Email: 731739 Autolearn: 0 AvgScore: -0.18 AvgScanTime: 1.68 sec Spam: 90187 Autolearn: 0 AvgScore: 13.07 AvgScanTime: 3.66 sec Ham: 641552 Autolearn: 0 AvgScore: -2.05 AvgScanTime: 1.40 sec Time Spent Running SA: 341.57 hours Time Spent Processing Spam: 91.59 hours Time Spent Processing Ham: 249.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 87820 98.28 97.38 98.41 2 HTML_MESSAGE 83075 75.55 92.11 73.22 3 XM_B_Unicode 67870 58.96 75.25 56.67 4 DKIM_SIGNED 64369 62.26 71.37 60.98 5 XM_DK_Pass 61879 61.06 68.61 60.00 6 RELAYCOUNTRY_US 60128 67.70 66.67 67.85 7 XMListUnsubscribeExists 57780 43.40 64.07 40.49 8 DKIM_VALID 50725 56.12 56.24 56.10 9 XM_DK_Undo_02 43750 14.73 48.51 9.98 10 BAYES_99 36465 10.66 40.43 6.47 11 DKIM_VALID_AU 35522 41.01 39.39 41.24 12 XM_B_Unicode3 34512 34.04 38.27 33.45 13 MIME_HTML_ONLY 34296 20.36 38.03 17.87 14 BOTNET 30772 6.63 34.12 2.77 15 BAYES_50 30755 42.63 34.10 43.83 16 RELAYCOUNTRY_META 30191 8.47 33.48 4.95 17 BAYES_999 28952 8.51 32.10 5.19 18 LOC_TINY_FONT_1 26741 20.67 29.65 19.41 19 DKIM_VALID_EF 23113 22.41 25.63 21.96 20 RCVD_IN_MSPIKE_H2 22594 20.09 25.05 19.39 21 FVGT_m_MULTI_ODD 22113 18.64 24.52 17.82 22 HTML_FONT_LOW_CONTRAST 21564 21.77 23.91 21.47 23 UNTRUSTED_Relay 20888 4.20 23.16 1.53 24 XMSubLong 20528 18.36 22.76 17.74 25 XM_UncommonTLD01 18625 4.73 20.65 2.49 26 T_TM2_M_HEADER_IN_MSG 18459 23.03 20.47 23.39 27 T_KAM_HTML_FONT_INVALID 17902 15.77 19.85 15.20 28 XM_Body_Dirty_Words 16477 11.68 18.27 10.75 29 XM_Multi_Part_URI 14747 18.66 16.35 18.98 30 BOTNET_IPINHOSTNAME 14628 5.78 16.22 4.32 31 DKIM_INVALID 13644 6.14 15.13 4.88 32 LOTS_OF_MONEY 13291 7.62 14.74 6.62 33 HTML_MIME_NO_HTML_TAG 11644 3.45 12.91 2.12 34 T_REMOTE_IMAGE 11496 3.98 12.75 2.75 35 XM_B_Phish_Phrases 10563 6.60 11.71 5.89 36 XM_B_Unsub 10488 11.06 11.63 10.98 37 HTML_IMAGE_RATIO_02 10274 6.87 11.39 6.23 38 NO_DNS_FOR_FROM 10263 3.61 11.38 2.52 39 XMSexyCombo_05 10176 4.41 11.28 3.44 40 SpammyFromTLD_02 9759 1.62 10.82 0.32 41 BOTNET_NORDNS 9278 1.28 10.29 0.02 42 FROM_EXCESS_BASE64 8722 2.85 9.67 1.89 43 FROM_SUSPICIOUS_NTLD 8533 1.19 9.46 0.02 44 FROM_SUSPICIOUS_NTLD_FP 8460 1.17 9.38 0.02 45 LotsOfNums_01 8231 7.34 9.13 7.09 46 XM_Evil_Numbers_Gen 8181 7.12 9.07 6.85 47 RCVD_IN_BL_SPAMCOP_NET 7850 2.12 8.70 1.19 48 BODY_URI_ONLY 7653 1.08 8.49 0.04 49 RCVD_IN_MSPIKE_BL 