Email: 296447 Autolearn: 0 AvgScore: 4.64 AvgScanTime: 1.27 sec Spam: 112170 Autolearn: 0 AvgScore: 15.28 AvgScanTime: 1.32 sec Ham: 184277 Autolearn: 0 AvgScore: -1.84 AvgScanTime: 1.23 sec Time Spent Running SA: 104.43 hours Time Spent Processing Spam: 41.22 hours Time Spent Processing Ham: 63.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 106444 87.35 94.90 82.75 2 XM_B_Unicode 96995 77.22 86.47 71.58 3 DKIM_SIGNED 95049 80.45 84.74 77.84 4 XM_DK_Pass 93908 78.55 83.72 75.41 5 DKIM_VALID 93108 77.97 83.01 74.91 6 DCC_CHECK 84885 53.69 75.68 40.31 7 RELAYCOUNTRY_US 83508 78.08 74.45 80.29 8 XMListUnsubscribeExists 75076 58.76 66.93 53.79 9 XM_B_SpammyWords 72590 53.26 64.71 46.28 10 DKIM_VALID_AU 70178 63.18 62.56 63.56 11 RCVD_IN_MSPIKE_H2 52104 42.74 46.45 40.49 12 XM_DK_Undo_02 51866 22.62 46.24 8.24 13 XM_B_Unicode3 50645 45.59 45.15 45.86 14 BAYES_99 45870 20.02 40.89 7.31 15 TR_XM_DKIM_Undo 43331 18.31 38.63 5.94 16 XM_B_SpammyWords2 40975 26.54 36.53 20.46 17 DKIM_VALID_EF 40756 32.15 36.33 29.60 18 MIME_HTML_ONLY 40334 26.99 35.96 21.54 19 BAYES_50 38447 48.28 34.28 56.81 20 LOC_TINY_FONT_1 38046 31.07 33.92 29.33 21 BAYES_999 37100 16.34 33.07 6.15 22 HTML_FONT_LOW_CONTRAST 35885 32.34 31.99 32.55 23 TR_DCC_Bayes_99 33296 13.20 29.68 3.17 24 T_KAM_HTML_FONT_INVALID 32637 22.63 29.10 18.69 25 FVGT_m_MULTI_ODD 32554 28.17 29.02 27.64 26 RELAYCOUNTRY_META 31864 13.16 28.41 3.88 27 DCC_CHECK_NEGATIVE 27259 46.27 24.30 59.65 28 XM_Body_Dirty_Words 25480 17.02 22.72 13.55 29 XMSubLong 22265 22.83 19.85 24.64 30 XM_Multi_Part_URI 21786 16.44 19.42 14.63 31 T_TM2_M_HEADER_IN_MSG 20764 21.03 18.51 22.56 32 TR_XM_SpammyRelay 17912 7.16 15.97 1.79 33 UNPARSEABLE_RELAY 17877 11.16 15.94 8.26 34 TR_XM_UnparsRelay 17684 10.00 15.77 6.48 35 RCVD_IN_MSPIKE_WL 17605 18.56 15.69 20.30 36 FSL_BULK_SIG 17560 8.32 15.65 3.86 37 TR_XM_SpammyWords2 16406 6.53 14.63 1.61 38 BOTNET 16206 6.40 14.45 1.50 39 XM_B_Unsub 16157 11.48 14.40 9.71 40 TR_XM_BayesUnsub 15929 10.35 14.20 8.00 41 RCVD_IN_BL_SPAMCOP_NET 15032 5.28 13.40 0.34 42 RELAYCOUNTRY_CA 15028 6.05 13.40 1.57 43 RCVD_IN_MSPIKE_H3 14265 12.47 12.72 12.32 44 BOTNET_IPINHOSTNAME 13209 8.54 