Email: 367933 Autolearn: 0 AvgScore: 1.82 AvgScanTime: 1.88 sec Spam: 90736 Autolearn: 0 AvgScore: 12.30 AvgScanTime: 2.97 sec Ham: 277197 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.52 sec Time Spent Running SA: 191.88 hours Time Spent Processing Spam: 74.79 hours Time Spent Processing Ham: 117.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86282 89.24 95.09 87.32 2 DCC_CHECK 75132 56.65 82.80 48.08 3 RELAYCOUNTRY_US 72907 80.57 80.35 80.64 4 DKIM_SIGNED 72855 78.01 80.29 77.26 5 XM_DK_Pass 70858 76.57 78.09 76.07 6 XM_B_Unicode 65197 71.44 71.85 71.30 7 XMListUnsubscribeExists 63637 58.73 70.13 54.99 8 DKIM_VALID 61905 71.66 68.23 72.78 9 DKIM_VALID_AU 48819 58.37 53.80 59.86 10 XM_DK_Undo_02 43323 18.02 47.75 8.29 11 MIME_HTML_ONLY 35502 26.40 39.13 22.23 12 XM_B_Unicode3 35496 42.37 39.12 43.43 13 BAYES_50 34088 48.79 37.57 52.46 14 LOC_TINY_FONT_1 30557 31.69 33.68 31.04 15 BAYES_99 29671 12.18 32.70 5.47 16 HTML_FONT_LOW_CONTRAST 25925 31.01 28.57 31.81 17 TR_DCC_Bayes_99 24380 9.18 26.87 3.39 18 DKIM_VALID_EF 24100 27.00 26.56 27.14 19 BAYES_999 23828 9.80 26.26 4.41 20 FVGT_m_MULTI_ODD 22135 22.69 24.39 22.14 21 T_KAM_HTML_FONT_INVALID 20425 17.67 22.51 16.09 22 RELAYCOUNTRY_META 20377 9.75 22.46 5.59 23 XMSubLong 18324 20.36 20.19 20.42 24 BOTNET 17449 6.46 19.23 2.28 25 T_TM2_M_HEADER_IN_MSG 16648 21.40 18.35 22.40 26 FSL_BULK_SIG 16223 10.64 17.88 8.27 27 XM_UncommonTLD01 15246 7.21 16.80 4.07 28 XM_Multi_Part_URI 14688 14.82 16.19 14.37 29 XM_Body_Dirty_Words 14663 15.31 16.16 15.04 30 DCC_CHECK_NEGATIVE 14654 42.18 16.15 50.70 31 BOTNET_IPINHOSTNAME 13819 8.11 15.23 5.78 32 HTML_IMAGE_RATIO_02 11805 10.73 13.01 9.99 33 UNTRUSTED_Relay 11608 4.45 12.79 1.72 34 DKIM_INVALID 10950 6.35 12.07 4.48 35 XM_B_Phish_Phrases 10413 8.24 11.48 7.18 36 XM_B_Unsub 10320 11.57 11.37 11.63 37 KHOP_HELO_FCRDNS 9991 3.82 11.01 1.47 38 LOTS_OF_MONEY 9928 8.46 10.94 7.65 39 XM_Evil_Numbers_Gen 8720 9.60 9.61 9.60 40 NO_DNS_FOR_FROM 8436 4.07 9.30 2.36 41 LotsOfNums_01 8293 8.49 9.14 8.28 42 XM_CamelCaseFrm001 8243 3.87 9.08 2.16 43 XMSexyCombo_05 7775 5.78 8.57 4.87 44 BAYES_80 7691 4.71 8.48 3.47 45 RDNS_DYNAMIC 7659 2.44 8.44 0.48 46 XMSubMetaSx_00 7603 5.53 8.38 4.60 47 RCVD_IN_MSPIKE_H2 7471 11.35 8.23 12.37 48 MPART_ALT_DIFF 7186 6.70 7.92 6.30 49 BAYES_60 6737 6.56 7.42 