Email: 723643 Autolearn: 0 AvgScore: 0.46 AvgScanTime: 1.95 sec Spam: 108719 Autolearn: 0 AvgScore: 12.19 AvgScanTime: 3.79 sec Ham: 614924 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.63 sec Time Spent Running SA: 392.57 hours Time Spent Processing Spam: 114.43 hours Time Spent Processing Ham: 278.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 106066 98.17 97.56 98.28 2 HTML_MESSAGE 98140 82.19 90.27 80.76 3 RELAYCOUNTRY_US 71049 73.44 65.35 74.87 4 DKIM_SIGNED 70406 67.97 64.76 68.53 5 XM_DK_Pass 67699 66.73 62.27 67.51 6 XM_B_Unicode 66862 62.66 61.50 62.86 7 XMListUnsubscribeExists 57284 46.49 52.69 45.40 8 DKIM_VALID 55214 61.33 50.79 63.20 9 BAYES_50 48618 47.74 44.72 48.27 10 XM_DK_Undo_02 47215 15.28 43.43 10.30 11 DKIM_VALID_AU 41402 45.72 38.08 47.07 12 RELAYCOUNTRY_META 36559 9.74 33.63 5.52 13 XM_B_Unicode3 35167 34.52 32.35 34.90 14 BOTNET 33818 7.27 31.11 3.05 15 BAYES_99 33022 10.07 30.37 6.48 16 MIME_HTML_ONLY 32897 19.80 30.26 17.95 17 LOC_TINY_FONT_1 28519 22.31 26.23 21.62 18 UNTRUSTED_Relay 28397 5.54 26.12 1.90 19 DKIM_VALID_EF 26835 25.01 24.68 25.07 20 HTML_FONT_LOW_CONTRAST 25946 23.33 23.87 23.24 21 BAYES_999 25620 7.90 23.57 5.13 22 FVGT_m_MULTI_ODD 25417 20.28 23.38 19.73 23 XMSubLong 24143 19.83 22.21 19.41 24 XM_UncommonTLD01 21931 5.49 20.17 2.89 25 RCVD_IN_MSPIKE_H2 21416 21.23 19.70 21.50 26 T_TM2_M_HEADER_IN_MSG 20655 25.90 19.00 27.12 27 BOTNET_IPINHOSTNAME 20602 6.78 18.95 4.63 28 LOTS_OF_MONEY 20343 9.26 18.71 7.59 29 T_KAM_HTML_FONT_INVALID 17870 16.61 16.44 16.64 30 XM_Multi_Part_URI 15681 15.88 14.42 16.14 31 XM_Body_Dirty_Words 15660 11.98 14.40 11.55 32 XM_UB50 15382 3.12 14.15 1.17 33 DKIM_INVALID 15192 6.63 13.97 5.34 34 NO_DNS_FOR_FROM 12198 4.13 11.22 2.87 35 HTML_IMAGE_RATIO_02 11520 6.53 10.60 5.81 36 SUBJ_ALL_CAPS 11437 2.65 10.52 1.26 37 REPLYTO_WITHOUT_TO_CC 11289 1.60 10.38 0.04 38 XM_B_Phish_Phrases 11181 6.94 10.28 6.35 39 XM_B_Unsub 10554 10.89 9.71 11.10 40 HELO_NODOT 10293 3.83 9.47 2.83 41 HELO_NO_DOMAIN 10292 3.83 9.47 2.83 42 MPART_ALT_DIFF 10256 5.08 9.43 4.31 43 MISSING_HEADERS 10004 1.75 9.20 0.43 44 RCVD_IN_MSPIKE_BL 9535 1.69 8.77 0.43 45 SpammyFromTLD_02 9485 1.61 8.72 0.35 46 TR_LOTS_OF_MONEY1 9267 1.30 8.52 0.02 47 XMSexyCombo_05 9134 4.37 8.40 3.66 48 RCVD_IN_MSPIKE_WL 9016 21.33 8.29 23.64 49 LotsOfNums_01 9006 8.04 8.28 8.00 