Email: 433618 Autolearn: 0 AvgScore: 4.18 AvgScanTime: 1.38 sec Spam: 146408 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 1.45 sec Ham: 287210 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.34 sec Time Spent Running SA: 165.77 hours Time Spent Processing Spam: 58.99 hours Time Spent Processing Ham: 106.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135734 90.54 92.71 89.43 2 DKIM_SIGNED 124871 83.40 85.29 82.44 3 XM_DK_Pass 122868 82.39 83.92 81.61 4 DKIM_VALID 121078 81.01 82.70 80.14 5 DCC_CHECK 117663 58.99 80.37 48.10 6 XM_B_Unicode 112002 75.38 76.50 74.81 7 RELAYCOUNTRY_US 109483 81.80 74.78 85.37 8 XMListUnsubscribeExists 102724 62.57 70.16 58.70 9 XM_B_SpammyWords 102480 57.51 70.00 51.15 10 DKIM_VALID_AU 94065 64.78 64.25 65.05 11 XM_DK_Undo_02 72862 22.98 49.77 9.32 12 TR_XM_DKIM_Undo 62715 18.85 42.84 6.63 13 XM_B_SpammyWords2 58592 28.69 40.02 22.92 14 LOC_TINY_FONT_1 58237 35.02 39.78 32.60 15 BAYES_99 58047 17.71 39.65 6.53 16 XM_B_Unicode3 56981 44.06 38.92 46.68 17 HTML_FONT_LOW_CONTRAST 54017 34.19 36.89 32.81 18 BAYES_999 45920 14.19 31.36 5.43 19 TR_DCC_Bayes_99 45793 12.71 31.28 3.24 20 DKIM_VALID_EF 44356 30.67 30.30 30.86 21 RCVD_IN_MSPIKE_H2 43899 28.47 29.98 27.70 22 MIME_HTML_ONLY 43242 26.62 29.54 25.14 23 BAYES_50 42968 46.13 29.35 54.68 24 FVGT_m_MULTI_ODD 39506 24.77 26.98 23.64 25 RELAYCOUNTRY_META 35143 11.11 24.00 4.54 26 T_KAM_HTML_FONT_INVALID 30983 20.00 21.16 19.41 27 XM_Multi_Part_URI 30448 16.49 20.80 14.29 28 XMSubLong 29879 19.95 20.41 19.71 29 RCVD_IN_MSPIKE_WL 29721 27.89 20.30 31.77 30 DCC_CHECK_NEGATIVE 26581 39.59 18.16 50.52 31 T_TM2_M_HEADER_IN_MSG 25858 21.41 17.66 23.31 32 XM_Body_Dirty_Words 25749 16.08 17.59 15.31 33 UNTRUSTED_Relay 23769 6.99 16.23 2.28 34 TR_XM_SpammyWords2 23215 6.23 15.86 1.32 35 BOTNET 23050 6.45 15.74 1.71 36 LOTS_OF_MONEY 21251 11.06 14.51 9.30 37 BOTNET_IPINHOSTNAME 20264 8.46 13.84 5.71 38 XM_B_Unsub 20050 12.50 13.69 11.89 39 XM_B_SpammyWords3 19715 8.14 13.47 5.42 40 TR_XM_SpammyWords4 18799 8.50 12.84 6.29 41 FSL_BULK_SIG 17568 8.61 12.00 6.89 42 BAYES_80 16984 7.07 11.60 4.77 43 LotsOfNums_01 16902 9.38 11.54 8.28 44 RCVD_IN_MSPIKE_H3 16802 15.62 11.48 17.73 45 RCVD_IN_BL_SPAMCOP_NET 16435 4.62 11.23 1.25 46 XM_UncommonTLD01 16035 6.73 10.95 4.57 47 XMSexyCombo_05 15940 7.58 10.89 5.90 48 XM_Evil_Numbers_Gen 13467 10.34 