Email: 460025 Autolearn: 0 AvgScore: 2.72 AvgScanTime: 1.28 sec Spam: 140575 Autolearn: 0 AvgScore: 13.70 AvgScanTime: 1.47 sec Ham: 319450 Autolearn: 0 AvgScore: -2.11 AvgScanTime: 1.20 sec Time Spent Running SA: 163.97 hours Time Spent Processing Spam: 57.33 hours Time Spent Processing Ham: 106.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133092 85.68 94.68 81.73 2 DKIM_SIGNED 126497 85.95 89.99 84.17 3 XM_DK_Pass 124682 84.94 88.69 83.28 4 DKIM_VALID 122841 83.57 87.38 81.89 5 XM_B_Unicode 114053 73.11 81.13 69.58 6 RELAYCOUNTRY_US 113159 84.38 80.50 86.08 7 DCC_CHECK 110324 60.59 78.48 52.72 8 XMListUnsubscribeExists 108259 60.88 77.01 53.78 9 XM_B_SpammyWords 104428 60.55 74.29 54.51 10 DKIM_VALID_AU 96235 68.50 68.46 68.52 11 XM_DK_Undo_02 74595 22.58 53.06 9.17 12 TR_XM_DKIM_Undo 66061 18.40 46.99 5.82 13 XM_B_SpammyWords2 63357 29.19 45.07 22.20 14 XM_B_Unicode3 61066 43.64 43.44 43.73 15 BAYES_99 57596 16.57 40.97 5.83 16 LOC_TINY_FONT_1 55247 32.28 39.30 29.19 17 HTML_FONT_LOW_CONTRAST 52091 32.65 37.06 30.71 18 RCVD_IN_MSPIKE_H2 46897 28.67 33.36 26.60 19 TR_DCC_Bayes_99 46090 12.36 32.79 3.37 20 BAYES_50 46088 49.29 32.79 56.56 21 BAYES_999 45782 13.13 32.57 4.58 22 MIME_HTML_ONLY 44424 24.80 31.60 21.81 23 FVGT_m_MULTI_ODD 42056 26.27 29.92 24.66 24 DKIM_VALID_EF 41572 34.19 29.57 36.23 25 RCVD_IN_MSPIKE_WL 35476 33.53 25.24 37.18 26 T_KAM_HTML_FONT_INVALID 33900 19.66 24.12 17.71 27 XMSubLong 33135 20.31 23.57 18.87 28 T_TM2_M_HEADER_IN_MSG 29407 21.16 20.92 21.27 29 DCC_CHECK_NEGATIVE 28161 38.08 20.03 46.03 30 XM_Body_Dirty_Words 27956 14.96 19.89 12.79 31 RELAYCOUNTRY_META 27001 8.65 19.21 4.00 32 TR_XM_SpammyWords2 26129 6.16 18.59 0.68 33 LOTS_OF_MONEY 23377 10.52 16.63 7.83 34 XM_B_SpammyWords3 22746 9.13 16.18 6.03 35 XM_Multi_Part_URI 21485 14.09 15.28 13.57 36 RCVD_IN_MSPIKE_H3 20245 15.79 14.40 16.40 37 TR_XM_SpammyWords4 19555 8.03 13.91 5.44 38 BOTNET_IPINHOSTNAME 19137 8.05 13.61 5.60 39 RCVD_IN_BL_SPAMCOP_NET 19062 5.11 13.56 1.39 40 BOTNET 17901 5.34 12.73 2.09 41 HTML_IMAGE_RATIO_02 17147 9.65 12.20 8.53 42 XMSexyCombo_05 14973 6.78 10.65 5.08 43 RCVD_IN_MSPIKE_H4 13962 12.55 9.93 13.70 44 XM_Evil_Numbers_Gen 13937 10.25 9.91 10.40 45 XM_B_Unsub 13762 10.58 9.79 10.93 46 UNTRUSTED_Relay 13449 4.04 9.57 1.61 47 RELAYCOUNTRY_CA 12898 3.82 9.18 1.47 48 UNPARSEABLE_RELAY 12487 8.81 