Email: 440802 Autolearn: 0 AvgScore: 0.63 AvgScanTime: 1.56 sec Spam: 73249 Autolearn: 0 AvgScore: 13.94 AvgScanTime: 2.65 sec Ham: 367553 Autolearn: 0 AvgScore: -2.02 AvgScanTime: 1.35 sec Time Spent Running SA: 191.62 hours Time Spent Processing Spam: 53.84 hours Time Spent Processing Ham: 137.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 70068 98.53 95.66 99.10 2 HTML_MESSAGE 65088 76.37 88.86 73.88 3 RELAYCOUNTRY_US 47993 69.16 65.52 69.89 4 DKIM_SIGNED 46122 67.47 62.97 68.36 5 XM_DK_Pass 44707 66.39 61.03 67.45 6 XM_B_Unicode 43549 61.65 59.45 62.08 7 XMListUnsubscribeExists 40195 51.67 54.87 51.03 8 DKIM_VALID 38850 62.60 53.04 64.51 9 XM_DK_Undo_02 34315 18.27 46.85 12.57 10 BAYES_99 28797 14.00 39.31 8.95 11 RCVD_IN_MSPIKE_H2 28089 24.58 38.35 21.83 12 MIME_HTML_ONLY 27295 23.05 37.26 20.22 13 DKIM_VALID_AU 26732 49.11 36.49 51.63 14 RELAYCOUNTRY_META 23625 9.46 32.25 4.92 15 BAYES_999 22299 11.15 30.44 7.31 16 XM_B_Unicode3 21857 36.09 29.84 37.34 17 BOTNET 21751 7.30 29.69 2.84 18 BAYES_50 20820 40.50 28.42 42.90 19 RCVD_IN_BL_SPAMCOP_NET 20189 5.75 27.56 1.40 20 UNTRUSTED_Relay 17998 5.87 24.57 2.15 21 LOC_TINY_FONT_1 17846 26.19 24.36 26.55 22 FVGT_m_MULTI_ODD 17063 20.43 23.29 19.85 23 HTML_IMAGE_RATIO_02 16510 9.81 22.54 7.28 24 DKIM_VALID_EF 15605 22.89 21.30 23.20 25 RCVD_IN_PSBL 15383 3.50 21.00 0.02 26 T_REMOTE_IMAGE 14436 5.55 19.71 2.73 27 HTML_FONT_LOW_CONTRAST 14189 25.94 19.37 27.25 28 T_TM2_M_HEADER_IN_MSG 14001 19.18 19.11 19.19 29 HTML_MIME_NO_HTML_TAG 13960 4.48 19.06 1.58 30 BODY_URI_ONLY 13938 3.22 19.03 0.07 31 HTML_SHORT_LINK_IMG_1 12742 2.93 17.40 0.05 32 XM_UncommonTLD01 12626 5.44 17.24 3.08 33 XMSubLong 12355 18.17 16.87 18.43 34 XM_Multi_Part_URI 11992 20.16 16.37 20.92 35 T_KAM_HTML_FONT_INVALID 11458 15.12 15.64 15.02 36 LOTS_OF_MONEY 10930 8.91 14.92 7.71 37 BOTNET_IPINHOSTNAME 10615 7.19 14.49 5.74 38 XM_Body_Dirty_Words 10367 13.50 14.15 13.37 39 FROM_EXCESS_BASE64 10253 5.00 14.00 3.20 40 RCVD_IN_MSPIKE_BL 9469 2.81 12.93 0.79 41 BAYES_80 8589 5.55 11.73 4.32 42 BAYES_60 8518 7.10 11.63 6.20 43 XMSubGiftCard1 8386 2.04 11.45 0.16 44 RCVD_IN_RP_RNBL 7663 1.79 10.46 0.07 45 DKIM_INVALID 7272 4.86 9.93 3.85 46 HTML_IMAGE_ONLY_12 7060 1.69 9.64 0.11 47 XM_B_Unsub 6862 9.79 9.37 9.87 48 BOTNET_NORDNS 6721 1.54 9.18 0.01 49 XM_SPF_SoftFail 6648 2.92 9.08 