Email: 542826 Autolearn: 0 AvgScore: 2.05 AvgScanTime: 1.45 sec Spam: 143784 Autolearn: 0 AvgScore: 14.44 AvgScanTime: 1.85 sec Ham: 399042 Autolearn: 0 AvgScore: -2.42 AvgScanTime: 1.30 sec Time Spent Running SA: 218.24 hours Time Spent Processing Spam: 74.04 hours Time Spent Processing Ham: 144.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138250 88.44 96.15 85.67 2 DCC_CHECK 109674 47.38 76.28 36.97 3 DKIM_SIGNED 108670 72.73 75.58 71.71 4 RELAYCOUNTRY_US 104566 78.25 72.72 80.24 5 XM_DK_Pass 102799 70.60 71.50 70.28 6 DKIM_VALID 98971 68.25 68.83 68.04 7 XM_B_Unicode 97654 67.23 67.92 66.98 8 XM_B_SpammyWords 91308 47.64 63.50 41.92 9 XMListUnsubscribeExists 85482 47.09 59.45 42.63 10 DKIM_VALID_AU 70929 51.10 49.33 51.74 11 BAYES_50 63115 50.32 43.90 52.64 12 XM_B_Unicode3 52300 37.65 36.37 38.11 13 XM_B_SpammyWords2 51682 21.88 35.94 16.82 14 XM_DK_Undo_02 50238 14.12 34.94 6.61 15 MIME_HTML_ONLY 45461 22.34 31.62 18.99 16 LOC_TINY_FONT_1 43522 22.69 30.27 19.96 17 RCVD_IN_MSPIKE_H2 42176 25.65 29.33 24.32 18 HTML_FONT_LOW_CONTRAST 41442 25.24 28.82 23.95 19 FVGT_m_MULTI_ODD 40717 23.63 28.32 21.95 20 TR_XM_DKIM_Undo 40020 11.00 27.83 4.93 21 T_KAM_HTML_FONT_INVALID 38928 19.82 27.07 17.21 22 DKIM_VALID_EF 38163 26.24 26.54 26.12 23 T_TM2_M_HEADER_IN_MSG 36265 31.69 25.22 34.02 24 BAYES_99 36143 10.30 25.14 4.95 25 XMSubLong 34469 21.14 23.97 20.12 26 DCC_CHECK_NEGATIVE 34061 52.57 23.69 62.98 27 FSL_BULK_SIG 32164 11.43 22.37 7.49 28 UNTRUSTED_Relay 29726 7.08 20.67 2.18 29 RELAYCOUNTRY_META 29139 8.95 20.27 4.87 30 XM_Body_Dirty_Words 28608 13.34 19.90 10.98 31 TR_DCC_Bayes_99 27944 6.79 19.43 2.23 32 BAYES_999 27530 8.10 19.15 4.11 33 RCVD_IN_MSPIKE_WL 25258 25.00 17.57 27.68 34 XM_Multi_Part_URI 22820 11.79 15.87 10.31 35 XM_UncommonTLD01 21670 6.66 15.07 3.64 36 BOTNET 21102 5.19 14.68 1.78 37 XM_B_Unsub 20809 11.37 14.47 10.25 38 XM_B_SpammyWords3 18336 6.07 12.75 3.66 39 LOTS_OF_MONEY 17567 7.71 12.22 6.09 40 BOTNET_IPINHOSTNAME 17173 6.32 11.94 4.30 41 RCVD_IN_MSPIKE_BL 16056 3.17 11.17 0.28 42 TR_XM_SpammyWords4 15065 5.49 10.48 3.70 43 UNPARSEABLE_RELAY 14932 8.41 10.39 7.70 44 XM_B_Phish_Phrases 14890 5.79 10.36 4.15 45 XMSexyCombo_05 14614 4.88 10.16 2.98 46 LotsOfNums_01 14531 9.12 10.11 8.76 47 TR_XM_UnparsRelay 14384 6.95 10.00 5.85 48 RCVD_IN_MSPIKE_H3 14360 13.42 9.99 14.65 49 TR_XM_PhishingBody 14164 