Email: 632128 Autolearn: 0 AvgScore: 1.71 AvgScanTime: 1.23 sec Spam: 110777 Autolearn: 0 AvgScore: 13.15 AvgScanTime: 1.25 sec Ham: 521351 Autolearn: 0 AvgScore: -0.72 AvgScanTime: 1.22 sec Time Spent Running SA: 215.17 hours Time Spent Processing Spam: 38.52 hours Time Spent Processing Ham: 176.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 107928 98.49 97.43 98.72 2 HTML_MESSAGE 102441 89.29 92.47 88.61 3 DKIM_SIGNED 82862 78.80 74.80 79.64 4 XM_B_Unicode 79904 72.54 72.13 72.63 5 XM_DK_Pass 78623 77.21 70.97 78.53 6 DKIM_VALID 76695 75.26 69.23 76.54 7 RELAYCOUNTRY_US 74223 79.76 67.00 82.47 8 XM_B_SpammyWords 70907 53.62 64.01 51.41 9 XMListUnsubscribeExists 67538 56.11 60.97 55.08 10 DKIM_VALID_AU 56269 56.09 50.79 57.21 11 XM_DK_Undo_02 53192 18.28 48.02 11.96 12 BAYES_99 42697 13.35 38.54 8.00 13 MIME_HTML_ONLY 38267 24.02 34.54 21.78 14 BAYES_50 38089 50.18 34.38 53.53 15 XM_B_SpammyWords2 37854 26.02 34.17 24.29 16 XM_B_Unicode3 36152 40.65 32.63 42.35 17 XMSubLong 34048 22.29 30.74 20.50 18 DKIM_VALID_EF 33884 28.94 30.59 28.59 19 RELAYCOUNTRY_META 33390 9.79 30.14 5.47 20 LOC_TINY_FONT_1 33369 27.60 30.12 27.07 21 BAYES_999 32376 10.47 29.23 6.48 22 RCVD_IN_MSPIKE_H2 30451 27.55 27.49 27.57 23 BOTNET 30190 6.66 27.25 2.29 24 HTML_FONT_LOW_CONTRAST 29577 29.38 26.70 29.96 25 UNTRUSTED_Relay 25890 6.06 23.37 2.38 26 T_KAM_HTML_FONT_INVALID 24629 19.83 22.23 19.32 27 FVGT_m_MULTI_ODD 23843 22.27 21.52 22.43 28 XM_UncommonTLD01 23420 6.23 21.14 3.06 29 XM_Multi_Part_URI 23361 14.49 21.09 13.08 30 T_TM2_M_HEADER_IN_MSG 23117 25.54 20.87 26.54 31 XM_Body_Dirty_Words 20211 15.00 18.24 14.30 32 LOTS_OF_MONEY 18808 10.05 16.98 8.58 33 T_REMOTE_IMAGE 17041 5.72 15.38 3.67 34 TR_XM_SpammyWords2 15944 4.36 14.39 2.23 35 RCVD_IN_MSPIKE_BL 15868 3.19 14.32 0.82 36 BOTNET_IPINHOSTNAME 14662 7.09 13.24 5.79 37 XM_B_Phish_Phrases 13046 7.36 11.78 6.42 38 XM_B_SpammyWords3 12422 7.08 11.21 6.20 39 XMSexyCombo_05 12197 5.94 11.01 4.86 40 RCVD_IN_MSPIKE_WL 12196 25.88 11.01 29.04 41 XM_B_Unsub 11565 11.46 10.44 11.68 42 MPART_ALT_DIFF 11526 5.66 10.40 4.66 43 URIBL_SBL_A 10884 1.94 9.83 0.26 44 HTML_MIME_NO_HTML_TAG 10605 3.47 9.57 2.17 45 LotsOfNums_01 10466 9.58 9.45 9.61 46 TR_XM_SpammyWords3 10286 2.04 9.29 0.50 47 MIME_HTML_MOSTLY 10274 3.92 9.27 2.78 48 SpammyFromTLD_01 9773 2.18 8.82 0.77 49 BAYES_80 9109 5.29 8.22 