1.70 50 RELAYCOUNTRY_CA 6543 3.35 8.93 2.24 51 NO_DNS_FOR_FROM 6481 3.38 8.85 2.29 52 SpammyFromTLD_01 6245 1.85 8.53 0.52 53 XMSexyCombo_05 6158 5.92 8.41 5.43 54 RCVD_IN_MSPIKE_L5 6018 1.60 8.22 0.28 55 XM_B_Phish_Phrases 6015 6.98 8.21 6.73 56 LotsOfNums_01 5885 8.06 8.03 8.06 57 HTML_IMAGE_ONLY_08 5817 1.39 7.94 0.09 58 XM_UB99 4665 1.06 6.37 0.01 59 XM_Combo_Sbj 4626 1.19 6.32 0.17 60 RCVD_IN_MSPIKE_WL 4549 21.27 6.21 24.27 61 XM_UB50 4406 1.87 6.02 1.04 62 MPART_ALT_DIFF 4161 4.87 5.68 4.71 63 BAYES_95 4010 3.36 5.47 2.94 64 URIBL_SBL_A 3976 1.29 5.43 0.46 65 XM_Evil_Numbers_Gen 3950 8.13 5.39 8.67 66 XMBody_17 3879 2.15 5.30 1.52 67 XM_H_Long_From01 3722 4.35 5.08 4.21 68 SpammyFromTLD_02 3613 1.03 4.93 0.25 69 TooManyTo_001 3472 5.40 4.74 5.53 70 UNPARSEABLE_RELAY 3441 6.95 4.70 7.39 71 HK_RANDOM_FROM 3429 0.85 4.68 0.09 72 XM_UB999 3391 0.77 4.63 0.00 73 XMStrtUSub 3389 4.52 4.63 4.49 74 XM_UB60 3374 0.88 4.61 0.14 75 TR_XM_MaxBayes 3360 0.81 4.59 0.06 76 TR_XM_PhishingBody 3337 3.21 4.56 2.94 77 XMSubMetaSx_00 3234 4.36 4.42 4.35 78 T_XMDrugObfuBody_08 3224 2.27 4.40 1.85 79 XM_B_SEO 3195 0.79 4.36 0.08 80 XM_UB80 3125 0.75 4.27 0.05 81 XM_DIRTYINTL 2907 1.17 3.97 0.61 82 HTML_IMAGE_RATIO_04 2892 5.34 3.95 5.61 83 IMG_ONLY_FM_DOM_INFO 2821 0.64 3.85 0.00 84 RCVD_IN_MSPIKE_L3 2711 1.00 3.70 0.46 85 HTML_IMAGE_RATIO_06 2679 3.63 3.66 3.63 86 MIME_HTML_MOSTLY 2646 2.63 3.61 2.44 87 XM_SendGrid 2619 5.86 3.58 6.31 88 RCVD_IN_MSPIKE_H3 2562 12.46 3.50 14.25 89 XM_B_SpammyTLD 2561 2.21 3.50 1.96 90 XM_OfRef6 2431 1.62 3.32 1.29 91 XMNumbers 2359 3.22 3.22 3.22 92 TR_LOTS_OF_MONEY3 2296 1.22 3.13 0.84 93 TR_XM_INV_DKIM 2265 0.73 3.09 0.26 94 HTML_IMAGE_RATIO_08 2183 2.34 2.98 2.22 95 KHOP_HELO_FCRDNS 2165 1.72 2.96 1.47 96 MISSING_HEADERS 2128 0.71 2.91 0.28 97 TR_XM_PHPDW 2117 0.79 2.89 0.37 98 TR_XM_PHPForged 2103 0.78 2.87 0.36 99 TR_XM_FormFill2 2083 0.77 2.84 0.36 100 XM_H_PHPOS 2080 0.77 2.84 0.36 101 TR_XM_UnparsRelay 2059 1.09 2.81 0.75 102 TR_XM_MaxSPIKE 1980 0.47 2.70 0.03 103 XM_B_COVIDMETA 1961 1.55 2.68 1.32 104 TR_XM_MaxWHORU 1918 0.49 2.62 0.07 105 RCVD_IN_MSPIKE_H4 1890 7.89 2.58 8.95 106 TR_XM_COVIDMETA4 1879 0.75 2.57 0.39 107 REPLYTO_WITHOUT_TO_CC 1868 0.53 2.55 0.13 108 TR_Mismatch_TLD_02 1853 0.51 2.53 0.10 109 SUBJ_ALL_CAPS 1835 1.60 2.51 1.42 110 HTML_IMAGE_ONLY_20 1815 