Email: 366770 Autolearn: 0 AvgScore: 1.04 AvgScanTime: 1.19 sec Spam: 71918 Autolearn: 0 AvgScore: 13.94 AvgScanTime: 1.29 sec Ham: 294852 Autolearn: 0 AvgScore: -2.11 AvgScanTime: 1.17 sec Time Spent Running SA: 121.24 hours Time Spent Processing Spam: 25.79 hours Time Spent Processing Ham: 95.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 70231 98.99 97.65 99.32 2 HTML_MESSAGE 63871 84.12 88.81 82.97 3 DKIM_SIGNED 57792 83.46 80.36 84.22 4 XM_DK_Pass 55100 81.86 76.62 83.14 5 DKIM_VALID 53955 80.28 75.02 81.56 6 XM_B_Unicode 52635 71.98 73.19 71.68 7 XMListUnsubscribeExists 48037 59.87 66.79 58.19 8 RELAYCOUNTRY_US 47279 80.38 65.74 83.95 9 XM_B_SpammyWords 45950 56.51 63.89 54.71 10 DKIM_VALID_AU 42947 65.25 59.72 66.59 11 XM_DK_Undo_02 40555 22.05 56.39 13.67 12 BAYES_99 32572 16.94 45.29 10.02 13 BAYES_999 25742 13.58 35.79 8.16 14 LOC_TINY_FONT_1 25629 31.74 35.64 30.79 15 XM_B_SpammyWords2 25029 25.05 34.80 22.67 16 RELAYCOUNTRY_META 24588 10.80 34.19 5.10 17 DKIM_VALID_EF 23116 33.20 32.14 33.46 18 HTML_FONT_LOW_CONTRAST 22718 32.85 31.59 33.16 19 BOTNET 22341 8.05 31.06 2.44 20 BAYES_50 21864 44.86 30.40 48.38 21 XM_B_Unicode3 21617 40.77 30.06 43.38 22 RCVD_IN_MSPIKE_H2 20291 26.83 28.21 26.49 23 XMSubLong 18941 22.75 26.34 21.88 24 XM_UncommonTLD01 18805 8.06 26.15 3.65 25 MIME_HTML_ONLY 18492 23.02 25.71 22.37 26 UNTRUSTED_Relay 18472 7.05 25.68 2.51 27 FVGT_m_MULTI_ODD 16250 22.58 22.60 22.58 28 T_TM2_M_HEADER_IN_MSG 15704 20.81 21.84 20.56 29 XM_Multi_Part_URI 15260 15.80 21.22 14.48 30 T_KAM_HTML_FONT_INVALID 14577 18.06 20.27 17.52 31 RCVD_IN_MSPIKE_BL 13703 4.59 19.05 1.06 32 XM_Body_Dirty_Words 13103 15.68 18.22 15.06 33 TR_XM_SpammyWords2 12865 6.15 17.89 3.28 34 BOTNET_IPINHOSTNAME 10740 8.27 14.93 6.65 35 LOTS_OF_MONEY 10215 9.27 14.20 8.07 36 MPART_ALT_DIFF 10086 6.67 14.02 4.87 37 HTML_IMAGE_RATIO_02 9525 10.62 13.24 9.98 38 MIME_HTML_MOSTLY 9101 5.35 12.65 3.56 39 XMSexyCombo_05 8770 7.13 12.19 5.90 40 RCVD_IN_BL_SPAMCOP_NET 8304 3.48 11.55 1.51 41 XM_B_SpammyWords3 8276 7.01 11.51 5.91 42 LotsOfNums_01 8113 8.87 11.28 8.28 43 URIBL_SBL_A 7800 2.40 10.85 0.34 44 RCVD_IN_MSPIKE_WL 7692 27.00 10.70 30.98 45 RCVD_IN_MSPIKE_L3 7441 2.68 10.35 0.82 46 XM_UB50 7083 2.90 9.85 1.21 47 RCVD_IN_RP_RNBL 6955 1.96 9.67 0.08 48 TR_XM_SpammyWords3 6841 2.49 9.51 0.77 49 XM_B_Unsub 6834 9.72 9.50 