Email: 281067 Autolearn: 0 AvgScore: 3.47 AvgScanTime: 1.31 sec Spam: 88140 Autolearn: 0 AvgScore: 14.06 AvgScanTime: 1.42 sec Ham: 192927 Autolearn: 0 AvgScore: -1.36 AvgScanTime: 1.26 sec Time Spent Running SA: 102.61 hours Time Spent Processing Spam: 34.89 hours Time Spent Processing Ham: 67.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82544 86.60 93.65 83.38 2 DKIM_SIGNED 72258 73.18 81.98 69.16 3 XM_DK_Pass 70033 71.60 79.46 68.01 4 DKIM_VALID 68530 69.84 77.75 66.22 5 RELAYCOUNTRY_US 65110 73.54 73.87 73.39 6 XM_B_Unicode 63810 66.72 72.40 64.13 7 XM_B_SpammyWords 61817 55.15 70.14 48.30 8 XMListUnsubscribeExists 60936 54.96 69.14 48.49 9 DCC_CHECK 59088 46.93 67.04 37.74 10 DKIM_VALID_AU 54223 56.77 61.52 54.60 11 XM_DK_Undo_02 39558 20.13 44.88 8.83 12 XM_B_Unicode3 33910 40.08 38.47 40.81 13 BAYES_50 32980 45.92 37.42 49.80 14 TR_XM_DKIM_Undo 32708 16.29 37.11 6.78 15 XM_B_SpammyWords2 31998 24.06 36.30 18.46 16 BAYES_99 30875 15.98 35.03 7.27 17 LOC_TINY_FONT_1 29243 29.42 33.18 27.70 18 DCC_CHECK_NEGATIVE 29010 53.04 32.91 62.23 19 HTML_FONT_LOW_CONTRAST 28718 30.90 32.58 30.13 20 MIME_HTML_ONLY 27152 24.42 30.81 21.51 21 XM_Body_Dirty_Words 26880 23.01 30.50 19.59 22 FVGT_m_MULTI_ODD 25158 24.81 28.54 23.10 23 DKIM_VALID_EF 24889 26.85 28.24 26.21 24 BAYES_999 24584 12.96 27.89 6.13 25 TR_DCC_Bayes_99 22768 10.21 25.83 3.07 26 T_KAM_HTML_FONT_INVALID 21617 18.95 24.53 16.40 27 RCVD_IN_MSPIKE_H2 21378 19.48 24.25 17.30 28 RELAYCOUNTRY_META 20360 9.30 23.10 3.00 29 XMSubLong 18649 21.65 21.16 21.87 30 T_TM2_M_HEADER_IN_MSG 18629 20.51 21.14 20.23 31 RCVD_IN_MSPIKE_WL 17145 26.74 19.45 30.07 32 XM_B_Unsub 16209 17.83 18.39 17.57 33 XM_Multi_Part_URI 14690 14.09 16.67 12.91 34 TR_XM_SpammyRelay 13135 5.57 14.90 1.31 35 XM_UncommonTLD01 12461 7.46 14.14 4.41 36 MPART_ALT_DIFF 12362 8.12 14.03 5.43 37 UNTRUSTED_Relay 12110 5.09 13.74 1.14 38 UNPARSEABLE_RELAY 11484 9.91 13.03 8.49 39 TR_XM_UnparsRelay 11332 8.75 12.86 6.87 40 TR_XM_SpammyWords2 11197 5.36 12.70 2.01 41 RCVD_IN_MSPIKE_H3 11052 14.42 12.54 15.28 42 XMSexyCombo_05 10884 6.98 12.35 4.52 43 BOTNET 10456 4.79 11.86 1.55 44 TooManyTo_001 10197 13.19 11.57 13.93 45 XM_B_SpammyWords3 9907 6.22 11.24 3.93 46 LOTS_OF_MONEY 9770 8.73 11.08 7.65 47 XMSubMetaSx_00 9747 9.78 11.06 9.19 48 BOTNET_IPINHOSTNAME 9471 7.13 10.75 5.48 49 FSL_BULK_SIG 8696 6.14 