Email: 270160 Autolearn: 0 AvgScore: 3.54 AvgScanTime: 1.26 sec Spam: 83557 Autolearn: 0 AvgScore: 15.57 AvgScanTime: 1.30 sec Ham: 186603 Autolearn: 0 AvgScore: -1.84 AvgScanTime: 1.24 sec Time Spent Running SA: 94.67 hours Time Spent Processing Spam: 30.27 hours Time Spent Processing Ham: 64.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 76660 86.14 91.75 83.63 2 DKIM_SIGNED 68516 78.42 82.00 76.81 3 XM_DK_Pass 66715 76.88 79.84 75.55 4 DKIM_VALID 66460 76.48 79.54 75.11 5 XM_B_Unicode 65386 74.12 78.25 72.26 6 RELAYCOUNTRY_US 64844 79.69 77.60 80.63 7 DCC_CHECK 59360 49.48 71.04 39.83 8 XMListUnsubscribeExists 53840 56.97 64.44 53.62 9 XM_B_SpammyWords 52318 51.75 62.61 46.88 10 DKIM_VALID_AU 50066 61.65 59.92 62.42 11 XM_DK_Undo_02 38320 21.02 45.86 9.90 12 XM_B_Unicode3 37564 46.31 44.96 46.92 13 BAYES_99 33036 18.21 39.54 8.66 14 LOC_TINY_FONT_1 29946 32.08 35.84 30.40 15 TR_XM_DKIM_Undo 29699 15.95 35.54 7.18 16 BAYES_50 29448 47.03 35.24 52.31 17 XM_B_SpammyWords2 29350 25.80 35.13 21.63 18 MIME_HTML_ONLY 27415 25.93 32.81 22.85 19 HTML_FONT_LOW_CONTRAST 26942 30.99 32.24 30.42 20 BAYES_999 26145 14.74 31.29 7.33 21 RCVD_IN_MSPIKE_H2 25497 23.30 30.51 20.07 22 FVGT_m_MULTI_ODD 24848 26.07 29.74 24.43 23 DCC_CHECK_NEGATIVE 24174 50.49 28.93 60.14 24 TR_DCC_Bayes_99 23334 10.93 27.93 3.32 25 DKIM_VALID_EF 22645 27.93 27.10 28.31 26 T_KAM_HTML_FONT_INVALID 20388 19.52 24.40 17.34 27 RELAYCOUNTRY_META 19939 9.66 23.86 3.30 28 XMSubLong 19937 22.11 23.86 21.32 29 XM_Body_Dirty_Words 17923 15.61 21.45 13.00 30 T_TM2_M_HEADER_IN_MSG 17094 21.00 20.46 21.25 31 RCVD_IN_MSPIKE_WL 16182 29.13 19.37 33.51 32 XM_Multi_Part_URI 13778 15.77 16.49 15.45 33 BOTNET 13365 6.14 16.00 1.72 34 UNPARSEABLE_RELAY 12796 11.40 15.31 9.64 35 TR_XM_UnparsRelay 12590 10.09 15.07 7.87 36 FSL_BULK_SIG 12389 7.88 14.83 4.77 37 XM_B_Unsub 11664 13.16 13.96 12.80 38 BOTNET_IPINHOSTNAME 11541 8.60 13.81 6.26 39 RCVD_IN_MSPIKE_H3 10536 16.14 12.61 17.71 40 TR_XM_SpammyWords2 10471 5.64 12.53 2.56 41 UNTRUSTED_Relay 10451 4.86 12.51 1.44 42 RCVD_IN_BL_SPAMCOP_NET 10069 4.25 12.05 0.75 43 XM_B_SpammyWords3 9817 7.79 11.75 6.01 44 TR_XM_SpammyRelay 9161 4.36 10.96 1.40 45 XM_UncommonTLD01 9062 6.46 10.85 4.50 46 LOTS_OF_MONEY 8960 9.44 10.72 8.86 47 XMSexyCombo_05 8578 6.95 10.27 5.47 48 HTML_IMAGE_RATIO_02 7802 8.68 9.34 8.39 49 XM_SendGrid 7646 7.82 