9.20 10.92 49 HTML_IMAGE_RATIO_02 12757 8.46 8.71 8.33 50 UNPARSEABLE_RELAY 12310 8.70 8.41 8.86 51 MPART_ALT_DIFF 12233 6.68 8.36 5.82 52 BAYES_60 12171 8.63 8.31 8.79 53 RCVD_IN_MSPIKE_H4 12126 10.53 8.28 11.67 54 TR_XM_UnparsRelay 11861 6.83 8.10 6.18 55 RELAYCOUNTRY_CA 11745 3.81 8.02 1.66 56 XMSubMetaSx_00 11629 6.25 7.94 5.39 57 XM_B_Phish_Phrases 10724 5.65 7.32 4.80 58 MIME_HTML_MOSTLY 10657 4.51 7.28 3.10 59 TooManyTo_001 9716 7.17 6.64 7.44 60 XM_SendGrid 9365 7.41 6.40 7.92 61 RCVD_IN_RP_SAFE 8879 9.89 6.06 11.84 62 URIBL_SBL_A 8876 2.24 6.06 0.29 63 XM_H_Long_From01 8720 5.96 5.96 5.96 64 BAYES_95 8597 3.98 5.87 3.01 65 RCVD_IN_MSPIKE_BL 8276 2.02 5.65 0.17 66 HTML_IMAGE_RATIO_08 8211 3.50 5.61 2.43 67 T_REMOTE_IMAGE 8190 4.57 5.59 4.05 68 TR_XM_MSPIKECOMBO 8152 1.99 5.57 0.16 69 XM_OfRef6 7945 2.57 5.43 1.12 70 TR_XM_PhishingBody 7898 3.50 5.39 2.53 71 XM_B_SpammyTLD 7708 4.07 5.26 3.46 72 KHOP_HELO_FCRDNS 7651 2.60 5.23 1.27 73 RCVD_IN_RP_CERTIFIED 7630 9.02 5.21 10.96 74 SpammyFromTLD_01 7484 2.00 5.11 0.42 75 XMNumbers 7426 4.21 5.07 3.77 76 TR_XM_SpammyWords5 7404 3.30 5.06 2.40 77 RCVD_IN_RP_RNBL 7111 1.70 4.86 0.09 78 HTML_IMAGE_RATIO_04 7072 6.71 4.83 7.66 79 HTML_IMAGE_RATIO_06 6753 4.15 4.61 3.92 80 RCVD_IN_PSBL 6522 1.58 4.45 0.11 81 RCVD_IN_MSPIKE_L5 6312 1.52 4.31 0.10 82 XM_UB50 6256 2.19 4.27 1.13 83 XMBody_17 5951 2.03 4.06 1.00 84 HTML_IMAGE_ONLY_12 5808 1.43 3.97 0.13 85 TR_XM_DK_SendGrid 5803 4.80 3.96 5.22 86 RELAYCOUNTRY_FR 5692 1.50 3.89 0.28 87 BODY_URI_ONLY 5679 1.34 3.88 0.04 88 HTML_SHORT_LINK_IMG_1 5446 1.27 3.72 0.02 89 TM2_M_VERY_LONG_WORD 5283 2.35 3.61 1.71 90 XM_UB80 5149 1.24 3.52 0.09 91 XM_DK_Undo_01 5127 2.16 3.50 1.48 92 TR_LOTS_OF_MONEY3 4915 1.58 3.36 0.67 93 T_FILL_THIS_FORM_SHORT 4911 1.60 3.35 0.71 94 TR_XM_SB_Phish 4855 2.21 3.32 1.64 95 XM_UB99 4831 1.12 3.30 0.01 96 TR_XM_MaxBayes 4810 1.12 3.29 0.01 97 XMSubPhish11 4793 2.18 3.27 1.62 98 TM2_M_URI_OPT_OUT 4663 3.03 3.18 2.96 99 XM_SPF_SoftFail 4653 2.01 3.18 1.41 100 TR_Symld_Words 4634 1.94 3.17 1.31 101 SUBJ_ALL_CAPS 4591 2.08 3.14 1.55 102 XMBdyGiftCard01 4507 2.15 3.08 1.68 103 URI_HEX 4479 1.90 3.06 1.31 104 XMBrknScrpt_02 4331 1.55 2.96 0.83 105 XM_UB60 4282 1.09 2.92 0.16 106 T_Symld_Words_02 4182 1.25 2.86 0.44 107 XMStrtUSub 4168 4.57 2.85 5.45 108 XM_DIRTYINTL 4153 1.23 2.84 0.41 109 PDS_FROM_2_EMAILS 3878 