Email: 412570 Autolearn: 0 AvgScore: 0.90 AvgScanTime: 1.56 sec Spam: 72005 Autolearn: 0 AvgScore: 14.64 AvgScanTime: 2.54 sec Ham: 340565 Autolearn: 0 AvgScore: -2.00 AvgScanTime: 1.36 sec Time Spent Running SA: 179.02 hours Time Spent Processing Spam: 50.71 hours Time Spent Processing Ham: 128.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 70714 98.88 98.21 99.03 2 HTML_MESSAGE 65565 80.57 91.06 78.35 3 XM_B_Unicode 43966 64.91 61.06 65.72 4 DKIM_SIGNED 41832 68.75 58.10 71.00 5 RELAYCOUNTRY_US 41642 70.97 57.83 73.75 6 XM_DK_Pass 40101 67.55 55.69 70.06 7 XMListUnsubscribeExists 39755 52.88 55.21 52.39 8 DKIM_VALID 34604 63.80 48.06 67.13 9 MIME_HTML_ONLY 30917 25.40 42.94 21.69 10 XM_DK_Undo_02 28941 16.69 40.19 11.72 11 BAYES_50 28249 44.29 39.23 45.36 12 BOTNET 28059 8.99 38.97 2.65 13 RELAYCOUNTRY_META 28051 10.94 38.96 5.01 14 DKIM_VALID_AU 25805 51.02 35.84 54.23 15 BAYES_99 22792 12.54 31.65 8.50 16 XM_UncommonTLD01 21487 8.22 29.84 3.64 17 XM_B_Unicode3 21175 37.68 29.41 39.43 18 LOC_TINY_FONT_1 18600 28.21 25.83 28.72 19 HTML_FONT_LOW_CONTRAST 17677 28.91 24.55 29.83 20 BAYES_999 17652 9.98 24.51 6.91 21 UNTRUSTED_Relay 16581 5.56 23.03 1.87 22 XMSubLong 15996 20.64 22.22 20.31 23 SpammyFromTLD_02 15464 3.95 21.48 0.25 24 FVGT_m_MULTI_ODD 15147 20.40 21.04 20.27 25 DKIM_VALID_EF 14879 23.86 20.66 24.53 26 T_TM2_M_HEADER_IN_MSG 14168 18.56 19.68 18.33 27 FROM_SUSPICIOUS_NTLD 14092 3.47 19.57 0.07 28 FROM_SUSPICIOUS_NTLD_FP 14027 3.45 19.48 0.06 29 RCVD_IN_MSPIKE_H2 13988 21.62 19.43 22.09 30 T_REMOTE_IMAGE 12569 5.06 17.46 2.44 31 T_KAM_HTML_FONT_INVALID 12426 16.18 17.26 15.96 32 BOTNET_IPINHOSTNAME 12050 7.80 16.73 5.91 33 HTML_MIME_NO_HTML_TAG 11606 4.45 16.12 1.99 34 FROM_EXCESS_BASE64 11219 5.62 15.58 3.51 35 HTML_TAG_BALANCE_CENTER 10940 2.75 15.19 0.12 36 BODY_URI_ONLY 10570 2.60 14.68 0.04 37 HDRS_MISSP 10202 2.52 14.17 0.06 38 BOTNET_NORDNS 10015 2.44 13.91 0.02 39 XM_Body_Dirty_Words 9926 13.27 13.79 13.16 40 XM_Multi_Part_URI 9885 17.37 13.73 18.14 41 HTML_IMAGE_RATIO_02 9712 9.46 13.49 8.61 42 LOTS_OF_MONEY 8734 7.51 12.13 6.53 43 DKIM_ADSP_NXDOMAIN 8247 2.32 11.45 0.38 44 SCRIPT_GIBBERISH 8041 1.95 11.17 0.00 45 REPLYTO_WITHOUT_TO_CC 7744 1.94 10.75 0.08 46 XMSexyCombo_05 7634 5.82 10.60 4.81 47 RCVD_IN_MSPIKE_BL 7577 2.38 10.52 0.66 48 DKIM_INVALID 7228 4.95 10.04 3.87 49 