Email: 544160 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 1.82 sec Spam: 71762 Autolearn: 0 AvgScore: 12.05 AvgScanTime: 3.97 sec Ham: 472398 Autolearn: 0 AvgScore: -2.92 AvgScanTime: 1.49 sec Time Spent Running SA: 275.29 hours Time Spent Processing Spam: 79.13 hours Time Spent Processing Ham: 196.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 69954 98.72 97.48 98.91 2 HTML_MESSAGE 65174 85.55 90.82 84.75 3 DKIM_SIGNED 55740 72.61 77.67 71.85 4 XM_B_Unicode 54493 69.95 75.94 69.05 5 XM_DK_Pass 53552 71.20 74.62 70.68 6 RELAYCOUNTRY_US 50754 77.77 70.73 78.84 7 XMListUnsubscribeExists 47724 52.66 66.50 50.55 8 DKIM_VALID 43769 66.28 60.99 67.09 9 XM_DK_Undo_02 39201 18.35 54.63 12.84 10 XM_B_Unicode3 31064 42.08 43.29 41.89 11 DKIM_VALID_AU 30792 50.47 42.91 51.62 12 BAYES_99 28186 12.74 39.28 8.71 13 BAYES_50 25384 46.61 35.37 48.31 14 LOC_TINY_FONT_1 23618 27.07 32.91 26.19 15 BAYES_999 22035 10.26 30.71 7.15 16 BOTNET 21436 6.58 29.87 3.05 17 MIME_HTML_ONLY 21312 22.31 29.70 21.18 18 RELAYCOUNTRY_META 21308 8.52 29.69 5.31 19 HTML_FONT_LOW_CONTRAST 19820 27.00 27.62 26.91 20 RCVD_IN_MSPIKE_H2 19474 22.92 27.14 22.28 21 FVGT_m_MULTI_ODD 18383 20.50 25.62 19.73 22 DKIM_VALID_EF 16742 25.62 23.33 25.97 23 XMSubLong 16477 18.39 22.96 17.70 24 XM_Multi_Part_URI 15896 16.54 22.15 15.69 25 XM_Body_Dirty_Words 15308 16.24 21.33 15.46 26 T_KAM_HTML_FONT_INVALID 15201 18.99 21.18 18.66 27 T_TM2_M_HEADER_IN_MSG 14354 21.75 20.00 22.01 28 UNTRUSTED_Relay 13457 4.77 18.75 2.65 29 BOTNET_IPINHOSTNAME 12664 7.16 17.65 5.57 30 DKIM_INVALID 11971 6.33 16.68 4.76 31 XM_UncommonTLD01 10668 4.44 14.87 2.86 32 NO_DNS_FOR_FROM 9779 4.30 13.63 2.88 33 XM_B_Unsub 9468 13.82 13.19 13.91 34 XMSexyCombo_05 9098 5.72 12.68 4.67 35 LOTS_OF_MONEY 8975 7.58 12.51 6.83 36 RCVD_IN_MSPIKE_BL 8460 2.16 11.79 0.70 37 LotsOfNums_01 7620 8.65 10.62 8.35 38 XM_B_Phish_Phrases 7338 6.51 10.23 5.95 39 HTML_IMAGE_RATIO_02 7216 7.75 10.06 7.40 40 XM_Evil_Numbers_Gen 6807 8.29 9.49 8.11 41 RCVD_IN_BL_SPAMCOP_NET 6526 2.59 9.09 1.60 42 XMSubMetaSx_00 6333 4.13 8.83 3.42 43 RELAYCOUNTRY_CA 6014 2.60 8.38 1.72 44 MPART_ALT_DIFF 5897 7.09 8.22 6.91 45 RCVD_IN_MSPIKE_WL 5831 22.16 8.13 24.30 46 BAYES_80 5648 4.73 7.87 4.26 47 TooManyTo_001 5497 7.34 7.66 7.29 48 RCVD_IN_RP_RNBL 5436 1.09 7.58 0.10 49 BAYES_60 5089 6.56 7.09 6.48 