Email: 434449 Autolearn: 0 AvgScore: 0.92 AvgScanTime: 1.61 sec Spam: 76809 Autolearn: 0 AvgScore: 14.38 AvgScanTime: 2.71 sec Ham: 357640 Autolearn: 0 AvgScore: -1.98 AvgScanTime: 1.38 sec Time Spent Running SA: 194.86 hours Time Spent Processing Spam: 57.74 hours Time Spent Processing Ham: 137.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 73869 98.56 96.17 99.08 2 HTML_MESSAGE 70727 78.43 92.08 75.50 3 RELAYCOUNTRY_US 49172 69.91 64.02 71.17 4 DKIM_SIGNED 44705 67.11 58.20 69.02 5 XM_DK_Pass 43437 65.83 56.55 67.82 6 XMListUnsubscribeExists 42374 52.16 55.17 51.52 7 XM_B_Unicode 40878 61.77 53.22 63.61 8 DKIM_VALID 37271 62.19 48.52 65.13 9 XM_DK_Undo_02 32286 17.94 42.03 12.77 10 MIME_HTML_ONLY 32230 24.17 41.96 20.34 11 BAYES_99 31384 14.89 40.86 9.31 12 DKIM_VALID_AU 27098 49.69 35.28 52.78 13 RCVD_IN_MSPIKE_H2 26804 24.19 34.90 21.89 14 RELAYCOUNTRY_META 24081 10.04 31.35 5.47 15 BAYES_999 23914 11.72 31.13 7.54 16 BOTNET 23776 7.74 30.95 2.75 17 BAYES_50 21511 40.14 28.01 42.75 18 XM_B_Unicode3 19619 35.55 25.54 37.70 19 RCVD_IN_BL_SPAMCOP_NET 19417 5.56 25.28 1.33 20 HTML_MIME_NO_HTML_TAG 18981 5.70 24.71 1.61 21 UNTRUSTED_Relay 18614 6.56 24.23 2.77 22 T_REMOTE_IMAGE 18415 6.39 23.98 2.61 23 RCVD_IN_PSBL 18183 4.21 23.67 0.03 24 LOC_TINY_FONT_1 17811 27.25 23.19 28.12 25 HTML_IMAGE_RATIO_02 17478 10.94 22.76 8.40 26 XM_UncommonTLD01 16764 6.51 21.83 3.22 27 FVGT_m_MULTI_ODD 16632 19.62 21.65 19.18 28 DKIM_VALID_EF 16307 23.23 21.23 23.65 29 T_TM2_M_HEADER_IN_MSG 15750 19.48 20.51 19.26 30 FROM_EXCESS_BASE64 13798 5.93 17.96 3.35 31 XMSubLong 13657 18.33 17.78 18.45 32 HTML_FONT_LOW_CONTRAST 13583 26.62 17.68 28.54 33 XM_Multi_Part_URI 13192 19.73 17.18 20.28 34 HTML_IMAGE_ONLY_16 12348 3.00 16.08 0.20 35 HTML_SHORT_LINK_IMG_2 11520 2.70 15.00 0.06 36 RCVD_IN_MSPIKE_BL 11467 3.89 14.93 1.51 37 T_KAM_HTML_FONT_INVALID 10782 14.85 14.04 15.02 38 BOTNET_IPINHOSTNAME 9786 7.02 12.74 5.79 39 XM_Body_Dirty_Words 9447 12.33 12.30 12.34 40 BOTNET_NORDNS 9347 2.16 12.17 0.01 41 BAYES_80 8864 6.06 11.54 4.88 42 RCVD_IN_RP_RNBL 8076 1.95 10.51 0.12 43 BAYES_60 8015 7.40 10.43 6.75 44 XM_SPF_SoftFail 7655 2.99 9.97 1.49 45 DKIM_INVALID 7434 4.92 9.68 3.89 46 RCVD_IN_MSPIKE_L5 7261 1.93 9.45 0.32 47 LOTS_OF_MONEY 6879 6.87 8.96 6.43 48 SpammyFromTLD_01 6577 1.95 8.56 0.53 49 RELAYCOUNTRY_CA 