Email: 642856 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.22 sec Spam: 181913 Autolearn: 0 AvgScore: 13.40 AvgScanTime: 1.33 sec Ham: 460943 Autolearn: 0 AvgScore: -0.24 AvgScanTime: 1.17 sec Time Spent Running SA: 217.59 hours Time Spent Processing Spam: 67.41 hours Time Spent Processing Ham: 150.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165821 89.71 91.15 89.13 2 DKIM_SIGNED 139308 78.40 76.58 79.11 3 DCC_CHECK 136181 49.16 74.86 39.01 4 XM_DK_Pass 135440 76.90 74.45 77.86 5 RELAYCOUNTRY_US 133295 80.18 73.27 82.90 6 DKIM_VALID 132625 74.82 72.91 75.57 7 XM_B_Unicode 132083 71.66 72.61 71.29 8 XM_B_SpammyWords 122477 55.06 67.33 50.22 9 XMListUnsubscribeExists 118188 56.21 64.97 52.75 10 DKIM_VALID_AU 102101 56.49 56.13 56.63 11 XM_DK_Undo_02 74334 18.11 40.86 9.13 12 BAYES_50 73087 51.34 40.18 55.74 13 XM_B_SpammyWords2 66950 26.91 36.80 23.01 14 XM_B_Unicode3 65286 40.03 35.89 41.67 15 LOC_TINY_FONT_1 58427 27.16 32.12 25.21 16 MIME_HTML_ONLY 57985 24.25 31.88 21.24 17 BAYES_99 56910 12.89 31.28 5.64 18 HTML_FONT_LOW_CONTRAST 55802 28.94 30.68 28.25 19 DKIM_VALID_EF 52180 29.13 28.68 29.30 20 RCVD_IN_MSPIKE_H2 49500 26.83 27.21 26.67 21 BAYES_999 43931 10.14 24.15 4.61 22 FVGT_m_MULTI_ODD 43809 23.58 24.08 23.39 23 TR_DCC_Bayes_99 43673 8.79 24.01 2.78 24 DCC_CHECK_NEGATIVE 42459 48.69 23.34 58.70 25 XMSubLong 41927 22.57 23.05 22.38 26 RELAYCOUNTRY_META 41918 10.23 23.04 5.17 27 T_TM2_M_HEADER_IN_MSG 40718 27.52 22.38 29.54 28 T_KAM_HTML_FONT_INVALID 39840 19.63 21.90 18.73 29 BOTNET 38579 7.55 21.21 2.16 30 XM_Multi_Part_URI 37749 14.53 20.75 12.08 31 XM_Body_Dirty_Words 37288 16.01 20.50 14.24 32 UNTRUSTED_Relay 33620 6.76 18.48 2.13 33 LOTS_OF_MONEY 32085 11.04 17.64 8.43 34 FSL_BULK_SIG 28873 8.42 15.87 5.48 35 RCVD_IN_MSPIKE_WL 26376 25.86 14.50 30.34 36 TR_XM_SpammyWords2 23934 4.71 13.16 1.38 37 XM_B_SpammyWords3 22542 7.94 12.39 6.18 38 RCVD_IN_MSPIKE_BL 22278 3.94 12.25 0.66 39 BOTNET_IPINHOSTNAME 21686 7.05 11.92 5.12 40 XM_B_Unsub 20423 11.55 11.23 11.67 41 XM_UncommonTLD01 19988 5.53 10.99 3.38 42 XMSexyCombo_05 18934 6.15 10.41 4.48 43 XM_B_Phish_Phrases 18852 8.03 10.36 7.11 44 MPART_ALT_DIFF 18444 5.73 10.14 3.98 45 T_REMOTE_IMAGE 17767 5.48 9.77 3.79 46 LotsOfNums_01 16266 9.24 8.94 9.36 47 RCVD_IN_RP_RNBL 15795 2.57 8.68 0.16 48 XM_Evil_Numbers_Gen 15574 8.86 8.56 8.98 49 MIME_HTML_MOSTLY 