Email: 515376 Autolearn: 0 AvgScore: 5.05 AvgScanTime: 1.50 sec Spam: 182880 Autolearn: 0 AvgScore: 15.94 AvgScanTime: 1.66 sec Ham: 332496 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 1.42 sec Time Spent Running SA: 215.15 hours Time Spent Processing Spam: 84.38 hours Time Spent Processing Ham: 130.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176783 89.76 96.67 85.96 2 XM_B_Unicode 158587 76.25 86.72 70.50 3 DKIM_SIGNED 153817 78.20 84.11 74.95 4 XM_DK_Pass 150826 76.19 82.47 72.74 5 DKIM_VALID 148379 75.13 81.13 71.82 6 RELAYCOUNTRY_US 137522 78.81 75.20 80.79 7 DCC_CHECK 133099 48.26 72.78 34.78 8 XM_B_SpammyWords 121491 51.29 66.43 42.97 9 XMListUnsubscribeExists 121074 56.15 66.20 50.61 10 DKIM_VALID_AU 109636 57.31 59.95 55.86 11 XM_B_Unicode3 83543 42.17 45.68 40.23 12 RCVD_IN_MSPIKE_H2 82991 42.95 45.38 41.62 13 XM_DK_Undo_02 75443 19.54 41.25 7.60 14 BAYES_50 74314 51.08 40.64 56.83 15 MIME_HTML_ONLY 67685 26.46 37.01 20.66 16 XM_B_SpammyWords2 66990 24.11 36.63 17.22 17 LOC_TINY_FONT_1 65371 27.97 35.75 23.70 18 HTML_FONT_LOW_CONTRAST 63339 30.27 34.63 27.87 19 DKIM_VALID_EF 62397 29.70 34.12 27.27 20 BAYES_99 62393 16.20 34.12 6.35 21 TR_XM_DKIM_Undo 60296 14.55 32.97 4.42 22 FVGT_m_MULTI_ODD 55711 27.26 30.46 25.50 23 T_KAM_HTML_FONT_INVALID 53174 23.19 29.08 19.95 24 DCC_CHECK_NEGATIVE 49743 51.70 27.20 65.18 25 BAYES_999 49205 12.96 26.91 5.28 26 RELAYCOUNTRY_META 48228 11.75 26.37 3.71 27 TR_DCC_Bayes_99 46225 10.39 25.28 2.20 28 XMSubLong 42765 23.05 23.38 22.87 29 XM_Body_Dirty_Words 40248 15.23 22.01 11.51 30 T_TM2_M_HEADER_IN_MSG 36809 25.79 20.13 28.90 31 XM_Multi_Part_URI 31100 14.87 17.01 13.69 32 LOTS_OF_MONEY 28002 10.58 15.31 7.98 33 XM_B_Unsub 27937 11.09 15.28 8.79 34 TR_XM_BayesUnsub 27274 9.84 14.91 7.05 35 TR_XM_SpammyRelay 27198 6.36 14.87 1.68 36 FSL_BULK_SIG 25822 7.35 14.12 3.63 37 RCVD_IN_BL_SPAMCOP_NET 24655 5.07 13.48 0.45 38 BOTNET_IPINHOSTNAME 24381 8.16 13.33 5.32 39 BOTNET 23983 5.75 13.11 1.70 40 TR_XM_SpammyWords4 23938 7.79 13.09 4.88 41 RCVD_IN_MSPIKE_WL 23550 15.57 12.88 17.05 42 UNPARSEABLE_RELAY 23104 9.70 12.63 8.09 43 XM_B_SpammyWords3 23047 6.71 12.60 3.47 44 UNTRUSTED_Relay 22514 5.25 12.31 1.36 45 TR_XM_UnparsRelay 20331 7.30 11.12 5.20 46 TR_XM_SpammyWords2 20112 4.51 11.00 0.95 47 RCVD_IN_MSPIKE_H3 19498 11.20 10.66 11.49 48 XMSexyCombo_05 19467 6.01 10.64 3.46 49 