Dirty_Words 23581 13.87 23.35 12.22 24 RCVD_IN_MSPIKE_H2 22551 23.38 22.33 23.56 25 T_TM2_M_HEADER_IN_MSG 21732 26.55 21.52 27.43 26 HTML_FONT_LOW_CONTRAST 20918 23.66 20.71 24.17 27 LOTS_OF_MONEY 18761 10.09 18.58 8.60 28 XMSexyCombo_05 17630 5.90 17.46 3.88 29 BOTNET_IPINHOSTNAME 17523 6.69 17.35 4.83 30 T_KAM_HTML_FONT_INVALID 17239 17.46 17.07 17.52 31 XM_UncommonTLD01 16319 5.00 16.16 3.05 32 XM_Multi_Part_URI 14894 13.72 14.75 13.54 33 XM_UB50 13783 3.07 13.65 1.22 34 DKIM_INVALID 13586 6.49 13.45 5.28 35 XM_B_Unsub 12538 12.53 12.42 12.55 36 HTML_MIME_NO_HTML_TAG 12527 3.74 12.40 2.22 37 HTML_IMAGE_RATIO_02 11046 7.17 10.94 6.52 38 BOTNET_NORDNS 10449 1.57 10.35 0.03 39 XM_B_Phish_Phrases 10066 7.14 9.97 6.65 40 NO_DNS_FOR_FROM 10014 3.72 9.92 2.63 41 XM_DIRTYINTL 9983 1.99 9.89 0.61 42 RCVD_IN_MSPIKE_BL 9426 1.87 9.33 0.57 43 LotsOfNums_01 8896 8.35 8.81 8.27 44 FROM_EXCESS_BASE64 8713 3.68 8.63 2.81 45 T_REMOTE_IMAGE 8697 4.36 8.61 3.62 46 SUBJ_ALL_CAPS 8494 2.41 8.41 1.37 47 SpammyFromTLD_02 8263 1.54 8.18 0.38 48 TR_XM_PhishingBody 8129 4.15 8.05 3.47 49 XM_Evil_Numbers_Gen 8117 7.97 8.04 7.96 50 XM_SPF_SoftFail 7740 2.59 7.66 1.70 51 REPLYTO_WITHOUT_TO_CC 7534 1.85 7.46 0.87 52 RCVD_IN_BL_SPAMCOP_NET 7492 2.34 7.42 1.46 53 XM_OfRef6 7451 1.96 7.38 1.01 54 TR_LOTS_OF_MONEY3 7325 2.23 7.25 1.35 55 MPART_ALT_DIFF 7282 5.09 7.21 4.72 56 HELO_NODOT 7270 2.94 7.20 2.20 57 HELO_NO_DOMAIN 7270 2.94 7.20 2.20 58 MISSING_HEADERS 6899 2.06 6.83 1.23 59 RELAYCOUNTRY_CA 6879 2.45 6.81 1.68 60 BAYES_80 6842 4.42 6.77 4.01 61 TooManyTo_001 6795 7.88 6.73 8.08 62 XMSubEmpty 6598 1.18 6.53 0.25 63 TR_LOTS_OF_MONEY1 6545 1.64 6.48 0.79 64 XMSubMetaSx_00 6396 3.65 6.33 3.18 65 BAYES_60 6353 6.11 6.29 6.07 66 RCVD_IN_MSPIKE_WL 6253 21.52 6.19 24.20 67 BODY_URI_ONLY 6092 1.08 6.03 0.22 68 XM_OfRef7 5943 0.97 5.88 0.11 69 XM_B_SpammyTLD 5940 2.26 5.88 1.63 70 HTML_TAG_BALANCE_CENTER 5935 0.95 5.88 0.08 71 XM_B_Phish66 5840 2.50 5.78 1.93 72 HDRS_MISSP 5798 0.87 5.74 0.02 73 TR_XM_COVIDMETA4 5794 1.48 5.74 0.73 74 XM_B_COVIDMETA 5717 2.19 5.66 1.58 75 XM_UB99 5697 0.84 5.64 0.01 76 XM_DK_Undo_01 5620 2.31 5.56 1.74 77 RCVD_IN_RP_RNBL 5534 0.86 5.48 