Email: 532825 Autolearn: 0 AvgScore: 4.37 AvgScanTime: 1.52 sec Spam: 174571 Autolearn: 0 AvgScore: 13.80 AvgScanTime: 1.60 sec Ham: 358254 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 1.48 sec Time Spent Running SA: 224.96 hours Time Spent Processing Spam: 77.38 hours Time Spent Processing Ham: 147.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162873 90.62 93.30 89.32 2 DKIM_SIGNED 147107 85.48 84.27 86.07 3 XM_DK_Pass 143012 84.04 81.92 85.07 4 DCC_CHECK 140967 63.31 80.75 54.81 5 DKIM_VALID 139809 82.49 80.09 83.66 6 XM_B_Unicode 128699 76.86 73.72 78.39 7 RELAYCOUNTRY_US 126492 82.15 72.46 86.87 8 XMListUnsubscribeExists 118804 66.11 68.05 65.16 9 XM_B_SpammyWords 113389 57.21 64.95 53.44 10 DKIM_VALID_AU 108675 64.80 62.25 66.04 11 XM_DK_Undo_02 81632 22.57 46.76 10.78 12 XM_B_Unicode3 77329 49.69 44.30 52.32 13 LOC_TINY_FONT_1 67944 34.48 38.92 32.31 14 BAYES_50 66592 48.16 38.15 53.04 15 TR_XM_DKIM_Undo 63772 17.04 36.53 7.55 16 XM_B_SpammyWords2 63757 27.47 36.52 23.05 17 HTML_FONT_LOW_CONTRAST 56717 32.71 32.49 32.81 18 MIME_HTML_ONLY 56424 26.61 32.32 23.83 19 BAYES_99 54460 14.93 31.20 7.00 20 DKIM_VALID_EF 53416 29.24 30.60 28.59 21 RCVD_IN_MSPIKE_H2 51529 29.15 29.52 28.96 22 FVGT_m_MULTI_ODD 48694 26.56 27.89 25.91 23 RELAYCOUNTRY_META 47588 12.64 27.26 5.51 24 T_KAM_HTML_FONT_INVALID 44564 22.48 25.53 20.99 25 TR_DCC_Bayes_99 43328 11.34 24.82 4.76 26 XMSubLong 42951 21.49 24.60 19.97 27 BAYES_999 41705 11.63 23.89 5.66 28 XM_Body_Dirty_Words 38652 16.11 22.14 13.17 29 RCVD_IN_MSPIKE_WL 35589 30.96 20.39 36.11 30 BOTNET 34019 7.80 19.49 2.10 31 UNTRUSTED_Relay 31275 7.78 17.92 2.84 32 DCC_CHECK_NEGATIVE 30496 35.30 17.47 43.99 33 XM_B_Unsub 30315 12.67 17.37 10.38 34 T_TM2_M_HEADER_IN_MSG 29931 18.83 17.15 19.65 35 XM_UncommonTLD01 27529 7.59 15.77 3.60 36 XM_Multi_Part_URI 26410 14.30 15.13 13.90 37 RCVD_IN_BL_SPAMCOP_NET 25394 6.21 14.55 2.15 38 BOTNET_IPINHOSTNAME 23982 8.27 13.74 5.60 39 XMSexyCombo_05 23474 7.67 13.45 4.85 40 XM_B_SpammyWords3 21797 7.94 12.49 5.73 41 FSL_BULK_SIG 21601 8.18 12.37 6.14 42 RCVD_IN_MSPIKE_H3 21430 16.65 12.28 18.78 43 HTML_IMAGE_RATIO_02 21407 11.06 12.26 10.48 44 LOTS_OF_MONEY 20358 7.49 11.66 5.46 45 TR_XM_SpammyWords2 19645 4.61 11.25 1.38 46 MPART_ALT_DIFF 19002 6.97 10.88 5.06 47 XM_Evil_Numbers_Gen 18495 11.38 10.59 11.76 48 TR_XM_SpammyWords4 17896 6.02 10.25 