Email: 563041 Autolearn: 0 AvgScore: 0.94 AvgScanTime: 1.07 sec Spam: 133418 Autolearn: 0 AvgScore: 13.79 AvgScanTime: 1.41 sec Ham: 429623 Autolearn: 0 AvgScore: -3.05 AvgScanTime: 0.96 sec Time Spent Running SA: 167.33 hours Time Spent Processing Spam: 52.29 hours Time Spent Processing Ham: 115.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127432 88.88 95.51 86.81 2 DKIM_SIGNED 111890 66.21 83.86 60.72 3 XM_DK_Pass 108168 64.71 81.07 59.63 4 DKIM_VALID 105789 62.88 79.29 57.78 5 XM_B_Unicode 101320 71.63 75.94 70.28 6 RELAYCOUNTRY_US 100271 78.68 75.16 79.78 7 DCC_CHECK 99372 42.24 74.48 32.22 8 XM_B_SpammyWords 90845 48.45 68.09 42.34 9 XMListUnsubscribeExists 89415 43.77 67.02 36.55 10 DKIM_VALID_AU 76347 46.77 57.22 43.53 11 XM_DK_Undo_02 59758 14.80 44.79 5.48 12 XM_B_Unicode3 56576 41.97 42.41 41.83 13 XM_B_SpammyWords2 55440 21.10 41.55 14.75 14 BAYES_50 51580 49.57 38.66 52.96 15 LOC_TINY_FONT_1 46580 22.29 34.91 18.37 16 TR_XM_DKIM_Undo 45824 11.09 34.35 3.86 17 BAYES_99 45026 11.40 33.75 4.46 18 HTML_FONT_LOW_CONTRAST 42327 24.73 31.73 22.56 19 MIME_HTML_ONLY 41765 24.48 31.30 22.36 20 FVGT_m_MULTI_ODD 39390 21.79 29.52 19.39 21 DKIM_VALID_EF 38951 26.33 29.19 25.44 22 XMSubLong 35628 22.02 26.70 20.57 23 BAYES_999 35127 9.00 26.33 3.61 24 RCVD_IN_MSPIKE_H2 34523 21.27 25.88 19.83 25 T_KAM_HTML_FONT_INVALID 34514 16.80 25.87 13.99 26 TR_DCC_Bayes_99 34480 7.42 25.84 1.70 27 T_TM2_M_HEADER_IN_MSG 31881 26.18 23.90 26.89 28 DCC_CHECK_NEGATIVE 30335 55.33 22.74 65.46 29 RCVD_IN_MSPIKE_WL 29903 25.68 22.41 26.70 30 RELAYCOUNTRY_META 28017 8.63 21.00 4.79 31 XM_Body_Dirty_Words 25404 11.27 19.04 8.85 32 UNTRUSTED_Relay 23337 5.85 17.49 2.24 33 XM_Multi_Part_URI 21156 10.26 15.86 8.52 34 XM_UncommonTLD01 20430 6.39 15.31 3.62 35 BOTNET_IPINHOSTNAME 20110 6.19 15.07 3.43 36 XM_B_Unsub 19444 9.46 14.57 7.87 37 BOTNET 19443 4.35 14.57 1.17 38 FSL_BULK_SIG 18274 8.48 13.70 6.86 39 LOTS_OF_MONEY 18013 7.50 13.50 5.64 40 XM_B_SpammyWords3 17281 5.26 12.95 2.87 41 TR_XM_SpammyWords2 16819 3.37 12.61 0.50 42 RCVD_IN_MSPIKE_H3 16013 13.13 12.00 13.48 43 XM_Evil_Numbers_Gen 15642 9.01 11.72 8.16 44 TR_XM_SpammyWords4 14404 5.14 10.80 3.38 45 XM_B_Phish_Phrases 13770 6.18 10.32 4.89 46 XMSexyCombo_05 13600 4.65 10.19 2.92 47 LotsOfNums_01 13409 8.02 10.05 7.39 48 BAYES_80 12649 5.21 9.48 3.88 49 RCVD_IN_MSPIKE_H4 