Email: 334526 Autolearn: 0 AvgScore: 3.48 AvgScanTime: 1.35 sec Spam: 111765 Autolearn: 0 AvgScore: 13.96 AvgScanTime: 1.46 sec Ham: 222761 Autolearn: 0 AvgScore: -1.77 AvgScanTime: 1.29 sec Time Spent Running SA: 125.28 hours Time Spent Processing Spam: 45.39 hours Time Spent Processing Ham: 79.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 105994 89.58 94.84 86.95 2 DKIM_SIGNED 90537 78.22 81.01 76.83 3 XM_DK_Pass 89149 77.15 79.76 75.84 4 DCC_CHECK 87933 56.59 78.68 45.51 5 DKIM_VALID 87006 75.48 77.85 74.29 6 RELAYCOUNTRY_US 81743 79.70 73.14 83.00 7 XM_B_Unicode 77814 72.84 69.62 74.45 8 XMListUnsubscribeExists 75220 60.74 67.30 57.45 9 DKIM_VALID_AU 67697 60.51 60.57 60.49 10 XM_B_SpammyWords 67144 49.68 60.08 44.46 11 XM_DK_Undo_02 56060 24.43 50.16 11.52 12 MIME_HTML_ONLY 43689 29.60 39.09 24.85 13 BAYES_99 43404 19.69 38.84 10.09 14 XM_B_Unicode3 43316 44.99 38.76 48.11 15 TR_XM_DKIM_Undo 41504 17.25 37.14 7.27 16 LOC_TINY_FONT_1 39273 32.15 35.14 30.65 17 RCVD_IN_MSPIKE_H2 36296 28.60 32.48 26.66 18 XM_B_SpammyWords2 36112 23.20 32.31 18.62 19 TR_DCC_Bayes_99 35016 13.59 31.33 4.68 20 BAYES_50 34970 44.79 31.29 51.57 21 BAYES_999 34948 16.18 31.27 8.61 22 HTML_FONT_LOW_CONTRAST 31885 31.79 28.53 33.43 23 DKIM_VALID_EF 31547 28.33 28.23 28.38 24 FVGT_m_MULTI_ODD 26936 25.77 24.10 26.61 25 XMSubLong 26356 21.10 23.58 19.86 26 T_KAM_HTML_FONT_INVALID 26109 19.72 23.36 17.90 27 RELAYCOUNTRY_META 24219 10.19 21.67 4.43 28 DCC_CHECK_NEGATIVE 22666 42.30 20.28 53.34 29 RCVD_IN_MSPIKE_WL 21446 27.21 19.19 31.24 30 XM_Body_Dirty_Words 20213 15.10 18.09 13.60 31 UNTRUSTED_Relay 18884 7.05 16.90 2.10 32 XM_Multi_Part_URI 18668 14.36 16.70 13.18 33 BOTNET 17831 6.80 15.95 2.21 34 FSL_BULK_SIG 16875 8.64 15.10 5.39 35 T_TM2_M_HEADER_IN_MSG 16465 19.84 14.73 22.40 36 XM_UncommonTLD01 16249 7.69 14.54 4.26 37 RCVD_IN_BL_SPAMCOP_NET 14391 5.14 12.88 1.25 38 TR_XM_SpammyWords2 13786 5.51 12.33 2.09 39 LOTS_OF_MONEY 13174 7.50 11.79 5.35 40 RCVD_IN_MSPIKE_H3 12650 15.65 11.32 17.82 41 BOTNET_IPINHOSTNAME 12256 8.42 10.97 7.14 42 BAYES_80 12116 7.41 10.84 5.69 43 TR_XM_SpammyWords4 11921 5.92 10.67 3.53 44 T_REMOTE_IMAGE 11701 5.37 10.47 2.82 45 XM_B_SpammyWords3 11591 6.15 10.37 4.03 46 XM_B_Unsub 11580 10.81 10.36 11.04 47 XMSexyCombo_05 11057 6.92 9.89 5.43 48 HTML_SHORT_LINK_IMG_1 10779 3.28 9.64 0.08 