Email: 418966 Autolearn: 0 AvgScore: 4.04 AvgScanTime: 1.23 sec Spam: 140748 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.34 sec Ham: 278218 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 1.18 sec Time Spent Running SA: 143.11 hours Time Spent Processing Spam: 52.30 hours Time Spent Processing Ham: 90.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132874 89.02 94.41 86.29 2 DKIM_SIGNED 123759 81.75 87.93 78.62 3 XM_DK_Pass 120054 80.18 85.30 77.58 4 DKIM_VALID 118381 78.92 84.11 76.29 5 XM_B_Unicode 114123 76.05 81.08 73.51 6 DCC_CHECK 110529 58.08 78.53 47.74 7 XMListUnsubscribeExists 109187 62.77 77.58 55.28 8 RELAYCOUNTRY_US 105061 79.49 74.64 81.94 9 XM_B_SpammyWords 103253 59.06 73.36 51.82 10 DKIM_VALID_AU 94440 63.61 67.10 61.84 11 XM_DK_Undo_02 70946 22.74 50.41 8.74 12 XM_B_SpammyWords2 60740 29.77 43.16 23.00 13 HTML_FONT_LOW_CONTRAST 57972 35.33 41.19 32.37 14 TR_XM_DKIM_Undo 56755 18.05 40.32 6.78 15 BAYES_99 55911 17.72 39.72 6.59 16 XM_B_Unicode3 51701 41.59 36.73 44.05 17 LOC_TINY_FONT_1 51242 32.55 36.41 30.60 18 RCVD_IN_MSPIKE_H2 44782 28.63 31.82 27.02 19 BAYES_999 44490 14.17 31.61 5.35 20 BAYES_50 43875 46.57 31.17 54.36 21 TR_DCC_Bayes_99 43346 13.14 30.80 4.20 22 DKIM_VALID_EF 42145 29.98 29.94 30.00 23 MIME_HTML_ONLY 36734 24.63 26.10 23.88 24 RELAYCOUNTRY_META 34701 11.59 24.65 4.98 25 T_TM2_M_HEADER_IN_MSG 31502 22.84 22.38 23.07 26 XM_Multi_Part_URI 30645 16.23 21.77 13.42 27 FVGT_m_MULTI_ODD 30217 22.44 21.47 22.93 28 T_KAM_HTML_FONT_INVALID 28828 18.30 20.48 17.20 29 DCC_CHECK_NEGATIVE 28335 40.70 20.13 51.11 30 XMSubLong 26442 20.15 18.79 20.85 31 XM_Body_Dirty_Words 26023 16.16 18.49 14.98 32 TR_XM_SpammyWords2 24934 7.09 17.72 1.72 33 LOTS_OF_MONEY 24312 10.26 17.27 6.71 34 RCVD_IN_MSPIKE_WL 23558 25.79 16.74 30.38 35 BOTNET 23018 6.63 16.35 1.70 36 UNTRUSTED_Relay 22910 7.25 16.28 2.68 37 XM_B_SpammyWords3 22177 9.46 15.76 6.28 38 TR_XM_SpammyWords4 22176 8.50 15.76 4.83 39 RCVD_IN_MSPIKE_BL 19800 5.28 14.07 0.84 40 BOTNET_IPINHOSTNAME 18595 8.24 13.21 5.73 41 XM_UncommonTLD01 17577 6.87 12.49 4.02 42 LotsOfNums_01 16550 9.04 11.76 7.66 43 XM_B_Unsub 16221 11.03 11.52 10.78 44 RCVD_IN_MSPIKE_L3 14982 4.01 10.64 0.65 45 XMSexyCombo_05 14905 7.21 10.59 5.50 46 MPART_ALT_DIFF 14483 7.55 10.29 6.16 47 TR_XM_SpammyWords3 14324 3.81 10.18 0.59 48 BAYES_80 14146 6.73 10.05 5.06 