Email: 656634 Autolearn: 0 AvgScore: 0.08 AvgScanTime: 1.88 sec Spam: 93423 Autolearn: 0 AvgScore: 12.84 AvgScanTime: 3.57 sec Ham: 563211 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.60 sec Time Spent Running SA: 343.00 hours Time Spent Processing Spam: 92.57 hours Time Spent Processing Ham: 250.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 90404 98.00 96.77 98.20 2 HTML_MESSAGE 83360 85.72 89.23 85.13 3 RELAYCOUNTRY_US 66018 78.37 70.67 79.65 4 DKIM_SIGNED 65863 73.13 70.50 73.56 5 XM_B_Unicode 64965 65.39 69.54 64.70 6 XM_DK_Pass 63443 71.82 67.91 72.47 7 XMListUnsubscribeExists 53969 48.69 57.77 47.18 8 DKIM_VALID 52984 66.41 56.71 68.02 9 XM_DK_Undo_02 43988 15.65 47.08 10.44 10 DKIM_VALID_AU 39008 50.32 41.75 51.74 11 BAYES_50 34555 50.48 36.99 52.72 12 XM_B_Unicode3 33900 36.46 36.29 36.49 13 BOTNET 33443 7.75 35.80 3.10 14 MIME_HTML_ONLY 30929 21.36 33.11 19.41 15 BAYES_99 30554 10.43 32.71 6.74 16 RELAYCOUNTRY_META 29232 8.95 31.29 5.25 17 DKIM_VALID_EF 26630 28.58 28.50 28.59 18 LOC_TINY_FONT_1 26549 23.40 28.42 22.56 19 HTML_FONT_LOW_CONTRAST 25276 25.50 27.06 25.24 20 BAYES_999 24340 8.28 26.05 5.33 21 XMSubLong 23172 21.28 24.80 20.70 22 XM_UncommonTLD01 23020 6.25 24.64 3.20 23 FVGT_m_MULTI_ODD 22229 21.42 23.79 21.02 24 BOTNET_IPINHOSTNAME 20221 7.27 21.64 4.89 25 RCVD_IN_MSPIKE_H2 19618 22.63 21.00 22.90 26 UNTRUSTED_Relay 18587 4.29 19.90 1.71 27 XM_Body_Dirty_Words 18356 13.78 19.65 12.81 28 T_TM2_M_HEADER_IN_MSG 17775 27.61 19.03 29.03 29 T_KAM_HTML_FONT_INVALID 16202 17.41 17.34 17.42 30 XM_Multi_Part_URI 13656 13.76 14.62 13.62 31 DKIM_INVALID 12879 6.72 13.79 5.54 32 LOTS_OF_MONEY 11927 8.70 12.77 8.03 33 HTML_IMAGE_RATIO_02 11026 7.49 11.80 6.77 34 XM_B_Phish_Phrases 10865 7.67 11.63 7.01 35 MPART_ALT_DIFF 10668 5.39 11.42 4.39 36 NO_DNS_FOR_FROM 10198 3.88 10.92 2.72 37 BAYES_60 10191 6.83 10.91 6.16 38 XMSexyCombo_05 10033 5.42 10.74 4.53 39 XM_B_Unsub 9727 12.50 10.41 12.85 40 RCVD_IN_MSPIKE_BL 9165 1.81 9.81 0.49 41 TooManyTo_001 8664 8.96 9.27 8.91 42 RCVD_IN_MSPIKE_WL 8650 22.05 9.26 24.18 43 SpammyFromTLD_02 8519 1.51 9.12 0.25 44 BAYES_80 8039 4.70 8.60 4.05 45 T_REMOTE_IMAGE 8016 4.29 8.58 3.57 46 XM_Evil_Numbers_Gen 7850 8.49 8.40 8.51 47 FROM_SUSPICIOUS_NTLD 7409 1.18 7.93 0.06 48 FROM_SUSPICIOUS_NTLD_FP 7311 1.16 7.83 0.06 49 BOTNET_NORDNS 7061 1.10 7.56 0.03 