Email: 796029 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 1.85 sec Spam: 95330 Autolearn: 0 AvgScore: 12.70 AvgScanTime: 3.96 sec Ham: 700699 Autolearn: 0 AvgScore: -2.83 AvgScanTime: 1.56 sec Time Spent Running SA: 408.19 hours Time Spent Processing Spam: 104.99 hours Time Spent Processing Ham: 303.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 92582 98.31 97.12 98.47 2 HTML_MESSAGE 88361 81.35 92.69 79.81 3 DKIM_SIGNED 70165 63.62 73.60 62.26 4 RELAYCOUNTRY_US 67241 73.24 70.53 73.60 5 XM_B_Unicode 65127 63.25 68.32 62.56 6 XM_DK_Pass 64679 62.07 67.85 61.29 7 XMListUnsubscribeExists 63491 43.99 66.60 40.92 8 DKIM_VALID 52440 57.22 55.01 57.52 9 XM_DK_Undo_02 45230 13.88 47.45 9.31 10 DKIM_VALID_AU 38770 43.02 40.67 43.34 11 BAYES_50 37852 44.19 39.71 44.80 12 XM_B_Unicode3 35983 37.41 37.75 37.36 13 BOTNET 35732 6.90 37.48 2.73 14 BAYES_99 31437 8.98 32.98 5.72 15 MIME_HTML_ONLY 30591 22.01 32.09 20.63 16 LOC_TINY_FONT_1 29897 20.94 31.36 19.53 17 RELAYCOUNTRY_META 27556 7.92 28.91 5.06 18 FVGT_m_MULTI_ODD 26350 19.12 27.64 17.96 19 HTML_FONT_LOW_CONTRAST 26084 22.35 27.36 21.66 20 DKIM_VALID_EF 25265 23.68 26.50 23.30 21 XMSubLong 24535 19.41 25.74 18.55 22 BAYES_999 24525 7.01 25.73 4.47 23 XM_UncommonTLD01 22434 5.06 23.53 2.55 24 BOTNET_IPINHOSTNAME 20602 6.24 21.61 4.15 25 UNTRUSTED_Relay 20151 4.44 21.14 2.16 26 RCVD_IN_MSPIKE_H2 19772 18.88 20.74 18.63 27 T_TM2_M_HEADER_IN_MSG 18148 22.34 19.04 22.79 28 T_KAM_HTML_FONT_INVALID 17766 15.17 18.64 14.70 29 DKIM_INVALID 17725 6.40 18.59 4.74 30 XM_Body_Dirty_Words 16480 12.14 17.29 11.44 31 XM_Multi_Part_URI 15509 15.71 16.27 15.64 32 HTML_IMAGE_RATIO_02 14527 6.31 15.24 5.10 33 SpammyFromTLD_02 14294 2.04 14.99 0.28 34 LOTS_OF_MONEY 12772 8.12 13.40 7.40 35 NO_DNS_FOR_FROM 11990 3.86 12.58 2.68 36 XMSexyCombo_05 11734 4.74 12.31 3.71 37 XM_B_Phish_Phrases 11022 6.50 11.56 5.81 38 XM_B_Unsub 10886 11.23 11.42 11.21 39 XM_Evil_Numbers_Gen 8810 7.87 9.24 7.68 40 FROM_SUSPICIOUS_NTLD 8604 1.13 9.03 0.05 41 XM_B_SpammyTLD 8571 2.26 8.99 1.35 42 FROM_SUSPICIOUS_NTLD_FP 8520 1.11 8.94 0.05 43 RCVD_IN_MSPIKE_BL 8220 1.60 8.62 0.65 44 LotsOfNums_01 7899 7.23 8.29 7.08 45 T_REMOTE_IMAGE 7850 3.49 8.23 2.85 46 MPART_ALT_DIFF 7842 7.10 8.23 6.95 47 RCVD_IN_MSPIKE_WL 7745 19.90 8.12 21.50 48 HTML_TAG_BALANCE_CENTER 7740 1.04 8.12 0.08 49 BAYES_60 7584 