Email: 756704 Autolearn: 0 AvgScore: 4.56 AvgScanTime: 1.98 sec Spam: 255614 Autolearn: 0 AvgScore: 13.58 AvgScanTime: 2.02 sec Ham: 501090 Autolearn: 0 AvgScore: -0.05 AvgScanTime: 1.96 sec Time Spent Running SA: 415.58 hours Time Spent Processing Spam: 143.45 hours Time Spent Processing Ham: 272.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 246429 93.47 96.41 91.97 2 DKIM_SIGNED 217677 85.39 85.16 85.51 3 DCC_CHECK 214488 65.33 83.91 55.86 4 XM_DK_Pass 211670 83.93 82.81 84.50 5 DKIM_VALID 207676 82.53 81.25 83.18 6 RELAYCOUNTRY_US 200221 84.65 78.33 87.87 7 XM_B_Unicode 192943 78.25 75.48 79.66 8 XMListUnsubscribeExists 184914 67.91 72.34 65.65 9 XM_B_SpammyWords 170041 58.51 66.52 54.43 10 DKIM_VALID_AU 157768 62.87 61.72 63.46 11 XM_DK_Undo_02 121699 23.07 47.61 10.55 12 XM_B_Unicode3 112687 49.61 44.08 52.43 13 LOC_TINY_FONT_1 100099 35.10 39.16 33.03 14 TR_XM_DKIM_Undo 99646 17.67 38.98 6.79 15 XM_B_SpammyWords2 98804 29.99 38.65 25.57 16 BAYES_50 96520 48.82 37.76 54.47 17 HTML_FONT_LOW_CONTRAST 91561 34.56 35.82 33.92 18 RCVD_IN_MSPIKE_H2 86267 30.30 33.75 28.54 19 BAYES_99 81758 15.18 31.98 6.61 20 MIME_HTML_ONLY 81010 26.53 31.69 23.90 21 FVGT_m_MULTI_ODD 74705 26.91 29.23 25.72 22 DKIM_VALID_EF 71685 27.55 28.04 27.30 23 T_KAM_HTML_FONT_INVALID 70176 23.87 27.45 22.04 24 TR_DCC_Bayes_99 67948 11.90 26.58 4.41 25 BAYES_999 62599 11.89 24.49 5.46 26 XMSubLong 61461 20.07 24.04 18.04 27 RCVD_IN_MSPIKE_WL 53128 31.52 20.78 37.00 28 RELAYCOUNTRY_META 52984 10.14 20.73 4.74 29 XM_Body_Dirty_Words 51010 15.33 19.96 12.97 30 T_TM2_M_HEADER_IN_MSG 48815 19.88 19.10 20.28 31 BOTNET 47835 7.73 18.71 2.13 32 XM_Multi_Part_URI 42354 15.34 16.57 14.71 33 XM_B_Unsub 41200 12.74 16.12 11.02 34 DCC_CHECK_NEGATIVE 37389 33.24 14.63 42.74 35 XM_B_SpammyWords3 34548 8.85 13.52 6.46 36 UNTRUSTED_Relay 34069 5.98 13.33 2.24 37 BOTNET_IPINHOSTNAME 32685 7.78 12.79 5.23 38 RCVD_IN_BL_SPAMCOP_NET 31247 5.60 12.22 2.22 39 HTML_IMAGE_RATIO_02 30674 11.02 12.00 10.52 40 XM_Evil_Numbers_Gen 30313 11.77 11.86 11.72 41 TR_XM_SpammyWords2 29736 4.74 11.63 1.22 42 UNPARSEABLE_RELAY 29364 11.23 11.49 11.10 43 RCVD_IN_MSPIKE_H3 29157 16.25 11.41 18.73 44 LOTS_OF_MONEY 29155 7.99 11.41 6.24 45 XM_UncommonTLD01 29035 5.66 11.36 2.75 46 TR_XM_UnparsRelay 28624 9.52 11.20 8.67 47 XMSexyCombo_05 27651 6.88 10.82 4.87 48 FSL_BULK_SIG 27619 7.45 10.80 