Email: 521189 Autolearn: 0 AvgScore: 4.45 AvgScanTime: 1.40 sec Spam: 177961 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.53 sec Ham: 343228 Autolearn: 0 AvgScore: -0.35 AvgScanTime: 1.34 sec Time Spent Running SA: 203.11 hours Time Spent Processing Spam: 75.79 hours Time Spent Processing Ham: 127.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170107 89.58 95.59 86.46 2 DKIM_SIGNED 160828 81.31 90.37 76.61 3 XM_DK_Pass 157968 79.43 88.77 74.58 4 DKIM_VALID 156722 78.55 88.07 73.61 5 XM_B_Unicode 145580 74.69 81.80 70.99 6 RELAYCOUNTRY_US 140679 80.28 79.05 80.91 7 DCC_CHECK 131908 49.16 74.12 36.22 8 XMListUnsubscribeExists 130845 58.63 73.52 50.91 9 XM_B_SpammyWords 126309 54.61 70.98 46.13 10 DKIM_VALID_AU 117499 61.38 66.03 58.98 11 RCVD_IN_MSPIKE_H2 83068 42.08 46.68 39.70 12 XM_DK_Undo_02 78377 19.16 44.04 6.26 13 XM_B_Unicode3 76314 42.13 42.88 41.74 14 BAYES_50 76010 53.61 42.71 59.25 15 XM_B_SpammyWords2 75246 27.69 42.28 20.13 16 LOC_TINY_FONT_1 68303 30.02 38.38 25.68 17 TR_XM_DKIM_Undo 65040 15.48 36.55 4.56 18 FVGT_m_MULTI_ODD 64912 29.60 36.48 26.03 19 DKIM_VALID_EF 62459 30.81 35.10 28.58 20 HTML_FONT_LOW_CONTRAST 59939 30.23 33.68 28.44 21 MIME_HTML_ONLY 58163 24.48 32.68 20.23 22 BAYES_99 56439 13.96 31.71 4.76 23 T_KAM_HTML_FONT_INVALID 56050 24.40 31.50 20.72 24 DCC_CHECK_NEGATIVE 45992 50.79 25.84 63.73 25 BAYES_999 43036 10.75 24.18 3.78 26 XMSubLong 41209 22.77 23.16 22.56 27 TR_DCC_Bayes_99 41128 9.02 23.11 1.71 28 T_TM2_M_HEADER_IN_MSG 38792 26.30 21.80 28.64 29 XM_Body_Dirty_Words 37190 14.76 20.90 11.57 30 RELAYCOUNTRY_META 35931 9.48 20.19 3.93 31 XM_Multi_Part_URI 32181 15.08 18.08 13.52 32 RCVD_IN_MSPIKE_WL 31938 18.46 17.95 18.72 33 TR_XM_SpammyRelay 26567 6.25 14.93 1.75 34 RCVD_IN_MSPIKE_H3 26385 12.67 14.83 11.55 35 BOTNET_IPINHOSTNAME 26136 8.42 14.69 5.17 36 XM_B_SpammyWords3 25807 7.86 14.50 4.42 37 XM_B_Unsub 25332 10.69 14.23 8.85 38 TR_XM_BayesUnsub 24730 9.48 13.90 7.19 39 LOTS_OF_MONEY 23855 8.68 13.40 6.23 40 TR_XM_SpammyWords2 22490 4.83 12.64 0.78 41 TR_XM_SpammyWords4 20564 6.69 11.56 4.17 42 UNPARSEABLE_RELAY 19794 9.40 11.12 8.50 43 RCVD_IN_BL_SPAMCOP_NET 18994 3.93 10.67 0.44 44 RELAYCOUNTRY_CA 18612 4.35 10.46 1.18 45 FSL_BULK_SIG 17089 5.59 9.60 3.50 46 XM_Evil_Numbers_Gen 16928 8.76 9.51 8.38 47 XMSexyCombo_05 16762 5.44 9.42 3.38 48 BOTNET 16372 4.41 9.20 1.93 49 