Email: 778237 Autolearn: 0 AvgScore: -0.40 AvgScanTime: 1.15 sec Spam: 107249 Autolearn: 0 AvgScore: 13.85 AvgScanTime: 1.33 sec Ham: 670988 Autolearn: 0 AvgScore: -2.68 AvgScanTime: 1.12 sec Time Spent Running SA: 248.54 hours Time Spent Processing Spam: 39.59 hours Time Spent Processing Ham: 208.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 103453 98.19 96.46 98.47 2 HTML_MESSAGE 98584 82.96 91.92 81.52 3 DKIM_SIGNED 75249 63.68 70.16 62.64 4 XM_DK_Pass 73037 62.55 68.10 61.66 5 XM_B_Unicode 70997 67.10 66.20 67.24 6 DKIM_VALID 70727 60.74 65.95 59.91 7 XMListUnsubscribeExists 64900 45.75 60.51 43.39 8 RELAYCOUNTRY_US 62708 72.90 58.47 75.21 9 XM_B_SpammyWords 59359 45.52 55.35 43.95 10 DKIM_VALID_AU 53650 45.95 50.02 45.30 11 XM_DK_Undo_02 46456 13.22 43.32 8.41 12 RELAYCOUNTRY_META 40406 9.27 37.67 4.73 13 BAYES_99 39932 10.09 37.23 5.75 14 BAYES_50 36299 42.33 33.85 43.68 15 MIME_HTML_ONLY 35295 22.72 32.91 21.09 16 XM_B_SpammyWords2 34977 20.69 32.61 18.78 17 DKIM_VALID_EF 34471 24.42 32.14 23.18 18 XM_B_Unicode3 32123 38.32 29.95 39.66 19 BOTNET 30280 5.52 28.23 1.88 20 XM_UncommonTLD01 29989 6.16 27.96 2.67 21 BAYES_999 29516 7.73 27.52 4.56 22 LOC_TINY_FONT_1 29303 22.21 27.32 21.39 23 UNTRUSTED_Relay 29064 5.56 27.10 2.12 24 T_TM2_M_HEADER_IN_MSG 26088 23.73 24.32 23.64 25 XM_Body_Dirty_Words 25090 13.09 23.39 11.44 26 BOTNET_IPINHOSTNAME 25055 7.11 23.36 4.51 27 XMSubLong 25039 20.06 23.35 19.53 28 HTML_FONT_LOW_CONTRAST 24712 23.60 23.04 23.69 29 RCVD_IN_MSPIKE_H2 24675 21.78 23.01 21.59 30 FVGT_m_MULTI_ODD 22934 18.78 21.38 18.36 31 T_KAM_HTML_FONT_INVALID 22620 16.22 21.09 15.44 32 XM_Multi_Part_URI 19393 11.90 18.08 10.91 33 SpammyFromTLD_02 17874 2.57 16.67 0.31 34 LOTS_OF_MONEY 15971 7.71 14.89 6.57 35 RCVD_IN_MSPIKE_BL 14471 2.72 13.49 0.99 36 MPART_ALT_DIFF 14039 9.00 13.09 8.34 37 XMSexyCombo_05 14003 5.00 13.06 3.72 38 XM_B_Phish_Phrases 13929 6.41 12.99 5.36 39 KHOP_HELO_FCRDNS 13381 3.01 12.48 1.49 40 XM_B_SpammyWords3 13255 6.27 12.36 5.29 41 T_REMOTE_IMAGE 13217 4.13 12.32 2.82 42 XM_B_Unsub 12724 9.41 11.86 9.02 43 FROM_SUSPICIOUS_NTLD 12472 1.71 11.63 0.12 44 FROM_SUSPICIOUS_NTLD_FP 12343 1.68 11.51 0.11 45 HTML_MIME_NO_HTML_TAG 12278 3.09 11.45 1.76 46 FROM_EXCESS_BASE64 11293 3.40 10.53 2.27 47 BODY_URI_ONLY 11051 1.45 10.30 0.03 48 HDRS_MISSP 10966 1.45 10.22 0.05 49 DKIM_ADSP_NXDOMAIN 