49 HTML_IMAGE_RATIO_02 14098 8.92 10.02 8.37 50 MIME_HTML_MOSTLY 13653 5.25 9.70 3.00 51 RCVD_IN_MSPIKE_H3 12776 13.92 9.08 16.37 52 XM_Evil_Numbers_Gen 12700 8.67 9.02 8.49 53 RCVD_IN_BL_SPAMCOP_NET 11837 3.32 8.41 0.75 54 BAYES_60 10514 8.23 7.47 8.62 55 XM_UB50 10276 3.23 7.30 1.17 56 FSL_BULK_SIG 10259 6.98 7.29 6.83 57 TR_LOTS_OF_MONEY3 10157 3.00 7.22 0.86 58 RELAYCOUNTRY_CA 10101 3.82 7.18 2.13 59 TooManyTo_001 9720 6.46 6.91 6.23 60 RCVD_IN_MSPIKE_H4 9654 9.96 6.86 11.52 61 XMSubMetaSx_00 9358 4.45 6.65 3.34 62 XMBrknScrpt_02 9237 3.18 6.56 1.46 63 TR_XM_SpammyWords5 9066 3.64 6.44 2.22 64 HTML_IMAGE_RATIO_04 9049 6.83 6.43 7.03 65 BAYES_95 8662 4.19 6.15 3.20 66 XMBody_17 8448 2.75 6.00 1.11 67 RELAYCOUNTRY_FR 8114 2.10 5.76 0.25 68 URIBL_SBL_A 7797 2.04 5.54 0.27 69 XM_B_Phish_Phrases 7582 5.40 5.39 5.41 70 RCVD_IN_RP_SAFE 7475 9.53 5.31 11.67 71 UNPARSEABLE_RELAY 7276 7.80 5.17 9.13 72 XMStrtUSub 7096 6.08 5.04 6.61 73 XM_H_Long_From01 7082 5.23 5.03 5.33 74 SpammyFromTLD_01 6760 2.07 4.80 0.69 75 XM_OfRef6 6616 2.55 4.70 1.46 76 RCVD_IN_RP_CERTIFIED 6435 8.78 4.57 10.91 77 SpammyFromTLD_02 6147 1.57 4.37 0.15 78 TR_XM_MaxSPIKE 6127 1.48 4.35 0.03 79 XMNumbers 5971 4.22 4.24 4.21 80 URI_HEX 5911 2.18 4.20 1.15 81 FROM_EXCESS_BASE64 5863 3.91 4.17 3.77 82 TR_XM_PhishingBody 5819 3.35 4.13 2.96 83 T_FONT_INVIS_NAKED_TO 5754 2.93 4.09 2.35 84 DKIM_INVALID 5378 2.83 3.82 2.33 85 XM_SendGrid 5358 6.76 3.81 8.25 86 XM_DIRTYINTL 5169 1.55 3.67 0.48 87 XM_B_SpammyTLD 4865 2.38 3.46 1.84 88 HTML_IMAGE_RATIO_08 4709 2.77 3.35 2.48 89 RCVD_IN_RP_RNBL 4688 1.17 3.33 0.08 90 SUBJ_ALL_CAPS 4675 2.15 3.32 1.56 91 T_XMDrugObfuBody_08 4535 2.18 3.22 1.65 92 XM_SPF_SoftFail 4313 1.74 3.06 1.06 93 XMDiploma_00 4260 1.93 3.03 1.38 94 XM_UB99 4210 1.01 2.99 0.00 95 URI_PHP_REDIR 4158 1.00 2.95 0.01 96 HTML_MIME_NO_HTML_TAG 4094 2.00 2.91 1.54 97 TR_XM_MaxBayes 4065 0.98 2.89 0.01 98 TM2_M_URI_OPT_OUT 3953 3.86 2.81 4.40 99 URI_TRY_3LD 3832 1.77 2.72 1.29 100 RELAYCOUNTRY_NL 3810 1.03 2.71 0.18 101 T_XMHurry_00 3750 1.40 2.66 0.76 102 RCVD_IN_MSPIKE_L5 3747 0.99 2.66 0.14 103 T_TooManySym_01 3529 5.32 2.51 6.75 104 BAYES_40 3346 3.74 2.38 4.43 105 TR_XM_DK_SendGrid 3330 4.19 2.37 5.11 106 SHORTENED_URL_HREF 3293 1.18 2.34 0.60 107 DKIM_ADSP_NXDOMAIN 3263 1.81 2.32 1.56 108 HTML_IMAGE_RATIO_06 3245 3.60 2.31 4.25 109 XM_B_Phish66 3154 1.47 