Email: 654981 Autolearn: 0 AvgScore: 0.86 AvgScanTime: 1.73 sec Spam: 105538 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 3.26 sec Ham: 549443 Autolearn: 0 AvgScore: -1.68 AvgScanTime: 1.44 sec Time Spent Running SA: 315.04 hours Time Spent Processing Spam: 95.57 hours Time Spent Processing Ham: 219.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 100982 98.17 95.68 98.64 2 HTML_MESSAGE 99296 83.38 94.09 81.32 3 RELAYCOUNTRY_US 65652 73.33 62.21 75.46 4 DKIM_SIGNED 64864 68.51 61.46 69.86 5 XM_B_Unicode 63300 65.84 59.98 66.97 6 XM_DK_Pass 62690 67.12 59.40 68.61 7 XMListUnsubscribeExists 58815 50.88 55.73 49.95 8 DKIM_VALID 52099 62.66 49.37 65.22 9 XM_DK_Undo_02 45166 16.42 42.80 11.36 10 MIME_HTML_ONLY 43906 24.09 41.60 20.73 11 DKIM_VALID_AU 38171 47.93 36.17 50.19 12 BAYES_99 37885 12.12 35.90 7.55 13 BOTNET 35641 8.10 33.77 3.17 14 BAYES_50 34084 45.35 32.30 47.86 15 RELAYCOUNTRY_META 33966 9.70 32.18 5.38 16 RCVD_IN_MSPIKE_H2 33774 23.60 32.00 21.99 17 XM_B_Unicode3 33009 39.45 31.28 41.02 18 BAYES_999 29363 9.58 27.82 6.08 19 LOC_TINY_FONT_1 28840 25.75 27.33 25.44 20 UNTRUSTED_Relay 26322 5.74 24.94 2.05 21 FVGT_m_MULTI_ODD 23944 20.13 22.69 19.63 22 T_TM2_M_HEADER_IN_MSG 23485 24.48 22.25 24.91 23 DKIM_VALID_EF 23317 23.95 22.09 24.31 24 HTML_MIME_NO_HTML_TAG 22866 5.03 21.67 1.83 25 T_REMOTE_IMAGE 22554 5.88 21.37 2.90 26 XM_UncommonTLD01 22415 5.66 21.24 2.67 27 FROM_EXCESS_BASE64 22008 5.59 20.85 2.66 28 HTML_FONT_LOW_CONTRAST 21625 25.38 20.49 26.32 29 XMSubLong 21484 20.54 20.36 20.57 30 BODY_URI_ONLY 21145 3.36 20.04 0.16 31 HTML_IMAGE_RATIO_02 20907 9.08 19.81 7.02 32 T_KAM_HTML_FONT_INVALID 18988 17.43 17.99 17.32 33 RCVD_IN_BL_SPAMCOP_NET 18475 3.86 17.51 1.23 34 XM_Body_Dirty_Words 17581 13.73 16.66 13.16 35 XM_Multi_Part_URI 16986 16.27 16.09 16.30 36 RCVD_IN_PSBL 16529 2.55 15.66 0.03 37 LOTS_OF_MONEY 14391 9.49 13.64 8.69 38 BOTNET_IPINHOSTNAME 14360 6.73 13.61 5.40 39 DKIM_INVALID 12765 5.84 12.10 4.64 40 BAYES_80 12659 5.43 11.99 4.17 41 XM_B_Phish_Phrases 12410 8.13 11.76 7.44 42 RCVD_IN_MSPIKE_BL 12287 2.64 11.64 0.91 43 HTML_SHORT_LINK_IMG_1 11804 1.83 11.18 0.03 44 BOTNET_NORDNS 11449 1.76 10.85 0.02 45 XMOffer 11100 1.82 10.52 0.15 46 XM_B_Unsub 11096 11.13 10.51 11.25 47 BAYES_60 10857 7.01 10.29 6.38 48 HTML_IMAGE_ONLY_12 10778 1.76 10.21 0.14 49 NO_DNS_FOR_FROM 