Email: 391404 Autolearn: 0 AvgScore: 0.70 AvgScanTime: 1.58 sec Spam: 67076 Autolearn: 0 AvgScore: 12.89 AvgScanTime: 2.73 sec Ham: 324328 Autolearn: 0 AvgScore: -1.82 AvgScanTime: 1.34 sec Time Spent Running SA: 172.02 hours Time Spent Processing Spam: 50.95 hours Time Spent Processing Ham: 121.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 65698 98.71 97.95 98.87 2 HTML_MESSAGE 59819 80.98 89.18 79.29 3 DKIM_SIGNED 41926 71.41 62.51 73.25 4 RELAYCOUNTRY_US 41643 73.12 62.08 75.40 5 XM_DK_Pass 40532 70.31 60.43 72.35 6 XM_B_Unicode 38012 64.49 56.67 66.10 7 DKIM_VALID 35444 66.64 52.84 69.49 8 XMListUnsubscribeExists 35172 53.69 52.44 53.95 9 BAYES_50 27648 45.84 41.22 46.79 10 XM_DK_Undo_02 27638 18.27 41.20 13.53 11 DKIM_VALID_AU 24841 51.98 37.03 55.07 12 RELAYCOUNTRY_META 23178 10.05 34.55 4.98 13 BAYES_99 22978 13.69 34.26 9.44 14 MIME_HTML_ONLY 21634 23.46 32.25 21.64 15 BOTNET 20307 7.60 30.27 2.91 16 XM_B_Unicode3 18851 37.92 28.10 39.94 17 UNTRUSTED_Relay 18715 6.33 27.90 1.87 18 BAYES_999 18197 10.99 27.13 7.65 19 FVGT_m_MULTI_ODD 18045 22.41 26.90 21.48 20 DKIM_VALID_EF 17373 25.13 25.90 24.98 21 LOC_TINY_FONT_1 15679 26.11 23.37 26.67 22 RCVD_IN_MSPIKE_H2 14576 23.47 21.73 23.83 23 XMSubLong 13266 18.36 19.78 18.06 24 LOTS_OF_MONEY 13192 10.32 19.67 8.38 25 HTML_FONT_LOW_CONTRAST 12423 25.83 18.52 27.34 26 BOTNET_IPINHOSTNAME 11849 8.53 17.67 6.64 27 XM_Multi_Part_URI 11600 17.83 17.29 17.94 28 XM_UncommonTLD01 10742 5.69 16.01 3.55 29 XM_UB50 10360 3.61 15.45 1.17 30 T_KAM_HTML_FONT_INVALID 10330 16.39 15.40 16.59 31 T_TM2_M_HEADER_IN_MSG 10041 19.63 14.97 20.59 32 XM_Body_Dirty_Words 9148 13.61 13.64 13.61 33 HTML_MIME_NO_HTML_TAG 7454 3.41 11.11 1.82 34 BOTNET_NORDNS 7066 1.82 10.53 0.02 35 HELO_NODOT 7052 2.43 10.51 0.76 36 HELO_NO_DOMAIN 7051 2.43 10.51 0.76 37 XM_B_Unsub 7033 9.35 10.49 9.12 38 MISSING_HEADERS 6935 2.12 10.34 0.42 39 HTML_IMAGE_RATIO_02 6849 8.65 10.21 8.32 40 REPLYTO_WITHOUT_TO_CC 6840 1.82 10.20 0.09 41 RCVD_IN_MSPIKE_BL 6773 2.23 10.10 0.61 42 TR_LOTS_OF_MONEY1 6604 1.72 9.85 0.04 43 DKIM_INVALID 6482 4.77 9.66 3.76 44 RCVD_IN_BL_SPAMCOP_NET 6199 3.00 9.24 1.71 45 SUBJ_ALL_CAPS 6071 2.54 9.05 1.20 46 XMSexyCombo_05 6008 5.60 8.96 4.90 47 RELAYCOUNTRY_CA 5923 3.26 8.83 2.11 48 RCVD_IN_RP_RNBL 5908 1.58 8.81 0.08 49 LotsOfNums_01 5533 8.23 8.25 8.22 50 