Email: 523555 Autolearn: 0 AvgScore: 2.95 AvgScanTime: 1.30 sec Spam: 130993 Autolearn: 0 AvgScore: 14.58 AvgScanTime: 1.53 sec Ham: 392562 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.23 sec Time Spent Running SA: 189.62 hours Time Spent Processing Spam: 55.74 hours Time Spent Processing Ham: 133.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125038 83.77 95.45 79.86 2 DKIM_SIGNED 104078 70.78 79.45 67.88 3 RELAYCOUNTRY_US 102751 74.25 78.44 72.85 4 DCC_CHECK 101488 45.00 77.48 34.16 5 XM_DK_Pass 101283 67.65 77.32 64.42 6 DKIM_VALID 98344 64.92 75.08 61.53 7 XM_B_Unicode 97208 70.11 74.21 68.74 8 XM_B_SpammyWords 85107 45.89 64.97 39.53 9 XMListUnsubscribeExists 83481 46.52 63.73 40.77 10 DKIM_VALID_AU 71101 48.11 54.28 46.05 11 BAYES_50 56195 49.84 42.90 52.16 12 XM_B_Unicode3 55293 40.16 42.21 39.48 13 XM_DK_Undo_02 51685 14.35 39.46 5.97 14 MIME_HTML_ONLY 48310 24.56 36.88 20.44 15 XM_B_SpammyWords2 46883 22.07 35.79 17.50 16 LOC_TINY_FONT_1 44539 23.22 34.00 19.62 17 HTML_FONT_LOW_CONTRAST 43369 25.29 33.11 22.67 18 TR_XM_DKIM_Undo 41075 11.22 31.36 4.50 19 DKIM_VALID_EF 40558 24.82 30.96 22.77 20 RCVD_IN_MSPIKE_H2 39185 24.09 29.91 22.14 21 BAYES_99 38130 12.07 29.11 6.38 22 T_KAM_HTML_FONT_INVALID 36536 19.12 27.89 16.19 23 FVGT_m_MULTI_ODD 33558 21.19 25.62 19.71 24 XMSubLong 32727 20.54 24.98 19.06 25 T_TM2_M_HEADER_IN_MSG 31097 29.96 23.74 32.04 26 DCC_CHECK_NEGATIVE 29451 54.96 22.48 65.80 27 TR_DCC_Bayes_99 29391 7.32 22.44 2.28 28 BAYES_999 29056 9.70 22.18 5.54 29 XM_Body_Dirty_Words 28096 17.04 21.45 15.57 30 RELAYCOUNTRY_META 25855 10.98 19.74 8.06 31 FSL_BULK_SIG 25138 9.80 19.19 6.66 32 RCVD_IN_MSPIKE_WL 24785 23.67 18.92 25.25 33 XM_Multi_Part_URI 20467 11.25 15.62 9.79 34 LOTS_OF_MONEY 20172 9.25 15.40 7.20 35 XM_UncommonTLD01 19249 5.97 14.69 3.06 36 BOTNET_IPINHOSTNAME 19067 6.49 14.56 3.80 37 UNTRUSTED_Relay 18928 7.77 14.45 5.54 38 BOTNET 18231 4.47 13.92 1.32 39 TR_XM_SpammyWords4 16531 6.26 12.62 4.13 40 XM_B_Unsub 16524 10.18 12.61 9.37 41 UNPARSEABLE_RELAY 16468 8.28 12.57 6.85 42 T_REMOTE_IMAGE 15925 6.35 12.16 4.41 43 TR_XM_UnparsRelay 15838 6.89 12.09 5.15 44 XM_B_SpammyWords3 14978 6.46 11.43 4.80 45 HTML_IMAGE_RATIO_02 14533 7.01 11.09 5.65 46 XMSexyCombo_05 13829 9.45 10.56 9.09 47 TR_XM_SpammyRelay 13587 3.66 10.37 1.43 48 RCVD_IN_MSPIKE_H3 13558 12.49 10.35 13.20 49 