4.93 9.85 3.16 50 T_REMOTE_IMAGE 13964 5.52 9.71 4.02 51 SpammyFromTLD_02 13766 2.82 9.57 0.39 52 XM_ShortIntro_01 12946 4.56 9.00 2.96 53 XM_Evil_Numbers_Gen 12836 7.79 8.93 7.38 54 HTML_MIME_NO_HTML_TAG 12557 3.97 8.73 2.25 55 TR_XM_SpammyWords2 12312 2.91 8.56 0.88 56 KHOP_HELO_FCRDNS 11625 4.34 8.09 2.99 57 XM_SendGrid 11524 7.10 8.01 6.77 58 BAYES_60 11210 8.56 7.80 8.83 59 HTML_IMAGE_RATIO_02 10909 5.62 7.59 4.92 60 BAYES_80 10638 4.85 7.40 3.93 61 XM_UB50 10181 3.05 7.08 1.60 62 RCVD_IN_BL_SPAMCOP_NET 10169 2.26 7.07 0.52 63 XM_B_Phish66 10116 3.22 7.04 1.84 64 RCVD_IN_MSPIKE_H4 9793 9.54 6.81 10.52 65 T_HTML_TAG_BALANCE_CENTER 9701 1.86 6.75 0.09 66 DKIM_INVALID 9699 4.48 6.75 3.67 67 HTML_IMAGE_ONLY_08 9589 1.83 6.67 0.09 68 BAYES_00 9563 12.56 6.65 14.70 69 XMSubMetaSx_00 9063 4.03 6.30 3.22 70 XM_B_SpammyTLD 8979 3.51 6.24 2.53 71 HELO_NODOT 8947 2.99 6.22 1.83 72 HELO_NO_DOMAIN 8944 2.99 6.22 1.83 73 MPART_ALT_DIFF 8747 4.95 6.08 4.55 74 TR_XM_MSPIKECOMBO 8619 1.78 5.99 0.27 75 MISSING_HEADERS 8028 1.82 5.58 0.47 76 TooManyTo_001 7942 7.98 5.52 8.86 77 MIXED_CENTER_CASE 7852 1.45 5.46 0.00 78 MIXED_HREF_CASE 7833 1.44 5.45 0.00 79 MIXED_AREA_CASE 7824 1.44 5.44 0.00 80 MIXED_FONT_CASE 7823 1.44 5.44 0.00 81 MIXED_IMG_CASE 7762 1.43 5.40 0.00 82 XM_H_Long_From01 7672 5.01 5.34 4.89 83 REPLYTO_WITHOUT_TO_CC 7535 1.41 5.24 0.04 84 RCVD_IN_MSPIKE_ZBI 7437 1.38 5.17 0.02 85 RELAYCOUNTRY_NG_I 7434 1.38 5.17 0.01 86 BODY_URI_ONLY 7182 1.33 4.99 0.02 87 XMNumbers 7063 3.55 4.91 3.06 88 ANY_BOUNCE_MESSAGE 7049 4.42 4.90 4.25 89 BOUNCE_MESSAGE 7049 4.42 4.90 4.25 90 BOTNET_NORDNS 7007 1.31 4.87 0.02 91 HTML_FONT_SIZE_LARGE 6684 1.31 4.65 0.11 92 TR_XM_SPAMCOP 6576 1.36 4.57 0.20 93 MIME_HTML_MOSTLY 6566 2.69 4.57 2.01 94 TR_XM_DK_SendGrid 6348 4.27 4.41 4.21 95 URI_OPTOUT_3LD 6321 1.27 4.40 0.14 96 XMStrtUSub 6300 4.55 4.38 4.60 97 MIXED_CTYPE_CASE 6166 1.14 4.29 0.00 98 TR_XM_SpammyWords5 6122 2.17 4.26 1.42 99 HTML_IMAGE_RATIO_04 6115 4.65 4.25 4.79 100 RELAYCOUNTRY_CA 6002 1.82 4.17 0.97 101 TR_XM_PhishingBody2 5828 1.11 4.05 0.05 102 XM_SPF_SoftFail 5584 3.42 3.88 3.25 103 BAYES_95 5582 2.68 3.88 2.24 104 PDS_OTHER_BAD_TLD 5527 1.22 3.84 0.28 105 MIME_QP_LONG_LINE 5399 4.95 3.75 5.38 106 TR_XM_SpammyWords3 5198 1.10 3.62 0.19 107 TM2_M_URI_OPT_OUT 5175 3.44 3.60 3.39 108 SpammyFromTLD_01 5157 1.70 3.59 1.02 109 