50 XM_UB50 4971 2.11 6.93 1.38 51 UNPARSEABLE_RELAY 4916 7.41 6.85 7.50 52 MIME_HTML_MOSTLY 4553 3.33 6.34 2.87 53 HTML_IMAGE_RATIO_04 4292 6.75 5.98 6.87 54 SpammyFromTLD_01 4229 1.27 5.89 0.57 55 RCVD_IN_MSPIKE_L5 4130 1.00 5.76 0.28 56 TR_XM_PhishingBody 4033 3.11 5.62 2.73 57 XM_H_Long_From01 3910 4.96 5.45 4.89 58 XM_DIRTYINTL 3873 1.39 5.40 0.78 59 XM_SendGrid 3791 6.51 5.28 6.69 60 TR_XM_INV_DKIM 3779 0.95 5.27 0.29 61 XM_SPF_SoftFail 3746 1.91 5.22 1.40 62 XMBrknScrpt_02 3611 1.76 5.03 1.27 63 XMNumbers 3598 3.58 5.01 3.37 64 BOTNET_NORDNS 3408 0.64 4.75 0.01 65 RCVD_IN_MSPIKE_H3 3362 12.89 4.68 14.13 66 HTML_IMAGE_RATIO_06 3254 4.02 4.53 3.94 67 RCVD_IN_PSBL 3165 0.80 4.41 0.25 68 XM_UB99 3152 0.58 4.39 0.01 69 BAYES_95 3115 2.87 4.34 2.64 70 RCVD_IN_MSPIKE_L3 3030 0.88 4.22 0.38 71 SUBJ_ALL_CAPS 3011 1.78 4.20 1.42 72 HTML_IMAGE_RATIO_08 2941 2.77 4.10 2.57 73 XM_B_SpammyTLD 2940 2.14 4.10 1.85 74 TM2_M_URI_OPT_OUT 2878 8.32 4.01 8.98 75 TR_XM_MaxWHORU 2855 0.59 3.98 0.08 76 TR_XM_COVIDMETA4 2848 1.00 3.97 0.55 77 FROM_EXCESS_BASE64 2815 3.14 3.92 3.03 78 TR_XM_UnparsRelay 2801 1.02 3.90 0.58 79 XMBody_17 2795 1.23 3.89 0.83 80 SpammyFromTLD_02 2743 0.78 3.82 0.32 81 RELAYCOUNTRY_FR 2645 0.83 3.69 0.40 82 XM_B_Unsub2 2617 5.44 3.65 5.71 83 XM_UB999 2453 0.45 3.42 0.00 84 HELO_NODOT 2409 1.04 3.36 0.69 85 HELO_NO_DOMAIN 2404 1.04 3.35 0.69 86 RCVD_IN_MSPIKE_H4 2380 8.10 3.32 8.83 87 TR_XM_PHPDW 2296 0.69 3.20 0.31 88 XM_B_COVIDMETA 2290 1.20 3.19 0.90 89 T_XMDrugObfuBody_08 2276 1.64 3.17 1.40 90 TR_XM_PHPForged 2263 0.67 3.15 0.29 91 TR_XM_FormFill2 2246 0.66 3.13 0.29 92 XM_H_PHPOS 2235 0.66 3.11 0.28 93 URIBL_SBL_A 2229 0.57 3.11 0.18 94 XMStrtUSub 2202 4.61 3.07 4.84 95 XMSexyCombo_01 2202 0.90 3.07 0.57 96 KHOP_HELO_FCRDNS 2190 1.56 3.05 1.33 97 XM_B_Phish66 2124 1.54 2.96 1.33 98 MIME_HTML_ONLY_MULTI 2084 4.57 2.90 4.82 99 MIME_QP_LONG_LINE 2053 4.79 2.86 5.09 100 XM_URI_RBL 1969 0.51 2.74 0.17 101 T_XMHurry_00 1951 0.83 2.72 0.54 102 XM_CamelCaseFrm001 1947 2.19 2.71 2.11 103 XM_OfRef6 1935 1.11 2.70 0.87 104 ALL_TRUSTED 1887 14.85 2.63 16.70 105 TR_XM_MaxSPIKE 1845 0.38 2.57 0.05 106 XMSubNoVowel 1839 3.00 2.56 3.06 107 XM_UB60 1779 0.47 2.48 0.16 108 PDS_OTHER_BAD_TLD 1716 0.66 2.39 0.40 109 T_REMOTE_IMAGE 1715 2.90 2.39 2.98 110 BAYES_40 1703 3.65 2.37 3.84 111 XM_UB80 1666 0.36 