50 XM_UB50 7025 1.92 7.52 0.99 51 XMNumbers 6960 3.55 7.45 2.91 52 RELAYCOUNTRY_CA 6850 2.47 7.33 1.67 53 LotsOfNums_01 6643 7.55 7.11 7.62 54 RCVD_IN_BL_SPAMCOP_NET 6595 1.83 7.06 0.97 55 TR_XM_PhishingBody 6422 3.73 6.87 3.21 56 FROM_EXCESS_BASE64 6375 3.21 6.82 2.61 57 HTML_MIME_NO_HTML_TAG 6363 2.73 6.81 2.05 58 UNPARSEABLE_RELAY 6309 6.91 6.75 6.93 59 BODY_URI_ONLY 6216 1.09 6.65 0.17 60 XMSubMetaSx_00 6213 3.86 6.65 3.40 61 RCVD_IN_RP_RNBL 6018 0.97 6.44 0.07 62 XM_B_COVIDMETA 5775 2.19 6.18 1.53 63 XM_H_Long_From01 5772 5.11 6.18 4.93 64 PDS_OTHER_BAD_TLD 5723 1.01 6.13 0.17 65 XM_SPF_SoftFail 5599 2.40 5.99 1.80 66 RCVD_IN_MSPIKE_H3 5478 12.64 5.86 13.77 67 SpammyFromTLD_01 5427 1.53 5.81 0.82 68 MIME_HTML_MOSTLY 5406 2.72 5.79 2.21 69 RCVD_IN_MSPIKE_L3 5279 1.09 5.65 0.34 70 HTML_TAG_BALANCE_CENTER 5258 0.96 5.63 0.19 71 HDRS_MISSP 5200 0.81 5.57 0.02 72 KHOP_HELO_FCRDNS 5000 2.34 5.35 1.83 73 DKIM_ADSP_NXDOMAIN 4754 0.97 5.09 0.28 74 XM_B_SpammyTLD 4485 2.05 4.80 1.59 75 XM_UB99 4427 0.68 4.74 0.01 76 REPLYTO_WITHOUT_TO_CC 4165 0.68 4.46 0.05 77 HTML_IMAGE_RATIO_04 4145 4.96 4.44 5.05 78 XM_DIRTYINTL 4026 1.13 4.31 0.60 79 XM_OfRef6 3933 1.48 4.21 1.03 80 SUBJ_ALL_CAPS 3916 1.80 4.19 1.40 81 TR_XM_COVIDMETA4 3895 1.16 4.17 0.66 82 BAYES_95 3812 2.69 4.08 2.46 83 XM_SendGrid 3751 5.98 4.02 6.30 84 RELAYCOUNTRY_FR 3732 0.78 3.99 0.24 85 TR_XM_INV_DKIM 3706 0.68 3.97 0.14 86 XM_B_Phish66 3661 2.09 3.92 1.79 87 XM_URI_RBL 3415 0.73 3.66 0.25 88 TM2_M_URI_OPT_OUT 3361 7.63 3.60 8.29 89 XM_UB999 3335 0.51 3.57 0.00 90 TR_Mismatch_TLD_02 3323 0.57 3.56 0.08 91 TR_XM_MaxSPIKE 3242 0.52 3.47 0.04 92 T_TooManySym_01 3205 4.13 3.43 4.25 93 RCVD_IN_PSBL 3115 0.48 3.33 0.00 94 RCVD_IN_MSPIKE_H4 3076 8.34 3.29 9.17 95 NORDNS_LOW_CONTRAST 2895 0.45 3.10 0.01 96 XMStrtUSub 2819 4.93 3.02 5.24 97 RCVD_IN_MSPIKE_L5 2641 0.48 2.83 0.09 98 ANY_BOUNCE_MESSAGE 2608 6.83 2.79 7.50 99 BOUNCE_MESSAGE 2603 6.82 2.79 7.49 100 HTML_IMAGE_ONLY_16 2558 0.65 2.74 0.30 101 SCRIPT_GIBBERISH 2449 0.38 2.62 0.00 102 TR_XM_PHPDW 2436 0.84 2.61 0.54 103 XM_B_Crypto 2420 0.44 2.59 0.08 104 MISSING_HEADERS 2416 0.76 2.59 0.46 105 TR_XM_PHPForged 2405 0.81 2.57 0.52 106 PDS_BTC_ID 2399 0.39 2.57 0.03 107 TR_XM_FormFill2 2384 0.81 2.55 0.52 108 XM_H_PHPOS 2373 0.80 2.54 0.51 109 BAYES_40 2351 4.21 2.52 4.49 110 MIME_QP_LONG_LINE 2291 4.72 