Email: 537246 Autolearn: 0 AvgScore: 3.42 AvgScanTime: 1.30 sec Spam: 149476 Autolearn: 0 AvgScore: 14.90 AvgScanTime: 1.38 sec Ham: 387770 Autolearn: 0 AvgScore: -1.00 AvgScanTime: 1.26 sec Time Spent Running SA: 193.35 hours Time Spent Processing Spam: 57.35 hours Time Spent Processing Ham: 136.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144193 89.55 96.47 86.88 2 DKIM_SIGNED 118737 71.17 79.44 67.98 3 XM_DK_Pass 114791 69.42 76.80 66.58 4 DKIM_VALID 114455 68.70 76.57 65.66 5 RELAYCOUNTRY_US 109920 75.18 73.54 75.81 6 DCC_CHECK 107607 41.68 71.99 30.00 7 XM_B_Unicode 106844 70.14 71.48 69.62 8 XM_B_SpammyWords 103032 52.45 68.93 46.10 9 XMListUnsubscribeExists 93835 49.56 62.78 44.46 10 DKIM_VALID_AU 86121 52.33 57.62 50.30 11 BAYES_50 69390 54.33 46.42 57.37 12 XM_DK_Undo_02 60236 16.34 40.30 7.10 13 XM_B_Unicode3 59350 41.64 39.71 42.38 14 MIME_HTML_ONLY 56943 28.61 38.10 24.96 15 XM_B_SpammyWords2 54066 26.32 36.17 22.52 16 FVGT_m_MULTI_ODD 50851 25.32 34.02 21.96 17 LOC_TINY_FONT_1 50776 24.51 33.97 20.86 18 HTML_FONT_LOW_CONTRAST 47794 26.09 31.97 23.82 19 BAYES_99 46318 12.75 30.99 5.72 20 TR_XM_DKIM_Undo 44257 11.96 29.61 5.16 21 DKIM_VALID_EF 43219 26.70 28.91 25.85 22 DCC_CHECK_NEGATIVE 41820 58.28 27.98 69.96 23 T_KAM_HTML_FONT_INVALID 38256 19.62 25.59 17.32 24 BAYES_999 37210 10.31 24.89 4.68 25 XM_B_Unsub 36593 12.97 24.48 8.53 26 RCVD_IN_MSPIKE_H2 35929 21.17 24.04 20.06 27 XM_Body_Dirty_Words 34810 17.56 23.29 15.35 28 TR_DCC_Bayes_99 32939 7.60 22.04 2.04 29 XMSubLong 32698 24.61 21.88 25.67 30 BOTNET 31138 6.79 20.83 1.38 31 T_TM2_M_HEADER_IN_MSG 30521 26.60 20.42 28.98 32 XM_UncommonTLD01 30381 7.96 20.33 3.19 33 RCVD_IN_MSPIKE_WL 29867 25.67 19.98 27.86 34 UNTRUSTED_Relay 29490 6.39 19.73 1.25 35 FSL_BULK_SIG 28458 7.16 19.04 2.58 36 RELAYCOUNTRY_META 28059 7.97 18.77 3.81 37 XM_Multi_Part_URI 24150 12.50 16.16 11.09 38 UNPARSEABLE_RELAY 21946 9.33 14.68 7.27 39 TR_XM_UnparsRelay 21382 8.13 14.30 5.74 40 XM_UB50 20578 4.40 13.77 0.79 41 RCVD_IN_MSPIKE_H3 19225 14.53 12.86 15.17 42 LOTS_OF_MONEY 18270 8.63 12.22 7.25 