Email: 379441 Autolearn: 0 AvgScore: 4.00 AvgScanTime: 1.26 sec Spam: 119734 Autolearn: 0 AvgScore: 13.86 AvgScanTime: 1.40 sec Ham: 259707 Autolearn: 0 AvgScore: -0.55 AvgScanTime: 1.20 sec Time Spent Running SA: 132.99 hours Time Spent Processing Spam: 46.51 hours Time Spent Processing Ham: 86.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 103351 86.79 86.32 87.01 2 XM_B_Unicode 96600 76.46 80.68 74.51 3 DKIM_SIGNED 96008 81.36 80.18 81.90 4 XM_DK_Pass 93217 80.01 77.85 81.01 5 RELAYCOUNTRY_US 92728 80.66 77.45 82.14 6 DKIM_VALID 91812 78.34 76.68 79.10 7 DCC_CHECK 87667 55.17 73.22 46.85 8 XM_B_SpammyWords 86928 57.38 72.60 50.36 9 XMListUnsubscribeExists 85195 62.52 71.15 58.54 10 DKIM_VALID_AU 72777 63.39 60.78 64.59 11 XM_DK_Undo_02 52463 21.45 43.82 11.14 12 XM_B_SpammyWords2 49273 29.95 41.15 24.78 13 BAYES_50 45261 48.23 37.80 53.03 14 XM_B_Unicode3 43444 42.99 36.28 46.08 15 HTML_FONT_LOW_CONTRAST 41236 34.13 34.44 33.99 16 BAYES_99 41091 16.02 34.32 7.58 17 LOC_TINY_FONT_1 40730 31.42 34.02 30.22 18 DKIM_VALID_EF 33025 29.53 27.58 30.43 19 RCVD_IN_MSPIKE_H2 32602 27.48 27.23 27.60 20 TR_DCC_Bayes_99 32227 11.54 26.92 4.46 21 BAYES_999 32004 12.73 26.73 6.27 22 DCC_CHECK_NEGATIVE 30173 43.50 25.20 51.94 23 XM_Multi_Part_URI 30106 18.02 25.14 14.73 24 T_TM2_M_HEADER_IN_MSG 29798 23.28 24.89 22.54 25 BOTNET 29052 9.31 24.26 2.42 26 MIME_HTML_ONLY 28213 23.13 23.56 22.93 27 RELAYCOUNTRY_META 28017 10.81 23.40 5.01 28 FVGT_m_MULTI_ODD 27749 23.36 23.18 23.44 29 XMSubLong 27001 21.96 22.55 21.69 30 T_KAM_HTML_FONT_INVALID 26656 18.63 22.26 16.96 31 LOTS_OF_MONEY 23062 10.39 19.26 6.29 32 XM_Body_Dirty_Words 22817 15.53 19.06 13.91 33 RCVD_IN_MSPIKE_BL 21826 6.33 18.23 0.84 34 RCVD_IN_MSPIKE_WL 18896 26.81 15.78 31.89 35 TR_XM_SpammyWords2 18885 6.97 15.77 2.91 36 UNTRUSTED_Relay 17071 6.19 14.26 2.47 37 RCVD_IN_RP_RNBL 16679 4.50 13.93 0.15 38 XM_UncommonTLD01 16674 7.18 13.93 4.08 39 XM_B_SpammyWords3 15035 8.20 12.56 6.19 40 XM_B_Phish_Phrases 14706 8.65 12.28 6.97 41 RCVD_IN_PSBL 14578 3.89 12.18 0.06 42 RCVD_IN_MSPIKE_L5 14552 3.95 12.15 0.17 43 BOTNET_IPINHOSTNAME 14361 8.24 11.99 6.52 44 TR_XM_SpammyWords3 14065 4.08 11.75 0.55 45 LotsOfNums_01 13242 9.70 11.06 9.07 46 XMSexyCombo_05 12704 6.91 10.61 5.20 47 MPART_ALT_DIFF 12167 6.53 10.16 4.86 48 BAYES_80 11167 6.33 9.33 4.95 49 DATE_IN_PAST_03_06 