Email: 501558 Autolearn: 0 AvgScore: 4.03 AvgScanTime: 1.51 sec Spam: 160841 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 1.59 sec Ham: 340717 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.47 sec Time Spent Running SA: 210.20 hours Time Spent Processing Spam: 71.09 hours Time Spent Processing Ham: 139.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153901 91.44 95.69 89.43 2 DKIM_SIGNED 143217 86.80 89.04 85.74 3 XM_DK_Pass 139450 85.38 86.70 84.76 4 DKIM_VALID 137512 84.15 85.50 83.52 5 DCC_CHECK 134579 65.09 83.67 56.32 6 XM_B_Unicode 129491 78.64 80.51 77.75 7 RELAYCOUNTRY_US 124974 84.11 77.70 87.14 8 XMListUnsubscribeExists 116791 65.50 72.61 62.15 9 DKIM_VALID_AU 108849 67.81 67.67 67.87 10 XM_B_SpammyWords 108120 58.81 67.22 54.84 11 XM_DK_Undo_02 78395 23.24 48.74 11.20 12 XM_B_Unicode3 69893 48.42 43.45 50.76 13 TR_XM_DKIM_Undo 65149 18.70 40.51 8.41 14 LOC_TINY_FONT_1 64459 35.57 40.08 33.44 15 XM_B_SpammyWords2 62846 29.74 39.07 25.33 16 BAYES_50 59878 47.59 37.23 52.48 17 HTML_FONT_LOW_CONTRAST 57933 36.04 36.02 36.05 18 BAYES_99 55911 16.06 34.76 7.24 19 RCVD_IN_MSPIKE_H2 53937 30.03 33.53 28.38 20 FVGT_m_MULTI_ODD 47913 25.70 29.79 23.77 21 MIME_HTML_ONLY 47466 26.09 29.51 24.48 22 TR_DCC_Bayes_99 46189 12.32 28.72 4.59 23 DKIM_VALID_EF 44491 29.11 27.66 29.79 24 BAYES_999 44297 12.96 27.54 6.07 25 T_KAM_HTML_FONT_INVALID 40517 19.80 25.19 17.25 26 RCVD_IN_MSPIKE_WL 38577 33.06 23.98 37.35 27 XMSubLong 34272 20.33 21.31 19.87 28 RELAYCOUNTRY_META 33699 9.53 20.95 4.15 29 T_TM2_M_HEADER_IN_MSG 30658 19.33 19.06 19.46 30 XM_Body_Dirty_Words 29110 15.49 18.10 14.26 31 XM_Multi_Part_URI 25658 15.93 15.95 15.92 32 LOTS_OF_MONEY 24837 9.55 15.44 6.77 33 BOTNET 24252 6.34 15.08 2.22 34 DCC_CHECK_NEGATIVE 23655 33.51 14.71 42.38 35 UNTRUSTED_Relay 22410 5.86 13.93 2.05 36 XM_B_SpammyWords3 22306 8.79 13.87 6.39 37 RCVD_IN_MSPIKE_H3 21514 17.17 13.38 18.96 38 BOTNET_IPINHOSTNAME 21344 8.11 13.27 5.68 39 TR_XM_SpammyWords2 21296 5.36 13.24 1.63 40 FSL_BULK_SIG 19812 8.27 12.32 6.36 41 TR_XM_SpammyWords4 19806 7.29 12.31 4.91 42 XM_B_Unsub 19781 11.66 12.30 11.36 43 RCVD_IN_BL_SPAMCOP_NET 19748 5.27 12.28 1.96 44 HTML_IMAGE_RATIO_02 19276 11.68 11.98 11.54 45 XM_Evil_Numbers_Gen 17584 12.11 10.93 12.67 46 XMSexyCombo_05 17137 7.18 10.65 5.53 47 XM_UncommonTLD01 16828 5.55 10.46 3.23 48 UNPARSEABLE_RELAY 