Email: 428866 Autolearn: 0 AvgScore: 4.29 AvgScanTime: 1.36 sec Spam: 145682 Autolearn: 0 AvgScore: 13.34 AvgScanTime: 1.48 sec Ham: 283184 Autolearn: 0 AvgScore: -0.37 AvgScanTime: 1.30 sec Time Spent Running SA: 162.45 hours Time Spent Processing Spam: 59.89 hours Time Spent Processing Ham: 102.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139149 90.73 95.52 88.26 2 DKIM_SIGNED 133247 86.05 91.46 83.26 3 XM_DK_Pass 130191 84.77 89.37 82.41 4 DKIM_VALID 128030 83.32 87.88 80.97 5 RELAYCOUNTRY_US 117708 83.18 80.80 84.41 6 XM_B_Unicode 116424 76.90 79.92 75.35 7 DCC_CHECK 115760 59.12 79.46 48.66 8 XMListUnsubscribeExists 110772 64.29 76.04 58.25 9 XM_B_SpammyWords 105661 58.86 72.53 51.83 10 DKIM_VALID_AU 101921 66.79 69.96 65.16 11 XM_DK_Undo_02 78112 24.62 53.62 9.70 12 TR_XM_DKIM_Undo 64537 19.74 44.30 7.11 13 LOC_TINY_FONT_1 64098 35.87 44.00 31.70 14 HTML_FONT_LOW_CONTRAST 62627 35.66 42.99 31.90 15 XM_B_SpammyWords2 62091 30.88 42.62 24.84 16 BAYES_99 60637 18.39 41.62 6.43 17 XM_B_Unicode3 60476 45.51 41.51 47.57 18 BAYES_999 49211 14.98 33.78 5.31 19 TR_DCC_Bayes_99 48056 13.66 32.99 3.72 20 DKIM_VALID_EF 47374 32.11 32.52 31.89 21 RCVD_IN_MSPIKE_H2 45892 29.40 31.50 28.32 22 BAYES_50 44980 46.81 30.88 55.01 23 MIME_HTML_ONLY 38902 26.38 26.70 26.21 24 FVGT_m_MULTI_ODD 37776 24.26 25.93 23.40 25 XMSubLong 33444 22.39 22.96 22.10 26 T_KAM_HTML_FONT_INVALID 33201 19.86 22.79 18.36 27 XM_Body_Dirty_Words 30484 17.00 20.93 14.98 28 XM_Multi_Part_URI 30384 16.87 20.86 14.81 29 RCVD_IN_MSPIKE_WL 30277 29.05 20.78 33.31 30 T_TM2_M_HEADER_IN_MSG 29376 20.75 20.16 21.06 31 RELAYCOUNTRY_META 29200 9.69 20.04 4.37 32 DCC_CHECK_NEGATIVE 27824 39.54 19.10 50.05 33 TR_XM_SpammyWords2 24062 6.18 16.52 0.86 34 XM_UncommonTLD01 21484 7.43 14.75 3.67 35 XM_B_Unsub 21101 12.52 14.48 11.51 36 BOTNET 21068 6.14 14.46 1.85 37 XM_B_SpammyWords3 20979 8.65 14.40 5.69 38 LOTS_OF_MONEY 19128 10.37 13.13 8.94 39 RCVD_IN_MSPIKE_H3 18081 16.08 12.41 17.97 40 LotsOfNums_01 17509 9.98 12.02 8.93 41 BOTNET_IPINHOSTNAME 17058 7.77 11.71 5.74 42 TR_XM_SpammyWords4 16574 7.63 11.38 5.70 43 UNTRUSTED_Relay 15416 4.97 10.58 2.09 44 TooManyTo_001 15296 7.82 10.50 6.44 45 HTML_IMAGE_RATIO_02 15116 9.43 10.38 8.94 46 XM_Evil_Numbers_Gen 14467 10.07 9.93 10.14 47 RCVD_IN_BL_SPAMCOP_NET 14116 4.44 9.69 1.74 48 XMSexyCombo_05 13554 7.11 