Email: 374952 Autolearn: 0 AvgScore: 2.63 AvgScanTime: 1.10 sec Spam: 86978 Autolearn: 0 AvgScore: 15.50 AvgScanTime: 0.96 sec Ham: 287974 Autolearn: 0 AvgScore: -1.25 AvgScanTime: 1.15 sec Time Spent Running SA: 115.01 hours Time Spent Processing Spam: 23.08 hours Time Spent Processing Ham: 91.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 83186 98.36 95.64 99.19 2 HTML_MESSAGE 81499 89.27 93.70 87.93 3 XM_B_SpammyWords 58253 55.32 66.97 51.80 4 XM_B_Unicode 48947 70.62 56.28 74.95 5 RELAYCOUNTRY_US 47307 76.46 54.39 83.12 6 RCVD_IN_MSPIKE_H2 47211 34.23 54.28 28.17 7 MIME_HTML_ONLY 46360 30.66 53.30 23.82 8 DKIM_SIGNED 45347 76.32 52.14 83.62 9 XM_DK_Pass 43982 75.07 50.57 82.46 10 DKIM_VALID 42866 73.62 49.28 80.97 11 RELAYCOUNTRY_META 39994 14.80 45.98 5.38 12 XMListUnsubscribeExists 39354 58.35 45.25 62.31 13 XM_B_SpammyWords2 37559 30.06 43.18 26.10 14 RCVD_IN_BL_SPAMCOP_NET 35282 10.34 40.56 1.22 15 BAYES_99 34347 16.19 39.49 9.15 16 RCVD_IN_PSBL 33811 9.07 38.87 0.07 17 DKIM_VALID_AU 32578 59.34 37.46 65.94 18 HTML_MIME_NO_HTML_TAG 32236 9.98 37.06 1.79 19 XM_DK_Undo_02 30480 17.79 35.04 12.58 20 XM_B_Unsub 27649 14.95 31.79 9.86 21 XMSubGiftCard1 27388 7.35 31.49 0.06 22 BAYES_999 25757 12.66 29.61 7.54 23 BAYES_50 24163 46.08 27.78 51.61 24 UNTRUSTED_Relay 23587 8.09 27.12 2.34 25 XM_Multi_Part_URI 22521 18.32 25.89 16.03 26 XM_B_Unicode3 21382 39.90 24.58 44.53 27 BOTNET 20041 7.34 23.04 2.59 28 DKIM_VALID_EF 19761 27.54 22.72 28.99 29 XMSubLong 19651 22.68 22.59 22.71 30 LOC_TINY_FONT_1 19049 30.87 21.90 33.57 31 FROM_EXCESS_BASE64 18256 7.79 20.99 3.80 32 XMSubGiftCard2 16843 4.51 19.36 0.03 33 HTML_FONT_LOW_CONTRAST 16335 31.12 18.78 34.85 34 FVGT_m_MULTI_ODD 14961 21.68 17.20 23.03 35 T_TM2_M_HEADER_IN_MSG 13108 21.50 15.07 23.44 36 T_KAM_HTML_FONT_INVALID 12757 17.85 14.67 18.81 37 HTML_IMAGE_ONLY_20 12183 3.57 14.01 0.42 38 XM_Body_Dirty_Words 11406 15.18 13.11 15.81 39 XM_UncommonTLD01 11215 5.85 12.89 3.73 40 LOCALPART_IN_SUBJECT 10914 2.94 12.55 0.03 41 BAYES_80 10061 6.93 11.57 5.53 42 BAYES_60 9214 8.90 10.59 8.39 43 BOTNET_IPINHOSTNAME 8670 8.08 9.97 7.51 44 HK_RANDOM_FROM 8353 2.31 9.60 0.10 45 RELAYCOUNTRY_GB 8249 2.69 9.48 0.64 46 MPART_ALT_DIFF 8116 6.00 9.33 4.99 47 RCVD_IN_MSPIKE_BL 7469 3.04 8.59 1.36 48 T_REMOTE_IMAGE 7434 4.28 8.55 2.99 49 MIME_HTML_MOSTLY 7353 4.59 8.45 