Email: 393772 Autolearn: 0 AvgScore: 0.17 AvgScanTime: 1.66 sec Spam: 60935 Autolearn: 0 AvgScore: 12.46 AvgScanTime: 3.05 sec Ham: 332837 Autolearn: 0 AvgScore: -2.08 AvgScanTime: 1.40 sec Time Spent Running SA: 181.25 hours Time Spent Processing Spam: 51.66 hours Time Spent Processing Ham: 129.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 59311 98.85 97.33 99.12 2 HTML_MESSAGE 52646 80.10 86.40 78.95 3 DKIM_SIGNED 46460 72.36 76.25 71.64 4 XM_DK_Pass 44879 71.09 73.65 70.62 5 RELAYCOUNTRY_US 40482 72.51 66.43 73.62 6 XM_B_Unicode 40040 66.55 65.71 66.70 7 DKIM_VALID 38747 66.99 63.59 67.61 8 XMListUnsubscribeExists 34301 54.00 56.29 53.58 9 XM_DK_Undo_02 33427 20.60 54.86 14.33 10 DKIM_VALID_AU 23217 52.39 38.10 55.01 11 BAYES_99 22302 14.04 36.60 9.91 12 BAYES_50 22089 43.61 36.25 44.96 13 XM_B_Unicode3 21284 39.85 34.93 40.75 14 RCVD_IN_MSPIKE_H2 21168 24.88 34.74 23.07 15 MIME_HTML_ONLY 20543 22.83 33.71 20.84 16 RELAYCOUNTRY_META 20523 10.85 33.68 6.67 17 BAYES_999 17662 11.41 28.98 8.19 18 DKIM_VALID_EF 17482 25.31 28.69 24.70 19 BOTNET 16911 7.12 27.75 3.34 20 LOC_TINY_FONT_1 16338 27.14 26.81 27.20 21 FVGT_m_MULTI_ODD 15818 20.41 25.96 19.39 22 XM_UncommonTLD01 14709 7.00 24.14 3.87 23 HTML_FONT_LOW_CONTRAST 14549 28.89 23.88 29.81 24 UNTRUSTED_Relay 13878 6.91 22.78 4.01 25 T_TM2_M_HEADER_IN_MSG 13371 20.32 21.94 20.02 26 XMSubLong 12697 20.03 20.84 19.89 27 RCVD_IN_BL_SPAMCOP_NET 11617 4.29 19.06 1.58 28 BOTNET_IPINHOSTNAME 10973 8.27 18.01 6.49 29 XM_Multi_Part_URI 10487 16.85 17.21 16.79 30 T_KAM_HTML_FONT_INVALID 9706 15.55 15.93 15.49 31 UNPARSEABLE_RELAY 9566 8.68 15.70 7.39 32 XM_Body_Dirty_Words 9192 12.64 15.08 12.19 33 XM_B_Unsub 8952 9.80 14.69 8.90 34 XM_SendGrid 7999 7.60 13.13 6.59 35 RCVD_IN_MSPIKE_BL 7919 2.73 13.00 0.85 36 DKIM_INVALID 7713 5.37 12.66 4.03 37 NO_DNS_FOR_FROM 7024 3.99 11.53 2.61 38 HTML_IMAGE_RATIO_02 6996 9.87 11.48 9.58 39 PDS_OTHER_BAD_TLD 6657 1.83 10.92 0.17 40 LOTS_OF_MONEY 6635 6.13 10.89 5.26 41 XMSexyCombo_05 6213 5.40 10.20 4.52 42 LotsOfNums_01 6105 8.71 10.02 8.47 43 XM_B_Phish_Phrases 5991 7.33 9.83 6.88 44 RELAYCOUNTRY_CA 5866 3.29 9.63 2.13 45 RCVD_IN_RP_RNBL 5778 1.58 9.48 0.13 46 HTML_MIME_NO_HTML_TAG 5392 2.38 8.85 1.19 47 XMSubMetaSx_00 5333 4.77 8.75 4.05 48 BAYES_80 4838 4.93 7.94 4.38 49 BAYES_60 4750 6.78 7.80 6.60 50 