Email: 379691 Autolearn: 0 AvgScore: 3.66 AvgScanTime: 1.23 sec Spam: 116657 Autolearn: 0 AvgScore: 13.56 AvgScanTime: 1.33 sec Ham: 263034 Autolearn: 0 AvgScore: -0.74 AvgScanTime: 1.18 sec Time Spent Running SA: 129.66 hours Time Spent Processing Spam: 43.11 hours Time Spent Processing Ham: 86.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109721 89.38 94.05 87.31 2 DKIM_SIGNED 99798 81.66 85.55 79.94 3 XM_DK_Pass 97113 80.15 83.25 78.77 4 DKIM_VALID 95537 78.66 81.90 77.22 5 DCC_CHECK 92920 57.21 79.65 47.26 6 XM_B_Unicode 89296 75.23 76.55 74.65 7 RELAYCOUNTRY_US 87901 80.63 75.35 82.98 8 XMListUnsubscribeExists 86860 63.13 74.46 58.11 9 XM_B_SpammyWords 81595 56.74 69.94 50.88 10 DKIM_VALID_AU 75888 63.93 65.05 63.43 11 XM_DK_Undo_02 53384 21.00 45.76 10.02 12 BAYES_99 47152 17.19 40.42 6.89 13 LOC_TINY_FONT_1 46227 34.43 39.63 32.12 14 HTML_FONT_LOW_CONTRAST 45394 35.39 38.91 33.83 15 XM_B_SpammyWords2 45287 28.24 38.82 23.55 16 XM_B_Unicode3 44507 43.35 38.15 45.65 17 TR_DCC_Bayes_99 37545 12.69 32.18 4.04 18 BAYES_999 37285 13.70 31.96 5.60 19 BAYES_50 36707 46.50 31.47 53.17 20 DKIM_VALID_EF 35413 29.37 30.36 28.93 21 RCVD_IN_MSPIKE_H2 32023 26.97 27.45 26.75 22 MIME_HTML_ONLY 30048 24.66 25.76 24.18 23 RELAYCOUNTRY_META 28097 10.60 24.09 4.61 24 FVGT_m_MULTI_ODD 27801 22.83 23.83 22.38 25 XM_Multi_Part_URI 26069 16.16 22.35 13.42 26 T_TM2_M_HEADER_IN_MSG 26039 22.06 22.32 21.94 27 T_KAM_HTML_FONT_INVALID 24449 18.28 20.96 17.09 28 XMSubLong 23081 21.04 19.79 21.60 29 DCC_CHECK_NEGATIVE 22065 41.50 18.91 51.52 30 XM_UncommonTLD01 21979 8.59 18.84 4.04 31 BOTNET 20727 6.93 17.77 2.12 32 RCVD_IN_MSPIKE_WL 18268 26.08 15.66 30.70 33 TR_XM_SpammyWords2 18154 6.30 15.56 2.19 34 XM_Body_Dirty_Words 18134 15.04 15.54 14.82 35 UNTRUSTED_Relay 17421 6.30 14.93 2.48 36 LOTS_OF_MONEY 15908 8.94 13.64 6.86 37 LotsOfNums_01 14727 9.90 12.62 8.70 38 XM_B_Unsub 14687 11.08 12.59 10.41 39 XMBrknScrpt_02 14046 4.65 12.04 1.38 40 BOTNET_IPINHOSTNAME 13259 7.71 11.37 6.09 41 RCVD_IN_MSPIKE_BL 13123 4.00 11.25 0.79 42 XM_B_SpammyWords3 12813 7.44 10.98 5.87 43 MPART_ALT_DIFF 12070 7.19 10.35 5.79 44 FSL_BULK_SIG 11598 6.88 9.94 5.53 45 XMSexyCombo_05 11459 7.06 9.82 5.83 46 MIME_HTML_MOSTLY 11432 5.03 9.80 2.91 47 XM_B_Phish_Phrases 11385 7.59 9.76 6.63 48 TooManyTo_001 11070 7.59 9.49 6.75 49 HTML_IMAGE_RATIO_02 10872 9.14 