Email: 413734 Autolearn: 0 AvgScore: 0.83 AvgScanTime: 1.63 sec Spam: 75317 Autolearn: 0 AvgScore: 13.96 AvgScanTime: 2.54 sec Ham: 338417 Autolearn: 0 AvgScore: -2.09 AvgScanTime: 1.43 sec Time Spent Running SA: 187.87 hours Time Spent Processing Spam: 53.07 hours Time Spent Processing Ham: 134.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 72369 98.40 96.09 98.91 2 HTML_MESSAGE 67469 87.65 89.58 87.22 3 DKIM_SIGNED 48993 75.26 65.05 77.53 4 XMListUnsubscribeExists 48876 58.12 64.89 56.61 5 XM_DK_Pass 47728 74.11 63.37 76.51 6 XM_B_Unicode 45730 69.99 60.72 72.05 7 RELAYCOUNTRY_US 45480 77.71 60.38 81.57 8 DKIM_VALID 42323 70.11 56.19 73.21 9 XM_DK_Undo_02 33399 18.90 44.34 13.23 10 DKIM_VALID_AU 31777 55.61 42.19 58.59 11 BAYES_99 29423 14.61 39.07 9.17 12 RELAYCOUNTRY_META 25407 10.58 33.73 5.43 13 MIME_HTML_ONLY 25052 26.53 33.26 25.04 14 RCVD_IN_MSPIKE_H2 23529 26.85 31.24 25.88 15 BOTNET 22878 8.13 30.38 3.18 16 BAYES_999 21881 11.36 29.05 7.43 17 LOC_TINY_FONT_1 21181 29.01 28.12 29.20 18 BAYES_50 20724 46.77 27.52 51.06 19 UNTRUSTED_Relay 20575 7.21 27.32 2.73 20 XM_B_Unicode3 19221 39.68 25.52 42.83 21 XM_UncommonTLD01 18512 7.75 24.58 4.01 22 DKIM_VALID_EF 17768 26.16 23.59 26.74 23 RCVD_IN_PSBL 16635 4.04 22.09 0.02 24 XM_Multi_Part_URI 16072 15.47 21.34 14.16 25 FVGT_m_MULTI_ODD 15519 21.66 20.60 21.89 26 T_TM2_M_HEADER_IN_MSG 15206 21.03 20.19 21.22 27 XMSubLong 13273 20.32 17.62 20.92 28 HTML_IMAGE_RATIO_02 13196 10.28 17.52 8.67 29 HTML_FONT_LOW_CONTRAST 12969 27.49 17.22 29.78 30 RCVD_IN_MSPIKE_BL 12839 3.98 17.05 1.07 31 T_KAM_HTML_FONT_INVALID 12416 17.66 16.48 17.92 32 XM_Body_Dirty_Words 12143 14.99 16.12 14.74 33 FROM_EXCESS_BASE64 11642 5.60 15.46 3.41 34 HTML_MIME_NO_HTML_TAG 11343 4.45 15.06 2.09 35 T_REMOTE_IMAGE 11343 5.90 15.06 3.86 36 LOTS_OF_MONEY 11077 8.53 14.71 7.16 37 MPART_ALT_DIFF 11027 8.77 14.64 7.46 38 RCVD_IN_BL_SPAMCOP_NET 10814 3.84 14.36 1.50 39 SpammyFromTLD_01 10520 3.01 13.97 0.57 40 XM_B_Phish_Phrases 9608 9.62 12.76 8.93 41 BOTNET_IPINHOSTNAME 9179 7.35 12.19 6.27 42 BAYES_80 8541 5.88 11.34 4.67 43 HTML_IMAGE_ONLY_16 8529 2.24 11.32 0.21 44 XM_SPF_SoftFail 8441 3.20 11.21 1.42 45 HTML_SHORT_LINK_IMG_2 8439 2.09 11.20 0.07 46 RCVD_IN_RP_RNBL 8422 2.11 11.18 0.09 47 LotsOfNums_01 7781 9.66 10.33 9.51 48 RCVD_IN_MSPIKE_L5 7760 2.12 10.30 0.30 49 