Email: 692127 Autolearn: 0 AvgScore: 2.17 AvgScanTime: 1.17 sec Spam: 144029 Autolearn: 0 AvgScore: 14.04 AvgScanTime: 1.13 sec Ham: 548098 Autolearn: 0 AvgScore: -0.95 AvgScanTime: 1.19 sec Time Spent Running SA: 225.59 hours Time Spent Processing Spam: 45.02 hours Time Spent Processing Ham: 180.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 138839 98.14 96.40 98.60 2 HTML_MESSAGE 136782 88.61 94.97 86.94 3 XM_B_Unicode 102364 70.72 71.07 70.63 4 RELAYCOUNTRY_US 92403 76.33 64.16 79.53 5 XM_B_SpammyWords 90127 52.01 62.58 49.24 6 DKIM_SIGNED 84866 72.29 58.92 75.80 7 XM_DK_Pass 82074 70.82 56.98 74.46 8 DKIM_VALID 79164 68.78 54.96 72.41 9 XMListUnsubscribeExists 72203 51.95 50.13 52.43 10 MIME_HTML_ONLY 69796 26.71 48.46 21.00 11 XM_B_Unicode3 62540 40.17 43.42 39.32 12 RCVD_IN_MSPIKE_H2 61885 30.03 42.97 26.63 13 DKIM_VALID_AU 60895 51.97 42.28 54.51 14 XM_DK_Undo_02 55403 16.31 38.47 10.49 15 RELAYCOUNTRY_META 49250 11.44 34.19 5.46 16 BAYES_50 46424 48.27 32.23 52.49 17 BAYES_99 45673 12.19 31.71 7.05 18 BOTNET 42783 7.88 29.70 2.14 19 RCVD_IN_BL_SPAMCOP_NET 42132 7.38 29.25 1.63 20 XM_B_Unsub 42107 13.98 29.24 9.97 21 XMSubLong 41007 23.09 28.47 21.67 22 XM_B_SpammyWords2 40520 23.90 28.13 22.78 23 DKIM_VALID_EF 37725 28.00 26.19 28.48 24 LOC_TINY_FONT_1 37250 24.72 25.86 24.42 25 HTML_MIME_NO_HTML_TAG 36202 7.00 25.14 2.24 26 BAYES_999 35147 9.57 24.40 5.67 27 UNTRUSTED_Relay 34803 6.78 24.16 2.21 28 RCVD_IN_PSBL 33875 4.94 23.52 0.05 29 T_KAM_HTML_FONT_INVALID 30516 19.12 21.19 18.58 30 XM_UncommonTLD01 28386 6.64 19.71 3.20 31 HTML_FONT_LOW_CONTRAST 27245 25.43 18.92 27.14 32 XM_Multi_Part_URI 26437 13.90 18.36 12.73 33 FROM_EXCESS_BASE64 26012 5.95 18.06 2.77 34 FVGT_m_MULTI_ODD 25889 21.27 17.97 22.14 35 T_TM2_M_HEADER_IN_MSG 25044 26.54 17.39 28.95 36 RCVD_IN_RP_RNBL 23154 3.40 16.08 0.07 37 XM_Body_Dirty_Words 21519 13.39 14.94 12.98 38 BOTNET_IPINHOSTNAME 20221 7.19 14.04 5.39 39 BAYES_60 18002 7.90 12.50 6.69 40 BAYES_80 17802 5.97 12.36 4.29 41 T_REMOTE_IMAGE 15811 4.90 10.98 3.31 42 XMSexyCombo_05 15318 5.54 10.64 4.20 43 RCVD_IN_MSPIKE_BL 14311 2.83 9.94 0.96 44 LOTS_OF_MONEY 13819 8.14 9.59 7.76 45 KHOP_HELO_FCRDNS 13722 3.49 9.53 1.91 46 MPART_ALT_DIFF 13640 5.46 9.47 4.40 47 SpammyFromTLD_02 12971 2.12 9.01 0.32 48 XM_B_Phish_Phrases 12891 6.48 8.95 5.83 49 BODY_URI_ONLY 12485 1.83 8.67 0.04 