Email: 615291 Autolearn: 0 AvgScore: 1.14 AvgScanTime: 2.11 sec Spam: 117791 Autolearn: 0 AvgScore: 11.91 AvgScanTime: 3.86 sec Ham: 497500 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.69 sec Time Spent Running SA: 360.06 hours Time Spent Processing Spam: 126.18 hours Time Spent Processing Ham: 233.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 113130 90.21 96.04 88.83 2 DKIM_SIGNED 97258 76.81 82.57 75.44 3 XM_DK_Pass 94957 75.39 80.61 74.15 4 RELAYCOUNTRY_US 92835 81.79 78.81 82.49 5 DCC_CHECK 92357 47.60 78.41 40.30 6 XM_B_Unicode 90323 71.98 76.68 70.87 7 DKIM_VALID 84651 70.30 71.87 69.93 8 XMListUnsubscribeExists 84530 54.44 71.76 50.34 9 DKIM_VALID_AU 61877 51.32 52.53 51.03 10 BAYES_50 57799 52.16 49.07 52.89 11 XM_B_Unicode3 53181 41.63 45.15 40.80 12 XM_DK_Undo_02 48505 13.62 41.18 7.10 13 MIME_HTML_ONLY 42879 23.96 36.40 21.01 14 LOC_TINY_FONT_1 41369 26.40 35.12 24.33 15 HTML_FONT_LOW_CONTRAST 37366 27.46 31.72 26.45 16 DKIM_VALID_EF 34069 26.32 28.92 25.70 17 FVGT_m_MULTI_ODD 33177 22.79 28.17 21.52 18 XMSubLong 29991 21.50 25.46 20.56 19 BOTNET 29062 7.17 24.67 3.03 20 T_KAM_HTML_FONT_INVALID 28408 18.98 24.12 17.77 21 BAYES_99 27929 7.10 23.71 3.16 22 RELAYCOUNTRY_META 25778 8.82 21.88 5.72 23 T_TM2_M_HEADER_IN_MSG 24396 26.87 20.71 28.33 24 XM_Body_Dirty_Words 23674 13.77 20.10 12.27 25 DCC_CHECK_NEGATIVE 23425 50.41 19.89 57.64 26 TR_DCC_Bayes_99 21842 4.92 18.54 1.70 27 BAYES_999 21559 5.62 18.30 2.61 28 XM_B_Phish_Phrases 21399 10.33 18.17 8.47 29 XM_UncommonTLD01 21120 6.20 17.93 3.42 30 XM_Multi_Part_URI 21048 12.93 17.87 11.77 31 BOTNET_IPINHOSTNAME 18674 6.73 15.85 4.57 32 UNTRUSTED_Relay 16656 4.17 14.14 1.80 33 XM_B_COVIDMETA 16082 5.02 13.65 2.98 34 FSL_BULK_SIG 15765 8.70 13.38 7.59 35 HTML_IMAGE_RATIO_02 15652 8.09 13.29 6.87 36 LOTS_OF_MONEY 14799 9.22 12.56 8.43 37 XM_B_Unsub 14333 10.32 12.17 9.88 38 XMSexyCombo_05 14275 5.32 12.12 3.70 39 LotsOfNums_01 13881 9.62 11.78 9.11 40 NO_DNS_FOR_FROM 13378 4.68 11.36 3.10 41 XM_Evil_Numbers_Gen 13142 9.06 11.16 8.57 42 DKIM_INVALID 12607 6.51 10.70 5.52 43 XM_UB50 11073 2.71 9.40 1.13 44 RCVD_IN_MSPIKE_H2 10110 13.52 8.58 14.69 45 RCVD_IN_MSPIKE_BL 9313 3.73 7.91 2.75 46 RCVD_IN_MSPIKE_L3 9174 3.69 7.79 2.72 47 XMSubMetaSx_00 8750 4.05 7.43 3.25 48 MPART_ALT_DIFF 8659 5.88 7.35 5.54 49 XM_H_Long_From01 8317 6.01 7.06 5.76 