Email: 377180 Autolearn: 0 AvgScore: 0.70 AvgScanTime: 1.56 sec Spam: 58189 Autolearn: 0 AvgScore: 14.81 AvgScanTime: 2.59 sec Ham: 318991 Autolearn: 0 AvgScore: -1.87 AvgScanTime: 1.37 sec Time Spent Running SA: 163.25 hours Time Spent Processing Spam: 41.88 hours Time Spent Processing Ham: 121.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 57072 98.90 98.08 99.05 2 HTML_MESSAGE 53111 81.65 91.27 79.89 3 DKIM_SIGNED 37537 71.40 64.51 72.65 4 XM_B_Unicode 37260 66.22 64.03 66.62 5 RELAYCOUNTRY_US 37087 73.56 63.74 75.35 6 XM_DK_Pass 36578 70.19 62.86 71.53 7 XMListUnsubscribeExists 33984 54.09 58.40 53.30 8 DKIM_VALID 31559 66.45 54.24 68.67 9 XM_DK_Undo_02 27002 17.85 46.40 12.65 10 BAYES_99 25306 14.57 43.49 9.30 11 DKIM_VALID_AU 23723 53.65 40.77 56.00 12 BOTNET 22060 8.00 37.91 2.55 13 RELAYCOUNTRY_META 21131 9.87 36.31 5.04 14 MIME_HTML_ONLY 20836 24.39 35.81 22.31 15 BAYES_999 20578 11.85 35.36 7.56 16 XM_B_Unicode3 20278 39.39 34.85 40.21 17 BAYES_50 17204 44.48 29.57 47.19 18 XM_UncommonTLD01 16998 7.48 29.21 3.52 19 LOC_TINY_FONT_1 16228 28.85 27.89 29.03 20 UNTRUSTED_Relay 15569 5.64 26.76 1.79 21 FVGT_m_MULTI_ODD 14976 21.61 25.74 20.86 22 DKIM_VALID_EF 14471 24.70 24.87 24.67 23 XMSubLong 13695 21.39 23.54 21.00 24 HTML_FONT_LOW_CONTRAST 12322 28.23 21.18 29.52 25 RCVD_IN_MSPIKE_H2 10816 22.35 18.59 23.03 26 BOTNET_NORDNS 10522 2.80 18.08 0.02 27 XM_Multi_Part_URI 10079 17.96 17.32 18.07 28 FROM_EXCESS_BASE64 9998 6.36 17.18 4.38 29 BOTNET_IPINHOSTNAME 9909 7.92 17.03 6.26 30 T_KAM_HTML_FONT_INVALID 9584 16.45 16.47 16.44 31 SpammyFromTLD_02 9370 2.68 16.10 0.23 32 T_TM2_M_HEADER_IN_MSG 9108 19.88 15.65 20.65 33 BODY_URI_ONLY 8930 2.40 15.35 0.04 34 SCRIPT_GIBBERISH 8557 2.28 14.71 0.01 35 FROM_SUSPICIOUS_NTLD 8502 2.33 14.61 0.09 36 FROM_SUSPICIOUS_NTLD_FP 8453 2.31 14.53 0.08 37 XM_Body_Dirty_Words 8079 14.55 13.88 14.67 38 T_REMOTE_IMAGE 8071 4.42 13.87 2.69 39 HTML_MIME_NO_HTML_TAG 7888 3.56 13.56 1.74 40 HTML_IMAGE_RATIO_02 7231 9.99 12.43 9.54 41 HDRS_MISSP 7202 1.98 12.38 0.08 42 HTML_TAG_BALANCE_CENTER 6907 1.93 11.87 0.12 43 DKIM_ADSP_NXDOMAIN 6492 2.07 11.16 0.41 44 RCVD_IN_MSPIKE_BL 6000 2.14 10.31 0.65 45 DKIM_INVALID 5978 4.95 10.27 3.98 46 RCVD_IN_BL_SPAMCOP_NET 5574 2.48 9.58 1.19 47 XM_B_Unsub 5290 9.28 9.09 9.31 48 RCVD_IN_MSPIKE_WL 5050 23.30 8.68 25.97 49 