Email: 639832 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 1.90 sec Spam: 85772 Autolearn: 0 AvgScore: 12.29 AvgScanTime: 4.01 sec Ham: 554060 Autolearn: 0 AvgScore: -2.05 AvgScanTime: 1.57 sec Time Spent Running SA: 336.83 hours Time Spent Processing Spam: 95.63 hours Time Spent Processing Ham: 241.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 83554 98.15 97.41 98.27 2 HTML_MESSAGE 78470 85.13 91.49 84.14 3 DKIM_SIGNED 66446 72.68 77.47 71.94 4 XM_DK_Pass 64289 71.33 74.95 70.77 5 RELAYCOUNTRY_US 61719 77.83 71.96 78.74 6 XM_B_Unicode 60593 66.28 70.64 65.60 7 DKIM_VALID 52735 65.76 61.48 66.43 8 XMListUnsubscribeExists 49595 48.36 57.82 46.90 9 XM_DK_Undo_02 46368 17.00 54.06 11.27 10 BAYES_50 33998 48.86 39.64 50.29 11 XM_B_Unicode3 33316 38.15 38.84 38.04 12 DKIM_VALID_AU 32932 48.92 38.39 50.55 13 MIME_HTML_ONLY 30585 22.24 35.66 20.16 14 BAYES_99 29111 10.95 33.94 7.39 15 DKIM_VALID_EF 26294 27.01 30.66 26.44 16 RCVD_IN_MSPIKE_H2 25507 24.46 29.74 23.64 17 LOC_TINY_FONT_1 25051 23.53 29.21 22.65 18 BOTNET 25008 6.74 29.16 3.27 19 RELAYCOUNTRY_META 23873 8.20 27.83 5.16 20 BAYES_999 23175 8.69 27.02 5.86 21 HTML_FONT_LOW_CONTRAST 22281 26.30 25.98 26.35 22 XMSubLong 21928 20.68 25.57 19.92 23 FVGT_m_MULTI_ODD 20900 21.42 24.37 20.96 24 XM_UncommonTLD01 19591 5.76 22.84 3.11 25 T_TM2_M_HEADER_IN_MSG 17482 27.01 20.38 28.04 26 XM_Body_Dirty_Words 16781 13.50 19.56 12.56 27 T_KAM_HTML_FONT_INVALID 16498 17.27 19.23 16.97 28 UNTRUSTED_Relay 15697 4.20 18.30 2.01 29 XM_Multi_Part_URI 14771 14.22 17.22 13.76 30 BOTNET_IPINHOSTNAME 14011 6.47 16.34 4.95 31 DKIM_INVALID 13711 6.92 15.99 5.51 32 XM_B_Unsub 13135 12.44 15.31 11.99 33 RCVD_IN_BL_SPAMCOP_NET 11933 2.77 13.91 1.05 34 NO_DNS_FOR_FROM 11897 4.59 13.87 3.15 35 XMSexyCombo_05 10818 5.31 12.61 4.18 36 XM_B_Phish_Phrases 10798 7.42 12.59 6.62 37 UNPARSEABLE_RELAY 10767 7.86 12.55 7.14 38 LOTS_OF_MONEY 10263 7.32 11.97 6.60 39 XM_SendGrid 9654 7.20 11.26 6.58 40 RCVD_IN_MSPIKE_BL 9279 2.17 10.82 0.83 41 HTML_IMAGE_RATIO_02 8904 7.28 10.38 6.80 42 PDS_OTHER_BAD_TLD 8303 1.67 9.68 0.43 43 XM_Evil_Numbers_Gen 7694 8.46 8.97 8.38 44 LotsOfNums_01 7593 8.18 8.85 8.08 45 RCVD_IN_MSPIKE_WL 6737 21.74 7.85 23.88 46 BAYES_80 6669 4.60 7.78 4.10 47 SpammyFromTLD_02 6656 1.28 7.76 0.28 48 XMSubMetaSx_00 6643 3.93 7.74 3.34 49 TR_XM_PhishingBody 6535 