Email: 359442 Autolearn: 0 AvgScore: 0.91 AvgScanTime: 1.17 sec Spam: 61652 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.24 sec Ham: 297790 Autolearn: 0 AvgScore: -1.78 AvgScanTime: 1.15 sec Time Spent Running SA: 116.57 hours Time Spent Processing Spam: 21.21 hours Time Spent Processing Ham: 95.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 60484 98.82 98.11 98.96 2 HTML_MESSAGE 54560 88.11 88.50 88.03 3 DKIM_SIGNED 44278 79.40 71.82 80.97 4 XM_DK_Pass 42819 78.16 69.45 79.96 5 RELAYCOUNTRY_US 41778 80.65 67.76 83.32 6 DKIM_VALID 41438 76.57 67.21 78.51 7 XM_B_Unicode 40392 73.08 65.52 74.65 8 XMListUnsubscribeExists 37631 60.07 61.04 59.87 9 XM_B_SpammyWords 36397 53.38 59.04 52.21 10 DKIM_VALID_AU 31994 62.02 51.89 64.12 11 XM_DK_Undo_02 28766 18.29 46.66 12.42 12 BAYES_99 25987 14.66 42.15 8.97 13 XM_B_SpammyWords2 21615 26.74 35.06 25.02 14 MIME_HTML_ONLY 20733 25.86 33.63 24.25 15 XM_B_Unicode3 20020 42.42 32.47 44.48 16 BAYES_999 19911 11.54 32.30 7.24 17 LOC_TINY_FONT_1 19760 32.87 32.05 33.04 18 BAYES_50 19011 46.76 30.84 50.06 19 RELAYCOUNTRY_META 18995 9.50 30.81 5.08 20 BOTNET 18410 7.16 29.86 2.46 21 DKIM_VALID_EF 17527 28.57 28.43 28.60 22 XM_UncommonTLD01 16446 7.66 26.68 3.73 23 RCVD_IN_MSPIKE_H2 16259 27.47 26.37 27.70 24 HTML_FONT_LOW_CONTRAST 15432 32.20 25.03 33.69 25 FVGT_m_MULTI_ODD 14274 22.54 23.15 22.41 26 T_TM2_M_HEADER_IN_MSG 13850 22.80 22.46 22.87 27 T_KAM_HTML_FONT_INVALID 13537 17.75 21.96 16.88 28 UNTRUSTED_Relay 13373 6.05 21.69 2.81 29 XMSubLong 12376 21.08 20.07 21.29 30 XM_Multi_Part_URI 12151 15.95 19.71 15.17 31 XM_Body_Dirty_Words 10992 16.44 17.83 16.15 32 BOTNET_IPINHOSTNAME 9582 8.53 15.54 7.08 33 SpammyFromTLD_02 8982 2.66 14.57 0.20 34 RCVD_IN_MSPIKE_BL 8096 3.41 13.13 1.40 35 BOTNET_NORDNS 7590 2.12 12.31 0.01 36 HTML_MIME_NO_HTML_TAG 7403 3.59 12.01 1.84 37 LOTS_OF_MONEY 7391 8.63 11.99 7.94 38 XM_B_SpammyWords3 7227 7.71 11.72 6.88 39 FROM_EXCESS_BASE64 7188 5.13 11.66 3.78 40 T_REMOTE_IMAGE 7140 4.50 11.58 3.03 41 XM_B_Phish_Phrases 7039 8.17 11.42 7.49 42 FROM_SUSPICIOUS_NTLD 6753 2.02 10.95 0.17 43 FROM_SUSPICIOUS_NTLD_FP 6719 2.00 10.90 0.16 44 HTML_IMAGE_RATIO_02 6599 10.24 10.70 10.15 45 DKIM_ADSP_NXDOMAIN 6536 2.49 10.60 0.81 46 XMSexyCombo_05 6471 7.48 10.50 6.85 47 LotsOfNums_01 6368 8.96 10.33 8.67 48 BODY_URI_ONLY 6158 1.74 9.99 