Email: 520594 Autolearn: 0 AvgScore: 3.23 AvgScanTime: 1.35 sec Spam: 146374 Autolearn: 0 AvgScore: 14.23 AvgScanTime: 1.47 sec Ham: 374220 Autolearn: 0 AvgScore: -1.07 AvgScanTime: 1.30 sec Time Spent Running SA: 194.61 hours Time Spent Processing Spam: 59.62 hours Time Spent Processing Ham: 134.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140351 90.29 95.89 88.10 2 DKIM_SIGNED 127641 74.24 87.20 69.17 3 XM_DK_Pass 124168 72.67 84.83 67.92 4 DKIM_VALID 123684 71.93 84.50 67.02 5 RELAYCOUNTRY_US 122746 78.46 83.86 76.35 6 XM_B_Unicode 114729 74.21 78.38 72.58 7 DCC_CHECK 103893 43.51 70.98 32.77 8 XMListUnsubscribeExists 98787 52.31 67.49 46.38 9 XM_B_SpammyWords 94162 47.63 64.33 41.10 10 DKIM_VALID_AU 87992 53.88 60.11 51.44 11 XM_DK_Undo_02 64939 17.42 44.37 6.88 12 BAYES_50 64704 54.36 44.20 58.33 13 XM_B_Unicode3 64620 46.21 44.15 47.02 14 XM_B_SpammyWords2 53147 22.95 36.31 17.73 15 FVGT_m_MULTI_ODD 52672 26.92 35.98 23.37 16 LOC_TINY_FONT_1 50517 25.63 34.51 22.15 17 TR_XM_DKIM_Undo 49207 12.94 33.62 4.85 18 MIME_HTML_ONLY 49195 28.20 33.61 26.08 19 HTML_FONT_LOW_CONTRAST 48158 26.68 32.90 24.25 20 BAYES_99 47072 13.22 32.16 5.81 21 DKIM_VALID_EF 43109 26.81 29.45 25.78 22 DCC_CHECK_NEGATIVE 42421 56.43 28.98 67.17 23 T_KAM_HTML_FONT_INVALID 39457 21.08 26.96 18.78 24 XMSubLong 39252 27.57 26.82 27.87 25 RCVD_IN_MSPIKE_H2 38668 21.83 26.42 20.04 26 BAYES_999 37035 10.59 25.30 4.83 27 XM_Body_Dirty_Words 33768 14.28 23.07 10.84 28 TR_DCC_Bayes_99 33159 7.75 22.65 1.93 29 RCVD_IN_MSPIKE_WL 33048 27.85 22.58 29.91 30 T_TM2_M_HEADER_IN_MSG 30293 25.87 20.70 27.89 31 RELAYCOUNTRY_META 29049 8.16 19.85 3.59 32 XM_Multi_Part_URI 24572 13.05 16.79 11.59 33 XM_B_Unsub 23291 16.08 15.91 16.15 34 LOTS_OF_MONEY 21501 9.35 14.69 7.26 35 RCVD_IN_MSPIKE_H3 21105 15.60 14.42 16.06 36 BOTNET_IPINHOSTNAME 21104 7.10 14.42 4.24 37 FSL_BULK_SIG 21087 6.49 14.41 3.40 38 BOTNET 20899 5.05 14.28 1.44 39 UNPARSEABLE_RELAY 20080 9.05 13.72 7.23 40 TR_XM_UnparsRelay 19716 7.89 13.47 5.71 41 XM_B_SpammyWords3 18908 6.39 12.92 3.83 42 TR_XM_SpammyWords4 18167 6.68 12.41 4.44 43 RCVD_IN_BL_SPAMCOP_NET 17928 3.92 12.25 0.66 44 XMSexyCombo_05 15245 4.98 10.42 2.86 45 XM_UncommonTLD01 15187 5.18 10.38 3.15 46 TR_XM_SpammyWords2 14600 3.52 9.97 0.99 47 MPART_ALT_DIFF 13737 6.46 9.38 5.32 48 XM_Evil_Numbers_Gen 13589 7.71 9.28 7.09 49 UNTRUSTED_Relay 