Email: 361683 Autolearn: 0 AvgScore: 2.28 AvgScanTime: 1.88 sec Spam: 93527 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 2.95 sec Ham: 268156 Autolearn: 0 AvgScore: -1.23 AvgScanTime: 1.52 sec Time Spent Running SA: 189.38 hours Time Spent Processing Spam: 76.51 hours Time Spent Processing Ham: 112.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87711 88.49 93.78 86.64 2 RELAYCOUNTRY_US 78244 82.68 83.66 82.34 3 DCC_CHECK 77007 57.67 82.34 49.06 4 DKIM_SIGNED 74382 79.96 79.53 80.11 5 XM_DK_Pass 72622 78.80 77.65 79.20 6 XM_B_Unicode 69723 73.28 74.55 72.84 7 XMListUnsubscribeExists 66280 60.61 70.87 57.03 8 DKIM_VALID 64222 73.74 68.67 75.50 9 DKIM_VALID_AU 49170 58.74 52.57 60.89 10 XM_DK_Undo_02 45088 18.58 48.21 8.25 11 XM_B_Unicode3 38755 43.42 41.44 44.11 12 MIME_HTML_ONLY 37427 27.33 40.02 22.90 13 BAYES_50 36011 48.95 38.50 52.59 14 BAYES_99 32160 12.60 34.39 5.01 15 LOC_TINY_FONT_1 28756 30.24 30.75 30.06 16 TR_DCC_Bayes_99 27087 9.60 28.96 2.85 17 BAYES_999 25921 10.13 27.71 4.00 18 HTML_FONT_LOW_CONTRAST 25686 30.29 27.46 31.28 19 DKIM_VALID_EF 24427 27.12 26.12 27.47 20 FVGT_m_MULTI_ODD 23201 22.86 24.81 22.18 21 T_KAM_HTML_FONT_INVALID 19844 18.38 21.22 17.38 22 XMSubLong 19679 21.06 21.04 21.06 23 T_TM2_M_HEADER_IN_MSG 19174 21.59 20.50 21.96 24 RELAYCOUNTRY_META 17973 9.05 19.22 5.51 25 BOTNET 16543 6.50 17.69 2.60 26 XM_Body_Dirty_Words 16409 15.28 17.54 14.49 27 FSL_BULK_SIG 16004 10.84 17.11 8.65 28 DCC_CHECK_NEGATIVE 15499 41.17 16.57 49.75 29 XM_Multi_Part_URI 15166 15.04 16.22 14.63 30 XM_UncommonTLD01 14810 7.10 15.83 4.06 31 BOTNET_IPINHOSTNAME 12812 8.43 13.70 6.59 32 LOTS_OF_MONEY 12048 10.69 12.88 9.92 33 KHOP_HELO_FCRDNS 10723 3.93 11.47 1.30 34 HTML_IMAGE_RATIO_02 10331 10.14 11.05 9.82 35 DKIM_INVALID 10160 6.22 10.86 4.61 36 XM_B_Phish_Phrases 9901 8.31 10.59 7.52 37 RCVD_IN_MSPIKE_H2 9175 13.42 9.81 14.68 38 XM_CamelCaseFrm001 9050 4.39 9.68 2.55 39 XMSexyCombo_05 9021 5.85 9.65 4.52 40 XM_Evil_Numbers_Gen 8939 10.07 9.56 10.25 41 UNTRUSTED_Relay 8818 3.71 9.43 1.72 42 RDNS_DYNAMIC 8717 2.82 9.32 0.55 43 XM_B_Unsub 8667 10.29 9.27 10.65 44 XMHTML_After_End 8540 2.80 9.13 0.60 45 LotsOfNums_01 8211 9.36 8.78 9.57 46 XMSubMetaSx_00 8028 6.23 8.58 5.41 47 NO_DNS_FOR_FROM 7742 3.92 8.28 2.40 48 BAYES_80 7560 4.92 8.08 3.81 49 BODY_URI_ONLY 7467 2.11 