9.30 5.99 49 BAYES_80 12923 6.44 8.87 5.19 50 UNPARSEABLE_RELAY 12310 9.36 8.45 9.82 51 FSL_BULK_SIG 11895 7.22 8.17 6.74 52 TR_XM_UnparsRelay 11721 7.30 8.05 6.92 53 MPART_ALT_DIFF 11702 5.95 8.03 4.88 54 XM_B_SpammyTLD 11498 4.30 7.89 2.46 55 BAYES_60 11440 8.25 7.85 8.45 56 RELAYCOUNTRY_CA 11299 3.72 7.76 1.64 57 RCVD_IN_MSPIKE_H4 11189 10.90 7.68 12.55 58 XMSubMetaSx_00 10717 5.34 7.36 4.30 59 MIME_HTML_MOSTLY 9715 3.87 6.67 2.43 60 XM_H_Long_From01 9457 6.09 6.49 5.88 61 XM_SendGrid 9340 8.03 6.41 8.86 62 XM_OfRef6 9077 2.92 6.23 1.22 63 RCVD_IN_RP_SAFE 8949 10.41 6.14 12.61 64 XM_B_Phish_Phrases 8315 6.18 5.71 6.42 65 TR_XM_PhishingBody 7908 3.59 5.43 2.64 66 HTML_IMAGE_RATIO_08 7891 3.29 5.42 2.19 67 RCVD_IN_RP_CERTIFIED 7616 9.54 5.23 11.76 68 BAYES_95 7564 3.92 5.19 3.27 69 HTML_IMAGE_RATIO_04 7062 5.76 4.85 6.23 70 XMBody_17 6225 2.33 4.27 1.34 71 TR_XM_SpammyWords5 6132 3.03 4.21 2.43 72 TR_XM_DK_SendGrid 5750 5.34 3.95 6.06 73 BOTNET_NORDNS 5733 1.35 3.94 0.01 74 SpammyFromTLD_01 5556 1.58 3.81 0.44 75 URI_HEX 5501 2.20 3.78 1.38 76 RCVD_IN_MSPIKE_BL 5470 1.37 3.75 0.14 77 TR_XM_MSPIKECOMBO 5421 1.35 3.72 0.14 78 XM_UB50 5294 2.01 3.63 1.17 79 DATE_IN_PAST_12_24 5258 1.25 3.61 0.04 80 DKIM_INVALID 5217 2.73 3.58 2.29 81 TR_LOTS_OF_MONEY3 5167 1.50 3.55 0.45 82 URIBL_SBL_A 5113 1.48 3.51 0.43 83 RELAYCOUNTRY_FR 4947 1.34 3.40 0.28 84 XM_SPF_SoftFail 4831 1.83 3.32 1.07 85 XM_DK_Undo_01 4787 2.03 3.29 1.38 86 HTML_IMAGE_RATIO_06 4713 3.52 3.24 3.67 87 XM_DIRTYINTL 4708 1.37 3.23 0.41 88 XMBdyGiftCard01 4707 2.32 3.23 1.85 89 XMStrtUSub 4606 5.28 3.16 6.36 90 XMNumbers 4456 3.36 3.06 3.52 91 SUBJ_ALL_CAPS 4386 2.50 3.01 2.23 92 TM2_M_URI_OPT_OUT 4333 3.12 2.97 3.20 93 XMBrknScrpt_02 4308 1.65 2.96 0.98 94 T_FILL_THIS_FORM_SHORT 4271 1.39 2.93 0.60 95 XM_B_Phish66 3971 1.67 2.73 1.12 96 T_TooManySym_01 3856 4.72 2.65 5.79 97 XM_B_Unsub2 3818 1.60 2.62 1.08 98 RCVD_IN_MSPIKE_L5 3740 0.92 2.57 0.08 99 SpammyFromTLD_02 3723 0.97 2.56 0.15 100 RCVD_IN_RP_RNBL 3689 0.89 2.53 0.05 101 MIME_HTML_ONLY_MULTI 3682 2.87 2.53 3.05 102 T_XMDrugObfuBody_14 3516 2.39 2.41 2.38 103 XM_CamelCaseFrm001 3457 2.40 2.37 2.41 104 XM_B_SpammyWords4 3345 1.45 2.30 1.01 105 TM2_M_VERY_LONG_WORD 3068 1.66 2.11 1.42 106 XM_UB99 3053 0.71 2.10 0.00 107 FROM_EXCESS_BASE64 3045 3.60 2.09 4.37 108 XMDiploma_00 3004 1.36 2.06 1.00 109 