Email: 554035 Autolearn: 0 AvgScore: 1.21 AvgScanTime: 1.42 sec Spam: 93245 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 2.54 sec Ham: 460790 Autolearn: 0 AvgScore: -1.39 AvgScanTime: 1.20 sec Time Spent Running SA: 219.16 hours Time Spent Processing Spam: 65.84 hours Time Spent Processing Ham: 153.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 92112 99.20 98.78 99.28 2 HTML_MESSAGE 88972 69.15 95.42 63.84 3 RELAYCOUNTRY_US 49318 58.03 52.89 59.07 4 DKIM_SIGNED 49242 56.84 52.81 57.65 5 XM_DK_Pass 47207 55.87 50.63 56.93 6 XM_B_Unicode 45566 52.38 48.87 53.10 7 XMListUnsubscribeExists 44200 44.29 47.40 43.66 8 RELAYCOUNTRY_META 43099 10.95 46.22 3.81 9 DKIM_VALID 40619 52.73 43.56 54.59 10 MIME_HTML_ONLY 38619 21.92 41.42 17.98 11 BAYES_50 35832 35.93 38.43 35.43 12 BAYES_99 35004 13.09 37.54 8.14 13 XM_DK_Undo_02 34547 15.59 37.05 11.25 14 UNTRUSTED_Relay 33989 7.20 36.45 1.29 15 BOTNET 31793 7.71 34.10 2.37 16 DKIM_VALID_AU 29447 41.56 31.58 43.58 17 BAYES_999 27761 10.51 29.77 6.62 18 LOTS_OF_MONEY 24395 8.93 26.16 5.45 19 XM_B_Unicode3 23943 31.05 25.68 32.14 20 XM_UncommonTLD01 22889 6.10 24.55 2.36 21 HTML_MIME_NO_HTML_TAG 22414 6.06 24.04 2.42 22 DKIM_VALID_EF 21040 19.75 22.56 19.18 23 FVGT_m_MULTI_ODD 18891 17.79 20.26 17.29 24 T_REMOTE_IMAGE 18779 5.88 20.14 3.00 25 RCVD_IN_MSPIKE_H2 17428 17.88 18.69 17.71 26 LOC_TINY_FONT_1 17185 21.09 18.43 21.63 27 XM_UB50 17179 3.73 18.42 0.76 28 BOTNET_IPINHOSTNAME 16265 7.04 17.44 4.94 29 FROM_EXCESS_BASE64 16214 5.26 17.39 2.80 30 FROM_SUSPICIOUS_NTLD 15681 2.85 16.82 0.03 31 FROM_SUSPICIOUS_NTLD_FP 15603 2.83 16.73 0.02 32 REPLYTO_WITHOUT_TO_CC 15252 2.87 16.36 0.14 33 SpammyFromTLD_02 15159 2.85 16.26 0.14 34 MISSING_HEADERS 15101 2.94 16.19 0.26 35 HELO_NO_DOMAIN 15001 3.07 16.09 0.44 36 HELO_NODOT 15001 3.07 16.09 0.44 37 HTML_FONT_LOW_CONTRAST 14861 21.55 15.94 22.69 38 TR_LOTS_OF_MONEY1 14783 2.70 15.85 0.04 39 XMSubLong 14657 15.60 15.72 15.58 40 RELAYCOUNTRY_UG 14557 2.66 15.61 0.04 41 BODY_URI_ONLY 14489 2.64 15.54 0.03 42 HTML_TAG_BALANCE_CENTER 14320 2.65 15.36 0.08 43 HDRS_MISSP 14241 2.61 15.27 0.05 44 DKIM_ADSP_NXDOMAIN 14141 2.74 15.17 0.23 45 T_TM2_M_HEADER_IN_MSG 13012 15.41 13.95 15.70 46 SUBJ_ALL_CAPS 12650 3.16 13.57 1.06 47 RCVD_IN_BL_SPAMCOP_NET 12315 3.20 13.21 1.17 48 XMSexyCombo_05 11682 5.37 12.53 3.92 49 