6522 3.22 8.49 2.09 50 SpammyFromTLD_02 6320 1.61 8.23 0.19 51 LotsOfNums_01 6276 7.68 8.17 7.58 52 XM_UB99 6153 1.42 8.01 0.00 53 NO_DNS_FOR_FROM 5904 3.26 7.69 2.31 54 BODY_URI_ONLY 5875 1.39 7.65 0.05 55 XMSexyCombo_05 5865 5.14 7.64 4.60 56 XM_B_Unsub 5597 8.35 7.29 8.57 57 FROM_SUSPICIOUS_NTLD 5453 1.29 7.10 0.04 58 FROM_SUSPICIOUS_NTLD_FP 5363 1.26 6.98 0.03 59 HDRS_MISSP 5086 1.21 6.62 0.05 60 XM_B_Phish_Phrases 4839 6.72 6.30 6.81 61 DKIM_ADSP_NXDOMAIN 4825 1.64 6.28 0.65 62 XM_UB999 4659 1.07 6.07 0.00 63 XM_UB50 4604 2.22 5.99 1.41 64 XM_Combo_Sbj 4549 1.18 5.92 0.16 65 HTML_TAG_BALANCE_CENTER 4412 1.09 5.74 0.09 66 XM_Evil_Numbers_Gen 4315 7.97 5.62 8.48 67 IMG_ONLY_FM_DOM_INFO 4266 0.98 5.55 0.00 68 BAYES_95 4195 3.51 5.46 3.10 69 XMSubGiftCard1 4090 0.98 5.32 0.05 70 XMOffer 3991 0.95 5.20 0.03 71 UNPARSEABLE_RELAY 3836 6.56 4.99 6.90 72 RCVD_IN_MSPIKE_WL 3758 21.51 4.89 25.08 73 XM_H_Long_From01 3705 4.58 4.82 4.52 74 XMBody_17 3704 2.08 4.82 1.49 75 XMSubMetaSx_00 3691 3.54 4.81 3.27 76 RCVD_IN_MSPIKE_L3 3444 1.30 4.48 0.62 77 HK_RANDOM_FROM 3427 0.86 4.46 0.09 78 XMNumbers 3271 3.51 4.26 3.35 79 MPART_ALT_DIFF 3270 5.10 4.26 5.28 80 TooManyTo_001 3116 5.64 4.06 5.98 81 TR_XM_PhishingBody 3067 2.64 3.99 2.35 82 XM_JunkDunk 3050 0.70 3.97 0.00 83 URIBL_SBL_A 3042 0.98 3.96 0.34 84 KHOP_HELO_FCRDNS 3033 1.85 3.95 1.40 85 XM_BadFromFormat 2976 0.79 3.87 0.13 86 HTML_IMAGE_RATIO_04 2950 5.45 3.84 5.80 87 XM_B_SpammyTLD 2911 1.92 3.79 1.52 88 XM_UB80 2805 0.73 3.65 0.11 89 HTML_IMAGE_ONLY_24 2635 0.75 3.43 0.18 90 XM_UB60 2634 0.76 3.43 0.18 91 HTML_IMAGE_RATIO_08 2633 2.65 3.43 2.48 92 XM_SendGrid 2575 5.56 3.35 6.03 93 TR_XM_INV_DKIM 2560 0.82 3.33 0.28 94 RELAYCOUNTRY_GB 2557 1.05 3.33 0.56 95 XM_DIRTYINTL 2498 1.00 3.25 0.52 96 DATE_IN_PAST_03_06 2485 0.68 3.24 0.13 97 TR_XM_MaxBayes 2316 0.57 3.02 0.05 98 TR_XM_UnparsRelay 2300 1.03 2.99 0.61 99 FROM_MISSP_REPLYTO 2294 0.53 2.99 0.01 100 MIME_HTML_MOSTLY 2242 3.20 2.92 3.26 101 XMStrtUSub 2205 4.67 2.87 5.06 102 RCVD_IN_MSPIKE_H3 2202 12.54 2.87 14.62 103 T_XMDrugObfuBody_08 2173 1.81 2.83 1.59 104 RELAYCOUNTRY_RU 2087 1.06 2.72 0.71 105 XM_OfRef6 2076 1.31 2.70 1.00 106 XM_CamelCaseFrm001 2069 1.98 2.69 1.83 107 TR_XM_MaxSPIKE 2042 0.51 2.66 0.04 108 SUBJ_ALL_CAPS 2033 1.80 2.65 1.62 109 RELAYCOUNTRY_KR 2024 0.48 2.64 0.01 110 