10835 1.88 10.10 0.56 50 MIME_HTML_MOSTLY 10724 3.36 10.00 2.29 51 RELAYCOUNTRY_CA 10356 2.43 9.66 1.28 52 BAYES_80 10292 4.58 9.60 3.78 53 RCVD_IN_BL_SPAMCOP_NET 10089 2.29 9.41 1.16 54 RCVD_IN_MSPIKE_WL 10064 21.08 9.38 22.95 55 T_HTML_TAG_BALANCE_CENTER 10009 1.38 9.33 0.11 56 XMBody_50 9763 1.25 9.10 0.00 57 XM_Evil_Numbers_Gen 9162 8.15 8.54 8.08 58 XM_UB50 9005 2.13 8.40 1.13 59 BAYES_60 8180 5.96 7.63 5.70 60 XM_UB99 8135 1.05 7.59 0.00 61 URI_PHP_REDIR 7996 1.05 7.46 0.03 62 XMSubMetaSx_00 7903 4.21 7.37 3.71 63 SpammyFromTLD_01 7878 1.62 7.35 0.70 64 XM_DIRTYINTL 7801 1.43 7.27 0.49 65 HTML_IMAGE_RATIO_02 7475 5.96 6.97 5.80 66 RELAYCOUNTRY_FR 7378 1.17 6.88 0.25 67 RCVD_IN_RP_RNBL 7315 1.03 6.82 0.10 68 LotsOfNums_01 7162 7.38 6.68 7.50 69 TR_XM_PhishingBody 7105 3.41 6.62 2.89 70 XM_SPF_SoftFail 6960 2.22 6.49 1.54 71 RCVD_IN_MSPIKE_L3 6859 1.37 6.40 0.57 72 RCVD_IN_MSPIKE_L5 6585 1.14 6.14 0.34 73 XM_B_COVIDMETA 6474 1.89 6.04 1.23 74 XMBody_17 6346 1.57 5.92 0.88 75 HTML_IMAGE_RATIO_04 6174 11.82 5.76 12.79 76 UNPARSEABLE_RELAY 5861 5.90 5.46 5.98 77 XM_UB999 5857 0.75 5.46 0.00 78 TooManyTo_001 5674 6.21 5.29 6.36 79 RCVD_IN_MSPIKE_H3 5592 11.86 5.21 12.92 80 BAYES_95 5479 2.63 5.11 2.23 81 XM_H_Long_From01 5441 4.83 5.07 4.80 82 XMNumbers 5319 3.74 4.96 3.54 83 T_XMDrugObfuBody_08 5140 1.94 4.79 1.49 84 RCVD_IN_PSBL 5082 0.68 4.74 0.03 85 XM_JunkDunk 4826 0.62 4.50 0.00 86 XMBrknScrpt_02 4683 1.55 4.37 1.10 87 DKIM_INVALID 4522 2.94 4.22 2.74 88 XMDiploma_00 4460 2.01 4.16 1.67 89 XM_B_Phish66 4364 2.06 4.07 1.74 90 XM_OfRef6 4354 1.54 4.06 1.14 91 RELAYCOUNTRY_DE 4322 0.78 4.03 0.26 92 XM_B_SpammyTLD 4205 1.87 3.92 1.55 93 RCVD_IN_MSPIKE_H4 4163 7.77 3.88 8.39 94 SUBJ_ALL_CAPS 4101 1.70 3.82 1.36 95 XMStrtUSub 3985 7.89 3.72 8.55 96 HTML_IMAGE_RATIO_08 3880 2.34 3.62 2.14 97 XM_UB60 3879 0.66 3.62 0.19 98 XM_B_Unsub2 3858 2.32 3.60 2.12 99 RELAYCOUNTRY_IN 3795 0.58 3.54 0.11 100 ALL_TRUSTED 3703 18.57 3.45 20.99 101 XM_UB80 3673 0.60 3.42 0.15 102 XM_SendGrid 3582 5.09 3.34 5.37 103 XMMoneyMeta_00 3542 0.93 3.30 0.55 104 XMGenDplmaNmb 3504 1.12 3.27 0.78 105 TM2_M_URI_OPT_OUT 3355 3.06 3.13 3.05 106 XM_URI_RBL 3110 0.55 2.90 0.17 107 TR_XM_COVIDMETA4 3090 0.86 2.88 0.54 108 BOTNET_NORDNS 3035 0.40 2.83 0.01 109 TR_LOTS_OF_MONEY3 2974 0.79 2.77 0.47 110 URIBL_SBL_A 2951 0.59 2.75 0.24 111 