Email: 677135 Autolearn: 0 AvgScore: 1.69 AvgScanTime: 2.17 sec Spam: 141267 Autolearn: 0 AvgScore: 12.36 AvgScanTime: 3.85 sec Ham: 535868 Autolearn: 0 AvgScore: -1.12 AvgScanTime: 1.73 sec Time Spent Running SA: 408.21 hours Time Spent Processing Spam: 150.93 hours Time Spent Processing Ham: 257.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134341 90.71 95.10 89.56 2 DKIM_SIGNED 119608 73.25 84.67 70.23 3 XM_DK_Pass 116138 71.85 82.21 69.11 4 RELAYCOUNTRY_US 112440 80.64 79.59 80.92 5 DCC_CHECK 112435 46.44 79.59 37.70 6 XM_B_Unicode 107424 71.89 76.04 70.79 7 XMListUnsubscribeExists 103753 52.93 73.44 47.52 8 DKIM_VALID 99591 66.07 70.50 64.90 9 DKIM_VALID_AU 74406 48.86 52.67 47.86 10 XM_DK_Undo_02 64017 14.48 45.32 6.36 11 BAYES_50 60605 49.60 42.90 51.37 12 XM_B_Unicode3 56319 39.32 39.87 39.18 13 MIME_HTML_ONLY 53585 26.51 37.93 23.50 14 LOC_TINY_FONT_1 49274 28.60 34.88 26.95 15 DKIM_VALID_EF 43634 25.48 30.89 24.06 16 BAYES_99 42181 8.89 29.86 3.36 17 HTML_FONT_LOW_CONTRAST 39962 25.26 28.29 24.46 18 T_KAM_HTML_FONT_INVALID 39732 20.22 28.13 18.13 19 FVGT_m_MULTI_ODD 37081 22.20 26.25 21.13 20 TR_DCC_Bayes_99 33713 6.26 23.86 1.62 21 BAYES_999 33433 7.06 23.67 2.68 22 XMSubLong 33401 20.42 23.64 19.57 23 RELAYCOUNTRY_META 31622 8.77 22.38 5.18 24 BOTNET 30075 6.54 21.29 2.65 25 T_TM2_M_HEADER_IN_MSG 29781 26.17 21.08 27.51 26 XM_Body_Dirty_Words 26908 13.31 19.05 11.79 27 DCC_CHECK_NEGATIVE 26339 51.61 18.64 60.30 28 XM_Multi_Part_URI 24433 12.26 17.30 10.94 29 XM_UncommonTLD01 20765 5.79 14.70 3.44 30 DKIM_INVALID 20017 7.18 14.17 5.34 31 BOTNET_IPINHOSTNAME 19914 6.18 14.10 4.09 32 XM_B_Phish_Phrases 19472 8.29 13.78 6.84 33 LOTS_OF_MONEY 18803 8.91 13.31 7.75 34 UNTRUSTED_Relay 18499 3.96 13.10 1.55 35 XM_B_Unsub 16398 10.34 11.61 10.01 36 HTML_IMAGE_RATIO_02 16395 7.99 11.61 7.04 37 FSL_BULK_SIG 16113 7.36 11.41 6.29 38 NO_DNS_FOR_FROM 15362 4.65 10.87 3.01 39 RCVD_IN_MSPIKE_H2 14532 13.59 10.29 14.46 40 XMSexyCombo_05 14444 4.57 10.22 3.08 41 XM_Evil_Numbers_Gen 13804 8.01 9.77 7.54 42 XM_CamelCaseFrm001 13106 3.36 9.28 1.79 43 LotsOfNums_01 12476 8.35 8.83 8.22 44 RCVD_IN_MSPIKE_BL 12405 3.29 8.78 1.85 45 BAYES_80 11232 4.06 7.95 3.03 46 XM_B_COVIDMETA 11095 3.33 7.85 2.14 47 XM_UB50 10985 2.39 7.78 0.97 48 RCVD_IN_MSPIKE_L3 10853 3.04 7.68 1.82 49 URIBL_SBL_A 10070 1.89 7.13 0.51 50 