Email: 711632 Autolearn: 0 AvgScore: 0.29 AvgScanTime: 1.93 sec Spam: 100192 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 3.95 sec Ham: 611440 Autolearn: 0 AvgScore: -1.87 AvgScanTime: 1.59 sec Time Spent Running SA: 380.57 hours Time Spent Processing Spam: 110.07 hours Time Spent Processing Ham: 270.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97585 98.34 97.40 98.50 2 HTML_MESSAGE 92563 82.63 92.39 81.04 3 DKIM_SIGNED 69400 67.89 69.27 67.66 4 RELAYCOUNTRY_US 67516 72.40 67.39 73.23 5 XM_DK_Pass 65179 66.33 65.05 66.53 6 XMListUnsubscribeExists 63482 49.26 63.36 46.95 7 XM_B_Unicode 63257 63.25 63.14 63.26 8 DKIM_VALID 52633 61.16 52.53 62.57 9 XM_DK_Undo_02 44680 15.59 44.59 10.84 10 BAYES_50 40112 46.55 40.04 47.61 11 BOTNET 38854 8.10 38.78 3.08 12 DKIM_VALID_AU 36817 45.15 36.75 46.53 13 MIME_HTML_ONLY 34663 22.40 34.60 20.40 14 XM_B_Unicode3 34119 36.45 34.05 36.84 15 BAYES_99 33395 10.62 33.33 6.90 16 RELAYCOUNTRY_META 31160 8.40 31.10 4.68 17 LOC_TINY_FONT_1 30276 23.47 30.22 22.37 18 FVGT_m_MULTI_ODD 27024 21.15 26.97 20.19 19 XM_UncommonTLD01 26324 6.05 26.27 2.73 20 BAYES_999 25624 8.33 25.57 5.51 21 HTML_FONT_LOW_CONTRAST 24978 24.51 24.93 24.44 22 DKIM_VALID_EF 24283 23.24 24.24 23.07 23 UNTRUSTED_Relay 23635 4.64 23.59 1.53 24 XMSubLong 22469 20.00 22.43 19.60 25 RCVD_IN_MSPIKE_H2 21409 21.50 21.37 21.52 26 T_TM2_M_HEADER_IN_MSG 21349 24.18 21.31 24.65 27 BOTNET_IPINHOSTNAME 20568 7.09 20.53 4.89 28 T_KAM_HTML_FONT_INVALID 19109 17.77 19.07 17.56 29 XM_Body_Dirty_Words 17387 14.38 17.35 13.89 30 DKIM_INVALID 16767 6.73 16.73 5.09 31 SpammyFromTLD_02 16486 2.62 16.45 0.35 32 FROM_SUSPICIOUS_NTLD 16051 2.28 16.02 0.03 33 HTML_IMAGE_RATIO_02 15939 7.82 15.91 6.49 34 FROM_SUSPICIOUS_NTLD_FP 15922 2.26 15.89 0.02 35 XM_Multi_Part_URI 14954 16.02 14.93 16.20 36 XMSexyCombo_05 12566 5.56 12.54 4.41 37 XM_B_Unsub 12273 12.75 12.25 12.83 38 NO_DNS_FOR_FROM 12085 4.07 12.06 2.76 39 LOTS_OF_MONEY 11598 8.30 11.58 7.76 40 XM_B_Phish_Phrases 11396 8.24 11.37 7.73 41 PDS_OTHER_BAD_TLD 10260 1.55 10.24 0.13 42 T_REMOTE_IMAGE 10133 4.11 10.11 3.13 43 RCVD_IN_BL_SPAMCOP_NET 9347 2.52 9.33 1.40 44 MPART_ALT_DIFF 8858 5.78 8.84 5.28 45 XM_Evil_Numbers_Gen 8679 8.01 8.66 7.91 46 RCVD_IN_MSPIKE_BL 8594 1.74 8.58 0.62 47 BAYES_60 8575 6.95 8.56 6.69 48 XMSubMetaSx_00 8363 4.08 8.35 3.38 49 FROM_EXCESS_BASE64 