Email: 781428 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 1.85 sec Spam: 93618 Autolearn: 0 AvgScore: 12.15 AvgScanTime: 4.37 sec Ham: 687810 Autolearn: 0 AvgScore: -1.82 AvgScanTime: 1.51 sec Time Spent Running SA: 401.34 hours Time Spent Processing Spam: 113.70 hours Time Spent Processing Ham: 287.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 91065 98.33 97.27 98.48 2 HTML_MESSAGE 85673 77.25 91.51 75.31 3 DKIM_SIGNED 71137 66.14 75.99 64.80 4 XM_B_Unicode 68633 59.98 73.31 58.16 5 XM_DK_Pass 67887 64.85 72.51 63.80 6 RELAYCOUNTRY_US 65771 69.67 70.25 69.59 7 XMListUnsubscribeExists 59361 46.34 63.41 44.02 8 DKIM_VALID 54514 59.78 58.23 59.99 9 XM_DK_Undo_02 48418 15.12 51.72 10.14 10 DKIM_VALID_AU 37715 44.92 40.29 45.55 11 XM_B_Unicode3 36933 34.81 39.45 34.18 12 BAYES_99 36231 10.59 38.70 6.76 13 BAYES_50 33407 44.45 35.68 45.65 14 BOTNET 30051 6.41 32.10 2.92 15 MIME_HTML_ONLY 29866 18.83 31.90 17.05 16 LOC_TINY_FONT_1 27906 21.40 29.81 20.25 17 BAYES_999 27882 8.36 29.78 5.44 18 FVGT_m_MULTI_ODD 25318 20.07 27.04 19.12 19 RELAYCOUNTRY_META 25057 7.10 26.77 4.42 20 HTML_FONT_LOW_CONTRAST 24296 23.00 25.95 22.60 21 RCVD_IN_MSPIKE_H2 23845 20.80 25.47 20.17 22 DKIM_VALID_EF 23204 23.64 24.79 23.48 23 XMSubLong 22054 19.00 23.56 18.37 24 XM_Body_Dirty_Words 19536 12.43 20.87 11.28 25 T_KAM_HTML_FONT_INVALID 19465 16.27 20.79 15.65 26 T_TM2_M_HEADER_IN_MSG 18463 23.52 19.72 24.04 27 XM_Multi_Part_URI 17515 18.41 18.71 18.37 28 DKIM_INVALID 16623 6.37 17.76 4.82 29 BOTNET_IPINHOSTNAME 16560 6.08 17.69 4.49 30 UNTRUSTED_Relay 16289 3.57 17.40 1.69 31 LOTS_OF_MONEY 15293 7.56 16.34 6.36 32 XM_UncommonTLD01 14605 4.08 15.60 2.51 33 NO_DNS_FOR_FROM 12624 4.01 13.48 2.72 34 XM_B_Phish_Phrases 11298 6.96 12.07 6.27 35 XM_B_Unsub 11104 11.23 11.86 11.14 36 XMSexyCombo_05 11078 3.94 11.83 2.86 37 XM_Evil_Numbers_Gen 9804 7.72 10.47 7.35 38 RCVD_IN_MSPIKE_BL 9467 1.78 10.11 0.64 39 HTML_IMAGE_RATIO_02 9110 6.64 9.73 6.22 40 RCVD_IN_MSPIKE_WL 8245 20.78 8.81 22.41 41 RELAYCOUNTRY_CA 7855 2.39 8.39 1.57 42 LotsOfNums_01 7851 7.75 8.39 7.66 43 BAYES_80 7693 4.31 8.22 3.78 44 TR_XM_PhishingBody 7557 3.62 8.07 3.02 45 MPART_ALT_DIFF 7174 4.39 7.66 3.94 46 XMSubMetaSx_00 7001 3.71 7.48 3.20 47 RCVD_IN_BL_SPAMCOP_NET 6443 1.68 6.88 0.97 48 BAYES_60 6430 5.88 6.87 5.75 49 UNPARSEABLE_RELAY 6374 6.13 6.81 