BAYES_80 7114 5.45 9.88 4.52 50 MPART_ALT_DIFF 6899 6.14 9.58 5.42 51 RCVD_IN_BL_SPAMCOP_NET 6752 2.50 9.38 1.04 52 XM_SPF_SoftFail 6215 2.26 8.63 0.92 53 XMSubMetaSx_00 6211 4.76 8.63 3.94 54 BAYES_60 6168 7.09 8.57 6.77 55 MIME_HTML_MOSTLY 6042 4.26 8.39 3.39 56 PDS_OTHER_BAD_TLD 5981 1.59 8.31 0.18 57 XMNumbers 5974 3.80 8.30 2.85 58 XM_UB50 5626 2.24 7.81 1.07 59 RELAYCOUNTRY_CA 5543 3.10 7.70 2.13 60 RCVD_IN_MSPIKE_WL 5277 22.18 7.33 25.33 61 XM_B_Unsub 5271 8.68 7.32 8.96 62 XM_B_Phish_Phrases 5196 6.84 7.22 6.76 63 NO_DNS_FOR_FROM 5115 2.96 7.10 2.08 64 LotsOfNums_01 4810 7.55 6.68 7.73 65 RCVD_IN_MSPIKE_L3 4635 1.57 6.44 0.55 66 RELAYCOUNTRY_GB 4595 1.60 6.38 0.59 67 ALL_TRUSTED 4500 19.58 6.25 22.40 68 RELAYCOUNTRY_FR 4491 1.32 6.24 0.28 69 XM_Evil_Numbers_Gen 4198 7.75 5.83 8.16 70 RCVD_IN_RP_RNBL 4136 1.09 5.74 0.11 71 TooManyTo_001 4133 6.17 5.74 6.26 72 FROM_MISSP_EH_MATCH 4133 1.00 5.74 0.00 73 MISSING_HEADERS 4041 1.20 5.61 0.27 74 TO_NO_BRKTS_FROM_MSSP 3932 0.97 5.46 0.02 75 NORDNS_LOW_CONTRAST 3847 0.94 5.34 0.00 76 KHOP_HELO_FCRDNS 3829 1.67 5.32 0.89 77 INVALID_MSGID 3766 2.74 5.23 2.21 78 FROM_MISSPACED 3763 0.93 5.23 0.02 79 FORGED_OUTLOOK_HTML 3747 0.91 5.20 0.00 80 FORGED_MUA_OUTLOOK 3709 0.92 5.15 0.02 81 XM_B_SpammyTLD 3696 2.02 5.13 1.36 82 FROM_MISSP_MSFT 3637 0.88 5.05 0.00 83 FSL_CTYPE_WIN1251 3635 0.88 5.05 0.00 84 FORGED_OUTLOOK_TAGS 3631 0.89 5.04 0.02 85 FSL_NEW_HELO_USER 3628 0.88 5.04 0.00 86 FROM_MISSP_XPRIO 3626 0.88 5.04 0.00 87 NSL_RCVD_HELO_USER 3618 0.88 5.02 0.00 88 AXB_XMAILER_MIMEOLE_OL_024C2 3614 0.88 5.02 0.00 89 BAYES_95 3546 3.13 4.92 2.75 90 TR_XM_PhishingBody 3533 3.20 4.91 2.84 91 RCVD_IN_MSPIKE_H3 3524 13.22 4.89 14.99 92 SUBJ_ALL_CAPS 3510 1.89 4.87 1.26 93 XM_H_Long_From01 3484 4.85 4.84 4.86 94 SpammyFromTLD_01 3246 1.38 4.51 0.72 95 XMBody_17 3202 1.81 4.45 1.25 96 XM_BadFromFormat 3202 0.90 4.45 0.16 97 URIBL_SBL_A 3017 1.15 4.19 0.51 98 XMMoneyMeta_00 3006 1.06 4.17 0.40 99 UNPARSEABLE_RELAY 2927 6.54 4.06 7.07 100 TR_XM_MaxSPIKE 2889 0.76 4.01 0.07 101 XM_UB80 2857 0.72 3.97 0.04 102 XM_UB60 2849 0.80 3.96 0.13 103 TR_LOTS_OF_MONEY1 2819 0.69 3.92 0.01 104 MONEY_FROM_MISSP 2816 0.68 3.91 0.00 105 HTML_IMAGE_RATIO_04 2796 6.39 3.88 6.92 106 XM_DIRTYINTL 2566 1.01 3.56 0.47 107 XM_UB99 2539 0.62 3.53 0.01 108 TR_Mismatch_TLD_01 2532 0.79 3.52 0.21 109 