Email: 280664 Autolearn: 0 AvgScore: 4.09 AvgScanTime: 1.23 sec Spam: 101643 Autolearn: 0 AvgScore: 13.83 AvgScanTime: 1.32 sec Ham: 179021 Autolearn: 0 AvgScore: -1.45 AvgScanTime: 1.18 sec Time Spent Running SA: 96.02 hours Time Spent Processing Spam: 37.18 hours Time Spent Processing Ham: 58.84 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 94671 86.91 93.14 83.37 2 DKIM_SIGNED 93523 82.33 92.01 76.84 3 XM_DK_Pass 91883 81.22 90.40 76.00 4 DKIM_VALID 90696 80.32 89.23 75.27 5 RELAYCOUNTRY_US 81628 79.87 80.31 79.62 6 XM_B_Unicode 78258 71.90 76.99 69.02 7 XMListUnsubscribeExists 75102 61.81 73.89 54.94 8 DKIM_VALID_AU 72870 66.69 71.69 63.85 9 XM_B_SpammyWords 67746 52.15 66.65 43.91 10 DCC_CHECK 62427 44.05 61.42 34.19 11 RCVD_IN_MSPIKE_H2 51953 42.10 51.11 36.99 12 XM_DK_Undo_02 47770 22.65 47.00 8.83 13 XM_B_Unicode3 42919 43.42 42.23 44.10 14 BAYES_50 40833 50.80 40.17 56.83 15 DCC_CHECK_NEGATIVE 39201 55.92 38.57 65.78 16 BAYES_99 38517 18.75 37.89 7.88 17 TR_XM_DKIM_Undo 37964 17.44 37.35 6.14 18 XM_B_SpammyWords2 37165 25.48 36.56 19.18 19 MIME_HTML_ONLY 36751 28.27 36.16 23.79 20 FVGT_m_MULTI_ODD 35755 30.08 35.18 27.18 21 LOC_TINY_FONT_1 33829 29.48 33.28 27.33 22 DKIM_VALID_EF 33039 30.54 32.50 29.42 23 HTML_FONT_LOW_CONTRAST 32497 31.40 31.97 31.07 24 BAYES_999 31011 15.26 30.51 6.61 25 T_KAM_HTML_FONT_INVALID 26639 21.26 26.21 18.44 26 TR_DCC_Bayes_99 25151 10.68 24.74 2.69 27 RELAYCOUNTRY_META 24469 11.56 24.07 4.46 28 XM_Body_Dirty_Words 22470 15.47 22.11 11.70 29 T_TM2_M_HEADER_IN_MSG 21051 22.33 20.71 23.25 30 XMSubLong 19402 21.49 19.09 22.85 31 XM_Multi_Part_URI 16638 15.44 16.37 14.91 32 RCVD_IN_MSPIKE_WL 15878 19.48 15.62 21.67 33 TR_XM_SpammyRelay 14842 6.57 14.60 2.00 34 TR_XM_SpammyWords2 13997 6.36 13.77 2.15 35 XM_B_Unsub 13813 11.16 13.59 9.78 36 TR_XM_BayesUnsub 13629 10.00 13.41 8.07 37 RCVD_IN_MSPIKE_H3 13152 14.19 12.94 14.90 38 MPART_ALT_DIFF 13057 9.99 12.85 8.37 39 RELAYCOUNTRY_CA 12307 5.37 12.11 1.55 40 UNPARSEABLE_RELAY 12198 9.42 12.00 7.96 41 TR_XM_UnparsRelay 12031 8.37 11.84 6.41 42 XM_B_SpammyWords3 11806 7.03 11.62 4.43 43 TM2_M_VERY_LONG_WORD 11569 6.65 11.38 3.96 44 LOTS_OF_MONEY 11376 8.67 11.19 7.24 45 MIME_HTML_ONLY_MULTI 11163 7.74 10.98 5.89 46 RCVD_IN_BL_SPAMCOP_NET 10788 4.11 10.61 0.42 47 BOTNET_IPINHOSTNAME 10409 7.98 10.24 6.70 48 XMSexyCombo_05 10389 6.25 