Email: 445760 Autolearn: 0 AvgScore: 4.29 AvgScanTime: 1.38 sec Spam: 154765 Autolearn: 0 AvgScore: 14.17 AvgScanTime: 1.67 sec Ham: 290995 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 1.22 sec Time Spent Running SA: 170.43 hours Time Spent Processing Spam: 71.89 hours Time Spent Processing Ham: 98.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149169 90.87 96.38 87.94 2 DKIM_SIGNED 133870 81.85 86.50 79.38 3 XM_DK_Pass 130421 80.28 84.27 78.15 4 DKIM_VALID 127915 78.56 82.65 76.38 5 DCC_CHECK 124733 56.52 80.60 43.71 6 XM_B_Unicode 118245 73.98 76.40 72.69 7 RELAYCOUNTRY_US 114757 80.14 74.15 83.33 8 XMListUnsubscribeExists 111092 61.56 71.78 56.12 9 XM_B_SpammyWords 105285 52.47 68.03 44.20 10 DKIM_VALID_AU 99887 61.36 64.54 59.67 11 XM_DK_Undo_02 82262 25.33 53.15 10.54 12 TR_XM_DKIM_Undo 65354 18.38 42.23 5.70 13 XM_B_Unicode3 65116 44.93 42.07 46.45 14 BAYES_99 61463 19.08 39.71 8.10 15 LOC_TINY_FONT_1 58904 32.09 38.06 28.91 16 XM_B_SpammyWords2 58798 25.74 37.99 19.23 17 BAYES_50 54347 47.92 35.12 54.73 18 HTML_FONT_LOW_CONTRAST 50955 31.27 32.92 30.39 19 BAYES_999 50314 15.60 32.51 6.60 20 MIME_HTML_ONLY 49405 25.69 31.92 22.37 21 TR_DCC_Bayes_99 48977 13.23 31.65 3.43 22 RCVD_IN_MSPIKE_H2 47904 28.97 30.95 27.92 23 DKIM_VALID_EF 46503 30.29 30.05 30.42 24 FVGT_m_MULTI_ODD 42982 26.70 27.77 26.13 25 T_KAM_HTML_FONT_INVALID 40734 22.41 26.32 20.33 26 XMSubLong 37503 22.22 24.23 21.14 27 RELAYCOUNTRY_META 36066 10.96 23.30 4.40 28 RCVD_IN_MSPIKE_WL 34143 28.88 22.06 32.50 29 T_TM2_M_HEADER_IN_MSG 30496 22.41 19.70 23.85 30 XM_Body_Dirty_Words 29711 14.88 19.20 12.59 31 DCC_CHECK_NEGATIVE 27033 41.78 17.47 54.71 32 UNTRUSTED_Relay 26267 7.21 16.97 2.02 33 XM_UncommonTLD01 24986 8.07 16.14 3.77 34 BOTNET 24346 6.71 15.73 1.92 35 XM_Multi_Part_URI 23437 13.63 15.14 12.82 36 TR_XM_SpammyWords2 22187 5.74 14.34 1.17 37 LOTS_OF_MONEY 19957 8.41 12.90 6.03 38 FSL_BULK_SIG 19934 8.44 12.88 6.08 39 XM_B_SpammyWords3 19921 7.54 12.87 4.71 40 RCVD_IN_MSPIKE_H3 19018 15.55 12.29 17.28 41 RCVD_IN_BL_SPAMCOP_NET 18797 5.28 12.15 1.64 42 TR_XM_SpammyWords4 17718 6.62 11.45 4.05 43 XM_B_Unsub 17714 11.20 11.45 11.06 44 BOTNET_IPINHOSTNAME 17544 7.76 11.34 5.86 45 HTML_IMAGE_RATIO_02 16838 9.27 10.88 8.41 46 XM_Evil_Numbers_Gen 15632 9.73 10.10 9.53 47 MPART_ALT_DIFF 15357 6.35 9.92 4.46 48 SpammyFromTLD_02 