Email: 614523 Autolearn: 0 AvgScore: 0.66 AvgScanTime: 1.76 sec Spam: 99195 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 3.13 sec Ham: 515328 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.50 sec Time Spent Running SA: 301.27 hours Time Spent Processing Spam: 86.19 hours Time Spent Processing Ham: 215.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 95396 98.00 96.17 98.35 2 HTML_MESSAGE 91761 89.89 92.51 89.39 3 DKIM_SIGNED 74173 76.26 74.77 76.54 4 XM_DK_Pass 70931 74.85 71.51 75.49 5 XM_B_Unicode 69020 72.37 69.58 72.91 6 XMListUnsubscribeExists 64600 55.30 65.12 53.40 7 RELAYCOUNTRY_US 62422 79.48 62.93 82.66 8 DKIM_VALID 60974 70.08 61.47 71.74 9 XM_DK_Undo_02 48887 18.22 49.28 12.24 10 DKIM_VALID_AU 45319 52.87 45.69 54.26 11 BAYES_50 36520 48.81 36.82 51.11 12 BAYES_99 35005 12.21 35.29 7.76 13 XM_B_Unicode3 33587 41.46 33.86 42.92 14 RELAYCOUNTRY_META 32069 10.11 32.33 5.83 15 DKIM_VALID_EF 31535 27.76 31.79 26.98 16 XM_B_SpammyWords 30949 25.88 31.20 24.85 17 BOTNET 29941 7.60 30.18 3.26 18 MIME_HTML_ONLY 29766 24.54 30.01 23.49 19 LOC_TINY_FONT_1 29148 26.98 29.38 26.51 20 RCVD_IN_MSPIKE_H2 26519 26.14 26.73 26.03 21 BAYES_999 26365 9.49 26.58 6.20 22 UNTRUSTED_Relay 26087 6.41 26.30 2.58 23 XMSubLong 25636 22.53 25.84 21.89 24 HTML_FONT_LOW_CONTRAST 24781 28.38 24.98 29.04 25 T_TM2_M_HEADER_IN_MSG 24177 28.05 24.37 28.75 26 FVGT_m_MULTI_ODD 23619 22.54 23.81 22.30 27 T_KAM_HTML_FONT_INVALID 21765 18.79 21.94 18.18 28 XM_UncommonTLD01 19675 5.79 19.83 3.09 29 XM_Body_Dirty_Words 18997 15.35 19.15 14.62 30 XM_Multi_Part_URI 17337 13.65 17.48 12.92 31 XM_B_SpammyWords2 17278 12.15 17.42 11.14 32 BOTNET_IPINHOSTNAME 14732 7.15 14.85 5.67 33 LOTS_OF_MONEY 14498 9.17 14.62 8.12 34 RCVD_IN_MSPIKE_BL 13675 3.06 13.79 0.99 35 DKIM_INVALID 13199 6.18 13.31 4.80 36 HTML_IMAGE_RATIO_02 12660 9.03 12.76 8.32 37 XMSexyCombo_05 12040 5.79 12.14 4.57 38 MPART_ALT_DIFF 12033 7.62 12.13 6.76 39 XM_B_Phish_Phrases 11655 8.14 11.75 7.44 40 XM_B_Unsub 11528 11.67 11.62 11.68 41 RCVD_IN_PSBL 10671 1.75 10.76 0.01 42 MIME_HTML_MOSTLY 10062 3.68 10.14 2.43 43 XM_SPF_SoftFail 9918 3.16 10.00 1.84 44 RCVD_IN_BL_SPAMCOP_NET 9850 2.99 9.93 1.65 45 SpammyFromTLD_01 9799 2.27 9.88 0.80 46 NO_DNS_FOR_FROM 9537 3.72 9.61 2.59 47 BAYES_80 8947 5.28 9.02 4.56 48 XM_Evil_Numbers_Gen 8795 9.00 8.87 9.02 49 XM_UB50 8715 