BAYES_80 4990 5.08 8.58 4.44 50 XM_B_Phish_Phrases 4942 8.12 8.49 8.05 51 LOTS_OF_MONEY 4936 7.56 8.48 7.39 52 XM_SPF_SoftFail 4925 2.20 8.46 1.05 53 XM_UB50 4812 2.14 8.27 1.03 54 RELAYCOUNTRY_CA 4803 3.14 8.25 2.21 55 XMSexyCombo_05 4670 6.15 8.03 5.81 56 TooManyTo_001 4659 6.71 8.01 6.47 57 XM_UB99 4636 1.23 7.97 0.01 58 BAYES_60 4408 6.67 7.58 6.51 59 NO_DNS_FOR_FROM 4170 2.67 7.17 1.85 60 RCVD_IN_MSPIKE_L3 4123 1.50 7.09 0.48 61 XMSubMetaSx_00 4097 4.79 7.04 4.37 62 RCVD_IN_RP_RNBL 3970 1.12 6.82 0.08 63 XM_Evil_Numbers_Gen 3846 8.75 6.61 9.14 64 XM_JunkDunk 3810 1.01 6.55 0.00 65 SpammyFromTLD_01 3700 1.46 6.36 0.56 66 XMSubNoVowel 3582 1.83 6.16 1.04 67 XM_UB999 3517 0.94 6.04 0.00 68 HTML_IMAGE_RATIO_04 3477 5.91 5.98 5.90 69 LotsOfNums_01 3464 7.58 5.95 7.87 70 XM_B_SpammyTLD 3433 2.30 5.90 1.64 71 XM_H_Long_From01 3402 5.16 5.85 5.03 72 PDS_OTHER_BAD_TLD 3284 1.14 5.64 0.31 73 RELAYCOUNTRY_FR 3271 1.09 5.62 0.26 74 BAYES_95 3174 3.17 5.45 2.75 75 MPART_ALT_DIFF 3143 5.71 5.40 5.77 76 HTML_IMAGE_ONLY_16 3045 0.96 5.23 0.18 77 RCVD_IN_PSBL 2904 0.78 4.99 0.01 78 TR_XM_MaxSPIKE 2730 0.79 4.69 0.08 79 RCVD_IN_MSPIKE_H3 2694 13.41 4.63 15.01 80 RELAYCOUNTRY_DE 2679 0.99 4.60 0.34 81 XMSubEmpty 2634 0.82 4.53 0.14 82 URIBL_SBL_A 2472 0.85 4.25 0.23 83 XMNumbers 2398 3.19 4.12 3.01 84 RELAYCOUNTRY_IT 2373 0.66 4.08 0.03 85 RCVD_IN_MSPIKE_H4 2301 8.86 3.95 9.76 86 TR_XM_PhishingBody 2300 3.07 3.95 2.91 87 XM_DIRTYINTL 2287 1.03 3.93 0.51 88 KHOP_HELO_FCRDNS 2284 1.42 3.93 0.97 89 BODY_SINGLE_WORD 2262 0.61 3.89 0.01 90 BODY_SINGLE_URI 2260 0.61 3.88 0.01 91 HTML_SHORT_LINK_IMG_2 2251 0.63 3.87 0.04 92 UNPARSEABLE_RELAY 2249 6.87 3.86 7.42 93 TR_XM_MaxBayes 2227 0.60 3.83 0.01 94 CTYPE_NULL 2224 0.59 3.82 0.00 95 MIME_HTML_MOSTLY 2153 3.48 3.70 3.44 96 TR_XM_INV_DKIM 2143 0.70 3.68 0.16 97 XM_UB80 2002 0.57 3.44 0.04 98 URI_TRY_3LD 1993 1.65 3.43 1.32 99 LongTLD 1988 0.62 3.42 0.11 100 HTML_IMAGE_RATIO_08 1873 2.71 3.22 2.62 101 XM_UB60 1865 0.60 3.21 0.13 102 TR_XM_PHPDW 1740 0.93 2.99 0.55 103 DATE_IN_PAST_03_06 1724 0.60 2.96 0.17 104 TR_XM_PHPForged 1704 0.89 2.93 0.52 105 DATE_IN_PAST_06_12 1704 0.62 2.93 0.20 106 TR_XM_FormFill2 1680 0.89 2.89 0.52 107 XM_OfRef6 1679 1.89 2.89 1.71 108 URI_PHP_REDIR 1677 0.46 2.88 0.01 109 XM_H_PHPOS 1669 0.88 2.87 0.51 110 XM_SendGrid 1604 5.78 2.76 