Email: 365383 Autolearn: 0 AvgScore: 3.73 AvgScanTime: 1.30 sec Spam: 115360 Autolearn: 0 AvgScore: 15.23 AvgScanTime: 1.36 sec Ham: 250023 Autolearn: 0 AvgScore: -1.57 AvgScanTime: 1.27 sec Time Spent Running SA: 131.56 hours Time Spent Processing Spam: 43.67 hours Time Spent Processing Ham: 87.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109830 87.52 95.21 83.97 2 DKIM_SIGNED 91438 75.63 79.26 73.96 3 XM_DK_Pass 89064 74.26 77.21 72.90 4 DCC_CHECK 87087 51.40 75.49 40.28 5 DKIM_VALID 86204 72.15 74.73 70.96 6 XM_B_Unicode 80153 68.71 69.48 68.36 7 RELAYCOUNTRY_US 80133 75.96 69.46 78.95 8 XMListUnsubscribeExists 74210 55.63 64.33 51.61 9 XM_B_SpammyWords 69353 49.86 60.12 45.13 10 DKIM_VALID_AU 66298 57.59 57.47 57.65 11 XM_DK_Undo_02 49986 19.59 43.33 8.64 12 XM_B_Unicode3 45895 43.23 39.78 44.81 13 BAYES_50 43882 48.65 38.04 53.55 14 MIME_HTML_ONLY 40283 26.04 34.92 21.95 15 LOC_TINY_FONT_1 40022 29.79 34.69 27.52 16 BAYES_99 38988 15.37 33.80 6.86 17 TR_XM_DKIM_Undo 37644 14.81 32.63 6.59 18 XM_B_SpammyWords2 34886 21.91 30.24 18.07 19 FVGT_m_MULTI_ODD 33235 26.46 28.81 25.38 20 HTML_FONT_LOW_CONTRAST 32605 29.51 28.26 30.08 21 RELAYCOUNTRY_META 32457 11.44 28.14 3.73 22 DKIM_VALID_EF 32120 26.70 27.84 26.17 23 BAYES_999 31645 12.44 27.43 5.53 24 TR_DCC_Bayes_99 30523 10.57 26.46 3.23 25 T_KAM_HTML_FONT_INVALID 29344 20.51 25.44 18.24 26 RCVD_IN_MSPIKE_H2 28256 21.63 24.49 20.30 27 DCC_CHECK_NEGATIVE 28227 48.57 24.47 59.70 28 UNTRUSTED_Relay 24611 7.77 21.33 1.51 29 RCVD_IN_MSPIKE_WL 21827 26.61 18.92 30.16 30 XM_Body_Dirty_Words 21474 15.51 18.61 14.07 31 XMSubLong 21413 19.58 18.56 20.05 32 BOTNET 21325 6.96 18.49 1.65 33 T_TM2_M_HEADER_IN_MSG 21145 21.92 18.33 23.57 34 FSL_BULK_SIG 19851 8.90 17.21 5.06 35 XM_Multi_Part_URI 18600 14.22 16.12 13.34 36 XM_UncommonTLD01 18345 7.68 15.90 3.88 37 TR_XM_SpammyRelay 15745 5.34 13.65 1.50 38 UNPARSEABLE_RELAY 15552 10.26 13.48 8.78 39 TR_XM_UnparsRelay 15205 8.99 13.18 7.06 40 XM_B_Unsub 14747 13.30 12.78 13.54 41 HTML_MIME_NO_HTML_TAG 14711 5.44 12.75 2.07 42 MPART_ALT_DIFF 14086 7.79 12.21 5.75 43 RCVD_IN_MSPIKE_H3 13765 14.89 11.93 16.26 44 TR_XM_SpammyWords2 13018 4.79 11.28 1.80 45 BOTNET_IPINHOSTNAME 12965 7.20 11.24 5.33 46 XMSexyCombo_05 11360 6.68 9.85 5.21 47 RCVD_IN_BL_SPAMCOP_NET 11334 3.79 9.82 1.00 48 LOTS_OF_MONEY 9985 6.99 8.66 6.22 49 BAYES_60 