Email: 639415 Autolearn: 0 AvgScore: 1.54 AvgScanTime: 2.16 sec Spam: 142920 Autolearn: 0 AvgScore: 12.29 AvgScanTime: 3.76 sec Ham: 496495 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 1.70 sec Time Spent Running SA: 383.53 hours Time Spent Processing Spam: 149.08 hours Time Spent Processing Ham: 234.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134361 89.56 94.01 88.29 2 DKIM_SIGNED 116018 73.74 81.18 71.60 3 DCC_CHECK 114570 47.22 80.16 37.73 4 RELAYCOUNTRY_US 113106 80.16 79.14 80.45 5 XM_DK_Pass 112889 72.27 78.99 70.34 6 XM_B_Unicode 107735 71.11 75.38 69.88 7 XMListUnsubscribeExists 99838 52.24 69.86 47.17 8 DKIM_VALID 95719 65.99 66.97 65.70 9 DKIM_VALID_AU 72294 49.42 50.58 49.08 10 BAYES_50 64040 50.99 44.81 52.77 11 XM_DK_Undo_02 62174 14.77 43.50 6.50 12 XM_B_Unicode3 57226 39.27 40.04 39.05 13 MIME_HTML_ONLY 52938 24.39 37.04 20.75 14 LOC_TINY_FONT_1 49823 26.12 34.86 23.60 15 HTML_FONT_LOW_CONTRAST 43007 27.88 30.09 27.25 16 BAYES_99 39935 8.97 27.94 3.51 17 DKIM_VALID_EF 38035 25.25 26.61 24.86 18 FVGT_m_MULTI_ODD 37780 22.30 26.43 21.11 19 T_KAM_HTML_FONT_INVALID 34260 18.64 23.97 17.11 20 TR_DCC_Bayes_99 33167 6.63 23.21 1.86 21 XMSubLong 33124 20.39 23.18 19.59 22 RELAYCOUNTRY_META 31782 9.31 22.24 5.59 23 BAYES_999 31040 6.96 21.72 2.71 24 BOTNET 30735 6.79 21.51 2.56 25 T_TM2_M_HEADER_IN_MSG 29231 27.56 20.45 29.60 26 XM_Body_Dirty_Words 26664 13.81 18.66 12.41 27 DCC_CHECK_NEGATIVE 24964 50.68 17.47 60.25 28 XM_Multi_Part_URI 23418 11.95 16.39 10.67 29 LOTS_OF_MONEY 22522 10.23 15.76 8.64 30 XM_UncommonTLD01 22170 6.19 15.51 3.50 31 FSL_BULK_SIG 21364 8.35 14.95 6.45 32 DKIM_INVALID 20299 7.75 14.20 5.90 33 BOTNET_IPINHOSTNAME 20290 6.48 14.20 4.26 34 UNTRUSTED_Relay 19302 4.43 13.51 1.82 35 XM_B_Phish_Phrases 19044 8.30 13.32 6.85 36 XM_B_Unsub 18920 10.27 13.24 9.41 37 XM_Evil_Numbers_Gen 16326 9.64 11.42 9.12 38 XMSexyCombo_05 15629 5.50 10.94 3.94 39 NO_DNS_FOR_FROM 15411 4.84 10.78 3.13 40 HTML_IMAGE_RATIO_02 15094 8.39 10.56 7.76 41 LotsOfNums_01 12457 8.04 8.72 7.85 42 XM_UB50 12439 2.76 8.70 1.05 43 MPART_ALT_DIFF 11870 6.70 8.31 6.24 44 KHOP_HELO_FCRDNS 11467 4.06 8.02 2.91 45 XM_B_COVIDMETA 11406 3.26 7.98 1.90 46 BAYES_80 10954 4.14 7.66 3.13 47 XMSubMetaSx_00 10466 4.07 7.32 3.14 48 XM_CamelCaseFrm001 10149 3.20 7.10 2.07 49 XM_H_Long_From01 10063 5.80 