15028 4.03 8.26 2.37 50 TR_XM_SpammyWords3 14859 2.59 8.17 0.39 51 XM_UB50 14834 3.04 8.15 1.02 52 BAYES_80 14561 5.44 8.00 4.42 53 BODY_URI_ONLY 14336 2.33 7.88 0.14 54 BAYES_60 13880 7.50 7.63 7.45 55 KHOP_HELO_FCRDNS 13793 3.56 7.58 1.97 56 RCVD_IN_MSPIKE_H3 13767 14.38 7.57 17.07 57 RCVD_IN_BL_SPAMCOP_NET 12594 3.00 6.92 1.46 58 RCVD_IN_MSPIKE_L5 12545 2.08 6.90 0.17 59 HTML_SHORT_LINK_IMG_1 12518 2.03 6.88 0.11 60 HTML_IMAGE_RATIO_02 12483 6.87 6.86 6.87 61 DATE_IN_PAST_03_06 12478 1.98 6.86 0.06 62 RCVD_IN_PSBL 12408 1.96 6.82 0.04 63 RCVD_IN_MSPIKE_H4 11436 9.59 6.29 10.89 64 HTML_IMAGE_RATIO_04 11042 5.34 6.07 5.05 65 RELAYCOUNTRY_CA 10652 2.80 5.86 1.60 66 XMSubMetaSx_00 10497 4.69 5.77 4.26 67 SpammyFromTLD_01 10242 2.22 5.63 0.88 68 UNPARSEABLE_RELAY 10169 7.17 5.59 7.79 69 TooManyTo_001 9810 7.77 5.39 8.70 70 TR_XM_PhishingBody 9784 3.84 5.38 3.24 71 URIBL_SBL_A 9476 1.58 5.21 0.15 72 T_XMDrugObfuBody_08 9360 2.97 5.15 2.11 73 TR_XM_COVIDMETA4 9322 1.72 5.12 0.38 74 ANY_BOUNCE_MESSAGE 8903 3.31 4.89 2.68 75 BOUNCE_MESSAGE 8901 3.31 4.89 2.68 76 RCVD_IN_MSPIKE_L3 8883 1.70 4.88 0.45 77 XMNumbers 8804 4.24 4.84 4.00 78 XM_B_COVIDMETA 8464 2.42 4.65 1.54 79 XM_Lotto 8391 1.46 4.61 0.21 80 LH_URI_DOM_IN_PATH 8231 2.69 4.52 1.96 81 XM_SendGrid 8197 6.38 4.51 7.12 82 BAYES_95 8183 3.18 4.50 2.66 83 XM_OfRef6 8014 2.05 4.41 1.13 84 HTML_IMAGE_ONLY_12 7917 1.44 4.35 0.28 85 XM_H_Long_From01 7458 5.48 4.10 6.03 86 T_FONT_INVIS_NAKED_TO 7432 2.81 4.09 2.31 87 XMBody_17 7349 1.67 4.04 0.73 88 URI_PHP_REDIR 7283 1.14 4.00 0.01 89 XMBrknScrpt_02 6969 1.67 3.83 0.82 90 BOTNET_NORDNS 6909 1.09 3.80 0.02 91 SHORTENED_URL_HREF 6812 1.25 3.74 0.26 92 XM_SPF_SoftFail 6773 2.28 3.72 1.71 93 XM_B_SpammyTLD 6749 2.48 3.71 1.99 94 DKIM_INVALID 6683 3.58 3.67 3.54 95 BAYES_40 6537 4.42 3.59 4.74 96 XM_DIRTYINTL 6226 1.30 3.42 0.46 97 XMStrtUSub 6073 3.99 3.34 4.25 98 SHORTENER_SHORT_IMG 6057 0.94 3.33 0.00 99 SHORTENED_URL_SRC 5948 0.93 3.27 0.00 100 XM_B_Phish66 5812 2.27 3.19 1.91 101 RELAYCOUNTRY_FR 5799 1.06 3.19 0.22 102 TR_XM_MaxBayes 5734 0.90 3.15 0.01 103 SpammyFromTLD_02 5691 1.18 3.13 0.41 104 URI_HEX 5661 2.11 3.11 1.72 105 SHORT_SHORTNER 5598 0.88 3.08 0.02 106 XMDiploma_00 5588 2.57 3.07 2.38 107 TR_LOTS_OF_MONEY3 5587 1.41 3.07 0.75 108 SHORT_URI_3 5586 0.90 3.07 0.04 109 HTML_IMAGE_ONLY_08 5503 0.93 3.03 0.11 110 