Email: 451925 Autolearn: 0 AvgScore: 0.51 AvgScanTime: 1.46 sec Spam: 65642 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 2.70 sec Ham: 386283 Autolearn: 0 AvgScore: -1.71 AvgScanTime: 1.24 sec Time Spent Running SA: 182.71 hours Time Spent Processing Spam: 49.26 hours Time Spent Processing Ham: 133.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 64360 98.93 98.05 99.08 2 HTML_MESSAGE 60037 74.10 91.46 71.15 3 RELAYCOUNTRY_US 43985 66.98 67.01 66.97 4 DKIM_SIGNED 43380 65.28 66.09 65.14 5 XM_DK_Pass 41043 64.07 62.53 64.33 6 XM_B_Unicode 40293 59.86 61.38 59.60 7 XMListUnsubscribeExists 40122 50.44 61.12 48.63 8 DKIM_VALID 35797 60.75 54.53 61.80 9 XM_DK_Undo_02 30100 16.45 45.85 11.45 10 DKIM_VALID_AU 24977 48.08 38.05 49.79 11 BAYES_99 23898 12.19 36.41 8.07 12 BOTNET 22870 7.14 34.84 2.43 13 BAYES_50 22844 40.93 34.80 41.97 14 XM_B_Unicode3 22252 36.18 33.90 36.57 15 RELAYCOUNTRY_META 21963 8.64 33.46 4.42 16 MIME_HTML_ONLY 19957 21.29 30.40 19.74 17 BAYES_999 18773 9.70 28.60 6.49 18 XM_UncommonTLD01 18571 6.57 28.29 2.88 19 HTML_FONT_LOW_CONTRAST 17406 25.37 26.52 25.18 20 FVGT_m_MULTI_ODD 17244 20.30 26.27 19.28 21 LOC_TINY_FONT_1 16783 24.71 25.57 24.56 22 DKIM_VALID_EF 15268 22.54 23.26 22.41 23 RCVD_IN_MSPIKE_H2 14985 20.60 22.83 20.22 24 UNTRUSTED_Relay 14364 4.40 21.88 1.43 25 T_TM2_M_HEADER_IN_MSG 13783 17.41 21.00 16.80 26 BOTNET_IPINHOSTNAME 13263 7.38 20.21 5.20 27 XMSubLong 12003 18.46 18.29 18.49 28 SpammyFromTLD_02 11283 2.64 17.19 0.17 29 T_KAM_HTML_FONT_INVALID 10519 14.80 16.02 14.59 30 FROM_SUSPICIOUS_NTLD 10503 2.35 16.00 0.03 31 FROM_SUSPICIOUS_NTLD_FP 10412 2.33 15.86 0.03 32 XM_Multi_Part_URI 10217 20.16 15.56 20.94 33 XM_Body_Dirty_Words 9612 12.71 14.64 12.39 34 HTML_IMAGE_RATIO_02 9568 9.13 14.58 8.20 35 RCVD_IN_MSPIKE_BL 8335 2.32 12.70 0.55 36 DKIM_INVALID 7583 4.53 11.55 3.34 37 LOTS_OF_MONEY 6787 7.34 10.34 6.83 38 PDS_OTHER_BAD_TLD 6489 1.59 9.89 0.18 39 RELAYCOUNTRY_CA 6480 3.29 9.87 2.18 40 T_REMOTE_IMAGE 6467 3.49 9.85 2.41 41 XM_B_Unsub 6374 8.82 9.71 8.67 42 MPART_ALT_DIFF 6370 5.14 9.70 4.37 43 HTML_TAG_BALANCE_CENTER 6195 1.44 9.44 0.08 44 FROM_EXCESS_BASE64 6037 4.39 9.20 3.57 45 HTML_MIME_NO_HTML_TAG 6020 2.95 9.17 1.89 46 MIME_HTML_MOSTLY 6007 3.28 9.15 2.28 47 XMSexyCombo_05 5934 5.49 9.04 4.89 48 RCVD_IN_BL_SPAMCOP_NET 5835 2.52 8.89 1.44 