Email: 390257 Autolearn: 0 AvgScore: 1.89 AvgScanTime: 1.64 sec Spam: 82943 Autolearn: 0 AvgScore: 15.31 AvgScanTime: 2.59 sec Ham: 307314 Autolearn: 0 AvgScore: -1.73 AvgScanTime: 1.39 sec Time Spent Running SA: 178.31 hours Time Spent Processing Spam: 59.63 hours Time Spent Processing Ham: 118.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 80961 98.64 97.61 98.92 2 HTML_MESSAGE 74335 87.13 89.62 86.45 3 XM_B_Unicode 57714 72.05 69.58 72.72 4 DKIM_SIGNED 54395 76.40 65.58 79.32 5 XM_DK_Pass 52413 75.23 63.19 78.47 6 RELAYCOUNTRY_US 50454 76.97 60.83 81.32 7 XMListUnsubscribeExists 46836 58.18 56.47 58.64 8 DKIM_VALID 45573 71.08 54.94 75.43 9 XM_B_SpammyWords 44947 52.68 54.19 52.28 10 XM_DK_Undo_02 37803 20.16 45.58 13.30 11 BAYES_99 35284 16.15 42.54 9.03 12 DKIM_VALID_AU 32847 56.66 39.60 61.27 13 BOTNET 31662 10.51 38.17 3.04 14 MIME_HTML_ONLY 31505 26.96 37.98 23.99 15 XM_UncommonTLD01 29122 10.37 35.11 3.70 16 RELAYCOUNTRY_META 28320 12.13 34.14 6.19 17 XM_B_Unicode3 27270 40.96 32.88 43.14 18 BAYES_999 26553 12.48 32.01 7.21 19 XM_B_SpammyWords2 25919 26.49 31.25 25.20 20 BAYES_50 23563 45.61 28.41 50.25 21 UNTRUSTED_Relay 21839 8.10 26.33 3.18 22 DKIM_VALID_EF 20548 27.22 24.77 27.88 23 XMSubLong 20313 23.01 24.49 22.61 24 LOC_TINY_FONT_1 19150 28.76 23.09 30.29 25 T_TM2_M_HEADER_IN_MSG 18984 22.90 22.89 22.90 26 FVGT_m_MULTI_ODD 17846 22.44 21.52 22.69 27 SpammyFromTLD_02 17514 4.66 21.12 0.22 28 RCVD_IN_MSPIKE_H2 17439 25.31 21.03 26.46 29 HTML_FONT_LOW_CONTRAST 17073 28.88 20.58 31.12 30 HTML_MIME_NO_HTML_TAG 16604 5.77 20.02 1.92 31 FROM_SUSPICIOUS_NTLD 16102 4.18 19.41 0.07 32 FROM_SUSPICIOUS_NTLD_FP 16059 4.16 19.36 0.06 33 BOTNET_NORDNS 15385 3.96 18.55 0.02 34 XM_Multi_Part_URI 14259 15.19 17.19 14.65 35 T_REMOTE_IMAGE 13822 6.05 16.66 3.19 36 XM_Body_Dirty_Words 13603 14.86 16.40 14.44 37 FROM_EXCESS_BASE64 13373 6.59 16.12 4.02 38 HDRS_MISSP 12789 3.43 15.42 0.19 39 DKIM_ADSP_NXDOMAIN 12666 3.90 15.27 0.83 40 T_KAM_HTML_FONT_INVALID 12466 17.55 15.03 18.23 41 T_HTML_TAG_BALANCE_CENTER 12416 3.42 14.97 0.30 42 BODY_URI_ONLY 12165 3.15 14.67 0.04 43 XMSexyCombo_05 12128 7.09 14.62 5.06 44 LOTS_OF_MONEY 9926 8.39 11.97 7.43 45 BOTNET_IPINHOSTNAME 9814 7.86 11.83 6.78 46 RCVD_IN_BL_SPAMCOP_NET 9602 3.84 11.58 1.75 47 RCVD_IN_MSPIKE_BL 9552 3.25 11.52 1.02 48 XMSubMetaSx_00 9512 6.57 