Email: 508236 Autolearn: 0 AvgScore: 3.37 AvgScanTime: 1.21 sec Spam: 170602 Autolearn: 0 AvgScore: 13.92 AvgScanTime: 1.35 sec Ham: 337634 Autolearn: 0 AvgScore: -1.96 AvgScanTime: 1.15 sec Time Spent Running SA: 171.32 hours Time Spent Processing Spam: 63.81 hours Time Spent Processing Ham: 107.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164058 90.12 96.16 87.07 2 DKIM_SIGNED 152511 75.01 89.40 67.74 3 XM_DK_Pass 146201 72.81 85.70 66.30 4 DKIM_VALID 144538 71.91 84.72 65.44 5 RELAYCOUNTRY_US 143632 81.98 84.19 80.86 6 XM_B_Unicode 132846 70.47 77.87 66.73 7 DCC_CHECK 125932 45.08 73.82 30.56 8 XMListUnsubscribeExists 119930 53.43 70.30 44.91 9 XM_B_SpammyWords 112532 53.19 65.96 46.73 10 DKIM_VALID_AU 111072 55.58 65.11 50.76 11 RCVD_IN_MSPIKE_H2 82184 39.27 48.17 34.76 12 BAYES_50 76827 50.20 45.03 52.81 13 XM_B_Unicode3 73114 41.01 42.86 40.07 14 XM_DK_Undo_02 69161 17.79 40.54 6.30 15 XM_B_SpammyWords2 64571 23.47 37.85 16.20 16 MIME_HTML_ONLY 63405 25.11 37.17 19.03 17 FVGT_m_MULTI_ODD 62998 27.60 36.93 22.89 18 LOC_TINY_FONT_1 58616 26.11 34.36 21.95 19 HTML_FONT_LOW_CONTRAST 55249 27.92 32.38 25.66 20 TR_XM_DKIM_Undo 54596 13.61 32.00 4.32 21 BAYES_99 53953 14.40 31.63 5.70 22 DKIM_VALID_EF 50229 26.95 29.44 25.70 23 T_KAM_HTML_FONT_INVALID 46392 21.53 27.19 18.67 24 DCC_CHECK_NEGATIVE 44634 54.88 26.16 69.39 25 BAYES_999 42806 11.50 25.09 4.64 26 TR_DCC_Bayes_99 37765 8.47 22.14 1.57 27 XM_Body_Dirty_Words 37059 14.76 21.72 11.24 28 XMSubLong 36533 20.96 21.41 20.72 29 T_TM2_M_HEADER_IN_MSG 33795 29.29 19.81 34.08 30 RELAYCOUNTRY_META 32646 8.56 19.14 3.22 31 XM_Multi_Part_URI 29223 13.38 17.13 11.48 32 XM_B_Unsub 28423 12.03 16.66 9.69 33 TR_XM_BayesUnsub 27542 10.50 16.14 7.66 34 RCVD_IN_MSPIKE_WL 27180 16.32 15.93 16.51 35 LOTS_OF_MONEY 24383 13.81 14.29 13.57 36 RCVD_IN_MSPIKE_H3 22390 11.78 13.12 11.11 37 MPART_ALT_DIFF 21981 7.98 12.88 5.51 38 BOTNET_IPINHOSTNAME 21971 7.54 12.88 4.85 39 XM_B_SpammyWords3 21075 6.42 12.35 3.42 40 TR_XM_SpammyWords4 20926 10.87 12.27 10.16 41 FSL_BULK_SIG 20297 5.91 11.90 2.89 42 UNPARSEABLE_RELAY 20009 8.37 11.73 6.68 43 TR_XM_UnparsRelay 19606 7.30 11.49 5.18 44 BOTNET 19109 4.78 11.20 1.54 45 TR_XM_SpammyWords2 19010 4.39 11.14 0.98 46 MIME_HTML_ONLY_MULTI 17846 6.01 10.46 3.76 47 XMSexyCombo_05 17802 5.68 10.43 3.28 48 TR_XM_SpammyRelay 17731 4.48 10.39 1.50 49 RCVD_IN_BL_SPAMCOP_NET 