Email: 487302 Autolearn: 0 AvgScore: 4.27 AvgScanTime: 1.57 sec Spam: 162368 Autolearn: 0 AvgScore: 13.85 AvgScanTime: 1.66 sec Ham: 324934 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 1.53 sec Time Spent Running SA: 212.41 hours Time Spent Processing Spam: 74.72 hours Time Spent Processing Ham: 137.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154164 90.67 94.95 88.54 2 DKIM_SIGNED 137767 85.50 84.85 85.83 3 DCC_CHECK 134757 63.03 82.99 53.06 4 XM_DK_Pass 134382 84.13 82.76 84.81 5 DKIM_VALID 132250 82.83 81.45 83.52 6 XM_B_Unicode 129600 77.66 79.82 76.59 7 RELAYCOUNTRY_US 125060 83.41 77.02 86.60 8 XMListUnsubscribeExists 116995 65.40 72.06 62.07 9 XM_B_SpammyWords 110876 58.76 68.29 54.00 10 DKIM_VALID_AU 101635 65.74 62.60 67.30 11 XM_DK_Undo_02 76854 23.59 47.33 11.73 12 XM_B_Unicode3 70842 47.48 43.63 49.40 13 LOC_TINY_FONT_1 63350 35.21 39.02 33.30 14 TR_XM_DKIM_Undo 63048 18.18 38.83 7.86 15 XM_B_SpammyWords2 61665 28.83 37.98 24.25 16 BAYES_50 58464 47.66 36.01 53.49 17 HTML_FONT_LOW_CONTRAST 57867 35.22 35.64 35.00 18 RCVD_IN_MSPIKE_H2 57477 31.06 35.40 28.89 19 MIME_HTML_ONLY 54971 27.04 33.86 23.63 20 BAYES_99 54805 16.50 33.75 7.87 21 DKIM_VALID_EF 44342 30.09 27.31 31.48 22 TR_DCC_Bayes_99 43803 12.01 26.98 4.53 23 FVGT_m_MULTI_ODD 42522 26.32 26.19 26.38 24 BAYES_999 42403 13.10 26.12 6.59 25 T_KAM_HTML_FONT_INVALID 40670 20.73 25.05 18.58 26 RELAYCOUNTRY_META 38103 10.67 23.47 4.28 27 RCVD_IN_MSPIKE_WL 37327 32.22 22.99 36.83 28 XM_Body_Dirty_Words 35285 15.87 21.73 12.94 29 XMSubLong 33988 19.99 20.93 19.52 30 BOTNET 32140 8.01 19.79 2.12 31 T_TM2_M_HEADER_IN_MSG 31659 20.32 19.50 20.73 32 XM_B_Unsub 26694 12.77 16.44 10.93 33 DCC_CHECK_NEGATIVE 25487 35.70 15.70 45.70 34 XM_Multi_Part_URI 25292 16.43 15.58 16.85 35 LOTS_OF_MONEY 23484 9.95 14.46 7.69 36 RCVD_IN_MSPIKE_H3 21514 16.66 13.25 18.37 37 XM_B_SpammyWords3 20940 7.96 12.90 5.49 38 TR_XM_SpammyWords4 20781 7.79 12.80 5.28 39 RCVD_IN_BL_SPAMCOP_NET 20627 5.67 12.70 2.15 40 UNTRUSTED_Relay 20363 5.50 12.54 1.99 41 XMSexyCombo_05 19905 7.06 12.26 4.47 42 BOTNET_IPINHOSTNAME 19392 7.87 11.94 5.84 43 TR_XM_SpammyWords2 19105 4.80 11.77 1.32 44 XM_Evil_Numbers_Gen 18543 11.81 11.42 12.01 45 HTML_IMAGE_RATIO_02 17516 9.99 10.79 9.59 46 LotsOfNums_01 16302 9.90 10.04 9.83 47 MPART_ALT_DIFF 15931 6.92 9.81 5.48 48 UNPARSEABLE_RELAY 15831 10.27 