Email: 554306 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.33 sec Spam: 138368 Autolearn: 0 AvgScore: 15.68 AvgScanTime: 1.63 sec Ham: 415938 Autolearn: 0 AvgScore: -7.08 AvgScanTime: 1.24 sec Time Spent Running SA: 205.35 hours Time Spent Processing Spam: 62.62 hours Time Spent Processing Ham: 142.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132628 88.47 95.85 86.02 2 DCC_CHECK 106056 50.22 76.65 41.43 3 DKIM_SIGNED 105761 67.34 76.43 64.31 4 RELAYCOUNTRY_US 101937 72.37 73.67 71.94 5 XM_B_Unicode 101610 71.90 73.43 71.40 6 XM_DK_Pass 99119 65.14 71.63 62.98 7 DKIM_VALID 95859 63.09 69.28 61.03 8 XM_B_SpammyWords 89972 50.85 65.02 46.13 9 XMListUnsubscribeExists 88801 45.84 64.18 39.74 10 DKIM_VALID_AU 69953 47.32 50.56 46.25 11 BAYES_50 62688 50.13 45.31 51.74 12 XM_B_Unicode3 53221 39.07 38.46 39.28 13 XM_DK_Undo_02 50961 13.69 36.83 5.99 14 XM_B_SpammyWords2 50801 26.59 36.71 23.22 15 MIME_HTML_ONLY 47879 22.33 34.60 18.25 16 LOC_TINY_FONT_1 46087 24.62 33.31 21.73 17 HTML_FONT_LOW_CONTRAST 42665 31.14 30.83 31.24 18 TR_XM_DKIM_Undo 40753 10.77 29.45 4.56 19 RCVD_IN_MSPIKE_H2 38323 23.93 27.70 22.67 20 T_KAM_HTML_FONT_INVALID 38133 18.97 27.56 16.12 21 BAYES_99 38034 10.48 27.49 4.82 22 FVGT_m_MULTI_ODD 37727 23.15 27.27 21.78 23 XMSubLong 37002 20.96 26.74 19.04 24 DKIM_VALID_EF 36410 24.67 26.31 24.12 25 T_TM2_M_HEADER_IN_MSG 33840 29.56 24.46 31.25 26 DCC_CHECK_NEGATIVE 32234 49.72 23.30 58.51 27 RELAYCOUNTRY_META 31192 9.13 22.54 4.67 28 TR_DCC_Bayes_99 28416 6.66 20.54 2.04 29 BAYES_999 28218 8.08 20.39 3.98 30 XM_Body_Dirty_Words 27894 12.57 20.16 10.04 31 FSL_BULK_SIG 25370 10.82 18.34 8.32 32 RCVD_IN_MSPIKE_WL 25178 23.12 18.20 24.76 33 UNTRUSTED_Relay 23735 5.74 17.15 1.95 34 BOTNET 22959 5.10 16.59 1.28 35 XM_Multi_Part_URI 20883 10.92 15.09 9.53 36 XM_UncommonTLD01 20341 6.10 14.70 3.24 37 LOTS_OF_MONEY 18721 8.63 13.53 7.00 38 XM_B_SpammyWords3 18482 6.38 13.36 4.06 39 BOTNET_IPINHOSTNAME 17308 5.90 12.51 3.70 40 TR_XM_SpammyWords4 16157 6.52 11.68 4.80 41 SpammyFromTLD_02 15530 3.07 11.22 0.36 42 XM_B_Unsub 15345 14.17 11.09 15.19 43 XMSexyCombo_05 13694 4.63 9.90 2.88 44 RCVD_IN_MSPIKE_H3 13559 12.35 9.80 13.20 45 UNPARSEABLE_RELAY 13288 7.73 9.60 7.10 46 TR_XM_SpammyWords2 12867 2.93 9.30 0.81 47 TR_XM_UnparsRelay 12823 6.30 9.27 5.32 48 XM_Evil_Numbers_Gen 12668 7.61 9.16 7.10 49 