BAYES_80 15716 6.01 8.83 4.54 50 MPART_ALT_DIFF 15382 5.93 8.64 4.52 51 TR_XM_SPAMCOP 15164 3.06 8.52 0.23 52 TR_XM_PhishingBody 14293 5.17 8.03 3.69 53 BAYES_60 13505 8.96 7.59 9.68 54 XM_UncommonTLD01 13304 5.06 7.48 3.81 55 TR_XM_UnparsRelay 12594 3.47 7.08 1.60 56 UNTRUSTED_Relay 12384 3.31 6.96 1.41 57 LotsOfNums_01 11943 8.21 6.71 8.99 58 XM_SendGrid 11158 5.70 6.27 5.41 59 HTML_IMAGE_RATIO_02 10972 5.97 6.17 5.86 60 XMSubMetaSx_00 10507 4.32 5.90 3.51 61 BAYES_95 9792 3.69 5.50 2.74 62 XM_B_Phish_Phrases 9605 3.90 5.40 3.13 63 XM_H_Long_From01 9593 5.51 5.39 5.57 64 MIME_HTML_ONLY_MULTI 9291 3.50 5.22 2.61 65 TM2_M_VERY_LONG_WORD 9005 2.50 5.06 1.17 66 XM_B_SpammyTLD 8887 3.30 4.99 2.43 67 XM_B_Investor 8659 2.66 4.87 1.52 68 MIME_HTML_MOSTLY 8547 3.32 4.80 2.54 69 RCVD_IN_MSPIKE_BL 8508 2.07 4.78 0.66 70 TR_XM_MSPIKECOMBO 8389 2.04 4.71 0.65 71 HTML_IMAGE_RATIO_04 8349 4.65 4.69 4.63 72 XM_B_Phish66 8035 2.87 4.52 2.02 73 XM_SPF_SoftFail 8014 3.05 4.50 2.29 74 TooManyTo_001 7762 6.96 4.36 8.31 75 XM_OfRef6 7662 2.63 4.31 1.76 76 TR_XM_DK_SendGrid 7512 3.90 4.22 3.74 77 HTML_MIME_NO_HTML_TAG 7440 2.87 4.18 2.20 78 T_XMDrugObfuBody_08 7289 2.30 4.10 1.38 79 HTML_IMAGE_RATIO_08 7112 3.01 4.00 2.50 80 XM_DIRTYINTL 6916 1.55 3.89 0.33 81 T_FILL_THIS_FORM_SHORT 6856 1.86 3.85 0.83 82 XMBody_17 6692 1.71 3.76 0.65 83 TR_XM_SpammyWords5 6656 2.12 3.74 1.28 84 XMStrtUSub 6655 4.40 3.74 4.75 85 HK_RANDOM_REPLYTO 6427 1.32 3.61 0.13 86 HTML_IMAGE_RATIO_06 6423 3.41 3.61 3.30 87 T_XMDrugObfuBody_14 6337 2.22 3.56 1.53 88 TR_XM_SpammyWords3 6221 1.43 3.50 0.36 89 XMNumbers 6145 3.82 3.45 4.01 90 SpammyFromTLD_02 6128 1.47 3.44 0.44 91 MIME_QP_LONG_LINE 5882 4.59 3.31 5.26 92 XM_UB50 5672 1.72 3.19 0.95 93 XM_GoogleGroups 5606 2.02 3.15 1.44 94 URI_NOVOWEL 5546 2.47 3.12 2.13 95 ALL_TRUSTED 5451 11.59 3.06 16.01 96 XMLngstWrd_00 5217 1.31 2.93 0.47 97 RCVD_IN_MSPIKE_H4 5191 4.85 2.92 5.86 98 XMLngstWrd_01 5172 1.26 2.91 0.40 99 XMLngstWrd_02 5086 1.19 2.86 0.32 100 TM2_M_URI_OPT_OUT 4944 2.24 2.78 1.95 101 URIBL_DBL_SPAM 4937 0.95 2.77 0.01 102 RCVD_IN_VALIDITY_SAFE 4844 4.26 2.72 5.05 103 XM_B_SpammyWords4 4825 1.33 2.71 0.61 104 XM_DK_Undo_01 4742 1.96 2.66 1.59 105 SpammyFromTLD_01 4695 1.45 2.64 0.84 106 XMLngstWrd_03 4687 1.06 2.63 0.24 107 HTML_TITLE_SUBJ_DIFF 4605 0.92 2.59 0.05 108 XMLngstWrd_04 4602 1.01 2.59 0.19 109 UPPERCASE_75_100 