Email: 581077 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.35 sec Spam: 190487 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.51 sec Ham: 390590 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.27 sec Time Spent Running SA: 217.87 hours Time Spent Processing Spam: 80.09 hours Time Spent Processing Ham: 137.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 183533 90.03 96.35 86.95 2 DKIM_SIGNED 162908 79.00 85.52 75.82 3 XM_DK_Pass 159561 77.43 83.76 74.33 4 DKIM_VALID 155825 75.33 81.80 72.18 5 DCC_CHECK 149858 51.91 78.67 38.86 6 XM_B_Unicode 145190 72.03 76.22 69.98 7 RELAYCOUNTRY_US 139696 79.42 73.34 82.38 8 XMListUnsubscribeExists 132657 56.73 69.64 50.43 9 XM_B_SpammyWords 127594 51.56 66.98 44.04 10 DKIM_VALID_AU 118648 58.22 62.29 56.24 11 XM_DK_Undo_02 96648 22.32 50.74 8.46 12 XM_B_Unicode3 78302 41.29 41.11 41.38 13 TR_XM_DKIM_Undo 76123 16.97 39.96 5.76 14 BAYES_99 73080 16.65 38.36 6.06 15 XM_B_SpammyWords2 71988 24.94 37.79 18.67 16 LOC_TINY_FONT_1 70880 28.85 37.21 24.78 17 BAYES_50 67010 49.77 35.18 56.89 18 MIME_HTML_ONLY 63031 25.06 33.09 21.14 19 HTML_FONT_LOW_CONTRAST 62521 29.86 32.82 28.42 20 BAYES_999 59118 13.50 31.04 4.95 21 DKIM_VALID_EF 57798 28.71 30.34 27.91 22 TR_DCC_Bayes_99 57342 11.77 30.10 2.83 23 RCVD_IN_MSPIKE_H2 56609 26.91 29.72 25.54 24 FVGT_m_MULTI_ODD 53834 25.64 28.26 24.37 25 T_KAM_HTML_FONT_INVALID 51202 21.16 26.88 18.36 26 RELAYCOUNTRY_META 43104 10.62 22.63 4.77 27 XMSubLong 42186 21.32 22.15 20.92 28 RCVD_IN_MSPIKE_WL 40458 27.20 21.24 30.11 29 DCC_CHECK_NEGATIVE 37473 46.13 19.67 59.03 30 T_TM2_M_HEADER_IN_MSG 36998 25.95 19.42 29.13 31 XM_Body_Dirty_Words 35981 14.09 18.89 11.74 32 UNTRUSTED_Relay 34440 7.15 18.08 1.82 33 XM_UncommonTLD01 33932 8.02 17.81 3.24 34 BOTNET 29570 6.31 15.52 1.81 35 LOTS_OF_MONEY 28414 9.99 14.92 7.59 36 TR_XM_SpammyWords2 26918 5.35 14.13 1.07 37 XM_Multi_Part_URI 26851 12.25 14.10 11.36 38 FSL_BULK_SIG 26214 8.27 13.76 5.59 39 XM_B_Unsub 25614 10.70 13.45 9.36 40 TR_XM_SpammyWords4 25411 7.95 13.34 5.32 41 XM_B_SpammyWords3 23881 7.06 12.54 4.39 42 RCVD_IN_MSPIKE_H3 21986 14.58 11.54 16.06 43 BOTNET_IPINHOSTNAME 21358 7.08 11.21 5.06 44 XMSexyCombo_05 20440 6.28 10.73 4.10 45 MPART_ALT_DIFF 20360 6.90 10.69 5.05 46 SpammyFromTLD_02 20177 3.58 10.59 0.15 47 XM_Evil_Numbers_Gen 19973 9.13 10.49 8.47 48 RCVD_IN_BL_SPAMCOP_NET 