Email: 543011 Autolearn: 0 AvgScore: 3.77 AvgScanTime: 1.43 sec Spam: 164618 Autolearn: 0 AvgScore: 13.72 AvgScanTime: 1.61 sec Ham: 378393 Autolearn: 0 AvgScore: -0.56 AvgScanTime: 1.35 sec Time Spent Running SA: 215.69 hours Time Spent Processing Spam: 73.51 hours Time Spent Processing Ham: 142.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158337 90.41 96.18 87.90 2 DKIM_SIGNED 144070 72.69 87.52 66.24 3 XM_DK_Pass 137686 70.70 83.64 65.07 4 DKIM_VALID 136950 69.79 83.19 63.96 5 XM_B_Unicode 136921 75.32 83.17 71.90 6 RELAYCOUNTRY_US 132628 75.28 80.57 72.98 7 DCC_CHECK 115031 41.69 69.88 29.43 8 XM_B_SpammyWords 114754 51.15 69.71 43.07 9 XMListUnsubscribeExists 113004 51.01 68.65 43.34 10 DKIM_VALID_AU 102827 53.84 62.46 50.09 11 RCVD_IN_MSPIKE_H2 82686 39.04 50.23 34.18 12 XM_B_Unicode3 75973 44.00 46.15 43.07 13 BAYES_50 70471 53.94 42.81 58.78 14 XM_DK_Undo_02 69602 16.85 42.28 5.79 15 XM_B_SpammyWords2 63275 24.60 38.44 18.58 16 LOC_TINY_FONT_1 60661 25.67 36.85 20.81 17 FVGT_m_MULTI_ODD 56450 30.64 34.29 29.06 18 TR_XM_DKIM_Undo 55653 13.05 33.81 4.03 19 HTML_FONT_LOW_CONTRAST 54349 26.16 33.02 23.18 20 DKIM_VALID_EF 53312 27.33 32.39 25.13 21 BAYES_99 53187 13.32 32.31 5.06 22 T_KAM_HTML_FONT_INVALID 50453 21.15 30.65 17.02 23 MIME_HTML_ONLY 49880 25.98 30.30 24.10 24 DCC_CHECK_NEGATIVE 49538 58.27 30.09 70.52 25 BAYES_999 41752 10.55 25.36 4.11 26 XMSubLong 40477 26.09 24.59 26.74 27 XM_Body_Dirty_Words 37533 13.25 22.80 9.10 28 TR_DCC_Bayes_99 36352 7.78 22.08 1.55 29 T_TM2_M_HEADER_IN_MSG 35351 28.26 21.47 31.22 30 RELAYCOUNTRY_META 29555 7.74 17.95 3.30 31 XM_B_Unsub 28229 15.49 17.15 14.77 32 XM_Multi_Part_URI 28126 12.50 17.09 10.50 33 TR_XM_BayesUnsub 27632 14.14 16.79 12.99 34 LOTS_OF_MONEY 22583 10.97 13.72 9.78 35 BOTNET_IPINHOSTNAME 21076 6.95 12.80 4.40 36 XM_B_SpammyWords3 20754 6.34 12.61 3.61 37 TR_XM_SpammyRelay 20623 4.91 12.53 1.59 38 FSL_BULK_SIG 20538 6.14 12.48 3.39 39 UNPARSEABLE_RELAY 19818 8.33 12.04 6.71 40 TR_XM_UnparsRelay 19424 7.25 11.80 5.27 41 BOTNET 19386 4.44 11.78 1.25 42 TR_XM_SpammyWords4 18828 8.60 11.44 7.37 43 RCVD_IN_MSPIKE_WL 18367 14.28 11.16 15.64 44 TR_XM_SpammyWords2 17367 3.69 10.55 0.70 45 RCVD_IN_BL_SPAMCOP_NET 16500 3.30 10.02 0.38 46 XMSexyCombo_05 15361 4.45 9.33 2.32 47 XM_Evil_Numbers_Gen 14673 7.36 8.91 6.69 48 RCVD_IN_MSPIKE_H3 13716 9.74 8.33 10.35 49 BAYES_80 