9.32 9.05 50 BAYES_80 10841 6.41 9.29 5.13 51 XM_Evil_Numbers_Gen 10371 9.92 8.89 10.38 52 SpammyFromTLD_02 9867 2.72 8.46 0.17 53 RCVD_IN_MSPIKE_H3 9602 14.13 8.23 16.75 54 RELAYCOUNTRY_CA 9377 3.69 8.04 1.76 55 RCVD_IN_BL_SPAMCOP_NET 9279 3.27 7.95 1.20 56 XMSubMetaSx_00 8122 4.90 6.96 3.98 57 RCVD_IN_MSPIKE_H4 8065 10.41 6.91 11.96 58 BAYES_60 8000 7.72 6.86 8.10 59 TR_XM_SpammyWords3 7733 2.45 6.63 0.60 60 RCVD_IN_MSPIKE_L3 7532 2.41 6.46 0.61 61 BAYES_95 7505 4.19 6.43 3.20 62 SpammyFromTLD_01 7327 2.29 6.28 0.53 63 RCVD_IN_RP_RNBL 6855 1.85 5.88 0.06 64 UNPARSEABLE_RELAY 6801 7.97 5.83 8.91 65 URIBL_SBL_A 6166 1.77 5.29 0.21 66 XM_UB50 6070 2.38 5.20 1.12 67 XM_OfRef6 5934 2.72 5.09 1.67 68 XM_SPF_SoftFail 5857 2.27 5.02 1.05 69 HTML_IMAGE_RATIO_04 5819 6.64 4.99 7.38 70 XMStrtUSub 5755 5.78 4.93 6.15 71 URI_PHP_REDIR 5407 1.43 4.63 0.01 72 TR_LOTS_OF_MONEY3 5357 2.18 4.59 1.12 73 XM_H_Long_From01 5321 5.17 4.56 5.43 74 TR_XM_PhishingBody 5140 3.33 4.41 2.85 75 XMBody_17 5011 2.17 4.30 1.23 76 BOTNET_NORDNS 5002 1.33 4.29 0.02 77 XM_UB99 4949 1.31 4.24 0.00 78 TR_XM_MaxSPIKE 4740 1.27 4.06 0.03 79 HTML_IMAGE_RATIO_08 4665 3.26 4.00 2.93 80 XM_SendGrid 4656 6.96 3.99 8.27 81 RELAYCOUNTRY_FR 4618 1.37 3.96 0.22 82 XMNumbers 4587 4.29 3.93 4.45 83 TM2_M_URI_OPT_OUT 4360 4.82 3.74 5.30 84 T_FONT_INVIS_NAKED_TO 4331 2.81 3.71 2.42 85 DKIM_INVALID 4261 3.00 3.65 2.71 86 RCVD_IN_MSPIKE_L5 4163 1.18 3.57 0.12 87 TR_XM_MaxBayes 4054 1.08 3.48 0.02 88 URI_TRY_3LD 4038 1.93 3.46 1.26 89 URI_HEX 4036 1.99 3.46 1.34 90 HTML_MIME_NO_HTML_TAG 3968 2.32 3.40 1.85 91 XM_UB999 3794 1.00 3.25 0.00 92 HTML_IMAGE_RATIO_06 3770 3.54 3.23 3.67 93 RCVD_IN_PSBL 3469 0.92 2.97 0.01 94 RCVD_IN_RP_SAFE 3468 9.44 2.97 12.31 95 XM_B_Unsub2 3381 1.62 2.90 1.05 96 XM_B_SpammyTLD 3258 2.09 2.79 1.78 97 FROM_SUSPICIOUS_NTLD 3246 0.94 2.78 0.12 98 T_HTML_TAG_BALANCE_CENTER 3212 1.06 2.75 0.31 99 XM_DIRTYINTL 3199 1.20 2.74 0.52 100 INVALID_MSGID 3196 2.85 2.74 2.90 101 SHORT_SHORTNER 3133 0.85 2.69 0.03 102 FROM_SUSPICIOUS_NTLD_FP 3124 0.90 2.68 0.11 103 XMDiploma_00 3123 1.76 2.68 1.36 104 DATE_IN_PAST_03_06 3084 0.87 2.64 0.09 105 FROM_EXCESS_BASE64 3082 3.39 2.64 3.72 106 TR_XM_UnparsRelay 3048 1.22 2.61 0.61 107 ANY_BOUNCE_MESSAGE 2988 2.78 2.56 2.88 108 BOUNCE_MESSAGE 2986 2.78 2.56 2.88 109 T_XMDrugObfuBody_08 2811 1.88 2.41 1.65 110 