Email: 501672 Autolearn: 0 AvgScore: 3.48 AvgScanTime: 2.53 sec Spam: 169821 Autolearn: 0 AvgScore: 14.14 AvgScanTime: 3.14 sec Ham: 331851 Autolearn: 0 AvgScore: -1.97 AvgScanTime: 2.22 sec Time Spent Running SA: 352.93 hours Time Spent Processing Spam: 147.97 hours Time Spent Processing Ham: 204.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162942 90.03 95.95 86.99 2 DKIM_SIGNED 151304 76.27 89.10 69.70 3 XM_DK_Pass 145633 73.89 85.76 67.82 4 XM_B_Unicode 145020 75.78 85.40 70.86 5 RELAYCOUNTRY_US 137731 80.64 81.10 80.40 6 DKIM_VALID 122907 64.96 72.37 61.16 7 DCC_CHECK 120504 45.35 70.96 32.24 8 XMListUnsubscribeExists 120310 55.38 70.85 47.47 9 XM_B_SpammyWords 116686 52.21 68.71 43.76 10 DKIM_VALID_AU 88780 49.29 52.28 47.76 11 XM_B_Unicode3 77937 43.40 45.89 42.13 12 RCVD_IN_MSPIKE_H2 72449 36.71 42.66 33.66 13 BAYES_50 72010 51.08 42.40 55.52 14 XM_DK_Undo_02 70116 18.36 41.29 6.63 15 XM_B_SpammyWords2 64943 25.91 38.24 19.59 16 LOC_TINY_FONT_1 64064 27.31 37.72 21.98 17 HTML_FONT_LOW_CONTRAST 59407 29.27 34.98 26.35 18 TR_XM_DKIM_Undo 57349 14.28 33.77 4.30 19 MIME_HTML_ONLY 56905 26.52 33.51 22.94 20 FVGT_m_MULTI_ODD 56561 26.95 33.31 23.69 21 BAYES_99 54573 14.75 32.14 5.85 22 T_KAM_HTML_FONT_INVALID 51083 22.45 30.08 18.55 23 DCC_CHECK_NEGATIVE 49293 54.62 29.03 67.72 24 DKIM_VALID_EF 49152 24.92 28.94 22.86 25 BAYES_999 42070 11.58 24.77 4.84 26 XM_Body_Dirty_Words 42067 15.88 24.77 11.33 27 TR_DCC_Bayes_99 38061 8.63 22.41 1.58 28 XMSubLong 36927 21.55 21.74 21.45 29 T_TM2_M_HEADER_IN_MSG 36406 26.24 21.44 28.69 30 RELAYCOUNTRY_META 34672 9.15 20.42 3.39 31 XM_Multi_Part_URI 31861 14.24 18.76 11.93 32 DKIM_INVALID 28397 11.31 16.72 8.54 33 XM_B_Unsub 27881 12.76 16.42 10.89 34 TR_XM_BayesUnsub 27037 9.55 15.92 6.29 35 LOTS_OF_MONEY 25672 9.95 15.12 7.31 36 TR_XM_SpammyRelay 24339 5.86 14.33 1.53 37 BOTNET_IPINHOSTNAME 23866 8.04 14.05 4.96 38 RCVD_IN_MSPIKE_WL 21893 15.02 12.89 16.11 39 UNPARSEABLE_RELAY 21310 8.85 12.55 6.96 40 TR_XM_SpammyWords4 20978 7.02 12.35 4.30 41 TR_XM_UnparsRelay 20788 7.61 12.24 5.24 42 TR_XM_SpammyWords2 19443 4.42 11.45 0.83 43 XM_B_SpammyWords3 19036 7.13 11.21 5.05 44 BOTNET 18254 4.77 10.75 1.70 45 XMSexyCombo_05 17649 5.82 10.39 3.48 46 RCVD_IN_BL_SPAMCOP_NET 16979 3.69 10.00 0.46 47 RELAYCOUNTRY_CA 16912 4.07 9.96 1.06 48 FSL_BULK_SIG 16667 5.57 9.81 3.40 49 RCVD_IN_MSPIKE_H3 