Email: 523705 Autolearn: 0 AvgScore: 0.11 AvgScanTime: 1.48 sec Spam: 68995 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.19 sec Ham: 454710 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.22 sec Time Spent Running SA: 214.92 hours Time Spent Processing Spam: 61.05 hours Time Spent Processing Ham: 153.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 67833 99.19 98.32 99.32 2 HTML_MESSAGE 54537 61.32 79.04 58.63 3 DKIM_SIGNED 47464 55.24 68.79 53.19 4 XM_DK_Pass 46158 54.25 66.90 52.33 5 XM_B_Unicode 43780 51.31 63.45 49.47 6 RELAYCOUNTRY_US 43606 56.45 63.20 55.42 7 DKIM_VALID 39211 50.96 56.83 50.07 8 XMListUnsubscribeExists 37765 41.43 54.74 39.41 9 XM_DK_Undo_02 32228 15.01 46.71 10.20 10 DKIM_VALID_AU 29287 41.19 42.45 41.00 11 BAYES_99 26992 11.42 39.12 7.22 12 BAYES_50 26798 33.71 38.84 32.94 13 RELAYCOUNTRY_META 23196 7.76 33.62 3.84 14 XM_B_Unicode3 20735 30.43 30.05 30.48 15 BAYES_999 20580 9.07 29.83 5.92 16 MIME_HTML_ONLY 20559 18.16 29.80 16.40 17 LOTS_OF_MONEY 20195 8.49 29.27 5.34 18 FVGT_m_MULTI_ODD 19655 16.22 28.49 14.35 19 LOC_TINY_FONT_1 18827 22.68 27.29 21.98 20 T_TM2_M_HEADER_IN_MSG 18486 15.79 26.79 14.12 21 RCVD_IN_MSPIKE_H2 18456 17.59 26.75 16.20 22 UNTRUSTED_Relay 18440 5.23 26.73 1.97 23 BOTNET 17908 5.45 25.96 2.34 24 DKIM_VALID_EF 17266 19.02 25.03 18.11 25 HTML_FONT_LOW_CONTRAST 16166 22.47 23.43 22.32 26 XMBody_17 14399 3.57 20.87 0.95 27 TR_LOTS_OF_MONEY3 13001 2.95 18.84 0.54 28 XM_Multi_Part_URI 12890 25.61 18.68 26.66 29 T_KAM_HTML_FONT_INVALID 11757 12.02 17.04 11.25 30 XMSubLong 11343 15.10 16.44 14.90 31 BOTNET_IPINHOSTNAME 11021 6.25 15.97 4.77 32 XM_Body_Dirty_Words 10445 10.76 15.14 10.10 33 SUBJ_ALL_CAPS 9455 2.68 13.70 1.00 34 XM_UB50 9372 2.50 13.58 0.82 35 DKIM_INVALID 8253 4.28 11.96 3.12 36 XM_UncommonTLD01 7893 3.58 11.44 2.38 37 RCVD_IN_MSPIKE_BL 7571 2.10 10.97 0.75 38 TR_XM_PhishingBody 7125 3.40 10.33 2.35 39 RELAYCOUNTRY_CA 6962 2.64 10.09 1.51 40 HELO_NODOT 6862 1.61 9.95 0.35 41 HELO_NO_DOMAIN 6861 1.61 9.94 0.35 42 REPLYTO_WITHOUT_TO_CC 6848 1.33 9.93 0.03 43 MISSING_HEADERS 6741 1.41 9.77 0.15 44 XMSexyCombo_05 6697 4.57 9.71 3.79 45 XM_ShortIntro_01 6685 1.50 9.69 0.26 46 NO_DNS_FOR_FROM 6507 2.97 9.43 1.99 47 TR_LOTS_OF_MONEY1 6416 1.23 9.30 0.01 48 XM_B_Unsub 6071 7.15 8.80 6.90 49 HTML_IMAGE_RATIO_02 5990 6.60 8.68 6.29 