3.42 50 XMSexyCombo_05 7296 6.52 8.39 5.96 51 LOTS_OF_MONEY 7050 7.17 8.11 6.88 52 XM_UB50 7029 2.69 8.08 1.06 53 RELAYCOUNTRY_CA 6855 3.66 7.88 2.39 54 XM_UB99 6605 1.77 7.59 0.01 55 RCVD_IN_MSPIKE_WL 6586 26.47 7.57 32.18 56 XM_B_SpammyWords3 6563 7.66 7.55 7.70 57 BAYES_95 6493 4.31 7.47 3.35 58 HTML_IMAGE_RATIO_02 6456 9.35 7.42 9.93 59 XM_Evil_Numbers_Gen 6215 9.49 7.15 10.20 60 XM_B_Phish_Phrases 6102 7.58 7.02 7.75 61 RCVD_IN_RP_RNBL 5928 1.62 6.82 0.05 62 URI_PHP_REDIR 5718 1.55 6.57 0.04 63 XMSubMetaSx_00 5448 5.59 6.26 5.38 64 BOTNET_NORDNS 5394 1.45 6.20 0.01 65 SpammyFromTLD_01 5122 1.79 5.89 0.56 66 LotsOfNums_01 4873 8.27 5.60 9.08 67 KHOP_HELO_FCRDNS 4829 1.96 5.55 0.87 68 XM_UB999 4724 1.26 5.43 0.01 69 HTML_IMAGE_ONLY_28 4530 1.45 5.21 0.31 70 RELAYCOUNTRY_FR 4335 1.32 4.98 0.21 71 RCVD_IN_MSPIKE_L3 4267 1.88 4.91 0.97 72 HTML_FONT_TINY_NORDNS 4178 1.23 4.80 0.15 73 XM_DIRTYINTL 4066 1.52 4.67 0.57 74 RCVD_IN_MSPIKE_H3 4020 14.93 4.62 18.04 75 XMBody_17 3710 2.64 4.27 2.16 76 FROM_LOCAL_NOVOWEL 3636 1.00 4.18 0.03 77 HTML_IMAGE_RATIO_04 3627 6.75 4.17 7.53 78 HTML_IMAGE_ONLY_24 3617 1.16 4.16 0.26 79 XM_UB60 3531 1.04 4.06 0.13 80 SpammyFromTLD_02 3527 1.14 4.06 0.26 81 XM_H_Long_From01 3524 5.14 4.05 5.47 82 XM_UB80 3511 0.97 4.04 0.04 83 XM_S_GiftBonus 3472 0.93 3.99 0.01 84 TooManyTo_001 3225 6.41 3.71 7.23 85 XM_SPF_SoftFail 3162 1.71 3.64 1.13 86 XM_B_SpammyTLD 3066 2.12 3.53 1.69 87 HK_RANDOM_ENVFROM 2849 0.87 3.28 0.14 88 UNPARSEABLE_RELAY 2840 7.51 3.27 8.79 89 RCVD_IN_MSPIKE_L5 2809 0.99 3.23 0.31 90 HTML_IMAGE_RATIO_06 2567 3.54 2.95 3.72 91 TR_XM_PhishingBody 2566 2.87 2.95 2.85 92 URI_HEX 2554 2.02 2.94 1.75 93 XM_CamelCaseFrm001 2519 2.31 2.90 2.13 94 XMNumbers 2493 3.85 2.87 4.15 95 DKIM_INVALID 2481 2.70 2.85 2.65 96 FVGT_m_MULTI_ODD_EMAIL 2477 0.70 2.85 0.05 97 XMBrknScrpt_02 2463 1.63 2.83 1.26 98 URIBL_SBL_A 2398 1.00 2.76 0.47 99 RCVD_IN_MSPIKE_H4 2367 10.33 2.72 12.62 100 XMSexyCombo_01 2366 1.98 2.72 1.75 101 XM_B_COVIDMETA 2349 1.33 2.70 0.91 102 RELAYCOUNTRY_IN 2332 0.66 2.68 0.05 103 TR_XM_MaxSPIKE 2273 0.66 2.61 0.07 104 RELAYCOUNTRY_JP 2271 0.63 2.61 0.03 105 XM_UB95 2253 0.62 2.59 0.02 106 XMStrtUSub 2220 4.67 2.55 5.30 107 LH_URI_DOM_IN_PATH 2033 1.75 2.34 1.57 108 HTML_IMAGE_RATIO_08 2007 2.76 2.31 2.89 109 RELAYCOUNTRY_AE 1991 0.53 2.29 0.00 110 TO_NO_BRKTS_HTML_ONLY 