Email: 669256 Autolearn: 0 AvgScore: 2.11 AvgScanTime: 2.19 sec Spam: 142580 Autolearn: 0 AvgScore: 12.07 AvgScanTime: 4.09 sec Ham: 526676 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.67 sec Time Spent Running SA: 406.25 hours Time Spent Processing Spam: 162.13 hours Time Spent Processing Ham: 244.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136137 91.08 95.48 89.89 2 DKIM_SIGNED 119921 74.09 84.11 71.37 3 RELAYCOUNTRY_US 117656 79.05 82.52 78.11 4 XM_DK_Pass 115060 72.42 80.70 70.18 5 XM_B_Unicode 114314 70.54 80.18 67.93 6 DCC_CHECK 108273 48.81 75.94 41.47 7 XMListUnsubscribeExists 103679 53.61 72.72 48.43 8 DKIM_VALID 98077 66.55 68.79 65.94 9 DKIM_VALID_AU 70044 49.02 49.13 48.99 10 XM_B_Unicode3 64206 40.00 45.03 38.64 11 XM_DK_Undo_02 62692 14.35 43.97 6.33 12 BAYES_50 61117 54.50 42.87 57.65 13 MIME_HTML_ONLY 48066 22.61 33.71 19.61 14 LOC_TINY_FONT_1 45400 24.56 31.84 22.59 15 HTML_FONT_LOW_CONTRAST 42152 27.05 29.56 26.36 16 T_KAM_HTML_FONT_INVALID 40531 19.83 28.43 17.50 17 BAYES_99 39645 8.51 27.81 3.28 18 FVGT_m_MULTI_ODD 38856 22.47 27.25 21.18 19 DKIM_VALID_EF 36380 24.78 25.52 24.57 20 XMSubLong 35802 20.64 25.11 19.43 21 T_TM2_M_HEADER_IN_MSG 32384 26.57 22.71 27.62 22 DCC_CHECK_NEGATIVE 31771 49.25 22.28 56.55 23 BOTNET 31395 6.65 22.02 2.49 24 BAYES_999 30989 6.62 21.73 2.53 25 TR_DCC_Bayes_99 30810 5.86 21.61 1.60 26 RELAYCOUNTRY_META 28333 8.34 19.87 5.22 27 XM_Body_Dirty_Words 26098 12.71 18.30 11.20 28 XM_Multi_Part_URI 25006 12.30 17.54 10.88 29 DKIM_INVALID 21844 7.54 15.32 5.44 30 BOTNET_IPINHOSTNAME 19981 6.23 14.01 4.13 31 LOTS_OF_MONEY 19423 9.09 13.62 7.87 32 XM_B_Phish_Phrases 19369 8.17 13.58 6.70 33 XM_B_Unsub 18556 10.00 13.01 9.18 34 LotsOfNums_01 18212 9.32 12.77 8.38 35 XM_UncommonTLD01 18062 5.85 12.67 4.00 36 FSL_BULK_SIG 17050 7.99 11.96 6.91 37 XM_Evil_Numbers_Gen 16251 8.76 11.40 8.05 38 NO_DNS_FOR_FROM 15450 4.70 10.84 3.04 39 UNTRUSTED_Relay 13952 3.30 9.79 1.54 40 RCVD_IN_MSPIKE_H2 13620 13.00 9.55 13.94 41 XMSubMetaSx_00 13522 4.78 9.48 3.51 42 HTML_IMAGE_RATIO_02 13090 7.95 9.18 7.62 43 BAYES_60 12418 6.39 8.71 5.76 44 XMSexyCombo_05 12141 4.32 8.52 3.19 45 XM_B_COVIDMETA 11283 3.30 7.91 2.05 46 BAYES_80 10467 3.91 7.34 2.99 47 TR_XM_COVIDMETA4 9657 2.42 6.77 1.24 48 RELAYCOUNTRY_CA 9320 2.53 6.54 1.44 49 XM_H_Long_From01 9062 5.99 6.36 5.89 50 