Email: 580765 Autolearn: 0 AvgScore: 1.20 AvgScanTime: 1.39 sec Spam: 168882 Autolearn: 0 AvgScore: 13.88 AvgScanTime: 1.62 sec Ham: 411883 Autolearn: 0 AvgScore: -3.99 AvgScanTime: 1.30 sec Time Spent Running SA: 224.73 hours Time Spent Processing Spam: 76.09 hours Time Spent Processing Ham: 148.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161746 91.16 95.77 89.27 2 DKIM_SIGNED 150644 68.92 89.20 60.61 3 XM_DK_Pass 145606 67.18 86.22 59.37 4 DKIM_VALID 144388 66.37 85.50 58.53 5 XM_B_Unicode 140039 76.41 82.92 73.74 6 RELAYCOUNTRY_US 139196 83.12 82.42 83.41 7 DCC_CHECK 117747 38.29 69.72 25.40 8 XMListUnsubscribeExists 117240 48.27 69.42 39.59 9 XM_B_SpammyWords 116262 50.07 68.84 42.38 10 DKIM_VALID_AU 112327 51.75 66.51 45.70 11 RCVD_IN_MSPIKE_H2 84307 37.45 49.92 32.34 12 XM_B_Unicode3 76934 44.28 45.55 43.76 13 XM_DK_Undo_02 74075 16.70 43.86 5.57 14 BAYES_50 68984 48.86 40.85 52.15 15 LOC_TINY_FONT_1 64604 24.55 38.25 18.93 16 XM_B_SpammyWords2 62149 20.75 36.80 14.17 17 HTML_FONT_LOW_CONTRAST 60364 27.14 35.74 23.61 18 TR_XM_DKIM_Undo 58002 12.80 34.34 3.96 19 FVGT_m_MULTI_ODD 57696 24.99 34.16 21.23 20 BAYES_99 57543 13.42 34.07 4.95 21 DKIM_VALID_EF 57082 26.75 33.80 23.85 22 MIME_HTML_ONLY 52259 26.40 30.94 24.54 23 DCC_CHECK_NEGATIVE 51077 61.67 30.24 74.55 24 T_KAM_HTML_FONT_INVALID 50705 19.67 30.02 15.43 25 BAYES_999 45840 10.53 27.14 3.72 26 XM_Body_Dirty_Words 39272 13.64 23.25 9.69 27 TR_DCC_Bayes_99 39012 7.91 23.10 1.68 28 XMSubLong 38781 21.14 22.96 20.40 29 T_TM2_M_HEADER_IN_MSG 37729 24.17 22.34 24.92 30 RELAYCOUNTRY_META 31966 7.70 18.93 3.09 31 XM_Multi_Part_URI 28358 12.55 16.79 10.81 32 XM_B_Unsub 27045 10.23 16.01 7.86 33 TR_XM_BayesUnsub 26453 8.99 15.66 6.25 34 LOTS_OF_MONEY 25123 8.92 14.88 6.48 35 BOTNET_IPINHOSTNAME 22551 6.75 13.35 4.05 36 RCVD_IN_MSPIKE_WL 22298 14.11 13.20 14.49 37 TR_XM_SpammyWords4 21923 6.72 12.98 4.15 38 TR_XM_SpammyRelay 21481 4.59 12.72 1.26 39 BOTNET 20725 4.43 12.27 1.21 40 UNPARSEABLE_RELAY 19942 8.23 11.81 6.76 41 TR_XM_UnparsRelay 19550 7.22 11.58 5.43 42 RCVD_IN_BL_SPAMCOP_NET 19409 3.60 11.49 0.37 43 XM_B_SpammyWords3 19320 5.72 11.44 3.37 44 FSL_BULK_SIG 19241 5.49 11.39 3.07 45 TR_XM_SpammyWords2 19065 3.85 11.29 0.80 46 RCVD_IN_MSPIKE_H3 17142 9.64 10.15 9.43 47 XMSexyCombo_05 15963 4.91 9.45 3.04 48 UNTRUSTED_Relay 14623 3.38 8.66 1.22 49 XM_Evil_Numbers_Gen 