10965 2.94 9.16 0.08 50 BOUNCE_MESSAGE 10921 4.96 9.12 3.04 51 ANY_BOUNCE_MESSAGE 10921 4.96 9.12 3.04 52 XM_Lotto 10889 2.90 9.09 0.04 53 XM_Evil_Numbers_Gen 10506 9.00 8.77 9.10 54 XM_B_Unsub 10407 9.97 8.69 10.56 55 RCVD_IN_MSPIKE_H3 10218 14.26 8.53 16.91 56 MIME_HTML_MOSTLY 10133 4.83 8.46 3.16 57 HTML_IMAGE_RATIO_02 10121 8.71 8.45 8.83 58 RCVD_IN_BL_SPAMCOP_NET 9475 3.39 7.91 1.30 59 FSL_BULK_SIG 9440 6.12 7.88 5.30 60 TR_XM_COVIDMETA4 9030 2.54 7.54 0.23 61 XMBrknScrpt_02 8944 3.32 7.47 1.40 62 RELAYCOUNTRY_CA 8934 3.78 7.46 2.09 63 SpammyFromTLD_01 8593 2.69 7.18 0.62 64 BAYES_60 8391 7.82 7.01 8.19 65 RCVD_IN_MSPIKE_H4 7940 10.98 6.63 12.98 66 XMSubMetaSx_00 7834 5.14 6.54 4.49 67 XM_OfRef6 7352 3.01 6.14 1.57 68 TooManyTo_001 7056 6.58 5.89 6.90 69 BAYES_95 6864 3.88 5.73 3.02 70 XMBody_17 6635 2.51 5.54 1.11 71 RCVD_IN_MSPIKE_L3 6478 2.15 5.41 0.64 72 XM_UB50 6344 2.44 5.30 1.12 73 UNPARSEABLE_RELAY 6167 8.02 5.15 9.34 74 HTML_IMAGE_RATIO_04 6126 6.05 5.12 6.48 75 RELAYCOUNTRY_FR 6118 1.75 5.11 0.21 76 TR_XM_PhishingBody 5737 3.37 4.79 2.71 77 URIBL_SBL_A 5685 1.61 4.75 0.17 78 XM_B_SpammyTLD 5680 2.76 4.74 1.85 79 TR_LOTS_OF_MONEY3 5624 2.07 4.70 0.87 80 URI_PHP_REDIR 5198 1.38 4.34 0.01 81 URI_HEX 5137 2.47 4.29 1.63 82 XM_H_Long_From01 5124 5.57 4.28 6.17 83 XM_SPF_SoftFail 5122 2.21 4.28 1.26 84 XM_SendGrid 4797 7.16 4.01 8.61 85 SUBJ_ALL_CAPS 4464 1.97 3.73 1.16 86 T_FONT_INVIS_NAKED_TO 4307 2.72 3.60 2.31 87 DKIM_INVALID 4196 3.02 3.50 2.80 88 XM_DIRTYINTL 4164 1.44 3.48 0.50 89 XMStrtUSub 4075 5.25 3.40 6.10 90 FROM_EXCESS_BASE64 4001 3.68 3.34 3.83 91 XM_UB99 3954 1.05 3.30 0.01 92 T_XMDrugObfuBody_08 3944 2.34 3.29 1.90 93 URI_TRY_3LD 3903 1.89 3.26 1.26 94 SpammyFromTLD_02 3901 1.12 3.26 0.14 95 TR_XM_MaxSPIKE 3886 1.04 3.25 0.03 96 TR_XM_MaxBayes 3758 1.00 3.14 0.01 97 XMNumbers 3743 4.37 3.13 4.94 98 HTML_IMAGE_RATIO_06 3706 3.65 3.10 3.90 99 T_FILL_THIS_FORM_SHORT 3701 1.62 3.09 0.94 100 XM_OfRef7 3573 1.04 2.98 0.15 101 XM_B_COVIDMETA 3493 1.49 2.92 0.83 102 T_XMHurry_00 3467 1.65 2.90 1.07 103 HTML_IMAGE_RATIO_08 3426 2.31 2.86 2.06 104 XM_B_Phish66 3420 1.65 2.86 1.10 105 TM2_M_URI_OPT_OUT 3366 3.29 2.81 3.51 106 RCVD_IN_RP_SAFE 3155 9.14 2.64 12.13 107 T_TooManySym_01 2923 5.25 2.44 6.54 108 BOTNET_NORDNS 2917 0.78 2.44 0.02 109 FILL_THIS_FORM 2862 0.98 2.39 0.33 110 BAYES_40 2745 3.65 