Email: 703217 Autolearn: 0 AvgScore: 2.47 AvgScanTime: 1.31 sec Spam: 209648 Autolearn: 0 AvgScore: 14.40 AvgScanTime: 1.60 sec Ham: 493569 Autolearn: 0 AvgScore: -2.60 AvgScanTime: 1.19 sec Time Spent Running SA: 255.55 hours Time Spent Processing Spam: 93.02 hours Time Spent Processing Ham: 162.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202918 86.66 96.79 82.36 2 DKIM_SIGNED 181504 67.63 86.58 59.58 3 XM_DK_Pass 177968 66.38 84.89 58.52 4 DKIM_VALID 174001 64.78 83.00 57.04 5 DCC_CHECK 166349 45.90 79.35 31.69 6 XM_B_Unicode 165829 71.95 79.10 68.91 7 RELAYCOUNTRY_US 158382 76.37 75.55 76.71 8 XMListUnsubscribeExists 152267 50.44 72.63 41.02 9 XM_B_SpammyWords 143165 49.00 68.29 40.81 10 DKIM_VALID_AU 133496 49.72 63.68 43.79 11 XM_DK_Undo_02 112232 20.83 53.53 6.93 12 BAYES_99 90787 16.58 43.30 5.23 13 XM_B_Unicode3 88988 42.78 42.45 42.92 14 TR_XM_DKIM_Undo 88158 15.57 42.05 4.32 15 XM_B_SpammyWords2 85919 23.07 40.98 15.46 16 LOC_TINY_FONT_1 78880 24.68 37.62 19.18 17 BAYES_999 73977 13.47 35.29 4.21 18 TR_DCC_Bayes_99 70856 11.84 33.80 2.51 19 HTML_FONT_LOW_CONTRAST 70271 26.30 33.52 23.24 20 BAYES_50 67703 46.72 32.29 52.85 21 MIME_HTML_ONLY 67433 25.15 32.16 22.17 22 DKIM_VALID_EF 62866 24.70 29.99 22.46 23 RCVD_IN_MSPIKE_H2 61788 23.05 29.47 20.32 24 FVGT_m_MULTI_ODD 60104 21.72 28.67 18.78 25 T_KAM_HTML_FONT_INVALID 56771 18.28 27.08 14.54 26 RCVD_IN_MSPIKE_WL 49007 23.81 23.38 24.00 27 XMSubLong 48097 18.63 22.94 16.79 28 RELAYCOUNTRY_META 45342 9.14 21.63 3.83 29 T_TM2_M_HEADER_IN_MSG 41183 21.42 19.64 22.17 30 XM_Body_Dirty_Words 40617 11.82 19.37 8.62 31 DCC_CHECK_NEGATIVE 39245 52.41 18.72 66.72 32 LOTS_OF_MONEY 36562 9.29 17.44 5.82 33 TR_XM_SpammyWords2 35583 5.77 16.97 1.02 34 TR_XM_SpammyWords4 32934 7.28 15.71 3.70 35 BOTNET 31958 5.49 15.24 1.35 36 XM_UncommonTLD01 31070 6.32 14.82 2.70 37 UNTRUSTED_Relay 31010 5.31 14.79 1.29 38 XM_Multi_Part_URI 30830 14.36 14.71 14.21 39 XM_B_SpammyWords3 29213 6.58 13.93 3.46 40 RCVD_IN_MSPIKE_H3 26820 12.80 12.79 12.81 41 BOTNET_IPINHOSTNAME 25401 6.41 12.12 3.99 42 XM_B_Unsub 24238 8.49 11.56 7.19 43 FSL_BULK_SIG 22142 6.42 10.56 4.67 44 XM_Evil_Numbers_Gen 22034 8.79 10.51 8.06 45 RCVD_IN_BL_SPAMCOP_NET 20936 3.55 9.99 0.81 46 XMSexyCombo_05 20802 4.89 9.92 2.75 47 MPART_ALT_DIFF 20384 9.69 9.72 9.68 48 RCVD_IN_MSPIKE_H4 20111 9.22 9.59 9.07 49 LotsOfNums_01 