50 TR_XM_PhishingBody 8948 4.17 8.23 3.45 51 TooManyTo_001 8358 8.14 7.69 8.22 52 XM_Evil_Numbers_Gen 8345 7.89 7.68 7.93 53 RELAYCOUNTRY_UG 8224 1.14 7.56 0.00 54 RCVD_IN_BL_SPAMCOP_NET 8035 2.18 7.39 1.26 55 T_REMOTE_IMAGE 7731 3.98 7.11 3.42 56 BAYES_80 7580 4.36 6.97 3.90 57 BAYES_60 7475 5.93 6.88 5.76 58 UNPARSEABLE_RELAY 7201 6.66 6.62 6.67 59 RCVD_IN_RP_RNBL 7181 1.04 6.61 0.06 60 XM_OfRef6 6806 1.95 6.26 1.19 61 XMSubMetaSx_00 6729 3.89 6.19 3.48 62 HTML_MIME_NO_HTML_TAG 6646 2.67 6.11 2.06 63 MONEY_ATM_CARD 6506 0.90 5.98 0.01 64 ADVANCE_FEE_4_NEW_MONEY 6480 0.90 5.96 0.01 65 PDS_OTHER_BAD_TLD 6385 1.03 5.87 0.18 66 FROM_SUSPICIOUS_NTLD 6340 0.94 5.83 0.07 67 XM_SPF_SoftFail 6337 2.23 5.83 1.59 68 XM_B_Phish66 6263 2.50 5.76 1.92 69 FROM_SUSPICIOUS_NTLD_FP 6229 0.91 5.73 0.06 70 XM_B_COVIDMETA 6227 2.16 5.73 1.53 71 XMNumbers 6153 4.74 5.66 4.58 72 RELAYCOUNTRY_CA 5974 2.33 5.49 1.77 73 XM_B_SpammyTLD 5949 2.13 5.47 1.54 74 FROM_EXCESS_BASE64 5781 2.97 5.32 2.55 75 SpammyFromTLD_01 5730 1.52 5.27 0.85 76 RCVD_IN_MSPIKE_H3 5639 12.35 5.19 13.61 77 XM_H_Long_From01 5403 5.23 4.97 5.27 78 KHOP_HELO_FCRDNS 5171 2.18 4.76 1.73 79 MIME_HTML_MOSTLY 4965 2.55 4.57 2.19 80 RCVD_IN_MSPIKE_L3 4848 0.92 4.46 0.30 81 TR_XM_COVIDMETA4 4721 1.19 4.34 0.63 82 BOTNET_NORDNS 4720 0.67 4.34 0.03 83 HTML_IMAGE_RATIO_04 4668 4.66 4.29 4.72 84 TR_XM_INV_DKIM 4517 0.77 4.15 0.17 85 XMHTML_After_End 4348 1.39 4.00 0.93 86 BODY_URI_ONLY 4336 0.66 3.99 0.07 87 TR_Mismatch_TLD_02 4083 0.67 3.76 0.13 88 BAYES_40 3970 4.61 3.65 4.78 89 HTML_TAG_BALANCE_CENTER 3965 0.68 3.65 0.16 90 XM_SendGrid 3845 5.61 3.54 5.98 91 TR_XM_COVIDMETA1 3842 1.02 3.53 0.57 92 XM_UB99 3821 0.53 3.51 0.01 93 BAYES_95 3569 2.47 3.28 2.33 94 RCVD_IN_PSBL 3541 0.50 3.26 0.01 95 XM_URI_RBL 3528 0.64 3.25 0.18 96 RELAYCOUNTRY_FR 3491 0.74 3.21 0.30 97 TM2_M_URI_OPT_OUT 3465 11.61 3.19 13.10 98 XM_BadFromFormat 3434 0.58 3.16 0.13 99 T_TooManySym_01 3336 3.63 3.07 3.74 100 HTML_IMAGE_ONLY_16 3293 0.64 3.03 0.21 101 MIME_CHARSET_FARAWAY 3285 0.55 3.02 0.11 102 XM_DIRTYINTL 3244 0.93 2.98 0.57 103 RCVD_IN_MSPIKE_L5 3195 0.51 2.94 0.08 104 PDS_BTC_ID 3130 0.47 2.88 0.04 105 RCVD_IN_MSPIKE_H4 3126 7.89 2.88 8.78 106 T_Symld_Words_02 3079 0.92 2.83 0.58 107 DEAR_FRIEND 3078 0.55 2.83 0.14 108 XM_B_Crypto 3056 0.46 2.81 0.05 109 T_XMDrugObfuBody_08 3040 1.72 