9.75 10.53 49 TR_XM_UnparsRelay 15361 8.30 9.46 7.72 50 XM_UncommonTLD01 15007 5.25 9.24 3.26 51 BAYES_60 14814 9.10 9.12 9.09 52 RCVD_IN_MSPIKE_H4 14616 12.54 9.00 14.31 53 FSL_BULK_SIG 14611 6.95 9.00 5.92 54 RELAYCOUNTRY_CA 14407 3.98 8.87 1.54 55 HTML_MIME_NO_HTML_TAG 13970 3.76 8.60 1.34 56 BOTNET_NORDNS 13808 2.84 8.50 0.01 57 BAYES_80 13651 6.34 8.41 5.31 58 XM_SendGrid 13207 9.14 8.13 9.64 59 DKIM_ADSP_NXDOMAIN 12751 2.83 7.85 0.33 60 MIME_HTML_MOSTLY 12738 4.72 7.85 3.16 61 HDRS_MISSP 12207 2.75 7.52 0.37 62 HTML_SHORT_LINK_IMG_1 12063 2.48 7.43 0.01 63 HTML_IMAGE_ONLY_08 11967 2.50 7.37 0.06 64 XM_B_Phish_Phrases 11818 7.49 7.28 7.60 65 HDRS_LCASE_IMGONLY 11705 2.45 7.21 0.07 66 GOOG_STO_IMG_HTML 11682 2.40 7.19 0.00 67 RCVD_IN_RP_SAFE 10739 10.67 6.61 12.70 68 XM_H_Long_From01 10443 6.28 6.43 6.21 69 XMSubMetaSx_00 10329 4.48 6.36 3.55 70 HTML_IMAGE_RATIO_04 9638 6.24 5.94 6.39 71 TR_XM_SpammyWords5 9220 3.41 5.68 2.28 72 RCVD_IN_RP_CERTIFIED 9136 9.69 5.63 11.72 73 TooManyTo_001 8924 5.89 5.50 6.09 74 XM_UB50 8626 2.50 5.31 1.10 75 TR_LOTS_OF_MONEY3 8146 2.11 5.02 0.66 76 TR_XM_PhishingBody 8137 2.94 5.01 1.91 77 BAYES_95 8066 3.83 4.97 3.26 78 RCVD_IN_MSPIKE_BL 7744 1.67 4.77 0.12 79 TR_XM_MSPIKECOMBO 7708 1.66 4.75 0.12 80 TR_XM_DK_SendGrid 7602 5.46 4.68 5.84 81 XMStrtUSub 6939 7.04 4.27 8.42 82 XM_DIRTYINTL 6722 1.60 4.14 0.33 83 XMBdyGiftCard01 6617 2.24 4.08 1.32 84 RELAYCOUNTRY_FR 6572 1.54 4.05 0.28 85 SUBJ_ALL_CAPS 6469 2.67 3.98 2.01 86 HTML_IMAGE_RATIO_06 6344 4.32 3.91 4.53 87 RCVD_IN_RP_RNBL 6340 1.32 3.90 0.03 88 XMNumbers 6231 3.27 3.84 2.99 89 SpammyFromTLD_01 6194 1.56 3.81 0.43 90 RCVD_IN_MSPIKE_L5 6158 1.31 3.79 0.07 91 HTML_IMAGE_RATIO_08 6053 2.73 3.73 2.23 92 XM_OfRef6 6028 1.83 3.71 0.89 93 XMBody_17 6017 1.86 3.71 0.94 94 TM2_M_URI_OPT_OUT 5987 2.62 3.69 2.08 95 XMBrknScrpt_02 5700 2.11 3.51 1.41 96 T_REMOTE_IMAGE 5615 3.16 3.46 3.01 97 URIBL_SBL_A 5539 1.28 3.41 0.22 98 XM_SPF_SoftFail 5529 1.77 3.41 0.95 99 DKIM_INVALID 5517 2.67 3.40 2.31 100 TM2_M_VERY_LONG_WORD 5112 2.12 3.15 1.60 101 XMSlimDrugH 4993 1.19 3.08 0.25 102 T_XMHurry_00 4949 1.74 3.05 1.08 103 XM_B_SpammyTLD 4934 2.66 3.04 2.47 104 DIET_1 4905 1.32 3.02 0.47 105 MIME_HTML_ONLY_MULTI 4830 2.85 2.97 2.78 106 FROM_EXCESS_BASE64 4830 3.94 2.97 4.43 107 RCVD_IN_PSBL 4562 0.97 2.81 0.05 108 XMDiploma_00 4423 1.53 2.72 0.93 109 