Email: 467599 Autolearn: 0 AvgScore: 4.07 AvgScanTime: 8.72 sec Spam: 177661 Autolearn: 0 AvgScore: 14.82 AvgScanTime: 13.40 sec Ham: 289938 Autolearn: 0 AvgScore: -2.51 AvgScanTime: 5.85 sec Time Spent Running SA: 1132.53 hours Time Spent Processing Spam: 661.38 hours Time Spent Processing Ham: 471.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171107 87.92 96.31 82.79 2 DKIM_SIGNED 154245 73.81 86.82 65.84 3 XM_DK_Pass 150440 72.14 84.68 64.45 4 RELAYCOUNTRY_US 148420 79.66 83.54 77.29 5 XM_B_Unicode 140860 69.18 79.29 62.99 6 XMListUnsubscribeExists 122716 49.98 69.07 38.28 7 DCC_CHECK 116886 40.65 65.79 25.24 8 XM_DK_Undo_02 114995 32.62 64.73 12.95 9 XM_B_SpammyWords 111091 47.48 62.53 38.26 10 BOTNET 104505 30.00 58.82 12.33 11 DKIM_INVALID 94667 30.61 53.29 16.71 12 BAYES_50 83531 51.77 47.02 54.68 13 XM_B_Unicode3 82837 40.21 46.63 36.27 14 TR_XM_DKIM_Undo 81349 21.43 45.79 6.50 15 LOC_TINY_FONT_1 61324 25.19 34.52 19.48 16 DCC_CHECK_NEGATIVE 60729 59.32 34.18 74.72 17 DKIM_VALID 59578 43.21 33.53 49.13 18 XM_B_SpammyWords2 58075 21.86 32.69 15.23 19 MIME_HTML_ONLY 57079 24.62 32.13 20.03 20 HTML_FONT_LOW_CONTRAST 55950 26.43 31.49 23.33 21 FVGT_m_MULTI_ODD 55756 26.27 31.38 23.13 22 T_KAM_HTML_FONT_INVALID 48243 19.92 27.15 15.48 23 DKIM_VALID_AU 44670 33.47 25.14 38.57 24 BAYES_99 44252 12.27 24.91 4.53 25 XMSubLong 41052 22.13 23.11 21.54 26 T_TM2_M_HEADER_IN_MSG 38246 29.08 21.53 33.70 27 BAYES_999 35045 9.74 19.73 3.63 28 XM_Body_Dirty_Words 34772 13.65 19.57 10.02 29 RELAYCOUNTRY_META 33315 9.72 18.75 4.19 30 TR_DCC_Bayes_99 30135 7.15 16.96 1.13 31 XM_Multi_Part_URI 27496 12.14 15.48 10.10 32 XM_B_Unsub 22066 10.70 12.42 9.64 33 DKIM_VALID_EF 21697 17.16 12.21 20.19 34 UNPARSEABLE_RELAY 20937 8.80 11.78 6.98 35 LOTS_OF_MONEY 20537 8.35 11.56 6.38 36 TR_XM_UnparsRelay 19994 7.41 11.25 5.06 37 BOTNET_IPINHOSTNAME 19721 6.76 11.10 4.10 38 RCVD_IN_MSPIKE_H2 19616 13.86 11.04 15.59 39 UNTRUSTED_Relay 19541 5.18 11.00 1.61 40 XM_B_SpammyWords3 18275 6.11 10.29 3.55 41 LotsOfNums_01 17901 8.25 10.08 7.13 42 FSL_BULK_SIG 17591 5.51 9.90 2.82 43 RCVD_IN_MSPIKE_WL 16878 16.72 9.50 21.14 44 TR_XM_SpammyWords4 16652 5.94 9.37 3.83 45 MPART_ALT_DIFF 16649 7.57 9.37 6.47 46 XM_Evil_Numbers_Gen 16567 7.84 9.33 6.93 47 XM_UncommonTLD01 16373 5.86 9.22 3.81 48 XMSexyCombo_05 15309 5.19 8.62 3.10 49 TR_XM_INV_DKIM 15001 