Email: 643116 Autolearn: 0 AvgScore: 1.49 AvgScanTime: 1.87 sec Spam: 129965 Autolearn: 0 AvgScore: 12.56 AvgScanTime: 3.11 sec Ham: 513151 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 1.56 sec Time Spent Running SA: 334.13 hours Time Spent Processing Spam: 112.26 hours Time Spent Processing Ham: 221.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123967 90.06 95.38 88.71 2 DKIM_SIGNED 103772 72.42 79.85 70.54 3 DCC_CHECK 102956 45.66 79.22 37.16 4 RELAYCOUNTRY_US 102506 81.03 78.87 81.58 5 XM_DK_Pass 101053 71.03 77.75 69.33 6 XM_B_Unicode 96003 70.71 73.87 69.91 7 XMListUnsubscribeExists 90985 51.39 70.01 46.67 8 DKIM_VALID 88545 66.06 68.13 65.53 9 DKIM_VALID_AU 67134 48.92 51.66 48.23 10 BAYES_50 55735 49.98 42.88 51.78 11 XM_DK_Undo_02 54538 13.41 41.96 6.18 12 MIME_HTML_ONLY 52747 27.70 40.59 24.44 13 XM_B_Unicode3 52403 38.34 40.32 37.84 14 LOC_TINY_FONT_1 40393 26.96 31.08 25.91 15 DKIM_VALID_EF 38451 26.51 29.59 25.73 16 HTML_FONT_LOW_CONTRAST 37396 26.64 28.77 26.10 17 BAYES_99 36208 8.20 27.86 3.22 18 T_KAM_HTML_FONT_INVALID 34902 19.38 26.85 17.49 19 FVGT_m_MULTI_ODD 31814 21.64 24.48 20.92 20 XMSubLong 29911 20.93 23.01 20.40 21 TR_DCC_Bayes_99 29173 5.66 22.45 1.41 22 RELAYCOUNTRY_META 28872 8.74 22.22 5.33 23 BOTNET 28624 6.55 22.02 2.64 24 BAYES_999 28038 6.39 21.57 2.54 25 T_TM2_M_HEADER_IN_MSG 26125 27.04 20.10 28.79 26 DCC_CHECK_NEGATIVE 24758 52.43 19.05 60.89 27 XM_Body_Dirty_Words 24017 13.06 18.48 11.68 28 XM_Multi_Part_URI 22442 12.15 17.27 10.86 29 XM_UncommonTLD01 19120 5.77 14.71 3.50 30 LOTS_OF_MONEY 18884 9.54 14.53 8.28 31 FSL_BULK_SIG 18862 8.28 14.51 6.71 32 XM_B_Phish_Phrases 18037 7.52 13.88 5.91 33 UNTRUSTED_Relay 17985 4.13 13.84 1.67 34 BOTNET_IPINHOSTNAME 17843 6.53 13.73 4.71 35 XM_B_Unsub 16431 10.42 12.64 9.85 36 DKIM_INVALID 15227 6.37 11.72 5.01 37 RCVD_IN_MSPIKE_H2 13746 13.72 10.58 14.52 38 XM_Evil_Numbers_Gen 13713 8.81 10.55 8.37 39 HTML_IMAGE_RATIO_02 13622 7.61 10.48 6.88 40 XMSexyCombo_05 13293 4.77 10.23 3.38 41 NO_DNS_FOR_FROM 12871 3.86 9.90 2.32 42 XM_CamelCaseFrm001 12050 3.40 9.27 1.91 43 XM_B_COVIDMETA 11139 3.21 8.57 1.85 44 BAYES_80 10961 3.90 8.43 2.76 45 LotsOfNums_01 10542 8.06 8.11 8.05 46 XM_UB50 10295 2.35 7.92 0.94 47 KHOP_HELO_FCRDNS 9383 4.75 7.22 4.13 48 BAYES_60 9158 5.74 7.05 5.41 49 RELAYCOUNTRY_CA 8879 2.54 6.83 1.46 50 