43 XMSexyCombo_05 18038 9.01 12.07 7.83 44 BOTNET_IPINHOSTNAME 17533 6.29 11.73 4.20 45 XM_B_SpammyWords3 16273 9.62 10.89 9.13 46 TR_XM_SpammyWords4 15869 6.06 10.62 4.30 47 SpammyFromTLD_02 15597 3.21 10.43 0.42 48 RCVD_IN_MSPIKE_BL 15371 3.70 10.28 1.17 49 TR_XM_MSPIKECOMBO 15234 3.68 10.19 1.17 50 TR_XM_SpammyWords2 14987 3.68 10.03 1.24 51 TR_XM_SpammyRelay 14463 3.82 9.68 1.56 52 RCVD_IN_PSBL 14229 2.74 9.52 0.13 53 MPART_ALT_DIFF 14195 6.51 9.50 5.36 54 XM_SendGrid 13889 6.48 9.29 5.40 55 XM_Evil_Numbers_Gen 13388 8.92 8.96 8.91 56 TR_XM_SpammyWords5 12958 3.41 8.67 1.38 57 XMNumbers 12835 4.89 8.59 3.46 58 XM_B_Phish_Phrases 12069 4.42 8.07 3.01 59 TR_XM_MaxUnsub 12013 2.88 8.04 0.89 60 TR_XM_SpammyWords3 11924 2.64 7.98 0.58 61 TR_XM_PhishingBody 11789 4.62 7.89 3.37 62 TM2_M_VERY_LONG_WORD 11515 3.30 7.70 1.60 63 BAYES_60 11143 8.50 7.45 8.90 64 HTML_IMAGE_RATIO_02 10746 6.07 7.19 5.64 65 RCVD_IN_BL_SPAMCOP_NET 10637 2.62 7.12 0.88 66 DKIM_ADSP_NXDOMAIN 10450 2.17 6.99 0.31 67 BAYES_80 10275 4.92 6.87 4.17 68 TR_Symld_Words 9994 3.14 6.69 1.77 69 RCVD_IN_MSPIKE_H4 9929 9.70 6.64 10.88 70 LotsOfNums_01 9331 8.21 6.24 8.96 71 RCVD_IN_MSPIKE_L5 9274 1.83 6.20 0.15 72 TR_XM_DK_SendGrid 9105 4.19 6.09 3.46 73 XMSubMetaSx_00 8533 4.12 5.71 3.51 74 XM_H_Long_From01 8345 5.15 5.58 4.99 75 MIME_HTML_ONLY_MULTI 8248 4.16 5.52 3.64 76 XMLngstWrd_00 7922 2.27 5.30 1.10 77 TooManyTo_001 7322 11.14 4.90 13.55 78 MIME_HTML_MOSTLY 7226 2.87 4.83 2.11 79 XM_SPF_SoftFail 6906 2.85 4.62 2.16 80 HTML_MIME_NO_HTML_TAG 6611 3.85 4.42 3.63 81 HTML_IMAGE_RATIO_04 6522 4.73 4.36 4.87 82 XM_B_SpammyTLD 6214 2.49 4.16 1.85 83 RELAYCOUNTRY_CA 6183 1.86 4.14 0.99 84 SpammyFromTLD_01 6118 1.65 4.09 0.71 85 URI_NOVOWEL 6057 2.84 4.05 2.37 86 TR_XM_SPAMCOP 5527 1.37 3.70 0.47 87 XMStrtUSub 5434 3.79 3.64 3.85 88 RCVD_IN_VALIDITY_SAFE 5429 4.11 3.63 4.30 89 HTML_IMAGE_RATIO_06 5413 4.12 3.62 4.31 90 BAYES_95 5343 2.78 3.57 2.48 91 HTML_IMAGE_RATIO_08 5161 2.67 3.45 2.37 92 T_XMDrugObfuBody_14 5146 2.17 3.44 1.68 93 MIME_QP_LONG_LINE 5114 5.06 3.42 5.69 94 TM2_M_URI_OPT_OUT 