Email: 714911 Autolearn: 0 AvgScore: -0.16 AvgScanTime: 2.09 sec Spam: 125179 Autolearn: 0 AvgScore: 11.80 AvgScanTime: 3.91 sec Ham: 589732 Autolearn: 0 AvgScore: -2.70 AvgScanTime: 1.70 sec Time Spent Running SA: 415.04 hours Time Spent Processing Spam: 135.93 hours Time Spent Processing Ham: 279.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 120502 89.70 96.26 88.31 2 DKIM_SIGNED 104513 68.74 83.49 65.61 3 XM_DK_Pass 101246 67.36 80.88 64.49 4 DCC_CHECK 99655 43.60 79.61 35.96 5 XM_B_Unicode 97618 71.98 77.98 70.70 6 RELAYCOUNTRY_US 96251 80.85 76.89 81.69 7 XMListUnsubscribeExists 89544 48.28 71.53 43.34 8 DKIM_VALID 85819 61.79 68.56 60.36 9 DKIM_VALID_AU 64680 44.94 51.67 43.51 10 BAYES_50 62521 46.91 49.95 46.26 11 XM_B_Unicode3 56242 41.85 44.93 41.20 12 XM_DK_Undo_02 50849 11.78 40.62 5.65 13 LOC_TINY_FONT_1 41907 22.45 33.48 20.11 14 MIME_HTML_ONLY 41533 24.76 33.18 22.97 15 HTML_FONT_LOW_CONTRAST 41383 24.60 33.06 22.80 16 DKIM_VALID_EF 34731 23.37 27.75 22.44 17 FVGT_m_MULTI_ODD 32960 20.19 26.33 18.89 18 XMSubLong 32268 20.53 25.78 19.41 19 RELAYCOUNTRY_META 30934 8.74 24.71 5.35 20 BOTNET 30235 6.24 24.15 2.44 21 T_KAM_HTML_FONT_INVALID 30025 17.63 23.99 16.29 22 BAYES_99 29708 6.31 23.73 2.61 23 T_TM2_M_HEADER_IN_MSG 24737 24.54 19.76 25.56 24 XM_B_Phish_Phrases 23996 9.09 19.17 6.96 25 TR_DCC_Bayes_99 23443 4.40 18.73 1.36 26 XM_Body_Dirty_Words 23375 11.87 18.67 10.42 27 BAYES_999 23217 4.91 18.55 2.01 28 DCC_CHECK_NEGATIVE 23129 54.51 18.48 62.16 29 XM_UncommonTLD01 21822 5.77 17.43 3.29 30 UNTRUSTED_Relay 21409 4.31 17.10 1.59 31 BOTNET_IPINHOSTNAME 21191 6.18 16.93 3.89 32 XM_Multi_Part_URI 21050 11.24 16.82 10.06 33 DKIM_INVALID 18694 6.94 14.93 5.25 34 XM_B_COVIDMETA 18458 4.16 14.75 1.92 35 XM_B_Unsub 16267 9.75 12.99 9.07 36 FSL_BULK_SIG 15850 8.63 12.66 7.77 37 HTML_IMAGE_RATIO_02 15746 7.02 12.58 5.84 38 LOTS_OF_MONEY 15367 7.70 12.28 6.73 39 NO_DNS_FOR_FROM 13969 4.53 11.16 3.12 40 RCVD_IN_MSPIKE_H2 13944 12.49 11.14 12.78 41 XM_Evil_Numbers_Gen 13927 9.82 11.13 9.55 42 LotsOfNums_01 13846 8.13 11.06 7.51 43 XM_UB50 13734 2.70 10.97 0.94 44 XMSexyCombo_05 12872 4.29 10.28 3.02 45 XM_H_Long_From01 10415 5.54 8.32 4.94 46 MIME_QP_LONG_LINE 9101 6.13 7.27 5.89 47 RCVD_IN_MSPIKE_BL 8583 3.13 6.86 2.34 48 MPART_ALT_DIFF 8327 9.00 6.65 9.50 49 XMSubMetaSx_00 8186 3.62 6.54 2.99 50 