Email: 514877 Autolearn: 0 AvgScore: 4.05 AvgScanTime: 1.48 sec Spam: 166443 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.67 sec Ham: 348434 Autolearn: 0 AvgScore: -0.73 AvgScanTime: 1.39 sec Time Spent Running SA: 211.95 hours Time Spent Processing Spam: 77.35 hours Time Spent Processing Ham: 134.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159384 88.76 95.76 85.42 2 DKIM_SIGNED 149254 80.23 89.67 75.71 3 XM_DK_Pass 145603 78.49 87.48 74.20 4 DKIM_VALID 144321 77.57 86.71 73.20 5 XM_B_Unicode 140380 74.61 84.34 69.96 6 RELAYCOUNTRY_US 135592 81.44 81.46 81.43 7 DCC_CHECK 120383 45.49 72.33 32.67 8 XMListUnsubscribeExists 116202 55.61 69.81 48.82 9 XM_B_SpammyWords 116133 52.24 69.77 43.87 10 DKIM_VALID_AU 107250 58.00 64.44 54.93 11 RCVD_IN_MSPIKE_H2 79944 43.31 48.03 41.05 12 XM_B_Unicode3 75972 42.29 45.64 40.69 13 BAYES_50 72397 52.23 43.50 56.40 14 XM_DK_Undo_02 67824 17.30 40.75 6.10 15 XM_B_SpammyWords2 65908 24.53 39.60 17.33 16 LOC_TINY_FONT_1 61512 27.69 36.96 23.26 17 FVGT_m_MULTI_ODD 58586 27.85 35.20 24.34 18 DKIM_VALID_EF 56040 29.58 33.67 27.62 19 HTML_FONT_LOW_CONTRAST 56012 28.77 33.65 26.44 20 TR_XM_DKIM_Undo 55140 13.52 33.13 4.15 21 MIME_HTML_ONLY 53673 23.76 32.25 19.71 22 BAYES_99 51686 13.54 31.05 5.18 23 T_KAM_HTML_FONT_INVALID 50696 23.04 30.46 19.49 24 DCC_CHECK_NEGATIVE 46016 54.47 27.65 67.28 25 BAYES_999 40491 10.70 24.33 4.19 26 XMSubLong 39978 21.90 24.02 20.89 27 XM_Body_Dirty_Words 36099 14.25 21.69 10.70 28 TR_DCC_Bayes_99 35613 7.87 21.40 1.41 29 T_TM2_M_HEADER_IN_MSG 35394 26.78 21.26 29.42 30 RELAYCOUNTRY_META 32759 8.85 19.68 3.68 31 XM_Multi_Part_URI 29706 13.76 17.85 11.81 32 XM_B_Unsub 27297 11.21 16.40 8.73 33 TR_XM_BayesUnsub 26653 9.71 16.01 6.70 34 LOTS_OF_MONEY 24525 9.57 14.73 7.10 35 BOTNET_IPINHOSTNAME 23078 7.65 13.87 4.68 36 RCVD_IN_MSPIKE_WL 22965 16.32 13.80 17.52 37 TR_XM_SpammyRelay 22842 5.59 13.72 1.71 38 XM_B_SpammyWords3 22831 6.99 13.72 3.78 39 UNPARSEABLE_RELAY 21605 9.55 12.98 7.91 40 TR_XM_UnparsRelay 21139 8.29 12.70 6.18 41 TR_XM_SpammyWords4 20746 6.99 12.46 4.37 42 TR_XM_SpammyWords2 19406 4.25 11.66 0.72 43 FSL_BULK_SIG 18834 5.75 11.32 3.09 44 BOTNET 18106 4.53 10.88 1.49 45 RCVD_IN_BL_SPAMCOP_NET 17613 3.69 10.58 0.40 46 RCVD_IN_MSPIKE_H3 16112 10.87 9.68 11.44 47 XMSexyCombo_05 16078 5.45 9.66 3.45 48 XM_Evil_Numbers_Gen 15651 8.31 9.40 7.78 49 