Email: 395971 Autolearn: 0 AvgScore: 3.64 AvgScanTime: 1.24 sec Spam: 120953 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 1.32 sec Ham: 275018 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 1.20 sec Time Spent Running SA: 136.26 hours Time Spent Processing Spam: 44.46 hours Time Spent Processing Ham: 91.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 104951 87.07 86.77 87.20 2 DKIM_SIGNED 97892 82.24 80.93 82.81 3 XM_B_Unicode 96280 76.12 79.60 74.58 4 XM_DK_Pass 95346 80.94 78.83 81.87 5 DKIM_VALID 93711 79.48 77.48 80.36 6 RELAYCOUNTRY_US 92029 81.08 76.09 83.28 7 XM_B_SpammyWords 87528 58.32 72.37 52.15 8 XMListUnsubscribeExists 86312 63.08 71.36 59.44 9 DCC_CHECK 85980 54.27 71.09 46.88 10 DKIM_VALID_AU 70274 63.13 58.10 65.34 11 XM_DK_Undo_02 55204 22.20 45.64 11.90 12 XM_B_SpammyWords2 47109 29.43 38.95 25.25 13 BAYES_99 45895 17.07 37.94 7.89 14 BAYES_50 42963 48.32 35.52 53.95 15 XM_B_Unicode3 42504 42.18 35.14 45.27 16 LOC_TINY_FONT_1 39497 31.73 32.65 31.33 17 HTML_FONT_LOW_CONTRAST 39277 33.53 32.47 33.99 18 BAYES_999 35685 13.55 29.50 6.53 19 TR_DCC_Bayes_99 35260 11.59 29.15 3.86 20 DKIM_VALID_EF 33817 29.56 27.96 30.26 21 DCC_CHECK_NEGATIVE 33538 44.46 27.73 51.82 22 RCVD_IN_MSPIKE_H2 32740 27.53 27.07 27.74 23 MIME_HTML_ONLY 30581 25.05 25.28 24.95 24 RELAYCOUNTRY_META 29276 10.58 24.20 4.59 25 XM_Multi_Part_URI 28335 16.86 23.43 13.97 26 FVGT_m_MULTI_ODD 27571 23.65 22.79 24.03 27 T_KAM_HTML_FONT_INVALID 26719 19.05 22.09 17.71 28 XMSubLong 26172 22.31 21.64 22.61 29 BOTNET 26067 8.35 21.55 2.54 30 T_TM2_M_HEADER_IN_MSG 26029 22.04 21.52 22.27 31 XM_Body_Dirty_Words 22708 16.17 18.77 15.03 32 LOTS_OF_MONEY 22642 11.68 18.72 8.59 33 TR_XM_SpammyWords2 19940 6.80 16.49 2.54 34 RCVD_IN_MSPIKE_WL 18933 26.60 15.65 31.41 35 RCVD_IN_MSPIKE_BL 17932 5.15 14.83 0.89 36 UNTRUSTED_Relay 17788 6.10 14.71 2.31 37 RCVD_IN_RP_RNBL 15259 4.00 12.62 0.20 38 HTML_IMAGE_RATIO_02 14531 10.21 12.01 9.42 39 XM_B_SpammyWords3 13326 7.71 11.02 6.25 40 XM_UncommonTLD01 13132 6.06 10.86 3.96 41 TR_XM_SpammyWords3 13072 3.68 10.81 0.54 42 LotsOfNums_01 12523 9.47 10.35 9.08 43 BOTNET_IPINHOSTNAME 12458 7.71 10.30 6.57 44 XM_B_Phish_Phrases 12026 7.42 9.94 6.31 45 RCVD_IN_PSBL 12025 3.10 9.94 0.09 46 RCVD_IN_MSPIKE_L5 11936 3.20 9.87 0.26 47 XMSexyCombo_05 11876 7.03 9.82 5.81 48 DATE_IN_PAST_03_06 11638 3.05 9.62 