Email: 406563 Autolearn: 0 AvgScore: 1.46 AvgScanTime: 1.61 sec Spam: 81389 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 2.54 sec Ham: 325174 Autolearn: 0 AvgScore: -1.78 AvgScanTime: 1.38 sec Time Spent Running SA: 182.00 hours Time Spent Processing Spam: 57.52 hours Time Spent Processing Ham: 124.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 78074 98.40 95.93 99.02 2 HTML_MESSAGE 74053 81.82 90.99 79.53 3 XM_B_Unicode 55340 67.16 67.99 66.95 4 RELAYCOUNTRY_US 51826 72.47 63.68 74.68 5 DKIM_SIGNED 43182 69.69 53.06 73.86 6 XM_DK_Pass 41650 68.62 51.17 72.98 7 DKIM_VALID 35803 64.63 43.99 69.80 8 MIME_HTML_ONLY 35036 25.84 43.05 21.53 9 XMListUnsubscribeExists 34737 52.43 42.68 54.87 10 RCVD_IN_MSPIKE_H2 31135 26.57 38.25 23.65 11 XM_DK_Undo_02 30033 18.62 36.90 14.05 12 RELAYCOUNTRY_META 27133 11.47 33.34 5.99 13 DKIM_VALID_AU 25981 51.30 31.92 56.15 14 BOTNET 25326 8.85 31.12 3.28 15 BAYES_99 25139 14.18 30.89 10.00 16 BAYES_50 23088 41.97 28.37 45.37 17 UNTRUSTED_Relay 22210 8.03 27.29 3.22 18 XM_B_Unicode3 21878 37.30 26.88 39.91 19 HTML_MIME_NO_HTML_TAG 21082 6.62 25.90 1.80 20 T_TM2_M_HEADER_IN_MSG 20523 21.98 25.22 21.17 21 RCVD_IN_BL_SPAMCOP_NET 19960 6.06 24.52 1.44 22 T_REMOTE_IMAGE 19312 7.09 23.73 2.93 23 BODY_URI_ONLY 19305 4.79 23.72 0.05 24 BAYES_999 18234 10.88 22.40 7.99 25 LOTS_OF_MONEY 17765 10.46 21.83 7.61 26 LOC_TINY_FONT_1 17503 26.74 21.51 28.05 27 RCVD_IN_PSBL 17243 4.31 21.19 0.09 28 BAYES_80 16905 7.99 20.77 4.79 29 FVGT_m_MULTI_ODD 16614 21.34 20.41 21.57 30 DKIM_VALID_EF 16481 25.60 20.25 26.94 31 HTML_IMAGE_ONLY_12 15932 4.05 19.58 0.16 32 HTML_SHORT_LINK_IMG_2 15672 3.91 19.26 0.07 33 XMSubGiftCard1 15594 3.87 19.16 0.04 34 HTML_FONT_LOW_CONTRAST 13722 26.64 16.86 29.09 35 XMBody_17 12837 4.02 15.77 1.07 36 XMSubLong 12822 20.20 15.75 21.31 37 XM_Multi_Part_URI 12453 17.90 15.30 18.55 38 XM_Body_Dirty_Words 11772 14.11 14.46 14.02 39 TR_LOTS_OF_MONEY3 10524 3.05 12.93 0.58 40 BOTNET_IPINHOSTNAME 9947 7.60 12.22 6.45 41 T_KAM_HTML_FONT_INVALID 9906 15.43 12.17 16.25 42 SUBJ_ALL_CAPS 9306 3.37 11.43 1.35 43 BOTNET_NORDNS 8691 2.15 10.68 0.02 44 NO_DNS_FOR_FROM 8435 4.07 10.36 2.49 45 XM_UncommonTLD01 8321 4.78 10.22 3.42 46 XM_ShortIntro_01 8140 2.28 10.00 0.35 47 BAYES_60 8068 7.48 9.91 6.87 48 MISSING_HEADERS 8004 2.14 9.83 0.21 49 REPLYTO_WITHOUT_TO_CC 7892 