Email: 765247 Autolearn: 0 AvgScore: 0.66 AvgScanTime: 1.79 sec Spam: 122674 Autolearn: 0 AvgScore: 13.49 AvgScanTime: 3.40 sec Ham: 642573 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 1.48 sec Time Spent Running SA: 379.88 hours Time Spent Processing Spam: 115.93 hours Time Spent Processing Ham: 263.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 119001 98.16 97.01 98.39 2 HTML_MESSAGE 115446 78.47 94.11 75.49 3 DKIM_SIGNED 73038 63.19 59.54 63.89 4 RELAYCOUNTRY_US 71466 67.44 58.26 69.19 5 XM_DK_Pass 70693 62.00 57.63 62.83 6 XM_B_Unicode 66097 57.75 53.88 58.49 7 XMListUnsubscribeExists 59043 43.14 48.13 42.18 8 DKIM_VALID 58326 57.12 47.55 58.95 9 MIME_HTML_ONLY 56907 22.23 46.39 17.62 10 RELAYCOUNTRY_META 51554 11.07 42.03 5.16 11 XM_DK_Undo_02 45000 14.21 36.68 9.92 12 BAYES_50 44722 44.17 36.46 45.64 13 DKIM_VALID_AU 42986 43.19 35.04 44.74 14 RCVD_IN_MSPIKE_H2 41712 22.55 34.00 20.37 15 BAYES_99 40038 10.59 32.64 6.38 16 UNTRUSTED_Relay 40017 6.81 32.62 1.88 17 BOTNET 38756 7.48 31.59 2.88 18 XM_B_Unicode3 37055 32.64 30.21 33.11 19 BAYES_999 31292 8.32 25.51 5.04 20 DKIM_VALID_EF 29837 23.91 24.32 23.83 21 HTML_MIME_NO_HTML_TAG 29272 5.64 23.86 2.16 22 XMSubLong 28539 19.12 23.26 18.33 23 FVGT_m_MULTI_ODD 28411 20.28 23.16 19.73 24 LOC_TINY_FONT_1 27693 20.79 22.57 20.45 25 T_TM2_M_HEADER_IN_MSG 24180 23.99 19.71 24.80 26 HTML_FONT_LOW_CONTRAST 23559 22.44 19.20 23.06 27 FROM_EXCESS_BASE64 23280 5.01 18.98 2.34 28 BODY_URI_ONLY 20897 2.81 17.03 0.09 29 XM_UncommonTLD01 20826 5.04 16.98 2.76 30 XM_Body_Dirty_Words 19818 11.89 16.16 11.07 31 T_KAM_HTML_FONT_INVALID 19485 15.55 15.88 15.48 32 LOTS_OF_MONEY 19460 7.62 15.86 6.04 33 HTML_IMAGE_RATIO_02 19030 7.81 15.51 6.34 34 RCVD_IN_BL_SPAMCOP_NET 18485 3.24 15.07 0.98 35 BOTNET_IPINHOSTNAME 16999 5.77 13.86 4.23 36 XM_Multi_Part_URI 15392 16.60 12.55 17.37 37 DKIM_INVALID 14712 6.07 11.99 4.94 38 XMSexyCombo_05 14521 4.75 11.84 3.39 39 HTML_SHORT_LINK_IMG_1 14276 1.91 11.64 0.06 40 T_REMOTE_IMAGE 14006 4.42 11.42 3.09 41 HTML_IMAGE_ONLY_08 13884 1.94 11.32 0.15 42 XM_B_Phish_Phrases 12900 6.60 10.52 5.85 43 NO_DNS_FOR_FROM 12354 3.81 10.07 2.61 44 FROM_SUSPICIOUS_NTLD 12012 1.59 9.79 0.03 45 FROM_SUSPICIOUS_NTLD_FP 11915 1.57 9.71 0.02 46 SpammyFromTLD_02 11871 1.73 9.68 0.21 47 XM_OfRef6 11854 2.49 9.66 1.12 48 MISSING_HEADERS 11428 2.00 9.32 0.60 