49 BAYES_60 10626 10.68 9.51 11.27 50 HTML_IMAGE_RATIO_02 10552 8.78 9.44 8.44 51 XM_Evil_Numbers_Gen 10481 9.34 9.38 9.31 52 MPART_ALT_DIFF 10152 7.73 9.08 7.05 53 HTML_IMAGE_ONLY_12 10069 3.14 9.01 0.19 54 BODY_URI_ONLY 10016 3.03 8.96 0.06 55 HTML_FONT_SIZE_LARGE 9760 3.05 8.73 0.20 56 KHOP_HELO_FCRDNS 9675 3.68 8.66 1.18 57 UNPARSEABLE_RELAY 9326 8.01 8.34 7.84 58 TR_XM_UnparsRelay 9212 7.17 8.24 6.63 59 RELAYCOUNTRY_CA 8714 3.58 7.80 1.46 60 SpammyFromTLD_02 8605 2.68 7.70 0.16 61 XMNumbers 8394 4.56 7.51 3.08 62 TooManyTo_001 8264 6.81 7.39 6.52 63 RCVD_IN_MSPIKE_H4 8035 9.81 7.19 11.12 64 LotsOfNums_01 7609 8.07 6.81 8.71 65 XM_H_Long_From01 7055 5.68 6.31 5.37 66 XM_SendGrid 6941 6.67 6.21 6.89 67 MIME_HTML_MOSTLY 6913 3.80 6.19 2.61 68 XMSubMetaSx_00 6776 4.64 6.06 3.92 69 HTML_IMAGE_RATIO_04 6756 8.10 6.04 9.13 70 XM_UB50 6549 2.77 5.86 1.22 71 XM_B_SpammyTLD 6418 3.07 5.74 1.74 72 BAYES_95 6321 4.20 5.66 3.47 73 RCVD_IN_RP_SAFE 6222 9.57 5.57 11.58 74 XM_B_Phish_Phrases 5603 4.03 5.01 3.54 75 TR_XM_SpammyWords5 5374 2.32 4.81 1.07 76 HTML_MIME_NO_HTML_TAG 5174 2.38 4.63 1.25 77 RCVD_IN_MSPIKE_BL 4627 1.46 4.14 0.11 78 TR_XM_MSPIKECOMBO 4615 1.45 4.13 0.11 79 RCVD_IN_RP_CERTIFIED 4542 8.43 4.06 10.62 80 XM_OfRef6 4482 1.75 4.01 0.62 81 TR_XM_PhishingBody 4368 3.11 3.91 2.71 82 PDS_OTHER_BAD_TLD 4352 1.61 3.89 0.46 83 SpammyFromTLD_01 4133 1.50 3.70 0.39 84 RCVD_IN_MSPIKE_L5 4006 1.24 3.58 0.07 85 FROM_EXCESS_BASE64 3999 3.55 3.58 3.54 86 XM_UB99 3978 1.19 3.56 0.01 87 RCVD_IN_RP_RNBL 3914 1.24 3.50 0.11 88 MIME_HTML_ONLY_MULTI 3855 4.49 3.45 5.01 89 RCVD_IN_PSBL 3835 1.26 3.43 0.17 90 TR_XM_DK_SendGrid 3671 3.83 3.28 4.11 91 FROM_SUSPICIOUS_NTLD 3639 1.20 3.26 0.16 92 XM_UB60 3614 1.18 3.23 0.15 93 FROM_SUSPICIOUS_NTLD_FP 3576 1.18 3.20 0.16 94 DKIM_INVALID 3531 2.74 3.16 2.53 95 HTML_IMAGE_RATIO_06 3527 4.02 3.16 4.46 96 XMBdyGiftCard01 3428 1.63 3.07 0.91 97 TR_Sbj_FN_Bdy 3416 1.13 3.06 0.17 98 XM_DK_Undo_01 3413 2.06 3.05 1.57 99 URIBL_SBL_A 3381 1.77 3.03 1.14 100 TR_XM_SpammyWords3 3372 1.04 3.02 0.05 101 RELAYCOUNTRY_FR 3328 1.12 2.98 0.18 102 BOTNET_NORDNS 3217 0.97 2.88 0.01 103 XMStrtUSub 3155 4.05 2.82 4.67 104 URI_HEX 3098 1.74 2.77 1.22 105 XM_UB999 3094 0.93 2.77 0.00 106 SUBJ_ALL_CAPS 3087 1.61 2.76 1.03 107 XMSubEmpty 3050 1.07 2.73 0.23 108 XM_DIRTYINTL 3034 1.18 2.71 0.40 109 