50 XM_B_SpammyWords3 12233 6.50 8.49 5.98 51 HTML_IMAGE_RATIO_02 11727 7.32 8.14 7.10 52 MIME_HTML_MOSTLY 11326 3.62 7.86 2.50 53 RCVD_IN_MSPIKE_WL 11294 23.62 7.84 27.77 54 XM_UB50 10526 2.41 7.31 1.12 55 XMSubMetaSx_00 10344 4.77 7.18 4.13 56 XM_Evil_Numbers_Gen 10028 7.67 6.96 7.85 57 BOTNET_NORDNS 9829 1.43 6.82 0.01 58 URI_PHP_REDIR 9785 1.43 6.79 0.02 59 HK_RANDOM_FROM 8908 1.39 6.18 0.14 60 SpammyFromTLD_01 8872 2.06 6.16 0.98 61 RCVD_IN_MSPIKE_L3 8816 1.78 6.12 0.64 62 LotsOfNums_01 8666 8.35 6.02 8.96 63 RELAYCOUNTRY_FR 8352 1.45 5.80 0.31 64 HTML_FONT_TINY_NORDNS 8250 1.30 5.73 0.13 65 RELAYCOUNTRY_CA 7862 2.53 5.46 1.76 66 BAYES_95 7753 3.26 5.38 2.71 67 T_HTML_TAG_BALANCE_CENTER 7742 1.25 5.38 0.16 68 RELAYCOUNTRY_GB 7524 1.82 5.22 0.93 69 TR_XM_PhishingBody 7440 3.52 5.17 3.09 70 XM_UB99 7361 1.07 5.11 0.01 71 LH_URI_DOM_IN_PATH 7243 2.49 5.03 1.83 72 XMSubGiftCard1 6941 1.04 4.82 0.05 73 XM_DIRTYINTL 6917 1.53 4.80 0.66 74 DKIM_ADSP_NXDOMAIN 6766 1.61 4.70 0.80 75 HTML_IMAGE_RATIO_04 6130 5.33 4.26 5.61 76 TooManyTo_001 6087 7.18 4.23 7.95 77 XM_SPF_SoftFail 5955 2.36 4.13 1.89 78 RCVD_IN_MSPIKE_H3 5906 13.10 4.10 15.46 79 FROM_SUSPICIOUS_NTLD 5851 0.90 4.06 0.07 80 XMNumbers 5827 4.36 4.05 4.45 81 XM_H_Long_From01 5807 5.12 4.03 5.41 82 SHORTENED_URL_HREF 5783 1.07 4.02 0.29 83 FROM_SUSPICIOUS_NTLD_FP 5777 0.88 4.01 0.06 84 DKIM_INVALID 5702 3.51 3.96 3.39 85 HTML_SHORT_LINK_IMG_1 5531 0.82 3.84 0.02 86 XM_B_COVIDMETA 5425 1.75 3.77 1.22 87 HDRS_MISSP 5366 0.85 3.73 0.10 88 UNPARSEABLE_RELAY 5320 6.54 3.69 7.28 89 XM_UB999 5208 0.76 3.62 0.00 90 T_FILL_THIS_FORM_SHORT 5198 1.42 3.61 0.85 91 XM_UB60 5189 0.85 3.60 0.12 92 XM_UB80 5145 0.78 3.57 0.05 93 SHORT_SHORTNER 5032 0.74 3.49 0.01 94 SHORTENED_URL_SRC 5015 0.73 3.48 0.00 95 SHORTENER_SHORT_IMG 5002 0.72 3.47 0.00 96 RCVD_IN_MSPIKE_H4 4864 8.78 3.38 10.20 97 RELAYCOUNTRY_IN 4827 0.79 3.35 0.12 98 XM_B_SpammyTLD 4758 2.16 3.30 1.86 99 URIBL_SBL_A 4743 0.90 3.29 0.27 100 XM_B_Phish66 4741 2.11 3.29 1.80 101 XMBrknScrpt_02 4577 1.72 3.18 1.34 102 TR_XM_SB_Phish 4570 2.26 3.17 2.02 103 XMSubPhish11 4526 2.23 3.14 1.99 104 TR_Symld_Words 4351 3.04 3.02 3.05 105 XM_OfRef6 4276 1.50 2.97 1.11 106 HTML_IMAGE_ONLY_08 4233 0.70 2.94 0.11 107 TR_XM_MaxBayes 4138 0.65 2.87 0.07 108 RCVD_IN_MSPIKE_L5 4047 0.76 2.81 0.22 109 XM_SendGrid 3978 5.74 2.76 6.52 110 