Email: 522666 Autolearn: 0 AvgScore: 3.63 AvgScanTime: 1.18 sec Spam: 163977 Autolearn: 0 AvgScore: 14.02 AvgScanTime: 1.33 sec Ham: 358689 Autolearn: 0 AvgScore: -1.13 AvgScanTime: 1.11 sec Time Spent Running SA: 170.62 hours Time Spent Processing Spam: 60.41 hours Time Spent Processing Ham: 110.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156250 87.34 95.29 83.70 2 DKIM_SIGNED 144391 74.20 88.06 67.86 3 XM_DK_Pass 136386 71.81 83.17 66.61 4 DKIM_VALID 135716 71.00 82.77 65.62 5 RELAYCOUNTRY_US 133734 77.94 81.56 76.29 6 XM_B_Unicode 126572 69.98 77.19 66.69 7 DCC_CHECK 118145 41.71 72.05 27.84 8 XMListUnsubscribeExists 112683 49.70 68.72 41.01 9 XM_B_SpammyWords 105871 50.85 64.56 44.57 10 DKIM_VALID_AU 105729 53.81 64.48 48.94 11 RCVD_IN_MSPIKE_H2 77358 40.19 47.18 36.99 12 BAYES_50 74157 53.55 45.22 57.36 13 XM_B_Unicode3 65973 40.55 40.23 40.69 14 XM_DK_Undo_02 64101 15.86 39.09 5.25 15 FVGT_m_MULTI_ODD 60184 26.89 36.70 22.40 16 XM_B_SpammyWords2 58878 22.39 35.91 16.22 17 MIME_HTML_ONLY 57983 26.92 35.36 23.06 18 LOC_TINY_FONT_1 53686 23.64 32.74 19.48 19 HTML_FONT_LOW_CONTRAST 50592 26.36 30.85 24.30 20 BAYES_99 50564 12.67 30.84 4.37 21 TR_XM_DKIM_Undo 50396 12.36 30.73 3.96 22 DKIM_VALID_EF 49247 27.27 30.03 26.00 23 DCC_CHECK_NEGATIVE 45779 58.25 27.92 72.12 24 T_KAM_HTML_FONT_INVALID 42379 19.65 25.84 16.82 25 BAYES_999 39439 9.93 24.05 3.48 26 XMSubLong 36025 24.56 21.97 25.74 27 TR_DCC_Bayes_99 35324 7.71 21.54 1.39 28 XM_Body_Dirty_Words 35005 17.18 21.35 15.28 29 T_TM2_M_HEADER_IN_MSG 34996 31.69 21.34 36.42 30 RELAYCOUNTRY_META 34545 8.81 21.07 3.20 31 XM_Multi_Part_URI 25718 15.55 15.68 15.49 32 RCVD_IN_MSPIKE_WL 25658 15.49 15.65 15.43 33 XM_B_Unsub 23965 9.75 14.61 7.53 34 TR_XM_BayesUnsub 23200 8.46 14.15 5.86 35 BOTNET_IPINHOSTNAME 22432 7.26 13.68 4.32 36 LOTS_OF_MONEY 20961 8.53 12.78 6.59 37 RCVD_IN_MSPIKE_H3 20921 10.91 12.76 10.06 38 TR_XM_SpammyRelay 20157 4.85 12.29 1.45 39 BOTNET 20092 4.74 12.25 1.31 40 MPART_ALT_DIFF 19842 7.52 12.10 5.42 41 FSL_BULK_SIG 19490 5.97 11.89 3.27 42 XM_B_SpammyWords3 19159 6.57 11.68 4.23 43 UNPARSEABLE_RELAY 18402 8.06 11.22 6.62 44 TR_XM_SpammyWords4 18197 6.42 11.10 4.28 45 TR_XM_UnparsRelay 17953 6.86 10.95 4.99 46 HTML_MIME_NO_HTML_TAG 17702 4.65 10.80 1.85 47 XMSexyCombo_05 16781 8.81 10.23 8.16 48 TR_XM_SpammyWords2 16380 3.57 9.99 0.63 49 MIME_HTML_ONLY_MULTI 