7.04 5.44 50 RCVD_IN_MSPIKE_H2 9871 11.61 6.91 12.96 51 BAYES_60 9826 5.89 6.88 5.61 52 RELAYCOUNTRY_CA 9272 2.72 6.49 1.63 53 UNPARSEABLE_RELAY 8819 6.96 6.17 7.18 54 TooManyTo_001 8089 8.31 5.66 9.07 55 URIBL_SBL_A 7667 1.32 5.36 0.16 56 HTML_IMAGE_RATIO_04 7606 5.62 5.32 5.70 57 TR_XM_COVIDMETA4 7405 1.95 5.18 1.02 58 RDNS_DYNAMIC 7293 1.39 5.10 0.32 59 TR_LOTS_OF_MONEY3 7215 1.75 5.05 0.80 60 MIME_HTML_MOSTLY 7025 2.94 4.92 2.37 61 RCVD_IN_BL_SPAMCOP_NET 6896 1.57 4.83 0.64 62 XM_SPF_SoftFail 6864 2.41 4.80 1.72 63 XM_SendGrid 6406 6.11 4.48 6.58 64 XMNumbers 6372 3.99 4.46 3.85 65 MIME_QP_LONG_LINE 6175 5.12 4.32 5.35 66 BAYES_95 6038 2.41 4.22 1.88 67 XMBody_17 5963 1.37 4.17 0.57 68 XMStrtUSub 5936 5.11 4.15 5.38 69 T_XMDrugObfuBody_08 5905 2.32 4.13 1.80 70 TR_XM_MaxBayes 5832 0.93 4.08 0.02 71 XM_DIRTYINTL 5801 1.28 4.06 0.48 72 XMHTML_After_End 5547 1.70 3.88 1.08 73 XM_B_SpammyTLD 5342 2.19 3.74 1.74 74 HTML_MIME_NO_HTML_TAG 5218 2.48 3.65 2.15 75 SpammyFromTLD_02 5097 0.93 3.57 0.18 76 SpammyFromTLD_01 4974 1.44 3.48 0.86 77 DKIM_ADSP_NXDOMAIN 4851 0.94 3.39 0.24 78 HTML_SHORT_LINK_IMG_1 4745 0.76 3.32 0.02 79 RELAYCOUNTRY_FR 4737 0.94 3.31 0.26 80 XM_OfRef6 4681 1.73 3.28 1.28 81 HTML_IMAGE_ONLY_08 4640 0.82 3.25 0.12 82 TM2_M_URI_OPT_OUT 4471 3.10 3.13 3.09 83 MIME_HTML_ONLY_MULTI 4458 4.09 3.12 4.37 84 PDS_OTHER_BAD_TLD 4418 1.09 3.09 0.52 85 BAYES_40 4361 5.43 3.05 6.12 86 RCVD_IN_MSPIKE_WL 4190 7.93 2.93 9.36 87 FROM_SUSPICIOUS_NTLD 4170 0.67 2.92 0.03 88 RCVD_IN_MSPIKE_H3 4160 7.81 2.91 9.21 89 FROM_SUSPICIOUS_NTLD_FP 4094 0.66 2.86 0.02 90 FROM_EXCESS_BASE64 4017 2.89 2.81 2.91 91 DATE_IN_PAST_06_12 3888 0.64 2.72 0.04 92 DATE_IN_PAST_03_06 3870 0.72 2.71 0.15 93 URI_HEX 3859 1.50 2.70 1.15 94 TR_XM_INV_DKIM 3852 0.68 2.70 0.10 95 XM_URI_RBL 3825 0.73 2.68 0.16 96 RCVD_IN_RP_SAFE 3722 6.81 2.60 8.02 97 XMStockSpam_06 3664 1.40 2.56 1.06 98 HTML_IMAGE_RATIO_06 3656 2.73 2.56 2.78 99 BODY_URI_ONLY 3643 0.61 2.55 0.06 100 RCVD_IN_MSPIKE_BL 3613 0.81 2.53 0.31 101 TR_XM_PhishingBody 3608 1.45 2.52 1.14 102 RCVD_IN_RP_RNBL 3580 0.59 2.50 0.04 103 T_TooManySym_01 3529 4.09 2.47 4.56 104 T_REMOTE_IMAGE 3429 3.62 2.40 3.98 105 TR_XM_PHPDW 3404 0.99 2.38 0.59 106 TR_XM_PHPForged 3375 0.98 2.36 0.58 107 TR_XM_FormFill2 3349 0.97 2.34 0.58 108 XM_H_PHPOS 3345 0.97 2.34 0.57 109 XMSexyCombo_01 3293 