XM_OfRef7 2974 0.80 2.04 0.16 110 BAYES_40 2935 3.58 2.01 4.38 111 XMSexyCombo_01 2898 1.10 1.99 0.64 112 XM_UB60 2894 0.78 1.99 0.15 113 FORGED_GMAIL_RCVD 2791 1.04 1.92 0.59 114 URI_TRY_3LD 2748 1.54 1.89 1.36 115 TR_XM_MaxBayes 2745 0.65 1.88 0.01 116 KHOP_HELO_FCRDNS 2740 1.22 1.88 0.88 117 MIME_QP_LONG_LINE 2684 3.37 1.84 4.16 118 TR_Symld_Words 2659 1.72 1.83 1.67 119 TR_XM_SpammyWords3 2604 0.64 1.79 0.06 120 T_XMHurry_00 2587 1.02 1.78 0.63 121 T_REMOTE_IMAGE 2553 2.85 1.75 3.41 122 TR_XM_SB_Phish 2550 1.74 1.75 1.73 123 BAYES_20 2514 2.66 1.73 3.15 124 T_XMDrugObfuBody_08 2482 1.37 1.70 1.20 125 PDS_OTHER_BAD_TLD 2460 1.33 1.69 1.15 126 T_XMDrugObfuBody_00 2434 1.34 1.67 1.17 127 XMSubNoVowel 2392 1.01 1.64 0.69 128 RCVD_IN_PSBL 2360 0.56 1.62 0.01 129 XMSubPhish11 2315 1.67 1.59 1.71 130 FROM_SUSPICIOUS_NTLD 2271 0.63 1.56 0.15 131 XM_UB80 2230 0.55 1.53 0.05 132 XM_UB999 2205 0.52 1.51 0.00 133 FROM_SUSPICIOUS_NTLD_FP 2204 0.61 1.51 0.14 134 DATE_IN_PAST_06_12 2145 0.70 1.47 0.30 135 TR_XM_FormFill 2121 0.53 1.46 0.05 136 URI_NOVOWEL 2120 2.40 1.46 2.89 137 XMHTML_After_End 2042 0.82 1.40 0.52 138 RCVD_IN_IADB_LISTED 2002 3.54 1.37 4.66 139 XM_Combo_Sbj 2001 0.65 1.37 0.28 140 MAILING_LIST_MULTI 1967 1.73 1.35 1.92 141 XMSlimDrugH 1959 0.62 1.34 0.24 142 LongTLD 1954 0.53 1.34 0.11 143 XMStockSpam_06 1928 1.52 1.32 1.62 144 TR_XM_BayesRelay 1876 0.44 1.29 0.01 145 MIME_CHARSET_FARAWAY 1851 0.49 1.27 0.08 146 TR_Caps_n_Bayes_99 1846 0.77 1.27 0.51 147 HTML_MIME_NO_HTML_TAG 1816 1.62 1.25 1.81 148 XM_B_COVIDMETA 1782 0.92 1.22 0.77 149 SUBJ_DOLLARS 1747 0.85 1.20 0.67 150 RCVD_IN_IADB_SPF 1726 3.06 1.18 4.03 151 TR_Mismatch_TLD_02 1724 0.44 1.18 0.06 152 XMGenDplmaNmb 1721 0.73 1.18 0.50 153 T_Symld_Words_02 1698 0.81 1.17 0.63 154 XM_ProductURIs 1686 1.40 1.16 1.52 155 RELAYCOUNTRY_IN 1633 0.42 1.12 0.06 156 RCVD_IN_IADB_DK 1628 2.67 1.12 3.47 157 XM_H_Long_From02 1627 1.23 1.12 1.29 158 RCVD_IN_IADB_SENDERID 1626 2.76 1.12 3.60 159 NUMERIC_HTTP_ADDR 1625 1.00 1.12 0.94 160 XMPhish08 1615 0.88 1.11 0.76 161 TR_XM_INV_DKIM 1606 0.45 1.10 0.12 162 GOOGLE_DOC_SUSP 1601 0.38 1.10 0.01 163 CHARSET_FARAWAY_HEADER 1555 0.37 1.07 0.02 164 XMPhish30 1528 0.65 1.05 0.44 165 URIBL_BLACK 1523 0.38 1.05 0.03 166 HK_RANDOM_REPLYTO 1520 0.51 1.04 0.24 167 XM_URI_RBL 1509 0.50 1.04 0.23 168 TR_MetaPhish_Combo_01 1484 0.76 