4.67 50 BAYES_60 9081 7.39 8.20 7.21 51 XM_Evil_Numbers_Gen 8719 8.58 7.87 8.74 52 XM_UB50 8597 2.42 7.76 1.29 53 RCVD_IN_MSPIKE_L3 8378 1.78 7.56 0.55 54 RCVD_IN_BL_SPAMCOP_NET 8377 2.82 7.56 1.81 55 RCVD_IN_RP_RNBL 8080 1.32 7.29 0.05 56 FROM_EXCESS_BASE64 7890 3.98 7.12 3.31 57 RELAYCOUNTRY_CA 7827 2.70 7.07 1.77 58 KHOP_HELO_FCRDNS 7681 2.40 6.93 1.44 59 TR_XM_PhishingBody 7621 4.10 6.88 3.50 60 URI_PHP_REDIR 7452 1.18 6.73 0.00 61 XMSubMetaSx_00 7345 4.24 6.63 3.73 62 HTML_IMAGE_ONLY_12 7099 1.28 6.41 0.19 63 RCVD_IN_MSPIKE_H3 7049 14.65 6.36 16.41 64 BODY_URI_ONLY 7044 1.16 6.36 0.06 65 HTML_IMAGE_RATIO_02 7041 7.90 6.36 8.23 66 XMSlimDrugs 6952 1.12 6.28 0.02 67 RCVD_IN_MSPIKE_L5 6732 1.22 6.08 0.19 68 XMBrknScrpt_02 6680 2.29 6.03 1.50 69 XM_H_Long_From01 6602 5.87 5.96 5.85 70 RELAYCOUNTRY_FR 6334 1.29 5.72 0.35 71 SpammyFromTLD_02 6265 1.37 5.66 0.46 72 T_FONT_INVIS_NAKED_TO 6245 2.80 5.64 2.20 73 XMBody_17 6187 1.86 5.59 1.06 74 DKIM_INVALID 6167 3.53 5.57 3.10 75 XM_B_COVIDMETA 6094 2.00 5.50 1.26 76 TR_XM_MaxBayes 5975 0.99 5.39 0.05 77 XM_B_SpammyTLD 5974 2.70 5.39 2.12 78 TooManyTo_001 5862 7.82 5.29 8.36 79 XM_DIRTYINTL 5827 1.33 5.26 0.50 80 HTML_IMAGE_RATIO_04 5779 5.17 5.22 5.16 81 SHORTENED_URL_HREF 5689 1.19 5.14 0.35 82 XM_UB99 5685 0.90 5.13 0.00 83 BOTNET_NORDNS 5641 0.91 5.09 0.03 84 BAYES_95 5605 3.35 5.06 2.98 85 UNPARSEABLE_RELAY 5575 7.84 5.03 8.44 86 SHORT_URI_3 5559 0.92 5.02 0.06 87 SHORT_SHORTNER 5512 0.88 4.98 0.02 88 XM_SPF_SoftFail 5460 2.21 4.93 1.64 89 HTML_SHORT_LINK_IMG_1 5333 0.86 4.81 0.02 90 HTML_IMAGE_ONLY_08 5327 0.93 4.81 0.10 91 RCVD_IN_PSBL 5190 0.87 4.69 0.06 92 RELAYCOUNTRY_IN 5182 0.89 4.68 0.09 93 SHORTENED_URL_SRC 5103 0.81 4.61 0.00 94 SHORTENER_SHORT_IMG 5094 0.81 4.60 0.00 95 XM_B_Phish66 4883 2.24 4.41 1.78 96 RCVD_IN_MSPIKE_H4 4776 9.25 4.31 10.30 97 XM_SendGrid 4481 7.09 4.05 7.74 98 FROM_SUSPICIOUS_NTLD 4226 0.71 3.81 0.05 99 XM_UB60 4190 0.77 3.78 0.13 100 XM_OfRef6 4151 1.85 3.75 1.45 101 T_PDS_OTHER_BAD_TLD 4134 1.02 3.73 0.45 102 XM_UB999 4109 0.65 3.71 0.00 103 TR_XM_MaxSPIKE 4084 0.66 3.69 0.02 104 XMStrtUSub 4067 4.54 3.67 4.72 105 FROM_SUSPICIOUS_NTLD_FP 4039 0.67 3.65 0.04 106 XMNumbers 3980 3.69 3.59 3.71 107 TR_LOTS_OF_MONEY3 3975 1.42 3.59 0.96 108 TR_XM_COVIDMETA4 3858 0.97 3.48 0.43 109 HTML_IMAGE_RATIO_08 3667 2.68 3.31 2.55 110 SUBJ_ALL_CAPS 3398 