8258 3.53 8.24 2.75 50 XM_UB50 8228 1.94 8.21 0.91 51 LotsOfNums_01 7924 8.19 7.91 8.23 52 RCVD_IN_MSPIKE_WL 7918 21.69 7.90 23.95 53 HTML_MIME_NO_HTML_TAG 7896 3.19 7.88 2.42 54 BAYES_80 7893 4.48 7.88 3.92 55 BOTNET_NORDNS 7616 1.09 7.60 0.02 56 XM_B_SpammyTLD 7581 2.48 7.57 1.65 57 MIME_HTML_MOSTLY 7366 3.44 7.35 2.80 58 TR_XM_PhishingBody 7304 3.63 7.29 3.03 59 HTML_TAG_BALANCE_CENTER 7289 1.12 7.28 0.11 60 TooManyTo_001 6529 7.82 6.52 8.04 61 HDRS_MISSP 6384 0.94 6.37 0.05 62 XM_UB99 6343 0.90 6.33 0.01 63 RCVD_IN_RP_RNBL 6288 0.94 6.28 0.07 64 XM_B_COVIDMETA 6235 2.27 6.22 1.62 65 RELAYCOUNTRY_CA 6147 2.26 6.14 1.62 66 UNPARSEABLE_RELAY 5974 6.00 5.96 6.01 67 XM_H_Long_From01 5730 5.18 5.72 5.09 68 DKIM_ADSP_NXDOMAIN 5670 1.04 5.66 0.28 69 BODY_URI_ONLY 5618 0.83 5.61 0.04 70 XM_SPF_SoftFail 5533 1.95 5.52 1.36 71 RELAYCOUNTRY_FR 5397 1.02 5.39 0.31 72 XM_B_Phish66 5125 2.26 5.12 1.79 73 KHOP_HELO_FCRDNS 5099 1.99 5.09 1.48 74 RCVD_IN_MSPIKE_L3 4996 1.08 4.99 0.44 75 TR_XM_COVIDMETA4 4887 1.32 4.88 0.73 76 RCVD_IN_MSPIKE_H3 4793 12.55 4.78 13.82 77 XMNumbers 4728 3.25 4.72 3.00 78 HTML_IMAGE_RATIO_04 4693 5.87 4.68 6.07 79 SCRIPT_GIBBERISH 4666 0.66 4.66 0.00 80 RELAYCOUNTRY_DE 4523 0.89 4.51 0.30 81 XM_UB999 4505 0.64 4.50 0.01 82 TR_XM_INV_DKIM 4480 0.82 4.47 0.23 83 XM_SendGrid 4370 5.39 4.36 5.56 84 SpammyFromTLD_01 4335 1.33 4.33 0.84 85 BAYES_95 4111 2.52 4.10 2.26 86 REPLYTO_WITHOUT_TO_CC 4059 0.63 4.05 0.07 87 XM_OfRef6 3861 1.42 3.85 1.03 88 LongTLD 3805 0.66 3.80 0.15 89 XMMoneyMeta_00 3776 0.93 3.77 0.46 90 XM_DIRTYINTL 3738 0.97 3.73 0.52 91 TM2_M_URI_OPT_OUT 3687 12.79 3.68 14.28 92 XMHTML_After_End 3679 1.16 3.67 0.75 93 SUBJ_ALL_CAPS 3572 1.77 3.57 1.48 94 TR_XM_COVIDMETA1 3294 0.92 3.29 0.53 95 TR_XM_MaxWHORU 3275 0.52 3.27 0.07 96 XMMoneyMeta_01 3266 0.48 3.26 0.03 97 XM_UB60 3186 0.53 3.18 0.10 98 TR_XM_MaxSPIKE 3156 0.48 3.15 0.04 99 T_XMDrugObfuBody_08 3130 1.56 3.12 1.30 100 RCVD_IN_PSBL 3088 0.45 3.08 0.02 101 XM_URI_RBL 3026 0.59 3.02 0.19 102 RCVD_IN_MSPIKE_H4 2988 7.86 2.98 8.66 103 MPART_ALT_DIFF_COUNT 2963 0.66 2.96 0.28 104 XM_B_Unsub2 2870 4.80 2.86 5.12 105 RCVD_IN_MSPIKE_L5 2796 0.48 2.79 0.10 106 TR_XM_UnparsRelay 2777 0.70 2.77 0.36 107 HTML_IMAGE_RATIO_06 2739 3.47 2.73 3.59 108 MIME_QP_LONG_LINE 2727 4.82 2.72 5.16 109 XM_UB80 2711 0.41 2.71 0.03 110 XMBody_17 2611 