Email: 489193 Autolearn: 0 AvgScore: 3.21 AvgScanTime: 1.09 sec Spam: 140883 Autolearn: 0 AvgScore: 14.06 AvgScanTime: 1.28 sec Ham: 348310 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 1.01 sec Time Spent Running SA: 147.50 hours Time Spent Processing Spam: 50.23 hours Time Spent Processing Ham: 97.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134994 80.82 95.82 74.76 2 DKIM_SIGNED 122159 71.08 86.71 64.76 3 XM_DK_Pass 120416 70.25 85.47 64.09 4 DKIM_VALID 117802 68.84 83.62 62.87 5 XM_B_Unicode 114603 68.67 81.35 63.54 6 DCC_CHECK 113495 49.28 80.56 36.63 7 RELAYCOUNTRY_US 108110 72.79 76.74 71.19 8 XMListUnsubscribeExists 106291 55.06 75.45 46.81 9 XM_B_SpammyWords 96337 48.37 68.38 40.27 10 DKIM_VALID_AU 89848 53.54 63.77 49.40 11 XM_DK_Undo_02 76057 22.03 53.99 9.11 12 XM_B_Unicode3 63925 42.37 45.37 41.15 13 TR_XM_DKIM_Undo 61559 16.62 43.70 5.67 14 BAYES_99 61387 18.00 43.57 7.65 15 XM_B_SpammyWords2 54554 24.45 38.72 18.67 16 LOC_TINY_FONT_1 53911 27.85 38.27 23.64 17 BAYES_999 50222 14.92 35.65 6.54 18 TR_DCC_Bayes_99 49189 12.83 34.91 3.90 19 MIME_HTML_ONLY 48372 25.32 34.33 21.68 20 HTML_FONT_LOW_CONTRAST 45936 28.68 32.61 27.09 21 BAYES_50 43813 47.63 31.10 54.32 22 RCVD_IN_MSPIKE_H2 43497 23.95 30.87 21.14 23 FVGT_m_MULTI_ODD 40573 24.09 28.80 22.19 24 DKIM_VALID_EF 37912 25.70 26.91 25.21 25 T_KAM_HTML_FONT_INVALID 35552 18.52 25.24 15.81 26 RCVD_IN_MSPIKE_WL 33289 25.14 23.63 25.75 27 XMSubLong 31005 17.31 22.01 15.42 28 XM_Body_Dirty_Words 28461 13.69 20.20 11.05 29 RELAYCOUNTRY_META 27077 7.83 19.22 3.22 30 DCC_CHECK_NEGATIVE 25581 49.63 18.16 62.37 31 TR_XM_SpammyWords2 23459 5.90 16.65 1.55 32 T_TM2_M_HEADER_IN_MSG 22942 18.54 16.28 19.45 33 XM_Multi_Part_URI 22357 18.17 15.87 19.10 34 LOTS_OF_MONEY 20325 8.21 14.43 5.70 35 UNTRUSTED_Relay 20160 5.09 14.31 1.37 36 BOTNET 18103 4.79 12.85 1.53 37 TR_XM_SpammyWords4 17880 6.52 12.69 4.02 38 RCVD_IN_MSPIKE_H3 17646 14.11 12.53 14.75 39 BOTNET_IPINHOSTNAME 17348 7.89 12.31 6.10 40 FSL_BULK_SIG 17173 7.15 12.19 5.11 41 XM_UncommonTLD01 16929 5.97 12.02 3.52 42 RCVD_IN_BL_SPAMCOP_NET 16599 4.05 11.78 0.92 43 XMSexyCombo_05 16584 6.33 11.77 4.13 44 XM_B_SpammyWords3 15424 6.24 10.95 4.33 45 XM_Evil_Numbers_Gen 14867 8.54 10.55 7.73 46 RCVD_IN_MSPIKE_H4 14387 9.31 10.21 8.95 47 UNPARSEABLE_RELAY 14287 8.15 10.14 7.34 48 TR_XM_UnparsRelay 14153 