Email: 572122 Autolearn: 0 AvgScore: 3.35 AvgScanTime: 1.52 sec Spam: 172202 Autolearn: 0 AvgScore: 13.48 AvgScanTime: 1.70 sec Ham: 399920 Autolearn: 0 AvgScore: -1.00 AvgScanTime: 1.44 sec Time Spent Running SA: 241.44 hours Time Spent Processing Spam: 81.50 hours Time Spent Processing Ham: 159.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165060 87.03 95.85 83.23 2 DKIM_SIGNED 157860 76.02 91.67 69.28 3 XM_DK_Pass 155185 74.33 90.12 67.53 4 DKIM_VALID 153521 73.43 89.15 66.67 5 XM_B_Unicode 144060 70.77 83.66 65.23 6 RELAYCOUNTRY_US 138183 77.43 80.24 76.21 7 XMListUnsubscribeExists 125152 53.65 72.68 45.46 8 DCC_CHECK 123787 45.00 71.88 33.42 9 XM_B_SpammyWords 119407 52.23 69.34 44.86 10 DKIM_VALID_AU 116311 58.00 67.54 53.88 11 RCVD_IN_MSPIKE_H2 86826 40.79 50.42 36.64 12 XM_DK_Undo_02 75713 17.09 43.97 5.51 13 XM_B_Unicode3 75480 39.98 43.83 38.32 14 BAYES_50 71566 51.31 41.56 55.51 15 XM_B_SpammyWords2 67441 25.12 39.16 19.07 16 LOC_TINY_FONT_1 65922 27.16 38.28 22.38 17 FVGT_m_MULTI_ODD 65137 28.07 37.83 23.87 18 TR_XM_DKIM_Undo 61579 13.60 35.76 4.05 19 DKIM_VALID_EF 58958 27.96 34.24 25.26 20 HTML_FONT_LOW_CONTRAST 57794 27.83 33.56 25.36 21 BAYES_99 56115 12.66 32.59 4.08 22 MIME_HTML_ONLY 56061 22.48 32.56 18.15 23 T_KAM_HTML_FONT_INVALID 54558 21.47 31.68 17.08 24 DCC_CHECK_NEGATIVE 48360 54.96 28.08 66.53 25 BAYES_999 43330 9.79 25.16 3.18 26 TR_DCC_Bayes_99 41378 8.20 24.03 1.38 27 XMSubLong 41167 21.29 23.91 20.16 28 XM_Body_Dirty_Words 39677 13.87 23.04 9.92 29 RELAYCOUNTRY_META 35827 9.06 20.81 4.00 30 T_TM2_M_HEADER_IN_MSG 35543 27.92 20.64 31.06 31 XM_Multi_Part_URI 30991 13.56 18.00 11.65 32 RCVD_IN_MSPIKE_WL 29257 16.86 16.99 16.81 33 XM_B_Unsub 27619 10.23 16.04 7.73 34 TR_XM_BayesUnsub 27050 8.77 15.71 5.79 35 TR_XM_SpammyRelay 25231 5.59 14.65 1.69 36 UNPARSEABLE_RELAY 24812 10.30 14.41 8.53 37 RCVD_IN_MSPIKE_H3 23568 11.26 13.69 10.22 38 BOTNET_IPINHOSTNAME 22430 6.72 13.03 4.01 39 XM_B_SpammyWords3 21113 6.69 12.26 4.29 40 LOTS_OF_MONEY 19569 10.59 11.36 10.25 41 TR_XM_SpammyWords2 19460 3.89 11.30 0.69 42 XMSexyCombo_05 18745 5.42 10.89 3.07 43 RELAYCOUNTRY_CA 17458 3.87 10.14 1.17 44 TR_XM_SpammyWords4 17336 8.11 10.07 7.26 45 FSL_BULK_SIG 17272 5.74 10.03 3.89 46 MPART_ALT_DIFF 17103 6.19 9.93 4.57 47 RCVD_IN_BL_SPAMCOP_NET 16596 3.25 9.64 0.51 48 XM_Evil_Numbers_Gen 16470 8.50 9.56 8.04 