9.87 4.44 50 TR_XM_SpammyWords4 8477 6.49 9.62 5.06 51 MIME_HTML_MOSTLY 7406 4.05 8.40 2.07 52 HTML_IMAGE_RATIO_02 7337 7.62 8.32 7.29 53 TM2_M_URI_OPT_OUT 7299 10.51 8.28 11.54 54 XM_Evil_Numbers_Gen 7288 8.44 8.27 8.52 55 RCVD_IN_BL_SPAMCOP_NET 7050 3.21 8.00 1.02 56 BAYES_60 7041 9.97 7.99 10.88 57 XM_SendGrid 6822 6.69 7.74 6.22 58 XMSexyCombo_01 6470 6.28 7.34 5.79 59 SpammyFromTLD_01 6452 2.59 7.32 0.43 60 HTML_MIME_NO_HTML_TAG 6383 3.61 7.24 1.95 61 URI_NOVOWEL 6277 3.80 7.12 2.28 62 MIME_QP_LONG_LINE 6200 9.69 7.03 10.91 63 MIME_HTML_ONLY_MULTI 6185 4.86 7.02 3.88 64 BAYES_80 6141 5.34 6.97 4.60 65 TM2_M_VERY_LONG_WORD 5906 3.39 6.70 1.87 66 ALL_TRUSTED 5812 18.82 6.59 24.40 67 RCVD_IN_MSPIKE_H4 5753 10.57 6.53 12.41 68 XM_UB50 5520 2.48 6.26 0.75 69 TR_XM_MaxUnsub 5379 2.76 6.10 1.24 70 XM_B_Phish_Phrases 5013 4.41 5.69 3.82 71 RCVD_IN_MSPIKE_BL 4926 2.32 5.59 0.83 72 TR_XM_MSPIKECOMBO 4913 2.32 5.57 0.83 73 RELAYCOUNTRY_CA 4845 2.32 5.50 0.87 74 RCVD_IN_VALIDITY_SAFE 4738 6.47 5.38 6.97 75 LotsOfNums_01 4575 7.51 5.19 8.56 76 XMLngstWrd_00 4431 2.24 5.03 0.96 77 XMLngstWrd_01 4404 2.20 5.00 0.92 78 TR_XM_PhishingBody 4401 3.18 4.99 2.36 79 XMLngstWrd_02 4361 2.12 4.95 0.83 80 XMLngstWrd_03 4334 2.04 4.92 0.73 81 XM_DIRTYINTL 4325 1.68 4.91 0.20 82 URIBL_DBL_SPAM 4318 1.54 4.90 0.01 83 XMLngstWrd_04 4302 1.99 4.88 0.67 84 SpammyFromTLD_02 4276 1.66 4.85 0.21 85 XM_GoogleGroups 4216 2.66 4.78 1.69 86 XMStrtUSub 4124 5.14 4.68 5.36 87 JH_SPAMMY_HEADERS 4032 1.43 4.57 0.00 88 TR_XM_DK_SendGrid 4030 4.22 4.57 4.06 89 XM_H_Long_From01 3956 4.70 4.49 4.79 90 DKIM_INVALID 3728 3.35 4.23 2.94 91 RCVD_IN_VALIDITY_CERTIFIED 3727 5.67 4.23 6.32 92 XMSpecificSbj 3697 1.32 4.19 0.00 93 UPPERCASE_75_100 3692 1.65 4.19 0.49 94 HTML_TITLE_SUBJ_DIFF 3681 1.64 4.18 0.48 95 XM_SPF_SoftFail 3679 2.03 4.17 1.05 96 XM_B_SpammyTLD 3504 2.54 3.98 1.89 97 HTML_IMAGE_RATIO_04 3497 5.69 3.97 6.47 98 T_XMDrugObfuBody_08 3496 2.07 3.97 1.21 99 SHORT_URI_2 3486 4.84 3.96 5.25 100 BAYES_95 3401 3.09 3.86 2.74 101 XM_B_Investor 3398 2.15 3.86 1.37 102 TR_XM_SpammyWords3 3347 1.53 3.80 0.49 103 TR_XM_SPAMCOP 3346 1.43 3.80 0.34 104 TR_XM_NoHeaderRelay 3257 1.25 3.70 0.13 105 RELAYCOUNTRY_FR 3256 1.27 3.69 0.16 106 TR_XM_SpammyWords5 3222 1.93 3.66 1.14 107 USER_IN_DEF_DKIM_WL 3222 12.12 3.66 15.99 108 KHOP_HELO_FCRDNS 3204 1.75 3.64 0.89 109 