Email: 665555 Autolearn: 0 AvgScore: 0.31 AvgScanTime: 1.84 sec Spam: 109596 Autolearn: 0 AvgScore: 13.25 AvgScanTime: 3.32 sec Ham: 555959 Autolearn: 0 AvgScore: -2.24 AvgScanTime: 1.55 sec Time Spent Running SA: 339.80 hours Time Spent Processing Spam: 101.08 hours Time Spent Processing Ham: 238.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106470 98.18 97.15 98.38 2 HTML_MESSAGE 103422 86.32 94.37 84.73 3 RELAYCOUNTRY_US 65629 76.01 59.88 79.19 4 XM_B_Unicode 61976 64.63 56.55 66.22 5 DKIM_SIGNED 61391 70.02 56.02 72.78 6 XM_DK_Pass 59096 68.68 53.92 71.59 7 XMListUnsubscribeExists 52175 48.24 47.61 48.37 8 BAYES_50 48820 50.13 44.55 51.23 9 DKIM_VALID 48154 63.67 43.94 67.56 10 RELAYCOUNTRY_META 42266 11.06 38.57 5.63 11 XM_DK_Undo_02 41612 15.34 37.97 10.88 12 BOTNET 39533 8.45 36.07 3.00 13 MIME_HTML_ONLY 39358 23.74 35.91 21.34 14 UNTRUSTED_Relay 35755 7.11 32.62 2.09 15 DKIM_VALID_AU 34280 47.19 31.28 50.32 16 XM_B_Unicode3 34035 37.44 31.05 38.70 17 BAYES_99 33478 10.77 30.55 6.87 18 LOTS_OF_MONEY 26449 10.95 24.13 8.35 19 BAYES_999 26445 8.46 24.13 5.37 20 XMSubLong 25306 20.45 23.09 19.93 21 LOC_TINY_FONT_1 24335 22.52 22.20 22.58 22 DKIM_VALID_EF 22105 25.35 20.17 26.37 23 XM_UB50 22059 4.18 20.13 1.04 24 FVGT_m_MULTI_ODD 21882 21.09 19.97 21.31 25 HTML_FONT_LOW_CONTRAST 21724 24.88 19.82 25.88 26 RCVD_IN_MSPIKE_H2 19333 22.04 17.64 22.91 27 T_TM2_M_HEADER_IN_MSG 17888 26.23 16.32 28.19 28 XM_Multi_Part_URI 17512 14.18 15.98 13.82 29 T_KAM_HTML_FONT_INVALID 17439 17.19 15.91 17.44 30 BOTNET_IPINHOSTNAME 17296 7.35 15.78 5.69 31 XM_UncommonTLD01 16950 5.16 15.47 3.12 32 BOTNET_NORDNS 16773 2.54 15.30 0.02 33 SUBJ_ALL_CAPS 16593 3.61 15.14 1.34 34 HELO_NODOT 16428 3.62 14.99 1.38 35 HELO_NO_DOMAIN 16427 3.62 14.99 1.38 36 MISSING_HEADERS 15984 2.82 14.58 0.50 37 REPLYTO_WITHOUT_TO_CC 15974 2.49 14.58 0.11 38 TR_LOTS_OF_MONEY1 15646 2.37 14.28 0.03 39 XM_Body_Dirty_Words 15642 12.69 14.27 12.38 40 ADVANCE_FEE_4_NEW_MONEY 14891 2.24 13.59 0.00 41 MONEY_ATM_CARD 14678 2.21 13.39 0.00 42 XM_B_Unsub 14565 12.43 13.29 12.26 43 FROM_EXCESS_BASE64 14437 4.60 13.17 2.91 44 RELAYCOUNTRY_UG 14363 2.16 13.11 0.00 45 T_REMOTE_IMAGE 14141 5.13 12.90 3.60 46 DKIM_INVALID 13237 6.35 12.08 5.22 47 HTML_MIME_NO_HTML_TAG 12939 4.05 11.81 2.52 48 HTML_TAG_BALANCE_CENTER 12419 1.95 11.33 0.10 49 BODY_URI_ONLY 11753 