Email: 597134 Autolearn: 0 AvgScore: 3.61 AvgScanTime: 11.20 sec Spam: 210351 Autolearn: 0 AvgScore: 15.00 AvgScanTime: 15.79 sec Ham: 386783 Autolearn: 0 AvgScore: -2.58 AvgScanTime: 8.70 sec Time Spent Running SA: 1857.79 hours Time Spent Processing Spam: 922.58 hours Time Spent Processing Ham: 935.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202935 82.83 96.47 75.41 2 DKIM_SIGNED 188291 66.10 89.51 53.37 3 XM_DK_Pass 183623 64.64 87.29 52.31 4 RELAYCOUNTRY_US 180727 79.21 85.92 75.57 5 XM_B_Unicode 168368 68.34 80.04 61.97 6 DCC_CHECK 151774 39.24 72.15 21.34 7 XMListUnsubscribeExists 150736 43.52 71.66 28.21 8 XM_DK_Undo_02 147424 32.24 70.08 11.66 9 BOTNET 137580 35.42 65.40 19.11 10 DKIM_INVALID 132432 34.20 62.96 18.55 11 XM_B_SpammyWords 131964 46.92 62.74 38.32 12 BAYES_50 103514 45.20 49.21 43.02 13 XM_B_Unicode3 100017 42.68 47.55 40.04 14 TR_XM_DKIM_Undo 99806 20.29 47.45 5.52 15 LOC_TINY_FONT_1 76302 21.91 36.27 14.10 16 HTML_FONT_LOW_CONTRAST 70506 23.44 33.52 17.95 17 XM_B_SpammyWords2 67838 19.39 32.25 12.39 18 FVGT_m_MULTI_ODD 64389 20.76 30.61 15.41 19 MIME_HTML_ONLY 60663 19.12 28.84 13.83 20 T_KAM_HTML_FONT_INVALID 59117 17.49 28.10 11.71 21 DCC_CHECK_NEGATIVE 58506 60.73 27.81 78.63 22 DKIM_VALID 55859 31.91 26.56 34.82 23 BAYES_99 49856 10.91 23.70 3.95 24 XMSubLong 48872 18.01 23.23 15.17 25 T_TM2_M_HEADER_IN_MSG 47073 32.74 22.38 38.38 26 DKIM_VALID_AU 41402 22.75 19.68 24.42 27 XM_Body_Dirty_Words 41197 11.57 19.58 7.20 28 BAYES_999 39754 8.75 18.90 3.23 29 TR_DCC_Bayes_99 35673 6.90 16.96 1.43 30 XM_Multi_Part_URI 34811 10.78 16.55 7.64 31 RELAYCOUNTRY_META 32634 7.04 15.51 2.44 32 XM_B_Unsub 26669 8.90 12.68 6.84 33 UNPARSEABLE_RELAY 25172 7.49 11.97 5.06 34 FSL_BULK_SIG 24766 5.93 11.77 2.76 35 LOTS_OF_MONEY 24439 13.35 11.62 14.30 36 TR_XM_UnparsRelay 23897 6.45 11.36 3.78 37 LotsOfNums_01 23686 7.53 11.26 5.50 38 XM_UncommonTLD01 23234 5.65 11.05 2.71 39 DKIM_VALID_EF 22873 11.90 10.87 12.46 40 TR_XM_INV_DKIM 22098 4.20 10.51 0.78 41 BOTNET_IPINHOSTNAME 21044 5.46 10.00 2.99 42 XM_Evil_Numbers_Gen 20247 6.87 9.63 5.36 43 HTML_IMAGE_RATIO_02 19747 5.53 9.39 3.43 44 UNTRUSTED_Relay 19447 8.13 9.25 7.53 45 TR_XM_SpammyWords4 19359 7.64 9.20 6.80 46 XM_B_SpammyWords3 19259 4.60 9.16 2.13 47 XM_SendGrid 18769 5.81 8.92 4.12 48 RCVD_IN_MSPIKE_H2 17841 11.05 8.48 12.44 49 XMSexyCombo_05 17670 4.21 