7.56 10.05 6.56 49 HTML_IMAGE_RATIO_02 13464 8.33 9.56 7.83 50 XM_B_Unsub 13256 10.62 9.41 11.10 51 BAYES_80 12458 5.63 8.84 4.34 52 LotsOfNums_01 12010 7.49 8.52 7.07 53 XMSubMetaSx_00 11427 6.06 8.11 5.22 54 XM_SendGrid 11102 6.99 7.88 6.62 55 BAYES_60 10875 8.47 7.72 8.77 56 MPART_ALT_DIFF 10843 7.61 7.70 7.57 57 SpammyFromTLD_02 10642 2.34 7.55 0.22 58 RELAYCOUNTRY_CA 10628 2.97 7.54 1.12 59 KHOP_HELO_FCRDNS 9989 2.71 7.09 0.93 60 RCVD_IN_RP_SAFE 9372 8.30 6.65 8.97 61 HTML_IMAGE_RATIO_04 9099 7.38 6.46 7.75 62 TooManyTo_001 9037 5.57 6.41 5.23 63 XM_H_Long_From01 9029 4.87 6.41 4.25 64 XM_B_Phish_Phrases 7730 4.88 5.49 4.64 65 HTML_SHORT_LINK_IMG_1 7415 1.53 5.26 0.02 66 HTML_FONT_SIZE_LARGE 7331 1.56 5.20 0.09 67 XM_OfRef6 7183 1.96 5.10 0.69 68 HTML_IMAGE_ONLY_12 7147 1.53 5.07 0.10 69 MIME_HTML_MOSTLY 7109 3.20 5.05 2.45 70 URIBL_SBL_A 7096 2.16 5.04 1.00 71 BAYES_95 7012 3.35 4.98 2.69 72 RCVD_IN_RP_CERTIFIED 7009 7.25 4.98 8.17 73 BODY_URI_ONLY 6993 1.43 4.96 0.00 74 XMNumbers 6672 3.31 4.74 2.73 75 XM_UB50 6667 1.98 4.73 0.86 76 TR_XM_PhishingBody 6662 2.74 4.73 1.94 77 XM_B_SpammyTLD 6604 2.63 4.69 1.80 78 RCVD_IN_MSPIKE_BL 6484 1.39 4.60 0.08 79 TR_XM_MSPIKECOMBO 6460 1.38 4.59 0.08 80 TR_XM_SpammyWords5 6273 2.23 4.45 1.33 81 TR_XM_DK_SendGrid 6055 4.22 4.30 4.19 82 FROM_EXCESS_BASE64 5916 3.31 4.20 2.95 83 TR_LOTS_OF_MONEY3 5399 2.08 3.83 1.38 84 RCVD_IN_RP_RNBL 5385 1.12 3.82 0.03 85 XM_DK_Undo_01 5354 1.85 3.80 1.06 86 T_FILL_THIS_FORM_SHORT 5204 1.42 3.69 0.50 87 RCVD_IN_PSBL 5193 1.14 3.69 0.12 88 BOTNET_NORDNS 5132 1.06 3.64 0.02 89 XMStrtUSub 5097 5.23 3.62 5.88 90 XMBdyGiftCard01 4921 1.52 3.49 0.72 91 URI_HEX 4836 1.68 3.43 0.97 92 TR_XM_SpammyWords3 4756 1.00 3.38 0.04 93 RCVD_IN_MSPIKE_L5 4749 1.01 3.37 0.05 94 XM_CamelCaseFrm001 4747 2.05 3.37 1.51 95 TR_XM_MaxBayes 4675 0.97 3.32 0.02 96 XM_UB99 4660 0.95 3.31 0.00 97 MIME_HTML_ONLY_MULTI 4562 4.95 3.24 5.64 98 XMDiploma_00 4473 1.89 3.17 1.37 99 TM2_M_URI_OPT_OUT 4375 16.55 3.11 21.99 100 DKIM_INVALID 4357 2.24 3.09 1.89 101 PDS_OTHER_BAD_TLD 4304 1.34 3.06 0.65 102 XM_DIRTYINTL 4300 1.05 3.05 0.24 103 HTML_IMAGE_RATIO_06 4168 2.97 2.96 2.98 104 URI_PHP_REDIR 4133 0.85 2.93 0.00 105 SpammyFromTLD_01 4013 1.06 2.85 0.34 106 XMBrknScrpt_02 3949 1.26 2.80 0.64 107 XM_SPF_SoftFail 3919 1.51 2.78 0.99 108 XM_UB60 3619 0.85 2.57 0.15 109 XMBody_17 