Email: 695425 Autolearn: 0 AvgScore: 0.69 AvgScanTime: 1.95 sec Spam: 97057 Autolearn: 0 AvgScore: 13.14 AvgScanTime: 3.99 sec Ham: 598368 Autolearn: 0 AvgScore: -1.33 AvgScanTime: 1.62 sec Time Spent Running SA: 377.28 hours Time Spent Processing Spam: 107.68 hours Time Spent Processing Ham: 269.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 94750 98.12 97.62 98.21 2 HTML_MESSAGE 90440 84.55 93.18 83.15 3 DKIM_SIGNED 66962 71.79 68.99 72.25 4 XM_B_Unicode 66464 66.50 68.48 66.18 5 RELAYCOUNTRY_US 65356 75.27 67.34 76.55 6 XM_DK_Pass 64532 70.48 66.49 71.12 7 XMListUnsubscribeExists 60013 52.39 61.83 50.85 8 DKIM_VALID 52242 65.18 53.83 67.02 9 XM_DK_Undo_02 46542 16.68 47.95 11.60 10 BAYES_99 39679 12.16 40.88 7.50 11 DKIM_VALID_AU 37650 49.20 38.79 50.89 12 BAYES_50 34991 46.70 36.05 48.43 13 XM_B_Unicode3 32675 37.44 33.67 38.05 14 BAYES_999 30870 9.55 31.81 5.95 15 MIME_HTML_ONLY 30187 21.37 31.10 19.79 16 LOC_TINY_FONT_1 29322 23.93 30.21 22.91 17 BOTNET 29189 6.92 30.07 3.16 18 RELAYCOUNTRY_META 28089 9.14 28.94 5.93 19 FVGT_m_MULTI_ODD 25905 21.82 26.69 21.03 20 RCVD_IN_MSPIKE_H2 23905 23.69 24.63 23.54 21 HTML_FONT_LOW_CONTRAST 23864 25.77 24.59 25.96 22 T_TM2_M_HEADER_IN_MSG 23162 26.51 23.86 26.94 23 DKIM_VALID_EF 22504 25.33 23.19 25.68 24 T_KAM_HTML_FONT_INVALID 21499 18.77 22.15 18.22 25 XMSubLong 21291 20.07 21.94 19.76 26 XM_UncommonTLD01 20224 5.41 20.84 2.91 27 UNTRUSTED_Relay 18340 4.95 18.90 2.69 28 XM_Multi_Part_URI 17929 15.73 18.47 15.28 29 LOTS_OF_MONEY 17220 8.66 17.74 7.18 30 XM_Body_Dirty_Words 16672 13.37 17.18 12.75 31 BOTNET_IPINHOSTNAME 15568 6.68 16.04 5.16 32 DKIM_INVALID 14720 6.62 15.17 5.23 33 XM_B_Phish_Phrases 11729 7.97 12.08 7.30 34 NO_DNS_FOR_FROM 11643 4.18 12.00 2.92 35 RCVD_IN_BL_SPAMCOP_NET 11208 2.82 11.55 1.40 36 RCVD_IN_MSPIKE_BL 11011 2.24 11.34 0.76 37 RELAYCOUNTRY_CA 10684 3.10 11.01 1.82 38 XM_B_Unsub 10352 10.06 10.67 9.96 39 LotsOfNums_01 9761 8.99 10.06 8.82 40 XMSexyCombo_05 8854 4.89 9.12 4.20 41 BOTNET_NORDNS 8769 1.28 9.03 0.02 42 XM_OfRef6 8611 2.43 8.87 1.38 43 HTML_MIME_NO_HTML_TAG 8568 3.27 8.83 2.37 44 XM_SPF_SoftFail 8363 2.65 8.62 1.68 45 XM_Evil_Numbers_Gen 8258 8.08 8.51 8.01 46 FROM_SUSPICIOUS_NTLD 7954 1.18 8.20 0.04 47 SpammyFromTLD_02 7877 1.42 8.12 0.34 48 FROM_EXCESS_BASE64 7842 3.42 8.08 2.67 49 RCVD_IN_RP_RNBL 7762 1.18 