Email: 547582 Autolearn: 0 AvgScore: 5.26 AvgScanTime: 1.86 sec Spam: 209399 Autolearn: 0 AvgScore: 14.39 AvgScanTime: 1.92 sec Ham: 338183 Autolearn: 0 AvgScore: -0.39 AvgScanTime: 1.83 sec Time Spent Running SA: 282.93 hours Time Spent Processing Spam: 111.39 hours Time Spent Processing Ham: 171.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 203122 92.38 97.00 89.51 2 DKIM_SIGNED 197438 87.27 94.29 82.92 3 XM_DK_Pass 193072 85.44 92.20 81.25 4 DKIM_VALID 191447 84.83 91.43 80.74 5 RELAYCOUNTRY_US 173998 84.12 83.09 84.76 6 XMListUnsubscribeExists 169730 70.69 81.06 64.27 7 XM_B_Unicode 168497 79.42 80.47 78.78 8 DCC_CHECK 163942 60.86 78.29 50.07 9 DKIM_VALID_AU 144880 67.24 69.19 66.04 10 XM_B_SpammyWords 139717 57.48 66.72 51.75 11 XM_DK_Undo_02 111019 25.85 53.02 9.03 12 LOC_TINY_FONT_1 105129 40.15 50.21 33.92 13 RCVD_IN_MSPIKE_H2 102862 45.45 49.12 43.18 14 XM_B_Unicode3 95509 49.17 45.61 51.37 15 HTML_FONT_LOW_CONTRAST 94436 38.57 45.10 34.54 16 BAYES_99 82912 19.74 39.60 7.44 17 DKIM_VALID_EF 79700 31.34 38.06 27.18 18 TR_XM_DKIM_Undo 77201 17.43 36.87 5.39 19 XM_B_SpammyWords2 75879 28.53 36.24 23.77 20 FVGT_m_MULTI_ODD 73383 32.40 35.04 30.76 21 BAYES_50 70971 48.50 33.89 57.55 22 BAYES_999 66410 15.84 31.71 6.01 23 TR_DCC_Bayes_99 66081 14.26 31.56 3.55 24 T_KAM_HTML_FONT_INVALID 58264 24.74 27.82 22.84 25 MIME_HTML_ONLY 50755 22.46 24.24 21.36 26 XMSubLong 48928 20.75 23.37 19.12 27 DCC_CHECK_NEGATIVE 45397 39.11 21.68 49.91 28 XM_Multi_Part_URI 44852 19.64 21.42 18.54 29 XM_Body_Dirty_Words 38862 15.30 18.56 13.28 30 RELAYCOUNTRY_META 33724 8.51 16.11 3.81 31 T_TM2_M_HEADER_IN_MSG 33618 19.29 16.05 21.30 32 UNPARSEABLE_RELAY 33033 13.91 15.78 12.75 33 BOTNET_IPINHOSTNAME 31482 8.82 15.03 4.97 34 XM_UncommonTLD01 30291 7.58 14.47 3.32 35 XM_B_SpammyTLD 28768 6.83 13.74 2.55 36 XM_B_Unsub 26318 10.16 12.57 8.67 37 RCVD_IN_MSPIKE_WL 26294 17.15 12.56 19.99 38 TR_XM_SpammyRelay 26274 5.95 12.55 1.86 39 TR_XM_BayesUnsub 25802 9.31 12.32 7.44 40 TooManyTo_001 24967 7.34 11.92 4.51 41 XM_B_SpammyWords3 24084 8.40 11.50 6.47 42 BOTNET 23879 5.19 11.40 1.35 43 TR_XM_SpammyWords2 23512 5.15 11.23 1.39 44 SpammyFromTLD_02 23427 4.44 11.19 0.26 45 PDS_OTHER_BAD_TLD 22057 4.37 10.53 0.56 46 RCVD_IN_BL_SPAMCOP_NET 21901 4.43 10.46 0.70 47 TR_XM_UnparsRelay 21031 5.82 10.04 3.20 48 FROM_SUSPICIOUS_NTLD 20682 3.81 9.88 0.05 