1.98 9.70 0.04 50 HELO_NODOT 7886 2.35 9.69 0.51 51 HELO_NO_DOMAIN 7873 2.34 9.67 0.51 52 TR_LOTS_OF_MONEY1 7794 1.93 9.58 0.02 53 XM_UB80 7640 1.96 9.39 0.10 54 XMSexyCombo_05 7508 5.81 9.22 4.95 55 TR_Caps_n_Bayes_80 7489 1.93 9.20 0.11 56 DKIM_INVALID 7379 5.06 9.07 4.06 57 XM_B_Unsub 7018 9.41 8.62 9.60 58 HTML_IMAGE_RATIO_02 6905 8.43 8.48 8.42 59 LotsOfNums_01 6675 8.35 8.20 8.39 60 RCVD_IN_MSPIKE_BL 6453 2.14 7.93 0.69 61 KHOP_HELO_FCRDNS 6237 2.49 7.66 1.19 62 RELAYCOUNTRY_CA 6065 3.23 7.45 2.18 63 RCVD_IN_RP_RNBL 5798 1.57 7.12 0.18 64 BAYES_95 5622 3.82 6.91 3.05 65 XM_UB50 5259 2.26 6.46 1.21 66 RELAYCOUNTRY_IE 5186 1.36 6.37 0.11 67 XM_B_Phish_Phrases 5103 6.51 6.27 6.57 68 XMSubMetaSx_00 4856 4.67 5.97 4.35 69 PDS_OTHER_BAD_TLD 4524 1.45 5.56 0.42 70 HK_RANDOM_FROM 4294 1.13 5.28 0.09 71 RCVD_IN_MSPIKE_WL 4287 22.00 5.27 26.18 72 XM_Evil_Numbers_Gen 4189 8.07 5.15 8.80 73 XM_DIRTYINTL 3867 1.41 4.75 0.57 74 XM_SPF_SoftFail 3759 1.99 4.62 1.33 75 RCVD_IN_MSPIKE_L5 3744 1.10 4.60 0.23 76 TooManyTo_001 3584 6.01 4.40 6.42 77 TR_XM_PhishingBody 3546 3.03 4.36 2.69 78 XMSubEmpty 3413 0.98 4.19 0.18 79 XM_UB60 3280 0.94 4.03 0.16 80 XM_H_Long_From01 3254 4.73 4.00 4.92 81 XM_UB99 3224 0.80 3.96 0.01 82 SpammyFromTLD_01 3113 1.18 3.82 0.52 83 UNPARSEABLE_RELAY 3084 7.12 3.79 7.95 84 MPART_ALT_DIFF 2920 4.52 3.59 4.75 85 SHORT_SHORTNER 2713 0.70 3.33 0.04 86 RELAYCOUNTRY_JP 2641 0.68 3.24 0.03 87 SHORT_URI_3 2627 0.73 3.23 0.10 88 DKIM_ADSP_NXDOMAIN 2621 1.24 3.22 0.74 89 XM_DK_Undo_01 2602 1.79 3.20 1.44 90 RCVD_IN_MSPIKE_H3 2588 12.95 3.18 15.39 91 HTML_IMAGE_ONLY_08 2559 0.70 3.14 0.09 92 HTML_SHORT_LINK_IMG_1 2543 0.64 3.12 0.02 93 XM_B_SpammyTLD 2512 2.08 3.09 1.83 94 XMStrtUSub 2457 4.15 3.02 4.44 95 XM_SendGrid 2446 6.16 3.01 6.94 96 MSGID_FROM_MTA_HEADER 2429 0.73 2.98 0.16 97 URIBL_SBL_A 2376 0.74 2.92 0.20 98 TR_Sbj_FN_Bdy 2320 0.69 2.85 0.14 99 XM_B_Phish66 2300 1.53 2.83 1.21 100 MIME_HTML_MOSTLY 2286 2.56 2.81 2.49 101 XM_UB95 2264 0.57 2.78 0.02 102 TR_XM_INV_DKIM 2254 0.77 2.77 0.27 103 HTML_IMAGE_RATIO_04 2250 4.49 2.76 4.92 104 RCVD_IN_MSPIKE_L3 2238 0.90 2.75 0.44 105 MISSING_SUBJECT 2199 0.60 2.70 0.07 106 XMNoSubject 2199 0.60 2.70 0.07 107 XM_B_COVIDMETA 2185 1.51 2.68 1.22 108 XM_OfRef6 2085 1.25 2.56 0.93 109 TR_XM_MaxWHORU 2078 0.57 2.55 0.07 110 XMBrknScrpt_02 2061 1.54 2.53 1.29 