Email: 701493 Autolearn: 0 AvgScore: 0.66 AvgScanTime: 2.33 sec Spam: 150379 Autolearn: 0 AvgScore: 12.40 AvgScanTime: 3.99 sec Ham: 551114 Autolearn: 0 AvgScore: -2.54 AvgScanTime: 1.87 sec Time Spent Running SA: 453.73 hours Time Spent Processing Spam: 166.76 hours Time Spent Processing Ham: 286.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145804 91.24 96.96 89.68 2 DKIM_SIGNED 124545 70.18 82.82 66.73 3 RELAYCOUNTRY_US 123027 82.97 81.81 83.29 4 XM_DK_Pass 121169 68.76 80.58 65.53 5 DCC_CHECK 120964 45.45 80.44 35.90 6 XM_B_Unicode 117843 74.45 78.36 73.39 7 XMListUnsubscribeExists 108545 50.09 72.18 44.06 8 DKIM_VALID 102937 62.87 68.45 61.35 9 DKIM_VALID_AU 78835 46.97 52.42 45.48 10 XM_DK_Undo_02 68191 14.49 45.35 6.08 11 XM_B_Unicode3 63363 42.55 42.14 42.66 12 BAYES_50 62561 47.39 41.60 48.97 13 MIME_HTML_ONLY 56502 26.35 37.57 23.28 14 LOC_TINY_FONT_1 50646 24.05 33.68 21.42 15 BAYES_99 48026 9.32 31.94 3.15 16 HTML_FONT_LOW_CONTRAST 44899 25.18 29.86 23.91 17 DKIM_VALID_EF 41835 23.89 27.82 22.82 18 FVGT_m_MULTI_ODD 39750 21.17 26.43 19.74 19 TR_DCC_Bayes_99 39557 6.77 26.30 1.43 20 T_KAM_HTML_FONT_INVALID 38109 17.98 25.34 15.98 21 BAYES_999 38085 7.30 25.33 2.38 22 XMSubLong 34559 20.66 22.98 20.03 23 T_TM2_M_HEADER_IN_MSG 32212 25.26 21.42 26.31 24 BOTNET 31363 6.37 20.86 2.41 25 RELAYCOUNTRY_META 31038 8.64 20.64 5.36 26 XM_Body_Dirty_Words 28484 12.68 18.94 10.97 27 XM_Multi_Part_URI 27293 11.62 18.15 9.84 28 DCC_CHECK_NEGATIVE 26640 52.63 17.72 62.16 29 LOTS_OF_MONEY 24544 9.55 16.32 7.70 30 XM_B_Phish_Phrases 21863 8.40 14.54 6.73 31 DKIM_INVALID 21608 7.31 14.37 5.39 32 XM_UncommonTLD01 21601 5.45 14.36 3.02 33 BOTNET_IPINHOSTNAME 21269 6.08 14.14 3.88 34 FSL_BULK_SIG 20961 8.79 13.94 7.38 35 XM_B_Unsub 20020 10.10 13.31 9.22 36 RCVD_IN_MSPIKE_H2 18056 14.48 12.01 15.15 37 HTML_IMAGE_RATIO_02 17596 7.18 11.70 5.94 38 NO_DNS_FOR_FROM 16581 4.79 11.03 3.08 39 XM_Evil_Numbers_Gen 16262 9.49 10.81 9.12 40 UNTRUSTED_Relay 16047 3.61 10.67 1.68 41 LotsOfNums_01 15629 8.60 10.39 8.11 42 XMSexyCombo_05 14843 4.61 9.87 3.18 43 XM_CamelCaseFrm001 13761 3.43 9.15 1.87 44 XM_B_COVIDMETA 11816 3.36 7.86 2.13 45 BAYES_80 11699 4.16 7.78 3.17 46 URIBL_SBL_A 11198 1.73 7.45 0.17 47 XMSubMetaSx_00 10995 3.93 7.31 3.00 48 XM_H_Long_From01 10373 5.53 6.90 5.16 49 HTML_IMAGE_RATIO_04 9711 13.23 6.46 15.08 