Email: 360908 Autolearn: 0 AvgScore: 0.58 AvgScanTime: 1.86 sec Spam: 65842 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 3.07 sec Ham: 295066 Autolearn: 0 AvgScore: -2.09 AvgScanTime: 1.58 sec Time Spent Running SA: 185.97 hours Time Spent Processing Spam: 56.23 hours Time Spent Processing Ham: 129.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 64476 98.64 97.93 98.80 2 HTML_MESSAGE 60751 88.05 92.27 87.11 3 DKIM_SIGNED 51304 80.08 77.92 80.57 4 XM_DK_Pass 49734 78.68 75.54 79.38 5 RELAYCOUNTRY_US 44796 80.21 68.04 82.93 6 XMListUnsubscribeExists 44440 60.05 67.49 58.38 7 XM_B_Unicode 43595 72.69 66.21 74.13 8 DKIM_VALID 43010 73.68 65.32 75.54 9 XM_DK_Undo_02 38380 21.67 58.29 13.50 10 DKIM_VALID_AU 33348 59.70 50.65 61.72 11 BAYES_99 32557 16.81 49.45 9.53 12 MIME_HTML_ONLY 29742 28.20 45.17 24.42 13 BAYES_999 27461 13.91 41.71 7.71 14 RELAYCOUNTRY_META 25867 11.76 39.29 5.62 15 DKIM_VALID_EF 23994 29.70 36.44 28.19 16 XM_UncommonTLD01 19524 9.17 29.65 4.60 17 XM_B_Unicode3 19407 42.11 29.48 44.93 18 BAYES_50 19378 46.99 29.43 50.91 19 BOTNET 18694 7.67 28.39 3.04 20 LOC_TINY_FONT_1 18189 31.95 27.63 32.92 21 T_KAM_HTML_FONT_INVALID 17755 19.98 26.97 18.42 22 RCVD_IN_MSPIKE_H2 17006 23.67 25.83 23.19 23 UNTRUSTED_Relay 15272 5.96 23.19 2.11 24 HTML_FONT_LOW_CONTRAST 14560 30.47 22.11 32.34 25 T_TM2_M_HEADER_IN_MSG 14180 21.02 21.54 20.90 26 XMSubLong 13712 21.90 20.83 22.14 27 FVGT_m_MULTI_ODD 12668 21.74 19.24 22.30 28 RCVD_IN_MSPIKE_BL 10994 3.62 16.70 0.70 29 XM_CamelCaseFrm001 10888 5.25 16.54 2.73 30 URIBL_SBL_A 9966 3.23 15.14 0.57 31 XM_Body_Dirty_Words 9919 15.88 15.06 16.07 32 HTML_IMAGE_RATIO_02 9663 11.69 14.68 11.02 33 TR_XM_MaxBayes 9617 2.91 14.61 0.30 34 XM_Multi_Part_URI 9111 14.71 13.84 14.90 35 BOTNET_IPINHOSTNAME 9033 8.01 13.72 6.74 36 RCVD_IN_BL_SPAMCOP_NET 8458 3.53 12.85 1.45 37 DKIM_INVALID 8294 6.41 12.60 5.02 38 LOTS_OF_MONEY 7405 9.36 11.25 8.94 39 RCVD_IN_MSPIKE_L3 6470 2.24 9.83 0.55 40 RELAYCOUNTRY_CA 6430 3.60 9.77 2.23 41 RCVD_IN_RP_RNBL 6310 1.88 9.58 0.16 42 NO_DNS_FOR_FROM 6215 3.97 9.44 2.75 43 XM_UB99 5797 1.61 8.80 0.00 44 XM_B_Unsub 5714 10.39 8.68 10.77 45 XMSexyCombo_05 5549 6.13 8.43 5.62 46 T_REMOTE_IMAGE 5490 4.04 8.34 3.08 47 XMHTML_After_End 5149 2.41 7.82 1.21 48 XMBody_17 5064 2.30 7.69 1.10 49 XM_B_Phish_Phrases 4797 