URI_GOOG_STO_SPAMMY 4944 0.91 3.44 0.00 110 GOOG_STO_IMG_HTML 4858 0.89 3.38 0.00 111 RCVD_IN_MSPIKE_L5 4746 0.90 3.30 0.03 112 URI_NOVOWEL 4716 2.77 3.28 2.59 113 HTML_IMAGE_RATIO_06 4620 3.73 3.21 3.92 114 HTML_FONT_SIZE_HUGE 4603 0.89 3.20 0.06 115 XM_DIRTYINTL 4566 1.41 3.18 0.78 116 URIBL_DBL_SPAM 4530 0.85 3.15 0.01 117 MIME_HTML_ONLY_MULTI 4241 3.04 2.95 3.08 118 TM2_M_VERY_LONG_WORD 4078 1.60 2.84 1.16 119 XM_OfRef6 4062 1.48 2.83 0.99 120 XM_B_COVIDMETA 3983 1.75 2.77 1.38 121 T_XMDrugObfuBody_08 3940 2.00 2.74 1.73 122 T_TooManySym_01 3939 4.56 2.74 5.22 123 XMNoVowels 3906 2.37 2.72 2.24 124 RCVD_IN_RP_SAFE 3782 5.18 2.63 6.09 125 URI_PHP_REDIR 3754 0.70 2.61 0.01 126 XM_UB99 3659 0.68 2.54 0.01 127 DIET_1 3655 0.95 2.54 0.37 128 BAYES_40 3641 4.67 2.53 5.44 129 RCVD_IN_IADB_LISTED 3640 4.55 2.53 5.27 130 TR_XM_SB_Phish 3569 2.33 2.48 2.27 131 XMSubPhish11 3477 2.28 2.42 2.23 132 T_XMDrugObfuBody_14 3408 2.33 2.37 2.31 133 XMDiploma_00 3367 1.90 2.34 1.74 134 XMLngstWrd_00 3357 1.00 2.33 0.52 135 XM_B_SpammyWords4 3305 0.87 2.30 0.36 136 XMLngstWrd_01 3256 0.93 2.26 0.45 137 XM_B_Unsub2 3255 2.06 2.26 1.99 138 XM_UB60 3199 0.66 2.22 0.09 139 URI_HEX 3160 1.60 2.20 1.38 140 RCVD_IN_IADB_SPF 3150 3.97 2.19 4.61 141 XM_DK_Undo_01 3047 1.85 2.12 1.75 142 HTML_IMAGE_RATIO_08 3044 2.56 2.12 2.71 143 RCVD_IN_RP_CERTIFIED 3020 4.51 2.10 5.38 144 XMSlimDrugH 2996 0.86 2.08 0.43 145 XM_CamelCaseFrm001 2984 1.83 2.08 1.75 146 T_XMDrugObfuBody_00 2935 0.96 2.04 0.57 147 TR_XM_COVIDMETA4 2921 0.82 2.03 0.38 148 RCVD_IN_IADB_DK 2915 3.47 2.03 4.00 149 RCVD_IN_IADB_SENDERID 2909 3.57 2.02 4.12 150 XMBody_17 2885 0.90 2.01 0.50 151 RCVD_IN_MSPIKE_L4 2820 0.58 1.96 0.09 152 RCVD_IN_PSBL 2820 0.57 1.96 0.07 153 XMSexyCombo_01 2689 0.85 1.87 0.48 154 FROM_EXCESS_BASE64 2620 2.42 1.82 2.64 155 MAILING_LIST_MULTI 2618 2.52 1.82 2.77 156 TR_XM_PHPDW 2592 0.69 1.80 0.29 157 XM_URI_RBL 2582 0.56 1.80 0.11 158 XM_UB999 2507 0.47 1.74 0.01 159 URI_TRY_3LD 2481 1.10 1.73 0.88 160 RELAYCOUNTRY_IR 2446 0.45 1.70 0.00 161 ALL_TRUSTED 2391 12.29 1.66 16.13 162 BAYES_20 2372 3.77 1.65 4.54 163 TR_XM_PHPForged 2330 0.62 1.62 0.26 164 HTML_IMAGE_ONLY_20 2322 1.06 1.61 0.85 165 SUBJ_ALL_CAPS 2311 1.54 1.61 1.52 166 JH_SPAMMY_HEADERS 2309 0.43 1.61 0.00 167 RELAYCOUNTRY_IN 2256 0.51 1.57 0.13 168 XMHTML_After_End 2246 1.17 1.56 1.03 169 TR_XM_FormFill2 2239 0.60 