18267 7.98 8.71 7.66 50 UNPARSEABLE_RELAY 17827 6.82 8.50 6.10 51 RELAYCOUNTRY_CA 17651 3.34 8.42 1.18 52 TR_XM_UnparsRelay 17608 6.07 8.40 5.08 53 HTML_IMAGE_RATIO_02 16906 5.97 8.06 5.08 54 MIME_HTML_MOSTLY 16818 3.86 8.02 2.09 55 BAYES_80 16762 5.30 8.00 4.16 56 BAYES_60 15235 7.75 7.27 7.96 57 SpammyFromTLD_02 14917 2.28 7.12 0.22 58 XM_SendGrid 13913 5.86 6.64 5.53 59 KHOP_HELO_FCRDNS 13893 3.04 6.63 1.51 60 TR_LOTS_OF_MONEY3 13610 2.56 6.49 0.89 61 XM_H_Long_From01 13357 4.99 6.37 4.41 62 TR_XM_PhishingBody 13180 3.62 6.29 2.49 63 URIBL_SBL_A 13116 2.83 6.26 1.37 64 HTML_IMAGE_RATIO_04 13071 13.41 6.23 16.46 65 XM_B_Phish_Phrases 13054 3.86 6.23 2.86 66 TooManyTo_001 12137 6.38 5.79 6.64 67 XM_UB50 11510 2.21 5.49 0.81 68 XMSubMetaSx_00 11405 3.74 5.44 3.01 69 HTML_SHORT_LINK_IMG_1 11294 1.62 5.39 0.02 70 XM_OfRef6 11232 2.15 5.36 0.78 71 TR_XM_SpammyWords5 10383 2.49 4.95 1.44 72 SpammyFromTLD_01 10160 1.91 4.85 0.66 73 XM_DK_Undo_01 10080 2.23 4.81 1.13 74 BAYES_95 10048 3.29 4.79 2.65 75 XMNumbers 10004 3.32 4.77 2.70 76 XMStrtUSub 9703 9.06 4.63 10.94 77 HTML_FONT_SIZE_LARGE 9077 1.35 4.33 0.09 78 XM_UB99 9047 1.29 4.32 0.01 79 BODY_URI_ONLY 8891 1.27 4.24 0.00 80 HTML_IMAGE_ONLY_12 8482 1.31 4.05 0.15 81 RCVD_IN_RP_SAFE 8402 6.07 4.01 6.95 82 XMDiploma_00 8272 2.10 3.95 1.31 83 XM_B_SpammyTLD 7979 2.24 3.81 1.58 84 T_FILL_THIS_FORM_SHORT 7956 1.51 3.79 0.54 85 TR_XM_MaxBayes 7917 1.14 3.78 0.03 86 HTML_MIME_NO_HTML_TAG 7844 2.39 3.74 1.82 87 T_REMOTE_IMAGE 7757 3.22 3.70 3.01 88 XM_DIRTYINTL 7684 1.30 3.67 0.30 89 TR_XM_DK_SendGrid 7609 3.49 3.63 3.43 90 TM2_M_URI_OPT_OUT 7604 8.81 3.63 11.02 91 DKIM_INVALID 7503 2.85 3.58 2.54 92 XM_B_Phish66 7220 1.98 3.44 1.35 93 HTML_IMAGE_RATIO_06 6951 4.61 3.32 5.15 94 URI_HEX 6941 1.80 3.31 1.16 95 XM_UB999 6900 0.98 3.29 0.00 96 MIME_HTML_ONLY_MULTI 6706 6.56 3.20 7.99 97 MIME_QP_LONG_LINE 6643 4.19 3.17 4.63 98 RCVD_IN_MSPIKE_BL 6424 0.97 3.06 0.08 99 TR_XM_MSPIKECOMBO 6391 0.96 3.05 0.07 100 XM_SPF_SoftFail 6323 1.89 3.02 1.41 101 XMBdyGiftCard01 6204 1.19 2.96 0.44 102 RCVD_IN_RP_CERTIFIED 6166 5.29 2.94 6.29 103 RELAYCOUNTRY_FR 5926 0.99 2.83 0.20 104 T_XMHurry_00 5903 1.38 2.82 0.76 105 XMBody_17 5887 1.15 2.81 0.44 106 T_XMDrugObfuBody_14 5780 1.87 2.76 1.50 107 RCVD_IN_RP_RNBL 5645 0.82 2.69 0.03 108 SUBJ_ALL_CAPS 5601 1.72 2.67 1.31 109 HTML_IMAGE_RATIO_08 5436 2.03 2.59 