Email: 609374 Autolearn: 0 AvgScore: 1.64 AvgScanTime: 2.11 sec Spam: 115332 Autolearn: 0 AvgScore: 12.24 AvgScanTime: 3.60 sec Ham: 494042 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.76 sec Time Spent Running SA: 356.51 hours Time Spent Processing Spam: 115.40 hours Time Spent Processing Ham: 241.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 110129 89.69 95.49 88.34 2 DCC_CHECK 92564 46.38 80.26 38.47 3 DKIM_SIGNED 89539 74.65 77.64 73.96 4 RELAYCOUNTRY_US 87629 79.86 75.98 80.76 5 XM_DK_Pass 87395 73.18 75.78 72.57 6 XM_B_Unicode 83513 69.74 72.41 69.12 7 XMListUnsubscribeExists 76989 51.68 66.75 48.16 8 DKIM_VALID 76596 67.81 66.41 68.14 9 DKIM_VALID_AU 58849 50.11 51.03 49.89 10 BAYES_50 51718 51.22 44.84 52.70 11 XM_DK_Undo_02 45654 13.07 39.58 6.88 12 XM_B_Unicode3 45293 37.58 39.27 37.18 13 MIME_HTML_ONLY 44366 23.57 38.47 20.09 14 LOC_TINY_FONT_1 39590 24.85 34.33 22.63 15 DKIM_VALID_EF 33908 26.85 29.40 26.25 16 HTML_FONT_LOW_CONTRAST 31989 26.62 27.74 26.36 17 T_KAM_HTML_FONT_INVALID 29943 19.59 25.96 18.10 18 BAYES_99 29703 7.54 25.75 3.29 19 XMSubLong 28025 20.97 24.30 20.20 20 FVGT_m_MULTI_ODD 27961 22.16 24.24 21.67 21 BOTNET 25592 6.47 22.19 2.81 22 RELAYCOUNTRY_META 25489 8.59 22.10 5.44 23 TR_DCC_Bayes_99 23606 5.38 20.47 1.86 24 BAYES_999 23362 5.94 20.26 2.59 25 T_TM2_M_HEADER_IN_MSG 22546 28.30 19.55 30.34 26 XM_Body_Dirty_Words 22131 12.83 19.19 11.34 27 XM_UncommonTLD01 22037 6.26 19.11 3.27 28 DCC_CHECK_NEGATIVE 20775 51.48 18.01 59.29 29 XM_Multi_Part_URI 20023 12.14 17.36 10.92 30 FSL_BULK_SIG 19879 9.15 17.24 7.26 31 UNTRUSTED_Relay 18079 4.33 15.68 1.68 32 BOTNET_IPINHOSTNAME 17339 6.61 15.03 4.65 33 LOTS_OF_MONEY 17205 9.48 14.92 8.21 34 XM_B_Unsub 15541 10.95 13.48 10.36 35 XM_B_Phish_Phrases 14652 8.76 12.70 7.84 36 HTML_IMAGE_RATIO_02 14004 8.60 12.14 7.77 37 XM_Evil_Numbers_Gen 13080 8.94 11.34 8.38 38 DKIM_INVALID 12943 6.84 11.22 5.82 39 XMSexyCombo_05 11880 4.27 10.30 2.87 40 XM_UB50 11400 2.60 9.88 0.90 41 NO_DNS_FOR_FROM 11376 4.18 9.86 2.85 42 LotsOfNums_01 10792 8.29 9.36 8.04 43 KHOP_HELO_FCRDNS 10020 3.31 8.69 2.06 44 RCVD_IN_MSPIKE_H2 10014 13.24 8.68 14.30 45 TooManyTo_001 9135 9.41 7.92 9.75 46 RCVD_IN_MSPIKE_BL 8330 3.22 7.22 2.29 47 XMSubMetaSx_00 8252 3.85 7.15 3.08 48 BAYES_80 8235 3.84 7.14 3.07 49 MPART_ALT_DIFF 8200 4.93 7.11 4.42 50 RCVD_IN_MSPIKE_L3 