49 REPLYTO_WITHOUT_TO_CC 5767 1.34 8.79 0.07 50 RCVD_IN_MSPIKE_WL 5683 20.63 8.66 22.66 51 BODY_URI_ONLY 5454 1.24 8.31 0.03 52 NO_DNS_FOR_FROM 5356 2.61 8.16 1.67 53 HDRS_MISSP 5335 1.22 8.13 0.05 54 BOTNET_NORDNS 5302 1.19 8.08 0.02 55 BAYES_80 5243 4.91 7.99 4.38 56 BAYES_60 5226 6.50 7.96 6.25 57 DKIM_ADSP_NXDOMAIN 5223 1.45 7.96 0.35 58 LotsOfNums_01 4856 7.40 7.40 7.40 59 XM_B_Phish_Phrases 4701 6.25 7.16 6.09 60 XM_Evil_Numbers_Gen 4606 8.26 7.02 8.47 61 XMSubMetaSx_00 4567 4.67 6.96 4.28 62 XM_UB50 4412 1.69 6.72 0.83 63 RCVD_IN_RP_RNBL 4405 1.04 6.71 0.07 64 XM_B_SpammyTLD 4402 2.04 6.71 1.25 65 TR_XM_PhishingBody 4293 3.41 6.54 2.88 66 XMMoneyMeta_00 4042 1.14 6.16 0.29 67 NORDNS_LOW_CONTRAST 3922 0.87 5.97 0.00 68 SCRIPT_GIBBERISH 3758 0.84 5.72 0.01 69 XM_SPF_SoftFail 3741 1.60 5.70 0.90 70 UNPARSEABLE_RELAY 3590 6.70 5.47 6.91 71 TooManyTo_001 3588 5.36 5.47 5.35 72 RCVD_IN_MSPIKE_H3 3526 11.77 5.37 12.86 73 XM_H_Long_From01 3462 4.77 5.27 4.69 74 KHOP_HELO_FCRDNS 3430 1.47 5.23 0.83 75 RCVD_IN_MSPIKE_L3 3387 1.10 5.16 0.41 76 SpammyFromTLD_01 3384 1.16 5.16 0.48 77 BAYES_95 3238 2.99 4.93 2.66 78 XM_UB99 3014 0.67 4.59 0.01 79 XMNumbers 3007 3.12 4.58 2.88 80 XM_B_Phish66 2984 1.87 4.55 1.42 81 XM_OfRef6 2913 1.52 4.44 1.03 82 XM_DIRTYINTL 2792 1.04 4.25 0.49 83 URIBL_SBL_A 2736 0.99 4.17 0.45 84 RCVD_IN_PSBL 2614 0.61 3.98 0.03 85 XMBody_17 2603 1.74 3.97 1.36 86 HK_SCAM 2580 0.63 3.93 0.06 87 XM_SendGrid 2403 5.61 3.66 5.94 88 RCVD_IN_MSPIKE_L5 2387 0.60 3.64 0.08 89 HTML_IMAGE_ONLY_16 2376 0.66 3.62 0.16 90 TR_XM_MaxSPIKE 2364 0.57 3.60 0.06 91 URG_BIZ 2351 0.66 3.58 0.16 92 MISSING_HEADERS 2315 0.78 3.53 0.31 93 HELO_NODOT 2313 1.00 3.52 0.57 94 HELO_NO_DOMAIN 2313 1.00 3.52 0.57 95 URI_PHP_REDIR 2305 0.52 3.51 0.01 96 TR_XM_MaxBayes 2290 0.53 3.49 0.03 97 BAYES_00 2279 23.41 3.47 26.79 98 RELAYCOUNTRY_FR 2256 0.71 3.44 0.25 99 XM_Attn_01 2215 0.56 3.37 0.08 100 HTML_IMAGE_RATIO_04 2178 5.09 3.32 5.39 101 XM_B_COVIDMETA 2140 1.35 3.26 1.02 102 XM_UB999 2099 0.47 3.20 0.00 103 RCVD_IN_MSPIKE_H4 2096 7.75 3.19 8.52 104 FILL_THIS_FORM_FRAUD_PHISH 2089 0.52 3.18 0.07 105 INVALID_MSGID 2068 2.07 3.15 1.89 106 TR_XM_PHPDW 2061 0.79 3.14 0.39 107 TR_XM_INV_DKIM 2055 0.67 3.13 0.25 108 TR_XM_COVIDMETA4 2054 0.75 3.13 0.35 109 TR_XM_PHPForged 2046 0.76 3.12 0.36 110 SUBJ_ALL_CAPS 2040 