HTML_IMAGE_RATIO_06 2850 4.02 2.66 4.24 112 TR_XM_MaxSPIKE 2842 0.41 2.65 0.05 113 T_PDS_OTHER_BAD_TLD 2817 0.74 2.63 0.43 114 LH_URI_DOM_IN_PATH 2762 1.73 2.58 1.59 115 RELAYCOUNTRY_RU 2750 0.65 2.56 0.35 116 XMSexyCombo_01 2742 1.23 2.56 1.02 117 XM_B_SpammyWords4 2704 0.89 2.52 0.63 118 T_TooManySym_01 2684 3.39 2.50 3.54 119 TR_XM_UnparsRelay 2587 0.70 2.41 0.42 120 URI_HEX 2586 1.56 2.41 1.42 121 MISSING_HEADERS 2534 0.80 2.36 0.55 122 TR_XM_COVIDMETA1 2514 0.61 2.34 0.33 123 BAYES_40 2474 5.59 2.31 6.12 124 XMSlimDrugH 2367 0.72 2.21 0.49 125 TR_XM_PHPDW 2353 0.56 2.19 0.30 126 T_XMDrugObfuBody_14 2348 1.70 2.19 1.62 127 TR_XM_PHPForged 2281 0.53 2.13 0.27 128 TR_XM_MaxBayes 2255 0.32 2.10 0.04 129 TR_XM_FormFill2 2224 0.51 2.07 0.27 130 XM_H_PHPOS 2219 0.51 2.07 0.26 131 BAYES_20 2151 9.76 2.01 11.00 132 DIET_1 2145 0.60 2.00 0.37 133 RELAYCOUNTRY_GB 2131 1.16 1.99 1.02 134 XM_CamelCaseFrm001 2087 1.46 1.95 1.38 135 XMSubMetaI_00 2082 0.67 1.94 0.46 136 MIME_HTML_ONLY_MULTI 2061 5.91 1.92 6.55 137 XM_UB95 2033 0.28 1.90 0.02 138 SPOOFED_URL 1881 0.86 1.75 0.72 139 REPLYTO_WITHOUT_TO_CC 1876 0.43 1.75 0.22 140 HELO_NODOT 1872 1.40 1.75 1.35 141 HELO_NO_DOMAIN 1868 1.40 1.74 1.35 142 TR_XM_RelayPhish 1855 0.33 1.73 0.10 143 URI_TRY_3LD 1844 1.18 1.72 1.09 144 MIME_QP_LONG_LINE 1842 4.19 1.72 4.59 145 TR_LOTS_OF_MONEY1 1812 0.25 1.69 0.02 146 T_XMDrugObfuBody_00 1798 0.76 1.68 0.62 147 TR_Symld_Words 1766 2.27 1.65 2.37 148 TR_XM_DK_SendGrid 1763 2.90 1.64 3.10 149 RDNS_DYNAMIC 1715 0.51 1.60 0.33 150 T_XMHurry_00 1715 0.83 1.60 0.71 151 HTML_TITLE_SUBJ_DIFF 1700 0.26 1.59 0.04 152 XM_ContractorBdy01 1696 0.22 1.58 0.00 153 TM2_M_VERY_LONG_WORD 1682 1.02 1.57 0.93 154 PRICES_ARE_AFFORDABLE 1671 0.23 1.56 0.02 155 T_FILL_THIS_FORM_SHORT 1642 0.84 1.53 0.73 156 TR_XM_INV_DKIM 1633 0.26 1.52 0.06 157 TR_Mismatch_TLD_01 1623 0.39 1.51 0.21 158 TR_Caps_n_Bayes_99 1587 0.26 1.48 0.06 159 T_Symld_Words_02 1581 0.63 1.47 0.50 160 XMStockSpam_06 1493 1.02 1.39 0.96 161 XMGppyBdWords 1478 0.30 1.38 0.12 162 XM_S_SpammyWords 1471 0.36 1.37 0.20 163 TR_XM_Spammywords 1471 0.36 1.37 0.20 164 XMSlimDrugs 1444 0.20 1.35 0.02 165 BAYES_00 1443 14.91 1.35 17.08 166 SHORT_SHORTNER 1440 0.23 1.34 0.05 167 DKIM_ADSP_CUSTOM_MED 1430 1.03 1.33 0.98 168 TR_XM_SpoofStaff 1411 0.24 1.32 0.07 169 XM_ShortIntro_01 1402 0.84 1.31 0.77 170 