13305 5.31 8.08 4.10 50 RELAYCOUNTRY_CA 12518 3.00 7.60 0.99 51 LotsOfNums_01 12438 7.63 7.56 7.66 52 UNTRUSTED_Relay 12425 3.13 7.55 1.21 53 XM_SendGrid 12102 5.28 7.35 4.38 54 TR_XM_SPAMCOP 12095 2.39 7.35 0.23 55 BAYES_60 12054 8.18 7.32 8.55 56 HTML_IMAGE_RATIO_02 11194 5.55 6.80 5.00 57 TR_XM_PhishingBody 10722 4.08 6.51 3.02 58 XM_UncommonTLD01 10068 4.26 6.12 3.45 59 XM_B_Phish_Phrases 9961 3.67 6.05 2.64 60 MPART_ALT_DIFF 9711 4.84 5.90 4.39 61 RCVD_IN_MSPIKE_BL 8822 2.48 5.36 1.22 62 TR_XM_MSPIKECOMBO 8646 2.44 5.25 1.22 63 XM_H_Long_From01 8473 4.99 5.15 4.93 64 XMStrtUSub 8342 4.78 5.07 4.65 65 XMSubMetaSx_00 8277 3.84 5.03 3.33 66 XM_B_SpammyTLD 8133 2.94 4.94 2.07 67 BAYES_95 8037 3.16 4.88 2.41 68 XM_B_Investor 8009 2.64 4.87 1.67 69 XM_SPF_SoftFail 7707 3.85 4.68 3.48 70 TR_XM_DK_SendGrid 7293 3.30 4.43 2.81 71 DKIM_INVALID 7120 2.90 4.33 2.28 72 T_XMDrugObfuBody_14 6869 2.15 4.17 1.27 73 TooManyTo_001 6858 11.01 4.17 13.99 74 XMNumbers 6569 3.33 3.99 3.05 75 T_TooManySym_01 6542 5.64 3.97 6.37 76 TR_XM_SpammyWords5 6448 2.12 3.92 1.34 77 HTML_MIME_NO_HTML_TAG 6393 2.75 3.88 2.26 78 TM2_M_VERY_LONG_WORD 6258 2.12 3.80 1.39 79 HTML_IMAGE_RATIO_04 6231 3.62 3.79 3.55 80 HTML_IMAGE_RATIO_06 6136 3.99 3.73 4.11 81 XM_OfRef6 6115 1.84 3.71 1.02 82 TR_XM_SpammyWords3 6004 1.49 3.65 0.55 83 MIME_HTML_ONLY_MULTI 5967 3.05 3.62 2.80 84 MIME_QP_LONG_LINE 5899 4.44 3.58 4.81 85 XM_B_Phish66 5855 2.29 3.56 1.73 86 MIME_HTML_MOSTLY 5757 2.52 3.50 2.09 87 T_XMDrugObfuBody_08 5742 1.97 3.49 1.32 88 ALL_TRUSTED 5703 18.07 3.46 24.43 89 XM_DIRTYINTL 5687 1.28 3.45 0.33 90 HTML_IMAGE_RATIO_08 5578 2.78 3.39 2.51 91 XM_UB50 5574 1.58 3.39 0.80 92 XM_B_Unsub2 4957 1.69 3.01 1.12 93 RCVD_IN_VALIDITY_SAFE 4851 3.88 2.95 4.29 94 XMDiploma_00 4793 6.38 2.91 7.88 95 T_REMOTE_IMAGE 4706 3.10 2.86 3.21 96 T_FILL_THIS_FORM_SHORT 4581 1.40 2.78 0.79 97 RCVD_IN_IADB_LISTED 4533 4.33 2.75 5.02 98 URI_NOVOWEL 4334 2.65 2.63 2.66 99 KHOP_HELO_FCRDNS 4308 2.22 2.62 2.05 100 XM_CamelCaseFrm001 4279 2.10 2.60 1.89 101 RCVD_IN_MSPIKE_H4 4242 3.88 2.58 4.45 102 TM2_M_URI_OPT_OUT 4202 2.39 2.55 2.32 103 RCVD_IN_MSPIKE_L5 4180 0.78 2.54 0.01 104 XM_DK_Undo_01 3938 1.72 2.39 1.43 105 SpammyFromTLD_01 3935 1.34 2.39 0.89 106 XM_B_SpammyWords4 3912 1.05 2.38 0.47 107 RCVD_IN_IADB_SPF 3741 3.80 2.27 4.46 108 RCVD_IN_MSPIKE_L3 3657 1.30 2.22 0.90 109 XMBody_17 3652 