8.31 7.29 8.53 50 XM_UB999 4747 1.32 7.21 0.00 51 BODY_URI_ONLY 4716 1.36 7.16 0.07 52 BOTNET_NORDNS 4655 1.31 7.07 0.02 53 XM_Evil_Numbers_Gen 4358 9.85 6.62 10.57 54 XM_UB50 4320 2.28 6.56 1.33 55 BAYES_60 4307 6.62 6.54 6.64 56 XMSubMetaSx_00 4257 4.76 6.47 4.38 57 TR_XM_MaxSPIKE 4241 1.20 6.44 0.03 58 T_XMDrugObfuBody_08 4233 2.34 6.43 1.43 59 RELAYCOUNTRY_DE 4193 1.51 6.37 0.43 60 BAYES_80 4180 5.03 6.35 4.74 61 LotsOfNums_01 4165 8.02 6.33 8.40 62 RCVD_IN_PSBL 3925 1.22 5.96 0.17 63 RCVD_IN_MSPIKE_WL 3919 21.21 5.95 24.62 64 RELAYCOUNTRY_FR 3866 1.37 5.87 0.36 65 XM_H_Long_From01 3431 5.30 5.21 5.32 66 MIME_HTML_MOSTLY 3198 3.74 4.86 3.49 67 MPART_ALT_DIFF 3071 6.05 4.66 6.36 68 SpammyFromTLD_01 3051 1.37 4.63 0.64 69 XM_SPF_SoftFail 3013 1.69 4.58 1.04 70 HTML_IMAGE_RATIO_04 2992 6.07 4.54 6.41 71 TR_XM_PhishingBody 2924 3.47 4.44 3.25 72 TooManyTo_001 2822 6.49 4.29 6.99 73 XMNumbers 2797 3.82 4.25 3.72 74 RCVD_IN_MSPIKE_L5 2791 0.86 4.24 0.11 75 TR_XM_INV_DKIM 2787 0.96 4.23 0.23 76 XM_JunkDunk 2774 0.77 4.21 0.00 77 TR_XM_COVIDMETA4 2728 1.28 4.14 0.64 78 XM_DIRTYINTL 2725 1.18 4.14 0.52 79 SpammyFromTLD_02 2687 0.96 4.08 0.26 80 XMStrtUSub 2682 5.22 4.07 5.48 81 XM_B_SpammyTLD 2477 2.43 3.76 2.13 82 XM_B_COVIDMETA 2473 1.88 3.76 1.46 83 BAYES_95 2467 3.23 3.75 3.11 84 KHOP_HELO_FCRDNS 2451 1.62 3.72 1.16 85 TR_Mismatch_TLD_02 2296 0.73 3.49 0.11 86 TR_Mismatch_TLD_01 2191 0.84 3.33 0.28 87 T_XMHurry_00 2132 1.09 3.24 0.62 88 RCVD_IN_MSPIKE_H3 2106 12.30 3.20 14.33 89 DATE_IN_PAST_06_12 2078 0.66 3.16 0.11 90 UNPARSEABLE_RELAY 2046 7.58 3.11 8.58 91 FROM_SUSPICIOUS_NTLD 2036 0.63 3.09 0.08 92 XMBdyGiftCard01 1998 1.90 3.03 1.65 93 FROM_SUSPICIOUS_NTLD_FP 1991 0.62 3.02 0.08 94 XM_OfRef6 1981 1.58 3.01 1.26 95 T_TooManySym_01 1922 5.12 2.92 5.61 96 PDS_OTHER_BAD_TLD 1859 1.12 2.82 0.74 97 FROM_EXCESS_BASE64 1845 4.12 2.80 4.42 98 SUBJ_ALL_CAPS 1844 1.46 2.80 1.16 99 RCVD_IN_MSPIKE_H4 1794 8.08 2.72 9.27 100 TR_XM_PHPDW 1787 0.87 2.71 0.46 101 XM_UB60 1786 0.59 2.71 0.11 102 TR_XM_PHPForged 1760 0.85 2.67 0.44 103 XMBrknScrpt_02 1748 1.63 2.65 1.41 104 TR_XM_FormFill2 1742 0.84 2.65 0.44 105 XM_H_PHPOS 1736 0.84 2.64 0.44 106 TR_LOTS_OF_MONEY3 1725 0.86 2.62 0.46 107 XM_URI_RBL 1719 0.64 2.61 0.20 108 DATE_IN_PAST_03_06 1662 0.56 2.52 0.13 109 XM_B_Phish66 1642 1.60 2.49 1.40 