Email: 481666 Autolearn: 0 AvgScore: 1.22 AvgScanTime: 1.39 sec Spam: 104553 Autolearn: 0 AvgScore: 13.29 AvgScanTime: 1.66 sec Ham: 377113 Autolearn: 0 AvgScore: -2.12 AvgScanTime: 1.31 sec Time Spent Running SA: 185.69 hours Time Spent Processing Spam: 48.23 hours Time Spent Processing Ham: 137.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100067 90.09 95.71 88.53 2 DKIM_SIGNED 86935 70.65 83.15 67.19 3 XM_B_Unicode 84415 73.74 80.74 71.80 4 XM_DK_Pass 84135 68.91 80.47 65.70 5 RELAYCOUNTRY_US 83102 79.69 79.48 79.75 6 DKIM_VALID 80894 66.69 77.37 63.73 7 DCC_CHECK 78214 44.58 74.81 36.20 8 XMListUnsubscribeExists 72369 49.03 69.22 43.44 9 XM_B_SpammyWords 70951 47.73 67.86 42.15 10 DKIM_VALID_AU 57484 49.27 54.98 47.69 11 XM_B_Unicode3 50255 45.51 48.07 44.81 12 BAYES_50 48570 49.52 46.45 50.38 13 XM_DK_Undo_02 41221 14.21 39.43 7.22 14 XM_B_SpammyWords2 38980 21.47 37.28 17.09 15 MIME_HTML_ONLY 35204 24.39 33.67 21.82 16 LOC_TINY_FONT_1 34851 24.47 33.33 22.01 17 HTML_FONT_LOW_CONTRAST 34331 26.20 32.84 24.37 18 TR_XM_DKIM_Undo 33169 11.42 31.72 5.79 19 DKIM_VALID_EF 30488 25.43 29.16 24.39 20 T_KAM_HTML_FONT_INVALID 29579 18.66 28.29 15.99 21 FVGT_m_MULTI_ODD 29386 22.99 28.11 21.57 22 BAYES_99 29205 15.28 27.93 11.77 23 T_TM2_M_HEADER_IN_MSG 28760 27.86 27.51 27.95 24 DCC_CHECK_NEGATIVE 26320 55.39 25.17 63.76 25 RCVD_IN_MSPIKE_H2 25548 19.42 24.44 18.03 26 XMSubLong 25437 20.77 24.33 19.78 27 XM_Body_Dirty_Words 23582 14.45 22.56 12.21 28 RCVD_IN_MSPIKE_WL 23199 26.01 22.19 27.07 29 BAYES_999 22465 13.09 21.49 10.76 30 RELAYCOUNTRY_META 21569 7.18 20.63 3.45 31 TR_DCC_Bayes_99 21198 6.65 20.27 2.87 32 XM_Multi_Part_URI 19832 12.68 18.97 10.93 33 BOTNET_IPINHOSTNAME 17332 6.89 16.58 4.20 34 BOTNET 16229 4.56 15.52 1.52 35 FSL_BULK_SIG 15678 8.85 15.00 7.15 36 LOTS_OF_MONEY 14958 9.21 14.31 7.79 37 UNPARSEABLE_RELAY 13992 8.70 13.38 7.40 38 RCVD_IN_MSPIKE_H3 13663 13.47 13.07 13.58 39 TR_XM_UnparsRelay 13595 7.32 13.00 5.75 40 HTML_IMAGE_RATIO_02 13220 7.42 12.64 5.97 41 TR_XM_SpammyWords4 12839 6.42 12.28 4.80 42 XM_B_Unsub 12381 11.56 11.84 11.48 43 XM_B_SpammyWords3 12062 5.05 11.54 3.25 44 TR_XM_SpammyRelay 11726 3.62 11.22 1.51 45 UNTRUSTED_Relay 11040 3.31 10.56 1.31 46 XMSexyCombo_05 10941 5.24 10.46 3.79 47 XM_SendGrid 10632 7.26 10.17 6.46 48 TR_XM_SpammyWords2 9792 2.90 9.37 1.11 49 XM_Evil_Numbers_Gen 