Email: 733536 Autolearn: 0 AvgScore: -1.16 AvgScanTime: 1.93 sec Spam: 94187 Autolearn: 0 AvgScore: 13.03 AvgScanTime: 4.08 sec Ham: 639349 Autolearn: 0 AvgScore: -3.25 AvgScanTime: 1.62 sec Time Spent Running SA: 393.58 hours Time Spent Processing Spam: 106.72 hours Time Spent Processing Ham: 286.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 91195 98.16 96.82 98.35 2 HTML_MESSAGE 86147 88.06 91.46 87.56 3 XM_B_Unicode 69583 70.41 73.88 69.90 4 DKIM_SIGNED 64026 67.33 67.98 67.23 5 RELAYCOUNTRY_US 63862 79.42 67.80 81.13 6 XM_DK_Pass 61745 65.98 65.56 66.04 7 XMListUnsubscribeExists 52073 46.47 55.29 45.17 8 DKIM_VALID 49632 60.79 52.70 61.98 9 XM_DK_Undo_02 44305 15.19 47.04 10.50 10 XM_B_Unicode3 36731 41.98 39.00 42.42 11 DKIM_VALID_AU 36391 46.15 38.64 47.26 12 BAYES_50 35467 46.37 37.66 47.65 13 BOTNET 33768 7.34 35.85 3.14 14 BAYES_99 33487 10.27 35.55 6.54 15 MIME_HTML_ONLY 33067 24.22 35.11 22.61 16 RELAYCOUNTRY_META 29815 8.68 31.66 5.29 17 LOC_TINY_FONT_1 27271 22.07 28.95 21.06 18 BAYES_999 26183 8.10 27.80 5.20 19 HTML_FONT_LOW_CONTRAST 25812 25.03 27.41 24.68 20 RCVD_IN_MSPIKE_H2 24513 22.13 26.03 21.55 21 FVGT_m_MULTI_ODD 23800 19.37 25.27 18.51 22 DKIM_VALID_EF 22076 24.63 23.44 24.81 23 UNTRUSTED_Relay 21726 4.94 23.07 2.27 24 XMSubLong 20261 20.46 21.51 20.31 25 T_KAM_HTML_FONT_INVALID 18338 16.01 19.47 15.49 26 T_TM2_M_HEADER_IN_MSG 18284 24.66 19.41 25.43 27 BOTNET_IPINHOSTNAME 17320 6.45 18.39 4.69 28 XM_Multi_Part_URI 17200 12.82 18.26 12.02 29 XM_Body_Dirty_Words 17094 12.53 18.15 11.70 30 XM_UncommonTLD01 15354 4.45 16.30 2.70 31 DKIM_INVALID 14394 6.54 15.28 5.25 32 XM_B_Unsub 13760 11.44 14.61 10.97 33 NO_DNS_FOR_FROM 12452 4.58 13.22 3.31 34 LOTS_OF_MONEY 11380 7.78 12.08 7.15 35 HTML_IMAGE_RATIO_02 11187 6.62 11.88 5.84 36 XM_B_Phish_Phrases 11141 6.90 11.83 6.18 37 RCVD_IN_MSPIKE_BL 10585 1.98 11.24 0.61 38 HTML_MIME_NO_HTML_TAG 10244 2.94 10.88 1.77 39 FROM_EXCESS_BASE64 9597 3.57 10.19 2.60 40 T_REMOTE_IMAGE 9367 4.00 9.95 3.12 41 XMSexyCombo_05 9139 4.65 9.70 3.91 42 XM_Evil_Numbers_Gen 8507 8.95 9.03 8.94 43 RCVD_IN_BL_SPAMCOP_NET 8458 2.30 8.98 1.31 44 BODY_URI_ONLY 8254 1.17 8.76 0.06 45 XM_UB50 7998 2.07 8.49 1.13 46 BOTNET_NORDNS 7965 1.10 8.46 0.02 47 BAYES_80 7612 4.23 8.08 3.67 48 RCVD_IN_RP_RNBL 7535 1.10 8.00 0.09 49 TR_XM_PhishingBody 7005 3.66 7.44 3.10 50 