Email: 605069 Autolearn: 0 AvgScore: 2.58 AvgScanTime: 6.01 sec Spam: 178789 Autolearn: 0 AvgScore: 15.04 AvgScanTime: 8.48 sec Ham: 426280 Autolearn: 0 AvgScore: -2.65 AvgScanTime: 4.98 sec Time Spent Running SA: 1010.26 hours Time Spent Processing Spam: 420.93 hours Time Spent Processing Ham: 589.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172633 88.57 96.56 85.22 2 DKIM_SIGNED 153359 66.47 85.78 58.37 3 XM_DK_Pass 149105 64.97 83.40 57.24 4 RELAYCOUNTRY_US 143485 78.84 80.25 78.24 5 XM_B_Unicode 133522 69.72 74.68 67.64 6 DCC_CHECK 123620 40.29 69.14 28.20 7 XMListUnsubscribeExists 119224 45.06 66.68 35.99 8 XM_B_SpammyWords 108064 48.80 60.44 43.92 9 XM_DK_Undo_02 102516 22.87 57.34 8.42 10 DKIM_VALID 90210 49.70 50.46 49.38 11 XM_B_Unicode3 79534 43.04 44.48 42.43 12 BOTNET 77760 21.20 43.49 11.85 13 BAYES_50 75995 47.68 42.51 49.85 14 TR_XM_DKIM_Undo 68965 14.86 38.57 4.91 15 DKIM_VALID_AU 66617 36.65 37.26 36.39 16 LOC_TINY_FONT_1 63594 23.11 35.57 17.88 17 DKIM_INVALID 63149 16.77 35.32 9.00 18 HTML_FONT_LOW_CONTRAST 56937 24.93 31.85 22.03 19 DCC_CHECK_NEGATIVE 55094 59.66 30.82 71.76 20 XM_B_SpammyWords2 53688 19.49 30.03 15.08 21 MIME_HTML_ONLY 53463 21.99 29.90 18.67 22 FVGT_m_MULTI_ODD 51102 21.50 28.58 18.53 23 BAYES_99 48645 10.99 27.21 4.18 24 T_KAM_HTML_FONT_INVALID 45538 18.11 25.47 15.02 25 XMSubLong 43985 19.93 24.60 17.96 26 BAYES_999 39198 8.86 21.92 3.38 27 RELAYCOUNTRY_META 38353 8.39 21.45 2.92 28 DKIM_VALID_EF 35678 19.02 19.96 18.63 29 TR_DCC_Bayes_99 35313 7.02 19.75 1.68 30 T_TM2_M_HEADER_IN_MSG 35019 30.05 19.59 34.44 31 XM_Body_Dirty_Words 34995 12.43 19.57 9.44 32 RCVD_IN_MSPIKE_H2 30763 16.46 17.21 16.15 33 XM_Multi_Part_URI 29832 11.27 16.69 9.00 34 UNTRUSTED_Relay 25183 6.13 14.09 2.79 35 FSL_BULK_SIG 24124 6.95 13.49 4.21 36 XM_B_Unsub 22215 11.83 12.43 11.58 37 XM_UncommonTLD01 21153 5.89 11.83 3.40 38 RCVD_IN_MSPIKE_WL 21115 17.45 11.81 19.82 39 UNPARSEABLE_RELAY 20855 8.01 11.66 6.47 40 BOTNET_IPINHOSTNAME 20270 5.90 11.34 3.63 41 TR_XM_UnparsRelay 19957 6.74 11.16 4.89 42 HTML_IMAGE_RATIO_02 18639 6.12 10.43 4.31 43 LOTS_OF_MONEY 18384 11.11 10.28 11.45 44 MPART_ALT_DIFF 18133 8.12 10.14 7.27 45 XM_B_SpammyWords3 17226 5.56 9.63 3.86 46 XM_Evil_Numbers_Gen 16766 7.93 9.38 7.32 47 BAYES_80 15610 4.84 8.73 3.21 48 HTML_MIME_NO_HTML_TAG 15572 4.05 8.71 2.10 49 TR_XM_SpammyRelay 15291 3.29 