9704 7.60 9.28 7.14 50 RCVD_IN_BL_SPAMCOP_NET 9564 2.69 9.15 0.89 51 RCVD_IN_MSPIKE_H4 8850 10.63 8.46 11.23 52 TR_XM_PhishingBody 8167 4.20 7.81 3.20 53 LotsOfNums_01 7980 8.58 7.63 8.84 54 BAYES_80 7710 4.57 7.37 3.79 55 XMSubMetaSx_00 7705 4.44 7.37 3.63 56 XM_H_Long_From01 7653 5.28 7.32 4.72 57 XM_UncommonTLD01 7523 4.06 7.20 3.19 58 RELAYCOUNTRY_CA 7283 2.12 6.97 0.77 59 BAYES_60 7108 7.62 6.80 7.85 60 TooManyTo_001 6860 8.09 6.56 8.51 61 XM_UB50 6839 2.09 6.54 0.85 62 MPART_ALT_DIFF 6705 6.93 6.41 7.07 63 XM_B_Phish_Phrases 6536 3.85 6.25 3.19 64 RCVD_IN_MSPIKE_BL 6264 1.46 5.99 0.21 65 DKIM_INVALID 6041 3.96 5.78 3.46 66 MIME_QP_LONG_LINE 5952 6.07 5.69 6.17 67 TR_XM_DK_SendGrid 5841 4.41 5.59 4.09 68 TR_XM_MSPIKECOMBO 5608 1.32 5.36 0.20 69 XM_B_Phish66 5332 2.53 5.10 1.82 70 TR_XM_SPAMCOP 5276 1.34 5.05 0.31 71 XMNumbers 5244 3.55 5.02 3.15 72 ALIBABA_IMG_NOT_RCVD_ALI 5243 1.09 5.01 0.00 73 HOSTED_IMG_DIRECT_MX 5224 1.09 5.00 0.00 74 HTML_IMAGE_RATIO_04 5209 6.71 4.98 7.19 75 RCVD_IN_PSBL 5123 1.10 4.90 0.05 76 XMStrtUSub 5091 3.99 4.87 3.75 77 XM_B_Investor 4742 2.00 4.54 1.30 78 XM_B_SpammyTLD 4699 2.43 4.49 1.86 79 XM_SPF_SoftFail 4670 2.43 4.47 1.86 80 T_XMDrugObfuBody_08 4606 2.08 4.41 1.43 81 HTML_IMAGE_RATIO_06 4438 3.79 4.24 3.67 82 TM2_M_URI_OPT_OUT 4401 4.48 4.21 4.56 83 TR_XM_SpammyWords5 4354 2.28 4.16 1.75 84 RCVD_IN_RP_RNBL 4295 0.94 4.11 0.06 85 BAYES_95 3998 2.64 3.82 2.31 86 MIME_HTML_MOSTLY 3916 2.84 3.75 2.59 87 HTML_IMAGE_RATIO_08 3790 2.72 3.62 2.46 88 MIME_HTML_ONLY_MULTI 3748 4.72 3.58 5.03 89 RCVD_IN_MSPIKE_L5 3677 0.77 3.52 0.01 90 RCVD_IN_VALIDITY_RPBL 3550 0.78 3.40 0.05 91 T_XMDrugObfuBody_14 3541 2.49 3.39 2.24 92 XM_DIRTYINTL 3227 0.88 3.09 0.26 93 XM_OfRef6 3215 1.40 3.07 0.93 94 XM_DK_Undo_01 3209 2.20 3.07 1.95 95 XM_B_COVIDMETA 3181 1.21 3.04 0.71 96 MAILING_LIST_MULTI 3172 2.79 3.03 2.72 97 T_TooManySym_01 3143 4.82 3.01 5.33 98 BAYES_40 3136 4.56 3.00 4.99 99 HTML_MIME_NO_HTML_TAG 3116 2.60 2.98 2.50 100 TR_XM_COVIDMETA1 3092 1.05 2.96 0.52 101 FROM_EXCESS_BASE64 3022 2.50 2.89 2.40 102 RCVD_IN_IADB_LISTED 3008 4.61 2.88 5.09 103 SpammyFromTLD_02 2954 0.87 2.83 0.32 104 XMDiploma_00 2908 1.68 2.78 1.38 105 T_REMOTE_IMAGE 2903 3.34 2.78 3.50 106 SUBJ_ALL_CAPS 2767 2.05 2.65 1.89 107 TR_XM_SB_Phish 2739 2.15 2.62 2.02 108 URIBL_DBL_SPAM 2736 0.57 2.62 0.01 109 XMBody_17 2693 0.99 2.58 