Email: 382557 Autolearn: 0 AvgScore: 1.82 AvgScanTime: 1.10 sec Spam: 75282 Autolearn: 0 AvgScore: 13.78 AvgScanTime: 1.06 sec Ham: 307275 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 1.11 sec Time Spent Running SA: 116.88 hours Time Spent Processing Spam: 22.15 hours Time Spent Processing Ham: 94.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 73329 98.94 97.41 99.31 2 HTML_MESSAGE 69669 86.38 92.54 84.87 3 DKIM_SIGNED 53821 79.17 71.49 81.05 4 XM_DK_Pass 52619 77.94 69.90 79.91 5 DKIM_VALID 51431 76.54 68.32 78.55 6 XMListUnsubscribeExists 48674 61.06 64.66 60.18 7 XM_B_SpammyWords 48513 53.16 64.44 50.40 8 XM_B_Unicode 47139 71.38 62.62 73.53 9 RELAYCOUNTRY_US 47060 77.66 62.51 81.37 10 XM_DK_Undo_02 39541 21.66 52.52 14.10 11 DKIM_VALID_AU 38850 61.51 51.61 63.94 12 BAYES_99 33161 16.71 44.05 10.01 13 XM_B_SpammyWords2 29522 27.37 39.22 24.47 14 RELAYCOUNTRY_META 28728 11.65 38.16 5.16 15 BOTNET 25563 8.89 33.96 2.75 16 MIME_HTML_ONLY 25451 24.49 33.81 22.21 17 LOC_TINY_FONT_1 25215 32.15 33.49 31.82 18 BAYES_999 24977 13.21 33.18 8.31 19 DKIM_VALID_EF 24925 29.65 33.11 28.80 20 RCVD_IN_MSPIKE_H2 22858 28.03 30.36 27.46 21 BAYES_50 21314 45.72 28.31 49.99 22 XM_B_Unicode3 20304 40.32 26.97 43.59 23 HTML_FONT_LOW_CONTRAST 20070 32.22 26.66 33.59 24 UNTRUSTED_Relay 19081 6.98 25.35 2.48 25 XM_UncommonTLD01 16791 7.26 22.30 3.58 26 T_KAM_HTML_FONT_INVALID 16195 18.72 21.51 18.03 27 XMSubLong 15778 22.20 20.96 22.51 28 T_TM2_M_HEADER_IN_MSG 15319 21.73 20.35 22.07 29 LOTS_OF_MONEY 14790 11.35 19.65 9.32 30 FVGT_m_MULTI_ODD 14497 22.46 19.26 23.25 31 XM_Multi_Part_URI 13783 15.06 18.31 14.27 32 RCVD_IN_BL_SPAMCOP_NET 13317 5.04 17.69 1.95 33 MPART_ALT_DIFF 12241 6.96 16.26 4.68 34 MIME_HTML_MOSTLY 10946 5.69 14.54 3.52 35 RCVD_IN_MSPIKE_BL 10886 3.76 14.46 1.14 36 RCVD_IN_RP_RNBL 10833 2.89 14.39 0.08 37 RCVD_IN_PSBL 9999 2.66 13.28 0.06 38 BOTNET_IPINHOSTNAME 9709 8.26 12.90 7.13 39 URI_PHP_REDIR 9519 2.51 12.64 0.03 40 XM_Body_Dirty_Words 9447 13.98 12.55 14.33 41 HTML_IMAGE_RATIO_08 8958 4.61 11.90 2.82 42 SpammyFromTLD_01 8709 2.68 11.57 0.51 43 FROM_EXCESS_BASE64 8484 5.35 11.27 3.90 44 XM_B_SpammyWords3 7974 6.91 10.59 6.00 45 HTML_MIME_NO_HTML_TAG 7713 3.16 10.25 1.42 46 XMSexyCombo_05 7379 7.06 9.80 6.39 47 XMBrknScrpt_02 7366 3.89 9.78 2.44 48 RELAYCOUNTRY_CA 7127 3.58 9.47 2.13 49 