3.64 8.44 0.70 50 TR_XM_SpammyRelay 14667 4.15 8.26 1.63 51 BAYES_60 14272 8.66 8.03 9.05 52 BAYES_80 14231 5.33 8.01 3.68 53 HTML_IMAGE_RATIO_02 14044 6.61 7.90 5.82 54 TR_XM_SpammyWords2 13916 3.42 7.83 0.72 55 XM_SendGrid 13318 5.98 7.50 5.05 56 HTML_MIME_NO_HTML_TAG 11551 4.52 6.50 3.31 57 TR_XM_PhishingBody 11352 4.60 6.39 3.50 58 RCVD_IN_MSPIKE_H3 11014 9.57 6.20 11.64 59 XM_H_Long_From01 11009 5.07 6.20 4.38 60 TooManyTo_001 10224 7.93 5.75 9.26 61 TR_XM_COVIDMETA4 10166 2.83 5.72 1.05 62 MIME_HTML_ONLY_MULTI 10161 5.02 5.72 4.59 63 XMSubMetaSx_00 9435 4.12 5.31 3.40 64 MIME_QP_LONG_LINE 9404 4.75 5.29 4.41 65 TM2_M_VERY_LONG_WORD 9397 3.11 5.29 1.77 66 HTML_IMAGE_RATIO_04 9087 5.10 5.11 5.09 67 XM_SPF_SoftFail 8768 3.94 4.94 3.33 68 XM_UB50 8681 2.37 4.89 0.82 69 XM_B_Phish_Phrases 8466 3.72 4.77 3.09 70 TR_XM_MaxUnsub 8166 2.28 4.60 0.87 71 MIME_HTML_MOSTLY 7882 3.29 4.44 2.58 72 XM_H_MailChimp 7711 1.95 4.34 0.48 73 BAYES_95 7704 2.96 4.34 2.12 74 KHOP_HELO_FCRDNS 7128 3.99 4.01 3.98 75 BOTNET_NORDNS 7081 1.55 3.99 0.06 76 URI_NOVOWEL 6829 2.66 3.84 1.93 77 RCVD_IN_BL_SPAMCOP_NET 6826 1.70 3.84 0.39 78 RELAYCOUNTRY_CA 6667 1.96 3.75 0.86 79 XM_GoogleGroups 6459 2.67 3.64 2.08 80 XMStrtUSub 6363 3.99 3.58 4.24 81 XMNumbers 6225 3.83 3.50 4.03 82 HTML_IMAGE_RATIO_06 6071 3.61 3.42 3.73 83 TR_XM_SpammyWords5 6034 2.09 3.40 1.28 84 SpammyFromTLD_01 5877 1.71 3.31 0.73 85 SpammyFromTLD_02 5807 1.39 3.27 0.24 86 TM2_M_URI_OPT_OUT 5804 3.19 3.27 3.14 87 T_XMDrugObfuBody_14 5637 2.22 3.17 1.63 88 XM_B_Investor 5568 2.03 3.13 1.35 89 T_REMOTE_IMAGE 5389 3.59 3.03 3.93 90 XM_B_Phish66 5376 2.51 3.03 2.19 91 RCVD_IN_MSPIKE_H4 5307 6.21 2.99 8.18 92 XM_B_SpammyTLD 5267 2.40 2.96 2.05 93 XMLngstWrd_00 5245 1.88 2.95 1.22 94 XMLngstWrd_01 5176 1.83 2.91 1.17 95 TR_Symld_Words 5148 2.21 2.90 1.79 96 XMLngstWrd_02 5087 1.76 2.86 1.08 97 T_TooManySym_01 5000 5.49 2.81 7.13 98 RCVD_IN_MSPIKE_BL 4994 1.55 2.81 0.77 99 TR_XM_MSPIKECOMBO 4944 1.53 2.78 0.77 100 XM_CamelCaseFrm001 4898 1.99 2.76 1.52 101 XMLngstWrd_03 4851 1.65 2.73 0.99 102 FROM_EXCESS_BASE64 4765 2.19 2.68 1.89 103 XMLngstWrd_04 4740 1.59 2.67 0.92 104 T_XMDrugObfuBody_08 4667 1.83 2.63 1.34 105 MAILING_LIST_MULTI 4558 2.68 2.57 2.75 106 BAYES_00 4558 9.65 2.57 13.99 107 HTML_TITLE_SUBJ_DIFF 4530 1.45 2.55 0.77 108 UPPERCASE_75_100 4482 1.46 2.52 0.81 109 