10.22 4.00 49 XM_UncommonTLD01 9590 6.46 9.43 4.77 50 HTML_MIME_NO_HTML_TAG 9544 6.16 9.39 4.32 51 TR_XM_SpammyWords4 9464 6.41 9.31 4.76 52 XM_GoogleGroups 9252 5.78 9.10 3.89 53 XMLngstWrd_00 9244 5.40 9.09 3.31 54 XMLngstWrd_01 9175 5.32 9.03 3.21 55 XMLngstWrd_02 9099 5.20 8.95 3.07 56 BOTNET 9027 4.10 8.88 1.38 57 HTML_TITLE_SUBJ_DIFF 8869 4.83 8.73 2.61 58 XMLngstWrd_03 8744 4.97 8.60 2.91 59 FSL_BULK_SIG 8726 5.31 8.58 3.46 60 XMLngstWrd_04 8704 4.90 8.56 2.82 61 UPPERCASE_75_100 8682 4.76 8.54 2.61 62 BAYES_80 7695 5.81 7.57 4.81 63 TR_XM_SPAMCOP 7470 2.78 7.35 0.18 64 BAYES_60 7220 9.55 7.10 10.94 65 HTML_IMAGE_RATIO_02 7125 7.44 7.01 7.69 66 XM_Evil_Numbers_Gen 6887 8.22 6.78 9.03 67 XM_H_Long_From01 6792 5.50 6.68 4.82 68 XM_SendGrid 6512 5.59 6.41 5.13 69 UNTRUSTED_Relay 6255 3.15 6.15 1.44 70 TR_XM_PhishingBody 5721 3.71 5.63 2.62 71 LotsOfNums_01 5636 7.11 5.54 8.00 72 XMSubMetaSx_00 5500 4.43 5.41 3.87 73 XM_OfRef6 4980 2.35 4.90 0.90 74 T_XMDrugObfuBody_14 4824 2.87 4.75 1.81 75 XMStrtUSub 4820 5.87 4.74 6.51 76 BAYES_95 4717 3.66 4.64 3.10 77 TooManyTo_001 4710 5.85 4.63 6.54 78 RCVD_IN_VALIDITY_SAFE 4705 6.28 4.63 7.21 79 RCVD_IN_MSPIKE_BL 4429 2.13 4.36 0.86 80 TR_XM_MSPIKECOMBO 4362 2.10 4.29 0.86 81 HTML_IMAGE_RATIO_04 4336 4.41 4.27 4.48 82 XM_B_SpammyTLD 4262 2.91 4.19 2.18 83 T_FILL_THIS_FORM_SHORT 4243 1.81 4.17 0.47 84 TR_XM_DK_SendGrid 4214 3.66 4.15 3.38 85 XM_B_Phish_Phrases 4193 3.52 4.13 3.18 86 SpammyFromTLD_02 4108 1.59 4.04 0.20 87 XMDiploma_00 4105 2.17 4.04 1.11 88 TR_XM_SpammyWords5 4100 2.60 4.03 1.78 89 XM_DIRTYINTL 3964 1.59 3.90 0.27 90 T_XMDrugObfuBody_08 3884 2.24 3.82 1.35 91 RCVD_IN_VALIDITY_CERTIFIED 3640 5.40 3.58 6.44 92 T_REMOTE_IMAGE 3500 3.22 3.44 3.09 93 XM_H_Undi_Recip 3473 1.35 3.42 0.18 94 XMNumbers 3206 4.00 3.15 4.48 95 MIME_HTML_MOSTLY 3197 3.31 3.15 3.40 96 HTML_IMAGE_RATIO_06 3187 3.88 3.14 4.31 97 TM2_M_A_HREF_HREF 3140 1.46 3.09 0.54 98 XM_SPF_SoftFail 3125 1.99 3.07 1.38 99 SpammyFromTLD_01 3103 1.42 3.05 0.49 100 TR_XM_Undi_Recip11 3098 1.12 3.05 0.03 101 XM_B_Investor 3052 1.88 3.00 1.25 102 T_XMHurry_00 2932 1.34 2.88 0.46 103 SUBJ_ALL_CAPS 2893 1.90 2.85 1.36 104 XM_B_Phish66 2876 1.63 2.83 0.96 105 USER_IN_DEF_DKIM_WL 2845 12.00 2.80 17.22 106 XM_UB50 2837 1.56 2.79 0.87 107 DKIM_INVALID 2827 2.01 2.78 1.57 108 PDS_OTHER_BAD_TLD 2784 1.13 2.74 0.21 109 