1.46 3.11 1.18 111 TR_XM_FormFill2 2026 0.75 3.09 0.35 112 XM_H_PHPOS 2014 0.74 3.07 0.35 113 PLING_QUERY 1984 0.75 3.02 0.36 114 RCVD_IN_MSPIKE_ZBI 1869 0.44 2.85 0.03 115 ADVANCE_FEE_4_NEW 1841 0.42 2.80 0.02 116 RELAYCOUNTRY_NG_I 1834 0.43 2.79 0.03 117 LUCRATIVE 1833 0.43 2.79 0.03 118 TR_Mismatch_TLD_02 1832 0.46 2.79 0.07 119 TM2_M_URI_OPT_OUT 1820 19.96 2.77 22.88 120 XMStrtUSub 1791 3.73 2.73 3.90 121 XM_CamelCaseFrm001 1772 2.00 2.70 1.89 122 MPART_ALT_DIFF_COUNT 1756 0.68 2.68 0.34 123 XMMoneyMeta_01 1707 0.41 2.60 0.04 124 T_TooManySym_01 1695 4.75 2.58 5.11 125 TR_XM_UnparsRelay 1658 0.74 2.53 0.43 126 XM_UB60 1629 0.44 2.48 0.10 127 T_XMDrugObfuBody_08 1620 1.25 2.47 1.05 128 XM_UB80 1542 0.37 2.35 0.03 129 HTML_IMAGE_RATIO_06 1541 2.92 2.35 3.02 130 TR_XM_MaxWHORU 1530 0.38 2.33 0.04 131 URI_TRY_3LD 1523 1.56 2.32 1.43 132 LongTLD 1458 0.43 2.22 0.13 133 RELAYCOUNTRY_DE 1453 0.50 2.21 0.21 134 XM_OfRef7 1414 0.41 2.15 0.12 135 XM_URI_RBL 1401 0.45 2.13 0.17 136 BAYES_40 1337 3.04 2.04 3.21 137 XM_BadFromFormat 1321 0.40 2.01 0.13 138 RELAYCOUNTRY_GB 1281 0.72 1.95 0.52 139 XM_RXBody 1280 1.07 1.95 0.92 140 RELAYCOUNTRY_HU 1264 0.29 1.93 0.01 141 XMSubNoVowel 1242 1.01 1.89 0.86 142 TM2_M_VERY_LONG_WORD 1227 1.02 1.87 0.88 143 T_XMDrugObfuBody_14 1217 1.10 1.85 0.98 144 T_Symld_Words_02 1178 0.53 1.79 0.31 145 RDNS_DYNAMIC 1141 0.61 1.74 0.41 146 XMSexyCombo_01 1126 1.22 1.72 1.13 147 T_FILL_THIS_FORM_SHORT 1117 0.69 1.70 0.52 148 XMLngstWrd_00 1111 0.60 1.69 0.41 149 HTML_IMAGE_RATIO_08 1109 1.73 1.69 1.74 150 T_XMDrugObfuBody_00 1101 4.23 1.68 4.67 151 TR_XM_RelayPhish 1095 0.34 1.67 0.11 152 T_XMHurry_00 1070 0.90 1.63 0.77 153 BAYES_20 1068 2.77 1.63 2.96 154 FILL_THIS_FORM 1065 0.37 1.62 0.16 155 RCVD_IN_RP_SAFE 1060 8.07 1.61 9.17 156 XMHTML_After_End 1058 0.79 1.61 0.65 157 XM_JunkDunk 1043 0.23 1.59 0.00 158 XMLngstWrd_01 1041 0.54 1.59 0.37 159 TR_XM_COVIDMETA1 1038 0.40 1.58 0.20 160 XM_UB95 997 0.24 1.52 0.02 161 XMBdyGiftCard01 987 1.31 1.50 1.28 162 RELAYCOUNTRY_PT 961 0.22 1.46 0.00 163 URI_NO_WWW_INFO_CGI 960 0.23 1.46 0.02 164 XMBrknScrpt_02 948 0.92 1.44 0.83 165 XMLngstWrd_02 944 0.46 1.44 0.30 166 TR_LOTS_OF_MONEY3 940 0.71 1.43 0.58 167 DKIM_ADSP_CUSTOM_MED 939 0.85 1.43 0.76 168 URIBL_BLACK 924 0.22 1.41 0.02 169 MIME_QP_LONG_LINE 921 3.17 1.40 3.47 170 ALL_TRUSTED 