RCVD_IN_MSPIKE_L3 8162 3.05 6.52 2.31 51 TooManyTo_001 8134 7.57 6.50 7.79 52 XM_CamelCaseFrm001 7874 2.50 6.29 1.69 53 BAYES_80 6947 3.01 5.55 2.47 54 RELAYCOUNTRY_CA 6896 2.22 5.51 1.52 55 FROM_SUSPICIOUS_NTLD 6809 1.01 5.44 0.06 56 FROM_SUSPICIOUS_NTLD_FP 6747 0.99 5.39 0.06 57 HTML_IMAGE_RATIO_04 6603 12.12 5.27 13.58 58 UNPARSEABLE_RELAY 6523 7.13 5.21 7.54 59 XM_B_SpammyTLD 6472 2.23 5.17 1.61 60 RELAYCOUNTRY_FR 6328 1.16 5.06 0.33 61 BAYES_60 6220 4.56 4.97 4.47 62 LongTLD 5871 1.01 4.69 0.23 63 XMNumbers 5729 3.22 4.58 2.93 64 PDS_OTHER_BAD_TLD 5723 1.17 4.57 0.44 65 XM_SendGrid 5453 5.59 4.36 5.85 66 XM_B_Unsub2 5368 2.01 4.29 1.52 67 SpammyFromTLD_02 5344 0.92 4.27 0.21 68 MIME_HTML_MOSTLY 5270 2.68 4.21 2.35 69 XM_DIRTYINTL 5212 1.19 4.16 0.55 70 BAYES_40 5097 6.06 4.07 6.48 71 RELAYCOUNTRY_DE 5060 1.13 4.04 0.51 72 XM_SPF_SoftFail 4903 2.02 3.92 1.62 73 HTML_IMAGE_RATIO_06 4837 4.17 3.86 4.24 74 KHOP_HELO_FCRDNS 4752 2.30 3.80 1.98 75 BAYES_00 4663 21.37 3.73 25.12 76 TM2_M_URI_OPT_OUT 4619 3.84 3.69 3.88 77 T_REMOTE_IMAGE 4580 3.99 3.66 4.07 78 SpammyFromTLD_01 4510 1.23 3.60 0.73 79 HTML_MIME_NO_HTML_TAG 4478 2.65 3.58 2.45 80 XMStrtUSub 4339 8.25 3.47 9.27 81 RCVD_IN_BL_SPAMCOP_NET 4247 1.25 3.39 0.80 82 RCVD_IN_MSPIKE_WL 4019 7.60 3.21 8.53 83 RCVD_IN_MSPIKE_H3 4019 7.60 3.21 8.53 84 XM_URI_RBL 3931 0.69 3.14 0.17 85 BAYES_20 3800 5.95 3.04 6.57 86 RCVD_IN_RP_RNBL 3784 0.58 3.02 0.06 87 BAYES_95 3770 1.62 3.01 1.32 88 XM_OfRef6 3689 1.32 2.95 0.98 89 RCVD_IN_IADB_LISTED 3684 4.70 2.94 5.08 90 XMBody_17 3656 0.97 2.92 0.55 91 TR_XM_PhishingBody 3557 1.40 2.84 1.10 92 T_XMDrugObfuBody_08 3472 1.71 2.77 1.49 93 RCVD_IN_IADB_SPF 3461 4.10 2.76 4.38 94 T_TooManySym_01 3418 3.81 2.73 4.04 95 RCVD_IN_IADB_DK 3388 3.58 2.71 3.76 96 RCVD_IN_IADB_SENDERID 3388 3.62 2.71 3.82 97 TR_XM_DK_Bayes 3343 10.89 2.67 12.63 98 T_XMDrugObfuBody_14 3299 1.63 2.64 1.41 99 NORDNS_LOW_CONTRAST 3293 0.47 2.63 0.01 100 MIME_HTML_ONLY_MULTI 3285 6.73 2.62 7.61 101 T_XMHurry_00 2906 0.90 2.32 0.60 102 URIBL_SBL_A 2869 0.49 2.29 0.11 103 XMDiploma_00 2837 1.53 2.27 1.38 104 TR_XM_INV_DKIM 2787 0.46 2.23 0.08 105 FROM_EXCESS_BASE64 2698 2.22 2.16 2.23 106 DATE_IN_PAST_06_12 2587 0.48 2.07 0.14 107 TR_XM_PHPDW 2556 0.74 2.04 0.47 108 URI_HEX 2553 1.30 2.04 1.14 109 MAILING_LIST_MULTI 2536 2.63 2.03 2.76 110 TR_XM_PHPForged 2517 0.73 2.01 