XM_Body_Dirty_Words_01 3056 1.45 3.47 0.53 110 T_XMDrugObfuBody_14 3052 2.65 3.46 2.27 111 XMNumbers 3029 4.40 3.44 4.84 112 RCVD_IN_MSPIKE_L3 3002 1.40 3.41 0.48 113 XMSexyCombo_02 2770 1.32 3.14 0.49 114 T_FILL_THIS_FORM_SHORT 2718 1.25 3.08 0.41 115 PDS_OTHER_BAD_TLD 2665 1.18 3.02 0.34 116 BAYES_20 2655 4.22 3.01 4.77 117 XM_UB60 2632 0.97 2.99 0.06 118 HTML_IMAGE_RATIO_06 2572 3.55 2.92 3.83 119 BAYES_00 2466 9.85 2.80 13.07 120 RCVD_IN_VALIDITY_RPBL 2296 0.84 2.60 0.03 121 TR_XM_PHPDW 2275 1.02 2.58 0.31 122 NO_DNS_FOR_FROM 2256 1.14 2.56 0.50 123 SUBJ_ALL_CAPS 2249 1.54 2.55 1.08 124 TR_XM_MaxWHORU 2241 1.05 2.54 0.37 125 XM_OfRef6 2192 1.20 2.49 0.61 126 XMBody_17 2166 1.20 2.46 0.63 127 XM_B_Phish66 2134 1.55 2.42 1.15 128 TR_XM_PHPForged 2131 0.93 2.42 0.25 129 TR_XM_FormFill2 2106 0.92 2.39 0.25 130 XM_H_PHPOS 2096 0.91 2.38 0.24 131 TR_XM_FormFill 1917 0.69 2.17 0.01 132 FROM_SUSPICIOUS_NTLD 1874 0.71 2.13 0.07 133 BAYES_40 1849 3.88 2.10 4.70 134 XM_DK_Undo_01 1844 1.69 2.09 1.50 135 URI_NO_WWW_BIZ_CGI 1840 0.66 2.09 0.01 136 FROM_SUSPICIOUS_NTLD_FP 1839 0.70 2.09 0.06 137 T_TooManySym_01 1774 6.39 2.01 8.39 138 TR_Mismatch_TLD_01 1733 0.82 1.97 0.30 139 TR_Symld_Words 1718 1.66 1.95 1.53 140 XMBdyGiftCard01 1714 1.54 1.94 1.36 141 TR_LOTS_OF_MONEY3 1700 0.78 1.93 0.26 142 T_XMDrugObfuBody_00 1690 1.02 1.92 0.61 143 XM_URI_RBL 1684 0.71 1.91 0.16 144 XM_CamelCaseFrm001 1662 1.69 1.89 1.60 145 XMDiploma_00 1607 1.32 1.82 1.09 146 RCVD_IN_PSBL 1541 0.66 1.75 0.16 147 FROM_EXCESS_BASE64 1503 2.92 1.71 3.47 148 SHORT_URI_3 1489 2.39 1.69 2.70 149 T_REMOTE_IMAGE 1480 2.45 1.68 2.80 150 XM_B_COVIDMETA 1471 0.82 1.67 0.44 151 XM_XX_Yahoo 1463 0.63 1.66 0.16 152 PLING_QUERY 1456 0.85 1.65 0.49 153 TR_XM_BayesRelay 1429 0.51 1.62 0.00 154 XM_UB99 1425 0.51 1.62 0.00 155 URI_HEX 1410 1.47 1.60 1.41 156 HTML_TAG_BALANCE_BODY 1353 0.82 1.54 0.50 157 TR_Mismatch_TLD_02 1348 0.52 1.53 0.05 158 TR_XM_INV_DKIM 1332 0.68 1.51 0.31 159 HTML_IMAGE_RATIO_08 1329 2.06 1.51 2.31 160 BOTNET_NORDNS 1324 0.48 1.50 0.01 161 RELAYCOUNTRY_IN 1318 0.51 1.50 0.06 162 RELAYCOUNTRY_PL 1292 0.48 1.47 0.03 163 RCVD_IN_IADB_LISTED 1290 3.02 1.46 3.73 164 RELAYCOUNTRY_AU 1288 0.61 1.46 0.21 165 XM_B_Unsub2 1227 0.99 1.39 0.80 166 XMBrknScrpt_02 1221 1.10 1.39 0.97 167 T_XMHurry_00 1214 0.73 1.38 0.44 168 XM_H_PHPMailer 1207 0.77 1.37 0.50 