2.45 5.10 111 XMSexyCombo_01 2278 0.92 2.44 0.66 112 BITCOIN_EXTORT_01 2254 0.35 2.41 0.00 113 HTML_FONT_TINY_NORDNS 2252 0.62 2.41 0.33 114 XM_UB60 2230 0.44 2.39 0.12 115 T_XMDrugObfuBody_08 2224 1.55 2.38 1.41 116 TR_XM_COVIDMETA1 2220 0.67 2.38 0.39 117 HTML_IMAGE_RATIO_06 2215 2.96 2.37 3.06 118 TR_XM_Crypto2 2175 0.34 2.33 0.01 119 HTML_TAG_BALANCE_HEAD 2148 0.37 2.30 0.05 120 XMBody_17 2118 1.12 2.27 0.93 121 XM_OfRef7 2105 0.44 2.25 0.14 122 T_TVD_MIME_EPI 2078 0.33 2.22 0.02 123 URIBL_SBL_A 2059 0.43 2.20 0.13 124 XM_UB80 1986 0.34 2.13 0.04 125 HTML_IMAGE_RATIO_08 1977 2.16 2.12 2.17 126 RELAYCOUNTRY_DE 1977 0.66 2.12 0.42 127 XMBrknScrpt_02 1959 1.06 2.10 0.88 128 XM_CamelCaseFrm001 1917 1.94 2.05 1.92 129 MIME_HTML_ONLY_MULTI 1904 2.62 2.04 2.72 130 LOADSA_MONEY_COMBO 1873 0.38 2.00 0.11 131 XM_B_Unsub2 1835 5.07 1.96 5.58 132 XM_Nigeria_01 1822 0.31 1.95 0.04 133 XFER_LOTSA_MONEY 1801 0.33 1.93 0.07 134 DKIM_ADSP_CUSTOM_MED 1796 1.23 1.92 1.11 135 T_XMDrugObfuBody_14 1791 1.44 1.92 1.36 136 MAILING_LIST_MULTI 1780 2.46 1.91 2.55 137 ALL_TRUSTED 1758 14.60 1.88 16.71 138 RELAYCOUNTRY_GB 1755 1.23 1.88 1.12 139 BAYES_20 1741 3.66 1.86 3.96 140 XMHTML_After_End 1720 1.00 1.84 0.86 141 URI_TRY_3LD 1709 1.11 1.83 0.99 142 XM_JunkDunk 1708 0.26 1.83 0.00 143 MONEY_FRAUD_8 1704 0.26 1.82 0.00 144 TR_XM_RelayPhish 1691 0.41 1.81 0.18 145 GB_BITCOIN_CP 1658 0.25 1.77 0.00 146 URI_PHP_REDIR 1655 0.26 1.77 0.01 147 NML_ADSP_CUSTOM_MED 1648 0.93 1.76 0.79 148 XMDiploma_00 1647 1.56 1.76 1.53 149 TR_Symld_Words 1628 1.42 1.74 1.37 150 T_XMDrugObfuBody_00 1625 0.83 1.74 0.68 151 FORGED_GMAIL_RCVD 1619 0.66 1.73 0.49 152 ADVANCE_FEE_5_NEW_FRM_MNY 1617 0.25 1.73 0.00 153 LongTLD 1604 0.38 1.72 0.16 154 TR_XM_MaxBayes 1574 0.26 1.68 0.02 155 URI_HEX 1547 1.39 1.66 1.35 156 RELAYCOUNTRY_IN 1545 0.33 1.65 0.11 157 HTTP_ESCAPED_HOST 1543 0.29 1.65 0.06 158 XMSubNoVowel 1536 1.12 1.64 1.03 159 TR_XM_DK_SendGrid 1531 2.96 1.64 3.18 160 T_MONEY_PERCENT 1518 0.56 1.62 0.38 161 TR_LOTS_OF_MONEY2 1518 0.56 1.62 0.38 162 RDNS_DYNAMIC 1475 0.51 1.58 0.33 163 HTML_SHORT_LINK_IMG_2 1466 0.26 1.57 0.04 164 XMStockSpam_06 1449 1.15 1.55 1.09 165 TR_LOTS_OF_MONEY3 1446 0.90 1.55 0.80 166 DATE_IN_PAST_03_06 1432 0.32 1.53 0.12 167 DATE_IN_PAST_06_12 1428 0.35 1.53 0.15 168 RELAYCOUNTRY_HU 1425 0.23 1.53 0.02 169 HK_RANDOM_REPLYTO 