T_REMOTE_IMAGE 12229 5.03 8.84 3.76 50 XM_UB50 11789 3.19 8.52 1.42 51 RCVD_IN_BL_SPAMCOP_NET 11514 2.62 8.32 0.72 52 HTML_IMAGE_RATIO_02 11506 5.75 8.32 4.89 53 HTML_MIME_NO_HTML_TAG 11221 3.53 8.11 2.00 54 BAYES_60 11063 7.88 8.00 7.84 55 XM_B_Phish_Phrases 10926 4.44 7.90 3.29 56 MPART_ALT_DIFF 10922 5.12 7.89 4.19 57 KHOP_HELO_FCRDNS 10749 3.93 7.77 2.65 58 RCVD_IN_MSPIKE_H4 10516 8.89 7.60 9.31 59 BAYES_80 10410 4.63 7.52 3.67 60 XM_SendGrid 10221 6.50 7.39 6.21 61 RCVD_IN_MSPIKE_BL 10213 2.07 7.38 0.30 62 TR_XM_MSPIKECOMBO 10158 2.05 7.34 0.29 63 TR_XM_PhishingBody 10038 4.39 7.25 3.44 64 DKIM_INVALID 9902 4.25 7.16 3.28 65 T_HTML_TAG_BALANCE_CENTER 9793 1.83 7.08 0.08 66 LotsOfNums_01 9665 7.86 6.98 8.16 67 HTML_IMAGE_ONLY_08 9275 1.74 6.70 0.09 68 XMSubMetaSx_00 9224 3.86 6.67 2.92 69 XM_B_SpammyTLD 9081 3.59 6.56 2.60 70 HTML_IMAGE_RATIO_04 8130 5.50 5.88 5.37 71 MIME_HTML_MOSTLY 7988 3.05 5.77 2.15 72 PDS_OTHER_BAD_TLD 7882 1.74 5.70 0.43 73 XM_H_Long_From01 7814 4.74 5.65 4.43 74 BODY_URI_ONLY 7736 1.41 5.59 0.02 75 TooManyTo_001 7727 7.37 5.58 7.96 76 XMNumbers 7632 3.79 5.52 3.22 77 MIXED_CENTER_CASE 7585 1.37 5.48 0.00 78 MIXED_HREF_CASE 7584 1.37 5.48 0.00 79 MIXED_IMG_CASE 7576 1.37 5.48 0.00 80 MIXED_AREA_CASE 7575 1.37 5.47 0.00 81 MIXED_FONT_CASE 7573 1.37 5.47 0.00 82 MIXED_CTYPE_CASE 7090 1.28 5.12 0.00 83 BOTNET_NORDNS 6893 1.25 4.98 0.01 84 BAYES_95 6838 2.93 4.94 2.26 85 URI_NOVOWEL 6725 2.95 4.86 2.31 86 XM_B_Phish66 6388 2.73 4.62 2.10 87 TR_XM_SPAMCOP 6358 1.37 4.59 0.29 88 RELAYCOUNTRY_CA 6313 1.84 4.56 0.94 89 XM_SPF_SoftFail 5943 3.15 4.30 2.77 90 HTML_FONT_SIZE_LARGE 5815 1.12 4.20 0.10 91 TM2_M_URI_OPT_OUT 5738 3.50 4.15 3.28 92 RCVD_IN_MSPIKE_L5 5664 1.05 4.09 0.03 93 TR_XM_SpammyWords3 5596 1.18 4.04 0.23 94 MIME_QP_LONG_LINE 5393 4.65 3.90 4.90 95 TR_XM_DK_SendGrid 5357 3.84 3.87 3.83 96 URIBL_DBL_SPAM 5297 0.97 3.83 0.02 97 GOOG_STO_IMG_HTML 5273 0.95 3.81 0.00 98 ALL_TRUSTED 5099 19.43 3.69 24.67 99 TR_XM_SpammyWords5 5022 2.02 3.63 1.49 100 T_XMDrugObfuBody_14 4589 2.35 3.32 2.02 101 TR_Symld_Words 4429 2.01 3.20 1.62 102 XMStrtUSub 4408 4.12 3.19 4.44 103 RCVD_IN_RP_SAFE 4406 5.28 3.18 5.98 104 XM_DIRTYINTL 4405 1.43 3.18 0.85 105 URI_GOOG_STO_SPAMMY 4397 0.79 3.18 0.00 106 HTML_IMAGE_RATIO_06 4360 3.09 3.15 3.07 107 URI_PHP_REDIR 4278 0.78 3.09 0.01 108 MIME_HTML_ONLY_MULTI 4115 2.76 2.97 