Email: 387506 Autolearn: 0 AvgScore: -0.31 AvgScanTime: 1.17 sec Spam: 57973 Autolearn: 0 AvgScore: 12.05 AvgScanTime: 1.28 sec Ham: 329533 Autolearn: 0 AvgScore: -2.48 AvgScanTime: 1.15 sec Time Spent Running SA: 125.93 hours Time Spent Processing Spam: 20.66 hours Time Spent Processing Ham: 105.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 56924 98.87 98.19 98.99 2 HTML_MESSAGE 51323 87.45 88.53 87.26 3 DKIM_SIGNED 45950 78.20 79.26 78.01 4 XM_DK_Pass 44854 77.29 77.37 77.28 5 DKIM_VALID 43564 75.70 75.15 75.80 6 XM_B_Unicode 42677 74.41 73.62 74.55 7 RELAYCOUNTRY_US 41496 81.67 71.58 83.44 8 XMListUnsubscribeExists 39824 58.89 68.69 57.17 9 XM_B_SpammyWords 38767 54.24 66.87 52.01 10 DKIM_VALID_AU 32749 60.25 56.49 60.91 11 XM_DK_Undo_02 31177 18.97 53.78 12.85 12 BAYES_99 25731 13.70 44.38 8.30 13 XM_B_SpammyWords2 22029 28.82 38.00 27.21 14 LOC_TINY_FONT_1 20130 30.64 34.72 29.92 15 BAYES_999 19892 10.83 34.31 6.69 16 XM_B_Unicode3 19624 43.00 33.85 44.61 17 BAYES_50 17945 46.42 30.95 49.14 18 DKIM_VALID_EF 17010 27.65 29.34 27.36 19 RELAYCOUNTRY_META 16427 8.52 28.34 5.04 20 RCVD_IN_MSPIKE_H2 16358 26.13 28.22 25.76 21 MIME_HTML_ONLY 15394 25.69 26.55 25.54 22 HTML_FONT_LOW_CONTRAST 15281 31.23 26.36 32.09 23 FVGT_m_MULTI_ODD 15054 23.72 25.97 23.33 24 T_KAM_HTML_FONT_INVALID 14133 18.52 24.38 17.49 25 XM_Multi_Part_URI 13562 15.92 23.39 14.60 26 T_TM2_M_HEADER_IN_MSG 13480 22.81 23.25 22.74 27 XMSubLong 12924 20.63 22.29 20.34 28 XM_Body_Dirty_Words 12365 16.25 21.33 15.35 29 BOTNET 12274 5.10 21.17 2.28 30 XM_UncommonTLD01 11393 6.04 19.65 3.64 31 UNTRUSTED_Relay 10360 4.85 17.87 2.56 32 BOTNET_IPINHOSTNAME 9581 7.98 16.53 6.48 33 LOTS_OF_MONEY 8351 9.60 14.40 8.75 34 XM_B_SpammyWords3 7030 9.14 12.13 8.62 35 RCVD_IN_MSPIKE_WL 6932 26.48 11.96 29.03 36 XMSexyCombo_05 6724 6.80 11.60 5.95 37 XM_B_Unsub 6398 12.25 11.04 12.46 38 RCVD_IN_MSPIKE_BL 6267 2.79 10.81 1.37 39 XM_B_Phish_Phrases 5857 8.86 10.10 8.64 40 RELAYCOUNTRY_CA 5830 3.20 10.06 1.99 41 LotsOfNums_01 5776 8.65 9.96 8.42 42 XM_Evil_Numbers_Gen 5266 9.38 9.08 9.44 43 SpammyFromTLD_02 5158 1.48 8.90 0.18 44 RCVD_IN_BL_SPAMCOP_NET 5097 3.54 8.79 2.62 45 BAYES_80 4999 5.53 8.62 4.98 46 HTML_IMAGE_RATIO_02 4934 8.77 8.51 8.81 47 XMSubMetaSx_00 4900 5.86 8.45 5.40 48 MPART_ALT_DIFF 4725 8.29 8.15 8.31 49 XM_UB50 4647 2.22 8.02 