Email: 592468 Autolearn: 0 AvgScore: 3.43 AvgScanTime: 1.31 sec Spam: 194756 Autolearn: 0 AvgScore: 16.85 AvgScanTime: 1.44 sec Ham: 397712 Autolearn: 0 AvgScore: -3.14 AvgScanTime: 1.24 sec Time Spent Running SA: 215.07 hours Time Spent Processing Spam: 77.63 hours Time Spent Processing Ham: 137.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 186250 90.80 95.63 88.44 2 XM_B_Unicode 163800 76.92 84.11 73.40 3 DKIM_SIGNED 156188 68.88 80.20 63.34 4 XM_DK_Pass 152400 66.97 78.25 61.44 5 DKIM_VALID 151008 66.14 77.54 60.56 6 RELAYCOUNTRY_US 141376 79.13 72.59 82.33 7 DCC_CHECK 138104 42.66 70.91 28.83 8 XM_B_SpammyWords 128975 50.34 66.22 42.55 9 XMListUnsubscribeExists 121937 48.49 62.61 41.58 10 DKIM_VALID_AU 115177 51.87 59.14 48.31 11 XM_B_Unicode3 89059 44.77 45.73 44.30 12 RCVD_IN_MSPIKE_H2 85623 37.65 43.96 34.55 13 BAYES_50 79959 49.36 41.06 53.42 14 MIME_HTML_ONLY 76479 28.11 39.27 22.65 15 XM_DK_Undo_02 73912 16.19 37.95 5.54 16 XM_B_SpammyWords2 70685 22.73 36.29 16.08 17 HTML_FONT_LOW_CONTRAST 68463 27.89 35.15 24.34 18 DKIM_VALID_EF 64188 26.62 32.96 23.52 19 LOC_TINY_FONT_1 62376 23.56 32.03 19.41 20 TR_XM_DKIM_Undo 61746 13.22 31.70 4.16 21 BAYES_99 61672 13.34 31.67 4.37 22 RELAYCOUNTRY_META 57107 11.77 29.32 3.17 23 DCC_CHECK_NEGATIVE 56615 57.30 29.07 71.13 24 FVGT_m_MULTI_ODD 56190 24.37 28.85 22.18 25 T_KAM_HTML_FONT_INVALID 54142 19.93 27.80 16.08 26 BAYES_999 48241 10.51 24.77 3.53 27 TR_DCC_Bayes_99 44323 8.58 22.76 1.64 28 XMSubLong 42643 22.36 21.90 22.59 29 XM_Body_Dirty_Words 39585 13.00 20.33 9.41 30 BOTNET 36626 7.13 18.81 1.42 31 T_TM2_M_HEADER_IN_MSG 35808 23.16 18.39 25.50 32 TR_XM_SpammyRelay 31951 6.35 16.41 1.43 33 FSL_BULK_SIG 31250 7.07 16.05 2.68 34 UNTRUSTED_Relay 30955 5.99 15.89 1.14 35 XM_B_Unsub 30768 10.10 15.80 7.32 36 TR_XM_BayesUnsub 29941 8.83 15.37 5.63 37 XM_Multi_Part_URI 29713 11.95 15.26 10.34 38 LOTS_OF_MONEY 26682 8.56 13.70 6.04 39 RCVD_IN_MSPIKE_WL 24765 14.12 12.72 14.81 40 BOTNET_IPINHOSTNAME 24480 7.04 12.57 4.33 41 UNPARSEABLE_RELAY 24002 8.17 12.32 6.14 42 TR_XM_UnparsRelay 23646 7.13 12.14 4.67 43 TR_XM_SpammyWords4 23083 6.35 11.85 3.65 44 RCVD_IN_BL_SPAMCOP_NET 22166 3.98 11.38 0.35 45 XM_B_SpammyWords3 21599 6.13 11.09 3.70 46 XMSexyCombo_05 20554 5.32 10.55 2.76 47 RCVD_IN_MSPIKE_H3 20181 10.03 10.36 9.86 48 RCVD_IN_VALIDITY_RPBL 19858 3.37 10.20 0.03 49 TR_XM_SpammyWords2 