6.34 111 XMBody_17 1516 1.19 2.61 0.94 112 XM_CamelCaseFrm001 1487 2.36 2.56 2.33 113 XM_URI_RBL 1469 0.55 2.52 0.19 114 HTML_IMAGE_RATIO_06 1416 3.39 2.43 3.57 115 XMBrknScrpt_02 1410 1.36 2.42 1.17 116 TR_XM_COVIDMETA4 1401 0.74 2.41 0.43 117 RCVD_IN_MSPIKE_L5 1372 0.44 2.36 0.09 118 XMSexyCombo_01 1368 1.02 2.35 0.78 119 XM_UB95 1363 0.38 2.34 0.02 120 T_TooManySym_01 1345 4.31 2.31 4.67 121 XMStrtUSub 1323 4.63 2.27 5.06 122 MIME_CHARSET_FARAWAY 1269 0.44 2.18 0.13 123 XM_B_Phish66 1258 1.31 2.16 1.15 124 XM_BadFromFormat 1233 0.47 2.12 0.17 125 MIME_QP_LONG_LINE 1229 3.36 2.11 3.59 126 TM2_M_URI_OPT_OUT 1225 11.24 2.11 12.90 127 XM_B_COVIDMETA 1178 1.25 2.02 1.11 128 BAYES_40 1165 3.64 2.00 3.94 129 T_XMDrugObfuBody_08 1161 1.38 2.00 1.27 130 SUBJ_ALL_CAPS 1126 1.12 1.94 0.97 131 MPART_ALT_DIFF_COUNT 1121 0.63 1.93 0.40 132 TR_XM_RelayPhish 1106 0.40 1.90 0.12 133 TR_Mismatch_TLD_02 1103 0.38 1.90 0.11 134 XM_XX_Yahoo 1085 0.31 1.86 0.03 135 TR_Mismatch_TLD_01 1052 0.50 1.81 0.26 136 RDNS_DYNAMIC 1045 0.65 1.80 0.44 137 DKIM_ADSP_CUSTOM_MED 1041 1.15 1.79 1.03 138 XM_ProductURIs 1029 1.30 1.77 1.21 139 RELAYCOUNTRY_NL 1009 0.50 1.73 0.27 140 MISSING_HEADERS 967 0.47 1.66 0.26 141 BAYES_20 960 3.33 1.65 3.64 142 HELO_MISC_IP 955 2.28 1.64 2.39 143 NML_ADSP_CUSTOM_MED 944 0.86 1.62 0.72 144 T_XMHurry_00 937 0.71 1.61 0.55 145 FORGED_GMAIL_RCVD 927 0.65 1.59 0.48 146 HK_RANDOM_REPLYTO 922 0.39 1.58 0.17 147 URI_NO_WWW_INFO_CGI 915 0.26 1.57 0.02 148 NO_FM_NAME_IP_HOSTN 909 0.24 1.56 0.00 149 CHARSET_FARAWAY_HEADER 906 0.27 1.56 0.03 150 XMBody_78 903 0.65 1.55 0.48 151 RELAYCOUNTRY_IN 892 0.30 1.53 0.08 152 CK_HELO_DYNAMIC_SPLIT_IP 889 2.26 1.53 2.39 153 TM2_M_VERY_LONG_WORD 886 1.22 1.52 1.16 154 REPLYTO_WITHOUT_TO_CC 882 0.28 1.52 0.06 155 HTML_FONT_TINY_NORDNS 875 0.52 1.50 0.34 156 ALL_TRUSTED 870 17.81 1.50 20.79 157 XM_H_PHPMailer 868 0.79 1.49 0.67 158 FROM_MISSP_REPLYTO 853 0.23 1.47 0.01 159 XM_B_Unsub2 841 1.18 1.45 1.13 160 TVD_RCVD_IP 789 2.45 1.36 2.65 161 XM_OfRef7 787 0.47 1.35 0.31 162 XMSubMetaI_00 780 0.62 1.34 0.49 163 URIBL_BLACK 780 0.22 1.34 0.01 164 T_FILL_THIS_FORM_SHORT 779 0.60 1.34 0.47 165 XMReplyNow 773 0.30 1.33 0.12 166 DIET_1 771 0.57 1.32 0.43 167 XMSubMetaSxObfu_03 756 0.44 1.30 0.28 168 T_XMDrugObfuBody_14 756 1.43 1.30 1.45 169 RELAYCOUNTRY_CN 746 0.25 