Email: 639491 Autolearn: 0 AvgScore: 2.26 AvgScanTime: 1.36 sec Spam: 188212 Autolearn: 0 AvgScore: 13.38 AvgScanTime: 1.52 sec Ham: 451279 Autolearn: 0 AvgScore: -2.38 AvgScanTime: 1.29 sec Time Spent Running SA: 241.60 hours Time Spent Processing Spam: 79.65 hours Time Spent Processing Ham: 161.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 177835 91.02 94.49 89.58 2 DKIM_SIGNED 161106 65.25 85.60 56.77 3 XM_DK_Pass 157128 63.62 83.48 55.33 4 DKIM_VALID 155312 62.73 82.52 54.47 5 RELAYCOUNTRY_US 150469 75.90 79.95 74.21 6 XM_B_Unicode 131654 72.74 69.95 73.90 7 DKIM_VALID_AU 124615 50.02 66.21 43.27 8 XM_B_SpammyWords 119092 46.88 63.28 40.05 9 XMListUnsubscribeExists 118924 44.38 63.19 36.54 10 DCC_CHECK 111685 36.40 59.34 26.83 11 RCVD_IN_MSPIKE_H2 82219 33.89 43.68 29.81 12 XM_DK_Undo_02 80194 16.19 42.61 5.17 13 DCC_CHECK_NEGATIVE 76489 63.56 40.64 73.12 14 BAYES_50 72290 52.40 38.41 58.24 15 BAYES_99 71804 14.05 38.15 4.00 16 XM_B_Unicode3 71566 43.48 38.02 45.75 17 XM_B_SpammyWords2 65806 21.78 34.96 16.29 18 FVGT_m_MULTI_ODD 59665 23.24 31.70 19.71 19 BAYES_999 58710 11.39 31.19 3.13 20 LOC_TINY_FONT_1 58705 21.73 31.19 17.78 21 HTML_FONT_LOW_CONTRAST 56006 23.69 29.76 21.16 22 TR_XM_DKIM_Undo 54954 11.12 29.20 3.58 23 DKIM_VALID_EF 54576 23.96 29.00 21.86 24 MIME_HTML_ONLY 51902 27.68 27.58 27.73 25 T_KAM_HTML_FONT_INVALID 51863 18.52 27.56 14.75 26 T_TM2_M_HEADER_IN_MSG 50380 25.70 26.77 25.26 27 LOTS_OF_MONEY 43507 12.36 23.12 7.88 28 XMSubLong 38559 24.65 20.49 26.39 29 TR_DCC_Bayes_99 38212 6.99 20.30 1.44 30 XM_Body_Dirty_Words 36750 11.83 19.53 8.62 31 RELAYCOUNTRY_META 33980 7.42 18.05 2.98 32 XM_Multi_Part_URI 31682 11.67 16.83 9.52 33 XM_B_Unsub 25146 13.34 13.36 13.33 34 RCVD_IN_MSPIKE_WL 24797 13.54 13.18 13.70 35 TR_XM_BayesUnsub 24703 12.50 13.13 12.25 36 XM_B_Crypto 23277 5.14 12.37 2.12 37 TR_XM_SpammyRelay 22958 4.50 12.20 1.29 38 TR_XM_SpammyWords4 22479 6.44 11.94 4.14 39 URIBL_DBL_PHISH 22007 4.72 11.69 1.81 40 BOTNET_IPINHOSTNAME 21181 6.14 11.25 4.00 41 RCVD_IN_MSPIKE_H3 20329 9.53 10.80 9.00 42 XM_B_SpammyWords3 19683 5.54 10.46 3.48 43 TR_XM_SpammyWords2 19200 3.46 10.20 0.65 44 UNPARSEABLE_RELAY 18377 7.13 9.76 6.03 45 XM_UncommonTLD01 18376 5.02 9.76 3.05 46 TR_XM_Crypto3 17658 2.88 9.38 0.16 47 TR_XM_PhishingBody 16860 4.37 8.96 2.45 48 XMSexyCombo_05 16413 4.37 8.72 2.56 49 BOTNET 16240 