0.15 49 XM_B_Unsub 11407 10.96 9.43 11.63 50 MPART_ALT_DIFF 11133 5.84 9.20 4.36 51 BAYES_80 10926 6.09 9.03 4.80 52 XM_Evil_Numbers_Gen 10866 9.65 8.98 9.95 53 FSL_BULK_SIG 10673 7.11 8.82 6.35 54 RCVD_IN_MSPIKE_H3 9972 14.90 8.24 17.82 55 XM_OfRef6 9736 3.59 8.05 1.63 56 XMBody_17 9633 3.26 7.96 1.19 57 ANY_BOUNCE_MESSAGE 9455 4.07 7.82 2.42 58 BOUNCE_MESSAGE 9454 4.07 7.82 2.42 59 RELAYCOUNTRY_CA 9332 3.64 7.72 1.84 60 XM_Lotto 9224 2.37 7.63 0.06 61 XMBrknScrpt_02 9120 3.39 7.54 1.56 62 MIME_HTML_MOSTLY 8497 3.68 7.03 2.21 63 RCVD_IN_MSPIKE_H4 8266 10.12 6.83 11.57 64 TR_XM_COVIDMETA4 8253 2.24 6.82 0.23 65 URIBL_SBL_A 7911 2.19 6.54 0.27 66 BAYES_60 7870 7.42 6.51 7.82 67 RCVD_IN_BL_SPAMCOP_NET 7643 3.03 6.32 1.58 68 HTML_IMAGE_RATIO_04 7161 5.56 5.92 5.40 69 UNPARSEABLE_RELAY 7082 8.01 5.86 8.96 70 XMSubMetaSx_00 7037 5.23 5.82 4.97 71 TooManyTo_001 7000 6.34 5.79 6.58 72 BAYES_95 6922 3.91 5.72 3.11 73 RELAYCOUNTRY_FR 6427 1.79 5.31 0.24 74 XM_UB50 6354 2.32 5.25 1.03 75 SpammyFromTLD_01 5844 1.95 4.83 0.68 76 RCVD_IN_MSPIKE_L3 5446 1.79 4.50 0.59 77 XM_SendGrid 5241 7.02 4.33 8.20 78 XM_H_Long_From01 5174 5.20 4.28 5.60 79 URI_HEX 5143 2.30 4.25 1.44 80 XM_SPF_SoftFail 5015 2.22 4.15 1.38 81 TR_XM_MaxBayes 4845 1.25 4.01 0.03 82 XM_DIRTYINTL 4751 1.67 3.93 0.68 83 XM_B_SpammyTLD 4739 2.74 3.92 2.22 84 T_XMDrugObfuBody_08 4521 2.62 3.74 2.13 85 XM_B_COVIDMETA 4404 1.94 3.64 1.19 86 XM_UB99 4341 1.10 3.59 0.01 87 SpammyFromTLD_02 4298 1.17 3.55 0.13 88 BOTNET_NORDNS 4234 1.08 3.50 0.01 89 TR_XM_PhishingBody 4222 2.59 3.49 2.20 90 DKIM_INVALID 4181 2.76 3.46 2.45 91 HTML_IMAGE_RATIO_06 4027 3.96 3.33 4.24 92 T_FONT_INVIS_NAKED_TO 3944 2.68 3.26 2.42 93 URI_PHP_REDIR 3872 0.98 3.20 0.00 94 XMStrtUSub 3768 4.45 3.12 5.03 95 T_REMOTE_IMAGE 3761 3.42 3.11 3.55 96 HTML_MIME_NO_HTML_TAG 3562 2.33 2.94 2.06 97 TR_LOTS_OF_MONEY3 3546 1.40 2.93 0.72 98 TR_XM_MaxSPIKE 3499 0.90 2.89 0.02 99 XM_OfRef7 3493 1.04 2.89 0.22 100 RCVD_IN_RP_SAFE 3461 8.73 2.86 11.31 101 URI_TRY_3LD 3458 2.45 2.86 2.27 102 XMNumbers 3371 3.95 2.79 4.46 103 FROM_EXCESS_BASE64 3166 4.06 2.62 4.69 104 TR_XM_UnparsRelay 3020 1.15 2.50 0.56 105 XM_UB999 2992 0.76 2.47 0.00 106 SUBJ_ALL_CAPS 2911 1.71 2.41 1.41 107 TM2_M_URI_OPT_OUT 2875 2.97 2.38 3.23 108 HTML_IMAGE_RATIO_08 2849 2.15 2.36 2.05 109 LH_URI_DOM_IN_PATH 2797 1.71 2.31 1.44 110 KHOP_HELO_FCRDNS 2781 