8061 3.15 6.99 2.26 51 XM_SPF_SoftFail 7931 2.77 6.88 1.81 52 BAYES_60 7864 5.54 6.82 5.24 53 FROM_SUSPICIOUS_NTLD 7246 1.23 6.28 0.05 54 FROM_SUSPICIOUS_NTLD_FP 7195 1.22 6.24 0.04 55 XM_H_Long_From01 6922 5.42 6.00 5.29 56 T_REMOTE_IMAGE 6824 4.44 5.92 4.09 57 LongTLD 6658 1.22 5.77 0.16 58 XMHTML_After_End 6601 1.66 5.72 0.71 59 XM_CamelCaseFrm001 6287 2.54 5.45 1.86 60 FROM_MISSP_REPLYTO 6258 1.03 5.43 0.01 61 HTML_IMAGE_RATIO_04 6233 5.71 5.40 5.78 62 UNPARSEABLE_RELAY 5974 7.90 5.18 8.53 63 MIME_QP_LONG_LINE 5829 6.01 5.05 6.23 64 XMNumbers 5422 3.67 4.70 3.43 65 MIME_HTML_MOSTLY 5337 2.64 4.63 2.17 66 XM_SendGrid 5160 6.30 4.47 6.73 67 RDNS_DYNAMIC 5053 1.10 4.38 0.33 68 RELAYCOUNTRY_FR 5045 1.02 4.37 0.24 69 HTML_MIME_NO_HTML_TAG 5029 3.35 4.36 3.12 70 XM_B_Unsub2 5025 2.69 4.36 2.31 71 RELAYCOUNTRY_CA 5006 2.09 4.34 1.57 72 BODY_URI_ONLY 4764 0.87 4.13 0.11 73 T_XMDrugObfuBody_08 4754 2.08 4.12 1.60 74 PDS_OTHER_BAD_TLD 4650 1.07 4.03 0.37 75 URIBL_SBL_A 4580 1.14 3.97 0.47 76 HTML_SHORT_LINK_IMG_1 4469 0.75 3.87 0.01 77 XMBody_17 4468 1.26 3.87 0.65 78 SpammyFromTLD_02 4380 0.89 3.80 0.21 79 BAYES_40 4329 5.52 3.75 5.93 80 BAYES_95 4250 2.04 3.69 1.66 81 MIME_HEADER_CTYPE_ONLY 4230 0.94 3.67 0.30 82 HDRS_LCASE_IMGONLY 4222 0.70 3.66 0.01 83 FROM_MISSP_DYNIP 4099 0.67 3.55 0.00 84 XM_DIRTYINTL 4094 1.13 3.55 0.57 85 XM_URI_RBL 4066 0.85 3.53 0.23 86 BAYES_20 4021 4.46 3.49 4.69 87 RCVD_IN_MSPIKE_WL 4011 8.11 3.48 9.19 88 RCVD_IN_MSPIKE_H3 4011 8.11 3.48 9.19 89 TM2_M_URI_OPT_OUT 4009 2.96 3.48 2.84 90 ALL_TRUSTED 3973 13.40 3.44 15.73 91 XM_B_SpammyTLD 3898 2.10 3.38 1.80 92 XMStrtUSub 3872 4.00 3.36 4.16 93 SpammyFromTLD_01 3753 1.31 3.25 0.85 94 RELAYCOUNTRY_DE 3719 1.10 3.22 0.60 95 TR_LOTS_OF_MONEY3 3710 1.28 3.22 0.83 96 DKIM_ADSP_NXDOMAIN 3660 0.80 3.17 0.25 97 XM_OfRef6 3639 1.60 3.16 1.23 98 TR_XM_MaxBayes 3570 0.60 3.10 0.02 99 RCVD_IN_BL_SPAMCOP_NET 3553 1.36 3.08 0.95 100 TR_Mismatch_TLD_01 3512 0.74 3.05 0.21 101 MIME_HTML_ONLY_MULTI 3427 2.68 2.97 2.62 102 DATE_IN_PAST_03_06 3299 0.65 2.86 0.13 103 HTML_IMAGE_ONLY_08 3280 0.65 2.84 0.13 104 XMSexyCombo_01 3268 1.23 2.83 0.86 105 FROM_EXCESS_BASE64 3255 2.70 2.82 2.68 106 DATE_IN_PAST_06_12 3223 0.67 2.79 0.17 107 HDRS_MISSP 3185 0.56 2.76 0.04 108 HTML_IMAGE_RATIO_06 3123 2.96 2.71 3.02 109 FVGT_m_MULTI_ODD_EMAIL 3120 0.73 2.71 0.27 110 