6.28 50 URIBL_SBL_A 6725 2.00 7.41 0.23 51 RELAYCOUNTRY_CA 6482 3.49 7.14 2.30 52 XM_UB50 6432 2.57 7.09 1.09 53 TooManyTo_001 5939 6.62 6.55 6.65 54 XMHTML_After_End 5918 2.01 6.52 0.54 55 TR_XM_MaxBayes 5455 1.50 6.01 0.03 56 HTML_IMAGE_RATIO_04 5365 7.05 5.91 7.42 57 XM_H_Long_From01 5286 5.53 5.83 5.44 58 BODY_URI_ONLY 5208 1.46 5.74 0.06 59 T_XMDrugObfuBody_08 4991 2.46 5.50 1.47 60 XM_SPF_SoftFail 4731 2.06 5.21 1.02 61 UNPARSEABLE_RELAY 4602 7.79 5.07 8.67 62 XM_B_COVIDMETA 4415 1.98 4.87 1.04 63 XMNumbers 4183 3.64 4.61 3.32 64 DATE_IN_PAST_03_06 4116 1.19 4.54 0.09 65 XMStrtUSub 3992 6.62 4.40 7.35 66 RCVD_IN_BL_SPAMCOP_NET 3965 1.71 4.37 0.84 67 RCVD_IN_RP_SAFE 3926 10.86 4.33 12.99 68 BAYES_95 3878 2.75 4.27 2.26 69 MIME_HTML_MOSTLY 3855 3.72 4.25 3.55 70 XM_SendGrid 3787 6.77 4.17 7.62 71 XMBody_17 3771 1.70 4.16 0.89 72 HTML_MIME_NO_HTML_TAG 3652 1.98 4.02 1.31 73 DATE_IN_PAST_06_12 3607 1.19 3.98 0.27 74 SpammyFromTLD_01 3527 1.28 3.89 0.42 75 RELAYCOUNTRY_FR 3507 1.11 3.87 0.21 76 XM_B_SpammyTLD 3185 2.55 3.51 2.24 77 MIME_QP_LONG_LINE 3124 3.82 3.44 3.94 78 HTML_IMAGE_RATIO_06 3002 3.42 3.31 3.45 79 RCVD_IN_RP_RNBL 2949 0.85 3.25 0.06 80 SpammyFromTLD_02 2948 0.92 3.25 0.16 81 XM_OfRef6 2920 1.54 3.22 1.00 82 TR_LOTS_OF_MONEY3 2894 1.26 3.19 0.63 83 RCVD_IN_MSPIKE_BL 2894 1.01 3.19 0.30 84 DKIM_ADSP_NXDOMAIN 2884 1.07 3.18 0.38 85 TR_XM_COVIDMETA4 2741 1.19 3.02 0.58 86 BAYES_00 2716 15.04 2.99 18.98 87 FROM_EXCESS_BASE64 2705 3.87 2.98 4.16 88 BAYES_40 2667 4.10 2.94 4.48 89 XM_DIRTYINTL 2658 1.08 2.93 0.48 90 PDS_OTHER_BAD_TLD 2656 1.35 2.93 0.83 91 SUBJ_ALL_CAPS 2604 1.59 2.87 1.16 92 FROM_SUSPICIOUS_NTLD 2602 0.73 2.87 0.04 93 RCVD_IN_MSPIKE_L3 2574 0.90 2.84 0.27 94 FROM_SUSPICIOUS_NTLD_FP 2546 0.72 2.81 0.03 95 HTML_SHORT_LINK_IMG_1 2527 0.70 2.79 0.02 96 HTML_IMAGE_RATIO_08 2420 3.17 2.67 3.33 97 TR_XM_INV_DKIM 2395 0.77 2.64 0.16 98 TR_XM_PhishingBody 2391 2.26 2.64 2.14 99 XMBdyGiftCard01 2386 2.43 2.63 2.36 100 RCVD_IN_MSPIKE_WL 2369 8.03 2.61 9.81 101 RCVD_IN_MSPIKE_H3 2366 7.97 2.61 9.72 102 MISSING_HEADERS 2206 0.89 2.43 0.38 103 TM2_M_URI_OPT_OUT 2188 3.61 2.41 4.00 104 TR_XM_DK_Bayes 2182 10.27 2.40 12.85 105 RCVD_IN_RP_CERTIFIED 2180 9.86 2.40 12.30 106 T_TooManySym_01 2139 4.63 2.36 5.37 107 HTML_IMAGE_ONLY_08 2099 0.66 2.31 0.12 108 NO_FM_NAME_IP_HOSTN 