RELAYCOUNTRY_CA 14035 3.48 8.43 1.12 50 BAYES_80 13562 5.32 8.15 3.97 51 LotsOfNums_01 13544 8.84 8.14 9.18 52 BAYES_60 13273 8.52 7.97 8.79 53 UNTRUSTED_Relay 12965 3.36 7.79 1.24 54 MPART_ALT_DIFF 12602 6.01 7.57 5.27 55 TR_XM_SPAMCOP 12184 2.52 7.32 0.23 56 XM_SendGrid 12034 5.90 7.23 5.26 57 TR_XM_PhishingBody 11624 4.65 6.98 3.54 58 XM_UncommonTLD01 11609 4.79 6.97 3.75 59 XM_H_Long_From01 11212 5.80 6.74 5.36 60 XM_B_SpammyTLD 10694 4.23 6.43 3.18 61 XMSubMetaSx_00 10685 4.15 6.42 3.07 62 HTML_IMAGE_RATIO_02 10554 5.85 6.34 5.61 63 XM_B_Phish_Phrases 10386 4.10 6.24 3.08 64 T_XMDrugObfuBody_08 8827 2.82 5.30 1.63 65 TM2_M_VERY_LONG_WORD 8336 2.30 5.01 1.00 66 XM_SPF_SoftFail 8329 2.87 5.00 1.85 67 XM_B_Investor 8253 2.66 4.96 1.57 68 MIME_HTML_ONLY_MULTI 8217 3.72 4.94 3.15 69 BAYES_95 8114 3.29 4.87 2.53 70 TR_XM_SpammyWords5 7798 2.60 4.69 1.61 71 TR_XM_DK_SendGrid 7790 3.78 4.68 3.35 72 T_XMDrugObfuBody_14 7681 2.41 4.61 1.35 73 TooManyTo_001 7646 6.97 4.59 8.10 74 RCVD_IN_VALIDITY_RPBL 7466 1.51 4.49 0.09 75 HTML_IMAGE_RATIO_04 7337 4.90 4.41 5.13 76 RCVD_IN_MSPIKE_BL 7264 2.16 4.36 1.11 77 XMNumbers 7082 3.64 4.25 3.35 78 TR_XM_MSPIKECOMBO 7067 2.12 4.25 1.10 79 PDS_OTHER_BAD_TLD 6980 1.45 4.19 0.13 80 XMStrtUSub 6822 4.37 4.10 4.50 81 XM_B_Phish66 6597 2.49 3.96 1.78 82 RCVD_IN_MSPIKE_H4 6527 4.61 3.92 4.94 83 XM_UB50 6428 1.78 3.86 0.79 84 XMBody_17 6425 1.51 3.86 0.38 85 XM_DIRTYINTL 6392 1.49 3.84 0.37 86 MIME_QP_LONG_LINE 6337 4.98 3.81 5.55 87 T_REMOTE_IMAGE 6324 3.80 3.80 3.80 88 HTML_MIME_NO_HTML_TAG 6252 2.41 3.76 1.76 89 XM_OfRef6 6132 1.97 3.68 1.15 90 T_FILL_THIS_FORM_SHORT 6078 1.89 3.65 1.05 91 URIBL_DBL_SPAM 5672 1.11 3.41 0.01 92 MIME_HTML_MOSTLY 5651 2.99 3.40 2.80 93 HTML_IMAGE_RATIO_06 5631 3.35 3.38 3.34 94 RCVD_IN_VALIDITY_SAFE 5441 4.19 3.27 4.63 95 HTML_IMAGE_RATIO_08 5152 2.40 3.10 2.06 96 XM_CamelCaseFrm001 5135 2.28 3.09 1.90 97 TM2_M_URI_OPT_OUT 4944 2.63 2.97 2.47 98 DKIM_INVALID 4933 2.66 2.96 2.51 99 XM_DK_Undo_01 4803 1.98 2.89 1.54 100 XM_B_Unsub2 4758 1.82 2.86 1.32 101 SpammyFromTLD_01 4693 1.43 2.82 0.77 102 XMLngstWrd_00 4672 1.19 2.81 0.42 103 XMDiploma_00 4664 1.94 2.80 1.52 104 XMLngstWrd_01 4586 1.12 2.76 0.35 105 XMLngstWrd_02 4492 1.04 2.70 0.25 106 XMLngstWrd_03 4263 0.94 2.56 0.17 107 URI_NOVOWEL 4257 2.78 2.56 2.89 108 RCVD_IN_IADB_LISTED 4253 4.72 2.56 5.75 109 XM_GoogleGroups 