RELAYCOUNTRY_CA 17760 4.19 9.71 1.16 50 XM_UncommonTLD01 17167 5.80 9.39 3.83 51 XM_H_Long_From01 15842 6.91 8.66 5.94 52 BAYES_80 15556 5.91 8.51 4.48 53 T_REMOTE_IMAGE 14417 5.27 7.88 3.83 54 XM_Evil_Numbers_Gen 14179 7.70 7.75 7.67 55 BAYES_60 13986 8.79 7.65 9.41 56 TR_XM_SPAMCOP 13778 2.84 7.53 0.25 57 XM_CamelCaseFrm001 13514 3.84 7.39 1.88 58 RCVD_IN_MSPIKE_BL 12770 2.81 6.98 0.52 59 LotsOfNums_01 12243 8.45 6.69 9.41 60 TR_XM_MSPIKECOMBO 12170 2.68 6.65 0.49 61 MPART_ALT_DIFF 11826 5.47 6.47 4.93 62 XMSubMetaSx_00 11409 4.80 6.24 4.01 63 HTML_IMAGE_RATIO_02 11288 5.86 6.17 5.69 64 XM_SendGrid 10855 5.43 5.94 5.16 65 XM_SPF_SoftFail 10615 3.59 5.80 2.37 66 XM_UB50 10518 2.61 5.75 0.89 67 RCVD_IN_VALIDITY_RPBL 10394 2.05 5.68 0.06 68 XM_B_Phish_Phrases 10133 4.04 5.54 3.22 69 TR_XM_PhishingBody 10108 4.02 5.53 3.18 70 XM_B_Investor 9735 2.81 5.32 1.43 71 BAYES_95 9510 3.64 5.20 2.78 72 HTML_IMAGE_ONLY_24 9305 2.01 5.09 0.32 73 HTML_IMAGE_RATIO_08 9061 3.25 4.95 2.31 74 HTTP_EXCESSIVE_ESCAPES 9018 1.76 4.93 0.02 75 XM_B_SpammyTLD 8168 3.32 4.47 2.69 76 TR_XM_SpammyWords5 8165 2.64 4.46 1.63 77 XMBody_17 8136 1.89 4.45 0.49 78 T_XMDrugObfuBody_14 8013 2.58 4.38 1.59 79 TooManyTo_001 7933 6.72 4.34 8.03 80 T_XMDrugObfuBody_08 7922 2.39 4.33 1.32 81 HTML_IMAGE_RATIO_04 7918 5.11 4.33 5.54 82 XMStrtUSub 7784 4.18 4.26 4.14 83 MIME_HTML_MOSTLY 7784 3.03 4.26 2.35 84 BOTNET_NORDNS 7518 1.47 4.11 0.01 85 XM_OfRef6 7490 2.23 4.10 1.20 86 TR_XM_DK_SendGrid 7151 3.64 3.91 3.49 87 RCVD_IN_PSBL 7099 1.62 3.88 0.37 88 HTML_IMAGE_RATIO_06 6955 3.55 3.80 3.41 89 XM_DIRTYINTL 6936 1.59 3.79 0.38 90 RCVD_IN_MSPIKE_L5 6772 1.34 3.70 0.05 91 T_FILL_THIS_FORM_SHORT 6555 1.84 3.58 0.87 92 TR_XM_SpammyWords3 6462 1.38 3.53 0.19 93 URIBL_DBL_SPAM 6171 1.21 3.37 0.02 94 SpammyFromTLD_01 6129 1.64 3.35 0.69 95 XMNumbers 6060 3.73 3.31 3.96 96 XM_B_Phish66 5952 2.32 3.25 1.80 97 MIME_QP_LONG_LINE 5907 4.76 3.23 5.59 98 MIME_HTML_ONLY_MULTI 5733 3.15 3.13 3.15 99 HTTPS_HTTP_MISMATCH 5555 1.52 3.04 0.68 100 SUBJ_ALL_CAPS 5474 2.44 2.99 2.14 101 DKIM_INVALID 5438 3.08 2.97 3.13 102 XM_DK_Undo_01 5272 1.96 2.88 1.45 103 RCVD_IN_VALIDITY_SAFE 5266 3.93 2.88 4.51 104 XMDiploma_00 5225 1.92 2.86 1.41 105 XM_UB99 5157 1.00 2.82 0.00 106 XM_B_SpammyWords4 5035 1.35 2.75 0.57 107 RCVD_IN_MSPIKE_L3 4974 1.25 2.72 0.45 108 MIME_BASE64_TEXT 4921 1.05 2.69 0.14 109 