Email: 693208 Autolearn: 0 AvgScore: 2.21 AvgScanTime: 12.72 sec Spam: 222131 Autolearn: 0 AvgScore: 14.90 AvgScanTime: 17.26 sec Ham: 471077 Autolearn: 0 AvgScore: -3.77 AvgScanTime: 10.59 sec Time Spent Running SA: 2449.94 hours Time Spent Processing Spam: 1064.76 hours Time Spent Processing Ham: 1385.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 212892 85.60 95.84 80.78 2 DKIM_SIGNED 200828 56.64 90.41 40.72 3 XM_DK_Pass 196346 55.46 88.39 39.93 4 RELAYCOUNTRY_US 193316 78.40 87.03 74.33 5 XM_B_Unicode 175763 68.38 79.13 63.31 6 XM_DK_Undo_02 164452 30.99 74.03 10.69 7 BOTNET 158947 41.44 71.56 27.24 8 XMListUnsubscribeExists 158104 36.37 71.18 19.96 9 DKIM_INVALID 157020 34.39 70.69 17.27 10 DCC_CHECK 154640 33.49 69.62 16.45 11 XM_B_SpammyWords 138877 44.34 62.52 35.76 12 TR_XM_DKIM_Undo 110680 19.40 49.83 5.06 13 BAYES_50 109488 42.89 49.29 39.88 14 XM_B_Unicode3 104676 44.82 47.12 43.73 15 LOC_TINY_FONT_1 77764 18.61 35.01 10.88 16 HTML_FONT_LOW_CONTRAST 72814 21.05 32.78 15.52 17 FVGT_m_MULTI_ODD 70421 18.49 31.70 12.26 18 XM_B_SpammyWords2 70255 15.79 31.63 8.32 19 DCC_CHECK_NEGATIVE 67417 66.48 30.35 83.52 20 MIME_HTML_ONLY 64125 24.59 28.87 22.58 21 T_KAM_HTML_FONT_INVALID 61559 14.57 27.71 8.37 22 XMSubLong 54433 20.84 24.50 19.11 23 BAYES_99 50249 9.15 22.62 2.80 24 T_TM2_M_HEADER_IN_MSG 48980 28.70 22.05 31.83 25 DKIM_VALID 43808 22.25 19.72 23.45 26 XM_Body_Dirty_Words 43389 10.31 19.53 5.96 27 BAYES_999 40330 7.39 18.16 2.32 28 TR_DCC_Bayes_99 35506 5.88 15.98 1.11 29 XM_Multi_Part_URI 35483 9.47 15.97 6.40 30 RELAYCOUNTRY_META 33508 6.12 15.08 1.90 31 DKIM_VALID_AU 32260 15.79 14.52 16.39 32 XM_B_Unsub 28662 8.46 12.90 6.37 33 LOTS_OF_MONEY 27810 12.34 12.52 12.26 34 TR_XM_INV_DKIM 25860 4.20 11.64 0.69 35 LotsOfNums_01 25382 6.40 11.43 4.03 36 UNPARSEABLE_RELAY 24768 6.15 11.15 3.80 37 XM_Evil_Numbers_Gen 23996 7.53 10.80 5.98 38 TR_XM_UnparsRelay 23326 5.19 10.50 2.68 39 MPART_ALT_DIFF 22987 9.58 10.35 9.21 40 FSL_BULK_SIG 22742 5.42 10.24 3.15 41 XM_UncommonTLD01 22241 4.74 10.01 2.25 42 BOTNET_IPINHOSTNAME 21082 4.67 9.49 2.40 43 XM_B_SpammyWords3 20867 4.36 9.39 1.98 44 TR_XM_SpammyWords4 19830 6.63 8.93 5.54 45 XMSexyCombo_05 18890 7.64 8.50 7.24 46 UNTRUSTED_Relay 18391 6.87 8.28 6.21 47 BAYES_60 18390 9.31 8.28 9.79 48 DKIM_VALID_EF 18064 8.48 8.13 8.65 49 XM_SendGrid 17950 4.66 8.08 3.05 50 