11.47 5.24 49 XM_B_SpammyWords3 9243 8.62 11.14 7.94 50 XM_B_Unsub 8853 11.17 10.67 11.30 51 DKIM_INVALID 8822 5.32 10.64 3.89 52 BAYES_80 7852 6.30 9.47 5.45 53 HTML_IMAGE_RATIO_02 7648 8.73 9.22 8.60 54 BAYES_60 7576 8.35 9.13 8.13 55 XM_UB99 7325 1.88 8.83 0.01 56 LotsOfNums_01 6822 9.16 8.22 9.42 57 XM_SPF_SoftFail 6775 2.73 8.17 1.27 58 XM_JunkDunk 6631 1.70 7.99 0.00 59 RELAYCOUNTRY_CA 6467 3.54 7.80 2.39 60 RCVD_IN_PSBL 6416 1.65 7.74 0.01 61 NO_DNS_FOR_FROM 6350 3.57 7.66 2.46 62 SpammyFromTLD_01 6115 2.05 7.37 0.61 63 RCVD_IN_MSPIKE_WL 6084 24.19 7.34 28.74 64 XM_UB50 5997 2.77 7.23 1.57 65 XM_B_Phish_Phrases 5970 7.13 7.20 7.11 66 RCVD_IN_RP_RNBL 5809 1.61 7.00 0.16 67 MPART_ALT_DIFF 5716 6.68 6.89 6.63 68 XM_UB999 5525 1.42 6.66 0.00 69 BAYES_95 5454 4.12 6.58 3.46 70 RCVD_IN_MSPIKE_L5 5337 1.58 6.43 0.27 71 PLING_QUERY 5123 1.71 6.18 0.50 72 T_FILL_THIS_FORM_SHORT 4810 1.80 5.80 0.71 73 MIME_HTML_MOSTLY 4708 3.30 5.68 2.66 74 XMBody_17 4694 2.34 5.66 1.45 75 XM_Evil_Numbers_Gen 4588 8.58 5.53 9.41 76 UNPARSEABLE_RELAY 4531 8.30 5.46 9.07 77 TVD_SPACE_RATIO_MINFP 4429 1.14 5.34 0.01 78 T_PDS_OTHER_BAD_TLD 4419 1.69 5.33 0.71 79 XM_DIRTYINTL 4275 1.52 5.15 0.55 80 XM_H_Long_From01 4105 5.04 4.95 5.06 81 RELAYCOUNTRY_FR 4071 1.29 4.91 0.31 82 XM_B_SpammyTLD 3960 2.84 4.77 2.32 83 TooManyTo_001 3865 6.36 4.66 6.82 84 TR_Mismatch_TLD_02 3596 1.00 4.34 0.09 85 XM_UB60 3495 1.12 4.21 0.29 86 RCVD_IN_MSPIKE_L3 3461 1.43 4.17 0.69 87 TR_XM_PhishingBody 3447 3.14 4.16 2.87 88 TR_XM_FormFill 3442 0.90 4.15 0.03 89 HTML_FONT_TINY_NORDNS 3394 1.10 4.09 0.29 90 RCVD_IN_MSPIKE_H3 3322 13.38 4.01 15.91 91 SUBJ_ALL_CAPS 3319 1.91 4.00 1.35 92 XMBrknScrpt_02 3280 2.30 3.95 1.85 93 XM_OfRef6 3248 1.93 3.92 1.40 94 XMStrtUSub 3173 4.89 3.83 5.17 95 IMG_ONLY_FM_DOM_INFO 3130 0.81 3.77 0.02 96 HTML_IMAGE_ONLY_12 3110 0.91 3.75 0.14 97 XM_SendGrid 2915 6.66 3.51 7.51 98 URI_PHP_REDIR 2834 0.74 3.42 0.01 99 ALL_TRUSTED 2815 11.03 3.39 13.09 100 FROM_WORDY 2729 0.71 3.29 0.02 101 HTML_IMAGE_RATIO_08 2714 2.69 3.27 2.54 102 HTML_IMAGE_RATIO_04 2697 5.73 3.25 6.40 103 TR_XM_UnparsRelay 2675 1.16 3.23 0.60 104 XM_B_Unsub2 2636 2.82 3.18 2.73 105 RCVD_IN_MSPIKE_H4 2617 9.51 3.16 11.22 106 T_XMDrugObfuBody_08 2549 1.92 3.07 1.61 107 LongTLD 2541 0.76 3.06 0.14 108 XM_UB80 2516 0.73 3.03 0.11 109 URIBL_SBL_A 2427 0.76 2.93 