FROM_EXCESS_BASE64 4735 2.36 2.59 2.23 110 TR_XM_MSPIKECOMBO2 4731 0.97 2.59 0.08 111 URI_NOVOWEL 4723 2.73 2.58 2.82 112 TM2_M_URI_OPT_OUT 4689 2.34 2.56 2.22 113 TM2_M_VERY_LONG_WORD 4503 1.63 2.46 1.18 114 XM_B_COPY_HTML 4502 1.38 2.46 0.79 115 XM_B_Unsub2 4500 1.72 2.46 1.32 116 HTML_MIME_NO_HTML_TAG 4494 2.37 2.46 2.33 117 RELAYCOUNTRY_BD 4273 0.83 2.34 0.00 118 XM_URI_RBL 4264 0.91 2.33 0.14 119 RCVD_IN_VALIDITY_CERTIFIED 4244 3.42 2.32 4.02 120 T_TooManySym_01 4234 5.10 2.32 6.63 121 SpammyFromTLD_02 4222 1.24 2.31 0.66 122 XM_UB999 4172 0.81 2.28 0.00 123 TR_XM_InvalidRelay 4053 0.80 2.22 0.02 124 URI_WP_HACKED 3998 0.78 2.19 0.00 125 XMSexyCombo_01 3975 1.43 2.17 1.02 126 FONT_INVIS_LONG_LINE 3893 0.81 2.13 0.08 127 TR_LOTS_OF_MONEY3 3817 0.97 2.09 0.36 128 TR_XM_SB_Phish 3783 2.46 2.07 2.68 129 USER_IN_DEF_DKIM_WL 3778 8.71 2.07 12.37 130 TVD_RCVD_SPACE_BRACKET 3768 0.73 2.06 0.01 131 RCVD_IN_MSPIKE_H4 3662 3.53 2.00 4.37 132 RCVD_IN_IADB_LISTED 3630 4.71 1.98 6.21 133 XMSubPhish11 3559 2.40 1.95 2.66 134 TR_XM_FormFill 3554 0.72 1.94 0.05 135 T_XMHurry_00 3498 1.07 1.91 0.61 136 TR_XM_SpoofStaff 3476 0.73 1.90 0.09 137 T_XMDrugObfuBody_00 3449 1.24 1.89 0.89 138 PDS_FRNOM_TODOM_NAKED_TO 3446 0.67 1.88 0.00 139 PDS_FROM_NAME_TO_DOMAIN 3446 0.67 1.88 0.00 140 HK_RANDOM_REPLYTO 3400 0.70 1.86 0.06 141 XMSpoofStaff2 3397 0.72 1.86 0.09 142 XM_H_SpoofStaff4 3377 0.73 1.85 0.11 143 TR_XM_PSC1 3376 0.71 1.85 0.09 144 RELAYCOUNTRY_NG 3350 0.65 1.83 0.00 145 RELAYCOUNTRY_AU 3324 0.83 1.82 0.29 146 XM_B_COVIDMETA 3307 1.12 1.81 0.74 147 TR_XM_SpoofStaff2 3290 0.64 1.80 0.00 148 PDS_OTHER_BAD_TLD 3270 0.80 1.79 0.25 149 XM_NONUS_MSG 3266 0.63 1.79 0.00 150 XMStockSpam_06 3202 1.43 1.75 1.25 151 RELAYCOUNTRY_RU 3191 0.63 1.74 0.02 152 RCVD_IN_IADB_SPF 3179 4.17 1.74 5.51 153 URI_PHP_REDIR 3156 0.61 1.73 0.00 154 MAILING_LIST_MULTI 3156 2.42 1.73 2.80 155 RCVD_IN_IADB_DK 3053 3.68 1.67 4.79 156 TR_XM_NoHeaderRelay 3009 0.66 1.65 0.12 157 RELAYCOUNTRY_CN 3006 0.68 1.64 0.14 158 RCVD_IN_IADB_SENDERID 3003 3.78 1.64 4.96 159 XMBrknScrpt_02 2999 1.05 1.64 0.73 160 ALL_TRUSTED 2835 11.02 1.55 16.23 161 MPART_ALT_DIFF_COUNT 2756 0.86 1.51 0.51 162 BAYES_40 2737 3.54 1.50 4.66 163 XM_UB60 2734 0.60 1.49 0.11 164 TO_NO_BRKTS_HTML_IMG 2627 0.53 1.44 0.03 165 TR_XM_PHPDW 2617 0.80 1.43 0.45 166 URI_HEX 2554 1.42 1.40 1.44 167 XMSpoofStaff 2507 0.50 1.37 