50 MIME_QP_LONG_LINE 7592 6.62 6.45 6.66 51 BAYES_80 7534 3.26 6.40 2.51 52 HTML_IMAGE_RATIO_04 6983 5.96 5.93 5.97 53 UNPARSEABLE_RELAY 6946 8.13 5.90 8.65 54 BAYES_60 6920 5.22 5.87 5.07 55 RELAYCOUNTRY_CA 6872 2.47 5.83 1.67 56 TooManyTo_001 6862 8.28 5.83 8.86 57 FROM_SUSPICIOUS_NTLD 6245 1.05 5.30 0.05 58 FROM_SUSPICIOUS_NTLD_FP 6188 1.04 5.25 0.04 59 PDS_OTHER_BAD_TLD 6017 1.45 5.11 0.59 60 KHOP_HELO_FCRDNS 5810 2.51 4.93 1.93 61 LongTLD 5745 1.09 4.88 0.19 62 XM_CamelCaseFrm001 5528 2.53 4.69 2.02 63 XM_SendGrid 5505 6.19 4.67 6.55 64 RELAYCOUNTRY_FR 5440 1.06 4.62 0.22 65 XM_B_SpammyTLD 5213 2.47 4.43 2.01 66 XM_SPF_SoftFail 5153 2.22 4.37 1.72 67 T_REMOTE_IMAGE 4948 4.54 4.20 4.62 68 TR_XM_PhishingBody 4854 2.14 4.12 1.67 69 HTML_IMAGE_RATIO_06 4786 3.65 4.06 3.55 70 BAYES_40 4680 5.66 3.97 6.06 71 SpammyFromTLD_02 4671 1.01 3.97 0.31 72 TM2_M_URI_OPT_OUT 4598 3.30 3.90 3.15 73 T_XMDrugObfuBody_08 4448 2.04 3.78 1.62 74 XM_OfRef6 4404 1.66 3.74 1.16 75 XM_URI_RBL 4330 0.87 3.68 0.21 76 RCVD_IN_MSPIKE_H3 4263 8.18 3.62 9.26 77 RCVD_IN_MSPIKE_WL 4263 8.18 3.62 9.26 78 RCVD_IN_BL_SPAMCOP_NET 4201 1.52 3.57 1.03 79 XMStrtUSub 4185 4.05 3.55 4.17 80 MIME_HTML_MOSTLY 4132 2.57 3.51 2.35 81 MIME_HTML_ONLY_MULTI 4103 3.61 3.48 3.64 82 BAYES_95 3957 1.79 3.36 1.42 83 XMNumbers 3925 3.19 3.33 3.15 84 BAYES_20 3844 4.49 3.26 4.78 85 XM_DIRTYINTL 3689 1.05 3.13 0.56 86 T_XMDrugObfuBody_14 3566 1.96 3.03 1.70 87 FROM_EXCESS_BASE64 3464 2.93 2.94 2.92 88 SpammyFromTLD_01 3458 1.20 2.94 0.78 89 XM_B_Unsub2 3344 1.90 2.84 1.67 90 DATE_IN_PAST_06_12 3257 0.66 2.77 0.16 91 RELAYCOUNTRY_DE 3233 1.09 2.74 0.69 92 XMBody_17 3207 1.06 2.72 0.66 93 HTML_MIME_NO_HTML_TAG 3169 2.78 2.69 2.80 94 BAYES_00 3135 17.42 2.66 20.91 95 RDNS_DYNAMIC 3095 0.76 2.63 0.32 96 URI_HEX 3050 1.57 2.59 1.32 97 T_TooManySym_01 2960 4.14 2.51 4.53 98 HTML_IMAGE_RATIO_08 2890 2.42 2.45 2.41 99 DATE_IN_PAST_03_06 2760 0.55 2.34 0.13 100 TR_XM_DK_Bayes 2631 11.71 2.23 13.96 101 RCVD_IN_IADB_LISTED 2601 4.93 2.21 5.57 102 DATE_IN_PAST_12_24 2583 0.47 2.19 0.06 103 FROM_MISSP_REPLYTO 2559 0.42 2.17 0.01 104 TR_XM_PHPDW 2511 0.78 2.13 0.46 105 FROM_MISSP_DYNIP 2507 0.41 2.13 0.00 106 MIME_HEADER_CTYPE_ONLY 2479 0.58 2.10 0.22 107 TR_XM_PHPForged 2469 0.75 2.10 0.44 108 URIBL_SBL_A 2450 0.47 2.08 0.09 109 TM2_M_VERY_LONG_WORD 2443 1.33 2.07 1.15 110 