Email: 443601 Autolearn: 0 AvgScore: 5.32 AvgScanTime: 1.35 sec Spam: 157267 Autolearn: 0 AvgScore: 15.62 AvgScanTime: 1.38 sec Ham: 286334 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.34 sec Time Spent Running SA: 166.76 hours Time Spent Processing Spam: 60.24 hours Time Spent Processing Ham: 106.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138258 88.84 87.91 89.35 2 DCC_CHECK 124794 59.32 79.35 48.32 3 DKIM_SIGNED 120151 79.60 76.40 81.36 4 XM_DK_Pass 117467 78.31 74.69 80.29 5 DKIM_VALID 115746 77.01 73.60 78.88 6 XM_B_Unicode 110033 74.40 69.97 76.83 7 RELAYCOUNTRY_US 105784 77.41 67.26 82.98 8 XMListUnsubscribeExists 101749 60.89 64.70 58.80 9 XM_B_SpammyWords 99075 54.42 63.00 49.71 10 DKIM_VALID_AU 91707 61.76 58.31 63.65 11 XM_DK_Undo_02 73934 23.19 47.01 10.11 12 BAYES_99 62676 18.60 39.85 6.92 13 TR_XM_DKIM_Undo 62299 18.41 39.61 6.76 14 HTML_FONT_LOW_CONTRAST 55817 33.16 35.49 31.88 15 LOC_TINY_FONT_1 53422 31.51 33.97 30.15 16 XM_B_Unicode3 52490 41.82 33.38 46.46 17 XM_B_SpammyWords2 52429 26.49 33.34 22.73 18 BAYES_999 50266 15.03 31.96 5.73 19 TR_DCC_Bayes_99 49727 13.35 31.62 3.31 20 BAYES_50 47921 45.69 30.47 54.05 21 RELAYCOUNTRY_META 46326 13.38 29.46 4.56 22 RCVD_IN_MSPIKE_H2 44148 27.93 28.07 27.85 23 DKIM_VALID_EF 43871 29.13 27.90 29.80 24 MIME_HTML_ONLY 43226 25.68 27.49 24.69 25 FVGT_m_MULTI_ODD 43217 25.11 27.48 23.81 26 UNTRUSTED_Relay 37977 9.97 24.15 2.18 27 XM_Multi_Part_URI 33149 16.66 21.08 14.24 28 T_KAM_HTML_FONT_INVALID 31656 18.78 20.13 18.03 29 BOTNET 31548 8.29 20.06 1.83 30 DCC_CHECK_NEGATIVE 30590 39.45 19.45 50.44 31 XMSubLong 30158 20.35 19.18 20.99 32 T_TM2_M_HEADER_IN_MSG 28872 21.06 18.36 22.55 33 FSL_BULK_SIG 26934 11.10 17.13 7.79 34 BOTNET_IPINHOSTNAME 26254 9.46 16.69 5.49 35 XM_Body_Dirty_Words 24975 15.79 15.88 15.75 36 RCVD_IN_MSPIKE_WL 24932 25.41 15.85 30.66 37 TR_XM_SpammyWords2 22621 6.05 14.38 1.47 38 XM_UncommonTLD01 22052 7.37 14.02 3.72 39 RCVD_IN_BL_SPAMCOP_NET 21084 5.82 13.41 1.65 40 LotsOfNums_01 19458 10.18 12.37 8.97 41 XM_B_Unsub 17504 11.05 11.13 11.01 42 RCVD_IN_MSPIKE_BL 16522 3.96 10.51 0.36 43 TR_XM_MSPIKECOMBO 16105 3.86 10.24 0.36 44 XM_B_SpammyWords3 15623 6.68 9.93 4.90 45 LOTS_OF_MONEY 15599 8.86 9.92 8.28 46 BAYES_80 15574 6.65 9.90 4.87 47 XMSexyCombo_05 14613 7.06 9.29 5.84 48 XM_UB50 14513 4.02 9.23 1.15 49 TR_XM_SpammyWords4 13740 