Email: 734 Autolearn: 0 AvgScore: 1.11 AvgScanTime: 1.86 sec Spam: 70 Autolearn: 0 AvgScore: 13.20 AvgScanTime: 2.60 sec Ham: 664 Autolearn: 0 AvgScore: -0.17 AvgScanTime: 1.78 sec Time Spent Running SA: 0.38 hours Time Spent Processing Spam: 0.05 hours Time Spent Processing Ham: 0.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 64 39.10 91.43 33.58 2 DKIM_SIGNED 63 34.74 90.00 28.92 3 XM_DK_Pass 55 33.24 78.57 28.46 4 DKIM_VALID 55 32.56 78.57 27.71 5 XM_B_Unicode 53 27.93 75.71 22.89 6 DCC_CHECK_NEGATIVE 52 96.05 74.29 98.34 7 XM_B_SpammyWords 43 18.66 61.43 14.16 8 RELAYCOUNTRY_US 42 32.43 60.00 29.52 9 DKIM_VALID_AU 41 27.11 58.57 23.80 10 XMListUnsubscribeExists 38 21.12 54.29 17.62 11 DKIM_VALID_EF 37 20.03 52.86 16.57 12 XM_DK_Undo_02 33 5.31 47.14 0.90 13 T_TM2_M_HEADER_IN_MSG 31 12.26 44.29 8.89 14 BAYES_50 31 56.54 44.29 57.83 15 LOC_TINY_FONT_1 30 14.44 42.86 11.45 16 RELAYCOUNTRY_META 27 7.90 38.57 4.67 17 MIME_HTML_ONLY 26 10.49 37.14 7.68 18 TR_XM_DKIM_Undo 25 3.68 35.71 0.30 19 XM_B_Unicode3 23 14.31 32.86 12.35 20 TR_XM_DK_Unsub 23 10.63 32.86 8.28 21 T_KAM_HTML_FONT_INVALID 23 9.54 32.86 7.08 22 HTML_FONT_LOW_CONTRAST 21 17.57 30.00 16.27 23 RCVD_IN_MSPIKE_H2 21 6.95 30.00 4.52 24 BAYES_99 21 3.68 30.00 0.90 25 FVGT_m_MULTI_ODD 20 8.86 28.57 6.78 26 XM_B_Unsub 19 7.36 27.14 5.27 27 TR_XM_BayesUnsub 19 5.72 27.14 3.46 28 TR_XM_SpammyRelay 19 5.86 27.14 3.61 29 DCC_CHECK 18 3.95 25.71 1.66 30 LOTS_OF_MONEY 18 4.22 25.71 1.96 31 XMSubLong 18 6.95 25.71 4.97 32 BAYES_999 17 3.00 24.29 0.75 33 TR_XM_SpammyWords4 16 3.68 22.86 1.66 34 XMStockSpam_06 16 3.41 22.86 1.36 35 XM_Multi_Part_URI 16 6.54 22.86 4.82 36 UNPARSEABLE_RELAY 15 7.77 21.43 6.33 37 RCVD_IN_BL_SPAMCOP_NET 14 1.91 20.00 0.00 38 RELAYCOUNTRY_CA 14 3.95 20.00 2.26 39 XM_B_SpammyWords2 12 7.49 17.14 6.48 40 US_DOLLARS_3 12 2.59 17.14 1.05 41 XM_UncommonTLD01 10 5.18 14.29 4.22 42 TR_XM_UnparsRelay 10 2.72 14.29 1.51 43 UNTRUSTED_Relay 10 2.45 14.29 1.20 44 BAYES_80 10 2.45 14.29 1.20 45 DKIM_INVALID 8 2.18 11.43 1.20 46 BOTNET 8 1.23 11.43 0.15 47 XM_Body_Dirty_Words 8 2.72 11.43 1.81 48 TR_XM_PHPDW 7 2.04 10.00 1.20 49 BOTNET_IPINHOSTNAME 7 1.91 