RCVD_IN_MSPIKE_L3 6668 2.49 8.86 0.93 50 BAYES_60 6662 7.70 8.85 7.42 51 RELAYCOUNTRY_FR 6463 1.88 8.59 0.23 52 RCVD_IN_MSPIKE_WL 6372 26.56 8.46 30.99 53 BAYES_80 6295 5.87 8.36 5.26 54 BOTNET_NORDNS 6270 1.78 8.33 0.18 55 XM_UB99 5969 1.57 7.93 0.01 56 T_REMOTE_IMAGE 5867 3.50 7.79 2.44 57 XM_B_Phish_Phrases 5835 6.33 7.75 5.98 58 SUBJ_ALL_CAPS 5715 2.74 7.59 1.55 59 XM_UB50 5673 2.31 7.54 1.03 60 XM_B_Unsub 5429 9.49 7.21 10.05 61 HTML_IMAGE_RATIO_02 5423 9.29 7.20 9.80 62 XMBody_17 5356 2.89 7.11 1.86 63 XM_Evil_Numbers_Gen 4991 9.06 6.63 9.66 64 XMSubMetaSx_00 4897 5.51 6.50 5.27 65 TR_MetaPhish_Combo_01 4828 2.05 6.41 0.98 66 XMHTML_After_End 4713 1.83 6.26 0.74 67 BAYES_95 4699 3.78 6.24 3.17 68 TR_XM_MaxSPIKE 4533 1.27 6.02 0.11 69 TR_LOTS_OF_MONEY3 4464 2.48 5.93 1.63 70 XM_SPF_SoftFail 4272 2.04 5.67 1.15 71 BODY_URI_ONLY 4259 1.15 5.66 0.05 72 SpammyFromTLD_02 4236 1.28 5.63 0.22 73 T_HTML_TAG_BALANCE_CENTER 4157 1.26 5.52 0.22 74 XMStrtUSub 4076 5.10 5.41 5.02 75 TR_MetaPhish_Combo_01b 3986 1.16 5.29 0.14 76 TR_MetaPhish_Combo_01a 3919 1.05 5.21 0.03 77 XMManySubDom_06 3908 1.05 5.19 0.04 78 XMManySubDom_07 3904 1.03 5.19 0.01 79 RELAYCOUNTRY_IN 3674 1.03 4.88 0.09 80 XM_UB999 3591 0.94 4.77 0.00 81 TR_XM_PhishingBody 3586 3.09 4.76 2.68 82 RCVD_IN_MSPIKE_L5 3561 1.05 4.73 0.15 83 URIBL_SBL_A 3547 1.12 4.71 0.24 84 UNPARSEABLE_RELAY 3528 7.61 4.69 8.33 85 XM_B_SpammyTLD 3502 2.29 4.65 1.71 86 TooManyTo_001 3461 6.66 4.60 7.17 87 XM_H_Long_From01 3419 5.17 4.54 5.32 88 RCVD_IN_MSPIKE_H3 3387 14.79 4.50 17.31 89 HTML_IMAGE_RATIO_04 3191 5.77 4.24 6.14 90 LotsOfNums_01 3186 7.80 4.23 8.67 91 XM_DIRTYINTL 3095 1.22 4.11 0.51 92 TR_XM_MaxBayes 3080 0.84 4.09 0.04 93 XM_BadFromFormat 2801 0.94 3.72 0.26 94 FROM_MISSP_REPLYTO 2797 0.75 3.72 0.02 95 RCVD_IN_MSPIKE_H4 2781 10.22 3.69 11.82 96 URI_TRY_3LD 2673 2.25 3.55 1.93 97 XM_UB60 2660 0.82 3.53 0.16 98 TR_Caps_n_Bayes_99 2616 0.80 3.47 0.15 99 KHOP_HELO_FCRDNS 2590 1.36 3.44 0.85 100 XM_B_SpammyWords4 2573 1.34 3.42 0.83 101 T_XMDrugObfuBody_08 2425 2.09 3.22 1.81 102 DKIM_INVALID 2390 2.63 3.17 2.49 103 URI_NO_WWW_BIZ_CGI 2386 0.63 3.17 0.01 104 XM_B_Phish66 2342 1.57 3.11 1.19 105 XM_OfRef6 2289 1.86 3.04 1.58 106 XM_UB80 2239 0.62 2.97 0.04 107 TR_XM_UnparsRelay 2107 1.05 2.80 0.63 108 HK_RANDOM_FROM 2015 0.62 2.68 0.12 109 T_XMHurry_00 1986 1.44 2.64 