10155 3.77 9.62 2.65 50 XMSexyCombo_05 9867 5.45 9.35 4.70 51 SpammyFromTLD_01 9514 1.97 9.01 0.62 52 LotsOfNums_01 8947 8.53 8.48 8.54 53 SpammyFromTLD_02 8756 1.69 8.30 0.42 54 RCVD_IN_RP_RNBL 8651 1.38 8.20 0.07 55 XM_SPF_SoftFail 8628 2.39 8.18 1.28 56 RELAYCOUNTRY_CA 8377 3.05 7.94 2.11 57 MPART_ALT_DIFF 8277 6.33 7.84 6.05 58 RCVD_IN_MSPIKE_L5 7714 1.43 7.31 0.31 59 XM_UB99 7577 1.16 7.18 0.00 60 RCVD_IN_MSPIKE_WL 7567 21.58 7.17 24.35 61 XM_Evil_Numbers_Gen 7438 8.20 7.05 8.42 62 XMSubMetaSx_00 6605 4.43 6.26 4.07 63 FROM_SUSPICIOUS_NTLD 6556 1.03 6.21 0.03 64 XM_UB50 6486 1.89 6.15 1.07 65 FROM_SUSPICIOUS_NTLD_FP 6468 1.01 6.13 0.03 66 TR_XM_PhishingBody 6217 3.79 5.89 3.38 67 DKIM_ADSP_NXDOMAIN 5791 1.31 5.49 0.51 68 HDRS_MISSP 5695 0.91 5.40 0.05 69 XM_B_COVIDMETA 5648 2.09 5.35 1.46 70 XM_B_SEO 5622 1.05 5.33 0.23 71 XM_H_Long_From01 5603 5.20 5.31 5.18 72 XM_UB999 5556 0.85 5.26 0.00 73 UNPARSEABLE_RELAY 5410 6.34 5.13 6.57 74 HTML_TAG_BALANCE_CENTER 5398 0.91 5.11 0.10 75 TooManyTo_001 5357 6.97 5.08 7.34 76 BAYES_95 5145 2.97 4.88 2.61 77 MIME_HTML_MOSTLY 5038 2.72 4.77 2.33 78 XM_UB80 4990 0.81 4.73 0.05 79 HTML_IMAGE_RATIO_04 4929 6.00 4.67 6.25 80 RELAYCOUNTRY_FR 4488 0.89 4.25 0.24 81 RCVD_IN_MSPIKE_H3 4425 12.40 4.19 13.98 82 HK_RANDOM_FROM 4245 0.74 4.02 0.11 83 XM_B_Phish66 4198 2.34 3.98 2.03 84 T_XMDrugObfuBody_08 4137 1.93 3.92 1.55 85 TR_XM_COVIDMETA4 4105 1.17 3.89 0.65 86 XMDiploma_00 4057 2.07 3.84 1.73 87 XM_DIRTYINTL 4051 1.11 3.84 0.59 88 XM_UB60 3986 0.75 3.78 0.16 89 XM_SendGrid 3978 5.10 3.77 5.36 90 XMSubGiftCard1 3948 0.65 3.74 0.06 91 TR_XM_INV_DKIM 3881 0.77 3.68 0.21 92 RCVD_IN_MSPIKE_L3 3867 1.01 3.66 0.51 93 XMStrtUSub 3782 4.01 3.58 4.09 94 HTML_IMAGE_RATIO_08 3765 2.89 3.57 2.76 95 IMG_ONLY_FM_DOM_INFO 3718 0.57 3.52 0.00 96 URIBL_SBL_A 3648 0.77 3.46 0.26 97 XM_OfRef6 3541 1.45 3.36 1.09 98 XMNumbers 3470 2.93 3.29 2.86 99 XM_B_SpammyTLD 3403 2.10 3.22 1.88 100 KHOP_HELO_FCRDNS 3399 1.90 3.22 1.65 101 SUBJ_ALL_CAPS 3057 1.89 2.90 1.70 102 TR_XM_MaxBayes 3056 0.51 2.90 0.05 103 RCVD_IN_MSPIKE_H4 3023 7.87 2.86 8.83 104 TM2_M_URI_OPT_OUT 2941 11.63 2.79 13.33 105 TR_XM_UnparsRelay 2928 0.77 2.77 0.38 106 DATE_IN_PAST_03_06 2915 0.52 2.76 0.09 107 TR_XM_MaxWHORU 2911 0.49 2.76 0.06 108 XM_JunkDunk 2890 0.44 2.74 0.00 109 XMSexyCombo_01 2816 1.39 2.67 1.15 110 RELAYCOUNTRY_GB 