RCVD_IN_MSPIKE_BL 8822 2.89 6.79 1.90 51 XM_H_Long_From01 8695 5.53 6.69 5.24 52 URIBL_SBL_A 8571 1.81 6.59 0.60 53 XMSubMetaSx_00 8189 3.88 6.30 3.27 54 XMBody_17 7948 1.74 6.12 0.64 55 TR_XM_COVIDMETA4 7673 2.25 5.90 1.33 56 T_XMDrugObfuBody_08 7502 2.30 5.77 1.42 57 XM_SPF_SoftFail 7495 2.53 5.77 1.71 58 UNPARSEABLE_RELAY 7259 6.31 5.59 6.49 59 TooManyTo_001 7249 8.00 5.58 8.61 60 MPART_ALT_DIFF 7061 8.15 5.43 8.84 61 RCVD_IN_BL_SPAMCOP_NET 6836 1.56 5.26 0.62 62 RDNS_DYNAMIC 6687 1.33 5.15 0.36 63 TR_XM_MaxBayes 6562 1.03 5.05 0.02 64 RCVD_IN_MSPIKE_L3 6537 2.51 5.03 1.88 65 HTML_MIME_NO_HTML_TAG 6511 3.73 5.01 3.41 66 XM_SendGrid 6371 5.70 4.90 5.91 67 HTML_IMAGE_RATIO_04 6367 5.09 4.90 5.13 68 FROM_EXCESS_BASE64 6338 3.41 4.88 3.04 69 PDS_OTHER_BAD_TLD 6086 1.85 4.68 1.14 70 DKIM_ADSP_NXDOMAIN 6069 1.16 4.67 0.27 71 RCVD_IN_RP_RNBL 6002 0.99 4.62 0.08 72 BAYES_95 5860 2.20 4.51 1.61 73 MIME_QP_LONG_LINE 5834 5.25 4.49 5.44 74 XMNumbers 5587 3.46 4.30 3.25 75 XM_B_SpammyTLD 5575 2.62 4.29 2.19 76 XM_OfRef6 5514 1.76 4.24 1.13 77 XMStrtUSub 5441 4.17 4.19 4.17 78 HTML_IMAGE_RATIO_06 4888 3.02 3.76 2.84 79 MIME_HTML_MOSTLY 4785 2.61 3.68 2.34 80 XM_URI_RBL 4717 0.87 3.63 0.17 81 TR_LOTS_OF_MONEY3 4707 1.18 3.62 0.56 82 BOTNET_NORDNS 4178 0.67 3.21 0.02 83 XM_DIRTYINTL 4154 0.99 3.20 0.43 84 BAYES_40 4015 5.28 3.09 5.84 85 HTML_SHORT_LINK_IMG_1 3901 0.62 3.00 0.02 86 TM2_M_URI_OPT_OUT 3745 3.11 2.88 3.17 87 HTML_IMAGE_ONLY_08 3729 0.67 2.87 0.11 88 XMDiploma_00 3696 1.80 2.84 1.54 89 TR_XM_PhishingBody 3565 1.43 2.74 1.10 90 FROM_SUSPICIOUS_NTLD 3509 0.76 2.70 0.27 91 BAYES_20 3501 4.46 2.69 4.90 92 RCVD_IN_MSPIKE_WL 3456 7.62 2.66 8.88 93 RCVD_IN_MSPIKE_H3 3456 7.62 2.66 8.88 94 FROM_SUSPICIOUS_NTLD_FP 3450 0.74 2.65 0.26 95 SpammyFromTLD_02 3426 0.68 2.64 0.19 96 XMHTML_After_End 3384 1.11 2.60 0.73 97 DATE_IN_PAST_03_06 3367 0.61 2.59 0.11 98 BODY_URI_ONLY 3336 0.55 2.57 0.04 99 SpammyFromTLD_01 3330 1.18 2.56 0.84 100 TO_MALFORMED 3265 1.62 2.51 1.40 101 RELAYCOUNTRY_DE 3234 0.80 2.49 0.37 102 RELAYCOUNTRY_FR 3192 0.70 2.46 0.25 103 TR_XM_DK_SendGrid 3157 3.10 2.43 3.27 104 RCVD_IN_PSBL 3108 0.55 2.39 0.08 105 MIME_HTML_ONLY_MULTI 3091 5.98 2.38 6.90 106 SCRIPT_GIBBERISH 3040 0.47 2.34 0.00 107 XM_B_Unsub2 3036 1.62 2.34 1.44 108 HTML_IMAGE_RATIO_08 2883 2.16 2.22 2.15 109 DATE_IN_PAST_06_12 2875 0.60 2.21 