Email: 492501 Autolearn: 0 AvgScore: 1.32 AvgScanTime: 1.25 sec Spam: 137661 Autolearn: 0 AvgScore: 13.53 AvgScanTime: 1.40 sec Ham: 354840 Autolearn: 0 AvgScore: -3.41 AvgScanTime: 1.19 sec Time Spent Running SA: 170.54 hours Time Spent Processing Spam: 53.64 hours Time Spent Processing Ham: 116.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133006 90.39 96.62 87.98 2 DKIM_SIGNED 127061 72.07 92.30 64.22 3 XM_DK_Pass 123547 70.14 89.75 62.53 4 DKIM_VALID 122476 69.39 88.97 61.80 5 XM_B_Unicode 113840 76.55 82.70 74.16 6 RELAYCOUNTRY_US 113563 82.23 82.49 82.13 7 XMListUnsubscribeExists 102900 52.23 74.75 43.50 8 DCC_CHECK 97578 42.96 70.88 32.13 9 XM_B_SpammyWords 95820 50.31 69.61 42.83 10 DKIM_VALID_AU 93183 55.16 67.69 50.30 11 XM_DK_Undo_02 66515 17.64 48.32 5.74 12 XM_B_Unicode3 59844 45.22 43.47 45.90 13 LOC_TINY_FONT_1 56824 27.26 41.28 21.83 14 XM_B_SpammyWords2 56616 23.51 41.13 16.67 15 FVGT_m_MULTI_ODD 53989 27.76 39.22 23.31 16 BAYES_50 53961 49.07 39.20 52.89 17 BAYES_99 53236 14.14 38.67 4.63 18 TR_XM_DKIM_Undo 50313 12.00 36.55 2.48 19 MIME_HTML_ONLY 46448 26.65 33.74 23.90 20 HTML_FONT_LOW_CONTRAST 46072 27.56 33.47 25.27 21 BAYES_999 43607 11.39 31.68 3.52 22 DKIM_VALID_EF 42559 26.04 30.92 24.15 23 T_KAM_HTML_FONT_INVALID 40706 20.56 29.57 17.06 24 TR_DCC_Bayes_99 40173 9.37 29.18 1.68 25 DCC_CHECK_NEGATIVE 40063 57.01 29.10 67.83 26 RCVD_IN_MSPIKE_H2 39375 21.75 28.60 19.09 27 RCVD_IN_MSPIKE_WL 39106 26.33 28.41 25.53 28 RCVD_IN_MSPIKE_H3 32699 20.52 23.75 19.26 29 XM_Body_Dirty_Words 30467 13.09 22.13 9.58 30 TR_XM_DK_Unsub 30221 14.82 21.95 12.05 31 XMSubLong 28353 21.02 20.60 21.18 32 RELAYCOUNTRY_META 27915 8.44 20.28 3.85 33 T_TM2_M_HEADER_IN_MSG 27354 21.89 19.87 22.68 34 XM_Multi_Part_URI 24865 13.41 18.06 11.60 35 LOTS_OF_MONEY 21925 8.79 15.93 6.02 36 TR_XM_SpammyWords2 21077 4.66 15.31 0.53 37 UNPARSEABLE_RELAY 19990 9.46 14.52 7.50 38 XM_B_Unsub 19736 9.09 14.34 7.06 39 TR_XM_SpammyWords4 19622 6.91 14.25 4.07 40 TR_XM_BayesUnsub 19051 7.65 13.84 5.25 41 TR_XM_SpammyRelay 18773 5.19 13.64 1.92 42 XM_B_SpammyWords3 17161 6.56 12.47 4.26 43 BOTNET_IPINHOSTNAME 16702 6.80 12.13 4.73 44 RELAYCOUNTRY_CA 14244 4.03 10.35 1.59 45 MPART_ALT_DIFF 14206 10.99 10.32 11.25 46 RCVD_IN_BL_SPAMCOP_NET 13305 2.99 9.67 0.40 47 XMSexyCombo_05 12833 4.87 9.32 3.15 48 XM_Evil_Numbers_Gen 12791 9.17 9.29 9.12 