Email: 586909 Autolearn: 0 AvgScore: 1.63 AvgScanTime: 1.34 sec Spam: 163379 Autolearn: 0 AvgScore: 13.77 AvgScanTime: 1.53 sec Ham: 423530 Autolearn: 0 AvgScore: -3.06 AvgScanTime: 1.26 sec Time Spent Running SA: 218.05 hours Time Spent Processing Spam: 69.56 hours Time Spent Processing Ham: 148.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155642 91.15 95.26 89.56 2 DKIM_SIGNED 145204 66.63 88.88 58.05 3 XM_DK_Pass 140400 65.03 85.94 56.96 4 DKIM_VALID 140137 64.41 85.77 56.16 5 RELAYCOUNTRY_US 134419 78.68 82.27 77.29 6 XM_B_Unicode 132438 76.08 81.06 74.16 7 XMListUnsubscribeExists 112894 47.49 69.10 39.15 8 DCC_CHECK 110800 36.26 67.82 24.09 9 XM_B_SpammyWords 110255 46.95 67.48 39.02 10 DKIM_VALID_AU 109392 50.63 66.96 44.33 11 RCVD_IN_MSPIKE_H2 83733 36.52 51.25 30.83 12 XM_B_Unicode3 71766 46.45 43.93 47.42 13 XM_DK_Undo_02 69552 15.41 42.57 4.93 14 BAYES_50 68369 52.25 41.85 56.26 15 XM_B_SpammyWords2 61285 19.96 37.51 13.19 16 LOC_TINY_FONT_1 58183 22.86 35.61 17.94 17 FVGT_m_MULTI_ODD 55500 28.77 33.97 26.77 18 DKIM_VALID_EF 55320 25.15 33.86 21.80 19 HTML_FONT_LOW_CONTRAST 54740 24.88 33.50 21.55 20 TR_XM_DKIM_Undo 54478 11.96 33.34 3.71 21 MIME_HTML_ONLY 54215 29.49 33.18 28.06 22 BAYES_99 54141 12.25 33.14 4.19 23 DCC_CHECK_NEGATIVE 52535 63.69 32.16 75.86 24 T_KAM_HTML_FONT_INVALID 49063 19.42 30.03 15.33 25 BAYES_999 42489 9.65 26.01 3.34 26 XMSubLong 38752 25.50 23.72 26.19 27 XM_Body_Dirty_Words 36952 12.43 22.62 8.50 28 TR_DCC_Bayes_99 36683 7.21 22.45 1.33 29 T_TM2_M_HEADER_IN_MSG 36443 23.70 22.31 24.24 30 RELAYCOUNTRY_META 31991 7.98 19.58 3.50 31 XM_Multi_Part_URI 27667 11.79 16.93 9.81 32 XM_B_Unsub 25242 13.18 15.45 12.30 33 TR_XM_BayesUnsub 24526 11.98 15.01 10.82 34 LOTS_OF_MONEY 23009 8.24 14.08 5.98 35 RCVD_IN_MSPIKE_WL 21386 13.78 13.09 14.04 36 BOTNET_IPINHOSTNAME 20925 6.28 12.81 3.76 37 XM_B_SpammyWords3 20022 5.67 12.25 3.13 38 UNPARSEABLE_RELAY 19410 7.36 11.88 5.62 39 TR_XM_SpammyRelay 19357 4.26 11.85 1.33 40 TR_XM_SpammyWords4 19192 5.85 11.75 3.57 41 TR_XM_UnparsRelay 19027 6.40 11.65 4.38 42 TR_XM_SpammyWords2 18461 3.58 11.30 0.60 43 BOTNET 18190 3.95 11.13 1.18 44 FSL_BULK_SIG 17323 4.35 10.60 1.93 45 RCVD_IN_BL_SPAMCOP_NET 16559 3.08 10.14 0.36 46 RCVD_IN_MSPIKE_H3 16085 9.28 9.85 9.07 47 XMSexyCombo_05 15581 4.17 9.54 2.10 48 XM_Evil_Numbers_Gen 15257 8.00 9.34 7.49 49 BAYES_80 