Email: 533302 Autolearn: 0 AvgScore: 2.51 AvgScanTime: 1.38 sec Spam: 162871 Autolearn: 0 AvgScore: 13.58 AvgScanTime: 1.55 sec Ham: 370431 Autolearn: 0 AvgScore: -2.36 AvgScanTime: 1.30 sec Time Spent Running SA: 203.85 hours Time Spent Processing Spam: 70.35 hours Time Spent Processing Ham: 133.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157168 88.74 96.50 85.33 2 DKIM_SIGNED 147707 74.52 90.69 67.41 3 XM_DK_Pass 145027 73.26 89.04 66.32 4 DKIM_VALID 143241 72.33 87.95 65.46 5 XM_B_Unicode 133589 69.53 82.02 64.04 6 RELAYCOUNTRY_US 132307 82.56 81.23 83.15 7 DCC_CHECK 121094 43.18 74.35 29.48 8 XMListUnsubscribeExists 114347 50.91 70.21 42.42 9 XM_B_SpammyWords 110985 53.15 68.14 46.56 10 DKIM_VALID_AU 106267 53.44 65.25 48.25 11 XM_B_Unicode3 77219 41.58 47.41 39.01 12 RCVD_IN_MSPIKE_H2 76990 40.04 47.27 36.85 13 BAYES_50 71501 48.22 43.90 50.11 14 XM_DK_Undo_02 67553 16.84 41.48 6.01 15 XM_B_SpammyWords2 65106 23.42 39.97 16.14 16 MIME_HTML_ONLY 59788 23.70 36.71 17.98 17 LOC_TINY_FONT_1 58147 25.10 35.70 20.44 18 FVGT_m_MULTI_ODD 55615 24.87 34.15 20.79 19 TR_XM_DKIM_Undo 55480 13.08 34.06 3.85 20 HTML_FONT_LOW_CONTRAST 55182 26.79 33.88 23.68 21 DKIM_VALID_EF 53637 26.45 32.93 23.60 22 BAYES_99 51216 13.20 31.45 5.18 23 T_KAM_HTML_FONT_INVALID 47432 20.36 29.12 16.50 24 DCC_CHECK_NEGATIVE 41743 56.78 25.63 70.48 25 BAYES_999 40542 10.63 24.89 4.36 26 XM_Body_Dirty_Words 37662 14.33 23.12 10.46 27 TR_DCC_Bayes_99 36112 7.69 22.17 1.33 28 T_TM2_M_HEADER_IN_MSG 35883 30.58 22.03 34.34 29 RELAYCOUNTRY_META 35535 8.77 21.82 3.03 30 XMSubLong 35303 19.52 21.68 18.57 31 XM_B_Unsub 28605 11.29 17.56 8.53 32 XM_Multi_Part_URI 27961 12.69 17.17 10.72 33 TR_XM_BayesUnsub 27961 9.87 17.17 6.66 34 RCVD_IN_MSPIKE_WL 25660 15.14 15.75 14.88 35 LOTS_OF_MONEY 23732 15.89 14.57 16.47 36 TR_XM_SpammyRelay 22421 5.18 13.77 1.40 37 XM_B_SpammyWords3 20631 6.00 12.67 3.07 38 TR_XM_SpammyWords4 20584 12.28 12.64 12.13 39 BOTNET_IPINHOSTNAME 19912 6.98 12.23 4.67 40 TR_XM_SpammyWords2 19742 4.16 12.12 0.65 41 RCVD_IN_MSPIKE_H3 19632 10.46 12.05 9.76 42 UNPARSEABLE_RELAY 19096 8.15 11.72 6.58 43 TR_XM_UnparsRelay 18579 7.08 11.41 5.18 44 MPART_ALT_DIFF 18514 6.86 11.37 4.87 45 XMSexyCombo_05 18346 5.61 11.26 3.13 46 FSL_BULK_SIG 17482 5.46 10.73 3.15 47 RCVD_IN_BL_SPAMCOP_NET 16298 3.36 10.01 0.44 48 RELAYCOUNTRY_CA 15742 3.65 9.67 1.00 49 BOTNET 