RELAYCOUNTRY_CA 7617 3.56 10.11 2.11 50 XM_UB99 7574 1.84 10.06 0.01 51 XMSexyCombo_05 7107 6.15 9.44 5.42 52 XMBrknScrpt_02 6982 2.88 9.27 1.46 53 BAYES_60 6908 7.50 9.17 7.13 54 DKIM_INVALID 6670 5.15 8.86 4.33 55 BOTNET_NORDNS 6662 1.62 8.85 0.01 56 XMStrtUSub 6356 6.00 8.44 5.46 57 BAYES_95 6183 3.82 8.21 2.85 58 NO_DNS_FOR_FROM 6126 3.45 8.13 2.40 59 TR_XM_PhishingBody 5879 3.98 7.81 3.13 60 XMBody_17 5424 2.09 7.20 0.95 61 XMSubMetaSx_00 5251 5.25 6.97 4.87 62 XM_UB999 5195 1.26 6.90 0.01 63 XM_Combo_Sbj 5194 1.50 6.90 0.30 64 XM_B_Unsub 5175 10.41 6.87 11.20 65 MIME_HTML_MOSTLY 5118 3.50 6.80 2.77 66 RELAYCOUNTRY_FR 4909 1.39 6.52 0.24 67 XM_DIRTYINTL 4821 1.66 6.40 0.60 68 RCVD_IN_MSPIKE_L3 4762 1.74 6.32 0.72 69 XM_UB50 4720 2.34 6.27 1.47 70 RCVD_IN_MSPIKE_WL 4642 23.64 6.16 27.53 71 PLING_QUERY 4613 1.57 6.12 0.55 72 XM_B_Phish66 4502 2.18 5.98 1.33 73 HTML_IMAGE_RATIO_08 4414 3.46 5.86 2.93 74 UNPARSEABLE_RELAY 4359 7.99 5.79 8.48 75 LOCALPART_IN_SUBJECT 4328 1.06 5.75 0.02 76 SpammyFromTLD_02 4327 1.23 5.75 0.22 77 SUBJ_ALL_CAPS 4239 2.02 5.63 1.22 78 XM_Evil_Numbers_Gen 3915 9.09 5.20 9.96 79 TooManyTo_001 3672 6.06 4.88 6.33 80 XM_H_Long_From01 3647 4.93 4.84 4.95 81 URI_PHP_REDIR 3519 0.88 4.67 0.03 82 DKIM_ADSP_NXDOMAIN 3180 1.43 4.22 0.81 83 FROM_SUSPICIOUS_NTLD 3000 0.80 3.98 0.09 84 TR_XM_PHPDW 2990 1.05 3.97 0.40 85 FROM_SUSPICIOUS_NTLD_FP 2971 0.79 3.94 0.08 86 TR_XM_PHPForged 2966 1.04 3.94 0.40 87 TR_XM_FormFill2 2955 1.03 3.92 0.38 88 XM_H_PHPOS 2954 1.02 3.92 0.38 89 RCVD_IN_MSPIKE_H3 2905 13.41 3.86 15.54 90 XM_UB80 2792 0.76 3.71 0.10 91 XM_UB60 2767 0.82 3.67 0.19 92 XMNumbers 2666 3.70 3.54 3.74 93 TR_LOTS_OF_MONEY3 2663 1.11 3.54 0.58 94 XM_B_SpammyTLD 2601 2.23 3.45 1.96 95 URIBL_SBL_A 2560 0.76 3.40 0.17 96 DATE_IN_PAST_06_12 2420 0.82 3.21 0.29 97 FROM_MISSP_REPLYTO 2373 0.58 3.15 0.00 98 T_HTML_TAG_BALANCE_CENTER 2298 0.65 3.05 0.11 99 BODY_URI_ONLY 2283 0.60 3.03 0.06 100 HK_RANDOM_FROM 2244 0.63 2.98 0.11 101 DATE_IN_PAST_03_06 2221 0.69 2.95 0.19 102 XM_UB95 2213 0.55 2.94 0.02 103 TR_XM_INV_DKIM 2188 0.78 2.91 0.31 104 HDRS_MISSP 2113 0.54 2.81 0.04 105 MISSING_HEADERS 2085 0.86 2.77 0.43 106 KHOP_HELO_FCRDNS 2081 1.35 2.76 1.04 107 TR_XM_MaxBayes 2069 0.53 2.75 0.04 108 HTML_IMAGE_RATIO_04 2029 5.14 2.69 5.68 109 TR_XM_MaxSPIKE 2020 0.58 2.68 0.11 110 XM_SendGrid 1996 