2.29 4.27 111 XMSexyCombo_01 2724 1.16 2.28 0.65 112 XM_UB999 2720 0.72 2.27 0.00 113 T_REMOTE_IMAGE 2705 2.62 2.26 2.79 114 MIME_HTML_ONLY_MULTI 2692 2.55 2.25 2.68 115 T_FILL_THIS_FORM_LONG 2674 0.90 2.23 0.28 116 TR_XM_UnparsRelay 2521 1.11 2.11 0.65 117 ADVANCE_FEE_2_NEW_FORM 2491 0.66 2.08 0.00 118 FORM_FRAUD 2451 0.65 2.05 0.00 119 RCVD_IN_RP_CERTIFIED 2427 8.29 2.03 11.18 120 KHOP_HELO_FCRDNS 2371 1.48 1.98 1.25 121 XM_CamelCaseFrm001 2346 1.97 1.96 1.98 122 HTML_IMAGE_ONLY_12 2318 0.70 1.94 0.14 123 TM2_M_VERY_LONG_WORD 2311 1.48 1.93 1.27 124 TR_XM_DK_SendGrid 2276 4.29 1.90 5.39 125 LOW_PRICE 2258 0.78 1.89 0.27 126 TR_Mismatch_TLD_02 2238 0.63 1.87 0.06 127 XMDiploma_00 2197 1.65 1.83 1.57 128 XM_UB60 2172 0.64 1.81 0.09 129 TR_XM_PHPDW 2156 0.94 1.80 0.54 130 TR_XM_PHPForged 2116 0.91 1.77 0.52 131 TR_XM_FormFill2 2112 0.91 1.76 0.52 132 XM_H_PHPOS 2111 0.91 1.76 0.51 133 XM_URI_RBL 2111 0.70 1.76 0.21 134 LH_URI_DOM_IN_PATH 2106 1.55 1.76 1.45 135 BAYES_20 2056 2.70 1.72 3.15 136 T_LONG_INVISIBLE_TEXT 2029 1.12 1.69 0.85 137 XMBdyGiftCard01 2026 1.68 1.69 1.67 138 ADVANCE_FEE_3_NEW_MONEY 2023 0.53 1.69 0.00 139 XM_UB80 1987 0.54 1.66 0.03 140 TR_XM_SB_Phish 1955 1.59 1.63 1.58 141 FROM_SUSPICIOUS_NTLD 1952 0.59 1.63 0.12 142 FROM_SUSPICIOUS_NTLD_FP 1888 0.57 1.58 0.10 143 MIME_QP_LONG_LINE 1883 3.36 1.57 4.18 144 XMSubPhish11 1881 1.55 1.57 1.54 145 XM_B_SpammyWords4 1857 0.93 1.55 0.64 146 T_PDS_OTHER_BAD_TLD 1822 0.82 1.52 0.50 147 IMG_ONLY_FM_DOM_INFO 1814 0.48 1.52 0.00 148 XMSubNoVowel 1794 0.69 1.50 0.32 149 T_XMDrugObfuBody_00 1788 0.94 1.49 0.69 150 HTML_MIME_NO_HTML_TAG 1785 1.88 1.49 2.07 151 XMSexyCombo_04 1743 0.67 1.46 0.30 152 XMSubMetaSxObfu_03 1724 0.70 1.44 0.37 153 TR_XM_RelayPhish 1717 0.53 1.43 0.12 154 TR_Caps_n_Bayes_99 1662 0.46 1.39 0.03 155 XM_B_Unsub2 1648 1.52 1.38 1.58 156 XMStockSpam_06 1571 1.02 1.31 0.88 157 XM_UB95 1540 0.41 1.29 0.01 158 RELAYCOUNTRY_NL 1511 0.61 1.26 0.31 159 MIME_CHARSET_FARAWAY 1507 0.51 1.26 0.17 160 URI_NO_WWW_BIZ_CGI 1496 0.40 1.25 0.01 161 XMSubMetaSSx_00 1466 0.46 1.22 0.10 162 RELAYCOUNTRY_IN 1448 0.42 1.21 0.06 163 RCVD_IN_IADB_LISTED 1431 2.85 1.20 3.62 164 T_XMDrugObfuBody_14 1418 1.38 1.18 1.47 165 HK_RANDOM_REPLYTO 1394 0.54 1.16 0.25 166 RELAYCOUNTRY_GB 1388 0.78 1.16 0.60 167 BAYES_05 1350 1.75 1.13 2.03 168 URI_NOVOWEL 1346 1.50 1.12 1.67 