13494 3.44 9.22 1.18 50 TR_XM_SpammyRelay 13448 3.63 9.19 1.45 51 XM_SendGrid 13012 6.41 8.89 5.43 52 RCVD_IN_MSPIKE_BL 12419 3.21 8.48 1.14 53 TR_XM_MSPIKECOMBO 11979 3.12 8.18 1.14 54 TM2_M_VERY_LONG_WORD 11294 3.62 7.72 2.01 55 RCVD_IN_MSPIKE_H4 11206 10.65 7.66 11.83 56 BAYES_80 10950 5.08 7.48 4.14 57 TR_XM_PhishingBody 10800 4.46 7.38 3.32 58 XM_B_SpammyTLD 10574 3.47 7.22 2.01 59 HTML_IMAGE_RATIO_02 10492 6.14 7.17 5.73 60 BAYES_60 10448 8.33 7.14 8.80 61 HTML_MIME_NO_HTML_TAG 10420 3.95 7.12 2.71 62 LotsOfNums_01 10420 8.65 7.12 9.26 63 TR_XM_MaxUnsub 10263 2.66 7.01 0.96 64 MIME_HTML_ONLY_MULTI 9645 4.54 6.59 3.74 65 XM_B_Phish_Phrases 9214 3.94 6.29 3.02 66 XMSubMetaSx_00 8455 4.09 5.78 3.43 67 TR_XM_DK_SendGrid 8289 4.03 5.66 3.40 68 XM_GoogleGroups 8255 2.94 5.64 1.88 69 XM_H_Long_From01 8160 5.46 5.57 5.42 70 TR_XM_SpammyWords3 8029 1.93 5.49 0.54 71 TR_XM_SPAMCOP 7606 1.64 5.20 0.25 72 RCVD_IN_MSPIKE_L5 7552 1.56 5.16 0.16 73 T_REMOTE_IMAGE 7288 3.89 4.98 3.46 74 TooManyTo_001 6775 11.61 4.63 14.35 75 XM_B_Investor 6729 2.52 4.60 1.71 76 HTML_IMAGE_RATIO_04 6709 4.99 4.58 5.15 77 XM_SPF_SoftFail 6689 2.92 4.57 2.28 78 XMNumbers 6624 3.70 4.53 3.38 79 RELAYCOUNTRY_CA 6552 1.83 4.48 0.79 80 XMLngstWrd_00 6443 1.99 4.40 1.05 81 XMLngstWrd_01 6368 1.93 4.35 0.99 82 XM_B_Phish66 6332 2.68 4.33 2.04 83 XMLngstWrd_02 6319 1.88 4.32 0.92 84 PDS_OTHER_BAD_TLD 6201 1.32 4.24 0.18 85 BAYES_95 6199 3.06 4.24 2.60 86 XMLngstWrd_03 6035 1.77 4.12 0.85 87 XMLngstWrd_04 5947 1.72 4.06 0.80 88 HTML_TITLE_SUBJ_DIFF 5884 1.61 4.02 0.67 89 T_XMDrugObfuBody_14 5879 2.67 4.02 2.14 90 MIME_HTML_MOSTLY 5856 2.63 4.00 2.09 91 UPPERCASE_75_100 5811 1.61 3.97 0.68 92 XM_UB50 5755 1.64 3.93 0.74 93 HTML_IMAGE_RATIO_06 5611 3.46 3.83 3.31 94 SpammyFromTLD_02 5492 1.38 3.75 0.45 95 XMStrtUSub 5389 9.05 3.68 11.15 96 TR_XM_SpammyWords5 5373 2.13 3.67 1.53 97 T_XMDrugObfuBody_08 5366 2.01 3.67 1.36 98 TM2_M_URI_OPT_OUT 5106 2.75 3.49 2.46 99 RCVD_IN_VALIDITY_SAFE 5025 4.17 3.43 4.46 100 SpammyFromTLD_01 4961 1.39 3.39 0.60 101 MIME_QP_LONG_LINE 4933 5.22 3.37 5.95 102 KHOP_HELO_FCRDNS 4832 2.09 3.30 1.61 103 XM_DIRTYINTL 4668 1.12 3.19 0.31 104 URI_PHP_REDIR 4637 0.89 3.17 0.00 105 URI_NOVOWEL 4485 2.88 3.06 2.81 106 RCVD_IN_VALIDITY_CERTIFIED 4228 3.76 2.89 4.10 107 RCVD_IN_VALIDITY_RPBL 4147 0.81 2.83 0.01 108 RCVD_IN_IADB_LISTED 4076 4.96 