13921 4.93 8.52 3.55 50 UNTRUSTED_Relay 13351 3.04 8.17 1.07 51 XM_UncommonTLD01 12630 4.26 7.73 2.92 52 MPART_ALT_DIFF 12609 10.11 7.72 11.03 53 LotsOfNums_01 12415 7.46 7.60 7.40 54 RELAYCOUNTRY_CA 12155 2.64 7.44 0.79 55 BAYES_60 11930 7.41 7.30 7.45 56 TR_XM_SPAMCOP 11329 2.08 6.93 0.20 57 TR_XM_PhishingBody 10981 3.74 6.72 2.60 58 XM_H_Long_From01 10748 4.92 6.58 4.28 59 HTML_IMAGE_RATIO_02 10547 4.80 6.46 4.17 60 XM_B_Phish_Phrases 10096 3.69 6.18 2.73 61 XM_SendGrid 9488 4.07 5.81 3.39 62 MIME_HTML_ONLY_MULTI 9049 8.44 5.54 9.56 63 XMSubMetaSx_00 8820 3.21 5.40 2.37 64 BAYES_95 8441 2.98 5.17 2.13 65 TM2_M_VERY_LONG_WORD 8301 2.71 5.08 1.79 66 HTML_MIME_NO_HTML_TAG 8250 3.44 5.05 2.82 67 HTML_IMAGE_RATIO_04 8160 13.17 4.99 16.32 68 TooManyTo_001 8105 10.45 4.96 12.57 69 XM_B_Investor 7853 2.29 4.81 1.32 70 XM_SPF_SoftFail 7274 2.59 4.45 1.87 71 RCVD_IN_MSPIKE_BL 6841 1.71 4.19 0.76 72 XMStrtUSub 6802 9.23 4.16 11.19 73 XMNumbers 6782 3.11 4.15 2.71 74 TR_XM_MSPIKECOMBO 6654 1.68 4.07 0.76 75 XM_B_SpammyTLD 6573 2.38 4.02 1.75 76 XM_B_Phish66 6206 2.21 3.80 1.59 77 TR_XM_SpammyWords5 6197 1.88 3.79 1.14 78 T_XMDrugObfuBody_14 5991 1.95 3.67 1.29 79 TR_XM_DK_SendGrid 5911 2.63 3.62 2.25 80 MIME_QP_LONG_LINE 5876 4.28 3.60 4.55 81 XM_UB50 5820 1.48 3.56 0.68 82 RCVD_IN_VALIDITY_SAFE 5679 3.69 3.48 3.77 83 XM_DIRTYINTL 5527 1.11 3.38 0.23 84 XM_OfRef6 5521 1.64 3.38 0.97 85 XM_GoogleGroups 5390 2.29 3.30 1.90 86 XMLngstWrd_00 5184 1.81 3.17 1.28 87 XMLngstWrd_01 5094 1.74 3.12 1.21 88 HTML_IMAGE_RATIO_06 5084 4.52 3.11 5.06 89 DKIM_INVALID 5067 2.23 3.10 1.89 90 SpammyFromTLD_02 5006 1.14 3.06 0.39 91 T_REMOTE_IMAGE 4967 3.02 3.04 3.01 92 XM_CamelCaseFrm001 4933 1.91 3.02 1.49 93 XMLngstWrd_02 4922 1.66 3.01 1.14 94 RCVD_IN_MSPIKE_H4 4917 3.83 3.01 4.15 95 XM_B_Unsub2 4907 1.64 3.00 1.11 96 BOTNET_NORDNS 4813 0.83 2.95 0.01 97 XMLngstWrd_03 4808 1.59 2.94 1.06 98 MIME_HTML_MOSTLY 4717 2.16 2.89 1.88 99 T_XMDrugObfuBody_08 4705 1.64 2.88 1.16 100 XMLngstWrd_04 4669 1.51 2.86 0.99 101 HTML_TITLE_SUBJ_DIFF 4650 1.39 2.85 0.82 102 XMDiploma_00 4589 5.80 2.81 6.96 103 XMBody_17 4587 1.05 2.81 0.37 104 RCVD_IN_VALIDITY_CERTIFIED 4551 3.17 2.79 3.32 105 T_FILL_THIS_FORM_SHORT 4547 1.26 2.78 0.68 106 UPPERCASE_75_100 4510 1.37 2.76 0.83 107 SpammyFromTLD_01 4487 1.21 2.75 0.62 108 XM_B_SpammyWords4 4422 1.02 2.71 0.37 109 TM2_M_URI_OPT_OUT 