Email: 381399 Autolearn: 0 AvgScore: 2.34 AvgScanTime: 1.21 sec Spam: 84110 Autolearn: 0 AvgScore: 14.37 AvgScanTime: 1.16 sec Ham: 297289 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 1.23 sec Time Spent Running SA: 128.35 hours Time Spent Processing Spam: 27.05 hours Time Spent Processing Ham: 101.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 81623 98.78 97.04 99.28 2 HTML_MESSAGE 75566 88.68 89.84 88.35 3 DKIM_SIGNED 69963 83.86 83.18 84.05 4 XM_DK_Pass 65097 81.83 77.40 83.09 5 DKIM_VALID 63933 80.28 76.01 81.49 6 XM_B_Unicode 62103 75.38 73.84 75.82 7 RELAYCOUNTRY_US 53237 79.56 63.29 84.16 8 DKIM_VALID_AU 51578 64.00 61.32 64.76 9 XMListUnsubscribeExists 51275 62.28 60.96 62.66 10 XM_B_SpammyWords 49357 54.86 58.68 53.77 11 XM_DK_Undo_02 49126 24.52 58.41 14.93 12 BAYES_99 35259 17.46 41.92 10.54 13 RELAYCOUNTRY_META 31195 12.26 37.09 5.23 14 XM_B_SpammyWords2 30081 28.28 35.76 26.16 15 XMSubLong 29523 24.35 35.10 21.31 16 BOTNET 29366 9.84 34.91 2.75 17 LOC_TINY_FONT_1 28402 31.75 33.77 31.18 18 XM_UncommonTLD01 26777 10.08 31.84 3.92 19 RCVD_IN_MSPIKE_H2 26550 29.04 31.57 28.33 20 MIME_HTML_ONLY 26184 25.76 31.13 24.24 21 BAYES_999 26097 13.68 31.03 8.78 22 DKIM_VALID_EF 25746 29.82 30.61 29.59 23 XM_B_Unicode3 24971 41.88 29.69 45.33 24 BAYES_50 23722 46.25 28.20 51.36 25 HTML_FONT_LOW_CONTRAST 22659 32.58 26.94 34.18 26 UNTRUSTED_Relay 22319 7.94 26.54 2.68 27 T_KAM_HTML_FONT_INVALID 17463 19.60 20.76 19.27 28 FVGT_m_MULTI_ODD 16706 23.11 19.86 24.03 29 T_TM2_M_HEADER_IN_MSG 16084 21.39 19.12 22.03 30 XM_Multi_Part_URI 15757 15.96 18.73 15.18 31 TR_XM_SpammyWords2 14705 6.64 17.48 3.57 32 T_REMOTE_IMAGE 14007 6.18 16.65 3.22 33 XM_Body_Dirty_Words 13997 15.73 16.64 15.47 34 RCVD_IN_MSPIKE_BL 13619 4.28 16.19 0.91 35 LOTS_OF_MONEY 13030 10.27 15.49 8.79 36 MPART_ALT_DIFF 12400 6.71 14.74 4.44 37 URIBL_SBL_A 12201 3.52 14.51 0.42 38 FROM_EXCESS_BASE64 12024 6.49 14.30 4.28 39 HTML_MIME_NO_HTML_TAG 11844 4.41 14.08 1.67 40 BOTNET_IPINHOSTNAME 11597 8.78 13.79 7.36 41 MIME_HTML_MOSTLY 11270 5.29 13.40 3.00 42 HTML_IMAGE_ONLY_12 11224 3.08 13.34 0.17 43 XMSlimDrugs 10823 2.86 12.87 0.03 44 RCVD_IN_BL_SPAMCOP_NET 10633 4.44 12.64 2.12 45 XM_B_SpammyWords3 10442 8.31 12.41 7.15 46 URI_PHP_REDIR 9177 2.42 10.91 0.02 47 BAYES_80 8903 6.44 10.58 5.27 48 SpammyFromTLD_01 8644 2.74 10.28 0.61 49 RCVD_IN_PSBL 