9.78 50 URI_PHP_REDIR 6734 1.85 9.36 0.01 51 SpammyFromTLD_01 6239 2.10 8.68 0.49 52 XM_B_Phish_Phrases 6093 6.65 8.47 6.20 53 T_REMOTE_IMAGE 5930 4.24 8.25 3.26 54 BAYES_80 5856 5.92 8.14 5.38 55 SpammyFromTLD_02 5657 1.72 7.87 0.22 56 RCVD_IN_MSPIKE_L5 5517 1.64 7.67 0.17 57 XMSubMetaSx_00 5156 4.80 7.17 4.22 58 RELAYCOUNTRY_CA 5111 3.06 7.11 2.07 59 BAYES_60 5092 7.70 7.08 7.85 60 RELAYCOUNTRY_FR 4957 1.52 6.89 0.21 61 XM_DIRTYINTL 4706 1.75 6.54 0.58 62 RCVD_IN_PSBL 4616 1.34 6.42 0.10 63 XM_UB99 4614 1.26 6.42 0.00 64 RCVD_IN_MSPIKE_H3 4586 15.38 6.38 17.58 65 XM_Evil_Numbers_Gen 4559 8.94 6.34 9.58 66 XMBody_17 4409 2.36 6.13 1.45 67 XM_H_Long_From01 4283 5.56 5.96 5.47 68 TR_XM_MaxSPIKE 4264 1.18 5.93 0.02 69 TR_XM_MaxBayes 4204 1.19 5.85 0.05 70 HTML_MIME_NO_HTML_TAG 4195 2.31 5.83 1.45 71 FROM_EXCESS_BASE64 4104 4.44 5.71 4.13 72 TR_XM_PhishingBody 3990 3.12 5.55 2.53 73 SUBJ_ALL_CAPS 3939 2.16 5.48 1.35 74 XM_SPF_SoftFail 3938 1.91 5.48 1.04 75 HTML_IMAGE_RATIO_08 3882 3.18 5.40 2.64 76 XM_B_SpammyTLD 3854 2.60 5.36 1.92 77 DKIM_INVALID 3837 3.18 5.34 2.65 78 BAYES_95 3809 3.80 5.30 3.44 79 T_PDS_OTHER_BAD_TLD 3657 1.31 5.08 0.39 80 XMBrknScrpt_02 3615 2.43 5.03 1.80 81 FROM_SUSPICIOUS_NTLD 3592 1.03 4.99 0.06 82 FROM_SUSPICIOUS_NTLD_FP 3514 1.00 4.89 0.05 83 TooManyTo_001 3494 10.56 4.86 11.96 84 XM_UB999 3464 0.95 4.82 0.00 85 LongTLD 3413 1.07 4.75 0.17 86 XMStrtUSub 3344 5.49 4.65 5.69 87 UNPARSEABLE_RELAY 3325 7.99 4.62 8.81 88 HTML_IMAGE_RATIO_04 3299 5.55 4.59 5.79 89 HTML_IMAGE_ONLY_12 3147 0.98 4.38 0.16 90 BOTNET_NORDNS 3003 0.85 4.18 0.04 91 RCVD_IN_MSPIKE_H4 2893 10.07 4.02 11.55 92 XMSlimDrugs 2892 0.80 4.02 0.02 93 T_XMDrugObfuBody_00 2858 1.41 3.97 0.79 94 RELAYCOUNTRY_DE 2764 1.09 3.84 0.42 95 XM_SendGrid 2638 7.24 3.67 8.11 96 URI_TRY_3LD 2557 2.05 3.56 1.68 97 XM_B_Phish66 2555 1.52 3.55 1.02 98 XM_OfRef6 2505 1.83 3.48 1.43 99 XM_UB60 2385 0.77 3.32 0.15 100 TR_XM_UnparsRelay 2326 1.44 3.23 1.00 101 XMSubNoVowel 2229 1.27 3.10 0.82 102 T_XMDrugObfuBody_08 2183 1.77 3.04 1.47 103 XMNumbers 2183 4.10 3.04 4.35 104 KHOP_HELO_FCRDNS 2167 1.27 3.01 0.84 105 TM2_M_VERY_LONG_WORD 2113 1.61 2.94 1.29 106 XM_UB80 2106 0.61 2.93 0.04 107 TR_LOTS_OF_MONEY3 2033 1.35 2.83 0.99 108 T_FONT_INVIS_NAKED_TO 2009 2.57 2.79 2.52 109 DKIM_ADSP_NXDOMAIN 1988 1.35 2.76 1.00 110 TR_XM_COVIDMETA4 1935 0.80 