4504 0.88 2.53 0.03 110 RCVD_IN_MSPIKE_L3 4425 1.09 2.49 0.36 111 FROM_EXCESS_BASE64 4323 2.50 2.43 2.53 112 USER_IN_DEF_DKIM_WL 4263 9.41 2.40 13.04 113 XMDiploma_00 4169 1.50 2.34 1.07 114 RCVD_IN_IADB_LISTED 4137 3.95 2.32 4.80 115 DKIM_INVALID 4106 2.76 2.31 3.00 116 FONT_INVIS_LONG_LINE 4093 0.86 2.30 0.12 117 T_TooManySym_01 4048 5.18 2.27 6.69 118 URI_PHP_REDIR 4032 0.78 2.27 0.00 119 T_XMHurry_00 4020 1.18 2.26 0.62 120 TR_XM_FormFill 3982 0.77 2.24 0.02 121 XM_B_Unsub2 3766 1.78 2.12 1.60 122 RCVD_IN_IADB_SPF 3736 3.55 2.10 4.30 123 PDS_OTHER_BAD_TLD 3722 0.91 2.09 0.30 124 RCVD_IN_VALIDITY_CERTIFIED 3690 3.71 2.07 4.55 125 RCVD_IN_IADB_DK 3555 3.21 2.00 3.85 126 RCVD_IN_VALIDITY_RPBL 3553 0.84 2.00 0.25 127 RCVD_IN_IADB_SENDERID 3523 3.26 1.98 3.92 128 XM_H_Undi_Recip 3516 0.86 1.98 0.28 129 XM_CamelCaseFrm001 3472 2.21 1.95 2.34 130 TR_LOTS_OF_MONEY3 3401 0.88 1.91 0.34 131 T_REMOTE_IMAGE 3365 3.33 1.89 4.08 132 RCVD_IN_MSPIKE_L5 3345 0.67 1.88 0.04 133 TR_XM_SB_Phish 3261 2.05 1.83 2.16 134 T_XMDrugObfuBody_00 3260 1.14 1.83 0.78 135 TR_XM_COVIDMETA1 3240 0.77 1.82 0.23 136 MAILING_LIST_MULTI 3098 2.50 1.74 2.89 137 XMSubPhish11 2964 1.95 1.67 2.10 138 RELAYCOUNTRY_IN 2954 0.63 1.66 0.10 139 SUBJ_ALL_CAPS 2922 1.60 1.64 1.58 140 HTTPS_HTTP_MISMATCH 2915 1.06 1.64 0.76 141 XMBdyGiftCard01 2913 1.18 1.64 0.95 142 XMSexyCombo_01 2839 1.03 1.60 0.74 143 XMBrknScrpt_02 2812 1.15 1.58 0.93 144 TR_XM_PHPDW 2803 0.88 1.58 0.51 145 TR_Mismatch_TLD_02 2771 0.59 1.56 0.10 146 XM_ProductURIs 2743 0.91 1.54 0.58 147 XMStockSpam_06 2665 1.32 1.50 1.23 148 TR_XM_PHPForged 2657 0.82 1.49 0.48 149 XM_URI_RBL 2639 0.60 1.48 0.14 150 URI_HEX 2613 1.56 1.47 1.61 151 TR_XM_FormFill2 2611 0.82 1.47 0.48 152 XM_H_PHPOS 2598 0.81 1.46 0.47 153 URI_TRY_3LD 2596 0.87 1.46 0.56 154 BAYES_40 2590 3.68 1.46 4.84 155 TR_XM_BayesRelay 2584 0.50 1.45 0.00 156 FROM_SUSPICIOUS_NTLD 2550 0.53 1.43 0.06 157 XM_B_COVIDMETA 2501 0.66 1.41 0.28 158 LongTLD 2498 0.66 1.40 0.27 159 TR_XM_NoHeaderRelay 2429 0.56 1.36 0.14 160 FROM_SUSPICIOUS_NTLD_FP 2410 0.50 1.35 0.06 161 HTML_TAG_BALANCE_BODY 2364 0.94 1.33 0.75 162 TR_XM_MSPIKECOMBO2 2361 0.48 1.33 0.04 163 XMHTML_After_End 2352 1.09 1.32 0.97 164 XM_UB99 2319 0.45 1.30 0.00 165 XMGenDplmaNmb 2254 0.82 1.27 0.58 166 XM_OfRef7 2217 0.50 1.25 0.11 167 XMClaimOffer 2173 0.56 1.22 0.21 168 BOTNET_NORDNS 2171 