TR_XM_FormFill2 2443 0.75 2.07 0.44 111 XM_H_PHPOS 2437 0.74 2.07 0.43 112 TR_XM_DK_SendGrid 2412 3.28 2.05 3.57 113 RCVD_IN_IADB_SPF 2349 4.28 1.99 4.82 114 XMDiploma_00 2322 1.51 1.97 1.41 115 RCVD_IN_IADB_SENDERID 2284 3.75 1.94 4.18 116 RCVD_IN_IADB_DK 2283 3.72 1.94 4.15 117 HTML_IMAGE_ONLY_08 2248 0.45 1.91 0.11 118 TR_XM_INV_DKIM 2217 0.44 1.88 0.09 119 XMHTML_After_End 2213 0.91 1.88 0.68 120 XMSexyCombo_01 2181 0.78 1.85 0.53 121 HTML_SHORT_LINK_IMG_1 2161 0.36 1.83 0.01 122 XM_DK_Undo_01 2117 1.95 1.80 1.98 123 TR_XM_DK_Bayes1 2091 10.94 1.78 13.11 124 HDRS_LCASE_IMGONLY 2082 0.35 1.77 0.01 125 TR_XM_RelayPhish 2082 0.49 1.77 0.19 126 XMStockSpam_06 2074 1.28 1.76 1.17 127 TR_XM_MaxBayes 2041 0.34 1.73 0.01 128 RCVD_IN_RP_SAFE 2023 7.28 1.72 8.60 129 URI_TRY_3LD 2019 1.44 1.71 1.38 130 RCVD_IN_RP_RNBL 2014 0.38 1.71 0.06 131 BOTNET_NORDNS 1998 0.34 1.70 0.02 132 BAYES_05 1992 2.90 1.69 3.19 133 SUBJ_ALL_CAPS 1793 1.54 1.52 1.55 134 TR_MetaPhish_Combo_01 1783 1.16 1.51 1.08 135 XMBdyGiftCard01 1778 1.07 1.51 0.97 136 XM_H_Long_From02 1760 1.16 1.49 1.08 137 TR_XM_DK_Bayes2 1741 9.47 1.48 11.37 138 TR_LOTS_OF_MONEY3 1741 0.58 1.48 0.37 139 ALL_TRUSTED 1735 11.42 1.47 13.78 140 T_XMHurry_00 1722 0.66 1.46 0.47 141 XMBrknScrpt_02 1707 0.83 1.45 0.69 142 XMPhish14 1687 0.59 1.43 0.39 143 MAILING_LIST_MULTI 1683 2.35 1.43 2.57 144 TR_Symld_Words 1669 1.34 1.42 1.32 145 RELAYCOUNTRY_IN 1668 0.34 1.42 0.08 146 XMGenDplmaNmb 1654 1.04 1.40 0.95 147 NORDNS_LOW_CONTRAST 1640 0.42 1.39 0.19 148 RELAYCOUNTRY_GB 1624 1.24 1.38 1.21 149 TR_XM_MaxSPIKE 1606 0.30 1.36 0.05 150 T_XMDrugObfuBody_00 1600 0.74 1.36 0.59 151 XMPhish30 1590 0.81 1.35 0.68 152 XM_UB60 1572 0.31 1.33 0.06 153 HEXHASH_WORD 1551 0.26 1.32 0.00 154 XMPhish08 1528 0.71 1.30 0.57 155 T_FILL_THIS_FORM_SHORT 1515 1.16 1.29 1.13 156 RCVD_IN_RP_CERTIFIED 1514 6.52 1.29 7.75 157 REPLYTO_WITHOUT_TO_CC 1458 0.30 1.24 0.07 158 URI_NOVOWEL 1399 0.69 1.19 0.57 159 HK_RANDOM_REPLYTO 1367 0.46 1.16 0.30 160 XM_ProductURIs 1358 1.13 1.15 1.13 161 XMBody_78 1325 0.51 1.12 0.37 162 DIET_1 1288 0.43 1.09 0.28 163 XM_H_PHPMailer 1262 0.59 1.07 0.47 164 TO_EQ_FM_DOM_HTML_IMG 1242 0.21 1.05 0.00 165 TR_Mismatch_TLD_02 1230 0.25 1.04 0.06 166 DKIM_ADSP_CUSTOM_MED 1222 1.40 1.04 1.49 167 BODY_URI_ONLY 1210 0.29 1.03 0.12 168 XMSubMetaSxObfu_03 1205 0.54 1.02 0.42 169 T_MONEY_PERCENT 