5.69 7.96 5.38 50 PDS_OTHER_BAD_TLD 7544 1.09 7.91 0.16 51 BAYES_80 7325 3.99 7.68 3.48 52 XMSubMetaSx_00 7297 3.49 7.65 2.93 53 XM_UB50 7214 2.15 7.57 1.41 54 TooManyTo_001 7168 7.20 7.52 7.16 55 XM_H_Long_From01 6743 4.64 7.07 4.31 56 UNPARSEABLE_RELAY 6523 5.53 6.84 5.35 57 TR_XM_PhishingBody 6510 3.01 6.83 2.49 58 MIME_HTML_MOSTLY 6259 2.54 6.57 2.00 59 XM_B_COVIDMETA 6203 1.99 6.51 1.37 60 FROM_EXCESS_BASE64 6125 2.94 6.43 2.46 61 XMNumbers 5917 2.91 6.21 2.46 62 RELAYCOUNTRY_CA 5770 1.99 6.05 1.43 63 XM_UB99 5740 0.72 6.02 0.00 64 REPLYTO_WITHOUT_TO_CC 5442 0.86 5.71 0.20 65 XM_SPF_SoftFail 5312 1.85 5.57 1.35 66 RCVD_IN_BL_SPAMCOP_NET 5242 1.75 5.50 1.24 67 TR_XM_COVIDMETA4 5139 1.21 5.39 0.64 68 HTML_MIME_NO_HTML_TAG 4971 2.54 5.21 2.17 69 BOTNET_NORDNS 4917 0.63 5.16 0.02 70 SpammyFromTLD_01 4651 1.25 4.88 0.75 71 HTML_IMAGE_RATIO_04 4645 10.36 4.87 11.11 72 XM_OfRef6 4595 1.52 4.82 1.07 73 XM_UB999 4433 0.56 4.65 0.00 74 RCVD_IN_RP_RNBL 4406 0.61 4.62 0.07 75 RCVD_IN_MSPIKE_H3 4391 11.31 4.61 12.23 76 BAYES_95 4366 2.35 4.58 2.04 77 XM_B_Phish66 4342 1.84 4.55 1.47 78 RELAYCOUNTRY_FR 4329 0.79 4.54 0.28 79 RCVD_IN_MSPIKE_L3 4322 0.74 4.53 0.23 80 TR_XM_INV_DKIM 4061 0.64 4.26 0.14 81 XM_SendGrid 3845 4.85 4.03 4.97 82 KHOP_HELO_FCRDNS 3842 1.69 4.03 1.37 83 T_XMDrugObfuBody_08 3737 1.71 3.92 1.41 84 HDRS_MISSP 3676 0.49 3.86 0.03 85 XM_DIRTYINTL 3658 0.90 3.84 0.50 86 BODY_URI_ONLY 3647 0.59 3.83 0.15 87 XM_URI_RBL 3510 0.60 3.68 0.19 88 MPART_ALT_DIFF_COUNT 3371 0.68 3.54 0.29 89 XMStrtUSub 3318 7.45 3.48 7.99 90 RCVD_IN_MSPIKE_H4 3254 7.48 3.41 8.03 91 TM2_M_URI_OPT_OUT 3131 13.33 3.28 14.70 92 RCVD_IN_PSBL 3072 0.40 3.22 0.01 93 TR_XM_MaxSPIKE 2936 0.39 3.08 0.02 94 TR_LOTS_OF_MONEY3 2901 1.02 3.04 0.75 95 RCVD_IN_MSPIKE_L5 2868 0.46 3.01 0.11 96 XM_CamelCaseFrm001 2722 1.75 2.86 1.61 97 URIBL_SBL_A 2604 0.45 2.73 0.14 98 MIME_QP_LONG_LINE 2578 4.32 2.70 4.54 99 TR_XM_PHPDW 2530 1.05 2.65 0.83 100 TR_XM_PHPForged 2512 1.03 2.64 0.81 101 XM_B_Unsub2 2511 4.36 2.63 4.59 102 TR_XM_FormFill2 2490 1.03 2.61 0.81 103 XM_H_PHPOS 2478 1.02 2.60 0.81 104 BAYES_40 2453 4.58 2.57 4.85 105 DKIM_ADSP_NXDOMAIN 2374 0.64 2.49 0.39 106 HTML_IMAGE_RATIO_08 2337 2.13 2.45 2.09 107 URI_TRY_3LD 2330 1.18 2.44 1.01 108 HTML_IMAGE_RATIO_06 2312 3.65 2.43 3.82 109 T_XMDrugObfuBody_00 2303 4.17 2.42 4.41 110 MAILING_LIST_MULTI 