BAYES_00 3071 16.92 2.66 20.25 111 FROM_DOMAIN_NOVOWEL 2982 0.52 2.59 0.04 112 TooManyTo_002 2964 2.95 2.57 3.04 113 XM_B_COVIDMETA 2934 0.79 2.54 0.38 114 T_TooManySym_01 2907 3.74 2.52 4.02 115 URI_HEX 2880 1.54 2.50 1.32 116 SHORT_IMG_SUSP_NTLD 2860 0.47 2.48 0.00 117 TR_XM_PHPDW 2815 0.81 2.44 0.43 118 TR_XM_PHPForged 2798 0.80 2.43 0.42 119 TR_XM_FormFill2 2779 0.79 2.41 0.41 120 XM_H_PHPOS 2772 0.78 2.40 0.40 121 XMNoVowels 2686 1.84 2.33 1.73 122 XMDiploma_00 2681 1.77 2.32 1.64 123 HTML_IMAGE_RATIO_08 2528 2.01 2.19 1.97 124 T_XMHurry_00 2528 0.98 2.19 0.69 125 TooManyTo_003 2502 2.17 2.17 2.17 126 RCVD_IN_RP_RNBL 2362 0.44 2.05 0.06 127 TR_XM_INV_DKIM 2352 0.45 2.04 0.07 128 NO_FM_NAME_IP_HOSTN 2334 0.38 2.02 0.00 129 FROM_LOCAL_NOVOWEL 2235 0.39 1.94 0.03 130 T_XMDrugObfuBody_14 2234 1.61 1.94 1.53 131 TR_XM_DK_SendGrid 2219 3.10 1.92 3.38 132 TR_XM_DK_Bayes 2192 11.65 1.90 13.92 133 TM2_M_VERY_LONG_WORD 2173 1.38 1.88 1.26 134 RCVD_IN_IADB_LISTED 2156 4.40 1.87 4.99 135 BAYES_05 2124 2.91 1.84 3.16 136 RELAYCOUNTRY_IN 2099 0.41 1.82 0.09 137 TooManyTo_004 2079 1.68 1.80 1.65 138 SUBJ_ALL_CAPS 2072 1.61 1.80 1.57 139 RCVD_IN_RP_SAFE 2029 6.33 1.76 7.39 140 T_XMDrugObfuBody_00 2015 0.87 1.75 0.67 141 TR_Mismatch_TLD_02 1983 0.39 1.72 0.07 142 TR_Symld_Words 1974 1.39 1.71 1.31 143 RCVD_IN_IADB_SPF 1943 3.83 1.68 4.33 144 TR_XM_RelayPhish 1940 0.57 1.68 0.31 145 XMGenDplmaNmb 1919 1.18 1.66 1.06 146 XMSexyCombo_04 1911 0.74 1.66 0.53 147 RCVD_IN_IADB_DK 1910 3.34 1.66 3.73 148 RCVD_IN_IADB_SENDERID 1903 3.38 1.65 3.79 149 XMStockSpam_06 1852 1.19 1.61 1.09 150 TR_MetaPhish_Combo_01 1844 1.19 1.60 1.09 151 URI_TRY_3LD 1820 1.64 1.58 1.65 152 REPLYTO_WITHOUT_TO_CC 1789 0.56 1.55 0.33 153 BOTNET_NORDNS 1773 0.31 1.54 0.02 154 XM_DK_Undo_01 1721 1.92 1.49 2.02 155 URI_WP_HACKED_2 1705 0.39 1.48 0.13 156 TR_XM_DK_Bayes1 1681 10.78 1.46 12.96 157 DIET_1 1612 0.47 1.40 0.26 158 T_FILL_THIS_FORM_SHORT 1572 1.09 1.36 1.02 159 XMSlimDrugH 1567 0.47 1.36 0.26 160 HTML_IMAGE_ONLY_12 1559 1.18 1.35 1.14 161 TooManyTo_005 1489 1.36 1.29 1.38 162 TR_LOTS_OF_MONEY2 1466 0.50 1.27 0.32 163 T_MONEY_PERCENT 1466 0.50 1.27 0.32 164 TR_XM_MaxSPIKE 1461 0.28 1.27 0.05 165 RELAYCOUNTRY_GB 1442 1.18 1.25 1.16 166 MAILING_LIST_MULTI 1428 2.41 1.24 2.69 167 RCVD_IN_RP_CERTIFIED 1395 5.82 1.21 6.90 168 XMBrknScrpt_02 1363 0.82 1.18 