Email: 409891 Autolearn: 0 AvgScore: 0.67 AvgScanTime: 1.59 sec Spam: 67318 Autolearn: 0 AvgScore: 12.91 AvgScanTime: 2.84 sec Ham: 342573 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.35 sec Time Spent Running SA: 181.56 hours Time Spent Processing Spam: 53.15 hours Time Spent Processing Ham: 128.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 66003 98.97 98.05 99.16 2 HTML_MESSAGE 61561 81.06 91.45 79.02 3 DKIM_SIGNED 48954 71.40 72.72 71.15 4 XM_DK_Pass 47421 70.19 70.44 70.14 5 RELAYCOUNTRY_US 46767 71.77 69.47 72.22 6 DKIM_VALID 41782 66.63 62.07 67.52 7 XM_B_Unicode 40130 64.10 59.61 64.99 8 XMListUnsubscribeExists 36082 53.93 53.60 53.99 9 XM_DK_Undo_02 31057 19.31 46.13 14.04 10 DKIM_VALID_AU 28657 50.67 42.57 52.27 11 BAYES_99 25189 14.41 37.42 9.88 12 MIME_HTML_ONLY 24920 23.81 37.02 21.21 13 BAYES_50 24517 42.94 36.42 44.22 14 RCVD_IN_MSPIKE_H2 22570 24.89 33.53 23.19 15 XM_B_Unicode3 22212 38.62 33.00 39.72 16 FVGT_m_MULTI_ODD 22070 22.90 32.78 20.95 17 DKIM_VALID_EF 20795 25.15 30.89 24.02 18 RELAYCOUNTRY_META 20499 11.75 30.45 8.07 19 BAYES_999 20130 11.66 29.90 8.08 20 BOTNET 19495 7.40 28.96 3.16 21 LOC_TINY_FONT_1 18134 27.13 26.94 27.17 22 XM_UncommonTLD01 16930 6.86 25.15 3.26 23 UNTRUSTED_Relay 14502 8.10 21.54 5.46 24 HTML_FONT_LOW_CONTRAST 14398 27.32 21.39 28.49 25 XMSubLong 13743 18.56 20.42 18.20 26 T_TM2_M_HEADER_IN_MSG 13728 18.63 20.39 18.28 27 XM_Multi_Part_URI 12404 17.49 18.43 17.31 28 HTML_MIME_NO_HTML_TAG 11489 4.00 17.07 1.43 29 T_KAM_HTML_FONT_INVALID 11055 15.84 16.42 15.73 30 XM_Body_Dirty_Words 10908 13.55 16.20 13.03 31 LotsOfNums_01 9827 10.45 14.60 9.63 32 BOTNET_IPINHOSTNAME 9201 7.64 13.67 6.46 33 RCVD_IN_BL_SPAMCOP_NET 8754 3.47 13.00 1.60 34 RCVD_IN_MSPIKE_BL 8662 2.65 12.87 0.65 35 XM_B_Unsub 8493 10.33 12.62 9.88 36 XMSexyCombo_05 7638 6.10 11.35 5.07 37 BOTNET_NORDNS 7466 1.83 11.09 0.01 38 DKIM_INVALID 7172 4.78 10.65 3.63 39 SpammyFromTLD_02 6402 1.75 9.51 0.22 40 DKIM_ADSP_NXDOMAIN 6348 2.17 9.43 0.74 41 NO_DNS_FOR_FROM 6149 3.46 9.13 2.34 42 HTML_IMAGE_RATIO_02 6088 9.54 9.04 9.63 43 FROM_EXCESS_BASE64 6081 4.50 9.03 3.61 44 BAYES_80 6014 5.37 8.93 4.67 45 XMSubEmpty 5759 1.61 8.55 0.24 46 XM_B_Phish_Phrases 5738 6.83 8.52 6.49 47 BODY_URI_ONLY 5694 1.44 8.46 0.06 48 FROM_SUSPICIOUS_NTLD 5472 1.36 8.13 0.03 49 RCVD_IN_RP_RNBL 