Email: 435991 Autolearn: 0 AvgScore: 4.39 AvgScanTime: 1.31 sec Spam: 156135 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 1.36 sec Ham: 279856 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 1.28 sec Time Spent Running SA: 158.78 hours Time Spent Processing Spam: 59.08 hours Time Spent Processing Ham: 99.71 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147511 90.60 94.48 88.43 2 DKIM_SIGNED 131162 83.17 84.01 82.70 3 XM_DK_Pass 128478 81.99 82.29 81.83 4 DCC_CHECK 127409 61.34 81.60 50.04 5 DKIM_VALID 126722 80.69 81.16 80.43 6 XM_B_Unicode 124678 77.38 79.85 76.00 7 RELAYCOUNTRY_US 116110 80.83 74.37 84.43 8 XMListUnsubscribeExists 110828 63.02 70.98 58.58 9 DKIM_VALID_AU 102048 65.80 65.36 66.04 10 XM_B_SpammyWords 100928 56.51 64.64 51.98 11 XM_DK_Undo_02 72589 22.87 46.49 9.69 12 LOC_TINY_FONT_1 64674 36.51 41.42 33.77 13 HTML_FONT_LOW_CONTRAST 64496 36.07 41.31 33.15 14 TR_XM_DKIM_Undo 59465 18.33 38.09 7.31 15 XM_B_Unicode3 59443 44.52 38.07 48.11 16 BAYES_50 59082 48.86 37.84 55.00 17 XM_B_SpammyWords2 58087 27.85 37.20 22.63 18 BAYES_99 56514 17.21 36.20 6.62 19 MIME_HTML_ONLY 50697 27.81 32.47 25.21 20 TR_DCC_Bayes_99 46239 13.40 29.61 4.35 21 BAYES_999 45986 14.02 29.45 5.41 22 RCVD_IN_MSPIKE_H2 44305 28.24 28.38 28.17 23 DKIM_VALID_EF 43398 29.98 27.80 31.19 24 XMSubLong 36549 22.72 23.41 22.33 25 FVGT_m_MULTI_ODD 35051 22.92 22.45 23.19 26 XM_Body_Dirty_Words 32379 17.22 20.74 15.26 27 T_KAM_HTML_FONT_INVALID 30804 18.40 19.73 17.66 28 XM_Multi_Part_URI 30585 17.13 19.59 15.75 29 RCVD_IN_MSPIKE_WL 30212 28.60 19.35 33.77 30 RELAYCOUNTRY_META 29181 9.83 18.69 4.89 31 T_TM2_M_HEADER_IN_MSG 26747 19.72 17.13 21.16 32 DCC_CHECK_NEGATIVE 26458 37.24 16.95 48.56 33 TR_XM_SpammyWords2 21941 6.07 14.05 1.61 34 TR_XM_PhishingBody 21054 6.13 13.48 2.02 35 BOTNET 20777 6.12 13.31 2.12 36 XM_B_SpammyWords3 20775 8.09 13.31 5.18 37 XM_UncommonTLD01 20383 7.12 13.05 3.81 38 LOTS_OF_MONEY 18199 8.69 11.66 7.03 39 XM_B_Unsub 18095 11.49 11.59 11.43 40 BOTNET_IPINHOSTNAME 18011 7.99 11.54 6.01 41 RCVD_IN_MSPIKE_H3 17911 15.90 11.47 18.37 42 LotsOfNums_01 17048 9.02 10.92 7.96 43 HTML_IMAGE_RATIO_02 16452 9.95 10.54 9.62 44 UNTRUSTED_Relay 15823 5.19 10.13 2.43 45 XMSexyCombo_05 15406 7.32 9.87 5.89 46 TR_XM_SpammyWords4 15261 6.58 9.77 4.79 47 TooManyTo_001 15215 7.69 9.74 6.54 48 XM_Evil_Numbers_Gen 14944 