2753 1.12 2.61 0.83 111 HTML_IMAGE_RATIO_06 2752 3.90 2.61 4.15 112 RELAYCOUNTRY_KR 2719 0.43 2.58 0.02 113 XM_CamelCaseFrm001 2713 1.99 2.57 1.88 114 TR_XM_COVIDMETA1 2631 0.70 2.49 0.36 115 XMBody_17 2606 1.10 2.47 0.83 116 XMHTML_After_End 2566 1.21 2.43 0.97 117 MIME_QP_LONG_LINE 2544 4.41 2.41 4.80 118 RELAYCOUNTRY_DE 2501 0.66 2.37 0.33 119 RELAYCOUNTRY_NL 2492 0.55 2.36 0.20 120 TR_XM_MaxSPIKE 2354 0.39 2.23 0.03 121 XM_URI_RBL 2348 0.52 2.22 0.20 122 T_TooManySym_01 2317 4.34 2.20 4.75 123 TR_XM_PHPDW 2270 0.63 2.15 0.34 124 TR_XM_PHPForged 2262 0.62 2.14 0.32 125 TR_XM_FormFill2 2239 0.61 2.12 0.33 126 XM_H_PHPOS 2231 0.61 2.11 0.32 127 HTML_IMAGE_ONLY_20 2192 0.79 2.08 0.54 128 TM2_M_VERY_LONG_WORD 2169 1.16 2.06 0.99 129 ALL_TRUSTED 2133 17.28 2.02 20.22 130 XM_UB95 2115 0.34 2.00 0.02 131 T_FILL_THIS_FORM_SHORT 2079 0.90 1.97 0.70 132 TR_LOTS_OF_MONEY3 2048 0.81 1.94 0.59 133 BAYES_40 2045 3.84 1.94 4.21 134 XM_B_Unsub2 2018 2.67 1.91 2.81 135 DATE_IN_PAST_06_12 1970 0.36 1.87 0.07 136 MIME_HTML_ONLY_MULTI 1961 3.84 1.86 4.22 137 HTML_FONT_TINY_NORDNS 1927 0.65 1.83 0.43 138 HTML_IMAGE_ONLY_28 1882 0.50 1.78 0.25 139 URI_HEX 1874 1.55 1.78 1.51 140 TR_XM_DK_SendGrid 1859 2.75 1.76 2.95 141 FROM_LOCAL_NOVOWEL 1849 0.30 1.75 0.02 142 XMGenDplmaNmb 1814 1.17 1.72 1.07 143 RELAYCOUNTRY_AU 1718 0.56 1.63 0.36 144 T_XMDrugObfuBody_00 1675 0.76 1.59 0.60 145 FVGT_m_MULTI_ODD_EMAIL 1520 0.26 1.44 0.04 146 URI_TRY_3LD 1512 1.24 1.43 1.21 147 RDNS_DYNAMIC 1496 0.50 1.42 0.33 148 T_XMDrugObfuBody_14 1493 1.56 1.41 1.59 149 XMStockSpam_06 1485 1.61 1.41 1.65 150 XMBrknScrpt_02 1477 0.96 1.40 0.88 151 LongTLD 1476 0.33 1.40 0.13 152 TR_Caps_n_Bayes_99 1475 0.35 1.40 0.15 153 XMSexyCombo_04 1472 0.70 1.39 0.57 154 TR_XM_RelayPhish 1468 0.34 1.39 0.14 155 XMSubNoVowel 1447 1.01 1.37 0.94 156 BAYES_20 1386 4.25 1.31 4.82 157 TR_Symld_Words 1365 1.49 1.29 1.52 158 TR_Mismatch_TLD_02 1324 0.26 1.25 0.07 159 URI_NOVOWEL 1315 1.72 1.25 1.81 160 HK_RANDOM_REPLYTO 1272 0.40 1.21 0.24 161 RELAYCOUNTRY_JP 1221 0.21 1.16 0.03 162 URI_PHP_REDIR 1188 0.19 1.13 0.01 163 DKIM_ADSP_CUSTOM_MED 1185 1.04 1.12 1.02 164 TR_Sbj_FN_Bdy 1182 0.33 1.12 0.18 165 REPLYTO_WITHOUT_TO_CC 1181 0.24 1.12 0.08 166 MAILING_LIST_MULTI 1179 1.96 1.12 2.12 167 T_XMHurry_00 1161 0.83 1.10 0.77 168 XMMoneyMeta_00 1140 0.55 1.08 0.44 169 