8642 2.35 10.27 0.11 50 RELAYCOUNTRY_FR 8557 2.53 10.17 0.36 51 LotsOfNums_01 8103 10.22 9.63 10.38 52 XM_B_Unsub 7947 10.26 9.45 10.49 53 TR_XM_SpammyWords3 7910 2.57 9.40 0.64 54 RCVD_IN_MSPIKE_WL 7408 26.62 8.81 31.66 55 RCVD_IN_RP_RNBL 7374 1.97 8.77 0.05 56 RCVD_IN_MSPIKE_L3 7208 2.45 8.57 0.72 57 XMSexyCombo_05 7178 6.35 8.53 5.73 58 XM_B_Phish_Phrases 7161 7.50 8.51 7.22 59 BAYES_60 7034 8.28 8.36 8.25 60 LongTLD 6739 1.91 8.01 0.18 61 SpammyFromTLD_02 6442 1.84 7.66 0.19 62 BAYES_95 6272 4.25 7.46 3.34 63 XM_Evil_Numbers_Gen 6175 9.70 7.34 10.37 64 XM_UB99 6106 1.60 7.26 0.01 65 DKIM_INVALID 6030 3.57 7.17 2.56 66 XM_UB50 5855 2.52 6.96 1.27 67 RELAYCOUNTRY_CA 5637 3.13 6.70 2.11 68 RCVD_IN_MSPIKE_L5 5292 1.47 6.29 0.10 69 FROM_SUSPICIOUS_NTLD 5238 1.43 6.23 0.07 70 XMBrknScrpt_02 5205 2.68 6.19 1.69 71 HTML_IMAGE_RATIO_02 5189 8.86 6.17 9.62 72 FROM_SUSPICIOUS_NTLD_FP 5170 1.41 6.15 0.07 73 T_PDS_OTHER_BAD_TLD 4965 1.85 5.90 0.70 74 TR_XM_MaxBayes 4854 1.33 5.77 0.07 75 XMBody_17 4718 2.49 5.61 1.61 76 RCVD_IN_MSPIKE_H3 4259 14.98 5.06 17.79 77 UNPARSEABLE_RELAY 4059 8.53 4.83 9.57 78 XM_H_Long_From01 3831 5.47 4.55 5.73 79 TR_XM_MaxSPIKE 3789 1.01 4.50 0.02 80 XMSubMetaSx_00 3773 4.17 4.49 4.08 81 XM_SPF_SoftFail 3731 1.86 4.44 1.14 82 XM_B_SpammyTLD 3731 2.72 4.44 2.24 83 XM_UB999 3681 0.97 4.38 0.00 84 TooManyTo_001 3597 6.13 4.28 6.65 85 XM_UB80 3595 0.98 4.27 0.05 86 XM_UB60 3566 1.07 4.24 0.17 87 KHOP_HELO_FCRDNS 3523 1.60 4.19 0.87 88 XM_DIRTYINTL 3471 1.36 4.13 0.57 89 XMStrtUSub 3339 4.86 3.97 5.11 90 XM_SendGrid 3246 7.76 3.86 8.86 91 DKIM_ADSP_NXDOMAIN 3072 1.49 3.65 0.87 92 HTML_IMAGE_RATIO_04 3051 5.13 3.63 5.55 93 HK_RANDOM_FROM 2968 0.85 3.53 0.09 94 XM_OfRef6 2939 1.87 3.49 1.41 95 RCVD_IN_MSPIKE_H4 2909 9.89 3.46 11.71 96 T_FONT_INVIS_NAKED_TO 2826 2.86 3.36 2.72 97 XM_UB95 2696 0.72 3.21 0.02 98 TR_XM_UnparsRelay 2520 1.29 3.00 0.81 99 TR_XM_PhishingBody 2478 3.15 2.95 3.21 100 SUBJ_ALL_CAPS 2393 1.77 2.85 1.46 101 XMNumbers 2369 3.79 2.82 4.07 102 URI_TRY_3LD 2247 1.97 2.67 1.77 103 HTML_IMAGE_RATIO_08 2246 2.64 2.67 2.64 104 XM_B_COVIDMETA 2213 1.48 2.63 1.16 105 XM_B_SpammyWords4 2127 1.22 2.53 0.85 106 HTML_IMAGE_RATIO_06 2121 3.28 2.52 3.49 107 TR_XM_INV_DKIM 2117 0.74 2.52 0.24 108 MIME_CHARSET_FARAWAY 2082 0.64 2.48 0.13 109 BOTNET_NORDNS 2052 0.57 2.44 0.03 110 CHARSET_FARAWAY_HEADER 