Email: 518784 Autolearn: 0 AvgScore: 0.66 AvgScanTime: 1.34 sec Spam: 69491 Autolearn: 0 AvgScore: 15.59 AvgScanTime: 2.63 sec Ham: 449293 Autolearn: 0 AvgScore: -1.65 AvgScanTime: 1.15 sec Time Spent Running SA: 193.80 hours Time Spent Processing Spam: 50.71 hours Time Spent Processing Ham: 143.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 68280 99.13 98.26 99.27 2 HTML_MESSAGE 63244 66.02 91.01 62.16 3 DKIM_SIGNED 43947 57.01 63.24 56.05 4 XM_DK_Pass 42351 56.09 60.94 55.34 5 XM_B_Unicode 40319 53.49 58.02 52.78 6 RELAYCOUNTRY_US 39952 57.48 57.49 57.47 7 XMListUnsubscribeExists 38642 44.12 55.61 42.34 8 DKIM_VALID 36665 53.09 52.76 53.14 9 XM_DK_Undo_02 31288 15.23 45.02 10.62 10 MIME_HTML_ONLY 29917 21.66 43.05 18.35 11 RELAYCOUNTRY_META 29439 9.19 42.36 4.06 12 BAYES_99 29063 12.31 41.82 7.74 13 DKIM_VALID_AU 26725 42.80 38.46 43.47 14 BOTNET 26411 7.06 38.01 2.28 15 UNTRUSTED_Relay 22416 5.77 32.26 1.68 16 XM_B_Unicode3 22051 33.17 31.73 33.39 17 BAYES_50 22002 34.96 31.66 35.47 18 BAYES_999 21733 9.59 31.27 6.24 19 XM_UncommonTLD01 20628 6.31 29.68 2.70 20 LOC_TINY_FONT_1 17578 23.11 25.30 22.78 21 XMSubLong 16251 17.61 23.39 16.72 22 FVGT_m_MULTI_ODD 15885 16.72 22.86 15.77 23 RCVD_IN_MSPIKE_H2 15698 17.86 22.59 17.13 24 DKIM_VALID_EF 15589 18.99 22.43 18.46 25 BOTNET_IPINHOSTNAME 15217 7.24 21.90 4.97 26 HTML_FONT_LOW_CONTRAST 13996 22.84 20.14 23.25 27 FROM_EXCESS_BASE64 13839 5.13 19.91 2.84 28 HTML_MIME_NO_HTML_TAG 13319 3.64 19.17 1.24 29 SpammyFromTLD_02 13083 2.71 18.83 0.22 30 FROM_SUSPICIOUS_NTLD 12802 2.49 18.42 0.02 31 FROM_SUSPICIOUS_NTLD_FP 12766 2.48 18.37 0.02 32 LOTS_OF_MONEY 12512 6.27 18.01 4.45 33 BODY_URI_ONLY 12077 2.36 17.38 0.04 34 HTML_TAG_BALANCE_CENTER 12074 2.42 17.37 0.10 35 T_KAM_HTML_FONT_INVALID 12019 12.84 17.30 12.15 36 HDRS_MISSP 11956 2.36 17.21 0.06 37 T_TM2_M_HEADER_IN_MSG 11720 16.02 16.87 15.89 38 RCVD_IN_BL_SPAMCOP_NET 11563 3.07 16.64 0.97 39 XM_Multi_Part_URI 11251 23.60 16.19 24.75 40 XMSexyCombo_05 10992 5.64 15.82 4.07 41 DKIM_ADSP_NXDOMAIN 10910 2.30 15.70 0.23 42 XM_Body_Dirty_Words 10249 10.73 14.75 10.10 43 T_REMOTE_IMAGE 9439 3.24 13.58 1.64 44 XMSubMetaSx_00 9082 5.51 13.07 4.34 45 HTML_IMAGE_RATIO_02 7935 7.83 11.42 7.27 46 DKIM_INVALID 7282 3.92 10.48 2.91 47 XM_UB99 7039 1.36 10.13 0.00 48 RCVD_IN_MSPIKE_BL 6924 1.97 9.96 0.74 