XMSubMetaSx_00 5521 5.16 8.23 4.52 51 FROM_EXCESS_BASE64 5478 4.55 8.17 3.80 52 T_REMOTE_IMAGE 5353 4.09 7.98 3.28 53 BODY_URI_ONLY 5274 1.39 7.86 0.05 54 XM_B_Phish_Phrases 5179 7.26 7.72 7.17 55 MONEY_ATM_CARD 4903 1.26 7.31 0.01 56 ADVANCE_FEE_4_NEW_MONEY 4862 1.25 7.25 0.01 57 RCVD_IN_MSPIKE_WL 4709 22.35 7.02 25.52 58 NO_DNS_FOR_FROM 4647 2.79 6.93 1.93 59 BAYES_60 4602 6.49 6.86 6.42 60 HDRS_MISSP 4534 1.19 6.76 0.04 61 BAYES_80 4471 4.82 6.67 4.44 62 RCVD_IN_MSPIKE_L3 4214 1.47 6.28 0.47 63 XMSubEmpty 4130 1.26 6.16 0.25 64 HTML_TAG_BALANCE_CENTER 4084 1.13 6.09 0.10 65 XM_OfRef6 3733 1.94 5.57 1.19 66 TooManyTo_001 3713 6.25 5.54 6.39 67 XM_Evil_Numbers_Gen 3700 8.33 5.52 8.91 68 SpammyFromTLD_02 3694 1.14 5.51 0.24 69 TR_XM_PhishingBody 3671 3.09 5.47 2.60 70 URIBL_SBL_A 3548 1.05 5.29 0.17 71 UNPARSEABLE_RELAY 3531 7.62 5.26 8.10 72 XM_SPF_SoftFail 3503 1.92 5.22 1.23 73 SpammyFromTLD_01 3468 1.40 5.17 0.62 74 XMStrtUSub 3378 5.17 5.04 5.20 75 XM_H_Long_From01 3357 5.21 5.00 5.26 76 XM_DK_Undo_01 3270 2.15 4.88 1.58 77 TR_Sbj_FN_Bdy 3099 0.98 4.62 0.22 78 BAYES_95 3025 3.12 4.51 2.83 79 XM_UB99 3014 0.78 4.49 0.01 80 KHOP_HELO_FCRDNS 2979 1.76 4.44 1.20 81 RCVD_IN_PSBL 2973 0.76 4.43 0.01 82 FROM_SUSPICIOUS_NTLD 2874 0.81 4.28 0.09 83 FROM_SUSPICIOUS_NTLD_FP 2861 0.80 4.27 0.09 84 SCRIPT_GIBBERISH 2856 0.73 4.26 0.01 85 XM_B_SpammyTLD 2853 2.71 4.25 2.39 86 RCVD_IN_MSPIKE_H3 2729 12.58 4.07 14.34 87 XMNoSubject 2700 0.79 4.03 0.13 88 MISSING_SUBJECT 2700 0.79 4.03 0.13 89 XM_B_Phish66 2524 1.63 3.76 1.19 90 XM_SendGrid 2488 6.65 3.71 7.26 91 XMLngstWrd_00 2472 1.11 3.69 0.58 92 RELAYCOUNTRY_FR 2369 0.82 3.53 0.26 93 PDS_OTHER_BAD_TLD 2352 1.36 3.51 0.91 94 TR_XM_COVIDMETA4 2329 0.96 3.47 0.45 95 TR_XM_MaxSPIKE 2310 0.62 3.44 0.04 96 XM_DIRTYINTL 2306 1.14 3.44 0.67 97 DKIM_ADSP_NXDOMAIN 2283 0.91 3.40 0.40 98 XM_UB999 2256 0.58 3.36 0.01 99 MPART_ALT_DIFF 2244 4.67 3.35 4.94 100 RELAYCOUNTRY_UG 2243 0.59 3.34 0.02 101 HTML_IMAGE_RATIO_04 2201 5.24 3.28 5.65 102 BAYES_40 2182 3.79 3.25 3.90 103 XMNumbers 2178 3.17 3.25 3.15 104 TR_XM_INV_DKIM 2177 0.72 3.25 0.19 105 XMSubNoVowel 2076 1.17 3.09 0.78 106 TR_XM_MaxBayes 1997 0.53 2.98 0.02 107 TR_XM_PHPDW 1989 0.98 2.97 0.57 108 URI_PHP_REDIR 1977 0.52 2.95 0.01 109 TR_XM_PHPForged 1957 0.95 2.92 0.55 110 XM_B_COVIDMETA 1948 1.45 2.90 1.15 