HTML_IMAGE_RATIO_06 5460 3.63 3.00 3.87 111 SUBJ_ALL_CAPS 5350 2.18 2.94 1.87 112 MIME_HTML_ONLY_MULTI 5145 2.19 2.83 1.93 113 TM2_M_URI_OPT_OUT 4997 2.73 2.75 2.73 114 URI_TRY_3LD 4989 1.95 2.74 1.63 115 XMHTML_After_End 4844 1.31 2.66 0.77 116 HTML_IMAGE_RATIO_08 4626 2.21 2.54 2.08 117 RCVD_IN_RP_SAFE 4579 6.32 2.52 7.82 118 MIME_QP_LONG_LINE 4542 5.11 2.50 6.14 119 HTML_FONT_SIZE_LARGE 4528 0.80 2.49 0.13 120 TR_XM_DK_SendGrid 4428 3.73 2.43 4.24 121 XM_UB60 4160 0.71 2.29 0.08 122 BAYES_20 4096 3.15 2.25 3.50 123 XMSexyCombo_01 4075 1.41 2.24 1.08 124 XM_UB99 4070 0.64 2.24 0.00 125 TR_XM_SB_Phish 4057 2.42 2.23 2.49 126 T_TooManySym_01 4022 4.35 2.21 5.19 127 XM_OfRef7 3984 0.71 2.19 0.13 128 XMSubPhish11 3979 2.38 2.19 2.46 129 RELAYCOUNTRY_GB 3945 1.35 2.17 1.02 130 XM_CamelCaseFrm001 3890 2.04 2.14 2.00 131 RELAYCOUNTRY_TR 3791 0.66 2.08 0.10 132 TR_XM_UnparsRelay 3790 0.87 2.08 0.39 133 INVALID_DATE 3737 0.62 2.05 0.05 134 FROM_EXCESS_BASE64 3698 2.60 2.03 2.83 135 T_FILL_THIS_FORM_SHORT 3692 1.22 2.03 0.90 136 XM_B_Unsub2 3639 2.73 2.00 3.01 137 RCVD_IN_RP_CERTIFIED 3629 5.77 1.99 7.25 138 XM_BadFromFormat 3568 0.72 1.96 0.23 139 XM_URI_RBL 3517 0.67 1.93 0.17 140 RELAYCOUNTRY_IN 3480 0.62 1.91 0.10 141 RCVD_IN_IADB_LISTED 3471 4.79 1.91 5.92 142 TR_Symld_Words 3409 2.15 1.87 2.26 143 T_HTML_TAG_BALANCE_CENTER 3408 0.71 1.87 0.24 144 TR_XM_MaxSPIKE 3385 0.54 1.86 0.01 145 T_XMDrugObfuBody_14 3335 1.81 1.83 1.81 146 XMBdyGiftCard01 3265 1.13 1.79 0.87 147 TVD_SPACE_RATIO_MINFP 3223 0.51 1.77 0.01 148 FROM_MISSP_REPLYTO 3180 0.50 1.75 0.01 149 HTML_MIME_NO_HTML_TAG 3146 2.32 1.73 2.55 150 XMGenDplmaNmb 3105 1.29 1.71 1.13 151 XM_B_SpammyWords4 3099 0.84 1.70 0.51 152 TM2_M_VERY_LONG_WORD 3032 1.31 1.67 1.17 153 BAYES_00 2999 10.25 1.65 13.64 154 FILL_THIS_FORM 2983 0.61 1.64 0.20 155 XM_UB80 2943 0.48 1.62 0.03 156 T_FILL_THIS_FORM_LONG 2922 0.55 1.61 0.13 157 TR_XM_COVIDMETA1 2919 0.68 1.60 0.31 158 RCVD_IN_IADB_SPF 2915 4.15 1.60 5.15 159 T_XMDrugObfuBody_00 2880 0.94 1.58 0.69 160 TVD_SPACE_RATIO 2814 0.70 1.55 0.36 161 XM_UB999 2801 0.44 1.54 0.00 162 XMMoneyMeta_00 2780 0.78 1.53 0.48 163 XMManySubDom_06 2759 0.56 1.52 0.19 164 XMStockSpam_06 2758 1.43 1.52 1.40 165 URI_NO_WWW_BIZ_CGI 2735 0.43 1.50 0.01 166 T_XMHurry_00 2734 0.79 1.50 0.51 167 RCVD_IN_IADB_DK 2680 3.57 1.47 4.40 168 RCVD_IN_IADB_SENDERID 2661 3.69 1.46 4.57 