Email: 681973 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 1.74 sec Spam: 107883 Autolearn: 0 AvgScore: 12.21 AvgScanTime: 3.04 sec Ham: 574090 Autolearn: 0 AvgScore: -2.13 AvgScanTime: 1.50 sec Time Spent Running SA: 329.70 hours Time Spent Processing Spam: 91.09 hours Time Spent Processing Ham: 238.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 105552 98.19 97.84 98.26 2 HTML_MESSAGE 101860 87.67 94.42 86.40 3 DKIM_SIGNED 67536 70.72 62.60 72.24 4 RELAYCOUNTRY_US 66388 76.94 61.54 79.83 5 XM_DK_Pass 65373 69.55 60.60 71.23 6 XM_B_Unicode 64086 64.73 59.40 65.73 7 DKIM_VALID 54886 64.47 50.88 67.02 8 XMListUnsubscribeExists 54722 46.43 50.72 45.62 9 BAYES_50 47463 50.41 43.99 51.61 10 XM_DK_Undo_02 42360 14.99 39.26 10.43 11 MIME_HTML_ONLY 41295 24.35 38.28 21.73 12 DKIM_VALID_AU 40865 47.94 37.88 49.83 13 RELAYCOUNTRY_META 35385 9.75 32.80 5.42 14 BAYES_99 34658 10.68 32.13 6.65 15 UNTRUSTED_Relay 33110 6.29 30.69 1.70 16 XM_B_Unicode3 31877 35.72 29.55 36.88 17 DKIM_VALID_EF 30552 27.74 28.32 27.64 18 XMSubLong 29993 21.59 27.80 20.43 19 BOTNET 28276 6.64 26.21 2.97 20 BAYES_999 27944 8.53 25.90 5.27 21 LOC_TINY_FONT_1 26724 22.54 24.77 22.13 22 FVGT_m_MULTI_ODD 26130 21.01 24.22 20.41 23 T_TM2_M_HEADER_IN_MSG 24043 27.54 22.29 28.52 24 RCVD_IN_MSPIKE_H2 22708 23.36 21.05 23.80 25 LOTS_OF_MONEY 22493 10.02 20.85 7.98 26 HTML_FONT_LOW_CONTRAST 22364 23.80 20.73 24.38 27 XM_Body_Dirty_Words 21634 13.68 20.05 12.48 28 T_KAM_HTML_FONT_INVALID 19677 17.54 18.24 17.41 29 XM_UncommonTLD01 16198 5.37 15.01 3.55 30 XMSexyCombo_05 15998 5.51 14.83 3.76 31 XM_UB50 15955 3.20 14.79 1.03 32 HELO_NODOT 15682 3.66 14.54 1.62 33 HELO_NO_DOMAIN 15682 3.66 14.54 1.62 34 XM_Multi_Part_URI 15085 12.41 13.98 12.11 35 MISSING_HEADERS 15084 2.68 13.98 0.55 36 RCVD_IN_MSPIKE_BL 15038 2.62 13.94 0.49 37 REPLYTO_WITHOUT_TO_CC 14823 2.24 13.74 0.08 38 XM_OfRef6 14663 2.99 13.59 1.00 39 BOTNET_IPINHOSTNAME 14184 5.90 13.15 4.53 40 HTML_MIME_NO_HTML_TAG 13942 4.60 12.92 3.04 41 SUBJ_ALL_CAPS 12953 2.97 12.01 1.27 42 DKIM_INVALID 12650 6.25 11.73 5.22 43 XM_Evil_Numbers_Gen 10955 9.67 10.15 9.58 44 HTML_IMAGE_RATIO_02 10519 6.85 9.75 6.30 45 NO_DNS_FOR_FROM 10513 4.18 9.74 3.14 46 XM_B_Unsub 10415 12.20 9.65 12.68 47 T_REMOTE_IMAGE 10151 4.98 9.41 4.14 48 XM_B_Phish_Phrases 9776 7.65 9.06 7.39 49 BODY_URI_ONLY 9225 1.50 8.55 