Email: 605812 Autolearn: 0 AvgScore: 2.93 AvgScanTime: 1.79 sec Spam: 200438 Autolearn: 0 AvgScore: 14.81 AvgScanTime: 2.31 sec Ham: 405374 Autolearn: 0 AvgScore: -2.94 AvgScanTime: 1.53 sec Time Spent Running SA: 301.00 hours Time Spent Processing Spam: 128.79 hours Time Spent Processing Ham: 172.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 191274 91.43 95.43 89.45 2 DKIM_SIGNED 175536 67.50 87.58 57.58 3 XM_B_Unicode 164125 77.03 81.88 74.64 4 RELAYCOUNTRY_US 159845 77.46 79.75 76.34 5 XM_DK_Pass 147836 61.62 73.76 55.62 6 DKIM_VALID 144899 60.60 72.29 54.83 7 DCC_CHECK 140588 40.31 70.14 25.55 8 XMListUnsubscribeExists 138893 48.18 69.29 37.74 9 XM_B_SpammyWords 132065 48.24 65.89 39.52 10 DKIM_VALID_AU 109561 47.00 54.66 43.21 11 XM_B_Unicode3 90452 46.55 45.13 47.25 12 BAYES_50 87115 51.60 43.46 55.62 13 RCVD_IN_MSPIKE_H2 75792 32.52 37.81 29.90 14 XM_DK_Undo_02 75039 15.77 37.44 5.06 15 XM_B_SpammyWords2 73453 21.41 36.65 13.87 16 LOC_TINY_FONT_1 70091 23.53 34.97 17.88 17 MIME_HTML_ONLY 67521 29.79 33.69 27.86 18 FVGT_m_MULTI_ODD 66326 24.26 33.09 19.89 19 HTML_FONT_LOW_CONTRAST 64608 25.10 32.23 21.57 20 BAYES_99 63038 13.10 31.45 4.03 21 TR_XM_DKIM_Undo 61502 12.57 30.68 3.61 22 DCC_CHECK_NEGATIVE 59820 59.65 29.84 74.39 23 T_KAM_HTML_FONT_INVALID 59738 20.07 29.80 15.26 24 DKIM_VALID_EF 57681 24.17 28.78 21.89 25 BAYES_999 50057 10.43 24.97 3.24 26 BOTNET 47802 9.30 23.85 2.10 27 XMSubLong 45471 24.96 22.69 26.09 28 RELAYCOUNTRY_META 43639 9.28 21.77 3.10 29 TR_DCC_Bayes_99 43185 7.93 21.55 1.20 30 XM_Body_Dirty_Words 42542 12.84 21.22 8.69 31 T_TM2_M_HEADER_IN_MSG 42294 22.71 21.10 23.50 32 XM_Multi_Part_URI 34037 11.82 16.98 9.27 33 DKIM_INVALID 30637 6.90 15.29 2.75 34 BOTNET_NORDNS 30356 5.44 15.14 0.64 35 XM_B_Unsub 29836 13.58 14.89 12.93 36 TR_XM_BayesUnsub 28996 12.34 14.47 11.28 37 RCVD_IN_MSPIKE_WL 27353 13.56 13.65 13.52 38 TR_XM_SpammyRelay 26070 5.17 13.01 1.29 39 LOTS_OF_MONEY 25278 8.00 12.61 5.72 40 UNPARSEABLE_RELAY 24348 7.85 12.15 5.73 41 XM_B_SpammyWords3 23553 5.95 11.75 3.08 42 TR_XM_UnparsRelay 23540 6.85 11.74 4.42 43 TR_XM_SpammyWords2 22555 4.14 11.25 0.63 44 BOTNET_IPINHOSTNAME 22496 6.47 11.22 4.12 45 RCVD_IN_MSPIKE_H3 22369 9.58 11.16 8.80 46 NO_DNS_FOR_FROM 21993 4.26 10.97 0.94 47 FSL_BULK_SIG 21079 4.93 10.52 2.17 48 TR_XM_SpammyWords4 20668 5.87 10.31 3.67 49 TR_XM_MaxWHORU 19963 3.73 