5458 1.42 8.11 0.10 50 BAYES_60 5428 6.79 8.06 6.54 51 FROM_SUSPICIOUS_NTLD_FP 5426 1.35 8.06 0.03 52 LOTS_OF_MONEY 5425 6.46 8.06 6.14 53 TR_Sbj_FN_Bdy 5391 1.51 8.01 0.23 54 XMLngstWrd_00 5375 1.94 7.98 0.76 55 T_REMOTE_IMAGE 5370 3.30 7.98 2.39 56 UNPARSEABLE_RELAY 5301 7.89 7.87 7.90 57 RELAYCOUNTRY_CA 5220 2.93 7.75 1.98 58 XM_DK_Undo_01 5153 2.33 7.65 1.29 59 TR_XM_PhishingBody 4961 3.44 7.37 2.67 60 MIME_HTML_MOSTLY 4857 3.50 7.22 2.77 61 MPART_ALT_DIFF 4835 5.07 7.18 4.65 62 MISSING_SUBJECT 4775 1.29 7.09 0.16 63 XMNoSubject 4775 1.29 7.09 0.16 64 RCVD_IN_MSPIKE_L5 4671 1.29 6.94 0.18 65 XM_UB50 4632 2.22 6.88 1.30 66 XM_SendGrid 4614 7.05 6.85 7.09 67 XM_Evil_Numbers_Gen 4606 9.29 6.84 9.77 68 HDRS_MISSP 4530 1.17 6.73 0.08 69 RCVD_IN_MSPIKE_WL 4356 22.13 6.47 25.20 70 SpammyFromTLD_01 4299 1.46 6.39 0.49 71 HTML_TAG_BALANCE_CENTER 4274 1.16 6.35 0.14 72 XMNumbers 4088 4.81 6.07 4.56 73 XMSubMetaSx_00 4067 3.53 6.04 3.04 74 XMLngstWrd_01 3866 1.47 5.74 0.62 75 XM_B_Phish66 3709 1.88 5.51 1.17 76 RCVD_IN_PSBL 3694 1.00 5.49 0.12 77 XM_DIRTYINTL 3582 1.34 5.32 0.56 78 XM_H_Long_From01 3529 4.88 5.24 4.81 79 XM_SPF_SoftFail 3501 1.84 5.20 1.18 80 TooManyTo_001 3461 5.59 5.14 5.68 81 HTML_IMAGE_RATIO_04 3308 5.50 4.91 5.62 82 XM_UB99 3303 0.81 4.91 0.01 83 PDS_OTHER_BAD_TLD 3291 1.20 4.89 0.47 84 RCVD_IN_MSPIKE_L3 2953 1.08 4.39 0.43 85 TM2_M_URI_OPT_OUT 2901 11.82 4.31 13.30 86 RELAYCOUNTRY_FR 2854 1.02 4.24 0.39 87 TR_XM_INV_DKIM 2844 0.91 4.22 0.26 88 BAYES_95 2762 3.03 4.10 2.82 89 XM_B_Unsub2 2725 2.02 4.05 1.62 90 XM_B_SpammyTLD 2713 2.16 4.03 1.79 91 XMBrknScrpt_02 2615 1.63 3.88 1.18 92 SUBJ_DOLLARS 2581 0.94 3.83 0.37 93 URIBL_SBL_A 2558 0.78 3.80 0.19 94 XM_UB999 2468 0.61 3.67 0.01 95 LongTLD 2458 0.69 3.65 0.11 96 XM_UB60 2417 0.77 3.59 0.21 97 TR_XM_PHPDW 2369 0.90 3.52 0.38 98 XMLngstWrd_02 2362 0.99 3.51 0.49 99 KHOP_HELO_FCRDNS 2356 1.35 3.50 0.93 100 HTML_IMAGE_RATIO_08 2344 2.35 3.48 2.13 101 TR_XM_PHPForged 2331 0.87 3.46 0.36 102 TR_XM_FormFill2 2321 0.86 3.45 0.35 103 XM_H_PHPOS 2311 0.86 3.43 0.35 104 XM_UB80 2201 0.61 3.27 0.09 105 SUBJ_ALL_CAPS 2166 1.79 3.22 1.51 106 RCVD_IN_MSPIKE_H4 2151 7.95 3.20 8.89 107 XMSubNoVowel 2142 1.38 3.18 1.03 108 TR_XM_UnparsRelay 2129 1.19 3.16 0.80 109 RCVD_IN_MSPIKE_H3 2118 13.11 3.15 15.07 110 ANY_BOUNCE_MESSAGE 2056 11.49 3.05 