5.73 49 XM_SendGrid 25862 10.17 10.12 10.20 50 TR_XM_SpammyWords4 25234 6.06 9.87 4.11 51 LotsOfNums_01 24921 10.97 9.75 11.59 52 BAYES_80 23477 6.58 9.18 5.25 53 MPART_ALT_DIFF 23060 7.30 9.02 6.43 54 RCVD_IN_MSPIKE_H4 21349 12.18 8.35 14.13 55 BAYES_60 21136 8.70 8.27 8.93 56 XM_H_Long_From01 19271 6.65 7.54 6.19 57 TooManyTo_001 18780 6.59 7.35 6.21 58 MIME_HTML_MOSTLY 18173 4.43 7.11 3.06 59 XMSubMetaSx_00 17556 4.21 6.87 2.85 60 XM_B_Phish_Phrases 16254 6.31 6.36 6.29 61 RCVD_IN_MSPIKE_BL 16227 2.34 6.35 0.29 62 TR_XM_MSPIKECOMBO 15792 2.28 6.18 0.29 63 RELAYCOUNTRY_CA 15128 2.98 5.92 1.49 64 TR_XM_SpammyWords5 15081 3.68 5.90 2.54 65 XM_UB50 14616 2.68 5.72 1.13 66 RCVD_IN_RP_SAFE 14598 9.49 5.71 11.41 67 HTML_IMAGE_RATIO_04 14459 7.16 5.66 7.93 68 BOTNET_NORDNS 13798 1.83 5.40 0.01 69 XMNumbers 13380 3.46 5.23 2.56 70 TR_XM_DK_SendGrid 13146 5.66 5.14 5.92 71 TR_XM_PhishingBody 13094 3.36 5.12 2.46 72 HTML_MIME_NO_HTML_TAG 13089 2.55 5.12 1.24 73 BAYES_95 12515 3.80 4.90 3.24 74 RCVD_IN_RP_CERTIFIED 12368 8.66 4.84 10.61 75 XM_B_SpammyTLD 12082 2.93 4.73 2.02 76 SUBJ_ALL_CAPS 11607 3.46 4.54 2.90 77 HTML_IMAGE_RATIO_06 11211 4.60 4.39 4.71 78 DKIM_ADSP_NXDOMAIN 10839 1.60 4.24 0.25 79 RCVD_IN_MSPIKE_L5 10421 1.43 4.08 0.08 80 HTML_IMAGE_RATIO_08 10298 3.14 4.03 2.69 81 HDRS_MISSP 10242 1.45 4.01 0.15 82 T_REMOTE_IMAGE 10189 3.04 3.99 2.55 83 MIME_HEADER_CTYPE_ONLY 10142 1.38 3.97 0.06 84 DKIM_INVALID 10001 2.86 3.91 2.33 85 KHOP_HELO_FCRDNS 9866 1.78 3.86 0.72 86 HDRS_LCASE_IMGONLY 9866 1.34 3.86 0.06 87 XM_SPF_SoftFail 9856 1.96 3.86 0.99 88 TM2_M_URI_OPT_OUT 9825 3.22 3.84 2.91 89 GOOG_STO_IMG_HTML 9759 1.29 3.82 0.00 90 RCVD_IN_RP_RNBL 9605 1.29 3.76 0.04 91 XM_OfRef6 9276 1.66 3.63 0.66 92 RELAYCOUNTRY_FR 9265 1.41 3.62 0.27 93 XM_DK_Undo_01 9265 2.01 3.62 1.18 94 RCVD_IN_PSBL 9213 1.36 3.60 0.22 95 XMStrtUSub 9185 4.98 3.59 5.68 96 XM_DIRTYINTL 9073 1.40 3.55 0.31 97 MIME_QP_LONG_LINE 8939 5.61 3.50 6.69 98 SpammyFromTLD_01 7912 1.34 3.10 0.44 99 MIME_HTML_ONLY_MULTI 7710 3.52 3.02 3.78 100 T_XMDrugObfuBody_08 7644 2.59 2.99 2.39 101 FROM_EXCESS_BASE64 7487 3.91 2.93 4.40 102 FORGED_GMAIL_RCVD 7296 1.37 2.85 0.61 103 HTML_SHORT_LINK_IMG_1 7277 0.98 2.85 0.03 104 XMSubMetaI_00 7128 2.02 2.79 1.63 105 XMDiploma_00 6694 1.75 2.62 1.31 106 TR_LOTS_OF_MONEY3 6683 1.10 2.61 0.32 107 XMBdyGiftCard01 6637 1.77 2.60 1.34 