1.56 0.26 170 XM_H_PHPOS 2232 0.59 1.55 0.25 171 T_XMHurry_00 2209 0.80 1.54 0.54 172 XMWghtMeta_00 2177 0.45 1.51 0.07 173 XMBrknScrpt_02 2154 1.00 1.50 0.82 174 XMGenDplmaNmb 2139 1.12 1.49 0.98 175 URIBL_BLACK 2095 0.41 1.46 0.03 176 RCVD_IN_RP_RNBL 2023 0.38 1.41 0.01 177 XM_UB80 1979 0.39 1.38 0.03 178 RELAYCOUNTRY_NL 1912 0.49 1.33 0.19 179 XM_PDF 1905 4.14 1.32 5.15 180 XMStockSpam_06 1843 0.85 1.28 0.69 181 XM_Body_Dirty_Words_01 1842 0.52 1.28 0.25 182 RELAYCOUNTRY_DE 1834 0.77 1.28 0.59 183 XMMoneyMeta_00 1813 0.83 1.26 0.67 184 FROM_SUSPICIOUS_NTLD 1799 0.36 1.25 0.04 185 TR_XM_COVIDMETA1 1797 0.50 1.25 0.23 186 TR_XM_INV_DKIM 1795 0.41 1.25 0.11 187 RCVD_IN_IADB_VOUCHED 1788 2.70 1.24 3.22 188 TR_Symld_Words 1748 1.55 1.22 1.67 189 DKIM_ADSP_CUSTOM_MED 1718 0.98 1.19 0.90 190 FROM_SUSPICIOUS_NTLD_FP 1714 0.34 1.19 0.03 191 HTTPS_HTTP_MISMATCH 1692 0.92 1.18 0.82 192 RELAYCOUNTRY_FR 1626 0.76 1.13 0.62 193 XMPhish14 1626 0.60 1.13 0.41 194 HTML_TAG_BALANCE_BODY 1607 0.66 1.12 0.49 195 T_FILL_THIS_FORM_SHORT 1606 0.89 1.12 0.81 196 USER_IN_DEF_DKIM_WL 1600 7.73 1.11 10.11 197 TR_Mismatch_TLD_02 1597 0.36 1.11 0.09 198 XM_H_Long_From02 1592 1.16 1.11 1.18 199 FORGED_GMAIL_RCVD 1559 0.63 1.08 0.47 200 DATE_IN_PAST_03_06 1537 0.57 1.07 0.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 341845 88.44 96.15 85.67 2 RELAYCOUNTRY_US 320192 78.25 72.72 80.24 3 DKIM_SIGNED 286142 72.73 75.58 71.71 4 XM_DK_Pass 280436 70.60 71.50 70.28 5 DKIM_VALID 271501 68.25 68.83 68.04 6 XM_B_Unicode 267294 67.23 67.92 66.98 7 DCC_CHECK_NEGATIVE 251328 52.57 23.69 62.98 8 BAYES_50 210058 50.32 43.90 52.64 9 DKIM_VALID_AU 206472 51.10 49.33 51.74 10 XMListUnsubscribeExists 170127 47.09 59.45 42.63 11 XM_B_SpammyWords 167285 47.64 63.50 41.92 12 XM_B_Unicode3 152092 37.65 36.37 38.11 13 DCC_CHECK 147510 47.38 76.28 36.97 14 T_TM2_M_HEADER_IN_MSG 135740 31.69 25.22 34.02 15 RCVD_IN_MSPIKE_WL 110464 25.00 17.57 27.68 16 DKIM_VALID_EF 104248 26.24 26.54 26.12 17 RCVD_IN_MSPIKE_H2 97050 25.65 29.33 24.32 18 HTML_FONT_LOW_CONTRAST 95577 25.24 28.82 23.95 19 FVGT_m_MULTI_ODD 87572 23.63 28.32 21.95 20 XMSubLong 80269 21.14 23.97 20.12 21 LOC_TINY_FONT_1 79633 22.69 30.27 19.96 22 MIME_HTML_ONLY 75788 22.34 31.62 18.99 23 T_KAM_HTML_FONT_INVALID 68656 19.82 27.07 17.21 24 XM_B_SpammyWords2 67103 21.88 35.94 16.82 25 ALL_TRUSTED 64349 12.29 1.66 