0.91 2.65 0.02 110 FROM_2_EMAILS_SHORT 3866 0.90 2.64 0.01 111 DKIM_INVALID 3793 2.39 2.59 2.29 112 PDS_TO_EQ_FROM_NAME 3724 0.87 2.54 0.01 113 XM_B_Phish66 3674 1.70 2.51 1.28 114 TVD_SPACE_RATIO_MINFP 3641 1.06 2.49 0.34 115 NAME_EMAIL_DIFF 3497 0.86 2.39 0.08 116 URI_TRY_3LD 3476 1.66 2.37 1.29 117 FORGED_GMAIL_RCVD 3334 1.16 2.28 0.60 118 NO_FM_NAME_IP_HOSTN 3290 0.76 2.25 0.01 119 MIME_HTML_ONLY_MULTI 3203 3.23 2.19 3.76 120 XM_CamelCaseFrm001 3189 2.07 2.18 2.01 121 TVD_SPACE_RATIO 3147 0.98 2.15 0.38 122 RELAYCOUNTRY_UA 3138 0.79 2.14 0.10 123 T_XMDrugObfuBody_14 3121 2.05 2.13 2.01 124 XM_B_COVIDMETA 3047 1.32 2.08 0.93 125 TR_XM_FormFill 2969 0.72 2.03 0.05 126 PDS_OTHER_BAD_TLD 2935 1.41 2.00 1.10 127 XMDiploma_00 2934 1.87 2.00 1.80 128 FROM_EXCESS_BASE64 2929 3.55 2.00 4.34 129 XM_UB999 2922 0.68 2.00 0.01 130 XMSexyCombo_01 2908 1.97 1.99 1.97 131 XM_B_Unsub2 2905 1.49 1.98 1.24 132 TR_XM_SpammyWords3 2897 0.71 1.98 0.06 133 XMSubMetaD_03 2799 0.69 1.91 0.07 134 HTML_FONT_SIZE_LARGE 2786 0.68 1.90 0.05 135 BAYES_40 2774 3.55 1.89 4.40 136 TR_Mismatch_TLD_02 2714 0.69 1.85 0.10 137 XMSlimDrugH 2713 0.79 1.85 0.25 138 HK_RANDOM_REPLYTO 2692 0.76 1.84 0.21 139 LONG_JUNK_URI 2681 0.65 1.83 0.05 140 XMSubMetaD_00 2662 0.66 1.82 0.07 141 TR_XM_BayesRelay 2620 0.61 1.79 0.01 142 XMStockSpam_06 2593 2.23 1.77 2.46 143 MIME_QP_LONG_LINE 2568 3.23 1.75 3.98 144 XM_UB95 2561 0.60 1.75 0.02 145 DRUGS_ERECTILE 2550 0.62 1.74 0.05 146 T_XMDrugObfuBody_08 2541 1.60 1.74 1.53 147 XMSolicitRefs_0 2436 0.72 1.66 0.25 148 XM_B_SpammyWords4 2375 0.87 1.62 0.48 149 URI_NOVOWEL 2318 2.44 1.58 2.87 150 T_XMDrugObfuBody_00 2314 1.22 1.58 1.03 151 T_TooManySym_01 2240 3.92 1.53 5.14 152 BOTNET_NORDNS 2236 0.53 1.53 0.02 153 XMPhish08 2216 0.62 1.51 0.16 154 BAYES_20 2207 2.81 1.51 3.47 155 FROM_SUSPICIOUS_NTLD 2206 0.57 1.51 0.10 156 TR_XM_PHPDW 2187 0.76 1.49 0.39 157 DRUGS_ANXIETY 2180 0.51 1.49 0.01 158 NUMERIC_HTTP_ADDR 2172 0.73 1.48 0.35 159 FROM_SUSPICIOUS_NTLD_FP 2166 0.56 1.48 0.08 160 SERGIO_SUBJECT_VIAGRA01 2150 0.50 1.47 0.01 161 XMSubMetaD_01 2142 0.50 1.46 0.01 162 XMSubMetaD_02 2139 0.50 1.46 0.01 163 TR_XM_PHPForged 2136 0.70 1.46 0.32 164 XMSubMetaD_04 2134 0.50 1.46 0.01 165 TR_XM_FormFill2 2123 0.70 1.45 0.32 166 XM_H_PHPOS 2119 0.69 1.45 0.31 167 DATE_IN_PAST_03_06 2089 0.53 1.43 0.07 168 SpammyFromTLD_02 2088 0.58 