1.15 110 HTML_IMAGE_RATIO_06 1940 3.55 2.58 3.79 111 XM_UB95 1875 0.50 2.49 0.02 112 RELAYCOUNTRY_GB 1868 1.00 2.48 0.63 113 XM_SendGrid 1826 6.44 2.43 7.42 114 URI_HEX 1781 1.88 2.37 1.76 115 RDNS_DYNAMIC 1766 1.02 2.35 0.70 116 XMDiploma_00 1634 1.77 2.17 1.67 117 T_PDS_OTHER_BAD_TLD 1608 0.68 2.14 0.32 118 TR_XM_SB_Phish 1608 1.72 2.14 1.62 119 XM_CamelCaseFrm001 1604 2.02 2.13 1.99 120 TM2_M_URI_OPT_OUT 1602 3.63 2.13 4.00 121 XMSubPhish11 1550 1.69 2.06 1.60 122 XMSlimDrugH 1508 0.73 2.00 0.41 123 MIME_CHARSET_FARAWAY 1508 0.48 2.00 0.11 124 TR_XM_PHPDW 1464 0.70 1.94 0.39 125 XMNumbers 1448 4.14 1.92 4.68 126 TR_XM_PHPForged 1444 0.69 1.92 0.39 127 TR_XM_FormFill2 1436 0.69 1.91 0.39 128 XM_H_PHPOS 1435 0.68 1.91 0.38 129 CHARSET_FARAWAY_HEADER 1431 0.42 1.90 0.06 130 XM_B_COVIDMETA 1426 1.07 1.89 0.87 131 DKIM_ADSP_CUSTOM_MED 1390 1.20 1.85 1.05 132 XMSexyCombo_01 1368 1.13 1.82 0.96 133 FROM_SUSPICIOUS_NTLD 1365 0.41 1.81 0.07 134 NML_ADSP_CUSTOM_MED 1333 0.85 1.77 0.63 135 XMSubNoVowel 1333 0.98 1.77 0.78 136 FORGED_GMAIL_RCVD 1310 0.81 1.74 0.58 137 TM2_M_VERY_LONG_WORD 1271 1.33 1.69 1.25 138 TR_XM_RelayPhish 1260 0.43 1.67 0.13 139 FROM_SUSPICIOUS_NTLD_FP 1246 0.38 1.66 0.06 140 XM_B_Unsub2 1224 1.36 1.63 1.30 141 NUMERIC_HTTP_ADDR 1177 0.86 1.56 0.68 142 PDS_RDNS_DYNAMIC_FP 1153 0.36 1.53 0.07 143 BILLION_DOLLARS 1132 0.33 1.50 0.05 144 BAYES_40 1127 3.96 1.50 4.56 145 RELAYCOUNTRY_NL 1112 0.51 1.48 0.27 146 XM_URI_RBL 1100 0.45 1.46 0.20 147 TR_XM_COVIDMETA4 1077 0.52 1.43 0.30 148 MONEY_FRAUD_3 1066 0.28 1.42 0.00 149 TR_Mismatch_TLD_02 1063 0.34 1.41 0.08 150 XMStockSpam_06 1050 1.61 1.39 1.66 151 TR_XM_INV_DKIM 1043 0.43 1.39 0.19 152 T_XMDrugObfuBody_00 1039 0.66 1.38 0.49 153 XMSlimDrugs 1038 0.29 1.38 0.03 154 T_XMDrugObfuBody_14 1017 1.54 1.35 1.58 155 DATE_IN_PAST_03_06 981 0.38 1.30 0.15 156 URI_NOVOWEL 979 1.78 1.30 1.90 157 XM_SPF_Unknown 953 0.51 1.27 0.32 158 XM_OneSimpleTrick 943 0.25 1.25 0.01 159 MIMEOLE_DIRECT_TO_MX 940 0.25 1.25 0.00 160 NORMAL_HTTP_TO_IP 921 0.26 1.22 0.03 161 DOS_OE_TO_MX 920 0.24 1.22 0.00 162 XMSexyCombo_04 913 0.61 1.21 0.47 163 HK_RANDOM_REPLYTO 906 0.38 1.20 0.18 164 INVESTMENT_ADVICE 898 0.29 1.19 0.07 165 TR_Caps_n_Bayes_95 879 0.28 1.17 0.07 166 BAYES_20 876 4.06 1.16 4.77 167 T_FILL_THIS_FORM_SHORT 873 0.76 1.16 0.66 168 XMSubMetaD_00 868 0.27 1.15 