6.53 8.74 5.32 50 RCVD_IN_MSPIKE_H3 13677 14.02 8.70 16.95 51 BAYES_60 13297 8.44 8.46 8.43 52 HTML_IMAGE_RATIO_02 13225 8.84 8.41 9.07 53 RCVD_IN_PSBL 12841 2.96 8.17 0.11 54 RCVD_IN_MSPIKE_L5 12456 2.89 7.92 0.13 55 MPART_ALT_DIFF 12454 6.37 7.92 5.52 56 RCVD_IN_RP_RNBL 12354 2.85 7.86 0.10 57 XM_Evil_Numbers_Gen 12340 9.07 7.85 9.75 58 T_REMOTE_IMAGE 11605 4.68 7.38 3.20 59 MIME_HTML_MOSTLY 11268 4.17 7.16 2.53 60 KHOP_HELO_FCRDNS 11020 3.06 7.01 0.90 61 BODY_URI_ONLY 11005 2.52 7.00 0.06 62 TooManyTo_001 10581 6.60 6.73 6.52 63 PDS_FROM_2_EMAILS 10545 2.39 6.71 0.02 64 FROM_2_EMAILS_SHORT 10519 2.38 6.69 0.02 65 TM2_M_VERY_LONG_WORD 10454 3.38 6.65 1.58 66 TVD_SPACE_RATIO 10194 2.66 6.48 0.56 67 RCVD_IN_MSPIKE_H4 10128 9.67 6.44 11.45 68 PDS_TO_EQ_FROM_NAME 9990 2.27 6.35 0.03 69 RELAYCOUNTRY_CA 9808 3.29 6.24 1.68 70 UNPARSEABLE_RELAY 9306 7.84 5.92 8.90 71 URI_WP_HACKED 9126 2.09 5.80 0.06 72 BAYES_95 9095 4.08 5.78 3.14 73 NO_FM_NAME_IP_HOSTN 8986 2.04 5.71 0.01 74 LONG_JUNK_URI 8921 2.08 5.67 0.10 75 XM_B_SpammyTLD 8908 3.76 5.66 2.71 76 TR_XM_UnparsRelay 8829 5.88 5.61 6.03 77 XMSubMetaSx_00 8264 4.42 5.25 3.96 78 HTML_IMAGE_RATIO_08 7933 3.13 5.04 2.08 79 XMSlimDrugH 7803 1.99 4.96 0.36 80 XM_H_Long_From01 7782 5.96 4.95 6.52 81 SpammyFromTLD_02 7780 1.85 4.95 0.16 82 SpammyFromTLD_01 7694 2.05 4.89 0.48 83 RCVD_IN_RP_SAFE 7690 9.18 4.89 11.54 84 TVD_SPACE_RATIO_MINFP 7660 1.73 4.87 0.01 85 XM_B_Phish_Phrases 7555 4.91 4.80 4.97 86 HTML_MIME_NO_HTML_TAG 7484 2.69 4.76 1.55 87 HTML_IMAGE_RATIO_04 7318 5.84 4.65 6.49 88 RELAYCOUNTRY_IN 7279 1.70 4.63 0.09 89 HTML_IMAGE_RATIO_06 7268 4.35 4.62 4.20 90 DATE_IN_PAST_03_06 7038 1.64 4.48 0.08 91 URIBL_SBL_A 6927 1.68 4.40 0.18 92 XM_SendGrid 6872 6.66 4.37 7.91 93 XM_DIRTYINTL 6822 1.82 4.34 0.44 94 XMNumbers 6756 3.80 4.30 3.53 95 XM_UB60 6356 1.52 4.04 0.13 96 RCVD_IN_RP_CERTIFIED 6127 8.22 3.90 10.60 97 TR_XM_PhishingBody 5997 2.80 3.81 2.25 98 RELAYCOUNTRY_FR 5918 1.51 3.76 0.28 99 ONLINE_PHARMACY 5865 1.35 3.73 0.04 100 XM_UB80 5846 1.37 3.72 0.08 101 TVD_VISIT_PHARMA 5828 1.34 3.71 0.04 102 MIMEOLE_DIRECT_TO_MX 5712 1.29 3.63 0.01 103 XM_UB99 5678 1.28 3.61 0.01 104 XM_OfRef6 5519 2.13 3.51 1.38 105 TM2_M_URI_OPT_OUT 5409 2.83 3.44 2.50 106 TR_XM_SpammyWords5 5273 2.22 3.35 1.60 107 HTML_IMAGE_ONLY_12 5259 1.31 3.34 0.19 108 HTML_SHORT_LINK_IMG_1 5146 1.19 3.27 