17380 3.75 10.19 0.49 50 TM2_M_VERY_LONG_WORD 16752 4.03 9.82 1.11 51 HTML_MIME_NO_HTML_TAG 16683 4.45 9.78 1.76 52 XM_Evil_Numbers_Gen 15431 8.44 9.05 8.14 53 XM_UncommonTLD01 13714 5.00 8.04 3.46 54 XMLngstWrd_00 13549 2.93 7.94 0.40 55 XMLngstWrd_01 13494 2.88 7.91 0.34 56 BAYES_80 13479 5.25 7.90 3.91 57 XMLngstWrd_02 13368 2.79 7.84 0.24 58 XM_GoogleGroups 13362 3.44 7.83 1.23 59 XMLngstWrd_03 12947 2.66 7.59 0.17 60 HTML_TITLE_SUBJ_DIFF 12816 2.56 7.51 0.06 61 XMLngstWrd_04 12771 2.59 7.49 0.11 62 UPPERCASE_75_100 12488 2.48 7.32 0.04 63 HTML_IMAGE_RATIO_02 12146 5.90 7.12 5.28 64 BAYES_60 12117 8.09 7.10 8.59 65 RELAYCOUNTRY_CA 11933 2.97 6.99 0.93 66 TR_XM_SPAMCOP 11903 2.56 6.98 0.32 67 UNTRUSTED_Relay 11890 3.18 6.97 1.26 68 LotsOfNums_01 11045 7.95 6.47 8.69 69 TR_XM_PhishingBody 10773 4.17 6.31 3.08 70 XM_H_Long_From01 9904 5.18 5.81 4.86 71 XM_B_Phish_Phrases 9518 4.11 5.58 3.37 72 XM_SendGrid 8885 4.09 5.21 3.52 73 XMSubMetaSx_00 8819 3.74 5.17 3.01 74 XM_B_Investor 8049 2.45 4.72 1.31 75 DKIM_INVALID 7973 3.09 4.67 2.30 76 BAYES_95 7852 3.29 4.60 2.62 77 T_XMDrugObfuBody_14 7728 2.69 4.53 1.76 78 TooManyTo_001 7644 6.64 4.48 7.73 79 XM_B_SpammyTLD 7570 3.03 4.44 2.32 80 TR_XM_SpammyWords5 6929 2.29 4.06 1.39 81 XM_SPF_SoftFail 6911 6.57 4.05 7.85 82 HTML_IMAGE_RATIO_04 6893 4.98 4.04 5.45 83 RCVD_IN_MSPIKE_BL 6656 2.19 3.90 1.33 84 TR_XM_MSPIKECOMBO 6531 2.16 3.83 1.32 85 XMDiploma_00 6506 2.25 3.81 1.46 86 XMNumbers 6475 3.41 3.80 3.22 87 XM_OfRef6 6260 1.80 3.67 0.85 88 XM_DIRTYINTL 5944 1.37 3.48 0.30 89 XMStrtUSub 5938 3.68 3.48 3.79 90 XM_B_Phish66 5923 2.21 3.47 1.57 91 T_XMDrugObfuBody_08 5900 2.03 3.46 1.31 92 SpammyFromTLD_02 5765 1.57 3.38 0.65 93 MIME_QP_LONG_LINE 5678 4.59 3.33 5.22 94 TR_XM_DK_SendGrid 5668 2.58 3.32 2.20 95 HTML_IMAGE_RATIO_08 5362 3.26 3.14 3.32 96 RCVD_IN_VALIDITY_SAFE 5310 4.04 3.11 4.52 97 XM_CamelCaseFrm001 5205 2.22 3.05 1.80 98 XM_UB50 5059 1.51 2.97 0.77 99 HTML_IMAGE_RATIO_06 5033 6.30 2.95 7.99 100 MIME_HTML_MOSTLY 4978 2.41 2.92 2.16 101 T_REMOTE_IMAGE 4827 3.28 2.83 3.51 102 XMBody_17 4693 1.17 2.75 0.37 103 TM2_M_URI_OPT_OUT 4607 2.81 2.70 2.87 104 RCVD_IN_IADB_LISTED 4454 4.40 2.61 5.30 105 PDS_OTHER_BAD_TLD 4408 0.96 2.58 0.13 106 RCVD_IN_MSPIKE_H4 4380 3.84 2.57 4.49 107 SpammyFromTLD_01 4370 1.26 2.56 0.60 108 XM_B_Unsub2 4294 1.84 2.52 1.49 109 RCVD_IN_VALIDITY_CERTIFIED 