2.69 109 T_XMDrugObfuBody_08 4106 1.83 2.97 1.45 110 RCVD_IN_PSBL 4102 0.76 2.96 0.03 111 XM_OfRef6 4011 1.32 2.90 0.79 112 SpammyFromTLD_01 3883 1.24 2.81 0.72 113 XMNoVowels 3812 2.10 2.75 1.89 114 XM_B_COVIDMETA 3755 1.09 2.71 0.55 115 HTML_IMAGE_ONLY_32 3720 0.99 2.69 0.43 116 JH_SPAMMY_HEADERS 3571 0.65 2.58 0.00 117 T_TooManySym_01 3557 4.36 2.57 4.96 118 XM_UB60 3489 0.68 2.52 0.07 119 HTML_FONT_SIZE_HUGE 3471 0.66 2.51 0.05 120 RCVD_IN_RP_CERTIFIED 3460 4.56 2.50 5.25 121 XMDiploma_00 3446 1.68 2.49 1.40 122 RCVD_IN_MSPIKE_L4 3412 0.74 2.47 0.16 123 RCVD_IN_RP_RNBL 3390 0.62 2.45 0.01 124 RCVD_IN_IADB_LISTED 3297 4.06 2.38 4.62 125 XM_B_SpammyWords4 3286 1.00 2.37 0.54 126 XM_B_Unsub2 3247 5.64 2.35 6.74 127 TR_XM_COVIDMETA4 3221 0.86 2.33 0.37 128 BAYES_40 3067 4.55 2.22 5.33 129 HTML_IMAGE_RATIO_08 3052 2.02 2.21 1.96 130 URI_HEX 2980 1.38 2.15 1.13 131 TR_XM_SB_Phish 2932 2.06 2.12 2.04 132 XM_CamelCaseFrm001 2928 1.75 2.12 1.63 133 TM2_M_VERY_LONG_WORD 2922 1.32 2.11 1.05 134 XM_URI_RBL 2888 0.62 2.09 0.13 135 TR_XM_COVIDMETA1 2867 0.78 2.07 0.35 136 RCVD_IN_IADB_SPF 2844 3.58 2.06 4.08 137 ALIBABA_IMG_NOT_RCVD_ALI 2842 0.51 2.05 0.00 138 XM_DrugUnitList 2842 0.51 2.05 0.00 139 HOSTED_IMG_DIRECT_MX 2823 0.51 2.04 0.00 140 RELAYCOUNTRY_AZ 2807 0.51 2.03 0.00 141 XMLngstWrd_00 2797 0.91 2.02 0.54 142 XM_DK_Undo_01 2762 1.68 2.00 1.58 143 XMLngstWrd_01 2742 0.86 1.98 0.48 144 XMSubPhish11 2710 2.00 1.96 2.02 145 XM_UB99 2708 0.49 1.96 0.00 146 RELAYCOUNTRY_IR 2684 0.49 1.94 0.00 147 XMSexyCombo_01 2665 0.74 1.93 0.34 148 XMBrknScrpt_02 2661 0.97 1.92 0.65 149 TR_XM_PHPDW 2639 0.68 1.91 0.27 150 RCVD_IN_IADB_DK 2624 3.16 1.90 3.58 151 SUBJ_ALL_CAPS 2609 1.60 1.89 1.50 152 RCVD_IN_IADB_SENDERID 2603 3.24 1.88 3.69 153 MAILING_LIST_MULTI 2576 2.35 1.86 2.51 154 XMSlimDrugH 2531 0.67 1.83 0.29 155 XMLngstWrd_02 2530 0.76 1.83 0.41 156 TR_XM_PHPForged 2508 0.63 1.81 0.24 157 T_XMDrugObfuBody_00 2473 0.84 1.79 0.53 158 BAYES_20 2466 4.52 1.78 5.43 159 XMLngstWrd_03 2443 0.71 1.77 0.36 160 URI_TRY_3LD 2426 1.19 1.75 1.00 161 BAYES_00 2378 11.40 1.72 14.62 162 XMLngstWrd_04 2358 0.65 1.70 0.30 163 TR_XM_FormFill2 2354 0.60 1.70 0.24 164 XM_H_PHPOS 2343 0.59 1.69 0.23 165 XMStockSpam_06 2190 1.05 1.58 0.87 166 FROM_EXCESS_BASE64 2168 2.51 1.57 2.83 167 URIBL_BLACK 2141 0.41 1.55 0.03 168 XMGenDplmaNmb 2027 0.90 1.46 0.71 