Email: 594723 Autolearn: 0 AvgScore: 4.52 AvgScanTime: 1.23 sec Spam: 200540 Autolearn: 0 AvgScore: 14.30 AvgScanTime: 1.37 sec Ham: 394183 Autolearn: 0 AvgScore: -0.46 AvgScanTime: 1.15 sec Time Spent Running SA: 202.84 hours Time Spent Processing Spam: 76.59 hours Time Spent Processing Ham: 126.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 194704 85.59 97.09 79.74 2 DKIM_SIGNED 171471 76.34 85.50 71.67 3 XM_DK_Pass 168622 75.17 84.08 70.64 4 DKIM_VALID 164228 73.39 81.89 69.06 5 DCC_CHECK 163981 53.36 81.77 38.90 6 XM_B_Unicode 158319 70.21 78.95 65.76 7 RELAYCOUNTRY_US 149695 75.27 74.65 75.59 8 XMListUnsubscribeExists 144173 57.76 71.89 50.57 9 XM_B_SpammyWords 138463 51.05 69.05 41.90 10 DKIM_VALID_AU 126733 56.00 63.20 52.34 11 XM_DK_Undo_02 106897 23.63 53.30 8.53 12 BAYES_99 88350 19.30 44.06 6.71 13 TR_XM_DKIM_Undo 83733 17.45 41.75 5.08 14 XM_B_Unicode3 81276 39.30 40.53 38.67 15 XM_B_SpammyWords2 75618 23.86 37.71 16.81 16 TR_DCC_Bayes_99 71791 14.20 35.80 3.21 17 LOC_TINY_FONT_1 71366 27.23 35.59 22.98 18 BAYES_999 71301 15.61 35.55 5.46 19 MIME_HTML_ONLY 67759 23.63 33.79 18.46 20 HTML_FONT_LOW_CONTRAST 64527 28.78 32.18 27.05 21 BAYES_50 59854 46.82 29.85 55.45 22 RCVD_IN_MSPIKE_H2 59044 25.97 29.44 24.21 23 FVGT_m_MULTI_ODD 59016 25.81 29.43 23.96 24 DKIM_VALID_EF 58196 27.46 29.02 26.66 25 T_KAM_HTML_FONT_INVALID 53269 20.84 26.56 17.93 26 RCVD_IN_MSPIKE_WL 47750 27.72 23.81 29.71 27 RELAYCOUNTRY_META 44052 10.26 21.97 4.30 28 T_TM2_M_HEADER_IN_MSG 38652 22.05 19.27 23.46 29 XMSubLong 37753 17.69 18.83 17.12 30 LOTS_OF_MONEY 37681 11.84 18.79 8.30 31 XM_Body_Dirty_Words 35311 13.32 17.61 11.14 32 DCC_CHECK_NEGATIVE 33321 45.01 16.62 59.45 33 TR_XM_SpammyWords4 33085 9.27 16.50 5.60 34 TR_XM_SpammyWords2 31233 5.82 15.57 0.85 35 UNTRUSTED_Relay 29874 6.23 14.90 1.82 36 XM_UncommonTLD01 28393 6.81 14.16 3.07 37 BOTNET 27666 5.65 13.80 1.51 38 XM_Multi_Part_URI 27198 14.91 13.56 15.60 39 FSL_BULK_SIG 26056 7.86 12.99 5.24 40 RCVD_IN_MSPIKE_H3 25544 14.87 12.74 15.95 41 XM_B_SpammyWords3 23728 6.55 11.83 3.86 42 BOTNET_IPINHOSTNAME 23183 7.08 11.56 4.80 43 XM_B_Unsub 22785 9.83 11.36 9.05 44 RCVD_IN_BL_SPAMCOP_NET 21003 4.06 10.47 0.79 45 RCVD_IN_MSPIKE_H4 20192 10.78 10.07 11.14 46 XMSexyCombo_05 20153 5.58 10.05 3.30 47 XM_Evil_Numbers_Gen 19800 8.73 9.87 8.15 48 UNPARSEABLE_RELAY 19771 8.33 9.86 7.55 