Email: 475323 Autolearn: 0 AvgScore: 3.85 AvgScanTime: 1.49 sec Spam: 155318 Autolearn: 0 AvgScore: 13.91 AvgScanTime: 1.64 sec Ham: 320005 Autolearn: 0 AvgScore: -1.03 AvgScanTime: 1.42 sec Time Spent Running SA: 197.13 hours Time Spent Processing Spam: 70.71 hours Time Spent Processing Ham: 126.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148851 90.21 95.84 87.48 2 DKIM_SIGNED 136330 77.69 87.77 72.80 3 XM_DK_Pass 131944 75.92 84.95 71.54 4 DKIM_VALID 130345 74.93 83.92 70.57 5 XM_B_Unicode 127238 74.68 81.92 71.16 6 RELAYCOUNTRY_US 126413 80.71 81.39 80.38 7 XM_B_SpammyWords 105345 51.88 67.83 44.14 8 DCC_CHECK 105253 43.83 67.77 32.21 9 XMListUnsubscribeExists 105210 55.13 67.74 49.01 10 DKIM_VALID_AU 97540 57.58 62.80 55.04 11 RCVD_IN_MSPIKE_H2 78415 42.49 50.49 38.61 12 XM_B_Unicode3 70704 43.33 45.52 42.26 13 XM_DK_Undo_02 66874 18.86 43.06 7.12 14 BAYES_50 62937 51.51 40.52 56.84 15 XM_B_SpammyWords2 60293 25.42 38.82 18.92 16 LOC_TINY_FONT_1 57838 27.74 37.24 23.13 17 HTML_FONT_LOW_CONTRAST 54473 29.30 35.07 26.49 18 MIME_HTML_ONLY 52168 24.92 33.59 20.72 19 BAYES_99 52074 15.33 33.53 6.50 20 TR_XM_DKIM_Undo 51774 14.08 33.33 4.73 21 DKIM_VALID_EF 50869 29.19 32.75 27.46 22 DCC_CHECK_NEGATIVE 50024 56.13 32.21 67.73 23 FVGT_m_MULTI_ODD 50016 27.06 32.20 24.56 24 T_KAM_HTML_FONT_INVALID 45530 22.83 29.31 19.69 25 BAYES_999 40998 12.23 26.40 5.35 26 XM_Body_Dirty_Words 36484 15.23 23.49 11.22 27 XMSubLong 36401 22.80 23.44 22.49 28 T_TM2_M_HEADER_IN_MSG 35351 27.91 22.76 30.42 29 TR_DCC_Bayes_99 34801 8.58 22.41 1.87 30 RELAYCOUNTRY_META 30037 8.60 19.34 3.39 31 XM_Multi_Part_URI 28320 14.16 18.23 12.18 32 XM_B_Unsub 27331 12.11 17.60 9.45 33 TR_XM_BayesUnsub 26620 10.62 17.14 7.45 34 LOTS_OF_MONEY 22362 9.92 14.40 7.74 35 UNPARSEABLE_RELAY 19540 9.16 12.58 7.51 36 BOTNET_IPINHOSTNAME 19412 7.32 12.50 4.81 37 TR_XM_SpammyRelay 19186 5.05 12.35 1.51 38 TR_XM_UnparsRelay 19148 8.01 12.33 5.91 39 TR_XM_SpammyWords2 18892 4.76 12.16 1.16 40 TR_XM_SpammyWords4 18690 7.23 12.03 4.90 41 RCVD_IN_MSPIKE_WL 18659 15.57 12.01 17.29 42 XM_B_SpammyWords3 17796 6.76 11.46 4.49 43 FSL_BULK_SIG 17322 5.81 11.15 3.21 44 BOTNET 17240 4.60 11.10 1.45 45 XMSexyCombo_05 16928 5.73 10.90 3.22 46 RCVD_IN_BL_SPAMCOP_NET 16186 3.78 10.42 0.55 47 RCVD_IN_MSPIKE_H3 14393 10.55 9.27 11.17 48 BAYES_80 13802 5.88 8.89 4.42 49 XM_Evil_Numbers_Gen 13096 