0.74 169 XMPhish08 1350 0.69 1.17 0.58 170 XMBdyGiftCard01 1332 0.99 1.15 0.95 171 TO_EQ_FM_DOM_HTML_IMG 1233 0.21 1.07 0.01 172 XM_ProductURIs 1223 0.89 1.06 0.85 173 TR_XM_DK_Bayes2 1216 9.22 1.05 11.13 174 XMPhish30 1200 0.48 1.04 0.35 175 XM_H_Long_From02 1199 0.95 1.04 0.93 176 MPART_ALT_DIFF_COUNT 1178 0.54 1.02 0.43 177 XM_H_PHPMailer 1169 0.62 1.01 0.53 178 DKIM_ADSP_CUSTOM_MED 1159 1.33 1.00 1.41 179 XMSubMetaI_00 1103 0.59 0.96 0.51 180 XMSubMetaSxObfu_03 1099 0.79 0.95 0.75 181 SUSPICIOUS_RECIPS 1096 0.19 0.95 0.02 182 RCVD_IN_PSBL 1087 0.21 0.94 0.04 183 XM_UB60 1079 0.25 0.94 0.09 184 DATE_IN_PAST_12_24 1073 0.20 0.93 0.03 185 XM_H_PHPOS_M 1067 0.33 0.93 0.19 186 XMPhish14 1067 0.49 0.93 0.39 187 XMMoneyMeta_00 1049 0.78 0.91 0.75 188 XM_OfRef7 1014 0.34 0.88 0.21 189 HTML_TAG_BALANCE_CENTER 996 0.21 0.86 0.06 190 XMSubNoVowel 990 1.13 0.86 1.20 191 RELAYCOUNTRY_AT 940 0.32 0.82 0.21 192 FORGED_GMAIL_RCVD 919 0.63 0.80 0.59 193 URIBL_BLACK 917 0.18 0.80 0.04 194 T_Symld_Words_02 898 0.55 0.78 0.49 195 XM_H_MailChimp 882 0.30 0.76 0.19 196 NML_ADSP_CUSTOM_MED 881 0.98 0.76 1.04 197 RELAYCOUNTRY_BR 879 0.16 0.76 0.02 198 XM_PDF 877 3.96 0.76 4.71 199 HTTPS_HTTP_MISMATCH 875 0.95 0.76 1.00 200 XM_SPF_Unknown 872 0.67 0.76 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 436415 89.69 95.49 88.34 2 RELAYCOUNTRY_US 399010 79.86 75.98 80.76 3 DKIM_SIGNED 365389 74.65 77.64 73.96 4 XM_DK_Pass 358526 73.18 75.78 72.57 5 XM_B_Unicode 341494 69.74 72.41 69.12 6 DKIM_VALID 336624 67.81 66.41 68.14 7 DCC_CHECK_NEGATIVE 292933 51.48 18.01 59.29 8 BAYES_50 260373 51.22 44.84 52.70 9 DKIM_VALID_AU 246478 50.11 51.03 49.89 10 XMListUnsubscribeExists 237955 51.68 66.75 48.16 11 DCC_CHECK 190041 46.38 80.26 38.47 12 XM_B_Unicode3 183680 37.58 39.27 37.18 13 T_TM2_M_HEADER_IN_MSG 149908 28.30 19.55 30.34 14 HTML_FONT_LOW_CONTRAST 130209 26.62 27.74 26.36 15 DKIM_VALID_EF 129686 26.85 29.40 26.25 16 LOC_TINY_FONT_1 111810 24.85 34.33 22.63 17 FVGT_m_MULTI_ODD 107062 22.16 24.24 21.67 18 BAYES_00 100059 16.92 2.66 20.25 19 XMSubLong 99772 20.97 24.30 20.20 20 MIME_HTML_ONLY 99267 23.57 38.47 20.09 21 T_KAM_HTML_FONT_INVALID 89412 19.59 25.96 18.10 22 ALL_TRUSTED 77702 13.40 3.44 15.73 23 RCVD_IN_MSPIKE_H2 70671 13.24 8.68 14.30 24 TR_XM_DK_Bayes 68771 11.65 1.90 13.92 25 TR_XM_DK_Bayes1 64011 10.78 1.46 12.96 26 