XM_CamelCaseFrm001 8979 3.10 6.30 2.24 51 RCVD_IN_MSPIKE_BL 8646 3.27 6.06 2.52 52 KHOP_HELO_FCRDNS 8540 2.74 5.99 1.86 53 HTML_IMAGE_RATIO_04 8443 5.60 5.92 5.51 54 MPART_ALT_DIFF 8195 4.85 5.75 4.61 55 UNPARSEABLE_RELAY 7831 6.52 5.49 6.79 56 MIME_QP_LONG_LINE 7633 5.64 5.35 5.72 57 RCVD_IN_MSPIKE_L3 7454 2.50 5.23 1.76 58 XM_SPF_SoftFail 7412 2.32 5.20 1.54 59 XMNumbers 7332 3.39 5.14 2.91 60 TooManyTo_001 7266 7.37 5.10 7.99 61 XM_UB50 7228 1.84 5.07 0.96 62 RCVD_IN_BL_SPAMCOP_NET 6845 1.68 4.80 0.84 63 T_XMDrugObfuBody_08 6444 2.13 4.52 1.49 64 XM_SendGrid 6428 5.81 4.51 6.16 65 URIBL_SBL_A 6158 1.28 4.32 0.46 66 HTML_IMAGE_RATIO_06 5913 3.22 4.15 2.97 67 XM_OfRef6 5900 1.71 4.14 1.06 68 XM_B_SpammyTLD 5697 2.94 4.00 2.65 69 SpammyFromTLD_02 5422 1.51 3.80 0.89 70 BAYES_95 5344 2.17 3.75 1.75 71 XMSubMetaSxObfu_03 5302 1.08 3.72 0.36 72 RDNS_DYNAMIC 5286 1.05 3.71 0.33 73 TR_XM_COVIDMETA2 5262 0.89 3.69 0.13 74 MIME_HTML_MOSTLY 5022 2.77 3.52 2.57 75 TR_XM_MaxBayes 4963 0.75 3.48 0.01 76 XMStrtUSub 4876 3.78 3.42 3.88 77 RCVD_IN_RP_RNBL 4864 0.78 3.41 0.07 78 XM_URI_RBL 4816 0.87 3.38 0.19 79 T_XMHurry_00 4798 1.15 3.37 0.55 80 BAYES_40 4756 4.70 3.34 5.07 81 XMClaimOffer 4544 0.89 3.19 0.27 82 BOTNET_NORDNS 4473 0.70 3.14 0.04 83 TR_LOTS_OF_MONEY3 4353 1.11 3.05 0.59 84 MIME_HTML_ONLY_MULTI 4341 2.76 3.04 2.69 85 FROM_EXCESS_BASE64 4328 2.91 3.04 2.88 86 TM2_M_URI_OPT_OUT 4311 2.95 3.02 2.93 87 XMBody_17 4299 1.11 3.02 0.59 88 HTML_SHORT_LINK_IMG_1 4258 0.65 2.99 0.01 89 TR_MetaPhish_Combo_01b 4237 0.82 2.97 0.24 90 T_REMOTE_IMAGE 4228 3.60 2.97 3.77 91 RCVD_IN_MSPIKE_WL 4174 7.62 2.93 8.88 92 RCVD_IN_MSPIKE_H3 4174 7.62 2.93 8.88 93 XM_DIRTYINTL 4152 1.02 2.91 0.51 94 XM_B_Unsub2 4097 2.13 2.87 1.93 95 URI_TRY_3LD 3884 1.45 2.72 1.11 96 BAYES_20 3782 3.73 2.65 4.02 97 T_TooManySym_01 3653 3.70 2.56 4.01 98 T_FILL_THIS_FORM_SHORT 3639 1.21 2.55 0.84 99 HTML_IMAGE_RATIO_08 3625 2.20 2.54 2.10 100 XMMoneyMeta_00 3570 1.07 2.50 0.68 101 PDS_OTHER_BAD_TLD 3561 1.40 2.50 1.10 102 SpammyFromTLD_01 3491 1.15 2.45 0.79 103 TR_XM_PhishingBody 3482 1.38 2.44 1.09 104 XMHTML_After_End 3402 1.00 2.39 0.62 105 DKIM_ADSP_NXDOMAIN 3369 0.71 2.36 0.26 106 RCVD_IN_RP_SAFE 3360 6.84 2.36 8.05 107 RELAYCOUNTRY_FR 3305 0.65 2.32 0.20 108 TR_XM_INV_DKIM 3179 0.55 2.23 0.09 109 URI_HEX 3178 1.61 2.23 1.44 110 HTML_FONT_SIZE_HUGE 3163 0.54 