3.48 8.63 1.34 50 FSL_BULK_SIG 15822 5.30 8.41 4.00 51 LotsOfNums_01 15475 6.94 8.22 6.40 52 MPART_ALT_DIFF 15430 9.26 8.20 9.70 53 UNTRUSTED_Relay 15233 3.13 8.09 1.05 54 XM_B_Phish_Phrases 15052 4.10 8.00 2.48 55 XM_Evil_Numbers_Gen 14658 7.83 7.79 7.85 56 BAYES_80 14331 4.60 7.61 3.35 57 XM_B_SpammyTLD 13424 3.47 7.13 1.95 58 ANY_BOUNCE_MESSAGE 13120 4.07 6.97 2.86 59 BOUNCE_MESSAGE 13117 4.07 6.97 2.86 60 RELAYCOUNTRY_CA 13006 2.68 6.91 0.92 61 BAYES_60 12997 6.76 6.91 6.70 62 RCVD_IN_BL_SPAMCOP_NET 12206 2.18 6.49 0.39 63 MIME_HEADER_CTYPE_ONLY 11706 2.07 6.22 0.34 64 XM_H_Long_From01 11094 4.75 5.89 4.27 65 XM_B_Phish66 10988 2.67 5.84 1.35 66 MY_SERVERS_FOUND 10764 2.08 5.72 0.56 67 TR_XM_UnparsRelay 10693 2.38 5.68 1.00 68 XMSubMetaSx_00 10171 3.40 5.40 2.56 69 MIME_HTML_ONLY_MULTI 9803 6.98 5.21 7.72 70 HTML_IMAGE_RATIO_02 9643 4.57 5.12 4.33 71 XMNumbers 9477 3.84 5.04 3.34 72 TooManyTo_001 9241 11.14 4.91 13.74 73 T_XMDrugObfuBody_08 8912 2.21 4.74 1.15 74 XMLngstWrd_00 8745 2.00 4.65 0.90 75 XMLngstWrd_01 8694 1.94 4.62 0.82 76 TM2_M_VERY_LONG_WORD 8686 2.16 4.62 1.14 77 TR_XM_SPAMCOP 8669 1.49 4.61 0.19 78 XM_OfRef6 8654 1.87 4.60 0.73 79 XMBody_17 8618 1.78 4.58 0.61 80 XM_SPF_SoftFail 8611 2.59 4.58 1.76 81 ALL_TRUSTED 8602 17.94 4.57 23.51 82 XM_SendGrid 8572 3.94 4.55 3.69 83 URIBL_DBL_SPAM 8057 1.26 4.28 0.01 84 HTML_IMAGE_RATIO_04 7967 11.53 4.23 14.57 85 BAYES_95 7882 2.80 4.19 2.22 86 XM_B_Investor 7667 1.99 4.07 1.12 87 RCVD_IN_MSPIKE_BL 7312 1.35 3.88 0.30 88 XM_UB50 7299 1.62 3.88 0.68 89 TR_XM_MSPIKECOMBO 7277 1.34 3.87 0.29 90 HTML_MIME_NO_HTML_TAG 7261 2.48 3.86 1.91 91 SpammyFromTLD_02 7103 1.35 3.77 0.34 92 MIME_HTML_MOSTLY 6965 2.70 3.70 2.28 93 T_XMDrugObfuBody_14 6806 1.86 3.62 1.13 94 XMStrtUSub 6222 8.35 3.31 10.46 95 SpammyFromTLD_01 6209 1.44 3.30 0.67 96 TR_XM_SpammyWords5 6051 1.61 3.21 0.95 97 T_FILL_THIS_FORM_SHORT 5952 1.44 3.16 0.73 98 XMLngstWrd_02 5877 1.43 3.12 0.73 99 XMDiploma_00 5865 6.75 3.12 8.27 100 XM_DIRTYINTL 5835 1.08 3.10 0.23 101 DKIM_INVALID 5794 2.53 3.08 2.30 102 RCVD_IN_VALIDITY_SAFE 5786 3.40 3.07 3.54 103 HTML_IMAGE_RATIO_06 5767 4.29 3.06 4.81 104 KHOP_HELO_FCRDNS 5722 1.64 3.04 1.06 105 PDS_OTHER_BAD_TLD 5713 1.02 3.04 0.18 106 XM_GoogleGroups 5411 1.75 2.87 1.28 107 XMLngstWrd_03 5334 1.29 2.83 0.64 108 XM_URI_RBL 5175 0.88 2.75 0.10 109 TR_XM_DK_SendGrid 5129 2.56 2.73 