Email: 378312 Autolearn: 0 AvgScore: 1.22 AvgScanTime: 2.05 sec Spam: 74238 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 3.30 sec Ham: 304074 Autolearn: 0 AvgScore: -1.73 AvgScanTime: 1.75 sec Time Spent Running SA: 215.65 hours Time Spent Processing Spam: 68.07 hours Time Spent Processing Ham: 147.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 72219 98.60 97.28 98.93 2 HTML_MESSAGE 69767 88.55 93.98 87.23 3 DKIM_SIGNED 55312 78.28 74.51 79.20 4 XM_DK_Pass 53888 77.10 72.59 78.20 5 XM_B_Unicode 50274 71.01 67.72 71.82 6 XMListUnsubscribeExists 49070 60.44 66.10 59.06 7 RELAYCOUNTRY_US 47210 77.74 63.59 81.20 8 DKIM_VALID 46247 71.74 62.30 74.05 9 XM_DK_Undo_02 41582 22.40 56.01 14.19 10 MIME_HTML_ONLY 36961 29.59 49.79 24.66 11 DKIM_VALID_AU 34678 57.05 46.71 59.57 12 BAYES_99 34238 16.72 46.12 9.54 13 RELAYCOUNTRY_META 30520 12.76 41.11 5.84 14 BAYES_999 29285 13.92 39.45 7.68 15 DKIM_VALID_EF 25674 28.79 34.58 27.37 16 BOTNET 25005 9.35 33.68 3.41 17 BAYES_50 23760 47.47 32.01 51.25 18 XM_UncommonTLD01 22775 9.69 30.68 4.57 19 UNTRUSTED_Relay 20752 7.19 27.95 2.12 20 XM_B_Unicode3 20097 39.86 27.07 42.98 21 T_KAM_HTML_FONT_INVALID 19651 19.92 26.47 18.32 22 LOC_TINY_FONT_1 19071 29.08 25.69 29.91 23 RCVD_IN_MSPIKE_H2 17724 23.38 23.87 23.26 24 T_TM2_M_HEADER_IN_MSG 17428 21.18 23.48 20.62 25 XMSubLong 16718 20.86 22.52 20.45 26 BOTNET_IPINHOSTNAME 15581 9.56 20.99 6.77 27 FVGT_m_MULTI_ODD 14365 22.37 19.35 23.10 28 HTML_FONT_LOW_CONTRAST 14339 29.01 19.31 31.38 29 XM_Body_Dirty_Words 13405 15.69 18.06 15.11 30 XM_CamelCaseFrm001 11961 5.50 16.11 2.91 31 URIBL_SBL_A 10766 3.37 14.50 0.65 32 TR_XM_MaxBayes 10153 2.93 13.68 0.30 33 XM_Multi_Part_URI 9404 13.79 12.67 14.06 34 RCVD_IN_MSPIKE_BL 9253 3.10 12.46 0.81 35 DKIM_INVALID 9065 6.54 12.21 5.15 36 RCVD_IN_BL_SPAMCOP_NET 8992 3.77 12.11 1.73 37 XMSexyCombo_05 8872 6.29 11.95 4.91 38 HTML_IMAGE_RATIO_02 8828 9.99 11.89 9.53 39 T_REMOTE_IMAGE 8405 4.86 11.32 3.29 40 LOTS_OF_MONEY 8146 8.70 10.97 8.15 41 XM_UB50 7798 3.09 10.50 1.27 42 NO_DNS_FOR_FROM 7226 4.23 9.73 2.89 43 RELAYCOUNTRY_CA 7138 3.81 9.62 2.39 44 RELAYCOUNTRY_DE 7076 2.15 9.53 0.35 45 XMBody_17 6959 2.94 9.37 1.36 46 KHOP_HELO_FCRDNS 6890 2.69 9.28 1.08 47 XM_UB99 6792 1.81 9.15 0.01 48 BODY_URI_ONLY 6204 1.69 8.36 0.06 49 RCVD_IN_MSPIKE_L3 6203 2.18 8.36 0.67 50 