16790 10.95 10.44 11.20 49 MPART_ALT_DIFF 16707 6.92 10.39 5.28 50 TR_XM_UnparsRelay 16424 8.81 10.21 8.14 51 RCVD_IN_MSPIKE_H4 15676 13.07 9.75 14.64 52 LotsOfNums_01 15453 9.40 9.61 9.30 53 BAYES_80 14657 6.55 9.11 5.34 54 XM_SendGrid 14646 9.88 9.11 10.24 55 XM_H_Long_From01 13313 6.95 8.28 6.32 56 BAYES_60 13036 8.83 8.10 9.17 57 MIME_HTML_MOSTLY 12841 4.95 7.98 3.52 58 RELAYCOUNTRY_CA 11687 3.34 7.27 1.49 59 XMSubMetaSx_00 10906 4.55 6.78 3.50 60 XM_B_Phish_Phrases 10058 7.22 6.25 7.68 61 TR_LOTS_OF_MONEY3 10036 2.48 6.24 0.70 62 RCVD_IN_RP_SAFE 9946 11.37 6.18 13.81 63 TooManyTo_001 9901 6.23 6.16 6.26 64 HTML_IMAGE_RATIO_04 9119 6.39 5.67 6.73 65 XMBody_17 9117 2.56 5.67 1.09 66 TR_XM_PhishingBody 9025 3.48 5.61 2.48 67 TR_XM_DK_SendGrid 8782 5.94 5.46 6.17 68 XM_UB50 8741 2.48 5.43 1.08 69 XM_DK_Undo_01 8234 2.64 5.12 1.47 70 RCVD_IN_RP_CERTIFIED 8220 10.36 5.11 12.84 71 RCVD_IN_MSPIKE_BL 8117 2.00 5.05 0.56 72 TR_XM_MSPIKECOMBO 7998 1.97 4.97 0.56 73 TR_XM_SpammyWords5 7790 2.98 4.84 2.10 74 XMNumbers 7691 3.50 4.78 2.89 75 HTML_IMAGE_RATIO_08 7588 3.36 4.72 2.71 76 BAYES_95 7288 3.65 4.53 3.23 77 XM_OfRef6 7149 2.09 4.44 0.98 78 FORGED_GMAIL_RCVD 7089 1.88 4.41 0.68 79 HTML_IMAGE_RATIO_06 6839 4.00 4.25 3.88 80 XMStrtUSub 6673 6.69 4.15 7.89 81 KHOP_HELO_FCRDNS 6552 1.89 4.07 0.87 82 SUBJ_ALL_CAPS 6412 2.62 3.99 1.97 83 RCVD_IN_RP_RNBL 6369 1.29 3.96 0.03 84 XM_B_SpammyTLD 6036 3.05 3.75 2.72 85 RCVD_IN_MSPIKE_L5 5932 1.24 3.69 0.09 86 T_REMOTE_IMAGE 5882 3.08 3.66 2.81 87 RELAYCOUNTRY_FR 5753 1.30 3.58 0.22 88 SpammyFromTLD_01 5732 1.42 3.56 0.41 89 DKIM_INVALID 5705 2.64 3.55 2.22 90 TM2_M_URI_OPT_OUT 5640 2.88 3.51 2.59 91 XM_SPF_SoftFail 5486 1.75 3.41 0.96 92 URIBL_SBL_A 5472 1.17 3.40 0.12 93 GOOGLE_DOC_SUSP 5169 1.04 3.21 0.02 94 SpammyFromTLD_02 4971 1.10 3.09 0.16 95 RCVD_IN_PSBL 4963 1.31 3.09 0.47 96 MIME_HTML_ONLY_MULTI 4667 3.05 2.90 3.11 97 FROM_EXCESS_BASE64 4648 4.59 2.89 5.39 98 T_FILL_THIS_FORM_SHORT 4586 1.32 2.85 0.59 99 T_XMDrugObfuBody_08 4537 2.64 2.82 2.55 100 XMBdyGiftCard01 4507 1.95 2.80 1.55 101 T_XMHurry_00 4430 2.02 2.75 1.67 102 XMDiploma_00 4375 1.55 2.72 0.99 103 XM_DIRTYINTL 4290 1.07 2.67 0.32 104 XM_B_SpammyWords4 4255 1.40 2.65 0.80 105 TM2_M_VERY_LONG_WORD 4151 2.06 2.58 1.82 106 HTML_IMAGE_ONLY_12 4025 0.93 2.50 0.19 107 XM_CamelCaseFrm001 3970 2.05 2.47 1.85 108 