7.92 8.43 7.67 50 XM_UncommonTLD01 12530 5.04 8.07 3.58 51 RELAYCOUNTRY_CA 12309 3.22 7.93 0.93 52 UNTRUSTED_Relay 12136 3.45 7.81 1.33 53 BAYES_60 11732 8.78 7.55 9.37 54 MPART_ALT_DIFF 11498 6.76 7.40 6.45 55 TR_XM_SPAMCOP 11475 2.58 7.39 0.24 56 XM_SendGrid 11231 5.57 7.23 4.76 57 LotsOfNums_01 11023 8.38 7.10 9.01 58 HTML_IMAGE_RATIO_02 10869 5.87 7.00 5.32 59 XMSubMetaSx_00 10676 4.91 6.87 3.95 60 TR_XM_PhishingBody 10035 4.35 6.46 3.32 61 XM_H_Long_From01 9477 6.20 6.10 6.25 62 XM_B_Phish_Phrases 9232 4.03 5.94 3.09 63 BAYES_95 8246 3.52 5.31 2.65 64 TooManyTo_001 8189 7.17 5.27 8.09 65 MIME_HTML_ONLY_MULTI 7701 4.62 4.96 4.46 66 XM_B_Investor 7462 2.66 4.80 1.61 67 HTML_IMAGE_RATIO_04 7343 5.38 4.73 5.69 68 RCVD_IN_MSPIKE_BL 7332 2.43 4.72 1.32 69 XM_SPF_SoftFail 7204 2.81 4.64 1.92 70 XMStrtUSub 7153 4.33 4.61 4.20 71 TR_XM_MSPIKECOMBO 7143 2.39 4.60 1.32 72 TR_XM_DK_SendGrid 7002 3.57 4.51 3.12 73 HTML_MIME_NO_HTML_TAG 6753 3.25 4.35 2.71 74 HTML_IMAGE_RATIO_06 6622 3.67 4.26 3.38 75 T_XMDrugObfuBody_14 6529 2.48 4.20 1.64 76 T_XMDrugObfuBody_08 6498 2.42 4.18 1.57 77 XM_B_SpammyTLD 6440 3.25 4.15 2.81 78 XM_OfRef6 6283 2.24 4.05 1.37 79 TM2_M_VERY_LONG_WORD 6224 2.56 4.01 1.86 80 DKIM_INVALID 5985 2.76 3.85 2.23 81 TR_XM_SpammyWords5 5714 2.16 3.68 1.43 82 RCVD_IN_VALIDITY_SAFE 5708 4.39 3.68 4.74 83 XM_B_Phish66 5686 2.60 3.66 2.08 84 XM_DIRTYINTL 5666 1.41 3.65 0.32 85 XMNumbers 5541 3.39 3.57 3.31 86 SpammyFromTLD_02 5460 1.52 3.52 0.55 87 MIME_HTML_MOSTLY 5399 2.84 3.48 2.53 88 MIME_QP_LONG_LINE 5222 4.86 3.36 5.59 89 T_REMOTE_IMAGE 5172 3.53 3.33 3.63 90 XM_UB50 4861 1.58 3.13 0.83 91 T_FILL_THIS_FORM_SHORT 4812 1.57 3.10 0.83 92 XM_CamelCaseFrm001 4533 2.15 2.92 1.78 93 HTML_IMAGE_RATIO_08 4488 2.39 2.89 2.14 94 TM2_M_URI_OPT_OUT 4392 3.06 2.83 3.18 95 RCVD_IN_VALIDITY_CERTIFIED 4387 3.81 2.82 4.29 96 TR_XM_SpammyWords3 4284 1.27 2.76 0.55 97 XM_B_Unsub2 4252 1.78 2.74 1.32 98 PDS_OTHER_BAD_TLD 4168 1.00 2.68 0.19 99 XMDiploma_00 4137 1.75 2.66 1.31 100 XMSexyCombo_01 4034 1.32 2.60 0.70 101 T_TooManySym_01 3918 4.92 2.52 6.09 102 XMBody_17 3894 1.11 2.51 0.44 103 RCVD_IN_VALIDITY_RPBL 3855 0.83 2.48 0.02 104 T_XMHurry_00 3846 1.16 2.48 0.51 105 SpammyFromTLD_01 3844 1.27 2.47 0.68 106 TR_XM_SB_Phish 3805 2.46 2.45 2.47 107 BOTNET_NORDNS 3782 0.80 2.44 0.01 108 USER_IN_DEF_DKIM_WL 3754 9.39 2.42 12.77 109 RCVD_IN_IADB_LISTED 