Email: 632633 Autolearn: 0 AvgScore: 0.83 AvgScanTime: 1.80 sec Spam: 99867 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 3.35 sec Ham: 532766 Autolearn: 0 AvgScore: -1.62 AvgScanTime: 1.52 sec Time Spent Running SA: 317.14 hours Time Spent Processing Spam: 92.91 hours Time Spent Processing Ham: 224.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 97274 98.19 97.40 98.33 2 HTML_MESSAGE 95300 90.22 95.43 89.25 3 DKIM_SIGNED 72175 76.59 72.27 77.40 4 RELAYCOUNTRY_US 71042 81.45 71.14 83.39 5 XM_DK_Pass 70178 75.28 70.27 76.21 6 XM_B_Unicode 69240 71.71 69.33 72.15 7 XMListUnsubscribeExists 65787 56.67 65.87 54.94 8 DKIM_VALID 59220 70.21 59.30 72.25 9 XM_DK_Undo_02 51186 18.88 51.25 12.81 10 BAYES_99 46678 14.36 46.74 8.29 11 DKIM_VALID_AU 42970 52.24 43.03 53.96 12 BAYES_999 36592 11.42 36.64 6.69 13 MIME_HTML_ONLY 36293 24.23 36.34 21.96 14 BOTNET 35540 8.34 35.59 3.23 15 XM_B_Unicode3 32421 40.44 32.46 41.93 16 LOC_TINY_FONT_1 31739 27.25 31.78 26.40 17 BAYES_50 28681 49.02 28.72 52.82 18 XM_UncommonTLD01 26619 6.66 26.65 2.92 19 DKIM_VALID_EF 25528 27.00 25.56 27.27 20 RCVD_IN_MSPIKE_H2 25337 25.17 25.37 25.13 21 RELAYCOUNTRY_META 24797 8.68 24.83 5.65 22 FVGT_m_MULTI_ODD 24189 22.74 24.22 22.46 23 XMSubLong 23789 21.32 23.82 20.85 24 HTML_FONT_LOW_CONTRAST 23401 27.76 23.43 28.57 25 T_KAM_HTML_FONT_INVALID 21381 19.32 21.41 18.92 26 T_TM2_M_HEADER_IN_MSG 21359 27.56 21.39 28.72 27 XM_Multi_Part_URI 20799 13.83 20.83 12.52 28 UNTRUSTED_Relay 19911 5.23 19.94 2.47 29 XM_Body_Dirty_Words 19749 14.59 19.78 13.62 30 LOTS_OF_MONEY 19714 11.05 19.74 9.42 31 RCVD_IN_BL_SPAMCOP_NET 15232 4.01 15.25 1.90 32 SpammyFromTLD_02 14729 2.67 14.75 0.41 33 BOTNET_NORDNS 13964 2.22 13.98 0.01 34 BOTNET_IPINHOSTNAME 13894 6.89 13.91 5.58 35 RCVD_IN_MSPIKE_BL 13894 3.15 13.91 1.13 36 HTML_MIME_NO_HTML_TAG 13846 4.25 13.86 2.45 37 FROM_EXCESS_BASE64 13609 4.58 13.63 2.89 38 T_REMOTE_IMAGE 13508 5.06 13.53 3.48 39 XM_B_Phish_Phrases 13321 8.54 13.34 7.64 40 FROM_SUSPICIOUS_NTLD 13088 2.14 13.11 0.09 41 FROM_SUSPICIOUS_NTLD_FP 13025 2.11 13.04 0.06 42 DKIM_INVALID 12955 6.38 12.97 5.14 43 XMSexyCombo_05 12297 5.18 12.31 3.85 44 T_HTML_TAG_BALANCE_CENTER 12023 1.96 12.04 0.07 45 BODY_URI_ONLY 11914 1.93 11.93 0.05 46 HDRS_MISSP 11788 1.87 11.80 0.01 47 DKIM_ADSP_NXDOMAIN 11776 2.31 11.79 0.53 48 MPART_ALT_DIFF 