15698 4.14 9.64 1.73 50 XM_Evil_Numbers_Gen 14217 7.87 8.73 7.49 51 BAYES_80 13308 4.96 8.17 3.54 52 MIME_HTML_ONLY_MULTI 13246 4.81 8.13 3.35 53 LotsOfNums_01 12516 7.77 7.68 7.80 54 BAYES_60 12507 7.82 7.68 7.89 55 TM2_M_VERY_LONG_WORD 12371 3.00 7.60 0.98 56 XM_UncommonTLD01 11807 4.45 7.25 3.22 57 TR_XM_SPAMCOP 11536 2.32 7.08 0.23 58 XM_SendGrid 11294 5.14 6.93 4.35 59 UNTRUSTED_Relay 11275 2.89 6.92 1.12 60 HTML_MIME_NO_HTML_TAG 11068 3.20 6.80 1.62 61 HTML_IMAGE_RATIO_02 11057 5.42 6.79 4.81 62 TR_XM_PhishingBody 9888 3.73 6.07 2.70 63 XM_H_Long_From01 9360 5.21 5.75 4.97 64 XMLngstWrd_00 9193 2.00 5.64 0.40 65 XMSubMetaSx_00 9177 3.95 5.63 3.20 66 XMLngstWrd_01 9117 1.94 5.60 0.33 67 XM_GoogleGroups 9031 2.47 5.54 1.11 68 XMLngstWrd_02 9000 1.85 5.53 0.23 69 XMLngstWrd_03 8550 1.71 5.25 0.15 70 XM_B_Phish_Phrases 8504 3.65 5.22 2.96 71 XMLngstWrd_04 8499 1.66 5.22 0.10 72 HTML_TITLE_SUBJ_DIFF 8459 1.61 5.19 0.03 73 UPPERCASE_75_100 8348 1.59 5.13 0.04 74 T_XMDrugObfuBody_08 8229 2.64 5.05 1.59 75 TooManyTo_001 7730 6.45 4.75 7.20 76 BAYES_95 7660 2.98 4.70 2.22 77 XM_B_Investor 7498 2.29 4.60 1.27 78 HTML_IMAGE_RATIO_04 7485 5.29 4.60 5.59 79 TR_XM_SpammyWords5 7248 2.51 4.45 1.65 80 XM_B_SpammyTLD 7211 2.89 4.43 2.21 81 MIME_HTML_MOSTLY 7093 2.91 4.35 2.28 82 TR_XM_DK_SendGrid 7065 3.31 4.34 2.86 83 XM_DIRTYINTL 6769 1.44 4.16 0.25 84 XMStrtUSub 6596 3.67 4.05 3.50 85 XM_SPF_SoftFail 6476 9.07 3.98 11.31 86 T_XMDrugObfuBody_14 6470 2.13 3.97 1.32 87 T_REMOTE_IMAGE 6206 3.39 3.81 3.20 88 RCVD_IN_VALIDITY_SAFE 6129 3.94 3.76 4.02 89 XMBody_17 5996 1.43 3.68 0.45 90 T_FILL_THIS_FORM_SHORT 5917 1.74 3.63 0.91 91 RCVD_IN_MSPIKE_BL 5750 1.64 3.53 0.80 92 MIME_QP_LONG_LINE 5730 4.38 3.52 4.76 93 RCVD_IN_MSPIKE_H4 5616 3.96 3.45 4.18 94 TR_XM_MSPIKECOMBO 5548 1.59 3.41 0.79 95 XM_B_Phish66 5510 2.15 3.38 1.61 96 HTML_IMAGE_RATIO_06 5507 8.45 3.38 10.68 97 XM_OfRef6 5451 1.67 3.35 0.93 98 TM2_M_URI_OPT_OUT 5184 2.74 3.18 2.54 99 XMDiploma_00 5077 1.79 3.12 1.21 100 XM_UB50 5022 1.45 3.08 0.73 101 RCVD_IN_VALIDITY_CERTIFIED 4955 3.37 3.04 3.51 102 XM_DK_Undo_01 4899 1.73 3.01 1.16 103 USER_IN_DEF_DKIM_WL 4894 8.77 3.00 11.30 104 SpammyFromTLD_01 4868 1.32 2.99 0.58 105 T_TooManySym_01 4791 5.40 2.94 6.48 106 HTML_IMAGE_RATIO_08 4748 3.71 2.92 4.06 107 XMNumbers 4727 2.96 2.90 2.98 108 XM_CamelCaseFrm001 4645 2.20 2.85 1.92 109 SpammyFromTLD_02 