0.93 2.61 0.65 111 ALL_TRUSTED 2538 20.48 2.53 23.42 112 XMStrtUSub 2478 4.29 2.47 4.59 113 BAYES_40 2476 3.84 2.47 4.06 114 XMDiploma_00 2360 1.71 2.36 1.60 115 XM_BadFromFormat 2231 0.44 2.23 0.14 116 XM_CamelCaseFrm001 2200 1.98 2.20 1.95 117 TR_XM_PHPDW 2191 0.61 2.19 0.35 118 TR_XM_PHPForged 2163 0.58 2.16 0.32 119 TR_XM_FormFill2 2135 0.58 2.13 0.32 120 XM_H_PHPOS 2127 0.57 2.12 0.32 121 NORDNS_LOW_CONTRAST 2113 0.30 2.11 0.01 122 XMSexyCombo_01 2107 1.03 2.10 0.85 123 INVALID_MSGID 2076 1.33 2.07 1.21 124 MIME_HTML_ONLY_MULTI 2022 3.41 2.02 3.64 125 DATE_IN_PAST_03_06 1994 0.41 1.99 0.15 126 XM_JunkDunk 1978 0.28 1.97 0.00 127 XMLngstWrd_00 1977 0.91 1.97 0.73 128 XMLngstWrd_01 1946 0.79 1.94 0.61 129 HTML_IMAGE_RATIO_08 1932 2.10 1.93 2.13 130 MAILING_LIST_MULTI 1881 1.84 1.88 1.83 131 XMLngstWrd_02 1877 0.65 1.87 0.45 132 XM_UB95 1850 0.28 1.85 0.02 133 TM2_M_VERY_LONG_WORD 1844 1.03 1.84 0.90 134 XMLngstWrd_03 1821 0.50 1.82 0.29 135 T_TooManySym_01 1780 3.59 1.78 3.89 136 T_XMDrugObfuBody_14 1767 1.64 1.76 1.62 137 URIBL_SBL_A 1762 0.42 1.76 0.20 138 RELAYCOUNTRY_IN 1752 0.34 1.75 0.11 139 XMLngstWrd_04 1726 0.42 1.72 0.21 140 XMGenDplmaNmb 1718 1.02 1.71 0.90 141 T_Symld_Words_02 1716 0.70 1.71 0.53 142 TR_Mismatch_TLD_02 1684 0.31 1.68 0.08 143 HTML_IMAGE_ONLY_16 1657 0.40 1.65 0.19 144 DKIM_ADSP_CUSTOM_MED 1640 1.07 1.64 0.98 145 MIME_HEADER_CTYPE_ONLY 1639 0.42 1.64 0.22 146 BAYES_20 1621 3.17 1.62 3.42 147 URI_HEX 1605 1.63 1.60 1.64 148 TR_XM_DK_SendGrid 1603 2.83 1.60 3.03 149 FVGT_m_MULTI_ODD_EMAIL 1584 0.25 1.58 0.04 150 TR_XM_RelayPhish 1556 0.32 1.55 0.12 151 T_XMDrugObfuBody_00 1518 2.34 1.52 2.48 152 RELAYCOUNTRY_GB 1516 0.98 1.51 0.89 153 URI_WP_HACKED_2 1507 0.66 1.50 0.52 154 XMBrknScrpt_02 1496 0.82 1.49 0.71 155 HTML_IMAGE_ONLY_08 1472 0.29 1.47 0.09 156 HTML_TITLE_SUBJ_DIFF 1462 0.23 1.46 0.03 157 XM_OfRef7 1452 0.31 1.45 0.13 158 FORGED_GMAIL_RCVD 1451 0.56 1.45 0.41 159 NML_ADSP_CUSTOM_MED 1432 0.81 1.43 0.71 160 URI_TRY_3LD 1426 1.25 1.42 1.22 161 TR_Symld_Words 1389 1.64 1.39 1.68 162 HTML_SHORT_LINK_IMG_2 1383 0.23 1.38 0.04 163 XMSubNoVowel 1371 0.97 1.37 0.91 164 HTML_SHORT_LINK_IMG_1 1362 0.20 1.36 0.01 165 TR_LOTS_OF_MONEY3 1358 0.88 1.36 0.81 166 TooManyTo_002 1353 2.21 1.35 2.35 167 PDS_NAKED_TO_NUMERO 1328 0.19 1.33 0.01 168 XMStockSpam_06 1309 1.36 1.31 1.37 169 XM_XX_Yahoo 