Email: 410495 Autolearn: 0 AvgScore: 4.26 AvgScanTime: 1.20 sec Spam: 135675 Autolearn: 0 AvgScore: 14.25 AvgScanTime: 1.23 sec Ham: 274820 Autolearn: 0 AvgScore: -0.67 AvgScanTime: 1.18 sec Time Spent Running SA: 136.36 hours Time Spent Processing Spam: 46.17 hours Time Spent Processing Ham: 90.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127159 88.55 93.72 85.99 2 DCC_CHECK 107918 56.95 79.54 45.80 3 DKIM_SIGNED 103866 78.96 76.56 80.15 4 XM_DK_Pass 101814 77.68 75.04 78.98 5 DKIM_VALID 100296 76.34 73.92 77.54 6 XM_B_Unicode 94090 71.93 69.35 73.20 7 RELAYCOUNTRY_US 89617 77.14 66.05 82.61 8 XMListUnsubscribeExists 86984 59.61 64.11 57.39 9 XM_B_SpammyWords 86588 55.17 63.82 50.90 10 DKIM_VALID_AU 77925 59.84 57.44 61.02 11 XM_DK_Undo_02 67966 22.85 50.09 9.40 12 TR_XM_DKIM_Undo 55099 17.68 40.61 6.36 13 BAYES_99 54444 17.73 40.13 6.68 14 XM_B_SpammyWords2 50660 28.19 37.34 23.67 15 XM_B_Unicode3 49844 41.98 36.74 44.56 16 MIME_HTML_ONLY 46799 27.52 34.49 24.08 17 BAYES_999 43677 14.27 32.19 5.42 18 LOC_TINY_FONT_1 43122 30.25 31.78 29.49 19 RELAYCOUNTRY_META 42032 13.18 30.98 4.39 20 HTML_FONT_LOW_CONTRAST 41909 31.44 30.89 31.72 21 TR_DCC_Bayes_99 41347 12.15 30.48 3.11 22 BAYES_50 37120 44.03 27.36 52.26 23 DKIM_VALID_EF 36193 29.22 26.68 30.48 24 UNTRUSTED_Relay 34730 10.00 25.60 2.30 25 RCVD_IN_MSPIKE_H2 33194 26.96 24.47 28.19 26 XMSubLong 29873 22.33 22.02 22.49 27 T_KAM_HTML_FONT_INVALID 29833 19.00 21.99 17.52 28 FVGT_m_MULTI_ODD 29754 22.59 21.93 22.92 29 FSL_BULK_SIG 28182 10.67 20.77 5.68 30 BOTNET 26805 7.63 19.76 1.65 31 DCC_CHECK_NEGATIVE 25994 41.85 19.16 53.05 32 T_TM2_M_HEADER_IN_MSG 25486 20.46 18.78 21.29 33 RCVD_IN_MSPIKE_WL 24577 25.38 18.11 28.96 34 TR_XM_SpammyWords2 23069 6.49 17.00 1.30 35 XM_Multi_Part_URI 21562 14.80 15.89 14.26 36 XM_B_Unsub 20345 12.23 15.00 10.86 37 XM_Body_Dirty_Words 20094 14.47 14.81 14.30 38 HTML_SHORT_LINK_IMG_1 18173 4.62 13.39 0.28 39 LOTS_OF_MONEY 16637 9.58 12.26 8.25 40 XM_UncommonTLD01 16320 6.58 12.03 3.88 41 XMSexyCombo_05 16141 7.13 11.90 4.78 42 XM_B_SpammyWords3 16106 7.74 11.87 5.70 43 T_REMOTE_IMAGE 16010 6.30 11.80 3.58 44 BOTNET_IPINHOSTNAME 14658 7.26 10.80 5.51 45 BAYES_60 14312 9.65 10.55 9.20 46 XMSubMetaSx_00 13624 6.52 10.04 4.78 47 MPART_ALT_DIFF 13213 6.69 9.74 5.18 48 RCVD_IN_MSPIKE_H3 13066 13.99 9.63 16.14 49 BODY_URI_ONLY 13035 3.37 