111 TR_XM_UnparsRelay 1988 1.09 2.44 0.76 112 XMSubNoVowel 1954 1.04 2.40 0.69 113 FROM_LOCAL_NOVOWEL 1908 0.49 2.34 0.03 114 HTML_IMAGE_RATIO_08 1878 2.23 2.31 2.21 115 FROM_EXCESS_BASE64 1872 3.25 2.30 3.48 116 XMNumbers 1857 3.66 2.28 4.01 117 XMLngstWrd_00 1825 0.65 2.24 0.26 118 SpammyFromTLD_02 1824 0.62 2.24 0.21 119 XM_CamelCaseFrm001 1803 2.14 2.22 2.12 120 TM2_M_VERY_LONG_WORD 1767 1.42 2.17 1.23 121 TR_XM_MaxBayes 1753 0.45 2.15 0.02 122 NO_FM_NAME_IP_HOSTN 1737 0.43 2.13 0.01 123 HTML_IMAGE_RATIO_06 1725 3.14 2.12 3.39 124 TR_XM_PHPDW 1712 0.77 2.10 0.44 125 TR_XM_COVIDMETA4 1705 0.78 2.09 0.46 126 TR_XM_PHPForged 1673 0.74 2.06 0.41 127 TM2_M_URI_OPT_OUT 1666 10.21 2.05 12.26 128 TR_XM_FormFill2 1664 0.73 2.04 0.40 129 XM_H_PHPOS 1657 0.73 2.04 0.40 130 TR_XM_MaxSPIKE 1627 0.47 2.00 0.09 131 FROM_SUSPICIOUS_NTLD 1609 0.43 1.98 0.05 132 XM_JunkDunk 1606 0.40 1.97 0.00 133 RCVD_IN_MSPIKE_H4 1598 8.08 1.96 9.61 134 FVGT_m_MULTI_ODD_EMAIL 1558 0.42 1.91 0.04 135 FROM_SUSPICIOUS_NTLD_FP 1557 0.42 1.91 0.04 136 XMSexyCombo_01 1495 0.88 1.84 0.64 137 TR_Mismatch_TLD_02 1491 0.42 1.83 0.07 138 XM_UB999 1473 0.37 1.81 0.00 139 DATE_IN_PAST_03_06 1443 0.49 1.77 0.17 140 LONG_JUNK_URI 1412 0.39 1.73 0.06 141 XMLngstWrd_01 1356 0.51 1.67 0.21 142 ONLINE_PHARMACY 1331 0.33 1.64 0.01 143 PDS_FROM_2_EMAILS 1330 0.34 1.63 0.01 144 TVD_VISIT_PHARMA 1317 0.33 1.62 0.01 145 FROM_2_EMAILS_SHORT 1299 0.32 1.60 0.00 146 XM_URI_RBL 1269 0.46 1.56 0.18 147 T_XMDrugObfuBody_08 1251 1.54 1.54 1.55 148 RELAYCOUNTRY_FR 1205 0.49 1.48 0.24 149 MIME_HTML_ONLY_MULTI 1203 2.63 1.48 2.92 150 URI_HEX 1180 1.59 1.45 1.63 151 TR_XM_RelayPhish 1175 0.39 1.44 0.13 152 PDS_TO_EQ_FROM_NAME 1149 0.29 1.41 0.01 153 TR_Mismatch_TLD_01 1146 0.51 1.41 0.28 154 RELAYCOUNTRY_HK 1102 0.28 1.35 0.01 155 XMStockSpam_06 1072 0.92 1.32 0.82 156 MIME_CHARSET_FARAWAY 1065 0.32 1.31 0.08 157 RDNS_DYNAMIC 1053 0.68 1.29 0.52 158 XM_B_Unsub2 1043 1.29 1.28 1.29 159 T_TooManySym_01 1043 4.81 1.28 5.69 160 CHARSET_FARAWAY_HEADER 1031 0.26 1.27 0.01 161 XMBdyGiftCard01 1029 1.47 1.26 1.52 162 FROM_MISSP_REPLYTO 1029 0.26 1.26 0.01 163 XMDiploma_00 1023 1.25 1.26 1.25 164 TR_XM_SpoofStaff 998 0.31 1.23 0.09 165 XMSpoofStaff2 986 0.31 1.21 0.09 166 BAYES_40 982 3.45 1.21 4.01 167 MIMEOLE_DIRECT_TO_MX 978 0.24 1.20 0.00 168 MPART_ALT_DIFF_COUNT 971 0.59 1.19 