111 TR_XM_FormFill2 1930 0.94 2.88 0.54 112 XM_H_PHPOS 1922 0.94 2.87 0.54 113 XM_JunkDunk 1907 0.49 2.84 0.00 114 XM_OfRef7 1885 0.65 2.81 0.21 115 RCVD_IN_MSPIKE_L5 1876 0.54 2.80 0.07 116 T_TooManySym_01 1868 4.41 2.78 4.74 117 RCVD_IN_MSPIKE_H4 1780 8.60 2.65 9.83 118 XMBody_17 1777 1.24 2.65 0.95 119 XMLngstWrd_01 1748 0.86 2.61 0.50 120 TM2_M_URI_OPT_OUT 1705 11.20 2.54 12.99 121 HTML_IMAGE_ONLY_16 1668 0.54 2.49 0.14 122 PDS_NAKED_TO_NUMERO 1620 0.41 2.42 0.00 123 HTML_IMAGE_RATIO_06 1575 3.22 2.35 3.40 124 XM_URI_RBL 1565 0.57 2.33 0.20 125 FILL_THIS_FORM 1540 0.55 2.30 0.19 126 TR_XM_RelayPhish 1507 0.51 2.25 0.15 127 BODY_SINGLE_WORD 1492 0.40 2.22 0.02 128 BODY_SINGLE_URI 1489 0.39 2.22 0.01 129 RELAYCOUNTRY_NL 1483 0.54 2.21 0.19 130 URI_TRY_3LD 1466 1.49 2.19 1.34 131 XMMoneyMeta_00 1461 0.57 2.18 0.23 132 HTML_FONT_TINY_NORDNS 1454 0.62 2.17 0.30 133 RELAYCOUNTRY_CN 1439 0.40 2.15 0.04 134 XM_UB60 1425 0.50 2.12 0.16 135 LongTLD 1423 0.51 2.12 0.17 136 DEAR_FRIEND 1417 0.47 2.11 0.14 137 XMSlimDrugH 1386 0.65 2.07 0.36 138 XMSubMetaSxObfu_02 1367 0.83 2.04 0.57 139 MIME_HTML_MOSTLY 1362 2.89 2.03 3.07 140 XM_UB80 1317 0.38 1.96 0.05 141 TM2_M_VERY_LONG_WORD 1290 1.36 1.92 1.24 142 DIET_1 1272 0.72 1.90 0.47 143 DKIM_ADSP_CUSTOM_MED 1259 1.04 1.88 0.86 144 URI_NO_WWW_INFO_CGI 1194 0.33 1.78 0.03 145 XM_CamelCaseFrm001 1188 2.10 1.77 2.17 146 NML_ADSP_CUSTOM_MED 1188 0.80 1.77 0.60 147 RELAYCOUNTRY_IT 1180 0.34 1.76 0.05 148 HTML_IMAGE_RATIO_08 1150 2.11 1.71 2.19 149 URI_HEX 1144 1.61 1.71 1.58 150 XMLngstWrd_02 1140 0.63 1.70 0.40 151 XMBrknScrpt_02 1136 1.15 1.69 1.03 152 T_XMDrugObfuBody_14 1134 1.27 1.69 1.18 153 XMSexyCombo_01 1120 1.42 1.67 1.37 154 XMWghtMeta_00 1098 0.31 1.64 0.04 155 TR_Mismatch_TLD_02 1097 0.35 1.64 0.09 156 XMHTML_After_End 1079 0.81 1.61 0.64 157 T_Symld_Words_02 1057 0.66 1.58 0.47 158 XM_B_Unsub2 1045 1.52 1.56 1.52 159 XMSubMetaI_00 1041 0.76 1.55 0.59 160 CTYPE_NULL 1040 0.27 1.55 0.00 161 BAYES_20 1035 3.33 1.54 3.70 162 T_XMDrugObfuBody_08 1027 1.44 1.53 1.42 163 MONEY_FORM_SHORT 1000 0.27 1.49 0.02 164 MIME_QP_LONG_LINE 984 3.68 1.47 4.13 165 FORGED_GMAIL_RCVD 978 0.59 1.46 0.42 166 T_XMDrugObfuBody_00 976 1.10 1.46 1.02 167 XM_UB95 968 0.27 1.44 0.02 168 XM_H_PHPMailer 955 0.82 1.42 0.69 169 XMSlimDrugs 953 0.27 1.42 0.03 170 T_TooManySym_02 943 