HTML_IMAGE_RATIO_02 17710 4.24 7.97 2.48 51 BAYES_80 16002 3.64 7.20 1.95 52 TR_XM_SpammyRelay 15942 2.71 7.18 0.61 53 TR_XM_SpammyWords2 15354 2.48 6.91 0.39 54 TR_XM_COVIDMETA4 15205 2.65 6.85 0.67 55 RCVD_IN_MSPIKE_H2 14118 7.94 6.36 8.68 56 MIME_QP_LONG_LINE 14009 3.84 6.31 2.68 57 TooManyTo_001 13564 9.55 6.11 11.17 58 XM_H_Long_From01 13495 3.86 6.08 2.82 59 XMSubMetaSx_00 13148 6.78 5.92 7.18 60 MIME_HTML_ONLY_MULTI 13039 7.36 5.87 8.06 61 TR_XM_PhishingBody 12987 3.01 5.85 1.68 62 URI_NOVOWEL 12588 2.62 5.67 1.19 63 XM_H_MailChimp 12297 2.14 5.54 0.53 64 XM_B_Phish_Phrases 12133 3.27 5.46 2.24 65 MIME_HTML_MOSTLY 12089 2.71 5.44 1.41 66 HTML_IMAGE_RATIO_04 11526 12.27 5.19 15.60 67 HTML_MIME_NO_HTML_TAG 10948 2.73 4.93 1.70 68 TR_XM_MaxUnsub 10559 2.08 4.75 0.82 69 RCVD_IN_MSPIKE_WL 10333 7.57 4.65 8.95 70 TM2_M_VERY_LONG_WORD 10142 1.96 4.57 0.73 71 BAYES_95 9591 2.14 4.32 1.12 72 XMStrtUSub 9583 8.32 4.31 10.21 73 BOTNET_NORDNS 9099 1.36 4.10 0.06 74 XM_UB50 8749 1.50 3.94 0.35 75 SpammyFromTLD_01 8732 1.54 3.93 0.41 76 XM_GoogleGroups 8554 1.85 3.85 0.91 77 T_REMOTE_IMAGE 7868 2.75 3.54 2.37 78 KHOP_HELO_FCRDNS 7470 9.15 3.36 11.88 79 SpammyFromTLD_02 7463 1.21 3.36 0.19 80 HTML_IMAGE_RATIO_06 7458 3.75 3.36 3.93 81 XM_H_ConstantContact 7403 1.23 3.33 0.24 82 XM_B_Investor 7369 1.56 3.32 0.72 83 MAILING_LIST_MULTI 7289 2.08 3.28 1.52 84 XM_B_Phish66 6937 1.72 3.12 1.06 85 T_XMDrugObfuBody_14 6890 1.70 3.10 1.04 86 TM2_M_URI_OPT_OUT 6832 2.30 3.08 1.93 87 XM_SPF_SoftFail 6791 12.07 3.06 16.31 88 HTML_IMAGE_RATIO_08 6658 10.62 3.00 14.21 89 RELAYCOUNTRY_CA 6513 1.20 2.93 0.39 90 XMNumbers 6432 2.53 2.90 2.35 91 FROM_EXCESS_BASE64 6429 1.84 2.89 1.34 92 BAYES_00 6429 21.64 2.89 30.47 93 RCVD_IN_MSPIKE_H3 6413 4.32 2.89 4.99 94 XMLngstWrd_00 6228 1.28 2.80 0.56 95 XMLngstWrd_01 6136 1.23 2.76 0.51 96 TR_XM_SpammyWords5 6087 1.39 2.74 0.76 97 XM_DK_Undo_01 6016 1.48 2.71 0.90 98 XMLngstWrd_02 6008 1.17 2.70 0.44 99 T_XMDrugObfuBody_08 5914 1.32 2.66 0.69 100 XMLngstWrd_03 5889 1.11 2.65 0.38 101 XM_B_SpammyTLD 5766 1.69 2.60 1.26 102 XMLngstWrd_04 5737 1.05 2.58 0.33 103 TR_XM_DK_Bayes 5577 5.45 2.51 6.84 104 HTML_TITLE_SUBJ_DIFF 5388 0.90 2.43 0.18 105 UPPERCASE_75_100 5335 0.89 2.40 0.18 106 URI_HEX 5319 1.16 2.39 0.58 107 SUBJ_ALL_CAPS 5266 4.09 2.37 4.91 108 XM_CamelCaseFrm001 5266 1.37 2.37 0.89 109 BAYES_40 5256 