3575 1.06 2.54 0.46 110 T_XMDrugObfuBody_14 3511 2.12 2.49 1.97 111 MIME_QP_LONG_LINE 3294 3.44 2.34 3.89 112 XM_UB80 3199 0.69 2.27 0.05 113 SUBJ_ALL_CAPS 3199 1.41 2.27 1.07 114 TR_XM_BayesRelay 3139 0.66 2.23 0.02 115 XMSexyCombo_01 3086 1.46 2.19 1.17 116 XM_UB999 3065 0.63 2.18 0.00 117 TR_XM_FormFill 3017 0.62 2.14 0.01 118 HTML_IMAGE_RATIO_08 2837 1.94 2.01 1.91 119 TM2_M_VERY_LONG_WORD 2808 1.63 1.99 1.49 120 XM_B_Phish66 2675 1.14 1.90 0.83 121 HK_RANDOM_REPLYTO 2633 0.60 1.87 0.09 122 XM_B_SpammyWords4 2609 0.79 1.85 0.36 123 DIET_1 2609 1.06 1.85 0.74 124 T_REMOTE_IMAGE 2595 2.27 1.84 2.44 125 T_TooManySym_01 2568 3.45 1.82 4.10 126 FORGED_GMAIL_RCVD 2560 0.85 1.82 0.46 127 XM_B_Unsub2 2524 1.06 1.79 0.76 128 RELAYCOUNTRY_FR 2499 0.63 1.77 0.17 129 RCVD_IN_IADB_LISTED 2423 3.39 1.72 4.07 130 XMSubMetaSxObfu_03 2397 2.16 1.70 2.34 131 URI_NOVOWEL 2385 2.03 1.69 2.17 132 TR_XM_COVIDMETA4 2291 0.58 1.63 0.15 133 HTML_MIME_NO_HTML_TAG 2286 1.45 1.62 1.37 134 XMStockSpam_06 2283 1.31 1.62 1.18 135 TR_XM_SB_Phish 2242 2.29 1.59 2.57 136 URIBL_DBL_SPAM 2227 0.46 1.58 0.01 137 T_XMDrugObfuBody_08 2205 1.11 1.57 0.93 138 T_XMHurry_00 2162 0.65 1.53 0.30 139 XMSubPhish11 2157 2.26 1.53 2.55 140 XM_URI_RBL 2156 0.52 1.53 0.11 141 BAYES_40 2135 2.37 1.52 2.71 142 XMGenDplmaNmb 2128 0.83 1.51 0.56 143 RCVD_IN_IADB_SPF 2113 2.95 1.50 3.54 144 RELAYCOUNTRY_DE 2079 0.66 1.48 0.33 145 TR_XM_PHPDW 2035 0.65 1.44 0.32 146 RCVD_IN_IADB_SENDERID 2001 2.65 1.42 3.15 147 RCVD_IN_IADB_DK 1995 2.57 1.42 3.04 148 XMSubMetaI_00 1995 0.69 1.42 0.39 149 URI_TRY_3LD 1874 1.10 1.33 1.00 150 HTTPS_HTTP_MISMATCH 1864 0.64 1.32 0.37 151 URIBL_BLACK 1769 0.39 1.26 0.04 152 FONT_INVIS_LONG_LINE 1764 0.49 1.25 0.18 153 TR_XM_INV_DKIM 1747 0.48 1.24 0.17 154 TR_XM_PHPForged 1720 0.53 1.22 0.25 155 XMSubNoVowel 1711 1.62 1.21 1.79 156 XMPhish08 1698 0.64 1.21 0.41 157 TR_XM_FormFill2 1686 0.52 1.20 0.25 158 XM_H_PHPOS 1678 0.52 1.19 0.24 159 RDNS_DYNAMIC 1665 0.71 1.18 0.52 160 XM_B_COVIDMETA 1657 1.70 1.18 1.91 161 RELAYCOUNTRY_IN 1653 0.37 1.17 0.05 162 T_XMDrugObfuBody_00 1647 4.92 1.17 6.43 163 XMPhish30 1615 0.66 1.15 0.46 164 BAYES_20 1613 1.60 1.14 1.79 165 HTML_TAG_BALANCE_BODY 1591 0.63 1.13 0.42 166 XM_OfRef7 1516 0.36 1.08 0.07 167 FROM_SUSPICIOUS_NTLD 1516 0.37 1.08 0.08 168 XM_UB95 1501 0.32 1.07 0.02 169 FROM_SUSPICIOUS_NTLD_FP 