Email: 835249 Autolearn: 0 AvgScore: -2.84 AvgScanTime: 1.86 sec Spam: 123783 Autolearn: 0 AvgScore: 12.15 AvgScanTime: 3.28 sec Ham: 711466 Autolearn: 0 AvgScore: -5.45 AvgScanTime: 1.61 sec Time Spent Running SA: 430.95 hours Time Spent Processing Spam: 112.95 hours Time Spent Processing Ham: 318.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117685 92.65 95.07 92.23 2 DKIM_SIGNED 100904 57.91 81.52 53.80 3 DCC_CHECK 99426 35.98 80.32 28.27 4 RELAYCOUNTRY_US 98599 86.28 79.65 87.43 5 XM_DK_Pass 97465 56.67 78.74 52.83 6 XM_B_Unicode 93852 78.54 75.82 79.02 7 DKIM_VALID 88438 53.38 71.45 50.24 8 XMListUnsubscribeExists 84753 41.21 68.47 36.46 9 DKIM_VALID_AU 66334 39.28 53.59 36.79 10 BAYES_50 57089 48.62 46.12 49.05 11 XM_DK_Undo_02 50817 10.21 41.05 4.85 12 XM_B_Unicode3 50532 38.56 40.82 38.17 13 MIME_HTML_ONLY 46143 41.93 37.28 42.73 14 LOC_TINY_FONT_1 41181 18.79 33.27 16.27 15 DKIM_VALID_EF 38007 20.63 30.70 18.88 16 HTML_FONT_LOW_CONTRAST 36730 20.30 29.67 18.67 17 FVGT_m_MULTI_ODD 34679 17.82 28.02 16.05 18 BAYES_99 34285 5.93 27.70 2.14 19 T_KAM_HTML_FONT_INVALID 31727 15.15 25.63 13.32 20 XMSubLong 30096 16.67 24.31 15.34 21 BAYES_999 27449 4.66 22.18 1.61 22 BOTNET 27429 22.47 22.16 22.52 23 TR_DCC_Bayes_99 27237 4.04 22.00 0.91 24 RELAYCOUNTRY_META 26005 6.58 21.01 4.07 25 T_TM2_M_HEADER_IN_MSG 25064 21.00 20.25 21.13 26 XM_Body_Dirty_Words 24772 10.26 20.01 8.56 27 XM_UncommonTLD01 22957 4.73 18.55 2.33 28 XM_Multi_Part_URI 22100 9.96 17.85 8.59 29 DCC_CHECK_NEGATIVE 21904 62.32 17.70 70.09 30 FSL_BULK_SIG 18970 6.41 15.33 4.85 31 BOTNET_IPINHOSTNAME 18311 5.04 14.79 3.34 32 UNTRUSTED_Relay 16350 3.04 13.21 1.27 33 XM_B_Phish_Phrases 16101 6.57 13.01 5.45 34 XM_B_Unsub 16054 8.12 12.97 7.28 35 LOTS_OF_MONEY 14967 6.57 12.09 5.61 36 HTML_IMAGE_RATIO_02 13928 5.91 11.25 4.98 37 LotsOfNums_01 13272 7.02 10.72 6.38 38 XM_Evil_Numbers_Gen 12733 6.81 10.29 6.21 39 DKIM_INVALID 12466 4.52 10.07 3.56 40 XMSexyCombo_05 11991 3.45 9.69 2.36 41 RCVD_IN_MSPIKE_H2 11549 10.62 9.33 10.85 42 XM_B_COVIDMETA 11039 3.01 8.92 1.99 43 NO_DNS_FOR_FROM 10306 3.41 8.33 2.56 44 XM_UB50 9767 1.82 7.89 0.77 45 XM_CamelCaseFrm001 9006 2.34 7.28 1.48 46 XMSubMetaSx_00 8795 2.91 7.11 2.17 47 RCVD_IN_MSPIKE_BL 8674 2.42 7.01 1.62 48 BAYES_80 8555 2.68 6.91 1.94 49 RCVD_IN_MSPIKE_L3 8449 2.38 6.83 1.61 50 SpammyFromTLD_02 7753 