2.80 1.53 110 HTML_FONT_TINY_NORDNS 3024 0.66 2.78 0.29 111 XM_UB60 2991 0.52 2.75 0.12 112 ANY_BOUNCE_MESSAGE 2960 11.12 2.72 12.61 113 BOUNCE_MESSAGE 2960 11.12 2.72 12.61 114 MIME_QP_LONG_LINE 2955 4.77 2.72 5.13 115 XM_UB999 2907 0.41 2.67 0.00 116 GB_BITCOIN_CP 2899 0.40 2.67 0.00 117 HTML_IMAGE_RATIO_06 2896 3.28 2.66 3.39 118 BITCOIN_EXTORT_01 2896 0.40 2.66 0.00 119 TR_XM_Crypto2 2882 0.40 2.65 0.01 120 XMStrtUSub 2867 4.13 2.64 4.39 121 TR_XM_MaxSPIKE 2803 0.41 2.58 0.03 122 XMBody_17 2797 0.98 2.57 0.69 123 HDRS_MISSP 2752 0.40 2.53 0.02 124 DKIM_ADSP_NXDOMAIN 2701 0.62 2.48 0.29 125 MONEY_FORM_SHORT 2672 0.42 2.46 0.05 126 URIBL_SBL_A 2671 0.47 2.46 0.12 127 TR_XM_PHPDW 2569 1.01 2.36 0.78 128 FILL_THIS_FORM 2544 0.53 2.34 0.20 129 XM_DK_Undo_01 2538 1.64 2.33 1.52 130 ALL_TRUSTED 2524 18.33 2.32 21.16 131 TR_XM_PHPForged 2514 0.99 2.31 0.75 132 TR_XM_FormFill2 2495 0.98 2.29 0.75 133 XM_H_PHPOS 2484 0.98 2.28 0.75 134 PDS_NAKED_TO_NUMERO 2462 0.34 2.26 0.00 135 NUMBERONLY_BITCOIN_EXP 2459 0.34 2.26 0.00 136 XM_B_Unsub2 2425 3.82 2.23 4.10 137 TR_Sbj_FN_Bdy 2391 0.48 2.20 0.17 138 NORDNS_LOW_CONTRAST 2379 0.33 2.19 0.01 139 MAILING_LIST_MULTI 2273 2.17 2.09 2.19 140 XM_CamelCaseFrm001 2203 1.93 2.03 1.92 141 T_TVD_MIME_EPI 2186 0.32 2.01 0.02 142 XMSexyCombo_01 2122 0.79 1.95 0.59 143 HTML_SHORT_LINK_IMG_2 2122 0.32 1.95 0.03 144 MIME_HTML_ONLY_MULTI 2066 2.49 1.90 2.59 145 TR_XM_MaxBayes 2059 0.31 1.89 0.03 146 HTML_IMAGE_RATIO_08 2028 2.04 1.87 2.08 147 T_XMDrugObfuBody_14 1992 1.39 1.83 1.31 148 XMDiploma_00 1983 1.41 1.82 1.34 149 URI_TRY_3LD 1957 1.24 1.80 1.14 150 INVALID_MSGID 1925 1.28 1.77 1.20 151 XMSubEmpty 1922 0.46 1.77 0.23 152 BAYES_20 1886 3.68 1.73 4.02 153 TR_Symld_Words 1878 1.57 1.73 1.54 154 XM_UB80 1845 0.30 1.70 0.05 155 URI_HEX 1818 1.39 1.67 1.34 156 T_XMDrugObfuBody_00 1813 2.96 1.67 3.18 157 FILL_THIS_FORM_LONG 1792 0.33 1.65 0.10 158 T_TooManySym_02 1775 1.86 1.63 1.90 159 XM_OfRef7 1756 0.36 1.62 0.13 160 DKIM_ADSP_CUSTOM_MED 1746 1.18 1.61 1.10 161 HTML_SHORT_LINK_IMG_1 1745 0.27 1.61 0.04 162 XMMoneyMeta_00 1737 0.73 1.60 0.57 163 FROM_MISSP_REPLYTO 1714 0.24 1.58 0.01 164 HTML_IMAGE_ONLY_08 1710 0.33 1.57 0.11 165 RELAYCOUNTRY_GB 1699 1.17 1.56 1.10 166 TR_XM_RelayPhish 1688 0.39 1.55 0.18 167 TM2_M_VERY_LONG_WORD 1678 1.13 1.54 1.05 168 XMSubNoVowel 1676 1.01 1.54 