HTML_IMAGE_ONLY_08 1134 0.24 1.07 0.08 170 MPART_ALT_DIFF_COUNT 1118 0.43 1.06 0.31 171 TR_MetaPhish_Combo_01 1111 0.64 1.05 0.56 172 IMPOTENCE 1104 0.19 1.05 0.03 173 LONG_JUNK_URI2 1079 0.21 1.02 0.05 174 PDS_OTHER_BAD_TLD 1059 0.31 1.00 0.18 175 ONE_TIME 1052 0.39 1.00 0.28 176 REMOVE_BEFORE_LINK 1026 0.43 0.97 0.32 177 DATE_IN_PAST_12_24 1004 0.19 0.95 0.04 178 MIME_CHARSET_FARAWAY 1003 0.22 0.95 0.08 179 FORGED_GMAIL_RCVD 984 0.54 0.93 0.46 180 MISSING_HEADERS 977 0.44 0.93 0.35 181 T_Symld_Words_02 975 0.58 0.92 0.52 182 HTTPS_HTTP_MISMATCH 969 0.63 0.92 0.58 183 SUBJ_DOLLARS 957 0.55 0.91 0.48 184 XM_H_Undi_Recip 957 0.28 0.91 0.16 185 XM_DK_Undo_01 956 1.34 0.91 1.43 186 URIBL_BLACK 946 0.16 0.90 0.02 187 NML_ADSP_CUSTOM_MED 943 0.71 0.89 0.68 188 RCVD_IN_IADB_LISTED 932 3.63 0.88 4.16 189 INVESTMENT_ADVICE 928 0.25 0.88 0.13 190 DIET_1 920 0.89 0.87 0.89 191 TR_LOTS_OF_MONEY2 915 0.35 0.87 0.25 192 T_MONEY_PERCENT 915 0.35 0.87 0.25 193 TR_Mismatch_TLD_01 913 0.28 0.87 0.17 194 XMSubMetaSSx_00 910 0.35 0.86 0.25 195 CHARSET_FARAWAY_HEADER 895 0.17 0.85 0.04 196 XMSubMetaSxObfu_03 893 0.78 0.85 0.77 197 SUBJ_BUY 880 0.17 0.83 0.05 198 PDS_FROM_2_EMAILS 878 0.14 0.83 0.01 199 XM_BadFromFormat 866 0.24 0.82 0.13 200 HK_SCAM 863 0.14 0.82 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 541985 98.17 95.68 98.64 2 HTML_MESSAGE 446797 83.38 94.09 81.32 3 RELAYCOUNTRY_US 414616 73.33 62.21 75.46 4 DKIM_SIGNED 383840 68.51 61.46 69.86 5 XM_DK_Pass 376955 67.12 59.40 68.61 6 XM_B_Unicode 367965 65.84 59.98 66.97 7 DKIM_VALID 358328 62.66 49.37 65.22 8 DKIM_VALID_AU 275755 47.93 36.17 50.19 9 XMListUnsubscribeExists 274448 50.88 55.73 49.95 10 BAYES_50 262947 45.35 32.30 47.86 11 XM_B_Unicode3 225372 39.45 31.28 41.02 12 HTML_FONT_LOW_CONTRAST 144597 25.38 20.49 26.32 13 LOC_TINY_FONT_1 139791 25.75 27.33 25.44 14 T_TM2_M_HEADER_IN_MSG 136871 24.48 22.25 24.91 15 RCVD_IN_MSPIKE_WL 133795 21.58 7.17 24.35 16 DKIM_VALID_EF 133575 23.95 22.09 24.31 17 RCVD_IN_MSPIKE_H2 120816 23.60 32.00 21.99 18 MIME_HTML_ONLY 113907 24.09 41.60 20.73 19 XMSubLong 113047 20.54 20.36 20.57 20 ALL_TRUSTED 111071 17.28 2.02 20.22 21 FVGT_m_MULTI_ODD 107880 20.13 22.69 19.63 22 T_KAM_HTML_FONT_INVALID 95168 17.43 17.99 17.32 23 XM_Multi_Part_URI 89581 16.27 16.09 16.30 24 BAYES_00 82990 12.79 0.72 15.10 25 RCVD_IN_MSPIKE_H3 76804 12.40 