Email: 722747 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 2.14 sec Spam: 138396 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 3.96 sec Ham: 584351 Autolearn: 0 AvgScore: -3.40 AvgScanTime: 1.71 sec Time Spent Running SA: 430.41 hours Time Spent Processing Spam: 152.24 hours Time Spent Processing Ham: 278.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133261 91.40 96.29 90.24 2 DKIM_SIGNED 115696 67.90 83.60 64.19 3 DCC_CHECK 112532 44.77 81.31 36.12 4 XM_DK_Pass 112455 66.55 81.26 63.07 5 RELAYCOUNTRY_US 110954 83.28 80.17 84.02 6 XM_B_Unicode 106662 75.11 77.07 74.65 7 XMListUnsubscribeExists 99584 48.27 71.96 42.65 8 DKIM_VALID 95307 60.98 68.87 59.11 9 DKIM_VALID_AU 73258 46.14 52.93 44.53 10 XM_DK_Undo_02 59624 12.95 43.08 5.81 11 BAYES_50 59243 45.02 42.81 45.54 12 XM_B_Unicode3 57593 44.22 41.61 44.84 13 MIME_HTML_ONLY 57194 27.11 41.33 23.75 14 LOC_TINY_FONT_1 45197 22.58 32.66 20.19 15 DKIM_VALID_EF 43405 23.94 31.36 22.18 16 HTML_FONT_LOW_CONTRAST 38535 24.94 27.84 24.25 17 BAYES_99 38449 7.53 27.78 2.73 18 T_KAM_HTML_FONT_INVALID 38212 17.69 27.61 15.34 19 FVGT_m_MULTI_ODD 34496 20.60 24.93 19.57 20 XMSubLong 32080 20.76 23.18 20.19 21 TR_DCC_Bayes_99 31426 5.41 22.71 1.31 22 BOTNET 30803 6.24 22.26 2.45 23 T_TM2_M_HEADER_IN_MSG 30052 24.76 21.71 25.49 24 BAYES_999 29313 5.79 21.18 2.15 25 RELAYCOUNTRY_META 28499 7.80 20.59 4.77 26 XM_Body_Dirty_Words 26332 12.71 19.03 11.21 27 XM_Multi_Part_URI 25393 11.89 18.35 10.36 28 XM_UncommonTLD01 25070 6.04 18.11 3.18 29 DCC_CHECK_NEGATIVE 23690 53.48 17.12 62.09 30 DKIM_INVALID 20389 6.92 14.73 5.08 31 BOTNET_IPINHOSTNAME 20078 6.05 14.51 4.05 32 LOTS_OF_MONEY 19853 8.79 14.35 7.48 33 UNTRUSTED_Relay 18799 3.82 13.58 1.51 34 FSL_BULK_SIG 18691 9.33 13.51 8.35 35 XM_B_Phish_Phrases 18384 8.00 13.28 6.75 36 XM_B_Unsub 17204 9.75 12.43 9.12 37 HTML_IMAGE_RATIO_02 15358 6.89 11.10 5.89 38 NO_DNS_FOR_FROM 15173 4.60 10.96 3.09 39 XM_CamelCaseFrm001 14299 3.60 10.33 2.01 40 XM_Evil_Numbers_Gen 14040 8.97 10.14 8.69 41 XMSexyCombo_05 13557 4.49 9.80 3.24 42 RCVD_IN_MSPIKE_H2 13366 12.09 9.66 12.67 43 LotsOfNums_01 12043 7.42 8.70 7.12 44 XM_B_COVIDMETA 12002 3.13 8.67 1.82 45 XM_UB50 11390 2.33 8.23 0.94 46 URIBL_SBL_A 11146 1.72 8.05 0.22 47 BAYES_80 11024 3.36 7.97 2.27 48 RCVD_IN_MSPIKE_BL 9469 2.69 6.84 1.70 49 TR_XM_COVIDMETA4 9128 2.49 6.60 