2.69 0.33 111 DATE_IN_PAST_03_06 1912 0.63 2.66 0.13 112 MISSING_HEADERS 1755 0.72 2.44 0.31 113 XM_B_COVIDMETA 1750 1.45 2.43 1.21 114 TR_XM_PHPDW 1703 0.76 2.37 0.37 115 XMDiploma_00 1692 1.70 2.35 1.54 116 TR_XM_PHPForged 1671 0.75 2.32 0.37 117 MIMEOLE_DIRECT_TO_MX 1669 0.46 2.32 0.00 118 TR_Caps_n_Bayes_99 1669 0.62 2.32 0.20 119 TR_XM_FormFill2 1664 0.75 2.31 0.36 120 XM_H_PHPOS 1659 0.74 2.31 0.36 121 URI_HEX 1652 2.06 2.30 2.01 122 HTML_IMAGE_RATIO_06 1631 3.27 2.27 3.51 123 MIME_CHARSET_FARAWAY 1630 0.54 2.27 0.12 124 RELAYCOUNTRY_IN 1623 0.50 2.26 0.07 125 TR_Mismatch_TLD_02 1616 0.50 2.25 0.08 126 TM2_M_URI_OPT_OUT 1580 3.01 2.20 3.20 127 DOS_OE_TO_MX 1572 0.43 2.19 0.00 128 XM_UB95 1569 0.44 2.18 0.02 129 T_XMHurry_00 1562 0.99 2.17 0.70 130 XM_B_SpammyWords4 1559 0.91 2.17 0.60 131 CHARSET_FARAWAY_HEADER 1555 0.46 2.16 0.05 132 REPLYTO_WITHOUT_TO_CC 1550 0.45 2.16 0.03 133 ANY_BOUNCE_MESSAGE 1527 2.61 2.12 2.72 134 BOUNCE_MESSAGE 1527 2.61 2.12 2.72 135 TR_XM_SB_Phish 1518 1.58 2.11 1.45 136 TR_XM_INV_DKIM 1516 0.56 2.11 0.18 137 XMSubPhish11 1507 1.56 2.10 1.43 138 RELAYCOUNTRY_NL 1480 0.67 2.06 0.33 139 SUBJ_BUY 1472 0.48 2.05 0.10 140 XMSexyCombo_01 1459 1.00 2.03 0.74 141 XMGppyBdWords 1456 0.48 2.02 0.10 142 XM_CamelCaseFrm001 1454 2.03 2.02 2.03 143 XM_Lotto 1414 0.45 1.97 0.08 144 PDS_FROM_2_EMAILS 1392 0.39 1.94 0.02 145 NUMERIC_HTTP_ADDR 1382 0.81 1.92 0.54 146 NO_FM_NAME_IP_HOSTN 1379 0.38 1.92 0.00 147 FROM_2_EMAILS_SHORT 1359 0.37 1.89 0.00 148 LH_URI_DOM_IN_PATH 1352 1.62 1.88 1.56 149 TR_XM_RelayPhish 1336 0.45 1.86 0.11 150 XM_B_Unsub2 1335 1.18 1.86 1.02 151 TR_LOTS_OF_MONEY1 1316 0.37 1.83 0.01 152 NORMAL_HTTP_TO_IP 1304 0.38 1.81 0.03 153 RDNS_DYNAMIC 1290 0.97 1.79 0.77 154 PDS_TO_EQ_FROM_NAME 1278 0.36 1.78 0.01 155 TR_XM_DK_SendGrid 1263 4.27 1.76 4.88 156 LONG_JUNK_URI2 1260 0.39 1.75 0.06 157 TR_Symld_Words 1258 1.88 1.75 1.92 158 XM_URI_RBL 1253 0.51 1.74 0.20 159 T_FILL_THIS_FORM_SHORT 1246 0.89 1.73 0.69 160 XM_SPF_Unknown 1224 0.62 1.70 0.36 161 XMSubMetaD_00 1223 0.37 1.70 0.04 162 T_TooManySym_01 1168 5.06 1.62 5.89 163 TR_Mismatch_TLD_01 1163 0.45 1.62 0.17 164 INVALID_MSGID 1159 2.36 1.61 2.55 165 URI_NO_WWW_BIZ_CGI 1136 0.31 1.58 0.01 166 T_MONEY_PERCENT 1110 0.56 1.54 0.32 167 TR_LOTS_OF_MONEY2 1110 0.56 1.54 0.32 168 XMObfuSubjects 1077 0.30 1.50 0.01 169 MIME_HTML_ONLY_MULTI 