4267 3.52 2.50 4.03 110 RCVD_IN_VALIDITY_RPBL 4192 0.89 2.46 0.09 111 T_FILL_THIS_FORM_SHORT 4156 1.31 2.44 0.75 112 SUBJ_ALL_CAPS 4018 2.02 2.36 1.86 113 URIBL_DBL_SPAM 3985 0.79 2.34 0.01 114 USER_IN_DEF_DKIM_WL 3927 8.53 2.30 11.68 115 FROM_EXCESS_BASE64 3903 2.33 2.29 2.35 116 KHOP_HELO_FCRDNS 3854 3.70 2.26 4.42 117 T_XMHurry_00 3797 1.09 2.23 0.51 118 TR_XM_MSPIKECOMBO2 3766 0.90 2.21 0.23 119 RCVD_IN_IADB_SPF 3725 3.86 2.18 4.71 120 T_TooManySym_01 3618 4.63 2.12 5.90 121 TR_XM_SB_Phish 3568 2.06 2.09 2.05 122 XM_B_COVIDMETA 3550 1.05 2.08 0.52 123 ALL_TRUSTED 3480 11.68 2.04 16.55 124 TR_XM_SpammyWords3 3478 1.04 2.04 0.53 125 RCVD_IN_IADB_DK 3412 3.36 2.00 4.05 126 XMSubPhish11 3402 2.02 1.99 2.03 127 RCVD_IN_IADB_SENDERID 3396 3.45 1.99 4.19 128 XM_B_SpammyWords4 3376 0.94 1.98 0.42 129 XMSexyCombo_01 3369 0.93 1.97 0.41 130 XM_DK_Undo_01 3340 1.60 1.96 1.42 131 URI_NOVOWEL 3281 2.25 1.92 2.41 132 URI_PHP_REDIR 3228 0.64 1.89 0.00 133 URI_HEX 3122 1.45 1.83 1.26 134 TR_LOTS_OF_MONEY3 3104 0.75 1.82 0.22 135 XMGenDplmaNmb 2831 1.13 1.66 0.86 136 URI_TRY_3LD 2810 0.87 1.65 0.47 137 T_XMDrugObfuBody_00 2784 0.98 1.63 0.66 138 TR_XM_COVIDMETA4 2776 0.71 1.63 0.24 139 RCVD_IN_MSPIKE_L3 2768 0.98 1.62 0.66 140 TR_Symld_Words 2732 1.64 1.60 1.65 141 HK_RANDOM_REPLYTO 2727 0.58 1.60 0.07 142 XM_UB99 2713 0.53 1.59 0.00 143 BOTNET_NORDNS 2705 0.54 1.59 0.01 144 RELAYCOUNTRY_AU 2635 0.73 1.54 0.31 145 MAILING_LIST_MULTI 2583 2.19 1.51 2.54 146 RCVD_IN_IADB_VOUCHED 2549 2.77 1.49 3.41 147 RCVD_IN_PSBL 2499 0.66 1.46 0.25 148 HTTPS_HTTP_MISMATCH 2489 0.89 1.46 0.61 149 TR_XM_PHPDW 2481 0.69 1.45 0.31 150 TM2_M_A_HREF_HREF 2470 0.96 1.45 0.71 151 XMBrknScrpt_02 2413 0.83 1.41 0.54 152 TR_XM_PHPForged 2402 0.66 1.41 0.28 153 RELAYCOUNTRY_RU 2364 0.48 1.39 0.03 154 XMHTML_After_End 2355 0.92 1.38 0.69 155 XMStockSpam_06 2352 1.23 1.38 1.15 156 TR_XM_FormFill2 2339 0.64 1.37 0.27 157 XM_H_PHPOS 2321 0.63 1.36 0.26 158 BAYES_40 2307 3.53 1.35 4.63 159 HTML_TAG_BALANCE_BODY 2284 0.84 1.34 0.59 160 REMOVE_BEFORE_LINK 2268 0.69 1.33 0.36 161 RCVD_IN_MSPIKE_L5 2231 0.46 1.31 0.03 162 FROM_SUSPICIOUS_NTLD 2165 0.44 1.27 0.03 163 XM_URI_RBL 2157 0.51 1.26 0.13 164 TR_XM_FormFill 2129 0.43 1.25 0.01 165 XM_H_Long_From02 2070 1.04 1.21 0.95 166 TR_XM_COVIDMETA1 2051 0.52 1.20 0.18 167 LongTLD 2047 0.59 1.20 0.27 168 XM_UB999 2032 0.40 1.19 0.00 169 