Email: 258920 Autolearn: 0 AvgScore: 5.34 AvgScanTime: 10.90 sec Spam: 115805 Autolearn: 0 AvgScore: 15.82 AvgScanTime: 15.72 sec Ham: 143115 Autolearn: 0 AvgScore: -3.14 AvgScanTime: 7.00 sec Time Spent Running SA: 784.00 hours Time Spent Processing Spam: 505.58 hours Time Spent Processing Ham: 278.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108563 83.95 93.75 76.03 2 DKIM_SIGNED 103013 77.09 88.95 67.49 3 XM_DK_Pass 100309 75.47 86.62 66.45 4 RELAYCOUNTRY_US 97736 79.02 84.40 74.67 5 XM_B_Unicode 92141 70.60 79.57 63.35 6 XMListUnsubscribeExists 83622 56.21 72.21 43.26 7 XM_DK_Undo_02 82497 41.61 71.24 17.64 8 DCC_CHECK 78273 46.95 67.59 30.24 9 BOTNET 76868 38.22 66.38 15.43 10 DKIM_INVALID 73510 39.48 63.48 20.06 11 XM_B_SpammyWords 71873 48.87 62.06 38.19 12 TR_XM_DKIM_Undo 57635 27.21 49.77 8.96 13 XM_B_Unicode3 57113 44.08 49.32 39.84 14 BAYES_50 52742 49.66 45.54 53.00 15 LOC_TINY_FONT_1 42896 30.23 37.04 24.71 16 HTML_FONT_LOW_CONTRAST 39019 29.93 33.69 26.89 17 XM_B_SpammyWords2 37943 23.57 32.76 16.13 18 FVGT_m_MULTI_ODD 37935 27.49 32.76 23.23 19 DCC_CHECK_NEGATIVE 37507 53.03 32.39 69.73 20 MIME_HTML_ONLY 37092 26.37 32.03 21.80 21 BAYES_99 32218 16.16 27.82 6.73 22 DKIM_VALID 29503 37.62 25.48 47.44 23 T_KAM_HTML_FONT_INVALID 28386 19.53 24.51 15.50 24 XMSubLong 27349 23.31 23.62 23.07 25 BAYES_999 25693 12.93 22.19 5.45 26 XM_Body_Dirty_Words 25261 16.10 21.81 11.47 27 DKIM_VALID_AU 22654 30.67 19.56 39.66 28 TR_DCC_Bayes_99 22217 9.95 19.18 2.48 29 RELAYCOUNTRY_META 20948 9.85 18.09 3.19 30 T_TM2_M_HEADER_IN_MSG 20808 21.44 17.97 24.25 31 XM_Multi_Part_URI 19637 14.62 16.96 12.73 32 UNPARSEABLE_RELAY 16218 10.21 14.00 7.14 33 TR_XM_UnparsRelay 15509 8.93 13.39 5.32 34 XM_B_Unsub 14794 11.53 12.77 10.53 35 TR_XM_INV_DKIM 14017 6.02 12.10 1.10 36 BOTNET_IPINHOSTNAME 13019 8.38 11.24 6.06 37 XM_B_SpammyWords3 12818 7.33 11.07 4.30 38 HTML_IMAGE_RATIO_02 12494 8.58 10.79 6.80 39 MPART_ALT_DIFF 12221 7.86 10.55 5.68 40 LOTS_OF_MONEY 11891 8.42 10.27 6.92 41 XM_Evil_Numbers_Gen 11579 8.50 10.00 7.28 42 XMSexyCombo_05 11527 6.72 9.95 4.10 43 FSL_BULK_SIG 11488 6.10 9.92 3.01 44 TR_XM_SpammyWords2 11377 5.30 9.82 1.64 45 UNTRUSTED_Relay 10918 4.86 9.43 1.17 46 DKIM_VALID_EF 10804 14.20 9.33 18.14 47 XM_UncommonTLD01 10131 6.90 8.75 5.41 48 XM_SendGrid 10069 6.81 8.69 5.29 49 TR_XM_SpammyWords4 9727 