HTML_SHORT_LINK_IMG_1 2780 0.75 2.38 0.03 111 T_REMOTE_IMAGE 2759 2.50 2.37 2.56 112 KHOP_HELO_FCRDNS 2747 1.32 2.35 0.86 113 HTML_IMAGE_ONLY_04 2731 0.74 2.34 0.03 114 MIME_CHARSET_FARAWAY 2701 0.81 2.32 0.14 115 MIME_HTML_ONLY_MULTI 2685 3.26 2.30 3.69 116 SHORTENER_SHORT_IMG 2615 0.69 2.24 0.00 117 T_FILL_THIS_FORM_SHORT 2614 1.27 2.24 0.84 118 HTML_SHORT_CENTER 2613 0.69 2.24 0.00 119 XM_B_Phish66 2531 1.39 2.17 1.04 120 MIME_HEADER_CTYPE_ONLY 2530 0.72 2.17 0.08 121 TR_XM_DK_SendGrid 2520 4.13 2.16 5.00 122 T_TooManySym_01 2516 4.93 2.16 6.16 123 XM_CamelCaseFrm001 2507 1.98 2.15 1.90 124 RCVD_IN_RP_CERTIFIED 2434 8.49 2.09 11.33 125 XM_B_SpammyWords4 2419 1.24 2.07 0.86 126 BAYES_40 2407 3.53 2.06 4.18 127 XMBdyGiftCard01 2365 1.93 2.03 1.89 128 XMSubNoVowel 2197 1.41 1.88 1.21 129 TM2_M_VERY_LONG_WORD 2105 1.40 1.80 1.22 130 BAYES_20 2104 2.81 1.80 3.25 131 XM_UB60 2102 0.63 1.80 0.12 132 T_XMHurry_00 2067 1.24 1.77 1.00 133 CHARSET_FARAWAY_HEADER 2043 0.58 1.75 0.06 134 SUBJ_ALL_CAPS 2024 1.29 1.74 1.09 135 XM_UB80 2017 0.55 1.73 0.03 136 TO_IN_SUBJ 1992 0.58 1.71 0.08 137 XMSexyCombo_01 1980 0.86 1.70 0.49 138 XM_SPF_Unknown 1919 0.80 1.64 0.43 139 TR_XM_COVIDMETA4 1892 0.66 1.62 0.23 140 TR_XM_SB_Phish 1817 1.58 1.56 1.59 141 XMSubPhish11 1753 1.56 1.50 1.58 142 URI_OPTOUT_3LD 1683 0.50 1.44 0.08 143 TR_XM_PHPDW 1654 0.68 1.42 0.35 144 XM_B_COVIDMETA 1649 0.86 1.41 0.62 145 TR_XM_RelayPhish 1644 0.48 1.41 0.07 146 TR_XM_INV_DKIM 1629 0.54 1.40 0.16 147 TR_XM_PHPForged 1618 0.67 1.39 0.35 148 TR_XM_FormFill2 1606 0.66 1.38 0.34 149 XM_H_PHPOS 1605 0.65 1.38 0.33 150 T_PDS_OTHER_BAD_TLD 1602 0.75 1.37 0.47 151 LH_URI_DOM_IN_PATH 1592 1.35 1.36 1.35 152 XMStockSpam_06 1579 1.54 1.35 1.62 153 HK_RANDOM_REPLYTO 1558 0.56 1.34 0.22 154 XMLngstWrd_00 1543 0.81 1.32 0.59 155 TR_MetaPhish_Combo_01 1538 0.86 1.32 0.66 156 DATE_IN_PAST_06_12 1488 0.59 1.28 0.29 157 XM_H_SupportSpoof 1442 0.49 1.24 0.16 158 TR_XM_FormFill 1421 0.38 1.22 0.01 159 DKIM_ADSP_CUSTOM_MED 1402 1.15 1.20 1.13 160 RELAYCOUNTRY_IN 1389 0.42 1.19 0.08 161 MIME_QP_LONG_LINE 1369 3.01 1.17 3.82 162 RCVD_IN_MSPIKE_L4 1367 0.39 1.17 0.05 163 XM_OfRef7 1367 0.43 1.17 0.10 164 DKIM_ADSP_NXDOMAIN 1367 0.98 1.17 0.89 165 XMHTML_After_End 1360 0.89 1.17 0.77 166 XM_Combo_Sbj 1360 0.53 1.17 0.25 167 XMSlimDrugH 1345 0.70 1.15 0.50 168 RELAYCOUNTRY_GB 1328 0.76 