17878 3.88 9.39 1.19 49 MIME_HTML_MOSTLY 17669 4.60 9.28 2.32 50 BAYES_60 17430 9.37 9.15 9.47 51 LotsOfNums_01 17430 8.62 9.15 8.36 52 HTML_IMAGE_RATIO_02 16984 7.77 8.92 7.21 53 RCVD_IN_MSPIKE_H4 16946 10.71 8.90 11.60 54 UNPARSEABLE_RELAY 16437 8.08 8.63 7.82 55 TR_XM_UnparsRelay 16027 7.04 8.41 6.37 56 T_REMOTE_IMAGE 15626 5.27 8.20 3.84 57 BAYES_80 15579 5.96 8.18 4.88 58 RELAYCOUNTRY_CA 14130 3.39 7.42 1.43 59 XM_B_Phish_Phrases 13853 4.94 7.27 3.81 60 XM_UB50 13693 3.10 7.19 1.11 61 KHOP_HELO_FCRDNS 13566 3.55 7.12 1.81 62 HTML_FONT_SIZE_LARGE 13379 2.39 7.02 0.13 63 HTML_SHORT_LINK_IMG_1 12834 2.22 6.74 0.02 64 XM_SendGrid 12698 6.99 6.67 7.14 65 HTML_IMAGE_ONLY_12 12609 2.33 6.62 0.24 66 BODY_URI_ONLY 12392 2.14 6.51 0.01 67 XMSubMetaSx_00 11379 4.56 5.97 3.87 68 XMNumbers 11143 4.09 5.85 3.23 69 TR_XM_PhishingBody 10886 3.72 5.71 2.75 70 XM_H_Long_From01 10784 5.70 5.66 5.72 71 URIBL_SBL_A 10623 3.00 5.58 1.74 72 SpammyFromTLD_01 10550 2.26 5.54 0.66 73 TR_XM_SpammyWords5 10053 2.83 5.28 1.63 74 TR_LOTS_OF_MONEY3 9468 2.30 4.97 0.99 75 TooManyTo_001 9438 7.22 4.95 8.32 76 XM_OfRef6 8959 2.12 4.70 0.86 77 RELAYCOUNTRY_FR 8817 1.69 4.63 0.26 78 RCVD_IN_RP_SAFE 8647 7.63 4.54 9.14 79 BAYES_95 8508 3.63 4.47 3.23 80 XMStrtUSub 8246 4.56 4.33 4.67 81 HTML_IMAGE_RATIO_06 8185 3.72 4.30 3.44 82 TM2_M_URI_OPT_OUT 8080 3.28 4.24 2.81 83 HTML_IMAGE_RATIO_04 8067 5.25 4.23 5.74 84 XM_DK_Undo_01 7944 2.35 4.17 1.46 85 XM_UB60 7747 1.44 4.07 0.15 86 TR_XM_DK_SendGrid 7441 4.32 3.91 4.53 87 XM_B_SpammyTLD 7407 2.60 3.89 1.98 88 DKIM_INVALID 7083 3.67 3.72 3.64 89 XMBody_17 6935 1.61 3.64 0.62 90 XM_UB99 6801 1.17 3.57 0.00 91 RCVD_IN_RP_CERTIFIED 6548 6.76 3.44 8.39 92 URI_HEX 6462 2.12 3.39 1.50 93 XM_B_Unsub2 6215 1.93 3.26 1.28 94 T_XMHurry_00 6183 1.51 3.25 0.67 95 TR_XM_MaxBayes 5936 1.04 3.12 0.03 96 XM_SPF_SoftFail 5919 2.27 3.11 1.87 97 MIME_HTML_ONLY_MULTI 5874 3.09 3.08 3.10 98 XMBdyGiftCard01 5694 1.24 2.99 0.39 99 XM_DIRTYINTL 5557 1.25 2.92 0.44 100 HTML_IMAGE_RATIO_08 5549 2.42 2.91 2.18 101 XM_UB999 5221 0.90 2.74 0.00 102 XM_B_Phish66 5151 2.05 2.70 1.73 103 MIME_QP_LONG_LINE 5135 4.25 2.70 5.01 104 T_FILL_THIS_FORM_SHORT 5101 1.50 2.68 0.93 105 XM_CamelCaseFrm001 5046 2.18 2.65 1.95 106 XMDiploma_00 5043 1.73 2.65 1.29 107 XMBrknScrpt_02 4865 1.22 2.55 0.57 108 T_TooManySym_01 4758 4.82 2.50 5.96 109 