XM_H_ConstantContact 4406 1.07 2.48 0.20 110 XM_OfRef6 4380 1.53 2.47 0.95 111 GOOG_STO_IMG_HTML 4331 0.93 2.44 0.00 112 BAYES_40 4320 4.31 2.43 5.47 113 URI_HEX 4172 1.54 2.35 1.05 114 BODY_URI_ONLY 4158 0.90 2.34 0.02 115 XM_DK_Undo_01 3973 1.81 2.24 1.55 116 HTML_IMAGE_RATIO_08 3850 2.13 2.17 2.10 117 XM_DIRTYINTL 3796 1.00 2.14 0.30 118 XMDiploma_00 3787 1.45 2.13 1.03 119 TR_XM_DK_SendGrid 3680 2.30 2.07 2.44 120 T_XMDrugObfuBody_00 3545 1.38 2.00 1.01 121 RCVD_IN_PSBL 3531 0.86 1.99 0.17 122 TR_XM_DK_Bayes 3387 5.20 1.91 7.22 123 T_FILL_THIS_FORM_SHORT 3321 1.27 1.87 0.91 124 XM_B_SpammyWords4 3258 0.93 1.83 0.38 125 RCVD_IN_VALIDITY_RPBL 3244 0.70 1.83 0.02 126 HDRS_MISSP 3216 0.71 1.81 0.04 127 XM_B_Unsub2 3185 1.72 1.79 1.67 128 TR_XM_PHPDW 3184 1.02 1.79 0.54 129 TR_XM_SB_Phish 3175 2.02 1.79 2.17 130 SUBJ_ALL_CAPS 3053 1.73 1.72 1.73 131 TR_XM_PHPForged 3039 0.97 1.71 0.51 132 BAYES_20 3022 3.10 1.70 3.95 133 TR_XM_FormFill2 3004 0.96 1.69 0.51 134 XM_H_PHPOS 2991 0.95 1.68 0.50 135 XMSubPhish11 2987 1.96 1.68 2.14 136 XMStockSpam_06 2883 1.36 1.62 1.19 137 XMPhish30 2860 1.03 1.61 0.68 138 XM_B_COVIDMETA 2840 0.85 1.60 0.39 139 TR_XM_SPAMCOP 2840 0.70 1.60 0.14 140 RELAYCOUNTRY_CZ 2679 0.59 1.51 0.03 141 HTML_SHORT_LINK_IMG_1 2654 0.58 1.49 0.02 142 HTML_IMAGE_ONLY_04 2629 0.60 1.48 0.06 143 XM_UB99 2625 0.56 1.48 0.00 144 XM_UB60 2591 0.80 1.46 0.39 145 HTML_SHORT_CENTER 2562 0.55 1.44 0.00 146 XMBody_17 2557 0.73 1.44 0.30 147 XM_UB80 2548 0.55 1.43 0.01 148 RDNS_DYNAMIC 2543 0.80 1.43 0.41 149 XM_PDF 2539 4.25 1.43 5.98 150 RELAYCOUNTRY_FR 2494 0.67 1.40 0.22 151 XMSexyCombo_01 2463 0.91 1.39 0.61 152 XM_Body_Dirty_Words_01 2450 0.97 1.38 0.72 153 RCVD_IN_MSPIKE_L5 2402 0.57 1.35 0.09 154 UPGRADE_MAILBOX 2372 0.78 1.34 0.44 155 TR_XM_NoHeaderRelay 2297 0.60 1.29 0.17 156 RCVD_IN_VALIDITY_SAFE 2296 2.31 1.29 2.94 157 HTTPS_HTTP_MISMATCH 2291 0.93 1.29 0.71 158 ANY_BOUNCE_MESSAGE 2271 3.15 1.28 4.30 159 PDS_OTHER_BAD_TLD 2263 0.58 1.27 0.15 160 TooManyTo_002 2210 2.18 1.24 2.75 161 XMBrknScrpt_02 2207 0.85 1.24 0.61 162 BOUNCE_MESSAGE 2207 3.14 1.24 4.30 163 XM_ProductURIs 2198 1.16 1.24 1.11 164 DKIM_ADSP_CUSTOM_MED 2177 1.00 1.23 0.86 165 URI_TRY_3LD 2167 0.90 1.22 0.70 166 XMGenDplmaNmb 2167 0.85 1.22 0.62 167 XMBdyGiftCard01 2112 0.83 1.19 0.61 168 TR_XM_SpammyWords3 2082 0.70 1.17 0.42 169 T_Symld_Words_02 2063 