49 BAYES_80 15483 5.60 8.99 4.14 50 TR_XM_UnparsRelay 15094 3.76 8.77 1.61 51 TR_XM_SPAMCOP 14663 2.74 8.51 0.25 52 XM_UncommonTLD01 13836 4.85 8.03 3.48 53 BOTNET 13771 3.46 8.00 1.50 54 BAYES_60 13425 8.38 7.80 8.64 55 UNTRUSTED_Relay 12385 3.22 7.19 1.51 56 XM_SendGrid 11885 5.59 6.90 5.03 57 LotsOfNums_01 11352 7.35 6.59 7.68 58 XM_B_SpammyTLD 11052 3.41 6.42 2.12 59 HTML_IMAGE_RATIO_02 10968 5.70 6.37 5.41 60 XM_B_Phish_Phrases 10763 4.33 6.25 3.50 61 XMSubMetaSx_00 10591 4.03 6.15 3.12 62 MIME_HTML_ONLY_MULTI 10334 3.64 6.00 2.63 63 TM2_M_VERY_LONG_WORD 10284 2.86 5.97 1.52 64 XM_H_Long_From01 10016 5.27 5.82 5.04 65 TR_XM_PhishingBody 10001 3.89 5.81 3.06 66 BAYES_95 9143 3.39 5.31 2.57 67 XM_B_Investor 8977 2.53 5.21 1.37 68 XMNumbers 8970 4.28 5.21 3.88 69 HTML_IMAGE_RATIO_04 8165 4.60 4.74 4.54 70 TooManyTo_001 8038 6.62 4.67 7.46 71 HTML_MIME_NO_HTML_TAG 8034 2.91 4.67 2.15 72 MIME_HTML_MOSTLY 7601 2.93 4.41 2.29 73 TR_XM_DK_SendGrid 7585 3.72 4.40 3.43 74 TR_XM_SpammyWords5 7525 2.13 4.37 1.17 75 XM_DIRTYINTL 7292 1.48 4.23 0.29 76 HTML_IMAGE_RATIO_06 6945 6.35 4.03 7.35 77 T_XMDrugObfuBody_08 6922 2.16 4.02 1.36 78 XMStrtUSub 6674 4.59 3.88 4.90 79 XMBody_17 6378 1.42 3.70 0.43 80 XM_GoogleGroups 6357 2.31 3.69 1.72 81 XM_SPF_SoftFail 6202 4.67 3.60 5.13 82 RCVD_IN_VALIDITY_SAFE 6095 4.34 3.54 4.69 83 XM_DK_Undo_01 6062 2.13 3.52 1.54 84 T_FILL_THIS_FORM_SHORT 6053 1.61 3.52 0.80 85 XM_UB50 6052 1.72 3.51 0.95 86 XMLngstWrd_00 5979 1.69 3.47 0.92 87 XMLngstWrd_01 5930 1.66 3.44 0.88 88 XM_B_Phish66 5905 2.21 3.43 1.69 89 SpammyFromTLD_02 5886 1.31 3.42 0.41 90 XMLngstWrd_02 5816 1.58 3.38 0.81 91 URIBL_DBL_SPAM 5779 1.03 3.36 0.02 92 XM_OfRef6 5730 1.66 3.33 0.94 93 T_XMDrugObfuBody_14 5685 1.84 3.30 1.22 94 HK_RANDOM_REPLYTO 5655 1.05 3.28 0.08 95 MIME_QP_LONG_LINE 5593 4.14 3.25 4.52 96 HTML_TITLE_SUBJ_DIFF 5471 1.33 3.18 0.54 97 TM2_M_URI_OPT_OUT 5470 5.84 3.18 6.99 98 URI_NOVOWEL 5464 2.30 3.17 1.92 99 XMLngstWrd_03 5420 1.48 3.15 0.76 100 XMLngstWrd_04 5363 1.43 3.11 0.70 101 RCVD_IN_MSPIKE_BL 5330 1.15 3.10 0.31 102 TR_XM_MSPIKECOMBO 5227 1.11 3.04 0.29 103 SpammyFromTLD_01 5212 1.46 3.03 0.78 104 HTML_IMAGE_RATIO_08 5210 2.31 3.03 2.00 105 UPPERCASE_75_100 5196 1.28 3.02 0.54 106 T_TooManySym_01 5073 5.30 2.95 6.32 107 PDS_OTHER_BAD_TLD 5066 1.00 2.94 0.16 108 RCVD_IN_MSPIKE_H4 4976 4.66 2.89 5.42 109 