49 RELAYCOUNTRY_FR 11073 1.77 9.03 0.39 50 HTML_TAG_BALANCE_CENTER 11055 1.52 9.01 0.09 51 LotsOfNums_01 11032 7.18 8.99 6.84 52 HDRS_MISSP 10652 1.41 8.68 0.02 53 XM_UB50 10557 2.33 8.61 1.14 54 RCVD_IN_PSBL 10509 1.39 8.57 0.03 55 TR_XM_PhishingBody 10452 3.96 8.52 3.09 56 REPLYTO_WITHOUT_TO_CC 10345 1.58 8.43 0.28 57 XM_UB99 10240 1.34 8.35 0.01 58 HELO_NODOT 10112 2.44 8.24 1.34 59 HELO_NO_DOMAIN 10111 2.44 8.24 1.34 60 DKIM_ADSP_NXDOMAIN 10077 1.51 8.21 0.23 61 BAYES_80 10059 4.46 8.20 3.75 62 BAYES_40 9916 4.80 8.08 4.17 63 DEAR_FRIEND 9835 1.35 8.02 0.08 64 XM_B_Unsub 9741 10.00 7.94 10.39 65 TR_LOTS_OF_MONEY1 9303 1.23 7.58 0.02 66 BAYES_60 9156 5.72 7.46 5.39 67 MONEY_FORM_SHORT 9056 1.20 7.38 0.02 68 RELAYCOUNTRY_UG 9037 1.18 7.37 0.00 69 RCVD_IN_MSPIKE_BL 9036 1.76 7.37 0.69 70 XM_Evil_Numbers_Gen 8881 7.07 7.24 7.04 71 XMSubMetaSx_00 8255 4.21 6.73 3.73 72 XM_UB999 8013 1.05 6.53 0.00 73 BOTNET_NORDNS 7935 1.05 6.47 0.02 74 RELAYCOUNTRY_CA 7810 2.39 6.37 1.64 75 RCVD_IN_MSPIKE_WL 7505 19.24 6.12 21.74 76 XM_B_Phish66 7345 2.59 5.99 1.94 77 XM_B_COVIDMETA 6838 2.17 5.57 1.52 78 FROM_NTLD_LINKBAIT 6811 0.89 5.55 0.00 79 SHORT_IMG_SUSP_NTLD 6797 0.89 5.54 0.00 80 XMSubEmpty 6751 1.12 5.50 0.28 81 XM_DK_Undo_01 6745 2.02 5.50 1.35 82 KHOP_HELO_FCRDNS 6510 2.26 5.31 1.68 83 XM_JunkDunk 6385 0.84 5.20 0.00 84 UNPARSEABLE_RELAY 6377 6.01 5.20 6.17 85 TR_Sbj_FN_Bdy 6367 1.02 5.19 0.22 86 MISSING_SUBJECT 5911 0.89 4.82 0.14 87 XMNoSubject 5911 0.89 4.82 0.14 88 XM_H_Long_From01 5742 4.62 4.68 4.61 89 TooManyTo_001 5557 6.91 4.53 7.37 90 HTML_IMAGE_RATIO_04 5492 4.88 4.48 4.96 91 MPART_ALT_DIFF 5457 4.32 4.45 4.30 92 T_XMDrugObfuBody_14 5444 1.93 4.44 1.45 93 XMStrtUSub 5441 4.57 4.44 4.59 94 XMNumbers 5360 2.98 4.37 2.71 95 XMLngstWrd_00 5222 0.96 4.26 0.33 96 XM_SPF_SoftFail 5117 1.98 4.17 1.56 97 XM_SendGrid 5112 5.42 4.17 5.66 98 RCVD_IN_MSPIKE_L3 5062 1.01 4.13 0.42 99 BAYES_95 4913 2.61 4.00 2.34 100 XM_DIRTYINTL 4760 1.04 3.88 0.50 101 TR_XM_COVIDMETA4 4723 1.18 3.85 0.67 102 TR_XM_INV_DKIM 4604 0.75 3.75 0.18 103 RCVD_IN_RP_RNBL 4577 0.66 3.73 0.07 104 SpammyFromTLD_01 4434 1.30 3.61 0.86 105 XM_B_SpammyTLD 4301 1.89 3.51 1.58 106 RCVD_IN_MSPIKE_H3 4231 11.19 3.45 12.67 107 XM_UB80 4045 0.56 3.30 0.03 108 XM_UB60 4040 0.62 3.29 0.10 109 HK_RANDOM_FROM 3928 0.62 3.20 0.13 110 XMSubGiftCard1 3887 0.57 3.17 