Email: 711213 Autolearn: 0 AvgScore: 0.18 AvgScanTime: 2.11 sec Spam: 141322 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 3.61 sec Ham: 569891 Autolearn: 0 AvgScore: -2.89 AvgScanTime: 1.74 sec Time Spent Running SA: 417.03 hours Time Spent Processing Spam: 141.83 hours Time Spent Processing Ham: 275.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136752 91.82 96.77 90.60 2 DCC_CHECK 117693 45.43 83.28 36.05 3 RELAYCOUNTRY_US 103976 82.34 73.57 84.51 4 DKIM_SIGNED 103096 66.74 72.95 65.20 5 XM_DK_Pass 100795 65.47 71.32 64.02 6 XM_B_Unicode 96905 73.22 68.57 74.37 7 XMListUnsubscribeExists 88166 47.13 62.39 43.35 8 DKIM_VALID 85240 60.06 60.32 60.00 9 BAYES_50 72710 48.35 51.45 47.59 10 DKIM_VALID_AU 64921 44.68 45.94 44.36 11 MIME_HTML_ONLY 64261 30.15 45.47 26.36 12 XM_B_Unicode3 54953 41.82 38.88 42.55 13 XM_DK_Undo_02 50911 12.15 36.02 6.23 14 LOC_TINY_FONT_1 44524 22.17 31.51 19.86 15 HTML_FONT_LOW_CONTRAST 40699 25.15 28.80 24.25 16 FSL_BULK_SIG 35908 10.94 25.41 7.36 17 DKIM_VALID_EF 35414 23.58 25.06 23.21 18 T_KAM_HTML_FONT_INVALID 33730 17.41 23.87 15.81 19 FVGT_m_MULTI_ODD 32366 19.90 22.90 19.16 20 XM_UncommonTLD01 31742 6.81 22.46 2.93 21 BAYES_99 31517 6.78 22.30 2.93 22 BOTNET 31505 6.55 22.29 2.65 23 XMSubLong 30326 19.43 21.46 18.93 24 RELAYCOUNTRY_META 27222 7.76 19.26 4.91 25 T_TM2_M_HEADER_IN_MSG 27111 23.99 19.18 25.18 26 TR_DCC_Bayes_99 25003 4.56 17.69 1.31 27 BAYES_999 24574 5.27 17.39 2.27 28 XM_Body_Dirty_Words 23859 12.15 16.88 10.98 29 LOTS_OF_MONEY 23539 9.12 16.66 7.25 30 XM_Multi_Part_URI 22966 11.32 16.25 10.10 31 DCC_CHECK_NEGATIVE 21673 52.84 15.34 62.14 32 BOTNET_IPINHOSTNAME 20483 6.13 14.49 4.06 33 UNTRUSTED_Relay 18798 3.88 13.30 1.54 34 XM_B_Phish_Phrases 18737 8.23 13.26 6.98 35 DKIM_INVALID 17856 6.68 12.63 5.20 36 REPLYTO_WITHOUT_TO_CC 17570 2.59 12.43 0.15 37 XM_B_Unsub 15723 9.48 11.13 9.07 38 XM_Evil_Numbers_Gen 14982 8.82 10.60 8.38 39 NO_DNS_FOR_FROM 14040 4.45 9.93 3.10 40 XMSexyCombo_05 13687 4.69 9.68 3.46 41 HTML_IMAGE_RATIO_02 13328 6.19 9.43 5.39 42 LotsOfNums_01 12624 7.44 