4534 1.10 2.78 0.36 110 DKIM_INVALID 4466 2.20 2.74 1.95 111 URI_NOVOWEL 4465 2.31 2.74 2.12 112 SUBJ_ALL_CAPS 4447 2.77 2.73 2.78 113 XM_B_Unsub2 4436 1.80 2.72 1.40 114 RCVD_IN_IADB_LISTED 4361 4.28 2.68 4.98 115 FROM_EXCESS_BASE64 4328 2.24 2.66 2.06 116 FONT_INVIS_LONG_LINE 3757 0.76 2.31 0.09 117 RCVD_IN_IADB_SPF 3748 3.78 2.30 4.44 118 RCVD_IN_VALIDITY_RPBL 3670 0.75 2.25 0.08 119 BOTNET_NORDNS 3631 0.69 2.23 0.01 120 URIBL_DBL_SPAM 3586 0.68 2.20 0.02 121 RCVD_IN_IADB_DK 3565 3.33 2.19 3.83 122 RCVD_IN_IADB_SENDERID 3548 3.41 2.18 3.96 123 PDS_OTHER_BAD_TLD 3538 0.76 2.17 0.14 124 XM_B_SpammyWords4 3524 1.08 2.16 0.61 125 TR_XM_FormFill 3283 0.63 2.02 0.01 126 TR_LOTS_OF_MONEY3 3229 0.74 1.98 0.20 127 T_XMDrugObfuBody_00 3062 0.95 1.88 0.53 128 TR_XM_SB_Phish 3057 1.87 1.88 1.87 129 TM2_M_A_HREF_HREF 3042 0.84 1.87 0.39 130 RCVD_IN_MSPIKE_L3 3009 1.10 1.85 0.77 131 XMSubPhish11 2995 1.85 1.84 1.86 132 RELAYCOUNTRY_AU 2919 0.75 1.79 0.29 133 XM_B_COVIDMETA 2915 0.92 1.79 0.53 134 URI_HEX 2782 1.29 1.71 1.10 135 MAILING_LIST_MULTI 2740 2.12 1.68 2.31 136 XMSexyCombo_01 2716 1.07 1.67 0.81 137 HK_RANDOM_REPLYTO 2685 0.55 1.65 0.07 138 BAYES_40 2630 3.81 1.61 4.78 139 TR_Symld_Words 2629 1.43 1.61 1.35 140 TR_XM_NoHeaderRelay 2608 0.56 1.60 0.10 141 TR_XM_MSPIKECOMBO2 2565 0.56 1.57 0.11 142 ALL_TRUSTED 2507 10.44 1.54 14.35 143 XMStockSpam_06 2493 1.59 1.53 1.61 144 TR_XM_SpammyWords3 2456 0.71 1.51 0.36 145 T_XMHurry_00 2453 0.74 1.51 0.40 146 XM_UB99 2388 0.45 1.47 0.00 147 XMBdyGiftCard01 2371 0.88 1.46 0.63 148 XMGenDplmaNmb 2349 0.84 1.44 0.57 149 TR_XM_PHPDW 2343 0.63 1.44 0.27 150 XM_URI_RBL 2326 0.52 1.43 0.11 151 HTML_TAG_BALANCE_BODY 2271 0.84 1.39 0.60 152 RCVD_IN_MSPIKE_L5 2256 0.44 1.39 0.02 153 TR_XM_PHPForged 2253 0.59 1.38 0.24 154 TR_XM_Base64_M1 2250 1.05 1.38 0.90 155 TR_XM_FormFill2 2216 0.58 1.36 0.24 156 TR_Caps_n_Bayes_99 2207 0.58 1.36 0.23 157 XM_H_PHPOS 2201 0.57 1.35 0.23 158 RCVD_IN_PSBL 2160 0.78 1.33 0.54 159 RELAYCOUNTRY_RU 2133 0.41 1.31 0.02 160 XMPhish30 2080 0.80 1.28 0.59 161 RCVD_IN_IADB_VOUCHED 2050 2.48 1.26 3.02 162 HTML_IMAGE_ONLY_24 2047 0.57 1.26 0.26 163 RELAYCOUNTRY_FR 2047 0.51 1.26 0.18 164 MPART_ALT_DIFF_COUNT 2032 0.75 1.25 0.53 165 XM_UB999 1966 0.37 1.21 0.00 166 HTTPS_HTTP_MISMATCH 1942 0.74 1.19 0.54 167 XMHTML_After_End 1923 1.26 1.18 1.30 168 URIBL_BLACK 1907 0.39 1.17 