1.79 110 FROM_EXCESS_BASE64 5379 2.54 2.57 2.53 111 XM_B_COVIDMETA 5367 1.31 2.56 0.77 112 TR_XM_BayesRelay 5343 0.78 2.55 0.02 113 TR_XM_FormFill 5342 0.78 2.55 0.03 114 BOTNET_NORDNS 5034 0.72 2.40 0.01 115 TR_XM_SpammyWords3 4859 0.72 2.32 0.05 116 XM_CamelCaseFrm001 4794 1.67 2.29 1.40 117 XM_B_Unsub2 4692 1.38 2.24 1.02 118 RCVD_IN_IADB_LISTED 4667 3.70 2.23 4.33 119 FORGED_GMAIL_RCVD 4665 0.98 2.23 0.45 120 URI_TRY_3LD 4636 1.28 2.21 0.88 121 XMBrknScrpt_02 4521 1.03 2.16 0.55 122 URI_PHP_REDIR 4506 0.64 2.15 0.00 123 XM_B_SpammyWords4 4436 1.02 2.12 0.55 124 URIBL_DBL_SPAM 4310 0.62 2.06 0.00 125 RCVD_IN_IADB_SPF 4248 3.30 2.03 3.84 126 BAYES_40 4217 3.78 2.01 4.53 127 DKIM_ADSP_NXDOMAIN 4164 0.75 1.99 0.22 128 TM2_M_VERY_LONG_WORD 4129 1.25 1.97 0.95 129 XM_UB60 4127 0.68 1.97 0.14 130 RELAYCOUNTRY_DE 4086 0.94 1.95 0.51 131 RCVD_IN_IADB_DK 4058 2.96 1.94 3.39 132 RCVD_IN_IADB_SENDERID 4013 3.02 1.91 3.49 133 TR_XM_SB_Phish 3988 1.70 1.90 1.62 134 PDS_OTHER_BAD_TLD 3981 0.91 1.90 0.49 135 RCVD_IN_PSBL 3904 0.62 1.86 0.09 136 XMSubPhish11 3893 1.67 1.86 1.59 137 RCVD_IN_MSPIKE_L5 3868 0.57 1.84 0.03 138 HDRS_MISSP 3765 0.60 1.80 0.10 139 HK_RANDOM_REPLYTO 3621 0.62 1.73 0.15 140 XMSexyCombo_01 3598 0.83 1.72 0.45 141 XM_URI_RBL 3595 0.59 1.71 0.11 142 XMGenDplmaNmb 3594 1.00 1.71 0.69 143 SHORT_SHORTNER 3561 0.52 1.70 0.02 144 RELAYCOUNTRY_IN 3542 0.55 1.69 0.06 145 T_TooManySym_01 3422 3.13 1.63 3.77 146 T_XMDrugObfuBody_08 3375 1.15 1.61 0.96 147 MIME_HEADER_CTYPE_ONLY 3332 0.53 1.59 0.08 148 SHORTENER_SHORT_IMG 3304 0.47 1.58 0.00 149 XM_UB80 3269 0.49 1.56 0.04 150 URIBL_DBL_ABUSE_REDIR 3267 0.46 1.56 0.00 151 HDRS_LCASE_IMGONLY 3239 0.47 1.54 0.01 152 TR_XM_INV_DKIM 3180 0.51 1.52 0.08 153 HTML_IMAGE_ONLY_08 3177 0.51 1.52 0.08 154 TR_XM_COVIDMETA4 3140 0.78 1.50 0.47 155 XMStockSpam_06 3129 0.89 1.49 0.63 156 HTTPS_HTTP_MISMATCH 3002 0.86 1.43 0.62 157 MAILING_LIST_MULTI 2987 1.76 1.42 1.90 158 GOOGLE_DOC_SUSP 2959 0.42 1.41 0.00 159 URI_NOVOWEL 2908 1.85 1.39 2.04 160 TR_XM_COVIDMETA1 2685 0.61 1.28 0.33 161 URIBL_BLACK 2639 0.40 1.26 0.03 162 T_XMDrugObfuBody_00 2617 2.82 1.25 3.49 163 XMSubMetaI_00 2549 0.78 1.22 0.60 164 DIET_1 2539 0.68 1.21 0.45 165 TR_Caps_n_Bayes_99 2506 0.44 1.20 0.12 166 TR_XM_PHPDW 2501 0.58 1.19 0.31 167 XM_OfRef7 2496 0.42 1.19 0.10 168 XMSubGiftCard1 2487 0.42 1.19 0.09 169 XM_Body_Obfu01 