Email: 457224 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.33 sec Spam: 148840 Autolearn: 0 AvgScore: 13.65 AvgScanTime: 1.46 sec Ham: 308384 Autolearn: 0 AvgScore: -1.22 AvgScanTime: 1.26 sec Time Spent Running SA: 168.50 hours Time Spent Processing Spam: 60.24 hours Time Spent Processing Ham: 108.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141119 86.33 94.81 82.23 2 DKIM_SIGNED 135191 86.56 90.83 84.49 3 XM_DK_Pass 132964 85.46 89.33 83.59 4 DKIM_VALID 130705 84.05 87.82 82.23 5 RELAYCOUNTRY_US 121052 84.32 81.33 85.76 6 DCC_CHECK 118815 60.62 79.83 51.35 7 XM_B_Unicode 118798 73.08 79.82 69.82 8 XMListUnsubscribeExists 113692 61.63 76.39 54.51 9 XM_B_SpammyWords 106366 59.40 71.46 53.58 10 DKIM_VALID_AU 104138 68.07 69.97 67.15 11 XM_DK_Undo_02 80715 24.03 54.23 9.45 12 TR_XM_DKIM_Undo 67595 19.09 45.41 6.38 13 XM_B_Unicode3 65589 42.85 44.07 42.27 14 BAYES_99 62743 17.92 42.15 6.22 15 XM_B_SpammyWords2 61174 27.45 41.10 20.86 16 LOC_TINY_FONT_1 59452 32.59 39.94 29.05 17 HTML_FONT_LOW_CONTRAST 54825 31.93 36.83 29.56 18 RCVD_IN_MSPIKE_H2 50698 30.46 34.06 28.73 19 BAYES_999 50659 14.23 34.04 4.67 20 TR_DCC_Bayes_99 50435 13.48 33.89 3.64 21 BAYES_50 46709 46.82 31.38 54.28 22 DKIM_VALID_EF 45642 33.91 30.67 35.48 23 MIME_HTML_ONLY 42965 24.54 28.87 22.44 24 FVGT_m_MULTI_ODD 40350 25.02 27.11 24.01 25 T_KAM_HTML_FONT_INVALID 36039 19.30 24.21 16.92 26 RCVD_IN_MSPIKE_WL 34853 32.15 23.42 36.37 27 XM_Body_Dirty_Words 32129 15.94 21.59 13.21 28 XMSubLong 31789 20.36 21.36 19.88 29 T_TM2_M_HEADER_IN_MSG 29838 20.50 20.05 20.72 30 RELAYCOUNTRY_META 28341 9.00 19.04 4.16 31 DCC_CHECK_NEGATIVE 27816 38.04 18.69 47.38 32 TR_XM_SpammyWords2 23960 5.73 16.10 0.73 33 XM_B_SpammyWords3 21558 8.33 14.48 5.35 34 BOTNET 20924 5.94 14.06 2.02 35 LOTS_OF_MONEY 20389 8.85 13.70 6.51 36 XM_Multi_Part_URI 19831 14.45 13.32 15.00 37 RCVD_IN_MSPIKE_H3 19321 15.23 12.98 16.31 38 XM_UncommonTLD01 18266 6.61 12.27 3.88 39 TR_XM_SpammyWords4 17606 6.67 11.83 4.18 40 XMSexyCombo_05 16790 7.01 11.28 4.94 41 XM_B_Unsub 16749 10.77 11.25 10.54 42 BOTNET_IPINHOSTNAME 16655 7.47 11.19 5.68 43 HTML_IMAGE_RATIO_02 15990 9.17 10.74 8.41 44 RCVD_IN_BL_SPAMCOP_NET 14522 4.15 9.76 1.44 45 RCVD_IN_MSPIKE_H4 14330 12.25 9.63 13.52 46 UNTRUSTED_Relay 13668 4.15 9.18 1.72 47 XM_Evil_Numbers_Gen 13395 9.84 9.00 10.24 48 UNPARSEABLE_RELAY 