0.04 49 T_HTML_TAG_BALANCE_CENTER 6063 1.80 9.83 0.14 50 HDRS_MISSP 5997 1.72 9.73 0.06 51 BAYES_80 5945 6.05 9.64 5.31 52 XMBody_50 5943 1.65 9.64 0.00 53 XM_B_Unsub 5714 9.71 9.27 9.81 54 RCVD_IN_MSPIKE_WL 5712 27.29 9.26 31.03 55 XM_Evil_Numbers_Gen 5358 9.74 8.69 9.96 56 MPART_ALT_DIFF 5169 6.04 8.38 5.55 57 RCVD_IN_BL_SPAMCOP_NET 5109 2.49 8.29 1.29 58 XMSubMetaSx_00 4964 6.05 8.05 5.63 59 RELAYCOUNTRY_CA 4916 3.15 7.97 2.16 60 XMBody_17 4619 2.50 7.49 1.46 61 BAYES_60 4589 7.65 7.44 7.69 62 MIME_HTML_MOSTLY 4530 3.74 7.35 2.99 63 XMBrknScrpt_02 4369 2.76 7.09 1.86 64 RCVD_IN_MSPIKE_L3 4362 2.03 7.08 0.98 65 XM_UB99 4360 1.22 7.07 0.01 66 XM_UB50 3958 2.06 6.42 1.15 67 RCVD_IN_RP_RNBL 3943 1.13 6.40 0.04 68 TR_XM_PhishingBody 3803 3.84 6.17 3.36 69 RELAYCOUNTRY_FR 3754 1.25 6.09 0.25 70 TooManyTo_001 3611 6.73 5.86 6.91 71 SpammyFromTLD_01 3521 1.41 5.71 0.52 72 HTML_IMAGE_RATIO_04 3459 7.20 5.61 7.53 73 XM_OfRef6 3359 2.29 5.45 1.64 74 RCVD_IN_MSPIKE_H3 3344 15.49 5.42 17.57 75 XM_UB999 3337 0.93 5.41 0.00 76 XM_B_COVIDMETA 3330 1.81 5.40 1.07 77 XM_H_Long_From01 3299 5.36 5.35 5.37 78 XM_DIRTYINTL 3194 1.35 5.18 0.56 79 RCVD_IN_MSPIKE_L5 3099 1.14 5.03 0.34 80 TR_XM_MaxSPIKE 3094 0.94 5.02 0.09 81 BAYES_95 3068 3.47 4.98 3.15 82 URI_PHP_REDIR 3025 0.87 4.91 0.03 83 XM_SPF_SoftFail 2846 1.74 4.62 1.15 84 DKIM_INVALID 2840 2.83 4.61 2.46 85 UNPARSEABLE_RELAY 2775 7.89 4.50 8.59 86 TM2_M_VERY_LONG_WORD 2641 1.85 4.28 1.34 87 XM_JunkDunk 2563 0.71 4.16 0.00 88 T_XMDrugObfuBody_08 2448 2.06 3.97 1.67 89 XM_B_Phish66 2313 1.49 3.75 1.03 90 XM_B_SpammyTLD 2253 2.04 3.65 1.71 91 RCVD_IN_MSPIKE_H4 2197 10.39 3.56 11.80 92 URI_HEX 2061 2.22 3.34 1.99 93 SUBJ_ALL_CAPS 2032 1.98 3.30 1.71 94 TR_LOTS_OF_MONEY3 2008 1.14 3.26 0.70 95 XM_CamelCaseFrm001 1969 2.04 3.19 1.81 96 URIBL_SBL_A 1966 0.78 3.19 0.28 97 TR_XM_PHPDW 1966 0.87 3.19 0.39 98 TR_XM_PHPForged 1925 0.82 3.12 0.35 99 TR_XM_FormFill2 1909 0.82 3.10 0.35 100 XM_SendGrid 1907 6.65 3.09 7.39 101 XM_UB80 1903 0.55 3.09 0.03 102 XM_H_PHPOS 1897 0.81 3.08 0.34 103 ALL_TRUSTED 1874 10.30 3.04 11.81 104 XMStrtUSub 1840 5.28 2.98 5.75 105 LH_URI_DOM_IN_PATH 1808 1.99 2.93 1.79 106 T_TooManySym_01 1794 5.12 2.91 5.58 107 XMSubMetaD_00 1740 0.54 2.82 0.07 108 PDS_FROM_2_EMAILS 1708 0.50 2.77 0.03 109 RCVD_IN_PSBL 1706 0.54 2.77 0.08 110 TR_XM_UnparsRelay 