Email: 661587 Autolearn: 0 AvgScore: 0.84 AvgScanTime: 1.88 sec Spam: 103300 Autolearn: 0 AvgScore: 14.35 AvgScanTime: 3.55 sec Ham: 558287 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.57 sec Time Spent Running SA: 345.42 hours Time Spent Processing Spam: 101.93 hours Time Spent Processing Ham: 243.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 98082 97.64 94.95 98.14 2 HTML_MESSAGE 92731 85.75 89.77 85.00 3 XM_B_Unicode 78728 67.64 76.21 66.06 4 RELAYCOUNTRY_US 69043 76.95 66.84 78.82 5 DKIM_SIGNED 62655 72.01 60.65 74.11 6 XM_DK_Pass 60920 70.83 58.97 73.02 7 XMListUnsubscribeExists 53167 49.82 51.47 49.51 8 DKIM_VALID 49466 65.29 47.89 68.51 9 MIME_HTML_ONLY 43438 23.19 42.05 19.69 10 XM_DK_Undo_02 43013 16.12 41.64 11.40 11 RCVD_IN_MSPIKE_H2 39387 25.77 38.13 23.48 12 BAYES_99 36261 11.69 35.10 7.36 13 DKIM_VALID_AU 35566 49.92 34.43 52.79 14 RELAYCOUNTRY_META 33311 10.13 32.25 6.04 15 BOTNET 33172 7.90 32.11 3.42 16 BAYES_50 33099 47.96 32.04 50.90 17 XM_B_Unicode3 32329 37.05 31.30 38.12 18 LOC_TINY_FONT_1 27661 24.68 26.78 24.29 19 BAYES_999 26419 8.88 25.58 5.79 20 RCVD_IN_BL_SPAMCOP_NET 24529 4.61 23.75 1.07 21 UNTRUSTED_Relay 24075 5.88 23.31 2.66 22 FVGT_m_MULTI_ODD 23686 21.88 22.93 21.68 23 RCVD_IN_PSBL 23409 3.58 22.66 0.05 24 HTML_FONT_LOW_CONTRAST 22876 25.84 22.15 26.52 25 T_REMOTE_IMAGE 22680 6.29 21.96 3.39 26 DKIM_VALID_EF 22146 27.05 21.44 28.09 27 HTML_MIME_NO_HTML_TAG 22080 5.00 21.37 1.97 28 BODY_URI_ONLY 20966 3.22 20.30 0.06 29 T_TM2_M_HEADER_IN_MSG 20145 27.41 19.50 28.87 30 XMSubLong 19461 20.73 18.84 21.08 31 T_KAM_HTML_FONT_INVALID 17737 17.79 17.17 17.90 32 XM_Body_Dirty_Words 16741 13.61 16.21 13.13 33 XM_Multi_Part_URI 16656 14.31 16.12 13.97 34 BOTNET_IPINHOSTNAME 16353 6.77 15.83 5.09 35 HTML_IMAGE_RATIO_02 15080 7.88 14.60 6.64 36 XM_UncommonTLD01 14256 4.68 13.80 3.00 37 DKIM_INVALID 13189 6.72 12.77 5.60 38 XMSubGiftCard1 12428 1.91 12.03 0.04 39 BAYES_80 12200 5.36 11.81 4.17 40 RCVD_IN_MSPIKE_BL 11823 2.47 11.45 0.81 41 NO_DNS_FOR_FROM 11676 4.46 11.30 3.19 42 LOTS_OF_MONEY 10765 7.92 10.42 7.45 43 XMSexyCombo_05 10196 5.13 9.87 4.25 44 XM_B_Unsub 10118 11.22 9.79 11.49 45 BAYES_60 9615 6.77 9.31 6.30 46 XM_B_Phish_Phrases 9448 7.26 9.15 6.91 47 KHOP_HELO_FCRDNS 9300 2.91 9.00 1.78 48 BOTNET_NORDNS 8538 1.31 8.27 0.02 49 HTML_IMAGE_ONLY_12 8058 1.40 7.80 0.21 50 