2.62 8.79 1.44 50 URI_PHP_REDIR 7788 1.29 7.85 0.03 51 LotsOfNums_01 7621 8.88 7.68 9.11 52 BAYES_60 7498 7.41 7.56 7.38 53 RCVD_IN_MSPIKE_L5 7455 1.54 7.52 0.39 54 XM_UB99 7388 1.21 7.45 0.01 55 RELAYCOUNTRY_CA 7153 2.83 7.21 1.99 56 RCVD_IN_RP_RNBL 7050 1.22 7.11 0.08 57 RELAYCOUNTRY_FR 6977 1.35 7.03 0.26 58 RCVD_IN_MSPIKE_WL 6953 24.64 7.01 28.04 59 XM_B_COVIDMETA 6944 2.49 7.00 1.62 60 T_REMOTE_IMAGE 6878 4.14 6.93 3.60 61 XMSubMetaSx_00 6517 4.01 6.57 3.52 62 TooManyTo_001 6278 7.78 6.33 8.06 63 HTML_MIME_NO_HTML_TAG 6195 3.44 6.25 2.90 64 XM_H_Long_From01 6045 6.15 6.09 6.16 65 TR_XM_PhishingBody 6010 3.65 6.06 3.19 66 SpammyFromTLD_02 5780 1.34 5.83 0.48 67 XM_UB999 5637 0.92 5.68 0.00 68 UNPARSEABLE_RELAY 5598 7.66 5.64 8.05 69 XM_B_SpammyWords3 5584 3.07 5.63 2.57 70 BAYES_95 5422 3.36 5.47 2.96 71 XMNumbers 5227 3.84 5.27 3.57 72 XM_OfRef6 5174 2.16 5.22 1.57 73 XM_DIRTYINTL 5034 1.28 5.07 0.55 74 T_FILL_THIS_FORM_SHORT 5010 1.49 5.05 0.80 75 BOTNET_NORDNS 4598 0.76 4.64 0.02 76 RCVD_IN_MSPIKE_L3 4543 1.18 4.58 0.53 77 HTML_IMAGE_RATIO_04 4496 6.74 4.53 7.16 78 XM_SendGrid 4462 6.58 4.50 6.98 79 HTML_IMAGE_ONLY_16 4260 0.91 4.29 0.26 80 XM_B_SpammyTLD 4215 2.76 4.25 2.47 81 HTML_SHORT_LINK_IMG_2 4169 0.72 4.20 0.05 82 LOCALPART_IN_SUBJECT 4152 0.70 4.19 0.03 83 T_XMDrugObfuBody_00 4056 1.52 4.09 1.03 84 TR_XM_COVIDMETA4 4026 1.21 4.06 0.67 85 RCVD_IN_MSPIKE_H3 3995 13.84 4.03 15.73 86 XM_B_Phish66 3935 2.00 3.97 1.62 87 HTML_FONT_TINY_NORDNS 3844 0.87 3.88 0.29 88 HTML_IMAGE_ONLY_12 3768 0.80 3.80 0.22 89 IMG_ONLY_FM_DOM_INFO 3690 0.60 3.72 0.00 90 TR_XM_FormFill 3400 0.59 3.43 0.04 91 TM2_M_URI_OPT_OUT 3287 4.30 3.31 4.49 92 RELAYCOUNTRY_RU 3281 0.99 3.31 0.55 93 T_XMDrugObfuBody_08 3214 2.23 3.24 2.04 94 TR_XM_INV_DKIM 3176 0.62 3.20 0.13 95 FROM_WORDY 3170 0.53 3.20 0.02 96 XM_UB80 3167 0.59 3.19 0.08 97 TR_XM_PHPDW 3140 0.84 3.17 0.39 98 XMStrtUSub 2890 4.15 2.91 4.39 99 XMBody_17 2879 1.15 2.90 0.81 100 XM_CamelCaseFrm001 2829 2.02 2.85 1.86 101 HTML_IMAGE_RATIO_06 2815 3.65 2.84 3.80 102 T_TooManySym_01 2789 3.99 2.81 4.22 103 ALL_TRUSTED 2741 11.07 2.76 12.67 104 XMBrknScrpt_02 2737 1.31 2.76 1.03 105 RCVD_IN_MSPIKE_H4 2729 9.05 2.75 10.26 106 HTML_IMAGE_RATIO_08 2729 2.60 2.75 2.58 107 TR_XM_PHPForged 2703 0.76 2.72 0.38 108 KHOP_HELO_FCRDNS 2665 1.80 2.69 1.63 109 TR_XM_FormFill2 2659 0.75 2.68 0.38 