Email: 277071 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 1.32 sec Spam: 101693 Autolearn: 0 AvgScore: 14.51 AvgScanTime: 1.40 sec Ham: 175378 Autolearn: 0 AvgScore: -2.24 AvgScanTime: 1.27 sec Time Spent Running SA: 101.47 hours Time Spent Processing Spam: 39.46 hours Time Spent Processing Ham: 62.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 97264 87.46 95.64 82.72 2 DKIM_SIGNED 90000 80.82 88.50 76.37 3 XM_DK_Pass 88517 79.61 87.04 75.31 4 XM_B_Unicode 87803 76.88 86.34 71.40 5 DKIM_VALID 87795 79.01 86.33 74.77 6 RELAYCOUNTRY_US 79517 79.07 78.19 79.58 7 DCC_CHECK 72243 50.08 71.04 37.93 8 XMListUnsubscribeExists 69149 59.05 68.00 53.86 9 DKIM_VALID_AU 68428 64.15 67.29 62.33 10 XM_B_SpammyWords 67980 51.87 66.85 43.18 11 XM_B_Unicode3 50842 46.66 50.00 44.73 12 RCVD_IN_MSPIKE_H2 49372 41.96 48.55 38.13 13 XM_DK_Undo_02 48048 22.70 47.25 8.47 14 BAYES_99 40903 19.30 40.22 7.17 15 TR_XM_DKIM_Undo 40895 18.52 40.21 5.93 16 XM_B_SpammyWords2 39704 26.62 39.04 19.42 17 BAYES_50 35791 48.41 35.20 56.08 18 LOC_TINY_FONT_1 35659 29.89 35.07 26.88 19 DKIM_VALID_EF 35150 31.81 34.56 30.21 20 FVGT_m_MULTI_ODD 34215 28.73 33.65 25.87 21 MIME_HTML_ONLY 33936 25.45 33.37 20.85 22 BAYES_999 32693 15.64 32.15 6.07 23 HTML_FONT_LOW_CONTRAST 31696 30.13 31.17 29.53 24 T_KAM_HTML_FONT_INVALID 29699 23.05 29.20 19.48 25 DCC_CHECK_NEGATIVE 29429 49.89 28.94 62.04 26 TR_DCC_Bayes_99 28734 12.06 28.26 2.67 27 RELAYCOUNTRY_META 25043 11.68 24.63 4.17 28 XM_Body_Dirty_Words 22453 15.98 22.08 12.44 29 XM_Multi_Part_URI 20086 16.82 19.75 15.12 30 T_TM2_M_HEADER_IN_MSG 19416 22.17 19.09 23.95 31 XMSubLong 18942 21.72 18.63 23.51 32 XM_B_Unsub 18269 12.36 17.96 9.11 33 TR_XM_BayesUnsub 17985 11.15 17.69 7.36 34 UNPARSEABLE_RELAY 17241 11.60 16.95 8.49 35 TR_XM_UnparsRelay 17029 10.46 16.75 6.81 36 RCVD_IN_MSPIKE_WL 16870 18.83 16.59 20.13 37 TR_XM_SpammyWords2 16734 7.17 16.46 1.78 38 TR_XM_SpammyRelay 15544 6.91 15.29 2.05 39 FSL_BULK_SIG 13445 6.95 13.22 3.32 40 RCVD_IN_MSPIKE_H3 13101 13.10 12.88 13.22 41 RELAYCOUNTRY_CA 12681 5.72 12.47 1.81 42 BOTNET_IPINHOSTNAME 12171 8.99 11.97 7.26 43 BOTNET 11955 5.41 11.76 1.73 44 RCVD_IN_BL_SPAMCOP_NET 11886 4.65 11.69 0.58 45 XM_B_SpammyWords3 11467 7.08 11.28 4.65 46 LOTS_OF_MONEY 10959 8.50 10.78 7.18 47 HTML_IMAGE_RATIO_02 9067 7.77 8.92 7.11 48 BAYES_80 9036 6.31 8.89 4.82 49 