169 RELAYCOUNTRY_IN 2026 0.44 1.46 0.10 170 HELO_NODOT 2018 1.51 1.46 1.53 171 HELO_NO_DOMAIN 2014 1.51 1.46 1.53 172 XMBody_17 2000 0.67 1.45 0.41 173 HTTPS_HTTP_MISMATCH 1901 0.92 1.37 0.76 174 XM_UB80 1877 0.36 1.36 0.03 175 DIET_1 1871 0.56 1.35 0.30 176 TR_XM_INV_DKIM 1751 0.40 1.27 0.11 177 T_XMHurry_00 1742 1.44 1.26 1.50 178 RELAYCOUNTRY_NL 1739 0.42 1.26 0.15 179 RELAYCOUNTRY_GB 1728 1.10 1.25 1.05 180 RCVD_IN_IADB_VOUCHED 1689 2.40 1.22 2.79 181 XM_PDF 1652 3.82 1.19 4.69 182 TR_XM_BayesRelay 1613 0.29 1.17 0.00 183 XM_Body_Dirty_Words_01 1601 0.39 1.16 0.13 184 XMHTML_After_End 1595 0.97 1.15 0.92 185 T_FILL_THIS_FORM_SHORT 1595 0.85 1.15 0.75 186 RELAYCOUNTRY_FR 1591 0.81 1.15 0.69 187 XM_H_PHPMailer 1559 0.64 1.13 0.48 188 RELAYCOUNTRY_AU 1534 0.52 1.11 0.33 189 XM_UB999 1529 0.28 1.11 0.00 190 DKIM_ADSP_CUSTOM_MED 1520 0.92 1.10 0.86 191 XMWghtMeta_00 1514 0.28 1.09 0.01 192 TR_Mismatch_TLD_02 1511 0.33 1.09 0.07 193 RELAYCOUNTRY_DE 1496 0.65 1.08 0.51 194 XMMoneyMeta_00 1481 0.63 1.07 0.48 195 XM_H_Long_From02 1455 1.11 1.05 1.13 196 ANY_BOUNCE_MESSAGE 1448 2.86 1.05 3.47 197 BOUNCE_MESSAGE 1447 2.86 1.05 3.47 198 FROM_SUSPICIOUS_NTLD 1442 0.29 1.04 0.04 199 TVD_SPACE_RATIO 1437 0.67 1.04 0.55 200 BAYES_05 1401 3.46 1.01 4.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 357783 88.47 95.85 86.02 2 RELAYCOUNTRY_US 299224 72.37 73.67 71.94 3 XM_B_Unicode 296963 71.90 73.43 71.40 4 DKIM_SIGNED 267483 67.34 76.43 64.31 5 XM_DK_Pass 261942 65.14 71.63 62.98 6 DKIM_VALID 253828 63.09 69.28 61.03 7 DCC_CHECK_NEGATIVE 243378 49.72 23.30 58.51 8 BAYES_50 215205 50.13 45.31 51.74 9 DKIM_VALID_AU 192368 47.32 50.56 46.25 10 XM_B_SpammyWords 191886 50.85 65.02 46.13 11 DCC_CHECK 172321 50.22 76.65 41.43 12 XMListUnsubscribeExists 165280 45.84 64.18 39.74 13 XM_B_Unicode3 163364 39.07 38.46 39.28 14 T_TM2_M_HEADER_IN_MSG 129999 29.56 24.46 31.25 15 HTML_FONT_LOW_CONTRAST 129919 31.14 30.83 31.24 16 RCVD_IN_MSPIKE_WL 102972 23.12 18.20 24.76 17 ALL_TRUSTED 102607 19.43 3.69 24.67 18 DKIM_VALID_EF 100330 24.67 26.31 24.12 19 XM_B_SpammyWords2 96592 26.59 36.71 23.22 20 RCVD_IN_MSPIKE_H2 94304 23.93 27.70 22.67 21 FVGT_m_MULTI_ODD 90606 23.15 27.27 21.78 22 LOC_TINY_FONT_1 90389 24.62 33.31 21.73 23 XMSubLong 79207 20.96 26.74 19.04 24 MIME_HTML_ONLY 75924 22.33 34.60 18.25 25 T_KAM_HTML_FONT_INVALID 67036 18.97 27.56 