Email: 372620 Autolearn: 0 AvgScore: 1.99 AvgScanTime: 1.95 sec Spam: 84917 Autolearn: 0 AvgScore: 12.58 AvgScanTime: 3.08 sec Ham: 287703 Autolearn: 0 AvgScore: -1.13 AvgScanTime: 1.61 sec Time Spent Running SA: 201.70 hours Time Spent Processing Spam: 72.67 hours Time Spent Processing Ham: 129.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77796 87.01 91.61 85.65 2 DCC_CHECK 68554 55.11 80.73 47.55 3 RELAYCOUNTRY_US 66697 80.02 78.54 80.45 4 DKIM_SIGNED 66262 78.28 78.03 78.35 5 XM_DK_Pass 64590 77.12 76.06 77.44 6 XM_B_Unicode 60269 70.21 70.97 69.99 7 XMListUnsubscribeExists 57714 59.00 67.97 56.36 8 DKIM_VALID 56667 72.24 66.73 73.86 9 DKIM_VALID_AU 44360 57.89 52.24 59.56 10 XM_DK_Undo_02 37785 16.41 44.50 8.12 11 BAYES_50 35290 50.38 41.56 52.98 12 MIME_HTML_ONLY 32178 25.30 37.89 21.58 13 XM_B_Unicode3 31779 41.98 37.42 43.32 14 BAYES_99 25365 10.14 29.87 4.31 15 DKIM_VALID_EF 25156 27.83 29.62 27.30 16 LOC_TINY_FONT_1 24320 28.81 28.64 28.86 17 HTML_FONT_LOW_CONTRAST 22652 29.06 26.68 29.76 18 XM_UncommonTLD01 21330 8.73 25.12 3.89 19 FVGT_m_MULTI_ODD 21178 23.78 24.94 23.44 20 T_KAM_HTML_FONT_INVALID 20233 18.64 23.83 17.11 21 RELAYCOUNTRY_META 20065 9.51 23.63 5.34 22 TR_DCC_Bayes_99 19702 6.94 23.20 2.13 23 BAYES_999 19636 7.93 23.12 3.45 24 BOTNET 17815 6.81 20.98 2.63 25 XM_Body_Dirty_Words 17336 15.09 20.42 13.52 26 XMSubLong 17294 20.31 20.37 20.29 27 T_TM2_M_HEADER_IN_MSG 16197 21.85 19.07 22.67 28 DCC_CHECK_NEGATIVE 15003 43.48 17.67 51.09 29 XM_Multi_Part_URI 14056 15.13 16.55 14.71 30 LOTS_OF_MONEY 13596 9.99 16.01 8.21 31 FSL_BULK_SIG 13190 9.46 15.53 7.67 32 BOTNET_IPINHOSTNAME 12035 8.13 14.17 6.34 33 UNTRUSTED_Relay 11690 4.44 13.77 1.68 34 XM_CamelCaseFrm001 10429 4.72 12.28 2.49 35 HTML_IMAGE_RATIO_02 9979 9.67 11.75 9.05 36 XMSexyCombo_05 9648 5.66 11.36 3.98 37 DKIM_INVALID 9595 6.04 11.30 4.49 38 RCVD_IN_MSPIKE_H2 8574 13.86 10.10 14.97 39 XM_B_Phish_Phrases 7659 8.07 9.02 7.78 40 XM_B_Unsub 7639 9.24 9.00 9.31 41 NO_DNS_FOR_FROM 7333 3.73 8.64 2.28 42 LotsOfNums_01 7192 8.93 8.47 9.07 43 XM_Evil_Numbers_Gen 7008 9.10 8.25 9.35 44 XM_H_Long_From01 6977 6.11 8.22 5.49 45 BAYES_80 6870 4.46 8.09 3.39 46 RELAYCOUNTRY_CA 6545 3.27 7.71 1.96 47 XM_UB50 6266 2.44 7.38 0.98 48 URIBL_SBL_A 6225 1.82 7.33 0.20 49 RCVD_IN_MSPIKE_BL 5991 2.77 7.06 1.51 50 XMSubMetaSx_00 5982 