Email: 421284 Autolearn: 0 AvgScore: 0.77 AvgScanTime: 1.55 sec Spam: 72312 Autolearn: 0 AvgScore: 12.49 AvgScanTime: 2.66 sec Ham: 348972 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.33 sec Time Spent Running SA: 181.92 hours Time Spent Processing Spam: 53.39 hours Time Spent Processing Ham: 128.52 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 71132 98.92 98.37 99.03 2 HTML_MESSAGE 65434 76.11 90.49 73.13 3 DKIM_SIGNED 40643 65.41 56.21 67.31 4 XM_B_Unicode 39609 60.72 54.78 61.95 5 XM_DK_Pass 39245 64.29 54.27 66.37 6 RELAYCOUNTRY_META 36256 13.22 50.14 5.58 7 XMListUnsubscribeExists 35983 50.18 49.76 50.27 8 RELAYCOUNTRY_US 34415 64.98 47.59 68.58 9 DKIM_VALID 33598 60.76 46.46 63.72 10 UNTRUSTED_Relay 31346 9.92 43.35 3.00 11 XM_DK_Undo_02 28912 16.84 39.98 12.05 12 T_TM2_M_HEADER_IN_MSG 28853 22.44 39.90 18.82 13 XM_Multi_Part_URI 26881 23.68 37.17 20.88 14 BAYES_99 25876 12.92 35.78 8.19 15 DKIM_VALID_AU 24040 48.83 33.24 52.06 16 LOTS_OF_MONEY 22467 10.02 31.07 5.66 17 BAYES_999 20735 10.34 28.67 6.54 18 XM_B_Unicode3 18861 35.88 26.08 37.91 19 TR_LOTS_OF_MONEY3 18180 5.08 25.14 0.92 20 RELAYCOUNTRY_NL 17783 4.76 24.59 0.65 21 MISSING_HEADERS 17619 4.69 24.37 0.61 22 REPLYTO_WITHOUT_TO_CC 17542 4.53 24.26 0.44 23 TR_LOTS_OF_MONEY1 17141 4.42 23.70 0.42 24 HELO_NODOT 17105 4.75 23.65 0.83 25 HELO_NO_DOMAIN 17097 4.75 23.64 0.83 26 LOADSA_MONEY_COMBO 16649 4.03 23.02 0.09 27 XFER_LOTSA_MONEY 16623 3.99 22.99 0.06 28 MIME_HTML_ONLY 16604 20.82 22.96 20.38 29 BOTNET 16122 6.32 22.30 3.01 30 BAYES_50 16027 39.08 22.16 42.59 31 ADVANCE_FEE_2_NEW_MONEY 15811 4.07 21.86 0.38 32 LOC_TINY_FONT_1 15295 26.59 21.15 27.72 33 DKIM_VALID_EF 14689 23.17 20.31 23.76 34 FVGT_m_MULTI_ODD 14458 19.04 19.99 18.84 35 RCVD_IN_MSPIKE_H2 14312 21.47 19.79 21.82 36 BAYES_00 14129 15.49 19.54 14.65 37 HTML_FONT_LOW_CONTRAST 13915 26.96 19.24 28.56 38 XM_UncommonTLD01 13098 5.67 18.11 3.09 39 XMSubLong 12460 18.55 17.23 18.82 40 XM_Body_Dirty_Words 9489 12.52 13.12 12.39 41 T_KAM_HTML_FONT_INVALID 9486 14.58 13.12 14.88 42 RCVD_IN_MSPIKE_BL 9044 2.77 12.51 0.75 43 BOTNET_IPINHOSTNAME 8491 7.22 11.74 6.29 44 RCVD_IN_BL_SPAMCOP_NET 7602 2.93 10.51 1.36 45 XMSexyCombo_05 7282 5.73 10.07 4.83 46 DKIM_INVALID 7045 4.64 9.74 3.59 47 XMSubMetaSx_00 6620 5.00 9.15 4.14 48 RCVD_IN_RP_RNBL 6010 1.50 8.31 0.09 49 