3.83 2.37 4.51 110 XMDiploma_00 5230 1.20 2.35 0.65 111 TR_XM_SB_Phish 5142 1.65 2.31 1.33 112 T_TooManySym_01 5098 3.27 2.30 3.72 113 XMSubPhish11 4989 1.61 2.25 1.32 114 XM_OfRef6 4931 1.00 2.22 0.43 115 XM_B_COVIDMETA 4880 0.87 2.20 0.25 116 RELAYCOUNTRY_FR 4769 0.77 2.15 0.12 117 XM_B_Unsub2 4627 1.30 2.08 0.93 118 XM_DIRTYINTL 4585 0.75 2.06 0.13 119 JH_SPAMMY_HEADERS 4475 0.65 2.01 0.00 120 XM_B_SpammyWords4 4436 0.79 2.00 0.22 121 RCVD_IN_BL_SPAMCOP_NET 4421 0.86 1.99 0.32 122 BAYES_20 4150 4.11 1.87 5.17 123 XMSexyCombo_01 3848 0.73 1.73 0.26 124 UPGRADE_MAILBOX 3844 0.76 1.73 0.30 125 TR_Symld_Words 3785 1.53 1.70 1.45 126 RCVD_IN_MSPIKE_H4 3566 2.74 1.61 3.28 127 RCVD_IN_MSPIKE_BL 3422 0.75 1.54 0.37 128 TR_XM_MSPIKECOMBO 3401 0.74 1.53 0.37 129 RELAYCOUNTRY_RU 3242 0.48 1.46 0.01 130 T_XMDrugObfuBody_00 3194 0.66 1.44 0.30 131 XM_PDF 3121 2.97 1.41 3.71 132 XM_UB99 2964 0.43 1.33 0.00 133 T_FILL_THIS_FORM_SHORT 2938 0.77 1.32 0.52 134 TR_XM_PHPDW 2914 0.59 1.31 0.26 135 XMPhish30 2906 0.58 1.31 0.24 136 TooManyTo_002 2890 1.66 1.30 1.84 137 XMBody_17 2888 0.53 1.30 0.16 138 XMGenDplmaNmb 2852 0.67 1.28 0.37 139 DKIM_ADSP_CUSTOM_MED 2827 0.67 1.27 0.39 140 TR_Mismatch_TLD_02 2756 0.43 1.24 0.04 141 TR_XM_DK_SendGrid 2725 1.22 1.23 1.22 142 XM_H_Long_From02 2695 0.75 1.21 0.53 143 TR_XM_NoHeaderRelay 2679 0.46 1.21 0.11 144 XMBrknScrpt_02 2675 0.70 1.20 0.46 145 TR_XM_PHPForged 2660 0.54 1.20 0.23 146 ALL_TRUSTED 2651 13.30 1.19 19.01 147 TR_XM_FormFill2 2627 0.53 1.18 0.23 148 XM_H_PHPOS 2609 0.53 1.17 0.22 149 BAYES_05 2571 3.30 1.16 4.31 150 XMStockSpam_06 2540 0.85 1.14 0.71 151 XMBdyGiftCard01 2538 0.55 1.14 0.27 152 RELAYCOUNTRY_AU 2472 0.44 1.11 0.13 153 T_XMHurry_00 2435 0.46 1.10 0.16 154 RELAYCOUNTRY_GB 2407 0.68 1.08 0.49 155 TooManyTo_003 2405 1.04 1.08 1.02 156 XM_UB999 2387 0.34 1.07 0.00 157 T_Symld_Words_02 2316 0.47 1.04 0.20 158 GOOG_STO_IMG_HTML 2311 0.33 1.04 0.00 159 MONEY_NOHTML 2305 0.37 1.04 0.05 160 XMSubMetaI_00 2277 0.51 1.03 0.27 161 XM_UB60 2274 0.34 1.02 0.02 162 TR_XM_COVIDMETA1 2264 0.41 1.02 0.12 163 PLING_QUERY 2247 0.48 1.01 0.23 164 TR_XM_SPAMCOP 2240 0.46 1.01 0.20 165 URI_TRY_3LD 2239 0.50 1.01 0.27 166 RCVD_IN_VALIDITY_SAFE 2194 1.58 0.99 1.86 167 XMHTML_After_End 2191 0.63 0.99 0.46 168 XM_ProductURIs 2161 0.49 0.97 0.26 169 TooManyTo_004 2122 0.79 0.96 0.71 170 HTTPS_HTTP_MISMATCH 