2094 0.57 2.31 0.00 109 DATE_IN_PAST_12_24 2062 0.59 2.27 0.04 110 XMSexyCombo_01 2049 1.02 2.26 0.62 111 TR_XM_PHPDW 2047 0.94 2.26 0.51 112 BAYES_20 2030 3.52 2.24 3.94 113 TR_XM_PHPForged 2016 0.91 2.22 0.49 114 TR_XM_FormFill2 1993 0.89 2.20 0.46 115 XM_H_PHPOS 1989 0.88 2.19 0.45 116 XM_URI_RBL 1943 0.68 2.14 0.21 117 T_XMHurry_00 1892 1.76 2.09 1.65 118 LongTLD 1885 0.62 2.08 0.15 119 TM2_M_VERY_LONG_WORD 1880 1.56 2.07 1.39 120 T_REMOTE_IMAGE 1859 2.81 2.05 3.06 121 MIME_HTML_ONLY_MULTI 1812 3.26 2.00 3.67 122 TR_XM_DK_Bayes1 1673 9.60 1.84 12.14 123 TR_XM_RelayPhish 1648 0.55 1.82 0.13 124 XMDiploma_00 1525 1.46 1.68 1.39 125 URI_TRY_3LD 1519 1.59 1.67 1.56 126 XMStockSpam_06 1510 1.59 1.66 1.57 127 XM_UB80 1510 0.43 1.66 0.02 128 URI_HEX 1505 1.23 1.66 1.09 129 TR_XM_DK_SendGrid 1449 3.91 1.60 4.67 130 TR_XM_DK_Bayes2 1448 8.92 1.60 11.31 131 URI_NOVOWEL 1438 0.68 1.58 0.38 132 TO_MALFORMED 1431 2.34 1.58 2.59 133 HTML_FONT_SIZE_HUGE 1422 0.51 1.57 0.16 134 XM_B_Unsub2 1412 1.17 1.56 1.04 135 XMSubMetaI_00 1385 0.92 1.53 0.72 136 HK_RANDOM_FROM 1374 0.48 1.51 0.15 137 RELAYCOUNTRY_GB 1372 1.10 1.51 0.97 138 RELAYCOUNTRY_DE 1370 0.65 1.51 0.37 139 XMPhish30 1311 1.01 1.44 0.86 140 XM_UB60 1262 0.40 1.39 0.07 141 BAYES_05 1256 2.35 1.38 2.67 142 XMBody_78 1253 0.69 1.38 0.46 143 URG_BIZ 1243 0.44 1.37 0.14 144 RCVD_IN_IADB_LISTED 1208 2.56 1.33 2.96 145 XM_ProductURIs 1189 1.07 1.31 0.99 146 HK_RANDOM_REPLYTO 1183 0.48 1.30 0.21 147 REPLYTO_WITHOUT_TO_CC 1151 0.35 1.27 0.05 148 TR_Mismatch_TLD_02 1146 0.37 1.26 0.08 149 RCVD_IN_IADB_SPF 1141 2.29 1.26 2.62 150 RCVD_IN_IADB_SENDERID 1129 2.10 1.24 2.38 151 RCVD_IN_IADB_DK 1126 2.04 1.24 2.30 152 RELAYCOUNTRY_IN 1117 0.36 1.23 0.07 153 XM_SPF_Unknown 1113 0.50 1.23 0.26 154 XM_H_PHPMailer 1091 0.75 1.20 0.61 155 DEAR_FRIEND 1082 0.34 1.19 0.06 156 T_FILL_THIS_FORM_SHORT 1073 1.18 1.18 1.18 157 T_XMDrugObfuBody_14 1064 1.75 1.17 1.94 158 SHORT_SHORTNER 1026 0.32 1.13 0.05 159 RCVD_IN_PSBL 1008 0.37 1.11 0.12 160 XMGenDplmaNmb 1004 0.92 1.11 0.86 161 SUBJECT_NEEDS_ENCODING 990 0.28 1.09 0.01 162 SUBJ_ILLEGAL_CHARS 988 0.28 1.09 0.01 163 MPART_ALT_DIFF_COUNT 967 0.50 1.07 0.31 164 TR_Symld_Words 958 0.93 1.06 0.89 165 HDRS_MISSP 954 0.29 1.05 0.04 166 THIS_AD 953 0.60 1.05 0.45 167 XM_RXBody 948 0.69 1.04 0.58 168 MIME_HEADER_CTYPE_ONLY 