Email: 725598 Autolearn: 0 AvgScore: -1.97 AvgScanTime: 1.99 sec Spam: 119730 Autolearn: 0 AvgScore: 12.38 AvgScanTime: 3.55 sec Ham: 605868 Autolearn: 0 AvgScore: -4.80 AvgScanTime: 1.68 sec Time Spent Running SA: 401.13 hours Time Spent Processing Spam: 117.92 hours Time Spent Processing Ham: 283.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114074 90.83 95.28 89.96 2 DCC_CHECK 96416 39.19 80.53 31.02 3 DKIM_SIGNED 94222 63.64 78.70 60.66 4 RELAYCOUNTRY_US 93812 83.97 78.35 85.09 5 XM_DK_Pass 91458 62.29 76.39 59.51 6 XM_B_Unicode 88790 74.32 74.16 74.35 7 DKIM_VALID 87059 59.45 72.71 56.83 8 XMListUnsubscribeExists 78908 43.62 65.90 39.21 9 DKIM_VALID_AU 65916 43.61 55.05 41.35 10 BAYES_50 57422 50.54 47.96 51.05 11 XM_B_Unicode3 49137 38.15 41.04 37.58 12 XM_DK_Undo_02 47184 10.97 39.41 5.35 13 MIME_HTML_ONLY 45090 36.33 37.66 36.06 14 LOC_TINY_FONT_1 38980 20.92 32.56 18.62 15 HTML_FONT_LOW_CONTRAST 37258 23.04 31.12 21.44 16 DKIM_VALID_EF 36246 22.94 30.27 21.49 17 BOTNET 31837 22.34 26.59 21.50 18 FVGT_m_MULTI_ODD 31021 18.92 25.91 17.54 19 BAYES_99 28860 5.75 24.10 2.12 20 XMSubLong 28206 18.17 23.56 17.11 21 XM_UncommonTLD01 27943 6.13 23.34 2.73 22 T_KAM_HTML_FONT_INVALID 27820 15.48 23.24 13.94 23 RELAYCOUNTRY_META 27539 7.76 23.00 4.74 24 T_TM2_M_HEADER_IN_MSG 24328 23.94 20.32 24.66 25 XM_Body_Dirty_Words 24050 11.71 20.09 10.05 26 TR_DCC_Bayes_99 22964 3.98 19.18 0.97 27 FSL_BULK_SIG 22809 7.65 19.05 5.40 28 BAYES_999 22525 4.46 18.81 1.62 29 DCC_CHECK_NEGATIVE 20994 59.05 17.53 67.26 30 XM_Multi_Part_URI 19007 10.17 15.87 9.04 31 UNTRUSTED_Relay 18264 3.58 15.25 1.27 32 BOTNET_IPINHOSTNAME 16836 5.47 14.06 3.77 33 XM_B_Phish_Phrases 16094 7.35 13.44 6.14 34 LOTS_OF_MONEY 14297 7.38 11.94 6.48 35 XM_B_Unsub 14285 9.27 11.93 8.75 36 XMSexyCombo_05 13905 4.57 11.61 3.18 37 HTML_IMAGE_RATIO_02 13276 6.44 11.09 5.52 38 XM_Evil_Numbers_Gen 12965 7.61 10.83 6.97 39 NO_DNS_FOR_FROM 12619 4.35 10.54 3.13 40 LotsOfNums_01 11860 6.98 9.91 6.40 41 RCVD_IN_MSPIKE_H2 11806 12.05 9.86 12.48 42 SpammyFromTLD_02 11518 1.72 9.62 0.15 43 XM_UB50 11445 2.20 9.56 0.75 44 XM_B_COVIDMETA 10430 3.19 8.71 2.10 45 T_REMOTE_IMAGE 9458 3.95 7.90 3.17 46 XM_H_Long_From01 9401 4.88 7.85 4.29 47 RCVD_IN_MSPIKE_BL 8980 2.70 7.50 1.76 48 RCVD_IN_MSPIKE_L3 8936 2.69 7.46 1.74 49 XMSubMetaSx_00 7947 3.18 6.64 2.49 50 BAYES_60 7897 4.32 