RELAYCOUNTRY_CA 5929 3.17 8.20 2.12 50 XM_B_Phish_Phrases 5616 6.84 7.77 6.65 51 XM_B_Unsub 5615 8.12 7.76 8.19 52 XM_UB99 5452 1.30 7.54 0.01 53 XM_SPF_SoftFail 5443 2.19 7.53 1.08 54 SpammyFromTLD_01 5340 1.64 7.38 0.45 55 RCVD_IN_MSPIKE_L5 5215 1.41 7.21 0.20 56 HTML_IMAGE_RATIO_02 5174 7.91 7.16 8.07 57 RCVD_IN_PSBL 5117 1.25 7.08 0.04 58 NO_DNS_FOR_FROM 4841 3.02 6.69 2.25 59 BAYES_80 4509 4.80 6.24 4.50 60 BOTNET_NORDNS 4468 1.08 6.18 0.03 61 BAYES_60 4440 6.32 6.14 6.36 62 LotsOfNums_01 4410 7.07 6.10 7.27 63 XM_UB999 4380 1.04 6.06 0.01 64 SpammyFromTLD_02 4298 1.20 5.94 0.21 65 RCVD_IN_MSPIKE_WL 4157 21.50 5.75 24.76 66 XMNumbers 4142 4.43 5.73 4.17 67 FROM_EXCESS_BASE64 4075 3.58 5.64 3.16 68 BODY_URI_ONLY 4069 1.01 5.63 0.05 69 FROM_SUSPICIOUS_NTLD 3752 0.92 5.19 0.04 70 XM_Evil_Numbers_Gen 3743 8.04 5.18 8.63 71 XM_UB50 3722 1.84 5.15 1.15 72 FROM_SUSPICIOUS_NTLD_FP 3721 0.91 5.15 0.04 73 T_REMOTE_IMAGE 3654 2.74 5.05 2.26 74 XM_H_Long_From01 3653 4.73 5.05 4.66 75 MPART_ALT_DIFF 3604 5.11 4.98 5.13 76 UNPARSEABLE_RELAY 3450 6.47 4.77 6.83 77 TooManyTo_001 3418 5.87 4.73 6.11 78 HTML_MIME_NO_HTML_TAG 3403 1.85 4.71 1.26 79 XM_BadFromFormat 3242 0.90 4.48 0.16 80 XMBody_17 3227 1.53 4.46 0.92 81 FROM_MISSP_REPLYTO 3073 0.74 4.25 0.01 82 TVD_SPACE_RATIO_MINFP 3068 0.74 4.24 0.01 83 URIBL_SBL_A 3064 0.90 4.24 0.21 84 RCVD_IN_MSPIKE_L3 3055 1.13 4.22 0.49 85 TR_XM_PhishingBody 2991 2.83 4.14 2.56 86 HDRS_MISSP 2851 0.76 3.94 0.09 87 DKIM_ADSP_NXDOMAIN 2833 1.32 3.92 0.78 88 BAYES_95 2726 2.98 3.77 2.81 89 HTML_TAG_BALANCE_CENTER 2718 0.75 3.76 0.12 90 RELAYCOUNTRY_RU 2558 1.09 3.54 0.59 91 TR_XM_MaxBayes 2532 0.64 3.50 0.05 92 T_XMDrugObfuBody_08 2521 1.84 3.49 1.49 93 IMG_ONLY_FM_DOM_INFO 2499 0.59 3.46 0.00 94 XM_UB60 2417 0.69 3.34 0.14 95 RCVD_IN_MSPIKE_H3 2409 12.59 3.33 14.50 96 XM_B_SpammyTLD 2329 1.75 3.22 1.44 97 TR_XM_UnparsRelay 2261 0.95 3.13 0.49 98 MIME_HTML_MOSTLY 2244 3.27 3.10 3.31 99 XM_SendGrid 2218 5.38 3.07 5.86 100 XMStrtUSub 2211 4.63 3.06 4.96 101 TR_XM_INV_DKIM 2196 0.68 3.04 0.19 102 HTML_IMAGE_RATIO_04 2112 5.17 2.92 5.64 103 XM_DIRTYINTL 2042 0.85 2.82 0.43 104 XM_OfRef6 2018 1.82 2.79 1.62 105 SUBJ_ALL_CAPS 2001 1.37 2.77 1.08 106 TR_XM_MaxSPIKE 1975 0.52 2.73 0.06 107 XMGppyBdWords 1948 0.60 2.69 0.16 108 XM_JunkDunk 1947 0.46 2.69 0.00 109 BAYES_05 1927 9.48 2.66 