XMSubGiftCard2 8049 1.23 7.79 0.02 51 HTML_SHORT_LINK_IMG_2 7980 1.25 7.73 0.05 52 FROM_EXCESS_BASE64 7916 3.13 7.66 2.29 53 RCVD_IN_RP_RNBL 7910 1.29 7.66 0.11 54 LotsOfNums_01 7768 7.67 7.52 7.70 55 HTML_SHORT_LINK_IMG_1 7667 1.18 7.42 0.03 56 HTML_IMAGE_ONLY_08 7628 1.24 7.38 0.11 57 XMSubject_48 7528 1.17 7.29 0.04 58 BAYES_95 7217 3.31 6.99 2.63 59 XM_UB50 7137 2.08 6.91 1.19 60 XM_Evil_Numbers_Gen 7098 7.72 6.87 7.87 61 RCVD_IN_MSPIKE_L5 6884 1.30 6.66 0.31 62 RCVD_IN_MSPIKE_WL 6600 21.84 6.39 24.70 63 TR_XM_PhishingBody 6377 4.21 6.17 3.84 64 RELAYCOUNTRY_CA 6239 2.47 6.04 1.81 65 XM_SPF_SoftFail 6040 2.43 5.85 1.80 66 SpammyFromTLD_01 5852 1.61 5.67 0.86 67 TooManyTo_001 5743 8.45 5.56 8.98 68 XM_UB99 5647 0.87 5.47 0.01 69 XMSubMetaSx_00 5578 4.38 5.40 4.19 70 XM_H_Long_From01 5412 5.16 5.24 5.15 71 HK_RANDOM_FROM 5397 0.93 5.22 0.13 72 UNPARSEABLE_RELAY 5248 6.54 5.08 6.81 73 XMBdyGiftCard01 4975 1.58 4.82 0.98 74 XM_DIRTYINTL 4629 1.18 4.48 0.57 75 XM_B_COVIDMETA 4595 2.11 4.45 1.67 76 MPART_ALT_DIFF 4512 4.84 4.37 4.93 77 XM_UB80 4236 0.72 4.10 0.09 78 XMBody_50 4229 0.64 4.09 0.00 79 TR_XM_COVIDMETA4 4184 1.22 4.05 0.70 80 HTML_IMAGE_RATIO_04 4176 5.29 4.04 5.52 81 XM_SendGrid 4131 5.77 4.00 6.10 82 RELAYCOUNTRY_JP 4081 0.64 3.95 0.03 83 XM_B_Phish66 4029 2.71 3.90 2.48 84 XM_B_SpammyTLD 4014 2.20 3.89 1.88 85 RCVD_IN_MSPIKE_H3 3898 12.93 3.77 14.63 86 TR_XM_INV_DKIM 3817 0.73 3.70 0.18 87 XMOffer 3808 0.60 3.69 0.03 88 XMNumbers 3653 3.32 3.54 3.28 89 XM_UB60 3633 0.69 3.52 0.16 90 XM_UB999 3502 0.54 3.39 0.01 91 XM_JunkDunk 3450 0.52 3.34 0.00 92 MIME_HTML_MOSTLY 3429 2.33 3.32 2.14 93 TM2_M_VERY_LONG_WORD 3361 1.40 3.25 1.06 94 TR_XM_MaxWHORU 3217 0.54 3.11 0.07 95 SUBJ_ALL_CAPS 3207 1.82 3.10 1.59 96 FROM_SUSPICIOUS_NTLD 3179 0.51 3.08 0.03 97 RCVD_IN_MSPIKE_L3 3153 0.83 3.05 0.42 98 FROM_SUSPICIOUS_NTLD_FP 3034 0.48 2.94 0.03 99 URIBL_SBL_A 2998 0.59 2.90 0.17 100 SpammyFromTLD_02 2971 0.64 2.88 0.22 101 RELAYCOUNTRY_AU 2952 0.80 2.86 0.42 102 TM2_M_URI_OPT_OUT 2897 7.21 2.80 8.02 103 XMStrtUSub 2842 4.51 2.75 4.84 104 NO_FM_NAME_IP_HOSTN 2841 0.43 2.75 0.00 105 XMBody_17 2786 1.15 2.70 0.86 106 TR_XM_UnparsRelay 2769 0.78 2.68 0.43 107 ONLINE_PHARMACY 2701 0.42 2.61 0.01 108 TVD_VISIT_PHARMA 2689 0.42 2.60 0.01 109 XM_CamelCaseFrm001 2671 2.11 2.59 2.02 110 T_XMDrugObfuBody_08 2665 1.65 2.58 1.48 111 