49 TR_XM_UnparsRelay 19504 7.61 9.73 6.53 50 BAYES_80 18346 6.53 9.15 5.19 51 LotsOfNums_01 17992 8.75 8.97 8.64 52 RELAYCOUNTRY_CA 17066 3.83 8.51 1.45 53 HTML_IMAGE_RATIO_02 16780 7.66 8.37 7.30 54 MPART_ALT_DIFF 16297 5.39 8.13 4.00 55 TR_LOTS_OF_MONEY3 16224 4.06 8.09 2.01 56 XM_SendGrid 16158 7.28 8.06 6.88 57 KHOP_HELO_FCRDNS 15569 3.70 7.76 1.63 58 HTML_SHORT_LINK_IMG_1 15136 2.56 7.55 0.02 59 BAYES_60 14093 8.92 7.03 9.88 60 SpammyFromTLD_02 13553 2.45 6.76 0.26 61 XMSubMetaSx_00 13459 4.27 6.71 3.03 62 XM_B_Phish_Phrases 12361 4.24 6.16 3.26 63 MIME_HTML_MOSTLY 12090 3.34 6.03 1.97 64 BODY_URI_ONLY 11561 1.95 5.76 0.00 65 URIBL_SBL_A 11377 2.84 5.67 1.40 66 XM_H_Long_From01 11367 5.41 5.67 5.28 67 TR_XM_PhishingBody 11130 3.48 5.55 2.42 68 BAYES_95 11107 4.09 5.54 3.36 69 HTML_IMAGE_RATIO_04 10748 5.27 5.36 5.23 70 HTML_FONT_SIZE_LARGE 10549 1.87 5.26 0.15 71 XMStrtUSub 10390 4.49 5.18 4.14 72 HTML_IMAGE_ONLY_12 10229 1.81 5.10 0.14 73 TR_XM_DK_SendGrid 9971 4.36 4.97 4.04 74 T_XMHurry_00 9953 2.89 4.96 1.84 75 TooManyTo_001 9757 6.13 4.87 6.77 76 RCVD_IN_RP_SAFE 9642 6.98 4.81 8.09 77 XMNumbers 9297 3.57 4.64 3.02 78 T_REMOTE_IMAGE 9148 3.67 4.56 3.22 79 XMDiploma_00 8829 2.57 4.40 1.64 80 SpammyFromTLD_01 8775 1.81 4.38 0.51 81 TR_XM_SpammyWords5 8747 2.39 4.36 1.39 82 XM_OfRef6 8679 2.05 4.33 0.89 83 HTML_IMAGE_RATIO_06 7943 3.61 3.96 3.43 84 HTML_MIME_NO_HTML_TAG 7541 2.81 3.76 2.32 85 XM_UB50 7457 1.92 3.72 1.01 86 TR_XM_MaxBayes 7348 1.27 3.66 0.05 87 RCVD_IN_RP_CERTIFIED 7346 6.04 3.66 7.25 88 DKIM_INVALID 7243 2.95 3.61 2.62 89 RCVD_IN_MSPIKE_BL 7203 1.27 3.59 0.09 90 TR_XM_MSPIKECOMBO 7160 1.26 3.57 0.09 91 XM_DK_Undo_01 7111 1.95 3.55 1.14 92 XMBdyGiftCard01 7084 1.47 3.53 0.41 93 XM_B_SpammyTLD 7019 2.37 3.50 1.80 94 XM_UB99 6818 1.15 3.40 0.00 95 URI_HEX 6528 2.00 3.26 1.37 96 XM_B_Phish66 6512 2.01 3.25 1.38 97 TM2_M_URI_OPT_OUT 6486 8.87 3.23 11.74 98 MIME_QP_LONG_LINE 6161 4.75 3.07 5.60 99 XM_SPF_SoftFail 6143 2.10 3.06 1.61 100 FROM_EXCESS_BASE64 6121 2.71 3.05 2.53 101 XM_DIRTYINTL 5952 1.22 2.97 0.34 102 XMBody_17 5836 1.33 2.91 0.53 103 T_FILL_THIS_FORM_SHORT 5727 1.41 2.86 0.67 104 TR_XM_BayesRelay 5656 0.97 2.82 0.02 105 RELAYCOUNTRY_DE 5562 1.37 2.77 0.65 106 BOTNET_NORDNS 5522 0.94 2.75 0.02 107 XM_UB80 5422 0.94 2.70 0.04 108 RCVD_IN_PSBL 5309 0.99 2.65 0.14 109 T_XMDrugObfuBody_14 5271 