TR_XM_SpammyWords4 8992 6.24 8.84 4.73 50 XMSexyCombo_05 8960 5.90 8.81 4.21 51 XM_UncommonTLD01 8731 6.46 8.59 5.23 52 XM_H_Long_From01 8507 6.07 8.37 4.75 53 TR_XM_SPAMCOP 8252 3.27 8.11 0.47 54 UNTRUSTED_Relay 8033 3.82 7.90 1.45 55 BAYES_60 7263 9.79 7.14 11.32 56 XM_Evil_Numbers_Gen 7068 8.24 6.95 8.99 57 MPART_ALT_DIFF 6721 6.10 6.61 5.81 58 XMBody_17 6612 2.89 6.50 0.79 59 XM_B_SpammyTLD 6524 3.84 6.42 2.34 60 XM_SendGrid 6445 5.17 6.34 4.49 61 T_REMOTE_IMAGE 5698 4.02 5.60 3.10 62 LotsOfNums_01 5561 7.13 5.47 8.10 63 TR_XM_PhishingBody 5555 3.63 5.46 2.56 64 PDS_OTHER_BAD_TLD 5542 2.15 5.45 0.24 65 BAYES_95 5531 3.96 5.44 3.10 66 T_XMDrugObfuBody_08 5451 2.69 5.36 1.14 67 XMStrtUSub 5395 6.32 5.31 6.91 68 XM_CamelCaseFrm001 5284 3.08 5.20 1.86 69 RCVD_IN_MSPIKE_BL 5219 2.17 5.13 0.46 70 TooManyTo_001 5146 6.34 5.06 7.08 71 TR_XM_MSPIKECOMBO 5023 2.10 4.94 0.46 72 XMSubMetaSx_00 5008 4.17 4.92 3.73 73 XM_B_Phish_Phrases 4868 3.55 4.79 2.84 74 T_FILL_THIS_FORM_SHORT 4746 2.11 4.67 0.63 75 TM2_M_VERY_LONG_WORD 4551 2.85 4.48 1.91 76 T_XMDrugObfuBody_14 4536 2.66 4.46 1.61 77 RCVD_IN_VALIDITY_RPBL 4388 1.59 4.31 0.01 78 RCVD_IN_VALIDITY_SAFE 4376 5.37 4.30 6.00 79 TR_XM_SpammyWords5 4357 2.76 4.28 1.87 80 TR_XM_DK_SendGrid 4347 3.39 4.27 2.87 81 MIME_HTML_ONLY_MULTI 4194 3.94 4.12 3.83 82 XM_SPF_SoftFail 4189 3.16 4.12 2.61 83 HTML_IMAGE_RATIO_04 4167 5.06 4.10 5.61 84 XM_OfRef6 4153 2.14 4.08 1.01 85 XMNumbers 4149 4.45 4.08 4.66 86 MIME_HTML_MOSTLY 3923 3.40 3.86 3.13 87 HTML_IMAGE_RATIO_06 3856 3.95 3.79 4.04 88 XM_DK_Undo_01 3841 2.34 3.78 1.51 89 BOTNET_NORDNS 3801 1.38 3.74 0.01 90 XM_B_Investor 3575 2.05 3.52 1.20 91 RCVD_IN_MSPIKE_H4 3574 4.97 3.51 5.82 92 HTML_IMAGE_RATIO_08 3492 2.94 3.43 2.65 93 XM_DIRTYINTL 3477 1.44 3.42 0.29 94 USER_IN_DEF_DKIM_WL 3372 12.45 3.32 17.74 95 XM_UB50 3335 1.81 3.28 0.95 96 TR_XM_FormFill 3284 1.24 3.23 0.09 97 HTML_IMAGE_ONLY_24 3260 1.32 3.21 0.23 98 DOS_RCVD_IP_TWICE_B 3258 1.80 3.20 0.99 99 HTTP_EXCESSIVE_ESCAPES 3139 1.14 3.09 0.00 100 RCVD_IN_VALIDITY_CERTIFIED 3106 4.38 3.05 5.15 101 HTML_MIME_NO_HTML_TAG 3077 2.45 3.03 2.12 102 SHOPIFY_IMG_NOT_RCVD_SFY 2876 1.19 2.83 0.25 103 SpammyFromTLD_01 2863 1.44 2.82 0.64 104 XM_H_Undi_Recip 2846 1.15 2.80 0.19 105 RCVD_IN_MSPIKE_L3 2811 1.28 2.76 0.43 106 T_TooManySym_01 2724 6.72 2.68 9.06 107 XM_GoogleGroups 2702 2.23 2.66 1.98 108 