0.95 2.22 0.40 110 TR_XM_MSPIKECOMBO2 3614 0.84 2.20 0.26 111 RCVD_IN_VALIDITY_RPBL 3579 0.67 2.17 0.02 112 MAILING_LIST_MULTI 3517 2.81 2.14 3.11 113 BOTNET_NORDNS 3453 0.65 2.10 0.02 114 RCVD_IN_IADB_DK 3426 3.31 2.08 3.85 115 XM_B_COVIDMETA 3401 0.92 2.07 0.42 116 RCVD_IN_VALIDITY_CERTIFIED 3381 3.35 2.05 3.91 117 RCVD_IN_IADB_SENDERID 3381 3.40 2.05 3.99 118 SpammyFromTLD_02 3355 0.93 2.04 0.45 119 FROM_EXCESS_BASE64 3320 1.94 2.02 1.90 120 PDS_OTHER_BAD_TLD 3271 0.69 1.99 0.13 121 USER_IN_DEF_DKIM_WL 3167 8.46 1.92 11.30 122 BAYES_40 3087 3.84 1.88 4.69 123 XMStockSpam_06 3063 1.15 1.86 0.84 124 SUBJ_ALL_CAPS 3037 1.58 1.84 1.47 125 XMHTML_After_End 2943 1.05 1.79 0.72 126 HTML_FONT_FACE_BAD 2923 2.30 1.78 2.53 127 HTTPS_HTTP_MISMATCH 2883 1.04 1.75 0.73 128 TR_XM_SB_Phish 2873 1.89 1.75 1.96 129 TR_XM_NoHeaderRelay 2861 0.61 1.74 0.12 130 URI_HEX 2835 1.19 1.72 0.96 131 RCVD_IN_IADB_VOUCHED 2812 2.74 1.71 3.19 132 URI_PHP_REDIR 2794 0.52 1.70 0.00 133 XMSubPhish11 2777 1.85 1.69 1.91 134 HK_RANDOM_REPLYTO 2682 0.54 1.63 0.06 135 TR_XM_MaxSPIKE 2645 0.61 1.61 0.17 136 TR_XM_FormFill 2593 0.49 1.58 0.01 137 XM_UB99 2592 0.48 1.57 0.00 138 HTML_TAG_BALANCE_BODY 2540 0.89 1.54 0.61 139 URIBL_DBL_SPAM 2502 0.47 1.52 0.02 140 TM2_M_A_HREF_HREF 2478 0.71 1.51 0.37 141 XMSexyCombo_01 2464 0.80 1.50 0.50 142 XMGenDplmaNmb 2456 0.90 1.49 0.64 143 XM_URI_RBL 2445 0.52 1.49 0.10 144 XMBdyGiftCard01 2438 0.96 1.48 0.73 145 TR_XM_COVIDMETA4 2416 0.70 1.47 0.37 146 XMLngstWrd_00 2398 0.96 1.46 0.74 147 TR_XM_PHPDW 2359 0.63 1.43 0.28 148 TR_XM_BayesRelay 2352 0.43 1.43 0.00 149 XMLngstWrd_01 2318 0.90 1.41 0.68 150 TR_XM_PHPForged 2276 0.59 1.38 0.25 151 XM_GoogleGroups 2263 1.42 1.37 1.44 152 XMBrknScrpt_02 2258 0.85 1.37 0.62 153 URIBL_BLACK 2250 0.45 1.37 0.05 154 TR_XM_COVIDMETA1 2250 0.52 1.37 0.15 155 TR_Symld_Words 2246 1.49 1.36 1.54 156 TR_XM_FormFill2 2245 0.59 1.36 0.26 157 T_XMDrugObfuBody_00 2243 0.89 1.36 0.69 158 TR_LOTS_OF_MONEY3 2240 0.58 1.36 0.24 159 XM_H_PHPOS 2234 0.58 1.36 0.24 160 RCVD_IN_PSBL 2232 0.52 1.36 0.16 161 TR_Mismatch_TLD_01 2190 0.62 1.33 0.30 162 T_XMHurry_00 2177 2.67 1.32 3.26 163 XMLngstWrd_02 2149 0.80 1.31 0.58 164 XMRefNum 2092 0.48 1.27 0.14 165 HTML_OBFUSCATE_10_20 2082 0.50 1.26 0.16 166 URI_TRY_3LD 2026 0.70 1.23 0.47 167 XM_Body_Dirty_Words_01 2010 0.66 1.22 0.42 168 MPART_ALT_DIFF_COUNT 1989 