Email: 367146 Autolearn: 0 AvgScore: 1.81 AvgScanTime: 1.77 sec Spam: 79743 Autolearn: 0 AvgScore: 12.46 AvgScanTime: 2.80 sec Ham: 287403 Autolearn: 0 AvgScore: -1.15 AvgScanTime: 1.48 sec Time Spent Running SA: 180.29 hours Time Spent Processing Spam: 62.00 hours Time Spent Processing Ham: 118.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 74902 87.06 93.93 85.15 2 DKIM_SIGNED 65763 74.82 82.47 72.70 3 DCC_CHECK 65433 53.50 82.05 45.58 4 XM_DK_Pass 63533 73.54 79.67 71.83 5 RELAYCOUNTRY_US 62271 75.62 78.09 74.93 6 XM_B_Unicode 58336 67.27 73.16 65.63 7 XMListUnsubscribeExists 57506 56.10 72.11 51.65 8 DKIM_VALID 56515 69.02 70.87 68.51 9 DKIM_VALID_AU 45643 56.45 57.24 56.23 10 XM_DK_Undo_02 36240 15.40 45.45 7.06 11 MIME_HTML_ONLY 35786 26.01 44.88 20.78 12 BAYES_50 31067 51.19 38.96 54.59 13 XM_B_Unicode3 29658 40.76 37.19 41.75 14 DKIM_VALID_EF 28136 27.85 35.28 25.79 15 BAYES_99 26433 10.78 33.15 4.57 16 LOC_TINY_FONT_1 25143 28.67 31.53 27.88 17 XM_UncommonTLD01 22742 9.20 28.52 3.84 18 T_KAM_HTML_FONT_INVALID 22665 17.84 28.42 14.90 19 TR_DCC_Bayes_99 21946 8.01 27.52 2.60 20 HTML_FONT_LOW_CONTRAST 20437 28.72 25.63 29.57 21 BAYES_999 20200 8.19 25.33 3.44 22 RELAYCOUNTRY_META 18076 8.68 22.67 4.80 23 FVGT_m_MULTI_ODD 16861 20.27 21.14 20.03 24 XMSubLong 16592 19.37 20.81 18.97 25 T_TM2_M_HEADER_IN_MSG 16466 22.05 20.65 22.43 26 BOTNET 13605 5.62 17.06 2.45 27 DCC_CHECK_NEGATIVE 13542 45.43 16.98 53.32 28 XM_CamelCaseFrm001 12777 6.88 16.02 4.34 29 XM_Body_Dirty_Words 12722 13.62 15.95 12.98 30 HTML_IMAGE_RATIO_02 12036 11.01 15.09 9.88 31 UNTRUSTED_Relay 11555 4.51 14.49 1.74 32 XM_Multi_Part_URI 11328 13.61 14.21 13.45 33 FSL_BULK_SIG 11190 9.33 14.03 8.03 34 BOTNET_IPINHOSTNAME 10380 7.72 13.02 6.25 35 DKIM_INVALID 9248 5.80 11.60 4.19 36 URIBL_SBL_A 9027 2.64 11.32 0.23 37 XM_B_Phish_Phrases 7682 7.52 9.63 6.93 38 XM_UB50 7636 2.82 9.58 0.95 39 TR_XM_MaxBayes 7257 2.00 9.10 0.04 40 XMSexyCombo_05 7218 5.33 9.05 4.30 41 XM_B_Unsub 7198 9.56 9.03 9.70 42 XM_Evil_Numbers_Gen 6736 8.50 8.45 8.52 43 RCVD_IN_MSPIKE_H2 6717 12.88 8.42 14.12 44 NO_DNS_FOR_FROM 6702 3.59 8.40 2.25 45 LOTS_OF_MONEY 6519 6.77 8.18 6.38 46 KHOP_HELO_FCRDNS 6433 2.56 8.07 1.03 47 BAYES_80 6063 4.95 7.60 4.21 48 LotsOfNums_01 5976 7.43 7.49 7.41 49 RCVD_IN_MSPIKE_BL 5930 2.52 7.44 1.15 50 RCVD_IN_MSPIKE_L3 