8.93 7.07 43 RCVD_IN_MSPIKE_H2 12483 12.64 8.83 13.59 44 ALL_TRUSTED 11786 11.45 8.34 12.22 45 XM_UB50 11419 2.32 8.08 0.89 46 XM_B_COVIDMETA 11393 3.71 8.06 2.63 47 T_REMOTE_IMAGE 11229 4.10 7.95 3.14 48 SpammyFromTLD_02 11224 1.77 7.94 0.24 49 MISSING_HEADERS 10979 2.16 7.77 0.77 50 XM_H_Long_From01 10586 5.26 7.49 4.70 51 TO_NO_BRKTS_FROM_MSSP 10482 1.48 7.42 0.01 52 FROM_MISSP_EH_MATCH 10452 1.47 7.40 0.01 53 FORGED_OUTLOOK_HTML 10440 1.47 7.39 0.01 54 FORGED_MUA_OUTLOOK 10418 1.47 7.37 0.01 55 FROM_MISSPACED 10412 1.47 7.37 0.00 56 FORGED_OUTLOOK_TAGS 10368 1.47 7.34 0.01 57 FROM_MISSP_MSFT 10366 1.46 7.34 0.00 58 FROM_MISSP_XPRIO 10366 1.46 7.34 0.00 59 FSL_NEW_HELO_USER 10365 1.46 7.33 0.00 60 FSL_CTYPE_WIN1251 10362 1.46 7.33 0.00 61 AXB_XMAILER_MIMEOLE_OL_024C2 10354 1.46 7.33 0.00 62 NSL_RCVD_HELO_USER 10354 1.46 7.33 0.00 63 KHOP_HELO_FCRDNS 10226 4.31 7.24 3.59 64 XM_SPF_SoftFail 9968 2.70 7.05 1.62 65 XMSubMetaSx_00 9843 3.47 6.96 2.60 66 SUBJ_ALL_CAPS 9753 2.53 6.90 1.44 67 XM_CamelCaseFrm001 9303 2.67 6.58 1.70 68 HTML_SHORT_LINK_IMG_1 9205 1.30 6.51 0.01 69 MIME_HEADER_CTYPE_ONLY 9180 1.49 6.50 0.25 70 HDRS_LCASE_IMGONLY 9131 1.29 6.46 0.01 71 RCVD_IN_MSPIKE_BL 8769 2.72 6.20 1.86 72 RCVD_IN_MSPIKE_L3 8662 2.70 6.13 1.84 73 MPART_ALT_DIFF 8476 11.39 6.00 12.73 74 XM_OfRef6 8409 1.95 5.95 0.95 75 BAYES_80 8322 3.12 5.89 2.43 76 BAYES_60 7904 4.78 5.59 4.58 77 XMNumbers 7764 3.40 5.49 2.88 78 TooManyTo_001 7542 7.06 5.34 7.48 79 HTML_IMAGE_RATIO_04 7514 13.29 5.32 15.26 80 T_MONEY_PERCENT 7500 1.58 5.31 0.66 81 TR_LOTS_OF_MONEY2 7500 1.58 5.31 0.66 82 UNPARSEABLE_RELAY 7492 7.46 5.30 8.00 83 SHORT_SHORTNER 7235 1.04 5.12 0.03 84 MIME_QP_LONG_LINE 7121 5.08 5.04 5.10 85 SHORT_URI_2 7068 1.01 5.00 0.02 86 HTML_IMAGE_ONLY_04 6997 1.03 4.95 0.06 87 HTML_SHORT_CENTER 6835 0.96 4.84 0.00 88 TO_EQ_FM_DOM_HTML_IMG 6831 0.96 4.83 0.01 89 RCVD_IN_BL_SPAMCOP_NET 6810 1.80 4.82 1.05 90 RELAYCOUNTRY_CA 6248 1.99 4.42 1.39 91 XMBody_17 5983 1.32 4.23 0.60 92 DEAR_SOMETHING 5661 0.97 4.01 0.22 93 HK_SCAM 5553 0.85 3.93 0.09 94 BAYES_40 5483 