2017 0.55 2.40 0.03 111 T_XMDrugObfuBody_08 1956 1.88 2.33 1.75 112 T_FILL_THIS_FORM_SHORT 1921 1.19 2.28 0.88 113 URI_HEX 1811 2.01 2.15 1.97 114 TR_LOTS_OF_MONEY3 1809 1.13 2.15 0.84 115 TR_XM_COVIDMETA4 1781 0.73 2.12 0.34 116 TM2_M_URI_OPT_OUT 1760 3.22 2.09 3.53 117 TM2_M_VERY_LONG_WORD 1742 1.56 2.07 1.41 118 RELAYCOUNTRY_JP 1740 0.47 2.07 0.02 119 TR_XM_PHPDW 1737 0.79 2.07 0.43 120 MIMEOLE_DIRECT_TO_MX 1704 0.45 2.03 0.00 121 TR_XM_PHPForged 1703 0.77 2.02 0.42 122 TR_XM_FormFill2 1686 0.76 2.00 0.41 123 XM_H_PHPOS 1679 0.76 2.00 0.40 124 RDNS_DYNAMIC 1678 1.07 2.00 0.81 125 XMSubNoVowel 1666 0.95 1.98 0.65 126 TR_XM_DK_SendGrid 1650 4.67 1.96 5.44 127 RELAYCOUNTRY_AU 1610 0.61 1.91 0.24 128 DOS_OE_TO_MX 1606 0.42 1.91 0.00 129 XMSexyCombo_01 1591 1.01 1.89 0.76 130 RELAYCOUNTRY_IN 1577 0.47 1.87 0.07 131 T_XMHurry_00 1553 1.38 1.85 1.25 132 NUMERIC_HTTP_ADDR 1547 1.01 1.84 0.78 133 XM_CamelCaseFrm001 1545 1.98 1.84 2.01 134 RELAYCOUNTRY_DE 1515 0.69 1.80 0.38 135 TR_XM_RelayPhish 1507 0.51 1.79 0.15 136 T_TooManySym_01 1497 5.08 1.78 6.02 137 URI_NO_WWW_BIZ_CGI 1482 0.40 1.76 0.01 138 XM_URI_RBL 1456 0.55 1.73 0.21 139 T_XMDrugObfuBody_00 1453 0.95 1.73 0.73 140 XM_Lotto 1450 0.49 1.72 0.14 141 RELAYCOUNTRY_GB 1448 0.81 1.72 0.55 142 XM_SPF_Unknown 1378 0.64 1.64 0.36 143 T_DEAR_BENEFICIARY 1364 0.38 1.62 0.03 144 NORMAL_HTTP_TO_IP 1362 0.38 1.62 0.04 145 XMDiploma_00 1347 1.33 1.60 1.26 146 TR_XM_SB_Phish 1314 1.91 1.56 2.01 147 RELAYCOUNTRY_NL 1298 0.67 1.54 0.43 148 XM_B_Unsub2 1295 1.43 1.54 1.40 149 TR_Mismatch_TLD_02 1289 0.49 1.53 0.19 150 XMSubPhish11 1285 1.76 1.53 1.83 151 MONEY_FORM_SHORT 1274 0.33 1.51 0.00 152 LH_URI_DOM_IN_PATH 1269 1.63 1.51 1.67 153 TR_Mismatch_TLD_01 1267 0.53 1.51 0.25 154 DKIM_ADSP_CUSTOM_MED 1252 1.10 1.49 0.98 155 BILLION_DOLLARS 1248 0.34 1.48 0.01 156 XM_OfRef7 1231 0.43 1.46 0.14 157 FROM_LOCAL_NOVOWEL 1221 0.35 1.45 0.03 158 XM_B_Phish66 1216 1.41 1.45 1.40 159 ADVANCE_FEE_3_NEW_MONEY 1212 0.37 1.44 0.06 160 BOUNCE_MESSAGE 1211 2.16 1.44 2.36 161 NML_ADSP_CUSTOM_MED 1211 0.83 1.44 0.66 162 ANY_BOUNCE_MESSAGE 1211 2.16 1.44 2.36 163 XMGppyBdWords 1182 0.48 1.41 0.22 164 FORGED_GMAIL_RCVD 1127 0.74 1.34 0.57 165 MIME_HTML_ONLY_MULTI 1083 2.25 1.29 2.52 166 XMStockSpam_06 1073 1.12 1.28 1.08 167 TR_Caps_n_Bayes_99 1061 0.40 1.26 0.16 168 FORM_FRAUD_3 1061 0.28 1.26 0.00 169 