2.32 0.07 112 XMSubMetaSxObfu_03 1613 0.76 2.25 0.54 113 HTML_MIME_NO_HTML_TAG 1597 1.57 2.23 1.47 114 TR_XM_MaxBayes 1579 0.31 2.20 0.02 115 URI_HEX 1549 1.52 2.16 1.43 116 TR_XM_RelayPhish 1529 0.41 2.13 0.15 117 FROM_SUSPICIOUS_NTLD 1494 0.30 2.08 0.03 118 TooManyTo_002 1470 1.93 2.05 1.92 119 TR_XM_DK_SendGrid 1453 3.57 2.02 3.80 120 T_XMDrugObfuBody_00 1428 0.73 1.99 0.54 121 FSL_HELO_NON_FQDN_1 1407 0.26 1.96 0.01 122 FROM_SUSPICIOUS_NTLD_FP 1389 0.28 1.94 0.02 123 BAYES_20 1371 3.80 1.91 4.08 124 DKIM_ADSP_CUSTOM_MED 1339 1.26 1.87 1.16 125 XMSubEmpty 1324 0.38 1.84 0.15 126 TR_MetaPhish_Combo_01 1319 0.87 1.84 0.72 127 URI_TRY_3LD 1303 1.26 1.82 1.17 128 DKIM_ADSP_NXDOMAIN 1295 0.73 1.80 0.57 129 BODY_URI_ONLY 1289 0.27 1.80 0.03 130 T_TooManySym_01 1261 3.64 1.76 3.93 131 T_XMDrugObfuBody_14 1258 1.58 1.75 1.55 132 MISSING_HEADERS 1247 0.54 1.74 0.36 133 TR_Mismatch_TLD_02 1242 0.30 1.73 0.08 134 TM2_M_VERY_LONG_WORD 1240 1.18 1.73 1.10 135 TooManyTo_003 1235 1.43 1.72 1.39 136 URI_PHP_REDIR 1229 0.23 1.71 0.01 137 RDNS_DYNAMIC 1223 0.54 1.70 0.37 138 NML_ADSP_CUSTOM_MED 1194 0.96 1.66 0.85 139 XMDiploma_00 1185 1.53 1.65 1.52 140 REPLYTO_WITHOUT_TO_CC 1169 0.33 1.63 0.13 141 RELAYCOUNTRY_JP 1150 0.24 1.60 0.03 142 TooManyTo_004 1137 1.12 1.58 1.04 143 MPART_ALT_DIFF_COUNT 1129 0.49 1.57 0.32 144 MAILING_LIST_MULTI 1128 1.89 1.57 1.94 145 MIME_CHARSET_FARAWAY 1100 0.30 1.53 0.11 146 ADVANCE_FEE_5_NEW_MONEY 1096 0.20 1.53 0.00 147 FORGED_GMAIL_RCVD 1079 0.65 1.50 0.52 148 XM_DK_Undo_01 1062 1.26 1.48 1.23 149 TR_LOTS_OF_MONEY3 1060 0.63 1.48 0.51 150 RELAYCOUNTRY_RU 1056 0.41 1.47 0.25 151 ANY_BOUNCE_MESSAGE 1046 7.58 1.46 8.51 152 BOUNCE_MESSAGE 1046 7.58 1.46 8.51 153 URI_WP_HACKED_2 1046 0.91 1.46 0.82 154 TR_XM_COVIDMETA1 1044 0.41 1.45 0.25 155 XMReplyNow 1041 0.27 1.45 0.09 156 XMStockSpam_06 1038 1.19 1.45 1.15 157 LongTLD 1005 0.33 1.40 0.17 158 TR_Caps_n_Bayes_99 999 0.34 1.39 0.18 159 TR_Mismatch_TLD_01 966 0.36 1.35 0.21 160 T_FILL_THIS_FORM_SHORT 950 0.71 1.32 0.62 161 XMSexyCombo_04 946 0.27 1.32 0.11 162 TO_IN_SUBJ 944 0.36 1.32 0.21 163 XMSubMetaI_00 942 0.95 1.31 0.90 164 TooManyTo_005 938 0.86 1.31 0.79 165 HTML_FONT_TINY_NORDNS 925 0.63 1.29 0.53 166 CHARSET_FARAWAY_HEADER 922 0.21 1.28 0.04 167 XM_H_PHPMailer 921 0.55 1.28 0.44 168 RELAYCOUNTRY_NL 919 0.37 1.28 0.23 169 