6.29 3.88 6.88 95 XM_SendGrid 5482 5.76 3.88 6.22 96 FILL_THIS_FORM 5369 0.95 3.80 0.25 97 TR_LOTS_OF_MONEY1 5351 0.84 3.79 0.11 98 MONEY_FRAUD_5 5307 0.75 3.76 0.00 99 TR_Mismatch_TLD_02 5258 0.79 3.72 0.07 100 FORM_FRAUD_5 5255 0.74 3.72 0.00 101 T_FILL_THIS_FORM_LOAN 5254 0.83 3.72 0.11 102 MONEY_FROM_MISSP 5205 0.73 3.68 0.00 103 TR_Mismatch_TLD_01 5161 0.85 3.65 0.15 104 FROM_SUSPICIOUS_NTLD 5141 0.76 3.64 0.05 105 FOUND_YOU 5134 0.72 3.63 0.00 106 BOMB_MONEY 5128 0.72 3.63 0.00 107 FROM_SUSPICIOUS_NTLD_FP 5027 0.74 3.56 0.05 108 TR_XM_PhishingBody 4832 1.52 3.42 1.04 109 BAYES_20 4760 5.89 3.37 6.52 110 XM_B_SpammyTLD 4674 2.04 3.31 1.73 111 TM2_M_URI_OPT_OUT 4671 2.71 3.31 2.56 112 HTML_MIME_NO_HTML_TAG 4627 2.26 3.27 2.01 113 RDNS_DYNAMIC 4586 0.91 3.25 0.34 114 MIME_HTML_MOSTLY 4558 2.37 3.23 2.16 115 LongTLD 4550 0.75 3.22 0.14 116 URIBL_SBL_A 4501 0.76 3.18 0.16 117 RCVD_IN_MSPIKE_H3 4445 7.12 3.15 8.11 118 RCVD_IN_MSPIKE_WL 4445 7.12 3.15 8.11 119 XMStrtUSub 4341 8.08 3.07 9.32 120 XMMoneyMeta_00 4313 1.12 3.05 0.64 121 T_XMDrugObfuBody_08 4260 1.60 3.01 1.25 122 BAYES_95 4119 1.75 2.91 1.46 123 XM_DIRTYINTL 4110 0.97 2.91 0.49 124 BAYES_00 4103 18.98 2.90 22.97 125 HTML_IMAGE_RATIO_06 4101 3.99 2.90 4.26 126 MIME_HTML_ONLY_MULTI 4072 9.30 2.88 10.89 127 URI_HEX 3941 1.70 2.79 1.43 128 T_TooManySym_01 3920 3.41 2.77 3.56 129 XM_URI_RBL 3890 0.67 2.75 0.15 130 FROM_EXCESS_BASE64 3709 2.60 2.62 2.59 131 RELAYCOUNTRY_IN 3698 0.58 2.62 0.07 132 XMDiploma_00 3683 1.53 2.61 1.27 133 FROM_MISSP_REPLYTO 3651 0.52 2.58 0.00 134 RELAYCOUNTRY_FR 3587 0.68 2.54 0.22 135 SpammyFromTLD_01 3519 1.06 2.49 0.71 136 TR_XM_MaxBayes 3419 0.49 2.42 0.01 137 XMSexyCombo_01 3406 0.83 2.41 0.43 138 PDS_OTHER_BAD_TLD 3378 0.87 2.39 0.50 139 RCVD_IN_RP_RNBL 3363 0.53 2.38 0.07 140 XM_B_Unsub2 3343 1.89 2.37 1.77 141 BODY_URI_ONLY 3183 0.52 2.25 0.09 142 HTML_IMAGE_RATIO_08 3108 1.87 2.20 1.79 143 TR_XM_PHPDW 3085 0.78 2.18 0.43 144 DATE_IN_PAST_03_06 3082 0.55 2.18 0.14 145 FROM_MISSP_DYNIP 3061 0.43 2.17 0.00 146 TR_XM_PHPForged 2986 0.75 2.11 0.42 