Email: 685269 Autolearn: 0 AvgScore: 2.92 AvgScanTime: 1.36 sec Spam: 193869 Autolearn: 0 AvgScore: 13.54 AvgScanTime: 1.50 sec Ham: 491400 Autolearn: 0 AvgScore: -1.27 AvgScanTime: 1.30 sec Time Spent Running SA: 258.48 hours Time Spent Processing Spam: 80.80 hours Time Spent Processing Ham: 177.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 185165 92.08 95.51 90.72 2 DKIM_SIGNED 166587 78.66 85.93 75.80 3 XM_DK_Pass 162741 77.34 83.94 74.73 4 DKIM_VALID 159335 75.53 82.19 72.91 5 XM_B_Unicode 153032 75.09 78.94 73.57 6 DCC_CHECK 149680 51.18 77.21 40.92 7 RELAYCOUNTRY_US 145884 82.59 75.25 85.49 8 XMListUnsubscribeExists 137439 56.53 70.89 50.86 9 XM_B_SpammyWords 135894 55.76 70.10 50.11 10 DKIM_VALID_AU 121319 57.21 62.58 55.09 11 XM_DK_Undo_02 91910 18.68 47.41 7.34 12 XM_B_SpammyWords2 83494 27.36 43.07 21.16 13 XM_B_Unicode3 82193 44.08 42.40 44.75 14 LOC_TINY_FONT_1 77324 30.16 39.88 26.33 15 TR_XM_DKIM_Undo 75887 14.91 39.14 5.35 16 BAYES_99 70543 13.49 36.39 4.46 17 BAYES_50 68490 49.55 35.33 55.16 18 HTML_FONT_LOW_CONTRAST 67528 29.69 34.83 27.66 19 RCVD_IN_MSPIKE_H2 60965 28.28 31.45 27.03 20 MIME_HTML_ONLY 59770 25.94 30.83 24.01 21 DKIM_VALID_EF 59032 27.64 30.45 26.53 22 BAYES_999 55042 10.62 28.39 3.61 23 TR_DCC_Bayes_99 54252 9.45 27.98 2.13 24 FVGT_m_MULTI_ODD 50049 23.43 25.82 22.49 25 XMSubLong 48396 21.43 24.96 20.04 26 T_KAM_HTML_FONT_INVALID 48154 20.04 24.84 18.15 27 RELAYCOUNTRY_META 44267 9.69 22.83 4.50 28 T_TM2_M_HEADER_IN_MSG 41892 27.76 21.61 30.19 29 DCC_CHECK_NEGATIVE 40969 46.90 21.13 57.06 30 XM_Multi_Part_URI 40853 14.67 21.07 12.14 31 XM_Body_Dirty_Words 37518 15.60 19.35 14.12 32 RCVD_IN_MSPIKE_WL 36518 26.41 18.84 29.39 33 XM_B_SpammyWords3 30471 8.29 15.72 5.36 34 UNTRUSTED_Relay 30421 5.78 15.69 1.87 35 BOTNET 30321 5.59 15.64 1.63 36 TR_XM_SpammyWords2 30290 4.82 15.62 0.56 37 XM_B_Unsub 27779 12.70 14.33 12.05 38 LOTS_OF_MONEY 27008 9.97 13.93 8.41 39 LotsOfNums_01 25518 10.08 13.16 8.86 40 BOTNET_IPINHOSTNAME 25180 6.76 12.99 4.30 41 XM_Evil_Numbers_Gen 22760 9.69 11.74 8.88 42 TR_XM_SpammyWords4 22609 7.19 11.66 5.42 43 XM_UncommonTLD01 21364 5.21 11.02 2.92 44 MPART_ALT_DIFF 20851 8.92 10.76 8.19 45 FSL_BULK_SIG 20466 7.46 10.56 6.23 46 RCVD_IN_MSPIKE_H3 20305 14.67 10.47 16.32 47 XMSexyCombo_05 19066 6.28 9.83 4.87 48 BAYES_80 18768 5.55 9.68 3.92 49 