16.12 26 XM_B_Unsub 63186 14.17 11.09 15.19 27 BAYES_00 60808 11.40 1.72 14.62 28 RCVD_IN_MSPIKE_H3 54918 12.35 9.80 13.20 29 USER_IN_DEF_DKIM_WL 42731 7.92 0.87 10.27 30 XM_Body_Dirty_Words 41767 12.57 20.16 10.04 31 XM_Multi_Part_URI 39651 10.92 15.09 9.53 32 RCVD_IN_MSPIKE_H4 38736 8.89 7.60 9.31 33 FSL_BULK_SIG 34589 10.82 18.34 8.32 34 LotsOfNums_01 33927 7.86 6.98 8.16 35 TooManyTo_001 33100 7.37 5.58 7.96 36 BAYES_60 32628 7.88 8.00 7.84 37 TR_XM_DK_Bayes 30078 5.60 0.68 7.23 38 UNPARSEABLE_RELAY 29542 7.73 9.60 7.10 39 XM_Evil_Numbers_Gen 29542 7.61 9.16 7.10 40 TR_XM_DK_Bayes1 29109 5.41 0.65 7.00 41 LOTS_OF_MONEY 29105 8.63 13.53 7.00 42 XM_DKIMWhitelistDomains 28637 5.18 0.07 6.88 43 XM_B_Unsub2 28017 5.64 2.35 6.74 44 XM_SendGrid 25820 6.50 7.39 6.21 45 XM_DK_Undo_02 24926 13.69 36.83 5.99 46 TR_XM_DK_Bayes2 24924 4.63 0.53 5.99 47 RCVD_IN_RP_SAFE 24871 5.28 3.18 5.98 48 TR_MetaPhish_Combo_01 24640 4.67 0.91 5.92 49 MISSING_HEADERS 24137 4.57 0.88 5.80 50 BAYES_20 22605 4.52 1.78 5.43 51 XM_H_SpoofStaff4 22420 4.25 0.84 5.39 52 HTML_IMAGE_RATIO_04 22349 5.50 5.88 5.37 53 BAYES_40 22160 4.55 2.22 5.33 54 TR_XM_UnparsRelay 22109 6.30 9.27 5.32 55 XMSUPPORT 21921 3.95 0.00 5.27 56 RCVD_IN_RP_CERTIFIED 21821 4.56 2.50 5.25 57 IN_ZIMBRA_NJ_WHITELIST 21697 3.93 0.05 5.22 58 T_TooManySym_01 20635 4.36 2.57 4.96 59 MIME_QP_LONG_LINE 20362 4.65 3.90 4.90 60 HTML_IMAGE_RATIO_02 20339 5.75 8.32 4.89 61 BAYES_99 20062 10.48 27.49 4.82 62 TR_XM_SpammyWords4 19983 6.52 11.68 4.80 63 XM_PDF 19528 3.82 1.19 4.69 64 RELAYCOUNTRY_META 19410 9.13 22.54 4.67 65 RCVD_IN_IADB_LISTED 19225 4.06 2.38 4.62 66 TR_XM_DKIM_Undo 18963 10.77 29.45 4.56 67 XMStrtUSub 18451 4.12 3.19 4.44 68 XM_H_Long_From01 18434 4.74 5.65 4.43 69 BAYES_05 17777 3.46 1.01 4.27 70 MPART_ALT_DIFF 17444 5.12 7.89 4.19 71 RCVD_IN_IADB_SPF 16987 3.58 2.06 4.08 72 XM_B_SpammyWords3 16904 6.38 13.36 4.06 73 BAYES_999 16553 8.08 20.39 3.98 74 TR_XM_DK_SendGrid 15929 3.84 3.87 3.83 75 T_REMOTE_IMAGE 15656 5.03 8.84 3.76 76 BOTNET_IPINHOSTNAME 15393 5.90 12.51 3.70 77 RCVD_IN_IADB_SENDERID 15356 3.24 1.88 3.69 78 BAYES_80 15261 4.63 7.52 3.67 79 XM_H_Trusted_IP 15166 2.74 0.00 3.65 80 RCVD_IN_IADB_DK 14879 3.16 1.90 3.58 81 ANY_BOUNCE_MESSAGE 14426 2.86 1.05 3.47 82 BOUNCE_MESSAGE 14420 2.86 1.05 3.47 83 TR_XM_PhishingBody 14319 4.39 7.25 3.44 84 XM_B_Phish_Phrases 