0.20 110 TR_XM_INV_DKIM 2815 0.48 2.17 0.05 111 XMSexyCombo_01 2735 1.07 2.10 0.81 112 TR_XM_PHPDW 2704 0.86 2.08 0.55 113 BAYES_00 2680 17.13 2.06 20.95 114 TR_XM_PHPForged 2664 0.83 2.05 0.53 115 T_TooManySym_01 2636 4.02 2.03 4.53 116 TR_XM_FormFill2 2634 0.83 2.03 0.52 117 XM_H_PHPOS 2630 0.82 2.02 0.52 118 XMMoneyMeta_00 2476 0.93 1.91 0.68 119 T_XMHurry_00 2457 0.76 1.89 0.47 120 XM_UB60 2408 0.44 1.85 0.08 121 T_REMOTE_IMAGE 2400 3.66 1.85 4.12 122 TM2_M_VERY_LONG_WORD 2386 1.32 1.84 1.19 123 URIBL_DBL_SPAM 2368 0.37 1.82 0.01 124 TR_XM_RelayPhish 2345 0.46 1.80 0.12 125 RCVD_IN_IADB_LISTED 2336 4.22 1.80 4.83 126 XMGenDplmaNmb 2248 1.13 1.73 0.98 127 URI_HEX 2203 1.24 1.70 1.13 128 LongTLD 2196 0.48 1.69 0.17 129 T_XMDrugObfuBody_14 2192 1.51 1.69 1.47 130 RCVD_IN_IADB_SPF 2167 3.68 1.67 4.19 131 XMStockSpam_06 2155 1.18 1.66 1.06 132 RCVD_IN_IADB_DK 2104 3.23 1.62 3.64 133 RCVD_IN_IADB_SENDERID 2094 3.25 1.61 3.66 134 TR_XM_MaxSPIKE 2088 0.40 1.61 0.09 135 XMSubNoVowel 2041 2.08 1.57 2.21 136 MISSING_HEADERS 2028 0.75 1.56 0.55 137 XMSubMetaI_00 1944 0.65 1.50 0.43 138 RCVD_IN_MSPIKE_L5 1931 0.31 1.49 0.01 139 TR_XM_DK_Bayes 1931 10.23 1.49 12.45 140 HTML_SHORT_LINK_IMG_2 1905 0.36 1.47 0.08 141 XM_SPF_Unknown 1890 0.75 1.45 0.57 142 BAYES_05 1846 3.10 1.42 3.53 143 XMBrknScrpt_02 1837 1.04 1.41 0.94 144 RCVD_IN_RP_SAFE 1836 6.25 1.41 7.47 145 RELAYCOUNTRY_GB 1834 1.20 1.41 1.15 146 T_FILL_THIS_FORM_SHORT 1828 1.24 1.41 1.20 147 T_XMDrugObfuBody_00 1821 0.70 1.40 0.52 148 XMSubEmpty 1800 0.48 1.38 0.25 149 HTML_TITLE_SUBJ_DIFF 1777 0.32 1.37 0.05 150 DATE_IN_PAST_12_24 1775 0.45 1.37 0.21 151 RELAYCOUNTRY_RU 1771 0.36 1.36 0.11 152 XM_UB80 1761 0.29 1.35 0.02 153 SUBJ_ALL_CAPS 1712 1.41 1.32 1.43 154 TR_LOTS_OF_MONEY2 1710 0.45 1.32 0.23 155 T_MONEY_PERCENT 1710 0.45 1.32 0.23 156 HTML_IMAGE_ONLY_12 1692 0.43 1.30 0.21 157 URI_TRY_3LD 1683 1.33 1.29 1.34 158 ALL_TRUSTED 1678 12.21 1.29 14.98 159 HTML_FONT_SIZE_HUGE 1662 0.37 1.28 0.14 160 XMBdyGiftCard01 1580 0.99 1.22 0.93 161 XM_DK_Undo_01 1575 1.73 1.21 1.86 162 TR_Symld_Words 1427 1.28 1.10 1.33 163 TR_Mismatch_TLD_01 1423 0.37 1.09 0.19 164 TR_Mismatch_TLD_02 1421 0.27 1.09 0.06 165 DKIM_ADSP_CUSTOM_MED 1410 1.27 1.08 1.32 166 XMPhish30 1373 0.43 1.06 0.27 167 RCVD_IN_SORBS_DUL 1361 0.72 1.05 0.64 168 MAILING_LIST_MULTI 1346 2.15 1.04 2.44 169 