URIBL_DBL_SPAM 4737 0.82 2.49 0.01 110 T_XMDrugObfuBody_14 4641 2.16 2.44 2.02 111 SUBJ_ALL_CAPS 4405 1.85 2.31 1.63 112 TR_XM_BayesRelay 4360 0.77 2.29 0.03 113 RELAYCOUNTRY_DE 4244 1.04 2.23 0.45 114 TM2_M_VERY_LONG_WORD 4214 1.56 2.21 1.24 115 RCVD_IN_MSPIKE_BL 4129 0.79 2.17 0.12 116 TR_XM_MSPIKECOMBO 4092 0.78 2.15 0.12 117 FROM_EXCESS_BASE64 4030 2.83 2.12 3.18 118 URI_NOVOWEL 3988 2.40 2.09 2.55 119 T_XMDrugObfuBody_08 3920 2.03 2.06 2.01 120 RCVD_IN_IADB_LISTED 3797 3.84 1.99 4.74 121 DIET_1 3774 1.03 1.98 0.56 122 FORGED_GMAIL_RCVD 3772 1.05 1.98 0.59 123 XM_B_SpammyWords4 3743 0.94 1.96 0.45 124 XM_UB80 3692 0.66 1.94 0.04 125 BOTNET_NORDNS 3625 0.63 1.90 0.01 126 URI_PHP_REDIR 3529 0.61 1.85 0.00 127 XMSexyCombo_01 3423 1.21 1.80 0.93 128 BAYES_40 3380 3.44 1.77 4.25 129 TR_XM_FormFill 3361 0.60 1.76 0.03 130 TR_XM_PHPDW 3340 0.92 1.75 0.52 131 XM_B_COVIDMETA 3319 1.13 1.74 0.84 132 RCVD_IN_IADB_SPF 3309 3.34 1.74 4.12 133 RCVD_IN_RP_RNBL 3295 0.58 1.73 0.02 134 XMStockSpam_06 3181 1.40 1.67 1.27 135 TR_XM_PHPForged 3120 0.83 1.64 0.44 136 TR_XM_FormFill2 3096 0.83 1.63 0.44 137 XM_H_PHPOS 3085 0.82 1.62 0.43 138 RCVD_IN_IADB_DK 3070 2.92 1.61 3.56 139 XMSlimDrugH 3064 0.69 1.61 0.25 140 XMSubMetaI_00 3055 1.03 1.60 0.75 141 RCVD_IN_IADB_SENDERID 3053 3.01 1.60 3.70 142 TR_XM_SB_Phish 3047 1.89 1.60 2.03 143 XMSubPhish11 2956 1.84 1.55 1.98 144 URI_TRY_3LD 2894 1.25 1.52 1.12 145 URIBL_BLACK 2852 0.52 1.50 0.04 146 HK_RANDOM_REPLYTO 2826 0.64 1.48 0.22 147 TR_XM_INV_DKIM 2821 0.63 1.48 0.22 148 RCVD_IN_MSPIKE_L5 2742 0.51 1.44 0.06 149 MAILING_LIST_MULTI 2728 2.90 1.43 3.62 150 HTML_MIME_NO_HTML_TAG 2693 2.12 1.41 2.46 151 RCVD_IN_PSBL 2654 0.51 1.39 0.07 152 TR_XM_SpammyWords3 2619 0.50 1.37 0.07 153 HTTPS_HTTP_MISMATCH 2612 0.87 1.37 0.62 154 XMGenDplmaNmb 2565 0.90 1.35 0.69 155 XM_URI_RBL 2535 0.53 1.33 0.15 156 GOOGLE_DOC_SUSP 2518 0.44 1.32 0.00 157 XMPhish08 2478 0.56 1.30 0.20 158 TR_XM_COVIDMETA4 2437 0.72 1.28 0.45 159 PDS_OTHER_BAD_TLD 2435 0.81 1.28 0.58 160 ANY_BOUNCE_MESSAGE 2424 2.28 1.27 2.77 161 BOUNCE_MESSAGE 2422 2.27 1.27 2.76 162 T_XMDrugObfuBody_00 2413 0.70 1.27 0.43 163 BAYES_20 2373 2.45 1.25 3.04 164 URI_NO_WWW_BIZ_CGI 2354 0.42 1.24 0.02 165 XM_H_Long_From02 2330 1.04 1.22 0.96 166 RELAYCOUNTRY_IN 2272 0.46 1.19 0.11 167 TR_XM_COVIDMETA1 1967 0.51 1.03 0.26 168 XM_Body_Dirty_Words_01 1963 0.45 