Email: 414343 Autolearn: 0 AvgScore: 4.95 AvgScanTime: 1.31 sec Spam: 149955 Autolearn: 0 AvgScore: 15.11 AvgScanTime: 1.32 sec Ham: 264388 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 1.31 sec Time Spent Running SA: 151.21 hours Time Spent Processing Spam: 54.94 hours Time Spent Processing Ham: 96.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134511 89.32 89.70 89.11 2 DCC_CHECK 120224 59.69 80.17 48.06 3 DKIM_SIGNED 116290 79.29 77.55 80.27 4 XM_DK_Pass 114111 78.14 76.10 79.30 5 DKIM_VALID 112494 76.84 75.02 77.87 6 XM_B_Unicode 104891 73.93 69.95 76.18 7 RELAYCOUNTRY_US 99501 77.16 66.35 83.29 8 XMListUnsubscribeExists 97247 59.97 64.85 57.20 9 XM_B_SpammyWords 95439 54.69 63.65 49.60 10 DKIM_VALID_AU 90740 62.79 60.51 64.08 11 XM_DK_Undo_02 70537 23.01 47.04 9.39 12 BAYES_99 58636 18.53 39.10 6.87 13 TR_XM_DKIM_Undo 57316 18.26 38.22 6.94 14 LOC_TINY_FONT_1 53270 32.62 35.52 30.97 15 XM_B_Unicode3 51879 42.87 34.60 47.57 16 XM_B_SpammyWords2 51654 27.36 34.45 23.35 17 HTML_FONT_LOW_CONTRAST 51598 32.89 34.41 32.03 18 BAYES_999 48053 15.23 32.04 5.69 19 TR_DCC_Bayes_99 47266 13.99 31.52 4.05 20 BAYES_50 46697 45.85 31.14 54.19 21 RELAYCOUNTRY_META 45244 13.92 30.17 4.70 22 MIME_HTML_ONLY 44717 26.48 29.82 24.59 23 RCVD_IN_MSPIKE_H2 42917 28.11 28.62 27.81 24 DKIM_VALID_EF 41449 28.81 27.64 29.47 25 FVGT_m_MULTI_ODD 37365 24.03 24.92 23.53 26 UNTRUSTED_Relay 37174 10.49 24.79 2.38 27 XM_Multi_Part_URI 32273 17.52 21.52 15.25 28 BOTNET 30786 8.58 20.53 1.80 29 XMSubLong 30754 20.73 20.51 20.86 30 T_KAM_HTML_FONT_INVALID 30675 18.55 20.46 17.47 31 T_TM2_M_HEADER_IN_MSG 27743 21.16 18.50 22.67 32 DCC_CHECK_NEGATIVE 27709 38.96 18.48 50.58 33 FSL_BULK_SIG 25457 10.76 16.98 7.23 34 RCVD_IN_MSPIKE_WL 24773 25.67 16.52 30.86 35 XM_Body_Dirty_Words 24466 15.70 16.32 15.35 36 BOTNET_IPINHOSTNAME 22508 9.17 15.01 5.86 37 TR_XM_SpammyWords2 20081 6.09 13.39 1.96 38 XM_UncommonTLD01 19247 7.22 12.84 4.03 39 XM_B_SpammyWords3 18778 7.98 12.52 5.40 40 RCVD_IN_BL_SPAMCOP_NET 18620 5.15 12.42 1.03 41 LotsOfNums_01 18185 9.62 12.13 8.20 42 XM_B_Unsub 17690 11.06 11.80 10.65 43 XMSexyCombo_05 16373 7.64 10.92 5.78 44 BAYES_80 15448 6.71 10.30 4.68 45 BAYES_60 13721 8.36 9.15 7.91 46 RCVD_IN_MSPIKE_BL 13718 3.57 9.15 0.40 47 MPART_ALT_DIFF 13696 7.51 9.13 6.59 48 HTML_IMAGE_RATIO_02 13515 9.28 9.01 9.44 49 RCVD_IN_MSPIKE_H3 