5083 3.00 3.40 2.85 95 HTML_TAG_BALANCE_BODY 5067 1.33 3.39 0.53 96 XM_GoogleGroups 5053 2.29 3.38 1.86 97 T_STY_INVIS_DIRECT 5003 0.99 3.35 0.08 98 XM_B_Investor 4989 2.13 3.34 1.66 99 XM_DIRTYINTL 4789 1.10 3.20 0.29 100 RCVD_IN_VALIDITY_CERTIFIED 4777 3.71 3.20 3.91 101 XMLngstWrd_01 4658 1.62 3.12 1.04 102 XMLngstWrd_02 4577 1.54 3.06 0.96 103 HTML_FONT_TINY_NORDNS 4404 0.87 2.95 0.07 104 T_REMOTE_IMAGE 4381 3.35 2.93 3.51 105 XMLngstWrd_03 4345 1.42 2.91 0.85 106 XM_B_Phish66 4334 2.35 2.90 2.14 107 DKIM_INVALID 4282 2.47 2.86 2.32 108 HTML_TITLE_SUBJ_DIFF 4242 1.20 2.84 0.57 109 XMLngstWrd_04 4239 1.34 2.84 0.77 110 HTML_TAG_BALANCE_CENTER 4210 0.84 2.82 0.08 111 UPPERCASE_75_100 4147 1.18 2.77 0.57 112 XM_OfRef6 4079 1.52 2.73 1.05 113 HTML_TAG_BALANCE_HEAD 4053 0.83 2.71 0.10 114 HTML_TEXT_INVISIBLE_STYLE 3992 0.86 2.67 0.16 115 T_TooManySym_01 3987 4.95 2.67 5.84 116 HTML_EMBEDS 3911 0.73 2.62 0.00 117 XM_CamelCaseFrm001 3744 1.87 2.50 1.63 118 RCVD_IN_IADB_LISTED 3696 4.53 2.47 5.32 119 BOTNET_NORDNS 3650 0.69 2.44 0.02 120 T_XMDrugObfuBody_08 3629 1.62 2.43 1.31 121 XMPhish11 3483 0.72 2.33 0.10 122 PDS_OTHER_BAD_TLD 3433 0.75 2.30 0.16 123 XM_UB60 3412 0.69 2.28 0.08 124 XM_B_Unsub2 3393 1.76 2.27 1.57 125 KHOP_HELO_FCRDNS 3348 1.67 2.24 1.44 126 XM_DK_Undo_01 3343 1.71 2.24 1.51 127 RELAYCOUNTRY_FR 3187 0.78 2.13 0.26 128 RCVD_IN_MSPIKE_L4 3117 0.92 2.09 0.47 129 RCVD_IN_IADB_SPF 3090 3.97 2.07 4.71 130 RCVD_IN_VALIDITY_RPBL 3059 0.58 2.05 0.02 131 TR_Mismatch_TLD_02 3031 0.62 2.03 0.08 132 USER_IN_DEF_DKIM_WL 2948 8.28 1.97 10.72 133 XMSexyCombo_01 2940 0.99 1.97 0.61 134 MAILING_LIST_MULTI 2935 2.76 1.96 3.07 135 RCVD_IN_MSPIKE_L3 2843 0.93 1.90 0.55 136 RCVD_IN_IADB_DK 2839 3.50 1.90 4.11 137 BAYES_40 2817 3.88 1.88 4.65 138 RCVD_IN_IADB_SENDERID 2810 3.58 1.88 4.24 139 T_FILL_THIS_FORM_SHORT 2776 1.06 1.86 0.76 140 HTML_SHORT_LINK_IMG_3 2759 0.56 1.85 0.06 141 XMHTML_After_End 2708 1.04 1.81 0.75 142 TR_XM_NoHeaderRelay 2694 0.63 1.80 0.17 143 TR_XM_PHPDW 2634 0.71 1.76 0.31 144 RELAYCOUNTRY_AU 2627 0.70 1.76 0.29 145 SUBJ_ALL_CAPS 