0.43 169 MIME_QP_LONG_LINE 970 3.41 1.19 3.96 170 RELAYCOUNTRY_DE 964 0.43 1.18 0.24 171 TR_Caps_n_Bayes_99 963 0.42 1.18 0.23 172 T_MONEY_PERCENT 937 0.37 1.15 0.17 173 TR_LOTS_OF_MONEY2 937 0.37 1.15 0.17 174 HDR_ORDER_FTSDMCXX_DIRECT 929 0.23 1.14 0.00 175 T_XMHurry_00 922 0.82 1.13 0.74 176 HK_RANDOM_REPLYTO 917 0.38 1.13 0.19 177 TR_XM_COVIDMETA1 913 0.41 1.12 0.23 178 XMLngstWrd_02 907 0.35 1.11 0.16 179 ALL_TRUSTED 904 16.34 1.11 20.15 180 URI_TRY_3LD 899 1.32 1.10 1.38 181 XMSexyCombo_04 891 0.38 1.09 0.20 182 RELAYCOUNTRY_GB 886 0.66 1.09 0.55 183 DKIM_ADSP_CUSTOM_MED 875 0.87 1.08 0.82 184 T_XMDrugObfuBody_14 874 1.21 1.07 1.24 185 RELAYCOUNTRY_SG 869 0.26 1.07 0.05 186 XMSlimDrugH 860 0.49 1.06 0.34 187 TR_XM_PSC1 858 0.28 1.05 0.09 188 XM_H_SpoofStaff4 858 0.28 1.05 0.09 189 PDS_BTC_ID 851 0.23 1.05 0.02 190 RELAYCOUNTRY_NL 848 0.47 1.04 0.32 191 RELAYCOUNTRY_AU 844 0.45 1.04 0.31 192 INVESTMENT_ADVICE 839 0.30 1.03 0.11 193 FILL_THIS_FORM 823 0.38 1.01 0.22 194 DOS_OE_TO_MX 812 0.20 1.00 0.00 195 FILL_THIS_FORM_LONG 808 0.28 0.99 0.10 196 FUZZY_CREDIT 801 0.23 0.98 0.04 197 MONEY_FROM_MISSP 767 0.19 0.94 0.00 198 T_FILL_THIS_FORM_SHORT 764 0.66 0.94 0.58 199 BAYES_20 750 3.83 0.92 4.56 200 FUZZY_BITCOIN 743 0.18 0.91 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 321995 98.40 95.93 99.02 2 HTML_MESSAGE 258595 81.82 90.99 79.53 3 RELAYCOUNTRY_US 242824 72.47 63.68 74.68 4 DKIM_SIGNED 240170 69.69 53.06 73.86 5 XM_DK_Pass 237327 68.62 51.17 72.98 6 DKIM_VALID 226978 64.63 43.99 69.80 7 XM_B_Unicode 217707 67.16 67.99 66.95 8 DKIM_VALID_AU 182601 51.30 31.92 56.15 9 XMListUnsubscribeExists 178424 52.43 42.68 54.87 10 BAYES_50 147533 41.97 28.37 45.37 11 XM_B_Unicode3 129774 37.30 26.88 39.91 12 HTML_FONT_LOW_CONTRAST 94582 26.64 16.86 29.09 13 LOC_TINY_FONT_1 91209 26.74 21.51 28.05 14 DKIM_VALID_EF 87587 25.60 20.25 26.94 15 RCVD_IN_MSPIKE_WL 85143 22.00 5.27 26.18 16 RCVD_IN_MSPIKE_H2 76893 26.57 38.25 23.65 17 FVGT_m_MULTI_ODD 70138 21.34 20.41 21.57 18 MIME_HTML_ONLY 70013 25.84 43.05 21.53 19 XMSubLong 69295 20.20 15.75 21.31 20 T_TM2_M_HEADER_IN_MSG 68840 21.98 25.22 21.17 21 ALL_TRUSTED 65517 16.34 1.11 20.15 22 XM_Multi_Part_URI 60334 17.90 15.30 18.55 23 T_KAM_HTML_FONT_INVALID 52828 15.43 12.17 16.25 24 RCVD_IN_MSPIKE_H3 50045 12.95 3.18 15.39 25 BAYES_00 47159 11.71 0.53 14.50 