0.18 50 BAYES_80 9167 4.48 8.50 3.72 51 LotsOfNums_01 8947 8.12 8.29 8.08 52 TR_LOTS_OF_MONEY3 8812 1.70 8.17 0.48 53 BOTNET_NORDNS 8643 1.29 8.01 0.03 54 TR_XM_PhishingBody 8534 4.04 7.91 3.31 55 TR_LOTS_OF_MONEY1 8523 1.28 7.90 0.04 56 XM_DIRTYINTL 8290 1.66 7.68 0.52 57 T_TooManySym_01 8107 4.67 7.51 4.14 58 XM_UB99 7825 1.15 7.25 0.01 59 T_HTML_TAG_BALANCE_CENTER 7811 1.36 7.24 0.26 60 FROM_EXCESS_BASE64 7745 3.16 7.18 2.40 61 RCVD_IN_MSPIKE_WL 7682 20.73 7.12 23.29 62 XM_OfRef7 7284 1.21 6.75 0.17 63 FILL_THIS_FORM 7201 1.25 6.67 0.24 64 RCVD_IN_BL_SPAMCOP_NET 6548 1.87 6.07 1.09 65 XMSubMetaSx_00 6517 3.94 6.04 3.54 66 RCVD_IN_RP_RNBL 6478 1.02 6.00 0.09 67 BAYES_60 6477 5.82 6.00 5.79 68 FILL_THIS_FORM_LONG 6431 1.01 5.96 0.08 69 RELAYCOUNTRY_CA 6428 2.30 5.96 1.61 70 RCVD_IN_MSPIKE_ZBI 6223 0.92 5.77 0.01 71 XM_B_Phish66 6170 2.65 5.72 2.07 72 XM_UB999 6159 0.91 5.71 0.00 73 SpammyFromTLD_01 5969 1.65 5.53 0.92 74 XM_SPF_SoftFail 5960 2.35 5.52 1.75 75 MPART_ALT_DIFF 5867 5.95 5.44 6.04 76 XMBody_17 5705 1.40 5.29 0.67 77 TooManyTo_001 5595 7.98 5.19 8.51 78 RELAYCOUNTRY_FR 5469 1.01 5.07 0.24 79 XM_H_Long_From01 5457 5.29 5.06 5.33 80 XM_DK_Undo_01 5355 2.13 4.96 1.60 81 HDRS_MISSP 5199 0.81 4.82 0.06 82 RCVD_IN_MSPIKE_L3 5143 1.02 4.77 0.31 83 XM_B_COVIDMETA 5032 2.51 4.66 2.11 84 XMSubEmpty 5022 0.97 4.66 0.28 85 TR_Sbj_FN_Bdy 4967 0.91 4.60 0.21 86 SCRIPT_GIBBERISH 4939 0.73 4.58 0.01 87 XM_CamelCaseFrm001 4863 2.28 4.51 1.86 88 RELAYCOUNTRY_UG 4857 0.71 4.50 0.00 89 TR_XM_COVIDMETA4 4729 1.30 4.38 0.72 90 XMNumbers 4624 3.39 4.29 3.22 91 XMNoSubject 4595 0.75 4.26 0.09 92 MISSING_SUBJECT 4595 0.75 4.26 0.09 93 HTML_IMAGE_RATIO_04 4426 5.11 4.10 5.30 94 XM_B_SpammyTLD 4299 2.25 3.98 1.92 95 RCVD_IN_PSBL 4184 0.68 3.88 0.08 96 UNPARSEABLE_RELAY 4184 6.68 3.88 7.20 97 MILLION_HUNDRED 4102 0.61 3.80 0.01 98 MIME_HTML_MOSTLY 4061 2.87 3.76 2.71 99 TR_XM_INV_DKIM 3949 0.69 3.66 0.14 100 RCVD_IN_MSPIKE_H3 3949 11.94 3.66 13.50 101 XMLngstWrd_00 3933 0.86 3.65 0.34 102 T_Symld_Words_02 3767 0.94 3.49 0.46 103 TR_Orig_Subnet 3744 0.56 3.47 0.02 104 SpammyFromTLD_02 3725 0.77 3.45 0.27 105 XM_SendGrid 3708 6.11 3.44 6.61 106 XM_BadFromFormat 3573 0.74 3.31 0.25 107 RCVD_IN_MSPIKE_H4 3523 7.84 3.27 8.70 108 BAYES_95 3506 2.40 3.25 2.24 109 XM_JunkDunk 3500 0.51 3.24 0.00 110 T_DEAR_BENEFICIARY 3474 0.52 3.22 0.01 