Email: 526284 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 1.35 sec Spam: 79701 Autolearn: 0 AvgScore: 12.56 AvgScanTime: 1.64 sec Ham: 446583 Autolearn: 0 AvgScore: -2.69 AvgScanTime: 1.30 sec Time Spent Running SA: 197.12 hours Time Spent Processing Spam: 36.23 hours Time Spent Processing Ham: 160.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 79673 99.96 99.96 99.96 2 HTML_MESSAGE 75465 90.40 94.69 89.63 3 DKIM_SIGNED 66570 66.09 83.52 62.97 4 XM_DK_Pass 64194 64.32 80.54 61.43 5 RELAYCOUNTRY_US 62394 78.92 78.29 79.04 6 DKIM_VALID 61965 62.46 77.75 59.73 7 XM_B_Unicode 60454 74.72 75.85 74.52 8 XM_B_SpammyWords 54101 44.71 67.88 40.58 9 XMListUnsubscribeExists 53124 46.08 66.65 42.41 10 DKIM_VALID_AU 43558 46.66 54.65 45.23 11 XM_DK_Undo_02 36525 13.37 45.83 7.57 12 BAYES_50 36267 47.04 45.50 47.32 13 XM_B_Unicode3 33950 49.73 42.60 51.00 14 XM_B_SpammyWords2 31821 20.85 39.93 17.45 15 TR_XM_DKIM_Undo 30225 10.37 37.92 5.45 16 MIME_HTML_ONLY 28126 23.03 35.29 20.85 17 FVGT_m_MULTI_ODD 26132 23.88 32.79 22.29 18 LOC_TINY_FONT_1 24701 23.31 30.99 21.94 19 BAYES_99 24562 20.44 30.82 18.59 20 HTML_FONT_LOW_CONTRAST 23886 25.04 29.97 24.17 21 DKIM_VALID_EF 23502 23.16 29.49 22.03 22 T_KAM_HTML_FONT_INVALID 22174 17.73 27.82 15.93 23 RCVD_IN_MSPIKE_H2 20995 18.33 26.34 16.90 24 XMSubLong 19485 19.62 24.45 18.76 25 XM_Body_Dirty_Words 19340 12.89 24.27 10.86 26 BAYES_999 19059 18.40 23.91 17.41 27 T_TM2_M_HEADER_IN_MSG 18758 25.24 23.54 25.54 28 RELAYCOUNTRY_META 18744 6.34 23.52 3.28 29 RCVD_IN_MSPIKE_WL 15892 23.59 19.94 24.25 30 LOTS_OF_MONEY 13347 8.77 16.75 7.34 31 XM_Multi_Part_URI 13170 11.72 16.52 10.86 32 XM_B_Unsub 12323 11.27 15.46 10.52 33 BOTNET_IPINHOSTNAME 12292 6.02 15.42 4.34 34 TR_XM_SpammyWords4 12150 6.27 15.24 4.67 35 BOTNET 11391 3.54 14.29 1.62 36 RCVD_IN_MSPIKE_H3 11169 12.80 14.01 12.59 37 XM_UncommonTLD01 10716 4.43 13.45 2.82 38 TR_XM_SpammyRelay 10712 3.29 13.44 1.48 39 XM_B_SpammyWords3 10428 5.20 13.08 3.80 40 MPART_ALT_DIFF 9691 8.20 12.16 7.49 41 XMSexyCombo_05 9630 4.82 12.08 3.52 42 UNTRUSTED_Relay 9433 2.83 11.84 1.22 43 TR_XM_SpammyWords2 9346 2.67 11.73 1.06 44 RCVD_IN_BL_SPAMCOP_NET 8955 2.53 11.24 0.98 45 UNPARSEABLE_RELAY 8683 7.82 10.89 7.27 46 TR_XM_UnparsRelay 8325 6.59 10.45 5.90 47 HTML_MIME_NO_HTML_TAG 7848 3.42 9.85 2.27 48 XM_Evil_Numbers_Gen 7524 7.09 9.44 6.67 