108 XMSexyCombo_01 6555 1.12 2.56 0.39 109 HTML_IMAGE_ONLY_24 6522 1.00 2.55 0.21 110 TR_XM_SpammyWords3 6369 0.98 2.49 0.21 111 URI_HEX 6298 2.25 2.46 2.15 112 URIBL_SBL_A 6275 0.90 2.45 0.11 113 TR_Mismatch_TLD_02 6223 0.87 2.43 0.07 114 SpammyFromTLD_02 6197 0.96 2.42 0.22 115 TM2_M_VERY_LONG_WORD 6056 1.89 2.37 1.65 116 XMStockSpam_06 5982 1.92 2.34 1.70 117 BAYES_40 5965 3.55 2.33 4.18 118 XM_CamelCaseFrm001 5884 2.19 2.30 2.13 119 XMBody_17 5881 1.30 2.30 0.80 120 DATE_IN_PAST_06_12 5740 0.95 2.25 0.30 121 RCVD_IN_IADB_LISTED 5563 5.42 2.18 7.08 122 HK_RANDOM_REPLYTO 5543 0.86 2.17 0.20 123 T_TooManySym_01 5418 3.24 2.12 3.81 124 BAYES_20 5400 2.83 2.11 3.20 125 T_XMHurry_00 5357 1.49 2.10 1.17 126 XMBrknScrpt_02 5220 1.81 2.04 1.69 127 RCVD_IN_IADB_SPF 5098 4.79 1.99 6.22 128 RCVD_IN_IADB_DK 4936 4.26 1.93 5.45 129 RCVD_IN_IADB_SENDERID 4925 4.36 1.93 5.60 130 XM_UB60 4923 0.75 1.93 0.16 131 RELAYCOUNTRY_GB 4774 1.09 1.87 0.70 132 XM_B_Phish66 4765 1.37 1.86 1.12 133 PDS_OTHER_BAD_TLD 4716 1.10 1.84 0.72 134 XM_B_Unsub2 4696 1.43 1.84 1.23 135 BAYES_00 4670 8.67 1.83 12.16 136 XM_B_SpammyWords4 4638 1.05 1.81 0.66 137 XMSexyCombo_04 4481 0.66 1.75 0.10 138 XMSlimDrugH 4461 0.67 1.75 0.12 139 XM_Lotto 4390 0.83 1.72 0.38 140 T_FILL_THIS_FORM_SHORT 4295 0.91 1.68 0.51 141 T_XMDrugObfuBody_14 4166 1.57 1.63 1.54 142 XM_UB80 4156 0.58 1.63 0.04 143 XM_UB99 4142 0.55 1.62 0.00 144 BAYES_05 4116 1.80 1.61 1.90 145 HTML_IMAGE_ONLY_20 4107 0.90 1.61 0.54 146 HTML_IMAGE_ONLY_08 4034 0.58 1.58 0.07 147 URI_NOVOWEL 3978 2.65 1.56 3.20 148 URIBL_BLACK 3929 0.57 1.54 0.07 149 GOOGLE_DOC_SUSP 3902 0.52 1.53 0.01 150 MAILING_LIST_MULTI 3899 2.00 1.53 2.25 151 ALIBABA_IMG_NOT_RCVD_ALI 3891 0.52 1.52 0.00 152 XM_B_COVIDMETA 3830 0.81 1.50 0.47 153 FVGT_m_MULTI_ODD_EMAIL 3783 0.52 1.48 0.03 154 HTML_IMAGE_ONLY_12 3758 0.58 1.47 0.12 155 XMSlimDrugs 3752 0.50 1.47 0.01 156 T_XMDrugObfuBody_00 3713 1.20 1.45 1.07 157 XM_URI_RBL 3627 0.78 1.42 0.45 158 TR_UG_Sexy_Spam 3611 0.48 1.41 0.01 159 RCVD_IN_MSPIKE_L4 3606 0.49 1.41 0.02 160 FROM_SUSPICIOUS_NTLD 3581 0.52 1.40 0.07 161 XM_OfRef7 3556 0.52 1.39 0.08 162 DKIM_ADSP_CUSTOM_MED 3553 1.05 1.39 0.87 163 BODY_URI_ONLY 3532 0.48 1.38 0.02 164 TR_XM_MaxBayes 3509 0.47 1.37 0.00 165 TR_XM_RelayPhish 3496 0.50 1.37 0.06 166 FROM_SUSPICIOUS_NTLD_FP 3492 0.51 1.37 0.07 167 HOSTED_IMG_DIRECT_MX 3465 