1.07 6.26 0.17 51 TooManyTo_001 7665 6.41 6.19 6.44 52 XM_H_Long_From01 7660 4.28 6.19 3.95 53 HTML_IMAGE_RATIO_04 7200 3.80 5.82 3.45 54 MPART_ALT_DIFF 7110 28.46 5.74 32.41 55 T_REMOTE_IMAGE 7069 3.29 5.71 2.87 56 RELAYCOUNTRY_CA 7060 1.87 5.70 1.21 57 BAYES_60 6790 4.10 5.49 3.86 58 UNPARSEABLE_RELAY 6332 6.34 5.12 6.55 59 XMNumbers 6310 2.79 5.10 2.39 60 MIME_QP_LONG_LINE 6281 4.41 5.07 4.29 61 XM_SPF_SoftFail 6258 1.79 5.06 1.22 62 MIME_HTML_MOSTLY 5989 2.22 4.84 1.76 63 KHOP_HELO_FCRDNS 5719 5.35 4.62 5.48 64 MIME_HEADER_CTYPE_ONLY 5680 0.83 4.59 0.17 65 HDRS_LCASE_IMGONLY 5666 0.68 4.58 0.01 66 RCVD_IN_BL_SPAMCOP_NET 5615 1.50 4.54 0.97 67 XM_SendGrid 5327 4.85 4.30 4.94 68 XMStrtUSub 5177 3.10 4.18 2.91 69 T_XMDrugObfuBody_08 5135 1.62 4.15 1.18 70 SHORT_SHORTNER 4971 0.61 4.02 0.02 71 URIBL_SBL_A 4956 0.68 4.00 0.10 72 RELAYCOUNTRY_FR 4914 0.74 3.97 0.18 73 REPLYTO_WITHOUT_TO_CC 4899 0.63 3.96 0.05 74 SHORT_URI_2 4853 0.60 3.92 0.03 75 BAYES_95 4829 1.56 3.90 1.16 76 HTML_SHORT_LINK_IMG_1 4742 0.57 3.83 0.01 77 HTML_IMAGE_RATIO_06 4695 3.05 3.79 2.92 78 HTML_IMAGE_ONLY_04 4691 0.59 3.79 0.04 79 PDS_OTHER_BAD_TLD 4663 0.92 3.77 0.42 80 TM2_M_URI_OPT_OUT 4619 2.14 3.73 1.86 81 HTML_SHORT_CENTER 4598 0.55 3.71 0.00 82 BAYES_40 4512 7.24 3.65 7.86 83 RCVD_IN_MSPIKE_H3 4277 6.46 3.46 6.98 84 RCVD_IN_MSPIKE_WL 4277 6.46 3.46 6.98 85 XM_B_SpammyTLD 4220 1.74 3.41 1.45 86 TR_XM_PhishingBody 4209 1.32 3.40 0.96 87 FROM_SUSPICIOUS_NTLD 4183 0.53 3.38 0.04 88 TR_XM_MaxBayes 4162 0.51 3.36 0.01 89 XM_URI_RBL 4159 0.61 3.36 0.14 90 FROM_SUSPICIOUS_NTLD_FP 4039 0.51 3.26 0.03 91 XM_B_Unsub2 3881 1.59 3.14 1.32 92 FROM_EXCESS_BASE64 3795 2.20 3.07 2.05 93 XM_DIRTYINTL 3733 0.88 3.02 0.50 94 RCVD_IN_RP_RNBL 3695 0.49 2.99 0.06 95 SpammyFromTLD_01 3453 0.89 2.79 0.56 96 XMBody_17 3433 0.75 2.77 0.39 97 XM_OfRef6 3427 1.00 2.77 0.69 98 HTML_IMAGE_RATIO_08 3415 3.31 2.76 3.41 99 MIME_HTML_ONLY_MULTI 3404 26.84 2.75 31.03 100 T_TooManySym_01 3356 2.95 2.71 2.99 101 LongTLD 3351 0.52 2.71 0.14 102 BAYES_20 3342 9.13 2.70 10.25 103 TO_EQ_FM_DOM_HTML_IMG 3261 0.40 2.63 0.01 104 RDNS_DYNAMIC 3057 0.60 2.47 0.27 105 RCVD_IN_IADB_LISTED 3046 3.76 2.46 3.99 106 XMSexyCombo_01 3009 0.68 2.43 0.38 107 TR_XM_PHPDW 2882 0.99 2.33 0.75 108 RCVD_IN_IADB_SPF 2833 3.27 2.29 3.44 109 TR_XM_PHPForged 2831 0.97 2.29 0.74 110 TR_XM_FormFill2 