RCVD_IN_RP_RNBL 6144 1.75 8.28 0.16 51 XMHTML_After_End 5851 2.41 7.88 1.08 52 XM_UB999 5828 1.55 7.85 0.01 53 HTML_MIME_NO_HTML_TAG 5783 3.90 7.79 2.95 54 XM_B_Unsub 5648 10.69 7.61 11.45 55 XMSubMetaSx_00 5492 4.68 7.40 4.02 56 XM_B_Phish_Phrases 5171 7.81 6.97 8.02 57 BAYES_80 5067 5.10 6.83 4.68 58 T_XMDrugObfuBody_08 4971 2.64 6.70 1.65 59 XM_DIRTYINTL 4868 1.77 6.56 0.61 60 BAYES_60 4710 6.68 6.34 6.76 61 RELAYCOUNTRY_FR 4647 1.63 6.26 0.50 62 SpammyFromTLD_02 4630 1.41 6.24 0.24 63 RCVD_IN_MSPIKE_WL 4610 19.91 6.21 23.25 64 XM_SPF_SoftFail 4522 2.16 6.09 1.20 65 LotsOfNums_01 4230 8.17 5.70 8.78 66 XM_Evil_Numbers_Gen 4172 8.93 5.62 9.74 67 XM_URI_RBL 3820 1.21 5.15 0.26 68 BOTNET_NORDNS 3772 1.01 5.08 0.02 69 XMNumbers 3743 3.82 5.04 3.52 70 SpammyFromTLD_01 3701 1.55 4.99 0.71 71 XM_JunkDunk 3693 0.98 4.97 0.00 72 XM_B_SpammyTLD 3467 2.61 4.67 2.11 73 XM_H_Long_From01 3421 5.30 4.61 5.47 74 TR_XM_MaxSPIKE 3418 0.92 4.60 0.02 75 MISSING_HEADERS 3364 1.16 4.53 0.33 76 TooManyTo_001 3358 6.52 4.52 7.01 77 DKIM_ADSP_NXDOMAIN 3254 1.19 4.38 0.41 78 TR_XM_PhishingBody 3020 3.40 4.07 3.24 79 TR_XM_INV_DKIM 3001 1.06 4.04 0.33 80 HDRS_MISSP 2956 0.90 3.98 0.15 81 TR_XM_COVIDMETA4 2955 1.33 3.98 0.68 82 MIME_HTML_MOSTLY 2845 3.00 3.83 2.80 83 MIME_HEADER_CTYPE_ONLY 2822 0.95 3.80 0.25 84 HTML_SHORT_LINK_IMG_1 2811 0.76 3.79 0.02 85 HDRS_LCASE_IMGONLY 2806 0.75 3.78 0.01 86 XM_OfRef6 2798 1.80 3.77 1.32 87 BAYES_95 2781 3.15 3.75 3.00 88 MPART_ALT_DIFF 2777 5.02 3.74 5.34 89 XMSexyCombo_01 2738 1.32 3.69 0.75 90 XM_B_COVIDMETA 2675 1.84 3.60 1.41 91 HTML_TAG_BALANCE_BODY 2624 1.26 3.53 0.71 92 PDS_OTHER_BAD_TLD 2548 1.31 3.43 0.79 93 HTML_IMAGE_RATIO_04 2545 5.21 3.43 5.65 94 RCVD_IN_PSBL 2529 0.79 3.41 0.15 95 DATE_IN_PAST_03_06 2469 0.74 3.33 0.11 96 RCVD_IN_MSPIKE_H3 2456 11.22 3.31 13.15 97 FROM_SUSPICIOUS_NTLD 2362 0.74 3.18 0.14 98 DATE_IN_PAST_06_12 2359 0.88 3.18 0.32 99 HTML_IMAGE_ONLY_28 2324 0.78 3.13 0.21 100 RELAYCOUNTRY_FI 2321 0.62 3.13 0.01 101 T_XMHurry_00 2314 1.15 3.12 0.67 102 HTML_FONT_SIZE_LARGE 2310 0.72 3.11 0.13 103 FROM_SUSPICIOUS_NTLD_FP 2309 0.72 3.11 0.13 104 UNPARSEABLE_RELAY 2227 7.96 3.00 9.17 105 XMSexyCombo_04 2171 0.77 2.92 0.25 106 XMBrknScrpt_02 2138 1.39 2.88 1.03 107 RCVD_IN_MSPIKE_H4 2125 8.10 2.86 9.38 108 XMStrtUSub 2119 4.23 2.85 4.57 109 LongTLD 1987 0.70 2.68 