9907 9.90 8.59 10.51 50 HTML_IMAGE_RATIO_02 9900 8.14 8.58 7.93 51 XM_SendGrid 9448 7.10 8.19 6.59 52 XM_B_SpammyWords3 9250 5.20 8.02 3.89 53 MIME_HTML_MOSTLY 9248 4.19 8.02 2.42 54 XM_Evil_Numbers_Gen 9040 9.34 7.84 10.03 55 XM_UB50 9022 3.13 7.82 0.96 56 XMSubMetaSx_00 8994 6.56 7.80 5.99 57 RCVD_IN_MSPIKE_BL 8776 3.25 7.61 1.24 58 TR_XM_MSPIKECOMBO 8691 3.23 7.53 1.24 59 BAYES_80 8607 5.66 7.46 4.82 60 SpammyFromTLD_01 8582 2.61 7.44 0.39 61 TooManyTo_001 8382 9.21 7.27 10.10 62 XM_SPF_SoftFail 8311 3.09 7.20 1.19 63 TR_XM_SpammyWords4 8169 5.24 7.08 4.39 64 RCVD_IN_MSPIKE_H4 7682 10.25 6.66 11.90 65 URI_NOVOWEL 7284 3.41 6.31 2.08 66 LotsOfNums_01 7275 8.42 6.31 9.40 67 RELAYCOUNTRY_CA 7061 2.61 6.12 0.98 68 SpammyFromTLD_02 7036 2.06 6.10 0.20 69 TR_XM_MaxUnsub 7016 2.61 6.08 1.01 70 GOOG_STO_IMG_HTML 6732 1.84 5.84 0.00 71 HTML_TAG_BALANCE_CENTER 6650 1.90 5.76 0.11 72 MIME_HTML_ONLY_MULTI 6500 4.54 5.63 4.04 73 XM_BadFromFormat 6343 1.80 5.50 0.09 74 TM2_M_VERY_LONG_WORD 6339 2.85 5.49 1.63 75 XMStrtUSub 6179 6.03 5.36 6.33 76 TR_XM_PhishingBody 5932 3.36 5.14 2.54 77 TM2_M_URI_OPT_OUT 5674 6.32 4.92 6.97 78 XM_H_Long_From01 5620 4.79 4.87 4.76 79 TR_XM_SPAMCOP 5552 1.69 4.81 0.25 80 HTML_SHORT_LINK_IMG_1 5456 1.50 4.73 0.01 81 XMNumbers 5373 4.44 4.66 4.34 82 DKIM_INVALID 5234 3.48 4.54 3.00 83 HDRS_MISSP 5204 1.43 4.51 0.01 84 BAYES_95 5199 3.42 4.51 2.92 85 T_REMOTE_IMAGE 5196 3.59 4.50 3.17 86 XM_B_Phish_Phrases 5095 3.95 4.42 3.73 87 TR_XM_DK_SendGrid 5068 4.19 4.39 4.10 88 FROM_SUSPICIOUS_NTLD 5014 1.42 4.35 0.07 89 RCVD_IN_VALIDITY_SAFE 4968 6.44 4.31 7.43 90 HTML_IMAGE_ONLY_08 4959 1.41 4.30 0.07 91 FROM_SUSPICIOUS_NTLD_FP 4917 1.39 4.26 0.06 92 JH_SPAMMY_HEADERS 4861 1.33 4.21 0.00 93 MIME_QP_LONG_LINE 4453 6.68 3.86 7.99 94 TR_XM_SpammyWords3 4414 1.62 3.83 0.60 95 HTML_IMAGE_RATIO_04 4365 5.60 3.78 6.44 96 TR_XM_SpammyWords5 4309 2.15 3.74 1.42 97 KHOP_HELO_FCRDNS 4288 1.75 3.72 0.84 98 RELAYCOUNTRY_FR 4172 1.29 3.62 0.22 99 RCVD_IN_VALIDITY_CERTIFIED 4162 5.61 3.61 6.53 100 TVD_SPACE_RATIO 4132 1.99 3.58 1.25 101 URIBL_DBL_SPAM 4107 1.14 3.56 0.02 102 RCVD_IN_MSPIKE_L3 4091 1.78 3.55 0.96 103 XM_B_SpammyTLD 4030 2.37 3.49 1.85 104 HTML_IMAGE_RATIO_06 3981 3.78 3.45 3.94 105 XM_UB60 3971 1.14 3.44 0.08 106 RCVD_IN_MSPIKE_L5 3827 1.07 3.32 0.04 107 XM_GoogleGroups 3813 2.70 3.31 2.41 108 RCVD_IN_VALIDITY_RPBL 