Email: 465086 Autolearn: 0 AvgScore: 1.82 AvgScanTime: 2.32 sec Spam: 92543 Autolearn: 0 AvgScore: 11.52 AvgScanTime: 3.02 sec Ham: 372543 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 2.15 sec Time Spent Running SA: 299.95 hours Time Spent Processing Spam: 77.59 hours Time Spent Processing Ham: 222.37 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87572 91.26 94.63 90.42 2 DKIM_SIGNED 80107 85.15 86.56 84.80 3 XM_DK_Pass 76825 83.47 83.02 83.59 4 DCC_CHECK 76764 61.38 82.95 56.02 5 XM_B_Unicode 74880 77.07 80.91 76.12 6 DKIM_VALID 72421 80.24 78.26 80.73 7 XMListUnsubscribeExists 70905 67.68 76.62 65.45 8 DKIM_VALID_AU 57687 63.23 62.34 63.45 9 XM_B_Unicode3 49383 49.91 53.36 49.06 10 BAYES_50 42239 54.20 45.64 56.33 11 XM_DK_Undo_02 36011 13.72 38.91 7.47 12 LOC_TINY_FONT_1 35840 33.37 38.73 32.04 13 HTML_FONT_LOW_CONTRAST 31840 35.65 34.41 35.96 14 FVGT_m_MULTI_ODD 29532 25.21 31.91 23.54 15 MIME_HTML_ONLY 27286 26.49 29.48 25.74 16 BAYES_99 25390 8.54 27.44 3.85 17 XM_Body_Dirty_Words 23729 16.64 25.64 14.40 18 XM_Multi_Part_URI 23368 17.50 25.25 15.58 19 XMSubLong 21697 21.51 23.45 21.03 20 T_KAM_HTML_FONT_INVALID 20478 19.32 22.13 18.62 21 TR_DCC_Bayes_99 20377 5.83 22.02 1.81 22 BAYES_999 19911 6.69 21.52 3.01 23 MultiRelay 19329 16.44 20.89 15.34 24 DKIM_VALID_EF 18658 25.90 20.16 27.33 25 HTML_IMAGE_RATIO_02 17560 14.29 18.97 13.13 26 BOTNET_IPINHOSTNAME 16978 8.05 18.35 5.50 27 RELAYCOUNTRY_META 16867 7.33 18.23 4.62 28 BOTNET 16795 5.33 18.15 2.14 29 T_TM2_M_HEADER_IN_MSG 16391 20.72 17.71 21.47 30 DCC_CHECK_NEGATIVE 14418 37.36 15.58 42.76 31 XM_Evil_Numbers_Gen 13811 12.80 14.92 12.28 32 LOTS_OF_MONEY 13488 11.04 14.57 10.17 33 FSL_BULK_SIG 10358 8.25 11.19 7.52 34 UNTRUSTED_Relay 10105 3.66 10.92 1.86 35 XM_B_Unsub 9872 12.54 10.67 13.01 36 XM_B_Phish_Phrases 9454 8.00 10.22 7.44 37 XMSexyCombo_05 9189 6.32 9.93 5.42 38 MPART_ALT_DIFF 9183 5.58 9.92 4.50 39 XM_UncommonTLD01 8647 4.37 9.34 3.13 40 T_XMDrugObfuBody_14 8574 8.67 9.26 8.53 41 XM_DIRTYINTL 8256 4.00 8.92 2.78 42 XM_SendGrid 8029 8.42 8.68 8.35 43 HTML_IMAGE_RATIO_04 7931 7.95 8.57 7.80 44 DKIM_INVALID 7686 4.91 8.31 4.06 45 LotsOfNums_01 7246 8.90 7.83 9.17 46 XM_H_Long_From01 6897 6.89 7.45 6.75 47 XMSubMetaSx_00 6709 4.50 7.25 3.82 48 MIME_HTML_MOSTLY 6566 4.81 7.10 4.24 49 XM_UB50 6161 2.07 6.66 0.93 50 