3.96 49 UNPARSEABLE_RELAY 16734 10.26 9.59 10.58 50 TR_XM_UnparsRelay 16285 8.38 9.33 7.91 51 BAYES_80 16157 6.78 9.26 5.58 52 MIME_HTML_MOSTLY 16146 4.95 9.25 2.86 53 XMNumbers 14694 4.84 8.42 3.10 54 BAYES_60 13942 8.65 7.99 8.98 55 XM_SendGrid 13926 9.14 7.98 9.71 56 XM_UB50 13322 3.47 7.63 1.44 57 XM_H_Long_From01 13199 6.75 7.56 6.36 58 LotsOfNums_01 13142 9.28 7.53 10.14 59 RCVD_IN_MSPIKE_H4 12829 11.65 7.35 13.75 60 RELAYCOUNTRY_CA 12720 3.41 7.29 1.52 61 XMSubMetaSx_00 12027 4.16 6.89 2.82 62 TooManyTo_001 11608 6.27 6.65 6.09 63 XM_B_Phish_Phrases 11428 6.44 6.55 6.39 64 RCVD_IN_MSPIKE_BL 11303 2.42 6.47 0.44 65 TR_XM_PhishingBody 11173 3.52 6.40 2.11 66 TR_XM_MSPIKECOMBO 11164 2.39 6.40 0.44 67 HTML_IMAGE_RATIO_04 10956 8.38 6.28 9.41 68 RCVD_IN_RP_RNBL 10081 1.94 5.77 0.07 69 SpammyFromTLD_01 9997 2.31 5.73 0.65 70 RCVD_IN_RP_SAFE 9984 10.78 5.72 13.24 71 RELAYCOUNTRY_FR 9505 2.02 5.44 0.35 72 RCVD_IN_MSPIKE_L5 9325 1.84 5.34 0.14 73 SpammyFromTLD_02 9185 1.97 5.26 0.37 74 BAYES_95 9029 3.92 5.17 3.31 75 TR_XM_SpammyWords5 8882 3.29 5.09 2.41 76 RCVD_IN_RP_CERTIFIED 8493 9.85 4.87 12.28 77 BOTNET_NORDNS 8455 1.60 4.84 0.02 78 RCVD_IN_PSBL 8219 1.74 4.71 0.30 79 KHOP_HELO_FCRDNS 8102 2.01 4.64 0.73 80 HTML_MIME_NO_HTML_TAG 7992 2.28 4.58 1.15 81 TR_XM_DK_SendGrid 7911 5.32 4.53 5.70 82 XM_SPF_SoftFail 7686 2.06 4.40 0.92 83 XM_B_SpammyTLD 7557 3.08 4.33 2.47 84 DKIM_INVALID 7298 2.99 4.18 2.41 85 XM_DIRTYINTL 7291 1.64 4.18 0.41 86 TM2_M_URI_OPT_OUT 7037 3.17 4.03 2.75 87 TR_Mismatch_TLD_02 6941 1.37 3.98 0.10 88 HTML_IMAGE_ONLY_12 6701 1.34 3.84 0.12 89 HTML_SHORT_LINK_IMG_1 6674 1.27 3.82 0.03 90 BAYES_40 6533 4.04 3.74 4.18 91 XM_OfRef6 6406 1.69 3.67 0.73 92 HTML_IMAGE_RATIO_06 6242 3.60 3.58 3.61 93 XMBdyGiftCard01 6171 2.14 3.53 1.45 94 XM_DK_Undo_01 6079 1.98 3.48 1.24 95 SUBJ_ALL_CAPS 6034 2.68 3.46 2.30 96 T_TooManySym_01 5977 4.25 3.42 4.65 97 XMDiploma_00 5825 1.76 3.34 1.00 98 HTML_IMAGE_RATIO_08 5819 2.84 3.33 2.59 99 DKIM_ADSP_NXDOMAIN 5564 1.24 3.19 0.30 100 T_REMOTE_IMAGE 5290 2.95 3.03 2.92 101 FROM_EXCESS_BASE64 5245 4.08 3.00 4.61 102 MIME_HEADER_CTYPE_ONLY 4993 0.98 2.86 0.07 103 MIME_HTML_ONLY_MULTI 4979 3.04 2.85 3.13 104 HDRS_MISSP 4925 1.08 2.82 0.23 105 URI_HEX 4902 1.91 2.81 1.48 106 T_XMDrugObfuBody_08 4861 1.98 2.78 1.58 107 TR_XM_SpammyWords3 4700 1.12 2.69 0.36 108 MIME_QP_LONG_LINE 4649 