6.29 8.40 4.59 50 TR_XM_SpammyRelay 9572 4.30 8.27 1.09 51 TM2_M_VERY_LONG_WORD 9504 4.75 8.21 1.95 52 LotsOfNums_01 9330 7.34 8.06 6.76 53 RCVD_IN_MSPIKE_H2 9297 10.03 8.03 11.65 54 BAYES_60 9131 9.96 7.88 11.64 55 RCVD_IN_MSPIKE_WL 8567 15.39 7.40 21.86 56 MIME_HTML_ONLY_MULTI 8386 5.50 7.24 4.08 57 BAYES_80 8179 5.43 7.06 4.11 58 XMSubMetaSx_00 7732 5.54 6.68 4.62 59 TooManyTo_001 7291 6.68 6.30 7.00 60 XM_H_Long_From01 6531 4.92 5.64 4.35 61 TR_XM_PhishingBody 6290 3.91 5.43 2.69 62 XMStrtUSub 6264 5.47 5.41 5.52 63 XM_GoogleGroups 6207 3.50 5.36 1.99 64 RELAYCOUNTRY_CA 5836 2.73 5.04 0.87 65 HTML_MIME_NO_HTML_TAG 5828 3.62 5.03 2.48 66 TR_XM_MaxUnsub 5748 2.76 4.96 0.98 67 XM_B_Phish_Phrases 5720 3.77 4.94 2.82 68 TR_XM_COVIDMETA4 5708 2.78 4.93 1.04 69 RCVD_IN_MSPIKE_H3 5686 8.50 4.91 11.40 70 HTML_IMAGE_RATIO_04 5595 5.32 4.83 5.72 71 XMLngstWrd_00 5427 2.86 4.69 1.39 72 XMLngstWrd_01 5379 2.81 4.64 1.33 73 XMLngstWrd_02 5336 2.73 4.61 1.22 74 XMLngstWrd_03 5318 2.66 4.59 1.09 75 XMLngstWrd_04 5274 2.60 4.55 1.03 76 BAYES_95 5066 3.44 4.37 2.68 77 MIME_HTML_MOSTLY 4992 3.09 4.31 2.10 78 UPPERCASE_75_100 4795 2.26 4.14 0.74 79 HTML_TITLE_SUBJ_DIFF 4773 2.23 4.12 0.70 80 RCVD_IN_BL_SPAMCOP_NET 4607 2.16 3.98 0.69 81 BOTNET_NORDNS 4545 1.79 3.92 0.06 82 HTML_IMAGE_RATIO_06 4494 3.99 3.88 4.08 83 XM_UB50 4275 2.04 3.69 0.71 84 FROM_EXCESS_BASE64 4245 3.27 3.67 2.96 85 SpammyFromTLD_01 4158 1.80 3.59 0.36 86 XM_SPF_SoftFail 3864 2.91 3.34 2.57 87 XM_OfRef6 3781 2.12 3.26 1.20 88 URI_NOVOWEL 3749 2.56 3.24 2.00 89 XM_CamelCaseFrm001 3554 2.24 3.07 1.57 90 XM_B_SpammyTLD 3553 2.55 3.07 2.12 91 MIME_QP_LONG_LINE 3432 2.94 2.96 2.92 92 XMNumbers 3385 4.57 2.92 5.90 93 T_REMOTE_IMAGE 3347 3.14 2.89 3.34 94 HTML_IMAGE_RATIO_08 3341 2.58 2.89 2.34 95 T_XMDrugObfuBody_14 3325 2.36 2.87 1.95 96 BAYES_00 3151 8.40 2.72 12.99 97 SpammyFromTLD_02 3137 1.30 2.71 0.16 98 T_Symld_Words_02 3090 1.41 2.67 0.39 99 KHOP_HELO_FCRDNS 3068 2.81 2.65 2.94 100 TM2_M_URI_OPT_OUT 3059 3.59 2.64 4.36 101 RCVD_IN_MSPIKE_BL 3056 1.67 2.64 0.88 102 TR_XM_MSPIKECOMBO 3034 1.66 2.62 0.88 103 XMSlimDrugH 3024 1.33 2.61 0.29 104 XM_B_Investor 2959 1.84 2.56 1.26 105 XMSexyCombo_01 2954 1.88 2.55 1.33 106 XM_DIRTYINTL 2938 1.27 2.54 0.25 107 XM_UB99 2891 1.12 2.50 0.01 108 XM_H_MailChimp 2867 1.29 2.48 0.33 109 TR_XM_SpammyWords5 2752 1.72 2.38 