14551 8.43 8.62 8.36 50 MPART_ALT_DIFF 14166 11.65 8.39 12.99 51 BAYES_80 13790 4.92 8.17 3.59 52 XM_UncommonTLD01 13442 4.45 7.96 3.01 53 BAYES_60 13033 7.63 7.72 7.59 54 TR_XM_SPAMCOP 12899 2.34 7.64 0.17 55 LotsOfNums_01 12414 7.37 7.35 7.37 56 XM_SendGrid 12199 5.33 7.22 4.56 57 TR_XM_PhishingBody 12146 3.85 7.19 2.48 58 RELAYCOUNTRY_CA 11517 2.56 6.82 0.82 59 XMSubMetaSx_00 10628 3.93 6.29 2.97 60 HTML_IMAGE_RATIO_02 10012 4.99 5.93 4.60 61 XM_B_Phish_Phrases 9595 3.69 5.68 2.88 62 XM_H_Long_From01 9439 4.81 5.59 4.49 63 XM_SPF_SoftFail 8825 3.02 5.23 2.12 64 XM_B_Investor 8552 2.43 5.06 1.35 65 BAYES_95 8260 2.99 4.89 2.21 66 XMBody_17 8098 1.71 4.80 0.44 67 XMStrtUSub 7976 11.00 4.72 13.58 68 MIME_HTML_MOSTLY 7928 3.19 4.69 2.57 69 MIME_HTML_ONLY_MULTI 7706 9.19 4.56 11.09 70 TM2_M_VERY_LONG_WORD 7701 2.35 4.56 1.45 71 TooManyTo_001 7683 6.35 4.55 7.09 72 RCVD_IN_MSPIKE_BL 7419 1.83 4.39 0.78 73 TR_XM_DK_SendGrid 7357 3.29 4.36 2.85 74 HTML_IMAGE_RATIO_04 7356 15.83 4.36 20.54 75 T_XMDrugObfuBody_14 7350 2.21 4.35 1.33 76 TR_XM_MSPIKECOMBO 7254 1.80 4.30 0.78 77 XM_UB50 7229 1.78 4.28 0.76 78 T_XMDrugObfuBody_08 6704 2.26 3.97 1.56 79 XM_OfRef6 6460 1.65 3.83 0.75 80 HTML_IMAGE_RATIO_06 6455 4.69 3.82 5.05 81 RCVD_IN_VALIDITY_SAFE 6443 4.02 3.82 4.10 82 MIME_QP_LONG_LINE 6408 4.20 3.79 4.37 83 TR_XM_SpammyWords5 6336 2.09 3.75 1.41 84 XM_DIRTYINTL 6302 1.29 3.73 0.28 85 DKIM_INVALID 6256 2.55 3.70 2.07 86 XM_B_Phish66 6030 2.04 3.57 1.41 87 XM_B_SpammyTLD 5994 2.46 3.55 2.01 88 XMNumbers 5921 3.09 3.51 2.92 89 URI_NOVOWEL 5663 2.46 3.35 2.09 90 HTML_IMAGE_RATIO_08 5560 2.34 3.29 1.95 91 XM_B_Unsub2 5441 2.11 3.22 1.65 92 T_REMOTE_IMAGE 5392 3.07 3.19 3.01 93 TR_LOTS_OF_MONEY3 5353 1.21 3.17 0.40 94 XMBrknScrpt_02 5229 1.27 3.10 0.52 95 BOTNET_NORDNS 5210 0.90 3.08 0.01 96 HTML_MIME_NO_HTML_TAG 5060 2.41 3.00 2.18 97 RCVD_IN_VALIDITY_CERTIFIED 4903 3.41 2.90 3.62 98 T_TooManySym_01 4755 4.28 2.82 4.88 99 TM2_M_URI_OPT_OUT 4723 2.39 2.80 2.22 100 XM_DK_Undo_01 4720 1.69 2.79 1.24 101 XMSexyCombo_01 4710 1.28 2.79 0.66 102 XMDiploma_00 4541 1.68 2.69 1.27 103 RCVD_IN_MSPIKE_H4 4540 3.81 2.69 4.27 104 XM_CamelCaseFrm001 4461 1.87 2.64 1.55 105 SpammyFromTLD_01 4448 1.16 2.63 0.56 106 RCVD_IN_IADB_LISTED 4299 3.68 2.55 4.14 107 FROM_EXCESS_BASE64 4277 2.05 2.53 1.85 108 RCVD_IN_VALIDITY_RPBL 4229 0.74 2.50 0.02 109 