1204 0.37 1.02 0.21 170 TR_LOTS_OF_MONEY2 1204 0.37 1.02 0.21 171 XM_PDF 1140 3.98 0.97 4.70 172 URIBL_BLACK 1113 0.21 0.94 0.03 173 TR_Mismatch_TLD_01 1102 0.34 0.94 0.19 174 XMMoneyMeta_00 1081 0.95 0.92 0.96 175 DKIM_ADSP_NXDOMAIN 1074 0.41 0.91 0.29 176 XMSubMetaI_00 1057 0.48 0.90 0.38 177 HDRS_MISSP 1050 0.18 0.89 0.02 178 HELO_NO_DOMAIN 1040 1.44 0.88 1.58 179 HELO_NODOT 1040 1.44 0.88 1.58 180 XM_H_PHPOS_M 1033 0.29 0.88 0.16 181 FORGED_GMAIL_RCVD 1020 0.59 0.87 0.52 182 TooManyTo_002 1013 2.34 0.86 2.69 183 XM_UB80 1012 0.18 0.86 0.02 184 XMSubMetaSSx_00 981 0.43 0.83 0.34 185 HTTPS_HTTP_MISMATCH 972 0.82 0.83 0.82 186 XM_B_COPY_HTML 966 0.46 0.82 0.38 187 RCVD_IN_PSBL 965 0.17 0.82 0.02 188 XM_H_MailChimp 962 0.31 0.82 0.19 189 XM_OfRef7 957 0.26 0.81 0.13 190 NO_FM_NAME_IP_HOSTN 954 0.16 0.81 0.00 191 T_Symld_Words_02 928 0.51 0.79 0.45 192 RELAYCOUNTRY_AU 916 0.45 0.78 0.37 193 FVGT_m_MULTI_ODD_EMAIL 911 0.17 0.77 0.02 194 XM_B_SEO 892 0.25 0.76 0.13 195 MPART_ALT_DIFF_COUNT 887 0.47 0.75 0.40 196 XM_UB99 868 0.15 0.74 0.01 197 T_TooManySym_02 864 2.10 0.73 2.43 198 REMOVE_BEFORE_LINK 839 0.33 0.71 0.24 199 FROM_DOMAIN_NOVOWEL 839 0.16 0.71 0.03 200 XM_Nigeria_01 835 0.20 0.71 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 441954 90.21 96.04 88.83 2 RELAYCOUNTRY_US 410394 81.79 78.81 82.49 3 DKIM_SIGNED 375331 76.81 82.57 75.44 4 XM_DK_Pass 368896 75.39 80.61 74.15 5 XM_B_Unicode 352594 71.98 76.68 70.87 6 DKIM_VALID 347887 70.30 71.87 69.93 7 DCC_CHECK_NEGATIVE 286771 50.41 19.89 57.64 8 BAYES_50 263129 52.16 49.07 52.89 9 DKIM_VALID_AU 253865 51.32 52.53 51.03 10 XMListUnsubscribeExists 250440 54.44 71.76 50.34 11 XM_B_Unicode3 202976 41.63 45.15 40.80 12 DCC_CHECK 200496 47.60 78.41 40.30 13 T_TM2_M_HEADER_IN_MSG 140920 26.87 20.71 28.33 14 HTML_FONT_LOW_CONTRAST 131573 27.46 31.72 26.45 15 DKIM_VALID_EF 127861 26.32 28.92 25.70 16 LOC_TINY_FONT_1 121048 26.40 35.12 24.33 17 FVGT_m_MULTI_ODD 107065 22.79 28.17 21.52 18 MIME_HTML_ONLY 104522 23.96 36.40 21.01 19 BAYES_00 104046 17.42 2.66 20.91 20 XMSubLong 102295 21.50 25.46 20.56 21 T_KAM_HTML_FONT_INVALID 88397 18.98 24.12 17.77 22 RCVD_IN_MSPIKE_H2 73082 13.52 8.58 14.69 23 TR_XM_DK_Bayes 69443 11.71 2.23 13.96 24 ALL_TRUSTED 68556 11.42 1.47 13.78 25 TR_XM_DK_Bayes1 65229 10.94 1.78 13.11 26 XM_Body_Dirty_Words 61060 13.77 20.10 