6.51 2.65 7.37 111 XMSexyCombo_01 1993 1.30 2.65 1.00 112 REPLYTO_WITHOUT_TO_CC 1984 0.52 2.63 0.05 113 XM_B_COVIDMETA 1848 1.39 2.45 1.16 114 T_XMDrugObfuBody_08 1812 1.69 2.41 1.53 115 TR_XM_COVIDMETA4 1770 0.89 2.35 0.57 116 TO_NAME_SUBJ_NO_RDNS 1753 0.42 2.33 0.00 117 XM_OfRef6 1747 1.36 2.32 1.14 118 DIET_1 1729 1.04 2.30 0.76 119 XM_CamelCaseFrm001 1714 1.93 2.28 1.86 120 TR_XM_UnparsRelay 1690 0.81 2.24 0.49 121 FROM_MISSPACED 1670 0.42 2.22 0.02 122 FROM_MISSP_EH_MATCH 1652 0.40 2.19 0.00 123 HTML_IMAGE_RATIO_06 1632 3.31 2.17 3.57 124 TO_NO_BRKTS_MSFT 1619 0.39 2.15 0.00 125 TR_XM_MaxWHORU 1610 0.45 2.14 0.07 126 TO_NO_BRKTS_FROM_MSSP 1609 0.39 2.14 0.01 127 URI_TRY_3LD 1604 1.67 2.13 1.56 128 FSL_CTYPE_WIN1251 1588 0.38 2.11 0.00 129 FROM_MISSP_MSFT 1588 0.38 2.11 0.00 130 RCVD_IN_MSPIKE_H4 1561 8.92 2.07 10.44 131 TM2_M_URI_OPT_OUT 1546 5.88 2.05 6.73 132 XM_ShortIntro_01 1542 0.87 2.05 0.61 133 TR_Mismatch_TLD_01 1520 0.58 2.02 0.26 134 RELAYCOUNTRY_GB 1515 0.85 2.01 0.59 135 TM2_M_BODY_EMPTY 1504 0.55 2.00 0.22 136 XMEmptyBody_01 1482 0.41 1.97 0.06 137 T_PDS_OTHER_BAD_TLD 1428 0.84 1.90 0.61 138 BAYES_40 1392 3.65 1.85 4.06 139 T_TooManySym_01 1391 4.93 1.85 5.62 140 RELAYCOUNTRY_CN 1390 0.38 1.85 0.05 141 TR_XM_RelayPhish 1340 0.45 1.78 0.15 142 URI_HEX 1310 1.75 1.74 1.76 143 TR_Caps_n_Bayes_95 1309 0.35 1.74 0.04 144 XMDiploma_00 1293 1.47 1.72 1.42 145 XMMoneyMeta_00 1284 0.51 1.70 0.24 146 HK_RANDOM_REPLYTO 1270 0.48 1.69 0.21 147 XM_URI_RBL 1252 0.46 1.66 0.19 148 RDNS_DYNAMIC 1211 0.67 1.61 0.46 149 XMHTML_After_End 1194 0.86 1.59 0.70 150 BAYES_20 1187 3.04 1.58 3.37 151 TR_LOTS_OF_MONEY1 1169 0.31 1.55 0.03 152 XMSubMetaSx_01 1151 0.39 1.53 0.14 153 T_XMDrugObfuBody_14 1145 2.05 1.52 2.16 154 TR_Caps_n_Bayes_80 1130 0.34 1.50 0.09 155 DKIM_ADSP_CUSTOM_MED 1126 1.15 1.50 1.08 156 MIME_HTML_ONLY_MULTI 1120 4.66 1.49 5.36 157 TM2_M_VERY_LONG_WORD 1116 1.45 1.48 1.45 158 XMSubNoVowel 1088 1.39 1.44 1.38 159 RELAYCOUNTRY_SG 1057 0.47 1.40 0.26 160 XMSexyCombo_02 1054 0.32 1.40 0.08 161 XMStockSpam_06 1051 1.06 1.40 0.99 162 NML_ADSP_CUSTOM_MED 1027 0.87 1.36 0.75 163 MONEY_FROM_MISSP 1012 0.25 1.34 0.00 164 DEAR_SOMETHING 997 0.33 1.32 0.11 165 FROM_LOCAL_NOVOWEL 959 0.25 1.27 0.03 166 RELAYCOUNTRY_RU 938 0.54 1.25 0.38 167 MIME_QP_LONG_LINE 936 3.73 1.24 4.28 168 XM_B_Unsub2 926 1.70 