1.19 110 RCVD_IN_MSPIKE_H4 2698 6.01 2.33 9.00 111 T_TooManySym_01 2676 6.56 2.31 10.00 112 DRUGS_ERECTILE 2667 1.04 2.30 0.02 113 XMSubMetaD_00 2659 1.06 2.30 0.06 114 RCVD_IN_VALIDITY_RPBL 2649 1.04 2.29 0.02 115 TR_XM_DK_Bayes 2626 5.06 2.27 7.31 116 T_FILL_THIS_FORM_SHORT 2594 1.24 2.24 0.42 117 XM_DK_Undo_01 2577 1.75 2.23 1.37 118 XMDiploma_00 2562 1.69 2.21 1.26 119 XMStockSpam_06 2521 1.73 2.18 1.37 120 TR_XM_PHPDW 2511 1.21 2.17 0.43 121 XMBdyGiftCard01 2507 1.57 2.16 1.08 122 MAILING_LIST_MULTI 2484 2.13 2.14 2.13 123 RCVD_IN_VALIDITY_SAFE 2448 3.97 2.11 5.47 124 T_XMDrugObfuBody_08 2434 1.74 2.10 1.45 125 UPGRADE_MAILBOX 2419 1.28 2.09 0.62 126 BAYES_40 2412 3.17 2.08 4.05 127 XMPhish30 2403 1.48 2.08 1.00 128 XM_UB999 2393 0.93 2.07 0.00 129 XM_B_Phish66 2385 1.55 2.06 1.14 130 XMSubMetaD_03 2377 0.93 2.05 0.01 131 XMSubMetaD_01 2359 0.92 2.04 0.01 132 SUBJECT_DRUG_GAP_C 2357 0.91 2.04 0.01 133 SERGIO_SUBJECT_VIAGRA01 2357 0.91 2.04 0.01 134 XMSubMetaD_02 2356 0.91 2.03 0.01 135 SUBJECT_DRUG_GAP_L 2355 0.91 2.03 0.01 136 XMSubMetaD_04 2353 0.91 2.03 0.01 137 XMSubMetaD_05 2352 0.91 2.03 0.01 138 RCVD_IN_PSBL 2332 0.94 2.01 0.07 139 PDS_FROM_2_EMAILS 2280 0.89 1.97 0.01 140 FROM_2_EMAILS_SHORT 2279 0.89 1.97 0.01 141 LONG_JUNK_URI 2218 0.88 1.92 0.03 142 TR_XM_PHPForged 2189 1.05 1.89 0.38 143 XM_Body_Dirty_Words_01 2188 1.40 1.89 1.00 144 TR_XM_FormFill2 2183 1.05 1.89 0.37 145 URI_HEX 2169 1.39 1.87 1.00 146 XM_H_PHPOS 2166 1.04 1.87 0.36 147 PDS_OTHER_BAD_TLD 2096 0.95 1.81 0.25 148 XM_H_ConstantContact 2080 0.94 1.80 0.25 149 BODY_URI_ONLY 2038 0.79 1.76 0.01 150 RCVD_IN_VALIDITY_CERTIFIED 2021 3.54 1.75 5.00 151 RCVD_IN_MSPIKE_L5 1953 0.80 1.69 0.08 152 TR_XM_DK_SendGrid 1933 2.10 1.67 2.45 153 TR_Symld_Words 1927 1.70 1.66 1.73 154 NO_FM_NAME_IP_HOSTN 1866 0.73 1.61 0.01 155 XM_B_Unsub2 1847 1.34 1.59 1.14 156 T_PDS_TO_EQ_FROM_NAME 1815 0.71 1.57 0.01 157 BAYES_20 1799 2.26 1.55 2.84 158 XM_ProductURIs 1774 1.07 1.53 0.69 159 TR_XM_FormFill 1728 0.67 1.49 0.01 160 XMBody_17 1726 0.90 1.49 0.43 161 XM_B_SpammyWords4 1652 0.83 1.43 0.35 162 XM_B_COVIDMETA 1640 0.94 1.42 0.55 163 XMBrknScrpt_02 1612 0.89 1.39 0.48 164 RELAYCOUNTRY_FR 1570 0.70 1.36 0.18 165 TR_XM_SB_Phish 1533 1.54 1.32 1.71 166 TR_XM_SPAMCOP 1530 0.66 1.32 0.13 167 TR_MetaPhish_Combo_01 1497 1.15 1.29 1.03 168 XMSubMetaSxObfu_03 1455 