3777 1.08 3.27 0.07 109 XM_UB99 3694 1.01 3.20 0.00 110 T_XMDrugObfuBody_14 3693 2.48 3.20 2.14 111 XMLngstWrd_00 3554 1.81 3.08 1.22 112 XMLngstWrd_01 3512 1.74 3.04 1.14 113 XM_B_Investor 3507 1.73 3.04 1.12 114 XMLngstWrd_02 3457 1.65 3.00 1.02 115 XMSexyCombo_01 3422 2.31 2.97 2.01 116 ALL_TRUSTED 3350 13.48 2.90 18.37 117 BAYES_40 3332 4.13 2.89 4.70 118 XMLngstWrd_03 3331 1.51 2.89 0.88 119 HTML_TITLE_SUBJ_DIFF 3327 1.19 2.88 0.41 120 XMLngstWrd_04 3282 1.42 2.85 0.77 121 UPPERCASE_75_100 3236 1.15 2.81 0.39 122 XM_UB999 3137 0.86 2.72 0.00 123 XMBody_17 3123 1.24 2.71 0.56 124 T_XMDrugObfuBody_08 3100 1.80 2.69 1.39 125 BOTNET_NORDNS 3100 0.85 2.69 0.01 126 XMGappySubj_01 3083 1.75 2.67 1.32 127 XMSubMetaI_00 2976 1.45 2.58 0.93 128 RCVD_IN_PSBL 2936 0.99 2.55 0.27 129 BAYES_20 2915 3.16 2.53 3.45 130 XM_DIRTYINTL 2902 0.98 2.52 0.27 131 HTML_SHORT_CENTER 2882 0.79 2.50 0.00 132 XM_DK_Undo_01 2806 1.78 2.43 1.48 133 HTML_IMAGE_ONLY_04 2778 0.78 2.41 0.03 134 BODY_URI_ONLY 2754 0.76 2.39 0.01 135 RELAYCOUNTRY_CZ 2739 0.77 2.37 0.03 136 FROM_NTLD_LINKBAIT 2726 0.75 2.36 0.00 137 SHORT_IMG_SUSP_NTLD 2626 0.72 2.28 0.00 138 T_FILL_THIS_FORM_SHORT 2621 1.11 2.27 0.57 139 FROM_EXCESS_BASE64 2568 3.44 2.23 3.99 140 HTML_FONT_SIZE_LARGE 2553 0.79 2.21 0.14 141 XMSubNoVowel 2545 1.88 2.21 1.72 142 USER_IN_DEF_DKIM_WL 2456 11.58 2.13 15.94 143 T_TooManySym_01 2401 5.91 2.08 7.68 144 XMDiploma_00 2383 1.30 2.07 0.95 145 HTML_TAG_BALANCE_BODY 2356 1.12 2.04 0.70 146 XM_B_Phish66 2320 1.53 2.01 1.31 147 XM_CamelCaseFrm001 2262 1.64 1.96 1.49 148 RELAYCOUNTRY_RU 2226 0.63 1.93 0.04 149 TR_XM_INV_DKIM 2132 0.77 1.85 0.28 150 RCVD_IN_IADB_LISTED 2044 3.49 1.77 4.28 151 XMSlimDrugH 2039 0.69 1.77 0.19 152 XMBdyGiftCard01 2026 1.29 1.76 1.07 153 T_XMHurry_00 1999 1.49 1.73 1.38 154 XM_UB80 1994 0.56 1.73 0.02 155 PDS_OTHER_BAD_TLD 1991 0.69 1.73 0.21 156 XM_OfRef6 1980 0.93 1.72 0.56 157 TR_XM_PHPDW 1977 0.78 1.71 0.35 158 RELAYCOUNTRY_AU 1967 0.70 1.71 0.24 159 MIXED_HREF_CASE 1954 0.54 1.69 0.00 160 MIXED_IMG_CASE 1949 0.54 1.69 0.00 161 MIXED_CENTER_CASE 1947 0.54 1.69 0.00 162 URI_HEX 1945 1.62 1.69 1.59 163 MIXED_AREA_CASE 1941 0.53 1.68 0.00 164 SHORT_URI_2 1935 2.85 1.68 3.39 165 MIXED_FONT_CASE 1934 0.53 1.68 0.00 166 TR_XM_PHPForged 1914 0.70 1.66 0.26 167 TR_XM_FormFill 1902 0.53 1.65 0.01 168 TR_XM_FormFill2 1872 0.69 