7588 1.55 8.41 0.59 50 HTML_TAG_BALANCE_CENTER 7529 1.12 8.35 0.10 51 HDRS_MISSP 7285 1.04 8.08 0.05 52 RCVD_IN_MSPIKE_WL 7091 19.41 7.86 21.03 53 BAYES_80 7057 4.09 7.82 3.56 54 XM_UB50 6998 1.77 7.76 0.93 55 XMSubMetaSx_00 6814 4.09 7.56 3.60 56 RELAYCOUNTRY_CA 6759 2.42 7.49 1.71 57 MPART_ALT_DIFF 6672 5.87 7.40 5.66 58 DKIM_ADSP_NXDOMAIN 6545 1.16 7.26 0.31 59 BAYES_60 6542 5.74 7.25 5.53 60 XM_UB99 6269 0.86 6.95 0.01 61 TooManyTo_001 6094 6.98 6.76 7.01 62 TR_XM_PhishingBody 5953 3.00 6.60 2.50 63 XM_H_Long_From01 5738 4.71 6.36 4.48 64 UNPARSEABLE_RELAY 5679 5.92 6.30 5.87 65 XMNumbers 5620 2.91 6.23 2.44 66 KHOP_HELO_FCRDNS 5456 2.09 6.05 1.53 67 XM_B_COVIDMETA 5452 2.01 6.05 1.44 68 XM_UB999 4793 0.66 5.31 0.00 69 MIME_HTML_MOSTLY 4581 2.43 5.08 2.05 70 HTML_IMAGE_RATIO_04 4554 5.02 5.05 5.02 71 TR_XM_INV_DKIM 4552 0.83 5.05 0.24 72 XM_SPF_SoftFail 4397 1.68 4.88 1.23 73 XM_SendGrid 4372 4.95 4.85 4.96 74 TR_XM_COVIDMETA4 4372 1.03 4.85 0.50 75 BAYES_95 4243 2.44 4.70 2.12 76 XM_B_SpammyTLD 4234 1.85 4.69 1.45 77 RCVD_IN_RP_RNBL 4227 0.62 4.69 0.05 78 SpammyFromTLD_01 4219 1.12 4.68 0.63 79 RCVD_IN_MSPIKE_L3 4095 0.83 4.54 0.31 80 RCVD_IN_MSPIKE_H3 4072 11.08 4.52 12.01 81 XMBody_17 3980 1.17 4.41 0.71 82 XM_DIRTYINTL 3775 0.92 4.19 0.46 83 XM_B_Phish66 3486 1.74 3.87 1.44 84 URIBL_SBL_A 3271 0.57 3.63 0.14 85 XM_URI_RBL 3268 0.61 3.62 0.18 86 DATE_IN_PAST_03_06 3198 0.55 3.55 0.13 87 HTML_IMAGE_RATIO_06 3189 3.16 3.54 3.11 88 TR_XM_MaxWHORU 3177 0.49 3.52 0.06 89 MIME_QP_LONG_LINE 3168 4.58 3.51 4.73 90 TR_XM_UnparsRelay 3062 0.72 3.40 0.35 91 RELAYCOUNTRY_FR 3018 0.65 3.35 0.27 92 TM2_M_URI_OPT_OUT 2987 18.78 3.31 20.95 93 TR_XM_MaxSPIKE 2943 0.43 3.26 0.04 94 T_XMDrugObfuBody_08 2936 1.59 3.26 1.35 95 RCVD_IN_MSPIKE_H4 2895 7.19 3.21 7.74 96 XMSexyCombo_01 2812 1.14 3.12 0.86 97 RELAYCOUNTRY_SG 2809 0.52 3.11 0.16 98 XMBrknScrpt_02 2734 1.06 3.03 0.78 99 XM_JunkDunk 2722 0.37 3.02 0.00 100 RCVD_IN_MSPIKE_L5 2706 0.55 3.00 0.21 101 TR_Symld_Words 2702 1.45 3.00 1.23 102 BAD_ENC_HEADER 2654 0.38 2.94 0.02 103 SUBJ_ALL_CAPS 2611 1.55 2.90 1.36 104 XM_UB60 2588 0.44 2.87 0.10 105 TR_XM_MaxBayes 2564 0.39 2.84 0.05 106 PDS_OTHER_BAD_TLD 2472 0.46 2.74 0.14 107 RCVD_IN_PSBL 2397 0.34 2.66 0.02 108 RELAYCOUNTRY_DE 2331 0.62 2.58 0.34 109 XM_OfRef6 2267 1.21 2.51 1.03 110 XM_UB80 2263 0.34 