0.02 168 TR_XM_BayesRelay 2486 0.48 1.36 0.00 169 RELAYCOUNTRY_IN 2479 0.53 1.36 0.08 170 TR_XM_PHPForged 2478 0.74 1.35 0.40 171 TR_XM_FormFill2 2443 0.73 1.34 0.40 172 XM_H_PHPOS 2433 0.73 1.33 0.40 173 TR_XM_Base64_M1 2411 0.99 1.32 0.81 174 XM_ProductURIs 2398 0.78 1.31 0.49 175 RELAYCOUNTRY_FR 2358 0.60 1.29 0.22 176 XM_H_Long_From02 2352 1.08 1.29 0.96 177 TR_Symld_Words 2343 1.64 1.28 1.84 178 XMReplyNow 2332 0.59 1.28 0.21 179 TR_XM_MaxSPIKE 2328 0.50 1.27 0.08 180 HTML_FONT_FACE_BAD 2280 1.67 1.25 1.90 181 XMBdyGiftCard01 2200 0.99 1.20 0.87 182 URI_PHISH 2151 0.43 1.18 0.02 183 XM_H_Undi_Recip 2140 0.57 1.17 0.24 184 XMGenDplmaNmb 2121 0.94 1.16 0.82 185 LONGLN_LOW_CONTRAST 2108 0.66 1.15 0.39 186 MultiRelay_CC 2103 0.41 1.15 0.00 187 TR_XM_COVIDMETA4 2081 0.50 1.14 0.14 188 KHOP_HELO_FCRDNS 2064 1.38 1.13 1.52 189 RCVD_IN_RP_RNBL 2049 0.40 1.12 0.01 190 XM_UB80 2011 0.41 1.10 0.03 191 XMHTML_After_End 2008 0.93 1.10 0.84 192 HTML_TAG_BALANCE_BODY 1978 0.83 1.08 0.68 193 URIBL_BLACK 1962 0.41 1.07 0.05 194 TR_XM_COVIDMETA1 1950 0.48 1.07 0.16 195 BAYES_20 1936 2.54 1.06 3.36 196 RELAYCOUNTRY_GB 1916 0.72 1.05 0.54 197 XMSubMetaSxObfu_03 1896 0.63 1.04 0.40 198 XMSexyCombo_04 1880 0.77 1.03 0.63 199 XMPhish30 1878 0.82 1.03 0.70 200 URI_TRY_3LD 1841 0.74 1.01 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 285820 89.76 96.67 85.96 2 RELAYCOUNTRY_US 268636 78.81 75.20 80.79 3 DKIM_SIGNED 249209 78.20 84.11 74.95 4 XM_DK_Pass 241847 76.19 82.47 72.74 5 DKIM_VALID 238799 75.13 81.13 71.82 6 XM_B_Unicode 234406 76.25 86.72 70.50 7 DCC_CHECK_NEGATIVE 216729 51.70 27.20 65.18 8 BAYES_50 188961 51.08 40.64 56.83 9 DKIM_VALID_AU 185740 57.31 59.95 55.86 10 XMListUnsubscribeExists 168289 56.15 66.20 50.61 11 XM_B_SpammyWords 142866 51.29 66.43 42.97 12 RCVD_IN_MSPIKE_H2 138373 42.95 45.38 41.62 13 XM_B_Unicode3 133775 42.17 45.68 40.23 14 DCC_CHECK 115643 48.26 72.78 34.78 15 T_TM2_M_HEADER_IN_MSG 96089 25.79 20.13 28.90 16 HTML_FONT_LOW_CONTRAST 92665 30.27 34.63 27.87 17 DKIM_VALID_EF 90686 29.70 34.12 27.27 18 FVGT_m_MULTI_ODD 84781 27.26 30.46 25.50 19 LOC_TINY_FONT_1 78790 27.97 35.75 23.70 20 XMSubLong 76045 23.05 23.38 22.87 21 MIME_HTML_ONLY 68704 26.46 37.01 20.66 22 T_KAM_HTML_FONT_INVALID 66317 23.19 29.08 19.95 23 XM_B_SpammyWords2 57271 24.11 36.63 17.22 24 RCVD_IN_MSPIKE_WL 56706 15.57 12.88 17.05 25 ALL_TRUSTED 53976 