49 XM_SendGrid 6759 6.69 8.48 6.38 50 MIME_HTML_ONLY_MULTI 6632 5.78 8.32 5.33 51 LotsOfNums_01 6155 8.11 7.72 8.18 52 TR_XM_SPAMCOP 6101 1.47 7.65 0.37 53 TR_XM_PhishingBody 5908 3.82 7.41 3.18 54 SpammyFromTLD_02 5862 1.57 7.35 0.53 55 TM2_M_VERY_LONG_WORD 5809 2.29 7.29 1.40 56 XM_B_Phish_Phrases 5784 3.90 7.26 3.30 57 XMSubMetaSx_00 5382 3.94 6.75 3.43 58 BAYES_80 5351 4.10 6.71 3.63 59 RELAYCOUNTRY_CA 5192 1.63 6.51 0.76 60 XM_GoogleGroups 5052 2.09 6.34 1.33 61 HTML_IMAGE_RATIO_02 4932 5.55 6.19 5.43 62 BAYES_60 4852 6.99 6.09 7.16 63 RCVD_IN_MSPIKE_BL 4748 1.63 5.96 0.86 64 TR_XM_MSPIKECOMBO 4722 1.62 5.92 0.85 65 XMLngstWrd_00 4686 2.15 5.88 1.49 66 TooManyTo_001 4681 7.15 5.87 7.37 67 XMLngstWrd_01 4650 1.86 5.83 1.15 68 DKIM_INVALID 4605 3.63 5.78 3.25 69 RCVD_IN_MSPIKE_H4 4430 9.09 5.56 9.72 70 HTML_TITLE_SUBJ_DIFF 4399 1.10 5.52 0.31 71 TM2_M_URI_OPT_OUT 4371 4.24 5.48 4.02 72 XMLngstWrd_02 4367 1.58 5.48 0.88 73 KHOP_HELO_FCRDNS 4346 1.97 5.45 1.35 74 XMLngstWrd_03 4306 1.29 5.40 0.56 75 XMLngstWrd_04 4200 1.23 5.27 0.51 76 XM_H_Long_From01 4181 4.51 5.25 4.38 77 MIME_HTML_MOSTLY 4068 3.06 5.10 2.69 78 UPPERCASE_75_100 4043 1.06 5.07 0.34 79 XM_UB50 4008 1.41 5.03 0.76 80 TR_XM_DK_SendGrid 3989 4.13 5.00 3.97 81 XM_B_Phish66 3973 2.15 4.98 1.65 82 T_REMOTE_IMAGE 3710 3.15 4.65 2.88 83 XM_OfRef6 3643 1.40 4.57 0.84 84 TR_XM_MaxUnsub 3592 1.56 4.51 1.03 85 XMNumbers 3534 3.32 4.43 3.12 86 MIME_QP_LONG_LINE 3513 5.42 4.41 5.60 87 XM_SPF_SoftFail 3472 2.03 4.36 1.62 88 XM_DIRTYINTL 3434 0.95 4.31 0.35 89 HTML_IMAGE_RATIO_04 3417 6.09 4.29 6.41 90 XM_B_Investor 3375 1.76 4.23 1.32 91 TR_XM_SpammyWords5 3282 1.85 4.12 1.44 92 SpammyFromTLD_01 3224 1.12 4.05 0.60 93 HTML_IMAGE_RATIO_06 3175 4.05 3.98 4.07 94 TR_XM_SB_Phish 3083 2.09 3.87 1.77 95 XM_B_SpammyTLD 3081 2.27 3.87 1.98 96 XMSubPhish11 2995 2.06 3.76 1.75 97 URI_NOVOWEL 2964 2.54 3.72 2.32 98 XM_B_COVIDMETA 2868 1.20 3.60 0.77 99 BAYES_95 2861 2.48 3.59 2.29 100 XMStrtUSub 2824 3.39 3.54 3.37 101 GOOG_STO_IMG_HTML 2788 0.57 3.50 0.05 102 ALL_TRUSTED 2764 16.33 3.47 18.63 103 T_XMDrugObfuBody_08 2663 1.61 3.34 1.30 104 TR_XM_SpammyWords3 2627 0.88 3.30 0.45 105 XMDiploma_00 2494 1.60 3.13 1.33 106 T_XMDrugObfuBody_14 2465 2.00 3.09 1.80 107 MAILING_LIST_MULTI 2411 2.25 3.03 2.11 108 T_XMDrugObfuBody_00 2403 1.02 3.02 0.66 109 TR_XM_PHPDW 2367 0.70 2.97 