1.20 50 MIME_HTML_MOSTLY 4220 3.62 7.28 2.98 51 XM_B_SpammyTLD 4186 3.09 7.22 2.37 52 RCVD_IN_MSPIKE_H3 4096 15.22 7.07 16.66 53 XM_DIRTYINTL 4014 1.56 6.92 0.61 54 XMBody_17 3828 2.21 6.60 1.44 55 XMBrknScrpt_02 3811 2.11 6.57 1.32 56 BAYES_60 3543 7.53 6.11 7.78 57 TooManyTo_001 3364 6.00 5.80 6.03 58 RCVD_IN_MSPIKE_L3 3320 1.63 5.73 0.91 59 HTML_IMAGE_RATIO_04 3286 6.70 5.67 6.88 60 TR_XM_PhishingBody 3235 3.18 5.58 2.75 61 SpammyFromTLD_01 3177 1.33 5.48 0.60 62 UNPARSEABLE_RELAY 3162 8.09 5.45 8.56 63 URIBL_SBL_A 3155 1.10 5.44 0.34 64 XM_H_Long_From01 3120 5.26 5.38 5.24 65 BAYES_95 2927 3.41 5.05 3.12 66 RCVD_IN_RP_RNBL 2923 0.79 5.04 0.04 67 T_REMOTE_IMAGE 2802 4.07 4.83 3.94 68 BOTNET_NORDNS 2698 0.71 4.65 0.01 69 RELAYCOUNTRY_FR 2685 0.90 4.63 0.25 70 URI_PHP_REDIR 2682 0.70 4.63 0.01 71 RCVD_IN_MSPIKE_H4 2634 9.90 4.54 10.85 72 RCVD_IN_MSPIKE_L5 2625 1.03 4.53 0.41 73 FROM_EXCESS_BASE64 2565 4.29 4.42 4.27 74 TR_LOTS_OF_MONEY3 2510 1.47 4.33 0.97 75 TR_XM_MaxBayes 2430 0.67 4.19 0.06 76 HTML_MIME_NO_HTML_TAG 2425 1.94 4.18 1.54 77 XM_SPF_SoftFail 2393 2.00 4.13 1.62 78 DKIM_INVALID 2386 2.49 4.12 2.21 79 FROM_SUSPICIOUS_NTLD 2343 0.80 4.04 0.22 80 URI_TRY_3LD 2327 2.26 4.01 1.96 81 FROM_SUSPICIOUS_NTLD_FP 2319 0.78 4.00 0.22 82 TR_XM_MaxSPIKE 2312 0.66 3.99 0.07 83 XMSexyCombo_01 2276 1.89 3.93 1.53 84 XM_B_COVIDMETA 2273 1.84 3.92 1.47 85 T_XMDrugObfuBody_08 2211 2.00 3.81 1.68 86 URI_HEX 2211 2.19 3.81 1.91 87 TR_XM_PHPDW 2157 0.92 3.72 0.43 88 XM_OfRef6 2139 1.46 3.69 1.07 89 TR_XM_PHPForged 2121 0.87 3.66 0.37 90 XM_SendGrid 2088 6.92 3.60 7.50 91 TR_XM_FormFill2 2087 0.85 3.60 0.37 92 XM_H_PHPOS 2083 0.84 3.59 0.36 93 HTML_IMAGE_RATIO_06 2040 3.79 3.52 3.84 94 XM_UB99 1993 0.52 3.44 0.01 95 XM_B_Phish66 1970 1.47 3.40 1.14 96 RCVD_IN_PSBL 1960 0.56 3.38 0.06 97 DKIM_ADSP_NXDOMAIN 1925 1.18 3.32 0.81 98 TR_XM_UnparsRelay 1813 0.96 3.13 0.58 99 HTML_IMAGE_RATIO_08 1777 2.56 3.07 2.47 100 XM_S_SpammyWords 1776 0.61 3.06 0.17 101 TR_XM_Spammywords 1776 0.61 3.06 0.17 102 XMMoneyMeta_00 1667 0.65 2.88 0.26 103 T_XMDrugObfuBody_14 1588 2.25 2.74 2.17 104 T_HTML_TAG_BALANCE_CENTER 1567 0.64 2.70 0.28 105 BODY_URI_ONLY 1564 0.43 2.70 0.03 106 TR_XM_SB_Phish 1519 3.25 2.62 3.36 107 XMSubPhish11 1504 3.24 2.59 3.35 108 TR_XM_COVIDMETA4 1471 0.82 2.54 0.52 109 T_TooManySym_01 1464 5.31 2.53 