Email: 359846 Autolearn: 0 AvgScore: 4.40 AvgScanTime: 1.24 sec Spam: 130044 Autolearn: 0 AvgScore: 13.77 AvgScanTime: 1.35 sec Ham: 229802 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.18 sec Time Spent Running SA: 123.72 hours Time Spent Processing Spam: 48.59 hours Time Spent Processing Ham: 75.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125248 89.81 96.31 86.12 2 DKIM_SIGNED 116244 82.27 89.39 78.24 3 XM_DK_Pass 114163 81.09 87.79 77.31 4 DKIM_VALID 112691 79.76 86.66 75.85 5 XM_B_Unicode 102125 75.06 78.53 73.10 6 DCC_CHECK 102049 57.91 78.47 46.27 7 RELAYCOUNTRY_US 97528 79.18 75.00 81.55 8 XMListUnsubscribeExists 96103 62.58 73.90 56.18 9 XM_B_SpammyWords 89694 54.88 68.97 46.91 10 DKIM_VALID_AU 87980 64.89 67.65 63.32 11 XM_DK_Undo_02 74216 27.55 57.07 10.85 12 TR_XM_DKIM_Undo 58038 20.85 44.63 7.40 13 BAYES_99 57051 21.29 43.87 8.52 14 XM_B_Unicode3 55785 43.41 42.90 43.70 15 XM_B_SpammyWords2 53198 27.04 40.91 19.20 16 LOC_TINY_FONT_1 48951 33.78 37.64 31.60 17 BAYES_999 47215 17.64 36.31 7.07 18 HTML_FONT_LOW_CONTRAST 45833 33.96 35.24 33.23 19 TR_DCC_Bayes_99 44060 15.26 33.88 4.73 20 RCVD_IN_MSPIKE_H2 43148 29.12 33.18 26.82 21 BAYES_50 42828 46.94 32.93 54.86 22 MIME_HTML_ONLY 41190 26.76 31.67 23.98 23 DKIM_VALID_EF 38731 30.54 29.78 30.96 24 FVGT_m_MULTI_ODD 33828 25.17 26.01 24.69 25 RCVD_IN_MSPIKE_WL 30119 29.32 23.16 32.81 26 T_KAM_HTML_FONT_INVALID 30034 18.62 23.10 16.09 27 RELAYCOUNTRY_META 29821 11.04 22.93 4.31 28 T_TM2_M_HEADER_IN_MSG 28739 21.50 22.10 21.15 29 DCC_CHECK_NEGATIVE 26042 40.81 20.03 52.56 30 XMSubLong 24648 20.96 18.95 22.09 31 XM_Body_Dirty_Words 23933 15.02 18.40 13.10 32 TR_XM_SpammyWords2 22921 7.68 17.63 2.06 33 XM_Multi_Part_URI 19939 14.72 15.33 14.38 34 UNTRUSTED_Relay 18614 6.47 14.31 2.02 35 BOTNET 18499 6.38 14.23 1.94 36 XM_UncommonTLD01 18457 7.80 14.19 4.18 37 LOTS_OF_MONEY 17214 9.23 13.24 6.96 38 XM_B_SpammyWords3 17042 6.85 13.10 3.31 39 XM_B_Unsub 16708 11.29 12.85 10.40 40 RCVD_IN_BL_SPAMCOP_NET 16444 5.55 12.64 1.54 41 XM_Evil_Numbers_Gen 15816 9.70 12.16 8.31 42 RCVD_IN_MSPIKE_H3 15797 15.27 12.15 17.04 43 XMSexyCombo_05 15433 7.64 11.87 5.24 44 BOTNET_IPINHOSTNAME 14720 8.25 11.32 6.52 45 TR_XM_SpammyWords4 14573 7.08 11.21 4.74 46 MPART_ALT_DIFF 14020 7.26 10.78 5.26 47 FSL_BULK_SIG 13522 7.34 10.40 5.61 48 MIME_HTML_MOSTLY 13447 5.75 