16.13 26 BAYES_00 58642 12.56 6.65 14.70 27 RCVD_IN_MSPIKE_H3 58463 13.42 9.99 14.65 28 XM_Body_Dirty_Words 43820 13.34 19.90 10.98 29 RCVD_IN_MSPIKE_H4 41984 9.54 6.81 10.52 30 XM_Multi_Part_URI 41153 11.79 15.87 10.31 31 XM_B_Unsub 40902 11.37 14.47 10.25 32 USER_IN_DEF_DKIM_WL 40346 7.73 1.11 10.11 33 TooManyTo_001 35367 7.98 5.52 8.86 34 BAYES_60 35255 8.56 7.80 8.83 35 LotsOfNums_01 34974 9.12 10.11 8.76 36 TR_XM_DK_Bayes 32421 6.13 0.58 8.12 37 TR_XM_DK_Bayes1 31357 5.92 0.55 7.86 38 UNPARSEABLE_RELAY 30741 8.41 10.39 7.70 39 FSL_BULK_SIG 29901 11.43 22.37 7.49 40 XM_Evil_Numbers_Gen 29455 7.79 8.93 7.38 41 XM_DKIMWhitelistDomains 27588 5.09 0.05 6.91 42 XM_SendGrid 27026 7.10 8.01 6.77 43 TR_XM_DK_Bayes2 26971 5.09 0.46 6.76 44 XM_DK_Undo_02 26390 14.12 34.94 6.61 45 RCVD_IN_RP_SAFE 24319 5.18 2.63 6.09 46 LOTS_OF_MONEY 24286 7.71 12.22 6.09 47 TR_XM_UnparsRelay 23353 6.95 10.00 5.85 48 IN_ZIMBRA_NJ_WHITELIST 22125 4.09 0.04 5.54 49 BAYES_40 21704 4.67 2.53 5.44 50 RCVD_IN_RP_CERTIFIED 21478 4.51 2.10 5.38 51 MIME_QP_LONG_LINE 21467 4.95 3.75 5.38 52 RCVD_IN_IADB_LISTED 21040 4.55 2.53 5.27 53 T_TooManySym_01 20838 4.56 2.74 5.22 54 XM_PDF 20569 4.14 1.32 5.15 55 BAYES_99 19756 10.30 25.14 4.95 56 TR_XM_DKIM_Undo 19673 11.00 27.83 4.93 57 HTML_IMAGE_RATIO_02 19620 5.62 7.59 4.92 58 XM_H_Long_From01 19501 5.01 5.34 4.89 59 RELAYCOUNTRY_META 19438 8.95 20.27 4.87 60 HTML_IMAGE_RATIO_04 19131 4.65 4.25 4.79 61 RCVD_IN_IADB_SPF 18415 3.97 2.19 4.61 62 XMStrtUSub 18373 4.55 4.38 4.60 63 MPART_ALT_DIFF 18149 4.95 6.08 4.55 64 BAYES_20 18115 3.77 1.65 4.54 65 BOTNET_IPINHOSTNAME 17160 6.32 11.94 4.30 66 ANY_BOUNCE_MESSAGE 16946 4.42 4.90 4.25 67 BOUNCE_MESSAGE 16946 4.42 4.90 4.25 68 TR_XM_DK_SendGrid 16811 4.27 4.41 4.21 69 XM_B_Phish_Phrases 16543 5.79 10.36 4.15 70 RCVD_IN_IADB_SENDERID 16459 3.57 2.02 4.12 71 XM_H_Trusted_IP 16447 3.03 0.00 4.12 72 BAYES_999 16420 8.10 19.15 4.11 73 T_REMOTE_IMAGE 16022 5.52 9.71 4.02 74 RCVD_IN_IADB_DK 15948 3.47 2.03 4.00 75 BAYES_80 15673 4.85 7.40 3.93 76 HTML_IMAGE_RATIO_06 15631 3.73 3.21 3.92 77 TR_XM_SpammyWords4 14752 5.49 10.48 3.70 78 DKIM_INVALID 14641 4.48 6.75 3.67 79 XM_B_SpammyWords3 14589 6.07 12.75 3.66 80 XM_UncommonTLD01 14508 6.66 15.07 3.64 81 TM2_M_URI_OPT_OUT 13521 3.44 3.60 3.39 82 XM_SPF_SoftFail 12966 3.42 3.88 3.25 83 RCVD_IN_IADB_VOUCHED 12864 2.70 1.24 3.22 84 