2.45 1.41 2.67 171 RELAYCOUNTRY_DE 931 0.49 1.39 0.30 172 XM_XX_Yahoo 924 0.27 1.38 0.04 173 ALL_TRUSTED 921 17.41 1.37 20.73 174 TR_Mismatch_TLD_01 921 0.45 1.37 0.26 175 HTML_SHORT_LINK_IMG_2 912 0.25 1.36 0.02 176 MIME_HTML_ONLY_MULTI 901 2.72 1.34 3.00 177 TR_LOTS_OF_MONEY3 891 0.71 1.33 0.58 178 HK_RANDOM_REPLYTO 862 0.39 1.29 0.20 179 SUBJECT_DIET 855 0.23 1.27 0.01 180 TR_XM_COVIDMETA1 839 0.45 1.25 0.28 181 XMDiploma_00 837 1.17 1.25 1.15 182 FILL_THIS_FORM_LONG 829 0.28 1.24 0.08 183 XMSubMetaSx_01 799 0.26 1.19 0.07 184 SUBJECT_NEEDS_ENCODING 798 0.23 1.19 0.03 185 SUBJ_ILLEGAL_CHARS 797 0.23 1.19 0.03 186 XM_ProductURIs 787 1.11 1.17 1.10 187 XM_H_PHPOS_M 777 0.48 1.16 0.34 188 RELAYCOUNTRY_GB 764 0.73 1.14 0.65 189 HELO_MISC_IP 764 2.16 1.14 2.37 190 MIME_CHARSET_FARAWAY 749 0.25 1.12 0.07 191 DATE_IN_PAST_12_24 741 0.24 1.10 0.06 192 T_TooManySym_03 739 0.84 1.10 0.79 193 XM_BadFromFormat 734 0.30 1.09 0.14 194 T_FILL_THIS_FORM_SHORT 731 0.81 1.09 0.75 195 TVD_FW_GRAPHIC_NAME_LONG 729 0.19 1.09 0.00 196 URIBL_BLACK 728 0.20 1.09 0.02 197 MPART_ALT_DIFF_COUNT 724 0.52 1.08 0.41 198 RDNS_DYNAMIC 719 0.59 1.07 0.49 199 FROM_MISSP_REPLYTO 713 0.19 1.06 0.01 200 XMStockSpam_06 712 0.85 1.06 0.80 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 320662 98.71 97.95 98.87 2 HTML_MESSAGE 257157 80.98 89.18 79.29 3 RELAYCOUNTRY_US 244536 73.12 62.08 75.40 4 DKIM_SIGNED 237565 71.41 62.51 73.25 5 XM_DK_Pass 234657 70.31 60.43 72.35 6 DKIM_VALID 225371 66.64 52.84 69.49 7 XM_B_Unicode 214388 64.49 56.67 66.10 8 DKIM_VALID_AU 178607 51.98 37.03 55.07 9 XMListUnsubscribeExists 174968 53.69 52.44 53.95 10 BAYES_50 151757 45.84 41.22 46.79 11 XM_B_Unicode3 129551 37.92 28.10 39.94 12 HTML_FONT_LOW_CONTRAST 88672 25.83 18.52 27.34 13 LOC_TINY_FONT_1 86512 26.11 23.37 26.67 14 RCVD_IN_MSPIKE_WL 82774 22.35 7.02 25.52 15 DKIM_VALID_EF 81006 25.13 25.90 24.98 16 RCVD_IN_MSPIKE_H2 77276 23.47 21.73 23.83 17 MIME_HTML_ONLY 70191 23.46 32.25 21.64 18 FVGT_m_MULTI_ODD 69656 22.41 26.90 21.48 19 ALL_TRUSTED 67236 17.41 1.37 20.73 20 T_TM2_M_HEADER_IN_MSG 66781 19.63 14.97 20.59 21 BAYES_00 61946 15.94 0.68 19.10 22 XMSubLong 58589 18.36 19.78 18.06 23 XM_Multi_Part_URI 58174 17.83 17.29 17.94 24 T_KAM_HTML_FONT_INVALID 53809 16.39 15.40 16.59 25 RCVD_IN_MSPIKE_H3 46515 12.58 4.07 14.34 26 XM_Body_Dirty_Words 