Email: 624724 Autolearn: 0 AvgScore: 1.79 AvgScanTime: 1.97 sec Spam: 135531 Autolearn: 0 AvgScore: 12.28 AvgScanTime: 3.31 sec Ham: 489193 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.60 sec Time Spent Running SA: 341.45 hours Time Spent Processing Spam: 124.57 hours Time Spent Processing Ham: 216.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128355 89.84 94.71 88.50 2 RELAYCOUNTRY_US 111364 82.04 82.17 82.00 3 DKIM_SIGNED 109263 75.85 80.62 74.53 4 DCC_CHECK 108016 48.91 79.70 40.38 5 XM_DK_Pass 106116 74.45 78.30 73.39 6 XM_B_Unicode 103132 72.68 76.09 71.73 7 XMListUnsubscribeExists 93684 53.96 69.12 49.76 8 DKIM_VALID 92873 69.37 68.53 69.60 9 DKIM_VALID_AU 66843 51.00 49.32 51.47 10 BAYES_50 62477 52.12 46.10 53.78 11 XM_DK_Undo_02 58087 14.55 42.86 6.71 12 XM_B_Unicode3 57384 42.02 42.34 41.93 13 MIME_HTML_ONLY 47933 24.56 35.37 21.56 14 LOC_TINY_FONT_1 44054 26.61 32.50 24.98 15 HTML_FONT_LOW_CONTRAST 42932 28.40 31.68 27.49 16 BAYES_99 37261 8.91 27.49 3.76 17 DKIM_VALID_EF 36653 26.24 27.04 26.02 18 FVGT_m_MULTI_ODD 35642 23.42 26.30 22.62 19 T_KAM_HTML_FONT_INVALID 32797 19.08 24.20 17.67 20 XMSubLong 31991 21.33 23.60 20.70 21 TR_DCC_Bayes_99 29918 6.26 22.07 1.88 22 BAYES_999 29694 7.08 21.91 2.97 23 RELAYCOUNTRY_META 27670 8.51 20.42 5.21 24 T_TM2_M_HEADER_IN_MSG 27621 25.85 20.38 27.37 25 XM_Body_Dirty_Words 27095 14.64 19.99 13.16 26 BOTNET 26484 6.06 19.54 2.32 27 DCC_CHECK_NEGATIVE 24771 49.07 18.28 57.60 28 XM_UncommonTLD01 24538 6.31 18.11 3.04 29 XM_Multi_Part_URI 23672 13.32 17.47 12.17 30 FSL_BULK_SIG 21685 9.26 16.00 7.39 31 BOTNET_IPINHOSTNAME 19989 6.82 14.75 4.62 32 XM_B_Phish_Phrases 19679 9.01 14.52 7.49 33 LOTS_OF_MONEY 18552 10.67 13.69 9.83 34 XM_B_Unsub 16631 11.29 12.27 11.01 35 DKIM_INVALID 16390 6.48 12.09 4.93 36 UNTRUSTED_Relay 14593 3.51 10.77 1.50 37 XM_Evil_Numbers_Gen 14173 8.48 10.46 7.93 38 HTML_IMAGE_RATIO_02 13610 7.80 10.04 7.18 39 LotsOfNums_01 13358 8.82 9.86 8.53 40 RCVD_IN_MSPIKE_H2 13249 13.09 9.78 14.01 41 XMSexyCombo_05 13038 5.39 9.62 4.22 42 XM_B_COVIDMETA 11897 3.43 8.78 1.95 43 NO_DNS_FOR_FROM 11491 3.59 8.48 2.24 44 RCVD_IN_MSPIKE_BL 11246 3.28 8.30 1.88 45 XMSubMetaSx_00 10728 4.76 7.92 3.89 46 XM_CamelCaseFrm001 10652 3.12 7.86 1.81 47 BAYES_80 10020 4.13 7.39 3.22 48 MPART_ALT_DIFF 9638 6.28 7.11 6.04 49 KHOP_HELO_FCRDNS 8867 2.96 6.54 1.97 