169 DKIM_ADSP_CUSTOM_MED 1190 1.06 1.35 0.93 170 RCVD_IN_MSPIKE_L5 1187 0.45 1.35 0.04 171 XMPhish30 1181 0.86 1.34 0.64 172 LongTLD 1162 0.46 1.32 0.07 173 NML_ADSP_CUSTOM_MED 1136 0.81 1.29 0.59 174 XM_H_Long_From02 1109 1.14 1.26 1.09 175 FORGED_GMAIL_RCVD 1093 0.75 1.24 0.52 176 RELAYCOUNTRY_GB 1091 0.75 1.24 0.52 177 ADMITS_SPAM 1086 0.54 1.23 0.22 178 RELAYCOUNTRY_NL 1085 0.48 1.23 0.13 179 XMStockSpam_06 1082 1.55 1.23 1.69 180 XM_UB80 1077 0.39 1.22 0.01 181 XM_B_SpammyWords4 1076 0.65 1.22 0.38 182 T_MONEY_PERCENT 1053 0.67 1.19 0.43 183 TR_LOTS_OF_MONEY2 1053 0.67 1.19 0.43 184 MAILING_LIST_MULTI 1036 1.71 1.18 1.95 185 XM_Lotto 1030 0.42 1.17 0.07 186 RCVD_IN_RP_SAFE 1029 1.25 1.17 1.29 187 RCVD_IN_IADB_SPF 1014 2.64 1.15 3.32 188 HTTPS_HTTP_MISMATCH 1007 0.70 1.14 0.50 189 DIET_1 1002 0.66 1.14 0.44 190 HTML_FONT_FACE_BAD 1002 1.25 1.14 1.30 191 MONEY_NOHTML 1001 0.40 1.14 0.06 192 TR_Caps_n_Bayes_99 998 0.44 1.13 0.13 193 RELAYCOUNTRY_RO 944 0.34 1.07 0.00 194 RELAYCOUNTRY_LV 944 0.34 1.07 0.01 195 URI_LONG_REPEAT 933 0.33 1.06 0.00 196 XM_B_DNDMA 933 0.63 1.06 0.43 197 RCVD_IN_IADB_DK 924 2.33 1.05 2.91 198 TR_XM_SB_Phish 918 1.36 1.04 1.51 199 XM_B_REG_HTML 917 0.64 1.04 0.46 200 RCVD_IN_IADB_SENDERID 911 2.38 1.03 2.99 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160866 86.60 93.65 83.38 2 RELAYCOUNTRY_US 141585 73.54 73.87 73.39 3 DKIM_SIGNED 133437 73.18 81.98 69.16 4 XM_DK_Pass 131218 71.60 79.46 68.01 5 DKIM_VALID 127756 69.84 77.75 66.22 6 XM_B_Unicode 123722 66.72 72.40 64.13 7 DCC_CHECK_NEGATIVE 120060 53.04 32.91 62.23 8 DKIM_VALID_AU 105337 56.77 61.52 54.60 9 BAYES_50 96073 45.92 37.42 49.80 10 XMListUnsubscribeExists 93548 54.96 69.14 48.49 11 XM_B_SpammyWords 93185 55.15 70.14 48.30 12 XM_B_Unicode3 78738 40.08 38.47 40.81 13 DCC_CHECK 72811 46.93 67.04 37.74 14 HTML_FONT_LOW_CONTRAST 58137 30.90 32.58 30.13 15 RCVD_IN_MSPIKE_WL 58008 26.74 19.45 30.07 16 LOC_TINY_FONT_1 53436 29.42 33.18 27.70 17 DKIM_VALID_EF 50566 26.85 28.24 26.21 18 ALL_TRUSTED 47073 18.82 6.59 24.40 19 FVGT_m_MULTI_ODD 44570 24.81 28.54 23.10 20 XMSubLong 42188 21.65 21.16 21.87 21 MIME_HTML_ONLY 41498 24.42 30.81 21.51 22 T_TM2_M_HEADER_IN_MSG 39029 20.51 21.14 20.23 23 XM_Body_Dirty_Words 37792 23.01 30.50 19.59 24 XM_B_SpammyWords2 35614 24.06 36.30 18.46 25 XM_B_Unsub 33893 17.83 18.39 17.57 26 RCVD_IN_MSPIKE_H2 