2.78 5.81 109 HTML_IMAGE_RATIO_08 4030 2.50 2.75 2.40 110 T_XMDrugObfuBody_00 4014 1.39 2.74 0.86 111 DKIM_INVALID 3957 2.31 2.70 2.15 112 BOTNET_NORDNS 3928 0.77 2.68 0.02 113 MAILING_LIST_MULTI 3813 2.64 2.60 2.65 114 XM_CamelCaseFrm001 3729 2.13 2.55 1.97 115 XM_OfRef6 3723 1.33 2.54 0.85 116 T_TooManySym_01 3703 4.74 2.53 5.60 117 XM_B_COVIDMETA 3598 1.13 2.46 0.61 118 XM_DK_Undo_01 3486 1.79 2.38 1.56 119 XM_B_Unsub2 3455 1.74 2.36 1.50 120 RCVD_IN_IADB_SPF 3419 4.36 2.34 5.15 121 RCVD_IN_PSBL 3322 0.66 2.27 0.03 122 USER_IN_DEF_DKIM_WL 3144 8.23 2.15 10.60 123 URI_HEX 3113 1.54 2.13 1.32 124 TR_XM_SB_Phish 3093 2.07 2.11 2.06 125 RCVD_IN_IADB_DK 3086 3.81 2.11 4.48 126 XMDiploma_00 3078 1.73 2.10 1.59 127 XMSubPhish11 3059 2.05 2.09 2.03 128 RCVD_IN_IADB_SENDERID 3053 3.93 2.09 4.65 129 TR_XM_MSPIKECOMBO2 2902 0.67 1.98 0.16 130 RCVD_IN_MSPIKE_L3 2871 0.92 1.96 0.51 131 SUBJ_ALL_CAPS 2730 1.76 1.87 1.72 132 FROM_EXCESS_BASE64 2729 2.35 1.86 2.55 133 XMSexyCombo_01 2717 1.04 1.86 0.72 134 TR_XM_COVIDMETA1 2670 0.68 1.82 0.24 135 BODY_URI_ONLY 2651 0.51 1.81 0.01 136 XM_B_SpammyWords4 2643 0.79 1.81 0.40 137 DKIM_ADSP_CUSTOM_MED 2628 1.08 1.80 0.80 138 XM_UB99 2556 0.49 1.75 0.00 139 RELAYCOUNTRY_AU 2541 0.73 1.74 0.34 140 HTML_IMAGE_ONLY_08 2498 0.55 1.71 0.09 141 TR_XM_PHPDW 2477 0.71 1.69 0.32 142 TR_XM_NoHeaderRelay 2477 0.61 1.69 0.18 143 RCVD_IN_IADB_VOUCHED 2458 3.00 1.68 3.51 144 HTML_TAG_BALANCE_CENTER 2401 0.49 1.64 0.04 145 URIBL_BLACK 2398 0.50 1.64 0.05 146 XM_URI_RBL 2395 0.56 1.64 0.13 147 BAYES_40 2391 3.78 1.63 4.62 148 GOOG_STO_IMG_HTML 2382 0.46 1.63 0.00 149 TR_XM_PHPForged 2318 0.64 1.58 0.28 150 TR_XM_FormFill2 2271 0.64 1.55 0.28 151 XM_H_PHPOS 2255 0.63 1.54 0.27 152 T_FILL_THIS_FORM_SHORT 2235 0.97 1.53 0.75 153 T_Symld_Words_02 2186 0.82 1.49 0.56 154 XMBdyGiftCard01 2162 0.89 1.48 0.66 155 XMBody_17 2145 0.69 1.47 0.39 156 XM_Body_Dirty_Words_01 2125 0.53 1.45 0.16 157 XMStockSpam_06 2110 0.89 1.44 0.67 158 MIXED_CENTER_CASE 2062 0.40 1.41 0.00 159 XM_H_Long_From02 2061 1.27 1.41 1.22 160 TR_Symld_Words 2059 1.63 1.41 1.72 161 MIXED_HREF_CASE 2052 0.39 1.40 0.00 162 XM_B_DNDMA 2049 0.64 1.40 0.34 163 MIXED_IMG_CASE 2037 0.39 1.39 0.00 164 MIXED_AREA_CASE 2037 0.39 1.39 0.00 165 MIXED_FONT_CASE 2026 0.39 1.38 0.00 166 ALL_TRUSTED 2015 15.74 1.38 21.36 167 XMPhish30 2005 0.78 1.37 0.56 168 HTTPS_HTTP_MISMATCH 