12608 9.61 9.45 9.66 50 MPART_ALT_DIFF 12199 10.12 9.14 10.43 51 UNPARSEABLE_RELAY 11716 6.41 8.78 5.68 52 TR_XM_UnparsRelay 11547 5.62 8.65 4.68 53 RCVD_IN_BL_SPAMCOP_NET 11172 2.40 8.37 0.54 54 MIME_HTML_MOSTLY 10805 3.92 8.10 2.62 55 BAYES_60 10776 7.74 8.08 7.63 56 XMNumbers 9460 3.85 7.09 2.85 57 XM_SendGrid 9440 5.55 7.08 5.07 58 HTML_IMAGE_RATIO_02 9137 5.03 6.85 4.47 59 TR_XM_PhishingBody 8680 3.82 6.51 2.99 60 XM_H_Long_From01 8495 5.06 6.37 4.65 61 XMSubMetaSx_00 8088 3.28 6.06 2.42 62 SpammyFromTLD_01 7988 2.08 5.99 0.86 63 TR_XM_SpammyWords5 7886 2.30 5.91 1.18 64 TooManyTo_001 7864 7.60 5.89 8.13 65 SpammyFromTLD_02 7696 1.63 5.77 0.35 66 KHOP_HELO_FCRDNS 7497 2.71 5.62 1.81 67 T_REMOTE_IMAGE 7389 3.89 5.54 3.38 68 TM2_M_URI_OPT_OUT 7342 3.62 5.50 3.03 69 RCVD_IN_MSPIKE_BL 7310 1.43 5.48 0.18 70 TR_XM_MSPIKECOMBO 7216 1.41 5.41 0.16 71 RELAYCOUNTRY_CA 7123 2.05 5.34 1.03 72 HTML_IMAGE_RATIO_04 7022 13.54 5.26 16.11 73 BAYES_95 6640 3.13 4.98 2.56 74 XM_UB50 6539 2.43 4.90 1.66 75 XMStrtUSub 6464 10.33 4.84 12.03 76 XM_B_SpammyTLD 6392 2.30 4.79 1.52 77 RCVD_IN_RP_RNBL 6283 1.14 4.71 0.03 78 DKIM_INVALID 6101 3.32 4.57 2.94 79 XM_SPF_SoftFail 6025 2.54 4.52 1.93 80 TR_XM_DK_SendGrid 5558 3.33 4.17 3.08 81 RCVD_IN_RP_SAFE 5484 5.02 4.11 5.30 82 RELAYCOUNTRY_FR 5409 1.22 4.05 0.35 83 HTML_FONT_SIZE_LARGE 5395 1.02 4.04 0.08 84 XM_B_Unsub2 5154 1.75 3.86 1.10 85 HTML_IMAGE_ONLY_12 5069 1.06 3.80 0.20 86 XM_B_Phish66 5019 2.17 3.76 1.68 87 XM_B_COVIDMETA 4951 1.48 3.71 0.79 88 XM_UB80 4948 0.90 3.71 0.03 89 XM_UB99 4900 0.88 3.67 0.01 90 RCVD_IN_MSPIKE_L5 4757 0.90 3.57 0.07 91 HTML_IMAGE_RATIO_06 4674 4.38 3.50 4.65 92 MIME_QP_LONG_LINE 4647 4.48 3.48 4.79 93 TR_XM_SpammyWords3 4549 0.86 3.41 0.07 94 XM_OfRef6 4393 1.33 3.29 0.72 95 URIBL_DBL_SPAM 4230 0.76 3.17 0.01 96 RCVD_IN_PSBL 4073 0.77 3.05 0.06 97 XM_UB60 3998 0.85 3.00 0.18 98 MIME_HTML_ONLY_MULTI 3974 7.01 2.98 8.26 99 BODY_URI_ONLY 3939 0.70 2.95 0.00 100 XMDiploma_00 3911 1.53 2.93 1.10 101 XM_DIRTYINTL 3792 0.91 2.84 0.31 102 RCVD_IN_RP_CERTIFIED 3780 4.32 2.83 4.78 103 T_XMDrugObfuBody_08 3753 1.75 2.81 1.42 104 T_TooManySym_01 3733 4.56 2.80 5.11 105 T_XMDrugObfuBody_14 3599 2.44 2.70 2.36 106 XM_UB999 3413 0.61 2.56 0.01 107 PDS_OTHER_BAD_TLD 3369 0.68 2.53 0.11 108 HTML_IMAGE_RATIO_08 3351 1.87 2.51 1.67 109 URI_HEX 3202 1.41 2.40 1.11 110 