1.51 50 XMBody_17 9085 1.72 6.56 0.57 51 BAYES_60 8941 4.91 6.46 4.54 52 RCVD_IN_MSPIKE_L3 8842 2.58 6.39 1.67 53 T_XMDrugObfuBody_08 8746 2.22 6.32 1.25 54 MPART_ALT_DIFF 8725 10.12 6.30 11.02 55 XM_H_Long_From01 8595 5.34 6.21 5.13 56 HTML_IMAGE_RATIO_04 8184 14.94 5.91 17.08 57 RELAYCOUNTRY_CA 8008 2.25 5.79 1.41 58 XMSubMetaSx_00 8003 3.23 5.78 2.63 59 KHOP_HELO_FCRDNS 7968 2.57 5.76 1.81 60 TR_XM_MaxBayes 7704 1.09 5.57 0.03 61 TooManyTo_001 7411 7.28 5.35 7.74 62 MIME_QP_LONG_LINE 6834 4.78 4.94 4.75 63 UNPARSEABLE_RELAY 6821 6.03 4.93 6.29 64 XM_SPF_SoftFail 6286 2.07 4.54 1.48 65 BAYES_95 6224 1.97 4.50 1.37 66 XM_SendGrid 5772 5.40 4.17 5.69 67 MIME_HTML_MOSTLY 5762 2.78 4.16 2.46 68 TR_LOTS_OF_MONEY3 5728 1.16 4.14 0.46 69 XMStrtUSub 5540 8.76 4.00 9.88 70 RDNS_DYNAMIC 5415 0.99 3.91 0.30 71 SpammyFromTLD_02 5214 0.90 3.77 0.22 72 T_REMOTE_IMAGE 5018 3.47 3.63 3.44 73 FROM_EXCESS_BASE64 4989 2.75 3.60 2.54 74 XM_B_SpammyTLD 4986 2.07 3.60 1.71 75 XMNumbers 4965 2.92 3.59 2.76 76 BAYES_40 4823 5.77 3.48 6.31 77 SpammyFromTLD_01 4819 1.26 3.48 0.74 78 RCVD_IN_BL_SPAMCOP_NET 4751 1.30 3.43 0.79 79 PDS_OTHER_BAD_TLD 4688 1.05 3.39 0.49 80 HTML_IMAGE_RATIO_06 4687 4.81 3.39 5.15 81 XMHTML_After_End 4620 1.17 3.34 0.66 82 HTML_MIME_NO_HTML_TAG 4578 2.21 3.31 1.95 83 RELAYCOUNTRY_FR 4477 0.82 3.23 0.24 84 TR_XM_PhishingBody 4236 1.44 3.06 1.06 85 XM_DIRTYINTL 4209 0.94 3.04 0.45 86 DATE_IN_PAST_03_06 4193 0.73 3.03 0.18 87 BAYES_20 4177 5.92 3.02 6.61 88 LongTLD 4172 0.70 3.01 0.16 89 TM2_M_URI_OPT_OUT 4091 3.62 2.96 3.78 90 URI_TRY_3LD 3867 1.38 2.79 1.04 91 MIME_HTML_ONLY_MULTI 3822 7.84 2.76 9.05 92 XM_OfRef6 3806 1.30 2.75 0.96 93 HTML_SHORT_LINK_IMG_1 3761 0.53 2.72 0.02 94 XM_URI_RBL 3751 0.65 2.71 0.16 95 TR_XM_INV_DKIM 3695 0.57 2.67 0.08 96 RCVD_IN_RP_RNBL 3666 0.56 2.65 0.07 97 RCVD_IN_MSPIKE_H3 3661 7.15 2.65 8.22 98 RCVD_IN_MSPIKE_WL 3661 7.15 2.65 8.22 99 XMDiploma_00 3657 1.42 2.64 1.13 100 FROM_SUSPICIOUS_NTLD 3653 0.55 2.64 0.05 101 XM_B_Unsub2 3634 1.64 2.63 1.40 102 FROM_SUSPICIOUS_NTLD_FP 3573 0.53 2.58 0.05 103 HTML_IMAGE_RATIO_08 3467 2.12 2.51 2.03 104 URI_HEX 3271 1.45 2.36 1.23 105 T_TooManySym_01 3228 3.66 2.33 3.98 106 BAYES_00 3027 20.90 2.19 25.33 107 RELAYCOUNTRY_DE 2872 0.70 2.08 0.38 108 BODY_URI_ONLY 2797 0.47 2.02 0.11 109 DATE_IN_PAST_06_12 2783 0.50 2.01 0.15 110 T_XMHurry_00 2748 