XMBrknScrpt_02 2987 1.43 2.67 0.80 110 XMNoSubject 2966 0.94 2.65 0.08 111 MISSING_SUBJECT 2966 0.94 2.65 0.08 112 TM2_M_URI_OPT_OUT 2929 3.41 2.62 3.81 113 BODY_EMPTY 2909 0.89 2.60 0.04 114 T_FILL_THIS_FORM_SHORT 2872 1.11 2.57 0.38 115 XM_SPF_SoftFail 2830 1.66 2.53 1.22 116 TR_LOTS_OF_MONEY3 2777 1.01 2.48 0.27 117 XM_CamelCaseFrm001 2777 2.05 2.48 1.83 118 XM_UB80 2721 0.84 2.43 0.04 119 XMDiploma_00 2699 1.57 2.41 1.15 120 TM2_M_VERY_LONG_WORD 2684 1.80 2.40 1.49 121 XMBody_17 2538 1.12 2.27 0.54 122 HTML_IMAGE_RATIO_08 2511 2.25 2.25 2.25 123 URI_PHP_REDIR 2363 0.71 2.11 0.00 124 T_TooManySym_01 2325 4.54 2.08 5.78 125 T_XMDrugObfuBody_14 2126 2.24 1.90 2.41 126 TR_XM_COVIDMETA4 2069 0.75 1.85 0.20 127 XM_H_Undi_Recip 1988 0.67 1.78 0.11 128 XM_B_SpammyWords4 1979 0.81 1.77 0.32 129 URIBL_DBL_SPAM 1958 0.59 1.75 0.01 130 XM_B_Phish66 1942 1.19 1.74 0.92 131 ALL_TRUSTED 1937 9.42 1.73 13.28 132 TR_XM_BayesRelay 1911 0.59 1.71 0.03 133 MIME_QP_LONG_LINE 1900 3.38 1.70 4.23 134 XM_B_Unsub2 1881 1.29 1.68 1.10 135 RELAYCOUNTRY_DE 1856 0.87 1.66 0.47 136 XMSubMetaI_00 1759 0.78 1.57 0.38 137 XMGenDplmaNmb 1758 0.83 1.57 0.45 138 TR_XM_PHPDW 1738 0.74 1.56 0.33 139 URI_NOVOWEL 1717 1.89 1.54 2.07 140 RCVD_IN_IADB_LISTED 1701 3.21 1.52 4.06 141 TR_XM_MaxBayes 1687 0.52 1.51 0.03 142 XMSexyCombo_01 1676 0.96 1.50 0.69 143 XM_OfRef7 1656 0.53 1.48 0.05 144 TR_XM_PHPForged 1634 0.63 1.46 0.22 145 MAILING_LIST_MULTI 1618 1.92 1.45 2.15 146 MONEY_NOHTML 1613 0.53 1.44 0.07 147 TR_XM_FormFill2 1605 0.63 1.44 0.23 148 XM_H_PHPOS 1599 0.62 1.43 0.21 149 XM_UB95 1537 0.47 1.38 0.02 150 XM_H_TOP 1527 0.46 1.37 0.00 151 XMStockSpam_06 1505 1.49 1.35 1.56 152 T_XMDrugObfuBody_08 1498 1.31 1.34 1.29 153 RCVD_IN_IADB_SPF 1463 2.83 1.31 3.59 154 URIBL_BLACK 1462 0.46 1.31 0.04 155 TR_M_TOP_BAYES 1460 0.44 1.31 0.00 156 FORGED_GMAIL_RCVD 1450 0.75 1.30 0.48 157 XM_URI_RBL 1395 0.55 1.25 0.21 158 RELAYCOUNTRY_CH 1393 0.48 1.25 0.09 159 HK_RANDOM_FROM 1388 0.47 1.24 0.09 160 DATE_IN_PAST_24_48 1388 0.42 1.24 0.00 161 RCVD_IN_IADB_DK 1380 2.51 1.23 3.15 162 XM_OfRef8 1366 0.42 1.22 0.02 163 RCVD_IN_IADB_SENDERID 1360 2.59 1.22 3.27 164 BAYES_40 1343 2.65 1.20 3.38 165 TR_XM_RelayPhish 1343 0.44 1.20 0.05 166 TR_XM_SB_Phish 1342 1.37 1.20 1.45 167 XMSubPhish11 1326 1.35 1.19 1.44 168 RELAYCOUNTRY_IN 1285 0.43 1.15 0.07 169 