1968 0.57 2.26 0.06 111 XM_OfRef6 1945 1.51 2.24 1.29 112 XM_SendGrid 1945 6.34 2.24 7.58 113 T_TooManySym_01 1888 4.90 2.17 5.72 114 RELAYCOUNTRY_NL 1797 0.66 2.07 0.23 115 TR_XM_MaxBayes 1769 0.52 2.03 0.06 116 TR_XM_PHPDW 1760 0.77 2.02 0.40 117 T_XMDrugObfuBody_14 1744 2.41 2.01 2.53 118 TR_XM_PHPForged 1720 0.74 1.98 0.37 119 TR_XM_FormFill2 1706 0.74 1.96 0.37 120 XM_H_PHPOS 1701 0.73 1.96 0.36 121 T_XMHurry_00 1667 1.19 1.92 0.97 122 TR_XM_UnparsRelay 1649 0.86 1.90 0.54 123 RELAYCOUNTRY_KR 1637 0.45 1.88 0.02 124 TM2_M_URI_OPT_OUT 1606 3.84 1.85 4.44 125 RELAYCOUNTRY_IE 1597 0.53 1.84 0.13 126 T_XMDrugObfuBody_08 1590 1.63 1.83 1.57 127 URI_NO_WWW_BIZ_CGI 1569 0.42 1.80 0.01 128 XMSexyCombo_04 1560 1.28 1.79 1.13 129 TO_NAME_SUBJ_NO_RDNS 1499 0.40 1.72 0.00 130 TM2_M_VERY_LONG_WORD 1488 1.45 1.71 1.37 131 DATE_IN_PAST_03_06 1450 0.48 1.67 0.13 132 T_XMDrugObfuBody_00 1441 1.10 1.66 0.94 133 TR_Mismatch_TLD_01 1380 0.56 1.59 0.25 134 TR_XM_RelayPhish 1372 0.52 1.58 0.20 135 TR_LOTS_OF_MONEY3 1331 1.03 1.53 0.88 136 XMSubNoVowel 1331 0.97 1.53 0.80 137 XMBdyGiftCard01 1304 1.69 1.50 1.74 138 RELAYCOUNTRY_AU 1300 0.58 1.49 0.30 139 XM_B_Phish66 1279 1.23 1.47 1.16 140 RDNS_DYNAMIC 1254 0.92 1.44 0.76 141 RELAYCOUNTRY_HK 1234 0.35 1.42 0.02 142 URI_TRY_3LD 1233 1.79 1.42 1.90 143 DKIM_ADSP_CUSTOM_MED 1222 1.14 1.40 1.05 144 MIME_CHARSET_FARAWAY 1200 0.42 1.38 0.13 145 XM_URI_RBL 1178 0.46 1.35 0.19 146 XMGppyBdWords 1178 0.45 1.35 0.17 147 NML_ADSP_CUSTOM_MED 1167 0.90 1.34 0.76 148 CHARSET_FARAWAY_HEADER 1148 0.36 1.32 0.07 149 ALL_TRUSTED 1131 9.72 1.30 12.26 150 TR_XM_INV_DKIM 1101 0.48 1.27 0.24 151 BAYES_40 1098 3.33 1.26 3.95 152 SUBJ_ALL_CAPS 1097 1.33 1.26 1.35 153 T_PDS_OTHER_BAD_TLD 1082 0.55 1.24 0.34 154 TR_XM_SB_Phish 1074 1.41 1.23 1.47 155 RELAYCOUNTRY_SG 1064 0.35 1.22 0.08 156 DRUGS_ERECTILE 1050 0.31 1.21 0.04 157 XM_B_SpammyWords4 1031 0.90 1.19 0.81 158 DIET_1 996 0.88 1.15 0.80 159 XMSubPhish11 984 1.38 1.13 1.45 160 XMDiploma_00 981 1.79 1.13 1.99 161 FORGED_GMAIL_RCVD 979 0.66 1.13 0.51 162 NO_DNS_FOR_FROM 963 0.85 1.11 0.77 163 DKIM_ADSP_NXDOMAIN 963 0.93 1.11 0.88 164 MIME_HTML_ONLY_MULTI 932 2.08 1.07 2.39 165 TR_Symld_Words 922 1.47 1.06 1.60 166 TR_XM_DK_SendGrid 892 3.58 1.03 4.35 167 XM_B_Unsub2 887 1.12 1.02 1.15 168 INVESTMENT_ADVICE 885 0.30 1.02 0.09 169 TR_XM_COVIDMETA4 