RCVD_IN_MSPIKE_L3 2536 1.37 2.50 0.73 110 MONEY_NOHTML 2522 0.93 2.48 0.05 111 XMBody_17 2520 1.19 2.48 0.45 112 TR_XM_MSPIKECOMBO2 2518 1.05 2.48 0.24 113 HTML_IMAGE_RATIO_08 2489 2.36 2.45 2.31 114 XM_CamelCaseFrm001 2483 2.04 2.44 1.81 115 RCVD_IN_MSPIKE_H4 2483 4.32 2.44 5.39 116 TR_XM_SpammyWords3 2439 1.08 2.40 0.33 117 XM_DK_Undo_01 2374 1.72 2.34 1.38 118 BOTNET_NORDNS 2329 0.84 2.29 0.01 119 TR_XM_Undi_Recip5 2296 0.82 2.26 0.00 120 TR_XM_Undi_Recip2 2254 0.81 2.22 0.02 121 TR_XM_Undi_RecipCombo2 2213 0.79 2.18 0.00 122 TR_XM_FormFill 2180 0.79 2.14 0.01 123 HTML_OBFUSCATE_05_10 2164 0.91 2.13 0.22 124 T_TooManySym_01 2164 7.21 2.13 10.10 125 UNDISC_MONEY 2086 0.74 2.05 0.00 126 RCVD_IN_VALIDITY_RPBL 2086 0.75 2.05 0.02 127 HTML_TAG_BALANCE_BODY 2075 1.23 2.04 0.77 128 XM_B_Unsub2 1966 1.26 1.93 0.88 129 TM2_M_URI_OPT_OUT 1959 2.33 1.93 2.56 130 FROM_EXCESS_BASE64 1943 2.71 1.91 3.16 131 URI_NOVOWEL 1921 1.96 1.89 2.00 132 TR_XM_MaxSPIKE 1902 0.80 1.87 0.19 133 XM_B_SpammyWords4 1881 1.18 1.85 0.80 134 TR_XM_Undi_RecipCombo3 1881 0.67 1.85 0.00 135 MONEY_ATM_CARD 1874 0.67 1.84 0.00 136 TR_XM_PHPDW 1836 1.02 1.81 0.57 137 HK_RANDOM_REPLYTO 1812 0.69 1.78 0.07 138 MIME_QP_LONG_LINE 1802 2.85 1.77 3.46 139 TR_XM_PHPForged 1786 0.95 1.76 0.50 140 TR_XM_FormFill2 1762 0.95 1.73 0.50 141 XM_H_PHPOS 1753 0.93 1.72 0.48 142 RCVD_IN_IADB_LISTED 1715 2.86 1.69 3.53 143 TR_XM_NoHeaderRelay 1695 0.66 1.67 0.09 144 ALL_TRUSTED 1669 11.51 1.64 17.11 145 RELAYCOUNTRY_RU 1658 0.60 1.63 0.02 146 RCVD_IN_PSBL 1637 1.07 1.61 0.76 147 TR_XM_Undi_Recip6 1616 0.58 1.59 0.00 148 XMBrknScrpt_02 1606 0.94 1.58 0.58 149 XMBdyGiftCard01 1572 1.46 1.55 1.41 150 TR_XM_BayesRelay 1570 0.56 1.54 0.00 151 XMSexyCombo_01 1555 0.89 1.53 0.53 152 TR_Symld_Words 1514 1.46 1.49 1.44 153 HK_SCAM 1514 0.54 1.49 0.01 154 MAILING_LIST_MULTI 1509 1.91 1.48 2.16 155 TR_LOTS_OF_MONEY3 1503 0.71 1.48 0.27 156 RCVD_IN_MSPIKE_L5 1486 0.54 1.46 0.02 157 XMReplyNow 1473 0.71 1.45 0.29 158 DEAR_BENEFICIARY 1457 0.52 1.43 0.00 159 RELAYCOUNTRY_AU 1456 0.70 1.43 0.28 160 TR_XM_SB_Phish 1449 1.62 1.43 1.73 161 MPART_ALT_DIFF_COUNT 1433 1.18 1.41 1.04 162 ADVANCE_FEE_5_NEW_MONEY 1430 0.51 1.41 0.00 163 RCVD_IN_IADB_SPF 1424 2.50 1.40 3.13 164 TR_Caps_n_Bayes_99 1419 0.71 1.40 0.32 165 XMSubNoVowel 1412 0.97 1.39 0.74 166 XM_UB99 1390 0.50 1.37 0.00 167 