111 TR_XM_MaxSPIKE 3424 0.52 3.17 0.03 112 TM2_M_URI_OPT_OUT 3409 6.40 3.16 7.00 113 XMStrtUSub 3399 5.86 3.15 6.37 114 URIBL_SBL_A 3374 0.64 3.13 0.17 115 RELAYCOUNTRY_NG_I 3353 0.51 3.11 0.02 116 BAYES_40 3325 5.18 3.08 5.58 117 XM_URI_RBL 3287 0.66 3.05 0.21 118 XM_UB80 3183 0.51 2.95 0.05 119 XM_UCStrings02 3180 0.56 2.95 0.11 120 TR_XM_COVIDMETA1 3124 0.99 2.90 0.63 121 T_PDS_OTHER_BAD_TLD 3093 0.92 2.87 0.56 122 MIME_QP_LONG_LINE 3077 5.26 2.85 5.71 123 ADVANCE_FEE_4_NEW 3072 0.47 2.85 0.02 124 HTML_SHORT_LINK_IMG_1 3072 0.55 2.85 0.12 125 KHOP_HELO_FCRDNS 3068 2.01 2.84 1.85 126 TR_Caps_n_Bayes_80 3034 0.47 2.81 0.03 127 TR_XM_MaxBayes 2993 0.49 2.77 0.07 128 UPPERCASE_75_100 2983 0.46 2.77 0.02 129 T_XMDrugObfuBody_08 2865 1.63 2.66 1.44 130 ADVANCE_FEE_5_NEW 2826 0.42 2.62 0.00 131 LOTTO_DEPT 2819 0.42 2.61 0.00 132 XMLngstWrd_01 2783 0.67 2.58 0.31 133 HTML_IMAGE_ONLY_08 2683 0.56 2.49 0.20 134 RCVD_IN_MSPIKE_L5 2677 0.48 2.48 0.11 135 TR_XM_PHPDW 2638 0.87 2.45 0.58 136 HDRS_LCASE_IMGONLY 2618 0.48 2.43 0.11 137 TR_XM_PHPForged 2613 0.85 2.42 0.56 138 TR_XM_FormFill2 2591 0.85 2.40 0.56 139 XM_H_PHPOS 2578 0.84 2.39 0.55 140 FROM_SUSPICIOUS_NTLD 2552 0.44 2.37 0.07 141 DEAR_FRIEND 2547 0.43 2.36 0.07 142 RELAYCOUNTRY_DE 2538 0.69 2.35 0.37 143 FROM_SUSPICIOUS_NTLD_FP 2514 0.43 2.33 0.07 144 XM_UB60 2442 0.45 2.26 0.11 145 DATE_IN_PAST_06_12 2426 0.47 2.25 0.14 146 HTML_IMAGE_RATIO_06 2412 2.89 2.24 3.02 147 DATE_IN_PAST_03_06 2350 0.44 2.18 0.11 148 MONEY_FORM_SHORT 2179 0.34 2.02 0.02 149 TR_Mismatch_TLD_01 2165 0.50 2.01 0.22 150 XMBrknScrpt_02 2115 1.06 1.96 0.89 151 RELAYCOUNTRY_RU 2104 0.33 1.95 0.03 152 TR_Wstrn_Union 2031 0.30 1.88 0.00 153 T_XMDrugObfuBody_00 1977 0.89 1.83 0.72 154 XM_B_Unsub2 1908 3.66 1.77 4.01 155 HK_SCAM 1866 0.29 1.73 0.02 156 XMSexyCombo_01 1833 0.63 1.70 0.43 157 XMLngstWrd_02 1830 0.47 1.70 0.24 158 LongTLD 1830 0.43 1.70 0.19 159 ALL_TRUSTED 1744 14.19 1.62 16.55 160 TR_XM_RelayPhish 1732 0.37 1.61 0.14 161 XMDiploma_00 1716 1.62 1.59 1.63 162 RELAYCOUNTRY_GB 1670 1.16 1.55 1.09 163 MIME_HTML_ONLY_MULTI 1640 3.59 1.52 3.98 164 T_XMDrugObfuBody_14 1637 1.75 1.52 1.80 165 URI_HEX 1626 1.53 1.51 1.53 166 RELAYCOUNTRY_IN 1589 0.33 1.47 0.11 167 XMSubNoVowel 1576 1.50 1.46 1.50 168 TM2_M_VERY_LONG_WORD 1573 1.22 1.46 1.17 169 TR_Symld_Words 1569 1.79 1.45 1.85 170 