3727 4.68 2.40 5.79 110 RCVD_IN_MSPIKE_H4 3717 4.14 2.39 4.99 111 KHOP_HELO_FCRDNS 3683 1.63 2.37 1.27 112 XM_DK_Undo_01 3653 1.72 2.35 1.42 113 XMSubPhish11 3540 2.39 2.28 2.44 114 FROM_EXCESS_BASE64 3467 2.39 2.23 2.47 115 ALL_TRUSTED 3430 12.16 2.21 17.00 116 TR_LOTS_OF_MONEY3 3350 1.01 2.16 0.45 117 RCVD_IN_MSPIKE_L3 3258 1.28 2.10 0.88 118 SUBJ_ALL_CAPS 3246 1.89 2.09 1.80 119 TR_XM_MSPIKECOMBO2 3206 0.86 2.06 0.28 120 XM_GoogleGroups 3176 1.89 2.04 1.82 121 URI_NOVOWEL 3138 2.42 2.02 2.61 122 RCVD_IN_IADB_SPF 3126 4.10 2.01 5.12 123 MAILING_LIST_MULTI 3061 2.91 1.97 3.36 124 RCVD_IN_MSPIKE_L5 2988 0.64 1.92 0.01 125 XMStockSpam_06 2966 1.61 1.91 1.47 126 XM_B_SpammyWords4 2888 0.93 1.86 0.47 127 RCVD_IN_IADB_DK 2885 3.61 1.86 4.45 128 XMLngstWrd_00 2878 1.33 1.85 1.07 129 RCVD_IN_IADB_SENDERID 2856 3.69 1.84 4.58 130 URI_HEX 2848 1.37 1.83 1.15 131 XM_B_COVIDMETA 2836 0.95 1.83 0.52 132 HK_RANDOM_REPLYTO 2831 0.66 1.82 0.09 133 XMLngstWrd_01 2813 1.25 1.81 0.98 134 FROM_SUSPICIOUS_NTLD 2801 0.60 1.80 0.01 135 T_XMDrugObfuBody_00 2719 1.22 1.75 0.97 136 XMLngstWrd_02 2673 1.15 1.72 0.88 137 RELAYCOUNTRY_AU 2665 0.78 1.72 0.33 138 XM_UB99 2653 0.56 1.71 0.00 139 FROM_SUSPICIOUS_NTLD_FP 2628 0.56 1.69 0.01 140 TR_XM_FormFill 2610 0.56 1.68 0.02 141 XMLngstWrd_03 2568 1.01 1.65 0.70 142 TR_XM_NoHeaderRelay 2547 0.61 1.64 0.11 143 UPPERCASE_75_100 2499 0.89 1.61 0.54 144 XMLngstWrd_04 2467 0.95 1.59 0.64 145 BAYES_40 2433 3.88 1.57 5.00 146 HTML_TAG_BALANCE_BODY 2425 0.91 1.56 0.59 147 LongTLD 2417 0.65 1.56 0.21 148 XM_Body_Dirty_Words_01 2417 0.73 1.56 0.32 149 HTML_TITLE_SUBJ_DIFF 2413 0.87 1.55 0.54 150 XMBrknScrpt_02 2340 0.92 1.51 0.64 151 TR_XM_PHPDW 2308 0.67 1.49 0.27 152 URIBL_DBL_SPAM 2261 0.48 1.46 0.01 153 XMGenDplmaNmb 2240 0.90 1.44 0.63 154 URIBL_BLACK 2235 0.51 1.44 0.06 155 TR_Symld_Words 2226 1.69 1.43 1.82 156 RCVD_IN_PSBL 2216 0.94 1.43 0.70 157 TR_XM_PHPForged 2183 0.62 1.41 0.24 158 RELAYCOUNTRY_RU 2180 0.48 1.40 0.04 159 TM2_M_A_HREF_HREF 2174 0.88 1.40 0.63 160 TR_XM_BayesRelay 2167 0.46 1.40 0.00 161 TR_XM_FormFill2 2156 0.61 1.39 0.24 162 RCVD_IN_IADB_VOUCHED 2156 2.88 1.39 3.60 163 XM_H_PHPOS 2150 0.61 1.38 0.23 164 TR_XM_MaxSPIKE 2114 0.56 1.36 0.17 165 URI_TRY_3LD 2100 0.83 1.35 0.58 166 TR_MetaPhish_Combo_01 2043 0.93 1.32 0.75 167 XM_URI_RBL 2037 0.51 1.31 0.12 168 XM_UB999 2025 0.43 1.30 0.00 