MIME_QP_LONG_LINE 4361 4.01 2.69 4.67 110 T_XMDrugObfuBody_08 4188 2.23 2.58 2.05 111 BAYES_20 4069 2.89 2.51 3.08 112 HTML_TITLE_SUBJ_DIFF 4062 0.86 2.50 0.04 113 BAYES_40 3872 3.51 2.38 4.08 114 XMSlimDrugs 3759 0.79 2.32 0.03 115 XMWghtMeta_00 3747 0.78 2.31 0.02 116 T_TooManySym_01 3718 3.93 2.29 4.74 117 SpammyFromTLD_02 3692 0.87 2.27 0.16 118 URI_HEX 3658 1.82 2.25 1.60 119 XM_DK_Undo_01 3628 1.57 2.23 1.23 120 XMSexyCombo_01 3627 0.96 2.23 0.32 121 SUBJECT_DIET 3548 0.73 2.19 0.00 122 XM_B_SpammyWords4 3503 1.24 2.16 0.77 123 XMSubMetaI_00 3459 1.85 2.13 1.71 124 T_FILL_THIS_FORM_SHORT 3434 1.17 2.11 0.70 125 FVGT_m_MULTI_ODD_EMAIL 3368 0.72 2.07 0.04 126 TR_XM_SpammyWords3 3341 0.72 2.06 0.05 127 XM_CamelCaseFrm001 3267 1.92 2.01 1.88 128 XM_UB60 3251 0.76 2.00 0.14 129 KHOP_HELO_FCRDNS 3250 1.13 2.00 0.69 130 FORGED_GMAIL_RCVD 3165 1.08 1.95 0.64 131 XMSubNoVowel 3112 0.96 1.92 0.48 132 HK_RANDOM_FROM 3061 0.70 1.89 0.10 133 TR_XM_BayesRelay 2962 0.63 1.82 0.03 134 XM_B_Phish66 2955 1.22 1.82 0.91 135 XM_UB99 2928 0.60 1.80 0.00 136 XMPhish08 2872 0.71 1.77 0.17 137 XM_OfRef7 2871 0.66 1.77 0.11 138 TR_XM_MaxBayes 2804 0.58 1.73 0.01 139 HK_RANDOM_REPLYTO 2790 0.73 1.72 0.24 140 TR_XM_RelayPhish 2694 0.60 1.66 0.07 141 BAYES_00 2661 8.52 1.64 11.96 142 RCVD_IN_IADB_LISTED 2648 3.65 1.63 4.66 143 URI_NO_WWW_BIZ_CGI 2621 0.54 1.61 0.00 144 T_XMDrugObfuBody_14 2578 1.50 1.59 1.46 145 URI_NOVOWEL 2568 2.34 1.58 2.72 146 NUMERIC_HTTP_ADDR 2560 0.93 1.58 0.60 147 XM_B_Unsub2 2534 1.18 1.56 1.00 148 XMStockSpam_06 2478 1.63 1.53 1.68 149 MAILING_LIST_MULTI 2472 1.84 1.52 1.99 150 RCVD_IN_IADB_SPF 2398 3.22 1.48 4.09 151 RELAYCOUNTRY_GB 2396 0.99 1.48 0.75 152 RCVD_IN_IADB_DK 2344 2.86 1.44 3.57 153 RCVD_IN_IADB_SENDERID 2332 2.93 1.44 3.67 154 PDS_OTHER_BAD_TLD 2323 1.11 1.43 0.96 155 DKIM_ADSP_CUSTOM_MED 2279 1.06 1.40 0.89 156 URI_TRY_3LD 2264 1.61 1.39 1.71 157 TR_XM_SB_Phish 2251 1.31 1.39 1.27 158 XMSubPhish11 2235 1.29 1.38 1.25 159 XMSubMetaSxObfu_03 2215 0.80 1.36 0.51 160 TR_Mismatch_TLD_02 2202 0.49 1.36 0.06 161 XMSexyCombo_04 2163 0.50 1.33 0.08 162 TR_Caps_n_Bayes_99 2157 0.53 1.33 0.13 163 XMClaimOffer 2145 0.50 1.32 0.09 164 URI_GOOGLE_PROXY 2131 0.53 1.31 0.14 165 TR_XM_FormFill 2089 0.46 1.29 0.04 166 NML_ADSP_CUSTOM_MED 2079 0.82 1.28 0.59 167 URIBL_BLACK 2069 0.45 1.27 0.03 168 XM_RXBody 1977 0.52 1.22 