XM_B_Phish66 3968 1.44 2.47 0.95 109 HTML_SHORT_LINK_IMG_1 3950 0.86 2.46 0.10 110 BODY_URI_ONLY 3932 0.85 2.44 0.09 111 MIME_QP_LONG_LINE 3848 3.74 2.39 4.37 112 XMSubMetaSxObfu_03 3806 1.50 2.37 1.09 113 BAYES_40 3752 3.58 2.33 4.16 114 URI_HEX 3746 1.57 2.33 1.21 115 TR_XM_SpammyWords3 3740 1.08 2.33 0.50 116 XMSubMetaI_00 3711 1.87 2.31 1.67 117 XMBrknScrpt_02 3651 1.62 2.27 1.31 118 T_XMDrugObfuBody_14 3524 1.77 2.19 1.56 119 T_TooManySym_01 3505 3.87 2.18 4.66 120 TR_XM_MaxBayes 3457 0.70 2.15 0.01 121 TR_Sbj_FN_Bdy 3445 0.86 2.14 0.26 122 XM_UB99 3380 0.68 2.10 0.01 123 XM_UB80 3222 0.67 2.00 0.04 124 BOTNET_NORDNS 3164 0.64 1.97 0.01 125 XM_B_Unsub2 3092 1.19 1.92 0.84 126 MAILING_LIST_MULTI 3042 1.73 1.89 1.65 127 XM_UB60 3029 0.70 1.88 0.14 128 XMSexyCombo_01 2963 0.84 1.84 0.37 129 XMSlimDrugH 2952 0.74 1.84 0.22 130 PDS_OTHER_BAD_TLD 2916 1.52 1.81 1.37 131 TVD_SPACE_RATIO_MINFP 2867 0.74 1.78 0.25 132 RCVD_IN_IADB_LISTED 2668 3.36 1.66 4.17 133 XMStockSpam_06 2659 2.02 1.65 2.19 134 XMSubNoVowel 2595 1.05 1.61 0.79 135 HTML_MIME_NO_HTML_TAG 2585 1.32 1.61 1.18 136 TR_XM_BayesRelay 2578 0.53 1.60 0.02 137 TR_Symld_Words 2575 1.56 1.60 1.54 138 BAYES_20 2553 2.58 1.59 3.04 139 URI_TRY_3LD 2481 1.24 1.54 1.10 140 TR_XM_RelayPhish 2411 0.52 1.50 0.06 141 RCVD_IN_IADB_SPF 2395 3.00 1.49 3.71 142 RELAYCOUNTRY_IN 2348 0.51 1.46 0.06 143 HK_RANDOM_REPLYTO 2344 0.59 1.46 0.17 144 RCVD_IN_IADB_DK 2326 2.71 1.45 3.30 145 RCVD_IN_IADB_SENDERID 2300 2.76 1.43 3.38 146 DEAR_BENEFICIARY 2290 0.46 1.42 0.00 147 XM_UB999 2255 0.46 1.40 0.01 148 TR_Mismatch_TLD_02 2222 0.49 1.38 0.07 149 FROM_SUSPICIOUS_NTLD 2184 0.50 1.36 0.10 150 URI_NOVOWEL 2154 1.94 1.34 2.22 151 XMPhish08 2147 0.55 1.33 0.18 152 FROM_SUSPICIOUS_NTLD_FP 2144 0.49 1.33 0.10 153 BAYES_00 2121 9.53 1.32 13.41 154 XMGenDplmaNmb 2058 0.80 1.28 0.57 155 TR_XM_PHPDW 2004 0.64 1.25 0.35 156 HTML_FONT_SIZE_LARGE 1959 0.49 1.22 0.15 157 XM_URI_RBL 1948 0.52 1.21 0.19 158 TR_XM_PHPForged 1944 0.59 1.21 0.30 159 TR_XM_FormFill2 1928 0.59 1.20 0.30 160 XM_H_PHPOS 1923 0.58 1.20 0.29 161 URIBL_BLACK 1922 0.40 1.19 0.03 162 TR_XM_FormFill 1880 0.40 1.17 0.04 163 NUMERIC_HTTP_ADDR 1862 0.69 1.16 0.47 164 DATE_IN_PAST_03_06 1856 0.56 1.15 0.28 165 URI_GOOGLE_PROXY 1850 0.44 1.15 0.11 166 DKIM_ADSP_CUSTOM_MED 1842 0.95 1.15 0.86 167 INVALID_MSGID 1810 1.91 1.13 2.28 168 TR_Caps_n_Bayes_99 