Email: 355334 Autolearn: 0 AvgScore: 1.16 AvgScanTime: 1.69 sec Spam: 66585 Autolearn: 0 AvgScore: 14.37 AvgScanTime: 2.82 sec Ham: 288749 Autolearn: 0 AvgScore: -1.89 AvgScanTime: 1.43 sec Time Spent Running SA: 166.79 hours Time Spent Processing Spam: 52.24 hours Time Spent Processing Ham: 114.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 64943 98.67 97.53 98.93 2 HTML_MESSAGE 61079 87.68 91.73 86.74 3 DKIM_SIGNED 49179 79.16 73.86 80.38 4 XM_B_Unicode 49047 74.32 73.66 74.47 5 XM_DK_Pass 47500 77.83 71.34 79.33 6 XMListUnsubscribeExists 42896 60.06 64.42 59.05 7 RELAYCOUNTRY_US 42279 79.26 63.50 82.89 8 DKIM_VALID 41185 73.63 61.85 76.34 9 XM_B_SpammyWords 36576 51.79 54.93 51.06 10 XM_DK_Undo_02 34796 20.59 52.26 13.29 11 DKIM_VALID_AU 30973 59.69 46.52 62.73 12 BAYES_99 28458 15.63 42.74 9.37 13 BOTNET 22342 8.76 33.55 3.05 14 BAYES_999 22311 12.48 33.51 7.64 15 MIME_HTML_ONLY 22241 26.16 33.40 24.49 16 XM_B_Unicode3 21882 42.62 32.86 44.87 17 RELAYCOUNTRY_META 21818 10.42 32.77 5.27 18 XM_B_SpammyWords2 21102 26.82 31.69 25.70 19 BAYES_50 20192 46.44 30.33 50.15 20 LOC_TINY_FONT_1 19336 32.58 29.04 33.40 21 T_TM2_M_HEADER_IN_MSG 18620 23.99 27.96 23.07 22 XM_UncommonTLD01 18488 8.26 27.77 3.76 23 HTML_FONT_LOW_CONTRAST 16885 32.13 25.36 33.70 24 DKIM_VALID_EF 16577 27.28 24.90 27.82 25 FVGT_m_MULTI_ODD 16504 22.38 24.79 21.83 26 XMSubLong 16388 21.84 24.61 21.20 27 UNTRUSTED_Relay 16287 6.64 24.46 2.53 28 RCVD_IN_MSPIKE_H2 15858 26.11 23.82 26.64 29 XM_Multi_Part_URI 13988 15.98 21.01 14.82 30 T_KAM_HTML_FONT_INVALID 13078 17.91 19.64 17.51 31 XM_Body_Dirty_Words 11026 15.22 16.56 14.92 32 RCVD_IN_MSPIKE_BL 9609 3.70 14.43 1.22 33 SpammyFromTLD_02 9609 2.89 14.43 0.22 34 BOTNET_IPINHOSTNAME 9593 8.48 14.41 7.11 35 LOTS_OF_MONEY 9546 8.69 14.34 7.39 36 BOTNET_NORDNS 8821 2.49 13.25 0.01 37 RCVD_IN_BL_SPAMCOP_NET 8613 3.54 12.94 1.37 38 HTML_MIME_NO_HTML_TAG 8012 3.37 12.03 1.37 39 DKIM_INVALID 7994 5.53 12.01 4.03 40 FROM_SUSPICIOUS_NTLD 7986 2.32 11.99 0.08 41 FROM_SUSPICIOUS_NTLD_FP 7956 2.30 11.95 0.08 42 XM_B_SpammyWords3 7642 7.77 11.48 6.91 43 XM_B_Phish_Phrases 7494 7.78 11.25 6.97 44 HTML_IMAGE_RATIO_02 6833 10.04 10.26 9.99 45 FROM_EXCESS_BASE64 6790 5.30 10.20 4.18 46 LotsOfNums_01 6738 9.08 10.12 8.85 47 RCVD_IN_RP_RNBL 6643 1.91 9.98 0.05 48 MPART_ALT_DIFF 6634 6.96 9.96 6.27 