1.62 0.26 169 XM_H_PHPOS 1858 0.68 1.61 0.25 170 SUBJ_ALL_CAPS 1853 1.43 1.61 1.35 171 XMStockSpam_06 1839 1.98 1.59 2.15 172 URI_NO_WWW_BIZ_CGI 1831 0.50 1.59 0.00 173 XM_B_Unsub2 1805 1.23 1.56 1.08 174 TR_XM_NoHeaderRelay 1802 0.61 1.56 0.17 175 SHOPIFY_IMG_NOT_RCVD_SFY 1784 0.69 1.55 0.29 176 RCVD_IN_IADB_SPF 1774 3.15 1.54 3.90 177 HTML_IMAGE_RATIO_08 1744 1.93 1.51 2.12 178 XMBrknScrpt_02 1737 1.14 1.51 0.98 179 XM_B_SpammyWords4 1735 0.73 1.50 0.37 180 RELAYCOUNTRY_IN 1730 0.54 1.50 0.10 181 TR_XM_BayesRelay 1725 0.48 1.50 0.00 182 URIBL_CSS 1676 0.47 1.45 0.02 183 URIBL_CSS_A 1676 0.47 1.45 0.02 184 XMSubMetaSxObfu_03 1666 0.73 1.44 0.41 185 DIET_1 1658 0.81 1.44 0.53 186 RCVD_IN_IADB_DK 1649 2.86 1.43 3.52 187 MAILING_LIST_MULTI 1640 3.33 1.42 4.21 188 RCVD_IN_IADB_SENDERID 1634 2.91 1.42 3.59 189 TO_NO_BRKTS_HTML_ONLY 1618 0.64 1.40 0.29 190 TR_Mismatch_TLD_02 1562 0.48 1.35 0.08 191 BAYES_00 1553 8.01 1.35 11.08 192 TR_LOTS_OF_MONEY3 1549 0.59 1.34 0.25 193 TM2_M_BODY_EMPTY 1545 0.54 1.34 0.17 194 XMEmptyBody_01 1497 0.43 1.30 0.03 195 RELAYCOUNTRY_BR 1482 0.42 1.28 0.01 196 XMPhish14 1474 0.61 1.28 0.31 197 T_Symld_Words_02 1453 0.54 1.26 0.22 198 XM_ProductURIs 1444 0.96 1.25 0.82 199 XMSpecificSbj 1419 0.39 1.23 0.00 200 TR_Symld_Words 1403 1.23 1.22 1.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 209951 87.52 95.21 83.97 2 RELAYCOUNTRY_US 197401 75.96 69.46 78.95 3 DKIM_SIGNED 184906 75.63 79.26 73.96 4 XM_DK_Pass 182256 74.26 77.21 72.90 5 DKIM_VALID 177410 72.15 74.73 70.96 6 XM_B_Unicode 170914 68.71 69.48 68.36 7 DCC_CHECK_NEGATIVE 149257 48.57 24.47 59.70 8 DKIM_VALID_AU 144132 57.59 57.47 57.65 9 BAYES_50 133877 48.65 38.04 53.55 10 XMListUnsubscribeExists 129044 55.63 64.33 51.61 11 XM_B_SpammyWords 112832 49.86 60.12 45.13 12 XM_B_Unicode3 112044 43.23 39.78 44.81 13 DCC_CHECK 100719 51.40 75.49 40.28 14 RCVD_IN_MSPIKE_WL 75407 26.61 18.92 30.16 15 HTML_FONT_LOW_CONTRAST 75212 29.51 28.26 30.08 16 LOC_TINY_FONT_1 68809 29.79 34.69 27.52 17 DKIM_VALID_EF 65428 26.70 27.84 26.17 18 FVGT_m_MULTI_ODD 63457 26.46 28.81 25.38 19 T_TM2_M_HEADER_IN_MSG 58932 21.92 18.33 23.57 20 MIME_HTML_ONLY 54877 26.04 34.92 21.95 21 RCVD_IN_MSPIKE_H2 50765 21.63 24.49 20.30 22 XMSubLong 50119 19.58 18.56 20.05 23 ALL_TRUSTED 45921 13.48 2.90 18.37 24 T_KAM_HTML_FONT_INVALID 45609 20.51 25.44 18.24 25 XM_B_SpammyWords2 