4.45 2.66 5.32 109 GOOG_STO_IMG_NOHTML 4627 1.06 2.65 0.29 110 HDRS_LCASE_IMGONLY 4456 0.89 2.55 0.08 111 XMBrknScrpt_02 4398 1.65 2.52 1.23 112 XM_B_Phish66 4380 1.51 2.51 1.02 113 MAILING_LIST_MULTI 4369 2.59 2.50 2.63 114 TR_LOTS_OF_MONEY3 4273 0.98 2.45 0.26 115 FORGED_GMAIL_RCVD 4212 1.22 2.41 0.64 116 T_FILL_THIS_FORM_SHORT 4201 1.08 2.41 0.43 117 XM_UB99 4129 0.78 2.37 0.01 118 XMStrtUSub 4004 4.83 2.29 6.07 119 TM2_M_VERY_LONG_WORD 4002 1.88 2.29 1.67 120 XM_UB60 3966 0.89 2.27 0.22 121 XMSexyCombo_01 3893 1.01 2.23 0.41 122 XM_CamelCaseFrm001 3759 1.97 2.15 1.88 123 XM_UB80 3641 0.71 2.09 0.05 124 PDS_OTHER_BAD_TLD 3596 1.31 2.06 0.94 125 URIBL_SBL_A 3563 0.78 2.04 0.17 126 XMPhish08 3393 0.74 1.94 0.15 127 T_XMDrugObfuBody_00 3313 1.53 1.90 1.35 128 FROM_MISSP_REPLYTO 3290 0.63 1.88 0.02 129 XMStockSpam_06 3273 1.49 1.87 1.31 130 XM_B_Unsub2 3267 1.23 1.87 0.92 131 RELAYCOUNTRY_GB 3212 1.15 1.84 0.81 132 XM_B_SpammyWords4 3197 1.32 1.83 1.07 133 BAYES_20 3154 2.74 1.81 3.19 134 PDS_TO_EQ_FROM_NAME 3121 0.59 1.79 0.01 135 XMSubMetaI_00 3107 1.45 1.78 1.29 136 BAYES_00 3050 9.18 1.75 12.80 137 NUMERIC_HTTP_ADDR 2983 0.98 1.71 0.63 138 XM_BadFromFormat 2907 0.74 1.67 0.29 139 RCVD_IN_IADB_LISTED 2903 4.28 1.66 5.55 140 URI_GOOGLE_PROXY 2838 0.73 1.63 0.29 141 HK_RANDOM_REPLYTO 2756 0.67 1.58 0.23 142 XMBody_17 2698 1.08 1.55 0.85 143 XM_OfRef7 2650 0.58 1.52 0.12 144 RCVD_IN_IADB_SPF 2619 3.79 1.50 4.90 145 DEAR_BENEFICIARY 2619 0.49 1.50 0.00 146 XMGenDplmaNmb 2615 0.87 1.50 0.57 147 T_XMHurry_00 2603 0.97 1.49 0.71 148 DKIM_ADSP_CUSTOM_MED 2595 1.12 1.49 0.94 149 XM_UB999 2555 0.48 1.46 0.00 150 HTML_IMAGE_ONLY_20 2550 0.81 1.46 0.49 151 FROM_SUSPICIOUS_NTLD 2522 0.54 1.44 0.10 152 TR_XM_RelayPhish 2498 0.52 1.43 0.08 153 RCVD_IN_IADB_DK 2481 3.36 1.42 4.30 154 XM_UB95 2480 0.48 1.42 0.02 155 RCVD_IN_IADB_SENDERID 2456 3.46 1.41 4.45 156 URIBL_BLACK 2434 0.48 1.39 0.04 157 TR_XM_DK_Bayes 2421 7.84 1.39 10.98 158 TR_XM_DK_Bayes1 2389 7.69 1.37 10.77 159 FROM_SUSPICIOUS_NTLD_FP 2388 0.51 1.37 0.09 160 TR_Caps_n_Bayes_99 2375 0.78 1.36 0.50 161 T_XMDrugObfuBody_14 2360 1.46 1.35 1.51 162 RELAYCOUNTRY_DE 2360 0.82 1.35 0.56 163 URI_NOVOWEL 2355 2.27 1.35 2.73 164 TR_XM_PHPDW 2344 0.64 1.34 0.29 165 TR_XM_FormFill 2317 0.44 1.33 0.01 166 TR_XM_PHPForged 2297 0.59 1.32 0.24 167 NML_ADSP_CUSTOM_MED 2293 0.83 1.31 0.60 168 TR_XM_FormFill2 