9.61 0.29 50 BAYES_80 12896 6.91 9.51 5.62 51 HTML_IMAGE_ONLY_12 12395 3.30 9.14 0.42 52 KHOP_HELO_FCRDNS 12395 3.73 9.14 1.06 53 LotsOfNums_01 12192 8.85 8.99 8.78 54 RCVD_IN_MSPIKE_BL 12138 3.46 8.95 0.75 55 XM_Evil_Numbers_Gen 12067 9.39 8.89 9.63 56 MIME_HTML_MOSTLY 11667 4.71 8.60 2.79 57 HTML_IMAGE_RATIO_02 11334 7.98 8.35 7.80 58 XMNumbers 11096 5.32 8.18 3.91 59 RCVD_IN_BL_SPAMCOP_NET 10882 3.67 8.02 1.52 60 RCVD_IN_MSPIKE_H4 10672 9.66 7.87 10.55 61 XM_UB50 9560 3.03 7.05 1.05 62 HTML_IMAGE_RATIO_04 9516 6.18 7.01 5.77 63 XM_UB60 9486 2.45 6.99 0.20 64 XM_B_Phish_Phrases 9095 7.29 6.70 7.58 65 RELAYCOUNTRY_CA 8743 3.33 6.44 1.80 66 SpammyFromTLD_01 8413 2.50 6.20 0.67 67 RCVD_IN_RP_SAFE 8217 9.47 6.06 11.15 68 XM_H_Long_From01 7906 5.46 5.83 5.28 69 RCVD_IN_MSPIKE_L3 7720 2.29 5.69 0.61 70 URIBL_SBL_A 7449 1.93 5.49 0.18 71 TR_XM_SpammyWords3 7363 2.14 5.43 0.52 72 RCVD_IN_RP_CERTIFIED 6987 8.37 5.15 9.96 73 UNPARSEABLE_RELAY 6877 8.26 5.07 9.84 74 TooManyTo_001 6796 5.83 5.01 6.24 75 BAYES_95 6749 4.05 4.97 3.59 76 BOTNET_NORDNS 6735 1.65 4.96 0.01 77 HTML_MIME_NO_HTML_TAG 6598 2.71 4.86 1.65 78 HTML_IMAGE_ONLY_08 6120 1.59 4.51 0.15 79 XMBody_17 6096 2.06 4.49 0.86 80 DKIM_ADSP_NXDOMAIN 5982 2.03 4.41 0.86 81 RELAYCOUNTRY_FR 5884 1.56 4.34 0.19 82 SUBJ_ALL_CAPS 5759 2.50 4.24 1.64 83 XM_UB80 5699 1.41 4.20 0.03 84 RELAYCOUNTRY_UA 5679 1.51 4.19 0.18 85 HDRS_MISSP 5566 1.45 4.10 0.14 86 XM_OfRef6 5533 2.22 4.08 1.31 87 TR_XM_PhishingBody 5371 3.15 3.96 2.76 88 SpammyFromTLD_02 5281 1.39 3.89 0.16 89 XM_UB99 5275 1.29 3.89 0.00 90 URI_PHP_REDIR 5256 1.28 3.87 0.00 91 INVALID_DATE 5178 1.29 3.82 0.04 92 XMBrknScrpt_02 5118 1.88 3.77 0.94 93 LOCALPART_IN_SUBJECT 5056 1.25 3.73 0.03 94 HDRS_LCASE_IMGONLY 5053 1.24 3.72 0.01 95 BOGUS_MIME_VERSION 5047 1.23 3.72 0.00 96 TO_NAME_SUBJ_NO_RDNS 5043 1.23 3.72 0.00 97 RCVD_DOTEDU_SHORT 5037 1.24 3.71 0.02 98 XM_SendGrid 5014 7.15 3.70 8.86 99 HTML_FONT_SIZE_LARGE 4824 1.26 3.56 0.12 100 HTML_IMAGE_RATIO_08 4727 2.78 3.48 2.43 101 URI_NOVOWEL 4724 2.75 3.48 2.39 102 XMStrtUSub 4723 5.09 3.48 5.89 103 T_FILL_THIS_FORM_SHORT 4617 1.67 3.40 0.81 104 T_FONT_INVIS_NAKED_TO 4532 2.72 3.34 2.41 105 RCVD_IN_RP_RNBL 4418 1.20 3.26 0.18 106 URI_HEX 4360 1.90 3.21 1.26 107 TR_XM_MaxSPIKE 4200 1.04 3.10 0.02 108 RELAYCOUNTRY_NL 4025 1.19 2.97 0.32 109 XM_B_SpammyTLD 3859 2.47 2.84 