8.00 0.07 50 T_REMOTE_IMAGE 7700 3.91 7.93 3.26 51 SpammyFromTLD_01 7651 1.82 7.88 0.84 52 RCVD_IN_MSPIKE_WL 7340 22.39 7.56 24.80 53 HTML_IMAGE_RATIO_02 7248 6.40 7.47 6.23 54 FROM_SUSPICIOUS_NTLD_FP 7229 1.06 7.45 0.03 55 BAYES_80 7012 4.86 7.22 4.48 56 RCVD_IN_MSPIKE_L5 6853 1.21 7.06 0.26 57 RCVD_IN_PSBL 6770 1.01 6.98 0.04 58 XM_BadFromFormat 6647 1.09 6.85 0.16 59 XM_UB99 6541 0.95 6.74 0.01 60 TR_XM_PhishingBody 6506 3.75 6.70 3.28 61 BODY_URI_ONLY 6399 0.97 6.59 0.06 62 FROM_MISSP_REPLYTO 6333 0.92 6.53 0.01 63 DKIM_ADSP_NXDOMAIN 6220 1.29 6.41 0.46 64 HTML_TAG_BALANCE_CENTER 5868 0.94 6.05 0.12 65 UNPARSEABLE_RELAY 5844 7.11 6.02 7.28 66 HDRS_MISSP 5808 0.88 5.98 0.06 67 BAYES_60 5794 6.37 5.97 6.44 68 LOADSA_MONEY_COMBO 5777 0.89 5.95 0.07 69 XFER_LOTSA_MONEY 5673 0.86 5.85 0.05 70 XMSubMetaSx_00 5613 3.76 5.78 3.44 71 TooManyTo_001 5549 7.59 5.72 7.90 72 XM_H_Long_From01 5310 5.37 5.47 5.35 73 ADVANCE_FEE_4_NEW_MONEY 5269 0.81 5.43 0.06 74 XM_UB999 5133 0.74 5.29 0.00 75 XM_UB50 5105 1.89 5.26 1.34 76 MPART_ALT_DIFF 5016 4.86 5.17 4.80 77 MONEY_FORM_SHORT 4935 0.77 5.08 0.07 78 BAYES_95 4796 2.95 4.94 2.63 79 XM_B_COVIDMETA 4793 2.12 4.94 1.66 80 HELO_NODOT 4772 1.93 4.92 1.44 81 HELO_NO_DOMAIN 4771 1.92 4.92 1.44 82 MISSING_HEADERS 4585 1.04 4.72 0.44 83 TR_XM_COVIDMETA4 4491 1.27 4.63 0.73 84 HTML_IMAGE_RATIO_04 4477 4.98 4.61 5.04 85 TR_XM_INV_DKIM 4466 0.79 4.60 0.17 86 XM_SendGrid 4403 6.13 4.54 6.39 87 REPLYTO_WITHOUT_TO_CC 4363 0.72 4.50 0.10 88 RCVD_IN_MSPIKE_H3 4305 13.04 4.44 14.44 89 TR_LOTS_OF_MONEY1 4201 0.67 4.33 0.08 90 XMBody_17 4128 1.47 4.25 1.02 91 XMNumbers 4108 3.46 4.23 3.33 92 T_XMDrugObfuBody_08 4081 1.86 4.20 1.48 93 XM_B_Phish66 3964 2.21 4.08 1.90 94 XM_B_SpammyTLD 3795 2.29 3.91 2.03 95 URIBL_SBL_A 3772 0.69 3.89 0.18 96 TR_XM_MaxWHORU 3550 0.56 3.66 0.06 97 XMDiploma_00 3494 1.96 3.60 1.70 98 RCVD_IN_MSPIKE_L3 3479 0.86 3.58 0.42 99 XM_DIRTYINTL 3379 1.06 3.48 0.67 100 TR_XM_MaxBayes 3222 0.50 3.32 0.04 101 TR_XM_UnparsRelay 3086 1.03 3.18 0.68 102 TM2_M_URI_OPT_OUT 3056 9.70 3.15 10.77 103 HTML_IMAGE_ONLY_16 3042 0.65 3.13 0.24 104 XM_URI_RBL 3036 0.62 3.13 0.22 105 RCVD_IN_MSPIKE_H4 2862 8.04 2.95 8.87 106 XMStrtUSub 2743 4.38 2.83 4.63 107 HTML_IMAGE_RATIO_06 2712 3.69 2.79 3.84 108 T_FILL_THIS_FORM_SHORT 2697 1.14 2.78 0.88 109 IMG_ONLY_FM_DOM_INFO 2661 0.38 