15999 5.69 9.76 3.83 50 TM2_M_VERY_LONG_WORD 15905 3.80 9.70 1.10 51 RCVD_IN_BL_SPAMCOP_NET 15681 3.22 9.56 0.33 52 XM_UncommonTLD01 14699 5.18 8.96 3.45 53 XM_Evil_Numbers_Gen 13628 7.56 8.31 7.22 54 RELAYCOUNTRY_CA 13357 3.19 8.15 0.93 55 BAYES_80 13277 5.11 8.10 3.75 56 XMLngstWrd_00 12933 2.75 7.89 0.41 57 XMLngstWrd_01 12867 2.70 7.85 0.35 58 UNTRUSTED_Relay 12834 3.33 7.83 1.28 59 XMLngstWrd_02 12757 2.62 7.78 0.27 60 XM_GoogleGroups 12716 3.32 7.75 1.29 61 XMLngstWrd_03 12333 2.49 7.52 0.19 62 XMLngstWrd_04 12261 2.43 7.48 0.13 63 HTML_TITLE_SUBJ_DIFF 12127 2.35 7.40 0.04 64 UPPERCASE_75_100 11862 2.28 7.23 0.02 65 LotsOfNums_01 11481 7.50 7.00 7.73 66 BAYES_60 11397 8.31 6.95 8.93 67 TR_XM_SPAMCOP 10934 2.23 6.67 0.20 68 XMSubMetaSx_00 10251 4.73 6.25 4.04 69 TR_XM_PhishingBody 9834 3.87 6.00 2.90 70 XM_B_Phish_Phrases 9390 3.92 5.73 3.09 71 XM_B_Investor 9371 2.73 5.71 1.37 72 HTML_IMAGE_RATIO_02 9024 5.58 5.50 5.61 73 XM_H_Long_From01 8708 4.60 5.31 4.28 74 DKIM_INVALID 8675 3.20 5.29 2.25 75 XMNumbers 8618 3.92 5.26 3.31 76 XM_SendGrid 8181 4.01 4.99 3.56 77 BAYES_95 8058 3.10 4.91 2.27 78 XM_B_SpammyTLD 7995 2.89 4.88 1.98 79 XMStrtUSub 7953 4.54 4.85 4.40 80 TooManyTo_001 7663 10.98 4.67 13.86 81 XM_SPF_SoftFail 7414 2.98 4.52 2.27 82 T_XMDrugObfuBody_14 6894 2.41 4.20 1.59 83 HTML_IMAGE_RATIO_04 6850 3.95 4.18 3.84 84 XM_DIRTYINTL 6437 1.46 3.93 0.33 85 RCVD_IN_MSPIKE_BL 6330 1.94 3.86 1.06 86 XM_OfRef6 6327 2.00 3.86 1.15 87 TR_XM_MSPIKECOMBO 6257 1.92 3.82 1.05 88 TR_XM_SpammyWords5 6129 1.97 3.74 1.16 89 HTML_IMAGE_RATIO_06 6004 3.68 3.66 3.69 90 XM_B_Phish66 5797 2.41 3.54 1.90 91 XMDiploma_00 5668 2.18 3.46 1.60 92 T_XMDrugObfuBody_08 5501 1.92 3.35 1.26 93 SpammyFromTLD_01 5470 1.54 3.34 0.71 94 RCVD_IN_VALIDITY_SAFE 5465 3.90 3.33 4.16 95 XM_UB50 5384 1.60 3.28 0.83 96 SpammyFromTLD_02 5379 1.21 3.28 0.26 97 TR_XM_DK_SendGrid 5165 2.58 3.15 2.31 98 T_REMOTE_IMAGE 5126 3.28 3.13 3.35 99 MIME_QP_LONG_LINE 5020 4.32 3.06 4.90 100 MIME_HTML_MOSTLY 4977 2.28 3.04 1.94 101 XMBody_17 4814 1.20 2.94 0.40 102 PDS_OTHER_BAD_TLD 4789 0.99 2.92 0.11 103 ALL_TRUSTED 4621 15.45 2.82 21.23 104 TM2_M_URI_OPT_OUT 4448 2.52 2.71 2.44 105 URI_PHP_REDIR 4414 0.85 2.69 0.00 106 URIBL_DBL_SPAM 4413 0.85 2.69 0.01 107 XM_B_Unsub2 4295 1.57 2.62 1.10 108 HTML_IMAGE_RATIO_08 4238 2.27 2.58 2.13 109 RCVD_IN_MSPIKE_H4 4220 3.88 2.57 