2292 2.00 2.40 1.94 111 NORDNS_LOW_CONTRAST 2235 0.29 2.34 0.01 112 T_TooManySym_01 2176 3.21 2.28 3.34 113 SUBJ_ALL_CAPS 2170 1.70 2.28 1.62 114 XM_UB60 2158 0.37 2.26 0.12 115 TR_XM_COVIDMETA1 2147 0.64 2.25 0.42 116 RELAYCOUNTRY_IN 2128 0.35 2.23 0.09 117 HTML_FONT_TINY_NORDNS 2125 0.49 2.23 0.25 118 XM_BadFromFormat 2105 0.36 2.21 0.11 119 TM2_M_VERY_LONG_WORD 2004 1.03 2.10 0.88 120 DATE_IN_PAST_03_06 1902 0.81 2.00 0.65 121 HTML_EXTRA_CLOSE 1891 0.26 1.98 0.02 122 TR_XM_MaxBayes 1888 0.25 1.98 0.01 123 HTML_IMAGE_ONLY_16 1846 0.39 1.94 0.18 124 XM_UB80 1843 0.27 1.93 0.05 125 BAYES_20 1796 3.96 1.88 4.24 126 TR_XM_RelayPhish 1788 0.32 1.88 0.11 127 MIME_HTML_ONLY_MULTI 1760 5.02 1.85 5.45 128 XMBody_17 1756 0.81 1.84 0.67 129 TR_Symld_Words 1755 1.42 1.84 1.36 130 ALL_TRUSTED 1736 20.22 1.82 22.72 131 XMSubNoVowel 1720 2.84 1.80 2.98 132 T_XMDrugObfuBody_14 1720 1.50 1.80 1.45 133 XMSubMetaI_00 1673 0.88 1.75 0.76 134 DKIM_ADSP_CUSTOM_MED 1606 0.96 1.68 0.86 135 BOUNCE_MESSAGE 1574 13.22 1.65 14.80 136 ANY_BOUNCE_MESSAGE 1574 13.22 1.65 14.80 137 URI_HEX 1563 1.31 1.64 1.26 138 LongTLD 1555 0.33 1.63 0.16 139 SCRIPT_GIBBERISH 1538 0.20 1.61 0.00 140 TR_LOTS_OF_MONEY2 1501 0.53 1.57 0.38 141 T_MONEY_PERCENT 1501 0.53 1.57 0.38 142 XMDiploma_00 1489 1.36 1.56 1.33 143 MIME_CHARSET_FARAWAY 1478 0.27 1.55 0.09 144 RELAYCOUNTRY_GB 1465 0.95 1.54 0.87 145 NML_ADSP_CUSTOM_MED 1440 0.73 1.51 0.62 146 TR_XM_DK_SendGrid 1432 2.50 1.50 2.63 147 XMHTML_After_End 1432 0.83 1.50 0.74 148 XMSexyCombo_01 1426 0.65 1.50 0.54 149 XM_PDF 1425 3.08 1.49 3.29 150 XM_XX_Yahoo 1387 0.22 1.45 0.05 151 FORGED_GMAIL_RCVD 1368 0.52 1.44 0.40 152 BAYES_00 1362 22.54 1.43 25.41 153 XM_UB95 1360 0.19 1.43 0.02 154 RELAYCOUNTRY_HU 1351 0.17 1.42 0.01 155 DATE_IN_PAST_06_12 1341 0.29 1.41 0.14 156 HTML_TAG_BALANCE_BODY 1278 0.49 1.34 0.38 157 T_FILL_THIS_FORM_SHORT 1233 0.68 1.29 0.59 158 XMMoneyMeta_00 1231 0.64 1.29 0.55 159 RDNS_DYNAMIC 1219 0.40 1.28 0.28 160 XMBrknScrpt_02 1195 0.63 1.25 0.54 161 SUBJ_ILLEGAL_CHARS 1178 0.16 1.24 0.02 162 XMBdyGiftCard01 1175 0.72 1.23 0.65 163 HELO_NODOT 1171 1.64 1.23 1.70 164 HELO_NO_DOMAIN 1170 1.64 1.23 1.70 165 XM_HighProb1 1164 0.15 1.22 0.01 166 BAYES_05 1151 3.73 1.21 4.07 167 XM_H_PHPMailer 1137 0.57 1.19 0.48 168 RELAYCOUNTRY_JP 1135 0.18 1.19 0.04 169 XM_H_Undi_Recip 1129 0.33 1.18 0.21 