13448 14.30 8.97 17.32 50 TR_XM_MSPIKECOMBO 13352 3.48 8.90 0.40 51 LOTS_OF_MONEY 12925 7.04 8.62 6.15 52 XM_UB50 12810 3.89 8.54 1.25 53 T_REMOTE_IMAGE 12773 5.02 8.52 3.04 54 XM_Evil_Numbers_Gen 12320 8.83 8.22 9.17 55 TR_XM_SpammyWords4 11595 5.44 7.73 4.13 56 RCVD_IN_RP_RNBL 11554 2.83 7.70 0.07 57 RCVD_IN_PSBL 11350 2.81 7.57 0.11 58 BODY_URI_ONLY 11140 2.75 7.43 0.10 59 MIME_HTML_MOSTLY 10887 4.81 7.26 3.42 60 HTML_SHORT_LINK_IMG_1 10419 2.57 6.95 0.09 61 HTML_IMAGE_ONLY_12 10386 2.64 6.93 0.21 62 KHOP_HELO_FCRDNS 10369 3.19 6.91 1.08 63 RCVD_IN_MSPIKE_L5 10265 2.55 6.85 0.11 64 RCVD_IN_MSPIKE_H4 10170 9.68 6.78 11.33 65 UNPARSEABLE_RELAY 10039 8.34 6.69 9.28 66 XMSubMetaSx_00 10023 5.29 6.68 4.50 67 RELAYCOUNTRY_CA 9934 3.42 6.62 1.61 68 TR_XM_UnparsRelay 9673 6.40 6.45 6.37 69 TooManyTo_001 9653 6.61 6.44 6.71 70 XMNumbers 9001 4.45 6.00 3.58 71 PDS_FROM_2_EMAILS 8713 2.12 5.81 0.02 72 FROM_2_EMAILS_SHORT 8672 2.11 5.78 0.02 73 BAYES_95 8597 3.91 5.73 2.87 74 HTML_IMAGE_RATIO_08 8500 3.66 5.67 2.52 75 PDS_TO_EQ_FROM_NAME 8208 2.00 5.47 0.03 76 XM_H_Long_From01 8174 5.59 5.45 5.66 77 RCVD_IN_RP_SAFE 8114 9.35 5.41 11.58 78 TM2_M_VERY_LONG_WORD 8069 2.90 5.38 1.49 79 SpammyFromTLD_01 7684 2.16 5.12 0.48 80 URIBL_SBL_A 7678 1.93 5.12 0.11 81 XM_B_Phish_Phrases 7517 5.28 5.01 5.44 82 RELAYCOUNTRY_IN 7407 1.83 4.94 0.07 83 NO_FM_NAME_IP_HOSTN 7345 1.78 4.90 0.01 84 XM_SendGrid 7105 7.01 4.74 8.29 85 HTML_IMAGE_RATIO_06 7061 3.98 4.71 3.57 86 HTML_IMAGE_RATIO_04 7039 6.25 4.69 7.14 87 XM_UB60 6865 1.75 4.58 0.14 88 LONG_JUNK_URI 6701 1.65 4.47 0.05 89 RELAYCOUNTRY_FR 6638 1.76 4.43 0.25 90 XM_B_SpammyTLD 6467 3.30 4.31 2.73 91 XM_UB80 6448 1.61 4.30 0.08 92 TR_XM_PhishingBody 6384 2.88 4.26 2.10 93 TR_XM_SpammyWords5 6275 2.54 4.18 1.60 94 XM_UB99 6221 1.51 4.15 0.01 95 RCVD_IN_RP_CERTIFIED 6107 8.21 4.07 10.56 96 SpammyFromTLD_02 5802 1.53 3.87 0.20 97 XMStrtUSub 5765 5.48 3.84 6.41 98 XMBody_17 5732 1.82 3.82 0.68 99 XM_DIRTYINTL 5084 1.51 3.39 0.45 100 SUBJ_ALL_CAPS 4974 2.00 3.32 1.26 101 URI_HEX 4894 2.15 3.26 1.52 102 T_FONT_INVIS_NAKED_TO 4765 2.45 3.18 2.04 103 TR_XM_MaxBayes 4700 1.14 3.13 0.01 104 TM2_M_URI_OPT_OUT 4548 3.10 3.03 3.14 105 MIMEOLE_DIRECT_TO_MX 4477 1.09 2.99 0.01 106 XM_OfRef6 4307 1.64 2.87 0.94 107 XM_UB999 4221 1.02 2.81 0.01 108 BITCOIN_XPRIO 4128 1.00 2.75 0.01 109 TR_XM_SpoofStaff 3973 1.06 