1.28 0.06 170 XMStockSpam_06 741 1.35 1.27 1.36 171 XMSexyCombo_04 735 0.48 1.26 0.33 172 MIME_HEADER_CTYPE_ONLY 726 0.55 1.25 0.43 173 XMDiploma_00 718 1.21 1.23 1.21 174 MAILING_LIST_MULTI 716 1.93 1.23 2.06 175 T_TooManySym_02 716 2.43 1.23 2.65 176 XM_H_PHPOS_M 712 0.49 1.22 0.35 177 HTML_TAG_BALANCE_BODY 702 0.60 1.21 0.49 178 FILL_THIS_FORM 681 0.43 1.17 0.29 179 T_Symld_Words_02 669 0.51 1.15 0.39 180 HTML_FONT_SIZE_HUGE 663 0.34 1.14 0.20 181 TR_LOTS_OF_MONEY3 646 0.52 1.11 0.42 182 BASE64_LENGTH_79_INF 643 0.44 1.11 0.31 183 RELAYCOUNTRY_GB 633 0.73 1.09 0.66 184 MIME_HTML_ONLY_MULTI 629 2.80 1.08 3.11 185 RCVD_IN_RP_SAFE 627 8.84 1.08 10.26 186 URI_HEX 614 1.12 1.06 1.14 187 TR_XM_COVIDMETA1 585 0.31 1.01 0.18 188 T_XMDrugObfuBody_00 583 0.64 1.00 0.58 189 XM_ShortIntro_01 581 0.46 1.00 0.36 190 TR_Symld_Words 575 1.17 0.99 1.21 191 RELAYCOUNTRY_BR 573 0.19 0.98 0.04 192 HTML_IMAGE_ONLY_20 553 0.54 0.95 0.46 193 RELAYCOUNTRY_AT 546 0.28 0.94 0.16 194 INVESTMENT_ADVICE 546 0.21 0.94 0.08 195 XMSubject_11 527 0.15 0.91 0.01 196 XMHTML_After_End 527 0.83 0.91 0.81 197 XMSlimDrugH 526 0.48 0.90 0.40 198 URIBL_DBL_SPAM 526 0.15 0.90 0.02 199 BAYES_05 521 2.96 0.90 3.34 200 XMPhish30 507 0.51 0.87 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 315969 98.90 98.08 99.05 2 HTML_MESSAGE 254840 81.65 91.27 79.89 3 RELAYCOUNTRY_US 240375 73.56 63.74 75.35 4 DKIM_SIGNED 231752 71.40 64.51 72.65 5 XM_DK_Pass 228166 70.19 62.86 71.53 6 DKIM_VALID 219059 66.45 54.24 68.67 7 XM_B_Unicode 212501 66.22 64.03 66.62 8 DKIM_VALID_AU 178635 53.65 40.77 56.00 9 XMListUnsubscribeExists 170014 54.09 58.40 53.30 10 BAYES_50 150547 44.48 29.57 47.19 11 XM_B_Unicode3 128282 39.39 34.85 40.21 12 HTML_FONT_LOW_CONTRAST 94159 28.23 21.18 29.52 13 LOC_TINY_FONT_1 92605 28.85 27.89 29.03 14 RCVD_IN_MSPIKE_WL 82828 23.30 8.68 25.97 15 DKIM_VALID_EF 78686 24.70 24.87 24.67 16 RCVD_IN_MSPIKE_H2 73467 22.35 18.59 23.03 17 MIME_HTML_ONLY 71162 24.39 35.81 22.31 18 XMSubLong 66995 21.39 23.54 21.00 19 FVGT_m_MULTI_ODD 66531 21.61 25.74 20.86 20 ALL_TRUSTED 66321 17.81 1.50 20.79 21 T_TM2_M_HEADER_IN_MSG 65863 19.88 15.65 20.65 22 BAYES_00 60248 16.10 0.79 18.89 23 XM_Multi_Part_URI 57653 17.96 17.32 18.07 24 T_KAM_HTML_FONT_INVALID 52456 16.45 16.47 16.44 25 RCVD_IN_MSPIKE_H3 47892 13.41 4.63 15.01 26 XM_Body_Dirty_Words 