1794 0.56 1.12 0.30 169 XMHTML_After_End 1751 0.77 1.09 0.61 170 XM_ProductURIs 1735 0.94 1.08 0.88 171 NML_ADSP_CUSTOM_MED 1725 0.74 1.07 0.58 172 SUBJ_DOLLARS 1699 0.64 1.06 0.45 173 LongTLD 1690 0.42 1.05 0.13 174 MONEY_FORM_SHORT 1668 0.34 1.04 0.00 175 URI_PHP_REDIR 1653 0.33 1.03 0.00 176 XM_H_Long_From02 1646 1.05 1.02 1.06 177 TR_XM_SB_Phish 1634 1.16 1.02 1.22 178 T_XMDrugObfuBody_00 1626 0.97 1.01 0.95 179 XMPhish30 1609 0.88 1.00 0.82 180 BAYES_05 1603 1.61 1.00 1.90 181 TR_BOTNET_NEGATE 1601 0.70 1.00 0.57 182 XM_OfRef7 1595 0.37 0.99 0.08 183 XMSubPhish11 1582 1.14 0.98 1.21 184 XM_B_COVIDMETA 1565 0.61 0.97 0.43 185 XM_Body_Dirty_Words_01 1560 0.75 0.97 0.64 186 XMSexyCombo_04 1520 0.40 0.95 0.14 187 TR_XM_DK_Bayes 1504 8.25 0.94 11.71 188 RELAYCOUNTRY_HK 1504 0.32 0.94 0.02 189 TR_XM_INV_DKIM 1504 0.35 0.94 0.08 190 TR_XM_DK_Bayes1 1488 8.13 0.93 11.53 191 MONEY_ATM_CARD 1459 0.29 0.91 0.00 192 HTML_IMAGE_ONLY_32 1445 0.46 0.90 0.25 193 DATE_IN_PAST_06_12 1437 0.42 0.89 0.19 194 MIME_CHARSET_FARAWAY 1424 0.35 0.89 0.10 195 TR_XM_DK_Bayes2 1412 7.56 0.88 10.71 196 RDNS_DYNAMIC 1408 0.75 0.88 0.69 197 RCVD_IN_MSPIKE_H5 1387 2.82 0.86 3.74 198 XMBody_78 1386 0.59 0.86 0.45 199 DIET_1 1377 0.54 0.86 0.40 200 XM_UB95 1367 0.28 0.85 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 304706 91.44 95.69 89.43 2 RELAYCOUNTRY_US 296900 84.11 77.70 87.14 3 DKIM_SIGNED 292118 86.80 89.04 85.74 4 XM_DK_Pass 288799 85.38 86.70 84.76 5 DKIM_VALID 284564 84.15 85.50 83.52 6 XM_B_Unicode 264913 78.64 80.51 77.75 7 DKIM_VALID_AU 231258 67.81 67.67 67.87 8 XMListUnsubscribeExists 211742 65.50 72.61 62.15 9 DCC_CHECK 191900 65.09 83.67 56.32 10 XM_B_SpammyWords 186849 58.81 67.22 54.84 11 BAYES_50 178811 47.59 37.23 52.48 12 XM_B_Unicode3 172960 48.42 43.45 50.76 13 DCC_CHECK_NEGATIVE 144395 33.51 14.71 42.38 14 RCVD_IN_MSPIKE_WL 127243 33.06 23.98 37.35 15 HTML_FONT_LOW_CONTRAST 122826 36.04 36.02 36.05 16 LOC_TINY_FONT_1 113943 35.57 40.08 33.44 17 DKIM_VALID_EF 101502 29.11 27.66 29.79 18 RCVD_IN_MSPIKE_H2 96687 30.03 33.53 28.38 19 XM_B_SpammyWords2 86308 29.74 39.07 25.33 20 MIME_HTML_ONLY 83402 26.09 29.51 24.48 21 FVGT_m_MULTI_ODD 81004 25.70 29.79 23.77 22 XMSubLong 67714 20.33 21.31 19.87 23 T_TM2_M_HEADER_IN_MSG 66314 19.33 19.06 19.46 24 RCVD_IN_MSPIKE_H3 64610 17.17 13.38 18.96 25 T_KAM_HTML_FONT_INVALID 