Email: 859891 Autolearn: 0 AvgScore: 3.73 AvgScanTime: 1.84 sec Spam: 255173 Autolearn: 0 AvgScore: 13.67 AvgScanTime: 2.04 sec Ham: 604718 Autolearn: 0 AvgScore: -0.47 AvgScanTime: 1.75 sec Time Spent Running SA: 438.36 hours Time Spent Processing Spam: 144.49 hours Time Spent Processing Ham: 293.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 246163 91.27 96.47 89.07 2 DKIM_SIGNED 216609 80.25 84.89 78.30 3 XM_DK_Pass 208513 78.56 81.71 77.23 4 DKIM_VALID 205006 76.89 80.34 75.43 5 DCC_CHECK 203534 53.39 79.76 42.26 6 RELAYCOUNTRY_US 198949 82.50 77.97 84.42 7 XM_B_Unicode 193841 73.69 75.96 72.73 8 XMListUnsubscribeExists 178689 58.00 70.03 52.92 9 XM_B_SpammyWords 175561 56.17 68.80 50.84 10 DKIM_VALID_AU 156806 56.89 61.45 54.96 11 XM_DK_Undo_02 120869 19.88 47.37 8.27 12 XM_B_Unicode3 111093 42.61 43.54 42.22 13 XM_B_SpammyWords2 99723 26.42 39.08 21.08 14 BAYES_50 98594 49.76 38.64 54.45 15 LOC_TINY_FONT_1 97226 28.58 38.10 24.56 16 TR_XM_DKIM_Undo 96746 15.02 37.91 5.35 17 BAYES_99 87108 13.34 34.14 4.57 18 HTML_FONT_LOW_CONTRAST 85696 29.61 33.58 27.94 19 RCVD_IN_MSPIKE_H2 83444 29.57 32.70 28.25 20 MIME_HTML_ONLY 79143 23.93 31.02 20.95 21 DKIM_VALID_EF 74271 28.62 29.11 28.42 22 FVGT_m_MULTI_ODD 73755 25.04 28.90 23.41 23 BAYES_999 68842 10.54 26.98 3.60 24 T_KAM_HTML_FONT_INVALID 68012 21.72 26.65 19.63 25 TR_DCC_Bayes_99 67309 9.46 26.38 2.32 26 XMSubLong 56875 19.87 22.29 18.85 27 RCVD_IN_MSPIKE_WL 55293 28.08 21.67 30.79 28 RELAYCOUNTRY_META 53587 9.68 21.00 4.91 29 T_TM2_M_HEADER_IN_MSG 53053 25.68 20.79 27.75 30 XM_Body_Dirty_Words 50834 14.48 19.92 12.19 31 BOTNET 49498 7.36 19.40 2.28 32 DCC_CHECK_NEGATIVE 47647 44.68 18.67 55.66 33 XM_Multi_Part_URI 40493 12.68 15.87 11.34 34 LOTS_OF_MONEY 39741 10.87 15.57 8.88 35 XM_B_Unsub 35083 11.46 13.75 10.50 36 TR_XM_SpammyWords4 34340 8.11 13.46 5.86 37 XM_B_SpammyWords3 34205 7.58 13.40 5.13 38 TR_XM_SpammyWords2 34123 4.49 13.37 0.74 39 UNTRUSTED_Relay 33246 5.23 13.03 1.93 40 BOTNET_IPINHOSTNAME 31741 7.65 12.44 5.63 41 RCVD_IN_MSPIKE_H3 29963 14.65 11.74 15.87 42 XM_Evil_Numbers_Gen 29727 10.09 11.65 9.43 43 RCVD_IN_BL_SPAMCOP_NET 27689 4.37 10.85 1.64 44 XMSexyCombo_05 27146 5.63 10.64 3.51 45 XM_UncommonTLD01 25604 5.20 10.03 3.15 46 FSL_BULK_SIG 25118 7.25 9.84 6.15 47 MPART_ALT_DIFF 24596 6.76 9.64 5.54 48 LotsOfNums_01 24352 9.58 9.54 9.60 49 