XM_UB50 4696 2.67 7.71 1.75 51 XM_Evil_Numbers_Gen 4670 8.54 7.66 8.70 52 HTML_SHORT_LINK_IMG_1 4479 1.16 7.35 0.03 53 MIME_HEADER_CTYPE_ONLY 4343 1.17 7.13 0.08 54 HTML_IMAGE_ONLY_08 4300 1.16 7.06 0.08 55 SpammyFromTLD_02 4204 1.26 6.90 0.23 56 RCVD_IN_MSPIKE_L5 4078 1.26 6.69 0.26 57 HTML_IMAGE_RATIO_04 4052 5.95 6.65 5.82 58 XM_SPF_SoftFail 3907 1.99 6.41 1.18 59 LongTLD 3845 1.07 6.31 0.11 60 RCVD_IN_PSBL 3831 1.07 6.29 0.12 61 RCVD_IN_MSPIKE_WL 3765 22.20 6.18 25.13 62 DKIM_ADSP_NXDOMAIN 3749 1.60 6.15 0.76 63 XMNumbers 3711 4.69 6.09 4.43 64 MIME_HTML_MOSTLY 3693 4.10 6.06 3.74 65 XM_H_Long_From01 3568 4.97 5.86 4.81 66 FROM_EXCESS_BASE64 3541 4.04 5.81 3.72 67 SpammyFromTLD_01 3524 1.30 5.78 0.47 68 SUBJ_ALL_CAPS 3443 2.39 5.65 1.79 69 MPART_ALT_DIFF 3420 5.73 5.61 5.75 70 XMStrtUSub 3076 5.45 5.05 5.52 71 TooManyTo_001 3042 6.19 4.99 6.40 72 XM_UB99 2986 0.77 4.90 0.01 73 KHOP_HELO_FCRDNS 2870 1.59 4.71 1.02 74 BOTNET_NORDNS 2865 0.74 4.70 0.01 75 XM_DIRTYINTL 2788 1.14 4.58 0.51 76 TR_XM_INV_DKIM 2723 0.86 4.47 0.20 77 TM2_M_URI_OPT_OUT 2721 12.13 4.47 13.54 78 FROM_SUSPICIOUS_NTLD 2689 0.71 4.41 0.03 79 FROM_SUSPICIOUS_NTLD_FP 2625 0.69 4.31 0.03 80 BAYES_95 2543 2.93 4.17 2.70 81 TR_XM_MaxWHORU 2535 0.70 4.16 0.07 82 RCVD_IN_MSPIKE_L3 2380 1.05 3.91 0.53 83 XM_UB60 2264 0.79 3.72 0.25 84 TR_XM_UnparsRelay 2262 1.12 3.71 0.64 85 XM_B_Unsub2 2216 1.78 3.64 1.44 86 XM_OfRef6 2194 1.42 3.60 1.02 87 RCVD_IN_MSPIKE_H3 2188 12.82 3.59 14.50 88 TR_XM_PhishingBody 2091 3.05 3.43 2.98 89 XM_B_SpammyTLD 2091 1.71 3.43 1.40 90 BAYES_40 2072 4.45 3.40 4.65 91 TR_XM_PHPDW 2066 0.83 3.39 0.36 92 TR_XM_PHPForged 2039 0.81 3.35 0.35 93 XM_UB999 2028 0.52 3.33 0.01 94 TR_XM_FormFill2 2022 0.81 3.32 0.35 95 XM_H_PHPOS 2015 0.80 3.31 0.34 96 HTML_IMAGE_RATIO_08 1967 2.61 3.23 2.49 97 XMBrknScrpt_02 1959 1.53 3.21 1.22 98 XM_UB80 1889 0.57 3.10 0.11 99 HTML_IMAGE_RATIO_06 1877 3.75 3.08 3.88 100 T_REMOTE_IMAGE 1870 2.45 3.07 2.33 101 TR_Mismatch_TLD_02 1780 0.57 2.92 0.14 102 URIBL_SBL_A 1725 0.56 2.83 0.14 103 DIET_1 1706 0.97 2.80 0.63 104 XMLngstWrd_00 1705 0.94 2.80 0.60 105 RELAYCOUNTRY_DE 1700 0.67 2.79 0.28 106 T_FILL_THIS_FORM_SHORT 1695 0.90 2.78 0.56 107 XMSubNoVowel 1659 2.02 2.72 1.90 108 TR_Caps_n_Bayes_99 1653 0.57 2.71 0.17 109 ANY_BOUNCE_MESSAGE 1639 11.34 2.69 12.92 110 BOUNCE_MESSAGE 