49 T_REMOTE_IMAGE 6224 4.18 9.35 2.99 50 XMSexyCombo_05 6189 6.65 9.29 6.04 51 RELAYCOUNTRY_CA 6155 3.58 9.24 2.27 52 BAYES_80 5976 6.12 8.97 5.46 53 SpammyFromTLD_01 5973 2.13 8.97 0.55 54 XM_SPF_SoftFail 5971 2.76 8.97 1.33 55 DKIM_ADSP_NXDOMAIN 5793 2.35 8.70 0.89 56 XM_B_Unsub 5464 9.87 8.21 10.26 57 XM_UB50 5456 2.36 8.19 1.02 58 RCVD_IN_MSPIKE_L5 5409 1.89 8.12 0.45 59 XM_Evil_Numbers_Gen 5389 9.94 8.09 10.36 60 RCVD_IN_MSPIKE_WL 5371 26.59 8.07 30.86 61 NO_DNS_FOR_FROM 5342 3.38 8.02 2.31 62 T_HTML_TAG_BALANCE_CENTER 5326 1.70 8.00 0.25 63 HDRS_MISSP 5150 1.62 7.73 0.21 64 XM_UB99 5056 1.43 7.59 0.01 65 RCVD_IN_PSBL 4990 1.45 7.49 0.05 66 BODY_URI_ONLY 4923 1.42 7.39 0.04 67 BAYES_60 4882 7.77 7.33 7.87 68 MIME_HTML_MOSTLY 4111 3.71 6.17 3.14 69 XM_UB999 4059 1.15 6.10 0.00 70 XMSubMetaSx_00 4053 4.68 6.09 4.36 71 TooManyTo_001 4013 6.95 6.03 7.16 72 UNPARSEABLE_RELAY 3944 8.13 5.92 8.64 73 RCVD_IN_MSPIKE_L3 3769 1.65 5.66 0.72 74 XM_B_SpammyTLD 3735 2.54 5.61 1.84 75 XM_H_Long_From01 3703 5.18 5.56 5.09 76 T_XMDrugObfuBody_08 3651 2.65 5.48 1.99 77 XMBody_17 3535 2.37 5.31 1.70 78 XM_DIRTYINTL 3374 1.46 5.07 0.63 79 T_PDS_OTHER_BAD_TLD 3317 1.17 4.98 0.29 80 TR_XM_PhishingBody 3244 3.09 4.87 2.68 81 BAYES_95 3231 3.62 4.85 3.33 82 RCVD_IN_MSPIKE_H3 3047 14.99 4.58 17.40 83 XMBrknScrpt_02 2981 1.92 4.48 1.33 84 HTML_FONT_TINY_NORDNS 2840 1.10 4.27 0.37 85 RELAYCOUNTRY_FR 2796 0.99 4.20 0.25 86 XM_SendGrid 2768 6.94 4.16 7.58 87 XM_JunkDunk 2747 0.77 4.13 0.00 88 XMDiploma_00 2745 2.12 4.12 1.66 89 DIET_1 2636 1.35 3.96 0.74 90 T_FILL_THIS_FORM_SHORT 2529 1.37 3.80 0.81 91 XMStrtUSub 2525 5.71 3.79 6.15 92 HTML_IMAGE_RATIO_04 2497 7.01 3.75 7.76 93 RELAYCOUNTRY_CZ 2325 0.66 3.49 0.01 94 FORGED_MUA_MOZILLA 2262 0.65 3.40 0.01 95 RELAYCOUNTRY_GB 2257 1.12 3.39 0.59 96 XMGenDplmaNmb 2247 1.26 3.37 0.77 97 RCVD_IN_MSPIKE_H4 2218 10.30 3.33 11.91 98 TR_XM_INV_DKIM 2216 0.76 3.33 0.17 99 TR_XM_MaxSPIKE 2140 0.62 3.21 0.02 100 XM_OfRef6 2128 1.91 3.20 1.62 101 TR_LOTS_OF_MONEY3 2126 1.13 3.19 0.65 102 XM_UB60 2109 0.68 3.17 0.11 103 URI_PHP_REDIR 2083 0.59 3.13 0.01 104 TR_XM_UnparsRelay 1986 1.01 2.98 0.56 105 XMNumbers 1975 3.70 2.97 3.87 106 XMSlimDrugH 1968 0.81 2.96 0.31 107 HTML_IMAGE_RATIO_08 1874 2.88 2.81 2.90 108 URI_HEX 1848 1.94 2.78 1.74 109 XM_B_COVIDMETA 1806 1.04 2.71 0.66 110 