9.15 7.23 50 TR_XM_SpammyWords4 7585 7.08 9.08 6.18 51 BAYES_80 7104 6.58 8.50 5.72 52 XM_Evil_Numbers_Gen 6995 9.69 8.37 10.28 53 BAYES_60 6305 10.97 7.55 12.50 54 RELAYCOUNTRY_CA 5692 2.76 6.81 0.95 55 TR_XM_MaxUnsub 5546 3.22 6.64 1.69 56 RCVD_IN_MSPIKE_BL 5440 2.58 6.51 0.82 57 RCVD_IN_MSPIKE_H4 5396 11.20 6.46 13.33 58 TR_XM_PhishingBody 5381 3.84 6.44 2.67 59 TR_XM_MSPIKECOMBO 5378 2.56 6.44 0.82 60 XMSubMetaSx_00 5221 5.54 6.25 5.23 61 RCVD_IN_VALIDITY_RPBL 5204 1.94 6.23 0.03 62 LotsOfNums_01 4835 8.10 5.79 9.14 63 TR_XM_SPAMCOP 4762 1.87 5.70 0.16 64 XM_H_Long_From01 4744 5.36 5.68 5.22 65 RCVD_IN_VALIDITY_SAFE 4682 7.06 5.60 7.71 66 TR_XM_DK_SendGrid 4571 5.00 5.47 4.79 67 MPART_ALT_DIFF 4567 5.11 5.47 4.95 68 TooManyTo_001 4565 6.02 5.46 6.26 69 XM_UB50 4531 2.27 5.42 0.86 70 BAYES_95 4530 4.09 5.42 3.50 71 XM_SPF_SoftFail 4435 2.47 5.31 1.20 72 XMNumbers 4269 4.99 5.11 4.94 73 XM_B_Phish_Phrases 4218 4.70 5.05 4.54 74 T_XMDrugObfuBody_14 4128 3.15 4.94 2.35 75 BOTNET_NORDNS 4123 1.55 4.93 0.03 76 TM2_M_VERY_LONG_WORD 4086 2.72 4.89 1.75 77 HTML_IMAGE_RATIO_04 3969 6.60 4.75 7.42 78 T_XMDrugObfuBody_08 3934 2.39 4.71 1.35 79 HTML_MIME_NO_HTML_TAG 3931 2.42 4.70 1.40 80 RCVD_IN_VALIDITY_CERTIFIED 3879 6.30 4.64 7.04 81 BODY_URI_ONLY 3819 1.42 4.57 0.01 82 XMStrtUSub 3647 5.17 4.36 5.53 83 T_REMOTE_IMAGE 3616 3.45 4.33 3.06 84 XM_B_SpammyTLD 3254 2.86 3.89 2.39 85 XM_B_Investor 3224 2.20 3.86 1.45 86 RCVD_IN_PSBL 3143 1.31 3.76 0.21 87 T_FILL_THIS_FORM_SHORT 3137 1.54 3.75 0.55 88 SpammyFromTLD_01 3068 1.40 3.67 0.38 89 RCVD_IN_MSPIKE_L5 3055 1.16 3.66 0.04 90 XM_BadFromFormat 2984 1.19 3.57 0.12 91 TR_XM_SpammyWords5 2978 2.20 3.56 1.59 92 T_XMDrugObfuBody_00 2863 1.55 3.43 0.71 93 MIME_HTML_ONLY_MULTI 2763 3.30 3.31 3.30 94 HTML_IMAGE_RATIO_06 2717 3.92 3.25 4.22 95 XMBdyGiftCard01 2704 2.03 3.24 1.49 96 TM2_M_URI_OPT_OUT 2595 2.85 3.11 2.74 97 TR_XM_PHPDW 2578 1.21 3.09 0.37 98 HTML_SHORT_LINK_IMG_1 2560 0.96 3.06 0.02 99 TR_XM_PHPForged 2505 1.13 3.00 0.29 100 TR_XM_FormFill2 2473 1.11 2.96 0.29 101 XM_UB99 2472 0.92 2.96 0.00 102 XM_H_PHPOS 2464 1.11 2.95 0.28 103 XM_DIRTYINTL 2422 1.07 2.90 0.26 104 USER_IN_DEF_DKIM_WL 2413 14.52 2.89 19.73 105 XM_B_Phish66 2364 1.72 2.83 1.22 106 MIME_HTML_MOSTLY 2344 2.50 2.81 2.36 107 TR_XM_FormFill 2271 0.84 2.72 0.01 108 RELAYCOUNTRY_PL 2232 0.84 2.67 0.02 109 URI_NOVOWEL 2223 