0.07 111 XMLngstWrd_01 3842 0.73 3.13 0.27 112 XMBody_17 3683 1.17 3.00 0.82 113 HTML_IMAGE_ONLY_16 3655 0.67 2.98 0.23 114 TR_XM_MaxSPIKE 3622 0.51 2.95 0.04 115 TR_XM_UnparsRelay 3550 0.83 2.89 0.43 116 XM_Combo_Sbj 3524 0.59 2.87 0.16 117 MIME_HTML_MOSTLY 3483 2.03 2.84 1.88 118 XMSexyCombo_01 3407 1.15 2.78 0.84 119 HTML_IMAGE_RATIO_06 3405 3.07 2.78 3.12 120 TR_XM_MaxWHORU 3315 0.48 2.70 0.06 121 RCVD_IN_MSPIKE_H4 3170 7.03 2.58 7.88 122 RCVD_IN_MSPIKE_L5 3168 0.61 2.58 0.23 123 HTML_SHORT_LINK_IMG_2 3148 0.44 2.57 0.04 124 SUBJ_ALL_CAPS 3071 1.35 2.50 1.14 125 T_XMDrugObfuBody_08 3049 1.58 2.49 1.41 126 TM2_M_URI_OPT_OUT 3048 16.01 2.48 18.60 127 HTML_IMAGE_RATIO_08 3010 2.17 2.45 2.11 128 XM_URI_RBL 3000 0.56 2.45 0.20 129 URIBL_SBL_A 2939 0.56 2.40 0.21 130 MIME_QP_LONG_LINE 2756 4.05 2.25 4.39 131 TR_XM_COVIDMETA1 2679 0.63 2.18 0.34 132 PDS_OTHER_BAD_TLD 2668 0.67 2.17 0.38 133 XMHTML_After_End 2401 1.03 1.96 0.85 134 TR_XM_PHPDW 2396 0.70 1.95 0.46 135 XMLngstWrd_02 2386 0.48 1.94 0.20 136 TR_XM_MaxBayes 2368 0.36 1.93 0.06 137 TR_XM_PHPForged 2353 0.68 1.92 0.44 138 RELAYCOUNTRY_JP 2351 0.34 1.92 0.04 139 RELAYCOUNTRY_GB 2341 1.05 1.91 0.88 140 TR_XM_FormFill2 2334 0.67 1.90 0.44 141 XM_H_PHPOS 2327 0.67 1.90 0.43 142 DATE_IN_PAST_03_06 2322 0.43 1.89 0.15 143 MIME_HTML_ONLY_MULTI 2226 2.61 1.81 2.76 144 XM_CamelCaseFrm001 2203 1.64 1.80 1.61 145 XMDiploma_00 2199 1.85 1.79 1.86 146 XM_UB95 2152 0.30 1.75 0.02 147 RELAYCOUNTRY_IT 2134 0.33 1.74 0.06 148 TR_Symld_Words 2134 1.32 1.74 1.25 149 TR_XM_RelayPhish 2124 0.44 1.73 0.19 150 T_TooManySym_01 2104 3.43 1.72 3.76 151 ALL_TRUSTED 2103 23.07 1.71 27.15 152 XMSexyCombo_04 2100 0.62 1.71 0.41 153 XMBrknScrpt_02 2099 0.87 1.71 0.71 154 XMSubNoVowel 2025 1.38 1.65 1.33 155 TM2_M_VERY_LONG_WORD 2004 1.28 1.63 1.21 156 TR_XM_DK_SendGrid 1961 2.80 1.60 3.03 157 BAYES_20 1901 3.88 1.55 4.32 158 LongTLD 1893 0.37 1.54 0.14 159 XMSubMetaSxObfu_03 1861 0.80 1.52 0.66 160 XM_B_Unsub2 1839 3.46 1.50 3.83 161 MAILING_LIST_MULTI 1838 1.88 1.50 1.95 162 XM_BadFromFormat 1794 0.33 1.46 0.11 163 DKIM_ADSP_CUSTOM_MED 1785 1.07 1.46 1.00 164 RELAYCOUNTRY_NL 1780 0.35 1.45 0.14 165 BAD_ENC_HEADER 1763 0.25 1.44 0.02 166 TR_Mismatch_TLD_01 1744 0.46 1.42 0.28 167 RELAYCOUNTRY_DE 1674 0.63 1.36 0.50 168 XMBdyGiftCard01 1669 0.79 1.36 0.68 169 NML_ADSP_CUSTOM_MED 1608 0.77 1.31 