HTML_IMAGE_RATIO_02 22704 7.70 8.90 7.20 50 RCVD_IN_MSPIKE_H4 22557 10.76 8.84 11.57 51 UNPARSEABLE_RELAY 21317 8.40 8.35 8.42 52 TR_XM_UnparsRelay 20615 6.92 8.08 6.43 53 XM_B_Phish_Phrases 20287 6.53 7.95 5.93 54 MIME_HTML_MOSTLY 19037 3.85 7.46 2.32 55 BAYES_80 18610 5.49 7.29 4.72 56 TR_XM_PhishingBody 18391 4.20 7.21 2.93 57 XM_SendGrid 18309 7.63 7.18 7.82 58 BAYES_60 17721 8.08 6.94 8.55 59 BOTNET_NORDNS 17014 2.00 6.67 0.03 60 XM_H_Long_From01 16835 6.04 6.60 5.80 61 HTML_SHORT_LINK_IMG_1 16832 1.99 6.60 0.05 62 RELAYCOUNTRY_CA 16138 2.81 6.32 1.32 63 XMSubMetaSx_00 16125 4.45 6.32 3.66 64 HTML_IMAGE_RATIO_04 15304 5.60 6.00 5.43 65 HTML_MIME_NO_HTML_TAG 15130 3.15 5.93 1.97 66 TR_LOTS_OF_MONEY3 14313 3.39 5.61 2.45 67 XM_UB50 14264 2.49 5.59 1.19 68 XMStrtUSub 13840 7.35 5.42 8.16 69 DKIM_ADSP_NXDOMAIN 13276 1.72 5.20 0.25 70 TooManyTo_001 13151 7.10 5.15 7.92 71 XMNumbers 12765 3.52 5.00 2.90 72 HDRS_MISSP 12173 1.52 4.77 0.15 73 HTML_IMAGE_ONLY_08 12066 1.50 4.73 0.13 74 SpammyFromTLD_01 12062 1.91 4.73 0.72 75 HDRS_LCASE_IMGONLY 11978 1.45 4.69 0.08 76 DKIM_INVALID 11603 3.36 4.55 2.86 77 URI_NOVOWEL 11325 3.84 4.44 3.59 78 BAYES_95 11233 3.25 4.40 2.76 79 RCVD_IN_MSPIKE_BL 10824 1.40 4.24 0.19 80 RCVD_IN_RP_SAFE 10692 6.83 4.19 7.95 81 XM_B_Phish66 10608 2.57 4.16 1.90 82 TR_XM_MSPIKECOMBO 10551 1.36 4.13 0.19 83 RELAYCOUNTRY_FR 10434 1.41 4.09 0.28 84 TR_XM_DK_SendGrid 10200 4.63 4.00 4.89 85 XM_DIRTYINTL 9897 1.40 3.88 0.36 86 MIME_QP_LONG_LINE 9820 5.66 3.85 6.42 87 TR_XM_SpammyWords5 9763 2.40 3.83 1.80 88 XM_SPF_SoftFail 9721 2.27 3.81 1.61 89 TM2_M_URI_OPT_OUT 9604 4.02 3.76 4.13 90 XM_OfRef6 9421 1.74 3.69 0.92 91 BAYES_40 8870 4.32 3.48 4.67 92 T_REMOTE_IMAGE 8556 3.63 3.35 3.74 93 T_XMHurry_00 8195 1.85 3.21 1.27 94 HTML_IMAGE_RATIO_08 8150 2.70 3.19 2.49 95 XMDiploma_00 8132 2.07 3.19 1.60 96 RCVD_IN_MSPIKE_L5 8069 1.00 3.16 0.08 97 RCVD_IN_RP_CERTIFIED 8056 6.10 3.16 7.35 98 KHOP_HELO_FCRDNS 8028 1.94 3.15 1.44 99 XM_B_SpammyTLD 7890 2.26 3.09 1.91 100 HTML_IMAGE_RATIO_06 7735 3.71 3.03 4.00 101 DIET_1 7539 1.16 2.95 0.40 102 XMSlimDrugH 7404 1.06 2.90 0.28 103 MIME_HTML_ONLY_MULTI 7384 3.40 2.89 3.61 104 XM_DK_Undo_01 7374 1.84 2.89 1.39 105 SpammyFromTLD_02 7272 1.01 2.85 0.23 106 XM_B_COVIDMETA 7270 1.78 2.85 1.33 107 TM2_M_VERY_LONG_WORD 7176 1.80 2.81 1.38 108 RCVD_IN_RP_RNBL 7123 0.86 2.79 0.04 109 