1.03 0.16 169 HTML_TAG_BALANCE_BODY 1911 0.61 1.00 0.42 170 NUMERIC_HTTP_ADDR 1906 0.50 1.00 0.26 171 TR_Sbj_FN_Bdy 1873 0.42 0.98 0.15 172 XM_UB95 1873 0.33 0.98 0.02 173 BAYES_00 1855 7.16 0.97 10.17 174 XMBody_78 1855 0.57 0.97 0.37 175 XM_Body_Obfu01 1850 0.50 0.97 0.27 176 HK_RANDOM_FROM 1843 0.39 0.97 0.11 177 XMSubMetaSxObfu_03 1809 0.62 0.95 0.46 178 XMWghtMeta_00 1803 0.36 0.95 0.07 179 TR_Caps_n_Bayes_99 1764 0.35 0.93 0.07 180 ALL_TRUSTED 1760 9.86 0.92 14.22 181 TR_XM_RelayPhish 1752 0.37 0.92 0.10 182 XMPhish14 1751 0.54 0.92 0.36 183 FILL_THIS_FORM 1751 0.47 0.92 0.25 184 RCVD_IN_IADB_VOUCHED 1737 2.24 0.91 2.89 185 TR_MetaPhish_Combo_01 1729 0.95 0.91 0.98 186 MPART_ALT_DIFF_COUNT 1729 0.59 0.91 0.43 187 XMMoneyMeta_00 1710 0.67 0.90 0.56 188 URI_OPTOUT_3LD 1705 0.33 0.90 0.06 189 XMSexyCombo_04 1675 0.71 0.88 0.63 190 T_Symld_Words_02 1674 0.64 0.88 0.52 191 MONEY_FORM 1649 0.29 0.87 0.01 192 TR_BOTNET_NEGATE 1645 0.51 0.86 0.34 193 XMLngstWrd_00 1633 0.56 0.86 0.42 194 XMHTML_After_End 1619 0.85 0.85 0.85 195 FROM_SUSPICIOUS_NTLD 1615 0.34 0.85 0.09 196 SUBJ_DOLLARS 1608 0.48 0.84 0.30 197 TO_IN_SUBJ 1575 0.28 0.83 0.02 198 XM_Combo_Sbj 1563 0.45 0.82 0.27 199 FROM_SUSPICIOUS_NTLD_FP 1533 0.32 0.80 0.08 200 RCVD_IN_MSPIKE_H5 1526 1.91 0.80 2.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 339619 90.03 96.35 86.95 2 RELAYCOUNTRY_US 321780 79.42 73.34 82.38 3 DKIM_SIGNED 296132 79.00 85.52 75.82 4 XM_DK_Pass 290339 77.43 83.76 74.33 5 DKIM_VALID 281914 75.33 81.80 72.18 6 XM_B_Unicode 273351 72.03 76.22 69.98 7 DCC_CHECK_NEGATIVE 230561 46.13 19.67 59.03 8 BAYES_50 222204 49.77 35.18 56.89 9 DKIM_VALID_AU 219674 58.22 62.29 56.24 10 XMListUnsubscribeExists 196981 56.73 69.64 50.43 11 XM_B_SpammyWords 172019 51.56 66.98 44.04 12 XM_B_Unicode3 161635 41.29 41.11 41.38 13 DCC_CHECK 151787 51.91 78.67 38.86 14 RCVD_IN_MSPIKE_WL 117589 27.20 21.24 30.11 15 T_TM2_M_HEADER_IN_MSG 113769 25.95 19.42 29.13 16 HTML_FONT_LOW_CONTRAST 111003 29.86 32.82 28.42 17 DKIM_VALID_EF 109014 28.71 30.34 27.91 18 RCVD_IN_MSPIKE_H2 99746 26.91 29.72 25.54 19 LOC_TINY_FONT_1 96788 28.85 37.21 24.78 20 FVGT_m_MULTI_ODD 95179 25.64 28.26 24.37 21 MIME_HTML_ONLY 82581 25.06 33.09 21.14 22 XMSubLong 81710 21.32 22.15 20.92 23 XM_B_SpammyWords2 72919 24.94 37.79 18.67 24 T_KAM_HTML_FONT_INVALID 71727 21.16 26.88 18.36 25 