2.24 1.07 110 XM_UB999 3123 0.75 2.22 0.00 111 T_REMOTE_IMAGE 3030 2.47 2.15 2.64 112 MIME_HTML_ONLY_MULTI 2993 3.52 2.13 4.22 113 XM_DK_Undo_01 2904 1.59 2.06 1.36 114 T_FILL_THIS_FORM_SHORT 2778 1.25 1.97 0.89 115 RCVD_IN_PSBL 2775 0.75 1.97 0.13 116 XM_UB60 2765 0.71 1.96 0.07 117 BOTNET_NORDNS 2757 0.67 1.96 0.02 118 XMSexyCombo_01 2642 0.94 1.88 0.47 119 TR_Mismatch_TLD_01 2608 0.88 1.85 0.39 120 XM_CamelCaseFrm001 2606 1.83 1.85 1.82 121 XM_URI_RBL 2575 0.74 1.83 0.19 122 XM_UB80 2569 0.63 1.83 0.02 123 KHOP_HELO_FCRDNS 2546 1.18 1.81 0.87 124 XM_B_SpammyWords4 2508 1.03 1.78 0.65 125 XMBdyGiftCard01 2500 1.84 1.78 1.87 126 RELAYCOUNTRY_DE 2465 0.85 1.75 0.40 127 TR_XM_PHPDW 2438 0.77 1.73 0.29 128 XMGenDplmaNmb 2421 1.07 1.72 0.74 129 TR_XM_PHPForged 2396 0.72 1.70 0.23 130 TM2_M_VERY_LONG_WORD 2387 1.35 1.70 1.18 131 TR_XM_FormFill2 2380 0.72 1.69 0.23 132 XM_H_PHPOS 2377 0.72 1.69 0.22 133 LH_URI_DOM_IN_PATH 2371 1.48 1.68 1.38 134 URIBL_DBL_ABUSE_REDIR 2364 0.57 1.68 0.00 135 HTML_TAG_BALANCE_BODY 2307 0.86 1.64 0.47 136 T_Symld_Words_02 2289 0.83 1.63 0.43 137 XM_B_Unsub2 2274 1.22 1.62 1.03 138 TR_Symld_Words 2258 1.71 1.60 1.76 139 TR_XM_UnparsRelay 2247 0.84 1.60 0.45 140 XMSubNoVowel 2194 1.72 1.56 1.80 141 TR_XM_COVIDMETA4 2185 0.66 1.55 0.21 142 ALL_TRUSTED 2173 9.27 1.54 13.19 143 BAYES_20 2099 2.60 1.49 3.15 144 TR_Caps_n_Bayes_99 2010 0.66 1.43 0.27 145 TR_XM_SB_Phish 1990 1.57 1.41 1.65 146 DATE_IN_PAST_03_06 1985 0.54 1.41 0.10 147 XMSubPhish11 1975 1.56 1.40 1.64 148 PDS_OTHER_BAD_TLD 1940 0.89 1.38 0.65 149 T_XMDrugObfuBody_14 1909 1.52 1.36 1.61 150 XMStockSpam_06 1888 1.45 1.34 1.51 151 RCVD_IN_IADB_LISTED 1873 2.87 1.33 3.65 152 XMSubMetaI_00 1864 0.87 1.32 0.64 153 XMBody_78 1793 0.76 1.27 0.50 154 HK_RANDOM_REPLYTO 1768 0.57 1.26 0.22 155 TR_XM_INV_DKIM 1766 0.50 1.25 0.11 156 MIME_QP_LONG_LINE 1755 2.83 1.25 3.63 157 SUBJ_DOLLARS 1676 0.77 1.19 0.55 158 XM_Combo_Sbj 1664 0.59 1.18 0.29 159 XMSubMetaSxObfu_03 1662 0.66 1.18 0.40 160 TR_Mismatch_TLD_02 1632 0.47 1.16 0.13 161 URI_NOVOWEL 1622 1.75 1.15 2.06 162 LOW_PRICE 1599 0.94 1.14 0.85 163 RCVD_IN_IADB_SPF 1585 2.51 1.13 3.21 164 T_XMDrugObfuBody_00 1578 0.73 1.12 0.53 165 FROM_SUSPICIOUS_NTLD 1500 0.44 1.07 0.13 166 MIME_CHARSET_FARAWAY 1475 0.42 1.05 0.10 167 HTML_IMAGE_ONLY_16 1474 0.46 1.05 0.17 168 FROM_SUSPICIOUS_NTLD_FP 1444 0.43 1.03 