14659 3.48 9.47 0.30 49 MIME_HTML_MOSTLY 14375 4.73 9.29 2.31 50 XMSexyCombo_05 14173 6.11 9.16 4.49 51 RCVD_IN_MSPIKE_H4 13975 11.35 9.03 12.58 52 BAYES_60 13397 9.91 8.66 10.57 53 BAYES_80 13185 6.73 8.52 5.78 54 LotsOfNums_01 13127 9.23 8.48 9.62 55 UNPARSEABLE_RELAY 12967 8.51 8.38 8.58 56 TR_XM_UnparsRelay 12731 7.58 8.23 7.24 57 HTML_IMAGE_RATIO_04 11580 7.11 7.48 6.92 58 RELAYCOUNTRY_CA 10944 3.30 7.07 1.29 59 XM_UB50 10690 3.23 6.91 1.27 60 T_REMOTE_IMAGE 10150 4.72 6.56 3.75 61 XM_SendGrid 9986 7.32 6.45 7.78 62 XM_B_Phish_Phrases 9804 5.12 6.33 4.48 63 XM_H_Long_From01 9737 5.74 6.29 5.45 64 XMNumbers 9640 4.19 6.23 3.11 65 TR_XM_PhishingBody 9276 4.20 5.99 3.25 66 KHOP_HELO_FCRDNS 9200 3.11 5.94 1.60 67 TooManyTo_001 9036 6.70 5.84 7.15 68 XMSubMetaSx_00 8469 4.07 5.47 3.33 69 RCVD_IN_RP_SAFE 8141 9.42 5.26 11.64 70 BODY_URI_ONLY 7892 1.77 5.10 0.00 71 HTML_SHORT_LINK_IMG_1 7617 1.72 4.92 0.02 72 HTML_FONT_SIZE_LARGE 7616 1.82 4.92 0.17 73 HTML_IMAGE_ONLY_12 7444 1.77 4.81 0.15 74 BAYES_95 7240 4.00 4.68 3.63 75 XM_DK_Undo_01 7188 2.51 4.64 1.38 76 XMStrtUSub 7188 4.76 4.64 4.82 77 SpammyFromTLD_01 6987 1.94 4.51 0.58 78 RELAYCOUNTRY_FR 6982 1.78 4.51 0.33 79 TR_XM_SpammyWords5 6687 2.54 4.32 1.59 80 XMBdyGiftCard01 6219 2.34 4.02 1.45 81 DKIM_INVALID 5955 3.29 3.85 3.00 82 XM_B_SpammyTLD 5720 2.83 3.70 2.37 83 RCVD_IN_RP_CERTIFIED 5621 8.28 3.63 10.75 84 TR_XM_DK_SendGrid 5594 4.35 3.61 4.74 85 URIBL_DBL_SPAM 5501 1.24 3.55 0.01 86 TR_LOTS_OF_MONEY3 5374 1.39 3.47 0.28 87 URIBL_SBL_A 5348 2.11 3.46 1.40 88 XM_UB99 5303 1.19 3.43 0.01 89 XM_B_Phish66 5174 2.31 3.34 1.76 90 RCVD_IN_MSPIKE_BL 4994 1.18 3.23 0.09 91 XM_OfRef6 4989 1.57 3.22 0.68 92 TR_XM_MSPIKECOMBO 4968 1.17 3.21 0.09 93 FROM_EXCESS_BASE64 4966 3.47 3.21 3.61 94 TM2_M_URI_OPT_OUT 4909 2.79 3.17 2.59 95 XM_SPF_SoftFail 4786 2.23 3.09 1.77 96 HTML_IMAGE_RATIO_06 4696 3.58 3.03 3.86 97 T_FILL_THIS_FORM_SHORT 4692 1.36 3.03 0.47 98 XM_UB60 4621 1.15 2.99 0.18 99 HTML_IMAGE_RATIO_08 4588 2.32 2.96 1.97 100 PDS_OTHER_BAD_TLD 4583 1.56 2.96 0.81 101 XMDiploma_00 4460 1.78 2.88 1.19 102 RELAYCOUNTRY_IN 4331 1.05 2.80 0.11 103 FORGED_GMAIL_RCVD 4319 1.37 2.79 0.62 104 MIME_QP_LONG_LINE 4293 4.45 2.77 5.34 105 RCVD_IN_RP_RNBL 4223 1.00 2.73 0.09 106 XM_UB999 4183 0.94 2.70 0.00 107 XM_DIRTYINTL 4182 1.17 2.70 0.35 108 T_TooManySym_01 4148 4.68 2.68 