Email: 647204 Autolearn: 0 AvgScore: -0.10 AvgScanTime: 2.02 sec Spam: 86341 Autolearn: 0 AvgScore: 11.81 AvgScanTime: 3.05 sec Ham: 560863 Autolearn: 0 AvgScore: -1.94 AvgScanTime: 1.86 sec Time Spent Running SA: 362.85 hours Time Spent Processing Spam: 73.12 hours Time Spent Processing Ham: 289.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 83892 98.05 97.16 98.18 2 HTML_MESSAGE 80426 89.31 93.15 88.71 3 DKIM_SIGNED 66746 75.95 77.31 75.74 4 XM_DK_Pass 64855 74.66 75.11 74.59 5 RELAYCOUNTRY_US 61288 78.90 70.98 80.11 6 XM_B_Unicode 60260 70.16 69.79 70.22 7 DKIM_VALID 56617 69.34 65.57 69.92 8 XMListUnsubscribeExists 54507 52.90 63.13 51.33 9 XM_DK_Undo_02 42383 14.48 49.09 9.15 10 DKIM_VALID_AU 40837 51.57 47.30 52.22 11 MIME_HTML_ONLY 36071 24.16 41.78 21.45 12 BAYES_99 33256 10.34 38.52 6.00 13 BAYES_50 31011 50.59 35.92 52.85 14 XM_B_Unicode3 30271 39.19 35.06 39.83 15 DKIM_VALID_EF 29204 27.86 33.82 26.94 16 BAYES_999 26517 8.14 30.71 4.67 17 RELAYCOUNTRY_META 26475 9.46 30.66 6.20 18 LOC_TINY_FONT_1 24852 24.76 28.78 24.15 19 XM_UncommonTLD01 22121 6.70 25.62 3.79 20 HTML_FONT_LOW_CONTRAST 20392 27.54 23.62 28.15 21 FVGT_m_MULTI_ODD 20385 22.72 23.61 22.58 22 BOTNET 20384 5.20 23.61 2.36 23 XMSubLong 20031 20.89 23.20 20.54 24 T_KAM_HTML_FONT_INVALID 18808 19.14 21.78 18.73 25 RCVD_IN_MSPIKE_H2 17993 19.14 20.84 18.88 26 T_TM2_M_HEADER_IN_MSG 17636 27.01 20.43 28.02 27 UNTRUSTED_Relay 17494 4.80 20.26 2.42 28 BOTNET_IPINHOSTNAME 16114 6.59 18.66 4.74 29 XM_Body_Dirty_Words 14133 13.87 16.37 13.48 30 XM_Multi_Part_URI 12955 12.32 15.00 11.91 31 LOTS_OF_MONEY 12516 9.70 14.50 8.97 32 XM_B_Phish_Phrases 10696 7.95 12.39 7.26 33 DKIM_INVALID 10129 6.61 11.73 5.82 34 HTML_IMAGE_RATIO_02 9752 8.10 11.29 7.61 35 XM_B_Unsub 9412 10.07 10.90 9.94 36 XM_CamelCaseFrm001 9051 3.59 10.48 2.53 37 KHOP_HELO_FCRDNS 8688 3.08 10.06 2.01 38 XMSexyCombo_05 7760 4.72 8.99 4.06 39 RCVD_IN_MSPIKE_BL 7671 2.75 8.88 1.81 40 T_REMOTE_IMAGE 7617 4.54 8.82 3.89 41 XM_Evil_Numbers_Gen 7617 8.50 8.82 8.45 42 URIBL_SBL_A 7245 1.46 8.39 0.39 43 SpammyFromTLD_02 7186 1.40 8.32 0.34 44 TR_XM_MaxBayes 6921 1.12 8.02 0.06 45 XM_B_COVIDMETA 6833 3.14 7.91 2.41 46 LotsOfNums_01 6662 8.63 7.72 8.77 47 BAYES_80 6362 4.34 7.37 3.87 48 RELAYCOUNTRY_CA 6266 2.42 7.26 1.67 49 XM_UB50 6119 2.11 7.09 1.34 50 NO_DNS_FOR_FROM 