5.80 110 XMStrtUSub 1452 3.97 2.50 4.23 111 HDRS_MISSP 1437 0.41 2.48 0.05 112 XMNumbers 1408 3.62 2.43 3.83 113 T_XMHurry_00 1391 0.86 2.40 0.59 114 XM_UB999 1389 0.36 2.40 0.00 115 TM2_M_URI_OPT_OUT 1384 6.33 2.39 7.02 116 XMBody_50 1383 0.36 2.39 0.00 117 DIET_1 1361 0.87 2.35 0.61 118 XM_CamelCaseFrm001 1352 2.07 2.33 2.02 119 XM_URI_RBL 1343 0.53 2.32 0.21 120 XM_UB60 1342 0.59 2.31 0.29 121 XMSlimDrugH 1339 0.79 2.31 0.52 122 ALL_TRUSTED 1315 10.64 2.27 12.12 123 BOUNCE_MESSAGE 1292 3.44 2.23 3.65 124 ANY_BOUNCE_MESSAGE 1292 3.44 2.23 3.65 125 XM_B_SpammyWords4 1261 1.30 2.18 1.15 126 XMBdyGiftCard01 1254 1.49 2.16 1.37 127 KHOP_HELO_FCRDNS 1215 1.43 2.10 1.31 128 RELAYCOUNTRY_IN 1206 0.37 2.08 0.07 129 XM_B_Unsub2 1205 1.54 2.08 1.44 130 T_PDS_OTHER_BAD_TLD 1192 1.00 2.06 0.82 131 T_FILL_THIS_FORM_SHORT 1168 0.95 2.01 0.76 132 TR_XM_INV_DKIM 1162 0.38 2.00 0.09 133 LH_URI_DOM_IN_PATH 1142 1.94 1.97 1.94 134 XM_UB80 1137 0.32 1.96 0.03 135 XMSexyCombo_04 1119 1.10 1.93 0.95 136 XMBounce_01 1106 0.32 1.91 0.04 137 TR_XM_RelayPhish 1106 0.40 1.91 0.14 138 XMDiploma_00 1071 1.65 1.85 1.61 139 XM_JunkDunk 1036 0.27 1.79 0.00 140 BAYES_40 1028 3.68 1.77 4.01 141 XMMailDelErr 1011 0.27 1.74 0.01 142 TR_Mismatch_TLD_02 1002 0.36 1.73 0.12 143 TM2_M_VERY_LONG_WORD 999 1.50 1.72 1.46 144 TR_Symld_Words 978 1.79 1.69 1.81 145 MIME_QP_LONG_LINE 974 3.69 1.68 4.05 146 XMHTML_After_End 964 0.90 1.66 0.76 147 XMSubNoVowel 954 1.66 1.65 1.66 148 SUBJ_ALL_CAPS 944 1.46 1.63 1.43 149 MIME_HTML_ONLY_MULTI 941 5.40 1.62 6.06 150 MISSING_HEADERS 938 0.64 1.62 0.47 151 RELAYCOUNTRY_DE 928 0.50 1.60 0.30 152 TR_XM_DK_SendGrid 926 4.13 1.60 4.58 153 BAYES_20 923 2.92 1.59 3.16 154 INVESTMENT_ADVICE 892 0.31 1.54 0.09 155 TR_Mismatch_TLD_01 875 0.52 1.51 0.34 156 REPLYTO_WITHOUT_TO_CC 858 0.28 1.48 0.07 157 XM_Combo_Sbj 857 0.46 1.48 0.29 158 XMStockSpam_06 839 1.46 1.45 1.46 159 RDNS_DYNAMIC 831 0.77 1.43 0.65 160 TVD_SPACE_RATIO_MINFP 825 0.25 1.42 0.04 161 XM_H_PHPMailer 824 0.81 1.42 0.70 162 MIME_CHARSET_FARAWAY 778 0.32 1.34 0.15 163 XM_SPF_Unknown 753 0.43 1.30 0.28 164 INVALID_MSGID 746 2.08 1.29 2.22 165 XM_UB95 730 0.20 1.26 0.02 166 RCVD_IN_IADB_LISTED 720 3.63 1.24 4.05 167 SPOOFED_URL 713 0.69 1.23 0.60 168 XMGenDplmaNmb 707 0.96 1.22 0.92 169 TR_XM_COVIDMETA1 698 0.38 1.20 0.23 170 XM_OfRef7 696 0.26 1.20 