8.40 1.93 50 BAYES_60 17510 7.21 8.32 6.60 51 TR_XM_SpammyRelay 17195 3.48 8.17 0.93 52 MPART_ALT_DIFF 17085 5.11 8.12 3.48 53 TR_XM_SpammyWords2 15550 2.97 7.39 0.57 54 BAYES_80 15007 4.24 7.13 2.66 55 TooManyTo_001 14377 6.72 6.83 6.66 56 TR_XM_PhishingBody 13764 3.76 6.54 2.24 57 RCVD_IN_MSPIKE_WL 13441 10.93 6.39 13.39 58 XMSubMetaSx_00 13212 3.73 6.28 2.34 59 XM_H_Long_From01 13022 4.64 6.19 3.80 60 TR_XM_COVIDMETA4 12752 2.66 6.06 0.82 61 MIME_QP_LONG_LINE 12728 4.33 6.05 3.40 62 XM_B_Phish_Phrases 10912 3.23 5.19 2.17 63 XM_H_MailChimp 10408 2.04 4.95 0.45 64 HTML_IMAGE_RATIO_04 10354 4.24 4.92 3.87 65 MIME_HTML_ONLY_MULTI 10258 3.30 4.88 2.44 66 SpammyFromTLD_02 10113 1.92 4.81 0.34 67 URI_NOVOWEL 9922 2.91 4.72 1.92 68 XM_UB50 9919 1.95 4.72 0.44 69 TR_XM_MaxUnsub 9794 2.17 4.66 0.81 70 MIME_HTML_MOSTLY 9175 2.45 4.36 1.41 71 HTML_MIME_NO_HTML_TAG 8862 2.79 4.21 2.02 72 XM_B_SpammyTLD 8832 2.66 4.20 1.83 73 TM2_M_VERY_LONG_WORD 8599 2.09 4.09 1.00 74 BAYES_95 8555 2.46 4.07 1.59 75 XMStrtUSub 8405 3.55 4.00 3.31 76 RCVD_IN_MSPIKE_H3 8179 6.00 3.89 7.15 77 XM_B_Phish66 8080 2.26 3.84 1.41 78 T_REMOTE_IMAGE 8017 3.14 3.81 2.78 79 HTML_IMAGE_RATIO_06 7737 2.83 3.68 2.37 80 KHOP_HELO_FCRDNS 7597 9.99 3.61 13.46 81 BOTNET_NORDNS 7414 1.27 3.52 0.05 82 SpammyFromTLD_01 7219 1.52 3.43 0.48 83 XM_SPF_SoftFail 6845 12.11 3.25 16.93 84 RELAYCOUNTRY_CA 6836 1.46 3.25 0.49 85 XM_B_Investor 6829 1.73 3.25 0.91 86 TM2_M_URI_OPT_OUT 6526 2.71 3.10 2.49 87 T_XMDrugObfuBody_14 6431 1.89 3.06 1.26 88 MAILING_LIST_MULTI 6418 2.28 3.05 1.87 89 TR_XM_SpammyWords5 6278 1.69 2.98 0.99 90 HTML_IMAGE_RATIO_08 5905 10.54 2.81 14.74 91 XMDiploma_00 5893 1.53 2.80 0.84 92 XMNumbers 5893 2.88 2.80 2.92 93 XM_GoogleGroups 5852 1.66 2.78 1.05 94 XM_H_ConstantContact 5676 1.18 2.70 0.35 95 T_XMDrugObfuBody_08 5650 1.56 2.69 0.95 96 PDS_OTHER_BAD_TLD 5618 1.01 2.67 0.11 97 XM_OfRef6 5614 1.36 2.67 0.65 98 FROM_EXCESS_BASE64 5562 1.88 2.64 1.47 99 RCVD_IN_BL_SPAMCOP_NET 5495 1.13 2.61 0.32 100 XM_CamelCaseFrm001 5430 1.63 2.58 1.11 101 BAYES_00 5095 20.23 2.42 29.91 102 BAYES_40 5052 3.80 2.40 4.56 103 FROM_SUSPICIOUS_NTLD 5034 0.87 2.39 0.03 104 XM_DK_Undo_01 4993 1.53 2.37 1.07 105 RCVD_IN_MSPIKE_H4 4942 4.29 2.35 5.35 106 FROM_SUSPICIOUS_NTLD_FP 4860 0.83 2.31 0.03 107 T_TooManySym_01 4828 3.82 2.30 4.66 108 XM_DIRTYINTL 4770 0.94 2.27 0.22 109 URI_HEX 