5926 3.03 6.86 2.44 51 TR_Mismatch_TLD_02 5630 0.94 6.52 0.08 52 XMSubMetaSx_00 5590 3.89 6.47 3.49 53 RCVD_IN_MSPIKE_L3 5392 2.34 6.25 1.74 54 TR_XM_COVIDMETA4 5360 2.24 6.21 1.63 55 XM_SPF_SoftFail 5212 2.39 6.04 1.83 56 BAYES_60 5123 6.08 5.93 6.10 57 RDNS_DYNAMIC 5016 1.21 5.81 0.51 58 TR_XM_PhishingBody 4994 3.75 5.78 3.44 59 XM_H_Long_From01 4777 5.64 5.53 5.65 60 BODY_URI_ONLY 4358 0.89 5.05 0.25 61 MPART_ALT_DIFF 4333 4.89 5.02 4.87 62 TooManyTo_001 4298 8.28 4.98 8.79 63 HTML_MIME_NO_HTML_TAG 4255 2.85 4.93 2.53 64 NO_FM_NAME_IP_HOSTN 4185 0.65 4.85 0.01 65 RELAYCOUNTRY_FR 4151 0.99 4.81 0.40 66 XMHTML_After_End 4088 1.33 4.73 0.80 67 UNPARSEABLE_RELAY 3989 6.64 4.62 6.95 68 TR_LOTS_OF_MONEY3 3950 1.36 4.57 0.86 69 XM_URI_RBL 3940 0.81 4.56 0.23 70 RCVD_IN_BL_SPAMCOP_NET 3934 1.50 4.56 1.03 71 DATE_IN_PAST_03_06 3855 0.72 4.46 0.15 72 XMNumbers 3854 3.65 4.46 3.53 73 XM_B_SpammyTLD 3791 2.22 4.39 1.88 74 XMBody_17 3742 1.38 4.33 0.92 75 MISSING_HEADERS 3686 1.28 4.27 0.82 76 HTML_IMAGE_RATIO_04 3644 4.75 4.22 4.83 77 HDRS_MISSP 3590 0.63 4.16 0.08 78 RELAYCOUNTRY_IN 3544 0.68 4.10 0.15 79 BAYES_95 3542 2.53 4.10 2.29 80 SpammyFromTLD_01 3516 1.30 4.07 0.88 81 RCVD_IN_MSPIKE_WL 3447 15.96 3.99 17.80 82 XM_UB99 3418 0.53 3.96 0.01 83 DKIM_ADSP_NXDOMAIN 3382 0.74 3.92 0.25 84 XM_OfRef6 3381 1.49 3.92 1.12 85 T_XMDrugObfuBody_08 3348 1.91 3.88 1.60 86 XM_SendGrid 3278 6.01 3.80 6.36 87 XMStrtUSub 3264 4.42 3.78 4.51 88 XM_B_Phish66 3142 2.17 3.64 1.94 89 TR_XM_INV_DKIM 3137 0.58 3.63 0.11 90 MIME_QP_LONG_LINE 3117 5.85 3.61 6.19 91 REPLYTO_WITHOUT_TO_CC 3072 0.73 3.56 0.30 92 TM2_M_URI_OPT_OUT 3053 3.29 3.54 3.25 93 XM_DIRTYINTL 3016 0.95 3.49 0.56 94 URI_NOVOWEL 2834 0.81 3.28 0.43 95 FROM_SUSPICIOUS_NTLD 2748 0.58 3.18 0.18 96 MIME_HTML_MOSTLY 2724 2.72 3.15 2.65 97 FROM_SUSPICIOUS_NTLD_FP 2720 0.57 3.15 0.17 98 HTML_IMAGE_RATIO_06 2691 3.55 3.12 3.62 99 TR_XM_MaxSPIKE 2672 0.52 3.09 0.13 100 HTML_SHORT_LINK_IMG_1 2645 0.42 3.06 0.02 101 MIME_HEADER_CTYPE_ONLY 2634 0.65 3.05 0.28 102 FROM_EXCESS_BASE64 2616 2.87 3.03 2.85 103 PDS_OTHER_BAD_TLD 2566 0.93 2.97 0.61 104 BAYES_40 2562 5.51 2.97 5.90 105 XM_JunkDunk 2555 0.40 2.96 0.00 106 TR_XM_PHPForged 2492 0.83 2.89 0.51 107 TR_XM_PHPDW 2491 0.84 2.89 0.53 108 HDRS_LCASE_IMGONLY 2480 0.39 2.87 0.01 109 TR_XM_FormFill2 2450 0.82 2.84 0.51 110 