9.96 0.65 50 XMSexyCombo_05 19289 4.84 9.62 2.47 51 XM_Evil_Numbers_Gen 18688 8.30 9.32 7.79 52 XM_UncommonTLD01 18471 5.25 9.22 3.29 53 RELAYCOUNTRY_CA 17915 3.68 8.94 1.07 54 MPART_ALT_DIFF 17330 9.89 8.65 10.51 55 RCVD_IN_BL_SPAMCOP_NET 17015 3.07 8.49 0.40 56 UNTRUSTED_Relay 16216 3.39 8.09 1.07 57 HTML_FONT_TINY_NORDNS 15969 2.85 7.97 0.33 58 BAYES_80 15765 4.92 7.87 3.47 59 BAYES_60 15198 7.48 7.58 7.43 60 LotsOfNums_01 15004 7.41 7.49 7.37 61 XM_H_Long_From01 14891 5.15 7.43 4.02 62 XM_SendGrid 13171 4.67 6.57 3.73 63 HTML_IMAGE_RATIO_02 12503 5.05 6.24 4.46 64 TR_XM_SPAMCOP 12208 2.13 6.09 0.17 65 TR_XM_PhishingBody 11955 3.49 5.96 2.27 66 XM_B_Phish_Phrases 11717 3.59 5.85 2.47 67 MIME_HTML_ONLY_MULTI 11707 7.84 5.84 8.82 68 XMSubMetaSx_00 11412 3.72 5.69 2.74 69 T_REMOTE_IMAGE 11234 3.99 5.60 3.19 70 NORDNS_LOW_CONTRAST 10867 1.95 5.42 0.24 71 TM2_M_VERY_LONG_WORD 10668 2.41 5.32 0.97 72 HTML_MIME_NO_HTML_TAG 9973 3.08 4.98 2.14 73 XM_B_SpammyTLD 9717 2.90 4.85 1.93 74 TooManyTo_001 9576 10.43 4.78 13.23 75 HTML_IMAGE_RATIO_04 9406 12.61 4.69 16.53 76 BAYES_95 9386 2.98 4.68 2.14 77 XM_B_Investor 8552 2.17 4.27 1.13 78 T_XMDrugObfuBody_08 8493 2.13 4.24 1.09 79 XM_CamelCaseFrm001 8400 2.36 4.19 1.46 80 XMNumbers 8389 3.26 4.19 2.81 81 XMBody_17 8306 1.65 4.14 0.41 82 XM_UB50 8049 1.74 4.02 0.62 83 XM_SPF_SoftFail 8039 2.56 4.01 1.84 84 XMStrtUSub 7998 9.14 3.99 11.69 85 MIME_HTML_MOSTLY 7790 2.79 3.89 2.25 86 T_FILL_THIS_FORM_SHORT 7703 1.87 3.84 0.90 87 TR_XM_SpammyWords5 7383 2.02 3.68 1.20 88 XM_GoogleGroups 7277 2.07 3.63 1.30 89 XMLngstWrd_00 7258 1.70 3.62 0.76 90 XMLngstWrd_01 7093 1.63 3.54 0.68 91 HTML_IMAGE_RATIO_06 6996 4.47 3.49 4.95 92 XMLngstWrd_02 6932 1.53 3.46 0.57 93 MIME_QP_LONG_LINE 6921 4.23 3.45 4.61 94 XM_OfRef6 6920 1.72 3.45 0.86 95 SpammyFromTLD_02 6568 1.38 3.28 0.44 96 XMLngstWrd_03 6453 1.38 3.22 0.48 97 TM2_M_URI_OPT_OUT 6415 2.46 3.20 2.09 98 T_XMDrugObfuBody_14 6357 1.95 3.17 1.35 99 TR_XM_DK_SendGrid 6356 2.62 3.17 2.34 100 XMDiploma_00 6301 6.14 3.14 7.63 101 PDS_OTHER_BAD_TLD 6292 1.11 3.14 0.10 102 XMLngstWrd_04 6261 1.30 3.12 0.40 103 HTML_IMAGE_RATIO_08 6120 2.22 3.05 1.80 104 HTML_TITLE_SUBJ_DIFF 6120 1.14 3.05 0.20 105 RCVD_IN_MSPIKE_BL 6085 1.21 3.04 0.31 106 XM_DIRTYINTL 6073 1.16 3.03 0.23 107 UPPERCASE_75_100 6030 1.13 3.01 0.19 108 XM_B_Phish66 6009 1.85 3.00 1.29 109 RCVD_IN_VALIDITY_SAFE 