SpammyFromTLD_02 4087 1.02 2.42 0.45 110 USER_IN_DEF_DKIM_WL 4048 7.93 2.40 10.19 111 RCVD_IN_MSPIKE_L3 3982 1.19 2.36 0.71 112 XMLngstWrd_00 3944 1.31 2.34 0.89 113 XMLngstWrd_01 3849 1.26 2.28 0.84 114 TR_XM_MSPIKECOMBO2 3783 0.72 2.24 0.09 115 XMStockSpam_06 3761 1.36 2.23 1.00 116 T_FILL_THIS_FORM_SHORT 3760 1.11 2.23 0.65 117 MAILING_LIST_MULTI 3695 2.42 2.19 2.51 118 XMLngstWrd_02 3679 1.15 2.18 0.73 119 RCVD_IN_IADB_SPF 3657 3.23 2.17 3.67 120 TR_XM_SpammyWords3 3453 0.85 2.04 0.35 121 RCVD_IN_IADB_DK 3380 2.86 2.00 3.21 122 XM_GoogleGroups 3371 1.65 2.00 1.51 123 RCVD_IN_IADB_SENDERID 3327 2.93 1.97 3.32 124 XM_B_SpammyWords4 3313 0.95 1.96 0.53 125 RCVD_IN_PSBL 3191 0.92 1.89 0.52 126 SUBJ_ALL_CAPS 3160 1.53 1.87 1.39 127 TR_XM_SB_Phish 3133 1.70 1.86 1.64 128 TR_XM_NoHeaderRelay 3116 0.62 1.85 0.11 129 T_XMDrugObfuBody_00 3096 0.93 1.83 0.55 130 URI_HEX 2995 1.36 1.77 1.19 131 XMLngstWrd_03 2987 0.98 1.77 0.66 132 XMSubPhish11 2984 1.66 1.77 1.62 133 T_XMHurry_00 2918 0.83 1.73 0.46 134 BAYES_40 2916 4.20 1.73 5.21 135 PDS_OTHER_BAD_TLD 2879 0.63 1.70 0.19 136 TR_XM_BayesRelay 2874 0.50 1.70 0.00 137 XM_URI_RBL 2866 0.58 1.70 0.12 138 XM_UB99 2847 0.49 1.69 0.00 139 TR_XM_MaxSPIKE 2819 0.55 1.67 0.09 140 XMHTML_After_End 2812 0.89 1.67 0.58 141 XMLngstWrd_04 2803 0.90 1.66 0.58 142 RCVD_IN_MSPIKE_L5 2665 0.47 1.58 0.02 143 URI_TRY_3LD 2665 0.83 1.58 0.52 144 KHOP_HELO_FCRDNS 2650 1.48 1.57 1.44 145 XMBdyGiftCard01 2638 0.85 1.56 0.56 146 XMPhish30 2576 0.85 1.53 0.57 147 XM_B_COVIDMETA 2556 0.75 1.51 0.44 148 HTML_TITLE_SUBJ_DIFF 2551 0.73 1.51 0.41 149 RELAYCOUNTRY_IN 2536 0.48 1.50 0.06 150 HK_RANDOM_REPLYTO 2527 0.50 1.50 0.09 151 RELAYCOUNTRY_AU 2502 0.59 1.48 0.23 152 HTML_TAG_BALANCE_BODY 2483 0.75 1.47 0.46 153 UPPERCASE_75_100 2480 0.71 1.47 0.40 154 REMOVE_BEFORE_LINK 2437 0.60 1.44 0.26 155 URIBL_BLACK 2429 0.45 1.44 0.04 156 XMClaimOffer 2391 0.46 1.42 0.07 157 TR_XM_PHPDW 2279 0.57 1.35 0.25 158 ALL_TRUSTED 2260 10.47 1.34 14.22 159 RCVD_IN_IADB_VOUCHED 2246 2.16 1.33 2.50 160 XMSubMetaSxObfu_03 2245 0.70 1.33 0.45 161 XM_UB999 2240 0.39 1.33 0.00 162 XM_H_Undi_Recip 2199 0.52 1.30 0.20 163 XMGenDplmaNmb 2191 0.81 1.30 0.61 164 TM2_M_A_HREF_HREF 2191 0.76 1.30 0.54 165 TR_XM_COVIDMETA1 2185 0.47 1.29 0.13 166 TR_XM_PHPForged 2172 0.52 1.29 0.21 167 TR_XM_FormFill 2147 0.38 1.27 0.02 168 TR_XM_FormFill2 2129 0.51 