Email: 280420 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.24 sec Spam: 98184 Autolearn: 0 AvgScore: 14.34 AvgScanTime: 1.37 sec Ham: 182236 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 1.18 sec Time Spent Running SA: 96.93 hours Time Spent Processing Spam: 37.24 hours Time Spent Processing Ham: 59.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92286 88.28 93.99 85.19 2 DKIM_SIGNED 86524 79.77 88.12 75.26 3 XM_DK_Pass 85055 78.62 86.63 74.30 4 DKIM_VALID 84581 78.15 86.15 73.85 5 XM_B_Unicode 80047 74.76 81.53 71.11 6 RELAYCOUNTRY_US 77593 78.91 79.03 78.85 7 DCC_CHECK 70450 50.44 71.75 38.95 8 XM_B_SpammyWords 69034 53.26 70.31 44.08 9 XMListUnsubscribeExists 67704 58.73 68.96 53.22 10 DKIM_VALID_AU 65177 63.54 66.38 62.00 11 RCVD_IN_MSPIKE_H2 48381 41.84 49.28 37.84 12 XM_DK_Undo_02 46692 22.69 47.56 9.29 13 XM_B_Unicode3 44010 45.14 44.82 45.31 14 XM_B_SpammyWords2 40228 26.77 40.97 19.12 15 BAYES_99 39178 19.50 39.90 8.51 16 TR_XM_DKIM_Undo 37047 17.35 37.73 6.37 17 LOC_TINY_FONT_1 36495 31.03 37.17 27.72 18 BAYES_50 34764 48.98 35.41 56.29 19 HTML_FONT_LOW_CONTRAST 34118 32.47 34.75 31.25 20 BAYES_999 31183 15.74 31.76 7.10 21 FVGT_m_MULTI_ODD 30736 28.18 31.30 26.50 22 DKIM_VALID_EF 30627 30.63 31.19 30.33 23 MIME_HTML_ONLY 30514 26.29 31.08 23.71 24 DCC_CHECK_NEGATIVE 27712 49.53 28.22 61.01 25 T_KAM_HTML_FONT_INVALID 27543 21.63 28.05 18.18 26 TR_DCC_Bayes_99 27306 12.01 27.81 3.50 27 XM_Body_Dirty_Words 21765 16.50 22.17 13.45 28 RELAYCOUNTRY_META 21290 9.75 21.68 3.31 29 T_TM2_M_HEADER_IN_MSG 18615 21.30 18.96 22.57 30 XMSubLong 18610 21.16 18.95 22.35 31 XM_Multi_Part_URI 17101 15.48 17.42 14.43 32 XM_B_Unsub 16814 12.07 17.12 9.35 33 TR_XM_BayesUnsub 16575 10.89 16.88 7.66 34 TR_XM_SpammyRelay 14400 6.04 14.67 1.40 35 TR_XM_SpammyWords2 14350 6.59 14.62 2.26 36 UNPARSEABLE_RELAY 13822 10.34 14.08 8.33 37 TR_XM_UnparsRelay 13581 9.14 13.83 6.61 38 XM_B_SpammyWords3 13471 7.96 13.72 4.86 39 BOTNET_IPINHOSTNAME 13355 9.17 13.60 6.79 40 LOTS_OF_MONEY 12330 9.20 12.56 7.39 41 RCVD_IN_MSPIKE_WL 11821 16.16 12.04 18.38 42 FSL_BULK_SIG 11683 6.81 11.90 4.07 43 BOTNET 11251 5.03 11.46 1.57 44 RCVD_IN_BL_SPAMCOP_NET 11104 4.29 11.31 0.51 45 RELAYCOUNTRY_CA 10790 4.59 10.99 1.14 46 TR_XM_SpammyWords4 10542 6.72 10.74 4.56 47 XMSexyCombo_05 9940 6.27 10.12 4.19 48 BAYES_80 8562 6.29 8.72 4.99 49 