1688 0.98 2.74 0.61 111 T_XMHurry_00 1679 1.21 2.72 0.89 112 XMSlimDrugH 1676 0.82 2.72 0.42 113 XM_URI_RBL 1657 0.61 2.69 0.18 114 XMNumbers 1656 3.74 2.69 3.95 115 XM_UB60 1608 0.53 2.61 0.10 116 SUBJ_BUY 1599 0.49 2.59 0.05 117 T_PDS_TO_EQ_FROM_NAME 1599 0.46 2.59 0.02 118 TR_Mismatch_TLD_02 1535 0.50 2.49 0.09 119 DATE_IN_PAST_03_06 1473 0.50 2.39 0.11 120 TM2_M_URI_OPT_OUT 1453 4.42 2.36 4.85 121 NO_FM_NAME_IP_HOSTN 1453 0.41 2.36 0.00 122 TR_XM_MaxBayes 1448 0.42 2.35 0.02 123 TR_XM_INV_DKIM 1428 0.50 2.32 0.13 124 RELAYCOUNTRY_NL 1421 0.55 2.30 0.18 125 URI_TRY_3LD 1411 1.58 2.29 1.44 126 HTML_IMAGE_RATIO_08 1406 2.76 2.28 2.86 127 XM_B_Unsub2 1393 1.24 2.26 1.02 128 TR_XM_COVIDMETA1 1377 0.54 2.23 0.19 129 DRUGS_ERECTILE 1346 0.38 2.18 0.01 130 XMHTML_After_End 1338 1.19 2.17 0.98 131 LONG_JUNK_URI2 1303 0.41 2.11 0.06 132 TR_XM_COVIDMETA4 1209 0.56 1.96 0.27 133 MISSING_HEADERS 1202 0.82 1.95 0.58 134 RELAYCOUNTRY_IN 1196 0.39 1.94 0.07 135 KHOP_HELO_FCRDNS 1188 1.15 1.93 0.99 136 XMSexyCombo_01 1182 1.14 1.92 0.98 137 XM_B_SpammyWords4 1170 0.84 1.90 0.63 138 XMGppyBdWords 1165 0.44 1.89 0.13 139 HTML_IMAGE_RATIO_06 1151 3.68 1.87 4.06 140 T_XMDrugObfuBody_14 1139 1.74 1.85 1.72 141 XMSubNoVowel 1138 1.11 1.85 0.96 142 RELAYCOUNTRY_JP 1138 0.34 1.85 0.03 143 T_PDS_OTHER_BAD_TLD 1137 0.63 1.84 0.38 144 BAYES_40 1134 3.45 1.84 3.78 145 TR_XM_RelayPhish 1124 0.43 1.82 0.14 146 T_FILL_THIS_FORM_SHORT 1105 0.95 1.79 0.77 147 RDNS_DYNAMIC 1097 0.87 1.78 0.68 148 XMSubMetaD_01 1094 0.31 1.77 0.01 149 XM_UB95 1070 0.31 1.74 0.02 150 T_XMDrugObfuBody_00 1068 0.75 1.73 0.54 151 BAYES_20 1057 2.81 1.71 3.04 152 MIMEOLE_DIRECT_TO_MX 1037 0.29 1.68 0.00 153 TR_XM_SpoofStaff 981 0.35 1.59 0.09 154 IMPOTENCE 978 0.29 1.59 0.02 155 XMSpoofStaff2 973 0.35 1.58 0.09 156 SERGIO_SUBJECT_VIAGRA01 962 0.27 1.56 0.00 157 DIET_1 957 0.75 1.55 0.59 158 TR_XM_DK_SendGrid 931 3.65 1.51 4.09 159 HELO_NODOT 911 0.95 1.48 0.84 160 HELO_NO_DOMAIN 911 0.95 1.48 0.84 161 TR_XM_SB_Phish 906 1.68 1.47 1.73 162 XMSubEmpty 881 0.71 1.43 0.56 163 MILLION_HUNDRED 870 0.24 1.41 0.00 164 INVESTMENT_ADVICE 869 0.32 1.41 0.09 165 MONEY_FRAUD_8 866 0.24 1.40 0.00 166 URI_GOOGLE_PROXY 865 0.29 1.40 0.07 167 HK_RANDOM_REPLYTO 861 0.46 1.40 0.27 168 ADVANCE_FEE_5_NEW_MONEY 860 0.24 1.39 0.00 169 MIME_HTML_ONLY_MULTI 834 3.33 1.35 3.75 