15439 10.06 9.09 10.56 50 XM_Evil_Numbers_Gen 15088 7.91 8.88 7.41 51 BAYES_80 14031 5.49 8.26 4.08 52 BAYES_60 12575 8.16 7.40 8.54 53 TR_XM_SPAMCOP 12508 2.65 7.37 0.23 54 LotsOfNums_01 12205 7.60 7.19 7.81 55 HTML_IMAGE_RATIO_02 12187 5.83 7.18 5.14 56 MPART_ALT_DIFF 12033 8.73 7.09 9.57 57 XM_H_Long_From01 11993 5.71 7.06 5.02 58 TR_XM_PhishingBody 11573 4.28 6.81 2.99 59 UNTRUSTED_Relay 11385 3.00 6.70 1.11 60 XM_UncommonTLD01 11224 4.64 6.61 3.63 61 TooManyTo_001 9958 7.13 5.86 7.77 62 XMSubMetaSx_00 9618 4.37 5.66 3.70 63 XM_B_Phish_Phrases 9370 3.82 5.52 2.96 64 XM_B_SpammyTLD 8816 3.28 5.19 2.30 65 XM_B_Investor 8662 2.77 5.10 1.58 66 XMStrtUSub 8551 4.54 5.04 4.29 67 BAYES_95 8536 3.38 5.03 2.54 68 HTML_IMAGE_RATIO_04 8032 5.35 4.73 5.67 69 XM_SendGrid 7621 3.61 4.49 3.16 70 MIME_HTML_ONLY_MULTI 7581 6.43 4.46 7.44 71 T_XMDrugObfuBody_08 7440 2.37 4.38 1.34 72 T_XMDrugObfuBody_14 7323 2.81 4.31 2.04 73 HTML_IMAGE_RATIO_06 7071 4.07 4.16 4.03 74 TM2_M_VERY_LONG_WORD 7000 2.45 4.12 1.59 75 XM_SPF_SoftFail 6639 2.75 3.91 2.15 76 XM_DIRTYINTL 6451 1.47 3.80 0.28 77 MIME_HTML_MOSTLY 6394 3.08 3.77 2.73 78 TR_XM_INV_DKIM 6377 1.53 3.76 0.40 79 XMBody_17 6372 1.62 3.75 0.53 80 RCVD_IN_MSPIKE_BL 6327 1.70 3.73 0.66 81 XM_OfRef6 6241 1.89 3.68 0.97 82 XM_B_Phish66 6205 2.44 3.65 1.83 83 T_REMOTE_IMAGE 6203 3.56 3.65 3.51 84 TR_XM_MSPIKECOMBO 6194 1.67 3.65 0.66 85 TM2_M_URI_OPT_OUT 6163 5.27 3.63 6.11 86 RCVD_IN_MSPIKE_H4 6136 4.22 3.61 4.53 87 XMNumbers 6080 3.25 3.58 3.08 88 T_FILL_THIS_FORM_SHORT 6045 1.76 3.56 0.83 89 MIME_QP_LONG_LINE 5918 4.28 3.48 4.69 90 TR_XM_SpammyWords5 5726 1.90 3.37 1.15 91 XM_CamelCaseFrm001 5589 2.41 3.29 1.96 92 URIBL_DBL_SPAM 5325 1.07 3.14 0.01 93 PDS_OTHER_BAD_TLD 5274 1.14 3.11 0.13 94 XM_UB50 5249 1.53 3.09 0.73 95 RCVD_IN_VALIDITY_RPBL 5199 1.04 3.06 0.01 96 XM_DK_Undo_01 5057 1.84 2.98 1.26 97 HTML_IMAGE_RATIO_08 5044 2.48 2.97 2.23 98 HTML_MIME_NO_HTML_TAG 5020 2.67 2.96 2.52 99 RCVD_IN_VALIDITY_SAFE 4706 3.70 2.77 4.18 100 XMDiploma_00 4626 1.72 2.72 1.20 101 XM_B_Unsub2 4581 1.60 2.70 1.04 102 FROM_EXCESS_BASE64 4454 2.34 2.62 2.20 103 XM_B_SpammyWords4 4039 1.10 2.38 0.44 104 T_XMHurry_00 3958 1.09 2.33 0.46 105 TR_XM_COVIDMETA4 3945 1.16 2.32 0.56 106 TR_XM_DK_SendGrid 3937 2.00 2.32 1.83 107 SpammyFromTLD_01 3919 1.23 2.31 0.68 108 BOTNET_NORDNS 3860 0.78 2.27 0.01 109 T_TooManySym_01 