6.04 50 XM_B_COVIDMETA 6278 2.16 6.71 1.54 51 TooManyTo_001 5976 6.85 6.38 6.91 52 XM_UB50 5926 1.54 6.33 0.88 53 XM_H_Long_From01 5875 4.96 6.28 4.78 54 XM_SPF_SoftFail 5630 2.13 6.01 1.60 55 HTML_IMAGE_RATIO_04 5592 5.01 5.97 4.88 56 RCVD_IN_RP_RNBL 5529 0.76 5.91 0.06 57 XMBody_17 5205 1.46 5.56 0.91 58 XM_SendGrid 5179 5.42 5.53 5.40 59 XMStrtUSub 5035 4.44 5.38 4.32 60 TR_XM_INV_DKIM 4941 0.81 5.28 0.20 61 RCVD_IN_MSPIKE_L3 4922 1.05 5.26 0.47 62 SpammyFromTLD_02 4803 0.86 5.13 0.27 63 RCVD_IN_MSPIKE_H3 4788 11.84 5.11 12.75 64 BOTNET_NORDNS 4757 0.63 5.08 0.02 65 TR_XM_COVIDMETA4 4716 1.15 5.04 0.62 66 XM_B_Phish66 4715 2.04 5.04 1.63 67 BAYES_95 4714 2.64 5.04 2.31 68 SpammyFromTLD_01 4633 1.27 4.95 0.77 69 XMNumbers 4622 2.83 4.94 2.55 70 XM_B_SpammyTLD 4616 2.01 4.93 1.61 71 MIME_HTML_MOSTLY 4594 2.23 4.91 1.87 72 RCVD_IN_MSPIKE_L5 4090 0.64 4.37 0.13 73 XM_DIRTYINTL 3989 0.95 4.26 0.50 74 ALL_TRUSTED 3877 24.20 4.14 26.93 75 T_REMOTE_IMAGE 3832 2.90 4.09 2.74 76 TR_XM_MaxWHORU 3731 0.52 3.99 0.05 77 KHOP_HELO_FCRDNS 3720 1.86 3.97 1.57 78 XM_UB99 3675 0.47 3.93 0.00 79 TR_XM_MaxSPIKE 3674 0.51 3.92 0.05 80 HTML_MIME_NO_HTML_TAG 3435 2.46 3.67 2.30 81 RCVD_IN_MSPIKE_H4 3323 7.70 3.55 8.26 82 XM_OfRef6 3306 1.24 3.53 0.93 83 T_XMDrugObfuBody_08 3260 1.52 3.48 1.26 84 TR_XM_UnparsRelay 3192 0.84 3.41 0.49 85 TR_LOTS_OF_MONEY3 3188 0.91 3.41 0.56 86 XM_URI_RBL 3096 0.56 3.31 0.18 87 HTML_IMAGE_RATIO_06 3054 3.23 3.26 3.22 88 FROM_SUSPICIOUS_NTLD 3036 0.42 3.24 0.03 89 FROM_SUSPICIOUS_NTLD_FP 3000 0.41 3.20 0.03 90 FROM_EXCESS_BASE64 2982 2.09 3.19 1.94 91 TR_XM_COVIDMETA1 2981 0.79 3.18 0.46 92 URIBL_SBL_A 2981 0.56 3.18 0.20 93 TM2_M_URI_OPT_OUT 2910 17.04 3.11 18.94 94 RELAYCOUNTRY_FR 2840 0.58 3.03 0.24 95 MIME_QP_LONG_LINE 2788 4.71 2.98 4.95 96 XMDiploma_00 2718 1.89 2.90 1.75 97 HTML_TAG_BALANCE_CENTER 2667 0.40 2.85 0.07 98 XM_UB999 2666 0.34 2.85 0.00 99 SUBJ_ALL_CAPS 2599 1.30 2.78 1.10 100 RCVD_IN_PSBL 2584 0.33 2.76 0.00 101 T_XMDrugObfuBody_14 2560 1.51 2.73 1.34 102 BODY_URI_ONLY 2454 0.35 2.62 0.04 103 XMBrknScrpt_02 2338 0.93 2.50 0.72 104 MPART_ALT_DIFF_COUNT 2337 0.54 2.50 0.28 105 TR_XM_PHPDW 2319 0.63 2.48 0.38 106 PDS_OTHER_BAD_TLD 2296 0.54 2.45 0.28 107 T_TooManySym_01 2293 3.56 2.45 3.71 108 REPLYTO_WITHOUT_TO_CC 2291 0.45 2.45 0.18 109 TR_XM_PHPForged 2280 0.60 2.44 0.35 110 