170 MIME_HEADER_CTYPE_ONLY 1129 0.33 1.18 0.21 171 RELAYCOUNTRY_DE 1127 0.61 1.18 0.53 172 HTML_SHORT_LINK_IMG_2 1110 0.17 1.16 0.03 173 RELAYCOUNTRY_RU 1108 0.16 1.16 0.02 174 TR_Mismatch_TLD_02 1095 0.19 1.15 0.06 175 TR_MetaPhish_Combo_01 1080 0.89 1.13 0.85 176 XMStockSpam_06 1039 0.94 1.09 0.93 177 HTML_SHORT_LINK_IMG_1 1030 0.14 1.08 0.01 178 XMGenDplmaNmb 1017 0.73 1.07 0.69 179 TR_Mismatch_TLD_01 1012 0.27 1.06 0.17 180 HK_RANDOM_REPLYTO 1003 0.37 1.05 0.27 181 XM_DK_Undo_01 983 1.31 1.03 1.35 182 MISSING_HEADERS 971 0.90 1.02 0.88 183 XM_H_PHPOS_M 957 0.29 1.00 0.19 184 XM_Nigeria_01 949 0.16 1.00 0.04 185 XM_OfRef7 948 0.24 0.99 0.13 186 XM_JunkDunk 943 0.12 0.99 0.00 187 XMSubMetaSxObfu_03 940 0.45 0.99 0.37 188 FUZZY_CREDIT 939 0.15 0.98 0.04 189 HK_RANDOM_FROM 932 0.50 0.98 0.43 190 HTML_IMAGE_ONLY_20 924 0.38 0.97 0.30 191 DIET_1 915 0.38 0.96 0.30 192 HK_SCAM 914 0.15 0.96 0.04 193 CHARSET_FARAWAY_HEADER 912 0.15 0.96 0.04 194 URIBL_BLACK 905 0.14 0.95 0.03 195 XM_SPF_Unknown 895 0.54 0.94 0.48 196 RELAYCOUNTRY_IT 889 0.21 0.93 0.11 197 HDRS_LCASE_IMGONLY 888 0.12 0.93 0.01 198 SHORTENER_SHORT_IMG 874 0.11 0.92 0.00 199 TM2_M_BODY_EMPTY 867 0.40 0.91 0.33 200 XM_H_MailChimp 867 0.26 0.91 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 690003 98.31 97.12 98.47 2 HTML_MESSAGE 559197 81.35 92.69 79.81 3 RELAYCOUNTRY_US 515736 73.24 70.53 73.60 4 XM_B_Unicode 438341 63.25 68.32 62.56 5 DKIM_SIGNED 436258 63.62 73.60 62.26 6 XM_DK_Pass 429447 62.07 67.85 61.29 7 DKIM_VALID 403054 57.22 55.01 57.52 8 BAYES_50 313912 44.19 39.71 44.80 9 DKIM_VALID_AU 303689 43.02 40.67 43.34 10 XMListUnsubscribeExists 286720 43.99 66.60 40.92 11 XM_B_Unicode3 261798 37.41 37.75 37.36 12 BAYES_00 178068 22.54 1.43 25.41 13 DKIM_VALID_EF 163236 23.68 26.50 23.30 14 T_TM2_M_HEADER_IN_MSG 159710 22.34 19.04 22.79 15 ALL_TRUSTED 159229 20.22 1.82 22.72 16 HTML_FONT_LOW_CONTRAST 151804 22.35 27.36 21.66 17 RCVD_IN_MSPIKE_WL 150667 19.90 8.12 21.50 18 MIME_HTML_ONLY 144584 22.01 32.09 20.63 19 LOC_TINY_FONT_1 136814 20.94 31.36 19.53 20 RCVD_IN_MSPIKE_H2 130549 18.88 20.74 18.63 21 XMSubLong 129986 19.41 25.74 18.55 22 FVGT_m_MULTI_ODD 125843 19.12 27.64 17.96 23 XM_Multi_Part_URI 109565 15.71 16.27 15.64 24 ANY_BOUNCE_MESSAGE 103675 13.22 1.65 14.80 25 BOUNCE_MESSAGE 103670 13.22 1.65 14.80 26 T_KAM_HTML_FONT_INVALID 102980 