Email: 413837 Autolearn: 0 AvgScore: 0.41 AvgScanTime: 1.45 sec Spam: 57143 Autolearn: 0 AvgScore: 13.01 AvgScanTime: 2.78 sec Ham: 356694 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.23 sec Time Spent Running SA: 166.32 hours Time Spent Processing Spam: 44.06 hours Time Spent Processing Ham: 122.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 55582 98.88 97.27 99.13 2 HTML_MESSAGE 48888 74.84 85.55 73.13 3 DKIM_SIGNED 41897 68.86 73.32 68.14 4 XM_B_Unicode 41207 63.79 72.11 62.45 5 XM_DK_Pass 40846 67.74 71.48 67.14 6 XMListUnsubscribeExists 38201 53.28 66.85 51.11 7 RELAYCOUNTRY_US 36548 67.93 63.96 68.56 8 DKIM_VALID 35872 64.41 62.78 64.67 9 XM_DK_Undo_02 30970 18.58 54.20 12.87 10 BAYES_99 27020 14.31 47.28 9.03 11 DKIM_VALID_AU 25534 50.60 44.68 51.55 12 XM_B_Unicode3 21595 37.01 37.79 36.88 13 BAYES_999 20850 11.32 36.49 7.29 14 RELAYCOUNTRY_META 18231 9.25 31.90 5.62 15 LOC_TINY_FONT_1 17678 26.06 30.94 25.28 16 BAYES_50 16005 39.99 28.01 41.91 17 RCVD_IN_MSPIKE_H2 15745 23.24 27.55 22.55 18 DKIM_VALID_EF 15243 24.83 26.68 24.54 19 MIME_HTML_ONLY 15115 20.64 26.45 19.71 20 BOTNET 14998 6.10 26.25 2.87 21 FVGT_m_MULTI_ODD 14847 20.53 25.98 19.66 22 HTML_FONT_LOW_CONTRAST 13558 26.48 23.73 26.93 23 T_TM2_M_HEADER_IN_MSG 13306 19.42 23.29 18.80 24 UNTRUSTED_Relay 13208 5.68 23.11 2.89 25 XM_UncommonTLD01 12858 5.71 22.50 3.02 26 T_KAM_HTML_FONT_INVALID 12269 15.90 21.47 15.00 27 XM_Body_Dirty_Words 11223 13.28 19.64 12.26 28 XM_Multi_Part_URI 11168 20.13 19.54 20.22 29 XMSubLong 10898 18.80 19.07 18.75 30 RCVD_IN_MSPIKE_BL 10308 3.11 18.04 0.72 31 LOTS_OF_MONEY 9054 8.06 15.84 6.81 32 BOTNET_IPINHOSTNAME 8646 7.39 15.13 6.15 33 RCVD_IN_BL_SPAMCOP_NET 7914 3.35 13.85 1.66 34 RCVD_IN_RP_RNBL 7212 1.81 12.62 0.07 35 RCVD_IN_MSPIKE_L5 6583 1.71 11.52 0.14 36 RCVD_IN_PSBL 6245 1.61 10.93 0.12 37 DKIM_INVALID 6025 4.45 10.54 3.47 38 HTML_IMAGE_RATIO_02 5996 8.26 10.49 7.91 39 NO_DNS_FOR_FROM 5928 3.15 10.37 1.99 40 XM_B_Phish_Phrases 5716 6.93 10.00 6.44 41 XMSexyCombo_05 5689 5.15 9.96 4.38 42 RELAYCOUNTRY_CA 5621 3.25 9.84 2.20 43 XM_B_Unsub 5551 8.82 9.71 8.67 44 XMSubMetaSx_00 5399 5.17 9.45 4.48 45 MPART_ALT_DIFF 5125 5.26 8.97 4.66 46 XM_UB99 5003 1.22 8.76 0.01 47 XM_SPF_SoftFail 4923 2.16 8.62 1.12 48 BAYES_80 4718 5.14 8.26 4.64 49 RCVD_IN_MSPIKE_WL 4699 21.84 8.22 24.02 