50 MPART_ALT_DIFF 9626 9.24 6.40 10.02 51 BAYES_60 9317 5.67 6.20 5.52 52 TR_XM_COVIDMETA4 9261 2.20 6.16 1.12 53 RELAYCOUNTRY_CA 9257 2.54 6.16 1.55 54 TooManyTo_001 9187 7.28 6.11 7.60 55 TR_XM_MaxBayes 8840 1.28 5.88 0.03 56 XM_UB50 8553 2.01 5.69 1.01 57 XMNumbers 8553 3.87 5.69 3.38 58 KHOP_HELO_FCRDNS 8304 3.14 5.52 2.49 59 RCVD_IN_BL_SPAMCOP_NET 8270 1.81 5.50 0.81 60 MIME_QP_LONG_LINE 8035 5.43 5.34 5.45 61 T_XMDrugObfuBody_08 7754 2.12 5.16 1.29 62 UNPARSEABLE_RELAY 7613 6.37 5.06 6.72 63 RCVD_IN_MSPIKE_BL 7257 2.26 4.83 1.56 64 XM_SPF_SoftFail 6837 2.12 4.55 1.46 65 BAYES_95 6723 2.53 4.47 2.00 66 XM_SendGrid 6502 5.77 4.32 6.16 67 XMBody_17 5920 1.47 3.94 0.79 68 TR_LOTS_OF_MONEY3 5880 1.39 3.91 0.71 69 RDNS_DYNAMIC 5831 1.07 3.88 0.30 70 XMHTML_After_End 5669 1.34 3.77 0.68 71 TR_XM_PhishingBody 5596 2.31 3.72 1.92 72 RCVD_IN_MSPIKE_WL 5413 9.62 3.60 11.26 73 XM_B_Phish66 5367 2.15 3.57 1.76 74 XMStrtUSub 5300 7.52 3.52 8.61 75 XM_B_SpammyTLD 5169 2.10 3.44 1.74 76 HTML_IMAGE_RATIO_06 5122 4.12 3.41 4.32 77 PDS_OTHER_BAD_TLD 5118 1.09 3.40 0.45 78 TM2_M_URI_OPT_OUT 4861 3.06 3.23 3.01 79 MIME_HTML_MOSTLY 4647 2.40 3.09 2.21 80 RCVD_IN_MSPIKE_L3 4552 1.11 3.03 0.59 81 FROM_SUSPICIOUS_NTLD 4550 0.67 3.03 0.03 82 FROM_SUSPICIOUS_NTLD_FP 4491 0.66 2.99 0.02 83 TR_XM_INV_DKIM 4317 0.69 2.87 0.09 84 SpammyFromTLD_02 4277 0.89 2.84 0.35 85 DATE_IN_PAST_06_12 4267 0.70 2.84 0.12 86 RCVD_IN_MSPIKE_H3 4260 7.36 2.83 8.60 87 MIME_HTML_ONLY_MULTI 4249 7.06 2.83 8.21 88 HTML_IMAGE_RATIO_08 4199 2.29 2.79 2.15 89 XM_URI_RBL 4175 0.73 2.78 0.17 90 T_REMOTE_IMAGE 4114 3.36 2.74 3.53 91 BODY_URI_ONLY 3968 0.60 2.64 0.05 92 BAYES_40 3923 5.46 2.61 6.24 93 RELAYCOUNTRY_FR 3919 0.72 2.61 0.20 94 HTML_MIME_NO_HTML_TAG 3885 2.25 2.58 2.15 95 XM_OfRef6 3885 1.26 2.58 0.90 96 XMSexyCombo_01 3847 1.14 2.56 0.75 97 XM_DIRTYINTL 3846 0.94 2.56 0.50 98 URI_TRY_3LD 3830 1.38 2.55 1.06 99 T_XMHurry_00 3728 0.87 2.48 0.43 100 T_TooManySym_01 3699 4.14 2.46 4.59 101 RCVD_IN_PSBL 3547 0.55 2.36 0.06 102 SpammyFromTLD_01 3543 1.11 2.36 0.76 103 DATE_IN_PAST_03_06 3508 0.55 2.33 0.06 104 XM_B_Unsub2 3423 1.92 2.28 1.83 105 FROM_EXCESS_BASE64 3389 2.56 2.25 2.64 106 BAYES_00 3347 17.28 2.23 21.38 107 TR_XM_RelayPhish 3285 0.58 2.18 0.14 108 URI_HEX 3185 1.58 2.12 1.43 109 LongTLD 3124 0.59 2.08 0.19 110 T_XMDrugObfuBody_14 3116 