0.43 1.22 0.01 169 XMPhish11 2095 0.52 1.18 0.17 170 TR_XM_Base64_M1 2067 0.99 1.16 0.90 171 XM_Body_Dirty_Words_01 2059 0.50 1.16 0.16 172 URIBL_BLACK 2048 0.43 1.15 0.05 173 TR_XM_InvalidRelay 2028 0.40 1.14 0.02 174 XMPhish30 2020 0.85 1.14 0.70 175 TVD_PH_BODY_ACCOUNTS_PRE 1996 0.55 1.12 0.25 176 TR_XM_COVIDMETA4 1979 0.50 1.11 0.18 177 TR_XM_Undi_Recip5 1936 0.37 1.09 0.00 178 RELAYCOUNTRY_AU 1912 0.61 1.07 0.38 179 XMReplyNow 1875 0.52 1.05 0.25 180 KHOP_HELO_FCRDNS 1812 1.12 1.02 1.18 181 TR_XM_Undi_Recip2 1802 0.40 1.01 0.08 182 SHOPIFY_IMG_NOT_RCVD_SFY 1799 0.51 1.01 0.25 183 TR_XM_MaxSPIKE 1787 0.35 1.00 0.02 184 BAYES_20 1781 2.56 1.00 3.37 185 RCVD_IN_IADB_VOUCHED 1778 2.23 1.00 2.87 186 TO_NO_BRKTS_HTML_IMG 1755 0.41 0.99 0.11 187 MPART_ALT_DIFF_COUNT 1721 0.73 0.97 0.61 188 XM_B_DNDMA 1716 0.70 0.96 0.57 189 XMSubMetaSxObfu_02 1716 0.63 0.96 0.45 190 ACCT_PHISHING_MANY 1688 0.32 0.95 0.00 191 XMSubMetaSSx_00 1685 0.40 0.95 0.12 192 RELAYCOUNTRY_FR 1679 0.50 0.94 0.27 193 UNDISC_MONEY 1664 0.32 0.94 0.00 194 XM_B_SEO 1659 0.43 0.93 0.18 195 TR_XM_Undi_RecipCombo2 1635 0.31 0.92 0.00 196 TR_LOTS_OF_MONEY2 1619 0.44 0.91 0.19 197 T_MONEY_PERCENT 1619 0.44 0.91 0.19 198 TM2_M_A_HREF_HREF 1588 0.43 0.89 0.19 199 HTML_FONT_FACE_BAD 1578 1.11 0.89 1.22 200 XM_UB60 1574 0.35 0.88 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 296762 89.58 95.59 86.46 2 RELAYCOUNTRY_US 277713 80.28 79.05 80.91 3 DKIM_SIGNED 262945 81.31 90.37 76.61 4 XM_DK_Pass 255991 79.43 88.77 74.58 5 DKIM_VALID 252656 78.55 88.07 73.61 6 XM_B_Unicode 243674 74.69 81.80 70.99 7 DCC_CHECK_NEGATIVE 218732 50.79 25.84 63.73 8 BAYES_50 203379 53.61 42.71 59.25 9 DKIM_VALID_AU 202429 61.38 66.03 58.98 10 XMListUnsubscribeExists 174734 58.63 73.52 50.91 11 XM_B_SpammyWords 158330 54.61 70.98 46.13 12 XM_B_Unicode3 143260 42.13 42.88 41.74 13 RCVD_IN_MSPIKE_H2 136267 42.08 46.68 39.70 14 DCC_CHECK 124314 49.16 74.12 36.22 15 T_TM2_M_HEADER_IN_MSG 98292 26.30 21.80 28.64 16 DKIM_VALID_EF 98100 30.81 35.10 28.58 17 HTML_FONT_LOW_CONTRAST 97605 30.23 33.68 28.44 18 FVGT_m_MULTI_ODD 89340 29.60 36.48 26.03 19 LOC_TINY_FONT_1 88158 30.02 38.38 25.68 20 XMSubLong 77441 22.77 23.16 22.56 21 T_KAM_HTML_FONT_INVALID 71111 24.40 31.50 20.72 22 MIME_HTML_ONLY 69430 24.48 32.68 20.23 23 XM_B_SpammyWords2 69079 27.69 42.28 20.13 24 RCVD_IN_MSPIKE_WL 64267 18.46 17.95 