0.72 1.99 0.42 111 RCVD_IN_IADB_LISTED 2743 3.76 1.98 4.18 112 TR_XM_PHPDW 2623 0.74 1.90 0.47 113 TR_XM_DK_SendGrid 2598 3.00 1.88 3.27 114 TR_XM_PHPForged 2558 0.72 1.85 0.46 115 TR_XM_FormFill2 2534 0.72 1.83 0.46 116 RCVD_IN_IADB_SPF 2528 3.31 1.83 3.66 117 XM_H_PHPOS 2527 0.71 1.83 0.45 118 BAYES_05 2481 4.63 1.79 5.30 119 TM2_M_VERY_LONG_WORD 2475 1.28 1.79 1.15 120 RCVD_IN_IADB_DK 2474 2.92 1.79 3.19 121 RCVD_IN_IADB_SENDERID 2465 2.93 1.78 3.20 122 MIME_HEADER_CTYPE_ONLY 2454 0.53 1.77 0.23 123 FROM_MISSP_REPLYTO 2411 0.34 1.74 0.01 124 HDRS_LCASE_IMGONLY 2393 0.34 1.73 0.01 125 XMSexyCombo_01 2342 0.68 1.69 0.44 126 T_FILL_THIS_FORM_SHORT 2334 1.25 1.69 1.14 127 TR_XM_DK_Bayes 2320 9.99 1.68 11.96 128 TR_Mismatch_TLD_01 2268 0.42 1.64 0.13 129 HTML_IMAGE_ONLY_04 2186 0.36 1.58 0.07 130 DKIM_ADSP_NXDOMAIN 2173 0.68 1.57 0.47 131 TR_XM_RelayPhish 2152 0.37 1.55 0.09 132 T_XMDrugObfuBody_14 2136 1.37 1.54 1.33 133 NO_FM_NAME_IP_HOSTN 2123 0.29 1.53 0.00 134 TR_XM_MaxSPIKE 2120 0.37 1.53 0.10 135 BOTNET_NORDNS 2107 0.30 1.52 0.01 136 XMStockSpam_06 2038 1.15 1.47 1.07 137 XMBrknScrpt_02 2004 0.69 1.45 0.52 138 XM_DK_Undo_01 1956 1.65 1.41 1.71 139 RCVD_IN_RP_SAFE 1943 5.95 1.40 7.03 140 T_XMDrugObfuBody_00 1942 0.76 1.40 0.61 141 RELAYCOUNTRY_IN 1932 0.33 1.40 0.08 142 MAILING_LIST_MULTI 1918 2.24 1.39 2.45 143 XMSubMetaI_00 1908 0.65 1.38 0.48 144 XMGenDplmaNmb 1906 0.81 1.38 0.68 145 XM_UB60 1858 0.30 1.34 0.05 146 TR_Mismatch_TLD_02 1853 0.34 1.34 0.10 147 HTML_IMAGE_ONLY_08 1822 0.35 1.32 0.12 148 TR_Symld_Words 1754 1.23 1.27 1.22 149 REPLYTO_WITHOUT_TO_CC 1717 0.29 1.24 0.07 150 SHORT_URI_2 1668 0.25 1.21 0.02 151 XMBdyGiftCard01 1655 1.12 1.20 1.11 152 HTTPS_HTTP_MISMATCH 1636 0.85 1.18 0.78 153 TO_MALFORMED 1634 1.22 1.18 1.23 154 SHORT_SHORTNER 1611 0.24 1.16 0.02 155 XMMoneyMeta_00 1594 0.69 1.15 0.58 156 RELAYCOUNTRY_GB 1586 1.05 1.15 1.02 157 XMPhish30 1577 0.48 1.14 0.33 158 SUBJ_ALL_CAPS 1534 1.19 1.11 1.21 159 RCVD_IN_PSBL 1493 0.25 1.08 0.06 160 XMBody_78 1483 0.51 1.07 0.38 161 SUBJECT_NEEDS_ENCODING 1478 0.21 1.07 0.00 162 SUBJ_ILLEGAL_CHARS 1475 0.21 1.07 0.00 163 TR_MetaPhish_Combo_01 1456 0.78 1.05 0.72 164 TR_XM_DK_Bayes1 1446 9.17 1.04 11.10 165 TR_XM_COVIDMETA1 1426 0.33 1.03 0.17 166 XM_H_MailChimp 1411 0.31 1.02 0.14 167 TR_XM_COVIDMETA3 1408 0.22 1.02 0.03 168 XMPhish08 1408 0.49 1.02 0.36 