12989 9.00 8.73 9.13 49 RELAYCOUNTRY_CA 12859 3.91 8.64 1.63 50 MPART_ALT_DIFF 12576 5.89 8.45 4.66 51 TR_XM_UnparsRelay 12563 7.57 8.44 7.15 52 TooManyTo_001 11974 6.64 8.04 5.96 53 BAYES_80 11909 7.06 8.00 6.61 54 LotsOfNums_01 11486 8.55 7.72 8.96 55 MIME_HTML_MOSTLY 10947 4.34 7.35 2.89 56 XMSubMetaSx_00 10822 4.68 7.27 3.43 57 FSL_BULK_SIG 10338 6.27 6.95 5.94 58 BAYES_60 10245 8.44 6.88 9.19 59 XM_OfRef6 10193 2.82 6.85 0.87 60 XM_SendGrid 9578 7.58 6.44 8.13 61 TR_XM_PhishingBody 9532 3.67 6.40 2.35 62 XM_B_Phish_Phrases 9353 10.30 6.28 12.23 63 URIBL_SBL_A 9057 3.18 6.09 1.77 64 XM_H_Long_From01 8821 5.40 5.93 5.15 65 RCVD_IN_RP_SAFE 8625 9.58 5.79 11.41 66 XM_B_SpammyTLD 8070 3.32 5.42 2.31 67 HTML_IMAGE_RATIO_04 7855 5.22 5.28 5.20 68 XM_DK_Undo_01 7803 2.72 5.24 1.50 69 BAYES_95 7459 3.77 5.01 3.17 70 SpammyFromTLD_01 7187 2.17 4.83 0.89 71 XMNumbers 7112 3.50 4.78 2.88 72 XMBody_17 6987 2.07 4.69 0.81 73 TR_XM_SpammyWords5 6467 2.18 4.34 1.14 74 HTML_IMAGE_RATIO_08 6366 2.80 4.28 2.09 75 RCVD_IN_RP_CERTIFIED 6129 8.41 4.12 10.48 76 XM_SPF_SoftFail 6061 2.00 4.07 1.01 77 T_REMOTE_IMAGE 6001 3.58 4.03 3.36 78 XMBdyGiftCard01 5896 2.37 3.96 1.60 79 TR_XM_DK_SendGrid 5703 4.86 3.83 5.36 80 TR_XM_MaxBayes 5645 1.26 3.79 0.03 81 TM2_M_URI_OPT_OUT 5413 2.63 3.64 2.14 82 HTML_MIME_NO_HTML_TAG 5360 2.06 3.60 1.32 83 XM_B_Phish66 5341 1.91 3.59 1.10 84 BOTNET_NORDNS 5009 1.10 3.37 0.01 85 TR_LOTS_OF_MONEY3 5007 1.35 3.36 0.38 86 XMStrtUSub 4889 9.70 3.28 12.80 87 XM_UB50 4738 1.73 3.18 1.03 88 FORGED_GMAIL_RCVD 4721 1.37 3.17 0.50 89 T_FILL_THIS_FORM_SHORT 4718 1.43 3.17 0.59 90 FROM_EXCESS_BASE64 4717 3.86 3.17 4.20 91 HTML_IMAGE_RATIO_06 4488 3.19 3.02 3.27 92 DKIM_INVALID 4486 2.51 3.01 2.26 93 BAYES_40 4448 4.20 2.99 4.78 94 XMBrknScrpt_02 4412 1.38 2.96 0.61 95 HDRS_MISSP 4344 1.13 2.92 0.26 96 URI_HEX 4153 1.98 2.79 1.59 97 XM_OfRef7 4153 0.97 2.79 0.09 98 XM_CamelCaseFrm001 4040 2.13 2.71 1.85 99 GOOGLE_DOC_SUSP 3970 0.88 2.67 0.02 100 MIME_HTML_ONLY_MULTI 3962 2.70 2.66 2.71 101 T_TooManySym_01 3907 4.41 2.62 5.27 102 DATE_IN_PAST_12_24 3874 0.87 2.60 0.03 103 RELAYCOUNTRY_FR 3855 1.04 2.59 0.29 104 SpammyFromTLD_02 3842 0.98 2.58 0.21 105 RCVD_IN_MSPIKE_BL 3737 0.93 2.51 0.17 106 TR_XM_MSPIKECOMBO 3715 0.93 2.50 0.17 107 XM_DIRTYINTL 3707 1.07 2.49 0.38 108 DKIM_ADSP_NXDOMAIN 3683 1.07 2.47 0.39 109 