0.66 170 FROM_LOCAL_NOVOWEL 1596 0.24 1.30 0.03 171 XMPhish14 1580 0.57 1.29 0.43 172 HK_RANDOM_REPLYTO 1575 0.41 1.28 0.24 173 FVGT_m_MULTI_ODD_EMAIL 1567 0.24 1.28 0.04 174 XMBody_78 1543 0.44 1.26 0.29 175 FORGED_GMAIL_RCVD 1455 0.58 1.19 0.46 176 T_XMDrugObfuBody_00 1444 3.70 1.18 4.18 177 TR_XM_SpoofPhishAttach 1419 0.26 1.16 0.09 178 TR_MetaPhish_Combo_01 1411 0.87 1.15 0.82 179 URI_HEX 1410 1.27 1.15 1.29 180 XMStockSpam_06 1332 1.06 1.09 1.05 181 T_FILL_THIS_FORM_SHORT 1327 0.77 1.08 0.71 182 RDNS_DYNAMIC 1313 0.42 1.07 0.29 183 XM_PDF 1280 3.28 1.04 3.71 184 TR_Mismatch_TLD_02 1275 0.23 1.04 0.08 185 TR_LOTS_OF_MONEY3 1271 0.58 1.04 0.49 186 HK_SCAM 1251 0.19 1.02 0.03 187 MIME_CHARSET_FARAWAY 1167 0.26 0.95 0.13 188 ANY_BOUNCE_MESSAGE 1153 15.75 0.94 18.58 189 BOUNCE_MESSAGE 1153 15.75 0.94 18.58 190 RELAYCOUNTRY_KR 1150 0.17 0.94 0.02 191 FROM_MISSP_REPLYTO 1110 0.15 0.90 0.01 192 RELAYCOUNTRY_HK 1100 0.18 0.90 0.04 193 SUBJ_ILLEGAL_CHARS 1090 0.18 0.89 0.05 194 DATE_IN_PAST_06_12 1087 0.24 0.89 0.11 195 T_XMHurry_00 1086 0.84 0.89 0.83 196 CHARSET_FARAWAY_HEADER 1077 0.18 0.88 0.05 197 BAYES_05 1066 4.56 0.87 5.27 198 URIBL_BLACK 1065 0.15 0.87 0.02 199 XMSubGiftCard2 1060 0.15 0.86 0.01 200 MPART_ALT_DIFF_COUNT 1046 0.37 0.85 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 632200 98.16 97.01 98.39 2 HTML_MESSAGE 485065 78.47 94.11 75.49 3 RELAYCOUNTRY_US 444618 67.44 58.26 69.19 4 DKIM_SIGNED 410537 63.19 59.54 63.89 5 XM_DK_Pass 403744 62.00 57.63 62.83 6 DKIM_VALID 378821 57.12 47.55 58.95 7 XM_B_Unicode 375817 57.75 53.88 58.49 8 BAYES_50 293261 44.17 36.46 45.64 9 DKIM_VALID_AU 287500 43.19 35.04 44.74 10 XMListUnsubscribeExists 271061 43.14 48.13 42.18 11 XM_B_Unicode3 212738 32.64 30.21 33.11 12 ALL_TRUSTED 174468 23.07 1.71 27.15 13 T_TM2_M_HEADER_IN_MSG 159374 23.99 19.71 24.80 14 DKIM_VALID_EF 153125 23.91 24.32 23.83 15 HTML_FONT_LOW_CONTRAST 148192 22.44 19.20 23.06 16 BAYES_00 146072 19.20 0.73 22.73 17 RCVD_IN_MSPIKE_WL 139726 19.24 6.12 21.74 18 LOC_TINY_FONT_1 131417 20.79 22.57 20.45 19 RCVD_IN_MSPIKE_H2 130867 22.55 34.00 20.37 20 FVGT_m_MULTI_ODD 126751 20.28 23.16 19.73 21 TM2_M_URI_OPT_OUT 119494 16.01 2.48 18.60 22 ANY_BOUNCE_MESSAGE 119381 15.75 0.94 18.58 23 BOUNCE_MESSAGE 119380 15.75 0.94 18.58 24 XMSubLong 117782 19.12 23.26 18.33 25 MIME_HTML_ONLY 113240 22.23 46.39 17.62 26 