0.46 1.36 0.00 168 XM_RXBody 3436 1.23 1.34 1.18 169 XM_ProductURIs 3324 1.45 1.30 1.53 170 DEAR_BENEFICIARY 3225 0.43 1.26 0.00 171 TR_Caps_n_Bayes_99 3162 0.53 1.24 0.17 172 NML_ADSP_CUSTOM_MED 3160 0.80 1.24 0.58 173 URI_TRY_3LD 3111 1.58 1.22 1.77 174 LongTLD 3070 0.49 1.20 0.12 175 HK_RANDOM_FROM 3069 0.45 1.20 0.07 176 DATE_IN_PAST_03_06 3016 0.52 1.18 0.18 177 TR_XM_SB_Phish 2978 1.21 1.17 1.24 178 XMSubPhish11 2933 1.19 1.15 1.22 179 XMHTML_After_End 2911 0.82 1.14 0.66 180 TR_Symld_Words 2911 0.99 1.14 0.91 181 XM_UB999 2894 0.38 1.13 0.00 182 HTML_TITLE_SUBJ_DIFF 2887 0.50 1.13 0.18 183 XMGenDplmaNmb 2879 0.72 1.13 0.52 184 XMPhish08 2790 0.48 1.09 0.17 185 HTML_IMAGE_ONLY_16 2776 0.46 1.09 0.14 186 XMClaimOffer 2759 0.47 1.08 0.15 187 XMSubMetaSxObfu_03 2730 0.66 1.07 0.45 188 DATE_IN_PAST_12_24 2714 0.42 1.06 0.10 189 TR_XM_FormFill 2695 0.36 1.05 0.00 190 TR_XM_INV_DKIM 2686 0.40 1.05 0.07 191 LOW_PRICE 2638 0.74 1.03 0.59 192 RCVD_IN_MSPIKE_H5 2622 3.09 1.03 4.14 193 URI_PHP_REDIR 2604 0.34 1.02 0.00 194 TR_XM_PHPDW 2594 0.54 1.01 0.30 195 TR_XM_DK_Bayes 2541 7.02 0.99 10.09 196 TR_XM_PHPForged 2529 0.50 0.99 0.25 197 TR_XM_FormFill2 2517 0.51 0.98 0.26 198 XM_H_PHPOS 2512 0.50 0.98 0.25 199 TR_XM_BayesRelay 2498 0.34 0.98 0.02 200 TR_XM_COVIDMETA4 2472 0.45 0.97 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 460877 93.47 96.41 91.97 2 RELAYCOUNTRY_US 440325 84.65 78.33 87.87 3 DKIM_SIGNED 428470 85.39 85.16 85.51 4 XM_DK_Pass 423416 83.93 82.81 84.50 5 DKIM_VALID 416811 82.53 81.25 83.18 6 XM_B_Unicode 399166 78.25 75.48 79.66 7 XMListUnsubscribeExists 328959 67.91 72.34 65.65 8 DKIM_VALID_AU 318005 62.87 61.72 63.46 9 DCC_CHECK 279896 65.33 83.91 55.86 10 BAYES_50 272935 48.82 37.76 54.47 11 XM_B_SpammyWords 272720 58.51 66.52 54.43 12 XM_B_Unicode3 262746 49.61 44.08 52.43 13 DCC_CHECK_NEGATIVE 214152 33.24 14.63 42.74 14 RCVD_IN_MSPIKE_WL 185411 31.52 20.78 37.00 15 HTML_FONT_LOW_CONTRAST 169949 34.56 35.82 33.92 16 LOC_TINY_FONT_1 165505 35.10 39.16 33.03 17 RCVD_IN_MSPIKE_H2 143014 30.30 33.75 28.54 18 DKIM_VALID_EF 136785 27.55 28.04 27.30 19 FVGT_m_MULTI_ODD 128895 26.91 29.23 25.72 20 XM_B_SpammyWords2 128119 29.99 38.65 25.57 21 MIME_HTML_ONLY 119778 26.53 31.69 23.90 22 T_KAM_HTML_FONT_INVALID 110432 23.87 27.45 22.04 23 T_TM2_M_HEADER_IN_MSG 101640 19.88 19.10 20.28 24 RCVD_IN_MSPIKE_H3 93835 