1.90 10.72 0.16 50 NO_DNS_FOR_FROM 11675 3.99 10.65 2.67 51 HTML_IMAGE_RATIO_02 11312 7.48 10.32 6.92 52 HDRS_MISSP 11075 1.70 10.11 0.05 53 SCRIPT_GIBBERISH 10526 1.59 9.60 0.01 54 RCVD_IN_MSPIKE_BL 9927 1.95 9.06 0.55 55 XM_B_Phish_Phrases 9896 7.74 9.03 7.48 56 XMSexyCombo_05 9831 5.06 8.97 4.29 57 BAYES_80 8616 4.65 7.86 4.01 58 XM_Evil_Numbers_Gen 8410 8.74 7.67 8.95 59 BAYES_60 7567 6.31 6.90 6.19 60 XMSubMetaSx_00 6886 4.86 6.28 4.58 61 RCVD_IN_BL_SPAMCOP_NET 6884 2.22 6.28 1.42 62 RCVD_IN_MSPIKE_L3 6701 1.33 6.11 0.38 63 SpammyFromTLD_01 6465 1.80 5.90 1.00 64 RELAYCOUNTRY_CA 6246 2.31 5.70 1.64 65 RCVD_IN_MSPIKE_WL 6193 20.89 5.65 23.89 66 LotsOfNums_01 6192 8.32 5.65 8.84 67 XM_UB99 5913 0.89 5.40 0.00 68 TR_XM_PhishingBody 5841 3.34 5.33 2.94 69 TooManyTo_001 5749 7.75 5.25 8.25 70 RCVD_IN_PSBL 5568 0.84 5.08 0.00 71 MPART_ALT_DIFF 5502 5.88 5.02 6.05 72 XM_B_COVIDMETA 5494 2.74 5.01 2.30 73 SpammyFromTLD_02 5241 1.18 4.78 0.47 74 XM_H_Long_From01 5128 5.29 4.68 5.41 75 XM_SPF_SoftFail 5125 2.16 4.68 1.67 76 XM_JunkDunk 5067 0.76 4.62 0.00 77 BAYES_95 5014 2.77 4.57 2.42 78 TR_XM_COVIDMETA4 4949 1.36 4.52 0.73 79 UNPARSEABLE_RELAY 4872 6.25 4.45 6.61 80 TM2_M_URI_OPT_OUT 4805 8.94 4.38 9.84 81 KHOP_HELO_FCRDNS 4791 2.19 4.37 1.76 82 RELAYCOUNTRY_FR 4753 0.97 4.34 0.31 83 RCVD_IN_RP_RNBL 4624 0.75 4.22 0.06 84 XM_UB999 4541 0.68 4.14 0.00 85 XM_B_SpammyTLD 4083 2.22 3.73 1.92 86 TR_XM_MaxSPIKE 4073 0.64 3.72 0.03 87 HTML_IMAGE_RATIO_04 3986 5.84 3.64 6.28 88 XM_SendGrid 3924 5.53 3.58 5.91 89 TR_XM_INV_DKIM 3892 0.74 3.55 0.18 90 XM_OfRef6 3845 1.76 3.51 1.41 91 T_TooManySym_01 3708 3.68 3.38 3.74 92 FROM_SUSPICIOUS_NTLD 3599 0.59 3.28 0.06 93 XM_B_Phish66 3536 1.86 3.23 1.59 94 XMNumbers 3534 3.04 3.22 3.01 95 FROM_SUSPICIOUS_NTLD_FP 3521 0.57 3.21 0.05 96 MIME_HTML_MOSTLY 3348 2.89 3.05 2.85 97 RCVD_IN_MSPIKE_H3 3323 11.94 3.03 13.70 98 XMSubNoVowel 3244 1.41 2.96 1.11 99 HTML_SHORT_LINK_IMG_1 3244 0.59 2.96 0.12 100 PDS_OTHER_BAD_TLD 3202 0.60 2.92 0.14 101 DKIM_ADSP_NXDOMAIN 3167 0.71 2.89 0.28 102 LongTLD 3166 0.60 2.89 0.15 103 XM_DIRTYINTL 3152 0.96 2.88 0.58 104 XMStrtUSub 2957 4.82 2.70 5.24 105 XM_URI_RBL 2900 0.61 2.65 0.21 106 RELAYCOUNTRY_DE 2793 0.97 2.55 0.65 107 XMSubEmpty 2784 0.61 2.54 0.23 108 HTML_IMAGE_ONLY_12 2749 0.57 2.51 0.19 109 RCVD_IN_MSPIKE_H4 2690 7.70 2.45 8.73 110 