0.18 110 TR_XM_INV_DKIM 2397 0.73 2.89 0.15 111 XMNumbers 2317 3.76 2.79 4.02 112 DATE_IN_PAST_03_06 2284 0.72 2.75 0.17 113 TR_XM_MaxBayes 2183 0.60 2.63 0.05 114 TR_XM_COVIDMETA4 2180 0.89 2.63 0.43 115 RELAYCOUNTRY_CZ 2131 0.56 2.57 0.02 116 FORGED_MUA_MOZILLA 2121 0.56 2.56 0.03 117 TR_XM_PHPDW 2118 0.88 2.55 0.43 118 TR_LOTS_OF_MONEY3 2106 1.05 2.54 0.64 119 MISSING_HEADERS 2048 0.74 2.47 0.27 120 XM_B_COVIDMETA 2018 1.53 2.43 1.29 121 URI_HEX 1971 1.75 2.38 1.58 122 XM_B_SpammyWords4 1938 0.96 2.34 0.59 123 RELAYCOUNTRY_GB 1937 0.99 2.34 0.63 124 REPLYTO_WITHOUT_TO_CC 1932 0.53 2.33 0.05 125 TR_XM_MaxSPIKE 1923 0.52 2.32 0.03 126 KHOP_HELO_FCRDNS 1862 1.31 2.24 1.05 127 RELAYCOUNTRY_DE 1846 0.77 2.23 0.38 128 XM_SPF_Unknown 1792 0.81 2.16 0.45 129 XM_UB95 1767 0.47 2.13 0.02 130 TR_XM_PHPForged 1766 0.77 2.13 0.40 131 TM2_M_URI_OPT_OUT 1754 4.03 2.11 4.55 132 TR_XM_MaxWHORU 1739 0.50 2.10 0.06 133 TR_XM_FormFill2 1731 0.76 2.09 0.40 134 XM_H_PHPOS 1726 0.75 2.08 0.39 135 URI_TRY_3LD 1701 1.89 2.05 1.85 136 XM_B_Phish66 1690 1.28 2.04 1.08 137 XMSexyCombo_01 1687 1.07 2.03 0.80 138 HTML_IMAGE_RATIO_06 1662 4.16 2.00 4.74 139 RELAYCOUNTRY_NL 1561 0.67 1.88 0.34 140 T_XMHurry_00 1561 0.92 1.88 0.65 141 XM_CamelCaseFrm001 1501 1.93 1.81 1.97 142 MIME_QP_LONG_LINE 1442 3.69 1.74 4.22 143 T_TooManySym_01 1419 5.50 1.71 6.52 144 DKIM_ADSP_CUSTOM_MED 1385 1.16 1.67 1.03 145 DEAR_SOMETHING 1356 0.40 1.63 0.06 146 RELAYCOUNTRY_IL 1337 0.34 1.61 0.00 147 NML_ADSP_CUSTOM_MED 1303 0.88 1.57 0.70 148 TR_Mismatch_TLD_01 1263 0.52 1.52 0.25 149 RDNS_DYNAMIC 1259 0.73 1.52 0.52 150 TR_LOTS_OF_MONEY1 1255 0.33 1.51 0.02 151 XM_BadFromFormat 1249 0.55 1.51 0.29 152 TR_XM_DK_SendGrid 1235 3.84 1.49 4.48 153 MIME_HTML_ONLY_MULTI 1234 3.71 1.49 4.31 154 TR_XM_RelayPhish 1227 0.39 1.48 0.10 155 XMGppyBdWords 1223 0.41 1.47 0.12 156 XMStockSpam_06 1200 1.06 1.45 0.96 157 BAYES_40 1197 3.48 1.44 4.03 158 DATE_IN_PAST_06_12 1188 0.64 1.43 0.43 159 TM2_M_VERY_LONG_WORD 1184 1.48 1.43 1.49 160 T_XMDrugObfuBody_00 1178 0.67 1.42 0.47 161 FILL_THIS_FORM 1158 0.72 1.40 0.53 162 BOGUS_MIME_VERSION 1140 0.29 1.37 0.00 163 MPART_ALT_DIFF_COUNT 1130 0.60 1.36 0.39 164 XMBody_50 1130 0.29 1.36 0.00 165 XM_URI_RBL 1130 0.46 1.36 0.22 166 XM_OfRef7 1126 0.43 1.36 0.18 167 T_XMDrugObfuBody_14 1074 1.49 1.29 1.54 168 XM_H_PHPMailer 1069 