4201 1.74 2.52 1.36 110 XMLngstWrd_04 4199 0.89 2.52 0.11 111 T_TooManySym_01 4089 4.91 2.46 6.08 112 RCVD_IN_VALIDITY_CERTIFIED 4072 3.53 2.45 4.05 113 BOTNET_NORDNS 3952 0.78 2.37 0.01 114 T_XMHurry_00 3948 1.19 2.37 0.63 115 RCVD_IN_MSPIKE_L3 3923 1.44 2.36 1.00 116 SUBJ_ALL_CAPS 3871 1.84 2.33 1.60 117 SpammyFromTLD_02 3827 1.05 2.30 0.46 118 URI_PHP_REDIR 3707 0.72 2.23 0.00 119 HTML_TITLE_SUBJ_DIFF 3702 0.75 2.22 0.04 120 USER_IN_DEF_DKIM_WL 3669 8.84 2.20 12.01 121 TR_XM_SpammyWords3 3613 1.01 2.17 0.45 122 FROM_EXCESS_BASE64 3581 2.47 2.15 2.62 123 RCVD_IN_IADB_SPF 3466 4.12 2.08 5.10 124 XMStockSpam_06 3402 1.55 2.04 1.32 125 UPPERCASE_75_100 3372 0.67 2.03 0.03 126 XM_B_SpammyWords4 3333 1.04 2.00 0.59 127 FONT_INVIS_LONG_LINE 3267 0.72 1.96 0.13 128 RCVD_IN_IADB_DK 3242 3.61 1.95 4.40 129 MAILING_LIST_MULTI 3224 2.57 1.94 2.87 130 XM_B_COVIDMETA 3194 0.88 1.92 0.39 131 T_XMDrugObfuBody_00 3191 1.07 1.92 0.66 132 RCVD_IN_IADB_SENDERID 3188 3.70 1.92 4.56 133 BAYES_40 3167 4.26 1.90 5.39 134 TR_XM_PHPDW 3095 0.82 1.86 0.32 135 URI_HEX 3081 1.43 1.85 1.23 136 XM_H_Undi_Recip 3078 0.77 1.85 0.26 137 XMSexyCombo_01 3014 0.84 1.81 0.38 138 TR_XM_PHPForged 3013 0.78 1.81 0.29 139 TR_XM_FormFill 3005 0.59 1.81 0.01 140 TR_XM_FormFill2 2972 0.78 1.79 0.29 141 TR_XM_NoHeaderRelay 2966 0.67 1.78 0.14 142 XM_H_PHPOS 2961 0.77 1.78 0.28 143 TR_XM_SB_Phish 2865 1.90 1.72 1.98 144 RCVD_IN_PSBL 2824 0.99 1.70 0.66 145 MPART_ALT_DIFF_COUNT 2822 0.95 1.70 0.59 146 TR_XM_MSPIKECOMBO2 2808 0.66 1.69 0.16 147 RCVD_IN_MSPIKE_L5 2800 0.57 1.68 0.04 148 HTML_IMAGE_ONLY_24 2800 0.81 1.68 0.39 149 HTTPS_HTTP_MISMATCH 2681 1.13 1.61 0.90 150 HK_RANDOM_REPLYTO 2665 0.59 1.60 0.10 151 XM_URI_RBL 2662 0.61 1.60 0.13 152 ALL_TRUSTED 2648 11.14 1.59 15.70 153 TR_LOTS_OF_MONEY3 2579 0.66 1.55 0.23 154 XMSubPhish11 2576 1.82 1.55 1.95 155 TR_XM_COVIDMETA4 2570 0.64 1.54 0.20 156 XMGenDplmaNmb 2569 1.11 1.54 0.91 157 XMHTML_After_End 2486 1.51 1.49 1.52 158 XMBdyGiftCard01 2466 0.99 1.48 0.75 159 RCVD_IN_IADB_VOUCHED 2431 2.85 1.46 3.52 160 XM_Body_Dirty_Words_01 2367 0.57 1.42 0.17 161 TR_XM_COVIDMETA1 2332 0.78 1.40 0.49 162 XMBrknScrpt_02 2330 0.82 1.40 0.54 163 URIBL_BLACK 2327 0.49 1.40 0.05 164 XM_UB99 2310 0.45 1.39 0.00 165 TR_Symld_Words 2141 1.51 1.29 1.62 166 TR_XM_BayesRelay 2128 0.42 1.28 0.00 167 XM_H_Long_From02 2116 1.29 1.27 1.29 168 