Email: 426257 Autolearn: 0 AvgScore: 5.18 AvgScanTime: 1.40 sec Spam: 153333 Autolearn: 0 AvgScore: 15.47 AvgScanTime: 1.55 sec Ham: 272924 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.31 sec Time Spent Running SA: 165.41 hours Time Spent Processing Spam: 66.05 hours Time Spent Processing Ham: 99.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 127039 83.56 82.85 83.97 2 XM_B_Unicode 118515 75.77 77.29 74.92 3 XM_B_SpammyWords 113591 59.87 74.08 51.89 4 HTML_MESSAGE 103533 80.50 67.52 87.79 5 DKIM_SIGNED 94407 75.59 61.57 83.46 6 XM_DK_Pass 91708 74.27 59.81 82.39 7 DKIM_VALID 89868 72.81 58.61 80.79 8 DCC_CHECK 86226 49.64 56.23 45.94 9 XMListUnsubscribeExists 81552 57.85 53.19 60.46 10 BAYES_50 73701 51.86 48.07 54.00 11 DKIM_VALID_AU 69144 57.44 45.09 64.38 12 DCC_CHECK_NEGATIVE 65802 49.31 42.91 52.90 13 BOTNET 62218 15.99 40.58 2.17 14 RCVD_IN_MSPIKE_BL 55831 13.52 36.41 0.65 15 XM_DK_Undo_02 53365 19.59 34.80 11.04 16 XM_B_SpammyWords2 50837 28.08 33.15 25.24 17 RCVD_IN_RP_RNBL 50329 11.92 32.82 0.17 18 XM_Multi_Part_URI 50104 20.93 32.68 14.33 19 RCVD_IN_MSPIKE_L5 48785 11.53 31.82 0.13 20 RCVD_IN_PSBL 48569 11.41 31.68 0.02 21 LOTS_OF_MONEY 47580 17.27 31.03 9.53 22 BAYES_99 45821 15.74 29.88 7.79 23 ANY_BOUNCE_MESSAGE 44348 11.89 28.92 2.32 24 BOUNCE_MESSAGE 44347 11.89 28.92 2.32 25 XM_B_Unicode3 44228 40.05 28.84 46.34 26 XM_Lotto 44121 10.43 28.77 0.12 27 TR_XM_SpammyWords3 42954 10.34 28.01 0.41 28 HTML_FONT_LOW_CONTRAST 39918 30.71 26.03 33.33 29 LOC_TINY_FONT_1 38954 29.43 25.40 31.70 30 FVGT_m_MULTI_ODD 37872 24.66 24.70 24.63 31 BAYES_999 36569 12.73 23.85 6.48 32 TR_DCC_Bayes_99 35173 10.46 22.94 3.45 33 TR_XM_COVIDMETA4 35066 8.37 22.87 0.22 34 XM_Body_Dirty_Words 34219 17.41 22.32 14.65 35 DKIM_VALID_EF 31594 26.85 20.60 30.35 36 RCVD_IN_MSPIKE_H2 31284 24.95 20.40 27.50 37 T_TM2_M_HEADER_IN_MSG 29693 20.88 19.37 21.74 38 MIME_HTML_ONLY 27797 21.59 18.13 23.53 39 XM_B_Phish_Phrases 27774 10.74 18.11 6.60 40 RELAYCOUNTRY_META 26334 9.32 17.17 4.91 41 T_KAM_HTML_FONT_INVALID 25073 18.32 16.35 19.42 42 XMSubLong 23191 19.36 15.12 21.74 43 RCVD_IN_MSPIKE_WL 19833 24.71 12.93 31.33 44 TR_XM_SpammyWords2 18810 5.81 12.27 2.18 45 UNTRUSTED_Relay 17196 5.58 11.21 2.41 46 DATE_IN_PAST_12_24 16130 3.83 10.52 0.07 47 XM_OfRef6 16054 4.63 10.47 1.35 48 XM_B_SpammyTLD 15933 5.27 10.39 2.40 49 XM_B_COVIDMETA 