2.15 2.63 1.90 110 MIME_HTML_ONLY_MULTI 5271 2.45 2.63 2.37 111 HTML_IMAGE_RATIO_08 5069 2.15 2.53 1.95 112 RELAYCOUNTRY_FR 5022 1.01 2.50 0.24 113 XM_CamelCaseFrm001 4779 1.97 2.38 1.75 114 TR_XM_SpammyWords3 4725 0.83 2.36 0.05 115 XM_UB999 4697 0.79 2.34 0.00 116 SUBJ_ALL_CAPS 4623 1.59 2.31 1.23 117 RCVD_IN_RP_RNBL 4538 0.78 2.26 0.03 118 URI_TRY_3LD 4503 1.57 2.25 1.23 119 TM2_M_VERY_LONG_WORD 4407 1.69 2.20 1.43 120 DKIM_ADSP_NXDOMAIN 4228 0.92 2.11 0.32 121 XMBrknScrpt_02 4210 1.16 2.10 0.68 122 TR_XM_FormFill 4185 0.72 2.09 0.02 123 XM_UB60 4158 0.79 2.07 0.14 124 HDRS_MISSP 4135 0.80 2.06 0.16 125 PDS_OTHER_BAD_TLD 4097 1.05 2.04 0.55 126 RCVD_IN_IADB_LISTED 4061 4.45 2.03 5.69 127 RCVD_IN_MSPIKE_L5 4001 0.70 2.00 0.04 128 MIME_HEADER_CTYPE_ONLY 3811 0.70 1.90 0.08 129 HTML_IMAGE_ONLY_08 3729 0.68 1.86 0.09 130 T_XMDrugObfuBody_08 3706 1.40 1.85 1.17 131 RCVD_IN_IADB_SPF 3667 3.90 1.83 4.96 132 HDRS_LCASE_IMGONLY 3624 0.62 1.81 0.02 133 URIBL_DBL_SPAM 3605 0.61 1.80 0.01 134 RCVD_IN_IADB_DK 3490 3.41 1.74 4.26 135 BAYES_20 3466 2.15 1.73 2.36 136 XM_B_Unsub2 3442 1.45 1.72 1.32 137 RCVD_IN_IADB_SENDERID 3438 3.51 1.71 4.42 138 HTML_TITLE_SUBJ_DIFF 3437 0.61 1.71 0.05 139 FORGED_GMAIL_RCVD 3351 0.92 1.67 0.53 140 XM_B_COVIDMETA 3339 1.00 1.67 0.67 141 URI_NOVOWEL 3328 2.55 1.66 3.00 142 TR_XM_SB_Phish 3311 2.02 1.65 2.21 143 HK_RANDOM_REPLYTO 3299 0.63 1.65 0.11 144 XM_URI_RBL 3183 0.66 1.59 0.19 145 HTTPS_HTTP_MISMATCH 3167 1.06 1.58 0.79 146 T_TooManySym_01 3124 3.51 1.56 4.51 147 XM_B_SpammyWords4 3061 0.75 1.53 0.35 148 HTML_FONT_SIZE_HUGE 3026 0.65 1.51 0.21 149 XM_UB95 3015 0.51 1.50 0.01 150 XMSubPhish11 2977 1.95 1.48 2.19 151 NAME_EMAIL_DIFF 2974 0.65 1.48 0.23 152 TR_Mismatch_TLD_01 2961 0.66 1.48 0.24 153 TR_XM_INV_DKIM 2950 0.56 1.47 0.10 154 MAILING_LIST_MULTI 2919 2.09 1.46 2.42 155 XMGenDplmaNmb 2918 0.97 1.46 0.73 156 XMStockSpam_06 2873 1.32 1.43 1.27 157 RELAYCOUNTRY_GB 2829 0.94 1.41 0.71 158 URI_PHP_REDIR 2822 0.48 1.41 0.00 159 BAYES_40 2821 2.62 1.41 3.24 160 SHORT_URI_3 2774 0.49 1.38 0.04 161 XMSexyCombo_01 2734 0.80 1.36 0.52 162 RELAYCOUNTRY_IN 2690 0.49 1.34 0.06 163 URIBL_BLACK 2683 0.48 1.34 0.04 164 TR_XM_COVIDMETA1 2681 0.65 1.34 0.30 165 TR_XM_COVIDMETA4 2676 0.62 1.33 0.25 166 T_XMDrugObfuBody_00 2633 2.75 1.31 3.49 167 T_HTML_TAG_BALANCE_CENTER 2629 0.59 1.31 0.22 168 XMSubMetaSSx_00 