Email: 273099 Autolearn: 0 AvgScore: 3.50 AvgScanTime: 1.34 sec Spam: 94434 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 1.43 sec Ham: 178665 Autolearn: 0 AvgScore: -1.99 AvgScanTime: 1.30 sec Time Spent Running SA: 101.75 hours Time Spent Processing Spam: 37.42 hours Time Spent Processing Ham: 64.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88149 86.43 93.34 82.78 2 DKIM_SIGNED 82185 80.25 87.03 76.67 3 XM_DK_Pass 80892 78.98 85.66 75.45 4 DKIM_VALID 80342 78.49 85.08 75.01 5 XM_B_Unicode 79610 75.61 84.30 71.02 6 RELAYCOUNTRY_US 70605 77.84 74.77 79.47 7 XM_B_SpammyWords 67601 54.26 71.59 45.11 8 DCC_CHECK 67445 49.92 71.42 38.56 9 XMListUnsubscribeExists 64900 59.04 68.73 53.91 10 DKIM_VALID_AU 61348 63.96 64.96 63.42 11 XM_B_Unicode3 46599 46.60 49.35 45.15 12 RCVD_IN_MSPIKE_H2 46000 41.79 48.71 38.13 13 XM_DK_Undo_02 42493 21.17 45.00 8.57 14 BAYES_99 35489 17.87 37.58 7.45 15 BAYES_50 35428 49.19 37.52 55.36 16 TR_XM_DKIM_Undo 35141 16.51 37.21 5.57 17 XM_B_SpammyWords2 34882 25.65 36.94 19.68 18 LOC_TINY_FONT_1 34329 31.04 36.35 28.23 19 HTML_FONT_LOW_CONTRAST 32709 33.47 34.64 32.86 20 DKIM_VALID_EF 31939 31.19 33.82 29.80 21 MIME_HTML_ONLY 30385 24.94 32.18 21.11 22 BAYES_999 28299 14.42 29.97 6.20 23 T_KAM_HTML_FONT_INVALID 27309 22.85 28.92 19.64 24 DCC_CHECK_NEGATIVE 26965 50.05 28.55 61.42 25 FVGT_m_MULTI_ODD 26525 26.80 28.09 26.11 26 TR_DCC_Bayes_99 24104 10.66 25.52 2.80 27 RELAYCOUNTRY_META 22422 10.78 23.74 3.93 28 XM_Body_Dirty_Words 21407 16.16 22.67 12.72 29 XMSubLong 19594 21.80 20.75 22.36 30 T_TM2_M_HEADER_IN_MSG 18837 22.29 19.95 23.52 31 XM_Multi_Part_URI 17720 15.54 18.76 13.83 32 TR_XM_SpammyRelay 16673 7.43 17.66 2.02 33 XM_B_Unsub 15388 11.80 16.29 9.43 34 TR_XM_BayesUnsub 15007 10.45 15.89 7.57 35 UNPARSEABLE_RELAY 12086 9.83 12.80 8.26 36 TR_XM_SpammyWords2 12009 5.46 12.72 1.62 37 XM_B_SpammyWords3 11873 7.49 12.57 4.80 38 TR_XM_UnparsRelay 11861 8.61 12.56 6.52 39 BOTNET_IPINHOSTNAME 11546 8.81 12.23 7.00 40 RCVD_IN_MSPIKE_WL 11534 16.50 12.21 18.77 41 RELAYCOUNTRY_CA 11350 5.25 12.02 1.68 42 XMSexyCombo_05 10666 6.71 11.29 4.28 43 RCVD_IN_BL_SPAMCOP_NET 10235 3.98 10.84 0.35 44 BOTNET 10161 4.99 10.76 1.93 45 LOTS_OF_MONEY 10133 8.47 10.73 7.27 46 UNTRUSTED_Relay 9356 4.50 9.91 1.64 47 FSL_BULK_SIG 9236 5.34 9.78 2.99 48 TR_XM_SpammyWords4 9087 6.42 9.62 4.73 49 