49 XM_UB50 6882 2.19 9.90 1.00 50 BAYES_80 6320 4.61 9.09 3.91 51 RELAYCOUNTRY_FR 6217 1.55 8.95 0.41 52 RELAYCOUNTRY_CA 6146 2.75 8.84 1.80 53 XM_B_Phish_Phrases 6103 6.13 8.78 5.72 54 XM_B_Unsub 5957 8.41 8.57 8.39 55 BOTNET_NORDNS 5743 1.11 8.26 0.01 56 NO_DNS_FOR_FROM 5646 2.40 8.12 1.52 57 XM_JunkDunk 5545 1.07 7.98 0.00 58 TR_XM_PhishingBody 5405 3.21 7.78 2.50 59 RCVD_IN_RP_RNBL 5117 1.05 7.36 0.07 60 LotsOfNums_01 4989 6.18 7.18 6.02 61 XM_UB999 4889 0.94 7.04 0.00 62 XM_Evil_Numbers_Gen 4755 7.63 6.84 7.75 63 BAYES_60 4666 5.56 6.71 5.38 64 RCVD_IN_MSPIKE_WL 4504 18.67 6.48 20.55 65 TR_Mismatch_TLD_01 4486 1.05 6.46 0.21 66 SpammyFromTLD_01 4353 1.36 6.26 0.60 67 RCVD_IN_MSPIKE_L3 4152 1.29 5.97 0.56 68 XMSubMetaSxObfu_03 4041 0.97 5.82 0.22 69 LOADSA_MONEY_COMBO 3958 0.80 5.70 0.04 70 SUBJ_DOLLARS 3903 1.28 5.62 0.61 71 T_Symld_Words_02 3893 1.06 5.60 0.36 72 MPART_ALT_DIFF 3851 4.06 5.54 3.83 73 TooManyTo_001 3809 4.76 5.48 4.65 74 BAYES_95 3805 2.84 5.48 2.43 75 UNPARSEABLE_RELAY 3802 5.87 5.47 5.93 76 XM_H_Long_From01 3689 4.21 5.31 4.04 77 SUBJ_ALL_CAPS 3558 1.40 5.12 0.82 78 HTML_IMAGE_RATIO_04 3360 5.57 4.84 5.68 79 XM_SPF_SoftFail 3249 1.36 4.68 0.85 80 RELAYCOUNTRY_IT 3190 0.64 4.59 0.02 81 RCVD_IN_PSBL 3084 0.66 4.44 0.08 82 XM_DIRTYINTL 3082 0.92 4.44 0.38 83 XMBody_17 3030 1.44 4.36 0.99 84 MIME_HTML_MOSTLY 3013 2.64 4.34 2.38 85 URIBL_SBL_A 2976 0.81 4.28 0.28 86 XM_B_Phish66 2952 1.50 4.25 1.07 87 TR_XM_MaxSPIKE 2922 0.61 4.20 0.05 88 KHOP_HELO_FCRDNS 2890 1.31 4.16 0.87 89 XM_SendGrid 2888 5.01 4.16 5.14 90 XM_UB80 2823 0.57 4.06 0.02 91 MISSING_HEADERS 2786 0.76 4.01 0.26 92 RCVD_IN_MSPIKE_H3 2665 10.91 3.84 12.01 93 XMStrtUSub 2502 3.59 3.60 3.59 94 PDS_OTHER_BAD_TLD 2501 0.59 3.60 0.12 95 XM_UB60 2434 0.57 3.50 0.12 96 XMNumbers 2393 2.56 3.44 2.43 97 TR_XM_UnparsRelay 2360 0.91 3.40 0.53 98 HELO_NODOT 2269 0.65 3.27 0.25 99 HELO_NO_DOMAIN 2269 0.65 3.27 0.25 100 XM_B_SpammyTLD 2262 1.39 3.26 1.10 101 TR_XM_MaxBayes 2234 0.49 3.21 0.06 102 TR_XM_INV_DKIM 2224 0.56 3.20 0.15 103 RCVD_IN_MSPIKE_L5 2182 0.53 3.14 0.13 104 T_XMDrugObfuBody_08 2106 1.23 3.03 0.95 105 XM_OfRef6 2099 1.34 3.02 1.08 106 XMBrknScrpt_02 1982 1.02 2.85 0.73 107 REPLYTO_WITHOUT_TO_CC 1933 0.51 2.78 0.15 108 XM_UB95 1868 0.37 2.69 0.01 109 TR_XM_MaxWHORU 1847 0.40 2.66 0.05 110 RELAYCOUNTRY_DE 