Email: 379821 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.33 sec Spam: 128084 Autolearn: 0 AvgScore: 13.66 AvgScanTime: 1.47 sec Ham: 251737 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 1.26 sec Time Spent Running SA: 140.72 hours Time Spent Processing Spam: 52.31 hours Time Spent Processing Ham: 88.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123355 90.95 96.31 88.22 2 DKIM_SIGNED 118151 85.51 92.24 82.08 3 XM_DK_Pass 116086 84.26 90.63 81.01 4 DKIM_VALID 113708 82.77 88.78 79.71 5 XM_B_Unicode 105868 77.38 82.66 74.69 6 DCC_CHECK 103423 60.14 80.75 49.66 7 RELAYCOUNTRY_US 101638 81.97 79.35 83.31 8 XMListUnsubscribeExists 99777 65.69 77.90 59.48 9 XM_B_SpammyWords 93157 57.15 72.73 49.22 10 DKIM_VALID_AU 89108 67.47 69.57 66.41 11 XM_DK_Undo_02 73910 26.45 57.70 10.54 12 TR_XM_DKIM_Undo 61051 20.36 47.66 6.46 13 BAYES_99 58960 20.84 46.03 8.01 14 XM_B_Unicode3 58581 46.94 45.74 47.55 15 XM_B_SpammyWords2 55575 28.62 43.39 21.11 16 LOC_TINY_FONT_1 53128 35.56 41.48 32.55 17 BAYES_999 48718 17.20 38.04 6.60 18 TR_DCC_Bayes_99 46941 15.36 36.65 4.53 19 HTML_FONT_LOW_CONTRAST 45826 35.18 35.78 34.87 20 RCVD_IN_MSPIKE_H2 42914 28.90 33.50 26.56 21 DKIM_VALID_EF 38655 30.22 30.18 30.23 22 MIME_HTML_ONLY 38650 26.04 30.18 23.94 23 BAYES_50 37173 46.58 29.02 55.52 24 FVGT_m_MULTI_ODD 34243 28.01 26.73 28.65 25 T_KAM_HTML_FONT_INVALID 32677 20.22 25.51 17.53 26 RCVD_IN_MSPIKE_WL 31145 31.47 24.32 35.10 27 XMSubLong 27161 21.30 21.21 21.35 28 RELAYCOUNTRY_META 25546 9.59 19.94 4.32 29 TR_XM_SpammyWords2 25419 7.40 19.85 1.07 30 XM_Body_Dirty_Words 24355 15.68 19.01 13.99 31 T_TM2_M_HEADER_IN_MSG 23671 20.09 18.48 20.91 32 DCC_CHECK_NEGATIVE 23036 38.65 17.99 49.16 33 XM_Multi_Part_URI 21589 15.29 16.86 14.49 34 XM_B_SpammyWords3 18919 8.06 14.77 4.64 35 LOTS_OF_MONEY 18261 9.89 14.26 7.66 36 RCVD_IN_MSPIKE_H3 17179 17.36 13.41 19.37 37 BOTNET 17176 5.83 13.41 1.97 38 TR_XM_SpammyWords4 16042 7.97 12.52 5.65 39 XM_Evil_Numbers_Gen 16009 10.63 12.50 9.68 40 HTML_IMAGE_RATIO_02 15352 10.82 11.99 10.23 41 BOTNET_IPINHOSTNAME 14608 8.11 11.41 6.44 42 XM_B_Unsub 14541 11.98 11.35 12.30 43 XMSexyCombo_05 14004 7.24 10.93 5.36 44 LotsOfNums_01 13567 9.12 10.59 8.38 45 RCVD_IN_BL_SPAMCOP_NET 13528 4.30 10.56 1.12 46 UNTRUSTED_Relay 13216 4.65 10.32 1.77 47 MPART_ALT_DIFF 13134 7.05 10.25 5.41 48 