XM_UncommonTLD01 8412 6.35 8.91 5.00 50 BAYES_80 8044 6.11 8.52 4.84 51 HTML_IMAGE_RATIO_02 7339 7.36 7.77 7.15 52 XM_SendGrid 7240 6.23 7.67 5.47 53 MPART_ALT_DIFF 7208 6.49 7.63 5.89 54 RCVD_IN_MSPIKE_H3 7117 10.14 7.54 11.52 55 TR_XM_SPAMCOP 7066 2.71 7.48 0.19 56 BAYES_60 6877 9.71 7.28 11.00 57 XM_Evil_Numbers_Gen 6595 8.47 6.98 9.26 58 XMSubMetaSx_00 6561 5.17 6.95 4.24 59 TR_XM_PhishingBody 5777 3.87 6.12 2.67 60 MIME_HTML_MOSTLY 5752 4.76 6.09 4.05 61 TooManyTo_001 5493 6.17 5.82 6.36 62 LotsOfNums_01 5437 6.79 5.76 7.34 63 RCVD_IN_VALIDITY_SAFE 5401 6.84 5.72 7.43 64 XM_H_Long_From01 5367 5.12 5.68 4.82 65 T_XMDrugObfuBody_08 5253 2.81 5.56 1.36 66 BAYES_95 4865 4.33 5.15 3.89 67 T_FILL_THIS_FORM_SHORT 4778 2.65 5.06 1.38 68 XM_UB50 4701 2.34 4.98 0.95 69 TR_XM_DK_SendGrid 4680 4.04 4.96 3.56 70 T_XMDrugObfuBody_14 4584 3.05 4.85 2.10 71 XMBody_17 4255 1.94 4.51 0.58 72 XMStrtUSub 4253 5.52 4.50 6.06 73 RCVD_IN_MSPIKE_H4 4251 5.27 4.50 5.67 74 XM_B_SpammyTLD 4165 3.03 4.41 2.30 75 XM_SPF_SoftFail 4165 2.82 4.41 1.98 76 XM_B_Phish_Phrases 4019 3.25 4.26 2.71 77 RCVD_IN_VALIDITY_CERTIFIED 4004 5.77 4.24 6.58 78 HTML_IMAGE_RATIO_04 3874 5.15 4.10 5.71 79 RCVD_IN_VALIDITY_RPBL 3823 1.44 4.05 0.06 80 TR_XM_SpammyWords5 3704 2.49 3.92 1.73 81 RCVD_IN_MSPIKE_BL 3470 1.66 3.67 0.59 82 URI_NOVOWEL 3381 2.44 3.58 1.84 83 HTML_IMAGE_RATIO_06 3370 4.26 3.57 4.63 84 DOS_RCVD_IP_TWICE_B 3353 1.84 3.55 0.94 85 XM_CamelCaseFrm001 3333 2.23 3.53 1.54 86 TR_XM_MSPIKECOMBO 3278 1.58 3.47 0.58 87 XM_B_Investor 3088 1.96 3.27 1.27 88 XM_DIRTYINTL 3068 1.28 3.25 0.23 89 FONT_INVIS_LONG_LINE 2985 1.21 3.16 0.19 90 T_REMOTE_IMAGE 2952 3.14 3.13 3.15 91 T_TooManySym_01 2945 6.97 3.12 9.01 92 XMNumbers 2931 4.04 3.10 4.53 93 XM_B_Phish66 2810 1.80 2.98 1.17 94 USER_IN_DEF_DKIM_WL 2764 12.85 2.93 18.09 95 ALL_TRUSTED 2749 12.03 2.91 16.84 96 SpammyFromTLD_01 2685 1.30 2.84 0.48 97 PDS_OTHER_BAD_TLD 2620 1.07 2.77 0.18 98 TR_XM_FormFill 2616 1.39 2.77 0.66 99 BOTNET_NORDNS 2569 0.95 2.72 0.02 100 HTML_IMAGE_RATIO_08 2534 2.63 2.68 2.61 101 MIME_HTML_ONLY_MULTI 2466 3.00 2.61 3.20 102 RCVD_IN_PSBL 2457 1.45 2.60 0.84 103 SUBJ_ALL_CAPS 2451 1.80 2.60 1.37 104 SpammyFromTLD_02 2430 1.01 2.57 0.19 105 XMDiploma_00 2372 1.84 2.51 1.48 106 TM2_M_URI_OPT_OUT 2298 2.59 2.43 2.67 107 TM2_M_VERY_LONG_WORD 2168 1.68 2.30 1.35 108 RELAYCOUNTRY_IN 2129 0.80 