TM2_M_VERY_LONG_WORD 3192 1.33 2.39 1.00 111 HTML_MIME_NO_HTML_TAG 3126 2.56 2.34 2.63 112 XM_B_SpammyWords4 3118 0.78 2.34 0.30 113 RCVD_IN_IADB_LISTED 3094 3.86 2.32 4.33 114 TR_XM_SB_Phish 3054 2.05 2.29 1.97 115 XM_CamelCaseFrm001 3023 1.56 2.27 1.34 116 XMSubPhish11 3021 2.03 2.26 1.96 117 TR_XM_COVIDMETA4 2960 0.74 2.22 0.28 118 HTML_SHORT_LINK_IMG_2 2933 0.55 2.20 0.03 119 XM_DK_Undo_01 2917 1.55 2.19 1.36 120 MAILING_LIST_MULTI 2908 2.40 2.18 2.47 121 BOTNET_NORDNS 2901 0.53 2.17 0.02 122 TR_Symld_Words 2861 1.74 2.14 1.61 123 SUBJ_ALL_CAPS 2799 1.48 2.10 1.28 124 XMGenDplmaNmb 2773 0.99 2.08 0.65 125 RCVD_IN_IADB_SPF 2772 3.40 2.08 3.81 126 ANY_BOUNCE_MESSAGE 2709 3.58 2.03 4.07 127 XM_URI_RBL 2703 0.57 2.03 0.12 128 BOUNCE_MESSAGE 2694 3.58 2.02 4.06 129 BAYES_40 2668 4.45 2.00 5.21 130 FROM_EXCESS_BASE64 2661 1.85 1.99 1.81 131 RCVD_IN_IADB_DK 2639 3.01 1.98 3.33 132 TR_XM_BayesRelay 2603 0.47 1.95 0.01 133 RCVD_IN_IADB_SENDERID 2602 3.08 1.95 3.44 134 XMBrknScrpt_02 2598 0.82 1.95 0.47 135 XMMoneyMeta_00 2557 0.86 1.92 0.54 136 T_FILL_THIS_FORM_SHORT 2505 1.06 1.88 0.81 137 XMBdyGiftCard01 2467 0.76 1.85 0.42 138 URI_PHP_REDIR 2402 0.43 1.80 0.00 139 XM_UB95 2333 0.42 1.75 0.01 140 TR_XM_PHPDW 2298 0.62 1.72 0.27 141 T_XMHurry_00 2268 0.65 1.70 0.32 142 URIBL_BLACK 2247 0.42 1.68 0.03 143 URIBL_SBL_A 2225 0.50 1.67 0.14 144 URI_OPTOUT_3LD 2206 0.44 1.65 0.07 145 TO_IN_SUBJ 2206 0.40 1.65 0.02 146 URI_NOVOWEL 2147 2.00 1.61 2.11 147 TR_XM_INV_DKIM 2115 0.42 1.59 0.06 148 URI_TRY_3LD 2074 1.00 1.55 0.83 149 TR_XM_PHPForged 2072 0.55 1.55 0.24 150 TR_XM_FormFill2 2030 0.55 1.52 0.24 151 HTML_SHORT_LINK_IMG_1 2030 0.37 1.52 0.01 152 XM_H_PHPOS 2017 0.54 1.51 0.23 153 HK_RANDOM_REPLYTO 2000 0.50 1.50 0.19 154 BAYES_20 1985 4.33 1.49 5.21 155 XM_S_SpammyWords 1966 0.59 1.47 0.32 156 XMLngstWrd_00 1966 0.77 1.47 0.55 157 TR_XM_Spammywords 1966 0.59 1.47 0.32 158 ALL_TRUSTED 1947 13.14 1.46 16.77 159 XMBody_17 1913 0.59 1.43 0.33 160 DKIM_ADSP_CUSTOM_MED 1901 1.00 1.42 0.87 161 XMSexyCombo_01 1890 0.55 1.42 0.27 162 XM_Body_Dirty_Words_01 1873 0.40 1.40 0.09 163 T_XMDrugObfuBody_00 1852 0.65 1.39 0.42 164 RELAYCOUNTRY_DE 1846 0.80 1.38 0.62 165 XMStockSpam_06 1828 1.07 1.37 0.98 166 TR_LOTS_OF_MONEY3 1766 0.39 1.32 0.10 167 TR_Mismatch_TLD_01 1742 0.51 1.31 0.26 168 T_Symld_Words_02 1717 0.54 1.29 0.31 169 