RCVD_IN_RP_SAFE 1044 9.01 1.24 11.20 170 BAYES_40 1044 3.34 1.24 3.93 171 ALL_TRUSTED 1042 8.97 1.24 11.15 172 T_Symld_Words_02 1040 0.51 1.24 0.30 173 RCVD_IN_MSPIKE_L4 1025 0.33 1.22 0.08 174 TR_XM_FormFill 1023 0.36 1.22 0.11 175 DATE_IN_PAST_03_06 998 0.37 1.19 0.14 176 SUBJ_BUY 983 0.36 1.17 0.12 177 XMHTML_After_End 980 0.84 1.17 0.74 178 PDS_FROM_2_EMAILS 938 0.26 1.12 0.01 179 NO_DNS_FOR_FROM 927 0.82 1.10 0.74 180 MISSING_HEADERS 924 0.43 1.10 0.25 181 NO_FM_NAME_IP_HOSTN 921 0.24 1.09 0.00 182 FROM_2_EMAILS_SHORT 919 0.24 1.09 0.00 183 XM_H_Long_From02 915 1.11 1.09 1.12 184 XM_H_SupportSpoof 914 0.45 1.09 0.27 185 MIME_QP_LONG_LINE 907 3.97 1.08 4.79 186 BAYES_20 902 2.70 1.07 3.16 187 FVGT_m_MULTI_ODD_EMAIL 890 0.27 1.06 0.05 188 TR_Symld_Words 889 1.73 1.06 1.91 189 RCVD_IN_IADB_LISTED 874 4.01 1.04 4.85 190 LONG_JUNK_URI2 870 0.26 1.03 0.04 191 PDS_TO_EQ_FROM_NAME 868 0.24 1.03 0.01 192 RELAYCOUNTRY_ID 865 0.23 1.03 0.01 193 INVESTMENT_ADVICE 836 0.31 0.99 0.12 194 XMBdyGiftCard01 832 1.52 0.99 1.67 195 REPLYTO_WITHOUT_TO_CC 824 0.27 0.98 0.07 196 HK_RANDOM_REPLYTO 821 0.39 0.98 0.23 197 RELAYCOUNTRY_SC 811 0.21 0.96 0.00 198 CK_HELO_DYNAMIC_SPLIT_IP 803 2.09 0.95 2.41 199 XMBody_78 798 0.57 0.95 0.46 200 XMSubMetaD_00 781 0.27 0.93 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 295135 98.78 97.04 99.28 2 HTML_MESSAGE 262665 88.68 89.84 88.35 3 RELAYCOUNTRY_US 250186 79.56 63.29 84.16 4 DKIM_SIGNED 249869 83.86 83.18 84.05 5 XM_DK_Pass 247019 81.83 77.40 83.09 6 DKIM_VALID 242270 80.28 76.01 81.49 7 XM_B_Unicode 225412 75.38 73.84 75.82 8 DKIM_VALID_AU 192535 64.00 61.32 64.76 9 XMListUnsubscribeExists 186272 62.28 60.96 62.66 10 XM_B_SpammyWords 159860 54.86 58.68 53.77 11 BAYES_50 152674 46.25 28.20 51.36 12 XM_B_Unicode3 134763 41.88 29.69 45.33 13 HTML_FONT_LOW_CONTRAST 101603 32.58 26.94 34.18 14 RCVD_IN_MSPIKE_WL 94107 26.62 8.81 31.66 15 LOC_TINY_FONT_1 92708 31.75 33.77 31.18 16 DKIM_VALID_EF 87972 29.82 30.61 29.59 17 RCVD_IN_MSPIKE_H2 84211 29.04 31.57 28.33 18 XM_B_SpammyWords2 77777 28.28 35.76 26.16 19 MIME_HTML_ONLY 72077 25.76 31.13 24.24 20 FVGT_m_MULTI_ODD 71445 23.11 19.86 24.03 21 T_TM2_M_HEADER_IN_MSG 65484 21.39 19.12 22.03 22 XMSubLong 63351 24.35 35.10 21.31 23 T_KAM_HTML_FONT_INVALID 57296 19.60 20.76 19.27 24 RCVD_IN_MSPIKE_H3 52881 14.98 5.06 17.79 25 XM_Body_Dirty_Words 