2120 0.59 0.95 0.41 171 HTML_IMAGE_ONLY_08 2117 0.36 0.95 0.08 172 XMCapTrack 2111 0.84 0.95 0.78 173 HTML_TAG_BALANCE_CENTER 2101 0.33 0.95 0.04 174 XM_Body_Dirty_Words_01 2091 0.35 0.94 0.07 175 TR_MetaPhish_Combo_01 2066 0.61 0.93 0.46 176 TM2_M_A_HREF_HREF 2044 0.40 0.92 0.16 177 FILL_THIS_FORM 2044 5.78 0.92 8.07 178 XM_H_PHPMailer 2031 0.56 0.91 0.40 179 FORGED_GMAIL_RCVD 1958 0.44 0.88 0.23 180 XMBody_78 1917 0.38 0.86 0.16 181 FROM_GOV_SPOOF 1912 0.63 0.86 0.52 182 PDS_OTHER_BAD_TLD 1882 0.33 0.85 0.08 183 TooManyTo_005 1856 0.65 0.84 0.56 184 FILL_THIS_FORM_LONG 1836 0.30 0.83 0.05 185 URI_NO_WWW_BIZ_CGI 1825 0.27 0.82 0.01 186 XM_B_COPY_HTML 1803 0.48 0.81 0.32 187 RCVD_IN_VALIDITY_CERTIFIED 1800 1.38 0.81 1.65 188 XMMoneyMeta_00 1784 0.47 0.80 0.31 189 XMSlimDrugH 1780 0.36 0.80 0.16 190 XMSexyCombo_04 1773 0.31 0.80 0.08 191 XMSubNoVowel 1750 3.40 0.79 4.63 192 BODY_URI_ONLY 1738 0.25 0.78 0.01 193 XMDateMe_00 1736 0.43 0.78 0.26 194 TR_LOTS_OF_MONEY3 1736 0.31 0.78 0.09 195 RCVD_IN_VALIDITY_RPBL 1734 0.25 0.78 0.00 196 DIET_1 1729 0.33 0.78 0.12 197 XM_S_SpammyWords 1719 0.35 0.77 0.15 198 TR_XM_Spammywords 1719 0.35 0.77 0.15 199 MILLION_USD 1699 0.25 0.76 0.00 200 HTML_FONT_FACE_BAD 1693 20.45 0.76 29.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 393433 66.48 30.35 83.52 2 HTML_MESSAGE 380521 85.60 95.84 80.78 3 RELAYCOUNTRY_US 350166 78.40 87.03 74.33 4 XM_B_Unicode 298240 68.38 79.13 63.31 5 XM_B_Unicode3 206011 44.82 47.12 43.73 6 DKIM_SIGNED 191826 56.64 90.41 40.72 7 XM_DK_Pass 188108 55.46 88.39 39.93 8 BAYES_50 187852 42.89 49.29 39.88 9 XM_B_SpammyWords 168462 44.34 62.52 35.76 10 T_TM2_M_HEADER_IN_MSG 149941 28.70 22.05 31.83 11 BAYES_00 143553 21.64 2.89 30.47 12 HTML_FONT_FACE_BAD 140057 20.45 0.76 29.73 13 BOTNET 128341 41.44 71.56 27.24 14 DKIM_VALID 110460 22.25 19.72 23.45 15 MIME_HTML_ONLY 106357 24.59 28.87 22.58 16 XMListUnsubscribeExists 94025 36.37 71.18 19.96 17 IN_ZIMBRA_NJ_WHITELIST 93760 13.62 0.28 19.90 18 XMSubLong 90020 20.84 24.50 19.11 19 ALL_TRUSTED 89530 13.30 1.19 19.01 20 DKIM_INVALID 81366 34.39 70.69 17.27 21 DCC_CHECK 77494 33.49 69.62 16.45 22 DKIM_VALID_AU 77227 15.79 14.52 16.39 23 XM_SPF_SoftFail 76847 12.07 3.06 16.31 24 HTML_IMAGE_RATIO_04 73497 12.27 5.19 15.60 25 HTML_FONT_LOW_CONTRAST 73115 21.05 32.78 15.52 26 XM_H_Trusted_IP 72052 10.39 0.00 15.30 27 