RCVD_IN_BL_SPAMCOP_NET 17702 3.59 9.13 1.40 50 XM_B_Phish_Phrases 17199 6.09 8.87 4.99 51 MIME_HTML_MOSTLY 16684 4.14 8.61 2.37 52 HTML_IMAGE_RATIO_02 16074 7.25 8.29 6.84 53 UNPARSEABLE_RELAY 14911 7.87 7.69 7.94 54 BAYES_60 14793 7.23 7.63 7.07 55 RCVD_IN_MSPIKE_H4 14668 9.74 7.57 10.60 56 TR_XM_UnparsRelay 14346 6.14 7.40 5.64 57 RELAYCOUNTRY_CA 12800 2.83 6.60 1.34 58 TR_XM_PhishingBody 12522 4.60 6.46 3.86 59 TooManyTo_001 11991 7.19 6.19 7.59 60 HTML_IMAGE_RATIO_08 11721 3.90 6.05 3.05 61 XM_SendGrid 11721 6.83 6.05 7.14 62 XMSubMetaSx_00 11626 4.34 6.00 3.68 63 URIBL_SBL_A 10924 1.77 5.63 0.25 64 BAYES_95 10584 3.24 5.46 2.36 65 T_REMOTE_IMAGE 10498 4.15 5.41 3.65 66 XM_H_Long_From01 10386 5.85 5.36 6.04 67 HTML_IMAGE_RATIO_04 10319 7.01 5.32 7.68 68 XM_OfRef6 9840 2.17 5.08 1.03 69 TR_XM_SpammyWords5 9794 2.39 5.05 1.34 70 RCVD_IN_RP_SAFE 9769 7.10 5.04 7.91 71 KHOP_HELO_FCRDNS 9739 2.65 5.02 1.72 72 XMNumbers 9426 3.49 4.86 2.95 73 XM_UB50 9397 2.11 4.85 1.04 74 SpammyFromTLD_01 9143 1.81 4.72 0.66 75 RELAYCOUNTRY_FR 8721 1.47 4.50 0.27 76 RCVD_IN_RP_CERTIFIED 8328 6.41 4.30 7.24 77 HTML_IMAGE_RATIO_06 8152 4.60 4.20 4.75 78 XM_B_Phish66 7372 2.44 3.80 1.90 79 XM_UB99 7369 1.08 3.80 0.01 80 XM_SPF_SoftFail 7322 2.21 3.78 1.60 81 RCVD_IN_MSPIKE_BL 7307 1.19 3.77 0.18 82 XM_B_SpammyTLD 7301 2.58 3.77 2.11 83 XM_B_COVIDMETA 7281 1.65 3.76 0.83 84 DKIM_INVALID 7252 3.13 3.74 2.89 85 TR_XM_MSPIKECOMBO 7213 1.18 3.72 0.17 86 HTML_IMAGE_ONLY_12 7057 1.24 3.64 0.29 87 SUBJ_ALL_CAPS 6801 2.20 3.51 1.68 88 TM2_M_URI_OPT_OUT 6781 3.54 3.50 3.56 89 BODY_URI_ONLY 6659 1.01 3.43 0.05 90 XM_DK_Undo_01 6567 2.12 3.39 1.62 91 HTML_SHORT_LINK_IMG_1 6447 0.96 3.33 0.02 92 SpammyFromTLD_02 6419 1.22 3.31 0.40 93 TR_XM_DK_SendGrid 6384 4.27 3.29 4.66 94 XMDiploma_00 6267 2.02 3.23 1.55 95 MIME_HTML_ONLY_MULTI 6058 5.14 3.12 5.93 96 RCVD_IN_RP_RNBL 5890 0.92 3.04 0.08 97 TR_XM_MaxBayes 5809 0.85 3.00 0.01 98 MIME_QP_LONG_LINE 5679 4.79 2.93 5.52 99 XMStrtUSub 5651 4.04 2.91 4.49 100 TR_LOTS_OF_MONEY3 5465 1.20 2.82 0.56 101 T_FILL_THIS_FORM_SHORT 5412 1.34 2.79 0.76 102 URI_HEX 5408 1.66 2.79 1.21 103 XMBody_17 5392 1.18 2.78 0.55 104 XM_DIRTYINTL 5390 1.06 2.78 0.39 105 URI_TRY_3LD 5367 1.76 2.77 1.37 106 XM_UB60 5021 0.82 2.59 0.12 107 FROM_EXCESS_BASE64 4887 3.39 2.52 3.73 108 T_XMDrugObfuBody_08 4872 1.75 2.51 1.45 109 TR_XM_SB_Phish 