1830 0.54 2.63 0.21 111 RCVD_IN_MSPIKE_H4 1793 6.90 2.58 7.57 112 TR_XM_COVIDMETA4 1780 0.67 2.56 0.38 113 TM2_M_VERY_LONG_WORD 1763 1.02 2.54 0.78 114 DATE_IN_PAST_03_06 1704 0.44 2.45 0.13 115 XM_B_COVIDMETA 1610 1.01 2.32 0.81 116 XM_BadFromFormat 1605 0.43 2.31 0.14 117 XMSubGiftCard1 1578 0.46 2.27 0.18 118 XMSexyCombo_01 1570 1.25 2.26 1.09 119 XMHTML_After_End 1561 1.18 2.25 1.02 120 ADVANCE_FEE_4_NEW_MONEY 1517 0.30 2.18 0.01 121 XM_URI_RBL 1509 0.46 2.17 0.19 122 HTML_IMAGE_RATIO_06 1507 2.79 2.17 2.88 123 XMPhish08 1499 0.84 2.16 0.64 124 XMSubNoVowel 1476 1.07 2.12 0.90 125 XM_CamelCaseFrm001 1450 1.71 2.09 1.65 126 TR_LOTS_OF_MONEY1 1449 0.29 2.09 0.01 127 RELAYCOUNTRY_GB 1427 0.62 2.05 0.39 128 TR_XM_PHPDW 1397 0.51 2.01 0.28 129 TR_XM_RelayPhish 1359 0.34 1.96 0.09 130 TR_XM_PHPForged 1359 0.49 1.96 0.26 131 LongTLD 1358 0.34 1.95 0.09 132 TM2_M_URI_OPT_OUT 1357 29.41 1.95 33.66 133 TR_XM_FormFill2 1351 0.49 1.94 0.26 134 XM_H_PHPOS 1343 0.48 1.93 0.26 135 HTML_IMAGE_RATIO_08 1343 2.09 1.93 2.12 136 TR_XM_DK_SendGrid 1340 2.70 1.93 2.82 137 DKIM_ADSP_CUSTOM_MED 1327 0.97 1.91 0.82 138 TR_XM_COVIDMETA1 1296 0.41 1.86 0.19 139 T_XMDrugObfuBody_00 1272 9.04 1.83 10.16 140 TM2_M_A_HREF_HREF 1249 0.39 1.80 0.18 141 NML_ADSP_CUSTOM_MED 1248 0.69 1.80 0.52 142 XMDiploma_00 1231 1.10 1.77 0.99 143 URI_HEX 1226 1.25 1.76 1.17 144 TR_LOTS_OF_MONEY3 1209 0.60 1.74 0.42 145 PDS_FROM_2_EMAILS 1200 0.24 1.73 0.01 146 XM_SPF_Unknown 1197 0.42 1.72 0.22 147 MONEY_ATM_CARD 1197 0.24 1.72 0.01 148 BAYES_40 1184 2.92 1.70 3.10 149 FROM_2_EMAILS_SHORT 1183 0.23 1.70 0.00 150 FORGED_GMAIL_RCVD 1181 0.61 1.70 0.44 151 URI_TRY_3LD 1176 1.08 1.69 0.99 152 XMBdyGiftCard01 1157 1.52 1.66 1.50 153 LONG_JUNK_URI 1150 0.24 1.65 0.02 154 NO_FM_NAME_IP_HOSTN 1129 0.22 1.62 0.00 155 PDS_TO_EQ_FROM_NAME 1124 0.22 1.62 0.00 156 MIME_QP_LONG_LINE 1123 2.63 1.62 2.78 157 TR_Mismatch_TLD_02 1088 0.26 1.57 0.05 158 BAYES_20 1070 3.44 1.54 3.74 159 TR_XM_SpoofStaff 1066 0.29 1.53 0.10 160 XMSpoofStaff2 1054 0.29 1.52 0.10 161 T_TooManySym_01 1031 3.23 1.48 3.50 162 MPART_ALT_DIFF_COUNT 997 0.42 1.43 0.26 163 RELAYCOUNTRY_UG 978 0.19 1.41 0.00 164 URI_PHP_REDIR 978 0.19 1.41 0.00 165 DATE_IN_PAST_06_12 977 0.33 1.41 0.16 166 TR_XM_PhishingBody2 974 0.19 1.40 0.00 167 RELAYCOUNTRY_HU 974 0.26 1.40 0.09 168 URI_PHISH 970 