0.91 2.30 0.50 110 NO_FM_NAME_IP_HOSTN 3151 0.49 2.20 0.00 111 TR_Mismatch_TLD_02 3138 0.56 2.20 0.09 112 BAYES_20 3134 4.12 2.19 4.68 113 BILLION_DOLLARS 3134 0.52 2.19 0.03 114 HTML_FONT_SIZE_HUGE 3120 0.57 2.18 0.11 115 XMDiploma_00 3059 1.63 2.14 1.49 116 RCVD_IN_MSPIKE_L3 2983 0.68 2.09 0.27 117 TM2_M_VERY_LONG_WORD 2950 1.38 2.06 1.18 118 LongTLD 2949 0.60 2.06 0.18 119 URI_TRY_3LD 2929 1.33 2.05 1.12 120 SUBJ_ALL_CAPS 2895 1.67 2.03 1.57 121 URI_NOVOWEL 2877 0.77 2.01 0.41 122 HTML_IMAGE_RATIO_08 2823 2.09 1.98 2.12 123 BOTNET_NORDNS 2815 0.45 1.97 0.01 124 XM_B_Unsub2 2669 1.64 1.87 1.57 125 TR_XM_DK_SendGrid 2662 3.13 1.86 3.50 126 BAYES_00 2625 15.17 1.84 19.01 127 RCVD_IN_RP_CERTIFIED 2620 6.27 1.83 7.55 128 T_XMDrugObfuBody_14 2620 1.80 1.83 1.79 129 XMBdyGiftCard01 2533 1.12 1.77 0.93 130 T_XMHurry_00 2528 0.82 1.77 0.55 131 TR_Symld_Words 2472 1.44 1.73 1.36 132 TO_MALFORMED 2423 1.51 1.70 1.45 133 RCVD_IN_IADB_LISTED 2370 3.92 1.66 4.57 134 TR_XM_RelayPhish 2299 0.47 1.61 0.14 135 MIME_HEADER_CTYPE_ONLY 2267 0.55 1.59 0.26 136 DIET_1 2175 0.56 1.52 0.29 137 RELAYCOUNTRY_GB 2153 1.29 1.51 1.22 138 RCVD_IN_IADB_SPF 2136 3.43 1.49 3.99 139 DATE_IN_PAST_12_24 2091 0.35 1.46 0.03 140 RCVD_IN_IADB_DK 2077 3.00 1.45 3.44 141 RCVD_IN_IADB_SENDERID 2067 3.02 1.45 3.47 142 ALL_TRUSTED 2043 12.67 1.43 15.90 143 T_FILL_THIS_FORM_SHORT 2038 1.18 1.43 1.11 144 RELAYCOUNTRY_NL 2017 0.49 1.41 0.22 145 BAYES_05 2007 2.87 1.40 3.30 146 TR_XM_DK_Bayes 1999 9.88 1.40 12.33 147 MAILING_LIST_MULTI 1961 2.29 1.37 2.56 148 XMSubMetaI_00 1864 0.75 1.30 0.59 149 XMGenDplmaNmb 1861 1.04 1.30 0.97 150 RELAYCOUNTRY_DE 1822 0.67 1.27 0.50 151 XM_UB60 1805 0.36 1.26 0.10 152 XM_H_PHPMailer 1769 0.74 1.24 0.60 153 HDRS_MISSP 1720 0.31 1.20 0.05 154 XMSexyCombo_04 1706 0.39 1.19 0.15 155 XM_ProductURIs 1698 0.90 1.19 0.81 156 XMBrknScrpt_02 1695 0.90 1.19 0.82 157 XMSlimDrugH 1659 0.44 1.16 0.23 158 T_XMDrugObfuBody_00 1649 0.90 1.15 0.82 159 XM_Body_Obfu01 1642 0.51 1.15 0.33 160 XM_DK_Undo_01 1626 1.78 1.14 1.96 161 TR_MetaPhish_Combo_01 1618 0.88 1.13 0.80 162 FILL_THIS_FORM 1600 0.60 1.12 0.44 163 FILL_THIS_FORM_LONG 1570 0.47 1.10 0.29 164 URG_BIZ 1516 0.31 1.06 0.10 165 DEAR_SOMETHING 1515 0.44 1.06 0.27 166 XM_H_PHPOS_M 1511 0.40 1.06 0.21 167 HDRS_LCASE_IMGONLY 1504 0.24 1.05 0.01 168 XMMoneyMeta_00 1499 1.11 