XM_H_PHPOS 2439 0.81 2.82 0.50 111 HTML_TITLE_SUBJ_DIFF 2406 0.49 2.79 0.14 112 XM_UB80 2388 0.41 2.77 0.04 113 HTML_IMAGE_ONLY_08 2365 0.48 2.74 0.14 114 XM_UB999 2288 0.36 2.65 0.00 115 BOTNET_NORDNS 2229 0.36 2.58 0.01 116 HTML_IMAGE_RATIO_08 2223 2.42 2.57 2.39 117 LongTLD 2166 0.60 2.51 0.30 118 XMMoneyMeta_00 2150 0.96 2.49 0.73 119 XMSubNoVowel 2109 1.06 2.44 0.85 120 XM_B_Unsub2 2073 1.98 2.40 1.92 121 TR_XM_COVIDMETA1 2067 0.69 2.39 0.43 122 BAYES_20 2037 3.96 2.36 4.21 123 RCVD_IN_RP_RNBL 1990 0.37 2.30 0.07 124 RCVD_IN_MSPIKE_H3 1964 8.62 2.27 9.60 125 TR_XM_RelayPhish 1916 0.46 2.22 0.19 126 DATE_IN_PAST_06_12 1911 0.49 2.21 0.23 127 XMSubEmpty 1910 0.52 2.21 0.25 128 TR_LOTS_OF_MONEY1 1852 0.52 2.14 0.27 129 XMSexyCombo_01 1844 0.73 2.14 0.51 130 T_TooManySym_01 1833 4.22 2.12 4.54 131 T_XMHurry_00 1821 0.91 2.11 0.72 132 XM_ShortIntro_01 1771 1.20 2.05 1.07 133 RELAYCOUNTRY_GB 1716 1.29 1.99 1.19 134 TM2_M_VERY_LONG_WORD 1695 1.41 1.96 1.33 135 TR_XM_DK_SendGrid 1678 3.26 1.94 3.46 136 SUBJ_ALL_CAPS 1673 1.53 1.94 1.47 137 XM_UB60 1640 0.38 1.90 0.15 138 T_HTML_TAG_BALANCE_CENTER 1628 0.59 1.89 0.40 139 T_XMDrugObfuBody_14 1598 1.63 1.85 1.59 140 RELAYCOUNTRY_DE 1582 0.68 1.83 0.50 141 ALL_TRUSTED 1557 13.64 1.80 15.46 142 BAYES_00 1544 14.21 1.79 16.12 143 URI_HEX 1508 1.39 1.75 1.33 144 FILL_THIS_FORM 1489 0.64 1.72 0.47 145 RCVD_IN_MSPIKE_H4 1467 7.25 1.70 8.10 146 XMDiploma_00 1463 1.67 1.69 1.66 147 RCVD_IN_PSBL 1448 0.24 1.68 0.02 148 DKIM_ADSP_CUSTOM_MED 1430 1.32 1.66 1.27 149 XM_UB95 1370 0.23 1.59 0.02 150 TR_Symld_Words 1338 1.81 1.55 1.85 151 XMStockSpam_06 1308 1.24 1.51 1.20 152 MIME_HTML_ONLY_MULTI 1279 2.69 1.48 2.87 153 TR_Mismatch_TLD_01 1242 0.35 1.44 0.18 154 NML_ADSP_CUSTOM_MED 1220 1.02 1.41 0.96 155 TR_XM_COVIDMETA3 1201 0.22 1.39 0.04 156 RCVD_IN_MSPIKE_L4 1196 0.21 1.39 0.03 157 DIET_1 1186 0.55 1.37 0.42 158 XM_H_PHPMailer 1136 0.63 1.32 0.52 159 HK_RANDOM_REPLYTO 1135 0.34 1.31 0.20 160 DATE_IN_PAST_12_24 1115 0.24 1.29 0.08 161 XM_DK_Undo_01 1106 1.81 1.28 1.90 162 XM_HighProb1 1106 0.18 1.28 0.01 163 RELAYCOUNTRY_MX 1105 0.19 1.28 0.02 164 T_FILL_THIS_FORM_SHORT 1104 1.46 1.28 1.48 165 URIBL_BLACK 1103 0.20 1.28 0.03 166 FORGED_GMAIL_RCVD 1097 0.64 1.27 0.54 167 RCVD_IN_MSPIKE_L5 1083 0.20 1.25 0.04 168 RCVD_IN_IADB_LISTED 1057 4.64 1.22 5.16 169 