2418 0.58 1.15 0.34 170 BAYES_20 2404 3.35 1.15 4.28 171 TR_XM_PHPForged 2279 0.50 1.09 0.25 172 XMHTML_After_End 2268 0.82 1.08 0.70 173 TR_XM_FormFill2 2215 0.49 1.06 0.25 174 XM_H_PHPOS 2203 0.48 1.05 0.24 175 HTML_FONT_SIZE_HUGE 2151 0.40 1.03 0.14 176 TR_LOTS_OF_MONEY2 2150 0.40 1.03 0.13 177 T_MONEY_PERCENT 2150 0.40 1.03 0.13 178 SHORTENED_URL_SRC 2140 0.30 1.02 0.00 179 URI_NO_WWW_BIZ_CGI 2138 0.31 1.02 0.01 180 XM_Body_Dirty_Words_01 2118 0.37 1.01 0.10 181 TR_BOTNET_NEGATE 2106 0.50 1.00 0.28 182 XMSubMetaD_00 2084 0.35 0.99 0.08 183 RCVD_IN_MSPIKE_H5 2076 1.79 0.99 2.13 184 XM_UB95 2062 0.31 0.98 0.02 185 ALL_TRUSTED 2004 14.75 0.96 20.61 186 FROM_SUSPICIOUS_NTLD 1992 0.33 0.95 0.06 187 T_Symld_Words_02 1982 0.64 0.95 0.52 188 TR_XM_RelayPhish 1924 0.31 0.92 0.05 189 XMPhish08 1915 0.39 0.91 0.17 190 FROM_SUSPICIOUS_NTLD_FP 1910 0.31 0.91 0.06 191 XMPhish30 1874 0.61 0.89 0.49 192 FONT_INVIS_LONG_LINE 1863 0.33 0.89 0.10 193 T_HTML_TAG_BALANCE_CENTER 1847 0.37 0.88 0.15 194 XMSlimDrugH 1827 0.40 0.87 0.20 195 XMSubMetaSxObfu_03 1801 0.56 0.86 0.44 196 TR_Sbj_FN_Bdy 1784 0.32 0.85 0.10 197 HTML_FONT_FACE_BAD 1765 10.19 0.84 14.16 198 RCVD_IN_IADB_VOUCHED 1757 1.98 0.84 2.47 199 DKIM_ADSP_CUSTOM_MED 1725 0.79 0.82 0.77 200 ANY_BOUNCE_MESSAGE 1719 8.49 0.82 11.75 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 406485 86.66 96.79 82.36 2 RELAYCOUNTRY_US 378636 76.37 75.55 76.71 3 XM_B_Unicode 340113 71.95 79.10 68.91 4 DCC_CHECK_NEGATIVE 329322 52.41 18.72 66.72 5 DKIM_SIGNED 294077 67.63 86.58 59.58 6 XM_DK_Pass 288852 66.38 84.89 58.52 7 DKIM_VALID 281542 64.78 83.00 57.04 8 BAYES_50 260830 46.72 32.29 52.85 9 DKIM_VALID_AU 216117 49.72 63.68 43.79 10 XM_B_Unicode3 211863 42.78 42.45 42.92 11 XMListUnsubscribeExists 202455 50.44 72.63 41.02 12 XM_B_SpammyWords 201418 49.00 68.29 40.81 13 DCC_CHECK 156422 45.90 79.35 31.69 14 RCVD_IN_MSPIKE_WL 118457 23.81 23.38 24.00 15 HTML_FONT_LOW_CONTRAST 114700 26.30 33.52 23.24 16 DKIM_VALID_EF 110852 24.70 29.99 22.46 17 T_TM2_M_HEADER_IN_MSG 109415 21.42 19.64 22.17 18 MIME_HTML_ONLY 109408 25.15 32.16 22.17 19 ALL_TRUSTED 101718 14.75 0.96 20.61 20 RCVD_IN_MSPIKE_H2 100303 23.05 29.47 20.32 21 LOC_TINY_FONT_1 94672 24.68 37.62 19.18 22 FVGT_m_MULTI_ODD 92668 21.72 28.67 18.78 23 XMSubLong 82888 18.63 22.94 16.79 24 HTML_IMAGE_RATIO_04 81255 13.41 6.23 16.46 25 BAYES_00 