6.60 3.87 51 XM_CamelCaseFrm001 7861 2.42 6.57 1.60 52 BAYES_80 7825 2.78 6.54 2.03 53 XMNumbers 7319 3.25 6.11 2.68 54 MPART_ALT_DIFF 7314 19.86 6.11 22.58 55 MIME_HEADER_CTYPE_ONLY 7186 1.17 6.00 0.22 56 HTML_SHORT_LINK_IMG_1 7180 1.00 6.00 0.02 57 HDRS_LCASE_IMGONLY 7170 1.00 5.99 0.01 58 DKIM_INVALID 7163 4.19 5.98 3.83 59 UNPARSEABLE_RELAY 6707 6.88 5.60 7.13 60 HTML_IMAGE_RATIO_04 6579 4.34 5.49 4.11 61 SHORT_SHORTNER 6567 0.92 5.48 0.02 62 REPLYTO_WITHOUT_TO_CC 6507 0.96 5.43 0.07 63 HTML_IMAGE_ONLY_04 6431 0.93 5.37 0.06 64 SHORT_URI_2 6421 0.90 5.36 0.02 65 TooManyTo_001 6390 7.26 5.34 7.64 66 RELAYCOUNTRY_CA 6277 2.07 5.24 1.45 67 HTML_SHORT_CENTER 6209 0.86 5.19 0.00 68 TO_EQ_FM_DOM_HTML_IMG 6189 0.86 5.17 0.01 69 MIME_QP_LONG_LINE 5764 4.62 4.81 4.58 70 XM_DIRTYINTL 5568 1.19 4.65 0.51 71 KHOP_HELO_FCRDNS 5532 2.22 4.62 1.74 72 XM_SendGrid 5471 5.24 4.57 5.37 73 MIME_HTML_MOSTLY 5412 2.44 4.52 2.02 74 XM_B_SpammyTLD 5395 2.09 4.51 1.61 75 BAYES_40 5299 6.30 4.43 6.67 76 XM_SPF_SoftFail 5255 1.97 4.39 1.49 77 RELAYCOUNTRY_FR 4957 0.86 4.14 0.21 78 T_XMDrugObfuBody_08 4920 1.78 4.11 1.32 79 FROM_SUSPICIOUS_NTLD 4871 0.70 4.07 0.04 80 FROM_SUSPICIOUS_NTLD_FP 4808 0.69 4.02 0.03 81 RELAYCOUNTRY_DE 4751 1.00 3.97 0.41 82 LongTLD 4593 0.77 3.84 0.17 83 PDS_OTHER_BAD_TLD 4580 1.02 3.83 0.46 84 HTML_IMAGE_RATIO_06 4453 2.97 3.72 2.82 85 XMStrtUSub 4323 3.79 3.61 3.82 86 RCVD_IN_BL_SPAMCOP_NET 4250 1.19 3.55 0.72 87 URIBL_SBL_A 4004 0.61 3.34 0.07 88 BAYES_20 3945 7.63 3.29 8.48 89 XM_OfRef6 3909 1.39 3.26 1.02 90 TM2_M_URI_OPT_OUT 3903 2.38 3.26 2.21 91 BAYES_95 3803 1.55 3.18 1.22 92 TR_XM_PhishingBody 3748 1.43 3.13 1.09 93 XM_URI_RBL 3715 0.64 3.10 0.15 94 XM_B_Unsub2 3505 1.61 2.93 1.34 95 SpammyFromTLD_01 3455 1.05 2.89 0.69 96 T_TooManySym_01 3392 3.52 2.83 3.65 97 RCVD_IN_MSPIKE_WL 3379 6.84 2.82 7.64 98 RCVD_IN_MSPIKE_H3 3379 6.84 2.82 7.64 99 TR_Symld_Words 3322 1.43 2.77 1.16 100 TR_XM_MaxBayes 3310 0.46 2.76 0.01 101 HTML_MIME_NO_HTML_TAG 3234 2.88 2.70 2.91 102 XMDiploma_00 3119 1.41 2.61 1.18 103 FROM_EXCESS_BASE64 3037 2.63 2.54 2.65 104 MIME_HTML_ONLY_MULTI 2979 17.98 2.49 21.04 105 XMBody_17 2886 0.83 2.41 0.52 106 TR_XM_PHPDW 2878 0.74 2.40 0.41 107 TR_XM_PHPForged 2835 0.72 2.37 0.40 108 TR_XM_FormFill2 2813 0.72 2.35 0.40 109 XM_H_PHPOS 2810 0.71 2.35 0.39 110 BAYES_00 2707 17.43 2.26 20.43 111 