4829 2.34 2.49 2.29 110 XM_UB80 4814 0.72 2.48 0.03 111 XM_UB999 4809 0.71 2.48 0.01 112 XMSubPhish11 4667 2.30 2.41 2.26 113 XMBrknScrpt_02 4549 1.21 2.35 0.76 114 RCVD_IN_PSBL 4489 0.90 2.32 0.34 115 XM_CamelCaseFrm001 4402 1.86 2.27 1.70 116 XM_B_Unsub2 4354 1.85 2.25 1.69 117 TM2_M_VERY_LONG_WORD 4276 1.58 2.21 1.33 118 T_XMDrugObfuBody_14 4121 1.96 2.13 1.90 119 TR_XM_COVIDMETA1 4088 0.92 2.11 0.45 120 RCVD_IN_MSPIKE_L5 4025 0.65 2.08 0.09 121 T_TooManySym_01 3984 3.88 2.05 4.60 122 XMStockSpam_06 3921 1.94 2.02 1.90 123 RCVD_IN_IADB_LISTED 3901 4.72 2.01 5.79 124 BAYES_40 3841 4.33 1.98 5.25 125 XMSexyCombo_01 3810 1.28 1.97 1.01 126 XM_B_SpammyWords4 3766 1.31 1.94 1.06 127 XM_RXBody 3658 0.71 1.89 0.24 128 HTML_FONT_SIZE_LARGE 3582 0.59 1.85 0.09 129 RCVD_IN_IADB_SPF 3451 4.14 1.78 5.07 130 XMBdyGiftCard01 3437 1.02 1.77 0.73 131 FORGED_GMAIL_RCVD 3351 0.92 1.73 0.60 132 TR_XM_SpammyWords3 3314 0.55 1.71 0.09 133 RCVD_IN_IADB_DK 3274 3.63 1.69 4.40 134 RCVD_IN_IADB_SENDERID 3252 3.73 1.68 4.55 135 TR_Symld_Words 3221 1.46 1.66 1.38 136 TR_XM_FormFill 3157 0.47 1.63 0.01 137 PDS_OTHER_BAD_TLD 3122 0.95 1.61 0.69 138 T_XMDrugObfuBody_00 3022 0.99 1.56 0.77 139 XM_URI_RBL 3012 0.56 1.55 0.17 140 XM_OfRef7 2999 0.53 1.55 0.13 141 BOTNET_NORDNS 2986 0.45 1.54 0.02 142 HTML_MIME_NO_HTML_TAG 2980 1.79 1.54 1.89 143 TR_Caps_n_Bayes_99 2959 0.47 1.53 0.05 144 HK_RANDOM_REPLYTO 2948 0.58 1.52 0.21 145 XMGenDplmaNmb 2928 0.99 1.51 0.78 146 ALL_TRUSTED 2925 8.41 1.51 11.13 147 URI_PHP_REDIR 2919 0.43 1.51 0.01 148 BAYES_20 2885 3.49 1.49 4.28 149 URI_NOVOWEL 2865 2.59 1.48 3.02 150 XM_UB95 2850 0.42 1.47 0.01 151 T_XMHurry_00 2775 1.01 1.43 0.85 152 MAILING_LIST_MULTI 2649 2.00 1.37 2.25 153 XMSubMetaI_00 2641 0.78 1.36 0.55 154 XM_ProductURIs 2634 1.72 1.36 1.87 155 RELAYCOUNTRY_UA 2584 0.42 1.33 0.06 156 TR_XM_COVIDMETA4 2575 0.60 1.33 0.32 157 TR_XM_PHPDW 2462 0.58 1.27 0.30 158 URI_NO_WWW_BIZ_CGI 2452 0.37 1.26 0.01 159 TR_XM_PHPForged 2398 0.54 1.24 0.26 160 TR_XM_BayesRelay 2397 0.36 1.24 0.01 161 TR_XM_FormFill2 2377 0.53 1.23 0.26 162 XM_H_PHPOS 2372 0.53 1.22 0.25 163 BAYES_00 2346 11.01 1.21 14.87 164 RELAYCOUNTRY_AL 2330 0.34 1.20 0.00 165 TR_MetaPhish_Combo_01 2330 0.89 1.20 0.77 166 RELAYCOUNTRY_GB 2275 0.99 1.17 0.91 167 FROM_SUSPICIOUS_NTLD 2259 0.37 1.17 0.06 168 HTTPS_HTTP_MISMATCH 2248 0.82 1.16 0.69 