Email: 958918 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.98 sec Spam: 299995 Autolearn: 0 AvgScore: 13.11 AvgScanTime: 2.13 sec Ham: 658923 Autolearn: 0 AvgScore: 0.08 AvgScanTime: 1.91 sec Time Spent Running SA: 526.50 hours Time Spent Processing Spam: 177.59 hours Time Spent Processing Ham: 348.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 291796 92.90 97.27 90.91 2 DKIM_SIGNED 259134 84.22 86.38 83.23 3 XM_DK_Pass 252171 82.67 84.06 82.03 4 DCC_CHECK 248872 60.58 82.96 50.39 5 DKIM_VALID 247422 80.99 82.48 80.31 6 RELAYCOUNTRY_US 243555 85.21 81.19 87.04 7 XM_B_Unicode 237221 77.03 79.07 76.10 8 XMListUnsubscribeExists 220896 63.47 73.63 58.85 9 XM_B_SpammyWords 209532 57.90 69.85 52.45 10 DKIM_VALID_AU 189490 61.78 63.16 61.15 11 XM_DK_Undo_02 142963 20.99 47.66 8.84 12 XM_B_Unicode3 137468 46.70 45.82 47.09 13 TR_XM_DKIM_Undo 119193 16.64 39.73 6.13 14 BAYES_50 117698 49.87 39.23 54.71 15 XM_B_SpammyWords2 114664 28.52 38.22 24.11 16 LOC_TINY_FONT_1 114356 31.82 38.12 28.95 17 RCVD_IN_MSPIKE_H2 107878 31.35 35.96 29.25 18 HTML_FONT_LOW_CONTRAST 105009 32.74 35.00 31.71 19 BAYES_99 95242 13.27 31.75 4.86 20 MIME_HTML_ONLY 93176 24.67 31.06 21.76 21 FVGT_m_MULTI_ODD 87255 26.33 29.09 25.08 22 T_KAM_HTML_FONT_INVALID 80545 22.33 26.85 20.27 23 DKIM_VALID_EF 79713 27.84 26.57 28.42 24 TR_DCC_Bayes_99 78225 10.12 26.08 2.86 25 BAYES_999 74198 10.49 24.73 4.01 26 XMSubLong 71553 19.93 23.85 18.14 27 RCVD_IN_MSPIKE_WL 64900 30.69 21.63 34.81 28 XM_Body_Dirty_Words 56451 14.91 18.82 13.13 29 T_TM2_M_HEADER_IN_MSG 56114 23.19 18.70 25.23 30 BOTNET 55905 7.26 18.64 2.09 31 RELAYCOUNTRY_META 52779 8.68 17.59 4.63 32 XM_Multi_Part_URI 47980 13.89 15.99 12.93 33 DCC_CHECK_NEGATIVE 46736 37.63 15.58 47.68 34 XM_B_SpammyWords3 43439 8.51 14.48 5.79 35 BOTNET_IPINHOSTNAME 40068 7.35 13.36 4.62 36 XM_Evil_Numbers_Gen 38361 11.49 12.79 10.90 37 LOTS_OF_MONEY 38056 9.03 12.69 7.36 38 RCVD_IN_MSPIKE_H3 35967 16.15 11.99 18.04 39 UNTRUSTED_Relay 35268 4.99 11.76 1.90 40 TR_XM_SpammyWords2 34530 4.32 11.51 1.05 41 RCVD_IN_BL_SPAMCOP_NET 34039 4.99 11.35 2.10 42 XM_B_Unsub 33819 10.85 11.27 10.65 43 TR_XM_SpammyWords4 32675 6.89 10.89 5.07 44 LotsOfNums_01 32394 10.54 10.80 10.43 45 UNPARSEABLE_RELAY 31969 10.08 10.66 9.81 46 TR_XM_UnparsRelay 31129 8.21 10.38 7.22 47 HTML_IMAGE_RATIO_02 28794 8.97 9.60 8.68 48 XM_SendGrid 