BAYES_80 6142 3.74 6.64 3.02 51 TooManyTo_001 6018 5.84 6.50 5.68 52 RCVD_IN_MSPIKE_H2 5471 7.15 5.91 7.45 53 MIME_QP_LONG_LINE 5358 5.58 5.79 5.53 54 XM_B_SpammyTLD 5238 2.58 5.66 1.82 55 MIME_HTML_ONLY_MULTI 5208 2.79 5.63 2.09 56 BAYES_60 5091 5.73 5.50 5.79 57 TR_XM_DK_SendGrid 4736 4.31 5.12 4.11 58 XMBdyGiftCard01 4659 3.43 5.03 3.03 59 HTML_IMAGE_RATIO_06 4543 3.54 4.91 3.20 60 FROM_EXCESS_BASE64 4283 4.83 4.63 4.88 61 TM2_M_VERY_LONG_WORD 4202 1.90 4.54 1.24 62 RCVD_IN_BL_SPAMCOP_NET 4123 2.29 4.46 1.75 63 XMNumbers 4112 3.48 4.44 3.24 64 TR_XM_RelayPhish 3916 1.88 4.23 1.29 65 URI_HEX 3864 2.63 4.18 2.25 66 XMStrtUSub 3786 4.93 4.09 5.14 67 SpammyFromTLD_02 3709 0.95 4.01 0.19 68 XMStockSpam_06 3627 2.02 3.92 1.54 69 TM2_M_URI_OPT_OUT 3481 2.90 3.76 2.69 70 XMBody_17 3413 1.49 3.69 0.95 71 T_TooManySym_01 3337 4.98 3.61 5.32 72 BAYES_95 3269 2.18 3.53 1.84 73 BAYES_40 3129 4.34 3.38 4.57 74 T_XMHurry_00 3095 1.67 3.34 1.25 75 RELAYCOUNTRY_CA 3019 1.96 3.26 1.63 76 T_REMOTE_IMAGE 2888 2.98 3.12 2.94 77 XM_SPF_SoftFail 2773 1.51 3.00 1.14 78 BAYES_00 2771 15.32 2.99 18.38 79 NO_DNS_FOR_FROM 2768 1.49 2.99 1.11 80 RELAYCOUNTRY_FR 2747 0.90 2.97 0.39 81 BAYES_20 2671 3.41 2.89 3.54 82 T_MONEY_PERCENT 2588 1.37 2.80 1.01 83 TR_LOTS_OF_MONEY2 2588 1.37 2.80 1.01 84 RCVD_IN_RP_RNBL 2578 0.58 2.79 0.04 85 US_DOLLARS_3 2530 1.60 2.73 1.32 86 HTML_MIME_NO_HTML_TAG 2477 2.90 2.68 2.96 87 XMSubMetaI_00 2473 1.87 2.67 1.66 88 TR_XM_INV_DKIM 2447 0.75 2.64 0.28 89 SUBJ_ALL_CAPS 2439 2.65 2.64 2.65 90 XM_URI_RBL 2407 0.79 2.60 0.34 91 THIS_AD 2375 1.08 2.57 0.72 92 XMDiploma_00 2333 1.51 2.52 1.26 93 URI_TRY_3LD 2332 1.93 2.52 1.78 94 T_XMDrugObfuBody_08 2329 1.59 2.52 1.36 95 TR_LOTS_OF_MONEY3 2291 1.36 2.48 1.08 96 XM_CamelCaseFrm001 2282 2.14 2.47 2.05 97 KHOP_HELO_FCRDNS 2269 1.31 2.45 1.03 98 HTML_IMAGE_RATIO_08 2235 2.14 2.42 2.07 99 XMSexyCombo_01 2163 0.79 2.34 0.40 100 RCVD_IN_IADB_LISTED 2118 4.40 2.29 4.92 101 TR_XM_PHPDW 2106 1.82 2.28 1.71 102 TR_Mismatch_TLD_02 2092 0.51 2.26 0.07 103 XM_OfRef6 2035 1.71 2.20 1.59 104 TR_XM_DK_Bayes 2027 14.04 2.19 16.98 105 RCVD_IN_IADB_SPF 2022 3.89 2.18 4.31 106 TR_XM_PHPForged 2012 1.79 2.17 1.70 107 TR_XM_FormFill2 1993 1.78 2.15 1.69 108 RCVD_IN_IADB_SENDERID 1991 3.52 2.15 3.86 109 RCVD_IN_IADB_DK 1987 3.45 2.15 3.77 110 XM_H_PHPOS 1987 1.78 2.15 1.69 