2.51 0.03 111 XMDiploma_00 2261 1.87 2.51 1.78 112 XMStrtUSub 2232 3.67 2.47 3.83 113 TR_XM_RelayPhish 2171 0.40 2.41 0.12 114 TR_XM_COVIDMETA1 2159 0.59 2.39 0.34 115 TR_XM_PHPDW 2155 0.61 2.39 0.35 116 TR_XM_PHPForged 2128 0.58 2.36 0.33 117 XM_CamelCaseFrm001 2128 1.69 2.36 1.60 118 TR_XM_FormFill2 2113 0.58 2.34 0.33 119 XM_H_PHPOS 2106 0.58 2.34 0.33 120 XMSexyCombo_04 2024 0.48 2.24 0.24 121 MIME_HTML_ONLY_MULTI 1990 3.66 2.21 3.86 122 HTML_IMAGE_RATIO_08 1952 2.10 2.16 2.09 123 TR_XM_DK_SendGrid 1938 2.60 2.15 2.67 124 SUBJ_ILLEGAL_CHARS 1847 0.26 2.05 0.01 125 URI_HEX 1835 1.41 2.03 1.32 126 XM_B_Unsub2 1772 3.92 1.96 4.20 127 T_XMDrugObfuBody_14 1692 1.42 1.88 1.36 128 XMHTML_After_End 1686 0.97 1.87 0.84 129 T_TooManySym_01 1675 3.82 1.86 4.10 130 BAYES_40 1674 3.52 1.86 3.75 131 TM2_M_VERY_LONG_WORD 1605 1.00 1.78 0.89 132 RELAYCOUNTRY_JP 1603 0.25 1.78 0.03 133 RELAYCOUNTRY_IT 1567 0.27 1.74 0.06 134 T_XMDrugObfuBody_00 1566 5.60 1.74 6.15 135 XM_BadFromFormat 1561 0.33 1.73 0.14 136 XM_SPF_Unknown 1560 0.62 1.73 0.46 137 XM_UB95 1535 0.23 1.70 0.02 138 XMBdyGiftCard01 1509 0.82 1.67 0.70 139 MAILING_LIST_MULTI 1496 2.08 1.66 2.14 140 RELAYCOUNTRY_GB 1484 0.84 1.65 0.72 141 BAYES_20 1469 3.58 1.63 3.85 142 HK_RANDOM_FROM 1457 0.28 1.62 0.09 143 LongTLD 1429 0.32 1.58 0.14 144 T_FILL_THIS_FORM_SHORT 1429 0.75 1.58 0.63 145 TR_LOTS_OF_MONEY3 1429 0.62 1.58 0.49 146 XMSubMetaSxObfu_03 1362 0.63 1.51 0.50 147 XM_PDF 1333 3.38 1.48 3.65 148 XMSubNoVowel 1318 1.94 1.46 2.01 149 DKIM_ADSP_CUSTOM_MED 1268 1.01 1.41 0.95 150 ALL_TRUSTED 1246 25.47 1.38 28.85 151 TR_MetaPhish_Combo_01 1209 0.72 1.34 0.64 152 RELAYCOUNTRY_AU 1197 0.39 1.33 0.26 153 MPART_ALT_DIFF_COUNT 1175 0.40 1.30 0.27 154 RELAYCOUNTRY_RU 1163 0.17 1.29 0.02 155 XMGenDplmaNmb 1126 0.77 1.25 0.70 156 XMStockSpam_06 1124 0.98 1.25 0.95 157 XM_H_Undi_Recip 1121 0.28 1.24 0.15 158 XM_ProductURIs 1103 0.84 1.22 0.78 159 NML_ADSP_CUSTOM_MED 1090 0.80 1.21 0.75 160 RELAYCOUNTRY_NL 1057 0.65 1.17 0.58 161 BAYES_05 1054 4.52 1.17 4.99 162 HELO_NODOT 1048 1.06 1.16 1.04 163 HELO_NO_DOMAIN 1048 1.05 1.16 1.04 164 TR_Mismatch_TLD_01 1048 0.31 1.16 0.19 165 FORGED_GMAIL_RCVD 1041 0.47 1.15 0.37 166 MIME_CHARSET_FARAWAY 1038 0.22 1.15 0.09 167 XM_DK_Undo_01 1038 1.27 1.15 1.28 168 TM2_M_A_HREF_HREF 1012 0.47 1.12 0.37 169 TR_Mismatch_TLD_02 1009 