58784 19.80 25.19 17.25 26 XM_Multi_Part_URI 54246 15.93 15.95 15.92 27 RCVD_IN_MSPIKE_H4 49876 13.07 9.75 14.64 28 XM_Body_Dirty_Words 48599 15.49 18.10 14.26 29 RCVD_IN_RP_SAFE 47070 11.37 6.18 13.81 30 XM_DKIMWhitelistDomains 47069 9.41 0.06 13.81 31 BAYES_00 45680 9.53 1.32 13.41 32 RCVD_IN_RP_CERTIFIED 43765 10.36 5.11 12.84 33 XM_Evil_Numbers_Gen 43166 12.11 10.93 12.67 34 TR_XM_DK_Bayes 39894 8.25 0.94 11.71 35 HTML_IMAGE_RATIO_02 39303 11.68 11.98 11.54 36 TR_XM_DK_Bayes1 39298 8.13 0.93 11.53 37 XM_B_Unsub 38690 11.66 12.30 11.36 38 XM_DK_Undo_02 38171 23.24 48.74 11.20 39 UNPARSEABLE_RELAY 38145 10.95 10.44 11.20 40 TR_XM_DK_Bayes2 36503 7.56 0.88 10.71 41 XM_SendGrid 34894 9.88 9.11 10.24 42 LotsOfNums_01 31697 9.40 9.61 9.30 43 ALL_TRUSTED 31475 6.48 0.64 9.24 44 BAYES_60 31243 8.83 8.10 9.17 45 TR_XM_DKIM_Undo 28661 18.70 40.51 8.41 46 TR_XM_UnparsRelay 27740 8.81 10.21 8.14 47 XMStrtUSub 26879 6.69 4.15 7.89 48 XM_B_Phish_Phrases 26160 7.22 6.25 7.68 49 BAYES_99 24660 16.06 34.76 7.24 50 LOTS_OF_MONEY 23050 9.55 15.44 6.77 51 HTML_IMAGE_RATIO_04 22922 6.39 5.67 6.73 52 XM_B_SpammyWords3 21781 8.79 13.87 6.39 53 FSL_BULK_SIG 21654 8.27 12.32 6.36 54 XM_H_Long_From01 21531 6.95 8.28 6.32 55 TooManyTo_001 21330 6.23 6.16 6.26 56 TR_XM_DK_SendGrid 21009 5.94 5.46 6.17 57 BAYES_999 20694 12.96 27.54 6.07 58 BOTNET_IPINHOSTNAME 19357 8.11 13.27 5.68 59 XMSexyCombo_05 18851 7.18 10.65 5.53 60 FROM_EXCESS_BASE64 18380 4.59 2.89 5.39 61 BAYES_80 18206 6.55 9.11 5.34 62 MPART_ALT_DIFF 17976 6.92 10.39 5.28 63 TR_XM_SpammyWords4 16746 7.29 12.31 4.91 64 IN_ZIMBRA_NJ_WHITELIST 15909 3.19 0.07 4.67 65 T_TooManySym_01 15887 3.87 2.18 4.66 66 TR_DCC_Bayes_99 15625 12.32 28.72 4.59 67 MIME_QP_LONG_LINE 14890 3.74 2.39 4.37 68 RCVD_IN_IADB_LISTED 14203 3.36 1.66 4.17 69 BAYES_40 14180 3.58 2.33 4.16 70 RELAYCOUNTRY_META 14124 9.53 20.95 4.15 71 HTML_IMAGE_RATIO_06 13204 4.00 4.25 3.88 72 RCVD_IN_MSPIKE_H5 12757 2.82 0.86 3.74 73 RCVD_IN_IADB_SPF 12655 3.00 1.49 3.71 74 MIME_HTML_MOSTLY 12006 4.95 7.98 3.52 75 XMSubMetaSx_00 11932 4.55 6.78 3.50 76 RCVD_IN_IADB_SENDERID 11533 2.76 1.43 3.38 77 RCVD_IN_IADB_DK 11250 2.71 1.45 3.30 78 XM_UncommonTLD01 11019 5.55 10.46 3.23 79 BAYES_95 11002 3.65 4.53 3.23 80 MIME_HTML_ONLY_MULTI 10607 3.05 2.90 3.11 81 BAYES_20 10373 2.58 1.59 3.04 82 XMNumbers 9860 3.50 4.78 2.89 83 T_REMOTE_IMAGE 