TR_XM_MaxSPIKE 2012 0.47 1.18 0.11 170 URIBL_BLACK 2011 0.43 1.18 0.05 171 XM_B_DynamicLink 2004 0.41 1.17 0.03 172 TR_XM_BayesRelay 1999 0.40 1.17 0.00 173 XM_B_SEO 1987 0.50 1.16 0.17 174 XMPhish30 1920 1.01 1.13 0.96 175 FROM_SUSPICIOUS_NTLD_FP 1919 0.39 1.12 0.02 176 TR_XM_NoHeaderRelay 1919 0.44 1.12 0.10 177 XM_OfRef7 1860 0.44 1.09 0.11 178 TR_XM_SEO4 1850 0.44 1.08 0.11 179 TR_MetaPhish_Combo_01 1833 0.99 1.07 0.95 180 RELAYCOUNTRY_FR 1827 0.55 1.07 0.29 181 XMSexyCombo_04 1823 0.41 1.07 0.08 182 T_Symld_Words_02 1822 0.59 1.07 0.35 183 HTML_TAG_BALANCE_CENTER 1805 0.45 1.06 0.14 184 XMPhish14 1799 0.59 1.05 0.36 185 XMReplyNow 1783 0.53 1.05 0.27 186 BAYES_20 1776 2.82 1.04 3.73 187 TR_XM_Base64_M1 1734 0.90 1.02 0.84 188 TR_Caps_n_Bayes_99 1684 0.42 0.99 0.13 189 FONT_INVIS_LONG_LINE 1669 0.36 0.98 0.05 190 XM_H_Undi_Recip 1659 0.47 0.97 0.22 191 MIXED_CENTER_CASE 1656 0.33 0.97 0.00 192 XMBdyGiftCard01 1652 0.79 0.97 0.70 193 MIXED_HREF_CASE 1628 0.32 0.95 0.00 194 MIXED_IMG_CASE 1610 0.32 0.94 0.00 195 MIXED_AREA_CASE 1602 0.32 0.94 0.00 196 RELAYCOUNTRY_DE 1557 0.50 0.91 0.28 197 RCVD_IN_IADB_OPTIN 1543 1.78 0.90 2.22 198 TR_Mismatch_TLD_02 1540 0.36 0.90 0.09 199 RCVD_IN_MSPIKE_L4 1532 0.72 0.90 0.63 200 TR_Mismatch_TLD_01 1523 0.46 0.89 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 293975 90.12 96.16 87.07 2 RELAYCOUNTRY_US 273003 81.98 84.19 80.86 3 DCC_CHECK_NEGATIVE 234278 54.88 26.16 69.39 4 DKIM_SIGNED 228697 75.01 89.40 67.74 5 XM_B_Unicode 225306 70.47 77.87 66.73 6 XM_DK_Pass 223843 72.81 85.70 66.30 7 DKIM_VALID 220946 71.91 84.72 65.44 8 BAYES_50 178318 50.20 45.03 52.81 9 DKIM_VALID_AU 171397 55.58 65.11 50.76 10 XM_B_SpammyWords 157774 53.19 65.96 46.73 11 XMListUnsubscribeExists 151635 53.43 70.30 44.91 12 XM_B_Unicode3 135294 41.01 42.86 40.07 13 RCVD_IN_MSPIKE_H2 117378 39.27 48.17 34.76 14 T_TM2_M_HEADER_IN_MSG 115073 29.29 19.81 34.08 15 DCC_CHECK 103186 45.08 73.82 30.56 16 DKIM_VALID_EF 86765 26.95 29.44 25.70 17 HTML_FONT_LOW_CONTRAST 86641 27.92 32.38 25.66 18 FVGT_m_MULTI_ODD 77280 27.60 36.93 22.89 19 LOC_TINY_FONT_1 74109 26.11 34.36 21.95 20 XMSubLong 69973 20.96 21.41 20.72 21 MIME_HTML_ONLY 64237 25.11 37.17 19.03 22 T_KAM_HTML_FONT_INVALID 63052 21.53 27.19 18.67 23 ALL_TRUSTED 55868 11.68 2.04 16.55 24 RCVD_IN_MSPIKE_WL 55755 16.32 15.93 16.51 25 XM_B_SpammyWords2 54691 23.47 37.85 16.20 