1.02 0.63 169 BAYES_00 1480 8.40 1.02 12.20 170 DIET_1 1435 0.60 0.99 0.41 171 RELAYCOUNTRY_NL 1424 0.45 0.98 0.18 172 TR_XM_COVIDMETA4 1415 0.48 0.97 0.23 173 XMSexyCombo_04 1393 0.39 0.96 0.09 174 RDNS_DYNAMIC 1385 0.79 0.95 0.71 175 TR_XM_RelayPhish 1375 0.35 0.94 0.05 176 XMSubMetaSSx_00 1352 0.45 0.93 0.21 177 XMBody_78 1315 0.59 0.90 0.43 178 TR_XM_PHPDW 1312 0.53 0.90 0.33 179 TR_XM_PHPForged 1299 0.48 0.89 0.27 180 HTTPS_HTTP_MISMATCH 1297 0.65 0.89 0.53 181 TR_XM_DK_Bayes 1282 7.26 0.88 10.54 182 TR_XM_FormFill2 1277 0.48 0.88 0.27 183 TR_BOTNET_NEGATE 1276 0.53 0.88 0.35 184 XM_H_PHPOS 1273 0.47 0.87 0.26 185 XMSubMetaI_00 1265 0.70 0.87 0.62 186 XM_UB95 1253 0.31 0.86 0.02 187 DKIM_ADSP_CUSTOM_MED 1251 0.90 0.86 0.91 188 TR_XM_DK_Bayes1 1240 7.12 0.85 10.35 189 RELAYCOUNTRY_DE 1226 0.46 0.84 0.26 190 BAYES_05 1194 1.52 0.82 1.88 191 XM_RXBody 1192 0.40 0.82 0.19 192 NML_ADSP_CUSTOM_MED 1162 0.68 0.80 0.62 193 XMSubMetaSxObfu_03 1142 0.65 0.78 0.58 194 INVESTMENT_ADVICE 1139 0.32 0.78 0.09 195 TM2_M_A_HREF_HREF 1136 0.65 0.78 0.58 196 TR_XM_COVIDMETA1 1120 0.36 0.77 0.15 197 TR_XM_DK_Bayes2 1098 6.51 0.75 9.48 198 THIS_AD 1088 0.39 0.75 0.20 199 URI_GOOGLE_PROXY 1086 0.31 0.75 0.09 200 LOW_PRICE 1082 0.42 0.74 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 249951 90.73 95.52 88.26 2 RELAYCOUNTRY_US 239038 83.18 80.80 84.41 3 DKIM_SIGNED 235775 86.05 91.46 83.26 4 XM_DK_Pass 233378 84.77 89.37 82.41 5 DKIM_VALID 229304 83.32 87.88 80.97 6 XM_B_Unicode 213375 76.90 79.92 75.35 7 DKIM_VALID_AU 184513 66.79 69.96 65.16 8 XMListUnsubscribeExists 164942 64.29 76.04 58.25 9 BAYES_50 155771 46.81 30.88 55.01 10 XM_B_SpammyWords 146769 58.86 72.53 51.83 11 DCC_CHECK_NEGATIVE 141736 39.54 19.10 50.05 12 DCC_CHECK 137784 59.12 79.46 48.66 13 XM_B_Unicode3 134706 45.51 41.51 47.57 14 RCVD_IN_MSPIKE_WL 94318 29.05 20.78 33.31 15 HTML_FONT_LOW_CONTRAST 90327 35.66 42.99 31.90 16 DKIM_VALID_EF 90314 32.11 32.52 31.89 17 LOC_TINY_FONT_1 89757 35.87 44.00 31.70 18 RCVD_IN_MSPIKE_H2 80192 29.40 31.50 28.32 19 MIME_HTML_ONLY 74231 26.38 26.70 26.21 20 XM_B_SpammyWords2 70330 30.88 42.62 24.84 21 FVGT_m_MULTI_ODD 66259 24.26 25.93 23.40 22 XMSubLong 62583 22.39 22.96 22.10 23 T_TM2_M_HEADER_IN_MSG 59629 20.75 20.16 21.06 24 T_KAM_HTML_FONT_INVALID 51985 19.86 22.79 18.36 25 RCVD_IN_MSPIKE_H3 50893 16.08 12.41 17.97 