4323 1.19 2.06 0.72 110 TR_XM_DK_Bayes 4217 7.43 2.00 10.38 111 SUBJ_ALL_CAPS 4175 4.14 1.98 5.31 112 XM_B_Unsub2 3972 1.37 1.89 1.08 113 TR_XM_SB_Phish 3937 1.60 1.87 1.45 114 TR_XM_DK_SendGrid 3876 1.79 1.84 1.76 115 XMLngstWrd_00 3858 0.99 1.83 0.53 116 RELAYCOUNTRY_FR 3855 0.74 1.83 0.15 117 BAYES_20 3803 3.33 1.81 4.16 118 XMLngstWrd_01 3788 0.95 1.80 0.49 119 RCVD_IN_MSPIKE_BL 3766 1.02 1.79 0.60 120 TR_XM_MSPIKECOMBO 3726 1.01 1.77 0.59 121 XMLngstWrd_02 3694 0.89 1.76 0.43 122 XMSubPhish11 3656 1.54 1.74 1.43 123 XMLngstWrd_03 3492 0.82 1.66 0.36 124 XM_H_TOP 3479 0.58 1.65 0.00 125 XM_B_COVIDMETA 3386 0.82 1.61 0.39 126 XMLngstWrd_04 3386 0.77 1.61 0.31 127 HTML_TITLE_SUBJ_DIFF 3317 0.68 1.58 0.20 128 XM_B_SpammyWords4 3259 0.69 1.55 0.23 129 T_XMDrugObfuBody_00 3255 0.82 1.55 0.42 130 XMSexyCombo_01 3219 0.76 1.53 0.34 131 UPPERCASE_75_100 3174 0.67 1.51 0.21 132 XMGenDplmaNmb 2999 0.81 1.43 0.48 133 TR_Symld_Words 2981 1.37 1.42 1.34 134 XM_UB99 2956 0.50 1.41 0.00 135 TR_Mismatch_TLD_02 2933 0.52 1.39 0.04 136 JH_SPAMMY_HEADERS 2910 0.49 1.38 0.00 137 TR_XM_NoHeaderRelay 2835 0.55 1.35 0.12 138 UPGRADE_MAILBOX 2799 0.65 1.33 0.27 139 XMBdyGiftCard01 2784 0.72 1.32 0.38 140 URIBL_DBL_SPAM 2777 0.47 1.32 0.00 141 TR_XM_SPAMCOP 2755 0.53 1.31 0.11 142 DATE_IN_PAST_03_06 2753 0.49 1.31 0.05 143 T_XMHurry_00 2744 1.53 1.30 1.65 144 XMStockSpam_06 2716 0.82 1.29 0.56 145 XM_PDF 2704 3.29 1.29 4.38 146 T_FILL_THIS_FORM_SHORT 2627 0.90 1.25 0.71 147 RCVD_IN_VALIDITY_SAFE 2538 1.92 1.21 2.31 148 XMPhish30 2536 0.66 1.21 0.37 149 XMBody_17 2528 0.56 1.20 0.22 150 TR_XM_COVIDMETA1 2520 0.50 1.20 0.12 151 XM_H_Long_From02 2487 1.08 1.18 1.03 152 TR_XM_PHPDW 2481 0.62 1.18 0.31 153 XM_UB60 2472 0.44 1.18 0.03 154 HTML_IMAGE_ONLY_08 2391 0.45 1.14 0.08 155 XM_UB999 2348 0.39 1.12 0.00 156 HTML_TAG_BALANCE_CENTER 2338 0.42 1.11 0.04 157 ALL_TRUSTED 2334 10.89 1.11 16.21 158 DKIM_ADSP_CUSTOM_MED 2329 0.69 1.11 0.46 159 XMHTML_After_End 2298 0.79 1.09 0.62 160 GOOG_STO_IMG_HTML 2262 0.38 1.08 0.00 161 RCVD_IN_IADB_LISTED 2261 2.10 1.07 2.65 162 TooManyTo_002 2242 1.58 1.07 1.86 163 RELAYCOUNTRY_AU 2225 0.52 1.06 0.23 164 RELAYCOUNTRY_GB 2216 0.77 1.05 0.62 165 TR_XM_PHPForged 2203 0.55 1.05 0.28 166 XMBrknScrpt_02 2196 0.66 1.04 0.45 167 TR_XM_FormFill2 2179 0.55 1.04 0.28 168 URI_TRY_3LD 2166 0.62 1.03 0.40 169 XM_H_PHPOS 2164 0.54 