Email: 527871 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 1.42 sec Spam: 58128 Autolearn: 0 AvgScore: 12.62 AvgScanTime: 3.42 sec Ham: 469743 Autolearn: 0 AvgScore: -1.70 AvgScanTime: 1.17 sec Time Spent Running SA: 207.66 hours Time Spent Processing Spam: 55.14 hours Time Spent Processing Ham: 152.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 57045 99.19 98.14 99.32 2 HTML_MESSAGE 51269 62.60 88.20 59.43 3 DKIM_SIGNED 43119 56.95 74.18 54.82 4 XM_B_Unicode 43025 52.74 74.02 50.11 5 XM_DK_Pass 41692 56.04 71.72 54.10 6 XMListUnsubscribeExists 39036 43.13 67.16 40.16 7 RELAYCOUNTRY_US 38576 57.34 66.36 56.22 8 DKIM_VALID 35532 52.83 61.13 51.80 9 XM_DK_Undo_02 31860 15.37 54.81 10.49 10 BAYES_99 24145 11.24 41.54 7.49 11 DKIM_VALID_AU 24026 41.18 41.33 41.16 12 XM_B_Unicode3 22691 31.60 39.04 30.68 13 BAYES_50 19392 34.16 33.36 34.26 14 BAYES_999 18895 8.96 32.51 6.05 15 RELAYCOUNTRY_META 18865 7.02 32.45 3.88 16 LOC_TINY_FONT_1 18495 21.47 31.82 20.19 17 BOTNET 18436 5.56 31.72 2.32 18 MIME_HTML_ONLY 17779 18.23 30.59 16.70 19 FVGT_m_MULTI_ODD 16310 17.37 28.06 16.04 20 DKIM_VALID_EF 14648 19.18 25.20 18.43 21 RCVD_IN_MSPIKE_H2 14464 17.83 24.88 16.96 22 HTML_FONT_LOW_CONTRAST 13625 22.39 23.44 22.26 23 XM_Multi_Part_URI 12256 25.45 21.08 25.99 24 UNTRUSTED_Relay 12002 3.85 20.65 1.78 25 XMSubLong 11982 15.80 20.61 15.21 26 XM_Body_Dirty_Words 11305 11.56 19.45 10.58 27 LOTS_OF_MONEY 11168 7.89 19.21 6.48 28 BOTNET_IPINHOSTNAME 10901 6.28 18.75 4.74 29 T_TM2_M_HEADER_IN_MSG 10835 15.23 18.64 14.81 30 T_KAM_HTML_FONT_INVALID 10296 12.12 17.71 11.43 31 XM_UncommonTLD01 10141 4.03 17.45 2.37 32 RCVD_IN_MSPIKE_BL 8902 2.35 15.31 0.75 33 DKIM_INVALID 7587 4.12 13.05 3.02 34 HTML_IMAGE_RATIO_02 6643 7.41 11.43 6.91 35 XMSexyCombo_05 6623 4.71 11.39 3.88 36 RCVD_IN_BL_SPAMCOP_NET 6490 2.27 11.17 1.17 37 RELAYCOUNTRY_CA 6398 2.70 11.01 1.67 38 XM_B_Unsub 6194 7.88 10.66 7.54 39 NO_DNS_FOR_FROM 5953 2.75 10.24 1.83 40 LotsOfNums_01 5663 6.46 9.74 6.06 41 XM_B_Phish_Phrases 5456 5.24 9.39 4.72 42 RCVD_IN_RP_RNBL 5434 1.10 9.35 0.08 43 RCVD_IN_MSPIKE_WL 5138 18.44 8.84 19.63 44 XMBrknScrpt_02 5123 1.81 8.81 0.94 45 XM_UB50 4847 1.62 8.34 0.79 46 BAYES_80 4754 4.13 8.18 3.62 47 XMSubMetaSx_00 4714 4.06 8.11 3.56 48 RCVD_IN_MSPIKE_L5 4520 1.01 7.78 0.17 49 XM_Evil_Numbers_Gen 4359 6.75 7.50 