50 RELAYCOUNTRY_CA 8762 2.59 6.46 1.52 51 XM_UB50 8743 2.10 6.45 0.90 52 BAYES_60 8678 5.96 6.40 5.84 53 XM_H_Long_From01 8548 5.71 6.31 5.54 54 TR_XM_COVIDMETA4 8173 2.35 6.03 1.33 55 SpammyFromTLD_02 8027 1.61 5.92 0.41 56 TooManyTo_001 7855 8.05 5.80 8.67 57 RCVD_IN_MSPIKE_L3 7655 2.67 5.65 1.84 58 XMNumbers 7122 3.97 5.25 3.62 59 UNPARSEABLE_RELAY 7092 7.01 5.23 7.50 60 RCVD_IN_BL_SPAMCOP_NET 7031 1.77 5.19 0.83 61 T_XMDrugObfuBody_08 6989 2.27 5.16 1.48 62 URIBL_SBL_A 6979 1.22 5.15 0.13 63 HTML_IMAGE_RATIO_04 6938 6.19 5.12 6.48 64 MIME_QP_LONG_LINE 6913 5.75 5.10 5.93 65 XM_B_SpammyTLD 6695 2.77 4.94 2.17 66 RDNS_DYNAMIC 6209 1.22 4.58 0.29 67 XMStrtUSub 6174 4.38 4.56 4.33 68 SpammyFromTLD_01 5837 1.48 4.31 0.70 69 XM_SPF_SoftFail 5755 2.10 4.25 1.51 70 XM_SendGrid 5748 6.17 4.24 6.71 71 TR_XM_MaxBayes 5679 0.92 4.19 0.02 72 PDS_OTHER_BAD_TLD 5192 1.37 3.83 0.69 73 XM_OfRef6 5189 1.69 3.83 1.10 74 HTML_MIME_NO_HTML_TAG 5185 2.70 3.83 2.39 75 HTML_SHORT_LINK_IMG_1 5108 0.83 3.77 0.02 76 BAYES_95 4887 2.19 3.61 1.80 77 MIME_HTML_MOSTLY 4699 2.61 3.47 2.37 78 FROM_SUSPICIOUS_NTLD 4641 0.78 3.42 0.04 79 FROM_SUSPICIOUS_NTLD_FP 4617 0.77 3.41 0.04 80 TM2_M_URI_OPT_OUT 4556 3.56 3.36 3.61 81 RCVD_IN_MSPIKE_WL 4444 8.36 3.28 9.77 82 RCVD_IN_MSPIKE_H3 4444 8.36 3.28 9.77 83 DKIM_ADSP_NXDOMAIN 4311 0.92 3.18 0.29 84 BAYES_40 4293 4.96 3.17 5.46 85 XM_URI_RBL 4280 0.83 3.16 0.19 86 HTML_IMAGE_RATIO_06 4268 3.85 3.15 4.04 87 RCVD_IN_PSBL 4259 0.70 3.14 0.03 88 MIME_HTML_ONLY_MULTI 4145 3.95 3.06 4.20 89 TR_LOTS_OF_MONEY3 4071 1.10 3.00 0.58 90 XMBody_17 4005 1.16 2.96 0.66 91 XMMoneyMeta_00 3984 1.09 2.94 0.58 92 XM_DIRTYINTL 3980 1.00 2.94 0.46 93 T_REMOTE_IMAGE 3973 3.72 2.93 3.94 94 RCVD_IN_RP_RNBL 3790 0.65 2.80 0.05 95 RCVD_IN_IADB_LISTED 3664 4.79 2.70 5.36 96 HTML_IMAGE_RATIO_08 3663 2.67 2.70 2.66 97 XMSexyCombo_01 3632 1.52 2.68 1.20 98 XMHTML_After_End 3558 1.19 2.63 0.79 99 FROM_EXCESS_BASE64 3541 2.93 2.61 3.02 100 HTML_IMAGE_ONLY_08 3518 0.66 2.60 0.12 101 DATE_IN_PAST_03_06 3464 0.66 2.56 0.14 102 TO_MALFORMED 3429 1.71 2.53 1.48 103 TR_Mismatch_TLD_02 3420 0.60 2.52 0.06 104 XM_B_Unsub2 3378 1.88 2.49 1.71 105 RCVD_IN_RP_SAFE 3267 6.58 2.41 7.73 106 RCVD_IN_IADB_SPF 3263 4.17 2.41 4.66 107 TR_XM_PhishingBody 3260 1.32 2.41 1.01 108 NORDNS_LOW_CONTRAST 3247 0.52 2.40 0.01 109 BAYES_20 3236 3.78 2.39 4.17 110 