Email: 693393 Autolearn: 0 AvgScore: 0.80 AvgScanTime: 2.02 sec Spam: 105300 Autolearn: 0 AvgScore: 13.74 AvgScanTime: 3.91 sec Ham: 588093 Autolearn: 0 AvgScore: -1.52 AvgScanTime: 1.68 sec Time Spent Running SA: 388.26 hours Time Spent Processing Spam: 114.33 hours Time Spent Processing Ham: 273.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 101133 97.91 96.04 98.25 2 HTML_MESSAGE 94947 86.10 90.17 85.37 3 XM_B_Unicode 80088 68.71 76.06 67.40 4 DKIM_SIGNED 69907 73.26 66.39 74.50 5 RELAYCOUNTRY_US 69416 76.78 65.92 78.73 6 XM_DK_Pass 67816 71.95 64.40 73.31 7 XMListUnsubscribeExists 60906 52.44 57.84 51.47 8 DKIM_VALID 55048 66.32 52.28 68.84 9 XM_DK_Undo_02 48809 16.97 46.35 11.70 10 DKIM_VALID_AU 41012 50.35 38.95 52.39 11 XM_B_Unicode3 40559 39.00 38.52 39.09 12 BAYES_99 39223 11.79 37.25 7.23 13 BAYES_50 34844 48.69 33.09 51.48 14 RCVD_IN_MSPIKE_H2 34471 24.91 32.74 23.51 15 MIME_HTML_ONLY 34052 21.63 32.34 19.71 16 BOTNET 33398 7.89 31.72 3.62 17 LOC_TINY_FONT_1 31597 24.80 30.01 23.87 18 RELAYCOUNTRY_META 31543 9.55 29.96 5.89 19 BAYES_999 29946 9.18 28.44 5.73 20 FVGT_m_MULTI_ODD 27840 22.19 26.44 21.43 21 UNTRUSTED_Relay 25753 6.21 24.46 2.95 22 DKIM_VALID_EF 23962 26.57 22.76 27.26 23 HTML_FONT_LOW_CONTRAST 23614 25.99 22.43 26.63 24 XMSubLong 23346 21.32 22.17 21.16 25 T_TM2_M_HEADER_IN_MSG 23112 27.35 21.95 28.32 26 RCVD_IN_BL_SPAMCOP_NET 20832 4.24 19.78 1.45 27 T_KAM_HTML_FONT_INVALID 20198 18.67 19.18 18.58 28 XM_Multi_Part_URI 19028 14.92 18.07 14.36 29 BOTNET_IPINHOSTNAME 17705 7.23 16.81 5.52 30 HTML_IMAGE_RATIO_02 16841 8.22 15.99 6.83 31 XM_UncommonTLD01 16576 4.90 15.74 2.95 32 XM_Body_Dirty_Words 16460 13.21 15.63 12.78 33 RCVD_IN_PSBL 16340 2.46 15.52 0.12 34 DKIM_INVALID 14859 6.94 14.11 5.66 35 RCVD_IN_MSPIKE_BL 13031 2.54 12.38 0.78 36 XM_B_Phish_Phrases 12861 7.62 12.21 6.80 37 NO_DNS_FOR_FROM 12607 4.54 11.97 3.21 38 T_REMOTE_IMAGE 12483 4.61 11.85 3.31 39 LOTS_OF_MONEY 12480 8.28 11.85 7.64 40 HTML_MIME_NO_HTML_TAG 11886 3.50 11.29 2.10 41 BODY_URI_ONLY 10976 1.63 10.42 0.06 42 RCVD_IN_RP_RNBL 10777 1.66 10.23 0.12 43 XM_B_Unsub 10525 11.69 10.00 11.99 44 BAYES_80 10300 5.13 9.78 4.30 45 HTML_SHORT_LINK_IMG_1 10220 1.50 9.71 0.03 46 MPART_ALT_DIFF 9621 5.42 9.14 4.76 47 BAYES_60 9536 7.14 9.06 6.80 48 LotsOfNums_01 9360 8.38 8.89 8.29 49 XM_Evil_Numbers_Gen 9300 8.33 8.83 