RCVD_IN_VALIDITY_CERTIFIED 4698 3.64 2.73 4.03 110 DKIM_INVALID 4339 2.59 2.52 2.62 111 XM_B_SpammyWords4 4161 1.08 2.42 0.50 112 TR_XM_SpammyWords3 4158 0.82 2.41 0.13 113 XM_CamelCaseFrm001 4138 2.18 2.40 2.08 114 XMSexyCombo_01 4097 0.95 2.38 0.34 115 XM_B_Unsub2 4088 1.74 2.37 1.46 116 USER_IN_DEF_DKIM_WL 4063 9.30 2.36 12.29 117 XMDiploma_00 3978 1.42 2.31 1.03 118 FROM_EXCESS_BASE64 3828 2.26 2.22 2.28 119 RCVD_IN_MSPIKE_L5 3621 0.66 2.10 0.04 120 TR_XM_FormFill 3592 0.63 2.09 0.01 121 URI_PHP_REDIR 3500 0.61 2.03 0.00 122 SUBJ_ALL_CAPS 3468 2.18 2.01 2.25 123 ALL_TRUSTED 3408 15.12 1.98 20.78 124 MAILING_LIST_MULTI 3307 2.31 1.92 2.48 125 TR_XM_PHPDW 3268 1.12 1.90 0.78 126 FONT_INVIS_LONG_LINE 3241 0.60 1.88 0.05 127 RCVD_IN_IADB_LISTED 3238 3.46 1.88 4.14 128 XM_H_Undi_Recip 3229 0.71 1.88 0.20 129 TR_XM_PHPForged 3185 1.08 1.85 0.75 130 TR_XM_FormFill2 3160 1.07 1.84 0.74 131 XM_H_PHPOS 3150 1.07 1.83 0.74 132 T_XMHurry_00 3071 2.40 1.78 2.66 133 XM_B_COVIDMETA 3029 0.85 1.76 0.46 134 HTTPS_HTTP_MISMATCH 2964 0.99 1.72 0.67 135 RCVD_IN_IADB_SPF 2925 3.11 1.70 3.72 136 TR_XM_NoHeaderRelay 2908 0.60 1.69 0.13 137 RELAYCOUNTRY_IN 2872 0.55 1.67 0.06 138 XMBrknScrpt_02 2870 0.99 1.67 0.70 139 XM_URI_RBL 2839 0.59 1.65 0.13 140 RCVD_IN_IADB_DK 2790 2.79 1.62 3.29 141 XMStockSpam_06 2756 1.25 1.60 1.10 142 RCVD_IN_IADB_SENDERID 2742 2.82 1.59 3.35 143 URI_HEX 2731 1.28 1.59 1.15 144 TR_Symld_Words 2684 1.52 1.56 1.50 145 T_REMOTE_IMAGE 2649 3.21 1.54 3.93 146 XM_Body_Dirty_Words_01 2606 0.89 1.51 0.62 147 XMBdyGiftCard01 2545 1.11 1.48 0.95 148 T_XMDrugObfuBody_00 2524 0.90 1.47 0.65 149 BAYES_40 2456 3.45 1.43 4.32 150 TR_XM_SB_Phish 2447 1.63 1.42 1.72 151 XMReplyNow 2398 0.57 1.39 0.22 152 XMGenDplmaNmb 2375 0.84 1.38 0.60 153 TR_XM_BayesRelay 2359 0.41 1.37 0.00 154 URIBL_BLACK 2337 0.44 1.36 0.04 155 RELAYCOUNTRY_AU 2335 0.62 1.36 0.30 156 XMSubPhish11 2320 1.60 1.35 1.71 157 XMHTML_After_End 2307 1.01 1.34 0.87 158 XM_UB99 2209 0.39 1.28 0.01 159 TR_LOTS_OF_MONEY3 2193 0.56 1.27 0.26 160 MPART_ALT_DIFF_COUNT 2064 0.72 1.20 0.51 161 RCVD_IN_VALIDITY_RPBL 2063 0.42 1.20 0.08 162 XM_ProductURIs 2038 0.66 1.18 0.44 163 HTML_TAG_BALANCE_BODY 2007 0.89 1.17 0.77 164 T_TooManySym_02 1994 2.91 1.16 3.67 165 XM_OfRef7 1943 0.45 1.13 0.16 166 XMPhish30 1920 0.78 1.11 0.63 167 URI_TRY_3LD 1912 0.82 1.11 0.70 168 KHOP_HELO_FCRDNS 