XM_URI_RBL 2650 0.57 2.57 0.20 112 XMBrknScrpt_02 2626 1.17 2.54 0.92 113 PDS_FROM_2_EMAILS 2613 0.42 2.53 0.03 114 HTML_IMAGE_RATIO_06 2592 3.09 2.51 3.19 115 FROM_2_EMAILS_SHORT 2592 0.40 2.51 0.01 116 RELAYCOUNTRY_NL 2564 0.60 2.48 0.26 117 RCVD_IN_MSPIKE_H4 2564 7.77 2.48 8.75 118 PDS_OTHER_BAD_TLD 2544 0.77 2.46 0.45 119 LONG_JUNK_URI 2475 0.41 2.40 0.04 120 DATE_IN_PAST_03_06 2433 0.46 2.36 0.11 121 TR_Mismatch_TLD_02 2416 0.43 2.34 0.08 122 TR_XM_PHPForged 2391 0.77 2.31 0.49 123 TR_XM_PHPDW 2390 0.79 2.31 0.50 124 XM_UB95 2388 0.38 2.31 0.02 125 TR_XM_FormFill2 2354 0.76 2.28 0.48 126 XM_H_PHPOS 2341 0.76 2.27 0.48 127 TR_XM_COVIDMETA1 2338 0.81 2.26 0.54 128 XMDiploma_00 2306 1.90 2.23 1.84 129 HTML_IMAGE_RATIO_08 2294 2.24 2.22 2.25 130 TR_XM_MaxBayes 2289 0.37 2.22 0.03 131 FROM_LOCAL_NOVOWEL 2288 0.37 2.21 0.03 132 RELAYCOUNTRY_FR 2281 0.56 2.21 0.25 133 MIME_QP_LONG_LINE 2258 4.38 2.19 4.78 134 PDS_TO_EQ_FROM_NAME 2253 0.35 2.18 0.01 135 TO_NO_BRKTS_HTML_ONLY 2201 0.45 2.13 0.14 136 XM_B_Unsub2 2191 3.86 2.12 4.18 137 XM_OfRef6 2140 1.38 2.07 1.25 138 XMSubNoVowel 1994 1.10 1.93 0.94 139 XMSexyCombo_01 1915 1.40 1.85 1.31 140 URI_HEX 1891 1.52 1.83 1.47 141 FVGT_m_MULTI_ODD_EMAIL 1876 0.32 1.82 0.04 142 BAYES_40 1847 4.15 1.79 4.59 143 HTML_IMAGE_ONLY_16 1844 0.52 1.79 0.28 144 MIME_CHARSET_FARAWAY 1841 0.39 1.78 0.14 145 RDNS_DYNAMIC 1791 0.58 1.73 0.36 146 TR_XM_MaxSPIKE 1782 0.31 1.73 0.05 147 RELAYCOUNTRY_DE 1764 0.60 1.71 0.39 148 TR_XM_RelayPhish 1729 0.42 1.67 0.19 149 T_XMDrugObfuBody_14 1728 1.50 1.67 1.47 150 TR_XM_DK_SendGrid 1670 3.20 1.62 3.49 151 DKIM_ADSP_NXDOMAIN 1669 0.69 1.62 0.52 152 T_TooManySym_01 1657 4.11 1.60 4.57 153 TR_Symld_Words 1652 1.65 1.60 1.67 154 TVD_SPACE_RATIO_MINFP 1652 0.26 1.60 0.01 155 MPART_ALT_DIFF_COUNT 1645 0.57 1.59 0.38 156 TR_XM_SpoofStaff 1638 0.31 1.59 0.08 157 XMSpoofStaff2 1611 0.31 1.56 0.08 158 TR_Caps_n_Bayes_99 1608 0.35 1.56 0.13 159 MIMEOLE_DIRECT_TO_MX 1597 0.24 1.55 0.00 160 TVD_SPACE_RATIO 1590 0.51 1.54 0.32 161 RCVD_IN_MSPIKE_L4 1568 0.30 1.52 0.08 162 RELAYCOUNTRY_SE 1556 0.25 1.51 0.02 163 MIME_HTML_ONLY_MULTI 1454 2.91 1.41 3.19 164 HDR_ORDER_FTSDMCXX_DIRECT 1449 0.22 1.40 0.00 165 BAYES_20 1443 4.04 1.40 4.53 166 ALL_TRUSTED 1440 14.23 1.39 16.60 167 XMHTML_After_End 1422 0.94 1.38 0.86 168 RELAYCOUNTRY_HK 1417 0.25 1.37 0.05 169 DKIM_ADSP_CUSTOM_MED 