169 XMHTML_After_End 2243 0.92 1.16 0.82 170 FROM_SUSPICIOUS_NTLD_FP 2152 0.35 1.11 0.05 171 TR_XM_RelayPhish 2135 0.36 1.10 0.07 172 NUMERIC_HTTP_ADDR 2121 0.64 1.09 0.45 173 RELAYCOUNTRY_DE 2090 0.61 1.08 0.42 174 TR_XM_INV_DKIM 2075 0.37 1.07 0.09 175 XMSubMetaSxObfu_03 2060 1.00 1.06 0.97 176 XMPhish08 2025 0.48 1.04 0.25 177 URG_BIZ 1988 0.34 1.03 0.06 178 HELO_NODOT 1921 1.37 0.99 1.52 179 HELO_NO_DOMAIN 1919 1.37 0.99 1.52 180 URI_GOOGLE_PROXY 1838 0.34 0.95 0.10 181 XMBody_78 1827 0.59 0.94 0.45 182 T_Symld_Words_02 1798 0.68 0.93 0.58 183 XMPhish30 1778 0.80 0.92 0.75 184 LongTLD 1775 0.36 0.92 0.14 185 TR_XM_DK_Bayes 1758 7.42 0.91 9.99 186 XMMoneyMeta_00 1740 0.61 0.90 0.50 187 XMPhish14 1739 0.89 0.90 0.89 188 TR_XM_DK_Bayes1 1721 7.21 0.89 9.71 189 XM_PDF 1704 3.14 0.88 4.03 190 XMSexyCombo_04 1701 0.73 0.88 0.68 191 LOADSA_MONEY_COMBO 1689 0.27 0.87 0.04 192 RCVD_IN_MSPIKE_L4 1679 0.26 0.87 0.03 193 DIET_1 1649 1.04 0.85 1.12 194 XM_H_Long_From02 1644 0.94 0.85 0.97 195 RDNS_DYNAMIC 1632 0.58 0.84 0.47 196 T_MONEY_PERCENT 1603 0.34 0.83 0.15 197 TR_LOTS_OF_MONEY2 1603 0.34 0.83 0.15 198 BAYES_05 1598 2.11 0.82 2.61 199 TR_Sbj_FN_Bdy 1581 0.36 0.82 0.17 200 INVESTMENT_ADVICE 1569 0.32 0.81 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 445810 92.08 95.51 90.72 2 RELAYCOUNTRY_US 420074 82.59 75.25 85.49 3 DKIM_SIGNED 372473 78.66 85.93 75.80 4 XM_DK_Pass 367219 77.34 83.94 74.73 5 XM_B_Unicode 361515 75.09 78.94 73.57 6 DKIM_VALID 358261 75.53 82.19 72.91 7 DCC_CHECK_NEGATIVE 280400 46.90 21.13 57.06 8 BAYES_50 271044 49.55 35.33 55.16 9 DKIM_VALID_AU 270728 57.21 62.58 55.09 10 XMListUnsubscribeExists 249945 56.53 70.89 50.86 11 XM_B_SpammyWords 246237 55.76 70.10 50.11 12 XM_B_Unicode3 219895 44.08 42.40 44.75 13 DCC_CHECK 201074 51.18 77.21 40.92 14 T_TM2_M_HEADER_IN_MSG 148344 27.76 21.61 30.19 15 RCVD_IN_MSPIKE_WL 144435 26.41 18.84 29.39 16 HTML_FONT_LOW_CONTRAST 135938 29.69 34.83 27.66 17 RCVD_IN_MSPIKE_H2 132841 28.28 31.45 27.03 18 DKIM_VALID_EF 130351 27.64 30.45 26.53 19 LOC_TINY_FONT_1 129365 30.16 39.88 26.33 20 MIME_HTML_ONLY 117997 25.94 30.83 24.01 21 FVGT_m_MULTI_ODD 110537 23.43 25.82 22.49 22 XM_B_SpammyWords2 103970 27.36 43.07 21.16 23 XMSubLong 98471 21.43 24.96 20.04 24 T_KAM_HTML_FONT_INVALID 89206 20.04 24.84 18.15 25 RCVD_IN_MSPIKE_H3 80196 14.67 10.47 16.32 26 BAYES_00 