RCVD_IN_MSPIKE_H4 12798 12.00 9.99 13.02 49 XM_UncommonTLD01 12418 5.86 9.70 3.91 50 UNPARSEABLE_RELAY 12314 9.72 9.61 9.77 51 TR_XM_UnparsRelay 12022 8.63 9.39 8.25 52 RELAYCOUNTRY_CA 11739 4.22 9.17 1.70 53 BAYES_80 11230 6.91 8.77 5.97 54 RCVD_IN_RP_SAFE 11041 11.27 8.62 12.62 55 FSL_BULK_SIG 10065 7.26 7.86 6.96 56 XM_H_Long_From01 9846 6.41 7.69 5.76 57 MIME_HTML_MOSTLY 9817 4.54 7.66 2.94 58 XM_B_Phish_Phrases 8848 6.33 6.91 6.03 59 XM_SendGrid 8723 8.22 6.81 8.94 60 RCVD_IN_RP_CERTIFIED 8723 9.87 6.81 11.43 61 BAYES_60 8680 9.70 6.78 11.19 62 HTML_IMAGE_RATIO_04 8558 6.23 6.68 6.01 63 XMSubMetaSx_00 7409 4.51 5.78 3.86 64 XM_OfRef6 7360 2.56 5.75 0.94 65 BAYES_95 6961 4.34 5.43 3.78 66 TooManyTo_001 6887 6.05 5.38 6.39 67 URIBL_SBL_A 6511 2.61 5.08 1.34 68 SpammyFromTLD_01 6189 1.92 4.83 0.45 69 TR_XM_PhishingBody 5976 2.95 4.67 2.08 70 FROM_EXCESS_BASE64 5671 4.29 4.43 4.23 71 TR_LOTS_OF_MONEY3 5513 1.94 4.30 0.74 72 XM_DK_Undo_01 5386 2.25 4.21 1.25 73 TM2_M_URI_OPT_OUT 5105 3.47 3.99 3.21 74 XMNumbers 5090 3.74 3.97 3.62 75 TR_XM_DK_SendGrid 5077 5.42 3.96 6.16 76 MIME_HTML_ONLY_MULTI 4787 3.19 3.74 2.92 77 XMBdyGiftCard01 4678 1.81 3.65 0.87 78 TR_XM_SpammyWords5 4657 2.43 3.64 1.82 79 XMBody_17 4509 1.62 3.52 0.65 80 XMDiploma_00 4445 2.01 3.47 1.27 81 DKIM_INVALID 4443 2.74 3.47 2.37 82 T_TooManySym_01 4439 5.16 3.47 6.02 83 HTML_IMAGE_RATIO_06 4360 4.04 3.40 4.36 84 XM_B_SpammyTLD 4339 2.70 3.39 2.35 85 XM_UB99 3944 1.04 3.08 0.01 86 RELAYCOUNTRY_FR 3927 1.23 3.07 0.30 87 URI_HEX 3885 1.94 3.03 1.39 88 XM_UB50 3837 1.76 3.00 1.14 89 T_FILL_THIS_FORM_SHORT 3836 1.35 2.99 0.51 90 XMBrknScrpt_02 3830 1.40 2.99 0.59 91 TR_XM_MaxBayes 3712 1.00 2.90 0.03 92 XMStrtUSub 3623 4.91 2.83 5.96 93 SpammyFromTLD_02 3614 1.06 2.82 0.16 94 XM_RXBody 3472 1.04 2.71 0.20 95 XM_DIRTYINTL 3441 1.11 2.69 0.31 96 TR_XM_BayesRelay 3426 0.92 2.67 0.03 97 XMSubMetaI_00 3302 1.69 2.58 1.24 98 RCVD_IN_MSPIKE_BL 3223 0.93 2.52 0.12 99 TR_XM_MSPIKECOMBO 3205 0.92 2.50 0.12 100 XM_SPF_SoftFail 3188 1.91 2.49 1.61 101 T_REMOTE_IMAGE 3157 2.78 2.46 2.95 102 T_XMDrugObfuBody_14 3143 2.92 2.45 3.16 103 XM_UB999 3122 0.83 2.44 0.01 104 XM_CamelCaseFrm001 3098 2.16 2.42 2.04 105 HTML_IMAGE_RATIO_08 3047 2.67 2.38 2.82 106 MIME_QP_LONG_LINE 3027 3.52 2.36 4.11 107 XM_B_SpammyWords4 3025 1.12 2.36 0.49 108 RCVD_IN_RP_RNBL 2975 0.81 2.32 0.05 