1.23 1.81 169 RELAYCOUNTRY_DE 921 0.50 1.22 0.33 170 XMSubMetaI_00 920 0.79 1.22 0.69 171 FORGED_GMAIL_RCVD 916 0.73 1.22 0.62 172 CTE_8BIT_MISMATCH 907 0.41 1.20 0.23 173 ALL_TRUSTED 891 11.48 1.18 13.77 174 MIMEOLE_DIRECT_TO_MX 878 0.21 1.17 0.00 175 MORE_SEX 876 0.24 1.16 0.03 176 URI_NOVOWEL 869 1.81 1.15 1.95 177 MIME_CHARSET_FARAWAY 838 0.29 1.11 0.11 178 LongTLD 834 0.32 1.11 0.14 179 INVESTMENT_ADVICE 818 0.28 1.09 0.10 180 TR_Symld_Words 805 1.86 1.07 2.03 181 MPART_ALT_DIFF_COUNT 800 0.55 1.06 0.43 182 T_XMHurry_00 799 0.84 1.06 0.80 183 RELAYCOUNTRY_HK 798 0.20 1.06 0.01 184 FORGED_MUA_OUTLOOK 793 0.21 1.05 0.02 185 XMGppyBdWords 781 0.50 1.04 0.38 186 CHARSET_FARAWAY_HEADER 780 0.22 1.04 0.03 187 TR_XM_DK_SendGrid 764 3.95 1.01 4.60 188 XM_OfRef7 759 0.26 1.01 0.10 189 TR_XM_COVIDMETA1 755 0.45 1.00 0.33 190 FROM_MISSP_XPRIO 752 0.18 1.00 0.00 191 RELAYCOUNTRY_JP 734 0.20 0.97 0.02 192 XMReplyNow 704 0.25 0.93 0.10 193 FVGT_m_MULTI_ODD_EMAIL 697 0.20 0.93 0.04 194 TR_XM_COVIDMETA3 688 0.18 0.91 0.02 195 T_FILL_THIS_FORM_SHORT 678 0.94 0.90 0.95 196 MAILING_LIST_MULTI 654 1.54 0.87 1.69 197 XM_B_SEO 652 0.25 0.87 0.12 198 RELAYCOUNTRY_NL 652 0.32 0.87 0.20 199 URIBL_BLACK 648 0.17 0.86 0.01 200 XM_H_SupportSpoof 645 0.40 0.86 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 334727 98.40 96.09 98.91 2 HTML_MESSAGE 295151 87.65 89.58 87.22 3 RELAYCOUNTRY_US 276050 77.71 60.38 81.57 4 DKIM_SIGNED 262384 75.26 65.05 77.53 5 XM_DK_Pass 258907 74.11 63.37 76.51 6 DKIM_VALID 247745 70.11 56.19 73.21 7 XM_B_Unicode 243839 69.99 60.72 72.05 8 DKIM_VALID_AU 198295 55.61 42.19 58.59 9 XMListUnsubscribeExists 191572 58.12 64.89 56.61 10 BAYES_50 172792 46.77 27.52 51.06 11 XM_B_Unicode3 144959 39.68 25.52 42.83 12 HTML_FONT_LOW_CONTRAST 100769 27.49 17.22 29.78 13 LOC_TINY_FONT_1 98833 29.01 28.12 29.20 14 RCVD_IN_MSPIKE_WL 93165 23.64 6.16 27.53 15 DKIM_VALID_EF 90476 26.16 23.59 26.74 16 RCVD_IN_MSPIKE_H2 87574 26.85 31.24 25.88 17 MIME_HTML_ONLY 84726 26.53 33.26 25.04 18 FVGT_m_MULTI_ODD 74083 21.66 20.60 21.89 19 T_TM2_M_HEADER_IN_MSG 71818 21.03 20.19 21.22 20 XMSubLong 70794 20.32 17.62 20.92 21 T_KAM_HTML_FONT_INVALID 60659 17.66 16.48 17.92 22 RCVD_IN_MSPIKE_H3 52587 13.41 3.86 15.54 23 BAYES_00 52225 12.72 0.51 15.43 24 XM_Body_Dirty_Words 49882 14.99 16.12 14.74 25 XM_Multi_Part_URI 47921 