1.57 2.30 1.25 111 TR_XM_DK_SendGrid 2771 4.37 2.29 5.29 112 FILL_THIS_FORM 2610 0.79 2.16 0.19 113 T_FILL_THIS_FORM_SHORT 2582 1.20 2.13 0.79 114 T_FILL_THIS_FORM_LONG 2546 0.73 2.10 0.12 115 XMDiploma_00 2541 2.18 2.10 2.21 116 XMBdyGiftCard01 2530 1.33 2.09 0.99 117 MIME_HTML_ONLY_MULTI 2520 2.44 2.08 2.60 118 XMSlimDrugH 2419 0.90 2.00 0.42 119 BAYES_40 2398 3.22 1.98 3.77 120 ADVANCE_FEE_2_NEW_FORM 2343 0.59 1.94 0.00 121 RCVD_IN_RP_CERTIFIED 2295 7.90 1.90 10.54 122 DKIM_ADSP_CUSTOM_MED 2285 1.19 1.89 0.88 123 T_Symld_Words_02 2189 1.00 1.81 0.64 124 MPART_ALT_DIFF_COUNT 2188 0.86 1.81 0.45 125 XM_CamelCaseFrm001 2187 1.91 1.81 1.96 126 NML_ADSP_CUSTOM_MED 2182 0.97 1.80 0.61 127 FORM_FRAUD 2173 0.55 1.80 0.00 128 XM_UB80 2155 0.56 1.78 0.02 129 FORGED_GMAIL_RCVD 2139 0.86 1.77 0.46 130 HTML_IMAGE_ONLY_08 2063 0.60 1.71 0.11 131 TM2_M_VERY_LONG_WORD 2046 1.43 1.69 1.32 132 T_TooManySym_01 2039 4.67 1.69 5.99 133 TR_Mismatch_TLD_01 2023 0.79 1.67 0.40 134 XMSexyCombo_01 2019 1.75 1.67 1.79 135 MIME_QP_LONG_LINE 1985 3.46 1.64 4.25 136 XM_URI_RBL 1983 0.64 1.64 0.19 137 T_LONG_INVISIBLE_TEXT 1974 1.00 1.63 0.72 138 XM_UB60 1956 0.56 1.62 0.10 139 HTML_SHORT_LINK_IMG_1 1931 0.52 1.60 0.05 140 RELAYCOUNTRY_GB 1925 0.94 1.59 0.65 141 T_PDS_OTHER_BAD_TLD 1918 1.01 1.59 0.76 142 XM_BadFromFormat 1914 0.64 1.58 0.23 143 RCVD_IN_IADB_LISTED 1897 3.42 1.57 4.23 144 TR_XM_PHPDW 1854 0.81 1.53 0.49 145 XM_B_Phish66 1837 1.13 1.52 0.95 146 MISSING_HEADERS 1807 0.65 1.49 0.28 147 BAYES_20 1801 2.42 1.49 2.84 148 TR_XM_PHPForged 1793 0.78 1.48 0.46 149 TR_XM_FormFill2 1793 0.77 1.48 0.46 150 XM_H_PHPOS 1791 0.77 1.48 0.46 151 T_XMHurry_00 1789 0.70 1.48 0.36 152 T_XMDrugObfuBody_00 1734 1.44 1.43 1.45 153 REPLYTO_WITHOUT_TO_CC 1684 0.47 1.39 0.07 154 XMGenDplmaNmb 1664 1.47 1.38 1.51 155 FROM_SUSPICIOUS_NTLD 1659 0.49 1.37 0.11 156 TR_Symld_Words 1644 2.15 1.36 2.50 157 HK_RANDOM_REPLYTO 1631 0.58 1.35 0.24 158 ADVANCE_FEE_3_NEW_MONEY 1626 0.41 1.34 0.00 159 TR_Mismatch_TLD_02 1624 0.45 1.34 0.06 160 FROM_SUSPICIOUS_NTLD_FP 1612 0.48 1.33 0.10 161 TR_LOTS_OF_MONEY1 1589 0.41 1.31 0.02 162 TR_XM_RelayPhish 1564 0.48 1.29 0.12 163 RCVD_IN_IADB_SPF 1544 2.97 1.28 3.72 164 RELAYCOUNTRY_SG 1539 0.43 1.27 0.06 165 XM_B_Unsub2 1536 1.68 1.27 1.86 166 URG_BIZ 1524 0.44 1.26 0.07 167 TR_XM_SB_Phish 1524 1.52 1.26 1.64 168 MILLION_HUNDRED 1518 