TR_XM_FormFill2 2254 0.60 2.41 0.35 111 TR_XM_MaxBayes 2251 0.31 2.40 0.02 112 XM_H_PHPOS 2240 0.59 2.39 0.35 113 XMSexyCombo_01 2202 1.00 2.35 0.81 114 XM_UB80 2165 0.31 2.31 0.04 115 TM2_M_VERY_LONG_WORD 2153 1.15 2.30 0.99 116 URI_HEX 2060 1.61 2.20 1.53 117 PDS_FROM_NAME_TO_DOMAIN 2049 0.37 2.19 0.12 118 PDS_FRNOM_TODOM_NAKED_TO 2048 0.37 2.19 0.12 119 TR_XM_DK_SendGrid 2015 2.93 2.15 3.03 120 HTML_IMAGE_RATIO_08 1997 1.80 2.13 1.75 121 MISSING_HEADERS 1955 0.65 2.09 0.46 122 HDRS_MISSP 1947 0.27 2.08 0.03 123 XM_UB60 1945 0.33 2.08 0.10 124 DKIM_ADSP_NXDOMAIN 1944 0.60 2.08 0.40 125 T_XMHurry_00 1924 0.86 2.06 0.69 126 FROM_ADDR_WS 1917 0.36 2.05 0.13 127 BAYES_40 1911 4.14 2.04 4.43 128 TO_IN_SUBJ 1892 0.37 2.02 0.15 129 XM_B_Unsub2 1888 4.40 2.02 4.72 130 TR_XM_RelayPhish 1880 0.35 2.01 0.13 131 DKIM_ADSP_CUSTOM_MED 1827 1.06 1.95 0.94 132 MIME_HTML_ONLY_MULTI 1773 2.47 1.89 2.54 133 URI_TRY_3LD 1773 1.20 1.89 1.11 134 T_FILL_THIS_FORM_SHORT 1716 0.75 1.83 0.61 135 TR_Mismatch_TLD_01 1705 0.42 1.82 0.23 136 NML_ADSP_CUSTOM_MED 1668 0.75 1.78 0.61 137 XM_CamelCaseFrm001 1588 1.78 1.70 1.79 138 DIET_1 1575 0.58 1.68 0.43 139 TR_Symld_Words 1568 1.84 1.67 1.86 140 RELAYCOUNTRY_DE 1558 0.54 1.66 0.38 141 XMHTML_After_End 1528 0.99 1.63 0.91 142 RELAYCOUNTRY_GB 1513 0.89 1.62 0.80 143 BASE64_LENGTH_79_INF 1489 0.51 1.59 0.37 144 MAILING_LIST_MULTI 1477 1.81 1.58 1.84 145 TVD_SPACE_RATIO_MINFP 1473 0.20 1.57 0.01 146 BAYES_20 1441 4.60 1.54 5.02 147 FORGED_GMAIL_RCVD 1416 0.60 1.51 0.47 148 XMSubNoVowel 1409 1.05 1.51 0.99 149 XMGenDplmaNmb 1339 0.93 1.43 0.86 150 XMSubMetaSxObfu_02 1329 0.43 1.42 0.29 151 XM_OfRef7 1285 0.24 1.37 0.08 152 TR_MetaPhish_Combo_01 1283 0.76 1.37 0.68 153 HK_RANDOM_REPLYTO 1282 0.33 1.37 0.19 154 T_XMDrugObfuBody_00 1279 1.92 1.37 1.99 155 XMStockSpam_06 1266 0.80 1.35 0.73 156 XM_BadFromFormat 1265 0.26 1.35 0.11 157 XM_UB95 1264 0.18 1.35 0.02 158 HTML_FONT_TINY_NORDNS 1252 0.45 1.34 0.32 159 XM_RXBody 1246 0.62 1.33 0.52 160 RDNS_DYNAMIC 1243 0.42 1.33 0.30 161 XM_H_Long_From02 1190 1.10 1.27 1.08 162 XM_DK_Undo_01 1183 1.30 1.26 1.30 163 RCVD_IN_RP_SAFE 1183 5.75 1.26 6.36 164 XM_PDF 1162 3.17 1.24 3.43 165 DATE_IN_PAST_03_06 1159 0.77 1.24 0.71 166 LONG_JUNK_URI 1154 0.19 1.23 0.05 167 RELAYCOUNTRY_NL 1153 0.28 1.23 0.15 168 XM_ShortIntro_01 1152 0.52 1.23 0.43 169 FUZZY_BITCOIN 