2578 0.50 1.29 0.10 169 TR_XM_PHPDW 2427 0.63 1.21 0.33 170 DIET_1 2383 0.63 1.19 0.35 171 TR_Caps_n_Bayes_99 2267 0.45 1.13 0.10 172 XM_Body_Obfu01 2242 0.56 1.12 0.27 173 SHORT_SHORTNER 2209 0.38 1.10 0.01 174 TR_XM_PHPForged 2150 0.54 1.07 0.26 175 XMSlimDrugH 2146 0.49 1.07 0.20 176 NO_FM_NAME_IP_HOSTN 2100 0.35 1.05 0.00 177 TR_XM_FormFill2 2083 0.53 1.04 0.27 178 XM_H_PHPOS 2072 0.52 1.03 0.26 179 XM_JunkDunk 2067 0.35 1.03 0.00 180 XM_OfRef7 2022 0.41 1.01 0.11 181 RCVD_IN_MSPIKE_H5 2014 2.07 1.00 2.61 182 SHORTENED_URL_SRC 1966 0.33 0.98 0.00 183 FROM_NO_USER 1966 0.33 0.98 0.00 184 GOOGLE_DOC_SUSP 1949 0.33 0.97 0.00 185 URIBL_DBL_ABUSE_REDIR 1946 0.33 0.97 0.00 186 SHORTENER_SHORT_IMG 1945 0.33 0.97 0.00 187 NO_DNS_FOR_FROM 1910 0.49 0.95 0.25 188 TR_XM_MaxWHORU 1904 0.48 0.95 0.24 189 XMPhish08 1851 0.43 0.92 0.17 190 RCVD_IN_MSPIKE_L3 1821 0.33 0.91 0.03 191 XMSubMetaI_00 1786 0.63 0.89 0.50 192 FROM_SUSPICIOUS_NTLD 1760 0.35 0.88 0.08 193 FROM_SUSPICIOUS_NTLD_FP 1712 0.34 0.85 0.07 194 XM_XX_Yahoo 1706 0.36 0.85 0.11 195 ALL_TRUSTED 1705 14.17 0.85 20.95 196 XMHTMLBadTable_001 1696 0.65 0.85 0.55 197 XM_Body_Dirty_Words_01 1680 0.38 0.84 0.14 198 T_Symld_Words_02 1671 0.56 0.83 0.42 199 DEAR_FRIEND 1655 0.39 0.83 0.17 200 RCVD_IN_IADB_VOUCHED 1631 2.71 0.81 3.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 314336 85.59 97.09 79.74 2 RELAYCOUNTRY_US 297959 75.27 74.65 75.59 3 DKIM_SIGNED 282527 76.34 85.50 71.67 4 XM_DK_Pass 278435 75.17 84.08 70.64 5 DKIM_VALID 272214 73.39 81.89 69.06 6 XM_B_Unicode 259208 70.21 78.95 65.76 7 DCC_CHECK_NEGATIVE 234347 45.01 16.62 59.45 8 BAYES_50 218581 46.82 29.85 55.45 9 DKIM_VALID_AU 206307 56.00 63.20 52.34 10 XMListUnsubscribeExists 199337 57.76 71.89 50.57 11 XM_B_SpammyWords 165161 51.05 69.05 41.90 12 DCC_CHECK 153338 53.36 81.77 38.90 13 XM_B_Unicode3 152432 39.30 40.53 38.67 14 RCVD_IN_MSPIKE_WL 117096 27.72 23.81 29.71 15 HTML_FONT_LOW_CONTRAST 106634 28.78 32.18 27.05 16 DKIM_VALID_EF 105093 27.46 29.02 26.66 17 RCVD_IN_MSPIKE_H2 95418 25.97 29.44 24.21 18 FVGT_m_MULTI_ODD 94463 25.81 29.43 23.96 19 T_TM2_M_HEADER_IN_MSG 92460 22.05 19.27 23.46 20 LOC_TINY_FONT_1 90585 27.23 35.59 22.98 21 ALL_TRUSTED 82587 14.17 0.85 20.95 22 MIME_HTML_ONLY 72766 23.63 33.79 18.46 23 T_KAM_HTML_FONT_INVALID 70666 20.84 26.56 17.93 24 XMSubLong 67476 17.69 18.83 17.12 25 