1424 0.42 1.52 0.23 170 PDS_NAKED_TO_NUMERO 1409 0.22 1.51 0.00 171 NUMBERONLY_BITCOIN_EXP 1403 0.21 1.50 0.00 172 TM2_M_VERY_LONG_WORD 1401 1.10 1.50 1.04 173 XMSexyCombo_04 1389 0.37 1.49 0.19 174 TR_LOTS_OF_MONEY1 1386 0.23 1.48 0.03 175 XM_PDF 1351 3.82 1.45 4.22 176 HTML_SHORT_LINK_IMG_1 1347 0.32 1.44 0.14 177 HTML_IMAGE_ONLY_08 1334 0.39 1.43 0.22 178 T_Symld_Words_02 1304 0.69 1.40 0.57 179 T_FILL_THIS_FORM_SHORT 1293 0.86 1.38 0.77 180 HDRS_LCASE_IMGONLY 1288 0.31 1.38 0.13 181 XM_BadFromFormat 1279 0.30 1.37 0.13 182 TR_Mismatch_TLD_01 1275 0.38 1.36 0.22 183 XM_HighProb1 1268 0.20 1.36 0.01 184 XMSubMetaSxObfu_03 1258 0.56 1.35 0.43 185 XM_UB95 1252 0.21 1.34 0.02 186 HTML_SHORT_LINK_IMG_3 1247 0.28 1.33 0.11 187 XMGenDplmaNmb 1234 0.91 1.32 0.85 188 HTML_IMAGE_ONLY_20 1226 0.58 1.31 0.45 189 INVALID_MSGID 1218 1.32 1.30 1.32 190 T_TooManySym_02 1196 2.08 1.28 2.22 191 RELAYCOUNTRY_RU 1178 0.20 1.26 0.02 192 T_XMHurry_00 1158 0.61 1.24 0.50 193 BAYES_00 1126 14.24 1.21 16.40 194 XMPhish08 1122 0.52 1.20 0.40 195 XM_XX_Yahoo 1114 0.22 1.19 0.06 196 TR_MetaPhish_Combo_01 1073 0.75 1.15 0.68 197 FILL_THIS_FORM 1062 0.34 1.14 0.21 198 HELO_NODOT 1060 1.53 1.13 1.59 199 XM_H_PHPMailer 1055 0.65 1.13 0.58 200 BAYES_05 1054 2.75 1.13 3.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 553081 98.00 96.77 98.20 2 HTML_MESSAGE 479478 85.72 89.23 85.13 3 RELAYCOUNTRY_US 448609 78.37 70.67 79.65 4 DKIM_SIGNED 414322 73.13 70.50 73.56 5 XM_DK_Pass 408177 71.82 67.91 72.47 6 DKIM_VALID 383098 66.41 56.71 68.02 7 XM_B_Unicode 364385 65.39 69.54 64.70 8 BAYES_50 296902 50.48 36.99 52.72 9 DKIM_VALID_AU 291427 50.32 41.75 51.74 10 XMListUnsubscribeExists 265734 48.69 57.77 47.18 11 XM_B_Unicode3 205493 36.46 36.29 36.49 12 T_TM2_M_HEADER_IN_MSG 163528 27.61 19.03 29.03 13 DKIM_VALID_EF 161013 28.58 28.50 28.59 14 HTML_FONT_LOW_CONTRAST 142145 25.50 27.06 25.24 15 RCVD_IN_MSPIKE_WL 136158 22.05 9.26 24.18 16 RCVD_IN_MSPIKE_H2 128969 22.63 21.00 22.90 17 LOC_TINY_FONT_1 127078 23.40 28.42 22.56 18 FVGT_m_MULTI_ODD 118406 21.42 23.79 21.02 19 XMSubLong 116583 21.28 24.80 20.70 20 MIME_HTML_ONLY 109336 21.36 33.11 19.41 21 T_KAM_HTML_FONT_INVALID 98130 17.41 17.34 17.42 22 ALL_TRUSTED 94097 14.60 1.88 16.71 23 BAYES_00 92388 14.24 1.21 16.40 24 RCVD_IN_MSPIKE_H3 77526 12.64 5.86 13.77 25 XM_Multi_Part_URI 76690 13.76 