111 RCVD_IN_RP_SAFE 1931 12.03 2.09 14.50 112 XM_B_Unsub2 1908 1.46 2.06 1.31 113 DKIM_ADSP_NXDOMAIN 1896 0.88 2.05 0.59 114 RELAYCOUNTRY_AT 1889 0.72 2.04 0.39 115 RDNS_DYNAMIC 1813 0.67 1.96 0.35 116 MultiRelay_CC 1802 0.49 1.95 0.12 117 MultiRelay_Combo 1802 0.49 1.95 0.12 118 TR_XM_DK_Bayes1 1800 13.54 1.95 16.42 119 SpammyFromTLD_01 1794 0.69 1.94 0.38 120 XMGenDplmaNmb 1790 0.95 1.93 0.70 121 RELAYCOUNTRY_GB 1667 0.75 1.80 0.48 122 RCVD_IN_PSBL 1662 0.37 1.80 0.01 123 XMHTMLBadTable_001 1661 0.74 1.79 0.48 124 BAYES_05 1652 2.32 1.79 2.45 125 DIET_1 1593 0.76 1.72 0.52 126 XM_H_PHPMailer 1560 0.73 1.69 0.50 127 FROM_SUSPICIOUS_NTLD 1534 0.44 1.66 0.13 128 FROM_SUSPICIOUS_NTLD_FP 1512 0.43 1.63 0.13 129 BODY_ENHANCEMENT 1485 0.35 1.60 0.03 130 FROM_MISSP_REPLYTO 1480 0.32 1.60 0.00 131 BOTNET_NORDNS 1480 0.33 1.60 0.01 132 HTML_SHORT_LINK_IMG_1 1456 0.33 1.57 0.02 133 RCVD_IN_MSPIKE_WL 1448 3.98 1.56 4.58 134 XM_H_PHPOS_M 1369 0.49 1.48 0.25 135 RCVD_IN_RP_CERTIFIED 1355 10.98 1.46 13.34 136 XM_ProductURIs 1345 1.95 1.45 2.08 137 ALL_TRUSTED 1290 9.66 1.39 11.71 138 XMBrknScrpt_02 1287 1.01 1.39 0.92 139 RELAYCOUNTRY_PL 1239 0.30 1.34 0.04 140 MIME_HEADER_CTYPE_ONLY 1217 1.29 1.32 1.28 141 T_Symld_Words_02 1214 0.72 1.31 0.57 142 XMMoneyMeta_00 1194 0.39 1.29 0.17 143 XMSubMetaSxObfu_03 1193 0.72 1.29 0.57 144 FROM_MISSP_DYNIP 1181 0.25 1.28 0.00 145 T_XMDrugObfuBody_00 1156 0.74 1.25 0.61 146 RCVD_IN_MSPIKE_H3 1153 3.49 1.25 4.05 147 LOW_PRICE 1107 0.70 1.20 0.58 148 REPLYTO_WITHOUT_TO_CC 1096 0.25 1.18 0.02 149 XM_DK_Undo_01 1093 1.19 1.18 1.20 150 TM2_M_A_HREF_HREF 1087 0.78 1.17 0.68 151 HTML_IMAGE_ONLY_12 1052 0.30 1.14 0.10 152 LONG_HEX_URI 1028 0.36 1.11 0.17 153 TR_XM_DK_Bayes2 1020 12.39 1.10 15.19 154 DATE_IN_PAST_06_12 1003 0.29 1.08 0.09 155 XMSexyCombo_04 1001 0.28 1.08 0.08 156 SUBJ_DOLLARS 996 0.87 1.08 0.81 157 RELAYCOUNTRY_DE 994 0.56 1.07 0.43 158 XMPhish11 989 0.74 1.07 0.65 159 LongTLD 989 0.37 1.07 0.20 160 HDRS_LCASE_IMGONLY 958 0.22 1.04 0.01 161 FSL_THIS_IS_ADV 956 0.40 1.03 0.25 162 TR_Symld_Words 954 1.14 1.03 1.17 163 XMSubMetaSSx_00 947 0.32 1.02 0.14 164 XMPhish30 925 0.75 1.00 0.69 165 XM_SPF_Unknown 911 0.46 0.98 0.33 166 XM_H_Long_From02 908 1.52 0.98 1.65 167 SHOPIFY_IMG_NOT_RCVD_SFY 905 0.50 0.98 0.38 168 TO_NO_BRKTS_DYNIP 885 0.19 0.96 0.00 169 XMSolicitRefs_0 