2.49 110 T_REMOTE_IMAGE 5051 2.93 2.68 3.04 111 TR_XM_PHPDW 5039 1.01 2.68 0.31 112 TR_XM_SpammyWords3 4942 0.89 2.63 0.16 113 MIME_QP_LONG_LINE 4914 3.53 2.61 3.91 114 TR_XM_PHPForged 4911 0.97 2.61 0.29 115 TR_XM_FormFill2 4879 0.96 2.59 0.28 116 XM_H_PHPOS 4874 0.96 2.59 0.28 117 TM2_M_URI_OPT_OUT 4835 1.75 2.57 1.41 118 XMLngstWrd_04 4833 1.16 2.57 0.58 119 XM_DK_Undo_01 4742 1.61 2.52 1.23 120 XM_B_Unsub2 4706 1.56 2.50 1.16 121 HTML_TITLE_SUBJ_DIFF 4584 0.99 2.44 0.38 122 RCVD_IN_VALIDITY_CERTIFIED 4566 2.87 2.43 3.05 123 XM_H_Undi_Recip 4518 0.84 2.40 0.19 124 UPPERCASE_75_100 4498 0.98 2.39 0.40 125 HTML_IMAGE_RATIO_08 4427 2.06 2.35 1.93 126 URI_NOVOWEL 4384 1.99 2.33 1.84 127 URI_OPTOUT_3LD 4285 0.71 2.28 0.06 128 TR_XM_PhishingBody2 4167 0.67 2.21 0.03 129 TR_XM_FormFill 4124 0.66 2.19 0.02 130 USER_IN_DEF_DKIM_WL 4078 7.30 2.17 9.45 131 RCVD_IN_MSPIKE_H4 4066 3.35 2.16 3.85 132 T_TooManySym_01 3936 4.30 2.09 5.23 133 FROM_EXCESS_BASE64 3848 2.03 2.04 2.02 134 RCVD_IN_MSPIKE_L3 3792 0.78 2.01 0.26 135 RCVD_IN_VALIDITY_RPBL 3773 0.61 2.00 0.02 136 TR_LOTS_OF_MONEY3 3726 0.76 1.98 0.25 137 LongTLD 3700 0.76 1.97 0.26 138 BAYES_40 3530 3.82 1.88 4.64 139 TR_XM_NoHeaderRelay 3414 0.60 1.81 0.09 140 XM_CamelCaseFrm001 3347 1.65 1.78 1.60 141 XM_B_SpammyWords4 3256 1.07 1.73 0.80 142 BOTNET_NORDNS 3256 0.52 1.73 0.02 143 XM_B_COVIDMETA 3250 0.92 1.73 0.58 144 RCVD_IN_IADB_LISTED 3249 3.09 1.73 3.66 145 HTTPS_HTTP_MISMATCH 3245 1.07 1.72 0.80 146 RCVD_IN_MSPIKE_L5 3184 0.52 1.69 0.03 147 SUBJ_ALL_CAPS 3103 1.33 1.65 1.20 148 TR_XM_InvalidRelay 3081 0.49 1.64 0.02 149 FROM_SUSPICIOUS_NTLD 3034 0.50 1.61 0.04 150 HK_RANDOM_REPLYTO 2956 0.51 1.57 0.07 151 TR_XM_COVIDMETA1 2953 0.54 1.57 0.11 152 TR_XM_SB_Phish 2926 1.85 1.55 1.97 153 XMStockSpam_06 2900 1.14 1.54 0.97 154 TM2_M_BODY_EMPTY 2899 0.78 1.54 0.46 155 MAILING_LIST_MULTI 2892 1.80 1.54 1.90 156 XMEmptyBody_01 2849 0.51 1.51 0.09 157 T_XMDrugObfuBody_00 2805 0.86 1.49 0.60 158 XMSubPhish11 2788 1.81 1.48 1.95 159 FROM_SUSPICIOUS_NTLD_FP 2780 0.46 1.48 0.03 160 RCVD_IN_IADB_SPF 2776 2.73 1.47 3.26 161 BAYES_20 2657 3.65 1.41 4.58 162 RCVD_IN_IADB_DK 2637 2.42 1.40 2.85 163 XM_UB99 2622 0.41 1.39 0.00 164 RCVD_IN_IADB_SENDERID 2591 2.48 1.38 2.93 165 RCVD_IN_PSBL 2572 0.55 1.37 0.22 166 XMBdyGiftCard01 2546 0.91 1.35 0.73 167 URI_PHP_REDIR 2488 0.39 1.32 0.00 168 TR_XM_Base64_M1 