2.28 110 T_XMHurry_00 3850 1.34 2.84 0.60 111 FROM_EXCESS_BASE64 3837 3.48 2.83 3.80 112 TR_XM_MaxBayes 3798 0.94 2.80 0.02 113 XM_BadFromFormat 3795 1.14 2.80 0.32 114 RCVD_IN_MSPIKE_L5 3793 0.99 2.80 0.10 115 XM_SPF_SoftFail 3724 1.63 2.74 1.08 116 XM_UB999 3642 0.89 2.68 0.00 117 TR_LOTS_OF_MONEY3 3634 1.32 2.68 0.65 118 DKIM_INVALID 3570 2.62 2.63 2.61 119 TM2_M_URI_OPT_OUT 3348 3.41 2.47 3.87 120 HTML_IMAGE_RATIO_06 3337 3.21 2.46 3.58 121 TR_XM_DK_SendGrid 3275 4.49 2.41 5.51 122 RELAYCOUNTRY_IN 3136 0.81 2.31 0.07 123 TR_XM_UnparsRelay 3120 1.11 2.30 0.52 124 TR_XM_SB_Phish 3116 1.91 2.30 1.72 125 XMSubPhish11 3051 1.89 2.25 1.71 126 RELAYCOUNTRY_DE 2977 0.95 2.19 0.33 127 XMDiploma_00 2961 1.68 2.18 1.44 128 XM_B_Phish66 2938 1.50 2.17 1.17 129 XM_DIRTYINTL 2930 1.05 2.16 0.50 130 T_TooManySym_01 2887 5.38 2.13 6.98 131 TM2_M_VERY_LONG_WORD 2812 1.55 2.07 1.30 132 RCVD_IN_PSBL 2787 0.70 2.05 0.02 133 XM_OfRef7 2776 0.72 2.05 0.07 134 BAYES_20 2773 2.65 2.04 2.96 135 T_XMDrugObfuBody_08 2680 1.65 1.98 1.48 136 BAYES_40 2637 3.39 1.94 4.10 137 URI_TRY_3LD 2634 1.68 1.94 1.55 138 T_XMDrugObfuBody_00 2634 1.08 1.94 0.65 139 MIME_HTML_ONLY_MULTI 2604 2.82 1.92 3.27 140 XM_CamelCaseFrm001 2547 1.96 1.88 2.00 141 LH_URI_DOM_IN_PATH 2545 2.04 1.88 2.12 142 BAYES_05 2497 1.88 1.84 1.90 143 XMSexyCombo_01 2392 1.15 1.76 0.85 144 XM_B_Unsub2 2343 1.40 1.73 1.24 145 RCVD_IN_IADB_LISTED 2272 3.67 1.67 4.66 146 TR_XM_PHPDW 2264 0.79 1.67 0.35 147 XM_UB95 2262 0.56 1.67 0.01 148 BAYES_00 2242 9.71 1.65 13.69 149 MONEY_FRAUD_8 2232 0.55 1.65 0.00 150 TR_XM_PHPForged 2231 0.76 1.64 0.33 151 TR_XM_FormFill2 2224 0.76 1.64 0.32 152 XM_H_PHPOS 2222 0.75 1.64 0.32 153 SHORT_URI 2201 0.54 1.62 0.01 154 TO_EQ_FM_DIRECT_MX 2194 0.54 1.62 0.01 155 FORM_FRAUD_5 2185 0.53 1.61 0.00 156 MONEY_FORM_SHORT 2153 0.53 1.59 0.00 157 DEAR_BENEFICIARY 2151 0.53 1.59 0.00 158 TVD_SPACE_RATIO 2146 0.77 1.58 0.37 159 T_FILL_THIS_FORM_FRAUD_PHISH 2127 0.55 1.57 0.05 160 FVGT_m_MULTI_ODD_EMAIL 2120 0.55 1.56 0.05 161 XMBdyGiftCard01 2119 1.39 1.56 1.31 162 XM_B_COVIDMETA 2115 1.18 1.56 1.00 163 XMSlimDrugH 2100 0.71 1.55 0.30 164 UPPERCASE_75_100 2095 0.53 1.54 0.03 165 UNCLAIMED_MONEY 2088 0.51 1.54 0.00 166 T_XMDrugObfuBody_14 2070 1.66 1.53 1.73 167 XMMoneyMeta_00 2030 0.70 1.50 0.31 168 XM_B_SpammyWords4 2008 0.87 1.48 0.57 169 MIME_QP_LONG_LINE 2007 