871 0.48 0.94 0.37 170 FILL_THIS_FORM 854 0.80 0.92 0.77 171 HTML_FONT_FACE_BAD 852 0.78 0.92 0.74 172 XMPhish14 845 0.68 0.91 0.63 173 RCVD_IN_MSPIKE_BL 844 0.82 0.91 0.80 174 MAILING_LIST_MULTI 839 1.54 0.91 1.69 175 XMHTML_After_End 832 1.07 0.90 1.11 176 T_TooManySym_02 824 2.22 0.89 2.55 177 XMSubNoVowel 814 0.31 0.88 0.17 178 DKIM_ADSP_CUSTOM_MED 807 0.89 0.87 0.90 179 DATE_IN_PAST_03_06 795 0.31 0.86 0.17 180 XMGppyBdWords 788 0.49 0.85 0.40 181 XM_B_COPY_HTML 779 0.54 0.84 0.47 182 UNPARSEABLE_RELAY 776 2.50 0.84 2.91 183 BODY_URI_ONLY 772 0.19 0.83 0.03 184 TR_Mismatch_TLD_01 741 0.43 0.80 0.34 185 XMReplyNow 733 0.22 0.79 0.07 186 TooManyTo_002 715 0.76 0.77 0.75 187 PLING_QUERY 685 0.87 0.74 0.90 188 XMLngstWrd_00 680 0.57 0.73 0.53 189 XM_UB60 675 0.18 0.73 0.05 190 XMLngstWrd_01 667 0.55 0.72 0.51 191 FORGED_GMAIL_RCVD 650 0.65 0.70 0.64 192 RCVD_IN_MSPIKE_L5 645 0.30 0.70 0.20 193 CK_HELO_DYNAMIC_SPLIT_IP 641 1.87 0.69 2.17 194 XMSolicitRefs_4 626 0.28 0.68 0.18 195 XMLngstWrd_02 622 0.43 0.67 0.37 196 HTML_TAG_BALANCE_BODY 614 0.75 0.66 0.78 197 TooManyTo_003 604 0.55 0.65 0.52 198 TM2_M_OBFU_COMMENT 603 0.19 0.65 0.07 199 MPART_ALT_DIFF_COUNT 602 0.37 0.65 0.30 200 XM_OfRef7 600 0.21 0.65 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 336863 91.26 94.63 90.42 2 DKIM_SIGNED 315899 85.15 86.56 84.80 3 XM_DK_Pass 311391 83.47 83.02 83.59 4 DKIM_VALID 300769 80.24 78.26 80.73 5 XM_B_Unicode 283579 77.07 80.91 76.12 6 XMListUnsubscribeExists 243847 67.68 76.62 65.45 7 DKIM_VALID_AU 236376 63.23 62.34 63.45 8 BAYES_50 209847 54.20 45.64 56.33 9 DCC_CHECK 208710 61.38 82.95 56.02 10 XM_B_Unicode3 182764 49.91 53.36 49.06 11 DCC_CHECK_NEGATIVE 159316 37.36 15.58 42.76 12 HTML_FONT_LOW_CONTRAST 133962 35.65 34.41 35.96 13 LOC_TINY_FONT_1 119364 33.37 38.73 32.04 14 DKIM_VALID_EF 101805 25.90 20.16 27.33 15 MIME_HTML_ONLY 95901 26.49 29.48 25.74 16 FVGT_m_MULTI_ODD 87695 25.21 31.91 23.54 17 T_TM2_M_HEADER_IN_MSG 79979 20.72 17.71 21.47 18 XMSubLong 78358 21.51 23.45 21.03 19 T_KAM_HTML_FONT_INVALID 69356 19.32 22.13 18.62 20 BAYES_00 68478 15.32 2.99 18.38 21 TR_XM_DK_Bayes 63258 14.04 2.19 16.98 22 TR_XM_DK_Bayes1 61172 13.54 1.95 16.42 23 XM_Multi_Part_URI 58026 17.50 25.25 15.58 24 MultiRelay 57138 16.44 20.89 15.34 25 TR_XM_DK_Bayes2 56604 12.39 1.10 15.19 26 RCVD_IN_RP_SAFE 