0.06 78 UNPARSEABLE_RELAY 5526 6.78 5.47 7.01 79 KHOP_HELO_FCRDNS 5205 2.24 5.15 1.73 80 FILL_THIS_FORM 5043 0.90 4.99 0.19 81 RELAYCOUNTRY_FR 5020 1.09 4.97 0.41 82 TR_Sbj_FN_Bdy 5002 0.95 4.95 0.25 83 XM_H_Long_From01 4985 5.41 4.94 5.49 84 RCVD_IN_MSPIKE_L3 4831 1.06 4.78 0.41 85 XMLngstWrd_00 4729 0.98 4.68 0.33 86 MILLION_HUNDRED 4672 0.70 4.63 0.01 87 XMNoSubject 4648 0.76 4.60 0.09 88 MISSING_SUBJECT 4648 0.76 4.60 0.09 89 FILL_THIS_FORM_LONG 4592 0.72 4.55 0.06 90 XM_OfRef8 4542 0.69 4.50 0.03 91 SpammyFromTLD_01 4380 1.40 4.34 0.89 92 HTML_IMAGE_RATIO_04 4256 5.14 4.21 5.31 93 XM_UB999 4234 0.63 4.19 0.00 94 XMNumbers 4191 3.09 4.15 2.91 95 RELAYCOUNTRY_UG 4185 1.27 4.14 0.77 96 T_FILL_THIS_FORM_SHORT 3880 1.35 3.84 0.92 97 SCRIPT_GIBBERISH 3844 0.57 3.81 0.00 98 RELAYCOUNTRY_DE 3819 0.95 3.78 0.46 99 XMBody_17 3804 1.20 3.77 0.75 100 BAYES_95 3749 2.67 3.71 2.49 101 RCVD_IN_MSPIKE_H3 3733 12.60 3.70 14.16 102 TR_XM_INV_DKIM 3732 0.69 3.70 0.17 103 XMLngstWrd_01 3692 0.79 3.66 0.29 104 RCVD_IN_PSBL 3555 0.53 3.52 0.01 105 XM_SendGrid 3529 5.92 3.49 6.35 106 T_XMDrugObfuBody_14 3395 1.92 3.36 1.67 107 XMSubNoVowel 3382 1.22 3.35 0.85 108 TR_XM_MaxSPIKE 3239 0.51 3.21 0.03 109 XM_URI_RBL 3183 0.68 3.15 0.25 110 TM2_M_URI_OPT_OUT 3125 7.43 3.09 8.19 111 MIME_HTML_MOSTLY 3113 2.42 3.08 2.31 112 PDS_OTHER_BAD_TLD 3086 0.62 3.06 0.19 113 FROM_SUSPICIOUS_NTLD 2980 0.50 2.95 0.07 114 TR_XM_PHPDW 2975 1.00 2.95 0.66 115 TR_XM_PHPForged 2945 0.98 2.92 0.64 116 TR_XM_FormFill2 2911 0.97 2.88 0.64 117 XM_H_PHPOS 2906 0.96 2.88 0.63 118 HTML_SHORT_LINK_IMG_1 2855 0.57 2.83 0.17 119 FROM_SUSPICIOUS_NTLD_FP 2846 0.47 2.82 0.06 120 HDRS_LCASE_IMGONLY 2769 0.56 2.74 0.18 121 MIME_QP_LONG_LINE 2757 4.92 2.73 5.30 122 XMStrtUSub 2663 4.75 2.64 5.12 123 HTML_IMAGE_RATIO_06 2598 3.39 2.57 3.54 124 XMLngstWrd_02 2590 0.57 2.56 0.22 125 HTML_IMAGE_RATIO_08 2496 2.16 2.47 2.10 126 BAYES_40 2480 5.17 2.46 5.65 127 RCVD_IN_MSPIKE_H4 2411 7.79 2.39 8.73 128 XM_UB60 2410 0.47 2.39 0.13 129 ALL_TRUSTED 2408 14.83 2.38 17.00 130 XM_BadFromFormat 2394 0.45 2.37 0.12 131 MIME_HEADER_CTYPE_ONLY 2339 0.54 2.32 0.23 132 DKIM_ADSP_CUSTOM_MED 2311 1.45 2.29 1.31 133 