Email: 642855 Autolearn: 0 AvgScore: 1.61 AvgScanTime: 1.90 sec Spam: 128861 Autolearn: 0 AvgScore: 11.95 AvgScanTime: 3.04 sec Ham: 513994 Autolearn: 0 AvgScore: -0.99 AvgScanTime: 1.62 sec Time Spent Running SA: 340.01 hours Time Spent Processing Spam: 108.82 hours Time Spent Processing Ham: 231.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123409 90.10 95.77 88.68 2 DKIM_SIGNED 105641 77.15 81.98 75.94 3 DCC_CHECK 102980 47.54 79.92 39.42 4 XM_DK_Pass 102885 75.70 79.84 74.66 5 RELAYCOUNTRY_US 102840 81.92 79.81 82.45 6 XM_B_Unicode 98673 71.58 76.57 70.33 7 DKIM_VALID 94768 71.59 73.54 71.10 8 XMListUnsubscribeExists 91066 54.99 70.67 51.06 9 DKIM_VALID_AU 71163 51.97 55.22 51.16 10 BAYES_50 59319 50.75 46.03 51.93 11 XM_B_Unicode3 52313 39.41 40.60 39.12 12 XM_DK_Undo_02 51678 13.23 40.10 6.49 13 LOC_TINY_FONT_1 45247 25.20 35.11 22.72 14 MIME_HTML_ONLY 45081 23.01 34.98 20.00 15 DKIM_VALID_EF 39971 27.53 31.02 26.65 16 HTML_FONT_LOW_CONTRAST 39823 27.25 30.90 26.33 17 FVGT_m_MULTI_ODD 35189 23.38 27.31 22.39 18 BAYES_99 34316 7.66 26.63 2.90 19 XMSubLong 33352 21.13 25.88 19.94 20 T_KAM_HTML_FONT_INVALID 32987 19.74 25.60 18.27 21 TR_DCC_Bayes_99 27750 5.29 21.53 1.22 22 RELAYCOUNTRY_META 26882 8.71 20.86 5.67 23 BAYES_999 26749 5.92 20.76 2.20 24 BOTNET 25462 5.99 19.76 2.54 25 T_TM2_M_HEADER_IN_MSG 24184 27.86 18.77 30.13 26 DCC_CHECK_NEGATIVE 23509 50.30 18.24 58.34 27 XM_Multi_Part_URI 23467 12.48 18.21 11.04 28 XM_Body_Dirty_Words 22602 12.21 17.54 10.87 29 XM_UncommonTLD01 22119 6.13 17.17 3.36 30 XM_B_Phish_Phrases 20949 9.45 16.26 7.75 31 FSL_BULK_SIG 19511 8.65 15.14 7.03 32 LOTS_OF_MONEY 18261 9.91 14.17 8.84 33 UNTRUSTED_Relay 18165 4.25 14.10 1.78 34 BOTNET_IPINHOSTNAME 18162 6.96 14.09 5.17 35 XM_B_COVIDMETA 16721 4.92 12.98 2.90 36 XM_B_Unsub 15475 10.26 12.01 9.83 37 HTML_IMAGE_RATIO_02 14928 7.89 11.58 6.96 38 RCVD_IN_MSPIKE_H2 13313 13.32 10.33 14.06 39 LotsOfNums_01 13204 9.15 10.25 8.88 40 XM_Evil_Numbers_Gen 12304 8.93 9.55 8.78 41 XM_UB50 11688 2.67 9.07 1.06 42 XMSexyCombo_05 11503 4.16 8.93 2.96 43 DKIM_INVALID 10873 5.56 8.44 4.84 44 NO_DNS_FOR_FROM 9526 3.13 7.39 2.07 45 RCVD_IN_MSPIKE_BL 9376 3.50 7.28 2.55 46 MPART_ALT_DIFF 9346 5.06 7.25 4.51 47 RCVD_IN_MSPIKE_L3 9064 3.42 7.03 2.51 48 BAYES_80 8701 3.89 6.75 3.17 49 XM_H_Long_From01 8168 5.55 6.34 5.35 50 XMSubMetaSx_00 8073 