169 XMGenDplmaNmb 1319 0.92 1.10 0.83 170 CHARSET_FARAWAY_HEADER 1291 0.40 1.08 0.09 171 XMPhish30 1273 0.70 1.06 0.53 172 RELAYCOUNTRY_DE 1272 0.57 1.06 0.34 173 XM_DK_Undo_01 1254 1.50 1.05 1.71 174 TR_Symld_Words 1246 1.94 1.04 2.36 175 RCVD_IN_IADB_SPF 1213 2.53 1.01 3.22 176 TR_Mismatch_TLD_01 1195 0.56 1.00 0.35 177 TR_XM_INV_DKIM 1186 0.38 0.99 0.09 178 RDNS_DYNAMIC 1163 0.90 0.97 0.86 179 DIET_1 1152 0.73 0.96 0.62 180 RCVD_IN_IADB_SENDERID 1138 2.33 0.95 2.96 181 RCVD_IN_IADB_DK 1119 2.26 0.93 2.88 182 XMBody_78 1108 0.62 0.93 0.48 183 XMHTML_After_End 1104 0.75 0.92 0.66 184 XMSlimDrugH 1087 0.55 0.91 0.38 185 XMSubMetaI_00 1075 0.85 0.90 0.82 186 DKIM_ADSP_CUSTOM_MED 1064 1.23 0.89 1.39 187 INVESTMENT_ADVICE 1041 0.33 0.87 0.08 188 HTML_FONT_SIZE_HUGE 1027 0.42 0.86 0.22 189 TR_XM_COVIDMETA1 1021 0.38 0.85 0.16 190 MPART_ALT_DIFF_COUNT 1018 0.60 0.85 0.49 191 TR_XM_FormFill 1016 0.27 0.85 0.01 192 XM_BadFromFormat 1013 0.47 0.85 0.29 193 FROM_MISSP_REPLYTO 999 0.27 0.83 0.01 194 NML_ADSP_CUSTOM_MED 996 0.95 0.83 1.00 195 ALL_TRUSTED 996 9.41 0.83 13.37 196 XMReplyNow 984 0.38 0.82 0.17 197 FORGED_GMAIL_RCVD 957 0.64 0.80 0.57 198 DKIM_ADSP_NXDOMAIN 952 0.96 0.80 1.03 199 NO_DNS_FOR_FROM 903 0.92 0.75 0.99 200 XMGppyBdWords 888 0.31 0.74 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 225984 86.79 86.32 87.01 2 RELAYCOUNTRY_US 213321 80.66 77.45 82.14 3 DKIM_SIGNED 212710 81.36 80.18 81.90 4 XM_DK_Pass 210385 80.01 77.85 81.01 5 DKIM_VALID 205440 78.34 76.68 79.10 6 XM_B_Unicode 193517 76.46 80.68 74.51 7 DKIM_VALID_AU 167741 63.39 60.78 64.59 8 XMListUnsubscribeExists 152034 62.52 71.15 58.54 9 BAYES_50 137725 48.23 37.80 53.03 10 DCC_CHECK_NEGATIVE 134887 43.50 25.20 51.94 11 XM_B_SpammyWords 130799 57.38 72.60 50.36 12 DCC_CHECK 121663 55.17 73.22 46.85 13 XM_B_Unicode3 119666 42.99 36.28 46.08 14 HTML_FONT_LOW_CONTRAST 88281 34.13 34.44 33.99 15 RCVD_IN_MSPIKE_WL 82823 26.81 15.78 31.89 16 DKIM_VALID_EF 79031 29.53 27.58 30.43 17 LOC_TINY_FONT_1 78477 31.42 34.02 30.22 18 RCVD_IN_MSPIKE_H2 71681 27.48 27.23 27.60 19 XM_B_SpammyWords2 64352 29.95 41.15 24.78 20 FVGT_m_MULTI_ODD 60875 23.36 23.18 23.44 21 MIME_HTML_ONLY 59545 23.13 23.56 22.93 22 T_TM2_M_HEADER_IN_MSG 58543 23.28 24.89 22.54 23 XMSubLong 56323 21.96 22.55 21.69 24 T_KAM_HTML_FONT_INVALID 44034 18.63 22.26 16.96 25 RCVD_IN_MSPIKE_H3 