28293 9.21 9.43 9.10 49 FSL_BULK_SIG 27254 6.97 9.08 6.00 50 XMSexyCombo_05 26892 5.81 8.96 4.38 51 RCVD_IN_MSPIKE_H4 26112 11.69 8.70 13.05 52 MPART_ALT_DIFF 24644 5.53 8.21 4.31 53 BAYES_80 24248 5.68 8.08 4.59 54 XM_UncommonTLD01 21904 4.08 7.30 2.62 55 BAYES_60 21410 8.00 7.14 8.40 56 BOTNET_NORDNS 20638 2.16 6.88 0.02 57 XM_B_Phish_Phrases 20178 6.23 6.73 6.00 58 XMNumbers 20009 4.11 6.67 2.95 59 XM_H_Long_From01 19727 6.22 6.58 6.06 60 MIME_HTML_MOSTLY 19474 3.87 6.49 2.67 61 HTML_MIME_NO_HTML_TAG 19348 3.16 6.45 1.67 62 HTML_IMAGE_RATIO_04 19241 6.92 6.41 7.16 63 HTML_IMAGE_ONLY_12 19072 2.12 6.36 0.18 64 HTML_SHORT_LINK_IMG_1 19019 2.00 6.34 0.02 65 TR_XM_SpammyWords5 18621 3.76 6.21 2.64 66 TR_XM_PhishingBody 18198 3.76 6.07 2.71 67 RCVD_IN_RP_SAFE 16909 8.47 5.64 9.77 68 TooManyTo_001 16854 6.95 5.62 7.56 69 DKIM_ADSP_NXDOMAIN 16413 1.85 5.47 0.20 70 XM_UB50 15675 2.35 5.23 1.04 71 RELAYCOUNTRY_CA 15550 2.57 5.18 1.38 72 HDRS_MISSP 15452 1.70 5.15 0.13 73 HDRS_LCASE_IMGONLY 15138 1.62 5.05 0.06 74 RCVD_IN_RP_CERTIFIED 14820 7.68 4.94 8.93 75 TR_XM_DK_SendGrid 14777 5.23 4.93 5.37 76 XMStrtUSub 13840 5.53 4.61 5.95 77 HTML_IMAGE_RATIO_06 13721 3.87 4.57 3.55 78 RCVD_IN_MSPIKE_BL 13718 1.56 4.57 0.20 79 TR_XM_MSPIKECOMBO 13596 1.55 4.53 0.19 80 BAYES_95 13545 3.30 4.52 2.75 81 SUBJ_ALL_CAPS 12751 3.14 4.25 2.63 82 XMSubMetaSx_00 12499 3.21 4.17 2.77 83 MIME_QP_LONG_LINE 11858 5.71 3.95 6.51 84 DKIM_INVALID 11712 3.22 3.90 2.92 85 XM_OfRef6 11661 1.87 3.89 0.95 86 TM2_M_URI_OPT_OUT 11655 2.88 3.89 2.42 87 TR_LOTS_OF_MONEY3 11574 1.83 3.86 0.91 88 XMBody_17 10935 1.71 3.65 0.82 89 XM_SPF_SoftFail 10427 2.13 3.48 1.52 90 HTML_IMAGE_RATIO_08 10241 2.71 3.41 2.39 91 FROM_EXCESS_BASE64 9952 3.82 3.32 4.04 92 XM_DK_Undo_01 9627 1.91 3.21 1.32 93 BAYES_40 9561 4.45 3.19 5.03 94 XMSubMetaI_00 9435 2.21 3.15 1.79 95 XM_B_SpammyTLD 9226 2.22 3.08 1.84 96 T_TooManySym_01 9192 3.94 3.06 4.35 97 RCVD_IN_MSPIKE_L5 8940 1.00 2.98 0.10 98 BAYES_00 8855 10.21 2.95 13.52 99 MIME_HTML_ONLY_MULTI 8664 2.65 2.89 2.55 100 XMBdyGiftCard01 8623 1.67 2.87 1.13 101 RELAYCOUNTRY_FR 8518 1.10 2.84 0.31 102 KHOP_HELO_FCRDNS 8468 1.83 2.82 1.37 103 XM_B_Phish66 8204 1.97 2.73 1.62 104 URI_HEX 8062 1.92 2.69 1.56 105 T_XMHurry_00 8047 1.82 2.68 1.43 106 URIBL_SBL_A 8026 0.94 2.68 0.15 107 TR_XM_SpammyWords3 7979 0.90 2.66 0.10 108 XMDiploma_00 7885 1.84 