11.02 1.55 16.23 26 XM_Multi_Part_URI 45534 14.87 17.01 13.69 27 USER_IN_DEF_DKIM_WL 41121 8.71 2.07 12.37 28 XM_Body_Dirty_Words 38260 15.23 22.01 11.51 29 RCVD_IN_MSPIKE_H3 38199 11.20 10.66 11.49 30 BAYES_00 33141 6.71 0.79 9.97 31 BAYES_60 31295 8.79 7.65 9.41 32 LotsOfNums_01 31294 8.45 6.69 9.41 33 XM_DKIMWhitelistDomains 30321 5.91 0.09 9.12 34 XM_B_Unsub 29214 11.09 15.28 8.79 35 UNPARSEABLE_RELAY 26906 9.70 12.63 8.09 36 TooManyTo_001 26690 6.72 4.34 8.03 37 LOTS_OF_MONEY 26542 10.58 15.31 7.98 38 XM_Evil_Numbers_Gen 25503 7.70 7.75 7.67 39 XM_DK_Undo_02 25274 19.54 41.25 7.60 40 TR_XM_BayesUnsub 23435 9.84 14.91 7.05 41 IN_ZIMBRA_NJ_WHITELIST 22778 4.45 0.09 6.85 42 T_TooManySym_01 22061 5.10 2.32 6.63 43 BAYES_99 21112 16.20 34.12 6.35 44 RCVD_IN_IADB_LISTED 20661 4.71 1.98 6.21 45 TR_XM_DK_Bayes 19819 4.05 0.57 5.96 46 XM_H_Long_From01 19747 6.91 8.66 5.94 47 TR_XM_DK_Bayes1 19503 3.98 0.56 5.87 48 HTML_IMAGE_RATIO_02 18934 5.86 6.17 5.69 49 MIME_QP_LONG_LINE 18603 4.76 3.23 5.59 50 HTML_IMAGE_RATIO_04 18404 5.11 4.33 5.54 51 RCVD_IN_IADB_SPF 18315 4.17 1.74 5.51 52 BOTNET_IPINHOSTNAME 17698 8.16 13.33 5.32 53 BAYES_999 17570 12.96 26.91 5.28 54 TR_XM_UnparsRelay 17299 7.30 11.12 5.20 55 TR_XM_DK_Bayes2 17258 3.52 0.50 5.19 56 XM_SendGrid 17148 5.43 5.94 5.16 57 XM_PDF 16758 3.45 0.56 5.04 58 RCVD_IN_IADB_SENDERID 16482 3.78 1.64 4.96 59 MPART_ALT_DIFF 16388 5.47 6.47 4.93 60 TR_XM_SpammyWords4 16221 7.79 13.09 4.88 61 RCVD_IN_IADB_DK 15938 3.68 1.67 4.79 62 BAYES_40 15494 3.54 1.50 4.66 63 RCVD_IN_VALIDITY_SAFE 14993 3.93 2.88 4.51 64 BAYES_80 14889 5.91 8.51 4.48 65 TR_XM_DKIM_Undo 14684 14.55 32.97 4.42 66 RCVD_IN_MSPIKE_H4 14538 3.53 2.00 4.37 67 XMStrtUSub 13749 4.18 4.26 4.14 68 T_TooManySym_02 13493 2.84 0.62 4.06 69 RCVD_IN_VALIDITY_CERTIFIED 13370 3.42 2.32 4.02 70 XMSubMetaSx_00 13334 4.80 6.24 4.01 71 XMNumbers 13182 3.73 3.31 3.96 72 RCVD_IN_IADB_VOUCHED 12917 2.82 0.88 3.88 73 XM_UncommonTLD01 12735 5.80 9.39 3.83 74 T_REMOTE_IMAGE 12729 5.27 7.88 3.83 75 RELAYCOUNTRY_META 12320 11.75 26.37 3.71 76 FSL_BULK_SIG 12058 7.35 14.12 3.63 77 TR_XM_DK_SendGrid 11602 3.64 3.91 3.49 78 XM_B_SpammyWords3 11533 6.71 12.60 3.47 79 XMSexyCombo_05 11503 6.01 10.64 3.46 80 HTML_IMAGE_RATIO_06 11333 3.55 3.80 3.41 81 BAYES_20 11179 2.54 1.06 3.36 82 XM_B_Phish_Phrases 10691 4.04 5.54 3.22 83 TR_XM_PhishingBody 10586 4.02 5.53 