26 XM_DK_Undo_02 45681 18.62 36.90 14.05 27 XM_Body_Dirty_Words 45577 14.11 14.46 14.02 28 TM2_M_URI_OPT_OUT 39860 10.21 2.05 12.26 29 ANY_BOUNCE_MESSAGE 36456 9.03 0.32 11.21 30 BOUNCE_MESSAGE 36455 9.03 0.32 11.21 31 BAYES_99 32524 14.18 30.89 10.00 32 RCVD_IN_RP_SAFE 31496 7.90 0.76 9.69 33 RCVD_IN_MSPIKE_H4 31257 8.08 1.96 9.61 34 XM_B_Unsub 31221 9.41 8.62 9.60 35 XM_DKIMWhitelistDomains 30013 7.38 0.01 9.23 36 RCVD_IN_RP_CERTIFIED 29669 7.39 0.45 9.12 37 XM_Evil_Numbers_Gen 28626 8.07 5.15 8.80 38 HTML_IMAGE_RATIO_02 27364 8.43 8.48 8.42 39 LotsOfNums_01 27272 8.35 8.20 8.39 40 TR_XM_DK_Bayes 27024 6.70 0.24 8.31 41 BAYES_999 25996 10.88 22.40 7.99 42 UNPARSEABLE_RELAY 25849 7.12 3.79 7.95 43 TR_XM_DK_Bayes1 25682 6.34 0.12 7.90 44 LOTS_OF_MONEY 24757 10.46 21.83 7.61 45 TR_XM_DK_Bayes2 23318 5.76 0.11 7.17 46 XM_SendGrid 22581 6.16 3.01 6.94 47 BAYES_60 22333 7.48 9.91 6.87 48 BAYES_05 21749 5.45 0.49 6.69 49 XM_B_Phish_Phrases 21365 6.51 6.27 6.57 50 BOTNET_IPINHOSTNAME 20959 7.60 12.22 6.45 51 TooManyTo_001 20860 6.01 4.40 6.42 52 RELAYCOUNTRY_META 19489 11.47 33.34 5.99 53 T_TooManySym_01 18499 4.81 1.28 5.69 54 XMSexyCombo_05 16104 5.81 9.22 4.95 55 XM_H_Long_From01 15986 4.73 4.00 4.92 56 HTML_IMAGE_RATIO_04 15985 4.49 2.76 4.92 57 BAYES_80 15579 7.99 20.77 4.79 58 MPART_ALT_DIFF 15453 4.52 3.59 4.75 59 BAYES_20 14841 3.83 0.92 4.56 60 XMStrtUSub 14429 4.15 3.02 4.44 61 XMSubMetaSx_00 14138 4.67 5.97 4.35 62 IN_ZIMBRA_NJ_WHITELIST 13698 3.38 0.06 4.21 63 TR_XM_DK_SendGrid 13456 3.49 0.89 4.14 64 DKIM_INVALID 13192 5.06 9.07 4.06 65 XMNumbers 13039 3.66 2.28 4.01 66 BAYES_40 13036 3.45 1.21 4.01 67 MIME_QP_LONG_LINE 12891 3.41 1.19 3.96 68 RCVD_IN_IADB_LISTED 11453 2.93 0.58 3.52 69 FROM_EXCESS_BASE64 11321 3.25 2.30 3.48 70 T_TooManySym_02 11169 2.84 0.44 3.43 71 XM_UncommonTLD01 11126 4.78 10.22 3.42 72 HTML_IMAGE_RATIO_06 11021 3.14 2.12 3.39 73 BOTNET 10667 8.85 31.12 3.28 74 UNTRUSTED_Relay 10457 8.03 27.29 3.22 75 BAYES_95 9909 3.82 6.91 3.05 76 RCVD_IN_IADB_SPF 9795 2.52 0.55 3.01 77 T_REMOTE_IMAGE 9530 7.09 23.73 2.93 78 MIME_HTML_ONLY_MULTI 9503 2.63 1.48 2.92 79 TVD_RCVD_IP 9119 2.34 0.47 2.80 80 TR_XM_PhishingBody 8759 3.03 4.36 2.69 81 RCVD_IN_IADB_SENDERID 8736 2.26 0.53 2.69 82 RCVD_IN_IADB_DK 8437 2.18 0.54 2.59 83 MIME_HTML_MOSTLY 8112 2.56 2.81 2.49 84 NO_DNS_FOR_FROM 8105 4.07 