8.55 1.09 50 XM_SendGrid 15186 6.09 8.49 5.08 51 TR_XM_SpammyWords2 15168 2.97 8.48 0.66 52 TR_XM_SpammyWords4 15130 6.54 8.46 5.74 53 XMSexyCombo_05 14690 4.09 8.22 2.36 54 LotsOfNums_01 14183 7.59 7.93 7.45 55 XM_SPF_SoftFail 13947 11.06 7.80 12.42 56 XMSubMetaSx_00 13842 4.77 7.74 3.52 57 TooManyTo_001 13336 8.23 7.46 8.56 58 BAYES_60 13261 7.32 7.42 7.29 59 HTML_SHORT_LINK_IMG_1 12845 2.13 7.18 0.02 60 RCVD_IN_MSPIKE_H3 12221 9.61 6.84 10.77 61 HDRS_MISSP 12145 2.03 6.79 0.03 62 HTML_IMAGE_ONLY_08 11975 2.05 6.70 0.10 63 TR_XM_INV_DKIM 10943 2.08 6.12 0.38 64 MIME_HTML_MOSTLY 10866 3.33 6.08 2.18 65 XM_B_Phish_Phrases 10646 3.93 5.95 3.09 66 SpammyFromTLD_02 10639 1.89 5.95 0.18 67 XM_H_Long_From01 10451 4.68 5.85 4.20 68 TR_XM_PhishingBody 10214 3.62 5.71 2.74 69 XM_UB50 10013 2.11 5.60 0.65 70 URI_NOVOWEL 9886 3.22 5.53 2.25 71 MIME_HTML_ONLY_MULTI 9423 5.14 5.27 5.09 72 BAYES_95 9323 2.93 5.21 1.97 73 TR_XM_MaxUnsub 9290 2.02 5.20 0.68 74 GOOG_STO_IMG_HTML 8834 1.46 4.94 0.00 75 BOTNET_NORDNS 8706 1.48 4.87 0.05 76 MIME_QP_LONG_LINE 8676 5.57 4.85 5.87 77 RCVD_IN_MSPIKE_H4 8599 6.92 4.81 7.81 78 TM2_M_VERY_LONG_WORD 8585 2.14 4.80 1.02 79 HTML_IMAGE_RATIO_04 8160 4.51 4.56 4.49 80 SpammyFromTLD_01 8129 1.77 4.55 0.61 81 RCVD_IN_MSPIKE_BL 7540 1.91 4.22 0.94 82 HTML_FONT_SIZE_LARGE 7463 1.29 4.17 0.08 83 XMSubNoVowel 7442 2.48 4.16 1.78 84 TR_XM_MSPIKECOMBO 7438 1.89 4.16 0.94 85 RCVD_IN_BL_SPAMCOP_NET 7272 1.55 4.07 0.49 86 XMStrtUSub 7244 4.22 4.05 4.29 87 XM_B_SpammyTLD 7071 2.32 3.95 1.63 88 TM2_M_URI_OPT_OUT 6843 5.24 3.83 5.83 89 TR_XM_COVIDMETA4 6507 1.43 3.64 0.51 90 XMSubGarbage 6249 1.19 3.50 0.23 91 RELAYCOUNTRY_CA 6237 1.47 3.49 0.62 92 XMURI4U 6146 1.03 3.44 0.02 93 FROM_SUSPICIOUS_NTLD 6137 1.05 3.43 0.05 94 FROM_SUSPICIOUS_NTLD_FP 6051 1.03 3.38 0.04 95 HTML_IMAGE_RATIO_06 6047 3.65 3.38 3.76 96 T_TVD_MIME_EPI 6007 1.01 3.36 0.02 97 T_REMOTE_IMAGE 5913 3.39 3.31 3.42 98 XMSexyCombo_01 5906 1.59 3.30 0.87 99 XMNumbers 5776 3.19 3.23 3.17 100 TR_XM_DK_SendGrid 5758 2.94 3.22 2.82 101 TR_XM_SpammyWords5 5713 1.74 3.20 1.13 102 KHOP_HELO_FCRDNS 5668 6.37 3.17 7.71 103 XM_B_Phish66 5483 2.01 3.07 1.57 104 XM_B_Investor 5390 1.84 3.01 1.34 105 XM_GoogleGroups 5383 1.67 3.01 1.11 106 T_XMDrugObfuBody_14 5245 2.21 2.93 1.91 107 SUSP_UTF8_WORD_SUBJ 5122 0.86 2.86 0.02 108 HTML_TAG_BALANCE_CENTER 5054 0.88 2.83 0.07 109 