0.20 1.40 0.02 169 XMPhishURI12 950 0.18 1.37 0.00 170 RELAYCOUNTRY_RU 946 0.21 1.36 0.03 171 MIME_HTML_ONLY_MULTI 942 2.23 1.36 2.36 172 MAILING_LIST_MULTI 908 1.33 1.31 1.33 173 RELAYCOUNTRY_JP 907 0.19 1.31 0.02 174 XM_B_Unsub2 898 0.91 1.29 0.85 175 XM_DK_Undo_01 878 1.01 1.26 0.97 176 MIME_CHARSET_FARAWAY 872 0.24 1.25 0.09 177 RDNS_DYNAMIC 861 0.44 1.24 0.32 178 TR_XM_PSC1 859 0.25 1.24 0.09 179 XM_H_SpoofStaff4 855 0.25 1.23 0.10 180 XMSubEmpty 849 0.27 1.22 0.12 181 ALL_TRUSTED 834 34.18 1.20 39.28 182 RELAYCOUNTRY_NL 823 0.29 1.18 0.16 183 CHARSET_FARAWAY_HEADER 808 0.19 1.16 0.04 184 TR_Sbj_FN_Bdy 808 0.26 1.16 0.12 185 XMStockSpam_06 801 1.09 1.15 1.08 186 T_XMDrugObfuBody_14 782 1.10 1.13 1.09 187 URIBL_BLACK 778 0.16 1.12 0.01 188 HK_RANDOM_REPLYTO 773 0.23 1.11 0.09 189 TR_XM_SpoofStaff2 731 0.14 1.05 0.00 190 TR_Symld_Words 729 0.91 1.05 0.89 191 XMSlimDrugH 727 0.41 1.05 0.31 192 BAYES_00 719 27.51 1.03 31.61 193 MONEY_FRAUD_8 699 0.14 1.01 0.00 194 HTML_SHORT_LINK_IMG_3 695 0.23 1.00 0.11 195 XMSubGiftCard2 691 0.18 0.99 0.06 196 T_XMHurry_00 690 0.77 0.99 0.74 197 HK_RANDOM_FROM 690 0.20 0.99 0.08 198 XMGppyBdWords 684 0.25 0.98 0.14 199 XMReplyNow 668 0.19 0.96 0.07 200 LOW_PRICE 664 0.51 0.96 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 445993 99.13 98.26 99.27 2 HTML_MESSAGE 279262 66.02 91.01 62.16 3 RELAYCOUNTRY_US 258222 57.48 57.49 57.47 4 DKIM_SIGNED 251813 57.01 63.24 56.05 5 XM_DK_Pass 248624 56.09 60.94 55.34 6 DKIM_VALID 238737 53.09 52.76 53.14 7 XM_B_Unicode 237156 53.49 58.02 52.78 8 DKIM_VALID_AU 195299 42.80 38.46 43.47 9 XMListUnsubscribeExists 190223 44.12 55.61 42.34 10 ALL_TRUSTED 176483 34.18 1.20 39.28 11 BAYES_50 159343 34.96 31.66 35.47 12 TM2_M_URI_OPT_OUT 151237 29.41 1.95 33.66 13 XM_B_Unicode3 150012 33.17 31.73 33.39 14 ANY_BOUNCE_MESSAGE 144337 27.89 0.54 32.13 15 BOUNCE_MESSAGE 144336 27.89 0.54 32.13 16 BAYES_00 142012 27.51 1.03 31.61 17 XM_Multi_Part_URI 111206 23.60 16.19 24.75 18 HTML_FONT_LOW_CONTRAST 104471 22.84 20.14 23.25 19 LOC_TINY_FONT_1 102328 23.11 25.30 22.78 20 RCVD_IN_MSPIKE_WL 92331 18.67 6.48 20.55 21 DKIM_VALID_EF 82926 18.99 22.43 18.46 22 MIME_HTML_ONLY 82451 21.66 43.05 18.35 23 RCVD_IN_MSPIKE_H2 76954 17.86 22.59 17.13 24 XMSubLong 75106 17.61 23.39 16.72 25 T_TM2_M_HEADER_IN_MSG 71385 16.02 16.87 15.89 26 