169 XM_UB80 1359 0.20 0.98 0.01 170 RCVD_IN_RP_CERTIFIED 1343 5.38 0.97 6.42 171 HDRS_MISSP 1332 0.22 0.96 0.05 172 HTML_FONT_SIZE_HUGE 1322 0.27 0.96 0.11 173 TO_EQ_FM_DOM_HTML_IMG 1322 0.19 0.96 0.01 174 HTML_SHORT_CENTER 1318 0.18 0.95 0.00 175 XM_UB99 1277 0.18 0.92 0.00 176 MPART_ALT_DIFF_COUNT 1276 0.47 0.92 0.36 177 XM_ProductURIs 1272 0.73 0.92 0.68 178 XM_H_Long_From02 1267 1.06 0.92 1.09 179 XMSubMetaSxObfu_03 1259 0.48 0.91 0.38 180 XM_H_PHPMailer 1253 0.56 0.91 0.47 181 XMPhish14 1242 0.46 0.90 0.35 182 REMOVE_BEFORE_LINK 1222 0.40 0.88 0.28 183 ALL_TRUSTED 1220 10.55 0.88 12.83 184 DIET_1 1215 0.40 0.88 0.29 185 XM_OfRef7 1207 0.27 0.87 0.13 186 XMSlimDrugH 1203 0.38 0.87 0.27 187 XM_NotFromAmazon 1194 0.19 0.86 0.02 188 DKIM_ADSP_CUSTOM_MED 1176 1.07 0.85 1.13 189 TR_XM_DK_Bayes2 1157 8.06 0.84 9.77 190 HTML_TAG_BALANCE_BODY 1119 0.42 0.81 0.32 191 T_MONEY_PERCENT 1117 0.45 0.81 0.37 192 SHORT_URI_3 1117 0.19 0.81 0.05 193 TR_LOTS_OF_MONEY2 1117 0.45 0.81 0.37 194 DKIM_ADSP_ALL 1089 0.18 0.79 0.04 195 URIBL_ABUSE_SURBL 1071 0.20 0.77 0.06 196 T_TooManySym_02 1060 1.80 0.77 2.04 197 TVD_RCVD_IP 1045 1.43 0.76 1.59 198 SUBJ_DOLLARS 1035 0.41 0.75 0.33 199 XM_H_PHPOS_M 1022 0.28 0.74 0.18 200 RELAYCOUNTRY_JP 1010 0.16 0.73 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 527296 91.40 96.29 90.24 2 RELAYCOUNTRY_US 490963 83.28 80.17 84.02 3 XM_B_Unicode 436218 75.11 77.07 74.65 4 DKIM_SIGNED 375069 67.90 83.60 64.19 5 XM_DK_Pass 368553 66.55 81.26 63.07 6 DCC_CHECK_NEGATIVE 362851 53.48 17.12 62.09 7 DKIM_VALID 345409 60.98 68.87 59.11 8 BAYES_50 266133 45.02 42.81 45.54 9 XM_B_Unicode3 262016 44.22 41.61 44.84 10 DKIM_VALID_AU 260224 46.14 52.93 44.53 11 XMListUnsubscribeExists 249251 48.27 71.96 42.65 12 DCC_CHECK 211046 44.77 81.31 36.12 13 T_TM2_M_HEADER_IN_MSG 148930 24.76 21.71 25.49 14 BAYES_00 148020 20.90 2.19 25.33 15 HTML_FONT_LOW_CONTRAST 141719 24.94 27.84 24.25 16 MIME_HTML_ONLY 138766 27.11 41.33 23.75 17 DKIM_VALID_EF 129625 23.94 31.36 22.18 18 LOC_TINY_FONT_1 117988 22.58 32.66 20.19 19 XMSubLong 117987 20.76 23.18 20.19 20 FVGT_m_MULTI_ODD 114382 20.60 24.93 19.57 21 HTML_IMAGE_RATIO_04 99825 14.94 5.91 17.08 22 XM_H_Trusted_IP 94478 13.07 0.00 16.17 23 HTML_FONT_FACE_BAD 90100 12.60 0.69 15.42 24 T_KAM_HTML_FONT_INVALID 89611 17.69 27.61 15.34 25 ALL_TRUSTED 74996 10.55 0.88 12.83 26 