XM_UB80 2592 0.43 2.37 0.05 111 HTML_IMAGE_RATIO_08 2573 2.61 2.35 2.66 112 XMBody_17 2536 1.00 2.31 0.74 113 XM_SPF_Unknown 2534 0.86 2.31 0.57 114 BAYES_40 2520 4.44 2.30 4.86 115 MIME_QP_LONG_LINE 2510 4.98 2.29 5.51 116 HTML_IMAGE_RATIO_06 2504 3.50 2.28 3.74 117 TR_XM_PHPDW 2449 0.86 2.23 0.59 118 TR_XM_PHPForged 2428 0.85 2.22 0.58 119 TR_XM_FormFill2 2411 0.84 2.20 0.57 120 XM_H_PHPOS 2403 0.84 2.19 0.57 121 T_TooManySym_02 2400 1.89 2.19 1.83 122 XMSexyCombo_01 2383 1.25 2.17 1.06 123 RCVD_IN_MSPIKE_L5 2373 0.44 2.17 0.10 124 XM_UB60 2317 0.48 2.11 0.15 125 RELAYCOUNTRY_IT 2310 0.39 2.11 0.06 126 HTML_SHORT_LINK_IMG_2 2255 0.38 2.06 0.05 127 HTML_TITLE_SUBJ_DIFF 2221 0.37 2.03 0.05 128 T_XMDrugObfuBody_08 2173 2.21 1.98 2.25 129 MPART_ALT_DIFF_COUNT 2169 0.63 1.98 0.36 130 XM_CamelCaseFrm001 2107 2.04 1.92 2.06 131 XM_B_Unsub2 2104 3.79 1.92 4.16 132 XM_OfRef7 2086 0.45 1.90 0.16 133 T_XMDrugObfuBody_14 2059 1.57 1.88 1.51 134 TR_LOTS_OF_MONEY3 2054 0.75 1.87 0.53 135 DKIM_ADSP_CUSTOM_MED 2041 1.35 1.86 1.24 136 TR_XM_COVIDMETA1 2020 0.71 1.84 0.48 137 URI_PHP_REDIR 2014 0.31 1.84 0.01 138 HTML_FONT_TINY_NORDNS 1929 0.64 1.76 0.42 139 XMHTML_After_End 1908 0.92 1.74 0.76 140 HTML_IMAGE_ONLY_16 1904 0.49 1.74 0.24 141 CTYPE_NULL 1890 0.28 1.72 0.00 142 NML_ADSP_CUSTOM_MED 1872 1.05 1.71 0.92 143 XM_ProductURIs 1865 1.07 1.70 0.94 144 URI_HEX 1797 1.48 1.64 1.45 145 XMBrknScrpt_02 1772 0.86 1.62 0.71 146 HTML_IMAGE_ONLY_08 1771 0.43 1.62 0.20 147 BAYES_20 1742 3.49 1.59 3.86 148 XMDiploma_00 1716 2.10 1.57 2.20 149 XM_UB95 1678 0.27 1.53 0.02 150 FORGED_GMAIL_RCVD 1670 0.72 1.52 0.56 151 XMMoneyMeta_00 1623 0.74 1.48 0.59 152 MIME_HTML_ONLY_MULTI 1622 3.48 1.48 3.87 153 TR_XM_DK_SendGrid 1611 2.98 1.47 3.28 154 ALL_TRUSTED 1590 14.22 1.45 16.73 155 URIBL_SBL_A 1563 0.32 1.43 0.10 156 DATE_IN_PAST_03_06 1553 0.31 1.42 0.10 157 XM_XX_Yahoo 1537 0.26 1.40 0.03 158 TR_XM_RelayPhish 1532 0.34 1.40 0.13 159 RDNS_DYNAMIC 1530 0.49 1.40 0.31 160 TM2_M_VERY_LONG_WORD 1529 1.09 1.40 1.03 161 RELAYCOUNTRY_GB 1453 1.07 1.33 1.02 162 XM_DK_Undo_01 1413 1.56 1.29 1.61 163 RELAYCOUNTRY_IN 1407 0.29 1.28 0.10 164 XMSexyCombo_04 1381 0.65 1.26 0.53 165 T_XMDrugObfuBody_00 1379 0.70 1.26 0.59 166 HK_RANDOM_REPLYTO 1355 0.35 1.24 0.18 167 TR_Symld_Words 1349 1.42 1.23 1.46 168 MIME_HEADER_CTYPE_ONLY 1331 0.42 1.21 0.26 169 