2.65 0.16 110 XMBdyGiftCard01 3960 1.81 2.64 1.34 111 TR_XM_DK_SendGrid 3954 4.39 2.64 5.38 112 XMSpoofStaff2 3938 1.05 2.63 0.16 113 XM_SPF_SoftFail 3805 1.66 2.54 1.16 114 DKIM_INVALID 3796 2.45 2.53 2.41 115 URI_ONLY_MSGID_MALF 3670 0.89 2.45 0.01 116 DATE_IN_PAST_03_06 3668 0.93 2.45 0.07 117 URI_TRY_3LD 3630 1.80 2.42 1.45 118 XMSubNoVowel 3577 2.74 2.39 2.95 119 HTML_FONT_SIZE_LARGE 3565 0.95 2.38 0.14 120 RELAYCOUNTRY_UA 3549 0.94 2.37 0.13 121 XM_UB95 3536 0.86 2.36 0.02 122 HDR_ORDER_FTSDMCXX_DIRECT 3477 0.84 2.32 0.00 123 BOTNET_NORDNS 3475 0.85 2.32 0.01 124 URI_WP_HACKED 3373 0.82 2.25 0.01 125 TR_LOTS_OF_MONEY3 3359 0.96 2.24 0.23 126 XM_H_SpoofStaff4 3355 0.92 2.24 0.17 127 TR_XM_PSC1 3351 0.91 2.23 0.16 128 XMDiploma_00 3318 1.71 2.21 1.43 129 PDS_OTHER_BAD_TLD 3314 1.64 2.21 1.32 130 TR_XM_SpoofStaff2 3289 0.79 2.19 0.00 131 XM_B_SpammyWords4 3194 1.30 2.13 0.83 132 FROM_EXCESS_BASE64 3136 3.85 2.09 4.84 133 MIME_HTML_ONLY_MULTI 3128 3.48 2.09 4.27 134 TR_XM_SB_Phish 3092 1.76 2.06 1.60 135 XMBrknScrpt_02 3028 1.21 2.02 0.75 136 XM_DK_Undo_01 3003 1.62 2.00 1.40 137 XMSubPhish11 2998 1.73 2.00 1.58 138 ALL_TRUSTED 2971 8.76 1.98 12.61 139 DOS_OE_TO_MX 2970 0.72 1.98 0.01 140 TR_XM_SpammyWords3 2939 0.86 1.96 0.24 141 XM_CamelCaseFrm001 2790 1.78 1.86 1.74 142 URI_WPADMIN 2738 0.67 1.83 0.02 143 XM_B_Unsub2 2707 1.23 1.81 0.91 144 BAYES_40 2680 3.43 1.79 4.36 145 URG_BIZ 2647 0.72 1.77 0.13 146 XMSexyCombo_01 2646 1.44 1.76 1.25 147 HTML_MIME_NO_HTML_TAG 2492 1.43 1.66 1.30 148 T_FILL_THIS_FORM_SHORT 2447 0.92 1.63 0.52 149 FROM_SUSPICIOUS_NTLD 2444 0.68 1.63 0.15 150 RDNS_DYNAMIC 2402 1.04 1.60 0.72 151 XMHTML_After_End 2400 0.95 1.60 0.58 152 XM_B_Phish66 2383 1.33 1.59 1.19 153 T_XMDrugObfuBody_08 2365 1.55 1.58 1.54 154 HK_RANDOM_REPLYTO 2362 0.72 1.58 0.23 155 FROM_SUSPICIOUS_NTLD_FP 2316 0.65 1.54 0.14 156 T_XMDrugObfuBody_14 2253 1.52 1.50 1.54 157 T_TooManySym_01 2239 4.25 1.49 5.82 158 TR_Symld_Words 2208 1.37 1.47 1.32 159 XMSubEmpty 2181 1.61 1.45 1.70 160 XMPhish08 2179 0.64 1.45 0.17 161 NUMERIC_HTTP_ADDR 2173 0.75 1.45 0.35 162 TR_XM_PHPDW 2163 0.72 1.44 0.30 163 RCVD_IN_MSPIKE_L3 2143 0.64 1.43 0.20 164 TR_Mismatch_TLD_01 2142 1.00 1.43 0.76 165 XMGenDplmaNmb 2141 1.00 1.43 0.76 166 DOS_OUTLOOK_TO_MX 2092 0.51 1.40 0.01 167 TR_XM_PHPForged 2088 0.66 1.39 0.25 168 TR_XM_FormFill2 2087 0.66 1.39 