169 TR_XM_PHPDW 2625 0.67 1.44 0.37 170 TR_XM_PHPForged 2550 0.64 1.40 0.34 171 TR_XM_FormFill2 2543 0.64 1.40 0.35 172 XM_NotFromAmazon 2541 0.40 1.40 0.01 173 XM_H_PHPOS 2540 0.64 1.40 0.34 174 XM_DK_Undo_01 2444 1.86 1.34 2.07 175 RELAYCOUNTRY_DE 2415 0.68 1.33 0.42 176 XMManySubDom_07 2398 0.49 1.32 0.16 177 XMManySubDom_08 2372 0.37 1.30 0.00 178 T_LONG_INVISIBLE_TEXT 2347 0.80 1.29 0.61 179 T_Symld_Words_02 2252 0.73 1.24 0.53 180 MISSING_HEADERS 2243 0.66 1.23 0.43 181 MILLION_HUNDRED 2230 0.35 1.23 0.01 182 ALL_TRUSTED 2220 9.78 1.22 13.15 183 URI_NOVOWEL 2217 2.34 1.22 2.79 184 TR_XM_INV_DKIM 2199 0.38 1.21 0.06 185 T_PDS_OTHER_BAD_TLD 2198 0.65 1.21 0.43 186 MONEY_FRAUD_8 2137 0.33 1.17 0.00 187 TR_MetaPhish_Combo_01 2116 0.83 1.16 0.70 188 TR_XM_Spammywords 2089 0.56 1.15 0.33 189 XM_S_SpammyWords 2089 0.56 1.15 0.33 190 XMSubNoVowel 2068 0.54 1.14 0.30 191 RELAYCOUNTRY_NL 2055 0.53 1.13 0.29 192 TR_XM_RelayPhish 1996 0.39 1.10 0.11 193 ADVANCE_FEE_2_NEW_FORM 1940 0.30 1.07 0.00 194 HK_RANDOM_FROM 1889 0.37 1.04 0.10 195 FORM_FRAUD 1850 0.29 1.02 0.00 196 XMPhish30 1843 0.61 1.01 0.45 197 FROM_SUSPICIOUS_NTLD 1827 0.35 1.00 0.09 198 FSL_THIS_IS_ADV 1804 0.41 0.99 0.18 199 XMSexyCombo_04 1779 0.65 0.98 0.52 200 RCVD_IN_IADB_VOUCHED 1765 2.95 0.97 3.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 410859 89.71 91.15 89.13 2 RELAYCOUNTRY_US 382119 80.18 73.27 82.90 3 DKIM_SIGNED 364670 78.40 76.58 79.11 4 XM_DK_Pass 358910 76.90 74.45 77.86 5 DKIM_VALID 348336 74.82 72.91 75.57 6 XM_B_Unicode 328588 71.66 72.61 71.29 7 DCC_CHECK_NEGATIVE 270557 48.69 23.34 58.70 8 DKIM_VALID_AU 261020 56.49 56.13 56.63 9 BAYES_50 256949 51.34 40.18 55.74 10 XMListUnsubscribeExists 243150 56.21 64.97 52.75 11 XM_B_SpammyWords 231470 55.06 67.33 50.22 12 XM_B_Unicode3 192080 40.03 35.89 41.67 13 DCC_CHECK 179827 49.16 74.86 39.01 14 RCVD_IN_MSPIKE_WL 139864 25.86 14.50 30.34 15 T_TM2_M_HEADER_IN_MSG 136185 27.52 22.38 29.54 16 DKIM_VALID_EF 135056 29.13 28.68 29.30 17 HTML_FONT_LOW_CONTRAST 130230 28.94 30.68 28.25 18 RCVD_IN_MSPIKE_H2 122954 26.83 27.21 26.67 19 LOC_TINY_FONT_1 116194 27.16 32.12 25.21 20 FVGT_m_MULTI_ODD 107799 23.58 24.08 23.39 21 XM_B_SpammyWords2 106051 26.91 36.80 23.01 22 XMSubLong 103145 22.57 23.05 22.38 23 MIME_HTML_ONLY 97910 24.25 31.88 21.24 24 T_KAM_HTML_FONT_INVALID 86322 19.63 21.90 18.73 25 RCVD_IN_MSPIKE_H3 