10.89 110 XM_B_Phish66 1919 1.27 2.65 0.99 111 TR_XM_COVIDMETA4 1889 0.81 2.61 0.43 112 XMDiploma_00 1800 1.68 2.49 1.51 113 HTML_IMAGE_ONLY_16 1783 0.55 2.47 0.15 114 DATE_IN_PAST_03_06 1721 0.50 2.38 0.11 115 TR_Mismatch_TLD_02 1691 0.47 2.34 0.08 116 RCVD_IN_MSPIKE_H4 1690 7.94 2.34 9.10 117 XM_UB80 1685 0.46 2.33 0.08 118 KHOP_HELO_FCRDNS 1612 1.19 2.23 0.98 119 TR_XM_MaxWHORU 1584 0.42 2.19 0.06 120 XMSubject_38 1573 0.43 2.18 0.07 121 HTML_IMAGE_RATIO_08 1556 2.46 2.15 2.53 122 XM_CamelCaseFrm001 1545 2.04 2.14 2.02 123 TR_XM_PHPDW 1524 0.60 2.11 0.29 124 TR_XM_PHPForged 1518 0.59 2.10 0.28 125 TR_XM_FormFill2 1505 0.59 2.08 0.28 126 XM_H_PHPOS 1499 0.58 2.07 0.27 127 URI_TRY_3LD 1498 1.42 2.07 1.28 128 BAYES_20 1389 5.35 1.92 6.06 129 HTML_IMAGE_RATIO_06 1371 3.02 1.90 3.25 130 TM2_M_URI_OPT_OUT 1367 16.99 1.89 20.12 131 XMSubNoVowel 1354 0.92 1.87 0.73 132 RELAYCOUNTRY_FR 1349 0.53 1.87 0.25 133 DKIM_ADSP_CUSTOM_MED 1323 1.06 1.83 0.90 134 TR_XM_RelayPhish 1257 0.39 1.74 0.11 135 NML_ADSP_CUSTOM_MED 1241 0.80 1.72 0.61 136 XM_B_Unsub2 1236 1.19 1.71 1.08 137 XMSexyCombo_01 1234 1.00 1.71 0.86 138 XM_B_COVIDMETA 1233 1.11 1.71 0.99 139 BAYES_40 1166 3.52 1.61 3.91 140 URG_BIZ 1127 0.30 1.56 0.04 141 XM_UB95 1122 0.28 1.55 0.02 142 T_XMHurry_00 1111 1.05 1.54 0.95 143 TR_Orig_Subnet 1102 0.27 1.52 0.01 144 DEAR_SOMETHING 1078 0.33 1.49 0.09 145 XM_URI_RBL 1075 0.42 1.49 0.19 146 TR_XM_COVIDMETA1 1072 0.41 1.48 0.18 147 MPART_ALT_DIFF_COUNT 1035 0.52 1.43 0.33 148 MIME_CHARSET_FARAWAY 1032 0.35 1.43 0.12 149 DATE_IN_PAST_06_12 1029 0.30 1.42 0.06 150 URI_HEX 1015 1.47 1.40 1.48 151 PDS_OTHER_BAD_TLD 994 0.36 1.37 0.15 152 T_TooManySym_01 976 4.37 1.35 4.99 153 TR_Symld_Words 976 1.33 1.35 1.32 154 ADVANCE_FEE_5_NEW_MONEY 968 0.23 1.34 0.00 155 T_FILL_THIS_FORM_SHORT 967 0.59 1.34 0.44 156 XM_B_SEO 935 0.27 1.29 0.06 157 RELAYCOUNTRY_IL 929 0.23 1.28 0.01 158 XMStockSpam_06 896 0.95 1.24 0.89 159 TR_Caps_n_Bayes_99 894 0.29 1.24 0.10 160 HTML_IMAGE_ONLY_28 890 0.37 1.23 0.19 161 XMBrknScrpt_02 886 1.18 1.23 1.17 162 MIME_HTML_ONLY_MULTI 884 2.82 1.22 3.15 163 TR_XM_DK_SendGrid 881 2.92 1.22 3.28 164 TR_Mismatch_TLD_01 880 0.35 1.22 0.17 165 CHARSET_FARAWAY_HEADER 865 0.25 1.20 0.05 166 ALL_TRUSTED 862 22.17 1.19 26.51 167 FORGED_GMAIL_RCVD 860 0.53 1.19 0.40 168 RELAYCOUNTRY_MU 859 0.20 1.19 0.00 