0.10 171 FROM_MISSP_REPLYTO 694 0.18 1.20 0.00 172 CHARSET_FARAWAY_HEADER 690 0.26 1.19 0.09 173 URI_NOVOWEL 687 1.82 1.19 1.93 174 DKIM_ADSP_CUSTOM_MED 661 0.95 1.14 0.91 175 HK_RANDOM_REPLYTO 657 0.33 1.13 0.19 176 HTTPS_HTTP_MISMATCH 657 0.60 1.13 0.50 177 XMReplyNow 656 0.29 1.13 0.15 178 XM_H_PHPOS_M 654 0.37 1.13 0.23 179 SPOOFED_URL_HOST 640 0.56 1.10 0.47 180 REMOVE_BEFORE_LINK 628 0.33 1.08 0.20 181 MAILING_LIST_MULTI 626 1.46 1.08 1.53 182 NML_ADSP_CUSTOM_MED 621 0.68 1.07 0.61 183 NO_DNS_FOR_FROM 616 0.77 1.06 0.71 184 RELAYCOUNTRY_IT 616 0.18 1.06 0.03 185 TR_XM_FormFill 615 0.23 1.06 0.08 186 TR_BOTNET_NEGATE 612 0.68 1.06 0.62 187 LongTLD 608 0.27 1.05 0.14 188 RCVD_IN_RP_SAFE 600 8.33 1.03 9.61 189 DATE_IN_PAST_03_06 599 0.28 1.03 0.15 190 XMSubMetaSxObfu_02 593 0.62 1.02 0.55 191 CK_HELO_DYNAMIC_SPLIT_IP 584 2.14 1.01 2.34 192 XMBody_29 584 0.23 1.01 0.09 193 HTML_FONT_FACE_BAD 570 1.54 0.98 1.64 194 XMPhish30 567 0.65 0.98 0.60 195 NUMERIC_HTTP_ADDR 562 0.58 0.97 0.52 196 RCVD_IN_IADB_SPF 558 3.10 0.96 3.48 197 TR_LOTS_OF_MONEY2 556 0.32 0.96 0.21 198 T_MONEY_PERCENT 556 0.32 0.96 0.21 199 MPART_ALT_DIFF_COUNT 549 0.51 0.95 0.43 200 T_XMDrugObfuBody_00 547 0.65 0.94 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 326207 98.87 98.19 98.99 2 HTML_MESSAGE 287540 87.45 88.53 87.26 3 RELAYCOUNTRY_US 274967 81.67 71.58 83.44 4 DKIM_SIGNED 257066 78.20 79.26 78.01 5 XM_DK_Pass 254652 77.29 77.37 77.28 6 DKIM_VALID 249789 75.70 75.15 75.80 7 XM_B_Unicode 245657 74.41 73.62 74.55 8 DKIM_VALID_AU 200728 60.25 56.49 60.91 9 XMListUnsubscribeExists 188385 58.89 68.69 57.17 10 XM_B_SpammyWords 171401 54.24 66.87 52.01 11 BAYES_50 161930 46.42 30.95 49.14 12 XM_B_Unicode3 146993 43.00 33.85 44.61 13 HTML_FONT_LOW_CONTRAST 105751 31.23 26.36 32.09 14 LOC_TINY_FONT_1 98606 30.64 34.72 29.92 15 RCVD_IN_MSPIKE_WL 95663 26.48 11.96 29.03 16 DKIM_VALID_EF 90149 27.65 29.34 27.36 17 XM_B_SpammyWords2 89667 28.82 38.00 27.21 18 RCVD_IN_MSPIKE_H2 84894 26.13 28.22 25.76 19 MIME_HTML_ONLY 84160 25.69 26.55 25.54 20 FVGT_m_MULTI_ODD 76868 23.72 25.97 23.33 21 T_TM2_M_HEADER_IN_MSG 74922 22.81 23.25 22.74 22 XMSubLong 67036 20.63 22.29 20.34 23 T_KAM_HTML_FONT_INVALID 57641 18.52 24.38 17.49 24 BAYES_00 57047 14.82 0.68 17.31 25 RCVD_IN_MSPIKE_H3 54888 15.22 7.07 16.66 26 XM_Body_Dirty_Words 50599 