BAYES_40 4951 4.45 2.77 5.15 110 XM_DIRTYINTL 4806 0.96 2.69 0.23 111 TR_XM_SpammyWords3 4653 1.10 2.60 0.46 112 XM_OfRef6 4634 1.30 2.59 0.76 113 HTML_IMAGE_RATIO_08 4616 8.83 2.58 11.45 114 JH_SPAMMY_HEADERS 4604 0.77 2.58 0.01 115 XMGappySubj_01 4589 1.37 2.57 0.87 116 RELAYCOUNTRY_DE 4530 0.88 2.53 0.19 117 XMLngstWrd_00 4474 1.12 2.50 0.54 118 T_XMDrugObfuBody_08 4459 1.64 2.49 1.28 119 MAILING_LIST_MULTI 4428 2.24 2.48 2.15 120 XMLngstWrd_01 4417 1.07 2.47 0.49 121 BAYES_00 4403 15.60 2.46 21.12 122 XMLngstWrd_02 4289 1.00 2.40 0.41 123 PDS_OTHER_BAD_TLD 4270 0.81 2.39 0.14 124 TR_XM_SB_Phish 4264 2.89 2.38 3.11 125 RCVD_IN_IADB_LISTED 4179 3.89 2.34 4.54 126 XMSubPhish11 4157 2.86 2.33 3.08 127 RCVD_IN_MSPIKE_L3 4143 1.13 2.32 0.63 128 XM_BadFromFormat 4119 0.89 2.30 0.30 129 XMLngstWrd_03 4086 0.90 2.29 0.32 130 XMDiploma_00 4077 1.51 2.28 1.18 131 BAYES_20 4057 3.67 2.27 4.26 132 HTML_TITLE_SUBJ_DIFF 4015 0.76 2.25 0.14 133 XMLngstWrd_04 4002 0.85 2.24 0.27 134 RELAYCOUNTRY_FR 3990 0.79 2.23 0.19 135 XM_B_COVIDMETA 3979 1.01 2.23 0.50 136 RCVD_IN_VALIDITY_SAFE 3978 3.15 2.22 3.53 137 XM_DK_Undo_01 3972 1.54 2.22 1.26 138 UPPERCASE_75_100 3858 0.73 2.16 0.12 139 URIBL_DBL_SPAM 3827 0.64 2.14 0.01 140 T_TooManySym_01 3779 3.97 2.11 4.75 141 TVD_SPACE_RATIO 3716 1.24 2.08 0.89 142 URI_HEX 3701 1.43 2.07 1.16 143 TR_XM_SPAMCOP 3621 0.68 2.03 0.12 144 XMSubLongNoVowel 3529 0.60 1.97 0.02 145 LONG_IMG_URI 3518 0.61 1.97 0.04 146 XM_CamelCaseFrm001 3481 1.50 1.95 1.32 147 FROM_EXCESS_BASE64 3444 2.08 1.93 2.14 148 XMGappySubj_02 3407 0.63 1.91 0.10 149 RCVD_IN_IADB_SPF 3405 3.40 1.90 4.02 150 HTML_IMAGE_ONLY_04 3379 0.58 1.89 0.04 151 XM_B_Unsub2 3323 1.65 1.86 1.57 152 HTML_SHORT_CENTER 3286 0.55 1.84 0.00 153 SUBJ_ALL_CAPS 3265 3.47 1.83 4.15 154 RCVD_IN_VALIDITY_CERTIFIED 3228 2.71 1.81 3.09 155 XM_UB60 3215 0.56 1.80 0.05 156 ALL_TRUSTED 3124 13.28 1.75 18.12 157 XM_B_SpammyWords4 3055 0.72 1.71 0.31 158 RCVD_IN_IADB_DK 3048 2.95 1.70 3.47 159 RCVD_IN_IADB_SENDERID 3003 3.04 1.68 3.61 160 XM_H_MailChimp 2984 0.62 1.67 0.17 161 RCVD_IN_IADB_VOUCHED 2793 2.44 1.56 2.80 162 XM_UB99 2664 0.44 1.49 0.00 163 RELAYCOUNTRY_AU 2640 0.62 1.48 0.27 164 RELAYCOUNTRY_RU 2638 0.45 1.48 0.01 165 XM_UB80 2578 0.43 1.44 0.01 166 XMSexyCombo_04 2574 0.50 1.44 0.10 167 T_XMDrugObfuBody_00 2571 0.88 1.44 0.64 168 BAYES_05 2543 2.51 1.42 2.96 169 