6.65 50 BAYES_60 4347 5.27 7.48 4.99 51 MPART_ALT_DIFF 4242 3.87 7.30 3.44 52 XMBody_17 4218 1.61 7.26 0.91 53 BOTNET_NORDNS 3973 0.76 6.83 0.01 54 XM_SPF_SoftFail 3834 1.60 6.60 0.98 55 RCVD_IN_MSPIKE_L3 3803 1.22 6.54 0.56 56 TooManyTo_001 3595 4.77 6.18 4.60 57 TR_XM_PhishingBody 3471 2.60 5.97 2.18 58 SpammyFromTLD_01 3389 0.99 5.83 0.39 59 UNPARSEABLE_RELAY 3247 5.85 5.59 5.89 60 XM_B_SpammyTLD 3197 1.81 5.50 1.36 61 RCVD_IN_PSBL 3105 0.60 5.34 0.02 62 XM_DIRTYINTL 3043 1.00 5.23 0.48 63 RCVD_IN_MSPIKE_H3 3043 10.90 5.23 11.60 64 URIBL_SBL_A 3037 0.74 5.22 0.19 65 TR_XM_MaxSPIKE 2954 0.64 5.08 0.09 66 T_REMOTE_IMAGE 2953 2.84 5.08 2.56 67 HTML_IMAGE_RATIO_08 2877 1.90 4.95 1.52 68 XM_H_Long_From01 2801 3.82 4.82 3.70 69 BAYES_95 2619 2.64 4.51 2.41 70 FROM_EXCESS_BASE64 2596 3.31 4.47 3.17 71 XM_SendGrid 2453 5.05 4.22 5.16 72 TR_XM_INV_DKIM 2415 0.65 4.15 0.22 73 TR_XM_MaxBayes 2358 0.47 4.06 0.02 74 KHOP_HELO_FCRDNS 2357 1.26 4.05 0.91 75 XMNumbers 2306 2.85 3.97 2.71 76 HTML_MIME_NO_HTML_TAG 2289 1.45 3.94 1.15 77 MPART_ALT_DIFF_COUNT 2138 0.62 3.68 0.25 78 XM_B_Phish66 2136 1.25 3.67 0.95 79 HTML_IMAGE_RATIO_04 2104 4.28 3.62 4.37 80 SUBJ_ALL_CAPS 2089 1.18 3.59 0.88 81 RCVD_IN_MSPIKE_H4 2048 6.50 3.52 6.86 82 TVD_SPACE_RATIO_MINFP 2043 0.39 3.51 0.01 83 XM_BadFromFormat 2005 0.49 3.45 0.12 84 MIME_HTML_MOSTLY 1981 1.98 3.41 1.80 85 XM_UB99 1980 0.38 3.41 0.01 86 TR_LOTS_OF_MONEY3 1974 1.04 3.40 0.75 87 TR_XM_PHPDW 1928 0.62 3.32 0.29 88 DATE_IN_PAST_03_06 1901 0.45 3.27 0.10 89 TR_XM_PHPForged 1888 0.59 3.25 0.26 90 XMStrtUSub 1886 2.99 3.24 2.95 91 TR_XM_FormFill2 1867 0.59 3.21 0.26 92 XM_H_PHPOS 1860 0.58 3.20 0.26 93 TR_XM_UnparsRelay 1854 0.78 3.19 0.48 94 TR_XM_MaxWHORU 1849 0.39 3.18 0.05 95 TR_Mismatch_TLD_01 1795 0.50 3.09 0.18 96 TM2_M_VERY_LONG_WORD 1788 1.17 3.08 0.93 97 TM2_M_URI_OPT_OUT 1767 31.58 3.04 35.11 98 URI_TRY_3LD 1753 1.42 3.02 1.22 99 XM_OfRef6 1749 1.12 3.01 0.88 100 SpammyFromTLD_02 1737 0.47 2.99 0.15 101 XM_B_COVIDMETA 1685 0.88 2.90 0.63 102 XMSexyCombo_01 1662 1.28 2.86 1.08 103 XM_UB80 1646 0.34 2.83 0.03 104 HTML_IMAGE_RATIO_06 1634 2.70 2.81 2.69 105 TR_XM_COVIDMETA4 1618 0.61 2.78 0.34 106 XM_UB60 1609 0.39 2.77 0.09 107 MISSING_HEADERS 1513 0.70 2.60 0.46 108 ALL_TRUSTED 1504 36.20 2.59 40.36 109 BILLION_DOLLARS 1433 0.33 2.47 0.06 110 URI_HEX 1387 