0.55 110 RCVD_IN_IADB_SPF 2684 4.04 2.57 4.45 111 XMSubPhish11 2657 2.10 2.54 1.98 112 TM2_M_VERY_LONG_WORD 2625 1.38 2.51 1.07 113 ALL_TRUSTED 2565 14.45 2.45 17.77 114 RCVD_IN_IADB_DK 2550 3.56 2.44 3.86 115 RCVD_IN_IADB_SENDERID 2533 3.64 2.42 3.98 116 KHOP_HELO_FCRDNS 2480 1.70 2.37 1.52 117 XMSexyCombo_01 2477 1.39 2.37 1.12 118 RELAYCOUNTRY_CH 2441 0.53 2.33 0.03 119 BAYES_20 2430 3.44 2.32 3.75 120 XM_CamelCaseFrm001 2419 1.72 2.31 1.56 121 TR_XM_PHPDW 2355 0.73 2.25 0.31 122 SpammyFromTLD_01 2334 0.98 2.23 0.64 123 XM_B_Unsub2 2323 1.37 2.22 1.14 124 BOTNET_NORDNS 2294 0.49 2.19 0.02 125 TR_XM_PHPForged 2290 0.69 2.19 0.27 126 TR_XM_FormFill2 2265 0.68 2.17 0.27 127 XM_H_PHPOS 2244 0.67 2.15 0.26 128 WANT_TO_ORDER 2218 0.46 2.12 0.00 129 XM_GoogleGroups 2175 1.60 2.08 1.46 130 XM_URI_RBL 2167 0.56 2.07 0.15 131 URI_HEX 1998 1.50 1.91 1.39 132 XM_B_SpammyWords4 1979 0.72 1.89 0.39 133 T_XMDrugObfuBody_00 1953 1.54 1.87 1.45 134 DATE_IN_PAST_03_06 1915 0.66 1.83 0.34 135 URIBL_BLACK 1889 0.43 1.81 0.04 136 PDS_OTHER_BAD_TLD 1874 0.57 1.79 0.23 137 TM2_M_A_HREF_HREF 1864 0.78 1.78 0.51 138 TR_XM_NoHeaderRelay 1849 0.51 1.77 0.16 139 XMStockSpam_06 1824 1.27 1.74 1.13 140 RCVD_IN_RP_SAFE 1800 5.53 1.72 6.58 141 RCVD_IN_MSPIKE_L3 1776 0.51 1.70 0.19 142 T_FILL_THIS_FORM_SHORT 1720 0.97 1.65 0.78 143 HTML_IMAGE_ONLY_20 1681 1.49 1.61 1.46 144 XM_Body_Dirty_Words_01 1663 0.52 1.59 0.22 145 TR_XM_COVIDMETA4 1649 0.60 1.58 0.34 146 TR_LOTS_OF_MONEY3 1616 0.61 1.55 0.35 147 T_XMHurry_00 1610 0.66 1.54 0.42 148 TR_XM_INV_DKIM 1608 0.70 1.54 0.47 149 XMGenDplmaNmb 1568 0.83 1.50 0.64 150 RELAYCOUNTRY_AU 1534 0.56 1.47 0.31 151 TR_XM_SpammyWords3 1532 0.40 1.47 0.10 152 TR_Symld_Words 1503 1.60 1.44 1.65 153 TR_XM_MaxUnsub 1486 0.63 1.42 0.41 154 BAYES_00 1484 10.37 1.42 12.85 155 HTML_SHORT_LINK_IMG_3 1481 0.54 1.42 0.30 156 URI_NOVOWEL 1480 2.25 1.42 2.48 157 XM_UB99 1475 0.31 1.41 0.00 158 TR_XM_BayesRelay 1461 0.31 1.40 0.01 159 XMPhish30 1427 0.82 1.36 0.66 160 RELAYCOUNTRY_FR 1396 0.44 1.34 0.20 161 XM_B_SEO 1374 0.38 1.31 0.13 162 XM_H_Undi_Recip 1363 0.41 1.30 0.17 163 USER_IN_DEF_DKIM_WL 1362 8.43 1.30 10.40 164 URI_TRY_3LD 1360 0.85 1.30 0.72 165 HTML_TITLE_SUBJ_DIFF 1356 0.49 1.30 0.26 166 XMBrknScrpt_02 1308 0.85 1.25 0.74 167 DIET_1 1301 0.78 1.24 0.65 168 TR_MetaPhish_Combo_01 1275 0.88 1.22 0.79 169 XM_H_Long_From02 