110 LongTLD 1635 0.58 2.48 0.16 111 XM_UB80 1626 0.49 2.47 0.04 112 RELAYCOUNTRY_NL 1509 0.63 2.29 0.27 113 RELAYCOUNTRY_GB 1495 1.10 2.27 0.83 114 RCVD_IN_MSPIKE_L4 1481 0.44 2.25 0.04 115 HTML_IMAGE_RATIO_08 1470 2.69 2.23 2.79 116 HTML_IMAGE_RATIO_06 1418 3.19 2.15 3.42 117 XM_SendGrid 1383 6.45 2.10 7.42 118 TM2_M_URI_OPT_OUT 1325 4.01 2.01 4.46 119 T_XMDrugObfuBody_14 1253 1.65 1.90 1.60 120 DKIM_ADSP_NXDOMAIN 1184 0.62 1.80 0.36 121 TR_XM_RelayPhish 1184 0.43 1.80 0.13 122 MIME_QP_LONG_LINE 1130 3.40 1.72 3.78 123 TM2_M_VERY_LONG_WORD 1128 1.63 1.71 1.61 124 DATE_IN_PAST_12_24 1119 0.51 1.70 0.25 125 XM_UB95 1105 0.32 1.68 0.01 126 XMSexyCombo_01 1094 0.89 1.66 0.71 127 TR_Caps_n_Bayes_99 1078 0.42 1.64 0.15 128 BAYES_40 1077 3.66 1.64 4.12 129 HTML_MIME_NO_HTML_TAG 1074 1.52 1.63 1.50 130 SCRIPT_GIBBERISH 1070 0.30 1.63 0.00 131 RELAYCOUNTRY_IN 1043 0.37 1.58 0.10 132 URI_WP_DIRINDEX 1021 0.30 1.55 0.02 133 URI_HEX 1018 1.53 1.55 1.53 134 URI_TRY_3LD 987 1.55 1.50 1.56 135 DKIM_ADSP_CUSTOM_MED 985 1.22 1.50 1.16 136 TR_Symld_Words 982 1.15 1.49 1.08 137 XMSubNoVowel 929 1.20 1.41 1.15 138 T_FILL_THIS_FORM_SHORT 928 1.03 1.41 0.94 139 XM_B_Unsub2 924 1.12 1.40 1.06 140 NML_ADSP_CUSTOM_MED 907 0.96 1.38 0.87 141 MISSING_HEADERS 899 0.81 1.37 0.68 142 BAYES_20 895 2.82 1.36 3.15 143 TR_XM_COVIDMETA1 894 0.49 1.36 0.30 144 XMStockSpam_06 865 1.49 1.31 1.53 145 URI_WP_HACKED_2 849 0.28 1.29 0.06 146 XM_H_PHPMailer 847 0.75 1.29 0.63 147 T_XMDrugObfuBody_00 844 0.79 1.28 0.68 148 XMSlimDrugH 834 0.57 1.27 0.41 149 T_TooManySym_02 831 2.51 1.26 2.79 150 RDNS_DYNAMIC 821 0.61 1.25 0.47 151 REPLYTO_WITHOUT_TO_CC 814 0.54 1.24 0.38 152 RELAYCOUNTRY_KR 788 0.26 1.20 0.05 153 ALL_TRUSTED 767 10.57 1.16 12.67 154 MIME_HTML_ONLY_MULTI 736 3.21 1.12 3.67 155 TR_XM_SB_Phish 727 0.34 1.10 0.17 156 XM_H_PHPOS_M 709 0.39 1.08 0.24 157 FORGED_GMAIL_RCVD 706 0.60 1.07 0.49 158 URIBL_BLACK 700 0.21 1.06 0.02 159 XMDiploma_00 669 1.48 1.02 1.58 160 XMReplyNow 655 0.25 0.99 0.09 161 XMSubEmpty 651 0.49 0.99 0.38 162 XM_ProductURIs 648 0.93 0.98 0.92 163 MAY_BE_FORGED 647 0.20 0.98 0.03 164 MPART_ALT_DIFF_COUNT 646 0.57 0.98 0.48 165 RELAYCOUNTRY_CN 642 0.22 0.98 0.06 166 RCVD_IN_RP_SAFE 635 10.34 0.96 12.43 167 T_Symld_Words_02 629 0.44 0.96 0.32 168 HK_RANDOM_REPLYTO 623 0.28 0.95 0.14 169 XM_DK_Undo_01 