7.98 0.06 50 XM_SPF_SoftFail 7160 2.73 7.66 1.01 51 RELAYCOUNTRY_CA 6838 3.40 7.31 2.04 52 URIBL_SBL_A 6771 2.03 7.24 0.21 53 BAYES_60 6388 6.82 6.83 6.81 54 TR_XM_MaxBayes 5824 1.63 6.23 0.03 55 MPART_ALT_DIFF 5759 5.63 6.16 5.44 56 RCVD_IN_MSPIKE_BL 5588 2.75 5.97 1.62 57 XM_H_Long_From01 5438 5.86 5.81 5.88 58 XM_UB50 5299 2.28 5.67 1.10 59 RCVD_IN_BL_SPAMCOP_NET 5249 2.17 5.61 0.97 60 HTML_IMAGE_RATIO_04 5224 6.61 5.59 6.97 61 RCVD_IN_MSPIKE_L3 4928 2.52 5.27 1.56 62 TR_XM_COVIDMETA4 4717 1.95 5.04 0.87 63 UNPARSEABLE_RELAY 4685 8.00 5.01 9.05 64 XM_B_COVIDMETA 4616 2.31 4.94 1.40 65 NO_FM_NAME_IP_HOSTN 4472 1.24 4.78 0.00 66 TooManyTo_001 4389 6.36 4.69 6.94 67 T_XMDrugObfuBody_08 4335 2.26 4.64 1.43 68 BAYES_95 4259 2.99 4.55 2.44 69 MIME_HTML_MOSTLY 4069 3.29 4.35 2.92 70 XMStrtUSub 3971 4.98 4.25 5.24 71 XM_SendGrid 3639 6.96 3.89 8.03 72 RCVD_IN_RP_SAFE 3545 10.37 3.79 12.67 73 DATE_IN_PAST_06_12 3537 1.19 3.78 0.29 74 XMBody_17 3469 1.68 3.71 0.98 75 RCVD_IN_RP_RNBL 3401 0.99 3.64 0.07 76 MIME_QP_LONG_LINE 3287 4.77 3.51 5.21 77 XMNumbers 3272 3.33 3.50 3.27 78 DATE_IN_PAST_03_06 3230 0.99 3.45 0.12 79 URI_TRY_3LD 3031 2.13 3.24 1.75 80 DATE_IN_PAST_12_24 3005 0.87 3.21 0.05 81 XM_DIRTYINTL 3000 1.19 3.21 0.49 82 FROM_EXCESS_BASE64 2988 3.16 3.19 3.15 83 RCVD_IN_RP_CERTIFIED 2828 9.52 3.02 11.79 84 SpammyFromTLD_01 2770 1.16 2.96 0.53 85 XMSexyCombo_01 2721 2.15 2.91 1.88 86 HTML_IMAGE_RATIO_06 2719 3.45 2.91 3.64 87 T_XMHurry_00 2702 1.20 2.89 0.61 88 BAYES_40 2675 4.27 2.86 4.76 89 HTML_MIME_NO_HTML_TAG 2651 1.79 2.83 1.43 90 TR_LOTS_OF_MONEY3 2628 1.27 2.81 0.73 91 XM_B_SpammyTLD 2586 2.53 2.76 2.45 92 TR_XM_PhishingBody 2518 2.01 2.69 1.77 93 FROM_SUSPICIOUS_NTLD 2501 0.73 2.67 0.06 94 TM2_M_URI_OPT_OUT 2485 3.49 2.66 3.78 95 PDS_OTHER_BAD_TLD 2471 1.30 2.64 0.83 96 FROM_SUSPICIOUS_NTLD_FP 2455 0.72 2.62 0.06 97 TR_XM_INV_DKIM 2382 0.81 2.55 0.20 98 T_TooManySym_01 2360 4.54 2.52 5.25 99 XM_OfRef6 2342 1.44 2.50 1.07 100 XM_URI_RBL 2308 0.77 2.47 0.18 101 TR_XM_MaxSPIKE 2275 0.72 2.43 0.13 102 HTML_IMAGE_RATIO_08 2211 2.42 2.36 2.44 103 TR_XM_PHPDW 2182 1.06 2.33 0.62 104 MIME_HTML_ONLY_MULTI 2175 2.96 2.33 3.18 105 TR_XM_PHPForged 2150 1.02 2.30 0.58 106 RCVD_IN_MSPIKE_WL 2148 7.87 2.30 9.82 107 RCVD_IN_MSPIKE_H3 2148 7.87 2.30 9.82 108 TR_XM_FormFill2 2134 0.99 2.28 0.54 109 