RCVD_IN_MSPIKE_H3 8551 10.83 8.71 11.98 50 UNTRUSTED_Relay 8214 3.93 8.37 1.55 51 XM_Evil_Numbers_Gen 8187 8.80 8.34 9.05 52 HTML_IMAGE_RATIO_02 7852 7.62 8.00 7.42 53 XM_SendGrid 7578 6.28 7.72 5.51 54 XM_UncommonTLD01 7549 5.64 7.69 4.53 55 BAYES_60 7451 9.85 7.59 11.06 56 TR_XM_SPAMCOP 6874 2.61 7.00 0.24 57 XM_H_Long_From01 5949 5.22 6.06 4.77 58 TR_XM_PhishingBody 5806 3.55 5.91 2.27 59 BAYES_95 5489 4.03 5.59 3.19 60 TooManyTo_001 5437 5.90 5.54 6.09 61 RCVD_IN_VALIDITY_SAFE 5406 6.58 5.51 7.16 62 MPART_ALT_DIFF 5316 5.29 5.41 5.23 63 LotsOfNums_01 5273 7.20 5.37 8.19 64 T_XMDrugObfuBody_14 5254 3.06 5.35 1.83 65 XMStrtUSub 5200 6.42 5.30 7.02 66 TR_XM_DK_SendGrid 5186 4.20 5.28 3.62 67 XM_DIRTYINTL 5179 2.00 5.27 0.24 68 HTML_IMAGE_RATIO_04 5083 5.52 5.18 5.70 69 XM_B_Phish_Phrases 5057 4.14 5.15 3.60 70 XM_OfRef6 4935 2.37 5.03 0.93 71 XM_SPF_SoftFail 4639 2.76 4.72 1.70 72 RCVD_IN_MSPIKE_BL 4590 2.16 4.67 0.80 73 T_REMOTE_IMAGE 4463 3.84 4.55 3.46 74 XMSubMetaSx_00 4402 4.05 4.48 3.82 75 TR_XM_MSPIKECOMBO 4371 2.08 4.45 0.80 76 TM2_M_VERY_LONG_WORD 4264 2.67 4.34 1.77 77 T_XMDrugObfuBody_08 3884 2.17 3.96 1.21 78 TR_XM_SpammyWords5 3879 2.20 3.95 1.26 79 XMBody_17 3847 1.74 3.92 0.57 80 XMDiploma_00 3773 2.20 3.84 1.31 81 XM_B_Investor 3771 2.10 3.84 1.17 82 RCVD_IN_VALIDITY_CERTIFIED 3763 5.48 3.83 6.37 83 XM_CamelCaseFrm001 3757 2.58 3.83 1.91 84 XM_UB50 3728 1.90 3.80 0.87 85 XM_B_SpammyTLD 3629 2.54 3.70 1.91 86 RCVD_IN_VALIDITY_RPBL 3627 1.34 3.69 0.07 87 MIME_HTML_MOSTLY 3385 3.17 3.45 3.02 88 HTML_IMAGE_RATIO_06 3356 4.08 3.42 4.44 89 MIME_HTML_ONLY_MULTI 3324 3.45 3.39 3.49 90 BOTNET_NORDNS 3300 1.19 3.36 0.01 91 SpammyFromTLD_01 3068 1.39 3.12 0.45 92 XMNumbers 3055 3.78 3.11 4.14 93 USER_IN_DEF_DKIM_WL 3036 12.76 3.09 17.97 94 HK_RANDOM_REPLYTO 3001 1.12 3.06 0.07 95 T_FILL_THIS_FORM_SHORT 2962 1.36 3.02 0.47 96 TR_XM_MSPIKECOMBO2 2903 1.21 2.96 0.26 97 RCVD_IN_MSPIKE_H4 2903 4.49 2.96 5.31 98 PDS_OTHER_BAD_TLD 2760 1.09 2.81 0.16 99 XM_B_Phish66 2714 1.59 2.76 0.95 100 T_TooManySym_01 2683 6.37 2.73 8.33 101 RCVD_IN_MSPIKE_L3 2630 1.30 2.68 0.55 102 SpammyFromTLD_02 2463 0.99 2.51 0.17 103 FROM_EXCESS_BASE64 2362 3.07 2.41 3.42 104 HTML_IMAGE_RATIO_08 2359 2.37 2.40 2.35 105 TR_XM_SpammyWords3 2346 1.06 2.39 0.35 106 T_XMHurry_00 2282 1.16 2.32 0.54 107 TM2_M_URI_OPT_OUT 2274 2.57 2.32 2.71 108 