5924 3.46 2.96 3.71 110 RCVD_IN_VALIDITY_RPBL 5757 0.97 2.87 0.03 111 URI_NOVOWEL 5713 2.13 2.85 1.78 112 TR_XM_MSPIKECOMBO 5679 1.15 2.83 0.31 113 URIBL_DBL_SPAM 5541 1.00 2.76 0.13 114 SpammyFromTLD_01 5482 1.33 2.74 0.63 115 XM_DK_Undo_01 5328 1.77 2.66 1.33 116 XM_B_Unsub2 5276 1.65 2.63 1.17 117 ALL_TRUSTED 5010 15.03 2.50 21.23 118 TR_XM_NoHeaderRelay 4906 0.88 2.45 0.10 119 RCVD_IN_VALIDITY_CERTIFIED 4786 2.92 2.39 3.18 120 RCVD_IN_MSPIKE_H4 4636 3.42 2.31 3.97 121 TR_XM_FormFill 4512 0.76 2.25 0.03 122 USER_IN_DEF_DKIM_WL 4492 7.14 2.24 9.56 123 TR_XM_INV_DKIM 4475 0.79 2.23 0.08 124 XM_B_SpammyWords4 4444 1.02 2.22 0.42 125 T_TooManySym_01 4410 4.05 2.20 4.97 126 TR_XM_SB_Phish 4150 1.81 2.07 1.68 127 HTML_IMAGE_ONLY_24 4111 0.89 2.05 0.32 128 FONT_INVIS_LONG_LINE 4053 0.73 2.02 0.09 129 RCVD_IN_MSPIKE_L3 3917 0.85 1.95 0.30 130 XMSubPhish11 3856 1.74 1.92 1.65 131 FROM_EXCESS_BASE64 3842 1.86 1.92 1.83 132 HELO_NODOT 3788 1.57 1.89 1.42 133 HELO_NO_DOMAIN 3777 1.57 1.88 1.41 134 HTTPS_HTTP_MISMATCH 3700 1.06 1.85 0.67 135 MAILING_LIST_MULTI 3695 2.10 1.84 2.23 136 HTML_TEXT_INVISIBLE_STYLE 3687 0.71 1.84 0.16 137 RCVD_IN_IADB_LISTED 3670 3.22 1.83 3.91 138 HTTP_EXCESSIVE_ESCAPES 3657 0.61 1.82 0.00 139 XMStockSpam_06 3603 1.14 1.80 0.82 140 DOS_RCVD_IP_TWICE_B 3533 0.87 1.76 0.43 141 XMGenDplmaNmb 3492 1.01 1.74 0.64 142 SUBJ_ALL_CAPS 3467 1.41 1.73 1.25 143 URI_HEX 3436 1.26 1.71 1.03 144 XM_B_COVIDMETA 3410 0.83 1.70 0.41 145 XM_UB99 3372 0.56 1.68 0.00 146 BAYES_40 3363 3.87 1.68 4.95 147 TR_XM_SpammyWords3 3332 0.65 1.66 0.15 148 TR_XM_InvalidRelay 3330 0.57 1.66 0.03 149 XM_H_Undi_Recip 3312 0.71 1.65 0.24 150 HK_RANDOM_REPLYTO 3286 0.59 1.64 0.08 151 RCVD_IN_IADB_SPF 3184 2.88 1.59 3.52 152 TR_XM_PHPDW 3172 0.71 1.58 0.28 153 T_XMDrugObfuBody_00 3100 1.02 1.55 0.76 154 TR_XM_PHPForged 3098 0.67 1.55 0.24 155 TR_XM_FormFill2 3049 0.67 1.52 0.24 156 XM_H_PHPOS 3034 0.66 1.51 0.24 157 TR_XM_MSPIKECOMBO2 2997 0.52 1.50 0.04 158 TR_Mismatch_TLD_02 2960 0.61 1.48 0.18 159 TR_XM_COVIDMETA4 2958 0.60 1.48 0.16 160 XMSexyCombo_01 2952 0.75 1.47 0.40 161 RCVD_IN_IADB_SENDERID 2952 2.63 1.47 3.20 162 RCVD_IN_IADB_DK 2951 2.58 1.47 3.13 163 RELAYCOUNTRY_AU 2929 0.63 1.46 0.22 164 MPART_ALT_DIFF_COUNT 2773 0.74 1.38 0.42 165 XM_UB999 2763 0.46 1.38 0.00 166 TR_LOTS_OF_MONEY3 2748 0.59 1.37 0.21 167 XM_ShortIntro_01 2708 0.79 