16.25 21.33 15.35 27 XM_Multi_Part_URI 48113 15.92 23.39 14.60 28 XM_DK_Undo_02 42335 18.97 53.78 12.85 29 XM_B_Unsub 41075 12.25 11.04 12.46 30 ALL_TRUSTED 39924 10.64 2.27 12.12 31 RCVD_IN_MSPIKE_H4 35748 9.90 4.54 10.85 32 XM_DKIMWhitelistDomains 31864 8.22 0.00 9.67 33 RCVD_IN_RP_SAFE 31668 8.33 1.03 9.61 34 XM_Evil_Numbers_Gen 31101 9.38 9.08 9.44 35 TR_XM_DK_Bayes 31015 8.06 0.37 9.41 36 TR_XM_DK_Bayes1 30429 7.91 0.36 9.23 37 RCVD_IN_RP_CERTIFIED 29977 7.83 0.65 9.10 38 HTML_IMAGE_RATIO_02 29047 8.77 8.51 8.81 39 LOTS_OF_MONEY 28850 9.60 14.40 8.75 40 XM_B_Phish_Phrases 28481 8.86 10.10 8.64 41 XM_B_SpammyWords3 28405 9.14 12.13 8.62 42 TR_XM_DK_Bayes2 28230 7.33 0.32 8.57 43 UNPARSEABLE_RELAY 28199 8.09 5.45 8.56 44 LotsOfNums_01 27757 8.65 9.96 8.42 45 MPART_ALT_DIFF 27391 8.29 8.15 8.31 46 BAYES_99 27351 13.70 44.38 8.30 47 BAYES_60 25654 7.53 6.11 7.78 48 XM_SendGrid 24710 6.92 3.60 7.50 49 TM2_M_URI_OPT_OUT 23131 6.33 2.39 7.02 50 HTML_IMAGE_RATIO_04 22675 6.70 5.67 6.88 51 BAYES_999 22061 10.83 34.31 6.69 52 BOTNET_IPINHOSTNAME 21354 7.98 16.53 6.48 53 MIME_HTML_ONLY_MULTI 19974 5.40 1.62 6.06 54 TooManyTo_001 19869 6.00 5.80 6.03 55 XMSexyCombo_05 19610 6.80 11.60 5.95 56 T_TooManySym_01 19123 5.31 2.53 5.80 57 XM_H_Trusted_IP 18162 4.69 0.00 5.51 58 XMSubMetaSx_00 17791 5.86 8.45 5.40 59 XM_H_Long_From01 17265 5.26 5.38 5.24 60 RELAYCOUNTRY_META 16600 8.52 28.34 5.04 61 BAYES_80 16412 5.53 8.62 4.98 62 TR_XM_DK_SendGrid 15085 4.13 1.60 4.58 63 FROM_EXCESS_BASE64 14071 4.29 4.42 4.27 64 XMStrtUSub 13929 3.97 2.50 4.23 65 IN_ZIMBRA_NJ_WHITELIST 13766 3.56 0.03 4.18 66 MIME_QP_LONG_LINE 13334 3.69 1.68 4.05 67 RCVD_IN_IADB_LISTED 13331 3.63 1.24 4.05 68 BAYES_40 13228 3.68 1.77 4.01 69 T_REMOTE_IMAGE 12972 4.07 4.83 3.94 70 HTML_IMAGE_RATIO_06 12665 3.79 3.52 3.84 71 XMNumbers 12605 3.62 2.43 3.83 72 ANY_BOUNCE_MESSAGE 12042 3.44 2.23 3.65 73 BOUNCE_MESSAGE 12040 3.44 2.23 3.65 74 XM_UncommonTLD01 12001 6.04 19.65 3.64 75 RCVD_IN_IADB_SPF 11473 3.10 0.96 3.48 76 TR_XM_SB_Phish 11086 3.25 2.62 3.36 77 T_TooManySym_02 11048 2.93 0.50 3.35 78 XMSubPhish11 11046 3.24 2.59 3.35 79 BAYES_20 10411 2.92 1.59 3.16 80 BAYES_95 10284 3.41 5.05 3.12 81 RCVD_IN_IADB_SENDERID 10225 2.77 0.90 3.10 82 TVD_RCVD_IP 9948 2.62 0.32 3.02 83 RCVD_IN_IADB_DK 9853 2.68 0.90 2.99 84 MIME_HTML_MOSTLY 9821 3.62 7.28 