LotsOfNums_01 6989 7.76 7.42 7.81 51 BAYES_60 6919 5.80 7.35 5.57 52 XM_SPF_SoftFail 6884 2.28 7.31 1.54 53 XM_B_COVIDMETA 6793 2.42 7.21 1.71 54 HTML_SHORT_LINK_IMG_1 6721 0.94 7.14 0.02 55 RCVD_IN_MSPIKE_WL 6638 20.75 7.05 22.77 56 MPART_ALT_DIFF 6326 8.63 6.72 8.91 57 RELAYCOUNTRY_CA 6306 2.22 6.70 1.57 58 XM_H_Long_From01 6167 5.16 6.55 4.96 59 XMSubMetaSx_00 6058 3.89 6.43 3.51 60 KHOP_HELO_FCRDNS 5929 2.18 6.29 1.57 61 UNPARSEABLE_RELAY 5779 6.18 6.14 6.19 62 RCVD_IN_PSBL 5584 0.90 5.93 0.16 63 FROM_SUSPICIOUS_NTLD 5332 0.75 5.66 0.03 64 FROM_SUSPICIOUS_NTLD_FP 5255 0.74 5.58 0.02 65 RCVD_IN_MSPIKE_L5 5189 0.93 5.51 0.25 66 TooManyTo_001 5188 7.04 5.51 7.26 67 SpammyFromTLD_02 5162 0.98 5.48 0.31 68 HTML_IMAGE_RATIO_04 5067 12.10 5.38 13.09 69 TR_XM_COVIDMETA4 5052 1.28 5.36 0.67 70 XM_UB99 4832 0.66 5.13 0.01 71 HTML_IMAGE_ONLY_12 4823 0.80 5.12 0.17 72 XMSubGiftCard1 4681 0.74 4.97 0.12 73 XMSubGiftCard2 4658 0.70 4.95 0.08 74 XMOffer 4606 0.66 4.89 0.03 75 XM_B_Phish66 4600 2.24 4.88 1.85 76 XM_SendGrid 4504 5.47 4.78 5.57 77 DKIM_ADSP_NXDOMAIN 4381 1.17 4.65 0.65 78 RELAYCOUNTRY_DE 4189 0.93 4.45 0.41 79 RCVD_IN_MSPIKE_L3 4179 0.85 4.44 0.32 80 SpammyFromTLD_01 4069 1.24 4.32 0.79 81 BAYES_95 4031 2.51 4.28 2.25 82 TR_XM_INV_DKIM 4030 0.73 4.28 0.20 83 HDRS_MISSP 3997 0.60 4.24 0.06 84 MIME_HTML_MOSTLY 3966 2.58 4.21 2.34 85 XMNumbers 3955 3.05 4.20 2.88 86 XMStrtUSub 3730 8.55 3.96 9.23 87 RCVD_IN_MSPIKE_H3 3725 12.08 3.95 13.28 88 HTML_IMAGE_RATIO_08 3647 2.21 3.87 1.97 89 XM_UB999 3568 0.49 3.79 0.00 90 XM_B_SpammyTLD 3520 1.77 3.74 1.48 91 XM_DIRTYINTL 3448 0.91 3.66 0.51 92 TR_XM_MaxWHORU 3374 0.50 3.58 0.05 93 SUBJ_ALL_CAPS 3257 1.62 3.46 1.35 94 TR_XM_UnparsRelay 3239 0.77 3.44 0.38 95 TM2_M_URI_OPT_OUT 3224 6.37 3.42 6.81 96 XM_URI_RBL 3147 0.59 3.34 0.19 97 TR_XM_COVIDMETA1 3010 0.91 3.20 0.57 98 T_XMDrugObfuBody_08 2914 1.69 3.09 1.48 99 XMBody_17 2911 1.14 3.09 0.85 100 RCVD_IN_MSPIKE_H4 2805 7.58 2.98 8.26 101 XMDiploma_00 2772 1.80 2.94 1.63 102 XM_B_Unsub2 2765 3.76 2.94 3.89 103 URIBL_SBL_A 2655 0.49 2.82 0.14 104 HTML_IMAGE_RATIO_06 2650 4.33 2.81 4.55 105 XM_UB80 2637 0.40 2.80 0.05 106 HELO_NODOT 2574 1.52 2.73 1.34 107 XM_UB60 2565 0.45 2.72 0.12 108 HELO_NO_DOMAIN 2562 1.51 2.72 1.34 109 XM_CamelCaseFrm001 2536 1.80 2.69 1.66 110 LongTLD 2451 0.47 2.60 0.15 111 MIME_QP_LONG_LINE 2399 4.70 