TR_XM_DK_Bayes 2532 5.17 1.42 6.74 170 RELAYCOUNTRY_PL 2517 0.43 1.41 0.02 171 RCVD_IN_VALIDITY_RPBL 2386 0.43 1.33 0.05 172 XMStockSpam_06 2373 0.85 1.33 0.65 173 T_XMHurry_00 2362 0.60 1.32 0.30 174 BODY_URI_ONLY 2358 0.40 1.32 0.01 175 USER_IN_DEF_DKIM_WL 2353 6.26 1.32 8.33 176 XM_H_TOP 2352 0.39 1.32 0.00 177 FROM_NTLD_LINKBAIT 2350 0.39 1.31 0.00 178 SHORT_IMG_SUSP_NTLD 2349 0.39 1.31 0.00 179 TR_XM_PHPDW 2311 0.62 1.29 0.34 180 TR_M_TOP_BAYES 2264 0.37 1.27 0.00 181 XM_PDF 2239 4.54 1.25 5.91 182 URI_TRY_3LD 2236 0.71 1.25 0.48 183 TR_MetaPhish_Combo_01 2180 0.77 1.22 0.59 184 RELAYCOUNTRY_CZ 2173 0.37 1.22 0.01 185 T_FILL_THIS_FORM_SHORT 2146 0.92 1.20 0.81 186 TR_XM_NoHeaderRelay 2144 0.46 1.20 0.15 187 XM_H_ConstantContact 2139 0.41 1.20 0.08 188 XM_H_Long_From02 2133 0.94 1.19 0.83 189 XM_ShortIntro_01 2125 0.75 1.19 0.57 190 TR_XM_PHPForged 2123 0.57 1.19 0.31 191 XM_UB999 2119 0.35 1.19 0.00 192 XM_URI_RBL 2101 0.41 1.18 0.09 193 TR_XM_FormFill2 2092 0.57 1.17 0.31 194 RCVD_IN_MSPIKE_L5 2078 0.36 1.16 0.03 195 XM_H_PHPOS 2076 0.56 1.16 0.30 196 XMGenDplmaNmb 2070 0.79 1.16 0.64 197 XMMoneyMeta_00 2068 0.66 1.16 0.45 198 RCVD_IN_PSBL 2049 0.40 1.15 0.09 199 MIXED_HREF_CASE 2004 0.33 1.12 0.00 200 MIXED_CENTER_CASE 2001 0.33 1.12 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 363274 88.57 96.56 85.22 2 RELAYCOUNTRY_US 333540 78.84 80.25 78.24 3 DCC_CHECK_NEGATIVE 305916 59.66 30.82 71.76 4 XM_B_Unicode 288315 69.72 74.68 67.64 5 DKIM_SIGNED 248838 66.47 85.78 58.37 6 XM_DK_Pass 244000 64.97 83.40 57.24 7 BAYES_50 212512 47.68 42.51 49.85 8 DKIM_VALID 210493 49.70 50.46 49.38 9 XM_B_SpammyWords 187238 48.80 60.44 43.92 10 XM_B_Unicode3 180869 43.04 44.48 42.43 11 DKIM_VALID_AU 155117 36.65 37.26 36.39 12 XMListUnsubscribeExists 153419 45.06 66.68 35.99 13 T_TM2_M_HEADER_IN_MSG 146821 30.05 19.59 34.44 14 DCC_CHECK 120191 40.29 69.14 28.20 15 HTML_FONT_LOW_CONTRAST 93914 24.93 31.85 22.03 16 BAYES_00 90012 15.60 2.46 21.12 17 RCVD_IN_MSPIKE_WL 84475 17.45 11.81 19.82 18 MIME_HTML_ONLY 79578 21.99 29.90 18.67 19 DKIM_VALID_EF 79426 19.02 19.96 18.63 20 FVGT_m_MULTI_ODD 78974 21.50 28.58 18.53 21 ALL_TRUSTED 77258 13.28 1.75 18.12 22 XMSubLong 76578 19.93 24.60 17.96 23 LOC_TINY_FONT_1 76222 23.11 35.57 17.88 24 IN_ZIMBRA_NJ_WHITELIST 70622 11.72 0.15 16.57 25 RCVD_IN_MSPIKE_H2 68836 16.46 17.21 16.15 26 XM_B_SpammyWords2 