2821 0.97 2.28 0.74 111 XM_H_PHPOS 2816 0.97 2.27 0.74 112 TR_XM_INV_DKIM 2779 0.36 2.25 0.03 113 RCVD_IN_IADB_DK 2772 2.84 2.24 2.95 114 RCVD_IN_IADB_SENDERID 2770 2.88 2.24 2.99 115 URI_HEX 2760 1.14 2.23 0.95 116 XMDiploma_00 2747 1.23 2.22 1.06 117 TR_Mismatch_TLD_01 2608 0.43 2.11 0.14 118 DKIM_ADSP_CUSTOM_MED 2589 1.19 2.09 1.04 119 TR_XM_DK_SendGrid 2568 2.68 2.07 2.79 120 T_XMDrugObfuBody_14 2559 1.38 2.07 1.26 121 BODY_URI_ONLY 2527 0.38 2.04 0.10 122 RELAYCOUNTRY_DE 2522 0.70 2.04 0.47 123 BAYES_00 2419 16.38 1.95 18.89 124 FORGED_GMAIL_RCVD 2383 0.67 1.93 0.45 125 TR_XM_MaxSPIKE 2376 0.36 1.92 0.09 126 NML_ADSP_CUSTOM_MED 2373 0.93 1.92 0.76 127 DATE_IN_PAST_03_06 2320 0.34 1.87 0.07 128 T_XMHurry_00 2290 0.80 1.85 0.62 129 TR_LOTS_OF_MONEY3 2274 0.60 1.84 0.38 130 HTML_MIME_NO_HTML_TAG 2239 1.58 1.81 1.54 131 XMHTML_After_End 2238 0.74 1.81 0.55 132 TM2_M_VERY_LONG_WORD 2169 0.99 1.75 0.86 133 XM_DK_Undo_01 2109 1.55 1.70 1.52 134 T_FILL_THIS_FORM_SHORT 2062 0.95 1.67 0.83 135 MAILING_LIST_MULTI 2010 1.95 1.62 2.01 136 BAYES_05 1962 4.36 1.59 4.85 137 FROM_MISSP_REPLYTO 1962 0.24 1.59 0.01 138 RCVD_IN_RP_SAFE 1956 4.95 1.58 5.54 139 XMStockSpam_06 1951 0.67 1.58 0.52 140 FROM_MISSP_DYNIP 1885 0.23 1.52 0.00 141 XMGenDplmaNmb 1883 0.83 1.52 0.71 142 HK_RANDOM_REPLYTO 1876 0.36 1.52 0.16 143 SUBJ_ALL_CAPS 1824 1.63 1.47 1.66 144 TR_Symld_Words 1791 1.05 1.45 0.98 145 RELAYCOUNTRY_GB 1740 0.92 1.41 0.84 146 TR_XM_RelayPhish 1621 0.28 1.31 0.10 147 BOTNET_NORDNS 1594 17.58 1.29 20.42 148 URI_TRY_3LD 1532 0.90 1.24 0.84 149 XMPhish30 1530 0.42 1.24 0.28 150 XMPhish08 1525 0.44 1.23 0.30 151 XM_H_PHPMailer 1475 0.52 1.19 0.40 152 XM_UB60 1427 0.22 1.15 0.06 153 TR_LOTS_OF_MONEY2 1410 0.36 1.14 0.23 154 T_MONEY_PERCENT 1410 0.36 1.14 0.23 155 TR_XM_DK_Bayes 1408 7.91 1.14 9.09 156 ALL_TRUSTED 1406 8.60 1.14 9.90 157 HTML_IMAGE_ONLY_20 1400 0.47 1.13 0.35 158 HEXHASH_WORD 1390 0.17 1.12 0.00 159 T_XMDrugObfuBody_00 1373 0.52 1.11 0.41 160 DATE_IN_PAST_06_12 1367 3.72 1.10 4.18 161 XMSubMetaI_00 1365 0.55 1.10 0.45 162 DKIM_ADSP_NXDOMAIN 1361 0.35 1.10 0.22 163 TR_XM_COVIDMETA1 1337 0.35 1.08 0.22 164 SUBJECT_NEEDS_ENCODING 1336 0.16 1.08 0.00 165 TR_MetaPhish_Combo_01 1331 0.81 1.08 0.76 166 SUBJ_ILLEGAL_CHARS 1329 0.16 1.07 0.00 167 RCVD_IN_RP_CERTIFIED 1329 4.40 1.07 4.98 168 TR_Mismatch_TLD_02 1307 0.19 1.06 