12.27 27 XM_Multi_Part_URI 58534 12.93 17.87 11.77 28 TR_XM_DK_Bayes2 56541 9.47 1.48 11.37 29 XM_B_Unsub 49140 10.32 12.17 9.88 30 RCVD_IN_MSPIKE_H3 46057 8.18 3.62 9.26 31 RCVD_IN_MSPIKE_WL 46057 8.18 3.62 9.26 32 LotsOfNums_01 45307 9.62 11.78 9.11 33 TooManyTo_001 44081 8.28 5.83 8.86 34 UNPARSEABLE_RELAY 43048 8.13 5.90 8.65 35 RCVD_IN_RP_SAFE 42765 7.28 1.72 8.60 36 XM_Evil_Numbers_Gen 42618 9.06 11.16 8.57 37 XM_B_Phish_Phrases 42150 10.33 18.17 8.47 38 LOTS_OF_MONEY 41943 9.22 12.56 8.43 39 RCVD_IN_RP_CERTIFIED 38579 6.52 1.29 7.75 40 XM_DKIMWhitelistDomains 37745 6.14 0.03 7.59 41 FSL_BULK_SIG 37736 8.70 13.38 7.59 42 XM_DK_Undo_02 35323 13.62 41.18 7.10 43 HTML_IMAGE_RATIO_02 34154 8.09 13.29 6.87 44 MIME_QP_LONG_LINE 33124 6.62 6.45 6.66 45 XM_SendGrid 32583 6.19 4.67 6.55 46 BAYES_40 30160 5.66 3.97 6.06 47 HTML_IMAGE_RATIO_04 29698 5.96 5.93 5.97 48 XM_H_Long_From01 28669 6.01 7.06 5.76 49 RELAYCOUNTRY_META 28481 8.82 21.88 5.72 50 RCVD_IN_IADB_LISTED 27704 4.93 2.21 5.57 51 MPART_ALT_DIFF 27546 5.88 7.35 5.54 52 DKIM_INVALID 27444 6.51 10.70 5.52 53 BAYES_60 25218 5.22 5.87 5.07 54 RCVD_IN_IADB_SPF 23989 4.28 1.99 4.82 55 BAYES_20 23780 4.49 3.26 4.78 56 XM_PDF 23375 3.98 0.97 4.70 57 T_REMOTE_IMAGE 22982 4.54 4.20 4.62 58 BOTNET_IPINHOSTNAME 22729 6.73 15.85 4.57 59 T_TooManySym_01 22514 4.14 2.51 4.53 60 RCVD_IN_IADB_SENDERID 20784 3.75 1.94 4.18 61 XMStrtUSub 20753 4.05 3.55 4.17 62 RCVD_IN_IADB_DK 20622 3.72 1.94 4.15 63 XMSexyCombo_05 18431 5.32 12.12 3.70 64 MIME_HTML_ONLY_MULTI 18089 3.61 3.48 3.64 65 RCVD_IN_IADB_VOUCHED 17824 3.02 0.65 3.58 66 TR_XM_DK_SendGrid 17776 3.28 2.05 3.57 67 HTML_IMAGE_RATIO_06 17646 3.65 4.06 3.55 68 XM_H_Trusted_IP 17067 2.77 0.00 3.43 69 XM_UncommonTLD01 17021 6.20 17.93 3.42 70 IN_ZIMBRA_NJ_WHITELIST 16664 2.71 0.02 3.35 71 XMSubMetaSx_00 16161 4.05 7.43 3.25 72 BAYES_05 15881 2.90 1.69 3.19 73 BAYES_99 15730 7.10 23.71 3.16 74 XMNumbers 15686 3.19 3.33 3.15 75 TM2_M_URI_OPT_OUT 15678 3.30 3.90 3.15 76 NO_DNS_FOR_FROM 15431 4.68 11.36 3.10 77 BOTNET 15065 7.17 24.67 3.03 78 XM_B_COVIDMETA 14817 5.02 13.65 2.98 79 FROM_EXCESS_BASE64 14536 2.93 2.94 2.92 80 HTML_MIME_NO_HTML_TAG 13928 2.78 2.69 2.80 81 RCVD_IN_MSPIKE_BL 13668 3.73 7.91 2.75 82 RCVD_IN_MSPIKE_L3 13532 3.69 7.79 2.72 83 TooManyTo_002 13387 2.34 0.86 2.69 84 BAYES_999 13006 5.62 18.30 2.61 85 