73076 11.01 1.21 14.87 27 XM_Body_Dirty_Words 69400 15.60 19.35 14.12 28 XM_Multi_Part_URI 59675 14.67 21.07 12.14 29 XM_B_Unsub 59221 12.70 14.33 12.05 30 ALL_TRUSTED 54687 8.41 1.51 11.13 31 RCVD_IN_MSPIKE_H4 52067 9.74 7.57 10.60 32 TR_XM_DK_Bayes 49071 7.42 0.91 9.99 33 TR_XM_DK_Bayes1 47702 7.21 0.89 9.71 34 XM_Evil_Numbers_Gen 43615 9.69 11.74 8.88 35 LotsOfNums_01 43561 10.08 13.16 8.86 36 XM_DKIMWhitelistDomains 43165 6.42 0.43 8.78 37 TR_XM_DK_Bayes2 42154 6.37 0.79 8.58 38 LOTS_OF_MONEY 41322 9.97 13.93 8.41 39 MPART_ALT_DIFF 40243 8.92 10.76 8.19 40 UNPARSEABLE_RELAY 38997 7.87 7.69 7.94 41 RCVD_IN_RP_SAFE 38891 7.10 5.04 7.91 42 HTML_IMAGE_RATIO_04 37747 7.01 5.32 7.68 43 TooManyTo_001 37274 7.19 6.19 7.59 44 XM_DK_Undo_02 36087 18.68 47.41 7.34 45 RCVD_IN_RP_CERTIFIED 35578 6.41 4.30 7.24 46 XM_SendGrid 35078 6.83 6.05 7.14 47 BAYES_60 34739 7.23 7.63 7.07 48 HTML_IMAGE_RATIO_02 33622 7.25 8.29 6.84 49 XM_H_Trusted_IP 31807 4.64 0.00 6.47 50 FSL_BULK_SIG 30622 7.46 10.56 6.23 51 IN_ZIMBRA_NJ_WHITELIST 30132 4.42 0.07 6.13 52 XM_H_Long_From01 29677 5.85 5.36 6.04 53 MIME_HTML_ONLY_MULTI 29135 5.14 3.12 5.93 54 RCVD_IN_IADB_LISTED 28457 4.72 2.01 5.79 55 TR_XM_UnparsRelay 27718 6.14 7.40 5.64 56 MIME_QP_LONG_LINE 27132 4.79 2.93 5.52 57 TR_XM_SpammyWords4 26655 7.19 11.66 5.42 58 XM_B_SpammyWords3 26356 8.29 15.72 5.36 59 TR_XM_DKIM_Undo 26297 14.91 39.14 5.35 60 BAYES_40 25822 4.33 1.98 5.25 61 RCVD_IN_IADB_SPF 24930 4.14 1.78 5.07 62 XM_B_Phish_Phrases 24516 6.09 8.87 4.99 63 XMSexyCombo_05 23940 6.28 9.83 4.87 64 HTML_IMAGE_RATIO_06 23350 4.60 4.20 4.75 65 TR_XM_DK_SendGrid 22901 4.27 3.29 4.66 66 T_TooManySym_01 22583 3.88 2.05 4.60 67 RCVD_IN_IADB_SENDERID 22336 3.73 1.68 4.55 68 RELAYCOUNTRY_META 22113 9.69 22.83 4.50 69 XMStrtUSub 22040 4.04 2.91 4.49 70 BAYES_99 21920 13.49 36.39 4.46 71 RCVD_IN_IADB_DK 21606 3.63 1.69 4.40 72 BOTNET_IPINHOSTNAME 21126 6.76 12.99 4.30 73 BAYES_20 21038 3.49 1.49 4.28 74 XM_PDF 19786 3.14 0.88 4.03 75 BAYES_80 19247 5.55 9.68 3.92 76 TR_XM_PhishingBody 18971 4.60 6.46 3.86 77 FROM_EXCESS_BASE64 18320 3.39 2.52 3.73 78 XMSubMetaSx_00 18099 4.34 6.00 3.68 79 T_REMOTE_IMAGE 17938 4.15 5.41 3.65 80 BAYES_999 17733 10.62 28.39 3.61 81 RCVD_IN_IADB_VOUCHED 17533 2.79 0.80 3.57 82 TM2_M_URI_OPT_OUT 17472 3.54 3.50 3.56 83 HTML_FONT_FACE_BAD 15340 2.41 0.61 3.12 84 