1149 0.15 1.23 0.00 170 RELAYCOUNTRY_JP 1118 0.16 1.19 0.02 171 XMBody_78 1111 0.56 1.19 0.47 172 XM_H_MailChimp 1094 0.31 1.17 0.20 173 XM_H_PHPMailer 1083 0.53 1.16 0.44 174 BAYES_00 1081 18.16 1.15 20.48 175 NO_FM_NAME_IP_HOSTN 1080 0.14 1.15 0.00 176 XM_SPF_Unknown 1069 0.57 1.14 0.49 177 XMMoneyMeta_00 1053 0.70 1.12 0.65 178 T_Symld_Words_02 1050 0.52 1.12 0.44 179 SUSP_UTF8_WORD_MANY 1047 0.14 1.12 0.00 180 HK_SCAM 1028 0.14 1.10 0.01 181 XMPhish14 1026 0.61 1.10 0.55 182 LongTLD 1025 0.28 1.09 0.17 183 LOADSA_MONEY_COMBO 1019 0.19 1.09 0.07 184 XMSubMetaI_00 1005 0.71 1.07 0.66 185 XM_HighProb1 1002 0.14 1.07 0.01 186 XM_H_Undi_Recip 994 0.26 1.06 0.15 187 URIBL_BLACK 992 0.15 1.06 0.03 188 REMOVE_BEFORE_LINK 987 0.40 1.05 0.31 189 MIME_CHARSET_FARAWAY 984 0.21 1.05 0.09 190 DATE_IN_PAST_06_12 973 0.28 1.04 0.17 191 RCVD_IN_IADB_LISTED 972 3.84 1.04 4.22 192 XMSlimDrugH 972 0.35 1.04 0.26 193 HTTPS_HTTP_MISMATCH 967 0.61 1.03 0.56 194 PDS_FROM_2_EMAILS 956 0.15 1.02 0.03 195 TR_XM_SpoofStaff 953 0.18 1.02 0.07 196 TR_LOTS_OF_MONEY2 947 0.32 1.01 0.23 197 T_MONEY_PERCENT 947 0.32 1.01 0.23 198 URI_PHP_REDIR 940 0.16 1.00 0.04 199 XMReplyNow 939 0.21 1.00 0.10 200 XM_JunkDunk 934 0.12 1.00 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 677322 98.33 97.27 98.48 2 HTML_MESSAGE 518018 77.25 91.51 75.31 3 RELAYCOUNTRY_US 478663 69.67 70.25 69.59 4 DKIM_SIGNED 445730 66.14 75.99 64.80 5 XM_DK_Pass 438831 64.85 72.51 63.80 6 DKIM_VALID 412605 59.78 58.23 59.99 7 XM_B_Unicode 400043 59.98 73.31 58.16 8 BAYES_50 313963 44.45 35.68 45.65 9 DKIM_VALID_AU 313303 44.92 40.29 45.55 10 XMListUnsubscribeExists 302782 46.34 63.41 44.02 11 XM_B_Unicode3 235063 34.81 39.45 34.18 12 ALL_TRUSTED 185228 24.20 4.14 26.93 13 T_TM2_M_HEADER_IN_MSG 165343 23.52 19.72 24.04 14 DKIM_VALID_EF 161525 23.64 24.79 23.48 15 HTML_FONT_LOW_CONTRAST 155414 23.00 25.95 22.60 16 RCVD_IN_MSPIKE_WL 154115 20.78 8.81 22.41 17 BAYES_00 140853 18.16 1.15 20.48 18 LOC_TINY_FONT_1 139308 21.40 29.81 20.25 19 RCVD_IN_MSPIKE_H2 138710 20.80 25.47 20.17 20 FVGT_m_MULTI_ODD 131479 20.07 27.04 19.12 21 TM2_M_URI_OPT_OUT 130275 17.04 3.11 18.94 22 ANY_BOUNCE_MESSAGE 128165 16.52 0.98 18.63 23 BOUNCE_MESSAGE 128160 16.52 0.98 18.63 24 XMSubLong 126379 19.00 23.56 18.37 25 XM_Multi_Part_URI 126325 18.41 18.71 18.37 26 MIME_HTML_ONLY 117286 18.83 