4.98 7.04 4.37 51 BAYES_60 5967 6.34 7.03 6.14 52 XMBody_17 5635 2.17 6.64 0.85 53 RCVD_IN_MSPIKE_L3 5389 2.58 6.35 1.47 54 KHOP_HELO_FCRDNS 5153 2.29 6.07 1.18 55 TooManyTo_001 4789 7.26 5.64 7.73 56 UNPARSEABLE_RELAY 4692 8.01 5.53 8.74 57 HTML_IMAGE_RATIO_04 4572 6.04 5.38 6.24 58 MPART_ALT_DIFF 4455 6.13 5.25 6.39 59 RCVD_IN_RP_RNBL 4422 1.29 5.21 0.13 60 TR_XM_MaxBayes 4310 1.18 5.08 0.03 61 TR_XM_COVIDMETA4 4212 1.92 4.96 1.02 62 XM_SPF_SoftFail 4212 1.92 4.96 1.03 63 XM_B_COVIDMETA 4162 2.14 4.90 1.32 64 RCVD_IN_BL_SPAMCOP_NET 4145 2.19 4.88 1.40 65 TR_Mismatch_TLD_02 3946 1.12 4.65 0.07 66 MIME_HTML_MOSTLY 3894 3.03 4.59 2.57 67 XM_OfRef6 3839 1.83 4.52 1.03 68 T_XMDrugObfuBody_08 3835 2.07 4.52 1.35 69 TR_LOTS_OF_MONEY3 3720 1.41 4.38 0.53 70 RDNS_DYNAMIC 3697 1.36 4.35 0.47 71 BAYES_95 3632 2.46 4.28 1.92 72 FROM_EXCESS_BASE64 3409 3.73 4.01 3.65 73 XM_SendGrid 3381 6.98 3.98 7.86 74 XMHTML_After_End 3347 1.39 3.94 0.64 75 XMStrtUSub 3227 4.23 3.80 4.36 76 FROM_MISSP_REPLYTO 3215 0.87 3.79 0.01 77 SpammyFromTLD_02 3170 0.97 3.73 0.16 78 FROM_MISSP_DYNIP 3148 0.84 3.71 0.00 79 T_REMOTE_IMAGE 3069 3.27 3.61 3.17 80 PDS_OTHER_BAD_TLD 3045 1.49 3.59 0.87 81 MIME_QP_LONG_LINE 2928 4.80 3.45 5.20 82 BAYES_40 2832 4.53 3.34 4.89 83 BODY_URI_ONLY 2816 0.80 3.32 0.05 84 XM_DIRTYINTL 2766 1.14 3.26 0.52 85 XM_B_SpammyTLD 2695 2.53 3.17 2.34 86 BOTNET_NORDNS 2645 0.72 3.11 0.01 87 RCVD_IN_MSPIKE_WL 2629 7.96 3.10 9.40 88 RCVD_IN_MSPIKE_H3 2629 7.96 3.10 9.40 89 HTML_IMAGE_RATIO_06 2536 3.80 2.99 4.04 90 FROM_SUSPICIOUS_NTLD 2419 0.67 2.85 0.03 91 XMNumbers 2419 3.20 2.85 3.30 92 FROM_SUSPICIOUS_NTLD_FP 2369 0.66 2.79 0.03 93 T_XMHurry_00 2346 1.13 2.76 0.65 94 SpammyFromTLD_01 2334 1.00 2.75 0.49 95 TR_XM_PhishingBody 2293 1.85 2.70 1.59 96 TR_XM_PHPDW 2233 0.99 2.63 0.51 97 XMMoneyMeta_00 2213 1.05 2.61 0.60 98 TR_XM_PHPForged 2184 0.97 2.57 0.50 99 TR_XM_FormFill2 2164 0.96 2.55 0.49 100 XM_H_PHPOS 2160 0.95 2.54 0.48 101 FILL_THIS_FORM 2156 0.80 2.54 0.28 102 FILL_THIS_FORM_LONG 2137 0.70 2.52 0.17 103 T_TooManySym_01 2104 5.01 2.48 5.76 104 BAYES_00 2088 16.14 2.46 20.17 105 TM2_M_VERY_LONG_WORD 2085 1.79 2.46 1.60 106 RELAYCOUNTRY_FR 2049 0.72 2.41 0.22 107 T_FILL_THIS_FORM_LOAN 1950 0.65 2.30 0.16 108 XM_URI_RBL 1892 0.66 2.23 0.20 109 NORDNS_LOW_CONTRAST 1834 0.50 2.16 0.01 110 BAYES_20 1834 