XMDiploma_00 3626 1.63 2.44 1.24 110 URI_TRY_3LD 3548 1.67 2.38 1.33 111 TR_XM_BayesRelay 3527 0.79 2.37 0.03 112 SUBJ_ALL_CAPS 3515 1.42 2.36 0.96 113 T_XMDrugObfuBody_14 3340 2.54 2.24 2.69 114 XM_UB99 3335 0.74 2.24 0.01 115 HTML_SHORT_LINK_IMG_1 3311 0.74 2.22 0.03 116 URIBL_DBL_ABUSE_REDIR 3291 0.73 2.21 0.01 117 HTML_IMAGE_ONLY_08 3271 0.80 2.20 0.13 118 TR_XM_FormFill 3216 0.73 2.16 0.04 119 T_XMHurry_00 3209 1.25 2.16 0.81 120 MIME_QP_LONG_LINE 3192 3.67 2.14 4.40 121 HDRS_LCASE_IMGONLY 3185 0.71 2.14 0.02 122 XMSexyCombo_01 3180 1.00 2.14 0.45 123 FILL_THIS_FORM 3172 0.81 2.13 0.17 124 SHORTENER_SHORT_IMG 3134 0.69 2.11 0.00 125 URI_NOVOWEL 3052 2.56 2.05 2.81 126 TM2_M_VERY_LONG_WORD 3012 1.60 2.02 1.39 127 TR_XM_PHPDW 2961 1.22 1.99 0.85 128 TR_XM_PHPForged 2878 1.15 1.93 0.77 129 TR_XM_FormFill2 2874 1.15 1.93 0.77 130 XM_H_PHPOS 2868 1.14 1.93 0.77 131 FILL_THIS_FORM_LONG 2861 0.66 1.92 0.05 132 PDS_OTHER_BAD_TLD 2801 1.33 1.88 1.06 133 XM_B_Unsub2 2791 1.40 1.88 1.18 134 FROM_SUSPICIOUS_NTLD 2776 0.67 1.87 0.09 135 FROM_SUSPICIOUS_NTLD_FP 2729 0.66 1.83 0.09 136 XM_B_SpammyWords4 2686 1.22 1.80 0.94 137 BAYES_20 2670 2.55 1.79 2.91 138 T_XMDrugObfuBody_08 2578 1.92 1.73 2.02 139 XMStockSpam_06 2553 1.55 1.72 1.48 140 XM_UB999 2511 0.55 1.69 0.01 141 RCVD_IN_IADB_LISTED 2475 3.74 1.66 4.75 142 RCVD_IN_RP_RNBL 2404 0.56 1.62 0.05 143 MONEY_FORM 2381 0.52 1.60 0.00 144 MONEY_FRAUD_8 2323 0.51 1.56 0.00 145 T_FILL_THIS_FORM_LOAN 2306 0.54 1.55 0.06 146 RCVD_IN_MSPIKE_L5 2261 0.56 1.52 0.09 147 XMGenDplmaNmb 2234 0.83 1.50 0.50 148 XMPhish08 2178 0.58 1.46 0.16 149 HK_RANDOM_REPLYTO 2173 0.59 1.46 0.17 150 RCVD_IN_IADB_SPF 2162 3.24 1.45 4.10 151 SUBJ_ILLEGAL_CHARS 2113 0.47 1.42 0.02 152 SUBJECT_NEEDS_ENCODING 2111 0.47 1.42 0.02 153 RCVD_IN_IADB_DK 2039 2.81 1.37 3.51 154 XMSubMetaSSx_00 2037 0.61 1.37 0.25 155 XMSubGiftCard1 2037 0.54 1.37 0.13 156 T_XMDrugObfuBody_00 2036 1.26 1.37 1.20 157 RCVD_IN_IADB_SENDERID 2033 2.90 1.37 3.64 158 HTTPS_HTTP_MISMATCH 2021 0.85 1.36 0.61 159 ADVANCE_FEE_5_NEW_FRM_MNY 2016 0.44 1.35 0.00 160 URI_GOOGLE_PROXY 2011 0.53 1.35 0.14 161 XM_B_COVIDMETA 2001 0.93 1.34 0.72 162 KHOP_HELO_FCRDNS 1997 1.08 1.34 0.95 163 RCVD_IN_PSBL 1930 0.45 1.30 0.04 164 XM_Body_Obfu01 1916 0.60 1.29 0.27 165 TR_XM_SB_Phish 1904 1.54 1.28 1.67 166 XM_URI_RBL 1904 0.55 1.28 0.20 167 