1.92 3.07 1.67 111 T_XMDrugObfuBody_08 3394 1.76 3.06 1.48 112 XMDiploma_00 3354 2.12 3.03 1.93 113 TR_Mismatch_TLD_02 3190 0.59 2.88 0.10 114 TR_XM_UnparsRelay 3178 1.07 2.87 0.69 115 XM_UB80 3117 0.53 2.81 0.04 116 LongTLD 3039 0.62 2.74 0.17 117 URI_TRY_3LD 3012 1.64 2.72 1.41 118 TM2_M_URI_OPT_OUT 3003 2.74 2.71 2.75 119 BOUNCE_MESSAGE 2987 3.94 2.70 4.20 120 ANY_BOUNCE_MESSAGE 2987 3.94 2.70 4.20 121 HTML_IMAGE_RATIO_06 2961 3.40 2.67 3.55 122 XM_B_Unsub2 2847 2.77 2.57 2.81 123 XM_URI_RBL 2805 0.62 2.53 0.21 124 DKIM_ADSP_NXDOMAIN 2619 0.93 2.36 0.63 125 XMSexyCombo_01 2587 0.96 2.34 0.67 126 TR_XM_PHPDW 2579 0.68 2.33 0.33 127 XM_CamelCaseFrm001 2563 2.13 2.31 2.09 128 MIME_QP_LONG_LINE 2558 5.60 2.31 6.30 129 XM_Lotto 2549 0.50 2.30 0.12 130 TR_XM_PHPForged 2537 0.67 2.29 0.32 131 TR_XM_FormFill2 2510 0.66 2.27 0.32 132 XM_H_PHPOS 2504 0.65 2.26 0.31 133 HK_RANDOM_FROM 2399 0.47 2.17 0.11 134 LH_URI_DOM_IN_PATH 2393 2.40 2.16 2.45 135 TR_XM_DK_SendGrid 2363 4.24 2.13 4.68 136 RELAYCOUNTRY_DE 2361 0.73 2.13 0.44 137 TR_XM_INV_DKIM 2344 0.49 2.12 0.15 138 TR_XM_SB_Phish 2325 2.18 2.10 2.19 139 TR_MetaPhish_Combo_01b 2275 0.52 2.05 0.20 140 XMSubPhish11 2274 2.14 2.05 2.16 141 FONT_INVIS_MSGID 2232 0.58 2.01 0.28 142 T_TooManySym_01 2229 3.76 2.01 4.13 143 URI_HEX 2204 1.72 1.99 1.66 144 BAYES_40 2064 4.14 1.86 4.63 145 XM_B_SpammyWords4 2053 0.87 1.85 0.66 146 MIME_CHARSET_FARAWAY 2048 0.41 1.85 0.10 147 TR_XM_RelayPhish 2039 0.44 1.84 0.14 148 TR_XM_COVIDMETA1 2026 0.62 1.83 0.36 149 XM_UB95 2016 0.33 1.82 0.02 150 FONT_INVIS_DIRECT 1993 0.37 1.80 0.06 151 DATE_IN_PAST_12_24 1990 0.43 1.80 0.14 152 T_XMHurry_00 1962 0.80 1.77 0.60 153 T_FONT_INVIS_NORDNS 1962 0.33 1.77 0.02 154 XMSubNoVowel 1895 1.07 1.71 0.93 155 TR_Symld_Words 1879 2.06 1.70 2.14 156 XMManySubDom_06 1866 0.31 1.68 0.02 157 RCVD_IN_IADB_LISTED 1860 5.15 1.68 5.88 158 ALL_TRUSTED 1843 11.19 1.66 13.21 159 TR_Mismatch_TLD_01 1795 0.43 1.62 0.18 160 T_FILL_THIS_FORM_SHORT 1777 1.03 1.60 0.90 161 CHARSET_FARAWAY_HEADER 1763 0.30 1.59 0.03 162 TM2_M_VERY_LONG_WORD 1747 1.26 1.58 1.20 163 T_XMDrugObfuBody_00 1744 0.86 1.57 0.70 164 MIME_HTML_ONLY_MULTI 1713 2.31 1.55 2.47 165 XM_OfRef7 1711 0.51 1.54 0.29 166 XMGenDplmaNmb 1706 1.06 1.54 0.96 167 RELAYCOUNTRY_GB 1705 1.05 1.54 0.95 168 DKIM_ADSP_CUSTOM_MED 1703 1.23 1.54 1.16 169 RDNS_DYNAMIC 1646 