10.36 2.49 85 HELO_MISC_IP 7569 1.98 0.58 2.33 86 CK_HELO_DYNAMIC_SPLIT_IP 7564 2.04 0.88 2.33 87 RCVD_IN_IADB_VOUCHED 7390 1.84 0.09 2.27 88 INVALID_MSGID 7303 1.96 0.83 2.25 89 HTML_IMAGE_RATIO_08 7187 2.23 2.31 2.21 90 RELAYCOUNTRY_CA 7080 3.23 7.45 2.18 91 XM_CamelCaseFrm001 6880 2.14 2.22 2.12 92 TO_MALFORMED 6438 1.60 0.07 1.98 93 TR_Symld_Words 6273 1.70 0.79 1.93 94 XM_PDF 6202 1.60 0.38 1.91 95 XM_B_SpammyTLD 5954 2.08 3.09 1.83 96 HTML_MIME_NO_HTML_TAG 5850 6.62 25.90 1.80 97 XM_H_Trusted_IP 5598 1.38 0.00 1.72 98 MAILING_LIST_MULTI 5597 1.55 0.86 1.72 99 URI_HEX 5290 1.59 1.45 1.63 100 T_XMDrugObfuBody_08 5025 1.54 1.54 1.55 101 XMBdyGiftCard01 4954 1.47 1.26 1.52 102 XMGappySubj_01 4888 1.23 0.12 1.50 103 RCVD_IN_IADB_OPTIN 4828 1.24 0.25 1.48 104 IN_HORDE_ADDRESS_BOOK 4774 1.23 0.29 1.47 105 RCVD_IN_BL_SPAMCOP_NET 4692 6.06 24.52 1.44 106 XM_DK_Undo_01 4687 1.79 3.20 1.44 107 USER_IN_DEF_DKIM_WL 4622 1.14 0.00 1.42 108 URI_TRY_3LD 4474 1.32 1.10 1.38 109 SUBJ_ALL_CAPS 4402 3.37 11.43 1.35 110 XM_SPF_SoftFail 4327 1.99 4.62 1.33 111 T_TooManySym_03 4299 1.08 0.09 1.32 112 XMBrknScrpt_02 4188 1.54 2.53 1.29 113 XM_B_Unsub2 4183 1.29 1.28 1.29 114 XMDiploma_00 4064 1.25 1.26 1.25 115 T_XMDrugObfuBody_14 4044 1.21 1.07 1.24 116 TM2_M_VERY_LONG_WORD 3990 1.42 2.17 1.23 117 XM_B_COVIDMETA 3971 1.51 2.68 1.22 118 XM_ProductURIs 3962 1.10 0.62 1.22 119 XM_UB50 3935 2.26 6.46 1.21 120 XM_GoogleGroups 3933 1.03 0.31 1.21 121 XM_B_Phish66 3920 1.53 2.83 1.21 122 XMBody_95 3915 0.98 0.07 1.20 123 KHOP_HELO_FCRDNS 3883 2.49 7.66 1.19 124 RCVD_IN_MSPIKE_H5 3841 0.97 0.12 1.18 125 RELAYCOUNTRY_RU 3838 1.08 0.66 1.18 126 XM_H_Long_From02 3549 0.98 0.51 1.09 127 XMBody_17 3494 4.02 15.77 1.07 128 TooManyTo_002 3474 0.96 0.55 1.07 129 HTML_FONT_FACE_BAD 3141 0.86 0.42 0.97 130 XM_OfRef6 3010 1.25 2.56 0.93 131 TR_MetaPhish_Combo_01 2975 0.85 0.58 0.91 132 DKIM_ADSP_CUSTOM_MED 2670 0.87 1.08 0.82 133 XMStockSpam_06 2655 0.92 1.32 0.82 134 TR_MSPIKEBAYES00 2614 0.64 0.00 0.80 135 XM_RXBody 2581 0.78 0.71 0.79 136 TR_XM_UnparsRelay 2458 1.09 2.44 0.76 137 T_TooManySym_04 2439 0.61 0.03 0.75 138 DKIM_ADSP_NXDOMAIN 2407 1.24 3.22 0.74 139 T_XMHurry_00 2407 0.82 1.13 0.74 140 TooManyTo_003 2350 0.63 0.27 0.72 141 XM_B_REG_HTML 2306 0.59 0.14 0.71 142 XMSubNoVowel 2258 1.04 2.40 0.69 143 XM_S_SubURI 2255 0.57 0.07 0.69 144 