MAILING_LIST_MULTI 12802 2.35 1.43 2.57 86 BAYES_80 12501 3.26 6.40 2.51 87 T_TooManySym_02 12085 2.10 0.73 2.43 88 HTML_IMAGE_RATIO_08 12013 2.42 2.45 2.41 89 ANY_BOUNCE_MESSAGE 11862 1.99 0.33 2.38 90 BOUNCE_MESSAGE 11856 1.99 0.33 2.38 91 MIME_HTML_MOSTLY 11699 2.57 3.51 2.35 92 RCVD_IN_IADB_OPTIN 11163 1.89 0.39 2.24 93 XM_CamelCaseFrm001 10044 2.53 4.69 2.02 94 XM_B_SpammyTLD 10003 2.47 4.43 2.01 95 XM_DK_Undo_01 9869 1.95 1.80 1.98 96 KHOP_HELO_FCRDNS 9621 2.51 4.93 1.93 97 TooManyTo_003 9539 1.68 0.69 1.92 98 UNTRUSTED_Relay 8974 4.17 14.14 1.80 99 TVD_RCVD_IP 8936 1.57 0.60 1.80 100 XM_SPF_SoftFail 8535 2.22 4.37 1.72 101 T_XMDrugObfuBody_14 8480 1.96 3.03 1.70 102 TR_DCC_Bayes_99 8446 4.92 18.54 1.70 103 XM_B_Unsub2 8329 1.90 2.84 1.67 104 RELAYCOUNTRY_CA 8304 2.47 5.83 1.67 105 TR_XM_PhishingBody 8289 2.14 4.12 1.67 106 T_XMDrugObfuBody_08 8079 2.04 3.78 1.62 107 IN_HORDE_ADDRESS_BOOK 8053 1.32 0.06 1.62 108 INVALID_MSGID 7891 1.32 0.20 1.59 109 HELO_NODOT 7849 1.44 0.88 1.58 110 HELO_NO_DOMAIN 7848 1.44 0.88 1.58 111 SUBJ_ALL_CAPS 7711 1.54 1.52 1.55 112 HTML_FONT_FACE_BAD 7656 1.37 0.64 1.54 113 TooManyTo_004 7461 1.32 0.55 1.50 114 XM_GoogleGroups 7417 1.32 0.59 1.49 115 CK_HELO_DYNAMIC_SPLIT_IP 7405 1.26 0.28 1.49 116 HELO_DYNAMIC_IPADDR2 7399 1.23 0.16 1.49 117 DKIM_ADSP_CUSTOM_MED 7392 1.40 1.04 1.49 118 TO_MALFORMED 7141 1.17 0.03 1.44 119 BAYES_95 7049 1.79 3.36 1.42 120 XMDiploma_00 6999 1.51 1.97 1.41 121 URI_TRY_3LD 6858 1.44 1.71 1.38 122 XMCapTrack 6835 1.22 0.59 1.37 123 URI_HEX 6581 1.57 2.59 1.32 124 TR_Symld_Words 6581 1.34 1.42 1.32 125 XMGappySubj_01 6376 1.08 0.22 1.28 126 TooManyTo_005 6274 1.11 0.46 1.26 127 RELAYCOUNTRY_GB 6010 1.24 1.38 1.21 128 XMStockSpam_06 5802 1.28 1.76 1.17 129 XM_OfRef6 5793 1.66 3.74 1.16 130 NML_ADSP_CUSTOM_MED 5773 1.07 0.69 1.16 131 TM2_M_VERY_LONG_WORD 5732 1.33 2.07 1.15 132 XMSubNoVowel 5716 1.06 0.69 1.15 133 XM_UB50 5605 2.71 9.40 1.13 134 XM_ProductURIs 5599 1.13 1.15 1.13 135 T_FILL_THIS_FORM_SHORT 5597 1.16 1.29 1.13 136 TR_MetaPhish_Combo_01 5381 1.16 1.51 1.08 137 XM_H_Long_From02 5379 1.16 1.49 1.08 138 RCVD_IN_BL_SPAMCOP_NET 5142 1.52 3.57 1.03 139 USER_IN_DEF_DKIM_WL 4866 0.79 0.00 0.98 140 XMBdyGiftCard01 4832 1.07 1.51 0.97 141 XMMoneyMeta_00 4778 0.95 0.92 0.96 142 XMGenDplmaNmb 4727 1.04 1.40 0.95 143 XM_SPF_Unknown 4709 0.89 0.64 0.95 144 