Email: 645225 Autolearn: 0 AvgScore: 2.04 AvgScanTime: 2.10 sec Spam: 149207 Autolearn: 0 AvgScore: 12.47 AvgScanTime: 3.55 sec Ham: 496018 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 1.66 sec Time Spent Running SA: 376.58 hours Time Spent Processing Spam: 147.25 hours Time Spent Processing Ham: 229.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142782 90.48 95.69 88.91 2 DCC_CHECK 120134 50.19 80.51 41.07 3 DKIM_SIGNED 119006 75.53 79.76 74.26 4 XM_B_Unicode 118829 73.18 79.64 71.24 5 RELAYCOUNTRY_US 115039 81.46 77.10 82.77 6 XM_DK_Pass 114648 73.87 76.84 72.98 7 XMListUnsubscribeExists 102620 54.31 68.78 49.96 8 DKIM_VALID 98027 67.88 65.70 68.54 9 DKIM_VALID_AU 74185 50.89 49.72 51.24 10 BAYES_50 66901 51.64 44.84 53.69 11 XM_DK_Undo_02 63603 15.29 42.63 7.06 12 XM_B_Unicode3 62368 41.32 41.80 41.18 13 MIME_HTML_ONLY 59430 25.80 39.83 21.58 14 T_KAM_HTML_FONT_INVALID 48070 22.27 32.22 19.28 15 LOC_TINY_FONT_1 47166 26.19 31.61 24.56 16 DKIM_VALID_EF 42612 26.12 28.56 25.39 17 BAYES_99 40971 9.36 27.46 3.91 18 HTML_FONT_LOW_CONTRAST 40302 27.09 27.01 27.12 19 FVGT_m_MULTI_ODD 36446 22.75 24.43 22.25 20 XMSubLong 34471 21.36 23.10 20.84 21 TR_DCC_Bayes_99 33807 6.72 22.66 1.93 22 BAYES_999 32003 7.47 21.45 3.26 23 RELAYCOUNTRY_META 31640 9.03 21.21 5.37 24 XM_Body_Dirty_Words 31341 14.97 21.01 13.16 25 T_TM2_M_HEADER_IN_MSG 29948 26.26 20.07 28.12 26 BOTNET 29838 6.68 20.00 2.68 27 DCC_CHECK_NEGATIVE 26691 47.91 17.89 56.94 28 XM_UncommonTLD01 24320 6.59 16.30 3.67 29 XM_Multi_Part_URI 23593 13.17 15.81 12.38 30 BOTNET_IPINHOSTNAME 21951 6.80 14.71 4.43 31 XM_B_Phish_Phrases 21353 9.14 14.31 7.59 32 DKIM_INVALID 20979 7.65 14.06 5.72 33 XM_B_Unsub 20827 11.45 13.96 10.69 34 FSL_BULK_SIG 20035 8.77 13.43 7.36 35 LOTS_OF_MONEY 19961 9.67 13.38 8.55 36 UNTRUSTED_Relay 19639 4.26 13.16 1.58 37 XM_Evil_Numbers_Gen 15710 8.45 10.53 7.83 38 NO_DNS_FOR_FROM 15700 4.66 10.52 2.90 39 HTML_IMAGE_RATIO_02 15565 8.19 10.43 7.52 40 XM_CamelCaseFrm001 14930 4.21 10.01 2.46 41 RCVD_IN_MSPIKE_H2 14299 13.73 9.58 14.97 42 LotsOfNums_01 14002 9.07 9.38 8.98 43 XMSexyCombo_05 13425 4.62 9.00 3.31 44 XM_B_COVIDMETA 13270 4.18 8.89 2.76 45 TooManyTo_001 12593 8.77 8.44 8.87 46 BAYES_80 12180 4.19 8.16 2.99 47 XM_UB50 12160 2.62 8.15 0.95 48 KHOP_HELO_FCRDNS 10667 3.36 7.15 2.22 49 URIBL_SBL_A 10481 1.77 7.02 0.19 50 