15.47 21.34 14.16 26 ALL_TRUSTED 46601 11.48 1.18 13.77 27 XM_DK_Undo_02 44787 18.90 44.34 13.23 28 XM_B_Unsub 37887 10.41 6.87 11.20 29 RCVD_IN_MSPIKE_H4 35334 8.92 2.07 10.44 30 RCVD_IN_RP_SAFE 34126 8.31 0.34 10.08 31 XM_Evil_Numbers_Gen 33691 9.09 5.20 9.96 32 LotsOfNums_01 32200 9.66 10.33 9.51 33 RCVD_IN_RP_CERTIFIED 32196 7.83 0.24 9.51 34 BAYES_99 31036 14.61 39.07 9.17 35 XM_DKIMWhitelistDomains 30995 7.49 0.01 9.16 36 XM_B_Phish_Phrases 30205 9.62 12.76 8.93 37 TR_XM_DK_Bayes 29538 7.19 0.28 8.73 38 HTML_IMAGE_RATIO_02 29356 10.28 17.52 8.67 39 UNPARSEABLE_RELAY 28701 7.99 5.79 8.48 40 TR_XM_DK_Bayes1 28153 6.83 0.16 8.32 41 TR_XM_DK_Bayes2 26156 6.35 0.14 7.73 42 MPART_ALT_DIFF 25243 8.77 14.64 7.46 43 BAYES_999 25130 11.36 29.05 7.43 44 XM_SendGrid 24946 6.51 2.65 7.37 45 LOTS_OF_MONEY 24231 8.53 14.71 7.16 46 BAYES_60 24126 7.50 9.17 7.13 47 TM2_M_URI_OPT_OUT 22779 5.88 2.05 6.73 48 TooManyTo_001 21412 6.06 4.88 6.33 49 BOTNET_IPINHOSTNAME 21228 7.35 12.19 6.27 50 HTML_IMAGE_RATIO_04 19239 5.14 2.69 5.68 51 T_TooManySym_01 19016 4.93 1.85 5.62 52 XMStrtUSub 18485 6.00 8.44 5.46 53 RELAYCOUNTRY_META 18377 10.58 33.73 5.43 54 XMSexyCombo_05 18330 6.15 9.44 5.42 55 MIME_HTML_ONLY_MULTI 18155 4.66 1.49 5.36 56 XM_H_Long_From01 16747 4.93 4.84 4.95 57 XMSubMetaSx_00 16479 5.25 6.97 4.87 58 IN_ZIMBRA_NJ_WHITELIST 15811 3.83 0.03 4.67 59 BAYES_80 15801 5.88 11.34 4.67 60 TR_XM_DK_SendGrid 15567 3.95 1.01 4.60 61 XM_H_Trusted_IP 14961 3.62 0.00 4.42 62 DKIM_INVALID 14639 5.15 8.86 4.33 63 MIME_QP_LONG_LINE 14495 3.73 1.24 4.28 64 RCVD_IN_IADB_LISTED 14121 3.51 0.54 4.17 65 BAYES_40 13727 3.65 1.85 4.06 66 XM_UncommonTLD01 13556 7.75 24.58 4.01 67 T_REMOTE_IMAGE 13047 5.90 15.06 3.86 68 XMNumbers 12653 3.70 3.54 3.74 69 RCVD_IN_IADB_SPF 12368 3.08 0.49 3.65 70 HTML_IMAGE_RATIO_06 12074 3.31 2.17 3.57 71 FROM_EXCESS_BASE64 11524 5.60 15.46 3.41 72 BAYES_20 11394 3.04 1.58 3.37 73 RCVD_IN_IADB_SENDERID 11217 2.80 0.46 3.31 74 ANY_BOUNCE_MESSAGE 11180 2.75 0.27 3.30 75 BOUNCE_MESSAGE 11179 2.75 0.27 3.30 76 XM_PDF 11132 2.78 0.47 3.29 77 RCVD_IN_IADB_DK 10879 2.71 0.46 3.21 78 BOTNET 10746 8.13 30.38 3.18 79 TR_XM_PhishingBody 10608 3.98 7.81 3.13 80 HTML_IMAGE_RATIO_08 9917 3.46 5.86 2.93 81 BAYES_95 9632 3.82 8.21 2.85 82 T_TooManySym_02 9549 2.42 0.64 2.82 83 MIME_HTML_MOSTLY 9373 3.50 6.80 2.77 84 