3.18 84 MIME_HTML_ONLY_MULTI 10486 3.15 3.13 3.15 85 DKIM_INVALID 10410 3.08 2.97 3.13 86 XM_H_Trusted_IP 9587 1.86 0.00 2.88 87 URI_NOVOWEL 9360 2.73 2.58 2.82 88 MAILING_LIST_MULTI 9312 2.42 1.73 2.80 89 BAYES_95 9234 3.64 5.20 2.78 90 XM_B_SpammyTLD 8946 3.32 4.47 2.69 91 TR_XM_SB_Phish 8916 2.46 2.07 2.68 92 XMSubPhish11 8831 2.40 1.95 2.66 93 RCVD_IN_IADB_OPTIN 8617 1.84 0.46 2.59 94 XM_SPF_SoftFail 7878 3.59 5.80 2.37 95 MIME_HTML_MOSTLY 7826 3.03 4.26 2.35 96 HTML_MIME_NO_HTML_TAG 7739 2.37 2.46 2.33 97 HTML_IMAGE_RATIO_08 7686 3.25 4.95 2.31 98 FROM_EXCESS_BASE64 7416 2.36 2.59 2.23 99 TM2_M_URI_OPT_OUT 7379 2.34 2.56 2.22 100 TR_DCC_Bayes_99 7301 10.39 25.28 2.20 101 BAYES_05 7191 1.59 0.55 2.16 102 SUBJ_ALL_CAPS 7102 2.44 2.99 2.14 103 TooManyTo_002 7099 1.53 0.44 2.14 104 ANY_BOUNCE_MESSAGE 6871 1.66 0.92 2.07 105 BOUNCE_MESSAGE 6869 1.66 0.92 2.07 106 INVALID_MSGID 6723 1.35 0.11 2.02 107 TVD_RCVD_IP 6711 1.40 0.28 2.02 108 HTML_FONT_FACE_BAD 6326 1.67 1.25 1.90 109 MSGID_NOFQDN1 6311 1.23 0.02 1.90 110 XM_CamelCaseFrm001 6257 3.84 7.39 1.88 111 TR_Symld_Words 6114 1.64 1.28 1.84 112 IN_HORDE_ADDRESS_BOOK 6102 1.22 0.10 1.84 113 TO_MALFORMED 5995 1.17 0.02 1.80 114 XM_B_Phish66 5992 2.32 3.25 1.80 115 TVD_SPACE_RATIO 5936 1.19 0.11 1.79 116 BOTNET 5668 5.75 13.11 1.70 117 TR_XM_SpammyRelay 5596 6.36 14.87 1.68 118 T_TooManySym_03 5536 1.20 0.36 1.66 119 TR_XM_SpammyWords5 5420 2.64 4.46 1.63 120 T_XMDrugObfuBody_14 5296 2.58 4.38 1.59 121 KHOP_HELO_FCRDNS 5067 1.38 1.13 1.52 122 HELO_NODOT 5015 1.14 0.47 1.51 123 HELO_NO_DOMAIN 5008 1.13 0.46 1.51 124 XM_DK_Undo_01 4834 1.96 2.88 1.45 125 TooManyTo_003 4825 1.06 0.35 1.45 126 XMGappySubj_01 4776 0.97 0.11 1.44 127 URI_HEX 4776 1.42 1.40 1.44 128 XM_B_Investor 4744 2.81 5.32 1.43 129 XMDiploma_00 4690 1.92 2.86 1.41 130 UNTRUSTED_Relay 4535 5.25 12.31 1.36 131 T_XMDrugObfuBody_08 4381 2.39 4.33 1.32 132 XM_B_Unsub2 4376 1.72 2.46 1.32 133 XM_GoogleGroups 4354 1.09 0.68 1.31 134 XMBSHREFv2 4226 0.94 0.34 1.27 135 XMStockSpam_06 4151 1.43 1.75 1.25 136 XM_OfRef6 3993 2.23 4.10 1.20 137 RCVD_IN_MSPIKE_H5 3969 0.85 0.21 1.19 138 TM2_M_VERY_LONG_WORD 3923 1.63 2.46 1.18 139 RELAYCOUNTRY_CA 3856 4.19 9.71 1.16 140 FROM_GOV_DKIM_AU 3487 0.71 0.10 1.05 141 TooManyTo_004 3444 0.78 0.31 1.04 142 XMSexyCombo_01 3384 1.43 2.17 1.02 143 DKIM_ADSP_CUSTOM_MED 3282 0.91 0.76 0.99 144 