50 SpammyFromTLD_01 4686 1.56 8.20 0.50 51 LotsOfNums_01 4493 7.64 7.86 7.60 52 XM_Evil_Numbers_Gen 4194 8.00 7.34 8.10 53 BOTNET_NORDNS 3892 0.95 6.81 0.02 54 BAYES_60 3827 6.29 6.70 6.23 55 SUBJ_ALL_CAPS 3730 2.00 6.53 1.27 56 XM_H_Long_From01 3706 4.83 6.49 4.56 57 XM_UB999 3564 0.87 6.24 0.01 58 XMBody_17 3522 1.89 6.16 1.20 59 XM_DIRTYINTL 3423 1.32 5.99 0.57 60 XM_UB50 3202 1.90 5.60 1.31 61 UNPARSEABLE_RELAY 3143 7.35 5.50 7.64 62 RCVD_IN_MSPIKE_L3 3087 1.21 5.40 0.53 63 URIBL_SBL_A 3076 0.95 5.38 0.24 64 TooManyTo_001 3016 5.87 5.28 5.97 65 BAYES_95 2975 3.21 5.21 2.89 66 RCVD_IN_MSPIKE_H3 2824 12.76 4.94 14.01 67 T_XMDrugObfuBody_08 2788 1.79 4.88 1.30 68 MIME_HTML_MOSTLY 2544 2.68 4.45 2.39 69 TR_XM_MaxBayes 2542 0.67 4.45 0.06 70 TR_XM_PhishingBody 2521 2.72 4.41 2.45 71 RELAYCOUNTRY_FR 2519 0.83 4.41 0.25 72 FROM_SUSPICIOUS_NTLD 2514 0.65 4.40 0.05 73 XM_B_SpammyTLD 2482 2.33 4.34 2.01 74 SpammyFromTLD_02 2412 0.72 4.22 0.16 75 XMStrtUSub 2383 4.16 4.17 4.16 76 HTML_IMAGE_RATIO_04 2257 4.83 3.95 4.97 77 XM_SendGrid 2249 6.22 3.94 6.58 78 IMG_ONLY_FM_DOM_INFO 2245 0.54 3.93 0.00 79 TR_Caps_n_Bayes_99 2160 0.70 3.78 0.20 80 RELAYCOUNTRY_GB 2155 0.97 3.77 0.52 81 XM_OfRef6 2147 1.49 3.76 1.13 82 REPLYTO_WITHOUT_TO_CC 2022 0.53 3.54 0.05 83 TR_XM_MaxSPIKE 2021 0.55 3.54 0.07 84 MISSING_HEADERS 1986 0.66 3.48 0.21 85 XMNumbers 1937 3.56 3.39 3.58 86 TR_XM_INV_DKIM 1931 0.74 3.38 0.32 87 XM_B_COVIDMETA 1926 1.52 3.37 1.23 88 TR_Mismatch_TLD_02 1923 0.52 3.37 0.07 89 MPART_ALT_DIFF_COUNT 1908 0.75 3.34 0.34 90 TR_XM_MaxWHORU 1880 0.50 3.29 0.05 91 TR_LOTS_OF_MONEY3 1845 1.09 3.23 0.75 92 TR_XM_UnparsRelay 1822 0.95 3.19 0.60 93 RCVD_IN_MSPIKE_H4 1791 8.11 3.13 8.90 94 XMDiploma_00 1770 1.78 3.10 1.57 95 TR_XM_COVIDMETA4 1740 0.75 3.04 0.38 96 FROM_SUSPICIOUS_NTLD_FP 1716 0.45 3.00 0.04 97 PDS_OTHER_BAD_TLD 1689 0.90 2.96 0.57 98 XM_UB80 1656 0.51 2.90 0.13 99 HTML_MIME_NO_HTML_TAG 1612 1.48 2.82 1.26 100 XM_UB60 1588 0.52 2.78 0.16 101 TR_XM_PHPDW 1587 0.70 2.78 0.36 102 TR_XM_PHPForged 1569 0.67 2.75 0.33 103 FROM_EXCESS_BASE64 1562 3.20 2.73 3.27 104 XMSexyCombo_01 1562 1.37 2.73 1.15 105 TR_XM_FormFill2 1560 0.66 2.73 0.33 106 XM_H_PHPOS 1545 0.66 2.70 0.33 107 XMBrknScrpt_02 1489 1.30 2.61 1.09 108 TR_LOTS_OF_MONEY1 1484 0.38 2.60 0.02 109 DATE_IN_PAST_06_12 1462 0.71 2.56 0.41 110 