76990 11.11 0.55 15.60 26 XM_B_SpammyWords2 76283 23.07 40.98 15.46 27 T_KAM_HTML_FONT_INVALID 71765 18.28 27.08 14.54 28 XM_H_Trusted_IP 71216 10.13 0.00 14.43 29 XM_Multi_Part_URI 70142 14.36 14.71 14.21 30 HTML_FONT_FACE_BAD 69887 10.19 0.84 14.16 31 RCVD_IN_MSPIKE_H3 63218 12.80 12.79 12.81 32 ANY_BOUNCE_MESSAGE 57984 8.49 0.82 11.75 33 BOUNCE_MESSAGE 57974 8.49 0.81 11.75 34 TM2_M_URI_OPT_OUT 54383 8.81 3.63 11.02 35 XMStrtUSub 53990 9.06 4.63 10.94 36 MPART_ALT_DIFF 47766 9.69 9.72 9.68 37 RCVD_IN_MSPIKE_H4 44744 9.22 9.59 9.07 38 XM_Body_Dirty_Words 42537 11.82 19.37 8.62 39 XM_Evil_Numbers_Gen 39806 8.79 10.51 8.06 40 MIME_HTML_ONLY_MULTI 39422 6.56 3.20 7.99 41 BAYES_60 39266 7.75 7.27 7.96 42 LotsOfNums_01 37822 7.98 8.71 7.66 43 XM_B_Unsub 35486 8.49 11.56 7.19 44 RCVD_IN_RP_SAFE 34300 6.07 4.01 6.95 45 XM_DK_Undo_02 34222 20.83 53.53 6.93 46 XM_DKIMWhitelistDomains 33619 4.80 0.08 6.81 47 TooManyTo_001 32756 6.38 5.79 6.64 48 RCVD_IN_RP_CERTIFIED 31044 5.29 2.94 6.29 49 UNPARSEABLE_RELAY 30120 6.82 8.50 6.10 50 LOTS_OF_MONEY 28741 9.29 17.44 5.82 51 XM_SendGrid 27314 5.86 6.64 5.53 52 TR_XM_DK_Bayes 25963 3.82 0.44 5.26 53 BAYES_99 25801 16.58 43.30 5.23 54 HTML_IMAGE_RATIO_06 25435 4.61 3.32 5.15 55 TR_XM_DK_Bayes1 25374 3.74 0.43 5.14 56 HTML_IMAGE_RATIO_02 25096 5.97 8.06 5.08 57 TR_XM_UnparsRelay 25061 6.07 8.40 5.08 58 FSL_BULK_SIG 23035 6.42 10.56 4.67 59 MIME_QP_LONG_LINE 22841 4.19 3.17 4.63 60 TR_XM_DK_Bayes2 22648 3.32 0.33 4.59 61 IN_ZIMBRA_NJ_WHITELIST 22640 3.23 0.04 4.59 62 BAYES_40 22371 3.78 2.01 4.53 63 XM_H_Long_From01 21750 4.99 6.37 4.41 64 RCVD_IN_IADB_LISTED 21365 3.70 2.23 4.33 65 TR_XM_DKIM_Undo 21326 15.57 42.05 4.32 66 BAYES_20 21121 3.35 1.15 4.28 67 XMSubNoVowel 21037 3.18 0.64 4.26 68 BAYES_999 20759 13.47 35.29 4.21 69 BAYES_80 20535 5.30 8.00 4.16 70 BOTNET_IPINHOSTNAME 19692 6.41 12.12 3.99 71 RCVD_IN_IADB_SPF 18960 3.30 2.03 3.84 72 RELAYCOUNTRY_META 18900 9.14 21.63 3.83 73 T_TooManySym_01 18610 3.13 1.63 3.77 74 TR_XM_SpammyWords4 18283 7.28 15.71 3.70 75 T_XMDrugObfuBody_00 17242 2.82 1.25 3.49 76 RCVD_IN_IADB_SENDERID 17210 3.02 1.91 3.49 77 XM_PDF 17090 2.64 0.71 3.46 78 XM_B_SpammyWords3 17077 6.58 13.93 3.46 79 TR_XM_DK_SendGrid 16909 3.49 3.63 3.43 80 RCVD_IN_IADB_DK 16732 2.96 1.94 3.39 81 XMSubMetaSx_00 14861 3.74 5.44 3.01 82 T_REMOTE_IMAGE 14857 3.22 3.70 3.01 83 XM_B_Phish_Phrases 