10.50 9.57 11.01 49 XMSubMetaSx_00 13368 5.71 8.56 4.12 50 BAYES_80 13291 6.28 8.51 5.03 51 RCVD_IN_BL_SPAMCOP_NET 12787 3.73 8.19 1.25 52 TR_MetaPhish_Combo_01 12525 3.26 8.02 0.60 53 ALL_TRUSTED 12320 10.10 7.89 11.34 54 MPART_ALT_DIFF 12201 6.26 7.81 5.40 55 FSL_BULK_SIG 12148 7.10 7.78 6.72 56 UNPARSEABLE_RELAY 12076 8.72 7.73 9.28 57 XM_BadFromFormat 12070 2.93 7.73 0.25 58 BAYES_60 11772 8.12 7.54 8.45 59 HTML_IMAGE_ONLY_28 11741 2.85 7.52 0.25 60 TR_XM_UnparsRelay 11695 6.98 7.49 6.70 61 XMPhish11 11644 2.71 7.46 0.06 62 PDS_FROM_NAME_TO_DOMAIN 11600 2.66 7.43 0.00 63 PDS_FRNOM_TODOM_NAKED_TO 11600 2.66 7.43 0.00 64 TO_IN_SUBJ 11599 2.67 7.43 0.02 65 XM_B_SpammyTLD 11138 4.30 7.13 2.72 66 RCVD_IN_MSPIKE_H4 11091 10.60 7.10 12.54 67 RELAYCOUNTRY_CA 10995 3.62 7.04 1.71 68 RCVD_IN_RP_SAFE 10899 10.85 6.98 13.00 69 HTML_IMAGE_RATIO_04 10814 7.08 6.93 7.17 70 XM_B_Phish_Phrases 10047 6.36 6.43 6.31 71 MIME_HTML_MOSTLY 9746 4.35 6.24 3.30 72 XM_SendGrid 9253 7.55 5.93 8.45 73 RCVD_IN_RP_CERTIFIED 9237 9.88 5.92 12.09 74 TO_NO_BRKTS_FROM_MSSP 8969 2.06 5.74 0.00 75 XM_H_Long_From01 8389 6.01 5.37 6.37 76 BAYES_95 7708 3.72 4.94 3.04 77 XMStrtUSub 7197 6.65 4.61 7.79 78 HTML_IMAGE_RATIO_08 7106 3.21 4.55 2.46 79 XM_OfRef6 7102 2.25 4.55 0.97 80 RCVD_IN_MSPIKE_BL 6855 1.83 4.39 0.41 81 TR_XM_MSPIKECOMBO 6740 1.80 4.32 0.40 82 XMBdyGiftCard01 6585 2.43 4.22 1.43 83 XMNumbers 6247 4.03 4.00 4.04 84 TR_XM_SpammyWords5 6231 2.79 3.99 2.13 85 XMSexyCombo_01 5986 1.72 3.83 0.54 86 XM_DK_Undo_01 5849 2.22 3.75 1.37 87 TR_XM_DK_SendGrid 5748 4.88 3.68 5.56 88 XMBody_17 5736 1.82 3.67 0.79 89 HTML_IMAGE_RATIO_06 5696 3.54 3.65 3.47 90 XM_UB50 5678 2.09 3.64 1.22 91 XMSubMetaSxObfu_03 5561 1.67 3.56 0.61 92 TM2_M_URI_OPT_OUT 5456 3.23 3.49 3.08 93 BOTNET_NORDNS 5215 1.21 3.34 0.02 94 RCVD_IN_RP_RNBL 5107 1.22 3.27 0.08 95 SpammyFromTLD_02 5001 1.25 3.20 0.16 96 TR_LOTS_OF_MONEY3 4935 1.41 3.16 0.43 97 SUBJ_ALL_CAPS 4620 1.94 2.96 1.37 98 RCVD_IN_MSPIKE_L5 4618 1.12 2.96 0.09 99 URI_HEX 4496 1.77 2.88 1.16 100 DATE_IN_PAST_12_24 4461 1.07 2.86 0.07 101 DKIM_INVALID 4440 2.48 2.84 2.28 102 XMBrknScrpt_02 4354 1.80 2.79 1.24 103 SpammyFromTLD_01 4352 1.29 2.79 0.45 104 XM_DIRTYINTL 4307 1.20 2.76 0.33 105 XM_B_SpammyWords4 4164 1.43 2.67 0.74 106 RELAYCOUNTRY_FR 4090 1.08 2.62 0.22 107 XM_SPF_SoftFail 4032 1.57 2.58 1.01 108 XM_B_Phish66 