26 BAYES_00 53200 10.73 0.78 15.76 27 LOTS_OF_MONEY 45827 13.81 14.29 13.57 28 IN_ZIMBRA_NJ_WHITELIST 43174 8.54 0.12 12.79 29 USER_IN_DEF_DKIM_WL 39447 8.53 2.30 11.68 30 XM_Multi_Part_URI 38776 13.38 17.13 11.48 31 XM_Body_Dirty_Words 37957 14.76 21.72 11.24 32 RCVD_IN_MSPIKE_H3 37501 11.78 13.12 11.11 33 TR_XM_SpammyWords4 34316 10.87 12.27 10.16 34 XM_B_Unsub 32727 12.03 16.66 9.69 35 LotsOfNums_01 29346 7.95 6.47 8.69 36 BAYES_60 29009 8.09 7.10 8.59 37 XM_Evil_Numbers_Gen 27486 8.44 9.05 8.14 38 HTML_IMAGE_RATIO_06 26990 6.30 2.95 7.99 39 XM_DKIMWhitelistDomains 26850 5.30 0.06 7.95 40 XM_SPF_SoftFail 26488 6.57 4.05 7.85 41 TooManyTo_001 26114 6.64 4.48 7.73 42 TR_XM_BayesUnsub 25847 10.50 16.14 7.66 43 HTML_FONT_FACE_BAD 25470 5.18 0.49 7.54 44 UNPARSEABLE_RELAY 22553 8.37 11.73 6.68 45 XM_DK_Undo_02 21276 17.79 40.54 6.30 46 TR_XM_DK_Bayes 20448 4.23 0.62 6.06 47 TR_XM_DK_Bayes1 20133 4.17 0.61 5.96 48 T_TooManySym_01 19926 4.63 2.12 5.90 49 BAYES_99 19250 14.40 31.63 5.70 50 MPART_ALT_DIFF 18598 7.98 12.88 5.51 51 HTML_IMAGE_RATIO_04 18404 4.98 4.04 5.45 52 RCVD_IN_IADB_LISTED 17910 4.40 2.61 5.30 53 HTML_IMAGE_RATIO_02 17842 5.90 7.12 5.28 54 TR_XM_DK_Bayes2 17744 3.67 0.52 5.26 55 MIME_QP_LONG_LINE 17631 4.59 3.33 5.22 56 TR_XM_UnparsRelay 17473 7.30 11.49 5.18 57 XM_H_Long_From01 16409 5.18 5.81 4.86 58 BOTNET_IPINHOSTNAME 16368 7.54 12.88 4.85 59 RCVD_IN_IADB_SPF 15886 3.86 2.18 4.71 60 BAYES_999 15664 11.50 25.09 4.64 61 BAYES_40 15619 3.53 1.35 4.63 62 XM_PDF 15476 3.29 0.73 4.58 63 RCVD_IN_VALIDITY_SAFE 15246 4.04 3.11 4.52 64 RCVD_IN_MSPIKE_H4 15143 3.84 2.57 4.49 65 KHOP_HELO_FCRDNS 14929 3.70 2.26 4.42 66 TR_XM_DKIM_Undo 14593 13.61 32.00 4.32 67 RCVD_IN_IADB_SENDERID 14144 3.45 1.99 4.19 68 RCVD_IN_IADB_DK 13668 3.36 2.00 4.05 69 RCVD_IN_VALIDITY_CERTIFIED 13612 3.52 2.50 4.03 70 XM_H_Trusted_IP 13277 2.61 0.00 3.93 71 BAYES_80 13190 5.25 7.90 3.91 72 XMStrtUSub 12783 3.68 3.48 3.79 73 MIME_HTML_ONLY_MULTI 12679 6.01 10.46 3.76 74 BAYES_20 12577 2.82 1.04 3.73 75 XM_SendGrid 11897 4.09 5.21 3.52 76 T_REMOTE_IMAGE 11843 3.28 2.83 3.51 77 XM_UncommonTLD01 11678 5.00 8.04 3.46 78 XM_B_SpammyWords3 11554 6.42 12.35 3.42 79 RCVD_IN_IADB_VOUCHED 11504 2.77 1.49 3.41 80 XM_B_Phish_Phrases 11363 4.11 5.58 3.37 81 HTML_IMAGE_RATIO_08 11221 3.26 3.14 3.32 82 XMSexyCombo_05 11090 5.68 10.43 3.28 83 T_TooManySym_02 10888 2.38 0.71 