4.48 110 KHOP_HELO_FCRDNS 4140 1.82 2.52 1.50 111 RCVD_IN_IADB_LISTED 4111 3.88 2.51 4.51 112 RCVD_IN_VALIDITY_CERTIFIED 4031 3.30 2.46 3.68 113 XM_CamelCaseFrm001 3944 1.83 2.41 1.56 114 RCVD_IN_VALIDITY_RPBL 3815 0.76 2.33 0.05 115 BOTNET_NORDNS 3742 0.72 2.28 0.01 116 XMSexyCombo_01 3624 1.59 2.21 1.30 117 T_TooManySym_01 3596 5.12 2.19 6.46 118 XM_B_SpammyWords4 3553 1.18 2.17 0.72 119 RCVD_IN_IADB_SPF 3499 3.45 2.13 4.06 120 TR_XM_MSPIKECOMBO2 3389 0.71 2.07 0.09 121 USER_IN_DEF_DKIM_WL 3365 8.23 2.05 11.06 122 URI_NOVOWEL 3298 2.06 2.01 2.08 123 SUBJ_ALL_CAPS 3267 1.61 1.99 1.44 124 TR_LOTS_OF_MONEY3 3252 0.77 1.98 0.21 125 RCVD_IN_IADB_DK 3232 3.07 1.97 3.57 126 RCVD_IN_IADB_SENDERID 3215 3.14 1.96 3.68 127 TR_XM_SpammyWords3 3118 0.93 1.90 0.48 128 XM_UB99 3060 0.59 1.87 0.00 129 XM_DK_Undo_01 3041 1.68 1.85 1.60 130 T_FILL_THIS_FORM_SHORT 3003 1.10 1.83 0.77 131 MAILING_LIST_MULTI 2964 2.84 1.81 3.31 132 RCVD_IN_PSBL 2953 0.74 1.80 0.25 133 FROM_EXCESS_BASE64 2916 1.99 1.78 2.08 134 XM_B_COVIDMETA 2895 0.98 1.77 0.62 135 XMStockSpam_06 2876 1.39 1.75 1.22 136 XMBrknScrpt_02 2825 0.88 1.72 0.50 137 XM_BadFromFormat 2781 0.65 1.70 0.17 138 XM_H_Undi_Recip 2642 0.68 1.61 0.25 139 HK_RANDOM_REPLYTO 2631 0.55 1.60 0.07 140 TR_XM_NoHeaderRelay 2575 0.56 1.57 0.10 141 TR_XM_SB_Phish 2538 1.75 1.55 1.84 142 RCVD_IN_MSPIKE_L3 2537 0.83 1.55 0.50 143 TR_XM_COVIDMETA4 2526 0.68 1.54 0.29 144 RCVD_IN_MSPIKE_L5 2515 0.51 1.53 0.04 145 BAYES_40 2454 4.52 1.50 5.90 146 URI_HEX 2437 1.19 1.49 1.06 147 XMHTML_After_End 2430 0.92 1.48 0.66 148 XMSubPhish11 2428 1.70 1.48 1.80 149 HTML_SHORT_LINK_IMG_1 2426 0.55 1.48 0.13 150 TR_XM_PHPDW 2420 0.70 1.48 0.35 151 HTML_IMAGE_ONLY_04 2412 0.58 1.47 0.17 152 XM_UB999 2380 0.46 1.45 0.00 153 TO_NO_BRKTS_FROM_MSSP 2376 0.52 1.45 0.09 154 TR_XM_PHPForged 2376 0.65 1.45 0.28 155 TM2_M_A_HREF_HREF 2355 0.63 1.44 0.26 156 HTTPS_HTTP_MISMATCH 2338 1.00 1.43 0.80 157 XM_URI_RBL 2332 0.51 1.42 0.09 158 RELAYCOUNTRY_RU 2329 0.47 1.42 0.03 159 TR_XM_FormFill2 2320 0.64 1.41 0.29 160 XM_H_PHPOS 2308 0.63 1.41 0.27 161 HTML_TAG_BALANCE_BODY 2245 0.80 1.37 0.54 162 RCVD_IN_IADB_VOUCHED 2214 2.29 1.35 2.72 163 XMGenDplmaNmb 2195 0.99 1.34 0.83 164 XMBdyGiftCard01 2151 0.81 1.31 0.58 165 TR_Symld_Words 2147 1.37 1.31 1.40 166 T_XMHurry_00 2084 0.77 1.27 0.54 167 XMSubNoVowel 2071 1.16 1.26 1.12 168 XM_H_Long_From02 