109 RCVD_IN_PSBL 2916 0.84 2.28 0.11 110 XMGenDplmaNmb 2894 1.12 2.26 0.54 111 FORGED_GMAIL_RCVD 2804 1.04 2.19 0.45 112 SUBJ_ALL_CAPS 2741 1.61 2.14 1.35 113 TM2_M_VERY_LONG_WORD 2650 1.66 2.07 1.46 114 KHOP_HELO_FCRDNS 2577 1.35 2.01 1.02 115 TR_XM_FormFill 2551 0.68 1.99 0.01 116 BOTNET_NORDNS 2461 0.67 1.92 0.03 117 XM_B_Unsub2 2355 1.45 1.84 1.25 118 RCVD_IN_MSPIKE_L5 2350 0.67 1.83 0.08 119 URI_PHP_REDIR 2288 0.60 1.79 0.00 120 T_XMHurry_00 2283 0.94 1.78 0.51 121 XMSexyCombo_01 2153 1.01 1.68 0.67 122 URIBL_DBL_SPAM 2122 0.57 1.66 0.01 123 T_TooManySym_02 2097 2.98 1.64 3.66 124 XM_B_Phish66 2065 1.15 1.61 0.92 125 TR_XM_SpammyWords3 2054 0.57 1.60 0.04 126 XM_Body_Obfu01 2046 0.66 1.60 0.18 127 RCVD_IN_IADB_LISTED 2044 3.21 1.60 4.03 128 XMPhish08 2032 0.67 1.59 0.20 129 GOOGLE_DOC_SUSP 2030 0.54 1.58 0.00 130 T_XMDrugObfuBody_08 2001 1.45 1.56 1.39 131 TR_XM_INV_DKIM 1989 0.58 1.55 0.09 132 HK_RANDOM_REPLYTO 1967 0.62 1.54 0.16 133 PDS_OTHER_BAD_TLD 1962 1.23 1.53 1.07 134 XM_URI_RBL 1919 0.62 1.50 0.17 135 TR_XM_PHPDW 1914 0.79 1.49 0.43 136 XMStockSpam_06 1884 1.83 1.47 2.01 137 XM_UB60 1861 0.59 1.45 0.15 138 RCVD_IN_IADB_SPF 1788 2.80 1.40 3.51 139 MAILING_LIST_MULTI 1784 1.73 1.39 1.90 140 BAYES_40 1783 2.51 1.39 3.08 141 TR_XM_RelayPhish 1775 0.51 1.39 0.06 142 XM_UB80 1774 0.49 1.39 0.04 143 XM_OfRef7 1769 0.55 1.38 0.13 144 TR_XM_PHPForged 1727 0.65 1.35 0.30 145 TR_XM_FormFill2 1720 0.65 1.34 0.30 146 NUMERIC_HTTP_ADDR 1717 0.64 1.34 0.29 147 XM_H_PHPOS 1716 0.65 1.34 0.29 148 RCVD_IN_IADB_DK 1704 2.47 1.33 3.05 149 RCVD_IN_IADB_SENDERID 1692 2.53 1.32 3.15 150 T_TooManySym_03 1656 1.14 1.29 1.06 151 THIS_AD 1647 0.99 1.29 0.84 152 URI_TRY_3LD 1643 2.07 1.28 2.47 153 T_XMDrugObfuBody_00 1638 0.77 1.28 0.51 154 HTML_MIME_NO_HTML_TAG 1561 1.43 1.22 1.54 155 URI_NOVOWEL 1525 1.78 1.19 2.08 156 XM_B_COVIDMETA 1524 1.12 1.19 1.08 157 BAYES_20 1483 1.92 1.16 2.30 158 TR_Sbj_FN_Bdy 1481 0.47 1.16 0.11 159 FILL_THIS_FORM 1446 0.52 1.13 0.21 160 XM_H_Long_From02 1411 1.18 1.10 1.23 161 T_Symld_Words_02 1402 0.57 1.09 0.31 162 URIBL_BLACK 1384 0.38 1.08 0.03 163 HTML_FONT_SIZE_HUGE 1379 0.52 1.08 0.24 164 HTTPS_HTTP_MISMATCH 1360 0.79 1.06 0.65 165 FROM_SUSPICIOUS_NTLD 1353 0.44 1.06 0.13 166 FROM_SUSPICIOUS_NTLD_FP 1320 0.42 1.03 0.11 167 T_TooManySym_04 1320 0.60 1.03 0.39 168 HTML_TAG_BALANCE_BODY 