15635 4.58 10.20 1.43 50 BOTNET_IPINHOSTNAME 15403 7.77 10.05 6.49 51 XM_B_SpammyWords3 15147 7.85 9.88 6.71 52 XM_UncommonTLD01 14461 5.90 9.43 3.92 53 DATE_IN_PAST_06_12 13742 3.42 8.96 0.31 54 XM_B_Unsub 12993 10.21 8.47 11.18 55 XM_OfRef7 12097 2.92 7.89 0.12 56 LotsOfNums_01 12029 8.82 7.85 9.36 57 FSL_BULK_SIG 11523 6.42 7.52 5.80 58 XMSexyCombo_05 11330 5.89 7.39 5.04 59 FILL_THIS_FORM 10993 2.73 7.17 0.23 60 T_FILL_THIS_FORM_LONG 10983 2.69 7.16 0.17 61 BAYES_80 10934 5.66 7.13 4.83 62 ADVANCE_FEE_2_NEW_FORM 10753 2.53 7.01 0.01 63 RCVD_IN_MSPIKE_H3 10442 13.67 6.81 17.52 64 HTML_IMAGE_RATIO_02 10209 8.06 6.66 8.85 65 RCVD_IN_BL_SPAMCOP_NET 9999 3.33 6.52 1.53 66 XM_Evil_Numbers_Gen 9897 8.81 6.45 10.13 67 BAYES_60 9812 7.48 6.40 8.09 68 MPART_ALT_DIFF 9603 4.83 6.26 4.03 69 RELAYCOUNTRY_CA 9138 3.37 5.96 1.92 70 RCVD_IN_MSPIKE_H4 8658 9.61 5.65 11.84 71 FORM_FRAUD 8572 2.02 5.59 0.01 72 DATE_IN_PAST_24_48 8178 1.92 5.33 0.01 73 URI_HEX 8096 2.96 5.28 1.66 74 XMBrknScrpt_02 7939 2.60 5.18 1.16 75 XMSubMetaSx_00 7492 5.10 4.89 5.22 76 UNPARSEABLE_RELAY 7457 7.58 4.86 9.11 77 MIME_HTML_MOSTLY 7425 3.21 4.84 2.30 78 TooManyTo_001 7292 5.97 4.76 6.66 79 HTML_IMAGE_RATIO_04 7278 5.62 4.75 6.12 80 XM_UB50 7076 2.35 4.61 1.08 81 TR_XM_PhishingBody 7053 4.32 4.60 4.16 82 SpammyFromTLD_01 6725 2.03 4.39 0.71 83 BAYES_95 6634 3.47 4.33 2.98 84 RCVD_IN_MSPIKE_L3 6412 1.80 4.18 0.46 85 URIBL_SBL_A 6324 1.64 4.12 0.25 86 XMBody_17 5808 1.98 3.79 0.97 87 ADVANCE_FEE_3_NEW_MONEY 5761 1.35 3.76 0.00 88 XM_H_Long_From01 5661 5.00 3.69 5.74 89 XM_SendGrid 5599 6.54 3.65 8.17 90 XM_SPF_SoftFail 5535 1.98 3.61 1.06 91 HTML_IMAGE_RATIO_06 5525 3.69 3.60 3.74 92 HTML_IMAGE_RATIO_08 4953 2.67 3.23 2.36 93 T_XMDrugObfuBody_08 4715 2.00 3.08 1.40 94 TR_LOTS_OF_MONEY3 4659 1.62 3.04 0.82 95 XMStrtUSub 4582 4.27 2.99 4.99 96 DKIM_INVALID 4539 2.77 2.96 2.67 97 TR_XM_MaxBayes 4483 1.07 2.92 0.03 98 RELAYCOUNTRY_FR 4419 1.22 2.88 0.28 99 XM_DIRTYINTL 4343 1.35 2.83 0.52 100 T_FONT_INVIS_NAKED_TO 4131 2.57 2.69 2.51 101 URI_TRY_3LD 3989 1.85 2.60 1.43 102 XM_URI_RBL 3901 1.05 2.54 0.21 103 TR_XM_MaxSPIKE 3856 0.92 2.51 0.02 104 T_REMOTE_IMAGE 3830 3.31 2.50 3.77 105 XM_UB99 3811 0.91 2.49 0.02 106 T_FILL_THIS_FORM_SHORT 3750 1.37 2.45 0.77 107 XM_B_Phish66 3689 2.30 2.41 2.25 108 DATE_IN_PAST_96_XX 3546 0.83 2.31 0.00 109 T_XMDrugObfuBody_01 3535 