XMGenDplmaNmb 1046 0.96 1.21 0.92 170 URIBL_DBL_SPAM 1006 0.16 1.17 0.01 171 T_XMDrugObfuBody_00 986 0.74 1.14 0.68 172 MAILING_LIST_MULTI 950 2.14 1.10 2.30 173 XM_H_PHPOS_M 930 0.33 1.08 0.21 174 XM_ProductURIs 924 1.20 1.07 1.22 175 XM_OfRef7 916 0.28 1.06 0.16 176 RCVD_IN_IADB_SPF 916 4.04 1.06 4.50 177 URI_TRY_3LD 907 1.51 1.05 1.58 178 BAYES_05 902 2.45 1.04 2.67 179 HELO_NODOT 894 0.78 1.04 0.74 180 HELO_NO_DOMAIN 894 0.78 1.04 0.74 181 XMSubMetaSxObfu_03 889 0.51 1.03 0.43 182 XMPhish08 883 0.52 1.02 0.44 183 DEAR_FRIEND 883 0.22 1.02 0.10 184 XMReplyNow 868 0.26 1.01 0.14 185 RCVD_IN_IADB_SENDERID 864 3.58 1.00 3.97 186 RCVD_IN_IADB_DK 857 3.52 0.99 3.91 187 XMSexyCombo_04 818 0.22 0.95 0.11 188 RELAYCOUNTRY_AT 807 0.30 0.93 0.21 189 XMBody_78 791 0.41 0.92 0.34 190 HTTPS_HTTP_MISMATCH 780 0.81 0.90 0.79 191 XMSubMetaSSxObfu_00 780 0.13 0.90 0.02 192 XMSlimDrugH 760 0.41 0.88 0.34 193 T_TooManySym_02 759 1.94 0.88 2.10 194 TR_LOTS_OF_MONEY2 747 0.36 0.87 0.28 195 T_MONEY_PERCENT 747 0.36 0.87 0.28 196 LOCALPART_IN_SUBJECT 729 0.14 0.84 0.03 197 RELAYCOUNTRY_IT 718 0.17 0.83 0.07 198 TooManyTo_002 718 2.09 0.83 2.28 199 TR_Caps_n_Bayes_99 706 0.20 0.82 0.11 200 TM2_M_A_HREF_HREF 678 0.40 0.79 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 550678 98.05 97.16 98.18 2 HTML_MESSAGE 497564 89.31 93.15 88.71 3 RELAYCOUNTRY_US 449332 78.90 70.98 80.11 4 DKIM_SIGNED 424784 75.95 77.31 75.74 5 XM_DK_Pass 418338 74.66 75.11 74.59 6 XM_B_Unicode 393817 70.16 69.79 70.22 7 DKIM_VALID 392138 69.34 65.57 69.92 8 BAYES_50 296393 50.59 35.92 52.85 9 DKIM_VALID_AU 292899 51.57 47.30 52.22 10 XMListUnsubscribeExists 287881 52.90 63.13 51.33 11 XM_B_Unicode3 223389 39.19 35.06 39.83 12 HTML_FONT_LOW_CONTRAST 157875 27.54 23.62 28.15 13 T_TM2_M_HEADER_IN_MSG 157158 27.01 20.43 28.02 14 DKIM_VALID_EF 151078 27.86 33.82 26.94 15 LOC_TINY_FONT_1 135422 24.76 28.78 24.15 16 FVGT_m_MULTI_ODD 126666 22.72 23.61 22.58 17 MIME_HTML_ONLY 120297 24.16 41.78 21.45 18 XMSubLong 115188 20.89 23.20 20.54 19 RCVD_IN_MSPIKE_H2 105886 19.14 20.84 18.88 20 T_KAM_HTML_FONT_INVALID 105047 19.14 21.78 18.73 21 RCVD_IN_MSPIKE_WL 99835 15.96 3.99 17.80 22 BAYES_00 90395 14.21 1.79 16.12 23 ALL_TRUSTED 86733 13.64 1.80 15.46 24 XM_Body_Dirty_Words 75631 13.87 16.37 13.48 25 XM_Multi_Part_URI 66780 12.32 15.00 11.91 26 TR_XM_DK_Bayes 