RELAYCOUNTRY_AU 2081 0.62 1.25 0.32 169 XMPhish30 1999 1.10 1.20 1.05 170 XMSubMetaI_00 1985 0.72 1.19 0.49 171 RELAYCOUNTRY_RU 1965 0.41 1.18 0.04 172 BAYES_20 1932 3.35 1.16 4.40 173 RELAYCOUNTRY_FR 1903 0.51 1.14 0.21 174 TR_XM_MaxSPIKE 1892 0.47 1.14 0.15 175 HTTP_EXCESSIVE_ESCAPES 1834 0.36 1.10 0.00 176 KHOP_HELO_FCRDNS 1832 1.27 1.10 1.35 177 XMReplyNow 1818 0.54 1.09 0.27 178 XM_UB999 1816 0.35 1.09 0.00 179 REMOVE_BEFORE_LINK 1803 0.48 1.08 0.19 180 HTML_TAG_BALANCE_BODY 1745 0.80 1.05 0.68 181 TR_XM_Base64_M1 1707 0.86 1.03 0.79 182 TM2_M_A_HREF_HREF 1700 0.57 1.02 0.36 183 T_Symld_Words_02 1663 0.74 1.00 0.62 184 XM_B_SEO 1646 0.40 0.99 0.13 185 DKIM_ADSP_NXDOMAIN 1638 0.58 0.98 0.38 186 TR_XM_SEO4 1616 0.37 0.97 0.08 187 XMGppyBdWords 1556 0.38 0.93 0.12 188 URI_TRY_3LD 1534 0.66 0.92 0.53 189 TR_XM_RelayPhish 1500 0.32 0.90 0.05 190 DKIM_ADSP_CUSTOM_MED 1491 0.92 0.90 0.93 191 DIET_1 1490 0.52 0.90 0.34 192 XMMoneyMeta_00 1475 0.57 0.89 0.42 193 XMPhish08 1460 0.45 0.88 0.24 194 XM_UB60 1452 0.33 0.87 0.08 195 RCVD_IN_RP_RNBL 1448 0.29 0.87 0.02 196 SHOPIFY_IMG_NOT_RCVD_SFY 1441 0.41 0.87 0.20 197 SUBJ_DOLLARS 1441 0.46 0.87 0.27 198 XM_PDF 1398 3.23 0.84 4.37 199 XM_TLDProd2 1394 0.41 0.84 0.21 200 TR_LOTS_OF_MONEY2 1371 0.36 0.82 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297645 88.76 95.76 85.42 2 RELAYCOUNTRY_US 283728 81.44 81.46 81.43 3 DKIM_SIGNED 263815 80.23 89.67 75.71 4 XM_DK_Pass 258533 78.49 87.48 74.20 5 DKIM_VALID 255054 77.57 86.71 73.20 6 XM_B_Unicode 243763 74.61 84.34 69.96 7 DCC_CHECK_NEGATIVE 234426 54.47 27.65 67.28 8 BAYES_50 196534 52.23 43.50 56.40 9 DKIM_VALID_AU 191384 58.00 64.44 54.93 10 XMListUnsubscribeExists 170101 55.61 69.81 48.82 11 XM_B_SpammyWords 152859 52.24 69.77 43.87 12 RCVD_IN_MSPIKE_H2 143038 43.31 48.03 41.05 13 XM_B_Unicode3 141787 42.29 45.64 40.69 14 DCC_CHECK 113846 45.49 72.33 32.67 15 T_TM2_M_HEADER_IN_MSG 102499 26.78 21.26 29.42 16 DKIM_VALID_EF 96244 29.58 33.67 27.62 17 HTML_FONT_LOW_CONTRAST 92134 28.77 33.65 26.44 18 FVGT_m_MULTI_ODD 84815 27.85 35.20 24.34 19 LOC_TINY_FONT_1 81040 27.69 36.96 23.26 20 XMSubLong 72796 21.90 24.02 20.89 21 MIME_HTML_ONLY 68659 23.76 32.25 19.71 22 T_KAM_HTML_FONT_INVALID 67916 23.04 30.46 19.49 23 RCVD_IN_MSPIKE_WL 61062 16.32 13.80 17.52 24 XM_B_SpammyWords2 60399 24.53 39.60 17.33 25 ALL_TRUSTED 54719 11.14 1.59 15.70 26 