26 XM_Body_Dirty_Words 42432 17.00 20.93 14.98 27 XM_Multi_Part_URI 41946 16.87 20.86 14.81 28 XM_DKIMWhitelistDomains 36083 8.42 0.03 12.74 29 RCVD_IN_RP_SAFE 35716 10.41 6.14 12.61 30 RCVD_IN_MSPIKE_H4 35541 10.90 7.68 12.55 31 BAYES_00 34539 8.40 1.02 12.20 32 RCVD_IN_RP_CERTIFIED 33306 9.54 5.23 11.76 33 ALL_TRUSTED 33287 7.97 0.61 11.75 34 XM_B_Unsub 32590 12.52 14.48 11.51 35 TR_XM_DK_Bayes 29854 7.26 0.88 10.54 36 TR_XM_DK_Bayes1 29305 7.12 0.85 10.35 37 XM_Evil_Numbers_Gen 28721 10.07 9.93 10.14 38 UNPARSEABLE_RELAY 27815 9.36 8.45 9.82 39 XM_DK_Undo_02 27468 24.62 53.62 9.70 40 TR_XM_DK_Bayes2 26842 6.51 0.75 9.48 41 LOTS_OF_MONEY 25329 10.37 13.13 8.94 42 HTML_IMAGE_RATIO_02 25305 9.43 10.38 8.94 43 LotsOfNums_01 25292 9.98 12.02 8.93 44 XM_SendGrid 25086 8.03 6.41 8.86 45 BAYES_60 23927 8.25 7.85 8.45 46 TR_XM_DKIM_Undo 20133 19.74 44.30 7.11 47 TR_XM_UnparsRelay 19603 7.30 8.05 6.92 48 FSL_BULK_SIG 19088 7.22 8.17 6.74 49 TooManyTo_001 18231 7.82 10.50 6.44 50 BAYES_99 18213 18.39 41.62 6.43 51 XM_B_Phish_Phrases 18183 6.18 5.71 6.42 52 XMStrtUSub 18024 5.28 3.16 6.36 53 HTML_IMAGE_RATIO_04 17629 5.76 4.85 6.23 54 TR_XM_DK_SendGrid 17147 5.34 3.95 6.06 55 XMSexyCombo_05 16957 7.11 9.30 5.99 56 XM_H_Long_From01 16651 6.09 6.49 5.88 57 T_TooManySym_01 16392 4.72 2.65 5.79 58 BOTNET_IPINHOSTNAME 16268 7.77 11.71 5.74 59 TR_XM_SpammyWords4 16148 7.63 11.38 5.70 60 XM_B_SpammyWords3 16120 8.65 14.40 5.69 61 BAYES_999 15027 14.98 33.78 5.31 62 BAYES_80 14684 6.44 8.87 5.19 63 IN_ZIMBRA_NJ_WHITELIST 13938 3.26 0.02 4.92 64 MPART_ALT_DIFF 13828 5.95 8.03 4.88 65 RCVD_IN_IADB_LISTED 13189 3.54 1.37 4.66 66 BAYES_40 12398 3.58 2.01 4.38 67 FROM_EXCESS_BASE64 12374 3.60 2.09 4.37 68 RELAYCOUNTRY_META 12366 9.69 20.04 4.37 69 XMSubMetaSx_00 12167 5.34 7.36 4.30 70 MIME_QP_LONG_LINE 11768 3.37 1.84 4.16 71 RCVD_IN_IADB_SPF 11408 3.06 1.18 4.03 72 TR_DCC_Bayes_99 10521 13.66 32.99 3.72 73 XM_UncommonTLD01 10387 7.43 14.75 3.67 74 HTML_IMAGE_RATIO_06 10382 3.52 3.24 3.67 75 RCVD_IN_IADB_SENDERID 10191 2.76 1.12 3.60 76 XMNumbers 9968 3.36 3.06 3.52 77 RCVD_IN_IADB_DK 9822 2.67 1.12 3.47 78 T_REMOTE_IMAGE 9670 2.85 1.75 3.41 79 BAYES_95 9250 3.92 5.19 3.27 80 TM2_M_URI_OPT_OUT 9065 3.12 2.97 3.20 81 BAYES_20 8913 2.66 1.73 3.15 82 MIME_HTML_ONLY_MULTI 8630 2.87 2.53 3.05 83 RCVD_IN_IADB_VOUCHED 8225 2.12 0.60 2.90 