2282 0.60 1.31 0.25 169 XM_URI_RBL 2278 0.80 1.30 0.55 170 TR_XM_BayesRelay 2273 0.44 1.30 0.02 171 XM_H_PHPOS 2270 0.58 1.30 0.23 172 DATE_IN_PAST_06_12 2225 0.65 1.27 0.35 173 BODY_URI_ONLY 2134 0.41 1.22 0.02 174 HTML_SHORT_LINK_IMG_3 2118 0.45 1.21 0.08 175 XM_ProductURIs 2116 1.12 1.21 1.07 176 TR_XM_DK_Bayes2 2086 7.15 1.19 10.04 177 DATE_IN_PAST_03_06 2073 0.52 1.19 0.19 178 RELAYCOUNTRY_PL 2055 0.43 1.18 0.06 179 SUBJ_DOLLARS 2052 0.68 1.18 0.44 180 URI_PHP_REDIR 2011 0.38 1.15 0.00 181 TR_Symld_Words 2002 0.90 1.15 0.78 182 TR_XM_INV_DKIM 1998 0.44 1.14 0.10 183 XMSubNoVowel 1992 1.03 1.14 0.98 184 HTML_FONT_SIZE_LARGE 1981 0.59 1.13 0.33 185 URI_NO_WWW_INFO_CGI 1967 0.38 1.13 0.02 186 INVALID_MSGID 1965 1.69 1.13 1.96 187 PDS_FROM_2_EMAILS 1965 0.39 1.13 0.03 188 XMSubMetaSxObfu_03 1944 0.70 1.11 0.50 189 FROM_2_EMAILS_SHORT 1933 0.37 1.11 0.01 190 RDNS_DYNAMIC 1896 0.79 1.09 0.64 191 TR_XM_SB_Phish 1851 1.27 1.06 1.37 192 NAME_EMAIL_DIFF 1803 0.41 1.03 0.11 193 TR_XM_COVIDMETA4 1800 0.48 1.03 0.20 194 URI_TRY_3LD 1754 1.25 1.00 1.37 195 LONG_JUNK_URI 1753 0.38 1.00 0.07 196 GOOGLE_DOC_SUSP 1739 0.33 1.00 0.01 197 LongTLD 1730 0.41 0.99 0.13 198 T_Symld_Words_02 1727 0.53 0.99 0.31 199 NO_FM_NAME_IP_HOSTN 1726 0.33 0.99 0.00 200 TR_Mismatch_TLD_01 1725 0.49 0.99 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 319981 90.62 93.30 89.32 2 RELAYCOUNTRY_US 311199 82.15 72.46 86.87 3 DKIM_SIGNED 308362 85.48 84.27 86.07 4 XM_DK_Pass 304759 84.04 81.92 85.07 5 DKIM_VALID 299715 82.49 80.09 83.66 6 XM_B_Unicode 280837 76.86 73.72 78.39 7 DKIM_VALID_AU 236605 64.80 62.25 66.04 8 XMListUnsubscribeExists 233445 66.11 68.05 65.16 9 DCC_CHECK 196368 63.31 80.75 54.81 10 XM_B_SpammyWords 191466 57.21 64.95 53.44 11 BAYES_50 190012 48.16 38.15 53.04 12 XM_B_Unicode3 187427 49.69 44.30 52.32 13 DCC_CHECK_NEGATIVE 157594 35.30 17.47 43.99 14 RCVD_IN_MSPIKE_WL 129365 30.96 20.39 36.11 15 HTML_FONT_LOW_CONTRAST 117552 32.71 32.49 32.81 16 LOC_TINY_FONT_1 115766 34.48 38.92 32.31 17 RCVD_IN_MSPIKE_H2 103764 29.15 29.52 28.96 18 DKIM_VALID_EF 102407 29.24 30.60 28.59 19 FVGT_m_MULTI_ODD 92833 26.56 27.89 25.91 20 MIME_HTML_ONLY 85370 26.61 32.32 23.83 21 XM_B_SpammyWords2 82586 27.47 36.52 23.05 22 T_KAM_HTML_FONT_INVALID 75189 22.48 25.53 20.99 23 XMSubLong 71553 21.49 24.60 19.97 24 T_TM2_M_HEADER_IN_MSG 70403 18.83 17.15 19.65 