TR_XM_COVIDMETA4 9578 2.45 6.78 1.31 51 XMSubMetaSx_00 9231 3.99 6.53 3.32 52 RELAYCOUNTRY_CA 9177 2.55 6.50 1.51 53 BAYES_60 9029 6.24 6.39 6.20 54 T_XMDrugObfuBody_08 8613 2.41 6.10 1.44 55 XM_H_Long_From01 8085 5.21 5.72 5.07 56 TR_XM_MaxBayes 8054 1.21 5.70 0.02 57 MPART_ALT_DIFF 8045 9.18 5.69 10.10 58 RCVD_IN_BL_SPAMCOP_NET 7736 1.72 5.48 0.72 59 KHOP_HELO_FCRDNS 7240 4.21 5.13 3.97 60 TooManyTo_001 7224 7.42 5.11 8.02 61 XM_SPF_SoftFail 7133 2.32 5.05 1.60 62 UNPARSEABLE_RELAY 7117 6.66 5.04 7.08 63 HTML_IMAGE_RATIO_04 7040 4.70 4.98 4.62 64 BAYES_95 6305 2.26 4.46 1.68 65 MIME_QP_LONG_LINE 6286 5.37 4.45 5.62 66 XM_SendGrid 6165 6.05 4.36 6.49 67 RELAYCOUNTRY_FR 6007 1.07 4.25 0.23 68 MIME_HTML_MOSTLY 5803 3.60 4.11 3.47 69 RCVD_IN_RP_RNBL 5769 0.91 4.08 0.07 70 XM_OfRef6 5721 1.59 4.05 0.95 71 XMNumbers 5714 3.48 4.04 3.33 72 XM_DIRTYINTL 5656 1.17 4.00 0.42 73 PDS_OTHER_BAD_TLD 5563 2.47 3.94 2.08 74 XMStrtUSub 5548 3.84 3.93 3.82 75 XM_B_SpammyTLD 5450 2.51 3.86 2.16 76 SpammyFromTLD_02 5210 0.99 3.69 0.28 77 XMBody_17 5079 1.16 3.60 0.52 78 TM2_M_URI_OPT_OUT 4886 3.17 3.46 3.10 79 RDNS_DYNAMIC 4519 0.90 3.20 0.30 80 XM_URI_RBL 4494 0.81 3.18 0.18 81 BAYES_40 4403 5.25 3.12 5.81 82 DATE_IN_PAST_03_06 4248 0.69 3.01 0.08 83 HTML_IMAGE_RATIO_06 4230 3.53 2.99 3.67 84 RCVD_IN_MSPIKE_WL 4164 7.32 2.95 8.48 85 RCVD_IN_MSPIKE_H3 4164 7.32 2.95 8.48 86 HTML_MIME_NO_HTML_TAG 3983 2.58 2.82 2.51 87 FROM_EXCESS_BASE64 3962 2.64 2.80 2.60 88 TR_XM_PhishingBody 3917 1.58 2.77 1.27 89 T_XMHurry_00 3912 0.99 2.77 0.52 90 XMHTML_After_End 3911 1.10 2.77 0.66 91 XM_B_Unsub2 3826 2.09 2.71 1.93 92 URI_HEX 3803 1.64 2.69 1.36 93 MIME_HTML_ONLY_MULTI 3779 6.16 2.68 7.08 94 SpammyFromTLD_01 3763 1.23 2.66 0.85 95 XMDiploma_00 3566 1.65 2.52 1.42 96 TR_XM_INV_DKIM 3466 0.58 2.45 0.09 97 HTML_IMAGE_RATIO_08 3398 2.39 2.41 2.39 98 TR_LOTS_OF_MONEY3 3394 0.97 2.40 0.59 99 FROM_SUSPICIOUS_NTLD 3296 0.51 2.33 0.03 100 BOTNET_NORDNS 3253 0.49 2.30 0.01 101 RELAYCOUNTRY_IN 3241 0.55 2.29 0.08 102 FROM_SUSPICIOUS_NTLD_FP 3225 0.50 2.28 0.03 103 BAYES_20 3210 4.29 2.27 4.82 104 RCVD_IN_IADB_LISTED 3146 4.31 2.23 4.85 105 DKIM_ADSP_NXDOMAIN 3114 0.69 2.20 0.29 106 TR_XM_PHPDW 3046 1.25 2.16 1.00 107 LongTLD 3034 0.56 2.15 0.14 108 BODY_URI_ONLY 3031 0.51 2.15 0.07 109 TR_XM_PHPForged 3023 1.23 2.14 0.99 110 TR_Symld_Words 3018 1.50 2.14 