10.34 3.16 49 UNPARSEABLE_RELAY 13267 9.78 10.20 9.55 50 TR_XM_UnparsRelay 13094 8.90 10.07 8.24 51 RCVD_IN_MSPIKE_H4 13078 12.14 10.06 13.32 52 HTML_IMAGE_RATIO_02 12865 9.67 9.89 9.54 53 RELAYCOUNTRY_CA 12533 4.47 9.64 1.54 54 LotsOfNums_01 12449 8.76 9.57 8.30 55 XM_B_Phish_Phrases 10570 5.68 8.13 4.29 56 RCVD_IN_RP_SAFE 10424 11.15 8.02 12.93 57 BAYES_80 9721 6.29 7.48 5.61 58 XMSubMetaSx_00 9565 5.17 7.36 3.93 59 BAYES_60 9529 9.63 7.33 10.94 60 XM_SendGrid 9155 8.12 7.04 8.73 61 SpammyFromTLD_02 8664 2.47 6.66 0.10 62 XM_UB50 8074 3.07 6.21 1.29 63 XM_H_Long_From01 8003 5.89 6.15 5.74 64 HTML_IMAGE_RATIO_04 7894 6.35 6.07 6.51 65 XMNumbers 7758 4.38 5.97 3.48 66 RCVD_IN_RP_CERTIFIED 7474 9.71 5.75 11.95 67 T_REMOTE_IMAGE 7084 3.84 5.45 2.93 68 TooManyTo_001 7073 6.27 5.44 6.74 69 URIBL_SBL_A 6979 2.86 5.37 1.44 70 BAYES_95 6241 4.23 4.80 3.91 71 XMStrtUSub 6201 5.79 4.77 6.37 72 SpammyFromTLD_01 6142 2.01 4.72 0.47 73 TR_XM_PhishingBody 6079 3.29 4.67 2.50 74 TR_LOTS_OF_MONEY3 5916 2.18 4.55 0.84 75 FROM_EXCESS_BASE64 5871 4.05 4.51 3.78 76 TR_XM_SpammyWords5 5853 2.47 4.50 1.32 77 TR_XM_DK_SendGrid 5658 5.26 4.35 5.78 78 KHOP_HELO_FCRDNS 5561 2.25 4.28 1.11 79 TM2_M_URI_OPT_OUT 5391 3.61 4.15 3.31 80 XMBody_17 5347 2.02 4.11 0.84 81 HTML_SHORT_LINK_IMG_1 5203 1.46 4.00 0.02 82 XM_OfRef6 5149 2.03 3.96 0.94 83 XM_DK_Undo_01 4993 2.27 3.84 1.38 84 RELAYCOUNTRY_FR 4991 1.53 3.84 0.23 85 HTML_FONT_SIZE_LARGE 4931 1.45 3.79 0.12 86 T_XMHurry_00 4766 1.98 3.66 1.02 87 HTML_IMAGE_ONLY_12 4760 1.40 3.66 0.13 88 BODY_URI_ONLY 4662 1.30 3.58 0.01 89 XMSubMetaI_00 4572 2.00 3.52 1.15 90 XMBdyGiftCard01 4410 2.00 3.39 1.21 91 XM_B_Unsub2 4322 1.79 3.32 0.92 92 URI_HEX 4257 2.01 3.27 1.29 93 URIBL_DBL_SPAM 4199 1.18 3.23 0.01 94 XM_UB99 4052 1.13 3.12 0.00 95 XM_B_SpammyTLD 3933 2.62 3.02 2.39 96 RCVD_IN_MSPIKE_BL 3783 1.12 2.91 0.11 97 HTML_IMAGE_RATIO_06 3774 3.18 2.90 3.35 98 TR_XM_MSPIKECOMBO 3759 1.12 2.89 0.11 99 TR_XM_BayesRelay 3675 1.04 2.83 0.03 100 DKIM_INVALID 3553 2.51 2.73 2.38 101 RCVD_IN_RP_RNBL 3522 1.00 2.71 0.04 102 MIME_HTML_ONLY_MULTI 3492 2.95 2.69 3.10 103 XMDiploma_00 3464 1.83 2.66 1.36 104 XM_CamelCaseFrm001 3409 2.08 2.62 1.77 105 PDS_OTHER_BAD_TLD 3327 1.58 2.56 1.03 106 XMBrknScrpt_02 3317 1.42 2.55 0.78 107 T_XMDrugObfuBody_14 3229 2.65 2.48 2.75 108 XM_B_SpammyWords4 3191 1.13 2.45 