2070 0.96 1.26 0.82 169 TR_Mismatch_TLD_01 2024 0.58 1.23 0.29 170 XMReplyNow 2020 0.60 1.23 0.31 171 T_XMDrugObfuBody_00 1918 0.68 1.17 0.45 172 TR_XM_COVIDMETA1 1912 0.48 1.17 0.16 173 XM_B_SEO 1908 0.48 1.16 0.17 174 RELAYCOUNTRY_AU 1899 0.53 1.16 0.24 175 URI_TRY_3LD 1872 0.67 1.14 0.45 176 MPART_ALT_DIFF_COUNT 1855 0.75 1.13 0.57 177 BOUNCE_MESSAGE 1836 2.06 1.12 2.49 178 ANY_BOUNCE_MESSAGE 1836 2.06 1.12 2.49 179 TR_XM_BayesRelay 1817 0.35 1.11 0.00 180 XM_OfRef7 1785 0.46 1.09 0.18 181 MONEY_NOHTML 1780 0.39 1.09 0.08 182 URIBL_BLACK 1778 0.37 1.08 0.04 183 TR_XM_SEO4 1770 0.42 1.08 0.12 184 RELAYCOUNTRY_FR 1727 0.53 1.05 0.29 185 TR_XM_MaxSPIKE 1683 0.34 1.03 0.03 186 XMClaimOffer 1679 0.39 1.02 0.10 187 BAYES_20 1648 3.41 1.01 4.51 188 FROM_SUSPICIOUS_NTLD 1641 0.33 1.00 0.02 189 UNDISC_MONEY 1630 0.31 0.99 0.00 190 XMMoneyMeta_00 1603 0.61 0.98 0.45 191 T_MONEY_PERCENT 1580 0.46 0.96 0.23 192 TR_LOTS_OF_MONEY2 1580 0.46 0.96 0.23 193 XM_B_DNDMA 1565 0.52 0.95 0.32 194 XM_PDF 1561 3.58 0.95 4.78 195 XM_UB60 1557 0.35 0.95 0.08 196 HTML_TAG_BALANCE_CENTER 1543 0.38 0.94 0.12 197 XMPhish30 1543 0.59 0.94 0.43 198 DKIM_ADSP_CUSTOM_MED 1536 0.91 0.94 0.90 199 NORDNS_LOW_CONTRAST 1497 0.30 0.91 0.02 200 MIXED_CENTER_CASE 1490 0.29 0.91 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 300237 87.34 95.29 83.70 2 RELAYCOUNTRY_US 273630 77.94 81.56 76.29 3 DCC_CHECK_NEGATIVE 258692 58.25 27.92 72.12 4 DKIM_SIGNED 243419 74.20 88.06 67.86 5 XM_B_Unicode 239200 69.98 77.19 66.69 6 XM_DK_Pass 238915 71.81 83.17 66.61 7 DKIM_VALID 235362 71.00 82.77 65.62 8 BAYES_50 205754 53.55 45.22 57.36 9 DKIM_VALID_AU 175531 53.81 64.48 48.94 10 XM_B_SpammyWords 159880 50.85 64.56 44.57 11 XMListUnsubscribeExists 147105 49.70 68.72 41.01 12 XM_B_Unicode3 145950 40.55 40.23 40.69 13 RCVD_IN_MSPIKE_H2 132696 40.19 47.18 36.99 14 T_TM2_M_HEADER_IN_MSG 130637 31.69 21.34 36.42 15 DCC_CHECK 99856 41.71 72.05 27.84 16 DKIM_VALID_EF 93273 27.27 30.03 26.00 17 XMSubLong 92322 24.56 21.97 25.74 18 HTML_FONT_LOW_CONTRAST 87163 26.36 30.85 24.30 19 MIME_HTML_ONLY 82716 26.92 35.36 23.06 20 FVGT_m_MULTI_ODD 80359 26.89 36.70 22.40 21 ALL_TRUSTED 76136 15.45 2.82 21.23 22 LOC_TINY_FONT_1 69886 23.64 32.74 19.48 23 T_KAM_HTML_FONT_INVALID 60319 19.65 25.84 16.82 24 XM_B_SpammyWords2 58167 22.39 35.91 16.22 25 XM_Multi_Part_URI 55560 15.55 15.68 15.49 