0.71 1.16 0.43 170 XM_H_Long_From02 2029 1.02 1.14 0.94 171 USER_IN_DEF_DKIM_WL 1967 6.06 1.11 9.09 172 RELAYCOUNTRY_RU 1944 0.43 1.09 0.03 173 RELAYCOUNTRY_AU 1937 0.55 1.09 0.22 174 XMHTML_After_End 1923 0.92 1.08 0.82 175 T_XMHurry_00 1922 0.64 1.08 0.37 176 ALL_TRUSTED 1899 12.89 1.07 20.13 177 RCVD_IN_IADB_LISTED 1899 2.36 1.07 3.15 178 XM_UB999 1891 0.41 1.06 0.00 179 RCVD_IN_VALIDITY_CERTIFIED 1880 2.05 1.06 2.66 180 TR_Mismatch_TLD_01 1877 0.52 1.06 0.19 181 TooManyTo_003 1862 1.54 1.05 1.85 182 HTML_TAG_BALANCE_BODY 1839 0.80 1.04 0.66 183 RELAYCOUNTRY_GB 1776 0.85 1.00 0.75 184 BAYES_05 1770 1.95 1.00 2.54 185 TM2_M_A_HREF_HREF 1747 0.61 0.98 0.38 186 T_TooManySym_02 1741 2.89 0.98 4.07 187 RELAYCOUNTRY_DE 1719 0.54 0.97 0.27 188 XM_B_DNDMA 1706 0.58 0.96 0.34 189 HTML_TAG_BALANCE_CENTER 1686 0.39 0.95 0.05 190 XMSubMetaI_00 1680 0.57 0.95 0.34 191 FORGED_GMAIL_RCVD 1679 0.65 0.95 0.46 192 TR_LOTS_OF_MONEY2 1678 0.48 0.94 0.19 193 T_MONEY_PERCENT 1678 0.48 0.94 0.19 194 TR_XM_FormFill 1652 0.36 0.93 0.02 195 TR_MetaPhish_Combo_01 1651 0.83 0.93 0.76 196 RELAYCOUNTRY_IN 1643 0.42 0.92 0.11 197 DIET_1 1642 0.53 0.92 0.29 198 RCVD_IN_IADB_SPF 1619 2.07 0.91 2.79 199 TooManyTo_004 1585 1.16 0.89 1.32 200 TR_XM_Spammywords 1576 0.59 0.89 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 240029 87.92 96.31 82.79 2 RELAYCOUNTRY_US 224080 79.66 83.54 77.29 3 DCC_CHECK_NEGATIVE 216634 59.32 34.18 74.72 4 DKIM_SIGNED 190907 73.81 86.82 65.84 5 XM_DK_Pass 186863 72.14 84.68 64.45 6 XM_B_Unicode 182633 69.18 79.29 62.99 7 BAYES_50 158543 51.77 47.02 54.68 8 DKIM_VALID 142457 43.21 33.53 49.13 9 DKIM_VALID_AU 111825 33.47 25.14 38.57 10 XMListUnsubscribeExists 110980 49.98 69.07 38.28 11 XM_B_SpammyWords 110930 47.48 62.53 38.26 12 XM_B_Unicode3 105171 40.21 46.63 36.27 13 T_TM2_M_HEADER_IN_MSG 97712 29.08 21.53 33.70 14 DCC_CHECK 73187 40.65 65.79 25.24 15 HTML_FONT_LOW_CONTRAST 67652 26.43 31.49 23.33 16 FVGT_m_MULTI_ODD 67064 26.27 31.38 23.13 17 XMSubLong 62445 22.13 23.11 21.54 18 RCVD_IN_MSPIKE_WL 61299 16.72 9.50 21.14 19 DKIM_VALID_EF 58542 17.16 12.21 20.19 20 ALL_TRUSTED 58362 12.89 1.07 20.13 21 MIME_HTML_ONLY 58066 24.62 32.13 20.03 22 LOC_TINY_FONT_1 56467 25.19 34.52 19.48 23 DKIM_INVALID 48450 30.61 53.29 16.71 24 RCVD_IN_MSPIKE_H2 45205 13.86 11.04 15.59 25 T_KAM_HTML_FONT_INVALID 44895 19.92 27.15 15.48 