PLING_QUERY 2246 0.62 0.31 0.69 145 RCVD_IN_MSPIKE_BL 2231 2.14 7.93 0.69 146 XMPhish30 2185 0.68 0.73 0.67 147 TR_BOTNET_NEGATE 2179 0.62 0.41 0.67 148 XMGenDplmaNmb 2113 0.65 0.67 0.65 149 DIET_1 2105 0.68 0.83 0.65 150 XMHTML_After_End 2078 0.66 0.76 0.64 151 XMSexyCombo_01 2066 0.88 1.84 0.64 152 USER_IN_WHITELIST 1971 0.48 0.00 0.61 153 T_XMDrugObfuBody_00 1942 0.61 0.68 0.60 154 TooManyTo_004 1939 0.53 0.25 0.60 155 XM_H_PHPMailer 1902 0.65 0.89 0.58 156 T_FILL_THIS_FORM_SHORT 1901 0.66 0.94 0.58 157 T_TooManySym_05 1899 0.47 0.00 0.58 158 TR_LOTS_OF_MONEY3 1883 3.05 12.93 0.58 159 XM_DIRTYINTL 1866 1.41 4.75 0.57 160 NML_ADSP_CUSTOM_MED 1848 0.64 0.90 0.57 161 XM_B_COPY_HTML 1841 0.50 0.25 0.57 162 RELAYCOUNTRY_GB 1801 0.66 1.09 0.55 163 HTML_TAG_BALANCE_BODY 1751 0.57 0.67 0.54 164 XMBSHREFv2 1718 0.45 0.14 0.53 165 XMSubMetaI_00 1714 0.54 0.59 0.53 166 RDNS_DYNAMIC 1702 0.68 1.29 0.52 167 SpammyFromTLD_01 1690 1.18 3.82 0.52 168 TooManyTo_005 1680 0.46 0.22 0.52 169 HELO_NODOT 1660 2.35 9.69 0.51 170 XMPhish08 1658 0.52 0.56 0.51 171 HELO_NO_DOMAIN 1658 2.34 9.67 0.51 172 HTTPS_HTTP_MISMATCH 1638 0.54 0.68 0.50 173 XMBody_78 1595 0.53 0.67 0.49 174 XMMoneyMeta_00 1544 0.47 0.45 0.47 175 XM_D_tchamptons_WL 1537 0.40 0.13 0.47 176 NUMERIC_HTTP_ADDR 1526 0.47 0.47 0.47 177 XMSubMetaSxObfu_02 1506 0.43 0.30 0.46 178 TR_XM_COVIDMETA4 1485 0.78 2.09 0.46 179 RCVD_IN_MSPIKE_L3 1430 0.90 2.75 0.44 180 XMHTMLBadTable_001 1427 0.40 0.25 0.44 181 TR_XM_PHPDW 1415 0.77 2.10 0.44 182 MPART_ALT_DIFF_COUNT 1413 0.59 1.19 0.43 183 DATE_IN_PAST_06_12 1401 0.44 0.50 0.43 184 PDS_OTHER_BAD_TLD 1360 1.45 5.56 0.42 185 HTML_IMAGE_ONLY_20 1336 0.35 0.13 0.41 186 TR_XM_PHPForged 1319 0.74 2.06 0.41 187 SUBJ_DOLLARS 1313 0.41 0.44 0.40 188 TR_XM_FormFill2 1309 0.73 2.04 0.40 189 XM_H_PHPOS 1295 0.73 2.04 0.40 190 FORGED_GMAIL_RCVD 1244 0.48 0.89 0.38 191 XMSubMetaSxObfu_03 1144 0.38 0.47 0.35 192 XM_ShortIntro_01 1139 2.28 10.00 0.35 193 BASE64_LENGTH_79_INF 1122 0.37 0.48 0.35 194 XMSlimDrugH 1117 0.49 1.06 0.34 195 URI_NOVOWEL 1104 0.43 0.78 0.34 196 HTML_TEXT_INVISIBLE_STYLE 1098 0.31 0.20 0.34 197 XMCapTrack 1070 0.31 0.22 0.33 198 TVD_SPACE_RATIO 1053 0.35 0.46 0.32 199 RELAYCOUNTRY_NL 1048 0.47 1.04 0.32 200 HTML_IMAGE_ONLY_32 1044 0.29 0.17 0.32 ----------------------------------------------------------------------