UNTRUSTED_Relay 9246 7.21 27.32 2.73 85 TVD_RCVD_IP 8597 2.18 0.58 2.54 86 RCVD_IN_IADB_VOUCHED 8400 2.06 0.17 2.48 87 NO_DNS_FOR_FROM 8128 3.45 8.13 2.40 88 BAYES_05 7683 1.99 0.75 2.27 89 HELO_MISC_IP 7639 1.95 0.59 2.26 90 CK_HELO_DYNAMIC_SPLIT_IP 7637 1.94 0.54 2.26 91 INVALID_MSGID 7346 1.89 0.63 2.17 92 T_XMDrugObfuBody_14 7318 2.05 1.52 2.16 93 RELAYCOUNTRY_CA 7124 3.56 10.11 2.11 94 HTML_MIME_NO_HTML_TAG 7063 4.45 15.06 2.09 95 TR_Symld_Words 6886 1.86 1.07 2.03 96 XM_B_SpammyTLD 6620 2.23 3.45 1.96 97 URI_NOVOWEL 6603 1.81 1.15 1.95 98 TO_MALFORMED 6364 1.54 0.03 1.88 99 XM_CamelCaseFrm001 6290 1.93 2.28 1.86 100 XM_B_Unsub2 6117 1.70 1.23 1.81 101 URI_HEX 5951 1.75 1.74 1.76 102 MAILING_LIST_MULTI 5735 1.54 0.87 1.69 103 RCVD_IN_IADB_OPTIN 5593 1.39 0.22 1.65 104 URI_TRY_3LD 5287 1.67 2.13 1.56 105 RCVD_IN_MSPIKE_H5 5244 1.31 0.23 1.55 106 IN_HORDE_ADDRESS_BOOK 5231 1.27 0.02 1.55 107 USER_IN_DEF_DKIM_WL 5178 1.25 0.01 1.53 108 T_XMDrugObfuBody_08 5177 1.69 2.41 1.53 109 RCVD_IN_BL_SPAMCOP_NET 5092 3.84 14.36 1.50 110 XM_UB50 4968 2.34 6.27 1.47 111 XMBdyGiftCard01 4939 1.32 0.71 1.46 112 XMBrknScrpt_02 4935 2.88 9.27 1.46 113 XMGappySubj_01 4926 1.20 0.08 1.46 114 TM2_M_VERY_LONG_WORD 4901 1.45 1.48 1.45 115 XM_DK_Undo_01 4829 1.30 0.75 1.43 116 XMDiploma_00 4798 1.47 1.72 1.42 117 XM_SPF_SoftFail 4794 3.20 11.21 1.42 118 XMSubNoVowel 4658 1.39 1.44 1.38 119 XM_ProductURIs 4576 1.23 0.70 1.35 120 XM_B_Phish66 4507 2.18 5.98 1.33 121 XM_GoogleGroups 4186 1.08 0.38 1.24 122 SUBJ_ALL_CAPS 4121 2.02 5.63 1.22 123 T_TooManySym_03 4062 1.00 0.08 1.20 124 XM_B_COVIDMETA 3922 1.39 2.45 1.16 125 XM_OfRef6 3870 1.36 2.32 1.14 126 T_OBFU_PDF_ATTACH 3819 0.94 0.10 1.13 127 DKIM_ADSP_CUSTOM_MED 3638 1.15 1.50 1.08 128 RCVD_IN_MSPIKE_BL 3633 3.98 17.05 1.07 129 TooManyTo_002 3581 0.95 0.47 1.06 130 XM_H_Long_From02 3580 1.01 0.77 1.06 131 KHOP_HELO_FCRDNS 3513 1.35 2.76 1.04 132 XMBody_95 3507 0.88 0.17 1.04 133 XMSexyCombo_01 3397 1.30 2.65 1.00 134 XMStockSpam_06 3346 1.06 1.40 0.99 135 XM_SPF_Unknown 3252 0.93 0.77 0.96 136 T_FILL_THIS_FORM_SHORT 3225 0.94 0.90 0.95 137 XMBody_17 3213 2.09 7.20 0.95 138 HTML_FONT_FACE_BAD 2976 0.84 0.66 0.88 139 XM_RXBody 2927 0.80 0.49 0.86 140 XMGenDplmaNmb 2882 0.82 0.69 0.85 141 TR_MetaPhish_Combo_01 2806 0.82 0.77 0.83 142 HTML_TAG_BALANCE_BODY 2766 0.79 0.69 0.82 