XM_B_SpammyWords2 66277 23.86 37.71 16.81 26 RCVD_IN_MSPIKE_H3 62890 14.87 12.74 15.95 27 XM_Multi_Part_URI 61487 14.91 13.56 15.60 28 BAYES_00 48284 8.35 0.69 12.25 29 ANY_BOUNCE_MESSAGE 46943 8.09 0.58 11.91 30 BOUNCE_MESSAGE 46926 8.09 0.58 11.90 31 TM2_M_URI_OPT_OUT 46272 8.87 3.23 11.74 32 XM_Body_Dirty_Words 43910 13.32 17.61 11.14 33 RCVD_IN_MSPIKE_H4 43906 10.78 10.07 11.14 34 BAYES_60 38963 8.92 7.03 9.88 35 XM_B_Unsub 35654 9.83 11.36 9.05 36 LotsOfNums_01 34049 8.75 8.97 8.64 37 XM_DK_Undo_02 33624 23.63 53.30 8.53 38 XM_DKIMWhitelistDomains 33401 5.62 0.02 8.47 39 LOTS_OF_MONEY 32731 11.84 18.79 8.30 40 XM_Evil_Numbers_Gen 32135 8.73 9.87 8.15 41 RCVD_IN_RP_SAFE 31871 6.98 4.81 8.09 42 UNPARSEABLE_RELAY 29776 8.33 9.86 7.55 43 HTML_IMAGE_RATIO_02 28766 7.66 8.37 7.30 44 RCVD_IN_RP_CERTIFIED 28571 6.04 3.66 7.25 45 XM_SendGrid 27121 7.28 8.06 6.88 46 TooManyTo_001 26679 6.13 4.87 6.77 47 BAYES_99 26430 19.30 44.06 6.71 48 TR_XM_UnparsRelay 25740 7.61 9.73 6.53 49 TR_XM_DK_Bayes 23353 4.04 0.35 5.92 50 TR_XM_DK_Bayes1 22930 3.97 0.34 5.82 51 RCVD_IN_IADB_LISTED 22430 4.45 2.03 5.69 52 MIME_QP_LONG_LINE 22091 4.75 3.07 5.60 53 TR_XM_SpammyWords4 22059 9.27 16.50 5.60 54 BAYES_999 21526 15.61 35.55 5.46 55 XM_H_Long_From01 20799 5.41 5.67 5.28 56 FSL_BULK_SIG 20672 7.86 12.99 5.24 57 HTML_IMAGE_RATIO_04 20606 5.27 5.36 5.23 58 TR_XM_DK_Bayes2 20586 3.57 0.32 5.22 59 BAYES_80 20477 6.53 9.15 5.19 60 IN_ZIMBRA_NJ_WHITELIST 20058 3.38 0.03 5.09 61 TR_XM_DKIM_Undo 20039 17.45 41.75 5.08 62 RCVD_IN_IADB_SPF 19536 3.90 1.83 4.96 63 BOTNET_IPINHOSTNAME 18929 7.08 11.56 4.80 64 T_TooManySym_01 17770 3.51 1.56 4.51 65 RCVD_IN_IADB_SENDERID 17441 3.51 1.71 4.42 66 RELAYCOUNTRY_META 16964 10.26 21.97 4.30 67 RCVD_IN_IADB_DK 16809 3.41 1.74 4.26 68 XMStrtUSub 16324 4.49 5.18 4.14 69 XM_PDF 16254 2.92 0.55 4.12 70 TR_XM_DK_SendGrid 15932 4.36 4.97 4.04 71 MPART_ALT_DIFF 15767 5.39 8.13 4.00 72 XM_B_SpammyWords3 15221 6.55 11.83 3.86 73 RCVD_IN_IADB_VOUCHED 14457 2.71 0.81 3.67 74 T_XMDrugObfuBody_00 13741 2.75 1.31 3.49 75 HTML_IMAGE_RATIO_06 13531 3.61 3.96 3.43 76 BAYES_95 13237 4.09 5.54 3.36 77 XMSexyCombo_05 13005 5.58 10.05 3.30 78 XM_B_Phish_Phrases 12851 4.24 6.16 3.26 79 BAYES_40 12761 2.62 1.41 3.24 80 T_REMOTE_IMAGE 12703 3.67 4.56 3.22 81 TR_DCC_Bayes_99 12642 14.20 35.80 3.21 82 XM_UncommonTLD01 12085 6.81 14.16 