1.19 1.26 1.14 169 T_XMDrugObfuBody_00 1448 0.96 1.25 0.73 170 XMSexyCombo_04 1443 1.05 1.25 0.90 171 HTML_TAG_BALANCE_BODY 1430 0.86 1.23 0.56 172 BOUNCE_MESSAGE 1427 3.52 1.23 5.37 173 ANY_BOUNCE_MESSAGE 1427 3.52 1.23 5.37 174 SUBJ_ALL_CAPS 1424 1.13 1.23 1.06 175 XMSubMetaI_00 1422 0.86 1.23 0.55 176 XMSubPhish11 1408 1.48 1.22 1.69 177 XM_DKIMWhitelistDomains 1406 7.99 1.21 13.46 178 T_XMHurry_00 1368 0.85 1.18 0.59 179 TR_XM_NoHeaderRelay 1345 0.60 1.16 0.15 180 DKIM_ADSP_CUSTOM_MED 1329 0.88 1.15 0.66 181 USER_IN_DEF_DKIM_WL 1315 7.83 1.14 13.24 182 TR_XM_SpoofStaff 1312 0.63 1.13 0.22 183 XMSpoofStaff2 1304 0.62 1.13 0.21 184 RDNS_DYNAMIC 1301 0.79 1.12 0.53 185 RELAYCOUNTRY_AU 1288 0.60 1.11 0.18 186 XM_H_Long_From02 1251 1.04 1.08 1.00 187 XM_B_COPY_HTML 1248 1.06 1.08 1.04 188 DIET_1 1241 0.67 1.07 0.35 189 DATE_IN_PAST_03_06 1214 0.52 1.05 0.08 190 TM2_M_A_HREF_HREF 1203 0.62 1.04 0.28 191 MIMEOLE_DIRECT_TO_MX 1203 0.47 1.04 0.01 192 XM_H_PHPMailer 1187 0.83 1.02 0.68 193 URI_TRY_3LD 1182 0.78 1.02 0.58 194 TR_XM_SpoofStaff2 1179 0.46 1.02 0.00 195 XM_UB60 1174 0.48 1.01 0.04 196 XMHTMLBadTable_001 1171 0.71 1.01 0.46 197 DATE_IN_FUTURE_06_12 1144 0.45 0.99 0.01 198 XM_H_Undi_Recip 1142 0.52 0.99 0.14 199 URIBL_SBL_A 1138 0.45 0.98 0.03 200 XM_JunkDunk 1134 0.44 0.98 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108807 83.95 93.75 76.03 2 RELAYCOUNTRY_US 106859 79.02 84.40 74.67 3 DCC_CHECK_NEGATIVE 99793 53.03 32.39 69.73 4 DKIM_SIGNED 96593 77.09 88.95 67.49 5 XM_DK_Pass 95095 75.47 86.62 66.45 6 XM_B_Unicode 90662 70.60 79.57 63.35 7 BAYES_50 75845 49.66 45.54 53.00 8 DKIM_VALID 67890 37.62 25.48 47.44 9 XMListUnsubscribeExists 61917 56.21 72.21 43.26 10 XM_B_Unicode3 57016 44.08 49.32 39.84 11 DKIM_VALID_AU 56762 30.67 19.56 39.66 12 XM_B_SpammyWords 54650 48.87 62.06 38.19 13 DCC_CHECK 43278 46.95 67.59 30.24 14 HTML_FONT_LOW_CONTRAST 38478 29.93 33.69 26.89 15 LOC_TINY_FONT_1 35365 30.23 37.04 24.71 16 T_TM2_M_HEADER_IN_MSG 34709 21.44 17.97 24.25 17 ALL_TRUSTED 33259 13.27 0.95 23.24 18 FVGT_m_MULTI_ODD 33239 27.49 32.76 23.23 19 XMSubLong 33013 23.31 23.62 23.07 20 RCVD_IN_MSPIKE_WL 31285 15.39 7.40 21.86 21 MIME_HTML_ONLY 31196 26.37 32.03 21.80 22 DKIM_INVALID 28703 39.48 63.48 20.06 23 DKIM_VALID_EF 25957 14.20 9.33 18.14 24 XM_DK_Undo_02 25240 41.61 71.24 17.64 25 XM_B_SpammyWords2 23085 