25 RCVD_IN_MSPIKE_H3 67293 16.65 12.28 18.78 26 XM_Multi_Part_URI 49784 14.30 15.13 13.90 27 RCVD_IN_MSPIKE_H4 49267 11.65 7.35 13.75 28 RCVD_IN_RP_SAFE 47450 10.78 5.72 13.24 29 XM_Body_Dirty_Words 47167 16.11 22.14 13.17 30 BAYES_00 45872 9.18 1.75 12.80 31 RCVD_IN_RP_CERTIFIED 43989 9.85 4.87 12.28 32 XM_DKIMWhitelistDomains 43719 8.33 0.37 12.20 33 XM_Evil_Numbers_Gen 42146 11.38 10.59 11.76 34 TR_XM_DK_Bayes 39330 7.84 1.39 10.98 35 XM_DK_Undo_02 38628 22.57 46.76 10.78 36 TR_XM_DK_Bayes1 38571 7.69 1.37 10.77 37 UNPARSEABLE_RELAY 37916 10.26 9.59 10.58 38 HTML_IMAGE_RATIO_02 37530 11.06 12.26 10.48 39 XM_B_Unsub 37186 12.67 17.37 10.38 40 LotsOfNums_01 36318 9.28 7.53 10.14 41 TR_XM_DK_Bayes2 35986 7.15 1.19 10.04 42 XM_SendGrid 34773 9.14 7.98 9.71 43 HTML_IMAGE_RATIO_04 33715 8.38 6.28 9.41 44 BAYES_60 32161 8.65 7.99 8.98 45 ALL_TRUSTED 29828 5.84 0.74 8.33 46 TR_XM_UnparsRelay 28347 8.38 9.33 7.91 47 TR_XM_DKIM_Undo 27042 17.04 36.53 7.55 48 BAYES_99 25065 14.93 31.20 7.00 49 XM_B_Phish_Phrases 22885 6.44 6.55 6.39 50 XM_H_Long_From01 22775 6.75 7.56 6.36 51 FSL_BULK_SIG 21987 8.18 12.37 6.14 52 TooManyTo_001 21800 6.27 6.65 6.09 53 XMStrtUSub 21736 4.83 2.29 6.07 54 XM_B_SpammyWords3 20526 7.94 12.49 5.73 55 TR_XM_DK_SendGrid 20428 5.32 4.53 5.70 56 BAYES_999 20261 11.63 23.89 5.66 57 BOTNET_IPINHOSTNAME 20060 8.27 13.74 5.60 58 BAYES_80 19978 6.78 9.26 5.58 59 RCVD_IN_IADB_LISTED 19892 4.28 1.66 5.55 60 RELAYCOUNTRY_META 19737 12.64 27.26 5.51 61 LOTS_OF_MONEY 19555 7.49 11.66 5.46 62 MIME_QP_LONG_LINE 19055 4.45 2.66 5.32 63 MPART_ALT_DIFF 18139 6.97 10.88 5.06 64 RCVD_IN_IADB_SPF 17551 3.79 1.50 4.90 65 XMSexyCombo_05 17386 7.67 13.45 4.85 66 TR_DCC_Bayes_99 17070 11.34 24.82 4.76 67 T_TooManySym_01 16669 4.25 3.42 4.65 68 FROM_EXCESS_BASE64 16510 4.08 3.00 4.61 69 IN_ZIMBRA_NJ_WHITELIST 16360 3.09 0.06 4.57 70 RCVD_IN_IADB_SENDERID 15956 3.46 1.41 4.45 71 RCVD_IN_IADB_DK 15401 3.36 1.42 4.30 72 BAYES_40 14992 4.04 3.74 4.18 73 TR_XM_SpammyWords4 14177 6.02 10.25 3.96 74 HTML_IMAGE_RATIO_06 12919 3.60 3.58 3.61 75 XM_UncommonTLD01 12894 7.59 15.77 3.60 76 RCVD_IN_MSPIKE_H5 12805 2.65 0.76 3.57 77 BAYES_95 11866 3.92 5.17 3.31 78 RCVD_IN_IADB_VOUCHED 11605 2.40 0.68 3.24 79 BAYES_20 11435 2.74 1.81 3.19 80 MIME_HTML_ONLY_MULTI 11215 3.04 2.85 3.13 81 XMNumbers 11106 4.84 8.42 3.10 82 T_REMOTE_IMAGE 10445 2.95 3.03 