4.14 6.26 3.61 51 BAYES_60 7910 5.68 6.14 5.57 52 KHOP_HELO_FCRDNS 7909 2.73 6.14 1.88 53 XM_CamelCaseFrm001 7862 2.84 6.10 2.02 54 HTML_IMAGE_RATIO_04 7385 5.74 5.73 5.75 55 XM_B_SpammyTLD 7349 2.68 5.70 1.93 56 TooManyTo_001 7159 8.36 5.56 9.07 57 MIME_QP_LONG_LINE 7031 6.21 5.46 6.40 58 XM_SPF_SoftFail 7000 2.50 5.43 1.76 59 UNPARSEABLE_RELAY 6624 7.91 5.14 8.61 60 RELAYCOUNTRY_CA 6088 2.25 4.72 1.63 61 URIBL_SBL_A 5931 1.42 4.60 0.62 62 XMHTML_After_End 5903 1.54 4.58 0.77 63 XMStrtUSub 5895 4.96 4.57 5.06 64 MIME_HTML_MOSTLY 5836 2.80 4.53 2.37 65 XMNumbers 5770 3.35 4.48 3.06 66 XM_SendGrid 5650 6.28 4.38 6.75 67 SpammyFromTLD_02 5333 1.04 4.14 0.26 68 FROM_SUSPICIOUS_NTLD 5297 0.86 4.11 0.05 69 FROM_SUSPICIOUS_NTLD_FP 5195 0.84 4.03 0.04 70 T_XMDrugObfuBody_08 5092 2.05 3.95 1.58 71 RCVD_IN_BL_SPAMCOP_NET 5064 1.75 3.93 1.21 72 LongTLD 4985 0.93 3.87 0.19 73 SpammyFromTLD_01 4899 1.42 3.80 0.82 74 BODY_URI_ONLY 4856 0.83 3.77 0.10 75 HTML_IMAGE_RATIO_06 4824 3.72 3.74 3.72 76 RCVD_IN_MSPIKE_H3 4818 8.35 3.74 9.51 77 RCVD_IN_MSPIKE_WL 4818 8.35 3.74 9.51 78 BAYES_40 4799 5.58 3.72 6.05 79 RDNS_DYNAMIC 4703 1.01 3.65 0.35 80 TM2_M_URI_OPT_OUT 4565 3.47 3.54 3.45 81 XM_OfRef6 4528 1.70 3.51 1.25 82 BAYES_95 4490 2.10 3.48 1.75 83 XM_URI_RBL 4301 0.83 3.34 0.20 84 PDS_OTHER_BAD_TLD 4298 1.05 3.34 0.48 85 RELAYCOUNTRY_FR 4245 0.88 3.29 0.27 86 TR_XM_MaxBayes 4228 0.67 3.28 0.02 87 DKIM_ADSP_NXDOMAIN 4224 0.89 3.28 0.30 88 HTML_MIME_NO_HTML_TAG 4205 2.43 3.26 2.23 89 MIME_HTML_ONLY_MULTI 3997 2.83 3.10 2.76 90 XM_DIRTYINTL 3996 1.17 3.10 0.69 91 BAYES_20 3959 4.45 3.07 4.79 92 RELAYCOUNTRY_DE 3933 1.13 3.05 0.65 93 TR_XM_PhishingBody 3897 1.99 3.02 1.73 94 XMBody_17 3801 0.98 2.95 0.49 95 T_REMOTE_IMAGE 3731 3.92 2.90 4.17 96 TR_LOTS_OF_MONEY3 3662 1.75 2.84 1.48 97 XM_B_Unsub2 3617 1.86 2.81 1.62 98 T_XMDrugObfuBody_14 3526 1.82 2.74 1.59 99 RCVD_IN_IADB_LISTED 3482 5.06 2.70 5.65 100 T_TooManySym_01 3220 3.87 2.50 4.21 101 RCVD_IN_IADB_SPF 3195 4.41 2.48 4.90 102 DATE_IN_PAST_06_12 3188 0.64 2.47 0.18 103 T_XMHurry_00 3162 1.02 2.45 0.66 104 BAYES_00 3150 16.93 2.44 20.56 105 HTML_IMAGE_RATIO_08 3136 2.19 2.43 2.13 106 RCVD_IN_IADB_DK 3104 3.88 2.41 4.25 107 FROM_EXCESS_BASE64 3092 2.88 2.40 3.00 108 RCVD_IN_IADB_SENDERID 3092 3.89 2.40 4.27 109 URI_HEX 3085 1.63 2.39 1.43 110 DATE_IN_PAST_03_06 2916 0.60 2.26 0.18 