1.03 0.27 170 ALIBABA_IMG_NOT_RCVD_ALI 2083 0.35 0.99 0.00 171 HOSTED_IMG_DIRECT_MX 2066 0.35 0.98 0.00 172 RCVD_IN_VALIDITY_CERTIFIED 2052 1.68 0.98 2.06 173 EBAY_IMG_NOT_RCVD_EBAY 2051 0.34 0.98 0.00 174 XM_ProductURIs 2048 0.61 0.97 0.41 175 HOSTED_IMG_MULTI 2044 0.34 0.97 0.00 176 TM2_M_A_HREF_HREF 2016 0.48 0.96 0.21 177 HTTPS_HTTP_MISMATCH 2009 0.65 0.96 0.48 178 XMCapTrack 1978 0.91 0.94 0.89 179 RCVD_IN_PSBL 1966 0.37 0.93 0.07 180 TR_XM_SpammyWords3 1961 0.51 0.93 0.28 181 BAYES_05 1955 2.62 0.93 3.54 182 XM_Body_Dirty_Words_01 1945 0.40 0.92 0.11 183 RCVD_IN_IADB_SPF 1937 1.85 0.92 2.35 184 RCVD_IN_VALIDITY_RPBL 1862 0.32 0.89 0.01 185 TooManyTo_003 1860 1.11 0.88 1.23 186 DIET_1 1860 0.44 0.88 0.20 187 XMSubNoVowel 1856 1.01 0.88 1.07 188 MIXED_CENTER_CASE 1854 0.31 0.88 0.00 189 MIXED_HREF_CASE 1852 0.31 0.88 0.00 190 MIXED_IMG_CASE 1849 0.31 0.88 0.00 191 BODY_URI_ONLY 1848 0.32 0.88 0.01 192 MIXED_AREA_CASE 1846 0.31 0.88 0.00 193 MIXED_FONT_CASE 1844 0.31 0.88 0.00 194 XMBody_78 1836 0.43 0.87 0.19 195 TR_LOTS_OF_MONEY3 1825 0.38 0.87 0.12 196 MPART_ALT_DIFF_COUNT 1812 0.50 0.86 0.30 197 RCVD_IN_IADB_DK 1808 1.63 0.86 2.04 198 RCVD_IN_IADB_SENDERID 1756 1.67 0.83 2.12 199 XMMoneyMeta_00 1753 0.50 0.83 0.33 200 HTML_FONT_SIZE_HUGE 1742 0.32 0.83 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 304123 60.73 27.81 78.63 2 RELAYCOUNTRY_US 292287 79.21 85.92 75.57 3 HTML_MESSAGE 291655 82.83 96.47 75.41 4 XM_B_Unicode 239687 68.34 80.04 61.97 5 DKIM_SIGNED 206428 66.10 89.51 53.37 6 XM_DK_Pass 202344 64.64 87.29 52.31 7 BAYES_50 166406 45.20 49.21 43.02 8 XM_B_Unicode3 154866 42.68 47.55 40.04 9 T_TM2_M_HEADER_IN_MSG 148453 32.74 22.38 38.38 10 XM_B_SpammyWords 148200 46.92 62.74 38.32 11 DKIM_VALID 134664 31.91 26.56 34.82 12 BAYES_00 115703 20.23 2.42 29.91 13 XMListUnsubscribeExists 109111 43.52 71.66 28.21 14 DKIM_VALID_AU 94443 22.75 19.68 24.42 15 IN_ZIMBRA_NJ_WHITELIST 82925 13.96 0.21 21.44 16 DCC_CHECK 82531 39.24 72.15 21.34 17 BOTNET 73922 35.42 65.40 19.11 18 DKIM_INVALID 71764 34.20 62.96 18.55 19 HTML_FONT_LOW_CONTRAST 69439 23.44 33.52 17.95 20 XM_SPF_SoftFail 65475 12.11 3.25 16.93 21 ALL_TRUSTED 62705 10.89 1.11 16.21 22 HTML_FONT_FACE_BAD 61663 10.57 0.70 15.94 23 FVGT_m_MULTI_ODD 59601 20.76 30.61 15.41 24 XMSubLong 58678 18.01 23.23 15.17 25 HTML_IMAGE_RATIO_08 57019 10.54 2.81 14.74 26 LOTS_OF_MONEY 