0.75 1.29 0.60 169 RELAYCOUNTRY_RU 1066 0.87 1.29 0.76 170 XMBdyGiftCard01 1064 1.32 1.28 1.33 171 LH_URI_DOM_IN_PATH 1060 1.53 1.28 1.59 172 MIME_CHARSET_FARAWAY 1040 0.33 1.25 0.08 173 XMSlimDrugH 1036 0.65 1.25 0.48 174 BAYES_20 1032 2.80 1.24 3.23 175 DRUGS_ERECTILE 1032 0.28 1.24 0.02 176 RELAYCOUNTRY_CN 1030 0.31 1.24 0.06 177 MONEY_FROM_MISSP 1020 0.26 1.23 0.00 178 FORGED_GMAIL_RCVD 1017 0.71 1.23 0.56 179 IMPOTENCE 1014 0.54 1.22 0.35 180 XMDiploma_00 987 1.19 1.19 1.19 181 TR_Symld_Words 965 1.45 1.16 1.53 182 ONLINE_PHARMACY 959 0.49 1.16 0.32 183 CHARSET_FARAWAY_HEADER 954 0.27 1.15 0.04 184 FROM_MISSP_REPLYTO 937 0.24 1.13 0.00 185 FROM_MISSPACED 917 0.25 1.11 0.01 186 RELAYCOUNTRY_AU 911 0.44 1.10 0.26 187 URI_WP_HACKED_2 883 0.46 1.06 0.30 188 TVD_VISIT_PHARMA 882 0.40 1.06 0.22 189 INVESTMENT_ADVICE 879 0.30 1.06 0.10 190 MONEY_FRAUD_8 879 0.23 1.06 0.00 191 XM_DK_Undo_01 876 1.33 1.06 1.40 192 MAILING_LIST_MULTI 859 1.68 1.04 1.86 193 XMHTML_After_End 858 0.67 1.03 0.57 194 HK_SCAM 850 0.22 1.02 0.01 195 NUMERIC_HTTP_ADDR 795 0.60 0.96 0.51 196 FROM_MISSP_MSFT 790 0.20 0.95 0.00 197 XMPhish14 780 0.69 0.94 0.62 198 XMSubNoVowel 758 0.73 0.91 0.68 199 FSL_CTYPE_WIN1251 757 0.19 0.91 0.00 200 XMReplyNow 757 0.31 0.91 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 303995 98.64 97.61 98.92 2 HTML_MESSAGE 265682 87.13 89.62 86.45 3 RELAYCOUNTRY_US 249913 76.97 60.83 81.32 4 DKIM_SIGNED 243759 76.40 65.58 79.32 5 XM_DK_Pass 241159 75.23 63.19 78.47 6 DKIM_VALID 231807 71.08 54.94 75.43 7 XM_B_Unicode 223473 72.05 69.58 72.72 8 DKIM_VALID_AU 188290 56.66 39.60 61.27 9 XMListUnsubscribeExists 180199 58.18 56.47 58.64 10 XM_B_SpammyWords 160649 52.68 54.19 52.28 11 BAYES_50 154431 45.61 28.41 50.25 12 XM_B_Unicode3 132588 40.96 32.88 43.14 13 HTML_FONT_LOW_CONTRAST 95638 28.88 20.58 31.12 14 LOC_TINY_FONT_1 93086 28.76 23.09 30.29 15 RCVD_IN_MSPIKE_WL 88320 24.19 7.34 28.74 16 DKIM_VALID_EF 85671 27.22 24.77 27.88 17 RCVD_IN_MSPIKE_H2 81323 25.31 21.03 26.46 18 XM_B_SpammyWords2 77453 26.49 31.25 25.20 19 MIME_HTML_ONLY 73721 26.96 37.98 23.99 20 T_TM2_M_HEADER_IN_MSG 70380 22.90 22.89 22.90 21 FVGT_m_MULTI_ODD 69742 22.44 21.52 22.69 22 XMSubLong 69498 23.01 24.49 22.61 23 T_KAM_HTML_FONT_INVALID 56028 17.55 15.03 18.23 24 RCVD_IN_MSPIKE_H3 48900 13.38 4.01 15.91 25 XM_Multi_Part_URI 45019 