0.92 169 TR_XM_DK_SendGrid 1621 3.09 1.49 3.37 170 URI_PHP_REDIR 1593 0.23 1.47 0.01 171 RELAYCOUNTRY_IN 1591 0.32 1.46 0.12 172 HDRS_LCASE_IMGONLY 1586 0.25 1.46 0.03 173 XMGenDplmaNmb 1578 0.88 1.45 0.78 174 NML_ADSP_CUSTOM_MED 1557 0.87 1.43 0.77 175 FORGED_GMAIL_RCVD 1538 0.67 1.41 0.54 176 XMLngstWrd_00 1530 0.48 1.41 0.32 177 MISSING_SUBJECT 1517 0.27 1.40 0.07 178 XMNoSubject 1517 0.27 1.40 0.07 179 LongTLD 1444 0.33 1.33 0.16 180 HTTP_ESCAPED_HOST 1377 0.25 1.27 0.07 181 DATE_IN_PAST_03_06 1360 0.28 1.25 0.11 182 BAYES_00 1357 18.24 1.25 21.24 183 TR_MetaPhish_Combo_01 1341 1.54 1.23 1.59 184 RDNS_DYNAMIC 1339 0.45 1.23 0.31 185 XMBrknScrpt_02 1338 0.85 1.23 0.78 186 HK_RANDOM_REPLYTO 1314 0.36 1.21 0.21 187 XM_ProductURIs 1301 0.84 1.20 0.78 188 XM_H_Undi_Recip 1298 0.35 1.19 0.20 189 RELAYCOUNTRY_HU 1289 0.18 1.19 0.01 190 RELAYCOUNTRY_RU 1287 0.20 1.18 0.02 191 DIET_1 1271 0.61 1.17 0.51 192 BAYES_05 1234 2.90 1.14 3.21 193 RELAYCOUNTRY_DE 1228 0.53 1.13 0.42 194 XM_PDF 1226 3.31 1.13 3.70 195 XMBody_78 1219 0.47 1.12 0.36 196 XMPhish08 1214 0.62 1.12 0.54 197 XM_Combo_Fr 1214 0.22 1.12 0.06 198 T_TooManySym_03 1205 0.68 1.11 0.61 199 HTML_TAG_BALANCE_HEAD 1169 0.20 1.08 0.04 200 T_XMHurry_00 1168 0.50 1.07 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 604359 98.17 97.56 98.28 2 HTML_MESSAGE 496617 82.19 90.27 80.76 3 RELAYCOUNTRY_US 460424 73.44 65.35 74.87 4 DKIM_SIGNED 421436 67.97 64.76 68.53 5 XM_DK_Pass 415159 66.73 62.27 67.51 6 DKIM_VALID 388627 61.33 50.79 63.20 7 XM_B_Unicode 386556 62.66 61.50 62.86 8 BAYES_50 296823 47.74 44.72 48.27 9 DKIM_VALID_AU 289460 45.72 38.08 47.07 10 XMListUnsubscribeExists 279160 46.49 52.69 45.40 11 XM_B_Unicode3 214629 34.52 32.35 34.90 12 T_TM2_M_HEADER_IN_MSG 166762 25.90 19.00 27.12 13 DKIM_VALID_EF 154147 25.01 24.68 25.07 14 RCVD_IN_MSPIKE_WL 145349 21.33 8.29 23.64 15 HTML_FONT_LOW_CONTRAST 142891 23.33 23.87 23.24 16 LOC_TINY_FONT_1 132932 22.31 26.23 21.62 17 RCVD_IN_MSPIKE_H2 132214 21.23 19.70 21.50 18 BAYES_00 130605 18.24 1.25 21.24 19 ALL_TRUSTED 130125 18.33 2.32 21.16 20 FVGT_m_MULTI_ODD 121312 20.28 23.38 19.73 21 XMSubLong 119385 19.83 22.21 19.41 22 MIME_HTML_ONLY 110395 19.80 30.26 17.95 23 T_KAM_HTML_FONT_INVALID 102343 16.61 16.44 16.64 24 XM_Multi_Part_URI 99268 15.88 14.42 16.14 25 RCVD_IN_MSPIKE_H3 83719 12.35 5.19 13.61 26 