TR_XM_INV_DKIM 1272 0.45 1.14 0.11 170 XMPhish30 1268 0.89 1.13 0.77 171 TR_MetaPhish_Combo_01 1245 0.86 1.11 0.73 172 XM_H_Long_From02 1231 1.51 1.10 1.72 173 TR_XM_Undi_Recip11 1221 0.38 1.09 0.02 174 HDRS_MISSP 1190 0.55 1.06 0.29 175 XM_Combo_Sbj 1186 0.41 1.06 0.08 176 INVESTMENT_ADVICE 1186 0.39 1.06 0.05 177 DKIM_ADSP_NXDOMAIN 1180 0.60 1.06 0.37 178 HK_RANDOM_REPLYTO 1158 0.45 1.04 0.16 179 T_TooManySym_02 1156 2.85 1.03 3.76 180 XMSubNoVowel 1146 1.82 1.03 2.22 181 BAYES_00 1141 7.00 1.02 9.99 182 TR_XM_FormFill 1138 0.34 1.02 0.01 183 TR_Mismatch_TLD_02 1129 0.38 1.01 0.06 184 HTML_TAG_BALANCE_BODY 1110 0.51 0.99 0.26 185 URI_TRY_3LD 1108 1.10 0.99 1.16 186 LongTLD 1106 0.40 0.99 0.11 187 MONEY_FORM_SHORT 1101 0.33 0.99 0.01 188 BAYES_20 1090 2.14 0.98 2.73 189 XMOemUri 1053 0.42 0.94 0.15 190 TR_XM_Undi_Recip5 1051 0.32 0.94 0.01 191 RDNS_DYNAMIC 1023 0.79 0.92 0.72 192 TR_LOTS_OF_MONEY2 946 0.33 0.85 0.08 193 T_MONEY_PERCENT 946 0.33 0.85 0.08 194 TR_Mismatch_TLD_01 922 0.44 0.82 0.25 195 XM_LoanWordsFrm 917 0.29 0.82 0.02 196 XMHTMLBadTable_001 901 0.79 0.81 0.78 197 TR_Caps_n_Bayes_99 901 0.29 0.81 0.03 198 T_XMDrugObfuBody_00 900 0.51 0.81 0.36 199 BITCOIN_YOUR_INFO 900 0.30 0.81 0.04 200 MIME_CHARSET_FARAWAY 899 0.37 0.80 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 193688 89.58 94.84 86.95 2 RELAYCOUNTRY_US 184889 79.70 73.14 83.00 3 DKIM_SIGNED 171141 78.22 81.01 76.83 4 XM_DK_Pass 168947 77.15 79.76 75.84 5 XM_B_Unicode 165840 72.84 69.62 74.45 6 DKIM_VALID 165495 75.48 77.85 74.29 7 DKIM_VALID_AU 134737 60.51 60.57 60.49 8 XMListUnsubscribeExists 127983 60.74 67.30 57.45 9 DCC_CHECK_NEGATIVE 118828 42.30 20.28 53.34 10 BAYES_50 114869 44.79 31.29 51.57 11 XM_B_Unicode3 107178 44.99 38.76 48.11 12 DCC_CHECK 101385 56.59 78.68 45.51 13 XM_B_SpammyWords 99043 49.68 60.08 44.46 14 HTML_FONT_LOW_CONTRAST 74474 31.79 28.53 33.43 15 RCVD_IN_MSPIKE_WL 69582 27.21 19.19 31.24 16 LOC_TINY_FONT_1 68284 32.15 35.14 30.65 17 DKIM_VALID_EF 63212 28.33 28.23 28.38 18 RCVD_IN_MSPIKE_H2 59391 28.60 32.48 26.66 19 FVGT_m_MULTI_ODD 59266 25.77 24.10 26.61 20 MIME_HTML_ONLY 55347 29.60 39.09 24.85 21 T_TM2_M_HEADER_IN_MSG 49908 19.84 14.73 22.40 22 XMSubLong 44234 21.10 23.58 19.86 23 XM_B_SpammyWords2 41484 23.20 32.31 18.62 24 T_KAM_HTML_FONT_INVALID 39876 19.72 23.36 17.90 25 RCVD_IN_MSPIKE_H3 