13.15 111 BOUNCE_MESSAGE 2056 11.49 3.05 13.15 112 TR_XM_MaxWHORU 1974 0.53 2.93 0.06 113 TR_XM_MaxBayes 1949 0.50 2.90 0.04 114 TR_XM_MaxSPIKE 1915 0.53 2.84 0.08 115 MPART_ALT_DIFF_COUNT 1879 0.72 2.79 0.32 116 URI_TRY_3LD 1738 1.50 2.58 1.28 117 XM_JunkDunk 1736 0.42 2.58 0.00 118 MIME_HEADER_CTYPE_ONLY 1729 0.49 2.57 0.08 119 URI_OPTOUT_3LD 1677 0.88 2.49 0.57 120 HTML_IMAGE_ONLY_08 1662 0.47 2.47 0.08 121 HTML_SHORT_LINK_IMG_1 1649 0.42 2.45 0.02 122 DKIM_ADSP_CUSTOM_MED 1591 1.10 2.36 0.85 123 TO_IN_SUBJ 1565 0.81 2.32 0.51 124 HTML_IMAGE_RATIO_06 1558 3.43 2.31 3.64 125 NML_ADSP_CUSTOM_MED 1521 0.86 2.26 0.58 126 XMStrtUSub 1514 3.42 2.25 3.65 127 MIME_QP_LONG_LINE 1472 3.84 2.19 4.16 128 FORGED_GMAIL_RCVD 1463 0.73 2.17 0.45 129 BAYES_40 1426 4.22 2.12 4.64 130 XMSubMetaI_00 1387 1.27 2.06 1.11 131 XMSexyCombo_01 1321 0.72 1.96 0.48 132 T_TooManySym_01 1280 4.68 1.90 5.23 133 XM_URI_RBL 1278 0.48 1.90 0.20 134 XM_OfRef6 1275 1.07 1.89 0.91 135 TR_XM_COVIDMETA4 1269 0.55 1.89 0.29 136 XMBody_17 1252 0.90 1.86 0.71 137 RELAYCOUNTRY_IT 1246 0.34 1.85 0.05 138 XM_ShortIntro_01 1233 0.54 1.83 0.29 139 RDNS_DYNAMIC 1199 0.64 1.78 0.41 140 XM_B_COVIDMETA 1196 0.83 1.78 0.65 141 URI_HEX 1162 1.54 1.73 1.50 142 T_XMHurry_00 1161 0.74 1.72 0.54 143 XMStockSpam_06 1141 1.39 1.69 1.33 144 XM_H_PHPMailer 1124 0.69 1.67 0.50 145 PDS_BTC_ID 1116 0.29 1.66 0.02 146 DATE_IN_PAST_03_06 1107 0.41 1.64 0.17 147 T_XMDrugObfuBody_08 1092 1.27 1.62 1.20 148 RELAYCOUNTRY_NL 1088 0.48 1.62 0.26 149 MIME_HTML_ONLY_MULTI 1075 2.65 1.60 2.86 150 TVD_SPACE_RATIO_MINFP 1069 0.27 1.59 0.01 151 TR_Caps_n_Bayes_99 1065 0.39 1.58 0.16 152 MIME_CHARSET_FARAWAY 1056 0.35 1.57 0.11 153 TM2_M_VERY_LONG_WORD 1055 1.19 1.57 1.11 154 DATE_IN_PAST_06_12 1037 0.52 1.54 0.32 155 XM_CamelCaseFrm001 1032 1.85 1.53 1.92 156 URI_PHP_REDIR 1025 0.26 1.52 0.01 157 XMLngstWrd_03 1015 0.55 1.51 0.36 158 RCVD_IN_MSPIKE_L4 1014 0.28 1.51 0.04 159 XM_UB95 997 0.27 1.48 0.04 160 TR_XM_DK_SendGrid 994 3.26 1.48 3.62 161 TR_Mismatch_TLD_02 993 0.30 1.48 0.07 162 TR_XM_RelayPhish 972 0.33 1.44 0.11 163 TR_LOTS_OF_MONEY3 968 0.49 1.44 0.31 164 RELAYCOUNTRY_JP 966 0.27 1.43 0.04 165 BAYES_20 933 4.43 1.39 5.03 166 RELAYCOUNTRY_GB 933 0.74 1.39 0.62 167 CHARSET_FARAWAY_HEADER 928 0.26 1.38 0.05 168 HK_SCAM 918 0.25 1.36 0.03 169 HTML_FONT_TINY_NORDNS 