SHORT_URI_3 3869 0.62 2.69 0.07 111 XMBody_17 3807 1.34 2.64 0.99 112 TR_XM_MaxSPIKE 3773 0.59 2.62 0.05 113 FROM_LOCAL_NOVOWEL 3729 0.56 2.59 0.03 114 XMStrtUSub 3700 3.76 2.57 4.08 115 T_TooManySym_01 3627 4.82 2.52 5.42 116 XMBody_50 3593 0.52 2.49 0.00 117 LOCALPART_IN_SUBJECT 3585 0.54 2.49 0.02 118 XMManySubDom_06 3565 0.53 2.48 0.02 119 T_XMDrugObfuBody_08 3528 1.85 2.45 1.69 120 XMDiploma_00 3468 1.87 2.41 1.72 121 XM_CamelCaseFrm001 3393 1.90 2.36 1.78 122 URI_HEX 3243 1.76 2.25 1.64 123 TM2_M_URI_OPT_OUT 3192 2.93 2.22 3.12 124 XM_UB95 3153 0.47 2.19 0.02 125 XM_URI_RBL 3149 0.60 2.19 0.19 126 XMHTML_After_End 3126 1.10 2.17 0.82 127 T_XMDrugObfuBody_00 3078 1.05 2.14 0.77 128 HTML_IMAGE_RATIO_06 3058 3.07 2.12 3.31 129 TR_XM_COVIDMETA4 3028 0.82 2.10 0.48 130 FVGT_m_MULTI_ODD_EMAIL 2970 0.46 2.06 0.04 131 XM_BadFromFormat 2967 0.60 2.06 0.21 132 XMSexyCombo_01 2909 1.07 2.02 0.83 133 HTML_IMAGE_RATIO_08 2894 2.19 2.01 2.24 134 RELAYCOUNTRY_NL 2807 0.59 1.95 0.23 135 XM_B_Unsub2 2789 2.29 1.94 2.38 136 TR_MetaPhish_Combo_01 2725 1.02 1.89 0.79 137 BAYES_40 2695 4.67 1.87 5.40 138 TR_XM_PHPDW 2674 0.69 1.86 0.39 139 TR_XM_PHPForged 2662 0.68 1.85 0.38 140 MIME_QP_LONG_LINE 2636 4.80 1.83 5.59 141 TR_XM_FormFill2 2635 0.68 1.83 0.38 142 XM_H_PHPOS 2630 0.67 1.83 0.37 143 TR_XM_UnparsRelay 2606 0.65 1.81 0.35 144 TR_XM_COVIDMETA1 2559 0.66 1.78 0.36 145 RELAYCOUNTRY_DE 2490 0.79 1.73 0.54 146 BAYES_20 2432 4.67 1.69 5.45 147 T_PDS_OTHER_BAD_TLD 2430 0.54 1.69 0.24 148 TR_MetaPhish_Combo_01b 2387 0.51 1.66 0.21 149 TM2_M_VERY_LONG_WORD 2359 1.25 1.64 1.15 150 TR_XM_INV_DKIM 2340 0.53 1.62 0.25 151 XM_B_SpammyWords4 2318 0.83 1.61 0.62 152 FROM_MISSP_REPLYTO 2287 0.33 1.59 0.00 153 T_XMDrugObfuBody_14 2183 1.46 1.52 1.44 154 T_XMHurry_00 2144 0.99 1.49 0.85 155 SUBJ_ALL_CAPS 2135 1.57 1.48 1.59 156 BAYES_00 2125 10.80 1.48 13.25 157 URI_TRY_3LD 2075 1.63 1.44 1.67 158 TR_XM_RelayPhish 2024 0.42 1.41 0.16 159 TR_LOTS_OF_MONEY3 1985 0.79 1.38 0.63 160 DKIM_ADSP_CUSTOM_MED 1903 1.13 1.32 1.08 161 LongTLD 1895 0.42 1.32 0.18 162 RCVD_IN_IADB_LISTED 1821 4.12 1.26 4.87 163 NML_ADSP_CUSTOM_MED 1806 0.87 1.25 0.77 164 RELAYCOUNTRY_JP 1794 0.29 1.25 0.04 165 XMGenDplmaNmb 1773 1.06 1.23 1.02 166 ALL_TRUSTED 1734 13.19 1.20 16.34 167 DATE_IN_PAST_06_12 1729 0.45 1.20 0.25 168 TR_XM_DK_SendGrid 1709 3.23 1.19 3.77 169 MIME_HTML_ONLY_MULTI 