ADVANCE_FEE_4_NEW_MONEY 11498 2.08 12.33 0.00 50 MONEY_ATM_CARD 11483 2.10 12.31 0.03 51 T_KAM_HTML_FONT_INVALID 11049 13.07 11.85 13.32 52 XM_Body_Dirty_Words 10840 10.62 11.63 10.41 53 XM_Multi_Part_URI 10408 21.62 11.16 23.74 54 HTML_IMAGE_RATIO_02 10128 7.53 10.86 6.85 55 BOTNET_NORDNS 9395 1.70 10.08 0.01 56 XMSubMetaSx_00 9249 4.34 9.92 3.21 57 DKIM_INVALID 8623 4.11 9.25 3.07 58 XM_B_Unsub 8472 7.66 9.09 7.37 59 XM_JunkDunk 7267 1.31 7.79 0.00 60 XM_UB99 7147 1.29 7.66 0.00 61 BAYES_80 6687 4.57 7.17 4.05 62 RELAYCOUNTRY_CA 6660 2.65 7.14 1.74 63 LotsOfNums_01 6267 6.72 6.72 6.72 64 RCVD_IN_MSPIKE_BL 6079 1.65 6.52 0.66 65 NO_DNS_FOR_FROM 5914 2.34 6.34 1.53 66 BAYES_60 5605 6.26 6.01 6.32 67 XM_OfRef6 5528 1.75 5.93 0.90 68 XM_UB999 5518 1.00 5.92 0.00 69 RCVD_IN_MSPIKE_WL 5225 17.90 5.60 20.39 70 HK_RANDOM_FROM 5159 1.00 5.53 0.08 71 XM_B_Phish_Phrases 4837 5.39 5.19 5.43 72 XM_Evil_Numbers_Gen 4716 6.78 5.06 7.13 73 TR_XM_PhishingBody 4702 2.82 5.04 2.37 74 BAYES_95 4659 2.92 5.00 2.50 75 DIET_1 4348 1.16 4.66 0.45 76 SpammyFromTLD_01 4201 1.07 4.51 0.38 77 MPART_ALT_DIFF 4057 3.68 4.35 3.54 78 UNPARSEABLE_RELAY 3966 5.79 4.25 6.11 79 RELAYCOUNTRY_IT 3890 0.73 4.17 0.04 80 KHOP_HELO_FCRDNS 3876 1.26 4.16 0.67 81 XMNumbers 3867 2.51 4.15 2.18 82 XM_DK_Undo_01 3811 1.56 4.09 1.05 83 RELAYCOUNTRY_FR 3747 0.82 4.02 0.17 84 TR_Mismatch_TLD_01 3687 0.86 3.95 0.24 85 XMSubEmpty 3667 0.82 3.93 0.19 86 RCVD_IN_RP_RNBL 3640 0.69 3.90 0.04 87 DEAR_FRIEND 3615 0.73 3.88 0.10 88 BAD_ENC_HEADER 3589 0.66 3.85 0.02 89 XMAntiAgeing 3527 0.64 3.78 0.01 90 RCVD_IN_MSPIKE_L3 3509 0.97 3.76 0.41 91 TR_Sbj_FN_Bdy 3500 0.79 3.75 0.19 92 TooManyTo_001 3372 4.50 3.62 4.68 93 MISSING_SUBJECT 3317 0.67 3.56 0.09 94 XMNoSubject 3317 0.67 3.56 0.09 95 URIBL_SBL_A 3255 0.77 3.49 0.21 96 XM_B_Phish66 3246 1.55 3.48 1.16 97 XM_H_Long_From01 3243 4.78 3.48 5.04 98 DATE_IN_PAST_03_06 3240 0.68 3.47 0.11 99 XM_DIRTYINTL 3239 0.96 3.47 0.46 100 MONEY_FORM_SHORT 3181 0.58 3.41 0.00 101 XMBody_17 3156 1.28 3.38 0.85 102 TR_XM_INV_DKIM 3055 0.71 3.28 0.19 103 BAYES_40 3037 3.29 3.26 3.30 104 MIME_HTML_MOSTLY 2973 2.10 3.19 1.88 105 HTML_IMAGE_RATIO_04 2902 4.50 3.11 4.78 106 TR_XM_MaxSPIKE 2881 0.59 3.09 0.09 107 URI_PHP_REDIR 2800 0.56 3.00 0.07 108 PDS_OTHER_BAD_TLD 2795 0.81 3.00 0.37 109 XMLngstWrd_00 2785 0.74 2.99 0.28 110 