1398 1.11 1.35 1.06 170 HK_RANDOM_REPLYTO 1371 0.44 1.33 0.28 171 T_XMDrugObfuBody_00 1350 0.74 1.31 0.64 172 XMGenDplmaNmb 1336 0.99 1.29 0.94 173 MAILING_LIST_MULTI 1327 2.20 1.28 2.36 174 XMStockSpam_06 1323 1.13 1.28 1.10 175 TO_MALFORMED 1308 1.18 1.27 1.16 176 TR_Mismatch_TLD_01 1296 0.41 1.25 0.25 177 URI_TRY_3LD 1283 1.13 1.24 1.11 178 XM_H_SpoofStaff4 1260 0.26 1.22 0.08 179 HTML_TAG_BALANCE_CENTER 1258 0.29 1.22 0.12 180 TR_XM_PSC1 1258 0.25 1.22 0.08 181 HDRS_MISSP 1251 0.25 1.21 0.07 182 NML_ADSP_CUSTOM_MED 1245 0.85 1.21 0.78 183 IMG_ONLY_FM_DOM_INFO 1218 0.19 1.18 0.00 184 CHARSET_FARAWAY_HEADER 1217 0.22 1.18 0.04 185 CK_HELO_DYNAMIC_SPLIT_IP 1193 1.34 1.15 1.38 186 DOS_OE_TO_MX 1165 0.18 1.13 0.00 187 RELAYCOUNTRY_IE 1164 0.32 1.13 0.18 188 RELAYCOUNTRY_GB 1157 1.00 1.12 0.98 189 URI_ONLY_MSGID_MALF 1148 0.18 1.11 0.00 190 URI_PHP_REDIR 1135 0.19 1.10 0.02 191 TR_XM_SpoofStaff2 1122 0.17 1.09 0.00 192 XMSexyCombo_04 1121 0.61 1.09 0.53 193 XM_H_PHPMailer 1111 0.65 1.08 0.57 194 LongTLD 1110 0.33 1.07 0.19 195 FORGED_GMAIL_RCVD 1107 0.57 1.07 0.47 196 XMBody_78 1086 0.46 1.05 0.36 197 XM_PDF 1067 3.97 1.03 4.51 198 XM_DK_Undo_01 1065 1.58 1.03 1.68 199 REMOVE_BEFORE_LINK 1053 0.40 1.02 0.29 200 HELO_NODOT 1039 1.48 1.01 1.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 547913 97.64 94.95 98.14 2 HTML_MESSAGE 474566 85.75 89.77 85.00 3 RELAYCOUNTRY_US 440030 76.95 66.84 78.82 4 DKIM_SIGNED 413746 72.01 60.65 74.11 5 XM_DK_Pass 407658 70.83 58.97 73.02 6 DKIM_VALID 382499 65.29 47.89 68.51 7 XM_B_Unicode 368781 67.64 76.21 66.06 8 DKIM_VALID_AU 294705 49.92 34.43 52.79 9 BAYES_50 284172 47.96 32.04 50.90 10 XMListUnsubscribeExists 276413 49.82 51.47 49.51 11 XM_B_Unicode3 212807 37.05 31.30 38.12 12 T_TM2_M_HEADER_IN_MSG 161184 27.41 19.50 28.87 13 DKIM_VALID_EF 156795 27.05 21.44 28.09 14 HTML_FONT_LOW_CONTRAST 148085 25.84 22.15 26.52 15 RCVD_IN_MSPIKE_WL 137872 21.84 6.39 24.70 16 LOC_TINY_FONT_1 135609 24.68 26.78 24.29 17 RCVD_IN_MSPIKE_H2 131090 25.77 38.13 23.48 18 FVGT_m_MULTI_ODD 121039 21.88 22.93 21.68 19 XMSubLong 117705 20.73 18.84 21.08 20 MIME_HTML_ONLY 109952 23.19 42.05 19.69 21 T_KAM_HTML_FONT_INVALID 99939 17.79 17.17 17.90 22 ALL_TRUSTED 92690 14.23 1.39 16.60 23 RCVD_IN_MSPIKE_H3 81656 12.93 3.77 14.63 24 BAYES_00 80666 12.33 0.86 14.45 25 XM_Multi_Part_URI 77998 14.31 