1907 3.49 1.11 4.51 169 BOTNET_NORDNS 1872 0.33 1.09 0.01 170 THIS_AD 1838 0.53 1.07 0.30 171 XM_B_DNDMA 1805 0.57 1.05 0.36 172 XM_B_SEO 1802 0.40 1.05 0.12 173 TR_XM_COVIDMETA1 1788 0.41 1.04 0.14 174 BAYES_20 1785 2.92 1.04 3.73 175 RELAYCOUNTRY_FR 1775 0.47 1.03 0.23 176 XMSubMetaI_00 1726 0.88 1.00 0.83 177 TR_XM_InvalidRelay 1723 0.32 1.00 0.03 178 TR_XM_SEO4 1679 0.33 0.98 0.06 179 XMSexyCombo_04 1638 0.34 0.95 0.08 180 XMHTMLBadTable_001 1630 0.60 0.95 0.45 181 XM_UB999 1626 0.29 0.94 0.00 182 XMBody_78 1618 0.50 0.94 0.30 183 REMOVE_BEFORE_LINK 1617 0.39 0.94 0.16 184 XM_UB60 1598 0.33 0.93 0.07 185 XMSubMetaSSx_00 1597 0.40 0.93 0.17 186 TR_XM_COVIDMETA4 1574 0.36 0.91 0.12 187 TR_XM_Base64_M1 1567 0.81 0.91 0.76 188 T_Symld_Words_02 1482 0.54 0.86 0.39 189 TR_MetaPhish_Combo_01 1427 0.58 0.83 0.48 190 FILL_THIS_FORM 1398 2.40 0.81 3.09 191 RCVD_IN_IADB_VOUCHED 1366 2.00 0.79 2.52 192 TR_XM_Base64_L1 1366 0.40 0.79 0.23 193 XM_B_REG_HTML 1364 0.44 0.79 0.29 194 T_TooManySym_03 1344 1.37 0.78 1.62 195 XM_UB80 1318 0.24 0.77 0.02 196 RELAYCOUNTRY_RU 1279 0.24 0.74 0.02 197 DIET_1 1278 0.40 0.74 0.25 198 XM_H_Long_From02 1277 1.11 0.74 1.27 199 LONGLN_LOW_CONTRAST 1270 0.35 0.74 0.19 200 PLING_QUERY 1264 0.50 0.73 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 332867 87.03 95.85 83.23 2 RELAYCOUNTRY_US 304786 77.43 80.24 76.21 3 DKIM_SIGNED 277070 76.02 91.67 69.28 4 XM_DK_Pass 270050 74.33 90.12 67.53 5 DKIM_VALID 266610 73.43 89.15 66.67 6 DCC_CHECK_NEGATIVE 266064 54.96 28.08 66.53 7 XM_B_Unicode 260859 70.77 83.66 65.23 8 BAYES_50 221981 51.31 41.56 55.51 9 DKIM_VALID_AU 215493 58.00 67.54 53.88 10 XMListUnsubscribeExists 181813 53.65 72.68 45.46 11 XM_B_SpammyWords 179406 52.23 69.34 44.86 12 XM_B_Unicode3 153243 39.98 43.83 38.32 13 RCVD_IN_MSPIKE_H2 146525 40.79 50.42 36.64 14 DCC_CHECK 133672 45.00 71.88 33.42 15 T_TM2_M_HEADER_IN_MSG 124213 27.92 20.64 31.06 16 HTML_FONT_LOW_CONTRAST 101433 27.83 33.56 25.36 17 DKIM_VALID_EF 101008 27.96 34.24 25.26 18 FVGT_m_MULTI_ODD 95453 28.07 37.83 23.87 19 LOC_TINY_FONT_1 89485 27.16 38.28 22.38 20 ALL_TRUSTED 83094 15.12 1.98 20.78 21 XMSubLong 80619 21.29 23.91 20.16 22 XM_B_SpammyWords2 76254 25.12 39.16 19.07 23 MIME_HTML_ONLY 72570 22.48 32.56 18.15 24 T_KAM_HTML_FONT_INVALID 68293 21.47 31.68 17.08 25 RCVD_IN_MSPIKE_WL 67230 16.86 16.99 16.81 26 BAYES_00 