1.34 111 TR_XM_FormFill2 2999 1.22 2.12 0.99 112 XM_H_PHPOS 2981 1.22 2.11 0.98 113 T_REMOTE_IMAGE 2943 3.32 2.08 3.65 114 RCVD_IN_IADB_SPF 2836 3.77 2.01 4.23 115 RCVD_IN_IADB_DK 2737 3.28 1.94 3.64 116 RCVD_IN_PSBL 2714 0.45 1.92 0.06 117 RCVD_IN_IADB_SENDERID 2705 3.34 1.91 3.72 118 T_TooManySym_01 2701 3.59 1.91 4.03 119 DATE_IN_PAST_12_24 2700 0.49 1.91 0.12 120 URI_TRY_3LD 2674 1.56 1.89 1.47 121 TR_XM_MaxSPIKE 2671 0.49 1.89 0.12 122 XMSexyCombo_01 2658 0.90 1.88 0.65 123 TM2_M_VERY_LONG_WORD 2616 1.24 1.85 1.08 124 TR_XM_DK_SendGrid 2610 3.23 1.85 3.60 125 XMStockSpam_06 2602 0.87 1.84 0.62 126 BAYES_00 2543 16.31 1.80 20.14 127 DATE_IN_PAST_06_12 2542 0.50 1.80 0.16 128 XMGenDplmaNmb 2496 1.09 1.77 0.91 129 RELAYCOUNTRY_DE 2389 0.70 1.69 0.44 130 T_XMDrugObfuBody_14 2368 1.36 1.68 1.27 131 XM_DK_Undo_01 2285 1.85 1.62 1.91 132 MAILING_LIST_MULTI 2243 2.25 1.59 2.42 133 T_XMDrugObfuBody_00 2214 0.91 1.57 0.74 134 TR_XM_RelayPhish 2189 0.43 1.55 0.13 135 RCVD_IN_RP_SAFE 2074 6.59 1.47 7.94 136 RELAYCOUNTRY_GB 2061 1.20 1.46 1.13 137 TR_MetaPhish_Combo_01 1968 1.12 1.39 1.04 138 ALL_TRUSTED 1942 12.68 1.37 15.66 139 TR_XM_DK_Bayes 1938 9.63 1.37 11.80 140 URIBL_DBL_SPAM 1888 0.29 1.34 0.01 141 HTML_SHORT_LINK_IMG_1 1852 0.28 1.31 0.01 142 TR_LOTS_OF_MONEY2 1848 0.52 1.31 0.31 143 T_MONEY_PERCENT 1848 0.52 1.31 0.31 144 XM_UB60 1841 0.33 1.30 0.07 145 HTML_IMAGE_ONLY_08 1806 0.35 1.28 0.11 146 XMMoneyMeta_00 1778 0.80 1.26 0.68 147 XMSubMetaI_00 1775 0.78 1.26 0.66 148 XMBody_78 1748 0.49 1.24 0.29 149 BAYES_05 1739 3.10 1.23 3.59 150 SUBJ_ALL_CAPS 1720 1.32 1.22 1.35 151 XM_UB80 1679 0.26 1.19 0.02 152 TO_MALFORMED 1664 1.30 1.18 1.33 153 XMBrknScrpt_02 1663 1.02 1.18 0.97 154 MISSING_HEADERS 1626 0.83 1.15 0.75 155 XM_ProductURIs 1617 1.27 1.14 1.31 156 XM_OfRef7 1595 0.32 1.13 0.11 157 XM_UB99 1569 0.23 1.11 0.00 158 XM_H_PHPOS_M 1539 0.34 1.09 0.15 159 XMPhish30 1508 0.66 1.07 0.55 160 XM_SPF_Unknown 1459 0.65 1.03 0.55 161 MPART_ALT_DIFF_COUNT 1453 0.49 1.03 0.35 162 RCVD_IN_IADB_VOUCHED 1453 2.68 1.03 3.11 163 TR_Mismatch_TLD_01 1451 0.40 1.03 0.23 164 XM_H_MailChimp 1427 0.34 1.01 0.16 165 HK_RANDOM_REPLYTO 1424 0.37 1.01 0.20 166 T_FILL_THIS_FORM_SHORT 1361 0.84 0.96 0.81 167 URG_BIZ 1353 0.30 0.96 0.12 168 RCVD_IN_RP_CERTIFIED 1333 5.89 0.94 7.19 169 XMPhish14 1332 0.47 0.94 0.34 170 REMOVE_BEFORE_LINK 