3.07 83 XMSubMetaSx_00 11942 4.27 6.71 3.03 84 XMNumbers 11915 3.57 4.64 3.02 85 URI_NOVOWEL 11822 2.55 1.66 3.00 86 DKIM_INVALID 10313 2.95 3.61 2.62 87 RCVD_IN_MSPIKE_H5 10300 2.07 1.00 2.61 88 FROM_EXCESS_BASE64 9967 2.71 3.05 2.53 89 TVD_RCVD_IP 9560 1.63 0.07 2.43 90 TR_XM_PhishingBody 9556 3.48 5.55 2.42 91 RCVD_IN_IADB_OPTIN 9538 1.78 0.53 2.42 92 MAILING_LIST_MULTI 9534 2.09 1.46 2.42 93 MIME_HTML_ONLY_MULTI 9328 2.45 2.63 2.37 94 BAYES_20 9300 2.15 1.73 2.36 95 HTML_MIME_NO_HTML_TAG 9157 2.81 3.76 2.32 96 T_TooManySym_02 9118 1.66 0.37 2.31 97 TR_XM_SB_Phish 8725 2.02 1.65 2.21 98 XMSubPhish11 8625 1.95 1.48 2.19 99 XM_H_Trusted_IP 7990 1.34 0.00 2.03 100 TR_LOTS_OF_MONEY3 7923 4.06 8.09 2.01 101 MIME_HTML_MOSTLY 7764 3.34 6.03 1.97 102 HTML_IMAGE_RATIO_08 7703 2.15 2.53 1.95 103 T_XMDrugObfuBody_14 7501 2.15 2.63 1.90 104 T_XMHurry_00 7257 2.89 4.96 1.84 105 UNTRUSTED_Relay 7171 6.23 14.90 1.82 106 XM_B_SpammyTLD 7098 2.37 3.50 1.80 107 INVALID_MSGID 6933 1.34 0.51 1.76 108 XM_CamelCaseFrm001 6909 1.97 2.38 1.75 109 XMDiploma_00 6451 2.57 4.40 1.64 110 MSGID_NOFQDN1 6441 1.09 0.03 1.63 111 KHOP_HELO_FCRDNS 6439 3.70 7.76 1.63 112 XM_SPF_SoftFail 6331 2.10 3.06 1.61 113 IN_HORDE_ADDRESS_BOOK 6255 1.07 0.06 1.59 114 TO_MALFORMED 6221 1.13 0.24 1.58 115 BAYES_05 6148 1.22 0.56 1.56 116 TooManyTo_002 6059 1.26 0.73 1.54 117 BOTNET 5959 5.65 13.80 1.51 118 USER_IN_DEF_DKIM_WL 5864 0.99 0.02 1.49 119 HELO_MISC_IP 5744 0.98 0.05 1.46 120 RELAYCOUNTRY_CA 5698 3.83 8.51 1.45 121 TM2_M_VERY_LONG_WORD 5620 1.69 2.20 1.43 122 XMBSHREFv2 5531 1.08 0.44 1.40 123 URIBL_SBL_A 5525 2.84 5.67 1.40 124 XM_GoogleGroups 5523 1.07 0.42 1.40 125 TR_XM_SpammyWords5 5475 2.39 4.36 1.39 126 XM_B_Phish66 5456 2.01 3.25 1.38 127 URI_HEX 5387 2.00 3.26 1.37 128 XM_B_Unsub2 5194 1.45 1.72 1.32 129 XMStockSpam_06 5005 1.32 1.43 1.27 130 URI_TRY_3LD 4852 1.57 2.25 1.23 131 SUBJ_ALL_CAPS 4850 1.59 2.31 1.23 132 T_XMDrugObfuBody_08 4598 1.40 1.85 1.17 133 XM_DK_Undo_01 4479 1.95 3.55 1.14 134 TR_Symld_Words 4449 0.96 0.63 1.13 135 XM_H_Long_From02 4363 0.99 0.75 1.11 136 HELO_NO_DOMAIN 4237 0.86 0.43 1.07 137 HELO_NODOT 4237 0.89 0.52 1.07 138 XM_UB50 3979 1.92 3.72 1.01 139 TooManyTo_003 3947 0.86 0.58 1.00 140 XMGappySubj_01 3931 0.70 0.13 1.00 141 XM_ProductURIs 3649 0.89 0.81 0.93 142 XMBody_95 3628 0.65 0.10 0.92 143 XM_OfRef6 3499 2.05 4.33 