169 TM2_M_VERY_LONG_WORD 832 1.05 1.15 1.03 170 T_XMDrugObfuBody_14 822 1.23 1.14 1.25 171 XMHTML_After_End 813 0.75 1.12 0.67 172 INVESTMENT_ADVICE 805 0.26 1.11 0.08 173 RDNS_DYNAMIC 762 0.52 1.05 0.41 174 RCVD_IN_MSPIKE_L4 745 0.22 1.03 0.06 175 DIET_1 738 0.68 1.02 0.61 176 RELAYCOUNTRY_JP 726 0.19 1.00 0.02 177 RELAYCOUNTRY_GB 712 0.60 0.98 0.52 178 T_XMDrugObfuBody_00 710 0.60 0.98 0.52 179 LongTLD 693 0.25 0.96 0.10 180 XM_H_PHPMailer 691 0.49 0.96 0.39 181 XMReplyNow 687 0.26 0.95 0.12 182 RELAYCOUNTRY_DE 676 0.37 0.93 0.25 183 RELAYCOUNTRY_TR 673 0.19 0.93 0.03 184 MIME_QP_LONG_LINE 667 2.86 0.92 3.26 185 URI_NOVOWEL 662 0.48 0.92 0.39 186 URIBL_BLACK 636 0.16 0.88 0.01 187 BASE64_LENGTH_79_INF 630 0.39 0.87 0.29 188 RELAYCOUNTRY_GR 613 0.17 0.85 0.03 189 XM_H_PHPOS_M 611 0.28 0.84 0.16 190 XMSubLongNoVowel 610 0.17 0.84 0.03 191 HK_RANDOM_REPLYTO 610 0.25 0.84 0.13 192 MAILING_LIST_MULTI 607 1.54 0.84 1.68 193 URIBL_DBL_SPAM 605 0.16 0.84 0.02 194 RELAYCOUNTRY_KR 585 0.15 0.81 0.01 195 PDS_BTC_ID 583 0.17 0.81 0.04 196 XMPhish30 580 0.67 0.80 0.64 197 XMSlimDrugH 575 0.42 0.80 0.34 198 XMGenDplmaNmb 547 0.79 0.76 0.79 199 HTML_FONT_SIZE_HUGE 539 0.31 0.75 0.22 200 HTML_TAG_BALANCE_BODY 533 0.43 0.74 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 345596 98.92 98.37 99.03 2 HTML_MESSAGE 255205 76.11 90.49 73.13 3 RELAYCOUNTRY_US 239327 64.98 47.59 68.58 4 DKIM_SIGNED 234899 65.41 56.21 67.31 5 XM_DK_Pass 231615 64.29 54.27 66.37 6 DKIM_VALID 222376 60.76 46.46 63.72 7 XM_B_Unicode 216179 60.72 54.78 61.95 8 DKIM_VALID_AU 181681 48.83 33.24 52.06 9 XMListUnsubscribeExists 175432 50.18 49.76 50.27 10 BAYES_50 148624 39.08 22.16 42.59 11 XM_B_Unicode3 132307 35.88 26.08 37.91 12 HTML_FONT_LOW_CONTRAST 99656 26.96 19.24 28.56 13 LOC_TINY_FONT_1 96724 26.59 21.15 27.72 14 ALL_TRUSTED 92518 22.17 1.19 26.51 15 RCVD_IN_MSPIKE_WL 86422 21.50 5.75 24.76 16 DKIM_VALID_EF 82925 23.17 20.31 23.76 17 RCVD_IN_MSPIKE_H2 76146 21.47 19.79 21.82 18 XM_Multi_Part_URI 72869 23.68 37.17 20.88 19 MIME_HTML_ONLY 71106 20.82 22.96 20.38 20 TM2_M_URI_OPT_OUT 70209 16.99 1.89 20.12 21 FVGT_m_MULTI_ODD 65751 19.04 19.99 18.84 22 T_TM2_M_HEADER_IN_MSG 65691 22.44 39.90 18.82 23 XMSubLong 65669 18.55 17.23 18.82 24 ANY_BOUNCE_MESSAGE 64859 15.49 0.53 18.59 25 BOUNCE_MESSAGE 64857 15.49 0.53 18.59 26 