DEAR_SOMETHING 1395 0.29 1.30 0.13 171 XMHTML_After_End 1382 0.73 1.29 0.64 172 XM_H_SpoofStaff4 1363 0.24 1.27 0.07 173 XMWghtMeta_00 1360 0.20 1.27 0.03 174 SPOOFED_URL_HOST 1358 0.71 1.27 0.62 175 XMSubNoVowel 1312 3.00 1.22 3.29 176 XMSpoofStaff2 1308 0.23 1.22 0.07 177 DATE_IN_PAST_03_06 1295 0.25 1.21 0.10 178 SUBJECT_DIET 1284 0.17 1.20 0.00 179 SHORT_URI_3 1280 0.22 1.19 0.07 180 HTML_IMAGE_ONLY_08 1273 0.25 1.19 0.10 181 URI_NOVOWEL 1267 1.67 1.18 1.75 182 TR_XM_PSC1 1264 0.22 1.18 0.07 183 MAILING_LIST_MULTI 1258 1.65 1.17 1.72 184 XM_XX_Yahoo 1252 0.24 1.17 0.10 185 FROM_MISSP_REPLYTO 1242 0.16 1.16 0.01 186 HTML_IMAGE_ONLY_16 1230 0.34 1.15 0.21 187 LongTLD 1222 0.26 1.14 0.12 188 XM_OfRef7 1221 0.26 1.14 0.12 189 NML_ADSP_CUSTOM_MED 1220 0.75 1.14 0.69 190 XM_PDF 1216 3.03 1.13 3.33 191 FROM_ADDR_WS 1213 0.16 1.13 0.01 192 XMSubMetaSxObfu_03 1209 0.51 1.13 0.42 193 HTML_SHORT_LINK_IMG_1 1197 0.17 1.12 0.02 194 FORGED_GMAIL_RCVD 1184 0.60 1.10 0.52 195 PDS_RDNS_DYNAMIC_FP 1167 0.18 1.09 0.04 196 XM_Body_Obfu01 1139 0.36 1.06 0.25 197 RCVD_IN_IADB_LISTED 1131 3.65 1.05 4.07 198 XMSexyCombo_04 1128 0.59 1.05 0.52 199 XMSubject_78 1115 0.20 1.04 0.06 200 XMBody_78 1089 0.45 1.02 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 660698 98.19 96.46 98.47 2 HTML_MESSAGE 547007 82.96 91.92 81.52 3 RELAYCOUNTRY_US 504638 72.90 58.47 75.21 4 XM_B_Unicode 451199 67.10 66.20 67.24 5 DKIM_SIGNED 420322 63.68 70.16 62.64 6 XM_DK_Pass 413755 62.55 68.10 61.66 7 DKIM_VALID 401959 60.74 65.95 59.91 8 DKIM_VALID_AU 303981 45.95 50.02 45.30 9 XM_B_SpammyWords 294910 45.52 55.35 43.95 10 BAYES_50 293108 42.33 33.85 43.68 11 XMListUnsubscribeExists 291165 45.75 60.51 43.39 12 XM_B_Unicode3 266087 38.32 29.95 39.66 13 HTML_FONT_LOW_CONTRAST 158982 23.60 23.04 23.69 14 T_TM2_M_HEADER_IN_MSG 158597 23.73 24.32 23.64 15 DKIM_VALID_EF 155537 24.42 32.14 23.18 16 RCVD_IN_MSPIKE_WL 154019 21.08 9.38 22.95 17 RCVD_IN_MSPIKE_H2 144836 21.78 23.01 21.59 18 LOC_TINY_FONT_1 143517 22.21 27.32 21.39 19 MIME_HTML_ONLY 141504 22.72 32.91 21.09 20 ALL_TRUSTED 140850 18.57 3.45 20.99 21 XMSubLong 131063 20.06 23.35 19.53 22 XM_B_SpammyWords2 126002 20.69 32.61 18.78 23 FVGT_m_MULTI_ODD 123204 18.78 21.38 18.36 24 BAYES_00 114610 14.91 1.35 17.08 25 T_KAM_HTML_FONT_INVALID 103629 16.22 21.09 15.44 26 RCVD_IN_MSPIKE_H3 86685 11.86 5.21 