2003 0.88 1.37 0.69 169 URIBL_DBL_SPAM 2000 0.39 1.37 0.01 170 XMCapTrack 1987 1.15 1.36 1.07 171 BAYES_20 1983 2.73 1.35 3.27 172 TR_XM_COVIDMETA4 1964 0.52 1.34 0.20 173 RELAYCOUNTRY_FR 1950 0.51 1.33 0.18 174 XMGenDplmaNmb 1944 1.18 1.33 1.12 175 XM_UB999 1941 0.37 1.33 0.00 176 HTML_FONT_SIZE_LARGE 1924 0.44 1.31 0.10 177 TM2_M_A_HREF_HREF 1910 0.65 1.30 0.39 178 HTML_FONT_TINY_NORDNS 1884 0.41 1.29 0.06 179 XMHTML_After_End 1874 0.85 1.28 0.68 180 DIET_1 1871 0.58 1.28 0.31 181 T_XMHurry_00 1868 0.73 1.28 0.51 182 URI_TRY_3LD 1779 0.85 1.22 0.70 183 RELAYCOUNTRY_GB 1746 0.86 1.19 0.73 184 RELAYCOUNTRY_DE 1740 0.51 1.19 0.24 185 TR_BOTNET_NEGATE 1704 0.57 1.16 0.34 186 TR_Mismatch_TLD_02 1697 0.38 1.16 0.08 187 XMSubMetaI_00 1688 0.66 1.15 0.47 188 LongTLD 1593 0.39 1.09 0.12 189 RCVD_IN_IADB_OPTIN 1572 1.95 1.07 2.30 190 RCVD_IN_MSPIKE_L4 1556 0.64 1.06 0.47 191 BAYES_00 1550 7.78 1.06 10.41 192 FROM_SUSPICIOUS_NTLD 1504 0.32 1.03 0.04 193 TR_LOTS_OF_MONEY3 1490 0.50 1.02 0.30 194 XM_UB60 1469 0.33 1.00 0.06 195 RELAYCOUNTRY_BR 1469 0.29 1.00 0.01 196 XMBrknScrpt_02 1460 0.77 1.00 0.69 197 XM_B_SEO 1459 0.35 1.00 0.10 198 RELAYCOUNTRY_CN 1454 0.35 0.99 0.10 199 TR_XM_BayesRelay 1442 0.28 0.99 0.01 200 RELAYCOUNTRY_RU 1416 0.29 0.97 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 329699 90.29 95.89 88.10 2 RELAYCOUNTRY_US 285702 78.46 83.86 76.35 3 XM_B_Unicode 271603 74.21 78.38 72.58 4 DKIM_SIGNED 258844 74.24 87.20 69.17 5 XM_DK_Pass 254156 72.67 84.83 67.92 6 DCC_CHECK_NEGATIVE 251365 56.43 28.98 67.17 7 DKIM_VALID 250784 71.93 84.50 67.02 8 BAYES_50 218289 54.36 44.20 58.33 9 DKIM_VALID_AU 192502 53.88 60.11 51.44 10 XM_B_Unicode3 175966 46.21 44.15 47.02 11 XMListUnsubscribeExists 173552 52.31 67.49 46.38 12 XM_B_SpammyWords 153788 47.63 64.33 41.10 13 DCC_CHECK 122629 43.51 70.98 32.77 14 RCVD_IN_MSPIKE_WL 111945 27.85 22.58 29.91 15 T_TM2_M_HEADER_IN_MSG 104376 25.87 20.70 27.89 16 XMSubLong 104290 27.57 26.82 27.87 17 MIME_HTML_ONLY 97594 28.20 33.61 26.08 18 DKIM_VALID_EF 96474 26.81 29.45 25.78 19 HTML_FONT_LOW_CONTRAST 90736 26.68 32.90 24.25 20 FVGT_m_MULTI_ODD 87468 26.92 35.98 23.37 21 LOC_TINY_FONT_1 82896 25.63 34.51 22.15 22 ALL_TRUSTED 79923 15.74 1.38 21.36 23 RCVD_IN_MSPIKE_H2 74976 21.83 26.42 20.04 24 T_KAM_HTML_FONT_INVALID 70275 21.08 26.96 18.78 25 XM_B_SpammyWords2 66338 22.95 36.31 