0.37 109 XM_UB999 3140 0.87 2.41 0.00 110 XM_DIRTYINTL 3118 1.14 2.40 0.43 111 XM_SPF_SoftFail 3080 1.64 2.37 1.22 112 URI_PHP_REDIR 3025 0.84 2.33 0.00 113 TR_XM_MaxBayes 3019 0.87 2.32 0.05 114 XM_UB60 3002 0.95 2.31 0.18 115 RCVD_IN_MSPIKE_L5 2931 0.86 2.25 0.08 116 HTML_IMAGE_RATIO_08 2884 2.31 2.22 2.36 117 HK_RANDOM_REPLYTO 2845 0.91 2.19 0.19 118 BOTNET_NORDNS 2752 0.78 2.12 0.02 119 T_FILL_THIS_FORM_SHORT 2748 1.04 2.11 0.43 120 TM2_M_VERY_LONG_WORD 2492 1.68 1.92 1.54 121 RELAYCOUNTRY_DE 2488 0.89 1.91 0.31 122 MIME_QP_LONG_LINE 2438 2.87 1.87 3.44 123 T_TooManySym_01 2438 4.97 1.87 6.73 124 URI_TRY_3LD 2429 1.43 1.87 1.18 125 T_XMDrugObfuBody_08 2357 1.72 1.81 1.67 126 XMStockSpam_06 2317 1.25 1.78 0.95 127 FROM_SUSPICIOUS_NTLD 2306 0.73 1.77 0.14 128 XM_B_Phish66 2287 1.33 1.76 1.09 129 ANY_BOUNCE_MESSAGE 2269 2.62 1.74 3.11 130 BOUNCE_MESSAGE 2266 2.62 1.74 3.11 131 SUBJ_ALL_CAPS 2248 1.28 1.73 1.03 132 FROM_SUSPICIOUS_NTLD_FP 2222 0.70 1.71 0.12 133 XMLngstWrd_00 2212 0.90 1.70 0.45 134 FORGED_GMAIL_RCVD 2004 0.88 1.54 0.50 135 XMPhish08 1948 0.92 1.50 0.60 136 TO_IN_SUBJ 1945 0.55 1.50 0.02 137 XM_RXBody 1928 0.66 1.48 0.20 138 RCVD_IN_PSBL 1926 0.61 1.48 0.12 139 URI_NOVOWEL 1914 1.74 1.47 1.89 140 URI_OPTOUT_3LD 1911 0.56 1.47 0.04 141 BAYES_40 1884 2.59 1.45 3.24 142 TR_XM_PHPDW 1883 0.76 1.45 0.37 143 DIET_1 1873 0.87 1.44 0.55 144 RCVD_IN_IADB_LISTED 1838 2.60 1.41 3.26 145 XM_UB80 1799 0.52 1.38 0.04 146 XMLngstWrd_01 1780 0.74 1.37 0.39 147 XMSexyCombo_01 1760 0.74 1.35 0.39 148 HTTPS_HTTP_MISMATCH 1755 0.95 1.35 0.73 149 XMGenDplmaNmb 1743 0.90 1.34 0.65 150 TR_XM_PHPForged 1742 0.65 1.34 0.26 151 TR_XM_SpammyWords3 1740 0.52 1.34 0.05 152 TR_XM_FormFill2 1720 0.65 1.32 0.27 153 XM_H_PHPOS 1714 0.64 1.32 0.25 154 TR_XM_FormFill 1705 0.48 1.31 0.01 155 RELAYCOUNTRY_CH 1650 0.48 1.27 0.03 156 PRICES_ARE_AFFORDABLE 1635 0.46 1.26 0.01 157 RCVD_IN_IADB_SPF 1627 2.29 1.25 2.87 158 XM_Body_Obfu01 1602 0.56 1.23 0.18 159 NUMERIC_HTTP_ADDR 1587 0.76 1.22 0.49 160 THIS_AD 1553 0.93 1.19 0.78 161 RCVD_IN_IADB_DK 1548 2.05 1.19 2.53 162 RCVD_IN_IADB_SENDERID 1528 2.08 1.17 2.60 163 T_XMDrugObfuBody_00 1456 0.98 1.12 0.90 164 HTML_MIME_NO_HTML_TAG 1421 1.46 1.09 1.66 165 URIBL_BLACK 1414 0.42 1.09 0.04 166 XMLngstWrd_02 1392 0.58 1.07 0.31 167 XM_B_COVIDMETA 1377 1.09 1.06 1.11 168 XM_URI_RBL 1372 0.52 