XM_H_PHPOS 2129 0.98 2.28 0.53 110 XMBdyGiftCard01 1934 1.62 2.07 1.46 111 SpammyFromTLD_02 1870 0.63 2.00 0.15 112 XMDiploma_00 1819 1.27 1.94 1.03 113 BAYES_00 1791 13.78 1.91 17.92 114 BAYES_20 1765 3.46 1.89 4.01 115 TM2_M_VERY_LONG_WORD 1742 1.50 1.86 1.38 116 LongTLD 1634 0.60 1.75 0.20 117 XMStockSpam_06 1598 1.54 1.71 1.48 118 T_REMOTE_IMAGE 1592 3.19 1.70 3.71 119 TR_XM_DK_Bayes 1583 10.70 1.69 13.84 120 RELAYCOUNTRY_FR 1581 0.63 1.69 0.26 121 T_FILL_THIS_FORM_SHORT 1572 1.36 1.68 1.25 122 RCVD_IN_IADB_LISTED 1564 3.45 1.67 4.07 123 TR_XM_DK_SendGrid 1562 4.01 1.67 4.83 124 XM_B_Unsub2 1540 1.43 1.65 1.36 125 DKIM_ADSP_NXDOMAIN 1535 0.70 1.64 0.37 126 DKIM_ADSP_CUSTOM_MED 1514 1.34 1.62 1.25 127 XMSubMetaI_00 1514 1.02 1.62 0.81 128 URI_HEX 1505 1.41 1.61 1.34 129 RCVD_IN_IADB_SPF 1429 3.05 1.53 3.58 130 RCVD_IN_IADB_DK 1401 2.72 1.50 3.15 131 RCVD_IN_IADB_SENDERID 1396 2.79 1.49 3.24 132 FORGED_GMAIL_RCVD 1392 0.83 1.49 0.61 133 NML_ADSP_CUSTOM_MED 1375 1.04 1.47 0.89 134 XM_RXBody 1364 1.71 1.46 1.80 135 XMPhish30 1350 0.70 1.44 0.44 136 XM_ProductURIs 1326 1.47 1.42 1.49 137 BOTNET_NORDNS 1304 0.37 1.39 0.01 138 T_XMDrugObfuBody_14 1215 1.31 1.30 1.31 139 MPART_ALT_DIFF_COUNT 1206 0.59 1.29 0.34 140 MAILING_LIST_MULTI 1182 1.97 1.26 2.21 141 XM_H_PHPMailer 1171 0.82 1.25 0.66 142 TO_MALFORMED 1136 2.31 1.21 2.70 143 SUBJ_ALL_CAPS 1132 1.23 1.21 1.24 144 XMMoneyMeta_00 1129 0.61 1.21 0.40 145 TR_Mismatch_TLD_02 1115 0.35 1.19 0.06 146 TR_XM_DK_Bayes1 1114 10.03 1.19 13.12 147 TR_XM_RelayPhish 1081 0.41 1.16 0.14 148 RELAYCOUNTRY_GB 1045 0.98 1.12 0.93 149 XM_SPF_Unknown 1044 0.54 1.12 0.35 150 XM_H_PHPOS_M 1037 0.50 1.11 0.28 151 XMGenDplmaNmb 992 0.70 1.06 0.58 152 URIBL_ABUSE_SURBL 968 0.33 1.03 0.08 153 ALL_TRUSTED 952 10.40 1.02 13.67 154 SUBJECT_NEEDS_ENCODING 948 0.27 1.01 0.00 155 SUBJ_ILLEGAL_CHARS 946 0.26 1.01 0.00 156 XM_DK_Undo_01 943 1.37 1.01 1.50 157 TR_MetaPhish_Combo_01 942 0.88 1.01 0.84 158 TR_Mismatch_TLD_01 935 0.45 1.00 0.26 159 XM_UB99 915 0.26 0.98 0.00 160 BAYES_05 915 2.21 0.98 2.64 161 TR_XM_COVIDMETA1 914 0.35 0.98 0.13 162 RCVD_IN_PSBL 901 0.31 0.96 0.08 163 TR_XM_DK_Bayes2 900 9.33 0.96 12.25 164 RELAYCOUNTRY_DE 870 0.44 0.93 0.27 165 XMSexyCombo_04 857 0.83 0.92 0.80 166 HTML_SHORT_LINK_IMG_1 840 0.25 0.90 0.02 167 XMHTMLBadTable_001 829 0.72 0.89 