920 25.40 1.40 29.47 171 MIME_CHARSET_FARAWAY 919 0.26 1.40 0.06 172 XM_B_Unsub2 913 1.31 1.39 1.30 173 XMSubMetaSxObfu_03 903 1.08 1.38 1.04 174 TR_Mismatch_TLD_01 899 0.35 1.37 0.18 175 CHARSET_FARAWAY_HEADER 888 0.21 1.35 0.02 176 XMLngstWrd_03 887 0.40 1.35 0.23 177 URI_HEX 887 1.30 1.35 1.30 178 NML_ADSP_CUSTOM_MED 880 0.62 1.34 0.50 179 XMDiploma_00 856 1.05 1.30 1.01 180 XMLngstWrd_04 827 0.34 1.26 0.18 181 TR_XM_DK_SendGrid 825 3.17 1.26 3.50 182 RELAYCOUNTRY_NL 809 0.29 1.23 0.13 183 XMStockSpam_06 805 1.17 1.23 1.16 184 FORGED_GMAIL_RCVD 795 0.53 1.21 0.41 185 HTML_FONT_TINY_NORDNS 786 0.39 1.20 0.25 186 MIME_HTML_ONLY_MULTI 775 2.54 1.18 2.77 187 MAILING_LIST_MULTI 752 1.30 1.15 1.33 188 URI_WP_DIRINDEX 742 0.17 1.13 0.00 189 T_TooManySym_02 729 2.88 1.11 3.18 190 T_MONEY_PERCENT 708 0.25 1.08 0.11 191 TR_LOTS_OF_MONEY2 708 0.25 1.08 0.11 192 XMReplyNow 703 0.20 1.07 0.05 193 RCVD_IN_MSPIKE_L4 692 0.18 1.05 0.03 194 TR_MetaPhish_Combo_01 686 0.69 1.05 0.63 195 XM_H_PHPMailer 682 0.51 1.04 0.42 196 HTML_SHORT_LINK_IMG_2 673 0.18 1.03 0.03 197 XMSlimDrugH 669 0.36 1.02 0.25 198 PDS_NAKED_TO_NUMERO 664 0.15 1.01 0.00 199 HTML_SHORT_LINK_IMG_3 653 0.18 0.99 0.04 200 RELAYCOUNTRY_CN 649 0.17 0.99 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 382737 98.93 98.05 99.08 2 HTML_MESSAGE 274839 74.10 91.46 71.15 3 RELAYCOUNTRY_US 258697 66.98 67.01 66.97 4 DKIM_SIGNED 251622 65.28 66.09 65.14 5 XM_DK_Pass 248490 64.07 62.53 64.33 6 DKIM_VALID 238732 60.75 54.53 61.80 7 XM_B_Unicode 230227 59.86 61.38 59.60 8 DKIM_VALID_AU 192322 48.08 38.05 49.79 9 XMListUnsubscribeExists 187842 50.44 61.12 48.63 10 BAYES_50 162113 40.93 34.80 41.97 11 XM_B_Unicode3 141255 36.18 33.90 36.57 12 ALL_TRUSTED 113855 25.40 1.40 29.47 13 BAYES_00 103498 23.41 3.47 26.79 14 HTML_FONT_LOW_CONTRAST 97258 25.37 26.52 25.18 15 LOC_TINY_FONT_1 94887 24.71 25.57 24.56 16 TM2_M_URI_OPT_OUT 88394 19.96 2.77 22.88 17 RCVD_IN_MSPIKE_WL 87536 20.63 8.66 22.66 18 DKIM_VALID_EF 86583 22.54 23.26 22.41 19 ANY_BOUNCE_MESSAGE 84898 18.88 0.66 21.98 20 BOUNCE_MESSAGE 84895 18.88 0.66 21.98 21 XM_Multi_Part_URI 80900 20.16 15.56 20.94 22 RCVD_IN_MSPIKE_H2 78109 20.60 22.83 20.22 23 MIME_HTML_ONLY 76248 21.29 30.40 19.74 24 FVGT_m_MULTI_ODD 74490 20.30 26.27 19.28 25 XMSubLong 71435 18.46 18.29 18.49 26 T_TM2_M_HEADER_IN_MSG 