3847 4.92 2.27 6.27 110 SUBJ_ALL_CAPS 3832 1.82 2.26 1.60 111 URI_NOVOWEL 3823 2.57 2.25 2.74 112 XMSexyCombo_01 3755 1.36 2.21 0.93 113 RCVD_IN_VALIDITY_CERTIFIED 3632 3.15 2.14 3.66 114 RCVD_IN_MSPIKE_L3 3585 1.12 2.11 0.62 115 HK_RANDOM_REPLYTO 3522 0.76 2.07 0.08 116 XMStockSpam_06 3475 1.45 2.05 1.15 117 XM_GoogleGroups 3469 1.74 2.04 1.58 118 RCVD_IN_IADB_LISTED 3446 4.06 2.03 5.10 119 SpammyFromTLD_02 3367 1.06 1.98 0.58 120 DOS_RCVD_IP_TWICE_B 3355 1.00 1.98 0.50 121 TR_XM_FormFill 3347 0.68 1.97 0.02 122 FONT_INVIS_LONG_LINE 3342 0.71 1.97 0.07 123 XM_H_Undi_Recip 3259 0.78 1.92 0.20 124 MAILING_LIST_MULTI 3242 2.27 1.91 2.46 125 XMLngstWrd_00 3206 1.32 1.89 1.03 126 BAYES_40 3200 4.19 1.88 5.38 127 HTML_FONT_TINY_NORDNS 3160 0.83 1.86 0.30 128 TR_XM_SB_Phish 3152 3.04 1.86 3.65 129 XMLngstWrd_01 3136 1.25 1.85 0.95 130 TR_Symld_Words 3122 1.74 1.84 1.68 131 RCVD_IN_PSBL 3101 0.99 1.83 0.57 132 TR_LOTS_OF_MONEY3 3095 0.79 1.82 0.26 133 XMSubPhish11 3074 3.01 1.81 3.63 134 XMLngstWrd_02 2992 1.15 1.76 0.84 135 RCVD_IN_IADB_SPF 2894 3.51 1.70 4.44 136 TR_XM_SpammyWords3 2874 0.75 1.69 0.26 137 TM2_M_A_HREF_HREF 2845 0.88 1.68 0.47 138 XMLngstWrd_03 2831 1.02 1.67 0.68 139 USER_IN_DEF_DKIM_WL 2823 8.10 1.66 11.40 140 KHOP_HELO_FCRDNS 2792 1.92 1.64 2.06 141 RCVD_IN_IADB_DK 2781 3.03 1.64 3.74 142 URI_HEX 2765 1.36 1.63 1.22 143 ALL_TRUSTED 2758 11.79 1.62 16.99 144 XMLngstWrd_04 2752 0.96 1.62 0.62 145 URI_PHP_REDIR 2732 0.55 1.61 0.01 146 T_XMDrugObfuBody_00 2731 0.99 1.61 0.67 147 RCVD_IN_IADB_SENDERID 2729 3.10 1.61 3.86 148 XMGenDplmaNmb 2716 0.95 1.60 0.62 149 XM_B_COVIDMETA 2711 0.85 1.60 0.48 150 TR_XM_PHPDW 2699 0.75 1.59 0.32 151 TR_XM_PHPForged 2668 0.72 1.57 0.28 152 XMBdyGiftCard01 2655 0.93 1.56 0.61 153 TR_XM_InvalidRelay 2611 0.55 1.54 0.04 154 HTML_TITLE_SUBJ_DIFF 2601 0.85 1.53 0.50 155 TR_XM_FormFill2 2594 0.70 1.53 0.28 156 XM_H_PHPOS 2585 0.69 1.52 0.27 157 TR_XM_MSPIKECOMBO2 2498 0.59 1.47 0.14 158 RELAYCOUNTRY_AU 2475 0.69 1.46 0.30 159 UPPERCASE_75_100 2458 0.82 1.45 0.50 160 HTML_IMAGE_ONLY_24 2423 0.68 1.43 0.29 161 HTTPS_HTTP_MISMATCH 2392 0.88 1.41 0.61 162 TR_XM_NoHeaderRelay 2385 0.54 1.40 0.10 163 RCVD_IN_MSPIKE_L5 2369 0.49 1.39 0.03 164 XM_URI_RBL 2337 0.55 1.38 0.13 165 NORDNS_LOW_CONTRAST 2328 0.57 1.37 0.16 166 MPART_ALT_DIFF_COUNT 2327 0.83 1.37 0.56 167 XMReplyNow 2319 0.68 1.37 0.33 168 