URI_HEX 7022 1.92 2.75 1.56 110 XMSexyCombo_01 7007 1.52 2.75 1.00 111 FROM_EXCESS_BASE64 6912 2.62 2.71 2.58 112 T_XMDrugObfuBody_08 6841 1.94 2.68 1.63 113 SUBJ_ALL_CAPS 6597 1.91 2.59 1.62 114 MALE_ENHANCE 6595 0.77 2.58 0.00 115 URIBL_SBL_A 6551 0.83 2.57 0.09 116 T_TooManySym_01 6237 3.77 2.44 4.33 117 XMBrknScrpt_02 6172 1.26 2.42 0.78 118 XMBody_17 6021 1.08 2.36 0.54 119 T_XMDrugObfuBody_14 5993 1.94 2.35 1.77 120 RCVD_IN_IADB_LISTED 5910 5.44 2.32 6.75 121 XM_B_Unsub2 5871 2.00 2.30 1.87 122 XMWghtMeta_00 5810 0.70 2.28 0.04 123 BAYES_00 5583 10.89 2.19 14.56 124 XM_CamelCaseFrm001 5576 1.98 2.19 1.89 125 TR_XM_SpammyWords3 5475 0.71 2.15 0.11 126 RCVD_IN_IADB_SPF 5307 4.74 2.08 5.87 127 MAILING_LIST_MULTI 5302 2.57 2.08 2.78 128 SUBJECT_DIET 5232 0.61 2.05 0.00 129 HTML_IMAGE_ONLY_12 5186 0.75 2.03 0.22 130 FVGT_m_MULTI_ODD_EMAIL 5149 0.63 2.02 0.04 131 RCVD_IN_PSBL 5114 0.60 2.00 0.01 132 XMBdyGiftCard01 5110 1.08 2.00 0.69 133 BAYES_20 5107 3.02 2.00 3.45 134 XM_UB99 5093 0.59 2.00 0.00 135 RCVD_IN_IADB_SENDERID 5027 4.26 1.97 5.22 136 RCVD_IN_IADB_DK 5005 4.15 1.96 5.07 137 RELAYCOUNTRY_GB 4720 1.19 1.85 0.91 138 URI_TRY_3LD 4677 1.26 1.83 1.02 139 BODY_URI_ONLY 4652 0.56 1.82 0.03 140 TR_XM_SB_Phish 4507 2.37 1.77 2.62 141 HK_RANDOM_REPLYTO 4439 0.66 1.74 0.20 142 XMSubPhish11 4430 2.34 1.74 2.59 143 FORGED_GMAIL_RCVD 4339 0.94 1.70 0.61 144 XM_UB60 4314 0.58 1.69 0.11 145 XMSexyCombo_04 4287 0.56 1.68 0.08 146 XM_URI_RBL 4276 0.60 1.68 0.15 147 GOOGLE_DOC_SUSP 4184 0.50 1.64 0.02 148 GOOG_STO_IMG_HTML 4104 0.48 1.61 0.00 149 XMStockSpam_06 4069 1.27 1.59 1.14 150 XM_B_SpammyWords4 4012 0.98 1.57 0.73 151 TR_XM_BayesRelay 4009 0.48 1.57 0.02 152 XMSubMetaI_00 4007 1.11 1.57 0.91 153 XMSubMetaD_00 3941 0.50 1.54 0.05 154 XMLongAddy 3938 0.51 1.54 0.07 155 PDS_OTHER_BAD_TLD 3828 0.97 1.50 0.74 156 T_FILL_THIS_FORM_SHORT 3808 1.02 1.49 0.82 157 DRUGS_ERECTILE 3808 0.49 1.49 0.06 158 XMGenDplmaNmb 3780 1.03 1.48 0.84 159 URI_PHP_REDIR 3762 0.44 1.47 0.00 160 TR_XM_COVIDMETA4 3756 0.66 1.47 0.32 161 TR_XM_MaxBayes 3702 0.43 1.45 0.01 162 TR_Symld_Words 3680 1.31 1.44 1.26 163 SERGIO_SUBJECT_VIAGRA01 3555 0.41 1.39 0.00 164 XM_UB999 3553 0.41 1.39 0.00 165 HK_RANDOM_FROM 3356 0.48 1.32 0.13 166 HTML_FONT_SIZE_LARGE 3308 0.45 1.30 0.10 167 URIBL_BLACK 3262 0.41 1.28 0.04 168 TR_XM_INV_DKIM 3200 0.40 1.25 0.04 169 