RCVD_IN_MSPIKE_L5 2256 0.41 2.23 0.09 134 T_TooManySym_01 2237 3.34 2.22 3.54 135 TO_EQ_FM_DOM_HTML_IMG 2199 0.34 2.18 0.02 136 SHORTENER_SHORT_IMG 2194 0.32 2.17 0.00 137 PLING_QUERY 2184 0.68 2.16 0.42 138 T_XMDrugObfuBody_08 2169 1.62 2.15 1.53 139 XM_UB80 2160 0.36 2.14 0.05 140 XM_CamelCaseFrm001 2154 1.97 2.13 1.94 141 NML_ADSP_CUSTOM_MED 2150 1.18 2.13 1.01 142 RELAYCOUNTRY_IT 2094 0.37 2.07 0.07 143 TR_XM_COVIDMETA1 2059 0.66 2.04 0.42 144 XMBrknScrpt_02 2028 1.07 2.01 0.91 145 XMDiploma_00 1986 1.90 1.97 1.88 146 RELAYCOUNTRY_GB 1983 1.28 1.96 1.16 147 RELAYCOUNTRY_NG_I 1979 0.31 1.96 0.02 148 XM_JunkDunk 1976 0.29 1.96 0.00 149 XM_B_Unsub2 1960 4.43 1.94 4.87 150 RELAYCOUNTRY_NL 1955 0.43 1.94 0.17 151 FORGED_GMAIL_RCVD 1940 0.84 1.92 0.65 152 HK_RANDOM_REPLYTO 1936 0.47 1.92 0.22 153 MAILING_LIST_MULTI 1921 2.34 1.90 2.41 154 XMHTML_After_End 1824 1.37 1.81 1.29 155 TR_XM_RelayPhish 1810 0.40 1.79 0.16 156 BAYES_05 1799 3.20 1.78 3.45 157 XM_XX_Yahoo 1788 0.29 1.77 0.04 158 TM2_M_VERY_LONG_WORD 1778 1.19 1.76 1.09 159 XMDateMe_00 1775 0.56 1.76 0.35 160 DATE_IN_PAST_12_24 1742 0.33 1.72 0.09 161 HTML_IMAGE_ONLY_16 1698 0.45 1.68 0.23 162 URI_HEX 1674 1.55 1.66 1.53 163 RDNS_DYNAMIC 1662 0.53 1.65 0.34 164 FROM_MISSP_REPLYTO 1637 0.25 1.62 0.01 165 BAYES_20 1607 3.73 1.59 4.10 166 CTYPE_NULL 1548 0.23 1.53 0.00 167 TR_Symld_Words 1531 1.63 1.52 1.65 168 MIME_HTML_ONLY_MULTI 1518 2.62 1.50 2.82 169 XM_H_PHPMailer 1516 0.79 1.50 0.67 170 RCVD_IN_MSPIKE_ZBI 1516 0.25 1.50 0.03 171 TR_XM_DK_SendGrid 1514 3.03 1.50 3.30 172 XMSexyCombo_01 1480 0.64 1.47 0.50 173 LongTLD 1472 0.37 1.46 0.18 174 SHORT_URI_2 1425 0.25 1.41 0.04 175 T_XMDrugObfuBody_00 1414 0.92 1.40 0.84 176 DATE_IN_PAST_06_12 1414 0.26 1.40 0.06 177 XM_UB95 1387 0.23 1.37 0.03 178 SHORT_SHORTNER 1385 0.22 1.37 0.01 179 ADVANCE_FEE_2_NEW_MONEY 1383 0.21 1.37 0.01 180 DKIM_ADSP_NXDOMAIN 1372 0.43 1.36 0.27 181 BAYES_00 1369 13.07 1.36 15.12 182 URIBL_SBL_A 1366 0.36 1.35 0.19 183 URI_TRY_3LD 1341 1.26 1.33 1.25 184 XM_H_PHPOS_M 1341 0.49 1.33 0.34 185 HTML_FONT_TINY_NORDNS 1326 0.45 1.31 0.30 186 HTML_IMAGE_ONLY_12 1300 0.35 1.29 0.19 187 XMGenDplmaNmb 1296 0.94 1.28 0.89 