8.88 8.78 49 TR_XM_UnparsRelay 11993 7.44 8.53 6.96 50 BAYES_80 11928 6.36 8.49 5.43 51 LotsOfNums_01 11809 8.49 8.40 8.53 52 XM_UncommonTLD01 11699 5.01 8.32 3.55 53 XM_H_Long_From01 11458 6.09 8.15 5.18 54 XM_B_Phish_Phrases 10826 10.53 7.70 11.77 55 BAYES_60 10647 9.08 7.57 9.75 56 RCVD_IN_RP_SAFE 9613 10.17 6.84 11.64 57 MPART_ALT_DIFF 9412 5.29 6.70 4.66 58 FSL_BULK_SIG 9370 6.26 6.67 6.08 59 XM_SendGrid 9269 7.39 6.59 7.74 60 TooManyTo_001 9056 6.15 6.44 6.03 61 TR_XM_SpammyWords5 8891 3.11 6.32 1.70 62 HTML_IMAGE_RATIO_04 8699 6.07 6.19 6.02 63 XMSubMetaSx_00 8414 4.34 5.99 3.62 64 XM_OfRef6 7836 2.25 5.57 0.79 65 TR_XM_PhishingBody 7797 3.56 5.55 2.68 66 XM_DK_Undo_01 7632 2.61 5.43 1.36 67 XMBody_17 7444 2.12 5.30 0.72 68 RCVD_IN_RP_CERTIFIED 7257 9.04 5.16 10.75 69 BAYES_95 7204 3.96 5.12 3.45 70 MIME_HTML_MOSTLY 6685 3.21 4.76 2.52 71 XMNumbers 6593 3.63 4.69 3.17 72 URIBL_SBL_A 6387 2.68 4.54 1.86 73 TR_LOTS_OF_MONEY3 5826 1.54 4.14 0.40 74 RCVD_IN_MSPIKE_BL 5627 1.32 4.00 0.14 75 URI_HEX 5620 2.01 4.00 1.14 76 TR_XM_MSPIKECOMBO 5518 1.30 3.93 0.14 77 XM_B_SpammyTLD 5453 2.75 3.88 2.25 78 SUBJ_ALL_CAPS 5357 2.06 3.81 1.29 79 TR_XM_DK_SendGrid 5228 4.72 3.72 5.16 80 TM2_M_URI_OPT_OUT 5183 2.68 3.69 2.23 81 FROM_EXCESS_BASE64 5179 3.56 3.68 3.51 82 T_FILL_THIS_FORM_SHORT 5091 1.41 3.62 0.44 83 XMBrknScrpt_02 4894 1.65 3.48 0.84 84 XM_UB50 4853 1.73 3.45 0.97 85 FORGED_GMAIL_RCVD 4834 1.41 3.44 0.52 86 XMBdyGiftCard01 4812 2.13 3.42 1.56 87 MIME_HTML_ONLY_MULTI 4642 2.99 3.30 2.86 88 XMStrtUSub 4500 10.03 3.20 13.03 89 HTML_IMAGE_RATIO_06 4431 3.64 3.15 3.85 90 RCVD_IN_MSPIKE_L5 4391 1.00 3.12 0.07 91 XMDiploma_00 4209 1.63 2.99 1.02 92 XM_CamelCaseFrm001 4141 2.30 2.95 2.02 93 RCVD_IN_RP_RNBL 4068 0.91 2.89 0.04 94 GOOGLE_DOC_SUSP 4043 0.89 2.88 0.02 95 XM_SPF_SoftFail 3822 1.81 2.72 1.41 96 T_REMOTE_IMAGE 3794 3.08 2.70 3.25 97 T_XMHurry_00 3681 1.42 2.62 0.89 98 XM_DIRTYINTL 3662 1.00 2.61 0.29 99 DKIM_INVALID 3656 2.38 2.60 2.28 100 SpammyFromTLD_01 3653 1.07 2.60 0.40 101 T_TooManySym_01 3529 4.67 2.51 5.62 102 HTML_IMAGE_RATIO_08 3487 1.99 2.48 1.78 103 TR_XM_BayesRelay 3432 0.77 2.44 0.03 104 T_XMDrugObfuBody_14 3384 2.52 2.41 2.58 105 RCVD_IN_PSBL 3343 0.82 2.38 0.13 106 URIBL_DBL_SPAM 3249 0.72 2.31 0.02 107 HK_RANDOM_REPLYTO 3244 0.80 2.31 0.14 108 TR_XM_MaxBayes 3243 0.73 2.31 0.04 109 