XM_Multi_Part_URI 111643 16.60 12.55 17.37 27 T_KAM_HTML_FONT_INVALID 99501 15.55 15.88 15.48 28 RCVD_IN_MSPIKE_H3 81410 11.19 3.45 12.67 29 XM_Body_Dirty_Words 71137 11.89 16.16 11.07 30 XM_B_Unsub 66752 10.00 7.94 10.39 31 XM_DK_Undo_02 63726 14.21 36.68 9.92 32 RCVD_IN_MSPIKE_H4 50612 7.03 2.58 7.88 33 TooManyTo_001 47338 6.91 4.53 7.37 34 XM_Evil_Numbers_Gen 45230 7.07 7.24 7.04 35 TR_XM_DK_Bayes 44077 5.81 0.32 6.86 36 LotsOfNums_01 43950 7.18 8.99 6.84 37 XM_DKIMWhitelistDomains 41187 5.38 0.01 6.41 38 BAYES_99 41001 10.59 32.64 6.38 39 TR_XM_DK_Bayes1 40831 5.36 0.17 6.35 40 IN_ZIMBRA_NJ_WHITELIST 40816 5.34 0.03 6.35 41 HTML_IMAGE_RATIO_02 40724 7.81 15.51 6.34 42 UNPARSEABLE_RELAY 39643 6.01 5.20 6.17 43 LOTS_OF_MONEY 38825 7.62 15.86 6.04 44 RCVD_IN_RP_SAFE 37985 5.04 0.47 5.91 45 XM_B_Phish_Phrases 37606 6.60 10.52 5.85 46 XM_SendGrid 36345 5.42 4.17 5.66 47 TR_XM_DK_Bayes2 35969 4.72 0.12 5.60 48 RCVD_IN_RP_CERTIFIED 35232 4.65 0.27 5.48 49 BAYES_60 34651 5.72 7.46 5.39 50 BAYES_05 33847 4.56 0.87 5.27 51 RELAYCOUNTRY_META 33167 11.07 42.03 5.16 52 BAYES_999 32400 8.32 25.51 5.04 53 HTML_IMAGE_RATIO_04 31867 4.88 4.48 4.96 54 DKIM_INVALID 31716 6.07 11.99 4.94 55 XM_H_Long_From01 29641 4.62 4.68 4.61 56 XMStrtUSub 29522 4.57 4.44 4.59 57 MIME_QP_LONG_LINE 28227 4.05 2.25 4.39 58 BAYES_20 27765 3.88 1.55 4.32 59 MPART_ALT_DIFF 27634 4.32 4.45 4.30 60 BOTNET_IPINHOSTNAME 27180 5.77 13.86 4.23 61 T_XMDrugObfuBody_00 26881 3.70 1.18 4.18 62 BAYES_40 26816 4.80 8.08 4.17 63 XM_B_Unsub2 24616 3.46 1.50 3.83 64 RCVD_IN_IADB_LISTED 24485 3.30 0.66 3.81 65 T_TooManySym_01 24132 3.43 1.72 3.76 66 BAYES_80 24105 4.46 8.20 3.75 67 XMSubMetaSx_00 23947 4.21 6.73 3.73 68 XM_PDF 23821 3.28 1.04 3.71 69 XMSexyCombo_05 21799 4.75 11.84 3.39 70 RCVD_IN_IADB_SPF 21351 2.89 0.59 3.32 71 HTML_IMAGE_RATIO_06 20064 3.07 2.78 3.12 72 TR_XM_PhishingBody 19858 3.96 8.52 3.09 73 T_REMOTE_IMAGE 19830 4.42 11.42 3.09 74 TR_XM_DK_SendGrid 19482 2.80 1.60 3.03 75 XM_H_Trusted_IP 18855 2.46 0.00 2.93 76 RCVD_IN_IADB_SENDERID 18833 2.55 0.58 2.93 77 RCVD_IN_IADB_DK 18678 2.53 0.59 2.91 78 BOTNET 18516 7.48 31.59 2.88 79 MIME_HTML_ONLY_MULTI 17754 2.61 1.81 2.76 80 XM_UncommonTLD01 17714 5.04 16.98 2.76 81 XMNumbers 17442 2.98 4.37 2.71 82 NO_DNS_FOR_FROM 16769 3.81 10.07 2.61 83 RCVD_IN_IADB_VOUCHED 15146 2.01 0.18 2.36 84 FROM_EXCESS_BASE64 