1239 0.92 1.19 0.85 170 TR_XM_SEO4 1236 0.32 1.18 0.08 171 TR_Caps_n_Bayes_99 1216 0.44 1.16 0.24 172 RCVD_IN_IADB_VOUCHED 1212 2.73 1.16 3.17 173 DATE_IN_PAST_06_12 1185 0.28 1.13 0.04 174 LongTLD 1161 0.36 1.11 0.15 175 RELAYCOUNTRY_IN 1142 0.31 1.09 0.09 176 TR_BOTNET_NEGATE 1140 0.46 1.09 0.29 177 XM_UB999 1138 0.24 1.09 0.00 178 RELAYCOUNTRY_GB 1135 0.79 1.09 0.71 179 T_Symld_Words_02 1121 0.60 1.07 0.47 180 HTTPS_HTTP_MISMATCH 1111 0.73 1.06 0.64 181 NO_DNS_FOR_FROM 1108 0.45 1.06 0.28 182 DKIM_ADSP_NXDOMAIN 1090 0.48 1.04 0.33 183 SHOPIFY_IMG_NOT_RCVD_SFY 1089 0.41 1.04 0.23 184 XM_B_DNDMA 1069 0.50 1.02 0.35 185 XM_H_PHPMailer 1059 0.61 1.01 0.50 186 FROM_SUSPICIOUS_NTLD 1053 0.26 1.01 0.06 187 DKIM_ADSP_CUSTOM_MED 1030 0.97 0.99 0.96 188 TR_XM_MaxWHORU 1028 0.37 0.98 0.19 189 RCVD_IN_RP_CERTIFIED 1018 4.77 0.97 5.83 190 XM_PDF 1016 3.69 0.97 4.44 191 FROM_SUSPICIOUS_NTLD_FP 1001 0.25 0.96 0.05 192 T_TooManySym_02 996 2.52 0.95 2.96 193 TR_Mismatch_TLD_02 981 0.28 0.94 0.10 194 TooManyTo_002 979 1.80 0.94 2.04 195 HELO_NODOT 959 1.36 0.92 1.48 196 BOUNCE_MESSAGE 955 4.37 0.91 5.33 197 ANY_BOUNCE_MESSAGE 955 4.37 0.91 5.33 198 HELO_NO_DOMAIN 948 1.35 0.91 1.48 199 XM_B_COPY_HTML 919 0.66 0.88 0.60 200 TR_Mismatch_TLD_01 915 0.43 0.88 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333855 90.09 95.71 88.53 2 RELAYCOUNTRY_US 300729 79.69 79.48 79.75 3 XM_B_Unicode 270770 73.74 80.74 71.80 4 DKIM_SIGNED 253375 70.65 83.15 67.19 5 XM_DK_Pass 247769 68.91 80.47 65.70 6 DCC_CHECK_NEGATIVE 240451 55.39 25.17 63.76 7 DKIM_VALID 240343 66.69 77.37 63.73 8 BAYES_50 189971 49.52 46.45 50.38 9 DKIM_VALID_AU 179833 49.27 54.98 47.69 10 XM_B_Unicode3 168968 45.51 48.07 44.81 11 XMListUnsubscribeExists 163808 49.03 69.22 43.44 12 XM_B_SpammyWords 158941 47.73 67.86 42.15 13 DCC_CHECK 136506 44.58 74.81 36.20 14 T_TM2_M_HEADER_IN_MSG 105416 27.86 27.51 27.95 15 RCVD_IN_MSPIKE_WL 102092 26.01 22.19 27.07 16 DKIM_VALID_EF 91992 25.43 29.16 24.39 17 HTML_FONT_LOW_CONTRAST 91887 26.20 32.84 24.37 18 LOC_TINY_FONT_1 83004 24.47 33.33 22.01 19 MIME_HTML_ONLY 82286 24.39 33.67 21.82 20 FVGT_m_MULTI_ODD 81358 22.99 28.11 21.57 21 XMSubLong 74600 20.77 24.33 19.78 22 RCVD_IN_MSPIKE_H2 68002 19.42 24.44 18.03 23 ALL_TRUSTED 67012 14.45 2.45 17.77 24 XM_B_SpammyWords2 64447 21.47 37.28 17.09 25 T_KAM_HTML_FONT_INVALID 60308 18.66 28.29 