0.06 169 T_FONT_INVIS_MSGID 854 0.97 1.13 0.92 170 XMSubMetaSxObfu_03 846 0.61 1.12 0.48 171 NO_FM_NAME_IP_HOSTN 838 0.22 1.11 0.00 172 MIME_HTML_ONLY_MULTI 824 2.13 1.09 2.38 173 SPOOFED_URL 821 0.70 1.09 0.61 174 T_TooManySym_01 818 5.06 1.09 6.03 175 TR_XM_DK_SendGrid 810 3.60 1.08 4.21 176 ALL_TRUSTED 800 11.60 1.06 14.19 177 XM_DK_Undo_01 789 1.45 1.05 1.54 178 XMSubMetaI_00 787 0.92 1.05 0.89 179 T_Symld_Words_02 785 0.60 1.04 0.50 180 FROM_LOCAL_NOVOWEL 780 0.23 1.04 0.03 181 TR_Mismatch_TLD_01 776 0.39 1.03 0.23 182 TR_Caps_n_Bayes_80 767 0.30 1.02 0.13 183 XMBdyGiftCard01 730 1.24 0.97 1.31 184 TR_Symld_Words 715 1.64 0.95 1.81 185 XMGppyBdWords 713 0.26 0.95 0.09 186 XMReplyNow 698 0.27 0.93 0.11 187 MIME_QP_LONG_LINE 695 3.06 0.92 3.58 188 RELAYCOUNTRY_JP 685 0.20 0.91 0.03 189 DATE_IN_PAST_06_12 684 0.25 0.91 0.09 190 DKIM_ADSP_NXDOMAIN 681 1.00 0.90 1.02 191 MAILING_LIST_MULTI 663 1.69 0.88 1.89 192 NO_DNS_FOR_FROM 662 0.76 0.88 0.74 193 DIET_1 652 0.65 0.87 0.60 194 MPART_ALT_DIFF_COUNT 648 0.57 0.86 0.49 195 SUBJ_BUY 640 0.24 0.85 0.09 196 TR_XM_COVIDMETA1 638 0.31 0.85 0.18 197 RELAYCOUNTRY_AU 630 0.36 0.84 0.25 198 BAYES_05 626 1.85 0.83 2.10 199 ADVANCE_FEE_2_NEW_MONEY 624 0.16 0.83 0.00 200 TR_XM_SpoofStaff 622 0.21 0.83 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 305158 98.94 97.41 99.31 2 HTML_MESSAGE 260788 86.38 92.54 84.87 3 RELAYCOUNTRY_US 250043 77.66 62.51 81.37 4 DKIM_SIGNED 249040 79.17 71.49 81.05 5 XM_DK_Pass 245546 77.94 69.90 79.91 6 DKIM_VALID 241379 76.54 68.32 78.55 7 XM_B_Unicode 225939 71.38 62.62 73.53 8 DKIM_VALID_AU 196467 61.51 51.61 63.94 9 XMListUnsubscribeExists 184906 61.06 64.66 60.18 10 XM_B_SpammyWords 154855 53.16 64.44 50.40 11 BAYES_50 153604 45.72 28.31 49.99 12 XM_B_Unicode3 133930 40.32 26.97 43.59 13 HTML_FONT_LOW_CONTRAST 103203 32.22 26.66 33.59 14 LOC_TINY_FONT_1 97780 32.15 33.49 31.82 15 RCVD_IN_MSPIKE_WL 95219 26.56 8.46 30.99 16 DKIM_VALID_EF 88499 29.65 33.11 28.80 17 RCVD_IN_MSPIKE_H2 84365 28.03 30.36 27.46 18 XM_B_SpammyWords2 75187 27.37 39.22 24.47 19 FVGT_m_MULTI_ODD 71436 22.46 19.26 23.25 20 XMSubLong 69163 22.20 20.96 22.51 21 MIME_HTML_ONLY 68251 24.49 33.81 22.21 22 T_TM2_M_HEADER_IN_MSG 67821 21.73 20.35 22.07 23 T_KAM_HTML_FONT_INVALID 55410 18.72 21.51 18.03 24 RCVD_IN_MSPIKE_H3 53181 14.79 4.50 17.31 25 XM_Body_Dirty_Words 