TM2_M_URI_OPT_OUT 80528 11.61 3.19 13.10 27 ANY_BOUNCE_MESSAGE 77519 11.12 2.72 12.61 28 BOUNCE_MESSAGE 77514 11.12 2.72 12.61 29 XM_Body_Dirty_Words 70998 11.98 14.40 11.55 30 XM_B_Unsub 68267 10.89 9.71 11.10 31 XM_DK_Undo_02 63336 15.28 43.43 10.30 32 RCVD_IN_MSPIKE_H4 53979 7.89 2.88 8.78 33 TooManyTo_001 50567 8.14 7.69 8.22 34 TR_XM_DK_Bayes 49577 6.92 0.43 8.06 35 LotsOfNums_01 49182 8.04 8.28 8.00 36 XM_Evil_Numbers_Gen 48742 7.89 7.68 7.93 37 LOTS_OF_MONEY 46671 9.26 18.71 7.59 38 TR_XM_DK_Bayes1 45755 6.36 0.23 7.44 39 IN_ZIMBRA_NJ_WHITELIST 43470 6.01 0.03 7.07 40 UNPARSEABLE_RELAY 41016 6.66 6.62 6.67 41 TR_XM_DK_Bayes2 40500 5.62 0.19 6.59 42 BAYES_99 39862 10.07 30.37 6.48 43 XM_B_Phish_Phrases 39029 6.94 10.28 6.35 44 XM_SendGrid 36744 5.61 3.54 5.98 45 XM_DKIMWhitelistDomains 35982 4.97 0.00 5.85 46 HTML_IMAGE_RATIO_02 35745 6.53 10.60 5.81 47 RCVD_IN_RP_SAFE 35485 5.01 0.71 5.77 48 BAYES_60 35414 5.93 6.88 5.76 49 RELAYCOUNTRY_META 33952 9.74 33.63 5.52 50 DKIM_INVALID 32809 6.63 13.97 5.34 51 XM_H_Long_From01 32408 5.23 4.97 5.27 52 BAYES_999 31555 7.90 23.57 5.13 53 MIME_QP_LONG_LINE 31538 4.77 2.72 5.13 54 RCVD_IN_RP_CERTIFIED 31523 4.42 0.42 5.13 55 BAYES_40 29404 4.61 3.65 4.78 56 HTML_IMAGE_RATIO_04 29048 4.66 4.29 4.72 57 RCVD_IN_IADB_LISTED 28944 4.12 0.81 4.71 58 BOTNET_IPINHOSTNAME 28451 6.78 18.95 4.63 59 XMNumbers 28147 4.74 5.66 4.58 60 XMStrtUSub 27014 4.13 2.64 4.39 61 MPART_ALT_DIFF 26505 5.08 9.43 4.31 62 RCVD_IN_IADB_SPF 25429 3.62 0.72 4.14 63 XM_B_Unsub2 25193 3.82 2.23 4.10 64 BAYES_20 24738 3.68 1.73 4.02 65 BAYES_80 23984 4.36 6.97 3.90 66 T_TooManySym_01 22968 3.63 3.07 3.74 67 XM_PDF 22722 3.31 1.13 3.70 68 XMSexyCombo_05 22521 4.37 8.40 3.66 69 RCVD_IN_IADB_DK 22083 3.16 0.70 3.59 70 RCVD_IN_IADB_SENDERID 21898 3.13 0.70 3.56 71 XMSubMetaSx_00 21420 3.89 6.19 3.48 72 TR_XM_PhishingBody 21202 4.17 8.23 3.45 73 T_REMOTE_IMAGE 21048 3.98 7.11 3.42 74 HTML_IMAGE_RATIO_06 20873 3.28 2.66 3.39 75 TR_XM_DK_SendGrid 20708 3.09 1.49 3.37 76 BAYES_05 19747 2.90 1.14 3.21 77 T_XMDrugObfuBody_00 19582 2.96 1.67 3.18 78 BOTNET 18766 7.27 31.11 3.05 79 RCVD_IN_IADB_VOUCHED 18075 2.54 0.27 2.94 80 XM_UncommonTLD01 17765 5.49 20.17 2.89 81 NO_DNS_FOR_FROM 17653 4.13 11.22 2.87 82 HELO_NODOT 17423 3.83 9.47 2.83 83 HELO_NO_DOMAIN 17420 3.83 9.47 2.83 84 MIME_HTML_ONLY_MULTI 15938 2.49 