0.22 110 XM_UB60 1930 0.61 2.60 0.12 111 XM_UB80 1925 0.56 2.59 0.06 112 XMSubMetaSSx_00 1900 0.71 2.56 0.26 113 NO_FM_NAME_IP_HOSTN 1900 0.51 2.56 0.01 114 URI_NOVOWEL 1864 0.84 2.51 0.44 115 DATE_IN_PAST_12_24 1802 0.58 2.43 0.13 116 TR_XM_PHPDW 1768 0.84 2.38 0.46 117 XM_SendGrid 1737 6.93 2.34 8.05 118 TR_XM_PHPForged 1734 0.82 2.34 0.45 119 T_TooManySym_01 1719 4.43 2.32 4.94 120 TR_XM_FormFill2 1705 0.81 2.30 0.44 121 XM_H_PHPOS 1701 0.80 2.29 0.44 122 HTML_IMAGE_ONLY_08 1675 0.54 2.26 0.12 123 BAYES_40 1665 3.67 2.24 4.02 124 TR_LOTS_OF_MONEY3 1663 0.92 2.24 0.60 125 SUBJ_ALL_CAPS 1659 1.50 2.23 1.32 126 XM_B_Phish66 1632 1.47 2.20 1.30 127 HTML_IMAGE_RATIO_06 1626 3.79 2.19 4.18 128 MIME_QP_LONG_LINE 1581 4.29 2.13 4.81 129 HTML_TITLE_SUBJ_DIFF 1568 0.47 2.11 0.07 130 XM_BadFromFormat 1565 0.58 2.11 0.20 131 RELAYCOUNTRY_IN 1553 0.50 2.09 0.11 132 RCVD_IN_MSPIKE_L5 1538 0.47 2.07 0.08 133 XMSexyCombo_03 1465 0.39 1.97 0.00 134 MORE_SEX 1462 0.39 1.97 0.00 135 TM2_M_URI_OPT_OUT 1462 3.70 1.97 4.12 136 FROM_EXCESS_BASE64 1456 3.43 1.96 3.79 137 BODY_SINGLE_URI 1451 0.39 1.95 0.01 138 URI_TRY_3LD 1410 1.83 1.90 1.81 139 HTML_IMAGE_ONLY_04 1386 0.40 1.87 0.04 140 TM2_M_VERY_LONG_WORD 1365 1.78 1.84 1.76 141 BODY_SINGLE_WORD 1330 0.37 1.79 0.02 142 URI_HEX 1290 1.39 1.74 1.30 143 FVGT_m_MULTI_ODD_EMAIL 1275 0.38 1.72 0.06 144 HTML_SHORT_CENTER 1275 0.34 1.72 0.00 145 HTML_IMAGE_RATIO_08 1259 2.18 1.70 2.30 146 XM_OfRef7 1216 0.42 1.64 0.12 147 RELAYCOUNTRY_GB 1182 0.84 1.59 0.66 148 XMBdyGiftCard01 1180 1.55 1.59 1.54 149 TR_Mismatch_TLD_02 1177 0.38 1.59 0.09 150 TR_XM_RelayPhish 1144 0.44 1.54 0.17 151 XMSlimDrugH 1138 0.54 1.53 0.29 152 XM_B_Unsub2 1105 1.33 1.49 1.30 153 XM_UB95 1040 0.30 1.40 0.03 154 TR_Mismatch_TLD_01 1032 0.49 1.39 0.27 155 URIBL_ABUSE_SURBL 1032 0.33 1.39 0.07 156 T_XMDrugObfuBody_14 1026 1.59 1.38 1.64 157 RCVD_IN_MSPIKE_L4 1017 0.31 1.37 0.05 158 XMSubNoVowel 1002 0.96 1.35 0.87 159 FILL_THIS_FORM 983 0.41 1.32 0.19 160 BAYES_20 968 2.83 1.30 3.20 161 TR_XM_COVIDMETA1 902 0.49 1.22 0.31 162 MIME_HTML_ONLY_MULTI 878 2.80 1.18 3.20 163 XM_H_Undi_Recip 872 0.46 1.17 0.29 164 XMStockSpam_06 861 0.99 1.16 0.95 165 ALL_TRUSTED 824 11.64 1.11 14.21 166 T_FILL_THIS_FORM_SHORT 822 0.64 1.11 0.53 167 XM_H_PHPMailer 803 0.68 1.08 0.59 168 XMReplyNow 788 0.28 1.06 0.09 169 XMDiploma_00 