14116 3.86 6.23 2.86 84 BAYES_05 13582 2.12 0.64 2.75 85 XMSexyCombo_05 13573 4.89 9.92 2.75 86 XM_UncommonTLD01 13348 6.32 14.82 2.70 87 XMNumbers 13321 3.32 4.77 2.70 88 BAYES_95 13073 3.29 4.79 2.65 89 DKIM_INVALID 12535 2.85 3.58 2.54 90 FROM_EXCESS_BASE64 12482 2.54 2.57 2.53 91 TR_DCC_Bayes_99 12403 11.84 33.80 2.51 92 TR_XM_PhishingBody 12281 3.62 6.29 2.49 93 RCVD_IN_IADB_VOUCHED 12185 1.98 0.84 2.47 94 T_TooManySym_02 11100 1.70 0.40 2.25 95 RCVD_IN_MSPIKE_H5 10495 1.79 0.99 2.13 96 MIME_HTML_MOSTLY 10339 3.86 8.02 2.09 97 URI_NOVOWEL 10067 1.85 1.39 2.04 98 MAILING_LIST_MULTI 9358 1.76 1.42 1.90 99 TVD_RCVD_IP 9355 1.36 0.09 1.90 100 HTML_MIME_NO_HTML_TAG 8962 2.39 3.74 1.82 101 HTML_IMAGE_RATIO_08 8815 2.03 2.59 1.79 102 XMSubGarbage 8512 1.22 0.04 1.72 103 XMSubLongNoVowel 8396 1.23 0.14 1.70 104 TR_XM_SB_Phish 7973 1.70 1.90 1.62 105 XMSubPhish11 7833 1.67 1.86 1.59 106 XM_B_SpammyTLD 7806 2.24 3.81 1.58 107 RCVD_IN_IADB_OPTIN 7715 1.27 0.57 1.56 108 TooManyTo_002 7499 1.26 0.64 1.52 109 KHOP_HELO_FCRDNS 7467 3.04 6.63 1.51 110 T_XMDrugObfuBody_14 7393 1.87 2.76 1.50 111 TR_XM_SpammyWords5 7099 2.49 4.95 1.44 112 XM_SPF_SoftFail 6943 1.89 3.02 1.41 113 INVALID_MSGID 6940 1.15 0.54 1.41 114 XM_CamelCaseFrm001 6921 1.67 2.29 1.40 115 HELO_NODOT 6789 1.12 0.51 1.38 116 HELO_NO_DOMAIN 6787 1.09 0.41 1.38 117 URIBL_SBL_A 6753 2.83 6.26 1.37 118 IN_HORDE_ADDRESS_BOOK 6708 0.98 0.07 1.36 119 XM_B_Phish66 6677 1.98 3.44 1.35 120 BOTNET 6657 5.49 15.24 1.35 121 XMDiploma_00 6483 2.10 3.95 1.31 122 SUBJ_ALL_CAPS 6469 1.72 2.67 1.31 123 MSGID_NOFQDN1 6391 0.92 0.03 1.29 124 UNTRUSTED_Relay 6351 5.31 14.79 1.29 125 TO_MALFORMED 6224 1.00 0.39 1.26 126 RELAYCOUNTRY_CA 5836 3.34 8.42 1.18 127 URI_HEX 5701 1.80 3.31 1.16 128 XM_DK_Undo_01 5598 2.23 4.81 1.13 129 XM_H_Long_From02 5546 1.03 0.80 1.12 130 HELO_MISC_IP 5407 0.79 0.06 1.10 131 XMBSHREFv2 5238 0.83 0.29 1.06 132 TR_Symld_Words 5182 0.97 0.79 1.05 133 XM_B_Unsub2 5027 1.38 2.24 1.02 134 TR_XM_SpammyWords2 5023 5.77 16.97 1.02 135 XM_E_Blogspot 4993 0.72 0.05 1.01 136 USER_IN_DEF_DKIM_WL 4967 0.71 0.02 1.01 137 TooManyTo_003 4858 0.83 0.48 0.98 138 RELAYCOUNTRY_GB 4759 0.88 0.70 0.96 139 T_XMDrugObfuBody_08 4744 1.15 1.61 0.96 140 TM2_M_VERY_LONG_WORD 4673 1.25 1.97 0.95 141 TR_LOTS_OF_MONEY3 4383 2.56 6.49 0.89 142 URI_TRY_3LD 4357 1.28 2.21 0.88 143 XMGappySubj_01 