MAILING_LIST_MULTI 1306 2.05 1.19 2.22 170 TR_XM_MaxBayes 1288 0.22 1.18 0.03 171 XM_BadFromFormat 1266 0.31 1.16 0.14 172 TM2_M_A_HREF_HREF 1233 0.45 1.13 0.32 173 XMStockSpam_06 1232 1.09 1.12 1.08 174 RELAYCOUNTRY_NL 1229 0.40 1.12 0.26 175 DATE_IN_PAST_06_12 1220 0.37 1.11 0.22 176 XMSubMetaSxObfu_03 1172 1.46 1.07 1.54 177 XM_H_PHPMailer 1164 0.68 1.06 0.61 178 HTML_TAG_BALANCE_BODY 1140 0.54 1.04 0.44 179 MIME_CHARSET_FARAWAY 1128 0.24 1.03 0.08 180 XMSubMetaSx_01 1122 0.23 1.02 0.07 181 XM_PDF 1114 3.35 1.02 3.81 182 URI_NO_WWW_INFO_CGI 1112 0.19 1.01 0.02 183 XM_ShortIntro_01 1110 0.55 1.01 0.46 184 T_XMHurry_00 1106 0.73 1.01 0.67 185 XMGenDplmaNmb 1071 1.41 0.98 1.50 186 XMPhish30 1059 0.58 0.97 0.50 187 URI_TRY_3LD 1052 1.08 0.96 1.10 188 T_FILL_THIS_FORM_SHORT 1050 0.88 0.96 0.86 189 TVD_RCVD_IP 1027 1.55 0.94 1.68 190 CHARSET_FARAWAY_HEADER 1025 0.18 0.94 0.04 191 TR_Sbj_FN_Bdy 1008 0.34 0.92 0.22 192 T_Symld_Words_02 970 0.47 0.89 0.39 193 TR_Mismatch_TLD_02 963 0.20 0.88 0.07 194 XM_H_PHPOS_M 962 0.39 0.88 0.30 195 TR_Mismatch_TLD_01 951 0.33 0.87 0.23 196 DATE_IN_PAST_12_24 939 0.19 0.86 0.06 197 XMSubMetaI_00 921 0.54 0.84 0.48 198 BAYES_00 919 14.80 0.84 17.55 199 BAYES_05 918 2.66 0.84 3.01 200 URIBL_BLACK 906 0.16 0.83 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 546960 98.18 97.15 98.38 2 HTML_MESSAGE 471088 86.32 94.37 84.73 3 RELAYCOUNTRY_US 440263 76.01 59.88 79.19 4 DKIM_SIGNED 404620 70.02 56.02 72.78 5 XM_DK_Pass 398030 68.68 53.92 71.59 6 DKIM_VALID 375613 63.67 43.94 67.56 7 XM_B_Unicode 368167 64.63 56.55 66.22 8 BAYES_50 284803 50.13 44.55 51.23 9 DKIM_VALID_AU 279763 47.19 31.28 50.32 10 XMListUnsubscribeExists 268915 48.24 47.61 48.37 11 XM_B_Unicode3 215136 37.44 31.05 38.70 12 T_TM2_M_HEADER_IN_MSG 156702 26.23 16.32 28.19 13 DKIM_VALID_EF 146600 25.35 20.17 26.37 14 HTML_FONT_LOW_CONTRAST 143891 24.88 19.82 25.88 15 RCVD_IN_MSPIKE_WL 132842 20.89 5.65 23.89 16 RCVD_IN_MSPIKE_H2 127355 22.04 17.64 22.91 17 LOC_TINY_FONT_1 125551 22.52 22.20 22.58 18 MIME_HTML_ONLY 118649 23.74 35.91 21.34 19 FVGT_m_MULTI_ODD 118477 21.09 19.97 21.31 20 XMSubLong 110779 20.45 23.09 19.93 21 BAYES_00 97558 14.80 0.84 17.55 22 T_KAM_HTML_FONT_INVALID 96979 17.19 15.91 17.44 23 ALL_TRUSTED 93035 14.22 1.45 16.73 24 XM_Multi_Part_URI 76858 14.18 15.98 13.82 25 RCVD_IN_MSPIKE_H3 76174 11.94 