5662 2.44 7.10 1.14 51 T_XMDrugObfuBody_08 5612 2.60 7.04 1.37 52 HTML_IMAGE_RATIO_04 5424 5.80 6.80 5.52 53 RELAYCOUNTRY_CA 5302 2.78 6.65 1.70 54 RDNS_DYNAMIC 5301 1.84 6.65 0.50 55 XMHTML_After_End 5284 1.83 6.63 0.51 56 BAYES_60 5070 6.17 6.36 6.12 57 MPART_ALT_DIFF 5014 10.70 6.29 11.93 58 XM_H_Long_From01 4967 5.48 6.23 5.27 59 XM_SPF_SoftFail 4907 2.05 6.15 0.91 60 BODY_URI_ONLY 4821 1.35 6.05 0.05 61 XMSubMetaSx_00 4783 3.98 6.00 3.42 62 FROM_MISSP_REPLYTO 4632 1.27 5.81 0.01 63 DATE_IN_PAST_03_06 4620 1.31 5.79 0.06 64 FROM_MISSP_DYNIP 4595 1.25 5.76 0.00 65 TooManyTo_001 4480 6.48 5.62 6.72 66 DATE_IN_PAST_06_12 4043 1.14 5.07 0.05 67 RCVD_IN_RP_RNBL 4032 1.19 5.06 0.12 68 UNPARSEABLE_RELAY 3756 7.19 4.71 7.88 69 PDS_OTHER_BAD_TLD 3615 1.66 4.53 0.86 70 XMStrtUSub 3614 5.22 4.53 5.41 71 MIME_HTML_MOSTLY 3571 3.25 4.48 2.91 72 XM_B_COVIDMETA 3507 1.94 4.40 1.25 73 BAYES_95 3506 2.73 4.40 2.26 74 TR_XM_COVIDMETA4 3494 1.58 4.38 0.80 75 SpammyFromTLD_01 3225 1.20 4.04 0.41 76 RELAYCOUNTRY_FR 3216 1.02 4.03 0.18 77 SpammyFromTLD_02 3146 0.98 3.95 0.15 78 RCVD_IN_BL_SPAMCOP_NET 3141 1.33 3.94 0.61 79 XM_SendGrid 3024 6.45 3.79 7.19 80 FROM_SUSPICIOUS_NTLD 2997 0.84 3.76 0.03 81 FROM_SUSPICIOUS_NTLD_FP 2959 0.83 3.71 0.02 82 XM_DIRTYINTL 2853 1.10 3.58 0.41 83 XM_B_SpammyTLD 2789 2.50 3.50 2.22 84 XMNumbers 2782 3.50 3.49 3.50 85 MIME_QP_LONG_LINE 2466 3.70 3.09 3.87 86 T_XMHurry_00 2376 1.02 2.98 0.48 87 LongTLD 2315 0.72 2.90 0.11 88 BAYES_40 2299 4.18 2.88 4.53 89 FROM_EXCESS_BASE64 2246 3.62 2.82 3.84 90 TR_LOTS_OF_MONEY3 2231 0.80 2.80 0.24 91 XMBody_17 2162 1.11 2.71 0.67 92 T_TooManySym_01 2156 4.77 2.70 5.34 93 BAYES_00 2138 14.60 2.68 17.91 94 BAYES_20 2082 3.18 2.61 3.33 95 HTML_IMAGE_RATIO_06 2009 3.55 2.52 3.83 96 TR_XM_PHPDW 1967 0.85 2.47 0.40 97 RCVD_IN_RP_SAFE 1955 10.17 2.45 12.31 98 T_XMDrugObfuBody_14 1945 2.15 2.44 2.07 99 TR_XM_PHPForged 1929 0.82 2.42 0.37 100 TR_XM_PhishingBody 1917 1.73 2.40 1.54 101 RCVD_IN_MSPIKE_H3 1917 8.15 2.40 9.74 102 RCVD_IN_MSPIKE_WL 1917 8.15 2.40 9.74 103 TR_XM_FormFill2 1914 0.81 2.40 0.37 104 XM_H_PHPOS 1909 0.81 2.39 0.36 105 XMDiploma_00 1734 1.23 2.17 0.97 106 MIME_HTML_ONLY_MULTI 1716 2.63 2.15 2.76 107 TM2_M_URI_OPT_OUT 1705 3.56 2.14 3.95 108 TR_XM_INV_DKIM 1703 0.52 2.14 0.07 109 URI_HEX 1695 1.32 2.13 1.10 110 