0.25 169 XM_H_PHPOS 2084 0.66 1.39 0.24 170 TR_Caps_n_Bayes_99 2060 0.51 1.37 0.02 171 T_XMHurry_00 2053 0.94 1.37 0.69 172 DIET_1 2038 0.82 1.36 0.52 173 CK_HELO_DYNAMIC_SPLIT_IP 2036 1.86 1.36 2.14 174 XMStockSpam_06 1956 1.67 1.30 1.88 175 RELAYCOUNTRY_DE 1939 0.67 1.29 0.32 176 MIME_QP_LONG_LINE 1922 2.82 1.28 3.69 177 T_XMDrugObfuBody_00 1900 0.88 1.27 0.66 178 XMSubMetaI_00 1885 0.79 1.26 0.52 179 TR_XM_BayesRelay 1861 0.45 1.24 0.01 180 MAILING_LIST_MULTI 1840 1.65 1.23 1.90 181 BAYES_20 1800 2.54 1.20 3.30 182 T_STY_INVIS_DIRECT 1785 0.45 1.19 0.02 183 URI_PHP_REDIR 1772 0.43 1.18 0.00 184 TR_MetaPhish_Combo_01 1768 0.81 1.18 0.61 185 XM_H_Long_From02 1707 1.23 1.14 1.28 186 HTML_IMAGE_ONLY_16 1691 0.53 1.13 0.19 187 XMSlimDrugH 1650 0.59 1.10 0.30 188 RELAYCOUNTRY_BR 1633 0.40 1.09 0.02 189 DATE_IN_PAST_06_12 1617 0.60 1.08 0.33 190 XM_LoanWordsFrm 1594 0.41 1.06 0.04 191 RCVD_IN_IADB_LISTED 1574 2.68 1.05 3.61 192 MIME_CHARSET_FARAWAY 1545 0.46 1.03 0.13 193 DKIM_ADSP_NXDOMAIN 1543 0.62 1.03 0.39 194 TR_XM_FormFill 1529 0.37 1.02 0.01 195 URI_NO_WWW_BIZ_CGI 1519 0.37 1.01 0.01 196 XM_URI_RBL 1472 0.48 0.98 0.20 197 SHORTENED_URL_HREF 1453 1.04 0.97 1.09 198 LongTLD 1429 0.41 0.95 0.10 199 URI_NOVOWEL 1417 1.80 0.94 2.28 200 BAYES_00 1411 9.10 0.94 13.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 235595 89.32 89.70 89.11 2 RELAYCOUNTRY_US 220218 77.16 66.35 83.29 3 DKIM_SIGNED 212235 79.29 77.55 80.27 4 XM_DK_Pass 209663 78.14 76.10 79.30 5 DKIM_VALID 205873 76.84 75.02 77.87 6 XM_B_Unicode 201423 73.93 69.95 76.18 7 DKIM_VALID_AU 169417 62.79 60.51 64.08 8 XMListUnsubscribeExists 151237 59.97 64.85 57.20 9 BAYES_50 143267 45.85 31.14 54.19 10 DCC_CHECK_NEGATIVE 133737 38.96 18.48 50.58 11 XM_B_SpammyWords 131148 54.69 63.65 49.60 12 DCC_CHECK 127077 59.69 80.17 48.06 13 XM_B_Unicode3 125766 42.87 34.60 47.57 14 HTML_FONT_LOW_CONTRAST 84676 32.89 34.41 32.03 15 LOC_TINY_FONT_1 81888 32.62 35.52 30.97 16 RCVD_IN_MSPIKE_WL 81581 25.67 16.52 30.86 17 DKIM_VALID_EF 77905 28.81 27.64 29.47 18 RCVD_IN_MSPIKE_H2 73537 28.11 28.62 27.81 19 MIME_HTML_ONLY 65020 26.48 29.82 24.59 20 FVGT_m_MULTI_ODD 62198 24.03 24.92 23.53 21 XM_B_SpammyWords2 61727 27.36 34.45 23.35 22 T_TM2_M_HEADER_IN_MSG 59947 21.16 18.50 22.67 23 XMSubLong 55144 20.73 20.51 20.86 24 T_KAM_HTML_FONT_INVALID 46181 18.55 20.46 17.47 25 RCVD_IN_MSPIKE_H3 