XM_B_Phish66 1457 1.26 2.55 1.06 111 HTML_IMAGE_ONLY_16 1402 0.49 2.45 0.17 112 XMSubNoVowel 1390 0.79 2.43 0.53 113 PDS_BTC_ID 1380 0.36 2.41 0.03 114 XM_BadFromFormat 1366 0.48 2.39 0.17 115 TM2_M_URI_OPT_OUT 1358 17.10 2.38 19.46 116 URI_TRY_3LD 1332 1.31 2.33 1.14 117 XM_B_SEO 1331 0.39 2.33 0.08 118 KHOP_HELO_FCRDNS 1324 1.12 2.32 0.93 119 OBFU_BITCOIN 1313 0.32 2.30 0.00 120 FUZZY_BITCOIN 1313 0.32 2.30 0.00 121 TVD_SPACE_RATIO_MINFP 1311 0.33 2.29 0.02 122 DKIM_ADSP_NXDOMAIN 1281 0.87 2.24 0.65 123 RELAYCOUNTRY_IT 1256 0.34 2.20 0.04 124 HTML_IMAGE_RATIO_06 1251 2.97 2.19 3.10 125 HTML_IMAGE_RATIO_08 1229 2.12 2.15 2.11 126 XM_CamelCaseFrm001 1228 1.98 2.15 1.96 127 URI_HEX 1210 1.61 2.12 1.53 128 TR_XM_RelayPhish 1206 0.43 2.11 0.16 129 HELO_MISC_IP 1198 2.17 2.10 2.19 130 MIME_CHARSET_FARAWAY 1177 0.36 2.06 0.08 131 CHARSET_FARAWAY_HEADER 1121 0.29 1.96 0.02 132 XM_B_Unsub2 1109 1.28 1.94 1.17 133 HTML_IMAGE_ONLY_28 1108 0.41 1.94 0.17 134 T_REMOTE_IMAGE 1081 2.54 1.89 2.64 135 DKIM_ADSP_CUSTOM_MED 1078 0.93 1.89 0.77 136 XM_URI_RBL 1073 0.41 1.88 0.17 137 T_FILL_THIS_FORM_SHORT 1055 0.70 1.85 0.51 138 LOADSA_MONEY_COMBO 1054 0.34 1.84 0.09 139 XM_UB95 1049 0.26 1.84 0.01 140 NML_ADSP_CUSTOM_MED 1040 0.70 1.82 0.52 141 T_TooManySym_01 1031 5.09 1.80 5.61 142 BITCOIN_SPAM_03 1029 0.25 1.80 0.00 143 BAYES_40 1003 3.50 1.76 3.78 144 DEAR_BENEFICIARY 1000 0.24 1.75 0.00 145 RELAYCOUNTRY_RU 998 1.10 1.75 1.00 146 XM_XX_Yahoo 976 0.28 1.71 0.05 147 MIME_HTML_ONLY_MULTI 970 2.57 1.70 2.71 148 XFER_LOTSA_MONEY 962 0.27 1.68 0.04 149 TR_Mismatch_TLD_01 958 0.43 1.68 0.23 150 TR_XM_DK_SendGrid 938 3.69 1.64 4.02 151 TR_MetaPhish_Combo_01 933 0.76 1.63 0.62 152 SUSP_UTF8_WORD_MANY 928 0.23 1.62 0.00 153 TM2_M_VERY_LONG_WORD 926 1.23 1.62 1.16 154 DATE_IN_PAST_03_06 913 0.32 1.60 0.12 155 LongTLD 905 0.34 1.58 0.14 156 XMSexyCombo_04 870 0.31 1.52 0.12 157 T_XMDrugObfuBody_14 865 1.25 1.51 1.20 158 XM_OfRef7 855 0.31 1.50 0.12 159 FROM_MISSP_REPLYTO 831 0.21 1.45 0.01 160 MIME_QP_LONG_LINE 809 3.27 1.42 3.57 161 BAYES_20 799 5.38 1.40 6.02 162 FORGED_GMAIL_RCVD 796 0.52 1.39 0.38 163 ALL_TRUSTED 785 23.04 1.37 26.51 164 T_XMHurry_00 767 0.92 1.34 0.85 165 ADVANCE_FEE_5_NEW_MONEY 755 0.19 1.32 0.00 166 BODY_URI_ONLY 753 0.22 1.32 0.05 167 RELAYCOUNTRY_JP 752 0.20 1.32 0.02 168 XMStockSpam_06 752 0.92 1.32 