4.19 13.98 26 TM2_M_URI_OPT_OUT 73237 11.63 2.79 13.33 27 XM_Body_Dirty_Words 72321 13.73 16.66 13.16 28 ANY_BOUNCE_MESSAGE 68321 10.55 0.72 12.43 29 BOUNCE_MESSAGE 68318 10.55 0.72 12.43 30 XM_DK_Undo_02 62397 16.42 42.80 11.36 31 XM_B_Unsub 61827 11.13 10.51 11.25 32 RCVD_IN_MSPIKE_H4 48538 7.87 2.86 8.83 33 LOTS_OF_MONEY 47743 9.49 13.64 8.69 34 LotsOfNums_01 46899 8.53 8.48 8.54 35 XM_Evil_Numbers_Gen 46280 8.20 7.05 8.42 36 BAYES_99 41497 12.12 35.90 7.55 37 XM_B_Phish_Phrases 40867 8.13 11.76 7.44 38 TooManyTo_001 40323 6.97 5.08 7.34 39 BAYES_05 40105 6.23 0.67 7.30 40 XM_DKIMWhitelistDomains 39838 6.08 0.01 7.25 41 HTML_IMAGE_RATIO_02 38583 9.08 19.81 7.02 42 RCVD_IN_RP_SAFE 38556 5.94 0.35 7.02 43 TR_XM_DK_Bayes 37892 5.84 0.31 6.90 44 UNPARSEABLE_RELAY 36113 6.34 5.13 6.57 45 IN_ZIMBRA_NJ_WHITELIST 35938 5.49 0.04 6.54 46 TR_XM_DK_Bayes1 35527 5.45 0.17 6.47 47 RCVD_IN_RP_CERTIFIED 35310 5.43 0.24 6.43 48 BAYES_60 35076 7.01 10.29 6.38 49 HTML_IMAGE_RATIO_04 34353 6.00 4.67 6.25 50 BAYES_999 33414 9.58 27.82 6.08 51 MPART_ALT_DIFF 33216 6.33 7.84 6.05 52 TR_XM_DK_Bayes2 32100 4.93 0.16 5.84 53 BOTNET_IPINHOSTNAME 29695 6.73 13.61 5.40 54 RELAYCOUNTRY_META 29549 9.70 32.18 5.38 55 XM_SendGrid 29442 5.10 3.77 5.36 56 XM_H_Long_From01 28484 5.20 5.31 5.18 57 BAYES_20 26482 4.25 1.31 4.82 58 MIME_QP_LONG_LINE 26352 4.41 2.41 4.80 59 T_TooManySym_01 26115 4.34 2.20 4.75 60 XMSexyCombo_05 25843 5.45 9.35 4.70 61 DKIM_INVALID 25512 5.84 12.10 4.64 62 MIME_HTML_ONLY_MULTI 23192 3.84 1.86 4.22 63 BAYES_40 23105 3.84 1.94 4.21 64 BAYES_80 22922 5.43 11.99 4.17 65 RCVD_IN_IADB_LISTED 22849 3.63 0.88 4.16 66 HTML_IMAGE_RATIO_06 22783 3.90 2.61 4.15 67 XMStrtUSub 22457 4.01 3.58 4.09 68 XMSubMetaSx_00 22379 4.43 6.26 4.07 69 XM_H_Trusted_IP 21150 3.23 0.00 3.85 70 RCVD_IN_IADB_SPF 19998 3.18 0.78 3.64 71 TR_XM_PhishingBody 18585 3.79 5.89 3.38 72 RCVD_IN_IADB_SENDERID 18022 2.87 0.74 3.28 73 RCVD_IN_IADB_DK 17569 2.80 0.73 3.20 74 BOTNET 17424 8.10 33.77 3.17 75 TR_XM_DK_SendGrid 16183 2.75 1.76 2.95 76 T_REMOTE_IMAGE 15961 5.88 21.37 2.90 77 XMNumbers 15691 2.93 3.29 2.86 78 XM_B_Unsub2 15439 2.67 1.91 2.81 79 HTML_IMAGE_RATIO_08 15182 2.89 3.57 2.76 80 HTML_FONT_FACE_BAD 15165 2.43 0.72 2.76 81 XM_UncommonTLD01 14651 5.66 21.24 2.67 82 FROM_EXCESS_BASE64 14628 5.59 20.85 2.66 83 NO_DNS_FOR_FROM 14534 3.77 9.62 