2.22 0.08 111 XMSexyCombo_01 3161 0.84 2.22 0.46 112 SUBJ_ALL_CAPS 3146 1.58 2.21 1.41 113 XMDiploma_00 3081 1.58 2.16 1.43 114 RCVD_IN_IADB_LISTED 3019 4.21 2.12 4.78 115 BAYES_00 2927 13.62 2.05 16.76 116 TR_XM_PHPDW 2894 0.79 2.03 0.46 117 HTML_IMAGE_ONLY_08 2842 0.52 1.99 0.12 118 TR_XM_PHPForged 2842 0.77 1.99 0.44 119 TR_XM_FormFill2 2825 0.76 1.98 0.43 120 XM_H_PHPOS 2816 0.76 1.98 0.43 121 TM2_M_VERY_LONG_WORD 2800 1.29 1.96 1.10 122 RCVD_IN_IADB_SPF 2767 3.71 1.94 4.19 123 T_XMDrugObfuBody_14 2743 1.41 1.92 1.27 124 TR_XM_RelayPhish 2709 0.51 1.90 0.14 125 TO_MALFORMED 2709 1.49 1.90 1.38 126 RCVD_IN_IADB_DK 2696 3.24 1.89 3.60 127 FROM_SUSPICIOUS_NTLD 2696 0.75 1.89 0.44 128 RCVD_IN_IADB_SENDERID 2672 3.27 1.87 3.65 129 HTML_MIME_NO_HTML_TAG 2613 2.25 1.83 2.36 130 FROM_SUSPICIOUS_NTLD_FP 2600 0.73 1.82 0.44 131 TR_XM_MaxSPIKE 2478 0.46 1.74 0.11 132 RELAYCOUNTRY_GB 2460 1.34 1.73 1.23 133 XM_UB99 2367 0.36 1.66 0.01 134 DATE_IN_PAST_03_06 2341 0.48 1.64 0.17 135 TR_XM_DK_SendGrid 2302 2.92 1.61 3.28 136 XMStockSpam_06 2293 0.88 1.61 0.68 137 REPLYTO_WITHOUT_TO_CC 2257 0.39 1.58 0.07 138 DATE_IN_PAST_06_12 2251 0.45 1.58 0.14 139 BODY_URI_ONLY 2248 0.38 1.58 0.05 140 TR_Symld_Words 2206 1.37 1.55 1.32 141 BAYES_05 2123 2.46 1.49 2.73 142 T_XMDrugObfuBody_00 2096 0.88 1.47 0.72 143 RCVD_IN_RP_CERTIFIED 2040 6.23 1.43 7.53 144 TR_MetaPhish_Combo_01 2037 0.87 1.43 0.72 145 SHORT_SHORTNER 1993 0.32 1.40 0.02 146 XMReplyNow 1968 0.38 1.38 0.11 147 XM_UB999 1942 0.29 1.36 0.00 148 XMBdyGiftCard01 1926 0.98 1.35 0.89 149 TR_XM_DK_Bayes 1889 9.22 1.32 11.36 150 XMGenDplmaNmb 1861 0.95 1.31 0.85 151 LongTLD 1822 0.39 1.28 0.15 152 XMBrknScrpt_02 1816 0.94 1.27 0.85 153 XM_H_MailChimp 1791 0.40 1.26 0.17 154 RCVD_IN_PSBL 1785 0.86 1.25 0.75 155 NORDNS_LOW_CONTRAST 1769 1.04 1.24 0.98 156 HK_RANDOM_REPLYTO 1731 0.44 1.21 0.23 157 SHORT_URI_2 1718 0.29 1.20 0.04 158 XM_ProductURIs 1704 0.88 1.20 0.79 159 RELAYCOUNTRY_DE 1668 0.59 1.17 0.44 160 MAILING_LIST_MULTI 1652 2.20 1.16 2.48 161 XMMoneyMeta_01 1646 0.30 1.15 0.07 162 URG_BIZ 1625 0.30 1.14 0.07 163 TR_XM_FormFill 1621 0.25 1.14 0.01 164 XM_DK_Undo_01 1619 1.70 1.14 1.85 165 TR_XM_COVIDMETA3 1610 0.28 1.13 0.05 166 XM_UB60 1603 0.29 1.12 0.07 167 MIME_HEADER_CTYPE_ONLY 1600 0.38 1.12 0.18 168 TR_Caps_n_Bayes_99 1593 0.27 1.12 0.04 169 MPART_ALT_DIFF_COUNT 1587 