1046 2.39 1.45 2.61 170 BAYES_40 1045 3.17 1.45 3.59 171 XMSubMetaSxObfu_03 1025 0.66 1.43 0.47 172 DKIM_ADSP_CUSTOM_MED 1000 1.07 1.39 0.99 173 FROM_NAME_EQ_TO_G_DRIVE 1000 0.27 1.39 0.00 174 HK_RANDOM_FROM 977 0.34 1.36 0.09 175 ALL_TRUSTED 946 9.56 1.32 11.57 176 NML_ADSP_CUSTOM_MED 940 0.84 1.31 0.73 177 XMStockSpam_06 939 1.69 1.31 1.78 178 XM_ShortIntro_01 932 0.71 1.30 0.57 179 INVESTMENT_ADVICE 932 0.34 1.30 0.10 180 HTTP_ESCAPED_HOST 912 0.27 1.27 0.03 181 DRUGS_ERECTILE 907 0.29 1.26 0.06 182 URI_NOVOWEL 895 1.56 1.24 1.63 183 BAYES_20 893 3.02 1.24 3.46 184 TR_Sbj_FN_Bdy 888 0.39 1.23 0.18 185 XMReplyNow 880 0.31 1.22 0.09 186 FORGED_GMAIL_RCVD 876 0.60 1.22 0.45 187 XMBdyGiftCard01 874 1.49 1.22 1.56 188 MIME_QP_LONG_LINE 855 3.71 1.19 4.32 189 TR_XM_SpoofStaff 836 0.32 1.16 0.11 190 XMSpoofStaff2 827 0.31 1.15 0.11 191 RCVD_IN_IADB_LISTED 805 3.47 1.12 4.04 192 XMBody_29 796 0.31 1.11 0.11 193 XMGenDplmaNmb 775 0.86 1.08 0.81 194 XM_BadFromFormat 760 0.40 1.06 0.24 195 HK_SCAM 757 0.21 1.05 0.00 196 HDR_ORDER_FTSDMCXX_DIRECT 757 0.21 1.05 0.00 197 CK_HELO_DYNAMIC_SPLIT_IP 753 2.08 1.05 2.34 198 NO_DNS_FOR_FROM 747 0.82 1.04 0.77 199 MILLION_HUNDRED 743 0.21 1.03 0.00 200 TR_XM_Spammywords 733 0.38 1.02 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 292834 98.99 97.65 99.32 2 DKIM_SIGNED 248311 83.46 80.36 84.22 3 RELAYCOUNTRY_US 247537 80.38 65.74 83.95 4 XM_DK_Pass 245135 81.86 76.62 83.14 5 HTML_MESSAGE 244649 84.12 88.81 82.97 6 DKIM_VALID 240484 80.28 75.02 81.56 7 XM_B_Unicode 211349 71.98 73.19 71.68 8 DKIM_VALID_AU 196354 65.25 59.72 66.59 9 XMListUnsubscribeExists 171566 59.87 66.79 58.19 10 XM_B_SpammyWords 161304 56.51 63.89 54.71 11 BAYES_50 142658 44.86 30.40 48.38 12 XM_B_Unicode3 127909 40.77 30.06 43.38 13 DKIM_VALID_EF 98651 33.20 32.14 33.46 14 HTML_FONT_LOW_CONTRAST 97771 32.85 31.59 33.16 15 RCVD_IN_MSPIKE_WL 91346 27.00 10.70 30.98 16 LOC_TINY_FONT_1 90775 31.74 35.64 30.79 17 RCVD_IN_MSPIKE_H2 78111 26.83 28.21 26.49 18 XM_B_SpammyWords2 66846 25.05 34.80 22.67 19 FVGT_m_MULTI_ODD 66570 22.58 22.60 22.58 20 MIME_HTML_ONLY 65948 23.02 25.71 22.37 21 XMSubLong 64502 22.75 26.34 21.88 22 T_TM2_M_HEADER_IN_MSG 60613 20.81 21.84 20.56 23 RCVD_IN_MSPIKE_H3 51836 15.38 6.38 17.58 24 T_KAM_HTML_FONT_INVALID 51662 18.06 20.27 17.52 25 XM_DKIMWhitelistDomains 46226 12.60 0.00 