RCVD_IN_MSPIKE_H2 74022 12.09 9.66 12.67 27 TR_XM_DK_Bayes 69873 9.99 1.68 11.96 28 XM_Body_Dirty_Words 65501 12.71 19.03 11.21 29 TR_XM_DK_Bayes1 64858 9.17 1.04 11.10 30 MPART_ALT_DIFF 64403 10.12 6.30 11.02 31 XM_Multi_Part_URI 60557 11.89 18.35 10.36 32 XMStrtUSub 57753 8.76 4.00 9.88 33 TR_XM_DK_Bayes2 57096 8.06 0.84 9.77 34 XM_B_Unsub 53292 9.75 12.43 9.12 35 MIME_HTML_ONLY_MULTI 52877 7.84 2.76 9.05 36 XM_Evil_Numbers_Gen 50770 8.97 10.14 8.69 37 FSL_BULK_SIG 48768 9.33 13.51 8.35 38 RCVD_IN_MSPIKE_WL 48049 7.15 2.65 8.22 39 RCVD_IN_MSPIKE_H3 48049 7.15 2.65 8.22 40 TooManyTo_001 45235 7.28 5.35 7.74 41 LOTS_OF_MONEY 43707 8.79 14.35 7.48 42 LotsOfNums_01 41589 7.42 8.70 7.12 43 RCVD_IN_RP_SAFE 41053 5.95 1.40 7.03 44 XM_B_Phish_Phrases 39426 8.00 13.28 6.75 45 BAYES_20 38625 5.92 3.02 6.61 46 RCVD_IN_RP_CERTIFIED 37515 5.38 0.97 6.42 47 BAYES_40 36858 5.77 3.48 6.31 48 UNPARSEABLE_RELAY 36770 6.03 4.93 6.29 49 XMSubNoVowel 35014 4.97 0.66 5.99 50 HTML_IMAGE_RATIO_02 34441 6.89 11.10 5.89 51 XM_DKIMWhitelistDomains 34395 4.77 0.06 5.89 52 XM_DK_Undo_02 33972 12.95 43.08 5.81 53 XM_SendGrid 33261 5.40 4.17 5.69 54 BAYES_05 30973 4.63 1.79 5.30 55 HTML_IMAGE_RATIO_06 30071 4.81 3.39 5.15 56 XM_H_Long_From01 29968 5.34 6.21 5.13 57 DKIM_INVALID 29660 6.92 14.73 5.08 58 RELAYCOUNTRY_META 27854 7.80 20.59 4.77 59 MIME_QP_LONG_LINE 27742 4.78 4.94 4.75 60 BAYES_60 26521 4.91 6.46 4.54 61 RCVD_IN_IADB_LISTED 24445 3.76 1.98 4.18 62 BOTNET_IPINHOSTNAME 23642 6.05 14.51 4.05 63 T_TooManySym_01 23228 3.66 2.33 3.98 64 TM2_M_URI_OPT_OUT 22078 3.62 2.96 3.78 65 XM_PDF 21500 3.11 0.73 3.68 66 RCVD_IN_IADB_SPF 21376 3.31 1.83 3.66 67 ANY_BOUNCE_MESSAGE 20889 2.97 0.42 3.57 68 BOUNCE_MESSAGE 20879 2.97 0.42 3.57 69 T_REMOTE_IMAGE 20074 3.47 3.63 3.44 70 TR_XM_DK_SendGrid 19080 3.00 1.88 3.27 71 XMSexyCombo_05 18921 4.49 9.80 3.24 72 RCVD_IN_IADB_SENDERID 18683 2.93 1.78 3.20 73 RCVD_IN_IADB_DK 18652 2.92 1.79 3.19 74 XM_UncommonTLD01 18588 6.04 18.11 3.18 75 NO_DNS_FOR_FROM 18063 4.60 10.96 3.09 76 IN_ZIMBRA_NJ_WHITELIST 17001 2.36 0.02 2.91 77 XMNumbers 16116 2.92 3.59 2.76 78 BAYES_99 15974 7.53 27.78 2.73 79 XMSubMetaSx_00 15365 3.23 5.78 2.63 80 RCVD_IN_IADB_VOUCHED 15087 2.20 0.61 2.58 81 FROM_EXCESS_BASE64 14852 2.75 3.60 2.54 82 MIME_HTML_MOSTLY 14355 2.78 4.16 2.46 83 BOTNET 14307 6.24 22.26 2.45 84 MAILING_LIST_MULTI 