HTML_FONT_FACE_BAD 1371 1.31 1.35 1.29 168 URI_HEX 1360 1.16 1.34 1.06 169 XM_OfRef7 1320 0.53 1.30 0.09 170 DIET_1 1312 0.77 1.29 0.47 171 RCVD_IN_IADB_SENDERID 1305 2.24 1.28 2.78 172 XMSlimDrugH 1302 0.81 1.28 0.55 173 RCVD_IN_IADB_DK 1301 2.17 1.28 2.68 174 XMStockSpam_06 1301 1.55 1.28 1.71 175 TR_Sbj_FN_Bdy 1282 0.52 1.26 0.10 176 URIBL_DBL_SPAM 1258 0.46 1.24 0.02 177 XMHTML_After_End 1239 0.79 1.22 0.55 178 FROM_SUSPICIOUS_NTLD 1237 0.46 1.22 0.03 179 URI_TRY_3LD 1226 0.68 1.21 0.37 180 MILLION_USD 1198 0.43 1.18 0.00 181 MONEY_FORM_SHORT 1177 0.42 1.16 0.00 182 XM_UB999 1141 0.41 1.12 0.00 183 XMSubPhish11 1124 1.50 1.11 1.72 184 XMGenDplmaNmb 1106 0.74 1.09 0.55 185 KHOP_HELO_FCRDNS 1096 0.97 1.08 0.91 186 XMPhish08 1083 0.50 1.07 0.17 187 SHOPIFY_IMG_NOT_RCVD_SFY 1079 0.54 1.06 0.25 188 XMClaimOffer 1076 0.47 1.06 0.13 189 XMPhish30 1074 0.93 1.06 0.85 190 XM_URI_RBL 1064 0.47 1.05 0.15 191 FORM_FRAUD_5 1059 0.38 1.04 0.00 192 RCVD_IN_IADB_VOUCHED 1045 1.91 1.03 2.40 193 BAYES_40 1042 2.81 1.03 3.82 194 URIBL_BLACK 1029 0.38 1.01 0.03 195 HTTPS_HTTP_MISMATCH 1025 0.69 1.01 0.50 196 XM_H_Long_From02 1016 1.15 1.00 1.23 197 TR_XM_Undi_Recip4 1008 0.36 0.99 0.00 198 FONT_INVIS_LONG_LINE 1003 0.39 0.99 0.06 199 T_XMDrugObfuBody_00 981 0.70 0.97 0.54 200 XM_B_DynamicLink 962 0.39 0.95 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149249 86.91 93.14 83.37 2 RELAYCOUNTRY_US 142534 79.87 80.31 79.62 3 DKIM_SIGNED 137555 82.33 92.01 76.84 4 XM_DK_Pass 136061 81.22 90.40 76.00 5 DKIM_VALID 134741 80.32 89.23 75.27 6 XM_B_Unicode 123553 71.90 76.99 69.02 7 DCC_CHECK_NEGATIVE 117758 55.92 38.57 65.78 8 DKIM_VALID_AU 114296 66.69 71.69 63.85 9 BAYES_50 101741 50.80 40.17 56.83 10 XMListUnsubscribeExists 98363 61.81 73.89 54.94 11 XM_B_Unicode3 78952 43.42 42.23 44.10 12 XM_B_SpammyWords 78610 52.15 66.65 43.91 13 RCVD_IN_MSPIKE_H2 66212 42.10 51.11 36.99 14 DCC_CHECK 61210 44.05 61.42 34.19 15 HTML_FONT_LOW_CONTRAST 55626 31.40 31.97 31.07 16 DKIM_VALID_EF 52676 30.54 32.50 29.42 17 LOC_TINY_FONT_1 48918 29.48 33.28 27.33 18 FVGT_m_MULTI_ODD 48660 30.08 35.18 27.18 19 MIME_HTML_ONLY 42598 28.27 36.16 23.79 20 T_TM2_M_HEADER_IN_MSG 41622 22.33 20.71 23.25 21 XMSubLong 40907 21.49 19.09 22.85 22 RCVD_IN_MSPIKE_WL 38788 19.48 15.62 21.67 23 XM_B_SpammyWords2 34345 25.48 36.56 19.18 24 T_KAM_HTML_FONT_INVALID 33020 21.26 26.21 