2.55 5.02 112 BAYES_40 2397 4.78 2.54 5.11 113 T_TooManySym_01 2358 3.89 2.50 4.10 114 RELAYCOUNTRY_FR 2325 0.52 2.47 0.23 115 TR_XM_PHPDW 2309 0.71 2.45 0.45 116 TR_XM_PHPForged 2292 0.69 2.43 0.43 117 TM2_M_VERY_LONG_WORD 2289 1.10 2.43 0.91 118 XM_OfRef6 2259 1.21 2.40 1.04 119 TR_XM_FormFill2 2259 0.69 2.40 0.44 120 XMSubNoVowel 2254 4.06 2.39 4.30 121 XM_H_PHPOS 2247 0.68 2.39 0.43 122 FSL_HELO_NON_FQDN_1 2138 0.34 2.27 0.06 123 TR_XM_MaxBayes 2134 0.32 2.27 0.03 124 XMGenDplmaNmb 2121 1.09 2.25 0.92 125 MIME_HEADER_CTYPE_ONLY 2116 0.35 2.25 0.07 126 MIME_HTML_ONLY_MULTI 2112 6.42 2.24 7.04 127 HDRS_LCASE_IMGONLY 2101 0.30 2.23 0.02 128 PDS_OTHER_BAD_TLD 2045 0.39 2.17 0.13 129 TR_XM_DK_SendGrid 2038 2.98 2.16 3.11 130 SHORT_IMG_SUSP_NTLD 2035 0.28 2.16 0.00 131 TR_XM_MaxSPIKE 2012 0.30 2.14 0.03 132 FVGT_m_MULTI_ODD_EMAIL 1990 0.30 2.11 0.03 133 TR_LOTS_OF_MONEY3 1945 0.66 2.07 0.45 134 DATE_IN_PAST_03_06 1940 0.38 2.06 0.13 135 TR_Symld_Words 1924 1.59 2.04 1.52 136 HTML_TAG_BALANCE_CENTER 1907 0.34 2.02 0.09 137 RELAYCOUNTRY_JP 1895 0.29 2.01 0.04 138 BAYES_20 1868 4.82 1.98 5.24 139 XM_JunkDunk 1860 0.25 1.97 0.00 140 TR_XM_RelayPhish 1841 0.36 1.95 0.13 141 URI_HEX 1838 1.65 1.95 1.61 142 HK_RANDOM_FROM 1789 0.35 1.90 0.13 143 XMBrknScrpt_02 1769 1.04 1.88 0.92 144 TR_Mismatch_TLD_02 1656 0.29 1.76 0.08 145 MPART_ALT_DIFF_COUNT 1632 0.47 1.73 0.28 146 RDNS_DYNAMIC 1626 0.51 1.73 0.33 147 T_XMDrugObfuBody_14 1619 1.39 1.72 1.34 148 LONG_JUNK_URI 1568 0.28 1.66 0.07 149 TVD_SPACE_RATIO_MINFP 1562 0.22 1.66 0.01 150 HTML_IMAGE_ONLY_08 1508 0.29 1.60 0.09 151 HELO_DYNAMIC_DHCP 1499 0.27 1.59 0.07 152 XM_UB95 1498 0.21 1.59 0.01 153 XMSexyCombo_01 1451 0.55 1.54 0.41 154 BAYES_00 1434 15.90 1.52 18.02 155 ALL_TRUSTED 1409 13.12 1.50 14.83 156 RELAYCOUNTRY_IN 1407 0.28 1.49 0.10 157 URI_NOVOWEL 1406 0.50 1.49 0.35 158 TVD_SPACE_RATIO 1389 0.44 1.47 0.29 159 RELAYCOUNTRY_RU 1356 0.60 1.44 0.48 160 HK_RANDOM_REPLYTO 1351 0.37 1.43 0.22 161 DIET_1 1350 0.57 1.43 0.44 162 URI_TRY_3LD 1339 1.14 1.42 1.10 163 MAILING_LIST_MULTI 1334 1.95 1.42 2.03 164 RELAYCOUNTRY_IT 1329 0.23 1.41 0.06 165 TR_Mismatch_TLD_01 1323 0.33 1.40 0.17 166 DKIM_ADSP_CUSTOM_MED 1311 1.11 1.39 1.06 167 NUMERIC_HTTP_ADDR 1309 0.51 1.39 0.38 168 ONLINE_PHARMACY 1308 0.19 1.39 0.01 169 T_XMDrugObfuBody_00 1299 0.75 1.38 0.66 170 PDS_FROM_2_EMAILS 