MILLION_USD 1885 0.42 1.27 0.01 168 DEAR_BENEFICIARY 1872 0.41 1.26 0.00 169 TR_XM_INV_DKIM 1866 0.47 1.25 0.09 170 XMSexyCombo_04 1845 0.44 1.24 0.06 171 NUMERIC_HTTP_ADDR 1820 0.54 1.22 0.21 172 XM_ProductURIs 1819 1.18 1.22 1.15 173 XMSubPhish11 1792 1.51 1.20 1.66 174 XM_UB60 1778 0.47 1.19 0.13 175 XMBody_106 1731 0.39 1.16 0.02 176 XM_Nigeria_01 1721 0.38 1.16 0.01 177 XM_Lotto 1704 0.75 1.14 0.55 178 TR_Symld_Words 1684 1.11 1.13 1.09 179 URIBL_BLACK 1651 0.38 1.11 0.03 180 XM_UB80 1644 0.38 1.10 0.03 181 TR_XM_SpammyWords3 1558 0.40 1.05 0.08 182 BAYES_00 1548 7.84 1.04 11.12 183 XMSubMetaI_00 1536 0.84 1.03 0.75 184 MAILING_LIST_MULTI 1534 1.65 1.03 1.95 185 XMSubMetaSx_01 1527 0.45 1.03 0.18 186 TR_XM_COVIDMETA4 1519 0.48 1.02 0.21 187 RELAYCOUNTRY_NL 1506 0.44 1.01 0.17 188 URI_PHP_REDIR 1478 0.32 0.99 0.00 189 T_Symld_Words_02 1458 0.62 0.98 0.45 190 TR_XM_COVIDMETA1 1456 0.56 0.98 0.35 191 LongTLD 1452 0.38 0.98 0.09 192 URI_NO_WWW_BIZ_CGI 1416 0.31 0.95 0.00 193 HTML_FONT_SIZE_HUGE 1399 0.52 0.94 0.32 194 RDNS_DYNAMIC 1398 0.81 0.94 0.75 195 TVD_APPROVED 1355 0.31 0.91 0.01 196 T_HTML_TAG_BALANCE_CENTER 1351 0.51 0.91 0.31 197 RELAYCOUNTRY_DE 1335 0.50 0.90 0.31 198 HK_WIN 1318 0.29 0.89 0.00 199 HK_LOTTO 1315 0.29 0.88 0.00 200 TR_Mismatch_TLD_02 1306 0.33 0.88 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 264464 84.32 81.33 85.76 2 DKIM_SIGNED 260563 86.56 90.83 84.49 3 XM_DK_Pass 257785 85.46 89.33 83.59 4 HTML_MESSAGE 253594 86.33 94.81 82.23 5 DKIM_VALID 253589 84.05 87.82 82.23 6 XM_B_Unicode 215328 73.08 79.82 69.82 7 DKIM_VALID_AU 207086 68.07 69.97 67.15 8 XMListUnsubscribeExists 168090 61.63 76.39 54.51 9 BAYES_50 167380 46.82 31.38 54.28 10 XM_B_SpammyWords 165229 59.40 71.46 53.58 11 DCC_CHECK 158346 60.62 79.83 51.35 12 DCC_CHECK_NEGATIVE 146108 38.04 18.69 47.38 13 XM_B_Unicode3 130340 42.85 44.07 42.27 14 RCVD_IN_MSPIKE_WL 112164 32.15 23.42 36.37 15 DKIM_VALID_EF 109411 33.91 30.67 35.48 16 HTML_FONT_LOW_CONTRAST 91162 31.93 36.83 29.56 17 LOC_TINY_FONT_1 89576 32.59 39.94 29.05 18 RCVD_IN_MSPIKE_H2 88593 30.46 34.06 28.73 19 FVGT_m_MULTI_ODD 74038 25.02 27.11 24.01 20 MIME_HTML_ONLY 69216 24.54 28.87 22.44 21 XM_B_SpammyWords2 64343 27.45 41.10 20.86 22 T_TM2_M_HEADER_IN_MSG 63909 20.50 20.05 20.72 23 XMSubLong 61302 20.36 21.36 19.88 24 XM_DKIMWhitelistDomains 57108 12.51 0.06 