1332 0.38 0.94 0.23 171 HTTPS_HTTP_MISMATCH 1292 0.83 0.91 0.80 172 XM_H_PHPMailer 1282 0.58 0.91 0.50 173 DKIM_ADSP_CUSTOM_MED 1268 1.13 0.90 1.19 174 XM_XX_Yahoo 1251 0.21 0.89 0.03 175 XMSolicitRefs_0 1200 0.44 0.85 0.33 176 XM_H_Long_From02 1185 1.11 0.84 1.18 177 TR_Mismatch_TLD_02 1169 0.24 0.83 0.09 178 TR_XM_DK_Bayes1 1145 8.85 0.81 10.97 179 TR_XM_COVIDMETA2 1134 0.41 0.80 0.31 180 TR_XM_COVIDMETA1 1119 0.27 0.79 0.13 181 RCVD_IN_MSPIKE_L5 1113 0.17 0.79 0.00 182 XM_UB999 1110 0.17 0.79 0.00 183 ANY_BOUNCE_MESSAGE 1107 2.41 0.78 2.83 184 BOUNCE_MESSAGE 1102 2.41 0.78 2.83 185 XMPhish08 1097 0.45 0.78 0.36 186 ADVANCE_FEE_5_NEW_FRM_MNY 1094 0.16 0.77 0.00 187 LOW_PRICE 1093 0.27 0.77 0.14 188 HTML_FONT_SIZE_HUGE 1087 0.24 0.77 0.10 189 XM_HighProb1 1083 0.16 0.77 0.00 190 BILLION_DOLLARS 1072 0.17 0.76 0.01 191 XM_PDF 1069 3.72 0.76 4.50 192 XMBdyGiftCard01 1069 0.89 0.76 0.93 193 SCRIPT_GIBBERISH 1063 0.16 0.75 0.00 194 TR_XM_COVIDMETA3 1061 0.18 0.75 0.03 195 XMSexyCombo_04 1054 0.21 0.75 0.07 196 FILL_THIS_FORM 1054 0.36 0.75 0.26 197 URIBL_BLACK 1039 0.17 0.74 0.03 198 NML_ADSP_CUSTOM_MED 1037 0.83 0.73 0.86 199 TR_XM_DK_Bayes2 1025 7.86 0.73 9.74 200 T_Symld_Words_02 997 0.60 0.71 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 479913 90.71 95.10 89.56 2 RELAYCOUNTRY_US 433632 80.64 79.59 80.92 3 XM_B_Unicode 379361 71.89 76.04 70.79 4 DKIM_SIGNED 376365 73.25 84.67 70.23 5 XM_DK_Pass 370364 71.85 82.21 69.11 6 DKIM_VALID 347764 66.07 70.50 64.90 7 DCC_CHECK_NEGATIVE 323148 51.61 18.64 60.30 8 BAYES_50 275262 49.60 42.90 51.37 9 DKIM_VALID_AU 256449 48.86 52.67 47.86 10 XMListUnsubscribeExists 254649 52.93 73.44 47.52 11 XM_B_Unicode3 209928 39.32 39.87 39.18 12 DCC_CHECK 202049 46.44 79.59 37.70 13 T_TM2_M_HEADER_IN_MSG 147429 26.17 21.08 27.51 14 LOC_TINY_FONT_1 144419 28.60 34.88 26.95 15 HTML_FONT_LOW_CONTRAST 131075 25.26 28.29 24.46 16 DKIM_VALID_EF 128933 25.48 30.89 24.06 17 MIME_HTML_ONLY 125920 26.51 37.93 23.50 18 FVGT_m_MULTI_ODD 113217 22.20 26.25 21.13 19 BAYES_00 107925 16.31 1.80 20.14 20 XMSubLong 104876 20.42 23.64 19.57 21 T_KAM_HTML_FONT_INVALID 97154 20.22 28.13 18.13 22 ALL_TRUSTED 83921 12.68 1.37 15.66 23 RCVD_IN_MSPIKE_H2 77467 13.59 10.29 14.46 24 TR_XM_DK_Bayes 63253 9.63 1.37 11.80 25 XM_Body_Dirty_Words 63194 13.31 19.05 11.79 26 TR_XM_DK_Bayes1 58791 8.85 0.81 