1636 11.34 2.68 12.92 111 TR_XM_COVIDMETA4 1615 0.75 2.65 0.40 112 TM2_M_VERY_LONG_WORD 1567 1.30 2.57 1.07 113 RCVD_IN_MSPIKE_H4 1530 8.58 2.51 9.70 114 TR_XM_MaxSPIKE 1523 0.48 2.50 0.12 115 RELAYCOUNTRY_RU 1492 1.35 2.45 1.15 116 URI_OPTOUT_3LD 1490 0.83 2.45 0.53 117 TO_IN_SUBJ 1465 0.80 2.40 0.51 118 RCVD_IN_MSPIKE_L4 1404 0.40 2.30 0.05 119 RELAYCOUNTRY_FR 1386 1.04 2.27 0.82 120 RDNS_DYNAMIC 1375 0.69 2.26 0.40 121 XMGppyBdWords 1340 0.51 2.20 0.20 122 MPART_ALT_DIFF_COUNT 1340 0.65 2.20 0.36 123 XMSexyCombo_01 1331 0.70 2.18 0.43 124 XMBody_17 1328 1.00 2.18 0.79 125 XMLngstWrd_01 1299 0.74 2.13 0.49 126 MONEY_FRAUD_5 1262 0.32 2.07 0.00 127 T_XMDrugObfuBody_08 1235 1.43 2.03 1.32 128 BAYES_20 1228 4.48 2.02 4.93 129 TR_XM_RelayPhish 1219 0.47 2.00 0.19 130 T_TooManySym_01 1217 4.56 2.00 5.03 131 TR_XM_MaxBayes 1186 0.31 1.95 0.01 132 URI_HEX 1176 1.48 1.93 1.40 133 LONG_JUNK_URI 1175 0.32 1.93 0.03 134 RELAYCOUNTRY_IT 1143 0.32 1.88 0.04 135 URI_TRY_3LD 1139 1.35 1.87 1.25 136 MIME_QP_LONG_LINE 1112 3.26 1.82 3.52 137 BODY_URI_ONLY 1109 0.33 1.82 0.05 138 XM_ShortIntro_01 1105 0.60 1.81 0.38 139 XM_URI_RBL 1104 0.44 1.81 0.19 140 ADVANCE_FEE_2_NEW_MONEY 1092 0.29 1.79 0.01 141 XM_B_COVIDMETA 1076 0.81 1.77 0.64 142 MONEY_FORM_SHORT 1065 0.28 1.75 0.01 143 NUMERIC_HTTP_ADDR 1044 0.69 1.71 0.51 144 PDS_FROM_2_EMAILS 1029 0.27 1.69 0.02 145 MIME_HTML_ONLY_MULTI 1025 3.25 1.68 3.53 146 MIME_CHARSET_FARAWAY 1013 0.39 1.66 0.16 147 FROM_2_EMAILS_SHORT 1002 0.26 1.64 0.01 148 ADVANCE_FEE_3_NEW_MONEY 995 0.27 1.63 0.02 149 XM_CamelCaseFrm001 993 1.89 1.63 1.94 150 NO_FM_NAME_IP_HOSTN 990 0.26 1.62 0.01 151 XM_B_Phish66 981 1.22 1.61 1.15 152 TR_Symld_Words 976 1.54 1.60 1.53 153 TR_XM_DK_SendGrid 968 3.18 1.59 3.47 154 XM_H_PHPMailer 966 0.63 1.59 0.46 155 TR_XM_SpoofStaff 963 0.42 1.58 0.21 156 CHARSET_FARAWAY_HEADER 959 0.32 1.57 0.09 157 HK_RANDOM_REPLYTO 953 0.40 1.56 0.19 158 XMSpoofStaff2 947 0.41 1.55 0.21 159 DKIM_ADSP_CUSTOM_MED 945 1.00 1.55 0.90 160 PDS_TO_EQ_FROM_NAME 937 0.25 1.54 0.01 161 XM_UB95 933 0.26 1.53 0.02 162 XMLngstWrd_02 928 0.55 1.52 0.37 163 XMSubject_38 919 0.30 1.51 0.08 164 XMSlimDrugH 913 0.70 1.50 0.55 165 TR_XM_FormFill 907 0.30 1.49 0.08 166 T_XMDrugObfuBody_14 907 1.31 1.49 1.28 167 NORMAL_HTTP_TO_IP 899 0.26 1.48 0.04 168 FORM_FRAUD_5 895 0.23 1.47 0.00 169 