0.58 1.11 0.44 170 XM_OfRef7 1582 0.32 1.11 0.10 171 RELAYCOUNTRY_AU 1560 0.54 1.09 0.39 172 ANY_BOUNCE_MESSAGE 1559 2.59 1.09 2.99 173 BOUNCE_MESSAGE 1558 2.59 1.09 2.99 174 HDRS_LCASE_IMGONLY 1549 0.24 1.09 0.01 175 XMBody_78 1547 0.53 1.09 0.38 176 HTML_IMAGE_ONLY_04 1532 0.27 1.07 0.05 177 XM_HighProb1 1513 0.23 1.06 0.01 178 DKIM_ADSP_CUSTOM_MED 1467 1.26 1.03 1.33 179 XMPhish30 1467 0.48 1.03 0.33 180 T_TooManySym_02 1450 1.84 1.02 2.06 181 HTML_SHORT_CENTER 1446 0.22 1.01 0.00 182 DATE_IN_PAST_12_24 1445 0.28 1.01 0.08 183 SHORTENER_SHORT_IMG 1445 0.22 1.01 0.00 184 TO_EQ_FM_DOM_HTML_IMG 1444 0.22 1.01 0.01 185 ALL_TRUSTED 1430 14.75 1.00 18.47 186 REMOVE_BEFORE_LINK 1395 0.39 0.98 0.23 187 DIET_1 1390 0.57 0.97 0.46 188 RELAYCOUNTRY_TW 1334 0.24 0.94 0.06 189 FORM_FRAUD_5 1300 0.20 0.91 0.01 190 XMSlimDrugH 1299 0.41 0.91 0.27 191 FORGED_GMAIL_RCVD 1284 0.64 0.90 0.57 192 XM_H_PHPMailer 1271 0.55 0.89 0.45 193 HTML_TAG_BALANCE_BODY 1261 0.78 0.88 0.75 194 XMSubMetaI_00 1251 0.70 0.88 0.65 195 TR_Mismatch_TLD_02 1246 0.24 0.87 0.07 196 TR_Mismatch_TLD_01 1239 0.35 0.87 0.21 197 NML_ADSP_CUSTOM_MED 1238 0.96 0.87 0.98 198 HTTPS_HTTP_MISMATCH 1219 0.82 0.85 0.81 199 URIBL_BLACK 1194 0.22 0.84 0.05 200 XM_XX_Yahoo 1192 0.20 0.84 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 473443 91.08 95.48 89.89 2 RELAYCOUNTRY_US 411407 79.05 82.52 78.11 3 DKIM_SIGNED 375914 74.09 84.11 71.37 4 XM_DK_Pass 369630 72.42 80.70 70.18 5 XM_B_Unicode 357752 70.54 80.18 67.93 6 DKIM_VALID 347284 66.55 68.79 65.94 7 BAYES_50 303628 54.50 42.87 57.65 8 DCC_CHECK_NEGATIVE 297846 49.25 22.28 56.55 9 DKIM_VALID_AU 258014 49.02 49.13 48.99 10 XMListUnsubscribeExists 255084 53.61 72.72 48.43 11 DCC_CHECK 218406 48.81 75.94 41.47 12 XM_B_Unicode3 203500 40.00 45.03 38.64 13 T_TM2_M_HEADER_IN_MSG 145457 26.57 22.71 27.62 14 HTML_FONT_LOW_CONTRAST 138855 27.05 29.56 26.36 15 DKIM_VALID_EF 129429 24.78 25.52 24.57 16 LOC_TINY_FONT_1 118999 24.56 31.84 22.59 17 FVGT_m_MULTI_ODD 111557 22.47 27.25 21.18 18 MIME_HTML_ONLY 103283 22.61 33.71 19.61 19 XMSubLong 102336 20.64 25.11 19.43 20 ALL_TRUSTED 97286 14.75 1.00 18.47 21 T_KAM_HTML_FONT_INVALID 92167 19.83 28.43 17.50 22 BAYES_00 88251 13.62 2.05 16.76 23 RCVD_IN_MSPIKE_H2 73399 13.00 9.55 13.94 24 TR_XM_DK_Bayes 59808 9.22 1.32 11.36 25 XM_Body_Dirty_Words 58974 12.71 18.30 11.20 26 