DKIM_ADSP_CUSTOM_MED 1547 1.19 1.43 1.15 171 HTML_IMAGE_RATIO_08 1533 1.94 1.42 2.04 172 BAYES_20 1533 3.40 1.42 3.77 173 URI_PHP_REDIR 1474 0.27 1.37 0.06 174 TR_XM_DK_SendGrid 1437 3.21 1.33 3.57 175 NML_ADSP_CUSTOM_MED 1430 0.93 1.33 0.86 176 XM_UB95 1408 0.23 1.31 0.02 177 XM_OfRef8 1406 0.22 1.30 0.02 178 RDNS_DYNAMIC 1404 0.46 1.30 0.30 179 T_XMHurry_00 1370 0.76 1.27 0.67 180 XMHTML_After_End 1338 0.91 1.24 0.85 181 HK_RANDOM_FROM 1332 0.32 1.23 0.15 182 TR_Mismatch_TLD_02 1323 0.27 1.23 0.08 183 XMStockSpam_06 1317 1.16 1.22 1.15 184 XMSubMetaSxObfu_03 1303 0.86 1.21 0.79 185 T_TooManySym_02 1291 1.87 1.20 2.00 186 XMGenDplmaNmb 1276 1.00 1.18 0.97 187 FORGED_GMAIL_RCVD 1267 0.61 1.17 0.50 188 RELAYCOUNTRY_BJ 1259 0.19 1.17 0.00 189 HTML_IMAGE_ONLY_16 1255 0.51 1.16 0.39 190 T_FILL_THIS_FORM_LOAN 1230 0.23 1.14 0.06 191 URI_NO_WWW_INFO_CGI 1230 0.20 1.14 0.02 192 T_FILL_THIS_FORM_SHORT 1212 0.94 1.12 0.91 193 MAILING_LIST_MULTI 1200 2.21 1.11 2.41 194 XM_PDF 1177 4.53 1.09 5.18 195 XMBdyGiftCard01 1123 0.83 1.04 0.79 196 ANY_BOUNCE_MESSAGE 1084 4.53 1.00 5.19 197 BOUNCE_MESSAGE 1078 4.52 1.00 5.19 198 XMSlimDrugH 1068 0.44 0.99 0.33 199 DKIM_ADSP_NXDOMAIN 1046 0.70 0.97 0.65 200 MIME_CHARSET_FARAWAY 1045 0.25 0.97 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 564106 98.19 97.84 98.26 2 HTML_MESSAGE 496026 87.67 94.42 86.40 3 RELAYCOUNTRY_US 458309 76.94 61.54 79.83 4 DKIM_SIGNED 414749 70.72 62.60 72.24 5 XM_DK_Pass 408931 69.55 60.60 71.23 6 DKIM_VALID 384778 64.47 50.88 67.02 7 XM_B_Unicode 377357 64.73 59.40 65.73 8 BAYES_50 296316 50.41 43.99 51.61 9 DKIM_VALID_AU 286071 47.94 37.88 49.83 10 XMListUnsubscribeExists 261913 46.43 50.72 45.62 11 XM_B_Unicode3 211752 35.72 29.55 36.88 12 T_TM2_M_HEADER_IN_MSG 163754 27.54 22.29 28.52 13 DKIM_VALID_EF 158650 27.74 28.32 27.64 14 HTML_FONT_LOW_CONTRAST 139953 23.80 20.73 24.38 15 RCVD_IN_MSPIKE_H2 136613 23.36 21.05 23.80 16 RCVD_IN_MSPIKE_WL 133681 20.73 7.12 23.29 17 LOC_TINY_FONT_1 127021 22.54 24.77 22.13 18 MIME_HTML_ONLY 124732 24.35 38.28 21.73 19 XMSubLong 117261 21.59 27.80 20.43 20 FVGT_m_MULTI_ODD 117179 21.01 24.22 20.41 21 BAYES_00 102887 15.22 0.86 17.92 22 T_KAM_HTML_FONT_INVALID 99969 17.54 18.24 17.41 23 ALL_TRUSTED 95012 14.19 1.62 16.55 24 RCVD_IN_MSPIKE_H3 77510 11.94 3.66 13.50 25 XM_B_Unsub 72784 12.20 9.65 12.68 26 XM_Body_Dirty_Words 