769 1.34 1.04 1.42 170 URIBL_BLACK 766 0.22 1.03 0.02 171 HK_RANDOM_FROM 763 0.32 1.03 0.15 172 DIET_1 755 0.76 1.02 0.69 173 URI_PHP_REDIR 713 0.19 0.96 0.00 174 DEAR_FRIEND 709 0.30 0.96 0.13 175 XM_ProductURIs 706 1.38 0.95 1.48 176 MAILING_LIST_MULTI 700 1.80 0.94 2.01 177 TR_Symld_Words 692 1.14 0.93 1.19 178 PDS_FROM_2_EMAILS 691 0.19 0.93 0.01 179 FROM_2_EMAILS_SHORT 675 0.18 0.91 0.01 180 MPART_ALT_DIFF_COUNT 662 0.61 0.89 0.54 181 FROM_DOMAIN_NOVOWEL 650 0.20 0.88 0.04 182 XM_H_PHPOS_M 649 0.35 0.87 0.23 183 TR_XM_Undi_Recip6 649 0.22 0.87 0.06 184 RELAYCOUNTRY_NL 634 0.42 0.85 0.31 185 PDS_TO_EQ_FROM_NAME 634 0.18 0.85 0.01 186 XM_HighProb1 620 0.17 0.84 0.01 187 TR_LOTS_OF_MONEY2 614 0.46 0.83 0.37 188 T_MONEY_PERCENT 614 0.46 0.83 0.37 189 RELAYCOUNTRY_AT 612 0.37 0.82 0.25 190 HK_RANDOM_REPLYTO 606 0.33 0.82 0.21 191 URI_NO_WWW_INFO_CGI 604 0.19 0.81 0.04 192 RELAYCOUNTRY_JP 589 0.18 0.79 0.03 193 DKIM_ADSP_CUSTOM_MED 588 1.02 0.79 1.07 194 XMSubMetaI_00 586 0.62 0.79 0.57 195 BAYES_00 569 12.49 0.77 15.35 196 LONG_JUNK_URI 567 0.22 0.76 0.08 197 T_XMDrugObfuBody_00 565 0.72 0.76 0.71 198 RDNS_DYNAMIC 559 0.57 0.75 0.53 199 TR_MetaPhish_Combo_01 551 0.68 0.74 0.66 200 RELAYCOUNTRY_CN 551 0.21 0.74 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 300808 98.60 97.28 98.93 2 HTML_MESSAGE 265237 88.55 93.98 87.23 3 RELAYCOUNTRY_US 246899 77.74 63.59 81.20 4 DKIM_SIGNED 240820 78.28 74.51 79.20 5 XM_DK_Pass 237790 77.10 72.59 78.20 6 DKIM_VALID 225155 71.74 62.30 74.05 7 XM_B_Unicode 218371 71.01 67.72 71.82 8 DKIM_VALID_AU 181152 57.05 46.71 59.57 9 XMListUnsubscribeExists 179574 60.44 66.10 59.06 10 BAYES_50 155839 47.47 32.01 51.25 11 XM_B_Unicode3 130697 39.86 27.07 42.98 12 HTML_FONT_LOW_CONTRAST 95415 29.01 19.31 31.38 13 LOC_TINY_FONT_1 90949 29.08 25.69 29.91 14 DKIM_VALID_EF 83240 28.79 34.58 27.37 15 MIME_HTML_ONLY 74988 29.59 49.79 24.66 16 RCVD_IN_MSPIKE_H2 70738 23.38 23.87 23.26 17 RCVD_IN_MSPIKE_WL 70704 19.91 6.21 23.25 18 FVGT_m_MULTI_ODD 70248 22.37 19.35 23.10 19 T_TM2_M_HEADER_IN_MSG 62695 21.18 23.48 20.62 20 XMSubLong 62179 20.86 22.52 20.45 21 T_KAM_HTML_FONT_INVALID 55703 19.92 26.47 18.32 22 BAYES_00 46669 12.49 0.77 15.35 23 XM_Body_Dirty_Words 45937 15.69 18.06 15.11 24 ALL_TRUSTED 43221 11.64 1.11 14.21 25 XM_DK_Undo_02 43144 22.40 56.01 14.19 26 XM_Multi_Part_URI 