TM2_M_A_HREF_HREF 2268 1.08 2.31 0.41 109 HTML_TAG_BALANCE_BODY 2164 1.21 2.20 0.68 110 HTML_MIME_NO_HTML_TAG 2113 1.90 2.15 1.76 111 XMBdyGiftCard01 2105 1.62 2.14 1.33 112 SUBJ_ALL_CAPS 2104 1.39 2.14 0.98 113 TR_XM_FormFill 2098 0.76 2.14 0.01 114 URI_NOVOWEL 2086 2.18 2.12 2.21 115 XM_B_SpammyWords4 2078 1.23 2.12 0.75 116 TR_LOTS_OF_MONEY3 2015 0.94 2.05 0.35 117 TR_XM_MaxSPIKE 2001 0.81 2.04 0.15 118 XMStockSpam_06 1987 1.88 2.02 1.80 119 DKIM_INVALID 1943 1.61 1.98 1.42 120 XM_B_Unsub2 1914 1.29 1.95 0.93 121 MIME_QP_LONG_LINE 1913 2.92 1.95 3.44 122 TR_XM_PHPDW 1886 0.85 1.92 0.28 123 XMGenDplmaNmb 1879 1.10 1.91 0.67 124 XMBrknScrpt_02 1878 1.52 1.91 1.31 125 XM_DK_Undo_01 1844 1.53 1.88 1.34 126 TR_XM_PHPForged 1823 0.80 1.86 0.23 127 TR_XM_FormFill2 1795 0.78 1.83 0.22 128 XM_H_PHPOS 1774 0.76 1.81 0.20 129 TR_XM_NoHeaderRelay 1687 0.66 1.72 0.09 130 XM_Body_Dirty_Words_01 1687 0.77 1.72 0.26 131 XM_UB99 1667 0.59 1.70 0.00 132 KHOP_HELO_FCRDNS 1648 0.96 1.68 0.58 133 TR_Symld_Words 1644 1.99 1.67 2.17 134 URI_TRY_3LD 1642 0.95 1.67 0.56 135 XM_B_Crypto 1641 0.63 1.67 0.07 136 PLING_QUERY 1613 0.91 1.64 0.51 137 TR_XM_SB_Phish 1609 1.59 1.64 1.57 138 TR_XM_BayesRelay 1586 0.57 1.62 0.00 139 XMReplyNow 1564 0.80 1.59 0.37 140 XMSexyCombo_01 1551 0.82 1.58 0.42 141 URIBL_DBL_SPAM 1542 0.55 1.57 0.01 142 HTML_OBFUSCATE_05_10 1531 1.67 1.56 1.73 143 RCVD_IN_IADB_LISTED 1511 2.84 1.54 3.54 144 RELAYCOUNTRY_RU 1494 0.57 1.52 0.06 145 XMSubPhish11 1468 1.54 1.50 1.56 146 MPART_ALT_DIFF_COUNT 1442 1.16 1.47 0.99 147 XMHTML_After_End 1421 0.91 1.45 0.62 148 URI_HEX 1412 1.25 1.44 1.15 149 ALL_TRUSTED 1395 12.32 1.42 18.19 150 DIET_1 1376 0.73 1.40 0.37 151 FROM_SUSPICIOUS_NTLD 1372 0.50 1.40 0.02 152 TR_XM_Base64_M1 1354 1.34 1.38 1.31 153 MAILING_LIST_MULTI 1335 1.91 1.36 2.21 154 XM_UB60 1309 0.55 1.33 0.12 155 XM_UB999 1305 0.47 1.33 0.00 156 RCVD_IN_PSBL 1305 1.18 1.33 1.10 157 FROM_SUSPICIOUS_NTLD_FP 1304 0.47 1.33 0.01 158 XMLngstWrd_00 1299 1.09 1.32 0.96 159 TR_XM_Crypto2 1291 0.47 1.31 0.02 160 URIBL_BLACK 1285 0.47 1.31 0.02 161 XMLngstWrd_01 1265 1.00 1.29 0.85 162 RCVD_IN_IADB_SPF 1265 2.48 1.29 3.12 163 XM_URI_RBL 1258 0.51 1.28 0.10 164 T_STY_INVIS_DIRECT 1257 0.63 1.28 0.27 165 XM_B_DNDMA 1250 0.76 1.27 0.48 166 XMPhish30 1250 0.91 1.27 0.72 167 XM_GoogleGroups 1246 1.44 1.27 1.54 168 RCVD_IN_RP_SAFE 1236 