64880 17.41 21.00 16.80 27 T_KAM_HTML_FONT_INVALID 56373 14.80 16.02 14.59 28 RCVD_IN_MSPIKE_H3 49671 11.77 5.37 12.86 29 XM_Body_Dirty_Words 47846 12.71 14.64 12.39 30 XM_DK_Undo_02 44228 16.45 45.85 11.45 31 RCVD_IN_RP_SAFE 35417 8.07 1.61 9.17 32 XM_B_Unsub 33497 8.82 9.71 8.67 33 RCVD_IN_MSPIKE_H4 32927 7.75 3.19 8.52 34 RCVD_IN_RP_CERTIFIED 32780 7.34 0.62 8.49 35 XM_Evil_Numbers_Gen 32708 8.26 7.02 8.47 36 XM_DKIMWhitelistDomains 32250 7.14 0.01 8.35 37 HTML_IMAGE_RATIO_02 31692 9.13 14.58 8.20 38 BAYES_99 31186 12.19 36.41 8.07 39 LotsOfNums_01 28600 7.40 7.40 7.40 40 UNPARSEABLE_RELAY 26692 6.70 5.47 6.91 41 LOTS_OF_MONEY 26392 7.34 10.34 6.83 42 TR_XM_DK_Bayes 25809 5.80 0.61 6.68 43 BAYES_999 25063 9.70 28.60 6.49 44 TR_XM_DK_Bayes1 24609 5.51 0.47 6.37 45 BAYES_60 24147 6.50 7.96 6.25 46 XM_B_Phish_Phrases 23535 6.25 7.16 6.09 47 XM_SendGrid 22941 5.61 3.66 5.94 48 TR_XM_DK_Bayes2 22867 5.11 0.37 5.92 49 HTML_IMAGE_RATIO_04 20826 5.09 3.32 5.39 50 TooManyTo_001 20653 5.36 5.47 5.35 51 BOTNET_IPINHOSTNAME 20070 7.38 20.21 5.20 52 T_TooManySym_01 19751 4.75 2.58 5.11 53 XMSexyCombo_05 18878 5.49 9.04 4.89 54 XM_H_Long_From01 18117 4.77 5.27 4.69 55 T_XMDrugObfuBody_00 18029 4.23 1.68 4.67 56 RELAYCOUNTRY_META 17082 8.64 33.46 4.42 57 BAYES_80 16937 4.91 7.99 4.38 58 MPART_ALT_DIFF 16867 5.14 9.70 4.37 59 XMSubMetaSx_00 16545 4.67 6.96 4.28 60 XMStrtUSub 15075 3.73 2.73 3.90 61 BAYES_05 14276 3.27 0.76 3.70 62 IN_ZIMBRA_NJ_WHITELIST 14131 3.13 0.02 3.66 63 FROM_EXCESS_BASE64 13782 4.39 9.20 3.57 64 TR_XM_DK_SendGrid 13523 3.17 1.26 3.50 65 MIME_QP_LONG_LINE 13388 3.17 1.40 3.47 66 DKIM_INVALID 12890 4.53 11.55 3.34 67 BAYES_40 12407 3.04 2.04 3.21 68 T_TooManySym_02 12293 2.88 1.11 3.18 69 RCVD_IN_IADB_LISTED 12139 2.78 0.67 3.14 70 HTML_IMAGE_RATIO_06 11666 2.92 2.35 3.02 71 BAYES_20 11431 2.77 1.63 2.96 72 TR_XM_PhishingBody 11132 3.41 6.54 2.88 73 XM_UncommonTLD01 11123 6.57 28.29 2.88 74 XMNumbers 11111 3.12 4.58 2.88 75 MIME_HTML_ONLY_MULTI 10689 2.54 1.18 2.77 76 RCVD_IN_IADB_SPF 10658 2.44 0.57 2.76 77 BAYES_95 10282 2.99 4.93 2.66 78 RCVD_IN_IADB_SENDERID 9552 2.19 0.55 2.47 79 BOTNET 9402 7.14 34.84 2.43 80 RCVD_IN_IADB_DK 9374 2.15 0.55 2.43 81 T_REMOTE_IMAGE 9297 3.49 9.85 2.41 82 MIME_HTML_MOSTLY 8809 3.28 9.15 2.28 83 RELAYCOUNTRY_CA 8405 3.29 9.87 2.18 84 TVD_RCVD_IP 7994 1.85 