2.25 0.03 109 XM_OfRef6 2110 1.63 2.23 1.31 110 XMBdyGiftCard01 2078 2.02 2.20 1.92 111 TR_XM_NoHeaderRelay 2038 0.81 2.16 0.10 112 XM_DK_Undo_01 1922 1.54 2.04 1.27 113 XMSexyCombo_01 1918 1.18 2.03 0.73 114 TR_XM_PHPDW 1874 0.90 1.98 0.32 115 FROM_EXCESS_BASE64 1857 2.79 1.97 3.23 116 DKIM_INVALID 1843 1.77 1.95 1.67 117 XMStockSpam_06 1835 2.08 1.94 2.15 118 TR_XM_PHPForged 1785 0.81 1.89 0.24 119 XM_B_SpammyWords4 1774 1.21 1.88 0.86 120 MIME_QP_LONG_LINE 1768 2.77 1.87 3.25 121 TR_XM_FormFill2 1749 0.79 1.85 0.23 122 XM_H_PHPOS 1746 0.79 1.85 0.23 123 HK_RANDOM_REPLYTO 1743 0.69 1.85 0.07 124 XM_B_Unsub2 1703 1.37 1.80 1.14 125 T_XMHurry_00 1675 1.00 1.77 0.60 126 XM_UB99 1642 0.60 1.74 0.00 127 MAILING_LIST_MULTI 1605 2.02 1.70 2.19 128 TR_XM_SpammyWords3 1576 0.74 1.67 0.25 129 HTML_IMAGE_ONLY_24 1561 0.73 1.65 0.24 130 RCVD_IN_MSPIKE_L3 1556 0.93 1.65 0.56 131 BAYES_40 1550 3.30 1.64 4.18 132 TR_XM_MSPIKECOMBO2 1518 0.63 1.61 0.12 133 TR_XM_InvalidRelay 1489 0.56 1.58 0.02 134 TR_LOTS_OF_MONEY3 1472 0.70 1.56 0.24 135 HTML_OBFUSCATE_05_10 1471 0.69 1.56 0.24 136 RCVD_IN_MSPIKE_L5 1469 0.55 1.56 0.02 137 TR_Symld_Words 1432 1.62 1.52 1.67 138 KHOP_HELO_FCRDNS 1410 1.42 1.49 1.38 139 HTML_TAG_BALANCE_BODY 1381 1.34 1.46 1.27 140 URIBL_DBL_SPAM 1346 0.50 1.43 0.01 141 TR_XM_SB_Phish 1339 1.54 1.42 1.61 142 URI_HEX 1336 1.40 1.41 1.39 143 XM_UB999 1299 0.48 1.38 0.00 144 MPART_ALT_DIFF_COUNT 1293 1.11 1.37 0.97 145 TM2_M_BODY_EMPTY 1292 1.05 1.37 0.88 146 TM2_M_A_HREF_HREF 1286 0.82 1.36 0.54 147 XMSubMetaI_00 1272 0.83 1.35 0.56 148 T_XMDrugObfuBody_00 1264 0.70 1.34 0.36 149 HTTP_EXCESSIVE_ESCAPES 1246 0.46 1.32 0.00 150 XMEmptyBody_01 1237 0.91 1.31 0.70 151 XM_URI_RBL 1235 0.52 1.31 0.10 152 RCVD_IN_IADB_LISTED 1229 2.56 1.30 3.23 153 XM_ProductURIs 1228 0.93 1.30 0.74 154 XMSubPhish11 1205 1.48 1.28 1.59 155 DIET_1 1202 0.69 1.27 0.39 156 XMBrknScrpt_02 1188 0.92 1.26 0.75 157 XMPhish08 1185 0.62 1.25 0.28 158 RELAYCOUNTRY_FR 1158 0.57 1.23 0.22 159 XM_UB60 1142 0.45 1.21 0.06 160 XMGenDplmaNmb 1114 0.77 1.18 0.55 161 XMSexyCombo_04 1113 0.65 1.18 0.37 162 SHOPIFY_IMG_NOT_RCVD_SFY 1111 0.58 1.18 0.26 163 TR_XM_BayesRelay 1106 0.41 1.17 0.00 164 XMPhish30 1105 0.89 1.17 0.74 165 BAYES_20 1096 2.17 1.16 2.70 166 RCVD_IN_RP_SAFE 1078 1.35 1.14 1.46 167 FROM_SUSPICIOUS_NTLD 1071 0.41 1.13 0.03 168 XMReplyNow 1066 0.54 