2.65 84 BAYES_95 14315 2.97 4.88 2.61 85 XM_PDF 14308 2.32 0.81 2.60 86 RCVD_IN_IADB_VOUCHED 13228 2.08 0.36 2.41 87 MIME_HTML_MOSTLY 12796 2.72 4.77 2.33 88 MAILING_LIST_MULTI 11674 1.96 1.12 2.12 89 RELAYCOUNTRY_CA 11587 3.05 7.94 2.11 90 T_TooManySym_02 11372 1.81 0.48 2.07 91 UNTRUSTED_Relay 11288 5.74 24.94 2.05 92 XM_B_Phish66 11155 2.34 3.98 2.03 93 XM_B_SpammyTLD 10345 2.10 3.22 1.88 94 XM_CamelCaseFrm001 10339 1.99 2.57 1.88 95 HTML_MIME_NO_HTML_TAG 10076 5.03 21.67 1.83 96 TooManyTo_002 10025 1.66 0.82 1.82 97 URI_NOVOWEL 9918 1.72 1.25 1.81 98 XMDiploma_00 9488 2.07 3.84 1.73 99 SUBJ_ALL_CAPS 9327 1.89 2.90 1.70 100 XMStockSpam_06 9076 1.61 1.41 1.65 101 KHOP_HELO_FCRDNS 9043 1.90 3.22 1.65 102 TVD_RCVD_IP 8821 1.41 0.40 1.61 103 T_XMDrugObfuBody_14 8722 1.56 1.41 1.59 104 RCVD_IN_IADB_OPTIN 8534 1.35 0.31 1.55 105 T_XMDrugObfuBody_08 8501 1.93 3.92 1.55 106 RCVD_IN_MSPIKE_H5 8453 1.31 0.11 1.54 107 TR_Symld_Words 8374 1.49 1.29 1.52 108 URI_HEX 8298 1.55 1.78 1.51 109 USER_IN_DEF_DKIM_WL 8197 1.25 0.00 1.49 110 XM_B_COVIDMETA 8045 2.09 5.35 1.46 111 XM_DK_Undo_01 7841 1.34 0.91 1.43 112 HELO_MISC_IP 7681 1.26 0.52 1.40 113 CK_HELO_DYNAMIC_SPLIT_IP 7651 1.27 0.63 1.39 114 INVALID_MSGID 7183 1.11 0.11 1.31 115 XM_SPF_SoftFail 7026 2.39 8.18 1.28 116 TooManyTo_003 7019 1.17 0.60 1.28 117 IN_HORDE_ADDRESS_BOOK 6809 1.07 0.16 1.24 118 RCVD_IN_BL_SPAMCOP_NET 6780 3.86 17.51 1.23 119 URI_TRY_3LD 6640 1.24 1.43 1.21 120 XM_GoogleGroups 6538 1.07 0.43 1.19 121 TO_MALFORMED 6499 0.99 0.02 1.18 122 XMGappySubj_01 6442 1.00 0.08 1.17 123 XMBdyGiftCard01 6385 1.08 0.66 1.16 124 XMSexyCombo_01 6292 1.39 2.67 1.15 125 XM_OfRef6 5963 1.45 3.36 1.09 126 XMGenDplmaNmb 5876 1.17 1.72 1.07 127 XM_UB50 5873 1.89 6.15 1.07 128 DKIM_ADSP_CUSTOM_MED 5605 1.04 1.12 1.02 129 TM2_M_VERY_LONG_WORD 5453 1.16 2.06 0.99 130 XM_H_Long_From02 5368 0.95 0.81 0.98 131 XMHTML_After_End 5328 1.21 2.43 0.97 132 TooManyTo_004 5310 0.90 0.53 0.97 133 XM_ProductURIs 5250 0.90 0.61 0.96 134 XMSubNoVowel 5143 1.01 1.37 0.94 135 HELO_NODOT 5057 0.88 0.68 0.92 136 HELO_NO_DOMAIN 5055 0.88 0.68 0.92 137 RCVD_IN_MSPIKE_BL 4999 2.64 11.64 0.91 138 FILL_THIS_FORM 4920 0.84 0.58 0.90 139 DIET_1 4881 0.89 0.87 0.89 140 XMBrknScrpt_02 4825 0.96 1.40 0.88 141 RELAYCOUNTRY_GB 4579 1.12 2.61 0.83 142 XMBody_17 4574 1.10 2.47 0.83 143 T_TooManySym_03 