111 RELAYCOUNTRY_IN 2873 0.51 2.23 0.08 112 XMNoVowels 2869 1.71 2.23 1.58 113 URI_TRY_3LD 2799 1.58 2.17 1.43 114 TR_XM_DK_SendGrid 2767 3.27 2.15 3.55 115 NO_FM_NAME_IP_HOSTN 2695 0.42 2.09 0.00 116 RCVD_IN_RP_RNBL 2660 0.46 2.06 0.06 117 TR_XM_PHPDW 2641 1.21 2.05 1.00 118 TR_XM_PHPForged 2594 1.19 2.01 0.98 119 TR_XM_FormFill2 2580 1.19 2.00 0.98 120 XM_H_PHPOS 2574 1.18 2.00 0.98 121 XMDiploma_00 2536 1.47 1.97 1.34 122 T_Symld_Words_02 2515 0.88 1.95 0.61 123 SUBJ_ALL_CAPS 2471 1.53 1.92 1.43 124 HTML_IMAGE_ONLY_08 2367 0.45 1.84 0.11 125 NORDNS_LOW_CONTRAST 2314 0.41 1.80 0.06 126 T_XMDrugObfuBody_00 2256 1.53 1.75 1.47 127 HTML_SHORT_LINK_IMG_1 2253 0.36 1.75 0.01 128 BAYES_05 2206 2.96 1.71 3.27 129 XMSexyCombo_01 2171 0.68 1.68 0.42 130 TM2_M_VERY_LONG_WORD 2170 1.20 1.68 1.08 131 BOTNET_NORDNS 2123 0.34 1.65 0.01 132 FROM_MISSP_REPLYTO 2123 0.34 1.65 0.01 133 TR_Symld_Words 2095 1.36 1.63 1.29 134 REMOVE_BEFORE_LINK 2074 0.60 1.61 0.34 135 MAILING_LIST_MULTI 2024 2.81 1.57 3.12 136 TR_XM_DK_Bayes 1977 11.46 1.53 13.95 137 TR_XM_INV_DKIM 1924 0.34 1.49 0.05 138 T_FILL_THIS_FORM_SHORT 1919 1.08 1.49 0.97 139 TR_XM_RelayPhish 1855 0.39 1.44 0.13 140 TR_Mismatch_TLD_01 1824 0.43 1.42 0.19 141 RELAYCOUNTRY_GB 1822 1.19 1.41 1.14 142 TR_XM_MaxSPIKE 1802 0.36 1.40 0.10 143 XMGenDplmaNmb 1723 0.95 1.34 0.85 144 HDRS_MISSP 1723 0.32 1.34 0.07 145 XMStockSpam_06 1719 0.91 1.33 0.81 146 XM_DK_Undo_01 1712 1.63 1.33 1.70 147 MISSING_HEADERS 1702 0.77 1.32 0.63 148 XMBrknScrpt_02 1699 0.95 1.32 0.86 149 HDRS_LCASE_IMGONLY 1670 0.28 1.30 0.02 150 XM_H_Long_From02 1659 1.08 1.29 1.02 151 RCVD_IN_RP_SAFE 1635 6.55 1.27 7.87 152 TR_XM_DK_Bayes1 1617 10.84 1.25 13.24 153 TR_Mismatch_TLD_02 1613 0.33 1.25 0.10 154 MPART_ALT_DIFF_COUNT 1608 0.58 1.25 0.41 155 FROM_MISSP_DYNIP 1606 0.25 1.25 0.00 156 FVGT_m_MULTI_ODD_EMAIL 1596 0.28 1.24 0.04 157 MIME_HEADER_CTYPE_ONLY 1588 0.46 1.23 0.27 158 FROM_DOMAIN_NOVOWEL 1551 0.27 1.20 0.04 159 XMSubNoVowel 1550 1.14 1.20 1.12 160 XM_UB60 1537 0.31 1.19 0.09 161 HTTPS_HTTP_MISMATCH 1517 1.04 1.18 1.00 162 T_MONEY_PERCENT 1483 0.42 1.15 0.24 163 TR_LOTS_OF_MONEY2 1483 0.42 1.15 0.24 164 SHORT_IMG_SUSP_NTLD 1468 0.23 1.14 0.00 165 TR_XM_DK_Bayes2 1431 9.38 1.11 11.45 166 DATE_IN_PAST_12_24 1417 0.25 1.10 0.04 167 XMPhish30 1408 0.63 1.09 0.51 168 XMSlimDrugH 1374 0.46 1.07 0.30 169 XMPhish08 