1.13 0.22 169 RCVD_IN_IADB_SPF 1052 2.27 1.11 2.88 170 THIS_AD 1050 0.72 1.11 0.51 171 XM_Body_Dirty_Words_01 1049 0.48 1.11 0.14 172 URIBL_BLACK 1036 0.40 1.10 0.03 173 XMHTMLBadTable_001 1032 0.80 1.09 0.64 174 FROM_SUSPICIOUS_NTLD_FP 1026 0.39 1.09 0.02 175 RCVD_IN_IADB_DK 1018 2.01 1.08 2.51 176 HTML_MIME_NO_HTML_TAG 1006 1.27 1.07 1.38 177 RCVD_IN_IADB_SENDERID 996 2.05 1.05 2.58 178 TR_Mismatch_TLD_02 995 0.42 1.05 0.09 179 XM_H_PHPMailer 986 0.76 1.04 0.62 180 XMHTML_After_End 986 0.72 1.04 0.55 181 HELO_NODOT 981 0.65 1.04 0.44 182 T_TooManySym_02 974 3.87 1.03 5.37 183 RELAYCOUNTRY_AU 932 0.48 0.99 0.22 184 TR_XM_Base64_M1 915 1.22 0.97 1.36 185 LongTLD 901 0.58 0.95 0.38 186 NO_DNS_FOR_FROM 901 0.56 0.95 0.35 187 FORGED_RELAY_MUA_TO_MX 890 0.35 0.94 0.04 188 XM_H_Long_From02 882 1.15 0.93 1.26 189 XMSubNoVowel 876 0.95 0.93 0.97 190 HTTPS_HTTP_MISMATCH 876 0.74 0.93 0.65 191 URIBL_DBL_ABUSE_SPAM 870 0.33 0.92 0.02 192 TR_XM_MaxSPIKE 866 0.39 0.92 0.12 193 XM_H_Undi_Recip 860 0.45 0.91 0.21 194 TR_XM_MaxWHORU 851 0.48 0.90 0.26 195 XMhairloss01 849 0.33 0.90 0.03 196 DKIM_ADSP_CUSTOM_MED 845 0.89 0.89 0.89 197 PLING_QUERY 844 0.63 0.89 0.49 198 RELAYCOUNTRY_RU 837 0.32 0.89 0.03 199 HTML_FONT_FACE_BAD 836 1.22 0.89 1.39 200 NORDNS_LOW_CONTRAST 828 0.33 0.88 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147899 86.43 93.34 82.78 2 RELAYCOUNTRY_US 141987 77.84 74.77 79.47 3 DKIM_SIGNED 136988 80.25 87.03 76.67 4 XM_DK_Pass 134809 78.98 85.66 75.45 5 DKIM_VALID 134009 78.49 85.08 75.01 6 XM_B_Unicode 126879 75.61 84.30 71.02 7 DKIM_VALID_AU 113315 63.96 64.96 63.42 8 DCC_CHECK_NEGATIVE 109732 50.05 28.55 61.42 9 BAYES_50 98916 49.19 37.52 55.36 10 XMListUnsubscribeExists 96324 59.04 68.73 53.91 11 XM_B_Unicode3 80663 46.60 49.35 45.15 12 XM_B_SpammyWords 80592 54.26 71.59 45.11 13 DCC_CHECK 68887 49.92 71.42 38.56 14 RCVD_IN_MSPIKE_H2 68126 41.79 48.71 38.13 15 HTML_FONT_LOW_CONTRAST 58709 33.47 34.64 32.86 16 DKIM_VALID_EF 53243 31.19 33.82 29.80 17 LOC_TINY_FONT_1 50444 31.04 36.35 28.23 18 FVGT_m_MULTI_ODD 46653 26.80 28.09 26.11 19 T_TM2_M_HEADER_IN_MSG 42026 22.29 19.95 23.52 20 XMSubLong 39947 21.80 20.75 22.36 21 MIME_HTML_ONLY 37718 24.94 32.18 21.11 22 XM_B_SpammyWords2 35158 25.65 36.94 19.68 23 T_KAM_HTML_FONT_INVALID 35096 22.85 28.92 19.64 24 RCVD_IN_MSPIKE_WL 33537 16.50 12.21 18.77 25 