TR_XM_COVIDMETA3 1322 0.24 1.02 0.04 170 TR_XM_DK_Bayes1 1319 9.46 1.01 11.60 171 XM_OfRef7 1305 0.31 1.00 0.14 172 XM_H_PHPMailer 1289 0.63 0.99 0.54 173 SHORT_SHORTNER 1261 0.22 0.97 0.03 174 LIST_PARTIAL_SHORT_MSG 1249 0.20 0.96 0.00 175 XMBody_78 1245 0.48 0.96 0.35 176 CTYPE_NULL 1244 0.19 0.96 0.00 177 URG_BIZ 1239 0.30 0.95 0.14 178 FORGED_GMAIL_RCVD 1219 0.64 0.94 0.57 179 XMSubMetaSxObfu_03 1219 0.52 0.94 0.41 180 XMPhish14 1196 0.53 0.92 0.43 181 XM_HighProb1 1192 0.19 0.92 0.00 182 REMOVE_BEFORE_LINK 1188 0.48 0.91 0.37 183 NML_ADSP_CUSTOM_MED 1187 0.92 0.91 0.92 184 LOW_PRICE 1186 0.31 0.91 0.16 185 TR_XM_COVIDMETA1 1182 0.30 0.91 0.14 186 XM_UB99 1160 0.18 0.89 0.00 187 RCVD_IN_RP_CERTIFIED 1136 5.61 0.87 6.81 188 XM_ProductURIs 1135 0.95 0.87 0.97 189 DIET_1 1112 0.41 0.86 0.30 190 XM_H_PHPOS_M 1063 0.30 0.82 0.17 191 XM_H_MailChimp 1056 0.25 0.81 0.11 192 XMSexyCombo_04 1050 0.51 0.81 0.44 193 TR_MetaPhish_Combo_01 1016 0.94 0.78 0.98 194 HTTPS_HTTP_MISMATCH 1002 0.86 0.77 0.89 195 XMPhish08 986 0.44 0.76 0.36 196 XM_BadFromFormat 984 0.30 0.76 0.18 197 XM_PDF 976 4.02 0.75 4.84 198 MALE_ENHANCE 974 0.15 0.75 0.00 199 NORDNS_LOW_CONTRAST 970 0.33 0.75 0.22 200 HK_RANDOM_REPLYTO 968 0.28 0.74 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 455231 90.06 95.38 88.71 2 RELAYCOUNTRY_US 418643 81.03 78.87 81.58 3 DKIM_SIGNED 361991 72.42 79.85 70.54 4 XM_B_Unicode 358749 70.71 73.87 69.91 5 XM_DK_Pass 355776 71.03 77.75 69.33 6 DKIM_VALID 336277 66.06 68.13 65.53 7 DCC_CHECK_NEGATIVE 312456 52.43 19.05 60.89 8 BAYES_50 265707 49.98 42.88 51.78 9 DKIM_VALID_AU 247494 48.92 51.66 48.23 10 XMListUnsubscribeExists 239506 51.39 70.01 46.67 11 XM_B_Unicode3 194163 38.34 40.32 37.84 12 DCC_CHECK 190709 45.66 79.22 37.16 13 T_TM2_M_HEADER_IN_MSG 147758 27.04 20.10 28.79 14 HTML_FONT_LOW_CONTRAST 133952 26.64 28.77 26.10 15 LOC_TINY_FONT_1 132975 26.96 31.08 25.91 16 DKIM_VALID_EF 132059 26.51 29.59 25.73 17 MIME_HTML_ONLY 125416 27.70 40.59 24.44 18 BAYES_00 107513 17.13 2.06 20.95 19 FVGT_m_MULTI_ODD 107365 21.64 24.48 20.92 20 XMSubLong 104704 20.93 23.01 20.40 21 T_KAM_HTML_FONT_INVALID 89747 19.38 26.85 17.49 22 ALL_TRUSTED 76850 12.21 1.29 14.98 23 RCVD_IN_MSPIKE_H2 74515 13.72 10.58 14.52 24 TR_XM_DK_Bayes 63882 10.23 1.49 12.45 25 XM_Body_Dirty_Words 59958 13.06 18.48 11.68 26 TR_XM_DK_Bayes1 59549 