SpammyFromTLD_02 2702 1.11 2.66 0.22 109 TM2_M_URI_OPT_OUT 2659 2.49 2.61 2.41 110 XM_B_SpammyWords4 2657 1.63 2.61 1.06 111 XMLngstWrd_00 2656 1.95 2.61 1.56 112 XM_B_Phish66 2611 1.59 2.57 1.02 113 XMLngstWrd_01 2598 1.84 2.55 1.43 114 XMLngstWrd_02 2526 1.70 2.48 1.24 115 FONT_INVIS_LONG_LINE 2469 0.96 2.43 0.11 116 TR_XM_MSPIKECOMBO2 2447 0.94 2.41 0.09 117 XMDiploma_00 2372 1.57 2.33 1.13 118 TR_XM_SpammyWords3 2366 0.98 2.33 0.20 119 XM_UB99 2343 0.85 2.30 0.00 120 SUBJ_ALL_CAPS 2311 1.66 2.27 1.31 121 DKIM_INVALID 2205 1.81 2.17 1.60 122 XMLngstWrd_03 2187 1.47 2.15 1.08 123 XMLngstWrd_04 2163 1.41 2.13 0.99 124 HTML_TITLE_SUBJ_DIFF 2115 1.22 2.08 0.72 125 UPPERCASE_75_100 2067 1.22 2.03 0.74 126 RCVD_IN_PSBL 2059 1.10 2.02 0.57 127 HK_RANDOM_REPLYTO 2058 0.80 2.02 0.10 128 FROM_EXCESS_BASE64 1982 2.87 1.95 3.40 129 TR_LOTS_OF_MONEY3 1974 0.96 1.94 0.39 130 MPART_ALT_DIFF_COUNT 1956 1.26 1.92 0.88 131 XM_UB999 1952 0.70 1.92 0.00 132 URI_NOVOWEL 1949 2.00 1.92 2.06 133 XM_B_Unsub2 1938 1.40 1.91 1.11 134 HTTPS_HTTP_MISMATCH 1910 1.18 1.88 0.77 135 TR_XM_BayesRelay 1896 0.69 1.86 0.00 136 MIME_QP_LONG_LINE 1891 2.93 1.86 3.56 137 MIME_BASE64_TEXT 1876 0.74 1.84 0.10 138 RCVD_IN_MSPIKE_L5 1842 0.68 1.81 0.02 139 XMReplyNow 1820 0.76 1.79 0.17 140 XMBdyGiftCard01 1817 1.46 1.79 1.27 141 RELAYCOUNTRY_CN 1776 0.69 1.75 0.07 142 TR_Symld_Words 1764 1.86 1.73 1.93 143 TM2_M_A_HREF_HREF 1681 1.06 1.65 0.71 144 XMSexyCombo_01 1659 0.84 1.63 0.38 145 TR_XM_MaxSPIKE 1596 0.63 1.57 0.08 146 TR_XM_PHPDW 1564 0.79 1.54 0.35 147 SUBJ_YOUR_FAMILY 1560 0.57 1.53 0.02 148 TR_XM_InvalidRelay 1559 0.58 1.53 0.02 149 XMStockSpam_06 1550 1.73 1.52 1.85 150 T_XMHurry_00 1524 0.86 1.50 0.49 151 ALL_TRUSTED 1516 11.19 1.49 16.81 152 TR_XM_PHPForged 1512 0.71 1.49 0.26 153 TR_XM_FormFill2 1466 0.69 1.44 0.26 154 XM_H_PHPOS 1458 0.68 1.43 0.24 155 TVD_RCVD_SPACE_BRACKET 1438 0.52 1.41 0.00 156 XMBody_29 1435 0.72 1.41 0.32 157 RELAYCOUNTRY_RU 1433 0.53 1.41 0.02 158 T_XMDrugObfuBody_10 1427 0.57 1.40 0.08 159 HTML_TAG_BALANCE_BODY 1406 1.03 1.38 0.83 160 URIBL_DBL_SPAM 1384 0.50 1.36 0.01 161 MAILING_LIST_MULTI 1373 1.95 1.35 2.30 162 T_XMDrugObfuBody_00 1368 1.64 1.35 1.81 163 KHOP_HELO_FCRDNS 1368 1.52 1.35 1.61 164 TR_XM_NoHeaderRelay 1326 0.53 1.30 0.09 165 DIET_1 1301 0.74 1.28 0.43 166 TR_XM_SB_Phish 1285 1.49 1.26 1.62 167 RCVD_IN_IADB_LISTED 