0.04 109 URI_HEX 5135 2.24 3.27 1.68 110 XMBody_17 4938 1.60 3.14 0.76 111 T_FONT_INVIS_NAKED_TO 4851 2.44 3.08 2.09 112 TR_XM_SpoofStaff 4750 1.13 3.02 0.08 113 HTML_IMAGE_ONLY_08 4750 1.13 3.02 0.10 114 XMSpoofStaff2 4733 1.12 3.01 0.08 115 XMStrtUSub 4711 4.44 3.00 5.24 116 URI_ONLY_MSGID_MALF 4549 1.03 2.89 0.01 117 XM_SPF_SoftFail 4548 1.71 2.89 1.06 118 XM_DK_Undo_01 4496 1.87 2.86 1.32 119 SUBJ_ALL_CAPS 4430 1.84 2.82 1.31 120 DKIM_INVALID 4405 2.59 2.80 2.48 121 HDR_ORDER_FTSDMCXX_DIRECT 4314 0.98 2.74 0.01 122 TR_XM_MaxBayes 4178 0.95 2.66 0.01 123 XMSubNoVowel 3994 2.69 2.54 2.78 124 TR_XM_SpoofStaff2 3942 0.89 2.51 0.00 125 TR_XM_DK_SendGrid 3898 4.25 2.48 5.22 126 DOS_OE_TO_MX 3857 0.87 2.45 0.01 127 XM_H_SpoofStaff4 3785 0.91 2.41 0.09 128 TR_XM_PSC1 3779 0.91 2.40 0.08 129 XM_UB999 3764 0.85 2.39 0.01 130 T_FILL_THIS_FORM_SHORT 3757 1.25 2.39 0.62 131 URI_TRY_3LD 3700 1.85 2.35 1.57 132 TR_LOTS_OF_MONEY3 3664 1.01 2.33 0.29 133 XMBdyGiftCard01 3639 1.56 2.31 1.15 134 T_XMDrugObfuBody_08 3633 1.97 2.31 1.79 135 BOTNET_NORDNS 3597 0.82 2.29 0.01 136 FROM_EXCESS_BASE64 3567 3.86 2.27 4.74 137 XMBrknScrpt_02 3527 1.23 2.24 0.67 138 INVALID_DATE 3504 0.82 2.23 0.04 139 HTML_FONT_SIZE_LARGE 3420 0.81 2.17 0.07 140 TR_XM_SpammyWords3 3345 0.85 2.13 0.15 141 RELAYCOUNTRY_UA 3285 0.80 2.09 0.09 142 ALL_TRUSTED 3169 9.15 2.02 13.08 143 XM_UB95 3165 0.72 2.01 0.01 144 XMDiploma_00 3151 1.52 2.00 1.26 145 T_TooManySym_01 3090 4.14 1.96 5.33 146 TR_XM_SB_Phish 3051 1.93 1.94 1.92 147 XM_CamelCaseFrm001 3039 2.04 1.93 2.09 148 PDS_OTHER_BAD_TLD 2986 1.41 1.90 1.14 149 MIME_HTML_ONLY_MULTI 2986 2.94 1.90 3.51 150 XMSubPhish11 2957 1.89 1.88 1.90 151 BAYES_40 2919 3.28 1.86 4.06 152 CK_HELO_DYNAMIC_SPLIT_IP 2873 1.92 1.83 1.97 153 XMSexyCombo_01 2828 0.94 1.80 0.46 154 RDNS_DYNAMIC 2790 1.09 1.77 0.72 155 XM_B_Unsub2 2714 1.66 1.73 1.63 156 BITCOIN_XPRIO 2589 0.59 1.65 0.01 157 URI_NO_WWW_BIZ_CGI 2524 0.57 1.60 0.01 158 XM_B_Phish66 2481 1.25 1.58 1.07 159 BAYES_20 2479 2.56 1.58 3.09 160 TR_Symld_Words 2394 1.67 1.52 1.76 161 DOS_OUTLOOK_TO_MX 2358 0.54 1.50 0.02 162 T_XMDrugObfuBody_14 2352 1.57 1.50 1.62 163 DIET_1 2313 0.81 1.47 0.44 164 RCVD_IN_MSPIKE_L3 2309 0.60 1.47 0.13 165 RELAYCOUNTRY_DE 2300 0.72 1.46 0.32 166 TR_XM_PHPDW 2290 0.76 1.46 0.38 167 DATE_IN_PAST_06_12 2284 0.70 1.45 0.28 168 TR_Mismatch_TLD_01 2266 1.05 