31.90 17.05 27 T_KAM_HTML_FONT_INVALID 107672 16.27 20.79 15.65 28 RCVD_IN_MSPIKE_H3 87709 11.84 5.11 12.75 29 XM_Body_Dirty_Words 77597 12.43 20.87 11.28 30 XM_B_Unsub 76618 11.23 11.86 11.14 31 XM_DK_Undo_02 69749 15.12 51.72 10.14 32 RCVD_IN_MSPIKE_H4 56825 7.70 3.55 8.26 33 LotsOfNums_01 52688 7.75 8.39 7.66 34 IN_ZIMBRA_NJ_WHITELIST 50933 6.52 0.05 7.41 35 XM_Evil_Numbers_Gen 50554 7.72 10.47 7.35 36 TooManyTo_001 47532 6.85 6.38 6.91 37 BAYES_99 46508 10.59 38.70 6.76 38 TR_XM_DK_Bayes 45147 5.85 0.64 6.56 39 LOTS_OF_MONEY 43756 7.56 16.34 6.36 40 RCVD_IN_RP_SAFE 43732 5.75 1.26 6.36 41 XM_B_Phish_Phrases 43124 6.96 12.07 6.27 42 HTML_IMAGE_RATIO_02 42749 6.64 9.73 6.22 43 TR_XM_DK_Bayes1 42099 5.43 0.37 6.12 44 UNPARSEABLE_RELAY 41539 6.13 6.81 6.04 45 RCVD_IN_RP_CERTIFIED 41143 5.34 0.66 5.98 46 BAYES_05 40090 5.22 0.76 5.83 47 BAYES_60 39550 5.88 6.87 5.75 48 TR_XM_DK_Bayes2 37625 4.85 0.29 5.47 49 XM_DKIMWhitelistDomains 37483 4.80 0.01 5.45 50 BAYES_999 37449 8.36 29.78 5.44 51 XM_SendGrid 37156 5.42 5.53 5.40 52 BAYES_20 34535 4.60 1.54 5.02 53 MIME_QP_LONG_LINE 34018 4.71 2.98 4.95 54 HTML_IMAGE_RATIO_04 33575 5.01 5.97 4.88 55 DKIM_INVALID 33125 6.37 17.76 4.82 56 XM_H_Long_From01 32901 4.96 6.28 4.78 57 XM_B_Unsub2 32477 4.40 2.02 4.72 58 BOTNET_IPINHOSTNAME 30913 6.08 17.69 4.49 59 BAYES_40 30436 4.14 2.04 4.43 60 RELAYCOUNTRY_META 30415 7.10 26.77 4.42 61 XMStrtUSub 29691 4.44 5.38 4.32 62 RCVD_IN_IADB_LISTED 29014 3.84 1.04 4.22 63 MPART_ALT_DIFF 27130 4.39 7.66 3.94 64 BAYES_80 25969 4.31 8.22 3.78 65 RCVD_IN_IADB_SPF 25550 3.38 0.89 3.71 66 T_TooManySym_01 25533 3.56 2.45 3.71 67 XM_PDF 23583 3.17 1.24 3.43 68 RCVD_IN_IADB_SENDERID 22589 2.99 0.85 3.28 69 RCVD_IN_IADB_DK 22323 2.96 0.85 3.25 70 HTML_IMAGE_RATIO_06 22160 3.23 3.26 3.22 71 XMSubMetaSx_00 22010 3.71 7.48 3.20 72 TR_XM_DK_SendGrid 20850 2.93 2.15 3.03 73 TR_XM_PhishingBody 20756 3.62 8.07 3.02 74 BOTNET 20071 6.41 32.10 2.92 75 XMSexyCombo_05 19689 3.94 11.83 2.86 76 T_REMOTE_IMAGE 18823 2.90 4.09 2.74 77 NO_DNS_FOR_FROM 18738 4.01 13.48 2.72 78 XMNumbers 17509 2.83 4.94 2.55 79 MIME_HTML_ONLY_MULTI 17496 2.47 1.89 2.54 80 RCVD_IN_IADB_VOUCHED 17280 2.25 0.34 2.51 81 XM_UncommonTLD01 17248 4.08 15.60 2.51 82 XM_H_Trusted_IP 16199 2.07 0.00 2.36 83 BAYES_95 15894 2.64 5.04 2.31 84 HTML_MIME_NO_HTML_TAG 15822 2.46 3.67 2.30 