SUBJ_ILLEGAL_CHARS 2694 0.50 2.89 0.01 111 XM_SPF_SoftFail 2666 1.13 2.86 0.78 112 XM_SendGrid 2642 4.89 2.83 5.30 113 RELAYCOUNTRY_SG 2630 0.52 2.82 0.05 114 TR_XM_MaxBayes 2619 0.52 2.81 0.06 115 XM_B_SpammyTLD 2611 1.57 2.80 1.32 116 RCVD_IN_MSPIKE_H4 2595 6.75 2.78 7.55 117 RCVD_IN_MSPIKE_H3 2549 10.10 2.73 11.59 118 XM_UB80 2537 0.48 2.72 0.03 119 TR_XM_UnparsRelay 2436 0.87 2.61 0.51 120 XMBrknScrpt_02 2422 1.10 2.60 0.79 121 ALL_TRUSTED 2342 31.99 2.51 37.96 122 RCVD_IN_MSPIKE_L5 2270 0.58 2.43 0.21 123 XMStrtUSub 2269 3.10 2.43 3.24 124 XM_UB60 2162 0.46 2.32 0.08 125 XM_UB95 2117 0.40 2.27 0.02 126 T_XMDrugObfuBody_08 2066 1.49 2.22 1.35 127 TR_XM_COVIDMETA4 2011 0.65 2.16 0.35 128 TR_XM_MaxWHORU 1977 0.39 2.12 0.04 129 XMLngstWrd_01 1975 0.57 2.12 0.26 130 RCVD_IN_PSBL 1943 0.41 2.08 0.07 131 XM_BadFromFormat 1860 0.43 1.99 0.11 132 T_Symld_Words_02 1788 0.56 1.92 0.29 133 TR_Symld_Words 1768 1.09 1.90 0.93 134 TR_XM_PHPDW 1753 0.58 1.88 0.32 135 TR_LOTS_OF_MONEY3 1726 0.91 1.85 0.72 136 RELAYCOUNTRY_DE 1720 0.48 1.84 0.20 137 TR_XM_PHPForged 1701 0.56 1.82 0.30 138 TR_XM_FormFill2 1692 0.55 1.81 0.30 139 XM_H_PHPOS 1687 0.55 1.81 0.30 140 HTML_IMAGE_RATIO_06 1678 2.66 1.80 2.84 141 URI_WP_DIRINDEX 1654 0.38 1.77 0.10 142 XMSexyCombo_01 1652 0.72 1.77 0.50 143 LongTLD 1608 0.37 1.72 0.10 144 T_TooManySym_01 1513 3.13 1.62 3.43 145 XM_B_COVIDMETA 1458 0.91 1.56 0.78 146 TM2_M_URI_OPT_OUT 1414 25.65 1.52 30.53 147 XM_CamelCaseFrm001 1387 1.64 1.49 1.67 148 HTML_IMAGE_ONLY_16 1365 0.40 1.46 0.18 149 XMBdyGiftCard01 1359 1.15 1.46 1.09 150 XM_URI_RBL 1310 0.37 1.40 0.16 151 MIME_HTML_ONLY_MULTI 1285 2.14 1.38 2.29 152 XM_OfRef7 1281 0.34 1.37 0.13 153 URI_TRY_3LD 1267 1.15 1.36 1.11 154 RELAYCOUNTRY_GB 1259 0.56 1.35 0.41 155 HTML_IMAGE_RATIO_08 1250 1.70 1.34 1.77 156 XMLngstWrd_02 1235 0.40 1.32 0.21 157 MIME_QP_LONG_LINE 1198 2.83 1.28 3.14 158 T_XMHurry_00 1195 0.59 1.28 0.45 159 URI_WP_HACKED_2 1174 0.27 1.26 0.07 160 XMSubNoVowel 1168 0.81 1.25 0.72 161 XMHTML_After_End 1158 0.83 1.24 0.75 162 XMBody_78 1104 0.48 1.18 0.34 163 MPART_ALT_DIFF_COUNT 1099 0.41 1.18 0.26 164 XMDiploma_00 1096 0.88 1.18 0.83 165 T_XMDrugObfuBody_14 1074 0.96 1.15 0.92 166 URI_HEX 1062 1.21 1.14 1.23 167 TR_XM_RelayPhish 1061 0.29 1.14 0.12 168 TR_XM_DK_SendGrid 1023 2.74 1.10 3.07 169 XM_B_Unsub2 1015 1.01 