1301 0.22 1.30 0.04 170 RELAYCOUNTRY_HU 1279 0.19 1.28 0.01 171 TR_XM_MaxBayes 1278 0.19 1.28 0.02 172 HDRS_LCASE_IMGONLY 1220 0.18 1.22 0.01 173 HTML_IMAGE_ONLY_12 1194 0.31 1.19 0.16 174 SHORT_IMG_SUSP_NTLD 1176 0.17 1.17 0.00 175 XM_PDF 1174 3.24 1.17 3.57 176 T_FILL_THIS_FORM_SHORT 1170 0.82 1.17 0.76 177 TooManyTo_003 1151 1.56 1.15 1.63 178 XMBody_78 1136 0.56 1.13 0.47 179 TR_MetaPhish_Combo_01 1129 0.72 1.13 0.65 180 URI_PHP_REDIR 1126 0.16 1.12 0.01 181 DATE_IN_PAST_06_12 1120 0.35 1.12 0.22 182 RELAYCOUNTRY_RU 1114 0.17 1.11 0.01 183 HK_RANDOM_REPLYTO 1105 0.36 1.10 0.24 184 FILL_THIS_FORM 1070 0.35 1.07 0.23 185 XMGppyBdWords 1067 0.28 1.06 0.15 186 XMPhish30 1067 0.57 1.06 0.49 187 TooManyTo_004 1033 1.18 1.03 1.21 188 XM_H_Long_From02 1021 1.16 1.02 1.18 189 XM_DK_Undo_01 1014 1.50 1.01 1.58 190 URI_WP_DIRINDEX 1013 0.15 1.01 0.01 191 TR_Mismatch_TLD_01 1005 0.29 1.00 0.17 192 BAYES_00 1005 19.08 1.00 22.05 193 BAYES_05 1001 2.78 1.00 3.08 194 XMBdyGiftCard01 995 0.90 0.99 0.89 195 MIME_CHARSET_FARAWAY 990 0.22 0.99 0.09 196 REMOVE_BEFORE_LINK 981 0.42 0.98 0.32 197 URI_NO_WWW_INFO_CGI 977 0.17 0.98 0.04 198 URIBL_BLACK 976 0.15 0.97 0.02 199 XM_H_Undi_Recip 961 0.28 0.96 0.17 200 RDNS_DYNAMIC 960 0.38 0.96 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 602256 98.34 97.40 98.50 2 HTML_MESSAGE 495493 82.63 92.39 81.04 3 RELAYCOUNTRY_US 447730 72.40 67.39 73.23 4 DKIM_SIGNED 413695 67.89 69.27 67.66 5 XM_DK_Pass 406813 66.33 65.05 66.53 6 XM_B_Unicode 386815 63.25 63.14 63.26 7 DKIM_VALID 382578 61.16 52.53 62.57 8 BAYES_50 291125 46.55 40.04 47.61 9 XMListUnsubscribeExists 287050 49.26 63.36 46.95 10 DKIM_VALID_AU 284504 45.15 36.75 46.53 11 XM_B_Unicode3 225270 36.45 34.05 36.84 12 T_TM2_M_HEADER_IN_MSG 150742 24.18 21.31 24.65 13 HTML_FONT_LOW_CONTRAST 149424 24.51 24.93 24.44 14 RCVD_IN_MSPIKE_WL 146432 21.69 7.90 23.95 15 ALL_TRUSTED 143176 20.48 2.53 23.42 16 DKIM_VALID_EF 141070 23.24 24.24 23.07 17 LOC_TINY_FONT_1 136753 23.47 30.22 22.37 18 BAYES_00 134800 19.08 1.00 22.05 19 RCVD_IN_MSPIKE_H2 131568 21.50 21.37 21.52 20 MIME_HTML_ONLY 124713 22.40 34.60 20.40 21 FVGT_m_MULTI_ODD 123477 21.15 26.97 20.19 22 XMSubLong 119828 20.00 22.43 19.60 23 T_KAM_HTML_FONT_INVALID 107355 17.77 19.07 17.56 24 XM_Multi_Part_URI 99026 16.02 14.93 16.20 25 TM2_M_URI_OPT_OUT 87313 12.79 3.68 14.28 