49 LongTLD 20626 3.90 9.85 0.22 50 FROM_SUSPICIOUS_NTLD_FP 20581 3.78 9.83 0.04 51 XM_Evil_Numbers_Gen 20431 10.51 9.76 10.98 52 RCVD_IN_MSPIKE_H3 19743 10.64 9.43 11.39 53 BAYES_80 19116 6.79 9.13 5.35 54 DATE_IN_PAST_24_48 18819 3.44 8.99 0.01 55 TR_XM_SPAMCOP 18653 3.58 8.91 0.28 56 HTML_IMAGE_RATIO_02 18412 8.57 8.79 8.42 57 XM_SendGrid 17744 8.21 8.47 8.04 58 BAYES_60 17227 9.91 8.23 10.96 59 NORDNS_LOW_CONTRAST 16367 3.03 7.82 0.07 60 XMSexyCombo_05 16263 5.52 7.77 4.14 61 FSL_BULK_SIG 16204 5.25 7.74 3.70 62 LOTS_OF_MONEY 15927 7.03 7.61 6.67 63 RELAYCOUNTRY_CA 15628 3.48 7.46 1.01 64 LotsOfNums_01 15263 9.18 7.29 10.35 65 MPART_ALT_DIFF 14655 6.02 7.00 5.41 66 UNTRUSTED_Relay 14447 3.75 6.90 1.80 67 XMSubMetaSx_00 13848 4.14 6.61 2.60 68 TR_XM_SpammyWords4 13638 4.92 6.51 3.93 69 TR_XM_PhishingBody 11484 3.83 5.48 2.81 70 BAYES_95 11271 4.25 5.38 3.55 71 TR_XM_DK_SendGrid 11153 5.38 5.33 5.41 72 URIBL_DBL_SPAM 11047 2.03 5.28 0.02 73 TR_XM_SpammyWords5 10584 3.77 5.05 2.97 74 MIME_HTML_MOSTLY 10350 3.71 4.94 2.95 75 XM_B_Phish_Phrases 10001 5.11 4.78 5.31 76 XM_H_Long_From01 9788 5.53 4.67 6.06 77 HTML_IMAGE_RATIO_04 9543 5.74 4.56 6.47 78 HTML_IMAGE_RATIO_08 9021 3.77 4.31 3.44 79 BOTNET_NORDNS 8610 1.58 4.11 0.01 80 HTML_FONT_TINY_NORDNS 8264 1.57 3.95 0.09 81 RCVD_IN_VALIDITY_SAFE 8005 6.64 3.82 8.39 82 SUBJ_ALL_CAPS 7997 4.01 3.82 4.12 83 XMBody_17 7799 1.89 3.72 0.75 84 HTML_IMAGE_RATIO_06 7389 4.24 3.53 4.68 85 USER_IN_DEF_DKIM_WL 7379 11.93 3.52 17.14 86 TM2_M_VERY_LONG_WORD 7299 2.41 3.49 1.74 87 RCVD_IN_MSPIKE_BL 7126 1.66 3.40 0.59 88 TR_XM_MSPIKECOMBO 7080 1.65 3.38 0.58 89 MIME_QP_LONG_LINE 7023 4.47 3.35 5.17 90 XMStrtUSub 6847 4.08 3.27 4.59 91 XM_UB50 6841 1.93 3.27 1.10 92 RCVD_IN_VALIDITY_CERTIFIED 6626 5.87 3.16 7.55 93 XM_B_Investor 6511 1.93 3.11 1.21 94 FROM_EXCESS_BASE64 6494 3.65 3.10 3.99 95 MIME_HTML_ONLY_MULTI 6451 3.20 3.08 3.27 96 XMNumbers 6449 3.60 3.08 3.92 97 XM_DIRTYINTL 6440 1.36 3.08 0.30 98 XMSubMetaI_00 6323 2.30 3.02 1.86 99 XM_SPF_SoftFail 6297 1.89 3.01 1.20 100 T_XMDrugObfuBody_14 6049 2.12 2.89 1.64 101 XM_B_SpammyWords4 6013 2.03 2.87 1.51 102 DKIM_INVALID 5991 2.44 2.86 2.18 103 URI_HEX 5931 2.05 2.83 1.57 104 XM_B_Phish66 5878 1.79 2.81 1.17 105 TR_XM_SpammyWords3 5843 1.26 2.79 0.31 106 URI_NOVOWEL 5788 2.31 2.76 2.02 107 T_XMDrugObfuBody_08 5774 2.12 2.76 1.73 108 T_XMHurry_00 