19726 4.06 10.13 1.08 50 XM_UncommonTLD01 18941 5.36 9.73 3.23 51 XM_SPF_SoftFail 18650 4.47 9.58 1.96 52 XM_H_Long_From01 18263 6.32 9.38 4.82 53 BAYES_80 17966 5.55 9.22 3.76 54 RELAYCOUNTRY_CA 17954 3.62 9.22 0.87 55 BAYES_60 16688 8.09 8.57 7.85 56 XM_Evil_Numbers_Gen 16352 8.52 8.40 8.58 57 T_REMOTE_IMAGE 14735 4.86 7.57 3.53 58 XM_UB50 14291 2.93 7.34 0.78 59 MPART_ALT_DIFF 13838 9.58 7.11 10.80 60 XM_CamelCaseFrm001 13487 3.37 6.93 1.63 61 TR_XM_SPAMCOP 13139 2.31 6.75 0.14 62 TR_XM_PhishingBody 12466 3.73 6.40 2.43 63 LotsOfNums_01 12253 7.03 6.29 7.39 64 XMSubMetaSx_00 12070 4.07 6.20 3.03 65 RCVD_IN_MSPIKE_BL 12018 2.21 6.17 0.27 66 XM_B_Phish_Phrases 11155 4.08 5.73 3.28 67 TR_XM_MSPIKECOMBO 11097 2.05 5.70 0.27 68 TR_XM_InvalidRelay 11088 1.88 5.69 0.02 69 RELAYCOUNTRY_NG 10771 1.82 5.53 0.00 70 BAYES_95 10587 3.42 5.44 2.43 71 RELAYCOUNTRY_JP 10195 1.74 5.23 0.03 72 XM_SendGrid 10068 4.19 5.17 3.71 73 BOTNET_NORDNS 9954 1.69 5.11 0.01 74 HTML_IMAGE_RATIO_02 9930 4.54 5.10 4.27 75 HTML_IMAGE_ONLY_24 9868 1.87 5.07 0.30 76 HTTP_EXCESSIVE_ESCAPES 9654 1.64 4.96 0.01 77 URIBL_DBL_SPAM 9097 1.54 4.67 0.01 78 PDS_FROM_NAME_TO_DOMAIN 8876 1.50 4.56 0.00 79 PDS_FRNOM_TODOM_NAKED_TO 8875 1.50 4.56 0.00 80 XM_B_SpammyTLD 8807 2.78 4.52 1.93 81 TR_XM_SpoofStaff 8798 1.54 4.52 0.08 82 XMSpoofStaff2 8766 1.53 4.50 0.08 83 XM_B_Investor 8549 2.29 4.39 1.26 84 MIME_HTML_MOSTLY 8519 3.10 4.37 2.48 85 TR_XM_SpoofStaff2 8510 1.44 4.37 0.00 86 XM_NONUS_MSG 8426 1.42 4.33 0.00 87 XM_B_COPY_HTML 8253 1.79 4.24 0.59 88 XMStrtUSub 7972 9.17 4.09 11.66 89 TooManyTo_001 7903 6.21 4.06 7.26 90 HTML_IMAGE_RATIO_04 7842 12.91 4.03 17.25 91 NORDNS_LOW_CONTRAST 7699 1.32 3.95 0.02 92 T_XMDrugObfuBody_08 7697 2.13 3.95 1.24 93 T_XMDrugObfuBody_14 7401 2.18 3.80 1.38 94 XM_DIRTYINTL 7379 1.45 3.79 0.30 95 XM_OfRef6 7185 1.87 3.69 0.98 96 XMNumbers 7136 3.44 3.66 3.33 97 TR_XM_SpammyWords5 7027 1.96 3.61 1.16 98 RCVD_IN_PSBL 6909 1.36 3.55 0.29 99 MIME_HTML_ONLY_MULTI 6878 7.16 3.53 8.94 100 XMBody_17 6802 1.48 3.49 0.49 101 XM_H_SpoofStaff4 6493 1.16 3.33 0.10 102 TR_XM_PSC1 6475 1.15 3.32 0.08 103 TR_MetaPhish_Combo_01 6468 1.52 3.32 0.64 104 TR_XM_SpammyWords3 6459 1.18 3.32 0.13 105 TR_XM_DK_SendGrid 6318 2.72 3.24 2.47 106 HTML_IMAGE_RATIO_06 6119 5.02 3.14 5.94 107 MIME_QP_LONG_LINE 5906 4.09 3.03 4.60 108 XM_UB99 5824 0.98 2.99 0.00 109 