78695 14.38 7.57 17.07 26 XM_Body_Dirty_Words 65650 16.01 20.50 14.24 27 BAYES_00 62863 10.25 1.65 13.64 28 ALL_TRUSTED 60623 9.78 1.22 13.15 29 XM_Multi_Part_URI 55689 14.53 20.75 12.08 30 XM_B_Unsub 53811 11.55 11.23 11.67 31 RCVD_IN_MSPIKE_H4 50199 9.59 6.29 10.89 32 TR_XM_DK_Bayes 46514 7.43 0.70 10.09 33 TR_XM_DK_Bayes1 44889 7.17 0.67 9.74 34 LotsOfNums_01 43135 9.24 8.94 9.36 35 XM_DK_Undo_02 42097 18.11 40.86 9.13 36 XM_Evil_Numbers_Gen 41414 8.86 8.56 8.98 37 TooManyTo_001 40119 7.77 5.39 8.70 38 TR_XM_DK_Bayes2 39888 6.39 0.64 8.65 39 XM_DKIMWhitelistDomains 39470 6.15 0.03 8.56 40 LOTS_OF_MONEY 38879 11.04 17.64 8.43 41 RCVD_IN_RP_SAFE 36065 6.32 2.52 7.82 42 UNPARSEABLE_RELAY 35930 7.17 5.59 7.79 43 BAYES_60 34362 7.50 7.63 7.45 44 RCVD_IN_RP_CERTIFIED 33437 5.77 1.99 7.25 45 IN_ZIMBRA_NJ_WHITELIST 32904 5.13 0.04 7.14 46 XM_SendGrid 32839 6.38 4.51 7.12 47 XM_B_Phish_Phrases 32788 8.03 10.36 7.11 48 HTML_IMAGE_RATIO_02 31650 6.87 6.86 6.87 49 XM_B_SpammyWords3 28472 7.94 12.39 6.18 50 MIME_QP_LONG_LINE 28303 5.11 2.50 6.14 51 XM_H_Long_From01 27789 5.48 4.10 6.03 52 RCVD_IN_IADB_LISTED 27290 4.79 1.91 5.92 53 BAYES_99 25975 12.89 31.28 5.64 54 FSL_BULK_SIG 25249 8.42 15.87 5.48 55 T_TooManySym_01 23928 4.35 2.21 5.19 56 RELAYCOUNTRY_META 23827 10.23 23.04 5.17 57 RCVD_IN_IADB_SPF 23741 4.15 1.60 5.15 58 BOTNET_IPINHOSTNAME 23620 7.05 11.92 5.12 59 HTML_IMAGE_RATIO_04 23281 5.34 6.07 5.05 60 XM_PDF 22184 3.69 0.85 4.81 61 BAYES_40 21854 4.42 3.59 4.74 62 BAYES_999 21251 10.14 24.15 4.61 63 RCVD_IN_IADB_SENDERID 21059 3.69 1.46 4.57 64 XMSexyCombo_05 20630 6.15 10.41 4.48 65 BAYES_80 20382 5.44 8.00 4.42 66 RCVD_IN_IADB_DK 20299 3.57 1.47 4.40 67 XMSubMetaSx_00 19631 4.69 5.77 4.26 68 XMStrtUSub 19570 3.99 3.34 4.25 69 TR_XM_DK_SendGrid 19521 3.73 2.43 4.24 70 XMNumbers 18430 4.24 4.84 4.00 71 MPART_ALT_DIFF 18360 5.73 10.14 3.98 72 HTML_IMAGE_RATIO_06 17853 3.63 3.00 3.87 73 T_REMOTE_IMAGE 17450 5.48 9.77 3.79 74 RCVD_IN_IADB_VOUCHED 17227 2.95 0.97 3.74 75 DKIM_INVALID 16334 3.58 3.67 3.54 76 BAYES_20 16126 3.15 2.25 3.50 77 XM_UncommonTLD01 15564 5.53 10.99 3.38 78 TR_XM_PhishingBody 14917 3.84 5.38 3.24 79 T_TooManySym_02 14141 2.42 0.78 3.07 80 XM_B_Unsub2 13880 2.73 2.00 3.01 81 FROM_EXCESS_BASE64 13041 2.60 2.03 2.83 82 URI_NOVOWEL 12838 2.34 1.22 2.79 83 TR_DCC_Bayes_99 12809 8.79 24.01 2.78 84 