XM_B_SpammyWords4 3219 1.29 2.29 0.85 110 SpammyFromTLD_02 3202 0.81 2.28 0.16 111 XM_B_Phish66 3195 1.85 2.27 1.67 112 TM2_M_VERY_LONG_WORD 3186 1.70 2.27 1.44 113 XM_B_Unsub2 3111 1.67 2.21 1.44 114 TR_Symld_Words 3104 1.53 2.21 1.24 115 XM_UB99 2957 0.65 2.10 0.00 116 TR_XM_FormFill 2948 0.65 2.10 0.01 117 KHOP_HELO_FCRDNS 2829 1.58 2.01 1.39 118 XM_OfRef7 2815 0.72 2.00 0.16 119 T_XMDrugObfuBody_08 2746 1.34 1.95 1.07 120 MIME_QP_LONG_LINE 2715 3.51 1.93 4.20 121 XM_URI_RBL 2591 0.72 1.84 0.23 122 BAYES_40 2587 3.38 1.84 4.06 123 XMGenDplmaNmb 2556 0.91 1.82 0.51 124 HTML_MIME_NO_HTML_TAG 2489 1.40 1.77 1.24 125 TR_Caps_n_Bayes_99 2420 0.74 1.72 0.31 126 XMStockSpam_06 2385 2.06 1.70 2.22 127 XMSexyCombo_01 2338 1.00 1.66 0.70 128 BOTNET_NORDNS 2312 0.51 1.64 0.01 129 TR_XM_SpammyWords3 2295 0.54 1.63 0.06 130 TR_XM_SB_Phish 2214 1.45 1.57 1.40 131 XM_UB999 2167 0.47 1.54 0.00 132 XMSubMetaI_00 2163 0.98 1.54 0.74 133 XMSubPhish11 2117 1.42 1.51 1.38 134 RELAYCOUNTRY_FR 2106 0.62 1.50 0.24 135 URI_TRY_3LD 2096 1.35 1.49 1.29 136 HTTPS_HTTP_MISMATCH 2093 0.78 1.49 0.47 137 XM_UB60 2081 0.54 1.48 0.12 138 RCVD_IN_IADB_LISTED 2047 3.27 1.46 4.06 139 NO_FM_NAME_IP_HOSTN 2041 0.45 1.45 0.00 140 XMPhish08 2037 0.55 1.45 0.15 141 BAYES_20 2036 2.32 1.45 2.71 142 LONG_JUNK_URI 1984 0.47 1.41 0.06 143 TR_XM_PHPDW 1950 0.84 1.39 0.60 144 T_HTML_TAG_BALANCE_CENTER 1928 0.52 1.37 0.14 145 URIBL_BLACK 1855 0.42 1.32 0.02 146 TR_XM_PHPForged 1854 0.76 1.32 0.51 147 NUMERIC_HTTP_ADDR 1850 0.57 1.32 0.24 148 TR_XM_FormFill2 1843 0.76 1.31 0.51 149 XM_H_PHPOS 1842 0.75 1.31 0.50 150 XM_B_COVIDMETA 1835 0.90 1.31 0.72 151 RCVD_IN_IADB_SPF 1792 2.84 1.27 3.53 152 URI_NOVOWEL 1790 2.02 1.27 2.35 153 MAILING_LIST_MULTI 1789 1.67 1.27 1.85 154 XM_ProductURIs 1762 1.07 1.25 0.99 155 HTML_FONT_SIZE_HUGE 1735 0.48 1.23 0.15 156 T_XMDrugObfuBody_00 1697 0.88 1.21 0.74 157 RCVD_IN_IADB_SENDERID 1692 2.56 1.20 3.16 158 SUBJ_DOLLARS 1685 0.60 1.20 0.34 159 DATE_IN_PAST_03_06 1680 0.47 1.20 0.15 160 RCVD_IN_IADB_DK 1678 2.50 1.19 3.07 161 XM_Body_Obfu01 1641 0.52 1.17 0.23 162 XMHTML_After_End 1610 0.79 1.15 0.64 163 RDNS_DYNAMIC 1602 0.85 1.14 0.72 164 PDS_OTHER_BAD_TLD 1590 0.90 1.13 0.80 165 HDRS_MISSP 1579 0.40 1.12 0.08 166 XM_UB80 1561 0.36 1.11 0.03 167 TR_Sbj_FN_Bdy 1530 0.41 1.09 0.11 168 XMPhish30 1500 0.64 1.07 0.46 169 XM_H_Long_From02 