RELAYCOUNTRY_DE 1693 0.78 2.12 0.40 111 XMSexyCombo_01 1616 0.74 2.03 0.38 112 ALL_TRUSTED 1543 17.25 1.93 21.50 113 XM_URI_RBL 1530 0.55 1.92 0.17 114 TR_XM_DK_Bayes 1493 10.57 1.87 12.98 115 TM2_M_VERY_LONG_WORD 1425 1.52 1.79 1.44 116 TR_Mismatch_TLD_02 1424 0.52 1.79 0.16 117 HTML_IMAGE_RATIO_08 1409 2.55 1.77 2.76 118 TR_XM_MaxSPIKE 1317 0.38 1.65 0.03 119 XMBdyGiftCard01 1282 1.49 1.61 1.46 120 RCVD_IN_RP_CERTIFIED 1274 9.09 1.60 11.16 121 XM_OfRef6 1262 0.99 1.58 0.82 122 HTML_MIME_NO_HTML_TAG 1259 1.50 1.58 1.48 123 T_FILL_THIS_FORM_SHORT 1231 2.07 1.54 2.22 124 XMSubMetaI_00 1227 1.02 1.54 0.88 125 TR_Mismatch_TLD_01 1223 0.49 1.53 0.20 126 XM_B_Unsub2 1137 1.17 1.43 1.10 127 SUBJ_ALL_CAPS 1123 1.18 1.41 1.12 128 TR_XM_FormFill 1117 0.52 1.40 0.27 129 TR_XM_DK_Bayes1 1109 9.97 1.39 12.36 130 XM_H_PHPMailer 1104 0.70 1.38 0.51 131 XMGenDplmaNmb 1098 0.80 1.38 0.65 132 RELAYCOUNTRY_GB 1084 0.97 1.36 0.86 133 BAYES_05 1082 2.23 1.36 2.47 134 SUBJ_ILLEGAL_CHARS 1068 0.30 1.34 0.01 135 SUBJECT_NEEDS_ENCODING 1068 0.30 1.34 0.01 136 RCVD_IN_IADB_LISTED 1061 2.50 1.33 2.82 137 XM_UB60 1016 0.32 1.27 0.06 138 XMBrknScrpt_02 1015 0.74 1.27 0.60 139 TR_XM_DK_SendGrid 1010 3.48 1.27 4.09 140 DKIM_ADSP_CUSTOM_MED 1007 1.31 1.26 1.32 141 RCVD_IN_IADB_SPF 992 2.20 1.24 2.46 142 TR_XM_DK_Bayes2 985 9.23 1.24 11.44 143 TR_Symld_Words 984 0.89 1.23 0.80 144 RCVD_IN_IADB_DK 976 1.96 1.22 2.16 145 RCVD_IN_IADB_SENDERID 970 2.01 1.22 2.23 146 XMPhish30 954 0.53 1.20 0.34 147 XMSexyCombo_04 949 0.34 1.19 0.11 148 BOTNET_NORDNS 947 0.26 1.19 0.01 149 XM_H_PHPOS_M 943 0.39 1.18 0.17 150 T_REMOTE_IMAGE 935 2.25 1.17 2.55 151 NO_FM_NAME_IP_HOSTN 924 0.25 1.16 0.00 152 MAILING_LIST_MULTI 905 1.78 1.13 1.96 153 TR_XM_RelayPhish 899 0.31 1.13 0.08 154 DIET_1 888 0.50 1.11 0.33 155 XM_ProductURIs 884 0.70 1.11 0.59 156 FILL_THIS_FORM 870 1.11 1.09 1.11 157 MPART_ALT_DIFF_COUNT 869 0.56 1.09 0.41 158 RCVD_IN_PSBL 860 0.31 1.08 0.09 159 XMSubNoVowel 860 1.03 1.08 1.02 160 FILL_THIS_FORM_LONG 849 0.99 1.06 0.97 161 XMStockSpam_06 845 1.31 1.06 1.38 162 DEAR_FRIEND 844 0.27 1.06 0.06 163 XM_DK_Undo_01 803 1.35 1.01 1.45 164 XM_UB80 795 0.23 1.00 0.02 165 NML_ADSP_CUSTOM_MED 779 0.85 0.98 0.81 166 HTML_TITLE_SUBJ_DIFF 775 0.26 0.97 0.06 167 XMBody_78 774 0.50 0.97 0.37 168 XM_B_FormFill 771 0.96 0.97 0.96 169 FORGED_GMAIL_RCVD 