1.35 0.51 168 BAYES_20 2646 3.76 1.32 4.97 169 XMBrknScrpt_02 2586 0.86 1.29 0.64 170 MIME_BASE64_TEXT 2579 0.53 1.29 0.16 171 RCVD_IN_PSBL 2531 0.59 1.26 0.26 172 XMHTML_After_End 2517 0.85 1.26 0.65 173 XM_H_Long_From02 2515 0.98 1.25 0.84 174 FSL_HELO_NON_FQDN_1 2508 0.44 1.25 0.03 175 TR_XM_BayesRelay 2486 0.41 1.24 0.00 176 KHOP_HELO_FCRDNS 2477 1.15 1.24 1.11 177 BAYES_00 2335 9.51 1.16 13.64 178 XMPhish30 2330 0.71 1.16 0.49 179 XMBdyGiftCard01 2316 0.75 1.16 0.55 180 RELAYCOUNTRY_FR 2190 0.50 1.09 0.20 181 TR_Symld_Words 2188 1.27 1.09 1.36 182 XM_URI_RBL 2179 0.41 1.09 0.08 183 RELAYCOUNTRY_IN 2170 0.40 1.08 0.07 184 TM2_M_A_HREF_HREF 2124 0.49 1.06 0.21 185 T_XMHurry_00 2116 0.66 1.06 0.46 186 LONGLN_LOW_CONTRAST 2115 0.46 1.06 0.16 187 HTML_TAG_BALANCE_BODY 2070 0.72 1.03 0.56 188 TR_XM_MaxSPIKE 2046 0.36 1.02 0.04 189 REMOVE_BEFORE_LINK 2043 0.55 1.02 0.31 190 RCVD_IN_IADB_VOUCHED 2029 1.82 1.01 2.22 191 XMEmptySub 2015 0.39 1.01 0.08 192 XM_PDF 1995 2.98 1.00 3.96 193 THIS_AD 1945 0.48 0.97 0.24 194 RELAYCOUNTRY_LK 1921 0.32 0.96 0.00 195 XM_H_MailChimp 1910 0.57 0.95 0.38 196 RELAYCOUNTRY_CN 1898 0.34 0.95 0.04 197 RELAYCOUNTRY_RU 1879 0.33 0.94 0.03 198 TVD_RCVD_SPACE_BRACKET 1867 0.31 0.93 0.01 199 T_Symld_Words_02 1857 0.58 0.93 0.40 200 MY_SERVERS_FOUND 1836 0.62 0.92 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 362601 91.43 95.43 89.45 2 RELAYCOUNTRY_US 309443 77.46 79.75 76.34 3 XM_B_Unicode 302560 77.03 81.88 74.64 4 DCC_CHECK_NEGATIVE 301571 59.65 29.84 74.39 5 DKIM_SIGNED 233396 67.50 87.58 57.58 6 XM_DK_Pass 225480 61.62 73.76 55.62 7 BAYES_50 225470 51.60 43.46 55.62 8 DKIM_VALID 222251 60.60 72.29 54.83 9 XM_B_Unicode3 191543 46.55 45.13 47.25 10 DKIM_VALID_AU 175179 47.00 54.66 43.21 11 XM_B_SpammyWords 160193 48.24 65.89 39.52 12 XMListUnsubscribeExists 152992 48.18 69.29 37.74 13 RCVD_IN_MSPIKE_H2 121189 32.52 37.81 29.90 14 MIME_HTML_ONLY 112921 29.79 33.69 27.86 15 XMSubLong 105759 24.96 22.69 26.09 16 DCC_CHECK 103585 40.31 70.14 25.55 17 T_TM2_M_HEADER_IN_MSG 95256 22.71 21.10 23.50 18 DKIM_VALID_EF 88731 24.17 28.78 21.89 19 HTML_FONT_LOW_CONTRAST 87443 25.10 32.23 21.57 20 ALL_TRUSTED 86044 15.03 2.50 21.23 21 FVGT_m_MULTI_ODD 80625 24.26 33.09 19.89 22 LOC_TINY_FONT_1 72482 23.53 34.97 17.88 23 HTML_IMAGE_RATIO_04 66989 12.61 4.69 16.53 24 HTML_FONT_FACE_BAD 65431 11.07 0.80 16.14 25 