0.67 168 HTML_IMAGE_ONLY_08 825 0.33 0.88 0.13 169 TR_Symld_Words 810 1.11 0.87 1.19 170 MISSING_HEADERS 799 0.48 0.85 0.36 171 XMBrknScrpt_02 777 1.22 0.83 1.36 172 URG_BIZ 763 0.35 0.82 0.18 173 HTTPS_HTTP_MISMATCH 757 0.65 0.81 0.59 174 RELAYCOUNTRY_ES 746 0.23 0.80 0.03 175 XM_UB60 741 0.27 0.79 0.08 176 DATE_IN_PAST_24_48 739 0.21 0.79 0.01 177 SHORT_SHORTNER 732 0.23 0.78 0.04 178 URIBL_RHS_DOB 726 0.31 0.78 0.15 179 XMSubMetaSxObfu_03 719 1.05 0.77 1.15 180 URIBL_BLACK 719 0.21 0.77 0.01 181 XMReplyNow 718 0.26 0.77 0.09 182 HTML_FONT_SIZE_HUGE 713 0.27 0.76 0.10 183 XMPhish08 712 0.61 0.76 0.56 184 ANY_BOUNCE_MESSAGE 698 2.76 0.75 3.46 185 BOUNCE_MESSAGE 698 2.76 0.75 3.46 186 T_XMDrugObfuBody_00 694 0.68 0.74 0.66 187 XM_UB80 691 0.21 0.74 0.02 188 T_TooManySym_02 682 2.28 0.73 2.82 189 XMLngstWrd_00 673 0.58 0.72 0.53 190 XMSubNoVowel 657 0.76 0.70 0.78 191 RELAYCOUNTRY_AT 657 0.36 0.70 0.24 192 XM_LoanWordsFrm 643 0.26 0.69 0.12 193 T_Symld_Words_02 634 0.51 0.68 0.45 194 XM_B_COPY_HTML 633 0.54 0.68 0.49 195 XMBody_78 632 0.47 0.68 0.40 196 DIET_1 628 0.77 0.67 0.81 197 XM_B_REG_HTML 624 0.55 0.67 0.51 198 RELAYCOUNTRY_IN 621 0.23 0.66 0.07 199 HTML_TAG_BALANCE_BODY 608 0.65 0.65 0.65 200 LONG_JUNK_URI2 605 0.21 0.65 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 232342 88.49 93.78 86.64 2 RELAYCOUNTRY_US 220811 82.68 83.66 82.34 3 DKIM_SIGNED 214817 79.96 79.53 80.11 4 XM_DK_Pass 212385 78.80 77.65 79.20 5 DKIM_VALID 202466 73.74 68.67 75.50 6 XM_B_Unicode 195322 73.28 74.55 72.84 7 DKIM_VALID_AU 163286 58.74 52.57 60.89 8 XMListUnsubscribeExists 152933 60.61 70.87 57.03 9 BAYES_50 141035 48.95 38.50 52.59 10 DCC_CHECK_NEGATIVE 133407 41.17 16.57 49.75 11 DCC_CHECK 131560 57.67 82.34 49.06 12 XM_B_Unicode3 118279 43.42 41.44 44.11 13 HTML_FONT_LOW_CONTRAST 83883 30.29 27.46 31.28 14 LOC_TINY_FONT_1 80612 30.24 30.75 30.06 15 DKIM_VALID_EF 73673 27.12 26.12 27.47 16 MIME_HTML_ONLY 61407 27.33 40.02 22.90 17 FVGT_m_MULTI_ODD 59483 22.86 24.81 22.18 18 T_TM2_M_HEADER_IN_MSG 58899 21.59 20.50 21.96 19 XMSubLong 56483 21.06 21.04 21.06 20 BAYES_00 48056 13.78 1.91 17.92 21 T_KAM_HTML_FONT_INVALID 46617 18.38 21.22 17.38 22 RCVD_IN_MSPIKE_H2 39358 13.42 9.81 14.68 23 XM_Multi_Part_URI 39244 15.04 16.22 14.63 24 XM_Body_Dirty_Words 38861 15.28 17.54 14.49 25 TR_XM_DK_Bayes 37121 