1493 0.99 1.06 0.96 170 PDS_LITECOIN_ID 1440 0.36 1.02 0.07 171 TR_XM_RelayPhish 1394 0.37 0.99 0.09 172 MILLION_USD 1386 0.30 0.99 0.00 173 T_MONEY_PERCENT 1327 0.35 0.94 0.09 174 TR_LOTS_OF_MONEY2 1327 0.35 0.94 0.09 175 BODY_URI_ONLY 1316 0.29 0.94 0.00 176 XMSubNoVowel 1312 0.77 0.93 0.69 177 XMSubMetaSxObfu_03 1302 0.48 0.93 0.28 178 RELAYCOUNTRY_NL 1279 0.40 0.91 0.18 179 URIBL_DBL_ABUSE_SPAM 1274 0.30 0.91 0.04 180 RCVD_IN_MSPIKE_H5 1269 5.19 0.90 7.07 181 MONEY_FRAUD_8 1264 0.27 0.90 0.00 182 HTML_IMAGE_ONLY_12 1262 0.36 0.90 0.13 183 BAYES_00 1256 7.58 0.89 10.52 184 HK_SCAM 1229 0.27 0.87 0.01 185 MIMEOLE_DIRECT_TO_MX 1224 0.27 0.87 0.00 186 TR_XM_INV_DKIM 1217 0.35 0.87 0.12 187 BAYES_05 1209 1.43 0.86 1.69 188 DATE_IN_PAST_12_24 1187 0.27 0.84 0.02 189 TR_XM_Spammywords 1186 0.63 0.84 0.54 190 XM_S_SpammyWords 1186 0.63 0.84 0.54 191 XMSubMetaD_00 1176 0.32 0.84 0.10 192 THIS_AD 1124 0.39 0.80 0.20 193 MPART_ALT_DIFF_COUNT 1115 0.50 0.79 0.37 194 TR_BOTNET_NEGATE 1103 0.51 0.78 0.39 195 INVESTMENT_ADVICE 1095 0.29 0.78 0.08 196 DEAR_FRIEND 1092 0.27 0.78 0.05 197 MIME_CHARSET_FARAWAY 1089 0.31 0.77 0.10 198 TR_XM_COVIDMETA4 1087 0.37 0.77 0.19 199 RELAYCOUNTRY_DE 1081 0.51 0.77 0.39 200 XM_HighProb1 1077 0.24 0.77 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 274997 84.38 80.50 86.08 2 DKIM_SIGNED 268884 85.95 89.99 84.17 3 XM_DK_Pass 266047 84.94 88.69 83.28 4 DKIM_VALID 261606 83.57 87.38 81.89 5 HTML_MESSAGE 261077 85.68 94.68 81.73 6 XM_B_Unicode 222286 73.11 81.13 69.58 7 DKIM_VALID_AU 218881 68.50 68.46 68.52 8 BAYES_50 180675 49.29 32.79 56.56 9 XM_B_SpammyWords 174135 60.55 74.29 54.51 10 XMListUnsubscribeExists 171803 60.88 77.01 53.78 11 DCC_CHECK 168407 60.59 78.48 52.72 12 DCC_CHECK_NEGATIVE 147036 38.08 20.03 46.03 13 XM_B_Unicode3 139691 43.64 43.44 43.73 14 RCVD_IN_MSPIKE_WL 118768 33.53 25.24 37.18 15 DKIM_VALID_EF 115721 34.19 29.57 36.23 16 HTML_FONT_LOW_CONTRAST 98111 32.65 37.06 30.71 17 LOC_TINY_FONT_1 93241 32.28 39.30 29.19 18 RCVD_IN_MSPIKE_H2 84982 28.67 33.36 26.60 19 FVGT_m_MULTI_ODD 78778 26.27 29.92 24.66 20 XM_B_SpammyWords2 70915 29.19 45.07 22.20 21 MIME_HTML_ONLY 69679 24.80 31.60 21.81 22 T_TM2_M_HEADER_IN_MSG 67950 21.16 20.92 21.27 23 XM_DKIMWhitelistDomains 62754 13.65 0.02 19.64 24 XMSubLong 60288 20.31 23.57 18.87 25 T_KAM_HTML_FONT_INVALID 56560 19.66 24.12 