4.09 7.62 3.55 50 BAYES_60 6476 6.10 7.55 5.88 51 MPART_ALT_DIFF 6001 5.12 7.00 4.83 52 XM_UB50 5956 1.84 6.94 1.04 53 TooManyTo_001 5905 8.42 6.88 8.66 54 RELAYCOUNTRY_CA 5901 2.34 6.88 1.64 55 RCVD_IN_RP_RNBL 5590 0.97 6.52 0.11 56 BOTNET_NORDNS 5534 0.88 6.45 0.02 57 SpammyFromTLD_01 5440 1.61 6.34 0.87 58 HTML_SHORT_LINK_IMG_1 5437 0.87 6.34 0.02 59 HTML_MIME_NO_HTML_TAG 5221 2.46 6.09 1.90 60 XM_SPF_SoftFail 5213 2.34 6.08 1.77 61 XM_H_Long_From01 5166 5.27 6.02 5.15 62 MIME_HTML_MOSTLY 5108 2.83 5.96 2.34 63 XMNumbers 5041 3.99 5.88 3.69 64 RCVD_IN_MSPIKE_L5 5031 1.13 5.87 0.40 65 FROM_EXCESS_BASE64 4892 3.15 5.70 2.76 66 TM2_M_URI_OPT_OUT 4787 8.12 5.58 8.51 67 XM_B_COVIDMETA 4713 1.89 5.49 1.33 68 RCVD_IN_PSBL 4676 0.79 5.45 0.07 69 MIME_HEADER_CTYPE_ONLY 4580 0.79 5.34 0.08 70 T_REMOTE_IMAGE 4424 3.67 5.16 3.44 71 XM_B_Phish66 4390 2.52 5.12 2.12 72 XM_B_SpammyTLD 3966 2.17 4.62 1.80 73 XMStrtUSub 3924 4.94 4.57 5.00 74 TR_XM_INV_DKIM 3920 0.76 4.57 0.17 75 HTML_IMAGE_RATIO_06 3911 3.68 4.56 3.54 76 XM_OfRef6 3728 1.64 4.35 1.22 77 XM_DIRTYINTL 3716 1.09 4.33 0.58 78 SUBJ_ALL_CAPS 3676 1.86 4.29 1.48 79 TR_XM_COVIDMETA4 3666 1.19 4.27 0.72 80 HTML_IMAGE_RATIO_04 3666 5.06 4.27 5.18 81 RCVD_IN_MSPIKE_L3 3641 0.90 4.24 0.39 82 RCVD_IN_MSPIKE_H3 3542 12.60 4.13 13.92 83 BAYES_95 3411 2.71 3.98 2.51 84 XM_UB99 3389 0.54 3.95 0.01 85 FROM_SUSPICIOUS_NTLD 3318 0.55 3.87 0.04 86 TR_XM_MaxWHORU 3264 0.56 3.81 0.06 87 FROM_SUSPICIOUS_NTLD_FP 3228 0.54 3.76 0.04 88 HTML_IMAGE_RATIO_08 3118 2.67 3.64 2.52 89 RCVD_IN_MSPIKE_H4 3035 7.88 3.54 8.56 90 XMBody_17 2957 1.11 3.45 0.74 91 TR_XM_PHPDW 2847 0.93 3.32 0.56 92 TR_XM_PHPForged 2830 0.92 3.30 0.55 93 TR_XM_FormFill2 2799 0.91 3.26 0.55 94 XM_H_PHPOS 2792 0.90 3.26 0.54 95 XM_B_Unsub2 2744 4.11 3.20 4.25 96 HTML_IMAGE_ONLY_12 2660 0.60 3.10 0.22 97 BAYES_40 2608 4.48 3.04 4.71 98 TR_XM_UnparsRelay 2607 0.85 3.04 0.51 99 HTML_IMAGE_ONLY_08 2587 0.50 3.02 0.11 100 DKIM_ADSP_NXDOMAIN 2581 0.82 3.01 0.48 101 KHOP_HELO_FCRDNS 2540 1.91 2.96 1.75 102 TR_XM_COVIDMETA1 2518 0.74 2.94 0.40 103 XM_URI_RBL 2507 0.56 2.92 0.20 104 RELAYCOUNTRY_FR 2491 0.63 2.90 0.27 105 XM_UB999 2433 0.39 2.84 0.01 106 TR_Mismatch_TLD_02 2349 0.45 2.74 0.09 107 XMHTML_After_End 2346 1.09 2.74 0.83 108 LongTLD 2320 0.50 2.70 0.15 109 T_XMDrugObfuBody_08 2307 1.65 2.69 1.49 110 XMSexyCombo_01 