RELAYCOUNTRY_DE 2481 0.95 3.45 0.42 110 XMSubMetaI_00 2463 1.11 3.42 0.62 111 TR_XM_MaxBayes 2460 0.62 3.42 0.03 112 XM_B_COVIDMETA 2443 1.42 3.39 1.00 113 RCVD_IN_PSBL 2306 0.59 3.20 0.03 114 XMReplyNow 2212 0.62 3.07 0.10 115 TR_XM_INV_DKIM 2113 0.69 2.93 0.22 116 XM_SendGrid 2082 5.66 2.89 6.24 117 TR_XM_COVIDMETA4 2055 0.82 2.85 0.39 118 RCVD_IN_MSPIKE_L5 2052 0.56 2.85 0.08 119 XMSubMetaI_01 2046 0.53 2.84 0.04 120 DATE_IN_PAST_03_06 1993 0.60 2.77 0.14 121 XM_OfRef6 1989 1.78 2.76 1.57 122 XM_Combo_Sbj 1946 0.65 2.70 0.21 123 XMStrtUSub 1912 4.92 2.66 5.40 124 SUBJ_ILLEGAL_CHARS 1850 0.46 2.57 0.01 125 T_FILL_THIS_FORM_SHORT 1802 0.94 2.50 0.60 126 XMSubMetaI_02 1760 0.43 2.44 0.00 127 MONEY_FRAUD_5 1737 0.42 2.41 0.00 128 TR_XM_PHPDW 1725 0.76 2.40 0.41 129 TR_XM_PHPForged 1716 0.74 2.38 0.39 130 RCVD_IN_MSPIKE_H4 1705 7.91 2.37 9.08 131 TR_XM_FormFill2 1695 0.73 2.35 0.38 132 XM_B_Phish66 1694 1.29 2.35 1.07 133 XM_H_PHPOS 1684 0.72 2.34 0.38 134 XM_UB999 1637 0.40 2.27 0.01 135 ADVANCE_FEE_3_NEW_MONEY 1631 0.40 2.27 0.00 136 TR_XM_UnparsRelay 1626 0.64 2.26 0.30 137 T_XMHurry_00 1606 1.05 2.23 0.81 138 HK_SCAM 1600 0.42 2.22 0.04 139 TR_XM_MaxWHORU 1547 0.43 2.15 0.06 140 BAD_ENC_HEADER 1544 0.40 2.14 0.04 141 HTML_SHORT_LINK_IMG_3 1541 0.40 2.14 0.04 142 XM_CamelCaseFrm001 1529 1.97 2.12 1.93 143 URI_TRY_3LD 1523 1.67 2.12 1.57 144 HTML_IMAGE_RATIO_06 1485 2.94 2.06 3.12 145 XMLngstWrd_00 1473 0.69 2.05 0.41 146 XMLngstWrd_01 1452 0.66 2.02 0.38 147 LOADSA_MONEY_COMBO 1447 0.41 2.01 0.07 148 XM_URI_RBL 1445 0.50 2.01 0.18 149 MPART_ALT_DIFF_COUNT 1445 0.66 2.01 0.37 150 HTML_IMAGE_RATIO_08 1441 2.93 2.00 3.12 151 XMLngstWrd_02 1427 0.60 1.98 0.31 152 XMLngstWrd_03 1406 0.58 1.95 0.29 153 TR_Mismatch_TLD_02 1399 0.44 1.94 0.12 154 BAYES_20 1399 2.97 1.94 3.19 155 XFER_LOTSA_MONEY 1397 0.36 1.94 0.03 156 MAILING_LIST_MULTI 1396 1.69 1.94 1.64 157 LongTLD 1387 0.46 1.93 0.15 158 XMSexyCombo_01 1378 0.86 1.91 0.64 159 TM2_M_URI_OPT_OUT 1366 13.34 1.90 15.76 160 XMLngstWrd_04 1362 0.54 1.89 0.25 161 URI_HEX 1360 1.66 1.89 1.62 162 ADVANCE_FEE_5_NEW_MONEY 1328 0.33 1.84 0.01 163 HTML_IMAGE_ONLY_16 1299 0.45 1.80 0.16 164 XM_UB95 1291 0.33 1.79 0.02 165 XMBdyGiftCard01 1281 1.59 1.78 1.55 166 BAYES_40 1280 3.40 1.78 3.74 167 TR_LOTS_OF_MONEY3 1242 0.74 1.72 0.53 168 T_XMDrugObfuBody_08 1236 1.29 1.72 1.20 