39691 15.65 11.32 17.82 26 XM_DKIMWhitelistDomains 32632 9.77 0.04 14.65 27 XM_Body_Dirty_Words 30302 15.10 18.09 13.60 28 ALL_TRUSTED 29592 9.42 1.73 13.28 29 XM_Multi_Part_URI 29361 14.36 16.70 13.18 30 RCVD_IN_RP_SAFE 25786 9.57 5.57 11.58 31 XM_DK_Undo_02 25651 24.43 50.16 11.52 32 BAYES_60 25096 10.68 9.51 11.27 33 RCVD_IN_MSPIKE_H4 24776 9.81 7.19 11.12 34 XM_B_Unsub 24584 10.81 10.36 11.04 35 RCVD_IN_RP_CERTIFIED 23649 8.43 4.06 10.62 36 BAYES_99 22477 19.69 38.84 10.09 37 BAYES_00 22263 7.00 1.02 9.99 38 XM_Evil_Numbers_Gen 20748 9.34 9.38 9.31 39 HTML_IMAGE_RATIO_04 20333 8.10 6.04 9.13 40 LotsOfNums_01 19398 8.07 6.81 8.71 41 BAYES_999 19184 16.18 31.27 8.61 42 HTML_IMAGE_RATIO_02 18803 8.78 9.44 8.44 43 UNPARSEABLE_RELAY 17463 8.01 8.34 7.84 44 TR_XM_DK_Bayes 16967 5.26 0.57 7.62 45 TR_XM_DK_Bayes1 16648 5.16 0.56 7.47 46 TR_XM_DKIM_Undo 16197 17.25 37.14 7.27 47 BOTNET_IPINHOSTNAME 15911 8.42 10.97 7.14 48 TR_XM_DK_Bayes2 15771 4.88 0.50 7.08 49 MPART_ALT_DIFF 15715 7.73 9.08 7.05 50 XM_SendGrid 15357 6.67 6.21 6.89 51 TR_XM_UnparsRelay 14770 7.17 8.24 6.63 52 TooManyTo_001 14531 6.81 7.39 6.52 53 XM_H_Trusted_IP 14006 4.19 0.00 6.29 54 T_TooManySym_01 12868 4.54 2.08 5.78 55 BAYES_80 12683 7.41 10.84 5.69 56 XMSexyCombo_05 12089 6.92 9.89 5.43 57 FSL_BULK_SIG 12012 8.64 15.10 5.39 58 XM_H_Long_From01 11959 5.68 6.31 5.37 59 LOTS_OF_MONEY 11921 7.50 11.79 5.35 60 MIME_HTML_ONLY_MULTI 11152 4.49 3.45 5.01 61 TR_DCC_Bayes_99 10430 13.59 31.33 4.68 62 XMStrtUSub 10401 4.05 2.82 4.67 63 IN_ZIMBRA_NJ_WHITELIST 10269 3.08 0.03 4.61 64 HTML_IMAGE_RATIO_06 9928 4.02 3.16 4.46 65 RELAYCOUNTRY_META 9862 10.19 21.67 4.43 66 XM_UncommonTLD01 9489 7.69 14.54 4.26 67 MIME_QP_LONG_LINE 9413 3.38 1.70 4.23 68 TR_XM_DK_SendGrid 9148 3.83 3.28 4.11 69 RCVD_IN_IADB_LISTED 9051 3.21 1.52 4.06 70 XM_B_SpammyWords3 8985 6.15 10.37 4.03 71 TVD_RCVD_IP 8824 2.67 0.10 3.96 72 XMSubMetaSx_00 8736 4.64 6.06 3.92 73 TM2_M_URI_OPT_OUT 8477 3.41 2.62 3.81 74 T_TooManySym_02 8376 2.85 1.03 3.76 75 RCVD_IN_IADB_SPF 8003 2.83 1.31 3.59 76 FROM_EXCESS_BASE64 7887 3.55 3.58 3.54 77 XM_B_Phish_Phrases 7879 4.03 5.01 3.54 78 TR_XM_SpammyWords4 7871 5.92 10.67 3.53 79 BAYES_95 7733 4.20 5.66 3.47 80 BAYES_40 7523 2.65 1.20 3.38 81 RCVD_IN_IADB_SENDERID 7289 2.59 1.22 3.27 82 RCVD_IN_IADB_DK 7014 2.51 1.23 3.15 83 XMNumbers 6852 4.56 