XMSubMetaSx_00 9915 4.10 6.65 3.34 51 BAYES_60 9680 5.91 6.49 5.74 52 TR_XM_COVIDMETA4 9227 2.65 6.18 1.59 53 XM_SPF_SoftFail 8841 2.64 5.93 1.66 54 RCVD_IN_MSPIKE_BL 8742 2.79 5.86 1.86 55 XM_B_Unsub2 8573 3.02 5.75 2.20 56 XM_H_Long_From01 8445 5.71 5.66 5.73 57 HTML_MIME_NO_HTML_TAG 8399 3.42 5.63 2.75 58 RELAYCOUNTRY_CA 8376 2.39 5.61 1.42 59 TR_XM_MaxBayes 8106 1.27 5.43 0.02 60 MPART_ALT_DIFF 7919 6.12 5.31 6.37 61 MIME_QP_LONG_LINE 7723 6.07 5.18 6.35 62 RCVD_IN_MSPIKE_L3 7691 2.60 5.15 1.83 63 UNPARSEABLE_RELAY 7642 6.87 5.12 7.40 64 T_XMDrugObfuBody_08 7525 2.26 5.04 1.43 65 HTML_IMAGE_RATIO_04 7370 5.33 4.94 5.45 66 RCVD_IN_BL_SPAMCOP_NET 7285 1.66 4.88 0.69 67 XMNumbers 7132 3.50 4.78 3.12 68 ALL_TRUSTED 7056 11.77 4.73 13.89 69 XM_B_SpammyTLD 6693 2.68 4.49 2.14 70 XM_SendGrid 6441 6.16 4.32 6.72 71 XMHTML_After_End 6407 1.64 4.29 0.84 72 BAYES_95 6135 2.29 4.11 1.74 73 RDNS_DYNAMIC 6026 1.16 4.04 0.29 74 URIBL_RHS_DOB 5866 1.30 3.93 0.50 75 PDS_OTHER_BAD_TLD 5697 1.38 3.82 0.64 76 TR_LOTS_OF_MONEY3 5652 1.31 3.79 0.57 77 FROM_EXCESS_BASE64 5390 2.87 3.61 2.65 78 TooManyTo_002 5339 2.89 3.58 2.68 79 XMStrtUSub 5337 3.84 3.58 3.91 80 XMBody_17 5319 1.37 3.56 0.71 81 XM_OfRef6 5267 1.66 3.53 1.10 82 T_REMOTE_IMAGE 5068 3.70 3.40 3.79 83 BAYES_40 4822 5.10 3.23 5.66 84 XM_DIRTYINTL 4761 1.18 3.19 0.58 85 RCVD_IN_RP_RNBL 4724 0.80 3.17 0.08 86 TM2_M_URI_OPT_OUT 4708 3.21 3.16 3.23 87 MIME_HTML_MOSTLY 4658 2.83 3.12 2.74 88 TooManyTo_003 4504 2.10 3.02 1.82 89 HTML_IMAGE_RATIO_06 4476 3.76 3.00 3.99 90 HTML_SHORT_LINK_IMG_1 4455 0.70 2.99 0.01 91 BODY_URI_ONLY 4313 0.77 2.89 0.13 92 XM_URI_RBL 4237 0.81 2.84 0.20 93 DATE_IN_PAST_06_12 4140 0.83 2.77 0.25 94 RELAYCOUNTRY_FR 4135 0.80 2.77 0.20 95 RCVD_IN_MSPIKE_WL 3992 7.32 2.68 8.72 96 RCVD_IN_MSPIKE_H3 3992 7.32 2.68 8.72 97 FROM_SUSPICIOUS_NTLD 3966 0.64 2.66 0.03 98 TR_XM_PhishingBody 3935 1.59 2.64 1.27 99 URI_HEX 3912 1.64 2.62 1.34 100 MIME_HTML_ONLY_MULTI 3905 3.88 2.62 4.26 101 BAYES_20 3893 4.13 2.61 4.59 102 FROM_SUSPICIOUS_NTLD_FP 3865 0.62 2.59 0.03 103 DATE_IN_PAST_03_06 3775 0.78 2.53 0.26 104 TooManyTo_004 3695 1.61 2.48 1.35 105 SpammyFromTLD_01 3672 1.16 2.46 0.76 106 T_XMHurry_00 3660 0.98 2.45 0.53 107 SpammyFromTLD_02 3487 0.82 2.34 0.36 108 TR_XM_INV_DKIM 3483 0.63 2.33 0.12 109 T_FILL_THIS_FORM_SHORT 3460 1.46 2.32 1.20 110 URI_WP_HACKED_2 3387 