T_TooManySym_01 1890 4.75 2.46 5.24 111 XM_B_Phish66 1873 1.22 2.44 0.96 112 TR_XM_MaxWHORU 1853 0.48 2.41 0.07 113 XMBrknScrpt_02 1828 1.36 2.38 1.14 114 URI_TRY_3LD 1789 1.63 2.33 1.48 115 T_XMHurry_00 1787 1.22 2.33 0.98 116 HTML_IMAGE_RATIO_06 1720 3.44 2.24 3.69 117 RELAYCOUNTRY_FR 1681 0.57 2.19 0.23 118 TR_XM_COVIDMETA4 1599 0.71 2.08 0.42 119 TR_XM_PHPDW 1559 0.60 2.03 0.29 120 TR_XM_PHPForged 1551 0.59 2.02 0.28 121 TR_XM_FormFill2 1541 0.59 2.01 0.28 122 XM_H_PHPOS 1536 0.58 2.00 0.28 123 DIET_1 1526 0.78 1.99 0.52 124 RCVD_IN_MSPIKE_H4 1502 8.00 1.96 9.30 125 XMHTML_After_End 1491 1.21 1.94 1.06 126 DKIM_ADSP_CUSTOM_MED 1481 1.04 1.93 0.85 127 XM_UB95 1464 0.35 1.91 0.02 128 XMGppyBdWords 1460 0.51 1.90 0.22 129 FROM_LOCAL_NOVOWEL 1459 0.35 1.90 0.02 130 XM_B_COVIDMETA 1432 1.48 1.86 1.40 131 TR_Mismatch_TLD_01 1418 0.52 1.85 0.23 132 TM2_M_URI_OPT_OUT 1413 14.65 1.84 17.40 133 NML_ADSP_CUSTOM_MED 1409 0.79 1.83 0.57 134 LongTLD 1396 0.41 1.82 0.11 135 TR_XM_RelayPhish 1376 0.42 1.79 0.12 136 TR_Sbj_FN_Bdy 1271 0.55 1.65 0.31 137 XMSlimDrugH 1270 0.58 1.65 0.35 138 MPART_ALT_DIFF_COUNT 1256 0.53 1.64 0.29 139 XMSubEmpty 1249 0.54 1.63 0.31 140 FVGT_m_MULTI_ODD_EMAIL 1233 0.31 1.61 0.03 141 XMSubNoVowel 1211 0.96 1.58 0.83 142 TM2_M_VERY_LONG_WORD 1177 1.17 1.53 1.10 143 BAYES_40 1170 3.52 1.52 3.95 144 DATE_IN_PAST_06_12 1160 0.31 1.51 0.06 145 HTML_IMAGE_ONLY_12 1158 0.41 1.51 0.17 146 RELAYCOUNTRY_JP 1158 0.29 1.51 0.03 147 DATE_IN_PAST_12_24 1156 0.30 1.51 0.05 148 XMSubject_09 1145 0.27 1.49 0.01 149 RDNS_DYNAMIC 1135 0.60 1.48 0.41 150 XM_B_SEO 1131 0.32 1.47 0.07 151 HK_RANDOM_REPLYTO 1129 0.48 1.47 0.26 152 RELAYCOUNTRY_NL 1124 0.44 1.46 0.22 153 RELAYCOUNTRY_HK 1095 0.27 1.43 0.03 154 MIME_CHARSET_FARAWAY 1079 0.34 1.40 0.11 155 TR_Mismatch_TLD_02 1076 0.34 1.40 0.11 156 TR_Caps_n_Bayes_99 1038 0.59 1.35 0.43 157 XM_URI_RBL 1033 0.41 1.34 0.20 158 URI_HEX 1030 1.47 1.34 1.50 159 CHARSET_FARAWAY_HEADER 1026 0.28 1.34 0.05 160 XMSexyCombo_01 1024 0.73 1.33 0.61 161 T_XMDrugObfuBody_14 995 1.67 1.30 1.75 162 XM_B_Unsub2 983 1.04 1.28 0.99 163 SUBJECT_DIET 963 0.24 1.25 0.02 164 HTML_IMAGE_ONLY_20 956 0.58 1.24 0.44 165 HTML_SHORT_LINK_IMG_1 955 0.24 1.24 0.02 166 XMDiploma_00 934 1.63 1.22 1.71 167 TR_LOTS_OF_MONEY3 917 0.72 1.19 0.62 168 XMNoSubject 901 0.39 1.17 0.22 169 MISSING_SUBJECT 