170 XMSubPhish11 821 1.65 1.33 1.72 171 XMDiploma_00 819 2.08 1.33 2.23 172 XM_H_SpoofStaff4 811 0.33 1.32 0.13 173 XMBdyGiftCard01 798 1.84 1.29 1.95 174 CK_HELO_DYNAMIC_SPLIT_IP 795 2.41 1.29 2.64 175 TR_Symld_Words 785 1.52 1.27 1.57 176 XM_H_PHPMailer 784 0.72 1.27 0.60 177 MIME_CHARSET_FARAWAY 782 0.32 1.27 0.12 178 XM_SPF_Unknown 779 0.47 1.26 0.31 179 DKIM_ADSP_CUSTOM_MED 778 1.10 1.26 1.07 180 XMStockSpam_06 777 1.52 1.26 1.57 181 TR_Mismatch_TLD_01 777 0.40 1.26 0.22 182 TR_XM_SpoofStaff2 777 0.22 1.26 0.00 183 HDR_ORDER_FTSDMCXX_DIRECT 752 0.21 1.22 0.00 184 DOS_OE_TO_MX 751 0.21 1.22 0.00 185 XM_OfRef7 743 0.29 1.21 0.10 186 URI_ONLY_MSGID_MALF 742 0.21 1.20 0.00 187 TR_Sbj_FN_Bdy 741 0.67 1.20 0.56 188 XMObfuSubjects 738 0.21 1.20 0.01 189 NML_ADSP_CUSTOM_MED 727 0.81 1.18 0.73 190 XMPhish14 707 0.84 1.15 0.77 191 URI_NOVOWEL 704 1.58 1.14 1.67 192 DATE_IN_PAST_06_12 692 0.61 1.12 0.50 193 CHARSET_FARAWAY_HEADER 683 0.24 1.11 0.06 194 TR_XM_PSC1 675 0.27 1.09 0.09 195 XMReplyNow 655 0.29 1.06 0.13 196 REPLYTO_WITHOUT_TO_CC 654 0.51 1.06 0.40 197 XM_ShortIntro_01 652 1.16 1.06 1.18 198 FROM_MISSP_REPLYTO 651 0.19 1.06 0.01 199 MIME_QP_LONG_LINE 641 3.36 1.04 3.84 200 FORGED_GMAIL_RCVD 639 0.61 1.04 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 294700 98.82 98.11 98.96 2 HTML_MESSAGE 262147 88.11 88.50 88.03 3 RELAYCOUNTRY_US 248116 80.65 67.76 83.32 4 DKIM_SIGNED 241119 79.40 71.82 80.97 5 XM_DK_Pass 238120 78.16 69.45 79.96 6 DKIM_VALID 233786 76.57 67.21 78.51 7 XM_B_Unicode 222290 73.08 65.52 74.65 8 DKIM_VALID_AU 190947 62.02 51.89 64.12 9 XMListUnsubscribeExists 178294 60.07 61.04 59.87 10 XM_B_SpammyWords 155490 53.38 59.04 52.21 11 BAYES_50 149080 46.76 30.84 50.06 12 XM_B_Unicode3 132456 42.42 32.47 44.48 13 HTML_FONT_LOW_CONTRAST 100321 32.20 25.03 33.69 14 LOC_TINY_FONT_1 98394 32.87 32.05 33.04 15 RCVD_IN_MSPIKE_WL 92397 27.29 9.26 31.03 16 DKIM_VALID_EF 85175 28.57 28.43 28.60 17 RCVD_IN_MSPIKE_H2 82488 27.47 26.37 27.70 18 XM_B_SpammyWords2 74503 26.74 35.06 25.02 19 MIME_HTML_ONLY 72217 25.86 33.63 24.25 20 T_TM2_M_HEADER_IN_MSG 68117 22.80 22.46 22.87 21 FVGT_m_MULTI_ODD 66747 22.54 23.15 22.41 22 XMSubLong 63405 21.08 20.07 21.29 23 RCVD_IN_MSPIKE_H3 52323 15.49 5.42 17.57 24 T_KAM_HTML_FONT_INVALID 50279 17.75 21.96 16.88 25 XM_Body_Dirty_Words 48086 16.44 17.83 16.15 