USER_IN_DEF_DKIM_WL 32324 12.85 2.93 18.09 26 ALL_TRUSTED 30096 12.03 2.91 16.84 27 XM_Multi_Part_URI 24714 15.54 18.76 13.83 28 XM_DKIMWhitelistDomains 23714 8.71 0.07 13.27 29 XM_Body_Dirty_Words 22729 16.16 22.67 12.72 30 RCVD_IN_MSPIKE_H3 20576 10.14 7.54 11.52 31 BAYES_60 19647 9.71 7.28 11.00 32 XM_B_Unsub 16849 11.80 16.29 9.43 33 XM_Evil_Numbers_Gen 16542 8.47 6.98 9.26 34 T_TooManySym_01 16093 6.97 3.12 9.01 35 BAYES_00 15595 5.88 0.50 8.73 36 XM_DK_Undo_02 15309 21.17 45.00 8.57 37 UNPARSEABLE_RELAY 14760 9.83 12.80 8.26 38 TR_XM_BayesUnsub 13524 10.45 15.89 7.57 39 BAYES_99 13316 17.87 37.58 7.45 40 RCVD_IN_VALIDITY_SAFE 13281 6.84 5.72 7.43 41 LotsOfNums_01 13110 6.79 5.76 7.34 42 LOTS_OF_MONEY 12993 8.47 10.73 7.27 43 HTML_IMAGE_RATIO_02 12773 7.36 7.77 7.15 44 BOTNET_IPINHOSTNAME 12504 8.81 12.23 7.00 45 RCVD_IN_VALIDITY_CERTIFIED 11760 5.77 4.24 6.58 46 TR_XM_UnparsRelay 11651 8.61 12.56 6.52 47 TooManyTo_001 11357 6.17 5.82 6.36 48 BAYES_999 11077 14.42 29.97 6.20 49 TR_XM_DK_Bayes 11020 4.16 0.37 6.17 50 TR_XM_DK_Bayes1 10941 4.13 0.37 6.12 51 XMStrtUSub 10832 5.52 4.50 6.06 52 MPART_ALT_DIFF 10525 6.49 7.63 5.89 53 IN_ZIMBRA_NJ_WHITELIST 10215 3.76 0.05 5.72 54 HTML_IMAGE_RATIO_04 10200 5.15 4.10 5.71 55 RCVD_IN_MSPIKE_H4 10134 5.27 4.50 5.67 56 TR_XM_DKIM_Undo 9951 16.51 37.21 5.57 57 TR_XM_DK_Bayes2 9807 3.68 0.26 5.49 58 XM_SendGrid 9766 6.23 7.67 5.47 59 T_TooManySym_02 9590 3.87 1.03 5.37 60 XM_UncommonTLD01 8929 6.35 8.91 5.00 61 BAYES_80 8649 6.11 8.52 4.84 62 XM_H_Long_From01 8615 5.12 5.68 4.82 63 XM_B_SpammyWords3 8574 7.49 12.57 4.80 64 TR_XM_SpammyWords4 8448 6.42 9.62 4.73 65 HTML_IMAGE_RATIO_06 8273 4.26 3.57 4.63 66 XMNumbers 8094 4.04 3.10 4.53 67 XMSexyCombo_05 7652 6.71 11.29 4.28 68 XMSubMetaSx_00 7569 5.17 6.95 4.24 69 BAYES_40 7465 3.30 1.64 4.18 70 MIME_HTML_MOSTLY 7241 4.76 6.09 4.05 71 INVALID_MSGID 7066 2.64 0.16 3.95 72 RELAYCOUNTRY_META 7025 10.78 23.74 3.93 73 BAYES_95 6956 4.33 5.15 3.89 74 MSGID_NOFQDN1 6717 2.48 0.06 3.76 75 TVD_RCVD_IP 6582 2.59 0.51 3.68 76 TR_XM_DK_SendGrid 6354 4.04 4.96 3.56 77 TO_MALFORMED 5919 2.19 0.05 3.31 78 MIME_QP_LONG_LINE 5810 2.77 1.87 3.25 79 RCVD_IN_IADB_LISTED 5773 2.56 1.30 3.23 80 FROM_EXCESS_BASE64 5763 2.79 1.97 3.23 81 MIME_HTML_ONLY_MULTI 5718 3.00 2.61 3.20 82 T_REMOTE_IMAGE 5627 3.14 3.13 3.15 83 FSL_BULK_SIG 5341 5.34 9.78 2.99 84 