2.63 1.48 109 XMBrknScrpt_02 7844 1.70 2.61 1.28 110 SpammyFromTLD_01 7799 1.28 2.60 0.68 111 SpammyFromTLD_02 7798 0.96 2.60 0.21 112 XM_DIRTYINTL 7676 1.02 2.56 0.32 113 XM_B_SpammyWords4 7595 1.31 2.53 0.75 114 T_REMOTE_IMAGE 7586 2.89 2.53 3.05 115 TM2_M_VERY_LONG_WORD 7501 1.84 2.50 1.54 116 T_XMDrugObfuBody_08 7332 1.95 2.44 1.72 117 XM_CamelCaseFrm001 6857 2.07 2.29 1.97 118 XM_B_COVIDMETA 6599 1.08 2.20 0.57 119 XMStockSpam_06 6448 1.94 2.15 1.84 120 RCVD_IN_IADB_LISTED 6415 5.07 2.14 6.40 121 URI_TRY_3LD 6311 1.65 2.10 1.44 122 FVGT_m_MULTI_ODD_EMAIL 6213 0.67 2.07 0.03 123 XM_B_Unsub2 6153 1.61 2.05 1.41 124 RCVD_IN_RP_RNBL 6141 0.66 2.05 0.03 125 HK_RANDOM_REPLYTO 6132 0.76 2.04 0.18 126 RCVD_IN_IADB_SPF 6022 4.53 2.01 5.67 127 FORGED_GMAIL_RCVD 5940 1.01 1.98 0.56 128 RCVD_IN_PSBL 5918 0.65 1.97 0.05 129 RCVD_IN_IADB_DK 5870 4.06 1.96 5.02 130 RCVD_IN_IADB_SENDERID 5864 4.16 1.95 5.16 131 T_XMDrugObfuBody_14 5673 1.84 1.89 1.82 132 T_FILL_THIS_FORM_SHORT 5608 1.07 1.87 0.71 133 BAYES_20 5443 3.14 1.81 3.75 134 XM_RXBody 5234 0.99 1.74 0.65 135 HTML_TITLE_SUBJ_DIFF 5027 0.57 1.68 0.06 136 TR_XM_DK_Bayes 5023 7.77 1.67 10.55 137 TR_XM_DK_Bayes1 4979 7.59 1.66 10.30 138 TR_XM_SB_Phish 4799 1.64 1.60 1.66 139 XM_URI_RBL 4689 0.59 1.56 0.15 140 XMSubPhish11 4631 1.61 1.54 1.64 141 TR_XM_DK_Bayes2 4579 6.61 1.53 8.92 142 URIBL_BLACK 4539 0.51 1.51 0.05 143 XMPhish08 4522 0.59 1.51 0.17 144 XM_UB60 4399 0.54 1.47 0.11 145 GOOGLE_DOC_SUSP 4391 0.47 1.46 0.01 146 MAILING_LIST_MULTI 4330 2.35 1.44 2.76 147 HK_RANDOM_FROM 4315 0.53 1.44 0.12 148 XM_Lotto 4251 0.56 1.42 0.17 149 PDS_OTHER_BAD_TLD 4188 0.82 1.40 0.56 150 TR_Caps_n_Bayes_99 4152 0.48 1.38 0.06 151 TR_XM_MaxBayes 4110 0.44 1.37 0.01 152 XM_UB99 4062 0.43 1.35 0.00 153 XM_OfRef7 3994 0.50 1.33 0.12 154 BAYES_05 3980 2.04 1.33 2.37 155 BODY_URI_ONLY 3967 0.42 1.32 0.01 156 RELAYCOUNTRY_GB 3945 1.03 1.32 0.90 157 URI_NOVOWEL 3901 2.41 1.30 2.92 158 XMGenDplmaNmb 3869 0.91 1.29 0.74 159 XM_UB80 3729 0.41 1.24 0.04 160 URI_PHP_REDIR 3656 0.38 1.22 0.00 161 T_XMDrugObfuBody_00 3647 0.97 1.22 0.86 162 TR_XM_INV_DKIM 3640 0.42 1.21 0.06 163 XM_ProductURIs 3324 1.20 1.11 1.25 164 TR_BOTNET_NEGATE 3292 0.69 1.10 0.51 165 TR_XM_COVIDMETA4 3282 0.55 1.09 0.30 166 XMHTML_After_End 3226 0.77 1.08 0.64 167 XMLongAddy 3224 0.39 1.07 0.08 168 TR_XM_BayesRelay 3220 0.35 1.07 0.01 