FVGT_m_MULTI_ODD 70871 16.72 22.86 15.77 27 T_KAM_HTML_FONT_INVALID 54581 12.84 17.30 12.15 28 RCVD_IN_MSPIKE_H3 53954 10.91 3.84 12.01 29 XM_DK_Undo_02 47722 15.23 45.02 10.62 30 T_XMDrugObfuBody_00 45638 9.04 1.83 10.16 31 XM_Body_Dirty_Words 45401 10.73 14.75 10.10 32 RCVD_IN_RP_SAFE 38707 7.55 0.63 8.62 33 XM_B_Unsub 37693 8.41 8.57 8.39 34 RCVD_IN_RP_CERTIFIED 36603 7.10 0.37 8.15 35 XM_DKIMWhitelistDomains 35430 6.83 0.03 7.89 36 XM_Evil_Numbers_Gen 34841 7.63 6.84 7.75 37 BAYES_99 34794 12.31 41.82 7.74 38 RCVD_IN_MSPIKE_H4 34016 6.90 2.58 7.57 39 HTML_IMAGE_RATIO_02 32668 7.83 11.42 7.27 40 BAYES_05 29714 5.85 0.94 6.61 41 BAYES_999 28015 9.59 31.27 6.24 42 TR_XM_DK_Bayes 27179 5.28 0.33 6.05 43 LotsOfNums_01 27064 6.18 7.18 6.02 44 UNPARSEABLE_RELAY 26658 5.87 5.47 5.93 45 TR_XM_DK_Bayes1 25907 5.02 0.16 5.77 46 XM_B_Phish_Phrases 25715 6.13 8.78 5.72 47 HTML_IMAGE_RATIO_04 25537 5.57 4.84 5.68 48 BAYES_60 24187 5.56 6.71 5.38 49 TR_XM_DK_Bayes2 24106 4.66 0.12 5.37 50 XM_SendGrid 23078 5.01 4.16 5.14 51 BOTNET_IPINHOSTNAME 22325 7.24 21.90 4.97 52 TooManyTo_001 20878 4.76 5.48 4.65 53 LOTS_OF_MONEY 20013 6.27 18.01 4.45 54 XMSubMetaSx_00 19490 5.51 13.07 4.34 55 XMSexyCombo_05 18264 5.64 15.82 4.07 56 RELAYCOUNTRY_META 18245 9.19 42.36 4.06 57 XM_H_Long_From01 18141 4.21 5.31 4.04 58 BAYES_80 17583 4.61 9.09 3.91 59 MPART_ALT_DIFF 17214 4.06 5.54 3.83 60 BAYES_20 16788 3.44 1.54 3.74 61 XMStrtUSub 16120 3.59 3.60 3.59 62 T_TooManySym_01 15740 3.23 1.48 3.50 63 BAYES_40 13941 2.92 1.70 3.10 64 IN_ZIMBRA_NJ_WHITELIST 13742 2.66 0.05 3.06 65 DKIM_INVALID 13076 3.92 10.48 2.91 66 HTML_IMAGE_RATIO_06 12956 2.79 2.17 2.88 67 FROM_EXCESS_BASE64 12757 5.13 19.91 2.84 68 TR_XM_DK_SendGrid 12671 2.70 1.93 2.82 69 MIME_QP_LONG_LINE 12506 2.63 1.62 2.78 70 XM_UncommonTLD01 12115 6.31 29.68 2.70 71 TR_XM_PhishingBody 11224 3.21 7.78 2.50 72 XMNumbers 10912 2.56 3.44 2.43 73 BAYES_95 10910 2.84 5.48 2.43 74 MIME_HTML_MOSTLY 10691 2.64 4.34 2.38 75 MIME_HTML_ONLY_MULTI 10624 2.23 1.36 2.36 76 BOTNET 10232 7.06 38.01 2.28 77 RCVD_IN_IADB_LISTED 9943 1.98 0.50 2.21 78 HTML_IMAGE_RATIO_08 9508 2.09 1.93 2.12 79 TVD_RCVD_IP 9378 1.87 0.45 2.09 80 RCVD_IN_IADB_SPF 8742 1.74 0.44 1.95 81 T_TooManySym_02 8712 1.75 0.54 1.94 82 XMSubMetaI_00 8279 1.68 0.66 1.84 83 XM_H_Trusted_IP 8236 1.59 0.00 1.83 84 