2249 0.84 2.62 0.57 111 XM_UB60 2218 0.45 2.59 0.11 112 XMSubNoVowel 2155 1.95 2.51 1.87 113 XM_CamelCaseFrm001 2148 1.97 2.50 1.89 114 T_TooManySym_01 2136 4.00 2.49 4.24 115 MIME_QP_LONG_LINE 2131 4.47 2.48 4.78 116 MIME_HTML_ONLY_MULTI 2101 3.11 2.45 3.21 117 BODY_URI_ONLY 2064 0.38 2.41 0.06 118 RELAYCOUNTRY_DE 2023 0.63 2.36 0.37 119 HELO_NODOT 2006 1.58 2.34 1.46 120 HELO_NO_DOMAIN 1998 1.57 2.33 1.46 121 NUMERIC_HTTP_ADDR 1978 0.78 2.31 0.54 122 URIBL_SBL_A 1974 0.44 2.30 0.15 123 URI_HEX 1951 1.45 2.27 1.33 124 TR_XM_RelayPhish 1895 0.44 2.21 0.16 125 XM_UB80 1891 0.34 2.20 0.05 126 ALL_TRUSTED 1872 15.47 2.18 17.53 127 TR_XM_MaxSPIKE 1784 0.34 2.08 0.08 128 XMDiploma_00 1733 2.33 2.02 2.38 129 XMBrknScrpt_02 1700 0.99 1.98 0.84 130 BAYES_20 1691 4.27 1.97 4.62 131 NORMAL_HTTP_TO_IP 1654 0.31 1.93 0.06 132 FSL_HELO_NON_FQDN_1 1635 0.27 1.91 0.01 133 XMBody_78 1616 0.60 1.88 0.40 134 MPART_ALT_DIFF_COUNT 1607 0.58 1.87 0.38 135 TR_XM_DK_SendGrid 1579 3.35 1.84 3.58 136 MAILING_LIST_MULTI 1510 2.11 1.76 2.17 137 T_XMDrugObfuBody_00 1505 0.76 1.75 0.61 138 XMSexyCombo_04 1492 0.42 1.74 0.21 139 ANY_BOUNCE_MESSAGE 1491 7.49 1.74 8.38 140 RDNS_DYNAMIC 1491 0.51 1.74 0.33 141 T_XMDrugObfuBody_14 1489 1.41 1.74 1.36 142 BOUNCE_MESSAGE 1484 7.49 1.73 8.38 143 TR_LOTS_OF_MONEY3 1455 0.56 1.70 0.39 144 RELAYCOUNTRY_GB 1449 1.11 1.69 1.02 145 TR_XM_MaxBayes 1433 0.24 1.67 0.02 146 URI_PHP_REDIR 1430 0.25 1.67 0.03 147 XMStockSpam_06 1386 1.33 1.62 1.28 148 TM2_M_VERY_LONG_WORD 1384 1.25 1.61 1.19 149 HDRS_MISSP 1376 0.27 1.60 0.07 150 TR_Symld_Words 1365 1.64 1.59 1.65 151 XMLngstWrd_00 1338 0.57 1.56 0.41 152 RELAYCOUNTRY_JP 1307 0.24 1.52 0.04 153 MIME_CHARSET_FARAWAY 1307 0.35 1.52 0.17 154 XMSubMetaSx_01 1273 0.29 1.48 0.11 155 XM_PDF 1217 3.71 1.42 4.06 156 DIET_1 1202 0.49 1.40 0.34 157 CHARSET_FARAWAY_HEADER 1201 0.25 1.40 0.07 158 DKIM_ADSP_CUSTOM_MED 1181 1.10 1.38 1.06 159 TR_Mismatch_TLD_01 1162 0.33 1.35 0.17 160 XMSubGiftCard1 1159 0.25 1.35 0.08 161 T_XMHurry_00 1149 0.68 1.34 0.58 162 XM_H_PHPMailer 1137 0.71 1.33 0.61 163 HDRS_LCASE_IMGONLY 1124 0.18 1.31 0.01 164 XMGenDplmaNmb 1108 0.92 1.29 0.86 165 URI_OPTOUT_3LD 1101 0.37 1.28 0.23 166 FILL_THIS_FORM 1100 0.50 1.28 0.38 167 HTML_FONT_TINY_NORDNS 1097 0.50 1.28 0.37 168 XMGappySubj_01 1094 1.08 1.28 1.06 169 HK_RANDOM_REPLYTO 1084 0.37 1.26 