10.00 1.05 50 TR_XM_PHPForged 7 2.04 10.00 1.20 51 XMSexyCombo_05 6 0.95 8.57 0.15 52 XMSubMetaSx_00 6 0.95 8.57 0.15 53 XM_H_PHPOS 5 1.77 7.14 1.20 54 TR_XM_INV_DKIM 5 0.68 7.14 0.00 55 XM_UB50 5 1.63 7.14 1.05 56 XM_B_SpammyWords3 5 1.91 7.14 1.36 57 TR_XM_PhishingBody 5 1.36 7.14 0.75 58 TR_XM_FormFill2 5 1.77 7.14 1.20 59 XM_B_SpammyTLD 5 0.82 7.14 0.15 60 XM_Evil_Numbers_Gen 5 2.86 7.14 2.41 61 T_XMDrugObfuBody_14 4 0.95 5.71 0.45 62 XM_H_PHPOS_M 4 1.63 5.71 1.20 63 BAYES_60 4 4.90 5.71 4.82 64 XM_OfRef6 4 0.82 5.71 0.30 65 LotsOfNums_01 4 1.50 5.71 1.05 66 XM_B_Phish_Phrases 4 1.50 5.71 1.05 67 TR_XM_SpammyWords2 4 0.54 5.71 0.00 68 XMStrtUSub 4 2.32 5.71 1.96 69 SpammyFromTLD_02 3 0.41 4.29 0.00 70 TooManyTo_001 3 2.72 4.29 2.56 71 HTML_IMAGE_RATIO_08 3 2.45 4.29 2.26 72 XM_DIRTYINTL 3 0.95 4.29 0.60 73 XMGappySubj_01 3 1.09 4.29 0.75 74 XMSubject_60 3 1.36 4.29 1.05 75 XM_H_PHPMailer 3 0.54 4.29 0.15 76 TR_Mismatch_TLD_02 3 0.41 4.29 0.00 77 XMGappySubj_02 3 0.82 4.29 0.45 78 XM_SendGrid 3 2.72 4.29 2.56 79 MAILING_LIST_MULTI 3 0.41 4.29 0.00 80 BAYES_95 3 1.23 4.29 0.90 81 URIBL_DBL_SPAM 3 0.41 4.29 0.00 82 XM_B_Investor 3 0.95 4.29 0.60 83 TR_XM_NoHeaderRelay 3 0.41 4.29 0.00 84 T_STY_INVIS_DIRECT 3 1.36 4.29 1.05 85 HTML_IMAGE_RATIO_06 3 0.82 4.29 0.45 86 FSL_BULK_SIG 3 0.54 4.29 0.15 87 HTML_IMAGE_RATIO_02 2 1.91 2.86 1.81 88 XMSlimDrugH 2 0.27 2.86 0.00 89 XMSexyCombo_01 2 0.27 2.86 0.00 90 RELAYCOUNTRY_GB 2 0.82 2.86 0.60 91 RELAYCOUNTRY_AT 2 0.54 2.86 0.30 92 HTML_FONT_TINY_NORDNS 2 1.77 2.86 1.66 93 XM_UB60 2 0.27 2.86 0.00 94 XM_B_Phish49 2 0.27 2.86 0.00 95 TR_DCC_Bayes_99 2 0.27 2.86 0.00 96 T_XMDrugObfuBody_08 2 0.27 2.86 0.00 97 BOTNET_NORDNS 2 0.27 2.86 0.00 98 TR_XM_InvalidRelay 2 0.27 2.86 0.00 99 DKIM_ADSP_CUSTOM_MED 2 0.41 2.86 0.15 100 ALL_TRUSTED 2 59.54 2.86 65.51 101 T_FILL_THIS_FORM_FRAUD_PHISH 2 0.27 2.86 0.00 102 RELAYCOUNTRY_SZ 2 0.27 2.86 0.00 103 XM_H_Long_From02 2 0.27 2.86 0.00 104 XM_TLDProd2 2 0.27 2.86 0.00 105 XM_UB80 2 0.27 2.86 0.00 106 RELAYCOUNTRY_ZA 2 0.27 2.86 0.00 107 XMNumbers 2 1.91 2.86 1.81 108 XMNoVowels 2 0.41 2.86 0.15 109 TooManyTo_002 2 1.63 2.86 1.51 110 XM_SPF_SoftFail 2 