0.72 1.21 0.51 169 BAYES_20 1965 2.81 1.19 3.52 170 XM_BadFromFormat 1931 0.52 1.17 0.23 171 XM_H_Long_From02 1931 1.25 1.17 1.29 172 XMReplyNow 1921 0.53 1.17 0.26 173 XM_UB999 1910 0.35 1.16 0.00 174 RELAYCOUNTRY_AU 1899 0.56 1.15 0.30 175 RELAYCOUNTRY_FR 1894 0.51 1.15 0.24 176 TR_XM_Base64_M1 1888 0.90 1.15 0.80 177 XMLngstWrd_03 1871 0.66 1.14 0.46 178 XMPhish30 1769 0.72 1.07 0.57 179 HTML_TAG_BALANCE_CENTER 1768 0.40 1.07 0.11 180 XMLngstWrd_04 1743 0.59 1.06 0.39 181 HTML_TITLE_SUBJ_DIFF 1691 0.53 1.03 0.32 182 XM_B_SEO 1680 0.41 1.02 0.14 183 TR_MetaPhish_Combo_01 1677 0.80 1.02 0.71 184 RCVD_IN_IADB_OPTIN 1676 1.81 1.02 2.15 185 DATE_IN_PAST_06_12 1675 0.34 1.02 0.04 186 XM_H_Undi_Recip 1629 0.43 0.99 0.19 187 XM_ProductURIs 1613 0.69 0.98 0.57 188 DIET_1 1610 0.48 0.98 0.26 189 FONT_INVIS_LONG_LINE 1602 0.33 0.97 0.04 190 TO_NO_BRKTS_FROM_MSSP 1595 0.41 0.97 0.17 191 MIXED_CENTER_CASE 1569 0.29 0.95 0.00 192 XM_PDF 1562 3.31 0.95 4.34 193 XMSubMetaI_00 1557 0.70 0.95 0.59 194 XMMoneyMeta_00 1551 0.63 0.94 0.49 195 PLING_QUERY 1549 0.51 0.94 0.32 196 DKIM_ADSP_CUSTOM_MED 1541 0.85 0.94 0.82 197 MIXED_HREF_CASE 1540 0.29 0.94 0.00 198 MIXED_IMG_CASE 1533 0.29 0.93 0.00 199 MIXED_AREA_CASE 1525 0.28 0.93 0.00 200 REMOVE_BEFORE_LINK 1517 0.44 0.92 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 332601 90.41 96.18 87.90 2 RELAYCOUNTRY_US 276159 75.28 80.57 72.98 3 XM_B_Unicode 272083 75.32 83.17 71.90 4 DCC_CHECK_NEGATIVE 266858 58.27 30.09 70.52 5 DKIM_SIGNED 250647 72.69 87.52 66.24 6 XM_DK_Pass 246237 70.70 83.64 65.07 7 DKIM_VALID 242002 69.79 83.19 63.96 8 BAYES_50 222417 53.94 42.81 58.78 9 DKIM_VALID_AU 189527 53.84 62.46 50.09 10 XMListUnsubscribeExists 164000 51.01 68.65 43.34 11 XM_B_SpammyWords 162980 51.15 69.71 43.07 12 XM_B_Unicode3 162958 44.00 46.15 43.07 13 RCVD_IN_MSPIKE_H2 129317 39.04 50.23 34.18 14 T_TM2_M_HEADER_IN_MSG 118127 28.26 21.47 31.22 15 DCC_CHECK 111351 41.69 69.88 29.43 16 FVGT_m_MULTI_ODD 109949 30.64 34.29 29.06 17 XMSubLong 101201 26.09 24.59 26.74 18 DKIM_VALID_EF 95081 27.33 32.39 25.13 19 ALL_TRUSTED 92441 18.07 3.46 24.43 20 MIME_HTML_ONLY 91211 25.98 30.30 24.10 21 HTML_FONT_LOW_CONTRAST 87712 26.16 33.02 23.18 22 LOC_TINY_FONT_1 78746 25.67 36.85 20.81 23 XM_B_SpammyWords2 70318 24.60 38.44 18.58 24 T_KAM_HTML_FONT_INVALID 64390 21.15 30.65 17.02 25 RCVD_IN_MSPIKE_WL 59171 14.28 