1.09 0.99 170 MIME_CHARSET_FARAWAY 1000 0.33 1.07 0.18 171 FVGT_m_MULTI_ODD_EMAIL 992 0.20 1.06 0.03 172 RELAYCOUNTRY_NL 991 0.30 1.06 0.15 173 DKIM_ADSP_CUSTOM_MED 988 1.58 1.06 1.69 174 XMSubMetaSx_01 970 0.22 1.04 0.05 175 URIBL_BLACK 952 0.18 1.02 0.01 176 RELAYCOUNTRY_AU 950 0.39 1.02 0.26 177 RELAYCOUNTRY_JP 947 0.18 1.02 0.02 178 FROM_LOCAL_NOVOWEL 946 0.19 1.01 0.03 179 XMStockSpam_06 946 0.85 1.01 0.81 180 BAYES_20 940 3.82 1.01 4.39 181 T_XMDrugObfuBody_00 937 6.34 1.00 7.42 182 NML_ADSP_CUSTOM_MED 901 1.33 0.97 1.40 183 DATE_IN_PAST_06_12 899 0.36 0.96 0.24 184 TM2_M_VERY_LONG_WORD 897 0.95 0.96 0.95 185 FILL_THIS_FORM 890 0.28 0.95 0.14 186 XMSexyCombo_04 885 0.32 0.95 0.19 187 XMSubjUTF8 875 0.16 0.94 0.00 188 CHARSET_FARAWAY_HEADER 867 0.17 0.93 0.01 189 MAILING_LIST_MULTI 842 1.30 0.90 1.38 190 XM_SPF_Unknown 826 0.36 0.89 0.26 191 TR_Mismatch_TLD_02 808 0.19 0.87 0.05 192 URI_NO_WWW_INFO_CGI 806 0.16 0.86 0.02 193 FORGED_GMAIL_RCVD 803 1.28 0.86 1.37 194 XMSlimDrugH 803 0.35 0.86 0.24 195 HTML_IMAGE_ONLY_20 800 0.45 0.86 0.37 196 PLING_QUERY 793 0.60 0.85 0.55 197 XMSubMetaI_00 791 0.86 0.85 0.86 198 XM_iOS_Forged_Message 773 0.16 0.83 0.03 199 NORDNS_LOW_CONTRAST 768 0.14 0.82 0.00 200 BAYES_00 749 23.94 0.80 28.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 457478 99.20 98.78 99.28 2 HTML_MESSAGE 294146 69.15 95.42 63.84 3 RELAYCOUNTRY_US 272186 58.03 52.89 59.07 4 DKIM_SIGNED 265652 56.84 52.81 57.65 5 XM_DK_Pass 262348 55.87 50.63 56.93 6 DKIM_VALID 251525 52.73 43.56 54.59 7 XM_B_Unicode 244663 52.38 48.87 53.10 8 XMListUnsubscribeExists 201185 44.29 47.40 43.66 9 DKIM_VALID_AU 200817 41.56 31.58 43.58 10 ALL_TRUSTED 174916 31.99 2.51 37.96 11 BAYES_50 163246 35.93 38.43 35.43 12 XM_B_Unicode3 148075 31.05 25.68 32.14 13 TM2_M_URI_OPT_OUT 140673 25.65 1.52 30.53 14 ANY_BOUNCE_MESSAGE 139686 25.31 0.58 30.31 15 BOUNCE_MESSAGE 139683 25.31 0.58 30.31 16 BAYES_00 131871 23.94 0.80 28.62 17 XM_Multi_Part_URI 109370 21.62 11.16 23.74 18 HTML_FONT_LOW_CONTRAST 104559 21.55 15.94 22.69 19 LOC_TINY_FONT_1 99665 21.09 18.43 21.63 20 RCVD_IN_MSPIKE_WL 93938 17.90 5.60 20.39 21 DKIM_VALID_EF 88395 19.75 22.56 19.18 22 MIME_HTML_ONLY 82839 21.92 41.42 17.98 23 RCVD_IN_MSPIKE_H2 81619 17.88 18.69 17.71 24 FVGT_m_MULTI_ODD 79663 17.79 20.26 17.29 25 T_TM2_M_HEADER_IN_MSG 72362 15.41 13.95 