16.12 13.97 26 XM_Body_Dirty_Words 73322 13.61 16.21 13.13 27 XM_B_Unsub 64133 11.22 9.79 11.49 28 XM_DK_Undo_02 63646 16.12 41.64 11.40 29 TooManyTo_001 50144 8.45 5.56 8.98 30 RCVD_IN_MSPIKE_H4 48869 7.77 2.48 8.75 31 TR_XM_DK_Bayes 45461 6.92 0.32 8.14 32 TM2_M_URI_OPT_OUT 44794 7.21 2.80 8.02 33 XM_Evil_Numbers_Gen 43950 7.72 6.87 7.87 34 LotsOfNums_01 43007 7.67 7.52 7.70 35 TR_XM_DK_Bayes1 42115 6.39 0.15 7.54 36 LOTS_OF_MONEY 41609 7.92 10.42 7.45 37 IN_ZIMBRA_NJ_WHITELIST 41436 6.28 0.12 7.42 38 BAYES_99 41111 11.69 35.10 7.36 39 XM_DKIMWhitelistDomains 40905 6.19 0.02 7.33 40 ANY_BOUNCE_MESSAGE 40582 6.22 0.58 7.27 41 BOUNCE_MESSAGE 40576 6.22 0.57 7.27 42 XM_B_Phish_Phrases 38602 7.26 9.15 6.91 43 UNPARSEABLE_RELAY 38030 6.54 5.08 6.81 44 RCVD_IN_RP_SAFE 37283 5.71 0.50 6.68 45 HTML_IMAGE_RATIO_02 37045 7.88 14.60 6.64 46 TR_XM_DK_Bayes2 36840 5.59 0.12 6.60 47 BAYES_60 35149 6.77 9.31 6.30 48 RCVD_IN_RP_CERTIFIED 34583 5.28 0.35 6.19 49 XM_SendGrid 34031 5.77 4.00 6.10 50 RELAYCOUNTRY_META 33720 10.13 32.25 6.04 51 BAYES_999 32343 8.88 25.58 5.79 52 DKIM_INVALID 31247 6.72 12.77 5.60 53 HTML_IMAGE_RATIO_04 30790 5.29 4.04 5.52 54 XM_H_Long_From01 28752 5.16 5.24 5.15 55 BOTNET_IPINHOSTNAME 28414 6.77 15.83 5.09 56 BAYES_05 27845 4.32 0.70 4.99 57 MPART_ALT_DIFF 27519 4.84 4.37 4.93 58 XMStrtUSub 27001 4.51 2.75 4.84 59 MIME_QP_LONG_LINE 26707 4.38 2.19 4.78 60 BAYES_40 25629 4.15 1.79 4.59 61 T_TooManySym_01 25503 4.11 1.60 4.57 62 BAYES_20 25286 4.04 1.40 4.53 63 XM_PDF 25191 3.97 1.03 4.51 64 XMSexyCombo_05 23715 5.13 9.87 4.25 65 XMSubMetaSx_00 23381 4.38 5.40 4.19 66 XM_B_Unsub2 23331 3.86 2.12 4.18 67 BAYES_80 23265 5.36 11.81 4.17 68 RCVD_IN_IADB_LISTED 21813 3.40 0.69 3.91 69 TR_XM_PhishingBody 21443 4.21 6.17 3.84 70 TR_XM_DK_SendGrid 19474 3.20 1.62 3.49 71 BOTNET 19100 7.90 32.11 3.42 72 T_REMOTE_IMAGE 18942 6.29 21.96 3.39 73 RCVD_IN_IADB_SPF 18841 2.94 0.61 3.37 74 XMNumbers 18305 3.32 3.54 3.28 75 HTML_IMAGE_RATIO_06 17835 3.09 2.51 3.19 76 NO_DNS_FOR_FROM 17833 4.46 11.30 3.19 77 MIME_HTML_ONLY_MULTI 17789 2.91 1.41 3.19 78 RCVD_IN_IADB_SENDERID 16762 2.63 0.59 3.00 79 XM_UncommonTLD01 16739 4.68 13.80 3.00 80 RCVD_IN_IADB_DK 16199 2.54 0.60 2.90 81 UNTRUSTED_Relay 14839 5.88 23.31 2.66 82 BAYES_95 14683 3.31 6.99 2.63 83 RCVD_IN_IADB_VOUCHED 14269 2.19 0.20 2.56 84 XM_B_Phish66 13870 2.71 3.90 