RELAYCOUNTRY_JP 892 0.25 1.46 0.03 170 NML_ADSP_CUSTOM_MED 889 0.77 1.46 0.64 171 XMDiploma_00 887 1.38 1.46 1.36 172 TR_LOTS_OF_MONEY3 880 0.49 1.44 0.31 173 MONEY_ATM_CARD 862 0.22 1.41 0.00 174 PLING_QUERY 827 0.78 1.36 0.67 175 FORGED_GMAIL_RCVD 817 0.55 1.34 0.40 176 XMStockSpam_06 810 0.98 1.33 0.92 177 TR_Mismatch_TLD_01 807 0.36 1.32 0.18 178 INVESTMENT_ADVICE 797 0.27 1.31 0.08 179 RELAYCOUNTRY_NL 790 0.43 1.30 0.27 180 ALL_TRUSTED 790 17.48 1.30 20.44 181 T_XMHurry_00 787 0.72 1.29 0.61 182 DATE_IN_PAST_03_06 785 0.34 1.29 0.17 183 URI_NOVOWEL 783 0.47 1.28 0.32 184 XM_H_SpoofStaff4 774 0.38 1.27 0.21 185 TR_XM_PSC1 773 0.37 1.27 0.21 186 XM_H_PHPOS_M 760 0.35 1.25 0.18 187 XMSlimDrugs 750 0.41 1.23 0.25 188 XMWghtMeta_00 743 0.46 1.22 0.33 189 HTML_FONT_TINY_NORDNS 734 0.50 1.20 0.37 190 RELAYCOUNTRY_KR 726 0.20 1.19 0.02 191 XMSubLongNoVowel 725 0.22 1.19 0.04 192 XM_BadFromFormat 707 0.33 1.16 0.18 193 XMReplyNow 692 0.27 1.14 0.11 194 XMBdyGiftCard01 682 1.61 1.12 1.70 195 URIBL_BLACK 681 0.20 1.12 0.03 196 TVD_SPACE_RATIO_MINFP 675 0.19 1.11 0.02 197 RELAYCOUNTRY_GB 671 0.65 1.10 0.57 198 FROM_MISSP_REPLYTO 666 0.18 1.09 0.01 199 MONEY_FRAUD_3 662 0.18 1.09 0.01 200 XMSubGiftCard1 651 0.24 1.07 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 329922 98.85 97.33 99.12 2 HTML_MESSAGE 262775 80.10 86.40 78.95 3 RELAYCOUNTRY_US 245029 72.51 66.43 73.62 4 DKIM_SIGNED 238454 72.36 76.25 71.64 5 XM_DK_Pass 235059 71.09 73.65 70.62 6 DKIM_VALID 225027 66.99 63.59 67.61 7 XM_B_Unicode 222012 66.55 65.71 66.70 8 DKIM_VALID_AU 183091 52.39 38.10 55.01 9 XMListUnsubscribeExists 178337 54.00 56.29 53.58 10 BAYES_50 149639 43.61 36.25 44.96 11 XM_B_Unicode3 135647 39.85 34.93 40.75 12 HTML_FONT_LOW_CONTRAST 99223 28.89 23.88 29.81 13 LOC_TINY_FONT_1 90546 27.14 26.81 27.20 14 RCVD_IN_MSPIKE_WL 83638 22.20 6.18 25.13 15 DKIM_VALID_EF 82196 25.31 28.69 24.70 16 RCVD_IN_MSPIKE_H2 76794 24.88 34.74 23.07 17 MIME_HTML_ONLY 69354 22.83 33.71 20.84 18 ALL_TRUSTED 68034 17.48 1.30 20.44 19 T_TM2_M_HEADER_IN_MSG 66644 20.32 21.94 20.02 20 XMSubLong 66191 20.03 20.84 19.89 21 FVGT_m_MULTI_ODD 64547 20.41 25.96 19.39 22 XM_Multi_Part_URI 55877 16.85 17.21 16.79 23 T_KAM_HTML_FONT_INVALID 51543 15.55 15.93 15.49 24 BAYES_00 50004 12.81 0.74 15.02 25 RCVD_IN_MSPIKE_H3 48277 12.82 3.59 14.50 26 