RDNS_DYNAMIC 2639 0.59 2.20 0.27 112 XMHTML_After_End 2638 0.88 2.20 0.61 113 TO_EQ_FM_DOM_HTML_ONLY 2598 0.38 2.17 0.03 114 URI_HEX 2573 1.50 2.15 1.37 115 TR_XM_DK_SendGrid 2552 2.89 2.13 3.04 116 NORDNS_LOW_CONTRAST 2463 0.34 2.06 0.01 117 XMSubMetaI_00 2417 0.76 2.02 0.52 118 TR_LOTS_OF_MONEY3 2414 0.60 2.02 0.33 119 HTML_IMAGE_RATIO_08 2370 2.94 1.98 3.13 120 RCVD_IN_RP_RNBL 2320 0.37 1.94 0.06 121 XMGenDplmaNmb 2314 0.99 1.93 0.81 122 TM2_M_VERY_LONG_WORD 2301 1.21 1.92 1.07 123 XMSexyCombo_01 2260 0.62 1.89 0.37 124 MAILING_LIST_MULTI 2166 2.15 1.81 2.22 125 RCVD_IN_IADB_LISTED 2115 3.62 1.77 3.99 126 DATE_IN_PAST_06_12 2096 6.90 1.75 7.92 127 BOTNET_NORDNS 2068 16.04 1.73 18.87 128 SUBJ_ALL_CAPS 2051 1.69 1.71 1.69 129 HK_RANDOM_REPLYTO 2016 0.47 1.68 0.24 130 RCVD_IN_RP_SAFE 2003 5.83 1.67 6.65 131 BAYES_05 1969 3.72 1.64 4.13 132 DIET_1 1968 0.48 1.64 0.26 133 RCVD_IN_IADB_SPF 1966 3.17 1.64 3.47 134 DATE_IN_PAST_03_06 1933 4.87 1.61 5.51 135 TR_Mismatch_TLD_02 1920 0.31 1.60 0.06 136 TR_XM_RelayPhish 1916 0.40 1.60 0.16 137 RCVD_IN_IADB_SENDERID 1880 2.75 1.57 2.99 138 RCVD_IN_IADB_DK 1878 2.77 1.57 3.00 139 FROM_MISSP_DYNIP 1865 0.26 1.56 0.00 140 T_XMDrugObfuBody_14 1840 1.18 1.54 1.11 141 TR_Mismatch_TLD_01 1832 0.39 1.53 0.17 142 TR_XM_DK_Bayes 1790 9.67 1.50 11.29 143 T_FILL_THIS_FORM_SHORT 1753 1.21 1.46 1.16 144 T_XMHurry_00 1731 0.56 1.45 0.38 145 TR_XM_DK_Bayes1 1701 9.31 1.42 10.87 146 TR_MetaPhish_Combo_01 1700 0.85 1.42 0.74 147 TR_XM_MaxSPIKE 1697 0.30 1.42 0.08 148 XM_UB60 1692 0.28 1.41 0.05 149 TR_XM_INV_DKIM 1671 0.27 1.40 0.05 150 SUBJECT_NEEDS_ENCODING 1656 0.23 1.38 0.00 151 SUBJ_ILLEGAL_CHARS 1654 0.23 1.38 0.00 152 RELAYCOUNTRY_GB 1629 1.11 1.36 1.06 153 XMPhish08 1627 0.51 1.36 0.35 154 XMBdyGiftCard01 1625 0.93 1.36 0.84 155 FROM_MISSP_REPLYTO 1617 0.23 1.35 0.01 156 URI_TRY_3LD 1581 0.97 1.32 0.90 157 T_XMDrugObfuBody_00 1519 0.69 1.27 0.58 158 XM_UB99 1509 0.21 1.26 0.00 159 XM_DK_Undo_01 1508 1.64 1.26 1.72 160 XMStockSpam_06 1507 1.01 1.26 0.96 161 XMMoneyMeta_00 1494 0.76 1.25 0.66 162 DATE_IN_PAST_12_24 1451 0.22 1.21 0.03 163 TR_XM_DK_Bayes2 1443 7.98 1.21 9.32 164 SUBJ_OBFU_PUNCT_FEW 1432 0.30 1.20 0.12 165 DKIM_ADSP_CUSTOM_MED 1409 1.14 1.18 1.13 166 TVD_SPACE_RATIO 1391 0.40 1.16 0.25 167 RCVD_IN_RP_CERTIFIED 1368 5.24 1.14 6.05 168 TVD_SPACE_RATIO_MINFP 1366 0.20 1.14 0.01 169 