10.97 27 XM_Multi_Part_URI 58600 12.26 17.30 10.94 28 MPART_ALT_DIFF 54136 9.18 5.69 10.10 29 XM_B_Unsub 53629 10.34 11.61 10.01 30 TR_XM_DK_Bayes2 52212 7.86 0.73 9.74 31 RCVD_IN_MSPIKE_WL 45426 7.32 2.95 8.48 32 RCVD_IN_MSPIKE_H3 45426 7.32 2.95 8.48 33 LotsOfNums_01 44066 8.35 8.83 8.22 34 TooManyTo_001 43003 7.42 5.11 8.02 35 RCVD_IN_RP_SAFE 42543 6.59 1.47 7.94 36 LOTS_OF_MONEY 41543 8.91 13.31 7.75 37 XM_Evil_Numbers_Gen 40427 8.01 9.77 7.54 38 RCVD_IN_RP_CERTIFIED 38545 5.89 0.94 7.19 39 UNPARSEABLE_RELAY 37963 6.66 5.04 7.08 40 MIME_HTML_ONLY_MULTI 37935 6.16 2.68 7.08 41 HTML_IMAGE_RATIO_02 37724 7.99 11.61 7.04 42 XM_B_Phish_Phrases 36632 8.29 13.78 6.84 43 XM_DKIMWhitelistDomains 35621 5.27 0.04 6.65 44 XM_SendGrid 34800 6.05 4.36 6.49 45 IN_ZIMBRA_NJ_WHITELIST 34189 5.05 0.02 6.38 46 XM_DK_Undo_02 34066 14.48 45.32 6.36 47 FSL_BULK_SIG 33698 7.36 11.41 6.29 48 BAYES_60 33202 6.24 6.39 6.20 49 BAYES_40 31153 5.25 3.12 5.81 50 MIME_QP_LONG_LINE 30100 5.37 4.45 5.62 51 HTML_FONT_FACE_BAD 28759 4.38 0.65 5.37 52 DKIM_INVALID 28601 7.18 14.17 5.34 53 RELAYCOUNTRY_META 27766 8.77 22.38 5.18 54 XM_H_Long_From01 27183 5.21 5.72 5.07 55 RCVD_IN_IADB_LISTED 26007 4.31 2.23 4.85 56 BAYES_20 25808 4.29 2.27 4.82 57 HTML_IMAGE_RATIO_04 24776 4.70 4.98 4.62 58 XM_PDF 24123 3.72 0.76 4.50 59 RCVD_IN_IADB_SPF 22685 3.77 2.01 4.23 60 BOTNET_IPINHOSTNAME 21924 6.18 14.10 4.09 61 T_TooManySym_01 21615 3.59 1.91 4.03 62 KHOP_HELO_FCRDNS 21263 4.21 5.13 3.97 63 XMStrtUSub 20470 3.84 3.93 3.82 64 RCVD_IN_IADB_SENDERID 19911 3.34 1.91 3.72 65 HTML_IMAGE_RATIO_06 19643 3.53 2.99 3.67 66 T_REMOTE_IMAGE 19560 3.32 2.08 3.65 67 RCVD_IN_IADB_DK 19500 3.28 1.94 3.64 68 TR_XM_DK_SendGrid 19277 3.23 1.85 3.60 69 BAYES_05 19224 3.10 1.23 3.59 70 MIME_HTML_MOSTLY 18576 3.60 4.11 3.47 71 XM_UncommonTLD01 18408 5.79 14.70 3.44 72 BAYES_99 18020 8.89 29.86 3.36 73 XMNumbers 17859 3.48 4.04 3.33 74 XMSubMetaSx_00 17791 3.99 6.53 3.32 75 RCVD_IN_IADB_VOUCHED 16664 2.68 1.03 3.11 76 TM2_M_URI_OPT_OUT 16611 3.17 3.46 3.10 77 XMSexyCombo_05 16490 4.57 10.22 3.08 78 BAYES_80 16246 4.06 7.95 3.03 79 NO_DNS_FOR_FROM 16129 4.65 10.87 3.01 80 ANY_BOUNCE_MESSAGE 15189 2.41 0.78 2.83 81 BOUNCE_MESSAGE 15188 2.41 0.78 2.83 82 BAYES_999 14356 7.06 23.67 2.68 83 BOTNET 14213 6.54 21.29 2.65 84 XM_H_Trusted_IP 14211 2.10 0.00 2.65 85 FROM_EXCESS_BASE64 