0.95 2.86 0.75 111 XM_DK_Undo_01 2 0.41 2.86 0.15 112 TR_XM_SPAMCOP 2 0.27 2.86 0.00 113 TooManyTo_004 2 0.27 2.86 0.00 114 RELAYCOUNTRY_DE 2 0.41 2.86 0.15 115 NML_ADSP_CUSTOM_MED 2 0.41 2.86 0.15 116 HTML_MIME_NO_HTML_TAG 2 0.95 2.86 0.75 117 TooManyTo_003 2 0.27 2.86 0.00 118 FORGED_GMAIL_RCVD 2 0.27 2.86 0.00 119 KHOP_HELO_FCRDNS 2 0.82 2.86 0.60 120 RELAYCOUNTRY_FR 2 0.54 2.86 0.30 121 MPART_ALT_DIFF 2 0.95 2.86 0.75 122 PDS_OTHER_BAD_TLD 2 0.27 2.86 0.00 123 TO_NO_BRKTS_HTML_ONLY 2 0.27 2.86 0.00 124 OBFU_TEXT_ATTACH 1 0.14 1.43 0.00 125 TR_XM_Undi_Recip5 1 0.14 1.43 0.00 126 TM2_M_URI_OPT_OUT 1 0.95 1.43 0.90 127 TR_XM_RelayPhish 1 0.14 1.43 0.00 128 XM_OfRef7 1 0.14 1.43 0.00 129 XMWinner 1 0.14 1.43 0.00 130 ADVANCE_FEE_5_NEW_FRM_MNY 1 0.14 1.43 0.00 131 XMSexyCombo_02 1 0.14 1.43 0.00 132 URIBL_DBL_ABUSE_SPAM 1 0.14 1.43 0.00 133 XM_CamelCaseFrm001 1 1.23 1.43 1.20 134 HTTPS_HTTP_MISMATCH 1 0.14 1.43 0.00 135 XM_B_Unsub2 1 0.82 1.43 0.75 136 DATE_IN_PAST_03_06 1 0.14 1.43 0.00 137 TR_LOTS_OF_MONEY2 1 0.14 1.43 0.00 138 XM_ShortIntro_01 1 0.14 1.43 0.00 139 MONEY_FORM 1 0.14 1.43 0.00 140 XMSubMetaSxObfu_03 1 0.27 1.43 0.15 141 XM_URI_RBL 1 0.14 1.43 0.00 142 NO_DNS_FOR_FROM 1 0.41 1.43 0.30 143 TR_XM_Undi_RecipCombo2 1 0.14 1.43 0.00 144 RCVD_IN_VALIDITY_RPBL 1 0.14 1.43 0.00 145 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.14 1.43 0.00 146 FILL_THIS_FORM 1 0.14 1.43 0.00 147 PDS_RDNS_DYNAMIC_FP 1 0.14 1.43 0.00 148 XM_H_Undi_Recip 1 0.27 1.43 0.15 149 RELAYCOUNTRY_ID 1 0.14 1.43 0.00 150 XMBdyGiftCard01 1 0.14 1.43 0.00 151 XM_PDF 1 0.68 1.43 0.60 152 XMFrmHeader_28 1 0.14 1.43 0.00 153 RCVD_IN_MSPIKE_H3 1 1.23 1.43 1.20 154 T_MONEY_PERCENT 1 0.14 1.43 0.00 155 TR_XM_DK_SendGrid 1 2.32 1.43 2.41 156 NORDNS_LOW_CONTRAST 1 0.27 1.43 0.15 157 XM_B_SpammyWords4 1 0.14 1.43 0.00 158 NOT_SPAM 1 0.14 1.43 0.00 159 DATE_IN_FUTURE_06_12 1 0.14 1.43 0.00 160 HELO_NODOT 1 0.14 1.43 0.00 161 WORD_INVIS_MANY 1 0.14 1.43 0.00 162 T_XMDrugObfuBody_00 1 0.14 1.43 0.00 163 HTML_FONT_SIZE_HUGE 1 0.14 1.43 0.00 164 XMSolicitRefs_0 1 0.41 1.43 0.30 165 XMDateMe_00 1 0.27 1.43 0.15 166 HTML_IMAGE_RATIO_04 1 1.50 1.43 1.51 167 