147 TR_XM_FormFill2 2965 0.75 2.10 0.41 148 XM_H_PHPOS 2959 0.75 2.09 0.41 149 RCVD_IN_RP_SAFE 2931 5.94 2.07 6.90 150 RCVD_IN_IADB_LISTED 2903 3.91 2.05 4.38 151 T_XMHurry_00 2888 0.74 2.04 0.42 152 TR_XM_INV_DKIM 2825 0.49 2.00 0.12 153 T_XMDrugObfuBody_14 2803 1.42 1.98 1.28 154 TR_XM_COVIDMETA4 2725 0.60 1.93 0.28 155 RCVD_IN_IADB_SPF 2690 3.42 1.90 3.79 156 RCVD_IN_IADB_DK 2639 2.98 1.87 3.26 157 RCVD_IN_IADB_SENDERID 2629 3.03 1.86 3.32 158 FVGT_m_MULTI_ODD_EMAIL 2628 0.39 1.86 0.03 159 DKIM_ADSP_NXDOMAIN 2521 0.70 1.78 0.43 160 RELAYCOUNTRY_DE 2516 0.78 1.78 0.53 161 TR_LOTS_OF_MONEY3 2492 0.67 1.76 0.40 162 BAYES_05 2402 4.06 1.70 4.65 163 HTML_IMAGE_ONLY_08 2394 0.43 1.69 0.11 164 HDRS_MISSP 2377 0.39 1.68 0.07 165 SUBJ_DOLLARS 2287 0.48 1.62 0.19 166 XM_DK_Undo_01 2199 1.74 1.56 1.79 167 TR_XM_MaxSPIKE 2195 0.41 1.55 0.13 168 SHORT_IMG_SUSP_NTLD 2175 0.31 1.54 0.00 169 TM2_M_VERY_LONG_WORD 2174 1.22 1.54 1.14 170 DATE_IN_PAST_06_12 2169 0.42 1.53 0.14 171 T_XMDrugObfuBody_00 2166 0.84 1.53 0.67 172 TR_XM_DK_SendGrid 2071 2.99 1.47 3.37 173 URI_TRY_3LD 1966 1.07 1.39 0.99 174 LOADSA_MONEY_COMBO 1958 0.29 1.39 0.02 175 XMGenDplmaNmb 1954 0.91 1.38 0.79 176 XMStockSpam_06 1948 1.20 1.38 1.16 177 TR_XM_DK_Bayes 1946 9.55 1.38 11.58 178 XMPhish14 1911 0.50 1.35 0.29 179 BOTNET_NORDNS 1872 0.27 1.32 0.01 180 FROM_DOMAIN_NOVOWEL 1866 0.29 1.32 0.03 181 T_FILL_THIS_FORM_SHORT 1866 1.08 1.32 1.01 182 XMBdyGiftCard01 1829 0.85 1.29 0.75 183 HK_RANDOM_REPLYTO 1801 0.36 1.27 0.14 184 TVD_RCVD_IP 1771 1.59 1.25 1.67 185 FROM_ADDR_WS 1753 0.25 1.24 0.01 186 MAILING_LIST_MULTI 1730 1.96 1.22 2.15 187 URI_NOVOWEL 1727 0.52 1.22 0.34 188 TR_Symld_Words 1686 1.21 1.19 1.21 189 RCVD_IN_RP_CERTIFIED 1682 5.17 1.19 6.15 190 RELAYCOUNTRY_GB 1616 1.06 1.14 1.04 191 XMHTML_After_End 1613 0.68 1.14 0.57 192 XMPhish30 1590 0.45 1.13 0.29 193 TR_XM_RelayPhish 1580 0.33 1.12 0.13 194 DKIM_ADSP_CUSTOM_MED 1555 1.14 1.10 1.15 195 TR_MetaPhish_Combo_01 1552 0.87 1.10 0.81 196 XM_H_PHPMailer 1436 0.55 1.02 0.44 197 XMSubMetaSxObfu_03 1421 0.53 1.01 0.41 198 