15.70 26 XMSubLong 71784 15.60 15.72 15.58 27 T_KAM_HTML_FONT_INVALID 61360 13.07 11.85 13.32 28 RCVD_IN_MSPIKE_H3 53402 10.10 2.73 11.59 29 XM_DK_Undo_02 51845 15.59 37.05 11.25 30 XM_Body_Dirty_Words 47982 10.62 11.63 10.41 31 BAYES_99 37501 13.09 37.54 8.14 32 RCVD_IN_RP_SAFE 37157 6.79 0.47 8.06 33 RCVD_IN_MSPIKE_H4 34798 6.75 2.78 7.55 34 RCVD_IN_RP_CERTIFIED 34490 6.27 0.27 7.48 35 T_XMDrugObfuBody_00 34188 6.34 1.00 7.42 36 XM_B_Unsub 33970 7.66 9.09 7.37 37 BAYES_05 33472 6.17 0.78 7.26 38 XM_Evil_Numbers_Gen 32863 6.78 5.06 7.13 39 HTML_IMAGE_RATIO_02 31587 7.53 10.86 6.85 40 XM_DKIMWhitelistDomains 31529 5.69 0.01 6.84 41 LotsOfNums_01 30988 6.72 6.72 6.72 42 BAYES_999 30483 10.51 29.77 6.62 43 TR_XM_DK_Bayes 29591 5.43 0.51 6.42 44 BAYES_60 29103 6.26 6.01 6.32 45 TR_XM_DK_Bayes1 28155 5.14 0.36 6.11 46 UNPARSEABLE_RELAY 28138 5.79 4.25 6.11 47 TR_XM_DK_Bayes2 25817 4.68 0.13 5.60 48 LOTS_OF_MONEY 25094 8.93 26.16 5.45 49 XM_B_Phish_Phrases 25027 5.39 5.19 5.43 50 XM_SendGrid 24444 4.89 2.83 5.30 51 XM_H_Long_From01 23240 4.78 3.48 5.04 52 BOTNET_IPINHOSTNAME 22756 7.04 17.44 4.94 53 HTML_IMAGE_RATIO_04 22039 4.50 3.11 4.78 54 TooManyTo_001 21570 4.50 3.62 4.68 55 BAYES_20 20231 3.82 1.01 4.39 56 BAYES_80 18653 4.57 7.17 4.05 57 XMSexyCombo_05 18045 5.37 12.53 3.92 58 RELAYCOUNTRY_META 17556 10.95 46.22 3.81 59 MPART_ALT_DIFF 16319 3.68 4.35 3.54 60 T_TooManySym_01 15815 3.13 1.62 3.43 61 BAYES_40 15186 3.29 3.26 3.30 62 IN_ZIMBRA_NJ_WHITELIST 14966 2.70 0.01 3.25 63 XMStrtUSub 14925 3.10 2.43 3.24 64 XMSubMetaSx_00 14800 4.34 9.92 3.21 65 MIME_QP_LONG_LINE 14467 2.83 1.28 3.14 66 TR_XM_DK_SendGrid 14138 2.74 1.10 3.07 67 DKIM_INVALID 14127 4.11 9.25 3.07 68 T_REMOTE_IMAGE 13805 5.88 20.14 3.00 69 RCVD_IN_IADB_LISTED 13286 2.47 0.44 2.88 70 HTML_IMAGE_RATIO_06 13087 2.66 1.80 2.84 71 FROM_EXCESS_BASE64 12925 5.26 17.39 2.80 72 BAYES_95 11521 2.92 5.00 2.50 73 RCVD_IN_IADB_SPF 11461 2.14 0.40 2.49 74 HTML_MIME_NO_HTML_TAG 11165 6.06 24.04 2.42 75 TR_XM_PhishingBody 10924 2.82 5.04 2.37 76 BOTNET 10918 7.71 34.10 2.37 77 XM_UncommonTLD01 10885 6.10 24.55 2.36 78 MIME_HTML_ONLY_MULTI 10561 2.14 1.38 2.29 79 RCVD_IN_IADB_SENDERID 10301 1.92 0.38 2.24 80 XMNumbers 10039 2.51 4.15 2.18 81 RCVD_IN_IADB_DK 9943 1.86 0.39 2.16 82 T_TooManySym_02 8972 1.73 0.68 1.95 83 TVD_RCVD_IP 8898 1.64 0.22 