10.70 1.69 13.84 26 ALL_TRUSTED 36655 10.40 1.02 13.67 27 TR_XM_DK_Bayes1 35178 10.03 1.19 13.12 28 RCVD_IN_RP_SAFE 33978 10.37 3.79 12.67 29 TR_XM_DK_Bayes2 32846 9.33 0.96 12.25 30 RCVD_IN_RP_CERTIFIED 31622 9.52 3.02 11.79 31 XM_DKIMWhitelistDomains 29658 8.23 0.13 11.06 32 XM_B_Unsub 28549 10.29 9.27 10.65 33 XM_Evil_Numbers_Gen 27493 10.07 9.56 10.25 34 LOTS_OF_MONEY 26605 10.69 12.88 9.92 35 HTML_IMAGE_RATIO_02 26330 10.14 11.05 9.82 36 RCVD_IN_MSPIKE_WL 26323 7.87 2.30 9.82 37 RCVD_IN_MSPIKE_H3 26323 7.87 2.30 9.82 38 LotsOfNums_01 25656 9.36 8.78 9.57 39 UNPARSEABLE_RELAY 24267 8.00 5.01 9.05 40 FSL_BULK_SIG 23188 10.84 17.11 8.65 41 XM_DK_Undo_02 22126 18.58 48.21 8.25 42 XM_SendGrid 21541 6.96 3.89 8.03 43 XM_B_Phish_Phrases 20168 8.31 10.59 7.52 44 HTML_IMAGE_RATIO_04 18681 6.61 5.59 6.97 45 TooManyTo_001 18621 6.36 4.69 6.94 46 BAYES_60 18265 6.82 6.83 6.81 47 BOTNET_IPINHOSTNAME 17663 8.43 13.70 6.59 48 XM_H_Long_From01 15767 5.86 5.81 5.88 49 RELAYCOUNTRY_META 14775 9.05 19.22 5.51 50 MPART_ALT_DIFF 14597 5.63 6.16 5.44 51 XMSubMetaSx_00 14498 6.23 8.58 5.41 52 T_TooManySym_01 14066 4.54 2.52 5.25 53 XMStrtUSub 14040 4.98 4.25 5.24 54 MIME_QP_LONG_LINE 13962 4.77 3.51 5.21 55 BAYES_99 13424 12.60 34.39 5.01 56 TR_XM_DK_SendGrid 12952 4.01 1.67 4.83 57 BAYES_40 12754 4.27 2.86 4.76 58 DKIM_INVALID 12351 6.22 10.86 4.61 59 XMSexyCombo_05 12128 5.85 9.65 4.52 60 RCVD_IN_IADB_LISTED 10914 3.45 1.67 4.07 61 XM_UncommonTLD01 10886 7.10 15.83 4.06 62 BAYES_20 10764 3.46 1.89 4.01 63 BAYES_999 10730 10.13 27.71 4.00 64 BAYES_80 10225 4.92 8.08 3.81 65 TM2_M_URI_OPT_OUT 10147 3.49 2.66 3.78 66 T_REMOTE_IMAGE 9936 3.19 1.70 3.71 67 HTML_IMAGE_RATIO_06 9750 3.45 2.91 3.64 68 RCVD_IN_IADB_SPF 9591 3.05 1.53 3.58 69 ANY_BOUNCE_MESSAGE 9270 2.76 0.75 3.46 70 BOUNCE_MESSAGE 9269 2.76 0.75 3.46 71 XMNumbers 8771 3.33 3.50 3.27 72 RCVD_IN_IADB_SENDERID 8700 2.79 1.49 3.24 73 MIME_HTML_ONLY_MULTI 8535 2.96 2.33 3.18 74 RCVD_IN_IADB_DK 8454 2.72 1.50 3.15 75 FROM_EXCESS_BASE64 8450 3.16 3.19 3.15 76 IN_ZIMBRA_NJ_WHITELIST 8147 2.26 0.01 3.04 77 TVD_RCVD_IP 8125 2.34 0.35 3.03 78 MIME_HTML_MOSTLY 7832 3.29 4.35 2.92 79 TR_DCC_Bayes_99 7640 9.60 28.96 2.85 80 T_TooManySym_02 7569 2.28 0.73 2.82 81 INVALID_MSGID 7540 2.21 0.47 2.81 82 HELO_MISC_IP 7376 2.07 0.10 2.75 83 CK_HELO_DYNAMIC_SPLIT_IP 7372 