49 FSL_BULK_SIG 12758 4.54 9.27 2.71 50 TR_XM_UnparsRelay 12442 3.49 9.04 1.34 51 XM_UncommonTLD01 12276 4.97 8.92 3.44 52 TR_XM_SPAMCOP 11608 2.53 8.43 0.24 53 TM2_M_VERY_LONG_WORD 11035 3.18 8.02 1.31 54 MIME_HTML_ONLY_MULTI 10602 9.05 7.70 9.57 55 BOTNET 10492 3.19 7.62 1.47 56 XM_SendGrid 10444 4.99 7.59 3.99 57 BAYES_80 10324 4.79 7.50 3.73 58 TR_XM_PhishingBody 9702 4.18 7.05 3.06 59 BAYES_60 9384 7.67 6.82 8.00 60 XMSubMetaSx_00 8949 4.31 6.50 3.46 61 HTML_MIME_NO_HTML_TAG 8916 3.43 6.48 2.25 62 HTML_IMAGE_RATIO_02 8456 5.10 6.14 4.69 63 XM_B_Phish_Phrases 7954 3.89 5.78 3.16 64 XM_GoogleGroups 7906 2.55 5.74 1.30 65 XMLngstWrd_00 7901 2.32 5.74 1.00 66 XMLngstWrd_01 7834 2.25 5.69 0.91 67 LotsOfNums_01 7832 6.77 5.69 7.19 68 XMLngstWrd_02 7680 2.14 5.58 0.80 69 UNTRUSTED_Relay 7370 2.39 5.35 1.25 70 HTML_IMAGE_RATIO_04 7346 14.09 5.34 17.49 71 XMLngstWrd_03 7216 1.96 5.24 0.69 72 XMLngstWrd_04 7156 1.89 5.20 0.60 73 HTML_TITLE_SUBJ_DIFF 7152 1.74 5.20 0.40 74 XM_H_Long_From01 7081 4.80 5.14 4.66 75 UPPERCASE_75_100 7022 1.71 5.10 0.39 76 XMNumbers 6918 4.13 5.03 3.78 77 HTML_IMAGE_RATIO_06 6261 5.71 4.55 6.16 78 XM_B_SpammyTLD 6217 2.84 4.52 2.19 79 TR_LOTS_OF_MONEY3 6199 1.95 4.50 0.96 80 TR_XM_DK_SendGrid 6024 3.16 4.38 2.68 81 XMBody_17 6012 1.48 4.37 0.35 82 BAYES_95 6007 2.89 4.36 2.32 83 TooManyTo_001 5998 6.28 4.36 7.02 84 XM_B_Phish66 5769 2.36 4.19 1.65 85 TR_XM_SpammyWords5 5740 2.07 4.17 1.26 86 XM_B_Investor 5432 2.19 3.95 1.51 87 XM_DIRTYINTL 5241 1.37 3.81 0.43 88 RCVD_IN_VALIDITY_SAFE 5163 4.40 3.75 4.65 89 XMBrknScrpt_02 5146 1.55 3.74 0.71 90 SpammyFromTLD_01 5124 1.45 3.72 0.57 91 RCVD_IN_MSPIKE_BL 4917 1.29 3.57 0.41 92 TR_XM_MSPIKECOMBO 4851 1.28 3.52 0.41 93 XMStrtUSub 4842 10.15 3.52 12.72 94 XM_OfRef6 4672 1.61 3.39 0.92 95 HTML_IMAGE_RATIO_08 4662 2.28 3.39 1.86 96 DKIM_INVALID 4585 2.67 3.33 2.42 97 RCVD_IN_VALIDITY_CERTIFIED 4531 4.10 3.29 4.41 98 MIME_HTML_MOSTLY 4497 2.48 3.27 2.18 99 XM_SPF_SoftFail 4477 1.97 3.25 1.47 100 T_XMDrugObfuBody_14 4388 1.88 3.19 1.37 101 SpammyFromTLD_02 4369 1.12 3.17 0.33 102 T_XMDrugObfuBody_08 4235 1.71 3.08 1.17 103 HK_RANDOM_REPLYTO 3974 0.96 2.89 0.21 104 URIBL_DBL_SPAM 3917 0.80 2.85 0.01 105 XMDiploma_00 3827 1.47 2.78 0.96 106 T_XMHurry_00 3647 1.25 2.65 0.70 107 RCVD_IN_MSPIKE_H5 3538 1.86 2.57 1.58 108 RCVD_IN_MSPIKE_L4 3479 0.75 2.53 0.06 109 