18.72 25 ALL_TRUSTED 54963 11.59 3.06 16.01 26 XM_Multi_Part_URI 46414 15.08 18.08 13.52 27 USER_IN_DEF_DKIM_WL 44758 9.41 2.40 13.04 28 XM_Body_Dirty_Words 39718 14.76 20.90 11.57 29 RCVD_IN_MSPIKE_H3 39657 12.67 14.83 11.55 30 BAYES_60 33209 8.96 7.59 9.68 31 LotsOfNums_01 30865 8.21 6.71 8.99 32 XM_DKIMWhitelistDomains 30840 5.93 0.03 8.99 33 XM_B_Unsub 30376 10.69 14.23 8.85 34 BAYES_00 30367 6.07 0.71 8.85 35 UNPARSEABLE_RELAY 29180 9.40 11.12 8.50 36 XM_Evil_Numbers_Gen 28754 8.76 9.51 8.38 37 TooManyTo_001 28519 6.96 4.36 8.31 38 TR_XM_BayesUnsub 24683 9.48 13.90 7.19 39 T_TooManySym_01 22958 5.18 2.27 6.69 40 IN_ZIMBRA_NJ_WHITELIST 22486 4.34 0.08 6.55 41 XM_DK_Undo_02 21477 19.16 44.04 6.26 42 LOTS_OF_MONEY 21366 8.68 13.40 6.23 43 TR_XM_DK_Bayes 21089 4.23 0.52 6.14 44 TR_XM_DK_Bayes1 20776 4.16 0.52 6.05 45 HTML_IMAGE_RATIO_02 20128 5.97 6.17 5.86 46 RCVD_IN_MSPIKE_H4 20097 4.85 2.92 5.86 47 XM_H_Long_From01 19113 5.51 5.39 5.57 48 TR_XM_DK_Bayes2 18594 3.73 0.48 5.42 49 XM_SendGrid 18564 5.70 6.27 5.41 50 MIME_QP_LONG_LINE 18059 4.59 3.31 5.26 51 BOTNET_IPINHOSTNAME 17751 8.42 14.69 5.17 52 XM_PDF 17375 3.53 0.58 5.06 53 RCVD_IN_VALIDITY_SAFE 17342 4.26 2.72 5.05 54 BAYES_40 16605 3.68 1.46 4.84 55 RCVD_IN_IADB_LISTED 16464 3.95 2.32 4.80 56 BAYES_99 16345 13.96 31.71 4.76 57 XMStrtUSub 16303 4.40 3.74 4.75 58 HTML_IMAGE_RATIO_04 15903 4.65 4.69 4.63 59 TR_XM_DKIM_Undo 15664 15.48 36.55 4.56 60 RCVD_IN_VALIDITY_CERTIFIED 15626 3.71 2.07 4.55 61 BAYES_80 15583 6.01 8.83 4.54 62 MPART_ALT_DIFF 15510 5.93 8.64 4.52 63 XM_B_SpammyWords3 15183 7.86 14.50 4.42 64 RCVD_IN_IADB_SPF 14774 3.55 2.10 4.30 65 T_TooManySym_02 14394 3.00 0.69 4.19 66 TR_XM_SpammyWords4 14296 6.69 11.56 4.17 67 T_REMOTE_IMAGE 13994 3.33 1.89 4.08 68 XMNumbers 13767 3.82 3.45 4.01 69 RELAYCOUNTRY_META 13472 9.48 20.19 3.93 70 RCVD_IN_IADB_SENDERID 13442 3.26 1.98 3.92 71 RCVD_IN_IADB_DK 13201 3.21 2.00 3.85 72 XM_UncommonTLD01 13083 5.06 7.48 3.81 73 BAYES_999 12988 10.75 24.18 3.78 74 TR_XM_DK_SendGrid 12840 3.90 4.22 3.74 75 TR_XM_PhishingBody 12661 5.17 8.03 3.69 76 XMSubMetaSx_00 12031 4.32 5.90 3.51 77 FSL_BULK_SIG 12021 5.59 9.60 3.50 78 XMSexyCombo_05 11599 5.44 9.42 3.38 79 BAYES_20 11569 2.56 1.00 3.37 80 HTML_IMAGE_RATIO_06 11330 3.41 3.61 3.30 81 XM_B_Phish_Phrases 10736 3.90 5.40 3.13 82 DKIM_INVALID 10289 2.76 2.31 3.00 83 MAILING_LIST_MULTI 