0.78 2.48 0.44 111 T_FILL_THIS_FORM_SHORT 1786 0.87 2.44 0.55 112 XM_UB95 1776 0.43 2.42 0.03 113 RELAYCOUNTRY_FR 1762 0.61 2.41 0.25 114 XM_CamelCaseFrm001 1748 1.70 2.39 1.56 115 XM_B_Phish66 1736 1.43 2.37 1.25 116 URI_TRY_3LD 1725 1.60 2.35 1.45 117 XMDiploma_00 1672 1.62 2.28 1.49 118 XMSubNoVowel 1614 0.82 2.20 0.55 119 DATE_IN_PAST_03_06 1576 0.50 2.15 0.17 120 RELAYCOUNTRY_BR 1562 0.36 2.13 0.01 121 FROM_SUSPICIOUS_NTLD 1560 0.40 2.13 0.05 122 XMBrknScrpt_02 1514 1.11 2.07 0.92 123 FROM_SUSPICIOUS_NTLD_FP 1510 0.38 2.06 0.04 124 FROM_LOCAL_NOVOWEL 1494 0.36 2.04 0.03 125 TR_XM_RelayPhish 1464 0.44 2.00 0.13 126 TR_Symld_Words 1458 2.03 1.99 2.04 127 XMHTML_After_End 1405 1.23 1.92 1.09 128 RELAYCOUNTRY_GB 1371 0.71 1.87 0.48 129 TM2_M_URI_OPT_OUT 1370 15.96 1.87 18.76 130 DKIM_ADSP_NXDOMAIN 1353 0.83 1.85 0.62 131 RELAYCOUNTRY_KR 1343 0.31 1.83 0.01 132 XMReplyNow 1334 0.39 1.82 0.10 133 RELAYCOUNTRY_SG 1330 0.35 1.82 0.05 134 XMEmptySub 1290 0.36 1.76 0.09 135 MIME_QP_LONG_LINE 1287 3.22 1.76 3.52 136 XM_URI_RBL 1280 0.43 1.75 0.17 137 T_TooManySym_01 1236 4.98 1.69 5.64 138 FVGT_m_MULTI_ODD_EMAIL 1235 0.31 1.69 0.03 139 RELAYCOUNTRY_JP 1234 0.31 1.68 0.03 140 TR_XM_DK_SendGrid 1209 3.42 1.65 3.78 141 RELAYCOUNTRY_DE 1199 0.53 1.64 0.31 142 DATE_IN_PAST_12_24 1198 0.30 1.64 0.03 143 RELAYCOUNTRY_HK 1196 0.28 1.63 0.02 144 HK_RANDOM_REPLYTO 1193 0.46 1.63 0.23 145 SHORT_URI 1191 0.28 1.63 0.01 146 URI_HEX 1172 1.60 1.60 1.60 147 XMSexyCombo_01 1153 1.34 1.57 1.29 148 DKIM_ADSP_CUSTOM_MED 1149 0.92 1.57 0.79 149 MIME_CHARSET_FARAWAY 1146 0.32 1.56 0.08 150 TM2_M_VERY_LONG_WORD 1123 1.25 1.53 1.20 151 NML_ADSP_CUSTOM_MED 1092 0.71 1.49 0.56 152 DATE_IN_PAST_06_12 1079 0.31 1.47 0.08 153 CHARSET_FARAWAY_HEADER 1078 0.27 1.47 0.03 154 HTML_IMAGE_ONLY_28 1057 0.41 1.44 0.20 155 XM_B_Unsub2 1037 1.86 1.42 1.95 156 RDNS_DYNAMIC 1035 0.55 1.41 0.38 157 T_XMDrugObfuBody_14 1028 1.37 1.40 1.36 158 PDS_OTHER_BAD_TLD 1011 0.58 1.38 0.42 159 MPART_ALT_DIFF_COUNT 991 0.53 1.35 0.36 160 LOADSA_MONEY_COMBO 976 0.30 1.33 0.09 161 FORGED_GMAIL_RCVD 974 0.57 1.33 0.42 162 TR_Mismatch_TLD_01 960 0.40 1.31 0.22 163 XMStockSpam_06 924 1.37 1.26 1.39 164 BAYES_40 920 3.44 1.26 3.88 165 XMGppyBdWords 903 0.32 1.23 0.14 166 XM_H_PHPMailer 887 0.56 1.21 0.43 167 XFER_LOTSA_MONEY 863 0.21 1.18 0.02 168 INVESTMENT_ADVICE 