23.57 32.76 16.13 26 T_KAM_HTML_FONT_INVALID 22188 19.53 24.51 15.50 27 BOTNET 22082 38.22 66.38 15.43 28 XM_DKIMWhitelistDomains 19270 7.99 1.21 13.46 29 USER_IN_DEF_DKIM_WL 18955 7.83 1.14 13.24 30 BAYES_00 18594 8.40 2.72 12.99 31 XM_Multi_Part_URI 18217 14.62 16.96 12.73 32 RCVD_IN_MSPIKE_H2 16670 10.03 8.03 11.65 33 BAYES_60 16661 9.96 7.88 11.64 34 XM_Body_Dirty_Words 16416 16.10 21.81 11.47 35 RCVD_IN_MSPIKE_H3 16314 8.50 4.91 11.40 36 XM_B_Unsub 15072 11.53 12.77 10.53 37 T_TooManySym_01 14309 6.56 2.31 10.00 38 RCVD_IN_MSPIKE_H4 12874 6.01 2.33 9.00 39 TR_XM_DKIM_Undo 12830 27.21 49.77 8.96 40 TR_XM_DK_Bayes 10464 5.06 2.27 7.31 41 XM_Evil_Numbers_Gen 10424 8.50 10.00 7.28 42 IN_ZIMBRA_NJ_WHITELIST 10248 4.08 0.27 7.16 43 UNPARSEABLE_RELAY 10218 10.21 14.00 7.14 44 TooManyTo_001 10011 6.68 6.30 7.00 45 LOTS_OF_MONEY 9900 8.42 10.27 6.92 46 HTML_IMAGE_RATIO_02 9734 8.58 10.79 6.80 47 LotsOfNums_01 9677 7.34 8.06 6.76 48 BAYES_99 9634 16.16 27.82 6.73 49 T_TooManySym_02 9247 3.85 0.62 6.46 50 BOTNET_IPINHOSTNAME 8674 8.38 11.24 6.06 51 XMNumbers 8437 4.57 2.92 5.90 52 HTML_IMAGE_RATIO_04 8189 5.32 4.83 5.72 53 MPART_ALT_DIFF 8127 7.86 10.55 5.68 54 XMStrtUSub 7895 5.47 5.41 5.52 55 RCVD_IN_VALIDITY_SAFE 7832 3.97 2.11 5.47 56 BAYES_999 7796 12.93 22.19 5.45 57 XM_UncommonTLD01 7737 6.90 8.75 5.41 58 BOUNCE_MESSAGE 7680 3.52 1.23 5.37 59 ANY_BOUNCE_MESSAGE 7680 3.52 1.23 5.37 60 TR_XM_UnparsRelay 7607 8.93 13.39 5.32 61 XM_SendGrid 7571 6.81 8.69 5.29 62 RCVD_IN_VALIDITY_CERTIFIED 7149 3.54 1.75 5.00 63 INVALID_MSGID 6849 2.91 0.58 4.79 64 XM_H_Trusted_IP 6825 2.64 0.00 4.77 65 TVD_RCVD_IP 6616 2.76 0.45 4.62 66 XMSubMetaSx_00 6615 5.54 6.68 4.62 67 MSGID_NOFQDN1 6580 2.75 0.47 4.60 68 TR_XM_SpammyWords4 6564 6.29 8.40 4.59 69 TR_XM_DK_Bayes1 6301 2.49 0.13 4.40 70 TM2_M_URI_OPT_OUT 6237 3.59 2.64 4.36 71 XM_H_Long_From01 6219 4.92 5.64 4.35 72 XM_B_SpammyWords3 6161 7.33 11.07 4.30 73 TO_MALFORMED 6015 2.33 0.01 4.20 74 BAYES_80 5888 5.43 7.06 4.11 75 XMSexyCombo_05 5864 6.72 9.95 4.10 76 HTML_IMAGE_RATIO_06 5843 3.99 3.88 4.08 77 MIME_HTML_ONLY_MULTI 5842 5.50 7.24 4.08 78 BAYES_40 5791 3.17 2.08 4.05 79 TR_XM_DK_Bayes2 5775 2.28 0.10 4.04 80 T_REMOTE_IMAGE 4781 3.14 2.89 3.34 81 RELAYCOUNTRY_META 4561 9.85 18.09 3.19 82 FSL_BULK_SIG 4305 6.10 9.92 3.01 83 FROM_EXCESS_BASE64 4231 3.27 3.67 2.96 84 