1.26 0.21 169 XM_Body_Dirty_Words_01 2127 0.46 1.26 0.14 170 XM_H_PHPOS 2122 0.51 1.26 0.20 171 XM_H_Long_From02 2109 0.98 1.25 0.87 172 BAYES_20 2048 4.03 1.21 5.18 173 MPART_ALT_DIFF_COUNT 2020 0.72 1.20 0.53 174 HTTPS_HTTP_MISMATCH 1972 0.80 1.17 0.65 175 T_Symld_Words_02 1961 0.87 1.16 0.75 176 RELAYCOUNTRY_RU 1919 0.35 1.14 0.03 177 TR_XM_Base64_M1 1912 0.86 1.13 0.74 178 XM_UB60 1899 0.37 1.12 0.06 179 TR_Symld_Words 1879 1.36 1.11 1.46 180 XM_ProductURIs 1879 0.60 1.11 0.39 181 URIBL_DBL_SPAM 1849 0.33 1.09 0.01 182 MONEY_NOHTML 1785 0.35 1.06 0.06 183 TR_Mismatch_TLD_02 1785 0.38 1.06 0.10 184 TR_XM_COVIDMETA4 1779 0.43 1.05 0.18 185 RELAYCOUNTRY_FR 1660 0.43 0.98 0.20 186 XM_PDF 1644 3.12 0.97 4.00 187 XMPhish14 1641 0.52 0.97 0.34 188 TR_Mismatch_TLD_01 1612 0.46 0.95 0.25 189 XM_B_COPY_HTML 1611 0.65 0.95 0.53 190 TR_XM_Undi_Recip5 1610 0.28 0.95 0.01 191 HTML_FONT_FACE_BAD 1562 14.22 0.92 19.67 192 RELAYCOUNTRY_CN 1557 0.34 0.92 0.10 193 FROM_SUSPICIOUS_NTLD 1557 0.28 0.92 0.01 194 URI_PHP_REDIR 1550 0.27 0.92 0.01 195 XMPhish08 1534 0.34 0.91 0.10 196 XM_Combo_Sbj 1524 0.47 0.90 0.30 197 XMReplyNow 1508 0.42 0.89 0.22 198 XMSexyCombo_04 1502 0.42 0.89 0.23 199 T_TooManySym_02 1497 2.08 0.89 2.57 200 HTML_IMAGE_ONLY_24 1493 0.47 0.88 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 367694 91.16 95.77 89.27 2 RELAYCOUNTRY_US 343545 83.12 82.42 83.41 3 DCC_CHECK_NEGATIVE 307069 61.67 30.24 74.55 4 XM_B_Unicode 303706 76.41 82.92 73.74 5 DKIM_SIGNED 249625 68.92 89.20 60.61 6 XM_DK_Pass 244541 67.18 86.22 59.37 7 DKIM_VALID 241085 66.37 85.50 58.53 8 BAYES_50 214778 48.86 40.85 52.15 9 DKIM_VALID_AU 188211 51.75 66.51 45.70 10 XM_B_Unicode3 180240 44.28 45.55 43.76 11 XM_B_SpammyWords 174549 50.07 68.84 42.38 12 XMListUnsubscribeExists 163080 48.27 69.42 39.59 13 RCVD_IN_MSPIKE_H2 133198 37.45 49.92 32.34 14 DCC_CHECK 104610 38.29 69.72 25.40 15 T_TM2_M_HEADER_IN_MSG 102656 24.17 22.34 24.92 16 MIME_HTML_ONLY 101065 26.40 30.94 24.54 17 DKIM_VALID_EF 98254 26.75 33.80 23.85 18 HTML_FONT_LOW_CONTRAST 97228 27.14 35.74 23.61 19 FVGT_m_MULTI_ODD 87456 24.99 34.16 21.23 20 HTML_IMAGE_RATIO_04 84595 15.83 4.36 20.54 21 XMSubLong 84020 21.14 22.96 20.40 22 HTML_FONT_FACE_BAD 81005 14.22 0.92 19.67 23 XM_H_Trusted_IP 78685 13.55 0.00 19.10 24 LOC_TINY_FONT_1 77971 24.55 38.25 18.93 25 T_KAM_HTML_FONT_INVALID 63551 19.67 