0.45 111 TR_XM_MaxBayes 2516 0.36 2.01 0.01 112 TR_XM_FormFill2 2469 0.72 1.97 0.45 113 XM_H_PHPOS 2459 0.71 1.96 0.44 114 HTML_IMAGE_RATIO_08 2459 1.97 1.96 1.97 115 TR_XM_DK_Bayes1 2445 10.02 1.95 11.73 116 BAYES_05 2437 4.21 1.95 4.69 117 TR_XM_DK_SendGrid 2414 2.78 1.93 2.96 118 TR_LOTS_OF_MONEY3 2401 0.65 1.92 0.37 119 URI_NOVOWEL 2388 0.60 1.91 0.33 120 TR_XM_RelayPhish 2306 0.49 1.84 0.21 121 TR_XM_DK_Bayes2 2295 8.66 1.83 10.11 122 DKIM_ADSP_NXDOMAIN 2274 0.75 1.82 0.53 123 TM2_M_VERY_LONG_WORD 2242 1.27 1.79 1.16 124 RCVD_IN_RP_SAFE 2240 5.85 1.79 6.71 125 XMSexyCombo_01 2181 0.59 1.74 0.35 126 DATE_IN_PAST_03_06 2146 0.42 1.71 0.14 127 XMGenDplmaNmb 1979 1.03 1.58 0.92 128 HTML_IMAGE_ONLY_08 1899 0.36 1.52 0.12 129 XMStockSpam_06 1884 1.09 1.51 1.01 130 HDRS_MISSP 1882 0.30 1.50 0.04 131 XMHTML_After_End 1870 0.76 1.49 0.60 132 HTML_SHORT_LINK_IMG_1 1852 0.27 1.48 0.01 133 TR_Symld_Words 1833 1.25 1.46 1.20 134 MIME_HEADER_CTYPE_ONLY 1827 0.46 1.46 0.25 135 XM_H_Long_From02 1820 1.04 1.45 0.96 136 DATE_IN_PAST_12_24 1747 0.28 1.40 0.04 137 FVGT_m_MULTI_ODD_EMAIL 1742 0.27 1.39 0.03 138 FROM_DOMAIN_NOVOWEL 1730 0.27 1.38 0.03 139 T_XMDrugObfuBody_00 1721 0.75 1.37 0.61 140 XMSubMetaI_00 1697 0.46 1.36 0.28 141 HDRS_LCASE_IMGONLY 1680 0.24 1.34 0.01 142 T_FILL_THIS_FORM_SHORT 1659 1.17 1.33 1.13 143 FROM_GOV_DKIM_AU 1632 0.62 1.30 0.47 144 BOTNET_NORDNS 1598 0.23 1.28 0.01 145 SHORT_IMG_SUSP_NTLD 1587 0.22 1.27 0.00 146 XM_DK_Undo_01 1575 1.62 1.26 1.69 147 MPART_ALT_DIFF_COUNT 1571 0.53 1.26 0.37 148 DKIM_ADSP_CUSTOM_MED 1562 1.18 1.25 1.16 149 XM_H_MailChimp 1553 0.38 1.24 0.20 150 XM_UB99 1543 0.22 1.23 0.01 151 SUBJ_ALL_CAPS 1542 1.23 1.23 1.23 152 RELAYCOUNTRY_IN 1526 0.28 1.22 0.08 153 ALL_TRUSTED 1508 12.56 1.20 14.97 154 RELAYCOUNTRY_FI 1494 0.23 1.19 0.03 155 RCVD_IN_RP_CERTIFIED 1493 5.09 1.19 5.91 156 TR_XM_MaxSPIKE 1487 0.28 1.19 0.08 157 TR_Mismatch_TLD_02 1471 0.26 1.18 0.06 158 XMPhish08 1465 0.52 1.17 0.39 159 T_Symld_Words_02 1456 0.55 1.16 0.42 160 URI_TRY_3LD 1454 1.04 1.16 1.02 161 TR_MetaPhish_Combo_01 1411 1.06 1.13 1.05 162 XM_PDF 1388 4.72 1.11 5.49 163 RELAYCOUNTRY_GB 1373 1.16 1.10 1.18 164 XMMoneyMeta_00 1350 0.87 1.08 0.82 165 FORGED_GMAIL_RCVD 1342 0.59 1.07 0.48 166 XM_UB60 1315 0.25 1.05 0.07 167 XMBdyGiftCard01 1305 0.86 1.04 0.82 168 NML_ADSP_CUSTOM_MED 1301 0.89 1.04 0.86 169 