5752 1.84 2.75 1.27 109 RCVD_IN_MSPIKE_H4 5746 5.32 2.74 6.91 110 TM2_M_URI_OPT_OUT 5684 2.30 2.71 2.04 111 URI_PHP_REDIR 5446 1.00 2.60 0.01 112 HK_RANDOM_REPLYTO 5315 1.04 2.54 0.11 113 T_FILL_THIS_FORM_SHORT 4966 1.20 2.37 0.48 114 SpammyFromTLD_01 4954 1.21 2.37 0.49 115 XM_DK_Undo_01 4712 1.64 2.25 1.26 116 XM_OfRef6 4335 1.13 2.07 0.55 117 T_REMOTE_IMAGE 4099 3.03 1.96 3.69 118 T_TooManySym_01 4028 4.74 1.92 6.48 119 RCVD_IN_IADB_LISTED 4007 4.09 1.91 5.43 120 RCVD_IN_MSPIKE_L5 3909 0.74 1.87 0.04 121 XMDiploma_00 3756 1.15 1.79 0.76 122 XMSexyCombo_01 3732 0.96 1.78 0.45 123 ALL_TRUSTED 3722 7.92 1.78 11.73 124 XMBrknScrpt_02 3712 1.47 1.77 1.28 125 XMStockSpam_06 3676 1.82 1.76 1.86 126 RCVD_IN_IADB_SPF 3654 3.71 1.74 4.92 127 RCVD_IN_IADB_DK 3509 3.39 1.68 4.44 128 RCVD_IN_IADB_SENDERID 3494 3.43 1.67 4.53 129 XM_CamelCaseFrm001 3490 1.80 1.67 1.89 130 XMBdyGiftCard01 3471 1.35 1.66 1.16 131 XM_B_Unsub2 3366 1.24 1.61 1.02 132 TR_XM_Base64_M1 3192 1.36 1.52 1.26 133 RELAYCOUNTRY_IN 3170 0.61 1.51 0.05 134 RELAYCOUNTRY_AU 3160 0.79 1.51 0.34 135 T_XMDrugObfuBody_00 3120 1.03 1.49 0.74 136 TR_Caps_n_Bayes_99 3113 0.80 1.49 0.38 137 MPART_ALT_DIFF_COUNT 3090 1.00 1.48 0.70 138 SHOPIFY_IMG_NOT_RCVD_SFY 2995 0.90 1.43 0.57 139 HTTPS_HTTP_MISMATCH 2978 0.81 1.42 0.43 140 MAILING_LIST_MULTI 2970 2.15 1.42 2.60 141 RCVD_IN_MSPIKE_L3 2924 0.84 1.40 0.49 142 FONT_INVIS_LONG_LINE 2919 0.59 1.39 0.09 143 BAYES_40 2869 2.95 1.37 3.93 144 TR_XM_FormFill 2852 0.52 1.36 0.01 145 XM_URI_RBL 2795 0.60 1.33 0.15 146 XM_ProductURIs 2788 1.72 1.33 1.95 147 TR_XM_BayesRelay 2735 0.50 1.31 0.00 148 URIBL_BLACK 2684 0.53 1.28 0.06 149 TR_XM_SB_Phish 2462 1.30 1.18 1.38 150 TR_XM_NoHeaderRelay 2384 0.51 1.14 0.12 151 HTML_MIME_NO_HTML_TAG 2352 1.07 1.12 1.03 152 TR_LOTS_OF_MONEY3 2291 0.62 1.09 0.32 153 THIS_AD 2283 0.73 1.09 0.51 154 RELAYCOUNTRY_AT 2277 0.58 1.09 0.26 155 TR_Mismatch_TLD_02 2272 0.46 1.09 0.07 156 TR_XM_PHPDW 2243 0.66 1.07 0.41 157 XMClaimOffer 2227 0.56 1.06 0.25 158 BAYES_20 2188 1.99 1.04 2.57 159 XMPhish14 2162 0.74 1.03 0.57 160 TR_XM_PHPForged 2151 0.62 1.03 0.37 161 HTML_TAG_BALANCE_BODY 2132 0.70 1.02 0.50 162 TR_XM_FormFill2 2117 0.61 1.01 0.37 163 XMSubPhish11 2113 1.23 1.01 1.36 164 XM_H_PHPOS 2111 0.61 1.01 0.36 165 XM_B_DNDMA 2096 0.88 1.00 0.80 166 XMPhish30 2090 0.83 1.00 0.73 167 XMHTMLBadTable_001 2074 0.68 0.99 