15047 5.01 18.98 2.34 85 BAYES_95 15045 2.61 4.00 2.34 86 HTML_MIME_NO_HTML_TAG 13910 5.64 23.86 2.16 87 HTML_IMAGE_RATIO_08 13561 2.17 2.45 2.11 88 MAILING_LIST_MULTI 12538 1.88 1.50 1.95 89 XM_B_Phish66 12442 2.59 5.99 1.94 90 UNTRUSTED_Relay 12105 6.81 32.62 1.88 91 MIME_HTML_MOSTLY 12079 2.03 2.84 1.88 92 XMDiploma_00 11980 1.85 1.79 1.86 93 TooManyTo_002 11789 1.66 0.71 1.83 94 T_TooManySym_02 11118 1.54 0.53 1.73 95 KHOP_HELO_FCRDNS 10791 2.26 5.31 1.68 96 RELAYCOUNTRY_CA 10513 2.39 6.37 1.64 97 XM_CamelCaseFrm001 10339 1.64 1.80 1.61 98 XM_B_SpammyTLD 10142 1.89 3.51 1.58 99 XM_SPF_SoftFail 9999 1.98 4.17 1.56 100 XM_B_COVIDMETA 9770 2.17 5.57 1.52 101 T_XMDrugObfuBody_14 9346 1.93 4.44 1.45 102 RCVD_IN_IADB_OPTIN 9291 1.24 0.16 1.45 103 T_XMDrugObfuBody_08 9029 1.58 2.49 1.41 104 TVD_RCVD_IP 9011 1.23 0.31 1.40 105 URI_TRY_3LD 8751 1.27 0.79 1.36 106 XM_DK_Undo_01 8704 2.02 5.50 1.35 107 HELO_NODOT 8595 2.44 8.24 1.34 108 HELO_NO_DOMAIN 8592 2.44 8.24 1.34 109 XMSubNoVowel 8531 1.38 1.65 1.33 110 URI_HEX 8315 1.27 1.15 1.29 111 TR_Symld_Words 8003 1.32 1.74 1.25 112 TM2_M_VERY_LONG_WORD 7804 1.28 1.63 1.21 113 RCVD_IN_MSPIKE_H5 7704 1.02 0.08 1.20 114 TooManyTo_003 7578 1.07 0.51 1.18 115 CK_HELO_DYNAMIC_SPLIT_IP 7349 1.05 0.55 1.14 116 IN_HORDE_ADDRESS_BOOK 7337 0.98 0.11 1.14 117 HELO_MISC_IP 7335 1.05 0.58 1.14 118 INVALID_MSGID 7333 0.98 0.17 1.14 119 SUBJ_ALL_CAPS 7298 1.35 2.50 1.14 120 XM_UB50 7295 2.33 8.61 1.14 121 XM_OfRef6 7175 2.49 9.66 1.12 122 XM_GoogleGroups 6754 0.95 0.43 1.05 123 XMStockSpam_06 6745 1.06 1.09 1.05 124 TO_MALFORMED 6704 0.88 0.00 1.04 125 DKIM_ADSP_CUSTOM_MED 6426 1.07 1.46 1.00 126 RCVD_IN_BL_SPAMCOP_NET 6276 3.24 15.07 0.98 127 XMCapTrack 6167 0.87 0.40 0.96 128 XM_ProductURIs 6144 0.89 0.52 0.96 129 USER_IN_DEF_DKIM_WL 5886 0.77 0.00 0.92 130 TooManyTo_004 5736 0.82 0.43 0.89 131 RELAYCOUNTRY_GB 5666 1.05 1.91 0.88 132 XM_H_Long_From02 5585 0.83 0.62 0.87 133 SpammyFromTLD_01 5494 1.30 3.61 0.86 134 XMHTML_After_End 5446 1.03 1.96 0.85 135 XMSexyCombo_01 5391 1.15 2.78 0.84 136 T_XMHurry_00 5344 0.84 0.89 0.83 137 TR_MetaPhish_Combo_01 5269 0.87 1.15 0.82 138 XMBody_17 5265 1.17 3.00 0.82 139 HTML_FONT_FACE_BAD 5258 0.78 0.60 0.82 140 XMGenDplmaNmb 4927 0.77 0.76 0.77 141 TooManyTo_005 4751 0.68 0.34 0.74 142 XMBrknScrpt_02 4549 0.87 1.71 0.71 143 T_FILL_THIS_FORM_SHORT 