SpammyFromTLD_02 12687 2.78 9.69 0.47 50 XM_SendGrid 12318 6.75 9.40 5.86 51 XM_Evil_Numbers_Gen 12104 7.72 9.24 7.21 52 TR_XM_SpammyWords2 11973 2.92 9.14 0.85 53 RCVD_IN_BL_SPAMCOP_NET 11732 2.69 8.96 0.60 54 TR_XM_PhishingBody 10876 4.39 8.30 3.08 55 BAYES_80 10833 4.83 8.27 3.68 56 LotsOfNums_01 10216 8.21 7.80 8.35 57 HTML_MIME_NO_HTML_TAG 10130 3.69 7.73 2.34 58 RCVD_IN_MSPIKE_H4 9977 9.01 7.62 9.47 59 KHOP_HELO_FCRDNS 9173 3.02 7.00 1.69 60 TooManyTo_001 9048 8.34 6.91 8.81 61 XM_B_Phish_Phrases 9043 4.09 6.90 3.15 62 BAYES_60 8907 8.17 6.80 8.62 63 MPART_ALT_DIFF 8681 6.03 6.63 5.83 64 HTML_IMAGE_ONLY_08 8594 1.74 6.56 0.13 65 XM_UB50 8528 4.89 6.51 4.36 66 T_HTML_TAG_BALANCE_CENTER 8091 1.61 6.18 0.09 67 XM_B_SpammyTLD 7578 2.84 5.79 1.86 68 XMSubMetaSx_00 7226 4.21 5.52 3.77 69 XM_H_Long_From01 7189 4.81 5.49 4.58 70 BODY_URI_ONLY 7188 1.38 5.49 0.01 71 HTML_FONT_SIZE_LARGE 7057 1.41 5.39 0.09 72 XM_B_Phish66 7046 2.79 5.38 1.92 73 RCVD_IN_MSPIKE_BL 6947 1.64 5.30 0.42 74 XMNumbers 6889 3.57 5.26 3.00 75 TR_XM_MSPIKECOMBO 6864 1.62 5.24 0.41 76 TR_XM_DK_SendGrid 6844 3.96 5.22 3.54 77 TR_XM_SpammyWords5 6682 2.32 5.10 1.40 78 MIXED_CENTER_CASE 6615 1.26 5.05 0.00 79 MIXED_HREF_CASE 6613 1.26 5.05 0.00 80 MIXED_IMG_CASE 6605 1.26 5.04 0.00 81 MIXED_AREA_CASE 6602 1.26 5.04 0.00 82 MIXED_FONT_CASE 6599 1.26 5.04 0.00 83 MIXED_CTYPE_CASE 6586 1.26 5.03 0.00 84 RCVD_IN_PSBL 6264 1.31 4.78 0.15 85 RELAYCOUNTRY_CA 5935 1.73 4.53 0.79 86 HTML_IMAGE_RATIO_04 5929 5.83 4.53 6.26 87 BAYES_95 5883 2.78 4.49 2.21 88 TR_XM_SPAMCOP 5881 1.31 4.49 0.25 89 MIME_QP_LONG_LINE 5774 4.97 4.41 5.16 90 DKIM_INVALID 5734 5.86 4.38 6.35 91 GOOG_STO_IMG_HTML 5449 1.04 4.16 0.00 92 MIME_HTML_MOSTLY 5353 2.56 4.09 2.05 93 XM_OfRef6 5170 1.56 3.95 0.77 94 XM_B_Investor 5117 1.84 3.91 1.15 95 RCVD_IN_RP_SAFE 4979 5.43 3.80 5.97 96 XM_SPF_SoftFail 4918 2.58 3.75 2.19 97 XM_DrugUnitList 4861 0.93 3.71 0.00 98 ALIBABA_IMG_NOT_RCVD_ALI 4860 0.93 3.71 0.00 99 TM2_M_URI_OPT_OUT 4852 6.71 3.70 7.71 100 HOSTED_IMG_DIRECT_MX 4828 0.92 3.69 0.00 101 MIME_HTML_ONLY_MULTI 4438 4.05 3.39 4.27 102 T_XMDrugObfuBody_08 4346 1.78 3.32 1.27 103 T_XMDrugObfuBody_14 4294 2.57 3.28 2.34 104 XM_B_COVIDMETA 4288 1.43 3.27 0.82 105 HTML_IMAGE_RATIO_06 4231 3.42 3.23 3.48 106 URIBL_DBL_SPAM 4184 0.81 3.19 0.02 107 XMNoVowels 4180 2.20 3.19 1.86 108 PDS_OTHER_BAD_TLD 4068 