11.78 6.58 45 XMSexyCombo_05 13045 7.50 11.63 4.98 46 XM_H_Long_From01 12463 7.12 11.11 4.69 47 XM_UncommonTLD01 12225 7.16 10.90 4.88 48 XM_B_SpammyWords3 11983 7.56 10.68 5.66 49 T_REMOTE_IMAGE 11871 5.94 10.58 3.11 50 UNTRUSTED_Relay 11683 4.90 10.42 1.54 51 LOTS_OF_MONEY 11490 8.49 10.24 7.42 52 XM_CamelCaseFrm001 10416 4.68 9.29 1.88 53 TR_XM_SPAMCOP 10095 3.53 9.00 0.21 54 BAYES_80 9399 6.14 8.38 4.77 55 RCVD_IN_VALIDITY_RPBL 9346 3.22 8.33 0.11 56 TR_XM_SpammyWords4 9192 6.33 8.19 5.19 57 BAYES_60 8877 10.01 7.91 11.29 58 HTML_IMAGE_RATIO_02 7961 7.06 7.10 7.04 59 HTML_IMAGE_ONLY_24 7936 2.86 7.07 0.29 60 HTTP_EXCESSIVE_ESCAPES 7916 2.69 7.06 0.03 61 XM_SendGrid 7495 5.93 6.68 5.47 62 XMSubMetaSx_00 7424 5.20 6.62 4.33 63 T_XMDrugObfuBody_08 7285 3.38 6.49 1.49 64 XM_SPF_SoftFail 7205 3.57 6.42 1.83 65 RCVD_IN_MSPIKE_BL 7106 2.55 6.34 0.25 66 MPART_ALT_DIFF 7017 5.76 6.26 5.45 67 TR_XM_MSPIKECOMBO 6778 2.44 6.04 0.25 68 T_FILL_THIS_FORM_SHORT 6743 2.65 6.01 0.60 69 XMBody_17 6645 3.00 5.92 1.22 70 BOTNET_NORDNS 6614 2.24 5.90 0.01 71 XM_Evil_Numbers_Gen 6133 7.98 5.47 9.51 72 XM_B_SpammyTLD 6066 3.30 5.41 2.02 73 BAYES_95 6029 3.96 5.37 3.10 74 XMStrtUSub 5835 5.90 5.20 6.32 75 LotsOfNums_01 5736 6.53 5.11 7.39 76 XM_DIRTYINTL 5578 2.05 4.97 0.27 77 MIME_HTML_MOSTLY 5383 3.91 4.80 3.37 78 T_XMDrugObfuBody_14 5221 3.02 4.65 2.03 79 XM_UB50 5178 2.35 4.62 0.96 80 XMNumbers 5138 4.94 4.58 5.16 81 TR_XM_PhishingBody 4899 3.27 4.37 2.60 82 TR_XM_DK_SendGrid 4785 3.89 4.27 3.65 83 TR_XM_FormFill 4715 1.60 4.20 0.01 84 XM_OfRef6 4692 2.19 4.18 0.98 85 RCVD_IN_MSPIKE_L3 4660 1.71 4.15 0.23 86 TooManyTo_001 4602 5.47 4.10 6.30 87 XM_B_Phish_Phrases 4556 4.46 4.06 4.70 88 RCVD_IN_VALIDITY_SAFE 4401 6.05 3.92 7.34 89 HTML_IMAGE_RATIO_04 4390 4.75 3.91 5.25 90 TR_XM_SpammyWords5 4371 2.34 3.90 1.40 91 MIME_BASE64_TEXT 4187 1.51 3.73 0.15 92 XM_B_Investor 4073 2.15 3.63 1.25 93 RCVD_IN_PSBL 3977 1.64 3.55 0.49 94 TR_XM_SpammyWords3 3698 1.33 3.30 0.13 95 XM_DK_Undo_01 3650 2.06 3.25 1.34 96 URI_NOVOWEL 3625 2.64 3.23 2.27 97 PDS_OTHER_BAD_TLD 3561 1.35 3.17 0.24 98 HTML_IMAGE_RATIO_06 3503 3.73 3.12 4.10 99 RCVD_IN_VALIDITY_CERTIFIED 3480 5.17 3.10 