3.03 13.70 26 XM_Body_Dirty_Words 68812 12.69 14.27 12.38 27 XM_B_Unsub 68133 12.43 13.29 12.26 28 XM_DK_Undo_02 60468 15.34 37.97 10.88 29 TM2_M_URI_OPT_OUT 54707 8.94 4.38 9.84 30 XM_Evil_Numbers_Gen 49740 8.74 7.67 8.95 31 LotsOfNums_01 49171 8.32 5.65 8.84 32 RCVD_IN_MSPIKE_H4 48538 7.70 2.45 8.73 33 ANY_BOUNCE_MESSAGE 48394 7.35 0.49 8.70 34 BOUNCE_MESSAGE 48387 7.35 0.48 8.70 35 TR_XM_DK_Bayes 46555 7.07 0.43 8.37 36 LOTS_OF_MONEY 46444 10.95 24.13 8.35 37 TooManyTo_001 45853 7.75 5.25 8.25 38 TR_XM_DK_Bayes1 43531 6.58 0.23 7.83 39 XM_B_Phish_Phrases 41612 7.74 9.03 7.48 40 IN_ZIMBRA_NJ_WHITELIST 39720 5.97 0.03 7.14 41 HTML_IMAGE_RATIO_02 38476 7.48 10.32 6.92 42 BAYES_99 38195 10.77 30.55 6.87 43 TR_XM_DK_Bayes2 37772 5.70 0.14 6.79 44 RCVD_IN_RP_SAFE 37515 5.71 0.43 6.75 45 UNPARSEABLE_RELAY 36747 6.25 4.45 6.61 46 XM_DKIMWhitelistDomains 36638 5.51 0.01 6.59 47 HTML_IMAGE_RATIO_04 34908 5.84 3.64 6.28 48 RCVD_IN_RP_CERTIFIED 34496 5.22 0.20 6.20 49 BAYES_60 34439 6.31 6.90 6.19 50 MPART_ALT_DIFF 33631 5.88 5.02 6.05 51 XM_SendGrid 32853 5.53 3.58 5.91 52 BOTNET_IPINHOSTNAME 31636 7.35 15.78 5.69 53 RELAYCOUNTRY_META 31317 11.06 38.57 5.63 54 MIME_QP_LONG_LINE 30635 4.98 2.29 5.51 55 XM_H_Long_From01 30059 5.29 4.68 5.41 56 BAYES_999 29839 8.46 24.13 5.37 57 XMStrtUSub 29136 4.82 2.70 5.24 58 DKIM_INVALID 29007 6.35 12.08 5.22 59 BAYES_40 26998 4.44 2.30 4.86 60 RCVD_IN_IADB_LISTED 26978 4.16 0.67 4.85 61 XMSubMetaSx_00 25449 4.86 6.28 4.58 62 XMSexyCombo_05 23849 5.06 8.97 4.29 63 RCVD_IN_IADB_SPF 23835 3.68 0.57 4.29 64 XM_B_Unsub2 23153 3.79 1.92 4.16 65 XM_H_Trusted_IP 22630 3.40 0.00 4.07 66 BAYES_80 22303 4.65 7.86 4.01 67 MIME_HTML_ONLY_MULTI 21508 3.48 1.48 3.87 68 BAYES_20 21455 3.49 1.59 3.86 69 XM_PDF 21196 3.35 1.02 3.81 70 RCVD_IN_IADB_SENDERID 21020 3.25 0.54 3.78 71 RCVD_IN_IADB_DK 20930 3.23 0.54 3.76 72 T_TooManySym_01 20805 3.68 3.38 3.74 73 HTML_IMAGE_RATIO_06 20803 3.50 2.28 3.74 74 T_REMOTE_IMAGE 20025 5.13 12.90 3.60 75 TR_XM_DK_SendGrid 18248 2.98 1.47 3.28 76 XM_UncommonTLD01 17362 5.16 15.47 3.12 77 BAYES_05 16757 2.66 0.84 3.01 78 XMNumbers 16716 3.04 3.22 3.01 79 BOTNET 16680 8.45 36.07 3.00 80 TR_XM_PhishingBody 16356 3.34 5.33 2.94 81 FROM_EXCESS_BASE64 16178 4.60 13.17 2.91 82 RCVD_IN_IADB_VOUCHED 15999 2.45 0.26 2.88 83 MIME_HTML_MOSTLY 15855 2.89 3.05 2.85 84 