26 XM_B_SpammyWords2 44152 21.86 32.69 15.23 27 BAYES_00 40553 9.65 2.57 13.99 28 XM_DK_Undo_02 37537 32.62 64.73 12.95 29 BOTNET 35752 30.00 58.82 12.33 30 RCVD_IN_MSPIKE_H3 33748 9.57 6.20 11.64 31 XM_Multi_Part_URI 29283 12.14 15.48 10.10 32 XM_Body_Dirty_Words 29043 13.65 19.57 10.02 33 XM_DKIMWhitelistDomains 28556 6.19 0.23 9.85 34 XM_B_Unsub 27952 10.70 12.42 9.64 35 TooManyTo_001 26844 7.93 5.75 9.26 36 USER_IN_DEF_DKIM_WL 26363 6.06 1.11 9.09 37 BAYES_60 26235 8.66 8.03 9.05 38 IN_ZIMBRA_NJ_WHITELIST 24089 5.24 0.24 8.31 39 RCVD_IN_MSPIKE_H4 23711 6.21 2.99 8.18 40 TR_XM_DK_Bayes 20945 5.20 1.91 7.22 41 T_TooManySym_01 20684 5.49 2.81 7.13 42 LotsOfNums_01 20672 8.25 10.08 7.13 43 UNPARSEABLE_RELAY 20229 8.80 11.78 6.98 44 XM_Evil_Numbers_Gen 20105 7.84 9.33 6.93 45 TR_XM_DKIM_Undo 18856 21.43 45.79 6.50 46 MPART_ALT_DIFF 18745 7.57 9.37 6.47 47 LOTS_OF_MONEY 18508 8.35 11.56 6.38 48 XM_PDF 17330 4.25 1.43 5.98 49 HTML_IMAGE_RATIO_02 16860 6.61 7.90 5.82 50 BAYES_40 15855 4.31 2.43 5.47 51 XM_H_Trusted_IP 15272 3.27 0.00 5.27 52 HTML_IMAGE_RATIO_04 14745 5.10 5.11 5.09 53 TR_XM_UnparsRelay 14668 7.41 11.25 5.06 54 XM_SendGrid 14638 5.98 7.50 5.05 55 TR_XM_DK_Bayes1 13669 3.00 0.20 4.71 56 MIME_HTML_ONLY_MULTI 13294 5.02 5.72 4.59 57 BAYES_99 13120 12.27 24.91 4.53 58 MIME_QP_LONG_LINE 12785 4.75 5.29 4.41 59 XM_H_Long_From01 12689 5.07 6.20 4.38 60 ANY_BOUNCE_MESSAGE 12464 3.15 1.28 4.30 61 BOUNCE_MESSAGE 12463 3.14 1.24 4.30 62 XMStrtUSub 12307 3.99 3.58 4.24 63 RELAYCOUNTRY_META 12137 9.72 18.75 4.19 64 BOTNET_IPINHOSTNAME 11886 6.76 11.10 4.10 65 T_TooManySym_02 11795 2.89 0.98 4.07 66 XMNumbers 11679 3.83 3.50 4.03 67 TR_XM_DK_Bayes2 11556 2.53 0.16 3.99 68 KHOP_HELO_FCRDNS 11534 3.99 4.01 3.98 69 BAYES_20 11459 3.10 1.70 3.95 70 T_REMOTE_IMAGE 11386 3.59 3.03 3.93 71 TR_XM_SpammyWords4 11113 5.94 9.37 3.83 72 XM_UncommonTLD01 11037 5.86 9.22 3.81 73 HTML_IMAGE_RATIO_06 10804 3.61 3.42 3.73 74 BAYES_80 10676 5.33 8.01 3.68 75 BAYES_999 10520 9.74 19.73 3.63 76 XM_B_SpammyWords3 10297 6.11 10.29 3.55 77 TR_XM_PhishingBody 10135 4.60 6.39 3.50 78 XMSubMetaSx_00 9844 4.12 5.31 3.40 79 XM_SPF_SoftFail 9656 3.94 4.94 3.33 80 HTML_MIME_NO_HTML_TAG 9594 4.52 6.50 3.31 81 RCVD_IN_IADB_LISTED 9133 2.36 1.07 3.15 82 TM2_M_URI_OPT_OUT 9101 3.19 3.27 3.14 83 XMSexyCombo_05 8982 5.19 8.62 3.10 84 XM_B_Phish_Phrases 8950 