45789 14.30 8.97 17.32 26 XM_Body_Dirty_Words 40577 15.70 16.32 15.35 27 XM_Multi_Part_URI 40329 17.52 21.52 15.25 28 BAYES_00 36300 9.10 0.94 13.73 29 ALL_TRUSTED 33343 8.76 1.98 12.61 30 XM_DKIMWhitelistDomains 32406 7.84 0.04 12.26 31 RCVD_IN_RP_SAFE 30623 9.35 5.41 11.58 32 RCVD_IN_MSPIKE_H4 29944 9.68 6.78 11.33 33 TR_XM_DK_Bayes 29674 7.45 0.79 11.22 34 TR_XM_DK_Bayes1 29044 7.29 0.78 10.99 35 XM_B_Unsub 28147 11.06 11.80 10.65 36 RCVD_IN_RP_CERTIFIED 27918 8.21 4.07 10.56 37 TR_XM_DK_Bayes2 27062 6.76 0.64 10.24 38 HTML_IMAGE_RATIO_02 24950 9.28 9.01 9.44 39 XM_DK_Undo_02 24823 23.01 47.04 9.39 40 UNPARSEABLE_RELAY 24532 8.34 6.69 9.28 41 XM_Evil_Numbers_Gen 24251 8.83 8.22 9.17 42 XM_SendGrid 21924 7.01 4.74 8.29 43 LotsOfNums_01 21669 9.62 12.13 8.20 44 BAYES_60 20904 8.36 9.15 7.91 45 FSL_BULK_SIG 19128 10.76 16.98 7.23 46 HTML_IMAGE_RATIO_04 18870 6.25 4.69 7.14 47 TR_XM_DKIM_Undo 18341 18.26 38.22 6.94 48 BAYES_99 18157 18.53 39.10 6.87 49 TooManyTo_001 17730 6.61 6.44 6.71 50 MPART_ALT_DIFF 17419 7.51 9.13 6.59 51 XMStrtUSub 16939 5.48 3.84 6.41 52 TR_XM_UnparsRelay 16852 6.40 6.45 6.37 53 LOTS_OF_MONEY 16257 7.04 8.62 6.15 54 BOTNET_IPINHOSTNAME 15496 9.17 15.01 5.86 55 T_TooManySym_01 15390 4.25 1.49 5.82 56 XMSexyCombo_05 15273 7.64 10.92 5.78 57 BAYES_999 15032 15.23 32.04 5.69 58 XM_H_Long_From01 14974 5.59 5.45 5.66 59 XM_B_Phish_Phrases 14376 5.28 5.01 5.44 60 XM_B_SpammyWords3 14283 7.98 12.52 5.40 61 TR_XM_DK_SendGrid 14233 4.39 2.64 5.38 62 IN_ZIMBRA_NJ_WHITELIST 13000 3.21 0.20 4.92 63 FROM_EXCESS_BASE64 12804 3.85 2.09 4.84 64 RELAYCOUNTRY_META 12420 13.92 30.17 4.70 65 BAYES_80 12369 6.71 10.30 4.68 66 XMSubMetaSx_00 11905 5.29 6.68 4.50 67 BAYES_40 11536 3.43 1.79 4.36 68 MIME_HTML_ONLY_MULTI 11292 3.48 2.09 4.27 69 TR_XM_SpammyWords4 10926 5.44 7.73 4.13 70 TR_DCC_Bayes_99 10707 13.99 31.52 4.05 71 XM_UncommonTLD01 10664 7.22 12.84 4.03 72 MIME_QP_LONG_LINE 9766 2.82 1.28 3.69 73 RCVD_IN_IADB_LISTED 9535 2.68 1.05 3.61 74 XMNumbers 9454 4.45 6.00 3.58 75 HTML_IMAGE_RATIO_06 9441 3.98 4.71 3.57 76 MIME_HTML_MOSTLY 9036 4.81 7.26 3.42 77 XM_H_Trusted_IP 8927 2.15 0.00 3.38 78 BAYES_20 8737 2.54 1.20 3.30 79 TM2_M_URI_OPT_OUT 8306 3.10 3.03 3.14 80 RCVD_IN_IADB_SPF 8305 2.33 0.91 3.14 81 T_REMOTE_IMAGE 8039 5.02 8.52 3.04 82 INVALID_MSGID 7843 2.11 0.61 2.97 83 XMSubNoVowel 7793 2.74 2.39 2.95 