1.06 0.22 169 TR_Sbj_FN_Bdy 1362 0.46 1.05 0.13 170 ALL_TRUSTED 1356 9.82 1.04 14.78 171 TR_XM_INV_DKIM 1352 0.43 1.04 0.09 172 XM_UB95 1352 0.39 1.04 0.02 173 BAYES_20 1342 1.91 1.03 2.41 174 GOOGLE_DOC_SUSP 1318 0.37 1.01 0.01 175 XM_H_Long_From02 1315 1.11 1.01 1.17 176 TR_XM_RelayPhish 1313 0.41 1.01 0.08 177 MAILING_LIST_MULTI 1308 1.60 1.01 1.93 178 TR_Symld_Words 1300 1.12 1.00 1.19 179 LongTLD 1271 0.40 0.98 0.08 180 RCVD_IN_MSPIKE_H5 1244 1.90 0.96 2.44 181 TM2_M_A_HREF_HREF 1226 0.47 0.94 0.20 182 SUBJ_DOLLARS 1133 0.93 0.87 0.96 183 HTML_FONT_FACE_BAD 1130 1.28 0.87 1.52 184 HTML_TAG_BALANCE_BODY 1107 0.56 0.85 0.40 185 RELAYCOUNTRY_NL 1104 0.49 0.85 0.29 186 TR_XM_SB_Phish 1062 1.28 0.82 1.54 187 HTML_IMAGE_ONLY_32 1056 0.48 0.81 0.29 188 TR_XM_COVIDMETA4 1056 0.44 0.81 0.23 189 XMHTML_After_End 1028 0.86 0.79 0.90 190 XM_ProductURIs 1018 0.69 0.78 0.63 191 XMSubNoVowel 1014 1.15 0.78 1.36 192 TR_Mismatch_TLD_02 1009 0.31 0.78 0.05 193 XMLngstWrd_03 1005 0.41 0.77 0.21 194 TR_Caps_n_Bayes_99 1001 0.30 0.77 0.03 195 XMSubPhish11 995 1.26 0.77 1.54 196 RELAYCOUNTRY_IN 995 0.33 0.77 0.08 197 XM_H_Undi_Recip 992 0.37 0.76 0.15 198 XM_OfRef7 989 0.34 0.76 0.10 199 T_Symld_Words_02 981 0.45 0.75 0.28 200 PLING_QUERY 972 0.71 0.75 0.69 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 197913 89.81 96.31 86.12 2 RELAYCOUNTRY_US 187404 79.18 75.00 81.55 3 DKIM_SIGNED 179793 82.27 89.39 78.24 4 XM_DK_Pass 177649 81.09 87.79 77.31 5 DKIM_VALID 174315 79.76 86.66 75.85 6 XM_B_Unicode 167985 75.06 78.53 73.10 7 DKIM_VALID_AU 145521 64.89 67.65 63.32 8 XMListUnsubscribeExists 129106 62.58 73.90 56.18 9 BAYES_50 126072 46.94 32.93 54.86 10 DCC_CHECK_NEGATIVE 120794 40.81 20.03 52.56 11 XM_B_SpammyWords 107797 54.88 68.97 46.91 12 DCC_CHECK 106329 57.91 78.47 46.27 13 XM_B_Unicode3 100422 43.41 42.90 43.70 14 HTML_FONT_LOW_CONTRAST 76354 33.96 35.24 33.23 15 RCVD_IN_MSPIKE_WL 75394 29.32 23.16 32.81 16 LOC_TINY_FONT_1 72621 33.78 37.64 31.60 17 DKIM_VALID_EF 71155 30.54 29.78 30.96 18 RCVD_IN_MSPIKE_H2 61622 29.12 33.18 26.82 19 FVGT_m_MULTI_ODD 56742 25.17 26.01 24.69 20 MIME_HTML_ONLY 55118 26.76 31.67 23.98 21 XMSubLong 50763 20.96 18.95 22.09 22 T_TM2_M_HEADER_IN_MSG 48610 21.50 22.10 21.15 23 XM_B_SpammyWords2 44115 27.04 40.91 19.20 24 RCVD_IN_MSPIKE_H3 39169 15.27 12.15 17.04 25 T_KAM_HTML_FONT_INVALID 