8.24 50 XMSexyCombo_05 8967 4.77 8.52 4.10 51 RCVD_IN_MSPIKE_L5 8888 1.51 8.44 0.27 52 XM_UB50 8219 2.29 7.81 1.30 53 XM_SPF_SoftFail 8102 2.62 7.69 1.71 54 FROM_EXCESS_BASE64 8057 3.33 7.65 2.56 55 SpammyFromTLD_01 7813 1.81 7.42 0.81 56 PDS_OTHER_BAD_TLD 7656 1.30 7.27 0.23 57 TR_XM_PhishingBody 7203 3.80 6.84 3.26 58 RCVD_IN_MSPIKE_WL 7199 22.82 6.84 25.68 59 BOTNET_NORDNS 7084 1.04 6.73 0.02 60 RELAYCOUNTRY_CA 6745 2.42 6.41 1.71 61 KHOP_HELO_FCRDNS 6667 2.40 6.33 1.70 62 XMSubMetaSx_00 6452 4.23 6.13 3.89 63 XM_UB99 6032 0.88 5.73 0.01 64 UNPARSEABLE_RELAY 5802 6.61 5.51 6.80 65 HTML_IMAGE_ONLY_12 5798 1.03 5.51 0.23 66 XMSubGiftCard1 5652 0.85 5.37 0.04 67 XMSubGiftCard2 5592 0.82 5.31 0.01 68 T_XMDrugObfuBody_08 5558 2.48 5.28 1.98 69 BAYES_95 5324 3.03 5.06 2.66 70 XM_H_Long_From01 5315 5.29 5.05 5.33 71 TooManyTo_001 5128 7.31 4.87 7.74 72 XM_B_Phish66 4744 2.15 4.51 1.72 73 XMDiploma_00 4730 1.93 4.49 1.47 74 HTML_IMAGE_ONLY_08 4711 0.77 4.47 0.10 75 XM_B_COVIDMETA 4685 1.91 4.45 1.45 76 XM_SendGrid 4578 5.90 4.35 6.18 77 XM_UB999 4577 0.66 4.35 0.00 78 XM_UB60 4569 0.98 4.34 0.37 79 TR_XM_COVIDMETA4 4483 1.29 4.26 0.75 80 HTML_IMAGE_RATIO_04 4424 5.37 4.20 5.58 81 LOCALPART_IN_SUBJECT 4394 0.66 4.17 0.03 82 RCVD_IN_MSPIKE_H3 4365 13.41 4.15 15.06 83 MIME_HTML_MOSTLY 4242 2.60 4.03 2.34 84 XM_B_SpammyTLD 4195 2.15 3.98 1.82 85 TR_XM_INV_DKIM 4186 0.79 3.98 0.22 86 XM_URI_RBL 4043 0.78 3.84 0.24 87 XM_DIRTYINTL 3936 1.06 3.74 0.58 88 XMNumbers 3853 3.34 3.66 3.28 89 XMStrtUSub 3774 4.33 3.58 4.47 90 MPART_ALT_DIFF_COUNT 3657 0.98 3.47 0.53 91 TR_XM_MaxWHORU 3635 0.58 3.45 0.06 92 XM_UB80 3522 0.56 3.34 0.06 93 URIBL_SBL_A 3498 0.66 3.32 0.18 94 TVD_SPACE_RATIO_MINFP 3478 0.51 3.30 0.01 95 XMBody_17 3459 1.14 3.28 0.75 96 XM_B_SEO 3358 0.59 3.19 0.13 97 RCVD_IN_MSPIKE_L3 3298 0.86 3.13 0.45 98 TR_XM_UnparsRelay 3247 0.89 3.08 0.50 99 HTML_IMAGE_RATIO_06 3242 3.35 3.08 3.40 100 XMSubNoVowel 3213 1.16 3.05 0.82 101 TM2_M_URI_OPT_OUT 3097 7.36 2.94 8.15 102 HK_RANDOM_FROM 3039 0.54 2.89 0.12 103 HELO_NODOT 2965 1.72 2.82 1.52 104 TR_XM_MaxBayes 2903 0.45 2.76 0.03 105 HELO_NO_DOMAIN 2885 1.71 2.74 1.52 106 XM_CamelCaseFrm001 2872 2.10 2.73 1.98 107 HTML_IMAGE_RATIO_08 2839 2.55 2.70 2.53 108 PDS_BTC_ID 2777 0.43 2.64 0.03 109 TR_Mismatch_TLD_02 2771 0.48 2.63 0.09 110 RCVD_IN_MSPIKE_H4 2708 8.13 2.57 9.12 