ALL_TRUSTED 1360 10.23 1.14 12.03 170 XM_H_PHPMailer 1356 0.55 1.13 0.44 171 MPART_ALT_DIFF_COUNT 1351 0.48 1.13 0.35 172 T_TooManySym_02 1343 1.70 1.12 1.81 173 XMPhish30 1338 0.58 1.12 0.47 174 DKIM_ADSP_NXDOMAIN 1335 0.39 1.12 0.25 175 XM_H_Long_From02 1320 0.80 1.10 0.74 176 XM_H_Undi_Recip 1293 0.43 1.08 0.31 177 XMBrknScrpt_02 1266 0.59 1.06 0.50 178 FVGT_m_MULTI_ODD_EMAIL 1260 0.19 1.05 0.02 179 T_MONEY_PERCENT 1236 0.40 1.03 0.28 180 TR_LOTS_OF_MONEY2 1236 0.40 1.03 0.28 181 FORGED_GMAIL_RCVD 1222 0.53 1.02 0.43 182 XMReplyNow 1216 0.23 1.02 0.08 183 BODY_URI_ONLY 1194 0.24 1.00 0.09 184 URIBL_BLACK 1179 0.18 0.98 0.02 185 XM_UB80 1172 0.18 0.98 0.02 186 XMNoVowels 1172 0.62 0.98 0.55 187 XM_ProductURIs 1146 0.66 0.96 0.60 188 XMSubMetaSxObfu_03 1135 0.45 0.95 0.35 189 XM_OfRef7 1123 0.23 0.94 0.09 190 NML_ADSP_CUSTOM_MED 1114 0.86 0.93 0.85 191 XM_H_PHPOS_M 1108 0.25 0.93 0.12 192 XM_PDF 1095 3.23 0.91 3.69 193 XM_UB999 1066 0.15 0.89 0.00 194 HTML_IMAGE_ONLY_08 1056 0.23 0.88 0.10 195 RCVD_IN_PSBL 1055 0.19 0.88 0.05 196 TR_XM_Undi_Recip5 1003 0.19 0.84 0.07 197 TR_XM_COVIDMETA1 993 0.20 0.83 0.07 198 HDRS_MISSP 988 0.16 0.83 0.03 199 HK_RANDOM_FROM 969 0.24 0.81 0.13 200 PLING_QUERY 958 0.44 0.80 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 545020 90.83 95.28 89.96 2 RELAYCOUNTRY_US 515507 83.97 78.35 85.09 3 XM_B_Unicode 450444 74.32 74.16 74.35 4 DCC_CHECK_NEGATIVE 407495 59.05 17.53 67.26 5 DKIM_SIGNED 367539 63.64 78.70 60.66 6 XM_DK_Pass 360541 62.29 76.39 59.51 7 DKIM_VALID 344321 59.45 72.71 56.83 8 BAYES_50 309273 50.54 47.96 51.05 9 DKIM_VALID_AU 250501 43.61 55.05 41.35 10 XMListUnsubscribeExists 237568 43.62 65.90 39.21 11 XM_B_Unicode3 227661 38.15 41.04 37.58 12 MIME_HTML_ONLY 218494 36.33 37.66 36.06 13 DCC_CHECK 187941 39.19 80.53 31.02 14 T_TM2_M_HEADER_IN_MSG 149378 23.94 20.32 24.66 15 MPART_ALT_DIFF 136819 19.86 6.11 22.58 16 BOTNET 130256 22.34 26.59 21.50 17 DKIM_VALID_EF 130218 22.94 30.27 21.49 18 HTML_FONT_LOW_CONTRAST 129914 23.04 31.12 21.44 19 XM_H_Trusted_IP 127567 17.58 0.00 21.06 20 MIME_HTML_ONLY_MULTI 127478 17.98 2.49 21.04 21 BAYES_00 123780 17.43 2.26 20.43 22 BOTNET_NORDNS 114314 16.04 1.73 18.87 23 LOC_TINY_FONT_1 112819 20.92 32.56 18.62 24 FVGT_m_MULTI_ODD 106245 18.92 25.91 17.54 25 XMSubLong 103666 18.17 23.56 17.11 26 IN_ZIMBRA_NJ_WHITELIST 101911 14.05 0.02 16.82 