46004 15.73 16.64 15.47 26 XM_Multi_Part_URI 45123 15.96 18.73 15.18 27 XM_DK_Undo_02 44395 24.52 58.41 14.93 28 BAYES_00 35622 9.44 0.44 11.98 29 RCVD_IN_MSPIKE_H4 34813 9.89 3.46 11.71 30 RCVD_IN_RP_SAFE 33301 9.01 1.24 11.20 31 ALL_TRUSTED 33159 8.97 1.24 11.15 32 BAYES_99 31324 17.46 41.92 10.54 33 XM_B_Unsub 31174 10.26 9.45 10.49 34 RCVD_IN_RP_CERTIFIED 31005 8.24 0.51 10.43 35 LotsOfNums_01 30859 10.22 9.63 10.38 36 XM_Evil_Numbers_Gen 30823 9.70 7.34 10.37 37 XM_DKIMWhitelistDomains 30409 7.97 0.01 10.23 38 TR_XM_DK_Bayes 28744 7.59 0.26 9.67 39 HTML_IMAGE_RATIO_02 28599 8.86 6.17 9.62 40 UNPARSEABLE_RELAY 28457 8.53 4.83 9.57 41 TR_XM_DK_Bayes1 28179 7.45 0.26 9.48 42 XM_SendGrid 26351 7.76 3.86 8.86 43 TR_XM_DK_Bayes2 26179 6.91 0.22 8.81 44 LOTS_OF_MONEY 26132 10.27 15.49 8.79 45 BAYES_999 26097 13.68 31.03 8.78 46 BAYES_60 24541 8.28 8.36 8.25 47 BOTNET_IPINHOSTNAME 21874 8.78 13.79 7.36 48 XM_B_Phish_Phrases 21450 7.50 8.51 7.22 49 XM_B_SpammyWords3 21266 8.31 12.41 7.15 50 TooManyTo_001 19779 6.13 4.28 6.65 51 T_TooManySym_01 17892 5.08 1.78 6.02 52 XM_H_Long_From01 17049 5.47 4.55 5.73 53 XMSexyCombo_05 17041 6.35 8.53 5.73 54 HTML_IMAGE_RATIO_04 16504 5.13 3.63 5.55 55 TR_XM_DK_SendGrid 16173 4.67 1.96 5.44 56 BAYES_80 15678 6.44 10.58 5.27 57 RELAYCOUNTRY_META 15562 12.26 37.09 5.23 58 XMStrtUSub 15189 4.86 3.97 5.11 59 RCVD_IN_IADB_LISTED 14404 4.01 1.04 4.85 60 MIME_QP_LONG_LINE 14251 3.97 1.08 4.79 61 IN_ZIMBRA_NJ_WHITELIST 13402 3.53 0.06 4.51 62 MPART_ALT_DIFF 13200 6.71 14.74 4.44 63 FROM_EXCESS_BASE64 12729 6.49 14.30 4.28 64 RCVD_IN_IADB_SPF 12617 3.49 0.83 4.24 65 XMSubMetaSx_00 12135 4.17 4.49 4.08 66 XMNumbers 12091 3.79 2.82 4.07 67 BAYES_40 11692 3.34 1.24 3.93 68 XM_UncommonTLD01 11659 10.08 31.84 3.92 69 RCVD_IN_IADB_SENDERID 11394 3.15 0.75 3.83 70 RCVD_IN_IADB_DK 11086 3.07 0.75 3.73 71 TR_XM_SpammyWords2 10625 6.64 17.48 3.57 72 TM2_M_URI_OPT_OUT 10509 3.22 2.09 3.53 73 HTML_IMAGE_RATIO_06 10379 3.28 2.52 3.49 74 BAYES_95 9931 4.25 7.46 3.34 75 T_REMOTE_IMAGE 9574 6.18 16.65 3.22 76 TR_XM_PhishingBody 9534 3.15 2.95 3.21 77 BAYES_20 9387 2.70 1.07 3.16 78 T_TooManySym_02 8982 2.46 0.48 3.02 79 MIME_HTML_MOSTLY 8917 5.29 13.40 3.00 80 RCVD_IN_IADB_VOUCHED 8538 2.36 0.56 2.87 81 BOTNET 8177 9.84 34.91 2.75 82 T_FONT_INVIS_NAKED_TO 8085 2.86 3.36 2.72 83 UNTRUSTED_Relay 7972 7.94 26.54 2.68 