1370 0.70 1.06 0.61 170 FROM_ADDR_WS 1342 0.23 1.04 0.03 171 SUBJ_DOLLARS 1298 0.48 1.01 0.35 172 DKIM_ADSP_CUSTOM_MED 1278 1.20 0.99 1.26 173 XMMoneyMeta_00 1274 0.86 0.99 0.83 174 BILLION_DOLLARS 1267 0.21 0.98 0.02 175 SUBJECT_NEEDS_ENCODING 1259 0.20 0.98 0.01 176 RCVD_IN_RP_CERTIFIED 1258 5.88 0.98 7.10 177 SUBJ_ILLEGAL_CHARS 1257 0.20 0.98 0.01 178 XMSubMetaI_00 1246 0.62 0.97 0.53 179 XMBdyGiftCard01 1244 0.98 0.97 0.98 180 ALL_TRUSTED 1223 11.31 0.95 13.90 181 RCVD_IN_IADB_VOUCHED 1173 3.01 0.91 3.54 182 HTML_FONT_FACE_BAD 1168 0.98 0.91 1.00 183 RCVD_IN_PSBL 1165 0.19 0.90 0.01 184 XM_UB99 1164 0.18 0.90 0.00 185 DIET_1 1139 0.47 0.88 0.36 186 URIBL_BLACK 1135 0.20 0.88 0.03 187 TR_MetaPhish_Combo_01 1124 1.10 0.87 1.16 188 T_HTML_TAG_BALANCE_CENTER 1116 0.39 0.87 0.28 189 XMPhish14 1109 0.63 0.86 0.58 190 URI_NOVOWEL 1107 0.50 0.86 0.41 191 FORGED_GMAIL_RCVD 1099 0.61 0.85 0.55 192 XMBody_78 1097 0.43 0.85 0.32 193 XM_ProductURIs 1089 0.88 0.85 0.89 194 HTML_FONT_SIZE_HUGE 1046 0.28 0.81 0.14 195 LOADSA_MONEY_COMBO 1041 0.20 0.81 0.04 196 XM_PDF 1021 4.11 0.79 4.94 197 XM_H_PHPMailer 1005 0.52 0.78 0.45 198 XMSubMetaSxObfu_03 976 1.10 0.76 1.18 199 XMDateMe_00 967 0.38 0.75 0.29 200 T_XMDrugObfuBody_06 954 0.19 0.74 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 455801 90.10 95.77 88.68 2 RELAYCOUNTRY_US 423767 81.92 79.81 82.45 3 DKIM_SIGNED 390326 77.15 81.98 75.94 4 XM_DK_Pass 383760 75.70 79.84 74.66 5 DKIM_VALID 365432 71.59 73.54 71.10 6 XM_B_Unicode 361473 71.58 76.57 70.33 7 DCC_CHECK_NEGATIVE 299861 50.30 18.24 58.34 8 BAYES_50 266935 50.75 46.03 51.93 9 DKIM_VALID_AU 262957 51.97 55.22 51.16 10 XMListUnsubscribeExists 262463 54.99 70.67 51.06 11 DCC_CHECK 202619 47.54 79.92 39.42 12 XM_B_Unicode3 201065 39.41 40.60 39.12 13 T_TM2_M_HEADER_IN_MSG 154884 27.86 18.77 30.13 14 DKIM_VALID_EF 136991 27.53 31.02 26.65 15 HTML_FONT_LOW_CONTRAST 135350 27.25 30.90 26.33 16 LOC_TINY_FONT_1 116757 25.20 35.11 22.72 17 FVGT_m_MULTI_ODD 115100 23.38 27.31 22.39 18 BAYES_00 105700 16.93 2.44 20.56 19 MIME_HTML_ONLY 102823 23.01 34.98 20.00 20 XMSubLong 102490 21.13 25.88 19.94 21 T_KAM_HTML_FONT_INVALID 93929 19.74 25.60 18.27 22 RCVD_IN_MSPIKE_H2 72293 13.32 10.33 14.06 23 TR_XM_DK_Bayes 71686 11.46 1.53 13.95 24 ALL_TRUSTED 71456 11.31 0.95 13.90 25 TR_XM_DK_Bayes1 68045 10.84 1.25 13.24 26 TR_XM_DK_Bayes2 