RDNS_DYNAMIC 1 0.14 1.43 0.00 168 BAYES_20 1 3.54 1.43 3.77 169 DRUGS_ERECTILE 1 0.14 1.43 0.00 170 XM_B_Phish66 1 0.27 1.43 0.15 171 XMNoUri_00 1 0.14 1.43 0.00 172 SpammyFromTLD_01 1 0.27 1.43 0.15 173 TooManyTo_005 1 0.14 1.43 0.00 174 MONEY_FRAUD_3 1 0.14 1.43 0.00 175 SUBJ_ALL_CAPS 1 2.18 1.43 2.26 176 URI_TRY_3LD 1 0.27 1.43 0.15 177 XMBody_106 1 0.14 1.43 0.00 178 FROM_EXCESS_BASE64 1 0.27 1.43 0.15 179 SUBJ_DOLLARS 1 0.14 1.43 0.00 180 RELAYCOUNTRY_SG 1 0.14 1.43 0.00 181 HELO_NO_DOMAIN 1 0.14 1.43 0.00 182 XMPhish08 1 0.27 1.43 0.15 183 FSL_HELO_NON_FQDN_1 1 0.14 1.43 0.00 184 RELAYCOUNTRY_RU 1 0.14 1.43 0.00 185 RCVD_IN_PSBL 1 0.27 1.43 0.15 186 IMPOTENCE 1 0.14 1.43 0.00 187 TR_XM_Undi_RecipCombo3 1 0.14 1.43 0.00 188 RELAYCOUNTRY_PL 1 0.14 1.43 0.00 189 TR_XM_Undi_Recip4 1 0.14 1.43 0.00 190 XM_Body_Dirty_Words_01 1 0.14 1.43 0.00 191 TM2_M_OBFU_COMMENT 1 0.14 1.43 0.00 192 XM_UB95 1 0.14 1.43 0.00 193 XMPhish11 1 0.14 1.43 0.00 194 XM_B_DNDMA 1 0.27 1.43 0.15 195 RCVD_IN_MSPIKE_WL 1 1.23 1.43 1.20 196 TR_XM_Undi_Recip2 1 0.14 1.43 0.00 197 MIME_HTML_MOSTLY 1 1.09 1.43 1.05 198 URI_PHISH 1 0.14 1.43 0.00 199 URG_BIZ 1 0.14 1.43 0.00 200 XMSexyCombo_04 1 0.14 1.43 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 653 96.05 74.29 98.34 2 ALL_TRUSTED 435 59.54 2.86 65.51 3 ANY_BOUNCE_MESSAGE 412 56.13 0.00 62.05 4 BOUNCE_MESSAGE 412 56.13 0.00 62.05 5 BAYES_50 384 56.54 44.29 57.83 6 HTML_MESSAGE 223 39.10 91.43 33.58 7 RELAYCOUNTRY_US 196 32.43 60.00 29.52 8 DKIM_SIGNED 192 34.74 90.00 28.92 9 XM_DK_Pass 189 33.24 78.57 28.46 10 DKIM_VALID 184 32.56 78.57 27.71 11 DKIM_VALID_AU 158 27.11 58.57 23.80 12 BAYES_05 157 21.39 0.00 23.64 13 XM_B_Unicode 152 27.93 75.71 22.89 14 XMListUnsubscribeExists 117 21.12 54.29 17.62 15 DKIM_VALID_EF 110 20.03 52.86 16.57 16 HTML_FONT_LOW_CONTRAST 108 17.57 30.00 16.27 17 XM_B_SpammyWords 94 18.66 61.43 14.16 18 XM_B_Unicode3 82 14.31 32.86 12.35 19 LOC_TINY_FONT_1 76 14.44 42.86 11.45 20 T_TM2_M_HEADER_IN_MSG 59 12.26 44.29 8.89 21 TR_XM_DK_Unsub 55 10.63 32.86 8.28 22 MIME_HTML_ONLY 51 10.49 37.14 7.68 23 T_KAM_HTML_FONT_INVALID 47 9.54 32.86 7.08 24 FVGT_m_MULTI_ODD 45 8.86 28.57 