T_FILL_THIS_FORM_SHORT 5786 1.45 2.97 0.71 110 XMDiploma_00 5765 1.82 2.96 1.26 111 URI_NOVOWEL 5585 2.24 2.87 1.93 112 RCVD_IN_MSPIKE_L5 5580 0.95 2.87 0.02 113 RCVD_IN_VALIDITY_SAFE 5544 3.85 2.85 4.34 114 XM_B_Phish66 5432 1.85 2.79 1.39 115 HTML_IMAGE_RATIO_08 5416 2.35 2.78 2.14 116 TR_XM_NoHeaderRelay 5319 0.97 2.73 0.10 117 SpammyFromTLD_01 5314 1.32 2.73 0.64 118 TM2_M_VERY_LONG_WORD 5238 1.62 2.69 1.10 119 XM_DK_Undo_01 5212 1.78 2.68 1.34 120 MIME_BASE64_TEXT 5199 0.96 2.67 0.12 121 DKIM_INVALID 5180 2.74 2.66 2.78 122 RCVD_IN_MSPIKE_L3 5052 1.02 2.59 0.25 123 TM2_M_URI_OPT_OUT 4866 2.15 2.50 1.98 124 SpammyFromTLD_02 4549 1.03 2.34 0.39 125 XM_UB999 4499 0.76 2.31 0.00 126 XM_B_Unsub2 4473 1.61 2.30 1.27 127 PDS_OTHER_BAD_TLD 4434 0.99 2.28 0.36 128 XM_B_SpammyWords4 4357 1.10 2.24 0.55 129 XM_H_Undi_Recip 4336 0.90 2.23 0.25 130 T_TooManySym_01 4327 4.57 2.22 5.72 131 HK_RANDOM_REPLYTO 4294 0.78 2.20 0.08 132 XM_UB60 4242 0.76 2.18 0.06 133 RCVD_IN_MSPIKE_H4 4216 3.51 2.16 4.17 134 TR_LOTS_OF_MONEY3 4197 0.90 2.16 0.29 135 TR_XM_SB_Phish 4185 2.14 2.15 2.13 136 RCVD_IN_VALIDITY_CERTIFIED 4170 3.31 2.14 3.88 137 TVD_RCVD_SPACE_BRACKET 4131 0.70 2.12 0.00 138 HTML_MIME_NO_HTML_TAG 4071 2.04 2.09 2.02 139 XMPhish30 4068 1.04 2.09 0.53 140 TR_XM_MSPIKECOMBO2 4020 0.69 2.06 0.01 141 XMSubPhish11 4018 2.10 2.06 2.11 142 FONT_INVIS_LONG_LINE 3934 0.70 2.02 0.05 143 USER_IN_DEF_DKIM_WL 3841 7.79 1.97 10.64 144 RCVD_IN_RP_RNBL 3834 0.65 1.97 0.01 145 FROM_EXCESS_BASE64 3826 1.88 1.96 1.84 146 XMBrknScrpt_02 3743 1.12 1.92 0.73 147 XM_URI_RBL 3547 0.70 1.82 0.15 148 RCVD_IN_IADB_LISTED 3514 3.35 1.80 4.11 149 SUBJ_ALL_CAPS 3509 1.46 1.80 1.29 150 RELAYCOUNTRY_IN 3401 0.62 1.75 0.06 151 XMStockSpam_06 3315 1.18 1.70 0.93 152 MPART_ALT_DIFF_COUNT 3283 0.89 1.69 0.50 153 BAYES_40 3224 4.12 1.66 5.32 154 XM_UB80 3211 0.55 1.65 0.01 155 MAILING_LIST_MULTI 3173 2.14 1.63 2.39 156 XM_B_COVIDMETA 3135 0.82 1.61 0.43 157 RCVD_IN_IADB_SPF 3122 2.99 1.60 3.67 158 T_XMHurry_00 3105 0.88 1.59 0.53 159 RELAYCOUNTRY_CN 3086 0.56 1.58 0.06 160 XM_H_Long_From02 3021 1.11 1.55 0.89 161 RCVD_IN_IADB_DK 3004 2.69 1.54 3.26 162 XMSexyCombo_01 2993 0.75 1.54 0.36 163 KHOP_HELO_FCRDNS 2981 1.28 1.53 1.16 164 RCVD_IN_IADB_SENDERID 2927 2.74 1.50 3.34 165 ALL_TRUSTED 2881 10.74 1.48 15.28 166 XMGenDplmaNmb 2742 0.99 1.41 0.78 167 HTTPS_HTTP_MISMATCH 2690 1.00 