2.38 2.66 2.25 110 DIET_1 2175 1.09 2.60 0.42 111 TR_XM_MSPIKECOMBO2 2130 0.91 2.55 0.18 112 SUBJ_ALL_CAPS 2130 1.61 2.55 1.19 113 SpammyFromTLD_02 2102 0.92 2.52 0.21 114 DKIM_INVALID 2056 1.94 2.46 1.70 115 FROM_MISSP_REPLYTO 2040 0.77 2.44 0.03 116 XM_CamelCaseFrm001 2004 2.07 2.40 1.92 117 TR_Mismatch_TLD_02 1987 0.82 2.38 0.13 118 XMGppyBdWords 1980 0.80 2.37 0.09 119 XM_DK_Undo_01 1978 1.69 2.37 1.38 120 T_TooManySym_01 1962 6.15 2.35 7.85 121 RCVD_IN_MSPIKE_L3 1938 1.11 2.32 0.57 122 XMSubMetaD_00 1926 0.76 2.31 0.07 123 HDRS_MISSP 1908 0.71 2.28 0.00 124 FROM_SUSPICIOUS_NTLD 1893 0.75 2.27 0.07 125 URIBL_SBL_A 1884 0.71 2.25 0.02 126 MAILING_LIST_MULTI 1879 2.01 2.25 1.90 127 MIME_QP_LONG_LINE 1862 3.28 2.23 3.75 128 XMSexyCombo_01 1853 1.74 2.22 1.53 129 XM_UB999 1841 0.68 2.20 0.00 130 FROM_SUSPICIOUS_NTLD_FP 1832 0.72 2.19 0.07 131 TR_XM_SpammyWords3 1828 0.95 2.19 0.40 132 HTML_IMAGE_RATIO_08 1815 2.54 2.17 2.70 133 RCVD_IN_IADB_LISTED 1804 3.56 2.16 4.19 134 HTML_EXTRA_CLOSE 1791 0.67 2.14 0.01 135 XMObfuSubjects 1789 0.67 2.14 0.02 136 FROM_EXCESS_BASE64 1789 3.17 2.14 3.62 137 T_Symld_Words_02 1778 0.86 2.13 0.30 138 KHOP_HELO_FCRDNS 1772 1.28 2.12 0.90 139 XMDiploma_00 1765 1.41 2.11 1.09 140 T_XMHurry_00 1762 1.05 2.11 0.58 141 XM_B_SpammyWords4 1751 1.32 2.10 0.97 142 XMBody_17 1734 0.95 2.08 0.45 143 PDS_OTHER_BAD_TLD 1713 1.04 2.05 0.59 144 FROM_2_EMAILS_SHORT 1704 0.63 2.04 0.01 145 XMSubject_38 1700 0.63 2.03 0.01 146 NAME_EMAIL_DIFF 1683 0.69 2.01 0.09 147 XM_OfRef6 1679 1.36 2.01 1.07 148 ALL_TRUSTED 1652 12.20 1.98 16.78 149 XMSubMetaD_01 1651 0.62 1.98 0.01 150 XM_B_Unsub2 1587 1.44 1.90 1.23 151 PDS_TO_EQ_FROM_NAME 1585 0.59 1.90 0.00 152 DKIM_ADSP_CUSTOM_MED 1567 1.15 1.88 0.83 153 TR_Symld_Words 1566 1.48 1.87 1.30 154 LONG_JUNK_URI 1562 0.59 1.87 0.02 155 RCVD_IN_IADB_SPF 1528 3.15 1.83 3.74 156 XM_GoogleGroups 1497 1.44 1.79 1.28 157 DRUGS_ERECTILE 1493 0.56 1.79 0.02 158 XMReplyNow 1482 0.71 1.77 0.23 159 NO_FM_NAME_IP_HOSTN 1480 0.55 1.77 0.01 160 URI_HEX 1447 1.65 1.73 1.62 161 RELAYCOUNTRY_GB 1442 0.90 1.73 0.54 162 TR_XM_SpoofStaff 1411 0.64 1.69 0.17 163 XMPhish30 1408 1.06 1.69 0.78 164 RCVD_IN_IADB_DK 1407 2.76 1.68 3.25 165 XMSpoofStaff2 1398 0.63 1.67 0.17 166 XM_B_REG_HTML 1394 0.86 1.67 0.49 167 TR_XM_BayesRelay 1389 0.52 1.66 0.01 168 RCVD_IN_IADB_SENDERID 1379 2.86 1.65 3.41 169 