0.30 110 XM_URI_RBL 2337 0.58 2.93 0.15 111 XM_B_SpammyWords4 2322 0.81 2.91 0.43 112 XMSexyCombo_01 2282 0.97 2.86 0.64 113 HTML_IMAGE_ONLY_08 2277 0.49 2.86 0.07 114 T_TooManySym_01 2232 4.30 2.80 4.57 115 TR_XM_PHPForged 2210 0.64 2.77 0.26 116 XM_B_Unsub2 2201 1.40 2.76 1.15 117 TR_XM_NoHeaderRelay 2171 0.57 2.72 0.19 118 TR_XM_FormFill2 2167 0.63 2.72 0.25 119 XM_H_PHPOS 2159 0.62 2.71 0.24 120 XM_DK_Undo_01 2090 1.73 2.62 1.57 121 RCVD_IN_MSPIKE_L3 2045 0.71 2.57 0.38 122 RCVD_IN_IADB_LISTED 2042 4.26 2.56 4.56 123 XM_UB99 2031 0.39 2.55 0.00 124 HTML_IMAGE_RATIO_08 2020 2.41 2.53 2.39 125 TR_XM_COVIDMETA1 2005 0.86 2.52 0.56 126 T_FILL_THIS_FORM_SHORT 1998 1.05 2.51 0.79 127 TR_Symld_Words 1970 1.55 2.47 1.39 128 BAYES_40 1930 4.26 2.42 4.59 129 URIBL_BLACK 1880 0.39 2.36 0.04 130 MIXED_CENTER_CASE 1863 0.35 2.34 0.00 131 MIXED_HREF_CASE 1862 0.35 2.34 0.00 132 MIXED_FONT_CASE 1860 0.35 2.33 0.00 133 MIXED_IMG_CASE 1860 0.36 2.33 0.00 134 MIXED_AREA_CASE 1855 0.35 2.33 0.00 135 XMStockSpam_06 1848 1.25 2.32 1.06 136 HTML_FONT_SIZE_LARGE 1843 0.42 2.31 0.09 137 SUBJ_ALL_CAPS 1811 1.90 2.27 1.84 138 T_XMHurry_00 1810 0.80 2.27 0.54 139 XMBody_17 1807 0.78 2.27 0.51 140 BOTNET_NORDNS 1784 0.35 2.24 0.01 141 T_HTML_TAG_BALANCE_CENTER 1777 0.42 2.23 0.09 142 RCVD_IN_IADB_SPF 1709 3.73 2.14 4.01 143 XMGenDplmaNmb 1680 0.99 2.11 0.80 144 XM_CamelCaseFrm001 1649 1.66 2.07 1.59 145 BAYES_20 1636 3.18 2.05 3.39 146 TR_XM_INV_DKIM 1627 0.50 2.04 0.23 147 RCVD_IN_IADB_SENDERID 1596 3.39 2.00 3.64 148 RCVD_IN_IADB_DK 1592 3.29 2.00 3.52 149 XM_UB999 1590 0.30 1.99 0.00 150 RCVD_IN_MSPIKE_L5 1590 0.44 1.99 0.16 151 URIBL_DBL_SPAM 1540 0.30 1.93 0.01 152 RELAYCOUNTRY_FR 1531 0.47 1.92 0.21 153 TR_XM_COVIDMETA4 1503 0.55 1.89 0.31 154 RCVD_IN_VALIDITY_RPBL 1418 0.34 1.78 0.08 155 RELAYCOUNTRY_CN 1368 0.32 1.72 0.07 156 RELAYCOUNTRY_AU 1359 0.53 1.71 0.32 157 URI_HEX 1319 1.47 1.65 1.44 158 BODY_URI_ONLY 1295 0.26 1.62 0.01 159 RCVD_IN_RP_RNBL 1287 0.30 1.61 0.07 160 HTTPS_HTTP_MISMATCH 1269 0.67 1.59 0.51 161 RELAYCOUNTRY_IN 1264 0.30 1.59 0.07 162 RCVD_IN_VALIDITY_SAFE 1255 4.51 1.57 5.03 163 MIXED_CTYPE_CASE 1233 0.24 1.55 0.00 164 XM_Body_Dirty_Words_01 1222 0.35 1.53 0.14 165 BAYES_00 1222 9.49 1.53 10.91 166 TM2_M_A_HREF_HREF 1215 0.65 1.52 0.49 167 TR_LOTS_OF_MONEY3 1212 0.55 1.52 0.38 168 XMSubNoVowel 1197 7.62 1.50 8.71 169 