45169 21.91 30.24 18.07 26 RCVD_IN_MSPIKE_H3 40652 14.89 11.93 16.26 27 USER_IN_DEF_DKIM_WL 39856 11.58 2.13 15.94 28 XM_Body_Dirty_Words 35187 15.51 18.61 14.07 29 XM_B_Unsub 33859 13.30 12.78 13.54 30 XM_Multi_Part_URI 33351 14.22 16.12 13.34 31 RCVD_IN_MSPIKE_H4 29764 10.25 6.66 11.90 32 BAYES_00 27713 8.01 1.35 11.08 33 XM_DKIMWhitelistDomains 26620 7.30 0.03 10.65 34 BAYES_60 26274 9.90 8.59 10.51 35 TooManyTo_001 25264 9.21 7.27 10.10 36 XM_Evil_Numbers_Gen 25083 9.34 7.84 10.03 37 LotsOfNums_01 23494 8.42 6.31 9.40 38 UNPARSEABLE_RELAY 21954 10.26 13.48 8.78 39 XM_DK_Undo_02 21596 19.59 43.33 8.64 40 MIME_QP_LONG_LINE 19965 6.68 3.86 7.99 41 HTML_IMAGE_RATIO_02 19831 8.14 8.58 7.93 42 T_TooManySym_01 19190 5.91 2.08 7.68 43 RCVD_IN_VALIDITY_SAFE 18566 6.44 4.31 7.43 44 TR_XM_UnparsRelay 17648 8.99 13.18 7.06 45 TM2_M_URI_OPT_OUT 17424 6.32 4.92 6.97 46 BAYES_99 17159 15.37 33.80 6.86 47 XM_SendGrid 16489 7.10 8.19 6.59 48 TR_XM_DKIM_Undo 16483 14.81 32.63 6.59 49 TR_XM_DK_Bayes 16371 4.64 0.51 6.55 50 RCVD_IN_VALIDITY_CERTIFIED 16339 5.61 3.61 6.53 51 TR_XM_DK_Bayes1 16119 4.57 0.49 6.45 52 HTML_IMAGE_RATIO_04 16100 5.60 3.78 6.44 53 XMStrtUSub 15837 6.03 5.36 6.33 54 LOTS_OF_MONEY 15547 6.99 8.66 6.22 55 XMSubMetaSx_00 14987 6.56 7.80 5.99 56 TR_XM_DK_Bayes2 14442 4.08 0.40 5.78 57 MPART_ALT_DIFF 14384 7.79 12.21 5.75 58 BAYES_999 13818 12.44 27.43 5.53 59 BOTNET_IPINHOSTNAME 13335 7.20 11.24 5.33 60 IN_ZIMBRA_NJ_WHITELIST 13064 3.60 0.08 5.23 61 XMSexyCombo_05 13033 6.68 9.85 5.21 62 FSL_BULK_SIG 12659 8.90 17.21 5.06 63 BAYES_80 12063 5.66 7.46 4.82 64 XM_H_Long_From01 11892 4.79 4.87 4.76 65 BAYES_40 11752 4.13 2.89 4.70 66 XM_H_Trusted_IP 11682 3.20 0.00 4.67 67 T_TooManySym_02 11190 3.27 0.65 4.48 68 TR_XM_SpammyWords4 10972 5.24 7.08 4.39 69 XMNumbers 10850 4.44 4.66 4.34 70 RCVD_IN_IADB_LISTED 10708 3.49 1.77 4.28 71 MAILING_LIST_MULTI 10536 3.33 1.42 4.21 72 TR_XM_DK_SendGrid 10258 4.19 4.39 4.10 73 MIME_HTML_ONLY_MULTI 10095 4.54 5.63 4.04 74 FROM_EXCESS_BASE64 9983 3.44 2.23 3.99 75 HTML_IMAGE_RATIO_06 9845 3.78 3.45 3.94 76 RCVD_IN_IADB_SPF 9751 3.15 1.54 3.90 77 ANY_BOUNCE_MESSAGE 9749 2.82 0.47 3.90 78 BOUNCE_MESSAGE 9749 2.82 0.47 3.90 79 XM_B_SpammyWords3 9734 5.20 8.02 3.89 80 XM_UncommonTLD01 9706 7.68 15.90 3.88 81 RELAYCOUNTRY_META 9336 11.44 28.14 3.73 82 XM_B_Phish_Phrases 9320 3.95 4.42 