901 0.39 1.17 0.22 170 XMMoneyMeta_00 893 0.41 1.16 0.25 171 T_FILL_THIS_FORM_SHORT 877 0.67 1.14 0.57 172 XM_OfRef7 877 0.29 1.14 0.11 173 URI_PHP_REDIR 874 0.22 1.14 0.02 174 FORGED_GMAIL_RCVD 863 0.54 1.12 0.41 175 ACT_NOW_CAPS 862 0.46 1.12 0.32 176 PDS_OTHER_BAD_TLD 835 0.32 1.09 0.15 177 XMStockSpam_06 829 1.35 1.08 1.41 178 MIME_HTML_ONLY_MULTI 807 2.79 1.05 3.17 179 BAYES_20 799 4.66 1.04 5.44 180 TVD_SPACE_RATIO_MINFP 797 0.20 1.04 0.02 181 TR_Symld_Words 797 1.44 1.04 1.53 182 URI_NOVOWEL 763 1.47 0.99 1.57 183 FILL_THIS_FORM 760 0.43 0.99 0.31 184 LONG_JUNK_URI 756 0.22 0.98 0.05 185 TR_XM_DK_SendGrid 746 2.86 0.97 3.27 186 INVESTMENT_ADVICE 744 0.24 0.97 0.09 187 ALL_TRUSTED 735 20.00 0.96 24.09 188 XM_DK_Undo_01 726 1.18 0.95 1.23 189 RCVD_IN_MSPIKE_L4 718 0.21 0.93 0.05 190 T_XMHurry_01 716 0.21 0.93 0.06 191 XMReplyNow 685 0.23 0.89 0.09 192 XM_XX_Yahoo 674 0.21 0.88 0.07 193 XMSubject_38 672 0.16 0.87 0.00 194 XM_ShortIntro_01 668 1.18 0.87 1.25 195 BOGUS_MIME_VERSION 663 0.15 0.86 0.00 196 XMPhish30 661 0.66 0.86 0.62 197 XMBdyGiftCard01 658 1.36 0.86 1.47 198 MIME_QP_LONG_LINE 656 2.68 0.85 3.07 199 TR_MetaPhish_Combo_01 655 0.56 0.85 0.49 200 XM_H_PHPMailer 653 0.46 0.85 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 354332 98.56 96.17 99.08 2 HTML_MESSAGE 270004 78.43 92.08 75.50 3 RELAYCOUNTRY_US 254542 69.91 64.02 71.17 4 DKIM_SIGNED 246851 67.11 58.20 69.02 5 XM_DK_Pass 242568 65.83 56.55 67.82 6 DKIM_VALID 232922 62.19 48.52 65.13 7 XM_B_Unicode 227489 61.77 53.22 63.61 8 DKIM_VALID_AU 188775 49.69 35.28 52.78 9 XMListUnsubscribeExists 184242 52.16 55.17 51.52 10 BAYES_50 152882 40.14 28.01 42.75 11 XM_B_Unicode3 134814 35.55 25.54 37.70 12 HTML_FONT_LOW_CONTRAST 102077 26.62 17.68 28.54 13 LOC_TINY_FONT_1 100560 27.25 23.19 28.12 14 RCVD_IN_MSPIKE_WL 89694 21.51 4.89 25.08 15 ALL_TRUSTED 86163 20.00 0.96 24.09 16 DKIM_VALID_EF 84594 23.23 21.23 23.65 17 RCVD_IN_MSPIKE_H2 78301 24.19 34.90 21.89 18 MIME_HTML_ONLY 72760 24.17 41.96 20.34 19 XM_Multi_Part_URI 72535 19.73 17.18 20.28 20 T_TM2_M_HEADER_IN_MSG 68868 19.48 20.51 19.26 21 FVGT_m_MULTI_ODD 68610 19.62 21.65 19.18 22 XMSubLong 65992 18.33 17.78 18.45 23 TM2_M_URI_OPT_OUT 62222 14.65 1.84 17.40 24 ANY_BOUNCE_MESSAGE 60280 14.02 0.80 16.85 25 BOUNCE_MESSAGE 60280 14.02 0.80 16.85 26 T_KAM_HTML_FONT_INVALID 