858 0.28 1.17 0.10 169 MIME_HTML_ONLY_MULTI 850 2.38 1.16 2.62 170 RELAYCOUNTRY_RU 807 0.30 1.10 0.14 171 URI_PHP_REDIR 790 0.26 1.08 0.10 172 TR_XM_COVIDMETA1 779 0.32 1.06 0.17 173 HTML_FONT_TINY_NORDNS 763 0.37 1.04 0.24 174 HTML_TAG_BALANCE_CENTER 758 0.27 1.03 0.12 175 HDRS_MISSP 743 0.23 1.01 0.07 176 ONE_TIME 738 0.38 1.01 0.25 177 URIBL_BLACK 738 0.18 1.01 0.01 178 XMSubMetaI_00 736 0.70 1.00 0.63 179 XM_H_PHPOS_M 734 0.33 1.00 0.20 180 LongTLD 718 0.27 0.98 0.13 181 RELAYCOUNTRY_NL 712 0.35 0.97 0.22 182 MONEY_FORM_SHORT 712 0.16 0.97 0.00 183 ADVANCE_FEE_2_NEW_MONEY 712 0.17 0.97 0.00 184 TR_Caps_n_Bayes_99 709 0.39 0.97 0.27 185 RCVD_IN_MSPIKE_L4 699 0.19 0.95 0.04 186 RELAYCOUNTRY_NG 695 0.16 0.95 0.00 187 XMBdyGiftCard01 693 1.45 0.95 1.55 188 RELAYCOUNTRY_IE 688 0.25 0.94 0.11 189 XM_OfRef7 683 0.28 0.93 0.15 190 MAILING_LIST_MULTI 679 1.43 0.93 1.53 191 BAYES_20 675 4.92 0.92 5.71 192 XMPhish14 674 0.46 0.92 0.37 193 XMBody_78 661 0.47 0.90 0.38 194 T_XMHurry_00 654 0.65 0.89 0.61 195 DIET_1 654 0.55 0.89 0.48 196 T_XMDrugObfuBody_00 653 0.87 0.89 0.86 197 HTML_IMAGE_ONLY_16 652 0.32 0.89 0.21 198 URI_NOVOWEL 631 1.51 0.86 1.64 199 XM_JunkDunk 631 0.14 0.86 0.00 200 TR_XM_FormFill 623 0.16 0.85 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 364255 98.53 95.66 99.10 2 HTML_MESSAGE 271555 76.37 88.86 73.88 3 RELAYCOUNTRY_US 256869 69.16 65.52 69.89 4 DKIM_SIGNED 251274 67.47 62.97 68.36 5 XM_DK_Pass 247928 66.39 61.03 67.45 6 DKIM_VALID 237109 62.60 53.04 64.51 7 XM_B_Unicode 228184 61.65 59.45 62.08 8 DKIM_VALID_AU 189762 49.11 36.49 51.63 9 XMListUnsubscribeExists 187576 51.67 54.87 51.03 10 BAYES_50 157696 40.50 28.42 42.90 11 XM_B_Unicode3 137236 36.09 29.84 37.34 12 HTML_FONT_LOW_CONTRAST 100170 25.94 19.37 27.25 13 LOC_TINY_FONT_1 97579 26.19 24.36 26.55 14 ALL_TRUSTED 95203 21.72 0.76 25.90 15 RCVD_IN_MSPIKE_WL 89208 21.27 6.21 24.27 16 DKIM_VALID_EF 85276 22.89 21.30 23.20 17 RCVD_IN_MSPIKE_H2 80249 24.58 38.35 21.83 18 XM_Multi_Part_URI 76877 20.16 16.37 20.92 19 MIME_HTML_ONLY 74302 23.05 37.26 20.22 20 FVGT_m_MULTI_ODD 72976 20.43 23.29 19.85 21 T_TM2_M_HEADER_IN_MSG 70523 19.18 19.11 19.19 22 TM2_M_URI_OPT_OUT 68965 15.96 1.87 18.76 23 XMSubLong 67743 18.17 16.87 18.43 24 ANY_BOUNCE_MESSAGE 65912 15.03 0.44 17.93 25 BOUNCE_MESSAGE 65912 15.03 0.44 17.93 26 