3.31 2.16 3.66 111 XM_SPF_Unknown 1823 0.73 2.15 0.32 112 XM_B_Unsub2 1778 1.56 2.09 1.41 113 TM2_M_URI_OPT_OUT 1767 3.72 2.08 4.20 114 TR_XM_DK_Bayes 1761 11.93 2.07 14.84 115 SUBJ_ALL_CAPS 1738 1.46 2.05 1.28 116 DATE_IN_PAST_03_06 1721 0.53 2.03 0.08 117 TR_XM_INV_DKIM 1699 0.55 2.00 0.13 118 MIME_HTML_ONLY_MULTI 1651 2.61 1.94 2.81 119 URI_HEX 1638 1.35 1.93 1.18 120 MISSING_HEADERS 1618 0.75 1.91 0.41 121 URI_TRY_3LD 1589 1.72 1.87 1.67 122 TR_XM_MaxSPIKE 1589 0.48 1.87 0.07 123 LongTLD 1588 0.54 1.87 0.15 124 RCVD_IN_RP_SAFE 1544 9.81 1.82 12.17 125 DATE_IN_PAST_06_12 1541 0.59 1.81 0.23 126 XM_OfRef7 1527 0.50 1.80 0.11 127 HTML_IMAGE_RATIO_08 1521 2.25 1.79 2.38 128 XMSexyCombo_01 1513 1.50 1.78 1.42 129 REPLYTO_WITHOUT_TO_CC 1492 0.51 1.76 0.14 130 SUBJ_DOLLARS 1489 0.84 1.75 0.58 131 XM_UB60 1482 0.45 1.75 0.07 132 TR_XM_DK_SendGrid 1406 3.86 1.66 4.51 133 HTML_MIME_NO_HTML_TAG 1391 1.64 1.64 1.64 134 XMSlimDrugH 1311 0.61 1.54 0.33 135 XMDiploma_00 1293 1.27 1.52 1.19 136 XM_H_Undi_Recip 1292 0.58 1.52 0.31 137 RCVD_IN_IADB_LISTED 1276 3.39 1.50 3.95 138 XM_H_PHPMailer 1255 0.80 1.48 0.60 139 RELAYCOUNTRY_GB 1252 0.95 1.47 0.80 140 RELAYCOUNTRY_IN 1248 0.39 1.47 0.07 141 XM_UB80 1234 0.34 1.45 0.02 142 MONEY_FRAUD_8 1222 0.33 1.44 0.01 143 TR_XM_DK_Bayes1 1206 11.28 1.42 14.19 144 RCVD_IN_IADB_SPF 1182 3.01 1.39 3.49 145 RELAYCOUNTRY_ZA 1173 0.32 1.38 0.01 146 T_FILL_THIS_FORM_SHORT 1170 1.16 1.38 1.10 147 RCVD_IN_RP_CERTIFIED 1160 8.79 1.37 10.98 148 TR_XM_Undi_Recip5 1157 0.32 1.36 0.01 149 RCVD_IN_IADB_SENDERID 1157 2.76 1.36 3.18 150 RELAYCOUNTRY_BR 1153 0.34 1.36 0.04 151 RCVD_IN_IADB_DK 1152 2.71 1.36 3.11 152 RELAYCOUNTRY_IT 1138 0.34 1.34 0.04 153 XMStockSpam_06 1124 0.95 1.32 0.85 154 DEAR_BENEFICIARY 1124 0.30 1.32 0.00 155 XM_H_Long_From02 1116 1.16 1.31 1.11 156 T_FILL_THIS_FORM_FRAUD_PHISH 1105 0.33 1.30 0.04 157 TR_Mismatch_TLD_01 1099 0.47 1.29 0.22 158 TR_LOTS_OF_MONEY1 1098 0.37 1.29 0.09 159 XM_OfRef8 1097 0.32 1.29 0.03 160 XMSpecificSbj 1081 0.29 1.27 0.00 161 XM_Combo_Sbj 1081 0.46 1.27 0.22 162 TR_XM_Undi_Recip2 1081 0.31 1.27 0.03 163 XMSlimDrugs 1077 0.33 1.27 0.06 164 ADVANCE_FEE_5_NEW_FRM_MNY 1077 0.29 1.27 0.00 165 TR_XM_Undi_Recip6 1065 0.29 1.25 0.00 166 TR_Orig_Subnet 1044 0.29 1.23 0.01 167 XMSubject_63 1042 0.28 1.23 0.00 168 HTML_TITLE_SUBJ_DIFF 1041 0.33 