TR_XM_NoHeaderRelay 1372 0.64 1.64 0.19 170 HTML_IMAGE_ONLY_08 1335 0.58 1.60 0.13 171 SHORT_SHORTNER 1317 0.51 1.58 0.03 172 TVD_SPACE_RATIO 1301 1.60 1.56 1.62 173 XMStockSpam_06 1299 2.69 1.55 3.19 174 XMSubMetaD_02 1286 0.48 1.54 0.00 175 HTML_IMAGE_ONLY_04 1271 0.50 1.52 0.04 176 T_XMDrugObfuBody_09 1271 0.48 1.52 0.01 177 PDS_FROM_2_EMAILS 1264 0.47 1.51 0.01 178 HTML_FONT_TINY_NORDNS 1258 0.52 1.51 0.08 179 TM2_M_A_HREF_HREF 1255 0.76 1.50 0.43 180 SHORTENER_SHORT_IMG 1252 0.46 1.50 0.00 181 TR_XM_PSC1 1251 0.58 1.50 0.17 182 HTML_SHORT_CENTER 1249 0.47 1.49 0.01 183 XM_URI_RBL 1248 0.57 1.49 0.16 184 TR_XM_SpoofStaff2 1245 0.46 1.49 0.00 185 SHORTENED_URL_SRC 1245 0.46 1.49 0.00 186 XM_H_SpoofStaff4 1243 0.61 1.49 0.22 187 XMLngstWrd_00 1220 0.94 1.46 0.71 188 MONEY_NOHTML 1211 0.48 1.45 0.05 189 LongTLD 1205 0.50 1.44 0.08 190 FORGED_GMAIL_RCVD 1185 0.77 1.42 0.47 191 RCVD_IN_IADB_VOUCHED 1171 2.26 1.40 2.64 192 DRUGS_ERECTILE_OBFU 1171 0.43 1.40 0.00 193 URIBL_BLACK 1152 0.44 1.38 0.03 194 RCVD_IN_RP_SAFE 1149 1.42 1.38 1.44 195 XMSubMetaI_00 1148 1.16 1.37 1.06 196 RELAYCOUNTRY_AU 1142 0.57 1.37 0.21 197 XMPhish08 1139 0.53 1.36 0.16 198 XM_Body_Dirty_Words_01 1132 1.20 1.35 1.12 199 HTTPS_HTTP_MISMATCH 1128 0.71 1.35 0.43 200 XMLngstWrd_01 1120 0.86 1.34 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156047 86.14 91.75 83.63 2 RELAYCOUNTRY_US 150454 79.69 77.60 80.63 3 DKIM_SIGNED 143334 78.42 82.00 76.81 4 XM_DK_Pass 140986 76.88 79.84 75.55 5 DKIM_VALID 140154 76.48 79.54 75.11 6 XM_B_Unicode 134846 74.12 78.25 72.26 7 DKIM_VALID_AU 116479 61.65 59.92 62.42 8 DCC_CHECK_NEGATIVE 112218 50.49 28.93 60.14 9 XMListUnsubscribeExists 100059 56.97 64.44 53.62 10 BAYES_50 97621 47.03 35.24 52.31 11 XM_B_Unicode3 87557 46.31 44.96 46.92 12 XM_B_SpammyWords 87477 51.75 62.61 46.88 13 DCC_CHECK 74326 49.48 71.04 39.83 14 RCVD_IN_MSPIKE_WL 62523 29.13 19.37 33.51 15 HTML_FONT_LOW_CONTRAST 56768 30.99 32.24 30.42 16 LOC_TINY_FONT_1 56719 32.08 35.84 30.40 17 DKIM_VALID_EF 52820 27.93 27.10 28.31 18 FVGT_m_MULTI_ODD 45595 26.07 29.74 24.43 19 MIME_HTML_ONLY 42634 25.93 32.81 22.85 20 XM_B_SpammyWords2 40353 25.80 35.13 21.63 21 XMSubLong 39786 22.11 23.86 21.32 22 T_TM2_M_HEADER_IN_MSG 39648 21.00 20.46 21.25 23 RCVD_IN_MSPIKE_H2 37459 23.30 30.51 20.07 24 USER_IN_DEF_DKIM_WL 36818 14.52 2.89 19.73 25 RCVD_IN_MSPIKE_H3 33055 16.14 