1.14 0.59 169 NML_ADSP_CUSTOM_MED 1326 0.91 1.14 0.80 170 TR_Mismatch_TLD_01 1324 0.64 1.13 0.42 171 RELAYCOUNTRY_DE 1315 0.59 1.13 0.36 172 XMGenDplmaNmb 1314 0.80 1.13 0.66 173 XM_UB95 1313 0.35 1.13 0.01 174 XMBody_78 1299 0.70 1.11 0.52 175 RDNS_DYNAMIC 1289 0.92 1.10 0.83 176 RCVD_IN_IADB_LISTED 1282 2.88 1.10 3.67 177 SHORT_IMG_SUSP_NTLD 1278 0.34 1.10 0.00 178 FORGED_GMAIL_RCVD 1270 0.73 1.09 0.57 179 XM_Lotto 1261 0.41 1.08 0.12 180 MIMEOLE_DIRECT_TO_MX 1261 0.33 1.08 0.00 181 RELAYCOUNTRY_NL 1252 0.58 1.07 0.36 182 BODY_URI_ONLY 1247 0.35 1.07 0.03 183 XM_URI_RBL 1243 0.47 1.07 0.21 184 NUMERIC_HTTP_ADDR 1233 0.98 1.06 0.95 185 XM_H_Long_From02 1223 1.12 1.05 1.15 186 T_XMDrugObfuBody_14 1222 1.44 1.05 1.61 187 MPART_ALT_DIFF_COUNT 1220 0.67 1.05 0.50 188 XMPhish30 1205 0.71 1.03 0.56 189 TR_Mismatch_TLD_02 1193 0.36 1.02 0.07 190 XMLngstWrd_01 1174 0.66 1.01 0.51 191 DOS_OE_TO_MX 1161 0.31 1.00 0.00 192 RCVD_IN_IADB_SPF 1154 2.55 0.99 3.24 193 BAYES_05 1142 1.64 0.98 1.94 194 SUBJ_DOLLARS 1133 0.48 0.97 0.26 195 XM_ProductURIs 1132 1.09 0.97 1.15 196 TR_Symld_Words 1126 1.62 0.97 1.91 197 XM_BadFromFormat 1121 0.48 0.96 0.26 198 LongTLD 1118 0.42 0.96 0.18 199 RCVD_IN_IADB_SENDERID 1102 2.33 0.94 2.95 200 RCVD_IN_IADB_DK 1098 2.28 0.94 2.88 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 229645 89.38 94.05 87.31 2 RELAYCOUNTRY_US 218262 80.63 75.35 82.98 3 DKIM_SIGNED 210261 81.66 85.55 79.94 4 XM_DK_Pass 207199 80.15 83.25 78.77 5 DKIM_VALID 203125 78.66 81.90 77.22 6 XM_B_Unicode 196353 75.23 76.55 74.65 7 DKIM_VALID_AU 166841 63.93 65.05 63.43 8 XMListUnsubscribeExists 152855 63.13 74.46 58.11 9 BAYES_50 139865 46.50 31.47 53.17 10 DCC_CHECK_NEGATIVE 135518 41.50 18.91 51.52 11 XM_B_SpammyWords 133831 56.74 69.94 50.88 12 DCC_CHECK 124302 57.21 79.65 47.26 13 XM_B_Unicode3 120076 43.35 38.15 45.65 14 HTML_FONT_LOW_CONTRAST 88997 35.39 38.91 33.83 15 LOC_TINY_FONT_1 84498 34.43 39.63 32.12 16 RCVD_IN_MSPIKE_WL 80761 26.08 15.66 30.70 17 DKIM_VALID_EF 76106 29.37 30.36 28.93 18 RCVD_IN_MSPIKE_H2 70367 26.97 27.45 26.75 19 MIME_HTML_ONLY 63597 24.66 25.76 24.18 20 XM_B_SpammyWords2 61937 28.24 38.82 23.55 21 FVGT_m_MULTI_ODD 58880 22.83 23.83 22.38 22 T_TM2_M_HEADER_IN_MSG 57717 22.06 22.32 21.94 23 XMSubLong 56812 21.04 19.79 21.60 24 T_KAM_HTML_FONT_INVALID 44956 18.28 20.96 17.09 25 RCVD_IN_MSPIKE_H3 