1239 2.81 1.22 3.74 168 BAYES_40 1233 2.91 1.21 3.89 169 XMPhish08 1233 0.58 1.21 0.21 170 URI_HEX 1224 1.11 1.20 1.06 171 MIME_CHARSET_FARAWAY 1202 0.60 1.18 0.26 172 XMHTML_After_End 1181 0.82 1.16 0.62 173 XMSubPhish11 1164 1.43 1.14 1.60 174 XM_URI_RBL 1140 0.46 1.12 0.08 175 NO_DNS_FOR_FROM 1104 0.63 1.09 0.37 176 RCVD_IN_IADB_SPF 1088 2.49 1.07 3.31 177 XMSubNoVowel 1083 1.06 1.06 1.06 178 XM_Combo_Sbj 1073 0.54 1.06 0.24 179 XM_Body_Dirty_Words_01 1059 0.60 1.04 0.34 180 RELAYCOUNTRY_AU 1054 0.53 1.04 0.24 181 XMPhish30 1050 0.92 1.03 0.86 182 RCVD_IN_IADB_DK 1044 2.18 1.03 2.85 183 TR_XM_MaxWHORU 1038 0.55 1.02 0.27 184 HTML_FONT_TINY_NORDNS 1038 0.41 1.02 0.05 185 PLING_QUERY 1029 0.62 1.01 0.39 186 NORDNS_LOW_CONTRAST 1022 0.38 1.00 0.02 187 RCVD_IN_IADB_SENDERID 1019 2.23 1.00 2.95 188 BAYES_20 1014 2.22 1.00 2.94 189 THIS_AD 977 0.56 0.96 0.33 190 SUBJ_DOLLARS 973 0.42 0.96 0.11 191 MultiRelay_CC 972 0.36 0.96 0.01 192 DKIM_ADSP_NXDOMAIN 967 0.61 0.95 0.41 193 RCVD_IN_RP_RNBL 963 0.35 0.95 0.00 194 XMGenDplmaNmb 957 0.63 0.94 0.45 195 XM_H_Long_From02 924 0.98 0.91 1.02 196 UNDISC_MONEY 917 0.33 0.90 0.00 197 HTML_FONT_FACE_BAD 909 1.03 0.89 1.10 198 TR_XM_Undi_Recip5 904 0.33 0.89 0.00 199 RELAYCOUNTRY_IN 904 0.34 0.89 0.03 200 TR_Caps_n_Bayes_99 897 0.51 0.88 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145064 87.46 95.64 82.72 2 RELAYCOUNTRY_US 139574 79.07 78.19 79.58 3 DKIM_SIGNED 133938 80.82 88.50 76.37 4 XM_DK_Pass 132073 79.61 87.04 75.31 5 DKIM_VALID 131127 79.01 86.33 74.77 6 XM_B_Unicode 125218 76.88 86.34 71.40 7 DKIM_VALID_AU 109310 64.15 67.29 62.33 8 DCC_CHECK_NEGATIVE 108802 49.89 28.94 62.04 9 BAYES_50 98350 48.41 35.20 56.08 10 XMListUnsubscribeExists 94456 59.05 68.00 53.86 11 XM_B_Unicode3 78447 46.66 50.00 44.73 12 XM_B_SpammyWords 75732 51.87 66.85 43.18 13 RCVD_IN_MSPIKE_H2 66879 41.96 48.55 38.13 14 DCC_CHECK 66513 50.08 71.04 37.93 15 DKIM_VALID_EF 52984 31.81 34.56 30.21 16 HTML_FONT_LOW_CONTRAST 51781 30.13 31.17 29.53 17 LOC_TINY_FONT_1 47145 29.89 35.07 26.88 18 FVGT_m_MULTI_ODD 45377 28.73 33.65 25.87 19 T_TM2_M_HEADER_IN_MSG 42002 22.17 19.09 23.95 20 XMSubLong 41235 21.72 18.63 23.51 21 MIME_HTML_ONLY 36567 25.45 33.37 20.85 22 RCVD_IN_MSPIKE_WL 35301 18.83 16.59 20.13 23 T_KAM_HTML_FONT_INVALID 34156 23.05 29.20 19.48 24 XM_B_SpammyWords2 34057 26.62 39.04 19.42 25 