44126 13.61 13.64 13.61 27 XM_DK_Undo_02 43866 18.27 41.20 13.53 28 TM2_M_URI_OPT_OUT 42131 11.20 2.54 12.99 29 ANY_BOUNCE_MESSAGE 39567 10.19 0.45 12.20 30 BOUNCE_MESSAGE 39566 10.19 0.45 12.20 31 RCVD_IN_RP_SAFE 34643 8.96 0.65 10.68 32 RCVD_IN_RP_CERTIFIED 32416 8.33 0.27 9.99 33 RCVD_IN_MSPIKE_H4 31889 8.60 2.65 9.83 34 BAYES_99 30618 13.69 34.26 9.44 35 XM_B_Unsub 29563 9.35 10.49 9.12 36 XM_Evil_Numbers_Gen 28902 8.33 5.52 8.91 37 TR_XM_DK_Bayes 28047 7.21 0.24 8.65 38 XM_DKIMWhitelistDomains 27259 6.97 0.01 8.40 39 LOTS_OF_MONEY 27187 10.32 19.67 8.38 40 HTML_IMAGE_RATIO_02 26990 8.65 10.21 8.32 41 TR_XM_DK_Bayes1 26720 6.85 0.16 8.24 42 LotsOfNums_01 26665 8.23 8.25 8.22 43 UNPARSEABLE_RELAY 26281 7.62 5.26 8.10 44 BAYES_999 24813 10.99 27.13 7.65 45 TR_XM_DK_Bayes2 24205 6.21 0.14 7.46 46 XM_SendGrid 23532 6.65 3.71 7.26 47 XM_B_Phish_Phrases 23240 7.26 7.72 7.17 48 BOTNET_IPINHOSTNAME 21522 8.53 17.67 6.64 49 BAYES_60 20814 6.49 6.86 6.42 50 TooManyTo_001 20731 6.25 5.54 6.39 51 HTML_IMAGE_RATIO_04 18322 5.24 3.28 5.65 52 XM_H_Long_From01 17046 5.21 5.00 5.26 53 XMStrtUSub 16870 5.17 5.04 5.20 54 RELAYCOUNTRY_META 16164 10.05 34.55 4.98 55 MPART_ALT_DIFF 16031 4.67 3.35 4.94 56 XMSexyCombo_05 15893 5.60 8.96 4.90 57 T_TooManySym_01 15386 4.41 2.78 4.74 58 XMSubMetaSx_00 14660 5.16 8.23 4.52 59 BAYES_80 14386 4.82 6.67 4.44 60 TR_XM_DK_SendGrid 14158 3.76 0.84 4.37 61 IN_ZIMBRA_NJ_WHITELIST 13755 3.52 0.03 4.24 62 MIME_QP_LONG_LINE 13408 3.68 1.47 4.13 63 BAYES_40 12645 3.79 3.25 3.90 64 FROM_EXCESS_BASE64 12337 4.55 8.17 3.80 65 DKIM_INVALID 12194 4.77 9.66 3.76 66 BAYES_20 12000 3.33 1.54 3.70 67 RCVD_IN_IADB_LISTED 11851 3.12 0.56 3.65 68 XM_UncommonTLD01 11522 5.69 16.01 3.55 69 HTML_IMAGE_RATIO_06 11017 3.22 2.35 3.40 70 BAYES_05 10986 2.98 0.98 3.39 71 T_REMOTE_IMAGE 10636 4.09 7.98 3.28 72 RCVD_IN_IADB_SPF 10295 2.71 0.48 3.17 73 XMNumbers 10222 3.17 3.25 3.15 74 MIME_HTML_MOSTLY 9955 2.89 2.03 3.07 75 MIME_HTML_ONLY_MULTI 9733 2.72 1.34 3.00 76 BOTNET 9432 7.60 30.27 2.91 77 RCVD_IN_IADB_SENDERID 9198 2.43 0.47 2.84 78 BAYES_95 9170 3.12 4.51 2.83 79 RCVD_IN_IADB_DK 8979 2.37 0.46 2.77 80 TVD_RCVD_IP 8889 2.42 0.88 2.74 81 T_TooManySym_02 8657 2.45 1.41 2.67 82 TR_XM_PhishingBody 8422 3.09 5.47 2.60 83 XM_B_SpammyTLD 7745 2.71 4.25 2.39 84 HELO_MISC_IP 7692 2.16 1.14 2.37 