XMPhish08 1414 0.56 1.00 0.45 199 PLING_QUERY 1396 0.38 0.99 0.23 200 SUBJ_BUY 1395 0.25 0.99 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 516312 91.82 96.77 90.60 2 RELAYCOUNTRY_US 481612 82.34 73.57 84.51 3 XM_B_Unicode 423828 73.22 68.57 74.37 4 DKIM_SIGNED 371572 66.74 72.95 65.20 5 XM_DK_Pass 364842 65.47 71.32 64.02 6 DCC_CHECK_NEGATIVE 354146 52.84 15.34 62.14 7 DKIM_VALID 341948 60.06 60.32 60.00 8 BAYES_50 271195 48.35 51.45 47.59 9 DKIM_VALID_AU 252816 44.68 45.94 44.36 10 XMListUnsubscribeExists 247038 47.13 62.39 43.35 11 XM_B_Unicode3 242488 41.82 38.88 42.55 12 DCC_CHECK 205435 45.43 83.28 36.05 13 MIME_HTML_ONLY 150201 30.15 45.47 26.36 14 T_TM2_M_HEADER_IN_MSG 143509 23.99 19.18 25.18 15 HTML_FONT_LOW_CONTRAST 138178 25.15 28.80 24.25 16 DKIM_VALID_EF 132278 23.58 25.06 23.21 17 BAYES_00 130890 18.98 2.90 22.97 18 LOC_TINY_FONT_1 113183 22.17 31.51 19.86 19 FVGT_m_MULTI_ODD 109183 19.90 22.90 19.16 20 XMSubLong 107873 19.43 21.46 18.93 21 HTML_FONT_FACE_BAD 91964 13.04 0.54 16.14 22 T_KAM_HTML_FONT_INVALID 90119 17.41 23.87 15.81 23 HTML_IMAGE_RATIO_04 86972 13.29 5.32 15.26 24 RCVD_IN_MSPIKE_H2 77431 12.64 8.83 13.59 25 MPART_ALT_DIFF 72521 11.39 6.00 12.73 26 ALL_TRUSTED 69617 11.45 8.34 12.22 27 XM_H_Trusted_IP 68627 9.65 0.00 12.04 28 TR_XM_DK_Bayes 65985 9.55 1.38 11.58 29 XM_Body_Dirty_Words 62553 12.15 16.88 10.98 30 MIME_HTML_ONLY_MULTI 62074 9.30 2.88 10.89 31 TR_XM_DK_Bayes1 61864 8.86 0.82 10.86 32 XM_Multi_Part_URI 57574 11.32 16.25 10.10 33 TR_XM_DK_Bayes2 54359 7.77 0.63 9.54 34 XMStrtUSub 53128 8.08 3.07 9.32 35 XM_B_Unsub 51701 9.48 11.13 9.07 36 XM_Evil_Numbers_Gen 47735 8.82 10.60 8.38 37 RCVD_IN_MSPIKE_H3 46198 7.12 3.15 8.11 38 RCVD_IN_MSPIKE_WL 46198 7.12 3.15 8.11 39 UNPARSEABLE_RELAY 45592 7.46 5.30 8.00 40 TooManyTo_001 42649 7.06 5.34 7.48 41 FSL_BULK_SIG 41929 10.94 25.41 7.36 42 LOTS_OF_MONEY 41310 9.12 16.66 7.25 43 LotsOfNums_01 40316 7.44 8.93 7.07 44 XM_B_Phish_Phrases 39785 8.23 13.26 6.98 45 RCVD_IN_RP_SAFE 39338 5.94 2.07 6.90 46 BAYES_40 39223 6.29 3.88 6.88 47 BAYES_20 37132 5.89 3.37 