943 0.39 1.04 0.18 169 ALL_TRUSTED 938 11.86 1.03 15.40 170 XM_H_PHPOS_M 934 0.41 1.03 0.20 171 XMSubNoVowel 931 1.21 1.03 1.27 172 TR_Mismatch_TLD_01 930 0.37 1.02 0.16 173 HDRS_LCASE_IMGONLY 928 0.26 1.02 0.01 174 XMBrknScrpt_02 919 1.37 1.01 1.48 175 BOTNET_NORDNS 914 0.25 1.01 0.01 176 FROM_ILLEGAL_CHARS 891 0.24 0.98 0.00 177 XM_DK_Undo_01 882 1.36 0.97 1.48 178 XMLngstWrd_00 843 0.66 0.93 0.57 179 DIET_1 842 0.57 0.93 0.45 180 T_TooManySym_02 817 2.39 0.90 2.88 181 XMSubMetaSSxObfu_00 801 0.26 0.88 0.05 182 RELAYCOUNTRY_CN 796 0.29 0.88 0.10 183 XMLngstWrd_01 795 0.61 0.88 0.52 184 DKIM_ADSP_CUSTOM_MED 791 1.15 0.87 1.24 185 MAILING_LIST_MULTI 768 1.72 0.85 2.01 186 LOW_PRICE 737 0.86 0.81 0.88 187 HK_SCAM 724 0.20 0.80 0.01 188 XMLngstWrd_02 720 0.53 0.79 0.45 189 URIBL_BLACK 712 0.20 0.78 0.01 190 XM_UB99 709 0.19 0.78 0.00 191 TR_XM_COVIDMETA3 708 0.21 0.78 0.03 192 UPPERCASE_75_100 705 0.21 0.78 0.02 193 FORGED_GMAIL_RCVD 691 0.56 0.76 0.49 194 XMBody_29 691 0.90 0.76 0.94 195 XMSubEmpty 690 0.35 0.76 0.21 196 SUBJ_DOLLARS 689 0.41 0.76 0.29 197 NML_ADSP_CUSTOM_MED 686 0.86 0.76 0.90 198 XM_B_COPY_HTML 672 0.48 0.74 0.39 199 T_Symld_Words_02 671 0.43 0.74 0.33 200 XMSubMetaSSx_00 665 0.67 0.73 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 242058 89.24 95.09 87.32 2 RELAYCOUNTRY_US 223525 80.57 80.35 80.64 3 DKIM_SIGNED 214155 78.01 80.29 77.26 4 XM_DK_Pass 210871 76.57 78.09 76.07 5 DKIM_VALID 201742 71.66 68.23 72.78 6 XM_B_Unicode 197645 71.44 71.85 71.30 7 DKIM_VALID_AU 165937 58.37 53.80 59.86 8 XMListUnsubscribeExists 152436 58.73 70.13 54.99 9 BAYES_50 145420 48.79 37.57 52.46 10 DCC_CHECK_NEGATIVE 140539 42.18 16.15 50.70 11 DCC_CHECK 133290 56.65 82.80 48.08 12 XM_B_Unicode3 120394 42.37 39.12 43.43 13 HTML_FONT_LOW_CONTRAST 88188 31.01 28.57 31.81 14 LOC_TINY_FONT_1 86029 31.69 33.68 31.04 15 DKIM_VALID_EF 75241 27.00 26.56 27.14 16 T_TM2_M_HEADER_IN_MSG 62103 21.40 18.35 22.40 17 MIME_HTML_ONLY 61626 26.40 39.13 22.23 18 FVGT_m_MULTI_ODD 61363 22.69 24.39 22.14 19 XMSubLong 56590 20.36 20.19 20.42 20 BAYES_00 52619 15.04 2.99 18.98 21 T_KAM_HTML_FONT_INVALID 44607 17.67 22.51 16.09 22 ALL_TRUSTED 42692 11.86 1.03 15.40 23 XM_Body_Dirty_Words 41677 15.31 16.16 15.04 24 XM_Multi_Part_URI 39827 14.82 16.19 14.37 25 RCVD_IN_RP_SAFE 36021 10.86 4.33 12.99 