17.71 26 RCVD_IN_MSPIKE_H3 52404 15.79 14.40 16.40 27 RCVD_IN_MSPIKE_H4 43765 12.55 9.93 13.70 28 XM_Multi_Part_URI 43337 14.09 15.28 13.57 29 XMStrtUSub 41633 10.03 3.20 13.03 30 XM_Body_Dirty_Words 40866 14.96 19.89 12.79 31 XM_B_Phish_Phrases 37613 10.53 7.70 11.77 32 RCVD_IN_RP_SAFE 37172 10.17 6.84 11.64 33 XM_B_Unsub 34923 10.58 9.79 10.93 34 RCVD_IN_RP_CERTIFIED 34336 9.04 5.16 10.75 35 ALL_TRUSTED 34078 7.61 0.66 10.67 36 BAYES_00 33592 7.58 0.89 10.52 37 XM_Evil_Numbers_Gen 33212 10.25 9.91 10.40 38 BAYES_60 31146 9.08 7.57 9.75 39 XM_DK_Undo_02 29279 22.58 53.06 9.17 40 UNPARSEABLE_RELAY 28044 8.81 8.88 8.78 41 HTML_IMAGE_RATIO_02 27235 9.65 12.20 8.53 42 LotsOfNums_01 27234 8.49 8.40 8.53 43 TR_XM_DK_Bayes 26815 6.04 0.70 8.39 44 TR_XM_DK_Bayes1 26152 5.89 0.68 8.19 45 LOTS_OF_MONEY 25004 10.52 16.63 7.83 46 XM_SendGrid 24712 7.39 6.59 7.74 47 TR_XM_DK_Bayes2 23660 5.33 0.62 7.41 48 RCVD_IN_MSPIKE_H5 22599 5.19 0.90 7.07 49 TR_XM_UnparsRelay 22230 7.44 8.53 6.96 50 FSL_BULK_SIG 19407 6.26 6.67 6.08 51 XM_B_SpammyWords3 19256 9.13 16.18 6.03 52 TooManyTo_001 19248 6.15 6.44 6.03 53 HTML_IMAGE_RATIO_04 19222 6.07 6.19 6.02 54 BAYES_99 18627 16.57 40.97 5.83 55 TR_XM_DKIM_Undo 18580 18.40 46.99 5.82 56 T_TooManySym_01 17956 4.67 2.51 5.62 57 BOTNET_IPINHOSTNAME 17888 8.05 13.61 5.60 58 TR_XM_SpammyWords4 17375 8.03 13.91 5.44 59 BAYES_80 17351 6.36 8.49 5.43 60 XM_H_Long_From01 16538 6.09 8.15 5.18 61 TR_XM_DK_SendGrid 16490 4.72 3.72 5.16 62 XMSexyCombo_05 16218 6.78 10.65 5.08 63 MPART_ALT_DIFF 14902 5.29 6.70 4.66 64 IN_ZIMBRA_NJ_WHITELIST 14758 3.22 0.04 4.62 65 BAYES_999 14640 13.13 32.57 4.58 66 MIME_QP_LONG_LINE 13413 3.51 1.93 4.20 67 BAYES_40 12983 3.38 1.84 4.06 68 RCVD_IN_IADB_LISTED 12983 3.27 1.46 4.06 69 RELAYCOUNTRY_META 12777 8.65 19.21 4.00 70 HTML_IMAGE_RATIO_06 12310 3.64 3.15 3.85 71 XMSubMetaSx_00 11559 4.34 5.99 3.62 72 XM_UncommonTLD01 11327 5.01 8.32 3.55 73 RCVD_IN_IADB_SPF 11283 2.84 1.27 3.53 74 FROM_EXCESS_BASE64 11200 3.56 3.68 3.51 75 BAYES_95 11021 3.96 5.12 3.45 76 TR_DCC_Bayes_99 10765 12.36 32.79 3.37 77 T_REMOTE_IMAGE 10372 3.08 2.70 3.25 78 T_TooManySym_02 10348 2.48 0.75 3.24 79 XMNumbers 10126 3.63 4.69 3.17 80 RCVD_IN_IADB_SENDERID 10090 2.56 1.20 3.16 81 RCVD_IN_IADB_DK 9821 2.50 1.19 3.07 82 MIME_HTML_ONLY_MULTI 9121 2.99 3.30 2.86 83 BAYES_20 8655 2.32 1.45 2.71 84 