18.44 25 USER_IN_DEF_DKIM_WL 30831 12.00 2.80 17.22 26 ALL_TRUSTED 30636 11.51 1.64 17.11 27 XM_Multi_Part_URI 26685 15.44 16.37 14.91 28 RCVD_IN_MSPIKE_H3 26670 14.19 12.94 14.90 29 XM_DKIMWhitelistDomains 23317 8.33 0.05 13.02 30 XM_Body_Dirty_Words 20941 15.47 22.11 11.70 31 BAYES_60 19580 9.55 7.10 10.94 32 T_TooManySym_01 18082 7.21 2.13 10.10 33 XM_B_Unsub 17517 11.16 13.59 9.78 34 XM_Evil_Numbers_Gen 16172 8.22 6.78 9.03 35 XM_DK_Undo_02 15810 22.65 47.00 8.83 36 MPART_ALT_DIFF 14985 9.99 12.85 8.37 37 BAYES_00 14716 5.39 0.42 8.22 38 TR_XM_BayesUnsub 14439 10.00 13.41 8.07 39 LotsOfNums_01 14314 7.11 5.54 8.00 40 UNPARSEABLE_RELAY 14242 9.42 12.00 7.96 41 BAYES_99 14114 18.75 37.89 7.88 42 HTML_IMAGE_RATIO_02 13763 7.44 7.01 7.69 43 LOTS_OF_MONEY 12956 8.67 11.19 7.24 44 RCVD_IN_VALIDITY_SAFE 12914 6.28 4.63 7.21 45 BOTNET_IPINHOSTNAME 11998 7.98 10.24 6.70 46 BAYES_999 11827 15.26 30.51 6.61 47 TooManyTo_001 11713 5.85 4.63 6.54 48 XMStrtUSub 11657 5.87 4.74 6.51 49 RCVD_IN_VALIDITY_CERTIFIED 11524 5.40 3.58 6.44 50 TR_XM_UnparsRelay 11473 8.37 11.84 6.41 51 TR_XM_DKIM_Undo 10993 17.44 37.35 6.14 52 MIME_HTML_ONLY_MULTI 10550 7.74 10.98 5.89 53 TR_XM_DK_Bayes 10541 3.88 0.34 5.89 54 TR_XM_DK_Bayes1 10422 3.84 0.34 5.82 55 T_TooManySym_02 10396 3.92 0.61 5.81 56 IN_ZIMBRA_NJ_WHITELIST 10200 3.66 0.08 5.70 57 RCVD_IN_MSPIKE_H4 9642 4.32 2.44 5.39 58 TR_XM_DK_Bayes2 9561 3.50 0.25 5.34 59 XM_SendGrid 9179 5.59 6.41 5.13 60 XM_H_Long_From01 8631 5.50 6.68 4.82 61 BAYES_80 8606 5.81 7.57 4.81 62 XM_UncommonTLD01 8540 6.46 9.43 4.77 63 TR_XM_SpammyWords4 8515 6.41 9.31 4.76 64 XMNumbers 8028 4.00 3.15 4.48 65 HTML_IMAGE_RATIO_04 8028 4.41 4.27 4.48 66 RELAYCOUNTRY_META 7988 11.56 24.07 4.46 67 XM_B_SpammyWords3 7931 7.03 11.62 4.43 68 HTML_MIME_NO_HTML_TAG 7734 6.16 9.39 4.32 69 HTML_IMAGE_RATIO_06 7716 3.88 3.14 4.31 70 XMSexyCombo_05 7155 6.25 10.22 4.00 71 TM2_M_VERY_LONG_WORD 7087 6.65 11.38 3.96 72 XM_GoogleGroups 6966 5.78 9.10 3.89 73 XMSubMetaSx_00 6934 4.43 5.41 3.87 74 BAYES_40 6832 2.81 1.03 3.82 75 INVALID_MSGID 6806 2.46 0.09 3.80 76 RCVD_IN_IADB_LISTED 6323 2.86 1.69 3.53 77 MIME_QP_LONG_LINE 6193 2.85 1.77 3.46 78 FSL_BULK_SIG 6186 5.31 8.58 3.46 79 MIME_HTML_MOSTLY 6088 3.31 3.15 3.40 80 TR_XM_DK_SendGrid 6045 3.66 4.15 3.38 81 XMLngstWrd_00 5923 5.40 9.09 3.31 82 TO_MALFORMED 5914 2.12 0.04 3.30 