3931 1.59 2.52 1.07 109 MIME_HTML_ONLY_MULTI 3890 3.04 2.49 3.35 110 T_FILL_THIS_FORM_SHORT 3762 1.19 2.41 0.51 111 URIBL_SBL_A 3636 0.97 2.33 0.20 112 RCVD_IN_PSBL 3477 1.01 2.23 0.33 113 FROM_EXCESS_BASE64 3414 3.62 2.19 4.43 114 XMPhish08 3217 0.81 2.06 0.12 115 FORGED_GMAIL_RCVD 3196 1.15 2.05 0.65 116 XM_CamelCaseFrm001 3178 2.08 2.04 2.11 117 T_TooManySym_01 3088 5.05 1.98 6.77 118 TM2_M_VERY_LONG_WORD 3043 1.73 1.95 1.61 119 T_XMDrugObfuBody_08 2959 1.53 1.90 1.33 120 BAYES_40 2877 3.64 1.84 4.64 121 DATE_IN_PAST_03_06 2872 0.80 1.84 0.21 122 NUMERIC_HTTP_ADDR 2851 0.85 1.83 0.31 123 XM_UB99 2788 0.64 1.79 0.01 124 XM_UB60 2752 0.75 1.76 0.18 125 TVD_SPACE_RATIO_MINFP 2725 0.86 1.75 0.36 126 T_XMDrugObfuBody_14 2719 2.06 1.74 2.24 127 XM_B_Unsub2 2682 1.16 1.72 0.85 128 XMDiploma_00 2662 1.40 1.70 1.23 129 T_XMHurry_00 2626 1.05 1.68 0.70 130 KHOP_HELO_FCRDNS 2590 1.14 1.66 0.85 131 TR_Symld_Words 2529 1.44 1.62 1.33 132 URI_WP_HACKED 2489 0.58 1.59 0.01 133 TR_XM_SpammyWords3 2440 0.76 1.56 0.32 134 PDS_OTHER_BAD_TLD 2363 1.33 1.51 1.23 135 MIME_QP_LONG_LINE 2336 2.92 1.50 3.72 136 FROM_DOMAIN_NOVOWEL 2325 0.54 1.49 0.01 137 GOOGLE_DOC_SUSP 2292 0.53 1.47 0.01 138 XMSexyCombo_04 2226 0.59 1.43 0.12 139 XMSlimDrugH 2206 0.73 1.41 0.35 140 FROM_SUSPICIOUS_NTLD 2195 0.59 1.41 0.14 141 URI_TRY_3LD 2191 1.23 1.40 1.13 142 T_XMDrugObfuBody_00 2182 1.17 1.40 1.05 143 XM_UB80 2141 0.55 1.37 0.10 144 FROM_SUSPICIOUS_NTLD_FP 2133 0.58 1.37 0.14 145 TR_XM_SB_Phish 2047 1.45 1.31 1.53 146 XMStockSpam_06 2037 1.50 1.30 1.61 147 TVD_SPACE_RATIO 2034 0.70 1.30 0.37 148 URI_NOVOWEL 1996 2.03 1.28 2.45 149 T_REMOTE_IMAGE 1990 2.34 1.27 2.93 150 XM_URI_RBL 1981 0.59 1.27 0.22 151 PDS_FROM_2_EMAILS 1964 0.46 1.26 0.01 152 FROM_2_EMAILS_SHORT 1959 0.45 1.25 0.01 153 XM_UB999 1954 0.45 1.25 0.01 154 TR_XM_INV_DKIM 1947 0.50 1.25 0.08 155 XMSubPhish11 1927 1.41 1.23 1.52 156 BAYES_00 1883 8.09 1.21 11.93 157 NAME_EMAIL_DIFF 1877 0.49 1.20 0.09 158 BAYES_20 1855 2.52 1.19 3.26 159 PDS_TO_EQ_FROM_NAME 1852 0.43 1.19 0.01 160 XMGenDplmaNmb 1850 0.85 1.18 0.66 161 TR_XM_BayesRelay 1849 0.43 1.18 0.01 162 RCVD_IN_IADB_LISTED 1845 2.80 1.18 3.71 163 TR_Caps_n_Bayes_99 1808 0.55 1.16 0.22 164 TR_XM_FormFill 1800 0.42 1.15 0.01 165 DIET_1 1781 0.76 1.14 0.55 166 HTML_MIME_NO_HTML_TAG 1712 1.39 1.10 1.55 167 NO_FM_NAME_IP_HOSTN 1701 0.39 1.09 