0.86 169 RCVD_HELO_IP_MISMATCH 745 0.18 1.30 0.00 170 FSL_HELO_BARE_IP_1 737 0.18 1.29 0.00 171 URIBL_BLACK 734 0.19 1.28 0.01 172 BOGUS_MIME_VERSION 728 0.18 1.27 0.00 173 FROM_NO_USER 722 0.18 1.26 0.01 174 XMBody_50 718 0.17 1.26 0.00 175 TR_XM_BayesRelay 715 0.19 1.25 0.02 176 XMReplyNow 709 0.27 1.24 0.11 177 TO_EQ_FM_DIRECT_MX 708 0.20 1.24 0.03 178 INVESTMENT_ADVICE 702 0.28 1.23 0.13 179 XMSubMetaI_00 700 0.77 1.22 0.70 180 TR_XM_COVIDMETA1 695 0.33 1.22 0.19 181 XMBdyGiftCard01 693 1.11 1.21 1.09 182 MONEY_ATM_CARD 691 0.17 1.21 0.00 183 HTML_TAG_BALANCE_CENTER 688 0.28 1.20 0.13 184 XM_H_PHPMailer 685 0.56 1.20 0.46 185 HK_RANDOM_REPLYTO 685 0.30 1.20 0.16 186 URI_PHP_REDIR 668 0.16 1.17 0.00 187 MAILING_LIST_MULTI 653 1.58 1.14 1.64 188 TR_Symld_Words 647 1.41 1.13 1.45 189 DIET_1 639 0.47 1.12 0.37 190 XMHTML_After_End 639 0.62 1.12 0.53 191 XM_SPF_Unknown 624 0.39 1.09 0.27 192 XMSubEmpty 619 0.26 1.08 0.13 193 RCVD_IN_MSPIKE_L4 617 0.18 1.08 0.04 194 XM_ProductURIs 612 1.06 1.07 1.06 195 RDNS_DYNAMIC 604 0.50 1.06 0.41 196 RELAYCOUNTRY_KR 602 0.15 1.05 0.01 197 XM_DK_Undo_01 597 1.19 1.04 1.22 198 RELAYCOUNTRY_IN 583 0.21 1.02 0.08 199 XM_H_PHPOS_M 576 0.31 1.01 0.20 200 RELAYCOUNTRY_DE 575 0.35 1.01 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 353606 98.88 97.27 99.13 2 HTML_MESSAGE 260840 74.84 85.55 73.13 3 RELAYCOUNTRY_US 244558 67.93 63.96 68.56 4 DKIM_SIGNED 243064 68.86 73.32 68.14 5 XM_DK_Pass 239490 67.74 71.48 67.14 6 DKIM_VALID 230690 64.41 62.78 64.67 7 XM_B_Unicode 222766 63.79 72.11 62.45 8 DKIM_VALID_AU 183862 50.60 44.68 51.55 9 XMListUnsubscribeExists 182291 53.28 66.85 51.11 10 BAYES_50 149485 39.99 28.01 41.91 11 XM_B_Unicode3 131562 37.01 37.79 36.88 12 HTML_FONT_LOW_CONTRAST 96041 26.48 23.73 26.93 13 ALL_TRUSTED 94550 23.04 1.37 26.51 14 LOC_TINY_FONT_1 90164 26.06 30.94 25.28 15 DKIM_VALID_EF 87521 24.83 26.68 24.54 16 RCVD_IN_MSPIKE_WL 85686 21.84 8.22 24.02 17 RCVD_IN_MSPIKE_H2 80447 23.24 27.55 22.55 18 XM_Multi_Part_URI 72140 20.13 19.54 20.22 19 MIME_HTML_ONLY 70302 20.64 26.45 19.71 20 FVGT_m_MULTI_ODD 70132 20.53 25.98 19.66 21 TM2_M_URI_OPT_OUT 69419 17.10 2.38 19.46 22 T_TM2_M_HEADER_IN_MSG 67060 19.42 23.29 18.80 23 XMSubLong 66887 18.80 19.07 18.75 24 BOUNCE_MESSAGE 65843 15.96 0.35 18.46 25 ANY_BOUNCE_MESSAGE 65843 15.96 0.35 18.46 26 