83 TVD_RCVD_IP 5849 2.16 0.20 3.27 84 XMLngstWrd_01 5754 5.32 9.03 3.21 85 XM_B_Phish_Phrases 5688 3.52 4.13 3.18 86 FROM_EXCESS_BASE64 5653 2.71 1.91 3.16 87 RCVD_IN_IADB_SPF 5597 2.50 1.40 3.13 88 BAYES_95 5543 3.66 4.64 3.10 89 T_REMOTE_IMAGE 5528 3.22 3.44 3.09 90 XMLngstWrd_02 5494 5.20 8.95 3.07 91 XMLngstWrd_03 5212 4.97 8.60 2.91 92 XMLngstWrd_04 5053 4.90 8.56 2.82 93 RCVD_IN_IADB_SENDERID 4970 2.24 1.28 2.78 94 TR_DCC_Bayes_99 4810 10.68 24.74 2.69 95 BAYES_20 4808 1.98 0.75 2.69 96 RCVD_IN_IADB_DK 4794 2.17 1.28 2.68 97 TR_XM_PhishingBody 4692 3.71 5.63 2.62 98 XM_H_Trusted_IP 4687 1.67 0.00 2.62 99 HTML_TITLE_SUBJ_DIFF 4675 4.83 8.73 2.61 100 UPPERCASE_75_100 4669 4.76 8.54 2.61 101 MSGID_NOFQDN1 4644 1.66 0.02 2.59 102 TM2_M_URI_OPT_OUT 4584 2.33 1.93 2.56 103 BOUNCE_MESSAGE 4517 1.82 0.58 2.52 104 ANY_BOUNCE_MESSAGE 4517 1.82 0.58 2.52 105 RCVD_IN_IADB_VOUCHED 4303 1.91 1.03 2.40 106 HTML_IMAGE_RATIO_08 4128 2.36 2.45 2.31 107 XM_PDF 4059 1.56 0.31 2.27 108 XMBSHREFv2 3977 1.49 0.21 2.22 109 XM_B_SpammyTLD 3900 2.91 4.19 2.18 110 IN_HORDE_ADDRESS_BOOK 3866 1.40 0.05 2.16 111 MAILING_LIST_MULTI 3859 1.91 1.48 2.16 112 TR_XM_SpammyWords2 3846 6.36 13.77 2.15 113 TR_XM_SpammyRelay 3586 6.57 14.60 2.00 114 URI_NOVOWEL 3581 1.96 1.89 2.00 115 XM_CamelCaseFrm001 3248 2.04 2.44 1.81 116 T_XMDrugObfuBody_14 3244 2.87 4.75 1.81 117 TR_XM_SpammyWords5 3191 2.60 4.03 1.78 118 TR_XM_SB_Phish 3104 1.62 1.43 1.73 119 BAYES_05 3081 1.25 0.42 1.72 120 XMSubPhish11 3079 1.50 1.11 1.72 121 TVD_SPACE_RATIO 3068 1.12 0.07 1.71 122 XMStockSpam_06 3060 1.55 1.28 1.71 123 RCVD_IN_IADB_OPTIN 3052 1.32 0.65 1.70 124 TR_XM_Base64_M1 2976 1.39 0.90 1.66 125 XM_ProductURIs 2968 1.32 0.73 1.66 126 XMGappySubj_01 2907 1.06 0.07 1.62 127 DKIM_INVALID 2814 2.01 2.78 1.57 128 RELAYCOUNTRY_CA 2774 5.37 12.11 1.55 129 RCVD_IN_RP_SAFE 2612 1.26 0.91 1.46 130 TR_Symld_Words 2583 1.46 1.49 1.44 131 UNTRUSTED_Relay 2574 3.15 6.15 1.44 132 XMBdyGiftCard01 2524 1.46 1.55 1.41 133 BOTNET 2478 4.10 8.88 1.38 134 RCVD_IN_MSPIKE_H5 2476 0.97 0.24 1.38 135 XM_DK_Undo_01 2466 1.72 2.34 1.38 136 XM_SPF_SoftFail 2465 1.99 3.07 1.38 137 SUBJ_ALL_CAPS 2430 1.90 2.85 1.36 138 T_XMDrugObfuBody_08 2412 2.24 3.82 1.35 139 RCVD_IN_RP_CERTIFIED 2335 1.08 0.68 1.30 140 HTML_FONT_FACE_BAD 2311 1.31 1.35 1.29 141 XMBody_95 2238 0.83 0.09 1.25 142 XM_B_Investor 2234 