84 HTML_IMAGE_RATIO_08 7842 2.64 2.67 2.64 85 TVD_RCVD_IP 7766 2.18 0.63 2.61 86 DKIM_INVALID 7599 3.57 7.17 2.56 87 MIME_HTML_ONLY_MULTI 7499 2.25 1.29 2.52 88 INVALID_MSGID 7294 2.06 0.66 2.45 89 HELO_MISC_IP 7157 2.02 0.66 2.41 90 CK_HELO_DYNAMIC_SPLIT_IP 7154 2.09 0.95 2.41 91 URI_NOVOWEL 7105 2.04 0.82 2.39 92 ANY_BOUNCE_MESSAGE 7017 2.16 1.44 2.36 93 BOUNCE_MESSAGE 7016 2.16 1.44 2.36 94 XM_B_SpammyTLD 6658 2.72 4.44 2.24 95 BAYES_05 6431 1.84 0.70 2.16 96 RCVD_IN_MSPIKE_H5 6413 1.74 0.29 2.16 97 TO_MALFORMED 6356 1.67 0.01 2.14 98 RCVD_IN_BL_SPAMCOP_NET 6310 4.44 12.64 2.12 99 RELAYCOUNTRY_CA 6285 3.13 6.70 2.11 100 XM_PDF 6122 1.70 0.41 2.06 101 XM_CamelCaseFrm001 5990 1.98 1.84 2.01 102 TR_XM_SB_Phish 5989 1.91 1.56 2.01 103 URI_HEX 5854 2.01 2.15 1.97 104 TR_Symld_Words 5691 1.73 1.06 1.91 105 XMBSHREFv2 5627 1.51 0.15 1.89 106 RCVD_IN_IADB_OPTIN 5527 1.55 0.46 1.86 107 XMSubPhish11 5439 1.76 1.53 1.83 108 URI_TRY_3LD 5253 1.97 2.67 1.77 109 T_XMDrugObfuBody_08 5209 1.88 2.33 1.75 110 XM_DK_Undo_01 5176 1.49 0.62 1.74 111 IN_HORDE_ADDRESS_BOOK 5079 1.38 0.22 1.71 112 XMBrknScrpt_02 5020 2.68 6.19 1.69 113 MAILING_LIST_MULTI 4998 1.46 0.66 1.68 114 HTML_MIME_NO_HTML_TAG 4965 4.41 14.08 1.67 115 LH_URI_DOM_IN_PATH 4958 1.63 1.51 1.67 116 XMBdyGiftCard01 4957 1.52 0.99 1.67 117 XMBody_17 4782 2.49 5.61 1.61 118 T_XMDrugObfuBody_14 4738 1.44 0.88 1.59 119 XMGappySubj_01 4594 1.22 0.09 1.55 120 USER_IN_DEF_DKIM_WL 4493 1.18 0.01 1.51 121 SUBJ_ALL_CAPS 4349 1.77 2.85 1.46 122 XM_OfRef6 4197 1.87 3.49 1.41 123 TM2_M_VERY_LONG_WORD 4192 1.56 2.07 1.41 124 XM_B_Phish66 4173 1.41 1.45 1.40 125 XM_B_Unsub2 4169 1.43 1.54 1.40 126 T_TooManySym_03 3889 1.05 0.13 1.31 127 XM_UB50 3768 2.52 6.96 1.27 128 XMDiploma_00 3741 1.33 1.60 1.26 129 T_XMHurry_00 3706 1.38 1.85 1.25 130 XM_B_COVIDMETA 3450 1.48 2.63 1.16 131 XM_ProductURIs 3422 1.01 0.50 1.15 132 XM_SPF_SoftFail 3382 1.86 4.44 1.14 133 XMBody_95 3341 0.89 0.09 1.12 134 XM_H_Long_From02 3326 1.11 1.09 1.12 135 XMStockSpam_06 3214 1.12 1.28 1.08 136 TooManyTo_002 3168 0.93 0.44 1.07 137 XM_RXBody 2948 0.94 0.76 0.99 138 DKIM_ADSP_CUSTOM_MED 2926 1.10 1.49 0.98 139 TR_MSPIKEBAYES00 2875 0.75 0.00 0.97 140 XM_GoogleGroups 2816 0.80 0.28 0.95 141 XMSubMetaI_00 2791 0.86 0.60 0.94 142 RCVD_IN_MSPIKE_BL 2695 4.28 16.19 0.91 143 TR_MetaPhish_Combo_01 2626 0.82 0.57 0.88 144 