110 XM_H_PHPOS 2649 0.74 2.67 0.37 111 XM_UB95 2614 0.44 2.64 0.02 112 TO_NO_BRKTS_HTML_ONLY 2574 0.54 2.59 0.14 113 MISSING_HEADERS 2560 0.93 2.58 0.62 114 TR_XM_UnparsRelay 2520 0.95 2.54 0.64 115 TR_XM_MaxSPIKE 2437 0.45 2.46 0.07 116 XM_OfRef7 2410 0.71 2.43 0.37 117 TR_XM_MaxWHORU 2396 0.44 2.42 0.07 118 XM_UB60 2391 0.58 2.41 0.23 119 HELO_NODOT 2385 1.47 2.40 1.29 120 HELO_NO_DOMAIN 2383 1.47 2.40 1.29 121 MIME_QP_LONG_LINE 2383 5.18 2.40 5.72 122 RELAYCOUNTRY_DE 2343 0.68 2.36 0.35 123 TR_XM_COVIDMETA1 2320 0.67 2.34 0.35 124 XM_URI_RBL 2305 0.56 2.32 0.22 125 REPLYTO_WITHOUT_TO_CC 2278 0.60 2.30 0.27 126 T_PDS_OTHER_BAD_TLD 2185 0.85 2.20 0.59 127 TR_LOTS_OF_MONEY1 2083 0.54 2.10 0.24 128 XMDiploma_00 2082 1.87 2.10 1.83 129 TR_XM_DK_SendGrid 2078 3.69 2.09 4.00 130 FROM_SUSPICIOUS_NTLD 2031 0.39 2.05 0.07 131 MIME_HTML_ONLY_MULTI 2028 4.33 2.04 4.77 132 FILL_THIS_FORM 2020 0.59 2.04 0.31 133 BAYES_40 1967 4.16 1.98 4.58 134 FROM_SUSPICIOUS_NTLD_FP 1967 0.37 1.98 0.06 135 XM_B_Unsub2 1965 1.85 1.98 1.82 136 XMSexyCombo_01 1945 0.86 1.96 0.64 137 URIBL_SBL_A 1925 0.50 1.94 0.22 138 T_XMDrugObfuBody_14 1918 1.63 1.93 1.57 139 URI_HEX 1911 1.73 1.93 1.69 140 RELAYCOUNTRY_GB 1858 0.99 1.87 0.82 141 XMSubMetaSxObfu_03 1852 0.76 1.87 0.55 142 DATE_IN_PAST_03_06 1851 0.39 1.87 0.11 143 TO_NAME_SUBJ_NO_RDNS 1838 0.30 1.85 0.00 144 FILL_THIS_FORM_LONG 1797 0.40 1.81 0.12 145 XMBody_78 1795 0.63 1.81 0.41 146 XMGppyBdWords 1792 0.58 1.81 0.35 147 LongTLD 1784 0.43 1.80 0.17 148 XMHTML_After_End 1784 1.03 1.80 0.88 149 DKIM_ADSP_CUSTOM_MED 1776 1.81 1.79 1.81 150 DATE_IN_PAST_06_12 1727 0.48 1.74 0.24 151 RDNS_DYNAMIC 1712 0.58 1.73 0.36 152 BAYES_20 1701 3.15 1.71 3.43 153 RELAYCOUNTRY_IN 1672 0.36 1.69 0.11 154 NML_ADSP_CUSTOM_MED 1653 1.53 1.67 1.50 155 FROM_EXCESS_BASE64 1644 2.77 1.66 2.98 156 T_Symld_Words_02 1630 0.80 1.64 0.63 157 TM2_M_VERY_LONG_WORD 1621 1.43 1.63 1.39 158 SUBJ_ALL_CAPS 1615 1.61 1.63 1.61 159 TR_Symld_Words 1614 1.72 1.63 1.74 160 TR_XM_MaxBayes 1602 0.32 1.62 0.07 161 TR_XM_RelayPhish 1527 0.35 1.54 0.12 162 FORGED_GMAIL_RCVD 1470 1.20 1.48 1.15 163 TR_LOTS_OF_MONEY3 1451 0.69 1.46 0.54 164 URI_NOVOWEL 1447 2.14 1.46 2.27 165 MAILING_LIST_MULTI 1436 2.00 1.45 2.11 166 LH_URI_DOM_IN_PATH 1435 1.16 1.45 1.11 167 XM_SPF_Unknown 1416 0.72 1.43 0.58 168 URI_TRY_3LD 1382 1.42 1.39 1.43 169 HK_RANDOM_FROM 