169 FROM_SUSPICIOUS_NTLD 3212 0.38 1.07 0.07 170 SUBJ_ILLEGAL_CHARS 3209 0.34 1.07 0.00 171 SUBJECT_NEEDS_ENCODING 3198 0.34 1.07 0.00 172 TR_XM_PHPDW 3194 0.55 1.06 0.32 173 XM_H_Long_From02 3192 1.23 1.06 1.31 174 FROM_SUSPICIOUS_NTLD_FP 3137 0.37 1.05 0.06 175 NUMERIC_HTTP_ADDR 3131 0.71 1.04 0.56 176 TR_XM_PHPForged 3118 0.52 1.04 0.29 177 TR_XM_FormFill2 3100 0.52 1.03 0.29 178 XM_H_PHPOS 3098 0.52 1.03 0.28 179 RCVD_IN_MSPIKE_L3 3082 0.37 1.03 0.07 180 TR_XM_COVIDMETA1 3014 0.51 1.00 0.28 181 TR_XM_RelayPhish 2999 0.37 1.00 0.08 182 TR_XM_FormFill 2988 0.32 1.00 0.02 183 DKIM_ADSP_CUSTOM_MED 2979 0.89 0.99 0.85 184 XMPhish14 2944 0.65 0.98 0.49 185 GOOG_STO_IMG_HTML 2898 0.30 0.97 0.00 186 XM_UB999 2887 0.30 0.96 0.00 187 LongTLD 2876 0.40 0.96 0.15 188 RCVD_IN_MSPIKE_H5 2821 2.85 0.94 3.72 189 T_MONEY_PERCENT 2819 1.13 0.94 1.22 190 TR_LOTS_OF_MONEY2 2819 1.13 0.94 1.22 191 TR_Symld_Words 2710 1.25 0.90 1.41 192 XMSexyCombo_01 2704 0.70 0.90 0.61 193 RELAYCOUNTRY_AT 2600 0.46 0.87 0.27 194 SUBJ_DOLLARS 2574 0.52 0.86 0.37 195 RELAYCOUNTRY_DE 2545 0.52 0.85 0.36 196 RELAYCOUNTRY_NL 2520 0.40 0.84 0.20 197 HTTPS_HTTP_MISMATCH 2511 0.72 0.84 0.66 198 XM_B_SEO 2487 0.39 0.83 0.18 199 GAPPY_SUBJECT 2480 0.37 0.83 0.16 200 ALL_TRUSTED 2373 6.67 0.79 9.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 599054 92.90 97.27 90.91 2 RELAYCOUNTRY_US 573500 85.21 81.19 87.04 3 DKIM_SIGNED 548422 84.22 86.38 83.23 4 XM_DK_Pass 540527 82.67 84.06 82.03 5 DKIM_VALID 529211 80.99 82.48 80.31 6 XM_B_Unicode 501457 77.03 79.07 76.10 7 DKIM_VALID_AU 402907 61.78 63.16 61.15 8 XMListUnsubscribeExists 387769 63.47 73.63 58.85 9 BAYES_50 360505 49.87 39.23 54.71 10 XM_B_SpammyWords 345636 57.90 69.85 52.45 11 DCC_CHECK 332010 60.58 82.96 50.39 12 DCC_CHECK_NEGATIVE 314144 37.63 15.58 47.68 13 XM_B_Unicode3 310302 46.70 45.82 47.09 14 RCVD_IN_MSPIKE_WL 229367 30.69 21.63 34.81 15 HTML_FONT_LOW_CONTRAST 208937 32.74 35.00 31.71 16 RCVD_IN_MSPIKE_H2 192722 31.35 35.96 29.25 17 LOC_TINY_FONT_1 190745 31.82 38.12 28.95 18 DKIM_VALID_EF 187251 27.84 26.57 28.42 19 T_TM2_M_HEADER_IN_MSG 166266 23.19 18.70 25.23 20 FVGT_m_MULTI_ODD 165267 26.33 29.09 25.08 21 XM_B_SpammyWords2 158866 28.52 38.22 24.11 22 MIME_HTML_ONLY 143400 24.67 31.06 21.76 23 T_KAM_HTML_FONT_INVALID 133579 22.33 26.85 20.27 24 XMSubLong 119552 19.93 23.85 18.14 25 RCVD_IN_MSPIKE_H3 