58864 9.38 1.11 11.45 27 XM_Multi_Part_URI 56735 12.48 18.21 11.04 28 XM_Body_Dirty_Words 55891 12.21 17.54 10.87 29 XM_B_Unsub 50504 10.26 12.01 9.83 30 RCVD_IN_MSPIKE_H3 48878 8.35 3.74 9.51 31 RCVD_IN_MSPIKE_WL 48878 8.35 3.74 9.51 32 TooManyTo_001 46604 8.36 5.56 9.07 33 LotsOfNums_01 45638 9.15 10.25 8.88 34 LOTS_OF_MONEY 45449 9.91 14.17 8.84 35 XM_Evil_Numbers_Gen 45129 8.93 9.55 8.78 36 UNPARSEABLE_RELAY 44230 7.91 5.14 8.61 37 RCVD_IN_RP_SAFE 40442 6.55 1.27 7.87 38 XM_B_Phish_Phrases 39824 9.45 16.26 7.75 39 RCVD_IN_RP_CERTIFIED 36513 5.88 0.98 7.10 40 FSL_BULK_SIG 36126 8.65 15.14 7.03 41 HTML_IMAGE_RATIO_02 35771 7.89 11.58 6.96 42 XM_SendGrid 34711 6.28 4.38 6.75 43 XM_DK_Undo_02 33368 13.23 40.10 6.49 44 XM_DKIMWhitelistDomains 33177 5.17 0.02 6.45 45 MIME_QP_LONG_LINE 32897 6.21 5.46 6.40 46 BAYES_40 31073 5.58 3.72 6.05 47 HTML_IMAGE_RATIO_04 29538 5.74 5.73 5.75 48 RELAYCOUNTRY_META 29136 8.71 20.86 5.67 49 RCVD_IN_IADB_LISTED 29043 5.06 2.70 5.65 50 BAYES_60 28633 5.68 6.14 5.57 51 XM_H_Long_From01 27497 5.55 6.34 5.35 52 BOTNET_IPINHOSTNAME 26572 6.96 14.09 5.17 53 XMStrtUSub 26008 4.96 4.57 5.06 54 XM_PDF 25408 4.11 0.79 4.94 55 RCVD_IN_IADB_SPF 25186 4.41 2.48 4.90 56 DKIM_INVALID 24894 5.56 8.44 4.84 57 BAYES_20 24644 4.45 3.07 4.79 58 MPART_ALT_DIFF 23156 5.06 7.25 4.51 59 RCVD_IN_IADB_SENDERID 21938 3.89 2.40 4.27 60 RCVD_IN_IADB_DK 21849 3.88 2.41 4.25 61 T_TooManySym_01 21652 3.87 2.50 4.21 62 T_REMOTE_IMAGE 21444 3.92 2.90 4.17 63 HTML_IMAGE_RATIO_06 19110 3.72 3.74 3.72 64 XMSubMetaSx_00 18535 4.14 6.26 3.61 65 TR_XM_DK_SendGrid 18240 3.27 2.15 3.55 66 RCVD_IN_IADB_VOUCHED 18183 3.01 0.91 3.54 67 TM2_M_URI_OPT_OUT 17736 3.47 3.54 3.45 68 XM_UncommonTLD01 17282 6.13 17.17 3.36 69 IN_ZIMBRA_NJ_WHITELIST 17026 2.65 0.02 3.31 70 BAYES_05 16793 2.96 1.71 3.27 71 BAYES_80 16287 3.89 6.75 3.17 72 MAILING_LIST_MULTI 16023 2.81 1.57 3.12 73 XMNumbers 15743 3.35 4.48 3.06 74 FROM_EXCESS_BASE64 15418 2.88 2.40 3.00 75 XMSexyCombo_05 15218 4.16 8.93 2.96 76 BAYES_99 14929 7.66 26.63 2.90 77 XM_B_COVIDMETA 14920 4.92 12.98 2.90 78 MIME_HTML_ONLY_MULTI 14210 2.83 3.10 2.76 79 XM_H_Trusted_IP 14077 2.19 0.00 2.74 80 RCVD_IN_MSPIKE_BL 13120 3.50 7.28 2.55 81 BOTNET 13052 5.99 19.76 2.54 82 ANY_BOUNCE_MESSAGE 12943 2.07 0.28 2.52 83 BOUNCE_MESSAGE 12939 2.07 0.28 2.52 84 TooManyTo_002 12928 2.15 0.69 