85 CK_HELO_DYNAMIC_SPLIT_IP 7688 2.10 0.78 2.37 86 INVALID_MSGID 7277 1.91 0.28 2.24 87 RCVD_IN_IADB_VOUCHED 7162 1.86 0.18 2.21 88 HTML_IMAGE_RATIO_08 7107 2.11 1.71 2.19 89 XM_CamelCaseFrm001 7048 2.10 1.77 2.17 90 RELAYCOUNTRY_CA 6838 3.26 8.83 2.11 91 TO_MALFORMED 6486 1.69 0.17 2.00 92 NO_DNS_FOR_FROM 6269 2.79 6.93 1.93 93 UNTRUSTED_Relay 6079 6.33 27.90 1.87 94 XM_H_Trusted_IP 5969 1.53 0.00 1.84 95 HTML_MIME_NO_HTML_TAG 5894 3.41 11.11 1.82 96 MAILING_LIST_MULTI 5692 1.63 1.01 1.76 97 RCVD_IN_BL_SPAMCOP_NET 5553 3.00 9.24 1.71 98 XM_PDF 5544 1.47 0.30 1.71 99 XM_DK_Undo_01 5139 2.15 4.88 1.58 100 URI_HEX 5139 1.61 1.71 1.58 101 XMBdyGiftCard01 5005 1.43 0.89 1.54 102 IN_HORDE_ADDRESS_BOOK 4925 1.27 0.05 1.52 103 XM_B_Unsub2 4920 1.52 1.56 1.52 104 T_XMDrugObfuBody_08 4611 1.44 1.53 1.42 105 USER_IN_DEF_DKIM_WL 4513 1.15 0.00 1.39 106 RCVD_IN_IADB_OPTIN 4490 1.19 0.22 1.38 107 XMSexyCombo_01 4449 1.42 1.67 1.37 108 RCVD_IN_MSPIKE_H5 4370 1.17 0.30 1.35 109 URI_TRY_3LD 4353 1.49 2.19 1.34 110 TR_Symld_Words 4340 1.28 0.98 1.34 111 TM2_M_VERY_LONG_WORD 4036 1.36 1.92 1.24 112 XM_SPF_SoftFail 3996 1.92 5.22 1.23 113 XM_GoogleGroups 3986 1.09 0.43 1.23 114 KHOP_HELO_FCRDNS 3905 1.76 4.44 1.20 115 TooManyTo_002 3887 1.07 0.42 1.20 116 SUBJ_ALL_CAPS 3878 2.54 9.05 1.20 117 XM_OfRef6 3869 1.94 5.57 1.19 118 XM_B_Phish66 3847 1.63 3.76 1.19 119 T_XMDrugObfuBody_14 3838 1.27 1.69 1.18 120 XM_UB50 3780 3.61 15.45 1.17 121 XMDiploma_00 3732 1.17 1.25 1.15 122 XM_B_COVIDMETA 3714 1.45 2.90 1.15 123 XM_ProductURIs 3556 1.11 1.17 1.10 124 XMBrknScrpt_02 3351 1.15 1.69 1.03 125 T_XMDrugObfuBody_00 3313 1.10 1.46 1.02 126 XM_H_Long_From02 3227 0.92 0.58 0.99 127 XMGappySubj_01 3113 0.81 0.07 0.96 128 XMBody_17 3067 1.24 2.65 0.95 129 HTML_FONT_FACE_BAD 3037 0.85 0.45 0.94 130 PDS_OTHER_BAD_TLD 2962 1.36 3.51 0.91 131 TR_MetaPhish_Combo_01 2858 0.86 0.74 0.88 132 TR_MSPIKEBAYES00 2825 0.72 0.00 0.87 133 DKIM_ADSP_CUSTOM_MED 2794 1.04 1.88 0.86 134 TooManyTo_003 2723 0.74 0.28 0.84 135 XMStockSpam_06 2607 0.85 1.06 0.80 136 T_TooManySym_03 2551 0.84 1.10 0.79 137 XMSubNoVowel 2519 1.17 3.09 0.78 138 HELO_NODOT 2458 2.43 10.51 0.76 139 HELO_NO_DOMAIN 2457 2.43 10.51 0.76 140 T_FILL_THIS_FORM_SHORT 2425 0.81 1.09 0.75 141 XMBody_95 2281 0.60 0.10 0.70 142 TooManyTo_004 2258 0.62 0.24 0.70 143 XM_H_PHPMailer 