1.34 1.26 1.38 169 MONEY_NOHTML 1214 0.47 1.24 0.06 170 FONT_INVIS_LONG_LINE 1212 0.48 1.23 0.07 171 XMLngstWrd_02 1193 0.88 1.22 0.70 172 RCVD_IN_MSPIKE_L5 1185 0.43 1.21 0.01 173 XMClaimOffer 1167 0.49 1.19 0.11 174 T_XMDrugObfuBody_00 1163 0.81 1.18 0.61 175 XMPhish08 1155 0.58 1.18 0.26 176 RCVD_IN_IADB_SENDERID 1145 2.22 1.17 2.79 177 RCVD_IN_IADB_DK 1135 2.15 1.16 2.68 178 XMSubNoVowel 1109 1.10 1.13 1.08 179 XMHTMLBadTable_001 1101 0.89 1.12 0.76 180 HTML_FONT_TINY_NORDNS 1090 0.44 1.11 0.07 181 TR_XM_RelayPhish 1084 0.41 1.10 0.03 182 BAYES_40 1064 2.76 1.08 3.67 183 DKIM_ADSP_CUSTOM_MED 1046 0.91 1.07 0.83 184 SHOPIFY_IMG_NOT_RCVD_SFY 1045 0.50 1.06 0.20 185 RELAYCOUNTRY_AU 1031 0.50 1.05 0.20 186 XMSubMetaI_00 1016 0.95 1.03 0.90 187 XM_OfRef7 994 0.38 1.01 0.04 188 XM_H_Undi_Recip 989 0.49 1.01 0.21 189 RCVD_IN_IADB_VOUCHED 976 1.93 0.99 2.44 190 RELAYCOUNTRY_CN 976 0.41 0.99 0.09 191 XM_H_PHPMailer 975 0.69 0.99 0.52 192 BITCOIN_YOUR_INFO 948 0.35 0.97 0.01 193 PDS_BTC_ID 948 0.35 0.97 0.03 194 FORGED_GMAIL_RCVD 945 0.66 0.96 0.50 195 GAPPY_SUBJECT 943 0.51 0.96 0.26 196 LongTLD 941 0.41 0.96 0.11 197 FILL_THIS_FORM 934 0.56 0.95 0.35 198 XM_ProductURIs 931 0.79 0.95 0.71 199 SUBJ_DOLLARS 928 0.55 0.95 0.33 200 XM_H_Long_From02 891 1.13 0.91 1.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155255 88.28 93.99 85.19 2 RELAYCOUNTRY_US 143700 78.91 79.03 78.85 3 DKIM_SIGNED 137156 79.77 88.12 75.26 4 XM_DK_Pass 135403 78.62 86.63 74.30 5 DKIM_VALID 134573 78.15 86.15 73.85 6 XM_B_Unicode 129594 74.76 81.53 71.11 7 DKIM_VALID_AU 112992 63.54 66.38 62.00 8 DCC_CHECK_NEGATIVE 111187 49.53 28.22 61.01 9 BAYES_50 102578 48.98 35.41 56.29 10 XMListUnsubscribeExists 96990 58.73 68.96 53.22 11 XM_B_Unicode3 82568 45.14 44.82 45.31 12 XM_B_SpammyWords 80331 53.26 70.31 44.08 13 DCC_CHECK 70983 50.44 71.75 38.95 14 RCVD_IN_MSPIKE_H2 68954 41.84 49.28 37.84 15 HTML_FONT_LOW_CONTRAST 56943 32.47 34.75 31.25 16 DKIM_VALID_EF 55264 30.63 31.19 30.33 17 LOC_TINY_FONT_1 50511 31.03 37.17 27.72 18 FVGT_m_MULTI_ODD 48293 28.18 31.30 26.50 19 MIME_HTML_ONLY 43205 26.29 31.08 23.71 20 T_TM2_M_HEADER_IN_MSG 41124 21.30 18.96 22.57 21 XMSubLong 40735 21.16 18.95 22.35 22 XM_B_SpammyWords2 34837 26.77 40.97 19.12 23 RCVD_IN_MSPIKE_WL 33504 16.16 12.04 18.38 24 ALL_TRUSTED 33151 12.32 1.42 18.19 25 T_KAM_HTML_FONT_INVALID 33125 