42757 13.79 12.67 14.06 27 RCVD_IN_MSPIKE_H3 39994 11.22 3.31 13.15 28 RCVD_IN_RP_SAFE 35096 9.42 0.74 11.54 29 XM_B_Unsub 34812 10.69 7.61 11.45 30 TR_XM_DK_Bayes 33164 8.86 0.50 10.91 31 RCVD_IN_RP_CERTIFIED 32767 8.76 0.53 10.78 32 TR_XM_DK_Bayes1 31180 8.30 0.30 10.25 33 XM_Evil_Numbers_Gen 29618 8.93 5.62 9.74 34 BAYES_99 29010 16.72 46.12 9.54 35 HTML_IMAGE_RATIO_02 28969 9.99 11.89 9.53 36 TR_XM_DK_Bayes2 28785 7.65 0.20 9.47 37 RCVD_IN_MSPIKE_H4 28535 8.10 2.86 9.38 38 UNPARSEABLE_RELAY 27883 7.96 3.00 9.17 39 XM_DKIMWhitelistDomains 27238 7.20 0.00 8.96 40 LotsOfNums_01 26690 8.17 5.70 8.78 41 LOTS_OF_MONEY 24780 8.70 10.97 8.15 42 XM_SendGrid 24489 6.93 2.34 8.05 43 XM_B_Phish_Phrases 24384 7.81 6.97 8.02 44 BAYES_999 23359 13.92 39.45 7.68 45 TooManyTo_001 21303 6.52 4.52 7.01 46 BOTNET_IPINHOSTNAME 20589 9.56 20.99 6.77 47 BAYES_60 20557 6.68 6.34 6.76 48 RELAYCOUNTRY_META 17746 12.76 41.11 5.84 49 HTML_IMAGE_RATIO_04 17175 5.21 3.43 5.65 50 XM_H_Long_From01 16643 5.30 4.61 5.47 51 MPART_ALT_DIFF 16231 5.02 3.74 5.34 52 DKIM_INVALID 15665 6.54 12.21 5.15 53 T_TooManySym_01 15035 4.43 2.32 4.94 54 XMSexyCombo_05 14938 6.29 11.95 4.91 55 MIME_QP_LONG_LINE 14636 4.29 2.13 4.81 56 TR_XM_DK_SendGrid 14256 3.91 0.70 4.69 57 BAYES_80 14218 5.10 6.83 4.68 58 XM_UncommonTLD01 13901 9.69 30.68 4.57 59 XMStrtUSub 13884 4.23 2.85 4.57 60 IN_ZIMBRA_NJ_WHITELIST 13694 3.63 0.05 4.50 61 HTML_IMAGE_RATIO_06 12705 3.79 2.19 4.18 62 TM2_M_URI_OPT_OUT 12542 3.70 1.97 4.12 63 BAYES_40 12221 3.67 2.24 4.02 64 XMSubMetaSx_00 12221 4.68 7.40 4.02 65 FROM_EXCESS_BASE64 11532 3.43 1.96 3.79 66 XMNumbers 10710 3.82 5.04 3.52 67 RCVD_IN_IADB_LISTED 10697 2.94 0.56 3.52 68 BOTNET 10367 9.35 33.68 3.41 69 ANY_BOUNCE_MESSAGE 10066 2.72 0.32 3.31 70 BOUNCE_MESSAGE 10064 2.72 0.32 3.31 71 T_REMOTE_IMAGE 9996 4.86 11.32 3.29 72 TR_XM_PhishingBody 9837 3.40 4.07 3.24 73 BAYES_20 9736 2.83 1.30 3.20 74 MIME_HTML_ONLY_MULTI 9716 2.80 1.18 3.20 75 RCVD_IN_IADB_SPF 9389 2.58 0.48 3.09 76 BAYES_95 9124 3.15 3.75 3.00 77 HTML_MIME_NO_HTML_TAG 8969 3.90 7.79 2.95 78 XM_CamelCaseFrm001 8837 5.50 16.11 2.91 79 NO_DNS_FOR_FROM 8777 4.23 9.73 2.89 80 MIME_HTML_MOSTLY 8523 3.00 3.83 2.80 81 RCVD_IN_IADB_SENDERID 8502 2.34 0.47 2.80 82 RCVD_IN_IADB_DK 8283 2.28 0.47 2.72 83 INVALID_MSGID 7868 2.12 0.22 2.59 84 T_TooManySym_02 