15.19 17.19 14.65 26 XM_Body_Dirty_Words 44376 14.86 16.40 14.44 27 BAYES_00 43925 11.38 0.57 14.29 28 XM_DK_Undo_02 40876 20.16 45.58 13.30 29 ALL_TRUSTED 40213 11.03 3.39 13.09 30 XM_B_Unsub 34741 11.17 10.67 11.30 31 RCVD_IN_MSPIKE_H4 34484 9.51 3.16 11.22 32 RCVD_IN_RP_SAFE 31727 8.22 0.42 10.32 33 XM_DKIMWhitelistDomains 31334 8.03 0.01 10.20 34 RCVD_IN_RP_CERTIFIED 29704 7.68 0.33 9.67 35 LotsOfNums_01 28935 9.16 8.22 9.42 36 XM_Evil_Numbers_Gen 28904 8.58 5.53 9.41 37 UNPARSEABLE_RELAY 27863 8.30 5.46 9.07 38 BAYES_99 27738 16.15 42.54 9.03 39 TR_XM_DK_Bayes 27403 7.10 0.36 8.92 40 HTML_IMAGE_RATIO_02 26419 8.73 9.22 8.60 41 TR_XM_DK_Bayes1 26176 6.75 0.22 8.52 42 BAYES_60 24996 8.35 9.13 8.13 43 XM_B_SpammyWords3 24411 8.62 11.14 7.94 44 TR_XM_DK_Bayes2 24309 6.26 0.14 7.91 45 XM_SendGrid 23078 6.66 3.51 7.51 46 LOTS_OF_MONEY 22824 8.39 11.97 7.43 47 BAYES_999 22147 12.48 32.01 7.21 48 XM_B_Phish_Phrases 21859 7.13 7.20 7.11 49 TooManyTo_001 20947 6.36 4.66 6.82 50 BOTNET_IPINHOSTNAME 20846 7.86 11.83 6.78 51 MPART_ALT_DIFF 20364 6.68 6.89 6.63 52 T_TooManySym_01 20047 5.50 1.71 6.52 53 HTML_IMAGE_RATIO_04 19677 5.73 3.25 6.40 54 RELAYCOUNTRY_META 19021 12.13 34.14 6.19 55 BAYES_80 16745 6.30 9.47 5.45 56 XMSubMetaSx_00 16115 6.57 11.47 5.24 57 XMStrtUSub 15898 4.89 3.83 5.17 58 XM_H_Long_From01 15565 5.04 4.95 5.06 59 XMSexyCombo_05 15548 7.09 14.62 5.06 60 HTML_IMAGE_RATIO_06 14556 4.16 2.00 4.74 61 TM2_M_URI_OPT_OUT 13983 4.03 2.11 4.55 62 TR_XM_DK_SendGrid 13766 3.84 1.49 4.48 63 IN_ZIMBRA_NJ_WHITELIST 13313 3.42 0.04 4.33 64 MIME_HTML_ONLY_MULTI 13257 3.71 1.49 4.31 65 MIME_QP_LONG_LINE 12955 3.69 1.74 4.22 66 BAYES_40 12395 3.48 1.44 4.03 67 FROM_EXCESS_BASE64 12356 6.59 16.12 4.02 68 XMNumbers 12355 3.76 2.79 4.02 69 DKIM_INVALID 11952 5.32 10.64 3.89 70 XM_UncommonTLD01 11362 10.37 35.11 3.70 71 RCVD_IN_IADB_LISTED 10777 2.95 0.87 3.51 72 T_TooManySym_02 10657 2.83 0.48 3.47 73 BAYES_95 10620 4.12 6.58 3.46 74 XM_H_Trusted_IP 10481 2.69 0.00 3.41 75 BAYES_20 9911 2.80 1.24 3.23 76 T_REMOTE_IMAGE 9803 6.05 16.66 3.19 77 UNTRUSTED_Relay 9774 8.10 26.33 3.18 78 RCVD_IN_IADB_SPF 9541 2.61 0.77 3.10 79 BOTNET 9354 10.51 38.17 3.04 80 ANY_BOUNCE_MESSAGE 9008 2.48 0.81 2.93 81 BOUNCE_MESSAGE 9006 2.48 0.81 2.93 82 TR_XM_PhishingBody 8810 3.14 4.16 2.87 83 TVD_RCVD_IP 8773 2.29 0.22 2.85 84 