36965 18.62 23.10 16.09 26 ALL_TRUSTED 33964 9.82 1.04 14.78 27 XM_Multi_Part_URI 33038 14.72 15.33 14.38 28 RCVD_IN_MSPIKE_H4 30614 12.14 10.06 13.32 29 XM_Body_Dirty_Words 30106 15.02 18.40 13.10 30 XM_DKIMWhitelistDomains 29965 8.34 0.02 13.04 31 RCVD_IN_RP_SAFE 29702 11.15 8.02 12.93 32 RCVD_IN_RP_CERTIFIED 27454 9.71 5.75 11.95 33 BAYES_60 25139 9.63 7.33 10.94 34 XM_DK_Undo_02 24938 27.55 57.07 10.85 35 XM_B_Unsub 23905 11.29 12.85 10.40 36 UNPARSEABLE_RELAY 21942 9.78 10.20 9.55 37 HTML_IMAGE_RATIO_02 21919 9.67 9.89 9.54 38 BAYES_00 20536 5.92 0.58 8.94 39 XM_SendGrid 20059 8.12 7.04 8.73 40 BAYES_99 19572 21.29 43.87 8.52 41 XM_Evil_Numbers_Gen 19101 9.70 12.16 8.31 42 LotsOfNums_01 19074 8.76 9.57 8.30 43 TR_XM_UnparsRelay 18941 8.90 10.07 8.24 44 TR_XM_DKIM_Undo 17004 20.85 44.63 7.40 45 TR_XM_DK_Bayes 16862 4.87 0.51 7.34 46 TR_XM_DK_Bayes1 16569 4.79 0.50 7.21 47 BAYES_999 16256 17.64 36.31 7.07 48 LOTS_OF_MONEY 15985 9.23 13.24 6.96 49 TR_XM_DK_Bayes2 15488 4.46 0.42 6.74 50 TooManyTo_001 15485 6.27 5.44 6.74 51 T_TooManySym_01 15456 4.97 1.87 6.73 52 BOTNET_IPINHOSTNAME 14979 8.25 11.32 6.52 53 HTML_IMAGE_RATIO_04 14970 6.35 6.07 6.51 54 XMStrtUSub 14640 5.79 4.77 6.37 55 TR_XM_DK_SendGrid 13275 5.26 4.35 5.78 56 XM_H_Long_From01 13195 5.89 6.15 5.74 57 FSL_BULK_SIG 12901 7.34 10.40 5.61 58 BAYES_80 12901 6.29 7.48 5.61 59 MPART_ALT_DIFF 12087 7.26 10.78 5.26 60 XMSexyCombo_05 12048 7.64 11.87 5.24 61 IN_ZIMBRA_NJ_WHITELIST 11307 3.15 0.03 4.92 62 TR_XM_SpammyWords4 10899 7.08 11.21 4.74 63 TR_DCC_Bayes_99 10870 15.26 33.88 4.73 64 RELAYCOUNTRY_META 9895 11.04 22.93 4.31 65 XM_B_Phish_Phrases 9868 5.68 8.13 4.29 66 XM_UncommonTLD01 9608 7.80 14.19 4.18 67 XMSubMetaSx_00 9030 5.17 7.36 3.93 68 T_TooManySym_02 9026 2.70 0.52 3.93 69 BAYES_95 8990 4.23 4.80 3.91 70 FROM_EXCESS_BASE64 8698 4.05 4.51 3.78 71 XMNumbers 8003 4.38 5.97 3.48 72 MIME_QP_LONG_LINE 7905 2.87 1.87 3.44 73 TVD_RCVD_IP 7720 2.18 0.08 3.36 74 HTML_IMAGE_RATIO_06 7687 3.18 2.90 3.35 75 TM2_M_URI_OPT_OUT 7610 3.61 4.15 3.31 76 XM_B_SpammyWords3 7606 6.85 13.10 3.31 77 RCVD_IN_IADB_LISTED 7501 2.60 1.41 3.26 78 BAYES_40 7436 2.59 1.45 3.24 79 INVALID_MSGID 7342 2.20 0.44 3.19 80 MIME_HTML_MOSTLY 7261 5.75 10.34 3.16 81 ANY_BOUNCE_MESSAGE 7153 2.62 1.74 3.11 82 BOUNCE_MESSAGE 7151 2.62 1.74 3.11 83 XM_H_Trusted_IP 7120 1.98 0.00 3.10 84 