30.02 15.43 26 BAYES_00 60507 10.62 0.71 14.69 27 RCVD_IN_MSPIKE_WL 59673 14.11 13.20 14.49 28 ALL_TRUSTED 58560 10.47 1.34 14.22 29 XM_B_SpammyWords2 58362 20.75 36.80 14.17 30 XMStrtUSub 55916 11.00 4.72 13.58 31 MPART_ALT_DIFF 53500 11.65 8.39 12.99 32 MIME_HTML_ONLY_MULTI 45661 9.19 4.56 11.09 33 XM_Multi_Part_URI 44536 12.55 16.79 10.81 34 USER_IN_DEF_DKIM_WL 41980 7.93 2.40 10.19 35 XM_Body_Dirty_Words 39931 13.64 23.25 9.69 36 RCVD_IN_MSPIKE_H3 38823 9.64 10.15 9.43 37 XM_Evil_Numbers_Gen 34415 8.43 8.62 8.36 38 XM_B_Unsub 32358 10.23 16.01 7.86 39 BAYES_60 31261 7.63 7.72 7.59 40 XM_DKIMWhitelistDomains 30949 5.40 0.25 7.51 41 LotsOfNums_01 30376 7.37 7.35 7.37 42 TooManyTo_001 29220 6.35 4.55 7.09 43 UNPARSEABLE_RELAY 27855 8.23 11.81 6.76 44 LOTS_OF_MONEY 26679 8.92 14.88 6.48 45 TR_XM_BayesUnsub 25729 8.99 15.66 6.25 46 IN_ZIMBRA_NJ_WHITELIST 23825 4.14 0.13 5.78 47 XM_DK_Undo_02 22933 16.70 43.86 5.57 48 XMSubNoVowel 22371 4.10 0.86 5.43 49 TR_XM_UnparsRelay 22356 7.22 11.58 5.43 50 BAYES_40 21457 4.20 1.73 5.21 51 BAYES_20 21346 4.03 1.21 5.18 52 HTML_IMAGE_RATIO_06 20806 4.69 3.82 5.05 53 BAYES_99 20379 13.42 34.07 4.95 54 T_TooManySym_01 20109 4.28 2.82 4.88 55 TR_XM_DK_Bayes 19619 3.53 0.51 4.76 56 TR_XM_DK_Bayes1 19213 3.45 0.50 4.66 57 HTML_IMAGE_RATIO_02 18950 4.99 5.93 4.60 58 XM_SendGrid 18778 5.33 7.22 4.56 59 XM_H_Long_From01 18491 4.81 5.59 4.49 60 BAYES_05 18294 3.34 0.66 4.44 61 MIME_QP_LONG_LINE 18010 4.20 3.79 4.37 62 RCVD_IN_MSPIKE_H4 17600 3.81 2.69 4.27 63 TR_XM_SpammyWords4 17096 6.72 12.98 4.15 64 RCVD_IN_IADB_LISTED 17049 3.68 2.55 4.14 65 TR_XM_DK_Bayes2 16972 3.05 0.44 4.12 66 RCVD_IN_VALIDITY_SAFE 16899 4.02 3.82 4.10 67 BOTNET_IPINHOSTNAME 16664 6.75 13.35 4.05 68 XM_PDF 16473 3.12 0.97 4.00 69 TR_XM_DKIM_Undo 16320 12.80 34.34 3.96 70 BAYES_999 15302 10.53 27.14 3.72 71 RCVD_IN_IADB_SPF 15126 3.23 2.17 3.67 72 RCVD_IN_VALIDITY_CERTIFIED 14900 3.41 2.90 3.62 73 BAYES_80 14771 4.92 8.17 3.59 74 XM_B_SpammyWords3 13897 5.72 11.44 3.37 75 RCVD_IN_IADB_SENDERID 13681 2.93 1.97 3.32 76 RCVD_IN_IADB_DK 13214 2.86 2.00 3.21 77 RELAYCOUNTRY_META 12739 7.70 18.93 3.09 78 FSL_BULK_SIG 12636 5.49 11.39 3.07 79 XMSexyCombo_05 12525 4.91 9.45 3.04 80 ANY_BOUNCE_MESSAGE 12501 2.40 0.84 3.04 81 BOUNCE_MESSAGE 12499 2.40 0.84 3.03 82 T_REMOTE_IMAGE 12418 3.07 3.19 3.01 83 XM_UncommonTLD01 12386 4.45 7.96 