NO_DNS_FOR_FROM 14862 3.99 10.65 2.67 85 HTML_IMAGE_RATIO_08 14801 2.61 2.35 2.66 86 HTML_MIME_NO_HTML_TAG 13992 4.05 11.81 2.52 87 BAYES_95 13450 2.77 4.57 2.42 88 XM_B_COVIDMETA 12771 2.74 5.01 2.30 89 T_XMDrugObfuBody_08 12511 2.21 1.98 2.25 90 MAILING_LIST_MULTI 12346 2.05 1.19 2.22 91 XMDiploma_00 12240 2.10 1.57 2.20 92 UNTRUSTED_Relay 11593 7.11 32.62 2.09 93 XM_CamelCaseFrm001 11449 2.04 1.92 2.06 94 XM_B_SpammyTLD 10690 2.22 3.73 1.92 95 TooManyTo_002 10299 1.67 0.72 1.85 96 T_TooManySym_02 10198 1.89 2.19 1.83 97 RCVD_IN_IADB_OPTIN 10071 1.55 0.21 1.81 98 KHOP_HELO_FCRDNS 9767 2.19 4.37 1.76 99 HTML_FONT_FACE_BAD 9501 1.49 0.40 1.71 100 TVD_RCVD_IP 9320 1.55 0.94 1.68 101 XM_SPF_SoftFail 9283 2.16 4.68 1.67 102 RELAYCOUNTRY_CA 9107 2.31 5.70 1.64 103 XM_DK_Undo_01 8944 1.56 1.29 1.61 104 XM_B_Phish66 8827 1.86 3.23 1.59 105 XMSubMetaSxObfu_03 8553 1.46 1.07 1.54 106 T_XMDrugObfuBody_14 8396 1.57 1.88 1.51 107 XMGenDplmaNmb 8340 1.41 0.98 1.50 108 RCVD_IN_MSPIKE_H5 8130 1.25 0.16 1.46 109 TR_Symld_Words 8092 1.42 1.23 1.46 110 URI_HEX 8035 1.48 1.64 1.45 111 RCVD_IN_BL_SPAMCOP_NET 7912 2.22 6.28 1.42 112 XM_OfRef6 7861 1.76 3.51 1.41 113 HELO_NODOT 7658 3.62 14.99 1.38 114 HELO_NO_DOMAIN 7657 3.62 14.99 1.38 115 IN_HORDE_ADDRESS_BOOK 7535 1.14 0.02 1.36 116 SUBJ_ALL_CAPS 7424 3.61 15.14 1.34 117 XM_H_Long_From02 7390 1.22 0.66 1.33 118 INVALID_MSGID 7345 1.18 0.47 1.32 119 HELO_MISC_IP 7265 1.21 0.72 1.31 120 CK_HELO_DYNAMIC_SPLIT_IP 7263 1.20 0.63 1.31 121 DKIM_ADSP_CUSTOM_MED 6915 1.35 1.86 1.24 122 XM_GoogleGroups 6897 1.10 0.38 1.24 123 TooManyTo_003 6861 1.11 0.51 1.23 124 TO_MALFORMED 6488 0.98 0.01 1.17 125 XMSubNoVowel 6146 1.41 2.96 1.11 126 URI_TRY_3LD 6105 1.08 0.96 1.10 127 XMStockSpam_06 5992 1.09 1.12 1.08 128 XMSexyCombo_01 5906 1.25 2.17 1.06 129 XM_UB50 5774 4.18 20.13 1.04 130 TM2_M_VERY_LONG_WORD 5741 1.09 1.40 1.03 131 TR_MetaPhish_Combo_01 5681 0.96 0.67 1.02 132 RELAYCOUNTRY_GB 5678 1.07 1.33 1.02 133 XMCapTrack 5607 0.90 0.36 1.01 134 SpammyFromTLD_01 5543 1.80 5.90 1.00 135 XMGappySubj_01 5356 0.82 0.10 0.96 136 TooManyTo_004 5351 0.87 0.42 0.96 137 XM_ProductURIs 5248 1.07 1.70 0.94 138 XMBdyGiftCard01 5173 0.89 0.68 0.93 139 NML_ADSP_CUSTOM_MED 5088 1.05 1.71 0.92 140 USER_IN_DEF_DKIM_WL 4982 0.75 0.00 0.90 141 T_FILL_THIS_FORM_SHORT 4803 0.88 0.96 0.86 142 TR_MSPIKEBAYES00 4572 0.69 