143 DKIM_ADSP_NXDOMAIN 2731 1.43 4.22 0.81 144 T_XMHurry_00 2693 0.84 1.06 0.80 145 XMHTMLBadTable_001 2671 0.71 0.34 0.79 146 TR_MSPIKEBAYES00 2663 0.64 0.00 0.79 147 DIET_1 2564 1.04 2.30 0.76 148 NML_ADSP_CUSTOM_MED 2552 0.87 1.36 0.75 149 XMPhish08 2537 0.74 0.67 0.75 150 T_XMDrugObfuBody_00 2478 0.72 0.64 0.73 151 T_TooManySym_04 2449 0.60 0.02 0.72 152 TR_BOTNET_NEGATE 2435 0.70 0.59 0.72 153 RCVD_IN_MSPIKE_L3 2431 1.74 6.32 0.72 154 TooManyTo_003 2380 0.63 0.32 0.70 155 XMHTML_After_End 2361 0.86 1.59 0.70 156 XMPhish30 2357 0.71 0.77 0.70 157 HELO_NODOT 2355 0.70 0.73 0.70 158 HELO_NO_DOMAIN 2353 0.70 0.73 0.70 159 XMSubMetaI_00 2341 0.79 1.22 0.69 160 XM_S_SubURI 2262 0.55 0.04 0.67 161 XMBSHREFv2 2259 0.56 0.08 0.67 162 XMSubMetaSxObfu_03 2216 0.63 0.52 0.65 163 FORGED_GMAIL_RCVD 2104 0.73 1.22 0.62 164 XMLngstWrd_00 2100 0.57 0.34 0.62 165 T_PDS_OTHER_BAD_TLD 2063 0.84 1.90 0.61 166 XM_ShortIntro_01 2050 0.87 2.05 0.61 167 XM_DIRTYINTL 2039 1.66 6.40 0.60 168 RELAYCOUNTRY_GB 2011 0.85 2.01 0.59 169 XMBody_78 1982 0.60 0.66 0.59 170 USER_IN_WHITELIST 1948 0.47 0.00 0.58 171 TR_LOTS_OF_MONEY3 1946 1.11 3.54 0.58 172 SpammyFromTLD_01 1933 3.01 13.97 0.57 173 TR_XM_COVIDMETA4 1927 0.89 2.35 0.57 174 T_TooManySym_05 1912 0.46 0.00 0.56 175 NUMERIC_HTTP_ADDR 1911 0.58 0.67 0.56 176 XMLngstWrd_01 1878 0.51 0.32 0.55 177 PLING_QUERY 1862 1.57 6.12 0.55 178 XM_B_REG_HTML 1845 0.49 0.26 0.55 179 TooManyTo_004 1833 0.50 0.30 0.54 180 HTML_IMAGE_ONLY_20 1804 0.47 0.17 0.53 181 XMSubMetaSxObfu_02 1741 0.48 0.34 0.51 182 XM_E_Blogspot 1701 0.43 0.08 0.50 183 XM_B_COPY_HTML 1698 0.50 0.50 0.50 184 TR_XM_UnparsRelay 1654 0.81 2.24 0.49 185 XM_H_PHPMailer 1615 0.55 0.86 0.48 186 TooManyTo_005 1585 0.43 0.25 0.47 187 XMSlimDrugH 1573 0.52 0.76 0.46 188 RDNS_DYNAMIC 1571 0.67 1.61 0.46 189 TM2_M_A_HREF_HREF 1561 0.47 0.50 0.46 190 XMLngstWrd_02 1553 0.40 0.15 0.46 191 XM_H_Undi_Recip 1552 0.50 0.71 0.46 192 T_Symld_Words_02 1540 0.51 0.75 0.46 193 SUBJ_DOLLARS 1527 0.49 0.67 0.45 194 XMNoVowels 1481 0.42 0.31 0.44 195 MPART_ALT_DIFF_COUNT 1469 0.55 1.06 0.43 196 MISSING_HEADERS 1453 0.86 2.77 0.43 197 XMOemUri 1449 0.39 0.20 0.43 198 XMSubMetaSSx_00 1378 0.49 0.84 0.41 199 TR_XM_PHPDW 1361 1.05 3.97 0.40 200 TR_XM_PHPForged 1351 1.04 3.94 0.40 ----------------------------------------------------------------------