4417 2.20 2.70 2.01 110 HTML_IMAGE_RATIO_08 4414 2.13 2.70 1.91 111 RCVD_IN_VALIDITY_RPBL 4347 0.75 2.66 0.02 112 USER_IN_DEF_DKIM_WL 4094 7.61 2.51 9.58 113 T_TooManySym_01 3970 4.29 2.43 5.00 114 XM_DK_Undo_01 3933 1.67 2.41 1.38 115 RCVD_IN_IADB_LISTED 3776 3.77 2.31 4.33 116 XM_B_COVIDMETA 3728 1.07 2.28 0.60 117 XM_H_Undi_Recip 3711 0.78 2.27 0.20 118 KHOP_HELO_FCRDNS 3698 1.65 2.26 1.41 119 FROM_EXCESS_BASE64 3671 2.08 2.25 2.01 120 TR_XM_MSPIKECOMBO2 3453 0.66 2.11 0.09 121 TR_XM_SpammyWords3 3380 0.83 2.07 0.35 122 SUBJ_ALL_CAPS 3330 1.48 2.04 1.26 123 RCVD_IN_IADB_SPF 3307 3.40 2.02 3.93 124 RCVD_IN_PSBL 3229 0.79 1.98 0.33 125 XM_UB99 3207 0.55 1.96 0.00 126 RCVD_IN_IADB_DK 3150 3.06 1.93 3.50 127 URI_NOVOWEL 3138 1.89 1.92 1.87 128 RCVD_IN_IADB_SENDERID 3126 3.12 1.91 3.59 129 TR_LOTS_OF_MONEY3 3040 0.73 1.86 0.29 130 HK_RANDOM_REPLYTO 3013 0.56 1.84 0.06 131 XMHTML_After_End 3003 0.95 1.84 0.60 132 MAILING_LIST_MULTI 2950 2.13 1.81 2.26 133 TR_XM_SB_Phish 2915 1.69 1.78 1.65 134 XMSexyCombo_01 2834 0.73 1.73 0.34 135 XMStockSpam_06 2832 0.94 1.73 0.63 136 RCVD_IN_MSPIKE_L3 2826 0.75 1.73 0.38 137 XMSubPhish11 2823 1.66 1.73 1.63 138 BAYES_40 2762 3.86 1.69 4.70 139 XM_URI_RBL 2671 0.53 1.63 0.11 140 HTML_TAG_BALANCE_BODY 2655 0.79 1.63 0.47 141 PDS_OTHER_BAD_TLD 2630 0.52 1.61 0.09 142 XM_UB999 2626 0.45 1.61 0.00 143 ALL_TRUSTED 2622 15.25 1.60 20.51 144 TR_XM_PHPDW 2500 0.62 1.53 0.28 145 TR_XM_NoHeaderRelay 2496 0.49 1.53 0.09 146 URIBL_DBL_SPAM 2400 0.41 1.47 0.01 147 TR_XM_PHPForged 2394 0.59 1.47 0.25 148 XMGenDplmaNmb 2386 0.79 1.46 0.53 149 RELAYCOUNTRY_RU 2367 0.70 1.45 0.41 150 TR_XM_FormFill2 2358 0.58 1.44 0.25 151 RCVD_IN_MSPIKE_L5 2351 0.42 1.44 0.03 152 XM_H_PHPOS 2344 0.57 1.43 0.24 153 URI_HEX 2311 1.09 1.41 0.96 154 T_XMHurry_00 2276 0.71 1.39 0.44 155 URI_TRY_3LD 2222 0.73 1.36 0.48 156 XMSubNoVowel 2220 3.93 1.36 4.92 157 URIBL_BLACK 2215 0.41 1.36 0.04 158 T_XMDrugObfuBody_00 2213 0.78 1.35 0.56 159 XMReplyNow 2198 0.58 1.35 0.28 160 UNDISC_MONEY 2183 0.37 1.34 0.00 161 HTML_IMAGE_ONLY_20 2155 0.76 1.32 0.54 162 TM2_M_A_HREF_HREF 2103 0.65 1.29 0.41 163 TR_XM_BayesRelay 2072 0.35 1.27 0.00 164 XMPhish30 2048 0.70 1.25 0.48 165 TR_XM_COVIDMETA1 2032 0.48 1.24 0.18 166 TR_XM_FormFill 2026 0.35 1.24 0.01 167 HTTPS_HTTP_MISMATCH 2012 0.82 1.23 0.66 168 XMBdyGiftCard01 1977 0.75 1.21 0.57 169 