HK_RANDOM_REPLYTO 1186 0.30 1.49 0.09 170 MIME_CHARSET_FARAWAY 1184 0.36 1.49 0.15 171 JH_SPAMMY_HEADERS 1183 0.22 1.48 0.00 172 PDS_OTHER_BAD_TLD 1157 0.47 1.45 0.29 173 TR_Mismatch_TLD_01 1142 0.39 1.43 0.21 174 TR_XM_BayesRelay 1132 0.22 1.42 0.00 175 XM_B_DNDMA 1124 0.52 1.41 0.36 176 RCVD_IN_IADB_VOUCHED 1118 2.53 1.40 2.74 177 DIET_1 1105 0.68 1.39 0.56 178 FROM_EXCESS_BASE64 1096 2.39 1.38 2.57 179 XMBrknScrpt_02 1089 0.78 1.37 0.67 180 RCVD_IN_MSPIKE_L4 1087 0.47 1.36 0.31 181 RELAYCOUNTRY_RU 1083 0.22 1.36 0.02 182 TR_MetaPhish_Combo_01 1082 0.70 1.36 0.58 183 T_MONEY_PERCENT 1061 0.34 1.33 0.17 184 TR_LOTS_OF_MONEY2 1061 0.34 1.33 0.17 185 XM_H_PHPMailer 1051 0.55 1.32 0.41 186 RELAYCOUNTRY_DE 1049 0.42 1.32 0.26 187 XM_B_SEO 1043 0.31 1.31 0.14 188 TR_XM_FormFill 1022 0.22 1.28 0.03 189 BAYES_05 1010 2.00 1.27 2.13 190 RELAYCOUNTRY_GB 1000 0.71 1.25 0.61 191 T_Symld_Words_02 996 0.60 1.25 0.49 192 XMBdyGiftCard01 970 0.86 1.22 0.79 193 XMHTML_After_End 950 0.66 1.19 0.56 194 TR_XM_SEO4 949 0.26 1.19 0.09 195 XM_H_Long_From02 945 0.91 1.19 0.86 196 CHARSET_FARAWAY_HEADER 941 0.21 1.18 0.04 197 XM_PDF 936 3.42 1.17 3.81 198 XM_UB60 921 0.25 1.16 0.09 199 RCVD_IN_RP_SAFE 908 4.05 1.14 4.57 200 BOUNCE_MESSAGE 895 7.02 1.12 8.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 446410 99.96 99.96 99.96 2 HTML_MESSAGE 400286 90.40 94.69 89.63 3 RELAYCOUNTRY_US 352973 78.92 78.29 79.04 4 XM_B_Unicode 332780 74.72 75.85 74.52 5 DKIM_SIGNED 281232 66.09 83.52 62.97 6 XM_DK_Pass 274328 64.32 80.54 61.43 7 DKIM_VALID 266735 62.46 77.75 59.73 8 XM_B_Unicode3 227751 49.73 42.60 51.00 9 BAYES_50 211301 47.04 45.50 47.32 10 DKIM_VALID_AU 202002 46.66 54.65 45.23 11 XMListUnsubscribeExists 189389 46.08 66.65 42.41 12 XM_B_SpammyWords 181223 44.71 67.88 40.58 13 T_TM2_M_HEADER_IN_MSG 114065 25.24 23.54 25.54 14 RCVD_IN_MSPIKE_WL 108284 23.59 19.94 24.25 15 HTML_FONT_LOW_CONTRAST 107918 25.04 29.97 24.17 16 FVGT_m_MULTI_ODD 99542 23.88 32.79 22.29 17 DKIM_VALID_EF 98381 23.16 29.49 22.03 18 LOC_TINY_FONT_1 97995 23.31 30.99 21.94 19 MIME_HTML_ONLY 93095 23.03 35.29 20.85 20 XMSubLong 83763 19.62 24.45 18.76 21 ALL_TRUSTED 83178 16.33 3.47 18.63 22 BAYES_99 83019 20.44 30.82 18.59 23 XM_B_SpammyWords2 77915 20.85 39.93 17.45 24 BAYES_999 77753 18.40 23.91 17.41 25 RCVD_IN_MSPIKE_H2 75452 18.33 26.34 16.90 26 T_KAM_HTML_FONT_INVALID 