0.61 2.27 0.11 111 RCVD_IN_IADB_LISTED 3240 4.59 2.17 5.31 112 FROM_MISSP_REPLYTO 3108 0.49 2.08 0.01 113 LongTLD 3067 0.60 2.06 0.16 114 HTML_IMAGE_RATIO_08 3067 2.55 2.06 2.70 115 DKIM_ADSP_NXDOMAIN 3045 0.76 2.04 0.38 116 XMDiploma_00 3028 1.57 2.03 1.43 117 T_TooManySym_01 2988 3.94 2.00 4.52 118 RCVD_IN_IADB_SPF 2979 4.04 2.00 4.65 119 T_XMDrugObfuBody_14 2950 2.07 1.98 2.10 120 RCVD_IN_IADB_DK 2906 3.58 1.95 4.07 121 TR_Mismatch_TLD_02 2905 0.53 1.95 0.10 122 RCVD_IN_IADB_SENDERID 2900 3.57 1.94 4.05 123 HDRS_MISSP 2878 0.49 1.93 0.06 124 TR_XM_DK_SendGrid 2784 3.30 1.87 3.73 125 HTML_IMAGE_ONLY_12 2724 0.59 1.83 0.22 126 DKIM_ADSP_CUSTOM_MED 2637 1.45 1.77 1.35 127 TooManyTo_005 2585 1.25 1.73 1.11 128 HDRS_LCASE_IMGONLY 2529 0.40 1.69 0.01 129 XM_NotFromAmazon 2524 0.40 1.69 0.02 130 URI_TRY_3LD 2523 1.64 1.69 1.62 131 TR_XM_PHPDW 2522 0.75 1.69 0.47 132 MIME_HEADER_CTYPE_ONLY 2493 0.54 1.67 0.20 133 XMStockSpam_06 2485 1.26 1.67 1.14 134 TM2_M_VERY_LONG_WORD 2472 1.35 1.66 1.25 135 DKIM_ADSP_ALL 2464 0.42 1.65 0.05 136 BAYES_00 2457 14.57 1.65 18.45 137 XM_UB80 2451 0.39 1.64 0.02 138 FORGED_GMAIL_RCVD 2447 0.74 1.64 0.47 139 TR_XM_PHPForged 2447 0.73 1.64 0.46 140 TR_XM_FormFill2 2426 0.73 1.63 0.46 141 XMBdyGiftCard01 2425 1.22 1.63 1.10 142 XM_H_PHPOS 2424 0.72 1.62 0.45 143 NO_FM_NAME_IP_HOSTN 2414 0.37 1.62 0.00 144 RCVD_IN_RP_SAFE 2404 6.76 1.61 8.30 145 SUSPICIOUS_RECIPS 2375 0.38 1.59 0.01 146 T_XMDrugObfuBody_00 2330 0.85 1.56 0.64 147 XMSexyCombo_01 2326 0.91 1.56 0.71 148 XMNoVowels 2270 0.74 1.52 0.51 149 NML_ADSP_CUSTOM_MED 2223 1.16 1.49 1.06 150 TO_NO_BRKTS_HTML_ONLY 2174 0.46 1.46 0.16 151 RELAYCOUNTRY_DE 2164 0.68 1.45 0.45 152 BAYES_05 2156 2.81 1.44 3.22 153 RELAYCOUNTRY_FI 2142 0.35 1.44 0.03 154 BOTNET_NORDNS 2121 0.34 1.42 0.02 155 XMMoneyMeta_00 2114 0.84 1.42 0.67 156 XMReplyNow 2102 0.39 1.41 0.08 157 XMBrknScrpt_02 2087 0.92 1.40 0.77 158 TR_XM_MaxSPIKE 2083 0.40 1.40 0.10 159 HTML_IMAGE_ONLY_04 2068 0.37 1.39 0.06 160 TO_MALFORMED 2048 1.42 1.37 1.44 161 DATE_IN_PAST_12_24 2014 0.41 1.35 0.13 162 XMGenDplmaNmb 1987 1.03 1.33 0.94 163 RCVD_IN_PSBL 1986 0.39 1.33 0.10 164 XM_UB60 1940 0.35 1.30 0.07 165 XM_DK_Undo_01 1936 1.67 1.30 1.78 166 TR_XM_RelayPhish 1822 0.41 1.22 0.16 167 SUBJ_ALL_CAPS 1815 1.50 1.22 1.59 168 RELAYCOUNTRY_GB 1799 1.24 1.21 1.25 169 TR_XM_DK_Bayes 1793 9.03 