2.92 83 MIME_HTML_MOSTLY 10243 4.95 9.25 2.86 84 UNTRUSTED_Relay 10160 7.78 17.92 2.84 85 XMSubMetaSx_00 10116 4.16 6.89 2.82 86 TM2_M_URI_OPT_OUT 9852 3.17 4.03 2.75 87 URI_NOVOWEL 9764 2.27 1.35 2.73 88 MAILING_LIST_MULTI 9429 2.59 2.50 2.63 89 HTML_IMAGE_RATIO_08 9289 2.84 3.33 2.59 90 XM_B_SpammyTLD 8840 3.08 4.33 2.47 91 XM_H_Trusted_IP 8716 1.64 0.00 2.43 92 DKIM_INVALID 8647 2.99 4.18 2.41 93 TR_XM_SpammyWords5 8635 3.29 5.09 2.41 94 SUBJ_ALL_CAPS 8249 2.68 3.46 2.30 95 T_TooManySym_02 7752 1.74 0.89 2.16 96 RCVD_IN_BL_SPAMCOP_NET 7692 6.21 14.55 2.15 97 RCVD_IN_IADB_OPTIN 7581 1.58 0.49 2.12 98 TR_XM_PhishingBody 7558 3.52 6.40 2.11 99 BOTNET 7516 7.80 19.49 2.10 100 INVALID_MSGID 7021 1.69 1.13 1.96 101 USER_IN_DEF_DKIM_WL 7012 1.32 0.01 1.96 102 XM_CamelCaseFrm001 6746 1.97 2.15 1.88 103 BAYES_05 6742 1.57 0.93 1.88 104 TO_MALFORMED 6458 1.23 0.04 1.80 105 TVD_RCVD_IP 6387 1.29 0.28 1.78 106 MSGID_NOFQDN1 6290 1.38 0.61 1.76 107 HELO_MISC_IP 6067 1.26 0.37 1.69 108 TR_MSPIKEBAYES00 6009 1.13 0.02 1.68 109 TM2_M_VERY_LONG_WORD 5995 1.88 2.29 1.67 110 T_XMDrugObfuBody_08 5675 1.98 2.78 1.58 111 RELAYCOUNTRY_CA 5456 3.41 7.29 1.52 112 ANY_BOUNCE_MESSAGE 5437 1.17 0.46 1.52 113 BOUNCE_MESSAGE 5435 1.17 0.46 1.52 114 T_XMDrugObfuBody_14 5409 1.46 1.35 1.51 115 IN_HORDE_ADDRESS_BOOK 5361 1.07 0.18 1.50 116 URI_HEX 5292 1.91 2.81 1.48 117 XMBdyGiftCard01 5210 2.14 3.53 1.45 118 XM_UB50 5146 3.47 7.63 1.44 119 XM_H_Long_From02 5015 1.23 0.87 1.40 120 TR_XM_SpammyWords2 4939 4.61 11.25 1.38 121 TR_XM_SB_Phish 4916 1.27 1.06 1.37 122 URI_TRY_3LD 4891 1.25 1.00 1.37 123 T_XMDrugObfuBody_00 4823 1.53 1.90 1.35 124 XMSubPhish11 4775 1.21 0.95 1.33 125 XMBSHREFv2 4744 0.97 0.23 1.32 126 XMStockSpam_06 4690 1.49 1.87 1.31 127 XMSubMetaI_00 4606 1.45 1.78 1.29 128 XM_DK_Undo_01 4458 1.98 3.48 1.24 129 XMBrknScrpt_02 4417 1.65 2.52 1.23 130 HTML_MIME_NO_HTML_TAG 4132 2.28 4.58 1.15 131 XM_ProductURIs 3828 1.12 1.21 1.07 132 XM_GoogleGroups 3825 0.88 0.49 1.07 133 XMGappySubj_01 3817 0.75 0.11 1.07 134 XM_B_SpammyWords4 3817 1.32 1.83 1.07 135 XM_PDF 3761 0.80 0.27 1.05 136 TooManyTo_002 3706 0.83 0.42 1.03 137 XM_B_Phish66 3666 1.51 2.51 1.02 138 XMDiploma_00 3576 1.76 3.34 1.00 139 HTML_FONT_FACE_BAD 3540 0.84 0.54 0.99 140 XMSubNoVowel 3502 1.03 1.14 0.98 141 PDS_OTHER_BAD_TLD 3370 1.31 2.06 0.94 142 DKIM_ADSP_CUSTOM_MED 3361 1.12 1.49 