T_XMDrugObfuBody_00 3183 0.99 1.25 0.88 170 TR_XM_RelayPhish 3159 0.41 1.24 0.07 171 XMPhish08 3066 0.53 1.20 0.24 172 XMSubject_47 3026 0.35 1.19 0.00 173 TR_XM_PHPDW 2977 0.56 1.17 0.30 174 XM_UB80 2953 0.36 1.16 0.02 175 TR_XM_PHPForged 2902 0.53 1.14 0.27 176 TR_XM_FormFill2 2886 0.53 1.13 0.28 177 XM_H_PHPOS 2878 0.52 1.13 0.26 178 TR_Caps_n_Bayes_99 2854 0.37 1.12 0.05 179 RCVD_IN_MSPIKE_H5 2773 2.67 1.09 3.34 180 XM_Body_Obfu01 2725 0.66 1.07 0.49 181 FROM_SUSPICIOUS_NTLD 2701 0.36 1.06 0.07 182 TR_XM_COVIDMETA1 2693 0.47 1.06 0.23 183 TR_XM_DK_Bayes 2656 6.91 1.04 9.39 184 XM_OfRef7 2649 0.40 1.04 0.13 185 T_Symld_Words_02 2625 0.69 1.03 0.55 186 FROM_SUSPICIOUS_NTLD_FP 2624 0.35 1.03 0.06 187 TR_XM_DK_Bayes1 2587 6.73 1.01 9.15 188 TR_Mismatch_TLD_02 2557 0.35 1.00 0.08 189 NUMERIC_HTTP_ADDR 2549 0.57 1.00 0.39 190 XM_H_Long_From02 2530 1.15 0.99 1.21 191 RDNS_DYNAMIC 2497 0.59 0.98 0.43 192 XM_ProductURIs 2488 0.85 0.98 0.80 193 XM_Body_Dirty_Words_01 2482 0.43 0.97 0.19 194 DKIM_ADSP_CUSTOM_MED 2464 0.96 0.97 0.96 195 XM_B_Crypto 2439 0.33 0.96 0.06 196 XMPhish30 2367 0.56 0.93 0.40 197 T_MONEY_PERCENT 2361 0.42 0.93 0.21 198 TR_LOTS_OF_MONEY2 2361 0.42 0.93 0.21 199 URI_NO_WWW_BIZ_CGI 2361 0.28 0.93 0.01 200 BITCOIN_YOUR_INFO 2359 0.30 0.92 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 538641 91.27 96.47 89.07 2 RELAYCOUNTRY_US 510485 82.50 77.97 84.42 3 DKIM_SIGNED 473475 80.25 84.89 78.30 4 XM_DK_Pass 467020 78.56 81.71 77.23 5 DKIM_VALID 456153 76.89 80.34 75.43 6 XM_B_Unicode 439809 73.69 75.96 72.73 7 DCC_CHECK_NEGATIVE 336581 44.68 18.67 55.66 8 DKIM_VALID_AU 332356 56.89 61.45 54.96 9 BAYES_50 329286 49.76 38.64 54.45 10 XMListUnsubscribeExists 320014 58.00 70.03 52.92 11 XM_B_SpammyWords 307468 56.17 68.80 50.84 12 DCC_CHECK 255562 53.39 79.76 42.26 13 XM_B_Unicode3 255317 42.61 43.54 42.22 14 RCVD_IN_MSPIKE_WL 186163 28.08 21.67 30.79 15 DKIM_VALID_EF 171869 28.62 29.11 28.42 16 RCVD_IN_MSPIKE_H2 170828 29.57 32.70 28.25 17 HTML_FONT_LOW_CONTRAST 168938 29.61 33.58 27.94 18 T_TM2_M_HEADER_IN_MSG 167788 25.68 20.79 27.75 19 LOC_TINY_FONT_1 148542 28.58 38.10 24.56 20 FVGT_m_MULTI_ODD 141544 25.04 28.90 23.41 21 XM_B_SpammyWords2 127460 26.42 39.08 21.08 22 MIME_HTML_ONLY 126669 23.93 31.02 20.95 23 T_KAM_HTML_FONT_INVALID 118732 21.72 26.65 19.63 24 XMSubLong 113984 19.87 22.29 18.85 25 RCVD_IN_MSPIKE_H3 