0.19 1.12 0.06 170 URIBL_BLACK 1003 0.16 1.11 0.03 171 DATE_IN_PAST_06_12 993 0.24 1.10 0.11 172 URI_PHP_REDIR 990 0.14 1.10 0.00 173 RDNS_DYNAMIC 984 0.38 1.09 0.28 174 HTML_SHORT_LINK_IMG_3 980 0.17 1.09 0.04 175 RELAYCOUNTRY_HU 962 0.14 1.07 0.01 176 URI_TRY_3LD 952 1.08 1.06 1.09 177 DATE_IN_PAST_12_24 949 0.15 1.05 0.02 178 CHARSET_FARAWAY_HEADER 945 0.15 1.05 0.03 179 XMPhish30 942 0.50 1.04 0.42 180 XMPhish08 940 0.38 1.04 0.28 181 URI_NOVOWEL 932 0.41 1.03 0.32 182 BAYES_00 924 22.83 1.02 25.90 183 RCVD_IN_IADB_LISTED 924 4.04 1.02 4.46 184 T_Symld_Words_02 914 0.56 1.01 0.49 185 HTML_IMAGE_ONLY_20 914 0.55 1.01 0.49 186 MISSING_HEADERS 913 0.41 1.01 0.33 187 XMReplyNow 912 0.20 1.01 0.09 188 T_XMHurry_00 911 0.52 1.01 0.45 189 T_MONEY_PERCENT 902 0.28 1.00 0.18 190 TR_LOTS_OF_MONEY2 902 0.28 1.00 0.18 191 XM_H_MailChimp 898 0.27 1.00 0.17 192 HK_RANDOM_REPLYTO 893 0.22 0.99 0.12 193 XM_HighProb1 885 0.13 0.98 0.01 194 URI_WP_DIRINDEX 880 0.12 0.98 0.00 195 PLING_QUERY 863 0.44 0.96 0.37 196 XMBody_78 858 0.51 0.95 0.45 197 TR_XM_COVIDMETA3 847 0.13 0.94 0.02 198 XMSubjUTF8 841 0.11 0.93 0.00 199 RCVD_IN_IADB_SPF 833 3.51 0.92 3.87 200 URIBL_DBL_SPAM 831 0.12 0.92 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 631360 98.28 97.38 98.41 2 HTML_MESSAGE 469745 75.55 92.11 73.22 3 RELAYCOUNTRY_US 435262 67.70 66.67 67.85 4 DKIM_SIGNED 391212 62.26 71.37 60.98 5 XM_DK_Pass 384921 61.06 68.61 60.00 6 XM_B_Unicode 363579 58.96 75.25 56.67 7 DKIM_VALID 359923 56.12 56.24 56.10 8 BAYES_50 281167 42.63 34.10 43.83 9 DKIM_VALID_AU 264554 41.01 39.39 41.24 10 XMListUnsubscribeExists 259795 43.40 64.07 40.49 11 XM_B_Unicode3 214584 34.04 38.27 33.45 12 ALL_TRUSTED 185105 25.47 1.38 28.85 13 BAYES_00 166148 22.83 1.02 25.90 14 T_TM2_M_HEADER_IN_MSG 150054 23.03 20.47 23.39 15 DKIM_VALID_EF 140867 22.41 25.63 21.96 16 HTML_FONT_LOW_CONTRAST 137716 21.77 23.91 21.47 17 RCVD_IN_MSPIKE_WL 134946 19.41 7.86 21.03 18 TM2_M_URI_OPT_OUT 134398 18.78 3.31 20.95 19 ANY_BOUNCE_MESSAGE 132563 18.22 0.83 20.66 20 BOUNCE_MESSAGE 132560 18.22 0.83 20.66 21 LOC_TINY_FONT_1 124522 20.67 29.65 19.41 22 RCVD_IN_MSPIKE_H2 124398 20.09 25.05 19.39 23 XM_Multi_Part_URI 121769 18.66 16.35 18.98 24 MIME_HTML_ONLY 114673 20.36 38.03 17.87 25 FVGT_m_MULTI_ODD 114297 18.64 24.52 17.82 26 XMSubLong 113840 18.36 22.76 17.74 27 