MIME_QP_LONG_LINE 3477 3.59 2.53 4.01 110 USER_IN_DEF_DKIM_WL 3423 8.92 2.49 11.41 111 XM_UB50 3406 1.24 2.47 0.77 112 XM_B_SpammyWords4 3403 0.99 2.47 0.42 113 TM2_M_URI_OPT_OUT 3356 2.10 2.44 1.97 114 TR_XM_MSPIKECOMBO2 3312 0.69 2.41 0.03 115 XM_B_Unsub2 3301 1.73 2.40 1.47 116 XMSexyCombo_01 3233 1.39 2.35 1.02 117 TR_XM_SpammyWords3 3193 0.77 2.32 0.17 118 PDS_OTHER_BAD_TLD 3136 0.78 2.28 0.20 119 XMStockSpam_06 3121 1.42 2.27 1.09 120 XM_CamelCaseFrm001 3070 2.06 2.23 2.00 121 URI_PHP_REDIR 3065 0.62 2.23 0.00 122 T_REMOTE_IMAGE 3056 3.08 2.22 3.41 123 T_TooManySym_01 2903 5.29 2.11 6.53 124 T_FILL_THIS_FORM_SHORT 2871 1.36 2.09 1.08 125 RCVD_IN_MSPIKE_H4 2869 3.95 2.08 4.68 126 TR_XM_BayesRelay 2771 0.57 2.01 0.01 127 HTTPS_HTTP_MISMATCH 2734 0.97 1.99 0.58 128 FROM_EXCESS_BASE64 2732 2.10 1.98 2.15 129 TR_XM_SB_Phish 2651 1.77 1.93 1.71 130 XM_B_COVIDMETA 2534 0.86 1.84 0.49 131 URI_NOVOWEL 2490 1.54 1.81 1.43 132 TR_XM_NoHeaderRelay 2374 0.55 1.72 0.09 133 SUBJ_ALL_CAPS 2364 1.40 1.72 1.28 134 XMSubPhish11 2266 1.67 1.65 1.68 135 TR_XM_PHPDW 2259 0.86 1.64 0.56 136 TR_XM_PHPForged 2169 0.80 1.58 0.49 137 ALL_TRUSTED 2149 11.07 1.56 14.76 138 XMHTML_After_End 2123 0.90 1.54 0.65 139 URI_HEX 2122 1.12 1.54 0.95 140 TR_XM_FormFill2 2119 0.79 1.54 0.50 141 XM_H_PHPOS 2112 0.78 1.53 0.48 142 RCVD_IN_IADB_LISTED 2090 3.01 1.52 3.59 143 XM_URI_RBL 2016 0.53 1.46 0.17 144 RELAYCOUNTRY_AU 2014 0.62 1.46 0.29 145 URIBL_BLACK 1988 0.43 1.44 0.04 146 AC_BR_BONANZA 1980 0.41 1.44 0.02 147 BAYES_40 1915 3.96 1.39 4.95 148 RCVD_IN_IADB_SPF 1910 2.74 1.39 3.27 149 TR_BOTNET_NEGATE 1874 0.65 1.36 0.38 150 XMGenDplmaNmb 1873 0.72 1.36 0.47 151 XM_B_DNDMA 1820 0.58 1.32 0.30 152 RCVD_IN_IADB_DK 1813 2.50 1.32 2.96 153 MAILING_LIST_MULTI 1756 1.74 1.28 1.92 154 RCVD_IN_IADB_SENDERID 1755 2.53 1.27 3.02 155 FONT_INVIS_LONG_LINE 1739 0.42 1.26 0.09 156 XM_UB99 1728 0.35 1.26 0.00 157 SUBJ_DOLLARS 1721 0.57 1.25 0.31 158 XMBdyGiftCard01 1662 0.91 1.21 0.80 159 KHOP_HELO_FCRDNS 1653 1.02 1.20 0.95 160 XMReplyNow 1638 0.46 1.19 0.17 161 TR_XM_COVIDMETA1 1633 0.50 1.19 0.24 162 MPART_ALT_DIFF_COUNT 1626 0.69 1.18 0.50 163 T_XMDrugObfuBody_00 1626 1.13 1.18 1.11 164 TR_Symld_Words 1609 1.21 1.17 1.23 165 XMPhish30 1606 0.88 1.17 0.77 166 TR_XM_FormFill 1596 0.34 1.16 0.03 167 TR_XM_INV_DKIM 1593 0.35 1.16 0.04 168 XM_DK_Undo_01 1574 1.29 1.14 