1.44 0.83 169 MIME_QP_LONG_LINE 2260 3.34 1.44 4.38 170 TR_XM_FormFill 2231 0.51 1.42 0.01 171 HTML_TAG_BALANCE_CENTER 2219 0.77 1.41 0.42 172 TR_XM_PHPForged 2217 0.69 1.41 0.29 173 TR_XM_FormFill2 2207 0.69 1.40 0.29 174 XM_H_PHPOS 2206 0.68 1.40 0.28 175 XMSubEmpty 2205 1.76 1.40 1.96 176 DATE_IN_PAST_12_24 2192 0.66 1.39 0.25 177 XMBody_78 2183 0.77 1.39 0.43 178 TR_XM_BayesRelay 2147 0.49 1.37 0.01 179 RCVD_IN_IADB_LISTED 2112 3.36 1.34 4.47 180 XMStockSpam_06 2105 1.60 1.34 1.74 181 XMGenDplmaNmb 2103 0.89 1.34 0.65 182 XM_B_SpammyWords4 2093 0.76 1.33 0.44 183 URI_NOVOWEL 2069 2.23 1.32 2.73 184 FROM_SUSPICIOUS_NTLD 1975 0.53 1.26 0.13 185 MAILING_LIST_MULTI 1970 1.63 1.25 1.83 186 URI_PHP_REDIR 1969 0.44 1.25 0.00 187 RELAYCOUNTRY_BR 1954 0.45 1.24 0.02 188 BAYES_00 1950 9.06 1.24 13.36 189 FROM_SUSPICIOUS_NTLD_FP 1920 0.51 1.22 0.12 190 T_XMHurry_00 1884 0.74 1.20 0.49 191 XM_OfRef7 1882 0.52 1.20 0.15 192 TR_XM_COVIDMETA4 1864 0.55 1.19 0.20 193 TR_MetaPhish_Combo_01 1841 0.83 1.17 0.64 194 BOUNCE_MESSAGE 1824 1.23 1.16 1.26 195 ANY_BOUNCE_MESSAGE 1824 1.23 1.16 1.26 196 HELO_DYNAMIC_IPADDR2 1824 0.41 1.16 0.00 197 DKIM_ADSP_NXDOMAIN 1815 0.64 1.15 0.36 198 RCVD_IN_IADB_SPF 1804 2.91 1.15 3.87 199 HTTPS_HTTP_MISMATCH 1776 0.77 1.13 0.57 200 HK_RANDOM_REPLYTO 1773 0.57 1.13 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 255853 88.84 87.91 89.35 2 RELAYCOUNTRY_US 237595 77.41 67.26 82.98 3 DKIM_SIGNED 232950 79.60 76.40 81.36 4 XM_DK_Pass 229910 78.31 74.69 80.29 5 DKIM_VALID 225855 77.01 73.60 78.88 6 XM_B_Unicode 220002 74.40 69.97 76.83 7 DKIM_VALID_AU 182261 61.76 58.31 63.65 8 XMListUnsubscribeExists 168370 60.89 64.70 58.80 9 BAYES_50 154770 45.69 30.47 54.05 10 DCC_CHECK_NEGATIVE 144427 39.45 19.45 50.44 11 XM_B_SpammyWords 142325 54.42 63.00 49.71 12 DCC_CHECK 138349 59.32 79.35 48.32 13 XM_B_Unicode3 133031 41.82 33.38 46.46 14 HTML_FONT_LOW_CONTRAST 91291 33.16 35.49 31.88 15 RCVD_IN_MSPIKE_WL 87794 25.41 15.85 30.66 16 LOC_TINY_FONT_1 86341 31.51 33.97 30.15 17 DKIM_VALID_EF 85333 29.13 27.90 29.80 18 RCVD_IN_MSPIKE_H2 79742 27.93 28.07 27.85 19 MIME_HTML_ONLY 70703 25.68 27.49 24.69 20 FVGT_m_MULTI_ODD 68190 25.11 27.48 23.81 21 XM_B_SpammyWords2 65080 26.49 33.34 22.73 22 T_TM2_M_HEADER_IN_MSG 64557 21.06 18.36 22.55 23 XMSubLong 60108 20.35 19.18 20.99 24 T_KAM_HTML_FONT_INVALID 51634 18.78 20.13 