1.05 1.13 169 XM_OfRef7 1483 0.34 1.04 0.14 170 XMPhish30 1475 0.48 1.03 0.32 171 XMGppyBdWords 1443 0.32 1.01 0.12 172 XM_UB99 1434 0.23 1.00 0.01 173 HK_SCAM 1426 0.24 1.00 0.03 174 XM_RXBody 1409 0.59 0.99 0.47 175 XM_B_Phish66 1395 1.00 0.98 1.01 176 RCVD_IN_PSBL 1385 0.27 0.97 0.07 177 XM_UB80 1371 0.23 0.96 0.03 178 MPART_ALT_DIFF_COUNT 1313 0.54 0.92 0.44 179 XM_H_MailChimp 1306 0.34 0.91 0.18 180 DEAR_FRIEND 1291 0.29 0.90 0.11 181 XMPhish08 1287 0.56 0.90 0.46 182 RELAYCOUNTRY_IN 1259 0.28 0.88 0.11 183 XMSubMetaSxObfu_03 1235 0.46 0.86 0.34 184 TR_XM_COVIDMETA3 1225 0.22 0.86 0.03 185 XM_Lotto 1209 0.24 0.85 0.07 186 RELAYCOUNTRY_FI 1207 0.21 0.84 0.02 187 TR_LOTS_OF_MONEY2 1201 0.42 0.84 0.30 188 T_MONEY_PERCENT 1201 0.42 0.84 0.30 189 DKIM_ADSP_CUSTOM_MED 1196 1.18 0.84 1.28 190 TR_XM_DK_Bayes1 1187 9.04 0.83 11.40 191 URIBL_BLACK 1180 0.22 0.83 0.05 192 TR_XM_COVIDMETA1 1164 0.25 0.81 0.09 193 XM_PDF 1128 3.84 0.79 4.71 194 T_TooManySym_02 1099 1.82 0.77 2.12 195 XMWghtMeta_00 1098 0.19 0.77 0.02 196 XM_B_SEO 1094 0.27 0.77 0.13 197 XMHTMLBadTable_001 1087 0.52 0.76 0.44 198 HK_RANDOM_REPLYTO 1084 0.32 0.76 0.19 199 RELAYCOUNTRY_AT 1078 0.34 0.75 0.22 200 RELAYCOUNTRY_TR 1076 0.18 0.75 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 438331 89.56 94.01 88.29 2 RELAYCOUNTRY_US 399420 80.16 79.14 80.45 3 DKIM_SIGNED 355500 73.74 81.18 71.60 4 XM_DK_Pass 349240 72.27 78.99 70.34 5 XM_B_Unicode 346961 71.11 75.38 69.88 6 DKIM_VALID 326217 65.99 66.97 65.70 7 DCC_CHECK_NEGATIVE 299118 50.68 17.47 60.25 8 BAYES_50 261989 50.99 44.81 52.77 9 DKIM_VALID_AU 243690 49.42 50.58 49.08 10 XMListUnsubscribeExists 234205 52.24 69.86 47.17 11 XM_B_Unicode3 193866 39.27 40.04 39.05 12 DCC_CHECK 187335 47.22 80.16 37.73 13 T_TM2_M_HEADER_IN_MSG 146960 27.56 20.45 29.60 14 HTML_FONT_LOW_CONTRAST 135283 27.88 30.09 27.25 15 DKIM_VALID_EF 123412 25.25 26.61 24.86 16 LOC_TINY_FONT_1 117165 26.12 34.86 23.60 17 FVGT_m_MULTI_ODD 104801 22.30 26.43 21.11 18 MIME_HTML_ONLY 103012 24.39 37.04 20.75 19 XMSubLong 97270 20.39 23.18 19.59 20 BAYES_00 94393 15.17 1.84 19.01 21 T_KAM_HTML_FONT_INVALID 84954 18.64 23.97 17.11 22 ALL_TRUSTED 78948 12.67 1.43 15.90 23 RCVD_IN_MSPIKE_H2 64336 11.61 6.91 12.96 24 XM_Body_Dirty_Words 61621 13.81 18.66 12.41 25 TR_XM_DK_Bayes 61195 9.88 1.40 12.33 26 TR_XM_DK_Bayes1 56602 