XMCapTrack 3239 0.72 0.26 0.97 145 XM_H_Long_From02 3208 1.08 1.29 0.96 146 TR_XM_SpammyWords2 3152 4.51 11.00 0.95 147 XMBody_95 3102 0.67 0.18 0.93 148 RCVD_IN_RP_SAFE 2998 0.77 0.52 0.90 149 T_OBFU_PDF_ATTACH 2978 0.61 0.08 0.90 150 XM_UB50 2955 2.61 5.75 0.89 151 FVGT_m_MULTI_ODD_EMAIL 2954 0.66 0.25 0.89 152 T_XMDrugObfuBody_00 2952 1.24 1.89 0.89 153 T_FILL_THIS_FORM_SHORT 2906 1.84 3.58 0.87 154 XMBdyGiftCard01 2906 0.99 1.20 0.87 155 XMSubNoVowel 2835 0.87 0.89 0.85 156 XMHTML_After_End 2785 0.93 1.10 0.84 157 RCVD_IN_RP_CERTIFIED 2751 0.67 0.40 0.83 158 XMGenDplmaNmb 2738 0.94 1.16 0.82 159 TR_XM_Base64_M1 2706 0.99 1.32 0.81 160 HTML_IMAGE_ONLY_20 2696 0.78 0.73 0.81 161 TooManyTo_005 2678 0.61 0.26 0.81 162 XM_B_COPY_HTML 2613 1.38 2.46 0.79 163 XMSubMetaSxObfu_02 2457 0.64 0.45 0.74 164 XM_B_COVIDMETA 2451 1.12 1.81 0.74 165 XMBrknScrpt_02 2417 1.05 1.64 0.73 166 XM_D_tchamptons_WL 2405 0.47 0.02 0.72 167 TR_MetaPhish_Combo_01 2358 0.81 0.98 0.71 168 XMPhish30 2334 0.82 1.03 0.70 169 SpammyFromTLD_01 2305 1.64 3.35 0.69 170 HTML_TAG_BALANCE_BODY 2277 0.83 1.08 0.68 171 HTTPS_HTTP_MISMATCH 2254 1.52 3.04 0.68 172 SpammyFromTLD_02 2184 1.24 2.31 0.66 173 XMSexyCombo_04 2108 0.77 1.03 0.63 174 XM_ShortIntro_01 2093 0.52 0.31 0.63 175 T_XMHurry_00 2022 1.07 1.91 0.61 176 TM2_M_A_HREF_HREF 2016 0.70 0.87 0.61 177 NML_ADSP_CUSTOM_MED 2014 0.56 0.47 0.61 178 FORGED_GMAIL_RCVD 2003 0.62 0.66 0.60 179 XM_H_PHPMailer 1961 0.61 0.65 0.59 180 URI_TRY_3LD 1951 0.74 1.01 0.59 181 XM_B_SpammyWords4 1897 1.35 2.75 0.57 182 T_Symld_Words_02 1870 0.61 0.69 0.56 183 XMSubMetaI_00 1834 0.70 0.98 0.55 184 TM2_M_BODY_EMPTY 1831 0.41 0.16 0.55 185 RELAYCOUNTRY_GB 1812 0.72 1.05 0.54 186 RCVD_IN_MSPIKE_BL 1730 2.81 6.98 0.52 187 XM_B_DNDMA 1717 0.60 0.74 0.52 188 XMNoVowels 1695 0.49 0.45 0.51 189 DKIM_ADSP_NXDOMAIN 1688 0.60 0.78 0.51 190 MPART_ALT_DIFF_COUNT 1680 0.86 1.51 0.51 191 XMLngstWrd_00 1650 0.54 0.61 0.50 192 BASE64_LENGTH_79_INF 1642 0.42 0.28 0.49 193 TR_XM_MSPIKECOMBO 1641 2.68 6.65 0.49 194 XM_ProductURIs 1625 0.78 1.31 0.49 195 XMBody_17 1617 1.89 4.45 0.49 196 XMSlimDrugH 1593 0.54 0.66 0.48 197 SHORT_HELO_AND_INLINE_IMAGE 1559 0.32 0.04 0.47 198 TR_XM_PHPDW 1496 0.80 1.43 0.45 199 RCVD_IN_BL_SPAMCOP_NET 1495 5.07 13.48 0.45 200 RCVD_IN_MSPIKE_L3 1485 1.25 2.72 0.45 ----------------------------------------------------------------------