64268 19.49 30.03 15.08 27 T_KAM_HTML_FONT_INVALID 64036 18.11 25.47 15.02 28 XM_SPF_SoftFail 52961 11.06 7.80 12.42 29 BOTNET 50503 21.20 43.49 11.85 30 XM_B_Unsub 49373 11.83 12.43 11.58 31 LOTS_OF_MONEY 48828 11.11 10.28 11.45 32 HTML_IMAGE_RATIO_08 48795 8.83 2.58 11.45 33 HTML_FONT_FACE_BAD 48174 8.14 0.60 11.30 34 RCVD_IN_MSPIKE_H3 45896 9.61 6.84 10.77 35 XM_Body_Dirty_Words 40235 12.43 19.57 9.44 36 XM_Multi_Part_URI 38362 11.27 16.69 9.00 37 DKIM_INVALID 38345 16.77 35.32 9.00 38 TooManyTo_001 36481 8.23 7.46 8.56 39 XM_DK_Undo_02 35879 22.87 57.34 8.42 40 USER_IN_DEF_DKIM_WL 35522 6.26 1.32 8.33 41 RCVD_IN_MSPIKE_H4 33299 6.92 4.81 7.81 42 KHOP_HELO_FCRDNS 32870 6.37 3.17 7.71 43 XM_DKIMWhitelistDomains 31868 5.34 0.25 7.48 44 LotsOfNums_01 31752 7.59 7.93 7.45 45 XM_Evil_Numbers_Gen 31191 7.93 9.38 7.32 46 BAYES_60 31056 7.32 7.42 7.29 47 MPART_ALT_DIFF 30996 8.12 10.14 7.27 48 TR_XM_DK_Bayes 28731 5.17 1.42 6.74 49 UNPARSEABLE_RELAY 27592 8.01 11.66 6.47 50 XM_PDF 25202 4.54 1.25 5.91 51 MIME_QP_LONG_LINE 25002 5.57 4.85 5.87 52 TM2_M_URI_OPT_OUT 24866 5.24 3.83 5.83 53 FILL_THIS_FORM 24805 4.20 0.33 5.82 54 TR_XM_SpammyWords4 24452 6.54 8.46 5.74 55 TR_XM_DK_Bayes1 23277 4.02 0.57 5.46 56 XM_H_Trusted_IP 23195 3.83 0.00 5.44 57 BAYES_40 21964 4.45 2.77 5.15 58 MIME_HTML_ONLY_MULTI 21704 5.14 5.27 5.09 59 XM_SendGrid 21635 6.09 8.49 5.08 60 ANY_BOUNCE_MESSAGE 21351 3.72 0.63 5.01 61 BOUNCE_MESSAGE 21347 3.71 0.63 5.01 62 TR_XM_DKIM_Undo 20923 14.86 38.57 4.91 63 TR_XM_UnparsRelay 20852 6.74 11.16 4.89 64 T_TooManySym_01 20241 3.97 2.11 4.75 65 TR_XM_DK_Bayes2 20213 3.48 0.48 4.74 66 RCVD_IN_IADB_LISTED 19366 3.89 2.34 4.54 67 HTML_IMAGE_RATIO_04 19146 4.51 4.56 4.49 68 HTML_IMAGE_RATIO_02 18383 6.12 10.43 4.31 69 XMStrtUSub 18281 4.22 4.05 4.29 70 BAYES_20 18167 3.67 2.27 4.26 71 FSL_BULK_SIG 17942 6.95 13.49 4.21 72 XM_H_Long_From01 17892 4.68 5.85 4.20 73 BAYES_99 17829 10.99 27.21 4.18 74 SUBJ_ALL_CAPS 17709 3.47 1.83 4.15 75 RCVD_IN_IADB_SPF 17139 3.40 1.90 4.02 76 XM_B_SpammyWords3 16437 5.56 9.63 3.86 77 HTML_IMAGE_RATIO_06 16049 3.65 3.38 3.76 78 BOTNET_IPINHOSTNAME 15459 5.90 11.34 3.63 79 RCVD_IN_IADB_SENDERID 15390 3.04 1.68 3.61 80 RCVD_IN_VALIDITY_SAFE 15057 3.15 2.22 3.53 81 XMSubMetaSx_00 15010 4.77 7.74 3.52 82 RCVD_IN_IADB_DK 14806 2.95 1.70 3.47 83 T_REMOTE_IMAGE 14596 3.39 3.31 3.42 84 XM_UncommonTLD01 