12.61 17.71 26 T_KAM_HTML_FONT_INVALID 32348 19.52 24.40 17.34 27 ALL_TRUSTED 31319 12.20 1.98 16.78 28 XM_Multi_Part_URI 28827 15.77 16.49 15.45 29 RCVD_IN_MSPIKE_H4 24869 11.20 6.46 13.33 30 XM_Body_Dirty_Words 24260 15.61 21.45 13.00 31 XM_B_Unsub 23882 13.16 13.96 12.80 32 XM_DKIMWhitelistDomains 23714 8.82 0.14 12.71 33 BAYES_60 23324 10.97 7.55 12.50 34 XM_Evil_Numbers_Gen 19192 9.69 8.37 10.28 35 XM_DK_Undo_02 18476 21.02 45.86 9.90 36 UNPARSEABLE_RELAY 17996 11.40 15.31 9.64 37 LotsOfNums_01 17049 8.10 5.79 9.14 38 LOTS_OF_MONEY 16538 9.44 10.72 8.86 39 BAYES_00 16416 6.25 0.58 8.80 40 BAYES_99 16167 18.21 39.54 8.66 41 HTML_IMAGE_RATIO_02 15652 8.68 9.34 8.39 42 TR_XM_UnparsRelay 14678 10.09 15.07 7.87 43 T_TooManySym_01 14654 6.15 2.35 7.85 44 RCVD_IN_VALIDITY_SAFE 14396 7.06 5.60 7.71 45 HTML_IMAGE_RATIO_04 13850 6.60 4.75 7.42 46 BAYES_999 13671 14.74 31.29 7.33 47 XM_SendGrid 13492 7.82 9.15 7.23 48 TR_XM_DKIM_Undo 13389 15.95 35.54 7.18 49 RCVD_IN_VALIDITY_CERTIFIED 13146 6.30 4.64 7.04 50 TR_XM_DK_Bayes 11697 4.47 0.46 6.27 51 TooManyTo_001 11689 6.02 5.46 6.26 52 BOTNET_IPINHOSTNAME 11681 8.60 13.81 6.26 53 TR_XM_SpammyWords4 11531 7.08 9.08 6.18 54 TR_XM_DK_Bayes1 11507 4.40 0.45 6.17 55 XM_B_SpammyWords3 11220 7.79 11.75 6.01 56 BAYES_80 10668 6.58 8.50 5.72 57 TR_XM_DK_Bayes2 10508 3.99 0.32 5.63 58 XMStrtUSub 10326 5.17 4.36 5.53 59 IN_ZIMBRA_NJ_WHITELIST 10314 3.85 0.11 5.53 60 XMSexyCombo_05 10208 6.95 10.27 5.47 61 XMSubMetaSx_00 9751 5.54 6.25 5.23 62 XM_H_Long_From01 9738 5.36 5.68 5.22 63 T_TooManySym_02 9287 3.70 0.85 4.98 64 MPART_ALT_DIFF 9237 5.11 5.47 4.95 65 XMNumbers 9217 4.99 5.11 4.94 66 TR_XM_DK_SendGrid 8929 5.00 5.47 4.79 67 FSL_BULK_SIG 8904 7.88 14.83 4.77 68 XM_B_Phish_Phrases 8468 4.70 5.05 4.54 69 XM_UncommonTLD01 8401 6.46 10.85 4.50 70 BAYES_40 7879 3.31 1.28 4.22 71 HTML_IMAGE_RATIO_06 7876 3.92 3.25 4.22 72 RCVD_IN_IADB_LISTED 7816 3.56 2.16 4.19 73 MIME_QP_LONG_LINE 6992 3.28 2.23 3.75 74 RCVD_IN_IADB_SPF 6977 3.15 1.83 3.74 75 FROM_EXCESS_BASE64 6763 3.17 2.14 3.62 76 INVALID_MSGID 6727 2.59 0.33 3.60 77 BAYES_95 6531 4.09 5.42 3.50 78 XM_H_Trusted_IP 6526 2.42 0.00 3.50 79 MSGID_NOFQDN1 6403 2.44 0.23 3.43 80 RCVD_IN_IADB_SENDERID 6354 2.86 1.65 3.41 81 TR_DCC_Bayes_99 6203 10.93 27.93 3.32 82 RELAYCOUNTRY_META 6158 9.66 23.86 3.30 83 MIME_HTML_ONLY_MULTI 6157 3.30 3.31 3.30 84 