169 HTML_IMAGE_ONLY_20 1221 0.67 1.70 0.45 170 TR_XM_RelayPhish 1188 0.41 1.65 0.15 171 ADVANCE_FEE_5_NEW 1183 0.29 1.64 0.00 172 T_TooManySym_01 1183 4.33 1.64 4.90 173 MIME_QP_LONG_LINE 1165 3.18 1.62 3.52 174 MONEY_FORM_SHORT 1164 0.30 1.62 0.02 175 XMBrknScrpt_02 1162 1.20 1.61 1.11 176 FORM_FRAUD_5 1147 0.28 1.59 0.00 177 XMSubNoVowel 1144 1.47 1.59 1.45 178 HK_RANDOM_FROM 1141 0.35 1.58 0.09 179 RELAYCOUNTRY_HU 1130 0.28 1.57 0.01 180 XM_JunkDunk 1097 0.27 1.52 0.00 181 FAKE_REPLY_C 1087 0.26 1.51 0.00 182 TM2_M_VERY_LONG_WORD 1080 1.08 1.50 0.99 183 RELAYCOUNTRY_IN 1003 0.33 1.39 0.11 184 DEAR_WINNER 1002 0.24 1.39 0.00 185 MIME_CHARSET_FARAWAY 1002 0.38 1.39 0.16 186 PDS_NAKED_TO_NUMERO 999 0.25 1.39 0.01 187 XMPhish14 957 0.71 1.33 0.57 188 CHARSET_FARAWAY_HEADER 940 0.28 1.31 0.06 189 XMSubMetaSxObfu_03 936 0.63 1.30 0.48 190 HTML_TAG_BALANCE_BODY 901 0.91 1.25 0.84 191 DATE_IN_PAST_06_12 898 0.40 1.25 0.22 192 XMSubGiftCard1 886 0.24 1.23 0.03 193 XM_B_Unsub2 876 1.07 1.22 1.04 194 DKIM_ADSP_CUSTOM_MED 867 1.02 1.20 0.98 195 MIME_HTML_ONLY_MULTI 865 2.97 1.20 3.35 196 XMHTML_After_End 839 0.81 1.17 0.73 197 DIET_1 819 0.57 1.14 0.45 198 BAYES_00 814 18.16 1.13 21.76 199 NML_ADSP_CUSTOM_MED 795 0.74 1.10 0.66 200 XMStockSpam_06 788 1.34 1.09 1.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 337252 98.88 98.21 99.03 2 HTML_MESSAGE 266834 80.57 91.06 78.35 3 RELAYCOUNTRY_US 251163 70.97 57.83 73.75 4 DKIM_SIGNED 241795 68.75 58.10 71.00 5 XM_DK_Pass 238603 67.55 55.69 70.06 6 DKIM_VALID 228620 63.80 48.06 67.13 7 XM_B_Unicode 223819 64.91 61.06 65.72 8 DKIM_VALID_AU 184689 51.02 35.84 54.23 9 XMListUnsubscribeExists 178430 52.88 55.21 52.39 10 BAYES_50 154486 44.29 39.23 45.36 11 XM_B_Unicode3 134275 37.68 29.41 39.43 12 HTML_FONT_LOW_CONTRAST 101594 28.91 24.55 29.83 13 LOC_TINY_FONT_1 97796 28.21 25.83 28.72 14 RCVD_IN_MSPIKE_WL 86249 22.18 7.33 25.33 15 DKIM_VALID_EF 83547 23.86 20.66 24.53 16 ALL_TRUSTED 76270 19.58 6.25 22.40 17 RCVD_IN_MSPIKE_H2 75224 21.62 19.43 22.09 18 BAYES_00 74105 18.16 1.13 21.76 19 MIME_HTML_ONLY 73868 25.40 42.94 21.69 20 XMSubLong 69174 20.64 22.22 20.31 21 FVGT_m_MULTI_ODD 69017 20.40 21.04 20.27 22 T_TM2_M_HEADER_IN_MSG 62420 18.56 19.68 18.33 23 XM_Multi_Part_URI 61781 17.37 13.73 18.14 24 T_KAM_HTML_FONT_INVALID 54344 16.18 17.26 15.96 25 TM2_M_URI_OPT_OUT 