11.16 15.64 26 XM_B_Unsub 55895 15.49 17.15 14.77 27 TooManyTo_001 52945 11.01 4.17 13.99 28 TR_XM_BayesUnsub 49159 14.14 16.79 12.99 29 USER_IN_DEF_DKIM_WL 42754 8.46 1.92 11.30 30 BAYES_00 40043 7.58 0.69 10.58 31 XM_Multi_Part_URI 39729 12.50 17.09 10.50 32 RCVD_IN_MSPIKE_H3 39179 9.74 8.33 10.35 33 LOTS_OF_MONEY 37003 10.97 13.72 9.78 34 XM_Body_Dirty_Words 34442 13.25 22.80 9.10 35 BAYES_60 32340 8.18 7.32 8.55 36 XMDiploma_00 29829 6.38 2.91 7.88 37 XM_DKIMWhitelistDomains 29790 5.51 0.07 7.87 38 IN_ZIMBRA_NJ_WHITELIST 28999 5.38 0.12 7.66 39 LotsOfNums_01 28998 7.63 7.56 7.66 40 TR_XM_SpammyWords4 27873 8.60 11.44 7.37 41 UNPARSEABLE_RELAY 25389 8.33 12.04 6.71 42 XM_Evil_Numbers_Gen 25318 7.36 8.91 6.69 43 T_TooManySym_01 24104 5.64 3.97 6.37 44 XM_DK_Undo_02 21919 16.85 42.28 5.79 45 TR_XM_DK_Bayes 20903 4.00 0.51 5.52 46 TR_XM_UnparsRelay 19927 7.25 11.80 5.27 47 TR_XM_DK_Bayes1 19810 3.80 0.50 5.24 48 BAYES_99 19138 13.32 32.31 5.06 49 RCVD_IN_IADB_LISTED 18999 4.33 2.75 5.02 50 HTML_IMAGE_RATIO_02 18932 5.55 6.80 5.00 51 XM_H_Long_From01 18636 4.99 5.15 4.93 52 MIME_QP_LONG_LINE 18209 4.44 3.58 4.81 53 BAYES_40 17738 3.84 1.88 4.69 54 XMStrtUSub 17595 4.78 5.07 4.65 55 TR_XM_DK_Bayes2 17380 3.34 0.45 4.59 56 RCVD_IN_IADB_SPF 16876 3.80 2.27 4.46 57 RCVD_IN_MSPIKE_H4 16852 3.88 2.58 4.45 58 BOTNET_IPINHOSTNAME 16647 6.95 12.80 4.40 59 MPART_ALT_DIFF 16596 4.84 5.90 4.39 60 XM_SendGrid 16567 5.28 7.35 4.38 61 XM_PDF 16405 3.31 0.95 4.34 62 RCVD_IN_VALIDITY_SAFE 16223 3.88 2.95 4.29 63 HTML_IMAGE_RATIO_06 15547 3.99 3.73 4.11 64 BAYES_999 15537 10.55 25.36 4.11 65 BAYES_80 15508 5.31 8.08 4.10 66 TR_XM_DKIM_Undo 15237 13.05 33.81 4.03 67 RCVD_IN_IADB_SENDERID 15107 3.40 2.05 3.99 68 RCVD_IN_VALIDITY_CERTIFIED 14790 3.35 2.05 3.91 69 RCVD_IN_IADB_DK 14560 3.31 2.08 3.85 70 T_TooManySym_02 14176 2.83 0.71 3.75 71 XM_B_SpammyWords3 13658 6.34 12.61 3.61 72 HTML_IMAGE_RATIO_04 13451 3.62 3.79 3.55 73 BAYES_20 13319 2.81 1.19 3.52 74 XM_SPF_SoftFail 13179 3.85 4.68 3.48 75 XM_UncommonTLD01 13040 4.26 6.12 3.45 76 FSL_BULK_SIG 12823 6.14 12.48 3.39 77 XMSubMetaSx_00 12592 3.84 5.03 3.33 78 RELAYCOUNTRY_META 12492 7.74 17.95 3.30 79 T_XMHurry_00 12342 2.67 1.32 3.26 80 T_REMOTE_IMAGE 12147 3.10 2.86 3.21 81 RCVD_IN_IADB_VOUCHED 12088 2.74 1.71 3.19 82 MAILING_LIST_MULTI 11753 2.81 2.14 3.11 83 XMNumbers 11533 3.33 3.99 3.05 84 