55291 13.35 11.62 14.30 27 LOC_TINY_FONT_1 54541 21.91 36.27 14.10 28 MIME_HTML_ONLY 53491 19.12 28.84 13.83 29 KHOP_HELO_FCRDNS 52067 9.99 3.61 13.46 30 RCVD_IN_MSPIKE_WL 51797 10.93 6.39 13.39 31 DKIM_VALID_EF 48180 11.90 10.87 12.46 32 RCVD_IN_MSPIKE_H2 48132 11.05 8.48 12.44 33 XM_B_SpammyWords2 47926 19.39 32.25 12.39 34 T_KAM_HTML_FONT_INVALID 45311 17.49 28.10 11.71 35 XM_DK_Undo_02 45116 32.24 70.08 11.66 36 TR_XM_DK_Bayes 40132 7.43 2.00 10.38 37 ANY_BOUNCE_MESSAGE 37053 6.41 0.59 9.58 38 BOUNCE_MESSAGE 37053 6.41 0.59 9.58 39 HELO_NODOT 32961 5.69 0.49 8.52 40 HELO_NO_DOMAIN 32959 5.69 0.49 8.52 41 FILL_THIS_FORM 32152 5.61 0.63 8.31 42 XM_Multi_Part_URI 29542 10.78 16.55 7.64 43 UNTRUSTED_Relay 29122 8.13 9.25 7.53 44 XM_Body_Dirty_Words 27863 11.57 19.58 7.20 45 RCVD_IN_MSPIKE_H3 27648 6.00 3.89 7.15 46 XM_B_Unsub 26463 8.90 12.68 6.84 47 XMBounce_01 26382 4.46 0.13 6.82 48 FSL_HELO_NON_FQDN_1 26378 4.50 0.25 6.82 49 XMBounce_02 26335 4.44 0.07 6.81 50 TR_XM_SpammyWords4 26283 7.64 9.20 6.80 51 TooManyTo_001 25755 6.72 6.83 6.66 52 XM_DKIMWhitelistDomains 25553 4.36 0.22 6.61 53 BAYES_60 25539 7.21 8.32 6.60 54 USER_IN_DEF_DKIM_WL 23608 4.16 0.59 6.10 55 T_HTML_ATTACH 22477 3.82 0.17 5.81 56 TR_XM_DK_Bayes1 21644 3.69 0.17 5.60 57 TR_XM_DKIM_Undo 21355 20.29 47.45 5.52 58 LotsOfNums_01 21263 7.53 11.26 5.50 59 XM_Evil_Numbers_Gen 20749 6.87 9.63 5.36 60 RCVD_IN_MSPIKE_H4 20679 4.29 2.35 5.35 61 SUBJ_ALL_CAPS 20528 4.14 1.98 5.31 62 UNPARSEABLE_RELAY 19552 7.49 11.97 5.06 63 T_TooManySym_01 18008 3.82 2.30 4.66 64 BAYES_40 17644 3.80 2.40 4.56 65 XM_PDF 16954 3.29 1.29 4.38 66 BAYES_20 16091 3.33 1.81 4.16 67 XM_SendGrid 15936 5.81 8.92 4.12 68 BAYES_99 15267 10.91 23.70 3.95 69 HTML_IMAGE_RATIO_04 14980 4.24 4.92 3.87 70 XM_H_Long_From01 14695 4.64 6.19 3.80 71 TR_XM_UnparsRelay 14638 6.45 11.36 3.78 72 BAYES_05 13703 2.62 0.93 3.54 73 DKIM_ADSP_NXDOMAIN 13659 2.33 0.11 3.53 74 NO_DNS_FOR_FROM 13544 2.32 0.14 3.50 75 MPART_ALT_DIFF 13441 5.11 8.12 3.48 76 HTML_IMAGE_RATIO_02 13262 5.53 9.39 3.43 77 MIME_QP_LONG_LINE 13148 4.33 6.05 3.40 78 XMStrtUSub 12807 3.55 4.00 3.31 79 BAYES_999 12501 8.75 18.90 3.23 80 BOTNET_IPINHOSTNAME 11574 5.46 10.00 2.99 81 XM_H_Trusted_IP 11564 1.94 0.00 2.99 82 XMNumbers 11287 2.88 2.80 2.92 83 T_TooManySym_02 10970 2.07 0.66 2.84 84 T_REMOTE_IMAGE 10750 3.14 3.81 2.78 85 FSL_BULK_SIG 