12.92 27 HTML_IMAGE_RATIO_04 85820 11.82 5.76 12.79 28 ANY_BOUNCE_MESSAGE 80348 10.45 0.91 11.97 29 BOUNCE_MESSAGE 80343 10.45 0.91 11.97 30 XM_Body_Dirty_Words 76768 13.09 23.39 11.44 31 BAYES_20 73779 9.76 2.01 11.00 32 XM_Multi_Part_URI 73193 11.90 18.08 10.91 33 XM_H_Trusted_IP 70323 9.04 0.00 10.48 34 HTML_FONT_FACE_BAD 68046 8.81 0.45 10.14 35 XM_B_Unsub 60515 9.41 11.86 9.02 36 XMStrtUSub 57398 7.89 3.72 8.55 37 XM_DK_Undo_02 56413 13.22 43.32 8.41 38 RCVD_IN_MSPIKE_H4 56269 7.77 3.88 8.39 39 MPART_ALT_DIFF 55967 9.00 13.09 8.34 40 XM_Evil_Numbers_Gen 54248 8.15 8.54 8.08 41 TR_XM_DK_Bayes 52739 6.90 0.89 7.86 42 TR_XM_DK_Bayes1 51129 6.69 0.86 7.62 43 LotsOfNums_01 50293 7.38 6.68 7.50 44 TR_XM_DK_Bayes2 45629 5.94 0.55 6.80 45 LOTS_OF_MONEY 44060 7.71 14.89 6.57 46 MIME_HTML_ONLY_MULTI 43924 5.91 1.92 6.55 47 TooManyTo_001 42648 6.21 5.29 6.36 48 BAYES_40 41060 5.59 2.31 6.12 49 UNPARSEABLE_RELAY 40092 5.90 5.46 5.98 50 HTML_IMAGE_RATIO_02 38915 5.96 6.97 5.80 51 RCVD_IN_RP_SAFE 38874 5.05 0.39 5.79 52 BAYES_99 38607 10.09 37.23 5.75 53 BAYES_60 38229 5.96 7.63 5.70 54 XM_DKIMWhitelistDomains 37869 4.87 0.00 5.64 55 RCVD_IN_RP_CERTIFIED 36482 4.71 0.19 5.44 56 XM_SendGrid 36023 5.09 3.34 5.37 57 XM_B_Phish_Phrases 35988 6.41 12.99 5.36 58 XM_B_SpammyWords3 35508 6.27 12.36 5.29 59 XM_H_Long_From01 32179 4.83 5.07 4.80 60 RELAYCOUNTRY_META 31771 9.27 37.67 4.73 61 IN_ZIMBRA_NJ_WHITELIST 31406 4.04 0.02 4.68 62 BAYES_05 31255 4.14 0.93 4.66 63 MIME_QP_LONG_LINE 30776 4.19 1.72 4.59 64 BAYES_999 30609 7.73 27.52 4.56 65 BOTNET_IPINHOSTNAME 30275 7.11 23.36 4.51 66 HTML_IMAGE_RATIO_06 28444 4.02 2.66 4.24 67 RCVD_IN_IADB_LISTED 27281 3.65 1.05 4.07 68 BAYES_80 25374 4.58 9.60 3.78 69 XMSexyCombo_05 24939 5.00 13.06 3.72 70 XMSubMetaSx_00 24895 4.21 7.37 3.71 71 RCVD_IN_IADB_SPF 23796 3.18 0.86 3.55 72 XMNumbers 23781 3.74 4.96 3.54 73 T_TooManySym_01 23725 3.39 2.50 3.54 74 XM_PDF 22372 3.03 1.13 3.33 75 XMSubNoVowel 22057 3.00 1.22 3.29 76 RCVD_IN_IADB_SENDERID 21299 2.85 0.80 3.17 77 TR_XM_DK_SendGrid 20769 2.90 1.64 3.10 78 RCVD_IN_IADB_DK 20641 2.76 0.79 3.08 79 TM2_M_URI_OPT_OUT 20458 3.06 3.13 3.05 80 TR_XM_PhishingBody 19403 3.41 6.62 2.89 81 T_REMOTE_IMAGE 18949 4.13 12.32 2.82 82 DKIM_INVALID 18363 2.94 4.22 2.74 83 XM_UncommonTLD01 17924 6.16 27.96 2.67 84 RCVD_IN_IADB_VOUCHED 16784 2.23 0.53 2.50 85 