44066 14.13 8.23 16.75 26 XM_Body_Dirty_Words 38971 15.04 15.54 14.82 27 BAYES_00 37195 10.01 0.68 14.14 28 XM_Multi_Part_URI 35293 16.16 22.35 13.42 29 ALL_TRUSTED 33453 9.06 0.81 12.72 30 RCVD_IN_RP_SAFE 32375 9.44 2.97 12.31 31 RCVD_IN_MSPIKE_H4 31450 10.41 6.91 11.96 32 RCVD_IN_RP_CERTIFIED 29814 8.49 2.09 11.33 33 XM_DKIMWhitelistDomains 27608 7.27 0.00 10.50 34 XM_B_Unsub 27389 11.08 12.59 10.41 35 TR_XM_DK_Bayes 27363 7.33 0.39 10.40 36 XM_Evil_Numbers_Gen 27301 9.92 8.89 10.38 37 TR_XM_DK_Bayes1 26815 7.18 0.38 10.19 38 XM_DK_Undo_02 26367 21.00 45.76 10.02 39 TR_XM_DK_Bayes2 25222 6.75 0.34 9.59 40 HTML_IMAGE_RATIO_02 23814 9.14 9.32 9.05 41 UNPARSEABLE_RELAY 23442 7.97 5.83 8.91 42 LotsOfNums_01 22874 9.90 12.62 8.70 43 XM_SendGrid 21763 6.96 3.99 8.27 44 BAYES_60 21298 7.72 6.86 8.10 45 HTML_IMAGE_RATIO_04 19405 6.64 4.99 7.38 46 BAYES_99 18122 17.19 40.42 6.89 47 LOTS_OF_MONEY 18038 8.94 13.64 6.86 48 TooManyTo_001 17742 7.59 9.49 6.75 49 XM_B_Phish_Phrases 17434 7.59 9.76 6.63 50 T_TooManySym_01 16216 4.93 2.16 6.16 51 XMStrtUSub 16188 5.78 4.93 6.15 52 BOTNET_IPINHOSTNAME 16029 7.71 11.37 6.09 53 XM_B_SpammyWords3 15432 7.44 10.98 5.87 54 XMSexyCombo_05 15338 7.06 9.82 5.83 55 MPART_ALT_DIFF 15236 7.19 10.35 5.79 56 BAYES_999 14740 13.70 31.96 5.60 57 FSL_BULK_SIG 14537 6.88 9.94 5.53 58 XM_H_Long_From01 14295 5.17 4.56 5.43 59 TM2_M_URI_OPT_OUT 13931 4.82 3.74 5.30 60 BAYES_80 13505 6.41 9.29 5.13 61 TR_XM_DK_SendGrid 13150 4.13 2.16 5.00 62 IN_ZIMBRA_NJ_WHITELIST 12964 3.42 0.01 4.93 63 RELAYCOUNTRY_META 12134 10.60 24.09 4.61 64 XMNumbers 11706 4.29 3.93 4.45 65 BAYES_40 10984 3.53 2.06 4.18 66 TR_DCC_Bayes_99 10635 12.69 32.18 4.04 67 XM_UncommonTLD01 10634 8.59 18.84 4.04 68 XMSubMetaSx_00 10464 4.90 6.96 3.98 69 MIME_QP_LONG_LINE 10041 3.01 1.17 3.82 70 FROM_EXCESS_BASE64 9778 3.39 2.64 3.72 71 MIME_HTML_ONLY_MULTI 9702 3.26 2.30 3.69 72 HTML_IMAGE_RATIO_06 9666 3.54 3.23 3.67 73 RCVD_IN_IADB_LISTED 9654 2.88 1.10 3.67 74 T_TooManySym_02 8994 2.56 0.63 3.42 75 XM_H_Trusted_IP 8708 2.29 0.00 3.31 76 BAYES_20 8561 2.81 1.80 3.25 77 RCVD_IN_IADB_SPF 8523 2.55 0.99 3.24 78 BAYES_95 8409 4.19 6.43 3.20 79 RCVD_IN_IADB_SENDERID 7754 2.33 0.94 2.95 80 HTML_IMAGE_RATIO_08 7719 3.26 4.00 2.93 81 MIME_HTML_MOSTLY 7648 5.03 9.80 2.91 82 INVALID_MSGID 7641 2.85 2.74 2.90 83 ANY_BOUNCE_MESSAGE 7585 2.78 2.56 