XMHTML_After_End 1709 1.12 1.28 1.07 170 FORGED_GMAIL_RCVD 1708 0.65 1.28 0.45 171 MONEY_NOHTML 1688 0.38 1.27 0.11 172 TR_MetaPhish_Combo_01 1639 0.80 1.23 0.67 173 LOADSA_MONEY_COMBO 1606 0.33 1.20 0.06 174 TR_XM_COVIDMETA1 1561 0.50 1.17 0.29 175 RELAYCOUNTRY_GB 1547 0.95 1.16 0.89 176 XM_TLDProd2 1540 0.40 1.15 0.16 177 XM_PDF 1525 3.75 1.14 4.57 178 RCVD_IN_MSPIKE_L4 1516 0.29 1.14 0.02 179 XMPhish30 1511 0.66 1.13 0.52 180 XMLngstWrd_01 1488 0.64 1.12 0.50 181 XM_B_SEO 1424 0.35 1.07 0.13 182 XMSlimDrugH 1423 0.46 1.07 0.28 183 XMBody_78 1393 0.51 1.04 0.34 184 XFER_LOTSA_MONEY 1379 0.28 1.03 0.04 185 TR_XM_FormFill 1367 0.26 1.02 0.02 186 HTTPS_HTTP_MISMATCH 1361 0.74 1.02 0.65 187 TR_XM_RelayPhish 1353 0.30 1.01 0.08 188 TR_XM_SEO4 1353 0.30 1.01 0.07 189 RCVD_IN_MSPIKE_H5 1282 2.94 0.96 3.56 190 MILLION_USD 1280 0.23 0.96 0.00 191 XM_Body_Obfu01 1269 0.45 0.95 0.30 192 TR_BOTNET_NEGATE 1266 0.43 0.95 0.27 193 DIET_1 1259 0.46 0.94 0.31 194 RCVD_IN_IADB_VOUCHED 1235 2.27 0.93 2.69 195 XM_OfRef7 1223 0.28 0.92 0.08 196 TooManyTo_002 1215 2.02 0.91 2.37 197 XM_H_PHPMailer 1208 0.63 0.91 0.55 198 TR_Mismatch_TLD_02 1200 0.26 0.90 0.06 199 RELAYCOUNTRY_IN 1179 0.30 0.88 0.11 200 RELAYCOUNTRY_CN 1145 0.26 0.86 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 372972 88.88 95.51 86.81 2 RELAYCOUNTRY_US 342742 78.68 75.16 79.78 3 XM_B_Unicode 301959 71.63 75.94 70.28 4 DCC_CHECK_NEGATIVE 281212 55.33 22.74 65.46 5 DKIM_SIGNED 260873 66.21 83.86 60.72 6 XM_DK_Pass 256164 64.71 81.07 59.63 7 DKIM_VALID 248257 62.88 79.29 57.78 8 BAYES_50 227539 49.57 38.66 52.96 9 DKIM_VALID_AU 187006 46.77 57.22 43.53 10 XM_B_SpammyWords 181923 48.45 68.09 42.34 11 XM_B_Unicode3 179721 41.97 42.41 41.83 12 XMListUnsubscribeExists 157006 43.77 67.02 36.55 13 DCC_CHECK 138440 42.24 74.48 32.22 14 T_TM2_M_HEADER_IN_MSG 115535 26.18 23.90 26.89 15 RCVD_IN_MSPIKE_WL 114706 25.68 22.41 26.70 16 DKIM_VALID_EF 109302 26.33 29.19 25.44 17 HTML_FONT_LOW_CONTRAST 96922 24.73 31.73 22.56 18 MIME_HTML_ONLY 96072 24.48 31.30 22.36 19 XMSubLong 88356 22.02 26.70 20.57 20 RCVD_IN_MSPIKE_H2 85210 21.27 25.88 19.83 21 FVGT_m_MULTI_ODD 83284 21.79 29.52 19.39 22 LOC_TINY_FONT_1 78906 22.29 34.91 18.37 23 ALL_TRUSTED 72029 13.14 1.46 16.77 24 HTML_IMAGE_RATIO_04 69220 13.54 5.26 16.11 25 XM_H_Trusted_IP 67709 12.03 0.00 15.76 26 XM_B_SpammyWords2 63354 