2.98 85 TR_XM_PhishingBody 9074 3.18 5.58 2.75 86 RCVD_IN_BL_SPAMCOP_NET 8640 3.54 8.79 2.62 87 RCVD_IN_IADB_VOUCHED 8538 2.29 0.59 2.59 88 UNTRUSTED_Relay 8421 4.85 17.87 2.56 89 HTML_IMAGE_RATIO_08 8127 2.56 3.07 2.47 90 XM_B_SpammyTLD 7805 3.09 7.22 2.37 91 HELO_MISC_IP 7704 2.12 0.88 2.34 92 CK_HELO_DYNAMIC_SPLIT_IP 7696 2.14 1.01 2.34 93 BOTNET 7503 5.10 21.17 2.28 94 INVALID_MSGID 7319 2.08 1.29 2.22 95 DKIM_INVALID 7277 2.49 4.12 2.21 96 BAYES_05 7210 1.98 0.82 2.19 97 T_XMDrugObfuBody_14 7150 2.25 2.74 2.17 98 XM_CamelCaseFrm001 6657 2.07 2.33 2.02 99 RELAYCOUNTRY_CA 6569 3.20 10.06 1.99 100 URI_TRY_3LD 6449 2.26 4.01 1.96 101 LH_URI_DOM_IN_PATH 6377 1.94 1.97 1.94 102 URI_NOVOWEL 6358 1.82 1.19 1.93 103 TO_MALFORMED 6357 1.64 0.01 1.93 104 URI_HEX 6283 2.19 3.81 1.91 105 XM_PDF 5997 1.61 0.45 1.82 106 TR_Symld_Words 5949 1.79 1.69 1.81 107 RCVD_IN_IADB_OPTIN 5707 1.54 0.42 1.73 108 T_XMDrugObfuBody_08 5536 2.00 3.81 1.68 109 XMSubNoVowel 5468 1.66 1.65 1.66 110 HTML_FONT_FACE_BAD 5411 1.54 0.98 1.64 111 XM_SPF_SoftFail 5345 2.00 4.13 1.62 112 XMDiploma_00 5310 1.65 1.85 1.61 113 HTML_MIME_NO_HTML_TAG 5083 1.94 4.18 1.54 114 XMSexyCombo_01 5048 1.89 3.93 1.53 115 MAILING_LIST_MULTI 5044 1.46 1.08 1.53 116 RCVD_IN_MSPIKE_H5 5027 1.35 0.35 1.53 117 XMGappySubj_01 5015 1.31 0.13 1.52 118 XM_DK_Undo_01 4953 1.40 0.81 1.50 119 XM_B_COVIDMETA 4841 1.84 3.92 1.47 120 XMStockSpam_06 4824 1.46 1.45 1.46 121 TM2_M_VERY_LONG_WORD 4802 1.50 1.72 1.46 122 XM_B_Unsub2 4750 1.54 2.08 1.44 123 XMBody_17 4734 2.21 6.60 1.44 124 SUBJ_ALL_CAPS 4720 1.46 1.63 1.43 125 IN_HORDE_ADDRESS_BOOK 4711 1.24 0.15 1.43 126 USER_IN_DEF_DKIM_WL 4609 1.19 0.01 1.40 127 RCVD_IN_MSPIKE_BL 4527 2.79 10.81 1.37 128 XMBdyGiftCard01 4521 1.49 2.16 1.37 129 XMBrknScrpt_02 4350 2.11 6.57 1.32 130 KHOP_HELO_FCRDNS 4324 1.43 2.10 1.31 131 TR_MSPIKEBAYES00 4048 1.05 0.00 1.23 132 XM_UB50 3945 2.22 8.02 1.20 133 XM_B_SpammyWords4 3779 1.30 2.18 1.15 134 T_TooManySym_03 3753 0.99 0.17 1.14 135 XM_B_Phish66 3745 1.47 3.40 1.14 136 XM_H_Long_From02 3658 1.04 0.62 1.11 137 XM_OfRef6 3527 1.46 3.69 1.07 138 TooManyTo_002 3320 0.94 0.53 1.01 139 XM_ProductURIs 3272 0.96 0.78 0.99 140 XM_GoogleGroups 3255 0.91 0.44 0.99 141 TR_LOTS_OF_MONEY3 3184 1.47 4.33 0.97 142 XMSexyCombo_04 3131 1.10 1.93 0.95 143 XMBody_95 3111 0.81 0.06 0.94 144 