54005 12.03 2.09 14.50 27 XM_Body_Dirty_Words 53651 16.64 25.64 14.40 28 RCVD_IN_RP_CERTIFIED 49689 10.98 1.46 13.34 29 HTML_IMAGE_RATIO_02 48917 14.29 18.97 13.13 30 XM_B_Unsub 48456 12.54 10.67 13.01 31 XM_Evil_Numbers_Gen 45730 12.80 14.92 12.28 32 ALL_TRUSTED 43619 9.66 1.39 11.71 33 XM_DKIMWhitelistDomains 39729 8.55 0.03 10.66 34 LOTS_OF_MONEY 37873 11.04 14.57 10.17 35 LotsOfNums_01 34157 8.90 7.83 9.17 36 T_XMDrugObfuBody_14 31769 8.67 9.26 8.53 37 XM_SendGrid 31113 8.42 8.68 8.35 38 HTML_IMAGE_RATIO_04 29062 7.95 8.57 7.80 39 FSL_BULK_SIG 28019 8.25 11.19 7.52 40 XM_DK_Undo_02 27812 13.72 38.91 7.47 41 RCVD_IN_MSPIKE_H2 27763 7.15 5.91 7.45 42 XM_B_Phish_Phrases 27732 8.00 10.22 7.44 43 XM_H_Long_From01 25141 6.89 7.45 6.75 44 BAYES_60 21563 5.73 5.50 5.79 45 TooManyTo_001 21157 5.84 6.50 5.68 46 MIME_QP_LONG_LINE 20599 5.58 5.79 5.53 47 BOTNET_IPINHOSTNAME 20484 8.05 18.35 5.50 48 XMSexyCombo_05 20202 6.32 9.93 5.42 49 T_TooManySym_01 19828 4.98 3.61 5.32 50 XMStrtUSub 19150 4.93 4.09 5.14 51 RCVD_IN_IADB_LISTED 18342 4.40 2.29 4.92 52 FROM_EXCESS_BASE64 18181 4.83 4.63 4.88 53 RELAYCOUNTRY_META 17213 7.33 18.23 4.62 54 RCVD_IN_MSPIKE_WL 17067 3.98 1.56 4.58 55 BAYES_40 17033 4.34 3.38 4.57 56 MPART_ALT_DIFF 16763 5.58 9.92 4.50 57 RCVD_IN_IADB_SPF 16054 3.89 2.18 4.31 58 MIME_HTML_MOSTLY 15799 4.81 7.10 4.24 59 TR_XM_DK_SendGrid 15294 4.31 5.12 4.11 60 DKIM_INVALID 15130 4.91 8.31 4.06 61 RCVD_IN_MSPIKE_H3 15084 3.49 1.25 4.05 62 RCVD_IN_IADB_SENDERID 14378 3.52 2.15 3.86 63 BAYES_99 14331 8.54 27.44 3.85 64 XMSubMetaSx_00 14220 4.50 7.25 3.82 65 RCVD_IN_IADB_DK 14040 3.45 2.15 3.77 66 BAYES_20 13194 3.41 2.89 3.54 67 XMNumbers 12066 3.48 4.44 3.24 68 HTML_IMAGE_RATIO_06 11933 3.54 4.91 3.20 69 XM_UncommonTLD01 11660 4.37 9.34 3.13 70 IN_ZIMBRA_NJ_WHITELIST 11364 2.45 0.01 3.05 71 RCVD_IN_IADB_VOUCHED 11292 2.52 0.49 3.03 72 XMBdyGiftCard01 11278 3.43 5.03 3.03 73 BAYES_80 11247 3.74 6.64 3.02 74 BAYES_999 11205 6.69 21.52 3.01 75 HTML_MIME_NO_HTML_TAG 11021 2.90 2.68 2.96 76 T_REMOTE_IMAGE 10964 2.98 3.12 2.94 77 UNPARSEABLE_RELAY 10835 2.50 0.84 2.91 78 XM_DIRTYINTL 10354 4.00 8.92 2.78 79 TM2_M_URI_OPT_OUT 10014 2.90 3.76 2.69 80 SUBJ_ALL_CAPS 9881 2.65 2.64 2.65 81 T_TooManySym_02 9499 2.22 0.89 2.55 82 BAYES_05 9137 2.32 1.79 2.45 83 TVD_RCVD_IP 9020 2.01 0.34 2.42 84 URI_HEX 8386 