26 RCVD_IN_MSPIKE_WL 55329 15.49 15.65 15.43 27 XM_Body_Dirty_Words 54797 17.18 21.35 15.28 28 TooManyTo_001 49709 10.98 4.67 13.86 29 USER_IN_DEF_DKIM_WL 39660 8.23 2.05 11.06 30 BAYES_00 37130 7.36 0.82 10.35 31 RCVD_IN_MSPIKE_H3 36080 10.91 12.76 10.06 32 BAYES_60 32024 8.31 6.95 8.93 33 XMSexyCombo_05 29270 8.81 10.23 8.16 34 XM_DKIMWhitelistDomains 28063 5.39 0.07 7.82 35 LotsOfNums_01 27719 7.50 7.00 7.73 36 XM_B_Unsub 27009 9.75 14.61 7.53 37 XM_Evil_Numbers_Gen 25882 7.56 8.31 7.22 38 UNPARSEABLE_RELAY 23731 8.06 11.22 6.62 39 LOTS_OF_MONEY 23629 8.53 12.78 6.59 40 IN_ZIMBRA_NJ_WHITELIST 23190 4.47 0.10 6.47 41 T_TooManySym_01 23164 5.12 2.19 6.46 42 BAYES_40 21168 4.52 1.50 5.90 43 TR_XM_BayesUnsub 21013 8.46 14.15 5.86 44 TR_XM_DK_Bayes 20134 4.02 0.55 5.61 45 HTML_IMAGE_RATIO_02 20127 5.58 5.50 5.61 46 TR_XM_DK_Bayes1 19745 3.95 0.54 5.50 47 MPART_ALT_DIFF 19437 7.52 12.10 5.42 48 XM_DK_Undo_02 18815 15.86 39.09 5.25 49 TR_XM_UnparsRelay 17903 6.86 10.95 4.99 50 MIME_QP_LONG_LINE 17569 4.32 3.06 4.90 51 XM_PDF 17154 3.58 0.95 4.78 52 TR_XM_DK_Bayes2 16471 3.29 0.43 4.59 53 BAYES_20 16187 3.41 1.01 4.51 54 RCVD_IN_IADB_LISTED 16173 3.88 2.51 4.51 55 RCVD_IN_MSPIKE_H4 16081 3.88 2.57 4.48 56 XMStrtUSub 15790 4.54 4.85 4.40 57 BAYES_99 15676 12.67 30.84 4.37 58 BOTNET_IPINHOSTNAME 15490 7.26 13.68 4.32 59 XM_H_Long_From01 15349 4.60 5.31 4.28 60 TR_XM_SpammyWords4 15347 6.42 11.10 4.28 61 XM_B_SpammyWords3 15160 6.57 11.68 4.23 62 RCVD_IN_VALIDITY_SAFE 14931 3.90 3.33 4.16 63 XM_H_Trusted_IP 14904 2.85 0.00 4.16 64 RCVD_IN_IADB_SPF 14559 3.45 2.13 4.06 65 XMSubMetaSx_00 14476 4.73 6.25 4.04 66 TR_XM_DKIM_Undo 14210 12.36 30.73 3.96 67 T_TooManySym_02 14161 2.94 0.74 3.95 68 HTML_IMAGE_RATIO_04 13781 3.95 4.18 3.84 69 MIME_HTML_ONLY_MULTI 13740 5.69 9.76 3.83 70 BAYES_80 13442 5.11 8.10 3.75 71 HTML_IMAGE_RATIO_06 13220 3.68 3.66 3.69 72 RCVD_IN_VALIDITY_CERTIFIED 13213 3.30 2.46 3.68 73 RCVD_IN_IADB_SENDERID 13197 3.14 1.96 3.68 74 RCVD_IN_IADB_DK 12794 3.07 1.97 3.57 75 XM_SendGrid 12774 4.01 4.99 3.56 76 BAYES_999 12480 9.93 24.05 3.48 77 XM_UncommonTLD01 12383 5.18 8.96 3.45 78 T_REMOTE_IMAGE 12031 3.28 3.13 3.35 79 MAILING_LIST_MULTI 11889 2.84 1.81 3.31 80 XMNumbers 11875 3.92 5.26 3.31 81 FSL_BULK_SIG 11729 5.97 11.89 3.27 82 T_HTML_ATTACH 11553 2.36 0.47 3.22 83 RELAYCOUNTRY_META 11484 8.81 21.07 3.20 84 XM_B_Phish_Phrases 