169 XMReplyNow 2000 0.63 1.29 0.31 170 XMHTML_After_End 1994 0.95 1.28 0.79 171 TR_XM_COVIDMETA1 1968 0.53 1.27 0.17 172 XM_H_Long_From02 1888 0.99 1.22 0.88 173 XM_ProductURIs 1881 1.66 1.21 1.88 174 XMBdyGiftCard01 1840 0.85 1.18 0.68 175 HTTPS_HTTP_MISMATCH 1836 0.89 1.18 0.75 176 PLING_QUERY 1836 0.65 1.18 0.40 177 T_STY_INVIS_DIRECT 1834 0.50 1.18 0.17 178 XM_H_Undi_Recip 1789 0.65 1.15 0.41 179 XM_B_DNDMA 1785 0.69 1.15 0.46 180 BAYES_20 1776 2.70 1.14 3.46 181 DKIM_ADSP_CUSTOM_MED 1759 0.96 1.13 0.88 182 DIET_1 1719 0.68 1.11 0.48 183 HTML_TAG_BALANCE_CENTER 1704 0.43 1.10 0.11 184 XMPhish30 1702 0.78 1.10 0.63 185 HTML_FONT_SIZE_LARGE 1691 0.45 1.09 0.14 186 RELAYCOUNTRY_FR 1683 0.50 1.08 0.22 187 HTML_FONT_FACE_BAD 1673 1.67 1.08 1.95 188 FONT_INVIS_LONG_LINE 1650 0.37 1.06 0.04 189 TR_Mismatch_TLD_02 1621 0.39 1.04 0.08 190 TR_XM_Base64_M1 1617 1.13 1.04 1.17 191 MONEY_NOHTML 1616 0.39 1.04 0.07 192 XMSubMetaI_00 1610 0.59 1.04 0.37 193 MPART_ALT_DIFF_COUNT 1596 0.77 1.03 0.64 194 HTML_IMAGE_ONLY_20 1579 0.89 1.02 0.82 195 FORGED_GMAIL_RCVD 1547 0.66 1.00 0.49 196 TooManyTo_002 1517 1.96 0.98 2.43 197 MIXED_CENTER_CASE 1508 0.32 0.97 0.00 198 TR_XM_COVIDMETA4 1504 0.44 0.97 0.18 199 REMOVE_BEFORE_LINK 1498 0.44 0.96 0.18 200 XMClaimOffer 1491 0.40 0.96 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279928 90.21 95.84 87.48 2 RELAYCOUNTRY_US 257207 80.71 81.39 80.38 3 DKIM_SIGNED 232949 77.69 87.77 72.80 4 XM_DK_Pass 228927 75.92 84.95 71.54 5 XM_B_Unicode 227719 74.68 81.92 71.16 6 DKIM_VALID 225824 74.93 83.92 70.57 7 DCC_CHECK_NEGATIVE 216753 56.13 32.21 67.73 8 BAYES_50 181893 51.51 40.52 56.84 9 DKIM_VALID_AU 176143 57.58 62.80 55.04 10 XMListUnsubscribeExists 156832 55.13 67.74 49.01 11 XM_B_SpammyWords 141249 51.88 67.83 44.14 12 XM_B_Unicode3 135235 43.33 45.52 42.26 13 RCVD_IN_MSPIKE_H2 123549 42.49 50.49 38.61 14 DCC_CHECK 103088 43.83 67.77 32.21 15 T_TM2_M_HEADER_IN_MSG 97335 27.91 22.76 30.42 16 DKIM_VALID_EF 87875 29.19 32.75 27.46 17 HTML_FONT_LOW_CONTRAST 84783 29.30 35.07 26.49 18 FVGT_m_MULTI_ODD 78586 27.06 32.20 24.56 19 LOC_TINY_FONT_1 74029 27.74 37.24 23.13 20 XMSubLong 71965 22.80 23.44 22.49 21 MIME_HTML_ONLY 66297 24.92 33.59 20.72 22 T_KAM_HTML_FONT_INVALID 63004 22.83 29.31 19.69 23 XM_B_SpammyWords2 60557 25.42 38.82 18.92 24 RCVD_IN_MSPIKE_WL 55330 15.57 12.01 17.29 25 ALL_TRUSTED 54387 12.16 