2.52 85 RCVD_IN_MSPIKE_L3 12914 3.42 7.03 2.51 86 MIME_HTML_MOSTLY 12196 2.80 4.53 2.37 87 HTML_MIME_NO_HTML_TAG 11441 2.43 3.26 2.23 88 RCVD_IN_IADB_OPTIN 11315 1.88 0.58 2.20 89 BAYES_999 11288 5.92 20.76 2.20 90 HTML_IMAGE_RATIO_08 10925 2.19 2.43 2.13 91 NO_DNS_FOR_FROM 10623 3.13 7.39 2.07 92 T_TooManySym_02 10491 1.76 0.64 2.04 93 XM_CamelCaseFrm001 10394 2.84 6.10 2.02 94 XM_B_SpammyTLD 9909 2.68 5.70 1.93 95 KHOP_HELO_FCRDNS 9646 2.73 6.14 1.88 96 TooManyTo_003 9254 1.55 0.55 1.80 97 UNTRUSTED_Relay 9143 4.25 14.10 1.78 98 TVD_RCVD_IP 9063 1.48 0.34 1.76 99 XM_SPF_SoftFail 9060 2.50 5.43 1.76 100 BAYES_95 8993 2.10 3.48 1.75 101 TR_XM_PhishingBody 8900 1.99 3.02 1.73 102 HELO_NODOT 8872 1.49 0.57 1.73 103 HELO_NO_DOMAIN 8869 1.49 0.57 1.73 104 XM_GoogleGroups 8840 1.48 0.50 1.72 105 XM_DK_Undo_01 8747 1.63 1.33 1.70 106 RELAYCOUNTRY_CA 8398 2.25 4.72 1.63 107 XM_B_Unsub2 8314 1.86 2.81 1.62 108 T_XMDrugObfuBody_14 8187 1.82 2.74 1.59 109 XMNoVowels 8124 1.71 2.23 1.58 110 T_XMDrugObfuBody_08 8106 2.05 3.95 1.58 111 IN_HORDE_ADDRESS_BOOK 8046 1.26 0.04 1.57 112 INVALID_MSGID 7676 1.23 0.19 1.49 113 TR_LOTS_OF_MONEY3 7586 1.75 2.84 1.48 114 T_XMDrugObfuBody_00 7571 1.53 1.75 1.47 115 SUBJ_ALL_CAPS 7368 1.53 1.92 1.43 116 URI_HEX 7367 1.63 2.39 1.43 117 URI_TRY_3LD 7344 1.58 2.17 1.43 118 CK_HELO_DYNAMIC_SPLIT_IP 7277 1.20 0.35 1.42 119 HELO_DYNAMIC_IPADDR2 7268 1.15 0.09 1.41 120 TO_MALFORMED 7230 1.13 0.02 1.41 121 XMCapTrack 7140 1.21 0.51 1.39 122 TooManyTo_004 7098 1.20 0.46 1.38 123 XMDiploma_00 6886 1.47 1.97 1.34 124 TR_Symld_Words 6618 1.36 1.63 1.29 125 DKIM_ADSP_CUSTOM_MED 6458 1.20 0.99 1.26 126 XM_OfRef6 6428 1.70 3.51 1.25 127 TR_DCC_Bayes_99 6272 5.29 21.53 1.22 128 RCVD_IN_BL_SPAMCOP_NET 6213 1.75 3.93 1.21 129 XMSubMetaSxObfu_03 6066 1.10 0.76 1.18 130 TooManyTo_005 5978 1.01 0.39 1.16 131 TR_MetaPhish_Combo_01 5953 1.10 0.87 1.16 132 RELAYCOUNTRY_GB 5843 1.19 1.41 1.14 133 XMSubNoVowel 5760 1.14 1.20 1.12 134 TM2_M_VERY_LONG_WORD 5542 1.20 1.68 1.08 135 XM_UB50 5448 2.67 9.07 1.06 136 XM_H_Long_From02 5258 1.08 1.29 1.02 137 HTML_FONT_FACE_BAD 5149 0.98 0.91 1.00 138 HTTPS_HTTP_MISMATCH 5139 1.04 1.18 1.00 139 TR_XM_PHPDW 5120 1.21 2.05 1.00 140 XMBdyGiftCard01 5056 0.98 0.97 0.98 141 TR_XM_PHPForged 5056 1.19 2.01 0.98 142 TR_XM_FormFill2 5043 1.19 2.00 0.98 143 XM_H_PHPOS 5019 1.18 2.00 0.98 