6.78 25 XM_B_SpammyWords2 43 7.49 17.14 6.48 26 UNPARSEABLE_RELAY 42 7.77 21.43 6.33 27 XM_B_Unsub 35 7.36 27.14 5.27 28 XMSubLong 33 6.95 25.71 4.97 29 BAYES_00 33 4.50 0.00 4.97 30 BAYES_60 32 4.90 5.71 4.82 31 XM_Multi_Part_URI 32 6.54 22.86 4.82 32 RELAYCOUNTRY_META 31 7.90 38.57 4.67 33 RCVD_IN_MSPIKE_H2 30 6.95 30.00 4.52 34 XM_UncommonTLD01 28 5.18 14.29 4.22 35 BAYES_20 25 3.54 1.43 3.77 36 TR_XM_SpammyRelay 24 5.86 27.14 3.61 37 T_REMOTE_IMAGE 23 3.13 0.00 3.46 38 TR_XM_BayesUnsub 23 5.72 27.14 3.46 39 XM_DKIMWhitelistDomains 21 2.86 0.00 3.16 40 TR_XM_DK_Bayes 19 2.59 0.00 2.86 41 TR_XM_DK_Bayes1 19 2.59 0.00 2.86 42 TR_XM_SpammyWords5 18 2.59 1.43 2.71 43 TR_XM_DK_Bayes2 18 2.45 0.00 2.71 44 XM_SendGrid 17 2.72 4.29 2.56 45 TooManyTo_001 17 2.72 4.29 2.56 46 XM_Evil_Numbers_Gen 16 2.86 7.14 2.41 47 TR_XM_DK_SendGrid 16 2.32 1.43 2.41 48 RELAYCOUNTRY_CA 15 3.95 20.00 2.26 49 SUBJ_ALL_CAPS 15 2.18 1.43 2.26 50 HTML_IMAGE_RATIO_08 15 2.45 4.29 2.26 51 XMStrtUSub 13 2.32 5.71 1.96 52 LOTS_OF_MONEY 13 4.22 25.71 1.96 53 HTML_IMAGE_ONLY_28 13 1.77 0.00 1.96 54 BAYES_40 13 1.77 0.00 1.96 55 XM_Body_Dirty_Words 12 2.72 11.43 1.81 56 XMNumbers 12 1.91 2.86 1.81 57 HTML_IMAGE_RATIO_02 12 1.91 2.86 1.81 58 INVALID_MSGID 11 1.50 0.00 1.66 59 USER_IN_DEF_DKIM_WL 11 1.50 0.00 1.66 60 DCC_CHECK 11 3.95 25.71 1.66 61 HTML_FONT_TINY_NORDNS 11 1.77 2.86 1.66 62 TR_XM_SpammyWords4 11 3.68 22.86 1.66 63 TooManyTo_002 10 1.63 2.86 1.51 64 TO_MALFORMED 10 1.36 0.00 1.51 65 TR_XM_UnparsRelay 10 2.72 14.29 1.51 66 HTML_IMAGE_RATIO_04 10 1.50 1.43 1.51 67 XM_B_FormFill 10 1.36 0.00 1.51 68 XM_H_Long_From01 9 1.36 1.43 1.36 69 T_TooManySym_01 9 1.23 0.00 1.36 70 XM_B_SpammyWords3 9 1.91 7.14 1.36 71 XMStockSpam_06 9 3.41 22.86 1.36 72 BAYES_80 8 2.45 14.29 1.20 73 TR_XM_PHPForged 8 2.04 10.00 1.20 74 RCVD_IN_MSPIKE_WL 8 1.23 1.43 1.20 75 MIME_QP_LONG_LINE 8 1.09 0.00 1.20 76 T_TooManySym_02 8 1.09 0.00 1.20 77 UNTRUSTED_Relay 8 2.45 14.29 1.20 78 TR_XM_FormFill2 8 1.77 7.14 1.20 79 RCVD_IN_MSPIKE_H3 8 1.23 1.43 1.20 80 XM_H_PHPOS_M 8 1.63 5.71 1.20 81 TR_XM_PHPDW 8 2.04 10.00 1.20 82 DKIM_INVALID 8 2.18 11.43 1.20 83 XM_CamelCaseFrm001 8 1.23 