XMLngstWrd_00 914 0.47 1.27 0.35 170 TR_Symld_Words 896 1.31 1.25 1.32 171 XM_UB95 886 0.19 1.23 0.03 172 URI_NOVOWEL 884 0.49 1.23 0.38 173 TR_LOTS_OF_MONEY1 884 0.17 1.23 0.01 174 DATE_IN_PAST_03_06 883 0.29 1.23 0.14 175 RELAYCOUNTRY_GB 871 0.79 1.21 0.72 176 URIBL_BLACK 865 0.18 1.21 0.03 177 INVESTMENT_ADVICE 853 0.22 1.19 0.07 178 FSL_THIS_IS_ADV 835 0.30 1.16 0.16 179 RELAYCOUNTRY_IT 833 0.20 1.16 0.05 180 RELAYCOUNTRY_AT 832 0.33 1.16 0.21 181 XMPhish30 801 0.64 1.12 0.56 182 HTML_IMAGE_ONLY_16 800 0.33 1.11 0.21 183 HTML_IMAGE_ONLY_20 794 0.62 1.11 0.55 184 XM_H_MailChimp 793 0.33 1.11 0.22 185 XM_XX_Yahoo 784 0.18 1.09 0.05 186 XMBdyGiftCard01 783 1.04 1.09 1.03 187 XMGppyBdWords 782 0.29 1.09 0.17 188 XM_BadFromFormat 778 0.27 1.08 0.15 189 RELAYCOUNTRY_NG 775 0.14 1.08 0.00 190 RELAYCOUNTRY_DE 753 0.48 1.05 0.40 191 BAYES_05 750 5.13 1.05 5.75 192 DIET_1 740 0.41 1.03 0.32 193 RCVD_IN_IADB_LISTED 719 4.21 1.00 4.70 194 XM_H_PHPOS_M 716 0.24 1.00 0.12 195 XMLngstWrd_01 715 0.40 1.00 0.31 196 XMHTML_After_End 713 0.67 0.99 0.62 197 RCVD_IN_MSPIKE_ZBI 711 0.13 0.99 0.00 198 HK_RANDOM_REPLYTO 707 0.27 0.99 0.16 199 UPGRADE_MAILBOX 707 0.22 0.99 0.10 200 TR_Sbj_FN_Bdy 706 0.31 0.98 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 467253 98.72 97.48 98.91 2 HTML_MESSAGE 400356 85.55 90.82 84.75 3 RELAYCOUNTRY_US 372449 77.77 70.73 78.84 4 DKIM_SIGNED 339395 72.61 77.67 71.85 5 XM_DK_Pass 333872 71.20 74.62 70.68 6 XM_B_Unicode 326173 69.95 75.94 69.05 7 DKIM_VALID 316919 66.28 60.99 67.09 8 DKIM_VALID_AU 243849 50.47 42.91 51.62 9 XMListUnsubscribeExists 238811 52.66 66.50 50.55 10 BAYES_50 228231 46.61 35.37 48.31 11 XM_B_Unicode3 197896 42.08 43.29 41.89 12 HTML_FONT_LOW_CONTRAST 127110 27.00 27.62 26.91 13 LOC_TINY_FONT_1 123701 27.07 32.91 26.19 14 DKIM_VALID_EF 122695 25.62 23.33 25.97 15 RCVD_IN_MSPIKE_WL 114775 22.16 8.13 24.30 16 RCVD_IN_MSPIKE_H2 105262 22.92 27.14 22.28 17 T_TM2_M_HEADER_IN_MSG 103980 21.75 20.00 22.01 18 MIME_HTML_ONLY 100071 22.31 29.70 21.18 19 FVGT_m_MULTI_ODD 93184 20.50 25.62 19.73 20 T_KAM_HTML_FONT_INVALID 88160 18.99 21.18 18.66 21 XMSubLong 83619 18.39 22.96 17.70 22 ALL_TRUSTED 78903 14.85 2.63 16.70 23 BAYES_00 75054 13.88 0.68 15.89 24 XM_Multi_Part_URI 74101 16.54 22.15 15.69 25 XM_Body_Dirty_Words 73055 16.24 21.33 15.46 26 RCVD_IN_MSPIKE_H3 66759 12.89 