0.04 169 XM_UB80 1300 0.17 1.05 0.01 170 SUBJ_DOLLARS 1205 0.39 0.97 0.28 171 XM_OfRef7 1203 0.23 0.97 0.10 172 XM_UB99 1187 0.14 0.96 0.00 173 XMPhish14 1186 0.45 0.96 0.37 174 XM_H_PHPOS_M 1180 0.25 0.95 0.13 175 XMMoneyMeta_00 1166 0.61 0.94 0.56 176 RCVD_IN_PSBL 1162 0.18 0.94 0.05 177 HTML_SHORT_LINK_IMG_3 1158 0.18 0.94 0.05 178 XM_ProductURIs 1134 0.52 0.92 0.46 179 XMNoVowels 1129 0.51 0.91 0.44 180 REMOVE_BEFORE_LINK 1128 0.33 0.91 0.23 181 XM_H_Undi_Recip 1091 0.29 0.88 0.19 182 XMBody_78 1091 0.35 0.88 0.25 183 PLING_QUERY 1049 0.32 0.85 0.23 184 T_Symld_Words_02 1032 0.40 0.83 0.32 185 URIBL_BLACK 1031 0.14 0.83 0.02 186 RELAYCOUNTRY_NL 1030 0.25 0.83 0.15 187 XM_H_Long_From02 1020 0.78 0.82 0.78 188 TR_XM_DK_Bayes1 1020 7.53 0.82 8.69 189 XMBrknScrpt_02 1018 0.52 0.82 0.46 190 XM_PDF 1009 2.72 0.82 3.06 191 DATE_IN_PAST_12_24 1002 10.86 0.81 12.61 192 XMBdyGiftCard01 996 0.71 0.80 0.69 193 HTTPS_HTTP_MISMATCH 991 0.68 0.80 0.66 194 XMSubMetaSxObfu_03 981 0.33 0.79 0.25 195 XM_XX_Yahoo 942 0.13 0.76 0.02 196 HELO_NODOT 922 1.13 0.74 1.19 197 HELO_NO_DOMAIN 921 1.13 0.74 1.19 198 XM_B_COPY_HTML 920 0.27 0.74 0.19 199 T_TooManySym_02 919 1.39 0.74 1.50 200 MPART_ALT_DIFF_COUNT 913 0.35 0.74 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 656187 92.65 95.07 92.23 2 RELAYCOUNTRY_US 622048 86.28 79.65 87.43 3 XM_B_Unicode 562185 78.54 75.82 79.02 4 DCC_CHECK_NEGATIVE 498648 62.32 17.70 70.09 5 DKIM_SIGNED 382771 57.91 81.52 53.80 6 XM_DK_Pass 375866 56.67 78.74 52.83 7 DKIM_VALID 357453 53.38 71.45 50.24 8 BAYES_50 348988 48.62 46.12 49.05 9 MIME_HTML_ONLY 304040 41.93 37.28 42.73 10 XM_B_Unicode3 271563 38.56 40.82 38.17 11 DKIM_VALID_AU 261755 39.28 53.59 36.79 12 XMListUnsubscribeExists 259417 41.21 68.47 36.46 13 MPART_ALT_DIFF 230611 28.46 5.74 32.41 14 MIME_HTML_ONLY_MULTI 220780 26.84 2.75 31.03 15 DCC_CHECK 201101 35.98 80.32 28.27 16 IN_ZIMBRA_NJ_WHITELIST 169292 20.27 0.02 23.79 17 BOTNET 160214 22.47 22.16 22.52 18 XM_H_Trusted_IP 159173 19.06 0.00 22.37 19 T_TM2_M_HEADER_IN_MSG 150309 21.00 20.25 21.13 20 BOTNET_NORDNS 145251 17.58 1.29 20.42 21 BAYES_00 134405 16.38 1.95 18.89 22 DKIM_VALID_EF 134305 20.63 30.70 18.88 23 HTML_FONT_LOW_CONTRAST 132802 20.30 29.67 18.67 24 LOC_TINY_FONT_1 115752 18.79 33.27 16.27 25 FVGT_m_MULTI_ODD 114161 17.82 28.02 16.05 26 XMSubLong 109138 16.67 24.31 15.34 