XM_UB99 2280 0.46 1.34 0.00 169 TR_XM_BayesRelay 2257 0.45 1.33 0.00 170 URIBL_BLACK 2254 0.48 1.33 0.05 171 BAYES_20 2210 2.96 1.30 3.80 172 XM_H_Long_From02 2113 1.32 1.24 1.35 173 TR_XM_Base64_M1 2087 0.96 1.23 0.82 174 TR_XM_COVIDMETA1 2033 0.54 1.20 0.20 175 TR_XM_MaxSPIKE 2024 0.50 1.19 0.14 176 XMHTML_After_End 2004 0.91 1.18 0.78 177 XM_OfRef7 1970 0.49 1.16 0.15 178 XMPhish14 1909 0.56 1.12 0.28 179 HTTP_EXCESSIVE_ESCAPES 1905 0.38 1.12 0.00 180 REMOVE_BEFORE_LINK 1901 0.55 1.12 0.25 181 XMPhish30 1888 0.80 1.11 0.63 182 XM_Body_Dirty_Words_01 1811 0.48 1.07 0.18 183 XMSubMetaI_00 1752 0.84 1.03 0.75 184 HELO_NODOT 1727 1.21 1.02 1.31 185 RCVD_IN_IADB_VOUCHED 1717 2.57 1.01 3.36 186 URIBL_DBL_ABUSE_SPAM 1709 0.35 1.01 0.01 187 T_Symld_Words_02 1701 0.67 1.00 0.50 188 URI_TRY_3LD 1656 0.74 0.98 0.61 189 DIET_1 1655 0.60 0.97 0.40 190 XM_UB999 1646 0.33 0.97 0.00 191 HTML_TAG_BALANCE_BODY 1640 0.79 0.97 0.69 192 XMClaimOffer 1604 0.39 0.94 0.11 193 HELO_NO_DOMAIN 1584 1.18 0.93 1.31 194 BAYES_00 1575 8.24 0.93 11.99 195 RELAYCOUNTRY_FR 1564 0.47 0.92 0.24 196 XM_H_MailChimp 1548 0.70 0.91 0.59 197 TR_MetaPhish_Combo_01 1541 0.86 0.91 0.83 198 NO_DNS_FOR_FROM 1508 0.46 0.89 0.25 199 SHOPIFY_IMG_NOT_RCVD_SFY 1488 0.43 0.88 0.20 200 XMBrknScrpt_02 1476 0.59 0.87 0.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 288690 90.03 95.95 86.99 2 RELAYCOUNTRY_US 266821 80.64 81.10 80.40 3 XM_B_Unicode 235146 75.78 85.40 70.86 4 DKIM_SIGNED 231310 76.27 89.10 69.70 5 XM_DK_Pass 225072 73.89 85.76 67.82 6 DCC_CHECK_NEGATIVE 224727 54.62 29.03 67.72 7 DKIM_VALID 202969 64.96 72.37 61.16 8 BAYES_50 184232 51.08 42.40 55.52 9 DKIM_VALID_AU 158499 49.29 52.28 47.76 10 XMListUnsubscribeExists 157539 55.38 70.85 47.47 11 XM_B_SpammyWords 145212 52.21 68.71 43.76 12 XM_B_Unicode3 139795 43.40 45.89 42.13 13 RCVD_IN_MSPIKE_H2 111716 36.71 42.66 33.66 14 DCC_CHECK 106995 45.35 70.96 32.24 15 T_TM2_M_HEADER_IN_MSG 95208 26.24 21.44 28.69 16 HTML_FONT_LOW_CONTRAST 87439 29.27 34.98 26.35 17 FVGT_m_MULTI_ODD 78618 26.95 33.31 23.69 18 MIME_HTML_ONLY 76118 26.52 33.51 22.94 19 DKIM_VALID_EF 75851 24.92 28.94 22.86 20 LOC_TINY_FONT_1 72952 27.31 37.72 21.98 21 XMSubLong 71177 21.55 21.74 21.45 22 XM_B_SpammyWords2 65016 25.91 38.24 19.59 23 T_KAM_HTML_FONT_INVALID 61544 22.45 30.08 18.55 24 ALL_TRUSTED 56380 11.79 1.62 16.99 25 RCVD_IN_MSPIKE_WL 