0.12 169 XM_B_COVIDMETA 1443 1.07 1.03 1.10 170 XM_TLDProd2 1435 0.48 1.02 0.20 171 RCVD_IN_IADB_SENDERID 1429 2.24 1.02 2.86 172 RCVD_IN_IADB_DK 1423 2.16 1.01 2.75 173 XM_UB95 1403 0.34 1.00 0.01 174 MAILING_LIST_MULTI 1395 1.55 0.99 1.83 175 TR_XM_FormFill 1388 0.34 0.99 0.01 176 TR_XM_RelayPhish 1332 0.38 0.95 0.09 177 XMSexyCombo_04 1319 0.43 0.94 0.18 178 RDNS_DYNAMIC 1278 0.77 0.91 0.70 179 REMOVE_BEFORE_LINK 1263 0.41 0.90 0.16 180 XM_ProductURIs 1257 0.89 0.89 0.89 181 CHARSET_FARAWAY_HEADER 1249 0.33 0.89 0.05 182 RELAYCOUNTRY_GB 1196 0.70 0.85 0.63 183 RELAYCOUNTRY_JP 1189 0.30 0.84 0.03 184 FROM_MISSP_REPLYTO 1186 0.29 0.84 0.01 185 XMPhish30 1168 0.84 0.83 0.84 186 XM_ShortIntro_01 1137 0.72 0.81 0.68 187 XMHTML_After_End 1128 0.75 0.80 0.72 188 RCVD_IN_MSPIKE_H5 1128 1.92 0.80 2.49 189 INVESTMENT_ADVICE 1123 0.33 0.80 0.09 190 BAYES_05 1116 1.67 0.79 2.12 191 BOUNCE_MESSAGE 1111 1.80 0.79 2.31 192 ANY_BOUNCE_MESSAGE 1111 1.80 0.79 2.31 193 BAYES_00 1079 8.54 0.77 12.47 194 DKIM_ADSP_CUSTOM_MED 1075 0.97 0.76 1.07 195 LOADSA_MONEY_COMBO 1053 0.27 0.75 0.02 196 URI_NO_WWW_BIZ_CGI 1051 0.25 0.75 0.00 197 SUSP_UTF8_WORD_SUBJ 1047 0.30 0.74 0.08 198 REPLYTO_WITHOUT_TO_CC 1044 0.27 0.74 0.04 199 TVD_SPACE_RATIO_MINFP 1041 0.25 0.74 0.01 200 HTML_SHORT_LINK_IMG_2 1034 0.26 0.73 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 240069 89.02 94.41 86.29 2 RELAYCOUNTRY_US 227982 79.49 74.64 81.94 3 DKIM_SIGNED 218734 81.75 87.93 78.62 4 XM_DK_Pass 215855 80.18 85.30 77.58 5 DKIM_VALID 212255 78.92 84.11 76.29 6 XM_B_Unicode 204511 76.05 81.08 73.51 7 DKIM_VALID_AU 172054 63.61 67.10 61.84 8 XMListUnsubscribeExists 153804 62.77 77.58 55.28 9 BAYES_50 151228 46.57 31.17 54.36 10 XM_B_SpammyWords 144175 59.06 73.36 51.82 11 DCC_CHECK_NEGATIVE 142201 40.70 20.13 51.11 12 DCC_CHECK 132824 58.08 78.53 47.74 13 XM_B_Unicode3 122559 41.59 36.73 44.05 14 HTML_FONT_LOW_CONTRAST 90064 35.33 41.19 32.37 15 LOC_TINY_FONT_1 85140 32.55 36.41 30.60 16 RCVD_IN_MSPIKE_WL 84509 25.79 16.74 30.38 17 DKIM_VALID_EF 83466 29.98 29.94 30.00 18 RCVD_IN_MSPIKE_H2 75163 28.63 31.82 27.02 19 MIME_HTML_ONLY 66437 24.63 26.10 23.88 20 T_TM2_M_HEADER_IN_MSG 64174 22.84 22.38 23.07 21 XM_B_SpammyWords2 64003 29.77 43.16 23.00 22 FVGT_m_MULTI_ODD 63790 22.44 21.47 22.93 23 XMSubLong 57999 20.15 18.79 20.85 24 T_KAM_HTML_FONT_INVALID 47853 18.30 20.48 