0.04 169 BAYES_20 1903 3.85 1.17 5.03 170 KHOP_HELO_FCRDNS 1895 4.51 1.16 5.98 171 URI_PHP_REDIR 1895 0.36 1.16 0.00 172 TR_XM_COVIDMETA1 1747 0.43 1.07 0.15 173 XM_H_Undi_Recip 1746 0.45 1.07 0.17 174 TR_XM_BayesRelay 1686 0.32 1.04 0.00 175 XM_H_Long_From02 1676 0.89 1.03 0.83 176 TR_XM_MaxSPIKE 1675 0.39 1.03 0.11 177 HTML_OBFUSCATE_05_10 1673 0.47 1.03 0.23 178 XMReplyNow 1669 0.46 1.02 0.22 179 T_TooManySym_02 1659 2.51 1.02 3.16 180 T_Symld_Words_02 1587 0.66 0.97 0.53 181 NUMERIC_HTTP_ADDR 1584 0.44 0.97 0.21 182 TR_Mismatch_TLD_01 1559 0.41 0.96 0.17 183 HTTP_EXCESSIVE_ESCAPES 1542 0.29 0.95 0.00 184 XM_B_REG_HTML 1482 0.50 0.91 0.31 185 XMSubMetaI_00 1481 0.77 0.91 0.70 186 SHOPIFY_IMG_NOT_RCVD_SFY 1462 0.41 0.90 0.20 187 DIET_1 1457 0.57 0.89 0.42 188 XM_Body_Dirty_Words_01 1451 0.33 0.89 0.08 189 XMBrknScrpt_02 1434 0.57 0.88 0.43 190 TM2_M_OBFU_COMMENT 1428 0.38 0.88 0.16 191 XM_B_DNDMA 1409 0.53 0.87 0.39 192 URI_TRY_3LD 1407 0.62 0.86 0.51 193 TR_Mismatch_TLD_02 1398 0.31 0.86 0.07 194 LONGLN_LOW_CONTRAST 1398 0.39 0.86 0.18 195 XM_UB60 1378 0.29 0.85 0.05 196 DOS_RCVD_IP_TWICE_B 1377 0.39 0.85 0.19 197 RELAYCOUNTRY_IE 1335 0.37 0.82 0.17 198 THIS_AD 1314 0.44 0.81 0.27 199 TR_MetaPhish_Combo_01 1285 0.72 0.79 0.69 200 DKIM_ADSP_CUSTOM_MED 1285 0.82 0.79 0.83 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316099 88.74 96.50 85.33 2 RELAYCOUNTRY_US 308013 82.56 81.23 83.15 3 DCC_CHECK_NEGATIVE 261064 56.78 25.63 70.48 4 DKIM_SIGNED 249712 74.52 90.69 67.41 5 XM_DK_Pass 245667 73.26 89.04 66.32 6 DKIM_VALID 242472 72.33 87.95 65.46 7 XM_B_Unicode 237216 69.53 82.02 64.04 8 BAYES_50 185635 48.22 43.90 50.11 9 DKIM_VALID_AU 178722 53.44 65.25 48.25 10 XM_B_SpammyWords 172482 53.15 68.14 46.56 11 XMListUnsubscribeExists 157136 50.91 70.21 42.42 12 XM_B_Unicode3 144509 41.58 47.41 39.01 13 RCVD_IN_MSPIKE_H2 136519 40.04 47.27 36.85 14 T_TM2_M_HEADER_IN_MSG 127223 30.58 22.03 34.34 15 DCC_CHECK 109193 43.18 74.35 29.48 16 HTML_FONT_LOW_CONTRAST 87706 26.79 33.88 23.68 17 DKIM_VALID_EF 87437 26.45 32.93 23.60 18 FVGT_m_MULTI_ODD 77017 24.87 34.15 20.79 19 LOC_TINY_FONT_1 75723 25.10 35.70 20.44 20 XMSubLong 68807 19.52 21.68 18.57 21 BAYES_00 67843 12.93 0.70 18.31 22 MIME_HTML_ONLY 66589 23.70 36.71 17.98 23 T_KAM_HTML_FONT_INVALID 61133 20.36 29.12 16.50 24 LOTS_OF_MONEY 61001 15.89 14.57 16.47 25 XM_B_SpammyWords2 59800 23.42 