T_KAM_HTML_FONT_INVALID 53516 15.90 21.47 15.00 27 BAYES_00 52428 12.77 0.71 14.70 28 RCVD_IN_MSPIKE_H3 49987 12.76 4.94 14.01 29 XM_DK_Undo_02 45903 18.58 54.20 12.87 30 XM_Body_Dirty_Words 43742 13.28 19.64 12.26 31 BAYES_05 38310 9.35 0.67 10.74 32 RCVD_IN_RP_SAFE 33924 8.30 0.72 9.51 33 BAYES_99 32214 14.31 47.28 9.03 34 RCVD_IN_RP_CERTIFIED 31870 7.77 0.50 8.93 35 RCVD_IN_MSPIKE_H4 31757 8.11 3.13 8.90 36 XM_B_Unsub 30929 8.82 9.71 8.67 37 XM_Evil_Numbers_Gen 28899 8.00 7.34 8.10 38 XM_DKIMWhitelistDomains 28240 6.82 0.01 7.92 39 HTML_IMAGE_RATIO_02 28206 8.26 10.49 7.91 40 UNPARSEABLE_RELAY 27269 7.35 5.50 7.64 41 LotsOfNums_01 27125 7.64 7.86 7.60 42 TR_XM_DK_Bayes 27031 6.58 0.33 7.58 43 BAYES_999 25989 11.32 36.49 7.29 44 TR_XM_DK_Bayes1 25948 6.30 0.21 7.27 45 LOTS_OF_MONEY 24303 8.06 15.84 6.81 46 TR_XM_DK_Bayes2 23868 5.79 0.13 6.69 47 XM_SendGrid 23481 6.22 3.94 6.58 48 XM_B_Phish_Phrases 22976 6.93 10.00 6.44 49 BAYES_60 22216 6.29 6.70 6.23 50 BOTNET_IPINHOSTNAME 21929 7.39 15.13 6.15 51 BAYES_20 21471 5.38 1.40 6.02 52 TooManyTo_001 21280 5.87 5.28 5.97 53 RELAYCOUNTRY_META 20031 9.25 31.90 5.62 54 T_TooManySym_01 20020 5.09 1.80 5.61 55 HTML_IMAGE_RATIO_04 17743 4.83 3.95 4.97 56 MPART_ALT_DIFF 16625 5.26 8.97 4.66 57 BAYES_80 16535 5.14 8.26 4.64 58 XM_H_Long_From01 16278 4.83 6.49 4.56 59 XMSubMetaSx_00 15985 5.17 9.45 4.48 60 XMSexyCombo_05 15637 5.15 9.96 4.38 61 XMStrtUSub 14848 4.16 4.17 4.16 62 TR_XM_DK_SendGrid 14326 3.69 1.64 4.02 63 BAYES_40 13480 3.50 1.76 3.78 64 IN_ZIMBRA_NJ_WHITELIST 13380 3.24 0.02 3.75 65 XMNumbers 12781 3.56 3.39 3.58 66 MIME_QP_LONG_LINE 12734 3.27 1.42 3.57 67 DKIM_INVALID 12374 4.45 10.54 3.47 68 RCVD_IN_IADB_LISTED 11698 2.91 0.61 3.28 69 FROM_EXCESS_BASE64 11675 3.20 2.73 3.27 70 HTML_IMAGE_RATIO_06 11057 2.97 2.19 3.10 71 XM_UncommonTLD01 10782 5.71 22.50 3.02 72 T_TooManySym_02 10491 2.60 0.49 2.94 73 BAYES_95 10312 3.21 5.21 2.89 74 UNTRUSTED_Relay 10307 5.68 23.11 2.89 75 BOTNET 10254 6.10 26.25 2.87 76 RCVD_IN_IADB_SPF 10056 2.50 0.54 2.82 77 MIME_HTML_ONLY_MULTI 9654 2.57 1.70 2.71 78 T_REMOTE_IMAGE 9432 2.54 1.89 2.64 79 TVD_RCVD_IP 9154 2.25 0.25 2.57 80 RCVD_IN_IADB_SENDERID 8955 2.23 0.51 2.51 81 TR_XM_PhishingBody 8730 2.72 4.41 2.45 82 RCVD_IN_IADB_DK 8728 2.18 0.50 2.45 83 MIME_HTML_MOSTLY 8541 2.68 4.45 2.39 84 RELAYCOUNTRY_CA 