TR_XM_PhishingBody 11434 4.08 6.51 3.02 85 ANY_BOUNCE_MESSAGE 10630 2.22 0.86 2.81 86 BOUNCE_MESSAGE 10630 2.22 0.86 2.81 87 TR_XM_DK_SendGrid 10622 3.30 4.43 2.81 88 MIME_HTML_ONLY_MULTI 10590 3.05 3.62 2.80 89 URI_NOVOWEL 10063 2.65 2.63 2.66 90 XM_B_Phish_Phrases 9972 3.67 6.05 2.64 91 HTML_FONT_FACE_BAD 9592 2.30 1.78 2.53 92 HTML_IMAGE_RATIO_08 9513 2.78 3.39 2.51 93 BAYES_95 9112 3.16 4.88 2.41 94 XMSexyCombo_05 8780 4.45 9.33 2.32 95 BAYES_05 8777 1.87 0.84 2.32 96 TM2_M_URI_OPT_OUT 8767 2.39 2.55 2.32 97 DKIM_INVALID 8645 2.90 4.33 2.28 98 HTML_MIME_NO_HTML_TAG 8563 2.75 3.88 2.26 99 RCVD_IN_IADB_OPTIN 8142 1.81 1.02 2.15 100 MIME_HTML_MOSTLY 7922 2.52 3.50 2.09 101 XM_H_Trusted_IP 7916 1.46 0.00 2.09 102 XM_B_SpammyTLD 7818 2.94 4.94 2.07 103 KHOP_HELO_FCRDNS 7740 2.22 2.62 2.05 104 TR_XM_SB_Phish 7398 1.89 1.75 1.96 105 TooManyTo_002 7281 1.48 0.47 1.92 106 XMSubPhish11 7246 1.85 1.69 1.91 107 FROM_EXCESS_BASE64 7195 1.94 2.02 1.90 108 XM_CamelCaseFrm001 7146 2.10 2.60 1.89 109 INVALID_MSGID 6799 1.29 0.13 1.80 110 TVD_RCVD_IP 6561 1.31 0.35 1.73 111 XM_B_Phish66 6557 2.29 3.56 1.73 112 XM_B_Investor 6302 2.64 4.87 1.67 113 HELO_NODOT 6263 1.32 0.55 1.66 114 HELO_NO_DOMAIN 6257 1.32 0.55 1.65 115 IN_HORDE_ADDRESS_BOOK 6184 1.18 0.13 1.63 116 TR_XM_SpammyRelay 6017 4.91 12.53 1.59 117 TO_MALFORMED 5957 1.10 0.01 1.57 118 TR_DCC_Bayes_99 5876 7.78 22.08 1.55 119 TR_Symld_Words 5828 1.49 1.36 1.54 120 SUBJ_ALL_CAPS 5561 1.58 1.84 1.47 121 XM_GoogleGroups 5430 1.42 1.37 1.44 122 XM_DK_Undo_01 5414 1.72 2.39 1.43 123 TM2_M_VERY_LONG_WORD 5258 2.12 3.80 1.39 124 TR_XM_SpammyWords5 5055 2.12 3.92 1.34 125 T_XMDrugObfuBody_08 4981 1.97 3.49 1.32 126 XMGappySubj_01 4937 0.99 0.26 1.30 127 XM_H_Long_From02 4863 1.25 1.17 1.29 128 T_XMDrugObfuBody_14 4816 2.15 4.17 1.27 129 TooManyTo_003 4805 1.00 0.38 1.27 130 BOTNET 4746 4.44 11.78 1.25 131 RCVD_IN_MSPIKE_BL 4620 2.48 5.36 1.22 132 TR_XM_MSPIKECOMBO 4606 2.44 5.25 1.22 133 UNTRUSTED_Relay 4568 3.13 7.55 1.21 134 SHORTENED_URL_HREF 4524 0.85 0.06 1.20 135 MSGID_NOFQDN1 4481 0.83 0.02 1.18 136 XM_B_Unsub2 4220 1.69 3.01 1.12 137 XMBSHREFv2 4201 0.86 0.28 1.11 138 XMNoVowels 4028 0.92 0.57 1.06 139 XMCapTrack 4006 0.86 0.39 1.06 140 XM_OfRef6 3861 1.84 3.71 1.02 141 RELAYCOUNTRY_CA 3763 3.00 7.60 0.99 142 URI_HEX 3628 1.19 1.72 0.96 143 T_TooManySym_03 3582 0.76 0.34 0.95 144 TVD_SPACE_RATIO 