95982 14.65 11.74 15.87 26 BAYES_00 88043 10.89 2.19 14.56 27 XM_Body_Dirty_Words 73710 14.48 19.92 12.19 28 ALL_TRUSTED 72165 8.65 0.86 11.93 29 RCVD_IN_MSPIKE_H4 69996 10.76 8.84 11.57 30 XM_Multi_Part_URI 68560 12.68 15.87 11.34 31 XM_B_Unsub 63483 11.46 13.75 10.50 32 LotsOfNums_01 58060 9.58 9.54 9.60 33 XM_Evil_Numbers_Gen 57006 10.09 11.65 9.43 34 TR_XM_DK_Bayes 56793 6.91 1.04 9.39 35 XM_DKIMWhitelistDomains 55596 6.52 0.17 9.19 36 TR_XM_DK_Bayes1 55322 6.73 1.01 9.15 37 LOTS_OF_MONEY 53720 10.87 15.57 8.88 38 BAYES_60 51731 8.08 6.94 8.55 39 UNPARSEABLE_RELAY 50899 8.40 8.35 8.42 40 XM_DK_Undo_02 50035 19.88 47.37 8.27 41 XMStrtUSub 49335 7.35 5.42 8.16 42 RCVD_IN_RP_SAFE 48053 6.83 4.19 7.95 43 TooManyTo_001 47889 7.10 5.15 7.92 44 TR_XM_DK_Bayes2 47496 5.79 0.89 7.85 45 XM_SendGrid 47277 7.63 7.18 7.82 46 RCVD_IN_RP_CERTIFIED 44439 6.10 3.16 7.35 47 HTML_IMAGE_RATIO_02 43514 7.70 8.90 7.20 48 RCVD_IN_IADB_LISTED 40832 5.44 2.32 6.75 49 TR_XM_UnparsRelay 38884 6.92 8.08 6.43 50 MIME_QP_LONG_LINE 38837 5.66 3.85 6.42 51 FSL_BULK_SIG 37184 7.25 9.84 6.15 52 XM_B_Phish_Phrases 35876 6.53 7.95 5.93 53 RCVD_IN_IADB_SPF 35489 4.74 2.08 5.87 54 TR_XM_SpammyWords4 35418 8.11 13.46 5.86 55 XM_H_Long_From01 35096 6.04 6.60 5.80 56 BOTNET_IPINHOSTNAME 34044 7.65 12.44 5.63 57 MPART_ALT_DIFF 33498 6.76 9.64 5.54 58 HTML_IMAGE_RATIO_04 32850 5.60 6.00 5.43 59 IN_ZIMBRA_NJ_WHITELIST 32746 3.82 0.05 5.42 60 TR_XM_DKIM_Undo 32378 15.02 37.91 5.35 61 RCVD_IN_IADB_SENDERID 31578 4.26 1.97 5.22 62 XM_B_SpammyWords3 31017 7.58 13.40 5.13 63 RCVD_IN_IADB_DK 30664 4.15 1.96 5.07 64 RELAYCOUNTRY_META 29670 9.68 21.00 4.91 65 TR_XM_DK_SendGrid 29573 4.63 4.00 4.89 66 XM_PDF 29541 3.69 0.86 4.89 67 BAYES_80 28572 5.49 7.29 4.72 68 BAYES_40 28245 4.32 3.48 4.67 69 BAYES_99 27617 13.34 34.14 4.57 70 T_TooManySym_01 26164 3.77 2.44 4.33 71 RCVD_IN_IADB_VOUCHED 25476 3.23 0.91 4.21 72 TM2_M_URI_OPT_OUT 24968 4.02 3.76 4.13 73 HTML_IMAGE_RATIO_06 24197 3.71 3.03 4.00 74 T_REMOTE_IMAGE 22621 3.63 3.35 3.74 75 XMSubMetaSx_00 22142 4.45 6.32 3.66 76 MIME_HTML_ONLY_MULTI 21848 3.40 2.89 3.61 77 BAYES_999 21793 10.54 26.98 3.60 78 URI_NOVOWEL 21682 3.84 4.44 3.59 79 XMSexyCombo_05 21225 5.63 10.64 3.51 80 BAYES_20 20853 3.02 2.00 3.45 81 RCVD_IN_MSPIKE_H5 20185 2.67 1.09 3.34 82 XM_H_Trusted_IP 19428 2.26 0.00 3.21 83 XM_UncommonTLD01 19078 5.20 