0.01 168 RELAYCOUNTRY_IN 1690 0.43 1.08 0.06 169 TR_Mismatch_TLD_02 1677 0.43 1.07 0.06 170 XM_OfRef7 1677 0.44 1.07 0.09 171 TR_XM_DK_Bayes 1668 6.81 1.07 10.02 172 TR_XM_DK_Bayes1 1650 6.67 1.06 9.80 173 RCVD_IN_IADB_SPF 1641 2.43 1.05 3.21 174 TR_XM_MaxBayes 1628 0.38 1.04 0.00 175 MAILING_LIST_MULTI 1614 1.62 1.03 1.94 176 URIBL_BLACK 1584 0.37 1.01 0.02 177 XMSubMetaI_00 1547 0.83 0.99 0.74 178 XMSubNoVowel 1536 1.00 0.98 1.01 179 XM_ProductURIs 1528 1.02 0.98 1.04 180 RCVD_IN_IADB_DK 1526 2.11 0.98 2.74 181 XMHTML_After_End 1523 0.71 0.98 0.56 182 TR_XM_DK_Bayes2 1520 6.21 0.97 9.14 183 RCVD_IN_IADB_SENDERID 1520 2.17 0.97 2.84 184 MIME_CHARSET_FARAWAY 1506 0.42 0.96 0.12 185 SUBJ_DOLLARS 1497 0.55 0.96 0.32 186 RDNS_DYNAMIC 1484 0.80 0.95 0.71 187 BODY_SINGLE_WORD 1476 0.35 0.95 0.03 188 BODY_SINGLE_URI 1474 0.35 0.94 0.02 189 HK_RANDOM_REPLYTO 1472 0.47 0.94 0.21 190 DATE_IN_PAST_06_12 1467 0.45 0.94 0.18 191 LongTLD 1450 0.40 0.93 0.11 192 XMPhish30 1435 0.63 0.92 0.47 193 XM_B_COVIDMETA 1372 0.61 0.88 0.46 194 URI_GOOGLE_PROXY 1365 0.36 0.87 0.08 195 RCVD_IN_MSPIKE_L4 1356 0.33 0.87 0.03 196 THIS_AD 1317 0.44 0.84 0.21 197 URI_PHP_REDIR 1294 0.30 0.83 0.00 198 TR_Sbj_FN_Bdy 1286 0.39 0.82 0.14 199 ACT_NOW_CAPS 1284 0.44 0.82 0.22 200 TR_XM_RelayPhish 1265 0.34 0.81 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247477 90.60 94.48 88.43 2 RELAYCOUNTRY_US 236291 80.83 74.37 84.43 3 DKIM_SIGNED 231453 83.17 84.01 82.70 4 XM_DK_Pass 228995 81.99 82.29 81.83 5 DKIM_VALID 225077 80.69 81.16 80.43 6 XM_B_Unicode 212697 77.38 79.85 76.00 7 DKIM_VALID_AU 184821 65.80 65.36 66.04 8 XMListUnsubscribeExists 163949 63.02 70.98 58.58 9 BAYES_50 153922 48.86 37.84 55.00 10 XM_B_SpammyWords 145464 56.51 64.64 51.98 11 DCC_CHECK 140039 61.34 81.60 50.04 12 DCC_CHECK_NEGATIVE 135904 37.24 16.95 48.56 13 XM_B_Unicode3 134643 44.52 38.07 48.11 14 LOC_TINY_FONT_1 94495 36.51 41.42 33.77 15 RCVD_IN_MSPIKE_WL 94494 28.60 19.35 33.77 16 HTML_FONT_LOW_CONTRAST 92785 36.07 41.31 33.15 17 DKIM_VALID_EF 87291 29.98 27.80 31.19 18 RCVD_IN_MSPIKE_H2 78830 28.24 28.38 28.17 19 MIME_HTML_ONLY 70545 27.81 32.47 25.21 20 FVGT_m_MULTI_ODD 64899 22.92 22.45 23.19 21 XM_B_SpammyWords2 63332 27.85 37.20 22.63 22 XMSubLong 62505 22.72 23.41 22.33 23 T_TM2_M_HEADER_IN_MSG 59215 19.72 17.13 21.16 24 RCVD_IN_MSPIKE_H3 51404 15.90 11.47 18.37 25 