XM_Multi_Part_URI 57295 12.30 17.54 10.88 27 TR_XM_DK_Bayes1 55485 8.45 0.75 10.53 28 TR_XM_DK_Bayes2 49603 7.55 0.67 9.42 29 XM_B_Unsub 48374 10.00 13.01 9.18 30 RCVD_IN_MSPIKE_WL 46791 7.62 2.93 8.88 31 RCVD_IN_MSPIKE_H3 46791 7.62 2.93 8.88 32 LotsOfNums_01 44139 9.32 12.77 8.38 33 RCVD_IN_RP_SAFE 42407 6.84 2.36 8.05 34 XM_Evil_Numbers_Gen 42375 8.76 11.40 8.05 35 TooManyTo_001 42075 7.37 5.10 7.99 36 LOTS_OF_MONEY 41426 9.09 13.62 7.87 37 HTML_IMAGE_RATIO_02 40132 7.95 9.18 7.62 38 RCVD_IN_RP_CERTIFIED 39669 6.23 1.43 7.53 39 FSL_BULK_SIG 36395 7.99 11.96 6.91 40 UNPARSEABLE_RELAY 35774 6.52 5.49 6.79 41 XM_B_Phish_Phrases 35307 8.17 13.58 6.70 42 XM_DKIMWhitelistDomains 34123 5.22 0.56 6.48 43 XM_DK_Undo_02 33335 14.35 43.97 6.33 44 XM_SendGrid 32464 5.81 4.51 6.16 45 XM_H_Long_From01 31037 5.99 6.36 5.89 46 BAYES_60 30329 6.39 8.71 5.76 47 MIME_QP_LONG_LINE 30143 5.64 5.35 5.72 48 HTML_IMAGE_RATIO_04 29017 5.60 5.92 5.51 49 DKIM_INVALID 28630 7.54 15.32 5.44 50 RELAYCOUNTRY_META 27492 8.34 19.87 5.22 51 BAYES_40 26691 4.70 3.34 5.07 52 RCVD_IN_IADB_LISTED 25184 4.21 2.12 4.78 53 MPART_ALT_DIFF 24294 4.85 5.75 4.61 54 RCVD_IN_IADB_SPF 22089 3.71 1.94 4.19 55 BOTNET_IPINHOSTNAME 21742 6.23 14.01 4.13 56 BAYES_20 21184 3.73 2.65 4.02 57 XM_PDF 21136 3.31 0.73 4.01 58 T_TooManySym_01 21097 3.70 2.56 4.01 59 XM_UncommonTLD01 21081 5.85 12.67 4.00 60 XMStrtUSub 20416 3.78 3.42 3.88 61 T_REMOTE_IMAGE 19851 3.60 2.97 3.77 62 RCVD_IN_IADB_SENDERID 19245 3.27 1.87 3.65 63 RCVD_IN_IADB_DK 18975 3.24 1.89 3.60 64 XMSubMetaSx_00 18486 4.78 9.48 3.51 65 IN_ZIMBRA_NJ_WHITELIST 17337 2.59 0.01 3.29 66 BAYES_99 17278 8.51 27.81 3.28 67 TR_XM_DK_SendGrid 17260 2.92 1.61 3.28 68 XMSexyCombo_05 16790 4.32 8.52 3.19 69 XM_H_Trusted_IP 16145 2.41 0.00 3.07 70 RCVD_IN_IADB_VOUCHED 16049 2.54 0.68 3.05 71 NO_DNS_FOR_FROM 15999 4.70 10.84 3.04 72 ANY_BOUNCE_MESSAGE 15759 2.59 1.09 2.99 73 BOUNCE_MESSAGE 15758 2.59 1.09 2.99 74 BAYES_80 15726 3.91 7.34 2.99 75 HTML_IMAGE_RATIO_06 15624 3.22 4.15 2.97 76 TM2_M_URI_OPT_OUT 15413 2.95 3.02 2.93 77 XMNumbers 15347 3.39 5.14 2.91 78 FROM_EXCESS_BASE64 15164 2.91 3.04 2.88 79 BAYES_05 14374 2.46 1.49 2.73 80 MIME_HTML_ONLY_MULTI 14162 2.76 3.04 2.69 81 XM_B_SpammyTLD 13979 2.94 4.00 2.65 82 MIME_HTML_MOSTLY 13527 2.77 3.52 2.57 83 BAYES_999 13310 6.62 21.73 2.53 84 RCVD_IN_MSPIKE_BL 13264 