84 INVALID_MSGID 8214 2.10 0.54 2.90 85 URI_NOVOWEL 8186 2.40 1.46 2.89 86 RCVD_IN_MSPIKE_H5 7884 2.07 0.69 2.78 87 T_TooManySym_02 7841 2.02 0.56 2.77 88 MSGID_NOFQDN1 7608 1.83 0.15 2.69 89 TR_XM_PhishingBody 7484 3.59 5.43 2.64 90 XM_PDF 7014 1.73 0.29 2.48 91 XM_B_SpammyTLD 6953 4.30 7.89 2.46 92 TR_XM_SpammyWords5 6879 3.03 4.21 2.43 93 MIME_HTML_MOSTLY 6868 3.87 6.67 2.43 94 XM_CamelCaseFrm001 6823 2.40 2.37 2.41 95 T_XMDrugObfuBody_14 6737 2.39 2.41 2.38 96 DKIM_INVALID 6471 2.73 3.58 2.29 97 TO_MALFORMED 6462 1.51 0.00 2.28 98 TVD_RCVD_IP 6372 1.56 0.22 2.25 99 SUBJ_ALL_CAPS 6317 2.50 3.01 2.23 100 HTML_IMAGE_RATIO_08 6206 3.29 5.42 2.19 101 UNTRUSTED_Relay 5910 4.97 10.58 2.09 102 HELO_MISC_IP 5908 1.52 0.41 2.09 103 MAILING_LIST_MULTI 5435 1.73 1.35 1.92 104 BAYES_05 5327 1.52 0.82 1.88 105 RCVD_IN_IADB_OPTIN 5303 1.41 0.52 1.87 106 BOTNET 5249 6.14 14.46 1.85 107 XMBdyGiftCard01 5240 2.32 3.23 1.85 108 HTML_MIME_NO_HTML_TAG 5132 1.62 1.25 1.81 109 IN_HORDE_ADDRESS_BOOK 5107 1.21 0.05 1.80 110 RCVD_IN_BL_SPAMCOP_NET 4921 4.44 9.69 1.74 111 TR_XM_SB_Phish 4907 1.74 1.75 1.73 112 XM_Body_Dirty_Words_01 4903 1.37 0.68 1.73 113 USER_IN_DEF_DKIM_WL 4879 1.14 0.01 1.72 114 XMSubPhish11 4845 1.67 1.59 1.71 115 TR_Symld_Words 4717 1.72 1.83 1.67 116 RELAYCOUNTRY_CA 4656 3.72 7.76 1.64 117 XMStockSpam_06 4597 1.52 1.32 1.62 118 XM_H_Trusted_IP 4506 1.05 0.00 1.59 119 XMBSHREFv2 4504 1.16 0.31 1.59 120 XM_ProductURIs 4302 1.40 1.16 1.52 121 TM2_M_VERY_LONG_WORD 4034 1.66 2.11 1.42 122 XM_DK_Undo_01 3914 2.03 3.29 1.38 123 URI_HEX 3913 2.20 3.78 1.38 124 URI_TRY_3LD 3852 1.54 1.89 1.36 125 XMBody_17 3781 2.33 4.27 1.34 126 XMBody_95 3745 0.93 0.16 1.32 127 XM_H_Long_From02 3647 1.23 1.12 1.29 128 TooManyTo_002 3626 1.02 0.50 1.28 129 ANY_BOUNCE_MESSAGE 3461 0.89 0.25 1.22 130 BOUNCE_MESSAGE 3461 0.89 0.25 1.22 131 XM_OfRef6 3447 2.92 6.23 1.22 132 T_XMDrugObfuBody_08 3408 1.37 1.70 1.20 133 T_XMDrugObfuBody_00 3326 1.34 1.67 1.17 134 XM_UB50 3307 2.01 3.63 1.17 135 PDS_OTHER_BAD_TLD 3251 1.33 1.69 1.15 136 XM_B_Phish66 3178 1.67 2.73 1.12 137 TR_MSPIKEBAYES00 3130 0.75 0.06 1.11 138 XMGappySubj_01 3074 0.85 0.38 1.09 139 XM_B_Unsub2 3062 1.60 2.62 1.08 140 XM_SPF_SoftFail 3037 1.83 3.32 1.07 141 XM_B_SpammyWords4 2870 1.45 2.30 1.01 142 XM_GoogleGroups 2833 0.81 0.45 1.00 143 XMDiploma_00 2826 1.36 2.06 1.00 144 