0.53 2.07 85 XM_H_Trusted_IP 7719 1.71 0.00 2.00 86 HELO_MISC_IP 7447 1.79 0.98 1.93 87 CK_HELO_DYNAMIC_SPLIT_IP 7446 1.78 0.90 1.93 88 HTML_MIME_NO_HTML_TAG 7292 2.95 9.17 1.89 89 INVALID_MSGID 7285 2.07 3.15 1.89 90 XM_CamelCaseFrm001 7284 2.00 2.70 1.89 91 RCVD_IN_IADB_VOUCHED 6923 1.57 0.23 1.79 92 HTML_IMAGE_RATIO_08 6719 1.73 1.69 1.74 93 TO_MALFORMED 6476 1.44 0.03 1.68 94 NO_DNS_FOR_FROM 6458 2.61 8.16 1.67 95 TR_Symld_Words 6371 1.55 0.94 1.65 96 XM_PDF 6271 1.45 0.40 1.62 97 USER_IN_DEF_DKIM_WL 6196 1.37 0.00 1.60 98 RCVD_IN_BL_SPAMCOP_NET 5561 2.52 8.89 1.44 99 URI_TRY_3LD 5533 1.56 2.32 1.43 100 UNTRUSTED_Relay 5527 4.40 21.88 1.43 101 XM_B_Phish66 5477 1.87 4.55 1.42 102 XMBody_17 5242 1.74 3.97 1.36 103 MAILING_LIST_MULTI 5141 1.30 1.15 1.33 104 XM_B_Unsub2 5003 1.31 1.39 1.30 105 URI_HEX 5003 1.30 1.35 1.30 106 RCVD_IN_MSPIKE_H5 4938 1.11 0.09 1.28 107 XMBdyGiftCard01 4927 1.31 1.50 1.28 108 XM_B_SpammyTLD 4821 2.04 6.71 1.25 109 IN_HORDE_ADDRESS_BOOK 4749 1.06 0.07 1.23 110 SUBJ_ALL_CAPS 4569 1.46 3.11 1.18 111 XMStockSpam_06 4488 1.17 1.23 1.16 112 XM_DK_Undo_01 4460 1.13 0.98 1.15 113 XMSexyCombo_01 4369 1.22 1.72 1.13 114 RCVD_IN_IADB_OPTIN 4354 1.00 0.27 1.13 115 XM_ProductURIs 4160 1.05 0.90 1.08 116 T_XMDrugObfuBody_08 4041 1.25 2.47 1.05 117 XMSubMetaSxObfu_03 3999 1.08 1.38 1.04 118 XM_OfRef6 3973 1.52 4.44 1.03 119 XM_B_COVIDMETA 3946 1.35 3.26 1.02 120 XMDiploma_00 3903 1.05 1.30 1.01 121 XM_GoogleGroups 3787 0.90 0.39 0.98 122 T_XMDrugObfuBody_14 3773 1.10 1.85 0.98 123 HTML_FONT_FACE_BAD 3617 0.91 0.75 0.94 124 TooManyTo_002 3581 0.88 0.62 0.93 125 XM_RXBody 3545 1.07 1.95 0.92 126 XM_SPF_SoftFail 3490 1.60 5.70 0.90 127 T_TooManySym_03 3443 0.79 0.20 0.89 128 TM2_M_VERY_LONG_WORD 3385 1.02 1.87 0.88 129 XMSubNoVowel 3326 1.01 1.89 0.86 130 XMGappySubj_01 3317 0.75 0.14 0.86 131 XM_UB50 3212 1.69 6.72 0.83 132 KHOP_HELO_FCRDNS 3195 1.47 5.23 0.83 133 XMBrknScrpt_02 3189 0.92 1.44 0.83 134 XM_H_Long_From02 3116 0.81 0.84 0.81 135 T_XMHurry_00 2982 0.90 1.63 0.77 136 DKIM_ADSP_CUSTOM_MED 2917 0.85 1.43 0.76 137 XMSexyCombo_04 2793 0.72 0.70 0.72 138 TR_MSPIKEBAYES00 2731 0.60 0.00 0.71 139 TooManyTo_003 2603 0.64 0.41 0.67 140 XMBody_95 2594 0.60 0.15 0.67 141 XMHTML_After_End 2497 0.79 1.61 0.65 142 TR_MetaPhish_Combo_01 2427 0.69 1.05 0.63 143 XM_B_REG_HTML 2346 0.54 