2251 0.82 1.42 0.69 144 HTML_TAG_BALANCE_BODY 2248 0.70 0.75 0.69 145 XMGenDplmaNmb 2198 0.68 0.70 0.68 146 XM_DIRTYINTL 2163 1.14 3.44 0.67 147 RELAYCOUNTRY_GB 2111 0.73 1.14 0.65 148 XMHTML_After_End 2078 0.81 1.61 0.64 149 XM_B_REG_HTML 2056 0.56 0.21 0.63 150 SpammyFromTLD_01 2003 1.40 5.17 0.62 151 TooManyTo_005 1998 0.55 0.21 0.62 152 RCVD_IN_MSPIKE_BL 1970 2.23 10.10 0.61 153 NML_ADSP_CUSTOM_MED 1960 0.80 1.77 0.60 154 HTTPS_HTTP_MISMATCH 1943 0.62 0.69 0.60 155 XMSubMetaI_00 1928 0.76 1.55 0.59 156 XMLngstWrd_00 1891 1.11 3.69 0.58 157 TR_LOTS_OF_MONEY3 1885 0.71 1.33 0.58 158 TR_XM_PHPDW 1864 0.98 2.97 0.57 159 XMSubMetaSxObfu_02 1863 0.83 2.04 0.57 160 XMPhish30 1849 0.59 0.68 0.57 161 TR_BOTNET_NEGATE 1823 0.51 0.23 0.56 162 USER_IN_WHITELIST 1820 0.46 0.00 0.56 163 XMHTMLBadTable_001 1800 0.52 0.37 0.55 164 TR_XM_PHPForged 1775 0.95 2.92 0.55 165 TR_XM_FormFill2 1758 0.94 2.88 0.54 166 XM_H_PHPOS 1741 0.94 2.87 0.54 167 XMPhish08 1684 0.52 0.51 0.52 168 T_XMHurry_00 1651 0.59 0.97 0.51 169 XMSexyCombo_04 1641 0.50 0.48 0.51 170 XMLngstWrd_01 1610 0.86 2.61 0.50 171 RDNS_DYNAMIC 1579 0.59 1.07 0.49 172 XMNoVowels 1575 0.54 0.81 0.49 173 XMSubMetaSxObfu_03 1556 0.57 0.98 0.48 174 TM2_M_A_HREF_HREF 1547 0.47 0.41 0.48 175 T_Symld_Words_02 1539 0.66 1.58 0.47 176 DIET_1 1538 0.72 1.90 0.47 177 RCVD_IN_MSPIKE_L3 1522 1.47 6.28 0.47 178 NUMERIC_HTTP_ADDR 1491 0.44 0.37 0.46 179 TR_XM_COVIDMETA4 1445 0.96 3.47 0.45 180 XMBody_78 1441 0.50 0.80 0.44 181 XM_B_COPY_HTML 1410 0.42 0.36 0.43 182 SUBJ_DOLLARS 1401 0.50 0.81 0.43 183 MISSING_HEADERS 1351 2.12 10.34 0.42 184 FORGED_GMAIL_RCVD 1349 0.59 1.46 0.42 185 HTML_IMAGE_ONLY_20 1346 0.42 0.46 0.42 186 URI_NOVOWEL 1338 0.43 0.53 0.41 187 XM_D_tchamptons_WL 1324 0.34 0.00 0.41 188 URI_OPTOUT_3LD 1319 0.35 0.08 0.41 189 MPART_ALT_DIFF_COUNT 1315 0.52 1.08 0.41 190 XMLngstWrd_02 1309 0.63 1.70 0.40 191 XMCapTrack 1308 0.38 0.24 0.40 192 DKIM_ADSP_NXDOMAIN 1289 0.91 3.40 0.40 193 XMSubMetaSSx_00 1256 0.40 0.46 0.39 194 XM_RXBody 1199 0.36 0.33 0.37 195 PLING_QUERY 1159 0.39 0.55 0.36 196 XMSlimDrugH 1154 0.65 2.07 0.36 197 HTML_TEXT_INVISIBLE_STYLE 1138 0.34 0.27 0.35 198 XMBSHREFv2 1130 0.32 0.20 0.35 199 XM_ShortIntro_01 1111 0.43 0.88 0.34 200 XM_H_PHPOS_M 1102 0.48 1.16 0.34 ----------------------------------------------------------------------