39.97 16.14 26 IN_ZIMBRA_NJ_WHITELIST 57696 10.84 0.08 15.58 27 RCVD_IN_MSPIKE_WL 55106 15.14 15.75 14.88 28 ALL_TRUSTED 53145 10.44 1.54 14.35 29 TR_XM_SpammyWords4 44928 12.28 12.64 12.13 30 XM_SPF_SoftFail 41908 9.07 3.98 11.31 31 USER_IN_DEF_DKIM_WL 41854 8.77 3.00 11.30 32 HTML_FONT_FACE_BAD 40608 7.85 0.76 10.96 33 XM_Multi_Part_URI 39707 12.69 17.17 10.72 34 HTML_IMAGE_RATIO_06 39557 8.45 3.38 10.68 35 XM_Body_Dirty_Words 38761 14.33 23.12 10.46 36 RCVD_IN_MSPIKE_H3 36142 10.46 12.05 9.76 37 XM_B_Unsub 31595 11.29 17.56 8.53 38 BAYES_60 29220 7.82 7.68 7.89 39 XM_DKIMWhitelistDomains 29150 5.48 0.03 7.87 40 LotsOfNums_01 28905 7.77 7.68 7.80 41 XM_Evil_Numbers_Gen 27735 7.87 8.73 7.49 42 TooManyTo_001 26664 6.45 4.75 7.20 43 TR_XM_BayesUnsub 24671 9.87 17.17 6.66 44 TR_XM_DK_Bayes 24384 4.72 0.48 6.58 45 UNPARSEABLE_RELAY 24363 8.15 11.72 6.58 46 TR_XM_DK_Bayes1 24028 4.65 0.47 6.49 47 T_TooManySym_01 23986 5.40 2.94 6.48 48 XM_DK_Undo_02 22280 16.84 41.48 6.01 49 KHOP_HELO_FCRDNS 22141 4.51 1.16 5.98 50 HTML_IMAGE_RATIO_04 20712 5.29 4.60 5.59 51 BAYES_99 19177 13.20 31.45 5.18 52 TR_XM_UnparsRelay 19172 7.08 11.41 5.18 53 BAYES_20 18636 3.85 1.17 5.03 54 RCVD_IN_IADB_LISTED 18453 4.28 2.68 4.98 55 XM_H_Long_From01 18420 5.21 5.75 4.97 56 MPART_ALT_DIFF 18053 6.86 11.37 4.87 57 TR_XM_DK_Bayes2 18013 3.49 0.36 4.86 58 HTML_IMAGE_RATIO_02 17824 5.42 6.79 4.81 59 BAYES_40 17693 3.81 1.61 4.78 60 MIME_QP_LONG_LINE 17618 4.38 3.52 4.76 61 BOTNET_IPINHOSTNAME 17305 6.98 12.23 4.67 62 RCVD_IN_IADB_SPF 16435 3.78 2.30 4.44 63 BAYES_999 16164 10.63 24.89 4.36 64 XM_SendGrid 16099 5.14 6.93 4.35 65 RCVD_IN_MSPIKE_H4 15486 3.96 3.45 4.18 66 HTML_IMAGE_RATIO_08 15041 3.71 2.92 4.06 67 RCVD_IN_VALIDITY_SAFE 14898 3.94 3.76 4.02 68 RCVD_IN_IADB_SENDERID 14651 3.41 2.18 3.96 69 XM_PDF 14308 2.91 0.75 3.86 70 TR_XM_DKIM_Undo 14271 13.08 34.06 3.85 71 RCVD_IN_IADB_DK 14175 3.33 2.19 3.83 72 T_HTML_ATTACH 13668 2.60 0.12 3.69 73 XM_H_Trusted_IP 13476 2.53 0.00 3.64 74 BAYES_80 13130 4.96 8.17 3.54 75 RCVD_IN_VALIDITY_CERTIFIED 13020 3.37 3.04 3.51 76 XMStrtUSub 12973 3.67 4.05 3.50 77 MIME_HTML_ONLY_MULTI 12411 4.81 8.13 3.35 78 XM_UncommonTLD01 11913 4.45 7.25 3.22 79 XMSubMetaSx_00 11872 3.95 5.63 3.20 80 T_REMOTE_IMAGE 11854 3.39 3.81 3.20 81 T_TooManySym_02 11707 2.51 1.02 3.16 82 FSL_BULK_SIG 11658 5.46 10.73 3.15 83 XMSexyCombo_05 11595 