46790 14.55 13.88 14.67 27 TM2_M_URI_OPT_OUT 41155 11.24 2.11 12.90 28 XM_DK_Undo_02 40343 17.85 46.40 12.65 29 ANY_BOUNCE_MESSAGE 38417 10.23 0.26 12.04 30 BOUNCE_MESSAGE 38415 10.22 0.26 12.04 31 RCVD_IN_RP_SAFE 32718 8.84 1.08 10.26 32 XM_DKIMWhitelistDomains 31241 8.28 0.01 9.79 33 RCVD_IN_MSPIKE_H4 31126 8.86 3.95 9.76 34 RCVD_IN_RP_CERTIFIED 30722 8.22 0.46 9.63 35 HTML_IMAGE_RATIO_02 30443 9.99 12.43 9.54 36 XM_B_Unsub 29697 9.28 9.09 9.31 37 BAYES_99 29655 14.57 43.49 9.30 38 XM_Evil_Numbers_Gen 29168 8.75 6.61 9.14 39 XM_B_Phish_Phrases 25674 8.12 8.49 8.05 40 LotsOfNums_01 25110 7.58 5.95 7.87 41 TR_XM_DK_Bayes 24911 6.65 0.26 7.81 42 BAYES_999 24119 11.85 35.36 7.56 43 TR_XM_DK_Bayes1 23722 6.31 0.16 7.44 44 UNPARSEABLE_RELAY 23682 6.87 3.86 7.42 45 LOTS_OF_MONEY 23570 7.56 8.48 7.39 46 TR_XM_DK_Bayes2 21931 5.84 0.14 6.88 47 BAYES_60 20751 6.67 7.58 6.51 48 TooManyTo_001 20634 6.71 8.01 6.47 49 XM_SendGrid 20210 5.78 2.76 6.34 50 BOTNET_IPINHOSTNAME 19978 7.92 17.03 6.26 51 HTML_IMAGE_RATIO_04 18818 5.91 5.98 5.90 52 XMSexyCombo_05 18528 6.15 8.03 5.81 53 MPART_ALT_DIFF 18397 5.71 5.40 5.77 54 XMStrtUSub 16135 4.63 2.27 5.06 55 RELAYCOUNTRY_META 16091 9.87 36.31 5.04 56 XM_H_Long_From01 16059 5.16 5.85 5.03 57 T_TooManySym_01 14907 4.31 2.31 4.67 58 BAYES_80 14168 5.08 8.58 4.44 59 FROM_EXCESS_BASE64 13982 6.36 17.18 4.38 60 XMSubMetaSx_00 13955 4.79 7.04 4.37 61 IN_ZIMBRA_NJ_WHITELIST 12942 3.44 0.04 4.06 62 DKIM_INVALID 12693 4.95 10.27 3.98 63 BAYES_40 12583 3.64 2.00 3.94 64 BAYES_20 11602 3.33 1.65 3.64 65 TR_XM_DK_SendGrid 11437 3.16 0.85 3.59 66 MIME_QP_LONG_LINE 11437 3.36 2.11 3.59 67 HTML_IMAGE_RATIO_06 11389 3.39 2.43 3.57 68 XM_UncommonTLD01 11224 7.48 29.21 3.52 69 MIME_HTML_MOSTLY 10986 3.48 3.70 3.44 70 BAYES_05 10654 2.96 0.90 3.34 71 MIME_HTML_ONLY_MULTI 9915 2.80 1.08 3.11 72 XMNumbers 9616 3.19 4.12 3.01 73 RCVD_IN_IADB_LISTED 9410 2.58 0.55 2.95 74 TR_XM_PhishingBody 9274 3.07 3.95 2.91 75 BAYES_95 8781 3.17 5.45 2.75 76 T_REMOTE_IMAGE 8593 4.42 13.87 2.69 77 XM_H_Trusted_IP 8509 2.26 0.00 2.67 78 TVD_RCVD_IP 8451 2.45 1.36 2.65 79 T_TooManySym_02 8438 2.43 1.23 2.65 80 RCVD_IN_IADB_SPF 8374 2.30 0.52 2.63 81 HTML_IMAGE_RATIO_08 8347 2.71 3.22 2.62 82 BOTNET 8133 8.00 37.91 2.55 83 INVALID_MSGID 7803 2.10 0.18 2.45 84 RCVD_IN_IADB_SENDERID 7647 2.11 0.51 