3.38 1.48 4.32 170 RELAYCOUNTRY_GB 1904 0.78 1.40 0.47 171 TR_XM_COVIDMETA4 1864 0.66 1.37 0.30 172 TVD_SPACE_RATIO_MINFP 1827 0.45 1.35 0.01 173 RCVD_IN_IADB_SPF 1795 3.15 1.32 4.05 174 XMGenDplmaNmb 1794 0.97 1.32 0.79 175 MIME_CHARSET_FARAWAY 1792 0.47 1.32 0.06 176 PDS_OTHER_BAD_TLD 1781 0.97 1.31 0.79 177 DATE_IN_PAST_06_12 1772 0.60 1.31 0.25 178 TR_Caps_n_Bayes_99 1760 0.54 1.30 0.17 179 XM_DK_Undo_01 1750 1.42 1.29 1.48 180 TR_Mismatch_TLD_01 1704 0.64 1.26 0.34 181 CHARSET_FARAWAY_HEADER 1665 0.41 1.23 0.01 182 HK_RANDOM_FROM 1664 0.47 1.23 0.09 183 URI_NO_WWW_BIZ_CGI 1633 0.40 1.20 0.00 184 RCVD_IN_IADB_SENDERID 1578 2.81 1.16 3.63 185 XMBody_78 1571 0.66 1.16 0.41 186 TR_XM_FormFill 1565 0.39 1.15 0.01 187 RCVD_IN_IADB_DK 1551 2.72 1.14 3.51 188 XM_SPF_Unknown 1549 0.57 1.14 0.29 189 FROM_SUSPICIOUS_NTLD 1537 0.46 1.13 0.13 190 XMSubNoVowel 1537 0.80 1.13 0.64 191 XMStockSpam_06 1533 1.00 1.13 0.94 192 SUBJ_BUY 1530 0.42 1.13 0.06 193 RDNS_DYNAMIC 1505 0.88 1.11 0.77 194 RELAYCOUNTRY_TR 1494 0.42 1.10 0.08 195 XMSubMetaD_00 1487 0.42 1.10 0.08 196 XMSubMetaD_03 1481 0.37 1.09 0.02 197 TR_Symld_Words 1475 2.69 1.09 3.48 198 XM_URI_RBL 1469 0.51 1.08 0.22 199 DATE_IN_PAST_03_06 1466 0.42 1.08 0.09 200 RCVD_IN_IADB_VOUCHED 1454 2.23 1.07 2.81 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 236329 88.55 93.72 85.99 2 RELAYCOUNTRY_US 227041 77.14 66.05 82.61 3 DKIM_SIGNED 220261 78.96 76.56 80.15 4 XM_DK_Pass 217056 77.68 75.04 78.98 5 DKIM_VALID 213086 76.34 73.92 77.54 6 XM_B_Unicode 201168 71.93 69.35 73.20 7 DKIM_VALID_AU 167699 59.84 57.44 61.02 8 XMListUnsubscribeExists 157720 59.61 64.11 57.39 9 DCC_CHECK_NEGATIVE 145790 41.85 19.16 53.05 10 BAYES_50 143615 44.03 27.36 52.26 11 XM_B_SpammyWords 139890 55.17 63.82 50.90 12 DCC_CHECK 125871 56.95 79.54 45.80 13 XM_B_Unicode3 122466 41.98 36.74 44.56 14 HTML_FONT_LOW_CONTRAST 87171 31.44 30.89 31.72 15 DKIM_VALID_EF 83770 29.22 26.68 30.48 16 LOC_TINY_FONT_1 81040 30.25 31.78 29.49 17 RCVD_IN_MSPIKE_WL 79598 25.38 18.11 28.96 18 RCVD_IN_MSPIKE_H2 77468 26.96 24.47 28.19 19 MIME_HTML_ONLY 66172 27.52 34.49 24.08 20 XM_B_SpammyWords2 65063 28.19 37.34 23.67 21 FVGT_m_MULTI_ODD 62979 22.59 21.93 22.92 22 XMSubLong 61798 22.33 22.02 22.49 23 T_TM2_M_HEADER_IN_MSG 58501 20.46 18.78 21.29 24 T_KAM_HTML_FONT_INVALID 48159 19.00 21.99 17.52 25 RCVD_IN_MSPIKE_H3 