1336 0.31 1.35 0.11 170 XM_Nigeria_01 1329 0.32 1.34 0.12 171 MPART_ALT_DIFF_COUNT 1324 0.51 1.33 0.35 172 XMStockSpam_06 1302 1.26 1.31 1.25 173 XMGenDplmaNmb 1263 0.99 1.27 0.94 174 XM_H_PHPMailer 1239 0.59 1.25 0.46 175 T_FILL_THIS_FORM_LOAN 1191 0.45 1.20 0.30 176 TR_MetaPhish_Combo_01 1190 0.83 1.20 0.76 177 HK_SCAM 1183 0.20 1.19 0.01 178 TR_Mismatch_TLD_02 1182 0.26 1.19 0.08 179 MIME_CHARSET_FARAWAY 1181 0.26 1.19 0.08 180 XM_DK_Undo_01 1160 1.58 1.17 1.66 181 TR_Mismatch_TLD_01 1159 0.38 1.17 0.23 182 XMMoneyMeta_00 1146 0.63 1.16 0.53 183 XMSubNoVowel 1127 1.13 1.14 1.13 184 HK_RANDOM_REPLYTO 1107 0.40 1.12 0.26 185 BAYES_00 1090 13.47 1.10 15.86 186 XM_PDF 1077 3.75 1.09 4.26 187 XM_BadFromFormat 1074 0.33 1.08 0.18 188 XMBdyGiftCard01 1046 1.07 1.05 1.07 189 BAYES_05 1043 2.15 1.05 2.37 190 LONG_JUNK_URI 1034 0.22 1.04 0.06 191 CHARSET_FARAWAY_HEADER 1028 0.20 1.04 0.04 192 NUMERIC_HTTP_ADDR 1026 0.53 1.03 0.43 193 RCVD_IN_IADB_LISTED 1015 4.20 1.02 4.81 194 INVESTMENT_ADVICE 1006 0.27 1.01 0.13 195 T_DEAR_BENEFICIARY 991 0.34 1.00 0.22 196 RELAYCOUNTRY_NG_I 986 0.16 0.99 0.00 197 RCVD_IN_MSPIKE_ZBI 978 0.16 0.99 0.00 198 XMPhish30 974 0.63 0.98 0.56 199 FSL_HELO_NON_FQDN_1 962 0.19 0.97 0.04 200 MONEY_FRAUD_5 956 0.34 0.96 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 506831 98.00 96.17 98.35 2 HTML_MESSAGE 460639 89.89 92.51 89.39 3 RELAYCOUNTRY_US 425981 79.48 62.93 82.66 4 DKIM_SIGNED 394434 76.26 74.77 76.54 5 XM_DK_Pass 389017 74.85 71.51 75.49 6 XM_B_Unicode 375705 72.37 69.58 72.91 7 DKIM_VALID 369681 70.08 61.47 71.74 8 DKIM_VALID_AU 279599 52.87 45.69 54.26 9 XMListUnsubscribeExists 275203 55.30 65.12 53.40 10 BAYES_50 263404 48.81 36.82 51.11 11 XM_B_Unicode3 221167 41.46 33.86 42.92 12 HTML_FONT_LOW_CONTRAST 149632 28.38 24.98 29.04 13 T_TM2_M_HEADER_IN_MSG 148169 28.05 24.37 28.75 14 RCVD_IN_MSPIKE_WL 144474 24.64 7.01 28.04 15 DKIM_VALID_EF 139033 27.76 31.79 26.98 16 LOC_TINY_FONT_1 136638 26.98 29.38 26.51 17 RCVD_IN_MSPIKE_H2 134121 26.14 26.73 26.03 18 XM_B_SpammyWords 128071 25.88 31.20 24.85 19 MIME_HTML_ONLY 121033 24.54 30.01 23.49 20 FVGT_m_MULTI_ODD 114906 22.54 23.81 22.30 21 XMSubLong 112817 22.53 25.84 21.89 22 T_KAM_HTML_FONT_INVALID 93682 18.79 21.94 18.18 23 BAYES_00 81712 13.47 1.10 15.86 24 RCVD_IN_MSPIKE_H3 81084 13.84 4.03 15.73 25 XM_Body_Dirty_Words 75350 