1701 2.05 1.18 2.27 170 DATE_IN_PAST_03_06 1672 0.32 1.16 0.10 171 XM_NotFromAmazon 1654 0.24 1.15 0.01 172 SHORT_URI_2 1638 0.26 1.14 0.03 173 XM_PDF 1631 3.41 1.13 4.01 174 XMMoneyMeta_00 1603 0.73 1.11 0.63 175 FORGED_GMAIL_RCVD 1588 0.65 1.10 0.53 176 TR_Mismatch_TLD_02 1579 0.30 1.10 0.09 177 RELAYCOUNTRY_KR 1562 0.25 1.08 0.03 178 XMStockSpam_06 1560 0.91 1.08 0.86 179 RELAYCOUNTRY_AU 1530 0.56 1.06 0.42 180 TR_Mismatch_TLD_01 1527 0.43 1.06 0.26 181 RELAYCOUNTRY_AE 1492 0.22 1.04 0.00 182 RCVD_IN_IADB_SPF 1462 3.60 1.02 4.28 183 TO_NAME_SUBJ_NO_RDNS 1447 0.21 1.00 0.00 184 RDNS_DYNAMIC 1441 0.57 1.00 0.45 185 MAILING_LIST_MULTI 1428 2.09 0.99 2.38 186 TR_XM_FormFill 1418 0.24 0.98 0.04 187 HTML_IMAGE_ONLY_04 1388 0.23 0.96 0.04 188 RCVD_IN_MSPIKE_L4 1361 0.28 0.94 0.10 189 T_MONEY_PERCENT 1353 0.56 0.94 0.47 190 TR_LOTS_OF_MONEY2 1353 0.56 0.94 0.47 191 XMGppyBdWords 1323 0.32 0.92 0.17 192 XM_OfRef7 1313 0.30 0.91 0.14 193 REMOVE_BEFORE_LINK 1302 0.45 0.90 0.33 194 XMSexyCombo_04 1297 0.41 0.90 0.29 195 RCVD_IN_IADB_SENDERID 1293 3.25 0.90 3.87 196 XMSubNoVowel 1281 0.64 0.89 0.57 197 RCVD_IN_IADB_DK 1269 3.15 0.88 3.74 198 URI_NOVOWEL 1264 1.98 0.88 2.26 199 XM_SPF_Unknown 1263 0.69 0.88 0.64 200 XMBody_78 1204 0.55 0.84 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 540446 98.14 96.40 98.60 2 HTML_MESSAGE 476541 88.61 94.97 86.94 3 RELAYCOUNTRY_US 435875 76.33 64.16 79.53 4 DKIM_SIGNED 415477 72.29 58.92 75.80 5 XM_DK_Pass 408095 70.82 56.98 74.46 6 DKIM_VALID 396883 68.78 54.96 72.41 7 XM_B_Unicode 387126 70.72 71.07 70.63 8 DKIM_VALID_AU 298775 51.97 42.28 54.51 9 BAYES_50 287691 48.27 32.23 52.49 10 XMListUnsubscribeExists 287347 51.95 50.13 52.43 11 XM_B_SpammyWords 269871 52.01 62.58 49.24 12 XM_B_Unicode3 215493 40.17 43.42 39.32 13 T_TM2_M_HEADER_IN_MSG 158664 26.54 17.39 28.95 14 DKIM_VALID_EF 156087 28.00 26.19 28.48 15 RCVD_IN_MSPIKE_WL 152200 23.62 7.84 27.77 16 HTML_FONT_LOW_CONTRAST 148740 25.43 18.92 27.14 17 RCVD_IN_MSPIKE_H2 145935 30.03 42.97 26.63 18 LOC_TINY_FONT_1 133862 24.72 25.86 24.42 19 XM_B_SpammyWords2 124882 23.90 28.13 22.78 20 FVGT_m_MULTI_ODD 121354 21.27 17.97 22.14 21 XMSubLong 118786 23.09 28.47 21.67 22 MIME_HTML_ONLY 115094 26.71 48.46 21.00 23 T_KAM_HTML_FONT_INVALID 101829 19.12 21.19 18.58 24 ALL_TRUSTED 89558 13.19 1.20 16.34 25 RCVD_IN_MSPIKE_H3 84747 