0.88 3.11 0.14 109 BAYES_40 3959 4.45 3.02 4.92 110 RCVD_IN_RP_CERTIFIED 3953 4.61 3.02 5.13 111 RCVD_IN_IADB_LISTED 3894 4.72 2.97 5.31 112 FROM_EXCESS_BASE64 3841 2.40 2.93 2.22 113 XMDiploma_00 3810 1.70 2.91 1.29 114 XMStrtUSub 3730 3.67 2.85 3.95 115 XM_B_Unsub2 3690 1.58 2.82 1.17 116 SUBJ_ALL_CAPS 3645 2.04 2.78 1.80 117 TR_XM_SB_Phish 3532 2.35 2.70 2.24 118 SpammyFromTLD_01 3486 1.08 2.66 0.56 119 XMSubPhish11 3478 2.32 2.66 2.21 120 RCVD_IN_IADB_SPF 3449 4.12 2.63 4.61 121 T_TooManySym_01 3294 4.41 2.51 5.04 122 RCVD_IN_IADB_DK 3279 3.62 2.50 3.99 123 TR_XM_SpammyWords3 3265 0.87 2.49 0.32 124 RCVD_IN_IADB_SENDERID 3249 3.72 2.48 4.13 125 HTML_IMAGE_ONLY_28 3215 0.89 2.45 0.37 126 RELAYCOUNTRY_AZ 3162 0.60 2.41 0.00 127 XM_DIRTYINTL 3128 4.10 2.39 4.67 128 URI_NOVOWEL 3073 2.65 2.35 2.76 129 DATE_IN_PAST_03_06 3067 0.78 2.34 0.25 130 FROM_SUSPICIOUS_NTLD 3030 0.61 2.31 0.04 131 HTML_IMAGE_RATIO_08 3005 2.23 2.29 2.21 132 URI_HEX 2994 1.61 2.29 1.38 133 BAYES_20 2980 6.28 2.27 7.62 134 FROM_SUSPICIOUS_NTLD_FP 2979 0.60 2.27 0.04 135 T_XMDrugObfuBody_00 2925 1.04 2.23 0.65 136 XM_CamelCaseFrm001 2855 1.72 2.18 1.57 137 RCVD_IN_MSPIKE_L4 2786 0.60 2.13 0.09 138 XM_DK_Undo_01 2744 1.68 2.09 1.54 139 XMStockSpam_06 2733 1.38 2.09 1.14 140 T_FILL_THIS_FORM_SHORT 2729 1.14 2.08 0.83 141 HTML_IMAGE_ONLY_24 2648 0.73 2.02 0.30 142 TR_XM_NoHeaderRelay 2637 0.62 2.01 0.16 143 BAYES_00 2632 9.54 2.01 12.05 144 TM2_M_VERY_LONG_WORD 2615 1.30 2.00 1.06 145 RCVD_IN_MSPIKE_L5 2614 0.52 2.00 0.02 146 TR_Symld_Words 2582 1.85 1.97 1.82 147 XM_B_SpammyWords4 2555 0.76 1.95 0.36 148 TR_XM_COVIDMETA1 2507 0.66 1.91 0.25 149 MAILING_LIST_MULTI 2496 2.41 1.91 2.58 150 URI_GOOG_STO_SPAMMY 2470 0.47 1.89 0.00 151 XMBody_17 2451 0.74 1.87 0.37 152 XM_UB99 2449 0.47 1.87 0.00 153 URI_TRY_3LD 2377 1.11 1.81 0.88 154 XM_Combo_Fr 2360 0.55 1.80 0.13 155 XM_UB80 2307 0.45 1.76 0.02 156 XMSexyCombo_01 2303 1.20 1.76 1.01 157 TR_XM_PHPDW 2249 0.61 1.72 0.24 158 DATE_IN_PAST_06_12 2244 0.54 1.71 0.15 159 TR_LOTS_OF_MONEY3 2231 0.67 1.70 0.33 160 XM_URI_RBL 2221 0.49 1.70 0.09 161 TR_XM_PHPForged 2184 0.58 1.67 0.21 162 TR_XM_FormFill2 2167 0.57 1.65 0.21 163 XMGenDplmaNmb 2164 0.90 1.65 0.65 164 XM_H_PHPOS 2147 0.56 1.64 0.21 165 USER_IN_DEF_DKIM_WL 2133 8.58 1.63 10.90 166 XM_H_TOP 2117 0.41 1.62 0.00 167 ALL_TRUSTED 2059 15.62 1.57 20.30 168 