17.20 25 RCVD_IN_MSPIKE_H3 45534 13.92 9.08 16.37 26 XM_Body_Dirty_Words 41684 16.16 18.49 14.98 27 XM_Multi_Part_URI 37337 16.23 21.77 13.42 28 ALL_TRUSTED 36686 9.27 1.54 13.19 29 BAYES_00 34698 8.54 0.77 12.47 30 XM_DKIMWhitelistDomains 33192 7.94 0.04 11.93 31 RCVD_IN_RP_SAFE 32464 9.53 5.31 11.67 32 RCVD_IN_MSPIKE_H4 32061 9.96 6.86 11.52 33 RCVD_IN_RP_CERTIFIED 30355 8.78 4.57 10.91 34 XM_B_Unsub 29987 11.03 11.52 10.78 35 UNPARSEABLE_RELAY 25410 7.80 5.17 9.13 36 TR_XM_DK_Bayes 24344 6.00 0.56 8.75 37 XM_DK_Undo_02 24330 22.74 50.41 8.74 38 BAYES_60 23975 8.23 7.47 8.62 39 TR_XM_DK_Bayes1 23867 5.88 0.55 8.58 40 XM_Evil_Numbers_Gen 23609 8.67 9.02 8.49 41 HTML_IMAGE_RATIO_02 23290 8.92 10.02 8.37 42 XM_SendGrid 22958 6.76 3.81 8.25 43 TR_XM_DK_Bayes2 22273 5.48 0.50 8.01 44 LotsOfNums_01 21305 9.04 11.76 7.66 45 HTML_IMAGE_RATIO_04 19561 6.83 6.43 7.03 46 FSL_BULK_SIG 18997 6.98 7.29 6.83 47 TR_XM_DKIM_Undo 18877 18.05 40.32 6.78 48 T_TooManySym_01 18780 5.32 2.51 6.75 49 LOTS_OF_MONEY 18656 10.26 17.27 6.71 50 XMStrtUSub 18392 6.08 5.04 6.61 51 BAYES_99 18347 17.72 39.72 6.59 52 XM_B_SpammyWords3 17478 9.46 15.76 6.28 53 TooManyTo_001 17342 6.46 6.91 6.23 54 MPART_ALT_DIFF 17142 7.55 10.29 6.16 55 BOTNET_IPINHOSTNAME 15930 8.24 13.21 5.73 56 XMSexyCombo_05 15289 7.21 10.59 5.50 57 XM_B_Phish_Phrases 15059 5.40 5.39 5.41 58 BAYES_999 14888 14.17 31.61 5.35 59 XM_H_Long_From01 14825 5.23 5.03 5.33 60 TR_XM_DK_SendGrid 14229 4.19 2.37 5.11 61 BAYES_80 14071 6.73 10.05 5.06 62 RELAYCOUNTRY_META 13849 11.59 24.65 4.98 63 TR_XM_SpammyWords4 13442 8.50 15.76 4.83 64 IN_ZIMBRA_NJ_WHITELIST 13333 3.20 0.04 4.79 65 BAYES_40 12315 3.74 2.38 4.43 66 TM2_M_URI_OPT_OUT 12237 3.86 2.81 4.40 67 HTML_IMAGE_RATIO_06 11819 3.60 2.31 4.25 68 MIME_HTML_ONLY_MULTI 11739 3.52 2.13 4.22 69 XMNumbers 11713 4.22 4.24 4.21 70 TR_DCC_Bayes_99 11694 13.14 30.80 4.20 71 XM_UncommonTLD01 11190 6.87 12.49 4.02 72 XM_H_Trusted_IP 10955 2.61 0.00 3.94 73 FROM_EXCESS_BASE64 10501 3.91 4.17 3.77 74 RCVD_IN_IADB_LISTED 10160 2.87 1.33 3.65 75 MIME_QP_LONG_LINE 10103 2.83 1.25 3.63 76 XMSubMetaSx_00 9289 4.45 6.65 3.34 77 T_TooManySym_02 9231 2.41 0.61 3.32 78 RCVD_IN_IADB_SPF 8921 2.51 1.13 3.21 79 BAYES_95 8911 4.19 6.15 3.20 80 BAYES_20 8777 2.60 1.49 3.15 81 MIME_HTML_MOSTLY 8356 5.25 9.70 3.00 82 TR_XM_PhishingBody 8232 3.35 4.13 2.96 83 