27 T_KAM_HTML_FONT_INVALID 84485 15.48 23.24 13.94 28 RCVD_IN_MSPIKE_H2 75642 12.05 9.86 12.48 29 ALL_TRUSTED 72877 10.23 1.14 12.03 30 TR_XM_DK_Bayes 68400 9.67 1.50 11.29 31 TR_XM_DK_Bayes1 65830 9.31 1.42 10.87 32 XM_Body_Dirty_Words 60896 11.71 20.09 10.05 33 TR_XM_DK_Bayes2 56480 7.98 1.21 9.32 34 XM_Multi_Part_URI 54781 10.17 15.87 9.04 35 XM_B_Unsub 53000 9.27 11.93 8.75 36 BAYES_20 51401 7.63 3.29 8.48 37 DATE_IN_PAST_06_12 47964 6.90 1.75 7.92 38 TooManyTo_001 46302 7.26 5.34 7.64 39 RCVD_IN_MSPIKE_H3 46275 6.84 2.82 7.64 40 RCVD_IN_MSPIKE_WL 46275 6.84 2.82 7.64 41 UNPARSEABLE_RELAY 43221 6.88 5.60 7.13 42 XM_Evil_Numbers_Gen 42235 7.61 10.83 6.97 43 BAYES_40 40387 6.30 4.43 6.67 44 RCVD_IN_RP_SAFE 40265 5.83 1.67 6.65 45 LOTS_OF_MONEY 39267 7.38 11.94 6.48 46 LotsOfNums_01 38787 6.98 9.91 6.40 47 XMSubNoVowel 37259 5.25 0.70 6.15 48 XM_B_Phish_Phrases 37227 7.35 13.44 6.14 49 RCVD_IN_RP_CERTIFIED 36655 5.24 1.14 6.05 50 XM_DKIMWhitelistDomains 33477 4.62 0.05 5.53 51 HTML_IMAGE_RATIO_02 33431 6.44 11.09 5.52 52 DATE_IN_PAST_03_06 33369 4.87 1.61 5.51 53 FSL_BULK_SIG 32708 7.65 19.05 5.40 54 XM_SendGrid 32522 5.24 4.57 5.37 55 XM_DK_Undo_02 32396 10.97 39.41 5.35 56 RELAYCOUNTRY_META 28741 7.76 23.00 4.74 57 MIME_QP_LONG_LINE 27777 4.62 4.81 4.58 58 XM_H_Long_From01 26019 4.88 7.85 4.29 59 BAYES_05 25007 3.72 1.64 4.13 60 HTML_IMAGE_RATIO_04 24922 4.34 5.49 4.11 61 RCVD_IN_IADB_LISTED 24157 3.62 1.77 3.99 62 HTML_OBFUSCATE_05_10 24050 3.40 0.54 3.97 63 BAYES_60 23440 4.32 6.60 3.87 64 DKIM_INVALID 23218 4.19 5.98 3.83 65 XMStrtUSub 23166 3.79 3.61 3.82 66 BOTNET_IPINHOSTNAME 22849 5.47 14.06 3.77 67 XM_PDF 22335 3.23 0.91 3.69 68 T_TooManySym_01 22124 3.52 2.83 3.65 69 RCVD_IN_IADB_SPF 21000 3.17 1.64 3.47 70 XMSexyCombo_05 19265 4.57 11.61 3.18 71 T_REMOTE_IMAGE 19208 3.95 7.90 3.17 72 HTML_IMAGE_RATIO_08 18985 2.94 1.98 3.13 73 NO_DNS_FOR_FROM 18951 4.35 10.54 3.13 74 TR_XM_DK_SendGrid 18443 2.89 2.13 3.04 75 RCVD_IN_IADB_DK 18190 2.77 1.57 3.00 76 RCVD_IN_IADB_SENDERID 18086 2.75 1.57 2.99 77 HTML_MIME_NO_HTML_TAG 17649 2.88 2.70 2.91 78 HTML_IMAGE_RATIO_06 17091 2.97 3.72 2.82 79 XM_UncommonTLD01 16519 6.13 23.34 2.73 80 XMNumbers 16229 3.25 6.11 2.68 81 FROM_EXCESS_BASE64 16032 2.63 2.54 2.65 82 RCVD_IN_IADB_VOUCHED 15427 2.23 0.62 2.55 83 XMSubMetaSx_00 15092 3.18 6.64 2.49 84 TooManyTo_002 13746 2.00 0.67 