43905 14.26 8.53 16.91 26 XM_Multi_Part_URI 38266 18.02 25.14 14.73 27 XM_Body_Dirty_Words 36127 15.53 19.06 13.91 28 BAYES_00 35732 9.63 0.67 13.76 29 ALL_TRUSTED 34723 9.41 0.83 13.37 30 RCVD_IN_MSPIKE_H4 33716 10.98 6.63 12.98 31 RCVD_IN_RP_SAFE 31514 9.14 2.64 12.13 32 RCVD_IN_RP_CERTIFIED 29043 8.29 2.03 11.18 33 XM_DK_Undo_02 28922 21.45 43.82 11.14 34 TR_XM_DK_Bayes 28373 7.61 0.41 10.93 35 XM_DKIMWhitelistDomains 28035 7.39 0.00 10.79 36 TR_XM_DK_Bayes1 27701 7.42 0.39 10.67 37 XM_B_Unsub 27427 9.97 8.69 10.56 38 TR_XM_DK_Bayes2 25747 6.90 0.36 9.91 39 UNPARSEABLE_RELAY 24262 8.02 5.15 9.34 40 XM_Evil_Numbers_Gen 23633 9.00 8.77 9.10 41 LotsOfNums_01 23558 9.70 11.06 9.07 42 HTML_IMAGE_RATIO_02 22923 8.71 8.45 8.83 43 XM_SendGrid 22355 7.16 4.01 8.61 44 BAYES_60 21278 7.82 7.01 8.19 45 BAYES_99 19696 16.02 34.32 7.58 46 XM_B_Phish_Phrases 18101 8.65 12.28 6.97 47 TooManyTo_001 17925 6.58 5.89 6.90 48 T_TooManySym_01 16995 5.25 2.44 6.54 49 BOTNET_IPINHOSTNAME 16921 8.24 11.99 6.52 50 HTML_IMAGE_RATIO_04 16818 6.05 5.12 6.48 51 LOTS_OF_MONEY 16348 10.39 19.26 6.29 52 BAYES_999 16280 12.73 26.73 6.27 53 XM_B_SpammyWords3 16068 8.20 12.56 6.19 54 XM_H_Long_From01 16023 5.57 4.28 6.17 55 XMStrtUSub 15838 5.25 3.40 6.10 56 TR_XM_DK_SendGrid 14008 4.29 1.90 5.39 57 FSL_BULK_SIG 13774 6.12 7.88 5.30 58 XMSexyCombo_05 13510 6.91 10.61 5.20 59 IN_ZIMBRA_NJ_WHITELIST 13186 3.48 0.03 5.08 60 RELAYCOUNTRY_META 13004 10.81 23.40 5.01 61 BAYES_80 12858 6.33 9.33 4.95 62 XMNumbers 12841 4.37 3.13 4.94 63 MPART_ALT_DIFF 12616 6.53 10.16 4.86 64 XMSubMetaSx_00 11662 5.14 6.54 4.49 65 TR_DCC_Bayes_99 11576 11.54 26.92 4.46 66 BAYES_40 11102 3.65 2.29 4.27 67 MIME_QP_LONG_LINE 10861 3.36 1.57 4.18 68 XM_UncommonTLD01 10588 7.18 13.93 4.08 69 HTML_IMAGE_RATIO_06 10141 3.65 3.10 3.90 70 FROM_EXCESS_BASE64 9949 3.68 3.34 3.83 71 RCVD_IN_IADB_LISTED 9397 2.85 1.20 3.62 72 T_TooManySym_02 9362 2.70 0.73 3.60 73 TM2_M_URI_OPT_OUT 9126 3.29 2.81 3.51 74 RCVD_IN_IADB_SPF 8373 2.53 1.01 3.22 75 MIME_HTML_MOSTLY 8199 4.83 8.46 3.16 76 BAYES_20 8186 2.70 1.72 3.15 77 ANY_BOUNCE_MESSAGE 7891 4.96 9.12 3.04 78 BOUNCE_MESSAGE 7888 4.96 9.12 3.04 79 BAYES_95 7849 3.88 5.73 3.02 80 TVD_RCVD_IP 7693 2.09 0.21 2.96 81 RCVD_IN_IADB_SENDERID 7691 2.33 0.95 2.96 82 TR_XM_SpammyWords2 7559 6.97 15.77 2.91 83 RCVD_IN_IADB_DK 7473 2.26 0.93 2.88 84 