11092 3.92 5.73 3.09 85 TR_XM_PhishingBody 10392 3.87 6.00 2.90 86 RCVD_IN_IADB_VOUCHED 9765 2.29 1.35 2.72 87 BAYES_05 9153 1.96 0.66 2.55 88 TooManyTo_002 8933 1.91 0.65 2.49 89 ANY_BOUNCE_MESSAGE 8916 2.06 1.12 2.49 90 BOUNCE_MESSAGE 8914 2.06 1.12 2.49 91 TM2_M_URI_OPT_OUT 8737 2.52 2.71 2.44 92 TR_XM_DK_SendGrid 8295 2.58 3.15 2.31 93 BAYES_95 8154 3.10 4.91 2.27 94 XM_SPF_SoftFail 8153 2.98 4.52 2.27 95 DKIM_INVALID 8057 3.20 5.29 2.25 96 HTML_IMAGE_RATIO_08 7640 2.27 2.58 2.13 97 FROM_EXCESS_BASE64 7474 1.99 1.78 2.08 98 URI_NOVOWEL 7454 2.06 2.01 2.08 99 HTML_FONT_FACE_BAD 7409 1.64 0.70 2.07 100 HELO_NODOT 7335 1.58 0.58 2.04 101 HELO_NO_DOMAIN 7326 1.58 0.58 2.04 102 XM_B_SpammyTLD 7087 2.89 4.88 1.98 103 MIME_HTML_MOSTLY 6946 2.28 3.04 1.94 104 TVD_RCVD_IP 6816 1.38 0.24 1.90 105 XM_B_Phish66 6814 2.41 3.54 1.90 106 HTML_MIME_NO_HTML_TAG 6622 4.65 10.80 1.85 107 INVALID_MSGID 6613 1.30 0.11 1.84 108 TR_XM_SB_Phish 6604 1.75 1.55 1.84 109 XMSubPhish11 6457 1.70 1.48 1.80 110 RCVD_IN_IADB_OPTIN 6449 1.48 0.79 1.80 111 IN_HORDE_ADDRESS_BOOK 6159 1.21 0.10 1.72 112 TooManyTo_003 6033 1.32 0.54 1.68 113 TO_MALFORMED 5967 1.15 0.01 1.66 114 XM_DK_Undo_01 5744 1.68 1.85 1.60 115 XMDiploma_00 5731 2.18 3.46 1.60 116 T_XMDrugObfuBody_14 5691 2.41 4.20 1.59 117 XM_CamelCaseFrm001 5606 1.83 2.41 1.56 118 KHOP_HELO_FCRDNS 5367 1.82 2.52 1.50 119 TR_XM_SpammyRelay 5186 4.85 12.29 1.45 120 SUBJ_ALL_CAPS 5167 1.61 1.99 1.44 121 TR_Symld_Words 5032 1.37 1.31 1.40 122 TR_DCC_Bayes_99 4968 7.71 21.54 1.39 123 XM_B_Investor 4908 2.73 5.71 1.37 124 BOTNET 4697 4.74 12.25 1.31 125 XMSexyCombo_01 4672 1.59 2.21 1.30 126 XM_GoogleGroups 4641 3.32 7.75 1.29 127 UNTRUSTED_Relay 4586 3.33 7.83 1.28 128 XMCapTrack 4548 0.98 0.37 1.27 129 T_XMDrugObfuBody_08 4512 1.92 3.35 1.26 130 XMStockSpam_06 4383 1.39 1.75 1.22 131 TooManyTo_004 4369 0.96 0.40 1.22 132 XMGappySubj_01 4334 0.89 0.19 1.21 133 XMBSHREFv2 4268 0.89 0.25 1.19 134 TR_XM_SpammyWords5 4161 1.97 3.74 1.16 135 XMNoVowels 4145 0.89 0.32 1.16 136 XM_OfRef6 4137 2.00 3.86 1.15 137 XMSubNoVowel 4000 1.16 1.26 1.12 138 TM2_M_VERY_LONG_WORD 3936 3.80 9.70 1.10 139 XM_B_Unsub2 3930 1.57 2.62 1.10 140 RCVD_IN_MSPIKE_BL 3814 1.94 3.86 1.06 141 URI_HEX 3807 1.19 1.49 1.06 142 TR_XM_MSPIKECOMBO 3768 1.92 3.82 1.05 143 TooManyTo_005 3661 0.81 0.34 1.02 144 TVD_SPACE_RATIO 3503 0.69 0.08 0.98 