2408 0.94 1.28 0.80 169 XMBounce_01 2407 0.40 1.28 0.03 170 TR_XM_Undi_Recip11 2396 0.40 1.27 0.04 171 T_XMHurry_00 2368 1.94 1.26 2.22 172 TR_XM_Crypto2 2341 0.38 1.24 0.02 173 XMSexyCombo_01 2317 0.56 1.23 0.27 174 FONT_INVIS_LONG_LINE 2295 0.45 1.22 0.13 175 URI_HEX 2269 1.01 1.21 0.93 176 UNDISC_MONEY 2264 0.36 1.20 0.00 177 RELAYCOUNTRY_AU 2253 0.54 1.20 0.26 178 XMBrknScrpt_02 2235 0.82 1.19 0.66 179 XMHTML_After_End 2223 1.09 1.18 1.06 180 HTML_TAG_BALANCE_BODY 2180 0.69 1.16 0.49 181 XMGenDplmaNmb 2149 0.71 1.14 0.53 182 TR_XM_MSPIKECOMBO2 2110 0.34 1.12 0.01 183 URI_TRY_3LD 2092 0.67 1.11 0.49 184 XM_HighProb1 2066 0.33 1.10 0.00 185 TR_XM_Undi_Recip5 1997 0.32 1.06 0.01 186 XMPhish30 1989 0.66 1.06 0.49 187 URIBL_BLACK 1966 0.34 1.04 0.04 188 XMMoneyMeta_00 1938 0.64 1.03 0.47 189 XMSubMetaI_00 1930 0.61 1.03 0.44 190 XM_UB999 1913 0.30 1.02 0.00 191 RELAYCOUNTRY_IN 1891 0.34 1.00 0.06 192 NO_DNS_FOR_FROM 1866 0.45 0.99 0.23 193 TR_LOTS_OF_MONEY2 1836 0.41 0.98 0.18 194 T_MONEY_PERCENT 1836 0.41 0.98 0.18 195 XM_B_DNDMA 1817 0.48 0.97 0.28 196 MPART_ALT_DIFF_COUNT 1799 0.60 0.96 0.45 197 TR_XM_Undi_Recip2 1798 0.30 0.96 0.02 198 XM_H_Long_From02 1785 0.98 0.95 1.00 199 DKIM_ADSP_NXDOMAIN 1745 0.50 0.93 0.32 200 TR_XM_RelayPhish 1727 0.30 0.92 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 404240 91.02 94.49 89.58 2 RELAYCOUNTRY_US 334882 75.90 79.95 74.21 3 XM_B_Unicode 333496 72.74 69.95 73.90 4 DCC_CHECK_NEGATIVE 329986 63.56 40.64 73.12 5 BAYES_50 262823 52.40 38.41 58.24 6 DKIM_SIGNED 256184 65.25 85.60 56.77 7 XM_DK_Pass 249703 63.62 83.48 55.33 8 DKIM_VALID 245827 62.73 82.52 54.47 9 XM_B_Unicode3 206480 43.48 38.02 45.75 10 DKIM_VALID_AU 195251 50.02 66.21 43.27 11 XM_B_SpammyWords 180716 46.88 63.28 40.05 12 XMListUnsubscribeExists 164899 44.38 63.19 36.54 13 RCVD_IN_MSPIKE_H2 134532 33.89 43.68 29.81 14 MIME_HTML_ONLY 125133 27.68 27.58 27.73 15 DCC_CHECK 121100 36.40 59.34 26.83 16 XMSubLong 119075 24.65 20.49 26.39 17 T_TM2_M_HEADER_IN_MSG 114001 25.70 26.77 25.26 18 ALL_TRUSTED 106092 17.94 4.57 23.51 19 DKIM_VALID_EF 98652 23.96 29.00 21.86 20 HTML_FONT_LOW_CONTRAST 95469 23.69 29.76 21.16 21 FVGT_m_MULTI_ODD 88948 23.24 31.70 19.71 22 LOC_TINY_FONT_1 80239 21.73 31.19 17.78 23 XM_B_SpammyWords2 73498 21.78 34.96 16.29 24 T_KAM_HTML_FONT_INVALID 66581 18.52 27.56 14.75 25 HTML_IMAGE_RATIO_04 