2.74 0.00 110 TR_XM_PHPDW 2622 0.76 2.70 0.44 111 TR_XM_PHPForged 2619 0.75 2.70 0.43 112 TR_XM_FormFill2 2595 0.74 2.67 0.43 113 XM_B_Unsub2 2591 2.91 2.67 2.95 114 XM_H_PHPOS 2588 0.74 2.67 0.42 115 MIME_QP_LONG_LINE 2503 4.96 2.58 5.35 116 MIME_HTML_MOSTLY 2498 2.29 2.57 2.24 117 XMBrknScrpt_02 2477 1.00 2.55 0.75 118 XM_JunkDunk 2352 0.34 2.42 0.00 119 XM_UB80 2308 0.41 2.38 0.09 120 KHOP_HELO_FCRDNS 2306 1.77 2.38 1.67 121 RELAYCOUNTRY_FR 2300 0.64 2.37 0.36 122 RELAYCOUNTRY_GB 2291 1.05 2.36 0.84 123 XM_CamelCaseFrm001 2233 1.96 2.30 1.90 124 DATE_IN_PAST_03_06 2195 0.43 2.26 0.13 125 XM_B_SEO 2183 0.52 2.25 0.24 126 T_TooManySym_01 2181 3.77 2.25 4.02 127 XM_Combo_Sbj 2177 0.59 2.24 0.33 128 HTML_IMAGE_RATIO_08 2163 2.39 2.23 2.42 129 SUBJ_ALL_CAPS 2129 1.66 2.19 1.57 130 TR_XM_MaxSPIKE 2092 0.34 2.16 0.05 131 ANY_BOUNCE_MESSAGE 2024 8.98 2.09 10.10 132 TM2_M_VERY_LONG_WORD 2019 1.20 2.08 1.05 133 BOUNCE_MESSAGE 2017 8.97 2.08 10.09 134 XM_UB60 1881 0.41 1.94 0.17 135 PDS_OTHER_BAD_TLD 1875 0.55 1.93 0.33 136 XMSexyCombo_01 1868 0.71 1.92 0.51 137 TR_XM_COVIDMETA1 1841 0.56 1.90 0.35 138 URI_HEX 1840 1.48 1.90 1.42 139 TR_XM_RelayPhish 1833 0.41 1.89 0.18 140 XMStockSpam_06 1812 1.04 1.87 0.90 141 BAYES_40 1777 4.03 1.83 4.39 142 XMGenDplmaNmb 1737 1.22 1.79 1.12 143 RELAYCOUNTRY_NL 1708 0.46 1.76 0.25 144 MIME_HTML_ONLY_MULTI 1698 2.96 1.75 3.16 145 XM_UB95 1693 0.27 1.74 0.03 146 URI_TRY_3LD 1681 1.26 1.73 1.18 147 XMSubNoVowel 1647 0.96 1.70 0.84 148 T_XMDrugObfuBody_14 1637 1.55 1.69 1.53 149 REMOVE_BEFORE_LINK 1619 0.42 1.67 0.22 150 MONEY_FRAUD_5 1606 0.24 1.65 0.01 151 MAILING_LIST_MULTI 1585 2.12 1.63 2.20 152 TR_XM_DK_SendGrid 1577 3.51 1.62 3.82 153 XM_DK_Undo_01 1485 1.62 1.53 1.64 154 XMHTML_After_End 1481 0.92 1.53 0.83 155 TR_Mismatch_TLD_02 1452 0.29 1.50 0.09 156 DATE_IN_PAST_06_12 1451 0.30 1.49 0.11 157 DKIM_ADSP_CUSTOM_MED 1449 1.10 1.49 1.04 158 MIME_CHARSET_FARAWAY 1438 0.29 1.48 0.10 159 ALL_TRUSTED 1436 16.22 1.48 18.61 160 BAYES_20 1431 4.33 1.47 4.80 161 XMSubMetaSxObfu_03 1428 0.66 1.47 0.52 162 XM_OfRef7 1379 0.41 1.42 0.25 163 TR_Symld_Words 1371 1.50 1.41 1.51 164 T_XMHurry_00 1353 0.74 1.39 0.64 165 HK_RANDOM_REPLYTO 1341 0.39 1.38 0.23 166 T_XMDrugObfuBody_00 1310 0.70 1.35 0.59 167 NML_ADSP_CUSTOM_MED 1306 0.81 1.35 0.72 168 URI_NOVOWEL 1263 1.83 1.30 1.92 169 