0.18 169 XM_UB999 1970 0.41 1.21 0.00 170 MONEY_FRAUD_5 1935 0.40 1.19 0.01 171 BAYES_05 1911 1.62 1.18 1.84 172 TR_XM_PHPDW 1900 0.63 1.17 0.36 173 XM_URI_RBL 1889 0.51 1.16 0.19 174 MISSING_HEADERS 1829 0.51 1.13 0.21 175 TR_XM_PHPForged 1828 0.56 1.13 0.28 176 FROM_SUSPICIOUS_NTLD 1820 0.44 1.12 0.10 177 T_XMDrugObfuBody_00 1816 0.91 1.12 0.81 178 TR_XM_FormFill2 1816 0.56 1.12 0.28 179 XM_H_PHPOS 1814 0.56 1.12 0.28 180 URI_PHP_REDIR 1803 0.37 1.11 0.00 181 XM_UB80 1801 0.39 1.11 0.04 182 REPLYTO_WITHOUT_TO_CC 1799 0.38 1.11 0.02 183 FROM_SUSPICIOUS_NTLD_FP 1781 0.43 1.10 0.09 184 TR_MetaPhish_Combo_01 1769 0.77 1.09 0.62 185 XMGenDplmaNmb 1728 0.63 1.06 0.41 186 XM_Lotto 1700 0.51 1.05 0.25 187 TR_Symld_Words 1698 1.08 1.05 1.10 188 RELAYCOUNTRY_NL 1692 0.46 1.04 0.16 189 TR_LOTS_OF_MONEY1 1641 0.34 1.01 0.01 190 MILLION_HUNDRED 1615 0.33 0.99 0.00 191 TM2_M_A_HREF_HREF 1609 0.56 0.99 0.35 192 XMSubEmpty 1606 0.42 0.99 0.14 193 TR_XM_DK_Bayes 1596 7.32 0.98 10.49 194 TR_XM_DK_Bayes1 1585 7.21 0.98 10.33 195 XM_B_COVIDMETA 1559 0.60 0.96 0.43 196 XMHTML_After_End 1535 0.69 0.95 0.56 197 HTML_IMAGE_ONLY_32 1491 0.46 0.92 0.23 198 HTML_TAG_BALANCE_BODY 1457 0.76 0.90 0.69 199 LongTLD 1449 0.36 0.89 0.10 200 TR_XM_INV_DKIM 1427 0.36 0.88 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 287697 90.67 94.95 88.54 2 RELAYCOUNTRY_US 281389 83.41 77.02 86.60 3 DKIM_SIGNED 278881 85.50 84.85 85.83 4 XM_DK_Pass 275567 84.13 82.76 84.81 5 DKIM_VALID 271378 82.83 81.45 83.52 6 XM_B_Unicode 248851 77.66 79.82 76.59 7 DKIM_VALID_AU 218693 65.74 62.60 67.30 8 XMListUnsubscribeExists 201682 65.40 72.06 62.07 9 XM_B_SpammyWords 175449 58.76 68.29 54.00 10 BAYES_50 173798 47.66 36.01 53.49 11 DCC_CHECK 172411 63.03 82.99 53.06 12 XM_B_Unicode3 160511 47.48 43.63 49.40 13 DCC_CHECK_NEGATIVE 148489 35.70 15.70 45.70 14 RCVD_IN_MSPIKE_WL 119666 32.22 22.99 36.83 15 HTML_FONT_LOW_CONTRAST 113741 35.22 35.64 35.00 16 LOC_TINY_FONT_1 108216 35.21 39.02 33.30 17 DKIM_VALID_EF 102293 30.09 27.31 31.48 18 RCVD_IN_MSPIKE_H2 93863 31.06 35.40 28.89 19 FVGT_m_MULTI_ODD 85714 26.32 26.19 26.38 20 XM_B_SpammyWords2 78800 28.83 37.98 24.25 21 MIME_HTML_ONLY 76788 27.04 33.86 23.63 22 T_TM2_M_HEADER_IN_MSG 67356 20.32 19.50 20.73 23 XMSubLong 63422 19.99 20.93 19.52 24 T_KAM_HTML_FONT_INVALID 60365 20.73 25.05 18.58 25 RCVD_IN_MSPIKE_H3 59677 16.66 