15.99 26 RCVD_IN_MSPIKE_H3 51216 13.47 13.07 13.58 27 BAYES_00 48461 10.37 1.42 12.85 28 XM_Body_Dirty_Words 46035 14.45 22.56 12.21 29 BAYES_99 44380 15.28 27.93 11.77 30 XM_B_Unsub 43302 11.56 11.84 11.48 31 RCVD_IN_MSPIKE_H4 42341 10.63 8.46 11.23 32 XM_Multi_Part_URI 41228 12.68 18.97 10.93 33 BAYES_999 40583 13.09 21.49 10.76 34 USER_IN_DEF_DKIM_WL 39227 8.43 1.30 10.40 35 XM_H_Trusted_IP 35674 7.41 0.00 9.46 36 LotsOfNums_01 33336 8.58 7.63 8.84 37 TooManyTo_001 32100 8.09 6.56 8.51 38 BAYES_60 29614 7.62 6.80 7.85 39 LOTS_OF_MONEY 29380 9.21 14.31 7.79 40 UNPARSEABLE_RELAY 27906 8.70 13.38 7.40 41 XM_DK_Undo_02 27220 14.21 39.43 7.22 42 HTML_IMAGE_RATIO_04 27114 6.71 4.98 7.19 43 TR_XM_DK_Bayes 26986 5.74 0.65 7.16 44 FSL_BULK_SIG 26957 8.85 15.00 7.15 45 XM_Evil_Numbers_Gen 26922 7.60 9.28 7.14 46 MPART_ALT_DIFF 26678 6.93 6.41 7.07 47 TR_XM_DK_Bayes1 26095 5.55 0.63 6.92 48 XM_DKIMWhitelistDomains 26007 5.43 0.12 6.90 49 RCVD_IN_RP_SAFE 24820 5.53 1.72 6.58 50 XM_SendGrid 24359 7.26 10.17 6.46 51 MIME_QP_LONG_LINE 23270 6.07 5.69 6.17 52 IN_ZIMBRA_NJ_WHITELIST 23051 4.80 0.09 6.11 53 TR_XM_DK_Bayes2 22706 4.83 0.52 6.02 54 HTML_IMAGE_RATIO_02 22511 7.42 12.64 5.97 55 RCVD_IN_RP_CERTIFIED 21971 4.77 0.97 5.83 56 TR_XM_DKIM_Undo 21830 11.42 31.72 5.79 57 TR_XM_UnparsRelay 21682 7.32 13.00 5.75 58 RCVD_IN_VALIDITY_SAFE 21292 4.60 0.84 5.65 59 T_TooManySym_01 20092 4.82 3.01 5.33 60 BOUNCE_MESSAGE 20087 4.37 0.91 5.33 61 ANY_BOUNCE_MESSAGE 20087 4.37 0.91 5.33 62 RCVD_IN_IADB_LISTED 19206 4.61 2.88 5.09 63 MIME_HTML_ONLY_MULTI 18977 4.72 3.58 5.03 64 RCVD_IN_VALIDITY_CERTIFIED 18832 3.97 0.29 4.99 65 BAYES_40 18817 4.56 3.00 4.99 66 TR_XM_SpammyWords4 18089 6.42 12.28 4.80 67 XMSubNoVowel 17862 3.82 0.50 4.74 68 XM_H_Long_From01 17792 5.28 7.32 4.72 69 TM2_M_URI_OPT_OUT 17195 4.48 4.21 4.56 70 RCVD_IN_IADB_SPF 16772 4.04 2.57 4.45 71 XM_PDF 16742 3.69 0.97 4.44 72 BOTNET_IPINHOSTNAME 15844 6.89 16.58 4.20 73 TR_XM_DK_SendGrid 15407 4.41 5.59 4.09 74 RCVD_IN_IADB_SENDERID 15002 3.64 2.42 3.98 75 RCVD_IN_IADB_DK 14575 3.56 2.44 3.86 76 BAYES_80 14287 4.57 7.37 3.79 77 XMSexyCombo_05 14279 5.24 10.46 3.79 78 XMStrtUSub 14136 3.99 4.87 3.75 79 BAYES_20 14131 3.44 2.32 3.75 80 HTML_IMAGE_RATIO_06 13839 3.79 4.24 3.67 81 XMSubMetaSx_00 13699 4.44 7.37 3.63 82 TVD_SPACE_RATIO_MINFP 13694 2.87 0.10 3.63 83 T_REMOTE_IMAGE 13192 