RCVD_IN_MSPIKE_H3 62722 14.58 11.54 16.06 26 ALL_TRUSTED 55560 9.86 0.92 14.22 27 XM_Body_Dirty_Words 45868 14.09 18.89 11.74 28 RCVD_IN_MSPIKE_H4 45289 10.71 8.90 11.60 29 XM_Multi_Part_URI 44354 12.25 14.10 11.36 30 BAYES_00 39733 7.16 0.97 10.17 31 BAYES_60 36992 9.37 9.15 9.47 32 XM_B_Unsub 36564 10.70 13.45 9.36 33 RCVD_IN_RP_SAFE 35711 7.63 4.54 9.14 34 XM_DKIMWhitelistDomains 35677 6.16 0.05 9.13 35 XM_Evil_Numbers_Gen 33066 9.13 10.49 8.47 36 XM_DK_Undo_02 33063 22.32 50.74 8.46 37 RCVD_IN_RP_CERTIFIED 32760 6.76 3.44 8.39 38 LotsOfNums_01 32656 8.62 9.15 8.36 39 TooManyTo_001 32508 7.22 4.95 8.32 40 UNPARSEABLE_RELAY 30530 8.08 8.63 7.82 41 LOTS_OF_MONEY 29649 9.99 14.92 7.59 42 TR_XM_DK_Bayes 28423 5.13 0.72 7.28 43 HTML_IMAGE_RATIO_02 28166 7.77 8.92 7.21 44 XM_SendGrid 27898 6.99 6.67 7.14 45 TR_XM_DK_Bayes1 27716 5.00 0.71 7.10 46 TR_XM_UnparsRelay 24864 7.04 8.41 6.37 47 TR_XM_DK_Bayes2 24134 4.35 0.60 6.18 48 BAYES_99 23653 16.65 38.36 6.06 49 T_TooManySym_01 23270 4.82 2.50 5.96 50 TR_XM_DKIM_Undo 22512 16.97 39.96 5.76 51 HTML_IMAGE_RATIO_04 22428 5.25 4.23 5.74 52 XM_H_Long_From01 22347 5.70 5.66 5.72 53 FSL_BULK_SIG 21831 8.27 13.76 5.59 54 IN_ZIMBRA_NJ_WHITELIST 20968 3.62 0.05 5.37 55 TR_XM_SpammyWords4 20785 7.95 13.34 5.32 56 BOTNET_IPINHOSTNAME 19756 7.08 11.21 5.06 57 MPART_ALT_DIFF 19715 6.90 10.69 5.05 58 MIME_QP_LONG_LINE 19583 4.25 2.70 5.01 59 BAYES_999 19316 13.50 31.04 4.95 60 BAYES_80 19063 5.96 8.18 4.88 61 XM_PDF 18877 3.51 0.80 4.83 62 RELAYCOUNTRY_META 18613 10.62 22.63 4.77 63 RCVD_IN_IADB_LISTED 18519 3.84 1.99 4.74 64 XMStrtUSub 18239 4.56 4.33 4.67 65 TR_XM_DK_SendGrid 17689 4.32 3.91 4.53 66 XM_B_SpammyWords3 17136 7.06 12.54 4.39 67 BAYES_40 16589 3.44 1.77 4.25 68 RCVD_IN_IADB_SPF 16088 3.34 1.74 4.12 69 XMSexyCombo_05 16031 6.28 10.73 4.10 70 XMSubMetaSx_00 15124 4.56 5.97 3.87 71 T_REMOTE_IMAGE 15010 5.27 8.20 3.84 72 XM_B_Phish_Phrases 14873 4.94 7.27 3.81 73 RCVD_IN_IADB_SENDERID 14456 3.01 1.60 3.70 74 DKIM_INVALID 14218 3.67 3.72 3.64 75 MAILING_LIST_MULTI 14142 2.90 1.43 3.62 76 RCVD_IN_IADB_DK 13921 2.92 1.61 3.56 77 HTML_IMAGE_RATIO_06 13436 3.72 4.30 3.44 78 T_TooManySym_02 12857 2.37 0.47 3.29 79 XM_UncommonTLD01 12654 8.02 17.81 3.24 80 BAYES_95 12614 3.63 4.47 3.23 81 XMNumbers 12601 4.09 5.85 3.23 82 FROM_EXCESS_BASE64 12415 2.83 2.12 3.18 83 XM_H_Trusted_IP 12371 2.13 0.00 