KHOP_HELO_FCRDNS 4212 2.81 2.65 2.94 85 MIME_QP_LONG_LINE 4184 2.94 2.96 2.92 86 BAYES_20 4060 2.26 1.55 2.84 87 XM_B_Phish_Phrases 4029 3.77 4.94 2.82 88 TR_XM_PhishingBody 3845 3.91 5.43 2.69 89 XM_PDF 3841 1.74 0.58 2.68 90 IN_HORDE_ADDRESS_BOOK 3839 1.72 0.54 2.68 91 BAYES_95 3838 3.44 4.37 2.68 92 XM_SPF_SoftFail 3682 2.91 3.34 2.57 93 RCVD_IN_IADB_LISTED 3564 1.57 0.44 2.49 94 HTML_MIME_NO_HTML_TAG 3552 3.62 5.03 2.48 95 TR_DCC_Bayes_99 3548 9.95 19.18 2.48 96 TR_XM_DK_SendGrid 3508 2.10 1.67 2.45 97 HTML_IMAGE_RATIO_08 3344 2.58 2.89 2.34 98 XMBSHREFv2 3327 1.41 0.28 2.32 99 TVD_SPACE_RATIO 3208 1.33 0.20 2.24 100 RCVD_IN_IADB_SPF 3100 1.36 0.36 2.17 101 MAILING_LIST_MULTI 3042 2.13 2.14 2.13 102 XM_B_SpammyTLD 3040 2.55 3.07 2.12 103 MIME_HTML_MOSTLY 3010 3.09 4.31 2.10 104 XMGappySubj_01 2937 1.18 0.11 2.05 105 URI_NOVOWEL 2867 2.56 3.24 2.00 106 XM_GoogleGroups 2848 3.50 5.36 1.99 107 BAYES_05 2799 1.50 0.94 1.96 108 TM2_M_VERY_LONG_WORD 2787 4.75 8.21 1.95 109 T_XMDrugObfuBody_14 2785 2.36 2.87 1.95 110 RCVD_IN_IADB_SENDERID 2777 1.22 0.34 1.94 111 RCVD_IN_IADB_DK 2658 1.18 0.34 1.86 112 XMSubNoVowel 2615 1.34 0.73 1.83 113 TR_Symld_Words 2471 1.70 1.66 1.73 114 TR_XM_SB_Phish 2445 1.54 1.32 1.71 115 RCVD_IN_IADB_VOUCHED 2433 1.06 0.27 1.70 116 XMSubPhish11 2421 1.48 1.22 1.69 117 TR_XM_SpammyWords2 2344 5.30 9.82 1.64 118 XM_CamelCaseFrm001 2240 2.24 3.07 1.57 119 TooManyTo_002 2220 1.21 0.80 1.55 120 T_TooManySym_03 2213 0.93 0.16 1.55 121 HTML_FONT_FACE_BAD 2127 1.21 0.88 1.49 122 XM_shorewaves_Whitelist 2104 0.81 0.00 1.47 123 RCVD_IN_MSPIKE_H5 2097 0.88 0.16 1.47 124 T_XMDrugObfuBody_08 2070 1.74 2.10 1.45 125 XMLngstWrd_00 1985 2.86 4.69 1.39 126 XMStockSpam_06 1958 1.73 2.18 1.37 127 XM_DK_Undo_01 1956 1.75 2.23 1.37 128 XMLngstWrd_01 1906 2.81 4.64 1.33 129 XMSexyCombo_01 1901 1.88 2.55 1.33 130 XMDiploma_00 1804 1.69 2.21 1.26 131 XM_B_Investor 1799 1.84 2.56 1.26 132 XMLngstWrd_02 1744 2.73 4.61 1.22 133 XM_OfRef6 1716 2.12 3.26 1.20 134 TR_XM_SpammyWords5 1698 1.72 2.38 1.19 135 UNTRUSTED_Relay 1674 4.86 9.43 1.17 136 RCVD_IN_IADB_OPTIN 1659 0.71 0.16 1.16 137 XM_B_Phish66 1637 1.55 2.06 1.14 138 XM_B_Unsub2 1629 1.34 1.59 1.14 139 XMSubMetaSxObfu_03 1629 1.19 1.26 1.14 140 TooManyTo_003 1616 0.92 0.67 1.13 141 TR_XM_INV_DKIM 1569 6.02 12.10 1.10 142 XMLngstWrd_03 1563 2.66 4.59 1.09 143 TR_XM_SpammyRelay 