33367 19.48 24.25 17.30 27 T_KAM_HTML_FONT_INVALID 31639 18.95 24.53 16.40 28 USER_IN_DEF_DKIM_WL 30857 12.12 3.66 15.99 29 RCVD_IN_MSPIKE_H3 29473 14.42 12.54 15.28 30 TooManyTo_001 26867 13.19 11.57 13.93 31 BAYES_00 25214 9.85 2.80 13.07 32 XM_Multi_Part_URI 24902 14.09 16.67 12.91 33 RCVD_IN_MSPIKE_H4 23950 10.57 6.53 12.41 34 TM2_M_URI_OPT_OUT 22255 10.51 8.28 11.54 35 MIME_QP_LONG_LINE 21048 9.69 7.03 10.91 36 BAYES_60 20982 9.97 7.99 10.88 37 XM_DKIMWhitelistDomains 20077 7.15 0.02 10.41 38 XMSubMetaSx_00 17733 9.78 11.06 9.19 39 XM_DK_Undo_02 17032 20.13 44.88 8.83 40 LotsOfNums_01 16523 7.51 5.19 8.56 41 XM_Evil_Numbers_Gen 16431 8.44 8.27 8.52 42 UNPARSEABLE_RELAY 16382 9.91 13.03 8.49 43 T_TooManySym_01 16194 6.39 2.01 8.39 44 LOTS_OF_MONEY 14764 8.73 11.08 7.65 45 HTML_IMAGE_RATIO_02 14067 7.62 8.32 7.29 46 BAYES_99 14027 15.98 35.03 7.27 47 RCVD_IN_VALIDITY_SAFE 13444 6.47 5.38 6.97 48 TR_XM_UnparsRelay 13255 8.75 12.86 6.87 49 TR_XM_DKIM_Undo 13090 16.29 37.11 6.78 50 HTML_IMAGE_RATIO_04 12487 5.69 3.97 6.47 51 RCVD_IN_VALIDITY_CERTIFIED 12200 5.67 4.23 6.32 52 TR_XM_DK_Bayes 12177 4.43 0.33 6.31 53 XM_SendGrid 11994 6.69 7.74 6.22 54 TR_XM_DK_Bayes1 11946 4.35 0.31 6.19 55 BAYES_999 11832 12.96 27.89 6.13 56 XMSexyCombo_01 11167 6.28 7.34 5.79 57 TR_XM_DK_Bayes2 10797 3.90 0.20 5.60 58 BOTNET_IPINHOSTNAME 10576 7.13 10.75 5.48 59 MPART_ALT_DIFF 10467 8.12 14.03 5.43 60 XMStrtUSub 10332 5.14 4.68 5.36 61 SHORT_URI_2 10123 4.84 3.96 5.25 62 IN_ZIMBRA_NJ_WHITELIST 10045 3.60 0.07 5.21 63 TR_XM_SpammyWords4 9762 6.49 9.62 5.06 64 XMNumbers 9334 4.40 3.44 4.84 65 T_TooManySym_02 9293 3.44 0.43 4.82 66 XM_H_Long_From01 9241 4.70 4.49 4.79 67 BAYES_20 9199 4.22 3.01 4.77 68 BAYES_40 9060 3.88 2.10 4.70 69 BAYES_80 8873 5.34 6.97 4.60 70 XMSexyCombo_05 8723 6.98 12.35 4.52 71 FSL_BULK_SIG 8565 6.14 9.87 4.44 72 XM_UncommonTLD01 8499 7.46 14.14 4.41 73 TR_XM_DK_SendGrid 7828 4.22 4.57 4.06 74 XM_B_SpammyWords3 7577 6.22 11.24 3.93 75 BOUNCE_MESSAGE 7543 2.82 0.44 3.91 76 ANY_BOUNCE_MESSAGE 7543 2.82 0.44 3.91 77 MIME_HTML_ONLY_MULTI 7477 4.86 7.02 3.88 78 HTML_IMAGE_RATIO_06 7393 3.55 2.92 3.83 79 XM_B_Phish_Phrases 7369 4.41 5.69 3.82 80 RCVD_IN_IADB_LISTED 7203 3.02 1.46 3.73 81 XM_H_Trusted_IP 7158 2.55 0.00 3.71 82 INVALID_MSGID 7061 2.59 0.26 3.66 83 MSGID_NOFQDN1 6765 2.45 0.14 3.51 84 FROM_EXCESS_BASE64 