3.01 84 XMSubMetaSx_00 12225 3.93 6.29 2.97 85 XMNumbers 12043 3.09 3.51 2.92 86 XM_B_Phish_Phrases 11861 3.69 5.68 2.88 87 TR_XM_DK_SendGrid 11734 3.29 4.36 2.85 88 MIME_HTML_MOSTLY 10601 3.19 4.69 2.57 89 T_TooManySym_02 10581 2.08 0.89 2.57 90 MAILING_LIST_MULTI 10341 2.42 2.19 2.51 91 RCVD_IN_IADB_VOUCHED 10298 2.16 1.33 2.50 92 TR_XM_PhishingBody 10207 3.85 7.19 2.48 93 TM2_M_URI_OPT_OUT 9139 2.39 2.80 2.22 94 BAYES_95 9087 2.99 4.89 2.21 95 HTML_MIME_NO_HTML_TAG 8962 2.41 3.00 2.18 96 XM_SPF_SoftFail 8724 3.02 5.23 2.12 97 URI_NOVOWEL 8618 2.46 3.35 2.09 98 DKIM_INVALID 8540 2.55 3.70 2.07 99 XMSubLongNoVowel 8374 1.51 0.25 2.03 100 XMSubGarbage 8285 1.47 0.15 2.01 101 XM_B_SpammyTLD 8265 2.46 3.55 2.01 102 TVD_RCVD_IP 8030 1.48 0.35 1.95 103 HTML_IMAGE_RATIO_08 8023 2.34 3.29 1.95 104 TooManyTo_002 7797 1.51 0.58 1.89 105 FROM_EXCESS_BASE64 7608 2.05 2.53 1.85 106 RCVD_IN_IADB_OPTIN 6939 1.43 0.80 1.68 107 TR_DCC_Bayes_99 6924 7.91 23.10 1.68 108 HELO_NODOT 6832 1.37 0.67 1.66 109 HELO_NO_DOMAIN 6827 1.37 0.66 1.66 110 XM_B_Unsub2 6807 2.11 3.22 1.65 111 TR_XM_SB_Phish 6767 1.70 1.86 1.64 112 XMSubPhish11 6683 1.66 1.77 1.62 113 INVALID_MSGID 6635 1.20 0.19 1.61 114 T_XMDrugObfuBody_08 6410 2.26 3.97 1.56 115 XM_CamelCaseFrm001 6379 1.87 2.64 1.55 116 IN_HORDE_ADDRESS_BOOK 6271 1.12 0.13 1.52 117 XM_GoogleGroups 6205 1.65 2.00 1.51 118 TO_MALFORMED 6156 1.07 0.03 1.49 119 TR_Symld_Words 6005 1.36 1.11 1.46 120 TM2_M_VERY_LONG_WORD 5976 2.35 4.56 1.45 121 XM_E_Blogspot 5970 1.06 0.10 1.45 122 KHOP_HELO_FCRDNS 5931 1.48 1.57 1.44 123 MSGID_NOFQDN1 5847 1.03 0.09 1.42 124 XM_B_Phish66 5813 2.04 3.57 1.41 125 TR_XM_SpammyWords5 5808 2.09 3.75 1.41 126 SUBJ_ALL_CAPS 5737 1.53 1.87 1.39 127 XM_B_Investor 5573 2.43 5.06 1.35 128 T_XMDrugObfuBody_14 5498 2.21 4.35 1.33 129 XMDiploma_00 5229 1.68 2.69 1.27 130 XMGappySubj_01 5214 0.92 0.09 1.27 131 TR_XM_SpammyRelay 5187 4.59 12.72 1.26 132 TooManyTo_003 5160 1.03 0.48 1.25 133 XM_DK_Undo_01 5097 1.69 2.79 1.24 134 UNTRUSTED_Relay 5032 3.38 8.66 1.22 135 BOTNET 4981 4.43 12.27 1.21 136 URI_HEX 4900 1.36 1.77 1.19 137 XMBSHREFv2 4320 0.83 0.30 1.05 138 XMStockSpam_06 4133 1.36 2.23 1.00 139 XMCapTrack 3914 0.78 0.37 0.95 140 XMBody_95 3678 0.68 0.15 0.89 141 XMLngstWrd_00 3670 1.31 2.34 0.89 142 XM_H_Long_From02 3564 0.98 1.25 0.87 143 TooManyTo_004 3521 0.73 0.42 0.85 144 XMLngstWrd_01 