USER_IN_DEF_DKIM_WL 31119 12.45 3.32 17.74 26 ALL_TRUSTED 29477 11.19 1.49 16.81 27 XM_Multi_Part_URI 26521 16.82 19.75 15.12 28 XM_DKIMWhitelistDomains 23337 8.74 0.87 13.31 29 RCVD_IN_MSPIKE_H3 23183 13.10 12.88 13.22 30 XM_Body_Dirty_Words 21817 15.98 22.08 12.44 31 BAYES_60 19853 9.79 7.14 11.32 32 XM_B_Unsub 15981 12.36 17.96 9.11 33 T_TooManySym_01 15892 6.72 2.68 9.06 34 XM_Evil_Numbers_Gen 15762 8.24 6.95 8.99 35 BAYES_00 15266 5.64 0.35 8.70 36 UNPARSEABLE_RELAY 14898 11.60 16.95 8.49 37 XM_DK_Undo_02 14851 22.70 47.25 8.47 38 LotsOfNums_01 14208 7.13 5.47 8.10 39 TR_XM_BayesUnsub 12903 11.15 17.69 7.36 40 BOTNET_IPINHOSTNAME 12730 8.99 11.97 7.26 41 LOTS_OF_MONEY 12587 8.50 10.78 7.18 42 BAYES_99 12573 19.30 40.22 7.17 43 HTML_IMAGE_RATIO_02 12473 7.77 8.92 7.11 44 TooManyTo_001 12416 6.34 5.06 7.08 45 XMStrtUSub 12112 6.32 5.31 6.91 46 TR_XM_UnparsRelay 11943 10.46 16.75 6.81 47 BAYES_999 10649 15.64 32.15 6.07 48 RCVD_IN_VALIDITY_SAFE 10516 5.37 4.30 6.00 49 TR_XM_DK_Bayes 10460 3.86 0.24 5.96 50 TR_XM_DKIM_Undo 10405 18.52 40.21 5.93 51 TR_XM_DK_Bayes1 10398 3.84 0.23 5.93 52 RCVD_IN_MSPIKE_H4 10199 4.97 3.51 5.82 53 MPART_ALT_DIFF 10185 6.10 6.61 5.81 54 IN_ZIMBRA_NJ_WHITELIST 9929 3.61 0.07 5.66 55 HTML_IMAGE_RATIO_04 9844 5.06 4.10 5.61 56 T_TooManySym_02 9569 3.67 0.59 5.46 57 TR_XM_DK_Bayes2 9374 3.46 0.21 5.35 58 XM_UncommonTLD01 9175 6.46 8.59 5.23 59 RCVD_IN_VALIDITY_CERTIFIED 9030 4.38 3.05 5.15 60 BAYES_80 8447 6.31 8.89 4.82 61 XM_H_Long_From01 8324 6.07 8.37 4.75 62 TR_XM_SpammyWords4 8291 6.24 8.84 4.73 63 XMNumbers 8178 4.45 4.08 4.66 64 XM_B_SpammyWords3 8151 7.08 11.28 4.65 65 XM_SendGrid 7880 5.17 6.34 4.49 66 XMSexyCombo_05 7386 5.90 8.81 4.21 67 RELAYCOUNTRY_META 7311 11.68 24.63 4.17 68 TVD_RCVD_IP 7164 2.74 0.43 4.08 69 INVALID_MSGID 7127 2.65 0.21 4.06 70 HTML_IMAGE_RATIO_06 7092 3.95 3.79 4.04 71 BAYES_40 6821 2.91 1.21 3.89 72 MSGID_NOFQDN1 6734 2.47 0.10 3.84 73 MIME_HTML_ONLY_MULTI 6715 3.94 4.12 3.83 74 RCVD_IN_IADB_LISTED 6554 2.81 1.22 3.74 75 XMSubMetaSx_00 6547 4.17 4.92 3.73 76 MIME_QP_LONG_LINE 6238 2.93 1.86 3.56 77 FROM_EXCESS_BASE64 5966 2.87 1.95 3.40 78 TO_MALFORMED 5927 2.17 0.08 3.38 79 FSL_BULK_SIG 5814 6.95 13.22 3.32 80 RCVD_IN_IADB_SPF 5812 2.49 1.07 3.31 81 MIME_HTML_MOSTLY 5493 3.40 3.86 3.13 82 BAYES_95 5440 3.96 5.44 3.10 83 T_REMOTE_IMAGE 5428 4.02 5.60 3.10 84 RCVD_IN_IADB_SENDERID 