RCVD_IN_IADB_SPF 5147 2.27 1.11 2.88 85 TR_DCC_Bayes_99 5005 10.66 25.52 2.80 86 XM_B_Phish_Phrases 4848 3.25 4.26 2.71 87 BAYES_20 4817 2.17 1.16 2.70 88 XM_H_Trusted_IP 4816 1.76 0.00 2.70 89 TR_XM_PhishingBody 4779 3.87 6.12 2.67 90 TM2_M_URI_OPT_OUT 4775 2.59 2.43 2.67 91 HTML_IMAGE_RATIO_08 4657 2.63 2.68 2.61 92 RCVD_IN_IADB_SENDERID 4605 2.05 1.05 2.58 93 RCVD_IN_IADB_DK 4482 2.01 1.08 2.51 94 XMBSHREFv2 4123 1.57 0.17 2.31 95 XM_B_SpammyTLD 4106 3.03 4.41 2.30 96 MAILING_LIST_MULTI 3917 2.02 1.70 2.19 97 XMStockSpam_06 3833 2.08 1.94 2.15 98 T_XMDrugObfuBody_14 3746 3.05 4.85 2.10 99 IN_HORDE_ADDRESS_BOOK 3739 1.40 0.09 2.09 100 RCVD_IN_IADB_VOUCHED 3735 1.58 0.61 2.09 101 TR_XM_SpammyRelay 3606 7.43 17.66 2.02 102 XM_SPF_SoftFail 3543 2.82 4.41 1.98 103 XM_PDF 3523 1.41 0.35 1.97 104 BOTNET 3457 4.99 10.76 1.93 105 XMBdyGiftCard01 3425 2.02 2.20 1.92 106 BAYES_05 3304 1.43 0.65 1.85 107 URI_NOVOWEL 3286 2.44 3.58 1.84 108 ANY_BOUNCE_MESSAGE 3137 1.32 0.51 1.76 109 BOUNCE_MESSAGE 3136 1.32 0.50 1.76 110 TR_XM_SpammyWords5 3096 2.49 3.92 1.73 111 XMBody_95 3023 1.13 0.08 1.69 112 RELAYCOUNTRY_CA 2993 5.25 12.02 1.68 113 XMGappySubj_01 2984 1.14 0.14 1.67 114 TR_Symld_Words 2982 1.62 1.52 1.67 115 DKIM_INVALID 2979 1.77 1.95 1.67 116 UNTRUSTED_Relay 2934 4.50 9.91 1.64 117 TR_XM_SpammyWords2 2891 5.46 12.72 1.62 118 TR_XM_SB_Phish 2868 1.54 1.42 1.61 119 XMSubPhish11 2836 1.48 1.28 1.59 120 RCVD_IN_MSPIKE_H5 2827 1.10 0.18 1.58 121 XM_CamelCaseFrm001 2747 2.23 3.53 1.54 122 XMDiploma_00 2644 1.84 2.51 1.48 123 RCVD_IN_RP_SAFE 2611 1.35 1.14 1.46 124 RCVD_IN_IADB_OPTIN 2585 1.06 0.34 1.45 125 HTML_FONT_FACE_BAD 2488 1.22 0.89 1.39 126 XM_GoogleGroups 2485 1.12 0.61 1.39 127 URI_HEX 2479 1.40 1.41 1.39 128 HTML_MIME_NO_HTML_TAG 2470 1.27 1.07 1.38 129 KHOP_HELO_FCRDNS 2461 1.42 1.49 1.38 130 T_FILL_THIS_FORM_SHORT 2459 2.65 5.06 1.38 131 SUBJ_ALL_CAPS 2456 1.80 2.60 1.37 132 T_XMDrugObfuBody_08 2430 2.81 5.56 1.36 133 TR_XM_Base64_M1 2429 1.22 0.97 1.36 134 TM2_M_VERY_LONG_WORD 2420 1.68 2.30 1.35 135 TooManyTo_002 2385 1.02 0.42 1.33 136 XM_OfRef6 2338 1.63 2.23 1.31 137 RCVD_IN_RP_CERTIFIED 2320 1.14 0.83 1.30 138 TVD_SPACE_RATIO 2298 0.88 0.11 1.29 139 HTML_TAG_BALANCE_BODY 2276 1.34 1.46 1.27 140 XM_DK_Undo_01 2271 1.54 2.04 1.27 141 XM_B_Investor 2269 1.96 3.27 1.27 142 XM_H_Long_From02 2254 1.15 0.93 1.26 143 