9585 3.08 3.66 2.81 84 XM_B_SpammyTLD 9282 3.05 3.75 2.72 85 HTML_IMAGE_RATIO_08 9248 3.36 4.72 2.71 86 TM2_M_URI_OPT_OUT 8823 2.88 3.51 2.59 87 T_XMDrugObfuBody_08 8703 2.64 2.82 2.55 88 TR_XM_PhishingBody 8445 3.48 5.61 2.48 89 INVALID_MSGID 7785 1.91 1.13 2.28 90 RCVD_IN_IADB_VOUCHED 7754 1.72 0.56 2.28 91 T_TooManySym_02 7686 1.80 0.82 2.26 92 URI_NOVOWEL 7559 1.94 1.34 2.22 93 BOTNET 7556 6.34 15.08 2.22 94 DKIM_INVALID 7554 2.64 3.55 2.22 95 XMStockSpam_06 7473 2.02 1.65 2.19 96 MSGID_NOFQDN1 7398 1.74 0.84 2.17 97 TR_XM_SpammyWords5 7171 2.98 4.84 2.10 98 UNTRUSTED_Relay 6968 5.86 13.93 2.05 99 SUBJ_ALL_CAPS 6720 2.62 3.99 1.97 100 RCVD_IN_BL_SPAMCOP_NET 6677 5.27 12.28 1.96 101 XM_H_Trusted_IP 6502 1.30 0.00 1.91 102 TVD_RCVD_IP 6487 1.34 0.15 1.90 103 BAYES_05 6482 1.61 1.00 1.90 104 TO_MALFORMED 6458 1.30 0.03 1.90 105 USER_IN_DEF_DKIM_WL 6355 1.27 0.00 1.87 106 XM_CamelCaseFrm001 6301 2.05 2.47 1.85 107 TM2_M_VERY_LONG_WORD 6192 2.06 2.58 1.82 108 TR_MSPIKEBAYES00 6104 1.23 0.04 1.79 109 HELO_MISC_IP 5811 1.27 0.34 1.71 110 T_XMHurry_00 5699 2.02 2.75 1.67 111 XMSubMetaI_00 5678 1.87 2.31 1.67 112 MAILING_LIST_MULTI 5630 1.73 1.89 1.65 113 TR_XM_SpammyWords2 5565 5.36 13.24 1.63 114 IN_HORDE_ADDRESS_BOOK 5485 1.14 0.15 1.61 115 XMBody_95 5363 1.13 0.18 1.57 116 T_XMDrugObfuBody_14 5329 1.77 2.19 1.56 117 XMBdyGiftCard01 5273 1.95 2.80 1.55 118 TR_Symld_Words 5246 1.56 1.60 1.54 119 RELAYCOUNTRY_CA 5066 3.34 7.27 1.49 120 RCVD_IN_IADB_OPTIN 5032 1.16 0.50 1.48 121 XM_DK_Undo_01 4996 2.64 5.12 1.47 122 XM_PDF 4942 1.05 0.20 1.45 123 PDS_OTHER_BAD_TLD 4683 1.52 1.81 1.37 124 XM_RXBody 4632 1.17 0.78 1.36 125 XMBSHREFv2 4497 0.98 0.27 1.32 126 XMBrknScrpt_02 4457 1.62 2.27 1.31 127 ANY_BOUNCE_MESSAGE 4389 0.94 0.19 1.29 128 BOUNCE_MESSAGE 4387 0.94 0.19 1.29 129 TR_XM_SB_Phish 4173 1.16 1.02 1.22 130 XMSubPhish11 4136 1.14 0.98 1.21 131 URI_HEX 4127 1.57 2.33 1.21 132 HTML_FONT_FACE_BAD 4090 0.96 0.46 1.20 133 HTML_MIME_NO_HTML_TAG 4020 1.32 1.61 1.18 134 URI_TRY_3LD 3736 1.24 1.54 1.10 135 XMBody_17 3721 2.56 5.67 1.09 136 XMSubMetaSxObfu_03 3720 1.50 2.37 1.09 137 XM_UB50 3680 2.48 5.43 1.08 138 XM_H_Long_From02 3625 1.05 1.02 1.06 139 XMDiploma_00 3387 1.55 2.72 0.99 140 TooManyTo_002 3342 0.75 0.27 0.98 141 XM_OfRef6 3325 2.09 4.44 0.98 142 XM_SPF_SoftFail 3282 1.75 3.41 0.96 143 XM_B_Phish66 3238 1.44 2.47 