9.46 1.01 11.60 27 XM_Multi_Part_URI 55726 12.15 17.27 10.86 28 TR_XM_DK_Bayes2 51758 8.19 0.69 10.09 29 XM_B_Unsub 50553 10.42 12.64 9.85 30 RCVD_IN_MSPIKE_H3 45578 7.62 2.66 8.88 31 RCVD_IN_MSPIKE_WL 45578 7.62 2.66 8.88 32 MPART_ALT_DIFF 45363 8.15 5.43 8.84 33 TooManyTo_001 44198 8.00 5.58 8.61 34 XM_Evil_Numbers_Gen 42949 8.81 10.55 8.37 35 LOTS_OF_MONEY 42498 9.54 14.53 8.28 36 LotsOfNums_01 41289 8.06 8.11 8.05 37 RCVD_IN_RP_SAFE 38354 6.25 1.41 7.47 38 XM_DKIMWhitelistDomains 37272 5.81 0.05 7.26 39 MIME_HTML_ONLY_MULTI 35388 5.98 2.38 6.90 40 HTML_IMAGE_RATIO_02 35323 7.61 10.48 6.88 41 RCVD_IN_RP_CERTIFIED 34921 5.61 0.87 6.81 42 FSL_BULK_SIG 34417 8.28 14.51 6.71 43 UNPARSEABLE_RELAY 33319 6.31 5.59 6.49 44 IN_ZIMBRA_NJ_WHITELIST 31765 4.94 0.01 6.19 45 XM_DK_Undo_02 31709 13.41 41.96 6.18 46 XM_B_Phish_Phrases 30319 7.52 13.88 5.91 47 XM_SendGrid 30309 5.70 4.90 5.91 48 BAYES_40 29973 5.28 3.09 5.84 49 MIME_QP_LONG_LINE 27940 5.25 4.49 5.44 50 BAYES_60 27741 5.74 7.05 5.41 51 RELAYCOUNTRY_META 27349 8.74 22.22 5.33 52 XM_H_Long_From01 26890 5.53 6.69 5.24 53 HTML_IMAGE_RATIO_04 26350 5.09 4.90 5.13 54 HTML_FONT_FACE_BAD 26121 4.17 0.55 5.09 55 DKIM_INVALID 25714 6.37 11.72 5.01 56 BAYES_20 25158 4.46 2.69 4.90 57 XM_PDF 24848 4.02 0.75 4.84 58 RCVD_IN_IADB_LISTED 24775 4.22 1.80 4.83 59 BOTNET_IPINHOSTNAME 24153 6.53 13.73 4.71 60 T_TooManySym_01 23232 4.02 2.03 4.53 61 RCVD_IN_IADB_SPF 21522 3.68 1.67 4.19 62 XMStrtUSub 21402 4.17 4.19 4.17 63 KHOP_HELO_FCRDNS 21177 4.75 7.22 4.13 64 T_REMOTE_IMAGE 21153 3.66 1.85 4.12 65 RCVD_IN_IADB_SENDERID 18795 3.25 1.61 3.66 66 RCVD_IN_IADB_DK 18691 3.23 1.62 3.64 67 BAYES_05 18098 3.10 1.42 3.53 68 XM_UncommonTLD01 17956 5.77 14.71 3.50 69 HTML_MIME_NO_HTML_TAG 17488 3.73 5.01 3.41 70 XMSexyCombo_05 17355 4.77 10.23 3.38 71 TR_XM_DK_SendGrid 16776 3.10 2.43 3.27 72 XMSubMetaSx_00 16756 3.88 6.30 3.27 73 XMNumbers 16672 3.46 4.30 3.25 74 BAYES_99 16526 8.20 27.86 3.22 75 TM2_M_URI_OPT_OUT 16243 3.11 2.88 3.17 76 RCVD_IN_IADB_VOUCHED 15639 2.54 0.53 3.05 77 FROM_EXCESS_BASE64 15591 3.41 4.88 3.04 78 ANY_BOUNCE_MESSAGE 14886 2.40 0.43 2.90 79 BOUNCE_MESSAGE 14885 2.40 0.43 2.90 80 HTML_IMAGE_RATIO_06 14549 3.02 3.76 2.84 81 BAYES_80 14147 3.90 8.43 2.76 82 BOTNET 13525 6.55 22.02 2.64 83 BAYES_999 13048 6.39 21.57 2.54 84 TooManyTo_002 12998 2.15 0.63 2.53 