0.85 2.31 0.03 110 TR_XM_DK_SendGrid 3518 4.12 2.29 5.15 111 TR_XM_UnparsRelay 3440 1.25 2.24 0.70 112 XMNumbers 3388 3.30 2.21 3.91 113 BOTNET_NORDNS 3357 0.80 2.19 0.01 114 XMReplyNow 3292 0.85 2.15 0.12 115 TM2_M_URI_OPT_OUT 3251 2.79 2.12 3.17 116 SUBJ_ALL_CAPS 2985 2.01 1.95 2.05 117 XM_CamelCaseFrm001 2975 2.05 1.94 2.11 118 RCVD_IN_RP_SAFE 2969 7.64 1.94 10.84 119 MIME_HTML_ONLY_MULTI 2823 2.14 1.84 2.31 120 SpammyFromTLD_02 2798 0.78 1.82 0.19 121 XM_UB999 2611 0.62 1.70 0.01 122 T_XMHurry_00 2594 1.15 1.69 0.85 123 KHOP_HELO_FCRDNS 2577 1.14 1.68 0.83 124 BAYES_40 2462 3.17 1.61 4.04 125 XMDiploma_00 2412 1.48 1.57 1.43 126 TR_Symld_Words 2410 2.21 1.57 2.58 127 XM_B_SpammyWords4 2402 0.95 1.57 0.60 128 T_TooManySym_01 2359 4.62 1.54 6.34 129 XMSubNoVowel 2286 1.05 1.49 0.80 130 RCVD_IN_RP_CERTIFIED 2185 7.06 1.43 10.23 131 FROM_EXCESS_BASE64 2175 2.84 1.42 3.64 132 TM2_M_VERY_LONG_WORD 2141 1.36 1.40 1.34 133 TR_XM_PHPDW 2138 0.75 1.39 0.39 134 TR_XM_PHPForged 2099 0.73 1.37 0.38 135 XMSexyCombo_01 2099 1.44 1.37 1.47 136 TR_XM_FormFill2 2090 0.73 1.36 0.37 137 XM_H_PHPOS 2085 0.72 1.36 0.36 138 MIME_CHARSET_FARAWAY 2081 0.56 1.36 0.11 139 URI_PHP_REDIR 2033 0.48 1.33 0.01 140 XM_UB80 1995 0.49 1.30 0.03 141 T_XMDrugObfuBody_14 1982 1.45 1.29 1.53 142 CHARSET_FARAWAY_HEADER 1926 0.46 1.26 0.02 143 MIME_QP_LONG_LINE 1909 3.43 1.25 4.66 144 DATE_IN_PAST_03_06 1902 0.51 1.24 0.11 145 XMBdyGiftCard01 1902 1.10 1.24 1.02 146 NUMERIC_HTTP_ADDR 1900 0.82 1.24 0.58 147 HTML_MIME_NO_HTML_TAG 1867 1.49 1.22 1.64 148 XMManySubDom_06 1826 0.45 1.19 0.03 149 LH_URI_DOM_IN_PATH 1808 1.62 1.18 1.86 150 XM_UB60 1803 0.48 1.18 0.10 151 XM_SPF_Unknown 1802 0.65 1.18 0.36 152 BAYES_20 1782 2.25 1.16 2.86 153 XMSlimDrugH 1731 0.64 1.13 0.37 154 RDNS_DYNAMIC 1716 0.90 1.12 0.77 155 RELAYCOUNTRY_IN 1705 0.45 1.11 0.09 156 TR_Mismatch_TLD_02 1688 0.43 1.10 0.06 157 XMStockSpam_06 1670 1.55 1.09 1.81 158 RCVD_IN_IADB_LISTED 1669 3.59 1.09 5.00 159 TR_XM_SB_Phish 1632 1.36 1.06 1.53 160 MPART_ALT_DIFF_COUNT 1604 0.72 1.05 0.54 161 RELAYCOUNTRY_NL 1598 0.54 1.04 0.25 162 XMHTML_After_End 1590 0.83 1.04 0.71 163 MIMEOLE_DIRECT_TO_MX 1582 0.37 1.03 0.00 164 URI_NOVOWEL 1573 1.79 1.03 2.21 165 XMSubPhish11 1560 1.34 1.02 1.52 166 DIET_1 1549 0.68 1.01 0.49 167 T_PDS_OTHER_BAD_TLD 1525 0.79 0.99 0.68 168 TR_XM_INV_DKIM 1523 0.58 0.99 0.34 169 