URIBL_SBL_A 1798 0.71 2.70 0.25 111 TR_XM_COVIDMETA4 1736 0.84 2.61 0.44 112 XM_B_Phish66 1730 1.41 2.60 1.14 113 DATE_IN_PAST_03_06 1720 0.59 2.58 0.13 114 TR_Mismatch_TLD_02 1684 0.54 2.53 0.08 115 XM_CamelCaseFrm001 1677 2.23 2.52 2.16 116 HTML_IMAGE_RATIO_06 1677 3.82 2.52 4.12 117 XM_UB80 1675 0.51 2.52 0.04 118 SUBJ_ALL_CAPS 1656 1.36 2.49 1.11 119 XM_ContractorBdy01 1647 0.46 2.47 0.00 120 TM2_M_URI_OPT_OUT 1639 4.47 2.46 4.94 121 XMWghtMeta_00 1638 0.55 2.46 0.11 122 TR_XM_PHPDW 1601 0.74 2.40 0.35 123 TR_XM_PHPForged 1600 0.72 2.40 0.33 124 KHOP_HELO_FCRDNS 1597 1.39 2.40 1.16 125 TR_XM_MaxBayes 1584 0.48 2.38 0.05 126 XMSlimDrugs 1582 0.46 2.38 0.01 127 TR_XM_FormFill2 1560 0.71 2.34 0.33 128 XM_H_PHPOS 1552 0.70 2.33 0.32 129 TM2_M_VERY_LONG_WORD 1529 1.41 2.30 1.21 130 XMGppyBdWords 1509 0.55 2.27 0.16 131 IMG_ONLY_FM_DOM_INFO 1509 0.42 2.27 0.00 132 TR_XM_FormFill 1477 0.49 2.22 0.09 133 HTML_IMAGE_ONLY_12 1445 0.52 2.17 0.14 134 T_TooManySym_01 1428 5.96 2.14 6.84 135 BAYES_40 1380 3.52 2.07 3.85 136 TR_XM_MaxWHORU 1375 0.44 2.07 0.06 137 BAYES_20 1310 3.29 1.97 3.60 138 RDNS_DYNAMIC 1302 0.80 1.96 0.53 139 URI_TRY_3LD 1299 1.58 1.95 1.50 140 TR_Symld_Words 1297 1.64 1.95 1.57 141 DKIM_ADSP_CUSTOM_MED 1285 1.24 1.93 1.09 142 XMSexyCombo_01 1261 0.78 1.89 0.52 143 T_XMDrugObfuBody_14 1226 1.62 1.84 1.56 144 MIME_QP_LONG_LINE 1220 3.28 1.83 3.61 145 MIME_HTML_ONLY_MULTI 1216 3.55 1.83 3.95 146 NML_ADSP_CUSTOM_MED 1214 0.95 1.82 0.74 147 T_XMHurry_00 1213 1.20 1.82 1.06 148 T_XMDrugObfuBody_00 1192 0.87 1.79 0.66 149 TR_Mismatch_TLD_01 1186 0.55 1.78 0.27 150 XM_B_SpammyWords4 1120 1.08 1.68 0.95 151 XM_URI_RBL 1094 0.46 1.64 0.18 152 DATE_IN_PAST_06_12 1084 0.53 1.63 0.28 153 FORGED_GMAIL_RCVD 1073 0.71 1.61 0.51 154 FROM_WORDY 1068 0.31 1.60 0.01 155 TR_XM_RelayPhish 1062 0.39 1.59 0.11 156 MPART_ALT_DIFF_COUNT 1055 0.70 1.58 0.49 157 XMStockSpam_06 1033 1.67 1.55 1.70 158 DEAR_SOMETHING 1023 0.38 1.54 0.11 159 LH_URI_DOM_IN_PATH 1013 1.57 1.52 1.58 160 XMBdyGiftCard01 1005 1.47 1.51 1.46 161 XMSubNoVowel 990 1.15 1.49 1.07 162 XMMoneyMeta_00 966 0.60 1.45 0.40 163 XM_UB95 948 0.28 1.42 0.02 164 DRUGS_ERECTILE 941 0.29 1.41 0.03 165 TR_XM_DK_SendGrid 933 3.82 1.40 4.38 166 LONG_JUNK_URI 925 0.29 1.39 0.04 167 XMSubMetaI_00 914 0.98 1.37 0.90 168 XMBody_78 904 0.58 1.36 0.40 169 ALL_TRUSTED 