2.63 4.18 2.25 85 CK_HELO_DYNAMIC_SPLIT_IP 8075 1.87 0.69 2.17 86 HELO_DYNAMIC_IPADDR2 8074 1.75 0.09 2.17 87 BOTNET 7988 5.33 18.15 2.14 88 MIME_HTML_ONLY_MULTI 7772 2.79 5.63 2.09 89 XM_ProductURIs 7733 1.95 1.45 2.08 90 HTML_IMAGE_RATIO_08 7699 2.14 2.42 2.07 91 XM_CamelCaseFrm001 7650 2.14 2.47 2.05 92 RCVD_IN_IADB_OPTIN 7302 1.67 0.52 1.96 93 INVALID_MSGID 7184 1.58 0.19 1.93 94 XM_PDF 7023 1.57 0.31 1.89 95 UNTRUSTED_Relay 6922 3.66 10.92 1.86 96 BAYES_95 6861 2.18 3.53 1.84 97 XM_B_SpammyTLD 6763 2.58 5.66 1.82 98 TR_DCC_Bayes_99 6738 5.83 22.02 1.81 99 URI_TRY_3LD 6642 1.93 2.52 1.78 100 TO_MALFORMED 6595 1.44 0.09 1.77 101 RCVD_IN_BL_SPAMCOP_NET 6505 2.29 4.46 1.75 102 TR_XM_PHPDW 6363 1.82 2.28 1.71 103 USER_IN_DEF_DKIM_WL 6353 1.37 0.01 1.71 104 TR_XM_PHPForged 6324 1.79 2.17 1.70 105 MAILING_LIST_MULTI 6314 1.54 0.91 1.69 106 TR_XM_FormFill2 6306 1.78 2.15 1.69 107 XM_H_PHPOS 6295 1.78 2.15 1.69 108 XMSubMetaI_00 6201 1.87 2.67 1.66 109 XM_H_Long_From02 6163 1.52 0.98 1.65 110 RELAYCOUNTRY_CA 6090 1.96 3.26 1.63 111 IN_HORDE_ADDRESS_BOOK 6004 1.30 0.03 1.61 112 XM_OfRef6 5936 1.71 2.20 1.59 113 XMStockSpam_06 5750 2.02 3.92 1.54 114 HTML_IMAGE_ONLY_28 5523 1.28 0.44 1.48 115 BOUNCE_MESSAGE 5516 1.26 0.37 1.48 116 ANY_BOUNCE_MESSAGE 5516 1.26 0.37 1.48 117 T_XMDrugObfuBody_08 5058 1.59 2.52 1.36 118 US_DOLLARS_3 4922 1.60 2.73 1.32 119 XM_B_Unsub2 4870 1.46 2.06 1.31 120 TR_XM_RelayPhish 4818 1.88 4.23 1.29 121 MIME_HEADER_CTYPE_ONLY 4765 1.29 1.32 1.28 122 XMDiploma_00 4686 1.51 2.52 1.26 123 T_XMHurry_00 4668 1.67 3.34 1.25 124 TM2_M_VERY_LONG_WORD 4627 1.90 4.54 1.24 125 XM_DK_Undo_01 4462 1.19 1.18 1.20 126 XM_RXBody 4387 1.04 0.48 1.18 127 TR_Symld_Words 4364 1.14 1.03 1.17 128 XM_SPF_SoftFail 4257 1.51 3.00 1.14 129 NO_DNS_FOR_FROM 4141 1.49 2.99 1.11 130 XMHTML_After_End 4125 1.07 0.90 1.11 131 TR_LOTS_OF_MONEY3 4026 1.36 2.48 1.08 132 KHOP_HELO_FCRDNS 3821 1.31 2.45 1.03 133 TR_LOTS_OF_MONEY2 3771 1.37 2.80 1.01 134 T_MONEY_PERCENT 3771 1.37 2.80 1.01 135 XMBody_17 3531 1.49 3.69 0.95 136 XM_UB50 3462 2.07 6.66 0.93 137 XMBrknScrpt_02 3433 1.01 1.39 0.92 138 DKIM_ADSP_CUSTOM_MED 3344 0.89 0.87 0.90 139 PLING_QUERY 3343 0.87 0.74 0.90 140 XM_GoogleGroups 3135 0.75 0.38 0.84 141 XMGappySubj_01 3125 0.72 0.24 0.84 142 SUBJ_DOLLARS 3028 0.87 1.08 0.81 143 RCVD_IN_MSPIKE_BL 2966 0.82 