60217 9.38 0.59 10.74 27 XM_B_Unsub 55743 10.07 10.90 9.94 28 TR_XM_DK_Bayes1 55695 8.67 0.45 9.93 29 RCVD_IN_MSPIKE_H3 53834 8.62 2.27 9.60 30 XM_DK_Undo_02 51343 14.48 49.09 9.15 31 LOTS_OF_MONEY 50291 9.70 14.50 8.97 32 TooManyTo_001 49303 8.28 4.98 8.79 33 LotsOfNums_01 49208 8.63 7.72 8.77 34 TR_XM_DK_Bayes2 48605 7.55 0.27 8.67 35 XM_Evil_Numbers_Gen 47405 8.50 8.82 8.45 36 RCVD_IN_MSPIKE_H4 45424 7.25 1.70 8.10 37 HTML_IMAGE_RATIO_02 42690 8.10 11.29 7.61 38 RCVD_IN_RP_SAFE 42056 6.59 0.66 7.50 39 XM_B_Phish_Phrases 40725 7.95 12.39 7.26 40 XM_DKIMWhitelistDomains 40176 6.21 0.01 7.16 41 UNPARSEABLE_RELAY 38965 6.64 4.62 6.95 42 RCVD_IN_RP_CERTIFIED 38281 5.98 0.52 6.83 43 XM_SendGrid 35651 6.01 3.80 6.36 44 RELAYCOUNTRY_META 34759 9.46 30.66 6.20 45 MIME_QP_LONG_LINE 34727 5.85 3.61 6.19 46 BAYES_60 34214 6.08 5.93 6.10 47 BAYES_99 33669 10.34 38.52 6.00 48 BAYES_40 33098 5.51 2.97 5.90 49 DKIM_INVALID 32646 6.61 11.73 5.82 50 XM_H_Long_From01 31698 5.64 5.53 5.65 51 IN_ZIMBRA_NJ_WHITELIST 29942 4.63 0.03 5.34 52 RCVD_IN_IADB_LISTED 28957 4.64 1.22 5.16 53 MPART_ALT_DIFF 27294 4.89 5.02 4.87 54 HTML_IMAGE_RATIO_04 27084 4.75 4.22 4.83 55 BOTNET_IPINHOSTNAME 26568 6.59 18.66 4.74 56 BAYES_999 26184 8.14 30.71 4.67 57 XM_PDF 25692 4.07 0.78 4.58 58 T_TooManySym_01 25454 4.22 2.12 4.54 59 XMStrtUSub 25322 4.42 3.78 4.51 60 RCVD_IN_IADB_SPF 25246 4.04 1.06 4.50 61 BAYES_20 23592 3.96 2.36 4.21 62 XMSexyCombo_05 22779 4.72 8.99 4.06 63 RCVD_IN_IADB_SENDERID 22292 3.58 1.00 3.97 64 RCVD_IN_IADB_DK 21921 3.52 0.99 3.91 65 T_REMOTE_IMAGE 21791 4.54 8.82 3.89 66 BAYES_80 21699 4.34 7.37 3.87 67 XM_UncommonTLD01 21232 6.70 25.62 3.79 68 HTML_IMAGE_RATIO_06 20301 3.55 3.12 3.62 69 XMNumbers 19796 3.65 4.46 3.53 70 XMSubMetaSx_00 19582 3.89 6.47 3.49 71 TR_XM_DK_SendGrid 19408 3.26 1.94 3.46 72 TR_XM_PhishingBody 19296 3.75 5.78 3.44 73 RCVD_IN_IADB_VOUCHED 18991 3.02 0.63 3.39 74 TM2_M_URI_OPT_OUT 18253 3.29 3.54 3.25 75 MIME_HTML_ONLY_MULTI 16103 2.69 1.48 2.87 76 FROM_EXCESS_BASE64 15967 2.87 3.03 2.85 77 ANY_BOUNCE_MESSAGE 15956 2.54 0.55 2.84 78 BOUNCE_MESSAGE 15955 2.54 0.55 2.84 79 BAYES_05 14981 2.45 1.04 2.67 80 MIME_HTML_MOSTLY 14883 2.72 3.15 2.65 81 XM_CamelCaseFrm001 14209 3.59 10.48 2.53 82 HTML_MIME_NO_HTML_TAG 14205 2.85 4.93 2.53 83 NO_DNS_FOR_FROM 13659 3.03 6.86 2.44 84 UNTRUSTED_Relay 