118867 16.15 11.99 18.04 26 BAYES_00 89062 10.21 2.95 13.52 27 XM_Body_Dirty_Words 86497 14.91 18.82 13.13 28 RCVD_IN_MSPIKE_H4 86004 11.69 8.70 13.05 29 XM_Multi_Part_URI 85204 13.89 15.99 12.93 30 XM_Evil_Numbers_Gen 71810 11.49 12.79 10.90 31 XM_B_Unsub 70178 10.85 11.27 10.65 32 TR_XM_DK_Bayes 69526 7.77 1.67 10.55 33 LotsOfNums_01 68710 10.54 10.80 10.43 34 TR_XM_DK_Bayes1 67846 7.59 1.66 10.30 35 UNPARSEABLE_RELAY 64663 10.08 10.66 9.81 36 XM_DKIMWhitelistDomains 64566 6.76 0.08 9.80 37 RCVD_IN_RP_SAFE 64347 8.47 5.64 9.77 38 ALL_TRUSTED 61563 6.67 0.79 9.34 39 XM_SendGrid 59979 9.21 9.43 9.10 40 RCVD_IN_RP_CERTIFIED 58829 7.68 4.94 8.93 41 TR_XM_DK_Bayes2 58803 6.61 1.53 8.92 42 XM_DK_Undo_02 58274 20.99 47.66 8.84 43 HTML_IMAGE_RATIO_02 57182 8.97 9.60 8.68 44 BAYES_60 55322 8.00 7.14 8.40 45 TooManyTo_001 49804 6.95 5.62 7.56 46 LOTS_OF_MONEY 48528 9.03 12.69 7.36 47 TR_XM_UnparsRelay 47605 8.21 10.38 7.22 48 HTML_IMAGE_RATIO_04 47162 6.92 6.41 7.16 49 MIME_QP_LONG_LINE 42928 5.71 3.95 6.51 50 RCVD_IN_IADB_LISTED 42170 5.07 2.14 6.40 51 TR_XM_DKIM_Undo 40401 16.64 39.73 6.13 52 XM_H_Long_From01 39925 6.22 6.58 6.06 53 FSL_BULK_SIG 39552 6.97 9.08 6.00 54 XM_B_Phish_Phrases 39515 6.23 6.73 6.00 55 XMStrtUSub 39186 5.53 4.61 5.95 56 XM_B_SpammyWords3 38155 8.51 14.48 5.79 57 RCVD_IN_IADB_SPF 37386 4.53 2.01 5.67 58 IN_ZIMBRA_NJ_WHITELIST 35546 3.72 0.04 5.39 59 TR_XM_DK_SendGrid 35364 5.23 4.93 5.37 60 RCVD_IN_IADB_SENDERID 34025 4.16 1.95 5.16 61 TR_XM_SpammyWords4 33397 6.89 10.89 5.07 62 BAYES_40 33121 4.45 3.19 5.03 63 RCVD_IN_IADB_DK 33087 4.06 1.96 5.02 64 BAYES_99 32048 13.27 31.75 4.86 65 RELAYCOUNTRY_META 30483 8.68 17.59 4.63 66 BOTNET_IPINHOSTNAME 30441 7.35 13.36 4.62 67 BAYES_80 30224 5.68 8.08 4.59 68 XMSexyCombo_05 28855 5.81 8.96 4.38 69 T_TooManySym_01 28633 3.94 3.06 4.35 70 XM_PDF 28463 3.14 0.56 4.32 71 MPART_ALT_DIFF 28398 5.53 8.21 4.31 72 FROM_EXCESS_BASE64 26652 3.82 3.32 4.04 73 BAYES_999 26432 10.49 24.73 4.01 74 BAYES_20 24711 3.14 1.81 3.75 75 RCVD_IN_MSPIKE_H5 24496 2.85 0.94 3.72 76 RCVD_IN_IADB_VOUCHED 23553 2.64 0.59 3.57 77 HTML_IMAGE_RATIO_06 23402 3.87 4.57 3.55 78 T_REMOTE_IMAGE 20121 2.89 2.53 3.05 79 XMNumbers 19424 4.11 6.67 2.95 80 URI_NOVOWEL 19221 2.41 1.30 2.92 81 DKIM_INVALID 19211 3.22 3.90 2.92 82 TR_DCC_Bayes_99 18846 10.12 26.08 2.86 83 XMSubMetaSx_00 18265 3.21 4.17 