6.52 48 XM_DK_Undo_02 35481 12.15 36.02 6.23 49 XM_SendGrid 35450 5.76 3.88 6.22 50 RCVD_IN_RP_CERTIFIED 35062 5.17 1.19 6.15 51 IN_ZIMBRA_NJ_WHITELIST 34832 4.90 0.03 6.11 52 XM_DKIMWhitelistDomains 32529 4.59 0.10 5.71 53 HTML_IMAGE_RATIO_02 30730 6.19 9.43 5.39 54 DKIM_INVALID 29624 6.68 12.63 5.20 55 MIME_QP_LONG_LINE 29042 5.08 5.04 5.10 56 XMSubNoVowel 28493 4.15 0.73 5.00 57 RELAYCOUNTRY_META 27958 7.76 19.26 4.91 58 XM_H_Long_From01 26795 5.26 7.49 4.70 59 BAYES_05 26505 4.06 1.70 4.65 60 BAYES_60 26102 4.78 5.59 4.58 61 RCVD_IN_IADB_LISTED 24938 3.91 2.05 4.38 62 HTML_IMAGE_RATIO_06 24249 3.99 2.90 4.26 63 BOTNET_IPINHOSTNAME 23128 6.13 14.49 4.06 64 RCVD_IN_IADB_SPF 21612 3.42 1.90 3.79 65 XM_PDF 20569 3.04 0.73 3.61 66 KHOP_HELO_FCRDNS 20436 4.31 7.24 3.59 67 T_TooManySym_01 20300 3.41 2.77 3.56 68 XMSexyCombo_05 19697 4.69 9.68 3.46 69 TR_XM_DK_SendGrid 19220 2.99 1.47 3.37 70 RCVD_IN_IADB_SENDERID 18913 3.03 1.86 3.32 71 RCVD_IN_IADB_DK 18571 2.98 1.87 3.26 72 T_REMOTE_IMAGE 17918 4.10 7.95 3.14 73 NO_DNS_FOR_FROM 17639 4.45 9.93 3.10 74 ANY_BOUNCE_MESSAGE 16898 2.46 0.43 2.97 75 BOUNCE_MESSAGE 16891 2.46 0.43 2.96 76 XM_UncommonTLD01 16686 6.81 22.46 2.93 77 BAYES_99 16683 6.78 22.30 2.93 78 XMNumbers 16419 3.40 5.49 2.88 79 RCVD_IN_IADB_VOUCHED 15768 2.34 0.60 2.77 80 BOTNET 15083 6.55 22.29 2.65 81 XM_B_COVIDMETA 14996 3.71 8.06 2.63 82 XMSubMetaSx_00 14830 3.47 6.96 2.60 83 FROM_EXCESS_BASE64 14776 2.60 2.62 2.59 84 TM2_M_URI_OPT_OUT 14579 2.71 3.31 2.56 85 BAYES_80 13857 3.12 5.89 2.43 86 BAYES_999 12915 5.27 17.39 2.27 87 MIME_HTML_MOSTLY 12282 2.37 3.23 2.16 88 MAILING_LIST_MULTI 12238 1.96 1.22 2.15 89 TooManyTo_002 11796 1.77 0.56 2.07 90 HTML_MIME_NO_HTML_TAG 11428 2.26 3.27 2.01 91 RCVD_IN_MSPIKE_BL 10610 2.72 6.20 1.86 92 RCVD_IN_MSPIKE_L3 10513 2.70 6.13 1.84 93 HTML_IMAGE_RATIO_08 10183 1.87 2.20 1.79 94 XM_DK_Undo_01 10176 1.74 1.56 1.79 95 XM_B_Unsub2 10108 1.89 2.37 1.77 96 RCVD_IN_IADB_OPTIN 9950 1.47 0.34 1.75 97 XM_B_SpammyTLD 9858 2.04 3.31 1.73 98 T_TooManySym_02 9699 1.50 0.70 1.70 99 XM_CamelCaseFrm001 