INVALID_MSGID 7373 2.09 0.46 2.84 85 DKIM_INVALID 7270 3.02 3.50 2.80 86 T_REMOTE_IMAGE 7255 2.62 2.26 2.79 87 TR_XM_PhishingBody 7042 3.37 4.79 2.71 88 MIME_HTML_ONLY_MULTI 6966 2.55 2.25 2.68 89 TO_MALFORMED 6557 1.73 0.02 2.52 90 UNTRUSTED_Relay 6425 6.19 14.26 2.47 91 BOTNET 6284 9.31 24.26 2.42 92 HELO_MISC_IP 6125 1.75 0.44 2.36 93 TR_Symld_Words 6123 1.94 1.04 2.36 94 CK_HELO_DYNAMIC_SPLIT_IP 6079 1.76 0.51 2.34 95 T_FONT_INVIS_NAKED_TO 6008 2.72 3.60 2.31 96 XM_PDF 5830 1.72 0.59 2.24 97 RELAYCOUNTRY_CA 5415 3.78 7.46 2.09 98 RCVD_IN_IADB_VOUCHED 5408 1.60 0.54 2.08 99 HTML_MIME_NO_HTML_TAG 5367 1.88 1.49 2.07 100 HTML_IMAGE_RATIO_08 5348 2.31 2.86 2.06 101 BAYES_05 5278 1.75 1.13 2.03 102 RCVD_IN_MSPIKE_H5 5202 1.57 0.62 2.00 103 XM_CamelCaseFrm001 5134 1.97 1.96 1.98 104 MAILING_LIST_MULTI 5000 1.55 0.73 1.93 105 XMBSHREFv2 4984 1.38 0.23 1.92 106 T_XMDrugObfuBody_08 4940 2.34 3.29 1.90 107 XM_B_SpammyTLD 4809 2.76 4.74 1.85 108 IN_HORDE_ADDRESS_BOOK 4767 1.28 0.08 1.84 109 XMGappySubj_01 4708 1.34 0.31 1.81 110 XM_DK_Undo_01 4430 1.50 1.05 1.71 111 URI_NOVOWEL 4340 1.50 1.12 1.67 112 XMBdyGiftCard01 4330 1.68 1.69 1.67 113 USER_IN_DEF_DKIM_WL 4265 1.13 0.01 1.64 114 URI_HEX 4225 2.47 4.29 1.63 115 T_TooManySym_03 4179 1.15 0.15 1.61 116 XM_B_Unsub2 4115 1.52 1.38 1.58 117 TR_XM_SB_Phish 4097 1.59 1.63 1.58 118 XM_OfRef6 4075 3.01 6.14 1.57 119 XMDiploma_00 4067 1.65 1.83 1.57 120 XMSubPhish11 4004 1.55 1.57 1.54 121 T_XMDrugObfuBody_14 3810 1.38 1.18 1.47 122 LH_URI_DOM_IN_PATH 3766 1.55 1.76 1.45 123 XMBrknScrpt_02 3638 3.32 7.47 1.40 124 TooManyTo_002 3619 1.09 0.43 1.39 125 DKIM_ADSP_CUSTOM_MED 3610 1.23 0.89 1.39 126 RCVD_IN_BL_SPAMCOP_NET 3383 3.39 7.91 1.30 127 RCVD_IN_IADB_OPTIN 3368 1.02 0.41 1.30 128 TM2_M_VERY_LONG_WORD 3306 1.48 1.93 1.27 129 URI_TRY_3LD 3282 1.89 3.26 1.26 130 XM_SPF_SoftFail 3266 2.21 4.28 1.26 131 KHOP_HELO_FCRDNS 3249 1.48 1.98 1.25 132 XM_H_Long_From02 3027 0.98 0.58 1.17 133 SUBJ_ALL_CAPS 3020 1.97 3.73 1.16 134 XM_GoogleGroups 2956 0.88 0.32 1.14 135 XM_UB50 2899 2.44 5.30 1.12 136 TR_MSPIKEBAYES00 2882 0.77 0.03 1.11 137 XMBody_17 2875 2.51 5.54 1.11 138 XM_B_Phish66 2858 1.65 2.86 1.10 139 T_XMHurry_00 2789 1.65 2.90 1.07 140 TooManyTo_003 2722 0.81 0.31 1.05 141 DKIM_ADSP_NXDOMAIN 2680 0.96 0.80 1.03 142 NML_ADSP_CUSTOM_MED 2608 0.95 0.83 1.00 143 NO_DNS_FOR_FROM 2572 0.92 