11156 7.05 11.17 6.28 49 LotsOfNums_01 10577 9.46 10.59 9.25 50 XM_B_Unsub 9967 10.77 9.98 10.92 51 NO_DNS_FOR_FROM 9549 3.89 9.56 2.83 52 SpammyFromTLD_01 8951 2.03 8.96 0.73 53 XM_JunkDunk 8574 1.36 8.59 0.00 54 RCVD_IN_MSPIKE_L5 8383 1.63 8.39 0.36 55 BAYES_80 8268 5.28 8.28 4.71 56 XMBrknScrpt_02 8224 2.83 8.23 1.81 57 XM_UB99 8128 1.29 8.14 0.01 58 XM_SPF_SoftFail 8046 2.89 8.06 1.92 59 XM_Evil_Numbers_Gen 7900 8.04 7.91 8.07 60 RCVD_IN_MSPIKE_WL 7648 24.27 7.66 27.39 61 RCVD_IN_RP_RNBL 7405 1.26 7.41 0.11 62 XMSubMetaSx_00 7230 4.21 7.24 3.64 63 TR_XM_PhishingBody 6908 4.19 6.92 3.68 64 HTML_IMAGE_RATIO_02 6874 6.92 6.88 6.93 65 RELAYCOUNTRY_CA 6797 2.74 6.81 1.98 66 XM_UB999 6407 1.02 6.42 0.00 67 MIME_HTML_MOSTLY 6235 3.17 6.24 2.59 68 BAYES_60 6228 7.06 6.24 7.21 69 RCVD_IN_PSBL 5977 0.96 5.98 0.02 70 HTML_IMAGE_RATIO_06 5564 4.31 5.57 4.07 71 XMBody_17 5498 1.91 5.51 1.24 72 XM_DIRTYINTL 5438 1.33 5.45 0.56 73 BAYES_95 5401 3.32 5.41 2.93 74 XM_B_COVIDMETA 5359 2.37 5.37 1.80 75 UNPARSEABLE_RELAY 5270 7.28 5.28 7.65 76 XM_H_Long_From01 5228 5.24 5.23 5.25 77 XM_B_Phish66 4970 2.42 4.98 1.94 78 TooManyTo_001 4962 7.59 4.97 8.09 79 RCVD_IN_MSPIKE_L3 4881 1.37 4.89 0.72 80 RELAYCOUNTRY_FR 4820 0.99 4.83 0.27 81 URIBL_SBL_A 4575 1.11 4.58 0.46 82 TR_XM_COVIDMETA4 4563 1.35 4.57 0.75 83 XM_UB50 4460 1.94 4.47 1.46 84 T_XMDrugObfuBody_08 4298 2.06 4.30 1.64 85 RCVD_IN_MSPIKE_H3 4236 13.54 4.24 15.28 86 XM_SendGrid 4134 6.37 4.14 6.79 87 HTML_IMAGE_RATIO_08 4111 2.96 4.12 2.75 88 TR_XM_INV_DKIM 4003 0.84 4.01 0.25 89 URI_PHP_REDIR 3951 0.65 3.96 0.04 90 TR_LOTS_OF_MONEY3 3941 1.65 3.95 1.22 91 HTML_IMAGE_RATIO_04 3893 6.13 3.90 6.55 92 XMStrtUSub 3842 4.22 3.85 4.29 93 TR_XM_MaxBayes 3684 0.67 3.69 0.11 94 TR_XM_MaxSPIKE 3318 0.61 3.32 0.10 95 XM_OfRef6 3287 1.77 3.29 1.48 96 RCVD_IN_MSPIKE_H4 3235 9.14 3.24 10.25 97 XMNumbers 3175 3.33 3.18 3.36 98 XM_B_SpammyTLD 2947 2.14 2.95 1.99 99 TR_XM_COVIDMETA1 2904 0.95 2.91 0.59 100 TR_XM_MaxWHORU 2895 0.52 2.90 0.07 101 TR_XM_UnparsRelay 2887 0.98 2.89 0.62 102 TR_Mismatch_TLD_01 2780 0.62 2.78 0.22 103 URI_TRY_3LD 2777 1.79 2.78 1.61 104 XMDiploma_00 2727 1.93 2.73 1.78 105 XM_UB80 2665 0.47 2.67 0.06 106 TM2_M_URI_OPT_OUT 2663 3.76 2.67 3.97 107 T_XMHurry_00 2537 1.22 2.54 0.97 108 MIME_QP_LONG_LINE 2479 5.07 2.48 5.55 109 DATE_IN_PAST_03_06 2458 0.51 