RELAYCOUNTRY_FR 3200 0.72 2.36 0.27 111 DATE_IN_PAST_06_12 3175 0.63 2.34 0.15 112 XMDiploma_00 3088 1.54 2.28 1.34 113 T_TooManySym_01 3073 4.29 2.27 4.85 114 RCVD_IN_IADB_DK 3070 3.62 2.27 4.00 115 RCVD_IN_IADB_SENDERID 3053 3.68 2.25 4.07 116 XMStockSpam_06 3031 1.65 2.24 1.49 117 TR_XM_PHPDW 3000 0.88 2.21 0.51 118 TR_XM_PHPForged 2978 0.86 2.20 0.50 119 URI_HEX 2970 1.53 2.19 1.34 120 TR_XM_INV_DKIM 2961 0.55 2.18 0.09 121 TR_XM_FormFill2 2943 0.86 2.17 0.50 122 XM_H_PHPOS 2938 0.85 2.17 0.49 123 SHORT_SHORTNER 2874 0.48 2.12 0.02 124 T_XMDrugObfuBody_14 2870 1.71 2.12 1.60 125 BAYES_00 2790 15.28 2.06 18.95 126 TR_XM_MaxSPIKE 2726 0.53 2.01 0.11 127 T_XMHurry_00 2712 0.80 2.00 0.47 128 TM2_M_VERY_LONG_WORD 2633 1.42 1.94 1.28 129 TR_XM_RelayPhish 2544 0.54 1.88 0.17 130 DATE_IN_PAST_12_24 2507 0.42 1.85 0.03 131 URI_TRY_3LD 2354 1.64 1.74 1.61 132 REPLYTO_WITHOUT_TO_CC 2335 0.42 1.72 0.06 133 LongTLD 2286 0.50 1.69 0.17 134 BODY_URI_ONLY 2248 0.40 1.66 0.05 135 XMBdyGiftCard01 2196 1.11 1.62 0.97 136 TR_XM_DK_SendGrid 2191 3.32 1.62 3.79 137 DIET_1 2184 0.61 1.61 0.33 138 SUBJ_ALL_CAPS 2158 1.61 1.59 1.61 139 RCVD_IN_RP_CERTIFIED 2126 5.96 1.57 7.18 140 XMGenDplmaNmb 2118 0.96 1.56 0.79 141 T_FILL_THIS_FORM_SHORT 2068 1.22 1.53 1.13 142 T_XMDrugObfuBody_00 2065 0.82 1.52 0.62 143 RELAYCOUNTRY_GB 2041 1.25 1.51 1.18 144 RCVD_IN_MSPIKE_L4 2028 0.35 1.50 0.03 145 TR_XM_DK_Bayes 1965 9.72 1.45 12.02 146 SHORT_URI_2 1911 0.33 1.41 0.04 147 MPART_ALT_DIFF_COUNT 1910 0.60 1.41 0.38 148 XMBrknScrpt_02 1904 0.91 1.40 0.78 149 BAYES_05 1888 2.66 1.39 3.01 150 BOTNET_NORDNS 1860 0.31 1.37 0.01 151 HTML_FONT_SIZE_HUGE 1846 0.35 1.36 0.07 152 TR_Symld_Words 1835 1.37 1.35 1.37 153 XM_H_PHPMailer 1817 0.70 1.34 0.53 154 HDRS_LCASE_IMGONLY 1799 0.29 1.33 0.01 155 MIME_HEADER_CTYPE_ONLY 1770 0.43 1.31 0.19 156 RELAYCOUNTRY_RU 1762 0.29 1.30 0.02 157 HTML_IMAGE_ONLY_04 1752 0.34 1.29 0.07 158 XMSubMetaI_00 1746 0.82 1.29 0.68 159 RELAYCOUNTRY_SE 1711 0.29 1.26 0.02 160 MAILING_LIST_MULTI 1697 2.26 1.25 2.54 161 DKIM_ADSP_CUSTOM_MED 1678 1.44 1.24 1.49 162 RELAYCOUNTRY_DE 1664 0.55 1.23 0.37 163 HTML_SHORT_CENTER 1661 0.27 1.23 0.00 164 SHORTENER_SHORT_IMG 1661 0.27 1.23 0.00 165 TO_EQ_FM_DOM_HTML_IMG 1660 0.27 1.22 0.01 166 XM_DK_Undo_01 1638 1.85 1.21 2.03 167 RCVD_IN_IADB_VOUCHED 1626 2.89 1.20 3.36 168 ALL_TRUSTED 1609 11.68 