9929 2.50 1.74 2.89 84 RCVD_IN_IADB_VOUCHED 9834 2.23 1.00 2.87 85 BAYES_95 9415 3.69 5.50 2.74 86 MIME_HTML_ONLY_MULTI 8945 3.50 5.22 2.61 87 MIME_HTML_MOSTLY 8735 3.32 4.80 2.54 88 FROM_EXCESS_BASE64 8693 2.50 2.43 2.53 89 HTML_IMAGE_RATIO_08 8574 3.01 4.00 2.50 90 XM_B_SpammyTLD 8336 3.30 4.99 2.43 91 XM_CamelCaseFrm001 8025 2.21 1.95 2.34 92 XM_SPF_SoftFail 7877 3.05 4.50 2.29 93 TooManyTo_002 7698 1.65 0.52 2.24 94 HTML_MIME_NO_HTML_TAG 7542 2.87 4.18 2.20 95 TR_XM_SB_Phish 7425 2.05 1.83 2.16 96 URI_NOVOWEL 7320 2.47 3.12 2.13 97 XMSubPhish11 7214 1.95 1.67 2.10 98 XM_B_Phish66 6927 2.87 4.52 2.02 99 INVALID_MSGID 6923 1.37 0.13 2.02 100 BAYES_05 6755 1.46 0.48 1.97 101 TM2_M_URI_OPT_OUT 6710 2.24 2.78 1.95 102 BOTNET 6630 4.41 9.20 1.93 103 RCVD_IN_IADB_OPTIN 6397 1.41 0.52 1.86 104 MSGID_NOFQDN1 6324 1.22 0.02 1.84 105 IN_HORDE_ADDRESS_BOOK 6294 1.24 0.10 1.83 106 ANY_BOUNCE_MESSAGE 6183 1.42 0.69 1.80 107 BOUNCE_MESSAGE 6183 1.42 0.69 1.80 108 XM_OfRef6 6054 2.63 4.31 1.76 109 TR_XM_SpammyRelay 5990 6.25 14.93 1.75 110 TO_MALFORMED 5928 1.14 0.02 1.73 111 TR_DCC_Bayes_99 5882 9.02 23.11 1.71 112 HELO_NODOT 5650 1.25 0.47 1.65 113 HELO_NO_DOMAIN 5645 1.24 0.47 1.64 114 T_TooManySym_03 5535 1.14 0.24 1.61 115 URI_HEX 5519 1.56 1.47 1.61 116 TR_XM_UnparsRelay 5499 3.47 7.08 1.60 117 XM_B_Unsub2 5488 1.78 2.12 1.60 118 XM_DK_Undo_01 5473 1.96 2.66 1.59 119 SUBJ_ALL_CAPS 5435 1.60 1.64 1.58 120 TR_Symld_Words 5428 1.33 0.84 1.58 121 TVD_RCVD_IP 5418 1.12 0.23 1.58 122 TVD_SPACE_RATIO 5257 1.03 0.05 1.53 123 T_XMDrugObfuBody_14 5241 2.22 3.56 1.53 124 XM_B_Investor 5207 2.66 4.87 1.52 125 TooManyTo_003 5200 1.14 0.43 1.52 126 XM_GoogleGroups 4946 2.02 3.15 1.44 127 UNTRUSTED_Relay 4853 3.31 6.96 1.41 128 T_XMDrugObfuBody_08 4724 2.30 4.10 1.38 129 XM_H_Long_From02 4688 1.17 0.80 1.37 130 RCVD_IN_MSPIKE_H5 4513 0.94 0.20 1.31 131 TR_XM_SpammyWords5 4397 2.12 3.74 1.28 132 XM_H_Trusted_IP 4261 0.82 0.00 1.24 133 XMBSHREFv2 4234 0.89 0.22 1.23 134 XMStockSpam_06 4232 1.32 1.50 1.23 135 HTML_FONT_FACE_BAD 4199 1.11 0.89 1.22 136 XMGappySubj_01 4103 0.85 0.19 1.20 137 KHOP_HELO_FCRDNS 4045 1.12 1.02 1.18 138 RELAYCOUNTRY_CA 4045 4.35 10.46 1.18 139 TM2_M_VERY_LONG_WORD 4023 2.50 5.06 1.17 140 XMCapTrack 3826 0.85 0.35 1.11 141 XMDiploma_00 3660 1.50 2.34 1.07 142 TooManyTo_004 3638 0.83 0.38 1.06 143 RCVD_IN_RP_SAFE 3524 0.86 0.53 