21.63 28.05 18.18 26 USER_IN_DEF_DKIM_WL 32749 12.76 3.09 17.97 27 XM_Multi_Part_URI 26303 15.48 17.42 14.43 28 XM_DKIMWhitelistDomains 25958 9.27 0.04 14.24 29 XM_Body_Dirty_Words 24510 16.50 22.17 13.45 30 RCVD_IN_MSPIKE_H3 21827 10.83 8.71 11.98 31 BAYES_60 20160 9.85 7.59 11.06 32 XM_B_Unsub 17037 12.07 17.12 9.35 33 XM_DK_Undo_02 16934 22.69 47.56 9.29 34 XM_Evil_Numbers_Gen 16499 8.80 8.34 9.05 35 BAYES_99 15513 19.50 39.90 8.51 36 UNPARSEABLE_RELAY 15187 10.34 14.08 8.33 37 T_TooManySym_01 15182 6.37 2.73 8.33 38 LotsOfNums_01 14920 7.20 5.37 8.19 39 BAYES_00 14445 5.27 0.34 7.93 40 TR_XM_BayesUnsub 13956 10.89 16.88 7.66 41 HTML_IMAGE_RATIO_02 13529 7.62 8.00 7.42 42 LOTS_OF_MONEY 13464 9.20 12.56 7.39 43 RCVD_IN_VALIDITY_SAFE 13052 6.58 5.51 7.16 44 BAYES_999 12943 15.74 31.76 7.10 45 XMStrtUSub 12796 6.42 5.30 7.02 46 BOTNET_IPINHOSTNAME 12372 9.17 13.60 6.79 47 TR_XM_UnparsRelay 12042 9.14 13.83 6.61 48 TR_XM_DKIM_Undo 11612 17.35 37.73 6.37 49 RCVD_IN_VALIDITY_CERTIFIED 11611 5.48 3.83 6.37 50 TooManyTo_001 11094 5.90 5.54 6.09 51 TR_XM_DK_Bayes 10630 3.87 0.23 5.83 52 TR_XM_DK_Bayes1 10553 3.84 0.23 5.79 53 HTML_IMAGE_RATIO_04 10390 5.52 5.18 5.70 54 IN_ZIMBRA_NJ_WHITELIST 10204 3.67 0.09 5.60 55 XM_SendGrid 10044 6.28 7.72 5.51 56 RCVD_IN_MSPIKE_H4 9676 4.49 2.96 5.31 57 TR_XM_DK_Bayes2 9675 3.52 0.21 5.31 58 MPART_ALT_DIFF 9532 5.29 5.41 5.23 59 BAYES_80 9087 6.29 8.72 4.99 60 XM_B_SpammyWords3 8850 7.96 13.72 4.86 61 T_TooManySym_02 8807 3.35 0.59 4.83 62 XM_H_Long_From01 8692 5.22 6.06 4.77 63 TR_XM_SpammyWords4 8305 6.72 10.74 4.56 64 XM_UncommonTLD01 8263 5.64 7.69 4.53 65 HTML_IMAGE_RATIO_06 8083 4.08 3.42 4.44 66 XMSexyCombo_05 7643 6.27 10.12 4.19 67 XMNumbers 7540 3.78 3.11 4.14 68 FSL_BULK_SIG 7423 6.81 11.90 4.07 69 INVALID_MSGID 7007 2.56 0.19 3.85 70 XMSubMetaSx_00 6960 4.05 4.48 3.82 71 BAYES_40 6680 2.76 1.08 3.67 72 TR_XM_DK_SendGrid 6602 4.20 5.28 3.62 73 XM_B_Phish_Phrases 6561 4.14 5.15 3.60 74 RCVD_IN_IADB_LISTED 6456 2.84 1.54 3.54 75 TR_DCC_Bayes_99 6384 12.01 27.81 3.50 76 MIME_HTML_ONLY_MULTI 6358 3.45 3.39 3.49 77 MSGID_NOFQDN1 6355 2.30 0.09 3.49 78 T_REMOTE_IMAGE 6300 3.84 4.55 3.46 79 MIME_QP_LONG_LINE 6267 2.92 1.95 3.44 80 FROM_EXCESS_BASE64 6233 3.07 2.41 3.42 81 RELAYCOUNTRY_META 6038 9.75 21.68 3.31 82 TO_MALFORMED 6019 2.15 0.02 3.30 83 BAYES_95 5818 4.03 5.59 3.19 84 