2.46 0.15 110 MIME_HTML_ONLY_MULTI 2429 4.05 2.43 4.35 111 XM_URI_RBL 2418 0.56 2.42 0.21 112 T_XMDrugObfuBody_14 2336 2.06 2.34 2.01 113 XMSexyCombo_01 2252 0.94 2.25 0.69 114 XM_CamelCaseFrm001 2224 1.98 2.23 1.94 115 XM_UB60 2212 0.47 2.21 0.14 116 XMHTML_After_End 2196 1.16 2.20 0.96 117 SUBJ_ALL_CAPS 2101 1.84 2.10 1.80 118 XM_B_SEO 2082 0.47 2.08 0.16 119 RELAYCOUNTRY_IL 2054 0.33 2.06 0.00 120 T_TooManySym_01 2041 3.97 2.04 4.33 121 ALL_TRUSTED 1997 10.60 2.00 12.21 122 URI_HEX 1939 1.87 1.94 1.86 123 TR_XM_PHPDW 1916 0.65 1.92 0.42 124 TR_XM_PHPForged 1886 0.64 1.89 0.41 125 TR_XM_FormFill2 1873 0.64 1.88 0.40 126 XM_UB95 1869 0.32 1.87 0.03 127 XM_H_PHPOS 1869 0.63 1.87 0.40 128 TR_Symld_Words 1826 1.89 1.83 1.90 129 XM_B_Unsub2 1799 2.35 1.80 2.45 130 DATE_IN_PAST_06_12 1798 0.47 1.80 0.23 131 KHOP_HELO_FCRDNS 1756 1.66 1.76 1.64 132 TR_XM_DK_SendGrid 1741 3.53 1.74 3.87 133 BAYES_40 1717 4.01 1.72 4.44 134 HTML_IMAGE_ONLY_28 1701 0.59 1.70 0.39 135 T_FILL_THIS_FORM_SHORT 1691 1.06 1.69 0.94 136 TR_XM_RelayPhish 1677 0.41 1.68 0.17 137 XMStockSpam_06 1634 0.97 1.64 0.84 138 TM2_M_VERY_LONG_WORD 1609 1.34 1.61 1.29 139 T_XMDrugObfuBody_00 1537 0.94 1.54 0.82 140 TR_XM_SEO4 1529 0.24 1.53 0.00 141 IMG_ONLY_FM_DOM_INFO 1529 0.24 1.53 0.00 142 RELAYCOUNTRY_DE 1518 0.70 1.52 0.55 143 DKIM_ADSP_CUSTOM_MED 1506 1.16 1.51 1.10 144 URI_NOVOWEL 1481 2.26 1.48 2.40 145 RELAYCOUNTRY_GB 1456 0.89 1.46 0.79 146 HK_RANDOM_REPLYTO 1367 0.46 1.37 0.29 147 T_PDS_OTHER_BAD_TLD 1361 0.58 1.36 0.44 148 XMGenDplmaNmb 1351 1.04 1.35 0.98 149 NML_ADSP_CUSTOM_MED 1336 0.89 1.34 0.80 150 FSL_THIS_IS_ADV 1330 0.30 1.33 0.11 151 MAILING_LIST_MULTI 1272 2.29 1.27 2.48 152 BAYES_20 1200 2.91 1.20 3.23 153 XM_PDF 1194 4.23 1.20 4.80 154 RDNS_DYNAMIC 1153 0.46 1.15 0.33 155 TR_Caps_n_Bayes_99 1142 0.35 1.14 0.20 156 FORGED_GMAIL_RCVD 1140 0.60 1.14 0.50 157 LongTLD 1134 0.31 1.14 0.16 158 TR_MetaPhish_Combo_01 1121 1.01 1.12 0.98 159 RELAYCOUNTRY_NL 1057 0.33 1.06 0.19 160 BAYES_00 1021 12.06 1.02 14.13 161 RCVD_IN_IADB_LISTED 1005 4.53 1.01 5.19 162 T_MONEY_PERCENT 987 0.37 0.99 0.25 163 TR_LOTS_OF_MONEY2 987 0.37 0.99 0.25 164 TR_XM_FormFill 983 0.20 0.98 0.05 165 XMSubMetaI_00 982 0.69 0.98 0.63 166 XMSexyCombo_04 980 0.27 0.98 0.13 167 T_Symld_Words_02 961 0.63 0.96 0.57 168 XM_XX_Yahoo 953 0.22 0.95 0.08 169 BODY_QUOTE_MALF_MSGID 