TR_Mismatch_TLD_01 1517 0.58 0.99 0.35 170 XMPhish14 1516 0.70 0.99 0.54 171 NORMAL_HTTP_TO_IP 1508 0.38 0.98 0.04 172 RELAYCOUNTRY_DE 1492 0.71 0.97 0.57 173 DOS_OE_TO_MX 1482 0.35 0.97 0.00 174 XM_B_Unsub2 1466 1.20 0.96 1.33 175 TR_XM_RelayPhish 1459 0.40 0.95 0.08 176 T_HTML_TAG_BALANCE_CENTER 1447 0.48 0.94 0.22 177 TR_XM_FormFill 1414 0.34 0.92 0.02 178 DKIM_ADSP_CUSTOM_MED 1394 1.01 0.91 1.07 179 XM_UB95 1386 0.34 0.90 0.02 180 HTML_FONT_SIZE_HUGE 1379 0.45 0.90 0.19 181 RCVD_IN_IADB_SPF 1377 3.11 0.90 4.35 182 HTML_IMAGE_ONLY_12 1358 0.41 0.89 0.14 183 FROM_SUSPICIOUS_NTLD 1331 0.34 0.87 0.04 184 TR_Caps_n_Bayes_99 1327 0.66 0.87 0.54 185 XMGenDplmaNmb 1290 0.74 0.84 0.68 186 NML_ADSP_CUSTOM_MED 1283 0.78 0.84 0.74 187 RCVD_IN_IADB_SENDERID 1278 2.77 0.83 3.86 188 RCVD_IN_IADB_DK 1270 2.68 0.83 3.72 189 TR_XM_COVIDMETA1 1245 0.67 0.81 0.60 190 FROM_SUSPICIOUS_NTLD_FP 1204 0.30 0.79 0.03 191 HK_RANDOM_REPLYTO 1202 0.39 0.78 0.17 192 IMG_ONLY_FM_DOM_INFO 1201 0.28 0.78 0.00 193 FORGED_GMAIL_RCVD 1194 0.68 0.78 0.63 194 MAILING_LIST_MULTI 1175 1.56 0.77 2.00 195 BAYES_05 1162 1.52 0.76 1.95 196 XMPhish30 1153 0.84 0.75 0.89 197 SUBJ_DOLLARS 1151 0.56 0.75 0.46 198 XM_BadFromFormat 1146 0.44 0.75 0.26 199 ALL_TRUSTED 1125 7.72 0.73 11.64 200 HDRS_MISSP 1111 0.33 0.72 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 239590 80.50 67.52 87.79 2 RELAYCOUNTRY_US 229162 83.56 82.85 83.97 3 DKIM_SIGNED 227786 75.59 61.57 83.46 4 XM_DK_Pass 224873 74.27 59.81 82.39 5 DKIM_VALID 220501 72.81 58.61 80.79 6 XM_B_Unicode 204469 75.77 77.29 74.92 7 DKIM_VALID_AU 175706 57.44 45.09 64.38 8 XMListUnsubscribeExists 165020 57.85 53.19 60.46 9 BAYES_50 147368 51.86 48.07 54.00 10 DCC_CHECK_NEGATIVE 144372 49.31 42.91 52.90 11 XM_B_SpammyWords 141628 59.87 74.08 51.89 12 XM_B_Unicode3 126468 40.05 28.84 46.34 13 DCC_CHECK 125389 49.64 56.23 45.94 14 HTML_FONT_LOW_CONTRAST 90969 30.71 26.03 33.33 15 LOC_TINY_FONT_1 86511 29.43 25.40 31.70 16 RCVD_IN_MSPIKE_WL 85514 24.71 12.93 31.33 17 DKIM_VALID_EF 82841 26.85 20.60 30.35 18 RCVD_IN_MSPIKE_H2 75051 24.95 20.40 27.50 19 XM_B_SpammyWords2 68875 28.08 33.15 25.24 20 FVGT_m_MULTI_ODD 67234 24.66 24.70 24.63 21 MIME_HTML_ONLY 64221 21.59 18.13 23.53 22 XMSubLong 59332 19.36 15.12 21.74 23 T_TM2_M_HEADER_IN_MSG 59324 20.88 19.37 21.74 24 T_KAM_HTML_FONT_INVALID 53010 18.32 16.35 19.42 25 