MIME_HTML_ONLY_MULTI 7115 2.95 2.69 3.10 85 MSGID_NOFQDN1 7064 1.98 0.05 3.07 86 T_REMOTE_IMAGE 6739 3.84 5.45 2.93 87 RCVD_IN_IADB_SPF 6600 2.29 1.25 2.87 88 T_XMDrugObfuBody_14 6311 2.65 2.48 2.75 89 TO_MALFORMED 6210 1.73 0.02 2.70 90 RCVD_IN_IADB_SENDERID 5972 2.08 1.17 2.60 91 RCVD_IN_IADB_DK 5824 2.05 1.19 2.53 92 TR_XM_PhishingBody 5748 3.29 4.67 2.50 93 RCVD_IN_MSPIKE_H5 5611 1.90 0.96 2.44 94 BAYES_20 5533 1.91 1.03 2.41 95 XM_B_SpammyTLD 5492 2.62 3.02 2.39 96 DKIM_INVALID 5478 2.51 2.73 2.38 97 HELO_MISC_IP 5448 1.54 0.08 2.37 98 HTML_IMAGE_RATIO_08 5417 2.31 2.22 2.36 99 XMBSHREFv2 4994 1.59 0.56 2.17 100 TR_XM_SpammyWords2 4724 7.68 17.63 2.06 101 UNTRUSTED_Relay 4651 6.47 14.31 2.02 102 XM_PDF 4500 1.33 0.22 1.96 103 BOTNET 4467 6.38 14.23 1.94 104 RCVD_IN_IADB_VOUCHED 4454 1.43 0.54 1.94 105 MAILING_LIST_MULTI 4444 1.60 1.01 1.93 106 URI_NOVOWEL 4348 1.74 1.47 1.89 107 IN_HORDE_ADDRESS_BOOK 4332 1.22 0.04 1.89 108 USER_IN_DEF_DKIM_WL 4146 1.15 0.00 1.80 109 XM_CamelCaseFrm001 4067 2.08 2.62 1.77 110 T_XMDrugObfuBody_08 3837 1.72 1.81 1.67 111 HTML_MIME_NO_HTML_TAG 3825 1.46 1.09 1.66 112 BAYES_05 3620 1.20 0.54 1.58 113 RELAYCOUNTRY_CA 3547 4.47 9.64 1.54 114 TM2_M_VERY_LONG_WORD 3545 1.68 1.92 1.54 115 TR_XM_SB_Phish 3541 1.28 0.82 1.54 116 RCVD_IN_BL_SPAMCOP_NET 3539 5.55 12.64 1.54 117 XMSubPhish11 3531 1.26 0.77 1.54 118 HTML_FONT_FACE_BAD 3483 1.28 0.87 1.52 119 URIBL_SBL_A 3304 2.86 5.37 1.44 120 XM_DK_Undo_01 3170 2.27 3.84 1.38 121 XMSubNoVowel 3129 1.15 0.78 1.36 122 XMGappySubj_01 3115 1.03 0.44 1.36 123 XMDiploma_00 3114 1.83 2.66 1.36 124 TR_XM_SpammyWords5 3031 2.47 4.50 1.32 125 URI_HEX 2964 2.01 3.27 1.29 126 XM_UB50 2964 3.07 6.21 1.29 127 TooManyTo_002 2907 0.97 0.45 1.27 128 RCVD_IN_IADB_OPTIN 2870 0.94 0.39 1.25 129 XM_SPF_SoftFail 2812 1.64 2.37 1.22 130 XMBdyGiftCard01 2776 2.00 3.39 1.21 131 TR_Symld_Words 2736 1.12 1.00 1.19 132 URI_TRY_3LD 2722 1.43 1.87 1.18 133 XM_GoogleGroups 2707 0.89 0.38 1.18 134 XM_H_Long_From02 2679 1.11 1.01 1.17 135 TVD_SPACE_RATIO 2651 0.76 0.05 1.15 136 XMSubMetaI_00 2637 2.00 3.52 1.15 137 XM_B_COVIDMETA 2549 1.09 1.06 1.11 138 KHOP_HELO_FCRDNS 2540 2.25 4.28 1.11 139 XM_B_Phish66 2505 1.33 1.76 1.09 140 SUBJ_ALL_CAPS 2366 1.28 1.73 1.03 141 PDS_OTHER_BAD_TLD 2364 1.58 2.56 1.03 142 T_TooManySym_03 2356 0.70 0.12 1.03 143 T_XMHurry_00 2354 