RCVD_IN_IADB_SENDERID 8616 2.36 0.73 2.80 85 RCVD_IN_IADB_DK 8449 2.32 0.73 2.75 86 XM_B_Unsub2 8385 2.82 3.18 2.73 87 MIME_HTML_MOSTLY 8164 3.30 5.68 2.66 88 HTML_IMAGE_RATIO_08 7797 2.69 3.27 2.54 89 CK_HELO_DYNAMIC_SPLIT_IP 7657 2.11 0.69 2.49 90 HELO_MISC_IP 7657 2.11 0.71 2.49 91 NO_DNS_FOR_FROM 7567 3.57 7.66 2.46 92 RELAYCOUNTRY_CA 7352 3.54 7.80 2.39 93 HTML_FONT_FACE_BAD 7267 1.98 0.58 2.36 94 INVALID_MSGID 7237 2.02 0.79 2.35 95 XM_B_SpammyTLD 7140 2.84 4.77 2.32 96 BAYES_05 6532 1.80 0.61 2.13 97 TO_MALFORMED 6306 1.63 0.06 2.05 98 XM_CamelCaseFrm001 6044 1.93 1.81 1.97 99 RCVD_IN_IADB_VOUCHED 5959 1.59 0.29 1.94 100 HTML_MIME_NO_HTML_TAG 5915 5.77 20.02 1.92 101 MAILING_LIST_MULTI 5703 1.68 1.04 1.86 102 XMBrknScrpt_02 5694 2.30 3.95 1.85 103 URI_TRY_3LD 5691 1.89 2.05 1.85 104 XM_PDF 5598 1.50 0.30 1.82 105 RCVD_IN_BL_SPAMCOP_NET 5369 3.84 11.58 1.75 106 IN_HORDE_ADDRESS_BOOK 4994 1.30 0.10 1.63 107 URI_NOVOWEL 4940 1.42 0.71 1.61 108 RCVD_IN_MSPIKE_H5 4936 1.30 0.17 1.61 109 T_XMDrugObfuBody_08 4933 1.92 3.07 1.61 110 LH_URI_DOM_IN_PATH 4900 1.53 1.28 1.59 111 URI_HEX 4853 1.75 2.38 1.58 112 XM_UB50 4832 2.77 7.23 1.57 113 XMGappySubj_01 4744 1.24 0.11 1.54 114 T_XMDrugObfuBody_14 4724 1.49 1.29 1.54 115 TR_Symld_Words 4696 1.45 1.16 1.53 116 TM2_M_VERY_LONG_WORD 4579 1.48 1.43 1.49 117 USER_IN_DEF_DKIM_WL 4535 1.16 0.00 1.48 118 XMBody_17 4452 2.34 5.66 1.45 119 XM_ProductURIs 4342 1.28 0.77 1.41 120 XM_DK_Undo_01 4311 1.33 1.06 1.40 121 XM_OfRef6 4296 1.93 3.92 1.40 122 SUBJ_ALL_CAPS 4153 1.91 4.00 1.35 123 XMBdyGiftCard01 4081 1.32 1.28 1.33 124 T_TooManySym_03 4013 1.04 0.07 1.31 125 XM_B_COVIDMETA 3953 1.53 2.43 1.29 126 RCVD_IN_IADB_OPTIN 3899 1.06 0.29 1.27 127 XM_SPF_SoftFail 3888 2.73 8.17 1.27 128 XMDiploma_00 3656 1.19 1.19 1.19 129 XM_GoogleGroups 3635 1.01 0.35 1.18 130 XM_B_Phish66 3310 1.28 2.04 1.08 131 TooManyTo_002 3263 0.96 0.57 1.06 132 KHOP_HELO_FCRDNS 3237 1.31 2.24 1.05 133 TR_MetaPhish_Combo_01 3171 0.97 0.76 1.03 134 DKIM_ADSP_CUSTOM_MED 3158 1.16 1.67 1.03 135 RCVD_IN_MSPIKE_BL 3134 3.25 11.52 1.02 136 XM_H_Long_From02 3084 0.93 0.64 1.00 137 XMBody_95 2955 0.77 0.05 0.96 138 XMStockSpam_06 2939 1.06 1.45 0.96 139 XMHTMLBadTable_001 2874 0.81 0.34 0.94 140 TR_MSPIKEBAYES00 2720 0.70 0.00 0.89 141 DKIM_ADSP_NXDOMAIN 2559 3.90 15.27 0.83 142 T_TooManySym_04 2476 0.64 0.01 