5165 2.23 1.00 2.95 85 BAYES_20 5148 2.22 1.00 2.94 86 TR_XM_DK_SendGrid 5041 3.39 4.27 2.87 87 RCVD_IN_IADB_DK 5002 2.18 1.03 2.85 88 XM_B_Phish_Phrases 4973 3.55 4.79 2.84 89 TR_DCC_Bayes_99 4683 12.06 28.26 2.67 90 XM_H_Trusted_IP 4663 1.68 0.00 2.66 91 HTML_IMAGE_RATIO_08 4642 2.94 3.43 2.65 92 XM_SPF_SoftFail 4579 3.16 4.12 2.61 93 TR_XM_PhishingBody 4492 3.63 5.46 2.56 94 RCVD_IN_IADB_VOUCHED 4327 1.82 0.71 2.47 95 TM2_M_URI_OPT_OUT 4227 2.49 2.61 2.41 96 XM_B_SpammyTLD 4104 3.84 6.42 2.34 97 XMBSHREFv2 4055 1.54 0.20 2.31 98 MAILING_LIST_MULTI 4033 1.95 1.35 2.30 99 HTML_MIME_NO_HTML_TAG 3723 2.45 3.03 2.12 100 XM_PDF 3707 1.46 0.33 2.11 101 URI_NOVOWEL 3605 2.00 1.92 2.06 102 TR_XM_SpammyRelay 3597 6.91 15.29 2.05 103 IN_HORDE_ADDRESS_BOOK 3520 1.30 0.09 2.01 104 BAYES_05 3479 1.46 0.56 1.98 105 XM_GoogleGroups 3477 2.23 2.66 1.98 106 ANY_BOUNCE_MESSAGE 3470 1.44 0.51 1.98 107 BOUNCE_MESSAGE 3469 1.44 0.51 1.98 108 TR_Symld_Words 3385 1.86 1.73 1.93 109 TM2_M_VERY_LONG_WORD 3345 2.85 4.48 1.91 110 TR_XM_SpammyWords5 3288 2.76 4.28 1.87 111 XM_CamelCaseFrm001 3259 3.08 5.20 1.86 112 XMStockSpam_06 3247 1.73 1.52 1.85 113 RELAYCOUNTRY_CA 3178 5.72 12.47 1.81 114 T_XMDrugObfuBody_00 3168 1.64 1.35 1.81 115 TR_XM_SpammyWords2 3130 7.17 16.46 1.78 116 XMBody_95 3111 1.16 0.09 1.77 117 BOTNET 3029 5.41 11.76 1.73 118 XMGappySubj_01 2998 1.16 0.20 1.71 119 RCVD_IN_IADB_OPTIN 2995 1.23 0.41 1.71 120 TR_XM_SB_Phish 2840 1.49 1.26 1.62 121 KHOP_HELO_FCRDNS 2831 1.52 1.35 1.61 122 T_XMDrugObfuBody_14 2827 2.66 4.46 1.61 123 XMSubPhish11 2811 1.43 1.14 1.60 124 DKIM_INVALID 2811 1.81 2.17 1.60 125 XMLngstWrd_00 2735 1.95 2.61 1.56 126 TooManyTo_002 2683 1.15 0.49 1.53 127 XM_DK_Undo_01 2642 2.34 3.78 1.51 128 UNTRUSTED_Relay 2539 3.82 7.90 1.45 129 XMLngstWrd_01 2510 1.84 2.55 1.43 130 TVD_SPACE_RATIO 2310 0.88 0.12 1.32 131 SUBJ_ALL_CAPS 2296 1.66 2.27 1.31 132 XMBdyGiftCard01 2219 1.46 1.79 1.27 133 XMLngstWrd_02 2177 1.70 2.48 1.24 134 XM_RXBody 2167 0.94 0.43 1.24 135 T_TooManySym_03 2156 0.87 0.26 1.23 136 TR_XM_Base64_M1 2115 1.08 0.87 1.21 137 XM_B_Investor 2110 2.05 3.52 1.20 138 RCVD_IN_RP_SAFE 2089 1.07 0.87 1.19 139 T_XMDrugObfuBody_08 1993 2.69 5.36 1.14 140 XMDiploma_00 1982 1.57 2.33 1.13 141 XM_shorewaves_Whitelist 1966 0.71 0.00 1.12 142 XM_B_Unsub2 1939 1.40 1.91 1.11 143 HTML_FONT_FACE_BAD 1936 1.03 0.89 