53680 13.34 1.90 15.76 26 RCVD_IN_MSPIKE_H3 51036 13.22 4.89 14.99 27 ANY_BOUNCE_MESSAGE 48565 11.83 0.34 14.26 28 BOUNCE_MESSAGE 48563 11.83 0.34 14.26 29 XM_Body_Dirty_Words 44825 13.27 13.79 13.16 30 XM_DK_Undo_02 39920 16.69 40.19 11.72 31 RCVD_IN_RP_SAFE 35002 8.63 0.84 10.28 32 RCVD_IN_RP_CERTIFIED 32963 8.09 0.60 9.68 33 XM_DKIMWhitelistDomains 31780 7.71 0.02 9.33 34 RCVD_IN_MSPIKE_H4 30937 7.91 2.37 9.08 35 XM_B_Unsub 30530 8.68 7.32 8.96 36 HTML_IMAGE_RATIO_02 29330 9.46 13.49 8.61 37 BAYES_99 28934 12.54 31.65 8.50 38 XM_Evil_Numbers_Gen 27786 7.75 5.83 8.16 39 LotsOfNums_01 26329 7.55 6.68 7.73 40 TR_XM_DK_Bayes 26243 6.43 0.41 7.71 41 TR_XM_DK_Bayes1 24934 6.10 0.30 7.32 42 UNPARSEABLE_RELAY 24065 6.54 4.06 7.07 43 HTML_IMAGE_RATIO_04 23581 6.39 3.88 6.92 44 BAYES_999 23526 9.98 24.51 6.91 45 TR_XM_DK_Bayes2 23277 5.69 0.27 6.83 46 BAYES_60 23072 7.09 8.57 6.77 47 XM_B_Phish_Phrases 23031 6.84 7.22 6.76 48 LOTS_OF_MONEY 22253 7.51 12.13 6.53 49 TooManyTo_001 21334 6.17 5.74 6.26 50 XM_SendGrid 21258 5.66 2.89 6.24 51 BOTNET_IPINHOSTNAME 20123 7.80 16.73 5.91 52 MPART_ALT_DIFF 18445 6.14 9.58 5.42 53 XMStrtUSub 18385 4.92 2.66 5.40 54 RELAYCOUNTRY_META 17078 10.94 38.96 5.01 55 T_TooManySym_01 16701 4.33 1.64 4.90 56 XM_H_Long_From01 16540 4.85 4.84 4.86 57 XMSexyCombo_05 16374 5.82 10.60 4.81 58 BAYES_80 15381 5.45 9.88 4.52 59 IN_ZIMBRA_NJ_WHITELIST 13446 3.26 0.03 3.95 60 XMSubMetaSx_00 13420 4.76 8.63 3.94 61 DKIM_INVALID 13175 4.95 10.04 3.87 62 BAYES_40 12728 3.40 1.78 3.74 63 XM_UncommonTLD01 12409 8.22 29.84 3.64 64 MIME_QP_LONG_LINE 11974 3.18 1.62 3.52 65 FROM_EXCESS_BASE64 11967 5.62 15.58 3.51 66 BAYES_05 11638 2.98 0.89 3.42 67 MIME_HTML_MOSTLY 11531 4.26 8.39 3.39 68 MIME_HTML_ONLY_MULTI 11394 2.97 1.20 3.35 69 XM_H_Trusted_IP 11351 2.75 0.00 3.33 70 TR_XM_DK_SendGrid 11229 2.91 1.06 3.30 71 BAYES_20 10864 2.97 1.94 3.19 72 HTML_IMAGE_RATIO_06 10638 2.94 2.06 3.12 73 HTML_IMAGE_RATIO_08 10633 2.93 2.00 3.12 74 RCVD_IN_IADB_LISTED 10494 2.65 0.59 3.08 75 XMNumbers 9702 3.80 8.30 2.85 76 TR_XM_PhishingBody 9666 3.20 4.91 2.84 77 BAYES_95 9350 3.13 4.92 2.75 78 T_TooManySym_02 9273 2.35 0.57 2.72 79 RCVD_IN_IADB_SPF 9226 2.33 0.56 2.71 80 BOTNET 9036 8.99 38.97 2.65 81 RCVD_IN_IADB_SENDERID 8374 2.13 0.56 2.46 82 T_REMOTE_IMAGE 8307 5.06 17.46 2.44 83 RCVD_IN_IADB_DK 8180 2.08 0.56 2.40 