85 T_XMDrugObfuBody_00 13707 1.92 1.37 1.99 86 FROM_EXCESS_BASE64 13346 2.09 3.19 1.94 87 MIME_HTML_MOSTLY 12830 2.23 4.91 1.87 88 TR_Symld_Words 12816 1.84 1.67 1.86 89 MAILING_LIST_MULTI 12629 1.81 1.58 1.84 90 XM_CamelCaseFrm001 12318 1.78 1.70 1.79 91 T_TooManySym_02 12157 1.63 0.59 1.77 92 XMDiploma_00 12068 1.89 2.90 1.75 93 HTML_IMAGE_RATIO_08 12040 1.80 2.13 1.75 94 UNTRUSTED_Relay 11609 3.57 17.40 1.69 95 XM_B_Phish66 11235 2.04 5.04 1.63 96 XM_B_SpammyTLD 11077 2.01 4.93 1.61 97 RCVD_IN_IADB_OPTIN 11030 1.45 0.29 1.60 98 XM_SPF_SoftFail 11015 2.13 6.01 1.60 99 RELAYCOUNTRY_CA 10827 2.39 8.39 1.57 100 KHOP_HELO_FCRDNS 10809 1.86 3.97 1.57 101 TVD_RCVD_IP 10652 1.44 0.68 1.55 102 XM_B_COVIDMETA 10571 2.16 6.71 1.54 103 URI_HEX 10500 1.61 2.20 1.53 104 TooManyTo_002 10406 1.44 0.89 1.51 105 RCVD_IN_MSPIKE_H5 9581 1.24 0.14 1.39 106 T_XMDrugObfuBody_14 9240 1.51 2.73 1.34 107 XM_DK_Undo_01 8968 1.30 1.26 1.30 108 T_XMDrugObfuBody_08 8655 1.52 3.48 1.26 109 HELO_NODOT 8164 1.16 0.99 1.19 110 HELO_NO_DOMAIN 8162 1.16 0.99 1.19 111 HELO_MISC_IP 7732 1.06 0.62 1.12 112 CK_HELO_DYNAMIC_SPLIT_IP 7727 1.06 0.60 1.12 113 URI_TRY_3LD 7638 1.20 1.89 1.11 114 SUBJ_ALL_CAPS 7598 1.30 2.78 1.10 115 IN_HORDE_ADDRESS_BOOK 7534 0.99 0.19 1.10 116 XM_H_Long_From02 7430 1.10 1.27 1.08 117 INVALID_MSGID 7277 1.00 0.56 1.06 118 XM_GoogleGroups 6998 0.96 0.50 1.02 119 TM2_M_VERY_LONG_WORD 6840 1.15 2.30 0.99 120 TooManyTo_003 6821 0.95 0.64 0.99 121 XMSubNoVowel 6813 1.05 1.51 0.99 122 XMGappySubj_01 6709 0.88 0.17 0.98 123 RCVD_IN_BL_SPAMCOP_NET 6694 1.68 6.88 0.97 124 TO_MALFORMED 6672 0.86 0.04 0.97 125 USER_IN_DEF_DKIM_WL 6631 0.85 0.01 0.96 126 DKIM_ADSP_CUSTOM_MED 6486 1.06 1.95 0.94 127 XM_ProductURIs 6406 0.91 0.79 0.93 128 XM_OfRef6 6377 1.24 3.53 0.93 129 XMBody_17 6238 1.46 5.56 0.91 130 XMHTML_After_End 6227 0.99 1.63 0.91 131 XM_UB50 6078 1.54 6.33 0.88 132 XMCapTrack 5943 0.81 0.45 0.86 133 XMGenDplmaNmb 5942 0.93 1.43 0.86 134 HTML_FONT_FACE_BAD 5938 0.85 0.75 0.86 135 XMSexyCombo_01 5600 1.00 2.35 0.81 136 XMBdyGiftCard01 5546 0.81 0.83 0.81 137 RELAYCOUNTRY_GB 5474 0.89 1.62 0.80 138 SpammyFromTLD_01 5320 1.27 4.95 0.77 139 TooManyTo_004 5135 0.72 0.51 0.75 140 T_TooManySym_03 5007 0.66 0.17 0.73 141 XMStockSpam_06 4999 0.80 1.35 0.73 142 XMBrknScrpt_02 4955 0.93 2.50 0.72 143 DATE_IN_PAST_03_06 4867 0.77 