1.82 2.07 1.75 111 RCVD_IN_RP_SAFE 3086 6.46 2.05 7.66 112 BOTNET_NORDNS 3052 0.45 2.03 0.02 113 XMDiploma_00 3010 1.56 2.00 1.44 114 RCVD_IN_IADB_LISTED 3004 4.00 2.00 4.55 115 TR_XM_PHPDW 2959 0.80 1.97 0.48 116 TR_XM_PHPForged 2918 0.78 1.94 0.47 117 BAYES_20 2889 4.70 1.92 5.46 118 TR_XM_FormFill2 2883 0.78 1.92 0.47 119 XM_H_PHPOS 2879 0.77 1.91 0.46 120 TM2_M_VERY_LONG_WORD 2831 1.24 1.88 1.06 121 RELAYCOUNTRY_DE 2767 0.83 1.84 0.55 122 TR_XM_DK_SendGrid 2760 3.13 1.84 3.48 123 RCVD_IN_IADB_SPF 2709 3.51 1.80 3.98 124 XM_Palau_URI 2691 0.39 1.79 0.00 125 RCVD_IN_IADB_DK 2616 3.12 1.74 3.49 126 RCVD_IN_IADB_SENDERID 2606 3.09 1.73 3.45 127 XM_UB99 2512 0.36 1.67 0.00 128 XMStockSpam_06 2490 1.15 1.66 1.02 129 RELAYCOUNTRY_GB 2486 1.35 1.65 1.26 130 SUBJ_ALL_CAPS 2471 1.41 1.64 1.34 131 DKIM_ADSP_NXDOMAIN 2393 0.67 1.59 0.42 132 RCVD_IN_RP_CERTIFIED 2310 6.00 1.54 7.22 133 XMMoneyMeta_00 2218 0.82 1.47 0.64 134 MAILING_LIST_MULTI 2144 2.23 1.43 2.45 135 DIET_1 2140 0.53 1.42 0.28 136 T_FILL_THIS_FORM_SHORT 2124 1.20 1.41 1.14 137 T_XMDrugObfuBody_00 2120 0.69 1.41 0.49 138 TR_XM_COVIDMETA1 2116 0.50 1.41 0.25 139 TR_XM_DK_Bayes 2107 8.64 1.40 10.62 140 RCVD_IN_RP_RNBL 2014 0.31 1.34 0.03 141 XMGenDplmaNmb 1982 0.89 1.32 0.77 142 XMSubMetaSxObfu_03 1975 0.86 1.31 0.74 143 BAYES_05 1891 3.49 1.26 4.10 144 TR_Symld_Words 1848 1.41 1.23 1.46 145 XM_UB999 1817 0.26 1.21 0.00 146 ALL_TRUSTED 1799 10.57 1.20 13.13 147 TR_Mismatch_TLD_02 1738 0.28 1.16 0.04 148 NORDNS_LOW_CONTRAST 1697 0.25 1.13 0.01 149 XM_UB60 1693 0.30 1.13 0.07 150 XMBdyGiftCard01 1679 0.99 1.12 0.96 151 XM_H_PHPMailer 1675 0.65 1.11 0.53 152 XMPhish30 1571 0.53 1.04 0.38 153 DATE_IN_PAST_12_24 1562 0.24 1.04 0.03 154 XM_DK_Undo_01 1550 1.60 1.03 1.75 155 URI_NOVOWEL 1544 0.52 1.03 0.38 156 RELAYCOUNTRY_IN 1508 0.29 1.00 0.10 157 HTML_IMAGE_ONLY_08 1505 0.30 1.00 0.11 158 RCVD_IN_MSPIKE_L5 1502 0.31 1.00 0.12 159 XM_H_MailChimp 1495 0.35 0.99 0.17 160 MPART_ALT_DIFF_COUNT 1476 0.48 0.98 0.34 161 XMBody_78 1462 0.43 0.97 0.28 162 XM_SPF_Unknown 1443 0.61 0.96 0.51 163 XMBrknScrpt_02 1416 0.77 0.94 0.72 164 TR_XM_MaxSPIKE 1400 0.23 0.93 0.04 165 XM_H_PHPOS_M 1388 0.34 0.92 0.19 166 NO_FM_NAME_IP_HOSTN 1382 0.20 0.92 0.00 167 RELAYCOUNTRY_AU 1371 0.51 0.91 0.40 168 PLING_QUERY 1365 0.53 0.91 0.43 169 HTML_SHORT_LINK_IMG_1 1363 0.20 0.91 0.01 170 