TR_Symld_Words 15917 2.27 1.65 2.37 86 MIME_HTML_MOSTLY 15388 3.36 10.00 2.29 87 FROM_EXCESS_BASE64 15202 3.40 10.53 2.27 88 BAYES_95 14961 2.63 5.11 2.23 89 HTML_IMAGE_RATIO_08 14355 2.34 3.62 2.14 90 UNTRUSTED_Relay 14207 5.56 27.10 2.12 91 XM_B_Unsub2 14203 2.32 3.60 2.12 92 BOTNET 12642 5.52 28.23 1.88 93 HTML_MIME_NO_HTML_TAG 11795 3.09 11.45 1.76 94 URI_NOVOWEL 11748 1.67 1.18 1.75 95 XM_B_Phish66 11689 2.06 4.07 1.74 96 MAILING_LIST_MULTI 11549 1.65 1.17 1.72 97 T_TooManySym_02 11310 1.55 0.72 1.69 98 XMDiploma_00 11181 2.01 4.16 1.67 99 RCVD_IN_MSPIKE_H5 11065 1.46 0.29 1.65 100 T_XMDrugObfuBody_14 10895 1.70 2.19 1.62 101 RCVD_IN_IADB_OPTIN 10804 1.44 0.39 1.61 102 LH_URI_DOM_IN_PATH 10665 1.73 2.58 1.59 103 XM_B_SpammyTLD 10372 1.87 3.92 1.55 104 XM_SPF_SoftFail 10322 2.22 6.49 1.54 105 TooManyTo_002 10244 1.43 0.82 1.53 106 TVD_RCVD_IP 10148 1.39 0.63 1.51 107 KHOP_HELO_FCRDNS 10014 3.01 12.48 1.49 108 T_XMDrugObfuBody_08 9995 1.94 4.79 1.49 109 URI_HEX 9542 1.56 2.41 1.42 110 XM_CamelCaseFrm001 9285 1.46 1.95 1.38 111 SUBJ_ALL_CAPS 9140 1.70 3.82 1.36 112 HELO_NODOT 9055 1.40 1.75 1.35 113 HELO_NO_DOMAIN 9054 1.40 1.74 1.35 114 XM_DK_Undo_01 9050 1.27 0.81 1.35 115 RELAYCOUNTRY_CA 8576 2.43 9.66 1.28 116 XM_B_COVIDMETA 8222 1.89 6.04 1.23 117 XMSubGarbage 7873 1.03 0.12 1.17 118 HELO_MISC_IP 7860 1.10 0.63 1.17 119 CK_HELO_DYNAMIC_SPLIT_IP 7857 1.08 0.53 1.17 120 RCVD_IN_BL_SPAMCOP_NET 7762 2.29 9.41 1.16 121 XMSubLongNoVowel 7659 1.02 0.23 1.14 122 XM_OfRef6 7618 1.54 4.06 1.14 123 XM_UB50 7558 2.13 8.40 1.13 124 XMGappySubj_01 7528 1.00 0.22 1.12 125 USER_IN_DEF_DKIM_WL 7527 0.97 0.00 1.12 126 XMBrknScrpt_02 7408 1.55 4.37 1.10 127 INVALID_MSGID 7391 1.02 0.52 1.10 128 IN_HORDE_ADDRESS_BOOK 7359 0.95 0.03 1.10 129 URI_TRY_3LD 7330 1.18 1.72 1.09 130 RELAYCOUNTRY_GB 6876 1.16 1.99 1.02 131 XMSexyCombo_01 6846 1.23 2.56 1.02 132 TooManyTo_003 6717 0.94 0.54 1.00 133 RCVD_IN_MSPIKE_BL 6659 2.72 13.49 0.99 134 DKIM_ADSP_CUSTOM_MED 6607 1.03 1.33 0.98 135 XMStockSpam_06 6420 1.02 1.39 0.96 136 TO_MALFORMED 6382 0.82 0.01 0.95 137 XM_GoogleGroups 6304 0.87 0.40 0.94 138 TM2_M_VERY_LONG_WORD 6251 1.02 1.57 0.93 139 XMCapTrack 6219 0.86 0.42 0.93 140 XMBody_17 5887 1.57 5.92 0.88 141 XM_ProductURIs 5878 0.83 0.52 0.88 142 TR_MSPIKEBAYES00 5839 0.75 0.00 0.87 143 XM_H_Long_From02 5814 0.83 0.62 0.87 144 