53459 15.02 12.89 16.11 26 BAYES_00 39778 8.24 0.93 11.99 27 XM_Multi_Part_URI 39587 14.24 18.76 11.93 28 USER_IN_DEF_DKIM_WL 37832 8.10 1.66 11.40 29 XM_Body_Dirty_Words 37590 15.88 24.77 11.33 30 XM_B_Unsub 36155 12.76 16.42 10.89 31 RCVD_IN_MSPIKE_H3 35041 10.06 9.09 10.56 32 MPART_ALT_DIFF 31769 8.73 7.09 9.57 33 XM_DKIMWhitelistDomains 29415 5.89 0.07 8.86 34 BAYES_60 28356 8.16 7.40 8.54 35 DKIM_INVALID 28341 11.31 16.72 8.54 36 LotsOfNums_01 25927 7.60 7.19 7.81 37 TooManyTo_001 25799 7.13 5.86 7.77 38 XM_H_Trusted_IP 25108 5.00 0.00 7.57 39 MIME_HTML_ONLY_MULTI 24674 6.43 4.46 7.44 40 XM_Evil_Numbers_Gen 24592 7.91 8.88 7.41 41 LOTS_OF_MONEY 24266 9.95 15.12 7.31 42 UNPARSEABLE_RELAY 23111 8.85 12.55 6.96 43 IN_ZIMBRA_NJ_WHITELIST 22255 4.47 0.10 6.71 44 XM_DK_Undo_02 22004 18.36 41.29 6.63 45 TR_XM_BayesUnsub 20883 9.55 15.92 6.29 46 T_TooManySym_01 20811 4.92 2.27 6.27 47 TM2_M_URI_OPT_OUT 20268 5.27 3.63 6.11 48 TR_XM_DK_Bayes 20005 4.22 0.68 6.03 49 BAYES_99 19427 14.75 32.14 5.85 50 HTML_IMAGE_RATIO_04 18821 5.35 4.73 5.67 51 TR_XM_DK_Bayes1 17980 3.72 0.41 5.42 52 BAYES_40 17845 4.19 1.88 5.38 53 TR_XM_UnparsRelay 17398 7.61 12.24 5.24 54 HTML_IMAGE_RATIO_02 17051 5.83 7.18 5.14 55 RCVD_IN_IADB_LISTED 16937 4.06 2.03 5.10 56 XM_B_SpammyWords3 16746 7.13 11.21 5.05 57 XM_H_Long_From01 16646 5.71 7.06 5.02 58 BOTNET_IPINHOSTNAME 16451 8.04 14.05 4.96 59 BAYES_999 16046 11.58 24.77 4.84 60 TR_XM_DK_Bayes2 15987 3.30 0.33 4.82 61 MIME_QP_LONG_LINE 15550 4.28 3.48 4.69 62 XM_PDF 15243 3.28 0.72 4.59 63 RCVD_IN_MSPIKE_H4 15019 4.22 3.61 4.53 64 RCVD_IN_IADB_SPF 14731 3.51 1.70 4.44 65 TR_XM_DKIM_Undo 14285 14.28 33.77 4.30 66 TR_XM_SpammyWords4 14255 7.02 12.35 4.30 67 XMStrtUSub 14229 4.54 5.04 4.29 68 RCVD_IN_VALIDITY_SAFE 13870 3.70 2.77 4.18 69 BAYES_80 13530 5.49 8.26 4.08 70 HTML_IMAGE_RATIO_06 13364 4.07 4.16 4.03 71 T_TooManySym_02 13309 2.87 0.64 4.01 72 RCVD_IN_IADB_SENDERID 12821 3.10 1.61 3.86 73 BAYES_20 12624 2.96 1.30 3.80 74 RCVD_IN_IADB_DK 12418 3.03 1.64 3.74 75 XMSubMetaSx_00 12290 4.37 5.66 3.70 76 RCVD_IN_VALIDITY_CERTIFIED 12149 3.15 2.14 3.66 77 TR_XM_SB_Phish 12104 3.04 1.86 3.65 78 XM_UncommonTLD01 12046 4.64 6.61 3.63 79 XMSubPhish11 12033 3.01 1.81 3.63 80 T_REMOTE_IMAGE 11658 3.56 3.65 3.51 81 XMSexyCombo_05 11561 5.82 10.39 3.48 82 FSL_BULK_SIG 11269 5.57 9.81 3.40 83 RELAYCOUNTRY_META 11244 