13918 2.64 2.80 2.60 86 HTML_MIME_NO_HTML_TAG 13455 2.58 2.82 2.51 87 MAILING_LIST_MULTI 12980 2.25 1.59 2.42 88 HTML_IMAGE_RATIO_08 12785 2.39 2.41 2.39 89 TooManyTo_002 11710 1.85 0.56 2.19 90 XMSubNoVowel 11598 1.82 0.52 2.16 91 XM_B_SpammyTLD 11551 2.51 3.86 2.16 92 XM_B_COVIDMETA 11459 3.33 7.85 2.14 93 PDS_OTHER_BAD_TLD 11165 2.47 3.94 2.08 94 RCVD_IN_IADB_OPTIN 10503 1.69 0.65 1.96 95 XM_B_Unsub2 10326 2.09 2.71 1.93 96 XM_DK_Undo_01 10227 1.85 1.62 1.91 97 T_TooManySym_02 10162 1.63 0.60 1.90 98 RCVD_IN_MSPIKE_BL 9897 3.29 8.78 1.85 99 RCVD_IN_MSPIKE_L3 9753 3.04 7.68 1.82 100 XM_CamelCaseFrm001 9612 3.36 9.28 1.79 101 TVD_RCVD_IP 9238 1.42 0.27 1.72 102 HELO_NODOT 9102 1.47 0.58 1.70 103 HELO_NO_DOMAIN 9099 1.46 0.58 1.70 104 BAYES_95 9025 2.26 4.46 1.68 105 TR_DCC_Bayes_99 8663 6.26 23.86 1.62 106 XM_SPF_SoftFail 8600 2.32 5.05 1.60 107 UNTRUSTED_Relay 8294 3.96 13.10 1.55 108 TooManyTo_003 8227 1.31 0.46 1.54 109 RELAYCOUNTRY_CA 8066 2.55 6.50 1.51 110 URI_TRY_3LD 7894 1.56 1.89 1.47 111 IN_HORDE_ADDRESS_BOOK 7725 1.15 0.05 1.44 112 T_XMDrugObfuBody_08 7713 2.41 6.10 1.44 113 XMDiploma_00 7607 1.65 2.52 1.42 114 INVALID_MSGID 7472 1.16 0.29 1.39 115 URI_HEX 7299 1.64 2.69 1.36 116 SUBJ_ALL_CAPS 7247 1.32 1.22 1.35 117 TR_Symld_Words 7162 1.50 2.14 1.34 118 HELO_MISC_IP 7132 1.07 0.08 1.33 119 TO_MALFORMED 7121 1.30 1.18 1.33 120 CK_HELO_DYNAMIC_SPLIT_IP 7118 1.07 0.08 1.33 121 XM_ProductURIs 7008 1.27 1.14 1.31 122 TR_XM_COVIDMETA4 7004 2.45 6.78 1.31 123 BAD_ENC_HEADER 6935 1.03 0.04 1.29 124 T_XMDrugObfuBody_14 6817 1.36 1.68 1.27 125 XM_GoogleGroups 6815 1.13 0.57 1.27 126 TR_XM_PhishingBody 6805 1.58 2.77 1.27 127 XMCapTrack 6658 1.09 0.51 1.24 128 DKIM_ADSP_CUSTOM_MED 6371 1.13 0.90 1.19 129 XM_H_Long_From02 6319 1.11 0.84 1.18 130 TooManyTo_004 6192 1.00 0.39 1.16 131 RELAYCOUNTRY_GB 6033 1.20 1.46 1.13 132 TM2_M_VERY_LONG_WORD 5772 1.24 1.85 1.08 133 TR_MetaPhish_Combo_01 5592 1.12 1.39 1.04 134 USER_IN_DEF_DKIM_WL 5473 0.81 0.00 1.02 135 TR_XM_PHPDW 5385 1.25 2.16 1.00 136 TR_XM_PHPForged 5280 1.23 2.14 0.99 137 TR_XM_FormFill2 5279 1.22 2.12 0.99 138 TooManyTo_005 5250 0.84 0.32 0.98 139 XM_H_PHPOS 5249 1.22 2.11 0.98 140 XMBrknScrpt_02 5224 1.02 1.18 0.97 141 XM_UB50 5183 2.39 7.78 0.97 142 XM_OfRef6 5075 1.59 4.05 0.95 143 XMBdyGiftCard01 4991 0.89 0.76 0.93 144 XMGappySubj_01 4888 0.74 