2.40 85 HELO_MISC_IP 7627 2.28 1.64 2.39 86 CK_HELO_DYNAMIC_SPLIT_IP 7623 2.26 1.53 2.39 87 RCVD_IN_IADB_DK 7484 2.06 0.51 2.35 88 XM_CamelCaseFrm001 7423 2.36 2.56 2.33 89 RELAYCOUNTRY_CA 7040 3.14 8.25 2.21 90 MAILING_LIST_MULTI 6570 1.93 1.23 2.06 91 TO_MALFORMED 6482 1.73 0.05 2.03 92 NO_DNS_FOR_FROM 5917 2.67 7.17 1.85 93 UNTRUSTED_Relay 5696 5.64 26.76 1.79 94 HTML_MIME_NO_HTML_TAG 5552 3.56 13.56 1.74 95 XM_OfRef6 5449 1.89 2.89 1.71 96 XMBdyGiftCard01 5374 1.56 0.87 1.68 97 RCVD_IN_IADB_VOUCHED 5344 1.43 0.09 1.68 98 USER_IN_DEF_DKIM_WL 5343 1.42 0.01 1.67 99 XM_B_SpammyTLD 5242 2.30 5.90 1.64 100 XM_PDF 5162 1.45 0.51 1.62 101 XM_DK_Undo_01 4893 1.42 0.77 1.53 102 IN_HORDE_ADDRESS_BOOK 4732 1.27 0.11 1.48 103 T_XMDrugObfuBody_14 4623 1.43 1.30 1.45 104 HTML_FONT_FACE_BAD 4355 1.20 0.32 1.37 105 XMStockSpam_06 4340 1.35 1.27 1.36 106 URI_TRY_3LD 4214 1.65 3.43 1.32 107 XM_GoogleGroups 4153 1.16 0.41 1.30 108 T_XMDrugObfuBody_08 4041 1.38 2.00 1.27 109 TR_MSPIKEBAYES00 3928 1.04 0.01 1.23 110 XM_ProductURIs 3862 1.30 1.77 1.21 111 XMDiploma_00 3862 1.21 1.23 1.21 112 TooManyTo_002 3861 1.11 0.59 1.21 113 TR_Symld_Words 3852 1.17 0.99 1.21 114 RCVD_IN_MSPIKE_H5 3810 1.02 0.09 1.19 115 RCVD_IN_BL_SPAMCOP_NET 3788 2.48 9.58 1.19 116 XMBrknScrpt_02 3723 1.36 2.42 1.17 117 TM2_M_VERY_LONG_WORD 3714 1.22 1.52 1.16 118 XM_B_Phish66 3677 1.31 2.16 1.15 119 URI_HEX 3624 1.12 1.06 1.14 120 XM_B_Unsub2 3618 1.18 1.45 1.13 121 XM_B_COVIDMETA 3546 1.25 2.02 1.11 122 XM_SPF_SoftFail 3356 2.20 8.46 1.05 123 XMSubNoVowel 3311 1.83 6.16 1.04 124 DKIM_ADSP_CUSTOM_MED 3299 1.15 1.79 1.03 125 XMGappySubj_01 3284 0.88 0.08 1.03 126 XM_UB50 3272 2.14 8.27 1.03 127 RCVD_IN_IADB_OPTIN 3176 0.87 0.19 1.00 128 SUBJ_ALL_CAPS 3088 1.12 1.94 0.97 129 KHOP_HELO_FCRDNS 3086 1.42 3.93 0.97 130 XMBody_17 2988 1.19 2.61 0.94 131 XM_H_Long_From02 2775 0.82 0.56 0.87 132 TooManyTo_003 2739 0.80 0.47 0.86 133 T_TooManySym_03 2602 0.82 0.83 0.82 134 XMHTML_After_End 2587 0.83 0.91 0.81 135 TR_MetaPhish_Combo_01 2499 0.78 0.77 0.78 136 XMSexyCombo_01 2482 1.02 2.35 0.78 137 XM_B_REG_HTML 2431 0.66 0.13 0.76 138 XMSubMetaSxObfu_02 2421 0.71 0.46 0.76 139 XMGenDplmaNmb 2306 0.72 0.68 0.72 140 NML_ADSP_CUSTOM_MED 2298 0.86 1.62 0.72 141 TooManyTo_004 2267 0.67 0.43 0.71 142 XMBody_95 2239 0.61 0.10 0.70 143 XMPhish08 2124 0.65 