TR_Mismatch_TLD_02 2055 0.45 1.57 0.08 169 XMBrknScrpt_02 2052 0.88 1.57 0.65 170 DIET_1 2032 0.75 1.55 0.48 171 TR_M_TOP_BAYES 2025 0.39 1.55 0.00 172 XM_UB60 1994 1.05 1.52 0.90 173 BOTNET_NORDNS 1926 0.37 1.47 0.01 174 RELAYCOUNTRY_DE 1903 0.87 1.45 0.67 175 HELO_NODOT 1845 1.30 1.41 1.27 176 HELO_NO_DOMAIN 1843 1.30 1.41 1.27 177 TR_XM_COVIDMETA4 1829 0.65 1.40 0.40 178 T_XMHurry_00 1816 0.65 1.39 0.41 179 XM_OfRef7 1804 0.42 1.38 0.11 180 T_Symld_Words_02 1785 0.68 1.36 0.45 181 URIBL_BLACK 1775 0.36 1.36 0.02 182 RELAYCOUNTRY_GB 1768 1.11 1.35 1.03 183 TR_XM_PhishingBody3 1698 0.33 1.30 0.00 184 XM_ProductURIs 1624 0.93 1.24 0.83 185 RCVD_IN_IADB_VOUCHED 1555 2.80 1.19 3.34 186 URIBL_SBL_A 1553 0.39 1.19 0.12 187 TR_MetaPhish_Combo_01 1550 0.78 1.18 0.65 188 HTML_FONT_SIZE_HUGE 1549 0.33 1.18 0.05 189 XM_Body_Dirty_Words_01 1528 0.53 1.17 0.32 190 RELAYCOUNTRY_IN 1506 0.35 1.15 0.08 191 XM_PDF 1504 3.44 1.15 4.21 192 RCVD_IN_MSPIKE_L3 1464 0.50 1.12 0.29 193 XMBdyGiftCard01 1459 0.79 1.11 0.68 194 TR_XM_INV_DKIM 1451 0.53 1.11 0.34 195 BAYES_05 1423 2.04 1.09 2.36 196 XMPhish30 1394 0.79 1.06 0.69 197 TR_LOTS_OF_MONEY2 1383 0.45 1.06 0.24 198 T_MONEY_PERCENT 1383 0.45 1.06 0.24 199 TR_XM_BayesRelay 1380 0.27 1.05 0.00 200 RELAYCOUNTRY_NL 1333 0.38 1.02 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 313519 83.77 95.45 79.86 2 RELAYCOUNTRY_US 285978 74.25 78.44 72.85 3 XM_B_Unicode 269860 70.11 74.21 68.74 4 DKIM_SIGNED 266476 70.78 79.45 67.88 5 DCC_CHECK_NEGATIVE 258299 54.96 22.48 65.80 6 XM_DK_Pass 252881 67.65 77.32 64.42 7 DKIM_VALID 241551 64.92 75.08 61.53 8 BAYES_50 204745 49.84 42.90 52.16 9 DKIM_VALID_AU 180763 48.11 54.28 46.05 10 XMListUnsubscribeExists 160062 46.52 63.73 40.77 11 XM_B_SpammyWords 155177 45.89 64.97 39.53 12 XM_B_Unicode3 154975 40.16 42.21 39.48 13 DCC_CHECK 134117 45.00 77.48 34.16 14 T_TM2_M_HEADER_IN_MSG 125785 29.96 23.74 32.04 15 RCVD_IN_MSPIKE_WL 99122 23.67 18.92 25.25 16 DKIM_VALID_EF 89392 24.82 30.96 22.77 17 HTML_FONT_LOW_CONTRAST 89012 25.29 33.11 22.67 18 RCVD_IN_MSPIKE_H2 86918 24.09 29.91 22.14 19 MIME_HTML_ONLY 80259 24.56 36.88 20.44 20 ALL_TRUSTED 79701 15.62 1.57 20.30 21 FVGT_m_MULTI_ODD 77369 21.19 25.62 19.71 22 LOC_TINY_FONT_1 77009 23.22 34.00 19.62 23 XMSubLong 74821 20.54 24.98 19.06 24 XM_B_SpammyWords2 68683 22.07 35.79 17.50 25 T_KAM_HTML_FONT_INVALID 63564 