1.46 2.39 1.34 111 RELAYCOUNTRY_FR 1375 0.44 2.37 0.20 112 XM_UB999 1373 0.26 2.36 0.00 113 PDS_BTC_ID 1369 0.27 2.36 0.02 114 REPLYTO_WITHOUT_TO_CC 1357 0.51 2.33 0.29 115 T_TooManySym_01 1346 3.92 2.32 4.11 116 XM_URI_RBL 1270 0.37 2.18 0.15 117 BITCOIN_SPAM_03 1259 0.24 2.17 0.00 118 OBFU_BITCOIN 1259 0.24 2.17 0.00 119 FUZZY_BITCOIN 1259 0.24 2.17 0.00 120 PDS_OTHER_BAD_TLD 1253 0.55 2.16 0.35 121 NO_FM_NAME_IP_HOSTN 1240 0.24 2.13 0.00 122 BODY_URI_ONLY 1229 0.27 2.11 0.04 123 BASE64_LENGTH_79_INF 1200 0.49 2.06 0.29 124 PDS_FROM_2_EMAILS 1190 0.24 2.05 0.01 125 TR_XM_RelayPhish 1188 0.33 2.04 0.11 126 FROM_2_EMAILS_SHORT 1171 0.23 2.01 0.01 127 SUSP_UTF8_WORD_MANY 1160 0.22 2.00 0.00 128 T_XMHurry_00 1139 0.75 1.96 0.60 129 MIME_HTML_ONLY_MULTI 1129 2.11 1.94 2.14 130 LONG_JUNK_URI 1123 0.25 1.93 0.05 131 XM_CamelCaseFrm001 1114 1.65 1.92 1.62 132 PDS_TO_EQ_FROM_NAME 1111 0.22 1.91 0.01 133 BAYES_40 1107 3.01 1.90 3.15 134 T_XMDrugObfuBody_14 1105 1.17 1.90 1.08 135 XMLngstWrd_00 1065 0.38 1.83 0.20 136 RELAYCOUNTRY_NL 1051 0.34 1.81 0.16 137 XMBdyGiftCard01 1048 1.09 1.80 1.00 138 T_XMDrugObfuBody_08 1047 1.13 1.80 1.04 139 T_FILL_THIS_FORM_SHORT 1041 0.54 1.79 0.39 140 FROM_SUSPICIOUS_NTLD 1029 0.22 1.77 0.03 141 MIME_CHARSET_FARAWAY 1028 0.26 1.77 0.07 142 XMSubNoVowel 1024 0.94 1.76 0.84 143 MIME_QP_LONG_LINE 1015 2.92 1.75 3.07 144 FROM_SUSPICIOUS_NTLD_FP 995 0.21 1.71 0.02 145 RELAYCOUNTRY_JP 992 0.21 1.71 0.02 146 XMLngstWrd_01 989 0.33 1.70 0.16 147 LongTLD 984 0.27 1.69 0.10 148 XMStockSpam_06 981 1.18 1.69 1.12 149 XM_DK_Undo_01 979 1.00 1.68 0.91 150 XMDiploma_00 978 0.96 1.68 0.87 151 CHARSET_FARAWAY_HEADER 978 0.20 1.68 0.02 152 TR_XM_SpoofStaff 978 0.27 1.68 0.10 153 XMSpoofStaff2 969 0.27 1.67 0.10 154 TVD_SPACE_RATIO 967 0.39 1.66 0.23 155 XM_B_Unsub2 963 1.14 1.66 1.08 156 TR_Caps_n_Bayes_99 961 0.29 1.65 0.13 157 XM_UB95 960 0.20 1.65 0.02 158 HTML_TAG_BALANCE_CENTER 954 0.28 1.64 0.11 159 BOGUS_MIME_VERSION 944 0.18 1.62 0.00 160 XMSlimDrugH 943 0.46 1.62 0.31 161 DATE_IN_PAST_06_12 935 0.36 1.61 0.21 162 TR_XM_DK_SendGrid 915 2.91 1.57 3.08 163 RELAYCOUNTRY_GB 908 0.64 1.56 0.53 164 TR_Sbj_FN_Bdy 902 0.25 1.55 0.09 165 XM_H_PHPMailer 897 0.45 1.54 0.31 166 XM_H_SpoofStaff4 883 0.26 1.52 0.10 167 TR_XM_PSC1 883 0.25 1.52 0.10 168 BAYES_20 878 3.89 1.51 4.18 169 XMSubEmpty 