3.34 2.78 3.50 84 DKIM_INVALID 13032 3.96 5.78 3.46 85 RELAYCOUNTRY_META 13009 7.18 20.63 3.45 86 XM_B_SpammyWords3 12264 5.05 11.54 3.25 87 TR_XM_PhishingBody 12082 4.20 7.81 3.20 88 XM_UncommonTLD01 12037 4.06 7.20 3.19 89 XM_B_Phish_Phrases 12015 3.85 6.25 3.19 90 RCVD_IN_IADB_VOUCHED 11942 2.73 1.16 3.17 91 XMNumbers 11863 3.55 5.02 3.15 92 T_TooManySym_02 11144 2.52 0.95 2.96 93 TR_DCC_Bayes_99 10821 6.65 20.27 2.87 94 MAILING_LIST_MULTI 10274 2.79 3.03 2.72 95 MIME_HTML_MOSTLY 9753 2.84 3.75 2.59 96 HTML_MIME_NO_HTML_TAG 9431 2.60 2.98 2.50 97 URI_NOVOWEL 9371 2.25 1.42 2.48 98 HTML_IMAGE_RATIO_08 9289 2.72 3.62 2.46 99 FROM_EXCESS_BASE64 9042 2.50 2.89 2.40 100 BAYES_05 8737 2.00 0.87 2.32 101 BAYES_95 8708 2.64 3.82 2.31 102 RCVD_IN_MSPIKE_H5 8535 1.91 0.66 2.26 103 T_XMDrugObfuBody_14 8456 2.49 3.39 2.24 104 HTML_FONT_FACE_BAD 7751 1.77 0.72 2.06 105 TooManyTo_002 7681 1.80 0.94 2.04 106 TR_XM_SB_Phish 7631 2.15 2.62 2.02 107 RCVD_IN_IADB_OPTIN 7472 1.72 0.78 1.98 108 XMSubPhish11 7470 2.10 2.54 1.98 109 XM_DK_Undo_01 7369 2.20 3.07 1.95 110 SUBJ_ALL_CAPS 7126 2.05 2.65 1.89 111 XM_SPF_SoftFail 7021 2.43 4.47 1.86 112 XM_B_SpammyTLD 7015 2.43 4.49 1.86 113 INVALID_MSGID 6991 1.51 0.28 1.85 114 IN_HORDE_ADDRESS_BOOK 6944 1.47 0.13 1.84 115 XM_B_Phish66 6863 2.53 5.10 1.82 116 TR_XM_SpammyWords5 6616 2.28 4.16 1.75 117 MSGID_NOFQDN1 6458 1.36 0.08 1.71 118 TR_Symld_Words 6213 1.60 1.44 1.65 119 TO_MALFORMED 6018 1.25 0.01 1.60 120 XM_CamelCaseFrm001 5873 1.72 2.31 1.56 121 TVD_RCVD_IP 5771 1.25 0.23 1.53 122 KHOP_HELO_FCRDNS 5726 1.70 2.37 1.52 123 BOTNET 5717 4.56 15.52 1.52 124 TR_XM_SpammyRelay 5700 3.62 11.22 1.51 125 HELO_NODOT 5576 1.36 0.92 1.48 126 HELO_NO_DOMAIN 5574 1.35 0.91 1.48 127 XM_GoogleGroups 5520 1.60 2.08 1.46 128 HTML_IMAGE_ONLY_20 5513 1.49 1.61 1.46 129 T_XMDrugObfuBody_00 5463 1.54 1.87 1.45 130 T_XMDrugObfuBody_08 5395 2.08 4.41 1.43 131 URI_HEX 5243 1.50 1.91 1.39 132 XMDiploma_00 5195 1.68 2.78 1.38 133 TooManyTo_003 5158 1.23 0.73 1.37 134 UNTRUSTED_Relay 4924 3.31 10.56 1.31 135 XM_B_Investor 4897 2.00 4.54 1.30 136 XMGappySubj_01 4297 0.95 0.29 1.14 137 XM_B_Unsub2 4292 1.37 2.22 1.14 138 XMStockSpam_06 4276 1.27 1.74 1.13 139 XMSexyCombo_01 4231 1.39 2.37 1.12 140 TR_XM_SpammyWords2 4183 2.90 9.37 1.11 141 XMCapTrack 4094 0.94 0.42 1.09 142 TM2_M_VERY_LONG_WORD 4028 1.38 2.51 1.07 143 