2.27 85 MAILING_LIST_MULTI 13437 2.15 1.81 2.22 86 TM2_M_URI_OPT_OUT 13367 2.38 3.26 2.21 87 BAYES_99 12844 5.75 24.10 2.12 88 XM_B_COVIDMETA 12723 3.19 8.71 2.10 89 BAYES_80 12322 2.78 6.54 2.03 90 MIME_HTML_MOSTLY 12267 2.44 4.52 2.02 91 ANY_BOUNCE_MESSAGE 12043 1.73 0.42 1.99 92 BOUNCE_MESSAGE 12042 1.73 0.42 1.99 93 T_TooManySym_02 10980 1.70 1.12 1.81 94 RCVD_IN_MSPIKE_BL 10636 2.70 7.50 1.76 95 RCVD_IN_MSPIKE_L3 10570 2.69 7.46 1.74 96 KHOP_HELO_FCRDNS 10557 2.22 4.62 1.74 97 XM_DK_Undo_01 10406 1.64 1.26 1.72 98 SUBJ_ALL_CAPS 10240 1.69 1.71 1.69 99 TooManyTo_003 9953 1.46 0.54 1.64 100 TVD_RCVD_IP 9946 1.45 0.50 1.64 101 BAYES_999 9814 4.46 18.81 1.62 102 RCVD_IN_IADB_OPTIN 9811 1.43 0.45 1.62 103 XM_B_SpammyTLD 9778 2.09 4.51 1.61 104 XM_CamelCaseFrm001 9704 2.42 6.57 1.60 105 HELO_NODOT 9097 1.36 0.67 1.50 106 HELO_NO_DOMAIN 9095 1.36 0.67 1.50 107 XM_SPF_SoftFail 9028 1.97 4.39 1.49 108 RELAYCOUNTRY_CA 8761 2.07 5.24 1.45 109 URI_HEX 8295 1.50 2.15 1.37 110 XM_B_Unsub2 8148 1.61 2.93 1.34 111 CK_HELO_DYNAMIC_SPLIT_IP 8043 1.13 0.15 1.33 112 HELO_DYNAMIC_IPADDR2 8036 1.12 0.07 1.33 113 T_XMDrugObfuBody_08 7977 1.78 4.11 1.32 114 TooManyTo_004 7751 1.14 0.46 1.28 115 UNTRUSTED_Relay 7712 3.58 15.25 1.27 116 IN_HORDE_ADDRESS_BOOK 7603 1.05 0.04 1.25 117 INVALID_MSGID 7601 1.09 0.26 1.25 118 BAYES_95 7411 1.55 3.18 1.22 119 XM_GoogleGroups 7364 1.09 0.44 1.22 120 XMCapTrack 7353 1.14 0.75 1.21 121 TO_MALFORMED 7164 1.00 0.05 1.18 122 XMDiploma_00 7142 1.41 2.61 1.18 123 T_FILL_THIS_FORM_SHORT 7055 1.21 1.46 1.16 124 TR_Symld_Words 7031 1.43 2.77 1.16 125 DKIM_ADSP_CUSTOM_MED 6870 1.14 1.18 1.13 126 T_XMDrugObfuBody_14 6746 1.18 1.54 1.11 127 HTML_FONT_SIZE_HUGE 6746 0.99 0.38 1.11 128 TooManyTo_005 6626 0.98 0.41 1.09 129 TR_XM_PhishingBody 6622 1.43 3.13 1.09 130 TM2_M_VERY_LONG_WORD 6486 1.21 1.92 1.07 131 RELAYCOUNTRY_GB 6413 1.11 1.36 1.06 132 XM_OfRef6 6150 1.39 3.26 1.02 133 TR_DCC_Bayes_99 5891 3.98 19.18 0.97 134 XMStockSpam_06 5846 1.01 1.26 0.96 135 URI_TRY_3LD 5468 0.97 1.32 0.90 136 USER_IN_DEF_DKIM_WL 5400 0.74 0.00 0.89 137 NML_ADSP_CUSTOM_MED 5162 0.86 0.93 0.85 138 XMBdyGiftCard01 5105 0.93 1.36 0.84 139 XMGenDplmaNmb 4899 0.99 1.93 0.81 140 XMGappySubj_01 4811 0.68 0.13 0.79 141 HTML_FONT_FACE_BAD 4731 0.76 0.65 0.78 142 XM_UB50 4540 2.20 9.56 0.75 143 TR_MetaPhish_Combo_01 4500 0.85 1.42 0.74 144 