26 BAYES_00 46103 12.91 0.50 15.48 27 XM_Multi_Part_URI 45188 15.95 19.71 15.17 28 XM_DK_Undo_02 36985 18.29 46.66 12.42 29 ALL_TRUSTED 35166 10.30 3.04 11.81 30 RCVD_IN_MSPIKE_H4 35151 10.39 3.56 11.80 31 RCVD_IN_RP_SAFE 33398 9.44 0.87 11.22 32 RCVD_IN_RP_CERTIFIED 31648 8.90 0.54 10.63 33 XM_DKIMWhitelistDomains 31562 8.78 0.00 10.60 34 HTML_IMAGE_RATIO_02 30220 10.24 10.70 10.15 35 TR_XM_DK_Bayes 29678 8.30 0.27 9.97 36 XM_Evil_Numbers_Gen 29662 9.74 8.69 9.96 37 XM_B_Unsub 29201 9.71 9.27 9.81 38 TR_XM_DK_Bayes1 28957 8.10 0.26 9.72 39 TR_XM_DK_Bayes2 27074 7.57 0.23 9.09 40 BAYES_99 26697 14.66 42.15 8.97 41 LotsOfNums_01 25824 8.96 10.33 8.67 42 UNPARSEABLE_RELAY 25593 7.89 4.50 8.59 43 LOTS_OF_MONEY 23639 8.63 11.99 7.94 44 BAYES_60 22901 7.65 7.44 7.69 45 HTML_IMAGE_RATIO_04 22411 7.20 5.61 7.53 46 XM_B_Phish_Phrases 22313 8.17 11.42 7.49 47 XM_SendGrid 22005 6.65 3.09 7.39 48 BAYES_999 21557 11.54 32.30 7.24 49 BOTNET_IPINHOSTNAME 21093 8.53 15.54 7.08 50 TooManyTo_001 20564 6.73 5.86 6.91 51 XM_B_SpammyWords3 20484 7.71 11.72 6.88 52 XMSexyCombo_05 20410 7.48 10.50 6.85 53 XMStrtUSub 17136 5.28 2.98 5.75 54 XMSubMetaSx_00 16768 6.05 8.05 5.63 55 T_TooManySym_01 16612 5.12 2.91 5.58 56 MPART_ALT_DIFF 16535 6.04 8.38 5.55 57 XM_H_Long_From01 15978 5.36 5.35 5.37 58 BAYES_80 15799 6.05 9.64 5.31 59 RELAYCOUNTRY_META 15137 9.50 30.81 5.08 60 TM2_M_URI_OPT_OUT 14451 4.42 2.36 4.85 61 IN_ZIMBRA_NJ_WHITELIST 12181 3.41 0.12 4.09 62 TR_XM_DK_SendGrid 12180 3.65 1.51 4.09 63 HTML_IMAGE_RATIO_06 12083 3.68 1.87 4.06 64 XMNumbers 11773 3.74 2.69 3.95 65 MIME_QP_LONG_LINE 11439 3.36 1.04 3.84 66 BAYES_40 11270 3.45 1.84 3.78 67 FROM_EXCESS_BASE64 11258 5.13 11.66 3.78 68 MIME_HTML_ONLY_MULTI 11153 3.33 1.35 3.75 69 XM_UncommonTLD01 11099 7.66 26.68 3.73 70 RCVD_IN_IADB_LISTED 10708 3.14 0.97 3.60 71 TR_XM_PhishingBody 10008 3.84 6.17 3.36 72 T_TooManySym_02 9736 2.85 0.84 3.27 73 BAYES_95 9391 3.47 4.98 3.15 74 ANY_BOUNCE_MESSAGE 9358 2.77 0.96 3.14 75 BOUNCE_MESSAGE 9358 2.77 0.96 3.14 76 XM_H_Trusted_IP 9356 2.60 0.00 3.14 77 RCVD_IN_IADB_SPF 9248 2.71 0.80 3.11 78 BAYES_20 9061 2.81 1.71 3.04 79 T_REMOTE_IMAGE 9028 4.50 11.58 3.03 80 MIME_HTML_MOSTLY 8917 3.74 7.35 2.99 81 TVD_RCVD_IP 8859 2.54 0.42 2.97 82 HTML_IMAGE_RATIO_08 8514 2.76 2.28 2.86 83 UNTRUSTED_Relay 8365 6.05 21.69 2.81 84 