RCVD_IN_IADB_SPF 5687 2.48 1.29 3.12 85 XM_H_Trusted_IP 5574 1.99 0.00 3.06 86 MIME_HTML_MOSTLY 5502 3.17 3.45 3.02 87 TVD_RCVD_IP 5367 2.08 0.47 2.95 88 TO_NO_BRKTS_HTML_ONLY 5101 1.87 0.15 2.80 89 RCVD_IN_IADB_SENDERID 5077 2.22 1.17 2.79 90 BAYES_20 5011 2.09 0.88 2.75 91 TM2_M_URI_OPT_OUT 4939 2.57 2.32 2.71 92 RCVD_IN_IADB_DK 4893 2.15 1.16 2.68 93 RCVD_IN_IADB_VOUCHED 4438 1.93 0.99 2.44 94 HTML_IMAGE_RATIO_08 4285 2.37 2.40 2.35 95 TR_XM_PhishingBody 4144 3.55 5.91 2.27 96 TR_XM_SpammyWords2 4126 6.59 14.62 2.26 97 MAILING_LIST_MULTI 4032 1.91 1.36 2.21 98 URI_NOVOWEL 4029 2.18 2.12 2.21 99 XMBSHREFv2 4008 1.50 0.20 2.20 100 TR_Symld_Words 3948 1.99 1.67 2.17 101 XM_PDF 3902 1.52 0.36 2.14 102 IN_HORDE_ADDRESS_BOOK 3799 1.38 0.07 2.08 103 ANY_BOUNCE_MESSAGE 3573 1.47 0.56 1.96 104 BOUNCE_MESSAGE 3573 1.47 0.56 1.96 105 XM_B_SpammyTLD 3487 2.54 3.70 1.91 106 XM_CamelCaseFrm001 3476 2.58 3.83 1.91 107 T_XMDrugObfuBody_14 3339 3.06 5.35 1.83 108 XMStockSpam_06 3287 1.88 2.02 1.80 109 TM2_M_VERY_LONG_WORD 3230 2.67 4.34 1.77 110 HTML_MIME_NO_HTML_TAG 3212 1.90 2.15 1.76 111 HTML_OBFUSCATE_05_10 3152 1.67 1.56 1.73 112 XM_SPF_SoftFail 3105 2.76 4.72 1.70 113 RCVD_IN_IADB_OPTIN 3104 1.34 0.66 1.70 114 XMBody_95 3093 1.13 0.09 1.70 115 XMGappySubj_01 3009 1.38 0.87 1.65 116 BAYES_05 2944 1.22 0.49 1.62 117 TR_XM_SB_Phish 2858 1.59 1.64 1.57 118 BOTNET 2857 5.03 11.46 1.57 119 XMSubPhish11 2845 1.54 1.50 1.56 120 UNTRUSTED_Relay 2816 3.93 8.37 1.55 121 XM_GoogleGroups 2798 1.44 1.27 1.54 122 DKIM_INVALID 2583 1.61 1.98 1.42 123 TR_XM_SpammyRelay 2549 6.04 14.67 1.40 124 HTML_FONT_FACE_BAD 2530 1.22 0.90 1.39 125 RCVD_IN_RP_SAFE 2514 1.34 1.26 1.38 126 XM_DK_Undo_01 2451 1.53 1.88 1.34 127 XMBdyGiftCard01 2424 1.62 2.14 1.33 128 TooManyTo_002 2395 1.02 0.47 1.31 129 TR_XM_Base64_M1 2394 1.34 1.38 1.31 130 XMBrknScrpt_02 2394 1.52 1.91 1.31 131 XMDiploma_00 2392 2.20 3.84 1.31 132 TR_XM_SpammyWords5 2300 2.20 3.95 1.26 133 XM_H_Long_From02 2287 1.13 0.91 1.25 134 RCVD_IN_RP_CERTIFIED 2247 1.11 0.89 1.23 135 XM_RXBody 2219 1.04 0.70 1.22 136 T_XMDrugObfuBody_08 2214 2.17 3.96 1.21 137 XM_B_Investor 2125 2.10 3.84 1.17 138 URI_HEX 2102 1.25 1.44 1.15 139 RELAYCOUNTRY_CA 2074 4.59 10.99 1.14 140 T_TooManySym_03 2043 0.82 0.27 1.12 141 XM_B_COPY_HTML 2015 1.03 0.89 1.11 142 RCVD_IN_PSBL 2008 1.18 1.33 1.10 143 RCVD_IN_MSPIKE_H5 