71674 13.68 20.05 12.48 27 XM_Multi_Part_URI 69539 12.41 13.98 12.11 28 XM_DK_Undo_02 59873 14.99 39.26 10.43 29 XM_Evil_Numbers_Gen 55005 9.67 10.15 9.58 30 TR_XM_DK_Bayes 53298 7.87 0.37 9.28 31 RCVD_IN_MSPIKE_H4 49969 7.84 3.27 8.70 32 TR_XM_DK_Bayes1 49506 7.29 0.20 8.62 33 TooManyTo_001 48837 7.98 5.19 8.51 34 LotsOfNums_01 46398 8.12 8.29 8.08 35 LOTS_OF_MONEY 45838 10.02 20.85 7.98 36 IN_ZIMBRA_NJ_WHITELIST 42962 6.31 0.04 7.48 37 TR_XM_DK_Bayes2 42769 6.30 0.18 7.45 38 XM_B_Phish_Phrases 42410 7.65 9.06 7.39 39 UNPARSEABLE_RELAY 41347 6.68 3.88 7.20 40 TM2_M_URI_OPT_OUT 40214 6.40 3.16 7.00 41 RCVD_IN_RP_SAFE 39200 5.82 0.45 6.83 42 BAYES_99 38178 10.68 32.13 6.65 43 XM_SendGrid 37955 6.11 3.44 6.61 44 XM_DKIMWhitelistDomains 36759 5.39 0.00 6.40 45 XMStrtUSub 36587 5.86 3.15 6.37 46 RCVD_IN_RP_CERTIFIED 36481 5.39 0.26 6.35 47 HTML_IMAGE_RATIO_02 36175 6.85 9.75 6.30 48 MPART_ALT_DIFF 34699 5.95 5.44 6.04 49 BAYES_60 33213 5.82 6.00 5.79 50 MIME_QP_LONG_LINE 32778 5.26 2.85 5.71 51 BAYES_40 32006 5.18 3.08 5.58 52 RELAYCOUNTRY_META 31127 9.75 32.80 5.42 53 XM_H_Long_From01 30593 5.29 5.06 5.33 54 HTML_IMAGE_RATIO_04 30448 5.11 4.10 5.30 55 BAYES_999 30241 8.53 25.90 5.27 56 DKIM_INVALID 29971 6.25 11.73 5.22 57 ANY_BOUNCE_MESSAGE 29790 4.53 1.00 5.19 58 BOUNCE_MESSAGE 29769 4.52 1.00 5.19 59 XM_PDF 29737 4.53 1.09 5.18 60 RCVD_IN_IADB_LISTED 27483 4.18 0.93 4.79 61 BOTNET_IPINHOSTNAME 26033 5.90 13.15 4.53 62 RCVD_IN_IADB_SPF 23795 3.62 0.84 4.14 63 T_REMOTE_IMAGE 23795 4.98 9.41 4.14 64 T_TooManySym_01 23746 4.67 7.51 4.14 65 XM_B_Unsub2 23027 3.66 1.77 4.01 66 MIME_HTML_ONLY_MULTI 22853 3.59 1.52 3.98 67 XM_H_Trusted_IP 21833 3.20 0.00 3.80 68 BAYES_20 21656 3.40 1.42 3.77 69 XMSexyCombo_05 21562 5.51 14.83 3.76 70 BAYES_80 21357 4.48 8.50 3.72 71 RCVD_IN_IADB_SENDERID 20736 3.17 0.80 3.61 72 RCVD_IN_IADB_DK 20552 3.14 0.81 3.58 73 TR_XM_DK_SendGrid 20487 3.21 1.33 3.57 74 XM_UncommonTLD01 20405 5.37 15.01 3.55 75 XMSubMetaSx_00 20328 3.94 6.04 3.54 76 TR_XM_PhishingBody 19027 4.04 7.91 3.31 77 XMNumbers 18499 3.39 4.29 3.22 78 NO_DNS_FOR_FROM 18014 4.18 9.74 3.14 79 RCVD_IN_IADB_VOUCHED 17694 2.64 0.31 3.08 80 HTML_MIME_NO_HTML_TAG 17450 4.60 12.92 3.04 81 HTML_IMAGE_RATIO_06 17315 2.89 2.24 3.02 82 BOTNET 17026 6.64 26.21 2.97 83 BAYES_05 15627 2.41 0.76 2.72 84 MIME_HTML_MOSTLY 15532 2.87 3.76 2.71 85 