53714 14.85 14.04 15.02 27 RCVD_IN_MSPIKE_H3 52270 12.54 2.87 14.62 28 BAYES_00 52157 12.12 0.67 14.58 29 XM_DK_Undo_02 45665 17.94 42.03 12.77 30 XM_Body_Dirty_Words 44142 12.33 12.30 12.34 31 RCVD_IN_RP_SAFE 34031 7.94 0.63 9.52 32 BAYES_99 33287 14.89 40.86 9.31 33 RCVD_IN_MSPIKE_H4 33243 8.00 1.96 9.30 34 BAYES_05 33042 7.68 0.45 9.24 35 XM_DKIMWhitelistDomains 32202 7.41 0.01 9.00 36 RCVD_IN_RP_CERTIFIED 31212 7.25 0.38 8.73 37 XM_B_Unsub 30665 8.35 7.29 8.57 38 XM_Evil_Numbers_Gen 30321 7.97 5.62 8.48 39 HTML_IMAGE_RATIO_02 30049 10.94 22.76 8.40 40 LotsOfNums_01 27099 7.68 8.17 7.58 41 BAYES_999 26983 11.72 31.13 7.54 42 UNPARSEABLE_RELAY 24674 6.56 4.99 6.90 43 XM_B_Phish_Phrases 24348 6.72 6.30 6.81 44 BAYES_60 24142 7.40 10.43 6.75 45 TR_XM_DK_Bayes 23237 5.40 0.26 6.50 46 LOTS_OF_MONEY 22981 6.87 8.96 6.43 47 TR_XM_DK_Bayes1 22074 5.11 0.14 6.17 48 XM_SendGrid 21579 5.56 3.35 6.03 49 TooManyTo_001 21404 5.64 4.06 5.98 50 HTML_IMAGE_RATIO_04 20738 5.45 3.84 5.80 51 BOTNET_IPINHOSTNAME 20706 7.02 12.74 5.79 52 TR_XM_DK_Bayes2 20361 4.71 0.12 5.69 53 RELAYCOUNTRY_META 19550 10.04 31.35 5.47 54 BAYES_20 19464 4.66 1.04 5.44 55 MPART_ALT_DIFF 18874 5.10 4.26 5.28 56 T_TooManySym_01 18742 4.75 2.46 5.24 57 XMStrtUSub 18088 4.67 2.87 5.06 58 BAYES_80 17449 6.06 11.54 4.88 59 XMSexyCombo_05 16468 5.14 7.64 4.60 60 XM_H_Long_From01 16183 4.58 4.82 4.52 61 BAYES_40 14138 3.52 1.52 3.95 62 DKIM_INVALID 13929 4.92 9.68 3.89 63 IN_ZIMBRA_NJ_WHITELIST 13607 3.14 0.02 3.80 64 HTML_IMAGE_RATIO_06 13213 3.44 2.24 3.69 65 XMNumbers 11990 3.51 4.26 3.35 66 FROM_EXCESS_BASE64 11969 5.93 17.96 3.35 67 TR_XM_DK_SendGrid 11694 2.86 0.97 3.27 68 XMSubMetaSx_00 11684 3.54 4.81 3.27 69 MIME_HTML_MOSTLY 11645 3.20 2.92 3.26 70 XM_UncommonTLD01 11513 6.51 21.83 3.22 71 MIME_HTML_ONLY_MULTI 11328 2.79 1.05 3.17 72 TVD_RCVD_IP 11280 2.68 0.50 3.15 73 BAYES_95 11073 3.51 5.46 3.10 74 MIME_QP_LONG_LINE 10987 2.68 0.85 3.07 75 RCVD_IN_IADB_LISTED 10552 2.52 0.49 2.95 76 UNTRUSTED_Relay 9905 6.56 24.23 2.77 77 T_TooManySym_02 9901 2.41 0.74 2.77 78 BOTNET 9832 7.74 30.95 2.75 79 T_REMOTE_IMAGE 9334 6.39 23.98 2.61 80 RCVD_IN_IADB_SPF 9041 2.15 0.41 2.53 81 XM_H_Trusted_IP 9015 2.08 0.00 2.52 82 HTML_IMAGE_RATIO_08 8859 2.65 3.43 2.48 83 TR_XM_PhishingBody 8411 2.64 3.99 2.35 84 NO_DNS_FOR_FROM 8269 3.26 7.69 2.31 85 