2613 1.64 1.75 1.60 146 XM_B_SpammyWords4 2594 0.83 1.74 0.48 147 XMDiploma_00 2584 1.24 1.73 1.06 148 JH_SPAMMY_HEADERS 2555 0.48 1.71 0.00 149 TR_XM_PHPForged 2541 0.67 1.70 0.28 150 URI_HEX 2537 1.38 1.70 1.25 151 T_XMDrugObfuBody_00 2522 0.97 1.69 0.69 152 URIBL_DBL_SPAM 2516 0.48 1.68 0.01 153 TR_XM_FormFill2 2486 0.66 1.66 0.28 154 XM_H_PHPOS 2473 0.65 1.65 0.27 155 DKIM_ADSP_CUSTOM_MED 2460 1.13 1.65 0.93 156 TR_XM_SB_Phish 2428 1.87 1.62 1.96 157 NO_DNS_FOR_FROM 2396 0.62 1.60 0.24 158 XMSubPhish11 2358 1.83 1.58 1.93 159 TR_XM_MaxWHORU 2331 0.56 1.56 0.17 160 XM_B_COVIDMETA 2259 0.79 1.51 0.52 161 FROM_EXCESS_BASE64 2240 2.22 1.50 2.50 162 RCVD_IN_IADB_VOUCHED 2216 2.73 1.48 3.21 163 BODY_URI_ONLY 2200 0.41 1.47 0.01 164 ADMITS_SPAM 2185 0.46 1.46 0.07 165 FORGED_GMAIL_RCVD 2178 0.77 1.46 0.50 166 XM_URI_RBL 2168 0.50 1.45 0.13 167 XMStockSpam_06 2167 0.96 1.45 0.77 168 HTML_IMAGE_ONLY_20 2125 0.80 1.42 0.56 169 XM_UB99 2077 0.39 1.39 0.00 170 HTTPS_HTTP_MISMATCH 2075 1.00 1.39 0.85 171 MSGID_FROM_MTA_HEADER 2074 0.67 1.39 0.39 172 XMBody_17 2061 0.63 1.38 0.34 173 TO_NO_BRKTS_HTML_ONLY 1971 0.56 1.32 0.27 174 ALL_TRUSTED 1970 16.08 1.32 21.76 175 NML_ADSP_CUSTOM_MED 1941 0.79 1.30 0.59 176 T_XMHurry_00 1929 1.01 1.29 0.90 177 XM_H_Long_From02 1919 1.30 1.28 1.30 178 URIBL_BLACK 1914 0.39 1.28 0.05 179 HK_RANDOM_ENVFROM 1908 0.42 1.28 0.09 180 NORDNS_LOW_CONTRAST 1898 0.35 1.27 0.00 181 BAYES_20 1884 2.78 1.26 3.37 182 XMPhish30 1849 0.66 1.24 0.43 183 HK_RANDOM_REPLYTO 1841 0.43 1.23 0.13 184 RELAYCOUNTRY_GB 1830 0.86 1.22 0.72 185 INVALID_DATE 1800 0.36 1.20 0.03 186 TR_BOTNET_NEGATE 1781 0.56 1.19 0.31 187 XMMoneyMeta_00 1776 0.64 1.19 0.43 188 URI_NO_WWW_BIZ_CGI 1761 0.33 1.18 0.01 189 RELAYCOUNTRY_IN 1696 0.38 1.13 0.09 190 URI_TRY_3LD 1693 0.65 1.13 0.47 191 TM2_M_A_HREF_HREF 1683 0.62 1.13 0.43 192 XMGenDplmaNmb 1665 0.74 1.11 0.59 193 XMBrknScrpt_02 1646 0.79 1.10 0.67 194 XM_UB999 1595 0.30 1.07 0.00 195 TR_LOTS_OF_MONEY3 1594 0.51 1.07 0.30 196 DIET_1 1583 0.56 1.06 0.36 197 TR_MetaPhish_Combo_01 1576 0.81 1.05 0.71 198 