RCVD_IN_MSPIKE_H3 47827 13.67 6.81 17.52 26 XM_Body_Dirty_Words 39973 17.41 22.32 14.65 27 XM_Multi_Part_URI 39110 20.93 32.68 14.33 28 BAYES_00 36659 8.84 0.65 13.43 29 RCVD_IN_MSPIKE_H4 32308 9.61 5.65 11.84 30 ALL_TRUSTED 31763 7.72 0.73 11.64 31 XM_DKIMWhitelistDomains 31537 7.40 0.00 11.56 32 XM_B_Unsub 30526 10.21 8.47 11.18 33 XM_DK_Undo_02 30132 19.59 34.80 11.04 34 TR_XM_DK_Bayes 29948 7.15 0.35 10.97 35 RCVD_IN_RP_SAFE 29595 7.64 1.94 10.84 36 TR_XM_DK_Bayes1 29397 7.02 0.35 10.77 37 RCVD_IN_RP_CERTIFIED 27925 7.06 1.43 10.23 38 XM_Evil_Numbers_Gen 27643 8.81 6.45 10.13 39 TR_XM_DK_Bayes2 27416 6.53 0.28 10.05 40 LOTS_OF_MONEY 26021 17.27 31.03 9.53 41 LotsOfNums_01 25547 8.82 7.85 9.36 42 UNPARSEABLE_RELAY 24852 7.58 4.86 9.11 43 HTML_IMAGE_RATIO_02 24159 8.06 6.66 8.85 44 XM_SendGrid 22299 6.54 3.65 8.17 45 BAYES_60 22070 7.48 6.40 8.09 46 BAYES_99 21259 15.74 29.88 7.79 47 XM_B_SpammyWords3 18300 7.85 9.88 6.71 48 TooManyTo_001 18176 5.97 4.76 6.66 49 XM_B_Phish_Phrases 18023 10.74 18.11 6.60 50 BOTNET_IPINHOSTNAME 17710 7.77 10.05 6.49 51 BAYES_999 17674 12.73 23.85 6.48 52 T_TooManySym_01 17314 4.62 1.54 6.34 53 HTML_IMAGE_RATIO_04 16694 5.62 4.75 6.12 54 FSL_BULK_SIG 15840 6.42 7.52 5.80 55 XM_H_Long_From01 15659 5.00 3.69 5.74 56 XMSubMetaSx_00 14250 5.10 4.89 5.22 57 IN_ZIMBRA_NJ_WHITELIST 14125 3.33 0.03 5.18 58 TR_XM_DK_SendGrid 14054 4.12 2.29 5.15 59 XMSexyCombo_05 13765 5.89 7.39 5.04 60 RCVD_IN_IADB_LISTED 13654 3.59 1.09 5.00 61 XMStrtUSub 13632 4.27 2.99 4.99 62 RELAYCOUNTRY_META 13405 9.32 17.17 4.91 63 BAYES_80 13193 5.66 7.13 4.83 64 MIME_QP_LONG_LINE 12705 3.43 1.25 4.66 65 RCVD_IN_IADB_SPF 11877 3.11 0.90 4.35 66 TR_XM_PhishingBody 11345 4.32 4.60 4.16 67 BAYES_40 11038 3.17 1.61 4.04 68 MPART_ALT_DIFF 10995 4.83 6.26 4.03 69 T_TooManySym_02 10805 2.68 0.41 3.96 70 XM_UncommonTLD01 10690 5.90 9.43 3.92 71 XMNumbers 10677 3.30 2.21 3.91 72 RCVD_IN_IADB_SENDERID 10547 2.77 0.83 3.86 73 T_REMOTE_IMAGE 10295 3.31 2.50 3.77 74 HTML_IMAGE_RATIO_06 10209 3.69 3.60 3.74 75 RCVD_IN_IADB_DK 10158 2.68 0.83 3.72 76 FROM_EXCESS_BASE64 9939 2.84 1.42 3.64 77 TR_DCC_Bayes_99 9424 10.46 22.94 3.45 78 RCVD_IN_IADB_VOUCHED 8772 2.24 0.50 3.21 79 TM2_M_URI_OPT_OUT 8654 2.79 2.12 3.17 80 BAYES_95 8138 3.47 4.33 2.98 81 BAYES_20 7804 2.25 1.16 2.86 82 INVALID_MSGID 7544 1.94 0.47 2.76 83 USER_IN_DEF_DKIM_WL 7508 1.77 0.01 