14483 5.89 11.83 3.40 85 HELO_NODOT 14461 2.48 0.32 3.39 86 HELO_NO_DOMAIN 14459 2.48 0.32 3.39 87 BAYES_999 14388 8.86 21.92 3.38 88 BAYES_80 13695 4.84 8.73 3.21 89 XMNumbers 13519 3.19 3.23 3.17 90 TR_XM_SB_Phish 13237 2.89 2.38 3.11 91 RCVD_IN_VALIDITY_CERTIFIED 13181 2.71 1.81 3.09 92 XM_B_Phish_Phrases 13161 3.93 5.95 3.09 93 XMSubPhish11 13149 2.86 2.33 3.08 94 BAYES_05 12632 2.51 1.42 2.96 95 RELAYCOUNTRY_META 12434 8.39 21.45 2.92 96 TR_XM_DK_SendGrid 12021 2.94 3.22 2.82 97 RCVD_IN_IADB_VOUCHED 11944 2.44 1.56 2.80 98 UNTRUSTED_Relay 11884 6.13 14.09 2.79 99 TR_XM_PhishingBody 11689 3.62 5.71 2.74 100 T_TooManySym_02 11199 2.06 0.70 2.63 101 XMSexyCombo_05 10044 4.09 8.22 2.36 102 URI_NOVOWEL 9575 3.22 5.53 2.25 103 MIME_HTML_MOSTLY 9296 3.33 6.08 2.18 104 MAILING_LIST_MULTI 9147 2.24 2.48 2.15 105 FROM_EXCESS_BASE64 9128 2.08 1.93 2.14 106 TooManyTo_002 9065 1.80 1.01 2.13 107 HTML_MIME_NO_HTML_TAG 8939 4.05 8.71 2.10 108 BAYES_95 8408 2.93 5.21 1.97 109 T_XMDrugObfuBody_14 8143 2.21 2.93 1.91 110 RCVD_IN_IADB_OPTIN 8053 1.62 0.98 1.89 111 XMSubNoVowel 7582 2.48 4.16 1.78 112 FSL_HELO_NON_FQDN_1 7363 1.24 0.08 1.73 113 XMBounce_01 7326 1.24 0.12 1.72 114 XMBounce_02 7275 1.22 0.06 1.71 115 TR_DCC_Bayes_99 7173 7.02 19.75 1.68 116 XM_E_Blogspot 7009 1.20 0.12 1.64 117 IN_HORDE_ADDRESS_BOOK 6999 1.22 0.21 1.64 118 XM_B_SpammyTLD 6960 2.32 3.95 1.63 119 INVALID_MSGID 6798 1.20 0.25 1.59 120 TVD_RCVD_IP 6718 1.22 0.36 1.58 121 XM_B_Phish66 6701 2.01 3.07 1.57 122 XM_B_Unsub2 6675 1.65 1.86 1.57 123 TR_Symld_Words 6643 1.42 1.09 1.56 124 MSGID_NOFQDN1 6235 1.07 0.13 1.46 125 TO_MALFORMED 6119 1.01 0.01 1.44 126 XM_B_Investor 5724 1.84 3.01 1.34 127 TooManyTo_003 5670 1.18 0.81 1.33 128 XM_CamelCaseFrm001 5608 1.50 1.95 1.32 129 T_XMDrugObfuBody_08 5465 1.64 2.49 1.28 130 SHORT_URI_2 5386 1.09 0.68 1.26 131 XM_DK_Undo_01 5351 1.54 2.22 1.26 132 RCVD_IN_MSPIKE_H5 5280 0.92 0.16 1.24 133 XMDiploma_00 5044 1.51 2.28 1.18 134 URI_HEX 4964 1.43 2.07 1.16 135 TR_XM_SpammyWords5 4833 1.74 3.20 1.13 136 XM_GoogleGroups 4749 1.67 3.01 1.11 137 TR_XM_SpammyRelay 4643 3.29 8.55 1.09 138 T_OBFU_PDF_ATTACH 4558 0.85 0.34 1.07 139 XMCapTrack 4396 0.88 0.53 1.03 140 TM2_M_VERY_LONG_WORD 4336 2.14 4.80 1.02 141 XMBSHREFv2 4191 0.80 0.38 0.98 142 RCVD_IN_MSPIKE_BL 4027 1.91 4.22 0.94 143 TooManyTo_004 4015 0.88 0.72 0.94 144 TR_XM_MSPIKECOMBO 