2.21 17.00 26 USER_IN_DEF_DKIM_WL 40872 9.39 2.42 12.77 27 XM_Multi_Part_URI 38974 14.16 18.23 12.18 28 XM_Body_Dirty_Words 35901 15.23 23.49 11.22 29 RCVD_IN_MSPIKE_H3 35755 10.55 9.27 11.17 30 XM_DKIMWhitelistDomains 30982 6.54 0.07 9.68 31 BAYES_00 30834 6.78 0.89 9.64 32 XM_B_Unsub 30254 12.11 17.60 9.45 33 BAYES_60 29985 8.78 7.55 9.37 34 LotsOfNums_01 28828 8.38 7.10 9.01 35 TooManyTo_001 25899 7.17 5.27 8.09 36 LOTS_OF_MONEY 24777 9.92 14.40 7.74 37 XM_Evil_Numbers_Gen 24544 7.92 8.43 7.67 38 UNPARSEABLE_RELAY 24022 9.16 12.58 7.51 39 TR_XM_BayesUnsub 23853 10.62 17.14 7.45 40 XM_DK_Undo_02 22775 18.86 43.06 7.12 41 IN_ZIMBRA_NJ_WHITELIST 22113 4.69 0.13 6.91 42 BAYES_99 20816 15.33 33.53 6.50 43 MPART_ALT_DIFF 20639 6.76 7.40 6.45 44 XM_H_Long_From01 19989 6.20 6.10 6.25 45 T_TooManySym_01 19487 4.92 2.52 6.09 46 TR_XM_DK_Bayes 18949 4.22 0.71 5.92 47 TR_XM_UnparsRelay 18911 8.01 12.33 5.91 48 TR_XM_DK_Bayes1 18595 4.14 0.70 5.81 49 RCVD_IN_IADB_LISTED 18515 4.68 2.40 5.79 50 HTML_IMAGE_RATIO_04 18209 5.38 4.73 5.69 51 MIME_QP_LONG_LINE 17898 4.86 3.36 5.59 52 BAYES_999 17126 12.23 26.40 5.35 53 HTML_IMAGE_RATIO_02 17035 5.87 7.00 5.32 54 TR_XM_DK_Bayes2 16605 3.66 0.51 5.19 55 RCVD_IN_IADB_SPF 16385 4.10 2.01 5.12 56 BAYES_40 15997 3.88 1.57 5.00 57 RCVD_IN_MSPIKE_H4 15981 4.14 2.39 4.99 58 XM_PDF 15710 3.56 0.79 4.91 59 TR_XM_SpammyWords4 15667 7.23 12.03 4.90 60 BOTNET_IPINHOSTNAME 15399 7.32 12.50 4.81 61 XM_SendGrid 15229 5.57 7.23 4.76 62 RCVD_IN_VALIDITY_SAFE 15179 4.39 3.68 4.74 63 TR_XM_DKIM_Undo 15150 14.08 33.33 4.73 64 RCVD_IN_IADB_SENDERID 14670 3.69 1.84 4.58 65 XM_B_SpammyWords3 14358 6.76 11.46 4.49 66 MIME_HTML_ONLY_MULTI 14281 4.62 4.96 4.46 67 XM_H_Trusted_IP 14278 3.00 0.00 4.46 68 RCVD_IN_IADB_DK 14255 3.61 1.86 4.45 69 BAYES_80 14139 5.88 8.89 4.42 70 RCVD_IN_VALIDITY_CERTIFIED 13723 3.81 2.82 4.29 71 XMStrtUSub 13439 4.33 4.61 4.20 72 XMSubMetaSx_00 12643 4.91 6.87 3.95 73 T_REMOTE_IMAGE 11616 3.53 3.33 3.63 74 RCVD_IN_IADB_VOUCHED 11520 2.88 1.39 3.60 75 XM_UncommonTLD01 11450 5.04 8.07 3.58 76 BAYES_20 11076 2.70 1.14 3.46 77 RELAYCOUNTRY_META 10855 8.60 19.34 3.39 78 HTML_IMAGE_RATIO_06 10811 3.67 4.26 3.38 79 MAILING_LIST_MULTI 10764 2.91 1.97 3.36 80 T_TooManySym_02 10716 2.47 0.67 3.35 81 TR_XM_PhishingBody 10626 4.35 6.46 3.32 82 XMNumbers 10592 3.39 3.57 3.31 83 XMSexyCombo_05 10311 5.73 10.90 3.22 