XMGenDplmaNmb 3017 0.96 1.22 0.92 145 DKIM_ADSP_CUSTOM_MED 3010 0.95 1.14 0.91 146 RCVD_IN_MSPIKE_L3 3004 1.63 5.73 0.91 147 XMSubMetaSxObfu_03 2937 0.89 0.86 0.89 148 XM_USANA_RCVD 2879 0.74 0.00 0.87 149 XMSubMetaSx_01 2802 0.78 0.36 0.85 150 XMHTMLBadTable_001 2781 0.80 0.53 0.84 151 T_PDS_OTHER_BAD_TLD 2698 1.00 2.06 0.82 152 DKIM_ADSP_NXDOMAIN 2660 1.18 3.32 0.81 153 HELO_NODOT 2542 0.79 0.89 0.77 154 T_FILL_THIS_FORM_SHORT 2514 0.95 2.01 0.76 155 XMHTML_After_End 2507 0.90 1.66 0.76 156 XMPhish08 2482 0.74 0.64 0.75 157 XM_B_REG_HTML 2458 0.67 0.21 0.75 158 HELO_NO_DOMAIN 2449 0.77 0.89 0.74 159 T_TooManySym_04 2403 0.63 0.06 0.73 160 TooManyTo_003 2364 0.67 0.38 0.72 161 NO_DNS_FOR_FROM 2353 0.77 1.06 0.71 162 XM_H_PHPMailer 2306 0.81 1.42 0.70 163 XM_S_SubURI 2253 0.61 0.22 0.68 164 RDNS_DYNAMIC 2158 0.77 1.43 0.65 165 PLING_QUERY 2128 0.61 0.37 0.65 166 XMSexyCombo_02 2054 0.56 0.21 0.62 167 TR_BOTNET_NEGATE 2034 0.68 1.06 0.62 168 DIET_1 2024 0.87 2.35 0.61 169 XM_DIRTYINTL 2019 1.56 6.92 0.61 170 NML_ADSP_CUSTOM_MED 1995 0.68 1.07 0.61 171 TR_MetaPhish_Combo_01 1984 0.63 0.81 0.60 172 T_XMDrugObfuBody_00 1981 0.65 0.94 0.60 173 XMSubMetaI_00 1980 0.57 0.41 0.60 174 SPOOFED_URL 1967 0.69 1.23 0.60 175 XMPhish30 1967 0.65 0.98 0.60 176 SpammyFromTLD_01 1964 1.33 5.48 0.60 177 T_XMHurry_00 1954 0.86 2.40 0.59 178 HTML_IMAGE_ONLY_20 1952 0.53 0.21 0.59 179 HTML_TAG_BALANCE_BODY 1919 0.61 0.78 0.58 180 USER_IN_WELCOMELIST 1915 0.49 0.00 0.58 181 T_TooManySym_05 1915 0.50 0.03 0.58 182 USER_IN_WHITELIST 1915 0.49 0.00 0.58 183 TR_XM_UnparsRelay 1908 0.96 3.13 0.58 184 XM_shorewaves_Whitelist 1833 0.47 0.00 0.56 185 XMSubMetaSxObfu_02 1824 0.62 1.02 0.55 186 RELAYCOUNTRY_GB 1821 0.59 0.81 0.55 187 XMBody_78 1807 0.60 0.89 0.55 188 XM_ShortIntro_01 1773 0.53 0.51 0.54 189 TooManyTo_004 1750 0.50 0.34 0.53 190 XMSlimDrugH 1713 0.79 2.31 0.52 191 TR_XM_COVIDMETA4 1709 0.82 2.54 0.52 192 NUMERIC_HTTP_ADDR 1698 0.58 0.97 0.52 193 THIS_AD 1685 0.50 0.44 0.51 194 HTTPS_HTTP_MISMATCH 1653 0.60 1.13 0.50 195 XMLngstWrd_00 1649 0.47 0.32 0.50 196 FORGED_GMAIL_RCVD 1630 0.54 0.82 0.49 197 MISSING_HEADERS 1557 0.64 1.62 0.47 198 TooManyTo_005 1544 0.44 0.30 0.47 199 SPOOFED_URL_HOST 1541 0.56 1.10 0.47 200 XM_E_Blogspot 1508 0.40 0.10 0.46 ----------------------------------------------------------------------