1.43 1.20 84 XM_H_PHPOS 8 1.77 7.14 1.20 85 RELAYCOUNTRY_AU 7 0.95 0.00 1.05 86 T_STY_INVIS_DIRECT 7 1.36 4.29 1.05 87 MIME_HTML_MOSTLY 7 1.09 1.43 1.05 88 XM_B_Phish_Phrases 7 1.50 5.71 1.05 89 LotsOfNums_01 7 1.50 5.71 1.05 90 XM_UB50 7 1.63 7.14 1.05 91 US_DOLLARS_3 7 2.59 17.14 1.05 92 BOTNET_IPINHOSTNAME 7 1.91 10.00 1.05 93 XMSubject_60 7 1.36 4.29 1.05 94 BAYES_99 6 3.68 30.00 0.90 95 BAYES_95 6 1.23 4.29 0.90 96 RCVD_IN_IADB_LISTED 6 0.82 0.00 0.90 97 RCVD_IN_IADB_SPF 6 0.82 0.00 0.90 98 RCVD_IN_IADB_SENDERID 6 0.82 0.00 0.90 99 XM_DK_Undo_02 6 5.31 47.14 0.90 100 TM2_M_URI_OPT_OUT 6 0.95 1.43 0.90 101 MPART_ALT_DIFF 5 0.95 2.86 0.75 102 BAYES_999 5 3.00 24.29 0.75 103 HTML_MIME_NO_HTML_TAG 5 0.95 2.86 0.75 104 RCVD_IN_IADB_DK 5 0.68 0.00 0.75 105 XM_SPF_SoftFail 5 0.95 2.86 0.75 106 XM_H_FedEx_Spoof 5 0.68 0.00 0.75 107 MSGID_NOFQDN1 5 0.68 0.00 0.75 108 TR_XM_PhishingBody 5 1.36 7.14 0.75 109 XMGappySubj_01 5 1.09 4.29 0.75 110 XMSubMetaI_00 5 0.68 0.00 0.75 111 XM_B_Unsub2 5 0.82 1.43 0.75 112 IN_ZIMBRA_NJ_WHITELIST 5 0.68 0.00 0.75 113 XMBSHREFv2 4 0.54 0.00 0.60 114 RCVD_IN_VALIDITY_SAFE 4 0.54 0.00 0.60 115 KHOP_HELO_FCRDNS 4 0.82 2.86 0.60 116 XM_ZIP 4 0.54 0.00 0.60 117 XM_B_Investor 4 0.95 4.29 0.60 118 MSGID_FROM_MTA_HEADER 4 0.54 0.00 0.60 119 XMLngstWrd_00 4 0.54 0.00 0.60 120 XM_PDF 4 0.68 1.43 0.60 121 XM_DIRTYINTL 4 0.95 4.29 0.60 122 RCVD_IN_VALIDITY_CERTIFIED 4 0.54 0.00 0.60 123 RELAYCOUNTRY_GB 4 0.82 2.86 0.60 124 HTML_IMAGE_RATIO_06 3 0.82 4.29 0.45 125 HTML_IMAGE_ONLY_20 3 0.54 1.43 0.45 126 XMLngstWrd_01 3 0.41 0.00 0.45 127 TR_Sbj_FN_Bdy 3 0.54 1.43 0.45 128 TVD_RCVD_IP 3 0.41 0.00 0.45 129 XMSubNoVowel 3 0.41 0.00 0.45 130 XMPhish14 3 0.41 0.00 0.45 131 TVD_SPACE_RATIO 3 0.41 0.00 0.45 132 FROM_GOV_SPOOF 3 0.41 0.00 0.45 133 XMBody_78 3 0.41 0.00 0.45 134 RCVD_IN_IADB_VOUCHED 3 0.41 0.00 0.45 135 XMSubEmpty 3 0.41 0.00 0.45 136 NUMERIC_HTTP_ADDR 3 0.41 0.00 0.45 137 IN_HORDE_ADDRESS_BOOK 3 0.41 0.00 0.45 138 T_FILL_THIS_FORM_SHORT 3 0.41 0.00 0.45 139 XMGappySubj_02 3 0.82 4.29 0.45 140 HTML_SHORT_LINK_IMG_3 3 0.41 0.00 0.45 141 T_XMDrugObfuBody_14 3 0.95 5.71 0.45 142 TR_MetaPhish_Combo_01 2 0.27 