765 0.55 0.96 0.44 170 XMSubEmpty 761 0.40 0.95 0.24 171 XM_Appointment_Request 760 0.23 0.95 0.02 172 XMHTMLBadTable_001 755 0.58 0.95 0.48 173 T_TooManySym_02 752 2.67 0.94 3.15 174 SUBJ_DOLLARS 742 0.59 0.93 0.49 175 XMPhish08 737 0.61 0.92 0.52 176 RELAYCOUNTRY_IN 725 0.24 0.91 0.05 177 XMReplyNow 722 0.28 0.91 0.11 178 DKIM_ADSP_NXDOMAIN 693 0.46 0.87 0.34 179 HTML_TAG_BALANCE_BODY 685 0.46 0.86 0.35 180 TVD_RCVD_IP 655 2.57 0.82 3.05 181 XM_XX_Yahoo 654 0.21 0.82 0.04 182 URIBL_BLACK 651 0.18 0.82 0.01 183 URI_TRY_3LD 650 1.18 0.82 1.28 184 RELAYCOUNTRY_AT 635 0.30 0.80 0.17 185 XM_UB99 622 0.17 0.78 0.00 186 MISSING_HEADERS 618 0.68 0.77 0.65 187 JOIN_MILLIONS 614 0.20 0.77 0.04 188 XMSlimDrugH 604 0.38 0.76 0.28 189 RELAYCOUNTRY_PL 603 0.19 0.76 0.03 190 XM_Combo_Sbj 586 0.29 0.73 0.16 191 REPLYTO_WITHOUT_TO_CC 578 0.40 0.72 0.31 192 XMSubMetaSxObfu_03 574 0.46 0.72 0.38 193 RELAYCOUNTRY_CN 565 0.20 0.71 0.06 194 LOW_PRICE 561 0.33 0.70 0.22 195 XM_OfRef7 542 0.22 0.68 0.09 196 TR_MetaPhish_Combo_01 539 0.66 0.68 0.65 197 DATE_IN_PAST_12_24 539 0.17 0.68 0.03 198 XM_B_COPY_HTML 530 0.44 0.66 0.38 199 T_XMDrugObfuBody_00 524 0.46 0.66 0.40 200 GUARANTEED_100_PERCENT 521 0.16 0.65 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 244734 87.06 93.93 85.15 2 RELAYCOUNTRY_US 215347 75.62 78.09 74.93 3 DKIM_SIGNED 208930 74.82 82.47 72.70 4 XM_DK_Pass 206449 73.54 79.67 71.83 5 DKIM_VALID 196897 69.02 70.87 68.51 6 XM_B_Unicode 188629 67.27 73.16 65.63 7 DKIM_VALID_AU 161612 56.45 57.24 56.23 8 BAYES_50 156879 51.19 38.96 54.59 9 DCC_CHECK_NEGATIVE 153253 45.43 16.98 53.32 10 XMListUnsubscribeExists 148446 56.10 72.11 51.65 11 DCC_CHECK 130998 53.50 82.05 45.58 12 XM_B_Unicode3 119978 40.76 37.19 41.75 13 HTML_FONT_LOW_CONTRAST 84989 28.72 25.63 29.57 14 LOC_TINY_FONT_1 80114 28.67 31.53 27.88 15 DKIM_VALID_EF 74111 27.85 35.28 25.79 16 T_TM2_M_HEADER_IN_MSG 64474 22.05 20.65 22.43 17 ALL_TRUSTED 61800 17.25 1.93 21.50 18 MIME_HTML_ONLY 59724 26.01 44.88 20.78 19 FVGT_m_MULTI_ODD 57557 20.27 21.14 20.03 20 XMSubLong 54527 19.37 20.81 18.97 21 BAYES_00 51483 14.60 2.68 17.91 22 T_KAM_HTML_FONT_INVALID 42823 17.84 28.42 14.90 23 RCVD_IN_MSPIKE_H2 40577 12.88 8.42 14.12 24 XM_Multi_Part_URI 38657 13.61 14.21 13.45 25 TR_XM_DK_Bayes 37313 10.57 1.87 12.98 26 XM_Body_Dirty_Words 37293 