0.48 168 XM_B_COPY_HTML 1962 0.84 0.94 0.78 169 TR_XM_Base64_L1 1937 0.61 0.93 0.42 170 XM_RXBody 1935 0.64 0.92 0.46 171 RCVD_IN_RP_SAFE 1902 1.29 0.91 1.53 172 XMSubMetaSxObfu_03 1892 0.58 0.90 0.38 173 XM_UB99 1873 0.35 0.89 0.01 174 XMGenDplmaNmb 1813 0.52 0.87 0.31 175 RCVD_IN_VALIDITY_RPBL 1807 0.38 0.86 0.08 176 XM_B_COVIDMETA 1795 0.65 0.86 0.53 177 DATE_IN_PAST_12_24 1783 0.34 0.85 0.03 178 MISSING_HEADERS 1740 0.70 0.83 0.62 179 XMSubMetaSSx_00 1717 0.40 0.82 0.14 180 TR_MetaPhish_Combo_01 1705 0.72 0.81 0.66 181 XMBody_29 1668 0.38 0.80 0.12 182 XM_UB80 1632 0.31 0.78 0.02 183 XM_UB60 1626 0.35 0.78 0.09 184 XM_GoogleGroups 1620 0.97 0.77 1.09 185 XM_Body_Dirty_Words_01 1614 0.39 0.77 0.15 186 DIET_1 1610 0.54 0.77 0.39 187 T_TooManySym_02 1609 2.80 0.77 4.06 188 XM_B_SEO 1582 0.35 0.76 0.09 189 KHOP_HELO_FCRDNS 1562 0.63 0.75 0.55 190 RCVD_IN_RP_CERTIFIED 1538 1.15 0.73 1.40 191 XMHTML_After_End 1534 0.85 0.73 0.93 192 LOW_PRICE 1534 0.86 0.73 0.94 193 TR_XM_MSPIKECOMBO2 1532 0.31 0.73 0.05 194 HTML_FONT_FACE_BAD 1526 1.79 0.73 2.44 195 T_MONEY_PERCENT 1513 0.43 0.72 0.26 196 TR_LOTS_OF_MONEY2 1513 0.43 0.72 0.26 197 TR_XM_COVIDMETA4 1494 0.32 0.71 0.07 198 RCVD_IN_IADB_VOUCHED 1492 2.08 0.71 2.92 199 PLING_QUERY 1462 0.53 0.70 0.43 200 XMReplyNow 1454 0.46 0.69 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302709 92.38 97.00 89.51 2 RELAYCOUNTRY_US 286637 84.12 83.09 84.76 3 DKIM_SIGNED 280437 87.27 94.29 82.92 4 XM_DK_Pass 274772 85.44 92.20 81.25 5 DKIM_VALID 273060 84.83 91.43 80.74 6 XM_B_Unicode 266414 79.42 80.47 78.78 7 DKIM_VALID_AU 223341 67.24 69.19 66.04 8 XMListUnsubscribeExists 217357 70.69 81.06 64.27 9 BAYES_50 194613 48.50 33.89 57.55 10 XM_B_SpammyWords 175009 57.48 66.72 51.75 11 XM_B_Unicode3 173720 49.17 45.61 51.37 12 DCC_CHECK 169314 60.86 78.29 50.07 13 DCC_CHECK_NEGATIVE 168789 39.11 21.68 49.91 14 RCVD_IN_MSPIKE_H2 146031 45.45 49.12 43.18 15 HTML_FONT_LOW_CONTRAST 116792 38.57 45.10 34.54 16 LOC_TINY_FONT_1 114720 40.15 50.21 33.92 17 FVGT_m_MULTI_ODD 104039 32.40 35.04 30.76 18 DKIM_VALID_EF 91934 31.34 38.06 27.18 19 XM_B_SpammyWords2 80372 28.53 36.24 23.77 20 T_KAM_HTML_FONT_INVALID 77228 24.74 27.82 22.84 21 MIME_HTML_ONLY 72225 22.46 24.24 21.36 22 T_TM2_M_HEADER_IN_MSG 72032 19.29 16.05 21.30 23 RCVD_IN_MSPIKE_WL 67618 17.15 12.56 19.99 24 XMSubLong 64669 20.75 23.37 19.12 25 