T_FILL_THIS_FORM_SHORT 2603 1.19 2.28 0.88 145 DKIM_ADSP_NXDOMAIN 2593 1.49 3.65 0.87 146 KHOP_HELO_FCRDNS 2574 1.60 4.19 0.87 147 XM_B_SpammyWords4 2514 1.22 2.53 0.85 148 TR_LOTS_OF_MONEY3 2486 1.13 2.15 0.84 149 XMPhish08 2471 0.79 0.63 0.83 150 RDNS_DYNAMIC 2419 1.07 2.00 0.81 151 T_TooManySym_04 2413 0.64 0.04 0.81 152 HTML_TAG_BALANCE_BODY 2399 0.78 0.67 0.81 153 TR_XM_UnparsRelay 2395 1.29 3.00 0.81 154 NUMERIC_HTTP_ADDR 2324 1.01 1.84 0.78 155 XMHTMLBadTable_001 2293 0.67 0.31 0.77 156 XMSexyCombo_01 2261 1.01 1.89 0.76 157 XM_S_SubURI 2246 0.61 0.09 0.76 158 TooManyTo_003 2237 0.66 0.33 0.75 159 NO_DNS_FOR_FROM 2210 0.82 1.10 0.74 160 HTML_FONT_FACE_BAD 2207 0.66 0.39 0.74 161 XMHTML_After_End 2206 0.84 1.17 0.74 162 PLING_QUERY 2181 0.70 0.56 0.73 163 T_XMDrugObfuBody_00 2173 0.95 1.73 0.73 164 RCVD_IN_MSPIKE_L3 2129 2.45 8.57 0.72 165 XMGenDplmaNmb 2107 0.73 0.81 0.71 166 T_PDS_OTHER_BAD_TLD 2074 1.85 5.90 0.70 167 XM_B_REG_HTML 2023 0.55 0.07 0.68 168 USER_IN_WELCOMELIST 1988 0.52 0.00 0.67 169 USER_IN_WHITELIST 1988 0.52 0.00 0.67 170 NML_ADSP_CUSTOM_MED 1955 0.83 1.44 0.66 171 XMSubNoVowel 1944 0.95 1.98 0.65 172 T_TooManySym_05 1908 0.50 0.02 0.64 173 TR_XM_SpammyWords3 1889 2.57 9.40 0.64 174 DIET_1 1883 0.67 0.81 0.63 175 TR_BOTNET_NEGATE 1875 0.57 0.37 0.63 176 SpammyFromTLD_01 1801 2.74 10.28 0.61 177 XMSubMetaSxObfu_02 1785 0.64 0.77 0.60 178 XM_H_Trusted_IP 1757 0.46 0.00 0.59 179 TooManyTo_004 1743 0.53 0.31 0.59 180 XM_ShortIntro_01 1739 0.54 0.38 0.58 181 XMPhish30 1718 0.58 0.57 0.58 182 XM_B_COPY_HTML 1709 0.55 0.44 0.57 183 XM_DIRTYINTL 1709 1.36 4.13 0.57 184 SENDGRID_REDIR 1701 0.52 0.35 0.57 185 FORGED_GMAIL_RCVD 1690 0.74 1.34 0.57 186 RELAYCOUNTRY_GB 1646 0.81 1.72 0.55 187 HTTPS_HTTP_MISMATCH 1623 0.60 0.79 0.55 188 MPART_ALT_DIFF_COUNT 1605 0.59 0.75 0.54 189 XMLngstWrd_00 1591 0.47 0.24 0.54 190 SUBJ_DOLLARS 1560 0.49 0.36 0.52 191 HTML_IMAGE_ONLY_20 1559 0.46 0.23 0.52 192 TooManyTo_005 1462 0.44 0.25 0.49 193 XMLngstWrd_01 1444 0.43 0.23 0.49 194 HELO_NODOT 1432 0.45 0.35 0.48 195 HELO_NO_DOMAIN 1431 0.45 0.35 0.48 196 XM_Doc_Oz_Body 1408 0.44 0.31 0.47 197 SHOPIFY_IMG_NOT_RCVD_SFY 1386 0.43 0.32 0.47 198 XMBody_78 1382 0.57 0.95 0.46 199 XM_H_PHPMailer 1370 0.48 0.54 0.46 200 XM_D_tchamptons_WL 1365 0.36 0.03 0.46 ----------------------------------------------------------------------