USER_IN_DEF_DKIM_WL 41861 8.84 2.20 12.01 27 XM_Multi_Part_URI 41136 13.76 17.85 11.81 28 RCVD_IN_MSPIKE_H3 39878 10.87 9.68 11.44 29 XM_Body_Dirty_Words 37281 14.25 21.69 10.70 30 BAYES_00 36258 7.28 0.74 10.41 31 LotsOfNums_01 31981 8.84 8.14 9.18 32 BAYES_60 30614 8.52 7.97 8.79 33 XM_B_Unsub 30415 11.21 16.40 8.73 34 XM_DKIMWhitelistDomains 29546 5.76 0.06 8.48 35 TooManyTo_001 28228 6.97 4.59 8.10 36 UNPARSEABLE_RELAY 27575 9.55 12.98 7.91 37 XM_Evil_Numbers_Gen 27110 8.31 9.40 7.78 38 LOTS_OF_MONEY 24751 9.57 14.73 7.10 39 TR_XM_DK_Bayes 23595 4.75 0.53 6.77 40 IN_ZIMBRA_NJ_WHITELIST 23529 4.60 0.09 6.75 41 TR_XM_BayesUnsub 23362 9.71 16.01 6.70 42 TR_XM_DK_Bayes1 23265 4.68 0.51 6.68 43 TR_XM_UnparsRelay 21524 8.29 12.70 6.18 44 XM_DK_Undo_02 21251 17.30 40.75 6.10 45 T_TooManySym_01 21179 4.91 2.46 6.08 46 RCVD_IN_IADB_LISTED 20029 4.72 2.56 5.75 47 HTML_IMAGE_RATIO_02 19563 5.85 6.34 5.61 48 MIME_QP_LONG_LINE 19325 4.98 3.81 5.55 49 BAYES_40 18779 4.26 1.90 5.39 50 XM_H_Long_From01 18661 5.80 6.74 5.36 51 TR_XM_DK_Bayes2 18638 3.77 0.48 5.35 52 MPART_ALT_DIFF 18353 6.01 7.57 5.27 53 XM_SendGrid 18320 5.90 7.23 5.26 54 BAYES_99 18046 13.54 31.05 5.18 55 HTML_IMAGE_RATIO_04 17883 4.90 4.41 5.13 56 RCVD_IN_IADB_SPF 17754 4.12 2.08 5.10 57 RCVD_IN_MSPIKE_H4 17230 4.61 3.92 4.94 58 BOTNET_IPINHOSTNAME 16320 7.65 13.87 4.68 59 RCVD_IN_VALIDITY_SAFE 16122 4.19 3.27 4.63 60 RCVD_IN_IADB_SENDERID 15877 3.70 1.92 4.56 61 XMStrtUSub 15663 4.37 4.10 4.50 62 RCVD_IN_IADB_DK 15344 3.61 1.95 4.40 63 BAYES_20 15341 3.35 1.16 4.40 64 XM_PDF 15233 3.23 0.84 4.37 65 TR_XM_SpammyWords4 15228 6.99 12.46 4.37 66 BAYES_999 14609 10.70 24.33 4.19 67 TR_XM_DKIM_Undo 14460 13.52 33.13 4.15 68 RCVD_IN_VALIDITY_CERTIFIED 14109 3.53 2.45 4.05 69 BAYES_80 13830 5.32 8.15 3.97 70 T_REMOTE_IMAGE 13240 3.80 3.80 3.80 71 XM_B_SpammyWords3 13173 6.99 13.72 3.78 72 XM_UncommonTLD01 13070 4.79 6.97 3.75 73 RELAYCOUNTRY_META 12827 8.85 19.68 3.68 74 TR_XM_PhishingBody 12343 4.65 6.98 3.54 75 RCVD_IN_IADB_VOUCHED 12259 2.85 1.46 3.52 76 XMSexyCombo_05 12008 5.45 9.66 3.45 77 TR_XM_DK_SendGrid 11674 3.78 4.68 3.35 78 XMNumbers 11663 3.64 4.25 3.35 79 HTML_IMAGE_RATIO_06 11635 3.35 3.38 3.34 80 T_TooManySym_02 11318 2.46 0.80 3.25 81 XM_B_SpammyTLD 11091 4.23 6.43 3.18 82 MIME_HTML_ONLY_MULTI 10961 3.72 4.94 3.15 83 FSL_BULK_SIG 10769 5.75 11.32 3.09 84 