XM_Body_Dirty_Words 56023 12.83 19.19 11.34 27 TR_XM_DK_Bayes2 54980 9.22 1.05 11.13 28 XM_Multi_Part_URI 53931 12.14 17.36 10.92 29 XM_B_Unsub 51207 10.95 13.48 10.36 30 TooManyTo_001 48184 9.41 7.92 9.75 31 RCVD_IN_MSPIKE_H3 45427 8.11 3.48 9.19 32 RCVD_IN_MSPIKE_WL 45427 8.11 3.48 9.19 33 UNPARSEABLE_RELAY 42147 7.90 5.18 8.53 34 XM_Evil_Numbers_Gen 41405 8.94 11.34 8.38 35 LOTS_OF_MONEY 40545 9.48 14.92 8.21 36 LotsOfNums_01 39745 8.29 9.36 8.04 37 XM_B_Phish_Phrases 38743 8.76 12.70 7.84 38 HTML_IMAGE_RATIO_02 38387 8.60 12.14 7.77 39 RCVD_IN_RP_SAFE 36524 6.33 1.76 7.39 40 FSL_BULK_SIG 35849 9.15 17.24 7.26 41 RCVD_IN_RP_CERTIFIED 34066 5.82 1.21 6.90 42 XM_DK_Undo_02 33987 13.07 39.58 6.88 43 XM_DKIMWhitelistDomains 33235 5.49 0.17 6.73 44 XM_SendGrid 33225 6.30 4.47 6.73 45 MIME_QP_LONG_LINE 30796 6.01 5.05 6.23 46 BAYES_40 29295 5.52 3.75 5.93 47 DKIM_INVALID 28765 6.84 11.22 5.82 48 HTML_IMAGE_RATIO_04 28578 5.71 5.40 5.78 49 RELAYCOUNTRY_META 26870 8.59 22.10 5.44 50 XM_H_Long_From01 26134 5.42 6.00 5.29 51 BAYES_60 25881 5.54 6.82 5.24 52 RCVD_IN_IADB_LISTED 24660 4.40 1.87 4.99 53 XM_PDF 23247 3.96 0.76 4.71 54 BAYES_20 23161 4.46 3.49 4.69 55 BOTNET_IPINHOSTNAME 22958 6.61 15.03 4.65 56 MPART_ALT_DIFF 21861 4.93 7.11 4.42 57 RCVD_IN_IADB_SPF 21385 3.83 1.68 4.33 58 XMStrtUSub 20529 4.00 3.36 4.16 59 T_REMOTE_IMAGE 20204 4.44 5.92 4.09 60 T_TooManySym_01 19885 3.74 2.52 4.02 61 RCVD_IN_IADB_SENDERID 18724 3.38 1.65 3.79 62 RCVD_IN_IADB_DK 18413 3.34 1.66 3.73 63 XMNumbers 16922 3.67 4.70 3.43 64 IN_ZIMBRA_NJ_WHITELIST 16904 2.78 0.02 3.42 65 TR_XM_DK_SendGrid 16697 3.10 1.92 3.38 66 BAYES_99 16252 7.54 25.75 3.29 67 XM_UncommonTLD01 16136 6.26 19.11 3.27 68 RCVD_IN_IADB_VOUCHED 15845 2.73 0.68 3.21 69 BAYES_05 15627 2.91 1.84 3.16 70 HTML_MIME_NO_HTML_TAG 15391 3.35 4.36 3.12 71 XMSubMetaSx_00 15196 3.85 7.15 3.08 72 BAYES_80 15173 3.84 7.14 3.07 73 TooManyTo_002 15013 2.95 2.57 3.04 74 HTML_IMAGE_RATIO_06 14929 2.96 2.71 3.02 75 XMSexyCombo_05 14166 4.27 10.30 2.87 76 NO_DNS_FOR_FROM 14081 4.18 9.86 2.85 77 TM2_M_URI_OPT_OUT 14035 2.96 3.48 2.84 78 BOTNET 13859 6.47 22.19 2.81 79 MAILING_LIST_MULTI 13266 2.41 1.24 2.69 80 FROM_EXCESS_BASE64 13228 2.70 2.82 2.68 81 MIME_HTML_ONLY_MULTI 12923 2.68 2.97 2.62 82 BAYES_999 12811 5.94 20.26 2.59 83 XM_H_Trusted_IP 12662 2.08 0.00 2.56 84 ANY_BOUNCE_MESSAGE 