65759 11.53 4.23 14.57 26 HTML_FONT_FACE_BAD 65071 10.41 0.80 14.42 27 TooManyTo_001 62003 11.14 4.91 13.74 28 RCVD_IN_MSPIKE_WL 61818 13.54 13.18 13.70 29 XM_B_Unsub 60135 13.34 13.36 13.33 30 XM_H_Trusted_IP 60059 9.39 0.00 13.31 31 BAYES_00 56970 9.13 0.74 12.62 32 TR_XM_BayesUnsub 55260 12.50 13.13 12.25 33 XMStrtUSub 47202 8.35 3.31 10.46 34 MPART_ALT_DIFF 43793 9.26 8.20 9.70 35 XM_Multi_Part_URI 42949 11.67 16.83 9.52 36 USER_IN_DEF_DKIM_WL 42626 7.30 2.17 9.45 37 RCVD_IN_MSPIKE_H3 40632 9.53 10.80 9.00 38 XM_Body_Dirty_Words 38916 11.83 19.53 8.62 39 XMDiploma_00 37327 6.75 3.12 8.27 40 LOTS_OF_MONEY 35551 12.36 23.12 7.88 41 XM_Evil_Numbers_Gen 35404 7.83 7.79 7.85 42 MIME_HTML_ONLY_MULTI 34820 6.98 5.21 7.72 43 XM_DKIMWhitelistDomains 33035 5.17 0.02 7.32 44 BAYES_60 30215 6.76 6.91 6.70 45 LotsOfNums_01 28889 6.94 8.22 6.40 46 UNPARSEABLE_RELAY 27223 7.13 9.76 6.03 47 T_TooManySym_01 23594 4.30 2.09 5.23 48 IN_ZIMBRA_NJ_WHITELIST 23408 3.68 0.06 5.19 49 XM_DK_Undo_02 23353 16.19 42.61 5.17 50 TR_XM_DK_Bayes 22777 3.72 0.54 5.05 51 TR_XM_DK_Bayes1 22301 3.65 0.54 4.94 52 HTML_IMAGE_RATIO_06 21686 4.29 3.06 4.81 53 BAYES_40 20927 3.82 1.88 4.64 54 BAYES_20 20691 3.65 1.41 4.58 55 XMSubNoVowel 20224 3.26 0.34 4.48 56 TR_XM_DK_Bayes2 19704 3.21 0.42 4.37 57 HTML_IMAGE_RATIO_02 19562 4.57 5.12 4.33 58 XM_H_Long_From01 19252 4.75 5.89 4.27 59 TR_XM_SpammyWords4 18699 6.44 11.94 4.14 60 BOTNET_IPINHOSTNAME 18059 6.14 11.25 4.00 61 FSL_BULK_SIG 18050 5.30 8.41 4.00 62 BAYES_99 18044 14.05 38.15 4.00 63 MIME_QP_LONG_LINE 17649 3.53 2.61 3.91 64 XM_PDF 17533 2.92 0.61 3.89 65 RCVD_IN_MSPIKE_H4 17388 3.35 2.16 3.85 66 XM_SendGrid 16645 3.94 4.55 3.69 67 RCVD_IN_IADB_LISTED 16531 3.09 1.73 3.66 68 BAYES_05 16472 2.78 0.70 3.65 69 TR_XM_DKIM_Undo 16145 11.12 29.20 3.58 70 RCVD_IN_VALIDITY_SAFE 15988 3.40 3.07 3.54 71 XM_B_SpammyWords3 15713 5.54 10.46 3.48 72 BAYES_80 15108 4.60 7.61 3.35 73 XMNumbers 15070 3.84 5.04 3.34 74 RCVD_IN_IADB_SPF 14704 2.73 1.47 3.26 75 T_TooManySym_02 14148 2.44 0.77 3.14 76 BAYES_999 14108 11.39 31.19 3.13 77 RCVD_IN_VALIDITY_CERTIFIED 13780 2.87 2.43 3.05 78 XM_UncommonTLD01 13742 5.02 9.76 3.05 79 T_REMOTE_IMAGE 13706 2.93 2.68 3.04 80 RELAYCOUNTRY_META 13456 7.42 18.05 2.98 81 RCVD_IN_IADB_SENDERID 13245 2.48 1.38 2.93 82 HELO_NODOT 13010 2.17 0.45 2.88 83 HELO_NO_DOMAIN 13007 2.17 0.45 2.88 84 BOUNCE_MESSAGE 