13566 4.80 20.26 2.42 85 XM_B_COVIDMETA 13513 3.14 7.91 2.41 86 HTML_IMAGE_RATIO_08 13423 2.42 2.57 2.39 87 BOTNET 13252 5.20 23.61 2.36 88 MAILING_LIST_MULTI 12889 2.14 1.10 2.30 89 BAYES_95 12821 2.53 4.10 2.29 90 TooManyTo_002 12809 2.09 0.83 2.28 91 XM_H_Trusted_IP 12601 1.95 0.00 2.25 92 T_TooManySym_02 11786 1.94 0.88 2.10 93 TVD_RCVD_IP 11285 1.78 0.28 2.01 94 KHOP_HELO_FCRDNS 11258 3.08 10.06 2.01 95 RCVD_IN_IADB_OPTIN 11245 1.79 0.39 2.00 96 XM_B_Phish66 10898 2.17 3.64 1.94 97 XM_B_Unsub2 10747 1.98 2.40 1.92 98 XM_DK_Undo_01 10636 1.81 1.28 1.90 99 XM_B_SpammyTLD 10558 2.22 4.39 1.88 100 TR_Symld_Words 10358 1.81 1.55 1.85 101 XM_SPF_SoftFail 10246 2.39 6.04 1.83 102 RCVD_IN_MSPIKE_BL 10151 2.75 8.88 1.81 103 RCVD_IN_MSPIKE_L3 9759 2.34 6.25 1.74 104 RELAYCOUNTRY_CA 9370 2.42 7.26 1.67 105 XMDiploma_00 9337 1.67 1.69 1.66 106 TooManyTo_003 9151 1.51 0.68 1.63 107 TR_XM_COVIDMETA4 9119 2.24 6.21 1.63 108 T_XMDrugObfuBody_08 8984 1.91 3.88 1.60 109 T_XMDrugObfuBody_14 8922 1.63 1.85 1.59 110 URI_TRY_3LD 8853 1.51 1.05 1.58 111 T_FILL_THIS_FORM_SHORT 8320 1.46 1.28 1.48 112 SUBJ_ALL_CAPS 8225 1.53 1.94 1.47 113 IN_HORDE_ADDRESS_BOOK 7990 1.24 0.05 1.42 114 INVALID_MSGID 7826 1.23 0.15 1.40 115 XM_UB50 7533 2.11 7.09 1.34 116 URI_HEX 7471 1.39 1.75 1.33 117 TM2_M_VERY_LONG_WORD 7455 1.41 1.96 1.33 118 HELO_MISC_IP 7382 1.17 0.23 1.32 119 CK_HELO_DYNAMIC_SPLIT_IP 7371 1.18 0.30 1.31 120 USER_IN_DEF_DKIM_WL 7316 1.13 0.00 1.30 121 DKIM_ADSP_CUSTOM_MED 7138 1.32 1.66 1.27 122 TO_MALFORMED 7072 1.10 0.02 1.26 123 XM_GoogleGroups 7068 1.14 0.38 1.26 124 XMCapTrack 6989 1.14 0.49 1.25 125 XM_ProductURIs 6868 1.20 1.07 1.22 126 TooManyTo_004 6865 1.14 0.58 1.22 127 XMStockSpam_06 6713 1.24 1.51 1.20 128 RELAYCOUNTRY_GB 6652 1.29 1.99 1.19 129 XMBdyGiftCard01 6347 1.06 0.58 1.13 130 XM_OfRef6 6288 1.49 3.92 1.12 131 XM_ShortIntro_01 5992 1.20 2.05 1.07 132 TooManyTo_005 5834 0.96 0.42 1.04 133 RCVD_IN_BL_SPAMCOP_NET 5792 1.50 4.56 1.03 134 XM_H_Long_From02 5642 0.97 0.73 1.01 135 NML_ADSP_CUSTOM_MED 5362 1.02 1.41 0.96 136 XMGappySubj_01 5264 0.83 0.13 0.94 137 XMGenDplmaNmb 5187 0.96 1.21 0.92 138 XMBody_17 5162 1.38 4.33 0.92 139 XM_SPF_Unknown 5143 0.89 0.72 0.92 140 SpammyFromTLD_01 4928 1.30 4.07 0.88 141 HTML_FONT_FACE_BAD 4879 0.83 0.55 0.87 142 TR_LOTS_OF_MONEY3 4837 1.36 4.57 0.86 