1.03 144 FROM_GOV_DKIM_AU 3433 0.72 0.18 1.00 145 XMBody_95 3362 0.70 0.15 0.98 146 XMHTML_After_End 3330 1.09 1.32 0.97 147 XM_UB50 3275 1.72 3.19 0.95 148 XMBdyGiftCard01 3252 1.18 1.64 0.95 149 RCVD_IN_RP_CERTIFIED 3223 0.75 0.38 0.94 150 XMBrknScrpt_02 3176 1.15 1.58 0.93 151 TR_XM_Base64_M1 3104 0.99 1.16 0.90 152 FVGT_m_MULTI_ODD_EMAIL 2973 0.61 0.12 0.87 153 TooManyTo_005 2943 0.68 0.34 0.86 154 DKIM_ADSP_CUSTOM_MED 2896 0.76 0.61 0.84 155 SpammyFromTLD_01 2883 1.45 2.64 0.84 156 T_FILL_THIS_FORM_SHORT 2842 1.86 3.85 0.83 157 TR_XM_SpammyWords2 2687 4.83 12.64 0.78 158 T_XMDrugObfuBody_00 2667 1.14 1.83 0.78 159 HTTPS_HTTP_MISMATCH 2599 1.06 1.64 0.76 160 HTML_TAG_BALANCE_BODY 2558 0.94 1.33 0.75 161 XMSexyCombo_01 2537 1.03 1.60 0.74 162 XMPhish30 2389 0.85 1.14 0.70 163 RCVD_IN_MSPIKE_BL 2263 2.07 4.78 0.66 164 XMBody_17 2238 1.71 3.76 0.65 165 TR_XM_MSPIKECOMBO 2224 2.04 4.71 0.65 166 XMSubNoVowel 2218 0.61 0.53 0.65 167 T_OBFU_PDF_ATTACH 2195 0.46 0.11 0.64 168 HTML_IMAGE_ONLY_20 2193 0.55 0.37 0.64 169 XMNoVowels 2152 0.60 0.55 0.63 170 T_XMHurry_00 2139 1.18 2.26 0.62 171 XM_B_COPY_HTML 2111 0.61 0.59 0.62 172 XM_B_SpammyWords4 2110 1.33 2.71 0.61 173 XM_ShortIntro_01 2108 0.56 0.45 0.61 174 MPART_ALT_DIFF_COUNT 2104 0.73 0.97 0.61 175 XM_H_PHPMailer 2013 0.63 0.71 0.59 176 XMGenDplmaNmb 1998 0.82 1.27 0.58 177 XM_ProductURIs 1996 0.91 1.54 0.58 178 XM_B_DNDMA 1943 0.70 0.96 0.57 179 URI_TRY_3LD 1913 0.87 1.46 0.56 180 TR_MetaPhish_Combo_01 1848 0.57 0.64 0.54 181 XMHTMLBadTable_001 1812 0.57 0.65 0.53 182 TR_XM_PHPDW 1759 0.88 1.58 0.51 183 NML_ADSP_CUSTOM_MED 1757 0.49 0.45 0.51 184 XMMoneyMeta_00 1733 0.58 0.71 0.50 185 SHORT_HELO_AND_INLINE_IMAGE 1725 0.35 0.05 0.50 186 XMSubMetaSxObfu_03 1720 0.54 0.62 0.50 187 RELAYCOUNTRY_GB 1712 0.58 0.73 0.50 188 FORGED_GMAIL_RCVD 1691 0.50 0.50 0.49 189 XMSlimDrugH 1682 0.47 0.43 0.49 190 TR_XM_PHPForged 1642 0.82 1.49 0.48 191 TR_XM_FormFill2 1640 0.82 1.47 0.48 192 XMPhish14 1617 0.58 0.80 0.47 193 XM_H_PHPOS 1611 0.81 1.46 0.47 194 XMLngstWrd_00 1608 1.31 2.93 0.47 195 HTML_IMAGE_ONLY_28 1547 0.42 0.37 0.45 196 XMSubMetaSxObfu_02 1544 0.63 0.96 0.45 197 FILL_THIS_FORM 1534 0.57 0.80 0.45 198 T_Symld_Words_02 1533 0.59 0.86 0.45 199 PLING_QUERY 1529 0.59 0.86 0.45 200 SpammyFromTLD_02 1519 1.47 3.44 0.44 ----------------------------------------------------------------------