26 TR_XM_DK_Bayes 35606 10.27 2.40 12.85 27 RCVD_IN_MSPIKE_H2 34292 11.35 8.23 12.37 28 RCVD_IN_RP_CERTIFIED 34085 9.86 2.40 12.30 29 TR_XM_DK_Bayes1 33654 9.60 1.84 12.14 30 XM_B_Unsub 32248 11.57 11.37 11.63 31 TR_XM_DK_Bayes2 31360 8.92 1.60 11.31 32 XM_DKIMWhitelistDomains 30671 8.35 0.04 11.06 33 HTML_IMAGE_RATIO_02 27679 10.73 13.01 9.99 34 RCVD_IN_MSPIKE_WL 27193 8.03 2.61 9.81 35 RCVD_IN_MSPIKE_H3 26941 7.97 2.61 9.72 36 XM_Evil_Numbers_Gen 26608 9.60 9.61 9.60 37 UNPARSEABLE_RELAY 24044 7.79 5.07 8.67 38 XM_DK_Undo_02 22968 18.02 47.75 8.29 39 LotsOfNums_01 22950 8.49 9.14 8.28 40 FSL_BULK_SIG 22934 10.64 17.88 8.27 41 LOTS_OF_MONEY 21197 8.46 10.94 7.65 42 XM_SendGrid 21125 6.77 4.17 7.62 43 HTML_IMAGE_RATIO_04 20561 7.05 5.91 7.42 44 XMStrtUSub 20366 6.62 4.40 7.35 45 XM_B_Phish_Phrases 19890 8.24 11.48 7.18 46 TooManyTo_001 18428 6.62 6.55 6.65 47 MPART_ALT_DIFF 17455 6.70 7.92 6.30 48 BAYES_60 17402 6.56 7.42 6.28 49 BOTNET_IPINHOSTNAME 16010 8.11 15.23 5.78 50 RELAYCOUNTRY_META 15494 9.75 22.46 5.59 51 BAYES_99 15160 12.18 32.70 5.47 52 XM_H_Long_From01 15066 5.53 5.83 5.44 53 T_TooManySym_01 14895 4.63 2.36 5.37 54 XMSexyCombo_05 13503 5.78 8.57 4.87 55 TR_XM_DK_SendGrid 12940 3.91 1.60 4.67 56 XMSubMetaSx_00 12751 5.53 8.38 4.60 57 DKIM_INVALID 12413 6.35 12.07 4.48 58 BAYES_40 12410 4.10 2.94 4.48 59 BAYES_999 12213 9.80 26.26 4.41 60 FROM_EXCESS_BASE64 11541 3.87 2.98 4.16 61 XM_UncommonTLD01 11287 7.21 16.80 4.07 62 TM2_M_URI_OPT_OUT 11078 3.61 2.41 4.00 63 MIME_QP_LONG_LINE 10935 3.82 3.44 3.94 64 BAYES_20 10913 3.52 2.24 3.94 65 MIME_HTML_ONLY_MULTI 10175 3.26 2.00 3.67 66 MIME_HTML_MOSTLY 9828 3.72 4.25 3.55 67 BAYES_80 9622 4.71 8.48 3.47 68 ANY_BOUNCE_MESSAGE 9618 2.65 0.16 3.47 69 BOUNCE_MESSAGE 9616 2.65 0.16 3.47 70 HTML_IMAGE_RATIO_06 9567 3.42 3.31 3.45 71 TR_DCC_Bayes_99 9385 9.18 26.87 3.39 72 HTML_IMAGE_RATIO_08 9238 3.17 2.67 3.33 73 XMNumbers 9212 3.64 4.61 3.32 74 T_REMOTE_IMAGE 8479 2.81 2.05 3.06 75 IN_ZIMBRA_NJ_WHITELIST 8253 2.25 0.01 2.98 76 XM_H_Trusted_IP 8212 2.23 0.00 2.96 77 RCVD_IN_IADB_LISTED 8212 2.56 1.33 2.96 78 TVD_RCVD_IP 8196 2.32 0.38 2.96 79 T_TooManySym_02 7973 2.39 0.90 2.88 80 INVALID_MSGID 7914 2.25 0.39 2.86 81 BAYES_05 7393 2.35 1.38 2.67 82 HELO_MISC_IP 7339 2.01 0.05 2.65 83 CK_HELO_DYNAMIC_SPLIT_IP 7338 2.01 0.05 2.65 