0.75 0.99 144 T_FILL_THIS_FORM_SHORT 2433 1.62 3.09 0.94 145 T_TooManySym_04 2423 0.65 0.04 0.93 146 HTML_FONT_FACE_BAD 2364 0.82 0.63 0.91 147 XMStockSpam_06 2294 1.02 1.31 0.88 148 XM_S_SubURI 2267 0.61 0.04 0.87 149 TR_LOTS_OF_MONEY3 2247 2.07 4.70 0.87 150 RDNS_DYNAMIC 2239 0.90 0.97 0.86 151 XM_ProductURIs 2232 0.77 0.59 0.86 152 XMBody_95 2224 0.61 0.09 0.86 153 T_LONG_INVISIBLE_TEXT 2211 1.12 1.69 0.85 154 TooManyTo_004 2185 0.66 0.27 0.84 155 RCVD_IN_MSPIKE_BL 2180 6.33 18.23 0.84 156 XMGenDplmaNmb 2166 0.92 1.10 0.83 157 XM_B_COVIDMETA 2162 1.49 2.92 0.83 158 XMSubMetaI_00 2137 0.85 0.90 0.82 159 NUMERIC_HTTP_ADDR 2031 0.67 0.43 0.78 160 XMPhish08 1982 0.68 0.49 0.76 161 T_TooManySym_05 1923 0.51 0.01 0.74 162 XMHTMLBadTable_001 1866 0.62 0.41 0.72 163 XMLngstWrd_00 1840 0.69 0.67 0.71 164 T_XMDrugObfuBody_00 1784 0.94 1.49 0.69 165 TR_MetaPhish_Combo_01 1755 0.69 0.72 0.68 166 XMHTML_After_End 1725 0.75 0.92 0.66 167 XM_B_COPY_HTML 1713 0.64 0.59 0.66 168 TR_XM_UnparsRelay 1700 1.11 2.11 0.65 169 XMSexyCombo_01 1694 1.16 2.28 0.65 170 USER_IN_WHITELIST 1681 0.44 0.00 0.65 171 USER_IN_WELCOMELIST 1681 0.44 0.00 0.65 172 PLING_QUERY 1677 0.58 0.45 0.65 173 XM_ShortIntro_01 1676 0.54 0.32 0.65 174 RCVD_IN_MSPIKE_L3 1671 2.15 5.41 0.64 175 TooManyTo_005 1661 0.50 0.21 0.64 176 XM_B_SpammyWords4 1655 0.93 1.55 0.64 177 DIET_1 1618 0.73 0.96 0.62 178 SpammyFromTLD_01 1614 2.69 7.18 0.62 179 XMLngstWrd_01 1606 0.63 0.65 0.62 180 XM_B_REG_HTML 1600 0.55 0.42 0.62 181 XM_S_SpammyWords 1568 0.51 0.30 0.60 182 TR_XM_Spammywords 1568 0.51 0.30 0.60 183 RELAYCOUNTRY_GB 1561 0.78 1.16 0.60 184 HTML_TAG_BALANCE_BODY 1560 0.58 0.55 0.60 185 FORGED_GMAIL_RCVD 1486 0.64 0.80 0.57 186 TR_BOTNET_NEGATE 1435 0.60 0.71 0.55 187 TR_XM_SpammyWords3 1431 4.08 11.75 0.55 188 XM_H_PHPMailer 1426 0.57 0.61 0.55 189 HELO_NODOT 1424 0.50 0.39 0.55 190 HELO_NO_DOMAIN 1423 0.50 0.39 0.55 191 HTML_IMAGE_ONLY_20 1418 0.43 0.18 0.55 192 TR_XM_PHPDW 1403 0.94 1.80 0.54 193 HTTPS_HTTP_MISMATCH 1382 0.51 0.47 0.53 194 XMPhish30 1370 0.70 1.06 0.53 195 XMLngstWrd_02 1354 0.53 0.56 0.52 196 TR_XM_FormFill2 1352 0.91 1.76 0.52 197 TR_XM_PHPForged 1349 0.91 1.77 0.52 198 XM_H_PHPOS 1337 0.91 1.76 0.51 199 XMNoVowels 1310 0.41 0.22 0.50 200 XMSubMetaSxObfu_02 1306 0.39 0.16 0.50 ----------------------------------------------------------------------