0.89 144 DKIM_ADSP_CUSTOM_MED 3399 0.83 0.76 0.86 145 TR_XM_SpammyWords2 3362 5.82 15.57 0.85 146 TR_MetaPhish_Combo_01 3335 0.80 0.70 0.85 147 HTML_FONT_FACE_BAD 3256 0.74 0.59 0.83 148 RCVD_IN_BL_SPAMCOP_NET 3120 4.06 10.47 0.79 149 HTTPS_HTTP_MISMATCH 3109 1.06 1.58 0.79 150 TVD_SPACE_RATIO 3061 0.53 0.05 0.78 151 XMSubNoVowel 2980 0.77 0.79 0.76 152 XMCapTrack 2927 0.56 0.20 0.74 153 TooManyTo_004 2898 0.60 0.32 0.74 154 XMGenDplmaNmb 2866 0.97 1.46 0.73 155 RELAYCOUNTRY_GB 2784 0.94 1.41 0.71 156 TR_MSPIKEBAYES00 2782 0.47 0.02 0.71 157 XMBrknScrpt_02 2668 1.16 2.10 0.68 158 T_FILL_THIS_FORM_SHORT 2633 1.41 2.86 0.67 159 XM_B_COVIDMETA 2630 1.00 1.67 0.67 160 XMHTML_After_End 2595 0.70 0.79 0.66 161 RELAYCOUNTRY_DE 2568 1.37 2.77 0.65 162 TooManyTo_005 2465 0.51 0.28 0.63 163 T_TooManySym_03 2442 0.47 0.18 0.62 164 HTML_IMAGE_ONLY_20 2344 0.47 0.22 0.59 165 TVD_PH_BODY_ACCOUNTS_PRE 2294 0.40 0.06 0.58 166 T_OBFU_PDF_ATTACH 2209 0.42 0.13 0.56 167 XMHTMLBadTable_001 2168 0.65 0.85 0.55 168 PDS_OTHER_BAD_TLD 2150 1.05 2.04 0.55 169 XMLngstWrd_00 2147 0.43 0.22 0.54 170 NML_ADSP_CUSTOM_MED 2123 0.57 0.64 0.54 171 XMSubMetaSxObfu_03 2112 0.63 0.81 0.54 172 FORGED_GMAIL_RCVD 2102 0.92 1.67 0.53 173 XMBody_17 2097 1.33 2.91 0.53 174 RDNS_DYNAMIC 2037 0.55 0.63 0.52 175 XMSexyCombo_01 2032 0.80 1.36 0.52 176 SpammyFromTLD_01 2014 1.81 4.38 0.51 177 XMSubMetaI_00 1988 0.63 0.89 0.50 178 XMLngstWrd_01 1970 0.40 0.20 0.50 179 XM_ShortIntro_01 1970 0.50 0.49 0.50 180 XM_H_PHPMailer 1834 0.55 0.73 0.47 181 XMNoVowels 1831 0.47 0.47 0.46 182 XM_SPF_Unknown 1807 0.49 0.56 0.46 183 XMPhish30 1708 0.53 0.72 0.43 184 PLING_QUERY 1701 0.47 0.54 0.43 185 USER_IN_WELCOMELIST 1692 0.28 0.00 0.43 186 USER_IN_WHITELIST 1692 0.28 0.00 0.43 187 XMLngstWrd_02 1689 0.33 0.15 0.43 188 XM_B_COPY_HTML 1676 0.44 0.46 0.43 189 T_Symld_Words_02 1646 0.56 0.83 0.42 190 XM_shorewaves_Whitelist 1640 0.28 0.00 0.42 191 XMBdyGiftCard01 1630 1.47 3.53 0.41 192 FROM_GOV_SPOOF 1613 0.31 0.11 0.41 193 XMDateMe_00 1586 0.38 0.34 0.40 194 XMOemUri 1568 0.31 0.15 0.40 195 XMSolicitRefs_0 1563 0.38 0.35 0.40 196 XMBounce_01 1492 0.37 0.37 0.38 197 XMMoneyMeta_00 1482 0.49 0.71 0.38 198 FROM_GOV_DKIM_AU 1440 0.27 0.09 0.37 199 XM_B_REG_HTML 1428 0.33 0.25 0.36 200 XMPhish14 1405 0.45 0.64 0.36 ----------------------------------------------------------------------