6.43 100 TVD_RCVD_SPACE_BRACKET 3405 1.15 3.04 0.00 101 SpammyFromTLD_01 3362 1.37 3.00 0.37 102 HK_RANDOM_REPLYTO 3230 1.14 2.88 0.08 103 XM_H_Undi_Recip 3226 1.22 2.88 0.21 104 TM2_M_URI_OPT_OUT 3163 2.60 2.82 2.47 105 XM_UB99 3155 1.07 2.81 0.00 106 RCVD_IN_MSPIKE_H4 2976 5.01 2.65 6.45 107 HTML_IMAGE_RATIO_08 2970 3.45 2.65 3.93 108 SpammyFromTLD_02 2938 1.10 2.62 0.18 109 FONT_INVIS_LONG_LINE 2924 1.08 2.61 0.15 110 T_XMHurry_00 2890 1.36 2.58 0.62 111 TR_XM_MSPIKECOMBO2 2861 0.98 2.55 0.02 112 USER_IN_DEF_DKIM_WL 2797 12.51 2.49 18.61 113 MIME_HTML_ONLY_MULTI 2752 2.73 2.45 2.90 114 MPART_ALT_DIFF_COUNT 2726 1.57 2.43 1.04 115 XMDiploma_00 2703 1.68 2.41 1.24 116 TM2_M_VERY_LONG_WORD 2683 1.64 2.39 1.18 117 T_TooManySym_01 2609 7.05 2.33 9.93 118 FROM_EXCESS_BASE64 2606 2.88 2.32 3.23 119 XM_UB999 2573 0.87 2.29 0.00 120 XM_B_SpammyWords4 2466 1.59 2.20 1.22 121 URIBL_DBL_SPAM 2454 0.83 2.19 0.01 122 XM_B_Unsub2 2256 1.33 2.01 0.92 123 TR_XM_InvalidRelay 2218 0.76 1.98 0.03 124 RELAYCOUNTRY_IN 2169 0.74 1.93 0.02 125 XM_B_Phish66 2097 1.26 1.87 0.89 126 XMReplyNow 2084 0.85 1.86 0.24 127 RELAYCOUNTRY_CN 2073 0.75 1.85 0.08 128 TR_XM_BayesRelay 2061 0.70 1.84 0.00 129 HTTPS_HTTP_MISMATCH 2059 1.10 1.84 0.66 130 MultiRelay_CC 2046 0.69 1.82 0.00 131 TR_XM_MaxSPIKE 1980 0.68 1.77 0.02 132 MIME_QP_LONG_LINE 1960 2.66 1.75 3.22 133 TR_XM_PHPDW 1954 0.84 1.74 0.29 134 DKIM_INVALID 1941 2.48 1.73 2.93 135 TR_LOTS_OF_MONEY3 1881 0.83 1.68 0.31 136 RCVD_IN_RP_RNBL 1861 0.64 1.66 0.01 137 SUBJ_ALL_CAPS 1797 1.31 1.60 1.13 138 TR_XM_NoHeaderRelay 1795 0.67 1.60 0.10 139 XM_Combo_Sbj 1786 0.73 1.59 0.21 140 RELAYCOUNTRY_RU 1780 0.61 1.59 0.02 141 XMSexyCombo_01 1752 0.93 1.56 0.55 142 TR_XM_PHPForged 1737 0.74 1.55 0.24 143 XM_ProductURIs 1728 0.99 1.54 0.65 144 TR_XM_FormFill2 1716 0.73 1.53 0.24 145 XM_H_PHPOS 1711 0.72 1.53 0.23 146 RCVD_IN_MSPIKE_L5 1691 0.58 1.51 0.02 147 XMStockSpam_06 1672 2.32 1.49 2.82 148 XMBdyGiftCard01 1573 1.46 1.40 1.50 149 BAYES_40 1499 3.08 1.34 4.14 150 MAILING_LIST_MULTI 1471 1.78 1.31 2.07 151 TR_XM_Base64_M1 1467 1.43 1.31 1.50 152 XM_URI_RBL 1464 0.56 1.31 0.10 153 T_XMDrugObfuBody_00 1451 0.82 1.29 0.53 