15.17 18.64 14.70 27 TM2_M_URI_OPT_OUT 102969 13.33 3.28 14.70 28 RCVD_IN_MSPIKE_H3 85677 11.31 4.61 12.23 29 XM_Body_Dirty_Words 80179 12.14 17.29 11.44 30 XM_B_Unsub 78537 11.23 11.42 11.21 31 HTML_IMAGE_RATIO_04 77851 10.36 4.87 11.11 32 XM_DK_Undo_02 65258 13.88 47.45 9.31 33 XM_H_Trusted_IP 62761 7.88 0.00 8.96 34 HTML_FONT_FACE_BAD 60328 7.64 0.49 8.61 35 RCVD_IN_MSPIKE_H4 56263 7.48 3.41 8.03 36 XMStrtUSub 55974 7.45 3.48 7.99 37 XM_Evil_Numbers_Gen 53800 7.87 9.24 7.68 38 LOTS_OF_MONEY 51849 8.12 13.40 7.40 39 IN_ZIMBRA_NJ_WHITELIST 50871 6.40 0.04 7.26 40 TooManyTo_001 50183 7.20 7.52 7.16 41 TR_XM_DK_Bayes 49778 6.33 0.63 7.10 42 LotsOfNums_01 49635 7.23 8.29 7.08 43 MPART_ALT_DIFF 48709 7.10 8.23 6.95 44 TR_XM_DK_Bayes1 46296 5.86 0.37 6.61 45 XM_B_Phish_Phrases 40701 6.50 11.56 5.81 46 RCVD_IN_RP_SAFE 40624 5.17 0.60 5.80 47 TR_XM_DK_Bayes2 40556 5.13 0.31 5.79 48 BAYES_99 40048 8.98 32.98 5.72 49 MIME_HTML_ONLY_MULTI 38201 5.02 1.85 5.45 50 XM_DKIMWhitelistDomains 38093 4.79 0.02 5.44 51 BAYES_60 37700 5.69 7.96 5.38 52 UNPARSEABLE_RELAY 37481 5.53 6.84 5.35 53 RCVD_IN_RP_CERTIFIED 36249 4.59 0.33 5.17 54 HTML_IMAGE_RATIO_02 35712 6.31 15.24 5.10 55 RELAYCOUNTRY_META 35467 7.92 28.91 5.06 56 XM_SendGrid 34794 4.85 4.03 4.97 57 BAYES_40 34010 4.58 2.57 4.85 58 DKIM_INVALID 33204 6.40 18.59 4.74 59 XM_B_Unsub2 32170 4.36 2.63 4.59 60 MIME_QP_LONG_LINE 31783 4.32 2.70 4.54 61 BAYES_999 31314 7.01 25.73 4.47 62 T_XMDrugObfuBody_00 30886 4.17 2.42 4.41 63 XM_H_Long_From01 30172 4.64 7.07 4.31 64 BAYES_20 29736 3.96 1.88 4.24 65 BOTNET_IPINHOSTNAME 29099 6.24 21.61 4.15 66 BAYES_05 28508 3.73 1.21 4.07 67 RCVD_IN_IADB_LISTED 28251 3.66 0.89 4.03 68 HTML_IMAGE_RATIO_06 26736 3.65 2.43 3.82 69 XMSexyCombo_05 26007 4.74 12.31 3.71 70 RCVD_IN_IADB_SPF 24679 3.19 0.79 3.52 71 BAYES_80 24398 3.99 7.68 3.48 72 T_TooManySym_01 23412 3.21 2.28 3.34 73 XM_PDF 23076 3.08 1.49 3.29 74 RCVD_IN_IADB_DK 21503 2.79 0.76 3.07 75 RCVD_IN_IADB_SENDERID 21499 2.79 0.76 3.07 76 XMSubNoVowel 20902 2.84 1.80 2.98 77 XMSubMetaSx_00 20519 3.49 7.65 2.93 78 T_REMOTE_IMAGE 19965 3.49 8.23 2.85 79 BOTNET 19160 6.90 37.48 2.73 80 NO_DNS_FOR_FROM 18757 3.86 12.58 2.68 81 TR_XM_DK_SendGrid 18437 2.50 1.50 2.63 82 XM_UncommonTLD01 17858 5.06 23.53 2.55 83 TR_XM_PhishingBody 17454 3.01 6.83 2.49 84 RCVD_IN_IADB_VOUCHED 17366 2.22 0.33 2.48 