18.03 25 RCVD_IN_MSPIKE_H3 48528 14.02 8.70 16.95 26 XM_Body_Dirty_Words 45088 15.79 15.88 15.75 27 XM_Multi_Part_URI 40777 16.66 21.08 14.24 28 BAYES_00 38242 9.06 1.24 13.36 29 ALL_TRUSTED 37439 9.15 2.02 13.08 30 RCVD_IN_RP_SAFE 33035 9.18 4.89 11.54 31 RCVD_IN_MSPIKE_H4 32780 9.67 6.44 11.45 32 TR_XM_DK_Bayes 32557 7.62 0.79 11.37 33 TR_XM_DK_Bayes1 31989 7.49 0.79 11.17 34 XM_B_Unsub 31528 11.05 11.13 11.01 35 XM_DKIMWhitelistDomains 31167 7.04 0.05 10.88 36 RCVD_IN_RP_CERTIFIED 30346 8.22 3.90 10.60 37 TR_XM_DK_Bayes2 29724 6.94 0.67 10.38 38 XM_DK_Undo_02 28951 23.19 47.01 10.11 39 XM_Evil_Numbers_Gen 27915 9.07 7.85 9.75 40 HTML_IMAGE_RATIO_02 25984 8.84 8.41 9.07 41 LotsOfNums_01 25689 10.18 12.37 8.97 42 UNPARSEABLE_RELAY 25487 7.84 5.92 8.90 43 BAYES_60 24128 8.44 8.46 8.43 44 LOTS_OF_MONEY 23710 8.86 9.92 8.28 45 XM_SendGrid 22653 6.66 4.37 7.91 46 FSL_BULK_SIG 22298 11.10 17.13 7.79 47 BAYES_99 19816 18.60 39.85 6.92 48 TR_XM_DKIM_Undo 19361 18.41 39.61 6.76 49 XM_H_Long_From01 18678 5.96 4.95 6.52 50 TooManyTo_001 18675 6.60 6.73 6.52 51 HTML_IMAGE_RATIO_04 18588 5.84 4.65 6.49 52 TR_XM_UnparsRelay 17256 5.88 5.61 6.03 53 XMSexyCombo_05 16725 7.06 9.29 5.84 54 BAYES_999 16415 15.03 31.96 5.73 55 MPART_ALT_DIFF 15807 6.37 7.92 5.52 56 BOTNET_IPINHOSTNAME 15726 9.46 16.69 5.49 57 T_TooManySym_01 15265 4.14 1.96 5.33 58 TR_XM_SpammyWords4 15234 6.53 8.74 5.32 59 XMStrtUSub 14993 4.44 3.00 5.24 60 TR_XM_DK_SendGrid 14943 4.25 2.48 5.22 61 XM_B_Phish_Phrases 14237 4.91 4.80 4.97 62 IN_ZIMBRA_NJ_WHITELIST 14233 3.29 0.24 4.97 63 XM_B_SpammyWords3 14024 6.68 9.93 4.90 64 BAYES_80 13941 6.65 9.90 4.87 65 FROM_EXCESS_BASE64 13578 3.86 2.27 4.74 66 RELAYCOUNTRY_META 13045 13.38 29.46 4.56 67 RCVD_IN_IADB_LISTED 12811 3.36 1.34 4.47 68 MIME_QP_LONG_LINE 12553 3.34 1.44 4.38 69 HTML_IMAGE_RATIO_06 12019 4.35 4.62 4.20 70 BAYES_40 11629 3.28 1.86 4.06 71 XMSubMetaSx_00 11331 4.42 5.25 3.96 72 RCVD_IN_IADB_SPF 11089 2.91 1.15 3.87 73 XM_UncommonTLD01 10656 7.37 14.02 3.72 74 XMNumbers 10117 3.80 4.30 3.53 75 MIME_HTML_ONLY_MULTI 10055 2.94 1.90 3.51 76 RCVD_IN_IADB_SENDERID 9760 2.58 1.08 3.41 77 TR_DCC_Bayes_99 9486 13.35 31.62 3.31 78 RCVD_IN_IADB_DK 9448 2.51 1.07 3.30 79 T_REMOTE_IMAGE 9151 4.68 7.38 3.20 80 BAYES_95 8997 4.08 5.78 3.14 81 BAYES_20 8860 2.56 1.58 3.09 82 INVALID_MSGID 8253 2.04 0.50 2.88 83 XMSubNoVowel 7959 