3.73 83 RCVD_IN_IADB_SENDERID 8983 2.91 1.42 3.59 84 RCVD_IN_IADB_DK 8809 2.86 1.43 3.52 85 BAYES_20 8616 3.16 2.53 3.45 86 SHORT_URI_2 8471 2.85 1.68 3.39 87 TR_DCC_Bayes_99 8083 10.57 26.46 3.23 88 T_REMOTE_IMAGE 7921 3.59 4.50 3.17 89 XM_PDF 7525 2.34 0.88 3.01 90 DKIM_INVALID 7496 3.48 4.54 3.00 91 BAYES_95 7311 3.42 4.51 2.92 92 INVALID_MSGID 6419 1.84 0.26 2.57 93 TR_XM_PhishingBody 6341 3.36 5.14 2.54 94 TO_MALFORMED 6135 1.68 0.02 2.45 95 MSGID_NOFQDN1 6075 1.72 0.18 2.43 96 MIME_HTML_MOSTLY 6045 4.19 8.02 2.42 97 XM_GoogleGroups 6038 2.70 3.31 2.41 98 RCVD_IN_IADB_VOUCHED 5917 1.91 0.93 2.37 99 XMStockSpam_06 5381 1.98 1.59 2.15 100 T_XMDrugObfuBody_14 5360 2.48 3.20 2.14 101 HTML_IMAGE_RATIO_08 5311 1.93 1.51 2.12 102 BAYES_05 5247 1.70 0.84 2.10 103 TVD_RCVD_IP 5194 1.49 0.21 2.08 104 URI_NOVOWEL 5188 3.41 6.31 2.08 105 HTML_MIME_NO_HTML_TAG 5163 5.44 12.75 2.07 106 XMSexyCombo_01 5022 2.31 2.97 2.01 107 RCVD_IN_MSPIKE_H5 4991 1.47 0.33 2.00 108 IN_HORDE_ADDRESS_BOOK 4882 1.40 0.20 1.95 109 XM_B_SpammyTLD 4637 2.37 3.49 1.85 110 TR_XM_SpammyWords2 4502 4.79 11.28 1.80 111 XMSubNoVowel 4312 1.88 2.21 1.72 112 BOTNET 4122 6.96 18.49 1.65 113 TM2_M_VERY_LONG_WORD 4066 2.85 5.49 1.63 114 URI_HEX 3968 1.62 1.69 1.59 115 RCVD_IN_IADB_OPTIN 3930 1.25 0.56 1.57 116 TR_XM_SB_Phish 3799 1.42 1.19 1.52 117 UNTRUSTED_Relay 3768 7.77 21.33 1.51 118 TR_XM_SpammyRelay 3758 5.34 13.65 1.50 119 XMSubPhish11 3745 1.35 1.03 1.50 120 XM_CamelCaseFrm001 3714 1.64 1.96 1.49 121 XMBSHREFv2 3706 1.09 0.24 1.48 122 XM_DK_Undo_01 3705 1.78 2.43 1.48 123 TR_XM_SpammyWords5 3560 2.15 3.74 1.42 124 T_XMDrugObfuBody_08 3474 1.80 2.69 1.39 125 TooManyTo_002 3468 1.25 0.96 1.39 126 RCVD_IN_RP_SAFE 3452 1.29 1.11 1.38 127 T_XMHurry_00 3451 1.49 1.73 1.38 128 SUBJ_ALL_CAPS 3368 1.43 1.61 1.35 129 HTML_FONT_FACE_BAD 3318 1.18 0.86 1.33 130 XMGappySubj_01 3307 1.75 2.67 1.32 131 XM_B_Phish66 3286 1.53 2.01 1.31 132 XMNoVowels 3221 1.06 0.55 1.29 133 XM_H_Long_From02 3164 1.12 0.79 1.27 134 TVD_SPACE_RATIO 3129 1.99 3.58 1.25 135 XM_E_Blogspot 3116 0.91 0.17 1.25 136 RCVD_IN_MSPIKE_BL 3099 3.25 7.61 1.24 137 TR_XM_MSPIKECOMBO 3096 3.23 7.53 1.24 138 TR_Symld_Words 3083 1.23 1.22 1.23 139 XMLngstWrd_00 3055 1.81 3.08 1.22 140 RCVD_IN_RP_CERTIFIED 3017 1.11 0.92 1.21 141 XM_SPF_SoftFail 2965 3.09 7.20 1.19 142 XMLngstWrd_01 2857 1.74 3.04 1.14 143 