1303 0.77 1.02 0.64 169 XM_UB95 1291 0.35 1.01 0.02 170 RELAYCOUNTRY_DE 1290 0.51 1.01 0.26 171 XMSubGiftCard1 1283 0.70 1.00 0.54 172 RDNS_DYNAMIC 1265 0.81 0.99 0.71 173 XMPhish30 1260 0.68 0.98 0.53 174 TR_XM_COVIDMETA4 1247 0.46 0.97 0.19 175 XMBody_78 1183 0.55 0.92 0.37 176 FONT_INVIS_LONG_LINE 1181 0.45 0.92 0.21 177 TR_Symld_Words 1173 1.02 0.92 1.08 178 MONEY_FORM 1168 0.31 0.91 0.00 179 RCVD_IN_MSPIKE_H5 1168 2.11 0.91 2.71 180 FILL_THIS_FORM_LONG 1166 0.35 0.91 0.07 181 RELAYCOUNTRY_GB 1160 0.80 0.91 0.75 182 TR_XM_SB_Phish 1157 1.21 0.90 1.37 183 XM_ProductURIs 1146 1.31 0.89 1.53 184 PLING_QUERY 1133 0.69 0.88 0.60 185 DIET_1 1129 0.59 0.88 0.44 186 XMSubPhish11 1122 1.19 0.88 1.35 187 HTML_SHORT_LINK_IMG_1 1108 0.30 0.87 0.01 188 XM_H_Undi_Recip 1086 0.40 0.85 0.17 189 XM_BadFromFormat 1065 0.46 0.83 0.27 190 HTML_FONT_SIZE_LARGE 1063 0.40 0.83 0.18 191 LOW_PRICE 1053 0.42 0.82 0.21 192 XMSubNoVowel 1046 0.80 0.82 0.79 193 INVESTMENT_ADVICE 1010 0.32 0.79 0.08 194 ALL_TRUSTED 1010 8.86 0.79 12.96 195 XMHTMLBadTable_001 996 0.82 0.78 0.84 196 XMOemUri 981 0.40 0.77 0.22 197 XM_Body_Dirty_Words_01 964 0.94 0.75 1.03 198 MIME_CHARSET_FARAWAY 957 0.31 0.75 0.08 199 XMSexyCombo_04 952 0.38 0.74 0.19 200 XMHTML_After_End 949 0.65 0.74 0.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 222089 90.95 96.31 88.22 2 RELAYCOUNTRY_US 209711 81.97 79.35 83.31 3 DKIM_SIGNED 206630 85.51 92.24 82.08 4 XM_DK_Pass 203943 84.26 90.63 81.01 5 DKIM_VALID 200652 82.77 88.78 79.71 6 XM_B_Unicode 188026 77.38 82.66 74.69 7 DKIM_VALID_AU 167172 67.47 69.57 66.41 8 XMListUnsubscribeExists 149743 65.69 77.90 59.48 9 BAYES_50 139759 46.58 29.02 55.52 10 DCC_CHECK 125005 60.14 80.75 49.66 11 XM_B_SpammyWords 123902 57.15 72.73 49.22 12 DCC_CHECK_NEGATIVE 123746 38.65 17.99 49.16 13 XM_B_Unicode3 119698 46.94 45.74 47.55 14 RCVD_IN_MSPIKE_WL 88371 31.47 24.32 35.10 15 HTML_FONT_LOW_CONTRAST 87782 35.18 35.78 34.87 16 LOC_TINY_FONT_1 81941 35.56 41.48 32.55 17 DKIM_VALID_EF 76108 30.22 30.18 30.23 18 FVGT_m_MULTI_ODD 72129 28.01 26.73 28.65 19 RCVD_IN_MSPIKE_H2 66850 28.90 33.50 26.56 20 MIME_HTML_ONLY 60273 26.04 30.18 23.94 21 XMSubLong 53758 21.30 21.21 21.35 22 XM_B_SpammyWords2 53146 28.62 43.39 21.11 23 T_TM2_M_HEADER_IN_MSG 52636 20.09 18.48 20.91 24 RCVD_IN_MSPIKE_H3 48765 17.36 13.41 19.37 25 T_KAM_HTML_FONT_INVALID 