2.69 2.54 2.78 84 RCVD_IN_IADB_VOUCHED 7954 2.01 0.61 2.78 85 URI_NOVOWEL 7805 2.23 1.32 2.73 86 XM_B_SpammyTLD 7773 3.76 5.66 2.71 87 MSGID_NOFQDN1 7684 1.75 0.06 2.68 88 T_TooManySym_02 7675 1.94 0.60 2.68 89 MIME_HTML_MOSTLY 7242 4.17 7.16 2.53 90 TM2_M_URI_OPT_OUT 7149 2.83 3.44 2.50 91 DKIM_INVALID 7095 2.59 2.80 2.48 92 TO_MALFORMED 6537 1.47 0.00 2.28 93 RCVD_IN_MSPIKE_H5 6486 1.72 0.72 2.27 94 TR_XM_PhishingBody 6433 2.80 3.81 2.25 95 UNTRUSTED_Relay 6251 9.97 24.15 2.18 96 TVD_RCVD_IP 6234 1.68 0.76 2.18 97 XM_CamelCaseFrm001 5993 2.04 1.93 2.09 98 T_FONT_INVIS_NAKED_TO 5985 2.44 3.08 2.09 99 HTML_IMAGE_RATIO_08 5967 3.13 5.04 2.08 100 XM_PDF 5699 1.37 0.23 1.99 101 HELO_MISC_IP 5641 1.55 0.79 1.97 102 CK_HELO_DYNAMIC_SPLIT_IP 5641 1.92 1.83 1.97 103 BAYES_05 5629 1.56 0.82 1.97 104 XM_H_Trusted_IP 5627 1.27 0.00 1.97 105 XMSubEmpty 5624 1.76 1.40 1.96 106 TR_XM_SB_Phish 5493 1.93 1.94 1.92 107 IN_HORDE_ADDRESS_BOOK 5454 1.56 0.94 1.90 108 XMSubPhish11 5436 1.89 1.88 1.90 109 MAILING_LIST_MULTI 5240 1.63 1.25 1.83 110 BOTNET 5239 8.29 20.06 1.83 111 RCVD_IN_IADB_OPTIN 5202 1.35 0.49 1.82 112 T_XMDrugObfuBody_08 5123 1.97 2.31 1.79 113 TR_Symld_Words 5029 1.67 1.52 1.76 114 XMStockSpam_06 4992 1.60 1.34 1.74 115 URI_HEX 4817 2.24 3.27 1.68 116 RELAYCOUNTRY_CA 4801 3.29 6.24 1.68 117 RCVD_IN_BL_SPAMCOP_NET 4727 5.82 13.41 1.65 118 XM_B_Unsub2 4660 1.66 1.73 1.63 119 T_XMDrugObfuBody_14 4634 1.57 1.50 1.62 120 XMBSHREFv2 4574 1.10 0.19 1.60 121 TR_XM_SpammyWords5 4573 2.22 3.35 1.60 122 TM2_M_VERY_LONG_WORD 4534 3.38 6.65 1.58 123 URI_TRY_3LD 4505 1.85 2.35 1.57 124 HTML_MIME_NO_HTML_TAG 4428 2.69 4.76 1.55 125 TR_XM_SpammyWords2 4221 6.05 14.38 1.47 126 USER_IN_DEF_DKIM_WL 4056 0.92 0.01 1.42 127 XM_OfRef6 3949 2.13 3.51 1.38 128 TooManyTo_002 3849 1.00 0.37 1.34 129 XM_DK_Undo_01 3782 1.87 2.86 1.32 130 SUBJ_ALL_CAPS 3739 1.84 2.82 1.31 131 SHORTENED_URL_HREF 3720 1.14 0.85 1.30 132 ANY_BOUNCE_MESSAGE 3622 1.23 1.16 1.26 133 BOUNCE_MESSAGE 3621 1.23 1.16 1.26 134 XMDiploma_00 3604 1.52 2.00 1.26 135 XMBody_95 3475 0.82 0.10 1.21 136 XM_UB50 3301 4.02 9.23 1.15 137 TR_MSPIKEBAYES00 3285 0.76 0.06 1.15 138 XMBdyGiftCard01 3283 1.56 2.31 1.15 139 PDS_OTHER_BAD_TLD 3278 1.41 1.90 1.14 140 XM_H_Long_From02 3266 0.97 0.66 1.14 141 XM_B_Phish66 3055 1.25 1.58 1.07 142 XMGappySubj_01 3037 0.74 0.17 1.06 143 XM_SPF_SoftFail 