1.93 84 MIME_HTML_MOSTLY 8649 2.10 3.19 1.88 85 HTML_IMAGE_RATIO_08 8144 1.70 1.34 1.77 86 RELAYCOUNTRY_CA 8015 2.65 7.14 1.74 87 RCVD_IN_IADB_VOUCHED 7997 1.46 0.12 1.74 88 DKIM_ADSP_CUSTOM_MED 7773 1.58 1.06 1.69 89 XM_CamelCaseFrm001 7676 1.64 1.49 1.67 90 HELO_MISC_IP 7663 1.51 0.77 1.66 91 CK_HELO_DYNAMIC_SPLIT_IP 7661 1.48 0.55 1.66 92 XM_H_Trusted_IP 7337 1.32 0.00 1.59 93 INVALID_MSGID 7238 1.39 0.48 1.57 94 XM_PDF 7237 1.35 0.26 1.57 95 NO_DNS_FOR_FROM 7037 2.34 6.34 1.53 96 TO_MALFORMED 6657 1.20 0.01 1.44 97 NML_ADSP_CUSTOM_MED 6473 1.33 0.97 1.40 98 MAILING_LIST_MULTI 6351 1.30 0.90 1.38 99 FORGED_GMAIL_RCVD 6304 1.28 0.86 1.37 100 T_XMDrugObfuBody_08 6210 1.49 2.22 1.35 101 XM_B_SpammyTLD 6073 1.57 2.80 1.32 102 USER_IN_DEF_DKIM_WL 5942 1.07 0.01 1.29 103 UNTRUSTED_Relay 5925 7.20 36.45 1.29 104 RCVD_IN_MSPIKE_H5 5738 1.05 0.09 1.25 105 URI_HEX 5652 1.21 1.14 1.23 106 XM_ProductURIs 5582 1.12 0.68 1.21 107 RCVD_IN_BL_SPAMCOP_NET 5412 3.20 13.21 1.17 108 XM_B_Phish66 5360 1.55 3.48 1.16 109 IN_HORDE_ADDRESS_BOOK 5188 0.94 0.03 1.13 110 URI_TRY_3LD 5096 1.15 1.36 1.11 111 RCVD_IN_IADB_OPTIN 5060 0.94 0.14 1.10 112 XMBdyGiftCard01 5007 1.15 1.46 1.09 113 XM_H_Long_From02 4934 1.01 0.69 1.07 114 HTML_FONT_SIZE_HUGE 4905 0.98 0.54 1.06 115 SUBJ_ALL_CAPS 4862 3.16 13.57 1.06 116 XM_DK_Undo_01 4837 1.56 4.09 1.05 117 XM_B_Unsub2 4572 1.01 1.09 0.99 118 TM2_M_VERY_LONG_WORD 4387 0.95 0.96 0.95 119 TR_Symld_Words 4294 1.09 1.90 0.93 120 T_XMDrugObfuBody_14 4262 0.96 1.15 0.92 121 XM_GoogleGroups 4252 0.82 0.32 0.92 122 XM_OfRef6 4164 1.75 5.93 0.90 123 XMSubMetaI_00 3972 0.86 0.85 0.86 124 XMBody_17 3908 1.28 3.38 0.85 125 XMDiploma_00 3805 0.88 1.18 0.83 126 XMStockSpam_06 3737 0.85 1.01 0.81 127 TooManyTo_002 3654 0.72 0.37 0.79 128 XMBrknScrpt_02 3646 1.10 2.60 0.79 129 XM_SPF_SoftFail 3605 1.13 2.86 0.78 130 XM_B_COVIDMETA 3596 0.91 1.56 0.78 131 XM_UB50 3503 3.73 18.42 0.76 132 XMGappySubj_01 3495 0.69 0.36 0.76 133 XMHTML_After_End 3456 0.83 1.24 0.75 134 HTML_FONT_FACE_BAD 3403 0.73 0.69 0.74 135 TR_LOTS_OF_MONEY3 3329 0.91 1.85 0.72 136 XMSubNoVowel 3302 0.81 1.25 0.72 137 KHOP_HELO_FCRDNS 3081 1.26 4.16 0.67 138 RCVD_IN_MSPIKE_BL 3050 1.65 6.52 0.66 139 TR_MSPIKEBAYES00 2932 0.53 0.00 0.64 140 T_TooManySym_03 2842 0.58 0.41 0.62 141 XMBody_95 2838 0.53 0.13 0.62 142 PLING_QUERY 2513 0.60 