85 XMNumbers 17246 2.91 6.21 2.46 86 FROM_EXCESS_BASE64 17246 2.94 6.43 2.46 87 HTML_MIME_NO_HTML_TAG 15231 2.54 5.21 2.17 88 UNTRUSTED_Relay 15168 4.44 21.14 2.16 89 HTML_IMAGE_RATIO_08 14654 2.13 2.45 2.09 90 BAYES_95 14308 2.35 4.58 2.04 91 MIME_HTML_MOSTLY 13994 2.54 6.57 2.00 92 MAILING_LIST_MULTI 13593 2.00 2.40 1.94 93 HELO_NODOT 11903 1.64 1.23 1.70 94 HELO_NO_DOMAIN 11902 1.64 1.23 1.70 95 SUBJ_ALL_CAPS 11352 1.70 2.28 1.62 96 XM_CamelCaseFrm001 11248 1.75 2.86 1.61 97 TooManyTo_002 11130 1.48 0.67 1.59 98 T_TooManySym_02 10900 1.45 0.67 1.56 99 RCVD_IN_IADB_OPTIN 10733 1.39 0.31 1.53 100 XM_B_Phish66 10327 1.84 4.55 1.47 101 T_XMDrugObfuBody_14 10182 1.50 1.80 1.45 102 RELAYCOUNTRY_CA 10045 1.99 6.05 1.43 103 XM_UB50 9864 2.15 7.57 1.41 104 T_XMDrugObfuBody_08 9856 1.71 3.92 1.41 105 XM_B_COVIDMETA 9628 1.99 6.51 1.37 106 KHOP_HELO_FCRDNS 9603 1.69 4.03 1.37 107 TR_Symld_Words 9557 1.42 1.84 1.36 108 XM_B_SpammyTLD 9455 2.26 8.99 1.35 109 XM_SPF_SoftFail 9429 1.85 5.57 1.35 110 XM_DK_Undo_01 9427 1.31 1.03 1.35 111 XMDiploma_00 9338 1.36 1.56 1.33 112 TVD_RCVD_IP 9061 1.20 0.51 1.29 113 URI_HEX 8857 1.31 1.64 1.26 114 RCVD_IN_MSPIKE_H5 8727 1.11 0.10 1.25 115 RCVD_IN_BL_SPAMCOP_NET 8662 1.75 5.50 1.24 116 CK_HELO_DYNAMIC_SPLIT_IP 7788 1.08 0.85 1.11 117 HELO_MISC_IP 7788 1.06 0.68 1.11 118 XM_OfRef6 7513 1.52 4.82 1.07 119 INVALID_MSGID 7442 0.95 0.15 1.06 120 TooManyTo_003 7316 0.98 0.50 1.04 121 IN_HORDE_ADDRESS_BOOK 7200 0.91 0.04 1.03 122 XM_GoogleGroups 7197 0.96 0.50 1.03 123 XMSubGarbage 7189 0.94 0.29 1.03 124 XMSubLongNoVowel 7158 0.95 0.40 1.02 125 URI_TRY_3LD 7052 1.18 2.44 1.01 126 TO_MALFORMED 6497 0.82 0.05 0.93 127 XMStockSpam_06 6483 0.94 1.09 0.93 128 XMCapTrack 6233 0.85 0.54 0.89 129 XM_H_Long_From02 6209 0.89 0.89 0.89 130 TM2_M_VERY_LONG_WORD 6199 1.03 2.10 0.88 131 MISSING_HEADERS 6170 0.90 1.02 0.88 132 RELAYCOUNTRY_GB 6103 0.95 1.54 0.87 133 DKIM_ADSP_CUSTOM_MED 6014 0.96 1.68 0.86 134 TR_MetaPhish_Combo_01 5968 0.89 1.13 0.85 135 TR_XM_PHPDW 5827 1.05 2.65 0.83 136 TR_XM_FormFill2 5707 1.03 2.61 0.81 137 TR_XM_PHPForged 5703 1.03 2.64 0.81 138 XM_H_PHPOS 5671 1.02 2.60 0.81 139 TooManyTo_004 5532 0.75 0.42 0.79 140 USER_IN_DEF_DKIM_WL 5350 0.67 0.01 0.76 141 XMSubMetaI_00 5338 0.88 1.75 0.76 142 SpammyFromTLD_01 5261 1.25 4.88 0.75 143 TR_LOTS_OF_MONEY3 5251 1.02 3.04 0.75 144 