4118 0.61 0.10 0.83 144 XM_UB50 4012 2.21 5.49 0.81 145 RCVD_IN_BL_SPAMCOP_NET 4000 3.55 9.99 0.81 146 XM_GoogleGroups 3899 0.67 0.39 0.79 147 XMBody_95 3888 0.58 0.09 0.79 148 XM_OfRef6 3862 2.15 5.36 0.78 149 XM_B_COVIDMETA 3814 1.31 2.56 0.77 150 DKIM_ADSP_CUSTOM_MED 3800 0.79 0.82 0.77 151 XMCapTrack 3790 0.61 0.23 0.77 152 T_XMHurry_00 3773 1.38 2.82 0.76 153 TooManyTo_004 3563 0.63 0.40 0.72 154 XMHTML_After_End 3474 0.82 1.08 0.70 155 TVD_SPACE_RATIO 3438 0.51 0.06 0.70 156 XMGenDplmaNmb 3411 1.00 1.71 0.69 157 SpammyFromTLD_01 3273 1.91 4.85 0.66 158 XM_H_PHPMailer 3135 0.64 0.66 0.64 159 XMStockSpam_06 3123 0.89 1.49 0.63 160 HTTPS_HTTP_MISMATCH 3041 0.86 1.43 0.62 161 XMSubMetaI_00 2954 0.78 1.22 0.60 162 TooManyTo_005 2881 0.50 0.32 0.58 163 TR_MSPIKEBAYES00 2770 0.40 0.02 0.56 164 XMSolicitRefs_0 2743 0.50 0.37 0.56 165 XM_B_SpammyWords4 2715 1.02 2.12 0.55 166 XM_ShortIntro_01 2709 0.46 0.25 0.55 167 XMBrknScrpt_02 2699 1.03 2.16 0.55 168 T_FILL_THIS_FORM_SHORT 2663 1.51 3.79 0.54 169 NML_ADSP_CUSTOM_MED 2643 0.58 0.68 0.54 170 XM_ProductURIs 2555 0.57 0.70 0.52 171 T_Symld_Words_02 2546 0.64 0.95 0.52 172 T_TooManySym_03 2507 0.40 0.15 0.51 173 RELAYCOUNTRY_DE 2496 0.94 1.95 0.51 174 XMPhish30 2417 0.61 0.89 0.49 175 PDS_OTHER_BAD_TLD 2401 0.91 1.90 0.49 176 HTML_IMAGE_ONLY_20 2359 0.42 0.28 0.48 177 MSGID_FROM_MTA_HEADER 2348 0.37 0.11 0.48 178 SHORT_HELO_AND_INLINE_IMAGE 2331 0.34 0.03 0.47 179 TR_XM_COVIDMETA4 2320 0.78 1.50 0.47 180 RDNS_DYNAMIC 2265 0.51 0.64 0.46 181 TR_MetaPhish_Combo_01 2255 0.53 0.70 0.46 182 RCVD_IN_SORBS_DUL 2253 0.35 0.09 0.46 183 DIET_1 2240 0.68 1.21 0.45 184 XMSexyCombo_01 2226 0.83 1.72 0.45 185 FORGED_GMAIL_RCVD 2212 0.98 2.23 0.45 186 T_OBFU_PDF_ATTACH 2192 0.37 0.19 0.44 187 XMBody_17 2186 1.15 2.81 0.44 188 XMBdyGiftCard01 2167 1.19 2.96 0.44 189 XM_SPF_Unknown 2154 0.47 0.55 0.44 190 XMSubMetaSxObfu_03 2152 0.56 0.86 0.44 191 XMMoneyMeta_00 2135 0.52 0.74 0.43 192 XMHTMLBadTable_001 2077 0.49 0.65 0.42 193 XMLngstWrd_00 2011 0.39 0.36 0.41 194 XMPhish14 2009 0.48 0.65 0.41 195 TM2_M_BODY_EMPTY 1991 0.30 0.06 0.40 196 USER_IN_WHITELIST 1833 0.26 0.00 0.37 197 USER_IN_WELCOMELIST 1833 0.26 0.00 0.37 198 XM_B_COPY_HTML 1814 0.41 0.50 0.37 199 XMLngstWrd_01 1805 0.35 0.33 0.37 200 XMNoVowels 1746 0.37 0.41 0.35 ----------------------------------------------------------------------