1.10 144 RCVD_IN_MSPIKE_H5 1919 0.76 0.19 1.09 145 XMLngstWrd_03 1892 1.47 2.15 1.08 146 XM_B_SpammyWords4 1864 1.63 2.61 1.06 147 XMSubNoVowel 1851 1.06 1.06 1.06 148 URI_HEX 1851 1.11 1.20 1.06 149 RCVD_IN_RP_CERTIFIED 1816 0.88 0.61 1.04 150 DKIM_ADSP_CUSTOM_MED 1791 0.90 0.68 1.02 151 XM_H_Long_From02 1789 0.98 0.91 1.02 152 TooManyTo_003 1783 0.77 0.34 1.02 153 XM_B_Phish66 1783 1.59 2.57 1.02 154 XM_OfRef6 1779 2.14 4.08 1.01 155 T_MANY_PILL_PRICE 1744 0.64 0.02 0.99 156 XMLngstWrd_04 1734 1.41 2.13 0.99 157 DOS_RCVD_IP_TWICE_B 1730 1.80 3.20 0.99 158 XM_UB50 1672 1.81 3.28 0.95 159 XM_H_PHPMailer 1607 0.84 0.72 0.92 160 MPART_ALT_DIFF_COUNT 1538 1.26 1.92 0.88 161 XM_B_COPY_HTML 1517 0.85 0.82 0.86 162 XMPhish30 1504 0.92 1.03 0.86 163 HTML_TAG_BALANCE_BODY 1451 1.03 1.38 0.83 164 XMBody_17 1392 2.89 6.50 0.79 165 TR_MetaPhish_Combo_01 1371 0.77 0.76 0.78 166 HTTPS_HTTP_MISMATCH 1354 1.18 1.88 0.77 167 TooManyTo_004 1307 0.59 0.31 0.75 168 UPPERCASE_75_100 1302 1.22 2.03 0.74 169 USER_IN_WELCOMELIST 1291 0.47 0.00 0.74 170 USER_IN_WHITELIST 1291 0.47 0.00 0.74 171 HTML_IMAGE_ONLY_20 1265 0.57 0.31 0.72 172 HTML_TITLE_SUBJ_DIFF 1264 1.22 2.08 0.72 173 TM2_M_A_HREF_HREF 1243 1.06 1.65 0.71 174 XMSubMetaSxObfu_02 1238 0.63 0.49 0.71 175 XMSubMetaI_00 1225 0.71 0.73 0.70 176 NML_ADSP_CUSTOM_MED 1144 0.62 0.58 0.65 177 SpammyFromTLD_01 1118 1.44 2.82 0.64 178 TooManyTo_005 1114 0.50 0.28 0.64 179 T_FILL_THIS_FORM_SHORT 1104 2.11 4.67 0.63 180 XMHTML_After_End 1095 0.82 1.16 0.62 181 XM_D_tchamptons_WL 1080 0.40 0.02 0.62 182 FORGED_GMAIL_RCVD 1053 0.56 0.50 0.60 183 BODY_ENHANCEMENT2 1052 0.38 0.01 0.60 184 DATE_IN_PAST_03_06 1046 0.53 0.41 0.60 185 XM_S_SubURI 1032 0.38 0.02 0.59 186 RCVD_IN_BL_SPAMCOP_NET 1011 4.65 11.69 0.58 187 XMBrknScrpt_02 1005 0.61 0.68 0.57 188 RCVD_IN_PSBL 1001 1.10 2.02 0.57 189 HTML_TEXT_INVISIBLE_STYLE 990 0.52 0.44 0.56 190 XM_ProductURIs 965 0.52 0.47 0.55 191 T_TooManySym_04 919 0.39 0.17 0.52 192 TR_XM_Base64_L1 901 0.54 0.60 0.51 193 T_XMHurry_00 863 0.86 1.50 0.49 194 AC_BR_BONANZA 836 0.47 0.45 0.48 195 TR_XM_SPAMCOP 821 3.27 8.11 0.47 196 XMCapTrack 816 0.37 0.19 0.47 197 URI_TRY_3LD 816 0.54 0.66 0.47 198 XMNoVowels 813 0.48 0.50 0.46 199 RCVD_IN_MSPIKE_BL 803 2.17 5.13 0.46 200 TR_XM_MSPIKECOMBO 802 2.10 4.94 0.46 ----------------------------------------------------------------------