27 T_KAM_HTML_FONT_INVALID 94790 15.15 25.63 13.32 28 DATE_IN_PAST_12_24 89702 10.86 0.81 12.61 29 RCVD_IN_MSPIKE_H2 77189 10.62 9.33 10.85 30 BAYES_20 72925 9.13 2.70 10.25 31 ALL_TRUSTED 70443 8.60 1.14 9.90 32 HTML_FONT_FACE_BAD 65146 7.88 0.55 9.16 33 TR_XM_DK_Bayes 64666 7.91 1.14 9.09 34 XMSubNoVowel 63515 7.71 0.70 8.93 35 TR_XM_DK_Bayes1 61844 7.53 0.82 8.69 36 XM_Multi_Part_URI 61129 9.96 17.85 8.59 37 XM_Body_Dirty_Words 60913 10.26 20.01 8.56 38 BAYES_40 55920 7.24 3.65 7.86 39 TR_XM_DK_Bayes2 55152 6.70 0.68 7.75 40 XM_B_Unsub 51771 8.12 12.97 7.28 41 RCVD_IN_MSPIKE_H3 49641 6.46 3.46 6.98 42 RCVD_IN_MSPIKE_WL 49641 6.46 3.46 6.98 43 UNPARSEABLE_RELAY 46615 6.34 5.12 6.55 44 TooManyTo_001 45833 6.41 6.19 6.44 45 LotsOfNums_01 45383 7.02 10.72 6.38 46 XM_Evil_Numbers_Gen 44149 6.81 10.29 6.21 47 LOTS_OF_MONEY 39921 6.57 12.09 5.61 48 RCVD_IN_RP_SAFE 39381 4.95 1.58 5.54 49 KHOP_HELO_FCRDNS 38954 5.35 4.62 5.48 50 XM_B_Phish_Phrases 38746 6.57 13.01 5.45 51 RCVD_IN_RP_CERTIFIED 35456 4.40 1.07 4.98 52 HTML_IMAGE_RATIO_02 35407 5.91 11.25 4.98 53 XM_SendGrid 35142 4.85 4.30 4.94 54 FSL_BULK_SIG 34532 6.41 15.33 4.85 55 BAYES_05 34479 4.36 1.59 4.85 56 XM_DK_Undo_02 34472 10.21 41.05 4.85 57 XM_DKIMWhitelistDomains 33762 4.05 0.03 4.75 58 HTML_OBFUSCATE_05_10 30636 3.70 0.23 4.31 59 MIME_QP_LONG_LINE 30530 4.41 5.07 4.29 60 DATE_IN_PAST_06_12 29743 3.72 1.10 4.18 61 RELAYCOUNTRY_META 28986 6.58 21.01 4.07 62 RCVD_IN_IADB_LISTED 28365 3.76 2.46 3.99 63 XM_H_Long_From01 28103 4.28 6.19 3.95 64 BAYES_60 27450 4.10 5.49 3.86 65 DATE_IN_PAST_24_48 26481 3.18 0.03 3.72 66 DKIM_INVALID 25318 4.52 10.07 3.56 67 HTML_IMAGE_RATIO_04 24555 3.80 5.82 3.45 68 RCVD_IN_IADB_SPF 24455 3.27 2.29 3.44 69 HTML_IMAGE_RATIO_08 24245 3.31 2.76 3.41 70 BOTNET_IPINHOSTNAME 23797 5.04 14.79 3.34 71 XM_PDF 21743 2.72 0.82 3.06 72 RCVD_IN_IADB_SENDERID 21267 2.88 2.24 2.99 73 T_TooManySym_01 21250 2.95 2.71 2.99 74 RCVD_IN_IADB_DK 20980 2.84 2.24 2.95 75 HTML_IMAGE_RATIO_06 20773 3.05 3.79 2.92 76 XMStrtUSub 20696 3.10 4.18 2.91 77 T_REMOTE_IMAGE 20418 3.29 5.71 2.87 78 TR_XM_DK_SendGrid 19829 2.68 2.07 2.79 79 NO_DNS_FOR_FROM 18205 3.41 8.33 2.56 80 RCVD_IN_IADB_VOUCHED 18123 2.27 0.67 2.55 81 XMNumbers 17023 2.79 5.10 2.39 82 XMSexyCombo_05 16819 3.45 9.69 2.36 83 XM_UncommonTLD01 16589 4.73 18.55 2.33 84 XMSubMetaSx_00 15469 2.91 