9695 2.67 6.58 1.70 100 TVD_RCVD_IP 9502 1.59 1.25 1.67 101 XM_SPF_SoftFail 9257 2.70 7.05 1.62 102 UNTRUSTED_Relay 8783 3.88 13.30 1.54 103 XM_E_Blogspot 8753 1.25 0.11 1.54 104 BAYES_95 8300 1.75 2.91 1.46 105 SUBJ_ALL_CAPS 8209 2.53 6.90 1.44 106 HELO_NODOT 8166 1.26 0.59 1.43 107 HELO_NO_DOMAIN 8161 1.26 0.59 1.43 108 URI_HEX 8133 1.70 2.79 1.43 109 TooManyTo_003 8117 1.23 0.45 1.42 110 RELAYCOUNTRY_CA 7939 1.99 4.42 1.39 111 INVALID_MSGID 7739 1.12 0.18 1.36 112 IN_HORDE_ADDRESS_BOOK 7561 1.07 0.05 1.33 113 XMSubLongNoVowel 7542 1.09 0.15 1.32 114 TR_DCC_Bayes_99 7462 4.56 17.69 1.31 115 CK_HELO_DYNAMIC_SPLIT_IP 7391 1.22 0.90 1.30 116 HELO_DYNAMIC_IPADDR2 7384 1.19 0.77 1.30 117 T_XMDrugObfuBody_14 7287 1.42 1.98 1.28 118 XMDiploma_00 7223 1.53 2.61 1.27 119 TO_MALFORMED 7187 1.02 0.05 1.26 120 T_XMDrugObfuBody_08 7144 1.60 3.01 1.25 121 XMSubGarbage 7033 0.99 0.03 1.23 122 TR_Symld_Words 6923 1.21 1.19 1.21 123 XM_GoogleGroups 6900 1.06 0.47 1.21 124 XMStockSpam_06 6597 1.20 1.38 1.16 125 DKIM_ADSP_CUSTOM_MED 6530 1.14 1.10 1.15 126 TM2_M_VERY_LONG_WORD 6522 1.22 1.54 1.14 127 TooManyTo_004 6371 0.97 0.38 1.12 128 XMCapTrack 6262 0.96 0.42 1.10 129 RCVD_IN_BL_SPAMCOP_NET 6004 1.80 4.82 1.05 130 TR_XM_PhishingBody 5953 1.52 3.42 1.04 131 RELAYCOUNTRY_GB 5916 1.06 1.14 1.04 132 T_FILL_THIS_FORM_SHORT 5781 1.08 1.32 1.01 133 URI_TRY_3LD 5645 1.07 1.39 0.99 134 XM_OfRef6 5432 1.95 5.95 0.95 135 TooManyTo_005 5412 0.82 0.32 0.95 136 XM_UB50 5098 2.32 8.08 0.89 137 NML_ADSP_CUSTOM_MED 5003 0.89 0.93 0.88 138 XMGappySubj_01 4701 0.69 0.13 0.82 139 XM_H_Long_From02 4675 0.81 0.78 0.82 140 USER_IN_DEF_DKIM_WL 4663 0.66 0.00 0.82 141 TR_MetaPhish_Combo_01 4636 0.87 1.10 0.81 142 XMGenDplmaNmb 4508 0.91 1.38 0.79 143 MISSING_HEADERS 4415 2.16 7.77 0.77 144 XMBdyGiftCard01 4249 0.85 1.29 0.75 145 SpammyFromTLD_01 4037 1.06 2.49 0.71 146 HTTPS_HTTP_MISMATCH 4016 0.73 0.81 0.70 147 XM_RXBody 3805 0.67 0.68 0.67 148 T_XMDrugObfuBody_00 3800 0.84 1.53 0.67 149 FROM_GOV_DKIM_AU 3786 0.60 0.33 0.66 150 T_MONEY_PERCENT 3768 1.58 5.31 0.66 151 