T_TooManySym_03 2829 0.84 0.22 1.13 144 XM_B_Investor 2808 1.73 3.04 1.12 145 XM_B_Unsub2 2698 1.23 1.56 1.08 146 XMBdyGiftCard01 2679 1.29 1.76 1.07 147 TooManyTo_003 2574 0.98 0.88 1.03 148 XMLngstWrd_02 2559 1.65 3.00 1.02 149 DKIM_ADSP_CUSTOM_MED 2540 1.02 1.03 1.02 150 TR_XM_MaxUnsub 2528 2.61 6.08 1.01 151 RCVD_IN_BL_SPAMCOP_NET 2498 3.79 9.82 1.00 152 XM_RXBody 2466 0.80 0.39 0.99 153 RELAYCOUNTRY_CA 2462 2.61 6.12 0.98 154 XMBody_95 2452 0.71 0.12 0.98 155 XMBrknScrpt_02 2438 1.14 1.51 0.98 156 RCVD_IN_MSPIKE_L3 2405 1.78 3.55 0.96 157 XM_UB50 2398 3.13 7.82 0.96 158 XMDiploma_00 2370 1.30 2.07 0.95 159 XMSubMetaI_00 2326 1.45 2.58 0.93 160 XMLngstWrd_03 2202 1.51 2.89 0.88 161 KHOP_HELO_FCRDNS 2095 1.75 3.72 0.84 162 TooManyTo_004 2066 0.82 0.80 0.83 163 XM_ProductURIs 2047 0.96 1.25 0.82 164 TVD_PH_BODY_ACCOUNTS_PRE 2010 0.57 0.07 0.80 165 XMLngstWrd_04 1917 1.42 2.85 0.77 166 XM_B_COPY_HTML 1870 0.81 0.94 0.75 167 TooManyTo_005 1796 0.73 0.75 0.72 168 URI_TRY_3LD 1765 0.77 0.91 0.71 169 HTML_TAG_BALANCE_BODY 1738 1.12 2.04 0.70 170 XMPhish30 1728 0.80 1.04 0.69 171 TR_MetaPhish_Combo_01 1697 0.79 1.02 0.68 172 XM_B_COVIDMETA 1642 0.68 0.73 0.66 173 HTML_IMAGE_ONLY_20 1638 0.52 0.23 0.66 174 NML_ADSP_CUSTOM_MED 1529 0.65 0.72 0.61 175 T_XMDrugObfuBody_00 1522 0.75 1.07 0.61 176 RELAYCOUNTRY_GB 1519 0.71 0.93 0.61 177 SHORTENED_URL_HREF 1513 0.55 0.44 0.61 178 TR_XM_SpammyWords3 1505 1.62 3.83 0.60 179 USER_IN_WELCOMELIST 1504 0.41 0.00 0.60 180 USER_IN_WHITELIST 1504 0.41 0.00 0.60 181 FORGED_GMAIL_RCVD 1480 0.69 0.89 0.59 182 TR_MSPIKEBAYES00 1457 0.40 0.01 0.58 183 T_FILL_THIS_FORM_SHORT 1426 1.11 2.27 0.57 184 XM_H_PHPMailer 1408 0.66 0.87 0.56 185 XM_OfRef6 1405 0.93 1.72 0.56 186 PLING_QUERY 1400 0.62 0.75 0.56 187 XMBody_17 1391 1.24 2.71 0.56 188 XMSubMetaSxObfu_02 1378 0.47 0.29 0.55 189 T_TooManySym_04 1363 0.41 0.13 0.55 190 HTTPS_HTTP_MISMATCH 1326 0.66 0.95 0.53 191 DIET_1 1315 0.81 1.44 0.53 192 HELO_NODOT 1275 0.49 0.45 0.51 193 HELO_NO_DOMAIN 1275 0.49 0.45 0.51 194 DKIM_ADSP_NXDOMAIN 1265 0.59 0.77 0.51 195 RDNS_DYNAMIC 1262 0.50 0.48 0.50 196 XMCapTrack 1246 0.42 0.24 0.50 197 MPART_ALT_DIFF_COUNT 1175 0.45 0.42 0.47 198 XMGenDplmaNmb 1125 0.49 0.58 0.45 199 THIS_AD 1115 0.55 0.79 0.45 200 XMHTML_After_End 1106 0.50 0.62 0.44 ----------------------------------------------------------------------