2.77 84 MAILING_LIST_MULTI 18213 2.35 1.44 2.76 85 BAYES_95 18091 3.30 4.52 2.75 86 TR_XM_PhishingBody 17824 3.76 6.07 2.71 87 MIME_HTML_MOSTLY 17614 3.87 6.49 2.67 88 TR_XM_SpammyWords5 17401 3.76 6.21 2.64 89 SUBJ_ALL_CAPS 17335 3.14 4.25 2.63 90 XM_UncommonTLD01 17251 4.08 7.30 2.62 91 MIME_HTML_ONLY_MULTI 16790 2.65 2.89 2.55 92 TM2_M_URI_OPT_OUT 15922 2.88 3.89 2.42 93 HTML_IMAGE_RATIO_08 15759 2.71 3.41 2.39 94 BAYES_05 15600 2.04 1.33 2.37 95 RCVD_IN_IADB_OPTIN 14904 1.69 0.43 2.26 96 RCVD_IN_BL_SPAMCOP_NET 13843 4.99 11.35 2.10 97 BOTNET 13756 7.26 18.64 2.09 98 XM_CamelCaseFrm001 12981 2.07 2.29 1.97 99 UNTRUSTED_Relay 12545 4.99 11.76 1.90 100 XMStockSpam_06 12152 1.94 2.15 1.84 101 XM_B_SpammyTLD 12105 2.22 3.08 1.84 102 T_XMDrugObfuBody_14 11975 1.84 1.89 1.82 103 XMSubMetaI_00 11784 2.21 3.15 1.79 104 T_TooManySym_02 11730 1.42 0.62 1.78 105 TooManyTo_002 11436 1.32 0.41 1.74 106 T_XMDrugObfuBody_08 11333 1.95 2.44 1.72 107 HTML_MIME_NO_HTML_TAG 10983 3.16 6.45 1.67 108 TR_XM_SB_Phish 10952 1.64 1.60 1.66 109 XMSubPhish11 10782 1.61 1.54 1.64 110 TR_MSPIKEBAYES00 10741 1.13 0.04 1.63 111 XM_B_Phish66 10646 1.97 2.73 1.62 112 XM_H_Trusted_IP 10627 1.11 0.00 1.61 113 URI_HEX 10312 1.92 2.69 1.56 114 TM2_M_VERY_LONG_WORD 10152 1.84 2.50 1.54 115 XM_SPF_SoftFail 10010 2.13 3.48 1.52 116 XMDiploma_00 9768 1.84 2.63 1.48 117 IN_HORDE_ADDRESS_BOOK 9750 1.03 0.05 1.48 118 URI_TRY_3LD 9486 1.65 2.10 1.44 119 T_XMHurry_00 9429 1.82 2.68 1.43 120 ANY_BOUNCE_MESSAGE 9377 1.07 0.29 1.42 121 BOUNCE_MESSAGE 9371 1.07 0.29 1.42 122 XM_B_Unsub2 9283 1.61 2.05 1.41 123 TR_Symld_Words 9272 1.25 0.90 1.41 124 RELAYCOUNTRY_CA 9092 2.57 5.18 1.38 125 HELO_NO_DOMAIN 9056 1.11 0.53 1.37 126 HELO_NODOT 9056 1.11 0.53 1.37 127 KHOP_HELO_FCRDNS 9045 1.83 2.82 1.37 128 USER_IN_DEF_DKIM_WL 8883 0.99 0.21 1.35 129 XMBody_95 8755 0.95 0.13 1.33 130 XM_DK_Undo_01 8684 1.91 3.21 1.32 131 XM_H_Long_From02 8645 1.23 1.06 1.31 132 XMBrknScrpt_02 8459 1.70 2.61 1.28 133 XM_GoogleGroups 8274 1.01 0.48 1.26 134 XM_ProductURIs 8222 1.20 1.11 1.25 135 TR_LOTS_OF_MONEY2 8016 1.13 0.94 1.22 136 T_MONEY_PERCENT 8016 1.13 0.94 1.22 137 TooManyTo_003 7654 0.90 0.33 1.16 138 INVALID_MSGID 7600 0.97 0.56 1.15 139 XMBdyGiftCard01 7420 1.67 2.87 1.13 140 TVD_RCVD_IP 7188 0.82 0.22 1.09 141 TR_XM_SpammyWords2 6924 4.32 11.51 1.05 142 XM_UB50 6885 2.35 5.23 1.04 143 