2.75 84 TVD_RCVD_IP 7408 1.84 0.29 2.71 85 DKIM_INVALID 7285 2.77 2.96 2.67 86 TR_Symld_Words 7030 2.21 1.57 2.58 87 HELO_MISC_IP 6948 1.77 0.38 2.55 88 CK_HELO_DYNAMIC_SPLIT_IP 6946 1.79 0.43 2.55 89 T_FONT_INVIS_NAKED_TO 6841 2.57 2.69 2.51 90 UNTRUSTED_Relay 6580 5.58 11.21 2.41 91 XM_B_SpammyTLD 6543 5.27 10.39 2.40 92 TO_MALFORMED 6445 1.51 0.00 2.36 93 HTML_IMAGE_RATIO_08 6437 2.67 3.23 2.36 94 ANY_BOUNCE_MESSAGE 6330 11.89 28.92 2.32 95 BOUNCE_MESSAGE 6330 11.89 28.92 2.32 96 MIME_HTML_ONLY_MULTI 6307 2.14 1.84 2.31 97 MIME_HTML_MOSTLY 6266 3.21 4.84 2.30 98 XM_PDF 6192 1.56 0.31 2.27 99 XM_B_Phish66 6132 2.30 2.41 2.25 100 URI_NOVOWEL 6037 1.79 1.03 2.21 101 TR_XM_SpammyWords2 5947 5.81 12.27 2.18 102 BOTNET 5926 15.99 40.58 2.17 103 RCVD_IN_IADB_OPTIN 5871 1.51 0.37 2.15 104 XM_CamelCaseFrm001 5762 2.05 1.94 2.11 105 SUBJ_ALL_CAPS 5598 2.01 1.95 2.05 106 MAILING_LIST_MULTI 5468 1.56 0.77 2.00 107 RCVD_IN_MSPIKE_H5 5379 1.43 0.48 1.97 108 BAYES_05 5314 1.52 0.76 1.95 109 XMBSHREFv2 5298 1.29 0.13 1.94 110 RELAYCOUNTRY_CA 5245 3.37 5.96 1.92 111 LH_URI_DOM_IN_PATH 5080 1.62 1.18 1.86 112 XMStockSpam_06 4928 1.55 1.09 1.81 113 IN_HORDE_ADDRESS_BOOK 4927 1.18 0.06 1.81 114 XMGappySubj_01 4716 1.18 0.22 1.73 115 URI_HEX 4537 2.96 5.28 1.66 116 HTML_MIME_NO_HTML_TAG 4481 1.49 1.22 1.64 117 XM_DK_Undo_01 4456 1.29 0.69 1.63 118 RCVD_IN_BL_SPAMCOP_NET 4184 3.33 6.52 1.53 119 T_XMDrugObfuBody_14 4183 1.45 1.29 1.53 120 TR_XM_SB_Phish 4174 1.36 1.06 1.53 121 XMSubPhish11 4136 1.34 1.02 1.52 122 XMSexyCombo_01 4018 1.44 1.37 1.47 123 XM_B_COVIDMETA 3907 4.58 10.20 1.43 124 TooManyTo_002 3906 1.07 0.43 1.43 125 URI_TRY_3LD 3901 1.85 2.60 1.43 126 XMDiploma_00 3900 1.48 1.57 1.43 127 T_TooManySym_03 3839 0.94 0.10 1.41 128 T_XMDrugObfuBody_08 3829 2.00 3.08 1.40 129 XM_OfRef6 3676 4.63 10.47 1.35 130 TM2_M_VERY_LONG_WORD 3663 1.36 1.40 1.34 131 XM_B_Unsub2 3633 1.20 0.96 1.33 132 XM_H_Long_From02 3375 0.99 0.55 1.24 133 XM_ProductURIs 3339 1.03 0.68 1.22 134 XMBrknScrpt_02 3156 2.60 5.18 1.16 135 XM_GoogleGroups 3068 0.81 0.26 1.12 136 XM_UB50 2946 2.35 4.61 1.08 137 DKIM_ADSP_CUSTOM_MED 2918 1.01 0.91 1.07 138 XM_SPF_SoftFail 2892 1.98 3.61 1.06 139 TooManyTo_003 2859 0.78 0.29 1.05 140 XMSubMetaSxObfu_03 2853 0.80 0.37 1.05 141 TR_MSPIKEBAYES00 2832 0.67 0.00 1.04 142 XMBody_95 2813 0.67 0.03 1.03 143 XMBdyGiftCard01 2792 1.10 