0.10 0.91 145 XMGenDplmaNmb 4869 1.09 1.77 0.91 146 NML_ADSP_CUSTOM_MED 4591 0.83 0.73 0.86 147 SpammyFromTLD_01 4548 1.23 2.66 0.85 148 T_FILL_THIS_FORM_SHORT 4327 0.84 0.96 0.81 149 HTTPS_HTTP_MISMATCH 4297 0.83 0.91 0.80 150 MISSING_HEADERS 4006 0.83 1.15 0.75 151 TR_MSPIKEBAYES00 3990 0.59 0.01 0.74 152 T_XMDrugObfuBody_00 3967 0.91 1.57 0.74 153 RCVD_IN_BL_SPAMCOP_NET 3883 1.72 5.48 0.72 154 XMMoneyMeta_00 3657 0.80 1.26 0.68 155 HTML_OBFUSCATE_05_10 3648 0.61 0.36 0.68 156 TO_NO_BRKTS_HTML_ONLY 3572 0.58 0.24 0.67 157 XMHTML_After_End 3542 1.10 2.77 0.66 158 XMSubMetaI_00 3531 0.78 1.26 0.66 159 XMSexyCombo_01 3458 0.90 1.88 0.65 160 HTML_TAG_BALANCE_BODY 3357 0.64 0.68 0.63 161 XMStockSpam_06 3298 0.87 1.84 0.62 162 T_TooManySym_03 3291 0.55 0.29 0.61 163 T_OBFU_PDF_ATTACH 3282 0.52 0.15 0.61 164 TR_LOTS_OF_MONEY3 3175 0.97 2.40 0.59 165 XMNoVowels 3147 0.56 0.44 0.59 166 T_Symld_Words_02 3082 0.60 0.71 0.58 167 RCVD_IN_SORBS_DUL 3033 0.47 0.13 0.57 168 XMPhish30 2932 0.66 1.07 0.55 169 XM_SPF_Unknown 2931 0.65 1.03 0.55 170 XM_ShortIntro_01 2840 0.50 0.40 0.53 171 FROM_GOV_DKIM_AU 2815 0.44 0.11 0.53 172 XMBody_17 2809 1.16 3.60 0.52 173 FORGED_GMAIL_RCVD 2769 0.55 0.67 0.52 174 T_XMHurry_00 2761 0.99 2.77 0.52 175 URIBL_SBL_A 2759 1.89 7.13 0.51 176 XM_H_PHPMailer 2671 0.58 0.91 0.50 177 XMHTMLBadTable_001 2641 0.52 0.63 0.49 178 FUZZY_CREDIT 2610 0.39 0.04 0.49 179 RELAYCOUNTRY_AU 2584 0.52 0.65 0.48 180 XM_E_Blogspot 2474 0.40 0.18 0.46 181 XMSubMetaSxObfu_03 2444 0.49 0.63 0.46 182 HTML_IMAGE_ONLY_20 2437 0.43 0.33 0.45 183 URI_NOVOWEL 2416 0.48 0.57 0.45 184 FROM_GOV_SPOOF 2355 0.39 0.20 0.44 185 RELAYCOUNTRY_DE 2344 0.70 1.69 0.44 186 PLING_QUERY 2304 0.41 0.35 0.43 187 SUBJ_DOLLARS 2304 0.48 0.68 0.43 188 XM_DIRTYINTL 2276 1.17 4.00 0.42 189 TM2_M_BODY_EMPTY 2276 0.37 0.15 0.42 190 SHORT_HELO_AND_INLINE_IMAGE 2242 0.34 0.03 0.42 191 TM2_M_A_HREF_HREF 2228 0.46 0.63 0.42 192 HTML_IMAGE_ONLY_28 2144 0.39 0.37 0.40 193 NUMERIC_HTTP_ADDR 2108 0.42 0.53 0.39 194 HTML_IMAGE_ONLY_32 2041 0.34 0.19 0.38 195 BODY_ENHANCEMENT 2039 0.33 0.12 0.38 196 XM_B_REG_HTML 1980 0.36 0.32 0.37 197 XMPhish08 1919 0.45 0.78 0.36 198 USER_IN_WHITELIST 1905 0.28 0.00 0.36 199 XM_B_COPY_HTML 1877 0.39 0.53 0.35 200 MPART_ALT_DIFF_COUNT 1858 0.49 1.03 0.35 ----------------------------------------------------------------------