923 0.51 0.92 0.43 170 XMBody_78 915 0.53 0.92 0.46 171 XM_DK_Undo_01 909 1.62 0.91 1.76 172 PLING_QUERY 897 0.56 0.90 0.50 173 XM_OfRef7 888 0.26 0.89 0.14 174 RCVD_IN_IADB_SPF 877 3.91 0.88 4.47 175 XMPhish30 873 0.83 0.87 0.82 176 INVESTMENT_ADVICE 869 0.24 0.87 0.13 177 XMSubNoVowel 864 0.93 0.87 0.94 178 REMOVE_BEFORE_LINK 859 0.53 0.86 0.47 179 RELAYCOUNTRY_IN 852 0.21 0.85 0.09 180 HELO_NODOT 851 1.37 0.85 1.47 181 HELO_NO_DOMAIN 851 1.37 0.85 1.46 182 TR_Mismatch_TLD_02 848 0.22 0.85 0.10 183 DIET_1 841 0.73 0.84 0.71 184 URIBL_BLACK 838 0.16 0.84 0.03 185 XM_H_Long_From02 837 1.03 0.84 1.07 186 RCVD_IN_IADB_SENDERID 825 3.48 0.83 3.98 187 RCVD_IN_IADB_DK 819 3.36 0.82 3.84 188 HTTPS_HTTP_MISMATCH 816 0.72 0.82 0.70 189 XM_ShortIntro_01 810 0.54 0.81 0.49 190 XM_H_MailChimp 808 0.30 0.81 0.21 191 XMGppyBdWords 808 0.27 0.81 0.17 192 MPART_ALT_DIFF_COUNT 804 0.39 0.81 0.31 193 XMSubMetaSxObfu_02 796 0.42 0.80 0.35 194 TooManyTo_002 795 1.61 0.80 1.76 195 XMSubMetaSxObfu_03 775 0.51 0.78 0.46 196 TR_XM_DK_Bayes 772 6.78 0.77 7.90 197 XMBdyGiftCard01 768 0.99 0.77 1.04 198 XM_Nigeria_01 758 0.19 0.76 0.08 199 XM_H_PHPMailer 740 0.51 0.74 0.47 200 XM_TLDProd2 740 0.24 0.74 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 523894 98.19 97.40 98.33 2 HTML_MESSAGE 475484 90.22 95.43 89.25 3 RELAYCOUNTRY_US 444251 81.45 71.14 83.39 4 DKIM_SIGNED 412356 76.59 72.27 77.40 5 XM_DK_Pass 406046 75.28 70.27 76.21 6 DKIM_VALID 384950 70.21 59.30 72.25 7 XM_B_Unicode 384408 71.71 69.33 72.15 8 XMListUnsubscribeExists 292724 56.67 65.87 54.94 9 DKIM_VALID_AU 287489 52.24 43.03 53.96 10 BAYES_50 281413 49.02 28.72 52.82 11 XM_B_Unicode3 223389 40.44 32.46 41.93 12 T_TM2_M_HEADER_IN_MSG 153006 27.56 21.39 28.72 13 HTML_FONT_LOW_CONTRAST 152211 27.76 23.43 28.57 14 RCVD_IN_MSPIKE_WL 145911 24.27 7.66 27.39 15 DKIM_VALID_EF 145260 27.00 25.56 27.27 16 LOC_TINY_FONT_1 140648 27.25 31.78 26.40 17 RCVD_IN_MSPIKE_H2 133898 25.17 25.37 25.13 18 FVGT_m_MULTI_ODD 119641 22.74 24.22 22.46 19 MIME_HTML_ONLY 117006 24.23 36.34 21.96 20 XMSubLong 111075 21.32 23.82 20.85 21 T_KAM_HTML_FONT_INVALID 100814 19.32 21.41 18.92 22 RCVD_IN_MSPIKE_H3 81427 13.54 4.24 15.28 23 BAYES_00 75296 12.06 1.02 14.13 24 XM_Body_Dirty_Words 72543 14.59 19.78 13.62 25 XM_DK_Undo_02 68268 18.88 51.25 12.81 26 XM_Multi_Part_URI 66689 