T_KAM_HTML_FONT_INVALID 51925 14.58 13.12 14.88 27 BAYES_00 51112 15.49 19.54 14.65 28 RCVD_IN_MSPIKE_H3 50615 12.59 3.33 14.50 29 XM_Body_Dirty_Words 43236 12.52 13.12 12.39 30 XM_DK_Undo_02 42048 16.84 39.98 12.05 31 BAYES_05 38000 9.48 2.66 10.89 32 RCVD_IN_RP_SAFE 33447 8.03 0.55 9.58 33 XM_DKIMWhitelistDomains 32652 7.75 0.01 9.36 34 RCVD_IN_MSPIKE_H4 31762 7.94 2.34 9.10 35 RCVD_IN_RP_CERTIFIED 31323 7.51 0.42 8.98 36 XM_Evil_Numbers_Gen 30121 8.04 5.18 8.63 37 XM_B_Unsub 28593 8.12 7.76 8.19 38 BAYES_99 28564 12.92 35.78 8.19 39 HTML_IMAGE_RATIO_02 28153 7.91 7.16 8.07 40 LotsOfNums_01 25366 7.07 6.10 7.27 41 UNPARSEABLE_RELAY 23825 6.47 4.77 6.83 42 TR_XM_DK_Bayes 23713 5.68 0.28 6.80 43 XM_B_Phish_Phrases 23205 6.84 7.77 6.65 44 BAYES_999 22830 10.34 28.67 6.54 45 TR_XM_DK_Bayes1 22384 5.35 0.20 6.41 46 BAYES_60 22203 6.32 6.14 6.36 47 BOTNET_IPINHOSTNAME 21944 7.22 11.74 6.29 48 TooManyTo_001 21329 5.87 4.73 6.11 49 BAYES_20 21151 5.35 1.92 6.06 50 TR_XM_DK_Bayes2 20743 4.95 0.18 5.94 51 XM_SendGrid 20452 5.38 3.07 5.86 52 LOTS_OF_MONEY 19765 10.02 31.07 5.66 53 HTML_IMAGE_RATIO_04 19672 5.17 2.92 5.64 54 RELAYCOUNTRY_META 19457 13.22 50.14 5.58 55 MPART_ALT_DIFF 17908 5.11 4.98 5.13 56 T_TooManySym_01 17414 4.37 1.35 4.99 57 XMStrtUSub 17313 4.63 3.06 4.96 58 XMSexyCombo_05 16850 5.73 10.07 4.83 59 XM_H_Long_From01 16274 4.73 5.05 4.66 60 BAYES_80 15703 4.80 6.24 4.50 61 XMNumbers 14536 4.43 5.73 4.17 62 XMSubMetaSx_00 14447 5.00 9.15 4.14 63 BAYES_40 13644 3.52 1.61 3.91 64 IN_ZIMBRA_NJ_WHITELIST 13075 3.11 0.01 3.75 65 DKIM_INVALID 12523 4.64 9.74 3.59 66 MIME_HTML_MOSTLY 11534 3.27 3.10 3.31 67 TR_XM_DK_SendGrid 11430 2.92 1.22 3.28 68 MIME_QP_LONG_LINE 11372 2.86 0.92 3.26 69 HTML_IMAGE_RATIO_06 11348 3.02 1.90 3.25 70 FROM_EXCESS_BASE64 11019 3.58 5.64 3.16 71 MIME_HTML_ONLY_MULTI 11000 2.82 1.22 3.15 72 XM_UncommonTLD01 10793 5.67 18.11 3.09 73 BOTNET 10497 6.32 22.30 3.01 74 UNTRUSTED_Relay 10453 9.92 43.35 3.00 75 T_TooManySym_02 10014 2.45 0.43 2.87 76 BAYES_95 9808 2.98 3.77 2.81 77 RCVD_IN_IADB_LISTED 9160 2.24 0.37 2.62 78 TVD_RCVD_IP 8950 2.17 0.24 2.56 79 TR_XM_PhishingBody 8924 2.83 4.14 2.56 80 HTML_IMAGE_RATIO_08 8825 2.46 2.15 2.53 81 RCVD_IN_IADB_SPF 8040 1.97 0.34 2.30 82 T_REMOTE_IMAGE 7886 2.74 5.05 2.26 83 NO_DNS_FOR_FROM 7868 3.02 6.69 2.25 84 XM_H_Trusted_IP 7615 1.81 0.00 2.18 