15.35 19.15 14.62 26 XM_Multi_Part_URI 66576 13.65 17.48 12.92 27 ALL_TRUSTED 65289 11.07 2.76 12.67 28 XM_DK_Undo_02 63073 18.22 49.28 12.24 29 XM_B_Unsub 60208 11.67 11.62 11.68 30 XM_B_SpammyWords2 57399 12.15 17.42 11.14 31 RCVD_IN_MSPIKE_H4 52897 9.05 2.75 10.26 32 LotsOfNums_01 46968 8.88 7.68 9.11 33 TR_XM_DK_Bayes 46678 7.67 0.49 9.06 34 XM_Evil_Numbers_Gen 46499 9.00 8.87 9.02 35 TR_XM_DK_Bayes1 43916 7.19 0.27 8.52 36 HTML_IMAGE_RATIO_02 42860 9.03 12.76 8.32 37 LOTS_OF_MONEY 41852 9.17 14.62 8.12 38 TooManyTo_001 41535 7.78 6.33 8.06 39 UNPARSEABLE_RELAY 41478 7.66 5.64 8.05 40 BAYES_99 40002 12.21 35.29 7.76 41 TR_XM_DK_Bayes2 39847 6.52 0.23 7.73 42 XM_DKIMWhitelistDomains 38912 6.33 0.01 7.55 43 XM_B_Phish_Phrases 38355 8.14 11.75 7.44 44 BAYES_60 38011 7.41 7.56 7.38 45 RCVD_IN_RP_SAFE 37458 6.16 0.41 7.27 46 HTML_IMAGE_RATIO_04 36893 6.74 4.53 7.16 47 XM_SendGrid 35950 6.58 4.50 6.98 48 RCVD_IN_RP_CERTIFIED 35270 5.78 0.28 6.84 49 MPART_ALT_DIFF 34820 7.62 12.13 6.76 50 BAYES_999 31971 9.49 26.58 6.20 51 XM_H_Long_From01 31747 6.15 6.09 6.16 52 RELAYCOUNTRY_META 30054 10.11 32.33 5.83 53 MIME_QP_LONG_LINE 29455 5.18 2.40 5.72 54 BOTNET_IPINHOSTNAME 29198 7.15 14.85 5.67 55 IN_ZIMBRA_NJ_WHITELIST 27432 4.47 0.03 5.32 56 RCVD_IN_IADB_LISTED 24795 4.20 1.02 4.81 57 DKIM_INVALID 24753 6.18 13.31 4.80 58 MIME_HTML_ONLY_MULTI 24599 4.33 2.04 4.77 59 BAYES_40 23598 4.16 1.98 4.58 60 XMSexyCombo_05 23554 5.79 12.14 4.57 61 BAYES_80 23499 5.28 9.02 4.56 62 XM_H_Trusted_IP 23172 3.77 0.00 4.50 63 TM2_M_URI_OPT_OUT 23125 4.30 3.31 4.49 64 XMStrtUSub 22606 4.15 2.91 4.39 65 XM_PDF 21973 3.75 1.09 4.26 66 RCVD_IN_IADB_SPF 21739 3.67 0.84 4.22 67 T_TooManySym_01 21730 3.99 2.81 4.22 68 TR_XM_DK_SendGrid 20607 3.69 2.09 4.00 69 HTML_IMAGE_RATIO_06 19598 3.65 2.84 3.80 70 RCVD_IN_IADB_SENDERID 19473 3.29 0.76 3.78 71 RCVD_IN_IADB_DK 18903 3.20 0.76 3.67 72 T_REMOTE_IMAGE 18547 4.14 6.93 3.60 73 XMNumbers 18388 3.84 5.27 3.57 74 XMSubMetaSx_00 18134 4.01 6.57 3.52 75 BAYES_20 17655 3.15 1.71 3.43 76 BOTNET 16786 7.60 30.18 3.26 77 TR_XM_PhishingBody 16417 3.65 6.06 3.19 78 XM_UncommonTLD01 15925 5.79 19.83 3.09 79 FROM_EXCESS_BASE64 15378 2.77 1.66 2.98 80 BAYES_95 15252 3.36 5.47 2.96 81 HTML_MIME_NO_HTML_TAG 14964 3.44 6.25 2.90 82 RCVD_IN_IADB_VOUCHED 14885 2.51 0.51 2.89 83 ANY_BOUNCE_MESSAGE 14686 2.49 0.60 2.85 84 