1.35 169 DIET_1 1566 0.56 1.14 0.33 170 BOTNET_NORDNS 1523 0.32 1.11 0.01 171 XMSubMetaI_00 1501 0.71 1.09 0.56 172 TR_MetaPhish_Combo_01 1485 0.79 1.08 0.68 173 HTML_IMAGE_ONLY_20 1469 0.52 1.07 0.30 174 XM_Body_Dirty_Words_01 1466 0.38 1.06 0.12 175 TR_XM_COVIDMETA4 1458 0.40 1.06 0.15 176 BAYES_20 1427 3.92 1.04 5.03 177 TR_XM_Base64_M1 1416 0.72 1.03 0.60 178 XM_H_Long_From02 1411 0.85 1.02 0.79 179 RCVD_IN_VALIDITY_RPBL 1386 0.33 1.01 0.07 180 XM_UB999 1370 0.28 1.00 0.00 181 URI_TRY_3LD 1359 0.68 0.99 0.56 182 XMClaimOffer 1345 0.34 0.98 0.09 183 HTML_TAG_BALANCE_BODY 1317 0.56 0.96 0.40 184 TR_XM_Spammywords 1316 0.41 0.96 0.20 185 XM_S_SpammyWords 1316 0.41 0.96 0.20 186 RELAYCOUNTRY_RU 1304 0.28 0.95 0.02 187 REMOVE_BEFORE_LINK 1292 0.39 0.94 0.18 188 XMBody_78 1223 0.42 0.89 0.24 189 XM_H_PHPMailer 1219 0.62 0.89 0.51 190 HTML_FONT_FACE_BAD 1214 12.83 0.88 17.47 191 RCVD_IN_MSPIKE_L3 1195 0.48 0.87 0.34 192 XMSexyCombo_04 1178 0.69 0.86 0.63 193 XM_B_REG_HTML 1171 0.42 0.85 0.26 194 TR_XM_InvalidRelay 1167 0.25 0.85 0.01 195 TM2_M_OBFU_COMMENT 1135 0.39 0.82 0.22 196 XM_B_COPY_HTML 1133 0.72 0.82 0.68 197 TR_LOTS_OF_MONEY2 1107 0.43 0.80 0.28 198 T_MONEY_PERCENT 1107 0.43 0.80 0.28 199 BOUNCE_MESSAGE 1098 2.75 0.80 3.51 200 ANY_BOUNCE_MESSAGE 1098 2.75 0.80 3.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312174 90.39 96.62 87.98 2 RELAYCOUNTRY_US 291416 82.23 82.49 82.13 3 XM_B_Unicode 263161 76.55 82.70 74.16 4 DCC_CHECK_NEGATIVE 240703 57.01 29.10 67.83 5 DKIM_SIGNED 227861 72.07 92.30 64.22 6 XM_DK_Pass 221899 70.14 89.75 62.53 7 DKIM_VALID 219279 69.39 88.97 61.80 8 BAYES_50 187692 49.07 39.20 52.89 9 DKIM_VALID_AU 178484 55.16 67.69 50.30 10 XM_B_Unicode3 162882 45.22 43.47 45.90 11 XMListUnsubscribeExists 154340 52.23 74.75 43.50 12 XM_B_SpammyWords 151972 50.31 69.61 42.83 13 DCC_CHECK 113993 42.96 70.88 32.13 14 RCVD_IN_MSPIKE_WL 90577 26.33 28.41 25.53 15 HTML_FONT_LOW_CONTRAST 89673 27.56 33.47 25.27 16 DKIM_VALID_EF 85700 26.04 30.92 24.15 17 MIME_HTML_ONLY 84803 26.65 33.74 23.90 18 FVGT_m_MULTI_ODD 82714 27.76 39.22 23.31 19 T_TM2_M_HEADER_IN_MSG 80467 21.89 19.87 22.68 20 LOC_TINY_FONT_1 77454 27.26 41.28 21.83 21 XMSubLong 75164 21.02 20.60 21.18 22 RCVD_IN_MSPIKE_H3 68352 20.52 23.75 19.26 23 RCVD_IN_MSPIKE_H2 67737 21.75 28.60 19.09 24 HTML_IMAGE_RATIO_04 62055 14.09 5.34 17.49 25 