RCVD_IN_IADB_SENDERID 7990 1.91 0.40 2.23 86 HELO_MISC_IP 7806 1.89 0.52 2.18 87 CK_HELO_DYNAMIC_SPLIT_IP 7803 1.88 0.49 2.18 88 RCVD_IN_IADB_DK 7736 1.85 0.40 2.16 89 INVALID_MSGID 7502 1.80 0.43 2.10 90 RELAYCOUNTRY_CA 7458 3.22 8.49 2.09 91 RCVD_IN_IADB_VOUCHED 6757 1.58 0.13 1.89 92 XM_CamelCaseFrm001 6527 1.98 2.69 1.83 93 TO_MALFORMED 6515 1.50 0.02 1.82 94 T_XMDrugObfuBody_14 6247 1.67 1.30 1.75 95 XMDiploma_00 6130 1.63 1.22 1.71 96 MAILING_LIST_MULTI 5840 1.46 0.63 1.63 97 SUBJ_ALL_CAPS 5789 1.80 2.65 1.62 98 HTML_MIME_NO_HTML_TAG 5762 5.70 24.71 1.61 99 T_XMDrugObfuBody_08 5704 1.81 2.83 1.59 100 URI_NOVOWEL 5611 1.47 0.99 1.57 101 TR_Symld_Words 5480 1.44 1.04 1.53 102 XM_B_SpammyTLD 5436 1.92 3.79 1.52 103 RCVD_IN_MSPIKE_BL 5416 3.89 14.93 1.51 104 URI_HEX 5378 1.47 1.34 1.50 105 XMBody_17 5341 2.08 4.82 1.49 106 XM_SPF_SoftFail 5334 2.99 9.97 1.49 107 URI_TRY_3LD 5293 1.63 2.33 1.48 108 HTML_FONT_FACE_BAD 5269 1.35 0.77 1.47 109 XMBdyGiftCard01 5243 1.36 0.86 1.47 110 XM_ProductURIs 5107 1.29 0.62 1.43 111 XM_UB50 5041 2.22 5.99 1.41 112 XMStockSpam_06 5036 1.35 1.08 1.41 113 XM_B_COVIDMETA 4999 1.48 1.86 1.40 114 KHOP_HELO_FCRDNS 4993 1.85 3.95 1.40 115 XMGappySubj_01 4773 1.11 0.09 1.33 116 RCVD_IN_BL_SPAMCOP_NET 4741 5.56 25.28 1.33 117 IN_HORDE_ADDRESS_BOOK 4547 1.07 0.14 1.27 118 XM_ShortIntro_01 4467 1.18 0.87 1.25 119 RCVD_IN_IADB_OPTIN 4439 1.05 0.18 1.24 120 XM_DK_Undo_01 4414 1.18 0.95 1.23 121 XMGenDplmaNmb 4234 1.12 0.83 1.18 122 USER_IN_DEF_DKIM_WL 4231 0.97 0.01 1.18 123 RCVD_IN_MSPIKE_H5 4181 0.97 0.07 1.17 124 T_TooManySym_03 4174 1.02 0.34 1.17 125 XMBrknScrpt_02 4092 1.36 2.38 1.14 126 XM_GoogleGroups 3984 0.96 0.26 1.11 127 TM2_M_VERY_LONG_WORD 3925 1.17 1.53 1.10 128 XM_PDF 3915 0.97 0.39 1.09 129 XMHTML_After_End 3776 1.21 1.94 1.06 130 XM_OfRef6 3594 1.31 2.70 1.00 131 XM_B_Unsub2 3536 1.04 1.28 0.99 132 T_XMHurry_00 3517 1.22 2.33 0.98 133 HELO_NODOT 3450 0.89 0.53 0.96 134 HELO_NO_DOMAIN 3442 0.89 0.53 0.96 135 TooManyTo_002 3441 0.88 0.52 0.96 136 XM_B_Phish66 3439 1.22 2.44 0.96 137 XM_RXBody 3147 0.84 0.64 0.88 138 XM_H_Long_From02 3130 0.83 0.61 0.88 139 DKIM_ADSP_CUSTOM_MED 3031 1.04 1.93 0.85 140 TR_MSPIKEBAYES00 3008 0.69 0.00 0.84 141 XMSubNoVowel 2981 0.96 1.58 0.83 142 T_MONEY_PERCENT 2728 0.69 0.37 0.76 143 TR_LOTS_OF_MONEY2 2728 0.69 0.37 0.76 144 