870 0.27 1.50 0.12 170 DKIM_ADSP_CUSTOM_MED 860 0.72 1.48 0.63 171 HDRS_MISSP 849 0.22 1.46 0.06 172 HTML_FONT_TINY_NORDNS 842 0.34 1.45 0.20 173 TR_XM_COVIDMETA1 828 0.51 1.42 0.40 174 DKIM_ADSP_NXDOMAIN 804 0.64 1.38 0.55 175 SHORT_URI_3 803 0.21 1.38 0.07 176 HK_RANDOM_FROM 801 0.22 1.38 0.08 177 NML_ADSP_CUSTOM_MED 798 0.54 1.37 0.44 178 MAILING_LIST_MULTI 797 1.19 1.37 1.17 179 RCVD_IN_RP_SAFE 791 6.48 1.36 7.11 180 DEAR_FRIEND 780 0.23 1.34 0.09 181 DIET_1 773 0.59 1.33 0.50 182 T_XMDrugObfuBody_00 772 10.13 1.33 11.22 183 XMLngstWrd_02 772 0.25 1.33 0.12 184 XM_RXBody 770 0.69 1.32 0.61 185 XMSexyCombo_04 768 0.75 1.32 0.68 186 XMHTML_After_End 767 0.50 1.32 0.40 187 HK_RANDOM_REPLYTO 766 0.24 1.32 0.11 188 RELAYCOUNTRY_RU 747 0.31 1.29 0.19 189 FORGED_GMAIL_RCVD 741 0.42 1.27 0.31 190 URIBL_BLACK 737 0.15 1.27 0.01 191 NUMERIC_HTTP_ADDR 724 0.44 1.25 0.34 192 XM_H_PHPOS_M 723 0.27 1.24 0.15 193 TR_XM_SpoofStaff2 722 0.14 1.24 0.00 194 RDNS_DYNAMIC 711 0.42 1.22 0.32 195 RELAYCOUNTRY_HU 707 0.15 1.22 0.02 196 SHORT_URI_4 706 0.21 1.21 0.08 197 XMLngstWrd_03 687 0.22 1.18 0.10 198 XMReplyNow 682 0.21 1.17 0.09 199 XMGppyBdWords 677 0.25 1.16 0.14 200 TR_Mismatch_TLD_02 675 0.18 1.16 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 466543 99.19 98.14 99.32 2 HTML_MESSAGE 279188 62.60 88.20 59.43 3 RELAYCOUNTRY_US 264113 57.34 66.36 56.22 4 DKIM_SIGNED 257521 56.95 74.18 54.82 5 XM_DK_Pass 254142 56.04 71.72 54.10 6 DKIM_VALID 243342 52.83 61.13 51.80 7 XM_B_Unicode 235398 52.74 74.02 50.11 8 DKIM_VALID_AU 193333 41.18 41.33 41.16 9 ALL_TRUSTED 189565 36.20 2.59 40.36 10 XMListUnsubscribeExists 188651 43.13 67.16 40.16 11 TM2_M_URI_OPT_OUT 164931 31.58 3.04 35.11 12 BAYES_50 160928 34.16 33.36 34.26 13 ANY_BOUNCE_MESSAGE 160461 30.47 0.67 34.16 14 BOUNCE_MESSAGE 160458 30.47 0.66 34.16 15 BAYES_00 154100 29.27 0.74 32.81 16 XM_B_Unicode3 144121 31.60 39.04 30.68 17 XM_Multi_Part_URI 122064 25.45 21.08 25.99 18 HTML_FONT_LOW_CONTRAST 104553 22.39 23.44 22.26 19 LOC_TINY_FONT_1 94857 21.47 31.82 20.19 20 RCVD_IN_MSPIKE_WL 92218 18.44 8.84 19.63 21 DKIM_VALID_EF 86596 19.18 25.20 18.43 22 RCVD_IN_MSPIKE_H2 79651 17.83 24.88 16.96 23 MIME_HTML_ONLY 78453 18.23 30.59 16.70 24 FVGT_m_MULTI_ODD 75355 17.37 28.06 16.04 25 XMSubLong 71433 15.80 20.61 15.21 26 T_TM2_M_HEADER_IN_MSG 69556 15.23 