12885 4.07 6.97 2.86 85 ANY_BOUNCE_MESSAGE 12885 4.07 6.97 2.86 86 RCVD_IN_IADB_DK 12866 2.42 1.40 2.85 87 XMSexyCombo_05 11555 4.37 8.72 2.56 88 XMSubMetaSx_00 11544 3.40 5.40 2.56 89 TR_XM_DK_SendGrid 11235 2.56 2.73 2.49 90 XM_B_Phish_Phrases 11190 4.10 8.00 2.48 91 TR_XM_PhishingBody 11055 4.37 8.96 2.45 92 RCVD_IN_IADB_VOUCHED 10407 1.88 0.86 2.31 93 DKIM_INVALID 10357 2.53 3.08 2.30 94 MIME_HTML_MOSTLY 10306 2.70 3.70 2.28 95 BAYES_95 10029 2.80 4.19 2.22 96 T_XMHurry_00 10018 1.94 1.26 2.22 97 XM_B_Crypto 9582 5.14 12.37 2.12 98 XMSubLongNoVowel 9285 1.48 0.09 2.06 99 FROM_EXCESS_BASE64 9132 2.03 2.04 2.02 100 XMSubGarbage 9105 1.43 0.03 2.02 101 TR_XM_SB_Phish 8889 1.85 1.55 1.97 102 XMSubPhish11 8781 1.81 1.48 1.95 103 XM_B_SpammyTLD 8779 3.47 7.13 1.95 104 HTML_IMAGE_RATIO_08 8715 2.06 2.35 1.93 105 HTML_MIME_NO_HTML_TAG 8602 2.48 3.86 1.91 106 MAILING_LIST_MULTI 8595 1.80 1.54 1.90 107 URI_NOVOWEL 8317 1.99 2.33 1.84 108 MISSING_HEADERS 8303 1.39 0.32 1.84 109 URIBL_DBL_PHISH 8146 4.72 11.69 1.81 110 XM_SPF_SoftFail 7950 2.59 4.58 1.76 111 TooManyTo_002 7921 1.40 0.56 1.76 112 XM_CamelCaseFrm001 7207 1.65 1.78 1.60 113 INVALID_MSGID 6944 1.13 0.14 1.54 114 TR_LOTS_OF_MONEY1 6900 1.10 0.07 1.53 115 RCVD_IN_IADB_OPTIN 6863 1.22 0.48 1.52 116 TVD_RCVD_IP 6675 1.12 0.26 1.48 117 TR_DCC_Bayes_99 6483 6.99 20.30 1.44 118 TR_Symld_Words 6467 1.25 0.80 1.43 119 MSGID_NOFQDN1 6376 1.02 0.06 1.41 120 TM2_M_URI_OPT_OUT 6362 1.75 2.57 1.41 121 IN_HORDE_ADDRESS_BOOK 6347 1.01 0.07 1.41 122 XM_B_Phish66 6103 2.67 5.84 1.35 123 BOTNET 6025 3.48 8.63 1.34 124 TO_MALFORMED 5942 0.93 0.01 1.32 125 TR_XM_SpammyRelay 5843 4.50 12.20 1.29 126 XM_GoogleGroups 5787 1.75 2.87 1.28 127 TVD_SPACE_RATIO 5745 0.92 0.07 1.27 128 T_TooManySym_03 5701 0.94 0.18 1.26 129 SHORTENED_URL_HREF 5614 0.89 0.05 1.24 130 XM_DK_Undo_01 5549 1.61 2.52 1.23 131 SUBJ_ALL_CAPS 5415 1.33 1.65 1.20 132 TooManyTo_003 5264 0.96 0.46 1.17 133 XM_B_Unsub2 5239 1.56 2.50 1.16 134 T_XMDrugObfuBody_08 5193 2.21 4.74 1.15 135 TM2_M_VERY_LONG_WORD 5153 2.16 4.62 1.14 136 T_XMDrugObfuBody_14 5085 1.86 3.62 1.13 137 XM_B_Investor 5075 1.99 4.07 1.12 138 KHOP_HELO_FCRDNS 4784 1.64 3.04 1.06 139 XMHTML_After_End 4776 1.09 1.18 1.06 140 UNTRUSTED_Relay 4755 3.13 8.09 1.05 141 XM_E_Blogspot 4530 0.72 0.05 1.00 142 TR_XM_UnparsRelay 4519 2.38 5.68 1.00 143 XM_H_Long_From02 4503 