17.73 26 XM_B_Unsub 60419 16.08 15.91 16.15 27 RCVD_IN_MSPIKE_H3 60102 15.60 14.42 16.06 28 TooManyTo_001 53682 11.61 4.63 14.35 29 RCVD_IN_MSPIKE_H4 44254 10.65 7.66 11.83 30 XM_Multi_Part_URI 43365 13.05 16.79 11.59 31 XMStrtUSub 41739 9.05 3.68 11.15 32 XM_Body_Dirty_Words 40580 14.28 23.07 10.84 33 USER_IN_DEF_DKIM_WL 39683 8.23 2.15 10.60 34 BAYES_00 38968 7.78 1.06 10.41 35 LotsOfNums_01 34636 8.65 7.12 9.26 36 BAYES_60 32936 8.33 7.14 8.80 37 XM_DKIMWhitelistDomains 27817 5.35 0.04 7.43 38 LOTS_OF_MONEY 27180 9.35 14.69 7.26 39 UNPARSEABLE_RELAY 27052 9.05 13.72 7.23 40 XM_Evil_Numbers_Gen 26545 7.71 9.28 7.09 41 IN_ZIMBRA_NJ_WHITELIST 25761 4.98 0.10 6.88 42 XM_DK_Undo_02 25760 17.42 44.37 6.88 43 TR_XM_DK_Bayes 23663 4.73 0.65 6.32 44 TR_XM_DK_Bayes1 23182 4.63 0.64 6.19 45 MIME_QP_LONG_LINE 22263 5.22 3.37 5.95 46 RCVD_IN_IADB_LISTED 21746 4.96 2.78 5.81 47 BAYES_99 21740 13.22 32.16 5.81 48 HTML_IMAGE_RATIO_02 21456 6.14 7.17 5.73 49 TR_XM_UnparsRelay 21364 7.89 13.47 5.71 50 T_TooManySym_01 20963 4.74 2.53 5.60 51 XM_SendGrid 20333 6.41 8.89 5.43 52 TR_XM_DK_Bayes2 20324 4.03 0.44 5.43 53 XM_H_Long_From01 20270 5.46 5.57 5.42 54 MPART_ALT_DIFF 19908 6.46 9.38 5.32 55 HTML_IMAGE_RATIO_04 19291 4.99 4.58 5.15 56 RCVD_IN_IADB_SPF 19285 4.36 2.34 5.15 57 TR_XM_DKIM_Undo 18149 12.94 33.62 4.85 58 BAYES_999 18076 10.59 25.30 4.83 59 RCVD_IN_IADB_SENDERID 17417 3.93 2.09 4.65 60 BAYES_40 17281 3.78 1.63 4.62 61 XM_PDF 17101 3.55 0.94 4.57 62 RCVD_IN_IADB_DK 16766 3.81 2.11 4.48 63 RCVD_IN_VALIDITY_SAFE 16675 4.17 3.43 4.46 64 TR_XM_SpammyWords4 16600 6.68 12.41 4.44 65 BOTNET_IPINHOSTNAME 15850 7.10 14.42 4.24 66 BAYES_80 15496 5.08 7.48 4.14 67 RCVD_IN_VALIDITY_CERTIFIED 15340 3.76 2.89 4.10 68 XM_B_SpammyWords3 14345 6.39 12.92 3.83 69 MIME_HTML_ONLY_MULTI 14000 4.54 6.59 3.74 70 RELAYCOUNTRY_META 13425 8.16 19.85 3.59 71 RCVD_IN_IADB_VOUCHED 13139 3.00 1.68 3.51 72 T_REMOTE_IMAGE 12958 3.89 4.98 3.46 73 XMSubMetaSx_00 12851 4.09 5.78 3.43 74 FSL_BULK_SIG 12721 6.49 14.41 3.40 75 TR_XM_DK_SendGrid 12714 4.03 5.66 3.40 76 XMNumbers 12659 3.70 4.53 3.38 77 TR_XM_PhishingBody 12418 4.46 7.38 3.32 78 HTML_IMAGE_RATIO_06 12395 3.46 3.83 3.31 79 BAYES_20 12232 2.73 1.35 3.27 80 T_TooManySym_02 11786 2.46 0.68 3.15 81 XM_UncommonTLD01 11778 5.18 10.38 3.15 82 XM_H_Trusted_IP 11404 2.19 0.00 3.05 83 XM_B_Phish_Phrases 11284 3.94 