XM_PDF 1362 3.44 0.91 4.14 171 XMSexyCombo_04 1325 0.55 0.88 0.46 172 TR_MetaPhish_Combo_01 1316 0.74 0.88 0.71 173 XM_ProductURIs 1313 0.73 0.87 0.70 174 HTML_FONT_FACE_BAD 1278 10.57 0.85 13.22 175 TR_XM_DK_Bayes1 1277 7.89 0.85 9.82 176 XMPhish11 1275 0.23 0.85 0.06 177 HK_RANDOM_FROM 1217 0.27 0.81 0.12 178 HTML_FONT_SIZE_HUGE 1204 0.26 0.80 0.11 179 RCVD_IN_MSPIKE_L4 1203 0.84 0.80 0.85 180 HTTPS_HTTP_MISMATCH 1200 0.77 0.80 0.76 181 TR_XM_COVIDMETA3 1168 0.19 0.78 0.03 182 TR_LOTS_OF_MONEY2 1164 0.35 0.77 0.24 183 T_MONEY_PERCENT 1164 0.35 0.77 0.24 184 RCVD_IN_MSPIKE_H4 1153 2.26 0.77 2.66 185 T_Symld_Words_02 1132 0.51 0.75 0.44 186 XM_UB80 1109 0.18 0.74 0.02 187 XMPhish14 1091 0.44 0.73 0.37 188 XMSubMetaI_00 1077 0.61 0.72 0.58 189 TR_XM_DK_Bayes2 1076 6.98 0.72 8.69 190 REMOVE_BEFORE_LINK 1067 0.37 0.71 0.28 191 HELO_NO_DOMAIN 1060 1.36 0.70 1.54 192 HELO_NODOT 1060 1.36 0.70 1.54 193 XM_H_Long_From02 1050 0.90 0.70 0.96 194 TR_Mismatch_TLD_01 1048 0.31 0.70 0.21 195 XMPhish08 1047 0.48 0.70 0.42 196 RELAYCOUNTRY_NL 1029 0.31 0.68 0.21 197 RELAYCOUNTRY_TW 1023 0.19 0.68 0.05 198 DKIM_ADSP_CUSTOM_MED 1021 1.07 0.68 1.17 199 RELAYCOUNTRY_AT 1020 0.28 0.68 0.17 200 SUBJ_OBFU_PUNCT_FEW 1015 0.19 0.67 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 494236 91.24 96.96 89.68 2 RELAYCOUNTRY_US 459001 82.97 81.81 83.29 3 XM_B_Unicode 404447 74.45 78.36 73.39 4 DKIM_SIGNED 367781 70.18 82.82 66.73 5 XM_DK_Pass 361149 68.76 80.58 65.53 6 DCC_CHECK_NEGATIVE 342561 52.63 17.72 62.16 7 DKIM_VALID 338089 62.87 68.45 61.35 8 BAYES_50 269882 47.39 41.60 48.97 9 DKIM_VALID_AU 250633 46.97 52.42 45.48 10 XMListUnsubscribeExists 242839 50.09 72.18 44.06 11 XM_B_Unicode3 235092 42.55 42.14 42.66 12 DCC_CHECK 197854 45.45 80.44 35.90 13 T_TM2_M_HEADER_IN_MSG 144974 25.26 21.42 26.31 14 HTML_FONT_LOW_CONTRAST 131756 25.18 29.86 23.91 15 MIME_HTML_ONLY 128320 26.35 37.57 23.28 16 DKIM_VALID_EF 125753 23.89 27.82 22.82 17 LOC_TINY_FONT_1 118072 24.05 33.68 21.42 18 BAYES_00 117851 17.28 2.23 21.38 19 XMSubLong 110389 20.66 22.98 20.03 20 FVGT_m_MULTI_ODD 108766 21.17 26.43 19.74 21 T_KAM_HTML_FONT_INVALID 88042 17.98 25.34 15.98 22 RCVD_IN_MSPIKE_H2 83500 14.48 12.01 15.15 23 HTML_IMAGE_RATIO_04 83085 13.23 6.46 15.08 24 HTML_FONT_FACE_BAD 72837 10.57 0.85 13.22 25 ALL_TRUSTED 72359 10.57 1.20 13.13 26 XM_H_Trusted_IP 