1.23 0.07 169 XMPhish08 1041 0.97 1.23 0.89 170 BAYES_05 1035 2.24 1.22 2.54 171 XM_H_PHPOS_M 1032 0.48 1.22 0.26 172 TR_XM_Undi_RecipCombo2 1029 0.28 1.21 0.00 173 BILLION_DOLLARS 1025 0.28 1.21 0.01 174 T_XMDrugObfuBody_14 1022 1.24 1.20 1.26 175 DIET_1 1021 0.50 1.20 0.30 176 ANY_BOUNCE_MESSAGE 1013 3.23 1.19 3.84 177 BOUNCE_MESSAGE 1012 3.23 1.19 3.83 178 XM_DK_Undo_01 1003 1.54 1.18 1.65 179 XMBrknScrpt_02 995 0.72 1.17 0.59 180 MAILING_LIST_MULTI 988 2.31 1.16 2.65 181 XM_BadFromFormat 983 0.43 1.16 0.22 182 TR_XM_DK_Bayes2 983 10.58 1.16 13.35 183 TR_LOTS_OF_MONEY2 976 0.58 1.15 0.42 184 T_MONEY_PERCENT 976 0.58 1.15 0.42 185 DATE_IN_PAST_12_24 972 0.30 1.14 0.05 186 MONEY_FROM_41 957 0.26 1.13 0.00 187 TR_Symld_Words 937 1.14 1.10 1.15 188 HTML_IMAGE_ONLY_16 917 0.44 1.08 0.25 189 XMPhish30 917 0.53 1.08 0.37 190 XMBounce_01 916 0.28 1.08 0.04 191 ALL_TRUSTED 912 12.35 1.07 15.67 192 RCVD_IN_PSBL 909 0.32 1.07 0.10 193 XMHTMLBadTable_001 907 0.76 1.07 0.66 194 DKIM_ADSP_CUSTOM_MED 907 1.18 1.07 1.21 195 RELAYCOUNTRY_SE 894 0.25 1.05 0.01 196 HEXHASH_WORD 889 0.24 1.05 0.00 197 HK_RANDOM_REPLYTO 876 0.41 1.03 0.23 198 FROM_NO_USER 873 0.24 1.03 0.01 199 XM_UB99 857 0.23 1.01 0.01 200 TR_XM_RelayPhish 852 0.33 1.00 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 246411 87.01 91.61 85.65 2 RELAYCOUNTRY_US 231460 80.02 78.54 80.45 3 DKIM_SIGNED 225413 78.28 78.03 78.35 4 XM_DK_Pass 222790 77.12 76.06 77.44 5 DKIM_VALID 212504 72.24 66.73 73.86 6 XM_B_Unicode 201361 70.21 70.97 69.99 7 DKIM_VALID_AU 171351 57.89 52.24 59.56 8 XMListUnsubscribeExists 162136 59.00 67.97 56.36 9 BAYES_50 152419 50.38 41.56 52.98 10 DCC_CHECK_NEGATIVE 147000 43.48 17.67 51.09 11 DCC_CHECK 136806 55.11 80.73 47.55 12 XM_B_Unicode3 124646 41.98 37.42 43.32 13 HTML_FONT_LOW_CONTRAST 85618 29.06 26.68 29.76 14 LOC_TINY_FONT_1 83035 28.81 28.64 28.86 15 DKIM_VALID_EF 78547 27.83 29.62 27.30 16 FVGT_m_MULTI_ODD 67426 23.78 24.94 23.44 17 T_TM2_M_HEADER_IN_MSG 65216 21.85 19.07 22.67 18 MIME_HTML_ONLY 62089 25.30 37.89 21.58 19 XMSubLong 58373 20.31 20.37 20.29 20 BAYES_00 58040 16.14 2.46 20.17 21 T_KAM_HTML_FONT_INVALID 49212 18.64 23.83 17.11 22 ALL_TRUSTED 45090 12.35 1.07 15.67 23 RCVD_IN_MSPIKE_H2 43069 13.86 10.10 14.97 24 TR_XM_DK_Bayes 42706 11.93 2.07 14.84 25 XM_Multi_Part_URI 42314 15.13 16.55 14.71 26 