71149 17.73 27.82 15.93 27 XM_H_Trusted_IP 59681 11.34 0.00 13.36 28 RCVD_IN_MSPIKE_H3 56206 12.80 14.01 12.59 29 BAYES_00 48736 9.49 1.53 10.91 30 XM_Body_Dirty_Words 48520 12.89 24.27 10.86 31 XM_Multi_Part_URI 48511 11.72 16.52 10.86 32 XM_B_Unsub 46994 11.27 15.46 10.52 33 RCVD_IN_MSPIKE_H4 43391 9.09 5.56 9.72 34 USER_IN_DEF_DKIM_WL 40828 7.88 0.78 9.14 35 XMSubNoVowel 38882 7.62 1.50 8.71 36 LotsOfNums_01 36513 8.11 7.72 8.18 37 ANY_BOUNCE_MESSAGE 36073 7.02 1.12 8.08 38 BOUNCE_MESSAGE 36071 7.02 1.12 8.08 39 TVD_SPACE_RATIO_MINFP 34505 6.58 0.15 7.73 40 XM_DK_Undo_02 33817 13.37 45.83 7.57 41 MPART_ALT_DIFF 33447 8.20 12.16 7.49 42 TooManyTo_001 32931 7.15 5.87 7.37 43 LOTS_OF_MONEY 32801 8.77 16.75 7.34 44 UNPARSEABLE_RELAY 32456 7.82 10.89 7.27 45 BAYES_60 31957 6.99 6.09 7.16 46 XM_Evil_Numbers_Gen 29781 7.09 9.44 6.67 47 HTML_IMAGE_RATIO_04 28617 6.09 4.29 6.41 48 XM_SendGrid 28474 6.69 8.48 6.38 49 XM_DKIMWhitelistDomains 26830 5.10 0.01 6.01 50 TR_XM_UnparsRelay 26365 6.59 10.45 5.90 51 TR_XM_DK_Bayes 25742 4.98 0.58 5.76 52 MIME_QP_LONG_LINE 25001 5.42 4.41 5.60 53 TR_XM_DK_Bayes1 24906 4.82 0.56 5.58 54 TR_XM_DKIM_Undo 24355 10.37 37.92 5.45 55 HTML_IMAGE_RATIO_02 24270 5.55 6.19 5.43 56 MIME_HTML_ONLY_MULTI 23799 5.78 8.32 5.33 57 IN_ZIMBRA_NJ_WHITELIST 23638 4.51 0.09 5.29 58 RCVD_IN_VALIDITY_SAFE 22468 4.51 1.57 5.03 59 TR_XM_DK_Bayes2 21347 4.12 0.43 4.78 60 TR_XM_SpammyWords4 20869 6.27 15.24 4.67 61 BAYES_40 20510 4.26 2.42 4.59 62 RCVD_IN_RP_SAFE 20427 4.05 1.14 4.57 63 T_TooManySym_01 20418 4.30 2.80 4.57 64 RCVD_IN_IADB_LISTED 20376 4.26 2.56 4.56 65 XM_H_Long_From01 19560 4.51 5.25 4.38 66 RCVD_IN_VALIDITY_CERTIFIED 19541 3.88 1.09 4.38 67 BOTNET_IPINHOSTNAME 19372 6.02 15.42 4.34 68 HTML_IMAGE_RATIO_06 18158 4.05 3.98 4.07 69 TM2_M_URI_OPT_OUT 17961 4.24 5.48 4.02 70 RCVD_IN_IADB_SPF 17912 3.73 2.14 4.01 71 RCVD_IN_RP_CERTIFIED 17849 3.49 0.64 4.00 72 TR_XM_DK_SendGrid 17745 4.13 5.00 3.97 73 XM_PDF 17037 3.42 1.17 3.81 74 XM_B_SpammyWords3 16956 5.20 13.08 3.80 75 RCVD_IN_IADB_SENDERID 16238 3.39 2.00 3.64 76 BAYES_80 16208 4.10 6.71 3.63 77 XMSexyCombo_05 15735 4.82 12.08 3.52 78 RCVD_IN_IADB_DK 15710 3.29 2.00 3.52 79 XMSubMetaSx_00 15335 3.94 6.75 3.43 80 BAYES_20 15118 3.18 2.05 3.39 81 XMStrtUSub 15033 3.39 3.54 3.37 82 XM_B_Phish_Phrases 14716 3.90 7.26 3.30 83 RELAYCOUNTRY_META 14645 