913 0.47 1.36 0.30 170 OBFU_BITCOIN 894 0.22 1.33 0.00 171 FUZZY_BITCOIN 894 0.22 1.33 0.00 172 BITCOIN_SPAM_03 893 0.22 1.33 0.00 173 XM_H_PHPOS_M 887 0.39 1.32 0.20 174 HK_RANDOM_REPLYTO 877 0.39 1.30 0.21 175 HTML_IMAGE_ONLY_16 866 0.33 1.29 0.14 176 RCVD_IN_RP_SAFE 863 8.26 1.28 9.63 177 RELAYCOUNTRY_PL 852 0.26 1.27 0.06 178 TR_Mismatch_TLD_01 849 0.39 1.26 0.22 179 XM_RXBody 836 0.87 1.24 0.80 180 SUSP_UTF8_WORD_MANY 828 0.20 1.23 0.00 181 RELAYCOUNTRY_DE 805 0.48 1.20 0.34 182 URI_NOVOWEL 774 0.46 1.15 0.33 183 INVESTMENT_ADVICE 752 0.25 1.12 0.08 184 URI_WP_DIRINDEX 752 0.19 1.12 0.00 185 XMDiploma_00 749 0.93 1.11 0.89 186 XMEmptySub 744 0.24 1.11 0.07 187 HTML_SHORT_LINK_IMG_2 742 0.22 1.10 0.04 188 XM_BadFromFormat 741 0.31 1.10 0.16 189 T_FILL_THIS_FORM_SHORT 740 0.69 1.10 0.62 190 RELAYCOUNTRY_BG 734 0.18 1.09 0.00 191 CTYPE_NULL 731 0.18 1.09 0.00 192 RELAYCOUNTRY_ZA 729 0.19 1.08 0.01 193 BODY_SINGLE_WORD 726 0.19 1.08 0.01 194 BODY_SINGLE_URI 723 0.18 1.07 0.01 195 ALL_TRUSTED 722 17.14 1.07 20.29 196 MAILING_LIST_MULTI 720 1.53 1.07 1.61 197 ADVANCE_FEE_2_NEW_MONEY 710 0.18 1.05 0.00 198 DIET_1 704 0.53 1.05 0.43 199 RELAYCOUNTRY_RU 702 0.48 1.04 0.37 200 T_XMDrugObfuBody_14 698 1.66 1.04 1.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 339683 98.97 98.05 99.16 2 HTML_MESSAGE 270712 81.06 91.45 79.02 3 RELAYCOUNTRY_US 247421 71.77 69.47 72.22 4 DKIM_SIGNED 243728 71.40 72.72 71.15 5 XM_DK_Pass 240285 70.19 70.44 70.14 6 DKIM_VALID 231308 66.63 62.07 67.52 7 XM_B_Unicode 222625 64.10 59.61 64.99 8 XMListUnsubscribeExists 184963 53.93 53.60 53.99 9 DKIM_VALID_AU 179052 50.67 42.57 52.27 10 BAYES_50 151474 42.94 36.42 44.22 11 XM_B_Unicode3 136080 38.62 33.00 39.72 12 HTML_FONT_LOW_CONTRAST 97604 27.32 21.39 28.49 13 LOC_TINY_FONT_1 93089 27.13 26.94 27.17 14 RCVD_IN_MSPIKE_WL 86335 22.13 6.47 25.20 15 DKIM_VALID_EF 82295 25.15 30.89 24.02 16 RCVD_IN_MSPIKE_H2 79456 24.89 33.53 23.19 17 MIME_HTML_ONLY 72673 23.81 37.02 21.21 18 FVGT_m_MULTI_ODD 71786 22.90 32.78 20.95 19 ALL_TRUSTED 69515 17.14 1.07 20.29 20 T_TM2_M_HEADER_IN_MSG 62638 18.63 20.39 18.28 21 XMSubLong 62349 18.56 20.42 18.20 22 XM_Multi_Part_URI 59302 17.49 18.43 17.31 23 T_KAM_HTML_FONT_INVALID 53881 15.84 16.42 15.73 24 BAYES_00 53135 13.07 0.64 15.51 25 RCVD_IN_MSPIKE_H3 51619 13.11 3.15 15.07 26 