14.62 13.62 26 XM_B_Unsub 72370 12.50 10.41 12.85 27 XM_Body_Dirty_Words 72138 13.78 19.65 12.81 28 XM_DK_Undo_02 58774 15.65 47.08 10.44 29 RCVD_IN_MSPIKE_H4 51656 8.34 3.29 9.17 30 TooManyTo_001 50187 8.96 9.27 8.91 31 IN_ZIMBRA_NJ_WHITELIST 49194 7.50 0.06 8.73 32 XM_Evil_Numbers_Gen 47918 8.49 8.40 8.51 33 TM2_M_URI_OPT_OUT 46713 7.63 3.60 8.29 34 LOTS_OF_MONEY 45201 8.70 12.77 8.03 35 TR_XM_DK_Bayes 45134 6.94 0.46 8.01 36 LotsOfNums_01 42904 7.55 7.11 7.62 37 ANY_BOUNCE_MESSAGE 42222 6.83 2.79 7.50 38 BOUNCE_MESSAGE 42208 6.82 2.79 7.49 39 TR_XM_DK_Bayes1 41999 6.44 0.29 7.46 40 XM_B_Phish_Phrases 39478 7.67 11.63 7.01 41 RCVD_IN_RP_SAFE 39266 6.10 0.84 6.97 42 UNPARSEABLE_RELAY 39044 6.91 6.75 6.93 43 XM_DKIMWhitelistDomains 38845 5.92 0.01 6.90 44 HTML_IMAGE_RATIO_02 38125 7.49 11.80 6.77 45 BAYES_99 37954 10.43 32.71 6.74 46 TR_XM_DK_Bayes2 36698 5.62 0.20 6.52 47 RCVD_IN_RP_CERTIFIED 36249 5.61 0.61 6.44 48 XM_SendGrid 35497 5.98 4.02 6.30 49 BAYES_60 34683 6.83 10.91 6.16 50 XM_B_Unsub2 31452 5.07 1.96 5.58 51 DKIM_INVALID 31224 6.72 13.79 5.54 52 BAYES_999 29997 8.28 26.05 5.33 53 RELAYCOUNTRY_META 29546 8.95 31.29 5.25 54 XMStrtUSub 29535 4.93 3.02 5.24 55 MIME_QP_LONG_LINE 28709 4.72 2.45 5.10 56 HTML_IMAGE_RATIO_04 28439 4.96 4.44 5.05 57 XM_H_Long_From01 27756 5.11 6.18 4.93 58 BOTNET_IPINHOSTNAME 27541 7.27 21.64 4.89 59 XMSexyCombo_05 25531 5.42 10.74 4.53 60 BAYES_40 25310 4.21 2.52 4.49 61 RCVD_IN_IADB_LISTED 24810 3.88 0.68 4.41 62 MPART_ALT_DIFF 24724 5.39 11.42 4.39 63 T_TooManySym_01 23926 4.13 3.43 4.25 64 XM_PDF 23740 3.82 1.45 4.22 65 BAYES_80 22816 4.70 8.60 4.05 66 BAYES_20 22294 3.66 1.86 3.96 67 RCVD_IN_IADB_SPF 21524 3.36 0.58 3.82 68 T_REMOTE_IMAGE 20126 4.29 8.58 3.57 69 XMSubMetaSx_00 19159 3.86 6.65 3.40 70 RCVD_IN_IADB_SENDERID 18940 2.96 0.56 3.36 71 RCVD_IN_IADB_DK 18812 2.94 0.56 3.34 72 TR_XM_PhishingBody 18062 3.73 6.87 3.21 73 XM_UncommonTLD01 18004 6.25 24.64 3.20 74 TR_XM_DK_SendGrid 17927 2.96 1.64 3.18 75 BOTNET 17463 7.75 35.80 3.10 76 HTML_IMAGE_RATIO_06 17225 2.96 2.37 3.06 77 BAYES_05 17005 2.75 1.13 3.02 78 XMNumbers 16364 3.55 7.45 2.91 79 RCVD_IN_IADB_VOUCHED 15457 2.39 0.26 2.74 80 MIME_HTML_ONLY_MULTI 15328 2.62 2.04 2.72 81 NO_DNS_FOR_FROM 15309 3.88 10.92 2.72 82 FROM_EXCESS_BASE64 14727 3.21 6.82 2.61 83 MAILING_LIST_MULTI 14352 2.46 1.91 2.55 84 