6697 2.92 1.71 3.47 85 RCVD_IN_IADB_SPF 6413 2.64 1.15 3.32 86 TO_MALFORMED 6114 2.18 0.03 3.17 87 TR_DCC_Bayes_99 5921 10.21 25.83 3.07 88 RELAYCOUNTRY_META 5784 9.30 23.10 3.00 89 RCVD_IN_IADB_SENDERID 5765 2.38 1.03 2.99 90 DKIM_INVALID 5681 3.35 4.23 2.94 91 RCVD_IN_IADB_DK 5614 2.33 1.05 2.91 92 T_REMOTE_IMAGE 5407 2.45 1.68 2.80 93 BAYES_95 5277 3.09 3.86 2.74 94 SHORT_URI_3 5217 2.39 1.69 2.70 95 TVD_RCVD_IP 4749 1.71 0.05 2.46 96 RCVD_IN_IADB_VOUCHED 4739 1.99 0.96 2.46 97 RCVD_IN_MSPIKE_H5 4585 1.75 0.39 2.38 98 TR_XM_PhishingBody 4547 3.18 4.99 2.36 99 HTML_IMAGE_RATIO_08 4454 2.06 1.51 2.31 100 URI_NOVOWEL 4404 3.80 7.12 2.28 101 T_XMDrugObfuBody_14 4388 2.65 3.46 2.27 102 BAYES_05 4218 1.76 0.83 2.19 103 IN_HORDE_ADDRESS_BOOK 4159 1.50 0.06 2.16 104 XM_PDF 4155 1.63 0.47 2.15 105 MIME_HTML_MOSTLY 3984 4.05 8.40 2.07 106 TR_XM_SpammyWords2 3881 5.36 12.70 2.01 107 MAILING_LIST_MULTI 3764 1.71 1.18 1.95 108 HTML_MIME_NO_HTML_TAG 3760 3.61 7.24 1.95 109 XM_B_SpammyTLD 3639 2.54 3.98 1.89 110 TM2_M_VERY_LONG_WORD 3616 3.39 6.70 1.87 111 XMBSHREFv2 3421 1.30 0.25 1.77 112 XMStockSpam_06 3265 1.55 1.23 1.69 113 XM_GoogleGroups 3255 2.66 4.78 1.69 114 RCVD_IN_IADB_OPTIN 3213 1.31 0.54 1.67 115 TVD_SPACE_RATIO 3100 1.24 0.44 1.61 116 XM_CamelCaseFrm001 3089 1.69 1.89 1.60 117 XMGappySubj_01 3058 1.12 0.11 1.59 118 BOTNET 2996 4.79 11.86 1.55 119 TR_Symld_Words 2960 1.66 1.95 1.53 120 TR_XM_SB_Phish 2905 1.36 1.04 1.51 121 XM_DK_Undo_01 2893 1.69 2.09 1.50 122 XMSubPhish11 2877 1.34 1.00 1.49 123 XMSubNoVowel 2874 1.21 0.59 1.49 124 URI_HEX 2728 1.47 1.60 1.41 125 XM_B_Investor 2636 2.15 3.86 1.37 126 XMBdyGiftCard01 2622 1.54 1.94 1.36 127 SHORTENED_URL_HREF 2587 1.24 1.01 1.34 128 TR_XM_SpammyRelay 2532 5.57 14.90 1.31 129 HTML_FONT_FACE_BAD 2499 1.25 1.14 1.30 130 RCVD_IN_RP_SAFE 2496 1.25 1.17 1.29 131 TooManyTo_002 2495 1.10 0.68 1.29 132 TR_XM_MaxUnsub 2383 2.76 6.10 1.24 133 T_XMDrugObfuBody_08 2335 2.07 3.97 1.21 134 T_TooManySym_03 2261 0.84 0.10 1.17 135 RCVD_IN_RP_CERTIFIED 2260 1.10 0.93 1.17 136 XM_B_Phish66 2226 1.55 2.42 1.15 137 UNTRUSTED_Relay 2202 5.09 13.74 1.14 138 TR_XM_SpammyWords5 2198 1.93 3.66 1.14 139 XM_H_Long_From02 2102 1.14 1.26 1.09 140 XMDiploma_00 2100 1.32 1.82 1.09 141 SUBJ_ALL_CAPS 2080 1.54 2.55 1.08 142 XM_SPF_SoftFail 2034 2.03 4.17 1.05 143 RCVD_IN_BL_SPAMCOP_NET 1965 3.21 