85 XM_H_Trusted_IP 12990 2.02 0.00 2.53 86 MAILING_LIST_MULTI 12500 2.15 1.04 2.44 87 T_TooManySym_02 12409 2.06 0.67 2.42 88 MIME_HTML_MOSTLY 12002 2.61 3.68 2.34 89 NO_DNS_FOR_FROM 11929 3.86 9.90 2.32 90 XMSubNoVowel 11332 2.08 1.57 2.21 91 XM_B_SpammyTLD 11259 2.62 4.29 2.19 92 HTML_IMAGE_RATIO_08 11014 2.16 2.22 2.15 93 TVD_RCVD_IP 10864 1.77 0.39 2.12 94 XM_CamelCaseFrm001 9802 3.40 9.27 1.91 95 RCVD_IN_MSPIKE_BL 9764 2.89 6.79 1.90 96 RCVD_IN_IADB_OPTIN 9685 1.58 0.37 1.89 97 RCVD_IN_MSPIKE_L3 9626 2.51 5.03 1.88 98 XM_DK_Undo_01 9550 1.73 1.21 1.86 99 XM_B_COVIDMETA 9517 3.21 8.57 1.85 100 HELO_NODOT 9379 1.58 0.61 1.83 101 HELO_NO_DOMAIN 9377 1.58 0.61 1.83 102 CK_HELO_DYNAMIC_SPLIT_IP 9157 1.45 0.14 1.78 103 TooManyTo_003 9112 1.51 0.49 1.78 104 XM_SPF_SoftFail 8754 2.53 5.77 1.71 105 UNTRUSTED_Relay 8562 4.13 13.84 1.67 106 BAYES_95 8287 2.20 4.51 1.61 107 XMDiploma_00 7884 1.80 2.84 1.54 108 T_XMDrugObfuBody_14 7524 1.51 1.69 1.47 109 IN_HORDE_ADDRESS_BOOK 7471 1.17 0.04 1.46 110 RELAYCOUNTRY_CA 7470 2.54 6.83 1.46 111 INVALID_MSGID 7454 1.21 0.26 1.45 112 XM_B_Unsub2 7403 1.62 2.34 1.44 113 SUBJ_ALL_CAPS 7358 1.41 1.32 1.43 114 T_XMDrugObfuBody_08 7273 2.30 5.77 1.42 115 TR_DCC_Bayes_99 7216 5.66 22.45 1.41 116 TO_MALFORMED 7171 1.62 2.51 1.40 117 TooManyTo_004 7054 1.18 0.42 1.37 118 URI_TRY_3LD 6856 1.33 1.29 1.34 119 TR_XM_COVIDMETA4 6824 2.25 5.90 1.33 120 TR_Symld_Words 6807 1.28 1.10 1.33 121 DKIM_ADSP_CUSTOM_MED 6754 1.27 1.08 1.32 122 XMCapTrack 6716 1.14 0.46 1.31 123 XM_GoogleGroups 6656 1.14 0.50 1.30 124 HTML_IMAGE_ONLY_32 6534 1.06 0.23 1.27 125 HELO_MISC_IP 6473 1.03 0.11 1.26 126 T_FILL_THIS_FORM_SHORT 6142 1.24 1.41 1.20 127 TM2_M_VERY_LONG_WORD 6103 1.32 1.84 1.19 128 TooManyTo_005 5905 0.99 0.35 1.15 129 RELAYCOUNTRY_GB 5897 1.20 1.41 1.15 130 PDS_OTHER_BAD_TLD 5832 1.85 4.68 1.14 131 XM_OfRef6 5816 1.76 4.24 1.13 132 URI_HEX 5784 1.24 1.70 1.13 133 TR_XM_PhishingBody 5650 1.43 2.74 1.10 134 XMStockSpam_06 5425 1.18 1.66 1.06 135 XMGappySubj_01 5387 0.87 0.17 1.05 136 XM_H_Long_From02 5192 0.95 0.71 1.01 137 TR_MetaPhish_Combo_01 5037 0.94 0.78 0.98 138 XMGenDplmaNmb 5013 1.13 1.73 0.98 139 XM_ProductURIs 4996 0.95 0.87 0.97 140 USER_IN_DEF_DKIM_WL 4966 0.77 0.01 0.97 141 XMBrknScrpt_02 4838 1.04 1.41 0.94 142 XM_UB50 4830 2.35 7.92 0.94 143 XMBdyGiftCard01 4763 0.99 1.22 0.93 