44039 13.98 12.55 14.33 26 XM_Multi_Part_URI 43835 15.06 18.31 14.27 27 ALL_TRUSTED 43590 11.60 1.06 14.19 28 XM_DK_Undo_02 43336 21.66 52.52 14.10 29 BAYES_00 39054 10.34 0.68 12.71 30 RCVD_IN_MSPIKE_H4 36311 10.22 3.69 11.82 31 RCVD_IN_RP_SAFE 33941 9.02 0.76 11.05 32 RCVD_IN_RP_CERTIFIED 32446 8.58 0.50 10.56 33 XM_B_Unsub 30890 9.49 7.21 10.05 34 BAYES_99 30751 16.71 44.05 10.01 35 HTML_IMAGE_RATIO_02 30128 9.29 7.20 9.80 36 XM_DKIMWhitelistDomains 29835 7.80 0.00 9.71 37 XM_Evil_Numbers_Gen 29677 9.06 6.63 9.66 38 LOTS_OF_MONEY 28635 11.35 19.65 9.32 39 TR_XM_DK_Bayes 28096 7.41 0.34 9.14 40 TR_XM_DK_Bayes1 27444 7.24 0.33 8.93 41 LotsOfNums_01 26655 7.80 4.23 8.67 42 UNPARSEABLE_RELAY 25588 7.61 4.69 8.33 43 BAYES_999 25540 13.21 33.18 8.31 44 TR_XM_DK_Bayes2 25245 6.65 0.28 8.22 45 BAYES_60 22804 7.70 8.85 7.42 46 XM_SendGrid 22799 6.44 2.43 7.42 47 TooManyTo_001 22019 6.66 4.60 7.17 48 BOTNET_IPINHOSTNAME 21904 8.26 12.90 7.13 49 XMSexyCombo_05 19643 7.06 9.80 6.39 50 HTML_IMAGE_RATIO_04 18874 5.77 4.24 6.14 51 T_TooManySym_01 18539 5.06 1.09 6.03 52 XM_B_SpammyWords3 18449 6.91 10.59 6.00 53 XM_B_Phish_Phrases 18372 6.33 7.75 5.98 54 XM_H_Long_From01 16354 5.17 4.54 5.32 55 XMSubMetaSx_00 16180 5.51 6.50 5.27 56 BAYES_80 16162 5.87 8.36 5.26 57 BOUNCE_MESSAGE 15958 4.23 0.31 5.19 58 ANY_BOUNCE_MESSAGE 15958 4.23 0.31 5.19 59 RELAYCOUNTRY_META 15858 11.65 38.16 5.16 60 XMStrtUSub 15433 5.10 5.41 5.02 61 BAYES_20 14667 4.06 1.16 4.77 62 XMNumbers 14382 4.14 1.92 4.68 63 MPART_ALT_DIFF 14366 6.96 16.26 4.68 64 BAYES_40 14014 3.96 1.50 4.56 65 IN_ZIMBRA_NJ_WHITELIST 13143 3.45 0.07 4.28 66 TR_XM_DK_SendGrid 12944 3.60 1.08 4.21 67 TM2_M_URI_OPT_OUT 12295 3.63 2.13 4.00 68 FROM_EXCESS_BASE64 11975 5.35 11.27 3.90 69 HTML_IMAGE_RATIO_06 11632 3.55 2.58 3.79 70 MIME_QP_LONG_LINE 10997 3.06 0.92 3.58 71 XM_UncommonTLD01 10986 7.26 22.30 3.58 72 MIME_HTML_MOSTLY 10820 5.69 14.54 3.52 73 RCVD_IN_IADB_LISTED 10686 2.93 0.69 3.48 74 BAYES_95 9748 3.78 6.24 3.17 75 T_TooManySym_02 9340 2.52 0.42 3.04 76 RCVD_IN_IADB_SPF 9313 2.54 0.54 3.03 77 HTML_IMAGE_RATIO_08 8670 4.61 11.90 2.82 78 BOTNET 8462 8.89 33.96 2.75 79 RCVD_IN_IADB_SENDERID 8368 2.29 0.50 2.72 80 TR_XM_PhishingBody 8223 3.09 4.76 2.68 81 RCVD_IN_IADB_DK 8152 2.23 0.50 2.65 82 TVD_RCVD_IP 7929 2.17 0.50 2.58 83 INVALID_MSGID 7669 2.10 0.48 2.50 84 