154 ALL_TRUSTED 1449 10.58 1.29 16.23 155 XMSubMetaSxObfu_02 1420 0.93 1.27 0.73 156 XMSubNoVowel 1392 1.06 1.24 0.96 157 MultiRelay 1388 0.47 1.24 0.00 158 KHOP_HELO_FCRDNS 1360 1.08 1.21 0.99 159 HTML_MIME_NO_HTML_TAG 1350 1.55 1.20 1.76 160 XMHTML_After_End 1345 0.78 1.20 0.52 161 XM_H_Long_From02 1334 1.20 1.19 1.21 162 URI_HEX 1333 1.07 1.19 1.01 163 LongTLD 1328 0.64 1.18 0.31 164 TM2_M_A_HREF_HREF 1322 0.58 1.18 0.22 165 TR_Symld_Words 1305 2.01 1.16 2.52 166 RELAYCOUNTRY_AU 1293 0.58 1.15 0.23 167 LOW_PRICE 1286 0.83 1.15 0.63 168 RCVD_IN_IADB_LISTED 1276 2.61 1.14 3.50 169 XMPhish30 1248 1.10 1.11 1.09 170 SHOPIFY_IMG_NOT_RCVD_SFY 1227 0.59 1.09 0.28 171 RELAYCOUNTRY_BR 1217 0.41 1.08 0.00 172 FROM_SUSPICIOUS_NTLD 1215 0.43 1.08 0.03 173 PLING_QUERY 1207 0.69 1.08 0.45 174 NORDNS_LOW_CONTRAST 1205 0.43 1.07 0.04 175 XMRcvdHeader_05 1202 0.41 1.07 0.00 176 XM_UB60 1180 0.44 1.05 0.06 177 FROM_SUSPICIOUS_NTLD_FP 1158 0.41 1.03 0.03 178 LONGLN_LOW_CONTRAST 1152 0.57 1.03 0.29 179 TR_Mismatch_TLD_02 1138 0.44 1.01 0.09 180 XMHTMLBadTable_001 1137 0.66 1.01 0.45 181 TR_XM_Undi_Recip2 1128 0.40 1.01 0.03 182 DIET_1 1118 0.63 1.00 0.41 183 TR_XM_SB_Phish 1117 1.35 1.00 1.57 184 T_XMDrugObfuBody_10 1104 0.41 0.98 0.06 185 HTML_OBFUSCATE_05_10 1103 0.51 0.98 0.22 186 XM_H_PHPMailer 1095 0.72 0.98 0.57 187 XM_B_DNDMA 1091 0.58 0.97 0.35 188 BAYES_20 1090 2.25 0.97 3.03 189 RCVD_IN_IADB_SPF 1088 2.29 0.97 3.09 190 HTML_TAG_BALANCE_BODY 1085 0.87 0.97 0.81 191 MSGID_DOLLARS_URI_IMG 1066 0.36 0.95 0.00 192 XMGenDplmaNmb 1049 0.72 0.94 0.59 193 TR_Sbj_FN_Bdy 1033 0.43 0.92 0.13 194 RELAYCOUNTRY_DE 1031 0.55 0.92 0.33 195 RCVD_IN_IADB_DK 1025 2.02 0.91 2.69 196 XMSubPhish11 1024 1.31 0.91 1.56 197 RCVD_IN_IADB_SENDERID 1023 2.06 0.91 2.75 198 HTML_FONT_TINY_NORDNS 1023 0.39 0.91 0.07 199 TR_XM_Undi_Recip5 1010 0.34 0.90 0.00 200 URIBL_BLACK 1003 0.35 0.89 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152489 87.35 94.90 82.75 2 RELAYCOUNTRY_US 147952 78.08 74.45 80.29 3 DKIM_SIGNED 143443 80.45 84.74 77.84 4 XM_DK_Pass 138961 78.55 83.72 75.41 5 DKIM_VALID 138037 77.97 83.01 74.91 6 XM_B_Unicode 131914 77.22 86.47 71.58 7 DKIM_VALID_AU 117124 