HTML_IMAGE_RATIO_08 66957 10.62 3.00 14.21 28 LOTS_OF_MONEY 57763 12.34 12.52 12.26 29 FVGT_m_MULTI_ODD 57755 18.49 31.70 12.26 30 KHOP_HELO_FCRDNS 55967 9.15 3.36 11.88 31 TooManyTo_001 52607 9.55 6.11 11.17 32 LOC_TINY_FONT_1 51276 18.61 35.01 10.88 33 XM_DK_Undo_02 50363 30.99 74.03 10.69 34 XMStrtUSub 48091 8.32 4.31 10.21 35 BAYES_60 46128 9.31 8.28 9.79 36 MPART_ALT_DIFF 43396 9.58 10.35 9.21 37 RCVD_IN_MSPIKE_WL 42166 7.57 4.65 8.95 38 BOUNCE_MESSAGE 41675 6.19 0.54 8.85 39 ANY_BOUNCE_MESSAGE 41675 6.19 0.54 8.85 40 RCVD_IN_MSPIKE_H2 40904 7.94 6.36 8.68 41 DKIM_VALID_EF 40741 8.48 8.13 8.65 42 T_KAM_HTML_FONT_INVALID 39408 14.57 27.71 8.37 43 XM_B_SpammyWords2 39184 15.79 31.63 8.32 44 FILL_THIS_FORM 38036 5.78 0.92 8.07 45 MIME_HTML_ONLY_MULTI 37947 7.36 5.87 8.06 46 XMSexyCombo_05 34093 7.64 8.50 7.24 47 HELO_NODOT 33914 5.01 0.36 7.20 48 HELO_NO_DOMAIN 33908 5.01 0.36 7.20 49 XMSubMetaSx_00 33825 6.78 5.92 7.18 50 TR_XM_DK_Bayes 32227 5.45 2.51 6.84 51 XM_Multi_Part_URI 30156 9.47 15.97 6.40 52 XM_B_Unsub 29995 8.46 12.90 6.37 53 UNTRUSTED_Relay 29264 6.87 8.28 6.21 54 DATE_IN_PAST_03_06 28863 4.36 0.61 6.13 55 XM_DKIMWhitelistDomains 28469 4.24 0.42 6.04 56 XM_Evil_Numbers_Gen 28185 7.53 10.80 5.98 57 XM_Body_Dirty_Words 28053 10.31 19.53 5.96 58 XMBounce_01 26659 3.88 0.12 5.66 59 FSL_HELO_NON_FQDN_1 26653 3.90 0.18 5.66 60 XMBounce_02 26604 3.85 0.05 5.65 61 TR_XM_SpammyWords4 26097 6.63 8.93 5.54 62 XMSubMetaSSx_00 26081 3.87 0.33 5.54 63 BAYES_20 24335 4.11 1.87 5.17 64 TR_XM_DKIM_Undo 23817 19.40 49.83 5.06 65 RCVD_IN_MSPIKE_H3 23507 4.32 2.89 4.99 66 SUBJ_ALL_CAPS 23113 4.09 2.37 4.91 67 XMSubNoVowel 21794 3.40 0.79 4.63 68 BAYES_40 21261 3.83 2.37 4.51 69 BAYES_05 20297 3.30 1.16 4.31 70 USER_IN_DEF_DKIM_WL 19343 2.94 0.45 4.11 71 LotsOfNums_01 18969 6.40 11.43 4.03 72 HTML_IMAGE_RATIO_06 18522 3.75 3.36 3.93 73 UNPARSEABLE_RELAY 17892 6.15 11.15 3.80 74 T_HTML_ATTACH 17646 2.58 0.11 3.75 75 T_TooManySym_01 17540 3.27 2.30 3.72 76 XM_PDF 17493 2.97 1.41 3.71 77 TR_XM_DK_Bayes1 15831 2.32 0.13 3.36 78 RCVD_IN_MSPIKE_H4 15461 2.74 1.61 3.28 79 FSL_BULK_SIG 14825 5.42 10.24 3.15 80 XM_SendGrid 14356 4.66 8.08 3.05 81 XM_H_Long_From01 13278 3.86 6.08 2.82 82 BAYES_99 13191 9.15 22.62 2.80 83 TR_XM_UnparsRelay 12648 5.19 10.50 2.68 84 MIME_QP_LONG_LINE 12631 3.84 6.31 2.68 85 XM_E_Blogspot 12163 1.79 0.11 2.58 