8.00 1.02 144 XM_B_COPY_HTML 1905 0.96 0.92 0.99 145 XMBrknScrpt_02 1868 1.10 1.39 0.97 146 XMLngstWrd_00 1861 2.24 5.03 0.96 147 TooManyTo_003 1857 0.86 0.62 0.96 148 DKIM_ADSP_CUSTOM_MED 1792 1.06 1.35 0.93 149 XMLngstWrd_01 1778 2.20 5.00 0.92 150 KHOP_HELO_FCRDNS 1711 1.75 3.64 0.89 151 RELAYCOUNTRY_CA 1683 2.32 5.50 0.87 152 HTML_IMAGE_ONLY_20 1633 0.75 0.53 0.85 153 XMLngstWrd_02 1605 2.12 4.95 0.83 154 RCVD_IN_MSPIKE_BL 1601 2.32 5.59 0.83 155 TR_XM_MSPIKECOMBO 1600 2.32 5.57 0.83 156 TR_MetaPhish_Combo_01 1565 0.81 0.82 0.81 157 XM_B_Unsub2 1547 0.99 1.39 0.80 158 XM_UB50 1453 2.48 6.26 0.75 159 XMBody_95 1427 0.55 0.13 0.74 160 TooManyTo_004 1425 0.69 0.59 0.74 161 XMLngstWrd_03 1411 2.04 4.92 0.73 162 XM_ProductURIs 1352 0.80 1.01 0.70 163 RDNS_DYNAMIC 1328 0.59 0.36 0.69 164 TR_MSPIKEBAYES00 1301 0.47 0.02 0.67 165 XMLngstWrd_04 1299 1.99 4.88 0.67 166 USER_IN_WHITELIST 1277 0.45 0.00 0.66 167 USER_IN_WELCOMELIST 1277 0.45 0.00 0.66 168 XMPhish30 1230 0.86 1.34 0.64 169 XMBody_17 1219 1.20 2.46 0.63 170 TooManyTo_005 1206 0.60 0.55 0.63 171 T_XMDrugObfuBody_00 1185 1.02 1.92 0.61 172 XM_OfRef6 1180 1.20 2.49 0.61 173 NML_ADSP_CUSTOM_MED 1136 0.81 1.29 0.59 174 XMHTMLBadTable_001 1135 0.71 0.99 0.59 175 URI_TRY_3LD 1130 0.64 0.76 0.59 176 NUMERIC_HTTP_ADDR 1116 0.62 0.72 0.58 177 XMHTML_After_End 1102 0.57 0.55 0.57 178 DATE_IN_PAST_03_06 1098 0.51 0.37 0.57 179 XMGenDplmaNmb 1058 0.60 0.71 0.55 180 XMSubMetaSxObfu_03 1043 0.52 0.47 0.54 181 DKIM_ADSP_NXDOMAIN 1038 0.45 0.26 0.54 182 XMSubMetaI_00 1037 0.67 0.96 0.54 183 XM_Body_Dirty_Words_01 1016 1.45 3.47 0.53 184 T_TooManySym_04 1015 0.37 0.04 0.53 185 XM_RXBody 1010 0.57 0.66 0.52 186 FORGED_GMAIL_RCVD 1006 0.75 1.24 0.52 187 RELAYCOUNTRY_GB 1006 0.75 1.24 0.52 188 MPART_ALT_DIFF_COUNT 995 0.50 0.45 0.52 189 HTTPS_HTTP_MISMATCH 963 0.70 1.14 0.50 190 XM_H_PHPMailer 961 0.77 1.37 0.50 191 HTML_TAG_BALANCE_BODY 957 0.82 1.54 0.50 192 TVD_SPACE_RATIO_MINFP 956 0.37 0.09 0.50 193 NO_DNS_FOR_FROM 955 1.14 2.56 0.50 194 XMSexyCombo_02 954 1.32 3.14 0.49 195 PLING_QUERY 947 0.85 1.65 0.49 196 TR_XM_SpammyWords3 944 1.53 3.80 0.49 197 XMSubMetaSxObfu_02 941 0.47 0.43 0.49 198 UPPERCASE_75_100 940 1.65 4.19 0.49 199 RCVD_IN_MSPIKE_L3 926 1.40 3.41 0.48 200 HTML_TITLE_SUBJ_DIFF 918 1.64 4.18 0.48 ----------------------------------------------------------------------