84 BAYES_95 7591 3.91 5.73 2.87 85 T_TooManySym_02 7507 2.00 0.51 2.84 86 RCVD_IN_IADB_SENDERID 7409 2.10 0.86 2.80 87 MSGID_NOFQDN1 7314 1.78 0.03 2.77 88 XM_B_SpammyTLD 7222 3.30 4.31 2.73 89 RCVD_IN_IADB_DK 7124 2.03 0.87 2.69 90 TVD_RCVD_IP 6729 1.86 0.64 2.55 91 HTML_IMAGE_RATIO_08 6675 3.66 5.67 2.52 92 TO_MALFORMED 6568 1.59 0.01 2.48 93 DKIM_INVALID 6362 2.45 2.53 2.41 94 UNTRUSTED_Relay 6301 10.49 24.79 2.38 95 URI_NOVOWEL 6037 1.80 0.94 2.28 96 RCVD_IN_IADB_VOUCHED 5971 1.58 0.38 2.26 97 RCVD_IN_MSPIKE_H5 5848 1.69 0.77 2.21 98 HELO_MISC_IP 5675 1.60 0.64 2.15 99 CK_HELO_DYNAMIC_SPLIT_IP 5668 1.86 1.36 2.14 100 TR_XM_PhishingBody 5539 2.88 4.26 2.10 101 T_FONT_INVIS_NAKED_TO 5383 2.45 3.18 2.04 102 BAYES_05 5292 1.51 0.64 2.00 103 TR_XM_SpammyWords2 5169 6.09 13.39 1.96 104 MAILING_LIST_MULTI 5016 1.65 1.23 1.90 105 XMStockSpam_06 4973 1.67 1.30 1.88 106 IN_HORDE_ADDRESS_BOOK 4886 1.48 0.84 1.85 107 USER_IN_DEF_DKIM_WL 4826 1.20 0.11 1.83 108 BOTNET 4766 8.58 20.53 1.80 109 HTML_FONT_FACE_BAD 4702 1.31 0.48 1.78 110 XM_CamelCaseFrm001 4605 1.78 1.86 1.74 111 XM_PDF 4553 1.23 0.35 1.72 112 XMSubEmpty 4485 1.61 1.45 1.70 113 XMBSHREFv2 4363 1.10 0.14 1.65 114 RELAYCOUNTRY_CA 4249 3.42 6.62 1.61 115 TR_XM_SpammyWords5 4235 2.54 4.18 1.60 116 TR_XM_SB_Phish 4218 1.76 2.06 1.60 117 XMSubPhish11 4167 1.73 2.00 1.58 118 T_XMDrugObfuBody_08 4069 1.55 1.58 1.54 119 T_XMDrugObfuBody_14 4064 1.52 1.50 1.54 120 TR_MSPIKEBAYES00 4049 0.99 0.02 1.53 121 URI_HEX 4028 2.15 3.26 1.52 122 RCVD_IN_IADB_OPTIN 3943 1.08 0.36 1.49 123 TM2_M_VERY_LONG_WORD 3933 2.90 5.38 1.49 124 TooManyTo_002 3887 1.07 0.37 1.47 125 URI_TRY_3LD 3843 1.80 2.42 1.45 126 XMDiploma_00 3770 1.71 2.21 1.43 127 XM_DK_Undo_01 3703 1.62 2.00 1.40 128 XMBdyGiftCard01 3555 1.81 2.64 1.34 129 PDS_OTHER_BAD_TLD 3494 1.64 2.21 1.32 130 TR_Symld_Words 3479 1.37 1.47 1.32 131 HTML_MIME_NO_HTML_TAG 3442 1.43 1.66 1.30 132 XM_H_Long_From02 3393 1.23 1.14 1.28 133 SUBJ_ALL_CAPS 3319 2.00 3.32 1.26 134 XMSexyCombo_01 3306 1.44 1.76 1.25 135 XM_UB50 3299 3.89 8.54 1.25 136 XM_B_Phish66 3137 1.33 1.59 1.19 137 XMGappySubj_01 3112 0.78 0.08 1.18 138 XM_GoogleGroups 3092 0.86 0.31 1.17 139 XM_SPF_SoftFail 3054 1.66 2.54 1.16 140 ANY_BOUNCE_MESSAGE 3033 0.90 0.46 1.15 141 BOUNCE_MESSAGE 3032 0.90 0.46 1.15 142 SHORTENED_URL_HREF 2871 1.04 0.97 1.09 143 KHOP_HELO_FCRDNS 2859 3.19 