44344 13.99 9.63 16.14 26 XM_Body_Dirty_Words 39300 14.47 14.81 14.30 27 XM_Multi_Part_URI 39178 14.80 15.89 14.26 28 BAYES_00 37627 9.71 1.65 13.69 29 ALL_TRUSTED 36165 9.09 0.83 13.16 30 XM_DKIMWhitelistDomains 31013 7.56 0.02 11.28 31 RCVD_IN_RP_SAFE 30641 9.47 6.06 11.15 32 XM_B_Unsub 29846 12.23 15.00 10.86 33 RCVD_IN_MSPIKE_H4 28986 9.66 7.87 10.55 34 TR_XM_DK_Bayes 28149 7.13 0.81 10.24 35 TR_XM_DK_Bayes1 27739 7.02 0.80 10.09 36 RCVD_IN_RP_CERTIFIED 27368 8.37 5.15 9.96 37 UNPARSEABLE_RELAY 27032 8.26 5.07 9.84 38 XM_Evil_Numbers_Gen 26463 9.39 8.89 9.63 39 XM_DK_Undo_02 25840 22.85 50.09 9.40 40 TR_XM_DK_Bayes2 25786 6.52 0.73 9.38 41 BAYES_60 25288 9.65 10.55 9.20 42 XM_SendGrid 24342 7.15 3.70 8.86 43 LotsOfNums_01 24123 8.85 8.99 8.78 44 LOTS_OF_MONEY 22670 9.58 12.26 8.25 45 HTML_IMAGE_RATIO_02 21427 7.98 8.35 7.80 46 XM_B_Phish_Phrases 20836 7.29 6.70 7.58 47 T_TooManySym_01 19182 5.38 2.13 6.98 48 BAYES_99 18348 17.73 40.13 6.68 49 TR_XM_DKIM_Undo 17469 17.68 40.61 6.36 50 TooManyTo_001 17142 5.83 5.01 6.24 51 XMStrtUSub 16177 5.09 3.48 5.89 52 HTML_IMAGE_RATIO_04 15855 6.18 7.01 5.77 53 XM_B_SpammyWords3 15652 7.74 11.87 5.70 54 FSL_BULK_SIG 15616 10.67 20.77 5.68 55 BAYES_80 15456 6.91 9.51 5.62 56 BOTNET_IPINHOSTNAME 15153 7.26 10.80 5.51 57 TR_XM_DK_SendGrid 15138 4.49 2.41 5.51 58 BAYES_999 14894 14.27 32.19 5.42 59 XM_H_Long_From01 14502 5.46 5.83 5.28 60 MPART_ALT_DIFF 14247 6.69 9.74 5.18 61 IN_ZIMBRA_NJ_WHITELIST 13483 3.30 0.04 4.91 62 XMSexyCombo_05 13136 7.13 11.90 4.78 63 XMSubMetaSx_00 13123 6.52 10.04 4.78 64 RCVD_IN_IADB_LISTED 12802 3.67 1.67 4.66 65 T_TooManySym_02 12319 3.14 0.43 4.48 66 RELAYCOUNTRY_META 12075 13.18 30.98 4.39 67 MIME_QP_LONG_LINE 11880 3.38 1.48 4.32 68 BAYES_40 11274 3.39 1.94 4.10 69 RCVD_IN_IADB_SPF 11135 3.15 1.32 4.05 70 XMNumbers 10733 5.32 8.18 3.91 71 XM_UncommonTLD01 10671 6.58 12.03 3.88 72 TM2_M_URI_OPT_OUT 10644 3.41 2.47 3.87 73 FROM_EXCESS_BASE64 10447 3.48 2.83 3.80 74 RCVD_IN_IADB_SENDERID 9963 2.81 1.16 3.63 75 BAYES_95 9862 4.05 4.97 3.59 76 T_REMOTE_IMAGE 9840 6.30 11.80 3.58 77 HTML_IMAGE_RATIO_06 9830 3.21 2.46 3.58 78 RCVD_IN_IADB_DK 9633 2.72 1.14 3.51 79 TR_Symld_Words 9570 2.69 1.09 3.48 80 MIME_HTML_ONLY_MULTI 8973 2.82 1.92 3.27 81 TR_DCC_Bayes_99 8546 12.15 30.48 3.11 82 BAYES_20 8121 2.65 2.04 2.96 83 RCVD_IN_IADB_VOUCHED 7719 2.23 1.07 2.81 