5.74 109 URI_HEX 4147 1.82 2.68 1.36 110 RCVD_IN_PSBL 4049 0.98 2.62 0.11 111 XMSubMetaI_00 3967 1.24 2.56 0.53 112 URI_PHP_REDIR 3964 0.89 2.56 0.00 113 XM_B_SpammyWords4 3852 1.22 2.49 0.55 114 XMBrknScrpt_02 3675 1.28 2.37 0.70 115 MIME_HTML_ONLY_MULTI 3610 2.37 2.33 2.38 116 XMBody_17 3581 1.12 2.31 0.48 117 XM_CamelCaseFrm001 3518 2.11 2.27 2.03 118 BOTNET_NORDNS 3377 0.77 2.18 0.01 119 URI_TRY_3LD 3345 1.52 2.16 1.18 120 XM_UB80 3308 0.78 2.14 0.06 121 XM_B_Unsub2 3295 1.66 2.13 1.41 122 FROM_SUSPICIOUS_NTLD 3265 0.80 2.11 0.10 123 T_XMDrugObfuBody_14 3259 2.53 2.11 2.75 124 T_XMDrugObfuBody_08 3256 1.63 2.10 1.38 125 RCVD_IN_IADB_LISTED 3247 4.40 2.10 5.62 126 TR_XM_SpammyWords3 3218 0.74 2.08 0.03 127 FROM_SUSPICIOUS_NTLD_FP 3185 0.78 2.06 0.10 128 RCVD_IN_MSPIKE_L5 3142 0.74 2.03 0.06 129 TR_XM_MaxBayes 3118 0.72 2.01 0.03 130 TM2_M_VERY_LONG_WORD 3023 1.58 1.95 1.37 131 TR_XM_BayesRelay 2938 0.67 1.90 0.02 132 TR_XM_SB_Phish 2929 1.89 1.89 1.88 133 GOOGLE_DOC_SUSP 2918 0.66 1.89 0.01 134 RCVD_IN_IADB_SPF 2907 3.87 1.88 4.93 135 SUBJ_ALL_CAPS 2806 1.64 1.81 1.54 136 RCVD_IN_IADB_DK 2747 3.40 1.77 4.27 137 RCVD_IN_IADB_SENDERID 2737 3.50 1.77 4.42 138 XM_B_COVIDMETA 2537 0.97 1.64 0.61 139 TR_XM_INV_DKIM 2519 0.65 1.63 0.13 140 XMGenDplmaNmb 2478 0.92 1.60 0.56 141 URI_NOVOWEL 2436 2.46 1.57 2.93 142 HTML_MIME_NO_HTML_TAG 2432 2.06 1.57 2.32 143 TR_XM_FormFill 2405 0.55 1.55 0.01 144 XMStockSpam_06 2353 1.46 1.52 1.43 145 MAILING_LIST_MULTI 2346 1.90 1.52 2.11 146 URIBL_BLACK 2315 0.54 1.50 0.03 147 LOADSA_MONEY_COMBO 2259 0.53 1.46 0.04 148 TR_XM_PHPDW 2187 0.75 1.41 0.40 149 XFER_LOTSA_MONEY 2162 0.50 1.40 0.02 150 T_XMHurry_00 2154 0.76 1.39 0.43 151 TR_XM_PHPForged 2073 0.67 1.34 0.31 152 TR_XM_FormFill2 2006 0.66 1.30 0.32 153 XM_H_PHPOS 2001 0.65 1.29 0.31 154 XM_H_Long_From02 1958 1.23 1.27 1.21 155 XMSexyCombo_01 1919 0.73 1.24 0.46 156 TR_XM_COVIDMETA1 1889 0.58 1.22 0.24 157 TR_XM_COVIDMETA4 1874 0.60 1.21 0.28 158 XMSubPhish11 1866 1.62 1.21 1.83 159 XM_URI_RBL 1848 0.63 1.19 0.33 160 XMPhish08 1789 0.55 1.16 0.22 161 BAYES_40 1780 2.68 1.15 3.49 162 HK_RANDOM_REPLYTO 1685 0.49 1.09 0.18 163 MPART_ALT_DIFF_COUNT 1681 0.69 1.09 0.48 164 ALL_TRUSTED 1646 8.91 1.06 13.09 165 TR_Mismatch_TLD_02 1617 0.40 1.04 0.06 166 PLING_QUERY 1588 1.07 1.03 1.10 167 SUBJ_DOLLARS 1565 0.53 1.01 0.27 168 XMPhish30 