DKIM_INVALID 7661 2.63 3.17 2.49 85 UNTRUSTED_Relay 7623 6.98 25.35 2.48 86 XMBrknScrpt_02 7506 3.89 9.78 2.44 87 T_REMOTE_IMAGE 7506 3.50 7.79 2.44 88 MIME_HTML_ONLY_MULTI 7328 2.13 1.09 2.38 89 HELO_MISC_IP 7052 1.95 0.55 2.30 90 CK_HELO_DYNAMIC_SPLIT_IP 7039 1.99 0.78 2.29 91 RELAYCOUNTRY_CA 6550 3.58 9.47 2.13 92 RCVD_IN_IADB_VOUCHED 6503 1.76 0.33 2.12 93 BAYES_05 6452 1.85 0.83 2.10 94 TO_MALFORMED 6339 1.66 0.02 2.06 95 XM_CamelCaseFrm001 6128 2.02 2.13 1.99 96 RCVD_IN_BL_SPAMCOP_NET 5983 5.04 17.69 1.95 97 URI_TRY_3LD 5933 2.25 3.55 1.93 98 URI_NOVOWEL 5824 1.78 1.30 1.90 99 MAILING_LIST_MULTI 5809 1.69 0.88 1.89 100 RCVD_IN_MSPIKE_H5 5727 1.55 0.27 1.86 101 XMBody_17 5714 2.89 7.11 1.86 102 T_XMDrugObfuBody_08 5571 2.09 3.22 1.81 103 TR_Symld_Words 5570 1.64 0.95 1.81 104 XMGappySubj_01 5434 1.45 0.13 1.77 105 XM_PDF 5434 1.50 0.42 1.77 106 URI_HEX 5423 1.88 2.37 1.76 107 XM_B_SpammyTLD 5263 2.29 4.65 1.71 108 XMDiploma_00 5146 1.77 2.17 1.67 109 XMStockSpam_06 5096 1.61 1.39 1.66 110 TR_LOTS_OF_MONEY3 5016 2.48 5.93 1.63 111 TR_XM_SB_Phish 4987 1.72 2.14 1.62 112 XMSubPhish11 4908 1.69 2.06 1.60 113 T_XMDrugObfuBody_14 4858 1.54 1.35 1.58 114 XM_OfRef6 4845 1.86 3.04 1.58 115 SUBJ_ALL_CAPS 4766 2.74 7.59 1.55 116 XM_DK_Undo_01 4739 1.45 1.05 1.54 117 IN_HORDE_ADDRESS_BOOK 4669 1.25 0.16 1.52 118 HTML_MIME_NO_HTML_TAG 4372 3.16 10.25 1.42 119 RCVD_IN_IADB_OPTIN 4368 1.19 0.25 1.42 120 USER_IN_DEF_DKIM_WL 4077 1.07 0.00 1.33 121 XMBdyGiftCard01 4014 1.24 0.97 1.31 122 T_TooManySym_03 4014 1.08 0.13 1.31 123 XM_B_Unsub2 3987 1.36 1.63 1.30 124 TM2_M_VERY_LONG_WORD 3830 1.33 1.69 1.25 125 XM_GoogleGroups 3827 1.06 0.31 1.25 126 XM_ProductURIs 3745 1.07 0.46 1.22 127 TooManyTo_002 3672 1.05 0.48 1.20 128 XM_B_Phish66 3660 1.57 3.11 1.19 129 XM_SPF_SoftFail 3528 2.04 5.67 1.15 130 T_XMHurry_00 3521 1.44 2.64 1.15 131 RCVD_IN_MSPIKE_BL 3490 3.76 14.46 1.14 132 TR_MSPIKEBAYES00 3242 0.85 0.00 1.06 133 DKIM_ADSP_CUSTOM_MED 3219 1.20 1.85 1.05 134 XM_UB50 3177 2.31 7.54 1.03 135 DKIM_ADSP_NXDOMAIN 3148 1.00 0.90 1.02 136 XM_H_Long_From02 3034 0.88 0.46 0.99 137 TR_MetaPhish_Combo_01 3026 2.05 6.41 0.98 138 XMSexyCombo_01 2959 1.13 1.82 0.96 139 RCVD_IN_MSPIKE_L3 2850 2.49 8.86 0.93 140 T_FONT_INVIS_MSGID 2842 0.97 1.13 0.92 141 XMSubMetaI_00 2743 0.92 1.05 0.89 142 XM_B_COVIDMETA 2675 1.07 1.89 0.87 143 