10666 5.93 11.77 2.76 86 TR_XM_DK_Bayes2 10601 1.83 0.14 2.74 87 XM_UncommonTLD01 10486 5.65 11.05 2.71 88 BAYES_80 10290 4.24 7.13 2.66 89 RCVD_IN_IADB_LISTED 10266 2.10 1.07 2.65 90 TM2_M_URI_OPT_OUT 9632 2.71 3.10 2.49 91 MIME_HTML_ONLY_MULTI 9426 3.30 4.88 2.44 92 RELAYCOUNTRY_META 9420 7.04 15.51 2.44 93 HTML_IMAGE_RATIO_06 9185 2.83 3.68 2.37 94 RCVD_IN_IADB_SPF 9085 1.85 0.92 2.35 95 XMSubMetaSx_00 9049 3.73 6.28 2.34 96 RCVD_IN_VALIDITY_SAFE 8928 1.92 1.21 2.31 97 TR_XM_PhishingBody 8659 3.76 6.54 2.24 98 XM_B_Phish_Phrases 8381 3.23 5.19 2.17 99 XM_B_SpammyWords3 8238 4.60 9.16 2.13 100 RCVD_IN_IADB_SENDERID 8199 1.67 0.83 2.12 101 RCVD_IN_VALIDITY_CERTIFIED 7952 1.68 0.98 2.06 102 RCVD_IN_IADB_DK 7904 1.63 0.86 2.04 103 HTML_MIME_NO_HTML_TAG 7817 2.79 4.21 2.02 104 XMSexyCombo_05 7459 4.21 8.40 1.93 105 URI_NOVOWEL 7436 2.91 4.72 1.92 106 MAILING_LIST_MULTI 7219 2.28 3.05 1.87 107 TooManyTo_002 7192 1.58 1.07 1.86 108 XM_B_SpammyTLD 7079 2.66 4.20 1.83 109 TR_XM_DK_SendGrid 6800 1.79 1.84 1.76 110 XM_E_Blogspot 6685 1.17 0.15 1.73 111 INVALID_MSGID 6591 1.16 0.17 1.70 112 T_XMHurry_00 6383 1.53 1.30 1.65 113 RCVD_IN_IADB_VOUCHED 6366 1.27 0.57 1.65 114 TVD_RCVD_IP 6326 1.14 0.24 1.64 115 IN_HORDE_ADDRESS_BOOK 6273 1.14 0.25 1.62 116 MSGID_NOFQDN1 6140 1.05 0.07 1.59 117 BAYES_95 6134 2.46 4.07 1.59 118 TO_MALFORMED 6006 1.01 0.01 1.55 119 FROM_EXCESS_BASE64 5675 1.88 2.64 1.47 120 TR_XM_SB_Phish 5614 1.60 1.87 1.45 121 XMSubPhish11 5527 1.54 1.74 1.43 122 TR_DCC_Bayes_99 5514 6.90 16.96 1.43 123 MIME_HTML_MOSTLY 5447 2.45 4.36 1.41 124 XM_B_Phish66 5439 2.26 3.84 1.41 125 TR_Symld_Words 5170 1.37 1.42 1.34 126 T_XMDrugObfuBody_14 4866 1.89 3.06 1.26 127 TooManyTo_003 4759 1.11 0.88 1.23 128 XMGappySubj_01 4519 0.86 0.28 1.17 129 XM_CamelCaseFrm001 4295 1.63 2.58 1.11 130 RCVD_IN_IADB_OPTIN 4226 0.83 0.33 1.09 131 XM_B_Unsub2 4183 1.37 1.89 1.08 132 XM_DK_Undo_01 4149 1.53 2.37 1.07 133 XMSubNoVowel 4146 1.01 0.88 1.07 134 XM_GoogleGroups 4049 1.66 2.78 1.05 135 XM_H_Long_From02 3971 1.08 1.18 1.03 136 TM2_M_VERY_LONG_WORD 3856 2.09 4.09 1.00 137 TR_XM_SpammyWords5 3827 1.69 2.98 0.99 138 T_XMDrugObfuBody_08 3688 1.56 2.69 0.95 139 TVD_SPACE_RATIO 3593 0.62 0.06 0.93 140 TR_XM_SpammyRelay 3578 3.48 8.17 0.93 141 XMBSHREFv2 3535 0.73 0.38 0.91 142 XM_B_Investor 3510 1.73 3.25 0.91 143 RCVD_IN_MSPIKE_H5 3470 0.63 0.15 0.90 