188 RELAYCOUNTRY_BR 1261 0.21 1.25 0.03 189 XMStockSpam_06 1256 0.80 1.24 0.72 190 FSL_THIS_IS_ADV 1256 0.45 1.24 0.31 191 MIME_CHARSET_FARAWAY 1236 0.29 1.22 0.12 192 TR_Mismatch_TLD_02 1209 0.25 1.20 0.09 193 TR_MetaPhish_Combo_01 1189 0.77 1.18 0.70 194 HTML_SHORT_LINK_IMG_2 1175 0.21 1.16 0.04 195 HTML_IMAGE_ONLY_04 1171 0.23 1.16 0.07 196 XMBody_78 1145 0.55 1.13 0.45 197 TVD_RCVD_IP 1140 1.43 1.13 1.49 198 RELAYCOUNTRY_IN 1135 0.27 1.12 0.12 199 XMMoneyMeta_00 1135 0.79 1.12 0.73 200 ADMITS_SPAM 1131 0.22 1.12 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 567127 98.02 97.27 98.15 2 HTML_MESSAGE 494793 86.53 91.71 85.63 3 RELAYCOUNTRY_US 452229 76.03 63.28 78.26 4 DKIM_SIGNED 420162 71.67 65.73 72.71 5 XM_DK_Pass 413197 70.22 62.83 71.51 6 DKIM_VALID 389679 65.18 52.27 67.44 7 XM_B_Unicode 379610 65.24 62.61 65.70 8 BAYES_50 299539 50.93 45.71 51.84 9 DKIM_VALID_AU 292121 48.82 38.88 50.55 10 XMListUnsubscribeExists 278933 48.72 51.28 48.27 11 XM_B_Unicode3 216208 36.86 33.66 37.42 12 T_TM2_M_HEADER_IN_MSG 158501 26.55 21.52 27.43 13 DKIM_VALID_EF 156669 27.10 27.01 27.11 14 RCVD_IN_MSPIKE_WL 139810 21.52 6.19 24.20 15 HTML_FONT_LOW_CONTRAST 139691 23.66 20.71 24.17 16 RCVD_IN_MSPIKE_H2 136140 23.38 22.33 23.56 17 LOC_TINY_FONT_1 131573 23.07 24.76 22.77 18 FVGT_m_MULTI_ODD 118224 21.44 27.04 20.46 19 MIME_HTML_ONLY 116339 22.76 37.77 20.13 20 XMSubLong 115981 21.79 31.61 20.07 21 T_KAM_HTML_FONT_INVALID 101264 17.46 17.07 17.52 22 ALL_TRUSTED 98237 14.83 2.38 17.00 23 BAYES_00 87343 13.07 1.36 15.12 24 RCVD_IN_MSPIKE_H3 81826 12.60 3.70 14.16 25 XM_Multi_Part_URI 78264 13.72 14.75 13.54 26 XM_B_Unsub 72493 12.53 12.42 12.55 27 XM_Body_Dirty_Words 70601 13.87 23.35 12.22 28 XM_DK_Undo_02 64995 15.77 41.67 11.25 29 RCVD_IN_MSPIKE_H4 50472 7.79 2.39 8.73 30 LOTS_OF_MONEY 49712 10.09 18.58 8.60 31 LotsOfNums_01 47779 8.35 8.81 8.27 32 TM2_M_URI_OPT_OUT 47337 7.43 3.09 8.19 33 TooManyTo_001 46696 7.88 6.73 8.08 34 TR_XM_DK_Bayes 46237 6.88 0.49 8.00 35 XM_Evil_Numbers_Gen 45989 7.97 8.04 7.96 36 IN_ZIMBRA_NJ_WHITELIST 44681 6.59 0.03 7.73 37 ANY_BOUNCE_MESSAGE 43102 6.48 0.88 7.46 38 BOUNCE_MESSAGE 43094 6.48 0.88 7.46 39 TR_XM_DK_Bayes1 