TM2_M_URI_OPT_OUT 12570 2.73 2.75 2.73 85 ANY_BOUNCE_MESSAGE 12358 3.31 4.89 2.68 86 BOUNCE_MESSAGE 12356 3.31 4.89 2.68 87 BAYES_95 12240 3.18 4.50 2.66 88 HTML_MIME_NO_HTML_TAG 11747 2.32 1.73 2.55 89 MAILING_LIST_MULTI 11583 2.07 0.94 2.51 90 TR_XM_SB_Phish 11472 2.42 2.23 2.49 91 XMSubPhish11 11326 2.38 2.19 2.46 92 RCVD_IN_IADB_OPTIN 11060 1.91 0.66 2.40 93 RCVD_IN_MSPIKE_H5 10970 1.89 0.64 2.38 94 XMDiploma_00 10958 2.57 3.07 2.38 95 MIME_HTML_MOSTLY 10910 4.03 8.26 2.37 96 TooManyTo_002 10687 1.83 0.59 2.32 97 T_FONT_INVIS_NAKED_TO 10627 2.81 4.09 2.31 98 TR_Symld_Words 10423 2.15 1.87 2.26 99 BAYES_05 10180 1.84 0.90 2.21 100 BOTNET 9954 7.55 21.21 2.16 101 UNTRUSTED_Relay 9840 6.76 18.48 2.13 102 T_XMDrugObfuBody_08 9704 2.97 5.15 2.11 103 HTML_IMAGE_RATIO_08 9610 2.21 2.54 2.08 104 XM_DK_Undo_01 9545 1.86 1.34 2.07 105 XM_CamelCaseFrm001 9241 2.04 2.14 2.00 106 XM_B_SpammyTLD 9166 2.48 3.71 1.99 107 KHOP_HELO_FCRDNS 9098 3.56 7.58 1.97 108 LH_URI_DOM_IN_PATH 9047 2.69 4.52 1.96 109 MIME_HTML_ONLY_MULTI 8913 2.19 2.83 1.93 110 XM_B_Phish66 8793 2.27 3.19 1.91 111 SUBJ_ALL_CAPS 8640 2.18 2.94 1.87 112 T_XMDrugObfuBody_14 8326 1.81 1.83 1.81 113 TVD_RCVD_IP 8250 1.34 0.19 1.79 114 URI_HEX 7923 2.11 3.11 1.72 115 XM_SPF_SoftFail 7869 2.28 3.72 1.71 116 IN_HORDE_ADDRESS_BOOK 7578 1.20 0.07 1.64 117 URI_TRY_3LD 7536 1.95 2.74 1.63 118 INVALID_MSGID 7473 1.36 0.69 1.62 119 RELAYCOUNTRY_CA 7356 2.80 5.86 1.60 120 HELO_NODOT 7218 1.30 0.63 1.57 121 HELO_NO_DOMAIN 7217 1.30 0.63 1.57 122 TooManyTo_003 7209 1.24 0.42 1.56 123 XM_B_COVIDMETA 7081 2.42 4.65 1.54 124 USER_IN_DEF_DKIM_WL 6925 1.08 0.01 1.50 125 RCVD_IN_BL_SPAMCOP_NET 6720 3.00 6.92 1.46 126 XMGappySubj_01 6680 1.15 0.40 1.45 127 TO_MALFORMED 6563 1.02 0.01 1.42 128 HELO_MISC_IP 6459 1.10 0.34 1.40 129 CK_HELO_DYNAMIC_SPLIT_IP 6448 1.10 0.35 1.40 130 XMStockSpam_06 6439 1.43 1.52 1.40 131 TR_XM_SpammyWords2 6342 4.71 13.16 1.38 132 XMBSHREFv2 6095 1.03 0.29 1.32 133 XM_GoogleGroups 5959 1.04 0.41 1.29 134 DKIM_ADSP_CUSTOM_MED 5682 1.13 0.88 1.23 135 XMCapTrack 5556 0.95 0.31 1.21 136 TM2_M_VERY_LONG_WORD 5401 1.31 1.67 1.17 137 XMGenDplmaNmb 5209 1.29 1.71 1.13 138 XM_OfRef6 5195 2.05 4.41 1.13 139 TooManyTo_004 5154 0.90 0.36 1.12 140 XM_H_Long_From02 5015 1.02 0.86 1.09 141 XMSexyCombo_01 4992 1.41 2.24 1.08 142 T_TooManySym_03 4900 0.85 0.32 1.06 143 RELAYCOUNTRY_GB 4708 