XM_E_Blogspot 5185 0.66 0.08 0.74 145 XMHTML_After_End 5174 0.83 1.50 0.74 146 TR_MSPIKEBAYES00 5009 0.63 0.05 0.71 147 XMGappySubj_01 4983 0.68 0.42 0.71 148 XMGenDplmaNmb 4803 0.73 1.07 0.69 149 XMBody_17 4725 0.81 1.84 0.67 150 TooManyTo_005 4659 0.63 0.36 0.66 151 T_OBFU_PDF_ATTACH 4594 0.61 0.28 0.66 152 DATE_IN_PAST_03_06 4564 0.81 2.00 0.65 153 XMBdyGiftCard01 4553 0.72 1.23 0.65 154 RCVD_IN_MSPIKE_BL 4550 1.60 8.62 0.65 155 TR_XM_COVIDMETA4 4516 1.21 5.39 0.64 156 NML_ADSP_CUSTOM_MED 4370 0.73 1.51 0.62 157 T_FILL_THIS_FORM_SHORT 4155 0.68 1.29 0.59 158 TO_NO_BRKTS_HTML_ONLY 3861 0.54 0.44 0.55 159 XMMoneyMeta_00 3847 0.64 1.29 0.55 160 XMBrknScrpt_02 3790 0.63 1.25 0.54 161 XMSexyCombo_01 3763 0.65 1.50 0.54 162 XM_ProductURIs 3723 0.54 0.61 0.53 163 XMBody_95 3720 0.48 0.11 0.53 164 RELAYCOUNTRY_DE 3701 0.61 1.18 0.53 165 HTTPS_HTTP_MISMATCH 3672 0.55 0.76 0.52 166 XM_DIRTYINTL 3490 0.90 3.84 0.50 167 XM_RXBody 3415 0.47 0.36 0.49 168 T_TooManySym_03 3395 0.45 0.23 0.48 169 XM_H_PHPMailer 3388 0.57 1.19 0.48 170 XM_SPF_Unknown 3380 0.54 0.94 0.48 171 T_XMHurry_00 3359 0.52 0.80 0.48 172 HK_RANDOM_FROM 3041 0.50 0.98 0.43 173 T_Symld_Words_02 2997 0.48 0.83 0.43 174 RELAYCOUNTRY_KE 2991 0.39 0.14 0.43 175 FROM_GOV_DKIM_AU 2947 0.38 0.07 0.42 176 FROM_GOV_SPOOF 2922 0.39 0.19 0.42 177 TR_XM_COVIDMETA1 2908 0.64 2.25 0.42 178 FORGED_GMAIL_RCVD 2802 0.52 1.44 0.40 179 XM_ShortIntro_01 2773 0.41 0.48 0.40 180 DKIM_ADSP_NXDOMAIN 2748 0.64 2.49 0.39 181 NUMERIC_HTTP_ADDR 2738 0.41 0.51 0.39 182 T_MONEY_PERCENT 2691 0.53 1.57 0.38 183 TR_LOTS_OF_MONEY2 2691 0.53 1.57 0.38 184 TR_BOTNET_NEGATE 2631 0.38 0.40 0.38 185 HTML_TAG_BALANCE_BODY 2629 0.49 1.34 0.38 186 XMSubMetaSxObfu_03 2624 0.45 0.99 0.37 187 RCVD_IN_SORBS_DUL 2617 0.39 0.51 0.37 188 XMPhish30 2604 0.43 0.83 0.37 189 XMNoVowels 2531 0.37 0.45 0.36 190 XM_B_COPY_HTML 2516 0.36 0.36 0.36 191 XMHTMLBadTable_001 2448 0.35 0.39 0.35 192 XMPhish08 2443 0.40 0.78 0.35 193 XMLngstWrd_00 2309 0.38 0.76 0.33 194 XM_B_REG_HTML 2292 0.31 0.18 0.33 195 TM2_M_BODY_EMPTY 2284 0.40 0.91 0.33 196 HTML_IMAGE_ONLY_28 2255 0.32 0.31 0.32 197 TR_Orig_Subnet 2177 0.28 0.07 0.31 198 SHORT_HELO_AND_INLINE_IMAGE 2173 0.28 0.10 0.31 199 HTML_IMAGE_ONLY_32 2156 0.31 0.32 0.31 200 XMBody_78 2139 0.37 0.84 0.31 ----------------------------------------------------------------------