1.20 11.38 170 XMPhish30 1761 0.67 1.18 0.52 171 TR_LOTS_OF_MONEY2 1701 0.53 1.14 0.34 172 T_MONEY_PERCENT 1701 0.53 1.14 0.34 173 MAILING_LIST_MULTI 1674 2.07 1.12 2.36 174 RCVD_IN_RP_CERTIFIED 1662 5.94 1.11 7.39 175 XMSubMetaI_00 1636 0.57 1.10 0.41 176 DIET_1 1589 0.52 1.06 0.35 177 XM_ProductURIs 1583 1.81 1.06 2.04 178 RELAYCOUNTRY_ID 1582 0.26 1.06 0.02 179 URI_TRUNCATED 1551 0.26 1.04 0.03 180 XM_H_MailChimp 1524 0.39 1.02 0.19 181 T_HTML_ATTACH 1458 0.35 0.98 0.16 182 REMOVE_BEFORE_LINK 1452 0.50 0.97 0.35 183 TR_Symld_Words 1416 1.36 0.95 1.48 184 MONEY_FORM_SHORT 1416 0.23 0.95 0.01 185 URIBL_ABUSE_SURBL 1416 0.25 0.95 0.04 186 TR_XM_COVIDMETA1 1406 0.48 0.94 0.35 187 RELAYCOUNTRY_NG 1393 0.22 0.93 0.00 188 FORM_FRAUD 1375 0.21 0.92 0.00 189 XM_H_ZimbraSpoof2 1372 0.21 0.92 0.00 190 URI_DATA 1360 0.21 0.91 0.00 191 SUBJECT_NEEDS_ENCODING 1354 0.27 0.91 0.08 192 SUBJ_ILLEGAL_CHARS 1353 0.27 0.91 0.08 193 RELAYCOUNTRY_PE 1351 0.21 0.91 0.00 194 XMPhish08 1349 0.51 0.90 0.39 195 TR_Mismatch_TLD_01 1300 0.34 0.87 0.18 196 SHORT_SHORTNER 1296 0.22 0.87 0.02 197 HK_RANDOM_REPLYTO 1296 0.36 0.87 0.21 198 RELAYCOUNTRY_RU 1285 0.25 0.86 0.06 199 TR_MetaPhish_Combo_01 1256 0.84 0.84 0.84 200 UPGRADE_MAILBOX 1242 0.30 0.83 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 441002 90.48 95.69 88.91 2 RELAYCOUNTRY_US 410544 81.46 77.10 82.77 3 DKIM_SIGNED 368332 75.53 79.76 74.26 4 XM_DK_Pass 361991 73.87 76.84 72.98 5 XM_B_Unicode 353373 73.18 79.64 71.24 6 DKIM_VALID 339975 67.88 65.70 68.54 7 DCC_CHECK_NEGATIVE 282451 47.91 17.89 56.94 8 BAYES_50 266308 51.64 44.84 53.69 9 DKIM_VALID_AU 254181 50.89 49.72 51.24 10 XMListUnsubscribeExists 247830 54.31 68.78 49.96 11 XM_B_Unicode3 204271 41.32 41.80 41.18 12 DCC_CHECK 203714 50.19 80.51 41.07 13 T_TM2_M_HEADER_IN_MSG 139496 26.26 20.07 28.12 14 HTML_FONT_LOW_CONTRAST 134500 27.09 27.01 27.12 15 DKIM_VALID_EF 125924 26.12 28.56 25.39 16 LOC_TINY_FONT_1 121840 26.19 31.61 24.56 17 FVGT_m_MULTI_ODD 110349 22.75 24.43 22.25 18 MIME_HTML_ONLY 107065 25.80 39.83 21.58 19 XMSubLong 103353 21.36 23.10 20.84 20 T_KAM_HTML_FONT_INVALID 95646 22.27 32.22 19.28 21 BAYES_00 91526 14.57 1.65 18.45 22 RCVD_IN_MSPIKE_H2 74270 13.73 9.58 14.97 23 ALL_TRUSTED 68885 11.77 4.73 13.89 24 XM_Body_Dirty_Words 65275 14.97 21.01 13.16 25 XM_Multi_Part_URI 61401 13.17 15.81 12.38 26 TR_XM_DK_Bayes 