13694 4.44 7.90 3.29 85 TM2_M_URI_OPT_OUT 13659 3.50 4.15 3.28 86 DKIM_INVALID 13655 4.25 7.16 3.28 87 XM_UncommonTLD01 13472 6.10 14.70 3.24 88 XMNumbers 13385 3.79 5.52 3.22 89 HTML_IMAGE_RATIO_06 12790 3.09 3.15 3.07 90 XMSubMetaSx_00 12157 3.86 6.67 2.92 91 XMSexyCombo_05 11983 4.63 9.90 2.88 92 FROM_EXCESS_BASE64 11767 2.51 1.57 2.83 93 RCVD_IN_IADB_VOUCHED 11625 2.40 1.22 2.79 94 XM_SPF_SoftFail 11506 3.15 4.30 2.77 95 MIME_HTML_ONLY_MULTI 11192 2.76 2.97 2.69 96 KHOP_HELO_FCRDNS 11032 3.93 7.77 2.65 97 XM_B_SpammyTLD 10799 3.59 6.56 2.60 98 MAILING_LIST_MULTI 10432 2.35 1.86 2.51 99 T_TooManySym_02 10399 2.10 0.89 2.50 100 TVD_RCVD_IP 9902 1.81 0.11 2.38 101 URI_NOVOWEL 9619 2.95 4.86 2.31 102 BAYES_95 9419 2.93 4.94 2.26 103 RCVD_IN_MSPIKE_H5 9318 1.88 0.80 2.24 104 TooManyTo_002 8941 1.86 1.01 2.15 105 MIME_HTML_MOSTLY 8929 3.05 5.77 2.15 106 XM_B_Phish66 8718 2.73 4.62 2.10 107 TR_XM_SB_Phish 8500 2.06 2.12 2.04 108 TR_DCC_Bayes_99 8496 6.66 20.54 2.04 109 T_XMDrugObfuBody_14 8413 2.35 3.32 2.02 110 XMSubPhish11 8398 2.00 1.96 2.02 111 HTML_MIME_NO_HTML_TAG 8334 3.53 8.11 2.00 112 HTML_IMAGE_RATIO_08 8170 2.02 2.21 1.96 113 FUZZY_MICROSOFT 8124 1.56 0.37 1.95 114 UNTRUSTED_Relay 8091 5.74 17.15 1.95 115 XMNoVowels 7844 2.10 2.75 1.89 116 IN_HORDE_ADDRESS_BOOK 7555 1.38 0.08 1.82 117 INVALID_MSGID 7176 1.38 0.33 1.73 118 RCVD_IN_IADB_OPTIN 7062 1.47 0.78 1.70 119 XM_CamelCaseFrm001 6779 1.75 2.12 1.63 120 TR_Symld_Words 6729 2.01 3.20 1.62 121 XM_DK_Undo_01 6569 1.68 2.00 1.58 122 MSGID_NOFQDN1 6457 1.18 0.06 1.55 123 HELO_NO_DOMAIN 6360 1.51 1.46 1.53 124 HELO_NODOT 6360 1.51 1.46 1.53 125 TO_MALFORMED 6355 1.15 0.01 1.53 126 T_XMHurry_00 6257 1.44 1.26 1.50 127 SUBJ_ALL_CAPS 6234 1.60 1.89 1.50 128 TR_XM_SpammyWords5 6177 2.02 3.63 1.49 129 T_XMDrugObfuBody_08 6026 1.83 2.97 1.45 130 XMSubNoVowel 6020 1.22 0.52 1.45 131 TooManyTo_003 5953 1.29 0.85 1.43 132 XM_UB50 5919 3.19 8.52 1.42 133 XMDiploma_00 5839 1.68 2.49 1.40 134 BOTNET 5324 5.10 16.59 1.28 135 XM_GoogleGroups 5002 1.06 0.65 1.20 136 XMCapTrack 4863 1.09 0.84 1.17 137 XM_H_Long_From02 4716 1.11 1.05 1.13 138 URI_HEX 4682 1.38 2.15 1.13 139 XM_shorewaves_Whitelist 4629 0.84 0.00 1.11 140 HTML_IMAGE_ONLY_20 4483 0.99 0.73 1.08 141 RELAYCOUNTRY_GB 4388 1.10 1.25 1.05 142 TM2_M_VERY_LONG_WORD 4383 1.32 2.11 1.05 143 XMGappySubj_01 4357 0.82 0.12 1.05 144 