84 MIME_HTML_MOSTLY 7658 4.71 8.60 2.79 85 TR_XM_PhishingBody 7576 3.15 3.96 2.76 86 DKIM_INVALID 7175 2.62 2.63 2.61 87 INVALID_MSGID 6879 1.87 0.58 2.50 88 TVD_RCVD_IP 6781 1.76 0.32 2.47 89 HTML_IMAGE_RATIO_08 6681 2.78 3.48 2.43 90 T_FONT_INVIS_NAKED_TO 6626 2.72 3.34 2.41 91 URI_NOVOWEL 6578 2.75 3.48 2.39 92 TO_MALFORMED 6411 1.57 0.03 2.33 93 UNTRUSTED_Relay 6321 10.00 25.60 2.30 94 RCVD_IN_MSPIKE_H5 6268 1.73 0.62 2.28 95 XM_B_SpammyTLD 6264 2.47 2.84 2.28 96 HELO_MISC_IP 6190 1.66 0.47 2.25 97 CK_HELO_DYNAMIC_SPLIT_IP 6186 1.69 0.57 2.25 98 XM_PDF 6002 1.55 0.26 2.18 99 ANY_BOUNCE_MESSAGE 5838 1.50 0.22 2.12 100 BOUNCE_MESSAGE 5837 1.50 0.22 2.12 101 LH_URI_DOM_IN_PATH 5829 2.04 1.88 2.12 102 MAILING_LIST_MULTI 5595 1.59 0.68 2.04 103 XM_H_Trusted_IP 5595 1.36 0.00 2.04 104 XM_CamelCaseFrm001 5494 1.96 1.88 2.00 105 BAYES_05 5229 1.88 1.84 1.90 106 RELAYCOUNTRY_CA 4940 3.33 6.44 1.80 107 XMBSHREFv2 4908 1.25 0.15 1.79 108 RCVD_IN_IADB_OPTIN 4861 1.43 0.74 1.77 109 T_XMDrugObfuBody_14 4763 1.66 1.53 1.73 110 XMGappySubj_01 4746 1.18 0.07 1.73 111 IN_HORDE_ADDRESS_BOOK 4727 1.21 0.19 1.72 112 TR_XM_SB_Phish 4722 1.91 2.30 1.72 113 XMSubPhish11 4695 1.89 2.25 1.71 114 USER_IN_DEF_DKIM_WL 4653 1.16 0.07 1.69 115 BOTNET 4534 7.63 19.76 1.65 116 HTML_MIME_NO_HTML_TAG 4522 2.71 4.86 1.65 117 SUBJ_ALL_CAPS 4509 2.50 4.24 1.64 118 URI_TRY_3LD 4263 1.68 1.94 1.55 119 RCVD_IN_BL_SPAMCOP_NET 4184 3.67 8.02 1.52 120 T_XMDrugObfuBody_08 4081 1.65 1.98 1.48 121 XM_DK_Undo_01 4077 1.42 1.29 1.48 122 XMDiploma_00 3945 1.68 2.18 1.44 123 FORGED_MUA_OUTLOOK 3928 1.00 0.14 1.43 124 HTML_FONT_FACE_BAD 3757 1.17 0.78 1.37 125 T_TooManySym_03 3707 0.95 0.13 1.35 126 XM_OfRef6 3589 2.22 4.08 1.31 127 XMBdyGiftCard01 3588 1.39 1.56 1.31 128 TR_XM_SpammyWords2 3571 6.49 17.00 1.30 129 TM2_M_VERY_LONG_WORD 3566 1.55 2.07 1.30 130 URI_HEX 3458 1.90 3.21 1.26 131 XMBody_95 3406 0.86 0.08 1.24 132 XM_B_Unsub2 3399 1.40 1.73 1.24 133 XM_ProductURIs 3324 1.05 0.72 1.21 134 XM_B_Phish66 3215 1.50 2.17 1.17 135 TooManyTo_002 3150 0.89 0.38 1.15 136 TR_MSPIKEBAYES00 3040 0.76 0.06 1.11 137 XM_GoogleGroups 3015 0.85 0.34 1.10 138 XM_SPF_SoftFail 2966 1.63 2.74 1.08 139 XM_H_Long_From02 2923 0.96 0.74 1.06 140 KHOP_HELO_FCRDNS 2902 3.73 9.14 1.06 141 XM_UB50 2898 3.03 7.05 1.05 142 XM_B_COVIDMETA 2744 1.18 1.56 1.00 143 DKIM_ADSP_CUSTOM_MED 2673 