RCVD_IN_IADB_SENDERID 7961 2.24 1.02 2.86 84 INVALID_MSGID 7928 1.98 0.25 2.85 85 RCVD_IN_IADB_DK 7642 2.16 1.01 2.75 86 UNTRUSTED_Relay 7447 7.25 16.28 2.68 87 MSGID_NOFQDN1 7447 1.79 0.04 2.68 88 T_REMOTE_IMAGE 7337 2.47 2.15 2.64 89 HTML_FONT_FACE_BAD 7180 1.92 0.62 2.58 90 RCVD_IN_MSPIKE_H5 6914 1.92 0.80 2.49 91 HTML_IMAGE_RATIO_08 6892 2.77 3.35 2.48 92 TO_MALFORMED 6549 1.57 0.01 2.35 93 T_FONT_INVIS_NAKED_TO 6542 2.93 4.09 2.35 94 DKIM_INVALID 6479 2.83 3.82 2.33 95 ANY_BOUNCE_MESSAGE 6415 1.80 0.79 2.31 96 BOUNCE_MESSAGE 6415 1.80 0.79 2.31 97 TVD_RCVD_IP 6414 1.60 0.19 2.31 98 RCVD_IN_IADB_VOUCHED 6303 1.74 0.71 2.27 99 TR_XM_SpammyWords5 6177 3.64 6.44 2.22 100 RELAYCOUNTRY_CA 5918 3.82 7.18 2.13 101 BAYES_05 5896 1.67 0.79 2.12 102 URI_NOVOWEL 5728 1.75 1.15 2.06 103 HELO_MISC_IP 5720 1.48 0.33 2.06 104 CK_HELO_DYNAMIC_SPLIT_IP 5714 1.48 0.36 2.05 105 XM_PDF 5393 1.41 0.37 1.94 106 USER_IN_DEF_DKIM_WL 5216 1.25 0.00 1.87 107 XMBdyGiftCard01 5211 1.84 1.78 1.87 108 XM_B_SpammyTLD 5123 2.38 3.46 1.84 109 MAILING_LIST_MULTI 5086 1.55 0.99 1.83 110 XM_CamelCaseFrm001 5073 1.83 1.85 1.82 111 XMSubNoVowel 5020 1.72 1.56 1.80 112 TR_Symld_Words 4907 1.71 1.60 1.76 113 IN_HORDE_ADDRESS_BOOK 4826 1.19 0.10 1.73 114 TR_XM_SpammyWords2 4782 7.09 17.72 1.72 115 BOTNET 4740 6.63 16.35 1.70 116 XMGappySubj_01 4623 1.14 0.10 1.66 117 T_XMDrugObfuBody_08 4585 2.18 3.22 1.65 118 TR_XM_SB_Phish 4579 1.57 1.41 1.65 119 XMSubPhish11 4562 1.56 1.40 1.64 120 XMBSHREFv2 4520 1.12 0.11 1.62 121 T_XMDrugObfuBody_14 4478 1.52 1.36 1.61 122 DKIM_ADSP_NXDOMAIN 4336 1.81 2.32 1.56 123 SUBJ_ALL_CAPS 4330 2.15 3.32 1.56 124 HTML_MIME_NO_HTML_TAG 4295 2.00 2.91 1.54 125 RCVD_IN_IADB_OPTIN 4224 1.19 0.53 1.52 126 XMStockSpam_06 4206 1.45 1.34 1.51 127 XMBrknScrpt_02 4074 3.18 6.56 1.46 128 XM_OfRef6 4070 2.55 4.70 1.46 129 T_TooManySym_03 3945 0.98 0.12 1.42 130 LH_URI_DOM_IN_PATH 3840 1.48 1.68 1.38 131 XMDiploma_00 3840 1.93 3.03 1.38 132 XM_DK_Undo_01 3774 1.59 2.06 1.36 133 URI_TRY_3LD 3577 1.77 2.72 1.29 134 TooManyTo_002 3559 1.02 0.51 1.28 135 TM2_M_VERY_LONG_WORD 3273 1.35 1.70 1.18 136 XM_UB50 3264 3.23 7.30 1.17 137 URI_HEX 3213 2.18 4.20 1.15 138 TR_MSPIKEBAYES00 3189 0.77 0.01 1.15 139 XMBody_95 3112 0.78 0.12 1.12 140 XMBody_17 3086 2.75 6.00 1.11 141 XM_B_COVIDMETA 3058 1.07 1.03 1.10 142 XM_B_Phish66 2987 1.47 2.24 1.07 143 XM_GoogleGroups 