0.66 1.49 0.49 170 XMStockSpam_06 1630 1.30 1.47 1.26 171 NO_DNS_FOR_FROM 1603 0.65 1.45 0.48 172 NML_ADSP_CUSTOM_MED 1589 0.95 1.43 0.85 173 BAYES_20 1580 4.15 1.43 4.72 174 T_XMDrugObfuBody_14 1565 1.60 1.41 1.64 175 XM_XX_Yahoo 1561 0.32 1.41 0.09 176 NUMERIC_HTTP_ADDR 1540 0.67 1.39 0.51 177 XMSubMetaSxObfu_03 1526 0.66 1.38 0.51 178 XM_S_SpammyWords 1516 0.62 1.37 0.46 179 TR_XM_Spammywords 1515 0.62 1.37 0.46 180 RCVD_IN_IADB_SPF 1512 4.45 1.36 5.11 181 FORGED_GMAIL_RCVD 1467 0.69 1.32 0.55 182 XM_SPF_Unknown 1430 0.84 1.29 0.74 183 RCVD_IN_IADB_SENDERID 1396 3.97 1.26 4.54 184 RCVD_IN_IADB_DK 1394 3.84 1.26 4.39 185 TR_Caps_n_Bayes_99 1379 0.31 1.24 0.11 186 MAILING_LIST_MULTI 1338 1.90 1.21 2.05 187 HELO_NO_DOMAIN 1307 1.22 1.18 1.23 188 HELO_NODOT 1307 1.22 1.18 1.23 189 XMHTML_After_End 1306 0.88 1.18 0.82 190 BAYES_00 1293 10.00 1.17 11.88 191 URI_NOVOWEL 1250 2.36 1.13 2.62 192 DATE_IN_PAST_06_12 1249 0.42 1.13 0.27 193 XM_H_Undi_Recip 1233 0.42 1.11 0.27 194 RELAYCOUNTRY_NL 1230 0.48 1.11 0.34 195 TR_MetaPhish_Combo_01 1229 0.79 1.11 0.73 196 XMBody_78 1223 0.67 1.10 0.58 197 XM_PDF 1223 3.43 1.10 3.92 198 NORMAL_HTTP_TO_IP 1196 0.23 1.08 0.05 199 DATE_IN_PAST_24_48 1194 0.19 1.08 0.01 200 DIET_1 1149 0.49 1.04 0.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 514669 98.49 97.43 98.72 2 HTML_MESSAGE 461973 89.29 92.47 88.61 3 RELAYCOUNTRY_US 429941 79.76 67.00 82.47 4 DKIM_SIGNED 415226 78.80 74.80 79.64 5 XM_DK_Pass 409427 77.21 70.97 78.53 6 DKIM_VALID 399049 75.26 69.23 76.54 7 XM_B_Unicode 378637 72.54 72.13 72.63 8 DKIM_VALID_AU 298286 56.09 50.79 57.21 9 XMListUnsubscribeExists 287147 56.11 60.97 55.08 10 BAYES_50 279099 50.18 34.38 53.53 11 XM_B_SpammyWords 268010 53.62 64.01 51.41 12 XM_B_Unicode3 220786 40.65 32.63 42.35 13 HTML_FONT_LOW_CONTRAST 156173 29.38 26.70 29.96 14 RCVD_IN_MSPIKE_WL 151403 25.88 11.01 29.04 15 DKIM_VALID_EF 149035 28.94 30.59 28.59 16 RCVD_IN_MSPIKE_H2 143717 27.55 27.49 27.57 17 LOC_TINY_FONT_1 141106 27.60 30.12 27.07 18 T_TM2_M_HEADER_IN_MSG 138353 25.54 20.87 26.54 19 XM_B_SpammyWords2 126615 26.02 34.17 24.29 20 FVGT_m_MULTI_ODD 116924 22.27 21.52 22.43 21 MIME_HTML_ONLY 113553 24.02 34.54 21.78 22 XMSubLong 106869 22.29 30.74 20.50 23 T_KAM_HTML_FONT_INVALID 100723 19.83 22.23 19.32 24 RCVD_IN_MSPIKE_H3 85569 14.65 6.36 16.41 25 XM_Body_Dirty_Words 74577 15.00 