13.83 20.83 12.52 27 ALL_TRUSTED 65042 10.60 2.00 12.21 28 XM_B_Unsub 58182 10.77 9.98 10.92 29 RCVD_IN_MSPIKE_H4 54619 9.14 3.24 10.25 30 LOTS_OF_MONEY 50173 11.05 19.74 9.42 31 LotsOfNums_01 49277 9.46 10.59 9.25 32 BAYES_99 44172 14.36 46.74 8.29 33 TooManyTo_001 43086 7.59 4.97 8.09 34 XM_Evil_Numbers_Gen 42983 8.04 7.91 8.07 35 TR_XM_DK_Bayes 42115 6.78 0.77 7.90 36 UNPARSEABLE_RELAY 40769 7.28 5.28 7.65 37 XM_B_Phish_Phrases 40681 8.54 13.34 7.64 38 TR_XM_DK_Bayes1 39479 6.33 0.60 7.41 39 BAYES_60 38422 7.06 6.24 7.21 40 RCVD_IN_RP_SAFE 37861 6.03 0.29 7.11 41 HTML_IMAGE_RATIO_02 36928 6.92 6.88 6.93 42 XM_DKIMWhitelistDomains 36333 5.74 0.01 6.82 43 XM_SendGrid 36178 6.37 4.14 6.79 44 BAYES_999 35644 11.42 36.64 6.69 45 TR_XM_DK_Bayes2 35548 5.66 0.23 6.67 46 RCVD_IN_RP_CERTIFIED 35334 5.61 0.17 6.63 47 HTML_IMAGE_RATIO_04 34919 6.13 3.90 6.55 48 MPART_ALT_DIFF 33474 7.05 11.17 6.28 49 IN_ZIMBRA_NJ_WHITELIST 31460 4.98 0.03 5.91 50 RELAYCOUNTRY_META 30118 8.68 24.83 5.65 51 BOTNET_IPINHOSTNAME 29718 6.89 13.91 5.58 52 MIME_QP_LONG_LINE 29578 5.07 2.48 5.55 53 XM_H_Long_From01 27944 5.24 5.23 5.25 54 RCVD_IN_IADB_LISTED 27662 4.53 1.01 5.19 55 DKIM_INVALID 27406 6.38 12.97 5.14 56 XM_PDF 25552 4.23 1.20 4.80 57 BAYES_80 25113 5.28 8.28 4.71 58 RCVD_IN_IADB_SPF 23831 3.91 0.88 4.47 59 BAYES_40 23654 4.01 1.72 4.44 60 MIME_HTML_ONLY_MULTI 23168 4.05 2.43 4.35 61 T_TooManySym_01 23057 3.97 2.04 4.33 62 XMStrtUSub 22853 4.22 3.85 4.29 63 HTML_IMAGE_RATIO_06 21696 4.31 5.57 4.07 64 RCVD_IN_IADB_SENDERID 21194 3.48 0.83 3.98 65 XM_H_Trusted_IP 21193 3.35 0.00 3.98 66 TM2_M_URI_OPT_OUT 21148 3.76 2.67 3.97 67 TR_XM_DK_SendGrid 20599 3.53 1.74 3.87 68 XMSexyCombo_05 20500 5.18 12.31 3.85 69 RCVD_IN_IADB_DK 20450 3.36 0.82 3.84 70 TR_XM_PhishingBody 19624 4.19 6.92 3.68 71 XMSubMetaSx_00 19387 4.21 7.24 3.64 72 T_REMOTE_IMAGE 18534 5.06 13.53 3.48 73 XMNumbers 17923 3.33 3.18 3.36 74 RCVD_IN_IADB_VOUCHED 17403 2.82 0.42 3.27 75 BAYES_20 17224 2.91 1.20 3.23 76 BOTNET 17211 8.34 35.59 3.23 77 BAYES_95 15604 3.32 5.41 2.93 78 XM_UncommonTLD01 15533 6.66 26.65 2.92 79 FROM_EXCESS_BASE64 15388 4.58 13.63 2.89 80 NO_DNS_FOR_FROM 15075 3.89 9.56 2.83 81 ANY_BOUNCE_MESSAGE 15028 2.47 0.57 2.82 82 BOUNCE_MESSAGE 15024 2.46 0.57 2.82 83 HTML_IMAGE_RATIO_08 14626 2.96 4.12 2.75 84 MIME_HTML_MOSTLY 13825 3.17 6.24 2.59 