3991 1.89 4.16 0.94 145 TVD_SPACE_RATIO 3776 1.24 2.08 0.89 146 XMGappySubj_01 3704 1.37 2.57 0.87 147 XMSexyCombo_01 3691 1.59 3.30 0.87 148 XM_H_Long_From02 3556 0.94 1.19 0.83 149 T_FILL_THIS_FORM_SHORT 3447 0.92 1.20 0.81 150 TooManyTo_005 3298 0.73 0.63 0.77 151 XM_OfRef6 3223 1.30 2.59 0.76 152 XMHTML_After_End 2964 0.79 1.01 0.70 153 RELAYCOUNTRY_GB 2932 0.77 0.95 0.69 154 TR_XM_MaxUnsub 2912 2.02 5.20 0.68 155 DKIM_ADSP_NXDOMAIN 2873 0.54 0.21 0.67 156 RCVD_IN_RP_SAFE 2846 0.60 0.42 0.67 157 HTTPS_HTTP_MISMATCH 2844 0.76 0.99 0.67 158 DKIM_ADSP_CUSTOM_MED 2806 0.78 1.07 0.66 159 TR_XM_SpammyWords2 2802 2.97 8.48 0.66 160 XMStockSpam_06 2788 0.85 1.33 0.65 161 T_TooManySym_03 2785 0.54 0.26 0.65 162 XM_UB50 2760 2.11 5.60 0.65 163 NO_DNS_FOR_FROM 2741 0.54 0.30 0.64 164 XMGenDplmaNmb 2732 0.79 1.16 0.64 165 T_XMDrugObfuBody_00 2729 0.88 1.44 0.64 166 RCVD_IN_MSPIKE_L3 2702 1.13 2.32 0.63 167 RELAYCOUNTRY_CA 2657 1.47 3.49 0.62 168 SpammyFromTLD_01 2606 1.77 4.55 0.61 169 XMBody_95 2581 0.48 0.16 0.61 170 RCVD_IN_RP_CERTIFIED 2556 0.51 0.30 0.60 171 TR_MetaPhish_Combo_01 2509 0.77 1.22 0.59 172 XMBdyGiftCard01 2437 0.62 0.72 0.57 173 XM_ShortIntro_01 2416 0.75 1.19 0.57 174 XMBrknScrpt_02 2387 0.67 0.93 0.56 175 TM2_M_BODY_EMPTY 2386 0.48 0.30 0.56 176 MSGID_FROM_MTA_HEADER 2362 0.48 0.30 0.55 177 XMLngstWrd_00 2295 1.12 2.50 0.54 178 TR_XM_COVIDMETA4 2153 1.43 3.64 0.51 179 HTML_IMAGE_ONLY_20 2116 0.43 0.28 0.50 180 XM_B_COVIDMETA 2116 1.01 2.23 0.50 181 RCVD_IN_BL_SPAMCOP_NET 2081 1.55 4.07 0.49 182 XMLngstWrd_01 2079 1.07 2.47 0.49 183 SHORT_HELO_AND_INLINE_IMAGE 2061 0.36 0.08 0.48 184 URI_TRY_3LD 2034 0.71 1.25 0.48 185 HTML_TAG_BALANCE_BODY 2031 0.60 0.89 0.48 186 FROM_GOV_DKIM_AU 2011 0.35 0.06 0.47 187 T_Symld_Words_02 1989 0.59 0.88 0.47 188 XM_H_PHPMailer 1985 0.51 0.62 0.47 189 TR_XM_SpammyWords3 1981 1.10 2.60 0.46 190 TR_MSPIKEBAYES00 1960 0.33 0.01 0.46 191 XMMoneyMeta_00 1929 0.66 1.16 0.45 192 XMNoVowels 1854 0.40 0.31 0.43 193 HTML_IMAGE_ONLY_32 1832 0.37 0.22 0.43 194 XMPhish30 1796 0.62 1.08 0.42 195 XM_B_COPY_HTML 1793 0.49 0.67 0.42 196 HTML_IMAGE_ONLY_28 1792 0.42 0.44 0.42 197 USER_IN_WELCOMELIST 1759 0.29 0.00 0.41 198 USER_IN_WHITELIST 1759 0.29 0.00 0.41 199 XMLngstWrd_02 1750 1.00 2.40 0.41 200 NML_ADSP_CUSTOM_MED 1736 0.54 0.84 0.41 ----------------------------------------------------------------------