15.68 26 BAYES_00 44657 12.24 0.35 15.15 27 XM_Body_Dirty_Words 44404 15.68 18.22 15.06 28 XM_Multi_Part_URI 42685 15.80 21.22 14.48 29 XM_DK_Undo_02 40316 22.05 56.39 13.67 30 TR_XM_DK_Bayes 37788 10.33 0.16 12.82 31 TR_XM_DK_Bayes1 37142 10.16 0.16 12.60 32 TR_XM_DK_Bayes2 35539 9.71 0.12 12.05 33 TooManyTo_001 35255 10.56 4.86 11.96 34 ALL_TRUSTED 34110 9.56 1.32 11.57 35 RCVD_IN_MSPIKE_H4 34046 10.07 4.02 11.55 36 RCVD_IN_RP_SAFE 30555 8.53 1.00 10.36 37 BAYES_99 29552 16.94 45.29 10.02 38 HTML_IMAGE_RATIO_02 29419 10.62 13.24 9.98 39 RCVD_IN_RP_CERTIFIED 28867 8.02 0.75 9.79 40 XM_B_Unsub 28826 9.72 9.50 9.78 41 XM_Evil_Numbers_Gen 28246 8.94 6.34 9.58 42 UNPARSEABLE_RELAY 25973 7.99 4.62 8.81 43 LotsOfNums_01 24423 8.87 11.28 8.28 44 BAYES_999 24063 13.58 35.79 8.16 45 XM_SendGrid 23918 7.24 3.67 8.11 46 LOTS_OF_MONEY 23781 9.27 14.20 8.07 47 BAYES_60 23139 7.70 7.08 7.85 48 BOTNET_IPINHOSTNAME 19607 8.27 14.93 6.65 49 TooManyTo_002 18607 5.14 0.35 6.31 50 XM_B_Phish_Phrases 18293 6.65 8.47 6.20 51 XM_B_SpammyWords3 17423 7.01 11.51 5.91 52 XMSexyCombo_05 17393 7.13 12.19 5.90 53 T_TooManySym_01 17381 5.06 1.62 5.89 54 HTML_IMAGE_RATIO_04 17058 5.55 4.59 5.79 55 XMStrtUSub 16778 5.49 4.65 5.69 56 XM_H_Long_From01 16126 5.56 5.96 5.47 57 BAYES_80 15860 5.92 8.14 5.38 58 RELAYCOUNTRY_META 15034 10.80 34.19 5.10 59 TR_XM_DK_SendGrid 14397 4.27 1.76 4.88 60 MPART_ALT_DIFF 14367 6.67 14.02 4.87 61 XMNumbers 12837 4.10 3.04 4.35 62 MIME_QP_LONG_LINE 12735 3.71 1.19 4.32 63 XMSubMetaSx_00 12438 4.80 7.17 4.22 64 IN_ZIMBRA_NJ_WHITELIST 12378 3.39 0.10 4.20 65 FROM_EXCESS_BASE64 12171 4.44 5.71 4.13 66 RCVD_IN_IADB_LISTED 11904 3.47 1.12 4.04 67 XM_UncommonTLD01 10774 8.06 26.15 3.65 68 BAYES_40 10579 3.17 1.45 3.59 69 MIME_HTML_MOSTLY 10503 5.35 12.65 3.56 70 RCVD_IN_IADB_SPF 10361 3.00 0.88 3.51 71 HTML_IMAGE_RATIO_06 10357 3.27 2.27 3.51 72 BAYES_20 10201 3.02 1.24 3.46 73 BAYES_95 10137 3.80 5.30 3.44 74 T_TooManySym_02 10119 2.86 0.50 3.43 75 TR_XM_SpammyWords2 9684 6.15 17.89 3.28 76 T_REMOTE_IMAGE 9622 4.24 8.25 3.26 77 TM2_M_URI_OPT_OUT 9443 3.01 2.20 3.20 78 RCVD_IN_IADB_SENDERID 9276 2.69 0.83 3.15 79 RCVD_IN_IADB_DK 8925 2.60 0.83 3.03 80 BAYES_05 8062 2.34 0.73 2.73 81 ANY_BOUNCE_MESSAGE 8033 2.61 2.12 2.72 82 BOUNCE_MESSAGE 8032 2.61 2.12 2.72 83 DKIM_INVALID 7827 3.18 5.34 2.65 84 HTML_IMAGE_RATIO_08 