3.72 4.77 3.09 85 RCVD_IN_VALIDITY_SAFE 8519 2.31 1.29 2.94 86 TVD_RCVD_IP 8309 1.86 0.22 2.87 87 FSL_BULK_SIG 8178 5.51 9.90 2.82 88 RCVD_IN_IADB_SPF 8083 2.07 0.91 2.79 89 TooManyTo_002 7970 2.18 1.24 2.75 90 MAILING_LIST_MULTI 7963 2.68 2.57 2.75 91 RCVD_IN_VALIDITY_CERTIFIED 7714 2.05 1.06 2.66 92 MIME_HTML_MOSTLY 7484 3.29 4.44 2.58 93 BAYES_05 7351 1.95 1.00 2.54 94 RCVD_IN_IADB_SENDERID 7296 1.87 0.83 2.52 95 TR_XM_DK_SendGrid 7067 2.30 2.07 2.44 96 RCVD_IN_IADB_DK 7046 1.82 0.82 2.43 97 HELO_NODOT 6771 1.72 0.71 2.34 98 HELO_NO_DOMAIN 6768 1.64 0.50 2.33 99 INVALID_MSGID 6537 1.49 0.23 2.25 100 XM_B_Phish66 6344 2.51 3.03 2.19 101 TR_XM_SB_Phish 6293 2.02 1.79 2.17 102 XMSubPhish11 6200 1.96 1.68 2.14 103 MSGID_NOFQDN1 6164 1.36 0.12 2.13 104 BAYES_95 6142 2.96 4.34 2.12 105 IN_HORDE_ADDRESS_BOOK 6088 1.40 0.25 2.10 106 HTML_IMAGE_RATIO_08 6087 2.13 2.17 2.10 107 TO_MALFORMED 6034 1.29 0.01 2.08 108 XM_GoogleGroups 6026 2.67 3.64 2.08 109 XM_B_SpammyTLD 5932 2.40 2.96 2.05 110 URI_NOVOWEL 5599 2.66 3.84 1.93 111 HTML_FONT_FACE_BAD 5556 1.50 0.82 1.92 112 RCVD_IN_IADB_VOUCHED 5508 1.41 0.62 1.90 113 FROM_EXCESS_BASE64 5468 2.19 2.68 1.89 114 TooManyTo_003 5358 1.54 1.05 1.85 115 TR_Symld_Words 5189 2.21 2.90 1.79 116 TM2_M_VERY_LONG_WORD 5132 3.11 5.29 1.77 117 SUBJ_ALL_CAPS 5025 1.73 1.72 1.73 118 XMSubNoVowel 4993 1.39 0.86 1.72 119 XM_B_Unsub2 4842 1.72 1.79 1.67 120 T_XMDrugObfuBody_14 4725 2.22 3.17 1.63 121 TR_XM_SpammyRelay 4725 4.15 8.26 1.63 122 UNTRUSTED_Relay 4667 5.18 11.00 1.61 123 XM_DK_Undo_01 4491 1.81 2.24 1.55 124 XM_CamelCaseFrm001 4411 1.99 2.76 1.52 125 XMGappySubj_01 4032 0.96 0.25 1.39 126 XM_B_Investor 3916 2.03 3.13 1.35 127 T_XMDrugObfuBody_08 3880 1.83 2.63 1.34 128 RCVD_IN_MSPIKE_H5 3840 0.94 0.31 1.32 129 TooManyTo_004 3822 1.16 0.89 1.32 130 TR_XM_SpammyWords5 3723 2.09 3.40 1.28 131 RCVD_IN_IADB_OPTIN 3721 0.95 0.39 1.28 132 XMCapTrack 3716 1.12 0.86 1.28 133 TVD_SPACE_RATIO 3659 0.89 0.28 1.26 134 XMLngstWrd_00 3544 1.88 2.95 1.22 135 XM_ShortIntro_01 3495 1.02 0.73 1.21 136 XMBSHREFv2 3466 0.87 0.34 1.20 137 XMStockSpam_06 3462 1.36 1.62 1.19 138 XM_E_Blogspot 3441 0.80 0.17 1.19 139 XMLngstWrd_01 3379 1.83 2.91 1.17 140 TR_DCC_Bayes_99 3283 7.15 16.96 1.13 141 XM_ProductURIs 3229 1.16 1.24 1.11 142 XM_shorewaves_Whitelist 3207 0.69 0.00 1.11 143 T_TooManySym_03 3143 0.82 0.38 1.08 