XM_B_Phish_Phrases 10724 4.10 6.24 3.08 85 XMSubMetaSx_00 10685 4.15 6.42 3.07 86 BAYES_05 10195 2.19 0.65 2.93 87 URI_NOVOWEL 10053 2.78 2.56 2.89 88 MAILING_LIST_MULTI 9993 2.57 1.94 2.87 89 MIME_HTML_MOSTLY 9769 2.99 3.40 2.80 90 FROM_EXCESS_BASE64 9129 2.47 2.15 2.62 91 BAYES_95 8829 3.29 4.87 2.53 92 DKIM_INVALID 8761 2.66 2.96 2.51 93 TM2_M_URI_OPT_OUT 8623 2.63 2.97 2.47 94 T_HTML_ATTACH 8278 1.66 0.16 2.38 95 RCVD_IN_IADB_OPTIN 8126 1.84 0.81 2.33 96 XM_H_Trusted_IP 7975 1.55 0.00 2.29 97 TooManyTo_002 7841 1.71 0.59 2.25 98 HTML_IMAGE_RATIO_08 7188 2.40 3.10 2.06 99 ANY_BOUNCE_MESSAGE 7185 1.58 0.57 2.06 100 BOUNCE_MESSAGE 7183 1.58 0.57 2.06 101 INVALID_MSGID 6931 1.41 0.21 1.99 102 TR_XM_SB_Phish 6910 1.90 1.72 1.98 103 XMSubPhish11 6802 1.82 1.55 1.95 104 XM_CamelCaseFrm001 6606 2.28 3.09 1.90 105 XM_SPF_SoftFail 6454 2.87 5.00 1.85 106 IN_HORDE_ADDRESS_BOOK 6225 1.25 0.14 1.79 107 XM_B_Phish66 6217 2.49 3.96 1.78 108 HTML_MIME_NO_HTML_TAG 6134 2.41 3.76 1.76 109 TVD_RCVD_IP 6036 1.27 0.29 1.73 110 HELO_NODOT 6026 1.39 0.69 1.73 111 HELO_NO_DOMAIN 6022 1.39 0.69 1.73 112 MSGID_NOFQDN1 5950 1.16 0.02 1.71 113 TO_MALFORMED 5946 1.27 0.36 1.71 114 TR_XM_SpammyRelay 5944 5.59 13.72 1.71 115 T_XMDrugObfuBody_08 5669 2.82 5.30 1.63 116 TR_Symld_Words 5653 1.51 1.29 1.62 117 TR_XM_SpammyWords5 5597 2.60 4.69 1.61 118 SUBJ_ALL_CAPS 5582 1.84 2.33 1.60 119 XM_B_Investor 5460 2.66 4.96 1.57 120 XM_DK_Undo_01 5371 1.98 2.89 1.54 121 XMDiploma_00 5313 1.94 2.80 1.52 122 XMHTML_After_End 5287 1.51 1.49 1.52 123 BOTNET 5209 4.53 10.88 1.49 124 TooManyTo_003 5188 1.14 0.41 1.49 125 TR_DCC_Bayes_99 4917 7.87 21.40 1.41 126 XM_GoogleGroups 4734 1.74 2.52 1.36 127 T_XMDrugObfuBody_14 4717 2.41 4.61 1.35 128 KHOP_HELO_FCRDNS 4689 1.27 1.10 1.35 129 XMBody_95 4668 0.96 0.17 1.34 130 XMGappySubj_01 4647 0.94 0.12 1.33 131 XM_B_Unsub2 4616 1.82 2.86 1.32 132 XMStockSpam_06 4594 1.55 2.04 1.32 133 XM_H_Long_From02 4508 1.29 1.27 1.29 134 UNTRUSTED_Relay 4324 3.36 7.79 1.24 135 XMBSHREFv2 4303 1.08 0.75 1.23 136 URI_HEX 4300 1.43 1.85 1.23 137 XMCapTrack 4143 0.91 0.33 1.19 138 XM_OfRef6 4022 1.97 3.68 1.15 139 RCVD_IN_MSPIKE_H5 3954 0.83 0.20 1.13 140 RELAYCOUNTRY_CA 3900 3.48 8.43 1.12 141 RCVD_IN_MSPIKE_BL 3870 2.16 4.36 1.11 142 TR_XM_MSPIKECOMBO 3829 2.12 4.25 1.10 143 TooManyTo_004 3669 0.82 0.32 1.05 144 XMPhish30 3666 1.10 1.20 1.05 145 