26 XM_Body_Dirty_Words 84934 14.38 17.35 13.89 27 RCVD_IN_MSPIKE_H3 84503 12.55 4.78 13.82 28 ANY_BOUNCE_MESSAGE 81745 11.57 0.56 13.37 29 BOUNCE_MESSAGE 81741 11.56 0.56 13.37 30 XM_B_Unsub 78459 12.75 12.25 12.83 31 XM_DK_Undo_02 66275 15.59 44.59 10.84 32 RCVD_IN_MSPIKE_H4 52976 7.86 2.98 8.66 33 LotsOfNums_01 50329 8.19 7.91 8.23 34 TooManyTo_001 49145 7.82 6.52 8.04 35 XM_Evil_Numbers_Gen 48354 8.01 8.66 7.91 36 TR_XM_DK_Bayes 48129 6.84 0.52 7.87 37 LOTS_OF_MONEY 47472 8.30 11.58 7.76 38 XM_B_Phish_Phrases 47272 8.24 11.37 7.73 39 TR_XM_DK_Bayes1 44523 6.30 0.30 7.28 40 XM_DKIMWhitelistDomains 42530 5.98 0.01 6.96 41 BAYES_99 42215 10.62 33.33 6.90 42 BAYES_60 40900 6.95 8.56 6.69 43 RCVD_IN_RP_SAFE 40601 5.78 0.55 6.64 44 HTML_IMAGE_RATIO_02 39710 7.82 15.91 6.49 45 TR_XM_DK_Bayes2 37694 5.33 0.24 6.16 46 HTML_IMAGE_RATIO_04 37095 5.87 4.68 6.07 47 RCVD_IN_RP_CERTIFIED 36851 5.21 0.24 6.03 48 UNPARSEABLE_RELAY 36739 6.00 5.96 6.01 49 XM_SendGrid 34002 5.39 4.36 5.56 50 IN_ZIMBRA_NJ_WHITELIST 33690 4.74 0.05 5.51 51 BAYES_999 33662 8.33 25.57 5.51 52 MPART_ALT_DIFF 32307 5.78 8.84 5.28 53 MIME_QP_LONG_LINE 31562 4.82 2.72 5.16 54 XM_B_Unsub2 31306 4.80 2.86 5.12 55 XM_H_Long_From01 31128 5.18 5.72 5.09 56 DKIM_INVALID 31117 6.73 16.73 5.09 57 BOTNET_IPINHOSTNAME 29905 7.09 20.53 4.89 58 RCVD_IN_IADB_LISTED 29091 4.20 0.79 4.76 59 RELAYCOUNTRY_META 28616 8.40 31.10 4.68 60 XMStrtUSub 28046 4.29 2.47 4.59 61 XMSexyCombo_05 26995 5.56 12.54 4.41 62 RCVD_IN_IADB_SPF 25183 3.64 0.70 4.12 63 BAYES_40 24826 3.84 2.47 4.06 64 BAYES_80 23980 4.48 7.88 3.92 65 T_TooManySym_01 23760 3.59 1.78 3.89 66 MIME_HTML_ONLY_MULTI 22269 3.41 2.02 3.64 67 HTML_IMAGE_RATIO_06 21960 3.47 2.73 3.59 68 RCVD_IN_IADB_SENDERID 21952 3.18 0.67 3.59 69 XM_PDF 21852 3.24 1.17 3.57 70 RCVD_IN_IADB_DK 21709 3.15 0.68 3.55 71 XM_H_Trusted_IP 20961 2.95 0.00 3.43 72 BAYES_20 20936 3.17 1.62 3.42 73 XMSubMetaSx_00 20639 4.08 8.35 3.38 74 T_REMOTE_IMAGE 19120 4.11 10.11 3.13 75 BOTNET 18820 8.10 38.78 3.08 76 BAYES_05 18807 2.78 1.00 3.08 77 TR_XM_DK_SendGrid 18530 2.83 1.60 3.03 78 TR_XM_PhishingBody 18516 3.63 7.29 3.03 79 XMNumbers 18372 3.25 4.72 3.00 80 RCVD_IN_IADB_VOUCHED 18070 2.57 0.25 2.96 81 MIME_HTML_MOSTLY 17137 3.44 7.35 2.80 82 NO_DNS_FOR_FROM 16869 4.07 12.06 2.76 83 FROM_EXCESS_BASE64 16837 3.53 8.24 2.75 84 XM_UncommonTLD01 