T_KAM_HTML_FONT_INVALID 97525 15.77 19.85 15.20 28 RCVD_IN_MSPIKE_H3 77040 11.08 4.52 12.01 29 XM_B_Unsub 70468 11.06 11.63 10.98 30 XM_Body_Dirty_Words 68994 11.68 18.27 10.75 31 XM_DK_Undo_02 64037 14.73 48.51 9.98 32 RCVD_IN_MSPIKE_H4 49682 7.19 3.21 7.74 33 LotsOfNums_01 45493 7.34 9.13 7.09 34 TooManyTo_001 44962 6.98 6.76 7.01 35 XM_Evil_Numbers_Gen 43924 7.12 9.07 6.85 36 LOTS_OF_MONEY 42455 7.62 14.74 6.62 37 BAYES_99 41518 10.66 40.43 6.47 38 HTML_IMAGE_RATIO_02 39966 6.87 11.39 6.23 39 T_XMDrugObfuBody_00 39440 5.60 1.74 6.15 40 IN_ZIMBRA_NJ_WHITELIST 38321 5.24 0.06 5.97 41 XM_DKIMWhitelistDomains 37988 5.19 0.01 5.92 42 XM_B_Phish_Phrases 37765 6.60 11.71 5.89 43 UNPARSEABLE_RELAY 37632 5.92 6.30 5.87 44 TR_XM_DK_Bayes 37284 5.18 0.67 5.81 45 MPART_ALT_DIFF 36300 5.87 7.40 5.66 46 BAYES_60 35489 5.74 7.25 5.53 47 RCVD_IN_RP_SAFE 34756 4.85 0.84 5.42 48 TR_XM_DK_Bayes1 34288 4.75 0.49 5.34 49 BAYES_999 33310 8.51 32.10 5.19 50 RCVD_IN_RP_CERTIFIED 32286 4.49 0.65 5.03 51 HTML_IMAGE_RATIO_04 32180 5.02 5.05 5.02 52 BAYES_05 31986 4.52 1.17 4.99 53 XM_H_Trusted_IP 31865 4.35 0.00 4.97 54 XM_SendGrid 31841 4.95 4.85 4.96 55 RELAYCOUNTRY_META 31769 8.47 33.48 4.95 56 DKIM_INVALID 31289 6.14 15.13 4.88 57 TR_XM_DK_Bayes2 30967 4.28 0.38 4.83 58 MIME_QP_LONG_LINE 30346 4.58 3.51 4.73 59 XM_H_Long_From01 28739 4.71 6.36 4.48 60 RCVD_IN_IADB_LISTED 28614 4.04 1.02 4.46 61 BOTNET_IPINHOSTNAME 27687 5.78 16.22 4.32 62 XM_B_Unsub2 26916 3.92 1.96 4.20 63 T_TooManySym_01 26290 3.82 1.86 4.10 64 RCVD_IN_IADB_SPF 24850 3.51 0.92 3.87 65 MIME_HTML_ONLY_MULTI 24795 3.66 2.21 3.86 66 BAYES_20 24710 3.58 1.63 3.85 67 XMStrtUSub 24591 3.67 2.47 3.83 68 BAYES_40 24067 3.52 1.86 3.75 69 XM_PDF 23403 3.38 1.48 3.65 70 XMSubMetaSx_00 23082 4.09 7.56 3.60 71 BAYES_80 22837 4.09 7.82 3.56 72 XMSexyCombo_05 22097 4.41 11.28 3.44 73 RCVD_IN_IADB_SENDERID 22086 3.13 0.87 3.44 74 RCVD_IN_IADB_DK 21520 3.05 0.89 3.35 75 HTML_IMAGE_RATIO_06 19957 3.16 3.54 3.11 76 BOTNET 17765 6.63 34.12 2.77 77 T_REMOTE_IMAGE 17611 3.98 12.75 2.75 78 RCVD_IN_IADB_VOUCHED 17382 2.41 0.31 2.71 79 TR_XM_DK_SendGrid 17105 2.60 2.15 2.67 80 NO_DNS_FOR_FROM 16138 3.61 11.38 2.52 81 TR_XM_PhishingBody 16026 3.00 6.60 2.50 82 XM_UncommonTLD01 15969 4.73 20.65 2.49 83 XMNumbers 15650 2.91 6.23 2.44 84 MAILING_LIST_MULTI 13755 2.08 1.66 2.14 85 