1293 0.20 1.37 0.03 171 TVD_VISIT_PHARMA 1286 0.18 1.37 0.01 172 XM_PDF 1284 3.22 1.36 3.50 173 XMHTML_After_End 1283 0.84 1.36 0.76 174 TR_XM_SpoofStaff 1234 0.24 1.31 0.09 175 FROM_2_EMAILS_SHORT 1223 0.17 1.30 0.00 176 XM_HighProb1 1201 0.17 1.28 0.00 177 XMSpoofStaff2 1199 0.24 1.27 0.09 178 NML_ADSP_CUSTOM_MED 1169 0.83 1.24 0.77 179 PDS_TO_EQ_FROM_NAME 1153 0.16 1.22 0.00 180 MIME_CHARSET_FARAWAY 1141 0.24 1.21 0.10 181 HTML_FONT_TINY_NORDNS 1137 0.47 1.21 0.37 182 NO_FM_NAME_IP_HOSTN 1134 0.16 1.20 0.00 183 RELAYCOUNTRY_GB 1126 0.97 1.20 0.93 184 HK_SCAM 1125 0.18 1.19 0.03 185 NORDNS_LOW_CONTRAST 1103 0.16 1.17 0.01 186 RELAYCOUNTRY_AU 1098 0.44 1.17 0.33 187 XMBody_78 1090 0.44 1.16 0.33 188 CHARSET_FARAWAY_HEADER 1084 0.19 1.15 0.05 189 REMOVE_BEFORE_LINK 1067 0.35 1.13 0.23 190 RELAYCOUNTRY_NL 1054 0.32 1.12 0.20 191 XM_H_PHPMailer 1051 0.56 1.12 0.48 192 XMStockSpam_06 1044 1.16 1.11 1.16 193 FORGED_GMAIL_RCVD 1040 0.61 1.10 0.54 194 TR_MetaPhish_Combo_01 1027 0.82 1.09 0.78 195 T_Symld_Words_02 1026 0.77 1.09 0.73 196 URI_PHP_REDIR 1025 0.15 1.09 0.01 197 RCVD_IN_MSPIKE_L4 1025 0.16 1.09 0.03 198 XMSubEmpty 1017 0.32 1.08 0.20 199 HTML_IMAGE_ONLY_16 1000 0.34 1.06 0.23 200 RELAYCOUNTRY_HK 990 0.19 1.05 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 628810 98.16 96.82 98.35 2 HTML_MESSAGE 559791 88.06 91.46 87.56 3 RELAYCOUNTRY_US 518733 79.42 67.80 81.13 4 XM_B_Unicode 446874 70.41 73.88 69.90 5 DKIM_SIGNED 429859 67.33 67.98 67.23 6 XM_DK_Pass 422223 65.98 65.56 66.04 7 DKIM_VALID 396264 60.79 52.70 61.98 8 BAYES_50 304651 46.37 37.66 47.65 9 DKIM_VALID_AU 302162 46.15 38.64 47.26 10 XMListUnsubscribeExists 288810 46.47 55.29 45.17 11 XM_B_Unicode3 271194 41.98 39.00 42.42 12 T_TM2_M_HEADER_IN_MSG 162600 24.66 19.41 25.43 13 DKIM_VALID_EF 158627 24.63 23.44 24.81 14 HTML_FONT_LOW_CONTRAST 157768 25.03 27.41 24.68 15 RCVD_IN_MSPIKE_WL 145550 20.75 7.05 22.77 16 MIME_HTML_ONLY 144582 24.22 35.11 22.61 17 RCVD_IN_MSPIKE_H2 137796 22.13 26.03 21.55 18 LOC_TINY_FONT_1 134654 22.07 28.95 21.06 19 XMSubLong 129839 20.46 21.51 20.31 20 FVGT_m_MULTI_ODD 118314 19.37 25.27 18.51 21 BAYES_00 115231 15.90 1.52 18.02 22 T_KAM_HTML_FONT_INVALID 99065 16.01 19.47 15.49 23 ALL_TRUSTED 94839 13.12 1.50 14.83 24 RCVD_IN_MSPIKE_H3 84898 12.08 3.95 13.28 25 HTML_IMAGE_RATIO_04 83711 12.10 5.38 13.09 26 