1460 0.36 1.04 0.08 170 MAILING_LIST_MULTI 1456 1.37 1.03 1.51 171 DKIM_ADSP_CUSTOM_MED 1444 0.84 1.02 0.77 172 TR_XM_RelayPhish 1437 0.33 1.02 0.04 173 HTML_FONT_SIZE_HUGE 1428 0.45 1.01 0.22 174 TR_MetaPhish_Combo_01 1402 0.60 1.00 0.44 175 XMSexyCombo_04 1399 0.77 0.99 0.68 176 XM_H_Long_From02 1373 1.26 0.97 1.38 177 RELAYCOUNTRY_CH 1352 0.30 0.96 0.03 178 TR_LOTS_OF_MONEY2 1347 0.35 0.96 0.10 179 T_MONEY_PERCENT 1347 0.35 0.96 0.10 180 RELAYCOUNTRY_NL 1317 0.39 0.93 0.16 181 NUMERIC_HTTP_ADDR 1309 0.58 0.93 0.44 182 NML_ADSP_CUSTOM_MED 1301 0.62 0.92 0.50 183 TR_Sbj_FN_Bdy 1284 0.35 0.91 0.13 184 XMSubMetaD_03 1265 0.35 0.90 0.13 185 TR_Caps_n_Bayes_99 1256 0.30 0.89 0.06 186 RCVD_IN_MSPIKE_H5 1256 1.71 0.89 2.04 187 XM_JunkDunk 1256 0.26 0.89 0.00 188 INVESTMENT_ADVICE 1254 0.29 0.89 0.04 189 XMSubMetaSSx_00 1246 0.40 0.88 0.21 190 XMSubMetaI_01 1245 0.35 0.88 0.13 191 XM_Body_Dirty_Words_01 1228 0.36 0.87 0.15 192 ALL_TRUSTED 1217 18.87 0.86 26.15 193 INVALID_MSGID 1212 1.65 0.86 1.97 194 GOOGLE_DOC_SUSP 1211 0.25 0.86 0.01 195 MONEY_NOHTML 1206 0.29 0.86 0.05 196 XMHTMLBadTable_001 1176 0.55 0.83 0.43 197 RCVD_IN_MSPIKE_L3 1173 0.26 0.83 0.02 198 LOADSA_MONEY_COMBO 1162 0.25 0.82 0.02 199 RELAYCOUNTRY_GB 1146 0.61 0.81 0.52 200 XMBody_78 1145 0.58 0.81 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 260382 80.82 95.82 74.76 2 RELAYCOUNTRY_US 247965 72.79 76.74 71.19 3 DKIM_SIGNED 225566 71.08 86.71 64.76 4 XM_DK_Pass 223220 70.25 85.47 64.09 5 XM_B_Unicode 221314 68.67 81.35 63.54 6 DKIM_VALID 218974 68.84 83.62 62.87 7 DCC_CHECK_NEGATIVE 217225 49.63 18.16 62.37 8 BAYES_50 189213 47.63 31.10 54.32 9 DKIM_VALID_AU 172082 53.54 63.77 49.40 10 XMListUnsubscribeExists 163054 55.06 75.45 46.81 11 XM_B_Unicode3 143342 42.37 45.37 41.15 12 XM_B_SpammyWords 140262 48.37 68.38 40.27 13 DCC_CHECK 127602 49.28 80.56 36.63 14 HTML_FONT_LOW_CONTRAST 94349 28.68 32.61 27.09 15 ALL_TRUSTED 91085 18.87 0.86 26.15 16 RCVD_IN_MSPIKE_WL 89674 25.14 23.63 25.75 17 DKIM_VALID_EF 87809 25.70 26.91 25.21 18 LOC_TINY_FONT_1 82348 27.85 38.27 23.64 19 FVGT_m_MULTI_ODD 77289 24.09 28.80 22.19 20 TM2_M_URI_OPT_OUT 76576 16.55 3.11 21.99 21 MIME_HTML_ONLY 75504 25.32 34.33 21.68 22 RCVD_IN_MSPIKE_H2 73641 23.95 30.87 21.14 23 T_TM2_M_HEADER_IN_MSG 67736 18.54 16.28 19.45 24 XM_Multi_Part_URI 66519 18.17 15.87 19.10 25 XM_B_SpammyWords2 