19.12 27.89 16.19 26 XM_Body_Dirty_Words 61121 17.04 21.45 15.57 27 RCVD_IN_MSPIKE_H3 51836 12.49 10.35 13.20 28 BAYES_00 47314 9.54 2.01 12.05 29 BOUNCE_MESSAGE 46059 8.98 0.71 11.73 30 ANY_BOUNCE_MESSAGE 46059 8.98 0.71 11.73 31 USER_IN_DEF_DKIM_WL 42773 8.58 1.63 10.90 32 XM_Multi_Part_URI 38443 11.25 15.62 9.79 33 RCVD_IN_MSPIKE_H4 37174 9.01 7.62 9.47 34 XM_B_Unsub 36782 10.18 12.61 9.37 35 XMSexyCombo_05 35670 9.45 10.56 9.09 36 TooManyTo_001 34604 8.34 6.91 8.81 37 BAYES_60 33843 8.17 6.80 8.62 38 LotsOfNums_01 32761 8.21 7.80 8.35 39 RELAYCOUNTRY_META 31648 10.98 19.74 8.06 40 TM2_M_URI_OPT_OUT 30267 6.71 3.70 7.71 41 BAYES_20 29895 6.28 2.27 7.62 42 XM_Evil_Numbers_Gen 28308 7.72 9.24 7.21 43 LOTS_OF_MONEY 28256 9.25 15.40 7.20 44 XM_DKIMWhitelistDomains 27105 5.18 0.02 6.90 45 TR_XM_DK_Bayes 26912 5.30 0.64 6.86 46 UNPARSEABLE_RELAY 26878 8.28 12.57 6.85 47 FSL_BULK_SIG 26156 9.80 19.19 6.66 48 TR_XM_DK_Bayes1 26026 5.12 0.61 6.63 49 XM_H_Trusted_IP 25954 4.96 0.00 6.61 50 BAYES_99 25038 12.07 29.11 6.38 51 DKIM_INVALID 24925 5.86 4.38 6.35 52 HTML_IMAGE_RATIO_04 24582 5.83 4.53 6.26 53 XM_DK_Undo_02 23451 14.35 39.46 5.97 54 RCVD_IN_RP_SAFE 23433 5.43 3.80 5.97 55 XM_SendGrid 23003 6.75 9.40 5.86 56 MPART_ALT_DIFF 22898 6.03 6.63 5.83 57 HTML_IMAGE_RATIO_02 22177 7.01 11.09 5.65 58 TR_XM_DK_Bayes2 22022 4.32 0.45 5.61 59 UNTRUSTED_Relay 21757 7.77 14.45 5.54 60 BAYES_999 21746 9.70 22.18 5.54 61 RCVD_IN_IADB_LISTED 20836 4.72 2.97 5.31 62 MIME_QP_LONG_LINE 20249 4.97 4.41 5.16 63 TR_XM_UnparsRelay 20233 6.89 12.09 5.15 64 RCVD_IN_RP_CERTIFIED 20157 4.61 3.02 5.13 65 T_TooManySym_01 19800 4.41 2.51 5.04 66 BAYES_40 19323 4.45 3.02 4.92 67 XM_B_SpammyWords3 18862 6.46 11.43 4.80 68 XM_DIRTYINTL 18346 4.10 2.39 4.67 69 RCVD_IN_IADB_SPF 18115 4.12 2.63 4.61 70 XM_H_Long_From01 17997 4.81 5.49 4.58 71 RELAYCOUNTRY_FR 17872 3.66 0.98 4.55 72 TR_XM_DKIM_Undo 17646 11.22 31.36 4.50 73 T_REMOTE_IMAGE 17312 6.35 12.16 4.41 74 XMBounce_01 17233 3.32 0.13 4.39 75 XM_UB50 17100 4.89 6.51 4.36 76 MIME_HTML_ONLY_MULTI 16768 4.05 3.39 4.27 77 XM_PDF 16532 3.44 1.15 4.21 78 RCVD_IN_IADB_SENDERID 16230 3.72 2.48 4.13 79 TR_XM_SpammyWords4 16224 6.26 12.62 4.13 80 RCVD_IN_IADB_DK 15653 3.62 2.50 3.99 81 XMStrtUSub 15507 3.67 2.85 3.95 82 BOTNET_IPINHOSTNAME 14922 6.49 14.56 3.80 83 XMSubMetaSx_00 14805 4.21 5.52 3.77 84 BAYES_80 