0.39 1.26 0.00 169 XMHTML_After_End 1517 0.75 1.25 0.52 170 MONEY_FRAUD_5 1506 0.38 1.25 0.00 171 XMSubPhish11 1501 1.50 1.24 1.61 172 XMStockSpam_06 1470 1.55 1.22 1.69 173 DATE_IN_PAST_06_12 1455 0.53 1.20 0.23 174 XM_UB95 1449 0.37 1.20 0.01 175 XMSubNoVowel 1432 0.55 1.18 0.27 176 XM_Combo_Sbj 1423 0.58 1.18 0.32 177 T_DEAR_BENEFICIARY 1414 0.36 1.17 0.00 178 RCVD_IN_IADB_DK 1412 2.60 1.17 3.23 179 TR_XM_INV_DKIM 1410 0.41 1.17 0.08 180 RCVD_IN_IADB_SENDERID 1406 2.67 1.16 3.33 181 HTML_IMAGE_ONLY_32 1390 0.52 1.15 0.24 182 TR_XM_FormFill 1374 0.36 1.14 0.02 183 DATE_IN_PAST_12_24 1365 0.45 1.13 0.16 184 RELAYCOUNTRY_NL 1364 0.57 1.13 0.33 185 TR_Caps_n_Bayes_99 1349 0.49 1.12 0.21 186 T_XMDrugObfuBody_14 1345 1.34 1.11 1.44 187 UNCLAIMED_MONEY 1302 0.33 1.08 0.00 188 XMSexyCombo_04 1292 1.14 1.07 1.17 189 DKIM_ADSP_NXDOMAIN 1291 1.01 1.07 0.98 190 BODY_URI_ONLY 1269 0.37 1.05 0.07 191 RDNS_DYNAMIC 1251 0.85 1.03 0.76 192 SHORTENED_URL_HREF 1250 0.50 1.03 0.27 193 XM_B_SpammyWords4 1204 0.72 1.00 0.60 194 XMPhish30 1197 0.62 0.99 0.46 195 BAYES_00 1195 9.96 0.99 13.91 196 MAILING_LIST_MULTI 1171 1.65 0.97 1.95 197 XMSubMetaSSx_00 1156 0.39 0.96 0.14 198 RELAYCOUNTRY_IN 1141 0.33 0.94 0.06 199 SUBJ_DOLLARS 1139 0.67 0.94 0.56 200 MIME_CHARSET_FARAWAY 1132 0.39 0.94 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239819 87.07 86.77 87.20 2 RELAYCOUNTRY_US 229030 81.08 76.09 83.28 3 DKIM_SIGNED 227747 82.24 80.93 82.81 4 XM_DK_Pass 225168 80.94 78.83 81.87 5 DKIM_VALID 221004 79.48 77.48 80.36 6 XM_B_Unicode 205122 76.12 79.60 74.58 7 DKIM_VALID_AU 179689 63.13 58.10 65.34 8 XMListUnsubscribeExists 163484 63.08 71.36 59.44 9 BAYES_50 148380 48.32 35.52 53.95 10 XM_B_SpammyWords 143418 58.32 72.37 52.15 11 DCC_CHECK_NEGATIVE 142522 44.46 27.73 51.82 12 DCC_CHECK 128919 54.27 71.09 46.88 13 XM_B_Unicode3 124511 42.18 35.14 45.27 14 HTML_FONT_LOW_CONTRAST 93475 33.53 32.47 33.99 15 RCVD_IN_MSPIKE_WL 86382 26.60 15.65 31.41 16 LOC_TINY_FONT_1 86158 31.73 32.65 31.33 17 DKIM_VALID_EF 83230 29.56 27.96 30.26 18 RCVD_IN_MSPIKE_H2 76279 27.53 27.07 27.74 19 XM_B_SpammyWords2 69433 29.43 38.95 25.25 20 MIME_HTML_ONLY 68618 25.05 25.28 24.95 21 FVGT_m_MULTI_ODD 66082 23.65 22.79 24.03 22 XMSubLong 62177 22.31 21.64 22.61 23 T_TM2_M_HEADER_IN_MSG 61258 22.04 21.52 22.27 24 RCVD_IN_MSPIKE_H3 49008 14.90 8.24 17.82 25 T_KAM_HTML_FONT_INVALID 