T_KAM_HTML_FONT_INVALID 55208 15.12 15.64 15.02 27 BAYES_00 54109 12.39 0.69 14.72 28 RCVD_IN_MSPIKE_H3 52360 12.46 3.50 14.25 29 XM_Body_Dirty_Words 49158 13.50 14.15 13.37 30 XM_DK_Undo_02 46214 18.27 46.85 12.57 31 BAYES_05 38108 8.74 0.55 10.37 32 XM_B_Unsub 36281 9.79 9.37 9.87 33 RCVD_IN_RP_SAFE 33058 7.62 0.74 8.99 34 BAYES_99 32908 14.00 39.31 8.95 35 RCVD_IN_MSPIKE_H4 32891 7.89 2.58 8.95 36 XM_Evil_Numbers_Gen 31879 8.13 5.39 8.67 37 XM_DKIMWhitelistDomains 31518 7.15 0.02 8.58 38 RCVD_IN_RP_CERTIFIED 29835 6.82 0.34 8.12 39 LotsOfNums_01 29631 8.06 8.03 8.06 40 LOTS_OF_MONEY 28331 8.91 14.92 7.71 41 UNPARSEABLE_RELAY 27179 6.95 4.70 7.39 42 BAYES_999 26850 11.15 30.44 7.31 43 TR_XM_DK_Bayes 26793 6.15 0.41 7.29 44 HTML_IMAGE_RATIO_02 26754 9.81 22.54 7.28 45 TR_XM_DK_Bayes1 25469 5.82 0.27 6.93 46 XM_B_Phish_Phrases 24739 6.98 8.21 6.73 47 TR_XM_DK_Bayes2 23452 5.35 0.18 6.38 48 XM_SendGrid 23200 5.86 3.58 6.31 49 BAYES_60 22788 7.10 11.63 6.20 50 BOTNET_IPINHOSTNAME 21082 7.19 14.49 5.74 51 BAYES_20 21005 4.92 0.92 5.71 52 T_TooManySym_01 20722 4.98 1.69 5.64 53 HTML_IMAGE_RATIO_04 20631 5.34 3.95 5.61 54 TooManyTo_001 20310 5.40 4.74 5.53 55 XMSexyCombo_05 19956 5.92 8.41 5.43 56 RELAYCOUNTRY_META 18096 9.46 32.25 4.92 57 MPART_ALT_DIFF 17315 4.87 5.68 4.71 58 XMStrtUSub 16516 4.52 4.63 4.49 59 XMSubMetaSx_00 15976 4.36 4.42 4.35 60 BAYES_80 15863 5.55 11.73 4.32 61 XM_H_Long_From01 15467 4.35 5.08 4.21 62 IN_ZIMBRA_NJ_WHITELIST 14829 3.37 0.03 4.03 63 BAYES_40 14253 3.44 1.26 3.88 64 DKIM_INVALID 14165 4.86 9.93 3.85 65 TR_XM_DK_SendGrid 13885 3.42 1.65 3.78 66 HTML_IMAGE_RATIO_06 13337 3.63 3.66 3.63 67 T_TooManySym_02 12958 3.07 0.81 3.53 68 MIME_QP_LONG_LINE 12928 3.22 1.76 3.52 69 RCVD_IN_IADB_LISTED 12693 2.97 0.56 3.45 70 XMNumbers 11848 3.22 3.22 3.22 71 FROM_EXCESS_BASE64 11771 5.00 14.00 3.20 72 XM_UncommonTLD01 11332 5.44 17.24 3.08 73 TVD_RCVD_IP 11104 2.61 0.53 3.02 74 RCVD_IN_IADB_SPF 10925 2.56 0.49 2.97 75 TR_XM_PhishingBody 10819 3.21 4.56 2.94 76 BAYES_95 10816 3.36 5.47 2.94 77 BOTNET 10422 7.30 29.69 2.84 78 T_REMOTE_IMAGE 10045 5.55 19.71 2.73 79 RCVD_IN_IADB_SENDERID 9653 2.27 0.46 2.63 80 MIME_HTML_ONLY_MULTI 9633 2.38 1.16 2.62 81 RCVD_IN_IADB_DK 9384 2.21 0.47 2.55 82 MIME_HTML_MOSTLY 8958 2.63 3.61 2.44 83 NO_DNS_FOR_FROM 8421 3.38 8.85 2.29 84 RELAYCOUNTRY_CA 8216 