14454 4.83 8.27 3.68 85 TR_XM_DK_SendGrid 13895 3.96 5.22 3.54 86 HTML_IMAGE_RATIO_06 13671 3.42 3.23 3.48 87 RCVD_IN_IADB_VOUCHED 13121 2.80 1.19 3.34 88 XM_B_Phish_Phrases 12384 4.09 6.90 3.15 89 TR_XM_PhishingBody 12105 4.39 8.30 3.08 90 XM_UncommonTLD01 12026 5.97 14.69 3.06 91 XMNumbers 11791 3.57 5.26 3.00 92 URI_NOVOWEL 10822 2.65 2.35 2.76 93 MAILING_LIST_MULTI 10126 2.41 1.91 2.58 94 RCVD_IN_MSPIKE_H5 10112 2.17 0.95 2.58 95 T_TooManySym_02 9696 2.05 0.80 2.47 96 BAYES_05 9270 2.04 1.09 2.36 97 HTML_MIME_NO_HTML_TAG 9204 3.69 7.73 2.34 98 T_XMDrugObfuBody_14 9175 2.57 3.28 2.34 99 TR_DCC_Bayes_99 8954 7.32 22.44 2.28 100 XMSubNoVowel 8843 1.85 0.64 2.25 101 TR_XM_SB_Phish 8776 2.35 2.70 2.24 102 FROM_EXCESS_BASE64 8717 2.40 2.93 2.22 103 HTML_IMAGE_RATIO_08 8679 2.23 2.29 2.21 104 XMSubPhish11 8678 2.32 2.66 2.21 105 BAYES_95 8663 2.78 4.49 2.21 106 XM_SPF_SoftFail 8615 2.58 3.75 2.19 107 RCVD_IN_IADB_OPTIN 8360 1.77 0.71 2.13 108 TooManyTo_002 8083 1.77 0.92 2.06 109 MIME_HTML_MOSTLY 8042 2.56 4.09 2.05 110 XM_B_Phish66 7550 2.79 5.38 1.92 111 XMNoVowels 7319 2.20 3.19 1.86 112 XM_B_SpammyTLD 7303 2.84 5.79 1.86 113 INVALID_MSGID 7159 1.40 0.15 1.82 114 TR_Symld_Words 7128 1.85 1.97 1.82 115 SUBJ_ALL_CAPS 7054 2.04 2.78 1.80 116 IN_HORDE_ADDRESS_BOOK 6896 1.35 0.12 1.76 117 MSGID_NOFQDN1 6658 1.28 0.05 1.70 118 KHOP_HELO_FCRDNS 6635 3.02 7.00 1.69 119 HTML_FONT_FACE_BAD 6518 1.47 0.88 1.66 120 TO_MALFORMED 6337 1.21 0.01 1.61 121 TVD_RCVD_IP 6175 1.23 0.21 1.57 122 XM_CamelCaseFrm001 6145 1.72 2.18 1.57 123 XM_DK_Undo_01 6054 1.68 2.09 1.54 124 HTML_IMAGE_ONLY_20 5639 1.18 0.40 1.44 125 TR_XM_SpammyRelay 5597 3.66 10.37 1.43 126 TR_XM_SpammyWords5 5488 2.32 5.10 1.40 127 URI_HEX 5429 1.61 2.29 1.38 128 TooManyTo_003 5221 1.17 0.70 1.33 129 BOTNET 5178 4.47 13.92 1.32 130 XMDiploma_00 5076 1.70 2.91 1.29 131 T_XMDrugObfuBody_08 4992 1.78 3.32 1.27 132 XMGappySubj_01 4987 1.00 0.18 1.27 133 HELO_NO_DOMAIN 4978 1.30 1.41 1.27 134 HELO_NODOT 4978 1.30 1.41 1.27 135 XM_GoogleGroups 4591 1.06 0.75 1.17 136 XM_B_Unsub2 4584 1.58 2.82 1.17 137 XM_B_Investor 4504 1.84 3.91 1.15 138 XMStockSpam_06 4466 1.38 2.09 1.14 139 TM2_M_VERY_LONG_WORD 4179 1.30 2.00 1.06 140 TVD_SPACE_RATIO_MINFP 4136 0.80 0.05 1.05 141 RELAYCOUNTRY_GB 4041 1.11 1.35 1.03 142 XMCapTrack 4041 1.00 0.91 1.03 143 XMSexyCombo_01 3984 1.20 1.76 1.01 144 