0.98 0.95 1.00 144 XMStockSpam_06 4390 1.14 1.54 0.97 145 TR_XM_SpammyWords5 4267 1.61 3.21 0.95 146 URI_HEX 4178 1.01 1.21 0.93 147 XMGappySubj_01 4173 0.69 0.14 0.92 148 RELAYCOUNTRY_CA 4130 2.68 6.91 0.92 149 XMCapTrack 4130 0.74 0.32 0.92 150 XMBSHREFv2 4123 0.73 0.30 0.91 151 XMLngstWrd_00 4069 2.00 4.65 0.90 152 XMBody_95 3888 0.68 0.23 0.86 153 RCVD_IN_MSPIKE_H5 3798 0.66 0.21 0.84 154 TooManyTo_004 3767 0.69 0.34 0.83 155 XMLngstWrd_01 3701 1.94 4.62 0.82 156 TR_XM_Base64_M1 3631 0.94 1.28 0.80 157 HTTPS_HTTP_MISMATCH 3617 1.07 1.72 0.80 158 XM_B_SpammyWords4 3598 1.07 1.73 0.80 159 RCVD_IN_RP_SAFE 3372 0.72 0.64 0.75 160 XMBdyGiftCard01 3286 0.91 1.35 0.73 161 T_FILL_THIS_FORM_SHORT 3284 1.44 3.16 0.73 162 XM_OfRef6 3278 1.87 4.60 0.73 163 XMLngstWrd_02 3276 1.43 3.12 0.73 164 XM_UB50 3047 1.62 3.88 0.68 165 SpammyFromTLD_01 3028 1.44 3.30 0.67 166 XMBrknScrpt_02 2987 0.82 1.19 0.66 167 FVGT_m_MULTI_ODD_EMAIL 2981 0.50 0.12 0.66 168 TooManyTo_005 2968 0.55 0.29 0.66 169 TR_XM_SpammyWords2 2946 3.46 10.20 0.65 170 RCVD_IN_RP_CERTIFIED 2934 0.61 0.51 0.65 171 DKIM_ADSP_CUSTOM_MED 2923 0.63 0.57 0.65 172 XMLngstWrd_03 2892 1.29 2.83 0.64 173 XMBody_17 2749 1.78 4.58 0.61 174 FROM_GOV_DKIM_AU 2734 0.49 0.21 0.61 175 T_XMDrugObfuBody_00 2724 0.86 1.49 0.60 176 XM_B_COVIDMETA 2631 0.92 1.73 0.58 177 T_OBFU_PDF_ATTACH 2616 0.44 0.10 0.58 178 TR_MetaPhish_Combo_01 2614 0.61 0.68 0.58 179 XMLngstWrd_04 2609 1.16 2.57 0.58 180 MY_SERVERS_FOUND 2530 2.08 5.72 0.56 181 TO_NO_BRKTS_HTML_ONLY 2409 0.41 0.11 0.53 182 XMGenDplmaNmb 2388 0.71 1.14 0.53 183 XM_B_COPY_HTML 2282 0.60 0.83 0.51 184 XM_ShortIntro_01 2263 0.44 0.31 0.50 185 XMPhish30 2228 0.66 1.06 0.49 186 URI_TRY_3LD 2219 0.67 1.11 0.49 187 HTML_TAG_BALANCE_BODY 2207 0.69 1.16 0.49 188 XM_Body_Dirty_Words_01 2189 0.58 0.82 0.49 189 XMMoneyMeta_00 2129 0.64 1.03 0.47 190 HTML_IMAGE_ONLY_20 2128 0.52 0.64 0.47 191 TM2_M_BODY_EMPTY 2087 0.78 1.54 0.46 192 MPART_ALT_DIFF_COUNT 2038 0.60 0.96 0.45 193 XM_H_PHPMailer 2024 0.52 0.68 0.45 194 XMSubMetaI_00 1973 0.61 1.03 0.44 195 XMSubMetaSxObfu_02 1960 0.41 0.36 0.43 196 NML_ADSP_CUSTOM_MED 1903 0.44 0.49 0.42 197 PLING_QUERY 1799 0.49 0.69 0.40 198 UPPERCASE_75_100 1789 0.98 2.39 0.40 199 XMReplyNow 1785 0.50 0.75 0.40 200 XMHTMLBadTable_001 1773 0.51 0.78 0.39 ----------------------------------------------------------------------