1.98 3.66 1.02 144 XMBody_95 2259 0.68 0.13 0.98 145 SUBJ_DOLLARS 2213 0.93 0.87 0.96 146 XMStockSpam_06 2191 1.25 1.78 0.95 147 XM_OfRef6 2168 2.03 3.96 0.94 148 TR_MSPIKEBAYES00 2160 0.62 0.04 0.94 149 XM_B_Unsub2 2112 1.79 3.32 0.92 150 T_XMDrugObfuBody_00 2079 0.98 1.12 0.90 151 XMHTML_After_End 2071 0.86 0.79 0.90 152 DKIM_ADSP_CUSTOM_MED 2030 0.81 0.69 0.88 153 TooManyTo_003 1952 0.68 0.38 0.85 154 XMBody_17 1938 2.02 4.11 0.84 155 TR_LOTS_OF_MONEY3 1937 2.18 4.55 0.84 156 XMHTMLBadTable_001 1853 0.73 0.59 0.81 157 HTML_IMAGE_ONLY_20 1841 0.54 0.08 0.80 158 XMBrknScrpt_02 1803 1.42 2.55 0.78 159 THIS_AD 1788 0.93 1.19 0.78 160 RDNS_DYNAMIC 1721 0.73 0.70 0.75 161 HTTPS_HTTP_MISMATCH 1668 0.95 1.35 0.73 162 USER_IN_WHITELIST 1626 0.45 0.00 0.71 163 USER_IN_WELCOMELIST 1626 0.45 0.00 0.71 164 XM_B_COPY_HTML 1615 0.67 0.60 0.70 165 PLING_QUERY 1582 0.71 0.75 0.69 166 TooManyTo_004 1581 0.57 0.35 0.69 167 XM_B_REG_HTML 1566 0.56 0.35 0.68 168 XMGenDplmaNmb 1501 0.90 1.34 0.65 169 XM_ProductURIs 1451 0.69 0.78 0.63 170 XMSubMetaSxObfu_02 1435 0.49 0.25 0.62 171 RELAYCOUNTRY_GB 1381 0.56 0.48 0.60 172 XMPhish08 1376 0.92 1.50 0.60 173 TR_MetaPhish_Combo_01 1359 0.55 0.48 0.59 174 TooManyTo_005 1337 0.48 0.31 0.58 175 NML_ADSP_CUSTOM_MED 1327 0.59 0.62 0.58 176 DIET_1 1258 0.87 1.44 0.55 177 XM_H_PHPMailer 1228 0.61 0.74 0.53 178 MISSING_HEADERS 1177 0.40 0.21 0.51 179 HELO_NODOT 1171 0.47 0.40 0.51 180 HELO_NO_DOMAIN 1171 0.47 0.40 0.51 181 FORGED_GMAIL_RCVD 1154 0.88 1.54 0.50 182 NUMERIC_HTTP_ADDR 1130 0.76 1.22 0.49 183 XMSubMetaSxObfu_03 1118 0.56 0.68 0.49 184 XMPhish30 1101 0.57 0.73 0.48 185 SpammyFromTLD_01 1088 2.01 4.72 0.47 186 XMLngstWrd_00 1038 0.90 1.70 0.45 187 MPART_ALT_DIFF_COUNT 1028 0.51 0.63 0.45 188 T_TooManySym_04 1017 0.30 0.04 0.44 189 T_FILL_THIS_FORM_SHORT 995 1.04 2.11 0.43 190 XM_DIRTYINTL 989 1.14 2.40 0.43 191 XMOemUri 972 0.31 0.11 0.42 192 XM_BadFromFormat 950 0.46 0.53 0.41 193 T_HTML_TAG_BALANCE_CENTER 936 0.43 0.47 0.41 194 TVD_SPACE_RATIO_MINFP 933 0.40 0.38 0.41 195 XM_ShortIntro_01 919 0.40 0.40 0.40 196 HTML_TAG_BALANCE_BODY 909 0.56 0.85 0.40 197 SHOPIFY_IMG_NOT_RCVD_SFY 906 0.43 0.50 0.39 198 HTML_FONT_SIZE_HUGE 900 0.45 0.57 0.39 199 XMSexyCombo_01 900 0.74 1.35 0.39 200 XMLngstWrd_01 893 0.74 1.37 0.39 ----------------------------------------------------------------------