MAILING_LIST_MULTI 13848 2.21 1.11 2.41 86 FROM_EXCESS_BASE64 13784 3.16 7.18 2.40 87 BAYES_95 12838 2.40 3.25 2.24 88 TooManyTo_002 12159 1.91 0.77 2.12 89 XM_B_COVIDMETA 12106 2.51 4.66 2.11 90 XM_B_Phish66 11899 2.65 5.72 2.07 91 HTML_IMAGE_RATIO_08 11715 1.94 1.42 2.04 92 T_TooManySym_02 11456 1.87 1.20 2.00 93 RCVD_IN_IADB_OPTIN 11107 1.67 0.27 1.93 94 XM_B_SpammyTLD 11021 2.25 3.98 1.92 95 XM_CamelCaseFrm001 10693 2.28 4.51 1.86 96 TR_Symld_Words 10643 1.79 1.45 1.85 97 KHOP_HELO_FCRDNS 10613 2.01 2.84 1.85 98 T_XMDrugObfuBody_14 10321 1.75 1.52 1.80 99 XM_SPF_SoftFail 10064 2.35 5.52 1.75 100 UNTRUSTED_Relay 9755 6.29 30.69 1.70 101 TVD_RCVD_IP 9337 1.44 0.48 1.63 102 XMDiploma_00 9334 1.62 1.59 1.63 103 HELO_NODOT 9295 3.66 14.54 1.62 104 HELO_NO_DOMAIN 9293 3.66 14.54 1.62 105 RELAYCOUNTRY_CA 9257 2.30 5.96 1.61 106 XM_DK_Undo_01 9173 2.13 4.96 1.60 107 URI_HEX 8793 1.53 1.51 1.53 108 XMSubNoVowel 8623 1.50 1.46 1.50 109 T_XMDrugObfuBody_08 8242 1.63 2.66 1.44 110 TooManyTo_003 8187 1.30 0.62 1.43 111 IN_HORDE_ADDRESS_BOOK 8054 1.18 0.03 1.40 112 INVALID_MSGID 7357 1.12 0.26 1.28 113 SUBJ_ALL_CAPS 7291 2.97 12.01 1.27 114 XM_GoogleGroups 7019 1.09 0.40 1.22 115 XMCapTrack 6945 1.10 0.54 1.21 116 TM2_M_VERY_LONG_WORD 6726 1.22 1.46 1.17 117 USER_IN_DEF_DKIM_WL 6706 0.98 0.00 1.17 118 DKIM_ADSP_CUSTOM_MED 6596 1.19 1.43 1.15 119 XMStockSpam_06 6592 1.16 1.22 1.15 120 XM_H_Long_From02 6588 1.09 0.81 1.15 121 TO_MALFORMED 6510 0.96 0.01 1.13 122 T_OBFU_PDF_ATTACH 6498 1.02 0.42 1.13 123 URI_TRY_3LD 6330 1.04 0.69 1.10 124 RCVD_IN_BL_SPAMCOP_NET 6238 1.87 6.07 1.09 125 RELAYCOUNTRY_GB 6229 1.16 1.55 1.09 126 TooManyTo_004 6208 1.00 0.56 1.08 127 RCVD_IN_MSPIKE_H5 6202 0.94 0.19 1.08 128 XM_SPF_Unknown 5994 0.96 0.50 1.04 129 XM_UB50 5889 3.20 14.79 1.03 130 XM_OfRef6 5760 2.99 13.59 1.00 131 XMGenDplmaNmb 5545 1.00 1.18 0.97 132 SpammyFromTLD_01 5265 1.65 5.53 0.92 133 T_FILL_THIS_FORM_SHORT 5230 0.94 1.12 0.91 134 TooManyTo_005 5221 0.83 0.43 0.91 135 XMBrknScrpt_02 5104 1.06 1.96 0.89 136 NML_ADSP_CUSTOM_MED 4914 0.93 1.33 0.86 137 HTML_FONT_FACE_BAD 4897 0.78 0.40 0.85 138 XMHTML_After_End 4877 0.91 1.24 0.85 139 XMGappySubj_01 4741 0.72 0.14 0.83 140 XMSubMetaSxObfu_03 4533 0.86 1.21 0.79 141 XMBdyGiftCard01 4533 0.83 1.04 0.79 142 XM_E_Blogspot 4362 0.65 0.07 0.76 143 HTTPS_HTTP_MISMATCH 4353 0.73 0.55 0.76 