XM_DK_Undo_02 47687 20.60 54.86 14.33 27 TM2_M_URI_OPT_OUT 45058 12.13 4.47 13.54 28 ANY_BOUNCE_MESSAGE 43011 11.34 2.69 12.92 29 BOUNCE_MESSAGE 43008 11.34 2.68 12.92 30 XM_Body_Dirty_Words 40581 12.64 15.08 12.19 31 RCVD_IN_RP_SAFE 35875 9.26 0.94 10.78 32 RCVD_IN_RP_CERTIFIED 33678 8.67 0.74 10.12 33 BAYES_99 32981 14.04 36.60 9.91 34 RCVD_IN_MSPIKE_H4 32273 8.58 2.51 9.70 35 HTML_IMAGE_RATIO_02 31876 9.87 11.48 9.58 36 XM_DKIMWhitelistDomains 31312 7.95 0.01 9.41 37 XM_B_Unsub 29633 9.80 14.69 8.90 38 XM_Evil_Numbers_Gen 28946 8.54 7.66 8.70 39 LotsOfNums_01 28207 8.71 10.02 8.47 40 BAYES_999 27248 11.41 28.98 8.19 41 TR_XM_DK_Bayes 26579 6.81 0.42 7.99 42 TR_XM_DK_Bayes1 25052 6.41 0.28 7.53 43 UNPARSEABLE_RELAY 24600 8.68 15.70 7.39 44 TR_XM_DK_Bayes2 23302 5.95 0.22 7.00 45 XM_B_Phish_Phrases 22891 7.33 9.83 6.88 46 BAYES_05 22626 5.91 1.04 6.80 47 RELAYCOUNTRY_META 22207 10.85 33.68 6.67 48 BAYES_60 21951 6.78 7.80 6.60 49 XM_SendGrid 21929 7.60 13.13 6.59 50 BOTNET_IPINHOSTNAME 21598 8.27 18.01 6.49 51 TooManyTo_001 21318 6.19 4.99 6.40 52 HTML_IMAGE_RATIO_04 19363 5.95 6.65 5.82 53 MPART_ALT_DIFF 19143 5.73 5.61 5.75 54 XMStrtUSub 18368 5.45 5.05 5.52 55 LOTS_OF_MONEY 17507 6.13 10.89 5.26 56 T_TooManySym_01 16746 4.56 2.00 5.03 57 BAYES_20 16411 4.48 2.02 4.93 58 XM_H_Long_From01 16017 4.97 5.86 4.81 59 BAYES_40 15463 4.45 3.40 4.65 60 XMSexyCombo_05 15048 5.40 10.20 4.52 61 XMNumbers 14742 4.69 6.09 4.43 62 BAYES_80 14582 4.93 7.94 4.38 63 XMSubMetaSx_00 13467 4.77 8.75 4.05 64 DKIM_INVALID 13427 5.37 12.66 4.03 65 UNTRUSTED_Relay 13349 6.91 22.78 4.01 66 IN_ZIMBRA_NJ_WHITELIST 12937 3.29 0.04 3.89 67 HTML_IMAGE_RATIO_06 12908 3.75 3.08 3.88 68 XM_UncommonTLD01 12871 7.00 24.14 3.87 69 MIME_HTML_MOSTLY 12443 4.10 6.06 3.74 70 XM_H_Trusted_IP 12443 3.16 0.00 3.74 71 FROM_EXCESS_BASE64 12368 4.04 5.81 3.72 72 MIME_HTML_ONLY_MULTI 11754 3.25 1.68 3.53 73 MIME_QP_LONG_LINE 11720 3.26 1.82 3.52 74 TR_XM_DK_SendGrid 11536 3.18 1.59 3.47 75 BOTNET 11122 7.12 27.75 3.34 76 T_TooManySym_02 10416 2.74 0.61 3.13 77 TR_XM_PhishingBody 9926 3.05 3.43 2.98 78 RCVD_IN_IADB_LISTED 9634 2.56 0.72 2.89 79 BAYES_95 8997 2.93 4.17 2.70 80 NO_DNS_FOR_FROM 8683 3.99 11.53 2.61 81 TVD_RCVD_IP 8486 2.22 0.45 2.55 82 RCVD_IN_IADB_SPF 8451 2.25 0.68 2.54 83 HTML_IMAGE_RATIO_08 8294 2.61 3.23 2.49 84 T_REMOTE_IMAGE 