16.25 11.41 18.73 25 XMSubLong 90387 20.07 24.04 18.04 26 XM_Multi_Part_URI 73706 15.34 16.57 14.71 27 RCVD_IN_MSPIKE_H4 70807 12.18 8.35 14.13 28 XM_Body_Dirty_Words 64988 15.33 19.96 12.97 29 BAYES_00 60954 8.67 1.83 12.16 30 XM_DKIMWhitelistDomains 58974 7.84 0.14 11.77 31 XM_Evil_Numbers_Gen 58741 11.77 11.86 11.72 32 LotsOfNums_01 58061 10.97 9.75 11.59 33 RCVD_IN_RP_SAFE 57196 9.49 5.71 11.41 34 UNPARSEABLE_RELAY 55598 11.23 11.49 11.10 35 XM_B_Unsub 55209 12.74 16.12 11.02 36 RCVD_IN_RP_CERTIFIED 53184 8.66 4.84 10.61 37 XM_DK_Undo_02 52875 23.07 47.61 10.55 38 HTML_IMAGE_RATIO_02 52709 11.02 12.00 10.52 39 XM_SendGrid 51091 10.17 10.12 10.20 40 TR_XM_DK_Bayes 50566 7.02 0.99 10.09 41 TR_XM_DK_Bayes1 49623 6.88 0.95 9.90 42 TR_XM_DK_Bayes2 44989 6.23 0.84 8.98 43 BAYES_60 44726 8.70 8.27 8.93 44 TR_XM_UnparsRelay 43435 9.52 11.20 8.67 45 ALL_TRUSTED 40446 5.59 0.72 8.07 46 HTML_IMAGE_RATIO_04 39718 7.16 5.66 7.93 47 RCVD_IN_IADB_LISTED 35483 5.42 2.18 7.08 48 TR_XM_DKIM_Undo 34041 17.67 38.98 6.79 49 MIME_QP_LONG_LINE 33504 5.61 3.50 6.69 50 BAYES_99 33111 15.18 31.98 6.61 51 XM_B_SpammyWords3 32391 8.85 13.52 6.46 52 MPART_ALT_DIFF 32207 7.30 9.02 6.43 53 XM_B_Phish_Phrases 31521 6.31 6.36 6.29 54 LOTS_OF_MONEY 31276 7.99 11.41 6.24 55 RCVD_IN_IADB_SPF 31173 4.79 1.99 6.22 56 TooManyTo_001 31103 6.59 7.35 6.21 57 XM_H_Long_From01 31042 6.65 7.54 6.19 58 TR_XM_DK_SendGrid 29652 5.66 5.14 5.92 59 FSL_BULK_SIG 28718 7.45 10.80 5.73 60 XMStrtUSub 28463 4.98 3.59 5.68 61 RCVD_IN_IADB_SENDERID 28084 4.36 1.93 5.60 62 BAYES_999 27382 11.89 24.49 5.46 63 RCVD_IN_IADB_DK 27330 4.26 1.93 5.45 64 BAYES_80 26300 6.58 9.18 5.25 65 BOTNET_IPINHOSTNAME 26215 7.78 12.79 5.23 66 XMSexyCombo_05 24404 6.88 10.82 4.87 67 RELAYCOUNTRY_META 23757 10.14 20.73 4.74 68 HTML_IMAGE_RATIO_06 23592 4.60 4.39 4.71 69 IN_ZIMBRA_NJ_WHITELIST 23275 3.09 0.03 4.64 70 TR_DCC_Bayes_99 22103 11.90 26.58 4.41 71 FROM_EXCESS_BASE64 22068 3.91 2.93 4.40 72 BAYES_40 20927 3.55 2.33 4.18 73 RCVD_IN_MSPIKE_H5 20769 3.09 1.03 4.14 74 TR_XM_SpammyWords4 20597 6.06 9.87 4.11 75 RCVD_IN_IADB_VOUCHED 20550 2.94 0.67 4.10 76 T_TooManySym_01 19092 3.24 2.12 3.81 77 MIME_HTML_ONLY_MULTI 18943 3.52 3.02 3.78 78 BAYES_95 16252 3.80 4.90 3.24 79 URI_NOVOWEL 16058 2.65 1.56 3.20 80 BAYES_20 16042 2.83 2.11 3.20 81 XM_H_Trusted_IP 15862 2.10 0.00 3.17 82 MIME_HTML_MOSTLY 15354 