50 XM_B_Phish66 5922 2.00 8.58 1.01 51 XMSubMetaSx_00 5844 3.70 8.47 2.98 52 RCVD_IN_RP_RNBL 5671 1.21 8.22 0.15 53 HTML_MIME_NO_HTML_TAG 5506 2.21 7.98 1.33 54 RCVD_IN_MSPIKE_WL 5438 18.36 7.88 19.95 55 LotsOfNums_01 5360 5.94 7.77 5.67 56 BAYES_80 5098 4.05 7.39 3.54 57 XM_B_Phish_Phrases 5028 6.08 7.29 5.90 58 XM_DK_Undo_01 4944 1.82 7.17 1.00 59 XMSubEmpty 4869 1.05 7.06 0.14 60 BAYES_60 4715 5.15 6.83 4.90 61 XMBrknScrpt_02 4695 1.88 6.80 1.14 62 TR_Sbj_FN_Bdy 4664 1.00 6.76 0.12 63 XMNoSubject 4559 0.90 6.61 0.04 64 MISSING_SUBJECT 4559 0.90 6.61 0.04 65 XM_Evil_Numbers_Gen 4328 6.94 6.27 7.04 66 RCVD_IN_BL_SPAMCOP_NET 4221 1.78 6.12 1.12 67 UNPARSEABLE_RELAY 4211 5.31 6.10 5.19 68 XMLngstWrd_00 3879 1.03 5.62 0.33 69 MPART_ALT_DIFF 3775 4.19 5.47 3.99 70 TooManyTo_001 3688 4.65 5.35 4.55 71 RCVD_IN_MSPIKE_L5 3503 0.84 5.08 0.20 72 RCVD_IN_MSPIKE_L3 3478 1.11 5.04 0.52 73 XM_SPF_SoftFail 3387 1.34 4.91 0.80 74 RCVD_IN_MSPIKE_H3 3326 10.62 4.82 11.50 75 XMStrtUSub 3283 3.96 4.76 3.84 76 HTML_IMAGE_RATIO_04 3140 5.37 4.55 5.49 77 SpammyFromTLD_01 3064 0.88 4.44 0.34 78 XM_UB99 3060 0.59 4.44 0.00 79 XM_H_Long_From01 3033 3.99 4.40 3.92 80 XM_DIRTYINTL 3019 1.01 4.38 0.49 81 XMLngstWrd_01 2872 0.80 4.16 0.29 82 MIME_HTML_MOSTLY 2859 2.66 4.14 2.44 83 TR_XM_INV_DKIM 2739 0.70 3.97 0.20 84 HTML_IMAGE_RATIO_08 2714 2.18 3.93 1.91 85 TR_XM_UnparsRelay 2695 0.92 3.91 0.47 86 URIBL_SBL_A 2680 0.69 3.88 0.20 87 XM_B_SpammyTLD 2662 1.41 3.86 1.04 88 BAYES_95 2602 2.43 3.77 2.23 89 TR_XM_MaxSPIKE 2593 0.58 3.76 0.10 90 XM_SendGrid 2574 4.45 3.73 4.56 91 XMNumbers 2558 2.92 3.71 2.80 92 HK_RANDOM_FROM 2543 0.54 3.69 0.07 93 TR_XM_COVIDMETA4 2332 0.75 3.38 0.35 94 RELAYCOUNTRY_NL 2224 0.60 3.22 0.21 95 RCVD_IN_PSBL 2222 0.44 3.22 0.02 96 XM_UB999 2218 0.43 3.21 0.00 97 TR_XM_MaxWHORU 2167 0.46 3.14 0.05 98 BOTNET_NORDNS 2149 0.42 3.11 0.01 99 XM_UB60 2128 0.51 3.08 0.11 100 HELO_MISC_IP 2125 1.92 3.08 1.74 101 TR_XM_MaxBayes 2078 0.42 3.01 0.02 102 CK_HELO_DYNAMIC_SPLIT_IP 2061 1.90 2.99 1.74 103 RCVD_IN_MSPIKE_H4 2055 6.72 2.98 7.29 104 FROM_EXCESS_BASE64 2045 2.76 2.96 2.73 105 XM_UB80 2037 0.44 2.95 0.06 106 KHOP_HELO_FCRDNS 2023 1.10 2.93 0.82 107 HTML_IMAGE_RATIO_06 1964 2.33 2.85 2.25 108 TR_Caps_n_Bayes_99 1962 0.48 2.84 0.12 109 RELAYCOUNTRY_RO 1950 0.38 2.83 0.00 110 XMLngstWrd_02 1930 0.58 2.80 