RDNS_DYNAMIC 1255 0.45 1.29 0.31 170 CHARSET_FARAWAY_HEADER 1254 0.22 1.29 0.05 171 TR_LOTS_OF_MONEY3 1244 0.61 1.28 0.50 172 XM_PDF 1204 3.56 1.24 3.94 173 TR_MetaPhish_Combo_01 1200 0.98 1.24 0.94 174 XM_H_PHPMailer 1153 0.57 1.19 0.47 175 HTTPS_HTTP_MISMATCH 1144 0.78 1.18 0.72 176 XMBody_78 1106 0.49 1.14 0.39 177 FORGED_GMAIL_RCVD 1050 0.61 1.08 0.54 178 URIBL_BLACK 1043 0.17 1.07 0.02 179 RELAYCOUNTRY_JP 1037 0.18 1.07 0.04 180 XMPhish08 1033 0.52 1.06 0.43 181 LongTLD 1026 0.28 1.06 0.15 182 URI_PHP_REDIR 994 0.16 1.02 0.02 183 TR_Mismatch_TLD_01 987 0.34 1.02 0.23 184 T_MONEY_PERCENT 925 0.38 0.95 0.28 185 TR_LOTS_OF_MONEY2 925 0.38 0.95 0.28 186 DIET_1 920 0.45 0.95 0.37 187 XMPhish14 910 0.57 0.94 0.51 188 RELAYCOUNTRY_IN 909 0.24 0.94 0.12 189 TooManyTo_002 900 1.67 0.93 1.80 190 XM_H_PHPOS_M 898 0.25 0.93 0.15 191 MPART_ALT_DIFF_COUNT 896 0.39 0.92 0.31 192 XMMoneyMeta_00 896 0.77 0.92 0.75 193 INVESTMENT_ADVICE 885 0.25 0.91 0.14 194 XM_H_Long_From02 877 1.12 0.90 1.15 195 RELAYCOUNTRY_RU 873 0.56 0.90 0.50 196 XM_H_MailChimp 859 0.32 0.89 0.23 197 XMSexyCombo_04 858 0.26 0.88 0.16 198 RELAYCOUNTRY_IL 858 0.13 0.88 0.01 199 XM_ProductURIs 848 1.00 0.87 1.02 200 RCVD_IN_IADB_LISTED 842 4.05 0.87 4.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 587630 98.12 97.62 98.21 2 HTML_MESSAGE 497563 84.55 93.18 83.15 3 RELAYCOUNTRY_US 458070 75.27 67.34 76.55 4 DKIM_SIGNED 432295 71.79 68.99 72.25 5 XM_DK_Pass 425579 70.48 66.49 71.12 6 DKIM_VALID 401010 65.18 53.83 67.02 7 XM_B_Unicode 395994 66.50 68.48 66.18 8 DKIM_VALID_AU 304520 49.20 38.79 50.89 9 XMListUnsubscribeExists 304289 52.39 61.83 50.85 10 BAYES_50 289785 46.70 36.05 48.43 11 XM_B_Unicode3 227692 37.44 33.67 38.05 12 T_TM2_M_HEADER_IN_MSG 161220 26.51 23.86 26.94 13 HTML_FONT_LOW_CONTRAST 155362 25.77 24.59 25.96 14 DKIM_VALID_EF 153658 25.33 23.19 25.68 15 RCVD_IN_MSPIKE_WL 148378 22.39 7.56 24.80 16 RCVD_IN_MSPIKE_H2 140874 23.69 24.63 23.54 17 LOC_TINY_FONT_1 137068 23.93 30.21 22.91 18 FVGT_m_MULTI_ODD 125864 21.82 26.69 21.03 19 MIME_HTML_ONLY 118437 21.37 31.10 19.79 20 XMSubLong 118260 20.07 21.94 19.76 21 ALL_TRUSTED 111386 16.22 1.48 18.61 22 T_KAM_HTML_FONT_INVALID 109028 18.77 22.15 18.22 23 XM_Multi_Part_URI 91431 15.73 18.47 15.28 24 BAYES_00 88910 12.90 0.82 14.86 25 RCVD_IN_MSPIKE_H3 86392 13.04 4.44 14.44 26 