9.15 20.42 3.39 84 RCVD_IN_IADB_VOUCHED 11163 2.57 1.01 3.36 85 XM_SendGrid 10492 3.61 4.49 3.16 86 XMNumbers 10218 3.25 3.58 3.08 87 TR_XM_PhishingBody 9915 4.28 6.81 2.99 88 XM_B_Phish_Phrases 9812 3.82 5.52 2.96 89 URI_NOVOWEL 9092 2.57 2.25 2.74 90 MIME_HTML_MOSTLY 9051 3.08 3.77 2.73 91 ANY_BOUNCE_MESSAGE 8785 1.96 0.63 2.65 92 BOUNCE_MESSAGE 8778 1.96 0.63 2.65 93 BAYES_95 8433 3.38 5.03 2.54 94 HTML_MIME_NO_HTML_TAG 8350 2.67 2.96 2.52 95 MAILING_LIST_MULTI 8169 2.27 1.91 2.46 96 XM_B_SpammyTLD 7629 3.28 5.19 2.30 97 RCVD_IN_IADB_OPTIN 7611 1.70 0.54 2.29 98 TooManyTo_002 7597 1.75 0.69 2.29 99 BAYES_05 7561 1.72 0.63 2.28 100 HTML_IMAGE_RATIO_08 7393 2.48 2.97 2.23 101 FROM_EXCESS_BASE64 7305 2.34 2.62 2.20 102 XMSubNoVowel 7251 1.64 0.58 2.19 103 XM_SPF_SoftFail 7145 2.75 3.91 2.15 104 TVD_RCVD_IP 7142 1.53 0.32 2.15 105 KHOP_HELO_FCRDNS 6825 1.92 1.64 2.06 106 HTML_FONT_FACE_BAD 6781 1.64 0.86 2.04 107 T_XMDrugObfuBody_14 6762 2.81 4.31 2.04 108 INVALID_MSGID 6698 1.41 0.22 2.02 109 XM_CamelCaseFrm001 6516 2.41 3.29 1.96 110 MSGID_NOFQDN1 6258 1.29 0.12 1.89 111 IN_HORDE_ADDRESS_BOOK 6209 1.28 0.14 1.87 112 TR_XM_DK_SendGrid 6077 2.00 2.32 1.83 113 XM_B_Phish66 6059 2.44 3.65 1.83 114 TO_MALFORMED 5948 1.19 0.02 1.79 115 BOTNET 5654 4.77 10.75 1.70 116 TR_Symld_Words 5590 1.74 1.84 1.68 117 SUBJ_ALL_CAPS 5314 1.82 2.26 1.60 118 TM2_M_VERY_LONG_WORD 5278 2.45 4.12 1.59 119 TR_DCC_Bayes_99 5247 8.63 22.41 1.58 120 XM_GoogleGroups 5247 1.74 2.04 1.58 121 XM_B_Investor 5229 2.77 5.10 1.58 122 TR_XM_SpammyRelay 5076 5.86 14.33 1.53 123 XMGappySubj_01 5048 1.05 0.14 1.52 124 TooManyTo_003 4573 1.11 0.58 1.38 125 XM_H_Long_From02 4486 1.32 1.24 1.35 126 T_XMDrugObfuBody_08 4434 2.37 4.38 1.34 127 HELO_NODOT 4336 1.21 1.02 1.31 128 HELO_NO_DOMAIN 4333 1.18 0.93 1.31 129 XM_DK_Undo_01 4169 1.84 2.98 1.26 130 XMBSHREFv2 4097 0.90 0.24 1.23 131 URI_HEX 4050 1.36 1.63 1.22 132 XMBody_95 4023 0.84 0.12 1.21 133 XMDiploma_00 3994 1.72 2.72 1.20 134 TR_XM_SpammyWords5 3830 1.90 3.37 1.15 135 XMStockSpam_06 3806 1.45 2.05 1.15 136 UNTRUSTED_Relay 3677 3.00 6.70 1.11 137 RELAYCOUNTRY_CA 3517 4.07 9.96 1.06 138 DKIM_ADSP_CUSTOM_MED 3509 0.97 0.80 1.06 139 XM_B_Unsub2 3436 1.60 2.70 1.04 140 XMLngstWrd_00 3423 1.32 1.89 1.03 141 RCVD_IN_MSPIKE_H5 3399 0.74 0.19 1.02 142 FROM_GOV_DKIM_AU 3259 0.73 0.24 0.98 143 XM_OfRef6 3221 1.89 3.68 0.97 