TR_XM_DK_Bayes1 40826 11.28 1.42 14.19 27 XM_Body_Dirty_Words 38891 15.09 20.42 13.52 28 TR_XM_DK_Bayes2 38422 10.58 1.16 13.35 29 RCVD_IN_RP_SAFE 35012 9.81 1.82 12.17 30 RCVD_IN_RP_CERTIFIED 31596 8.79 1.37 10.98 31 XM_DKIMWhitelistDomains 28350 7.62 0.04 9.85 32 RCVD_IN_MSPIKE_H3 27039 7.96 3.10 9.40 33 RCVD_IN_MSPIKE_WL 27039 7.96 3.10 9.40 34 XM_Evil_Numbers_Gen 26901 9.10 8.25 9.35 35 XM_B_Unsub 26790 9.24 9.00 9.31 36 LotsOfNums_01 26086 8.93 8.47 9.07 37 HTML_IMAGE_RATIO_02 26037 9.67 11.75 9.05 38 UNPARSEABLE_RELAY 25152 8.01 5.53 8.74 39 LOTS_OF_MONEY 23628 9.99 16.01 8.21 40 XM_DK_Undo_02 23362 16.41 44.50 8.12 41 XM_SendGrid 22624 6.98 3.98 7.86 42 XM_B_Phish_Phrases 22395 8.07 9.02 7.78 43 TooManyTo_001 22253 7.26 5.64 7.73 44 FSL_BULK_SIG 22071 9.46 15.53 7.67 45 MPART_ALT_DIFF 18384 6.13 5.25 6.39 46 BOTNET_IPINHOSTNAME 18241 8.13 14.17 6.34 47 HTML_IMAGE_RATIO_04 17944 6.04 5.38 6.24 48 BAYES_60 17674 6.34 7.03 6.14 49 T_TooManySym_01 16578 5.01 2.48 5.76 50 XM_H_Long_From01 15798 6.11 8.22 5.49 51 RELAYCOUNTRY_META 15361 9.51 23.63 5.34 52 MIME_QP_LONG_LINE 14967 4.80 3.45 5.20 53 BAYES_40 14062 4.53 3.34 4.89 54 TR_XM_DK_SendGrid 12985 3.86 1.66 4.51 55 DKIM_INVALID 12909 6.04 11.30 4.49 56 XMSubMetaSx_00 12581 4.98 7.04 4.37 57 XMStrtUSub 12547 4.23 3.80 4.36 58 BAYES_99 12404 10.14 29.87 4.31 59 TM2_M_URI_OPT_OUT 12093 3.72 2.08 4.20 60 HTML_IMAGE_RATIO_06 11609 3.80 2.99 4.04 61 XMSexyCombo_05 11457 5.66 11.36 3.98 62 RCVD_IN_IADB_LISTED 11356 3.39 1.50 3.95 63 XM_UncommonTLD01 11203 8.73 25.12 3.89 64 ANY_BOUNCE_MESSAGE 11034 3.23 1.19 3.84 65 BOUNCE_MESSAGE 11033 3.23 1.19 3.83 66 BAYES_20 10518 3.31 2.16 3.66 67 FROM_EXCESS_BASE64 10494 3.73 4.01 3.65 68 RCVD_IN_IADB_SPF 10045 3.01 1.39 3.49 69 BAYES_999 9918 7.93 23.12 3.45 70 BAYES_80 9758 4.46 8.09 3.39 71 XMNumbers 9505 3.20 2.85 3.30 72 RCVD_IN_IADB_SENDERID 9143 2.76 1.36 3.18 73 T_REMOTE_IMAGE 9115 3.27 3.61 3.17 74 RCVD_IN_IADB_DK 8953 2.71 1.36 3.11 75 T_TooManySym_02 8644 2.44 0.54 3.00 76 IN_ZIMBRA_NJ_WHITELIST 8526 2.29 0.01 2.96 77 TVD_RCVD_IP 8283 2.39 0.74 2.88 78 MIME_HTML_ONLY_MULTI 8079 2.61 1.94 2.81 79 INVALID_MSGID 7712 2.13 0.27 2.68 80 MAILING_LIST_MULTI 7613 2.31 1.16 2.65 81 BOTNET 7576 6.81 20.98 2.63 82 CK_HELO_DYNAMIC_SPLIT_IP 7391 2.02 0.15 2.57 83 MIME_HTML_MOSTLY 7388 3.03 4.59 2.57 84 