1.19 14.58 169 TR_MetaPhish_Combo_01 1580 0.80 1.17 0.70 170 XMPhish30 1579 0.45 1.17 0.25 171 RELAYCOUNTRY_IN 1574 0.32 1.16 0.09 172 RCVD_IN_MSPIKE_L5 1563 0.26 1.15 0.01 173 DEAR_EMAIL_USER 1525 0.24 1.13 0.00 174 XM_H_PHPOS_M 1516 0.39 1.12 0.19 175 XM_UB60 1505 0.30 1.11 0.07 176 FORGED_GMAIL_RCVD 1493 0.71 1.10 0.61 177 FROM_MISSP_REPLYTO 1433 0.24 1.06 0.01 178 XM_ProductURIs 1401 1.25 1.03 1.31 179 NML_ADSP_CUSTOM_MED 1366 1.09 1.01 1.11 180 TR_Mismatch_TLD_01 1362 0.40 1.00 0.23 181 XMSubMetaSxObfu_03 1349 0.89 1.00 0.86 182 TR_XM_DK_Bayes1 1319 9.03 0.97 11.26 183 TR_XM_COVIDMETA3 1261 0.24 0.93 0.04 184 ANY_BOUNCE_MESSAGE 1216 2.62 0.90 3.10 185 BOUNCE_MESSAGE 1210 2.62 0.89 3.10 186 XM_OfRef7 1193 0.28 0.88 0.11 187 BODY_ENHANCEMENT 1190 0.35 0.88 0.20 188 SUBJ_DOLLARS 1185 0.45 0.87 0.33 189 T_MONEY_PERCENT 1182 0.34 0.87 0.20 190 TR_LOTS_OF_MONEY2 1182 0.34 0.87 0.20 191 BODY_ENHANCEMENT2 1157 0.19 0.85 0.01 192 URIBL_BLACK 1154 0.20 0.85 0.02 193 RCVD_IN_IADB_OPTIN 1132 1.84 0.84 2.12 194 TR_XM_COVIDMETA2 1127 0.30 0.83 0.15 195 XMBody_78 1115 0.47 0.82 0.37 196 XM_Lotto 1106 0.36 0.82 0.23 197 HTML_TAG_BALANCE_BODY 1079 0.45 0.80 0.36 198 XM_UB80 1077 0.19 0.79 0.02 199 XMPhish08 1068 0.48 0.79 0.40 200 XM_H_MailChimp 1057 0.28 0.78 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 432921 89.84 94.71 88.50 2 RELAYCOUNTRY_US 401139 82.04 82.17 82.00 3 DKIM_SIGNED 364580 75.85 80.62 74.53 4 XM_DK_Pass 359000 74.45 78.30 73.39 5 XM_B_Unicode 350915 72.68 76.09 71.73 6 DKIM_VALID 340484 69.37 68.53 69.60 7 DCC_CHECK_NEGATIVE 281778 49.07 18.28 57.60 8 BAYES_50 263098 52.12 46.10 53.78 9 DKIM_VALID_AU 251776 51.00 49.32 51.47 10 XMListUnsubscribeExists 243429 53.96 69.12 49.76 11 XM_B_Unicode3 205101 42.02 42.34 41.93 12 DCC_CHECK 197551 48.91 79.70 40.38 13 HTML_FONT_LOW_CONTRAST 134495 28.40 31.68 27.49 14 T_TM2_M_HEADER_IN_MSG 133884 25.85 20.38 27.37 15 DKIM_VALID_EF 127282 26.24 27.04 26.02 16 LOC_TINY_FONT_1 122188 26.61 32.50 24.98 17 FVGT_m_MULTI_ODD 110670 23.42 26.30 22.62 18 MIME_HTML_ONLY 105480 24.56 35.37 21.56 19 XMSubLong 101261 21.33 23.60 20.70 20 BAYES_00 92699 15.28 2.06 18.95 21 T_KAM_HTML_FONT_INVALID 86417 19.08 24.20 17.67 22 ALL_TRUSTED 71338 11.68 1.19 14.58 23 RCVD_IN_MSPIKE_H2 68529 13.09 9.78 14.01 24 XM_Body_Dirty_Words 64379 14.64 19.99 13.16 25 XM_Multi_Part_URI 59556 13.32 