0.25 111 TM2_M_VERY_LONG_WORD 1904 1.02 2.76 0.76 112 XM_B_COVIDMETA 1825 0.99 2.65 0.74 113 URI_TRY_3LD 1779 1.15 2.58 0.93 114 TR_XM_PHPDW 1735 0.53 2.51 0.23 115 SpammyFromTLD_02 1702 0.46 2.47 0.16 116 TR_XM_PHPForged 1701 0.52 2.47 0.22 117 TR_XM_FormFill2 1684 0.51 2.44 0.22 118 T_XMDrugObfuBody_00 1680 9.95 2.43 11.09 119 XM_H_PHPOS 1679 0.51 2.43 0.22 120 XMGppyBdWords 1655 0.43 2.40 0.13 121 XM_OfRef6 1603 1.27 2.32 1.11 122 T_XMHurry_00 1519 0.95 2.20 0.76 123 TM2_M_URI_OPT_OUT 1497 31.61 2.17 36.08 124 T_XMDrugObfuBody_08 1460 1.13 2.12 0.98 125 SUBJ_BUY 1448 0.36 2.10 0.10 126 PDS_FROM_2_EMAILS 1443 0.28 2.09 0.00 127 XMSexyCombo_01 1432 0.78 2.08 0.58 128 T_REMOTE_IMAGE 1424 1.85 2.06 1.82 129 FROM_2_EMAILS_SHORT 1417 0.27 2.05 0.00 130 NO_FM_NAME_IP_HOSTN 1410 0.27 2.04 0.00 131 DATE_IN_PAST_03_06 1386 0.35 2.01 0.09 132 RELAYCOUNTRY_FR 1381 0.42 2.00 0.18 133 PDS_TO_EQ_FROM_NAME 1326 0.26 1.92 0.00 134 LONG_JUNK_URI 1316 0.27 1.91 0.02 135 BILLION_DOLLARS 1313 0.29 1.90 0.05 136 TR_XM_COVIDMETA1 1310 0.40 1.90 0.17 137 XMDiploma_00 1305 1.03 1.89 0.90 138 XMSubMetaD_00 1271 0.28 1.84 0.04 139 XM_B_Unsub2 1265 0.96 1.83 0.83 140 RELAYCOUNTRY_DE 1217 0.47 1.76 0.27 141 XM_CamelCaseFrm001 1212 1.52 1.76 1.48 142 RELAYCOUNTRY_RU 1200 0.45 1.74 0.25 143 DIET_1 1197 0.58 1.73 0.40 144 TR_XM_SpoofStaff 1191 0.24 1.73 0.02 145 HTML_FONT_TINY_NORDNS 1184 0.44 1.72 0.25 146 XMSpoofStaff2 1183 0.24 1.71 0.02 147 TR_XM_DK_SendGrid 1139 2.44 1.65 2.56 148 XMSubNoVowel 1136 1.25 1.65 1.19 149 XMLngstWrd_03 1084 0.40 1.57 0.22 150 TR_XM_RelayPhish 1083 0.29 1.57 0.09 151 URI_HEX 1078 1.06 1.56 0.98 152 XMObfuSubjects 1070 0.21 1.55 0.01 153 XM_URI_RBL 1065 0.34 1.54 0.16 154 XMBdyGiftCard01 1060 1.36 1.54 1.33 155 PDS_OTHER_BAD_TLD 1057 0.34 1.53 0.16 156 XM_H_SpoofStaff4 1056 0.22 1.53 0.02 157 TR_XM_PSC1 1056 0.22 1.53 0.02 158 FROM_SUSPICIOUS_NTLD 1031 0.22 1.49 0.03 159 BAYES_40 1022 3.03 1.48 3.26 160 RELAYCOUNTRY_JP 1013 0.21 1.47 0.02 161 DRUGS_ERECTILE 1007 0.20 1.46 0.01 162 MIME_CHARSET_FARAWAY 986 0.26 1.43 0.08 163 XMHTML_After_End 984 0.69 1.43 0.58 164 DKIM_ADSP_CUSTOM_MED 953 0.81 1.38 0.73 165 DATE_IN_PAST_06_12 947 0.26 1.37 0.09 166 T_TooManySym_01 943 3.33 1.37 3.63 167 MIME_HTML_ONLY_MULTI 941 2.35 1.36 2.50 168 CHARSET_FARAWAY_HEADER 938 0.21 1.36 0.03 169 TR_XM_SpoofStaff2 