T_FILL_THIS_FORM_SHORT 3644 1.89 3.65 1.05 146 TM2_M_VERY_LONG_WORD 3492 2.30 5.01 1.00 147 RCVD_IN_MSPIKE_L3 3475 1.44 2.36 1.00 148 TR_MetaPhish_Combo_01 3377 0.91 0.78 0.97 149 HTML_FONT_FACE_BAD 3375 0.90 0.75 0.97 150 DKIM_ADSP_CUSTOM_MED 3238 0.92 0.90 0.93 151 RCVD_IN_RP_SAFE 3184 0.81 0.59 0.91 152 XMGenDplmaNmb 3154 1.11 1.54 0.91 153 HTTPS_HTTP_MISMATCH 3147 1.13 1.61 0.90 154 TooManyTo_005 2962 0.66 0.28 0.85 155 T_TooManySym_03 2841 0.63 0.25 0.82 156 TVD_SPACE_RATIO 2809 0.57 0.09 0.81 157 RCVD_IN_RP_CERTIFIED 2801 0.69 0.44 0.80 158 TR_XM_Base64_M1 2746 0.86 1.03 0.79 159 XMSubNoVowel 2746 0.71 0.54 0.79 160 XM_UB50 2739 1.78 3.86 0.79 161 SpammyFromTLD_01 2682 1.43 2.82 0.77 162 XMBdyGiftCard01 2607 0.99 1.48 0.75 163 TR_XM_SpammyWords2 2492 4.25 11.66 0.72 164 HTML_TAG_BALANCE_BODY 2365 0.80 1.05 0.68 165 T_XMDrugObfuBody_00 2306 1.07 1.92 0.66 166 RCVD_IN_PSBL 2285 0.99 1.70 0.66 167 FROM_GOV_DKIM_AU 2237 0.51 0.23 0.64 168 XM_ShortIntro_01 2233 0.55 0.37 0.64 169 T_XMHurry_00 2186 1.19 2.37 0.63 170 T_Symld_Words_02 2143 0.74 1.00 0.62 171 HTML_IMAGE_ONLY_20 2133 0.56 0.44 0.61 172 RELAYCOUNTRY_GB 2089 0.63 0.69 0.60 173 T_OBFU_PDF_ATTACH 2085 0.46 0.17 0.60 174 MPART_ALT_DIFF_COUNT 2046 0.95 1.70 0.59 175 XM_B_SpammyWords4 2044 1.04 2.00 0.59 176 XMNoVowels 2024 0.60 0.65 0.58 177 XM_B_COPY_HTML 1961 0.57 0.58 0.56 178 SHORT_HELO_AND_INLINE_IMAGE 1927 0.40 0.09 0.55 179 NML_ADSP_CUSTOM_MED 1919 0.59 0.68 0.55 180 XMBrknScrpt_02 1876 0.82 1.40 0.54 181 URI_TRY_3LD 1855 0.66 0.92 0.53 182 XM_H_PHPMailer 1845 0.59 0.71 0.53 183 RCVD_IN_SORBS_DUL 1778 0.54 0.61 0.51 184 FORGED_GMAIL_RCVD 1774 0.60 0.78 0.51 185 XMSubMetaI_00 1714 0.72 1.19 0.49 186 TR_XM_COVIDMETA1 1694 0.78 1.40 0.49 187 FILL_THIS_FORM 1678 0.45 0.38 0.48 188 XMHTMLBadTable_001 1658 0.58 0.78 0.48 189 TO_NO_BRKTS_HTML_ONLY 1625 0.36 0.15 0.47 190 XM_ProductURIs 1617 0.50 0.57 0.46 191 XMOemUri 1611 0.37 0.19 0.46 192 SpammyFromTLD_02 1589 1.05 2.30 0.46 193 TR_XM_SpammyWords3 1585 1.01 2.17 0.45 194 BASE64_LENGTH_79_INF 1571 0.37 0.19 0.45 195 HTML_IMAGE_ONLY_32 1552 0.38 0.25 0.45 196 MSGID_FROM_MTA_HEADER 1530 0.35 0.15 0.44 197 XM_D_tchamptons_WL 1528 0.30 0.02 0.44 198 HTML_IMAGE_ONLY_28 1516 0.46 0.52 0.44 199 XMMoneyMeta_00 1476 0.57 0.89 0.42 200 XMLngstWrd_00 1451 1.19 2.81 0.42 ----------------------------------------------------------------------