7835 3.25 9.84 2.20 85 HELO_MISC_IP 7794 2.17 2.10 2.19 86 CK_HELO_DYNAMIC_SPLIT_IP 7793 2.00 0.83 2.18 87 HTML_IMAGE_RATIO_08 7524 2.12 2.15 2.11 88 RCVD_IN_IADB_VOUCHED 7265 1.78 0.19 2.04 89 INVALID_MSGID 7240 1.85 0.72 2.03 90 XM_B_SpammyTLD 7180 2.33 4.34 2.01 91 NO_DNS_FOR_FROM 7089 3.15 10.37 1.99 92 XM_CamelCaseFrm001 6980 1.98 2.15 1.96 93 TO_MALFORMED 6444 1.56 0.05 1.81 94 RCVD_IN_BL_SPAMCOP_NET 5931 3.35 13.85 1.66 95 MAILING_LIST_MULTI 5866 1.58 1.14 1.64 96 XM_PDF 5643 1.42 0.43 1.58 97 XM_H_Trusted_IP 5621 1.36 0.00 1.58 98 XMDiploma_00 5604 1.78 3.10 1.57 99 URI_HEX 5443 1.61 2.12 1.53 100 TR_Symld_Words 5189 1.41 1.13 1.45 101 RCVD_IN_IADB_OPTIN 4681 1.18 0.34 1.31 102 XM_UB50 4670 1.90 5.60 1.31 103 T_XMDrugObfuBody_08 4640 1.79 4.88 1.30 104 IN_HORDE_ADDRESS_BOOK 4570 1.11 0.03 1.28 105 XMGappySubj_01 4569 1.12 0.10 1.28 106 SUBJ_ALL_CAPS 4539 2.00 6.53 1.27 107 USER_IN_DEF_DKIM_WL 4530 1.10 0.01 1.27 108 HTML_MIME_NO_HTML_TAG 4505 1.48 2.82 1.26 109 XM_B_COVIDMETA 4381 1.52 3.37 1.23 110 XM_DK_Undo_01 4334 1.19 1.04 1.22 111 XMBody_17 4298 1.89 6.16 1.20 112 T_XMDrugObfuBody_14 4290 1.25 1.51 1.20 113 T_TooManySym_03 4237 1.04 0.14 1.19 114 XM_B_Unsub2 4181 1.28 1.94 1.17 115 TM2_M_VERY_LONG_WORD 4148 1.23 1.62 1.16 116 XMSexyCombo_01 4101 1.37 2.73 1.15 117 URI_TRY_3LD 4071 1.31 2.33 1.14 118 XM_OfRef6 4037 1.49 3.76 1.13 119 XM_GoogleGroups 4026 1.05 0.52 1.13 120 XM_SPF_SoftFail 3998 2.16 8.62 1.12 121 RCVD_IN_MSPIKE_H5 3942 0.97 0.15 1.11 122 XMBdyGiftCard01 3898 1.11 1.21 1.09 123 XMBrknScrpt_02 3886 1.30 2.61 1.09 124 XM_ProductURIs 3788 1.06 1.07 1.06 125 XM_B_Phish66 3765 1.26 2.55 1.06 126 TooManyTo_002 3671 0.96 0.54 1.03 127 RELAYCOUNTRY_RU 3566 1.10 1.75 1.00 128 KHOP_HELO_FCRDNS 3330 1.12 2.32 0.93 129 HTML_FONT_FACE_BAD 3237 0.89 0.80 0.91 130 XM_RXBody 3233 0.88 0.74 0.91 131 XM_H_Long_From02 3223 0.86 0.59 0.90 132 XMStockSpam_06 3056 0.92 1.32 0.86 133 T_XMHurry_00 3034 0.92 1.34 0.85 134 XMBody_95 2856 0.71 0.14 0.80 135 DKIM_ADSP_CUSTOM_MED 2764 0.93 1.89 0.77 136 XM_B_REG_HTML 2738 0.70 0.29 0.77 137 TR_LOTS_OF_MONEY3 2661 1.09 3.23 0.75 138 RCVD_IN_MSPIKE_BL 2575 3.11 18.04 0.72 139 XMSubMetaI_00 2496 0.77 1.22 0.70 140 TR_MSPIKEBAYES00 2482 0.60 0.00 0.70 141 T_TooManySym_04 2440 0.59 0.01 0.68 142 TR_BOTNET_NEGATE 2407 0.67 0.64 0.67 143 XMGenDplmaNmb 2374 