HTML_FONT_FACE_BAD 61995 12.83 0.88 17.47 26 T_KAM_HTML_FONT_INVALID 60542 20.56 29.57 17.06 27 XM_B_SpammyWords2 59167 23.51 41.13 16.67 28 XM_H_Trusted_IP 57501 11.68 0.00 16.20 29 ALL_TRUSTED 52369 11.07 1.56 14.76 30 BAYES_00 51099 10.53 0.57 14.40 31 XMStrtUSub 45130 10.15 3.52 12.72 32 TR_XM_DK_Unsub 42757 14.82 21.95 12.05 33 XM_Multi_Part_URI 41159 13.41 18.06 11.60 34 USER_IN_DEF_DKIM_WL 40503 8.92 2.49 11.41 35 MPART_ALT_DIFF 39916 10.99 10.32 11.25 36 XM_Body_Dirty_Words 33992 13.09 22.13 9.58 37 MIME_HTML_ONLY_MULTI 33954 9.05 7.70 9.57 38 XM_Evil_Numbers_Gen 32371 9.17 9.29 9.12 39 BAYES_60 28403 7.67 6.82 8.00 40 XM_DKIMWhitelistDomains 27912 5.68 0.06 7.87 41 UNPARSEABLE_RELAY 26598 9.46 14.52 7.50 42 LotsOfNums_01 25514 6.77 5.69 7.19 43 XM_B_Unsub 25055 9.09 14.34 7.06 44 TooManyTo_001 24910 6.28 4.36 7.02 45 T_TooManySym_01 23156 5.29 2.11 6.53 46 HTML_IMAGE_RATIO_06 21851 5.71 4.55 6.16 47 LOTS_OF_MONEY 21355 8.79 15.93 6.02 48 XM_DK_Undo_02 20373 17.64 48.32 5.74 49 TR_XM_DK_Bayes 20071 4.17 0.35 5.66 50 TR_XM_DK_Bayes1 19754 4.11 0.35 5.57 51 IN_ZIMBRA_NJ_WHITELIST 19312 3.94 0.05 5.44 52 XMSubNoVowel 19254 4.12 0.74 5.43 53 TR_XM_BayesUnsub 18623 7.65 13.84 5.25 54 BAYES_20 17860 3.92 1.04 5.03 55 BAYES_40 17582 3.96 1.39 4.95 56 TR_XM_DK_Bayes2 16808 3.49 0.28 4.74 57 BOTNET_IPINHOSTNAME 16776 6.80 12.13 4.73 58 HTML_IMAGE_RATIO_02 16652 5.10 6.14 4.69 59 RCVD_IN_MSPIKE_H4 16609 3.95 2.08 4.68 60 XM_H_Long_From01 16551 4.80 5.14 4.66 61 RCVD_IN_VALIDITY_SAFE 16494 4.40 3.75 4.65 62 BAYES_99 16428 14.14 38.67 4.63 63 RCVD_IN_VALIDITY_CERTIFIED 15660 4.10 3.29 4.41 64 XM_B_SpammyWords3 15125 6.56 12.47 4.26 65 T_TooManySym_02 14646 3.14 0.59 4.13 66 TR_XM_SpammyWords4 14430 6.91 14.25 4.07 67 BAYES_05 14292 3.03 0.45 4.03 68 MIME_QP_LONG_LINE 14227 3.59 2.53 4.01 69 XM_SendGrid 14152 4.99 7.59 3.99 70 XM_PDF 13767 3.01 0.78 3.88 71 RELAYCOUNTRY_META 13662 8.44 20.28 3.85 72 XMNumbers 13406 4.13 5.03 3.78 73 BAYES_80 13243 4.79 7.50 3.73 74 RCVD_IN_IADB_LISTED 12756 3.01 1.52 3.59 75 BAYES_999 12505 11.39 31.68 3.52 76 ANY_BOUNCE_MESSAGE 12446 2.75 0.80 3.51 77 BOUNCE_MESSAGE 12441 2.75 0.80 3.51 78 XMSubMetaSx_00 12260 4.31 6.50 3.46 79 XM_UncommonTLD01 12208 4.97 8.92 3.44 80 T_REMOTE_IMAGE 12117 3.08 2.22 3.41 81 RCVD_IN_IADB_SPF 11603 2.74 1.39 3.27 82 XM_B_Phish_Phrases 11210 3.89 5.78 3.16 83 XMSexyCombo_05 