65035 24.45 38.72 18.67 26 ANY_BOUNCE_MESSAGE 61761 12.79 0.57 17.73 27 BOUNCE_MESSAGE 61757 12.79 0.56 17.73 28 BAYES_00 57108 11.84 0.56 16.40 29 T_KAM_HTML_FONT_INVALID 55061 18.52 25.24 15.81 30 XMSubLong 53692 17.31 22.01 15.42 31 RCVD_IN_MSPIKE_H3 51383 14.11 12.53 14.75 32 XM_B_Unsub 38672 10.62 9.41 11.10 33 XM_Body_Dirty_Words 38505 13.69 20.20 11.05 34 XM_DKIMWhitelistDomains 36399 7.48 0.13 10.45 35 XM_DK_Undo_02 31729 22.03 53.99 9.11 36 RCVD_IN_RP_SAFE 31238 8.30 6.65 8.97 37 RCVD_IN_MSPIKE_H4 31176 9.31 10.21 8.95 38 BAYES_60 30542 8.47 7.72 8.77 39 RCVD_IN_RP_CERTIFIED 28456 7.25 4.98 8.17 40 HTML_IMAGE_RATIO_02 27270 8.33 9.56 7.83 41 HTML_IMAGE_RATIO_04 26980 7.38 6.46 7.75 42 XM_Evil_Numbers_Gen 26922 8.54 10.55 7.73 43 BAYES_99 26647 18.00 43.57 7.65 44 MPART_ALT_DIFF 26361 7.61 7.70 7.57 45 UNPARSEABLE_RELAY 25577 8.15 10.14 7.34 46 LotsOfNums_01 24617 7.49 8.52 7.07 47 XM_SendGrid 23074 6.99 7.88 6.62 48 TR_XM_UnparsRelay 22851 7.56 10.05 6.56 49 BAYES_999 22764 14.92 35.65 6.54 50 T_XMDrugObfuBody_00 22410 4.92 1.17 6.43 51 BOTNET_IPINHOSTNAME 21262 7.89 12.31 6.10 52 XM_H_Trusted_IP 20960 4.28 0.00 6.02 53 XMStrtUSub 20471 5.23 3.62 5.88 54 LOTS_OF_MONEY 19855 8.21 14.43 5.70 55 TR_XM_DKIM_Undo 19748 16.62 43.70 5.67 56 MIME_HTML_ONLY_MULTI 19654 4.95 3.24 5.64 57 TR_XM_DK_Bayes 18795 3.98 0.48 5.40 58 TR_XM_DK_Bayes1 18542 3.93 0.48 5.32 59 TooManyTo_001 18232 5.57 6.41 5.23 60 XMSubMetaSx_00 18198 6.06 8.11 5.22 61 FSL_BULK_SIG 17815 7.15 12.19 5.11 62 TR_XM_DK_Bayes2 17586 3.73 0.47 5.05 63 XM_B_Phish_Phrases 16165 4.88 5.49 4.64 64 BAYES_80 15106 5.63 8.84 4.34 65 XM_B_SpammyWords3 15088 6.24 10.95 4.33 66 XM_H_Long_From01 14811 4.87 6.41 4.25 67 TR_XM_DK_SendGrid 14604 4.22 4.30 4.19 68 XMSexyCombo_05 14371 6.33 11.77 4.13 69 T_TooManySym_01 14294 3.45 1.82 4.10 70 RCVD_IN_IADB_LISTED 14183 3.39 1.72 4.07 71 TR_XM_SpammyWords4 14016 6.52 12.69 4.02 72 IN_ZIMBRA_NJ_WHITELIST 13872 2.85 0.04 3.98 73 TR_DCC_Bayes_99 13586 12.83 34.91 3.90 74 MIME_QP_LONG_LINE 13554 3.44 2.34 3.89 75 RCVD_IN_IADB_SPF 12331 2.95 1.50 3.54 76 XM_UncommonTLD01 12265 5.97 12.02 3.52 77 RELAYCOUNTRY_META 11232 7.83 19.22 3.22 78 RCVD_IN_IADB_SENDERID 10975 2.65 1.42 3.15 79 RCVD_IN_IADB_DK 10597 2.57 1.42 3.04 80 HTML_IMAGE_RATIO_06 10368 2.97 2.96 2.98 81 FROM_EXCESS_BASE64 10263 3.31 4.20 2.95 82 XMNumbers 9516 