48713 19.05 22.09 17.71 26 XM_Body_Dirty_Words 41340 16.17 18.77 15.03 27 XM_Multi_Part_URI 38410 16.86 23.43 13.97 28 BAYES_00 38246 9.96 0.99 13.91 29 ALL_TRUSTED 34580 8.98 0.82 12.57 30 XM_DK_Undo_02 32720 22.20 45.64 11.90 31 XM_B_Unsub 31972 10.96 9.43 11.63 32 RCVD_IN_MSPIKE_H4 31808 10.12 6.83 11.57 33 XM_DKIMWhitelistDomains 31500 7.97 0.04 11.45 34 RCVD_IN_RP_SAFE 31092 8.73 2.86 11.31 35 TR_XM_DK_Bayes 30713 7.92 0.52 11.17 36 TR_XM_DK_Bayes1 30145 7.77 0.51 10.96 37 RCVD_IN_RP_CERTIFIED 28985 7.90 1.90 10.54 38 TR_XM_DK_Bayes2 27983 7.20 0.45 10.17 39 XM_Evil_Numbers_Gen 27359 9.65 8.98 9.95 40 HTML_IMAGE_RATIO_02 25900 10.21 12.01 9.42 41 LotsOfNums_01 24976 9.47 10.35 9.08 42 UNPARSEABLE_RELAY 24634 8.01 5.86 8.96 43 LOTS_OF_MONEY 23612 11.68 18.72 8.59 44 XM_SendGrid 22554 7.02 4.33 8.20 45 BAYES_99 21702 17.07 37.94 7.89 46 BAYES_60 21508 7.42 6.51 7.82 47 TooManyTo_001 18106 6.34 5.79 6.58 48 BOTNET_IPINHOSTNAME 18056 7.71 10.30 6.57 49 BAYES_999 17962 13.55 29.50 6.53 50 FSL_BULK_SIG 17472 7.11 8.82 6.35 51 XM_B_Phish_Phrases 17344 7.42 9.94 6.31 52 XM_B_SpammyWords3 17185 7.71 11.02 6.25 53 T_TooManySym_01 16472 4.67 1.69 5.99 54 XMSexyCombo_05 15975 7.03 9.82 5.81 55 XM_H_Long_From01 15412 5.20 4.28 5.60 56 HTML_IMAGE_RATIO_04 14859 5.56 5.92 5.40 57 TR_XM_DK_SendGrid 14551 4.37 2.29 5.29 58 IN_ZIMBRA_NJ_WHITELIST 14246 3.60 0.02 5.18 59 XMStrtUSub 13837 4.45 3.12 5.03 60 XMSubMetaSx_00 13657 5.23 5.82 4.97 61 BAYES_80 13205 6.09 9.03 4.80 62 FROM_EXCESS_BASE64 12896 4.06 2.62 4.69 63 RELAYCOUNTRY_META 12629 10.58 24.20 4.59 64 XMNumbers 12255 3.95 2.79 4.46 65 MPART_ALT_DIFF 11996 5.84 9.20 4.36 66 MIME_QP_LONG_LINE 11696 3.46 1.64 4.25 67 HTML_IMAGE_RATIO_06 11666 3.96 3.33 4.24 68 RCVD_IN_IADB_LISTED 11635 3.42 1.57 4.23 69 XM_UncommonTLD01 10880 6.06 10.86 3.96 70 TR_DCC_Bayes_99 10622 11.59 29.15 3.86 71 BAYES_40 10369 3.22 1.98 3.77 72 RCVD_IN_IADB_SPF 10229 2.97 1.28 3.72 73 T_REMOTE_IMAGE 9771 3.42 3.11 3.55 74 T_TooManySym_02 9534 2.56 0.51 3.47 75 RCVD_IN_IADB_SENDERID 9170 2.67 1.16 3.33 76 RCVD_IN_IADB_DK 8888 2.60 1.17 3.23 77 TM2_M_URI_OPT_OUT 8880 2.97 2.38 3.23 78 BAYES_95 8546 3.91 5.72 3.11 79 TVD_RCVD_IP 7878 2.05 0.19 2.86 80 BAYES_20 7799 2.42 1.49 2.84 81 INVALID_MSGID 7642 2.20 0.89 2.78 82 MIME_HTML_ONLY_MULTI 7152 2.44 2.08 2.60 83 BOTNET 6995 8.35 21.55 2.54 84 TR_XM_SpammyWords2 