2001 0.84 0.37 1.10 144 XMSubNoVowel 1970 1.10 1.13 1.08 145 MPART_ALT_DIFF_COUNT 1809 1.16 1.47 0.99 146 BODY_ENHANCEMENT2 1808 0.65 0.01 0.99 147 SUBJ_ALL_CAPS 1782 1.39 2.14 0.98 148 TooManyTo_003 1772 0.78 0.42 0.97 149 XMLngstWrd_00 1744 1.09 1.32 0.96 150 XM_B_Phish66 1736 1.59 2.76 0.95 151 XM_OfRef6 1703 2.37 5.03 0.93 152 XM_B_Unsub2 1692 1.29 1.95 0.93 153 HTTPS_HTTP_MISMATCH 1691 0.89 0.82 0.93 154 XMSubMetaI_00 1642 0.95 1.03 0.90 155 XM_UB50 1588 1.90 3.80 0.87 156 TVD_SPACE_RATIO 1561 0.59 0.11 0.86 157 XMLngstWrd_01 1550 1.00 1.29 0.85 158 DKIM_ADSP_CUSTOM_MED 1516 0.91 1.07 0.83 159 TR_MetaPhish_Combo_01 1480 0.79 0.74 0.81 160 TR_XM_MSPIKECOMBO 1463 2.08 4.45 0.80 161 RCVD_IN_MSPIKE_BL 1463 2.16 4.67 0.80 162 XMSubMetaSxObfu_02 1451 0.61 0.27 0.80 163 XM_D_tchamptons_WL 1411 0.51 0.03 0.77 164 XMHTMLBadTable_001 1392 0.89 1.12 0.76 165 XM_B_SpammyWords4 1367 1.23 2.12 0.75 166 TooManyTo_004 1361 0.62 0.38 0.75 167 XMPhish30 1306 0.91 1.27 0.72 168 XM_ProductURIs 1288 0.79 0.95 0.71 169 USER_IN_WHITELIST 1285 0.46 0.00 0.71 170 USER_IN_WELCOMELIST 1285 0.46 0.00 0.71 171 XMLngstWrd_02 1268 0.88 1.22 0.70 172 HTML_TAG_BALANCE_BODY 1239 1.21 2.20 0.68 173 HTML_IMAGE_ONLY_20 1226 0.66 0.64 0.67 174 XMGenDplmaNmb 1215 1.10 1.91 0.67 175 RDNS_DYNAMIC 1203 0.73 0.85 0.66 176 TooManyTo_005 1186 0.54 0.35 0.65 177 XMSubMetaSxObfu_03 1160 0.57 0.44 0.64 178 XMHTML_After_End 1124 0.91 1.45 0.62 179 T_XMDrugObfuBody_00 1103 0.81 1.18 0.61 180 XMNoVowels 1073 0.48 0.29 0.59 181 XM_B_REG_HTML 1065 0.64 0.74 0.58 182 XMLngstWrd_03 1061 0.66 0.80 0.58 183 KHOP_HELO_FCRDNS 1053 0.96 1.68 0.58 184 XM_S_SubURI 1040 0.37 0.01 0.57 185 XMBody_17 1034 1.74 3.92 0.57 186 DATE_IN_PAST_03_06 1029 0.58 0.60 0.56 187 URI_TRY_3LD 1014 0.95 1.67 0.56 188 RCVD_IN_MSPIKE_L3 1004 1.30 2.68 0.55 189 T_XMHurry_00 984 1.16 2.32 0.54 190 XM_H_PHPMailer 956 0.69 0.99 0.52 191 RCVD_IN_BL_SPAMCOP_NET 936 4.29 11.31 0.51 192 PLING_QUERY 929 0.91 1.64 0.51 193 HELO_NODOT 929 0.55 0.61 0.51 194 HELO_NO_DOMAIN 929 0.55 0.61 0.51 195 XMLngstWrd_04 924 0.60 0.78 0.51 196 TVD_SPACE_RATIO_MINFP 912 0.40 0.21 0.50 197 FORGED_GMAIL_RCVD 910 0.66 0.96 0.50 198 XM_B_DNDMA 880 0.76 1.27 0.48 199 HTML_TEXT_INVISIBLE_STYLE 862 0.47 0.47 0.47 200 T_FILL_THIS_FORM_SHORT 860 1.36 3.02 0.47 ----------------------------------------------------------------------