84 TVD_RCVD_IP 7951 1.99 0.37 2.33 85 INVALID_MSGID 7521 2.74 5.23 2.21 86 HELO_MISC_IP 7417 1.98 1.06 2.18 87 CK_HELO_DYNAMIC_SPLIT_IP 7407 1.96 0.95 2.17 88 RELAYCOUNTRY_CA 7262 3.10 7.70 2.13 89 NO_DNS_FOR_FROM 7091 2.96 7.10 2.08 90 HTML_MIME_NO_HTML_TAG 6769 4.45 16.12 1.99 91 XM_CamelCaseFrm001 6580 1.97 2.12 1.93 92 TO_MALFORMED 6479 1.57 0.02 1.90 93 UNTRUSTED_Relay 6364 5.56 23.03 1.87 94 RCVD_IN_IADB_VOUCHED 6014 1.48 0.10 1.77 95 MAILING_LIST_MULTI 5574 1.69 1.94 1.64 96 URI_HEX 5507 1.66 1.89 1.62 97 TR_Symld_Words 5403 1.48 0.97 1.59 98 URI_TRY_3LD 5358 1.67 2.12 1.57 99 XM_OfRef6 5349 1.78 2.76 1.57 100 XMBdyGiftCard01 5276 1.59 1.78 1.55 101 XM_PDF 5128 1.32 0.42 1.51 102 HTML_FONT_FACE_BAD 5041 1.29 0.41 1.48 103 XMSubNoVowel 4937 1.47 1.59 1.45 104 XMStockSpam_06 4741 1.34 1.09 1.39 105 IN_HORDE_ADDRESS_BOOK 4735 1.16 0.09 1.39 106 XM_DK_Undo_01 4698 1.24 0.59 1.38 107 T_XMDrugObfuBody_14 4685 1.30 0.94 1.38 108 XM_B_SpammyTLD 4644 2.02 5.13 1.36 109 TR_MSPIKEBAYES00 4427 1.07 0.01 1.30 110 USER_IN_DEF_DKIM_WL 4375 1.06 0.00 1.28 111 XM_ProductURIs 4306 1.18 0.78 1.26 112 SUBJ_ALL_CAPS 4298 1.89 4.87 1.26 113 RCVD_IN_MSPIKE_H5 4276 1.05 0.07 1.26 114 XMBody_17 4245 1.81 4.45 1.25 115 XM_RXBody 4229 1.12 0.55 1.24 116 T_XMDrugObfuBody_08 4103 1.29 1.72 1.20 117 XMDiploma_00 4051 1.13 0.83 1.19 118 XM_GoogleGroups 3886 1.00 0.36 1.14 119 XMBrknScrpt_02 3782 1.20 1.61 1.11 120 TooManyTo_002 3767 1.02 0.62 1.11 121 RCVD_IN_IADB_OPTIN 3658 0.91 0.16 1.07 122 XM_B_Phish66 3636 1.29 2.35 1.07 123 XM_UB50 3635 2.24 7.81 1.07 124 XM_B_Unsub2 3558 1.07 1.22 1.04 125 RCVD_IN_BL_SPAMCOP_NET 3547 2.50 9.38 1.04 126 XM_H_Long_From02 3490 0.97 0.68 1.02 127 T_TooManySym_03 3490 0.89 0.28 1.02 128 XMGappySubj_01 3469 0.87 0.14 1.02 129 XM_B_COVIDMETA 3413 1.42 3.39 1.00 130 TM2_M_VERY_LONG_WORD 3381 1.08 1.50 0.99 131 DKIM_ADSP_CUSTOM_MED 3322 1.02 1.20 0.98 132 XM_SPF_SoftFail 3125 2.26 8.63 0.92 133 KHOP_HELO_FCRDNS 3048 1.67 5.32 0.89 134 TR_MetaPhish_Combo_01 2888 0.82 0.69 0.85 135 HTML_TAG_BALANCE_BODY 2845 0.91 1.25 0.84 136 T_XMHurry_00 2744 1.05 2.23 0.81 137 TooManyTo_003 2654 0.70 0.34 0.78 138 T_XMDrugObfuBody_00 2575 0.79 0.93 0.76 139 XMHTML_After_End 2492 0.81 1.17 0.73 140 SpammyFromTLD_01 2451 1.38 4.51 0.72 141 XMPhish08 2313 0.64 0.48 0.68 142 XMGenDplmaNmb 2296 0.65 0.52 0.67 143 