66661 9.50 0.00 12.10 27 RCVD_IN_MSPIKE_WL 62074 9.62 3.60 11.26 28 XM_Body_Dirty_Words 60431 12.68 18.94 10.97 29 TR_XM_DK_Bayes 58524 8.64 1.40 10.62 30 MPART_ALT_DIFF 55212 9.24 6.40 10.02 31 XM_Multi_Part_URI 54222 11.62 18.15 9.84 32 TR_XM_DK_Bayes1 54095 7.89 0.85 9.82 33 XM_B_Unsub 50827 10.10 13.31 9.22 34 XM_Evil_Numbers_Gen 50283 9.49 10.81 9.12 35 TR_XM_DK_Bayes2 47871 6.98 0.72 8.69 36 XMStrtUSub 47439 7.52 3.52 8.61 37 RCVD_IN_MSPIKE_H3 47396 7.36 2.83 8.60 38 MIME_HTML_ONLY_MULTI 45265 7.06 2.83 8.21 39 LotsOfNums_01 44712 8.60 10.39 8.11 40 LOTS_OF_MONEY 42448 9.55 16.32 7.70 41 RCVD_IN_RP_SAFE 42236 6.46 2.05 7.66 42 TooManyTo_001 41910 7.28 6.11 7.60 43 FSL_BULK_SIG 40676 8.79 13.94 7.38 44 RCVD_IN_RP_CERTIFIED 39798 6.00 1.54 7.22 45 XM_B_Phish_Phrases 37085 8.40 14.54 6.73 46 UNPARSEABLE_RELAY 37049 6.37 5.06 6.72 47 XM_DKIMWhitelistDomains 35151 5.03 0.09 6.38 48 BAYES_40 34382 5.46 2.61 6.24 49 XM_SendGrid 33940 5.77 4.32 6.16 50 XM_DK_Undo_02 33489 14.49 45.35 6.08 51 HTML_IMAGE_RATIO_02 32754 7.18 11.70 5.94 52 BAYES_60 30449 5.67 6.20 5.52 53 BAYES_20 30088 4.70 1.92 5.46 54 MIME_QP_LONG_LINE 30046 5.43 5.34 5.45 55 DKIM_INVALID 29692 7.31 14.37 5.39 56 RELAYCOUNTRY_META 29545 8.64 20.64 5.36 57 XM_H_Long_From01 28423 5.53 6.90 5.16 58 T_TooManySym_01 25316 4.14 2.46 4.59 59 RCVD_IN_IADB_LISTED 25074 4.00 2.00 4.55 60 XMSubNoVowel 24499 3.62 0.59 4.45 61 HTML_IMAGE_RATIO_06 23811 4.12 3.41 4.32 62 IN_ZIMBRA_NJ_WHITELIST 23261 3.32 0.04 4.22 63 XM_PDF 22802 3.44 0.91 4.14 64 BAYES_05 22621 3.49 1.26 4.10 65 RCVD_IN_IADB_SPF 21926 3.51 1.80 3.98 66 BOTNET_IPINHOSTNAME 21408 6.08 14.14 3.88 67 T_REMOTE_IMAGE 19476 3.36 2.74 3.53 68 RCVD_IN_IADB_DK 19238 3.12 1.74 3.49 69 TR_XM_DK_SendGrid 19202 3.13 1.84 3.48 70 RCVD_IN_IADB_SENDERID 19036 3.09 1.73 3.45 71 XMNumbers 18624 3.87 5.69 3.38 72 ANY_BOUNCE_MESSAGE 18011 2.67 0.50 3.27 73 BOUNCE_MESSAGE 17997 2.67 0.50 3.27 74 XMSexyCombo_05 17528 4.61 9.87 3.18 75 BAYES_80 17456 4.16 7.78 3.17 76 BAYES_99 17357 9.32 31.94 3.15 77 NO_DNS_FOR_FROM 16987 4.79 11.03 3.08 78 XM_UncommonTLD01 16629 5.45 14.36 3.02 79 TM2_M_URI_OPT_OUT 16616 3.06 3.23 3.01 80 XMSubMetaSx_00 16550 3.93 7.31 3.00 81 RCVD_IN_IADB_VOUCHED 15171 2.30 0.64 2.75 82 RCVD_IN_MSPIKE_H4 14678 2.26 0.77 2.66 83 FROM_EXCESS_BASE64 14574 2.56 2.25 2.64 84 KHOP_HELO_FCRDNS 13706 