11166 4.87 9.32 3.15 84 TR_XM_PhishingBody 10869 4.18 7.05 3.06 85 RCVD_IN_IADB_SENDERID 10700 2.53 1.27 3.02 86 RCVD_IN_IADB_DK 10497 2.50 1.32 2.96 87 FSL_BULK_SIG 9601 4.54 9.27 2.71 88 TR_XM_DK_SendGrid 9527 3.16 4.38 2.68 89 XMSubLongNoVowel 8837 1.85 0.21 2.49 90 TR_XM_DKIM_Undo 8802 12.00 36.55 2.48 91 XMSubGarbage 8694 1.77 0.02 2.45 92 DKIM_INVALID 8582 2.67 3.33 2.42 93 BAYES_95 8240 2.89 4.36 2.32 94 HTML_MIME_NO_HTML_TAG 7987 3.43 6.48 2.25 95 XM_B_SpammyTLD 7779 2.84 4.52 2.19 96 MIME_HTML_MOSTLY 7736 2.48 3.27 2.18 97 FROM_EXCESS_BASE64 7626 2.10 1.98 2.15 98 RCVD_IN_IADB_VOUCHED 7240 1.66 0.69 2.04 99 XM_CamelCaseFrm001 7091 2.06 2.23 2.00 100 INVALID_MSGID 7070 1.50 0.24 1.99 101 TM2_M_URI_OPT_OUT 6980 2.10 2.44 1.97 102 MAILING_LIST_MULTI 6817 1.74 1.28 1.92 103 TR_XM_SpammyRelay 6801 5.19 13.64 1.92 104 HTML_IMAGE_RATIO_08 6589 2.28 3.39 1.86 105 TVD_SPACE_RATIO 6537 1.36 0.11 1.84 106 MSGID_NOFQDN1 6522 1.36 0.11 1.84 107 TooManyTo_002 6163 1.43 0.65 1.74 108 TVD_RCVD_IP 6102 1.30 0.23 1.72 109 TR_XM_SB_Phish 6059 1.77 1.93 1.71 110 TO_MALFORMED 5996 1.22 0.00 1.69 111 XMSubPhish11 5979 1.67 1.65 1.68 112 TR_DCC_Bayes_99 5960 9.37 29.18 1.68 113 XM_B_Phish66 5845 2.36 4.19 1.65 114 RELAYCOUNTRY_CA 5628 4.03 10.35 1.59 115 RCVD_IN_MSPIKE_H5 5616 1.86 2.57 1.58 116 XM_B_Investor 5363 2.19 3.95 1.51 117 T_TooManySym_03 5324 1.16 0.27 1.50 118 IN_HORDE_ADDRESS_BOOK 5260 1.09 0.08 1.48 119 BOTNET 5231 3.19 7.62 1.47 120 XM_SPF_SoftFail 5228 1.97 3.25 1.47 121 XM_B_Unsub2 5215 1.73 2.40 1.47 122 URI_NOVOWEL 5074 1.54 1.81 1.43 123 T_XMDrugObfuBody_14 4879 1.88 3.19 1.37 124 RCVD_IN_IADB_OPTIN 4818 1.10 0.42 1.36 125 XM_DK_Undo_01 4800 1.29 1.14 1.35 126 XMGappySubj_01 4789 1.01 0.12 1.35 127 TR_XM_UnparsRelay 4749 3.49 9.04 1.34 128 XMBody_95 4730 1.02 0.21 1.33 129 TM2_M_VERY_LONG_WORD 4633 3.18 8.02 1.31 130 XM_GoogleGroups 4629 2.55 5.74 1.30 131 SUBJ_ALL_CAPS 4543 1.40 1.72 1.28 132 TR_XM_SpammyWords5 4476 2.07 4.17 1.26 133 XM_E_Blogspot 4426 0.92 0.07 1.25 134 UNTRUSTED_Relay 4423 2.39 5.35 1.25 135 TR_Symld_Words 4359 1.21 1.17 1.23 136 XMBSHREFv2 4344 0.96 0.28 1.22 137 T_XMDrugObfuBody_08 4163 1.71 3.08 1.17 138 HELO_NODOT 4047 0.98 0.55 1.14 139 HELO_NO_DOMAIN 4043 0.97 0.55 1.14 140 TooManyTo_003 3974 0.96 0.53 1.12 141 T_XMDrugObfuBody_00 3933 1.13 1.18 1.11 142 XMStockSpam_06 3862 1.42 2.27 