RELAYCOUNTRY_CA 8105 2.75 8.84 1.80 85 HELO_MISC_IP 8089 1.66 0.76 1.80 86 CK_HELO_DYNAMIC_SPLIT_IP 8084 1.67 0.82 1.80 87 RCVD_IN_IADB_SENDERID 7956 1.59 0.43 1.77 88 RCVD_IN_IADB_DK 7768 1.56 0.43 1.73 89 UNTRUSTED_Relay 7540 5.77 32.26 1.68 90 XM_CamelCaseFrm001 7418 1.71 2.09 1.65 91 T_REMOTE_IMAGE 7363 3.24 13.58 1.64 92 INVALID_MSGID 7346 1.47 0.41 1.64 93 NO_DNS_FOR_FROM 6823 2.40 8.12 1.52 94 XMBdyGiftCard01 6741 1.52 1.66 1.50 95 TO_MALFORMED 6659 1.28 0.01 1.48 96 XMBody_78 6462 1.33 0.62 1.44 97 MAILING_LIST_MULTI 5966 1.33 1.31 1.33 98 MIME_HEADER_CTYPE_ONLY 5762 1.13 0.15 1.28 99 RCVD_IN_IADB_VOUCHED 5731 1.12 0.15 1.28 100 USER_IN_DEF_DKIM_WL 5685 1.10 0.00 1.27 101 HTML_MIME_NO_HTML_TAG 5552 3.64 19.17 1.24 102 XM_H_Long_From02 5485 1.17 0.82 1.22 103 XM_ProductURIs 5448 1.15 0.77 1.21 104 XM_PDF 5335 1.09 0.44 1.19 105 URI_HEX 5235 1.25 1.76 1.17 106 XM_B_SpammyTLD 4925 1.39 3.26 1.10 107 XMSexyCombo_01 4914 1.25 2.26 1.09 108 T_XMDrugObfuBody_14 4912 1.10 1.13 1.09 109 XM_OfRef6 4863 1.34 3.02 1.08 110 XMStockSpam_06 4830 1.09 1.15 1.08 111 XM_B_Phish66 4805 1.50 4.25 1.07 112 IN_HORDE_ADDRESS_BOOK 4796 0.96 0.30 1.07 113 XMHTML_After_End 4561 1.18 2.25 1.02 114 XM_UB50 4486 2.19 9.90 1.00 115 XMDiploma_00 4454 1.10 1.77 0.99 116 URI_TRY_3LD 4450 1.08 1.69 0.99 117 XMBody_17 4439 1.44 4.36 0.99 118 RCVD_IN_BL_SPAMCOP_NET 4372 3.07 16.64 0.97 119 XM_DK_Undo_01 4368 1.01 1.26 0.97 120 RCVD_IN_MSPIKE_H5 4361 0.85 0.07 0.97 121 T_XMDrugObfuBody_08 4283 1.23 3.03 0.95 122 XMSubNoVowel 4056 1.07 2.12 0.90 123 TR_Symld_Words 4009 0.91 1.05 0.89 124 KHOP_HELO_FCRDNS 3926 1.31 4.16 0.87 125 XM_GoogleGroups 3897 0.79 0.31 0.87 126 XM_B_Unsub2 3831 0.91 1.29 0.85 127 XM_SPF_SoftFail 3828 1.36 4.68 0.85 128 SUBJ_ALL_CAPS 3704 1.40 5.12 0.82 129 DKIM_ADSP_CUSTOM_MED 3701 0.97 1.91 0.82 130 TR_MSPIKEBAYES00 3686 0.71 0.00 0.82 131 XM_B_COVIDMETA 3647 1.01 2.32 0.81 132 TM2_M_VERY_LONG_WORD 3522 1.02 2.54 0.78 133 RCVD_IN_IADB_OPTIN 3435 0.69 0.20 0.76 134 HTML_FONT_FACE_BAD 3428 0.73 0.52 0.76 135 XMGappySubj_01 3351 0.67 0.15 0.75 136 T_XMHurry_00 3321 0.77 0.99 0.74 137 RCVD_IN_MSPIKE_BL 3317 1.97 9.96 0.74 138 XMBrknScrpt_02 3298 1.02 2.85 0.73 139 T_MONEY_PERCENT 3056 0.66 0.51 0.68 140 TR_LOTS_OF_MONEY2 3056 0.66 0.51 0.68 141 TooManyTo_002 3036 0.65 0.52 0.68 142 XMSubMetaSSx_00 2899 0.62 0.46 