621 1.39 0.94 1.49 170 DIET_1 591 0.67 0.90 0.62 171 RELAYCOUNTRY_AT 586 0.33 0.89 0.20 172 XMMoneyMeta_00 583 0.45 0.89 0.36 173 MAILING_LIST_MULTI 581 1.73 0.88 1.92 174 XM_ShortIntro_01 575 0.50 0.87 0.42 175 URIBL_ABUSE_SURBL 570 0.19 0.87 0.04 176 XM_iOS_Forged_Message 565 0.18 0.86 0.02 177 INVESTMENT_ADVICE 565 0.24 0.86 0.10 178 URIBL_DBL_SPAM 560 0.17 0.85 0.02 179 XMSexyCombo_04 551 0.29 0.84 0.17 180 FROM_MISSP_REPLYTO 549 0.15 0.83 0.00 181 XM_OfRef7 544 0.30 0.83 0.18 182 DEAR_FRIEND 540 0.21 0.82 0.08 183 XM_XX_Yahoo 540 0.19 0.82 0.05 184 RELAYCOUNTRY_JP 538 0.19 0.82 0.05 185 T_HTML_TAG_BALANCE_CENTER 531 0.32 0.81 0.21 186 XMCapTrack 529 0.50 0.80 0.44 187 TR_LOTS_OF_MONEY1 529 0.37 0.80 0.28 188 XM_BadFromFormat 526 0.30 0.80 0.19 189 BAYES_00 509 12.89 0.77 15.59 190 XMPhish08 502 0.87 0.76 0.89 191 RCVD_IN_RP_CERTIFIED 501 9.64 0.76 11.62 192 RELAYCOUNTRY_ES 491 0.15 0.75 0.02 193 XM_PDF 487 1.55 0.74 1.74 194 DEAR_SOMETHING 476 0.44 0.72 0.38 195 BASE64_LENGTH_79_INF 474 0.45 0.72 0.39 196 BAYES_05 472 1.94 0.72 2.22 197 TR_XM_COVIDMETA3 458 0.15 0.70 0.03 198 XM_HighProb1 451 0.13 0.68 0.01 199 RCVD_IN_IADB_LISTED 451 2.84 0.68 3.32 200 LOW_PRICE 445 0.20 0.68 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 291537 98.64 97.93 98.80 2 HTML_MESSAGE 257035 88.05 92.27 87.11 3 RELAYCOUNTRY_US 244693 80.21 68.04 82.93 4 DKIM_SIGNED 237723 80.08 77.92 80.57 5 XM_DK_Pass 234236 78.68 75.54 79.38 6 DKIM_VALID 222899 73.68 65.32 75.54 7 XM_B_Unicode 218741 72.69 66.21 74.13 8 DKIM_VALID_AU 182118 59.70 50.65 61.72 9 XMListUnsubscribeExists 172273 60.05 67.49 58.38 10 BAYES_50 150211 46.99 29.43 50.91 11 XM_B_Unicode3 132560 42.11 29.48 44.93 12 LOC_TINY_FONT_1 97135 31.95 27.63 32.92 13 HTML_FONT_LOW_CONTRAST 95414 30.47 22.11 32.34 14 DKIM_VALID_EF 83185 29.70 36.44 28.19 15 RCVD_IN_MSPIKE_WL 72647 21.21 5.95 24.62 16 MIME_HTML_ONLY 72046 28.20 45.17 24.42 17 RCVD_IN_MSPIKE_H2 68434 23.67 25.83 23.19 18 FVGT_m_MULTI_ODD 65800 21.74 19.24 22.30 19 XMSubLong 65333 21.90 20.83 22.14 20 T_TM2_M_HEADER_IN_MSG 61675 21.02 21.54 20.90 21 T_KAM_HTML_FONT_INVALID 54340 19.98 26.97 18.42 22 XM_Body_Dirty_Words 47407 15.88 15.06 16.07 23 BAYES_00 45995 12.89 0.77 15.59 24 XM_Multi_Part_URI 43962 14.71 13.84 14.90 25 RCVD_IN_MSPIKE_H3 42272 12.30 3.20 14.33 26 XM_DK_Undo_02 