XM_H_Long_From02 4470 0.80 1.10 0.74 145 RCVD_IN_BL_SPAMCOP_NET 4379 1.19 3.55 0.72 146 HTTPS_HTTP_MISMATCH 4378 0.73 0.75 0.72 147 SpammyFromTLD_01 4198 1.05 2.89 0.69 148 TR_MSPIKEBAYES00 4119 0.57 0.00 0.68 149 XMMoneyMeta_00 4024 0.76 1.25 0.66 150 XMHTML_After_End 3721 0.88 2.20 0.61 151 XM_ProductURIs 3660 0.66 0.96 0.60 152 T_XMDrugObfuBody_00 3506 0.69 1.27 0.58 153 XMNoVowels 3349 0.62 0.98 0.55 154 T_TooManySym_03 3269 0.52 0.41 0.54 155 XM_E_Blogspot 3266 0.47 0.14 0.54 156 MISSING_HEADERS 3169 0.51 0.43 0.52 157 RCVD_IN_SORBS_DUL 3157 0.45 0.10 0.52 158 XMBody_17 3154 0.83 2.41 0.52 159 XMSubMetaI_00 3124 0.76 2.02 0.52 160 XM_SPF_Unknown 3121 0.54 0.64 0.52 161 XM_DIRTYINTL 3067 1.19 4.65 0.51 162 XM_ShortIntro_01 3014 0.49 0.43 0.50 163 XMBrknScrpt_02 3009 0.59 1.06 0.50 164 XMPhish30 2861 0.58 1.12 0.47 165 PDS_OTHER_BAD_TLD 2796 1.02 3.83 0.46 166 XM_H_PHPMailer 2650 0.55 1.13 0.44 167 FORGED_GMAIL_RCVD 2631 0.53 1.02 0.43 168 T_Symld_Words_02 2615 0.48 0.70 0.43 169 T_OBFU_PDF_ATTACH 2590 0.39 0.21 0.43 170 FROM_GOV_SPOOF 2537 0.41 0.39 0.42 171 RELAYCOUNTRY_DE 2507 1.00 3.97 0.41 172 TR_XM_PHPDW 2482 0.74 2.40 0.41 173 TR_XM_FormFill2 2404 0.72 2.35 0.40 174 TR_XM_PHPForged 2398 0.72 2.37 0.40 175 XMSubLongNoVowel 2381 0.34 0.07 0.39 176 XMHTMLBadTable_001 2376 0.41 0.52 0.39 177 XM_H_PHPOS 2369 0.71 2.35 0.39 178 T_XMHurry_00 2323 0.56 1.45 0.38 179 HTML_IMAGE_ONLY_20 2280 0.37 0.32 0.38 180 RELAYCOUNTRY_AU 2253 0.39 0.51 0.37 181 XMSexyCombo_01 2244 0.62 1.89 0.37 182 TM2_M_BODY_EMPTY 2236 0.33 0.12 0.37 183 PLING_QUERY 2220 0.44 0.80 0.37 184 HTML_TAG_BALANCE_BODY 2194 0.40 0.60 0.36 185 FROM_GOV_DKIM_AU 2188 0.34 0.21 0.36 186 URI_NOVOWEL 2148 0.39 0.57 0.35 187 XMSubMetaSxObfu_03 2148 0.45 0.95 0.35 188 MPART_ALT_DIFF_COUNT 2116 0.48 1.13 0.35 189 XMPhish08 2092 0.51 1.36 0.35 190 HTML_IMAGE_ONLY_28 2080 0.39 0.60 0.34 191 SHORT_HELO_AND_INLINE_IMAGE 2038 0.29 0.04 0.34 192 MSGID_FROM_MTA_HEADER 2023 0.35 0.40 0.33 193 HTML_IMAGE_ONLY_32 2021 0.31 0.18 0.33 194 USER_IN_WHITELIST 2002 0.28 0.00 0.33 195 AC_DIV_BONANZA 2001 0.29 0.08 0.33 196 TR_LOTS_OF_MONEY3 1974 0.60 2.02 0.33 197 XMSubMetaSxObfu_02 1911 0.32 0.32 0.32 198 XM_H_Undi_Recip 1854 0.43 1.08 0.31 199 T_HTML_ATTACH 1851 0.28 0.12 0.31 200 XM_RXBody 1850 0.31 0.32 0.31 ----------------------------------------------------------------------