1.38 0.82 168 XMReplyNow 2666 0.63 1.37 0.27 169 XM_Combo_Sbj 2658 0.59 1.36 0.21 170 URI_TRY_3LD 2628 0.80 1.35 0.53 171 RELAYCOUNTRY_RU 2561 0.46 1.31 0.05 172 TR_XM_Base64_M1 2508 0.99 1.29 0.85 173 XMLngstWrd_00 2465 0.96 1.27 0.82 174 XMBdyGiftCard01 2462 0.87 1.26 0.67 175 TR_XM_PHPDW 2426 0.64 1.25 0.34 176 XM_GoogleGroups 2419 1.32 1.24 1.36 177 TR_XM_FormFill 2398 0.42 1.23 0.02 178 URI_HEX 2397 1.16 1.23 1.12 179 XMLngstWrd_01 2391 0.90 1.23 0.73 180 TR_XM_PHPForged 2336 0.61 1.20 0.32 181 RELAYCOUNTRY_NL 2334 0.45 1.20 0.09 182 MultiRelay_CC 2322 0.40 1.19 0.00 183 XMHTML_After_End 2290 0.88 1.18 0.73 184 TR_XM_FormFill2 2290 0.60 1.18 0.31 185 T_XMDrugObfuBody_00 2279 0.75 1.17 0.54 186 XM_H_PHPOS 2272 0.59 1.17 0.31 187 XMCapTrack2 2267 0.40 1.16 0.03 188 TR_Symld_Words 2220 1.41 1.14 1.55 189 XMLngstWrd_02 2202 0.77 1.13 0.60 190 BAYES_20 2202 3.95 1.13 5.32 191 DKIM_ADSP_CUSTOM_MED 2194 0.91 1.13 0.80 192 URIBL_BLACK 2185 0.40 1.12 0.04 193 RELAYCOUNTRY_AU 2137 0.54 1.10 0.27 194 HTML_TAG_BALANCE_BODY 2116 0.77 1.09 0.61 195 TR_XM_BayesRelay 2059 0.35 1.06 0.00 196 RELAYCOUNTRY_FR 2041 0.48 1.05 0.21 197 RELAYCOUNTRY_GB 1980 0.68 1.02 0.52 198 TR_XM_MaxSPIKE 1956 0.34 1.00 0.01 199 ANY_BOUNCE_MESSAGE 1950 2.31 1.00 2.96 200 FORGED_GMAIL_RCVD 1949 0.63 1.00 0.46 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 351739 90.80 95.63 88.44 2 RELAYCOUNTRY_US 327444 79.13 72.59 82.33 3 XM_B_Unicode 291934 76.92 84.11 73.40 4 DCC_CHECK_NEGATIVE 282883 57.30 29.07 71.13 5 DKIM_SIGNED 251908 68.88 80.20 63.34 6 XM_DK_Pass 244372 66.97 78.25 61.44 7 DKIM_VALID 240865 66.14 77.54 60.56 8 BAYES_50 212455 49.36 41.06 53.42 9 DKIM_VALID_AU 192133 51.87 59.14 48.31 10 XM_B_Unicode3 176191 44.77 45.73 44.30 11 XM_B_SpammyWords 169245 50.34 66.22 42.55 12 XMListUnsubscribeExists 165349 48.49 62.61 41.58 13 RCVD_IN_MSPIKE_H2 137421 37.65 43.96 34.55 14 DCC_CHECK 114661 42.66 70.91 28.83 15 T_TM2_M_HEADER_IN_MSG 101435 23.16 18.39 25.50 16 HTML_FONT_LOW_CONTRAST 96802 27.89 35.15 24.34 17 DKIM_VALID_EF 93538 26.62 32.96 23.52 18 MIME_HTML_ONLY 90080 28.11 39.27 22.65 19 XMSubLong 89837 22.36 21.90 22.59 20 FVGT_m_MULTI_ODD 88209 24.37 28.85 22.18 21 LOC_TINY_FONT_1 77180 23.56 32.03 19.41 22 HTML_IMAGE_RATIO_04 68617 12.91 4.03 17.25 23 HTML_FONT_FACE_BAD 66718 11.51 0.75 16.78 24 XM_B_SpammyWords2 63967 22.73 36.29 16.08 25 