39844 21.67 58.29 13.50 27 ALL_TRUSTED 37381 10.57 1.16 12.67 28 RCVD_IN_RP_SAFE 36676 10.34 0.96 12.43 29 RCVD_IN_RP_CERTIFIED 34278 9.64 0.76 11.62 30 HTML_IMAGE_RATIO_02 32523 11.69 14.68 11.02 31 TR_XM_DK_Bayes 32273 9.02 0.44 10.94 32 XM_B_Unsub 31781 10.39 8.68 10.77 33 XM_Evil_Numbers_Gen 31184 9.85 6.62 10.57 34 XM_DKIMWhitelistDomains 30578 8.47 0.00 10.36 35 TR_XM_DK_Bayes1 30332 8.45 0.25 10.28 36 TR_XM_DK_Bayes2 28344 7.89 0.21 9.61 37 BAYES_99 28121 16.81 49.45 9.53 38 RCVD_IN_MSPIKE_H4 27361 8.08 2.72 9.27 39 LOTS_OF_MONEY 26369 9.36 11.25 8.94 40 UNPARSEABLE_RELAY 25309 7.58 3.11 8.58 41 XM_B_Phish_Phrases 25183 8.31 7.29 8.53 42 LotsOfNums_01 24785 8.02 6.33 8.40 43 BAYES_999 22741 13.91 41.71 7.71 44 XM_SendGrid 21880 6.45 2.10 7.42 45 TooManyTo_001 20612 6.49 4.29 6.99 46 BOTNET_IPINHOSTNAME 19882 8.01 13.72 6.74 47 BAYES_60 19591 6.62 6.54 6.64 48 HTML_IMAGE_RATIO_04 18900 6.07 4.54 6.41 49 MPART_ALT_DIFF 18762 6.05 4.66 6.36 50 XMSexyCombo_05 16582 6.13 8.43 5.62 51 RELAYCOUNTRY_META 16572 11.76 39.29 5.62 52 T_TooManySym_01 16559 5.12 2.92 5.61 53 XMStrtUSub 16160 5.22 4.07 5.48 54 XM_H_Long_From01 15703 5.30 5.21 5.32 55 DKIM_INVALID 14824 6.41 12.60 5.02 56 BAYES_80 13988 5.03 6.35 4.74 57 XM_UncommonTLD01 13576 9.17 29.65 4.60 58 TM2_M_URI_OPT_OUT 13162 4.01 2.01 4.46 59 IN_ZIMBRA_NJ_WHITELIST 13105 3.64 0.03 4.44 60 FROM_EXCESS_BASE64 13029 4.12 2.80 4.42 61 XMSubMetaSx_00 12918 4.76 6.47 4.38 62 TR_XM_DK_SendGrid 12561 3.59 0.62 4.26 63 BAYES_40 12145 3.66 1.64 4.12 64 MIME_QP_LONG_LINE 11156 3.40 1.72 3.78 65 XMNumbers 10973 3.82 4.25 3.72 66 MIME_HTML_ONLY_MULTI 10839 3.21 1.12 3.67 67 MIME_HTML_MOSTLY 10305 3.74 4.86 3.49 68 HTML_IMAGE_RATIO_06 10097 3.19 2.15 3.42 69 RCVD_IN_IADB_LISTED 9810 2.84 0.68 3.32 70 TR_XM_PhishingBody 9601 3.47 4.44 3.25 71 ANY_BOUNCE_MESSAGE 9328 2.63 0.25 3.16 72 BOUNCE_MESSAGE 9324 2.63 0.25 3.16 73 BAYES_20 9295 2.82 1.36 3.15 74 BAYES_95 9182 3.23 3.75 3.11 75 T_REMOTE_IMAGE 9086 4.04 8.34 3.08 76 BOTNET 8982 7.67 28.39 3.04 77 RCVD_IN_IADB_SPF 8473 2.45 0.58 2.87 78 HTML_IMAGE_RATIO_08 8244 2.69 2.23 2.79 79 T_TooManySym_02 8236 2.51 1.26 2.79 80 NO_DNS_FOR_FROM 8115 3.97 9.44 2.75 81 XM_CamelCaseFrm001 8048 5.25 16.54 2.73 82 INVALID_MSGID 7984 2.25 0.19 2.71 83 TVD_RCVD_IP 7927 2.23 0.20 2.69 84 XM_H_Trusted_IP 7890 2.19 