MONEY_NOHTML 1970 0.40 1.21 0.08 170 RELAYCOUNTRY_AU 1969 0.49 1.21 0.21 171 FONT_INVIS_LONG_LINE 1954 0.37 1.20 0.05 172 MPART_ALT_DIFF_COUNT 1910 0.69 1.17 0.50 173 FROM_SUSPICIOUS_NTLD 1907 0.34 1.17 0.02 174 XM_H_Long_From02 1895 0.88 1.16 0.77 175 TR_XM_Undi_Recip5 1882 0.34 1.15 0.02 176 DIET_1 1871 0.53 1.15 0.29 177 RCVD_IN_IADB_VOUCHED 1826 2.13 1.12 2.53 178 BAYES_20 1790 3.70 1.10 4.71 179 TR_XM_MaxSPIKE 1774 0.33 1.09 0.04 180 TR_Symld_Words 1703 1.22 1.04 1.28 181 RELAYCOUNTRY_DE 1698 0.48 1.04 0.26 182 XM_B_DNDMA 1696 0.56 1.04 0.37 183 TR_XM_Undi_Recip11 1679 0.32 1.03 0.04 184 HTML_TAG_BALANCE_CENTER 1662 0.34 1.02 0.08 185 RELAYCOUNTRY_FR 1608 0.42 0.98 0.20 186 TR_XM_COVIDMETA4 1602 0.40 0.98 0.17 187 XM_ProductURIs 1598 0.66 0.98 0.54 188 TR_XM_Base64_M1 1589 0.72 0.97 0.63 189 XMBrknScrpt_02 1550 0.63 0.95 0.51 190 XM_PDF 1516 3.32 0.93 4.25 191 TR_MetaPhish_Combo_01 1500 0.72 0.92 0.64 192 REMOVE_BEFORE_LINK 1492 0.49 0.91 0.33 193 XMSubMetaI_00 1488 0.57 0.91 0.44 194 RELAYCOUNTRY_CN 1487 0.30 0.91 0.07 195 XM_UB60 1478 0.30 0.90 0.06 196 RCVD_IN_MSPIKE_L4 1477 0.50 0.90 0.35 197 XM_B_SEO 1461 0.36 0.89 0.15 198 XM_Lotto 1459 0.39 0.89 0.20 199 MIXED_CENTER_CASE 1445 0.25 0.88 0.00 200 HTML_FONT_FACE_BAD 1442 11.79 0.88 15.99 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 379309 91.15 95.26 89.56 2 RELAYCOUNTRY_US 327341 78.68 82.27 77.29 3 DCC_CHECK_NEGATIVE 321294 63.69 32.16 75.86 4 XM_B_Unicode 314070 76.08 81.06 74.16 5 DKIM_SIGNED 245867 66.63 88.88 58.05 6 XM_DK_Pass 241245 65.03 85.94 56.96 7 BAYES_50 238289 52.25 41.85 56.26 8 DKIM_VALID 237874 64.41 85.77 56.16 9 XM_B_Unicode3 200838 46.45 43.93 47.42 10 DKIM_VALID_AU 187740 50.63 66.96 44.33 11 XMListUnsubscribeExists 165829 47.49 69.10 39.15 12 XM_B_SpammyWords 165271 46.95 67.48 39.02 13 RCVD_IN_MSPIKE_H2 130587 36.52 51.25 30.83 14 MIME_HTML_ONLY 118855 29.49 33.18 28.06 15 FVGT_m_MULTI_ODD 113380 28.77 33.97 26.77 16 XMSubLong 110904 25.50 23.72 26.19 17 T_TM2_M_HEADER_IN_MSG 102662 23.70 22.31 24.24 18 DCC_CHECK 102026 36.26 67.82 24.09 19 DKIM_VALID_EF 92310 25.15 33.86 21.80 20 HTML_FONT_LOW_CONTRAST 91271 24.88 33.50 21.55 21 ALL_TRUSTED 86885 15.25 1.60 20.51 22 LOC_TINY_FONT_1 75980 22.86 35.61 17.94 23 HTML_IMAGE_RATIO_04 69132 13.17 4.99 16.32 24 HTML_FONT_FACE_BAD 67743 11.79 0.88 15.99 25 XM_H_Trusted_IP 66404 11.31 0.00 15.68 