0.24 170 URI_TRY_3LD 1081 1.05 1.26 1.02 171 TR_MetaPhish_Combo_01 1064 0.84 1.24 0.78 172 FILL_THIS_FORM_LONG 1060 0.29 1.24 0.15 173 HTML_IMAGE_ONLY_04 1051 0.21 1.23 0.06 174 TO_IN_SUBJ 1049 0.34 1.22 0.20 175 PDS_BTC_ID 1025 0.19 1.20 0.04 176 T_FILL_THIS_FORM_SHORT 1016 0.81 1.18 0.75 177 FROM_NTLD_LINKBAIT 1016 0.16 1.18 0.00 178 URIBL_BLACK 1014 0.19 1.18 0.03 179 SHORT_IMG_SUSP_NTLD 1014 0.16 1.18 0.00 180 FORM_FRAUD 1008 0.18 1.18 0.03 181 HTML_SHORT_CENTER 1002 0.16 1.17 0.00 182 DATE_IN_PAST_03_06 997 0.26 1.16 0.12 183 BAYES_00 990 13.30 1.15 15.18 184 NML_ADSP_CUSTOM_MED 988 0.85 1.15 0.80 185 XM_BadFromFormat 982 0.34 1.14 0.22 186 FORGED_GMAIL_RCVD 976 0.55 1.14 0.46 187 XMSubMetaI_00 975 0.95 1.14 0.92 188 TR_Caps_n_Bayes_99 973 0.24 1.13 0.10 189 NORDNS_LOW_CONTRAST 965 0.16 1.13 0.01 190 XMLngstWrd_01 964 0.45 1.12 0.35 191 XM_HighProb1 963 0.16 1.12 0.01 192 CK_HELO_DYNAMIC_SPLIT_IP 952 1.35 1.11 1.38 193 RELAYCOUNTRY_NL 951 0.37 1.11 0.26 194 TooManyTo_002 932 1.92 1.09 2.05 195 XMGappySubj_02 928 0.29 1.08 0.17 196 XM_UB95 910 0.17 1.06 0.03 197 XM_DK_Undo_01 908 1.34 1.06 1.38 198 URI_NOVOWEL 907 0.42 1.06 0.32 199 FROM_MISSP_REPLYTO 903 0.15 1.05 0.01 200 RELAYCOUNTRY_RU 892 0.18 1.04 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 544467 98.15 97.41 98.27 2 HTML_MESSAGE 466188 85.13 91.49 84.14 3 RELAYCOUNTRY_US 436263 77.83 71.96 78.74 4 DKIM_SIGNED 398592 72.68 77.47 71.94 5 XM_DK_Pass 392093 71.33 74.95 70.77 6 DKIM_VALID 368036 65.76 61.48 66.43 7 XM_B_Unicode 363482 66.28 70.64 65.60 8 DKIM_VALID_AU 280082 48.92 38.39 50.55 9 BAYES_50 278634 48.86 39.64 50.29 10 XMListUnsubscribeExists 259827 48.36 57.82 46.90 11 XM_B_Unicode3 210784 38.15 38.84 38.04 12 T_TM2_M_HEADER_IN_MSG 155332 27.01 20.38 28.04 13 DKIM_VALID_EF 146498 27.01 30.66 26.44 14 HTML_FONT_LOW_CONTRAST 146014 26.30 25.98 26.35 15 RCVD_IN_MSPIKE_WL 132331 21.74 7.85 23.88 16 RCVD_IN_MSPIKE_H2 130986 24.46 29.74 23.64 17 LOC_TINY_FONT_1 125486 23.53 29.21 22.65 18 FVGT_m_MULTI_ODD 116146 21.42 24.37 20.96 19 MIME_HTML_ONLY 111720 22.24 35.66 20.16 20 XMSubLong 110370 20.68 25.57 19.92 21 ALL_TRUSTED 97125 15.47 2.18 17.53 22 T_KAM_HTML_FONT_INVALID 94027 17.27 19.23 16.97 23 BAYES_00 84131 13.30 1.15 15.18 24 RCVD_IN_MSPIKE_H3 77104 12.60 4.13 13.92 25 XM_Multi_Part_URI 76232 14.22 17.22 13.76 26 XM_Body_Dirty_Words 