85 MAILING_LIST_MULTI 13205 2.29 1.27 2.48 86 UNTRUSTED_Relay 13168 5.23 19.94 2.47 87 XM_B_Unsub2 13065 2.35 1.80 2.45 88 HTML_MIME_NO_HTML_TAG 13036 4.25 13.86 2.45 89 URI_NOVOWEL 12810 2.26 1.48 2.40 90 BAYES_05 11865 1.98 0.66 2.23 91 T_TooManySym_02 11445 1.89 0.49 2.15 92 RCVD_IN_IADB_OPTIN 11219 1.84 0.44 2.11 93 T_XMDrugObfuBody_14 10711 2.06 2.34 2.01 94 XM_B_SpammyTLD 10577 2.14 2.95 1.99 95 RELAYCOUNTRY_CA 10553 2.74 6.81 1.98 96 XM_CamelCaseFrm001 10331 1.98 2.23 1.94 97 XM_B_Phish66 10326 2.42 4.98 1.94 98 XM_SPF_SoftFail 10211 2.89 8.06 1.92 99 RCVD_IN_BL_SPAMCOP_NET 10145 4.01 15.25 1.90 100 TR_Symld_Words 10127 1.89 1.83 1.90 101 URI_HEX 9911 1.87 1.94 1.86 102 RCVD_IN_MSPIKE_H5 9865 1.59 0.18 1.85 103 HTML_FONT_FACE_BAD 9846 1.67 0.70 1.85 104 XMBrknScrpt_02 9654 2.83 8.23 1.81 105 XM_B_COVIDMETA 9607 2.37 5.37 1.80 106 SUBJ_ALL_CAPS 9568 1.84 2.10 1.80 107 XMDiploma_00 9464 1.93 2.73 1.78 108 TooManyTo_002 9403 1.61 0.80 1.76 109 TVD_RCVD_IP 9369 1.52 0.22 1.76 110 XM_DK_Undo_01 9352 1.62 0.91 1.76 111 T_XMDrugObfuBody_08 8757 2.06 4.30 1.64 112 KHOP_HELO_FCRDNS 8746 1.66 1.76 1.64 113 URI_TRY_3LD 8565 1.79 2.78 1.61 114 XM_GoogleGroups 8415 1.40 0.42 1.58 115 XM_OfRef6 7883 1.77 3.29 1.48 116 HELO_NODOT 7807 1.37 0.85 1.47 117 HELO_NO_DOMAIN 7805 1.37 0.85 1.46 118 XM_UB50 7784 1.94 4.47 1.46 119 HELO_MISC_IP 7706 1.29 0.45 1.45 120 CK_HELO_DYNAMIC_SPLIT_IP 7700 1.28 0.42 1.45 121 IN_HORDE_ADDRESS_BOOK 7443 1.18 0.03 1.40 122 INVALID_MSGID 7325 1.20 0.26 1.37 123 TM2_M_VERY_LONG_WORD 6884 1.34 1.61 1.29 124 XMGappySubj_01 6693 1.08 0.12 1.26 125 XMBody_17 6603 1.91 5.51 1.24 126 TR_LOTS_OF_MONEY3 6499 1.65 3.95 1.22 127 TO_MALFORMED 6416 1.02 0.03 1.20 128 TooManyTo_003 6110 1.05 0.51 1.15 129 RCVD_IN_MSPIKE_BL 6021 3.15 13.91 1.13 130 DKIM_ADSP_CUSTOM_MED 5847 1.16 1.51 1.10 131 XM_ProductURIs 5741 1.00 0.61 1.08 132 XM_H_Long_From02 5687 1.03 0.84 1.07 133 XMBdyGiftCard01 5515 0.99 0.77 1.04 134 TR_MetaPhish_Combo_01 5242 1.01 1.12 0.98 135 XMGenDplmaNmb 5236 1.04 1.35 0.98 136 T_XMHurry_00 5188 1.22 2.54 0.97 137 XMHTML_After_End 5111 1.16 2.20 0.96 138 USER_IN_DEF_DKIM_WL 5093 0.81 0.01 0.96 139 XMCapTrack 5027 0.85 0.36 0.94 140 T_FILL_THIS_FORM_SHORT 5024 1.06 1.69 0.94 141 XMSubNoVowel 5024 0.93 0.87 0.94 142 T_TooManySym_03 4637 0.75 0.10 0.87 143 XMStockSpam_06 4496 0.97 