4548 0.77 1.08 0.71 144 T_OBFU_PDF_ATTACH 4521 0.62 0.20 0.70 145 XMSubMetaI_00 4460 0.69 0.67 0.69 146 RCVD_IN_MSPIKE_BL 4423 1.76 7.37 0.69 147 XMBdyGiftCard01 4370 0.79 1.36 0.68 148 XMGappySubj_01 4365 0.59 0.13 0.68 149 TR_XM_COVIDMETA4 4336 1.18 3.85 0.67 150 NML_ADSP_CUSTOM_MED 4266 0.77 1.31 0.66 151 XMSubMetaSxObfu_03 4260 0.80 1.52 0.66 152 XMBody_95 4006 0.53 0.06 0.62 153 HTTPS_HTTP_MISMATCH 3948 0.59 0.46 0.61 154 TR_MSPIKEBAYES00 3887 0.51 0.00 0.60 155 MISSING_HEADERS 3882 2.00 9.32 0.60 156 XM_SPF_Unknown 3730 0.59 0.62 0.58 157 XMMoneyMeta_00 3727 0.59 0.65 0.58 158 XM_E_Blogspot 3625 0.48 0.06 0.56 159 T_TooManySym_03 3561 0.49 0.15 0.55 160 HTML_IMAGE_ONLY_20 3494 0.53 0.46 0.54 161 XM_DIRTYINTL 3225 1.04 3.88 0.50 162 RELAYCOUNTRY_DE 3182 0.63 1.36 0.50 163 TR_LOTS_OF_MONEY3 3153 0.58 1.04 0.49 164 XM_H_PHPMailer 3105 0.53 0.77 0.48 165 XM_ShortIntro_01 3097 0.49 0.50 0.48 166 T_Symld_Words_02 3064 0.51 0.69 0.48 167 TR_BOTNET_NEGATE 3063 0.45 0.32 0.48 168 FORGED_GMAIL_RCVD 2984 0.58 1.19 0.46 169 XMNoVowels 2951 0.49 0.67 0.46 170 TR_XM_PHPDW 2947 0.70 1.95 0.46 171 XMSubMetaSSx_00 2940 0.44 0.32 0.46 172 TR_XM_PHPForged 2815 0.68 1.92 0.44 173 TR_XM_FormFill2 2811 0.67 1.90 0.44 174 XM_H_PHPOS 2776 0.67 1.90 0.43 175 TR_XM_UnparsRelay 2764 0.83 2.89 0.43 176 XMPhish14 2750 0.57 1.29 0.43 177 XMOemUri 2713 0.47 0.71 0.42 178 RCVD_IN_MSPIKE_L3 2677 1.01 4.13 0.42 179 XMSexyCombo_04 2655 0.62 1.71 0.41 180 TVD_SPACE_RATIO 2559 0.41 0.46 0.40 181 FROM_GOV_DKIM_AU 2555 0.35 0.09 0.40 182 RELAYCOUNTRY_FR 2509 1.77 9.03 0.39 183 RCVD_IN_SORBS_DUL 2470 0.36 0.22 0.38 184 RELAYCOUNTRY_AU 2468 0.45 0.76 0.38 185 PDS_OTHER_BAD_TLD 2463 0.67 2.17 0.38 186 HTML_TAG_BALANCE_BODY 2459 0.41 0.54 0.38 187 TM2_M_BODY_EMPTY 2386 0.32 0.08 0.37 188 XMPhish30 2352 0.43 0.77 0.37 189 XMSubMetaSxObfu_02 2346 0.35 0.27 0.37 190 XMSubMetaSx_01 2314 0.34 0.22 0.36 191 NUMERIC_HTTP_ADDR 2291 0.37 0.42 0.36 192 HTML_IMAGE_ONLY_28 2272 0.35 0.32 0.35 193 XMSlimDrugH 2234 0.39 0.59 0.35 194 XMPhish08 2228 0.38 0.56 0.35 195 SHORT_HELO_AND_INLINE_IMAGE 2222 0.30 0.07 0.35 196 FROM_GOV_SPOOF 2215 0.32 0.21 0.34 197 TR_XM_COVIDMETA1 2167 0.63 2.18 0.34 198 LOW_PRICE 2164 0.39 0.65 0.34 199 XM_B_COPY_HTML 2147 0.35 0.43 0.33 200 XM_B_REG_HTML 2134 0.31 0.17 0.33 ----------------------------------------------------------------------