85 CK_HELO_DYNAMIC_SPLIT_IP 7562 1.85 0.33 2.17 86 HELO_MISC_IP 7560 1.86 0.38 2.17 87 INVALID_MSGID 7445 1.88 0.67 2.13 88 RELAYCOUNTRY_CA 7411 3.17 8.20 2.12 89 RCVD_IN_IADB_SENDERID 7353 1.80 0.34 2.11 90 RCVD_IN_IADB_DK 7165 1.76 0.34 2.05 91 XM_CamelCaseFrm001 7057 2.04 2.14 2.02 92 TO_MALFORMED 6456 1.54 0.03 1.85 93 MAILING_LIST_MULTI 5869 1.54 0.84 1.68 94 XM_ProductURIs 5694 1.45 0.57 1.63 95 XM_OfRef6 5664 1.82 2.79 1.62 96 XMDiploma_00 5278 1.68 2.49 1.51 97 T_XMDrugObfuBody_08 5214 1.84 3.49 1.49 98 URI_HEX 5158 1.47 1.40 1.48 99 RCVD_IN_IADB_VOUCHED 5118 1.23 0.07 1.47 100 XM_B_SpammyTLD 5032 1.75 3.22 1.44 101 HTML_FONT_FACE_BAD 4939 1.28 0.65 1.42 102 RCVD_IN_BL_SPAMCOP_NET 4751 2.93 10.51 1.36 103 IN_HORDE_ADDRESS_BOOK 4699 1.12 0.02 1.35 104 XM_PDF 4690 1.18 0.39 1.34 105 TR_Symld_Words 4620 1.33 1.35 1.32 106 XMGappySubj_01 4573 1.10 0.08 1.31 107 URI_TRY_3LD 4480 1.42 2.07 1.28 108 XM_DK_Undo_01 4465 1.18 0.68 1.28 109 XMBdyGiftCard01 4424 1.15 0.58 1.27 110 HTML_MIME_NO_HTML_TAG 4396 1.85 4.71 1.26 111 T_XMDrugObfuBody_14 4345 1.23 1.14 1.25 112 USER_IN_DEF_DKIM_WL 4320 1.03 0.00 1.24 113 T_TooManySym_03 4190 1.02 0.15 1.20 114 XM_GoogleGroups 4092 1.02 0.28 1.17 115 XMBrknScrpt_02 4074 1.18 1.23 1.17 116 RCVD_IN_MSPIKE_H5 4045 0.97 0.08 1.16 117 XM_UB50 4018 1.84 5.15 1.15 118 XM_B_Unsub2 3782 1.19 1.71 1.08 119 XM_SPF_SoftFail 3773 2.19 7.53 1.08 120 SUBJ_ALL_CAPS 3758 1.37 2.77 1.08 121 TM2_M_VERY_LONG_WORD 3591 1.05 1.15 1.03 122 TooManyTo_002 3500 0.95 0.69 1.00 123 XM_B_COVIDMETA 3442 1.11 1.71 0.99 124 XM_B_Phish66 3439 1.27 2.65 0.99 125 KHOP_HELO_FCRDNS 3410 1.19 2.23 0.98 126 XM_RXBody 3386 0.88 0.45 0.97 127 T_XMHurry_00 3321 1.05 1.54 0.95 128 XM_H_Long_From02 3307 0.89 0.61 0.95 129 RCVD_IN_IADB_OPTIN 3288 0.81 0.16 0.94 130 XMBody_17 3223 1.53 4.46 0.92 131 TR_LOTS_OF_MONEY3 3205 5.08 25.14 0.92 132 DKIM_ADSP_CUSTOM_MED 3129 1.06 1.83 0.90 133 XMStockSpam_06 3107 0.95 1.24 0.89 134 XMSexyCombo_01 2999 1.00 1.71 0.86 135 HELO_NODOT 2910 4.75 23.65 0.83 136 HELO_NO_DOMAIN 2904 4.75 23.64 0.83 137 XMSubMetaI_00 2832 0.79 0.71 0.81 138 TR_MSPIKEBAYES00 2766 0.66 0.00 0.79 139 XMGenDplmaNmb 2765 0.79 0.76 0.79 140 DKIM_ADSP_NXDOMAIN 2723 1.32 3.92 0.78 141 RCVD_IN_MSPIKE_BL 2626 2.77 12.51 0.75 142 XMSubNoVowel 2539 0.92 1.87 0.73 143 TooManyTo_003 2478 0.66 0.45 0.71 