TR_XM_FormFill 1572 0.30 1.05 0.01 199 HDRS_MISSP 1547 0.31 1.03 0.02 200 TR_XM_RelayPhish 1523 0.32 1.02 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 336910 89.55 96.47 86.88 2 RELAYCOUNTRY_US 293985 75.18 73.54 75.81 3 DCC_CHECK_NEGATIVE 271277 58.28 27.98 69.96 4 XM_B_Unicode 269960 70.14 71.48 69.62 5 DKIM_SIGNED 263620 71.17 79.44 67.98 6 XM_DK_Pass 258175 69.42 76.80 66.58 7 DKIM_VALID 254615 68.70 76.57 65.66 8 BAYES_50 222478 54.33 46.42 57.37 9 DKIM_VALID_AU 195041 52.33 57.62 50.30 10 XM_B_SpammyWords 178768 52.45 68.93 46.10 11 XMListUnsubscribeExists 172398 49.56 62.78 44.46 12 XM_B_Unicode3 164353 41.64 39.71 42.38 13 DCC_CHECK 116335 41.68 71.99 30.00 14 T_TM2_M_HEADER_IN_MSG 112384 26.60 20.42 28.98 15 RCVD_IN_MSPIKE_WL 108052 25.67 19.98 27.86 16 DKIM_VALID_EF 100224 26.70 28.91 25.85 17 XMSubLong 99541 24.61 21.88 25.67 18 MIME_HTML_ONLY 96785 28.61 38.10 24.96 19 HTML_FONT_LOW_CONTRAST 92384 26.09 31.97 23.82 20 XM_B_SpammyWords2 87316 26.32 36.17 22.52 21 FVGT_m_MULTI_ODD 85155 25.32 34.02 21.96 22 ALL_TRUSTED 84398 16.08 1.32 21.76 23 LOC_TINY_FONT_1 80893 24.51 33.97 20.86 24 RCVD_IN_MSPIKE_H2 77794 21.17 24.04 20.06 25 T_KAM_HTML_FONT_INVALID 67171 19.62 25.59 17.32 26 XM_Body_Dirty_Words 59536 17.56 23.29 15.35 27 RCVD_IN_MSPIKE_H3 58835 14.53 12.86 15.17 28 TooManyTo_001 52548 11.14 4.90 13.55 29 XM_Multi_Part_URI 42990 12.50 16.16 11.09 30 BAYES_00 42987 8.24 0.84 11.09 31 RCVD_IN_MSPIKE_H4 42205 9.70 6.64 10.88 32 USER_IN_DEF_DKIM_WL 41550 8.28 1.97 10.72 33 XM_B_SpammyWords3 35407 9.62 10.89 9.13 34 LotsOfNums_01 34752 8.21 6.24 8.96 35 XM_Evil_Numbers_Gen 34553 8.92 8.96 8.91 36 BAYES_60 34510 8.50 7.45 8.90 37 XM_B_Unsub 33091 12.97 24.48 8.53 38 XMSexyCombo_05 30379 9.01 12.07 7.83 39 UNPARSEABLE_RELAY 28185 9.33 14.68 7.27 40 LOTS_OF_MONEY 28103 8.63 12.22 7.25 41 XM_DK_Undo_02 27540 16.34 40.30 7.10 42 XM_DKIMWhitelistDomains 26416 4.93 0.03 6.81 43 IN_ZIMBRA_NJ_WHITELIST 26205 4.90 0.07 6.76 44 TR_XM_DK_Bayes 24001 4.61 0.52 6.19 45 TR_XM_DK_Bayes1 23392 4.50 0.51 6.03 46 T_TooManySym_01 22632 4.95 2.67 5.84 47 