1.88 3.00 1.25 143 TooManyTo_002 2208 1.03 0.67 1.23 144 XM_H_Long_From02 2201 1.15 1.00 1.23 145 T_TooManySym_03 2099 0.83 0.24 1.17 146 XMDiploma_00 1996 2.17 4.04 1.11 147 XM_B_COPY_HTML 1980 0.95 0.68 1.11 148 URI_HEX 1906 1.16 1.34 1.06 149 MPART_ALT_DIFF_COUNT 1869 1.18 1.41 1.04 150 TooManyTo_003 1729 0.84 0.62 0.97 151 XM_B_Phish66 1711 1.63 2.83 0.96 152 XMSubMetaSxObfu_02 1708 0.84 0.64 0.95 153 XMHTMLBadTable_001 1645 0.84 0.70 0.92 154 KHOP_HELO_FCRDNS 1627 0.97 1.08 0.91 155 XM_OfRef6 1608 2.35 4.90 0.90 156 XM_B_Unsub2 1567 1.26 1.93 0.88 157 DKIM_ADSP_CUSTOM_MED 1567 0.87 0.87 0.88 158 XM_UB50 1549 1.56 2.79 0.87 159 XMSubMetaI_00 1549 0.84 0.79 0.87 160 RCVD_IN_MSPIKE_BL 1548 2.13 4.36 0.86 161 TR_XM_MSPIKECOMBO 1544 2.10 4.29 0.86 162 XMPhish30 1527 0.93 1.06 0.85 163 TR_MetaPhish_Combo_01 1463 0.83 0.86 0.82 164 XM_B_SpammyWords4 1440 1.18 1.85 0.80 165 HTML_TAG_BALANCE_BODY 1380 1.23 2.04 0.77 166 RCVD_IN_PSBL 1356 1.07 1.61 0.76 167 XMSubNoVowel 1321 0.97 1.39 0.74 168 TooManyTo_004 1313 0.68 0.59 0.73 169 RCVD_IN_MSPIKE_L3 1310 1.37 2.50 0.73 170 DKIM_ADSP_NXDOMAIN 1309 0.66 0.53 0.73 171 USER_IN_WHITELIST 1171 0.42 0.00 0.65 172 USER_IN_WELCOMELIST 1171 0.42 0.00 0.65 173 PLING_QUERY 1129 0.63 0.64 0.63 174 RDNS_DYNAMIC 1124 0.56 0.44 0.63 175 TooManyTo_005 1118 0.58 0.50 0.62 176 NO_DNS_FOR_FROM 1098 0.69 0.82 0.61 177 XM_H_PHPMailer 1087 0.72 0.93 0.61 178 XMNoVowels 1082 0.56 0.47 0.60 179 XM_S_SubURI 1056 0.38 0.01 0.59 180 HTML_IMAGE_ONLY_20 1052 0.60 0.63 0.59 181 XMBrknScrpt_02 1032 0.94 1.58 0.58 182 XMPhish14 1031 0.56 0.54 0.58 183 XM_B_REG_HTML 1024 0.58 0.60 0.57 184 TR_XM_PHPDW 1020 1.02 1.81 0.57 185 XMHTML_After_End 985 0.79 1.22 0.55 186 XMGenDplmaNmb 984 0.74 1.09 0.55 187 XMSlimDrugH 984 0.81 1.28 0.55 188 XM_D_tchamptons_WL 979 0.35 0.01 0.55 189 T_XMDrugObfuBody_00 970 0.70 0.97 0.54 190 TM2_M_A_HREF_HREF 968 1.46 3.09 0.54 191 XMSexyCombo_01 955 0.89 1.53 0.53 192 TR_XM_MaxWHORU 905 0.62 0.81 0.51 193 T_TooManySym_04 903 0.39 0.19 0.50 194 HTTPS_HTTP_MISMATCH 900 0.69 1.01 0.50 195 TR_XM_FormFill2 898 0.95 1.73 0.50 196 TR_XM_PHPForged 892 0.95 1.76 0.50 197 XM_ShortIntro_01 882 0.43 0.32 0.49 198 SpammyFromTLD_01 873 1.42 3.05 0.49 199 XM_H_PHPOS 864 0.93 1.72 0.48 200 FORGED_GMAIL_RCVD 863 0.56 0.69 0.48 ----------------------------------------------------------------------