145 T_TooManySym_03 3337 0.74 0.33 0.93 146 RELAYCOUNTRY_CA 3321 3.19 8.15 0.93 147 DKIM_ADSP_CUSTOM_MED 3213 0.91 0.94 0.90 148 RCVD_IN_MSPIKE_H5 3168 0.71 0.32 0.88 149 XM_E_Blogspot 3074 0.64 0.17 0.86 150 RCVD_IN_RP_SAFE 3032 0.78 0.62 0.85 151 XM_UB50 2992 1.60 3.28 0.83 152 XMGenDplmaNmb 2986 0.99 1.34 0.83 153 XM_H_Long_From02 2949 0.96 1.26 0.82 154 HTTPS_HTTP_MISMATCH 2885 1.00 1.43 0.80 155 TR_XM_Base64_M1 2811 0.80 0.84 0.78 156 T_FILL_THIS_FORM_SHORT 2750 1.10 1.83 0.77 157 XMBody_95 2653 0.60 0.31 0.74 158 RCVD_IN_RP_CERTIFIED 2620 0.66 0.49 0.73 159 XM_ShortIntro_01 2609 0.60 0.33 0.73 160 XM_B_SpammyWords4 2596 1.18 2.17 0.72 161 XMSubMetaSxObfu_03 2578 0.63 0.42 0.72 162 SpammyFromTLD_01 2561 1.54 3.34 0.71 163 XMSexyCombo_04 2397 0.67 0.67 0.67 164 TR_MetaPhish_Combo_01 2368 0.68 0.74 0.66 165 XMHTML_After_End 2365 0.92 1.48 0.66 166 FILL_THIS_FORM 2322 0.61 0.52 0.65 167 MSGID_NOFQDN1 2280 0.44 0.01 0.64 168 TR_XM_SpammyWords2 2273 3.57 9.99 0.63 169 XM_H_PHPMailer 2272 0.68 0.77 0.63 170 XM_B_COVIDMETA 2216 0.98 1.77 0.62 171 SHORT_HELO_AND_INLINE_IMAGE 2215 0.45 0.07 0.62 172 HTML_IMAGE_ONLY_20 2184 0.60 0.58 0.61 173 T_OBFU_PDF_ATTACH 2132 0.48 0.24 0.59 174 XMBdyGiftCard01 2085 0.81 1.31 0.58 175 MPART_ALT_DIFF_COUNT 2056 0.75 1.13 0.57 176 NML_ADSP_CUSTOM_MED 1983 0.59 0.68 0.55 177 T_XMHurry_00 1946 0.77 1.27 0.54 178 HTML_TAG_BALANCE_BODY 1938 0.80 1.37 0.54 179 XMSubMetaSx_01 1932 0.44 0.22 0.54 180 RCVD_IN_SORBS_DUL 1879 0.40 0.13 0.52 181 RCVD_IN_MSPIKE_L4 1847 0.58 0.73 0.51 182 XM_B_COPY_HTML 1842 0.57 0.68 0.51 183 XMSexyCombo_02 1818 0.39 0.13 0.51 184 XMSubMetaI_00 1797 0.61 0.83 0.50 185 XMBrknScrpt_02 1786 0.88 1.72 0.50 186 RCVD_IN_MSPIKE_L3 1783 0.83 1.55 0.50 187 TR_XM_SpammyWords3 1733 0.93 1.90 0.48 188 FORGED_GMAIL_RCVD 1702 0.57 0.79 0.47 189 HTML_IMAGE_ONLY_32 1684 0.38 0.17 0.47 190 RELAYCOUNTRY_GB 1655 0.51 0.61 0.46 191 USER_IN_WHITELIST 1653 0.32 0.00 0.46 192 USER_IN_WELCOMELIST 1653 0.32 0.00 0.46 193 T_XMDrugObfuBody_00 1624 0.68 1.17 0.45 194 URI_TRY_3LD 1612 0.67 1.14 0.45 195 XMMoneyMeta_00 1601 0.61 0.98 0.45 196 TM2_M_BODY_EMPTY 1586 0.36 0.17 0.44 197 XMSubMetaSxObfu_02 1565 0.40 0.32 0.44 198 T_Symld_Words_02 1562 0.55 0.81 0.44 199 XMPhish30 1553 0.59 0.94 0.43 200 TO_NO_BRKTS_HTML_ONLY 1516 0.33 0.12 0.42 ----------------------------------------------------------------------