57779 10.32 0.73 14.45 27 USER_IN_DEF_DKIM_WL 49160 9.30 2.36 12.29 28 XM_Multi_Part_URI 46607 13.56 18.00 11.65 29 LOTS_OF_MONEY 41003 10.59 11.36 10.25 30 RCVD_IN_MSPIKE_H3 40878 11.26 13.69 10.22 31 IN_ZIMBRA_NJ_WHITELIST 40103 7.04 0.09 10.03 32 XM_Body_Dirty_Words 39660 13.87 23.04 9.92 33 BAYES_60 34542 8.38 7.80 8.64 34 XM_DKIMWhitelistDomains 34118 5.97 0.04 8.53 35 UNPARSEABLE_RELAY 34098 10.30 14.41 8.53 36 XM_Evil_Numbers_Gen 32172 8.50 9.56 8.04 37 XM_B_Unsub 30931 10.23 16.04 7.73 38 LotsOfNums_01 30715 7.35 6.59 7.68 39 TooManyTo_001 29839 6.62 4.67 7.46 40 HTML_IMAGE_RATIO_06 29392 6.35 4.03 7.35 41 TR_XM_SpammyWords4 29050 8.11 10.07 7.26 42 TM2_M_URI_OPT_OUT 27958 5.84 3.18 6.99 43 ANY_BOUNCE_MESSAGE 25954 4.71 0.57 6.49 44 BOUNCE_MESSAGE 25952 4.71 0.57 6.49 45 T_TooManySym_01 25255 5.30 2.95 6.32 46 TR_XM_DK_Bayes 24515 4.45 0.55 6.13 47 TR_XM_DK_Bayes1 24220 4.40 0.54 6.06 48 TR_XM_BayesUnsub 23137 8.77 15.71 5.79 49 XM_DK_Undo_02 22051 17.09 43.97 5.51 50 TR_XM_DK_Bayes2 21942 3.98 0.50 5.49 51 RCVD_IN_MSPIKE_H4 21681 4.66 2.89 5.42 52 HTML_IMAGE_RATIO_02 21649 5.70 6.37 5.41 53 XM_SPF_SoftFail 20508 4.67 3.60 5.13 54 XM_H_Long_From01 20153 5.27 5.82 5.04 55 XM_SendGrid 20113 5.59 6.90 5.03 56 XMStrtUSub 19582 4.59 3.88 4.90 57 RCVD_IN_VALIDITY_SAFE 18741 4.34 3.54 4.69 58 MPART_ALT_DIFF 18285 6.19 9.93 4.57 59 HTML_IMAGE_RATIO_04 18174 4.60 4.74 4.54 60 MIME_QP_LONG_LINE 18087 4.14 3.25 4.52 61 KHOP_HELO_FCRDNS 18036 3.49 1.11 4.51 62 HTML_FONT_FACE_BAD 17578 3.25 0.61 4.40 63 BAYES_40 17291 3.45 1.43 4.32 64 XM_B_SpammyWords3 17176 6.69 12.26 4.29 65 XM_PDF 16711 3.13 0.71 4.18 66 BAYES_80 16569 5.60 8.99 4.14 67 RCVD_IN_IADB_LISTED 16556 3.46 1.88 4.14 68 BAYES_99 16309 12.66 32.59 4.08 69 TR_XM_DKIM_Undo 16211 13.60 35.76 4.05 70 RCVD_IN_VALIDITY_CERTIFIED 16103 3.64 2.73 4.03 71 BOTNET_IPINHOSTNAME 16040 6.72 13.03 4.01 72 RELAYCOUNTRY_META 15992 9.06 20.81 4.00 73 T_REMOTE_IMAGE 15714 3.21 1.54 3.93 74 FSL_BULK_SIG 15568 5.74 10.03 3.89 75 XMNumbers 15498 4.28 5.21 3.88 76 BAYES_20 14922 2.92 1.04 3.73 77 RCVD_IN_IADB_SPF 14860 3.11 1.70 3.72 78 T_TooManySym_02 14668 2.91 1.16 3.67 79 XM_B_Phish_Phrases 14009 4.33 6.25 3.50 80 XM_UncommonTLD01 13898 4.85 8.03 3.48 81 TR_XM_DK_SendGrid 13703 3.72 4.40 3.43 82 RCVD_IN_IADB_SENDERID 13407 2.82 1.59 3.35 83 RCVD_IN_IADB_DK 13163 2.79 1.62 3.29 84 BAYES_999 