T_KAM_HTML_FONT_INVALID 49429 18.40 19.73 17.66 26 XM_Multi_Part_URI 44080 17.13 19.59 15.75 27 XM_Body_Dirty_Words 42700 17.22 20.74 15.26 28 XM_DKIMWhitelistDomains 39440 9.05 0.01 14.09 29 RCVD_IN_RP_SAFE 36395 10.85 6.98 13.00 30 RCVD_IN_MSPIKE_H4 35103 10.60 7.10 12.54 31 RCVD_IN_RP_CERTIFIED 33845 9.88 5.92 12.09 32 BAYES_00 33381 8.09 1.21 11.93 33 XM_B_Unsub 31993 11.49 11.59 11.43 34 ALL_TRUSTED 31734 10.10 7.89 11.34 35 XM_Evil_Numbers_Gen 30822 10.50 9.57 11.01 36 TR_XM_DK_Bayes 28038 6.81 1.07 10.02 37 TR_XM_DK_Bayes1 27422 6.67 1.06 9.80 38 XM_DK_Undo_02 27120 22.87 46.49 9.69 39 HTML_IMAGE_RATIO_02 26912 9.95 10.54 9.62 40 UNPARSEABLE_RELAY 25963 8.72 7.73 9.28 41 TR_XM_DK_Bayes2 25568 6.21 0.97 9.14 42 XM_SendGrid 23648 7.55 5.93 8.45 43 BAYES_60 23643 8.12 7.54 8.45 44 LotsOfNums_01 22273 9.02 10.92 7.96 45 XMStrtUSub 21809 6.65 4.61 7.79 46 TR_XM_DKIM_Undo 20458 18.33 38.09 7.31 47 HTML_IMAGE_RATIO_04 20059 7.08 6.93 7.17 48 LOTS_OF_MONEY 19678 8.69 11.66 7.03 49 T_TooManySym_01 18937 5.05 1.98 6.77 50 FSL_BULK_SIG 18819 7.10 7.78 6.72 51 TR_XM_UnparsRelay 18739 6.98 7.49 6.70 52 BAYES_99 18516 17.21 36.20 6.62 53 TooManyTo_001 18312 7.69 9.74 6.54 54 XM_H_Long_From01 17822 6.01 5.37 6.37 55 XM_B_Phish_Phrases 17667 6.36 6.43 6.31 56 BOTNET_IPINHOSTNAME 16824 7.99 11.54 6.01 57 XMSexyCombo_05 16491 7.32 9.87 5.89 58 TR_XM_DK_SendGrid 15550 4.88 3.68 5.56 59 BAYES_999 15154 14.02 29.45 5.41 60 MPART_ALT_DIFF 15112 6.26 7.81 5.40 61 XM_B_SpammyWords3 14491 8.09 13.31 5.18 62 BAYES_80 14081 6.28 8.51 5.03 63 IN_ZIMBRA_NJ_WHITELIST 13787 3.19 0.07 4.93 64 RELAYCOUNTRY_META 13690 9.83 18.69 4.89 65 TR_XM_SpammyWords4 13408 6.58 9.77 4.79 66 BAYES_40 12988 3.64 1.84 4.64 67 FROM_EXCESS_BASE64 12389 3.62 2.19 4.43 68 TR_DCC_Bayes_99 12173 13.40 29.61 4.35 69 XMSubMetaSx_00 11542 5.71 8.56 4.12 70 XMNumbers 11307 4.03 4.00 4.04 71 XM_UncommonTLD01 10666 7.12 13.05 3.81 72 MIME_QP_LONG_LINE 10416 2.92 1.50 3.72 73 RCVD_IN_IADB_LISTED 10384 2.80 1.18 3.71 74 HTML_IMAGE_RATIO_06 9722 3.54 3.65 3.47 75 MIME_HTML_ONLY_MULTI 9380 3.04 2.49 3.35 76 MIME_HTML_MOSTLY 9226 4.35 6.24 3.30 77 BAYES_20 9114 2.52 1.19 3.26 78 RCVD_IN_IADB_SPF 8975 2.43 1.05 3.21 79 TM2_M_URI_OPT_OUT 8612 3.23 3.49 3.08 80 BAYES_95 8521 3.72 4.94 3.04 81 T_REMOTE_IMAGE 8195 2.34 1.27 2.93 82 RCVD_IN_MSPIKE_H5 7987 2.11 0.77 2.85 83 RCVD_IN_IADB_SENDERID 