11822 2.05 0.57 2.39 85 BOUNCE_MESSAGE 11801 2.04 0.57 2.39 86 XM_B_Unsub2 11395 2.69 4.36 2.31 87 RCVD_IN_MSPIKE_BL 11313 3.22 7.22 2.29 88 RCVD_IN_MSPIKE_L3 11163 3.15 6.99 2.26 89 TooManyTo_003 10724 2.17 2.17 2.17 90 MIME_HTML_MOSTLY 10721 2.64 4.63 2.17 91 T_TooManySym_02 10185 1.80 0.68 2.06 92 KHOP_HELO_FCRDNS 10157 3.31 8.69 2.06 93 RCVD_IN_IADB_OPTIN 10040 1.73 0.44 2.03 94 XM_DK_Undo_01 9967 1.92 1.49 2.02 95 HTML_IMAGE_RATIO_08 9726 2.01 2.19 1.97 96 TVD_RCVD_IP 9438 1.63 0.44 1.91 97 XM_CamelCaseFrm001 9186 2.54 5.45 1.86 98 TR_DCC_Bayes_99 9183 5.38 20.47 1.86 99 HELO_NODOT 8979 1.60 0.65 1.82 100 HELO_NO_DOMAIN 8977 1.60 0.65 1.82 101 XM_SPF_SoftFail 8961 2.77 6.88 1.81 102 XM_B_SpammyTLD 8884 2.10 3.38 1.80 103 XMNoVowels 8529 1.84 2.33 1.73 104 UNTRUSTED_Relay 8318 4.33 15.68 1.68 105 BAYES_95 8199 2.04 3.69 1.66 106 TooManyTo_004 8164 1.68 1.80 1.65 107 URI_TRY_3LD 8149 1.64 1.58 1.65 108 XMDiploma_00 8104 1.77 2.32 1.64 109 T_XMDrugObfuBody_08 7920 2.08 4.12 1.60 110 IN_HORDE_ADDRESS_BOOK 7884 1.30 0.03 1.60 111 RELAYCOUNTRY_CA 7743 2.09 4.34 1.57 112 SUBJ_ALL_CAPS 7735 1.61 1.80 1.57 113 INVALID_MSGID 7696 1.31 0.26 1.56 114 XMCapTrack 7631 1.35 0.52 1.54 115 T_XMDrugObfuBody_14 7579 1.61 1.94 1.53 116 CK_HELO_DYNAMIC_SPLIT_IP 7409 1.27 0.29 1.50 117 HELO_DYNAMIC_IPADDR2 7403 1.23 0.06 1.50 118 XM_GoogleGroups 7253 1.28 0.50 1.47 119 TO_MALFORMED 7010 1.17 0.11 1.42 120 DKIM_ADSP_CUSTOM_MED 6956 1.33 1.00 1.41 121 TooManyTo_005 6807 1.36 1.29 1.38 122 URI_HEX 6511 1.54 2.50 1.32 123 TR_Symld_Words 6469 1.39 1.71 1.31 124 TM2_M_VERY_LONG_WORD 6228 1.38 1.88 1.26 125 XM_OfRef6 6083 1.60 3.16 1.23 126 XMSubNoVowel 5904 1.13 0.86 1.20 127 RELAYCOUNTRY_GB 5720 1.18 1.25 1.16 128 HTML_IMAGE_ONLY_12 5615 1.18 1.35 1.14 129 XMStockSpam_06 5404 1.19 1.61 1.09 130 TR_MetaPhish_Combo_01 5395 1.19 1.60 1.09 131 XMGenDplmaNmb 5261 1.18 1.66 1.06 132 NML_ADSP_CUSTOM_MED 5120 0.98 0.76 1.04 133 T_FILL_THIS_FORM_SHORT 5044 1.09 1.36 1.02 134 HTTPS_HTTP_MISMATCH 4922 0.95 0.76 1.00 135 USER_IN_DEF_DKIM_WL 4855 0.80 0.01 0.98 136 XMGappySubj_01 4719 0.81 0.19 0.96 137 RCVD_IN_BL_SPAMCOP_NET 4714 1.36 3.08 0.95 138 XMBdyGiftCard01 4693 0.99 1.15 0.95 139 XM_H_Long_From02 4614 0.95 1.04 0.93 140 MISSING_HEADERS 4553 0.85 0.52 0.92 141 XM_UB50 4461 2.60 9.88 0.90 142 XMSexyCombo_01 4249 1.23 2.83 0.86 143 SpammyFromTLD_01 