XM_Body_Dirty_Words 76272 13.37 17.18 12.75 27 XM_DK_Undo_02 69429 16.68 47.95 11.60 28 TM2_M_URI_OPT_OUT 64423 9.70 3.15 10.77 29 ANY_BOUNCE_MESSAGE 60435 8.98 2.09 10.10 30 BOUNCE_MESSAGE 60390 8.97 2.08 10.09 31 XM_B_Unsub 59622 10.06 10.67 9.96 32 RCVD_IN_MSPIKE_H4 53063 8.04 2.95 8.87 33 LotsOfNums_01 52753 8.99 10.06 8.82 34 TR_XM_DK_Bayes 49110 7.13 0.47 8.21 35 XM_Evil_Numbers_Gen 47913 8.08 8.51 8.01 36 TooManyTo_001 47261 7.59 5.72 7.90 37 TR_XM_DK_Bayes1 45743 6.61 0.25 7.64 38 BAYES_99 44867 12.16 40.88 7.50 39 XM_B_Phish_Phrases 43670 7.97 12.08 7.30 40 UNPARSEABLE_RELAY 43585 7.11 6.02 7.28 41 LOTS_OF_MONEY 42983 8.66 17.74 7.18 42 TR_XM_DK_Bayes2 40712 5.88 0.15 6.80 43 RCVD_IN_RP_SAFE 39202 5.69 0.39 6.55 44 BAYES_05 38619 5.67 0.81 6.45 45 BAYES_60 38518 6.37 5.97 6.44 46 XM_SendGrid 38210 6.13 4.54 6.39 47 XM_DKIMWhitelistDomains 37571 5.40 0.01 6.28 48 HTML_IMAGE_RATIO_02 37290 6.40 7.47 6.23 49 RCVD_IN_RP_CERTIFIED 36592 5.30 0.25 6.12 50 IN_ZIMBRA_NJ_WHITELIST 35797 5.15 0.04 5.98 51 BAYES_999 35574 9.55 31.81 5.95 52 RELAYCOUNTRY_META 35495 9.14 28.94 5.93 53 XM_H_Long_From01 32020 5.37 5.47 5.35 54 MIME_QP_LONG_LINE 31996 4.96 2.58 5.35 55 DKIM_INVALID 31285 6.62 15.17 5.23 56 BOTNET_IPINHOSTNAME 30879 6.68 16.04 5.16 57 HTML_IMAGE_RATIO_04 30167 4.98 4.61 5.04 58 MPART_ALT_DIFF 28749 4.86 5.17 4.80 59 BAYES_20 28694 4.33 1.47 4.80 60 XMStrtUSub 27728 4.38 2.83 4.63 61 RCVD_IN_IADB_LISTED 27333 4.05 0.87 4.57 62 BAYES_80 26786 4.86 7.22 4.48 63 BAYES_40 26244 4.03 1.83 4.39 64 XMSexyCombo_05 25135 4.89 9.12 4.20 65 T_TooManySym_01 24057 3.77 2.25 4.02 66 RCVD_IN_IADB_SPF 23987 3.56 0.78 4.01 67 XM_PDF 23547 3.56 1.24 3.94 68 HTML_IMAGE_RATIO_06 22956 3.69 2.79 3.84 69 TR_XM_DK_SendGrid 22852 3.51 1.62 3.82 70 RCVD_IN_IADB_SENDERID 21496 3.20 0.76 3.59 71 RCVD_IN_IADB_DK 20861 3.11 0.76 3.49 72 XMSubMetaSx_00 20568 3.76 5.78 3.44 73 XMNumbers 19927 3.46 4.23 3.33 74 TR_XM_PhishingBody 19607 3.75 6.70 3.28 75 T_REMOTE_IMAGE 19493 3.91 7.93 3.26 76 MIME_HTML_ONLY_MULTI 18903 2.96 1.75 3.16 77 BOTNET 18900 6.92 30.07 3.16 78 XM_B_Unsub2 17659 2.91 2.67 2.95 79 NO_DNS_FOR_FROM 17452 4.18 12.00 2.92 80 XM_UncommonTLD01 17433 5.41 20.84 2.91 81 RCVD_IN_IADB_VOUCHED 16563 2.42 0.27 2.77 82 UNTRUSTED_Relay 16108 4.95 18.90 2.69 83 FROM_EXCESS_BASE64 15963 3.42 8.08 2.67 84 BAYES_95 15736 2.95 