1.43 0.15 169 LongTLD 2084 0.57 1.42 0.13 170 RCVD_IN_IADB_LISTED 1993 3.42 1.36 4.47 171 MIMEOLE_DIRECT_TO_MX 1969 0.46 1.34 0.00 172 HTTPS_HTTP_MISMATCH 1952 0.85 1.33 0.60 173 MONEY_FRAUD_8 1943 0.45 1.33 0.00 174 XMSubNoVowel 1870 1.02 1.28 0.89 175 XM_OfRef7 1863 0.55 1.27 0.17 176 XMSubMetaSSx_00 1857 0.63 1.27 0.30 177 T_XMHurry_00 1844 0.92 1.26 0.75 178 RDNS_DYNAMIC 1824 0.85 1.25 0.64 179 TR_XM_SpoofStaff 1817 0.57 1.24 0.23 180 XMSpoofStaff2 1803 0.57 1.23 0.23 181 XM_LoanWordsFrm 1800 0.46 1.23 0.07 182 ADVANCE_FEE_5_NEW_MONEY 1775 0.41 1.21 0.00 183 XMGenDplmaNmb 1759 1.05 1.20 0.97 184 URI_ONLY_MSGID_MALF 1732 0.40 1.18 0.00 185 RELAYCOUNTRY_AL 1720 0.40 1.17 0.00 186 RCVD_IN_IADB_SPF 1709 2.95 1.17 3.86 187 URI_GOOGLE_PROXY 1703 0.42 1.16 0.04 188 XMSexyCombo_04 1687 1.41 1.15 1.53 189 TR_Caps_n_Bayes_99 1663 0.43 1.14 0.07 190 HDR_ORDER_FTSDMCXX_DIRECT 1647 0.38 1.12 0.00 191 TR_XM_COVIDMETA4 1628 0.55 1.11 0.26 192 RCVD_IN_IADB_DK 1604 2.56 1.10 3.31 193 RCVD_IN_IADB_SENDERID 1600 2.65 1.09 3.45 194 XM_ProductURIs 1579 1.09 1.08 1.10 195 XM_H_SpoofStaff4 1528 0.51 1.04 0.24 196 TR_XM_PSC1 1525 0.50 1.04 0.23 197 TR_XM_RelayPhish 1518 0.41 1.04 0.09 198 XMSubMetaI_00 1509 0.67 1.03 0.49 199 HTML_MIME_NO_HTML_TAG 1443 1.28 0.99 1.43 200 XMHTML_After_End 1440 0.67 0.98 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 256862 90.54 92.71 89.43 2 RELAYCOUNTRY_US 245196 81.80 74.78 85.37 3 DKIM_SIGNED 236764 83.40 85.29 82.44 4 XM_DK_Pass 234381 82.39 83.92 81.61 5 DKIM_VALID 230178 81.01 82.70 80.14 6 XM_B_Unicode 214852 75.38 76.50 74.81 7 DKIM_VALID_AU 186843 64.78 64.25 65.05 8 XMListUnsubscribeExists 168587 62.57 70.16 58.70 9 BAYES_50 157052 46.13 29.35 54.68 10 XM_B_SpammyWords 146910 57.51 70.00 51.15 11 DCC_CHECK_NEGATIVE 145105 39.59 18.16 50.52 12 DCC_CHECK 138141 58.99 80.37 48.10 13 XM_B_Unicode3 134078 44.06 38.92 46.68 14 HTML_FONT_LOW_CONTRAST 94233 34.19 36.89 32.81 15 LOC_TINY_FONT_1 93636 35.02 39.78 32.60 16 RCVD_IN_MSPIKE_WL 91236 27.89 20.30 31.77 17 DKIM_VALID_EF 88642 30.67 30.30 30.86 18 RCVD_IN_MSPIKE_H2 79564 28.47 29.98 27.70 19 MIME_HTML_ONLY 72192 26.62 29.54 25.14 20 FVGT_m_MULTI_ODD 67896 24.77 26.98 23.64 21 T_TM2_M_HEADER_IN_MSG 66963 21.41 17.66 23.31 22 XM_B_SpammyWords2 65832 28.69 40.02 22.92 23 XMSubLong 56612 19.95 20.41 19.71 24 T_KAM_HTML_FONT_INVALID 55760 20.00 