84 RCVD_IN_IADB_SPF 7272 2.29 1.26 2.62 85 TO_MALFORMED 7182 2.34 1.58 2.59 86 RCVD_IN_IADB_SENDERID 6603 2.10 1.24 2.38 87 XMBdyGiftCard01 6553 2.43 2.63 2.36 88 NO_DNS_FOR_FROM 6530 4.07 9.30 2.36 89 RCVD_IN_IADB_DK 6388 2.04 1.24 2.30 90 RELAYCOUNTRY_CA 6366 3.49 7.14 2.30 91 BOTNET 6321 6.46 19.23 2.28 92 BAYES_95 6258 2.75 4.27 2.26 93 XM_B_SpammyTLD 6204 2.55 3.51 2.24 94 XM_CamelCaseFrm001 5993 3.87 9.08 2.16 95 TR_XM_PhishingBody 5942 2.26 2.64 2.14 96 USER_IN_DEF_DKIM_WL 5666 1.54 0.00 2.04 97 MAILING_LIST_MULTI 5578 1.72 0.85 2.01 98 T_XMDrugObfuBody_14 5379 1.75 1.17 1.94 99 IN_HORDE_ADDRESS_BOOK 5170 1.41 0.03 1.87 100 UNTRUSTED_Relay 4771 4.45 12.79 1.72 101 RCVD_IN_IADB_VOUCHED 4757 1.36 0.27 1.72 102 T_XMHurry_00 4571 1.76 2.09 1.65 103 XMStockSpam_06 4341 1.59 1.66 1.57 104 URI_TRY_3LD 4322 1.59 1.67 1.56 105 XM_PDF 4129 1.27 0.60 1.49 106 XM_DK_Undo_01 4115 1.36 0.97 1.48 107 TooManyTo_002 4111 1.24 0.48 1.48 108 XMBrknScrpt_02 4110 1.37 1.01 1.48 109 KHOP_HELO_FCRDNS 4069 3.82 11.01 1.47 110 T_XMDrugObfuBody_08 4069 2.46 5.50 1.47 111 TM2_M_VERY_LONG_WORD 3863 1.56 2.07 1.39 112 XMDiploma_00 3847 1.46 1.68 1.39 113 XM_GoogleGroups 3824 1.14 0.40 1.38 114 HTML_MIME_NO_HTML_TAG 3644 1.98 4.02 1.31 115 XMSubNoVowel 3529 1.21 1.03 1.27 116 DKIM_ADSP_CUSTOM_MED 3425 1.15 0.87 1.24 117 XMGappySubj_01 3399 0.96 0.16 1.23 118 T_FILL_THIS_FORM_SHORT 3269 1.18 1.18 1.18 119 SUBJ_ALL_CAPS 3228 1.59 2.87 1.16 120 TR_MSPIKEBAYES00 3080 0.84 0.01 1.11 121 TooManyTo_003 3056 0.93 0.41 1.10 122 HTML_FONT_FACE_BAD 3038 0.95 0.50 1.10 123 URI_HEX 3022 1.23 1.66 1.09 124 XM_UB50 3021 2.57 7.09 1.09 125 RCVD_IN_IADB_OPTIN 2893 0.85 0.25 1.04 126 XM_B_Unsub2 2882 1.17 1.56 1.04 127 XM_B_COVIDMETA 2879 1.98 4.87 1.04 128 XM_SPF_SoftFail 2841 2.06 5.21 1.02 129 XM_OfRef6 2761 1.54 3.22 1.00 130 XM_ProductURIs 2751 1.07 1.31 0.99 131 RELAYCOUNTRY_GB 2693 1.10 1.51 0.97 132 XMBody_29 2608 0.90 0.76 0.94 133 XM_H_Long_From02 2573 0.86 0.65 0.93 134 TooManyTo_004 2550 0.78 0.36 0.92 135 NML_ADSP_CUSTOM_MED 2484 0.86 0.76 0.90 136 TR_Symld_Words 2476 0.93 1.06 0.89 137 T_TooManySym_03 2466 0.78 0.44 0.89 138 XMBody_17 2466 1.70 4.16 0.89 139 LOW_PRICE 2439 0.86 0.81 0.88 140 XMPhish30 2396 1.01 1.44 0.86 141 XMGenDplmaNmb 2385 0.92 1.11 0.86 142 XMPhish08 2385 0.82 0.70 0.86 143 RCVD_IN_BL_SPAMCOP_NET 