XM_DK_Undo_02 48101 19.31 46.13 14.04 27 TM2_M_URI_OPT_OUT 45557 11.82 4.31 13.30 28 ANY_BOUNCE_MESSAGE 45042 11.49 3.05 13.15 29 BOUNCE_MESSAGE 45042 11.49 3.05 13.15 30 XM_Body_Dirty_Words 44650 13.55 16.20 13.03 31 BAYES_99 33863 14.41 37.42 9.88 32 XM_B_Unsub 33835 10.33 12.62 9.88 33 XM_Evil_Numbers_Gen 33471 9.29 6.84 9.77 34 HTML_IMAGE_RATIO_02 33002 9.54 9.04 9.63 35 LotsOfNums_01 32999 10.45 14.60 9.63 36 RCVD_IN_RP_SAFE 32998 8.26 1.28 9.63 37 XM_DKIMWhitelistDomains 32413 7.91 0.01 9.46 38 RCVD_IN_MSPIKE_H4 30448 7.95 3.20 8.89 39 RCVD_IN_RP_CERTIFIED 30348 7.54 0.81 8.86 40 BAYES_999 27667 11.66 29.90 8.08 41 RELAYCOUNTRY_META 27654 11.75 30.45 8.07 42 UNPARSEABLE_RELAY 27048 7.89 7.87 7.90 43 TR_XM_DK_Bayes 25499 6.27 0.28 7.44 44 TR_XM_DK_Bayes1 24299 5.96 0.17 7.09 45 XM_SendGrid 24278 7.05 6.85 7.09 46 BAYES_05 22821 5.71 0.88 6.66 47 BAYES_60 22409 6.79 8.06 6.54 48 TR_XM_DK_Bayes2 22298 5.46 0.14 6.51 49 XM_B_Phish_Phrases 22241 6.83 8.52 6.49 50 BOTNET_IPINHOSTNAME 22120 7.64 13.67 6.46 51 LOTS_OF_MONEY 21040 6.46 8.06 6.14 52 TooManyTo_001 19444 5.59 5.14 5.68 53 HTML_IMAGE_RATIO_04 19238 5.50 4.91 5.62 54 UNTRUSTED_Relay 18704 8.10 21.54 5.46 55 T_TooManySym_01 17907 4.68 1.90 5.23 56 XMSexyCombo_05 17385 6.10 11.35 5.07 57 BAYES_20 17224 4.43 1.39 5.03 58 XM_H_Long_From01 16465 4.88 5.24 4.81 59 BAYES_80 15986 5.37 8.93 4.67 60 MPART_ALT_DIFF 15934 5.07 7.18 4.65 61 BAYES_40 15884 4.22 2.12 4.64 62 XMNumbers 15617 4.81 6.07 4.56 63 MIME_QP_LONG_LINE 14250 3.84 2.19 4.16 64 RCVD_IN_IADB_LISTED 13413 3.37 0.58 3.92 65 IN_ZIMBRA_NJ_WHITELIST 12902 3.15 0.03 3.77 66 XMStrtUSub 12502 3.42 2.25 3.65 67 HTML_IMAGE_RATIO_06 12482 3.43 2.31 3.64 68 DKIM_INVALID 12420 4.78 10.65 3.63 69 TR_XM_DK_SendGrid 12386 3.26 1.48 3.62 70 FROM_EXCESS_BASE64 12362 4.50 9.03 3.61 71 RCVD_IN_IADB_SPF 11762 2.95 0.52 3.43 72 XM_UncommonTLD01 11185 6.86 25.15 3.26 73 BOTNET 10821 7.40 28.96 3.16 74 RCVD_IN_IADB_SENDERID 10705 2.69 0.49 3.12 75 T_Symld_Words_02 10489 2.66 0.60 3.06 76 RCVD_IN_IADB_DK 10454 2.63 0.50 3.05 77 XMSubMetaSx_00 10404 3.53 6.04 3.04 78 HELO_NODOT 10235 2.64 0.90 2.99 79 HELO_NO_DOMAIN 10233 2.64 0.90 2.99 80 T_TooManySym_02 9947 2.54 0.69 2.90 81 MISSING_HEADERS 9846 2.55 0.91 2.87 82 MIME_HTML_ONLY_MULTI 9805 2.65 1.60 2.86 83 BAYES_95 9666 3.03 4.10 2.82 84 MIME_HTML_MOSTLY 