111 T_FILL_THIS_FORM_SHORT 2679 1.07 2.54 0.81 112 BITCOIN_SPAM_03 2677 0.39 2.54 0.00 113 TR_LOTS_OF_MONEY3 2671 1.13 2.54 0.88 114 XMBrknScrpt_02 2633 1.22 2.50 0.99 115 TR_XM_PHPDW 2633 0.74 2.50 0.43 116 TR_XM_PHPForged 2616 0.72 2.48 0.40 117 DATE_IN_PAST_03_06 2604 0.48 2.47 0.12 118 SpammyFromTLD_02 2594 0.66 2.46 0.33 119 TR_XM_FormFill2 2589 0.71 2.46 0.40 120 XM_H_PHPOS 2577 0.71 2.45 0.39 121 MIME_QP_LONG_LINE 2535 4.96 2.41 5.42 122 RELAYCOUNTRY_FR 2534 0.67 2.41 0.35 123 TO_NO_BRKTS_HTML_ONLY 2520 0.46 2.39 0.12 124 TR_XM_COVIDMETA1 2505 0.68 2.38 0.38 125 XM_OfRef6 2462 1.33 2.34 1.15 126 MIME_CHARSET_FARAWAY 2438 0.46 2.32 0.13 127 TM2_M_VERY_LONG_WORD 2372 1.35 2.25 1.19 128 SUBJ_ALL_CAPS 2327 1.62 2.21 1.52 129 NO_FM_NAME_IP_HOSTN 2315 0.34 2.20 0.00 130 XM_B_Unsub2 2241 4.30 2.13 4.69 131 BAYES_40 2161 4.03 2.05 4.38 132 RELAYCOUNTRY_DE 2099 0.69 1.99 0.45 133 URI_TRY_3LD 2088 1.41 1.98 1.31 134 TR_Symld_Words 2085 1.80 1.98 1.76 135 TR_XM_MaxSPIKE 2073 0.34 1.97 0.05 136 HTML_IMAGE_ONLY_28 2061 0.64 1.96 0.40 137 RELAYCOUNTRY_JP 2035 0.33 1.93 0.04 138 TR_XM_DK_SendGrid 2020 3.23 1.92 3.46 139 ALL_TRUSTED 1983 14.20 1.88 16.40 140 MISSING_HEADERS 1971 0.79 1.87 0.60 141 TR_XM_RelayPhish 1944 0.48 1.85 0.24 142 T_TooManySym_01 1930 3.87 1.83 4.23 143 URI_HEX 1893 1.61 1.80 1.58 144 XMSexyCombo_01 1889 0.80 1.79 0.62 145 IMG_ONLY_FM_DOM_INFO 1884 0.27 1.79 0.00 146 RELAYCOUNTRY_AU 1835 0.64 1.74 0.44 147 RELAYCOUNTRY_IN 1782 0.35 1.69 0.11 148 MIME_HTML_ONLY_MULTI 1744 2.66 1.66 2.83 149 T_XMDrugObfuBody_14 1737 1.55 1.65 1.53 150 TO_NAME_SUBJ_NO_RDNS 1729 0.25 1.64 0.00 151 FROM_SUSPICIOUS_NTLD 1726 0.28 1.64 0.04 152 RELAYCOUNTRY_RU 1691 0.69 1.61 0.52 153 XM_UB95 1663 0.26 1.58 0.02 154 XM_H_Long_From02 1661 1.40 1.58 1.37 155 XMHTML_After_End 1632 0.91 1.55 0.80 156 FROM_SUSPICIOUS_NTLD_FP 1602 0.26 1.52 0.03 157 XM_B_Crypto 1600 0.36 1.52 0.16 158 BAYES_20 1587 3.82 1.51 4.24 159 DKIM_ADSP_CUSTOM_MED 1584 1.05 1.50 0.96 160 LOADSA_MONEY_COMBO 1581 0.29 1.50 0.07 161 T_XMHurry_00 1577 0.70 1.50 0.56 162 LONG_JUNK_URI 1576 0.27 1.50 0.05 163 FSL_HELO_NON_FQDN_1 1573 0.24 1.49 0.01 164 TVD_SPACE_RATIO 1565 0.50 1.49 0.32 165 RDNS_DYNAMIC 1557 0.48 1.48 0.31 166 XFER_LOTSA_MONEY 1520 0.26 1.44 0.05 167 ONLINE_PHARMACY 1484 0.29 1.41 0.09 168 XMGppyBdWords 1483 0.38 1.41 0.19 169 T_XMDrugObfuBody_00 