0.65 143 XMSubMetaSxObfu_02 2872 0.61 0.42 0.64 144 XMPhish08 2855 0.84 2.16 0.64 145 T_TooManySym_03 2791 0.56 0.13 0.62 146 SUBJ_DOLLARS 2748 1.28 5.62 0.61 147 XMSexyCombo_04 2706 0.62 0.71 0.60 148 SpammyFromTLD_01 2693 1.36 6.26 0.60 149 XMBody_95 2566 0.50 0.05 0.57 150 RCVD_IN_MSPIKE_L3 2516 1.29 5.97 0.56 151 XMGenDplmaNmb 2456 0.55 0.58 0.55 152 XM_B_REG_HTML 2426 0.49 0.16 0.54 153 TR_XM_UnparsRelay 2379 0.91 3.40 0.53 154 NML_ADSP_CUSTOM_MED 2334 0.69 1.80 0.52 155 XM_B_COPY_HTML 2248 0.48 0.33 0.50 156 TooManyTo_003 2202 0.47 0.32 0.49 157 T_FILL_THIS_FORM_SHORT 2137 0.54 0.92 0.48 158 XMPhish14 1980 0.48 0.76 0.44 159 LOW_PRICE 1976 0.51 0.96 0.44 160 FORGED_GMAIL_RCVD 1964 0.61 1.70 0.44 161 TR_LOTS_OF_MONEY3 1901 0.60 1.74 0.42 162 HTML_IMAGE_ONLY_20 1897 0.47 0.75 0.42 163 TR_MetaPhish_Combo_01 1859 0.46 0.77 0.41 164 RELAYCOUNTRY_FR 1847 1.55 8.95 0.41 165 TooManyTo_004 1842 0.39 0.27 0.41 166 RELAYCOUNTRY_GB 1771 0.62 2.05 0.39 167 TR_BOTNET_NEGATE 1719 0.38 0.33 0.38 168 TR_XM_COVIDMETA4 1714 0.67 2.56 0.38 169 XMHTMLBadTable_001 1710 0.39 0.43 0.38 170 XMPhish30 1708 0.42 0.70 0.38 171 XM_DIRTYINTL 1708 0.92 4.44 0.38 172 XM_H_PHPMailer 1696 0.44 0.82 0.38 173 XM_RXBody 1657 0.38 0.47 0.37 174 THIS_AD 1615 0.38 0.48 0.36 175 T_Symld_Words_02 1603 1.06 5.60 0.36 176 USER_IN_WHITELIST 1589 0.31 0.00 0.35 177 DATE_IN_PAST_12_24 1494 0.37 0.65 0.33 178 HTML_TAG_BALANCE_BODY 1479 0.34 0.38 0.33 179 TooManyTo_005 1477 0.32 0.23 0.33 180 DIET_1 1475 0.40 0.85 0.33 181 RDNS_DYNAMIC 1417 0.44 1.24 0.32 182 XMSlimDrugH 1414 0.41 1.05 0.31 183 XMLngstWrd_00 1355 0.37 0.83 0.30 184 TR_XM_PHPDW 1259 0.51 2.01 0.28 185 HTTPS_HTTP_MISMATCH 1253 0.29 0.37 0.28 186 URIBL_SBL_A 1246 0.81 4.28 0.28 187 PLING_QUERY 1239 0.26 0.19 0.28 188 XMBSHREFv2 1236 0.26 0.17 0.28 189 XMLngstWrd_01 1216 0.33 0.69 0.27 190 TR_XM_PHPForged 1190 0.49 1.96 0.26 191 TR_XM_FormFill2 1184 0.49 1.94 0.26 192 MISSING_HEADERS 1177 0.76 4.01 0.26 193 XM_H_PHPOS 1171 0.48 1.93 0.26 194 MPART_ALT_DIFF_COUNT 1167 0.42 1.43 0.26 195 URI_NOVOWEL 1148 0.30 0.56 0.26 196 XM_Akamai 1129 0.22 0.00 0.25 197 XM_ShortIntro_01 1120 0.26 0.32 0.25 198 HELO_NODOT 1108 0.65 3.27 0.25 199 HELO_NO_DOMAIN 1102 0.65 3.27 0.25 200 T_TooManySym_04 1076 0.21 0.01 0.24 ----------------------------------------------------------------------