7745 2.17 0.60 2.55 85 TVD_RCVD_IP 7722 2.12 0.40 2.54 86 RELAYCOUNTRY_CA 7278 3.81 9.62 2.39 87 HTML_IMAGE_RATIO_08 6979 2.18 1.70 2.30 88 HELO_MISC_IP 6977 1.89 0.25 2.29 89 CK_HELO_DYNAMIC_SPLIT_IP 6962 1.90 0.29 2.29 90 TO_MALFORMED 6776 1.83 0.20 2.23 91 BAYES_05 6697 1.89 0.63 2.20 92 XM_H_Trusted_IP 6489 1.72 0.00 2.13 93 UNTRUSTED_Relay 6453 7.19 27.95 2.12 94 XM_B_SpammyTLD 6407 2.61 4.67 2.11 95 RCVD_IN_IADB_VOUCHED 6209 1.67 0.17 2.04 96 MAILING_LIST_MULTI 6126 1.80 0.94 2.01 97 XM_PDF 6020 1.73 0.71 1.98 98 URI_TRY_3LD 5505 1.83 1.90 1.81 99 TM2_M_VERY_LONG_WORD 5364 1.78 1.84 1.76 100 RCVD_IN_BL_SPAMCOP_NET 5259 3.77 12.11 1.73 101 T_XMDrugObfuBody_08 5015 2.64 6.70 1.65 102 T_XMDrugObfuBody_14 4993 1.59 1.38 1.64 103 HTML_IMAGE_ONLY_24 4938 1.34 0.16 1.62 104 IN_HORDE_ADDRESS_BOOK 4869 1.32 0.18 1.60 105 XMBdyGiftCard01 4685 1.55 1.59 1.54 106 USER_IN_DEF_DKIM_WL 4683 1.24 0.00 1.54 107 XM_DK_Undo_01 4543 1.34 0.72 1.49 108 XM_ProductURIs 4509 1.38 0.95 1.48 109 XMDiploma_00 4315 1.34 1.04 1.42 110 XM_B_COVIDMETA 4275 1.84 3.60 1.41 111 XMBody_17 4148 2.94 9.37 1.36 112 XM_OfRef6 4021 1.80 3.77 1.32 113 SUBJ_ALL_CAPS 4019 1.50 2.23 1.32 114 TooManyTo_002 3974 1.14 0.44 1.31 115 URI_HEX 3955 1.39 1.74 1.30 116 XM_B_Phish66 3944 1.47 2.20 1.30 117 XM_B_Unsub2 3942 1.33 1.49 1.30 118 XM_UB50 3874 3.09 10.50 1.27 119 RCVD_IN_IADB_OPTIN 3865 1.07 0.22 1.27 120 XM_GoogleGroups 3742 1.07 0.44 1.23 121 XM_H_Long_From02 3721 1.05 0.34 1.22 122 XM_SPF_SoftFail 3656 2.16 6.09 1.20 123 TR_Symld_Words 3606 1.14 0.93 1.19 124 KHOP_HELO_FCRDNS 3285 2.69 9.28 1.08 125 XMHTML_After_End 3270 2.41 7.88 1.08 126 DKIM_ADSP_CUSTOM_MED 3252 1.02 0.79 1.07 127 XMGappySubj_01 3179 0.87 0.18 1.05 128 XMBrknScrpt_02 3138 1.39 2.88 1.03 129 HTML_FONT_FACE_BAD 3124 0.89 0.32 1.03 130 TooManyTo_003 2929 0.83 0.31 0.96 131 XMPhish08 2928 0.88 0.53 0.96 132 XMStockSpam_06 2901 0.99 1.16 0.95 133 XMSubNoVowel 2647 0.96 1.35 0.87 134 TR_MSPIKEBAYES00 2644 0.70 0.00 0.87 135 RCVD_IN_MSPIKE_BL 2471 3.10 12.46 0.81 136 TooManyTo_004 2455 0.70 0.26 0.81 137 PDS_OTHER_BAD_TLD 2395 1.31 3.43 0.79 138 T_TooManySym_03 2370 0.69 0.32 0.78 139 NML_ADSP_CUSTOM_MED 2325 0.75 0.70 0.76 140 XMSexyCombo_01 2269 1.32 3.69 0.75 141 XMGenDplmaNmb 2182 0.67 0.49 0.72 142 XM_B_REG_HTML 2176 0.63 0.26 0.72 143 RCVD_IN_MSPIKE_H5 2175 0.58 