18.52 25 T_KAM_HTML_FONT_INVALID 52191 19.30 24.21 16.92 26 RCVD_IN_MSPIKE_H3 50302 15.23 12.98 16.31 27 XM_Multi_Part_URI 46249 14.45 13.32 15.00 28 RCVD_IN_MSPIKE_H4 41685 12.25 9.63 13.52 29 XM_Body_Dirty_Words 40735 15.94 21.59 13.21 30 XMStrtUSub 39464 9.70 3.28 12.80 31 XM_B_Phish_Phrases 37722 10.30 6.28 12.23 32 RCVD_IN_RP_SAFE 35193 9.58 5.79 11.41 33 BAYES_00 34291 7.84 1.04 11.12 34 ALL_TRUSTED 33157 7.43 0.55 10.75 35 XM_B_Unsub 32502 10.77 11.25 10.54 36 RCVD_IN_RP_CERTIFIED 32312 8.41 4.12 10.48 37 XM_Evil_Numbers_Gen 31585 9.84 9.00 10.24 38 XM_DK_Undo_02 29139 24.03 54.23 9.45 39 TR_XM_DK_Bayes 28602 6.52 0.80 9.27 40 BAYES_60 28341 8.44 6.88 9.19 41 UNPARSEABLE_RELAY 28148 9.00 8.73 9.13 42 TR_XM_DK_Bayes1 27991 6.38 0.79 9.08 43 LotsOfNums_01 27623 8.55 7.72 8.96 44 HTML_IMAGE_RATIO_02 25938 9.17 10.74 8.41 45 XM_SendGrid 25077 7.58 6.44 8.13 46 TR_XM_DK_Bayes2 25055 5.67 0.57 8.12 47 TR_XM_UnparsRelay 22038 7.57 8.44 7.15 48 BAYES_80 20378 7.06 8.00 6.61 49 RCVD_IN_MSPIKE_H5 20177 4.68 0.81 6.54 50 LOTS_OF_MONEY 20066 8.85 13.70 6.51 51 TR_XM_DKIM_Undo 19667 19.09 45.41 6.38 52 BAYES_99 19192 17.92 42.15 6.22 53 TooManyTo_001 18391 6.64 8.04 5.96 54 FSL_BULK_SIG 18328 6.27 6.95 5.94 55 BOTNET_IPINHOSTNAME 17512 7.47 11.19 5.68 56 TR_XM_DK_SendGrid 16526 4.86 3.83 5.36 57 XM_B_SpammyWords3 16509 8.33 14.48 5.35 58 T_TooManySym_01 16254 4.41 2.62 5.27 59 HTML_IMAGE_RATIO_04 16025 5.22 5.28 5.20 60 XM_H_Long_From01 15881 5.40 5.93 5.15 61 XMSexyCombo_05 15243 7.01 11.28 4.94 62 BAYES_40 14750 4.20 2.99 4.78 63 RCVD_IN_IADB_LISTED 14637 3.74 1.66 4.75 64 BAYES_999 14404 14.23 34.04 4.67 65 MPART_ALT_DIFF 14362 5.89 8.45 4.66 66 IN_ZIMBRA_NJ_WHITELIST 14029 3.08 0.03 4.55 67 MIME_QP_LONG_LINE 13580 3.67 2.14 4.40 68 FROM_EXCESS_BASE64 12945 3.86 3.17 4.20 69 TR_XM_SpammyWords4 12892 6.67 11.83 4.18 70 RELAYCOUNTRY_META 12828 9.00 19.04 4.16 71 RCVD_IN_IADB_SPF 12656 3.24 1.45 4.10 72 XM_UncommonTLD01 11959 6.61 12.27 3.88 73 RCVD_IN_IADB_SENDERID 11224 2.90 1.37 3.64 74 TR_DCC_Bayes_99 11220 13.48 33.89 3.64 75 RCVD_IN_IADB_DK 10824 2.81 1.37 3.51 76 XMSubMetaSx_00 10586 4.68 7.27 3.43 77 T_REMOTE_IMAGE 10366 3.58 4.03 3.36 78 HTML_IMAGE_RATIO_06 10093 3.19 3.02 3.27 79 BAYES_95 9767 3.77 5.01 3.17 80 RCVD_IN_IADB_VOUCHED 9208 2.26 0.76 2.99 81 T_TooManySym_02 9025 2.22 0.75 2.93 82 BAYES_20 8977 2.55 