143 XMSubNoVowel 4746 1.06 2.44 0.85 144 MISSING_HEADERS 4595 1.28 4.27 0.82 145 XMHTML_After_End 4496 1.33 4.73 0.80 146 XMBrknScrpt_02 4493 0.80 0.78 0.80 147 HTTPS_HTTP_MISMATCH 4430 0.81 0.90 0.79 148 HELO_NODOT 4131 0.78 1.04 0.74 149 HELO_NO_DOMAIN 4129 0.78 1.04 0.74 150 XMSubMetaI_00 4106 0.72 0.63 0.73 151 XMMoneyMeta_00 4081 0.96 2.49 0.73 152 T_XMHurry_00 4040 0.91 2.11 0.72 153 THIS_AD 4010 0.71 0.66 0.71 154 TR_MetaPhish_Combo_01 3925 0.70 0.70 0.70 155 XMDateMe_00 3866 0.63 0.26 0.69 156 T_XMDrugObfuBody_00 3826 0.74 1.14 0.68 157 TR_MSPIKEBAYES00 3676 0.57 0.01 0.66 158 T_OBFU_PDF_ATTACH 3637 0.59 0.18 0.65 159 T_TooManySym_03 3518 0.58 0.25 0.63 160 PDS_OTHER_BAD_TLD 3448 0.93 2.97 0.61 161 XMNoVowels 3279 0.57 0.48 0.58 162 XMPhish30 3192 0.57 0.57 0.57 163 XM_DIRTYINTL 3143 0.95 3.49 0.56 164 XM_E_Blogspot 3056 0.49 0.14 0.54 165 FORGED_GMAIL_RCVD 3017 0.64 1.27 0.54 166 TR_XM_PHPDW 2951 0.84 2.89 0.53 167 XM_H_PHPMailer 2934 0.63 1.32 0.52 168 XMHTMLBadTable_001 2916 0.49 0.30 0.52 169 T_Symld_Words_02 2916 0.54 0.68 0.52 170 TR_XM_PHPForged 2872 0.83 2.89 0.51 171 XMSexyCombo_01 2867 0.73 2.14 0.51 172 TR_XM_FormFill2 2857 0.82 2.84 0.51 173 RDNS_DYNAMIC 2845 1.21 5.81 0.51 174 XM_H_PHPOS 2828 0.81 2.82 0.50 175 RELAYCOUNTRY_DE 2807 0.68 1.83 0.50 176 HTML_IMAGE_ONLY_20 2758 0.48 0.37 0.49 177 XMPhish14 2732 0.52 0.73 0.49 178 TM2_M_BODY_EMPTY 2645 0.43 0.19 0.47 179 FILL_THIS_FORM 2621 0.64 1.72 0.47 180 FROM_GOV_DKIM_AU 2596 0.41 0.09 0.46 181 XMPhish08 2456 0.52 1.02 0.44 182 XMSubMetaSxObfu_03 2436 0.51 1.03 0.43 183 URI_NOVOWEL 2423 0.81 3.28 0.43 184 HTML_IMAGE_ONLY_28 2401 0.43 0.42 0.43 185 TR_XM_COVIDMETA1 2396 0.69 2.39 0.43 186 HTML_IMAGE_ONLY_32 2394 0.39 0.17 0.43 187 DIET_1 2379 0.55 1.37 0.42 188 XM_B_REG_HTML 2320 0.39 0.22 0.41 189 HTML_TAG_BALANCE_BODY 2313 0.43 0.52 0.41 190 RELAYCOUNTRY_FR 2255 0.99 4.81 0.40 191 MPART_ALT_DIFF_COUNT 2238 0.45 0.77 0.40 192 XM_RXBody 2218 0.42 0.58 0.40 193 T_HTML_TAG_BALANCE_CENTER 2216 0.59 1.89 0.40 194 URIBL_SBL_A 2176 1.46 8.39 0.39 195 XMOemUri 2169 0.38 0.32 0.39 196 FROM_GOV_SPOOF 2158 0.37 0.25 0.38 197 PLING_QUERY 2126 0.40 0.52 0.38 198 XM_B_COPY_HTML 2120 0.38 0.36 0.38 199 XMBSHREFv2 2119 0.40 0.54 0.38 200 RELAYCOUNTRY_AU 2068 0.38 0.45 0.37 ----------------------------------------------------------------------