BAYES_95 13609 2.44 4.70 2.12 86 HTML_MIME_NO_HTML_TAG 13572 3.45 12.91 2.12 87 HTML_IMAGE_RATIO_08 13427 2.10 2.16 2.09 88 MIME_HTML_MOSTLY 13169 2.43 5.08 2.05 89 T_TooManySym_02 12956 1.86 0.70 2.02 90 XMSubNoVowel 12870 1.94 1.46 2.01 91 FROM_EXCESS_BASE64 12150 2.85 9.67 1.89 92 XMDiploma_00 11412 1.87 2.51 1.78 93 RCVD_IN_IADB_OPTIN 11010 1.54 0.25 1.72 94 RELAYCOUNTRY_CA 10939 2.42 7.49 1.71 95 XM_CamelCaseFrm001 10250 1.69 2.36 1.60 96 UNTRUSTED_Relay 9817 4.20 23.16 1.53 97 KHOP_HELO_FCRDNS 9803 2.09 6.05 1.53 98 TooManyTo_002 9680 1.43 0.86 1.51 99 HTML_FONT_FACE_BAD 9573 1.39 0.68 1.49 100 XM_B_SpammyTLD 9320 1.85 4.69 1.45 101 XM_B_COVIDMETA 9257 2.01 6.05 1.44 102 XM_B_Phish66 9227 1.74 3.87 1.44 103 SUBJ_ALL_CAPS 8752 1.55 2.90 1.36 104 TVD_RCVD_IP 8721 1.24 0.40 1.36 105 T_XMDrugObfuBody_14 8707 1.42 1.88 1.36 106 T_XMDrugObfuBody_08 8669 1.59 3.26 1.35 107 URI_HEX 8495 1.41 2.03 1.32 108 RCVD_IN_MSPIKE_H5 8224 1.14 0.14 1.28 109 XM_DK_Undo_01 8220 1.27 1.15 1.28 110 TR_Symld_Words 7907 1.45 3.00 1.23 111 XM_SPF_SoftFail 7901 1.68 4.88 1.23 112 RCVD_IN_BL_SPAMCOP_NET 7653 2.12 8.70 1.19 113 HELO_MISC_IP 7604 1.14 0.83 1.19 114 CK_HELO_DYNAMIC_SPLIT_IP 7589 1.14 0.81 1.18 115 INVALID_MSGID 7320 1.04 0.30 1.14 116 IN_HORDE_ADDRESS_BOOK 7282 1.01 0.13 1.14 117 URI_TRY_3LD 6976 1.08 1.06 1.09 118 HELO_NODOT 6672 1.06 1.16 1.04 119 HELO_NO_DOMAIN 6670 1.05 1.16 1.04 120 TO_MALFORMED 6610 0.90 0.01 1.03 121 XM_OfRef6 6594 1.21 2.51 1.03 122 TooManyTo_003 6473 0.96 0.60 1.01 123 XM_GoogleGroups 6191 0.90 0.44 0.97 124 DKIM_ADSP_CUSTOM_MED 6116 1.01 1.41 0.95 125 XMStockSpam_06 6073 0.98 1.25 0.95 126 XM_UB50 5987 1.77 7.76 0.93 127 TM2_M_VERY_LONG_WORD 5685 1.00 1.78 0.89 128 XM_H_Long_From02 5627 0.88 0.91 0.88 129 XMSexyCombo_01 5549 1.14 3.12 0.86 130 XMGappySubj_01 5538 0.77 0.12 0.86 131 USER_IN_DEF_DKIM_WL 5407 0.74 0.00 0.84 132 XMHTML_After_End 5398 0.97 1.87 0.84 133 XMNoVowels 5256 0.82 0.81 0.82 134 XMCapTrack 5079 0.75 0.46 0.79 135 XM_ProductURIs 5019 0.84 1.22 0.78 136 XMBrknScrpt_02 5010 1.06 3.03 0.78 137 T_OBFU_PDF_ATTACH 4874 0.69 0.22 0.76 138 TooManyTo_004 4855 0.72 0.49 0.76 139 NML_ADSP_CUSTOM_MED 4798 0.80 1.21 0.75 140 RELAYCOUNTRY_GB 4641 0.84 1.65 0.72 141 XMBody_17 4577 1.17 4.41 0.71 142 XMGenDplmaNmb 4495 0.77 1.25 0.70 143 XMBdyGiftCard01 4464 0.82 1.67 0.70 144 