1480 0.71 1.41 0.59 170 TVD_VISIT_PHARMA 1471 0.29 1.40 0.09 171 NML_ADSP_CUSTOM_MED 1465 0.83 1.39 0.73 172 XM_RXBody 1419 0.51 1.35 0.36 173 MIMEOLE_DIRECT_TO_MX 1414 0.21 1.34 0.00 174 HK_RANDOM_REPLYTO 1406 0.39 1.34 0.22 175 RCVD_IN_RP_SAFE 1397 5.99 1.33 6.82 176 RELAYCOUNTRY_NL 1385 0.40 1.32 0.23 177 OBFU_BITCOIN 1377 0.20 1.31 0.00 178 FUZZY_BITCOIN 1377 0.20 1.31 0.00 179 XMBody_78 1374 0.52 1.30 0.38 180 MAILING_LIST_MULTI 1364 2.02 1.30 2.15 181 XMGenDplmaNmb 1353 0.93 1.28 0.87 182 PDS_FROM_2_EMAILS 1347 0.22 1.28 0.03 183 FROM_2_EMAILS_SHORT 1309 0.19 1.24 0.00 184 FROM_LOCAL_NOVOWEL 1301 0.21 1.24 0.03 185 BAYES_00 1297 12.07 1.23 14.01 186 DATE_IN_PAST_06_12 1296 0.25 1.23 0.07 187 XM_BadFromFormat 1295 0.34 1.23 0.18 188 XMStockSpam_06 1278 1.03 1.21 1.00 189 HDR_ORDER_FTSDMCXX_DIRECT 1269 0.18 1.21 0.00 190 LongTLD 1265 0.35 1.20 0.20 191 HTML_FONT_TINY_NORDNS 1257 0.44 1.19 0.31 192 SUSP_UTF8_WORD_MANY 1251 0.18 1.19 0.00 193 RELAYCOUNTRY_RO 1247 0.20 1.18 0.02 194 TR_XM_Crypto2 1221 0.18 1.16 0.01 195 FVGT_m_MULTI_ODD_EMAIL 1203 0.21 1.14 0.04 196 XM_PDF 1196 3.37 1.14 3.78 197 TR_XM_SB_Phish 1194 0.33 1.13 0.19 198 XM_JunkDunk 1181 0.17 1.12 0.00 199 FORGED_GMAIL_RCVD 1180 0.54 1.12 0.43 200 DIET_1 1165 0.52 1.11 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 577779 97.91 96.04 98.25 2 HTML_MESSAGE 502047 86.10 90.17 85.37 3 RELAYCOUNTRY_US 462979 76.78 65.92 78.73 4 DKIM_SIGNED 438105 73.26 66.39 74.50 5 XM_DK_Pass 431108 71.95 64.40 73.31 6 DKIM_VALID 404827 66.32 52.28 68.84 7 XM_B_Unicode 396366 68.71 76.06 67.40 8 DKIM_VALID_AU 308092 50.35 38.95 52.39 9 BAYES_50 302755 48.69 33.09 51.48 10 XMListUnsubscribeExists 302700 52.44 57.84 51.47 11 XM_B_Unicode3 229895 39.00 38.52 39.09 12 T_TM2_M_HEADER_IN_MSG 166527 27.35 21.95 28.32 13 DKIM_VALID_EF 160307 26.57 22.76 27.26 14 HTML_FONT_LOW_CONTRAST 156629 25.99 22.43 26.63 15 RCVD_IN_MSPIKE_WL 151020 22.82 6.84 25.68 16 LOC_TINY_FONT_1 140389 24.80 30.01 23.87 17 RCVD_IN_MSPIKE_H2 138234 24.91 32.74 23.51 18 FVGT_m_MULTI_ODD 126026 22.19 26.44 21.43 19 XMSubLong 124467 21.32 22.17 21.16 20 MIME_HTML_ONLY 115895 21.63 32.34 19.71 21 T_KAM_HTML_FONT_INVALID 109286 18.67 19.18 18.58 22 ALL_TRUSTED 96465 14.20 1.88 16.40 23 RCVD_IN_MSPIKE_H3 88593 13.41 4.15 15.06 24 XM_Multi_Part_URI 84438 14.92 18.07 14.36 25 BAYES_00 82374 12.07 