879 10.40 1.32 12.50 170 MIME_CHARSET_FARAWAY 878 0.34 1.32 0.12 171 RELAYCOUNTRY_IT 868 0.27 1.30 0.03 172 XM_DK_Undo_01 851 1.53 1.28 1.59 173 XM_H_PHPMailer 846 0.68 1.27 0.54 174 INVESTMENT_ADVICE 832 0.33 1.25 0.12 175 URI_NOVOWEL 819 1.47 1.23 1.52 176 RELAYCOUNTRY_NL 818 0.47 1.23 0.29 177 XM_B_Unsub2 814 1.05 1.22 1.01 178 HK_RANDOM_REPLYTO 812 0.35 1.22 0.15 179 SUBJ_DOLLARS 807 0.67 1.21 0.55 180 XM_BadFromFormat 807 0.46 1.21 0.29 181 CHARSET_FARAWAY_HEADER 772 0.26 1.16 0.05 182 RELAYCOUNTRY_IN 769 0.27 1.15 0.07 183 TR_XM_COVIDMETA1 763 0.39 1.15 0.22 184 RELAYCOUNTRY_DE 761 0.53 1.14 0.39 185 LongTLD 758 0.30 1.14 0.10 186 MISSING_HEADERS 752 0.40 1.13 0.23 187 XMPhish30 726 0.64 1.09 0.53 188 MAILING_LIST_MULTI 717 1.67 1.08 1.80 189 THIS_AD 708 0.63 1.06 0.53 190 FROM_MISSP_REPLYTO 694 0.20 1.04 0.00 191 T_Symld_Words_02 690 0.49 1.04 0.37 192 XMReplyNow 683 0.31 1.03 0.14 193 XMSexyCombo_04 667 0.29 1.00 0.12 194 RELAYCOUNTRY_RU 661 0.30 0.99 0.14 195 XMHTML_After_End 661 0.78 0.99 0.73 196 BAYES_05 660 1.87 0.99 2.07 197 XMSubject_38 659 0.19 0.99 0.00 198 HTML_FONT_SIZE_HUGE 654 0.49 0.98 0.37 199 XMSubMetaD_00 649 0.25 0.97 0.09 200 BASE64_LENGTH_79_INF 647 0.52 0.97 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 285671 98.67 97.53 98.93 2 HTML_MESSAGE 250473 87.68 91.73 86.74 3 RELAYCOUNTRY_US 239355 79.26 63.50 82.89 4 DKIM_SIGNED 232092 79.16 73.86 80.38 5 XM_DK_Pass 229069 77.83 71.34 79.33 6 DKIM_VALID 220441 73.63 61.85 76.34 7 XM_B_Unicode 215039 74.32 73.66 74.47 8 DKIM_VALID_AU 181132 59.69 46.52 62.73 9 XMListUnsubscribeExists 170514 60.06 64.42 59.05 10 XM_B_SpammyWords 147435 51.79 54.93 51.06 11 BAYES_50 144819 46.44 30.33 50.15 12 XM_B_Unicode3 129550 42.62 32.86 44.87 13 HTML_FONT_LOW_CONTRAST 97294 32.13 25.36 33.70 14 LOC_TINY_FONT_1 96444 32.58 29.04 33.40 15 RCVD_IN_MSPIKE_WL 89104 26.59 8.07 30.86 16 DKIM_VALID_EF 80344 27.28 24.90 27.82 17 RCVD_IN_MSPIKE_H2 76922 26.11 23.82 26.64 18 XM_B_SpammyWords2 74195 26.82 31.69 25.70 19 MIME_HTML_ONLY 70702 26.16 33.40 24.49 20 T_TM2_M_HEADER_IN_MSG 66611 23.99 27.96 23.07 21 FVGT_m_MULTI_ODD 63034 22.38 24.79 21.83 22 XMSubLong 61219 21.84 24.61 21.20 23 T_KAM_HTML_FONT_INVALID 50564 17.91 19.64 17.51 24 RCVD_IN_MSPIKE_H3 50233 14.99 4.58 17.40 25 XM_Body_Dirty_Words 43072 15.22 16.56 14.92 26 XM_Multi_Part_URI 