7774 3.18 5.40 2.64 85 MIME_HTML_ONLY_MULTI 7709 2.39 1.45 2.61 86 TVD_RCVD_IP 7692 2.23 0.68 2.61 87 INVALID_MSGID 7504 2.36 1.61 2.55 88 TR_XM_PhishingBody 7450 3.12 5.55 2.53 89 T_FONT_INVIS_NAKED_TO 7435 2.57 2.79 2.52 90 UNTRUSTED_Relay 7394 7.05 25.68 2.51 91 RCVD_IN_IADB_VOUCHED 7249 2.07 0.50 2.46 92 BOTNET 7189 8.05 31.06 2.44 93 CK_HELO_DYNAMIC_SPLIT_IP 6889 2.08 1.05 2.34 94 HELO_MISC_IP 6889 2.01 0.67 2.34 95 TO_MALFORMED 6320 1.73 0.01 2.14 96 RELAYCOUNTRY_CA 6116 3.06 7.11 2.07 97 XM_CamelCaseFrm001 5985 2.03 2.02 2.03 98 URI_HEX 5915 2.06 2.30 2.01 99 XMBSHREFv2 5798 1.60 0.08 1.97 100 XM_B_SpammyTLD 5668 2.60 5.36 1.92 101 TR_Symld_Words 5653 1.88 1.75 1.92 102 RCVD_IN_MSPIKE_H5 5464 1.55 0.30 1.85 103 XMBrknScrpt_02 5308 2.43 5.03 1.80 104 XMStockSpam_06 5243 1.69 1.31 1.78 105 URI_TRY_3LD 4960 2.05 3.56 1.68 106 XMGappySubj_01 4851 1.33 0.05 1.65 107 URI_NOVOWEL 4818 1.56 1.24 1.63 108 XM_PDF 4804 1.42 0.54 1.63 109 RCVD_IN_IADB_OPTIN 4670 1.34 0.34 1.58 110 IN_HORDE_ADDRESS_BOOK 4659 1.35 0.39 1.58 111 LH_URI_DOM_IN_PATH 4598 1.62 1.88 1.56 112 XMBdyGiftCard01 4598 1.49 1.22 1.56 113 T_TooManySym_03 4596 1.28 0.13 1.56 114 T_XMDrugObfuBody_14 4596 1.43 0.91 1.56 115 XMDiploma_00 4552 1.70 2.35 1.54 116 MAILING_LIST_MULTI 4494 1.38 0.77 1.52 117 RCVD_IN_BL_SPAMCOP_NET 4466 3.48 11.55 1.51 118 XM_DK_Undo_01 4374 1.36 0.84 1.48 119 T_XMDrugObfuBody_08 4325 1.77 3.04 1.47 120 TR_XM_SB_Phish 4274 1.58 2.11 1.45 121 HTML_MIME_NO_HTML_TAG 4271 2.31 5.83 1.45 122 XMBody_17 4265 2.36 6.13 1.45 123 XMSubPhish11 4229 1.56 2.10 1.43 124 XM_OfRef6 4203 1.83 3.48 1.43 125 USER_IN_DEF_DKIM_WL 4087 1.11 0.00 1.39 126 SUBJ_ALL_CAPS 3979 2.16 5.48 1.35 127 TM2_M_VERY_LONG_WORD 3802 1.61 2.94 1.29 128 XM_B_COVIDMETA 3565 1.45 2.43 1.21 129 XM_UB50 3553 2.90 9.85 1.21 130 XM_ProductURIs 3393 1.04 0.56 1.15 131 RCVD_IN_MSPIKE_BL 3122 4.59 19.05 1.06 132 XM_SPF_SoftFail 3061 1.91 5.48 1.04 133 XM_B_Phish66 3003 1.52 3.55 1.02 134 XM_B_Unsub2 3002 1.18 1.86 1.02 135 XMSubMetaI_00 2974 0.92 0.53 1.01 136 XM_GoogleGroups 2971 0.86 0.27 1.01 137 DKIM_ADSP_NXDOMAIN 2955 1.35 2.76 1.00 138 TR_XM_UnparsRelay 2939 1.44 3.23 1.00 139 DKIM_ADSP_CUSTOM_MED 2925 1.07 1.39 0.99 140 TR_LOTS_OF_MONEY3 2917 1.35 2.83 0.99 141 XM_H_Long_From02 2685 0.85 0.62 0.91 142 T_TooManySym_04 2676 0.74 0.04 0.91 143 KHOP_HELO_FCRDNS 2491 1.27 