144 T_FILL_THIS_FORM_SHORT 4994 1.08 1.49 0.97 145 NML_ADSP_CUSTOM_MED 4776 0.88 0.70 0.93 146 USER_IN_DEF_DKIM_WL 4767 0.74 0.00 0.93 147 XMGappySubj_01 4650 0.76 0.16 0.90 148 XM_ProductURIs 4560 0.88 0.85 0.89 149 XMBrknScrpt_02 4402 0.95 1.32 0.86 150 XMGenDplmaNmb 4392 0.95 1.34 0.85 151 XMMoneyMeta_00 4272 0.86 0.99 0.83 152 SpammyFromTLD_01 4207 1.42 3.80 0.82 153 XMStockSpam_06 4157 0.91 1.33 0.81 154 XMHTML_After_End 3968 1.54 4.58 0.77 155 XM_GRM 3913 0.61 0.00 0.76 156 TO_NO_BRKTS_HTML_ONLY 3865 0.63 0.14 0.75 157 HTML_TAG_BALANCE_BODY 3723 0.69 0.57 0.72 158 TR_MSPIKEBAYES00 3647 0.57 0.01 0.71 159 XM_DIRTYINTL 3553 1.17 3.10 0.69 160 T_XMHurry_00 3374 1.02 2.45 0.66 161 RELAYCOUNTRY_DE 3321 1.13 3.05 0.65 162 MISSING_HEADERS 3245 0.77 1.32 0.63 163 URIBL_SBL_A 3194 1.42 4.60 0.62 164 XMPhish08 3160 0.70 1.06 0.61 165 T_Symld_Words_02 3146 0.88 1.95 0.61 166 T_TooManySym_03 3138 0.54 0.24 0.61 167 XM_SPF_Unknown 3054 0.59 0.59 0.59 168 T_OBFU_PDF_ATTACH 3024 0.50 0.17 0.59 169 XMPhish14 2959 0.63 0.86 0.58 170 RCVD_IN_SORBS_DUL 2897 0.47 0.08 0.56 171 FORGED_GMAIL_RCVD 2828 0.61 0.85 0.55 172 XMSubMetaI_00 2744 0.62 0.97 0.53 173 XM_ShortIntro_01 2687 0.49 0.38 0.52 174 XMPhish30 2637 0.63 1.09 0.51 175 HTML_IMAGE_ONLY_20 2591 0.47 0.35 0.50 176 XMBody_17 2513 0.98 2.95 0.49 177 PDS_OTHER_BAD_TLD 2465 1.05 3.34 0.48 178 RELAYCOUNTRY_AU 2453 0.50 0.59 0.48 179 TM2_M_BODY_EMPTY 2432 0.40 0.11 0.47 180 XMHTMLBadTable_001 2398 0.46 0.42 0.47 181 TVD_PH_BODY_ACCOUNTS_PRE 2383 0.39 0.09 0.46 182 FROM_GOV_DKIM_AU 2377 0.41 0.22 0.46 183 FROM_GOV_SPOOF 2322 0.45 0.46 0.45 184 XM_H_PHPMailer 2309 0.52 0.78 0.45 185 HTML_IMAGE_ONLY_32 2287 0.39 0.20 0.44 186 XM_RXBody 2276 0.42 0.33 0.44 187 MSGID_FROM_MTA_HEADER 2272 0.40 0.21 0.44 188 XM_B_REG_HTML 2209 0.40 0.29 0.43 189 HTML_IMAGE_ONLY_28 2190 0.43 0.44 0.43 190 XMSexyCombo_01 2182 0.68 1.68 0.42 191 SHORT_HELO_AND_INLINE_IMAGE 2168 0.35 0.04 0.42 192 MPART_ALT_DIFF_COUNT 2119 0.58 1.25 0.41 193 AC_DIV_BONANZA 2099 0.36 0.16 0.41 194 URI_NOVOWEL 2089 0.50 0.86 0.41 195 USER_IN_WHITELIST 1919 0.30 0.00 0.37 196 XM_Body_Obfu01 1894 0.39 0.46 0.37 197 DIET_1 1867 0.47 0.88 0.36 198 TVD_SPACE_RATIO 1819 0.39 0.54 0.35 199 GMD_PDF_EMPTY_BODY 1818 0.30 0.10 0.35 200 RDNS_DYNAMIC 1798 1.01 3.65 0.35 ----------------------------------------------------------------------