9.04 0.83 11.40 27 XM_Multi_Part_URI 52962 11.95 16.39 10.67 28 TR_XM_DK_Bayes2 49236 7.84 0.64 9.92 29 XM_B_Unsub 46717 10.27 13.24 9.41 30 RCVD_IN_MSPIKE_WL 46485 7.93 2.93 9.36 31 RCVD_IN_MSPIKE_H3 45752 7.81 2.91 9.21 32 XM_Evil_Numbers_Gen 45296 9.64 11.42 9.12 33 TooManyTo_001 45034 8.31 5.66 9.07 34 LOTS_OF_MONEY 42885 10.23 15.76 8.64 35 RCVD_IN_RP_SAFE 39837 6.81 2.60 8.02 36 LotsOfNums_01 38960 8.04 8.72 7.85 37 HTML_IMAGE_RATIO_02 38525 8.39 10.56 7.76 38 RCVD_IN_RP_CERTIFIED 37469 6.27 1.83 7.55 39 XM_DKIMWhitelistDomains 36756 5.76 0.06 7.40 40 UNPARSEABLE_RELAY 35668 6.96 6.17 7.18 41 XM_B_Phish_Phrases 34003 8.30 13.32 6.85 42 XM_SendGrid 32677 6.11 4.48 6.58 43 XM_DK_Undo_02 32256 14.77 43.50 6.50 44 FSL_BULK_SIG 32032 8.35 14.95 6.45 45 MPART_ALT_DIFF 30958 6.70 8.31 6.24 46 BAYES_40 30389 5.43 3.05 6.12 47 DKIM_INVALID 29283 7.75 14.20 5.90 48 HTML_IMAGE_RATIO_04 28308 5.62 5.32 5.70 49 BAYES_60 27861 5.89 6.88 5.61 50 RELAYCOUNTRY_META 27752 9.31 22.24 5.59 51 XM_H_Long_From01 27027 5.80 7.04 5.44 52 XMStrtUSub 26708 5.11 4.15 5.38 53 MIME_QP_LONG_LINE 26542 5.12 4.32 5.35 54 XM_PDF 23400 3.84 0.79 4.71 55 BAYES_20 23226 4.12 2.19 4.68 56 RCVD_IN_IADB_LISTED 22695 3.92 1.66 4.57 57 T_TooManySym_01 22640 4.09 2.47 4.56 58 IN_ZIMBRA_NJ_WHITELIST 22608 3.54 0.02 4.55 59 MIME_HTML_ONLY_MULTI 21680 4.09 3.12 4.37 60 BOTNET_IPINHOSTNAME 21129 6.48 14.20 4.26 61 RCVD_IN_IADB_SPF 19815 3.43 1.49 3.99 62 T_REMOTE_IMAGE 19745 3.62 2.40 3.98 63 XMSexyCombo_05 19553 5.50 10.94 3.94 64 XMNumbers 19123 3.99 4.46 3.85 65 BAYES_99 17414 8.97 27.94 3.51 66 XM_UncommonTLD01 17393 6.19 15.51 3.50 67 TR_XM_DK_SendGrid 17362 3.13 1.86 3.50 68 RCVD_IN_IADB_SENDERID 17248 3.02 1.45 3.47 69 RCVD_IN_IADB_DK 17082 3.00 1.45 3.44 70 ANY_BOUNCE_MESSAGE 16471 2.67 0.41 3.32 71 BOUNCE_MESSAGE 16466 2.67 0.41 3.32 72 BAYES_05 16365 2.87 1.40 3.30 73 XM_H_Trusted_IP 15810 2.47 0.00 3.18 74 XMSubMetaSx_00 15590 4.07 7.32 3.14 75 NO_DNS_FOR_FROM 15564 4.84 10.78 3.13 76 BAYES_80 15517 4.14 7.66 3.13 77 TM2_M_URI_OPT_OUT 15357 3.10 3.13 3.09 78 RCVD_IN_IADB_VOUCHED 14506 2.39 0.54 2.92 79 KHOP_HELO_FCRDNS 14462 4.06 8.02 2.91 80 FROM_EXCESS_BASE64 14452 2.89 2.81 2.91 81 HTML_IMAGE_RATIO_06 13789 2.73 2.56 2.78 82 BAYES_999 13436 6.96 21.72 2.71 83 BOTNET 12701 6.79 21.51 2.56 84 MAILING_LIST_MULTI 12690 2.29 1.37 2.56 