2315 1.71 4.37 0.84 144 PDS_OTHER_BAD_TLD 2299 1.35 2.93 0.83 145 XMBody_95 2281 0.65 0.11 0.82 146 XMSubMetaSxObfu_02 2240 0.78 0.70 0.81 147 TooManyTo_005 2238 0.69 0.32 0.81 148 XMSubMetaI_00 1988 0.92 1.53 0.72 149 HTML_TAG_BALANCE_BODY 1916 0.68 0.66 0.69 150 HELO_NODOT 1818 0.60 0.42 0.66 151 HELO_NO_DOMAIN 1814 0.60 0.42 0.65 152 XMSubMetaSSx_00 1798 0.67 0.73 0.65 153 HTML_IMAGE_ONLY_20 1759 0.56 0.33 0.63 154 TR_LOTS_OF_MONEY3 1757 1.26 3.19 0.63 155 USER_IN_WHITELIST 1740 0.47 0.00 0.63 156 XMSexyCombo_01 1706 1.02 2.26 0.62 157 XM_H_PHPMailer 1685 0.75 1.20 0.61 158 TR_MetaPhish_Combo_01 1645 0.61 0.64 0.59 159 TR_XM_COVIDMETA4 1621 1.19 3.02 0.58 160 XM_ShortIntro_01 1597 0.59 0.61 0.58 161 XM_RXBody 1596 0.69 1.04 0.58 162 XMLngstWrd_00 1581 0.66 0.93 0.57 163 XM_B_REG_HTML 1563 0.55 0.52 0.56 164 XMSlimDrugH 1511 0.55 0.55 0.55 165 XMHTML_After_End 1495 2.01 6.52 0.54 166 XMCapTrack 1461 0.55 0.61 0.53 167 XMLngstWrd_01 1454 0.61 0.88 0.52 168 HTTPS_HTTP_MISMATCH 1452 0.55 0.65 0.52 169 TR_XM_PHPDW 1421 0.94 2.26 0.51 170 FORGED_GMAIL_RCVD 1372 0.56 0.76 0.49 171 TR_XM_PHPForged 1345 0.91 2.22 0.49 172 RDNS_DYNAMIC 1335 2.44 8.44 0.48 173 XM_DIRTYINTL 1330 1.08 2.93 0.48 174 TR_XM_FormFill2 1274 0.89 2.20 0.46 175 XMBody_78 1273 0.69 1.38 0.46 176 BODY_ENHANCEMENT 1263 0.36 0.08 0.46 177 THIS_AD 1258 0.60 1.05 0.45 178 XM_H_PHPOS 1257 0.88 2.19 0.45 179 DIET_1 1243 0.57 0.93 0.45 180 XMLngstWrd_02 1242 0.53 0.79 0.45 181 T_XMDrugObfuBody_00 1227 0.46 0.52 0.44 182 TM2_M_A_HREF_HREF 1197 0.47 0.60 0.43 183 SpammyFromTLD_01 1178 1.28 3.89 0.42 184 XMNoVowels 1161 0.44 0.49 0.42 185 HTML_OBFUSCATE_05_10 1159 0.34 0.10 0.42 186 XMBSHREFv2 1153 0.36 0.19 0.42 187 XMPhish14 1127 0.43 0.51 0.41 188 XMHTMLBadTable_001 1084 0.46 0.69 0.39 189 XM_B_COPY_HTML 1080 0.48 0.74 0.39 190 XMSolicitRefs_0 1079 0.37 0.30 0.39 191 XMLngstWrd_03 1068 0.41 0.50 0.39 192 MISSING_HEADERS 1065 0.89 2.43 0.38 193 T_TooManySym_04 1065 0.33 0.16 0.38 194 DKIM_ADSP_NXDOMAIN 1060 1.07 3.18 0.38 195 URI_NOVOWEL 1054 0.68 1.58 0.38 196 FILL_THIS_FORM 1051 0.32 0.14 0.38 197 RELAYCOUNTRY_DE 1028 0.65 1.51 0.37 198 XMSubMetaSxObfu_03 957 0.44 0.71 0.35 199 TVD_SPACE_RATIO 945 0.29 0.12 0.34 200 XMLngstWrd_04 942 0.35 0.40 0.34 ----------------------------------------------------------------------