13.62 15.95 12.98 27 TR_XM_DK_Bayes1 35509 9.97 1.39 12.36 28 RCVD_IN_RP_SAFE 35375 10.17 2.45 12.31 29 MPART_ALT_DIFF 34278 10.70 6.29 11.93 30 TR_XM_DK_Bayes2 32893 9.23 1.24 11.44 31 RCVD_IN_RP_CERTIFIED 32082 9.09 1.60 11.16 32 XM_DKIMWhitelistDomains 29000 7.91 0.05 10.09 33 HTML_IMAGE_RATIO_02 28391 11.01 15.09 9.88 34 RCVD_IN_MSPIKE_WL 27997 8.15 2.40 9.74 35 RCVD_IN_MSPIKE_H3 27997 8.15 2.40 9.74 36 XM_B_Unsub 27884 9.56 9.03 9.70 37 XM_Evil_Numbers_Gen 24477 8.50 8.45 8.52 38 FSL_BULK_SIG 23074 9.33 14.03 8.03 39 UNPARSEABLE_RELAY 22658 7.19 4.71 7.88 40 LotsOfNums_01 21287 7.43 7.49 7.41 41 XM_SendGrid 20659 6.45 3.79 7.19 42 XM_DK_Undo_02 20301 15.40 45.45 7.06 43 XM_B_Phish_Phrases 19918 7.52 9.63 6.93 44 HTML_FONT_SIZE_LARGE 19507 5.34 0.11 6.79 45 TooManyTo_001 19325 6.48 5.62 6.72 46 LOTS_OF_MONEY 18323 6.77 8.18 6.38 47 BOTNET_IPINHOSTNAME 17954 7.72 13.02 6.25 48 BAYES_60 17597 6.17 6.36 6.12 49 HTML_IMAGE_RATIO_04 15855 5.80 6.80 5.52 50 XMStrtUSub 15555 5.22 4.53 5.41 51 T_TooManySym_01 15352 4.77 2.70 5.34 52 XM_H_Long_From01 15156 5.48 6.23 5.27 53 RELAYCOUNTRY_META 13806 8.68 22.67 4.80 54 BAYES_99 13131 10.78 33.15 4.57 55 BAYES_40 13033 4.18 2.88 4.53 56 XM_CamelCaseFrm001 12476 6.88 16.02 4.34 57 XMSexyCombo_05 12359 5.33 9.05 4.30 58 BAYES_80 12111 4.95 7.60 4.21 59 DKIM_INVALID 12033 5.80 11.60 4.19 60 TR_XM_DK_SendGrid 11763 3.48 1.27 4.09 61 TM2_M_URI_OPT_OUT 11350 3.56 2.14 3.95 62 MIME_QP_LONG_LINE 11135 3.70 3.09 3.87 63 XM_UncommonTLD01 11049 9.20 28.52 3.84 64 FROM_EXCESS_BASE64 11035 3.62 2.82 3.84 65 HTML_IMAGE_RATIO_06 11010 3.55 2.52 3.83 66 XMNumbers 10059 3.50 3.49 3.50 67 BAYES_999 9877 8.19 25.33 3.44 68 XMSubMetaSx_00 9823 3.98 6.00 3.42 69 BAYES_20 9575 3.18 2.61 3.33 70 T_TooManySym_02 9049 2.67 0.94 3.15 71 ANY_BOUNCE_MESSAGE 8866 2.49 0.34 3.08 72 BOUNCE_MESSAGE 8865 2.49 0.33 3.08 73 TVD_RCVD_IP 8767 2.57 0.82 3.05 74 MIME_HTML_MOSTLY 8373 3.25 4.48 2.91 75 RCVD_IN_IADB_LISTED 8103 2.50 1.33 2.82 76 CK_HELO_DYNAMIC_SPLIT_IP 7958 2.19 0.11 2.77 77 HELO_DYNAMIC_IPADDR2 7954 2.19 0.09 2.77 78 HTML_IMAGE_RATIO_08 7943 2.55 1.77 2.76 79 MIME_HTML_ONLY_MULTI 7922 2.63 2.15 2.76 80 INVALID_MSGID 7693 2.16 0.29 2.68 81 IN_ZIMBRA_NJ_WHITELIST 7581 2.07 0.01 2.64 82 TR_DCC_Bayes_99 7467 8.01 27.52 2.60 83 T_REMOTE_IMAGE 7340 2.25 1.17 2.55 84 TO_MALFORMED 