43053 6.39 0.30 7.45 40 BAYES_99 42050 10.71 30.32 7.28 41 RCVD_IN_RP_SAFE 40925 6.09 0.44 7.08 42 UNPARSEABLE_RELAY 40484 6.78 5.47 7.01 43 XM_B_Phish_Phrases 38405 7.14 9.97 6.65 44 TR_XM_DK_Bayes2 38362 5.68 0.22 6.64 45 RCVD_IN_RP_CERTIFIED 38043 5.63 0.19 6.58 46 RELAYCOUNTRY_META 37740 10.79 35.16 6.53 47 HTML_IMAGE_RATIO_02 37648 7.17 10.94 6.52 48 XM_DKIMWhitelistDomains 37247 5.49 0.01 6.45 49 XM_SendGrid 36690 5.92 3.49 6.35 50 BAYES_60 35098 6.11 6.29 6.07 51 BAYES_999 33253 8.43 23.71 5.75 52 BAYES_40 32625 5.17 2.46 5.65 53 XM_H_Long_From01 31730 5.41 4.94 5.49 54 HTML_IMAGE_RATIO_04 30655 5.14 4.21 5.31 55 MIME_QP_LONG_LINE 30645 4.92 2.73 5.30 56 DKIM_INVALID 30483 6.49 13.45 5.28 57 XMStrtUSub 29570 4.75 2.64 5.12 58 RCVD_IN_IADB_LISTED 29185 4.41 0.72 5.05 59 XM_B_Unsub2 28140 4.43 1.94 4.87 60 BOTNET_IPINHOSTNAME 27908 6.69 17.35 4.83 61 MPART_ALT_DIFF 27295 5.09 7.21 4.72 62 RCVD_IN_IADB_SPF 25349 3.83 0.66 4.39 63 XM_PDF 23746 3.66 1.06 4.11 64 BAYES_20 23719 3.73 1.59 4.10 65 BAYES_80 23154 4.42 6.77 4.01 66 XMSexyCombo_05 22393 5.90 17.46 3.88 67 RCVD_IN_IADB_SENDERID 22132 3.36 0.64 3.83 68 RCVD_IN_IADB_DK 22043 3.34 0.64 3.81 69 T_REMOTE_IMAGE 20911 4.36 8.61 3.62 70 HTML_IMAGE_RATIO_06 20435 3.39 2.57 3.54 71 T_TooManySym_01 20430 3.34 2.22 3.54 72 TR_XM_PhishingBody 20047 4.15 8.05 3.47 73 BAYES_05 19911 3.20 1.78 3.45 74 TR_XM_DK_SendGrid 19061 3.03 1.50 3.30 75 XMSubMetaSx_00 18372 3.65 6.33 3.18 76 RCVD_IN_IADB_VOUCHED 18233 2.72 0.23 3.16 77 BOTNET 17660 7.63 33.80 3.06 78 XM_UncommonTLD01 17631 5.00 16.16 3.05 79 XMNumbers 16817 3.09 4.15 2.91 80 MIME_HTML_ONLY_MULTI 16271 2.62 1.50 2.82 81 FROM_EXCESS_BASE64 16242 3.68 8.63 2.81 82 UNTRUSTED_Relay 15818 6.29 26.59 2.74 83 NO_DNS_FOR_FROM 15216 3.72 9.92 2.63 84 BAYES_95 14390 2.67 3.71 2.49 85 MAILING_LIST_MULTI 13941 2.34 1.90 2.41 86 MIME_HTML_MOSTLY 13333 2.42 3.08 2.31 87 HTML_MIME_NO_HTML_TAG 12840 3.74 12.40 2.22 88 HELO_NODOT 12706 2.94 7.20 2.20 89 HELO_NO_DOMAIN 12705 2.94 7.20 2.20 90 XM_H_Trusted_IP 12480 1.84 0.00 2.16 91 HTML_IMAGE_RATIO_08 12162 2.16 2.47 2.10 92 RCVD_IN_IADB_OPTIN 11635 1.75 0.24 2.01 93 XM_CamelCaseFrm001 11192 1.97 2.13 