0.01 0.82 143 TooManyTo_005 4426 0.72 0.35 0.80 144 XMHTML_After_End 4242 0.92 1.74 0.76 145 XMBody_17 4122 1.00 2.31 0.74 146 TR_XM_COVIDMETA4 4084 1.36 4.52 0.73 147 XMBrknScrpt_02 3923 0.86 1.62 0.71 148 XM_GRM 3914 0.59 0.00 0.70 149 T_XMHurry_00 3743 0.73 1.01 0.67 150 FROM_GOV_DKIM_AU 3635 0.56 0.10 0.65 151 RELAYCOUNTRY_DE 3634 0.97 2.55 0.65 152 T_OBFU_PDF_ATTACH 3518 0.56 0.19 0.63 153 XMLngstWrd_00 3450 0.65 0.80 0.62 154 XM_H_PHPMailer 3380 0.68 1.06 0.61 155 HTTPS_HTTP_MISMATCH 3312 0.59 0.59 0.60 156 T_XMDrugObfuBody_00 3305 0.70 1.26 0.59 157 TR_XM_PHPDW 3298 0.86 2.23 0.59 158 XMMoneyMeta_00 3283 0.74 1.48 0.59 159 XM_DIRTYINTL 3249 0.96 2.88 0.58 160 TR_XM_PHPForged 3207 0.85 2.22 0.58 161 TR_XM_FormFill2 3194 0.84 2.20 0.57 162 XM_H_PHPOS 3169 0.84 2.19 0.57 163 XM_SPF_Unknown 3168 0.86 2.31 0.57 164 FORGED_GMAIL_RCVD 3101 0.72 1.52 0.56 165 RCVD_IN_MSPIKE_BL 3080 1.95 9.06 0.55 166 XMHTMLBadTable_001 3080 0.50 0.25 0.55 167 T_TooManySym_03 3046 0.55 0.56 0.55 168 URI_OPTOUT_3LD 3014 0.47 0.13 0.54 169 HTML_IMAGE_ONLY_20 3003 0.52 0.39 0.54 170 XMSexyCombo_04 2970 0.65 1.26 0.53 171 TR_LOTS_OF_MONEY3 2955 0.75 1.87 0.53 172 XMLngstWrd_01 2877 0.54 0.66 0.52 173 MISSING_HEADERS 2792 2.82 14.58 0.50 174 XMPhish30 2771 0.58 0.97 0.50 175 PLING_QUERY 2758 0.46 0.29 0.50 176 XM_B_REG_HTML 2723 0.45 0.22 0.49 177 TR_XM_COVIDMETA1 2675 0.71 1.84 0.48 178 XMNoVowels 2669 0.49 0.57 0.48 179 XMPhish14 2653 0.51 0.67 0.48 180 XMSubMetaI_00 2642 0.54 0.84 0.48 181 TR_BOTNET_NEGATE 2640 0.42 0.16 0.47 182 XMBody_95 2638 0.41 0.09 0.47 183 RELAYCOUNTRY_AU 2598 0.47 0.48 0.47 184 SpammyFromTLD_02 2586 1.18 4.78 0.47 185 XM_ShortIntro_01 2571 0.55 1.01 0.46 186 NUMERIC_HTTP_ADDR 2460 0.44 0.42 0.44 187 HTML_TAG_BALANCE_BODY 2453 0.54 1.04 0.44 188 SUBJ_DOLLARS 2435 0.47 0.63 0.44 189 XMBody_78 2382 0.48 0.72 0.43 190 TM2_M_BODY_EMPTY 2357 0.37 0.11 0.42 191 FROM_GOV_SPOOF 2348 0.38 0.18 0.42 192 HTML_FONT_TINY_NORDNS 2310 0.64 1.76 0.42 193 URI_NOVOWEL 2308 0.45 0.64 0.42 194 XMLngstWrd_02 2215 0.41 0.49 0.40 195 RCVD_IN_SORBS_DUL 2185 0.35 0.15 0.39 196 T_Symld_Words_02 2179 0.47 0.89 0.39 197 RCVD_IN_MSPIKE_L3 2139 1.33 6.11 0.38 198 XM_B_COPY_HTML 2121 0.38 0.35 0.38 199 XMPhish08 2062 0.41 0.63 0.37 200 XMBounce_01 2021 0.34 0.23 0.36 ----------------------------------------------------------------------