13.25 18.37 26 XM_Multi_Part_URI 54754 16.43 15.58 16.85 27 XM_DKIMWhitelistDomains 49292 10.13 0.03 15.17 28 RCVD_IN_MSPIKE_H4 46505 12.54 9.00 14.31 29 XM_Body_Dirty_Words 42047 15.87 21.73 12.94 30 RCVD_IN_RP_SAFE 41252 10.67 6.61 12.70 31 XM_Evil_Numbers_Gen 39013 11.81 11.42 12.01 32 BAYES_00 38876 8.52 1.64 11.96 33 XM_DK_Undo_02 38105 23.59 47.33 11.73 34 RCVD_IN_RP_CERTIFIED 38084 9.69 5.63 11.72 35 XM_B_Unsub 35519 12.77 16.44 10.93 36 UNPARSEABLE_RELAY 34204 10.27 9.75 10.53 37 TR_XM_DK_Bayes 34094 7.32 0.98 10.49 38 TR_XM_DK_Bayes1 33568 7.21 0.98 10.33 39 LotsOfNums_01 31957 9.90 10.04 9.83 40 ALL_TRUSTED 31309 6.60 0.52 9.64 41 XM_SendGrid 31309 9.14 8.13 9.64 42 HTML_IMAGE_RATIO_02 31174 9.99 10.79 9.59 43 TR_XM_DK_Bayes2 30455 6.49 0.72 9.37 44 BAYES_60 29546 9.10 9.12 9.09 45 XMStrtUSub 27373 7.04 4.27 8.42 46 BAYES_99 25578 16.50 33.75 7.87 47 TR_XM_DKIM_Undo 25533 18.18 38.83 7.86 48 TR_XM_UnparsRelay 25091 8.30 9.46 7.72 49 LOTS_OF_MONEY 24986 9.95 14.46 7.69 50 XM_B_Phish_Phrases 24682 7.49 7.28 7.60 51 BAYES_999 21422 13.10 26.12 6.59 52 HTML_IMAGE_RATIO_04 20761 6.24 5.94 6.39 53 XM_H_Long_From01 20172 6.28 6.43 6.21 54 TooManyTo_001 19779 5.89 5.50 6.09 55 FSL_BULK_SIG 19240 6.95 9.00 5.92 56 TR_XM_DK_SendGrid 18989 5.46 4.68 5.84 57 BOTNET_IPINHOSTNAME 18976 7.87 11.94 5.84 58 XM_B_SpammyWords3 17827 7.96 12.90 5.49 59 MPART_ALT_DIFF 17798 6.92 9.81 5.48 60 BAYES_80 17248 6.34 8.41 5.31 61 TR_XM_SpammyWords4 17157 7.79 12.80 5.28 62 T_TooManySym_01 15418 3.93 2.29 4.74 63 MIME_QP_LONG_LINE 15185 4.01 2.69 4.67 64 RCVD_IN_IADB_LISTED 15153 3.65 1.63 4.66 65 IN_ZIMBRA_NJ_WHITELIST 14802 3.05 0.03 4.56 66 TR_DCC_Bayes_99 14731 12.01 26.98 4.53 67 HTML_IMAGE_RATIO_06 14725 4.32 3.91 4.53 68 XMSexyCombo_05 14509 7.06 12.26 4.47 69 FROM_EXCESS_BASE64 14392 3.94 2.97 4.43 70 RELAYCOUNTRY_META 13910 10.67 23.47 4.28 71 RCVD_IN_MSPIKE_H5 13484 3.01 0.74 4.15 72 RCVD_IN_IADB_SPF 13276 3.22 1.48 4.09 73 BAYES_40 13242 3.51 2.38 4.08 74 RCVD_IN_IADB_SENDERID 11937 2.93 1.44 3.67 75 RCVD_IN_IADB_DK 11591 2.86 1.44 3.57 76 XMSubMetaSx_00 11524 4.48 6.36 3.55 77 XM_UncommonTLD01 10595 5.25 9.24 3.26 78 BAYES_95 10585 3.83 4.97 3.26 79 MIME_HTML_MOSTLY 10253 4.72 7.85 3.16 80 BAYES_20 10015 2.89 2.51 3.08 81 T_REMOTE_IMAGE 9774 3.16 3.46 3.01 82 XMNumbers 9724 3.27 3.84 2.99 83 MIME_HTML_ONLY_MULTI 9036 2.85 2.97 2.78 