13.10 4.10 15.46 26 BAYES_00 72650 10.80 1.48 13.25 27 XM_Body_Dirty_Words 71133 13.39 14.94 12.98 28 XM_Multi_Part_URI 69784 13.90 18.36 12.73 29 XM_DK_Undo_02 57513 16.31 38.47 10.49 30 RCVD_IN_MSPIKE_H4 55913 8.78 3.38 10.20 31 XM_B_Unsub 54670 13.98 29.24 9.97 32 TR_XM_DK_Bayes 50304 7.35 0.38 9.18 33 LotsOfNums_01 49116 8.35 6.02 8.96 34 TR_XM_DK_Bayes1 48549 7.09 0.36 8.86 35 TooManyTo_001 43576 7.18 4.23 7.95 36 XM_Evil_Numbers_Gen 43048 7.67 6.96 7.85 37 TR_XM_DK_Bayes2 42855 6.26 0.34 7.82 38 LOTS_OF_MONEY 42551 8.14 9.59 7.76 39 RCVD_IN_RP_SAFE 41163 6.01 0.31 7.51 40 UNPARSEABLE_RELAY 39917 6.54 3.69 7.28 41 RCVD_IN_RP_CERTIFIED 39023 5.68 0.18 7.12 42 HTML_IMAGE_RATIO_02 38941 7.32 8.14 7.10 43 BAYES_99 38668 12.19 31.71 7.05 44 BAYES_60 36680 7.90 12.50 6.69 45 XM_SendGrid 35733 5.74 2.76 6.52 46 IN_ZIMBRA_NJ_WHITELIST 33844 4.90 0.04 6.17 47 XM_DKIMWhitelistDomains 33654 4.86 0.00 6.14 48 XM_B_SpammyWords3 32752 6.50 8.49 5.98 49 XM_B_Phish_Phrases 31945 6.48 8.95 5.83 50 ANY_BOUNCE_MESSAGE 31907 4.75 0.66 5.82 51 BOUNCE_MESSAGE 31900 4.75 0.65 5.82 52 BAYES_999 31093 9.57 24.40 5.67 53 HTML_IMAGE_RATIO_04 30774 5.33 4.26 5.61 54 MIME_QP_LONG_LINE 30619 4.80 1.83 5.59 55 RELAYCOUNTRY_META 29949 11.44 34.19 5.46 56 BAYES_20 29873 4.67 1.69 5.45 57 T_TooManySym_01 29707 4.82 2.52 5.42 58 XM_H_Long_From01 29631 5.12 4.03 5.41 59 BAYES_40 29608 4.67 1.87 5.40 60 BOTNET_IPINHOSTNAME 29516 7.19 14.04 5.39 61 RCVD_IN_IADB_LISTED 26687 4.12 1.26 4.87 62 XMNumbers 24383 4.36 4.05 4.45 63 MPART_ALT_DIFF 24141 5.46 9.47 4.40 64 BAYES_80 23523 5.97 12.36 4.29 65 RCVD_IN_IADB_SPF 23473 3.60 1.02 4.28 66 XMSexyCombo_05 23023 5.54 10.64 4.20 67 XMSubMetaSx_00 22662 4.77 7.18 4.13 68 XMStrtUSub 22335 3.76 2.57 4.08 69 XM_PDF 21990 3.41 1.13 4.01 70 RCVD_IN_IADB_SENDERID 21214 3.25 0.90 3.87 71 TR_XM_DK_SendGrid 20646 3.23 1.19 3.77 72 RCVD_IN_IADB_DK 20514 3.15 0.88 3.74 73 DKIM_INVALID 18594 3.51 3.96 3.39 74 T_TooManySym_02 18492 2.83 0.77 3.37 75 HTML_IMAGE_RATIO_06 18167 3.07 2.12 3.31 76 T_REMOTE_IMAGE 18116 4.90 10.98 3.31 77 XM_UncommonTLD01 17545 6.64 19.71 3.20 78 TM2_M_URI_OPT_OUT 17082 2.93 2.22 3.12 79 TR_XM_PhishingBody 16955 3.52 5.17 3.09 80 TR_Symld_Words 16713 3.04 3.02 3.05 81 RCVD_IN_IADB_VOUCHED 15950 2.46 0.77 2.91 82 FROM_EXCESS_BASE64 15194 5.95 18.06 2.77 83 BAYES_95 14830 3.26 5.38 2.71 84 BAYES_05 