3.17 84 MIME_HTML_ONLY_MULTI 12098 3.09 3.08 3.10 85 BAYES_20 11872 2.45 1.25 3.04 86 RCVD_IN_IADB_VOUCHED 11273 2.24 0.91 2.89 87 TR_DCC_Bayes_99 11043 11.77 30.10 2.83 88 TM2_M_URI_OPT_OUT 10963 3.28 4.24 2.81 89 ANY_BOUNCE_MESSAGE 10801 2.28 1.27 2.77 90 BOUNCE_MESSAGE 10795 2.27 1.27 2.76 91 TR_XM_PhishingBody 10736 3.72 5.71 2.75 92 URI_NOVOWEL 9942 2.40 2.09 2.55 93 HTML_MIME_NO_HTML_TAG 9617 2.12 1.41 2.46 94 RCVD_IN_MSPIKE_H5 9578 1.91 0.80 2.45 95 MIME_HTML_MOSTLY 9055 4.60 9.28 2.32 96 TVD_RCVD_IP 9053 1.61 0.14 2.32 97 HTML_IMAGE_RATIO_08 8520 2.42 2.91 2.18 98 TooManyTo_002 8265 1.60 0.54 2.12 99 TR_XM_SB_Phish 7914 1.89 1.60 2.03 100 T_XMDrugObfuBody_14 7909 2.16 2.44 2.02 101 BAYES_05 7866 1.57 0.67 2.01 102 T_XMDrugObfuBody_08 7863 2.03 2.06 2.01 103 XM_B_SpammyTLD 7729 2.60 3.89 1.98 104 XMSubPhish11 7727 1.84 1.55 1.98 105 XM_CamelCaseFrm001 7627 2.18 2.65 1.95 106 RCVD_IN_IADB_OPTIN 7550 1.49 0.59 1.93 107 XM_SPF_SoftFail 7287 2.27 3.11 1.87 108 UNTRUSTED_Relay 7101 7.15 18.08 1.82 109 BOTNET 7085 6.31 15.52 1.81 110 KHOP_HELO_FCRDNS 7069 3.55 7.12 1.81 111 INVALID_MSGID 6948 1.35 0.48 1.78 112 URIBL_SBL_A 6792 3.00 5.58 1.74 113 XM_B_Phish66 6758 2.05 2.70 1.73 114 HELO_NODOT 6624 1.31 0.51 1.70 115 HELO_NO_DOMAIN 6624 1.30 0.49 1.70 116 IN_HORDE_ADDRESS_BOOK 6570 1.15 0.06 1.68 117 XMNoVowels 6559 1.21 0.26 1.68 118 TR_XM_SpammyWords5 6369 2.83 5.28 1.63 119 MSGID_NOFQDN1 6357 1.11 0.05 1.63 120 SUBJ_ALL_CAPS 6349 1.85 2.31 1.63 121 TO_MALFORMED 6240 1.08 0.02 1.60 122 URI_HEX 5845 2.12 3.39 1.50 123 HELO_MISC_IP 5727 1.01 0.06 1.47 124 XM_DK_Undo_01 5718 2.35 4.17 1.46 125 RELAYCOUNTRY_CA 5588 3.39 7.42 1.43 126 USER_IN_DEF_DKIM_WL 5410 0.93 0.00 1.39 127 TooManyTo_003 5348 1.07 0.45 1.37 128 TR_Symld_Words 5319 1.16 0.76 1.36 129 XMBSHREFv2 5290 0.99 0.23 1.35 130 XMDiploma_00 5021 1.73 2.65 1.29 131 XM_B_Unsub2 4986 1.93 3.26 1.28 132 XMStockSpam_06 4977 1.40 1.67 1.27 133 XMSubNoVowel 4928 1.07 0.69 1.26 134 TM2_M_VERY_LONG_WORD 4846 1.56 2.21 1.24 135 RCVD_IN_BL_SPAMCOP_NET 4655 3.88 9.39 1.19 136 XM_GoogleGroups 4377 0.86 0.34 1.12 137 URI_TRY_3LD 4371 1.25 1.52 1.12 138 XM_UB50 4337 3.10 7.19 1.11 139 XMCapTrack 4292 0.83 0.28 1.10 140 HTML_FONT_FACE_BAD 4200 0.94 0.65 1.08 141 TR_XM_SpammyWords2 4160 5.35 14.13 1.07 142 XMGappySubj_01 4093 0.74 0.11 1.05 143 DKIM_ADSP_CUSTOM_MED 4017 0.95 0.80 1.03 