44121 20.22 25.51 17.53 26 XM_DKIMWhitelistDomains 37580 9.92 0.06 14.93 27 XM_Multi_Part_URI 36486 15.29 16.86 14.49 28 XM_Body_Dirty_Words 35217 15.68 19.01 13.99 29 RCVD_IN_MSPIKE_H4 32774 12.00 9.99 13.02 30 ALL_TRUSTED 32636 8.86 0.79 12.96 31 RCVD_IN_RP_SAFE 31775 11.27 8.62 12.62 32 XM_B_Unsub 30966 11.98 11.35 12.30 33 RCVD_IN_RP_CERTIFIED 28784 9.87 6.81 11.43 34 BAYES_60 28157 9.70 6.78 11.19 35 XM_DK_Undo_02 26543 26.45 57.70 10.54 36 HTML_IMAGE_RATIO_02 25750 10.82 11.99 10.23 37 UNPARSEABLE_RELAY 24590 9.72 9.61 9.77 38 XM_Evil_Numbers_Gen 24359 10.63 12.50 9.68 39 XM_SendGrid 22494 8.22 6.81 8.94 40 BAYES_00 22026 6.04 0.70 8.75 41 LotsOfNums_01 21091 9.12 10.59 8.38 42 TR_XM_UnparsRelay 20758 8.63 9.39 8.25 43 BAYES_99 20176 20.84 46.03 8.01 44 LOTS_OF_MONEY 19290 9.89 14.26 7.66 45 TR_XM_DK_Bayes 19214 5.27 0.63 7.63 46 TR_XM_DK_Bayes1 18933 5.19 0.62 7.52 47 FSL_BULK_SIG 17517 7.26 7.86 6.96 48 TR_XM_DK_Bayes2 17260 4.74 0.59 6.86 49 BAYES_999 16610 17.20 38.04 6.60 50 TR_XM_DKIM_Undo 16271 20.36 47.66 6.46 51 BOTNET_IPINHOSTNAME 16213 8.11 11.41 6.44 52 TooManyTo_001 16088 6.05 5.38 6.39 53 TR_XM_DK_SendGrid 15516 5.42 3.96 6.16 54 XM_B_Phish_Phrases 15179 6.33 6.91 6.03 55 T_TooManySym_01 15166 5.16 3.47 6.02 56 HTML_IMAGE_RATIO_04 15123 6.23 6.68 6.01 57 BAYES_80 15034 6.91 8.77 5.97 58 XMStrtUSub 15013 4.91 2.83 5.96 59 XM_H_Long_From01 14493 6.41 7.69 5.76 60 TR_XM_SpammyWords4 14229 7.97 12.52 5.65 61 MPART_ALT_DIFF 13626 7.05 10.25 5.41 62 XMSexyCombo_05 13488 7.24 10.93 5.36 63 IN_ZIMBRA_NJ_WHITELIST 12007 3.17 0.03 4.77 64 XM_B_SpammyWords3 11690 8.06 14.77 4.64 65 TR_DCC_Bayes_99 11395 15.36 36.65 4.53 66 HTML_IMAGE_RATIO_06 10987 4.04 3.40 4.36 67 RELAYCOUNTRY_META 10864 9.59 19.94 4.32 68 FROM_EXCESS_BASE64 10637 4.29 4.43 4.23 69 MIME_QP_LONG_LINE 10353 3.52 2.36 4.11 70 RCVD_IN_IADB_LISTED 10155 3.21 1.60 4.03 71 XM_UncommonTLD01 9853 5.86 9.70 3.91 72 XMSubMetaSx_00 9708 4.51 5.78 3.86 73 BAYES_95 9507 4.34 5.43 3.78 74 T_TooManySym_02 9203 2.98 1.64 3.66 75 XMNumbers 9115 3.74 3.97 3.62 76 RCVD_IN_IADB_SPF 8842 2.80 1.40 3.51 77 INVALID_MSGID 8303 2.35 0.50 3.30 78 TM2_M_URI_OPT_OUT 8085 3.47 3.99 3.21 79 T_XMDrugObfuBody_14 7959 2.92 2.45 3.16 80 RCVD_IN_IADB_SENDERID 7923 2.53 1.32 3.15 81 BAYES_40 7762 2.51 1.39 3.08 82 MSGID_NOFQDN1 7677 2.05 0.09 3.05 83 RCVD_IN_IADB_DK 7677 