HTML_IMAGE_RATIO_08 15001 3.90 6.05 3.05 85 URI_NOVOWEL 14851 2.59 1.48 3.02 86 XMNumbers 14478 3.49 4.86 2.95 87 XM_UncommonTLD01 14335 5.21 11.02 2.92 88 DKIM_INVALID 14212 3.13 3.74 2.89 89 BAYES_05 12837 2.11 0.82 2.61 90 RCVD_IN_MSPIKE_H5 12172 2.00 0.80 2.48 91 MIME_HTML_MOSTLY 11667 4.14 8.61 2.37 92 BAYES_95 11618 3.24 5.46 2.36 93 RCVD_IN_IADB_OPTIN 11541 1.84 0.55 2.35 94 TR_XM_SB_Phish 11231 2.34 2.49 2.29 95 XMSubPhish11 11106 2.30 2.41 2.26 96 MAILING_LIST_MULTI 11076 2.00 1.37 2.25 97 TR_DCC_Bayes_99 10485 9.45 27.98 2.13 98 XM_B_SpammyTLD 10385 2.58 3.77 2.11 99 TooManyTo_002 9994 1.67 0.75 2.03 100 T_TooManySym_02 9939 1.61 0.55 2.02 101 XMStockSpam_06 9347 1.94 2.02 1.90 102 XM_B_Phish66 9327 2.44 3.80 1.90 103 T_XMDrugObfuBody_14 9325 1.96 2.13 1.90 104 HTML_MIME_NO_HTML_TAG 9268 1.79 1.54 1.89 105 XM_ProductURIs 9185 1.72 1.36 1.87 106 UNTRUSTED_Relay 9165 5.78 15.69 1.87 107 ANY_BOUNCE_MESSAGE 8533 1.41 0.58 1.74 108 BOUNCE_MESSAGE 8531 1.41 0.58 1.74 109 KHOP_HELO_FCRDNS 8452 2.65 5.02 1.72 110 XM_CamelCaseFrm001 8330 1.86 2.27 1.70 111 XM_B_Unsub2 8300 1.85 2.25 1.69 112 SUBJ_ALL_CAPS 8264 2.20 3.51 1.68 113 BOTNET 8011 5.59 15.64 1.63 114 XM_DK_Undo_01 7982 2.12 3.39 1.62 115 XM_SPF_SoftFail 7849 2.21 3.78 1.60 116 IN_HORDE_ADDRESS_BOOK 7809 1.19 0.18 1.59 117 XMDiploma_00 7607 2.02 3.23 1.55 118 HELO_NODOT 7479 1.37 0.99 1.52 119 HELO_NO_DOMAIN 7479 1.37 0.99 1.52 120 INVALID_MSGID 7433 1.20 0.40 1.51 121 T_XMDrugObfuBody_08 7131 1.75 2.51 1.45 122 RCVD_IN_BL_SPAMCOP_NET 6885 3.59 9.13 1.40 123 TVD_RCVD_IP 6819 1.06 0.21 1.39 124 TR_Symld_Words 6800 1.46 1.66 1.38 125 TooManyTo_003 6722 1.16 0.63 1.37 126 URI_TRY_3LD 6709 1.76 2.77 1.37 127 MSGID_NOFQDN1 6675 0.98 0.02 1.36 128 TO_MALFORMED 6611 0.97 0.02 1.35 129 RELAYCOUNTRY_CA 6596 2.83 6.60 1.34 130 TR_XM_SpammyWords5 6577 2.39 5.05 1.34 131 TM2_M_VERY_LONG_WORD 6526 1.58 2.21 1.33 132 USER_IN_DEF_DKIM_WL 6451 0.95 0.03 1.31 133 XMSubNoVowel 6063 1.10 0.76 1.23 134 URI_HEX 5963 1.66 2.79 1.21 135 HELO_MISC_IP 5635 0.92 0.35 1.15 136 XM_GoogleGroups 5536 0.95 0.50 1.13 137 TR_MSPIKEBAYES00 5507 0.81 0.01 1.12 138 XMCapTrack 5502 0.91 0.37 1.12 139 DIET_1 5492 1.04 0.85 1.12 140 XM_B_SpammyWords4 5232 1.31 1.94 1.06 141 DKIM_ADSP_CUSTOM_MED 5132 0.96 0.75 1.04 142 XM_UB50 5092 2.11 4.85 1.04 143 XM_OfRef6 5058 2.17 5.08 1.03 144 XMGappySubj_01 