1.35 2.17 1.02 144 XM_UB50 4699 3.04 8.15 1.02 145 XM_ProductURIs 4528 0.96 0.92 0.98 146 TR_MSPIKEBAYES00 4479 0.70 0.02 0.97 147 NML_ADSP_CUSTOM_MED 4283 0.89 0.79 0.93 148 T_FILL_THIS_FORM_SHORT 4152 1.22 2.03 0.90 149 SpammyFromTLD_01 4045 2.22 5.63 0.88 150 TooManyTo_005 4037 0.71 0.30 0.88 151 XMBdyGiftCard01 4009 1.13 1.79 0.87 152 XM_ShortIntro_01 3994 0.71 0.32 0.87 153 HTML_FONT_FACE_BAD 3902 0.77 0.58 0.85 154 XMBrknScrpt_02 3772 1.67 3.83 0.82 155 FROM_GOV_DKIM_AU 3638 0.61 0.16 0.79 156 XMHTML_After_End 3571 1.31 2.66 0.77 157 HTTPS_HTTP_MISMATCH 3524 0.77 0.78 0.76 158 TR_LOTS_OF_MONEY3 3478 1.41 3.07 0.75 159 XMBody_17 3355 1.67 4.04 0.73 160 XMBody_95 3270 0.54 0.10 0.71 161 XM_SPF_Unknown 3269 0.72 0.74 0.71 162 TR_MetaPhish_Combo_01 3247 0.83 1.16 0.70 163 T_OBFU_PDF_ATTACH 3244 0.54 0.14 0.70 164 XMSubMetaSSx_00 3205 0.65 0.53 0.70 165 T_XMDrugObfuBody_00 3168 0.94 1.58 0.69 166 XMNoVowels 3118 0.64 0.54 0.68 167 NUMERIC_HTTP_ADDR 3043 0.64 0.57 0.66 168 RCVD_IN_MSPIKE_BL 3031 3.94 12.25 0.66 169 DKIM_ADSP_NXDOMAIN 2933 0.73 0.97 0.64 170 TR_BOTNET_NEGATE 2895 0.69 0.83 0.63 171 T_LONG_INVISIBLE_TEXT 2806 0.80 1.29 0.61 172 T_TooManySym_04 2631 0.42 0.05 0.57 173 NO_DNS_FOR_FROM 2623 0.66 0.90 0.57 174 TM2_M_A_HREF_HREF 2594 0.58 0.62 0.56 175 HTML_TAG_BALANCE_BODY 2575 0.58 0.62 0.56 176 XM_H_PHPMailer 2507 0.49 0.36 0.54 177 XMSubMetaSxObfu_03 2506 0.63 0.85 0.54 178 XMSubMetaI_00 2484 0.65 0.92 0.54 179 T_Symld_Words_02 2454 0.73 1.24 0.53 180 FORGED_GMAIL_RCVD 2415 0.57 0.68 0.52 181 XMLngstWrd_00 2415 0.47 0.34 0.52 182 RDNS_DYNAMIC 2393 0.60 0.82 0.52 183 XMSexyCombo_04 2392 0.65 0.98 0.52 184 XMHTMLBadTable_001 2365 0.53 0.56 0.51 185 XM_B_COPY_HTML 2365 0.57 0.71 0.51 186 T_XMHurry_00 2335 0.79 1.50 0.51 187 XM_B_SpammyWords4 2328 0.84 1.70 0.51 188 XM_B_REG_HTML 2309 0.50 0.51 0.50 189 XMBody_78 2287 0.62 0.93 0.50 190 XM_S_SubURI 2260 0.36 0.03 0.49 191 XMSolicitRefs_0 2234 0.50 0.52 0.48 192 TR_Mismatch_TLD_01 2227 0.60 0.88 0.48 193 XMMoneyMeta_00 2220 0.78 1.53 0.48 194 XMPhish08 2144 0.53 0.69 0.47 195 XM_DIRTYINTL 2139 1.30 3.42 0.46 196 XMLngstWrd_01 2121 0.42 0.33 0.46 197 SENDGRID_REDIR 2103 0.53 0.73 0.46 198 MPART_ALT_DIFF_COUNT 2089 0.48 0.55 0.45 199 XMPhish30 2081 0.61 1.01 0.45 200 RCVD_IN_MSPIKE_L3 2055 1.70 4.88 0.45 ----------------------------------------------------------------------