18.24 14.30 26 ALL_TRUSTED 68886 11.19 1.66 13.21 27 XM_Multi_Part_URI 68208 14.49 21.09 13.08 28 XM_DK_Undo_02 62359 18.28 48.02 11.96 29 BAYES_00 61926 10.00 1.17 11.88 30 XM_B_Unsub 60890 11.46 10.44 11.68 31 RCVD_IN_MSPIKE_H4 53715 9.25 4.31 10.30 32 LotsOfNums_01 50117 9.58 9.45 9.61 33 TR_XM_DK_Bayes 46344 7.39 0.33 8.89 34 XM_Evil_Numbers_Gen 45548 8.58 7.87 8.74 35 TR_XM_DK_Bayes1 44758 7.14 0.31 8.59 36 LOTS_OF_MONEY 44742 10.05 16.98 8.58 37 UNPARSEABLE_RELAY 43987 7.84 5.03 8.44 38 TooManyTo_001 43583 7.82 5.29 8.36 39 HTML_IMAGE_RATIO_02 42906 7.90 6.36 8.23 40 BAYES_99 41691 13.35 38.54 8.00 41 XM_SendGrid 40363 7.09 4.05 7.74 42 TR_XM_DK_Bayes2 40074 6.39 0.29 7.69 43 RCVD_IN_RP_SAFE 39108 6.32 0.79 7.50 44 XM_DKIMWhitelistDomains 38664 6.12 0.04 7.42 45 BAYES_60 37607 7.39 8.20 7.21 46 RCVD_IN_RP_CERTIFIED 35335 5.66 0.42 6.78 47 BAYES_999 33789 10.47 29.23 6.48 48 XM_B_Phish_Phrases 33455 7.36 11.78 6.42 49 IN_ZIMBRA_NJ_WHITELIST 33027 5.23 0.05 6.33 50 MIME_QP_LONG_LINE 32847 5.60 2.31 6.30 51 XM_B_SpammyWords3 32348 7.08 11.21 6.20 52 RCVD_IN_IADB_LISTED 30663 5.15 1.68 5.88 53 XM_H_Long_From01 30523 5.87 5.96 5.85 54 BOTNET_IPINHOSTNAME 30167 7.09 13.24 5.79 55 RELAYCOUNTRY_META 28522 9.79 30.14 5.47 56 HTML_IMAGE_RATIO_04 26901 5.17 5.22 5.16 57 RCVD_IN_IADB_SPF 26629 4.45 1.36 5.11 58 XMSexyCombo_05 25341 5.94 11.01 4.86 59 XMStrtUSub 24625 4.54 3.67 4.72 60 BAYES_20 24622 4.15 1.43 4.72 61 TR_XM_DK_SendGrid 24415 4.24 2.13 4.68 62 BAYES_80 24344 5.29 8.22 4.67 63 MPART_ALT_DIFF 24281 5.66 10.40 4.66 64 BAYES_40 24131 4.14 1.86 4.63 65 RCVD_IN_IADB_SENDERID 23681 3.97 1.26 4.54 66 RCVD_IN_IADB_DK 22866 3.84 1.26 4.39 67 ANY_BOUNCE_MESSAGE 21914 3.94 2.70 4.20 68 BOUNCE_MESSAGE 21912 3.94 2.70 4.20 69 T_TooManySym_01 21511 3.76 2.01 4.13 70 XM_PDF 20448 3.43 1.10 3.92 71 RCVD_IN_IADB_VOUCHED 19515 3.23 0.82 3.74 72 XMSubMetaSx_00 19429 4.24 6.63 3.73 73 XMNumbers 19362 3.69 3.59 3.71 74 T_REMOTE_IMAGE 19112 5.72 15.38 3.67 75 HTML_IMAGE_RATIO_06 18521 3.40 2.67 3.55 76 TR_XM_PhishingBody 18271 4.10 6.88 3.50 77 FROM_EXCESS_BASE64 17259 3.98 7.12 3.31 78 DKIM_INVALID 16177 3.53 5.57 3.10 79 XM_UncommonTLD01 15935 6.23 21.14 3.06 80 BAYES_95 15561 3.35 5.06 2.98 81 XM_B_Unsub2 14655 2.77 2.57 2.81 82 MIME_HTML_MOSTLY 14482 3.92 9.27 2.78 83 TM2_M_URI_OPT_OUT 14330 2.74 2.71 2.75 84 URI_NOVOWEL 13641 2.36 