1.64 0.84 144 T_XMDrugObfuBody_00 4388 0.94 1.54 0.82 145 XMPhish30 4386 0.83 0.87 0.82 146 TooManyTo_004 4266 0.75 0.46 0.80 147 NML_ADSP_CUSTOM_MED 4263 0.89 1.34 0.80 148 RELAYCOUNTRY_GB 4198 0.89 1.46 0.79 149 T_OBFU_PDF_ATTACH 4140 0.68 0.19 0.78 150 TR_MSPIKEBAYES00 4042 0.64 0.00 0.76 151 TR_XM_COVIDMETA4 3996 1.35 4.57 0.75 152 SpammyFromTLD_01 3896 2.03 8.96 0.73 153 TR_BOTNET_NEGATE 3874 0.68 0.41 0.73 154 RCVD_IN_MSPIKE_L3 3812 1.37 4.89 0.72 155 DIET_1 3788 0.73 0.84 0.71 156 HTTPS_HTTP_MISMATCH 3717 0.72 0.82 0.70 157 XMSexyCombo_01 3686 0.94 2.25 0.69 158 XMBody_95 3683 0.59 0.07 0.69 159 TooManyTo_005 3442 0.60 0.36 0.65 160 XMSubMetaI_00 3356 0.69 0.98 0.63 161 TR_XM_UnparsRelay 3305 0.98 2.89 0.62 162 MISSING_HEADERS 3262 0.62 0.67 0.61 163 XM_SPF_Unknown 3228 0.62 0.69 0.61 164 HTML_TAG_BALANCE_BODY 3145 0.60 0.66 0.59 165 HTML_IMAGE_ONLY_20 3144 0.54 0.27 0.59 166 TR_XM_COVIDMETA1 3119 0.95 2.91 0.59 167 FROM_GOV_DKIM_AU 3033 0.49 0.08 0.57 168 T_Symld_Words_02 3011 0.63 0.96 0.57 169 XM_DIRTYINTL 2982 1.33 5.45 0.56 170 XMMoneyMeta_00 2969 0.58 0.72 0.56 171 RELAYCOUNTRY_DE 2934 0.70 1.52 0.55 172 XMHTMLBadTable_001 2880 0.53 0.46 0.54 173 DKIM_ADSP_NXDOMAIN 2825 2.31 11.79 0.53 174 XMBSHREFv2 2718 0.47 0.22 0.51 175 PLING_QUERY 2676 0.56 0.90 0.50 176 FORGED_GMAIL_RCVD 2653 0.60 1.14 0.50 177 SUBJ_DOLLARS 2634 0.46 0.25 0.49 178 XM_ShortIntro_01 2629 0.54 0.81 0.49 179 XM_B_COPY_HTML 2628 0.53 0.72 0.49 180 TM2_M_A_HREF_HREF 2568 0.52 0.73 0.48 181 XM_H_PHPMailer 2513 0.51 0.74 0.47 182 XMPhish14 2502 0.49 0.61 0.47 183 REMOVE_BEFORE_LINK 2489 0.53 0.86 0.47 184 T_TooManySym_04 2482 0.40 0.03 0.47 185 XMSubMetaSxObfu_03 2474 0.51 0.78 0.46 186 URIBL_SBL_A 2451 1.11 4.58 0.46 187 XMBody_78 2438 0.53 0.92 0.46 188 NUMERIC_HTTP_ADDR 2402 0.46 0.48 0.45 189 XMLngstWrd_00 2379 0.43 0.34 0.45 190 XMPhish08 2356 0.48 0.67 0.44 191 FROM_GOV_SPOOF 2346 0.44 0.41 0.44 192 T_PDS_OTHER_BAD_TLD 2330 0.58 1.36 0.44 193 BODY_QUOTE_MALF_MSGID 2305 0.51 0.92 0.43 194 XM_B_REG_HTML 2300 0.38 0.13 0.43 195 XM_S_SubURI 2262 0.37 0.05 0.42 196 XMNoVowels 2259 0.43 0.49 0.42 197 TR_XM_PHPDW 2226 0.65 1.92 0.42 198 XMLngstWrd_01 2173 0.39 0.31 0.41 199 SpammyFromTLD_02 2169 2.67 14.75 0.41 200 TVD_PH_BODY_ACCOUNTS_PRE 2165 0.36 0.11 0.41 ----------------------------------------------------------------------