2.88 84 BOUNCE_MESSAGE 7584 2.78 2.56 2.88 85 RCVD_IN_IADB_DK 7567 2.28 0.94 2.88 86 TR_XM_PhishingBody 7503 3.33 4.41 2.85 87 DKIM_INVALID 7136 3.00 3.65 2.71 88 TVD_RCVD_IP 6965 1.90 0.22 2.65 89 T_REMOTE_IMAGE 6727 2.50 2.37 2.56 90 UNTRUSTED_Relay 6515 6.30 14.93 2.48 91 TO_MALFORMED 6468 1.72 0.05 2.46 92 T_FONT_INVIS_NAKED_TO 6355 2.81 3.71 2.42 93 XM_PDF 6315 1.77 0.36 2.40 94 HELO_MISC_IP 6283 1.78 0.42 2.39 95 CK_HELO_DYNAMIC_SPLIT_IP 6275 1.82 0.54 2.39 96 TR_XM_SpammyWords2 5773 6.30 15.56 2.19 97 RCVD_IN_IADB_VOUCHED 5676 1.63 0.42 2.16 98 BOTNET 5573 6.93 17.77 2.12 99 MAILING_LIST_MULTI 5477 1.69 0.81 2.08 100 RCVD_IN_MSPIKE_H5 5245 1.54 0.52 1.99 101 BAYES_05 5091 1.64 0.98 1.94 102 TR_Symld_Words 5035 1.62 0.97 1.91 103 XM_CamelCaseFrm001 4996 1.98 2.15 1.90 104 XMBdyGiftCard01 4969 1.93 2.03 1.89 105 XMBSHREFv2 4950 1.36 0.18 1.88 106 URI_NOVOWEL 4946 1.58 0.89 1.88 107 HTML_FONT_FACE_BAD 4919 1.51 0.70 1.87 108 HTML_MIME_NO_HTML_TAG 4857 2.32 3.40 1.85 109 IN_HORDE_ADDRESS_BOOK 4794 1.28 0.05 1.82 110 USER_IN_DEF_DKIM_WL 4751 1.26 0.01 1.81 111 XM_B_SpammyTLD 4693 2.09 2.79 1.78 112 RELAYCOUNTRY_CA 4642 3.69 8.04 1.76 113 XMGappySubj_01 4597 1.28 0.22 1.75 114 XM_OfRef6 4382 2.72 5.09 1.67 115 T_XMDrugObfuBody_08 4336 1.88 2.41 1.65 116 XMStockSpam_06 4273 1.54 1.35 1.62 117 T_XMDrugObfuBody_14 4234 1.44 1.05 1.61 118 XM_DK_Undo_01 4221 1.33 0.72 1.60 119 TR_XM_SB_Phish 4189 1.58 1.56 1.59 120 XMSubPhish11 4157 1.56 1.50 1.58 121 T_TooManySym_03 4024 1.09 0.09 1.53 122 XMBrknScrpt_02 3628 4.65 12.04 1.38 123 XMDiploma_00 3576 1.76 2.68 1.36 124 RCVD_IN_IADB_OPTIN 3560 1.06 0.40 1.35 125 LH_URI_DOM_IN_PATH 3550 1.35 1.36 1.35 126 URI_HEX 3530 1.99 3.46 1.34 127 TooManyTo_002 3508 1.05 0.41 1.33 128 URI_TRY_3LD 3306 1.93 3.46 1.26 129 XM_GoogleGroups 3251 0.97 0.37 1.24 130 XMBody_17 3231 2.17 4.30 1.23 131 TM2_M_VERY_LONG_WORD 3201 1.40 1.80 1.22 132 XMSubNoVowel 3175 1.41 1.88 1.21 133 TR_MSPIKEBAYES00 3170 0.86 0.09 1.21 134 RCVD_IN_BL_SPAMCOP_NET 3151 3.27 7.95 1.20 135 XM_ProductURIs 3023 1.09 0.97 1.15 136 XM_H_Long_From02 3022 1.12 1.05 1.15 137 DKIM_ADSP_CUSTOM_MED 2980 1.15 1.20 1.13 138 XM_UB50 2952 2.38 5.20 1.12 139 TR_LOTS_OF_MONEY3 2933 2.18 4.59 1.12 140 SUBJ_ALL_CAPS 2880 1.29 1.74 1.09 141 XM_B_Unsub2 2775 1.62 2.90 1.05 142 XM_SPF_SoftFail 2763 2.27 5.02 1.05 143 XM_B_Phish66 2744 