XM_H_Trusted_IP 64381 10.63 0.00 15.88 26 T_KAM_HTML_FONT_INVALID 61842 20.07 29.80 15.26 27 XM_B_SpammyWords2 56227 21.41 36.65 13.87 28 BAYES_00 55274 9.51 1.16 13.64 29 RCVD_IN_MSPIKE_WL 54806 13.56 13.65 13.52 30 TooManyTo_001 53635 10.43 4.78 13.23 31 XM_B_Unsub 52426 13.58 14.89 12.93 32 XMStrtUSub 47383 9.14 3.99 11.69 33 TR_XM_BayesUnsub 45740 12.34 14.47 11.28 34 MPART_ALT_DIFF 42601 9.89 8.65 10.51 35 USER_IN_DEF_DKIM_WL 38756 7.14 2.24 9.56 36 XM_Multi_Part_URI 37587 11.82 16.98 9.27 37 MIME_HTML_ONLY_MULTI 35768 7.84 5.84 8.82 38 RCVD_IN_MSPIKE_H3 35663 9.58 11.16 8.80 39 XM_Body_Dirty_Words 35237 12.84 21.22 8.69 40 XM_Evil_Numbers_Gen 31571 8.30 9.32 7.79 41 XMDiploma_00 30918 6.14 3.14 7.63 42 BAYES_60 30104 7.48 7.58 7.43 43 LotsOfNums_01 29864 7.41 7.49 7.37 44 XM_DKIMWhitelistDomains 27332 4.55 0.11 6.74 45 UNPARSEABLE_RELAY 23237 7.85 12.15 5.73 46 LOTS_OF_MONEY 23184 8.00 12.61 5.72 47 IN_ZIMBRA_NJ_WHITELIST 23177 3.90 0.23 5.72 48 XM_DK_Undo_02 20515 15.77 37.44 5.06 49 XMSubNoVowel 20419 3.57 0.60 5.04 50 TR_XM_DK_Bayes 20324 3.51 0.46 5.01 51 BAYES_20 20132 3.76 1.32 4.97 52 T_TooManySym_01 20130 4.05 2.20 4.97 53 BAYES_40 20068 3.87 1.68 4.95 54 HTML_IMAGE_RATIO_06 20058 4.47 3.49 4.95 55 TR_XM_DK_Bayes1 20032 3.45 0.43 4.94 56 MIME_QP_LONG_LINE 18688 4.23 3.45 4.61 57 HTML_IMAGE_RATIO_02 18066 5.05 6.24 4.46 58 TR_XM_UnparsRelay 17931 6.85 11.74 4.42 59 TR_XM_DK_Bayes2 17787 3.06 0.39 4.39 60 BOTNET_IPINHOSTNAME 16707 6.47 11.22 4.12 61 BAYES_99 16329 13.10 31.45 4.03 62 XM_H_Long_From01 16300 5.15 7.43 4.02 63 RCVD_IN_MSPIKE_H4 16081 3.42 2.31 3.97 64 XM_PDF 16035 2.98 1.00 3.96 65 RCVD_IN_IADB_LISTED 15838 3.22 1.83 3.91 66 BAYES_05 15263 2.78 0.79 3.77 67 XM_SendGrid 15139 4.67 6.57 3.73 68 RCVD_IN_VALIDITY_SAFE 15024 3.46 2.96 3.71 69 TR_XM_SpammyWords4 14873 5.87 10.31 3.67 70 TR_XM_DKIM_Undo 14621 12.57 30.68 3.61 71 RCVD_IN_IADB_SPF 14282 2.88 1.59 3.52 72 BAYES_80 14068 4.92 7.87 3.47 73 XM_UncommonTLD01 13344 5.25 9.22 3.29 74 BAYES_999 13140 10.43 24.97 3.24 75 RCVD_IN_IADB_SENDERID 12953 2.63 1.47 3.20 76 T_REMOTE_IMAGE 12949 3.99 5.60 3.19 77 RCVD_IN_VALIDITY_CERTIFIED 12900 2.92 2.39 3.18 78 RCVD_IN_IADB_DK 12698 2.58 1.47 3.13 79 RELAYCOUNTRY_META 12562 9.28 21.77 3.10 80 XM_B_SpammyWords3 12466 5.95 11.75 3.08 81 ANY_BOUNCE_MESSAGE 11931 2.18 0.64 2.94 82 BOUNCE_MESSAGE 11931 2.18 0.64 2.94 83 XMNumbers 