21.16 19.41 25 RCVD_IN_MSPIKE_H3 50919 15.62 11.48 17.73 26 XM_Body_Dirty_Words 43980 16.08 17.59 15.31 27 XM_Multi_Part_URI 41045 16.49 20.80 14.29 28 BAYES_00 35097 8.41 0.94 12.22 29 XM_DKIMWhitelistDomains 34715 8.02 0.05 12.09 30 XM_B_Unsub 34153 12.50 13.69 11.89 31 RCVD_IN_RP_SAFE 34012 9.89 6.06 11.84 32 RCVD_IN_MSPIKE_H4 33530 10.53 8.28 11.67 33 RCVD_IN_RP_CERTIFIED 31485 9.02 5.21 10.96 34 XM_Evil_Numbers_Gen 31371 10.34 9.20 10.92 35 ALL_TRUSTED 30410 7.34 0.96 10.59 36 TR_XM_DK_Bayes 28458 6.82 0.78 9.91 37 TR_XM_DK_Bayes1 27960 6.71 0.76 9.74 38 XM_DK_Undo_02 26779 22.98 49.77 9.32 39 LOTS_OF_MONEY 26699 11.06 14.51 9.30 40 UNPARSEABLE_RELAY 25435 8.70 8.41 8.86 41 TR_XM_DK_Bayes2 25332 6.06 0.66 8.82 42 BAYES_60 25252 8.63 8.31 8.79 43 HTML_IMAGE_RATIO_02 23928 8.46 8.71 8.33 44 LotsOfNums_01 23791 9.38 11.54 8.28 45 XM_SendGrid 22757 7.41 6.40 7.92 46 HTML_IMAGE_RATIO_04 22007 6.71 4.83 7.66 47 TooManyTo_001 21363 7.17 6.64 7.44 48 FSL_BULK_SIG 19776 8.61 12.00 6.89 49 TR_XM_DKIM_Undo 19038 18.85 42.84 6.63 50 BAYES_99 18742 17.71 39.65 6.53 51 TR_XM_SpammyWords4 18072 8.50 12.84 6.29 52 TR_XM_UnparsRelay 17737 6.83 8.10 6.18 53 XM_H_Long_From01 17108 5.96 5.96 5.96 54 XMSexyCombo_05 16940 7.58 10.89 5.90 55 MPART_ALT_DIFF 16726 6.68 8.36 5.82 56 BOTNET_IPINHOSTNAME 16401 8.46 13.84 5.71 57 XMStrtUSub 15658 4.57 2.85 5.45 58 BAYES_999 15590 14.19 31.36 5.43 59 XM_B_SpammyWords3 15561 8.14 13.47 5.42 60 XMSubMetaSx_00 15482 6.25 7.94 5.39 61 TR_XM_DK_SendGrid 14997 4.80 3.96 5.22 62 T_TooManySym_01 14755 3.92 1.53 5.14 63 IN_ZIMBRA_NJ_WHITELIST 14637 3.42 0.12 5.10 64 XM_B_Phish_Phrases 13783 5.65 7.32 4.80 65 BAYES_80 13694 7.07 11.60 4.77 66 XM_UncommonTLD01 13134 6.73 10.95 4.57 67 RELAYCOUNTRY_META 13027 11.11 24.00 4.54 68 RCVD_IN_IADB_LISTED 12839 3.42 1.36 4.47 69 BAYES_40 12637 3.55 1.89 4.40 70 FROM_EXCESS_BASE64 12469 3.55 2.00 4.34 71 T_REMOTE_IMAGE 11623 4.57 5.59 4.05 72 MIME_QP_LONG_LINE 11427 3.23 1.75 3.98 73 HTML_IMAGE_RATIO_06 11245 4.15 4.61 3.92 74 RCVD_IN_IADB_SPF 11094 2.95 1.17 3.86 75 XMNumbers 10835 4.21 5.07 3.77 76 MIME_HTML_ONLY_MULTI 10790 3.23 2.19 3.76 77 BAYES_20 9977 2.81 1.51 3.47 78 XM_B_SpammyTLD 9940 4.07 5.26 3.46 79 RCVD_IN_IADB_SENDERID 9904 2.65 1.09 3.45 80 RCVD_IN_IADB_DK 9512 2.56 1.10 3.31 81 TR_DCC_Bayes_99 9313 12.71 31.28 3.24 82 MIME_HTML_MOSTLY 8906 4.51 7.28 