1.39 2.17 1.04 144 T_XMHurry_00 2638 1.24 1.77 1.00 145 TooManyTo_003 2551 0.75 0.26 0.97 146 T_TooManySym_04 2506 0.67 0.02 0.95 147 NUMERIC_HTTP_ADDR 2493 0.98 1.06 0.95 148 XMBody_95 2492 0.68 0.09 0.95 149 XMPhish08 2364 0.88 0.83 0.90 150 DKIM_ADSP_NXDOMAIN 2349 0.98 1.17 0.89 151 XM_B_SpammyWords4 2272 1.24 2.07 0.86 152 KHOP_HELO_FCRDNS 2267 1.32 2.35 0.86 153 XM_S_SubURI 2235 0.59 0.02 0.85 154 T_FILL_THIS_FORM_SHORT 2218 1.27 2.24 0.84 155 NO_DNS_FOR_FROM 2207 0.81 0.75 0.84 156 RDNS_DYNAMIC 2196 0.92 1.10 0.83 157 XM_B_REG_HTML 2125 0.66 0.34 0.81 158 NML_ADSP_CUSTOM_MED 2111 0.91 1.14 0.80 159 RCVD_IN_MSPIKE_BL 2072 4.00 11.25 0.79 160 TooManyTo_004 2055 0.62 0.24 0.78 161 HTML_TAG_BALANCE_BODY 2019 0.68 0.48 0.77 162 XMHTML_After_End 2018 0.89 1.17 0.77 163 XMHTMLBadTable_001 1970 0.74 0.72 0.75 164 T_TooManySym_05 1948 0.51 0.01 0.74 165 T_XMDrugObfuBody_00 1908 0.77 0.88 0.73 166 HTML_IMAGE_ONLY_20 1864 0.59 0.33 0.71 167 XMSubMetaSxObfu_02 1816 0.62 0.46 0.69 168 XM_B_COPY_HTML 1805 0.63 0.49 0.69 169 TooManyTo_005 1740 0.53 0.22 0.66 170 XMGenDplmaNmb 1730 0.80 1.13 0.66 171 TR_MetaPhish_Combo_01 1728 0.86 1.32 0.66 172 DIET_1 1703 0.71 0.84 0.65 173 XMSubMetaI_00 1696 0.66 0.70 0.64 174 USER_IN_WELCOMELIST 1660 0.44 0.00 0.63 175 USER_IN_WHITELIST 1660 0.44 0.00 0.63 176 XM_RXBody 1633 0.57 0.45 0.62 177 XM_B_COVIDMETA 1633 0.86 1.41 0.62 178 XM_ShortIntro_01 1630 0.59 0.51 0.62 179 RCVD_IN_MSPIKE_L3 1613 2.41 6.46 0.61 180 TR_XM_UnparsRelay 1593 1.22 2.61 0.61 181 TR_XM_SpammyWords3 1569 2.45 6.63 0.60 182 RELAYCOUNTRY_GB 1557 0.76 1.14 0.59 183 XMLngstWrd_00 1542 0.81 1.32 0.59 184 SENDGRID_REDIR 1529 0.54 0.44 0.58 185 FORGED_GMAIL_RCVD 1492 0.73 1.09 0.57 186 XMPhish30 1481 0.71 1.03 0.56 187 HELO_NODOT 1438 0.54 0.51 0.55 188 HELO_NO_DOMAIN 1437 0.54 0.51 0.55 189 SpammyFromTLD_01 1383 2.29 6.28 0.53 190 XMBody_78 1373 0.70 1.11 0.52 191 XM_DIRTYINTL 1360 1.20 2.74 0.52 192 XMLngstWrd_01 1330 0.66 1.01 0.51 193 XMNoVowels 1326 0.45 0.33 0.50 194 XMSlimDrugH 1324 0.70 1.15 0.50 195 BASE64_LENGTH_79_INF 1317 0.49 0.46 0.50 196 MPART_ALT_DIFF_COUNT 1308 0.67 1.05 0.50 197 XMSexyCombo_01 1283 0.86 1.70 0.49 198 XM_H_PHPMailer 1233 0.51 0.59 0.47 199 T_PDS_OTHER_BAD_TLD 1229 0.75 1.37 0.47 200 HTTPS_HTTP_MISMATCH 1156 0.49 0.60 0.44 ----------------------------------------------------------------------