3.27 6.06 2.52 85 BOTNET 13098 6.65 22.02 2.49 86 MAILING_LIST_MULTI 13055 2.20 1.16 2.48 87 HTML_MIME_NO_HTML_TAG 12452 2.25 1.83 2.36 88 TooManyTo_002 11872 1.90 0.61 2.25 89 XM_CamelCaseFrm001 11791 3.10 6.30 2.24 90 HTML_IMAGE_RATIO_08 11072 2.20 2.54 2.10 91 T_TooManySym_02 10841 1.84 1.02 2.06 92 XM_B_COVIDMETA 10788 3.30 7.91 2.05 93 XM_B_Unsub2 10139 2.13 2.87 1.93 94 RCVD_IN_IADB_OPTIN 9874 1.56 0.42 1.87 95 KHOP_HELO_FCRDNS 9812 2.74 5.99 1.86 96 XM_DK_Undo_01 9752 1.70 1.14 1.85 97 RCVD_IN_MSPIKE_L3 9278 2.50 5.23 1.76 98 BAYES_95 9212 2.17 3.75 1.75 99 TVD_RCVD_IP 9021 1.41 0.29 1.71 100 TR_DCC_Bayes_99 8422 5.86 21.61 1.60 101 HELO_NODOT 8297 1.36 0.55 1.58 102 HELO_NO_DOMAIN 8296 1.36 0.55 1.58 103 TooManyTo_003 8280 1.34 0.49 1.57 104 UNTRUSTED_Relay 8132 3.30 9.79 1.54 105 XM_SPF_SoftFail 8123 2.32 5.20 1.54 106 IN_HORDE_ADDRESS_BOOK 7903 1.19 0.04 1.50 107 T_XMDrugObfuBody_08 7822 2.13 4.52 1.49 108 INVALID_MSGID 7621 1.20 0.27 1.45 109 RELAYCOUNTRY_CA 7601 2.53 6.54 1.44 110 URI_HEX 7568 1.61 2.23 1.44 111 XMDiploma_00 7508 1.58 2.16 1.43 112 HELO_MISC_IP 7501 1.14 0.08 1.42 113 CK_HELO_DYNAMIC_SPLIT_IP 7486 1.14 0.08 1.42 114 SUBJ_ALL_CAPS 7402 1.58 2.21 1.41 115 TO_MALFORMED 7289 1.49 1.90 1.38 116 DKIM_ADSP_CUSTOM_MED 6987 1.26 1.03 1.33 117 TR_Symld_Words 6956 1.37 1.55 1.32 118 XM_GoogleGroups 6950 1.15 0.54 1.32 119 T_XMDrugObfuBody_14 6688 1.41 1.92 1.27 120 XMCapTrack 6612 1.09 0.50 1.26 121 XM_H_Long_From02 6600 1.16 0.81 1.25 122 TR_XM_COVIDMETA4 6530 2.42 6.77 1.24 123 RELAYCOUNTRY_GB 6485 1.34 1.73 1.23 124 TooManyTo_004 6330 1.04 0.43 1.20 125 URI_TRY_3LD 5839 1.45 2.72 1.11 126 TM2_M_VERY_LONG_WORD 5811 1.29 1.96 1.10 127 PDS_OTHER_BAD_TLD 5791 1.40 2.50 1.10 128 TR_XM_PhishingBody 5766 1.38 2.44 1.09 129 XM_OfRef6 5557 1.71 4.14 1.06 130 XMGappySubj_01 5538 0.85 0.12 1.05 131 TooManyTo_005 5349 0.88 0.36 1.02 132 NML_ADSP_CUSTOM_MED 5178 0.96 0.87 0.98 133 NORDNS_LOW_CONTRAST 5159 1.04 1.24 0.98 134 USER_IN_DEF_DKIM_WL 5144 0.77 0.00 0.98 135 HTML_FONT_FACE_BAD 5089 0.85 0.42 0.97 136 XM_UB50 5069 1.84 5.07 0.96 137 XMSubNoVowel 5018 0.88 0.63 0.95 138 SpammyFromTLD_02 4688 1.51 3.80 0.89 139 XMBdyGiftCard01 4662 0.98 1.35 0.89 140 T_Symld_Words_02 4491 0.82 0.70 0.85 141 XMBrknScrpt_02 4475 0.94 1.27 0.85 142 XMGenDplmaNmb 4468 0.95 1.31 0.85 143 T_FILL_THIS_FORM_SHORT 4445 1.21 