TR_XM_UnparsRelay 22274 8.13 14.30 5.74 48 BAYES_99 22199 12.75 30.99 5.72 49 MIME_QP_LONG_LINE 22046 5.06 3.42 5.69 50 HTML_IMAGE_RATIO_02 21871 6.07 7.19 5.64 51 XM_SendGrid 20924 6.48 9.29 5.40 52 MPART_ALT_DIFF 20781 6.51 9.50 5.36 53 TR_XM_DK_Bayes2 20632 3.95 0.39 5.32 54 RCVD_IN_IADB_LISTED 20623 4.53 2.47 5.32 55 TR_XM_DKIM_Undo 20015 11.96 29.61 5.16 56 XM_H_Long_From01 19350 5.15 5.58 4.99 57 HTML_IMAGE_RATIO_04 18889 4.73 4.36 4.87 58 RCVD_IN_IADB_SPF 18248 3.97 2.07 4.71 59 BAYES_999 18165 10.31 24.89 4.68 60 BAYES_40 18012 3.88 1.88 4.65 61 XM_PDF 17477 3.49 0.85 4.51 62 HTML_IMAGE_RATIO_06 16722 4.12 3.62 4.31 63 TR_XM_SpammyWords4 16689 6.06 10.62 4.30 64 RCVD_IN_VALIDITY_SAFE 16667 4.11 3.63 4.30 65 RCVD_IN_IADB_SENDERID 16441 3.58 1.88 4.24 66 BOTNET_IPINHOSTNAME 16269 6.29 11.73 4.20 67 BAYES_80 16164 4.92 6.87 4.17 68 RCVD_IN_IADB_DK 15942 3.50 1.90 4.11 69 RCVD_IN_VALIDITY_CERTIFIED 15145 3.71 3.20 3.91 70 XMStrtUSub 14933 3.79 3.64 3.85 71 RELAYCOUNTRY_META 14758 7.97 18.77 3.81 72 MIME_HTML_ONLY_MULTI 14127 4.16 5.52 3.64 73 HTML_MIME_NO_HTML_TAG 14072 3.85 4.42 3.63 74 XMSubMetaSx_00 13617 4.12 5.71 3.51 75 T_REMOTE_IMAGE 13605 3.35 2.93 3.51 76 XM_H_Trusted_IP 13527 2.52 0.00 3.49 77 XMNumbers 13424 4.89 8.59 3.46 78 TR_XM_DK_SendGrid 13401 4.19 6.09 3.46 79 BAYES_20 13061 2.78 1.26 3.37 80 TR_XM_PhishingBody 13050 4.62 7.89 3.37 81 T_TooManySym_02 12577 2.50 0.59 3.24 82 RCVD_IN_IADB_VOUCHED 12462 2.73 1.48 3.21 83 XM_UncommonTLD01 12366 7.96 20.33 3.19 84 ANY_BOUNCE_MESSAGE 12112 2.48 0.81 3.12 85 BOUNCE_MESSAGE 12110 2.48 0.81 3.12 86 MAILING_LIST_MULTI 11918 2.76 1.96 3.07 87 XM_B_Phish_Phrases 11671 4.42 8.07 3.01 88 TM2_M_URI_OPT_OUT 11060 3.00 3.40 2.85 89 FSL_BULK_SIG 9995 7.16 19.04 2.58 90 FROM_EXCESS_BASE64 9702 2.22 1.50 2.50 91 BAYES_95 9604 2.78 3.57 2.48 92 URI_NOVOWEL 9186 2.84 4.05 2.37 93 HTML_IMAGE_RATIO_08 9171 2.67 3.45 2.37 94 DKIM_INVALID 9005 2.47 2.86 2.32 95 BAYES_05 8747 1.82 0.69 2.26 96 TooManyTo_002 8494 1.85 0.96 2.19 97 XM_SPF_SoftFail 8379 2.85 4.62 2.16 98 XM_B_Phish66 8296 2.35 2.90 2.14 