XM_Multi_Part_URI 62694 19.64 21.42 18.54 26 USER_IN_DEF_DKIM_WL 57967 11.93 3.52 17.14 27 XM_Body_Dirty_Words 44912 15.30 18.56 13.28 28 UNPARSEABLE_RELAY 43133 13.91 15.78 12.75 29 ALL_TRUSTED 39652 7.92 1.78 11.73 30 XM_DKIMWhitelistDomains 38750 7.09 0.04 11.46 31 RCVD_IN_MSPIKE_H3 38521 10.64 9.43 11.39 32 XM_Evil_Numbers_Gen 37144 10.51 9.76 10.98 33 BAYES_60 37053 9.91 8.23 10.96 34 LotsOfNums_01 35012 9.18 7.29 10.35 35 XM_DK_Undo_02 30543 25.85 53.02 9.03 36 XM_B_Unsub 29316 10.16 12.57 8.67 37 HTML_IMAGE_RATIO_02 28489 8.57 8.79 8.42 38 RCVD_IN_VALIDITY_SAFE 28360 6.64 3.82 8.39 39 XM_SendGrid 27202 8.21 8.47 8.04 40 RCVD_IN_VALIDITY_CERTIFIED 25543 5.87 3.16 7.55 41 BAYES_99 25175 19.74 39.60 7.44 42 TR_XM_BayesUnsub 25165 9.31 12.32 7.44 43 BAYES_00 23852 4.61 0.67 7.05 44 RCVD_IN_MSPIKE_H4 23363 5.32 2.74 6.91 45 LOTS_OF_MONEY 22567 7.03 7.61 6.67 46 T_TooManySym_01 21924 4.74 1.92 6.48 47 XM_B_SpammyWords3 21893 8.40 11.50 6.47 48 HTML_IMAGE_RATIO_04 21871 5.74 4.56 6.47 49 XM_H_Long_From01 20496 5.53 4.67 6.06 50 BAYES_999 20309 15.84 31.71 6.01 51 TR_XM_DK_Bayes 18574 3.60 0.55 5.49 52 IN_ZIMBRA_NJ_WHITELIST 18400 3.38 0.06 5.44 53 RCVD_IN_IADB_LISTED 18371 4.09 1.91 5.43 54 TR_XM_DK_SendGrid 18302 5.38 5.33 5.41 55 MPART_ALT_DIFF 18301 6.02 7.00 5.41 56 TR_XM_DKIM_Undo 18242 17.43 36.87 5.39 57 BAYES_80 18090 6.79 9.13 5.35 58 TR_XM_DK_Bayes1 17983 3.49 0.55 5.32 59 XM_B_Phish_Phrases 17963 5.11 4.78 5.31 60 MIME_QP_LONG_LINE 17469 4.47 3.35 5.17 61 BOTNET_IPINHOSTNAME 16818 8.82 15.03 4.97 62 RCVD_IN_IADB_SPF 16643 3.71 1.74 4.92 63 TR_XM_DK_Bayes2 16304 3.16 0.47 4.82 64 HTML_IMAGE_RATIO_06 15828 4.24 3.53 4.68 65 XMStrtUSub 15518 4.08 3.27 4.59 66 RCVD_IN_IADB_SENDERID 15306 3.43 1.67 4.53 67 TooManyTo_001 15252 7.34 11.92 4.51 68 RCVD_IN_IADB_DK 15028 3.39 1.68 4.44 69 XMSexyCombo_05 13990 5.52 7.77 4.14 70 SUBJ_ALL_CAPS 13941 4.01 3.82 4.12 71 T_TooManySym_02 13714 2.80 0.77 4.06 72 FROM_EXCESS_BASE64 13501 3.65 3.10 3.99 73 BAYES_40 13297 2.95 1.37 3.93 74 TR_XM_SpammyWords4 13292 4.92 6.51 3.93 75 XMNumbers 13262 3.60 3.08 3.92 76 RELAYCOUNTRY_META 12874 8.51 16.11 3.81 77 FSL_BULK_SIG 12524 5.25 7.74 3.70 78 T_REMOTE_IMAGE 12481 3.03 1.96 3.69 79 BAYES_95 12004 4.25 5.38 3.55 80 TR_DCC_Bayes_99 12003 14.26 31.56 3.55 81 HTML_IMAGE_RATIO_08 11626 3.77 4.31 3.44 82 XM_UncommonTLD01 11228 7.58 14.47 3.32 83 