XM_Multi_Part_URI 76854 12.82 18.26 12.02 27 XM_H_Trusted_IP 75231 10.26 0.00 11.77 28 XM_Body_Dirty_Words 74814 12.53 18.15 11.70 29 XM_B_Unsub 70141 11.44 14.61 10.97 30 XM_DK_Undo_02 67103 15.19 47.04 10.50 31 HTML_FONT_FACE_BAD 64629 8.88 0.55 10.11 32 XMStrtUSub 59024 8.55 3.96 9.23 33 XM_Evil_Numbers_Gen 57127 8.95 9.03 8.94 34 MPART_ALT_DIFF 56975 8.63 6.72 8.91 35 RCVD_IN_MSPIKE_H4 52788 7.58 2.98 8.26 36 LotsOfNums_01 49932 7.76 7.42 7.81 37 TR_XM_DK_Bayes 47471 6.53 0.45 7.42 38 TooManyTo_001 46422 7.04 5.51 7.26 39 LOTS_OF_MONEY 45699 7.78 12.08 7.15 40 MIME_HTML_ONLY_MULTI 45006 6.42 2.24 7.04 41 IN_ZIMBRA_NJ_WHITELIST 44573 6.08 0.05 6.97 42 TR_XM_DK_Bayes1 44098 6.05 0.28 6.90 43 TM2_M_URI_OPT_OUT 43516 6.37 3.42 6.81 44 BAYES_99 41815 10.27 35.55 6.54 45 ANY_BOUNCE_MESSAGE 41229 5.72 0.80 6.45 46 BOUNCE_MESSAGE 41221 5.72 0.80 6.45 47 UNPARSEABLE_RELAY 39583 6.18 6.14 6.19 48 XM_B_Phish_Phrases 39505 6.90 11.83 6.18 49 TR_XM_DK_Bayes2 38820 5.33 0.27 6.07 50 XM_DKIMWhitelistDomains 38027 5.19 0.02 5.95 51 BAYES_05 37696 5.27 1.02 5.90 52 RCVD_IN_RP_SAFE 37391 5.18 0.63 5.85 53 HTML_IMAGE_RATIO_02 37368 6.62 11.88 5.84 54 XM_SendGrid 35629 5.47 4.78 5.57 55 BAYES_60 35616 5.80 7.35 5.57 56 RELAYCOUNTRY_META 33823 8.68 31.66 5.29 57 DKIM_INVALID 33595 6.54 15.28 5.25 58 BAYES_20 33476 4.82 1.98 5.24 59 RCVD_IN_RP_CERTIFIED 33444 4.61 0.37 5.23 60 BAYES_999 33238 8.10 27.80 5.20 61 BAYES_40 32666 4.78 2.54 5.11 62 MIME_QP_LONG_LINE 32075 4.70 2.55 5.02 63 XM_H_Long_From01 31709 5.16 6.55 4.96 64 BOTNET_IPINHOSTNAME 29975 6.45 18.39 4.69 65 HTML_IMAGE_RATIO_06 29119 4.33 2.81 4.55 66 XMSubNoVowel 27501 4.06 2.39 4.30 67 RCVD_IN_IADB_LISTED 27031 3.80 0.86 4.23 68 T_TooManySym_01 26206 3.89 2.50 4.10 69 XMSexyCombo_05 24993 4.65 9.70 3.91 70 XM_B_Unsub2 24840 3.76 2.94 3.89 71 RCVD_IN_IADB_SPF 23608 3.32 0.79 3.69 72 BAYES_80 23438 4.23 8.08 3.67 73 XMSubMetaSx_00 22469 3.89 6.43 3.51 74 XM_PDF 22366 3.22 1.36 3.50 75 RCVD_IN_IADB_SENDERID 21158 2.98 0.77 3.31 76 NO_DNS_FOR_FROM 21151 4.58 13.22 3.31 77 RCVD_IN_IADB_DK 20567 2.90 0.77 3.22 78 BOTNET 20081 7.34 35.85 3.14 79 T_REMOTE_IMAGE 19959 4.00 9.95 3.12 80 TR_XM_DK_SendGrid 19852 2.98 2.16 3.11 81 TR_XM_PhishingBody 19848 3.66 7.44 3.10 82 XMNumbers 18436 3.05 4.20 2.88 83 XM_UncommonTLD01 17262 4.45 16.30 2.70 84 FROM_EXCESS_BASE64 16599 3.57 10.19 