0.94 143 XM_B_Unsub2 3296 1.23 1.87 0.92 144 XM_SPF_SoftFail 3291 2.06 4.40 0.92 145 XMBody_17 3056 1.08 1.55 0.85 146 RELAYCOUNTRY_GB 2905 1.15 1.84 0.81 147 XMOemUri 2858 0.60 0.19 0.80 148 TR_XM_Spammywords 2811 0.77 0.73 0.78 149 XM_S_SpammyWords 2811 0.77 0.73 0.78 150 TR_Symld_Words 2783 0.90 1.15 0.78 151 KHOP_HELO_FCRDNS 2624 2.01 4.64 0.73 152 TooManyTo_003 2607 0.59 0.29 0.73 153 XMHTMLBadTable_001 2599 0.72 0.71 0.73 154 XM_OfRef6 2599 1.69 3.67 0.73 155 XM_RXBody 2564 0.72 0.73 0.72 156 T_XMHurry_00 2544 0.97 1.49 0.71 157 T_TooManySym_03 2472 0.50 0.12 0.69 158 SpammyFromTLD_01 2328 2.31 5.73 0.65 159 RDNS_DYNAMIC 2303 0.79 1.09 0.64 160 FORGED_GMAIL_RCVD 2275 1.22 2.41 0.64 161 NUMERIC_HTTP_ADDR 2260 0.98 1.71 0.63 162 XMBody_95 2224 0.47 0.17 0.62 163 XMHTML_After_End 2216 0.70 0.88 0.62 164 NML_ADSP_CUSTOM_MED 2150 0.83 1.31 0.60 165 SHOPIFY_IMG_NOT_RCVD_SFY 2149 0.56 0.48 0.60 166 XM_B_COPY_HTML 2107 0.61 0.66 0.59 167 PLING_QUERY 2093 0.58 0.57 0.58 168 TR_MetaPhish_Combo_01 2069 0.60 0.65 0.58 169 XMGenDplmaNmb 2032 0.87 1.50 0.57 170 TooManyTo_004 2022 0.47 0.27 0.56 171 RELAYCOUNTRY_DE 2021 0.82 1.35 0.56 172 XM_URI_RBL 1985 0.80 1.30 0.55 173 XM_B_REG_HTML 1973 0.44 0.22 0.55 174 TR_BOTNET_NEGATE 1893 0.68 0.98 0.53 175 XM_H_PHPMailer 1835 0.52 0.52 0.51 176 TR_Caps_n_Bayes_99 1797 0.78 1.36 0.50 177 XMLngstWrd_00 1787 0.43 0.28 0.50 178 XMSubMetaSxObfu_03 1787 0.70 1.11 0.50 179 HTML_IMAGE_ONLY_20 1750 0.81 1.46 0.49 180 XMSubMetaSxObfu_02 1746 0.46 0.40 0.49 181 HTML_TAG_BALANCE_BODY 1723 0.56 0.73 0.48 182 XMPhish30 1683 0.59 0.84 0.47 183 TooManyTo_005 1667 0.39 0.24 0.47 184 XMNoVowels 1665 0.59 0.86 0.46 185 XMBody_78 1637 0.59 0.88 0.46 186 RCVD_IN_MSPIKE_BL 1567 2.42 6.47 0.44 187 TR_XM_MSPIKECOMBO 1560 2.39 6.40 0.44 188 SUBJ_DOLLARS 1559 0.68 1.18 0.44 189 T_FILL_THIS_FORM_SHORT 1557 1.08 2.41 0.43 190 XMLngstWrd_01 1538 0.37 0.25 0.43 191 XM_Ancestry_Forge 1521 0.29 0.00 0.42 192 HTTPS_HTTP_MISMATCH 1504 0.53 0.77 0.42 193 XMPhish14 1502 0.49 0.64 0.42 194 XMSexyCombo_01 1481 1.01 2.23 0.41 195 XM_DIRTYINTL 1469 1.64 4.18 0.41 196 USER_IN_WHITELIST 1449 0.27 0.00 0.40 197 USER_IN_WELCOMELIST 1449 0.27 0.00 0.40 198 TVD_SPACE_RATIO_MINFP 1440 0.56 0.87 0.40 199 XM_HighProb1 1407 0.35 0.27 0.39 200 HELO_NO_DOMAIN 1356 0.38 0.39 0.38 ----------------------------------------------------------------------