4.68 14.13 27 XM_B_Unsub 65730 13.82 13.19 13.91 28 XM_DK_Undo_02 60641 18.35 54.63 12.84 29 TM2_M_URI_OPT_OUT 42414 8.32 4.01 8.98 30 RCVD_IN_MSPIKE_H4 41721 8.10 3.32 8.83 31 BAYES_99 41159 12.74 39.28 8.71 32 ANY_BOUNCE_MESSAGE 40202 7.58 1.46 8.51 33 BOUNCE_MESSAGE 40200 7.58 1.46 8.51 34 LotsOfNums_01 39437 8.65 10.62 8.35 35 XM_DKIMWhitelistDomains 38459 7.07 0.02 8.14 36 XM_Evil_Numbers_Gen 38324 8.29 9.49 8.11 37 UNPARSEABLE_RELAY 35423 7.41 6.85 7.50 38 RCVD_IN_RP_SAFE 35150 6.55 0.72 7.44 39 HTML_IMAGE_RATIO_02 34968 7.75 10.06 7.40 40 TooManyTo_001 34436 7.34 7.66 7.29 41 BAYES_999 33780 10.26 30.71 7.15 42 XM_H_Trusted_IP 33208 6.10 0.00 7.03 43 TR_XM_DK_Bayes 33151 6.14 0.37 7.02 44 MPART_ALT_DIFF 32661 7.09 8.22 6.91 45 HTML_IMAGE_RATIO_04 32436 6.75 5.98 6.87 46 IN_ZIMBRA_NJ_WHITELIST 32415 5.96 0.03 6.86 47 RCVD_IN_RP_CERTIFIED 32291 6.00 0.49 6.84 48 LOTS_OF_MONEY 32246 7.58 12.51 6.83 49 XM_SendGrid 31624 6.51 5.28 6.69 50 TR_XM_DK_Bayes1 31187 5.76 0.21 6.60 51 BAYES_60 30631 6.56 7.09 6.48 52 TR_XM_DK_Bayes2 28275 5.21 0.13 5.99 53 XM_B_Phish_Phrases 28092 6.51 10.23 5.95 54 BAYES_05 27154 5.13 1.05 5.75 55 XM_B_Unsub2 26974 5.44 3.65 5.71 56 BOTNET_IPINHOSTNAME 26322 7.16 17.65 5.57 57 RELAYCOUNTRY_META 25061 8.52 29.69 5.31 58 MIME_QP_LONG_LINE 24033 4.79 2.86 5.09 59 XM_H_Long_From01 23080 4.96 5.45 4.89 60 XMStrtUSub 22886 4.61 3.07 4.84 61 MIME_HTML_ONLY_MULTI 22767 4.57 2.90 4.82 62 DKIM_INVALID 22476 6.33 16.68 4.76 63 RCVD_IN_IADB_LISTED 22213 4.21 1.00 4.70 64 XMSexyCombo_05 22052 5.72 12.68 4.67 65 BAYES_80 20117 4.73 7.87 4.26 66 BAYES_20 19289 3.80 1.91 4.08 67 RCVD_IN_IADB_SPF 19281 3.66 0.87 4.08 68 HTML_IMAGE_RATIO_06 18619 4.02 4.53 3.94 69 T_TooManySym_01 18568 3.64 1.76 3.93 70 BAYES_40 18152 3.65 2.37 3.84 71 TR_XM_DK_SendGrid 17964 3.57 2.02 3.80 72 RCVD_IN_IADB_SENDERID 17295 3.29 0.82 3.66 73 RCVD_IN_IADB_DK 16716 3.18 0.82 3.54 74 XMSubMetaSx_00 16137 4.13 8.83 3.42 75 XMNumbers 15902 3.58 5.01 3.37 76 XMSubNoVowel 14464 3.00 2.56 3.06 77 BOTNET 14393 6.58 29.87 3.05 78 FROM_EXCESS_BASE64 14292 3.14 3.92 3.03 79 T_REMOTE_IMAGE 14060 2.90 2.39 2.98 80 RCVD_IN_IADB_VOUCHED 13620 2.55 0.39 2.88 81 NO_DNS_FOR_FROM 13606 4.30 13.63 2.88 82 MIME_HTML_MOSTLY 13547 3.33 6.34 2.87 83 XM_UncommonTLD01 13518 4.44 14.87 2.86 84 TR_XM_PhishingBody 12906 3.11 5.62 2.73 85 