144 TR_MSPIKEBAYES00 4320 0.63 0.00 0.75 145 TR_XM_COVIDMETA4 4161 1.30 4.38 0.72 146 T_XMDrugObfuBody_00 4125 0.89 1.83 0.72 147 TR_MetaPhish_Combo_01 4084 0.72 0.79 0.71 148 XMNoVowels 4050 0.71 0.71 0.71 149 XMBody_17 3860 1.40 5.29 0.67 150 XM_ProductURIs 3855 0.66 0.62 0.67 151 T_XMHurry_00 3839 0.76 1.27 0.67 152 DKIM_ADSP_NXDOMAIN 3710 0.70 0.97 0.65 153 TR_XM_COVIDMETA1 3597 0.99 2.90 0.63 154 XM_RXBody 3498 0.54 0.19 0.61 155 T_TooManySym_03 3407 0.63 0.81 0.59 156 TR_XM_PHPDW 3323 0.87 2.45 0.58 157 XMSubMetaI_00 3231 0.62 0.91 0.56 158 TR_XM_FormFill2 3210 0.85 2.40 0.56 159 T_PDS_OTHER_BAD_TLD 3204 0.92 2.87 0.56 160 TR_XM_PHPForged 3193 0.85 2.42 0.56 161 XMMoneyMeta_00 3191 0.58 0.69 0.56 162 XM_H_PHPMailer 3191 0.62 0.95 0.56 163 MISSING_HEADERS 3164 2.68 13.98 0.55 164 XM_H_PHPOS 3160 0.84 2.39 0.55 165 XM_ShortIntro_01 3087 0.56 0.69 0.54 166 XM_DIRTYINTL 3002 1.66 7.68 0.52 167 TM2_M_A_HREF_HREF 2995 0.58 0.90 0.52 168 XM_B_REG_HTML 2863 0.45 0.20 0.50 169 FORGED_GMAIL_RCVD 2860 0.61 1.17 0.50 170 RCVD_IN_MSPIKE_BL 2818 2.62 13.94 0.49 171 TR_LOTS_OF_MONEY3 2776 1.70 8.17 0.48 172 FROM_GOV_DKIM_AU 2716 0.41 0.08 0.47 173 RCVD_IN_SORBS_DUL 2663 0.44 0.30 0.46 174 T_Symld_Words_02 2642 0.94 3.49 0.46 175 HTML_IMAGE_ONLY_28 2604 0.42 0.25 0.45 176 XMPhish08 2584 0.50 0.76 0.45 177 XMHTMLBadTable_001 2540 0.42 0.29 0.44 178 HTML_IMAGE_ONLY_20 2533 0.43 0.38 0.44 179 TM2_M_BODY_EMPTY 2527 0.39 0.10 0.44 180 RELAYCOUNTRY_NL 2490 0.50 0.85 0.43 181 XMSexyCombo_01 2475 0.63 1.70 0.43 182 RELAYCOUNTRY_AU 2456 0.44 0.48 0.43 183 SHORT_HELO_AND_INLINE_IMAGE 2450 0.37 0.08 0.43 184 T_MONEY_PERCENT 2442 0.47 0.73 0.43 185 TR_LOTS_OF_MONEY2 2442 0.47 0.73 0.43 186 HTML_IMAGE_ONLY_32 2430 0.38 0.13 0.42 187 XMPhish30 2376 0.48 0.81 0.41 188 MPART_ALT_DIFF_COUNT 2310 0.47 0.82 0.40 189 TR_BOTNET_NEGATE 2281 0.36 0.19 0.40 190 FROM_GOV_SPOOF 2277 0.37 0.25 0.40 191 HTML_IMAGE_ONLY_16 2252 0.51 1.16 0.39 192 XMBody_95 2245 0.34 0.09 0.39 193 NUMERIC_HTTP_ADDR 2200 0.38 0.34 0.38 194 GMD_PDF_HORIZ 2174 0.33 0.06 0.38 195 XMDateMe_00 2147 0.37 0.33 0.37 196 RELAYCOUNTRY_DE 2135 0.69 2.35 0.37 197 TVD_SPACE_RATIO 2131 0.34 0.16 0.37 198 URI_NOVOWEL 2125 0.43 0.77 0.37 199 PLING_QUERY 2120 0.40 0.57 0.37 200 HTML_TAG_BALANCE_BODY 2099 0.36 0.36 0.37 ----------------------------------------------------------------------