56466 9.03 1.20 11.38 27 XM_B_Unsub 53024 11.45 13.96 10.69 28 TR_XM_DK_Bayes1 52263 8.26 0.71 10.54 29 TR_XM_DK_Bayes2 45355 7.15 0.54 9.14 30 LotsOfNums_01 44523 9.07 9.38 8.98 31 TooManyTo_001 43992 8.77 8.44 8.87 32 RCVD_IN_MSPIKE_H3 43228 7.32 2.68 8.72 33 RCVD_IN_MSPIKE_WL 43228 7.32 2.68 8.72 34 LOTS_OF_MONEY 42432 9.67 13.38 8.55 35 RCVD_IN_RP_SAFE 41191 6.76 1.61 8.30 36 XM_Evil_Numbers_Gen 38842 8.45 10.53 7.83 37 XM_DKIMWhitelistDomains 38026 5.90 0.04 7.67 38 XM_B_Phish_Phrases 37647 9.14 14.31 7.59 39 HTML_IMAGE_RATIO_02 37297 8.19 10.43 7.52 40 UNPARSEABLE_RELAY 36688 6.87 5.12 7.40 41 RCVD_IN_RP_CERTIFIED 36657 5.94 1.11 7.39 42 FSL_BULK_SIG 36526 8.77 13.43 7.36 43 XM_DK_Undo_02 35027 15.29 42.63 7.06 44 XM_SendGrid 33320 6.16 4.32 6.72 45 MPART_ALT_DIFF 31600 6.12 5.31 6.37 46 MIME_QP_LONG_LINE 31474 6.07 5.18 6.35 47 BAYES_60 28467 5.91 6.49 5.74 48 XM_H_Long_From01 28414 5.71 5.66 5.73 49 DKIM_INVALID 28357 7.65 14.06 5.72 50 BAYES_40 28092 5.10 3.23 5.66 51 HTML_IMAGE_RATIO_04 27020 5.33 4.94 5.45 52 RELAYCOUNTRY_META 26613 9.03 21.21 5.37 53 RCVD_IN_IADB_LISTED 26357 4.59 2.17 5.31 54 RCVD_IN_IADB_SPF 23069 4.04 2.00 4.65 55 BAYES_20 22767 4.13 2.61 4.59 56 T_TooManySym_01 22417 3.94 2.00 4.52 57 XM_PDF 22369 3.62 0.65 4.51 58 BOTNET_IPINHOSTNAME 21952 6.80 14.71 4.43 59 MIME_HTML_ONLY_MULTI 21137 3.88 2.62 4.26 60 RCVD_IN_IADB_DK 20203 3.58 1.95 4.07 61 RCVD_IN_IADB_SENDERID 20110 3.57 1.94 4.05 62 HTML_IMAGE_RATIO_06 19799 3.76 3.00 3.99 63 XM_H_Trusted_IP 19602 3.04 0.00 3.95 64 XMStrtUSub 19412 3.84 3.58 3.91 65 BAYES_99 19405 9.36 27.46 3.91 66 IN_ZIMBRA_NJ_WHITELIST 19255 2.99 0.01 3.88 67 T_REMOTE_IMAGE 18787 3.70 3.40 3.79 68 TR_XM_DK_SendGrid 18516 3.30 1.87 3.73 69 XM_UncommonTLD01 18195 6.59 16.30 3.67 70 XMSubMetaSx_00 16565 4.10 6.65 3.34 71 XMSexyCombo_05 16396 4.62 9.00 3.31 72 RCVD_IN_IADB_VOUCHED 16339 2.69 0.67 3.29 73 BAYES_999 16173 7.47 21.45 3.26 74 TM2_M_URI_OPT_OUT 16012 3.21 3.16 3.23 75 BAYES_05 15962 2.81 1.44 3.22 76 XMNumbers 15469 3.50 4.78 3.12 77 BAYES_80 14839 4.19 8.16 2.99 78 ANY_BOUNCE_MESSAGE 14442 2.34 0.42 2.91 79 BOUNCE_MESSAGE 14433 2.33 0.41 2.91 80 NO_DNS_FOR_FROM 14369 4.66 10.52 2.90 81 XM_B_COVIDMETA 13699 4.18 8.89 2.76 82 HTML_MIME_NO_HTML_TAG 13663 3.42 5.63 2.75 83 MIME_HTML_MOSTLY 13571 2.83 3.12 2.74 84 HTML_IMAGE_RATIO_08 13403 2.55 2.06 