2.07 0.11 2.75 84 TO_MALFORMED 7236 2.31 1.21 2.70 85 BAYES_05 7084 2.21 0.98 2.64 86 BOTNET 6969 6.50 17.69 2.60 87 XM_CamelCaseFrm001 6841 4.39 9.68 2.55 88 XM_B_SpammyTLD 6571 2.53 2.76 2.45 89 BAYES_95 6548 2.99 4.55 2.44 90 HTML_IMAGE_RATIO_08 6539 2.42 2.36 2.44 91 NO_DNS_FOR_FROM 6446 3.92 8.28 2.40 92 RCVD_IN_IADB_VOUCHED 6281 1.85 0.43 2.34 93 MAILING_LIST_MULTI 5937 1.97 1.26 2.21 94 RELAYCOUNTRY_CA 5477 3.40 7.31 2.04 95 IN_HORDE_ADDRESS_BOOK 5176 1.44 0.03 1.93 96 XM_H_Trusted_IP 5068 1.40 0.00 1.89 97 XMSexyCombo_01 5047 2.15 2.91 1.88 98 XM_PDF 4925 1.49 0.50 1.84 99 XM_RXBody 4837 1.71 1.46 1.80 100 TR_XM_PhishingBody 4734 2.01 2.69 1.77 101 URI_TRY_3LD 4688 2.13 3.24 1.75 102 USER_IN_DEF_DKIM_WL 4623 1.28 0.00 1.72 103 UNTRUSTED_Relay 4603 3.71 9.43 1.72 104 TooManyTo_002 4350 1.36 0.63 1.62 105 RCVD_IN_MSPIKE_BL 4341 2.75 5.97 1.62 106 RCVD_IN_MSPIKE_L3 4183 2.52 5.27 1.56 107 XM_DK_Undo_01 4018 1.37 1.01 1.50 108 XM_ProductURIs 4007 1.47 1.42 1.49 109 XMStockSpam_06 3959 1.54 1.71 1.48 110 XMBdyGiftCard01 3925 1.62 2.07 1.46 111 XM_GoogleGroups 3869 1.20 0.51 1.44 112 T_XMDrugObfuBody_08 3839 2.26 4.64 1.43 113 HTML_MIME_NO_HTML_TAG 3833 1.79 2.83 1.43 114 RCVD_IN_IADB_OPTIN 3815 1.13 0.30 1.42 115 XM_B_COVIDMETA 3756 2.31 4.94 1.40 116 TM2_M_VERY_LONG_WORD 3699 1.50 1.86 1.38 117 XM_B_Unsub2 3641 1.43 1.65 1.36 118 XMBrknScrpt_02 3636 1.22 0.83 1.36 119 URI_HEX 3596 1.41 1.61 1.34 120 T_XMDrugObfuBody_14 3512 1.31 1.30 1.31 121 KHOP_HELO_FCRDNS 3474 3.93 11.47 1.30 122 T_FILL_THIS_FORM_SHORT 3359 1.36 1.68 1.25 123 DKIM_ADSP_CUSTOM_MED 3343 1.34 1.62 1.25 124 SUBJ_ALL_CAPS 3326 1.23 1.21 1.24 125 XMGappySubj_01 3314 0.94 0.08 1.24 126 TooManyTo_003 3251 1.03 0.50 1.21 127 TR_Symld_Words 3191 1.11 0.87 1.19 128 XM_H_Long_From02 3170 0.99 0.45 1.18 129 XMSubMetaSxObfu_03 3089 1.05 0.77 1.15 130 XM_UB50 2941 2.28 5.67 1.10 131 XM_OfRef6 2881 1.44 2.50 1.07 132 HTML_FONT_FACE_BAD 2860 0.94 0.56 1.07 133 TooManyTo_004 2783 0.89 0.46 1.04 134 XMDiploma_00 2775 1.27 1.94 1.03 135 XM_SPF_SoftFail 2710 2.73 7.66 1.01 136 XMBody_17 2622 1.68 3.71 0.98 137 RCVD_IN_BL_SPAMCOP_NET 2596 2.17 5.61 0.97 138 RELAYCOUNTRY_GB 2505 0.98 1.12 0.93 139 T_TooManySym_03 2490 0.79 0.40 0.93 140 TooManyTo_005 2447 0.78 0.42 0.91 141 NML_ADSP_CUSTOM_MED 2390 1.04 1.47 0.89 142 TR_XM_COVIDMETA4 2325 