63.18 62.56 63.56 8 DCC_CHECK_NEGATIVE 109918 46.27 24.30 59.65 9 BAYES_50 104689 48.28 34.28 56.81 10 XMListUnsubscribeExists 99130 58.76 66.93 53.79 11 XM_B_SpammyWords 85283 53.26 64.71 46.28 12 XM_B_Unicode3 84510 45.59 45.15 45.86 13 RCVD_IN_MSPIKE_H2 74610 42.74 46.45 40.49 14 DCC_CHECK 74273 53.69 75.68 40.31 15 HTML_FONT_LOW_CONTRAST 59986 32.34 31.99 32.55 16 DKIM_VALID_EF 54548 32.15 36.33 29.60 17 LOC_TINY_FONT_1 54052 31.07 33.92 29.33 18 FVGT_m_MULTI_ODD 50942 28.17 29.02 27.64 19 XMSubLong 45406 22.83 19.85 24.64 20 T_TM2_M_HEADER_IN_MSG 41580 21.03 18.51 22.56 21 MIME_HTML_ONLY 39689 26.99 35.96 21.54 22 XM_B_SpammyWords2 37696 26.54 36.53 20.46 23 RCVD_IN_MSPIKE_WL 37415 18.56 15.69 20.30 24 T_KAM_HTML_FONT_INVALID 34437 22.63 29.10 18.69 25 USER_IN_DEF_DKIM_WL 34299 12.51 2.49 18.61 26 ALL_TRUSTED 29911 10.58 1.29 16.23 27 XM_Multi_Part_URI 26963 16.44 19.42 14.63 28 XM_DKIMWhitelistDomains 26936 9.12 0.08 14.62 29 XM_Body_Dirty_Words 24965 17.02 22.72 13.55 30 RCVD_IN_MSPIKE_H3 22701 12.47 12.72 12.32 31 BAYES_60 20798 10.01 7.91 11.29 32 T_TooManySym_01 18305 7.05 2.33 9.93 33 XM_B_Unsub 17888 11.48 14.40 9.71 34 XM_Evil_Numbers_Gen 17521 7.98 5.47 9.51 35 UNPARSEABLE_RELAY 15219 11.16 15.94 8.26 36 XM_DK_Undo_02 15190 22.62 46.24 8.24 37 TR_XM_BayesUnsub 14739 10.35 14.20 8.00 38 BAYES_00 14316 4.97 0.37 7.77 39 LOTS_OF_MONEY 13677 8.49 10.24 7.42 40 LotsOfNums_01 13621 6.53 5.11 7.39 41 RCVD_IN_VALIDITY_SAFE 13529 6.05 3.92 7.34 42 BAYES_99 13478 20.02 40.89 7.31 43 HTML_IMAGE_RATIO_02 12966 7.06 7.10 7.04 44 BOTNET_IPINHOSTNAME 12119 8.54 11.78 6.58 45 TR_XM_UnparsRelay 11947 10.00 15.77 6.48 46 RCVD_IN_MSPIKE_H4 11878 5.01 2.65 6.45 47 T_TooManySym_02 11867 4.23 0.61 6.44 48 RCVD_IN_VALIDITY_CERTIFIED 11853 5.17 3.10 6.43 49 XMStrtUSub 11650 5.90 5.20 6.32 50 TooManyTo_001 11602 5.47 4.10 6.30 51 BAYES_999 11331 16.34 33.07 6.15 52 TR_XM_DKIM_Undo 10944 18.31 38.63 5.94 53 XM_B_SpammyWords3 10434 7.56 10.68 5.66 54 IN_ZIMBRA_NJ_WHITELIST 10135 3.44 0.05 5.50 55 XM_SendGrid 10077 5.93 6.68 5.47 56 TR_XM_DK_Bayes 10073 3.51 0.30 5.47 57 MPART_ALT_DIFF 10047 5.76 6.26 5.45 58 TR_XM_DK_Bayes1 9982 3.48 0.29 5.42 59 