2.70 85 TooManyTo_002 13310 2.89 3.58 2.68 86 BOTNET 13279 6.68 20.00 2.68 87 FROM_EXCESS_BASE64 13153 2.87 3.61 2.65 88 XM_CamelCaseFrm001 12204 4.21 10.01 2.46 89 MAILING_LIST_MULTI 11701 2.07 1.12 2.36 90 HTML_FONT_FACE_BAD 11487 1.93 0.63 2.32 91 KHOP_HELO_FCRDNS 11012 3.36 7.15 2.22 92 XM_B_Unsub2 10937 3.02 5.75 2.20 93 XM_B_SpammyTLD 10597 2.68 4.49 2.14 94 T_XMDrugObfuBody_14 10413 2.07 1.98 2.10 95 XM_ProductURIs 10111 1.81 1.06 2.04 96 RCVD_IN_IADB_OPTIN 10058 1.64 0.34 2.03 97 T_TooManySym_02 9870 1.65 0.52 1.99 98 TR_DCC_Bayes_99 9575 6.72 22.66 1.93 99 RCVD_IN_MSPIKE_BL 9229 2.79 5.86 1.86 100 RCVD_IN_MSPIKE_L3 9073 2.60 5.15 1.83 101 TooManyTo_003 9038 2.10 3.02 1.82 102 XM_DK_Undo_01 8828 1.67 1.30 1.78 103 BAYES_95 8643 2.29 4.11 1.74 104 TVD_RCVD_IP 8408 1.38 0.35 1.70 105 XM_SPF_SoftFail 8222 2.64 5.93 1.66 106 URI_TRY_3LD 8057 1.64 1.69 1.62 107 SUBJ_ALL_CAPS 7891 1.50 1.22 1.59 108 TR_XM_COVIDMETA4 7865 2.65 6.18 1.59 109 UNTRUSTED_Relay 7849 4.26 13.16 1.58 110 IN_HORDE_ADDRESS_BOOK 7837 1.22 0.03 1.58 111 HELO_NODOT 7483 1.28 0.51 1.51 112 HELO_NO_DOMAIN 7483 1.28 0.51 1.51 113 INVALID_MSGID 7442 1.21 0.25 1.50 114 TR_Symld_Words 7354 1.36 0.95 1.48 115 XMSubNoVowel 7267 1.24 0.51 1.47 116 TO_MALFORMED 7137 1.42 1.37 1.44 117 XMDiploma_00 7082 1.57 2.03 1.43 118 T_XMDrugObfuBody_08 7070 2.26 5.04 1.43 119 RELAYCOUNTRY_CA 7057 2.39 5.61 1.42 120 CK_HELO_DYNAMIC_SPLIT_IP 6936 1.10 0.13 1.40 121 HELO_DYNAMIC_IPADDR2 6906 1.08 0.06 1.39 122 XM_GoogleGroups 6792 1.17 0.52 1.37 123 TooManyTo_004 6715 1.61 2.48 1.35 124 DKIM_ADSP_CUSTOM_MED 6701 1.45 1.77 1.35 125 URI_HEX 6638 1.64 2.62 1.34 126 TR_XM_PhishingBody 6298 1.59 2.64 1.27 127 XMGappySubj_01 6223 0.99 0.11 1.25 128 TM2_M_VERY_LONG_WORD 6223 1.35 1.66 1.25 129 RELAYCOUNTRY_GB 6190 1.24 1.21 1.25 130 USER_IN_DEF_DKIM_WL 6169 0.96 0.00 1.24 131 T_FILL_THIS_FORM_SHORT 5963 1.46 2.32 1.20 132 XMCapTrack 5806 1.01 0.48 1.17 133 XMStockSpam_06 5632 1.26 1.67 1.14 134 TooManyTo_005 5512 1.25 1.73 1.11 135 XMBdyGiftCard01 5452 1.22 1.63 1.10 136 XM_OfRef6 5444 1.66 3.53 1.10 137 NML_ADSP_CUSTOM_MED 5244 1.16 1.49 1.06 138 XM_H_Long_From02 5168 0.98 0.76 1.04 139 XM_UB50 4716 2.62 8.15 0.95 140 XMGenDplmaNmb 4681 1.03 1.33 0.94 141 XMHTML_After_End 4183 1.64 4.29 0.84 142 TR_MetaPhish_Combo_01 4142 0.84 0.84 0.84 143 HTTPS_HTTP_MISMATCH 3850 0.75 0.68 