BOUNCE_MESSAGE 14683 2.49 0.59 2.85 85 NO_DNS_FOR_FROM 13349 3.72 9.61 2.59 86 UNTRUSTED_Relay 13313 6.41 26.30 2.58 87 HTML_IMAGE_RATIO_08 13277 2.60 2.75 2.58 88 XM_B_SpammyWords3 13263 3.07 5.63 2.57 89 XM_B_SpammyTLD 12720 2.76 4.25 2.47 90 MIME_HTML_MOSTLY 12543 3.68 10.14 2.43 91 BAYES_05 12188 2.15 1.05 2.37 92 URI_NOVOWEL 11674 2.14 1.46 2.27 93 T_TooManySym_02 11396 1.94 0.55 2.21 94 MAILING_LIST_MULTI 10878 2.00 1.45 2.11 95 HTML_FONT_FACE_BAD 10853 1.86 0.60 2.11 96 T_XMDrugObfuBody_08 10504 2.23 3.24 2.04 97 RCVD_IN_MSPIKE_H5 10493 1.74 0.23 2.04 98 RELAYCOUNTRY_CA 10244 2.83 7.21 1.99 99 TooManyTo_002 9889 1.75 0.90 1.92 100 RCVD_IN_IADB_OPTIN 9843 1.67 0.42 1.91 101 XM_CamelCaseFrm001 9600 2.02 2.85 1.86 102 XM_SPF_SoftFail 9499 3.16 10.00 1.84 103 TVD_RCVD_IP 9481 1.58 0.23 1.84 104 XMDiploma_00 9414 1.87 2.10 1.83 105 XM_B_Unsub2 9392 1.85 1.98 1.82 106 DKIM_ADSP_CUSTOM_MED 9342 1.81 1.79 1.81 107 TR_Symld_Words 8943 1.72 1.63 1.74 108 URI_HEX 8724 1.73 1.93 1.69 109 XM_DK_Undo_01 8556 1.58 1.17 1.66 110 RCVD_IN_BL_SPAMCOP_NET 8508 2.99 9.93 1.65 111 KHOP_HELO_FCRDNS 8415 1.80 2.69 1.63 112 XM_B_Phish66 8344 2.00 3.97 1.62 113 XM_B_COVIDMETA 8330 2.49 7.00 1.62 114 SUBJ_ALL_CAPS 8296 1.61 1.63 1.61 115 XM_OfRef6 8108 2.16 5.22 1.57 116 T_XMDrugObfuBody_14 8081 1.63 1.93 1.57 117 NML_ADSP_CUSTOM_MED 7728 1.53 1.67 1.50 118 HELO_MISC_IP 7500 1.37 0.91 1.46 119 CK_HELO_DYNAMIC_SPLIT_IP 7496 1.36 0.86 1.45 120 XM_UB50 7401 2.62 8.79 1.44 121 URI_TRY_3LD 7371 1.42 1.39 1.43 122 INVALID_MSGID 7323 1.26 0.44 1.42 123 IN_HORDE_ADDRESS_BOOK 7246 1.18 0.03 1.41 124 TM2_M_VERY_LONG_WORD 7184 1.43 1.63 1.39 125 XMGappySubj_01 6656 1.11 0.15 1.29 126 HELO_NODOT 6636 1.47 2.40 1.29 127 HELO_NO_DOMAIN 6635 1.47 2.40 1.29 128 XMStockSpam_06 6433 1.26 1.31 1.25 129 TooManyTo_003 6413 1.14 0.62 1.24 130 XM_GoogleGroups 6360 1.10 0.42 1.23 131 TO_MALFORMED 6337 1.03 0.02 1.23 132 XM_ProductURIs 5995 1.09 0.73 1.16 133 FORGED_GMAIL_RCVD 5920 1.20 1.48 1.15 134 XMSubNoVowel 5817 1.13 1.14 1.13 135 LH_URI_DOM_IN_PATH 5709 1.16 1.45 1.11 136 XM_H_Long_From02 5508 1.05 0.94 1.07 137 XMBdyGiftCard01 5508 1.07 1.05 1.07 138 XMBrknScrpt_02 5299 1.31 2.76 1.03 139 T_XMDrugObfuBody_00 5286 1.52 4.09 1.03 140 XMCapTrack 5250 0.93 0.46 1.02 141 TR_MSPIKEBAYES00 5141 0.84 0.01 1.00 142 RCVD_IN_MSPIKE_BL 5124 3.06 13.79 0.99 143 