144 NML_ADSP_CUSTOM_MED 4716 0.92 0.91 0.92 145 HTTPS_HTTP_MISMATCH 4552 0.86 0.77 0.89 146 SpammyFromTLD_01 4290 1.18 2.56 0.84 147 XMSexyCombo_01 4153 1.07 2.10 0.81 148 XMHTML_After_End 3757 1.11 2.60 0.73 149 HTML_TAG_BALANCE_BODY 3629 0.68 0.57 0.71 150 XMNoVowels 3612 0.69 0.64 0.70 151 XMMoneyMeta_00 3506 0.93 1.91 0.68 152 T_TooManySym_03 3358 0.56 0.19 0.65 153 RCVD_IN_SORBS_DUL 3292 0.72 1.05 0.64 154 XMBody_17 3262 1.74 6.12 0.64 155 RCVD_IN_BL_SPAMCOP_NET 3180 1.56 5.26 0.62 156 XM_E_Blogspot 3149 0.51 0.09 0.61 157 URIBL_SBL_A 3058 1.81 6.59 0.60 158 TR_MSPIKEBAYES00 3049 0.48 0.01 0.59 159 FORGED_GMAIL_RCVD 2922 0.64 0.94 0.57 160 XM_SPF_Unknown 2913 0.75 1.45 0.57 161 TR_LOTS_OF_MONEY3 2872 1.18 3.62 0.56 162 XM_RXBody 2849 0.52 0.37 0.56 163 MISSING_HEADERS 2819 0.75 1.56 0.55 164 XM_ShortIntro_01 2813 0.55 0.54 0.55 165 TR_XM_PHPDW 2807 0.86 2.08 0.55 166 XM_H_PHPMailer 2766 0.63 0.99 0.54 167 XMSolicitRefs_0 2738 0.54 0.58 0.53 168 TR_XM_PHPForged 2701 0.83 2.05 0.53 169 TR_XM_FormFill2 2693 0.83 2.03 0.52 170 HELO_DYNAMIC_IPADDR2 2688 0.43 0.05 0.52 171 T_XMDrugObfuBody_00 2685 0.70 1.40 0.52 172 XM_H_PHPOS 2667 0.82 2.02 0.52 173 T_OBFU_PDF_ATTACH 2667 0.45 0.15 0.52 174 T_Symld_Words_02 2600 0.51 0.51 0.51 175 HTML_IMAGE_ONLY_20 2555 0.47 0.36 0.50 176 FROM_GOV_DKIM_AU 2545 0.42 0.12 0.50 177 T_XMHurry_00 2415 0.76 1.89 0.47 178 FROM_GOV_SPOOF 2392 0.41 0.20 0.47 179 PLING_QUERY 2326 0.50 0.66 0.45 180 TM2_M_BODY_EMPTY 2300 0.38 0.12 0.45 181 XMSexyCombo_04 2256 0.51 0.81 0.44 182 XMHTMLBadTable_001 2253 0.48 0.63 0.44 183 SHORT_HELO_AND_INLINE_IMAGE 2248 0.36 0.04 0.44 184 XMSubMetaI_00 2231 0.65 1.50 0.43 185 XMPhish14 2224 0.53 0.92 0.43 186 XM_DIRTYINTL 2208 0.99 3.20 0.43 187 MPART_ALT_DIFF_COUNT 2197 0.49 0.73 0.43 188 XMSubMetaSxObfu_02 2158 0.40 0.31 0.42 189 HTML_IMAGE_ONLY_28 2114 0.40 0.35 0.41 190 XMSubMetaSxObfu_03 2104 0.52 0.94 0.41 191 FUZZY_CREDIT 2078 0.33 0.05 0.40 192 RELAYCOUNTRY_AU 2039 0.44 0.62 0.40 193 XM_B_REG_HTML 1979 0.37 0.33 0.39 194 RELAYCOUNTRY_DE 1896 0.80 2.49 0.37 195 REMOVE_BEFORE_LINK 1884 0.48 0.91 0.37 196 URI_NOVOWEL 1874 0.41 0.59 0.37 197 XMBody_95 1867 0.30 0.07 0.36 198 XMPhish08 1859 0.44 0.76 0.36 199 MSGID_FROM_MTA_HEADER 1859 0.32 0.14 0.36 200 THIS_AD 1849 0.35 0.32 0.36 ----------------------------------------------------------------------