NML_ADSP_CUSTOM_MED 2261 0.74 1.10 0.66 144 RCVD_IN_MSPIKE_BL 2238 2.38 10.52 0.66 145 TooManyTo_004 2228 0.59 0.31 0.65 146 XMSexyCombo_01 2184 0.86 1.91 0.64 147 XMBody_95 2172 0.53 0.04 0.64 148 XM_B_REG_HTML 2108 0.55 0.23 0.62 149 XMSubMetaI_00 2104 1.11 3.42 0.62 150 T_FILL_THIS_FORM_SHORT 2059 0.94 2.50 0.60 151 RELAYCOUNTRY_GB 2012 1.60 6.38 0.59 152 T_MANY_PILL_PRICE 1996 0.48 0.00 0.59 153 XMPhish14 1952 0.71 1.33 0.57 154 TooManyTo_005 1920 0.51 0.24 0.56 155 NUMERIC_HTTP_ADDR 1910 0.53 0.37 0.56 156 RCVD_IN_MSPIKE_L3 1859 1.57 6.44 0.55 157 TR_LOTS_OF_MONEY3 1817 0.74 1.72 0.53 158 XM_B_COPY_HTML 1754 0.50 0.45 0.52 159 URIBL_SBL_A 1733 1.15 4.19 0.51 160 HELO_NODOT 1728 0.53 0.66 0.51 161 XMPhish30 1728 0.55 0.75 0.51 162 USER_IN_WHITELIST 1722 0.42 0.00 0.51 163 HELO_NO_DOMAIN 1718 0.53 0.66 0.50 164 XM_H_PHPMailer 1697 0.59 1.03 0.50 165 XMSubMetaSxObfu_03 1649 0.63 1.30 0.48 166 SUBJ_DOLLARS 1628 0.43 0.21 0.48 167 XM_DIRTYINTL 1616 1.01 3.56 0.47 168 XMSubMetaSxObfu_02 1605 0.44 0.30 0.47 169 PLING_QUERY 1598 0.43 0.27 0.47 170 FORGED_GMAIL_RCVD 1576 0.57 1.08 0.46 171 XMBody_78 1541 0.56 1.06 0.45 172 HTML_IMAGE_ONLY_20 1529 0.67 1.70 0.45 173 DIET_1 1526 0.57 1.14 0.45 174 TR_BOTNET_NEGATE 1505 0.44 0.42 0.44 175 RELAYCOUNTRY_DE 1443 0.95 3.45 0.42 176 RDNS_DYNAMIC 1442 0.49 0.79 0.42 177 TR_XM_PHPDW 1404 0.76 2.40 0.41 178 XMLngstWrd_00 1389 0.69 2.05 0.41 179 XMMoneyMeta_00 1361 1.06 4.17 0.40 180 HTTPS_HTTP_MISMATCH 1348 0.39 0.36 0.40 181 TR_XM_COVIDMETA4 1334 0.82 2.85 0.39 182 XMHTMLBadTable_001 1326 0.42 0.59 0.39 183 TR_XM_PHPForged 1318 0.74 2.38 0.39 184 DKIM_ADSP_NXDOMAIN 1304 2.32 11.45 0.38 185 XMNoVowels 1304 0.38 0.39 0.38 186 TR_XM_FormFill2 1303 0.73 2.35 0.38 187 URI_NOVOWEL 1301 0.42 0.62 0.38 188 XM_H_PHPOS 1291 0.72 2.34 0.38 189 XMLngstWrd_01 1281 0.66 2.02 0.38 190 MPART_ALT_DIFF_COUNT 1263 0.66 2.01 0.37 191 XMSlimDrugH 1260 0.40 0.55 0.37 192 XMSubMetaSSx_00 1248 0.47 0.99 0.37 193 MIME_HEADER_CTYPE_ONLY 1235 0.31 0.08 0.36 194 HTML_FONT_TINY_NORDNS 1221 0.43 0.76 0.36 195 XMCapTrack 1216 0.35 0.31 0.36 196 T_TooManySym_04 1166 0.30 0.12 0.34 197 XM_Body_Obfu01 1159 0.30 0.09 0.34 198 XMBSHREFv2 1148 0.30 0.12 0.34 199 XM_ShortIntro_01 1134 0.40 0.74 0.33 200 BASE64_LENGTH_79_INF 1131 0.41 0.76 0.33 ----------------------------------------------------------------------