144 T_TooManySym_04 2441 0.59 0.05 0.70 145 XMHTML_After_End 2347 0.75 1.12 0.67 146 XM_B_REG_HTML 2312 0.58 0.17 0.66 147 XMBody_95 2295 0.55 0.04 0.66 148 RELAYCOUNTRY_NL 2269 4.76 24.59 0.65 149 XMPhish30 2242 0.67 0.80 0.64 150 XM_S_SubURI 2216 0.54 0.09 0.64 151 TR_BOTNET_NEGATE 2203 0.59 0.39 0.63 152 NML_ADSP_CUSTOM_MED 2138 0.80 1.72 0.61 153 MISSING_HEADERS 2124 4.69 24.37 0.61 154 DIET_1 2114 0.68 1.02 0.61 155 TR_MetaPhish_Combo_01 2083 0.62 0.70 0.60 156 RELAYCOUNTRY_RU 2050 1.09 3.54 0.59 157 XM_B_COPY_HTML 2042 0.54 0.34 0.59 158 TooManyTo_004 2026 0.55 0.43 0.58 159 T_TooManySym_05 1931 0.46 0.01 0.55 160 THIS_AD 1925 0.51 0.32 0.55 161 NUMERIC_HTTP_ADDR 1895 0.54 0.53 0.54 162 XMBSHREFv2 1880 0.46 0.07 0.54 163 T_XMDrugObfuBody_00 1806 0.60 0.98 0.52 164 RELAYCOUNTRY_GB 1803 0.60 0.98 0.52 165 T_XMDrugObfuBody_01 1798 0.43 0.03 0.52 166 PLING_QUERY 1770 0.51 0.52 0.51 167 XMLngstWrd_00 1738 0.51 0.57 0.50 168 TR_XM_UnparsRelay 1726 0.95 3.13 0.49 169 TooManyTo_005 1716 0.47 0.35 0.49 170 RCVD_IN_MSPIKE_L3 1709 1.13 4.22 0.49 171 XM_ShortIntro_01 1675 0.51 0.68 0.48 172 USER_IN_WHITELIST 1668 0.40 0.00 0.48 173 XMPhish08 1653 0.46 0.42 0.47 174 XMPhish14 1593 0.47 0.52 0.46 175 SpammyFromTLD_01 1573 1.64 7.38 0.45 176 XMHTMLBadTable_001 1562 0.50 0.73 0.45 177 XMSubMetaSxObfu_02 1561 0.43 0.34 0.45 178 REPLYTO_WITHOUT_TO_CC 1551 4.53 24.26 0.44 179 XMSubMetaSxObfu_03 1531 0.47 0.61 0.44 180 XMLngstWrd_01 1522 0.44 0.46 0.44 181 T_FILL_THIS_FORM_SHORT 1521 0.59 1.34 0.44 182 XM_DIRTYINTL 1518 0.85 2.82 0.43 183 TR_XM_COVIDMETA4 1517 0.81 2.61 0.43 184 TR_LOTS_OF_MONEY1 1475 4.42 23.70 0.42 185 HTML_IMAGE_ONLY_20 1418 0.37 0.22 0.41 186 RDNS_DYNAMIC 1415 0.52 1.05 0.41 187 FORGED_GMAIL_RCVD 1383 0.53 1.19 0.40 188 XMBody_78 1377 0.43 0.58 0.39 189 XMSubMetaSSx_00 1366 0.45 0.73 0.39 190 XM_H_PHPMailer 1365 0.49 0.96 0.39 191 URI_NOVOWEL 1353 0.48 0.92 0.39 192 ADVANCE_FEE_2_NEW_MONEY 1315 4.07 21.86 0.38 193 HTML_TAG_BALANCE_BODY 1258 0.43 0.74 0.36 194 XMNoVowels 1240 0.40 0.62 0.36 195 XMLngstWrd_02 1215 0.35 0.38 0.35 196 XM_H_Undi_Recip 1188 0.37 0.53 0.34 197 XMSlimDrugH 1188 0.42 0.80 0.34 198 MPART_ALT_DIFF_COUNT 1162 0.52 1.43 0.33 199 HTTPS_HTTP_MISMATCH 1155 0.34 0.37 0.33 200 SUBJ_DOLLARS 1155 0.32 0.29 0.33 ----------------------------------------------------------------------