5.61 11.26 3.13 84 XM_B_SpammyWords3 11374 6.00 12.67 3.07 85 RELAYCOUNTRY_META 11215 8.77 21.82 3.03 86 RCVD_IN_IADB_VOUCHED 11180 2.48 1.26 3.02 87 XMNumbers 11055 2.96 2.90 2.98 88 XM_B_Phish_Phrases 10980 3.65 5.22 2.96 89 BAYES_05 10888 2.23 0.62 2.94 90 TR_XM_DK_SendGrid 10605 3.31 4.34 2.86 91 SUBJ_ALL_CAPS 10310 2.77 2.73 2.78 92 TR_XM_PhishingBody 9994 3.73 6.07 2.70 93 TM2_M_URI_OPT_OUT 9409 2.74 3.18 2.54 94 MAILING_LIST_MULTI 8545 2.12 1.68 2.31 95 MIME_HTML_MOSTLY 8431 2.91 4.35 2.28 96 BAYES_95 8208 2.98 4.70 2.22 97 XM_B_SpammyTLD 8200 2.89 4.43 2.21 98 URI_NOVOWEL 7871 2.31 2.74 2.12 99 ANY_BOUNCE_MESSAGE 7652 1.62 0.62 2.07 100 BOUNCE_MESSAGE 7651 1.62 0.62 2.07 101 FROM_EXCESS_BASE64 7625 2.24 2.66 2.06 102 RCVD_IN_IADB_OPTIN 7570 1.65 0.75 2.04 103 TooManyTo_002 7503 1.56 0.49 2.03 104 DKIM_INVALID 7240 2.20 2.74 1.95 105 XM_CamelCaseFrm001 7105 2.20 2.85 1.92 106 TR_XM_SB_Phish 6915 1.87 1.88 1.87 107 XMSubPhish11 6879 1.85 1.84 1.86 108 INVALID_MSGID 6750 1.32 0.16 1.82 109 BOTNET 6392 4.14 9.64 1.73 110 IN_HORDE_ADDRESS_BOOK 6179 1.19 0.11 1.67 111 MSGID_NOFQDN1 6116 1.16 0.03 1.65 112 TR_XM_SpammyWords5 6112 2.51 4.45 1.65 113 HTML_MIME_NO_HTML_TAG 6002 3.20 6.80 1.62 114 TVD_RCVD_IP 5983 1.21 0.29 1.62 115 XM_B_Phish66 5971 2.15 3.38 1.61 116 XMStockSpam_06 5969 1.59 1.53 1.61 117 TO_MALFORMED 5931 1.12 0.02 1.60 118 T_XMDrugObfuBody_08 5874 2.64 5.05 1.59 119 TR_XM_SpammyRelay 5182 5.18 13.77 1.40 120 XM_B_Unsub2 5172 1.80 2.72 1.40 121 TR_Symld_Words 5017 1.43 1.61 1.35 122 HELO_NODOT 4949 1.13 0.66 1.34 123 HELO_NO_DOMAIN 4943 1.13 0.66 1.33 124 TR_DCC_Bayes_99 4924 7.69 22.17 1.33 125 T_XMDrugObfuBody_14 4908 2.13 3.97 1.32 126 XMHTML_After_End 4801 1.26 1.18 1.30 127 XM_B_Investor 4718 2.29 4.60 1.27 128 TooManyTo_003 4704 1.00 0.40 1.27 129 XMGappySubj_01 4635 0.91 0.14 1.25 130 XMBSHREFv2 4511 0.93 0.29 1.22 131 XMDiploma_00 4477 1.79 3.12 1.21 132 XM_DK_Undo_01 4306 1.73 3.01 1.16 133 UNTRUSTED_Relay 4135 2.89 6.92 1.12 134 XMSubNoVowel 4132 1.00 0.73 1.12 135 XM_GoogleGroups 4127 2.47 5.54 1.11 136 URI_HEX 4083 1.29 1.71 1.10 137 XMNoVowels 3984 0.86 0.38 1.08 138 XMBody_95 3745 0.75 0.17 1.01 139 RELAYCOUNTRY_CA 3721 3.65 9.67 1.00 140 TM2_M_VERY_LONG_WORD 3637 3.00 7.60 0.98 141 RCVD_IN_MSPIKE_H5 3478 0.73 0.25 0.94 142 XM_OfRef6 3450 1.67 3.35 0.93 143 XMCapTrack 3373 0.74 0.37 0.91 144 T_FILL_THIS_FORM_SHORT 