42806 15.98 21.01 14.82 27 BAYES_00 41244 11.75 0.74 14.28 28 XM_DK_Undo_02 38365 20.59 52.26 13.29 29 ALL_TRUSTED 36089 10.40 1.32 12.50 30 RCVD_IN_MSPIKE_H4 34392 10.30 3.33 11.91 31 XM_DKIMWhitelistDomains 31651 8.91 0.01 10.96 32 RCVD_IN_RP_SAFE 31452 8.94 0.48 10.89 33 XM_Evil_Numbers_Gen 29922 9.94 8.09 10.36 34 RCVD_IN_RP_CERTIFIED 29727 8.43 0.33 10.30 35 XM_B_Unsub 29614 9.87 8.21 10.26 36 HTML_IMAGE_RATIO_02 28844 10.04 10.26 9.99 37 BAYES_99 27068 15.63 42.74 9.37 38 LotsOfNums_01 25543 9.08 10.12 8.85 39 UNPARSEABLE_RELAY 24962 8.13 5.92 8.64 40 TR_XM_DK_Bayes 24218 6.89 0.37 8.39 41 TR_XM_DK_Bayes1 23075 6.54 0.24 7.99 42 BAYES_60 22736 7.77 7.33 7.87 43 HTML_IMAGE_RATIO_04 22400 7.01 3.75 7.76 44 BAYES_999 22050 12.48 33.51 7.64 45 XM_SendGrid 21880 6.94 4.16 7.58 46 TR_XM_DK_Bayes2 21512 6.09 0.21 7.45 47 LOTS_OF_MONEY 21327 8.69 14.34 7.39 48 TooManyTo_001 20667 6.95 6.03 7.16 49 BOTNET_IPINHOSTNAME 20536 8.48 14.41 7.11 50 XM_B_Phish_Phrases 20137 7.78 11.25 6.97 51 XM_B_SpammyWords3 19955 7.77 11.48 6.91 52 T_TooManySym_01 19744 5.96 2.14 6.84 53 MPART_ALT_DIFF 18096 6.96 9.96 6.27 54 XMStrtUSub 17748 5.71 3.79 6.15 55 XMSexyCombo_05 17436 6.65 9.29 6.04 56 BAYES_80 15769 6.12 8.97 5.46 57 RELAYCOUNTRY_META 15210 10.42 32.77 5.27 58 XM_H_Long_From01 14686 5.18 5.56 5.09 59 TM2_M_URI_OPT_OUT 14255 4.47 2.46 4.94 60 IN_ZIMBRA_NJ_WHITELIST 12688 3.58 0.04 4.39 61 TR_XM_DK_SendGrid 12644 3.82 1.40 4.38 62 XMSubMetaSx_00 12579 4.68 6.09 4.36 63 FROM_EXCESS_BASE64 12060 5.30 10.20 4.18 64 HTML_IMAGE_RATIO_06 11896 3.82 2.52 4.12 65 DKIM_INVALID 11651 5.53 12.01 4.03 66 MIME_HTML_ONLY_MULTI 11404 3.55 1.83 3.95 67 XMNumbers 11169 3.70 2.97 3.87 68 BAYES_40 11123 3.52 2.07 3.85 69 XM_UncommonTLD01 10848 8.26 27.77 3.76 70 ANY_BOUNCE_MESSAGE 10786 3.13 0.51 3.74 71 BOUNCE_MESSAGE 10786 3.13 0.51 3.74 72 T_TooManySym_02 10751 3.14 0.62 3.72 73 MIME_QP_LONG_LINE 10437 3.28 1.83 3.61 74 BAYES_20 10388 3.29 1.97 3.60 75 BAYES_95 9617 3.62 4.85 3.33 76 RCVD_IN_IADB_LISTED 9341 2.77 0.73 3.23 77 TVD_RCVD_IP 9090 2.63 0.37 3.15 78 MIME_HTML_MOSTLY 9077 3.71 6.17 3.14 79 XM_H_Trusted_IP 9073 2.55 0.00 3.14 80 BOTNET 8798 8.76 33.55 3.05 81 T_REMOTE_IMAGE 8634 4.18 9.35 2.99 82 HTML_IMAGE_RATIO_08 8372 2.88 2.81 2.90 83 RCVD_IN_IADB_SPF 8162 2.41 0.61 2.83 84 TR_XM_PhishingBody 7728 3.09 4.87 2.68 