1.23 14.01 26 XM_Body_Dirty_Words 75158 13.21 15.63 12.78 27 XM_B_Unsub 70500 11.69 10.00 11.99 28 XM_DK_Undo_02 68835 16.97 46.35 11.70 29 RCVD_IN_MSPIKE_H4 53660 8.13 2.57 9.12 30 LotsOfNums_01 48729 8.38 8.89 8.29 31 XM_Evil_Numbers_Gen 48456 8.33 8.83 8.24 32 TM2_M_URI_OPT_OUT 47954 7.36 2.94 8.15 33 TR_XM_DK_Bayes 47652 6.93 0.41 8.10 34 TooManyTo_001 45537 7.31 4.87 7.74 35 LOTS_OF_MONEY 44957 8.28 11.85 7.64 36 TR_XM_DK_Bayes1 44390 6.44 0.23 7.55 37 IN_ZIMBRA_NJ_WHITELIST 43619 6.30 0.06 7.42 38 ANY_BOUNCE_MESSAGE 43090 6.32 0.67 7.33 39 BOUNCE_MESSAGE 43084 6.32 0.67 7.33 40 BAYES_99 42529 11.79 37.25 7.23 41 HTML_IMAGE_RATIO_02 40189 8.22 15.99 6.83 42 RCVD_IN_RP_SAFE 40112 5.99 1.33 6.82 43 UNPARSEABLE_RELAY 40008 6.61 5.51 6.80 44 BAYES_60 39995 7.14 9.06 6.80 45 XM_B_Phish_Phrases 39975 7.62 12.21 6.80 46 TR_XM_DK_Bayes2 39922 5.79 0.21 6.79 47 RCVD_IN_RP_CERTIFIED 37425 5.54 0.95 6.36 48 XM_DKIMWhitelistDomains 37010 5.34 0.01 6.29 49 XM_SendGrid 36345 5.90 4.35 6.18 50 RELAYCOUNTRY_META 34656 9.55 29.96 5.89 51 BAYES_999 33685 9.18 28.44 5.73 52 DKIM_INVALID 33278 6.94 14.11 5.66 53 HTML_IMAGE_RATIO_04 32795 5.37 4.20 5.58 54 BOTNET_IPINHOSTNAME 32438 7.23 16.81 5.52 55 MIME_QP_LONG_LINE 31855 4.96 2.41 5.42 56 XM_H_Long_From01 31360 5.29 5.05 5.33 57 BAYES_05 28497 4.24 0.84 4.85 58 MPART_ALT_DIFF 27995 5.42 9.14 4.76 59 RCVD_IN_IADB_LISTED 27774 4.12 0.76 4.72 60 XM_B_Unsub2 27607 4.30 2.13 4.69 61 XMStrtUSub 26262 4.33 3.58 4.47 62 BAYES_40 25757 4.03 2.05 4.38 63 BAYES_80 25283 5.13 9.78 4.30 64 BAYES_20 24930 3.82 1.51 4.24 65 T_TooManySym_01 24876 3.87 1.83 4.23 66 RCVD_IN_IADB_SPF 24218 3.60 0.68 4.12 67 XMSexyCombo_05 24125 4.77 8.52 4.10 68 XMSubMetaSx_00 22867 4.23 6.13 3.89 69 XM_PDF 22205 3.37 1.14 3.78 70 RCVD_IN_IADB_SENDERID 21764 3.24 0.66 3.70 71 BOTNET 21278 7.89 31.72 3.62 72 RCVD_IN_IADB_DK 21117 3.15 0.67 3.59 73 TR_XM_DK_SendGrid 20343 3.23 1.92 3.46 74 HTML_IMAGE_RATIO_06 19993 3.35 3.08 3.40 75 T_REMOTE_IMAGE 19494 4.61 11.85 3.31 76 XMNumbers 19302 3.34 3.66 3.28 77 TR_XM_PhishingBody 19146 3.80 6.84 3.26 78 NO_DNS_FOR_FROM 18883 4.54 11.97 3.21 79 XM_UncommonTLD01 17367 4.90 15.74 2.95 80 UNTRUSTED_Relay 17320 6.21 24.46 2.95 81 MIME_HTML_ONLY_MULTI 16667 2.66 1.66 2.83 82 RCVD_IN_IADB_VOUCHED 16597 2.43 0.24 2.82 83 BAYES_95 15672 3.03 5.06 2.66 84 FROM_EXCESS_BASE64 