17.47 12.17 26 TR_XM_DK_Bayes 58781 9.72 1.45 12.02 27 TR_XM_DK_Bayes1 55091 9.03 0.97 11.26 28 XM_B_Unsub 53884 11.29 12.27 11.01 29 LOTS_OF_MONEY 48101 10.67 13.69 9.83 30 TR_XM_DK_Bayes2 47911 7.80 0.62 9.79 31 RCVD_IN_MSPIKE_H3 47797 8.36 3.28 9.77 32 RCVD_IN_MSPIKE_WL 47797 8.36 3.28 9.77 33 TooManyTo_001 42416 8.05 5.80 8.67 34 LotsOfNums_01 41737 8.82 9.86 8.53 35 XM_DKIMWhitelistDomains 39697 6.38 0.13 8.11 36 XM_Evil_Numbers_Gen 38813 8.48 10.46 7.93 37 RCVD_IN_RP_SAFE 37816 6.58 2.41 7.73 38 UNPARSEABLE_RELAY 36696 7.01 5.23 7.50 39 XM_B_Phish_Phrases 36633 9.01 14.52 7.49 40 FSL_BULK_SIG 36137 9.26 16.00 7.39 41 HTML_IMAGE_RATIO_02 35142 7.80 10.04 7.18 42 RCVD_IN_RP_CERTIFIED 35130 5.96 1.57 7.18 43 XM_SendGrid 32816 6.17 4.24 6.71 44 XM_DK_Undo_02 32804 14.55 42.86 6.71 45 HTML_IMAGE_RATIO_04 31724 6.19 5.12 6.48 46 MPART_ALT_DIFF 29565 6.28 7.11 6.04 47 MIME_QP_LONG_LINE 29015 5.75 5.10 5.93 48 BAYES_60 28575 5.96 6.40 5.84 49 XM_H_Long_From01 27107 5.71 6.31 5.54 50 BAYES_40 26710 4.96 3.17 5.46 51 RCVD_IN_IADB_LISTED 26241 4.79 2.70 5.36 52 RELAYCOUNTRY_META 25473 8.51 20.42 5.21 53 DKIM_INVALID 24096 6.48 12.09 4.93 54 T_TooManySym_01 23748 4.29 2.27 4.85 55 RCVD_IN_IADB_SPF 22807 4.17 2.41 4.66 56 BOTNET_IPINHOSTNAME 22608 6.82 14.75 4.62 57 XM_PDF 21390 3.58 0.72 4.37 58 XMStrtUSub 21167 4.38 4.56 4.33 59 XMSexyCombo_05 20652 5.39 9.62 4.22 60 MIME_HTML_ONLY_MULTI 20548 3.95 3.06 4.20 61 BAYES_20 20395 3.78 2.39 4.17 62 RCVD_IN_IADB_SENDERID 19919 3.68 2.25 4.07 63 HTML_IMAGE_RATIO_06 19764 3.85 3.15 4.04 64 RCVD_IN_IADB_DK 19560 3.62 2.27 4.00 65 T_REMOTE_IMAGE 19291 3.72 2.93 3.94 66 XMSubMetaSx_00 19018 4.76 7.92 3.89 67 TR_XM_DK_SendGrid 18532 3.32 1.62 3.79 68 XM_H_Trusted_IP 18511 2.96 0.00 3.78 69 BAYES_99 18405 8.91 27.49 3.76 70 XMNumbers 17703 3.97 5.25 3.62 71 TM2_M_URI_OPT_OUT 17666 3.56 3.36 3.61 72 IN_ZIMBRA_NJ_WHITELIST 16692 2.68 0.02 3.41 73 RCVD_IN_IADB_VOUCHED 16450 2.89 1.20 3.36 74 BAYES_80 15770 4.13 7.39 3.22 75 ANY_BOUNCE_MESSAGE 15181 2.62 0.90 3.10 76 BOUNCE_MESSAGE 15168 2.62 0.89 3.10 77 XM_UncommonTLD01 14892 6.31 18.11 3.04 78 FROM_EXCESS_BASE64 14791 2.93 2.61 3.02 79 BAYES_05 14726 2.66 1.39 3.01 80 BAYES_999 14516 7.08 21.91 2.97 81 HTML_IMAGE_RATIO_08 13035 2.67 2.70 2.66 82 MAILING_LIST_MULTI 12403 2.26 1.25 2.54 83 TooManyTo_002 12184 2.08 0.58 2.49 84 