14562 2.26 0.77 2.66 85 MIME_HTML_MOSTLY 13700 3.62 7.86 2.50 86 MAILING_LIST_MULTI 13055 2.09 0.99 2.38 87 XM_B_Unsub2 13034 2.29 1.94 2.38 88 MIME_HTML_ONLY_MULTI 12453 2.05 1.18 2.27 89 URI_NOVOWEL 12412 1.98 0.88 2.26 90 HTML_IMAGE_RATIO_08 12291 2.19 2.01 2.24 91 HTML_MIME_NO_HTML_TAG 12250 7.00 25.14 2.24 92 UNTRUSTED_Relay 12111 6.78 24.16 2.21 93 BOTNET 11725 7.88 29.70 2.14 94 RCVD_IN_MSPIKE_H5 11540 1.74 0.36 2.11 95 TR_XM_SB_Phish 11077 2.26 3.17 2.02 96 TooManyTo_002 10942 1.75 0.81 2.00 97 XMSubPhish11 10891 2.23 3.14 1.99 98 KHOP_HELO_FCRDNS 10442 3.49 9.53 1.91 99 XM_SPF_SoftFail 10379 2.36 4.13 1.89 100 HTML_FONT_FACE_BAD 10335 1.61 0.57 1.89 101 RCVD_IN_IADB_OPTIN 10302 1.59 0.51 1.88 102 XM_B_SpammyTLD 10185 2.16 3.30 1.86 103 LH_URI_DOM_IN_PATH 10019 2.49 5.03 1.83 104 XM_B_Phish66 9847 2.11 3.29 1.80 105 XM_DK_Undo_01 9807 1.58 0.79 1.79 106 TVD_RCVD_IP 9758 1.47 0.27 1.78 107 XM_CamelCaseFrm001 9735 1.90 2.36 1.78 108 RELAYCOUNTRY_CA 9628 2.53 5.46 1.76 109 XMDiploma_00 9441 1.87 2.41 1.72 110 T_XMDrugObfuBody_08 9278 1.85 2.45 1.69 111 URI_TRY_3LD 9174 1.63 1.44 1.67 112 URI_HEX 8971 1.76 2.25 1.64 113 RCVD_IN_BL_SPAMCOP_NET 8923 7.38 29.25 1.63 114 SUBJ_ALL_CAPS 8701 1.57 1.48 1.59 115 HELO_NODOT 7960 1.32 0.82 1.45 116 HELO_NO_DOMAIN 7959 1.32 0.82 1.45 117 T_XMDrugObfuBody_14 7920 1.46 1.52 1.44 118 INVALID_MSGID 7544 1.22 0.61 1.38 119 IN_HORDE_ADDRESS_BOOK 7501 1.11 0.13 1.37 120 XMBrknScrpt_02 7360 1.72 3.18 1.34 121 TooManyTo_003 7212 1.18 0.64 1.32 122 HELO_MISC_IP 7133 1.14 0.55 1.30 123 CK_HELO_DYNAMIC_SPLIT_IP 7132 1.16 0.64 1.30 124 XM_GoogleGroups 6720 1.04 0.34 1.23 125 XM_B_COVIDMETA 6682 1.75 3.77 1.22 126 XMGappySubj_01 6653 0.99 0.12 1.21 127 XMCapTrack 6434 1.04 0.51 1.17 128 TM2_M_VERY_LONG_WORD 6320 1.25 1.64 1.15 129 TO_MALFORMED 6287 0.91 0.01 1.15 130 XM_UB50 6156 2.41 7.31 1.12 131 XM_OfRef6 6085 1.50 2.97 1.11 132 MIME_HEADER_CTYPE_ONLY 6025 0.89 0.10 1.10 133 XM_H_Long_From02 5999 1.03 0.77 1.09 134 DKIM_ADSP_CUSTOM_MED 5930 1.13 1.32 1.08 135 HTML_OBFUSCATE_10_20 5886 0.87 0.11 1.07 136 XMGenDplmaNmb 5565 1.06 1.23 1.02 137 XMBody_17 5434 1.34 2.64 0.99 138 SpammyFromTLD_01 5356 2.06 6.16 0.98 139 RCVD_IN_MSPIKE_BL 5255 2.83 9.94 0.96 140 T_TooManySym_03 5252 0.82 0.30 0.96 141 USER_IN_DEF_DKIM_WL 5223 0.75 0.00 0.95 142 TooManyTo_004 5102 0.86 0.58 0.93 143 RELAYCOUNTRY_GB 