ANY_BOUNCE_MESSAGE 6085 2.47 0.70 3.26 85 BOUNCE_MESSAGE 6085 2.47 0.70 3.26 86 RCVD_IN_IADB_DK 6056 2.76 1.68 3.25 87 TO_MALFORMED 6011 2.23 0.01 3.22 88 XMStockSpam_06 5958 2.69 1.55 3.19 89 T_REMOTE_IMAGE 5713 3.45 4.33 3.06 90 TVD_RCVD_IP 5390 2.15 0.51 2.89 91 TM2_M_URI_OPT_OUT 5107 2.85 3.11 2.74 92 HTML_IMAGE_RATIO_08 5034 2.54 2.17 2.70 93 TR_XM_PhishingBody 4983 3.84 6.44 2.67 94 RCVD_IN_IADB_VOUCHED 4926 2.26 1.40 2.64 95 BAYES_20 4790 2.03 0.82 2.57 96 TR_XM_SpammyWords2 4772 5.64 12.53 2.56 97 RCVD_IN_MSPIKE_H5 4599 1.79 0.30 2.46 98 XM_B_SpammyTLD 4468 2.86 3.89 2.39 99 MIME_HTML_MOSTLY 4413 2.50 2.81 2.36 100 T_XMDrugObfuBody_14 4390 3.15 4.94 2.35 101 URI_NOVOWEL 4206 2.38 2.66 2.25 102 IN_HORDE_ADDRESS_BOOK 3993 1.63 0.51 2.14 103 XM_PDF 3914 1.58 0.42 2.10 104 TR_XM_SB_Phish 3624 1.75 1.31 1.94 105 XMSubPhish11 3604 1.70 1.18 1.93 106 XM_CamelCaseFrm001 3588 2.07 2.40 1.92 107 MAILING_LIST_MULTI 3539 2.01 2.25 1.90 108 XMBSHREFv2 3489 1.36 0.23 1.87 109 TM2_M_VERY_LONG_WORD 3259 2.72 4.89 1.75 110 RCVD_IN_IADB_OPTIN 3259 1.49 0.92 1.75 111 BOTNET 3215 6.14 16.00 1.72 112 BAYES_05 3198 1.51 1.07 1.71 113 DKIM_INVALID 3180 1.94 2.46 1.70 114 TR_XM_MaxUnsub 3157 3.22 6.64 1.69 115 TVD_SPACE_RATIO 3032 1.60 1.56 1.62 116 URI_HEX 3022 1.65 1.73 1.62 117 TR_XM_SpammyWords5 2966 2.20 3.56 1.59 118 XMGappySubj_01 2900 1.15 0.25 1.55 119 XMSexyCombo_01 2852 1.74 2.22 1.53 120 XMBdyGiftCard01 2784 2.03 3.24 1.49 121 XM_B_Investor 2715 2.20 3.86 1.45 122 RCVD_IN_RP_SAFE 2686 1.42 1.38 1.44 123 UNTRUSTED_Relay 2684 4.86 12.51 1.44 124 XMSubMetaSxObfu_03 2623 1.26 0.94 1.41 125 TR_XM_SpammyRelay 2621 4.36 10.96 1.40 126 HTML_MIME_NO_HTML_TAG 2607 2.42 4.70 1.40 127 XM_DK_Undo_01 2580 1.69 2.37 1.38 128 T_XMDrugObfuBody_08 2521 2.39 4.71 1.35 129 RCVD_IN_RP_CERTIFIED 2498 1.27 1.13 1.34 130 XMSubNoVowel 2476 1.28 1.18 1.33 131 TR_Symld_Words 2427 1.48 1.87 1.30 132 XM_GoogleGroups 2384 1.44 1.79 1.28 133 XM_S_SpammyWords 2380 1.02 0.45 1.28 134 TR_XM_Spammywords 2380 1.02 0.45 1.28 135 HTML_FONT_FACE_BAD 2332 1.12 0.83 1.25 136 XM_B_Unsub2 2301 1.44 1.90 1.23 137 XM_B_Phish66 2271 1.72 2.83 1.22 138 XM_SPF_SoftFail 2243 2.47 5.31 1.20 139 SUBJ_ALL_CAPS 2226 1.61 2.55 1.19 140 TooManyTo_002 2226 1.06 0.76 1.19 141 T_TooManySym_03 2196 0.87 0.18 1.18 142 XM_Body_Dirty_Words_01 2098 1.20 1.35 1.12 143 XMBody_95 2092 0.82 0.14 