1.79 2.91 83 MIME_HTML_MOSTLY 8919 4.34 7.35 2.89 84 XMNumbers 8894 3.50 4.78 2.88 85 URI_NOVOWEL 8652 2.56 2.05 2.81 86 MIME_HTML_ONLY_MULTI 8370 2.70 2.66 2.71 87 T_XMDrugObfuBody_14 8296 2.54 2.24 2.69 88 INVALID_MSGID 8279 1.93 0.38 2.68 89 MSGID_NOFQDN1 7645 1.69 0.05 2.48 90 TR_XM_PhishingBody 7250 3.67 6.40 2.35 91 TVD_RCVD_IP 7140 1.59 0.10 2.32 92 XM_B_SpammyTLD 7116 3.32 5.42 2.31 93 DKIM_INVALID 6974 2.51 3.01 2.26 94 TM2_M_URI_OPT_OUT 6607 2.63 3.64 2.14 95 HTML_IMAGE_RATIO_08 6456 2.80 4.28 2.09 96 TO_MALFORMED 6414 1.41 0.02 2.08 97 BOTNET 6226 5.94 14.06 2.02 98 T_XMDrugObfuBody_08 6220 1.92 1.73 2.02 99 XM_PDF 6196 1.46 0.32 2.01 100 HELO_MISC_IP 6152 1.39 0.12 1.99 101 RCVD_IN_IADB_OPTIN 6084 1.50 0.53 1.97 102 MAILING_LIST_MULTI 6025 1.65 1.03 1.95 103 XM_CamelCaseFrm001 5698 2.13 2.71 1.85 104 URIBL_SBL_A 5473 3.18 6.09 1.77 105 BAYES_05 5302 1.40 0.74 1.72 106 UNTRUSTED_Relay 5291 4.15 9.18 1.72 107 USER_IN_DEF_DKIM_WL 5277 1.16 0.03 1.71 108 BOUNCE_MESSAGE 5247 1.24 0.28 1.70 109 ANY_BOUNCE_MESSAGE 5247 1.24 0.28 1.70 110 TR_XM_SB_Phish 5149 1.54 1.28 1.67 111 XMSubPhish11 5125 1.51 1.20 1.66 112 IN_HORDE_ADDRESS_BOOK 5071 1.12 0.04 1.64 113 RELAYCOUNTRY_CA 5035 3.91 8.64 1.63 114 XMBdyGiftCard01 4944 2.37 3.96 1.60 115 URI_HEX 4914 1.98 2.79 1.59 116 XMBSHREFv2 4885 1.16 0.28 1.58 117 XM_DK_Undo_01 4636 2.72 5.24 1.50 118 XMStockSpam_06 4550 1.55 1.72 1.48 119 RCVD_IN_BL_SPAMCOP_NET 4445 4.15 9.76 1.44 120 TM2_M_VERY_LONG_WORD 4283 1.60 2.02 1.39 121 URI_TRY_3LD 4090 1.67 2.38 1.33 122 XM_H_Trusted_IP 4075 0.89 0.00 1.32 123 HTML_MIME_NO_HTML_TAG 4067 2.06 3.60 1.32 124 XMBody_95 3862 0.88 0.11 1.25 125 XMDiploma_00 3819 1.63 2.44 1.24 126 XM_RXBody 3789 0.95 0.37 1.23 127 T_XMDrugObfuBody_00 3710 1.26 1.37 1.20 128 XM_B_Unsub2 3628 1.40 1.88 1.18 129 XM_ProductURIs 3558 1.18 1.22 1.15 130 TR_XM_SpammyWords5 3514 2.18 4.34 1.14 131 TooManyTo_002 3459 0.88 0.38 1.12 132 XMGappySubj_01 3420 0.80 0.17 1.11 133 XM_B_Phish66 3382 1.91 3.59 1.10 134 TR_Symld_Words 3371 1.11 1.13 1.09 135 PDS_OTHER_BAD_TLD 3272 1.33 1.88 1.06 136 XM_H_Long_From02 3270 0.97 0.79 1.06 137 XM_UB50 3163 1.73 3.18 1.03 138 XM_SPF_SoftFail 3101 2.00 4.07 1.01 139 XM_GoogleGroups 2992 0.79 0.43 0.97 140 SUBJ_ALL_CAPS 2955 1.42 2.36 0.96 141 KHOP_HELO_FCRDNS 2935 1.08 1.34 0.95 142 XM_B_SpammyWords4 2891 1.22 1.80 0.94 