T_KAM_HTML_FONT_INVALID 63955 19.93 27.80 16.08 26 XM_H_Trusted_IP 63305 10.68 0.00 15.92 27 ALL_TRUSTED 60759 10.74 1.48 15.28 28 RCVD_IN_MSPIKE_WL 58896 14.12 12.72 14.81 29 BAYES_00 54322 9.40 0.69 13.66 30 XMStrtUSub 46381 9.17 4.09 11.66 31 MPART_ALT_DIFF 42934 9.58 7.11 10.80 32 USER_IN_DEF_DKIM_WL 42329 7.79 1.97 10.64 33 XM_Multi_Part_URI 41111 11.95 15.26 10.34 34 RCVD_IN_MSPIKE_H3 39226 10.03 10.36 9.86 35 XM_Body_Dirty_Words 37426 13.00 20.33 9.41 36 MIME_HTML_ONLY_MULTI 35539 7.16 3.53 8.94 37 XM_Evil_Numbers_Gen 34137 8.52 8.40 8.58 38 BAYES_60 31219 8.09 8.57 7.85 39 XM_DKIMWhitelistDomains 29508 5.08 0.29 7.42 40 LotsOfNums_01 29397 7.03 6.29 7.39 41 XM_B_Unsub 29099 10.10 15.80 7.32 42 TooManyTo_001 28860 6.21 4.06 7.26 43 UNPARSEABLE_RELAY 24421 8.17 12.32 6.14 44 LOTS_OF_MONEY 24032 8.56 13.70 6.04 45 HTML_IMAGE_RATIO_06 23626 5.02 3.14 5.94 46 IN_ZIMBRA_NJ_WHITELIST 23042 3.92 0.09 5.79 47 T_TooManySym_01 22737 4.57 2.22 5.72 48 XMSubNoVowel 22540 4.08 0.85 5.67 49 TR_XM_BayesUnsub 22388 8.83 15.37 5.63 50 XM_DK_Undo_02 22018 16.19 37.95 5.54 51 BAYES_40 21176 4.12 1.66 5.32 52 BAYES_20 21173 3.95 1.13 5.32 53 TR_XM_DK_Bayes 20951 3.70 0.51 5.27 54 TR_XM_DK_Bayes1 20648 3.65 0.50 5.19 55 XM_H_Long_From01 19184 6.32 9.38 4.82 56 TR_XM_UnparsRelay 18593 7.13 12.14 4.67 57 MIME_QP_LONG_LINE 18307 4.09 3.03 4.60 58 TR_XM_DK_Bayes2 18241 3.23 0.46 4.59 59 BAYES_99 17379 13.34 31.67 4.37 60 RCVD_IN_VALIDITY_SAFE 17275 3.85 2.85 4.34 61 BOTNET_IPINHOSTNAME 17219 7.04 12.57 4.33 62 HTML_IMAGE_RATIO_02 16989 4.54 5.10 4.27 63 XM_PDF 16634 3.02 0.64 4.18 64 RCVD_IN_MSPIKE_H4 16598 3.51 2.16 4.17 65 TR_XM_DKIM_Undo 16551 13.22 31.70 4.16 66 RCVD_IN_IADB_LISTED 16337 3.35 1.80 4.11 67 RCVD_IN_VALIDITY_CERTIFIED 15430 3.31 2.14 3.88 68 BAYES_05 15380 2.78 0.57 3.87 69 BAYES_80 14945 5.55 9.22 3.76 70 XM_SendGrid 14775 4.19 5.17 3.71 71 XM_B_SpammyWords3 14703 6.13 11.09 3.70 72 RCVD_IN_IADB_SPF 14614 2.99 1.60 3.67 73 TR_XM_SpammyWords4 14529 6.35 11.85 3.65 74 T_TooManySym_02 14234 2.65 0.76 3.58 75 T_REMOTE_IMAGE 14052 4.86 7.57 3.53 76 BAYES_999 14027 10.51 24.77 3.53 77 RCVD_IN_IADB_SENDERID 13286 2.74 1.50 3.34 78 XMNumbers 13259 3.44 3.66 3.33 79 XM_B_Phish_Phrases 13031 4.08 5.73 3.28 80 RCVD_IN_IADB_DK 12963 2.69 1.54 3.26 81 XM_UncommonTLD01 12839 5.36 9.73 3.23 82 RELAYCOUNTRY_META 12605 11.77 29.32 3.17 83 XMSubMetaSx_00 12044 