3.35 8.93 2.24 85 HTML_IMAGE_RATIO_08 8142 2.34 2.98 2.22 86 RCVD_IN_IADB_VOUCHED 8098 1.87 0.17 2.20 87 UNTRUSTED_Relay 7896 5.87 24.57 2.15 88 HELO_MISC_IP 7642 1.85 0.72 2.08 89 CK_HELO_DYNAMIC_SPLIT_IP 7640 1.85 0.67 2.08 90 TR_Symld_Words 7511 2.03 1.99 2.04 91 INVALID_MSGID 7205 1.65 0.10 1.96 92 XM_B_SpammyTLD 7194 2.21 3.50 1.96 93 XM_B_Unsub2 7150 1.86 1.42 1.95 94 T_XMDrugObfuBody_08 6787 2.27 4.40 1.85 95 TO_MALFORMED 6469 1.47 0.02 1.76 96 XM_SPF_SoftFail 6236 2.92 9.08 1.70 97 XM_H_Trusted_IP 6131 1.39 0.00 1.67 98 URI_NOVOWEL 6021 1.51 0.86 1.64 99 URI_HEX 5865 1.60 1.60 1.60 100 HTML_MIME_NO_HTML_TAG 5803 4.48 19.06 1.58 101 XM_CamelCaseFrm001 5730 1.70 2.39 1.56 102 XMBdyGiftCard01 5695 1.45 0.95 1.55 103 MAILING_LIST_MULTI 5629 1.43 0.93 1.53 104 XMBody_17 5582 2.15 5.30 1.52 105 XMDiploma_00 5489 1.62 2.28 1.49 106 KHOP_HELO_FCRDNS 5418 1.72 2.96 1.47 107 URI_TRY_3LD 5322 1.60 2.35 1.45 108 RCVD_IN_IADB_OPTIN 5295 1.23 0.20 1.44 109 XM_PDF 5239 1.25 0.35 1.43 110 SUBJ_ALL_CAPS 5206 1.60 2.51 1.42 111 RCVD_IN_BL_SPAMCOP_NET 5163 5.75 27.56 1.40 112 XMStockSpam_06 5099 1.37 1.26 1.39 113 T_XMDrugObfuBody_14 5017 1.37 1.40 1.36 114 USER_IN_DEF_DKIM_WL 4864 1.10 0.01 1.32 115 XM_B_COVIDMETA 4852 1.55 2.68 1.32 116 XMSexyCombo_01 4739 1.34 1.57 1.29 117 XM_OfRef6 4728 1.62 3.32 1.29 118 IN_HORDE_ADDRESS_BOOK 4705 1.08 0.08 1.28 119 XMGappySubj_01 4682 1.08 0.13 1.27 120 XM_B_Phish66 4589 1.43 2.37 1.25 121 T_TooManySym_03 4559 1.08 0.29 1.24 122 TM2_M_VERY_LONG_WORD 4409 1.25 1.53 1.20 123 XM_DK_Undo_01 4237 1.08 0.69 1.15 124 XMHTML_After_End 4008 1.23 1.92 1.09 125 RCVD_IN_MSPIKE_H5 3957 0.92 0.13 1.08 126 XM_GoogleGroups 3888 0.95 0.38 1.06 127 XM_UB50 3821 1.87 6.02 1.04 128 HTML_FONT_FACE_BAD 3810 1.01 0.85 1.04 129 XMGenDplmaNmb 3806 0.98 0.71 1.04 130 TooManyTo_002 3485 0.89 0.61 0.95 131 XMBody_95 3420 0.78 0.04 0.93 132 XMBrknScrpt_02 3397 1.11 2.07 0.92 133 XM_ProductURIs 3362 0.87 0.64 0.91 134 XMSubMetaSxObfu_03 3316 0.84 0.53 0.90 135 XM_H_Long_From02 3288 0.88 0.79 0.89 136 T_XMDrugObfuBody_00 3167 0.87 0.89 0.86 137 TR_LOTS_OF_MONEY3 3103 1.22 3.13 0.84 138 XMSolicitRefs_0 3103 0.76 0.36 0.84 139 XMPhish08 2930 0.77 0.65 0.80 140 XM_shorewaves_Whitelist 2924 0.66 0.00 0.80 141 DKIM_ADSP_CUSTOM_MED 2919 0.92 1.57 0.79 142 RCVD_IN_MSPIKE_BL 2910 2.81 12.93 0.79 143 TR_MSPIKEBAYES00 