XMBrknScrpt_02 2769 1.65 2.96 0.98 145 NUMERIC_HTTP_ADDR 2662 1.00 1.12 0.94 146 TooManyTo_003 2640 0.76 0.42 0.93 147 DKIM_ADSP_CUSTOM_MED 2589 0.90 0.86 0.91 148 HTML_FONT_FACE_BAD 2556 0.80 0.62 0.90 149 KHOP_HELO_FCRDNS 2486 1.22 1.88 0.88 150 TR_XM_SpammyWords2 2448 6.18 16.52 0.86 151 T_TooManySym_03 2336 0.59 0.13 0.82 152 XM_B_COVIDMETA 2169 0.92 1.22 0.77 153 XMPhish08 2153 0.88 1.11 0.76 154 XMMoneyMeta_00 2066 0.66 0.54 0.73 155 RDNS_DYNAMIC 2023 0.79 0.95 0.71 156 XMHTMLBadTable_001 1963 0.66 0.61 0.69 157 XM_B_REG_HTML 1962 0.60 0.41 0.69 158 XMSubNoVowel 1956 1.01 1.64 0.69 159 TooManyTo_004 1942 0.59 0.40 0.69 160 SUBJ_DOLLARS 1891 0.85 1.20 0.67 161 XMSexyCombo_01 1822 1.10 1.99 0.64 162 T_Symld_Words_02 1797 0.81 1.17 0.63 163 T_XMHurry_00 1783 1.02 1.78 0.63 164 TR_MetaPhish_Combo_01 1779 0.76 1.02 0.63 165 HELO_NODOT 1767 0.52 0.32 0.62 166 HELO_NO_DOMAIN 1766 0.52 0.32 0.62 167 USER_IN_WHITELIST 1754 0.41 0.00 0.62 168 RELAYCOUNTRY_GB 1754 0.65 0.70 0.62 169 USER_IN_WELCOMELIST 1754 0.41 0.00 0.62 170 NML_ADSP_CUSTOM_MED 1752 0.68 0.80 0.62 171 XMSubMetaI_00 1742 0.70 0.87 0.62 172 T_FILL_THIS_FORM_SHORT 1700 1.39 2.93 0.60 173 FORGED_GMAIL_RCVD 1671 1.04 1.92 0.59 174 XMSubMetaSxObfu_03 1651 0.65 0.78 0.58 175 TM2_M_A_HREF_HREF 1643 0.65 0.78 0.58 176 TooManyTo_005 1642 0.51 0.38 0.58 177 XM_B_COPY_HTML 1606 0.56 0.54 0.57 178 HTTPS_HTTP_MISMATCH 1492 0.65 0.89 0.53 179 XMHTML_After_End 1471 0.82 1.40 0.52 180 TR_Caps_n_Bayes_99 1446 0.77 1.27 0.51 181 XMSubMetaSxObfu_02 1428 0.41 0.23 0.50 182 XMNoVowels 1423 0.49 0.48 0.50 183 XMGenDplmaNmb 1407 0.73 1.18 0.50 184 XM_H_PHPMailer 1290 0.40 0.30 0.46 185 TR_LOTS_OF_MONEY3 1280 1.50 3.55 0.45 186 HTML_IMAGE_ONLY_20 1270 0.37 0.21 0.45 187 XMPhish30 1251 0.65 1.05 0.44 188 SpammyFromTLD_01 1238 1.58 3.81 0.44 189 URIBL_SBL_A 1221 1.48 3.51 0.43 190 SHOPIFY_IMG_NOT_RCVD_SFY 1221 0.43 0.42 0.43 191 XMBody_78 1206 0.59 0.90 0.43 192 XM_SPF_Unknown 1199 0.44 0.48 0.42 193 T_HTML_TAG_BALANCE_CENTER 1185 0.40 0.38 0.42 194 DIET_1 1149 0.60 0.99 0.41 195 XM_DIRTYINTL 1147 1.37 3.23 0.41 196 HTML_TAG_BALANCE_BODY 1125 0.50 0.70 0.40 197 XMLngstWrd_00 1075 0.37 0.34 0.38 198 TVD_SPACE_RATIO 1066 0.29 0.12 0.38 199 XM_Body_Obfu01 1052 0.48 0.68 0.37 200 XMCapTrack 1036 0.30 0.19 0.37 ----------------------------------------------------------------------