2.60 85 RCVD_IN_IADB_VOUCHED 15833 2.19 0.22 2.48 86 MIME_HTML_MOSTLY 14978 2.58 4.21 2.34 87 UNTRUSTED_Relay 14487 4.94 23.07 2.27 88 BAYES_95 14367 2.51 4.28 2.25 89 MAILING_LIST_MULTI 12951 1.95 1.42 2.03 90 HTML_IMAGE_RATIO_08 12581 2.21 3.87 1.97 91 T_TooManySym_02 12518 1.84 1.03 1.96 92 XM_B_Phish66 11806 2.24 4.88 1.85 93 TooManyTo_002 11408 1.67 0.90 1.78 94 HTML_MIME_NO_HTML_TAG 11302 2.94 10.88 1.77 95 XM_B_COVIDMETA 10962 2.42 7.21 1.71 96 XM_CamelCaseFrm001 10644 1.80 2.69 1.66 97 RCVD_IN_IADB_OPTIN 10431 1.46 0.30 1.63 98 XMDiploma_00 10404 1.80 2.94 1.63 99 URI_HEX 10267 1.65 1.95 1.61 100 KHOP_HELO_FCRDNS 10060 2.18 6.29 1.57 101 RELAYCOUNTRY_CA 10014 2.22 6.70 1.57 102 XM_SPF_SoftFail 9843 2.28 7.31 1.54 103 TR_Symld_Words 9734 1.59 2.04 1.52 104 TVD_RCVD_IP 9469 1.39 0.79 1.48 105 XM_B_SpammyTLD 9450 1.77 3.74 1.48 106 T_XMDrugObfuBody_08 9448 1.69 3.09 1.48 107 SUBJ_ALL_CAPS 8660 1.62 3.46 1.35 108 XM_DK_Undo_01 8608 1.30 0.98 1.35 109 T_XMDrugObfuBody_14 8593 1.39 1.72 1.34 110 HELO_NODOT 8551 1.52 2.73 1.34 111 HELO_NO_DOMAIN 8545 1.51 2.72 1.34 112 RCVD_IN_BL_SPAMCOP_NET 8377 2.30 8.98 1.31 113 RCVD_IN_MSPIKE_H5 7864 1.09 0.11 1.23 114 IN_HORDE_ADDRESS_BOOK 7727 1.09 0.25 1.21 115 HELO_MISC_IP 7720 1.14 0.68 1.21 116 CK_HELO_DYNAMIC_SPLIT_IP 7717 1.17 0.96 1.21 117 TooManyTo_003 7707 1.14 0.67 1.21 118 XMSubGarbage 7510 1.09 0.53 1.17 119 XMStockSpam_06 7438 1.16 1.11 1.16 120 XMSubLongNoVowel 7367 1.11 0.79 1.15 121 XM_H_Long_From02 7355 1.11 0.86 1.15 122 INVALID_MSGID 7320 1.09 0.74 1.14 123 XM_UB50 7218 2.07 8.49 1.13 124 URI_TRY_3LD 7020 1.14 1.42 1.10 125 DKIM_ADSP_CUSTOM_MED 6801 1.11 1.39 1.06 126 XM_GoogleGroups 6754 0.97 0.41 1.06 127 XM_OfRef6 6624 1.21 2.40 1.04 128 XMGappySubj_01 6444 0.90 0.14 1.01 129 TO_MALFORMED 6431 0.88 0.05 1.01 130 XMCapTrack 6080 0.88 0.44 0.95 131 RELAYCOUNTRY_GB 5976 0.97 1.20 0.93 132 XMBrknScrpt_02 5890 1.04 1.88 0.92 133 XMGenDplmaNmb 5869 1.09 2.25 0.92 134 TM2_M_VERY_LONG_WORD 5790 1.10 2.43 0.91 135 TooManyTo_004 5773 0.86 0.57 0.90 136 XM_E_Blogspot 5720 0.79 0.10 0.89 137 XMBdyGiftCard01 5613 0.88 0.87 0.88 138 XMBody_17 5440 1.14 3.09 0.85 139 TR_MSPIKEBAYES00 5261 0.72 0.01 0.82 140 SpammyFromTLD_01 5058 1.24 4.32 0.79 141 T_FILL_THIS_FORM_SHORT 5020 0.82 1.02 0.79 142 T_TooManySym_03 4970 0.70 0.19 0.78 143 TR_MetaPhish_Combo_01 4964 0.82 