TooManyTo_004 4177 0.93 0.72 1.00 145 URI_TRY_3LD 4169 1.19 1.75 1.00 146 RELAYCOUNTRY_CA 3897 1.84 4.56 0.94 147 XMHTML_After_End 3809 0.97 1.15 0.92 148 HTML_FONT_FACE_BAD 3655 0.84 0.72 0.88 149 XMStockSpam_06 3622 1.05 1.58 0.87 150 DKIM_ADSP_CUSTOM_MED 3589 0.92 1.10 0.86 151 XM_DIRTYINTL 3521 1.43 3.18 0.85 152 TooManyTo_005 3456 0.79 0.66 0.83 153 T_TooManySym_03 3444 0.74 0.49 0.83 154 TR_XM_SpammyWords2 3367 2.93 9.30 0.81 155 XMBSHREFv2 3366 0.68 0.27 0.81 156 XM_OfRef6 3295 1.32 2.90 0.79 157 HTTPS_HTTP_MISMATCH 3173 0.92 1.37 0.76 158 T_FILL_THIS_FORM_SHORT 3116 0.85 1.15 0.75 159 SpammyFromTLD_01 2986 1.24 2.81 0.72 160 RCVD_IN_BL_SPAMCOP_NET 2985 2.62 8.32 0.72 161 XMGenDplmaNmb 2948 0.90 1.46 0.71 162 T_OBFU_PDF_ATTACH 2924 0.58 0.23 0.70 163 RELAYCOUNTRY_FR 2887 0.81 1.15 0.69 164 MY_SERVERS_FOUND 2778 0.61 0.44 0.67 165 XMBrknScrpt_02 2708 0.97 1.92 0.65 166 XMBody_95 2650 0.52 0.18 0.64 167 XM_ShortIntro_01 2642 0.62 0.57 0.64 168 XM_SPF_Unknown 2630 0.63 0.63 0.63 169 TM2_M_BODY_EMPTY 2582 0.50 0.12 0.62 170 XM_ProductURIs 2523 0.65 0.76 0.61 171 TR_MSPIKEBAYES00 2505 0.46 0.03 0.60 172 NML_ADSP_CUSTOM_MED 2457 0.67 0.93 0.59 173 XM_B_COVIDMETA 2293 1.09 2.71 0.55 174 TVD_SPACE_RATIO 2271 0.67 1.04 0.55 175 XM_B_SpammyWords4 2251 1.00 2.37 0.54 176 XMLngstWrd_00 2236 0.91 2.02 0.54 177 TVD_SPACE_RATIO_MINFP 2207 0.43 0.12 0.53 178 FROM_GOV_DKIM_AU 2204 0.46 0.27 0.53 179 T_XMDrugObfuBody_00 2199 0.84 1.79 0.53 180 FROM_GOV_SPOOF 2181 0.42 0.11 0.52 181 XMPhish30 2180 0.60 0.82 0.52 182 XMBdyGiftCard01 2168 0.64 1.00 0.52 183 XMBounce_01 2151 0.41 0.07 0.52 184 RELAYCOUNTRY_DE 2121 0.65 1.08 0.51 185 XMSubMetaI_00 2104 0.58 0.80 0.51 186 DKIM_ADSP_NXDOMAIN 2078 0.52 0.58 0.50 187 RCVD_IN_SORBS_DUL 2071 0.50 0.51 0.50 188 HTML_TAG_BALANCE_BODY 2056 0.53 0.64 0.49 189 XMMoneyMeta_00 2007 0.63 1.07 0.48 190 XM_H_PHPMailer 2006 0.64 1.13 0.48 191 XMLngstWrd_01 2004 0.86 1.98 0.48 192 XM_B_COPY_HTML 1869 0.45 0.47 0.45 193 XMHTMLBadTable_001 1863 0.48 0.59 0.45 194 XMPhish14 1855 0.55 0.88 0.45 195 FORGED_GMAIL_RCVD 1817 0.57 0.98 0.44 196 TR_LOTS_OF_MONEY3 1811 0.57 0.97 0.44 197 PDS_OTHER_BAD_TLD 1781 1.74 5.70 0.43 198 HTML_IMAGE_ONLY_32 1781 0.99 2.69 0.43 199 XM_USANA_RCVD 1765 0.32 0.00 0.42 200 HTML_IMAGE_ONLY_28 1714 0.47 0.63 0.41 ----------------------------------------------------------------------