HTML_IMAGE_RATIO_04 9677 4.75 3.91 5.25 60 TR_XM_SpammyWords4 9573 6.33 8.19 5.19 61 XMNumbers 9500 4.94 4.58 5.16 62 XMSexyCombo_05 9180 7.50 11.63 4.98 63 TR_XM_DK_Bayes2 9100 3.16 0.24 4.94 64 XM_UncommonTLD01 8989 7.16 10.90 4.88 65 BAYES_80 8793 6.14 8.38 4.77 66 XM_B_Phish_Phrases 8654 4.46 4.06 4.70 67 XM_H_Long_From01 8648 7.12 11.11 4.69 68 XMSubMetaSx_00 7987 5.20 6.62 4.33 69 BAYES_40 7622 3.08 1.34 4.14 70 HTML_IMAGE_RATIO_06 7562 3.73 3.12 4.10 71 HTML_IMAGE_RATIO_08 7250 3.45 2.65 3.93 72 RELAYCOUNTRY_META 7142 13.16 28.41 3.88 73 FSL_BULK_SIG 7116 8.32 15.65 3.86 74 INVALID_MSGID 7032 2.44 0.18 3.82 75 MSGID_NOFQDN1 6744 2.31 0.09 3.66 76 TR_XM_DK_SendGrid 6734 3.89 4.27 3.65 77 RCVD_IN_IADB_LISTED 6454 2.61 1.14 3.50 78 TVD_RCVD_IP 6217 2.23 0.36 3.37 79 MIME_HTML_MOSTLY 6201 3.91 4.80 3.37 80 FROM_EXCESS_BASE64 5946 2.88 2.32 3.23 81 MIME_QP_LONG_LINE 5925 2.66 1.75 3.22 82 TO_MALFORMED 5923 2.00 0.00 3.21 83 TR_DCC_Bayes_99 5837 13.20 29.68 3.17 84 T_REMOTE_IMAGE 5734 5.94 10.58 3.11 85 BAYES_95 5709 3.96 5.37 3.10 86 RCVD_IN_IADB_SPF 5695 2.29 0.97 3.09 87 BAYES_20 5591 2.25 0.97 3.03 88 DKIM_INVALID 5406 2.48 1.73 2.93 89 MIME_HTML_ONLY_MULTI 5350 2.73 2.45 2.90 90 XMStockSpam_06 5200 2.32 1.49 2.82 91 RCVD_IN_IADB_SENDERID 5071 2.06 0.91 2.75 92 T_TooManySym_03 5011 1.79 0.27 2.72 93 RCVD_IN_IADB_DK 4951 2.02 0.91 2.69 94 TVD_SPACE_RATIO 4922 1.69 0.09 2.67 95 XM_H_Trusted_IP 4839 1.63 0.00 2.63 96 TR_XM_PhishingBody 4787 3.27 4.37 2.60 97 TR_Symld_Words 4642 2.01 1.16 2.52 98 TM2_M_URI_OPT_OUT 4553 2.60 2.82 2.47 99 RCVD_IN_IADB_VOUCHED 4370 1.72 0.66 2.37 100 XMBSHREFv2 4272 1.50 0.17 2.32 101 URI_NOVOWEL 4191 2.64 3.23 2.27 102 IN_HORDE_ADDRESS_BOOK 4024 1.38 0.06 2.18 103 MAILING_LIST_MULTI 3819 1.78 1.31 2.07 104 T_XMDrugObfuBody_14 3739 3.02 4.65 2.03 105 XM_B_SpammyTLD 3729 3.30 5.41 2.02 106 XM_PDF 3667 1.33 0.24 1.99 107 ANY_BOUNCE_MESSAGE 3581 1.40 0.50 1.94 108 BOUNCE_MESSAGE 3580 1.39 0.49 1.94 109 XM_CamelCaseFrm001 3466 4.68 9.29 1.88 110 XMBody_95 3465 1.21 0.11 1.88 111 XM_SPF_SoftFail 3369 3.57 6.42 1.83 112 TR_XM_SpammyRelay 3303 7.16 15.97 1.79 113 BAYES_05 3281 1.29 0.48 1.78 114 HTML_MIME_NO_HTML_TAG 3250 