144 TooManyTo_005 3132 0.98 0.81 1.08 145 XMLngstWrd_02 3126 1.76 2.86 1.08 146 TR_XM_COVIDMETA4 3051 2.83 5.72 1.05 147 URI_HEX 3030 1.54 2.35 1.05 148 XMDiploma_00 2997 1.45 2.13 1.03 149 T_XMDrugObfuBody_00 2920 1.38 2.00 1.01 150 XMLngstWrd_03 2862 1.65 2.73 0.99 151 XMBody_95 2776 0.67 0.20 0.96 152 XM_OfRef6 2761 1.53 2.47 0.95 153 XM_H_Long_From02 2720 1.02 1.14 0.94 154 XMLngstWrd_04 2674 1.59 2.67 0.92 155 T_FILL_THIS_FORM_SHORT 2637 1.27 1.87 0.91 156 TR_XM_MaxUnsub 2518 2.28 4.60 0.87 157 RELAYCOUNTRY_CA 2506 1.96 3.75 0.86 158 DKIM_ADSP_CUSTOM_MED 2482 1.00 1.23 0.86 159 XM_UB50 2386 2.37 4.89 0.82 160 XMHTML_After_End 2384 0.92 1.08 0.82 161 UPPERCASE_75_100 2339 1.46 2.52 0.81 162 HTML_IMAGE_ONLY_20 2275 0.73 0.64 0.78 163 RCVD_IN_MSPIKE_BL 2244 1.55 2.81 0.77 164 HTML_TITLE_SUBJ_DIFF 2238 1.45 2.55 0.77 165 T_OBFU_PDF_ATTACH 2228 0.66 0.49 0.77 166 TR_XM_MSPIKECOMBO 2224 1.53 2.78 0.77 167 TR_MetaPhish_Combo_01 2213 0.83 0.93 0.76 168 RELAYCOUNTRY_GB 2189 0.85 1.00 0.75 169 XM_H_PHPMailer 2142 0.76 0.78 0.74 170 SpammyFromTLD_01 2121 1.71 3.31 0.73 171 XM_Body_Dirty_Words_01 2085 0.97 1.38 0.72 172 TR_XM_SpammyWords2 2082 3.42 7.83 0.72 173 HTTPS_HTTP_MISMATCH 2063 0.93 1.29 0.71 174 URI_TRY_3LD 2026 0.90 1.22 0.70 175 TR_XM_INV_DKIM 2016 3.64 8.44 0.70 176 XMPhish30 1968 1.03 1.61 0.68 177 XM_RXBody 1922 0.58 0.46 0.66 178 HTML_TAG_BALANCE_BODY 1901 0.80 1.04 0.66 179 SHORT_HELO_AND_INLINE_IMAGE 1888 0.43 0.08 0.65 180 FROM_GOV_SPOOF 1850 0.64 0.64 0.64 181 FILL_THIS_FORM 1804 0.49 0.27 0.62 182 XMGenDplmaNmb 1794 0.85 1.22 0.62 183 XMBrknScrpt_02 1778 0.85 1.24 0.61 184 XMSexyCombo_01 1773 0.91 1.39 0.61 185 XMBdyGiftCard01 1756 0.83 1.19 0.61 186 PLING_QUERY 1696 0.54 0.48 0.58 187 XMNoVowels 1619 0.50 0.41 0.56 188 XM_B_COPY_HTML 1615 0.58 0.63 0.56 189 MSGID_FROM_MTA_HEADER 1597 0.49 0.38 0.55 190 T_MANY_PILL_PRICE 1579 0.37 0.10 0.54 191 TR_XM_PHPDW 1565 1.02 1.79 0.54 192 NML_ADSP_CUSTOM_MED 1542 0.59 0.68 0.53 193 HTML_IMAGE_ONLY_32 1509 0.44 0.30 0.52 194 USER_IN_WHITELIST 1498 0.32 0.00 0.52 195 USER_IN_WELCOMELIST 1498 0.32 0.00 0.52 196 HTML_IMAGE_ONLY_28 1482 0.46 0.37 0.51 197 TR_XM_FormFill2 1479 0.96 1.69 0.51 198 TR_XM_PHPForged 1476 0.97 1.71 0.51 199 TM2_M_BODY_EMPTY 1466 0.45 0.35 0.51 200 XM_H_PHPOS 1450 0.95 1.68 0.50 ----------------------------------------------------------------------