T_TooManySym_03 4171 0.59 0.16 0.65 145 TR_MetaPhish_Combo_01 4079 0.72 1.34 0.64 146 T_FILL_THIS_FORM_SHORT 4034 0.75 1.58 0.63 147 SpammyFromTLD_01 4012 1.12 4.68 0.63 148 TooManyTo_005 3838 0.57 0.39 0.60 149 RCVD_IN_MSPIKE_BL 3773 1.55 8.41 0.59 150 RELAYCOUNTRY_NL 3722 0.65 1.17 0.58 151 XMBody_95 3644 0.51 0.13 0.57 152 TR_MSPIKEBAYES00 3641 0.50 0.01 0.57 153 HTTPS_HTTP_MISMATCH 3576 0.59 0.84 0.56 154 XMSubMetaSxObfu_03 3228 0.63 1.51 0.50 155 TR_BOTNET_NEGATE 3195 0.46 0.22 0.50 156 TR_XM_COVIDMETA4 3182 1.03 4.85 0.50 157 T_Symld_Words_02 3167 0.56 1.01 0.49 158 TR_LOTS_OF_MONEY3 3142 0.62 1.58 0.49 159 HTML_IMAGE_ONLY_20 3137 0.55 1.01 0.49 160 XM_SPF_Unknown 2969 0.62 1.73 0.46 161 XM_DIRTYINTL 2951 0.92 4.19 0.46 162 FROM_GOV_DKIM_AU 2928 0.41 0.09 0.46 163 XMMoneyMeta_00 2922 0.49 0.75 0.46 164 T_XMHurry_00 2910 0.52 1.01 0.45 165 XMBody_78 2901 0.51 0.95 0.45 166 XM_H_PHPMailer 2816 0.50 0.92 0.44 167 XM_ShortIntro_01 2811 0.43 0.35 0.44 168 HTML_TAG_BALANCE_BODY 2744 0.46 0.70 0.43 169 XMPhish30 2709 0.50 1.04 0.42 170 HTML_FONT_TINY_NORDNS 2707 0.46 0.74 0.42 171 XMLKML 2506 0.34 0.00 0.39 172 XMSubMetaI_00 2488 0.42 0.61 0.39 173 XM_B_COPY_HTML 2439 0.41 0.60 0.38 174 THIS_AD 2414 0.39 0.52 0.38 175 TM2_M_A_HREF_HREF 2392 0.47 1.12 0.37 176 XM_UCStrings02 2391 0.33 0.02 0.37 177 FORGED_GMAIL_RCVD 2372 0.47 1.15 0.37 178 PLING_QUERY 2353 0.44 0.96 0.37 179 TR_XM_PHPDW 2277 0.61 2.39 0.35 180 XMPhish14 2247 0.41 0.83 0.35 181 TR_XM_UnparsRelay 2243 0.72 3.40 0.35 182 RELAYCOUNTRY_DE 2201 0.62 2.58 0.34 183 TR_XM_COVIDMETA1 2187 0.59 2.39 0.34 184 TR_XM_FormFill2 2141 0.58 2.34 0.33 185 TR_XM_PHPForged 2136 0.58 2.36 0.33 186 TM2_M_BODY_EMPTY 2106 0.34 0.38 0.33 187 XM_H_PHPOS 2102 0.58 2.34 0.33 188 MISSING_HEADERS 2100 0.41 1.01 0.33 189 LOW_PRICE 2095 0.39 0.82 0.33 190 URI_NOVOWEL 2084 0.41 1.03 0.32 191 SpammyFromTLD_02 2081 1.62 10.82 0.32 192 HTML_IMAGE_ONLY_32 2024 0.31 0.28 0.32 193 SUBJ_DOLLARS 2009 0.31 0.31 0.31 194 RCVD_IN_MSPIKE_L3 2000 0.83 4.54 0.31 195 DKIM_ADSP_NXDOMAIN 1962 1.16 7.26 0.31 196 XMSubMetaSxObfu_02 1933 0.31 0.36 0.30 197 XMSubMetaSSx_00 1932 0.33 0.53 0.30 198 RCVD_IN_SORBS_DUL 1928 0.29 0.18 0.30 199 SHORT_HELO_AND_INLINE_IMAGE 1852 0.26 0.08 0.29 200 T_TooManySym_04 1836 0.26 0.06 0.29 ----------------------------------------------------------------------