UNTRUSTED_Relay 12496 4.77 18.75 2.65 86 BAYES_95 12487 2.87 4.34 2.64 87 HTML_IMAGE_RATIO_08 12133 2.77 4.10 2.57 88 T_TooManySym_02 10867 2.06 0.51 2.30 89 TVD_RCVD_IP 10490 1.97 0.35 2.22 90 XM_PDF 10226 1.98 0.80 2.16 91 XM_CamelCaseFrm001 9954 2.19 2.71 2.11 92 HTML_FONT_FACE_BAD 9259 1.79 0.69 1.96 93 MAILING_LIST_MULTI 9164 1.89 1.57 1.94 94 TooManyTo_002 9057 1.93 2.05 1.92 95 RCVD_IN_IADB_OPTIN 8961 1.70 0.44 1.90 96 XM_B_SpammyTLD 8717 2.14 4.10 1.85 97 RELAYCOUNTRY_CA 8120 2.60 8.38 1.72 98 CK_HELO_DYNAMIC_SPLIT_IP 7710 1.50 0.61 1.63 99 HELO_MISC_IP 7710 1.51 0.69 1.63 100 RCVD_IN_BL_SPAMCOP_NET 7566 2.59 9.09 1.60 101 T_XMDrugObfuBody_14 7345 1.58 1.75 1.55 102 INVALID_MSGID 7185 1.36 0.29 1.52 103 XMDiploma_00 7161 1.53 1.65 1.52 104 HTML_MIME_NO_HTML_TAG 6950 1.57 2.23 1.47 105 URI_HEX 6744 1.52 2.16 1.43 106 SUBJ_ALL_CAPS 6696 1.78 4.20 1.42 107 T_XMDrugObfuBody_08 6637 1.64 3.17 1.40 108 XM_SPF_SoftFail 6633 1.91 5.22 1.40 109 TooManyTo_003 6570 1.43 1.72 1.39 110 XM_UB50 6506 2.11 6.93 1.38 111 TO_MALFORMED 6374 1.18 0.07 1.35 112 RCVD_IN_MSPIKE_H5 6295 1.17 0.12 1.33 113 KHOP_HELO_FCRDNS 6290 1.56 3.05 1.33 114 XM_B_Phish66 6279 1.54 2.96 1.33 115 TR_Symld_Words 6247 1.31 1.25 1.32 116 IN_HORDE_ADDRESS_BOOK 6119 1.13 0.04 1.30 117 XMBrknScrpt_02 5991 1.76 5.03 1.27 118 XM_DK_Undo_01 5791 1.26 1.48 1.23 119 URI_TRY_3LD 5543 1.26 1.82 1.17 120 DKIM_ADSP_CUSTOM_MED 5500 1.26 1.87 1.16 121 XMStockSpam_06 5455 1.19 1.45 1.15 122 USER_IN_DEF_DKIM_WL 5347 0.98 0.01 1.13 123 XMGappySubj_01 5280 0.99 0.14 1.12 124 TM2_M_VERY_LONG_WORD 5199 1.18 1.73 1.10 125 XM_GoogleGroups 5122 1.00 0.42 1.08 126 TooManyTo_004 4932 1.12 1.58 1.04 127 XMBdyGiftCard01 4886 1.04 1.09 1.03 128 T_TooManySym_03 4397 0.83 0.16 0.93 129 XMSubMetaI_00 4245 0.95 1.31 0.90 130 XM_B_COVIDMETA 4228 1.20 3.19 0.90 131 XM_H_Long_From02 4131 0.89 0.97 0.87 132 XM_OfRef6 4121 1.11 2.70 0.87 133 NML_ADSP_CUSTOM_MED 4009 0.96 1.66 0.85 134 XMBody_17 3919 1.23 3.89 0.83 135 URI_WP_HACKED_2 3894 0.91 1.46 0.82 136 XMBody_95 3870 0.73 0.17 0.82 137 TooManyTo_005 3727 0.86 1.31 0.79 138 XM_DIRTYINTL 3697 1.39 5.40 0.78 139 TR_MSPIKEBAYES00 3524 0.65 0.02 0.75 140 TR_MetaPhish_Combo_01 3412 0.87 1.84 0.72 141 RELAYCOUNTRY_GB 3405 0.79 1.21 0.72 142 XM_ProductURIs 3362 0.71 0.69 0.71 143 PLING_QUERY 3360 0.69 0.52 0.71 144 