7.11 2.17 85 BAYES_99 15258 5.93 27.70 2.14 86 FROM_EXCESS_BASE64 14598 2.20 3.07 2.05 87 MAILING_LIST_MULTI 14268 1.95 1.62 2.01 88 XM_B_COVIDMETA 14128 3.01 8.92 1.99 89 BAYES_80 13812 2.68 6.91 1.94 90 TM2_M_URI_OPT_OUT 13218 2.14 3.73 1.86 91 MIME_HTML_MOSTLY 12515 2.22 4.84 1.76 92 TooManyTo_002 12273 1.55 0.54 1.73 93 SUBJ_ALL_CAPS 11793 1.63 1.47 1.66 94 RCVD_IN_MSPIKE_BL 11553 2.42 7.01 1.62 95 ANY_BOUNCE_MESSAGE 11526 1.45 0.47 1.62 96 BOUNCE_MESSAGE 11519 1.45 0.46 1.62 97 RCVD_IN_MSPIKE_L3 11465 2.38 6.83 1.61 98 BAYES_999 11445 4.66 22.18 1.61 99 RCVD_IN_IADB_OPTIN 11361 1.42 0.43 1.60 100 HTML_MIME_NO_HTML_TAG 10979 1.58 1.81 1.54 101 XM_DK_Undo_01 10843 1.55 1.70 1.52 102 T_TooManySym_02 10661 1.39 0.74 1.50 103 TVD_RCVD_IP 10595 1.37 0.65 1.49 104 XM_CamelCaseFrm001 10513 2.34 7.28 1.48 105 XM_B_SpammyTLD 10319 1.74 3.41 1.45 106 XM_B_Unsub2 9406 1.59 3.14 1.32 107 UNTRUSTED_Relay 9007 3.04 13.21 1.27 108 T_XMDrugObfuBody_14 8999 1.38 2.07 1.26 109 XM_SPF_SoftFail 8710 1.79 5.06 1.22 110 TooManyTo_003 8670 1.10 0.42 1.22 111 RELAYCOUNTRY_CA 8584 1.87 5.70 1.21 112 HELO_NODOT 8484 1.13 0.74 1.19 113 HELO_NO_DOMAIN 8481 1.13 0.74 1.19 114 T_XMDrugObfuBody_08 8414 1.62 4.15 1.18 115 CK_HELO_DYNAMIC_SPLIT_IP 8265 1.02 0.18 1.16 116 HELO_DYNAMIC_IPADDR2 8257 1.00 0.08 1.16 117 BAYES_95 8227 1.56 3.90 1.16 118 XM_GoogleGroups 8132 1.04 0.45 1.14 119 IN_HORDE_ADDRESS_BOOK 7694 0.93 0.04 1.08 120 INVALID_MSGID 7611 0.96 0.31 1.07 121 XMDiploma_00 7526 1.23 2.22 1.06 122 DKIM_ADSP_CUSTOM_MED 7387 1.19 2.09 1.04 123 TO_MALFORMED 7283 0.87 0.01 1.02 124 TR_Symld_Words 6980 1.05 1.45 0.98 125 RCVD_IN_BL_SPAMCOP_NET 6925 1.50 4.54 0.97 126 TR_XM_PhishingBody 6825 1.32 3.40 0.96 127 XMCapTrack 6813 0.91 0.62 0.96 128 URI_HEX 6740 1.14 2.23 0.95 129 TooManyTo_004 6723 0.86 0.36 0.94 130 TR_DCC_Bayes_99 6498 4.04 22.00 0.91 131 TM2_M_VERY_LONG_WORD 6132 0.99 1.75 0.86 132 URI_TRY_3LD 6003 0.90 1.24 0.84 133 RELAYCOUNTRY_GB 5958 0.92 1.41 0.84 134 T_FILL_THIS_FORM_SHORT 5879 0.95 1.67 0.83 135 FUZZY_CREDIT 5875 0.72 0.08 0.83 136 TooManyTo_005 5776 0.74 0.29 0.81 137 XM_H_Long_From02 5532 0.78 0.82 0.78 138 XM_UB50 5468 1.82 7.89 0.77 139 NML_ADSP_CUSTOM_MED 5424 0.93 1.92 0.76 140 TR_MetaPhish_Combo_01 5409 0.81 1.08 0.76 141 TR_XM_PHPDW 5357 0.99 2.33 0.75 142 USER_IN_DEF_DKIM_WL 5310 0.64 0.00 0.75 143 TR_XM_FormFill2 