4.43 7.11 3.06 83 TM2_M_URI_OPT_OUT 14574 3.22 3.84 2.91 84 SUBJ_ALL_CAPS 14554 3.46 4.54 2.90 85 XMSubMetaSx_00 14265 4.21 6.87 2.85 86 XM_UncommonTLD01 13766 5.66 11.36 2.75 87 HTML_IMAGE_RATIO_08 13493 3.14 4.03 2.69 88 RCVD_IN_IADB_OPTIN 13155 1.93 0.58 2.63 89 XMNumbers 12835 3.46 5.23 2.56 90 T_REMOTE_IMAGE 12780 3.04 3.99 2.55 91 TR_XM_SpammyWords5 12735 3.68 5.90 2.54 92 TR_XM_PhishingBody 12329 3.36 5.12 2.46 93 T_XMDrugObfuBody_08 11962 2.59 2.99 2.39 94 DKIM_INVALID 11659 2.86 3.91 2.33 95 MAILING_LIST_MULTI 11250 2.00 1.53 2.25 96 UNTRUSTED_Relay 11213 5.98 13.33 2.24 97 RCVD_IN_BL_SPAMCOP_NET 11123 5.60 12.22 2.22 98 URI_HEX 10759 2.25 2.46 2.15 99 BOTNET 10694 7.73 18.71 2.13 100 XM_CamelCaseFrm001 10665 2.19 2.30 2.13 101 XM_B_SpammyTLD 10105 2.93 4.73 2.02 102 XM_PDF 9569 1.35 0.26 1.91 103 BAYES_05 9512 1.80 1.61 1.90 104 URI_TRY_3LD 8853 1.58 1.22 1.77 105 USER_IN_DEF_DKIM_WL 8569 1.24 0.31 1.71 106 XMStockSpam_06 8509 1.92 2.34 1.70 107 TR_MSPIKEBAYES00 8500 1.13 0.03 1.70 108 XMBrknScrpt_02 8451 1.81 2.04 1.69 109 T_TooManySym_02 8358 1.29 0.54 1.67 110 TM2_M_VERY_LONG_WORD 8259 1.89 2.37 1.65 111 ANY_BOUNCE_MESSAGE 8164 1.17 0.28 1.63 112 BOUNCE_MESSAGE 8161 1.17 0.28 1.63 113 XMSubMetaI_00 8145 2.02 2.79 1.63 114 T_XMDrugObfuBody_14 7732 1.57 1.63 1.54 115 XM_ProductURIs 7660 1.45 1.30 1.53 116 RELAYCOUNTRY_CA 7452 2.98 5.92 1.49 117 IN_HORDE_ADDRESS_BOOK 7197 0.97 0.05 1.44 118 INVALID_MSGID 7194 1.10 0.43 1.44 119 HTML_FONT_FACE_BAD 7149 1.11 0.50 1.43 120 XMBdyGiftCard01 6728 1.77 2.60 1.34 121 MSGID_NOFQDN1 6570 0.98 0.34 1.31 122 XMDiploma_00 6559 1.75 2.62 1.31 123 TVD_RCVD_IP 6541 0.91 0.12 1.31 124 XM_H_Long_From02 6528 1.14 0.83 1.30 125 TO_MALFORMED 6469 0.87 0.03 1.29 126 HTML_MIME_NO_HTML_TAG 6237 2.55 5.12 1.24 127 TR_XM_SB_Phish 6204 1.21 1.17 1.24 128 XM_B_Unsub2 6153 1.43 1.84 1.23 129 TR_XM_SpammyWords2 6114 4.74 11.63 1.22 130 XMSubPhish11 6090 1.19 1.15 1.22 131 HELO_MISC_IP 5949 0.86 0.23 1.19 132 XM_DK_Undo_01 5917 2.01 3.62 1.18 133 XM_RXBody 5890 1.23 1.34 1.18 134 T_XMHurry_00 5886 1.49 2.10 1.17 135 XM_UB50 5657 2.68 5.72 1.13 136 XM_B_Phish66 5611 1.37 1.86 1.12 137 T_XMDrugObfuBody_00 5351 1.20 1.45 1.07 138 XMSubNoVowel 5260 0.92 0.65 1.05 139 XM_SPF_SoftFail 4958 1.96 3.86 0.99 140 XMBody_95 4921 0.70 0.15 0.98 141 XMBSHREFv2 4784 0.70 0.20 0.95 142 XM_Body_Dirty_Words_01 4741 