1560 4.30 8.27 1.09 144 XMBdyGiftCard01 1548 1.57 2.16 1.08 145 HTML_IMAGE_ONLY_20 1527 0.76 0.38 1.07 146 SUBJ_ALL_CAPS 1511 1.13 1.23 1.06 147 TR_XM_COVIDMETA4 1491 2.78 4.93 1.04 148 XM_B_COPY_HTML 1485 1.06 1.08 1.04 149 TR_MetaPhish_Combo_01 1480 1.15 1.29 1.03 150 XMLngstWrd_04 1468 2.60 4.55 1.03 151 XM_H_Long_From02 1438 1.04 1.08 1.00 152 XMPhish30 1433 1.48 2.08 1.00 153 XM_Body_Dirty_Words_01 1431 1.40 1.89 1.00 154 URI_HEX 1430 1.39 1.87 1.00 155 TR_XM_MaxUnsub 1400 2.76 4.96 0.98 156 XMBody_95 1353 0.63 0.24 0.95 157 USER_IN_WHITELIST 1339 0.52 0.00 0.94 158 USER_IN_WELCOMELIST 1339 0.52 0.00 0.94 159 XMSexyCombo_04 1284 1.05 1.25 0.90 160 RCVD_IN_MSPIKE_BL 1264 1.67 2.64 0.88 161 TR_XM_MSPIKECOMBO 1259 1.66 2.62 0.88 162 RELAYCOUNTRY_CA 1243 2.73 5.04 0.87 163 TooManyTo_004 1237 0.75 0.61 0.86 164 TR_LOTS_OF_MONEY2 1152 0.81 0.82 0.80 165 T_MONEY_PERCENT 1152 0.81 0.82 0.80 166 T_TooManySym_04 1059 0.44 0.07 0.74 167 UPPERCASE_75_100 1052 2.26 4.14 0.74 168 TooManyTo_005 1052 0.66 0.57 0.74 169 T_XMDrugObfuBody_00 1049 0.96 1.25 0.73 170 XM_UB50 1014 2.04 3.69 0.71 171 HTML_TITLE_SUBJ_DIFF 1004 2.23 4.12 0.70 172 XM_ProductURIs 994 1.07 1.53 0.69 173 RCVD_IN_BL_SPAMCOP_NET 982 2.16 3.98 0.69 174 XMSexyCombo_02 981 0.79 0.93 0.69 175 XM_H_PHPMailer 968 0.83 1.02 0.68 176 T_MANY_PILL_PRICE 958 0.67 0.68 0.67 177 DKIM_ADSP_CUSTOM_MED 941 0.88 1.15 0.66 178 UPGRADE_MAILBOX 888 1.28 2.09 0.62 179 RELAYCOUNTRY_GB 875 0.67 0.74 0.61 180 XMSubMetaSxObfu_02 867 0.48 0.33 0.61 181 T_XMHurry_00 844 0.85 1.18 0.59 182 URI_TRY_3LD 834 0.78 1.02 0.58 183 HTTPS_HTTP_MISMATCH 819 0.60 0.63 0.57 184 RCVD_IN_MSPIKE_L3 809 0.60 0.64 0.57 185 HTML_TAG_BALANCE_BODY 801 0.86 1.23 0.56 186 XMSubMetaI_00 794 0.86 1.23 0.55 187 XM_B_COVIDMETA 785 0.94 1.42 0.55 188 HELO_NODOT 780 0.68 0.84 0.55 189 XM_S_SubURI 777 0.30 0.01 0.54 190 HELO_NO_DOMAIN 777 0.49 0.42 0.54 191 RDNS_DYNAMIC 756 0.79 1.12 0.53 192 MPART_ALT_DIFF_COUNT 753 0.66 0.82 0.53 193 XMNoVowels 740 0.40 0.25 0.52 194 XMGenDplmaNmb 737 0.70 0.94 0.51 195 KHOP_FAKE_EBAY 729 0.29 0.01 0.51 196 CTE_8BIT_MISMATCH 725 0.28 0.01 0.51 197 XMHTML_After_End 707 0.68 0.91 0.49 198 XMBrknScrpt_02 680 0.89 1.39 0.48 199 XMHTMLBadTable_001 658 0.71 1.01 0.46 200 TR_XM_SpammyWords3 653 0.58 0.74 0.46 ----------------------------------------------------------------------