937 0.18 1.36 0.00 170 FROM_SUSPICIOUS_NTLD_FP 922 0.20 1.34 0.03 171 TR_Mismatch_TLD_01 916 0.29 1.33 0.14 172 TR_Mismatch_TLD_02 906 0.23 1.31 0.06 173 XMSubMetaSxObfu_03 889 0.39 1.29 0.25 174 T_XMDrugObfuBody_14 883 1.14 1.28 1.11 175 XM_UB95 881 0.19 1.28 0.02 176 NML_ADSP_CUSTOM_MED 873 0.60 1.27 0.50 177 TR_MetaPhish_Combo_01 868 0.60 1.26 0.50 178 XMStockSpam_06 865 1.13 1.25 1.11 179 XM_BadFromFormat 857 0.28 1.24 0.13 180 HTML_IMAGE_ONLY_16 847 0.28 1.23 0.14 181 TR_Symld_Words 837 1.48 1.21 1.52 182 XM_H_PHPMailer 833 0.42 1.21 0.30 183 BODY_URI_ONLY 830 0.21 1.20 0.06 184 MIME_QP_LONG_LINE 825 2.42 1.20 2.60 185 RELAYCOUNTRY_IR 801 0.20 1.16 0.05 186 MPART_ALT_DIFF_COUNT 797 0.40 1.16 0.28 187 HTML_TAG_BALANCE_CENTER 795 0.26 1.15 0.13 188 T_FILL_THIS_FORM_SHORT 792 0.46 1.15 0.36 189 XM_RXBody 777 0.78 1.13 0.73 190 FORGED_GMAIL_RCVD 777 0.42 1.13 0.32 191 RCVD_IN_RP_SAFE 764 7.01 1.11 7.91 192 BAYES_20 758 3.81 1.10 4.22 193 RELAYCOUNTRY_CN 752 0.18 1.09 0.04 194 RELAYCOUNTRY_BR 745 0.17 1.08 0.03 195 URIBL_BLACK 741 0.15 1.07 0.01 196 ALL_TRUSTED 739 35.97 1.07 41.26 197 XMSubject_38 737 0.16 1.07 0.02 198 HDRS_MISSP 726 0.20 1.05 0.07 199 HK_RANDOM_REPLYTO 721 0.21 1.05 0.09 200 ONE_TIME 719 0.18 1.04 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 451613 99.19 98.32 99.32 2 HTML_MESSAGE 266583 61.32 79.04 58.63 3 RELAYCOUNTRY_US 252009 56.45 63.20 55.42 4 DKIM_SIGNED 241840 55.24 68.79 53.19 5 XM_DK_Pass 237963 54.25 66.90 52.33 6 DKIM_VALID 227659 50.96 56.83 50.07 7 XM_B_Unicode 224957 51.31 63.45 49.47 8 ALL_TRUSTED 187619 35.97 1.07 41.26 9 DKIM_VALID_AU 186446 41.19 42.45 41.00 10 XMListUnsubscribeExists 179217 41.43 54.74 39.41 11 TM2_M_URI_OPT_OUT 164058 31.61 2.17 36.08 12 BOUNCE_MESSAGE 160128 30.64 0.49 35.22 13 ANY_BOUNCE_MESSAGE 160128 30.64 0.49 35.22 14 BAYES_00 157376 30.14 0.70 34.61 15 BAYES_50 149768 33.71 38.84 32.94 16 XM_B_Unicode3 138604 30.43 30.05 30.48 17 XM_Multi_Part_URI 121230 25.61 18.68 26.66 18 HTML_FONT_LOW_CONTRAST 101497 22.47 23.43 22.32 19 LOC_TINY_FONT_1 99939 22.68 27.29 21.98 20 RCVD_IN_MSPIKE_WL 90699 18.36 7.88 19.95 21 DKIM_VALID_EF 82368 19.02 25.03 18.11 22 MIME_HTML_ONLY 74565 18.16 29.80 16.40 23 RCVD_IN_MSPIKE_H2 73643 17.59 26.75 16.20 24 XMSubLong 67743 15.10 16.44 14.90 25 FVGT_m_MULTI_ODD 65267 16.22 28.49 14.35 26 