85 TooManyTo_002 12406 2.08 0.63 2.50 86 HTML_FONT_FACE_BAD 11981 2.01 0.62 2.41 87 MIME_HTML_MOSTLY 11750 2.94 4.92 2.37 88 XMSubNoVowel 11242 1.91 0.66 2.26 89 HTML_MIME_NO_HTML_TAG 10657 2.48 3.65 2.15 90 HTML_IMAGE_RATIO_08 10543 2.09 1.98 2.12 91 T_TooManySym_02 10516 1.82 0.77 2.12 92 XM_CamelCaseFrm001 10283 3.20 7.10 2.07 93 TVD_RCVD_IP 10023 1.68 0.50 2.02 94 XM_DK_Undo_01 9733 1.78 1.14 1.96 95 XM_B_COVIDMETA 9419 3.26 7.98 1.90 96 BAYES_95 9340 2.41 4.22 1.88 97 RCVD_IN_IADB_OPTIN 9314 1.54 0.38 1.88 98 TR_DCC_Bayes_99 9250 6.63 23.21 1.86 99 HELO_NODOT 9138 1.57 0.62 1.84 100 HELO_NO_DOMAIN 9136 1.57 0.62 1.84 101 UNTRUSTED_Relay 9045 4.43 13.51 1.82 102 T_XMDrugObfuBody_08 8924 2.32 4.13 1.80 103 T_XMDrugObfuBody_14 8896 1.80 1.83 1.79 104 XM_B_SpammyTLD 8662 2.19 3.74 1.74 105 TooManyTo_003 8566 1.45 0.51 1.73 106 XM_SPF_SoftFail 8564 2.41 4.80 1.72 107 RELAYCOUNTRY_CA 8095 2.72 6.49 1.63 108 XM_B_Unsub2 7786 1.64 1.87 1.57 109 SUBJ_ALL_CAPS 7774 1.67 2.03 1.57 110 HELO_MISC_IP 7706 1.24 0.16 1.55 111 CK_HELO_DYNAMIC_SPLIT_IP 7700 1.24 0.16 1.55 112 INVALID_MSGID 7517 1.24 0.29 1.51 113 IN_HORDE_ADDRESS_BOOK 7413 1.17 0.04 1.49 114 XMDiploma_00 7395 1.63 2.14 1.49 115 TO_MALFORMED 7204 1.51 1.70 1.45 116 XMCapTrack 7124 1.23 0.53 1.43 117 XM_GoogleGroups 6882 1.19 0.52 1.39 118 TR_Symld_Words 6764 1.44 1.73 1.36 119 TooManyTo_004 6571 1.13 0.45 1.32 120 XM_OfRef6 6376 1.73 3.28 1.28 121 DKIM_ADSP_CUSTOM_MED 6372 1.18 0.84 1.28 122 RELAYCOUNTRY_GB 6082 1.29 1.51 1.22 123 USER_IN_DEF_DKIM_WL 6025 0.94 0.00 1.21 124 TM2_M_VERY_LONG_WORD 5851 1.38 2.06 1.18 125 URI_HEX 5718 1.50 2.70 1.15 126 TR_XM_PhishingBody 5643 1.45 2.52 1.14 127 XMMoneyMeta_00 5625 1.11 1.05 1.13 128 URI_TRY_3LD 5572 1.33 2.05 1.12 129 T_FILL_THIS_FORM_SHORT 5531 1.18 1.43 1.11 130 TooManyTo_005 5479 0.94 0.38 1.10 131 XMHTML_After_End 5345 1.70 3.88 1.08 132 XMStockSpam_06 5259 1.40 2.56 1.06 133 XM_UB50 5224 2.76 8.70 1.05 134 TR_XM_COVIDMETA4 5042 1.95 5.18 1.02 135 XM_B_Phish66 5023 1.00 0.98 1.01 136 XMGenDplmaNmb 4812 1.04 1.30 0.97 137 NML_ADSP_CUSTOM_MED 4777 0.90 0.67 0.96 138 XMBdyGiftCard01 4625 1.12 1.77 0.93 139 XM_H_Long_From02 4625 0.87 0.66 0.93 140 XMGappySubj_01 4560 0.75 0.15 0.92 141 SpammyFromTLD_01 4260 1.44 3.48 0.86 142 T_XMDrugObfuBody_00 4080 0.90 1.15 0.82 143 XMBrknScrpt_02 4059 0.90 1.19 