2774 0.63 0.00 0.75 144 XMSexyCombo_04 2754 0.73 0.63 0.75 145 TR_XM_UnparsRelay 2740 1.09 2.81 0.75 146 TR_BOTNET_NEGATE 2595 0.67 0.48 0.71 147 XMHTMLBadTable_001 2577 0.63 0.24 0.70 148 TooManyTo_003 2465 0.63 0.40 0.67 149 T_TooManySym_04 2430 0.56 0.03 0.66 150 XMSubMetaSx_01 2423 0.59 0.23 0.66 151 TR_MetaPhish_Combo_01 2377 0.66 0.75 0.65 152 XM_B_REG_HTML 2367 0.57 0.22 0.64 153 XMSubMetaI_00 2330 0.70 1.00 0.63 154 DKIM_ADSP_NXDOMAIN 2290 0.83 1.85 0.62 155 XM_S_SubURI 2281 0.53 0.08 0.62 156 XM_DIRTYINTL 2251 1.17 3.97 0.61 157 HTML_TAG_BALANCE_BODY 2237 0.61 0.63 0.61 158 T_XMHurry_00 2233 0.65 0.89 0.61 159 XM_RXBody 2143 0.57 0.50 0.58 160 XMSexyCombo_02 2101 0.50 0.14 0.57 161 NML_ADSP_CUSTOM_MED 2045 0.71 1.49 0.56 162 TooManyTo_004 2042 0.52 0.36 0.56 163 T_FILL_THIS_FORM_SHORT 2032 0.87 2.44 0.55 164 XMSubNoVowel 2010 0.82 2.20 0.55 165 THIS_AD 2000 0.51 0.33 0.54 166 XMBSHREFv2 1956 0.48 0.23 0.53 167 T_TooManySym_05 1936 0.44 0.00 0.53 168 XMPhish30 1928 0.55 0.68 0.52 169 SpammyFromTLD_01 1925 1.85 8.53 0.52 170 USER_IN_WHITELIST 1914 0.43 0.00 0.52 171 TooManyTo_005 1784 0.46 0.33 0.49 172 DIET_1 1773 0.55 0.89 0.48 173 RELAYCOUNTRY_GB 1770 0.71 1.87 0.48 174 T_OBFU_PDF_ATTACH 1768 0.41 0.06 0.48 175 RCVD_IN_MSPIKE_L3 1701 1.00 3.70 0.46 176 URIBL_SBL_A 1699 1.29 5.43 0.46 177 XMLngstWrd_00 1699 0.44 0.34 0.46 178 XMSubMetaSxObfu_02 1698 0.44 0.34 0.46 179 SUBJ_DOLLARS 1643 0.44 0.43 0.45 180 NUMERIC_HTTP_ADDR 1639 0.47 0.59 0.45 181 HELO_NODOT 1616 0.48 0.71 0.44 182 HELO_NO_DOMAIN 1614 0.48 0.70 0.44 183 HTML_IMAGE_ONLY_20 1606 0.78 2.48 0.44 184 XM_H_PHPMailer 1575 0.56 1.21 0.43 185 HTTPS_HTTP_MISMATCH 1563 0.44 0.54 0.43 186 XM_B_COPY_HTML 1563 0.44 0.50 0.43 187 PDS_OTHER_BAD_TLD 1554 0.58 1.38 0.42 188 FORGED_GMAIL_RCVD 1538 0.57 1.33 0.42 189 XMLngstWrd_01 1505 0.39 0.29 0.41 190 T_Symld_Words_02 1489 0.40 0.38 0.41 191 XMSlimDrugH 1446 0.43 0.59 0.39 192 TR_XM_COVIDMETA4 1417 0.75 2.57 0.39 193 XMBody_78 1414 0.47 0.90 0.38 194 RDNS_DYNAMIC 1396 0.55 1.41 0.38 195 TR_XM_PHPDW 1360 0.79 2.89 0.37 196 XMPhish14 1343 0.46 0.92 0.37 197 MPART_ALT_DIFF_COUNT 1336 0.53 1.35 0.36 198 TR_XM_PHPForged 1332 0.78 2.87 0.36 199 TM2_M_A_HREF_HREF 1324 0.42 0.74 0.36 200 TR_XM_FormFill2 1323 0.77 2.84 0.36 ----------------------------------------------------------------------