1.94 94 XM_B_Phish66 11129 2.50 5.78 1.93 95 TooManyTo_002 10882 1.72 0.76 1.88 96 XMDiploma_00 10879 1.90 1.97 1.88 97 T_TooManySym_02 10259 1.67 1.04 1.78 98 XM_DK_Undo_01 10041 2.31 5.56 1.74 99 KHOP_HELO_FCRDNS 9972 2.24 5.15 1.73 100 XM_SPF_SoftFail 9844 2.59 7.66 1.70 101 RELAYCOUNTRY_CA 9720 2.45 6.81 1.68 102 T_XMDrugObfuBody_14 9642 1.92 3.36 1.67 103 TR_Symld_Words 9524 1.63 1.52 1.65 104 XM_B_SpammyTLD 9413 2.26 5.88 1.63 105 XM_B_COVIDMETA 9136 2.19 5.66 1.58 106 URI_HEX 8848 1.55 1.66 1.53 107 T_XMDrugObfuBody_08 8819 1.62 2.15 1.53 108 TVD_RCVD_IP 8582 1.43 1.13 1.49 109 RCVD_IN_BL_SPAMCOP_NET 8419 2.34 7.42 1.46 110 SUBJ_ALL_CAPS 7894 2.41 8.41 1.37 111 TR_LOTS_OF_MONEY3 7828 2.23 7.25 1.35 112 DKIM_ADSP_CUSTOM_MED 7553 1.45 2.29 1.31 113 RCVD_IN_MSPIKE_H5 7512 1.12 0.11 1.30 114 IN_HORDE_ADDRESS_BOOK 7493 1.11 0.03 1.30 115 XMHTML_After_End 7445 1.37 1.81 1.29 116 INVALID_MSGID 7443 1.14 0.27 1.29 117 TooManyTo_003 7404 1.18 0.60 1.28 118 XM_GoogleGroups 7237 1.12 0.37 1.25 119 URI_TRY_3LD 7226 1.26 1.33 1.25 120 HELO_MISC_IP 7143 1.18 0.89 1.24 121 CK_HELO_DYNAMIC_SPLIT_IP 7129 1.16 0.76 1.23 122 MISSING_HEADERS 7100 2.06 6.83 1.23 123 XM_UB50 7056 3.07 13.65 1.22 124 RELAYCOUNTRY_GB 6691 1.28 1.96 1.16 125 XM_H_Long_From02 6610 1.10 0.82 1.14 126 TO_MALFORMED 6488 0.96 0.05 1.12 127 XMCapTrack 6336 1.00 0.46 1.10 128 TM2_M_VERY_LONG_WORD 6285 1.19 1.76 1.09 129 NML_ADSP_CUSTOM_MED 5847 1.18 2.13 1.01 130 XM_OfRef6 5837 1.96 7.38 1.01 131 USER_IN_DEF_DKIM_WL 5641 0.83 0.00 0.98 132 TooManyTo_004 5571 0.89 0.49 0.96 133 XM_ProductURIs 5519 0.92 0.70 0.96 134 HTML_FONT_FACE_BAD 5347 0.86 0.47 0.93 135 T_FILL_THIS_FORM_SHORT 5311 1.35 3.84 0.92 136 XMBrknScrpt_02 5253 1.07 2.01 0.91 137 XMBdyGiftCard01 5205 0.87 0.68 0.90 138 SpammyFromTLD_01 5135 1.40 4.34 0.89 139 XMGenDplmaNmb 5114 0.94 1.28 0.89 140 XMGappySubj_01 5085 0.78 0.23 0.88 141 REPLYTO_WITHOUT_TO_CC 5018 1.85 7.46 0.87 142 XMSubNoVowel 4891 1.22 3.35 0.85 143 T_XMDrugObfuBody_00 4840 0.92 1.40 0.84 144 TooManyTo_005 4656 0.74 0.38 0.81 145 TR_LOTS_OF_MONEY1 4576 1.64 6.48 0.79 146 RELAYCOUNTRY_UG 4448 1.27 4.14 0.77 147 TR_MSPIKEBAYES00 4432 0.65 0.00 0.77 148 