99 MIME_HTML_MOSTLY 8167 2.87 4.83 2.11 100 RCVD_IN_IADB_OPTIN 8165 1.77 0.89 2.11 101 TR_DCC_Bayes_99 7903 7.60 22.04 2.04 102 TR_XM_SB_Phish 7593 1.87 1.62 1.96 103 XMSubPhish11 7494 1.83 1.58 1.93 104 XM_GoogleGroups 7225 2.29 3.38 1.86 105 XM_B_SpammyTLD 7182 2.49 4.16 1.85 106 INVALID_MSGID 7118 1.42 0.34 1.84 107 RCVD_IN_MSPIKE_H5 7012 1.44 0.48 1.81 108 HELO_NODOT 6970 1.48 0.66 1.80 109 HELO_NO_DOMAIN 6963 1.47 0.62 1.80 110 TR_Symld_Words 6852 3.14 6.69 1.77 111 IN_HORDE_ADDRESS_BOOK 6704 1.28 0.12 1.73 112 T_XMDrugObfuBody_14 6497 2.17 3.44 1.68 113 TVD_RCVD_IP 6452 1.27 0.26 1.66 114 XM_B_Investor 6433 2.13 3.34 1.66 115 MSGID_NOFQDN1 6327 1.20 0.09 1.63 116 XM_CamelCaseFrm001 6325 1.87 2.50 1.63 117 SUBJ_ALL_CAPS 6219 1.64 1.75 1.60 118 TM2_M_VERY_LONG_WORD 6210 3.30 7.70 1.60 119 XM_B_Unsub2 6086 1.76 2.27 1.57 120 TO_MALFORMED 6045 1.13 0.02 1.56 121 TR_XM_SpammyRelay 6042 3.82 9.68 1.56 122 XM_DK_Undo_01 5870 1.71 2.24 1.51 123 KHOP_HELO_FCRDNS 5599 1.67 2.24 1.44 124 TooManyTo_003 5528 1.26 0.84 1.43 125 BOTNET 5363 6.79 20.83 1.38 126 TR_XM_SpammyWords5 5360 3.41 8.67 1.38 127 T_XMDrugObfuBody_08 5075 1.62 2.43 1.31 128 XM_H_Long_From02 5041 1.30 1.28 1.30 129 XMGappySubj_01 4906 0.95 0.12 1.27 130 URI_HEX 4853 1.38 1.70 1.25 131 UNTRUSTED_Relay 4852 6.39 19.73 1.25 132 TR_XM_SpammyWords2 4793 3.68 10.03 1.24 133 XMSubNoVowel 4728 1.09 0.74 1.22 134 XMCapTrack 4609 0.99 0.46 1.19 135 RCVD_IN_MSPIKE_BL 4523 3.70 10.28 1.17 136 TR_XM_MSPIKECOMBO 4518 3.68 10.19 1.17 137 XMLngstWrd_00 4265 2.27 5.30 1.10 138 XMBSHREFv2 4197 0.88 0.35 1.08 139 HTML_FONT_FACE_BAD 4119 0.98 0.75 1.06 140 XMDiploma_00 4104 1.24 1.73 1.06 141 XM_OfRef6 4063 1.52 2.73 1.05 142 XMLngstWrd_01 4049 1.62 3.12 1.04 143 TooManyTo_004 3969 0.93 0.70 1.02 144 RELAYCOUNTRY_CA 3821 1.86 4.14 0.99 145 TVD_SPACE_RATIO 3714 0.71 0.08 0.96 146 XMLngstWrd_02 3705 1.54 3.06 0.96 147 DKIM_ADSP_CUSTOM_MED 3590 1.13 1.65 0.93 148 T_XMHurry_00 3499 1.01 1.29 0.90 149 XMNoVowels 3497 0.85 0.70 0.90 150 TR_XM_MaxUnsub 3435 2.88 8.04 0.89 151 RCVD_IN_BL_SPAMCOP_NET 3430 2.62 7.12 