T_TM2_M_HEADER_IN_MSG 64205 15.79 26.79 14.12 27 RCVD_IN_MSPIKE_H3 52276 10.62 4.82 11.50 28 T_KAM_HTML_FONT_INVALID 51174 12.02 17.04 11.25 29 T_XMDrugObfuBody_00 50432 9.95 2.43 11.09 30 XM_DK_Undo_02 46392 15.01 46.71 10.20 31 XM_Body_Dirty_Words 45908 10.76 15.14 10.10 32 RCVD_IN_RP_SAFE 35958 7.01 1.11 7.91 33 RCVD_IN_RP_CERTIFIED 33707 6.51 0.58 7.41 34 RCVD_IN_MSPIKE_H4 33150 6.72 2.98 7.29 35 BAYES_99 32815 11.42 39.12 7.22 36 BAYES_05 32192 6.24 0.73 7.08 37 XM_Evil_Numbers_Gen 32002 6.94 6.27 7.04 38 XM_DKIMWhitelistDomains 31753 6.07 0.03 6.98 39 XM_B_Unsub 31393 7.15 8.80 6.90 40 HTML_IMAGE_RATIO_02 28580 6.60 8.68 6.29 41 BAYES_999 26908 9.07 29.83 5.92 42 XM_B_Phish_Phrases 26813 6.08 7.29 5.90 43 TR_XM_DK_Bayes 26286 5.06 0.29 5.78 44 LotsOfNums_01 25766 5.94 7.77 5.67 45 HTML_IMAGE_RATIO_04 24962 5.37 4.55 5.49 46 TR_XM_DK_Bayes1 24900 4.78 0.17 5.48 47 LOTS_OF_MONEY 24276 8.49 29.27 5.34 48 UNPARSEABLE_RELAY 23589 5.31 6.10 5.19 49 TR_XM_DK_Bayes2 23130 4.44 0.15 5.09 50 BAYES_60 22261 5.15 6.83 4.90 51 BOTNET_IPINHOSTNAME 21701 6.25 15.97 4.77 52 XM_SendGrid 20723 4.45 3.73 4.56 53 TooManyTo_001 20667 4.65 5.35 4.55 54 BAYES_20 19202 3.81 1.10 4.22 55 MPART_ALT_DIFF 18161 4.19 5.47 3.99 56 XM_H_Long_From01 17844 3.99 4.40 3.92 57 XMStrtUSub 17462 3.96 4.76 3.84 58 RELAYCOUNTRY_META 17459 7.76 33.62 3.84 59 XMSexyCombo_05 17239 4.57 9.71 3.79 60 T_TooManySym_01 16510 3.33 1.37 3.63 61 BAYES_80 16092 4.05 7.39 3.54 62 BAYES_40 14836 3.03 1.48 3.26 63 DKIM_INVALID 14181 4.28 11.96 3.12 64 XMSubMetaSx_00 13536 3.70 8.47 2.98 65 IN_ZIMBRA_NJ_WHITELIST 13430 2.57 0.06 2.95 66 XMNumbers 12749 2.92 3.71 2.80 67 FROM_EXCESS_BASE64 12427 2.76 2.96 2.73 68 MIME_QP_LONG_LINE 11825 2.42 1.20 2.60 69 TR_XM_DK_SendGrid 11636 2.44 1.65 2.56 70 MIME_HTML_ONLY_MULTI 11354 2.35 1.36 2.50 71 MIME_HTML_MOSTLY 11094 2.66 4.14 2.44 72 XM_H_Trusted_IP 11060 2.11 0.00 2.43 73 XM_UncommonTLD01 10844 3.58 11.44 2.38 74 TR_XM_PhishingBody 10691 3.40 10.33 2.35 75 BOTNET 10649 5.45 25.96 2.34 76 HTML_IMAGE_RATIO_06 10250 2.33 2.85 2.25 77 T_TooManySym_02 10200 2.02 0.54 2.24 78 BAYES_95 10129 2.43 3.77 2.23 79 RCVD_IN_IADB_LISTED 9823 1.94 0.45 2.16 80 NO_DNS_FOR_FROM 9027 2.97 9.43 1.99 81 UNTRUSTED_Relay 8967 5.23 26.73 1.97 82 TVD_RCVD_IP 8740 1.72 0.42 1.92 83 HTML_IMAGE_RATIO_08 8702 2.18 3.93 1.91 84 RCVD_IN_IADB_SPF 