143 SpammyFromTLD_01 2750 2.17 4.83 0.89 144 XM_OfRef6 2692 2.82 6.85 0.87 145 HTML_FONT_FACE_BAD 2654 0.78 0.62 0.86 146 TR_XM_PHPDW 2618 1.22 1.99 0.85 147 TR_MSPIKEBAYES00 2587 0.57 0.02 0.84 148 TooManyTo_003 2539 0.66 0.32 0.82 149 TVD_SPACE_RATIO 2508 0.56 0.05 0.81 150 DKIM_ADSP_CUSTOM_MED 2500 0.76 0.66 0.81 151 XMBody_17 2496 2.07 4.69 0.81 152 T_XMHurry_00 2488 1.25 2.16 0.81 153 TR_XM_PHPForged 2381 1.15 1.93 0.77 154 TR_XM_FormFill2 2381 1.15 1.93 0.77 155 XM_H_PHPOS 2366 1.14 1.93 0.77 156 RDNS_DYNAMIC 2326 0.81 0.94 0.75 157 XMSubMetaI_00 2303 0.84 1.03 0.75 158 XMHTMLBadTable_001 2294 0.71 0.63 0.74 159 TR_XM_SpammyWords2 2240 5.73 16.10 0.73 160 XM_B_COVIDMETA 2235 0.93 1.34 0.72 161 T_TooManySym_03 2196 0.55 0.21 0.71 162 XMHTML_After_End 2172 0.73 0.79 0.70 163 HELO_NODOT 2082 0.56 0.33 0.68 164 HELO_NO_DOMAIN 2081 0.56 0.33 0.67 165 USER_IN_WHITELIST 1993 0.44 0.00 0.65 166 USER_IN_WELCOMELIST 1993 0.44 0.00 0.65 167 TR_MetaPhish_Combo_01 1972 0.60 0.51 0.64 168 RELAYCOUNTRY_GB 1963 0.70 0.82 0.64 169 TooManyTo_004 1952 0.52 0.29 0.63 170 SUBJ_DOLLARS 1907 0.65 0.72 0.62 171 XMBrknScrpt_02 1878 1.38 2.96 0.61 172 HTTPS_HTTP_MISMATCH 1875 0.85 1.36 0.61 173 T_FILL_THIS_FORM_SHORT 1813 1.43 3.17 0.59 174 XMPhish14 1740 0.54 0.48 0.56 175 XM_B_COPY_HTML 1733 0.54 0.49 0.56 176 XM_Lotto 1706 0.75 1.14 0.55 177 TooManyTo_005 1678 0.45 0.27 0.54 178 DIET_1 1615 0.59 0.73 0.52 179 NML_ADSP_CUSTOM_MED 1595 0.51 0.51 0.52 180 XM_H_PHPMailer 1587 0.51 0.49 0.51 181 XMGenDplmaNmb 1554 0.83 1.50 0.50 182 XMSubNoVowel 1547 0.55 0.64 0.50 183 FORGED_GMAIL_RCVD 1538 1.37 3.17 0.50 184 XMSubMetaSxObfu_02 1525 0.42 0.27 0.49 185 XMCapTrack 1478 0.38 0.18 0.48 186 XMPhish30 1451 0.60 0.86 0.47 187 TR_BOTNET_NEGATE 1438 0.58 0.83 0.47 188 XMOemUri 1430 0.37 0.18 0.46 189 T_Symld_Words_02 1389 0.62 0.98 0.45 190 XMSexyCombo_01 1375 1.00 2.14 0.45 191 TM2_M_A_HREF_HREF 1278 0.50 0.68 0.41 192 SHOPIFY_IMG_NOT_RCVD_SFY 1271 0.38 0.31 0.41 193 DATE_IN_PAST_06_12 1217 0.38 0.34 0.39 194 XMBody_78 1206 0.46 0.60 0.39 195 DKIM_ADSP_NXDOMAIN 1189 1.07 2.47 0.39 196 TR_LOTS_OF_MONEY3 1186 1.35 3.36 0.38 197 XMLngstWrd_00 1168 0.37 0.36 0.38 198 XM_DIRTYINTL 1165 1.07 2.49 0.38 199 PLING_QUERY 1152 0.48 0.70 0.37 200 XM_Sams_Club_Forge 1151 0.27 0.07 0.37 ----------------------------------------------------------------------