USER_IN_DEF_DKIM_WL 5037 0.82 0.01 0.98 144 XMGenDplmaNmb 4821 0.99 1.27 0.94 145 T_TooManySym_03 4731 0.79 0.14 0.92 146 XMHTML_After_End 4554 1.03 1.80 0.88 147 TooManyTo_004 4347 0.79 0.53 0.84 148 RELAYCOUNTRY_GB 4206 0.99 1.87 0.82 149 XMBody_17 4182 1.15 2.90 0.81 150 SpammyFromTLD_01 4147 2.27 9.88 0.80 151 T_FILL_THIS_FORM_SHORT 4142 1.49 5.05 0.80 152 TR_MetaPhish_Combo_01 3903 0.83 1.20 0.76 153 DIET_1 3680 0.75 0.92 0.71 154 XMBody_95 3609 0.62 0.19 0.70 155 TooManyTo_005 3586 0.65 0.43 0.70 156 XM_RXBody 3475 0.65 0.49 0.67 157 TR_BOTNET_NEGATE 3465 0.63 0.39 0.67 158 TR_XM_COVIDMETA4 3430 1.21 4.06 0.67 159 FROM_GOV_DKIM_AU 3389 0.56 0.05 0.66 160 HTML_IMAGE_ONLY_20 3345 0.62 0.48 0.65 161 HTTPS_HTTP_MISMATCH 3314 0.66 0.75 0.64 162 TR_XM_UnparsRelay 3312 0.95 2.54 0.64 163 XMSexyCombo_01 3312 0.86 1.96 0.64 164 T_Symld_Words_02 3270 0.80 1.64 0.63 165 XMPhish08 3228 0.64 0.73 0.63 166 MISSING_HEADERS 3183 0.93 2.58 0.62 167 DKIM_ADSP_NXDOMAIN 3134 0.65 0.89 0.61 168 XMSubMetaI_00 3131 0.65 0.89 0.61 169 T_XMHurry_00 3088 0.64 0.88 0.60 170 XM_ShortIntro_01 3061 0.58 0.48 0.59 171 XMHTMLBadTable_001 3037 0.54 0.29 0.59 172 T_OBFU_PDF_ATTACH 3029 0.52 0.15 0.59 173 T_PDS_OTHER_BAD_TLD 3026 0.85 2.20 0.59 174 XM_SPF_Unknown 3011 0.72 1.43 0.58 175 XMPhish30 2875 0.63 0.98 0.56 176 XM_DIRTYINTL 2839 1.28 5.07 0.55 177 XMSubMetaSxObfu_03 2836 0.76 1.87 0.55 178 PLING_QUERY 2833 0.53 0.41 0.55 179 RELAYCOUNTRY_RU 2817 0.99 3.31 0.55 180 TR_LOTS_OF_MONEY3 2803 0.69 1.46 0.54 181 XMNoVowels 2802 0.59 0.84 0.54 182 RCVD_IN_MSPIKE_L3 2719 1.18 4.58 0.53 183 XMMoneyMeta_00 2708 0.63 1.16 0.53 184 T_TooManySym_04 2540 0.42 0.04 0.49 185 XMBSHREFv2 2485 0.46 0.32 0.48 186 SpammyFromTLD_02 2450 1.34 5.83 0.48 187 HTML_TAG_BALANCE_BODY 2431 0.49 0.58 0.47 188 XMLngstWrd_00 2409 0.46 0.44 0.47 189 XM_H_PHPMailer 2380 0.59 1.25 0.46 190 XM_B_REG_HTML 2324 0.41 0.18 0.45 191 XM_B_COPY_HTML 2313 0.48 0.64 0.45 192 XM_S_SubURI 2299 0.39 0.09 0.45 193 NUMERIC_HTTP_ADDR 2226 0.53 1.03 0.43 194 TM2_M_BODY_EMPTY 2190 0.38 0.14 0.42 195 XMLngstWrd_01 2145 0.42 0.41 0.42 196 RELAYCOUNTRY_AU 2099 0.43 0.56 0.41 197 XMBody_78 2094 0.63 1.81 0.41 198 HTML_IMAGE_ONLY_32 2086 0.39 0.31 0.40 199 FROM_GOV_SPOOF 2052 0.38 0.31 0.40 200 TM2_M_A_HREF_HREF 2040 0.44 0.69 0.40 ----------------------------------------------------------------------