26 T_KAM_HTML_FONT_INVALID 64912 19.42 30.03 15.33 27 RCVD_IN_MSPIKE_WL 59482 13.78 13.09 14.04 28 BAYES_00 56507 9.81 0.65 13.34 29 XM_B_SpammyWords2 55855 19.96 37.51 13.19 30 TooManyTo_001 53220 10.45 4.96 12.57 31 XM_B_Unsub 52084 13.18 15.45 12.30 32 XMStrtUSub 47397 9.23 4.16 11.19 33 MPART_ALT_DIFF 46714 10.11 7.72 11.03 34 TR_XM_BayesUnsub 45815 11.98 15.01 10.82 35 XM_Multi_Part_URI 41558 11.79 16.93 9.81 36 USER_IN_DEF_DKIM_WL 40591 7.61 2.51 9.58 37 MIME_HTML_ONLY_MULTI 40478 8.44 5.54 9.56 38 RCVD_IN_MSPIKE_H3 38393 9.28 9.85 9.07 39 XM_Body_Dirty_Words 36003 12.43 22.62 8.50 40 XM_Evil_Numbers_Gen 31721 8.00 9.34 7.49 41 BAYES_60 31549 7.41 7.30 7.45 42 LotsOfNums_01 31352 7.46 7.60 7.40 43 XMDiploma_00 29463 5.80 2.81 6.96 44 XM_DKIMWhitelistDomains 27925 4.77 0.04 6.59 45 LOTS_OF_MONEY 25335 8.24 14.08 5.98 46 UNPARSEABLE_RELAY 23785 7.36 11.88 5.62 47 IN_ZIMBRA_NJ_WHITELIST 23768 4.08 0.12 5.61 48 HTML_IMAGE_RATIO_06 21437 4.52 3.11 5.06 49 T_TooManySym_01 21188 4.29 2.43 5.00 50 XM_DK_Undo_02 20869 15.41 42.57 4.93 51 XMSubNoVowel 20846 3.93 1.36 4.92 52 TR_XM_DK_Bayes 19951 3.53 0.47 4.71 53 BAYES_20 19951 3.70 1.10 4.71 54 BAYES_40 19914 3.86 1.69 4.70 55 TR_XM_DK_Bayes1 19580 3.47 0.47 4.62 56 MIME_QP_LONG_LINE 19267 4.28 3.60 4.55 57 TR_XM_UnparsRelay 18559 6.40 11.65 4.38 58 RCVD_IN_IADB_LISTED 18340 3.77 2.31 4.33 59 XM_H_Long_From01 18106 4.92 6.58 4.28 60 XM_PDF 17985 3.32 0.93 4.25 61 BAYES_99 17766 12.25 33.14 4.19 62 HTML_IMAGE_RATIO_02 17652 4.80 6.46 4.17 63 RCVD_IN_MSPIKE_H4 17587 3.83 3.01 4.15 64 TR_XM_DK_Bayes2 17264 3.06 0.43 4.08 65 RCVD_IN_IADB_SPF 16628 3.40 2.02 3.93 66 RCVD_IN_VALIDITY_SAFE 15966 3.69 3.48 3.77 67 BOTNET_IPINHOSTNAME 15915 6.28 12.81 3.76 68 TR_XM_DKIM_Undo 15708 11.96 33.34 3.71 69 BAYES_05 15490 2.80 0.59 3.66 70 RCVD_IN_IADB_SENDERID 15212 3.12 1.91 3.59 71 TR_XM_SpammyWords4 15113 5.85 11.75 3.57 72 BAYES_80 15029 4.93 8.52 3.55 73 RELAYCOUNTRY_META 14824 7.98 19.58 3.50 74 RCVD_IN_IADB_DK 14813 3.06 1.93 3.50 75 XM_SendGrid 14376 4.07 5.81 3.39 76 BAYES_999 14145 9.65 26.01 3.34 77 RCVD_IN_VALIDITY_CERTIFIED 14063 3.17 2.79 3.32 78 XM_B_SpammyWords3 13250 5.67 12.25 3.13 79 ANY_BOUNCE_MESSAGE 13211 2.47 0.80 3.12 80 BOUNCE_MESSAGE 13202 2.47 0.80 3.12 81 T_REMOTE_IMAGE 12756 3.02 3.04 3.01 82 T_TooManySym_02 12409 2.32 0.75 2.93 83 XM_UncommonTLD01 12380 4.26 7.73 