0.82 144 TR_MSPIKEBAYES00 4046 0.63 0.00 0.81 145 XM_ProductURIs 4027 0.90 1.19 0.81 146 TR_MetaPhish_Combo_01 3984 0.88 1.13 0.80 147 TR_LOTS_OF_MONEY3 3952 1.75 5.05 0.80 148 HTTPS_HTTP_MISMATCH 3900 0.76 0.68 0.79 149 XM_ShortIntro_01 3405 0.65 0.54 0.69 150 T_TooManySym_03 3242 0.56 0.23 0.65 151 RCVD_IN_BL_SPAMCOP_NET 3167 1.57 4.83 0.64 152 HTML_IMAGE_ONLY_20 3127 0.56 0.32 0.63 153 RCVD_IN_SORBS_DUL 3103 0.51 0.10 0.62 154 XMNoVowels 3074 0.58 0.46 0.62 155 XM_E_Blogspot 3070 0.49 0.06 0.62 156 XM_SPF_Unknown 3058 0.61 0.57 0.62 157 XM_H_PHPMailer 2975 0.74 1.24 0.60 158 T_Symld_Words_02 2965 0.63 0.74 0.60 159 TR_XM_PHPDW 2937 0.99 2.38 0.59 160 XMSubMetaI_00 2924 0.75 1.30 0.59 161 TR_XM_PHPForged 2900 0.98 2.36 0.58 162 TR_XM_FormFill2 2872 0.97 2.34 0.58 163 XM_H_PHPOS 2852 0.97 2.34 0.57 164 XMBody_17 2816 1.37 4.17 0.57 165 MISSING_HEADERS 2799 0.55 0.49 0.56 166 XM_H_SpoofStaff4 2760 0.46 0.14 0.56 167 T_XMHurry_00 2740 0.82 1.77 0.55 168 T_OBFU_PDF_ATTACH 2672 0.45 0.17 0.54 169 FROM_GOV_SPOOF 2631 0.47 0.25 0.53 170 XMLngstWrd_00 2568 0.53 0.58 0.52 171 PDS_OTHER_BAD_TLD 2560 1.09 3.09 0.52 172 FORGED_GMAIL_RCVD 2509 0.55 0.69 0.51 173 XMSexyCombo_01 2495 0.91 2.30 0.50 174 RELAYCOUNTRY_DE 2468 0.67 1.27 0.50 175 TM2_M_BODY_EMPTY 2403 0.41 0.13 0.48 176 SHORT_HELO_AND_INLINE_IMAGE 2383 0.38 0.05 0.48 177 XM_DIRTYINTL 2376 1.28 4.06 0.48 178 XM_RXBody 2348 0.59 0.99 0.47 179 XMRcvdHeader_15 2304 0.36 0.00 0.46 180 XMPhish08 2280 0.56 0.90 0.46 181 FROM_GOV_DKIM_AU 2258 0.37 0.09 0.45 182 FILL_THIS_FORM 2206 0.60 1.12 0.44 183 XMHTMLBadTable_001 2206 0.52 0.76 0.44 184 MPART_ALT_DIFF_COUNT 2166 0.54 0.92 0.44 185 HTML_IMAGE_ONLY_28 2143 0.40 0.31 0.43 186 HTML_IMAGE_ONLY_32 2083 0.37 0.19 0.42 187 XMLngstWrd_01 2076 0.45 0.55 0.42 188 XMBody_95 2036 0.34 0.11 0.41 189 URI_NOVOWEL 2022 0.77 2.01 0.41 190 RELAYCOUNTRY_AU 1960 0.47 0.74 0.39 191 AC_DIV_BONANZA 1952 0.33 0.12 0.39 192 XMBSHREFv2 1940 0.38 0.33 0.39 193 T_MANY_PILL_PRICE 1928 0.30 0.00 0.39 194 XM_USANA_RCVD 1895 0.30 0.00 0.38 195 XMSUPPORT 1873 0.29 0.00 0.38 196 MSGID_FROM_MTA_HEADER 1810 0.38 0.43 0.36 197 XMDateMe_00 1794 0.40 0.53 0.36 198 USER_IN_WHITELIST 1756 0.27 0.00 0.35 199 TVD_SPACE_RATIO 1750 0.31 0.18 0.35 200 SUBJ_DOLLARS 1742 0.40 0.57 0.35 ----------------------------------------------------------------------