3.31 4.74 2.73 83 BAYES_40 9445 2.37 1.52 2.71 84 BAYES_95 9377 3.35 4.98 2.69 85 RCVD_IN_IADB_VOUCHED 9075 2.06 0.72 2.61 86 TR_XM_SB_Phish 8967 2.29 1.59 2.57 87 XMSubPhish11 8879 2.26 1.53 2.55 88 T_TooManySym_02 8640 1.89 0.42 2.48 89 MIME_HTML_MOSTLY 8542 3.20 5.05 2.45 90 T_REMOTE_IMAGE 8497 2.27 1.84 2.44 91 TVD_RCVD_IP 8298 1.72 0.08 2.38 92 XMSubMetaSxObfu_03 8156 2.16 1.70 2.34 93 URI_NOVOWEL 7561 2.03 1.69 2.17 94 RCVD_IN_MSPIKE_H5 7115 1.71 0.89 2.04 95 XM_PDF 6951 1.53 0.37 2.00 96 INVALID_MSGID 6871 1.65 0.86 1.97 97 T_XMDrugObfuBody_14 6866 2.12 2.49 1.97 98 TR_XM_PhishingBody 6741 2.74 4.73 1.94 99 HTML_IMAGE_RATIO_08 6642 1.94 2.01 1.91 100 XM_B_COVIDMETA 6636 1.70 1.18 1.91 101 DKIM_INVALID 6592 2.24 3.09 1.89 102 MSGID_NOFQDN1 6493 1.34 0.03 1.86 103 XM_B_SpammyTLD 6281 2.63 4.69 1.80 104 TO_MALFORMED 6280 1.36 0.26 1.80 105 XMSubNoVowel 6235 1.62 1.21 1.79 106 BAYES_20 6231 1.60 1.14 1.79 107 RCVD_IN_IADB_OPTIN 6054 1.38 0.51 1.74 108 HELO_MISC_IP 5770 1.20 0.06 1.66 109 TR_XM_SpammyWords2 5393 5.90 16.65 1.55 110 BOTNET 5335 4.79 12.85 1.53 111 XM_CamelCaseFrm001 5257 2.05 3.37 1.51 112 MAILING_LIST_MULTI 5256 1.37 1.03 1.51 113 TM2_M_VERY_LONG_WORD 5174 1.63 1.99 1.49 114 IN_HORDE_ADDRESS_BOOK 5105 1.06 0.04 1.47 115 XMBSHREFv2 4941 1.06 0.16 1.42 116 XM_H_Long_From02 4793 1.26 0.97 1.38 117 TR_LOTS_OF_MONEY3 4790 2.08 3.83 1.38 118 HTML_MIME_NO_HTML_TAG 4783 1.45 1.62 1.37 119 XMDiploma_00 4767 1.89 3.17 1.37 120 UNTRUSTED_Relay 4757 5.09 14.31 1.37 121 BAYES_05 4640 1.11 0.57 1.33 122 TR_XM_SpammyWords5 4620 2.23 4.45 1.33 123 USER_IN_DEF_DKIM_WL 4557 0.94 0.04 1.31 124 HTML_FONT_FACE_BAD 4339 1.08 0.69 1.25 125 XMStockSpam_06 4122 1.31 1.62 1.18 126 XMSexyCombo_01 4077 1.46 2.19 1.17 127 XM_GRM 4064 0.83 0.00 1.17 128 RELAYCOUNTRY_CA 3890 2.97 7.54 1.12 129 SUBJ_ALL_CAPS 3716 1.41 2.27 1.07 130 XM_DK_Undo_01 3705 1.85 3.80 1.06 131 URI_TRY_3LD 3487 1.10 1.33 1.00 132 URIBL_SBL_A 3474 2.16 5.04 1.00 133 XM_SPF_SoftFail 3452 1.51 2.78 0.99 134 URI_HEX 3367 1.68 3.43 0.97 135 XMBody_95 3331 0.70 0.08 0.96 136 XMGappySubj_01 3331 0.71 0.09 0.96 137 KHOP_HELO_FCRDNS 3246 2.71 7.09 0.93 138 T_XMDrugObfuBody_08 3235 1.11 1.57 0.93 139 TR_MSPIKEBAYES00 3220 0.66 0.02 0.92 140 RCVD_IN_BL_SPAMCOP_NET 3202 4.05 11.78 0.92 141 HTML_IMAGE_ONLY_20 3046 0.66 0.12 0.87 142 XM_UB50 3006 1.98 4.73 0.86 143 