4.07 6.20 3.03 84 ANY_BOUNCE_MESSAGE 11765 2.31 1.00 2.96 85 BOUNCE_MESSAGE 11763 2.31 1.00 2.96 86 XMSubLongNoVowel 11356 2.03 0.34 2.86 87 XMSubGarbage 11215 2.00 0.33 2.82 88 DKIM_INVALID 11043 2.74 2.66 2.78 89 XMSexyCombo_05 10980 5.32 10.55 2.76 90 FSL_BULK_SIG 10663 7.07 16.05 2.68 91 MIME_HTML_MOSTLY 9869 3.10 4.37 2.48 92 TR_XM_DK_SendGrid 9806 2.72 3.24 2.47 93 BAYES_95 9663 3.42 5.44 2.43 94 TR_XM_PhishingBody 9648 3.73 6.40 2.43 95 RCVD_IN_IADB_VOUCHED 9504 1.88 0.84 2.39 96 MAILING_LIST_MULTI 9501 2.14 1.63 2.39 97 HTML_IMAGE_RATIO_08 8518 2.35 2.78 2.14 98 TR_XM_SB_Phish 8467 2.14 2.15 2.13 99 XMSubPhish11 8396 2.10 2.06 2.11 100 HTML_MIME_NO_HTML_TAG 8014 2.04 2.09 2.02 101 TM2_M_URI_OPT_OUT 7862 2.15 2.50 1.98 102 XM_SPF_SoftFail 7804 4.47 9.58 1.96 103 URI_NOVOWEL 7688 2.24 2.87 1.93 104 XM_B_SpammyTLD 7683 2.78 4.52 1.93 105 TooManyTo_002 7616 1.47 0.55 1.91 106 FROM_EXCESS_BASE64 7335 1.88 1.96 1.84 107 INVALID_MSGID 6784 1.20 0.18 1.71 108 TVD_RCVD_IP 6661 1.26 0.42 1.67 109 TR_DCC_Bayes_99 6530 8.58 22.76 1.64 110 XM_CamelCaseFrm001 6488 3.37 6.93 1.63 111 RCVD_IN_IADB_OPTIN 6444 1.25 0.50 1.62 112 MSGID_NOFQDN1 6318 1.08 0.05 1.59 113 HELO_NODOT 6305 1.25 0.55 1.59 114 HELO_NO_DOMAIN 6294 1.23 0.52 1.58 115 IN_HORDE_ADDRESS_BOOK 6148 1.07 0.09 1.55 116 TR_Symld_Words 6145 1.41 1.14 1.55 117 TO_MALFORMED 5942 1.01 0.01 1.49 118 T_TooManySym_03 5868 1.10 0.32 1.48 119 TVD_SPACE_RATIO 5792 1.02 0.12 1.46 120 TR_XM_SpammyRelay 5682 6.35 16.41 1.43 121 BOTNET 5637 7.13 18.81 1.42 122 XM_B_Phish66 5523 1.85 2.79 1.39 123 T_XMDrugObfuBody_14 5486 2.18 3.80 1.38 124 XM_GoogleGroups 5405 1.32 1.24 1.36 125 XM_DK_Undo_01 5341 1.78 2.68 1.34 126 SUBJ_ALL_CAPS 5132 1.46 1.80 1.29 127 XM_B_Unsub2 5063 1.61 2.30 1.27 128 XM_B_Investor 5029 2.29 4.39 1.26 129 XMDiploma_00 5020 1.82 2.96 1.26 130 TooManyTo_003 4958 0.98 0.45 1.25 131 T_XMDrugObfuBody_08 4944 2.13 3.95 1.24 132 XMGappySubj_01 4845 0.85 0.09 1.22 133 XM_E_Blogspot 4717 0.91 0.34 1.19 134 KHOP_HELO_FCRDNS 4610 1.28 1.53 1.16 135 TR_XM_SpammyWords5 4597 1.96 3.61 1.16 136 UNTRUSTED_Relay 4537 5.99 15.89 1.14 137 URI_HEX 4465 1.16 1.23 1.12 138 TM2_M_VERY_LONG_WORD 4367 1.62 2.69 1.10 139 TR_XM_SpammyWords2 4304 4.06 10.13 1.08 140 XMCapTrack 4289 0.84 0.34 1.08 141 XMBSHREFv2 4203 0.79 0.26 1.06 142 XM_OfRef6 3881 1.87 3.69 0.98 143 XMStockSpam_06 3680 1.18 1.70 