TR_XM_PhishingBody 8566 3.56 5.55 2.68 85 TVD_RCVD_IP 8501 1.97 0.39 2.66 86 T_XMDrugObfuBody_14 8231 2.52 2.41 2.58 87 INVALID_MSGID 8151 1.92 0.48 2.55 88 MIME_HTML_MOSTLY 8059 3.21 4.76 2.52 89 RCVD_IN_IADB_VOUCHED 7861 1.90 0.64 2.46 90 MSGID_NOFQDN1 7610 1.67 0.06 2.38 91 USER_IN_DEF_DKIM_WL 7509 1.64 0.04 2.35 92 URI_NOVOWEL 7499 2.02 1.27 2.35 93 DKIM_INVALID 7278 2.38 2.60 2.28 94 XM_B_SpammyTLD 7192 2.75 3.88 2.25 95 TM2_M_URI_OPT_OUT 7133 2.68 3.69 2.23 96 XMStockSpam_06 7080 2.06 1.70 2.22 97 BOTNET 6676 5.34 12.73 2.09 98 XM_CamelCaseFrm001 6457 2.30 2.95 2.02 99 TO_MALFORMED 6368 1.39 0.00 1.99 100 HELO_MISC_IP 6209 1.46 0.37 1.94 101 URIBL_SBL_A 5934 2.68 4.54 1.86 102 MAILING_LIST_MULTI 5916 1.67 1.27 1.85 103 HTML_IMAGE_RATIO_08 5686 1.99 2.48 1.78 104 XM_H_Trusted_IP 5424 1.18 0.00 1.70 105 TR_XM_SpammyWords5 5420 3.11 6.32 1.70 106 BAYES_05 5384 1.43 0.86 1.69 107 XM_B_Phish66 5325 1.85 2.27 1.67 108 BOUNCE_MESSAGE 5277 1.27 0.40 1.65 109 ANY_BOUNCE_MESSAGE 5277 1.27 0.40 1.65 110 IN_HORDE_ADDRESS_BOOK 5154 1.17 0.16 1.61 111 UNTRUSTED_Relay 5140 4.04 9.57 1.61 112 XM_PDF 5136 1.21 0.30 1.61 113 XMBdyGiftCard01 4984 2.13 3.42 1.56 114 RCVD_IN_IADB_OPTIN 4881 1.21 0.49 1.53 115 XMBSHREFv2 4707 1.10 0.26 1.47 116 RELAYCOUNTRY_CA 4688 3.82 9.18 1.47 117 TM2_M_VERY_LONG_WORD 4614 1.70 2.27 1.44 118 XM_B_Unsub2 4593 1.67 2.21 1.44 119 XM_SPF_SoftFail 4518 1.81 2.72 1.41 120 TR_XM_SB_Phish 4457 1.45 1.57 1.40 121 KHOP_HELO_FCRDNS 4429 1.58 2.01 1.39 122 RCVD_IN_BL_SPAMCOP_NET 4428 5.11 13.56 1.39 123 XMSubPhish11 4417 1.42 1.51 1.38 124 XM_DK_Undo_01 4353 2.61 5.43 1.36 125 XMBody_95 4230 0.96 0.13 1.32 126 SUBJ_ALL_CAPS 4122 2.06 3.81 1.29 127 URI_TRY_3LD 4115 1.35 1.49 1.29 128 HTML_MIME_NO_HTML_TAG 3958 1.40 1.77 1.24 129 TR_Symld_Words 3956 1.53 2.21 1.24 130 URI_HEX 3636 2.01 4.00 1.14 131 TooManyTo_002 3627 0.97 0.59 1.14 132 T_XMDrugObfuBody_08 3418 1.34 1.95 1.07 133 XMDiploma_00 3268 1.63 2.99 1.02 134 XM_ProductURIs 3153 1.07 1.25 0.99 135 XM_UB50 3109 1.73 3.45 0.97 136 XM_GoogleGroups 3099 0.81 0.44 0.97 137 XMGappySubj_01 3078 0.68 0.05 0.96 138 XM_H_Long_From02 3054 0.99 1.06 0.96 139 T_XMHurry_00 2834 1.42 2.62 0.89 140 HTML_FONT_FACE_BAD 2799 0.81 0.66 0.88 141 TR_MSPIKEBAYES00 2748 0.61 0.03 0.86 142 XM_B_SpammyWords4 2711 1.29 2.29 0.85 143 XMBrknScrpt_02 2682 1.65 3.48 0.84 144 