18.64 14.81 27 RCVD_IN_MSPIKE_H3 54510 10.90 5.23 11.60 28 T_KAM_HTML_FONT_INVALID 53675 12.12 17.71 11.43 29 T_XMDrugObfuBody_00 52710 10.13 1.33 11.22 30 XM_Body_Dirty_Words 49711 11.56 19.45 10.58 31 XM_DK_Undo_02 49290 15.37 54.81 10.49 32 XM_B_Unsub 35427 7.88 10.66 7.54 33 BAYES_99 35183 11.24 41.54 7.49 34 RCVD_IN_RP_SAFE 33410 6.48 1.36 7.11 35 BAYES_05 33312 6.39 0.75 7.09 36 XM_DKIMWhitelistDomains 32764 6.21 0.02 6.97 37 HTML_IMAGE_RATIO_02 32466 7.41 11.43 6.91 38 RCVD_IN_MSPIKE_H4 32244 6.50 3.52 6.86 39 XM_Evil_Numbers_Gen 31256 6.75 7.50 6.65 40 RCVD_IN_RP_CERTIFIED 30938 5.95 0.80 6.59 41 LOTS_OF_MONEY 30457 7.89 19.21 6.48 42 LotsOfNums_01 28445 6.46 9.74 6.06 43 BAYES_999 28415 8.96 32.51 6.05 44 UNPARSEABLE_RELAY 27645 5.85 5.59 5.89 45 TR_XM_DK_Bayes 25104 4.81 0.45 5.34 46 XM_SendGrid 24227 5.05 4.22 5.16 47 TR_XM_DK_Bayes1 23852 4.55 0.32 5.08 48 BAYES_60 23455 5.27 7.48 4.99 49 BOTNET_IPINHOSTNAME 22251 6.28 18.75 4.74 50 XM_B_Phish_Phrases 22192 5.24 9.39 4.72 51 TooManyTo_001 21587 4.77 6.18 4.60 52 TR_XM_DK_Bayes2 21582 4.11 0.18 4.59 53 HTML_IMAGE_RATIO_04 20506 4.28 3.62 4.37 54 BAYES_20 19632 3.89 1.51 4.18 55 T_TooManySym_01 19324 3.92 2.32 4.11 56 XMSexyCombo_05 18249 4.71 11.39 3.88 57 RELAYCOUNTRY_META 18216 7.02 32.45 3.88 58 XM_H_Long_From01 17366 3.82 4.82 3.70 59 BAYES_80 17028 4.13 8.18 3.62 60 XMSubMetaSx_00 16706 4.06 8.11 3.56 61 MPART_ALT_DIFF 16179 3.87 7.30 3.44 62 IN_ZIMBRA_NJ_WHITELIST 14953 2.84 0.06 3.18 63 FROM_EXCESS_BASE64 14876 3.31 4.47 3.17 64 BAYES_40 14782 3.01 1.90 3.15 65 TR_XM_DK_SendGrid 14457 2.91 1.57 3.08 66 MIME_QP_LONG_LINE 14401 2.92 1.75 3.07 67 DKIM_INVALID 14179 4.12 13.05 3.02 68 XMStrtUSub 13880 2.99 3.24 2.95 69 RCVD_IN_IADB_LISTED 12781 2.52 0.86 2.72 70 XMNumbers 12717 2.85 3.97 2.71 71 HTML_IMAGE_RATIO_06 12644 2.70 2.81 2.69 72 T_REMOTE_IMAGE 12034 2.84 5.08 2.56 73 BAYES_95 11303 2.64 4.51 2.41 74 XM_UncommonTLD01 11152 4.03 17.45 2.37 75 RCVD_IN_IADB_SPF 11118 2.19 0.76 2.37 76 BOTNET 10892 5.56 31.72 2.32 77 T_TooManySym_02 10327 2.00 0.42 2.20 78 TR_XM_PhishingBody 10232 2.60 5.97 2.18 79 RCVD_IN_IADB_SENDERID 10037 1.98 0.71 2.14 80 MIME_HTML_ONLY_MULTI 10032 2.11 1.94 2.14 81 RCVD_IN_IADB_DK 9741 1.92 0.70 2.07 82 TVD_RCVD_IP 9212 1.80 0.50 1.96 83 NO_DNS_FOR_FROM 8582 2.75 10.24 1.83 84 MIME_HTML_MOSTLY 8459 1.98 