5281 0.97 2.28 0.74 144 TR_XM_PHPForged 5279 0.97 2.29 0.74 145 XM_H_PHPOS 5256 0.97 2.27 0.74 146 XMGenDplmaNmb 5034 0.83 1.52 0.71 147 XMGappySubj_01 4998 0.63 0.20 0.70 148 XMBdyGiftCard01 4934 0.71 0.80 0.69 149 XM_OfRef6 4885 1.00 2.77 0.69 150 HTTPS_HTTP_MISMATCH 4700 0.68 0.80 0.66 151 T_XMHurry_00 4431 0.80 1.85 0.62 152 XMSubLongNoVowel 4261 0.52 0.07 0.60 153 SpammyFromTLD_01 4017 0.89 2.79 0.56 154 XMMoneyMeta_00 3968 0.61 0.94 0.56 155 XMHTML_After_End 3916 0.74 1.81 0.55 156 TR_MSPIKEBAYES00 3911 0.47 0.00 0.55 157 TO_NO_BRKTS_HTML_ONLY 3884 0.50 0.23 0.55 158 XMStockSpam_06 3684 0.67 1.58 0.52 159 XM_DIRTYINTL 3586 0.88 3.02 0.50 160 RELAYCOUNTRY_DE 3359 0.70 2.04 0.47 161 MISSING_HEADERS 3324 0.46 0.40 0.47 162 XMBrknScrpt_02 3286 0.52 0.82 0.46 163 XM_ProductURIs 3242 0.52 0.92 0.46 164 FORGED_GMAIL_RCVD 3195 0.67 1.93 0.45 165 XMSubMetaI_00 3188 0.55 1.10 0.45 166 T_TooManySym_03 3124 0.43 0.39 0.44 167 XMNoVowels 3114 0.51 0.91 0.44 168 XM_SPF_Unknown 3038 0.47 0.69 0.43 169 RCVD_IN_SORBS_DUL 3002 0.37 0.10 0.42 170 PDS_OTHER_BAD_TLD 2998 0.92 3.77 0.42 171 T_XMDrugObfuBody_00 2942 0.52 1.11 0.41 172 T_OBFU_PDF_ATTACH 2882 0.37 0.19 0.41 173 XM_H_PHPMailer 2840 0.52 1.19 0.40 174 XMBody_17 2802 0.75 2.77 0.39 175 XM_ShortIntro_01 2780 0.41 0.50 0.39 176 FROM_GOV_DKIM_AU 2754 0.36 0.21 0.39 177 XMBody_29 2729 0.38 0.38 0.38 178 XMHTMLBadTable_001 2727 0.43 0.68 0.38 179 TR_LOTS_OF_MONEY3 2726 0.60 1.84 0.38 180 XMSexyCombo_01 2694 0.68 2.43 0.38 181 XMSubMetaSxObfu_02 2656 0.37 0.35 0.37 182 XMPhish14 2604 0.45 0.96 0.37 183 URI_NOVOWEL 2538 0.41 0.70 0.36 184 HTML_IMAGE_ONLY_20 2506 0.47 1.13 0.35 185 HTML_TAG_BALANCE_BODY 2381 0.39 0.70 0.33 186 T_Symld_Words_02 2306 0.40 0.83 0.32 187 HTML_IMAGE_ONLY_32 2305 0.30 0.19 0.32 188 FROM_GOV_SPOOF 2270 0.32 0.31 0.32 189 RELAYCOUNTRY_AU 2266 0.37 0.66 0.32 190 DIET_1 2233 0.36 0.65 0.31 191 TM2_M_BODY_EMPTY 2145 0.27 0.09 0.30 192 XMPhish08 2112 0.44 1.23 0.30 193 AC_DIV_BONANZA 2060 0.26 0.08 0.29 194 XM_B_REG_HTML 2046 0.28 0.25 0.29 195 HTML_IMAGE_ONLY_28 2040 0.31 0.47 0.29 196 SUBJ_DOLLARS 2025 0.39 0.97 0.28 197 MPART_ALT_DIFF_COUNT 2004 0.35 0.74 0.28 198 XMPhish30 1975 0.42 1.24 0.28 199 RDNS_DYNAMIC 1919 0.60 2.47 0.27 200 SHORT_HELO_AND_INLINE_IMAGE 1910 0.23 0.04 0.27 ----------------------------------------------------------------------