4215 1.31 3.25 0.85 144 XM_ProductURIs 4188 0.89 1.06 0.85 145 HTML_FONT_FACE_BAD 4122 0.81 0.69 0.83 146 TR_LOTS_OF_MONEY3 4088 1.28 3.22 0.83 147 XMSubMetaSxObfu_03 3697 0.79 0.95 0.75 148 XMMoneyMeta_00 3696 0.78 0.91 0.75 149 XMBrknScrpt_02 3652 0.82 1.18 0.74 150 XM_E_Blogspot 3508 0.60 0.14 0.71 151 XMHTML_After_End 3489 1.66 5.72 0.71 152 T_XMHurry_00 3433 0.98 2.19 0.69 153 XMSolicitRefs_0 3309 0.65 0.56 0.67 154 T_XMDrugObfuBody_00 3287 0.87 1.75 0.67 155 XMBody_17 3227 1.26 3.87 0.65 156 XM_SPF_Unknown 3220 0.67 0.76 0.65 157 RCVD_IN_SORBS_DUL 3109 0.52 0.06 0.63 158 TR_MSPIKEBAYES00 3038 0.53 0.15 0.61 159 XM_ShortIntro_01 2999 0.57 0.40 0.61 160 HTML_TAG_BALANCE_BODY 2982 0.60 0.60 0.60 161 RELAYCOUNTRY_DE 2962 1.10 3.22 0.60 162 FORGED_GMAIL_RCVD 2916 0.63 0.80 0.59 163 XMPhish08 2862 0.69 1.17 0.58 164 T_TooManySym_03 2818 0.51 0.24 0.57 165 T_OBFU_PDF_ATTACH 2804 0.49 0.18 0.57 166 XM_DIRTYINTL 2798 1.13 3.55 0.57 167 XMSexyCombo_04 2626 0.74 1.66 0.53 168 XM_H_PHPMailer 2623 0.62 1.01 0.53 169 FROM_GOV_SPOOF 2609 0.49 0.33 0.53 170 XMSubMetaI_00 2504 0.59 0.96 0.51 171 FROM_GOV_DKIM_AU 2453 0.43 0.16 0.50 172 T_Symld_Words_02 2437 0.55 0.78 0.49 173 HTML_IMAGE_ONLY_20 2348 0.47 0.45 0.48 174 URIBL_SBL_A 2341 1.14 3.97 0.47 175 RELAYCOUNTRY_AU 2284 0.50 0.68 0.46 176 SHORT_HELO_AND_INLINE_IMAGE 2280 0.38 0.02 0.46 177 PLING_QUERY 2183 0.48 0.62 0.44 178 TM2_M_BODY_EMPTY 2150 0.39 0.22 0.44 179 MPART_ALT_DIFF_COUNT 2112 0.54 1.02 0.43 180 AC_DIV_BONANZA 2110 0.37 0.13 0.43 181 TR_XM_PHPDW 2107 0.81 2.44 0.43 182 XM_B_REG_HTML 2104 0.41 0.32 0.43 183 HTML_IMAGE_ONLY_32 2079 0.38 0.19 0.42 184 LOW_PRICE 2072 0.46 0.66 0.42 185 TR_XM_PHPForged 2055 0.80 2.43 0.42 186 TR_XM_FormFill2 2043 0.79 2.41 0.41 187 USER_IN_WHITELIST 2030 0.33 0.00 0.41 188 XM_H_PHPOS 1994 0.78 2.40 0.40 189 XMOemUri 1993 0.39 0.33 0.40 190 HTML_IMAGE_ONLY_28 1950 0.41 0.45 0.39 191 URI_NOVOWEL 1944 0.41 0.50 0.39 192 XMPhish14 1904 0.49 0.93 0.39 193 XMBody_95 1904 0.33 0.08 0.39 194 XM_B_COVIDMETA 1900 0.79 2.54 0.38 195 HK_RANDOM_FROM 1887 0.39 0.42 0.38 196 XMHTMLBadTable_001 1873 0.39 0.45 0.38 197 XMEmptySub 1857 0.34 0.16 0.38 198 MSGID_FROM_MTA_HEADER 1855 0.35 0.25 0.38 199 PDS_OTHER_BAD_TLD 1843 1.07 4.03 0.37 200 XMPhish30 1752 0.48 1.04 0.35 ----------------------------------------------------------------------