6.29 3.02 84 XMSexyCombo_05 10684 4.98 10.42 2.86 85 URI_NOVOWEL 10498 2.88 3.06 2.81 86 HTML_MIME_NO_HTML_TAG 10154 3.95 7.12 2.71 87 MAILING_LIST_MULTI 9918 2.64 2.60 2.65 88 ANY_BOUNCE_MESSAGE 9723 2.06 0.69 2.60 89 BAYES_95 9721 3.06 4.24 2.60 90 BOUNCE_MESSAGE 9716 2.05 0.65 2.60 91 FROM_EXCESS_BASE64 9526 2.35 1.86 2.55 92 TM2_M_URI_OPT_OUT 9200 2.75 3.49 2.46 93 HTML_IMAGE_RATIO_08 8993 2.50 2.75 2.40 94 RCVD_IN_IADB_OPTIN 8590 1.95 1.07 2.30 95 XM_SPF_SoftFail 8525 2.92 4.57 2.28 96 DKIM_INVALID 8060 2.31 2.70 2.15 97 T_XMDrugObfuBody_14 8020 2.67 4.02 2.14 98 MIME_HTML_MOSTLY 7823 2.63 4.00 2.09 99 TooManyTo_002 7746 1.72 0.81 2.07 100 TR_XM_SB_Phish 7692 2.07 2.11 2.06 101 XM_B_Phish66 7623 2.68 4.33 2.04 102 XMSubPhish11 7606 2.05 2.09 2.03 103 RCVD_IN_MSPIKE_H5 7589 1.60 0.50 2.03 104 BAYES_05 7544 1.63 0.65 2.02 105 TM2_M_VERY_LONG_WORD 7529 3.62 7.72 2.01 106 XM_B_SpammyTLD 7516 3.47 7.22 2.01 107 XM_CamelCaseFrm001 7355 2.13 2.55 1.97 108 TR_DCC_Bayes_99 7212 7.75 22.65 1.93 109 XM_GoogleGroups 7043 2.94 5.64 1.88 110 INVALID_MSGID 6607 1.34 0.26 1.77 111 IN_HORDE_ADDRESS_BOOK 6604 1.33 0.20 1.76 112 TR_Symld_Words 6439 1.63 1.41 1.72 113 SUBJ_ALL_CAPS 6437 1.76 1.87 1.72 114 TVD_RCVD_IP 6436 1.32 0.31 1.72 115 XM_B_Investor 6395 2.52 4.60 1.71 116 HELO_NODOT 6126 1.33 0.54 1.64 117 HELO_NO_DOMAIN 6125 1.33 0.53 1.64 118 MSGID_NOFQDN1 6109 1.21 0.13 1.63 119 TO_MALFORMED 6027 1.18 0.06 1.61 120 KHOP_HELO_FCRDNS 6026 2.09 3.30 1.61 121 XMDiploma_00 5951 1.73 2.10 1.59 122 XM_DK_Undo_01 5829 1.79 2.38 1.56 123 TR_XM_SpammyWords5 5719 2.13 3.67 1.53 124 XM_B_Unsub2 5619 1.74 2.36 1.50 125 TR_XM_SpammyRelay 5436 3.63 9.19 1.45 126 BOTNET 5387 5.05 14.28 1.44 127 TooManyTo_003 5319 1.23 0.72 1.42 128 T_XMDrugObfuBody_08 5106 2.01 3.67 1.36 129 XMGappySubj_01 5095 1.06 0.29 1.36 130 URI_HEX 4922 1.54 2.13 1.32 131 HTML_FONT_FACE_BAD 4796 1.16 0.83 1.28 132 SHORTENED_URL_HREF 4627 0.94 0.17 1.24 133 XM_H_Long_From02 4551 1.27 1.41 1.22 134 UNTRUSTED_Relay 4431 3.44 9.22 1.18 135 RCVD_IN_MSPIKE_BL 4269 3.21 8.48 1.14 136 TR_XM_MSPIKECOMBO 4258 3.12 8.18 1.14 137 XMGenDplmaNmb 4181 1.18 1.33 1.12 138 XMSubNoVowel 4039 0.95 0.63 1.08 139 XMCapTrack 4013 1.15 1.36 1.07 140 XMLngstWrd_00 3921 1.99 4.40 1.05 141 TooManyTo_004 3763 0.91 0.66 1.01 142 XMBSHREFv2 3730 0.79 0.25 1.00 143 TR_XM_SpammyWords2 3706 3.52 9.97 0.99 144 