0.95 144 T_XMDrugObfuBody_00 3229 0.97 1.01 0.95 145 XMGappySubj_01 3170 0.72 0.28 0.93 146 XM_ProductURIs 2988 0.94 1.08 0.88 147 XMOemUri 2958 0.62 0.09 0.87 148 KHOP_HELO_FCRDNS 2951 1.89 4.07 0.87 149 DKIM_ADSP_CUSTOM_MED 2947 0.95 1.15 0.86 150 XM_B_Unsub2 2868 1.19 1.92 0.84 151 XM_GoogleGroups 2841 0.71 0.46 0.83 152 LOW_PRICE 2828 0.81 0.78 0.83 153 XMPhish30 2781 0.88 1.00 0.82 154 XM_B_SpammyWords4 2742 1.40 2.65 0.80 155 XMSubNoVowel 2693 1.05 1.61 0.79 156 SHOPIFY_IMG_NOT_RCVD_SFY 2417 0.69 0.66 0.71 157 XM_S_SpammyWords 2396 0.62 0.46 0.70 158 TR_XM_Spammywords 2396 0.62 0.46 0.70 159 TR_LOTS_OF_MONEY3 2388 2.48 6.24 0.70 160 XMSolicitRefs_0 2360 0.58 0.33 0.69 161 RDNS_DYNAMIC 2343 0.75 0.88 0.69 162 FORGED_GMAIL_RCVD 2331 1.88 4.41 0.68 163 TooManyTo_003 2323 0.54 0.24 0.68 164 T_TooManySym_03 2312 0.51 0.14 0.68 165 XM_Body_Dirty_Words_01 2180 0.75 0.97 0.64 166 XMHTML_After_End 2087 0.77 1.09 0.61 167 TR_MetaPhish_Combo_01 2025 0.57 0.52 0.59 168 T_FILL_THIS_FORM_SHORT 2015 1.32 2.85 0.59 169 RELAYCOUNTRY_GB 2001 0.65 0.79 0.59 170 NML_ADSP_CUSTOM_MED 1972 0.74 1.07 0.58 171 XMGenDplmaNmb 1952 0.80 1.28 0.57 172 TR_BOTNET_NEGATE 1931 0.70 1.00 0.57 173 XMHTMLBadTable_001 1926 0.60 0.66 0.57 174 RCVD_IN_MSPIKE_BL 1913 2.00 5.05 0.56 175 TooManyTo_004 1910 0.45 0.22 0.56 176 TR_XM_MSPIKECOMBO 1899 1.97 4.97 0.56 177 PLING_QUERY 1880 0.54 0.53 0.55 178 XMWhlSbjSex 1807 0.38 0.07 0.53 179 XM_Body_Obfu01 1786 0.63 0.84 0.52 180 XM_B_COPY_HTML 1776 0.58 0.71 0.52 181 TR_XM_SpammyWords3 1692 1.08 2.33 0.50 182 THIS_AD 1670 0.57 0.73 0.49 183 T_HTML_TAG_BALANCE_CENTER 1652 0.44 0.34 0.48 184 XMPhish14 1625 0.54 0.69 0.48 185 NUMERIC_HTTP_ADDR 1614 0.69 1.16 0.47 186 USER_IN_WHITELIST 1604 0.32 0.00 0.47 187 USER_IN_WELCOMELIST 1604 0.32 0.00 0.47 188 TooManyTo_005 1600 0.38 0.18 0.47 189 RCVD_IN_PSBL 1598 1.31 3.09 0.47 190 HTTPS_HTTP_MISMATCH 1574 0.54 0.71 0.46 191 XMSubMetaSxObfu_02 1559 0.43 0.38 0.46 192 XMBody_78 1549 0.59 0.86 0.45 193 RCVD_IN_MSPIKE_L3 1537 0.47 0.51 0.45 194 SUBJ_DOLLARS 1522 0.64 1.06 0.45 195 HELO_NODOT 1496 0.41 0.35 0.44 196 HELO_NO_DOMAIN 1495 0.41 0.35 0.44 197 XM_B_COVIDMETA 1472 0.61 0.97 0.43 198 XM_H_PHPMailer 1460 0.45 0.48 0.43 199 HTML_IMAGE_ONLY_20 1425 0.31 0.09 0.42 200 SpammyFromTLD_01 1413 1.42 3.56 0.41 ----------------------------------------------------------------------