XMPhish30 1277 0.43 1.02 0.30 170 XMBrknScrpt_02 1262 0.73 1.01 0.67 171 REMOVE_BEFORE_LINK 1249 0.40 1.00 0.28 172 TR_LOTS_OF_MONEY2 1244 0.65 0.99 0.58 173 T_MONEY_PERCENT 1244 0.65 0.99 0.58 174 XM_H_PHPMailer 1224 0.57 0.98 0.48 175 TR_Mismatch_TLD_01 1216 0.32 0.97 0.18 176 XM_OfRef7 1211 0.28 0.97 0.14 177 XM_ProductURIs 1193 0.67 0.95 0.61 178 XMNoVowels 1166 0.88 0.93 0.87 179 DIET_1 1161 0.69 0.93 0.63 180 XM_SPF_Unknown 1143 1.13 0.91 1.18 181 XMGppyBdWords 1111 0.33 0.89 0.21 182 XM_XX_Yahoo 1089 0.19 0.87 0.04 183 HK_RANDOM_REPLYTO 1086 0.32 0.87 0.21 184 T_TooManySym_02 1054 1.73 0.84 1.91 185 XM_UB999 1045 0.15 0.83 0.01 186 URIBL_BLACK 1025 0.16 0.82 0.02 187 XMSlimDrugH 1014 0.39 0.81 0.31 188 XM_H_PHPOS_M 1000 0.28 0.80 0.17 189 URIBL_ABUSE_SURBL 986 0.18 0.79 0.05 190 XMSubNoVowel 983 3.76 0.79 4.39 191 LONG_IMG_URI 978 0.18 0.78 0.06 192 XM_B_COPY_HTML 947 0.35 0.76 0.26 193 RCVD_IN_IADB_VOUCHED 941 2.87 0.75 3.32 194 XMSubMetaSxObfu_03 930 0.58 0.74 0.55 195 HTTPS_HTTP_MISMATCH 925 0.79 0.74 0.80 196 SUBJ_ILLEGAL_CHARS 924 0.13 0.74 0.01 197 XM_UB80 924 0.14 0.74 0.02 198 SUBJECT_NEEDS_ENCODING 924 0.13 0.74 0.01 199 HELO_NO_DOMAIN 908 1.32 0.73 1.45 200 HELO_NODOT 908 1.32 0.73 1.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 520793 89.70 96.26 88.31 2 RELAYCOUNTRY_US 481735 80.85 76.89 81.69 3 XM_B_Unicode 416954 71.98 77.98 70.70 4 DKIM_SIGNED 386900 68.74 83.49 65.61 5 XM_DK_Pass 380345 67.36 80.88 64.49 6 DCC_CHECK_NEGATIVE 366576 54.51 18.48 62.16 7 DKIM_VALID 355959 61.79 68.56 60.36 8 BAYES_50 272829 46.91 49.95 46.26 9 DKIM_VALID_AU 256615 44.94 51.67 43.51 10 XMListUnsubscribeExists 255610 48.28 71.53 43.34 11 XM_B_Unicode3 242970 41.85 44.93 41.20 12 DCC_CHECK 212051 43.60 79.61 35.96 13 T_TM2_M_HEADER_IN_MSG 150728 24.54 19.76 25.56 14 BAYES_00 148132 21.37 3.73 25.12 15 MIME_HTML_ONLY 135472 24.76 33.18 22.97 16 HTML_FONT_LOW_CONTRAST 134474 24.60 33.06 22.80 17 DKIM_VALID_EF 132345 23.37 27.75 22.44 18 LOC_TINY_FONT_1 118601 22.45 33.48 20.11 19 XMSubLong 114474 20.53 25.78 19.41 20 FVGT_m_MULTI_ODD 111381 20.19 26.33 18.89 21 T_KAM_HTML_FONT_INVALID 96045 17.63 23.99 16.29 22 ALL_TRUSTED 88264 12.56 1.20 14.97 23 HTML_IMAGE_RATIO_04 80062 12.12 5.27 13.58 24 RCVD_IN_MSPIKE_H2 75348 12.49 11.14 12.78 25 TR_XM_DK_Bayes 74508 10.89 2.67 12.63 26 XM_H_Trusted_IP 72865 10.19 0.00 