RCVD_IN_MSPIKE_BL 3297 2.16 11.79 0.70 145 HELO_NODOT 3257 1.04 3.36 0.69 146 HELO_NO_DOMAIN 3255 1.04 3.35 0.69 147 XM_RXBody 3157 0.66 0.60 0.67 148 T_FILL_THIS_FORM_SHORT 2922 0.71 1.32 0.62 149 XMHTML_After_End 2910 0.67 0.99 0.62 150 XM_B_COPY_HTML 2849 0.63 0.80 0.60 151 XMGenDplmaNmb 2795 0.64 0.96 0.59 152 TR_XM_UnparsRelay 2746 1.02 3.90 0.58 153 TR_BOTNET_NEGATE 2719 0.58 0.61 0.58 154 SpammyFromTLD_01 2706 1.27 5.89 0.57 155 DKIM_ADSP_NXDOMAIN 2694 0.73 1.80 0.57 156 XMSexyCombo_01 2674 0.90 3.07 0.57 157 XMPhish30 2663 0.64 1.12 0.56 158 XM_UCStrings02 2599 0.48 0.04 0.55 159 HTML_IMAGE_ONLY_20 2598 0.62 1.11 0.55 160 TR_XM_COVIDMETA4 2584 1.00 3.97 0.55 161 XM_B_REG_HTML 2583 0.50 0.20 0.55 162 T_XMHurry_00 2559 0.83 2.72 0.54 163 T_XMDrugObfuBody_00 2543 0.73 1.99 0.54 164 XMSubMetaSxObfu_03 2541 0.76 2.25 0.54 165 T_TooManySym_04 2511 0.47 0.05 0.53 166 HTML_FONT_TINY_NORDNS 2488 0.63 1.29 0.53 167 FORGED_GMAIL_RCVD 2463 0.65 1.50 0.52 168 XMBody_78 2428 0.54 0.75 0.51 169 TR_LOTS_OF_MONEY3 2395 0.63 1.48 0.51 170 THIS_AD 2384 0.52 0.64 0.50 171 XM_S_SubURI 2220 0.42 0.07 0.47 172 T_OBFU_PDF_ATTACH 2147 0.41 0.14 0.45 173 HTML_TAG_BALANCE_BODY 2142 0.48 0.66 0.45 174 XMCapTrack 2127 0.44 0.38 0.45 175 XMPhish08 2083 0.48 0.77 0.44 176 XM_shorewaves_Whitelist 2079 0.38 0.00 0.44 177 XM_H_PHPMailer 2075 0.55 1.28 0.44 178 XMHTMLBadTable_001 2019 0.43 0.44 0.43 179 TM2_M_A_HREF_HREF 2002 0.46 0.67 0.42 180 XMNoVowels 1985 0.44 0.59 0.42 181 T_TooManySym_05 1920 0.35 0.02 0.41 182 PDS_OTHER_BAD_TLD 1898 0.66 2.39 0.40 183 NUMERIC_HTTP_ADDR 1895 0.44 0.69 0.40 184 RELAYCOUNTRY_DE 1881 0.48 1.05 0.40 185 T_Symld_Words_02 1879 0.44 0.70 0.40 186 RELAYCOUNTRY_FR 1872 0.83 3.69 0.40 187 HTTPS_HTTP_MISMATCH 1845 0.41 0.52 0.39 188 USER_IN_WHITELIST 1842 0.34 0.00 0.39 189 XM_ShortIntro_01 1816 0.41 0.57 0.38 190 RCVD_IN_MSPIKE_L3 1778 0.88 4.22 0.38 191 URI_NOVOWEL 1774 0.49 1.23 0.38 192 RDNS_DYNAMIC 1726 0.54 1.70 0.37 193 MISSING_HEADERS 1701 0.54 1.74 0.36 194 XMLngstWrd_00 1660 0.47 1.27 0.35 195 XMSubMetaSxObfu_02 1652 0.37 0.50 0.35 196 XMPhish14 1634 0.40 0.77 0.35 197 FROM_GOV_DKIM_AU 1606 0.30 0.05 0.34 198 XMMoneyMeta_00 1544 0.35 0.54 0.33 199 MPART_ALT_DIFF_COUNT 1532 0.49 1.57 0.32 200 XM_SPF_Unknown 1523 0.39 0.80 0.32 ----------------------------------------------------------------------