6981 6.80 16.49 2.54 85 RCVD_IN_IADB_VOUCHED 6899 2.00 0.86 2.51 86 TR_Symld_Words 6869 2.15 1.36 2.50 87 DKIM_INVALID 6743 2.76 3.46 2.45 88 T_FONT_INVIS_NAKED_TO 6665 2.68 3.26 2.42 89 BOUNCE_MESSAGE 6648 4.07 7.82 2.42 90 ANY_BOUNCE_MESSAGE 6648 4.07 7.82 2.42 91 TO_MALFORMED 6548 1.65 0.00 2.38 92 XM_PDF 6515 1.77 0.40 2.37 93 UNTRUSTED_Relay 6349 6.10 14.71 2.31 94 HELO_MISC_IP 6300 1.74 0.48 2.29 95 CK_HELO_DYNAMIC_SPLIT_IP 6299 1.74 0.49 2.29 96 URI_TRY_3LD 6234 2.45 2.86 2.27 97 XM_B_SpammyTLD 6115 2.74 3.92 2.22 98 XMDiploma_00 6089 2.18 2.10 2.21 99 MIME_HTML_MOSTLY 6077 3.68 7.03 2.21 100 TR_XM_PhishingBody 6050 2.59 3.49 2.20 101 T_XMDrugObfuBody_08 5869 2.62 3.74 2.13 102 XM_ProductURIs 5808 1.73 0.87 2.11 103 URI_NOVOWEL 5716 1.72 0.91 2.08 104 HTML_MIME_NO_HTML_TAG 5657 2.33 2.94 2.06 105 HTML_IMAGE_RATIO_08 5646 2.15 2.36 2.05 106 RCVD_IN_MSPIKE_H5 5566 1.58 0.57 2.02 107 XM_CamelCaseFrm001 5378 1.91 1.81 1.96 108 MAILING_LIST_MULTI 5360 1.65 0.97 1.95 109 BAYES_05 5260 1.57 0.81 1.91 110 XM_B_Unsub2 5107 1.68 1.27 1.86 111 RELAYCOUNTRY_CA 5072 3.64 7.72 1.84 112 IN_HORDE_ADDRESS_BOOK 5065 1.29 0.03 1.84 113 XMBSHREFv2 5019 1.31 0.14 1.82 114 USER_IN_DEF_DKIM_WL 4966 1.26 0.00 1.81 115 XMSexyCombo_01 4930 1.75 1.67 1.79 116 XMStockSpam_06 4652 1.55 1.22 1.69 117 XMGappySubj_01 4565 1.32 0.56 1.66 118 TR_XM_SB_Phish 4497 1.52 1.26 1.64 119 XM_OfRef6 4480 3.59 8.05 1.63 120 RCVD_IN_IADB_OPTIN 4433 1.31 0.63 1.61 121 XMSubPhish11 4427 1.50 1.24 1.61 122 T_TooManySym_03 4402 1.16 0.17 1.60 123 RCVD_IN_BL_SPAMCOP_NET 4352 3.03 6.32 1.58 124 XMBrknScrpt_02 4298 3.39 7.54 1.56 125 XM_DK_Undo_01 4193 1.29 0.76 1.52 126 XMGenDplmaNmb 4160 1.47 1.38 1.51 127 T_XMDrugObfuBody_00 3977 1.44 1.43 1.45 128 LH_URI_DOM_IN_PATH 3972 1.71 2.31 1.44 129 T_XMDrugObfuBody_14 3955 1.34 1.11 1.44 130 URI_HEX 3951 2.30 4.25 1.44 131 SUBJ_ALL_CAPS 3865 1.71 2.41 1.41 132 XM_SPF_SoftFail 3788 2.22 4.15 1.38 133 TM2_M_VERY_LONG_WORD 3636 1.43 1.69 1.32 134 TooManyTo_002 3618 1.03 0.38 1.32 135 KHOP_HELO_FCRDNS 3429 1.57 2.30 1.25 136 XMBody_17 3265 3.26 7.96 1.19 137 XM_B_COVIDMETA 3261 1.94 3.64 1.19 138 XMSexyCombo_04 3215 1.14 1.07 1.17 139 XM_GoogleGroups 3138 0.90 0.35 1.14 140 XM_H_Long_From02 3095 1.02 0.78 1.13 141 TR_MSPIKEBAYES00 2987 0.76 0.02 1.09 142 TR_MetaPhish_Combo_01 2927 0.95 0.70 1.06 143 XMBody_95 2921 0.76 0.09 