7940 2.17 0.97 2.84 84 INVALID_MSGID 7878 2.06 0.69 2.82 85 RCVD_IN_IADB_DK 7680 2.11 0.98 2.74 86 XM_B_SpammyTLD 7607 4.30 7.13 2.72 87 T_TooManySym_02 7493 1.87 0.43 2.68 88 MSGID_NOFQDN1 7414 1.74 0.12 2.65 89 XM_H_Trusted_IP 6938 1.59 0.00 2.48 90 HTML_IMAGE_RATIO_08 6873 3.21 4.55 2.46 91 URI_NOVOWEL 6869 2.03 1.28 2.45 92 UNTRUSTED_Relay 6791 5.19 10.13 2.43 93 RCVD_IN_IADB_VOUCHED 6712 1.74 0.55 2.40 94 TO_MALFORMED 6463 1.49 0.02 2.31 95 TVD_RCVD_IP 6460 1.58 0.29 2.31 96 DKIM_INVALID 6376 2.48 2.84 2.28 97 T_XMDrugObfuBody_14 6281 2.06 1.74 2.24 98 TR_XM_SpammyWords5 5954 2.79 3.99 2.13 99 BOTNET 5927 6.12 13.31 2.12 100 XM_CamelCaseFrm001 5903 2.08 2.04 2.11 101 HELO_MISC_IP 5844 1.49 0.42 2.09 102 TR_XM_PhishingBody 5661 6.13 13.48 2.02 103 MAILING_LIST_MULTI 5428 1.62 1.03 1.94 104 XM_PDF 5416 1.34 0.28 1.94 105 USER_IN_DEF_DKIM_WL 5405 1.25 0.02 1.93 106 BAYES_05 5372 1.49 0.73 1.92 107 IN_HORDE_ADDRESS_BOOK 4852 1.21 0.27 1.73 108 RELAYCOUNTRY_CA 4774 3.62 7.04 1.71 109 XMBSHREFv2 4514 1.09 0.15 1.61 110 XMStockSpam_06 4508 1.50 1.30 1.61 111 TM2_M_VERY_LONG_WORD 4508 1.73 1.95 1.61 112 TR_XM_SpammyWords2 4506 6.07 14.05 1.61 113 RCVD_IN_IADB_OPTIN 4344 1.18 0.50 1.55 114 HTML_MIME_NO_HTML_TAG 4343 1.39 1.10 1.55 115 TR_XM_SB_Phish 4279 1.45 1.31 1.53 116 XMSubPhish11 4241 1.41 1.23 1.52 117 XMBdyGiftCard01 4003 2.43 4.22 1.43 118 TR_MSPIKEBAYES00 3879 0.91 0.05 1.39 119 XM_DK_Undo_01 3846 2.22 3.75 1.37 120 SUBJ_ALL_CAPS 3831 1.94 2.96 1.37 121 TR_Symld_Words 3733 1.44 1.62 1.33 122 T_XMDrugObfuBody_08 3730 1.53 1.90 1.33 123 ANY_BOUNCE_MESSAGE 3587 0.93 0.31 1.28 124 BOUNCE_MESSAGE 3585 0.93 0.31 1.28 125 TooManyTo_002 3539 0.92 0.30 1.26 126 RCVD_IN_BL_SPAMCOP_NET 3494 3.73 8.19 1.25 127 XMBrknScrpt_02 3482 1.80 2.79 1.24 128 XMDiploma_00 3442 1.40 1.70 1.23 129 PDS_OTHER_BAD_TLD 3431 1.33 1.51 1.23 130 XM_UB50 3420 2.09 3.64 1.22 131 HTML_FONT_FACE_BAD 3397 0.99 0.60 1.21 132 URI_HEX 3242 1.77 2.88 1.16 133 XMGappySubj_01 3199 0.78 0.12 1.14 134 URI_TRY_3LD 3159 1.23 1.40 1.13 135 XM_GoogleGroups 3137 0.88 0.45 1.12 136 XM_Body_Dirty_Words_01 3026 0.93 0.67 1.08 137 XM_H_Long_From02 3000 0.92 0.65 1.07 138 XM_B_Phish66 2991 1.59 2.52 1.07 139 DKIM_ADSP_CUSTOM_MED 2984 0.93 0.68 1.07 140 T_XMDrugObfuBody_00 2934 1.17 1.40 1.05 141 XM_ProductURIs 2899 1.02 0.98 1.04 142 XMBody_95 2836 0.70 0.13 1.01 