0.91 0.80 144 T_TooManySym_03 2905 0.68 0.28 0.78 145 HTML_TAG_BALANCE_BODY 2895 0.75 0.66 0.78 146 FILL_THIS_FORM 2878 0.80 0.92 0.77 147 TooManyTo_002 2798 0.76 0.77 0.75 148 HTML_FONT_FACE_BAD 2759 0.78 0.92 0.74 149 TR_MetaPhish_Combo_01 2733 0.67 0.41 0.73 150 THIS_AD 2664 1.08 2.57 0.72 151 XMGenDplmaNmb 2619 0.95 1.93 0.70 152 XMPhish30 2561 0.75 1.00 0.69 153 TM2_M_A_HREF_HREF 2528 0.78 1.17 0.68 154 FILL_THIS_FORM_LONG 2510 0.63 0.44 0.67 155 T_FILL_THIS_FORM_LOAN 2473 0.59 0.31 0.66 156 XMBody_95 2449 0.55 0.10 0.66 157 XMPhish11 2437 0.74 1.07 0.65 158 XMSubMetaSxObfu_02 2409 0.56 0.24 0.65 159 FORGED_GMAIL_RCVD 2395 0.65 0.70 0.64 160 XMPhish14 2334 0.68 0.91 0.63 161 XMUrgent 2312 0.58 0.42 0.62 162 T_XMDrugObfuBody_00 2267 0.74 1.25 0.61 163 XMBSHREFv2 2237 0.58 0.48 0.60 164 URI_NOVOWEL 2237 0.59 0.53 0.60 165 DKIM_ADSP_NXDOMAIN 2216 0.88 2.05 0.59 166 NML_ADSP_CUSTOM_MED 2194 0.60 0.62 0.59 167 LOW_PRICE 2160 0.70 1.20 0.58 168 XMOemUri 2145 0.55 0.43 0.58 169 XMSubMetaSxObfu_03 2133 0.72 1.29 0.57 170 T_Symld_Words_02 2123 0.72 1.31 0.57 171 XM_D_tchamptons_WL 2070 0.46 0.09 0.56 172 USER_IN_WHITELIST 2066 0.44 0.00 0.55 173 XMLngstWrd_00 1977 0.57 0.73 0.53 174 DIET_1 1941 0.76 1.72 0.52 175 TooManyTo_003 1940 0.55 0.65 0.52 176 XMBody_78 1893 0.49 0.44 0.51 177 XMLngstWrd_01 1887 0.55 0.72 0.51 178 XM_H_PHPMailer 1853 0.73 1.69 0.50 179 RELAYCOUNTRY_GB 1798 0.75 1.80 0.48 180 XMHTMLBadTable_001 1790 0.74 1.79 0.48 181 XM_B_COPY_HTML 1749 0.54 0.84 0.47 182 HTTPS_HTTP_MISMATCH 1686 0.43 0.34 0.45 183 RCVD_IN_MSPIKE_H4 1644 0.41 0.27 0.44 184 TooManyTo_004 1607 0.46 0.59 0.43 185 RELAYCOUNTRY_DE 1590 0.56 1.07 0.43 186 XM_B_REG_HTML 1573 0.40 0.32 0.42 187 T_FILL_THIS_FORM_SHORT 1506 0.42 0.48 0.40 188 XMSexyCombo_01 1498 0.79 2.34 0.40 189 XMGppyBdWords 1498 0.49 0.85 0.40 190 RELAYCOUNTRY_AT 1463 0.72 2.04 0.39 191 RELAYCOUNTRY_FR 1450 0.90 2.97 0.39 192 TooManyTo_005 1420 0.41 0.54 0.38 193 HELO_NODOT 1413 0.41 0.53 0.38 194 HELO_NO_DOMAIN 1412 0.41 0.53 0.38 195 SpammyFromTLD_01 1400 0.69 1.94 0.38 196 SHOPIFY_IMG_NOT_RCVD_SFY 1400 0.50 0.98 0.38 197 XM_Walgreens_Forge 1398 0.41 0.53 0.38 198 XMSolicitRefs_0 1377 0.48 0.94 0.37 199 XMLngstWrd_02 1372 0.43 0.67 0.37 200 REMOVE_BEFORE_LINK 1357 0.36 0.37 0.36 ----------------------------------------------------------------------