6.34 23.52 3.28 84 DKIM_INVALID 14497 3.63 5.78 3.25 85 TR_XM_PhishingBody 14190 3.82 7.41 3.18 86 XMNumbers 13943 3.32 4.43 3.12 87 T_REMOTE_IMAGE 12870 3.15 4.65 2.88 88 XM_UncommonTLD01 12589 4.43 13.45 2.82 89 RCVD_IN_IADB_VOUCHED 12217 2.53 1.40 2.74 90 MIME_HTML_MOSTLY 12014 3.06 5.10 2.69 91 T_TooManySym_02 11464 2.30 0.82 2.57 92 FROM_EXCESS_BASE64 11461 2.39 1.38 2.57 93 HTML_FONT_FACE_BAD 11099 2.21 0.69 2.49 94 HTML_IMAGE_RATIO_08 10656 2.41 2.53 2.39 95 URI_NOVOWEL 10383 2.54 3.72 2.32 96 BAYES_95 10207 2.48 3.59 2.29 97 HTML_MIME_NO_HTML_TAG 10131 3.42 9.85 2.27 98 BAYES_05 9518 2.00 1.27 2.13 99 MAILING_LIST_MULTI 9411 2.25 3.03 2.11 100 XM_B_SpammyTLD 8862 2.27 3.87 1.98 101 RCVD_IN_MSPIKE_H5 8687 1.71 0.37 1.95 102 SUBJ_ALL_CAPS 8199 1.90 2.27 1.84 103 T_XMDrugObfuBody_14 8047 2.00 3.09 1.80 104 TR_XM_SB_Phish 7906 2.09 3.87 1.77 105 XMSubPhish11 7821 2.06 3.76 1.75 106 TooManyTo_002 7750 1.64 1.11 1.74 107 RCVD_IN_IADB_OPTIN 7649 1.60 1.00 1.71 108 XM_B_Phish66 7355 2.15 4.98 1.65 109 XM_SPF_SoftFail 7234 2.03 4.36 1.62 110 BOTNET 7224 3.54 14.29 1.62 111 XM_CamelCaseFrm001 7105 1.66 2.07 1.59 112 XM_DK_Undo_01 7008 1.73 2.62 1.57 113 INVALID_MSGID 7001 1.39 0.38 1.57 114 IN_HORDE_ADDRESS_BOOK 6707 1.29 0.09 1.50 115 XMLngstWrd_00 6649 2.15 5.88 1.49 116 TR_XM_SpammyRelay 6600 3.29 13.44 1.48 117 MSGID_NOFQDN1 6480 1.27 0.29 1.45 118 TR_XM_SpammyWords5 6451 1.85 4.12 1.44 119 URI_HEX 6422 1.47 1.65 1.44 120 TM2_M_VERY_LONG_WORD 6255 2.29 7.29 1.40 121 TR_Symld_Words 6189 1.55 2.47 1.39 122 TO_MALFORMED 6043 1.15 0.01 1.35 123 KHOP_HELO_FCRDNS 6028 1.97 5.45 1.35 124 XM_GoogleGroups 5932 2.09 6.34 1.33 125 XMDiploma_00 5926 1.60 3.13 1.33 126 XM_B_Investor 5877 1.76 4.23 1.32 127 HELO_NODOT 5864 1.24 0.85 1.31 128 HELO_NO_DOMAIN 5862 1.24 0.85 1.31 129 T_XMDrugObfuBody_08 5802 1.61 3.34 1.30 130 UNTRUSTED_Relay 5457 2.83 11.84 1.22 131 TVD_RCVD_IP 5348 1.06 0.31 1.20 132 XM_B_Unsub2 5142 1.40 2.76 1.15 133 TooManyTo_003 5138 1.10 0.84 1.15 134 XMLngstWrd_01 5133 1.86 5.83 1.15 135 XMGappySubj_01 5114 1.00 0.16 1.15 136 TR_XM_SpammyWords2 4732 2.67 11.73 1.06 137 XMStockSpam_06 4724 1.25 2.32 1.06 138 HTML_IMAGE_ONLY_20 4613 0.92 0.26 1.03 139 TR_XM_MaxUnsub 4594 1.56 4.51 1.03 140 RCVD_IN_BL_SPAMCOP_NET 4385 2.53 11.24 0.98 141 XMBSHREFv2 4244 0.85 0.29 0.95 142 XMCapTrack 4089 0.94 1.09 0.92 143 