84 RCVD_IN_IADB_VOUCHED 9001 2.01 0.47 2.77 85 URI_NOVOWEL 8846 2.34 1.58 2.72 86 INVALID_MSGID 8063 1.88 0.67 2.48 87 XM_B_SpammyTLD 8042 2.66 3.04 2.47 88 MSGID_NOFQDN1 7613 1.75 0.55 2.34 89 DKIM_INVALID 7503 2.67 3.40 2.31 90 T_TooManySym_02 7470 1.73 0.60 2.30 91 TR_XM_SpammyWords5 7407 3.41 5.68 2.28 92 HTML_IMAGE_RATIO_08 7256 2.73 3.73 2.23 93 RCVD_IN_BL_SPAMCOP_NET 6982 5.67 12.70 2.15 94 BOTNET 6886 8.01 19.79 2.12 95 TM2_M_URI_OPT_OUT 6773 2.62 3.69 2.08 96 T_XMDrugObfuBody_08 6676 2.23 2.58 2.05 97 SUBJ_ALL_CAPS 6518 2.67 3.98 2.01 98 MAILING_LIST_MULTI 6472 1.84 1.52 1.99 99 TO_MALFORMED 6470 1.35 0.06 1.99 100 UNTRUSTED_Relay 6452 5.50 12.54 1.99 101 TVD_RCVD_IP 6268 1.31 0.07 1.93 102 XMBody_95 6235 1.35 0.20 1.92 103 TR_XM_PhishingBody 6192 2.94 5.01 1.91 104 XM_CamelCaseFrm001 6107 1.92 2.01 1.88 105 BAYES_05 5989 1.62 1.18 1.84 106 HELO_MISC_IP 5883 1.30 0.28 1.81 107 XM_PDF 5832 1.26 0.20 1.79 108 RCVD_IN_IADB_OPTIN 5781 1.34 0.46 1.78 109 URI_TRY_3LD 5559 1.61 1.39 1.71 110 XMSubMetaI_00 5553 1.85 2.13 1.71 111 XMStockSpam_06 5453 1.63 1.53 1.68 112 USER_IN_DEF_DKIM_WL 5407 1.11 0.00 1.66 113 IN_HORDE_ADDRESS_BOOK 5279 1.10 0.05 1.62 114 TR_MSPIKEBAYES00 5248 1.08 0.02 1.62 115 TM2_M_VERY_LONG_WORD 5213 2.12 3.15 1.60 116 URI_HEX 5208 1.82 2.25 1.60 117 RELAYCOUNTRY_CA 4999 3.98 8.87 1.54 118 T_XMDrugObfuBody_14 4749 1.50 1.59 1.46 119 XMBrknScrpt_02 4591 2.11 3.51 1.41 120 XMBSHREFv2 4473 0.99 0.21 1.38 121 XM_H_Long_From02 4394 1.19 0.88 1.35 122 HTML_MIME_NO_HTML_TAG 4349 3.76 8.60 1.34 123 TR_XM_SpammyWords2 4305 4.80 11.77 1.32 124 XM_H_Trusted_IP 4304 0.88 0.00 1.32 125 XMBdyGiftCard01 4288 2.24 4.08 1.32 126 TR_XM_SB_Phish 4117 1.31 1.39 1.27 127 XMSubPhish11 4067 1.29 1.38 1.25 128 XM_DK_Undo_01 4002 1.57 2.23 1.23 129 BOUNCE_MESSAGE 3841 0.85 0.19 1.18 130 ANY_BOUNCE_MESSAGE 3841 0.85 0.19 1.18 131 TR_Symld_Words 3577 1.08 1.05 1.10 132 XM_UB50 3571 2.50 5.31 1.10 133 T_XMHurry_00 3525 1.74 3.05 1.08 134 XMGappySubj_01 3378 0.76 0.19 1.04 135 XM_B_Unsub2 3240 1.18 1.56 1.00 136 XM_GoogleGroups 3111 0.78 0.43 0.96 137 PDS_OTHER_BAD_TLD 3109 1.11 1.43 0.96 138 TooManyTo_002 3105 0.75 0.34 0.96 139 XM_SPF_SoftFail 3092 1.77 3.41 0.95 140 XMBody_17 3055 1.86 3.71 0.94 141 XMDiploma_00 3035 1.53 2.72 0.93 142 XM_B_Phish66 2972 1.22 1.82 0.91 143 XM_ProductURIs 2933 0.89 0.87 0.90 144 XM_OfRef6 2885 