12699 9.79 25.16 3.18 85 XMSubMetaSx_00 12458 4.03 6.15 3.12 86 FILL_THIS_FORM 12350 2.40 0.81 3.09 87 XMSexyCombo_05 12280 5.42 10.89 3.07 88 TR_XM_PhishingBody 12235 3.89 5.81 3.06 89 FILL_THIS_FORM_LONG 11579 2.15 0.43 2.90 90 T_XMHurry_00 10646 2.40 1.78 2.66 91 MIME_HTML_ONLY_MULTI 10499 3.64 6.00 2.63 92 DKIM_INVALID 10460 2.59 2.52 2.62 93 BAYES_95 10267 3.39 5.31 2.57 94 BAYES_05 10257 1.96 0.56 2.56 95 RCVD_IN_IADB_VOUCHED 10093 2.00 0.79 2.52 96 MAILING_LIST_MULTI 9910 2.31 1.92 2.48 97 MIME_HTML_MOSTLY 9163 2.93 4.41 2.29 98 FROM_EXCESS_BASE64 9113 2.26 2.22 2.28 99 SUBJ_ALL_CAPS 9009 2.18 2.01 2.25 100 HTML_MIME_NO_HTML_TAG 8588 2.91 4.67 2.15 101 XM_B_SpammyTLD 8464 3.41 6.42 2.12 102 XM_CamelCaseFrm001 8314 2.18 2.40 2.08 103 HTML_IMAGE_RATIO_08 8018 2.31 3.03 2.00 104 URI_NOVOWEL 7687 2.30 3.17 1.92 105 TooManyTo_002 7550 1.52 0.68 1.89 106 INVALID_MSGID 7018 1.28 0.17 1.75 107 XM_GoogleGroups 6886 2.31 3.69 1.72 108 TR_XM_SB_Phish 6876 1.63 1.42 1.72 109 IN_HORDE_ADDRESS_BOOK 6835 1.22 0.09 1.71 110 XMSubPhish11 6821 1.60 1.35 1.71 111 TR_XM_SpammyRelay 6776 5.59 14.65 1.69 112 RCVD_IN_IADB_OPTIN 6757 1.32 0.45 1.69 113 XM_B_Phish66 6757 2.21 3.43 1.69 114 MSGID_NOFQDN1 6513 1.15 0.03 1.63 115 T_TooManySym_03 6477 1.37 0.78 1.62 116 TR_XM_UnparsRelay 6423 3.76 8.77 1.61 117 XM_DK_Undo_01 6140 2.13 3.52 1.54 118 TM2_M_VERY_LONG_WORD 6098 2.86 5.97 1.52 119 HELO_NODOT 6052 1.24 0.59 1.51 120 HELO_NO_DOMAIN 6045 1.23 0.59 1.51 121 TO_MALFORMED 6039 1.06 0.02 1.51 122 UNTRUSTED_Relay 6032 3.22 7.19 1.51 123 TR_Symld_Words 6000 1.52 1.56 1.50 124 BOTNET 5997 3.46 8.00 1.50 125 XM_B_Unsub2 5841 1.74 2.37 1.46 126 TR_DCC_Bayes_99 5531 8.20 24.03 1.38 127 XM_B_Investor 5473 2.53 5.21 1.37 128 T_XMDrugObfuBody_08 5442 2.16 4.02 1.36 129 TVD_SPACE_RATIO 5179 0.95 0.15 1.30 130 TooManyTo_003 5122 1.07 0.57 1.28 131 XM_H_Long_From02 5073 1.11 0.74 1.27 132 T_XMDrugObfuBody_14 4862 1.84 3.30 1.22 133 RELAYCOUNTRY_CA 4694 3.87 10.14 1.17 134 RCVD_IN_MSPIKE_H5 4671 0.94 0.41 1.17 135 TR_XM_SpammyWords5 4671 2.13 4.37 1.17 136 XMGappySubj_01 4595 0.85 0.16 1.15 137 URI_HEX 4587 1.28 1.59 1.15 138 XMBody_95 4580 0.85 0.16 1.15 139 XMStockSpam_06 4392 1.25 1.60 1.10 140 XM_H_Trusted_IP 4220 0.74 0.00 1.06 141 TVD_RCVD_IP 4198 0.81 0.27 1.05 142 XMDiploma_00 4137 1.42 2.31 1.03 143 RCVD_IN_RP_SAFE 3909 0.88 0.67 0.98 144 