HTTPS_HTTP_MISMATCH 4104 0.82 0.83 0.82 145 XMNoVowels 4034 0.76 0.53 0.81 146 SpammyFromTLD_01 3897 1.20 2.94 0.78 147 XMDateMe_00 3516 0.63 0.33 0.71 148 RELAYCOUNTRY_DE 3454 1.09 2.74 0.69 149 XMBrknScrpt_02 3427 0.83 1.45 0.69 150 XMPhish30 3375 0.81 1.35 0.68 151 XMHTML_After_End 3364 0.91 1.88 0.68 152 XMBody_17 3307 1.06 2.72 0.66 153 XM_ShortIntro_01 3196 0.56 0.20 0.64 154 HTML_IMAGE_ONLY_20 3058 0.59 0.48 0.61 155 T_TooManySym_03 2961 0.53 0.26 0.60 156 T_XMDrugObfuBody_00 2953 0.74 1.36 0.59 157 FROM_GOV_DKIM_AU 2937 0.54 0.35 0.59 158 PDS_OTHER_BAD_TLD 2932 1.45 5.11 0.59 159 MISSING_HEADERS 2919 0.54 0.34 0.59 160 TR_MSPIKEBAYES00 2884 0.47 0.00 0.58 161 URI_NOVOWEL 2849 0.69 1.19 0.57 162 T_OBFU_PDF_ATTACH 2836 0.50 0.19 0.57 163 XMPhish08 2821 0.71 1.30 0.57 164 XM_DIRTYINTL 2765 1.05 3.13 0.56 165 PLING_QUERY 2707 0.52 0.40 0.54 166 XMSexyCombo_01 2638 0.78 1.85 0.53 167 RCVD_IN_SORBS_DUL 2624 0.44 0.06 0.53 168 FORGED_GMAIL_RCVD 2596 0.59 0.87 0.52 169 XMHTMLBadTable_001 2405 0.50 0.55 0.48 170 XMGappySubj_02 2396 0.41 0.09 0.48 171 XM_H_PHPMailer 2359 0.59 1.07 0.47 172 T_XMHurry_00 2348 0.66 1.46 0.47 173 TVD_PH_BODY_ACCOUNTS_PRE 2320 0.42 0.24 0.47 174 TR_XM_PHPDW 2272 0.78 2.13 0.46 175 T_Symld_Words_02 2231 0.51 0.79 0.45 176 XM_B_REG_HTML 2214 0.41 0.27 0.45 177 USER_IN_WHITELIST 2199 0.36 0.00 0.44 178 TR_XM_FormFill2 2172 0.75 2.07 0.44 179 TR_XM_PHPForged 2170 0.75 2.10 0.44 180 XM_H_PHPOS 2141 0.74 2.07 0.43 181 FROM_GOV_SPOOF 2132 0.41 0.32 0.43 182 XMRcvdHeader_15 2131 0.35 0.00 0.43 183 HTML_IMAGE_ONLY_16 2109 0.44 0.50 0.42 184 XMLngstWrd_00 2103 0.46 0.63 0.42 185 XMSubMetaSxObfu_03 2095 0.54 1.02 0.42 186 HTML_IMAGE_ONLY_32 2073 0.36 0.14 0.42 187 TM2_M_BODY_EMPTY 2057 0.35 0.07 0.41 188 XM_USANA_RCVD 2026 0.33 0.00 0.41 189 MPART_ALT_DIFF_COUNT 2003 0.47 0.75 0.40 190 TO_NO_BRKTS_HTML_ONLY 2001 0.36 0.20 0.40 191 AC_DIV_BONANZA 1991 0.35 0.12 0.40 192 MSGID_FROM_MTA_HEADER 1945 0.37 0.29 0.39 193 SHORT_HELO_AND_INLINE_IMAGE 1939 0.33 0.05 0.39 194 XMPhish14 1939 0.59 1.43 0.39 195 XM_B_TRADE_HTML 1934 0.36 0.21 0.39 196 XMLngstWrd_01 1912 0.43 0.60 0.38 197 HTML_IMAGE_ONLY_28 1898 0.39 0.42 0.38 198 XMSubMetaI_00 1885 0.48 0.90 0.38 199 XM_B_COPY_HTML 1881 0.46 0.82 0.38 200 TR_LOTS_OF_MONEY3 1845 0.58 1.48 0.37 ----------------------------------------------------------------------