2983 0.83 0.36 1.07 144 DKIM_ADSP_CUSTOM_MED 2970 0.97 0.76 1.07 145 XM_SPF_SoftFail 2960 1.74 3.06 1.06 146 XM_B_Unsub2 2855 1.22 1.62 1.03 147 XM_H_Long_From02 2815 0.83 0.48 1.01 148 TooManyTo_003 2611 0.72 0.27 0.94 149 NO_DNS_FOR_FROM 2525 0.77 0.49 0.91 150 XM_ProductURIs 2481 0.89 0.89 0.89 151 T_FILL_THIS_FORM_SHORT 2471 1.25 1.97 0.89 152 HELO_NODOT 2469 0.75 0.48 0.89 153 T_TooManySym_04 2468 0.60 0.04 0.89 154 HELO_NO_DOMAIN 2468 0.75 0.48 0.89 155 KHOP_HELO_FCRDNS 2418 1.18 1.81 0.87 156 TR_LOTS_OF_MONEY3 2393 3.00 7.22 0.86 157 LOW_PRICE 2355 0.94 1.14 0.85 158 XMPhish30 2343 0.84 0.83 0.84 159 RCVD_IN_MSPIKE_BL 2337 5.28 14.07 0.84 160 XM_S_SubURI 2245 0.56 0.08 0.81 161 NUMERIC_HTTP_ADDR 2236 0.67 0.40 0.80 162 T_XMHurry_00 2109 1.40 2.66 0.76 163 TooManyTo_004 2096 0.58 0.25 0.75 164 RCVD_IN_BL_SPAMCOP_NET 2084 3.32 8.41 0.75 165 XMGenDplmaNmb 2054 1.07 1.72 0.74 166 XMHTMLBadTable_001 2033 0.70 0.63 0.73 167 MISSING_HEADERS 2016 0.72 0.71 0.72 168 XMHTML_After_End 2005 0.75 0.80 0.72 169 T_TooManySym_05 1967 0.47 0.00 0.71 170 RDNS_DYNAMIC 1941 0.77 0.91 0.70 171 NML_ADSP_CUSTOM_MED 1929 0.70 0.71 0.69 172 SpammyFromTLD_01 1929 2.07 4.80 0.69 173 XMSubEmpty 1925 0.69 0.70 0.69 174 XM_B_REG_HTML 1906 0.61 0.47 0.69 175 XM_ShortIntro_01 1898 0.72 0.81 0.68 176 XMPhish08 1879 0.64 0.56 0.68 177 RCVD_IN_MSPIKE_L3 1814 4.01 10.64 0.65 178 PDS_OTHER_BAD_TLD 1805 0.89 1.38 0.65 179 XM_B_SpammyWords4 1801 1.03 1.78 0.65 180 XMSubMetaI_00 1782 0.87 1.32 0.64 181 TooManyTo_005 1779 0.50 0.23 0.64 182 RELAYCOUNTRY_GB 1753 0.70 0.85 0.63 183 TR_MetaPhish_Combo_01 1686 0.59 0.57 0.61 184 USER_IN_WELCOMELIST 1684 0.40 0.00 0.61 185 USER_IN_WHITELIST 1684 0.40 0.00 0.61 186 FORGED_GMAIL_RCVD 1681 0.61 0.62 0.60 187 SHORTENED_URL_HREF 1668 1.18 2.34 0.60 188 TR_XM_SpammyWords3 1640 3.81 10.18 0.59 189 HTTPS_HTTP_MISMATCH 1543 0.59 0.67 0.55 190 SUBJ_DOLLARS 1538 0.77 1.19 0.55 191 TR_XM_Spammywords 1500 0.56 0.60 0.54 192 XM_S_SpammyWords 1500 0.56 0.60 0.54 193 XM_B_COPY_HTML 1482 0.51 0.48 0.53 194 T_XMDrugObfuBody_00 1470 0.73 1.12 0.53 195 HTML_IMAGE_ONLY_20 1457 0.45 0.31 0.52 196 FILL_THIS_FORM 1456 0.39 0.11 0.52 197 XMLngstWrd_00 1455 0.47 0.37 0.52 198 DIET_1 1403 0.54 0.61 0.50 199 XMBody_78 1383 0.76 1.27 0.50 200 PLING_QUERY 1345 0.51 0.55 0.48 ----------------------------------------------------------------------