KHOP_HELO_FCRDNS 2604 1.36 3.44 0.85 144 TooManyTo_003 2593 0.74 0.33 0.84 145 XM_B_SpammyWords4 2540 1.34 3.42 0.83 146 XMGenDplmaNmb 2494 0.80 0.77 0.81 147 XMSubMetaSxObfu_02 2467 0.76 0.59 0.80 148 T_TooManySym_04 2443 0.65 0.05 0.80 149 HTML_FONT_FACE_BAD 2442 0.75 0.59 0.79 150 XMSubNoVowel 2401 0.98 1.77 0.78 151 XMHTML_After_End 2279 1.83 6.26 0.74 152 NO_DNS_FOR_FROM 2261 0.76 0.88 0.74 153 XM_S_SubURI 2251 0.60 0.04 0.73 154 XMBody_95 2250 0.62 0.17 0.73 155 RDNS_DYNAMIC 2136 1.02 2.35 0.70 156 TR_BOTNET_NEGATE 2124 0.66 0.51 0.69 157 NUMERIC_HTTP_ADDR 2104 0.86 1.56 0.68 158 XM_H_Trusted_IP 2096 0.55 0.00 0.68 159 TooManyTo_004 2093 0.60 0.27 0.68 160 XM_B_REG_HTML 2072 0.56 0.10 0.67 161 XMHTMLBadTable_001 2042 0.60 0.32 0.66 162 HTTPS_HTTP_MISMATCH 2037 0.66 0.63 0.66 163 T_FILL_THIS_FORM_SHORT 2035 0.76 1.16 0.66 164 RELAYCOUNTRY_GB 1944 1.00 2.48 0.63 165 T_TooManySym_05 1935 0.51 0.02 0.63 166 NML_ADSP_CUSTOM_MED 1929 0.85 1.77 0.63 167 TR_XM_UnparsRelay 1927 1.05 2.80 0.63 168 SPOOFED_URL 1865 0.70 1.09 0.61 169 DIET_1 1837 0.65 0.87 0.60 170 SUBJ_DOLLARS 1812 0.56 0.42 0.59 171 TooManyTo_005 1801 0.52 0.24 0.59 172 FORGED_GMAIL_RCVD 1793 0.81 1.74 0.58 173 XMPhish30 1713 0.58 0.66 0.56 174 XM_ShortIntro_01 1710 0.49 0.24 0.56 175 USER_IN_WELCOMELIST 1700 0.44 0.00 0.55 176 USER_IN_WHITELIST 1700 0.44 0.00 0.55 177 XM_B_COPY_HTML 1650 0.51 0.41 0.54 178 XM_RXBody 1556 0.46 0.29 0.51 179 XM_DIRTYINTL 1555 1.22 4.11 0.51 180 SpammyFromTLD_01 1552 2.68 11.57 0.51 181 T_Symld_Words_02 1524 0.60 1.04 0.50 182 MPART_ALT_DIFF_COUNT 1518 0.57 0.86 0.49 183 XMPhish08 1513 0.53 0.66 0.49 184 HTML_TAG_BALANCE_BODY 1507 0.50 0.55 0.49 185 XM_H_PHPMailer 1507 0.49 0.47 0.49 186 HTML_IMAGE_ONLY_20 1504 0.42 0.15 0.49 187 T_XMDrugObfuBody_00 1500 0.66 1.38 0.49 188 XMSubMetaSxObfu_04 1490 0.51 0.59 0.48 189 XMSubMetaSxObfu_03 1480 0.61 1.12 0.48 190 THIS_AD 1479 0.46 0.37 0.48 191 HELO_NODOT 1477 0.43 0.21 0.48 192 HELO_NO_DOMAIN 1476 0.43 0.21 0.48 193 SPOOFED_URL_HOST 1467 0.53 0.75 0.48 194 XMCapTrack 1439 0.43 0.27 0.47 195 XMSexyCombo_04 1438 0.61 1.21 0.47 196 XMUrgent 1404 0.39 0.10 0.46 197 XMBody_78 1397 0.46 0.48 0.45 198 PLING_QUERY 1363 0.46 0.54 0.44 199 XMLngstWrd_00 1354 0.41 0.29 0.44 200 DATE_IN_PAST_12_24 1298 0.42 0.40 0.42 ----------------------------------------------------------------------