XM_SPF_Unknown 2969 0.80 0.66 0.85 144 TooManyTo_002 2930 0.72 0.43 0.84 145 XM_B_Phish66 2887 1.14 1.90 0.83 146 XM_GoogleGroups 2769 0.68 0.39 0.79 147 DKIM_ADSP_CUSTOM_MED 2681 0.84 1.02 0.77 148 XM_B_Unsub2 2647 1.06 1.79 0.76 149 TVD_SPACE_RATIO 2590 0.55 0.06 0.74 150 DIET_1 2575 1.06 1.85 0.74 151 XMBdyGiftCard01 2491 1.52 3.49 0.72 152 XM_ProductURIs 2428 0.71 0.73 0.70 153 XM_OfRef6 2396 1.96 5.10 0.69 154 XMSexyCombo_04 2362 0.77 0.99 0.68 155 TR_Symld_Words 2292 0.69 0.78 0.66 156 PDS_OTHER_BAD_TLD 2247 1.34 3.06 0.65 157 XMBrknScrpt_02 2236 1.26 2.80 0.64 158 T_TooManySym_03 2165 0.51 0.24 0.62 159 TooManyTo_003 2160 0.53 0.31 0.62 160 XMGenDplmaNmb 1956 0.83 1.51 0.56 161 TVD_SPACE_RATIO_MINFP 1911 0.60 0.72 0.55 162 RELAYCOUNTRY_GB 1821 0.61 0.81 0.52 163 RDNS_DYNAMIC 1817 0.71 1.18 0.52 164 NML_ADSP_CUSTOM_MED 1755 0.62 0.92 0.50 165 TooManyTo_004 1747 0.44 0.28 0.50 166 T_FILL_THIS_FORM_SHORT 1746 1.42 3.69 0.50 167 XMLngstWrd_00 1742 0.44 0.29 0.50 168 XM_B_REG_HTML 1728 0.54 0.65 0.50 169 XMBody_78 1678 0.58 0.81 0.48 170 USER_IN_WELCOMELIST 1677 0.34 0.00 0.48 171 USER_IN_WHITELIST 1677 0.34 0.00 0.48 172 FORGED_GMAIL_RCVD 1610 0.85 1.82 0.46 173 XMBody_17 1610 1.06 2.54 0.46 174 XMPhish30 1595 0.66 1.15 0.46 175 XMHTML_After_End 1541 0.47 0.55 0.44 176 XMLngstWrd_01 1540 0.39 0.26 0.44 177 TR_MetaPhish_Combo_01 1531 0.60 1.00 0.44 178 XMSubMetaSxObfu_02 1527 0.44 0.46 0.44 179 TooManyTo_005 1523 0.38 0.24 0.44 180 NUMERIC_HTTP_ADDR 1517 0.58 0.93 0.44 181 XM_E_Blogspot 1515 0.33 0.06 0.43 182 XMHTMLBadTable_001 1491 0.55 0.83 0.43 183 XM_H_PHPMailer 1479 0.53 0.79 0.42 184 HTML_TAG_BALANCE_BODY 1476 0.63 1.13 0.42 185 XM_B_COPY_HTML 1416 0.48 0.67 0.41 186 XMPhish08 1415 0.64 1.21 0.41 187 XMSubMetaI_00 1374 0.69 1.42 0.39 188 HTTPS_HTTP_MISMATCH 1275 0.64 1.32 0.37 189 XMLngstWrd_02 1270 0.31 0.19 0.36 190 XM_B_SpammyWords4 1256 0.79 1.85 0.36 191 T_OBFU_PDF_ATTACH 1193 0.27 0.08 0.34 192 SpammyFromTLD_01 1189 1.06 2.85 0.34 193 HELO_NODOT 1189 0.39 0.51 0.34 194 HELO_NO_DOMAIN 1189 0.36 0.42 0.34 195 MPART_ALT_DIFF_COUNT 1186 0.41 0.59 0.34 196 SHOPIFY_IMG_NOT_RCVD_SFY 1183 0.47 0.78 0.34 197 RELAYCOUNTRY_DE 1151 0.66 1.48 0.33 198 TR_XM_PHPDW 1123 0.65 1.44 0.32 199 XMNoVowels 1089 0.31 0.31 0.31 200 T_XMHurry_00 1033 0.65 1.53 0.30 ----------------------------------------------------------------------