85 CK_HELO_DYNAMIC_SPLIT_IP 7690 2.30 0.71 2.66 86 HELO_MISC_IP 7689 2.30 0.70 2.66 87 INVALID_MSGID 7629 2.28 0.73 2.64 88 RCVD_IN_IADB_SENDERID 7361 2.18 0.56 2.55 89 UNTRUSTED_Relay 7298 6.64 24.46 2.53 90 RCVD_IN_IADB_DK 7128 2.11 0.57 2.47 91 NO_DNS_FOR_FROM 6664 3.38 8.02 2.31 92 RELAYCOUNTRY_CA 6562 3.58 9.24 2.27 93 TO_MALFORMED 6315 1.78 0.03 2.19 94 XM_CamelCaseFrm001 6247 2.23 2.52 2.16 95 BAYES_05 5976 1.87 0.99 2.07 96 T_XMDrugObfuBody_08 5760 2.65 5.48 1.99 97 RCVD_IN_IADB_VOUCHED 5601 1.64 0.34 1.94 98 XM_B_SpammyTLD 5304 2.54 5.61 1.84 99 MAILING_LIST_MULTI 5200 1.67 1.08 1.80 100 URI_HEX 5030 1.94 2.78 1.74 101 XMStockSpam_06 4905 1.67 1.55 1.70 102 HTML_FONT_FACE_BAD 4896 1.49 0.61 1.70 103 XMBody_17 4896 2.37 5.31 1.70 104 XMGappySubj_01 4866 1.40 0.15 1.69 105 XM_PDF 4856 1.44 0.38 1.68 106 XMDiploma_00 4784 2.12 4.12 1.66 107 XM_OfRef6 4666 1.91 3.20 1.62 108 IN_HORDE_ADDRESS_BOOK 4595 1.32 0.17 1.59 109 XM_DK_Undo_01 4595 1.53 1.28 1.59 110 LH_URI_DOM_IN_PATH 4563 1.57 1.52 1.58 111 USER_IN_DEF_DKIM_WL 4547 1.28 0.00 1.57 112 TR_Symld_Words 4531 1.64 1.95 1.57 113 T_XMDrugObfuBody_14 4517 1.62 1.84 1.56 114 RCVD_IN_MSPIKE_H5 4479 1.29 0.16 1.55 115 URI_NOVOWEL 4398 1.47 1.23 1.52 116 URI_TRY_3LD 4318 1.58 1.95 1.50 117 XMBdyGiftCard01 4222 1.47 1.51 1.46 118 XM_GoogleGroups 3980 1.19 0.37 1.38 119 T_TooManySym_03 3968 1.14 0.13 1.37 120 RCVD_IN_BL_SPAMCOP_NET 3967 3.54 12.94 1.37 121 HTML_MIME_NO_HTML_TAG 3947 3.37 12.03 1.37 122 XMBrknScrpt_02 3830 1.92 4.48 1.33 123 XM_SPF_SoftFail 3830 2.76 8.97 1.33 124 TR_MSPIKEBAYES00 3780 1.07 0.01 1.31 125 RCVD_IN_IADB_OPTIN 3739 1.11 0.28 1.29 126 XM_RXBody 3626 1.12 0.51 1.26 127 XM_H_Long_From02 3620 1.17 0.79 1.25 128 RCVD_IN_MSPIKE_BL 3531 3.70 14.43 1.22 129 TM2_M_VERY_LONG_WORD 3493 1.41 2.30 1.21 130 TooManyTo_002 3409 1.07 0.61 1.18 131 KHOP_HELO_FCRDNS 3347 1.39 2.40 1.16 132 XM_B_Phish66 3282 1.41 2.60 1.14 133 XM_ProductURIs 3214 1.02 0.60 1.11 134 SUBJ_ALL_CAPS 3194 1.36 2.49 1.11 135 DKIM_ADSP_CUSTOM_MED 3136 1.24 1.93 1.09 136 XMSubNoVowel 3080 1.15 1.49 1.07 137 T_XMHurry_00 3052 1.20 1.82 1.06 138 XM_UB50 2942 2.36 8.19 1.02 139 XM_B_Unsub2 2915 1.05 1.22 1.01 140 XMHTMLBadTable_001 2852 0.90 0.51 0.99 141 HTML_TAG_BALANCE_BODY 2774 0.94 0.87 0.96 142 XM_B_SpammyWords4 2733 1.08 1.68 0.95 143 XMSubMetaI_00 2585 0.98 1.37 