4.94 2.63 85 HTML_IMAGE_RATIO_08 14486 2.39 2.23 2.42 86 XM_H_Trusted_IP 14438 2.08 0.00 2.41 87 HTML_MIME_NO_HTML_TAG 14153 3.27 8.83 2.37 88 MIME_HTML_MOSTLY 13407 2.29 2.57 2.24 89 MAILING_LIST_MULTI 13188 2.12 1.63 2.20 90 XM_B_SpammyTLD 12163 2.29 3.91 2.03 91 T_TooManySym_02 11618 1.75 0.59 1.94 92 URI_NOVOWEL 11464 1.83 1.30 1.92 93 XM_CamelCaseFrm001 11391 1.96 2.30 1.90 94 XM_B_Phish66 11375 2.21 4.08 1.90 95 RELAYCOUNTRY_CA 10861 3.10 11.01 1.82 96 RCVD_IN_IADB_OPTIN 10815 1.60 0.30 1.81 97 TooManyTo_002 10745 1.67 0.93 1.80 98 XMDiploma_00 10157 1.96 3.60 1.70 99 XM_SPF_SoftFail 10072 2.65 8.62 1.68 100 KHOP_HELO_FCRDNS 9969 1.77 2.38 1.67 101 XM_B_COVIDMETA 9932 2.12 4.94 1.66 102 XM_DK_Undo_01 9805 1.62 1.53 1.64 103 TVD_RCVD_IP 9732 1.45 0.36 1.63 104 SUBJ_ALL_CAPS 9388 1.66 2.19 1.57 105 T_XMDrugObfuBody_14 9129 1.55 1.69 1.53 106 TR_Symld_Words 9054 1.50 1.41 1.51 107 RCVD_IN_MSPIKE_H5 8923 1.31 0.18 1.49 108 T_XMDrugObfuBody_08 8856 1.86 4.20 1.48 109 HELO_NODOT 8619 1.93 4.92 1.44 110 HELO_NO_DOMAIN 8615 1.92 4.92 1.44 111 URI_HEX 8472 1.48 1.90 1.42 112 RCVD_IN_BL_SPAMCOP_NET 8390 2.82 11.55 1.40 113 XM_OfRef6 8284 2.43 8.87 1.38 114 XM_UB50 8016 1.89 5.26 1.34 115 HELO_MISC_IP 8006 1.22 0.47 1.34 116 CK_HELO_DYNAMIC_SPLIT_IP 7997 1.21 0.42 1.34 117 IN_HORDE_ADDRESS_BOOK 7745 1.13 0.15 1.29 118 INVALID_MSGID 7473 1.13 0.41 1.25 119 XM_GoogleGroups 7294 1.11 0.44 1.22 120 URI_TRY_3LD 7067 1.26 1.73 1.18 121 TooManyTo_003 7000 1.10 0.68 1.17 122 XM_H_Long_From02 6879 1.12 0.90 1.15 123 XMGenDplmaNmb 6714 1.22 1.79 1.12 124 XMGappySubj_01 6609 0.99 0.26 1.10 125 TO_MALFORMED 6475 0.96 0.22 1.08 126 TM2_M_VERY_LONG_WORD 6310 1.20 2.08 1.05 127 DKIM_ADSP_CUSTOM_MED 6202 1.10 1.49 1.04 128 XM_ProductURIs 6113 1.00 0.87 1.02 129 XMBody_17 6099 1.47 4.25 1.02 130 XMCapTrack 6034 0.94 0.49 1.01 131 HTML_FONT_FACE_BAD 5637 0.89 0.59 0.94 132 TR_MetaPhish_Combo_01 5618 0.98 1.24 0.94 133 USER_IN_DEF_DKIM_WL 5535 0.80 0.00 0.93 134 XMStockSpam_06 5388 1.04 1.87 0.90 135 T_FILL_THIS_FORM_SHORT 5256 1.14 2.78 0.88 136 TooManyTo_004 5171 0.83 0.61 0.86 137 RELAYCOUNTRY_GB 5036 1.05 2.36 0.84 138 XMSubNoVowel 5023 0.96 1.70 0.84 139 SpammyFromTLD_01 5020 1.82 7.88 0.84 140 XMHTML_After_End 4946 0.92 1.53 0.83 141 RCVD_IN_MSPIKE_BL 4541 2.24 11.34 0.76 142 TR_MSPIKEBAYES00 4527 0.65 0.01 0.76 143 