144 TooManyTo_004 3976 0.81 0.39 1.02 145 TR_LOTS_OF_MONEY3 3871 2.30 4.97 0.99 146 TR_MetaPhish_Combo_01 3817 0.95 0.91 0.98 147 RELAYCOUNTRY_GB 3797 0.83 0.53 0.97 148 T_TooManySym_03 3760 0.70 0.17 0.96 149 XM_H_Long_From02 3739 1.04 1.22 0.96 150 T_FILL_THIS_FORM_SHORT 3641 1.50 2.68 0.93 151 XMSexyCombo_01 3635 1.21 1.80 0.93 152 TM2_M_BODY_EMPTY 3584 0.77 0.46 0.92 153 XMBody_95 3477 0.62 0.08 0.89 154 XM_OfRef6 3364 2.12 4.70 0.86 155 TVD_SPACE_RATIO 3337 0.59 0.04 0.85 156 XMHTML_After_End 3332 0.85 0.85 0.85 157 XM_B_COVIDMETA 3266 1.13 1.74 0.84 158 TooManyTo_005 3186 0.66 0.34 0.82 159 NML_ADSP_CUSTOM_MED 2971 0.73 0.68 0.76 160 XMSubMetaI_00 2933 1.03 1.60 0.75 161 XM_E_Blogspot 2870 0.51 0.05 0.73 162 TR_MSPIKEBAYES00 2822 0.51 0.09 0.72 163 XMGenDplmaNmb 2689 0.90 1.35 0.69 164 HTML_IMAGE_ONLY_20 2618 0.66 0.64 0.67 165 T_XMHurry_00 2599 1.51 3.25 0.67 166 SpammyFromTLD_01 2593 2.26 5.54 0.66 167 T_OBFU_PDF_ATTACH 2522 0.49 0.18 0.65 168 PLING_QUERY 2521 0.65 0.66 0.65 169 XMHTMLBadTable_001 2499 0.65 0.68 0.64 170 XM_ShortIntro_01 2493 0.55 0.35 0.64 171 XMSexyCombo_04 2455 0.71 0.88 0.63 172 XMBody_17 2441 1.61 3.64 0.62 173 HTTPS_HTTP_MISMATCH 2421 0.87 1.37 0.62 174 XM_SPF_Unknown 2412 0.63 0.65 0.62 175 FORGED_GMAIL_RCVD 2320 1.05 1.98 0.59 176 PDS_OTHER_BAD_TLD 2255 0.81 1.28 0.58 177 XMBrknScrpt_02 2241 1.22 2.55 0.57 178 RDNS_DYNAMIC 2240 0.65 0.79 0.57 179 DIET_1 2195 1.03 1.98 0.56 180 XM_ProductURIs 2188 0.59 0.66 0.56 181 XMMoneyMeta_00 2181 0.67 0.90 0.56 182 SHORT_HELO_AND_INLINE_IMAGE 2081 0.38 0.07 0.53 183 RCVD_IN_SORBS_DUL 2058 0.41 0.18 0.53 184 T_Symld_Words_02 2021 0.64 0.88 0.52 185 TR_XM_PHPDW 2015 0.92 1.75 0.52 186 XM_H_PHPMailer 1999 0.57 0.69 0.51 187 XMSolicitRefs_0 1892 0.43 0.33 0.48 188 GMD_PDF_EMPTY_BODY 1880 0.35 0.09 0.48 189 T_TooManySym_04 1850 0.34 0.05 0.47 190 XM_B_REG_HTML 1824 0.41 0.31 0.47 191 FROM_GOV_DKIM_AU 1804 0.37 0.19 0.46 192 USER_IN_WHITELIST 1800 0.31 0.00 0.46 193 USER_IN_WELCOMELIST 1800 0.31 0.00 0.46 194 FROM_GOV_SPOOF 1793 0.36 0.16 0.46 195 XMSubMetaSxObfu_03 1784 0.62 0.95 0.46 196 RELAYCOUNTRY_DE 1777 1.04 2.23 0.45 197 TR_XM_COVIDMETA4 1753 0.72 1.28 0.45 198 HTML_IMAGE_ONLY_28 1748 0.37 0.22 0.45 199 XM_B_SpammyWords4 1746 0.94 1.96 0.45 200 TR_XM_FormFill2 1731 0.83 1.63 0.44 ----------------------------------------------------------------------