MIME_HTML_ONLY_MULTI 11047 3.20 3.08 3.27 84 TR_XM_UnparsRelay 10835 5.82 10.04 3.20 85 TR_XM_SpammyWords5 10055 3.77 5.05 2.97 86 MIME_HTML_MOSTLY 9987 3.71 4.94 2.95 87 RCVD_IN_IADB_VOUCHED 9885 2.08 0.71 2.92 88 TR_XM_PhishingBody 9497 3.83 5.48 2.81 89 XM_H_Trusted_IP 9141 1.67 0.00 2.70 90 MAILING_LIST_MULTI 8805 2.15 1.42 2.60 91 XMSubMetaSx_00 8797 4.14 6.61 2.60 92 BAYES_20 8699 1.99 1.04 2.57 93 XM_B_SpammyTLD 8608 6.83 13.74 2.55 94 HTML_FONT_FACE_BAD 8251 1.79 0.73 2.44 95 DKIM_INVALID 7377 2.44 2.86 2.18 96 TM2_M_URI_OPT_OUT 6912 2.30 2.71 2.04 97 URI_NOVOWEL 6839 2.31 2.76 2.02 98 XM_ProductURIs 6604 1.72 1.33 1.95 99 INVALID_MSGID 6566 1.24 0.09 1.94 100 XM_CamelCaseFrm001 6393 1.80 1.67 1.89 101 XM_PDF 6346 1.23 0.20 1.88 102 TR_XM_SpammyRelay 6307 5.95 12.55 1.86 103 XMStockSpam_06 6292 1.82 1.76 1.86 104 RCVD_IN_IADB_OPTIN 6286 1.31 0.42 1.86 105 XMSubMetaI_00 6284 2.30 3.02 1.86 106 MSGID_NOFQDN1 6191 1.14 0.02 1.83 107 UNTRUSTED_Relay 6080 3.75 6.90 1.80 108 IN_HORDE_ADDRESS_BOOK 6080 1.13 0.06 1.80 109 TO_MALFORMED 6016 1.11 0.03 1.78 110 TM2_M_VERY_LONG_WORD 5873 2.41 3.49 1.74 111 T_XMDrugObfuBody_08 5853 2.12 2.76 1.73 112 RCVD_IN_MSPIKE_H5 5734 1.19 0.38 1.70 113 T_TooManySym_03 5586 1.15 0.34 1.65 114 TVD_RCVD_IP 5576 1.11 0.24 1.65 115 T_XMDrugObfuBody_14 5556 2.12 2.89 1.64 116 BAYES_05 5398 1.25 0.69 1.60 117 URI_HEX 5321 2.05 2.83 1.57 118 RCVD_IN_RP_SAFE 5188 1.29 0.91 1.53 119 XM_B_SpammyWords4 5100 2.03 2.87 1.51 120 XMBody_95 5062 1.00 0.19 1.50 121 ANY_BOUNCE_MESSAGE 4905 1.04 0.38 1.45 122 BOUNCE_MESSAGE 4902 1.04 0.38 1.45 123 TVD_SPACE_RATIO 4748 0.89 0.05 1.40 124 RCVD_IN_RP_CERTIFIED 4743 1.15 0.73 1.40 125 TR_XM_SpammyWords2 4705 5.15 11.23 1.39 126 TR_XM_SB_Phish 4657 1.30 1.18 1.38 127 XMSubPhish11 4602 1.23 1.01 1.36 128 BOTNET 4556 5.19 11.40 1.35 129 XMBSHREFv2 4541 0.95 0.31 1.34 130 XMBrknScrpt_02 4312 1.47 1.77 1.28 131 T_XMHurry_00 4297 1.84 2.75 1.27 132 XM_DK_Undo_01 4254 1.64 2.25 1.26 133 TR_XM_Base64_M1 4254 1.36 1.52 1.26 134 XM_H_Long_From02 4226 1.00 0.59 1.25 135 XM_B_Investor 4082 1.93 3.11 1.21 136 XM_SPF_SoftFail 4045 1.89 3.01 1.20 137 XM_B_Phish66 3947 1.79 2.81 1.17 138 XMBdyGiftCard01 3937 1.35 1.66 1.16 139 XM_UB50 3714 1.93 3.27 1.10 140 XM_GoogleGroups 3680 0.97 0.77 1.09 141 HTML_MIME_NO_HTML_TAG 3496 1.07 1.12 1.03 142 XM_B_Unsub2 3441 1.24 1.61 1.02 143 RELAYCOUNTRY_CA 