1.13 2.62 85 HTML_IMAGE_RATIO_08 13301 2.68 3.31 2.55 86 MIME_HTML_ONLY_MULTI 12863 2.31 1.55 2.47 87 LH_URI_DOM_IN_PATH 12766 2.40 2.16 2.45 88 RCVD_IN_IADB_OPTIN 12731 2.11 0.56 2.44 89 UNTRUSTED_Relay 12386 6.06 23.37 2.38 90 BAYES_05 12327 2.10 0.88 2.36 91 RCVD_IN_MSPIKE_H5 12119 1.98 0.33 2.32 92 BOTNET 11923 6.66 27.25 2.29 93 TR_XM_SpammyWords2 11635 4.36 14.39 2.23 94 T_FONT_INVIS_NAKED_TO 11470 2.80 5.64 2.20 95 TR_XM_SB_Phish 11432 2.18 2.10 2.19 96 HTML_MIME_NO_HTML_TAG 11333 3.47 9.57 2.17 97 XMSubPhish11 11247 2.14 2.05 2.16 98 TR_Symld_Words 11156 2.06 1.70 2.14 99 XM_B_SpammyTLD 11063 2.70 5.39 2.12 100 T_TooManySym_02 10972 1.87 0.76 2.10 101 XM_CamelCaseFrm001 10884 2.13 2.31 2.09 102 MAILING_LIST_MULTI 10672 1.90 1.21 2.05 103 XM_DK_Undo_01 10165 1.77 0.93 1.95 104 XMDiploma_00 10050 2.12 3.03 1.93 105 RCVD_IN_BL_SPAMCOP_NET 9461 2.82 7.56 1.81 106 TooManyTo_002 9316 1.64 0.95 1.79 107 XM_B_Phish66 9256 2.24 4.41 1.78 108 RELAYCOUNTRY_CA 9241 2.70 7.07 1.77 109 SUBJ_ALL_CAPS 8720 1.92 3.07 1.67 110 URI_HEX 8651 1.72 1.99 1.66 111 T_XMDrugObfuBody_14 8572 1.60 1.41 1.64 112 XM_SPF_SoftFail 8541 2.21 4.93 1.64 113 TVD_RCVD_IP 7926 1.32 0.38 1.52 114 XMBrknScrpt_02 7826 2.29 6.03 1.50 115 T_XMDrugObfuBody_08 7728 1.76 3.06 1.48 116 XM_OfRef6 7545 1.85 3.75 1.45 117 IN_HORDE_ADDRESS_BOOK 7542 1.20 0.06 1.45 118 KHOP_HELO_FCRDNS 7495 2.40 6.93 1.44 119 URI_TRY_3LD 7372 1.64 2.72 1.41 120 INVALID_MSGID 7239 1.22 0.45 1.39 121 XMGappySubj_01 7106 1.15 0.14 1.36 122 HELO_MISC_IP 6874 1.18 0.53 1.32 123 CK_HELO_DYNAMIC_SPLIT_IP 6873 1.20 0.65 1.32 124 XM_UB50 6709 2.42 7.76 1.29 125 XM_H_Long_From02 6569 1.16 0.70 1.26 126 XMStockSpam_06 6559 1.30 1.47 1.26 127 XM_B_COVIDMETA 6543 2.00 5.50 1.26 128 XM_ProductURIs 6517 1.12 0.51 1.25 129 HELO_NODOT 6410 1.22 1.18 1.23 130 HELO_NO_DOMAIN 6408 1.22 1.18 1.23 131 TO_MALFORMED 6361 1.01 0.02 1.22 132 TM2_M_VERY_LONG_WORD 6240 1.26 1.58 1.20 133 TooManyTo_003 6077 1.09 0.73 1.17 134 DKIM_ADSP_CUSTOM_MED 6044 1.23 1.54 1.16 135 XMBSHREFv2 6042 1.01 0.32 1.16 136 XMSubMetaI_00 5645 1.03 0.78 1.08 137 XMBody_17 5543 1.86 5.59 1.06 138 XMCapTrack 5299 0.90 0.37 1.02 139 XM_GoogleGroups 5269 0.90 0.39 1.01 140 XMBdyGiftCard01 5114 0.95 0.83 0.98 141 XMGenDplmaNmb 5020 1.06 1.54 0.96 142 USER_IN_DEF_DKIM_WL 5015 0.79 0.01 0.96 143 TR_LOTS_OF_MONEY3 5009 1.42 3.59 0.96 144 