3550 0.68 0.09 0.94 145 TooManyTo_004 3468 0.74 0.32 0.92 146 RCVD_IN_MSPIKE_L3 3388 1.30 2.22 0.90 147 SpammyFromTLD_01 3350 1.34 2.39 0.89 148 XMStockSpam_06 3195 1.15 1.86 0.84 149 XMBody_95 3144 0.64 0.21 0.83 150 RCVD_IN_MSPIKE_H5 3140 0.65 0.25 0.83 151 RCVD_IN_RP_SAFE 3101 0.79 0.72 0.82 152 DKIM_ADSP_CUSTOM_MED 3086 0.85 0.94 0.82 153 XM_UB50 3030 1.58 3.39 0.80 154 TR_XM_Base64_M1 3010 0.90 1.15 0.80 155 T_FILL_THIS_FORM_SHORT 2998 1.40 2.78 0.79 156 XMSubNoVowel 2886 0.77 0.80 0.76 157 TooManyTo_005 2845 0.61 0.28 0.75 158 RCVD_IN_RP_CERTIFIED 2795 0.68 0.53 0.74 159 XMLngstWrd_00 2793 0.96 1.46 0.74 160 XMBdyGiftCard01 2772 0.96 1.48 0.73 161 HTTPS_HTTP_MISMATCH 2757 1.04 1.75 0.73 162 XMHTML_After_End 2743 1.05 1.79 0.72 163 TR_MetaPhish_Combo_01 2683 0.80 1.02 0.71 164 TR_XM_SpammyWords2 2664 3.69 10.55 0.70 165 T_XMDrugObfuBody_00 2604 0.89 1.36 0.69 166 XMLngstWrd_01 2560 0.90 1.41 0.68 167 HTML_IMAGE_ONLY_04 2450 0.68 0.77 0.65 168 XMGenDplmaNmb 2424 0.90 1.49 0.64 169 T_OBFU_PDF_ATTACH 2378 0.51 0.23 0.63 170 HTML_SHORT_LINK_IMG_1 2347 0.67 0.78 0.62 171 XMBrknScrpt_02 2344 0.85 1.37 0.62 172 HTML_TAG_BALANCE_BODY 2294 0.89 1.54 0.61 173 XMSubMetaI_00 2233 0.70 0.95 0.59 174 XM_ShortIntro_01 2210 0.50 0.31 0.58 175 XMLngstWrd_02 2203 0.80 1.31 0.58 176 FROM_GOV_DKIM_AU 2200 0.44 0.12 0.58 177 XM_B_COPY_HTML 2174 0.59 0.64 0.57 178 XMPhish30 2160 0.72 1.07 0.57 179 XM_ProductURIs 2148 0.69 0.98 0.57 180 HTML_IMAGE_ONLY_20 2132 0.62 0.76 0.56 181 TR_XM_SpammyWords3 2069 1.49 3.65 0.55 182 XM_H_PHPMailer 2028 0.58 0.68 0.54 183 NML_ADSP_CUSTOM_MED 1958 0.59 0.75 0.52 184 MPART_ALT_DIFF_COUNT 1936 0.72 1.21 0.51 185 XMSexyCombo_01 1901 0.80 1.50 0.50 186 RELAYCOUNTRY_GB 1881 0.53 0.62 0.50 187 SHORT_HELO_AND_INLINE_IMAGE 1857 0.37 0.09 0.49 188 XMMoneyMeta_00 1847 0.63 0.94 0.49 189 XMHTMLBadTable_001 1806 0.57 0.77 0.48 190 XM_B_SpammyWords4 1791 1.05 2.38 0.47 191 URI_TRY_3LD 1777 0.70 1.23 0.47 192 XMLngstWrd_03 1738 0.66 1.14 0.46 193 SpammyFromTLD_02 1708 0.93 2.04 0.45 194 T_Symld_Words_02 1704 0.57 0.86 0.45 195 FORGED_GMAIL_RCVD 1687 0.55 0.79 0.45 196 XM_S_SpammyWords 1683 0.54 0.75 0.44 197 TR_XM_Spammywords 1682 0.54 0.75 0.44 198 RCVD_IN_SORBS_DUL 1645 0.34 0.13 0.43 199 XMPhish14 1619 0.57 0.89 0.43 200 XM_B_COVIDMETA 1606 0.92 2.07 0.42 ----------------------------------------------------------------------