RCVD_IN_IADB_SENDERID 8244 2.42 0.74 2.77 85 RCVD_IN_IADB_DK 7993 2.35 0.75 2.68 86 CK_HELO_DYNAMIC_SPLIT_IP 7874 2.41 1.29 2.64 87 HELO_MISC_IP 7873 2.32 0.77 2.64 88 INVALID_MSGID 7580 2.18 0.41 2.55 89 BAYES_05 7484 2.23 0.89 2.51 90 DKIM_INVALID 7333 2.83 4.61 2.46 91 BOTNET 7321 7.16 29.86 2.46 92 RCVD_IN_IADB_VOUCHED 6684 1.93 0.41 2.24 93 XMDiploma_00 6652 2.08 1.33 2.23 94 RELAYCOUNTRY_CA 6422 3.15 7.97 2.16 95 TO_MALFORMED 6360 1.77 0.01 2.14 96 URI_HEX 5935 2.22 3.34 1.99 97 XMBdyGiftCard01 5814 1.84 1.29 1.95 98 HTML_FONT_FACE_BAD 5764 1.73 0.76 1.94 99 XMBrknScrpt_02 5545 2.76 7.09 1.86 100 HTML_MIME_NO_HTML_TAG 5486 3.59 12.01 1.84 101 XM_CamelCaseFrm001 5377 2.04 3.19 1.81 102 LH_URI_DOM_IN_PATH 5333 1.99 2.93 1.79 103 TR_XM_SB_Phish 5141 1.68 1.47 1.73 104 T_XMDrugObfuBody_14 5128 1.74 1.85 1.72 105 MAILING_LIST_MULTI 5125 1.59 0.96 1.72 106 XMSubPhish11 5117 1.65 1.33 1.72 107 SUBJ_ALL_CAPS 5102 1.98 3.30 1.71 108 XM_B_SpammyTLD 5084 2.04 3.65 1.71 109 T_XMDrugObfuBody_08 4969 2.06 3.97 1.67 110 URI_NOVOWEL 4965 1.58 1.14 1.67 111 RCVD_IN_MSPIKE_H5 4923 1.42 0.28 1.65 112 XM_OfRef6 4873 2.29 5.45 1.64 113 XM_PDF 4827 1.43 0.48 1.62 114 IN_HORDE_ADDRESS_BOOK 4709 1.40 0.50 1.58 115 XMStockSpam_06 4678 1.52 1.26 1.57 116 TR_Symld_Words 4667 1.52 1.27 1.57 117 XM_DK_Undo_01 4631 1.44 0.89 1.56 118 XMGappySubj_01 4540 1.30 0.21 1.52 119 TR_MSPIKEBAYES00 4472 1.24 0.00 1.50 120 RCVD_IN_IADB_OPTIN 4442 1.30 0.38 1.49 121 XMBody_17 4361 2.50 7.49 1.46 122 USER_IN_DEF_DKIM_WL 4317 1.20 0.00 1.45 123 URI_TRY_3LD 4282 1.58 2.29 1.44 124 XM_ProductURIs 4186 1.29 0.76 1.41 125 RCVD_IN_MSPIKE_BL 4176 3.41 13.13 1.40 126 T_TooManySym_03 4035 1.15 0.18 1.35 127 TM2_M_VERY_LONG_WORD 3994 1.85 4.28 1.34 128 RCVD_IN_BL_SPAMCOP_NET 3843 2.49 8.29 1.29 129 XM_H_Long_From02 3620 1.06 0.30 1.22 130 XM_ShortIntro_01 3520 1.16 1.06 1.18 131 TooManyTo_002 3473 1.06 0.54 1.17 132 XM_UB50 3430 2.06 6.42 1.15 133 XM_SPF_SoftFail 3412 1.74 4.62 1.15 134 XM_GoogleGroups 3229 0.96 0.34 1.08 135 XM_B_COVIDMETA 3189 1.81 5.40 1.07 136 DKIM_ADSP_CUSTOM_MED 3186 1.10 1.26 1.07 137 XMGenDplmaNmb 3157 1.02 0.83 1.06 138 PLING_QUERY 3105 0.95 0.49 1.04 139 XM_B_Phish66 3058 1.49 3.75 1.03 140 SUBJ_DOLLARS 3052 0.91 0.34 1.02 141 XM_B_Unsub2 3050 1.24 2.26 1.02 142 KHOP_HELO_FCRDNS 2953 1.15 1.93 0.99 143 XMHTMLBadTable_001 2933 