1550 0.91 1.00 0.86 169 HTML_TAG_BALANCE_BODY 1526 0.52 0.99 0.28 170 XM_UB95 1521 0.36 0.98 0.03 171 RELAYCOUNTRY_DE 1509 0.60 0.98 0.40 172 HTTPS_HTTP_MISMATCH 1502 0.71 0.97 0.57 173 TR_XM_RelayPhish 1495 0.40 0.97 0.10 174 T_XMDrugObfuBody_00 1485 0.66 0.96 0.50 175 DKIM_ADSP_CUSTOM_MED 1469 1.01 0.95 1.04 176 TR_Caps_n_Bayes_99 1465 0.55 0.95 0.35 177 XM_B_SEO 1450 0.42 0.94 0.14 178 RDNS_DYNAMIC 1447 0.75 0.93 0.66 179 BAYES_20 1444 2.01 0.93 2.58 180 XMMoneyMeta_00 1438 0.59 0.93 0.42 181 XM_ProductURIs 1430 0.87 0.92 0.84 182 HK_SCAM 1422 0.32 0.92 0.00 183 XM_Body_Dirty_Words_01 1415 0.89 0.91 0.87 184 TR_Sbj_FN_Bdy 1412 0.41 0.91 0.15 185 T_Symld_Words_02 1392 0.64 0.90 0.51 186 TR_XM_SEO4 1390 0.38 0.90 0.10 187 XM_BadFromFormat 1389 0.51 0.90 0.31 188 THIS_AD 1381 0.54 0.89 0.35 189 XM_Body_Obfu01 1373 0.42 0.89 0.17 190 XM_ShortIntro_01 1351 0.61 0.87 0.46 191 MILLION_USD 1347 0.30 0.87 0.00 192 XMHTMLBadTable_001 1344 0.80 0.87 0.77 193 LongTLD 1339 0.37 0.87 0.10 194 XMBody_78 1314 0.56 0.85 0.40 195 XM_PDF 1312 2.24 0.85 2.98 196 RELAYCOUNTRY_CN 1307 0.34 0.84 0.08 197 XM_OfRef7 1300 0.34 0.84 0.08 198 RCVD_IN_MSPIKE_L4 1300 0.30 0.84 0.01 199 MONEY_FORM_SHORT 1282 0.29 0.83 0.01 200 T_TooManySym_02 1270 2.29 0.82 3.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 255905 90.87 96.38 87.94 2 RELAYCOUNTRY_US 242475 80.14 74.15 83.33 3 DKIM_SIGNED 231001 81.85 86.50 79.38 4 XM_DK_Pass 227424 80.28 84.27 78.15 5 DKIM_VALID 222273 78.56 82.65 76.38 6 XM_B_Unicode 211517 73.98 76.40 72.69 7 DKIM_VALID_AU 173643 61.36 64.54 59.67 8 XMListUnsubscribeExists 163311 61.56 71.78 56.12 9 BAYES_50 159259 47.92 35.12 54.73 10 DCC_CHECK_NEGATIVE 159208 41.78 17.47 54.71 11 XM_B_Unicode3 135154 44.93 42.07 46.45 12 XM_B_SpammyWords 128626 52.47 68.03 44.20 13 DCC_CHECK 127191 56.52 80.60 43.71 14 RCVD_IN_MSPIKE_WL 94576 28.88 22.06 32.50 15 DKIM_VALID_EF 88525 30.29 30.05 30.42 16 HTML_FONT_LOW_CONTRAST 88436 31.27 32.92 30.39 17 LOC_TINY_FONT_1 84130 32.09 38.06 28.91 18 RCVD_IN_MSPIKE_H2 81251 28.97 30.95 27.92 19 FVGT_m_MULTI_ODD 76037 26.70 27.77 26.13 20 T_TM2_M_HEADER_IN_MSG 69393 22.41 19.70 23.85 21 MIME_HTML_ONLY 65095 25.69 31.92 22.37 22 XMSubLong 61530 22.22 24.23 21.14 23 T_KAM_HTML_FONT_INVALID 59156 22.41 26.32 20.33 24 XM_B_SpammyWords2 55949 25.74 37.99 19.23 25 RCVD_IN_MSPIKE_H3 50280 