3416 3.48 7.46 1.01 144 LOW_PRICE 3181 0.86 0.73 0.94 145 TooManyTo_002 3166 0.73 0.40 0.94 146 XMGappySubj_01 3150 0.76 0.49 0.93 147 XMHTML_After_End 3146 0.85 0.73 0.93 148 FVGT_m_MULTI_ODD_EMAIL 2973 0.60 0.14 0.88 149 DKIM_ADSP_CUSTOM_MED 2924 0.72 0.48 0.86 150 TR_Symld_Words 2785 0.71 0.52 0.82 151 XM_B_DNDMA 2700 0.88 1.00 0.80 152 XM_B_COPY_HTML 2629 0.84 0.94 0.78 153 XMDiploma_00 2559 1.15 1.79 0.76 154 XMBody_17 2532 1.89 3.72 0.75 155 URI_TRY_3LD 2530 0.70 0.61 0.75 156 XMSubNoVowel 2517 0.63 0.45 0.74 157 T_XMDrugObfuBody_00 2494 1.03 1.49 0.74 158 XMPhish30 2470 0.83 1.00 0.73 159 XM_B_REG_HTML 2416 0.65 0.54 0.71 160 RCVD_IN_BL_SPAMCOP_NET 2368 4.43 10.46 0.70 161 MPART_ALT_DIFF_COUNT 2367 1.00 1.48 0.70 162 TR_MetaPhish_Combo_01 2221 0.72 0.81 0.66 163 TooManyTo_003 2195 0.53 0.35 0.65 164 XMNoVowels 2175 0.53 0.35 0.64 165 XMOemUri 2141 0.55 0.40 0.63 166 XMLngstWrd_00 2097 0.62 0.63 0.62 167 FORGED_GMAIL_RCVD 2088 0.53 0.39 0.62 168 MISSING_HEADERS 2081 0.70 0.83 0.62 169 RELAYCOUNTRY_GB 2008 0.52 0.41 0.59 170 RCVD_IN_PSBL 1991 0.57 0.54 0.59 171 RCVD_IN_MSPIKE_BL 1982 1.66 3.40 0.59 172 TR_XM_MSPIKECOMBO 1978 1.65 3.38 0.58 173 SHOPIFY_IMG_NOT_RCVD_SFY 1915 0.90 1.43 0.57 174 XMPhish14 1914 0.74 1.03 0.57 175 PDS_OTHER_BAD_TLD 1885 4.37 10.53 0.56 176 KHOP_HELO_FCRDNS 1873 0.63 0.75 0.55 177 XMLngstWrd_01 1853 0.57 0.61 0.55 178 XM_OfRef6 1852 1.13 2.07 0.55 179 HTML_IMAGE_ONLY_20 1817 0.43 0.25 0.54 180 XM_B_COVIDMETA 1791 0.65 0.86 0.53 181 NML_ADSP_CUSTOM_MED 1779 0.45 0.34 0.53 182 THIS_AD 1732 0.73 1.09 0.51 183 TooManyTo_004 1706 0.43 0.30 0.50 184 HTML_TAG_BALANCE_BODY 1679 0.70 1.02 0.50 185 RCVD_IN_MSPIKE_L3 1659 0.84 1.40 0.49 186 SpammyFromTLD_01 1656 1.21 2.37 0.49 187 XMHTMLBadTable_001 1625 0.68 0.99 0.48 188 T_FILL_THIS_FORM_SHORT 1616 1.20 2.37 0.48 189 XM_Ancestry_Forge 1608 0.29 0.00 0.48 190 XM_H_PHPMailer 1595 0.52 0.61 0.47 191 DATE_IN_PAST_03_06 1568 0.48 0.51 0.46 192 XM_RXBody 1559 0.64 0.92 0.46 193 XMSexyCombo_01 1526 0.96 1.78 0.45 194 XMSubMetaSxObfu_02 1509 0.38 0.27 0.45 195 T_Symld_Words_02 1496 0.43 0.41 0.44 196 XMLngstWrd_02 1491 0.49 0.57 0.44 197 HTTPS_HTTP_MISMATCH 1453 0.81 1.42 0.43 198 PLING_QUERY 1450 0.53 0.70 0.43 199 TooManyTo_005 1428 0.37 0.29 0.42 200 T_OBFU_PDF_ATTACH 1422 0.27 0.02 0.42 ----------------------------------------------------------------------