1.12 144 XMSolicitRefs_0 2062 0.87 0.34 1.11 145 XMDiploma_00 2033 1.41 2.11 1.09 146 XM_OfRef6 1998 1.36 2.01 1.07 147 XMSubMetaI_00 1980 1.16 1.37 1.06 148 XMSexyCombo_04 1943 0.97 0.81 1.04 149 TR_MetaPhish_Combo_01 1907 0.91 0.65 1.02 150 XM_H_Long_From02 1855 1.02 1.08 0.99 151 XMSexyCombo_02 1810 0.83 0.51 0.97 152 XM_B_SpammyWords4 1803 1.32 2.10 0.97 153 RELAYCOUNTRY_CA 1775 2.76 6.81 0.95 154 XMBrknScrpt_02 1737 0.97 1.07 0.93 155 KHOP_HELO_FCRDNS 1684 1.28 2.12 0.90 156 TooManyTo_003 1654 0.83 0.70 0.89 157 XM_B_COPY_HTML 1652 0.84 0.75 0.89 158 XM_UB50 1613 2.27 5.42 0.86 159 HTML_IMAGE_ONLY_20 1552 0.67 0.30 0.83 160 MPART_ALT_DIFF_COUNT 1552 0.81 0.77 0.83 161 DKIM_ADSP_CUSTOM_MED 1544 1.15 1.88 0.83 162 TR_XM_MSPIKECOMBO 1527 2.56 6.44 0.82 163 RCVD_IN_MSPIKE_BL 1527 2.58 6.51 0.82 164 HTML_TAG_BALANCE_BODY 1494 0.90 1.11 0.80 165 XMPhish30 1462 1.06 1.69 0.78 166 RCVD_IN_BL_SPAMCOP_NET 1408 4.25 12.05 0.75 167 PLING_QUERY 1399 0.93 1.33 0.75 168 USER_IN_WELCOMELIST 1397 0.52 0.00 0.75 169 USER_IN_WHITELIST 1397 0.52 0.00 0.75 170 XM_D_tchamptons_WL 1374 0.51 0.00 0.74 171 TR_MSPIKEBAYES00 1347 0.50 0.01 0.72 172 XMLngstWrd_00 1329 0.94 1.46 0.71 173 T_XMDrugObfuBody_00 1320 1.55 3.43 0.71 174 TooManyTo_004 1276 0.68 0.68 0.68 175 XMLngstWrd_01 1206 0.86 1.34 0.65 176 NUMERIC_HTTP_ADDR 1188 0.81 1.18 0.64 177 XMGenDplmaNmb 1169 0.68 0.80 0.63 178 RDNS_DYNAMIC 1156 0.69 0.86 0.62 179 XMSubMetaSxObfu_02 1137 0.51 0.28 0.61 180 PDS_OTHER_BAD_TLD 1095 1.04 2.05 0.59 181 T_XMHurry_00 1085 1.05 2.11 0.58 182 XM_ProductURIs 1083 0.59 0.61 0.58 183 RCVD_IN_MSPIKE_L3 1071 1.11 2.32 0.57 184 TooManyTo_005 1065 0.59 0.65 0.57 185 XM_H_PHPMailer 1035 0.73 1.13 0.55 186 URI_TRY_3LD 1031 0.65 0.86 0.55 187 T_FILL_THIS_FORM_SHORT 1028 1.54 3.75 0.55 188 T_TooManySym_04 1015 0.39 0.06 0.54 189 XMLngstWrd_02 1014 0.77 1.29 0.54 190 HTML_TEXT_INVISIBLE_STYLE 1010 0.56 0.59 0.54 191 RELAYCOUNTRY_GB 1002 0.90 1.73 0.54 192 TR_LOTS_OF_MONEY2 979 0.52 0.51 0.52 193 T_MONEY_PERCENT 979 0.52 0.51 0.52 194 XM_B_REG_HTML 916 0.86 1.67 0.49 195 XMNoVowels 911 0.42 0.27 0.49 196 XMHTMLBadTable_001 908 0.66 1.06 0.49 197 DATE_IN_PAST_03_06 901 0.72 1.24 0.48 198 DKIM_ADSP_NXDOMAIN 889 0.45 0.41 0.48 199 FORGED_GMAIL_RCVD 884 0.77 1.42 0.47 200 XM_B_COVIDMETA 850 0.67 1.14 0.46 ----------------------------------------------------------------------