15.55 12.29 17.28 26 ALL_TRUSTED 38090 8.91 1.06 13.09 27 XM_Multi_Part_URI 37303 13.63 15.14 12.82 28 XM_Body_Dirty_Words 36623 14.88 19.20 12.59 29 RCVD_IN_MSPIKE_H4 36612 11.35 9.03 12.58 30 RCVD_IN_RP_SAFE 33871 9.42 5.26 11.64 31 XM_DKIMWhitelistDomains 32663 7.35 0.07 11.22 32 XM_B_Unsub 32190 11.20 11.45 11.06 33 RCVD_IN_RP_CERTIFIED 31282 8.28 3.63 10.75 34 BAYES_60 30772 9.91 8.66 10.57 35 XM_DK_Undo_02 30660 25.33 53.15 10.54 36 LotsOfNums_01 27999 9.23 8.48 9.62 37 XM_Evil_Numbers_Gen 27738 9.73 10.10 9.53 38 BAYES_00 27537 6.43 0.73 9.46 39 UNPARSEABLE_RELAY 24972 8.51 8.38 8.58 40 HTML_IMAGE_RATIO_02 24485 9.27 10.88 8.41 41 BAYES_99 23582 19.08 39.71 8.10 42 XM_SendGrid 22634 7.32 6.45 7.78 43 TR_XM_DK_Bayes 22085 5.13 0.51 7.59 44 TR_XM_DK_Bayes1 21520 5.00 0.51 7.40 45 TR_XM_UnparsRelay 21074 7.58 8.23 7.24 46 TooManyTo_001 20820 6.70 5.84 7.15 47 HTML_IMAGE_RATIO_04 20125 7.11 7.48 6.92 48 BAYES_999 19216 15.60 32.51 6.60 49 TR_XM_DK_Bayes2 19145 4.44 0.40 6.58 50 FSL_BULK_SIG 17682 8.44 12.88 6.08 51 LOTS_OF_MONEY 17552 8.41 12.90 6.03 52 BOTNET_IPINHOSTNAME 17056 7.76 11.34 5.86 53 BAYES_80 16812 6.73 8.52 5.78 54 T_TooManySym_01 16711 4.68 2.68 5.74 55 TR_XM_DKIM_Undo 16574 18.38 42.23 5.70 56 RCVD_IN_IADB_LISTED 16359 4.40 2.10 5.62 57 XM_H_Long_From01 15850 5.74 6.29 5.45 58 MIME_QP_LONG_LINE 15548 4.45 2.77 5.34 59 IN_ZIMBRA_NJ_WHITELIST 15543 3.50 0.04 5.34 60 RCVD_IN_IADB_SPF 14334 3.87 1.88 4.93 61 XMStrtUSub 14018 4.76 4.64 4.82 62 TR_XM_DK_SendGrid 13785 4.35 3.61 4.74 63 XM_B_SpammyWords3 13706 7.54 12.87 4.71 64 XMSexyCombo_05 13059 6.11 9.16 4.49 65 XM_B_Phish_Phrases 13025 5.12 6.33 4.48 66 MPART_ALT_DIFF 12966 6.35 9.92 4.46 67 RCVD_IN_IADB_SENDERID 12848 3.50 1.77 4.42 68 RELAYCOUNTRY_META 12811 10.96 23.30 4.40 69 RCVD_IN_IADB_DK 12427 3.40 1.77 4.27 70 TR_XM_SpammyWords4 11796 6.62 11.45 4.05 71 HTML_IMAGE_RATIO_06 11244 3.58 3.03 3.86 72 XM_UncommonTLD01 10965 8.07 16.14 3.77 73 T_REMOTE_IMAGE 10903 4.72 6.56 3.75 74 BAYES_95 10573 4.00 4.68 3.63 75 FROM_EXCESS_BASE64 10503 3.47 3.21 3.61 76 RCVD_IN_IADB_VOUCHED 10238 2.57 0.79 3.52 77 BAYES_40 10155 2.68 1.15 3.49 78 TR_DCC_Bayes_99 9977 13.23 31.65 3.43 79 XMSubMetaSx_00 9679 4.07 5.47 3.33 80 TR_XM_PhishingBody 9458 4.20 5.99 3.25 81 XMNumbers 9057 4.19 6.23 3.11 82 TVD_RCVD_IP 9054 2.08 0.15 3.11 83 T_TooManySym_02 8932 2.29 