1.90 2.59 85 FROM_EXCESS_BASE64 15706 2.97 5.32 2.55 86 BAYES_95 14336 2.47 3.28 2.33 87 MIME_HTML_MOSTLY 13474 2.55 4.57 2.19 88 XM_H_Trusted_IP 13463 1.86 0.00 2.19 89 MAILING_LIST_MULTI 13461 2.17 2.09 2.19 90 HTML_IMAGE_RATIO_08 12770 2.04 1.87 2.08 91 HTML_MIME_NO_HTML_TAG 12656 2.67 6.11 2.06 92 XM_B_Phish66 11804 2.50 5.76 1.92 93 XM_CamelCaseFrm001 11784 1.93 2.03 1.92 94 T_TooManySym_02 11714 1.86 1.63 1.90 95 UNTRUSTED_Relay 11658 5.54 26.12 1.90 96 TooManyTo_002 11509 1.70 0.71 1.87 97 RCVD_IN_IADB_OPTIN 11285 1.60 0.26 1.84 98 RELAYCOUNTRY_CA 10901 2.33 5.49 1.77 99 SHORT_HELO_AND_INLINE_IMAGE 10813 1.50 0.07 1.76 100 KHOP_HELO_FCRDNS 10634 2.18 4.76 1.73 101 TR_MetaPhish_Combo_01 9808 1.54 1.23 1.59 102 XM_SPF_SoftFail 9772 2.23 5.83 1.59 103 TVD_RCVD_IP 9598 1.40 0.51 1.56 104 TR_Symld_Words 9485 1.57 1.73 1.54 105 XM_B_SpammyTLD 9470 2.13 5.47 1.54 106 T_XMDrugObfuBody_08 9437 1.72 2.80 1.53 107 XM_B_COVIDMETA 9436 2.16 5.73 1.53 108 XM_DK_Undo_01 9326 1.64 2.33 1.52 109 URI_HEX 8234 1.39 1.67 1.34 110 XMDiploma_00 8216 1.41 1.82 1.34 111 T_XMDrugObfuBody_14 8062 1.39 1.83 1.31 112 TooManyTo_003 7830 1.16 0.53 1.27 113 SUBJ_ALL_CAPS 7740 2.65 10.52 1.26 114 RCVD_IN_BL_SPAMCOP_NET 7728 2.18 7.39 1.26 115 RCVD_IN_MSPIKE_H5 7651 1.09 0.23 1.24 116 HELO_MISC_IP 7637 1.20 0.95 1.24 117 CK_HELO_DYNAMIC_SPLIT_IP 7628 1.15 0.62 1.24 118 IN_HORDE_ADDRESS_BOOK 7485 1.04 0.03 1.22 119 INVALID_MSGID 7363 1.28 1.77 1.20 120 XM_OfRef6 7303 1.95 6.26 1.19 121 XM_UB50 7209 3.12 14.15 1.17 122 XM_GoogleGroups 7096 1.06 0.54 1.15 123 URI_TRY_3LD 7033 1.24 1.80 1.14 124 DKIM_ADSP_CUSTOM_MED 6786 1.18 1.61 1.10 125 RELAYCOUNTRY_GB 6778 1.17 1.56 1.10 126 XMCapTrack 6758 1.02 0.54 1.10 127 TO_MALFORMED 6494 0.91 0.09 1.06 128 TM2_M_VERY_LONG_WORD 6484 1.13 1.54 1.05 129 TooManyTo_004 5825 0.87 0.44 0.95 130 XMHTML_After_End 5701 1.39 4.00 0.93 131 XMSubNoVowel 5659 1.01 1.54 0.92 132 TR_MSPIKEBAYES00 5646 0.78 0.00 0.92 133 XM_H_Long_From02 5551 0.91 0.97 0.90 134 SpammyFromTLD_01 5243 1.52 5.27 0.85 135 USER_IN_DEF_DKIM_WL 5220 0.72 0.00 0.85 136 XMGappySubj_01 5086 0.72 0.13 0.83 137 TooManyTo_005 4902 0.73 0.34 0.80 138 HTML_FONT_FACE_BAD 4837 0.76 0.62 0.79 139 XM_H_PHPMailer 4817 0.80 0.91 0.78 140 XM_ProductURIs 4803 0.84 1.20 0.78 141 XMBrknScrpt_02 4781 0.85 1.23 0.78 142 XMGenDplmaNmb 4781 0.88 1.45 0.78 