883 0.47 1.02 0.31 170 FROM_SUSPICIOUS_NTLD 877 0.29 1.01 0.07 171 HK_RANDOM_REPLYTO 837 0.44 0.96 0.28 172 NO_FM_NAME_IP_HOSTN 833 0.23 0.96 0.00 173 URI_NOVOWEL 830 1.49 0.95 1.65 174 FROM_SUSPICIOUS_NTLD_FP 828 0.27 0.95 0.06 175 XMStockSpam_06 828 1.44 0.95 1.58 176 BAYES_20 824 2.71 0.95 3.24 177 RCVD_IN_IADB_LISTED 819 3.02 0.94 3.64 178 T_FILL_THIS_FORM_SHORT 795 0.67 0.91 0.60 179 SUBJ_BUY 793 0.29 0.91 0.10 180 DRUGS_ERECTILE_OBFU 789 0.22 0.91 0.01 181 INVALID_MSGID 760 2.15 0.87 2.53 182 PDS_FROM_2_EMAILS 746 0.21 0.86 0.01 183 MIMEOLE_DIRECT_TO_MX 733 0.20 0.84 0.00 184 FROM_2_EMAILS_SHORT 731 0.20 0.84 0.01 185 XMHTML_After_End 699 0.97 0.80 1.01 186 MONEY_FRAUD_5 688 0.18 0.79 0.00 187 PDS_TO_EQ_FROM_NAME 687 0.19 0.79 0.01 188 TR_Mismatch_TLD_02 686 0.25 0.79 0.09 189 RELAYCOUNTRY_DE 685 0.55 0.79 0.48 190 FROM_MISSP_REPLYTO 679 0.18 0.78 0.00 191 XMSubMetaSxObfu_03 678 0.45 0.78 0.34 192 XMReplyNow 675 0.26 0.78 0.10 193 MISSING_HEADERS 674 0.37 0.77 0.25 194 XM_H_PHPMailer 674 0.56 0.77 0.50 195 DATE_IN_PAST_06_12 671 0.39 0.77 0.28 196 RELAYCOUNTRY_CN 670 0.23 0.77 0.07 197 CK_HELO_DYNAMIC_SPLIT_IP 670 2.14 0.77 2.56 198 XM_SPF_Unknown 665 0.49 0.76 0.41 199 XM_TLDProd2 660 0.31 0.76 0.17 200 XMGenDplmaNmb 653 1.16 0.75 1.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 285630 98.36 95.64 99.19 2 HTML_MESSAGE 253224 89.27 93.70 87.93 3 DKIM_SIGNED 240803 76.32 52.14 83.62 4 RELAYCOUNTRY_US 239371 76.46 54.39 83.12 5 XM_DK_Pass 237476 75.07 50.57 82.46 6 DKIM_VALID 233167 73.62 49.28 80.97 7 XM_B_Unicode 215834 70.62 56.28 74.95 8 DKIM_VALID_AU 189903 59.34 37.46 65.94 9 XMListUnsubscribeExists 179427 58.35 45.25 62.31 10 XM_B_SpammyWords 149162 55.32 66.97 51.80 11 BAYES_50 148618 46.08 27.78 51.61 12 XM_B_Unicode3 128223 39.90 24.58 44.53 13 HTML_FONT_LOW_CONTRAST 100365 31.12 18.78 34.85 14 LOC_TINY_FONT_1 96684 30.87 21.90 33.57 15 RCVD_IN_MSPIKE_WL 92660 26.47 7.57 32.18 16 DKIM_VALID_EF 83496 27.54 22.72 28.99 17 RCVD_IN_MSPIKE_H2 81119 34.23 54.28 28.17 18 XM_B_SpammyWords2 75158 30.06 43.18 26.10 19 MIME_HTML_ONLY 68590 30.66 53.30 23.82 20 T_TM2_M_HEADER_IN_MSG 67494 21.50 15.07 23.44 21 FVGT_m_MULTI_ODD 66322 21.68 17.20 23.03 22 XMSubLong 65406 22.68 22.59 22.71 23 T_KAM_HTML_FONT_INVALID 54172 17.85 14.67 18.81 24 RCVD_IN_MSPIKE_H3 51957 14.93 4.62 18.04 25 XM_Multi_Part_URI 