TooManyTo_004 3601 0.84 0.60 0.92 145 XM_UB60 3525 1.05 1.52 0.90 146 DKIM_ADSP_CUSTOM_MED 3477 0.88 0.88 0.89 147 URI_TRY_3LD 3455 1.11 1.81 0.88 148 XMSubMetaSxObfu_03 3433 0.81 0.61 0.87 149 HELO_MISC_IP 3343 0.74 0.42 0.85 150 TR_XM_SpammyWords2 3329 2.92 9.14 0.85 151 T_FILL_THIS_FORM_SHORT 3261 1.14 2.08 0.83 152 XM_ProductURIs 3256 0.93 1.24 0.83 153 XM_B_COVIDMETA 3203 1.43 3.27 0.82 154 XMBSHREFv2 3143 0.67 0.26 0.80 155 XM_H_Long_From02 3140 0.82 0.89 0.80 156 RELAYCOUNTRY_CA 3117 1.73 4.53 0.79 157 IN_ZIMBRA_NJ_WHITELIST 3100 0.60 0.01 0.79 158 XMHTML_After_End 3055 0.80 0.86 0.78 159 XM_OfRef6 3012 1.56 3.95 0.77 160 TooManyTo_005 2899 0.68 0.52 0.74 161 T_TooManySym_03 2720 0.61 0.35 0.69 162 XMPhish30 2718 0.79 1.06 0.69 163 XMBdyGiftCard01 2656 0.79 1.11 0.68 164 RELAYCOUNTRY_DE 2641 0.87 1.45 0.67 165 XMBrknScrpt_02 2561 0.88 1.57 0.65 166 XMGenDplmaNmb 2548 0.90 1.65 0.65 167 TR_MetaPhish_Combo_01 2546 0.78 1.18 0.65 168 MSGID_FROM_MTA_HEADER 2546 0.59 0.43 0.65 169 T_XMDrugObfuBody_00 2544 1.04 2.23 0.65 170 XMBody_95 2518 0.51 0.13 0.64 171 TR_MSPIKEBAYES00 2479 0.48 0.02 0.63 172 FROM_GOV_DKIM_AU 2399 0.49 0.14 0.61 173 HTTPS_HTTP_MISMATCH 2381 0.68 0.89 0.61 174 RCVD_IN_BL_SPAMCOP_NET 2352 2.69 8.96 0.60 175 NML_ADSP_CUSTOM_MED 2341 0.63 0.73 0.60 176 XM_D_tchamptons_WL 2336 0.45 0.00 0.60 177 SpammyFromTLD_01 2192 1.08 2.66 0.56 178 XMSexyCombo_04 2108 0.56 0.61 0.54 179 T_OBFU_PDF_ATTACH 2091 0.44 0.18 0.53 180 TM2_M_A_HREF_HREF 2013 0.63 0.99 0.51 181 XM_B_COPY_HTML 1999 0.55 0.66 0.51 182 DIET_1 1899 0.75 1.55 0.48 183 XM_ShortIntro_01 1893 0.53 0.67 0.48 184 XMHTMLBadTable_001 1865 0.54 0.74 0.48 185 SpammyFromTLD_02 1852 2.78 9.69 0.47 186 MISSING_HEADERS 1776 0.46 0.49 0.45 187 XM_H_PHPMailer 1775 0.56 0.90 0.45 188 T_Symld_Words_02 1773 0.68 1.36 0.45 189 TVD_SPACE_RATIO 1753 0.36 0.09 0.45 190 FORGED_GMAIL_RCVD 1735 0.51 0.72 0.44 191 MPART_ALT_DIFF_COUNT 1721 0.54 0.85 0.44 192 XMOemUri 1715 0.42 0.38 0.44 193 RCVD_IN_SORBS_DUL 1685 0.45 0.50 0.43 194 HTML_TAG_BALANCE_BODY 1674 0.51 0.74 0.43 195 RCVD_IN_MSPIKE_BL 1644 1.64 5.30 0.42 196 XMLngstWrd_00 1628 0.39 0.30 0.41 197 T_XMHurry_00 1602 0.65 1.39 0.41 198 TR_XM_MSPIKECOMBO 1592 1.62 5.24 0.41 199 FROM_GOV_SPOOF 1573 0.35 0.19 0.40 200 TR_XM_COVIDMETA4 1573 0.65 1.40 0.40 ----------------------------------------------------------------------