69589 13.50 19.56 12.56 27 XM_B_Unsub 66450 12.44 15.31 11.99 28 XM_DK_Undo_02 62435 17.00 54.06 11.27 29 TooManyTo_001 47996 8.42 6.88 8.66 30 RCVD_IN_MSPIKE_H4 47414 7.88 3.54 8.56 31 TM2_M_URI_OPT_OUT 47163 8.12 5.58 8.51 32 ANY_BOUNCE_MESSAGE 46455 7.49 1.74 8.38 33 BOUNCE_MESSAGE 46450 7.49 1.73 8.38 34 XM_Evil_Numbers_Gen 46430 8.46 8.97 8.38 35 TR_XM_DK_Bayes 45202 7.13 0.45 8.16 36 LotsOfNums_01 44773 8.18 8.85 8.08 37 TR_XM_DK_Bayes1 42049 6.60 0.20 7.59 38 BAYES_99 40962 10.95 33.94 7.39 39 IN_ZIMBRA_NJ_WHITELIST 40623 6.35 0.03 7.33 40 UNPARSEABLE_RELAY 39533 7.86 12.55 7.14 41 XM_DKIMWhitelistDomains 39502 6.18 0.02 7.13 42 RCVD_IN_RP_SAFE 37713 5.95 0.45 6.81 43 HTML_IMAGE_RATIO_02 37688 7.28 10.38 6.80 44 TR_XM_DK_Bayes2 36828 5.77 0.14 6.65 45 XM_B_Phish_Phrases 36655 7.42 12.59 6.62 46 LOTS_OF_MONEY 36552 7.32 11.97 6.60 47 XM_SendGrid 36445 7.20 11.26 6.58 48 RCVD_IN_RP_CERTIFIED 34488 5.43 0.33 6.22 49 BAYES_60 32575 6.10 7.55 5.88 50 BAYES_999 32451 8.69 27.02 5.86 51 DKIM_INVALID 30556 6.92 15.99 5.51 52 BAYES_05 29395 4.72 0.95 5.31 53 HTML_IMAGE_RATIO_04 28728 5.06 4.27 5.18 54 RELAYCOUNTRY_META 28609 8.20 27.83 5.16 55 XM_H_Long_From01 28550 5.27 6.02 5.15 56 XMStrtUSub 27696 4.94 4.57 5.00 57 BOTNET_IPINHOSTNAME 27417 6.47 16.34 4.95 58 MPART_ALT_DIFF 26738 5.12 7.00 4.83 59 MIME_QP_LONG_LINE 26481 4.47 2.48 4.78 60 BAYES_40 26079 4.48 3.04 4.71 61 BAYES_20 25598 4.27 1.97 4.62 62 XM_B_Unsub2 23563 4.11 3.20 4.25 63 T_TooManySym_01 23481 4.00 2.49 4.24 64 XMSexyCombo_05 23148 5.31 12.61 4.18 65 BAYES_80 22735 4.60 7.78 4.10 66 RCVD_IN_IADB_LISTED 22555 3.63 0.79 4.07 67 XM_PDF 22517 3.71 1.42 4.06 68 XMNumbers 20463 3.99 5.88 3.69 69 XM_H_Trusted_IP 20338 3.18 0.00 3.67 70 TR_XM_DK_SendGrid 19862 3.35 1.84 3.58 71 RCVD_IN_IADB_SPF 19775 3.19 0.71 3.57 72 TR_XM_PhishingBody 19648 4.09 7.62 3.55 73 HTML_IMAGE_RATIO_06 19635 3.68 4.56 3.54 74 T_REMOTE_IMAGE 19057 3.67 5.16 3.44 75 XMSubMetaSx_00 18494 3.93 7.74 3.34 76 BOTNET 18115 6.74 29.16 3.27 77 RCVD_IN_IADB_SENDERID 17827 2.87 0.66 3.22 78 MIME_HTML_ONLY_MULTI 17781 3.11 2.45 3.21 79 NO_DNS_FOR_FROM 17441 4.59 13.87 3.15 80 RCVD_IN_IADB_DK 17363 2.80 0.68 3.13 81 XM_UncommonTLD01 17245 5.76 22.84 3.11 82 FROM_EXCESS_BASE64 15277 3.15 5.70 2.76 83 HTML_IMAGE_RATIO_08 13963 2.67 3.64 2.52 84 BAYES_95 13915 2.71 3.98 2.51 85 