2.47 1.33 3.05 84 TVD_RCVD_IP 7447 2.03 0.21 2.96 85 T_REMOTE_IMAGE 7421 2.78 2.46 2.95 86 MIME_HTML_MOSTLY 7409 4.54 7.66 2.94 87 MIME_HTML_ONLY_MULTI 7343 3.19 3.74 2.92 88 HTML_IMAGE_RATIO_08 7108 2.67 2.38 2.82 89 RCVD_IN_MSPIKE_H5 6832 2.11 0.91 2.71 90 RCVD_IN_IADB_VOUCHED 6331 1.88 0.63 2.51 91 TO_MALFORMED 6223 1.65 0.02 2.47 92 URI_TRY_3LD 6222 2.07 1.28 2.47 93 DKIM_INVALID 5978 2.74 3.47 2.37 94 XM_B_SpammyTLD 5926 2.70 3.39 2.35 95 BAYES_20 5794 1.92 1.16 2.30 96 HELO_MISC_IP 5455 1.47 0.09 2.17 97 ANY_BOUNCE_MESSAGE 5395 1.56 0.41 2.14 98 BOUNCE_MESSAGE 5393 1.56 0.41 2.14 99 TR_XM_PhishingBody 5236 2.95 4.67 2.08 100 URI_NOVOWEL 5225 1.78 1.19 2.08 101 XM_CamelCaseFrm001 5125 2.16 2.42 2.04 102 XMStockSpam_06 5056 1.83 1.47 2.01 103 BOTNET 4969 5.83 13.41 1.97 104 XMBSHREFv2 4860 1.36 0.25 1.93 105 IN_HORDE_ADDRESS_BOOK 4848 1.30 0.06 1.93 106 MAILING_LIST_MULTI 4792 1.73 1.39 1.90 107 XM_PDF 4669 1.31 0.24 1.85 108 XM_H_Trusted_IP 4595 1.21 0.00 1.83 109 TR_XM_SpammyWords5 4577 2.43 3.64 1.82 110 UNTRUSTED_Relay 4448 4.65 10.32 1.77 111 RELAYCOUNTRY_CA 4273 4.22 9.17 1.70 112 USER_IN_DEF_DKIM_WL 4155 1.09 0.00 1.65 113 RCVD_IN_IADB_OPTIN 4076 1.23 0.45 1.62 114 XM_SPF_SoftFail 4048 1.91 2.49 1.61 115 HTML_MIME_NO_HTML_TAG 3874 1.43 1.22 1.54 116 XM_ProductURIs 3845 1.31 0.89 1.53 117 TM2_M_VERY_LONG_WORD 3663 1.66 2.07 1.46 118 BAYES_05 3518 1.16 0.71 1.40 119 T_XMDrugObfuBody_08 3498 1.45 1.56 1.39 120 URI_HEX 3487 1.94 3.03 1.39 121 TR_XM_SB_Phish 3439 1.21 0.90 1.37 122 XMBody_95 3430 0.96 0.16 1.36 123 XMSubPhish11 3406 1.19 0.88 1.35 124 SUBJ_ALL_CAPS 3387 1.61 2.14 1.35 125 URIBL_SBL_A 3384 2.61 5.08 1.34 126 TR_MSPIKEBAYES00 3235 0.86 0.02 1.29 127 XMDiploma_00 3202 2.01 3.47 1.27 128 XM_DK_Undo_01 3147 2.25 4.21 1.25 129 XM_B_Unsub2 3144 1.45 1.84 1.25 130 XMSubMetaI_00 3118 1.69 2.58 1.24 131 XMGappySubj_01 3089 0.84 0.08 1.23 132 XM_H_Long_From02 3085 1.18 1.10 1.23 133 XM_UB50 2862 1.76 3.00 1.14 134 RCVD_IN_BL_SPAMCOP_NET 2821 4.30 10.56 1.12 135 XM_GoogleGroups 2734 0.86 0.41 1.09 136 XM_B_COVIDMETA 2731 1.12 1.19 1.08 137 TR_Symld_Words 2718 1.02 0.92 1.08 138 PDS_OTHER_BAD_TLD 2701 1.23 1.53 1.07 139 TR_XM_SpammyWords2 2690 7.40 19.85 1.07 140 T_TooManySym_03 2665 1.14 1.29 1.06 141 TooManyTo_002 2597 0.82 0.41 1.03 142 XM_Body_Dirty_Words_01 2589 0.94 0.75 1.03 143 KHOP_HELO_FCRDNS 