14295 2.24 1.39 2.45 85 XMSubLongNoVowel 13574 1.89 0.07 2.32 86 XMSubGarbage 13426 1.86 0.02 2.30 87 BAYES_80 13241 3.36 7.97 2.27 88 BAYES_999 12535 5.79 21.18 2.15 89 TooManyTo_002 12261 1.81 0.57 2.10 90 T_TooManySym_02 11921 1.80 0.77 2.04 91 HTML_IMAGE_RATIO_08 11871 2.12 2.51 2.03 92 XM_CamelCaseFrm001 11724 3.60 10.33 2.01 93 HTML_MIME_NO_HTML_TAG 11411 2.21 3.31 1.95 94 XM_B_COVIDMETA 10645 3.13 8.67 1.82 95 KHOP_HELO_FCRDNS 10575 2.57 5.76 1.81 96 XM_B_SpammyTLD 9984 2.07 3.60 1.71 97 XM_DK_Undo_01 9968 1.65 1.41 1.71 98 RCVD_IN_MSPIKE_BL 9951 2.69 6.84 1.70 99 RCVD_IN_MSPIKE_L3 9778 2.58 6.39 1.67 100 RCVD_IN_IADB_OPTIN 9431 1.38 0.38 1.61 101 TVD_RCVD_IP 9283 1.43 0.76 1.59 102 TR_XM_COVIDMETA4 8845 2.49 6.60 1.51 103 UNTRUSTED_Relay 8829 3.82 13.58 1.51 104 XM_SPF_SoftFail 8655 2.07 4.54 1.48 105 HELO_NODOT 8612 1.31 0.60 1.47 106 HELO_NO_DOMAIN 8611 1.31 0.60 1.47 107 TooManyTo_003 8438 1.25 0.44 1.44 108 RELAYCOUNTRY_CA 8258 2.25 5.79 1.41 109 XM_B_Unsub2 8189 1.64 2.63 1.40 110 BAYES_95 8005 1.97 4.50 1.37 111 IN_HORDE_ADDRESS_BOOK 8005 1.12 0.05 1.37 112 T_XMDrugObfuBody_14 7794 1.37 1.54 1.33 113 TR_DCC_Bayes_99 7659 5.41 22.71 1.31 114 INVALID_MSGID 7633 1.10 0.24 1.31 115 CK_HELO_DYNAMIC_SPLIT_IP 7379 1.04 0.10 1.26 116 HELO_DYNAMIC_IPADDR2 7351 1.03 0.06 1.26 117 XM_GoogleGroups 7312 1.13 0.60 1.25 118 T_XMDrugObfuBody_08 7309 2.22 6.32 1.25 119 URI_HEX 7210 1.45 2.36 1.23 120 XM_E_Blogspot 7189 1.01 0.08 1.23 121 TO_MALFORMED 7169 1.22 1.18 1.23 122 TR_Symld_Words 7135 1.23 1.27 1.22 123 SUBJ_ALL_CAPS 7051 1.19 1.11 1.21 124 XMCapTrack 6751 1.04 0.54 1.16 125 TM2_M_VERY_LONG_WORD 6747 1.28 1.79 1.15 126 T_FILL_THIS_FORM_SHORT 6666 1.25 1.69 1.14 127 XMDiploma_00 6595 1.42 2.64 1.13 128 DKIM_ADSP_CUSTOM_MED 6581 1.07 0.85 1.13 129 TooManyTo_004 6521 0.97 0.35 1.12 130 XMBdyGiftCard01 6461 1.12 1.20 1.11 131 XM_H_Long_From02 6395 1.06 0.92 1.09 132 XMStockSpam_06 6252 1.15 1.47 1.07 133 TR_XM_PhishingBody 6206 1.44 3.06 1.06 134 URI_TRY_3LD 6087 1.38 2.79 1.04 135 RELAYCOUNTRY_GB 5969 1.05 1.15 1.02 136 XM_OfRef6 5603 1.30 2.75 0.96 137 TooManyTo_005 5534 0.82 0.29 0.95 138 XM_UB50 5486 2.33 8.23 0.94 139 USER_IN_DEF_DKIM_WL 5072 0.70 0.00 0.87 140 NML_ADSP_CUSTOM_MED 4982 0.82 0.70 0.85 141 XMGappySubj_01 4738 0.68 0.15 0.81 142 RCVD_IN_BL_SPAMCOP_NET 4643 1.30 3.43 0.79 143 TR_MSPIKEBAYES00 4554 