2.55 0.84 144 RCVD_IN_BL_SPAMCOP_NET 4405 1.68 4.80 0.84 145 HTTPS_HTTP_MISMATCH 4281 0.82 0.85 0.81 146 SpammyFromTLD_01 4183 1.15 2.45 0.79 147 XM_ProductURIs 4174 0.88 1.20 0.79 148 RCVD_IN_PSBL 3966 0.86 1.25 0.75 149 HTML_TAG_BALANCE_BODY 3951 0.78 0.88 0.75 150 XM_RXBody 3824 0.72 0.68 0.73 151 TR_MetaPhish_Combo_01 3790 0.87 1.43 0.72 152 T_XMDrugObfuBody_00 3779 0.88 1.47 0.72 153 XMNoVowels 3624 0.65 0.51 0.69 154 XMMoneyMeta_00 3583 1.07 2.50 0.68 155 TR_MSPIKEBAYES00 3576 0.54 0.00 0.68 156 XMStockSpam_06 3573 0.88 1.61 0.68 157 XMSubMetaI_00 3413 0.70 0.88 0.65 158 XMHTML_After_End 3265 1.00 2.39 0.62 159 SUBJ_DOLLARS 3246 0.59 0.48 0.62 160 XMBody_17 3109 1.11 3.02 0.59 161 T_TooManySym_03 3097 0.56 0.44 0.59 162 TR_LOTS_OF_MONEY3 3090 1.11 3.05 0.59 163 FROM_GOV_DKIM_AU 3085 0.48 0.10 0.59 164 XMSolicitRefs_0 3049 0.56 0.48 0.58 165 FROM_GOV_SPOOF 3019 0.48 0.12 0.57 166 FORGED_GMAIL_RCVD 3003 0.64 0.90 0.57 167 T_XMHurry_00 2883 1.15 3.37 0.55 168 RCVD_IN_MSPIKE_L5 2867 0.56 0.61 0.54 169 HTML_IMAGE_ONLY_20 2848 0.50 0.34 0.54 170 T_OBFU_PDF_ATTACH 2809 0.45 0.12 0.53 171 RCVD_IN_SORBS_DUL 2779 0.43 0.07 0.53 172 XM_ShortIntro_01 2758 0.50 0.41 0.52 173 XM_DIRTYINTL 2667 1.02 2.91 0.51 174 MISSING_HEADERS 2645 0.53 0.64 0.50 175 UPPERCASE_75_100 2643 0.40 0.03 0.50 176 XM_SPF_Unknown 2563 0.52 0.66 0.49 177 UNICODE_OBFU_ASC 2521 0.46 0.38 0.48 178 XMSexyCombo_01 2449 0.84 2.22 0.46 179 XMLngstWrd_00 2441 0.52 0.74 0.46 180 DIET_1 2434 0.57 0.97 0.46 181 TR_XM_PHPDW 2405 0.79 2.03 0.46 182 URIBL_SBL_A 2399 1.28 4.32 0.46 183 XM_H_PHPMailer 2394 0.55 0.89 0.45 184 XMHTMLBadTable_001 2371 0.49 0.62 0.45 185 XMOemUri 2364 0.43 0.36 0.45 186 LOADSA_MONEY_COMBO 2353 0.43 0.36 0.45 187 FROM_SUSPICIOUS_NTLD 2321 0.75 1.89 0.44 188 MPART_ALT_DIFF_COUNT 2320 0.58 1.11 0.44 189 RELAYCOUNTRY_DE 2311 0.59 1.17 0.44 190 TR_XM_PHPForged 2310 0.77 1.99 0.44 191 FROM_SUSPICIOUS_NTLD_FP 2306 0.73 1.82 0.44 192 TR_XM_FormFill2 2287 0.76 1.98 0.43 193 XM_H_PHPOS 2267 0.76 1.98 0.43 194 XMBody_95 2221 0.35 0.09 0.42 195 URI_NOVOWEL 2169 0.43 0.49 0.41 196 XMLngstWrd_01 2161 0.47 0.70 0.41 197 SHORT_HELO_AND_INLINE_IMAGE 2108 0.32 0.04 0.40 198 RELAYCOUNTRY_AU 2074 0.54 1.09 0.39 199 XMPhish08 2059 0.48 0.82 0.39 200 HTML_IMAGE_ONLY_28 2029 0.37 0.32 0.39 ----------------------------------------------------------------------