8589 1.70 0.42 1.89 85 T_REMOTE_IMAGE 8253 1.85 2.06 1.82 86 HELO_MISC_IP 7920 1.92 3.08 1.74 87 CK_HELO_DYNAMIC_SPLIT_IP 7913 1.90 2.99 1.74 88 RCVD_IN_IADB_SENDERID 7788 1.54 0.40 1.71 89 RCVD_IN_IADB_DK 7593 1.50 0.41 1.67 90 INVALID_MSGID 7489 1.46 0.22 1.65 91 TR_Symld_Words 6909 1.48 1.21 1.52 92 RELAYCOUNTRY_CA 6853 2.64 10.09 1.51 93 XM_CamelCaseFrm001 6742 1.52 1.76 1.48 94 TO_MALFORMED 6550 1.26 0.08 1.44 95 HTML_MIME_NO_HTML_TAG 6069 2.21 7.98 1.33 96 XMBdyGiftCard01 6042 1.36 1.54 1.33 97 RCVD_IN_IADB_VOUCHED 5788 1.12 0.09 1.27 98 XM_ProductURIs 5770 1.20 0.73 1.27 99 HTML_FONT_FACE_BAD 5668 1.17 0.69 1.25 100 XMSubNoVowel 5420 1.25 1.65 1.19 101 RCVD_IN_MSPIKE_H5 5273 1.02 0.08 1.16 102 XMGappySubj_01 5241 1.11 0.86 1.15 103 XMBrknScrpt_02 5176 1.88 6.80 1.14 104 MAILING_LIST_MULTI 5168 1.11 0.96 1.14 105 RCVD_IN_BL_SPAMCOP_NET 5083 1.78 6.12 1.12 106 T_XMDrugObfuBody_14 5066 1.14 1.28 1.11 107 XMStockSpam_06 5051 1.13 1.25 1.11 108 XM_OfRef6 5051 1.27 2.32 1.11 109 IN_HORDE_ADDRESS_BOOK 4963 1.00 0.39 1.09 110 XM_PDF 4870 0.98 0.34 1.07 111 XM_B_SpammyTLD 4729 1.41 3.86 1.04 112 USER_IN_DEF_DKIM_WL 4573 0.87 0.00 1.01 113 XM_B_Phish66 4571 2.00 8.58 1.01 114 XM_DK_Undo_01 4562 1.82 7.17 1.00 115 SUBJ_ALL_CAPS 4562 2.68 13.70 1.00 116 T_XMDrugObfuBody_08 4471 1.13 2.12 0.98 117 URI_HEX 4461 1.06 1.56 0.98 118 XMBody_17 4311 3.57 20.87 0.95 119 URI_TRY_3LD 4239 1.15 2.58 0.93 120 T_TooManySym_03 4190 0.81 0.09 0.92 121 XMDiploma_00 4114 1.03 1.89 0.90 122 TR_MSPIKEBAYES00 4110 0.79 0.00 0.90 123 XM_GoogleGroups 3877 0.79 0.35 0.85 124 XM_B_Unsub2 3772 0.96 1.83 0.83 125 XM_UB50 3744 2.50 13.58 0.82 126 KHOP_HELO_FCRDNS 3730 1.10 2.93 0.82 127 XM_SPF_SoftFail 3616 1.34 4.91 0.80 128 XM_H_Long_From02 3607 0.78 0.72 0.79 129 RCVD_IN_IADB_OPTIN 3492 0.68 0.14 0.77 130 T_XMHurry_00 3471 0.95 2.20 0.76 131 TooManyTo_002 3448 0.73 0.55 0.76 132 TM2_M_VERY_LONG_WORD 3448 1.02 2.76 0.76 133 XMSubMetaI_00 3445 0.72 0.47 0.76 134 RCVD_IN_MSPIKE_BL 3405 2.10 10.97 0.75 135 XM_B_COVIDMETA 3372 0.99 2.65 0.74 136 DKIM_ADSP_CUSTOM_MED 3312 0.81 1.38 0.73 137 XM_RXBody 3310 0.78 1.13 0.73 138 XMSexyCombo_01 2648 0.78 2.08 0.58 139 XMHTML_After_End 2641 0.69 1.43 0.58 140 PLING_QUERY 2547 0.56 0.57 0.56 141 T_TooManySym_04 2469 0.47 0.02 0.54 142 XM_B_REG_HTML 2459 0.51 0.29 0.54 143 TR_LOTS_OF_MONEY3 