2.48 85 MAILING_LIST_MULTI 13200 2.20 1.28 2.36 86 T_TooManySym_02 13167 2.07 0.49 2.36 87 XM_H_Trusted_IP 12792 1.93 0.00 2.29 88 FROM_EXCESS_BASE64 12784 3.13 7.66 2.29 89 HTML_IMAGE_RATIO_08 12540 2.24 2.22 2.25 90 TooManyTo_002 12493 2.02 0.86 2.24 91 MIME_HTML_MOSTLY 11975 2.33 3.32 2.14 92 XM_CamelCaseFrm001 11295 2.11 2.59 2.02 93 HTML_MIME_NO_HTML_TAG 11018 5.00 21.37 1.97 94 XM_B_SpammyTLD 10512 2.20 3.89 1.88 95 XMDiploma_00 10272 1.90 2.23 1.84 96 RELAYCOUNTRY_CA 10088 2.47 6.04 1.81 97 XM_SPF_SoftFail 10023 2.43 5.85 1.80 98 KHOP_HELO_FCRDNS 9928 2.91 9.00 1.78 99 TVD_RCVD_IP 9381 1.52 0.65 1.68 100 XM_DK_Undo_01 9377 1.58 1.03 1.68 101 XM_B_COVIDMETA 9348 2.11 4.45 1.67 102 TR_Symld_Words 9296 1.65 1.60 1.67 103 RCVD_IN_IADB_OPTIN 9216 1.43 0.23 1.65 104 SUBJ_ALL_CAPS 8861 1.82 3.10 1.59 105 HELO_NODOT 8720 1.48 1.01 1.56 106 HELO_NO_DOMAIN 8717 1.47 0.99 1.56 107 T_XMDrugObfuBody_08 8281 1.65 2.58 1.48 108 USER_IN_DEF_DKIM_WL 8265 1.25 0.00 1.48 109 URI_HEX 8197 1.52 1.83 1.47 110 T_XMDrugObfuBody_14 8184 1.50 1.67 1.47 111 TooManyTo_003 7827 1.28 0.61 1.40 112 HELO_MISC_IP 7694 1.27 0.70 1.38 113 CK_HELO_DYNAMIC_SPLIT_IP 7677 1.34 1.15 1.38 114 XM_GoogleGroups 7443 1.19 0.41 1.33 115 RCVD_IN_MSPIKE_H5 7347 1.13 0.13 1.32 116 XMSexyCombo_01 7341 1.40 1.85 1.31 117 IN_HORDE_ADDRESS_BOOK 7315 1.17 0.43 1.31 118 INVALID_MSGID 7209 1.15 0.40 1.29 119 XM_OfRef6 6992 1.38 2.07 1.25 120 XM_UB50 6619 2.08 6.91 1.19 121 TO_MALFORMED 6468 1.18 1.27 1.16 122 XMCapTrack 6274 1.00 0.34 1.12 123 URI_TRY_3LD 6218 1.13 1.24 1.11 124 XMGappySubj_01 6176 0.97 0.24 1.11 125 XMStockSpam_06 6155 1.13 1.28 1.10 126 RCVD_IN_BL_SPAMCOP_NET 5994 4.61 23.75 1.07 127 DKIM_ADSP_CUSTOM_MED 5938 1.11 1.35 1.06 128 TM2_M_VERY_LONG_WORD 5926 1.40 3.25 1.06 129 TooManyTo_004 5846 0.96 0.51 1.05 130 T_OBFU_PDF_ATTACH 5667 0.88 0.12 1.02 131 T_FILL_THIS_FORM_SHORT 5570 1.00 1.00 1.00 132 XMBdyGiftCard01 5473 1.58 4.82 0.98 133 RELAYCOUNTRY_GB 5472 1.00 1.12 0.98 134 XM_H_Long_From02 5321 0.91 0.68 0.95 135 XMSubNoVowel 5275 1.10 1.93 0.94 136 XMGenDplmaNmb 5239 0.99 1.29 0.94 137 T_TooManySym_03 5239 0.81 0.12 0.94 138 XMBrknScrpt_02 5131 1.17 2.54 0.92 139 HTML_FONT_FACE_BAD 4874 0.85 0.75 0.87 140 XMBody_17 4821 1.15 2.70 0.86 141 TooManyTo_005 4802 0.79 0.42 0.86 142 SpammyFromTLD_01 4800 1.61 5.67 0.86 143 XMHTML_After_End 4788 0.94 