0.88 152 XMLngstWrd_03 3303 1.42 2.91 0.85 153 HTTPS_HTTP_MISMATCH 3285 1.00 1.39 0.85 154 XMBody_95 3267 0.64 0.10 0.84 155 T_TooManySym_03 3241 0.66 0.21 0.84 156 TooManyTo_005 3179 0.77 0.63 0.82 157 RCVD_IN_RP_SAFE 3153 0.80 0.77 0.81 158 XM_UB50 3075 4.40 13.77 0.79 159 XMStockSpam_06 2982 0.96 1.45 0.77 160 XMLngstWrd_04 2975 1.34 2.84 0.77 161 T_FILL_THIS_FORM_SHORT 2940 1.06 1.86 0.76 162 RCVD_IN_RP_CERTIFIED 2898 0.73 0.67 0.75 163 XMHTML_After_End 2892 1.04 1.81 0.75 164 RELAYCOUNTRY_GB 2804 0.86 1.22 0.72 165 TR_MetaPhish_Combo_01 2767 0.81 1.05 0.71 166 XMBdyGiftCard01 2743 0.72 0.76 0.71 167 SpammyFromTLD_01 2735 1.65 4.09 0.71 168 T_XMDrugObfuBody_00 2684 0.97 1.69 0.69 169 XMBrknScrpt_02 2589 0.79 1.10 0.67 170 FROM_GOV_DKIM_AU 2549 0.51 0.11 0.66 171 XM_ShortIntro_01 2436 0.58 0.46 0.63 172 XMSexyCombo_01 2364 0.99 1.97 0.61 173 TR_MSPIKEBAYES00 2358 0.45 0.02 0.61 174 T_Symld_Words_02 2356 0.70 0.93 0.61 175 XMGenDplmaNmb 2300 0.74 1.11 0.59 176 NML_ADSP_CUSTOM_MED 2295 0.79 1.30 0.59 177 T_OBFU_PDF_ATTACH 2270 0.47 0.18 0.59 178 TR_XM_SpammyWords3 2264 2.64 7.98 0.58 179 XM_H_PHPMailer 2254 0.65 0.83 0.58 180 UPPERCASE_75_100 2213 1.18 2.77 0.57 181 HTML_TITLE_SUBJ_DIFF 2192 1.20 2.84 0.57 182 HTML_IMAGE_ONLY_20 2163 0.80 1.42 0.56 183 XM_B_COPY_HTML 2147 0.62 0.80 0.55 184 RCVD_IN_MSPIKE_L3 2137 0.93 1.90 0.55 185 HTML_TAG_BALANCE_BODY 2074 1.33 3.39 0.53 186 XM_D_tchamptons_WL 2054 0.38 0.00 0.53 187 XM_B_COVIDMETA 2003 0.79 1.51 0.52 188 SHORT_HELO_AND_INLINE_IMAGE 1965 0.39 0.09 0.51 189 RCVD_IN_SORBS_DUL 1948 0.45 0.32 0.50 190 FORGED_GMAIL_RCVD 1934 0.77 1.46 0.50 191 XM_B_SpammyWords4 1850 0.83 1.74 0.48 192 XMPhish14 1849 0.54 0.71 0.48 193 XMSubMetaI_00 1836 0.57 0.81 0.47 194 TR_XM_SPAMCOP 1836 1.37 3.70 0.47 195 HTML_IMAGE_ONLY_32 1830 0.45 0.39 0.47 196 XMHTMLBadTable_001 1828 0.58 0.86 0.47 197 URI_TRY_3LD 1817 0.65 1.13 0.47 198 RCVD_IN_MSPIKE_L4 1807 0.92 2.09 0.47 199 XMSubMetaSxObfu_03 1797 0.52 0.65 0.46 200 XM_ProductURIs 1779 0.58 0.89 0.46 ----------------------------------------------------------------------