2450 2.95 18.84 0.54 144 TooManyTo_003 2418 0.52 0.42 0.53 145 DKIM_ADSP_NXDOMAIN 2362 0.56 0.86 0.52 146 XMGenDplmaNmb 2359 0.54 0.65 0.52 147 RCVD_IN_MSPIKE_L3 2352 1.11 5.04 0.52 148 XMPhish08 2303 0.52 0.61 0.51 149 TR_MetaPhish_Combo_01 2285 0.60 1.26 0.50 150 NML_ADSP_CUSTOM_MED 2267 0.60 1.27 0.50 151 XM_DIRTYINTL 2247 1.01 4.38 0.49 152 XM_S_SubURI 2243 0.44 0.09 0.49 153 TR_BOTNET_NEGATE 2218 0.51 0.69 0.49 154 XM_B_COPY_HTML 2212 0.48 0.44 0.49 155 XMBody_78 2160 0.49 0.62 0.48 156 NUMERIC_HTTP_ADDR 2149 0.50 0.69 0.47 157 XMBody_95 2137 0.42 0.12 0.47 158 TR_XM_UnparsRelay 2136 0.92 3.91 0.47 159 XMSubMetaSxObfu_02 2058 0.46 0.53 0.45 160 XMPhish14 2028 0.44 0.43 0.45 161 TooManyTo_004 2013 0.44 0.39 0.44 162 T_TooManySym_05 1942 0.37 0.00 0.43 163 RELAYCOUNTRY_GB 1884 0.48 0.89 0.41 164 HTML_TAG_BALANCE_BODY 1865 0.46 0.76 0.41 165 HTML_IMAGE_ONLY_20 1851 0.42 0.50 0.41 166 DIET_1 1829 0.58 1.73 0.40 167 XMPhish30 1769 0.44 0.79 0.39 168 TooManyTo_005 1668 0.36 0.34 0.37 169 TVD_SPACE_RATIO 1655 0.36 0.32 0.36 170 T_FILL_THIS_FORM_SHORT 1635 0.46 1.15 0.36 171 TR_XM_COVIDMETA4 1613 0.75 3.38 0.35 172 HELO_NODOT 1581 1.61 9.95 0.35 173 HELO_NO_DOMAIN 1575 1.61 9.94 0.35 174 USER_IN_WHITELIST 1573 0.30 0.00 0.35 175 T_Symld_Words_02 1564 0.37 0.51 0.34 176 SpammyFromTLD_01 1552 0.88 4.44 0.34 177 XMLngstWrd_00 1493 1.03 5.62 0.33 178 HTTPS_HTTP_MISMATCH 1475 0.35 0.53 0.32 179 FORGED_GMAIL_RCVD 1443 0.42 1.13 0.32 180 XMHTMLBadTable_001 1370 0.31 0.38 0.30 181 XM_H_PHPMailer 1359 0.42 1.21 0.30 182 RDNS_DYNAMIC 1353 0.39 0.97 0.30 183 DATE_IN_PAST_12_24 1349 0.31 0.41 0.30 184 XMLngstWrd_01 1308 0.80 4.16 0.29 185 MPART_ALT_DIFF_COUNT 1283 0.40 1.16 0.28 186 XMCapTrack 1278 0.27 0.22 0.28 187 XMSlimDrugH 1276 0.38 1.02 0.28 188 RELAYCOUNTRY_DE 1242 0.47 1.76 0.27 189 URI_NOVOWEL 1186 0.32 0.67 0.26 190 XM_Combo_Sbj 1171 0.31 0.62 0.26 191 XM_ShortIntro_01 1166 1.50 9.69 0.26 192 XMSubMetaSxObfu_03 1159 0.39 1.29 0.25 193 XMMoneyMeta_00 1159 0.34 0.93 0.25 194 HTML_FONT_TINY_NORDNS 1143 0.44 1.72 0.25 195 RELAYCOUNTRY_RU 1141 0.45 1.74 0.25 196 XMBSHREFv2 1130 0.23 0.09 0.25 197 XMLngstWrd_02 1115 0.58 2.80 0.25 198 XMNoVowels 1106 0.32 0.80 0.24 199 TR_XM_PHPDW 1066 0.53 2.51 0.23 200 XM_Akamai 1061 0.20 0.00 0.23 ----------------------------------------------------------------------