15029 3.33 7.65 2.56 85 HTML_IMAGE_RATIO_08 14871 2.55 2.70 2.53 86 MIME_HTML_MOSTLY 13776 2.60 4.03 2.34 87 XM_H_Trusted_IP 13230 1.91 0.00 2.25 88 MAILING_LIST_MULTI 12671 2.02 1.30 2.15 89 T_TooManySym_02 12428 1.87 0.50 2.11 90 HTML_MIME_NO_HTML_TAG 12366 3.50 11.29 2.10 91 XM_CamelCaseFrm001 11663 2.10 2.73 1.98 92 T_XMDrugObfuBody_08 11624 2.48 5.28 1.98 93 RCVD_IN_IADB_OPTIN 10831 1.60 0.25 1.84 94 XM_B_SpammyTLD 10721 2.15 3.98 1.82 95 TooManyTo_002 10507 1.65 0.88 1.79 96 TR_Symld_Words 10370 1.80 1.98 1.76 97 XM_B_Phish66 10133 2.15 4.51 1.72 98 XM_SPF_SoftFail 10079 2.62 7.69 1.71 99 RELAYCOUNTRY_CA 10036 2.42 6.41 1.71 100 TVD_RCVD_IP 9979 1.51 0.49 1.70 101 KHOP_HELO_FCRDNS 9978 2.40 6.33 1.70 102 URI_HEX 9283 1.61 1.80 1.58 103 XM_DK_Undo_01 9061 1.47 1.10 1.54 104 T_XMDrugObfuBody_14 8985 1.55 1.65 1.53 105 HELO_NODOT 8943 1.72 2.82 1.52 106 HELO_NO_DOMAIN 8941 1.71 2.74 1.52 107 SUBJ_ALL_CAPS 8924 1.62 2.21 1.52 108 RCVD_IN_MSPIKE_H5 8767 1.28 0.12 1.49 109 XMDiploma_00 8655 1.93 4.49 1.47 110 RCVD_IN_BL_SPAMCOP_NET 8556 4.24 19.78 1.45 111 XM_B_COVIDMETA 8538 1.91 4.45 1.45 112 XM_H_Long_From02 8049 1.40 1.58 1.37 113 HELO_MISC_IP 7921 1.24 0.66 1.35 114 CK_HELO_DYNAMIC_SPLIT_IP 7919 1.29 0.96 1.35 115 URI_TRY_3LD 7696 1.41 1.98 1.31 116 XM_UB50 7647 2.29 7.81 1.30 117 IN_HORDE_ADDRESS_BOOK 7579 1.13 0.23 1.29 118 INVALID_MSGID 7467 1.14 0.39 1.27 119 TM2_M_VERY_LONG_WORD 6980 1.35 2.25 1.19 120 TooManyTo_003 6959 1.10 0.66 1.18 121 XM_GoogleGroups 6908 1.06 0.43 1.17 122 XM_OfRef6 6760 1.33 2.34 1.15 123 XMGappySubj_01 6485 0.98 0.28 1.10 124 TO_MALFORMED 6473 0.94 0.03 1.10 125 USER_IN_DEF_DKIM_WL 6389 0.92 0.00 1.09 126 XMStockSpam_06 5883 1.03 1.21 1.00 127 XMBrknScrpt_02 5799 1.22 2.50 0.99 128 XM_ProductURIs 5769 0.93 0.66 0.98 129 DKIM_ADSP_CUSTOM_MED 5675 1.05 1.50 0.96 130 HTML_FONT_FACE_BAD 5647 0.91 0.61 0.96 131 XMBdyGiftCard01 5646 0.92 0.71 0.96 132 XMCapTrack 5490 0.86 0.43 0.93 133 RELAYCOUNTRY_GB 5181 0.90 1.02 0.88 134 TR_LOTS_OF_MONEY3 5156 1.13 2.54 0.88 135 T_TooManySym_03 5138 0.76 0.13 0.87 136 XMGenDplmaNmb 5098 0.93 1.28 0.87 137 TooManyTo_004 5081 0.82 0.59 0.86 138 TR_MetaPhish_Combo_01 5060 0.87 0.95 0.86 139 XMSubNoVowel 4838 1.16 3.05 0.82 140 T_FILL_THIS_FORM_SHORT 4748 1.07 2.54 0.81 141 SpammyFromTLD_01 4736 1.81 7.42 0.81 142 XMHTML_After_End 4677 0.91 1.55 0.80 