7128 1.95 0.05 2.48 85 BAYES_05 7089 2.23 1.36 2.47 86 RCVD_IN_IADB_SPF 7073 2.20 1.24 2.46 87 BOTNET 7030 5.62 17.06 2.45 88 BAYES_95 6503 2.73 4.40 2.26 89 NO_DNS_FOR_FROM 6476 3.59 8.40 2.25 90 RCVD_IN_IADB_SENDERID 6400 2.01 1.22 2.23 91 T_FILL_THIS_FORM_SHORT 6380 2.07 1.54 2.22 92 XM_B_SpammyTLD 6376 2.50 3.50 2.22 93 RCVD_IN_IADB_DK 6215 1.96 1.22 2.16 94 T_XMDrugObfuBody_14 5940 2.15 2.44 2.07 95 XM_H_Trusted_IP 5875 1.60 0.00 2.04 96 MAILING_LIST_MULTI 5628 1.78 1.13 1.96 97 USER_IN_DEF_DKIM_WL 5091 1.39 0.01 1.77 98 UNTRUSTED_Relay 4997 4.51 14.49 1.74 99 IN_HORDE_ADDRESS_BOOK 4950 1.35 0.03 1.72 100 RELAYCOUNTRY_CA 4898 2.78 6.65 1.70 101 RCVD_IN_IADB_VOUCHED 4845 1.39 0.32 1.69 102 XM_GoogleGroups 4476 1.34 0.56 1.56 103 XM_PDF 4453 1.29 0.37 1.55 104 TR_XM_PhishingBody 4438 1.73 2.40 1.54 105 HTML_MIME_NO_HTML_TAG 4256 1.50 1.58 1.48 106 XMBdyGiftCard01 4205 1.49 1.61 1.46 107 TooManyTo_002 4191 1.25 0.49 1.46 108 XM_DK_Undo_01 4159 1.35 1.01 1.45 109 TM2_M_VERY_LONG_WORD 4138 1.52 1.79 1.44 110 XMStockSpam_06 3978 1.31 1.06 1.38 111 T_XMDrugObfuBody_08 3948 2.60 7.04 1.37 112 DKIM_ADSP_CUSTOM_MED 3801 1.31 1.26 1.32 113 URI_TRY_3LD 3668 1.18 0.82 1.28 114 XM_B_COVIDMETA 3606 1.94 4.40 1.25 115 RCVD_IN_MSPIKE_BL 3317 2.52 7.44 1.15 116 RCVD_IN_MSPIKE_L3 3288 2.44 7.10 1.14 117 SUBJ_ALL_CAPS 3209 1.18 1.41 1.12 118 XMGappySubj_01 3201 0.90 0.11 1.11 119 FILL_THIS_FORM 3195 1.11 1.09 1.11 120 URI_HEX 3160 1.32 2.13 1.10 121 TooManyTo_003 3155 0.94 0.37 1.10 122 XM_B_Unsub2 3149 1.17 1.43 1.10 123 KHOP_HELO_FCRDNS 2971 2.56 8.07 1.03 124 XMSubNoVowel 2918 1.03 1.08 1.02 125 RCVD_IN_IADB_OPTIN 2910 0.85 0.26 1.01 126 XMDiploma_00 2797 1.23 2.17 0.97 127 FILL_THIS_FORM_LONG 2777 0.99 1.06 0.97 128 XM_B_FormFill 2763 0.96 0.97 0.96 129 XM_UB50 2731 2.82 9.58 0.95 130 T_TooManySym_03 2709 0.82 0.36 0.94 131 TooManyTo_004 2671 0.80 0.33 0.93 132 XM_SPF_SoftFail 2616 2.05 6.15 0.91 133 TR_MSPIKEBAYES00 2600 0.72 0.07 0.90 134 HTML_FONT_FACE_BAD 2572 0.83 0.57 0.89 135 XMSubMetaI_00 2526 1.02 1.54 0.88 136 RELAYCOUNTRY_GB 2483 0.97 1.36 0.86 137 PDS_OTHER_BAD_TLD 2463 1.66 4.53 0.86 138 XM_OfRef6 2357 0.99 1.58 0.82 139 NML_ADSP_CUSTOM_MED 2334 0.85 0.98 0.81 140 TooManyTo_005 2328 0.69 0.28 0.81 141 TR_XM_COVIDMETA4 2299 1.58 4.38 0.80 142 TR_Symld_Words 2289 0.89 1.23 0.80 143 