7761 2.45 3.07 2.33 85 RCVD_IN_IADB_SENDERID 7622 2.04 0.66 2.29 86 INVALID_MSGID 7487 1.92 0.14 2.25 87 RCVD_IN_IADB_DK 7432 1.99 0.67 2.23 88 HELO_MISC_IP 7176 1.95 0.83 2.16 89 CK_HELO_DYNAMIC_SPLIT_IP 7171 1.97 0.98 2.15 90 RELAYCOUNTRY_CA 7075 3.29 9.63 2.13 91 XM_CamelCaseFrm001 6446 1.89 1.63 1.94 92 TO_MALFORMED 6357 1.63 0.08 1.91 93 XMSubNoVowel 6312 2.02 2.72 1.90 94 SUBJ_ALL_CAPS 5962 2.39 5.65 1.79 95 XM_UB50 5820 2.67 7.71 1.75 96 RCVD_IN_IADB_VOUCHED 5749 1.48 0.13 1.73 97 XMBdyGiftCard01 5648 1.61 1.12 1.70 98 MAILING_LIST_MULTI 5481 1.54 0.96 1.65 99 RCVD_IN_BL_SPAMCOP_NET 5270 4.29 19.06 1.58 100 TR_Symld_Words 5097 1.54 1.60 1.53 101 HTML_FONT_FACE_BAD 5037 1.43 0.98 1.51 102 XM_H_Long_From02 4992 1.38 0.71 1.50 103 XM_PDF 4852 1.34 0.69 1.46 104 XM_B_Unsub2 4784 1.78 3.64 1.44 105 URI_HEX 4652 1.48 1.93 1.40 106 XM_B_SpammyTLD 4648 1.71 3.43 1.40 107 XMGappySubj_01 4619 1.19 0.11 1.39 108 XMDiploma_00 4538 1.38 1.46 1.36 109 USER_IN_DEF_DKIM_WL 4506 1.14 0.00 1.35 110 IN_HORDE_ADDRESS_BOOK 4503 1.19 0.31 1.35 111 T_XMDrugObfuBody_08 4407 1.43 2.03 1.32 112 T_XMDrugObfuBody_14 4261 1.31 1.49 1.28 113 T_TooManySym_03 4235 1.10 0.19 1.27 114 URI_TRY_3LD 4159 1.35 1.87 1.25 115 XMBrknScrpt_02 4049 1.53 3.21 1.22 116 XM_DK_Undo_01 4029 1.14 0.77 1.21 117 HTML_MIME_NO_HTML_TAG 3970 2.38 8.85 1.19 118 XMSubMetaI_00 3933 1.16 1.03 1.18 119 XM_SPF_SoftFail 3922 1.99 6.41 1.18 120 RELAYCOUNTRY_RU 3839 1.35 2.45 1.15 121 XM_B_Phish66 3833 1.22 1.61 1.15 122 TR_MSPIKEBAYES00 3793 0.97 0.03 1.14 123 XM_GoogleGroups 3659 0.99 0.39 1.10 124 RCVD_IN_IADB_OPTIN 3609 0.96 0.26 1.08 125 TM2_M_VERY_LONG_WORD 3563 1.30 2.57 1.07 126 KHOP_HELO_FCRDNS 3407 1.59 4.71 1.02 127 XM_OfRef6 3402 1.42 3.60 1.02 128 XM_ProductURIs 3188 0.93 0.75 0.96 129 RCVD_IN_MSPIKE_H5 3088 0.80 0.08 0.93 130 XMStockSpam_06 3051 0.98 1.33 0.92 131 TooManyTo_002 3040 0.88 0.72 0.91 132 DKIM_ADSP_CUSTOM_MED 3001 1.00 1.55 0.90 133 RCVD_IN_MSPIKE_BL 2823 2.73 13.00 0.85 134 XMGenDplmaNmb 2747 0.82 0.79 0.83 135 XMBody_95 2744 0.71 0.06 0.82 136 RELAYCOUNTRY_FR 2718 1.04 2.27 0.82 137 XMBody_17 2628 1.00 2.18 0.79 138 DKIM_ADSP_NXDOMAIN 2533 1.60 6.15 0.76 139 T_TooManySym_04 2498 0.64 0.06 0.75 140 XM_B_REG_HTML 2445 0.66 0.24 0.73 141 XMHTML_After_End 2370 0.76 1.05 0.71 142 XMPhish08 2318 0.67 0.53 0.70 143 TR_BOTNET_NEGATE 