2.92 84 HTML_MIME_NO_HTML_TAG 11941 3.44 5.05 2.82 85 XM_B_Phish_Phrases 11575 3.69 6.18 2.73 86 XMNumbers 11495 3.11 4.15 2.71 87 TR_XM_PhishingBody 10993 3.74 6.72 2.60 88 RCVD_IN_IADB_VOUCHED 10703 2.13 1.12 2.53 89 XMSubMetaSx_00 10026 3.21 5.40 2.37 90 MAILING_LIST_MULTI 9562 2.13 1.81 2.26 91 TR_XM_DK_SendGrid 9532 2.63 3.62 2.25 92 XMSubLongNoVowel 9442 1.73 0.42 2.23 93 XMSubGarbage 9342 1.67 0.27 2.21 94 BAYES_95 9034 2.98 5.17 2.13 95 XMSexyCombo_05 8883 4.17 9.54 2.10 96 FROM_EXCESS_BASE64 8528 2.08 2.25 2.01 97 TM2_M_URI_OPT_OUT 8498 2.20 2.70 2.01 98 FSL_BULK_SIG 8195 4.35 10.60 1.93 99 HTML_IMAGE_RATIO_08 8098 2.13 2.70 1.91 100 XM_GoogleGroups 8054 2.29 3.30 1.90 101 TooManyTo_002 8007 1.51 0.51 1.89 102 DKIM_INVALID 7993 2.23 3.10 1.89 103 MIME_HTML_MOSTLY 7973 2.16 2.89 1.88 104 URI_NOVOWEL 7931 1.89 1.92 1.87 105 XM_SPF_SoftFail 7904 2.59 4.45 1.87 106 TM2_M_VERY_LONG_WORD 7594 2.71 5.08 1.79 107 RCVD_IN_IADB_OPTIN 7477 1.47 0.69 1.77 108 XM_B_SpammyTLD 7398 2.38 4.02 1.75 109 TVD_RCVD_IP 7252 1.35 0.42 1.71 110 TR_XM_SB_Phish 6988 1.69 1.78 1.65 111 XMSubPhish11 6901 1.66 1.73 1.63 112 INVALID_MSGID 6770 1.20 0.18 1.60 113 XM_B_Phish66 6753 2.21 3.80 1.59 114 HELO_NODOT 6712 1.31 0.61 1.58 115 HELO_NO_DOMAIN 6702 1.31 0.61 1.58 116 XM_CamelCaseFrm001 6302 1.91 3.02 1.49 117 IN_HORDE_ADDRESS_BOOK 6031 1.05 0.09 1.42 118 KHOP_HELO_FCRDNS 5983 1.65 2.26 1.41 119 TO_MALFORMED 5957 1.02 0.03 1.41 120 MSGID_NOFQDN1 5946 1.04 0.10 1.40 121 XM_DK_Undo_01 5855 1.67 2.41 1.38 122 TR_XM_SpammyRelay 5651 4.26 11.85 1.33 123 TR_DCC_Bayes_99 5642 7.21 22.45 1.33 124 XM_B_Investor 5602 2.29 4.81 1.32 125 T_XMDrugObfuBody_14 5463 1.95 3.67 1.29 126 TR_Symld_Words 5435 1.22 1.04 1.28 127 XMLngstWrd_00 5419 1.81 3.17 1.28 128 SUBJ_ALL_CAPS 5331 1.48 2.04 1.26 129 TooManyTo_003 5201 1.00 0.41 1.23 130 XMLngstWrd_01 5137 1.74 3.12 1.21 131 BOTNET 4995 3.95 11.13 1.18 132 T_XMDrugObfuBody_08 4912 1.64 2.88 1.16 133 XM_E_Blogspot 4858 0.87 0.14 1.15 134 XMLngstWrd_02 4818 1.66 3.01 1.14 135 TR_XM_SpammyWords5 4811 1.88 3.79 1.14 136 XMGappySubj_01 4793 0.85 0.12 1.13 137 XM_B_Unsub2 4715 1.64 3.00 1.11 138 SHORTENED_URL_HREF 4601 0.82 0.13 1.09 139 UNTRUSTED_Relay 4515 3.04 8.17 1.07 140 XMLngstWrd_03 4509 1.59 2.94 1.06 141 XMLngstWrd_04 4181 1.51 2.86 0.99 142 XMCapTrack 4179 0.81 0.34 0.99 143 XM_OfRef6 4089 1.64 3.38 0.97 144 