T_OBFU_PDF_ATTACH 4393 0.67 0.18 0.76 149 HTTPS_HTTP_MISMATCH 4342 0.74 0.64 0.75 150 XMBody_17 4332 1.20 3.77 0.75 151 TR_XM_COVIDMETA4 4236 1.48 5.74 0.73 152 XMMoneyMeta_00 4228 0.79 1.12 0.73 153 XMStockSpam_06 4174 0.80 1.24 0.72 154 TR_MetaPhish_Combo_01 4046 0.77 1.18 0.70 155 XMPhish30 3961 0.73 0.98 0.69 156 XM_H_PHPMailer 3879 0.79 1.50 0.67 157 TR_XM_PHPDW 3823 1.00 2.95 0.66 158 XMSubMetaI_00 3784 0.69 0.88 0.65 159 FORGED_GMAIL_RCVD 3763 0.84 1.92 0.65 160 TR_XM_FormFill2 3684 0.97 2.88 0.64 161 TR_XM_PHPForged 3680 0.98 2.92 0.64 162 XM_H_PHPOS 3644 0.96 2.88 0.63 163 XM_DIRTYINTL 3548 1.99 9.89 0.61 164 FROM_GOV_DKIM_AU 3371 0.50 0.05 0.58 165 RCVD_IN_MSPIKE_BL 3292 1.87 9.33 0.57 166 HTML_TAG_BALANCE_BODY 3210 0.55 0.54 0.56 167 XM_SPF_Unknown 3150 0.55 0.59 0.55 168 T_Symld_Words_02 3045 0.59 0.96 0.53 169 NUMERIC_HTTP_ADDR 3032 0.52 0.50 0.52 170 T_TooManySym_03 2940 0.52 0.55 0.51 171 XMSexyCombo_01 2890 0.64 1.47 0.50 172 T_XMHurry_00 2864 0.57 0.97 0.50 173 XM_ShortIntro_01 2825 0.50 0.56 0.49 174 XMBody_95 2808 0.44 0.16 0.49 175 XMPhish08 2783 0.51 0.69 0.48 176 RELAYCOUNTRY_DE 2657 0.95 3.78 0.46 177 TR_BOTNET_NEGATE 2634 0.43 0.25 0.46 178 XM_B_REG_HTML 2628 0.42 0.25 0.45 179 FROM_GOV_SPOOF 2613 0.43 0.27 0.45 180 XMBody_78 2577 0.55 1.13 0.45 181 XMNoVowels 2547 0.48 0.69 0.44 182 XMHTMLBadTable_001 2495 0.44 0.48 0.43 183 HTML_IMAGE_ONLY_20 2475 0.43 0.44 0.43 184 TR_XM_COVIDMETA1 2444 0.66 2.04 0.42 185 PLING_QUERY 2411 0.68 2.16 0.42 186 RCVD_IN_MSPIKE_L3 2386 1.06 4.78 0.41 187 RELAYCOUNTRY_FR 2361 1.09 4.97 0.41 188 HTML_IMAGE_ONLY_28 2338 0.41 0.45 0.40 189 RELAYCOUNTRY_AU 2314 0.46 0.77 0.40 190 TM2_M_BODY_EMPTY 2303 0.35 0.10 0.40 191 XM_B_COPY_HTML 2295 0.42 0.58 0.40 192 XMSubMetaSxObfu_03 2270 0.45 0.78 0.39 193 MY_SERVERS_FOUND 2215 0.36 0.24 0.38 194 XM_Body_Obfu01 2214 0.37 0.31 0.38 195 RCVD_IN_SORBS_DUL 2206 0.37 0.28 0.38 196 SpammyFromTLD_02 2202 1.54 8.18 0.38 197 HTML_IMAGE_ONLY_32 2177 0.34 0.10 0.38 198 XMPhish14 2114 0.41 0.69 0.37 199 SHORT_HELO_AND_INLINE_IMAGE 2100 0.32 0.09 0.36 200 TVD_SPACE_RATIO 2094 0.33 0.16 0.36 ----------------------------------------------------------------------