1.06 144 XM_UB50 2830 2.32 5.25 1.03 145 XMSolicitRefs_0 2795 0.79 0.26 1.02 146 XMBdyGiftCard01 2721 1.33 2.09 0.99 147 DKIM_ADSP_NXDOMAIN 2690 1.01 1.07 0.98 148 XM_RXBody 2689 0.75 0.25 0.98 149 TooManyTo_003 2637 0.74 0.24 0.96 150 XM_B_Phish66 2625 1.13 1.52 0.95 151 NO_DNS_FOR_FROM 2581 0.89 0.79 0.94 152 RCVD_IN_MSPIKE_BL 2459 5.15 14.83 0.89 153 T_MONEY_PERCENT 2426 0.83 0.72 0.88 154 TR_LOTS_OF_MONEY2 2426 0.83 0.72 0.88 155 DKIM_ADSP_CUSTOM_MED 2417 1.19 1.89 0.88 156 T_TooManySym_04 2403 0.62 0.05 0.87 157 XM_B_REG_HTML 2315 0.72 0.46 0.84 158 XMHTMLBadTable_001 2227 0.76 0.66 0.81 159 XM_S_SubURI 2221 0.58 0.05 0.81 160 T_FILL_THIS_FORM_SHORT 2168 1.20 2.13 0.79 161 FROM_GOV_DKIM_AU 2133 0.55 0.04 0.78 162 RDNS_DYNAMIC 2101 0.85 1.03 0.76 163 T_PDS_OTHER_BAD_TLD 2079 1.01 1.59 0.76 164 XMNoVowels 2017 0.60 0.31 0.73 165 TooManyTo_004 2010 0.57 0.21 0.73 166 USER_IN_WHITELIST 2010 0.51 0.00 0.73 167 USER_IN_WELCOMELIST 2010 0.51 0.00 0.73 168 TR_LOTS_OF_MONEY3 1979 1.40 2.93 0.72 169 T_LONG_INVISIBLE_TEXT 1967 1.00 1.63 0.72 170 HTML_TAG_BALANCE_BODY 1950 0.63 0.45 0.71 171 T_MANY_PILL_PRICE 1919 0.49 0.03 0.70 172 T_TooManySym_05 1912 0.49 0.02 0.70 173 XM_DIRTYINTL 1863 1.67 3.93 0.68 174 SpammyFromTLD_01 1862 1.95 4.83 0.68 175 HTML_FONT_FACE_BAD 1838 0.65 0.60 0.67 176 RELAYCOUNTRY_GB 1782 0.94 1.59 0.65 177 T_Symld_Words_02 1764 1.00 1.81 0.64 178 XMBody_78 1749 0.65 0.69 0.64 179 XM_USANA_RCVD 1735 0.44 0.00 0.63 180 NML_ADSP_CUSTOM_MED 1671 0.97 1.80 0.61 181 XM_B_SpammyWords4 1658 0.72 1.00 0.60 182 XMSubMetaSxObfu_03 1647 0.65 0.75 0.60 183 RCVD_IN_MSPIKE_L3 1636 1.79 4.50 0.59 184 XM_ShortIntro_01 1622 0.51 0.32 0.59 185 HELO_NODOT 1550 0.50 0.36 0.56 186 HELO_NO_DOMAIN 1549 0.50 0.36 0.56 187 SUBJ_DOLLARS 1531 0.67 0.94 0.56 188 TR_XM_UnparsRelay 1530 1.15 2.50 0.56 189 TooManyTo_005 1530 0.43 0.16 0.56 190 XMSubMetaSxObfu_02 1507 0.45 0.23 0.55 191 TR_XM_SpammyWords3 1486 3.68 10.81 0.54 192 NUMERIC_HTTP_ADDR 1450 0.49 0.39 0.53 193 XMHTML_After_End 1438 0.75 1.25 0.52 194 XM_B_COPY_HTML 1407 0.54 0.59 0.51 195 XM_H_PHPMailer 1406 0.53 0.57 0.51 196 ACT_NOW_CAPS 1400 0.39 0.11 0.51 197 TR_BOTNET_NEGATE 1365 0.61 0.85 0.50 198 PLING_QUERY 1355 0.61 0.87 0.49 199 TR_XM_PHPDW 1339 0.81 1.53 0.49 200 HTTPS_HTTP_MISMATCH 1304 0.51 0.58 0.47 ----------------------------------------------------------------------