0.82 3.07 84 DKIM_INVALID 8728 3.29 3.85 3.00 85 XM_PDF 8670 2.24 0.85 2.98 86 URI_NOVOWEL 8516 2.46 1.57 2.93 87 T_XMDrugObfuBody_14 8001 2.53 2.11 2.75 88 RCVD_IN_MSPIKE_H5 7684 1.98 0.74 2.64 89 TM2_M_URI_OPT_OUT 7529 2.79 3.17 2.59 90 BAYES_20 7508 2.01 0.93 2.58 91 ANY_BOUNCE_MESSAGE 7340 1.78 0.38 2.52 92 BOUNCE_MESSAGE 7335 1.77 0.37 2.52 93 MIME_HTML_ONLY_MULTI 6933 2.37 2.33 2.38 94 XM_B_SpammyTLD 6895 2.83 3.70 2.37 95 INVALID_MSGID 6802 1.68 0.46 2.34 96 HTML_MIME_NO_HTML_TAG 6748 2.06 1.57 2.32 97 XM_H_Trusted_IP 6723 1.51 0.00 2.31 98 MIME_HTML_MOSTLY 6722 4.73 9.29 2.31 99 RCVD_IN_IADB_OPTIN 6675 1.68 0.53 2.29 100 MSGID_NOFQDN1 6369 1.44 0.03 2.19 101 USER_IN_DEF_DKIM_WL 6292 1.42 0.03 2.16 102 TO_MALFORMED 6209 1.40 0.01 2.13 103 MAILING_LIST_MULTI 6135 1.90 1.52 2.11 104 XM_CamelCaseFrm001 5903 2.11 2.27 2.03 105 UNTRUSTED_Relay 5865 7.21 16.97 2.02 106 HELO_MISC_IP 5839 1.34 0.08 2.01 107 HTML_IMAGE_RATIO_08 5739 2.32 2.96 1.97 108 BOTNET 5578 6.71 15.73 1.92 109 TR_XM_SB_Phish 5479 1.89 1.89 1.88 110 IN_HORDE_ADDRESS_BOOK 5427 1.24 0.05 1.86 111 XMSubPhish11 5335 1.62 1.21 1.83 112 XM_SPF_SoftFail 5149 2.23 3.09 1.77 113 XM_B_Phish66 5112 2.31 3.34 1.76 114 TR_Symld_Words 5052 1.41 0.80 1.74 115 XMBSHREFv2 4959 1.22 0.32 1.70 116 BAYES_05 4792 1.25 0.50 1.65 117 RCVD_IN_BL_SPAMCOP_NET 4758 5.28 12.15 1.64 118 KHOP_HELO_FCRDNS 4650 3.11 5.94 1.60 119 TR_XM_SpammyWords5 4635 2.54 4.32 1.59 120 SUBJ_ALL_CAPS 4493 1.64 1.81 1.54 121 TooManyTo_002 4470 1.22 0.62 1.54 122 XMSolicitRefs_0 4384 1.06 0.23 1.51 123 XMBdyGiftCard01 4207 2.34 4.02 1.45 124 XMStockSpam_06 4166 1.46 1.52 1.43 125 XM_B_Unsub2 4090 1.66 2.13 1.41 126 URIBL_SBL_A 4079 2.11 3.46 1.40 127 T_XMDrugObfuBody_08 4005 1.63 2.10 1.38 128 XM_DK_Undo_01 4002 2.51 4.64 1.38 129 TM2_M_VERY_LONG_WORD 4001 1.58 1.95 1.37 130 URI_HEX 3954 1.82 2.68 1.36 131 XMBody_95 3792 0.88 0.09 1.30 132 RELAYCOUNTRY_CA 3749 3.30 7.07 1.29 133 XMGappySubj_01 3693 1.05 0.64 1.27 134 XM_UB50 3687 3.23 6.91 1.27 135 DIET_1 3664 1.01 0.55 1.26 136 XM_H_Long_From02 3508 1.23 1.27 1.21 137 XMDiploma_00 3456 1.78 2.88 1.19 138 URI_TRY_3LD 3435 1.52 2.16 1.18 139 XMSubNoVowel 3413 1.03 0.75 1.17 140 TR_XM_SpammyWords2 3392 5.74 14.34 1.17 141 PLING_QUERY 3189 1.07 1.03 1.10 142 TooManyTo_003 3115 0.89 0.54 1.07 143 DKIM_ADSP_CUSTOM_MED 3040 1.01 0.95 1.04 144 