XM_UB50 3800 1.72 3.51 0.95 145 XMBdyGiftCard01 3790 1.11 1.48 0.95 146 XM_OfRef6 3776 1.66 3.33 0.94 147 XMCapTrack 3761 0.75 0.31 0.94 148 XMLngstWrd_00 3697 1.69 3.47 0.92 149 TooManyTo_004 3673 0.79 0.50 0.92 150 XMLngstWrd_01 3539 1.66 3.44 0.88 151 XMHTML_After_End 3495 1.01 1.34 0.87 152 XMSubMetaI_00 3301 0.88 1.00 0.83 153 RCVD_IN_RP_CERTIFIED 3300 0.73 0.53 0.83 154 XMLngstWrd_02 3231 1.58 3.38 0.81 155 T_FILL_THIS_FORM_SHORT 3186 1.61 3.52 0.80 156 DKIM_ADSP_CUSTOM_MED 3168 0.76 0.69 0.79 157 FROM_GOV_DKIM_AU 3140 0.63 0.26 0.79 158 SpammyFromTLD_01 3126 1.46 3.03 0.78 159 TR_XM_PHPDW 3112 1.12 1.90 0.78 160 HTML_TAG_BALANCE_BODY 3070 0.89 1.17 0.77 161 TR_XM_Base64_M1 3053 0.81 0.91 0.76 162 XMLngstWrd_03 3042 1.48 3.15 0.76 163 FVGT_m_MULTI_ODD_EMAIL 3014 0.57 0.13 0.75 164 XMBSHREFv2 2990 0.62 0.34 0.75 165 TR_XM_PHPForged 2983 1.08 1.85 0.75 166 TR_XM_FormFill2 2977 1.07 1.84 0.74 167 XM_H_PHPOS 2947 1.07 1.83 0.74 168 TooManyTo_005 2936 0.65 0.44 0.73 169 XMBrknScrpt_02 2813 0.99 1.67 0.70 170 URI_TRY_3LD 2806 0.82 1.11 0.70 171 XMLngstWrd_04 2803 1.43 3.11 0.70 172 TR_XM_SpammyWords2 2770 3.89 11.30 0.69 173 HTTPS_HTTP_MISMATCH 2694 0.99 1.72 0.67 174 T_XMDrugObfuBody_00 2611 0.90 1.47 0.65 175 XMPhish30 2525 0.78 1.11 0.63 176 T_OBFU_PDF_ATTACH 2465 0.46 0.09 0.62 177 XM_Body_Dirty_Words_01 2462 0.89 1.51 0.62 178 XMGenDplmaNmb 2405 0.84 1.38 0.60 179 XMSubNoVowel 2389 0.55 0.45 0.60 180 XM_B_COPY_HTML 2361 0.62 0.69 0.59 181 XM_ShortIntro_01 2360 0.51 0.34 0.59 182 XMNoVowels 2279 0.59 0.63 0.57 183 UPPERCASE_75_100 2150 1.28 3.02 0.54 184 HTML_TITLE_SUBJ_DIFF 2143 1.33 3.18 0.54 185 NML_ADSP_CUSTOM_MED 2082 0.52 0.52 0.52 186 MPART_ALT_DIFF_COUNT 2048 0.72 1.20 0.51 187 XMOemUri 2043 0.43 0.24 0.51 188 RCVD_IN_BL_SPAMCOP_NET 2026 3.25 9.64 0.51 189 XM_B_SpammyWords4 2019 1.08 2.42 0.50 190 RELAYCOUNTRY_GB 1996 0.55 0.67 0.50 191 BASE64_LENGTH_79_INF 1954 0.56 0.72 0.49 192 XM_H_PHPMailer 1952 0.54 0.66 0.49 193 TR_MetaPhish_Combo_01 1915 0.58 0.83 0.48 194 HTML_IMAGE_ONLY_20 1914 0.50 0.55 0.48 195 XM_B_COVIDMETA 1833 0.85 1.76 0.46 196 FORGED_GMAIL_RCVD 1782 0.48 0.57 0.45 197 XMHTMLBadTable_001 1780 0.60 0.95 0.45 198 XM_ProductURIs 1759 0.66 1.18 0.44 199 SHORT_HELO_AND_INLINE_IMAGE 1745 0.33 0.07 0.44 200 XMBody_17 1731 1.42 3.70 0.43 ----------------------------------------------------------------------