XMGenDplmaNmb 5244 1.12 3.27 0.78 145 XM_ShortIntro_01 5174 0.84 1.31 0.77 146 XM_E_Blogspot 5151 0.67 0.09 0.77 147 T_FILL_THIS_FORM_SHORT 4908 0.84 1.53 0.73 148 TooManyTo_004 4895 0.69 0.45 0.73 149 TR_MetaPhish_Combo_01 4861 0.75 0.92 0.72 150 SPOOFED_URL 4825 0.86 1.75 0.72 151 T_XMHurry_00 4746 0.83 1.60 0.71 152 SpammyFromTLD_01 4718 1.62 7.35 0.70 153 NML_ADSP_CUSTOM_MED 4607 0.75 1.14 0.69 154 T_TooManySym_03 4557 0.61 0.15 0.68 155 T_OBFU_PDF_ATTACH 4539 0.61 0.23 0.68 156 FROM_GOV_DKIM_AU 4370 0.58 0.15 0.65 157 HTTPS_HTTP_MISMATCH 4304 0.67 0.87 0.64 158 XMBdyGiftCard01 4282 0.67 0.87 0.64 159 XMHTML_After_End 4276 0.73 1.29 0.64 160 XM_B_SpammyWords4 4209 0.89 2.52 0.63 161 T_XMDrugObfuBody_00 4147 0.76 1.68 0.62 162 SPOOFED_URL_HOST 4136 0.71 1.27 0.62 163 TooManyTo_005 3980 0.56 0.33 0.59 164 RCVD_IN_MSPIKE_L3 3829 1.37 6.40 0.57 165 DKIM_ADSP_NXDOMAIN 3776 1.88 10.10 0.56 166 XMMoneyMeta_00 3718 0.93 3.30 0.55 167 MISSING_HEADERS 3679 0.80 2.36 0.55 168 XM_B_REG_HTML 3619 0.48 0.09 0.54 169 TR_XM_COVIDMETA4 3594 0.86 2.88 0.54 170 XMBody_95 3587 0.48 0.11 0.53 171 XMHTMLBadTable_001 3577 0.52 0.44 0.53 172 FORGED_GMAIL_RCVD 3493 0.60 1.10 0.52 173 XMSexyCombo_04 3457 0.59 1.05 0.52 174 XM_SPF_Unknown 3447 0.55 0.80 0.51 175 T_Symld_Words_02 3330 0.63 1.47 0.50 176 XM_DIRTYINTL 3303 1.43 7.27 0.49 177 XM_H_PHPMailer 3289 0.55 0.92 0.49 178 XMSlimDrugH 3255 0.72 2.21 0.49 179 PLING_QUERY 3252 0.48 0.44 0.48 180 XMLngstWrd_00 3181 0.48 0.52 0.47 181 TR_LOTS_OF_MONEY3 3167 0.79 2.77 0.47 182 XMSubMetaI_00 3102 0.67 1.94 0.46 183 TR_BOTNET_NEGATE 3001 0.45 0.48 0.45 184 HTML_TAG_BALANCE_BODY 2980 0.51 0.89 0.44 185 HTML_IMAGE_ONLY_28 2966 0.42 0.25 0.44 186 XMLngstWrd_01 2964 0.44 0.47 0.44 187 T_PDS_OTHER_BAD_TLD 2907 0.74 2.63 0.43 188 TR_XM_UnparsRelay 2842 0.70 2.41 0.42 189 XM_B_COPY_HTML 2816 0.43 0.50 0.42 190 HTML_IMAGE_ONLY_20 2796 0.41 0.38 0.42 191 XMPhish14 2793 0.48 0.86 0.42 192 XMSubMetaSxObfu_03 2785 0.51 1.13 0.42 193 HTML_IMAGE_ONLY_24 2688 0.38 0.28 0.40 194 XMNoVowels 2688 0.38 0.29 0.40 195 T_TooManySym_04 2666 0.35 0.04 0.40 196 XMSubEmpty 2665 0.39 0.33 0.40 197 HTML_IMAGE_ONLY_32 2654 0.38 0.30 0.40 198 XMPhish30 2623 0.47 0.96 0.39 199 NUMERIC_HTTP_ADDR 2622 0.42 0.59 0.39 200 BASE64_LENGTH_79_INF 2617 0.41 0.54 0.39 ----------------------------------------------------------------------