86 HTML_IMAGE_RATIO_02 11678 4.24 7.97 2.48 87 BOTNET_IPINHOSTNAME 11325 4.67 9.49 2.40 88 T_REMOTE_IMAGE 11162 2.75 3.54 2.37 89 XMNumbers 11077 2.53 2.90 2.35 90 DKIM_ADSP_NXDOMAIN 11069 1.62 0.08 2.35 91 NO_DNS_FOR_FROM 10943 1.69 0.35 2.32 92 BAYES_999 10919 7.39 18.16 2.32 93 T_TooManySym_02 10760 1.79 0.73 2.28 94 XM_UncommonTLD01 10604 4.74 10.01 2.25 95 XM_B_Phish_Phrases 10569 3.27 5.46 2.24 96 TR_XM_DK_Bayes2 9420 1.39 0.10 2.00 97 XM_B_SpammyWords3 9329 4.36 9.39 1.98 98 BAYES_80 9197 3.64 7.20 1.95 99 TM2_M_URI_OPT_OUT 9078 2.30 3.08 1.93 100 RELAYCOUNTRY_META 8946 6.12 15.08 1.90 101 XMSubGarbage 8890 1.33 0.15 1.89 102 XMSubLongNoVowel 8769 1.36 0.29 1.86 103 RCVD_IN_VALIDITY_SAFE 8761 1.58 0.99 1.86 104 TooManyTo_002 8648 1.66 1.30 1.84 105 RCVD_IN_IADB_LISTED 8023 1.38 0.71 1.70 106 HTML_MIME_NO_HTML_TAG 8008 2.73 4.93 1.70 107 TR_XM_PhishingBody 7891 3.01 5.85 1.68 108 RCVD_IN_VALIDITY_CERTIFIED 7771 1.38 0.81 1.65 109 MAILING_LIST_MULTI 7138 2.08 3.28 1.52 110 RCVD_IN_IADB_SPF 7050 1.21 0.59 1.50 111 TR_Symld_Words 6844 1.53 1.70 1.45 112 MIME_HTML_MOSTLY 6664 2.71 5.44 1.41 113 INVALID_MSGID 6596 1.05 0.30 1.40 114 IN_HORDE_ADDRESS_BOOK 6469 1.02 0.28 1.37 115 TVD_RCVD_IP 6437 0.99 0.18 1.37 116 RCVD_IN_IADB_SENDERID 6352 1.09 0.54 1.35 117 FROM_EXCESS_BASE64 6306 1.84 2.89 1.34 118 TR_XM_SB_Phish 6278 1.65 2.31 1.33 119 XMSubPhish11 6205 1.61 2.25 1.32 120 MSGID_NOFQDN1 6114 0.94 0.19 1.30 121 RCVD_IN_IADB_DK 6106 1.06 0.55 1.30 122 TO_MALFORMED 6028 1.07 0.62 1.28 123 XM_B_SpammyTLD 5943 1.69 2.60 1.26 124 TR_XM_DK_SendGrid 5731 1.22 1.23 1.22 125 URI_NOVOWEL 5605 2.62 5.67 1.19 126 BAYES_95 5255 2.14 4.32 1.12 127 TR_DCC_Bayes_99 5221 5.88 15.98 1.11 128 XM_B_Phish66 5006 1.72 3.12 1.06 129 RCVD_IN_IADB_VOUCHED 4964 0.85 0.43 1.05 130 T_XMDrugObfuBody_14 4916 1.70 3.10 1.04 131 TooManyTo_003 4810 1.04 1.08 1.02 132 XM_B_Unsub2 4378 1.30 2.08 0.93 133 XM_GoogleGroups 4279 1.85 3.85 0.91 134 XM_DK_Undo_01 4250 1.48 2.71 0.90 135 XM_CamelCaseFrm001 4201 1.37 2.37 0.89 136 XMGappySubj_01 4092 0.70 0.35 0.87 137 XMBody_95 3989 0.64 0.20 0.85 138 TR_XM_MaxUnsub 3855 2.08 4.75 0.82 139 TVD_SPACE_RATIO 3729 0.56 0.08 0.79 140 XMCapTrack 3694 0.84 0.95 0.78 141 TR_XM_SpammyWords5 3582 1.39 2.74 0.76 142 XMBSHREFv2 3511 0.62 0.36 0.75 143 TM2_M_VERY_LONG_WORD 3433 1.96 4.57 0.73 144 XM_B_Investor 3415 1.56 3.32 