144 TooManyTo_004 3201 0.79 0.46 0.96 145 XMLngstWrd_01 3143 1.25 1.85 0.95 146 XMSexyCombo_01 3087 1.36 2.21 0.93 147 XMCapTrack 3042 0.71 0.30 0.92 148 XM_D_tchamptons_WL 2914 0.59 0.04 0.88 149 XMLngstWrd_02 2800 1.15 1.76 0.84 150 HTML_IMAGE_ONLY_20 2798 0.70 0.43 0.84 151 T_FILL_THIS_FORM_SHORT 2767 1.76 3.56 0.83 152 TR_XM_SpammyWords2 2751 4.42 11.45 0.83 153 TR_MetaPhish_Combo_01 2749 0.86 0.91 0.83 154 TR_XM_Base64_M1 2734 0.96 1.23 0.82 155 TVD_SPACE_RATIO 2731 0.58 0.10 0.82 156 XMHTML_After_End 2585 0.91 1.18 0.78 157 T_TooManySym_03 2568 0.60 0.26 0.77 158 TooManyTo_005 2531 0.64 0.40 0.76 159 XMSubMetaI_00 2474 0.84 1.03 0.75 160 XM_UB50 2407 1.53 3.09 0.73 161 NML_ADSP_CUSTOM_MED 2311 0.68 0.64 0.70 162 HTML_TAG_BALANCE_BODY 2299 0.79 0.97 0.69 163 XM_B_COPY_HTML 2274 0.69 0.70 0.69 164 T_OBFU_PDF_ATTACH 2270 0.49 0.10 0.68 165 XMLngstWrd_03 2268 1.02 1.67 0.68 166 SpammyFromTLD_01 2244 1.23 2.31 0.68 167 T_XMDrugObfuBody_00 2236 0.99 1.61 0.67 168 XM_H_PHPMailer 2229 0.70 0.75 0.67 169 RCVD_IN_RP_SAFE 2223 0.61 0.49 0.67 170 RCVD_IN_MSPIKE_BL 2179 1.70 3.73 0.66 171 TR_XM_MSPIKECOMBO 2177 1.67 3.65 0.66 172 XM_ProductURIs 2147 0.65 0.65 0.65 173 XMPhish30 2106 0.80 1.11 0.63 174 XMGenDplmaNmb 2069 0.95 1.60 0.62 175 XMLngstWrd_04 2053 0.96 1.62 0.62 176 RCVD_IN_MSPIKE_L3 2047 1.12 2.11 0.62 177 FROM_GOV_SPOOF 2044 0.50 0.26 0.62 178 URI_TRY_3LD 2039 0.74 0.98 0.61 179 HTTPS_HTTP_MISMATCH 2033 0.88 1.41 0.61 180 XMSexyCombo_04 2029 0.68 0.81 0.61 181 XMBdyGiftCard01 2026 0.93 1.56 0.61 182 XM_E_Blogspot 2006 0.45 0.16 0.60 183 RCVD_IN_RP_CERTIFIED 1995 0.52 0.36 0.60 184 XM_ShortIntro_01 1964 0.51 0.36 0.59 185 XM_H_MailChimp 1955 0.70 0.91 0.59 186 SpammyFromTLD_02 1927 1.06 1.98 0.58 187 RCVD_IN_PSBL 1884 0.99 1.83 0.57 188 TR_XM_COVIDMETA4 1867 1.16 2.32 0.56 189 MPART_ALT_DIFF_COUNT 1858 0.83 1.37 0.56 190 FORGED_GMAIL_RCVD 1810 0.56 0.59 0.55 191 MY_SERVERS_FOUND 1779 0.44 0.24 0.54 192 XMBody_17 1764 1.62 3.75 0.53 193 XMNoVowels 1738 0.52 0.51 0.52 194 UPPERCASE_75_100 1674 0.82 1.45 0.50 195 HTML_TITLE_SUBJ_DIFF 1673 0.85 1.53 0.50 196 T_Symld_Words_02 1666 0.67 1.00 0.50 197 DOS_RCVD_IP_TWICE_B 1658 1.00 1.98 0.50 198 RELAYCOUNTRY_GB 1643 0.54 0.63 0.50 199 XM_B_COVIDMETA 1578 0.85 1.60 0.48 200 XM_shorewaves_Whitelist 1575 0.31 0.00 0.47 ----------------------------------------------------------------------