143 XMBdyGiftCard01 4779 0.77 0.74 0.78 144 TR_XM_PHPDW 4770 1.01 2.36 0.78 145 NML_ADSP_CUSTOM_MED 4732 0.87 1.43 0.77 146 TR_XM_FormFill2 4627 0.98 2.29 0.75 147 TR_XM_PHPForged 4620 0.99 2.31 0.75 148 XM_H_PHPOS 4594 0.98 2.28 0.75 149 XMStockSpam_06 4536 0.79 1.05 0.74 150 HTTPS_HTTP_MISMATCH 4297 0.68 0.60 0.70 151 XMBody_17 4263 0.98 2.57 0.69 152 T_FILL_THIS_FORM_SHORT 4206 0.74 1.04 0.68 153 XMSubMetaI_00 3915 0.65 0.73 0.64 154 TR_XM_COVIDMETA4 3890 1.19 4.34 0.63 155 FROM_GOV_DKIM_AU 3829 0.54 0.07 0.62 156 T_OBFU_PDF_ATTACH 3825 0.55 0.15 0.62 157 XMBody_95 3771 0.54 0.10 0.61 158 T_TooManySym_03 3723 0.68 1.11 0.61 159 XMSexyCombo_01 3629 0.79 1.95 0.59 160 T_Symld_Words_02 3554 0.92 2.83 0.58 161 XMMoneyMeta_00 3531 0.73 1.60 0.57 162 TR_XM_COVIDMETA1 3516 1.02 3.53 0.57 163 XM_DIRTYINTL 3511 0.93 2.98 0.57 164 XMPhish14 3430 0.58 0.73 0.56 165 XM_SPF_Unknown 3354 0.57 0.73 0.55 166 FORGED_GMAIL_RCVD 3323 0.67 1.41 0.54 167 XMPhish08 3291 0.62 1.12 0.54 168 XMNoVowels 3235 0.56 0.74 0.53 169 DIET_1 3115 0.61 1.17 0.51 170 TR_LOTS_OF_MONEY3 3085 0.58 1.00 0.50 171 XMSubMetaSxObfu_03 3028 0.55 0.87 0.49 172 XM_H_PHPOS_M 2927 0.51 0.73 0.48 173 XM_ShortIntro_01 2907 0.49 0.57 0.47 174 PLING_QUERY 2871 0.49 0.63 0.47 175 HTML_TAG_BALANCE_BODY 2799 0.49 0.67 0.46 176 TR_BOTNET_NEGATE 2745 0.41 0.23 0.45 177 TM2_M_BODY_EMPTY 2720 0.39 0.10 0.44 178 RCVD_IN_MSPIKE_BL 2667 1.69 8.77 0.43 179 MISSING_HEADERS 2660 1.75 9.20 0.43 180 URI_NOVOWEL 2636 0.49 0.85 0.43 181 XMPhish30 2634 0.49 0.82 0.43 182 XM_Body_Obfu01 2632 0.41 0.29 0.43 183 RELAYCOUNTRY_DE 2607 0.53 1.13 0.42 184 XMHTMLBadTable_001 2590 0.42 0.39 0.42 185 RCVD_IN_SORBS_DUL 2510 0.41 0.45 0.41 186 FROM_GOV_SPOOF 2480 0.37 0.16 0.40 187 HTML_IMAGE_ONLY_20 2473 0.45 0.74 0.40 188 T_XMHurry_00 2448 0.50 1.07 0.40 189 XM_B_REG_HTML 2444 0.39 0.34 0.40 190 HTML_IMAGE_ONLY_28 2350 0.37 0.30 0.38 191 RELAYCOUNTRY_AU 2267 0.40 0.55 0.37 192 XMBody_78 2211 0.47 1.12 0.36 193 NUMERIC_HTTP_ADDR 2209 0.36 0.36 0.36 194 SpammyFromTLD_02 2149 1.61 8.72 0.35 195 XM_B_COPY_HTML 2109 0.36 0.45 0.34 196 HTML_IMAGE_ONLY_32 2107 0.31 0.16 0.34 197 TVD_SPACE_RATIO 2088 0.32 0.24 0.34 198 XMSlimDrugH 2019 0.35 0.45 0.33 199 XMDateMe_00 2013 0.35 0.47 0.33 200 XMLngstWrd_00 1956 0.48 1.41 0.32 ----------------------------------------------------------------------