0.00 2.67 85 RCVD_IN_IADB_SENDERID 7606 2.21 0.55 2.58 86 RCVD_IN_IADB_DK 7418 2.16 0.56 2.51 87 HELO_MISC_IP 7153 2.02 0.22 2.42 88 CK_HELO_DYNAMIC_SPLIT_IP 7149 2.01 0.14 2.42 89 TO_MALFORMED 6831 1.93 0.23 2.32 90 RELAYCOUNTRY_CA 6566 3.60 9.77 2.23 91 BAYES_05 6536 1.94 0.72 2.22 92 XM_B_SpammyTLD 6294 2.43 3.76 2.13 93 UNTRUSTED_Relay 6232 5.96 23.19 2.11 94 RCVD_IN_IADB_VOUCHED 6201 1.76 0.22 2.10 95 MAILING_LIST_MULTI 5669 1.73 0.88 1.92 96 USER_IN_DEF_DKIM_WL 5127 1.42 0.00 1.74 97 XM_PDF 5125 1.55 0.74 1.74 98 XMBdyGiftCard01 4867 1.90 3.03 1.65 99 IN_HORDE_ADDRESS_BOOK 4833 1.34 0.03 1.64 100 TM2_M_VERY_LONG_WORD 4738 1.63 1.71 1.61 101 T_XMDrugObfuBody_14 4710 1.65 1.90 1.60 102 XMDiploma_00 4663 1.48 1.02 1.58 103 URI_TRY_3LD 4596 1.55 1.50 1.56 104 XMStockSpam_06 4525 1.49 1.31 1.53 105 URI_HEX 4519 1.53 1.55 1.53 106 HTML_MIME_NO_HTML_TAG 4424 1.52 1.63 1.50 107 HTML_FONT_FACE_BAD 4413 1.27 0.26 1.50 108 XM_DK_Undo_01 4399 1.39 0.94 1.49 109 XM_B_COVIDMETA 4309 1.88 3.76 1.46 110 RCVD_IN_BL_SPAMCOP_NET 4283 3.53 12.85 1.45 111 T_XMDrugObfuBody_08 4226 2.34 6.43 1.43 112 XMBrknScrpt_02 4150 1.63 2.65 1.41 113 XM_B_Phish66 4121 1.60 2.49 1.40 114 TooManyTo_002 3983 1.18 0.41 1.35 115 TR_MSPIKEBAYES00 3952 1.10 0.00 1.34 116 XM_UB50 3919 2.28 6.56 1.33 117 XM_GoogleGroups 3897 1.15 0.41 1.32 118 RCVD_IN_IADB_OPTIN 3879 1.12 0.25 1.31 119 XM_OfRef6 3718 1.58 3.01 1.26 120 XMHTML_After_End 3561 2.41 7.82 1.21 121 SUBJ_ALL_CAPS 3436 1.46 2.80 1.16 122 DKIM_ADSP_CUSTOM_MED 3424 1.22 1.50 1.16 123 KHOP_HELO_FCRDNS 3411 1.62 3.72 1.16 124 XMSubNoVowel 3394 1.20 1.41 1.15 125 XMBody_17 3242 2.30 7.69 1.10 126 XMGappySubj_01 3189 0.91 0.12 1.08 127 XMSubMetaI_00 3187 0.97 0.46 1.08 128 TR_Symld_Words 3178 1.15 1.49 1.08 129 XM_B_Unsub2 3124 1.12 1.40 1.06 130 XM_H_Long_From02 3119 0.95 0.50 1.06 131 XM_SPF_SoftFail 3078 1.69 4.58 1.04 132 RCVD_IN_MSPIKE_H5 3014 0.84 0.03 1.02 133 TooManyTo_003 2886 0.85 0.28 0.98 134 T_FILL_THIS_FORM_SHORT 2780 1.03 1.41 0.94 135 XM_ProductURIs 2720 0.93 0.98 0.92 136 XMPhish08 2635 0.87 0.76 0.89 137 NML_ADSP_CUSTOM_MED 2558 0.96 1.38 0.87 138 T_TooManySym_03 2558 0.82 0.63 0.87 139 XMGenDplmaNmb 2528 0.82 0.63 0.86 140 XM_B_REG_HTML 2524 0.75 0.29 0.86 141 RELAYCOUNTRY_GB 2459 1.10 2.27 0.83 142 XM_RXBody 2448 0.80 0.67 0.83 143 TooManyTo_004 