21.10 41.55 14.75 27 BAYES_00 63212 11.41 0.77 14.71 28 HTML_FONT_FACE_BAD 63083 11.40 0.81 14.68 29 T_KAM_HTML_FONT_INVALID 60094 16.80 25.87 13.99 30 RCVD_IN_MSPIKE_H3 57921 13.13 12.00 13.48 31 XMStrtUSub 51704 10.33 4.84 12.03 32 MPART_ALT_DIFF 44805 10.12 9.14 10.43 33 RCVD_IN_MSPIKE_H4 41505 9.61 9.45 9.66 34 XM_Body_Dirty_Words 38039 11.27 19.04 8.85 35 XM_Multi_Part_URI 36585 10.26 15.86 8.52 36 MIME_HTML_ONLY_MULTI 35495 7.01 2.98 8.26 37 XM_Evil_Numbers_Gen 35065 9.01 11.72 8.16 38 TooManyTo_001 34936 7.60 5.89 8.13 39 XM_B_Unsub 33792 9.46 14.57 7.87 40 XM_DKIMWhitelistDomains 33298 5.92 0.02 7.75 41 BAYES_60 32783 7.74 8.08 7.63 42 LotsOfNums_01 31740 8.02 10.05 7.39 43 FSL_BULK_SIG 29455 8.48 13.70 6.86 44 UNPARSEABLE_RELAY 24398 6.41 8.78 5.68 45 LOTS_OF_MONEY 24231 7.50 13.50 5.64 46 XM_DK_Undo_02 23563 14.80 44.79 5.48 47 TR_XM_DK_Bayes 23136 4.24 0.55 5.39 48 RCVD_IN_RP_SAFE 22775 5.02 4.11 5.30 49 BAYES_40 22401 4.45 2.00 5.21 50 BAYES_20 22368 4.33 1.49 5.21 51 TR_XM_DK_Bayes1 22319 4.09 0.54 5.20 52 T_TooManySym_01 21939 4.56 2.80 5.11 53 XM_SendGrid 21802 5.55 7.08 5.07 54 XMSubNoVowel 21343 3.98 0.78 4.97 55 XM_B_Phish_Phrases 21010 6.18 10.32 4.89 56 MIME_QP_LONG_LINE 20596 4.48 3.48 4.79 57 RELAYCOUNTRY_META 20565 8.63 21.00 4.79 58 RCVD_IN_RP_CERTIFIED 20520 4.32 2.83 4.78 59 TR_XM_UnparsRelay 20091 5.62 8.65 4.68 60 XM_H_Long_From01 19972 5.06 6.37 4.65 61 HTML_IMAGE_RATIO_06 19966 4.38 3.50 4.65 62 IN_ZIMBRA_NJ_WHITELIST 19623 3.49 0.04 4.57 63 XM_PDF 19616 3.75 1.14 4.57 64 HTML_IMAGE_RATIO_02 19212 5.03 6.85 4.47 65 BAYES_99 19159 11.40 33.75 4.46 66 TR_XM_DK_Bayes2 18821 3.46 0.51 4.38 67 RCVD_IN_IADB_LISTED 18616 3.86 2.32 4.33 68 ANY_BOUNCE_MESSAGE 17469 3.58 2.03 4.07 69 BOUNCE_MESSAGE 17442 3.58 2.02 4.06 70 BAYES_80 16668 5.21 9.48 3.88 71 TR_XM_DKIM_Undo 16602 11.09 34.35 3.86 72 RCVD_IN_IADB_SPF 16370 3.40 2.08 3.81 73 XM_UncommonTLD01 15539 6.39 15.31 3.62 74 BAYES_999 15520 9.00 26.33 3.61 75 RCVD_IN_MSPIKE_H5 15280 2.94 0.96 3.56 76 RCVD_IN_IADB_SENDERID 14759 3.08 1.95 3.44 77 BOTNET_IPINHOSTNAME 14726 6.19 15.07 3.43 78 T_REMOTE_IMAGE 14537 3.89 5.54 3.38 79 TR_XM_SpammyWords4 14531 5.14 10.80 3.38 80 BAYES_05 14506 2.77 0.80 3.38 81 RCVD_IN_IADB_DK 14303 3.01 1.98 3.33 82 TR_XM_DK_SendGrid 13216 3.33 4.17 3.08 83 TM2_M_URI_OPT_OUT 13039 3.62 5.50 3.03 84 TR_XM_PhishingBody 12841 