143 TR_MSPIKEBAYES00 4641 0.67 0.00 0.79 144 RCVD_IN_MSPIKE_BL 4577 2.54 12.38 0.78 145 T_OBFU_PDF_ATTACH 4480 0.67 0.18 0.76 146 TR_XM_COVIDMETA4 4431 1.29 4.26 0.75 147 XMBody_17 4418 1.14 3.28 0.75 148 TR_BOTNET_NEGATE 4352 0.71 0.51 0.74 149 NML_ADSP_CUSTOM_MED 4286 0.83 1.39 0.73 150 XMMoneyMeta_00 4276 0.74 0.80 0.73 151 TooManyTo_005 4226 0.67 0.43 0.72 152 DKIM_ADSP_NXDOMAIN 3701 0.65 0.77 0.63 153 XMBody_95 3685 0.55 0.15 0.63 154 HTTPS_HTTP_MISMATCH 3632 0.62 0.63 0.62 155 XMSexyCombo_01 3628 0.80 1.79 0.62 156 HTML_IMAGE_ONLY_20 3622 0.59 0.43 0.62 157 XM_SPF_Unknown 3532 0.63 0.81 0.60 158 MISSING_HEADERS 3507 0.79 1.87 0.60 159 T_XMDrugObfuBody_00 3469 0.71 1.41 0.59 160 XMSubMetaSxObfu_03 3420 0.61 0.75 0.58 161 XM_DIRTYINTL 3409 1.06 3.74 0.58 162 XMSubMetaI_00 3325 0.60 0.76 0.57 163 T_Symld_Words_02 3322 0.56 0.55 0.56 164 T_XMHurry_00 3294 0.70 1.50 0.56 165 FROM_GOV_DKIM_AU 3248 0.48 0.08 0.55 166 MPART_ALT_DIFF_COUNT 3108 0.98 3.47 0.53 167 XMPhish30 3081 0.57 0.82 0.52 168 RELAYCOUNTRY_RU 3059 0.69 1.61 0.52 169 XMPhish14 3052 0.59 0.98 0.52 170 XMOemUri 2954 0.53 0.66 0.50 171 TR_XM_UnparsRelay 2931 0.89 3.08 0.50 172 XM_ShortIntro_01 2893 0.49 0.49 0.49 173 NUMERIC_HTTP_ADDR 2877 0.51 0.62 0.49 174 XMPhish08 2863 0.52 0.71 0.49 175 HTML_TAG_BALANCE_BODY 2700 0.50 0.73 0.46 176 RCVD_IN_MSPIKE_L3 2663 0.86 3.13 0.45 177 RELAYCOUNTRY_DE 2661 0.69 1.99 0.45 178 XM_B_REG_HTML 2635 0.41 0.18 0.45 179 T_TooManySym_04 2625 0.39 0.07 0.45 180 XM_H_PHPMailer 2609 0.52 0.94 0.44 181 XMNoVowels 2605 0.45 0.48 0.44 182 RELAYCOUNTRY_AU 2601 0.64 1.74 0.44 183 FORGED_GMAIL_RCVD 2548 0.54 1.12 0.43 184 XM_B_COPY_HTML 2507 0.42 0.39 0.43 185 XMHTMLBadTable_001 2505 0.45 0.59 0.43 186 TR_XM_PHPDW 2502 0.74 2.50 0.43 187 DIET_1 2439 0.52 1.11 0.41 188 TM2_M_BODY_EMPTY 2429 0.42 0.46 0.41 189 XMLngstWrd_00 2403 0.42 0.47 0.41 190 XM_Combo_Sbj 2383 0.41 0.45 0.41 191 HTML_IMAGE_ONLY_28 2377 0.64 1.96 0.40 192 FROM_GOV_SPOOF 2375 0.37 0.18 0.40 193 TR_XM_PHPForged 2354 0.72 2.48 0.40 194 TM2_M_A_HREF_HREF 2350 0.45 0.71 0.40 195 TR_XM_FormFill2 2345 0.71 2.46 0.40 196 XM_S_SubURI 2332 0.36 0.12 0.40 197 XM_H_PHPOS 2314 0.71 2.45 0.39 198 XMBody_78 2231 0.52 1.30 0.38 199 TR_XM_COVIDMETA1 2228 0.68 2.38 0.38 200 XM_UB60 2194 0.98 4.34 0.37 ----------------------------------------------------------------------