HTML_MIME_NO_HTML_TAG 11674 2.70 3.83 2.39 85 MIME_HTML_MOSTLY 11595 2.61 3.47 2.37 86 BOTNET 11348 6.06 19.54 2.32 87 NO_DNS_FOR_FROM 10965 3.59 8.48 2.24 88 XM_B_SpammyTLD 10634 2.77 4.94 2.17 89 T_TooManySym_02 10467 1.82 0.66 2.14 90 RCVD_IN_IADB_OPTIN 10352 1.84 0.84 2.12 91 XM_DK_Undo_01 9926 1.85 1.21 2.03 92 HTML_FONT_FACE_BAD 9831 1.73 0.71 2.01 93 KHOP_HELO_FCRDNS 9631 2.96 6.54 1.97 94 XM_B_COVIDMETA 9544 3.43 8.78 1.95 95 TR_DCC_Bayes_99 9217 6.26 22.07 1.88 96 RCVD_IN_MSPIKE_BL 9217 3.28 8.30 1.88 97 RCVD_IN_MSPIKE_L3 9025 2.67 5.65 1.84 98 TVD_RCVD_IP 8943 1.49 0.29 1.83 99 XM_CamelCaseFrm001 8865 3.12 7.86 1.81 100 BAYES_95 8812 2.19 3.61 1.80 101 TooManyTo_003 8576 1.47 0.46 1.75 102 XM_B_Unsub2 8389 1.88 2.49 1.71 103 SUBJ_ALL_CAPS 7900 1.61 1.59 1.61 104 URI_TRY_3LD 7893 1.64 1.74 1.61 105 T_XMDrugObfuBody_14 7834 1.71 2.12 1.60 106 HELO_NODOT 7632 1.35 0.57 1.56 107 HELO_NO_DOMAIN 7631 1.34 0.56 1.56 108 IN_HORDE_ADDRESS_BOOK 7623 1.23 0.05 1.56 109 HELO_MISC_IP 7602 1.25 0.13 1.55 110 CK_HELO_DYNAMIC_SPLIT_IP 7594 1.24 0.13 1.55 111 INVALID_MSGID 7466 1.26 0.28 1.53 112 RELAYCOUNTRY_CA 7439 2.59 6.46 1.52 113 XM_SPF_SoftFail 7370 2.10 4.25 1.51 114 UNTRUSTED_Relay 7323 3.51 10.77 1.50 115 XMStockSpam_06 7294 1.65 2.24 1.49 116 DKIM_ADSP_CUSTOM_MED 7291 1.44 1.24 1.49 117 TO_MALFORMED 7229 1.71 2.53 1.48 118 T_XMDrugObfuBody_08 7222 2.27 5.16 1.48 119 XMGappySubj_01 7111 1.18 0.18 1.45 120 TR_Symld_Words 6705 1.37 1.35 1.37 121 XMSubNoVowel 6702 1.23 0.73 1.37 122 XM_GoogleGroups 6631 1.17 0.49 1.36 123 TooManyTo_004 6579 1.14 0.38 1.34 124 URI_HEX 6573 1.53 2.19 1.34 125 XMDiploma_00 6553 1.54 2.28 1.34 126 TR_XM_COVIDMETA4 6484 2.35 6.03 1.33 127 XM_ProductURIs 6412 1.25 1.03 1.31 128 TM2_M_VERY_LONG_WORD 6267 1.42 1.94 1.28 129 XMCapTrack 5916 1.07 0.57 1.21 130 XMSexyCombo_01 5884 1.52 2.68 1.20 131 RELAYCOUNTRY_GB 5781 1.25 1.51 1.18 132 T_FILL_THIS_FORM_SHORT 5540 1.22 1.53 1.13 133 TooManyTo_005 5449 0.94 0.33 1.11 134 XM_RXBody 5448 0.98 0.48 1.11 135 NML_ADSP_CUSTOM_MED 5442 1.09 1.01 1.11 136 XM_OfRef6 5363 1.69 3.83 1.10 137 XM_H_Long_From02 5009 0.95 0.70 1.02 138 TR_XM_PhishingBody 4956 1.32 2.41 1.01 139 USER_IN_DEF_DKIM_WL 4942 0.79 0.01 1.01 140 XMBdyGiftCard01 4752 1.11 1.62 0.97 141 XM_UB50 4384 2.10 6.45 0.90 142 XMSubMetaSxObfu_03 4213 0.89 1.00 0.86 143 RCVD_IN_BL_SPAMCOP_NET 4055 1.77 