BAYES_95 13854 2.69 4.08 2.46 85 XM_H_Trusted_IP 13840 2.11 0.00 2.46 86 T_TooManySym_02 12479 2.08 1.28 2.22 87 MIME_HTML_MOSTLY 12451 2.72 5.79 2.21 88 HTML_IMAGE_RATIO_08 12215 2.16 2.12 2.17 89 TooManyTo_002 11808 1.92 0.85 2.10 90 HTML_MIME_NO_HTML_TAG 11544 2.73 6.81 2.05 91 XM_CamelCaseFrm001 10818 1.94 2.05 1.92 92 KHOP_HELO_FCRDNS 10333 2.34 5.35 1.83 93 XM_SPF_SoftFail 10140 2.40 5.99 1.80 94 XM_B_Phish66 10080 2.09 3.92 1.79 95 TVD_RCVD_IP 9864 1.63 0.91 1.75 96 RCVD_IN_IADB_OPTIN 9658 1.51 0.25 1.71 97 UNTRUSTED_Relay 9611 4.29 19.90 1.71 98 RELAYCOUNTRY_CA 9390 2.47 7.33 1.67 99 XM_DK_Undo_01 8992 1.51 1.00 1.60 100 HELO_NODOT 8963 1.53 1.13 1.59 101 HELO_NO_DOMAIN 8956 1.52 1.12 1.59 102 XM_B_SpammyTLD 8951 2.05 4.80 1.59 103 XM_B_COVIDMETA 8630 2.19 6.18 1.53 104 XMDiploma_00 8627 1.56 1.76 1.53 105 TooManyTo_003 8039 1.31 0.62 1.43 106 T_XMDrugObfuBody_08 7929 1.55 2.38 1.41 107 SUBJ_ALL_CAPS 7912 1.80 4.19 1.40 108 TR_Symld_Words 7717 1.42 1.74 1.37 109 T_XMDrugObfuBody_14 7648 1.44 1.92 1.36 110 HELO_MISC_IP 7635 1.32 1.09 1.36 111 CK_HELO_DYNAMIC_SPLIT_IP 7628 1.31 1.04 1.35 112 URI_HEX 7595 1.39 1.66 1.35 113 INVALID_MSGID 7455 1.32 1.30 1.32 114 IN_HORDE_ADDRESS_BOOK 7106 1.09 0.08 1.26 115 XMCapTrack 6996 1.16 0.69 1.24 116 RCVD_IN_MSPIKE_H5 6976 1.08 0.10 1.24 117 XM_GoogleGroups 6887 1.12 0.52 1.22 118 TO_MALFORMED 6499 0.99 0.02 1.15 119 RELAYCOUNTRY_GB 6331 1.23 1.88 1.12 120 DKIM_ADSP_CUSTOM_MED 6257 1.23 1.92 1.11 121 XMStockSpam_06 6126 1.15 1.55 1.09 122 TooManyTo_004 6031 0.99 0.53 1.07 123 TM2_M_VERY_LONG_WORD 5831 1.10 1.50 1.04 124 XMSubNoVowel 5794 1.12 1.64 1.03 125 XM_OfRef6 5785 1.48 4.21 1.03 126 XM_H_Long_From02 5706 0.96 0.63 1.01 127 XM_UB50 5603 1.92 7.52 0.99 128 URI_TRY_3LD 5589 1.11 1.83 0.99 129 USER_IN_DEF_DKIM_WL 5538 0.84 0.00 0.98 130 RCVD_IN_BL_SPAMCOP_NET 5438 1.83 7.06 0.97 131 XMBody_17 5259 1.12 2.27 0.93 132 TooManyTo_005 5157 0.84 0.41 0.92 133 XMBrknScrpt_02 4977 1.06 2.10 0.88 134 HTML_FONT_FACE_BAD 4964 0.84 0.56 0.88 135 XMHTML_After_End 4843 1.00 1.84 0.86 136 XMGenDplmaNmb 4762 0.91 1.32 0.85 137 XMGappySubj_01 4602 0.72 0.16 0.82 138 SpammyFromTLD_01 4599 1.53 5.81 0.82 139 TR_LOTS_OF_MONEY3 4486 0.90 1.55 0.80 140 NML_ADSP_CUSTOM_MED 4457 0.93 1.76 0.79 141 XMBdyGiftCard01 4430 0.82 1.02 0.79 142 T_FILL_THIS_FORM_SHORT 4347 0.86 1.38 0.77 143 