3.41 1.80 85 UNTRUSTED_Relay 8338 3.85 20.65 1.78 86 XM_H_Trusted_IP 8010 1.52 0.00 1.71 87 RELAYCOUNTRY_CA 7847 2.70 11.01 1.67 88 RCVD_IN_IADB_VOUCHED 7702 1.49 0.30 1.64 89 XM_CamelCaseFrm001 7620 1.65 1.92 1.62 90 HELO_MISC_IP 7520 1.54 1.06 1.60 91 CK_HELO_DYNAMIC_SPLIT_IP 7515 1.55 1.11 1.60 92 INVALID_MSGID 7345 1.42 0.24 1.56 93 HTML_IMAGE_RATIO_08 7156 1.90 4.95 1.52 94 TO_MALFORMED 6560 1.25 0.11 1.40 95 XM_B_SpammyTLD 6383 1.81 5.50 1.36 96 XM_PDF 6357 1.25 0.43 1.35 97 URI_HEX 6304 1.46 2.39 1.34 98 TR_Symld_Words 5896 1.23 1.07 1.26 99 URI_TRY_3LD 5754 1.42 3.02 1.22 100 MAILING_LIST_MULTI 5490 1.19 1.37 1.17 101 RCVD_IN_BL_SPAMCOP_NET 5489 2.27 11.17 1.17 102 RCVD_IN_MSPIKE_H5 5464 1.04 0.08 1.16 103 HTML_MIME_NO_HTML_TAG 5390 1.45 3.94 1.15 104 XMStockSpam_06 5247 1.18 1.69 1.12 105 IN_HORDE_ADDRESS_BOOK 5123 1.01 0.35 1.09 106 XMSexyCombo_01 5088 1.28 2.86 1.08 107 T_XMDrugObfuBody_14 5075 1.17 1.90 1.08 108 XM_B_Unsub2 5062 1.14 1.66 1.08 109 T_XMDrugObfuBody_08 4907 1.13 1.80 1.04 110 USER_IN_DEF_DKIM_WL 4850 0.92 0.00 1.03 111 XMBdyGiftCard01 4713 1.09 1.80 1.00 112 RCVD_IN_IADB_OPTIN 4667 0.92 0.34 0.99 113 XMGappySubj_01 4595 0.88 0.10 0.98 114 XM_SPF_SoftFail 4588 1.60 6.60 0.98 115 XM_B_Phish66 4483 1.25 3.67 0.95 116 XMBrknScrpt_02 4429 1.81 8.81 0.94 117 TM2_M_VERY_LONG_WORD 4364 1.17 3.08 0.93 118 XM_DK_Undo_01 4296 1.00 1.68 0.91 119 KHOP_HELO_FCRDNS 4280 1.26 4.05 0.91 120 XMBody_17 4276 1.61 7.26 0.91 121 XM_ProductURIs 4205 0.87 0.66 0.90 122 T_TooManySym_03 4167 0.80 0.12 0.89 123 SUBJ_ALL_CAPS 4140 1.18 3.59 0.88 124 XM_OfRef6 4137 1.12 3.01 0.88 125 XMDiploma_00 4069 0.96 1.68 0.87 126 XMSubNoVowel 3939 0.94 1.76 0.84 127 XM_GoogleGroups 3777 0.77 0.46 0.80 128 XM_UB50 3719 1.62 8.34 0.79 129 HTML_FONT_FACE_BAD 3689 0.77 0.63 0.79 130 TooManyTo_002 3667 0.78 0.75 0.78 131 TR_LOTS_OF_MONEY3 3536 1.04 3.40 0.75 132 RCVD_IN_MSPIKE_BL 3512 2.35 15.31 0.75 133 TR_MetaPhish_Combo_01 3445 0.76 0.96 0.73 134 XM_H_Long_From02 3428 0.76 0.98 0.73 135 XMSexyCombo_04 3186 0.75 1.32 0.68 136 DKIM_ADSP_CUSTOM_MED 2951 0.72 1.48 0.63 137 XM_B_COVIDMETA 2936 0.88 2.90 0.63 138 XM_RXBody 2848 0.69 1.32 0.61 139 T_XMHurry_00 2822 0.75 1.96 0.60 140 XMBody_95 2795 0.53 0.04 0.60 141 TR_MSPIKEBAYES00 2770 0.53 0.01 0.59 142 XMSubMetaI_00 2725 0.58 0.54 0.58 143 RCVD_IN_MSPIKE_L3 