3.82 6.51 2.99 85 DKIM_INVALID 12616 3.32 4.57 2.94 86 XMSexyCombo_05 12560 4.65 10.19 2.92 87 XM_B_SpammyWords3 12326 5.26 12.95 2.87 88 XMNumbers 12233 3.85 7.09 2.85 89 RCVD_IN_IADB_VOUCHED 11567 2.27 0.93 2.69 90 HTML_MIME_NO_HTML_TAG 11291 2.56 2.34 2.63 91 MIME_HTML_MOSTLY 11256 3.92 8.10 2.62 92 BAYES_95 10985 3.13 4.98 2.56 93 T_TooManySym_02 10969 2.15 0.85 2.55 94 MAILING_LIST_MULTI 10610 2.40 2.18 2.47 95 XMSubMetaSx_00 10393 3.28 6.06 2.42 96 TooManyTo_002 10171 2.02 0.91 2.37 97 T_XMDrugObfuBody_14 10120 2.44 2.70 2.36 98 UNTRUSTED_Relay 9620 5.85 17.49 2.24 99 URI_NOVOWEL 9086 2.00 1.61 2.11 100 TR_XM_SB_Phish 8484 2.05 2.29 1.97 101 XMSubPhish11 8414 2.03 2.26 1.96 102 XM_SPF_SoftFail 8284 2.54 4.52 1.93 103 HELO_NODOT 8210 1.59 0.55 1.91 104 HELO_NO_DOMAIN 8209 1.59 0.55 1.91 105 XMSubGarbage 8121 1.48 0.17 1.89 106 XMSubLongNoVowel 7976 1.48 0.26 1.86 107 FROM_EXCESS_BASE64 7777 1.85 1.99 1.81 108 KHOP_HELO_FCRDNS 7760 2.71 5.62 1.81 109 TR_DCC_Bayes_99 7290 7.42 25.84 1.70 110 RCVD_IN_IADB_OPTIN 7287 1.43 0.58 1.70 111 XM_B_Phish66 7210 2.17 3.76 1.68 112 HTML_IMAGE_RATIO_08 7189 1.87 2.51 1.67 113 XM_UB50 7128 2.43 4.90 1.66 114 INVALID_MSGID 7076 1.34 0.34 1.65 115 IN_HORDE_ADDRESS_BOOK 6960 1.25 0.07 1.62 116 TR_Symld_Words 6919 1.74 2.14 1.61 117 TooManyTo_003 6548 1.34 0.74 1.52 118 XM_B_SpammyTLD 6538 2.30 4.79 1.52 119 MSGID_NOFQDN1 6466 1.18 0.12 1.51 120 TVD_RCVD_IP 6429 1.20 0.25 1.50 121 TO_MALFORMED 6247 1.30 0.80 1.45 122 T_XMDrugObfuBody_08 6098 1.75 2.81 1.42 123 XM_DK_Undo_01 5822 1.55 2.19 1.36 124 XM_CamelCaseFrm001 5760 1.56 2.27 1.34 125 SUBJ_ALL_CAPS 5514 1.48 2.10 1.28 126 XMCapTrack 5420 1.09 0.53 1.26 127 TR_XM_SpammyWords5 5087 2.30 5.91 1.18 128 BOTNET 5035 4.35 14.57 1.17 129 XM_E_Blogspot 4876 0.89 0.09 1.13 130 XM_GoogleGroups 4781 1.01 0.69 1.11 131 URI_HEX 4763 1.41 2.40 1.11 132 XM_B_Unsub2 4717 1.75 3.86 1.10 133 XMDiploma_00 4705 1.53 2.93 1.10 134 XMGappySubj_01 4701 0.90 0.28 1.09 135 XMHTML_After_End 4615 1.12 1.28 1.07 136 TooManyTo_004 4608 0.98 0.67 1.07 137 RELAYCOUNTRY_CA 4405 2.05 5.34 1.03 138 TM2_M_VERY_LONG_WORD 4313 1.33 2.39 1.00 139 XMStockSpam_06 4203 1.07 1.37 0.98 140 RELAYCOUNTRY_GB 3823 0.95 1.16 0.89 141 TooManyTo_005 3762 0.80 0.57 0.88 142 HELO_MISC_IP 3748 0.68 0.05 0.87 143 XM_H_Long_From02 3732 0.85 0.79 0.87 144 DKIM_ADSP_CUSTOM_MED 3717 