1.95 5.04 0.87 143 TR_MetaPhish_Combo_01 2240 0.88 1.01 0.84 144 PDS_OTHER_BAD_TLD 2220 1.30 2.64 0.83 145 XMSubMetaI_00 2181 1.02 1.62 0.81 146 DIET_1 2164 0.77 0.67 0.81 147 XMSexyCombo_04 2158 0.83 0.92 0.80 148 XMSubMetaSx_01 2143 0.73 0.55 0.80 149 XMSexyCombo_02 2120 0.71 0.49 0.79 150 XMSubNoVowel 2090 0.76 0.70 0.78 151 XMPhish14 2013 0.68 0.47 0.75 152 HELO_NODOT 2000 0.69 0.53 0.75 153 HELO_NO_DOMAIN 1999 0.69 0.53 0.75 154 TR_LOTS_OF_MONEY3 1966 1.27 2.81 0.73 155 XMBody_95 1890 0.54 0.08 0.70 156 XMSubMetaSxObfu_02 1855 0.65 0.53 0.69 157 XMHTMLBadTable_001 1790 0.72 0.89 0.67 158 XM_H_PHPMailer 1777 0.82 1.25 0.66 159 USER_IN_WHITELIST 1769 0.49 0.00 0.66 160 T_XMDrugObfuBody_00 1763 0.68 0.74 0.66 161 HTML_TAG_BALANCE_BODY 1736 0.65 0.65 0.65 162 XM_ShortIntro_01 1668 0.60 0.55 0.62 163 TR_XM_PHPDW 1653 1.06 2.33 0.62 164 T_XMHurry_00 1646 1.20 2.89 0.61 165 HTML_IMAGE_ONLY_20 1643 0.56 0.42 0.61 166 XMSolicitRefs_0 1627 0.53 0.32 0.61 167 TR_MSPIKEBAYES00 1627 0.45 0.00 0.61 168 FORGED_GMAIL_RCVD 1625 0.83 1.49 0.61 169 XMHTML_After_End 1599 2.80 9.13 0.60 170 HTTPS_HTTP_MISMATCH 1593 0.65 0.81 0.59 171 TR_XM_PHPForged 1555 1.02 2.30 0.58 172 XMGenDplmaNmb 1551 0.70 1.06 0.58 173 XMPhish08 1499 0.61 0.76 0.56 174 RDNS_DYNAMIC 1485 2.82 9.32 0.55 175 TR_XM_FormFill2 1442 0.99 2.28 0.54 176 XMLngstWrd_00 1431 0.58 0.72 0.53 177 XM_H_PHPOS 1427 0.98 2.28 0.53 178 SpammyFromTLD_01 1421 1.16 2.96 0.53 179 THIS_AD 1392 0.50 0.46 0.52 180 XMCapTrack 1376 0.50 0.46 0.51 181 XM_B_REG_HTML 1372 0.55 0.67 0.51 182 LOW_PRICE 1330 0.51 0.56 0.50 183 XM_DIRTYINTL 1312 1.19 3.21 0.49 184 XM_B_COPY_HTML 1304 0.54 0.68 0.49 185 XMLngstWrd_01 1284 0.51 0.59 0.48 186 FUZZY_CPILL 1269 0.37 0.06 0.47 187 SUBJ_DOLLARS 1266 0.49 0.55 0.47 188 TR_LOTS_OF_MONEY2 1238 0.50 0.62 0.46 189 T_MONEY_PERCENT 1238 0.50 0.62 0.46 190 T_Symld_Words_02 1220 0.51 0.68 0.45 191 T_TooManySym_04 1216 0.36 0.11 0.45 192 XMBSHREFv2 1203 0.40 0.24 0.45 193 NUMERIC_HTTP_ADDR 1201 0.48 0.56 0.45 194 XMPhish30 1172 0.70 1.44 0.44 195 XMNoVowels 1171 0.40 0.28 0.44 196 URI_NOVOWEL 1091 0.46 0.61 0.41 197 XMBody_78 1067 0.47 0.68 0.40 198 XMMoneyMeta_00 1061 0.61 1.21 0.40 199 XMLngstWrd_02 1017 0.38 0.38 0.38 200 DKIM_ADSP_NXDOMAIN 998 0.70 1.64 0.37 ----------------------------------------------------------------------