0.81 143 XMSexyCombo_01 2472 1.07 2.03 0.80 144 RELAYCOUNTRY_RU 2321 0.87 1.29 0.76 145 XM_S_SubURI 2260 0.60 0.11 0.74 146 TR_BOTNET_NEGATE 2234 0.68 0.53 0.73 147 TooManyTo_003 2223 0.64 0.32 0.72 148 T_FILL_THIS_FORM_SHORT 2196 1.80 5.80 0.71 149 T_PDS_OTHER_BAD_TLD 2170 1.69 5.33 0.71 150 NML_ADSP_CUSTOM_MED 2148 0.88 1.57 0.70 151 XMGenDplmaNmb 2137 0.70 0.72 0.70 152 RCVD_IN_MSPIKE_L3 2127 1.43 4.17 0.69 153 XMLngstWrd_00 2106 0.61 0.35 0.69 154 XM_B_REG_HTML 2097 0.57 0.17 0.68 155 XMSubNoVowel 2084 0.73 0.91 0.68 156 HTML_TAG_BALANCE_BODY 2039 0.69 0.78 0.66 157 T_XMHurry_00 2012 0.92 1.88 0.65 158 USER_IN_WELCOMELIST 2002 0.51 0.00 0.65 159 USER_IN_WHITELIST 2002 0.51 0.00 0.65 160 TR_LOTS_OF_MONEY3 1979 1.05 2.54 0.64 161 T_TooManySym_05 1959 0.50 0.00 0.64 162 XM_ShortIntro_01 1953 0.56 0.29 0.64 163 XMPhish30 1947 0.64 0.66 0.63 164 XMSubEmpty 1936 0.67 0.84 0.63 165 RELAYCOUNTRY_GB 1933 0.99 2.34 0.63 166 XM_RXBody 1919 0.64 0.68 0.62 167 XMPhish14 1917 0.69 0.94 0.62 168 XMLngstWrd_01 1892 0.55 0.31 0.62 169 SpammyFromTLD_01 1876 2.05 7.37 0.61 170 XM_H_PHPMailer 1842 0.75 1.29 0.60 171 TR_XM_UnparsRelay 1838 1.16 3.23 0.60 172 XM_B_SpammyWords4 1810 0.96 2.34 0.59 173 XMBSHREFv2 1800 0.49 0.15 0.59 174 HELO_NODOT 1799 0.61 0.72 0.59 175 HELO_NO_DOMAIN 1794 0.61 0.72 0.58 176 XMHTML_After_End 1756 0.67 1.03 0.57 177 FORGED_GMAIL_RCVD 1735 0.71 1.23 0.56 178 XM_B_COPY_HTML 1723 0.54 0.45 0.56 179 XMSubMetaI_00 1711 0.59 0.71 0.56 180 SUBJ_DOLLARS 1698 0.55 0.52 0.55 181 XMSubMetaSxObfu_02 1676 0.49 0.29 0.55 182 XM_DIRTYINTL 1675 1.52 5.15 0.55 183 DIET_1 1650 0.60 0.84 0.54 184 TooManyTo_004 1642 0.48 0.28 0.53 185 FILL_THIS_FORM 1636 0.72 1.40 0.53 186 MISSING_SUBJECT 1625 0.54 0.58 0.53 187 XMNoSubject 1625 0.54 0.58 0.53 188 XMPhish08 1614 0.53 0.52 0.53 189 HTML_IMAGE_ONLY_20 1598 0.47 0.27 0.52 190 RDNS_DYNAMIC 1587 0.73 1.52 0.52 191 TR_Sbj_FN_Bdy 1587 0.60 0.89 0.52 192 NUMERIC_HTTP_ADDR 1562 0.60 0.96 0.51 193 PLING_QUERY 1537 1.71 6.18 0.50 194 XMSlimDrugH 1487 0.65 1.25 0.48 195 T_XMDrugObfuBody_00 1431 0.67 1.42 0.47 196 THIS_AD 1431 0.43 0.30 0.47 197 BODY_ENHANCEMENT 1425 0.38 0.07 0.46 198 BASE64_LENGTH_79_INF 1400 0.54 0.86 0.46 199 TooManyTo_005 1389 0.41 0.25 0.45 200 XM_SPF_Unknown 1369 0.81 2.16 0.45 ----------------------------------------------------------------------