DKIM_ADSP_CUSTOM_MED 2660 0.77 0.64 0.83 145 TooManyTo_003 2576 0.72 0.54 0.81 146 PDS_OTHER_BAD_TLD 2564 0.90 1.13 0.80 147 TR_MetaPhish_Combo_01 2547 0.75 0.65 0.80 148 XM_OfRef6 2516 2.25 5.57 0.79 149 TVD_SPACE_RATIO 2486 0.56 0.05 0.78 150 T_TooManySym_03 2434 0.59 0.19 0.76 151 XMSubMetaI_00 2366 0.98 1.54 0.74 152 T_XMDrugObfuBody_00 2354 0.88 1.21 0.74 153 XMBody_17 2303 2.12 5.30 0.72 154 XM_B_COVIDMETA 2302 0.90 1.31 0.72 155 RDNS_DYNAMIC 2286 0.85 1.14 0.72 156 XMSexyCombo_01 2252 1.00 1.66 0.70 157 XMSubNoVowel 2209 0.77 0.93 0.69 158 XMHTMLBadTable_001 2209 0.69 0.70 0.69 159 TR_XM_SpammyWords2 2186 6.16 18.59 0.68 160 XM_Lotto 2151 0.59 0.41 0.67 161 XMHTML_After_End 2039 0.79 1.15 0.64 162 RELAYCOUNTRY_GB 2002 0.65 0.70 0.63 163 TooManyTo_004 1955 0.58 0.51 0.61 164 XM_RXBody 1929 0.52 0.34 0.60 165 TR_XM_PHPDW 1911 0.84 1.39 0.60 166 XMSubMetaSxObfu_02 1891 0.51 0.34 0.59 167 PLING_QUERY 1820 0.59 0.63 0.57 168 NML_ADSP_CUSTOM_MED 1785 0.55 0.52 0.56 169 HELO_NO_DOMAIN 1763 0.48 0.30 0.55 170 HELO_NODOT 1763 0.48 0.30 0.55 171 XM_shorewaves_Whitelist 1747 0.38 0.00 0.55 172 TooManyTo_005 1729 0.52 0.46 0.54 173 TR_XM_Spammywords 1718 0.63 0.84 0.54 174 XM_S_SpammyWords 1718 0.63 0.84 0.54 175 USER_IN_WELCOMELIST 1696 0.37 0.00 0.53 176 USER_IN_WHITELIST 1696 0.37 0.00 0.53 177 XM_B_COPY_HTML 1652 0.55 0.62 0.52 178 HTML_IMAGE_ONLY_20 1651 0.47 0.37 0.52 179 FORGED_GMAIL_RCVD 1649 1.41 3.44 0.52 180 TR_XM_PHPForged 1635 0.76 1.32 0.51 181 TR_XM_FormFill2 1633 0.76 1.31 0.51 182 XMGenDplmaNmb 1621 0.91 1.82 0.51 183 XM_H_PHPOS 1611 0.75 1.31 0.50 184 XM_H_PHPMailer 1567 0.53 0.61 0.49 185 HTTPS_HTTP_MISMATCH 1496 0.78 1.49 0.47 186 XMPhish30 1467 0.64 1.07 0.46 187 SHOPIFY_IMG_NOT_RCVD_SFY 1450 0.48 0.55 0.45 188 XMBody_78 1426 0.48 0.57 0.45 189 T_FILL_THIS_FORM_SHORT 1409 1.41 3.62 0.44 190 XM_B_REG_HTML 1400 0.41 0.35 0.44 191 FROM_GOV_DKIM_AU 1339 0.32 0.09 0.42 192 GOOG_STO_IMG_NOHTML 1310 0.48 0.65 0.41 193 SpammyFromTLD_01 1291 1.07 2.60 0.40 194 TR_LOTS_OF_MONEY3 1269 1.54 4.14 0.40 195 RELAYCOUNTRY_DE 1253 0.51 0.77 0.39 196 XM_SPF_Unknown 1244 0.39 0.38 0.39 197 TR_BOTNET_NEGATE 1239 0.51 0.78 0.39 198 DKIM_ADSP_NXDOMAIN 1197 0.48 0.70 0.37 199 MPART_ALT_DIFF_COUNT 1189 0.50 0.79 0.37 200 XM_D_tchamptons_WL 1184 0.26 0.00 0.37 ----------------------------------------------------------------------