7.51 3.08 84 ANY_BOUNCE_MESSAGE 6637 2.15 0.51 2.98 85 BOUNCE_MESSAGE 6637 2.15 0.51 2.98 86 INVALID_MSGID 6622 2.18 0.59 2.97 87 T_REMOTE_IMAGE 6279 5.37 10.47 2.82 88 MSGID_NOFQDN1 6247 1.88 0.02 2.80 89 HELO_MISC_IP 6222 1.91 0.14 2.79 90 TO_MALFORMED 6209 1.86 0.01 2.79 91 BAYES_20 6077 2.14 0.98 2.73 92 TR_XM_PhishingBody 6028 3.11 3.91 2.71 93 MIME_HTML_MOSTLY 5807 3.80 6.19 2.61 94 DKIM_INVALID 5646 2.74 3.16 2.53 95 T_XMDrugObfuBody_14 5368 2.24 1.90 2.41 96 XMBSHREFv2 5251 1.62 0.14 2.36 97 RCVD_IN_IADB_VOUCHED 5235 1.78 0.65 2.35 98 RCVD_IN_MSPIKE_H5 5115 1.76 0.68 2.30 99 HTML_IMAGE_RATIO_08 5016 2.25 2.25 2.25 100 XMSubNoVowel 4939 1.82 1.03 2.22 101 BOTNET 4932 6.80 15.95 2.21 102 MAILING_LIST_MULTI 4795 1.92 1.45 2.15 103 HTML_FONT_FACE_BAD 4726 1.65 0.70 2.12 104 UNTRUSTED_Relay 4685 7.05 16.90 2.10 105 TR_XM_SpammyWords2 4654 5.51 12.33 2.09 106 URI_NOVOWEL 4601 1.89 1.54 2.07 107 XM_CamelCaseFrm001 4070 2.05 2.48 1.83 108 BAYES_05 4029 1.43 0.67 1.81 109 IN_HORDE_ADDRESS_BOOK 4016 1.21 0.03 1.80 110 XM_B_SpammyTLD 3868 3.07 5.74 1.74 111 XM_H_Long_From02 3822 1.51 1.10 1.72 112 USER_IN_DEF_DKIM_WL 3702 1.11 0.00 1.66 113 RCVD_IN_IADB_OPTIN 3500 1.22 0.53 1.57 114 XM_DK_Undo_01 3488 2.06 3.05 1.57 115 XMStockSpam_06 3479 1.49 1.35 1.56 116 TM2_M_VERY_LONG_WORD 3330 1.80 2.40 1.49 117 RELAYCOUNTRY_CA 3247 3.58 7.80 1.46 118 TR_XM_SB_Phish 3233 1.37 1.20 1.45 119 XMSubPhish11 3205 1.35 1.19 1.44 120 XMGappySubj_01 3159 0.98 0.10 1.42 121 HTML_IMAGE_ONLY_20 2946 0.91 0.09 1.32 122 T_XMDrugObfuBody_08 2875 1.31 1.34 1.29 123 RCVD_IN_BL_SPAMCOP_NET 2794 5.14 12.88 1.25 124 HTML_MIME_NO_HTML_TAG 2777 2.38 4.63 1.25 125 XMBody_95 2737 0.88 0.19 1.23 126 TR_MSPIKEBAYES00 2737 0.83 0.03 1.23 127 URI_HEX 2719 1.74 2.77 1.22 128 XM_SPF_SoftFail 2714 1.66 2.53 1.22 129 XM_UB50 2709 2.77 5.86 1.22 130 TVD_SPACE_RATIO 2660 0.82 0.06 1.19 131 KHOP_HELO_FCRDNS 2631 3.68 8.66 1.18 132 URI_TRY_3LD 2586 1.10 0.99 1.16 133 XMDiploma_00 2566 1.57 2.41 1.15 134 URIBL_SBL_A 2536 1.77 3.03 1.14 135 XM_B_Unsub2 2448 1.29 1.68 1.10 136 XM_GoogleGroups 2445 0.86 0.38 1.10 137 TR_XM_SpammyWords5 2389 2.32 4.81 1.07 138 XM_ProductURIs 2362 0.94 0.71 1.06 139 XM_PDF 2342 0.79 0.26 1.05 140 SUBJ_ALL_CAPS 2300 1.61 2.76 1.03 141 XM_B_COVIDMETA 2263 0.93 0.75 1.02 142 T_TooManySym_03 2200 0.79 0.40 0.99 143 TVD_SPACE_RATIO_MINFP 