12.36 27 TR_XM_DK_Bayes1 69175 10.02 1.95 11.73 28 HTML_FONT_FACE_BAD 66319 9.38 0.58 11.25 29 XM_Body_Dirty_Words 61452 11.87 18.67 10.42 30 TR_XM_DK_Bayes2 59627 8.66 1.83 10.11 31 XM_Multi_Part_URI 59304 11.24 16.82 10.06 32 XM_Evil_Numbers_Gen 56303 9.82 11.13 9.55 33 MPART_ALT_DIFF 56046 9.00 6.65 9.50 34 XMStrtUSub 54659 8.25 3.47 9.27 35 XM_B_Unsub 53469 9.75 12.99 9.07 36 RCVD_IN_MSPIKE_H3 50323 7.60 3.21 8.53 37 RCVD_IN_MSPIKE_WL 50323 7.60 3.21 8.53 38 TooManyTo_001 45953 7.57 6.50 7.79 39 FSL_BULK_SIG 45812 8.63 12.66 7.77 40 MIME_HTML_ONLY_MULTI 44853 6.73 2.62 7.61 41 UNPARSEABLE_RELAY 44450 7.13 5.21 7.54 42 LotsOfNums_01 44277 8.13 11.06 7.51 43 XM_B_Phish_Phrases 41016 9.09 19.17 6.96 44 LOTS_OF_MONEY 39683 7.70 12.28 6.73 45 RCVD_IN_RP_SAFE 39596 5.85 1.79 6.71 46 BAYES_20 38744 5.95 3.04 6.57 47 BAYES_40 38216 6.06 4.07 6.48 48 XM_DKIMWhitelistDomains 35020 4.91 0.04 5.94 49 RCVD_IN_RP_CERTIFIED 34877 5.09 1.19 5.91 50 MIME_QP_LONG_LINE 34754 6.13 7.27 5.89 51 XM_SendGrid 34515 5.59 4.36 5.85 52 HTML_IMAGE_RATIO_02 34441 7.02 12.58 5.84 53 XM_DK_Undo_02 33349 11.78 40.62 5.65 54 XM_PDF 32358 4.72 1.11 5.49 55 RELAYCOUNTRY_META 31527 8.74 24.71 5.35 56 DKIM_INVALID 30941 6.94 14.93 5.25 57 RCVD_IN_IADB_LISTED 29942 4.70 2.94 5.08 58 XM_H_Long_From01 29158 5.54 8.32 4.94 59 BAYES_05 27683 4.21 1.95 4.69 60 BAYES_60 26365 4.56 4.97 4.47 61 XMSubNoVowel 25899 3.76 0.79 4.39 62 RCVD_IN_IADB_SPF 25854 4.10 2.76 4.38 63 HTML_IMAGE_RATIO_06 25000 4.17 3.86 4.24 64 T_REMOTE_IMAGE 23973 3.99 3.66 4.07 65 T_TooManySym_01 23806 3.81 2.73 4.04 66 BOTNET_IPINHOSTNAME 22962 6.18 16.93 3.89 67 TM2_M_URI_OPT_OUT 22868 3.84 3.69 3.88 68 RCVD_IN_IADB_SENDERID 22505 3.62 2.71 3.82 69 RCVD_IN_IADB_DK 22203 3.58 2.71 3.76 70 RCVD_IN_IADB_VOUCHED 19584 2.87 0.75 3.32 71 XM_UncommonTLD01 19412 5.77 17.43 3.29 72 NO_DNS_FOR_FROM 18406 4.53 11.16 3.12 73 IN_ZIMBRA_NJ_WHITELIST 18393 2.58 0.02 3.12 74 ANY_BOUNCE_MESSAGE 18199 2.62 0.42 3.09 75 BOUNCE_MESSAGE 18192 2.62 0.41 3.08 76 XMSexyCombo_05 17822 4.29 10.28 3.02 77 XMSubMetaSx_00 17660 3.62 6.54 2.99 78 TR_XM_DK_SendGrid 17479 2.78 1.93 2.96 79 XMNumbers 17272 3.22 4.58 2.93 80 MAILING_LIST_MULTI 16254 2.63 2.03 2.76 81 BAYES_99 15386 6.31 23.73 2.61 82 BAYES_80 14579 3.01 5.55 2.47 83 HTML_MIME_NO_HTML_TAG 14455 2.65 3.58 2.45 84 BOTNET 14393 6.24 24.15 2.44 85 