XMMoneyMeta_00 4470 0.77 0.92 0.75 144 T_TooManySym_03 4469 0.66 0.13 0.75 145 XMBrknScrpt_02 4461 1.00 2.55 0.75 146 TR_XM_COVIDMETA4 4359 1.27 4.63 0.73 147 NML_ADSP_CUSTOM_MED 4335 0.81 1.35 0.72 148 HTTPS_HTTP_MISMATCH 4305 0.78 1.18 0.72 149 TooManyTo_005 4270 0.67 0.39 0.71 150 XMBdyGiftCard01 4065 0.69 0.75 0.68 151 TR_XM_UnparsRelay 4064 1.03 3.18 0.68 152 XM_DIRTYINTL 4027 1.06 3.48 0.67 153 XMBody_95 3930 0.58 0.10 0.66 154 T_XMHurry_00 3822 0.74 1.39 0.64 155 XMSubMetaI_00 3759 0.65 0.80 0.63 156 TR_BOTNET_NEGATE 3563 0.56 0.32 0.60 157 T_XMDrugObfuBody_00 3535 0.70 1.35 0.59 158 XMNoVowels 3351 0.58 0.72 0.56 159 XM_SPF_Unknown 3261 0.58 0.82 0.54 160 T_OBFU_PDF_ATTACH 3217 0.49 0.19 0.54 161 FORGED_GMAIL_RCVD 3213 0.61 1.08 0.54 162 T_Symld_Words_02 3202 0.56 0.71 0.54 163 XMSubMetaSxObfu_03 3140 0.66 1.47 0.52 164 XMSexyCombo_01 3062 0.71 1.92 0.51 165 XMPhish14 3039 0.57 0.94 0.51 166 TR_LOTS_OF_MONEY3 3020 0.61 1.28 0.50 167 FROM_GOV_SPOOF 3012 0.46 0.19 0.50 168 RELAYCOUNTRY_RU 3010 0.56 0.90 0.50 169 FROM_GOV_DKIM_AU 2944 0.43 0.05 0.49 170 RELAYCOUNTRY_AU 2899 0.50 0.60 0.48 171 XM_B_REG_HTML 2835 0.45 0.29 0.47 172 XM_H_PHPMailer 2831 0.57 1.19 0.47 173 XM_ShortIntro_01 2794 0.48 0.59 0.47 174 DKIM_ADSP_NXDOMAIN 2775 1.29 6.41 0.46 175 XMHTMLBadTable_001 2728 0.44 0.33 0.46 176 XMOemUri 2653 0.42 0.31 0.44 177 THIS_AD 2653 0.44 0.40 0.44 178 TR_XM_PHPDW 2649 0.76 2.70 0.44 179 MISSING_HEADERS 2631 1.04 4.72 0.44 180 XMPhish30 2610 0.49 0.82 0.44 181 TR_XM_FormFill2 2585 0.74 2.67 0.43 182 T_TooManySym_04 2568 0.38 0.04 0.43 183 TR_XM_PHPForged 2564 0.75 2.70 0.43 184 XMPhish08 2553 0.52 1.06 0.43 185 RCVD_IN_MSPIKE_L3 2530 0.86 3.58 0.42 186 XM_H_PHPOS 2529 0.74 2.67 0.42 187 HTML_TAG_BALANCE_BODY 2521 0.47 0.76 0.42 188 HTML_IMAGE_ONLY_28 2512 0.41 0.35 0.42 189 XM_RXBody 2507 0.44 0.56 0.42 190 XM_B_COPY_HTML 2467 0.41 0.42 0.41 191 HTML_IMAGE_ONLY_20 2464 0.42 0.44 0.41 192 SUBJ_DOLLARS 2439 0.42 0.51 0.41 193 SHORT_HELO_AND_INLINE_IMAGE 2344 0.35 0.07 0.39 194 RELAYCOUNTRY_DE 2309 0.42 0.65 0.39 195 XMBody_78 2308 0.49 1.14 0.39 196 NUMERIC_HTTP_ADDR 2293 0.42 0.63 0.38 197 XM_S_SubURI 2252 0.33 0.07 0.38 198 DIET_1 2239 0.45 0.95 0.37 199 XMBSHREFv2 2184 0.37 0.40 0.36 200 RCVD_IN_SORBS_DUL 2182 0.35 0.29 0.36 ----------------------------------------------------------------------