84 FSL_BULK_SIG 10284 5.81 11.15 3.21 85 TM2_M_URI_OPT_OUT 10174 3.06 2.83 3.18 86 TR_XM_DK_SendGrid 9981 3.57 4.51 3.12 87 XM_B_Phish_Phrases 9904 4.03 5.94 3.09 88 XM_B_SpammyTLD 8997 3.25 4.15 2.81 89 HTML_MIME_NO_HTML_TAG 8679 3.25 4.35 2.71 90 BAYES_95 8496 3.52 5.31 2.65 91 URI_NOVOWEL 8352 2.42 2.02 2.61 92 MIME_HTML_MOSTLY 8108 2.84 3.48 2.53 93 ANY_BOUNCE_MESSAGE 8057 1.98 0.87 2.52 94 BOUNCE_MESSAGE 8055 1.98 0.87 2.52 95 FROM_EXCESS_BASE64 7901 2.39 2.23 2.47 96 TR_XM_SB_Phish 7900 2.46 2.45 2.47 97 RCVD_IN_IADB_OPTIN 7857 1.93 0.85 2.46 98 XMSubPhish11 7815 2.39 2.28 2.44 99 TooManyTo_002 7783 1.96 0.98 2.43 100 DKIM_INVALID 7125 2.76 3.85 2.23 101 HTML_IMAGE_RATIO_08 6858 2.39 2.89 2.14 102 INVALID_MSGID 6783 1.47 0.13 2.12 103 BAYES_05 6765 1.62 0.61 2.11 104 XM_B_Phish66 6658 2.60 3.66 2.08 105 HTML_FONT_FACE_BAD 6247 1.67 1.08 1.95 106 XM_SPF_SoftFail 6131 2.81 4.64 1.92 107 TO_MALFORMED 6052 1.28 0.02 1.89 108 IN_HORDE_ADDRESS_BOOK 6019 1.30 0.11 1.88 109 XM_ProductURIs 6003 1.66 1.21 1.88 110 MSGID_NOFQDN1 5989 1.27 0.03 1.87 111 TR_DCC_Bayes_99 5978 8.58 22.41 1.87 112 TM2_M_VERY_LONG_WORD 5962 2.56 4.01 1.86 113 TVD_RCVD_IP 5831 1.31 0.24 1.82 114 TR_Symld_Words 5813 1.69 1.43 1.82 115 XM_GoogleGroups 5811 1.89 2.04 1.82 116 SUBJ_ALL_CAPS 5755 1.89 2.09 1.80 117 XM_CamelCaseFrm001 5702 2.15 2.92 1.78 118 XMGappySubj_01 5387 1.17 0.13 1.68 119 T_XMDrugObfuBody_14 5238 2.48 4.20 1.64 120 TooManyTo_003 5184 1.36 0.82 1.62 121 XM_B_Investor 5160 2.66 4.80 1.61 122 HELO_NODOT 5151 1.27 0.57 1.61 123 HELO_NO_DOMAIN 5150 1.27 0.57 1.61 124 T_XMDrugObfuBody_08 5015 2.42 4.18 1.57 125 TR_XM_SpammyRelay 4839 5.05 12.35 1.51 126 XMStockSpam_06 4707 1.61 1.91 1.47 127 BOTNET 4642 4.60 11.10 1.45 128 XMBSHREFv2 4607 1.08 0.35 1.44 129 TR_XM_SpammyWords5 4565 2.16 3.68 1.43 130 XM_DK_Undo_01 4536 1.72 2.35 1.42 131 XM_OfRef6 4373 2.24 4.05 1.37 132 UNTRUSTED_Relay 4265 3.45 7.81 1.33 133 XMBody_95 4255 0.93 0.11 1.33 134 XM_B_Unsub2 4225 1.78 2.74 1.32 135 RCVD_IN_MSPIKE_BL 4220 2.43 4.72 1.32 136 TR_XM_MSPIKECOMBO 4210 2.39 4.60 1.32 137 XMDiploma_00 4201 1.75 2.66 1.31 138 KHOP_HELO_FCRDNS 4067 1.63 2.37 1.27 139 XMSubNoVowel 3813 1.10 0.92 1.19 140 TR_XM_Base64_M1 3756 1.13 1.04 1.17 141 TR_XM_SpammyWords2 3719 4.76 12.16 1.16 142 URI_HEX 3685 1.37 1.83 1.15 143 TooManyTo_004 3653 1.00 0.70 1.14 144 RCVD_IN_MSPIKE_H5 3594 