3.10 83 BAYES_95 8645 3.98 5.87 3.01 84 TM2_M_URI_OPT_OUT 8495 3.03 3.18 2.96 85 RCVD_IN_IADB_VOUCHED 8436 2.15 0.60 2.94 86 URI_NOVOWEL 8252 2.44 1.58 2.87 87 INVALID_MSGID 8104 2.01 0.43 2.82 88 XM_H_Trusted_IP 7800 1.80 0.00 2.72 89 MSGID_NOFQDN1 7653 1.80 0.10 2.66 90 TVD_RCVD_IP 7608 1.88 0.36 2.65 91 T_TooManySym_02 7596 1.90 0.45 2.64 92 TR_XM_PhishingBody 7279 3.50 5.39 2.53 93 XMStockSpam_06 7075 2.23 1.77 2.46 94 HTML_IMAGE_RATIO_08 6968 3.50 5.61 2.43 95 TR_XM_SpammyWords5 6884 3.30 5.06 2.40 96 RCVD_IN_MSPIKE_H5 6787 1.75 0.54 2.36 97 DKIM_INVALID 6586 2.39 2.59 2.29 98 TO_MALFORMED 6568 1.53 0.05 2.29 99 UNTRUSTED_Relay 6546 6.99 16.23 2.28 100 XM_PDF 5893 1.46 0.30 2.05 101 HELO_MISC_IP 5880 1.53 0.50 2.05 102 XM_CamelCaseFrm001 5785 2.07 2.18 2.01 103 T_XMDrugObfuBody_14 5766 2.05 2.13 2.01 104 BAYES_05 5723 1.61 0.86 1.99 105 RCVD_IN_IADB_OPTIN 5706 1.48 0.50 1.99 106 XMSexyCombo_01 5648 1.97 1.99 1.97 107 MAILING_LIST_MULTI 5428 1.55 0.88 1.89 108 IN_HORDE_ADDRESS_BOOK 5225 1.34 0.41 1.82 109 XMDiploma_00 5173 1.87 2.00 1.80 110 TM2_M_VERY_LONG_WORD 4914 2.35 3.61 1.71 111 BOTNET 4912 6.45 15.74 1.71 112 XMBdyGiftCard01 4819 2.15 3.08 1.68 113 USER_IN_DEF_DKIM_WL 4806 1.11 0.01 1.67 114 RELAYCOUNTRY_CA 4757 3.81 8.02 1.66 115 TR_XM_SB_Phish 4714 2.21 3.32 1.64 116 XMSubMetaSxObfu_03 4708 1.27 0.54 1.64 117 XMSubPhish11 4646 2.18 3.27 1.62 118 SUBJ_ALL_CAPS 4447 2.08 3.14 1.55 119 XMSexyCombo_04 4406 1.41 1.15 1.53 120 T_XMDrugObfuBody_08 4392 1.60 1.74 1.53 121 XMBSHREFv2 4389 1.06 0.13 1.53 122 XM_DK_Undo_01 4255 2.16 3.50 1.48 123 XMBody_95 4145 0.98 0.08 1.44 124 HTML_FONT_FACE_BAD 4137 1.17 0.64 1.44 125 HTML_MIME_NO_HTML_TAG 4096 1.28 0.99 1.43 126 XM_SPF_SoftFail 4059 2.01 3.18 1.41 127 TR_XM_SpammyWords2 3800 6.23 15.86 1.32 128 URI_HEX 3757 1.90 3.06 1.31 129 TR_Symld_Words 3757 1.94 3.17 1.31 130 URI_TRY_3LD 3703 1.66 2.37 1.29 131 XM_B_Phish66 3677 1.70 2.51 1.28 132 KHOP_HELO_FCRDNS 3636 2.60 5.23 1.27 133 TooManyTo_002 3603 0.95 0.37 1.25 134 RCVD_IN_BL_SPAMCOP_NET 3589 4.62 11.23 1.25 135 XM_H_Long_From02 3585 1.06 0.68 1.25 136 XM_B_Unsub2 3572 1.49 1.98 1.24 137 ANY_BOUNCE_MESSAGE 3390 0.90 0.34 1.18 138 BOUNCE_MESSAGE 3389 0.90 0.34 1.18 139 XM_UB50 3251 2.19 4.27 1.13 140 XM_OfRef6 3219 2.57 5.43 1.12 141 PDS_OTHER_BAD_TLD 3167 1.41 2.00 1.10 142 XM_ProductURIs 3165 1.09 1.08 1.10 143 