XMSubMetaSx_00 12832 4.03 6.30 3.22 85 TR_XM_PhishingBody 12624 4.93 9.85 3.16 86 MIME_HTML_ONLY_MULTI 12273 3.04 2.95 3.08 87 XMNumbers 12217 3.55 4.91 3.06 88 KHOP_HELO_FCRDNS 11943 4.34 8.09 2.99 89 XMSexyCombo_05 11890 4.88 10.16 2.98 90 XM_ShortIntro_01 11810 4.56 9.00 2.96 91 MAILING_LIST_MULTI 11071 2.52 1.82 2.77 92 BAYES_05 10869 2.28 1.05 2.72 93 HTML_IMAGE_RATIO_08 10828 2.56 2.12 2.71 94 FROM_EXCESS_BASE64 10541 2.42 1.82 2.64 95 URI_NOVOWEL 10328 2.77 3.28 2.59 96 TVD_RCVD_IP 10204 1.93 0.18 2.56 97 T_TooManySym_02 10139 2.11 0.91 2.54 98 XM_B_SpammyTLD 10081 3.51 6.24 2.53 99 RCVD_IN_MSPIKE_H5 10017 2.05 0.77 2.51 100 TooManyTo_002 9745 2.05 0.95 2.44 101 MIME_HEADER_CTYPE_ONLY 9270 1.74 0.12 2.32 102 T_XMDrugObfuBody_14 9218 2.33 2.37 2.31 103 TR_XM_SB_Phish 9058 2.33 2.48 2.27 104 HTML_MIME_NO_HTML_TAG 8990 3.97 8.73 2.25 105 BAYES_95 8956 2.68 3.88 2.24 106 XMNoVowels 8933 2.37 2.72 2.24 107 XMSubPhish11 8910 2.28 2.42 2.23 108 TR_DCC_Bayes_99 8901 6.79 19.43 2.23 109 UNTRUSTED_Relay 8682 7.08 20.67 2.18 110 RCVD_IN_IADB_OPTIN 8328 1.73 0.75 2.09 111 MY_SERVERS_FOUND 8055 1.54 0.21 2.02 112 MIME_HTML_MOSTLY 8033 2.69 4.57 2.01 113 XM_B_Unsub2 7946 2.06 2.26 1.99 114 IN_HORDE_ADDRESS_BOOK 7655 1.43 0.09 1.92 115 XM_B_Phish66 7339 3.22 7.04 1.84 116 HELO_NODOT 7290 2.99 6.22 1.83 117 HELO_NO_DOMAIN 7288 2.99 6.22 1.83 118 BOTNET 7093 5.19 14.68 1.78 119 XM_DK_Undo_01 6971 1.85 2.12 1.75 120 XM_CamelCaseFrm001 6967 1.83 2.08 1.75 121 XMDiploma_00 6949 1.90 2.34 1.74 122 INVALID_MSGID 6935 1.31 0.13 1.74 123 T_XMDrugObfuBody_08 6904 2.00 2.74 1.73 124 TR_Symld_Words 6669 1.55 1.22 1.67 125 XM_UB50 6384 3.05 7.08 1.60 126 MSGID_NOFQDN1 6332 1.18 0.05 1.59 127 TooManyTo_003 6326 1.38 0.80 1.59 128 TO_MALFORMED 6291 1.16 0.01 1.58 129 SUBJ_ALL_CAPS 6058 1.54 1.61 1.52 130 XMSubNoVowel 6019 1.31 0.77 1.51 131 TR_XM_SpammyWords5 5650 2.17 4.26 1.42 132 URI_HEX 5517 1.60 2.20 1.38 133 XM_B_COVIDMETA 5498 1.75 2.77 1.38 134 XMCapTrack 5382 1.25 0.98 1.35 135 XM_shorewaves_Whitelist 4922 0.91 0.00 1.23 136 XM_GoogleGroups 4761 1.06 0.67 1.19 137 XM_H_Long_From02 4714 1.16 1.11 1.18 138 XMGappySubj_01 4672 0.89 0.11 1.17 139 TooManyTo_004 4652 1.05 0.71 1.17 140 TM2_M_VERY_LONG_WORD 4628 1.60 2.84 1.16 141 XMHTML_After_End 4122 1.17 1.56 1.03 142 SpammyFromTLD_01 4085 1.70 3.59 1.02 143 XM_OfRef6 3945 1.48 2.83 0.99 144 XMGenDplmaNmb 