3.01 0.84 144 TR_MSPIKEBAYES00 2461 0.68 0.03 0.83 145 XMHTMLBadTable_001 2427 0.71 0.26 0.82 146 XMSubNoVowel 2426 1.27 3.10 0.82 147 RCVD_IN_MSPIKE_L3 2405 2.68 10.35 0.82 148 XMGenDplmaNmb 2383 0.86 1.08 0.81 149 XMBody_95 2373 0.67 0.11 0.80 150 T_XMDrugObfuBody_00 2325 1.41 3.97 0.79 151 TR_XM_SpammyWords3 2276 2.49 9.51 0.77 152 XM_S_SubURI 2264 0.63 0.09 0.77 153 NO_DNS_FOR_FROM 2262 0.82 1.04 0.77 154 RDNS_DYNAMIC 2259 0.97 1.79 0.77 155 XMSexyCombo_01 2194 1.00 2.03 0.74 156 HTML_TAG_BALANCE_BODY 2160 0.75 0.82 0.73 157 PLING_QUERY 2156 0.71 0.63 0.73 158 NML_ADSP_CUSTOM_MED 2145 0.84 1.31 0.73 159 HTML_FONT_FACE_BAD 2145 0.72 0.66 0.73 160 TooManyTo_003 2107 0.63 0.28 0.71 161 XM_H_Trusted_IP 2096 0.57 0.00 0.71 162 T_XMHurry_00 2066 0.99 2.17 0.70 163 XM_B_REG_HTML 2054 0.57 0.04 0.70 164 T_FILL_THIS_FORM_SHORT 2020 0.89 1.73 0.69 165 TR_MetaPhish_Combo_01 1963 0.67 0.67 0.67 166 T_TooManySym_05 1935 0.53 0.00 0.66 167 RELAYCOUNTRY_GB 1888 0.71 1.02 0.64 168 TR_BOTNET_NEGATE 1864 0.61 0.52 0.63 169 XMSolicitRefs_0 1830 0.56 0.32 0.62 170 XMHTML_After_End 1822 0.67 0.91 0.62 171 XM_B_SpammyWords4 1778 0.91 2.17 0.60 172 TooManyTo_004 1725 0.52 0.25 0.59 173 XM_DIRTYINTL 1707 1.75 6.54 0.58 174 USER_IN_WELCOMELIST 1700 0.46 0.00 0.58 175 USER_IN_WHITELIST 1700 0.46 0.00 0.58 176 XM_ShortIntro_01 1671 0.71 1.30 0.57 177 DIET_1 1643 0.59 0.72 0.56 178 MPART_ALT_DIFF_COUNT 1597 0.63 0.97 0.54 179 NUMERIC_HTTP_ADDR 1594 0.81 1.92 0.54 180 XMPhish30 1587 0.59 0.79 0.54 181 THIS_AD 1584 0.52 0.44 0.54 182 XMPhish08 1529 0.55 0.67 0.52 183 SENDGRID_REDIR 1515 0.49 0.40 0.51 184 HTML_IMAGE_ONLY_20 1511 0.60 0.96 0.51 185 XMBody_78 1501 0.55 0.74 0.51 186 TooManyTo_005 1497 0.45 0.20 0.51 187 XM_B_COPY_HTML 1462 0.47 0.38 0.50 188 SpammyFromTLD_01 1455 2.10 8.68 0.49 189 XMLngstWrd_00 1422 0.48 0.45 0.48 190 SUBJ_DOLLARS 1419 0.44 0.25 0.48 191 XMSubMetaSxObfu_02 1387 0.43 0.28 0.47 192 XMSubMetaSxObfu_03 1379 0.66 1.43 0.47 193 HTTPS_HTTP_MISMATCH 1343 0.48 0.56 0.46 194 XMSlimDrugH 1342 0.56 0.97 0.46 195 XMPhish14 1329 0.47 0.56 0.45 196 FORGED_GMAIL_RCVD 1322 0.60 1.22 0.45 197 XMLngstWrd_01 1315 0.44 0.42 0.45 198 SHOPIFY_IMG_NOT_RCVD_SFY 1313 0.41 0.25 0.45 199 DATE_IN_PAST_12_24 1296 0.50 0.76 0.44 200 XM_H_PHPMailer 1285 0.47 0.63 0.44 ----------------------------------------------------------------------