DKIM_ADSP_CUSTOM_MED 3633 0.97 0.99 0.96 144 XMBSHREFv2 3611 0.83 0.37 0.96 145 TooManyTo_004 3583 0.88 0.62 0.95 146 XM_OfRef6 3510 1.40 3.07 0.93 147 RCVD_IN_BL_SPAMCOP_NET 3374 2.69 9.15 0.89 148 XM_ProductURIs 3225 0.82 0.69 0.86 149 XM_H_Long_From02 3213 0.92 1.19 0.85 150 XM_UB50 3210 2.09 6.54 0.85 151 TVD_SPACE_RATIO 3186 0.69 0.11 0.84 152 XMNoVowels 2972 0.75 0.62 0.79 153 TR_MetaPhish_Combo_01 2962 0.88 1.22 0.79 154 T_FILL_THIS_FORM_SHORT 2955 0.97 1.65 0.78 155 RELAYCOUNTRY_CA 2915 2.12 6.97 0.77 156 T_TooManySym_03 2847 0.66 0.32 0.75 157 XMHTML_After_End 2784 0.76 0.83 0.74 158 XMBody_95 2783 0.62 0.18 0.74 159 XMBrknScrpt_02 2783 0.85 1.25 0.74 160 TooManyTo_005 2765 0.69 0.54 0.73 161 URI_TRY_3LD 2732 0.85 1.30 0.72 162 XMLngstWrd_00 2719 0.64 0.34 0.72 163 RELAYCOUNTRY_GB 2683 0.79 1.09 0.71 164 XM_B_COVIDMETA 2666 1.21 3.04 0.71 165 XM_RXBody 2619 0.63 0.37 0.69 166 XMPhish30 2499 0.82 1.36 0.66 167 DIET_1 2435 0.78 1.24 0.65 168 XMGenDplmaNmb 2414 0.83 1.50 0.64 169 HTTPS_HTTP_MISMATCH 2409 0.73 1.06 0.64 170 SpammyFromTLD_01 2405 0.98 2.23 0.64 171 XMBdyGiftCard01 2394 0.65 0.72 0.63 172 NML_ADSP_CUSTOM_MED 2364 0.67 0.83 0.63 173 TR_MSPIKEBAYES00 2353 0.49 0.03 0.62 174 XM_B_COPY_HTML 2257 0.66 0.88 0.60 175 XMSubMetaI_00 2124 0.62 0.82 0.56 176 XMOemUri 2076 0.51 0.38 0.55 177 XMBody_17 2076 0.99 2.58 0.55 178 T_OBFU_PDF_ATTACH 2032 0.45 0.11 0.54 179 TR_XM_COVIDMETA1 1975 1.05 2.96 0.52 180 XM_D_tchamptons_WL 1964 0.41 0.00 0.52 181 XM_ShortIntro_01 1951 0.56 0.73 0.52 182 SHORT_URI_3 1929 0.46 0.26 0.51 183 FORGED_GMAIL_RCVD 1923 0.58 0.85 0.51 184 TM2_M_A_HREF_HREF 1906 0.78 1.78 0.51 185 XM_H_PHPMailer 1892 0.61 1.01 0.50 186 XMMoneyMeta_00 1882 0.57 0.81 0.50 187 XMLngstWrd_01 1869 0.45 0.28 0.50 188 RCVD_IN_SORBS_DUL 1807 0.43 0.25 0.48 189 HTML_TAG_BALANCE_BODY 1797 0.52 0.66 0.48 190 TR_XM_INV_DKIM 1762 0.70 1.54 0.47 191 T_Symld_Words_02 1754 0.60 1.07 0.47 192 HTML_IMAGE_ONLY_24 1719 0.51 0.69 0.46 193 XMHTMLBadTable_001 1668 0.50 0.70 0.44 194 XMSubMetaSxObfu_03 1612 0.50 0.75 0.43 195 RDNS_DYNAMIC 1606 0.49 0.70 0.43 196 FROM_GOV_DKIM_AU 1596 0.36 0.13 0.42 197 SHORT_HELO_AND_INLINE_IMAGE 1584 0.36 0.12 0.42 198 MPART_ALT_DIFF_COUNT 1584 0.46 0.60 0.42 199 T_XMHurry_00 1577 0.66 1.54 0.42 200 TR_XM_MaxUnsub 1545 0.63 1.42 0.41 ----------------------------------------------------------------------