3925 1.12 1.49 0.98 145 RELAYCOUNTRY_CA 3865 1.82 4.17 0.97 146 FROM_GOV_DKIM_AU 3860 0.74 0.12 0.97 147 TooManyTo_005 3788 0.87 0.65 0.95 148 HTML_FONT_FACE_BAD 3643 0.83 0.60 0.91 149 RELAYCOUNTRY_GB 3623 0.94 1.02 0.91 150 DKIM_ADSP_CUSTOM_MED 3589 0.98 1.19 0.90 151 TR_XM_SpammyWords2 3497 2.91 8.56 0.88 152 URI_TRY_3LD 3495 1.10 1.73 0.88 153 HTML_IMAGE_ONLY_20 3408 1.06 1.61 0.85 154 XMBSHREFv2 3294 0.67 0.22 0.83 155 HTTPS_HTTP_MISMATCH 3276 0.92 1.18 0.82 156 XMBrknScrpt_02 3262 1.00 1.50 0.82 157 T_FILL_THIS_FORM_SHORT 3235 0.89 1.12 0.81 158 T_OBFU_PDF_ATTACH 3148 0.65 0.28 0.79 159 XM_DIRTYINTL 3095 1.41 3.18 0.78 160 T_TooManySym_03 2995 0.62 0.27 0.75 161 TR_MSPIKEBAYES00 2991 0.55 0.01 0.75 162 TR_MetaPhish_Combo_01 2945 0.78 0.91 0.74 163 XM_SPF_Unknown 2842 0.70 0.65 0.71 164 XMBody_95 2835 0.56 0.15 0.71 165 XMStockSpam_06 2761 0.85 1.28 0.69 166 XMBdyGiftCard01 2691 0.73 0.88 0.67 167 XMMoneyMeta_00 2678 0.83 1.26 0.67 168 XM_ProductURIs 2625 0.75 1.02 0.66 169 FROM_GOV_SPOOF 2607 0.54 0.23 0.65 170 RELAYCOUNTRY_FR 2488 0.76 1.13 0.62 171 RCVD_IN_SORBS_DUL 2476 0.55 0.34 0.62 172 NML_ADSP_CUSTOM_MED 2373 0.67 0.88 0.59 173 RELAYCOUNTRY_DE 2348 0.77 1.28 0.59 174 T_XMDrugObfuBody_00 2259 0.96 2.04 0.57 175 XMPhish30 2217 0.65 0.92 0.56 176 T_XMHurry_00 2152 0.80 1.54 0.54 177 RCVD_IN_BL_SPAMCOP_NET 2093 2.26 7.07 0.52 178 XMLngstWrd_00 2085 1.00 2.33 0.52 179 XMBounce_01 2038 0.53 0.57 0.51 180 HTML_IMAGE_ONLY_32 2029 0.43 0.22 0.51 181 XMHTMLBadTable_001 2001 0.52 0.56 0.50 182 XM_H_PHPMailer 1993 0.64 1.04 0.50 183 XMBody_17 1985 0.90 2.01 0.50 184 HTML_TAG_BALANCE_BODY 1966 0.66 1.12 0.49 185 XMSexyCombo_01 1931 0.85 1.87 0.48 186 SHORT_HELO_AND_INLINE_IMAGE 1928 0.41 0.20 0.48 187 XM_USANA_RCVD 1880 0.35 0.00 0.47 188 FORGED_GMAIL_RCVD 1864 0.63 1.08 0.47 189 MISSING_HEADERS 1857 1.82 5.58 0.47 190 XM_B_REG_HTML 1856 0.44 0.37 0.47 191 XMSubMetaI_00 1799 0.54 0.81 0.45 192 XMLngstWrd_01 1793 0.93 2.26 0.45 193 TM2_M_BODY_EMPTY 1761 0.37 0.18 0.44 194 T_Symld_Words_02 1729 0.49 0.66 0.43 195 USER_IN_WELCOMELIST 1712 0.32 0.00 0.43 196 USER_IN_WHITELIST 1712 0.32 0.00 0.43 197 TVD_SPACE_RATIO 1711 0.42 0.40 0.43 198 HTML_IMAGE_ONLY_28 1705 0.59 1.04 0.43 199 XMSlimDrugH 1698 0.86 2.08 0.43 200 TVD_SPACE_RATIO_MINFP 1652 0.41 0.41 0.41 ----------------------------------------------------------------------