1.24 1.02 144 XMBody_17 2643 1.98 3.79 0.97 145 XMPhish30 2419 0.84 0.75 0.89 146 DKIM_ADSP_NXDOMAIN 2402 0.75 0.52 0.88 147 T_TooManySym_04 2383 0.56 0.01 0.87 148 XMHTMLBadTable_001 2362 0.70 0.39 0.87 149 T_XMHurry_00 2309 1.15 1.69 0.85 150 T_XMDrugObfuBody_00 2269 0.79 0.71 0.83 151 KHOP_HELO_FCRDNS 2269 1.14 1.68 0.83 152 XM_S_SubURI 2262 0.55 0.06 0.83 153 XMSexyCombo_04 2260 0.70 0.48 0.83 154 TR_LOTS_OF_MONEY3 2248 1.62 3.04 0.82 155 NO_DNS_FOR_FROM 2233 0.74 0.60 0.82 156 USER_IN_WHITELIST 2214 0.52 0.00 0.81 157 USER_IN_WELCOMELIST 2214 0.52 0.00 0.81 158 XMSubMetaSx_01 2206 0.62 0.28 0.81 159 TooManyTo_004 2205 0.61 0.27 0.81 160 XMSubNoVowel 2182 1.05 1.49 0.80 161 RDNS_DYNAMIC 2103 0.90 1.12 0.77 162 T_FILL_THIS_FORM_SHORT 2096 1.37 2.45 0.77 163 XMSexyCombo_02 2065 0.53 0.12 0.76 164 XM_H_Trusted_IP 2044 0.48 0.00 0.75 165 NML_ADSP_CUSTOM_MED 2024 0.78 0.84 0.74 166 TR_MetaPhish_Combo_01 2010 0.66 0.53 0.74 167 HTML_TAG_BALANCE_BODY 2008 0.59 0.32 0.74 168 XM_D_tchamptons_WL 1999 0.47 0.00 0.73 169 XMHTML_After_End 1940 0.83 1.04 0.71 170 SpammyFromTLD_01 1928 2.03 4.39 0.71 171 TR_XM_UnparsRelay 1906 1.25 2.24 0.70 172 T_TooManySym_05 1893 0.44 0.00 0.69 173 XMSubMetaI_00 1877 0.60 0.44 0.69 174 XMGenDplmaNmb 1869 0.74 0.84 0.68 175 T_PDS_OTHER_BAD_TLD 1855 0.79 0.99 0.68 176 XM_RXBody 1829 0.57 0.38 0.67 177 RCVD_IN_MSPIKE_BL 1779 13.52 36.41 0.65 178 XM_B_REG_HTML 1757 0.52 0.29 0.64 179 PLING_QUERY 1751 0.60 0.53 0.64 180 RELAYCOUNTRY_GB 1727 0.57 0.47 0.63 181 XM_ShortIntro_01 1712 0.59 0.52 0.63 182 FORGED_GMAIL_RCVD 1707 0.68 0.78 0.63 183 XMSubMetaSxObfu_02 1670 0.50 0.31 0.61 184 HELO_NODOT 1655 0.62 0.65 0.61 185 HELO_NO_DOMAIN 1654 0.62 0.65 0.61 186 HTML_FONT_FACE_BAD 1652 0.61 0.62 0.61 187 TooManyTo_005 1651 0.47 0.23 0.60 188 XM_B_SpammyWords4 1642 0.95 1.57 0.60 189 TR_XM_COVIDMETA1 1630 0.67 0.81 0.60 190 TVD_SPACE_RATIO 1605 0.45 0.19 0.59 191 NUMERIC_HTTP_ADDR 1574 0.82 1.24 0.58 192 XMLngstWrd_00 1556 0.51 0.40 0.57 193 RELAYCOUNTRY_DE 1545 0.71 0.97 0.57 194 TM2_M_A_HREF_HREF 1524 0.59 0.65 0.56 195 XMPhish14 1480 0.70 0.99 0.54 196 MPART_ALT_DIFF_COUNT 1480 0.72 1.05 0.54 197 XM_B_COPY_HTML 1475 0.51 0.45 0.54 198 TR_Caps_n_Bayes_99 1471 0.66 0.87 0.54 199 XMBody_78 1436 0.58 0.67 0.53 200 XM_DIRTYINTL 1420 1.35 2.83 0.52 ----------------------------------------------------------------------