3031 1.71 2.89 1.06 144 XM_GoogleGroups 2995 0.79 0.33 1.05 145 XM_B_COVIDMETA 2980 1.05 1.08 1.04 146 XM_ProductURIs 2671 0.88 0.78 0.93 147 TooManyTo_003 2661 0.70 0.27 0.93 148 KHOP_HELO_FCRDNS 2571 3.06 7.01 0.90 149 HTML_FONT_FACE_BAD 2570 0.76 0.51 0.90 150 T_XMDrugObfuBody_00 2553 0.96 1.08 0.89 151 DKIM_ADSP_CUSTOM_MED 2502 0.82 0.73 0.87 152 TR_Mismatch_TLD_01 2380 1.05 1.44 0.83 153 XMWhlSbjSex 2317 0.56 0.12 0.81 154 T_TooManySym_03 2287 0.56 0.12 0.80 155 XMBody_17 2180 1.60 3.14 0.76 156 BASE64_LENGTH_79_INF 2140 0.69 0.58 0.75 157 PLING_QUERY 2095 0.75 0.77 0.73 158 RDNS_DYNAMIC 2060 1.09 1.77 0.72 159 T_MANY_PILL_PRICE 1953 0.45 0.02 0.68 160 XMHTMLBadTable_001 1939 0.66 0.63 0.68 161 USER_IN_WELCOMELIST 1935 0.44 0.00 0.68 162 USER_IN_WHITELIST 1935 0.44 0.00 0.68 163 XMBrknScrpt_02 1912 1.23 2.24 0.67 164 XMGenDplmaNmb 1866 0.89 1.34 0.65 165 TooManyTo_004 1861 0.50 0.24 0.65 166 TR_MetaPhish_Combo_01 1839 0.83 1.17 0.64 167 RELAYCOUNTRY_GB 1818 0.67 0.73 0.63 168 PP_MIME_FAKE_ASCII_TEXT 1773 0.46 0.18 0.62 169 T_FILL_THIS_FORM_SHORT 1769 1.25 2.39 0.62 170 XM_B_REG_HTML 1749 0.54 0.41 0.61 171 XM_D_tchamptons_WL 1703 0.40 0.04 0.59 172 SUBJ_DOLLARS 1693 0.73 0.99 0.59 173 XMSubMetaI_00 1675 0.75 1.04 0.58 174 HTTPS_HTTP_MISMATCH 1638 0.77 1.13 0.57 175 NML_ADSP_CUSTOM_MED 1635 0.61 0.68 0.57 176 TooManyTo_005 1612 0.44 0.21 0.56 177 XM_B_COPY_HTML 1598 0.56 0.55 0.56 178 TVD_SPACE_RATIO 1597 2.66 6.48 0.56 179 XM_H_PHPMailer 1572 0.54 0.52 0.55 180 BODY_ENHANCEMENT 1571 0.36 0.02 0.55 181 HELO_NODOT 1544 0.53 0.52 0.54 182 HELO_NO_DOMAIN 1544 0.53 0.52 0.54 183 FORGED_GMAIL_RCVD 1516 0.68 0.94 0.53 184 TM2_M_A_HREF_HREF 1500 0.48 0.40 0.52 185 T_Symld_Words_02 1447 0.58 0.72 0.51 186 XMHTML_After_End 1447 0.68 0.99 0.51 187 NUMERIC_HTTP_ADDR 1438 0.65 0.91 0.50 188 XMEmptySub 1432 0.44 0.33 0.50 189 XMOemUri 1409 0.36 0.13 0.49 190 T_XMHurry_00 1405 0.74 1.20 0.49 191 SpammyFromTLD_01 1383 2.05 4.89 0.48 192 XMSubMetaSxObfu_02 1379 0.41 0.28 0.48 193 XMSolicitRefs_0 1343 0.40 0.28 0.47 194 XMSexyCombo_01 1323 0.94 1.80 0.46 195 XMPhish30 1281 0.57 0.80 0.45 196 XM_B_SpammyWords4 1274 0.76 1.33 0.44 197 DIET_1 1269 0.81 1.47 0.44 198 XM_DIRTYINTL 1255 1.82 4.34 0.44 199 XMBody_78 1244 0.77 1.39 0.43 200 HTML_IMAGE_ONLY_20 1239 0.40 0.33 0.43 ----------------------------------------------------------------------