XMLngstWrd_02 3943 1.58 5.48 0.88 144 XM_H_Long_From02 3856 0.91 1.19 0.86 145 RCVD_IN_MSPIKE_BL 3836 1.63 5.96 0.86 146 XMPhish30 3819 0.89 1.06 0.86 147 TR_XM_MSPIKECOMBO 3788 1.62 5.92 0.85 148 XM_OfRef6 3734 1.40 4.57 0.84 149 TVD_SPACE_RATIO 3699 0.72 0.11 0.83 150 XM_ProductURIs 3607 0.79 0.70 0.81 151 TooManyTo_004 3568 0.78 0.66 0.80 152 XMGenDplmaNmb 3552 0.99 2.11 0.80 153 XMBdyGiftCard01 3547 0.86 1.22 0.79 154 T_FILL_THIS_FORM_SHORT 3546 1.05 2.51 0.79 155 DKIM_ADSP_CUSTOM_MED 3543 0.82 0.97 0.79 156 XM_B_COVIDMETA 3426 1.20 3.60 0.77 157 RELAYCOUNTRY_CA 3412 1.63 6.51 0.76 158 XM_UB50 3399 1.41 5.03 0.76 159 XMBrknScrpt_02 3001 0.78 1.37 0.67 160 XM_S_SpammyWords 2999 0.64 0.46 0.67 161 TR_XM_Spammywords 2998 0.64 0.46 0.67 162 T_XMDrugObfuBody_00 2968 1.02 3.02 0.66 163 XMSexyCombo_01 2845 0.97 2.86 0.64 164 HTML_TAG_BALANCE_BODY 2832 0.68 0.91 0.63 165 TooManyTo_005 2821 0.63 0.59 0.63 166 XMBody_95 2773 0.57 0.29 0.62 167 T_TooManySym_03 2728 0.56 0.28 0.61 168 RELAYCOUNTRY_GB 2715 0.71 1.25 0.61 169 SpammyFromTLD_01 2667 1.12 4.05 0.60 170 URI_TRY_3LD 2644 0.66 1.06 0.59 171 XM_B_COPY_HTML 2599 0.60 0.69 0.58 172 TR_MetaPhish_Combo_01 2581 0.70 1.36 0.58 173 FROM_GOV_DKIM_AU 2526 0.51 0.20 0.57 174 TR_XM_COVIDMETA1 2518 0.86 2.52 0.56 175 XMHTML_After_End 2509 0.66 1.19 0.56 176 XMLngstWrd_03 2496 1.29 5.40 0.56 177 DIET_1 2488 0.68 1.39 0.56 178 T_XMHurry_00 2404 0.80 2.27 0.54 179 SpammyFromTLD_02 2388 1.57 7.35 0.53 180 SHORT_URI_2 2347 0.54 0.64 0.53 181 NML_ADSP_CUSTOM_MED 2334 0.57 0.81 0.52 182 T_OBFU_PDF_ATTACH 2329 0.46 0.14 0.52 183 XMSubMetaI_00 2304 0.59 1.01 0.52 184 XMBody_17 2287 0.78 2.27 0.51 185 HTTPS_HTTP_MISMATCH 2276 0.67 1.59 0.51 186 XMLngstWrd_04 2264 1.23 5.27 0.51 187 TM2_M_A_HREF_HREF 2201 0.65 1.52 0.49 188 T_Symld_Words_02 2179 0.60 1.25 0.49 189 XM_ShortIntro_01 2126 0.49 0.58 0.48 190 XMNoVowels 2121 0.48 0.50 0.47 191 TR_MSPIKEBAYES00 2102 0.40 0.02 0.47 192 FROM_GOV_SPOOF 2066 0.45 0.35 0.46 193 TR_XM_SpammyWords3 1988 0.88 3.30 0.45 194 XM_B_SpammyWords4 1926 0.81 2.91 0.43 195 FORGED_GMAIL_RCVD 1879 0.48 0.80 0.42 196 XM_H_PHPMailer 1834 0.55 1.32 0.41 197 RCVD_IN_SORBS_DUL 1829 0.40 0.38 0.41 198 XMMoneyMeta_00 1820 0.48 0.85 0.41 199 XMHTMLBadTable_001 1811 0.44 0.60 0.41 200 XMBody_78 1801 0.43 0.55 0.40 ----------------------------------------------------------------------