3.22 84 RELAYCOUNTRY_META 10878 8.56 19.14 3.22 85 XMNumbers 10862 3.41 3.80 3.22 86 TR_XM_PhishingBody 10399 4.17 6.31 3.08 87 XMSubMetaSx_00 10174 3.74 5.17 3.01 88 FSL_BULK_SIG 9748 5.91 11.90 2.89 89 TM2_M_URI_OPT_OUT 9677 2.81 2.70 2.87 90 BAYES_95 8853 3.29 4.60 2.62 91 ANY_BOUNCE_MESSAGE 8668 1.97 0.79 2.57 92 BOUNCE_MESSAGE 8668 1.97 0.79 2.57 93 MAILING_LIST_MULTI 8570 2.19 1.51 2.54 94 URI_NOVOWEL 8139 2.25 1.92 2.41 95 FROM_EXCESS_BASE64 7923 2.33 2.29 2.35 96 XM_B_SpammyTLD 7817 3.03 4.44 2.32 97 DKIM_INVALID 7751 3.09 4.67 2.30 98 BAYES_05 7601 1.69 0.57 2.25 99 RCVD_IN_IADB_OPTIN 7512 1.78 0.90 2.22 100 TR_XM_DK_SendGrid 7433 2.58 3.32 2.20 101 TooManyTo_002 7290 1.62 0.55 2.16 102 MIME_HTML_MOSTLY 7277 2.41 2.92 2.16 103 INVALID_MSGID 7158 1.48 0.21 2.12 104 TR_XM_SB_Phish 6912 2.06 2.09 2.05 105 XMSubPhish11 6839 2.02 1.99 2.03 106 TVD_RCVD_IP 6642 1.40 0.26 1.97 107 SUBJ_ALL_CAPS 6264 2.02 2.36 1.86 108 XM_CamelCaseFrm001 6066 2.22 3.05 1.80 109 IN_HORDE_ADDRESS_BOOK 6065 1.24 0.15 1.80 110 T_XMDrugObfuBody_14 5958 2.69 4.53 1.76 111 HTML_MIME_NO_HTML_TAG 5957 4.45 9.78 1.76 112 TO_MALFORMED 5942 1.17 0.02 1.76 113 TR_Symld_Words 5584 1.64 1.60 1.65 114 HELO_NODOT 5552 1.25 0.46 1.64 115 HELO_NO_DOMAIN 5543 1.24 0.45 1.64 116 XMGappySubj_01 5472 1.17 0.26 1.62 117 XM_B_Phish66 5295 2.21 3.47 1.57 118 TR_DCC_Bayes_99 5288 8.47 22.14 1.57 119 BOTNET 5184 4.78 11.20 1.54 120 TR_XM_SpammyRelay 5059 4.48 10.39 1.50 121 XM_B_Unsub2 5038 1.84 2.52 1.49 122 XMDiploma_00 4939 2.25 3.81 1.46 123 TooManyTo_003 4926 1.12 0.45 1.46 124 XM_DK_Undo_01 4804 1.60 1.96 1.42 125 TR_XM_SpammyWords5 4691 2.29 4.06 1.39 126 XMBSHREFv2 4622 1.03 0.35 1.37 127 RCVD_IN_MSPIKE_BL 4481 2.19 3.90 1.33 128 TR_XM_MSPIKECOMBO 4457 2.16 3.83 1.32 129 T_XMDrugObfuBody_08 4436 2.03 3.46 1.31 130 XM_B_Investor 4418 2.45 4.72 1.31 131 URI_HEX 4256 1.45 1.83 1.26 132 UNTRUSTED_Relay 4253 3.18 6.97 1.26 133 MY_SERVERS_FOUND 4217 1.01 0.52 1.25 134 XM_GoogleGroups 4141 3.44 7.83 1.23 135 XMStockSpam_06 3879 1.23 1.38 1.15 136 TM2_M_VERY_LONG_WORD 3744 4.03 9.82 1.11 137 XMCapTrack 3573 0.80 0.29 1.06 138 XMSubNoVowel 3447 0.95 0.81 1.02 139 TooManyTo_004 3439 0.81 0.39 1.02 140 TVD_SPACE_RATIO 3364 0.70 0.12 1.00 141 TR_XM_SpammyWords2 3321 4.39 11.14 0.98 142 XMPhish30 3227 1.01 1.13 0.96 143 TR_MetaPhish_Combo_01 3214 0.99 1.07 0.95 144 XMBody_95 3195 0.69 