5090 1.82 5.22 0.93 144 XMBdyGiftCard01 5013 0.83 0.51 0.91 145 HTTPS_HTTP_MISMATCH 4819 0.86 0.77 0.88 146 XMStockSpam_06 4705 0.91 1.08 0.86 147 T_XMHurry_00 4683 0.99 1.49 0.85 148 T_FILL_THIS_FORM_SHORT 4633 1.42 3.61 0.85 149 TR_MSPIKEBAYES00 4577 0.66 0.01 0.84 150 XM_ProductURIs 4565 0.73 0.34 0.83 151 XMSexyCombo_01 4528 1.07 2.02 0.83 152 XMHTML_After_End 4492 1.10 2.17 0.82 153 DKIM_ADSP_NXDOMAIN 4362 1.61 4.70 0.80 154 TR_MetaPhish_Combo_01 4349 1.02 1.89 0.79 155 T_XMDrugObfuBody_00 4219 1.05 2.14 0.77 156 NML_ADSP_CUSTOM_MED 4201 0.87 1.25 0.77 157 TooManyTo_005 3842 0.66 0.49 0.70 158 XM_ShortIntro_01 3702 0.62 0.41 0.68 159 XM_DIRTYINTL 3642 1.53 4.80 0.66 160 T_Symld_Words_02 3633 0.66 0.65 0.66 161 XM_SPF_Unknown 3498 0.69 0.88 0.64 162 RCVD_IN_MSPIKE_L3 3481 1.78 6.12 0.64 163 XMMoneyMeta_00 3472 0.73 1.11 0.63 164 TR_LOTS_OF_MONEY3 3470 0.79 1.38 0.63 165 XMNoVowels 3418 0.59 0.46 0.62 166 XM_B_SpammyWords4 3411 0.83 1.61 0.62 167 XMBody_95 3409 0.51 0.07 0.62 168 XMSubMetaI_00 3370 0.65 0.80 0.61 169 XM_H_Trusted_IP 3370 0.49 0.00 0.61 170 T_OBFU_PDF_ATTACH 3178 0.49 0.13 0.58 171 XMSubNoVowel 3139 0.64 0.89 0.57 172 HTML_TAG_BALANCE_BODY 3134 0.59 0.67 0.57 173 TR_BOTNET_NEGATE 3044 0.52 0.39 0.56 174 RELAYCOUNTRY_DE 2980 0.79 1.73 0.54 175 FORGED_GMAIL_RCVD 2899 0.65 1.10 0.53 176 PLING_QUERY 2884 0.49 0.34 0.53 177 FROM_GOV_DKIM_AU 2844 0.43 0.10 0.52 178 XMHTMLBadTable_001 2842 0.51 0.49 0.52 179 XM_B_COPY_HTML 2809 0.51 0.50 0.51 180 NUMERIC_HTTP_ADDR 2771 0.53 0.61 0.51 181 XMPhish30 2723 0.55 0.75 0.50 182 T_TooManySym_04 2686 0.40 0.06 0.49 183 XM_H_PHPMailer 2651 0.50 0.58 0.48 184 TR_XM_COVIDMETA4 2648 0.82 2.10 0.48 185 XMBody_78 2596 0.55 0.84 0.47 186 XM_B_REG_HTML 2558 0.39 0.08 0.47 187 T_MONEY_PERCENT 2551 0.56 0.94 0.47 188 TR_LOTS_OF_MONEY2 2551 0.56 0.94 0.47 189 XMSolicitRefs_0 2524 0.42 0.28 0.46 190 NO_DNS_FOR_FROM 2487 0.50 0.67 0.45 191 XMOemUri 2484 0.41 0.25 0.45 192 RDNS_DYNAMIC 2470 0.57 1.00 0.45 193 XMSubMetaSxObfu_02 2468 0.42 0.32 0.45 194 XMPhish08 2450 0.47 0.57 0.45 195 DIET_1 2382 0.50 0.73 0.43 196 RCVD_IN_SORBS_DUL 2349 0.39 0.24 0.43 197 RELAYCOUNTRY_AU 2325 0.56 1.06 0.42 198 XM_S_SubURI 2266 0.34 0.04 0.41 199 HTML_IMAGE_ONLY_32 2259 0.41 0.42 0.41 200 FROM_GOV_SPOOF 2234 0.35 0.12 0.41 ----------------------------------------------------------------------