5010 0.79 0.19 1.02 145 XMSexyCombo_01 4959 1.28 1.97 1.01 146 XMSubMetaSxObfu_03 4784 1.00 1.06 0.97 147 XM_H_Long_From02 4776 0.94 0.85 0.97 148 TooManyTo_004 4763 0.85 0.54 0.97 149 XMBody_95 4693 0.73 0.18 0.96 150 XMBSHREFv2 4572 0.72 0.20 0.93 151 RELAYCOUNTRY_GB 4476 0.99 1.17 0.91 152 XMPhish14 4351 0.89 0.90 0.89 153 T_XMHurry_00 4154 1.01 1.43 0.85 154 XM_B_COVIDMETA 4058 1.65 3.76 0.83 155 XMHTML_After_End 4045 0.92 1.16 0.82 156 TooManyTo_005 3858 0.70 0.48 0.79 157 XMGenDplmaNmb 3851 0.99 1.51 0.78 158 TR_MetaPhish_Combo_01 3794 0.89 1.20 0.77 159 T_XMDrugObfuBody_00 3790 0.99 1.56 0.77 160 FROM_GOV_DKIM_AU 3779 0.60 0.17 0.77 161 T_FILL_THIS_FORM_SHORT 3740 1.34 2.79 0.76 162 XMBrknScrpt_02 3711 1.21 2.35 0.76 163 XMPhish30 3687 0.80 0.92 0.75 164 XMBdyGiftCard01 3569 1.02 1.77 0.73 165 NML_ADSP_CUSTOM_MED 3546 0.69 0.60 0.72 166 HTTPS_HTTP_MISMATCH 3400 0.82 1.16 0.69 167 PDS_OTHER_BAD_TLD 3399 0.95 1.61 0.69 168 PLING_QUERY 3334 0.66 0.60 0.68 169 XMSexyCombo_04 3328 0.73 0.88 0.68 170 SpammyFromTLD_01 3239 1.81 4.72 0.66 171 HTML_IMAGE_ONLY_20 2976 0.59 0.56 0.61 172 FORGED_GMAIL_RCVD 2952 0.92 1.73 0.60 173 FILL_THIS_FORM 2948 0.56 0.45 0.60 174 T_TooManySym_03 2944 0.49 0.20 0.60 175 XM_SPF_Unknown 2858 0.57 0.54 0.58 176 T_Symld_Words_02 2840 0.68 0.93 0.58 177 TR_XM_SpammyWords2 2759 4.82 15.62 0.56 178 TR_LOTS_OF_MONEY3 2750 1.20 2.82 0.56 179 XMBody_17 2718 1.18 2.78 0.55 180 T_OBFU_PDF_ATTACH 2717 0.43 0.12 0.55 181 XMSubMetaI_00 2689 0.78 1.36 0.55 182 XM_Body_Obfu01 2670 0.51 0.44 0.54 183 XM_ShortIntro_01 2577 0.45 0.27 0.52 184 MPART_ALT_DIFF_COUNT 2548 0.50 0.45 0.52 185 XMNoVowels 2540 0.48 0.39 0.52 186 XMHTMLBadTable_001 2525 0.52 0.55 0.51 187 XMSubMetaSx_01 2443 0.42 0.23 0.50 188 XMMoneyMeta_00 2442 0.61 0.90 0.50 189 SUBJ_DOLLARS 2416 0.55 0.71 0.49 190 XM_H_PHPMailer 2379 0.49 0.50 0.48 191 RDNS_DYNAMIC 2331 0.58 0.84 0.47 192 TM2_M_A_HREF_HREF 2331 0.55 0.73 0.47 193 USER_IN_WHITELIST 2303 0.34 0.00 0.47 194 USER_IN_WELCOMELIST 2303 0.34 0.00 0.47 195 TVD_SPACE_RATIO_MINFP 2300 0.45 0.41 0.47 196 SHORT_HELO_AND_INLINE_IMAGE 2293 0.37 0.12 0.47 197 XMSexyCombo_02 2290 0.37 0.14 0.47 198 TM2_M_BODY_EMPTY 2272 0.35 0.07 0.46 199 NUMERIC_HTTP_ADDR 2231 0.64 1.09 0.45 200 RCVD_IN_SORBS_DUL 2224 0.40 0.26 0.45 ----------------------------------------------------------------------