XM_H_Long_From02 2274 0.75 0.58 0.79 144 XMSubMetaSxObfu_02 2007 0.59 0.20 0.70 145 PLING_QUERY 1940 0.61 0.35 0.68 146 XMBody_17 1913 1.11 2.71 0.67 147 MISSING_HEADERS 1882 0.68 0.77 0.65 148 TR_MetaPhish_Combo_01 1878 0.66 0.68 0.65 149 XMPhish14 1861 0.56 0.26 0.65 150 XMGenDplmaNmb 1854 0.80 1.38 0.65 151 T_MONEY_PERCENT 1801 0.61 0.55 0.63 152 TR_LOTS_OF_MONEY2 1801 0.61 0.55 0.63 153 RCVD_IN_BL_SPAMCOP_NET 1739 1.33 3.94 0.61 154 XMBody_95 1723 0.49 0.08 0.60 155 XMBrknScrpt_02 1718 0.74 1.27 0.60 156 HELO_NODOT 1712 0.59 0.57 0.60 157 HELO_NO_DOMAIN 1707 0.59 0.57 0.59 158 XM_ProductURIs 1702 0.70 1.11 0.59 159 USER_IN_WHITELIST 1667 0.45 0.00 0.58 160 XM_B_REG_HTML 1568 0.55 0.57 0.55 161 XMNoVowels 1545 0.50 0.38 0.54 162 XMPhish08 1501 0.61 0.92 0.52 163 XM_H_PHPMailer 1462 0.70 1.38 0.51 164 XMHTML_After_End 1452 1.83 6.63 0.51 165 RDNS_DYNAMIC 1439 1.84 6.65 0.50 166 XMCapTrack 1427 0.45 0.29 0.50 167 SUBJ_DOLLARS 1416 0.59 0.93 0.49 168 XMHTMLBadTable_001 1386 0.58 0.95 0.48 169 T_XMHurry_00 1372 1.02 2.98 0.48 170 HTTPS_HTTP_MISMATCH 1347 0.51 0.65 0.47 171 HTML_IMAGE_ONLY_20 1302 0.44 0.38 0.45 172 FORGED_GMAIL_RCVD 1271 0.55 0.96 0.44 173 XMLngstWrd_00 1258 0.45 0.51 0.44 174 MPART_ALT_DIFF_COUNT 1190 0.56 1.09 0.41 175 BASE64_LENGTH_79_INF 1189 0.38 0.27 0.41 176 XM_DIRTYINTL 1185 1.10 3.58 0.41 177 XMBSHREFv2 1172 0.42 0.47 0.41 178 SpammyFromTLD_01 1165 1.20 4.04 0.41 179 T_XMDrugObfuBody_00 1155 0.46 0.66 0.40 180 RELAYCOUNTRY_DE 1153 0.78 2.12 0.40 181 XMLngstWrd_01 1137 0.41 0.47 0.40 182 TR_XM_PHPDW 1136 0.85 2.47 0.40 183 XMSubMetaSxObfu_03 1104 0.46 0.72 0.38 184 T_TooManySym_04 1100 0.33 0.12 0.38 185 XMSexyCombo_01 1091 0.74 2.03 0.38 186 XM_B_COPY_HTML 1090 0.44 0.66 0.38 187 TR_XM_PHPForged 1075 0.82 2.42 0.37 188 XMBody_78 1070 0.50 0.97 0.37 189 TR_XM_FormFill2 1065 0.81 2.40 0.37 190 URI_NOVOWEL 1064 0.41 0.58 0.37 191 BODY_ENHANCEMENT 1060 0.30 0.04 0.37 192 XMSubMetaSSx_00 1054 0.39 0.46 0.37 193 XM_H_PHPOS 1049 0.81 2.39 0.36 194 XM_RXBody 1043 0.41 0.57 0.36 195 HTML_TAG_BALANCE_BODY 1019 0.46 0.86 0.35 196 DKIM_ADSP_NXDOMAIN 991 0.46 0.87 0.34 197 XMPhish30 991 0.53 1.20 0.34 198 XMPhish11 977 0.31 0.21 0.34 199 XM_Body_Obfu01 968 0.30 0.17 0.34 200 XM_ShortIntro_01 949 0.35 0.40 0.33 ----------------------------------------------------------------------