46157 18.32 25.89 16.03 26 XM_Body_Dirty_Words 45529 15.18 13.11 15.81 27 BAYES_00 36827 9.90 0.35 12.79 28 RCVD_IN_MSPIKE_H4 36354 10.33 2.72 12.62 29 XM_DK_Undo_02 36228 17.79 35.04 12.58 30 ALL_TRUSTED 35303 9.72 1.30 12.26 31 RCVD_IN_RP_SAFE 32288 8.75 0.61 11.21 32 XM_DKIMWhitelistDomains 31545 8.41 0.00 10.95 33 RCVD_IN_RP_CERTIFIED 31021 8.35 0.35 10.77 34 XM_Evil_Numbers_Gen 29381 9.49 7.15 10.20 35 HTML_IMAGE_RATIO_02 28600 9.35 7.42 9.93 36 XM_B_Unsub 28401 14.95 31.79 9.86 37 TR_XM_DK_Bayes 27523 7.37 0.15 9.56 38 TR_XM_DK_Bayes1 26904 7.21 0.15 9.34 39 BAYES_99 26363 16.19 39.49 9.15 40 LotsOfNums_01 26143 8.27 5.60 9.08 41 UNPARSEABLE_RELAY 25319 7.51 3.27 8.79 42 TR_XM_DK_Bayes2 25250 6.76 0.13 8.77 43 BAYES_60 24174 8.90 10.59 8.39 44 XM_B_Phish_Phrases 22320 7.58 7.02 7.75 45 XM_B_SpammyWords3 22161 7.66 7.55 7.70 46 XM_SendGrid 21841 6.34 2.24 7.58 47 BAYES_999 21711 12.66 29.61 7.54 48 HTML_IMAGE_RATIO_04 21688 6.75 4.17 7.53 49 BOTNET_IPINHOSTNAME 21638 8.08 9.97 7.51 50 TooManyTo_001 20809 6.41 3.71 7.23 51 LOTS_OF_MONEY 19822 7.17 8.11 6.88 52 XMSexyCombo_05 17164 6.52 8.39 5.96 53 T_TooManySym_01 16466 4.90 2.17 5.72 54 BAYES_80 15939 6.93 11.57 5.53 55 XM_H_Long_From01 15741 5.14 4.05 5.47 56 XMSubMetaSx_00 15499 5.59 6.26 5.38 57 RELAYCOUNTRY_META 15492 14.80 45.98 5.38 58 XMStrtUSub 15272 4.67 2.55 5.30 59 MPART_ALT_DIFF 14375 6.00 9.33 4.99 60 TM2_M_URI_OPT_OUT 12793 3.84 1.85 4.44 61 IN_ZIMBRA_NJ_WHITELIST 12530 3.35 0.05 4.35 62 TR_XM_DK_SendGrid 12527 3.58 1.03 4.35 63 XMNumbers 11952 3.85 2.87 4.15 64 BAYES_40 11382 3.33 1.26 3.95 65 MIME_QP_LONG_LINE 11377 3.20 0.70 3.95 66 FROM_EXCESS_BASE64 10939 7.79 20.99 3.80 67 XM_UncommonTLD01 10732 5.85 12.89 3.73 68 HTML_IMAGE_RATIO_06 10715 3.54 2.95 3.72 69 RCVD_IN_IADB_LISTED 10495 3.02 0.94 3.64 70 MIME_HTML_MOSTLY 9851 4.59 8.45 3.42 71 BAYES_95 9652 4.31 7.47 3.35 72 BAYES_20 9319 2.71 0.95 3.24 73 T_TooManySym_02 9317 2.57 0.37 3.24 74 RCVD_IN_IADB_SPF 9164 2.61 0.71 3.18 75 ANY_BOUNCE_MESSAGE 8682 2.36 0.20 3.01 76 BOUNCE_MESSAGE 8679 2.36 0.20 3.01 77 T_REMOTE_IMAGE 8611 4.28 8.55 2.99 78 HTML_IMAGE_RATIO_08 8335 2.76 2.31 2.89 79 TVD_RCVD_IP 8233 2.34 0.63 2.86 80 TR_XM_PhishingBody 8213 2.87 2.95 2.85 81 RCVD_IN_IADB_SENDERID 8147 2.31 0.61 2.83 82 RCVD_IN_IADB_DK 7891 2.25 0.62 2.74 83 DKIM_INVALID 7636 2.70 2.85 2.65 