XMGappySubj_01 3055 0.74 0.12 1.06 144 XM_GoogleGroups 3041 0.84 0.41 1.06 145 TR_MSPIKEBAYES00 2978 0.70 0.03 1.04 146 T_XMDrugObfuBody_00 2970 1.22 1.58 1.03 147 XMBody_17 2868 2.03 4.06 1.00 148 XMGenDplmaNmb 2794 1.05 1.20 0.97 149 XM_B_COVIDMETA 2677 1.32 2.08 0.93 150 DKIM_ADSP_CUSTOM_MED 2637 0.87 0.78 0.92 151 XMSubNoVowel 2556 1.02 1.28 0.89 152 TooManyTo_003 2513 0.68 0.30 0.87 153 XMBrknScrpt_02 2377 1.55 2.96 0.83 154 T_TooManySym_03 2244 0.56 0.14 0.78 155 XMSubMetaSx_01 2229 0.59 0.23 0.78 156 T_XMHurry_00 2152 0.92 1.26 0.75 157 TM2_M_A_HREF_HREF 2142 0.67 0.52 0.75 158 XMSexyCombo_02 2091 0.52 0.12 0.73 159 T_FILL_THIS_FORM_SHORT 2027 1.60 3.35 0.71 160 TR_LOTS_OF_MONEY3 1929 1.58 3.36 0.67 161 XMHTMLBadTable_001 1886 0.63 0.59 0.66 162 TooManyTo_004 1862 0.52 0.25 0.65 163 RDNS_DYNAMIC 1847 0.85 1.25 0.64 164 USER_IN_WHITELIST 1820 0.42 0.00 0.63 165 USER_IN_WELCOMELIST 1820 0.42 0.00 0.63 166 NML_ADSP_CUSTOM_MED 1748 0.64 0.70 0.61 167 HELO_NODOT 1739 0.61 0.62 0.61 168 HELO_NO_DOMAIN 1739 0.60 0.60 0.61 169 HTTPS_HTTP_MISMATCH 1727 0.85 1.33 0.60 170 RELAYCOUNTRY_GB 1723 0.56 0.47 0.60 171 TR_MetaPhish_Combo_01 1722 0.72 0.95 0.60 172 FORGED_GMAIL_RCVD 1714 1.16 2.28 0.60 173 XM_B_COPY_HTML 1710 0.66 0.78 0.60 174 XMPhish14 1702 0.56 0.51 0.59 175 XM_B_REG_HTML 1675 0.60 0.65 0.58 176 TooManyTo_005 1636 0.45 0.22 0.57 177 XM_D_tchamptons_WL 1603 0.37 0.02 0.56 178 XM_H_PHPMailer 1570 0.53 0.49 0.55 179 XMBody_78 1488 0.59 0.72 0.52 180 SUBJ_DOLLARS 1484 0.63 0.84 0.52 181 XMHTML_After_End 1467 0.67 0.98 0.51 182 HTML_IMAGE_ONLY_20 1455 0.57 0.70 0.51 183 XMSubMetaI_00 1413 0.67 1.03 0.49 184 XM_B_SpammyWords4 1388 0.87 1.62 0.48 185 HTML_TAG_BALANCE_BODY 1300 0.50 0.59 0.45 186 XMSubMetaSxObfu_02 1269 0.34 0.13 0.44 187 XMPhish30 1260 0.56 0.81 0.44 188 T_Symld_Words_02 1258 1.25 2.86 0.44 189 XM_Body_Obfu01 1247 0.49 0.60 0.43 190 DIET_1 1224 0.56 0.82 0.43 191 XM_ShortIntro_01 1215 0.42 0.42 0.42 192 XM_SPF_Unknown 1206 0.45 0.51 0.42 193 XM_shorewaves_Whitelist 1201 0.28 0.00 0.42 194 SpammyFromTLD_01 1197 2.00 5.11 0.42 195 XMCapTrack 1191 0.33 0.16 0.41 196 RELAYCOUNTRY_DE 1182 0.53 0.76 0.41 197 XM_DIRTYINTL 1164 1.23 2.84 0.41 198 PLING_QUERY 1128 0.48 0.64 0.39 199 TR_XM_PHPDW 1116 0.76 1.49 0.39 200 XMNoVowels 1084 0.33 0.23 0.38 ----------------------------------------------------------------------