0.87 0.35 1.12 145 XMLngstWrd_00 3422 1.33 1.85 1.07 146 XMCapTrack 3373 0.82 0.33 1.05 147 XMLngstWrd_01 3131 1.25 1.81 0.98 148 T_XMDrugObfuBody_00 3097 1.22 1.75 0.97 149 RCVD_IN_RP_SAFE 3017 0.90 0.81 0.94 150 RELAYCOUNTRY_CA 2983 3.22 7.93 0.93 151 XM_H_Long_From02 2826 0.99 1.22 0.88 152 DKIM_ADSP_CUSTOM_MED 2817 0.96 1.13 0.88 153 RCVD_IN_MSPIKE_L3 2809 1.28 2.10 0.88 154 XMLngstWrd_02 2801 1.15 1.72 0.88 155 RCVD_IN_RP_CERTIFIED 2750 0.78 0.61 0.86 156 XM_UB50 2666 1.58 3.13 0.83 157 XMNoVowels 2654 0.68 0.37 0.83 158 T_FILL_THIS_FORM_SHORT 2650 1.57 3.10 0.83 159 HTML_IMAGE_ONLY_20 2639 0.89 1.02 0.82 160 T_TooManySym_03 2564 0.64 0.31 0.80 161 TooManyTo_005 2538 0.62 0.26 0.79 162 XMHTML_After_End 2513 0.95 1.28 0.79 163 HTTPS_HTTP_MISMATCH 2407 0.89 1.18 0.75 164 TR_MetaPhish_Combo_01 2401 0.93 1.32 0.75 165 XM_B_COPY_HTML 2265 0.74 0.79 0.71 166 XM_D_tchamptons_WL 2262 0.49 0.04 0.71 167 XM_RXBody 2256 0.61 0.41 0.70 168 RCVD_IN_PSBL 2249 0.94 1.43 0.70 169 XMLngstWrd_03 2238 1.01 1.65 0.70 170 XMSexyCombo_01 2236 1.32 2.60 0.70 171 FROM_GOV_DKIM_AU 2210 0.52 0.16 0.69 172 SpammyFromTLD_01 2186 1.27 2.47 0.68 173 XMBdyGiftCard01 2178 0.85 1.18 0.68 174 XMLngstWrd_04 2059 0.95 1.59 0.64 175 TVD_SPACE_RATIO 2055 0.47 0.12 0.64 176 MPART_ALT_DIFF_COUNT 2050 0.77 1.03 0.64 177 XMBrknScrpt_02 2038 0.92 1.51 0.64 178 T_OBFU_PDF_ATTACH 2027 0.47 0.13 0.63 179 XMGenDplmaNmb 2025 0.90 1.44 0.63 180 TM2_M_A_HREF_HREF 2016 0.88 1.40 0.63 181 XMPhish30 2013 0.78 1.10 0.63 182 BASE64_LENGTH_79_INF 1944 0.60 0.58 0.61 183 XM_ShortIntro_01 1940 0.53 0.38 0.61 184 XMSubMetaSxObfu_02 1898 0.57 0.54 0.59 185 HTML_TAG_BALANCE_BODY 1891 0.91 1.56 0.59 186 URI_TRY_3LD 1855 0.83 1.35 0.58 187 XMHTMLBadTable_001 1847 0.63 0.75 0.58 188 XM_H_PHPMailer 1834 0.61 0.70 0.57 189 T_Symld_Words_02 1776 0.63 0.78 0.55 190 SpammyFromTLD_02 1770 1.52 3.52 0.55 191 RCVD_IN_BL_SPAMCOP_NET 1760 3.78 10.42 0.55 192 TR_XM_SpammyWords3 1757 1.27 2.76 0.55 193 UPPERCASE_75_100 1720 0.89 1.61 0.54 194 HTML_TITLE_SUBJ_DIFF 1715 0.87 1.55 0.54 195 XM_B_COVIDMETA 1677 0.95 1.83 0.52 196 NML_ADSP_CUSTOM_MED 1659 0.58 0.71 0.52 197 T_XMHurry_00 1648 1.16 2.48 0.51 198 SHORT_HELO_AND_INLINE_IMAGE 1593 0.36 0.07 0.50 199 FORGED_GMAIL_RCVD 1577 0.66 1.00 0.49 200 TVD_SPACE_RATIO_MINFP 1575 0.39 0.17 0.49 ----------------------------------------------------------------------