T_OBFU_PDF_ATTACH 4220 0.67 0.20 0.75 144 T_TooManySym_03 4120 0.74 0.77 0.73 145 XM_ProductURIs 4071 0.71 0.66 0.72 146 HTTPS_HTTP_MISMATCH 4023 0.71 0.65 0.71 147 TR_MSPIKEBAYES00 3988 0.61 0.01 0.71 148 XMBody_95 3971 0.62 0.12 0.71 149 TR_MetaPhish_Combo_01 3849 0.75 1.15 0.68 150 T_XMDrugObfuBody_00 3829 0.83 1.74 0.68 151 XMSexyCombo_01 3734 0.92 2.44 0.66 152 TR_XM_COVIDMETA4 3716 1.16 4.17 0.66 153 XMPhish30 3608 0.70 1.03 0.64 154 XM_DIRTYINTL 3405 1.13 4.31 0.60 155 XMSubMetaI_00 3350 0.64 0.91 0.59 156 XM_SPF_Unknown 3330 0.61 0.75 0.59 157 PLING_QUERY 3302 0.56 0.43 0.59 158 XM_E_Blogspot 3298 0.52 0.10 0.59 159 XMMoneyMeta_00 3271 0.61 0.77 0.58 160 XM_H_PHPMailer 3241 0.65 1.13 0.58 161 T_Symld_Words_02 3204 0.69 1.40 0.57 162 TR_XM_PHPDW 3067 0.84 2.61 0.54 163 XM_ShortIntro_01 2975 0.58 0.92 0.53 164 TR_XM_FormFill2 2936 0.81 2.55 0.52 165 TR_XM_PHPForged 2915 0.81 2.57 0.52 166 XM_B_REG_HTML 2895 0.46 0.15 0.51 167 HTML_TAG_BALANCE_BODY 2882 0.55 0.81 0.51 168 XM_H_PHPOS 2882 0.80 2.54 0.51 169 T_XMHurry_00 2819 0.61 1.24 0.50 170 FORGED_GMAIL_RCVD 2744 0.66 1.73 0.49 171 RCVD_IN_MSPIKE_BL 2741 1.81 9.81 0.49 172 TM2_M_BODY_EMPTY 2691 0.51 0.72 0.48 173 RCVD_IN_SORBS_DUL 2640 0.46 0.38 0.47 174 MISSING_HEADERS 2594 0.76 2.59 0.46 175 XMBody_78 2578 0.54 1.05 0.46 176 HTML_IMAGE_ONLY_20 2558 0.58 1.31 0.45 177 FROM_GOV_DKIM_AU 2555 0.40 0.06 0.45 178 HTML_IMAGE_ONLY_32 2524 0.42 0.24 0.45 179 FROM_GOV_SPOOF 2514 0.42 0.23 0.45 180 URI_NOVOWEL 2440 0.49 0.86 0.43 181 XMSubMetaSxObfu_03 2430 0.56 1.35 0.43 182 XMSlimDrugH 2403 0.47 0.72 0.43 183 RELAYCOUNTRY_DE 2387 0.66 2.12 0.42 184 TR_BOTNET_NEGATE 2375 0.41 0.37 0.42 185 XMNoVowels 2372 0.46 0.70 0.42 186 SHORT_HELO_AND_INLINE_IMAGE 2359 0.37 0.10 0.42 187 NUMERIC_HTTP_ADDR 2322 0.41 0.42 0.41 188 XMHTMLBadTable_001 2308 0.39 0.30 0.41 189 XMPhish08 2278 0.52 1.20 0.40 190 HTML_IMAGE_ONLY_28 2257 0.39 0.36 0.40 191 XMOemUri 2216 0.39 0.36 0.39 192 TR_XM_COVIDMETA1 2175 0.67 2.38 0.39 193 XM_B_COPY_HTML 2149 0.38 0.37 0.38 194 T_MONEY_PERCENT 2133 0.56 1.62 0.38 195 TR_LOTS_OF_MONEY2 2133 0.56 1.62 0.38 196 XMLKML 2071 0.32 0.00 0.37 197 XMSubMetaSxObfu_02 2053 0.36 0.36 0.36 198 RELAYCOUNTRY_AU 2009 0.39 0.57 0.36 199 XMPhish14 2007 0.43 0.85 0.36 200 DIET_1 1959 0.43 0.94 0.35 ----------------------------------------------------------------------