1.83 3.71 0.89 145 DKIM_ADSP_CUSTOM_MED 2885 1.06 1.40 0.89 146 T_XMDrugObfuBody_00 2624 0.91 1.12 0.81 147 SHOPIFY_IMG_NOT_RCVD_SFY 2586 0.72 0.57 0.80 148 HTML_FONT_FACE_BAD 2523 0.70 0.55 0.78 149 XM_B_SpammyWords4 2516 1.24 2.16 0.77 150 RELAYCOUNTRY_GB 2436 0.99 1.48 0.75 151 XMSolicitRefs_0 2376 0.61 0.36 0.73 152 RDNS_DYNAMIC 2349 0.73 0.75 0.72 153 T_TooManySym_03 2310 0.60 0.38 0.71 154 T_FILL_THIS_FORM_SHORT 2265 1.17 2.11 0.70 155 HTML_TAG_BALANCE_BODY 2256 0.76 0.90 0.69 156 KHOP_HELO_FCRDNS 2233 1.13 2.00 0.69 157 PLING_QUERY 2194 0.69 0.72 0.68 158 XMHTMLBadTable_001 2152 0.69 0.75 0.66 159 TR_LOTS_OF_MONEY3 2142 2.11 5.02 0.66 160 FORGED_GMAIL_RCVD 2086 1.08 1.95 0.64 161 TooManyTo_003 2030 0.51 0.29 0.62 162 TR_MetaPhish_Combo_01 1999 0.77 1.09 0.62 163 XMLngstWrd_00 1995 0.52 0.34 0.61 164 XM_B_COPY_HTML 1990 0.57 0.49 0.61 165 NUMERIC_HTTP_ADDR 1957 0.93 1.58 0.60 166 XMOemUri 1953 0.43 0.09 0.60 167 NML_ADSP_CUSTOM_MED 1918 0.82 1.28 0.59 168 USER_IN_WELCOMELIST 1901 0.39 0.00 0.59 169 USER_IN_WHITELIST 1901 0.39 0.00 0.59 170 SUBJ_DOLLARS 1877 0.65 0.80 0.58 171 T_HTML_TAG_BALANCE_CENTER 1838 0.63 0.76 0.57 172 XMLngstWrd_01 1829 0.48 0.32 0.56 173 TR_BOTNET_NEGATE 1829 0.65 0.83 0.56 174 XMHTML_After_End 1819 0.69 0.95 0.56 175 XM_Body_Dirty_Words_01 1818 0.55 0.52 0.56 176 HELO_NODOT 1661 0.48 0.42 0.51 177 HELO_NO_DOMAIN 1661 0.48 0.42 0.51 178 XMSubMetaSxObfu_03 1661 0.80 1.36 0.51 179 XM_B_REG_HTML 1658 0.45 0.33 0.51 180 XMSubMetaSxObfu_02 1599 0.40 0.21 0.49 181 XMLngstWrd_02 1570 0.42 0.28 0.48 182 XMSubNoVowel 1545 0.96 1.92 0.48 183 XM_Walgreens_Forge 1532 0.32 0.02 0.47 184 XM_H_PHPMailer 1531 0.45 0.41 0.47 185 TooManyTo_004 1530 0.41 0.28 0.47 186 HTTPS_HTTP_MISMATCH 1518 0.56 0.75 0.47 187 DIET_1 1515 1.32 3.02 0.47 188 XM_Body_Obfu01 1502 0.58 0.82 0.46 189 XM_BadFromFormat 1450 0.44 0.44 0.45 190 HTML_FONT_SIZE_HUGE 1450 0.50 0.61 0.45 191 T_Symld_Words_02 1444 0.41 0.34 0.44 192 SpammyFromTLD_01 1413 1.56 3.81 0.43 193 XM_B_COVIDMETA 1381 0.60 0.96 0.43 194 XMGenDplmaNmb 1341 0.63 1.06 0.41 195 XMLngstWrd_03 1310 0.35 0.24 0.40 196 BASE64_LENGTH_79_INF 1308 0.32 0.15 0.40 197 TooManyTo_005 1307 0.35 0.25 0.40 198 XMPhish30 1280 0.51 0.74 0.39 199 RELAYCOUNTRY_DE 1246 0.39 0.40 0.38 200 XM_ShortIntro_01 1245 0.37 0.34 0.38 ----------------------------------------------------------------------