0.78 144 XMBrknScrpt_02 3824 0.92 1.40 0.77 145 SpammyFromTLD_01 3789 1.16 2.46 0.76 146 XMBody_17 3540 1.37 3.56 0.71 147 XMSexyCombo_01 3536 0.91 1.56 0.71 148 RCVD_IN_BL_SPAMCOP_NET 3436 1.66 4.88 0.69 149 XMMoneyMeta_00 3312 0.84 1.42 0.67 150 PDS_OTHER_BAD_TLD 3182 1.38 3.82 0.64 151 T_XMDrugObfuBody_00 3181 0.85 1.56 0.64 152 TR_MSPIKEBAYES00 3145 0.50 0.04 0.63 153 FROM_GOV_DKIM_AU 2979 0.49 0.12 0.60 154 T_TooManySym_03 2956 0.49 0.13 0.60 155 XM_DIRTYINTL 2874 1.18 3.19 0.58 156 HTML_IMAGE_ONLY_20 2862 0.50 0.26 0.58 157 TR_LOTS_OF_MONEY3 2815 1.31 3.79 0.57 158 XMHTMLBadTable_001 2784 0.57 0.59 0.56 159 XM_SPF_Unknown 2705 0.59 0.73 0.55 160 T_OBFU_PDF_ATTACH 2690 0.45 0.14 0.54 161 T_XMHurry_00 2650 0.98 2.45 0.53 162 MISSING_HEADERS 2572 0.51 0.50 0.52 163 XMPhish30 2557 0.67 1.18 0.52 164 XMNoVowels 2514 0.74 1.52 0.51 165 URIBL_RHS_DOB 2502 1.30 3.93 0.50 166 XMSubMetaSxObfu_03 2501 0.57 0.78 0.50 167 XM_ShortIntro_01 2476 0.46 0.32 0.50 168 RCVD_IN_SORBS_DUL 2469 0.48 0.44 0.50 169 XMLngstWrd_00 2455 0.51 0.54 0.49 170 XM_RXBody 2448 0.46 0.35 0.49 171 PLING_QUERY 2351 0.55 0.80 0.47 172 FROM_GOV_SPOOF 2331 0.42 0.25 0.47 173 TR_XM_PHPDW 2325 0.75 1.69 0.47 174 NORDNS_LOW_CONTRAST 2320 0.41 0.21 0.47 175 FORGED_GMAIL_RCVD 2308 0.74 1.64 0.47 176 URI_NOVOWEL 2294 0.47 0.50 0.46 177 TR_XM_PHPForged 2265 0.73 1.64 0.46 178 XM_H_PHPMailer 2261 0.53 0.79 0.46 179 TR_XM_FormFill2 2258 0.73 1.63 0.46 180 TM2_M_A_HREF_HREF 2236 0.47 0.53 0.45 181 RELAYCOUNTRY_DE 2235 0.68 1.45 0.45 182 XM_H_PHPOS 2228 0.72 1.62 0.45 183 MPART_ALT_DIFF_COUNT 2177 0.49 0.67 0.44 184 XMBody_95 2141 0.35 0.08 0.43 185 XMLngstWrd_01 2139 0.43 0.41 0.43 186 T_Symld_Words_02 2056 0.50 0.78 0.41 187 XMSubMetaI_00 2049 0.57 1.10 0.41 188 RELAYCOUNTRY_AU 1981 0.45 0.61 0.40 189 HTML_IMAGE_ONLY_32 1950 0.33 0.12 0.39 190 XMPhish08 1936 0.51 0.90 0.39 191 HTML_TAG_BALANCE_BODY 1921 0.46 0.70 0.39 192 T_MANY_PILL_PRICE 1910 0.30 0.00 0.39 193 SHORT_HELO_AND_INLINE_IMAGE 1878 0.30 0.02 0.38 194 DKIM_ADSP_NXDOMAIN 1876 0.76 2.04 0.38 195 TM2_M_BODY_EMPTY 1876 0.31 0.08 0.38 196 XMGappySubj_02 1868 0.30 0.03 0.38 197 FILL_THIS_FORM 1863 0.32 0.12 0.38 198 XMRcvdHeader_15 1833 0.28 0.00 0.37 199 HTML_IMAGE_ONLY_28 1811 0.34 0.28 0.37 200 SpammyFromTLD_02 1796 0.82 2.34 0.36 ----------------------------------------------------------------------