3442 1.26 2.28 0.84 145 RELAYCOUNTRY_CA 3367 2.56 6.82 0.82 146 TR_XM_SpammyWords2 3277 3.85 11.29 0.80 147 RCVD_IN_MSPIKE_H5 3250 0.67 0.36 0.79 148 RCVD_IN_RP_SAFE 3223 0.79 0.82 0.78 149 RCVD_IN_MSPIKE_BL 3212 1.83 4.39 0.78 150 TR_XM_MSPIKECOMBO 3208 1.80 4.30 0.78 151 XM_UB50 3116 1.78 4.28 0.76 152 XM_OfRef6 3109 1.65 3.83 0.75 153 T_Symld_Words_02 3104 0.87 1.16 0.75 154 TR_XM_Base64_M1 3062 0.86 1.13 0.74 155 XMLngstWrd_02 3027 1.15 2.18 0.73 156 RCVD_IN_MSPIKE_L3 2925 1.19 2.36 0.71 157 DKIM_ADSP_CUSTOM_MED 2897 0.74 0.82 0.70 158 RCVD_IN_RP_CERTIFIED 2856 0.67 0.62 0.69 159 TooManyTo_005 2847 0.60 0.38 0.69 160 XMLngstWrd_03 2704 0.98 1.77 0.66 161 XMSexyCombo_01 2700 1.28 2.79 0.66 162 HTTPS_HTTP_MISMATCH 2682 0.80 1.17 0.65 163 T_FILL_THIS_FORM_SHORT 2672 1.11 2.23 0.65 164 TR_MetaPhish_Combo_01 2635 0.69 0.82 0.64 165 TVD_SPACE_RATIO 2572 0.47 0.11 0.62 166 XMGenDplmaNmb 2508 0.81 1.30 0.61 167 T_TooManySym_03 2398 0.49 0.26 0.58 168 XMLngstWrd_04 2396 0.90 1.66 0.58 169 XMHTML_After_End 2381 0.89 1.67 0.58 170 XMPhish30 2350 0.85 1.53 0.57 171 SpammyFromTLD_01 2316 1.16 2.63 0.56 172 XMBdyGiftCard01 2286 0.85 1.56 0.56 173 T_XMDrugObfuBody_00 2280 0.93 1.83 0.55 174 SHORT_HELO_AND_INLINE_IMAGE 2230 0.42 0.12 0.54 175 FROM_GOV_DKIM_AU 2218 0.47 0.32 0.54 176 TM2_M_A_HREF_HREF 2214 0.76 1.30 0.54 177 XM_B_SpammyWords4 2186 0.95 1.96 0.53 178 XM_ShortIntro_01 2178 0.48 0.37 0.53 179 MPART_ALT_DIFF_COUNT 2176 0.72 1.20 0.53 180 XM_B_COPY_HTML 2171 0.65 0.95 0.53 181 XMBrknScrpt_02 2160 1.27 3.10 0.52 182 URI_TRY_3LD 2157 0.83 1.58 0.52 183 RCVD_IN_PSBL 2152 0.92 1.89 0.52 184 XMSubMetaSxObfu_02 2103 0.53 0.57 0.51 185 T_OBFU_PDF_ATTACH 2074 0.42 0.21 0.50 186 XM_B_DNDMA 1991 0.58 0.83 0.48 187 RELAYCOUNTRY_GB 1989 0.59 0.84 0.48 188 HTML_IMAGE_ONLY_20 1936 0.46 0.44 0.47 189 XM_D_tchamptons_WL 1906 0.35 0.08 0.46 190 HTML_TAG_BALANCE_BODY 1877 0.75 1.47 0.46 191 T_XMHurry_00 1876 0.83 1.73 0.46 192 XMHTMLBadTable_001 1870 0.57 0.86 0.45 193 XM_H_PHPMailer 1856 0.52 0.70 0.45 194 MY_SERVERS_FOUND 1854 0.35 0.09 0.45 195 SpammyFromTLD_02 1848 1.02 2.42 0.45 196 XMSubMetaSxObfu_03 1847 0.70 1.33 0.45 197 NML_ADSP_CUSTOM_MED 1821 0.49 0.60 0.44 198 XM_B_COVIDMETA 1811 0.75 1.51 0.44 199 XMBody_17 1809 1.71 4.80 0.44 200 XMNoVowels 1791 0.39 0.30 0.43 ----------------------------------------------------------------------