0.16 0.61 144 XMGenDplmaNmb 2330 0.64 0.87 0.60 145 XMPhish08 2272 0.60 0.64 0.59 146 TR_LOTS_OF_MONEY3 2253 0.71 1.43 0.58 147 HELO_NODOT 2209 1.00 3.52 0.57 148 HELO_NO_DOMAIN 2208 1.00 3.52 0.57 149 HTML_TAG_BALANCE_BODY 2203 0.56 0.52 0.57 150 TooManyTo_004 2202 0.54 0.38 0.57 151 XMSubMetaSx_01 2161 0.53 0.34 0.56 152 RCVD_IN_MSPIKE_BL 2143 2.32 12.70 0.55 153 XMSexyCombo_02 2028 0.47 0.14 0.53 154 T_FILL_THIS_FORM_SHORT 2011 0.69 1.70 0.52 155 RELAYCOUNTRY_GB 1994 0.72 1.95 0.52 156 NML_ADSP_CUSTOM_MED 1922 0.62 1.34 0.50 157 TooManyTo_005 1908 0.47 0.32 0.49 158 XM_DIRTYINTL 1900 1.04 4.25 0.49 159 SpammyFromTLD_01 1867 1.16 5.16 0.48 160 TM2_M_A_HREF_HREF 1858 0.47 0.40 0.48 161 USER_IN_WHITELIST 1836 0.41 0.00 0.48 162 XMPhish30 1783 0.52 0.84 0.46 163 URIBL_SBL_A 1729 0.99 4.17 0.45 164 XMSubMetaSxObfu_02 1692 0.43 0.36 0.44 165 TR_XM_UnparsRelay 1678 0.74 2.53 0.43 166 XM_B_COPY_HTML 1666 0.43 0.42 0.43 167 TR_BOTNET_NEGATE 1654 0.50 0.94 0.43 168 XM_H_PHPMailer 1641 0.51 1.04 0.42 169 RDNS_DYNAMIC 1598 0.61 1.74 0.41 170 XMLngstWrd_00 1592 0.60 1.69 0.41 171 HTTPS_HTTP_MISMATCH 1588 0.47 0.80 0.41 172 FORGED_GMAIL_RCVD 1585 0.53 1.21 0.41 173 RCVD_IN_MSPIKE_L3 1584 1.10 5.16 0.41 174 XMPhish14 1574 0.45 0.68 0.41 175 XMBody_78 1572 0.43 0.60 0.41 176 NUMERIC_HTTP_ADDR 1517 0.40 0.45 0.39 177 TR_XM_PHPDW 1510 0.79 3.14 0.39 178 XMHTMLBadTable_001 1480 0.40 0.47 0.38 179 DIET_1 1475 0.44 0.80 0.38 180 HTML_IMAGE_ONLY_20 1460 0.44 0.78 0.38 181 XMLngstWrd_01 1419 0.54 1.59 0.37 182 XMDateMe_00 1411 0.35 0.27 0.37 183 TR_XM_PHPForged 1395 0.76 3.12 0.36 184 PLING_QUERY 1383 0.75 3.02 0.36 185 TR_XM_FormFill2 1367 0.75 3.09 0.35 186 TR_XM_COVIDMETA4 1355 0.75 3.13 0.35 187 XM_H_PHPOS 1350 0.74 3.07 0.35 188 XM_D_tchamptons_WL 1350 0.30 0.01 0.35 189 DKIM_ADSP_NXDOMAIN 1348 1.45 7.96 0.35 190 XMBSHREFv2 1304 0.31 0.12 0.34 191 MPART_ALT_DIFF_COUNT 1297 0.68 2.68 0.34 192 MISSING_HEADERS 1205 0.78 3.53 0.31 193 T_Symld_Words_02 1195 0.53 1.79 0.31 194 URI_NOVOWEL 1195 0.36 0.62 0.31 195 XMCapTrack 1182 0.31 0.36 0.31 196 XMSubMetaI_00 1155 0.39 0.92 0.30 197 DATE_IN_PAST_06_12 1146 0.36 0.73 0.30 198 XMLngstWrd_02 1141 0.46 1.44 0.30 199 HTML_TEXT_INVISIBLE_STYLE 1109 0.28 0.24 0.29 200 XMMoneyMeta_00 1108 1.14 6.16 0.29 ----------------------------------------------------------------------