16710 6.05 26.27 2.73 85 T_XMDrugObfuBody_00 15139 2.34 1.52 2.48 86 HTML_MIME_NO_HTML_TAG 14774 3.19 7.88 2.42 87 TooManyTo_002 14379 2.21 1.35 2.35 88 BAYES_95 13845 2.52 4.10 2.26 89 HTML_IMAGE_RATIO_08 12996 2.10 1.93 2.13 90 XM_CamelCaseFrm001 11916 1.98 2.20 1.95 91 RCVD_IN_IADB_OPTIN 11540 1.66 0.27 1.89 92 MAILING_LIST_MULTI 11179 1.84 1.88 1.83 93 XM_B_Phish66 10974 2.26 5.12 1.79 94 T_TooManySym_02 10470 1.53 0.42 1.71 95 TR_Symld_Words 10261 1.64 1.39 1.68 96 XM_B_SpammyTLD 10090 2.48 7.57 1.65 97 URI_HEX 10025 1.63 1.60 1.64 98 TooManyTo_003 9952 1.56 1.15 1.63 99 T_XMDrugObfuBody_14 9923 1.64 1.76 1.62 100 XM_B_COVIDMETA 9918 2.27 6.22 1.62 101 RELAYCOUNTRY_CA 9905 2.26 6.14 1.62 102 XMDiploma_00 9784 1.71 2.36 1.60 103 HTML_FONT_FACE_BAD 9765 1.47 0.71 1.60 104 XM_DK_Undo_01 9685 1.50 1.01 1.58 105 UNTRUSTED_Relay 9354 4.64 23.59 1.53 106 TVD_RCVD_IP 9081 1.34 0.45 1.49 107 SUBJ_ALL_CAPS 9059 1.77 3.57 1.48 108 KHOP_HELO_FCRDNS 9051 1.99 5.09 1.48 109 RCVD_IN_MSPIKE_H5 8953 1.28 0.14 1.46 110 RCVD_IN_BL_SPAMCOP_NET 8585 2.52 9.33 1.40 111 XMStockSpam_06 8387 1.36 1.31 1.37 112 XM_SPF_SoftFail 8312 1.95 5.52 1.36 113 T_XMDrugObfuBody_08 7963 1.56 3.12 1.30 114 HELO_MISC_IP 7690 1.20 0.84 1.26 115 CK_HELO_DYNAMIC_SPLIT_IP 7677 1.18 0.72 1.26 116 URI_TRY_3LD 7461 1.25 1.42 1.22 117 IN_HORDE_ADDRESS_BOOK 7403 1.06 0.16 1.21 118 TooManyTo_004 7390 1.18 1.03 1.21 119 INVALID_MSGID 7371 1.33 2.07 1.21 120 XM_H_Long_From02 7242 1.16 1.02 1.18 121 HELO_NODOT 6848 1.08 0.81 1.12 122 HELO_NO_DOMAIN 6847 1.08 0.81 1.12 123 USER_IN_DEF_DKIM_WL 6703 0.94 0.01 1.10 124 TO_MALFORMED 6518 0.92 0.01 1.07 125 XM_GoogleGroups 6442 0.97 0.48 1.05 126 XM_OfRef6 6273 1.42 3.85 1.03 127 DKIM_ADSP_CUSTOM_MED 5997 1.07 1.64 0.98 128 TooManyTo_005 5702 0.92 0.84 0.93 129 XM_ProductURIs 5565 0.90 0.84 0.91 130 XM_UB50 5557 1.94 8.21 0.91 131 XMSubNoVowel 5542 0.97 1.37 0.91 132 XMGenDplmaNmb 5531 1.02 1.71 0.90 133 TM2_M_VERY_LONG_WORD 5491 1.03 1.84 0.90 134 RELAYCOUNTRY_GB 5449 0.98 1.51 0.89 135 XMBdyGiftCard01 5413 0.90 0.99 0.89 136 TR_MSPIKEBAYES00 5345 0.75 0.01 0.87 137 XMCapTrack 5272 0.81 0.52 0.86 138 XMSexyCombo_01 5216 1.03 2.10 0.85 139 XMGappySubj_01 5176 0.81 0.55 0.85 140 SpammyFromTLD_01 5128 1.33 4.33 0.84 141 TR_LOTS_OF_MONEY3 4926 0.88 1.36 0.81 142 T_FILL_THIS_FORM_SHORT 4630 0.82 1.17 0.76 143 XMHTML_After_End 