10.03 3.15 84 TR_XM_PhishingBody 17739 4.20 7.21 2.93 85 XMNumbers 17525 3.52 5.00 2.90 86 DKIM_INVALID 17322 3.36 4.55 2.86 87 RCVD_IN_IADB_OPTIN 16839 2.14 0.63 2.78 88 MAILING_LIST_MULTI 16804 2.57 2.08 2.78 89 BAYES_95 16715 3.25 4.40 2.76 90 TR_XM_SB_Phish 15831 2.37 1.77 2.62 91 XMSubPhish11 15678 2.34 1.74 2.59 92 FROM_EXCESS_BASE64 15590 2.62 2.71 2.58 93 HTML_IMAGE_RATIO_08 15083 2.70 3.19 2.49 94 TR_LOTS_OF_MONEY3 14806 3.39 5.61 2.45 95 MIME_HTML_MOSTLY 14052 3.85 7.46 2.32 96 TR_DCC_Bayes_99 14041 9.46 26.38 2.32 97 BOTNET 13791 7.36 19.40 2.28 98 BAYES_05 13421 1.83 0.91 2.22 99 HTML_MIME_NO_HTML_TAG 11942 3.15 5.93 1.97 100 T_TooManySym_02 11942 1.59 0.68 1.97 101 UNTRUSTED_Relay 11693 5.23 13.03 1.93 102 XM_B_SpammyTLD 11537 2.26 3.09 1.91 103 XM_B_Phish66 11479 2.57 4.16 1.90 104 XM_CamelCaseFrm001 11433 1.98 2.19 1.89 105 TooManyTo_002 11394 1.50 0.59 1.88 106 XM_B_Unsub2 11312 2.00 2.30 1.87 107 TR_XM_SpammyWords5 10861 2.40 3.83 1.80 108 T_XMDrugObfuBody_14 10718 1.94 2.35 1.77 109 ANY_BOUNCE_MESSAGE 10575 1.36 0.43 1.75 110 BOUNCE_MESSAGE 10574 1.36 0.43 1.75 111 RCVD_IN_BL_SPAMCOP_NET 9891 4.37 10.85 1.64 112 T_XMDrugObfuBody_08 9836 1.94 2.68 1.63 113 SUBJ_ALL_CAPS 9797 1.91 2.59 1.62 114 XM_SPF_SoftFail 9760 2.27 3.81 1.61 115 XMDiploma_00 9653 2.07 3.19 1.60 116 URI_HEX 9453 1.92 2.75 1.56 117 IN_HORDE_ADDRESS_BOOK 9053 1.07 0.06 1.50 118 HELO_NODOT 8966 1.17 0.41 1.48 119 HELO_NO_DOMAIN 8965 1.16 0.41 1.48 120 KHOP_HELO_FCRDNS 8682 1.94 3.15 1.44 121 XM_DK_Undo_01 8434 1.84 2.89 1.39 122 TM2_M_VERY_LONG_WORD 8323 1.80 2.81 1.38 123 XMSubMetaSxObfu_03 8199 1.18 0.76 1.36 124 XM_B_COVIDMETA 8064 1.78 2.85 1.33 125 RELAYCOUNTRY_CA 8007 2.81 6.32 1.32 126 T_XMHurry_00 7674 1.85 3.21 1.27 127 USER_IN_DEF_DKIM_WL 7655 0.90 0.03 1.27 128 TR_Symld_Words 7600 1.31 1.44 1.26 129 TVD_RCVD_IP 7588 0.96 0.26 1.25 130 TooManyTo_003 7558 1.03 0.50 1.25 131 XM_H_Long_From02 7326 1.15 0.99 1.21 132 XMSubNoVowel 7309 1.05 0.69 1.21 133 INVALID_MSGID 7305 0.98 0.44 1.21 134 XM_UB50 7180 2.49 5.59 1.19 135 TR_MSPIKEBAYES00 6937 0.81 0.01 1.15 136 XMStockSpam_06 6865 1.27 1.59 1.14 137 XMCapTrack 6836 0.89 0.32 1.13 138 T_OBFU_PDF_ATTACH 6531 0.83 0.25 1.08 139 MSGID_NOFQDN1 6529 0.81 0.19 1.08 140 TO_MALFORMED 6436 0.75 0.01 1.06 141 HELO_MISC_IP 6328 0.80 0.23 1.05 142 URI_TRY_3LD 6170 1.26 1.83 1.02 143 XMBSHREFv2 6141 