0.18 0.95 145 XM_H_Long_From02 3192 1.04 1.21 0.95 146 RELAYCOUNTRY_CA 3147 2.97 6.99 0.93 147 RCVD_IN_MSPIKE_H5 3111 0.69 0.24 0.92 148 RCVD_IN_RP_SAFE 2930 0.79 0.65 0.87 149 DKIM_ADSP_CUSTOM_MED 2898 0.80 0.69 0.86 150 XMGenDplmaNmb 2897 1.13 1.66 0.86 151 XM_OfRef6 2880 1.80 3.67 0.85 152 TR_XM_Base64_M1 2844 0.90 1.02 0.84 153 FROM_GOV_DKIM_AU 2826 0.67 0.33 0.84 154 HTML_IMAGE_ONLY_20 2769 0.77 0.66 0.82 155 TooManyTo_005 2757 0.66 0.35 0.82 156 RCVD_IN_RP_CERTIFIED 2629 0.69 0.52 0.78 157 XM_UB50 2616 1.51 2.97 0.77 158 T_TooManySym_03 2594 0.61 0.29 0.77 159 T_FILL_THIS_FORM_SHORT 2526 1.31 2.44 0.75 160 XM_H_PHPMailer 2435 0.71 0.69 0.72 161 XM_B_COPY_HTML 2390 0.73 0.76 0.71 162 TM2_M_A_HREF_HREF 2384 0.96 1.45 0.71 163 XMBdyGiftCard01 2353 0.79 0.97 0.70 164 MSGID_NOFQDN1 2333 0.47 0.04 0.69 165 XMHTML_After_End 2315 0.92 1.38 0.69 166 RCVD_IN_MSPIKE_L3 2227 0.98 1.62 0.66 167 T_XMDrugObfuBody_00 2220 0.98 1.63 0.66 168 T_OBFU_PDF_ATTACH 2201 0.49 0.16 0.65 169 SpammyFromTLD_02 2193 1.57 3.38 0.65 170 XM_Body_Dirty_Words_01 2161 0.70 0.81 0.64 171 RCVD_IN_MSPIKE_L4 2134 0.72 0.90 0.63 172 XMNoVowels 2127 0.52 0.32 0.63 173 TM2_M_BODY_EMPTY 2090 0.49 0.23 0.62 174 XMSubMetaI_00 2064 0.66 0.74 0.61 175 HTTPS_HTTP_MISMATCH 2055 0.89 1.46 0.61 176 SpammyFromTLD_01 2041 1.26 2.56 0.60 177 XM_ProductURIs 2010 0.60 0.60 0.60 178 XM_D_tchamptons_WL 2006 0.40 0.00 0.59 179 HTML_TAG_BALANCE_BODY 1999 0.84 1.34 0.59 180 XM_ShortIntro_01 1895 0.55 0.54 0.56 181 XMBrknScrpt_02 1813 0.83 1.41 0.54 182 DIET_1 1802 0.59 0.71 0.53 183 NML_ADSP_CUSTOM_MED 1786 0.54 0.55 0.53 184 TR_XM_SpammyWords3 1784 1.04 2.04 0.53 185 XM_B_COVIDMETA 1772 1.05 2.08 0.52 186 T_XMHurry_00 1725 1.09 2.23 0.51 187 XMHTMLBadTable_001 1712 0.54 0.60 0.51 188 SHORT_HELO_AND_INLINE_IMAGE 1687 0.35 0.06 0.50 189 RCVD_IN_BL_SPAMCOP_NET 1662 3.75 10.19 0.49 190 FORGED_GMAIL_RCVD 1659 0.52 0.58 0.49 191 URI_TRY_3LD 1593 0.87 1.65 0.47 192 MPART_ALT_DIFF_COUNT 1587 0.61 0.87 0.47 193 RELAYCOUNTRY_GB 1584 0.56 0.75 0.47 194 BASE64_LENGTH_79_INF 1554 0.36 0.17 0.46 195 RCVD_IN_SORBS_DUL 1547 0.34 0.10 0.46 196 USER_IN_WELCOMELIST 1530 0.30 0.00 0.45 197 USER_IN_WHITELIST 1530 0.30 0.00 0.45 198 XM_B_DNDMA 1490 0.58 0.85 0.44 199 XM_B_SpammyWords4 1405 0.94 1.98 0.42 200 XMSolicitRefs_0 1398 0.44 0.48 0.41 ----------------------------------------------------------------------