URI_HEX 4085 1.09 1.41 0.96 145 XMBSHREFv2 4071 0.78 0.30 0.96 146 XMBody_95 3767 0.70 0.20 0.89 147 TVD_SPACE_RATIO 3760 0.67 0.09 0.89 148 TooManyTo_004 3735 0.73 0.33 0.88 149 UPPERCASE_75_100 3508 1.37 2.76 0.83 150 RCVD_IN_MSPIKE_H5 3502 0.66 0.24 0.83 151 HTML_TITLE_SUBJ_DIFF 3479 1.39 2.85 0.82 152 RELAYCOUNTRY_CA 3361 2.64 7.44 0.79 153 XM_H_Long_From02 3275 0.88 1.16 0.77 154 RCVD_IN_RP_SAFE 3272 0.75 0.70 0.77 155 RCVD_IN_MSPIKE_BL 3216 1.71 4.19 0.76 156 TR_XM_MSPIKECOMBO 3202 1.68 4.07 0.76 157 TooManyTo_005 3082 0.60 0.29 0.73 158 DKIM_ADSP_CUSTOM_MED 2937 0.72 0.80 0.69 159 RCVD_IN_RP_CERTIFIED 2893 0.64 0.52 0.68 160 XM_UB50 2890 1.48 3.56 0.68 161 T_FILL_THIS_FORM_SHORT 2865 1.26 2.78 0.68 162 HTTPS_HTTP_MISMATCH 2789 0.82 1.23 0.66 163 XM_B_COPY_HTML 2738 0.68 0.77 0.65 164 TR_MetaPhish_Combo_01 2701 0.72 0.92 0.64 165 XMStockSpam_06 2687 0.94 1.73 0.63 166 T_TooManySym_03 2680 0.53 0.25 0.63 167 TR_XM_Base64_M1 2658 0.72 0.97 0.63 168 SpammyFromTLD_01 2606 1.21 2.75 0.62 169 XMHTML_After_End 2558 0.95 1.84 0.60 170 TR_XM_SpammyWords2 2549 3.58 11.30 0.60 171 XM_B_COVIDMETA 2534 1.07 2.28 0.60 172 XMBdyGiftCard01 2399 0.75 1.21 0.57 173 T_XMDrugObfuBody_00 2381 0.78 1.35 0.56 174 XM_ShortIntro_01 2349 0.50 0.37 0.55 175 HTML_IMAGE_ONLY_20 2304 0.76 1.32 0.54 176 XM_ProductURIs 2273 0.66 0.98 0.54 177 XMGenDplmaNmb 2240 0.79 1.46 0.53 178 XMNoVowels 2238 0.50 0.43 0.53 179 FROM_GOV_DKIM_AU 2186 0.50 0.45 0.52 180 T_OBFU_PDF_ATTACH 2162 0.42 0.19 0.51 181 XMBrknScrpt_02 2149 0.63 0.95 0.51 182 XMHTMLBadTable_001 2144 0.55 0.66 0.51 183 MPART_ALT_DIFF_COUNT 2129 0.69 1.17 0.50 184 RELAYCOUNTRY_GB 2121 0.55 0.68 0.50 185 XM_H_PHPMailer 2112 0.58 0.77 0.50 186 SHORT_HELO_AND_INLINE_IMAGE 2108 0.39 0.11 0.50 187 XM_B_Crypto 2101 0.45 0.33 0.50 188 XMPhish30 2053 0.70 1.25 0.48 189 URI_TRY_3LD 2036 0.73 1.36 0.48 190 HTML_TAG_BALANCE_BODY 2007 0.79 1.63 0.47 191 RCVD_IN_SORBS_DUL 1956 0.37 0.14 0.46 192 T_XMHurry_00 1881 0.71 1.39 0.44 193 XMSubMetaI_00 1862 0.57 0.91 0.44 194 NML_ADSP_CUSTOM_MED 1837 0.49 0.65 0.43 195 RELAYCOUNTRY_RU 1752 0.70 1.45 0.41 196 XMOemUri 1745 0.35 0.20 0.41 197 TM2_M_A_HREF_HREF 1736 0.65 1.29 0.41 198 BASE64_LENGTH_79_INF 1660 0.34 0.22 0.39 199 SpammyFromTLD_02 1659 1.14 3.06 0.39 200 TR_XM_Crypto2 1640 0.29 0.03 0.39 ----------------------------------------------------------------------