0.72 145 TooManyTo_004 3362 0.79 0.96 0.71 146 XMStockSpam_06 3336 0.85 1.14 0.71 147 T_XMDrugObfuBody_08 3258 1.32 2.66 0.69 148 RCVD_IN_IADB_OPTIN 3256 0.55 0.25 0.69 149 TR_XM_INV_DKIM 3242 4.20 11.64 0.69 150 RCVD_IN_MSPIKE_H5 3198 0.51 0.16 0.68 151 TR_XM_COVIDMETA4 3163 2.65 6.85 0.67 152 XMDiploma_00 3056 1.20 2.35 0.65 153 TR_XM_SpammyRelay 2865 2.71 7.18 0.61 154 URI_HEX 2736 1.16 2.39 0.58 155 T_TooManySym_03 2707 0.47 0.24 0.57 156 T_OBFU_PDF_ATTACH 2690 0.49 0.32 0.57 157 TooManyTo_005 2656 0.65 0.84 0.56 158 XMLngstWrd_00 2631 1.28 2.80 0.56 159 MSGID_FROM_MTA_HEADER 2611 0.49 0.35 0.55 160 XM_H_MailChimp 2516 2.14 5.54 0.53 161 XM_H_Long_From02 2489 0.75 1.21 0.53 162 FROM_GOV_SPOOF 2437 0.63 0.86 0.52 163 T_FILL_THIS_FORM_SHORT 2429 0.77 1.32 0.52 164 XMLngstWrd_01 2417 1.23 2.76 0.51 165 RELAYCOUNTRY_GB 2319 0.68 1.08 0.49 166 SHORT_HELO_AND_INLINE_IMAGE 2252 0.35 0.08 0.48 167 XMBrknScrpt_02 2180 0.70 1.20 0.46 168 XM_ShortIntro_01 2174 0.47 0.48 0.46 169 TR_MetaPhish_Combo_01 2160 0.61 0.93 0.46 170 XMHTML_After_End 2147 0.63 0.99 0.46 171 MY_SERVERS_FOUND 2086 0.33 0.10 0.44 172 XMLngstWrd_02 2080 1.17 2.70 0.44 173 XMNoVowels 2034 0.49 0.62 0.43 174 XM_OfRef6 2005 1.00 2.22 0.43 175 HTML_IMAGE_ONLY_20 1995 0.46 0.53 0.42 176 SpammyFromTLD_01 1953 1.54 3.93 0.41 177 HTTPS_HTTP_MISMATCH 1953 0.59 0.95 0.41 178 XM_H_PHPMailer 1871 0.56 0.91 0.40 179 RELAYCOUNTRY_CA 1835 1.20 2.93 0.39 180 TR_XM_SpammyWords2 1830 2.48 6.91 0.39 181 DKIM_ADSP_CUSTOM_MED 1828 0.67 1.27 0.39 182 XMLngstWrd_03 1774 1.11 2.65 0.38 183 XMGenDplmaNmb 1766 0.67 1.28 0.37 184 RCVD_IN_MSPIKE_BL 1747 0.75 1.54 0.37 185 HTML_TAG_BALANCE_BODY 1746 0.49 0.73 0.37 186 TR_XM_MSPIKECOMBO 1720 0.74 1.53 0.37 187 T_MANY_PILL_PRICE 1717 0.25 0.01 0.36 188 XM_UB50 1645 1.50 3.94 0.35 189 XM_BadFromFormat 1636 0.35 0.34 0.35 190 USER_IN_WHITELIST 1568 0.23 0.00 0.33 191 USER_IN_WELCOMELIST 1568 0.23 0.00 0.33 192 XMLngstWrd_04 1533 1.05 2.58 0.33 193 RCVD_IN_BL_SPAMCOP_NET 1521 0.86 1.99 0.32 194 XM_B_COPY_HTML 1504 0.48 0.81 0.32 195 HTML_IMAGE_ONLY_32 1463 0.29 0.24 0.31 196 XMMoneyMeta_00 1447 0.47 0.80 0.31 197 TM2_M_BODY_EMPTY 1445 0.27 0.18 0.31 198 UPGRADE_MAILBOX 1430 0.76 1.73 0.30 199 TVD_SPACE_RATIO_MINFP 1414 0.23 0.07 0.30 200 T_XMDrugObfuBody_00 1409 0.66 1.44 0.30 ----------------------------------------------------------------------