0.93 0.84 0.97 144 XMBrknScrpt_02 2583 1.88 3.77 0.94 145 XMStockSpam_06 2580 1.00 1.13 0.94 146 HTML_TAG_BALANCE_BODY 2426 0.85 0.79 0.88 147 TR_MetaPhish_Combo_01 2419 0.79 0.62 0.88 148 T_TooManySym_04 2396 0.60 0.04 0.87 149 XMBody_17 2368 2.06 4.49 0.86 150 XMHTML_After_End 2363 0.89 0.97 0.86 151 DKIM_ADSP_NXDOMAIN 2359 2.03 4.41 0.86 152 XMSexyCombo_01 2331 1.15 1.76 0.85 153 XM_S_SubURI 2230 0.56 0.04 0.81 154 T_FILL_THIS_FORM_SHORT 2220 1.67 3.40 0.81 155 NO_DNS_FOR_FROM 2195 0.68 0.45 0.80 156 TooManyTo_003 2184 0.63 0.30 0.79 157 XMGenDplmaNmb 2183 0.97 1.32 0.79 158 PDS_OTHER_BAD_TLD 2181 0.97 1.31 0.79 159 RDNS_DYNAMIC 2107 0.88 1.11 0.77 160 XM_D_tchamptons_WL 2099 0.51 0.00 0.76 161 RCVD_IN_MSPIKE_BL 2071 3.46 8.95 0.75 162 T_TooManySym_05 1905 0.46 0.00 0.69 163 XMLngstWrd_00 1897 0.54 0.23 0.69 164 NML_ADSP_CUSTOM_MED 1887 0.73 0.81 0.69 165 XMHTMLBadTable_001 1872 0.66 0.61 0.68 166 USER_IN_WELCOMELIST 1870 0.46 0.00 0.68 167 USER_IN_WHITELIST 1870 0.46 0.00 0.68 168 HELO_NODOT 1868 0.69 0.72 0.68 169 HELO_NO_DOMAIN 1867 0.69 0.72 0.68 170 SpammyFromTLD_01 1834 2.50 6.20 0.67 171 TR_LOTS_OF_MONEY3 1800 1.32 2.68 0.65 172 T_XMDrugObfuBody_00 1793 1.08 1.94 0.65 173 NUMERIC_HTTP_ADDR 1778 0.69 0.79 0.65 174 XMPhish14 1765 0.56 0.39 0.64 175 XMSubNoVowel 1756 0.80 1.13 0.64 176 XMLngstWrd_01 1734 0.49 0.21 0.63 177 XMSubMetaSxObfu_02 1705 0.49 0.23 0.62 178 DIET_1 1704 0.67 0.79 0.62 179 XM_B_REG_HTML 1698 0.59 0.52 0.62 180 RCVD_IN_MSPIKE_L3 1672 2.29 5.69 0.61 181 T_XMHurry_00 1644 1.34 2.84 0.60 182 TooManyTo_004 1617 0.48 0.27 0.59 183 XM_ShortIntro_01 1606 0.56 0.51 0.58 184 XM_B_SpammyWords4 1577 0.87 1.48 0.57 185 XMNoVowels 1562 0.46 0.24 0.57 186 XMPhish08 1545 0.57 0.60 0.56 187 XMLngstWrd_02 1528 0.43 0.18 0.56 188 SUBJ_DOLLARS 1522 0.51 0.43 0.55 189 FORGED_GMAIL_RCVD 1520 0.59 0.66 0.55 190 TM2_M_A_HREF_HREF 1505 0.53 0.51 0.55 191 HTTPS_HTTP_MISMATCH 1492 0.65 0.88 0.54 192 XM_B_COPY_HTML 1476 0.59 0.69 0.54 193 XMSubMetaI_00 1440 0.61 0.79 0.52 194 TR_XM_SpammyWords3 1432 2.14 5.43 0.52 195 TR_XM_UnparsRelay 1422 1.11 2.30 0.52 196 MPART_ALT_DIFF_COUNT 1411 0.64 0.90 0.51 197 HTML_IMAGE_ONLY_20 1399 0.45 0.32 0.51 198 XM_DIRTYINTL 1383 1.05 2.16 0.50 199 XMSolicitRefs_0 1367 0.43 0.28 0.50 200 XMCapTrack 1345 0.38 0.15 0.49 ----------------------------------------------------------------------