0.90 144 DKIM_ADSP_NXDOMAIN 2572 2.35 8.70 0.89 145 T_TooManySym_04 2514 0.72 0.05 0.87 146 XMBody_95 2507 0.72 0.07 0.87 147 TooManyTo_003 2482 0.77 0.38 0.86 148 TR_MetaPhish_Combo_01 2458 0.86 0.92 0.85 149 T_FILL_THIS_FORM_SHORT 2346 1.37 3.80 0.81 150 XM_S_SubURI 2281 0.67 0.14 0.79 151 XMGenDplmaNmb 2220 1.26 3.37 0.77 152 NML_ADSP_CUSTOM_MED 2151 0.95 1.82 0.74 153 DIET_1 2150 1.35 3.96 0.74 154 XM_B_REG_HTML 2137 0.63 0.14 0.74 155 XMHTML_After_End 2105 0.78 0.99 0.73 156 RCVD_IN_MSPIKE_L3 2085 1.65 5.66 0.72 157 XMBSHREFv2 2049 0.60 0.12 0.71 158 TooManyTo_004 2034 0.64 0.36 0.70 159 XM_B_COPY_HTML 2011 0.71 0.75 0.70 160 T_MANY_PILL_PRICE 1944 0.55 0.00 0.67 161 TR_BOTNET_NEGATE 1937 0.67 0.65 0.67 162 T_TooManySym_05 1931 0.54 0.01 0.67 163 T_XMDrugObfuBody_00 1917 0.87 1.79 0.66 164 XM_B_COVIDMETA 1901 1.04 2.71 0.66 165 TR_LOTS_OF_MONEY3 1885 1.13 3.19 0.65 166 XM_DIRTYINTL 1818 1.46 5.07 0.63 167 XMPhish08 1807 0.63 0.67 0.63 168 USER_IN_WELCOMELIST 1764 0.50 0.00 0.61 169 USER_IN_WHITELIST 1764 0.50 0.00 0.61 170 XM_ShortIntro_01 1762 0.62 0.64 0.61 171 XMSubMetaSxObfu_02 1753 0.54 0.26 0.61 172 RELAYCOUNTRY_GB 1713 1.12 3.39 0.59 173 TooManyTo_005 1670 0.53 0.31 0.58 174 TR_XM_UnparsRelay 1606 1.01 2.98 0.56 175 SUBJ_DOLLARS 1590 0.67 1.21 0.55 176 SpammyFromTLD_01 1581 2.13 8.97 0.55 177 XM_H_PHPMailer 1554 0.68 1.27 0.54 178 XMPhish30 1544 0.64 1.09 0.53 179 HTML_IMAGE_ONLY_20 1533 0.49 0.30 0.53 180 RDNS_DYNAMIC 1529 0.80 1.96 0.53 181 THIS_AD 1523 0.63 1.06 0.53 182 NUMERIC_HTTP_ADDR 1504 0.56 0.74 0.52 183 XMSexyCombo_01 1504 0.78 1.89 0.52 184 FORGED_GMAIL_RCVD 1463 0.71 1.61 0.51 185 MPART_ALT_DIFF_COUNT 1416 0.70 1.58 0.49 186 XMSubMetaSxObfu_03 1357 0.51 0.70 0.47 187 XMNoVowels 1352 0.49 0.60 0.47 188 XMLngstWrd_00 1328 0.43 0.31 0.46 189 HTTPS_HTTP_MISMATCH 1322 0.48 0.59 0.46 190 BODY_ENHANCEMENT 1315 0.38 0.06 0.46 191 HELO_NODOT 1309 0.53 0.88 0.45 192 HELO_NO_DOMAIN 1308 0.53 0.88 0.45 193 RCVD_IN_MSPIKE_L5 1290 1.89 8.12 0.45 194 TR_XM_COVIDMETA4 1259 0.84 2.61 0.44 195 FILL_THIS_FORM 1247 0.46 0.59 0.43 196 XMLngstWrd_01 1226 0.40 0.28 0.42 197 BASE64_LENGTH_79_INF 1210 0.52 0.97 0.42 198 XMMoneyMeta_00 1164 0.60 1.45 0.40 199 XMBody_78 1160 0.58 1.36 0.40 200 RELAYCOUNTRY_DE 1124 0.53 1.14 0.39 ----------------------------------------------------------------------