2438 0.72 0.25 0.83 144 TR_MetaPhish_Combo_01 2434 0.79 0.64 0.82 145 PDS_OTHER_BAD_TLD 2184 1.12 2.82 0.74 146 TooManyTo_005 2132 0.63 0.21 0.72 147 XMSexyCombo_01 2105 0.89 1.66 0.71 148 RCVD_IN_MSPIKE_BL 2071 3.62 16.70 0.70 149 THIS_AD 2044 0.62 0.28 0.69 150 MISSING_HEADERS 2010 0.81 1.37 0.68 151 T_XMDrugObfuBody_00 1993 0.79 1.28 0.68 152 XMSubMetaSxObfu_02 1981 0.64 0.51 0.67 153 T_MANY_PILL_PRICE 1936 0.54 0.00 0.66 154 HELO_NODOT 1927 0.65 0.66 0.65 155 HELO_NO_DOMAIN 1922 0.65 0.65 0.65 156 TR_XM_COVIDMETA4 1893 1.28 4.14 0.64 157 HTML_TAG_BALANCE_BODY 1890 0.61 0.45 0.64 158 SpammyFromTLD_01 1884 1.37 4.63 0.64 159 XM_H_PHPMailer 1856 0.75 1.29 0.63 160 T_XMHurry_00 1818 1.09 3.24 0.62 161 DIET_1 1816 0.67 0.90 0.62 162 USER_IN_WHITELIST 1766 0.49 0.00 0.60 163 XMBody_95 1759 0.50 0.06 0.60 164 SUBJ_DOLLARS 1754 0.55 0.36 0.59 165 XM_B_COPY_HTML 1704 0.55 0.44 0.58 166 URIBL_SBL_A 1681 3.23 15.14 0.57 167 XMPhish30 1653 0.57 0.63 0.56 168 XMLngstWrd_00 1633 0.55 0.55 0.55 169 RCVD_IN_MSPIKE_L3 1614 2.24 9.83 0.55 170 HTTPS_HTTP_MISMATCH 1544 0.51 0.45 0.52 171 XM_DIRTYINTL 1537 1.18 4.14 0.52 172 XMLngstWrd_01 1515 0.51 0.51 0.51 173 FORGED_GMAIL_RCVD 1455 0.60 1.07 0.49 174 HTML_IMAGE_ONLY_20 1446 0.49 0.48 0.49 175 XMBody_78 1414 0.49 0.55 0.48 176 MPART_ALT_DIFF_COUNT 1406 0.57 0.98 0.48 177 URI_NOVOWEL 1401 0.50 0.62 0.47 178 XMSubMetaSxObfu_03 1389 0.51 0.66 0.47 179 RDNS_DYNAMIC 1381 0.61 1.25 0.47 180 TR_LOTS_OF_MONEY3 1370 0.86 2.62 0.46 181 TR_XM_PHPDW 1363 0.87 2.71 0.46 182 XMHTMLBadTable_001 1320 0.43 0.37 0.45 183 TR_XM_PHPForged 1310 0.85 2.67 0.44 184 TR_XM_FormFill2 1296 0.84 2.65 0.44 185 XMCapTrack 1290 0.50 0.80 0.44 186 XM_H_PHPOS 1285 0.84 2.64 0.44 187 RELAYCOUNTRY_DE 1272 1.51 6.37 0.43 188 XMLngstWrd_02 1245 0.39 0.24 0.42 189 XM_ShortIntro_01 1226 0.50 0.87 0.42 190 XMSlimDrugH 1208 0.57 1.27 0.41 191 XMPhish14 1176 0.44 0.61 0.40 192 XMNoVowels 1166 0.42 0.53 0.40 193 BASE64_LENGTH_79_INF 1155 0.45 0.72 0.39 194 T_TooManySym_04 1149 0.41 0.49 0.39 195 TM2_M_A_HREF_HREF 1137 0.40 0.45 0.39 196 XMSubEmpty 1134 0.49 0.99 0.38 197 REPLYTO_WITHOUT_TO_CC 1133 0.54 1.24 0.38 198 DEAR_SOMETHING 1125 0.44 0.72 0.38 199 XM_Akamai 1120 0.31 0.01 0.38 200 TM2_M_BODY_EMPTY 1101 0.32 0.07 0.37 ----------------------------------------------------------------------