RCVD_IN_IADB_VOUCHED 13401 2.13 0.29 2.42 86 XMDiploma_00 13183 2.33 2.02 2.38 87 MIME_HTML_MOSTLY 12978 2.83 5.96 2.34 88 T_TooManySym_02 12113 1.95 0.44 2.19 89 MAILING_LIST_MULTI 11998 2.11 1.76 2.17 90 XM_B_Phish66 11745 2.52 5.12 2.12 91 TooManyTo_002 11364 1.92 1.09 2.05 92 UNTRUSTED_Relay 11145 4.20 18.30 2.01 93 HTML_MIME_NO_HTML_TAG 10519 2.46 6.09 1.90 94 XM_CamelCaseFrm001 10467 1.97 2.50 1.89 95 XMSubNoVowel 10335 1.95 2.51 1.87 96 XM_B_SpammyTLD 9949 2.17 4.62 1.80 97 XM_SPF_SoftFail 9782 2.34 6.08 1.77 98 KHOP_HELO_FCRDNS 9707 1.91 2.96 1.75 99 TVD_RCVD_IP 9685 1.60 0.64 1.75 100 TR_Symld_Words 9123 1.64 1.59 1.65 101 RELAYCOUNTRY_CA 9091 2.34 6.88 1.64 102 RCVD_IN_IADB_OPTIN 8564 1.38 0.29 1.55 103 T_XMDrugObfuBody_08 8262 1.65 2.69 1.49 104 SUBJ_ALL_CAPS 8213 1.86 4.29 1.48 105 HELO_NODOT 8073 1.58 2.34 1.46 106 HELO_NO_DOMAIN 8070 1.57 2.33 1.46 107 RCVD_IN_MSPIKE_H5 7813 1.25 0.19 1.41 108 HELO_MISC_IP 7677 1.34 1.01 1.39 109 CK_HELO_DYNAMIC_SPLIT_IP 7667 1.35 1.11 1.38 110 XM_DK_Undo_01 7666 1.34 1.06 1.38 111 T_XMDrugObfuBody_14 7543 1.41 1.74 1.36 112 TooManyTo_003 7453 1.27 0.80 1.35 113 XM_B_COVIDMETA 7381 1.89 5.49 1.33 114 URI_HEX 7354 1.45 2.27 1.33 115 IN_HORDE_ADDRESS_BOOK 7210 1.15 0.17 1.30 116 INVALID_MSGID 7158 1.16 0.31 1.29 117 XMStockSpam_06 7094 1.33 1.62 1.28 118 XM_OfRef6 6755 1.64 4.35 1.22 119 TM2_M_VERY_LONG_WORD 6586 1.25 1.61 1.19 120 TO_MALFORMED 6375 1.00 0.03 1.15 121 XM_GoogleGroups 6197 1.04 0.50 1.12 122 XMCapTrack 6156 1.04 0.61 1.11 123 HTML_FONT_FACE_BAD 6014 1.03 0.69 1.09 124 DKIM_ADSP_CUSTOM_MED 5875 1.10 1.38 1.06 125 XMGappySubj_01 5847 1.08 1.28 1.06 126 RCVD_IN_BL_SPAMCOP_NET 5814 2.77 13.91 1.05 127 XM_UB50 5789 1.84 6.94 1.04 128 XM_H_Long_From02 5663 0.99 0.79 1.02 129 URI_TRY_3LD 5626 1.05 1.26 1.02 130 RELAYCOUNTRY_GB 5626 1.11 1.69 1.02 131 TooManyTo_004 5593 0.97 0.68 1.01 132 USER_IN_DEF_DKIM_WL 5574 0.87 0.00 1.01 133 XMSubMetaI_00 5100 0.95 1.14 0.92 134 XMBdyGiftCard01 5028 0.87 0.65 0.91 135 T_TooManySym_03 4834 0.77 0.13 0.87 136 SpammyFromTLD_01 4832 1.61 6.34 0.87 137 XMGenDplmaNmb 4772 0.92 1.29 0.86 138 TooManyTo_005 4701 0.81 0.55 0.85 139 XMBrknScrpt_02 4665 0.99 1.98 0.84 140 XMHTML_After_End 4618 1.09 2.74 0.83 141 RCVD_IN_MSPIKE_BL 4588 2.17 10.82 0.83 142 NML_ADSP_CUSTOM_MED 4443 0.85 1.15 0.80 143 XMBody_95 4343 0.69 0.09 0.78 144 