T_TooManySym_03 2096 0.86 0.26 1.17 144 XM_B_Phish66 2095 1.80 2.98 1.17 145 XM_B_Unsub2 2040 1.37 1.80 1.14 146 TooManyTo_003 1811 0.79 0.38 1.01 147 T_MANY_PILL_PRICE 1736 0.64 0.00 0.97 148 MPART_ALT_DIFF_COUNT 1729 1.11 1.37 0.97 149 XMSubNoVowel 1725 0.95 0.93 0.97 150 HTML_TEXT_INVISIBLE_STYLE 1704 0.76 0.40 0.95 151 XM_UB50 1700 2.34 4.98 0.95 152 XM_B_COPY_HTML 1686 0.88 0.77 0.94 153 DOS_RCVD_IP_TWICE_B 1674 1.84 3.55 0.94 154 DKIM_ADSP_CUSTOM_MED 1583 0.89 0.89 0.89 155 TM2_M_BODY_EMPTY 1577 1.05 1.37 0.88 156 TR_MetaPhish_Combo_01 1564 0.83 0.76 0.88 157 XM_B_SpammyWords4 1528 1.21 1.88 0.86 158 RCVD_IN_PSBL 1495 1.45 2.60 0.84 159 XM_shorewaves_Whitelist 1398 0.51 0.00 0.78 160 TooManyTo_004 1384 0.63 0.36 0.77 161 XMBrknScrpt_02 1335 0.92 1.26 0.75 162 XMLngstWrd_00 1328 0.71 0.64 0.74 163 XM_ProductURIs 1323 0.93 1.30 0.74 164 XMPhish30 1317 0.89 1.17 0.74 165 XMSexyCombo_01 1298 1.18 2.03 0.73 166 XMEmptyBody_01 1255 0.91 1.31 0.70 167 USER_IN_WHITELIST 1254 0.46 0.00 0.70 168 USER_IN_WELCOMELIST 1254 0.46 0.00 0.70 169 XM_D_tchamptons_WL 1241 0.46 0.03 0.69 170 HTML_IMAGE_ONLY_20 1239 0.55 0.27 0.69 171 XMSubMetaSxObfu_02 1230 0.59 0.41 0.69 172 TR_XM_FormFill 1184 1.39 2.77 0.66 173 TooManyTo_005 1177 0.55 0.34 0.66 174 HTTPS_HTTP_MISMATCH 1156 0.74 0.93 0.65 175 XMLngstWrd_01 1149 0.62 0.59 0.64 176 XMHTMLBadTable_001 1141 0.80 1.09 0.64 177 XM_H_PHPMailer 1101 0.76 1.04 0.62 178 T_XMHurry_00 1064 1.00 1.77 0.60 179 RCVD_IN_MSPIKE_BL 1056 1.66 3.67 0.59 180 HTML_TAG_BALANCE_CENTER 1053 0.50 0.34 0.59 181 XM_S_SubURI 1045 0.40 0.05 0.58 182 TR_XM_MSPIKECOMBO 1042 1.58 3.47 0.58 183 XMBody_17 1031 1.94 4.51 0.58 184 XMSubMetaI_00 996 0.83 1.35 0.56 185 RCVD_IN_MSPIKE_L3 996 0.93 1.65 0.56 186 XMGenDplmaNmb 990 0.77 1.18 0.55 187 XMHTML_After_End 988 0.72 1.04 0.55 188 NML_ADSP_CUSTOM_MED 982 0.61 0.72 0.55 189 TM2_M_A_HREF_HREF 965 0.82 1.36 0.54 190 TR_XM_Base64_L1 931 0.58 0.68 0.52 191 T_TooManySym_04 925 0.41 0.21 0.52 192 XMLngstWrd_02 921 0.52 0.53 0.52 193 FORGED_GMAIL_RCVD 919 0.60 0.76 0.51 194 XM_B_REG_HTML 918 0.58 0.70 0.51 195 THIS_AD 907 0.72 1.11 0.51 196 PLING_QUERY 867 0.63 0.89 0.49 197 SUBJ_DOLLARS 867 0.55 0.67 0.49 198 SpammyFromTLD_01 858 1.30 2.84 0.48 199 XMSlimDrugH 816 0.59 0.83 0.46 200 URI_TRY_3LD 799 0.59 0.85 0.45 ----------------------------------------------------------------------