0.00 0.30 143 HTML_IMAGE_ONLY_24 2 0.27 0.00 0.30 144 URI_NOVOWEL 2 0.27 0.00 0.30 145 RELAYCOUNTRY_FR 2 0.54 2.86 0.30 146 XM_GoogleGroups 2 0.27 0.00 0.30 147 XM_Body_Obfu01 2 0.27 0.00 0.30 148 USER_IN_WELCOMELIST 2 0.27 0.00 0.30 149 WEIRD_QUOTING 2 0.27 0.00 0.30 150 XMSpoofStaff2 2 0.27 0.00 0.30 151 XM_ZohoDesk1 2 0.27 0.00 0.30 152 TR_XM_SpoofStaff 2 0.27 0.00 0.30 153 TR_XM_SpoofPhishAttach 2 0.27 0.00 0.30 154 USER_IN_WHITELIST 2 0.27 0.00 0.30 155 TR_XM_DKIM_Undo 2 3.68 35.71 0.30 156 XM_ProductURIs 2 0.27 0.00 0.30 157 RCVD_IN_IADB_OPTIN 2 0.27 0.00 0.30 158 TM2_M_VERY_LONG_WORD 2 0.27 0.00 0.30 159 XMSolicitRefs_0 2 0.41 1.43 0.30 160 XM_OfRef6 2 0.82 5.71 0.30 161 TR_Symld_Words 2 0.27 0.00 0.30 162 DEAR_SOMETHING 2 0.27 0.00 0.30 163 T_OBFU_PDF_ATTACH 2 0.27 0.00 0.30 164 NO_DNS_FOR_FROM 2 0.41 1.43 0.30 165 TR_XM_PSC1 2 0.27 0.00 0.30 166 XM_H_SpoofStaff4 2 0.27 0.00 0.30 167 RELAYCOUNTRY_AT 2 0.54 2.86 0.30 168 FSL_BULK_SIG 1 0.54 4.29 0.15 169 XM_B_COVIDMETA 1 0.14 0.00 0.15 170 HDRS_MISSP 1 0.14 0.00 0.15 171 URI_HEX 1 0.14 0.00 0.15 172 XMSubMetaSx_00 1 0.95 8.57 0.15 173 SUBJ_OBFU_PUNCT_FEW 1 0.14 0.00 0.15 174 XM_B_DNDMA 1 0.27 1.43 0.15 175 TR_XM_COVIDMETA2 1 0.14 0.00 0.15 176 CTE_8BIT_MISMATCH 1 0.14 0.00 0.15 177 NML_ADSP_CUSTOM_MED 1 0.41 2.86 0.15 178 RELAYCOUNTRY_DE 1 0.41 2.86 0.15 179 SUBJ_BUY 1 0.14 0.00 0.15 180 XM_B_SpammyTLD 1 0.82 7.14 0.15 181 HTML_SHORT_LINK_IMG_2 1 0.14 0.00 0.15 182 XM_DK_Undo_01 1 0.41 2.86 0.15 183 RCVD_IN_PSBL 1 0.27 1.43 0.15 184 XMPhish08 1 0.27 1.43 0.15 185 BOTNET 1 1.23 11.43 0.15 186 XMNoVowels 1 0.41 2.86 0.15 187 XMSubject_78 1 0.14 0.00 0.15 188 FROM_EXCESS_BASE64 1 0.27 1.43 0.15 189 XM_S_SubURI 1 0.14 0.00 0.15 190 URI_TRY_3LD 1 0.27 1.43 0.15 191 WEIRD_PORT 1 0.14 0.00 0.15 192 XMSubMetaD_00 1 0.14 0.00 0.15 193 T_TVD_MIME_EPI 1 0.14 0.00 0.15 194 XMSexyCombo_05 1 0.95 8.57 0.15 195 SpammyFromTLD_01 1 0.27 1.43 0.15 196 XM_H_Trusted_IP 1 0.14 0.00 0.15 197 XMBody_17 1 0.14 0.00 0.15 198 XM_B_Phish66 1 0.27 1.43 0.15 199 LONG_JUNK_URI3 1 0.14 0.00 0.15 200 CK_HELO_GENERIC 1 0.14 0.00 0.15 ----------------------------------------------------------------------