2311 0.63 0.31 0.69 144 HTML_TAG_BALANCE_BODY 2294 0.64 0.38 0.69 145 PLING_QUERY 2237 0.78 1.36 0.67 146 XM_S_SubURI 2231 0.58 0.12 0.67 147 TR_XM_UnparsRelay 2138 1.12 3.71 0.64 148 T_XMDrugObfuBody_00 2137 0.68 0.89 0.64 149 XM_B_COVIDMETA 2132 0.81 1.77 0.64 150 NML_ADSP_CUSTOM_MED 2130 0.77 1.46 0.64 151 TooManyTo_003 2113 0.61 0.45 0.63 152 TR_MetaPhish_Combo_01 2111 0.66 0.79 0.63 153 THIS_AD 2100 0.65 0.75 0.63 154 DIET_1 2096 0.97 2.80 0.63 155 XMPhish30 2035 0.66 0.92 0.61 156 T_XMHurry_00 2030 0.72 1.29 0.61 157 XMLngstWrd_00 2003 0.94 2.80 0.60 158 T_TooManySym_05 1970 0.51 0.04 0.59 159 RELAYCOUNTRY_GB 1903 0.65 1.10 0.57 160 T_FILL_THIS_FORM_SHORT 1854 0.90 2.78 0.56 161 XMSlimDrugH 1829 0.70 1.50 0.55 162 XMPhish14 1804 0.53 0.44 0.54 163 XM_B_COPY_HTML 1794 0.56 0.65 0.54 164 RCVD_IN_MSPIKE_L3 1774 1.05 3.91 0.53 165 URI_OPTOUT_3LD 1769 0.83 2.45 0.53 166 TooManyTo_004 1758 0.51 0.42 0.53 167 XMSubMetaSxObfu_02 1728 0.52 0.55 0.52 168 USER_IN_WHITELIST 1720 0.44 0.00 0.52 169 TO_IN_SUBJ 1696 0.80 2.40 0.51 170 NUMERIC_HTTP_ADDR 1683 0.69 1.71 0.51 171 XM_DIRTYINTL 1682 1.14 4.58 0.51 172 SUBJ_DOLLARS 1640 0.45 0.23 0.49 173 XMLngstWrd_01 1629 0.74 2.13 0.49 174 XM_RXBody 1583 0.53 0.84 0.48 175 SpammyFromTLD_01 1580 1.30 5.78 0.47 176 XM_H_PHPMailer 1532 0.63 1.59 0.46 177 TooManyTo_005 1495 0.44 0.36 0.45 178 HTML_IMAGE_ONLY_20 1488 0.53 1.00 0.45 179 XMSexyCombo_01 1427 0.70 2.18 0.43 180 XMBody_78 1419 0.47 0.74 0.43 181 FORGED_GMAIL_RCVD 1345 0.55 1.34 0.40 182 RDNS_DYNAMIC 1333 0.69 2.26 0.40 183 TR_XM_COVIDMETA4 1321 0.75 2.65 0.40 184 XMHTMLBadTable_001 1286 0.39 0.41 0.39 185 HTTPS_HTTP_MISMATCH 1280 0.41 0.53 0.38 186 XM_ShortIntro_01 1276 0.60 1.81 0.38 187 XMLngstWrd_02 1237 0.55 1.52 0.37 188 HTML_FONT_TINY_NORDNS 1231 0.50 1.20 0.37 189 HELO_NODOT 1211 0.43 0.81 0.36 190 TR_XM_PHPDW 1211 0.83 3.39 0.36 191 HELO_NO_DOMAIN 1205 0.43 0.81 0.36 192 MPART_ALT_DIFF_COUNT 1200 0.65 2.20 0.36 193 XM_Akamai 1187 0.30 0.02 0.36 194 XMCapTrack 1169 0.36 0.40 0.35 195 TR_XM_FormFill2 1159 0.81 3.32 0.35 196 TR_XM_PHPForged 1157 0.81 3.35 0.35 197 DATE_IN_PAST_06_12 1147 0.39 0.61 0.34 198 XMSubMetaSxObfu_03 1143 0.41 0.76 0.34 199 XM_H_PHPOS 1131 0.80 3.31 0.34 200 T_Symld_Words_02 1122 0.38 0.58 0.34 ----------------------------------------------------------------------