RELAYCOUNTRY_GB 4951 1.05 1.54 0.95 145 XMSubNoVowel 4864 1.07 1.71 0.93 146 T_FILL_THIS_FORM_SHORT 4707 1.03 1.60 0.90 147 SENDGRID_REDIR 4664 0.88 0.80 0.89 148 TR_MSPIKEBAYES00 4601 0.73 0.00 0.88 149 T_TooManySym_03 4595 0.74 0.10 0.88 150 NML_ADSP_CUSTOM_MED 4430 0.95 1.43 0.85 151 TooManyTo_004 4381 0.81 0.65 0.84 152 RCVD_IN_MSPIKE_BL 4287 3.19 14.32 0.82 153 XM_H_Trusted_IP 4275 0.68 0.00 0.82 154 XMHTML_After_End 4256 0.88 1.18 0.82 155 SpammyFromTLD_01 4026 2.18 8.82 0.77 156 HTTPS_HTTP_MISMATCH 3979 0.72 0.54 0.76 157 XM_SPF_Unknown 3872 0.84 1.29 0.74 158 TR_MetaPhish_Combo_01 3784 0.79 1.11 0.73 159 XMPhish14 3753 0.75 0.88 0.72 160 HTML_FONT_FACE_BAD 3725 0.69 0.60 0.71 161 T_XMDrugObfuBody_00 3669 0.86 1.57 0.70 162 TR_XM_UnparsRelay 3604 1.07 2.87 0.69 163 XMBody_95 3580 0.59 0.12 0.69 164 XM_RXBody 3532 0.63 0.43 0.68 165 TooManyTo_005 3527 0.65 0.54 0.68 166 HTML_IMAGE_ONLY_20 3498 0.60 0.26 0.67 167 XMSexyCombo_01 3487 0.96 2.34 0.67 168 XM_B_SpammyWords4 3416 0.87 1.85 0.66 169 FROM_GOV_DKIM_AU 3399 0.55 0.10 0.65 170 TR_BOTNET_NEGATE 3326 0.62 0.55 0.64 171 DKIM_ADSP_NXDOMAIN 3262 0.93 2.36 0.63 172 XMPhish30 3133 0.66 0.94 0.60 173 XM_ShortIntro_01 3126 0.58 0.51 0.60 174 T_XMHurry_00 3110 0.80 1.77 0.60 175 XMHTMLBadTable_001 3093 0.56 0.40 0.59 176 PLING_QUERY 3085 0.55 0.38 0.59 177 T_OBFU_PDF_ATTACH 3017 0.50 0.15 0.58 178 XMBody_78 3016 0.67 1.10 0.58 179 RCVD_IN_MSPIKE_L3 2892 1.78 7.56 0.55 180 FORGED_GMAIL_RCVD 2864 0.69 1.32 0.55 181 T_Symld_Words_02 2807 0.59 0.82 0.54 182 XM_B_COPY_HTML 2757 0.56 0.69 0.53 183 TM2_M_A_HREF_HREF 2755 0.54 0.59 0.53 184 XMMoneyMeta_00 2696 0.54 0.64 0.52 185 NUMERIC_HTTP_ADDR 2670 0.67 1.39 0.51 186 XMSubMetaSxObfu_03 2636 0.66 1.38 0.51 187 XMNoVowels 2625 0.50 0.51 0.50 188 XM_DIRTYINTL 2591 1.33 5.26 0.50 189 TR_XM_SpammyWords3 2590 2.04 9.29 0.50 190 T_TooManySym_04 2581 0.41 0.03 0.50 191 XM_B_REG_HTML 2548 0.42 0.09 0.49 192 RDNS_DYNAMIC 2537 0.66 1.49 0.49 193 NO_DNS_FOR_FROM 2482 0.65 1.45 0.48 194 HTML_TAG_BALANCE_BODY 2479 0.52 0.74 0.48 195 SUBJ_DOLLARS 2434 0.47 0.47 0.47 196 MPART_ALT_DIFF_COUNT 2421 0.55 0.96 0.46 197 XMGppyBdWords 2397 0.52 0.81 0.46 198 XM_S_SpammyWords 2396 0.62 1.37 0.46 199 TR_XM_Spammywords 2394 0.62 1.37 0.46 200 SpammyFromTLD_02 2391 1.37 5.66 0.46 ----------------------------------------------------------------------