3.14 5.52 2.49 85 MAILING_LIST_MULTI 13503 2.23 1.43 2.45 86 BOTNET 13305 6.37 20.86 2.41 87 BAYES_999 13112 7.30 25.33 2.38 88 MIME_HTML_MOSTLY 12201 2.40 3.09 2.21 89 HTML_MIME_NO_HTML_TAG 11870 2.25 2.58 2.15 90 HTML_IMAGE_RATIO_08 11865 2.29 2.79 2.15 91 XM_B_COVIDMETA 11731 3.36 7.86 2.13 92 TooManyTo_002 11554 1.77 0.59 2.10 93 BAYES_95 11024 2.53 4.47 2.00 94 TR_XM_PhishingBody 10579 2.31 3.72 1.92 95 T_TooManySym_02 10313 1.61 0.63 1.87 96 XM_CamelCaseFrm001 10281 3.43 9.15 1.87 97 XM_B_Unsub2 10071 1.92 2.28 1.83 98 XM_B_Phish66 9683 2.15 3.57 1.76 99 T_XMDrugObfuBody_14 9662 1.82 2.07 1.75 100 XM_DK_Undo_01 9639 1.60 1.03 1.75 101 XM_B_SpammyTLD 9596 2.10 3.44 1.74 102 UNTRUSTED_Relay 9286 3.61 10.67 1.68 103 RCVD_IN_IADB_OPTIN 9132 1.40 0.44 1.66 104 TVD_RCVD_IP 9077 1.36 0.31 1.65 105 RCVD_IN_MSPIKE_BL 8617 2.26 4.83 1.56 106 RELAYCOUNTRY_CA 8554 2.54 6.16 1.55 107 HELO_NODOT 8503 1.36 0.70 1.54 108 HELO_NO_DOMAIN 8502 1.36 0.70 1.54 109 XMSubLongNoVowel 8361 1.21 0.10 1.52 110 TR_Symld_Words 8065 1.41 1.23 1.46 111 XM_SPF_SoftFail 8036 2.12 4.55 1.46 112 XMSubGarbage 7987 1.15 0.03 1.45 113 TooManyTo_003 7927 1.23 0.46 1.44 114 XMDiploma_00 7913 1.56 2.00 1.44 115 TR_DCC_Bayes_99 7902 6.77 26.30 1.43 116 URI_HEX 7871 1.58 2.12 1.43 117 IN_HORDE_ADDRESS_BOOK 7608 1.09 0.04 1.38 118 INVALID_MSGID 7602 1.12 0.15 1.38 119 SUBJ_ALL_CAPS 7410 1.41 1.64 1.34 120 HELO_MISC_IP 7392 1.07 0.10 1.34 121 CK_HELO_DYNAMIC_SPLIT_IP 7384 1.07 0.10 1.34 122 XM_GoogleGroups 7360 1.15 0.46 1.34 123 TO_MALFORMED 7240 1.17 0.63 1.31 124 T_XMDrugObfuBody_08 7098 2.12 5.16 1.29 125 RELAYCOUNTRY_GB 6966 1.35 1.65 1.26 126 XMCapTrack 6892 1.10 0.53 1.25 127 DKIM_ADSP_CUSTOM_MED 6472 1.07 0.68 1.17 128 T_FILL_THIS_FORM_SHORT 6261 1.20 1.41 1.14 129 TR_XM_COVIDMETA4 6177 2.20 6.16 1.12 130 TooManyTo_004 6124 0.96 0.40 1.11 131 TM2_M_VERY_LONG_WORD 5867 1.24 1.88 1.06 132 URI_TRY_3LD 5853 1.38 2.55 1.06 133 XMStockSpam_06 5598 1.15 1.66 1.02 134 XM_UB50 5553 2.01 5.69 1.01 135 XM_E_Blogspot 5448 0.80 0.09 0.99 136 XMGappySubj_01 5408 0.80 0.14 0.98 137 XMBdyGiftCard01 5270 0.99 1.12 0.96 138 XM_H_Long_From02 5268 0.90 0.70 0.96 139 TooManyTo_005 5203 0.82 0.34 0.94 140 USER_IN_DEF_DKIM_WL 5190 0.74 0.00 0.94 141 XM_OfRef6 4965 1.26 2.58 0.90 142 NML_ADSP_CUSTOM_MED 4787 0.80 0.53 0.87 143 RCVD_IN_MSPIKE_L4 4686 0.84 0.80 0.85 