2634 1.22 6.54 0.56 144 TooManyTo_003 2579 0.54 0.48 0.55 145 DKIM_ADSP_NXDOMAIN 2561 0.64 1.38 0.55 146 XMGenDplmaNmb 2477 0.57 0.93 0.53 147 RELAYCOUNTRY_GB 2468 0.64 1.56 0.53 148 T_TooManySym_04 2449 0.47 0.02 0.52 149 TR_BOTNET_NEGATE 2441 0.54 0.72 0.52 150 DIET_1 2329 0.59 1.33 0.50 151 XM_B_REG_HTML 2306 0.46 0.25 0.49 152 SUBJ_DOLLARS 2274 0.49 0.52 0.48 153 XM_DIRTYINTL 2260 1.00 5.23 0.48 154 TR_XM_UnparsRelay 2239 0.78 3.19 0.48 155 XM_S_SubURI 2234 0.44 0.13 0.48 156 TooManyTo_004 2206 0.46 0.42 0.47 157 MISSING_HEADERS 2184 0.70 2.60 0.46 158 XMPhish30 2131 0.51 0.98 0.45 159 NML_ADSP_CUSTOM_MED 2057 0.54 1.37 0.44 160 XMPhish14 2026 0.44 0.52 0.43 161 HELO_NODOT 1926 0.49 1.15 0.41 162 PLING_QUERY 1925 0.40 0.36 0.41 163 HELO_NO_DOMAIN 1923 0.49 1.15 0.41 164 T_TooManySym_05 1918 0.36 0.00 0.41 165 TR_XM_COVIDMETA1 1884 0.51 1.42 0.40 166 XMHTML_After_End 1869 0.50 1.32 0.40 167 TooManyTo_005 1843 0.39 0.37 0.39 168 SpammyFromTLD_01 1834 0.99 5.83 0.39 169 USER_IN_WHITELIST 1834 0.35 0.00 0.39 170 T_FILL_THIS_FORM_SHORT 1822 0.54 1.79 0.39 171 XMSubMetaSxObfu_02 1780 0.41 0.65 0.38 172 XM_B_COPY_HTML 1741 0.38 0.45 0.37 173 HTML_TAG_BALANCE_BODY 1736 0.40 0.64 0.37 174 HTML_IMAGE_ONLY_20 1673 0.42 0.98 0.36 175 PDS_OTHER_BAD_TLD 1650 0.55 2.16 0.35 176 XMBSHREFv2 1626 0.33 0.17 0.35 177 XMHTMLBadTable_001 1609 0.34 0.34 0.34 178 NUMERIC_HTTP_ADDR 1602 0.44 1.25 0.34 179 XMSubMetaSxObfu_03 1593 0.37 0.60 0.34 180 HTTPS_HTTP_MISMATCH 1578 0.37 0.61 0.34 181 TR_XM_COVIDMETA4 1576 0.61 2.78 0.34 182 XMPhish08 1565 0.39 0.89 0.33 183 XMBody_78 1534 0.41 1.06 0.33 184 RDNS_DYNAMIC 1520 0.42 1.22 0.32 185 XM_H_PHPMailer 1478 0.45 1.54 0.31 186 FORGED_GMAIL_RCVD 1477 0.42 1.27 0.31 187 XMSlimDrugH 1467 0.46 1.62 0.31 188 XM_H_XFINITY 1446 0.28 0.06 0.31 189 T_OBFU_PDF_ATTACH 1412 0.28 0.09 0.30 190 URI_NOVOWEL 1398 0.35 0.75 0.30 191 BASE64_LENGTH_79_INF 1375 0.49 2.06 0.29 192 REPLYTO_WITHOUT_TO_CC 1358 0.51 2.33 0.29 193 TR_XM_PHPDW 1341 0.62 3.32 0.29 194 LOW_PRICE 1316 0.35 0.90 0.28 195 T_Symld_Words_02 1287 0.32 0.74 0.27 196 TR_XM_PHPForged 1239 0.59 3.25 0.26 197 TR_XM_FormFill2 1224 0.59 3.21 0.26 198 XMNoVowels 1221 0.30 0.65 0.26 199 XM_H_PHPOS 1208 0.58 3.20 0.26 200 MPART_ALT_DIFF_COUNT 1151 0.62 3.68 0.25 ----------------------------------------------------------------------