11378 3.26 4.19 2.81 84 T_TooManySym_02 11336 2.08 0.63 2.80 85 DKIM_INVALID 11145 6.90 15.29 2.75 86 XMSubMetaSx_00 11102 3.72 5.69 2.74 87 XMSexyCombo_05 10013 4.84 9.62 2.47 88 XM_B_Phish_Phrases 10009 3.59 5.85 2.47 89 TR_XM_DK_SendGrid 9490 2.62 3.17 2.34 90 TR_XM_PhishingBody 9188 3.49 5.96 2.27 91 MIME_HTML_MOSTLY 9116 2.79 3.89 2.25 92 MAILING_LIST_MULTI 9045 2.10 1.84 2.23 93 RCVD_IN_IADB_VOUCHED 9015 1.82 1.01 2.22 94 XMSubGarbage 8847 1.49 0.09 2.18 95 FSL_BULK_SIG 8811 4.93 10.52 2.17 96 XMSubLongNoVowel 8770 1.51 0.18 2.16 97 BAYES_95 8666 2.98 4.68 2.14 98 HTML_MIME_NO_HTML_TAG 8664 3.08 4.98 2.14 99 BOTNET 8519 9.30 23.85 2.10 100 TM2_M_URI_OPT_OUT 8484 2.46 3.20 2.09 101 XM_B_SpammyTLD 7835 2.90 4.85 1.93 102 XM_SPF_SoftFail 7471 2.56 4.01 1.84 103 TooManyTo_002 7466 1.46 0.69 1.84 104 FROM_EXCESS_BASE64 7409 1.86 1.92 1.83 105 HTML_IMAGE_RATIO_08 7307 2.22 3.05 1.80 106 URI_NOVOWEL 7205 2.13 2.85 1.78 107 TR_XM_SB_Phish 6815 1.81 2.07 1.68 108 TVD_RCVD_IP 6692 1.22 0.35 1.65 109 XMSubPhish11 6691 1.74 1.92 1.65 110 INVALID_MSGID 6682 1.17 0.19 1.65 111 MSGID_NOFQDN1 6201 1.05 0.09 1.53 112 TO_MALFORMED 6038 1.01 0.05 1.49 113 IN_HORDE_ADDRESS_BOOK 6006 1.05 0.18 1.48 114 XM_CamelCaseFrm001 5908 2.36 4.19 1.46 115 RCVD_IN_IADB_OPTIN 5834 1.17 0.64 1.44 116 HELO_NODOT 5741 1.57 1.89 1.42 117 HELO_NO_DOMAIN 5735 1.57 1.88 1.41 118 TR_Symld_Words 5503 1.27 1.09 1.36 119 T_XMDrugObfuBody_14 5486 1.95 3.17 1.35 120 XM_DK_Undo_01 5392 1.77 2.66 1.33 121 XM_GoogleGroups 5288 2.07 3.63 1.30 122 TR_XM_SpammyRelay 5248 5.17 13.01 1.29 123 XM_B_Phish66 5213 1.85 3.00 1.29 124 SUBJ_ALL_CAPS 5051 1.41 1.73 1.25 125 TooManyTo_003 4938 1.00 0.56 1.22 126 TR_XM_SpammyWords5 4884 2.02 3.68 1.20 127 TR_DCC_Bayes_99 4878 7.93 21.55 1.20 128 XM_E_Blogspot 4758 0.85 0.19 1.17 129 XM_B_Unsub2 4725 1.65 2.63 1.17 130 XMGappySubj_01 4631 0.83 0.19 1.14 131 XM_B_Investor 4596 2.17 4.27 1.13 132 KHOP_HELO_FCRDNS 4511 1.15 1.24 1.11 133 SHORTENED_URL_HREF 4507 0.77 0.07 1.11 134 T_XMDrugObfuBody_08 4425 2.13 4.24 1.09 135 RELAYCOUNTRY_CA 4357 3.68 8.94 1.07 136 UNTRUSTED_Relay 4332 3.39 8.09 1.07 137 XMBSHREFv2 4189 0.78 0.26 1.03 138 URI_HEX 4189 1.26 1.71 1.03 139 XMBody_95 4144 0.76 0.24 1.02 140 XMCapTrack 4142 0.80 0.36 1.02 141 TM2_M_VERY_LONG_WORD 3927 2.41 5.32 0.97 142 NO_DNS_FOR_FROM 3803 4.26 10.97 0.94 143 T_FILL_THIS_FORM_SHORT 3638 