144 RCVD_IN_BL_SPAMCOP_NET 4439 1.81 5.50 0.81 145 XMBody_17 4381 1.47 3.94 0.79 146 XMGenDplmaNmb 4258 0.89 1.32 0.77 147 SpammyFromTLD_01 4213 1.11 2.36 0.76 148 HTTPS_HTTP_MISMATCH 4178 0.77 0.80 0.76 149 XMSexyCombo_01 4154 1.14 2.56 0.75 150 XMSubMetaSxObfu_03 4070 0.86 1.31 0.74 151 XMBrknScrpt_02 3989 0.77 0.94 0.72 152 TR_MetaPhish_Combo_01 3906 0.74 0.88 0.71 153 TR_LOTS_OF_MONEY3 3892 1.39 3.91 0.71 154 TR_MSPIKEBAYES00 3841 0.55 0.00 0.70 155 XM_ProductURIs 3837 0.73 0.87 0.70 156 XMHTML_After_End 3722 1.34 3.77 0.68 157 XM_ShortIntro_01 3598 0.57 0.28 0.65 158 XMMoneyMeta_00 3517 0.82 1.47 0.64 159 T_OBFU_PDF_ATTACH 3447 0.54 0.21 0.63 160 FROM_GOV_DKIM_AU 3444 0.51 0.10 0.62 161 RCVD_IN_MSPIKE_L3 3250 1.11 3.03 0.59 162 XMSubMetaI_00 3199 0.61 0.72 0.58 163 T_TooManySym_03 3148 0.51 0.29 0.57 164 RELAYCOUNTRY_DE 3022 0.83 1.84 0.55 165 XM_H_PHPMailer 2899 0.65 1.11 0.53 166 XM_SPF_Unknown 2833 0.61 0.96 0.51 167 RCVD_IN_SORBS_DUL 2754 0.42 0.12 0.50 168 XM_DIRTYINTL 2735 0.94 2.56 0.50 169 MISSING_HEADERS 2730 0.49 0.47 0.50 170 T_XMDrugObfuBody_00 2723 0.69 1.41 0.49 171 TR_XM_PHPDW 2650 0.80 1.97 0.48 172 TR_XM_FormFill2 2590 0.78 1.92 0.47 173 TR_XM_PHPForged 2587 0.78 1.94 0.47 174 XM_H_PHPOS 2552 0.77 1.91 0.46 175 XMSexyCombo_04 2539 0.55 0.88 0.46 176 PDS_OTHER_BAD_TLD 2503 1.09 3.40 0.45 177 FORGED_GMAIL_RCVD 2462 0.46 0.53 0.45 178 T_Symld_Words_02 2425 0.51 0.75 0.44 179 XMNoVowels 2424 0.44 0.45 0.44 180 PLING_QUERY 2384 0.53 0.91 0.43 181 FROM_GOV_SPOOF 2372 0.38 0.19 0.43 182 HTML_IMAGE_ONLY_20 2355 0.41 0.35 0.43 183 T_XMHurry_00 2343 0.87 2.48 0.43 184 XMPhish08 2333 0.48 0.70 0.42 185 DKIM_ADSP_NXDOMAIN 2331 0.67 1.59 0.42 186 TM2_M_BODY_EMPTY 2298 0.36 0.13 0.42 187 RELAYCOUNTRY_AU 2211 0.51 0.91 0.40 188 SHORT_HELO_AND_INLINE_IMAGE 2181 0.34 0.12 0.40 189 T_MANY_PILL_PRICE 2127 0.32 0.09 0.39 190 XMPhish30 2116 0.53 1.04 0.38 191 URI_NOVOWEL 2079 0.52 1.03 0.38 192 XMHTMLBadTable_001 2071 0.41 0.55 0.38 193 XMPhish14 2029 0.44 0.73 0.37 194 XM_RXBody 2020 0.41 0.58 0.37 195 XM_B_REG_HTML 2008 0.36 0.35 0.36 196 HTML_IMAGE_ONLY_28 1973 0.34 0.27 0.36 197 XMDateMe_00 1964 0.35 0.35 0.36 198 SpammyFromTLD_02 1936 0.89 2.84 0.35 199 TM2_M_A_HREF_HREF 1936 0.42 0.67 0.35 200 HTML_IMAGE_ONLY_32 1931 0.31 0.18 0.35 ----------------------------------------------------------------------