1.00 1.42 0.87 145 SpammyFromTLD_01 3696 2.08 5.99 0.86 146 URI_TRY_3LD 3546 1.00 1.55 0.83 147 T_FILL_THIS_FORM_SHORT 3464 1.06 1.88 0.81 148 XM_B_COVIDMETA 3401 1.48 3.71 0.79 149 XMBSHREFv2 3393 0.66 0.25 0.79 150 HTML_IMAGE_ONLY_20 3315 0.79 0.83 0.77 151 TVD_SPACE_RATIO 3265 0.60 0.08 0.76 152 USER_IN_DEF_DKIM_WL 3131 0.56 0.00 0.73 153 XM_OfRef6 3109 1.33 3.29 0.72 154 T_TooManySym_03 2982 0.61 0.34 0.69 155 TR_MetaPhish_Combo_01 2860 0.80 1.23 0.67 156 FROM_GOV_SPOOF 2842 0.55 0.19 0.66 157 XMNoVowels 2821 0.70 0.84 0.66 158 HTTPS_HTTP_MISMATCH 2811 0.74 1.02 0.65 159 XMGenDplmaNmb 2781 0.99 2.08 0.65 160 RELAYCOUNTRY_DE 2655 0.80 1.38 0.62 161 T_OBFU_PDF_ATTACH 2645 0.52 0.22 0.62 162 XMBody_95 2619 0.50 0.14 0.61 163 NML_ADSP_CUSTOM_MED 2552 0.61 0.68 0.59 164 RCVD_IN_SORBS_DUL 2549 0.50 0.20 0.59 165 XM_ShortIntro_01 2517 0.55 0.45 0.59 166 XMPhish14 2488 0.61 0.70 0.58 167 XM_SPF_Unknown 2460 0.63 0.80 0.57 168 SHORT_HELO_AND_INLINE_IMAGE 2385 0.45 0.10 0.56 169 XM_H_PHPMailer 2365 0.63 0.91 0.55 170 XMLngstWrd_00 2349 0.77 1.47 0.55 171 TR_MSPIKEBAYES00 2342 0.42 0.01 0.55 172 RCVD_IN_BL_SPAMCOP_NET 2341 2.40 8.37 0.54 173 XMMoneyMeta_00 2299 0.86 1.92 0.54 174 XMPhish30 2216 0.66 1.13 0.52 175 XM_B_REG_HTML 2178 0.52 0.56 0.51 176 TR_XM_SpammyWords2 2164 3.37 12.61 0.50 177 XMLngstWrd_01 2134 0.64 1.12 0.50 178 XM_ProductURIs 2106 0.50 0.55 0.49 179 TM2_M_BODY_EMPTY 2041 0.38 0.08 0.48 180 XMBrknScrpt_02 2011 0.82 1.95 0.47 181 FORGED_GMAIL_RCVD 1936 0.65 1.28 0.45 182 PLING_QUERY 1839 0.50 0.75 0.43 183 XM_B_COPY_HTML 1838 0.47 0.60 0.43 184 TVD_SPACE_RATIO_MINFP 1822 0.42 0.40 0.42 185 T_XMDrugObfuBody_00 1808 0.65 1.39 0.42 186 XMDateMe_00 1797 0.41 0.38 0.42 187 XMBdyGiftCard01 1784 0.76 1.85 0.42 188 MISSING_HEADERS 1760 0.46 0.61 0.41 189 XMHTMLBadTable_001 1752 0.46 0.62 0.41 190 FROM_GOV_DKIM_AU 1741 0.41 0.45 0.41 191 XMLngstWrd_02 1680 0.49 0.80 0.39 192 USER_IN_WELCOMELIST 1661 0.30 0.00 0.39 193 USER_IN_WHITELIST 1661 0.30 0.00 0.39 194 HTML_IMAGE_ONLY_32 1651 0.34 0.21 0.38 195 HTML_IMAGE_ONLY_28 1631 0.40 0.46 0.38 196 TO_NO_BRKTS_HTML_ONLY 1555 0.31 0.14 0.36 197 NICE_REPLY_A 1538 0.28 0.03 0.36 198 XMSubMetaI_00 1529 0.47 0.85 0.36 199 HTML_IMAGE_ONLY_24 1522 0.32 0.20 0.35 200 XMSubMetaSxObfu_03 1499 0.45 0.78 0.35 ----------------------------------------------------------------------