0.63 0.00 0.78 144 HTTPS_HTTP_MISMATCH 4537 0.85 1.18 0.78 145 SpammyFromTLD_01 4313 1.26 3.48 0.74 146 TR_MetaPhish_Combo_01 4211 0.78 1.05 0.72 147 XM_ProductURIs 3979 0.73 0.92 0.68 148 XMGenDplmaNmb 3978 0.81 1.38 0.68 149 XMSolicitRefs_0 3883 0.60 0.31 0.66 150 XMHTML_After_End 3864 1.17 3.34 0.66 151 T_TooManySym_03 3622 0.55 0.23 0.62 152 T_XMDrugObfuBody_00 3576 0.76 1.40 0.61 153 XMMoneyMeta_00 3403 0.69 1.15 0.58 154 XMBody_17 3355 1.72 6.56 0.57 155 XM_RXBody 3264 0.51 0.32 0.56 156 XMBrknScrpt_02 3011 0.69 1.45 0.52 157 PDS_OTHER_BAD_TLD 2874 1.05 3.39 0.49 158 XM_SPF_Unknown 2868 0.52 0.66 0.49 159 XMNoVowels 2849 0.49 0.50 0.49 160 FROM_GOV_DKIM_AU 2846 0.42 0.13 0.49 161 XMSubMetaI_00 2800 0.65 1.38 0.48 162 MISSING_HEADERS 2790 0.47 0.43 0.48 163 RCVD_IN_SORBS_DUL 2790 0.40 0.08 0.48 164 T_Symld_Words_02 2780 0.50 0.62 0.48 165 T_OBFU_PDF_ATTACH 2774 0.42 0.16 0.47 166 XM_H_PHPMailer 2766 0.56 0.91 0.47 167 DKIM_ADSP_NXDOMAIN 2757 0.68 1.57 0.47 168 TR_XM_PHPDW 2736 0.74 1.90 0.47 169 HTML_IMAGE_ONLY_20 2690 0.43 0.31 0.46 170 TR_XM_PHPForged 2675 0.72 1.85 0.46 171 TR_XM_FormFill2 2662 0.72 1.83 0.46 172 MY_SERVERS_FOUND 2660 0.39 0.12 0.46 173 TR_LOTS_OF_MONEY3 2659 1.16 4.14 0.46 174 XM_ShortIntro_01 2659 0.42 0.28 0.46 175 XM_H_PHPOS 2630 0.71 1.83 0.45 176 FORGED_GMAIL_RCVD 2627 0.50 0.70 0.45 177 XM_DIRTYINTL 2615 0.94 3.04 0.45 178 FROM_GOV_SPOOF 2608 0.39 0.17 0.45 179 XMSexyCombo_01 2577 0.68 1.69 0.44 180 T_XMHurry_00 2472 0.72 1.99 0.42 181 XMHTMLBadTable_001 2448 0.45 0.59 0.42 182 XM_B_REG_HTML 2401 0.40 0.37 0.41 183 RELAYCOUNTRY_AU 2293 0.45 0.67 0.39 184 XMSubMetaSxObfu_03 2228 0.48 0.91 0.38 185 XMBody_78 2226 0.51 1.07 0.38 186 RELAYCOUNTRY_DE 2206 0.70 2.08 0.38 187 XMLngstWrd_00 2198 0.39 0.47 0.38 188 SHORT_HELO_AND_INLINE_IMAGE 2186 0.31 0.03 0.37 189 HTML_IMAGE_ONLY_28 2145 0.37 0.41 0.37 190 T_MONEY_PERCENT 2138 0.45 0.81 0.37 191 TR_LOTS_OF_MONEY2 2138 0.45 0.81 0.37 192 TM2_M_BODY_EMPTY 2118 0.31 0.10 0.36 193 MPART_ALT_DIFF_COUNT 2117 0.47 0.92 0.36 194 XMPhish08 2099 0.49 1.02 0.36 195 XMPhish14 2057 0.46 0.90 0.35 196 XMLKML 2026 0.28 0.00 0.35 197 MSGID_FROM_MTA_HEADER 2020 0.31 0.16 0.35 198 HTML_IMAGE_ONLY_32 2003 0.34 0.33 0.34 199 XMLngstWrd_01 1938 0.35 0.43 0.33 200 SUBJ_DOLLARS 1935 0.41 0.75 0.33 ----------------------------------------------------------------------