XMLngstWrd_01 3705 1.93 4.35 0.99 145 TVD_SPACE_RATIO 3652 0.82 0.42 0.98 146 TR_XM_MaxUnsub 3581 2.66 7.01 0.96 147 XMLngstWrd_02 3452 1.88 4.32 0.92 148 RCVD_IN_RP_SAFE 3299 0.83 0.68 0.88 149 T_XMDrugObfuBody_00 3206 1.39 2.74 0.86 150 XMLngstWrd_03 3187 1.77 4.12 0.85 151 XM_OfRef6 3183 1.33 2.54 0.85 152 XM_ProductURIs 3179 0.87 0.91 0.85 153 TooManyTo_005 3074 0.77 0.62 0.82 154 RCVD_IN_RP_CERTIFIED 3058 0.74 0.54 0.82 155 XMLngstWrd_04 3004 1.72 4.06 0.80 156 DKIM_ADSP_CUSTOM_MED 2994 1.08 1.80 0.80 157 RELAYCOUNTRY_CA 2962 1.83 4.48 0.79 158 TR_MetaPhish_Combo_01 2799 0.78 0.85 0.75 159 T_FILL_THIS_FORM_SHORT 2798 0.97 1.53 0.75 160 T_TooManySym_03 2788 0.61 0.27 0.75 161 XM_UB50 2774 1.64 3.93 0.74 162 RELAYCOUNTRY_GB 2748 0.86 1.19 0.73 163 XMSexyCombo_01 2693 1.04 1.86 0.72 164 HTML_IMAGE_ONLY_20 2689 0.63 0.40 0.72 165 XMBody_95 2647 0.55 0.16 0.71 166 URI_TRY_3LD 2629 0.85 1.22 0.70 167 XMBrknScrpt_02 2574 0.77 1.00 0.69 168 HTTPS_HTTP_MISMATCH 2568 0.88 1.37 0.69 169 XMHTML_After_End 2563 0.85 1.28 0.68 170 UPPERCASE_75_100 2547 1.61 3.97 0.68 171 HTML_TITLE_SUBJ_DIFF 2519 1.61 4.02 0.67 172 XMStockSpam_06 2519 0.89 1.44 0.67 173 FROM_GOV_DKIM_AU 2481 0.54 0.22 0.66 174 RCVD_IN_BL_SPAMCOP_NET 2456 3.92 12.25 0.66 175 XMBdyGiftCard01 2454 0.89 1.48 0.66 176 TR_MSPIKEBAYES00 2314 0.47 0.08 0.62 177 XM_B_COVIDMETA 2293 1.13 2.46 0.61 178 SpammyFromTLD_01 2254 1.39 3.39 0.60 179 XM_B_COPY_HTML 2194 0.59 0.60 0.59 180 HTML_TAG_BALANCE_BODY 2178 0.66 0.86 0.58 181 XM_ShortIntro_01 2169 0.57 0.56 0.58 182 T_OBFU_PDF_ATTACH 2098 0.45 0.18 0.56 183 T_Symld_Words_02 2090 0.82 1.49 0.56 184 XMPhish30 2079 0.78 1.37 0.56 185 TR_XM_SpammyWords3 2030 1.93 5.49 0.54 186 SHORT_HELO_AND_INLINE_IMAGE 2019 0.40 0.06 0.54 187 NML_ADSP_CUSTOM_MED 1939 0.59 0.79 0.52 188 T_XMHurry_00 1922 0.73 1.28 0.51 189 RCVD_IN_MSPIKE_L3 1905 0.92 1.96 0.51 190 XMNoVowels 1892 0.45 0.32 0.51 191 XM_H_PHPMailer 1830 0.60 0.88 0.49 192 RCVD_IN_MSPIKE_L4 1767 0.64 1.06 0.47 193 PLING_QUERY 1759 0.51 0.63 0.47 194 XMSubMetaI_00 1745 0.66 1.15 0.47 195 SpammyFromTLD_02 1694 1.38 3.75 0.45 196 FROM_GOV_SPOOF 1676 0.38 0.19 0.45 197 XMMoneyMeta_00 1672 0.54 0.76 0.45 198 XMSubMetaSxObfu_03 1638 0.55 0.85 0.44 199 XMPhish14 1615 0.56 0.88 0.43 200 MPART_ALT_DIFF_COUNT 1613 0.53 0.79 0.43 ----------------------------------------------------------------------