0.69 0.87 0.67 144 DKIM_ADSP_NXDOMAIN 2304 0.87 2.24 0.65 145 TooManyTo_003 2295 0.60 0.33 0.64 146 XM_S_SubURI 2248 0.56 0.14 0.63 147 TR_MetaPhish_Combo_01 2228 0.76 1.63 0.62 148 HTML_TAG_BALANCE_BODY 2162 0.66 0.97 0.61 149 TR_XM_UnparsRelay 2126 0.95 3.19 0.60 150 SUBJ_DOLLARS 2103 0.60 0.69 0.59 151 XMPhish30 2060 0.61 0.82 0.58 152 XM_DIRTYINTL 2044 1.32 5.99 0.57 153 PLING_QUERY 2034 0.58 0.65 0.57 154 PDS_OTHER_BAD_TLD 2025 0.90 2.96 0.57 155 USER_IN_WHITELIST 1929 0.47 0.00 0.54 156 T_TooManySym_05 1917 0.46 0.00 0.54 157 TooManyTo_004 1910 0.50 0.29 0.54 158 XMBSHREFv2 1908 0.50 0.25 0.53 159 XMHTML_After_End 1907 0.62 1.12 0.53 160 RCVD_IN_MSPIKE_L3 1904 1.21 5.40 0.53 161 XMSubNoVowel 1890 0.79 2.43 0.53 162 RELAYCOUNTRY_GB 1851 0.97 3.77 0.52 163 NML_ADSP_CUSTOM_MED 1849 0.70 1.82 0.52 164 XMHTMLBadTable_001 1848 0.51 0.49 0.52 165 T_FILL_THIS_FORM_SHORT 1829 0.70 1.85 0.51 166 SpammyFromTLD_01 1777 1.56 8.20 0.50 167 THIS_AD 1769 0.48 0.35 0.50 168 TM2_M_A_HREF_HREF 1740 0.50 0.55 0.49 169 T_XMDrugObfuBody_00 1687 0.50 0.66 0.47 170 TooManyTo_005 1686 0.44 0.26 0.47 171 XMSlimDrugH 1674 0.51 0.76 0.47 172 HELO_NODOT 1659 0.51 0.80 0.47 173 HELO_NO_DOMAIN 1657 0.51 0.77 0.46 174 XM_H_PHPMailer 1623 0.56 1.20 0.46 175 XMPhish08 1578 0.48 0.69 0.44 176 XMSubMetaSxObfu_02 1529 0.43 0.42 0.43 177 XM_B_COPY_HTML 1520 0.44 0.52 0.43 178 DATE_IN_PAST_06_12 1477 0.71 2.56 0.41 179 RDNS_DYNAMIC 1476 0.50 1.06 0.41 180 HTML_IMAGE_ONLY_20 1418 0.37 0.23 0.40 181 XMSubMetaSxObfu_03 1407 0.41 0.50 0.39 182 XMBody_78 1401 0.48 1.00 0.39 183 NUMERIC_HTTP_ADDR 1386 0.42 0.60 0.39 184 TR_XM_COVIDMETA4 1362 0.75 3.04 0.38 185 HTTPS_HTTP_MISMATCH 1353 0.40 0.54 0.38 186 FORGED_GMAIL_RCVD 1351 0.52 1.39 0.38 187 XMNoVowels 1347 0.44 0.83 0.38 188 XMPhish14 1328 0.38 0.43 0.37 189 DIET_1 1321 0.47 1.12 0.37 190 XMLngstWrd_00 1305 0.37 0.37 0.37 191 TR_XM_PHPDW 1296 0.70 2.78 0.36 192 XMMoneyMeta_00 1280 0.40 0.66 0.36 193 XM_Body_Obfu01 1212 0.32 0.18 0.34 194 MPART_ALT_DIFF_COUNT 1210 0.75 3.34 0.34 195 XM_D_tchamptons_WL 1204 0.29 0.01 0.34 196 URI_NOVOWEL 1198 0.40 0.83 0.34 197 TR_XM_PHPForged 1191 0.67 2.75 0.33 198 TR_XM_FormFill2 1187 0.66 2.73 0.33 199 XM_H_PHPOS 1167 0.66 2.70 0.33 200 T_Symld_Words_02 1137 0.36 0.59 0.32 ----------------------------------------------------------------------