6.91 1.08 144 DKIM_ADSP_CUSTOM_MED 2786 0.91 0.67 1.05 145 TooManyTo_003 2755 0.78 0.31 1.04 146 XMBody_95 2752 0.70 0.09 1.04 147 RCVD_IN_BL_SPAMCOP_NET 2734 5.15 12.42 1.03 148 XM_ProductURIs 2681 0.87 0.62 1.01 149 XM_OfRef6 2493 1.64 2.87 0.94 150 T_TooManySym_03 2480 0.65 0.14 0.94 151 XMSexyCombo_04 2467 0.89 0.82 0.93 152 XM_B_Unsub2 2401 1.23 1.81 0.91 153 XMSubMetaSSx_00 2401 0.71 0.36 0.91 154 TooManyTo_004 2199 0.63 0.27 0.83 155 XM_B_SpammyWords4 2189 1.30 2.13 0.83 156 SUBJ_YOUR_FAMILY 2113 0.64 0.35 0.80 157 XMGenDplmaNmb 2015 1.00 1.43 0.76 158 TR_Mismatch_TLD_01 2007 1.00 1.43 0.76 159 XM_B_REG_HTML 1990 0.59 0.31 0.75 160 XMBrknScrpt_02 1977 1.21 2.02 0.75 161 NML_ADSP_CUSTOM_MED 1948 0.68 0.59 0.74 162 PLING_QUERY 1929 0.61 0.40 0.73 163 XM_B_COVIDMETA 1908 0.73 0.73 0.72 164 RDNS_DYNAMIC 1905 1.04 1.60 0.72 165 TooManyTo_005 1885 0.54 0.24 0.71 166 T_XMHurry_00 1834 0.94 1.37 0.69 167 XMBody_17 1790 1.82 3.82 0.68 168 T_XMDrugObfuBody_00 1741 0.88 1.27 0.66 169 RELAYCOUNTRY_GB 1734 0.62 0.56 0.66 170 USER_IN_WHITELIST 1608 0.39 0.00 0.61 171 USER_IN_WELCOMELIST 1608 0.39 0.00 0.61 172 TR_MetaPhish_Combo_01 1605 0.81 1.18 0.61 173 FORGED_GMAIL_RCVD 1585 0.66 0.78 0.60 174 XM_B_COPY_HTML 1582 0.56 0.50 0.60 175 XMHTMLBadTable_001 1562 0.53 0.43 0.59 176 XMHTML_After_End 1531 0.95 1.60 0.58 177 HTML_IMAGE_ONLY_20 1500 0.41 0.13 0.57 178 XMBody_78 1429 0.68 0.94 0.54 179 BASE64_LENGTH_79_INF 1412 0.53 0.51 0.53 180 HTTPS_HTTP_MISMATCH 1384 0.67 0.92 0.52 181 XMSubMetaI_00 1381 0.79 1.26 0.52 182 T_FILL_THIS_FORM_SHORT 1379 0.92 1.63 0.52 183 DIET_1 1369 0.82 1.36 0.52 184 TVD_SPACE_RATIO 1361 0.46 0.35 0.51 185 PP_MIME_FAKE_ASCII_TEXT 1327 0.39 0.20 0.50 186 HELO_NODOT 1299 0.46 0.39 0.49 187 HELO_NO_DOMAIN 1299 0.45 0.39 0.49 188 XMCapTrack 1298 0.40 0.25 0.49 189 SpammyFromTLD_01 1280 2.16 5.12 0.48 190 TR_XM_Spammywords 1249 0.47 0.47 0.47 191 XM_S_SpammyWords 1249 0.47 0.47 0.47 192 XM_H_PHPMailer 1220 0.49 0.53 0.46 193 XMEmptySub 1215 0.40 0.29 0.46 194 XMSubMetaSxObfu_02 1193 0.49 0.57 0.45 195 XM_DIRTYINTL 1182 1.51 3.39 0.45 196 XMPhish30 1176 0.57 0.78 0.44 197 XMSubMetaSxObfu_03 1175 0.49 0.57 0.44 198 SHOPIFY_IMG_NOT_RCVD_SFY 1142 0.38 0.28 0.43 199 XMLngstWrd_00 1141 0.40 0.35 0.43 200 HTML_TAG_BALANCE_BODY 1114 0.48 0.58 0.42 ----------------------------------------------------------------------