HELO_DYNAMIC_IPADDR2 7388 2.00 0.08 2.57 85 BAYES_05 7296 2.24 1.22 2.54 86 XM_CamelCaseFrm001 7151 4.72 12.28 2.49 87 TO_MALFORMED 7127 1.92 0.01 2.48 88 HTML_IMAGE_RATIO_08 6852 2.25 1.79 2.38 89 XM_B_SpammyTLD 6741 2.53 3.17 2.34 90 NO_DNS_FOR_FROM 6558 3.73 8.64 2.28 91 RCVD_IN_IADB_VOUCHED 6476 1.85 0.49 2.25 92 TR_DCC_Bayes_99 6142 6.94 23.20 2.13 93 XM_PDF 5783 1.62 0.32 2.01 94 RELAYCOUNTRY_CA 5648 3.27 7.71 1.96 95 XMBdyGiftCard01 5629 1.70 0.81 1.96 96 BAYES_95 5531 2.46 4.28 1.92 97 IN_HORDE_ADDRESS_BOOK 5238 1.41 0.04 1.82 98 UNTRUSTED_Relay 4847 4.44 13.77 1.68 99 URI_TRY_3LD 4814 1.72 1.87 1.67 100 XM_H_Trusted_IP 4778 1.28 0.00 1.66 101 XM_DK_Undo_01 4733 1.54 1.18 1.65 102 HTML_MIME_NO_HTML_TAG 4728 1.64 1.64 1.64 103 USER_IN_DEF_DKIM_WL 4644 1.25 0.01 1.61 104 TM2_M_VERY_LONG_WORD 4594 1.79 2.46 1.60 105 TR_XM_PhishingBody 4587 1.85 2.70 1.59 106 TooManyTo_002 4488 1.31 0.45 1.56 107 HTML_FONT_SIZE_LARGE 4449 1.22 0.11 1.55 108 RCVD_IN_MSPIKE_BL 4336 2.77 7.06 1.51 109 XM_GoogleGroups 4271 1.25 0.47 1.48 110 RCVD_IN_MSPIKE_L3 4225 2.58 6.35 1.47 111 HTML_FONT_FACE_BAD 4094 1.27 0.74 1.42 112 XMSexyCombo_01 4079 1.50 1.78 1.42 113 XM_B_Unsub2 4046 1.56 2.09 1.41 114 RCVD_IN_BL_SPAMCOP_NET 4029 2.19 4.88 1.40 115 RCVD_IN_IADB_OPTIN 3882 1.13 0.39 1.35 116 T_XMDrugObfuBody_08 3873 2.07 4.52 1.35 117 XM_B_COVIDMETA 3808 2.14 4.90 1.32 118 SUBJ_ALL_CAPS 3684 1.46 2.05 1.28 119 T_XMDrugObfuBody_14 3612 1.24 1.20 1.26 120 XMGappySubj_01 3544 1.00 0.19 1.23 121 DKIM_ADSP_CUSTOM_MED 3473 1.18 1.07 1.21 122 TooManyTo_003 3465 1.01 0.34 1.20 123 XMDiploma_00 3430 1.27 1.52 1.19 124 URI_HEX 3397 1.35 1.93 1.18 125 KHOP_HELO_FCRDNS 3382 2.29 6.07 1.18 126 TR_Symld_Words 3304 1.14 1.10 1.15 127 XM_H_Long_From02 3202 1.16 1.31 1.11 128 T_FILL_THIS_FORM_SHORT 3155 1.16 1.38 1.10 129 TooManyTo_004 3012 0.87 0.27 1.05 130 XM_OfRef6 2977 1.83 4.52 1.03 131 XM_SPF_SoftFail 2953 1.92 4.96 1.03 132 TR_XM_COVIDMETA4 2947 1.92 4.96 1.02 133 XM_UB50 2821 2.44 7.38 0.98 134 XM_ProductURIs 2731 0.95 0.96 0.95 135 TooManyTo_005 2678 0.77 0.22 0.93 136 T_TooManySym_03 2617 0.75 0.20 0.91 137 XMPhish08 2565 0.97 1.23 0.89 138 PDS_OTHER_BAD_TLD 2495 1.49 3.59 0.87 139 XMBody_17 2442 2.17 6.64 0.85 140 NML_ADSP_CUSTOM_MED 2441 0.86 0.91 0.85 141 XMStockSpam_06 2433 0.95 1.32 0.85 142 RELAYCOUNTRY_GB 2306 0.95 1.47 0.80 