1.24 0.71 144 T_XMHurry_00 4776 0.86 2.06 0.69 145 TR_MetaPhish_Combo_01 4654 0.76 1.37 0.68 146 T_OBFU_PDF_ATTACH 4573 0.60 0.15 0.66 147 XMSubMetaI_00 4539 0.71 1.07 0.66 148 TR_MSPIKEBAYES00 4511 0.58 0.01 0.66 149 XMMoneyMeta_00 4443 0.70 1.12 0.65 150 RCVD_IN_MSPIKE_BL 4406 1.78 10.11 0.64 151 TR_XM_COVIDMETA4 4261 1.15 5.04 0.62 152 NML_ADSP_CUSTOM_MED 4230 0.75 1.78 0.61 153 T_FILL_THIS_FORM_SHORT 4168 0.75 1.83 0.61 154 TooManyTo_005 4165 0.59 0.45 0.61 155 TR_LOTS_OF_MONEY3 3886 0.91 3.41 0.56 156 HTTPS_HTTP_MISMATCH 3837 0.61 1.03 0.56 157 XMPhish14 3758 0.61 1.10 0.55 158 TR_BOTNET_NEGATE 3632 0.55 0.70 0.53 159 XM_RXBody 3585 0.62 1.33 0.52 160 XM_DIRTYINTL 3453 0.95 4.26 0.50 161 XMHTMLBadTable_001 3419 0.49 0.46 0.50 162 TR_XM_UnparsRelay 3386 0.84 3.41 0.49 163 XM_SPF_Unknown 3379 0.57 1.14 0.49 164 XMBody_95 3322 0.44 0.08 0.48 165 FORGED_GMAIL_RCVD 3266 0.60 1.51 0.47 166 XMBody_78 3259 0.56 1.19 0.47 167 RCVD_IN_MSPIKE_L3 3257 1.05 5.26 0.47 168 TR_XM_COVIDMETA1 3185 0.79 3.18 0.46 169 MISSING_HEADERS 3142 0.65 2.09 0.46 170 XMNoVowels 3129 0.51 0.90 0.45 171 XMPhish30 3069 0.50 0.93 0.45 172 XM_H_PHPMailer 3052 0.53 1.16 0.44 173 FROM_GOV_DKIM_AU 3006 0.40 0.09 0.44 174 T_Symld_Words_02 3002 0.52 1.12 0.44 175 DIET_1 2951 0.58 1.68 0.43 176 XM_ShortIntro_01 2944 0.52 1.23 0.43 177 HTML_TAG_BALANCE_BODY 2802 0.43 0.57 0.41 178 DKIM_ADSP_NXDOMAIN 2762 0.60 2.08 0.40 179 T_TooManySym_04 2675 0.35 0.08 0.39 180 XM_B_REG_HTML 2658 0.37 0.29 0.39 181 FROM_GOV_SPOOF 2650 0.36 0.19 0.39 182 SHORT_HELO_AND_INLINE_IMAGE 2639 0.35 0.08 0.38 183 RELAYCOUNTRY_DE 2631 0.54 1.66 0.38 184 TR_XM_PHPDW 2630 0.63 2.48 0.38 185 XM_B_COPY_HTML 2592 0.38 0.39 0.38 186 XMPhish08 2546 0.44 0.97 0.37 187 BASE64_LENGTH_79_INF 2514 0.51 1.59 0.37 188 HTML_IMAGE_ONLY_20 2495 0.42 0.84 0.36 189 RELAYCOUNTRY_AU 2471 0.40 0.70 0.36 190 LOW_PRICE 2458 0.39 0.66 0.36 191 TR_XM_FormFill2 2426 0.60 2.41 0.35 192 TR_XM_PHPForged 2425 0.60 2.44 0.35 193 PLING_QUERY 2405 0.36 0.41 0.35 194 XM_H_PHPOS 2388 0.59 2.39 0.35 195 TM2_M_A_HREF_HREF 2384 0.39 0.68 0.35 196 XMLngstWrd_00 2281 0.39 0.84 0.33 197 XM_S_SubURI 2262 0.30 0.08 0.33 198 HTML_FONT_TINY_NORDNS 2230 0.45 1.34 0.32 199 XM_Body_Obfu01 2168 0.39 0.96 0.32 200 HTML_IMAGE_ONLY_28 2163 0.34 0.57 0.31 ----------------------------------------------------------------------