9480 3.50 7.22 2.77 85 REPLYTO_WITHOUT_TO_CC 9344 2.40 0.72 2.73 86 RELAYCOUNTRY_UG 9145 2.26 0.17 2.67 87 TR_XM_PhishingBody 9131 3.44 7.37 2.67 88 TVD_RCVD_IP 9123 2.27 0.28 2.66 89 T_REMOTE_IMAGE 8175 3.30 7.98 2.39 90 NO_DNS_FOR_FROM 8022 3.46 9.13 2.34 91 HELO_MISC_IP 7756 2.00 0.68 2.26 92 CK_HELO_DYNAMIC_SPLIT_IP 7752 1.98 0.54 2.26 93 RCVD_IN_IADB_VOUCHED 7679 1.90 0.16 2.24 94 XM_H_Trusted_IP 7486 1.83 0.00 2.19 95 HTML_IMAGE_RATIO_08 7306 2.35 3.48 2.13 96 INVALID_MSGID 7091 1.77 0.22 2.07 97 RELAYCOUNTRY_CA 6793 2.93 7.75 1.98 98 XM_CamelCaseFrm001 6562 1.85 1.53 1.92 99 TO_MALFORMED 6365 1.56 0.04 1.86 100 XM_B_SpammyTLD 6137 2.16 4.03 1.79 101 T_XMDrugObfuBody_14 6092 1.66 1.04 1.78 102 XM_B_Unsub2 5551 2.02 4.05 1.62 103 MAILING_LIST_MULTI 5531 1.53 1.07 1.61 104 RCVD_IN_BL_SPAMCOP_NET 5474 3.47 13.00 1.60 105 SUBJ_ALL_CAPS 5163 1.79 3.22 1.51 106 URI_HEX 5152 1.54 1.73 1.50 107 XM_ProductURIs 5116 1.39 0.87 1.49 108 HTML_MIME_NO_HTML_TAG 4908 4.00 17.07 1.43 109 TR_Symld_Words 4862 1.32 0.82 1.42 110 IN_HORDE_ADDRESS_BOOK 4839 1.19 0.04 1.41 111 USER_IN_DEF_DKIM_WL 4836 1.18 0.00 1.41 112 RCVD_IN_IADB_OPTIN 4823 1.21 0.22 1.41 113 XMGappySubj_01 4811 1.20 0.16 1.40 114 XMStockSpam_06 4572 1.39 1.69 1.33 115 XM_UB50 4450 2.22 6.88 1.30 116 XM_DK_Undo_01 4415 2.33 7.65 1.29 117 URI_TRY_3LD 4399 1.50 2.58 1.28 118 T_TooManySym_03 4346 1.07 0.09 1.27 119 XM_PDF 4344 1.13 0.42 1.27 120 RCVD_IN_MSPIKE_H5 4268 1.06 0.13 1.25 121 XM_H_Long_From02 4139 1.14 0.79 1.21 122 T_XMDrugObfuBody_08 4125 1.27 1.62 1.20 123 XM_SPF_SoftFail 4052 1.84 5.20 1.18 124 XMBrknScrpt_02 4050 1.63 3.88 1.18 125 XM_B_Phish66 4017 1.88 5.51 1.17 126 TM2_M_VERY_LONG_WORD 3814 1.19 1.57 1.11 127 XMSubMetaI_00 3808 1.27 2.06 1.11 128 XMBdyGiftCard01 3649 1.02 0.80 1.07 129 XM_GoogleGroups 3635 0.94 0.34 1.06 130 XMSubNoVowel 3529 1.38 3.18 1.03 131 XMBody_95 3182 0.79 0.07 0.93 132 KHOP_HELO_FCRDNS 3182 1.35 3.50 0.93 133 XM_OfRef6 3124 1.07 1.89 0.91 134 HTML_FONT_FACE_BAD 3065 0.85 0.64 0.89 135 XMDiploma_00 3055 0.93 1.11 0.89 136 DKIM_ADSP_CUSTOM_MED 2928 1.10 2.36 0.85 137 TooManyTo_002 2881 0.80 0.61 0.84 138 TR_XM_UnparsRelay 2757 1.19 3.16 0.80 139 XM_RXBody 2750 0.87 1.24 0.80 140 TR_MSPIKEBAYES00 2615 0.64 0.00 0.76 141 XMLngstWrd_00 2593 1.94 7.98 0.76 142 HTML_TAG_BALANCE_BODY 2573 0.72 0.59 0.75 