143 XMSubNoVowel 2826 1.00 0.98 1.01 144 XM_SPF_SoftFail 2824 1.57 2.58 1.01 145 XM_OfRef6 2706 2.25 4.55 0.97 146 TooManyTo_003 2489 0.65 0.23 0.89 147 KHOP_HELO_FCRDNS 2387 1.14 1.66 0.85 148 XM_B_Unsub2 2369 1.16 1.72 0.85 149 T_TooManySym_03 2329 0.57 0.11 0.83 150 XMHTMLBadTable_001 2280 0.76 0.67 0.81 151 XMBody_17 2197 1.82 3.67 0.79 152 XMOemUri 2114 0.52 0.08 0.76 153 XM_B_SpammyWords4 2081 1.43 2.67 0.74 154 XMSubMetaI_00 2076 0.83 0.99 0.74 155 NML_ADSP_CUSTOM_MED 2014 0.68 0.61 0.72 156 RDNS_DYNAMIC 1986 0.80 0.95 0.71 157 XM_B_REG_HTML 1962 0.63 0.50 0.70 158 XMSubMetaSxObfu_02 1954 0.53 0.23 0.70 159 TooManyTo_004 1952 0.52 0.20 0.70 160 T_XMHurry_00 1951 1.05 1.68 0.70 161 PLING_QUERY 1916 0.64 0.55 0.68 162 XMGenDplmaNmb 1856 0.85 1.18 0.66 163 FORGED_GMAIL_RCVD 1827 1.15 2.05 0.65 164 XM_B_COPY_HTML 1739 0.59 0.54 0.62 165 XMSubMetaSxObfu_03 1713 1.67 3.56 0.61 166 TR_MetaPhish_Combo_01 1673 3.26 8.02 0.60 167 RELAYCOUNTRY_GB 1652 0.64 0.72 0.59 168 TooManyTo_005 1646 0.44 0.17 0.59 169 HELO_NODOT 1621 0.53 0.44 0.58 170 HELO_NO_DOMAIN 1621 0.53 0.44 0.58 171 USER_IN_WHITELIST 1613 0.37 0.00 0.58 172 USER_IN_WELCOMELIST 1613 0.37 0.00 0.58 173 XMHTML_After_End 1555 0.71 0.98 0.56 174 DIET_1 1526 0.76 1.14 0.55 175 XMSexyCombo_01 1505 1.72 3.83 0.54 176 HTTPS_HTTP_MISMATCH 1459 0.53 0.55 0.52 177 T_FILL_THIS_FORM_SHORT 1437 1.19 2.41 0.51 178 XM_S_SpammyWords 1396 0.54 0.63 0.50 179 TR_XM_Spammywords 1396 0.54 0.63 0.50 180 SHOPIFY_IMG_NOT_RCVD_SFY 1379 0.44 0.36 0.49 181 XM_H_PHPMailer 1347 0.41 0.28 0.48 182 XMPhish30 1309 0.63 0.92 0.47 183 XMBody_78 1308 0.53 0.64 0.47 184 HTML_TAG_BALANCE_BODY 1306 0.49 0.53 0.47 185 XM_B_COVIDMETA 1292 0.61 0.88 0.46 186 T_Symld_Words_02 1287 0.55 0.72 0.46 187 SpammyFromTLD_01 1253 1.29 2.79 0.45 188 TR_BOTNET_NEGATE 1242 0.49 0.57 0.44 189 HTML_IMAGE_ONLY_20 1205 0.32 0.11 0.43 190 XMLngstWrd_00 1204 0.43 0.43 0.43 191 TR_LOTS_OF_MONEY3 1200 1.41 3.16 0.43 192 XMCapTrack 1151 0.33 0.17 0.41 193 RCVD_IN_MSPIKE_BL 1138 1.83 4.39 0.41 194 TR_XM_MSPIKECOMBO 1128 1.80 4.32 0.40 195 XMLngstWrd_01 1110 0.40 0.40 0.40 196 XM_RXBody 1095 0.47 0.60 0.39 197 XMNoVowels 1088 0.39 0.39 0.39 198 TVD_SPACE_RATIO 1035 0.70 1.30 0.37 199 T_TooManySym_04 1022 0.25 0.04 0.37 200 DKIM_ADSP_NXDOMAIN 1020 0.42 0.51 0.36 ----------------------------------------------------------------------