1.38 0.86 144 RCVD_IN_MSPIKE_BL 4544 2.47 11.45 0.81 145 XMBody_95 4499 0.70 0.12 0.81 146 XM_ProductURIs 4490 0.79 0.70 0.80 147 NML_ADSP_CUSTOM_MED 4363 0.85 1.21 0.78 148 TR_MSPIKEBAYES00 4251 0.64 0.00 0.76 149 HTTPS_HTTP_MISMATCH 4138 0.72 0.59 0.74 150 XM_E_Blogspot 4087 0.63 0.10 0.73 151 TR_MetaPhish_Combo_01 3994 0.75 0.96 0.72 152 TR_XM_COVIDMETA4 3919 1.22 4.05 0.70 153 RELAYCOUNTRY_RU 3904 0.69 0.64 0.70 154 TR_BOTNET_NEGATE 3626 0.62 0.49 0.65 155 XM_RXBody 3599 0.61 0.44 0.64 156 T_XMDrugObfuBody_00 3562 0.74 1.31 0.64 157 XM_SPF_Unknown 3538 0.64 0.65 0.63 158 XMMoneyMeta_00 3474 0.62 0.60 0.62 159 XM_DIRTYINTL 3205 1.18 4.48 0.57 160 XM_H_PHPMailer 3202 0.65 1.08 0.57 161 XMSubMetaI_00 3147 0.60 0.80 0.56 162 TR_XM_COVIDMETA1 3037 0.81 2.26 0.54 163 XM_ShortIntro_01 3019 0.55 0.58 0.54 164 XMSexyCombo_04 2939 0.61 1.09 0.53 165 T_XMHurry_00 2917 0.59 0.95 0.52 166 DKIM_ADSP_NXDOMAIN 2912 0.69 1.62 0.52 167 XMPhish14 2899 0.58 0.88 0.52 168 HTML_IMAGE_ONLY_32 2844 0.47 0.23 0.51 169 TR_XM_PHPDW 2812 0.79 2.31 0.50 170 T_Symld_Words_02 2805 0.52 0.62 0.50 171 TR_XM_PHPForged 2722 0.77 2.31 0.49 172 TR_XM_FormFill2 2703 0.76 2.28 0.48 173 XM_H_PHPOS 2656 0.76 2.27 0.48 174 FORGED_GMAIL_RCVD 2648 0.57 1.07 0.47 175 FROM_GOV_DKIM_AU 2637 0.41 0.08 0.47 176 T_TooManySym_04 2629 0.40 0.04 0.47 177 PDS_OTHER_BAD_TLD 2538 0.77 2.46 0.45 178 XMNoVowels 2533 0.43 0.32 0.45 179 XM_B_REG_HTML 2514 0.41 0.18 0.45 180 RCVD_IN_SORBS_DUL 2493 0.45 0.48 0.45 181 MISSING_HEADERS 2490 0.48 0.69 0.45 182 HTML_TAG_BALANCE_BODY 2484 0.48 0.69 0.44 183 XMPhish30 2425 0.49 0.80 0.43 184 TR_XM_UnparsRelay 2406 0.78 2.68 0.43 185 FROM_GOV_SPOOF 2391 0.38 0.15 0.43 186 RCVD_IN_MSPIKE_L3 2357 0.83 3.05 0.42 187 RELAYCOUNTRY_AU 2325 0.80 2.86 0.42 188 TR_LOTS_OF_MONEY3 2324 0.50 0.97 0.42 189 XMPhish08 2322 0.46 0.70 0.42 190 NUMERIC_HTTP_ADDR 2317 0.42 0.48 0.42 191 SHORT_HELO_AND_INLINE_IMAGE 2316 0.36 0.09 0.41 192 HTML_IMAGE_ONLY_20 2311 0.42 0.43 0.41 193 HTML_IMAGE_ONLY_28 2293 0.40 0.32 0.41 194 XM_S_SubURI 2261 0.35 0.06 0.40 195 XMSubMetaSxObfu_03 2252 0.48 0.90 0.40 196 TM2_M_BODY_EMPTY 2223 0.35 0.10 0.40 197 T_XMDrugObfuBody_01 2216 0.34 0.06 0.40 198 DIET_1 2201 0.48 0.92 0.39 199 SUBJ_DOLLARS 2200 0.38 0.31 0.39 200 RELAYCOUNTRY_DE 2183 0.60 1.71 0.39 ----------------------------------------------------------------------