0.87 0.34 0.98 144 XMSexyCombo_01 2929 1.14 1.92 0.98 145 XMHTML_After_End 2925 1.19 2.17 0.98 146 RCVD_IN_MSPIKE_L3 2919 2.03 7.08 0.98 147 XMSubNoVowel 2851 1.11 1.85 0.96 148 XMPhish08 2681 0.83 0.49 0.90 149 T_XMHurry_00 2665 1.21 2.72 0.89 150 TM2_M_A_HREF_HREF 2578 0.89 1.01 0.87 151 TooManyTo_003 2558 0.79 0.43 0.86 152 HELO_NODOT 2490 0.95 1.48 0.84 153 HELO_NO_DOMAIN 2489 0.95 1.48 0.84 154 T_TooManySym_04 2479 0.70 0.08 0.83 155 DKIM_ADSP_NXDOMAIN 2403 2.49 10.60 0.81 156 TR_MetaPhish_Combo_01 2394 0.81 0.81 0.80 157 HTML_TAG_BALANCE_BODY 2344 0.75 0.58 0.79 158 XMBody_95 2341 0.66 0.08 0.79 159 XMPhish14 2301 0.84 1.15 0.77 160 T_FILL_THIS_FORM_SHORT 2292 0.95 1.79 0.77 161 XM_S_SubURI 2247 0.65 0.12 0.75 162 NO_DNS_FOR_FROM 2229 0.78 0.94 0.75 163 NML_ADSP_CUSTOM_MED 2181 0.81 1.18 0.73 164 XM_B_REG_HTML 2137 0.60 0.04 0.72 165 XMSubMetaI_00 2093 0.68 0.55 0.70 166 TooManyTo_004 2087 0.65 0.38 0.70 167 TR_LOTS_OF_MONEY3 2079 1.14 3.26 0.70 168 RDNS_DYNAMIC 2038 0.87 1.78 0.68 169 XMSubMetaSxObfu_02 2011 0.70 0.83 0.68 170 XMPhish30 1990 0.72 0.97 0.67 171 T_MANY_PILL_PRICE 1938 0.54 0.00 0.65 172 T_TooManySym_05 1925 0.54 0.03 0.65 173 XM_B_SpammyWords4 1865 0.84 1.90 0.63 174 TR_XM_UnparsRelay 1819 0.98 2.74 0.61 175 TooManyTo_005 1790 0.55 0.30 0.60 176 XM_H_PHPMailer 1789 0.72 1.27 0.60 177 TR_BOTNET_NEGATE 1767 0.60 0.61 0.59 178 DIET_1 1753 0.75 1.55 0.59 179 XM_B_COPY_HTML 1744 0.59 0.61 0.59 180 RELAYCOUNTRY_GB 1743 0.63 0.87 0.59 181 MISSING_HEADERS 1732 0.82 1.95 0.58 182 USER_IN_WELCOMELIST 1684 0.47 0.00 0.57 183 USER_IN_WHITELIST 1684 0.47 0.00 0.57 184 SPOOFED_URL 1681 0.63 0.93 0.56 185 XM_DIRTYINTL 1676 1.35 5.18 0.56 186 XMSubEmpty 1676 0.71 1.43 0.56 187 NUMERIC_HTTP_ADDR 1671 0.57 0.62 0.56 188 TR_Sbj_FN_Bdy 1654 0.67 1.20 0.56 189 T_XMDrugObfuBody_00 1616 0.75 1.73 0.54 190 HTML_IMAGE_ONLY_20 1605 0.48 0.19 0.54 191 HTTPS_HTTP_MISMATCH 1561 0.51 0.47 0.52 192 FORGED_GMAIL_RCVD 1539 0.61 1.04 0.52 193 SpammyFromTLD_01 1538 1.41 5.71 0.52 194 DATE_IN_PAST_06_12 1494 0.61 1.12 0.50 195 XM_RXBody 1484 0.48 0.37 0.50 196 XMSubMetaSxObfu_03 1459 0.57 0.97 0.49 197 XMBody_78 1448 0.52 0.68 0.49 198 MPART_ALT_DIFF_COUNT 1428 0.55 0.91 0.48 199 XMBSHREFv2 1416 0.41 0.11 0.48 200 XMLngstWrd_00 1415 0.50 0.64 0.48 ----------------------------------------------------------------------