2148 0.79 0.44 0.96 144 TooManyTo_002 2100 0.81 0.56 0.94 145 XM_B_Phish66 2051 1.19 1.74 0.92 146 XMBdyGiftCard01 2022 1.63 3.07 0.91 147 DKIM_ADSP_CUSTOM_MED 1977 0.82 0.70 0.89 148 XMSubMetaSxObfu_02 1905 0.78 0.62 0.86 149 TR_Symld_Words 1842 0.80 0.74 0.83 150 XM_B_REG_HTML 1803 0.62 0.25 0.81 151 XMBrknScrpt_02 1788 1.43 2.67 0.80 152 USER_IN_WELCOMELIST 1777 0.53 0.00 0.80 153 USER_IN_WHITELIST 1777 0.53 0.00 0.80 154 XMHTMLBadTable_001 1748 0.79 0.81 0.78 155 XMPhish30 1718 0.89 1.13 0.77 156 TR_MetaPhish_Combo_01 1635 0.86 1.11 0.73 157 XMLngstWrd_00 1634 0.65 0.47 0.73 158 RDNS_DYNAMIC 1612 0.79 0.92 0.72 159 XMSexyCombo_01 1545 0.96 1.50 0.69 160 TooManyTo_003 1535 0.62 0.50 0.69 161 NUMERIC_HTTP_ADDR 1476 0.59 0.44 0.66 162 XMLngstWrd_01 1387 0.55 0.41 0.62 163 XM_OfRef6 1376 1.75 4.01 0.62 164 NML_ADSP_CUSTOM_MED 1375 0.62 0.63 0.62 165 DIET_1 1370 0.63 0.66 0.62 166 RELAYCOUNTRY_GB 1367 0.63 0.66 0.61 167 XM_H_PHPMailer 1296 0.62 0.70 0.58 168 XMBody_78 1257 0.63 0.75 0.56 169 TooManyTo_004 1250 0.53 0.46 0.56 170 XMHTML_After_End 1226 0.61 0.72 0.55 171 XMPhish08 1223 0.53 0.48 0.55 172 HTTPS_HTTP_MISMATCH 1205 0.62 0.79 0.54 173 XMBody_17 1197 1.12 2.27 0.54 174 XM_B_COPY_HTML 1143 0.52 0.54 0.51 175 XMLngstWrd_02 1132 0.44 0.30 0.51 176 FORGED_GMAIL_RCVD 1068 0.75 1.30 0.48 177 TooManyTo_005 1063 0.46 0.42 0.48 178 RELAYCOUNTRY_DE 1051 0.87 1.66 0.47 179 XMSolicitRefs_0 1040 0.36 0.15 0.47 180 PDS_OTHER_BAD_TLD 1023 1.61 3.89 0.46 181 MPART_ALT_DIFF_COUNT 1010 0.50 0.58 0.45 182 XMGenDplmaNmb 1007 0.83 1.57 0.45 183 T_XMHurry_00 1002 0.56 0.79 0.45 184 XM_Akamai 973 0.33 0.12 0.44 185 REMOVE_BEFORE_LINK 952 0.34 0.18 0.43 186 T_TooManySym_04 933 0.30 0.06 0.42 187 SHOPIFY_IMG_NOT_RCVD_SFY 926 0.48 0.61 0.42 188 XM_DIRTYINTL 901 1.18 2.71 0.40 189 NO_DNS_FOR_FROM 880 0.41 0.44 0.40 190 SpammyFromTLD_01 869 1.50 3.70 0.39 191 XMPhish14 867 0.38 0.37 0.39 192 XMSexyCombo_04 866 0.52 0.79 0.39 193 T_FILL_THIS_FORM_SHORT 852 1.11 2.57 0.38 194 XMSubMetaI_00 842 0.78 1.57 0.38 195 DKIM_ADSP_NXDOMAIN 833 0.60 1.06 0.37 196 XMLngstWrd_03 832 0.33 0.25 0.37 197 TR_XM_MaxWHORU 826 0.39 0.43 0.37 198 TR_BOTNET_NEGATE 826 0.47 0.68 0.37 199 XM_BadFromFormat 824 0.46 0.65 0.37 200 XM_shorewaves_Whitelist 818 0.24 0.00 0.37 ----------------------------------------------------------------------