MIME_HTML_MOSTLY 13881 2.68 4.21 2.35 86 RCVD_IN_MSPIKE_BL 13810 3.13 6.86 2.34 87 RCVD_IN_MSPIKE_L3 13628 3.05 6.52 2.31 88 FROM_EXCESS_BASE64 13158 2.22 2.16 2.23 89 TooManyTo_002 12976 1.92 0.60 2.20 90 RCVD_IN_IADB_OPTIN 12271 1.79 0.40 2.08 91 BAYES_999 11874 4.91 18.55 2.01 92 KHOP_HELO_FCRDNS 11670 2.30 3.80 1.98 93 HTML_IMAGE_RATIO_08 11620 1.97 1.96 1.97 94 XM_B_COVIDMETA 11308 4.16 14.75 1.92 95 T_TooManySym_02 11292 1.73 0.84 1.91 96 XM_CamelCaseFrm001 9995 2.50 6.29 1.69 97 XM_DK_Undo_01 9973 1.62 1.26 1.69 98 TVD_RCVD_IP 9545 1.42 0.47 1.62 99 XM_SPF_SoftFail 9540 2.02 3.92 1.62 100 XM_B_SpammyTLD 9482 2.23 5.17 1.61 101 UNTRUSTED_Relay 9396 4.31 17.10 1.59 102 TooManyTo_003 9207 1.37 0.48 1.56 103 RELAYCOUNTRY_CA 8987 2.22 5.51 1.52 104 XM_B_Unsub2 8974 2.01 4.29 1.52 105 T_XMDrugObfuBody_08 8768 1.71 2.77 1.49 106 HELO_NODOT 8558 1.32 0.73 1.45 107 HELO_NO_DOMAIN 8557 1.32 0.73 1.45 108 XMSubLongNoVowel 8492 1.20 0.08 1.44 109 XMSubGarbage 8415 1.18 0.03 1.43 110 IN_HORDE_ADDRESS_BOOK 8355 1.18 0.04 1.42 111 T_XMDrugObfuBody_14 8338 1.63 2.64 1.41 112 XMDiploma_00 8133 1.53 2.27 1.38 113 INVALID_MSGID 8113 1.17 0.22 1.38 114 TR_DCC_Bayes_99 8017 4.40 18.73 1.36 115 XM_GoogleGroups 7803 1.18 0.48 1.32 116 BAYES_95 7782 1.62 3.01 1.32 117 CK_HELO_DYNAMIC_SPLIT_IP 7377 1.08 0.30 1.25 118 HELO_DYNAMIC_IPADDR2 7371 1.04 0.07 1.25 119 XMCapTrack 7327 1.12 0.56 1.24 120 SUBJ_ALL_CAPS 7281 1.23 1.23 1.23 121 TooManyTo_004 7223 1.08 0.40 1.22 122 TO_MALFORMED 7140 1.01 0.05 1.21 123 TR_Symld_Words 7097 1.25 1.46 1.20 124 XM_E_Blogspot 7038 1.00 0.09 1.19 125 XM_SPF_Unknown 6942 1.13 0.91 1.18 126 RELAYCOUNTRY_GB 6930 1.16 1.10 1.18 127 T_OBFU_PDF_ATTACH 6921 1.04 0.39 1.17 128 DKIM_ADSP_CUSTOM_MED 6861 1.18 1.25 1.16 129 TM2_M_VERY_LONG_WORD 6818 1.27 1.79 1.16 130 URI_HEX 6719 1.30 2.04 1.14 131 T_FILL_THIS_FORM_SHORT 6691 1.17 1.33 1.13 132 TR_XM_PhishingBody 6463 1.40 2.84 1.10 133 TR_MetaPhish_Combo_01 6201 1.06 1.13 1.05 134 USER_IN_DEF_DKIM_WL 6187 0.87 0.00 1.05 135 TooManyTo_005 6173 0.93 0.36 1.05 136 URI_TRY_3LD 6012 1.04 1.16 1.02 137 XMStockSpam_06 5940 1.09 1.51 1.01 138 XM_OfRef6 5773 1.32 2.95 0.98 139 XM_H_Long_From02 5635 1.04 1.45 0.96 140 XM_UB50 5554 2.70 10.97 0.94 141 XMGenDplmaNmb 5411 1.03 1.58 0.92 142 XMNoVowels 5158 0.88 0.93 0.87 143 NML_ADSP_CUSTOM_MED 5058 0.89 1.04 0.86 144 XMMoneyMeta_00 