1.09 0.78 144 NML_ADSP_CUSTOM_MED 4915 0.83 1.24 0.77 145 USER_IN_DEF_DKIM_WL 4906 0.67 0.01 0.77 146 XMHTML_After_End 4856 0.84 1.36 0.76 147 TooManyTo_005 4684 0.70 0.46 0.73 148 T_Symld_Words_02 4645 0.77 1.09 0.73 149 XM_ProductURIs 4310 0.69 0.77 0.67 150 TR_XM_COVIDMETA4 4304 1.28 5.36 0.67 151 T_XMDrugObfuBody_00 4207 0.75 1.38 0.66 152 DKIM_ADSP_NXDOMAIN 4177 1.17 4.65 0.65 153 RCVD_IN_MSPIKE_BL 3910 1.98 11.24 0.61 154 HTTPS_HTTP_MISMATCH 3858 0.63 0.78 0.60 155 XMMoneyMeta_00 3782 0.65 1.04 0.59 156 TR_BOTNET_NEGATE 3720 0.57 0.50 0.58 157 T_OBFU_PDF_ATTACH 3665 0.53 0.25 0.57 158 XMBody_95 3661 0.51 0.07 0.57 159 TR_XM_COVIDMETA1 3642 0.91 3.20 0.57 160 XM_SPF_Unknown 3521 0.58 0.80 0.55 161 FORGED_GMAIL_RCVD 3425 0.61 1.10 0.54 162 XM_DIRTYINTL 3260 0.91 3.66 0.51 163 XMSubMetaI_00 3192 0.53 0.70 0.50 164 RELAYCOUNTRY_RU 3077 0.60 1.44 0.48 165 XMNoVowels 3064 0.48 0.49 0.48 166 FROM_GOV_DKIM_AU 3062 0.43 0.10 0.48 167 XM_H_PHPMailer 3039 0.56 1.12 0.48 168 XMPhish30 2986 0.53 0.99 0.47 169 T_XMHurry_00 2898 0.53 1.05 0.45 170 TR_LOTS_OF_MONEY3 2883 0.66 2.07 0.45 171 TR_XM_PHPDW 2869 0.71 2.45 0.45 172 XM_ShortIntro_01 2846 0.47 0.60 0.45 173 XM_B_COPY_HTML 2834 0.47 0.62 0.44 174 DIET_1 2820 0.57 1.43 0.44 175 TR_XM_FormFill2 2782 0.69 2.40 0.44 176 TR_XM_PHPForged 2780 0.69 2.43 0.43 177 XM_H_PHPOS 2743 0.68 2.39 0.43 178 RELAYCOUNTRY_DE 2646 0.93 4.45 0.41 179 T_TooManySym_04 2642 0.37 0.06 0.41 180 HTML_TAG_BALANCE_BODY 2622 0.45 0.76 0.41 181 XMSexyCombo_01 2612 0.55 1.54 0.41 182 XMHTMLBadTable_001 2607 0.42 0.50 0.41 183 HTML_IMAGE_ONLY_20 2525 0.41 0.49 0.39 184 HTML_IMAGE_ONLY_28 2456 0.40 0.47 0.38 185 XMPhish08 2453 0.43 0.71 0.38 186 XMPhish14 2452 0.46 0.95 0.38 187 TR_XM_UnparsRelay 2435 0.77 3.44 0.38 188 NUMERIC_HTTP_ADDR 2434 0.51 1.39 0.38 189 XM_B_REG_HTML 2423 0.36 0.24 0.38 190 MISSING_HEADERS 2420 0.41 0.62 0.38 191 XMLngstWrd_00 2412 0.39 0.44 0.38 192 PLING_QUERY 2410 0.40 0.53 0.38 193 HTML_FONT_TINY_NORDNS 2337 0.47 1.21 0.37 194 SHORT_HELO_AND_INLINE_IMAGE 2298 0.33 0.15 0.36 195 FROM_GOV_SPOOF 2265 0.32 0.12 0.35 196 URI_NOVOWEL 2251 0.50 1.49 0.35 197 RCVD_IN_SORBS_DUL 2246 0.35 0.35 0.35 198 XM_S_SubURI 2229 0.31 0.06 0.35 199 HTML_IMAGE_ONLY_32 2225 0.37 0.55 0.35 200 XMLngstWrd_01 2193 0.35 0.39 0.34 ----------------------------------------------------------------------