1.09 143 T_FILL_THIS_FORM_SHORT 3839 1.36 2.09 1.08 144 XMSexyCombo_01 3615 1.39 2.35 1.02 145 XMLngstWrd_00 3548 2.32 5.74 1.00 146 XMDiploma_00 3408 1.47 2.78 0.96 147 TR_LOTS_OF_MONEY3 3400 1.95 4.50 0.96 148 URI_HEX 3382 1.12 1.54 0.95 149 KHOP_HELO_FCRDNS 3377 1.02 1.20 0.95 150 RCVD_IN_RP_SAFE 3311 0.88 0.73 0.93 151 XM_OfRef6 3279 1.61 3.39 0.92 152 XMLngstWrd_01 3231 2.25 5.69 0.91 153 RCVD_IN_RP_CERTIFIED 3172 0.82 0.63 0.89 154 FVGT_m_MULTI_ODD_EMAIL 2928 0.63 0.13 0.83 155 XMBdyGiftCard01 2844 0.91 1.21 0.80 156 XMLngstWrd_02 2841 2.14 5.58 0.80 157 XM_H_Long_From02 2788 0.85 1.02 0.79 158 XMPhish30 2740 0.88 1.17 0.77 159 XM_UB50 2725 1.24 2.47 0.77 160 TR_MSPIKEBAYES00 2698 0.55 0.02 0.76 161 TooManyTo_004 2651 0.68 0.49 0.75 162 XMSubMetaSxObfu_03 2651 0.68 0.52 0.75 163 DKIM_ADSP_CUSTOM_MED 2554 0.71 0.68 0.72 164 XMCapTrack 2550 0.60 0.28 0.72 165 XMBrknScrpt_02 2507 1.55 3.74 0.71 166 T_XMHurry_00 2489 1.25 2.65 0.70 167 XMLngstWrd_03 2431 1.96 5.24 0.69 168 TR_MetaPhish_Combo_01 2399 0.79 1.08 0.68 169 XM_B_COPY_HTML 2398 0.72 0.82 0.68 170 FROM_GOV_DKIM_AU 2355 0.61 0.46 0.66 171 XMHTML_After_End 2308 0.90 1.54 0.65 172 XMSexyCombo_04 2238 0.69 0.86 0.63 173 XM_ShortIntro_01 2154 0.50 0.23 0.61 174 XMLngstWrd_04 2146 1.89 5.20 0.60 175 TR_XM_Base64_M1 2142 0.72 1.03 0.60 176 HTTPS_HTTP_MISMATCH 2051 0.97 1.99 0.58 177 TooManyTo_005 2038 0.54 0.46 0.57 178 SpammyFromTLD_01 2007 1.45 3.72 0.57 179 TR_XM_PHPDW 1994 0.86 1.64 0.56 180 XMSubMetaI_00 1989 0.71 1.09 0.56 181 URI_TRY_3LD 1981 0.68 0.99 0.56 182 TR_XM_SpammyWords2 1895 4.66 15.31 0.53 183 XM_H_PHPMailer 1818 0.62 0.89 0.51 184 MPART_ALT_DIFF_COUNT 1776 0.69 1.18 0.50 185 NML_ADSP_CUSTOM_MED 1767 0.51 0.55 0.50 186 T_OBFU_PDF_ATTACH 1762 0.38 0.10 0.50 187 TR_XM_FormFill2 1762 0.79 1.54 0.50 188 TR_XM_PHPForged 1747 0.80 1.58 0.49 189 T_MANY_PILL_PRICE 1736 0.35 0.01 0.49 190 XM_B_COVIDMETA 1726 0.86 1.84 0.49 191 XM_ProductURIs 1723 0.55 0.71 0.49 192 XM_H_PHPOS 1715 0.78 1.53 0.48 193 RCVD_IN_PSBL 1708 0.56 0.78 0.48 194 XMSlimDrugH 1701 0.47 0.45 0.48 195 XMNoVowels 1679 0.45 0.39 0.47 196 TR_XM_Base64_L1 1667 0.49 0.54 0.47 197 XMGenDplmaNmb 1655 0.72 1.36 0.47 198 LongTLD 1648 0.51 0.63 0.46 199 USER_IN_WHITELIST 1604 0.33 0.00 0.45 200 USER_IN_WELCOMELIST 1604 0.33 0.00 0.45 ----------------------------------------------------------------------