143 DKIM_ADSP_NXDOMAIN 2530 2.17 9.43 0.74 144 T_TooManySym_04 2464 0.60 0.02 0.72 145 TR_BOTNET_NEGATE 2463 0.63 0.18 0.72 146 XMBody_17 2425 0.90 1.86 0.71 147 XM_B_REG_HTML 2344 0.60 0.20 0.68 148 XM_B_COVIDMETA 2223 0.83 1.78 0.65 149 XM_S_SubURI 2217 0.56 0.10 0.65 150 RCVD_IN_MSPIKE_BL 2213 2.65 12.87 0.65 151 T_XMDrugObfuBody_00 2191 0.68 0.86 0.64 152 XMLngstWrd_01 2141 1.47 5.74 0.62 153 RELAYCOUNTRY_GB 2112 0.74 1.39 0.62 154 T_FILL_THIS_FORM_SHORT 2107 0.69 1.10 0.62 155 TooManyTo_003 2006 0.55 0.34 0.59 156 NML_ADSP_CUSTOM_MED 1994 0.86 2.26 0.58 157 TR_MetaPhish_Combo_01 1968 0.62 0.84 0.57 158 URI_OPTOUT_3LD 1941 0.88 2.49 0.57 159 T_TooManySym_05 1936 0.47 0.01 0.57 160 XM_DIRTYINTL 1927 1.34 5.32 0.56 161 USER_IN_WHITELIST 1909 0.47 0.00 0.56 162 T_XMHurry_00 1854 0.74 1.72 0.54 163 XMPhish30 1823 0.59 0.91 0.53 164 XMPhish08 1749 0.52 0.54 0.51 165 TO_IN_SUBJ 1742 0.81 2.32 0.51 166 XMSubMetaSxObfu_02 1719 0.52 0.61 0.50 167 XM_H_PHPMailer 1701 0.69 1.67 0.50 168 TooManyTo_004 1692 0.46 0.31 0.49 169 XMLngstWrd_02 1683 0.99 3.51 0.49 170 SpammyFromTLD_01 1669 1.46 6.39 0.49 171 XMGenDplmaNmb 1659 0.49 0.54 0.48 172 XM_B_COPY_HTML 1650 0.46 0.36 0.48 173 XMSexyCombo_01 1630 0.72 1.96 0.48 174 PDS_OTHER_BAD_TLD 1623 1.20 4.89 0.47 175 XMHTMLBadTable_001 1618 0.45 0.34 0.47 176 NUMERIC_HTTP_ADDR 1576 0.47 0.52 0.46 177 FORGED_GMAIL_RCVD 1548 0.73 2.17 0.45 178 XMHTML_After_End 1546 0.55 1.03 0.45 179 XMPhish14 1537 0.45 0.48 0.45 180 DIET_1 1488 0.53 1.05 0.43 181 XMBody_78 1468 0.47 0.70 0.43 182 RCVD_IN_MSPIKE_L3 1461 1.08 4.39 0.43 183 TooManyTo_005 1460 0.40 0.28 0.43 184 RDNS_DYNAMIC 1415 0.64 1.78 0.41 185 TM2_M_A_HREF_HREF 1377 0.41 0.46 0.40 186 RELAYCOUNTRY_FR 1339 1.02 4.24 0.39 187 TR_XM_PHPDW 1314 0.90 3.52 0.38 188 SHOPIFY_IMG_NOT_RCVD_SFY 1310 0.44 0.74 0.38 189 HTML_IMAGE_ONLY_20 1307 0.42 0.64 0.38 190 XMOemUri 1299 0.35 0.19 0.38 191 XMSolicitRefs_0 1295 0.35 0.23 0.38 192 THIS_AD 1268 0.33 0.14 0.37 193 SUBJ_DOLLARS 1263 0.94 3.83 0.37 194 RELAYCOUNTRY_RU 1253 0.48 1.04 0.37 195 XMLngstWrd_03 1248 0.55 1.51 0.36 196 TR_XM_PHPForged 1226 0.87 3.46 0.36 197 XMBSHREFv2 1221 0.32 0.14 0.36 198 TR_XM_FormFill2 1210 0.86 3.45 0.35 199 XMNoVowels 1199 0.34 0.30 0.35 200 XM_H_PHPOS 1196 0.86 3.43 0.35 ----------------------------------------------------------------------