3371 1.74 3.63 0.91 145 TooManyTo_004 3361 0.73 0.32 0.91 146 TR_XM_Base64_M1 3339 1.05 1.38 0.90 147 XMSubMetaSxObfu_03 3232 0.74 0.44 0.87 148 FROM_GOV_DKIM_AU 3147 0.64 0.16 0.85 149 DKIM_ADSP_CUSTOM_MED 3085 0.82 0.79 0.83 150 XM_H_Long_From02 3080 0.89 1.03 0.83 151 XMSexyCombo_01 2993 1.07 1.67 0.81 152 RCVD_IN_MSPIKE_BL 2975 1.64 3.53 0.80 153 RCVD_IN_RP_SAFE 2923 0.78 0.76 0.79 154 TR_XM_MSPIKECOMBO 2923 1.59 3.41 0.79 155 HTML_IMAGE_ONLY_20 2845 0.65 0.39 0.77 156 RCVD_IN_MSPIKE_L3 2840 1.10 1.85 0.77 157 TooManyTo_005 2797 0.61 0.27 0.76 158 TVD_SPACE_RATIO 2759 0.55 0.09 0.74 159 XM_UB50 2700 1.45 3.08 0.73 160 T_TooManySym_03 2616 0.64 0.49 0.71 161 XMSubMetaI_00 2601 0.77 0.91 0.70 162 RCVD_IN_RP_CERTIFIED 2585 0.67 0.62 0.70 163 TR_MetaPhish_Combo_01 2553 0.72 0.79 0.69 164 TR_XM_SpammyWords2 2422 4.16 12.12 0.65 165 XMBdyGiftCard01 2338 0.88 1.46 0.63 166 XM_B_SpammyWords4 2249 1.08 2.16 0.61 167 HTML_TAG_BALANCE_BODY 2223 0.84 1.39 0.60 168 XMPhish30 2192 0.80 1.28 0.59 169 SpammyFromTLD_01 2146 1.32 2.99 0.58 170 XM_B_COPY_HTML 2137 0.64 0.77 0.58 171 XMGenDplmaNmb 2106 0.84 1.44 0.57 172 T_OBFU_PDF_ATTACH 2015 0.42 0.13 0.54 173 XM_ShortIntro_01 2008 0.49 0.38 0.54 174 RCVD_IN_PSBL 2008 0.78 1.33 0.54 175 HTTPS_HTTP_MISMATCH 1986 0.74 1.19 0.54 176 T_XMDrugObfuBody_00 1980 0.95 1.88 0.53 177 MPART_ALT_DIFF_COUNT 1976 0.75 1.25 0.53 178 XM_B_COVIDMETA 1971 0.92 1.79 0.53 179 T_Symld_Words_02 1958 0.66 0.97 0.53 180 XMSubMetaSx_01 1945 0.46 0.31 0.53 181 NML_ADSP_CUSTOM_MED 1906 0.52 0.55 0.51 182 XMSexyCombo_04 1900 0.52 0.54 0.51 183 URI_TRY_3LD 1875 0.62 0.86 0.51 184 XM_D_tchamptons_WL 1843 0.35 0.02 0.50 185 XMSexyCombo_02 1754 0.37 0.14 0.47 186 PLING_QUERY 1725 0.53 0.68 0.47 187 FORGED_GMAIL_RCVD 1713 0.53 0.69 0.46 188 XM_ProductURIs 1681 0.49 0.58 0.45 189 RELAYCOUNTRY_GB 1660 0.50 0.60 0.45 190 XMBody_17 1655 1.43 3.68 0.45 191 XM_H_PHPMailer 1649 0.52 0.69 0.45 192 RCVD_IN_BL_SPAMCOP_NET 1620 3.36 10.01 0.44 193 XMBrknScrpt_02 1594 0.57 0.88 0.43 194 DIET_1 1571 0.57 0.89 0.42 195 SHORT_HELO_AND_INLINE_IMAGE 1540 0.32 0.09 0.42 196 HTML_IMAGE_ONLY_32 1512 0.34 0.20 0.41 197 TO_NO_BRKTS_HTML_ONLY 1506 0.42 0.44 0.41 198 XMLngstWrd_00 1472 2.00 5.64 0.40 199 T_XMHurry_00 1471 0.74 1.51 0.40 200 BASE64_LENGTH_79_INF 1454 0.33 0.19 0.39 ----------------------------------------------------------------------