MSGID_NOFQDN1 6576 0.79 0.32 1.00 144 TO_MALFORMED 6476 0.68 0.01 0.98 145 XMCapTrack 6358 0.75 0.26 0.96 146 XM_OfRef6 6231 1.87 3.89 0.95 147 HELO_MISC_IP 5997 0.68 0.18 0.91 148 TR_LOTS_OF_MONEY3 5970 1.83 3.86 0.91 149 RELAYCOUNTRY_GB 5921 1.03 1.32 0.90 150 TooManyTo_004 5691 0.68 0.29 0.86 151 T_XMDrugObfuBody_00 5681 0.97 1.22 0.86 152 DKIM_ADSP_CUSTOM_MED 5602 0.89 0.99 0.85 153 XMBody_17 5421 1.71 3.65 0.82 154 XMBSHREFv2 5303 0.63 0.26 0.80 155 HTML_FONT_FACE_BAD 5170 0.74 0.64 0.78 156 XM_B_SpammyWords4 4936 1.31 2.53 0.75 157 XM_S_SpammyWords 4914 0.69 0.57 0.75 158 TR_XM_Spammywords 4908 0.69 0.57 0.74 159 XMGenDplmaNmb 4874 0.91 1.29 0.74 160 XMSubNoVowel 4839 0.73 0.72 0.73 161 TooManyTo_005 4747 0.57 0.25 0.72 162 T_FILL_THIS_FORM_SHORT 4670 1.07 1.87 0.71 163 XMGappySubj_01 4624 0.56 0.25 0.70 164 SHOPIFY_IMG_NOT_RCVD_SFY 4561 0.68 0.65 0.69 165 XMSubMetaSxObfu_03 4460 0.68 0.70 0.68 166 SpammyFromTLD_01 4450 1.28 2.60 0.68 167 HTTPS_HTTP_MISMATCH 4353 0.72 0.84 0.66 168 XM_RXBody 4266 0.99 1.74 0.65 169 XMHTML_After_End 4203 0.77 1.08 0.64 170 XMSexyCombo_01 4023 0.70 0.90 0.61 171 TR_MetaPhish_Combo_01 4017 0.65 0.75 0.61 172 XM_B_COVIDMETA 3759 1.08 2.20 0.57 173 FORGED_GMAIL_RCVD 3720 1.01 1.98 0.56 174 NUMERIC_HTTP_ADDR 3710 0.71 1.04 0.56 175 PDS_OTHER_BAD_TLD 3696 0.82 1.40 0.56 176 NML_ADSP_CUSTOM_MED 3665 0.62 0.77 0.56 177 XMOemUri 3554 0.42 0.15 0.54 178 FONT_INVIS_MSGID 3424 0.54 0.59 0.52 179 XM_SPF_Unknown 3407 0.50 0.47 0.52 180 T_OBFU_PDF_ATTACH 3393 0.38 0.10 0.51 181 XM_ShortIntro_01 3366 0.47 0.37 0.51 182 TR_BOTNET_NEGATE 3363 0.69 1.10 0.51 183 LOW_PRICE 3356 0.59 0.77 0.51 184 RDNS_DYNAMIC 3313 0.57 0.73 0.50 185 XM_E_Blogspot 3277 0.36 0.07 0.50 186 XM_Body_Obfu01 3277 0.46 0.37 0.50 187 XMPhish14 3246 0.65 0.98 0.49 188 THIS_AD 3207 0.58 0.77 0.49 189 FROM_GOV_DKIM_AU 3204 0.36 0.07 0.49 190 TM2_M_BODY_EMPTY 3197 0.36 0.07 0.49 191 XMHTMLBadTable_001 3160 0.51 0.57 0.48 192 XMMoneyMeta_00 3052 0.53 0.68 0.46 193 XM_H_PHPMailer 3050 0.42 0.34 0.46 194 T_TooManySym_03 3047 0.38 0.19 0.46 195 XMNoVowels 3004 0.46 0.48 0.46 196 T_Symld_Words_02 2984 0.54 0.73 0.45 197 XMSolicitRefs_0 2938 0.42 0.36 0.45 198 XM_B_COPY_HTML 2906 0.45 0.46 0.44 199 XMBody_78 2880 0.54 0.75 0.44 200 TVD_PH_BODY_ACCOUNTS_PRE 2871 0.33 0.10 0.44 ----------------------------------------------------------------------