144 XMCapTrack 3450 0.91 0.94 0.89 145 TooManyTo_004 3364 0.83 0.76 0.87 146 XMDiploma_00 3242 1.53 2.80 0.84 147 TR_XM_COVIDMETA4 3160 2.66 6.06 0.82 148 TR_XM_MaxUnsub 3138 2.17 4.66 0.81 149 TR_MetaPhish_Combo_01 3052 0.78 0.76 0.79 150 TR_XM_INV_DKIM 3005 4.20 10.51 0.78 151 TooManyTo_005 2780 0.70 0.68 0.72 152 URI_HEX 2774 1.19 2.06 0.72 153 T_FILL_THIS_FORM_SHORT 2728 0.90 1.25 0.71 154 T_TooManySym_03 2715 0.53 0.22 0.70 155 XMBody_95 2631 0.53 0.25 0.68 156 XM_OfRef6 2527 1.36 2.67 0.65 157 XM_D_tchamptons_WL 2434 0.47 0.18 0.63 158 XMHTML_After_End 2391 0.79 1.09 0.62 159 RELAYCOUNTRY_GB 2379 0.77 1.05 0.62 160 RCVD_IN_MSPIKE_BL 2319 1.02 1.79 0.60 161 TR_XM_MSPIKECOMBO 2300 1.01 1.77 0.59 162 T_OBFU_PDF_ATTACH 2275 0.48 0.28 0.59 163 HTML_IMAGE_ONLY_20 2261 0.45 0.21 0.58 164 TR_XM_SpammyWords2 2213 2.97 7.39 0.57 165 HTML_TAG_BALANCE_BODY 2200 0.64 0.77 0.57 166 XMStockSpam_06 2155 0.82 1.29 0.56 167 FROM_GOV_SPOOF 2115 0.52 0.48 0.55 168 XM_ShortIntro_01 2089 0.48 0.37 0.54 169 XMLngstWrd_00 2063 0.99 1.83 0.53 170 XM_H_PHPMailer 1939 0.60 0.78 0.50 171 SHORT_HELO_AND_INLINE_IMAGE 1933 0.36 0.11 0.50 172 RELAYCOUNTRY_CA 1900 1.46 3.25 0.49 173 XMLngstWrd_01 1880 0.95 1.80 0.49 174 HTTPS_HTTP_MISMATCH 1875 0.65 0.96 0.48 175 XMGenDplmaNmb 1840 0.81 1.43 0.48 176 SpammyFromTLD_01 1839 1.52 3.43 0.48 177 XMNoVowels 1808 0.48 0.51 0.47 178 DKIM_ADSP_CUSTOM_MED 1765 0.69 1.11 0.46 179 XM_H_MailChimp 1748 2.04 4.95 0.45 180 XMBrknScrpt_02 1728 0.66 1.04 0.45 181 XM_UB50 1708 1.95 4.72 0.44 182 XMLngstWrd_02 1650 0.89 1.76 0.43 183 T_XMDrugObfuBody_00 1631 0.82 1.55 0.42 184 USER_IN_WELCOMELIST 1626 0.27 0.00 0.42 185 USER_IN_WHITELIST 1626 0.27 0.00 0.42 186 XM_ProductURIs 1598 0.61 0.97 0.41 187 URI_TRY_3LD 1548 0.62 1.03 0.40 188 XM_B_COVIDMETA 1498 0.82 1.61 0.39 189 XMBdyGiftCard01 1488 0.72 1.32 0.38 190 XM_B_COPY_HTML 1467 0.47 0.62 0.38 191 XMPhish30 1434 0.66 1.21 0.37 192 HTML_IMAGE_ONLY_32 1416 0.33 0.25 0.37 193 XMLngstWrd_03 1386 0.82 1.66 0.36 194 XM_H_ConstantContact 1371 1.18 2.70 0.35 195 TM2_M_BODY_EMPTY 1370 0.30 0.20 0.35 196 TVD_SPACE_RATIO_MINFP 1364 0.25 0.06 0.35 197 SpammyFromTLD_02 1330 1.92 4.81 0.34 198 TO_NO_BRKTS_HTML_ONLY 1329 0.30 0.21 0.34 199 XMSexyCombo_01 1314 0.76 1.53 0.34 200 XMHTMLBadTable_001 1300 0.49 0.78 0.34 ----------------------------------------------------------------------