2566 1.35 2.01 1.02 144 TVD_SPACE_RATIO 2538 0.68 0.05 1.01 145 HTML_FONT_FACE_BAD 2503 0.87 0.62 0.99 146 XM_OfRef6 2369 2.56 5.75 0.94 147 XM_B_Phish66 2308 1.15 1.61 0.92 148 XMGetyour 2215 0.61 0.08 0.88 149 XMBdyGiftCard01 2182 1.81 3.65 0.87 150 XMHTMLBadTable_001 2119 0.82 0.78 0.84 151 THIS_AD 2111 0.99 1.29 0.84 152 T_MANY_PILL_PRICE 2070 0.56 0.03 0.82 153 DKIM_ADSP_CUSTOM_MED 2025 0.73 0.58 0.80 154 XMSubNoVowel 1997 0.80 0.82 0.79 155 USER_IN_WELCOMELIST 1929 0.51 0.00 0.77 156 USER_IN_WHITELIST 1929 0.51 0.00 0.77 157 RELAYCOUNTRY_GB 1889 0.80 0.91 0.75 158 XMLngstWrd_00 1884 0.61 0.34 0.75 159 TR_LOTS_OF_MONEY3 1867 1.94 4.30 0.74 160 RDNS_DYNAMIC 1793 0.81 0.99 0.71 161 TooManyTo_003 1780 0.58 0.34 0.71 162 XMSubMetaSxObfu_02 1750 0.57 0.33 0.70 163 XM_B_REG_HTML 1710 0.56 0.31 0.68 164 XMSexyCombo_01 1692 1.01 1.68 0.67 165 XMLngstWrd_01 1666 0.54 0.29 0.66 166 XMBody_17 1630 1.62 3.52 0.65 167 HTTPS_HTTP_MISMATCH 1625 0.79 1.06 0.65 168 HTML_TAG_BALANCE_BODY 1609 0.77 1.02 0.64 169 XMHTML_After_End 1538 0.65 0.74 0.61 170 HTML_IMAGE_ONLY_20 1534 0.43 0.07 0.61 171 XM_B_COPY_HTML 1521 0.65 0.73 0.60 172 PLING_QUERY 1498 0.69 0.88 0.60 173 XMBrknScrpt_02 1491 1.40 2.99 0.59 174 XM_Walgreens_Forge 1441 0.38 0.00 0.57 175 XMSubMetaSSx_00 1424 0.57 0.56 0.57 176 TR_MetaPhish_Combo_01 1423 0.55 0.53 0.57 177 TooManyTo_004 1423 0.48 0.32 0.57 178 XMLngstWrd_02 1418 0.45 0.22 0.56 179 XMSubGiftCard1 1362 0.70 1.00 0.54 180 XMGenDplmaNmb 1356 1.12 2.26 0.54 181 NML_ADSP_CUSTOM_MED 1347 0.52 0.48 0.54 182 XMPhish30 1324 0.68 0.98 0.53 183 XM_H_PHPMailer 1306 0.59 0.72 0.52 184 T_XMHurry_00 1294 0.94 1.78 0.51 185 T_FILL_THIS_FORM_SHORT 1278 1.35 2.99 0.51 186 T_XMDrugObfuBody_00 1275 0.77 1.28 0.51 187 HELO_NODOT 1227 0.47 0.42 0.49 188 HELO_NO_DOMAIN 1227 0.46 0.42 0.49 189 XM_B_SpammyWords4 1221 1.12 2.36 0.49 190 TooManyTo_005 1202 0.41 0.28 0.48 191 SHOPIFY_IMG_NOT_RCVD_SFY 1141 0.50 0.59 0.45 192 FORGED_GMAIL_RCVD 1138 1.04 2.19 0.45 193 SpammyFromTLD_01 1121 1.92 4.83 0.45 194 DIET_1 1116 0.59 0.88 0.44 195 XMLngstWrd_03 1083 0.34 0.18 0.43 196 TR_XM_PHPDW 1078 0.79 1.49 0.43 197 XMSubMetaSxObfu_03 1029 0.43 0.48 0.41 198 T_TooManySym_04 977 0.60 1.03 0.39 199 DKIM_ADSP_NXDOMAIN 963 0.40 0.43 0.38 200 XMPhish14 942 0.39 0.43 0.37 ----------------------------------------------------------------------