0.85 0.55 143 TooManyTo_003 2478 0.49 0.24 0.54 144 TR_XM_UnparsRelay 2360 0.87 2.61 0.51 145 T_FILL_THIS_FORM_SHORT 2331 0.54 0.73 0.51 146 XM_B_REG_HTML 2326 0.45 0.17 0.50 147 XMSexyCombo_01 2320 0.72 1.77 0.50 148 TR_MetaPhish_Combo_01 2241 0.50 0.56 0.49 149 NUMERIC_HTTP_ADDR 2126 0.45 0.40 0.46 150 XMGenDplmaNmb 2104 0.47 0.52 0.46 151 XM_DIRTYINTL 2103 0.96 3.47 0.46 152 HTML_TAG_BALANCE_BODY 2095 0.46 0.47 0.45 153 DIET_1 2079 1.16 4.66 0.45 154 T_XMHurry_00 2069 0.59 1.28 0.45 155 XMSubMetaSxObfu_02 2058 0.41 0.26 0.45 156 HELO_NODOT 2017 3.07 16.09 0.44 157 HELO_NO_DOMAIN 2015 3.07 16.09 0.44 158 XMPhish08 2013 0.44 0.46 0.44 159 TooManyTo_004 2008 0.40 0.22 0.44 160 XMSubMetaSxObfu_03 2005 0.48 0.68 0.44 161 XMPhish30 1967 0.44 0.50 0.43 162 RELAYCOUNTRY_GB 1868 0.56 1.35 0.41 163 RCVD_IN_MSPIKE_L3 1867 0.97 3.76 0.41 164 TR_BOTNET_NEGATE 1844 0.38 0.26 0.40 165 SpammyFromTLD_01 1735 1.07 4.51 0.38 166 PDS_OTHER_BAD_TLD 1720 0.81 3.00 0.37 167 HTML_IMAGE_ONLY_20 1699 0.45 0.86 0.37 168 USER_IN_WHITELIST 1677 0.30 0.00 0.36 169 XM_B_COPY_HTML 1676 0.35 0.26 0.36 170 XM_H_PHPMailer 1675 0.43 0.78 0.36 171 HTTPS_HTTP_MISMATCH 1668 0.37 0.39 0.36 172 SUBJ_DOLLARS 1666 0.41 0.63 0.36 173 THIS_AD 1633 0.33 0.19 0.35 174 TooManyTo_005 1625 0.33 0.19 0.35 175 TR_XM_COVIDMETA4 1604 0.65 2.16 0.35 176 LOW_PRICE 1600 0.39 0.61 0.35 177 XMHTMLBadTable_001 1593 0.32 0.21 0.35 178 XMPhish14 1575 0.39 0.64 0.34 179 XM_RXBody 1569 0.34 0.37 0.34 180 XMBody_78 1544 0.48 1.18 0.34 181 TR_XM_PHPDW 1486 0.58 1.88 0.32 182 URI_NOVOWEL 1473 0.34 0.44 0.32 183 RDNS_DYNAMIC 1472 0.38 0.68 0.32 184 XMMoneyMeta_00 1442 0.33 0.43 0.31 185 T_OBFU_PDF_ATTACH 1398 0.26 0.03 0.30 186 TR_XM_PHPForged 1389 0.56 1.82 0.30 187 TR_XM_FormFill2 1378 0.55 1.81 0.30 188 XM_H_PHPOS 1363 0.55 1.81 0.30 189 XMBSHREFv2 1325 0.28 0.23 0.29 190 T_Symld_Words_02 1324 0.56 1.92 0.29 191 XMOemUri 1305 0.27 0.19 0.28 192 XMNoVowels 1304 0.32 0.53 0.28 193 XMLngstWrd_00 1299 0.74 2.99 0.28 194 TM2_M_A_HREF_HREF 1289 0.35 0.71 0.28 195 XM_Ancestry_Forge 1234 0.23 0.04 0.27 196 RELAYCOUNTRY_AU 1207 0.39 1.02 0.26 197 MISSING_HEADERS 1202 2.94 16.19 0.26 198 XMCapTrack 1180 0.26 0.26 0.26 199 XM_SPF_Unknown 1180 0.36 0.89 0.26 200 MPART_ALT_DIFF_COUNT 1177 0.41 1.18 0.26 ----------------------------------------------------------------------