84 BOTNET 7470 7.34 23.04 2.59 85 CK_HELO_DYNAMIC_SPLIT_IP 7358 2.14 0.77 2.56 86 HELO_MISC_IP 7357 2.08 0.51 2.55 87 T_XMDrugObfuBody_14 7294 2.41 2.01 2.53 88 INVALID_MSGID 7290 2.15 0.87 2.53 89 MIME_HTML_ONLY_MULTI 6883 2.08 1.07 2.39 90 RELAYCOUNTRY_CA 6869 3.66 7.88 2.39 91 UNTRUSTED_Relay 6744 8.09 27.12 2.34 92 RCVD_IN_IADB_VOUCHED 6524 1.87 0.58 2.27 93 XMBody_17 6206 2.64 4.27 2.16 94 XM_CamelCaseFrm001 6143 2.31 2.90 2.13 95 TO_MALFORMED 6074 1.64 0.08 2.11 96 XMDiploma_00 5734 1.79 1.13 1.99 97 BAYES_05 5700 1.64 0.54 1.98 98 XM_PDF 5681 1.60 0.38 1.97 99 URI_TRY_3LD 5477 1.79 1.42 1.90 100 MAILING_LIST_MULTI 5355 1.59 0.71 1.86 101 HTML_MIME_NO_HTML_TAG 5166 9.98 37.06 1.79 102 XMSexyCombo_01 5051 1.98 2.72 1.75 103 URI_HEX 5032 2.02 2.94 1.75 104 XMBdyGiftCard01 5025 1.69 1.50 1.74 105 XM_DK_Undo_01 4880 1.45 0.64 1.69 106 XM_B_SpammyTLD 4876 2.12 3.53 1.69 107 URI_NOVOWEL 4750 1.49 0.95 1.65 108 USER_IN_DEF_DKIM_WL 4689 1.25 0.00 1.63 109 TR_Symld_Words 4606 1.47 1.06 1.60 110 XMGappySubj_01 4595 1.25 0.12 1.60 111 XMStockSpam_06 4559 1.44 0.95 1.58 112 T_XMDrugObfuBody_08 4529 1.63 1.83 1.57 113 LH_URI_DOM_IN_PATH 4521 1.75 2.34 1.57 114 IN_HORDE_ADDRESS_BOOK 4479 1.23 0.14 1.56 115 RCVD_IN_IADB_OPTIN 4357 1.26 0.43 1.51 116 RCVD_IN_MSPIKE_H5 4349 1.21 0.23 1.51 117 TR_XM_SB_Phish 4227 1.41 1.23 1.47 118 T_TooManySym_03 4194 1.15 0.15 1.46 119 XMSubPhish11 4174 1.38 1.13 1.45 120 TM2_M_VERY_LONG_WORD 3958 1.45 1.71 1.37 121 RCVD_IN_MSPIKE_BL 3915 3.04 8.59 1.36 122 SUBJ_ALL_CAPS 3885 1.33 1.26 1.35 123 XM_OfRef6 3719 1.51 2.24 1.29 124 XMGenDplmaNmb 3691 1.16 0.75 1.28 125 XMBrknScrpt_02 3637 1.63 2.83 1.26 126 TooManyTo_002 3554 1.04 0.40 1.23 127 RCVD_IN_BL_SPAMCOP_NET 3499 10.34 40.56 1.22 128 TR_MSPIKEBAYES00 3348 0.90 0.04 1.16 129 XM_B_Phish66 3347 1.23 1.47 1.16 130 XM_H_Long_From02 3333 0.99 0.42 1.16 131 XM_B_Unsub2 3325 1.12 1.02 1.15 132 XM_SPF_SoftFail 3258 1.71 3.64 1.13 133 XM_RXBody 3256 0.94 0.31 1.13 134 XMSexyCombo_04 3247 1.28 1.79 1.13 135 XM_GoogleGroups 3246 0.92 0.25 1.13 136 XM_UB50 3052 2.69 8.08 1.06 137 DKIM_ADSP_CUSTOM_MED 3034 1.14 1.40 1.05 138 XMHTML_After_End 2922 0.97 0.80 1.01 139 XM_ProductURIs 2819 0.86 0.45 0.98 140 T_XMHurry_00 2807 1.19 1.92 0.97 141 RCVD_IN_MSPIKE_L3 2783 1.88 4.91 0.97 142 T_XMDrugObfuBody_00 2698 1.10 1.66 0.94 143 XM_B_COVIDMETA 2629 