0.93 144 XM_H_Long_From02 3547 1.11 1.55 0.89 145 TooManyTo_004 3502 0.72 0.39 0.88 146 RELAYCOUNTRY_CA 3467 3.62 9.22 0.87 147 TR_XM_Base64_M1 3380 0.99 1.29 0.85 148 RCVD_IN_RP_SAFE 3255 0.76 0.64 0.82 149 HTTPS_HTTP_MISMATCH 3253 1.00 1.38 0.82 150 XMLngstWrd_00 3249 0.96 1.27 0.82 151 DKIM_ADSP_CUSTOM_MED 3185 0.91 1.13 0.80 152 XMGenDplmaNmb 3109 0.99 1.41 0.78 153 XM_UB50 3089 2.93 7.34 0.78 154 RCVD_IN_MSPIKE_H5 3072 0.58 0.19 0.77 155 FVGT_m_MULTI_ODD_EMAIL 3014 0.57 0.17 0.76 156 RCVD_IN_RP_CERTIFIED 2923 0.66 0.51 0.73 157 XMHTML_After_End 2923 0.88 1.18 0.73 158 XMLngstWrd_01 2914 0.90 1.23 0.73 159 XMBrknScrpt_02 2911 1.12 1.92 0.73 160 XMBody_95 2895 0.56 0.22 0.73 161 TooManyTo_005 2849 0.59 0.32 0.72 162 T_FILL_THIS_FORM_SHORT 2816 1.45 2.97 0.71 163 XMBdyGiftCard01 2674 0.87 1.26 0.67 164 TR_MetaPhish_Combo_01 2561 1.52 3.32 0.64 165 SpammyFromTLD_01 2536 1.32 2.73 0.64 166 HTML_TAG_BALANCE_BODY 2434 0.77 1.09 0.61 167 XMLngstWrd_02 2369 0.77 1.13 0.60 168 XM_B_COPY_HTML 2340 1.79 4.24 0.59 169 XM_RXBody 2300 0.63 0.74 0.58 170 FROM_GOV_DKIM_AU 2207 0.46 0.27 0.55 171 XM_B_SpammyWords4 2187 1.10 2.24 0.55 172 XM_ShortIntro_01 2178 0.47 0.32 0.55 173 XM_Body_Obfu01 2161 0.59 0.68 0.54 174 T_XMDrugObfuBody_00 2146 0.75 1.17 0.54 175 T_XMHurry_00 2106 0.88 1.59 0.53 176 XM_H_PHPMailer 2102 0.57 0.66 0.53 177 NML_ADSP_CUSTOM_MED 2101 0.65 0.89 0.53 178 URI_TRY_3LD 2101 0.80 1.35 0.53 179 XMPhish30 2095 1.04 2.09 0.53 180 RELAYCOUNTRY_GB 2075 0.68 1.02 0.52 181 XMLngstWrd_03 2014 0.63 0.87 0.51 182 T_OBFU_PDF_ATTACH 1990 0.37 0.12 0.50 183 MPART_ALT_DIFF_COUNT 1986 0.89 1.69 0.50 184 HTML_IMAGE_ONLY_20 1981 0.50 0.49 0.50 185 XMBody_17 1938 1.48 3.49 0.49 186 XMNoVowels 1922 0.46 0.41 0.48 187 SHORT_HELO_AND_INLINE_IMAGE 1905 0.35 0.08 0.48 188 MY_SERVERS_FOUND 1840 0.36 0.16 0.46 189 XM_ProductURIs 1832 0.57 0.80 0.46 190 T_Symld_Words_02 1826 0.53 0.66 0.46 191 FORGED_GMAIL_RCVD 1812 0.63 1.00 0.46 192 XMLngstWrd_04 1734 0.56 0.81 0.44 193 XMSubMetaSxObfu_02 1707 0.49 0.60 0.43 194 XMMoneyMeta_00 1704 0.51 0.67 0.43 195 XM_B_COVIDMETA 1699 0.82 1.61 0.43 196 BASE64_LENGTH_79_INF 1666 0.35 0.20 0.42 197 MISSING_HEADERS 1652 0.39 0.34 0.42 198 XM_B_DNDMA 1601 0.56 0.89 0.40 199 HTML_IMAGE_ONLY_28 1569 0.38 0.34 0.39 200 SpammyFromTLD_02 1549 1.03 2.34 0.39 ----------------------------------------------------------------------