1.87 3.84 0.90 144 XM_OfRef6 3471 1.72 3.45 0.86 145 TooManyTo_004 3423 0.72 0.47 0.84 146 XM_H_Long_From02 3413 0.98 1.25 0.84 147 XMStockSpam_06 3313 1.14 1.80 0.82 148 DKIM_ADSP_CUSTOM_MED 3081 0.80 0.89 0.76 149 T_XMDrugObfuBody_00 3077 1.02 1.55 0.76 150 XMLngstWrd_00 3071 1.70 3.62 0.76 151 RCVD_IN_MSPIKE_H5 3062 0.56 0.17 0.76 152 RCVD_IN_RP_SAFE 2976 0.70 0.62 0.73 153 TooManyTo_005 2779 0.58 0.36 0.69 154 XMLngstWrd_01 2753 1.63 3.54 0.68 155 TVD_SPACE_RATIO 2738 0.50 0.16 0.68 156 XM_ProductURIs 2735 0.71 0.80 0.67 157 HTTPS_HTTP_MISMATCH 2717 1.06 1.85 0.67 158 T_TooManySym_03 2702 0.52 0.23 0.67 159 XMHTML_After_End 2635 0.85 1.26 0.65 160 TR_XM_MaxWHORU 2625 3.73 9.96 0.65 161 XMBrknScrpt_02 2610 0.86 1.29 0.64 162 XMGenDplmaNmb 2606 1.01 1.74 0.64 163 BOTNET_NORDNS 2596 5.44 15.14 0.64 164 RCVD_IN_RP_CERTIFIED 2589 0.59 0.49 0.64 165 SpammyFromTLD_01 2564 1.33 2.74 0.63 166 TR_XM_SpammyWords2 2551 4.14 11.25 0.63 167 XM_UB50 2518 1.74 4.02 0.62 168 TR_MetaPhish_Combo_01 2431 0.63 0.69 0.60 169 XMLngstWrd_02 2330 1.53 3.46 0.57 170 TR_XM_Base64_M1 2299 0.68 0.92 0.57 171 HTML_TAG_BALANCE_BODY 2289 0.72 1.03 0.56 172 T_OBFU_PDF_ATTACH 2234 0.43 0.17 0.55 173 XMBdyGiftCard01 2214 0.75 1.16 0.55 174 FROM_GOV_DKIM_AU 2150 0.47 0.36 0.53 175 XM_H_PHPMailer 2144 0.55 0.59 0.53 176 XM_B_COPY_HTML 2128 0.63 0.85 0.52 177 XM_ShortIntro_01 2067 0.79 1.35 0.51 178 HTML_IMAGE_ONLY_20 2062 0.58 0.74 0.51 179 NML_ADSP_CUSTOM_MED 2054 0.58 0.72 0.51 180 XMPhish30 1990 0.71 1.16 0.49 181 MY_SERVERS_FOUND 1942 0.62 0.92 0.48 182 XMLngstWrd_03 1935 1.38 3.22 0.48 183 T_XMHurry_00 1864 0.66 1.06 0.46 184 XMDateMe_00 1788 0.40 0.32 0.44 185 SpammyFromTLD_02 1786 1.38 3.28 0.44 186 RELAYCOUNTRY_GB 1773 0.58 0.88 0.44 187 TO_NO_BRKTS_HTML_ONLY 1767 0.33 0.12 0.44 188 DOS_RCVD_IP_TWICE_B 1755 0.87 1.76 0.43 189 XMNoVowels 1733 0.44 0.46 0.43 190 XMSubMetaI_00 1719 0.52 0.72 0.42 191 MPART_ALT_DIFF_COUNT 1717 0.74 1.38 0.42 192 XM_B_SpammyWords4 1714 1.02 2.22 0.42 193 SHORT_HELO_AND_INLINE_IMAGE 1684 0.33 0.16 0.42 194 XMBody_17 1665 1.65 4.14 0.41 195 XMMoneyMeta_00 1661 0.54 0.79 0.41 196 URI_TRY_3LD 1648 0.57 0.90 0.41 197 XM_B_COVIDMETA 1646 0.83 1.70 0.41 198 T_Symld_Words_02 1637 0.58 0.93 0.40 199 XMLngstWrd_04 1622 1.30 3.12 0.40 200 XMSexyCombo_01 1621 0.75 1.47 0.40 ----------------------------------------------------------------------