1.33 2.70 0.91 144 TR_LOTS_OF_MONEY3 2538 1.03 1.53 0.88 145 TooManyTo_003 2528 0.74 0.30 0.88 146 DKIM_ADSP_NXDOMAIN 2525 0.93 1.11 0.88 147 KHOP_HELO_FCRDNS 2512 1.96 5.55 0.87 148 HTML_FONT_FACE_BAD 2486 0.78 0.52 0.86 149 T_TooManySym_04 2468 0.67 0.03 0.86 150 TR_MetaPhish_Combo_01 2457 0.80 0.64 0.85 151 XMBody_95 2397 0.66 0.07 0.83 152 XM_B_SpammyWords4 2328 0.90 1.19 0.81 153 DIET_1 2298 0.88 1.15 0.80 154 XMSubNoVowel 2295 0.97 1.53 0.80 155 XM_S_SubURI 2237 0.60 0.03 0.78 156 NO_DNS_FOR_FROM 2230 0.85 1.11 0.77 157 NML_ADSP_CUSTOM_MED 2202 0.90 1.34 0.76 158 RDNS_DYNAMIC 2192 0.92 1.44 0.76 159 XMPhish08 2151 0.66 0.39 0.75 160 XM_B_REG_HTML 2110 0.61 0.21 0.73 161 XM_B_COPY_HTML 2004 0.62 0.38 0.70 162 TooManyTo_004 1982 0.59 0.26 0.69 163 T_TooManySym_05 1956 0.52 0.00 0.68 164 T_MANY_PILL_PRICE 1940 0.52 0.00 0.67 165 XMBody_78 1924 0.61 0.40 0.67 166 XMHTMLBadTable_001 1922 0.57 0.25 0.67 167 BASE64_LENGTH_79_INF 1901 0.67 0.68 0.66 168 USER_IN_WHITELIST 1862 0.50 0.00 0.65 169 USER_IN_WELCOMELIST 1862 0.50 0.00 0.65 170 RELAYCOUNTRY_GB 1847 2.69 9.48 0.64 171 XM_ShortIntro_01 1816 0.55 0.29 0.63 172 NUMERIC_HTTP_ADDR 1801 0.63 0.63 0.63 173 XMSubMetaSxObfu_02 1724 0.55 0.40 0.60 174 TooManyTo_005 1719 0.51 0.24 0.60 175 TR_BOTNET_NEGATE 1717 0.59 0.56 0.60 176 T_FILL_THIS_FORM_SHORT 1715 0.67 0.91 0.60 177 XMSubMetaI_00 1707 0.56 0.45 0.59 178 HTTPS_HTTP_MISMATCH 1648 0.51 0.30 0.57 179 XMSolicitRefs_0 1645 0.53 0.39 0.57 180 XM_DIRTYINTL 1634 1.52 4.67 0.57 181 XMPhish30 1607 0.60 0.75 0.56 182 HTML_TAG_BALANCE_BODY 1606 0.53 0.44 0.56 183 SpammyFromTLD_01 1605 1.79 5.89 0.56 184 THIS_AD 1602 0.49 0.26 0.56 185 XMLngstWrd_00 1573 0.50 0.34 0.55 186 MPART_ALT_DIFF_COUNT 1562 0.57 0.67 0.54 187 TR_XM_UnparsRelay 1559 0.86 1.90 0.54 188 PLING_QUERY 1548 0.46 0.19 0.54 189 XMSubEmpty 1502 0.50 0.43 0.52 190 FORGED_GMAIL_RCVD 1479 0.66 1.13 0.51 191 XMLngstWrd_01 1446 0.46 0.33 0.50 192 HELO_NODOT 1445 0.52 0.59 0.50 193 HELO_NO_DOMAIN 1444 0.52 0.59 0.50 194 XM_H_PHPMailer 1440 0.56 0.77 0.50 195 RELAYCOUNTRY_DE 1376 0.55 0.79 0.48 196 URIBL_SBL_A 1351 1.00 2.76 0.47 197 SUBJ_DOLLARS 1344 0.43 0.31 0.47 198 HTML_IMAGE_ONLY_32 1295 0.40 0.25 0.45 199 XM_H_Trusted_IP 1245 0.33 0.00 0.43 200 T_Symld_Words_02 1238 0.45 0.50 0.43 ----------------------------------------------------------------------