TR_MetaPhish_Combo_01 4301 0.84 1.24 0.78 145 T_FILL_THIS_FORM_SHORT 4136 0.81 1.18 0.75 146 XMBody_17 4115 1.11 3.45 0.74 147 XM_ProductURIs 4071 0.76 0.89 0.73 148 TR_MSPIKEBAYES00 4002 0.63 0.01 0.72 149 TR_XM_COVIDMETA4 3964 1.19 4.27 0.72 150 XM_E_Blogspot 3875 0.62 0.11 0.70 151 XM_RXBody 3826 0.66 0.49 0.69 152 HTTPS_HTTP_MISMATCH 3728 0.68 0.74 0.67 153 XM_SPF_Unknown 3668 0.68 0.80 0.66 154 T_OBFU_PDF_ATTACH 3584 0.58 0.15 0.65 155 XM_H_PHPMailer 3375 0.71 1.33 0.61 156 T_XMDrugObfuBody_00 3361 0.76 1.75 0.61 157 XM_DIRTYINTL 3238 1.09 4.33 0.58 158 T_XMHurry_00 3215 0.68 1.34 0.58 159 XMMoneyMeta_00 3183 0.60 0.80 0.57 160 XM_ShortIntro_01 3173 0.61 0.87 0.57 161 XMSexyCombo_01 3145 0.84 2.62 0.57 162 TR_XM_PHPDW 3126 0.93 3.32 0.56 163 TR_XM_PHPForged 3030 0.92 3.30 0.55 164 TR_XM_FormFill2 3022 0.91 3.26 0.55 165 TR_BOTNET_NEGATE 3021 0.53 0.40 0.55 166 NUMERIC_HTTP_ADDR 3019 0.78 2.31 0.54 167 XM_H_PHPOS 2988 0.90 3.26 0.54 168 TR_XM_UnparsRelay 2846 0.85 3.04 0.51 169 T_Symld_Words_02 2824 0.53 0.66 0.51 170 XM_B_REG_HTML 2771 0.45 0.16 0.50 171 SUBJ_DOLLARS 2721 0.49 0.49 0.49 172 XMPhish30 2656 0.53 0.89 0.48 173 DKIM_ADSP_NXDOMAIN 2637 0.82 3.01 0.48 174 T_TooManySym_04 2596 0.41 0.04 0.47 175 XMPhish14 2589 0.53 0.95 0.47 176 XMPhish08 2549 0.51 0.82 0.46 177 FORGED_GMAIL_RCVD 2537 0.55 1.14 0.46 178 FROM_GOV_DKIM_AU 2537 0.41 0.12 0.46 179 MISSING_HEADERS 2516 0.50 0.83 0.45 180 XMHTMLBadTable_001 2496 0.48 0.67 0.45 181 PLING_QUERY 2493 0.46 0.54 0.45 182 XMSubMetaSxObfu_03 2462 0.50 0.83 0.44 183 FROM_GOV_SPOOF 2443 0.42 0.26 0.44 184 HTML_IMAGE_ONLY_20 2438 0.52 1.01 0.44 185 XMNoVowels 2429 0.45 0.49 0.44 186 PDS_OTHER_BAD_TLD 2393 1.67 9.68 0.43 187 XM_B_COPY_HTML 2379 0.44 0.49 0.43 188 RCVD_IN_SORBS_DUL 2329 0.42 0.39 0.42 189 TM2_M_BODY_EMPTY 2290 0.38 0.16 0.41 190 XMLngstWrd_00 2279 0.57 1.56 0.41 191 XM_S_SubURI 2273 0.37 0.07 0.41 192 HTML_IMAGE_ONLY_32 2242 0.41 0.43 0.40 193 XMBody_78 2218 0.60 1.88 0.40 194 RCVD_IN_MSPIKE_L5 2208 1.13 5.87 0.40 195 TR_XM_COVIDMETA1 2208 0.74 2.94 0.40 196 SHORT_HELO_AND_INLINE_IMAGE 2207 0.36 0.12 0.40 197 HTML_TAG_BALANCE_BODY 2201 0.45 0.80 0.40 198 XMSubMetaSxObfu_02 2171 0.42 0.59 0.39 199 RCVD_IN_MSPIKE_L3 2145 0.90 4.24 0.39 200 TR_LOTS_OF_MONEY3 2144 0.56 1.70 0.39 ----------------------------------------------------------------------