TVD_SPACE_RATIO 2906 0.67 0.05 1.00 145 XM_GoogleGroups 2885 0.79 0.41 0.99 146 XM_Body_Dirty_Words_01 2541 0.89 0.91 0.87 147 HELO_NODOT 2536 0.74 0.50 0.87 148 HELO_NO_DOMAIN 2536 0.72 0.43 0.87 149 XMPhish30 2493 0.91 1.00 0.86 150 HTML_FONT_FACE_BAD 2487 0.72 0.47 0.85 151 TooManyTo_004 2462 0.72 0.49 0.85 152 XM_ProductURIs 2434 0.87 0.92 0.84 153 TR_MSPIKEBAYES00 2411 0.54 0.01 0.83 154 XMHTML_After_End 2380 0.81 0.79 0.82 155 PDS_OTHER_BAD_TLD 2366 1.56 2.96 0.81 156 HTML_IMAGE_ONLY_20 2255 0.60 0.28 0.77 157 XMHTMLBadTable_001 2243 0.80 0.87 0.77 158 T_TooManySym_03 2202 0.54 0.12 0.76 159 USER_IN_WELCOMELIST 2129 0.48 0.00 0.73 160 USER_IN_WHITELIST 2129 0.48 0.00 0.73 161 TooManyTo_005 2060 0.61 0.44 0.71 162 RELAYCOUNTRY_GB 2053 0.75 0.82 0.71 163 XMBrknScrpt_02 2038 1.28 2.37 0.70 164 XMLngstWrd_00 1993 0.64 0.56 0.68 165 XM_OfRef6 1992 1.57 3.22 0.68 166 T_MANY_PILL_PRICE 1954 0.45 0.02 0.67 167 RDNS_DYNAMIC 1914 0.75 0.93 0.66 168 NML_ADSP_CUSTOM_MED 1907 0.71 0.80 0.66 169 FORGED_GMAIL_RCVD 1798 1.37 2.79 0.62 170 XM_B_COVIDMETA 1788 0.97 1.64 0.61 171 XMLngstWrd_01 1764 0.57 0.51 0.61 172 XMCapTrack 1739 0.47 0.24 0.60 173 XM_B_REG_HTML 1725 0.48 0.26 0.59 174 XM_H_PHPMailer 1699 0.62 0.69 0.58 175 TR_MetaPhish_Combo_01 1680 0.54 0.47 0.58 176 SpammyFromTLD_01 1675 1.94 4.51 0.58 177 HTTPS_HTTP_MISMATCH 1673 0.71 0.97 0.57 178 XMGenDplmaNmb 1642 0.92 1.60 0.56 179 XM_B_SpammyWords4 1590 1.22 2.49 0.55 180 XMSubMetaI_00 1551 1.24 2.56 0.53 181 XMSubMetaSxObfu_02 1506 0.42 0.22 0.52 182 T_Symld_Words_02 1477 0.64 0.90 0.51 183 T_XMDrugObfuBody_00 1464 0.66 0.96 0.50 184 TVD_SPACE_RATIO_MINFP 1452 0.42 0.28 0.50 185 XMLngstWrd_02 1450 0.49 0.46 0.50 186 MPART_ALT_DIFF_COUNT 1402 0.69 1.09 0.48 187 XMBody_17 1391 1.12 2.31 0.48 188 TR_BOTNET_NEGATE 1374 0.55 0.69 0.47 189 T_FILL_THIS_FORM_SHORT 1359 1.36 3.03 0.47 190 XM_ShortIntro_01 1348 0.61 0.87 0.46 191 XMSexyCombo_01 1326 0.73 1.24 0.46 192 XMNoVowels 1285 0.41 0.34 0.44 193 T_XMHurry_00 1254 0.76 1.39 0.43 194 XM_shorewaves_Whitelist 1226 0.28 0.00 0.42 195 XM_B_COPY_HTML 1224 0.46 0.52 0.42 196 XMMoneyMeta_00 1208 0.59 0.93 0.42 197 T_OBFU_PDF_ATTACH 1199 0.40 0.38 0.41 198 XMBody_78 1170 0.56 0.85 0.40 199 RELAYCOUNTRY_DE 1163 0.60 0.98 0.40 200 TR_XM_PHPDW 1154 0.75 1.41 0.40 ----------------------------------------------------------------------