0.04 0.72 144 SpammyFromTLD_01 2172 1.55 4.99 0.71 145 T_XMDrugObfuBody_00 2152 0.72 0.76 0.71 146 HTML_TAG_BALANCE_BODY 2148 1.26 3.53 0.71 147 XM_RXBody 2126 0.67 0.55 0.70 148 TooManyTo_005 2123 0.60 0.22 0.70 149 DIET_1 2113 0.76 1.02 0.69 150 TR_XM_COVIDMETA4 2070 1.33 3.98 0.68 151 RCVD_IN_MSPIKE_L3 2044 2.18 8.36 0.67 152 T_XMHurry_00 2028 1.15 3.12 0.67 153 TR_MetaPhish_Combo_01 2012 0.68 0.74 0.66 154 XMSubMetaSxObfu_03 2004 0.67 0.71 0.66 155 RELAYCOUNTRY_GB 1998 0.84 1.59 0.66 156 XM_B_COPY_HTML 1986 0.60 0.40 0.65 157 URIBL_SBL_A 1968 3.37 14.50 0.65 158 XMHTMLBadTable_001 1920 0.58 0.35 0.63 159 HELO_NODOT 1857 0.59 0.48 0.61 160 HELO_NO_DOMAIN 1856 0.58 0.47 0.61 161 XM_DIRTYINTL 1845 1.77 6.56 0.61 162 TR_LOTS_OF_MONEY3 1833 0.92 2.24 0.60 163 THIS_AD 1822 0.51 0.17 0.60 164 USER_IN_WHITELIST 1789 0.47 0.00 0.59 165 XM_H_PHPMailer 1788 0.68 1.08 0.59 166 XMSubMetaSxObfu_02 1751 0.58 0.58 0.58 167 XMSubMetaI_00 1743 0.62 0.79 0.57 168 HTTPS_HTTP_MISMATCH 1732 0.56 0.52 0.57 169 PLING_QUERY 1682 0.49 0.23 0.55 170 FORGED_GMAIL_RCVD 1676 0.57 0.66 0.55 171 HTML_IMAGE_ONLY_20 1660 0.52 0.43 0.55 172 MPART_ALT_DIFF_COUNT 1629 0.61 0.89 0.54 173 T_FILL_THIS_FORM_SHORT 1616 0.64 1.11 0.53 174 RDNS_DYNAMIC 1599 0.57 0.75 0.53 175 XMBody_95 1569 0.43 0.05 0.52 176 RELAYCOUNTRY_FR 1520 1.63 6.26 0.50 177 XMPhish30 1508 0.52 0.61 0.50 178 T_Symld_Words_02 1471 0.52 0.66 0.48 179 XMLngstWrd_00 1453 0.43 0.24 0.48 180 HTML_OBFUSCATE_05_10 1415 0.39 0.07 0.47 181 XMPhish14 1413 0.50 0.65 0.46 182 TR_XM_PHPDW 1410 0.84 2.38 0.46 183 NUMERIC_HTTP_ADDR 1385 0.40 0.18 0.46 184 TR_XM_PHPForged 1372 0.82 2.34 0.45 185 XMBody_78 1364 0.49 0.66 0.45 186 TR_XM_FormFill2 1349 0.81 2.30 0.44 187 XM_H_PHPOS 1333 0.80 2.29 0.44 188 TM2_M_A_HREF_HREF 1327 0.46 0.55 0.44 189 URI_NOVOWEL 1325 0.84 2.51 0.44 190 XMLngstWrd_01 1268 0.38 0.21 0.42 191 HTML_IMAGE_ONLY_32 1260 0.35 0.09 0.41 192 DKIM_ADSP_NXDOMAIN 1251 1.19 4.38 0.41 193 XMCapTrack 1210 0.43 0.58 0.40 194 XM_Body_Obfu01 1188 0.34 0.12 0.39 195 BASE64_LENGTH_79_INF 1162 0.38 0.39 0.38 196 XMBSHREFv2 1135 0.32 0.12 0.37 197 T_MONEY_PERCENT 1123 0.46 0.83 0.37 198 TR_LOTS_OF_MONEY2 1123 0.46 0.83 0.37 199 HTML_TEXT_INVISIBLE_STYLE 1112 0.32 0.12 0.37 200 XM_SPF_Unknown 1108 0.37 0.39 0.36 ----------------------------------------------------------------------