4604 1.16 3.67 0.75 144 TR_XM_COVIDMETA4 4488 1.32 4.88 0.73 145 XMLngstWrd_00 4481 0.91 1.97 0.73 146 XMBrknScrpt_02 4371 0.82 1.49 0.71 147 NML_ADSP_CUSTOM_MED 4364 0.81 1.43 0.71 148 XMSubMetaSxObfu_03 4006 0.67 0.75 0.66 149 XMBody_17 3987 0.93 2.61 0.65 150 TR_MetaPhish_Combo_01 3979 0.72 1.13 0.65 151 RCVD_IN_MSPIKE_BL 3821 1.74 8.58 0.62 152 XMLngstWrd_01 3707 0.79 1.94 0.61 153 URI_OPTOUT_3LD 3629 0.55 0.31 0.59 154 T_OBFU_PDF_ATTACH 3391 0.50 0.16 0.55 155 XMBody_95 3260 0.48 0.15 0.53 156 HTTPS_HTTP_MISMATCH 3254 0.56 0.71 0.53 157 TR_XM_COVIDMETA1 3237 0.92 3.29 0.53 158 T_Symld_Words_02 3231 0.70 1.71 0.53 159 T_TooManySym_03 3185 0.46 0.11 0.52 160 URI_WP_HACKED_2 3171 0.66 1.50 0.52 161 XM_DIRTYINTL 3166 0.97 3.73 0.52 162 FROM_GOV_DKIM_AU 3044 0.44 0.06 0.50 163 XMPhish30 3009 0.57 1.06 0.49 164 XM_SPF_Unknown 3001 0.50 0.59 0.49 165 TR_BOTNET_NEGATE 2966 0.46 0.29 0.49 166 XMHTMLBadTable_001 2896 0.45 0.30 0.47 167 XMBody_78 2872 0.56 1.13 0.47 168 XMMoneyMeta_00 2840 0.93 3.77 0.46 169 HTML_TAG_BALANCE_BODY 2783 0.49 0.71 0.46 170 HTML_IMAGE_ONLY_20 2772 0.51 0.83 0.45 171 XMLngstWrd_02 2772 0.65 1.87 0.45 172 NUMERIC_HTTP_ADDR 2711 0.43 0.35 0.44 173 RCVD_IN_MSPIKE_L3 2710 1.08 4.99 0.44 174 XMPhish08 2691 0.47 0.68 0.44 175 XMSubMetaI_00 2659 0.47 0.65 0.43 176 HTML_FONT_TINY_NORDNS 2631 0.49 0.89 0.43 177 TO_IN_SUBJ 2610 0.39 0.15 0.43 178 T_XMHurry_00 2605 0.49 0.89 0.43 179 XM_ShortIntro_01 2594 0.42 0.41 0.42 180 XM_H_PHPMailer 2579 0.48 0.86 0.42 181 XMSexyCombo_04 2577 0.48 0.82 0.42 182 FORGED_GMAIL_RCVD 2537 0.56 1.45 0.41 183 SUBJ_DOLLARS 2429 0.38 0.28 0.40 184 XMSubMetaSx_01 2332 0.37 0.32 0.38 185 RELAYCOUNTRY_AU 2296 0.39 0.48 0.38 186 MISSING_HEADERS 2295 0.42 0.72 0.38 187 TM2_M_BODY_EMPTY 2292 0.34 0.10 0.37 188 XM_B_REG_HTML 2273 0.34 0.15 0.37 189 FROM_GOV_SPOOF 2254 0.35 0.21 0.37 190 TR_XM_UnparsRelay 2230 0.70 2.77 0.36 191 XM_B_COPY_HTML 2218 0.36 0.32 0.36 192 XMNoVowels 2207 0.35 0.27 0.36 193 PLING_QUERY 2192 0.37 0.42 0.36 194 XM_Body_Obfu01 2192 0.36 0.36 0.36 195 SpammyFromTLD_02 2162 2.62 16.45 0.35 196 TR_XM_PHPDW 2151 0.61 2.19 0.35 197 USER_IN_WHITELIST 2084 0.29 0.00 0.34 198 RCVD_IN_SORBS_DUL 2034 0.35 0.43 0.33 199 URI_NOVOWEL 2019 0.36 0.55 0.33 200 XMSexyCombo_02 2004 0.31 0.23 0.33 ----------------------------------------------------------------------