0.88 0.76 0.95 143 TR_Symld_Words 4568 0.99 1.14 0.91 144 XMGappySubj_01 4375 0.61 0.08 0.87 145 DKIM_ADSP_CUSTOM_MED 4356 1.05 1.39 0.87 146 TooManyTo_002 4338 0.69 0.34 0.87 147 XM_GoogleGroups 4337 0.72 0.44 0.87 148 SHOPIFY_IMG_NOT_RCVD_SFY 4116 0.82 0.83 0.82 149 XMBody_17 3987 1.30 2.30 0.80 150 T_Symld_Words_02 3658 0.70 0.63 0.73 151 KHOP_HELO_FCRDNS 3609 1.78 3.86 0.72 152 PDS_OTHER_BAD_TLD 3591 1.10 1.84 0.72 153 XMPhish30 3553 0.75 0.83 0.71 154 PLING_QUERY 3491 0.72 0.77 0.70 155 RELAYCOUNTRY_GB 3488 1.09 1.87 0.70 156 XMHTMLBadTable_001 3360 0.64 0.58 0.67 157 XM_B_SpammyWords4 3332 1.05 1.81 0.66 158 XM_OfRef6 3296 1.66 3.63 0.66 159 XMHTML_After_End 3289 0.82 1.14 0.66 160 DIET_1 3279 0.71 0.82 0.65 161 XM_Body_Obfu01 3222 0.56 0.39 0.64 162 TR_BOTNET_NEGATE 3203 0.71 0.86 0.64 163 XMOemUri 3126 0.46 0.13 0.62 164 FORGED_GMAIL_RCVD 3072 1.37 2.85 0.61 165 XMUrgent 2971 0.48 0.25 0.59 166 LOW_PRICE 2970 0.74 1.03 0.59 167 XM_B_COPY_HTML 2945 0.65 0.78 0.59 168 TooManyTo_003 2945 0.48 0.26 0.59 169 NML_ADSP_CUSTOM_MED 2918 0.80 1.24 0.58 170 XMBody_78 2775 0.58 0.63 0.55 171 HTML_IMAGE_ONLY_20 2691 0.90 1.61 0.54 172 SUBJ_DOLLARS 2689 0.62 0.77 0.54 173 RDNS_DYNAMIC 2681 0.56 0.62 0.54 174 XMGenDplmaNmb 2600 0.72 1.13 0.52 175 XMSolicitRefs_0 2565 0.45 0.32 0.51 176 T_FILL_THIS_FORM_SHORT 2554 0.91 1.68 0.51 177 T_TooManySym_03 2486 0.37 0.12 0.50 178 HELO_NODOT 2462 0.49 0.49 0.49 179 HELO_NO_DOMAIN 2462 0.49 0.48 0.49 180 XM_B_REG_HTML 2353 0.38 0.19 0.47 181 NUMERIC_HTTP_ADDR 2345 0.61 0.90 0.47 182 XM_B_COVIDMETA 2334 0.81 1.50 0.47 183 XM_URI_RBL 2273 0.78 1.42 0.45 184 XMSubMetaSxObfu_03 2263 0.66 1.07 0.45 185 TR_MetaPhish_Combo_01 2259 0.46 0.49 0.45 186 HTTPS_HTTP_MISMATCH 2228 0.56 0.79 0.44 187 TooManyTo_004 2216 0.37 0.24 0.44 188 SpammyFromTLD_01 2195 1.34 3.10 0.44 189 XM_H_PHPMailer 2161 0.39 0.32 0.43 190 XMPhish14 2079 0.56 0.85 0.41 191 TR_LOTS_OF_MONEY2 2031 0.55 0.83 0.41 192 T_MONEY_PERCENT 2031 0.55 0.83 0.41 193 TVD_SPACE_RATIO_MINFP 2012 0.42 0.45 0.40 194 RELAYCOUNTRY_DE 2006 0.52 0.75 0.40 195 XMSexyCombo_01 1949 1.12 2.56 0.39 196 XM_Lotto 1916 0.83 1.72 0.38 197 T_OBFU_PDF_ATTACH 1822 0.26 0.07 0.36 198 TooManyTo_005 1817 0.31 0.20 0.36 199 TM2_M_A_HREF_HREF 1748 0.52 0.87 0.35 200 RELAYCOUNTRY_AT 1745 0.51 0.83 0.35 ----------------------------------------------------------------------