0.53 0.67 144 XM_H_PHPMailer 2122 0.79 1.49 0.67 145 XMPhish14 2117 0.63 0.46 0.66 146 RELAYCOUNTRY_GB 2115 0.73 1.09 0.66 147 XM_Superlative01 2112 0.57 0.05 0.66 148 RCVD_IN_MSPIKE_BL 2063 2.14 10.31 0.65 149 TooManyTo_005 1970 0.58 0.37 0.62 150 T_XMDrugObfuBody_00 1838 0.64 1.00 0.58 151 XM_B_COPY_HTML 1814 0.55 0.42 0.57 152 SpammyFromTLD_01 1793 1.46 6.36 0.56 153 TR_XM_PHPDW 1766 0.93 2.99 0.55 154 T_XMHurry_00 1754 0.71 1.61 0.55 155 USER_IN_WHITELIST 1749 0.46 0.00 0.55 156 XM_RXBody 1733 0.54 0.49 0.54 157 NUMERIC_HTTP_ADDR 1688 0.51 0.37 0.53 158 TR_XM_FormFill2 1661 0.89 2.89 0.52 159 TR_XM_PHPForged 1658 0.89 2.93 0.52 160 XM_H_PHPOS 1640 0.88 2.87 0.51 161 HELO_NODOT 1633 0.55 0.78 0.51 162 HELO_NO_DOMAIN 1628 0.55 0.78 0.51 163 XM_DIRTYINTL 1615 1.03 3.93 0.51 164 HTML_TAG_BALANCE_BODY 1573 0.60 1.21 0.49 165 XMSubMetaI_00 1552 0.62 1.34 0.49 166 XMBody_78 1544 0.65 1.55 0.48 167 FORGED_GMAIL_RCVD 1538 0.65 1.59 0.48 168 RCVD_IN_MSPIKE_L3 1536 1.50 7.09 0.48 169 T_FILL_THIS_FORM_SHORT 1492 0.60 1.34 0.47 170 HTML_IMAGE_ONLY_20 1482 0.54 0.95 0.46 171 XMSubMetaSSx_00 1457 0.48 0.61 0.46 172 TR_BOTNET_NEGATE 1424 0.40 0.16 0.45 173 XMPhish30 1418 0.51 0.87 0.44 174 RDNS_DYNAMIC 1409 0.65 1.80 0.44 175 DIET_1 1384 0.57 1.32 0.43 176 TR_XM_COVIDMETA4 1383 0.74 2.41 0.43 177 URI_NOVOWEL 1372 0.48 0.73 0.43 178 MIME_HEADER_CTYPE_ONLY 1363 0.55 1.25 0.43 179 TR_LOTS_OF_MONEY3 1330 0.52 1.11 0.42 180 XMCapTrack 1319 0.41 0.37 0.41 181 XMLngstWrd_00 1308 0.40 0.34 0.41 182 DKIM_ADSP_NXDOMAIN 1306 2.07 11.16 0.41 183 XMSlimDrugH 1272 0.48 0.90 0.40 184 MPART_ALT_DIFF_COUNT 1267 0.63 1.93 0.40 185 XMHTMLBadTable_001 1255 0.40 0.41 0.39 186 HTTPS_HTTP_MISMATCH 1247 0.38 0.35 0.39 187 T_Symld_Words_02 1236 0.51 1.15 0.39 188 XMLngstWrd_01 1222 0.37 0.31 0.38 189 URI_OPTOUT_3LD 1216 0.34 0.11 0.38 190 XMNoVowels 1207 0.45 0.86 0.38 191 XM_ShortIntro_01 1139 0.46 1.00 0.36 192 XM_H_PHPOS_M 1125 0.49 1.22 0.35 193 XM_Body_Obfu01 1111 0.32 0.14 0.35 194 XMBSHREFv2 1110 0.31 0.12 0.35 195 T_TooManySym_04 1108 0.30 0.07 0.35 196 TM2_M_A_HREF_HREF 1090 0.36 0.47 0.34 197 PLING_QUERY 1089 0.34 0.32 0.34 198 XM_Walgreens_Forge 1087 0.29 0.04 0.34 199 HTML_FONT_TINY_NORDNS 1082 0.52 1.50 0.34 200 RELAYCOUNTRY_DE 1072 0.99 4.60 0.34 ----------------------------------------------------------------------