0.81 0.31 1.02 144 XMSexyCombo_01 6077 1.52 2.75 1.00 145 XM_GoogleGroups 5847 0.83 0.51 0.97 146 DKIM_ADSP_CUSTOM_MED 5819 0.96 0.97 0.96 147 XM_GRM 5810 0.68 0.00 0.96 148 XM_OfRef6 5538 1.74 3.69 0.92 149 XMSubMetaI_00 5517 1.11 1.57 0.91 150 RELAYCOUNTRY_GB 5495 1.19 1.85 0.91 151 TooManyTo_004 5427 0.76 0.45 0.90 152 T_XMDrugObfuBody_00 5316 0.99 1.25 0.88 153 XM_SPF_Unknown 5237 0.77 0.54 0.87 154 XMGenDplmaNmb 5067 1.03 1.48 0.84 155 T_FILL_THIS_FORM_SHORT 4955 1.02 1.49 0.82 156 XM_ProductURIs 4819 0.85 0.98 0.80 157 XMBody_95 4742 0.57 0.07 0.78 158 XMBrknScrpt_02 4689 1.26 2.42 0.78 159 HTML_FONT_FACE_BAD 4674 0.69 0.48 0.77 160 XMHTML_After_End 4602 0.81 0.92 0.76 161 XMGappySubj_01 4578 0.58 0.15 0.76 162 PDS_OTHER_BAD_TLD 4485 0.97 1.50 0.74 163 TR_XM_SpammyWords2 4484 4.49 13.37 0.74 164 TooManyTo_005 4435 0.64 0.41 0.73 165 XM_B_SpammyWords4 4388 0.98 1.57 0.73 166 SpammyFromTLD_01 4341 1.91 4.73 0.72 167 XMBdyGiftCard01 4197 1.08 2.00 0.69 168 FROM_GOV_DKIM_AU 4177 0.52 0.11 0.69 169 XMNoVowels 4176 0.64 0.53 0.69 170 HTTPS_HTTP_MISMATCH 4041 0.68 0.72 0.67 171 TR_MetaPhish_Combo_01 4029 0.70 0.77 0.67 172 NML_ADSP_CUSTOM_MED 3788 0.66 0.73 0.63 173 FORGED_GMAIL_RCVD 3705 0.94 1.70 0.61 174 XMMoneyMeta_00 3642 0.65 0.78 0.60 175 T_TooManySym_03 3311 0.46 0.24 0.55 176 T_Symld_Words_02 3296 0.69 1.03 0.55 177 XMBody_17 3287 1.08 2.36 0.54 178 XMLngstWrd_00 3160 0.49 0.41 0.52 179 TR_BOTNET_NEGATE 3133 0.57 0.71 0.52 180 XM_ShortIntro_01 3128 0.44 0.27 0.52 181 XM_H_PHPMailer 3032 0.46 0.37 0.50 182 XM_Body_Obfu01 2951 0.66 1.07 0.49 183 RELAYCOUNTRY_DE 2772 0.58 0.87 0.46 184 RCVD_IN_SORBS_DUL 2766 0.38 0.19 0.46 185 XMLngstWrd_01 2766 0.44 0.38 0.46 186 HTML_IMAGE_ONLY_28 2760 0.42 0.34 0.46 187 XM_RXBody 2758 0.49 0.56 0.46 188 HTML_IMAGE_ONLY_20 2741 0.40 0.29 0.45 189 XMHTMLBadTable_001 2704 0.48 0.56 0.45 190 XM_B_COPY_HTML 2699 0.47 0.54 0.45 191 RDNS_DYNAMIC 2602 0.59 0.98 0.43 192 SHORT_HELO_AND_INLINE_IMAGE 2526 0.31 0.05 0.42 193 DIET_1 2420 1.16 2.95 0.40 194 XMPhish30 2413 0.56 0.93 0.40 195 RELAYCOUNTRY_AU 2411 0.53 0.86 0.40 196 HTML_IMAGE_ONLY_32 2371 0.40 0.43 0.39 197 NUMERIC_HTTP_ADDR 2347 0.57 1.00 0.39 198 TM2_M_BODY_EMPTY 2327 0.29 0.05 0.38 199 PLING_QUERY 2318 0.40 0.44 0.38 200 HTML_TAG_BALANCE_BODY 2313 0.50 0.77 0.38 ----------------------------------------------------------------------