XMBody_95 2714 0.64 0.06 0.76 145 MISSING_HEADERS 2700 0.75 0.73 0.75 146 XMSolicitRefs_0 2584 0.63 0.22 0.72 147 RELAYCOUNTRY_RU 2527 1.06 2.72 0.71 148 THIS_AD 2517 0.66 0.43 0.70 149 T_TooManySym_04 2516 0.59 0.07 0.70 150 XMSubMetaI_00 2489 0.65 0.44 0.70 151 TooManyTo_003 2469 0.63 0.36 0.69 152 DKIM_ADSP_NXDOMAIN 2319 1.64 6.28 0.65 153 XM_S_SubURI 2241 0.52 0.04 0.63 154 XM_shorewaves_Whitelist 2226 0.51 0.00 0.62 155 RCVD_IN_MSPIKE_L3 2221 1.30 4.48 0.62 156 TR_LOTS_OF_MONEY3 2218 0.72 1.19 0.62 157 XM_B_REG_HTML 2214 0.56 0.29 0.62 158 XMPhish30 2214 0.66 0.86 0.62 159 TR_XM_UnparsRelay 2194 1.03 2.99 0.61 160 XMSexyCombo_01 2164 0.73 1.33 0.61 161 XMBSHREFv2 2098 0.50 0.10 0.59 162 REPLYTO_WITHOUT_TO_CC 2069 0.58 0.58 0.58 163 TR_BOTNET_NEGATE 2061 0.53 0.31 0.58 164 TooManyTo_004 2039 0.53 0.33 0.57 165 NML_ADSP_CUSTOM_MED 2033 0.79 1.83 0.57 166 T_FILL_THIS_FORM_SHORT 2026 0.67 1.14 0.57 167 RELAYCOUNTRY_GB 2015 1.05 3.33 0.56 168 T_XMDrugObfuBody_00 2007 0.60 0.76 0.56 169 T_TooManySym_05 1994 0.46 0.02 0.56 170 SpammyFromTLD_01 1913 1.95 8.56 0.53 171 RCVD_IN_MSPIKE_ZBI 1875 0.44 0.06 0.52 172 DIET_1 1861 0.78 1.99 0.52 173 XM_DIRTYINTL 1848 1.00 3.25 0.52 174 XM_B_COPY_HTML 1808 0.51 0.53 0.51 175 TR_MetaPhish_Combo_01 1764 0.56 0.85 0.49 176 USER_IN_WHITELIST 1756 0.40 0.00 0.49 177 XMSubMetaSxObfu_02 1752 0.49 0.48 0.49 178 TooManyTo_005 1745 0.45 0.30 0.49 179 SUBJ_DOLLARS 1680 0.44 0.29 0.47 180 XMLngstWrd_00 1621 0.51 0.80 0.45 181 XMPhish08 1604 0.44 0.37 0.45 182 XMHTMLBadTable_001 1600 0.42 0.30 0.45 183 XMSubMetaSxObfu_03 1594 0.45 0.48 0.45 184 HTML_IMAGE_ONLY_20 1581 0.58 1.24 0.44 185 HTTPS_HTTP_MISMATCH 1547 0.44 0.45 0.43 186 TR_Caps_n_Bayes_99 1535 0.59 1.35 0.43 187 TR_XM_COVIDMETA4 1489 0.71 2.08 0.42 188 HTML_TAG_BALANCE_BODY 1487 0.44 0.58 0.42 189 FORGED_GMAIL_RCVD 1483 0.54 1.12 0.41 190 RDNS_DYNAMIC 1465 0.60 1.48 0.41 191 RELAYCOUNTRY_DE 1448 0.42 0.50 0.40 192 TR_XM_COVIDMETA1 1434 0.47 0.81 0.40 193 XMNoVowels 1389 0.40 0.45 0.39 194 XMLngstWrd_01 1365 0.43 0.65 0.38 195 XMBody_78 1333 0.43 0.69 0.37 196 XM_H_PHPMailer 1324 0.46 0.85 0.37 197 TM2_M_A_HREF_HREF 1299 0.37 0.42 0.36 198 XMSlimDrugH 1268 0.58 1.65 0.35 199 BODY_ENHANCEMENT 1244 0.30 0.10 0.35 200 URIBL_SBL_A 1214 0.98 3.96 0.34 ----------------------------------------------------------------------