TR_LOTS_OF_MONEY2 3768 1.58 5.31 0.66 152 XMMoneyMeta_00 3623 1.12 3.05 0.64 153 XM_SPF_Unknown 3427 0.59 0.53 0.60 154 XMBody_17 3424 1.32 4.23 0.60 155 XMSubMetaI_00 3302 0.63 0.81 0.58 156 XMHTML_After_End 3229 0.68 1.14 0.57 157 TR_MSPIKEBAYES00 3127 0.44 0.00 0.55 158 T_TooManySym_03 3070 0.48 0.23 0.54 159 RELAYCOUNTRY_DE 3020 0.78 1.78 0.53 160 XMNoVowels 3008 0.55 0.65 0.53 161 XMSolicitRefs_0 2997 0.51 0.47 0.53 162 PDS_OTHER_BAD_TLD 2836 0.87 2.39 0.50 163 T_OBFU_PDF_ATTACH 2811 0.43 0.17 0.49 164 XM_DIRTYINTL 2800 0.97 2.91 0.49 165 XM_ProductURIs 2698 0.54 0.81 0.47 166 XM_ShortIntro_01 2621 0.46 0.46 0.46 167 RCVD_IN_SORBS_DUL 2621 0.38 0.06 0.46 168 XMPhish08 2549 0.56 1.00 0.45 169 XMBrknScrpt_02 2542 0.50 0.73 0.45 170 XM_H_PHPMailer 2492 0.55 1.02 0.44 171 TR_XM_PHPDW 2474 0.78 2.18 0.43 172 XMSexyCombo_01 2474 0.83 2.41 0.43 173 DKIM_ADSP_NXDOMAIN 2450 0.70 1.78 0.43 174 FORGED_GMAIL_RCVD 2417 0.52 0.93 0.42 175 T_XMHurry_00 2379 0.74 2.04 0.42 176 TR_XM_PHPForged 2369 0.75 2.11 0.42 177 TR_XM_FormFill2 2362 0.75 2.10 0.41 178 XMHTMLBadTable_001 2348 0.43 0.53 0.41 179 XM_H_PHPOS 2341 0.75 2.09 0.41 180 XMSubMetaSxObfu_03 2332 0.53 1.01 0.41 181 XMLngstWrd_00 2305 0.38 0.28 0.40 182 HTML_IMAGE_ONLY_20 2274 0.38 0.28 0.40 183 TR_LOTS_OF_MONEY3 2260 0.67 1.76 0.40 184 T_Symld_Words_02 2247 0.50 0.90 0.39 185 RELAYCOUNTRY_AU 2233 0.42 0.52 0.39 186 FUZZY_CREDIT 2187 0.33 0.11 0.38 187 T_MANY_PILL_PRICE 2148 0.32 0.08 0.38 188 MPART_ALT_DIFF_COUNT 2131 0.44 0.72 0.37 189 HTML_TAG_BALANCE_BODY 2125 0.42 0.62 0.37 190 TM2_M_BODY_EMPTY 2106 0.31 0.08 0.37 191 XM_B_REG_HTML 2079 0.37 0.39 0.36 192 SHORT_HELO_AND_INLINE_IMAGE 2000 0.29 0.04 0.35 193 FROM_GOV_SPOOF 1970 0.31 0.19 0.35 194 XMLngstWrd_01 1969 0.32 0.24 0.35 195 URI_NOVOWEL 1960 0.52 1.22 0.34 196 HTML_IMAGE_ONLY_24 1924 0.34 0.36 0.34 197 RDNS_DYNAMIC 1919 0.91 3.25 0.34 198 T_HTML_TAG_BALANCE_CENTER 1918 0.33 0.32 0.34 199 XMSubMetaSxObfu_02 1917 0.32 0.26 0.34 200 USER_IN_WHITELIST 1846 0.26 0.00 0.32 ----------------------------------------------------------------------