4413 0.69 0.13 0.80 144 T_XMHurry_00 4249 0.83 1.10 0.77 145 XMSubMetaSxObfu_03 4244 0.78 0.85 0.77 146 TooManyTo_005 4209 0.71 0.45 0.77 147 TR_MSPIKEBAYES00 4193 0.64 0.00 0.76 148 XMBody_95 4063 0.63 0.08 0.74 149 T_FILL_THIS_FORM_SHORT 3842 0.90 1.97 0.70 150 NML_ADSP_CUSTOM_MED 3723 0.71 0.89 0.68 151 TR_XM_COVIDMETA4 3553 1.17 3.89 0.65 152 TR_BOTNET_NEGATE 3516 0.57 0.23 0.64 153 XMSubMetaI_00 3503 0.64 0.62 0.64 154 XMSolicitRefs_0 3462 0.61 0.49 0.63 155 XMCapTrack 3428 0.59 0.40 0.62 156 SpammyFromTLD_01 3414 1.97 9.01 0.62 157 T_XMDrugObfuBody_00 3285 0.76 1.59 0.60 158 TR_LOTS_OF_MONEY3 3262 0.81 1.94 0.59 159 XM_DIRTYINTL 3251 1.11 3.84 0.59 160 HTTPS_HTTP_MISMATCH 3170 0.63 0.92 0.58 161 XMSexyCombo_04 3135 0.70 1.39 0.57 162 FROM_GOV_DKIM_AU 3097 0.48 0.07 0.56 163 TR_MetaPhish_Combo_01 3055 0.64 1.05 0.56 164 XMHTMLBadTable_001 2997 0.50 0.25 0.55 165 PLING_QUERY 2982 0.52 0.42 0.54 166 HTML_IMAGE_ONLY_20 2952 0.79 2.08 0.54 167 T_Symld_Words_02 2840 0.58 0.92 0.52 168 NUMERIC_HTTP_ADDR 2823 0.50 0.40 0.51 169 DKIM_ADSP_NXDOMAIN 2807 1.31 5.49 0.51 170 XMPhish30 2791 0.54 0.70 0.51 171 RCVD_IN_MSPIKE_L3 2781 1.01 3.66 0.51 172 SUBJ_DOLLARS 2644 0.55 0.91 0.48 173 XMSubMetaSx_01 2562 0.51 0.73 0.47 174 XMPhish08 2562 0.50 0.68 0.47 175 FORGED_GMAIL_RCVD 2523 0.54 0.93 0.46 176 T_TooManySym_04 2498 0.38 0.02 0.45 177 HTML_TAG_BALANCE_BODY 2459 0.46 0.51 0.45 178 XMMoneyMeta_00 2430 0.55 1.08 0.44 179 HTML_FONT_TINY_NORDNS 2356 0.65 1.83 0.43 180 XM_H_PHPMailer 2338 0.48 0.77 0.43 181 SpammyFromTLD_02 2331 1.69 8.30 0.42 182 T_OBFU_PDF_ATTACH 2328 0.38 0.14 0.42 183 XMBody_78 2298 0.48 0.78 0.42 184 TM2_M_A_HREF_HREF 2295 0.44 0.54 0.42 185 XM_B_COPY_HTML 2293 0.46 0.65 0.42 186 XM_B_REG_HTML 2280 0.38 0.22 0.41 187 XM_S_SubURI 2247 0.35 0.05 0.41 188 THIS_AD 2230 0.41 0.45 0.41 189 XMLngstWrd_00 2187 0.42 0.55 0.40 190 XMBSHREFv2 2176 0.39 0.34 0.40 191 XMSexyCombo_02 2169 0.38 0.31 0.39 192 XM_ShortIntro_01 2128 0.40 0.47 0.39 193 TR_XM_UnparsRelay 2097 0.77 2.77 0.38 194 XMPhish14 2021 0.42 0.66 0.37 195 XM_SPF_Unknown 2000 0.41 0.68 0.36 196 XMNoVowels 1978 0.37 0.44 0.36 197 RELAYCOUNTRY_AU 1964 0.56 1.63 0.36 198 TR_XM_COVIDMETA1 1960 0.70 2.49 0.36 199 XMLngstWrd_01 1951 0.38 0.50 0.36 200 XM_Combo_Sbj 1948 0.37 0.45 0.35 ----------------------------------------------------------------------