5.19 0.83 144 XMSexyCombo_04 4020 0.79 0.67 0.82 145 XMGenDplmaNmb 3879 0.96 1.56 0.79 146 XMHTML_After_End 3863 1.19 2.63 0.79 147 XMBrknScrpt_02 3810 0.91 1.40 0.78 148 HTTPS_HTTP_MISMATCH 3647 0.75 0.76 0.75 149 T_TooManySym_03 3637 0.66 0.35 0.74 150 TR_MSPIKEBAYES00 3428 0.56 0.03 0.70 151 TR_MetaPhish_Combo_01 3427 0.80 1.17 0.70 152 SpammyFromTLD_01 3403 1.48 4.31 0.70 153 PDS_OTHER_BAD_TLD 3395 1.37 3.83 0.69 154 HTML_IMAGE_ONLY_20 3389 0.62 0.35 0.69 155 XMSubMetaI_00 3348 0.82 1.29 0.68 156 XMBody_17 3233 1.16 2.96 0.66 157 FROM_GOV_DKIM_AU 3177 0.52 0.07 0.65 158 T_XMDrugObfuBody_00 3053 0.82 1.52 0.62 159 XM_ShortIntro_01 2979 0.58 0.47 0.61 160 FORGED_GMAIL_RCVD 2971 0.71 1.10 0.61 161 XMMoneyMeta_00 2830 1.09 2.94 0.58 162 TR_LOTS_OF_MONEY3 2819 1.10 3.00 0.58 163 PDS_FROM_2_EMAILS 2775 0.45 0.01 0.57 164 XMBody_95 2750 0.46 0.11 0.56 165 T_OBFU_PDF_ATTACH 2731 0.46 0.13 0.56 166 MISSING_HEADERS 2671 0.55 0.55 0.55 167 XMNoVowels 2584 0.54 0.58 0.53 168 FROM_GOV_SPOOF 2578 0.51 0.47 0.53 169 UPPERCASE_75_100 2572 0.42 0.05 0.53 170 XM_H_PHPMailer 2571 0.70 1.34 0.53 171 TR_XM_PHPDW 2501 0.88 2.21 0.51 172 XMHTMLBadTable_001 2495 0.54 0.64 0.51 173 T_Symld_Words_02 2462 0.53 0.61 0.50 174 UNICODE_OBFU_ASC 2456 0.52 0.57 0.50 175 TR_XM_PHPForged 2425 0.86 2.20 0.50 176 XMLngstWrd_00 2423 0.52 0.63 0.50 177 TR_XM_FormFill2 2423 0.86 2.17 0.50 178 XMGappySubj_02 2397 0.39 0.05 0.49 179 XM_H_PHPOS 2389 0.85 2.17 0.49 180 XM_SPF_Unknown 2383 0.49 0.52 0.49 181 RCVD_IN_SORBS_DUL 2352 0.39 0.07 0.48 182 T_XMHurry_00 2309 0.80 2.00 0.47 183 XM_DIRTYINTL 2273 1.00 2.94 0.46 184 XMSubMetaSx_01 2208 0.47 0.52 0.45 185 RELAYCOUNTRY_AU 2148 0.49 0.68 0.44 186 HTML_IMAGE_ONLY_28 2120 0.40 0.30 0.43 187 XMLngstWrd_01 2110 0.47 0.60 0.43 188 FILL_THIS_FORM 2048 0.41 0.37 0.42 189 SpammyFromTLD_02 2023 1.61 5.92 0.41 190 XMSolicitRefs_0 1980 0.45 0.61 0.40 191 HTML_IMAGE_ONLY_32 1973 0.36 0.20 0.40 192 XMPhish08 1950 0.48 0.79 0.40 193 SHORT_HELO_AND_INLINE_IMAGE 1946 0.32 0.02 0.40 194 XMSexyCombo_02 1942 0.36 0.22 0.40 195 URI_NOVOWEL 1937 0.47 0.73 0.40 196 TM2_M_BODY_EMPTY 1907 0.32 0.08 0.39 197 XMSubMetaSxObfu_02 1906 0.39 0.38 0.39 198 XMAntiAgingB 1845 0.31 0.09 0.38 199 MPART_ALT_DIFF_COUNT 1841 0.60 1.41 0.38 200 XMDateMe_00 1819 0.38 0.42 0.37 ----------------------------------------------------------------------