143 XMSubNoVowel 2238 0.81 0.93 0.78 144 TR_MetaPhish_Combo_01 2221 0.80 0.88 0.77 145 HELO_NODOT 2063 0.66 0.48 0.72 146 HELO_NO_DOMAIN 2062 0.66 0.48 0.72 147 T_XMDrugObfuBody_00 2049 0.77 0.99 0.71 148 XMGenDplmaNmb 1989 0.71 0.79 0.69 149 XMSubMetaSxObfu_03 1929 0.69 0.76 0.67 150 XMHTMLBadTable_001 1912 0.76 1.07 0.66 151 XMLngstWrd_00 1901 0.67 0.69 0.66 152 T_XMHurry_00 1864 1.13 2.76 0.65 153 HTML_TAG_BALANCE_BODY 1863 0.67 0.73 0.65 154 XM_B_REG_HTML 1849 0.58 0.36 0.64 155 PLING_QUERY 1842 0.55 0.25 0.64 156 XMHTML_After_End 1830 1.39 3.94 0.64 157 USER_IN_WHITELIST 1735 0.47 0.00 0.60 158 XM_H_PHPMailer 1729 0.80 1.48 0.60 159 XMMoneyMeta_00 1716 1.05 2.61 0.60 160 XMSubMetaSSx_00 1708 0.58 0.54 0.59 161 XMBrknScrpt_02 1697 0.72 1.17 0.59 162 XMSubMetaSxObfu_02 1691 0.50 0.20 0.59 163 XMLngstWrd_01 1668 0.60 0.67 0.58 164 SUBJ_DOLLARS 1658 0.84 1.75 0.58 165 XMNoVowels 1626 0.54 0.43 0.57 166 FORGED_GMAIL_RCVD 1601 0.64 0.91 0.56 167 XMBSHREFv2 1579 0.51 0.38 0.55 168 XMSexyCombo_04 1552 0.64 0.98 0.54 169 HTTPS_HTTP_MISMATCH 1551 0.58 0.70 0.54 170 TR_LOTS_OF_MONEY3 1522 1.41 4.38 0.53 171 T_Symld_Words_02 1504 0.53 0.55 0.52 172 XM_DIRTYINTL 1500 1.14 3.26 0.52 173 XMSubMetaI_00 1497 0.56 0.71 0.52 174 TR_MSPIKEBAYES00 1476 0.40 0.02 0.51 175 TR_XM_PHPDW 1455 0.99 2.63 0.51 176 TR_XM_PHPForged 1425 0.97 2.57 0.50 177 SpammyFromTLD_01 1397 1.00 2.75 0.49 178 TR_XM_FormFill2 1397 0.96 2.55 0.49 179 HTML_IMAGE_ONLY_20 1380 0.49 0.54 0.48 180 XM_H_PHPOS 1379 0.95 2.54 0.48 181 RDNS_DYNAMIC 1359 1.36 4.35 0.47 182 XMCapTrack 1357 0.53 0.74 0.47 183 URI_NOVOWEL 1336 0.51 0.65 0.46 184 MPART_ALT_DIFF_COUNT 1316 0.56 0.90 0.46 185 XMBody_95 1288 0.36 0.05 0.45 186 XM_RXBody 1216 0.48 0.68 0.42 187 T_TooManySym_04 1214 0.33 0.03 0.42 188 T_MONEY_PERCENT 1202 0.58 1.15 0.42 189 TR_LOTS_OF_MONEY2 1202 0.58 1.15 0.42 190 XMSolicitRefs_0 1167 0.44 0.54 0.41 191 MISSING_HEADERS 1167 0.75 1.91 0.41 192 RELAYCOUNTRY_AU 1148 0.40 0.41 0.40 193 XM_Akamai 1110 0.30 0.01 0.39 194 RELAYCOUNTRY_NL 1103 0.42 0.56 0.38 195 XMLngstWrd_02 1087 0.44 0.64 0.38 196 XMLKML 1082 0.29 0.00 0.38 197 XMPhish30 1062 0.53 1.08 0.37 198 DKIM_ADSP_NXDOMAIN 1014 0.43 0.71 0.35 199 XM_ShortIntro_01 1007 0.36 0.39 0.35 200 XM_B_COPY_HTML 1004 0.44 0.76 0.35 ----------------------------------------------------------------------