4862 0.87 1.08 0.82 145 XMBdyGiftCard01 4860 0.86 1.04 0.82 146 XMGappySubj_01 4811 0.70 0.16 0.82 147 HTTPS_HTTP_MISMATCH 4693 0.79 0.74 0.80 148 RCVD_IN_BL_SPAMCOP_NET 4689 1.25 3.39 0.80 149 TR_MSPIKEBAYES00 4331 0.61 0.00 0.73 150 SpammyFromTLD_01 4297 1.23 3.60 0.73 151 XM_RXBody 4290 0.68 0.47 0.73 152 XMBrknScrpt_02 3951 0.73 1.01 0.67 153 DIET_1 3741 0.69 0.93 0.63 154 T_XMDrugObfuBody_00 3622 0.75 1.37 0.61 155 XM_ProductURIs 3595 0.67 0.95 0.61 156 T_XMHurry_00 3554 0.90 2.32 0.60 157 XMHTML_After_End 3544 0.76 1.49 0.60 158 T_TooManySym_03 3491 0.54 0.28 0.59 159 XMSolicitRefs_0 3393 0.54 0.37 0.58 160 T_MONEY_PERCENT 3392 0.65 0.99 0.58 161 TR_LOTS_OF_MONEY2 3392 0.65 0.99 0.58 162 XM_DIRTYINTL 3261 1.19 4.16 0.55 163 XMBody_17 3244 0.97 2.92 0.55 164 XMSubMetaSxObfu_03 3238 0.58 0.74 0.55 165 DKIM_ADSP_NXDOMAIN 3113 0.75 1.82 0.53 166 XMDateMe_00 3076 0.50 0.39 0.52 167 RELAYCOUNTRY_DE 3003 1.13 4.04 0.51 168 XM_ShortIntro_01 3001 0.49 0.41 0.51 169 MISSING_HEADERS 2945 0.49 0.47 0.50 170 RCVD_IN_SORBS_DUL 2943 0.43 0.09 0.50 171 XMHTMLBadTable_001 2881 0.50 0.58 0.49 172 FORGED_GMAIL_RCVD 2859 0.59 1.07 0.48 173 XM_H_PHPMailer 2835 0.57 0.98 0.48 174 FROM_GOV_DKIM_AU 2786 0.62 1.30 0.47 175 TR_XM_PHPDW 2750 0.74 2.04 0.47 176 TR_XM_PHPForged 2676 0.73 2.01 0.45 177 TR_XM_FormFill2 2647 0.72 1.97 0.45 178 XM_H_PHPOS 2618 0.71 1.96 0.44 179 PDS_OTHER_BAD_TLD 2616 1.17 4.57 0.44 180 T_Symld_Words_02 2482 0.55 1.16 0.42 181 HTML_IMAGE_ONLY_20 2448 0.41 0.40 0.42 182 FROM_GOV_SPOOF 2379 0.39 0.35 0.40 183 TM2_M_BODY_EMPTY 2333 0.34 0.09 0.40 184 XMPhish08 2278 0.52 1.17 0.39 185 RELAYCOUNTRY_AU 2215 0.42 0.62 0.38 186 TR_LOTS_OF_MONEY3 2211 0.65 1.92 0.37 187 MPART_ALT_DIFF_COUNT 2194 0.53 1.26 0.37 188 MSGID_FROM_MTA_HEADER 2187 0.36 0.31 0.37 189 XMPhish14 2175 0.42 0.67 0.37 190 HTML_IMAGE_ONLY_28 2153 0.40 0.56 0.37 191 XMBody_95 2120 0.32 0.12 0.36 192 HTML_TAG_BALANCE_BODY 2118 0.41 0.67 0.36 193 TVD_SPACE_RATIO 2097 0.32 0.15 0.36 194 RELAYCOUNTRY_NL 2095 0.37 0.46 0.36 195 SHORT_HELO_AND_INLINE_IMAGE 2072 0.30 0.05 0.35 196 XMSexyCombo_01 2059 0.59 1.74 0.35 197 HTML_IMAGE_ONLY_32 2052 0.33 0.23 0.35 198 TO_NO_BRKTS_HTML_ONLY 2050 0.32 0.20 0.35 199 MY_SERVERS_FOUND 1993 0.30 0.14 0.34 200 RELAYCOUNTRY_FR 1950 1.16 5.06 0.33 ----------------------------------------------------------------------