1.55 1.20 1.76 115 RCVD_IN_IADB_OPTIN 3008 1.17 0.41 1.63 116 TR_XM_SpammyWords2 2960 6.53 14.63 1.61 117 FVGT_m_MULTI_ODD_EMAIL 2919 1.10 0.30 1.58 118 RELAYCOUNTRY_CA 2897 6.05 13.40 1.57 119 TR_XM_SB_Phish 2894 1.35 1.00 1.57 120 XMSubPhish11 2867 1.31 0.91 1.56 121 UNTRUSTED_Relay 2840 4.90 10.42 1.54 122 RCVD_IN_MSPIKE_H5 2836 1.08 0.32 1.54 123 XMBdyGiftCard01 2767 1.46 1.40 1.50 124 TR_XM_Base64_M1 2767 1.43 1.31 1.50 125 BOTNET 2758 6.40 14.45 1.50 126 T_XMDrugObfuBody_08 2744 3.38 6.49 1.49 127 XMGappySubj_01 2693 0.93 0.07 1.46 128 RCVD_IN_RP_SAFE 2685 1.21 0.80 1.46 129 TooManyTo_002 2634 1.02 0.34 1.43 130 TR_XM_SpammyWords5 2578 2.34 3.90 1.40 131 XM_DK_Undo_01 2468 2.06 3.25 1.34 132 XM_GoogleGroups 2468 1.09 0.67 1.34 133 RCVD_IN_RP_CERTIFIED 2370 1.03 0.60 1.29 134 HTML_FONT_FACE_BAD 2361 1.10 0.81 1.28 135 XM_B_Investor 2306 2.15 3.63 1.25 136 XMDiploma_00 2281 1.68 2.41 1.24 137 XM_B_SpammyWords4 2256 1.59 2.20 1.22 138 XMBody_17 2253 3.00 5.92 1.22 139 XM_H_Long_From02 2227 1.20 1.19 1.21 140 TM2_M_VERY_LONG_WORD 2180 1.64 2.39 1.18 141 XM_RXBody 2111 0.90 0.51 1.15 142 SUBJ_ALL_CAPS 2075 1.31 1.60 1.13 143 XMPhish30 2017 1.10 1.11 1.09 144 XM_B_COPY_HTML 2015 0.94 0.68 1.09 145 MPART_ALT_DIFF_COUNT 1925 1.57 2.43 1.04 146 TooManyTo_003 1908 0.76 0.30 1.04 147 URI_HEX 1853 1.07 1.19 1.01 148 KHOP_HELO_FCRDNS 1829 1.08 1.21 0.99 149 XM_OfRef6 1800 2.19 4.18 0.98 150 XMLngstWrd_00 1794 0.80 0.50 0.97 151 XM_UB50 1776 2.35 4.62 0.96 152 XMSubNoVowel 1763 1.06 1.24 0.96 153 T_MANY_PILL_PRICE 1750 0.60 0.01 0.95 154 XM_B_Unsub2 1687 1.33 2.01 0.92 155 XM_B_Phish66 1642 1.26 1.87 0.89 156 DKIM_ADSP_CUSTOM_MED 1593 0.80 0.68 0.86 157 XMLngstWrd_01 1566 0.71 0.48 0.85 158 HTML_TAG_BALANCE_BODY 1485 0.87 0.97 0.81 159 TooManyTo_004 1452 0.60 0.29 0.79 160 USER_IN_WELCOMELIST 1360 0.46 0.00 0.74 161 USER_IN_WHITELIST 1360 0.46 0.00 0.74 162 XMBrknScrpt_02 1355 0.77 0.83 0.74 163 XMSubMetaSxObfu_02 1346 0.93 1.27 0.73 164 XMLngstWrd_02 1230 0.58 0.42 0.67 165 HTTPS_HTTP_MISMATCH 1209 1.10 1.84 0.66 166 TooManyTo_005 1204 0.51 0.28 0.65 167 XM_ProductURIs 1202 0.99 1.54 0.65 168 LOW_PRICE 1166 0.83 1.15 0.63 169 HTML_TEXT_INVISIBLE_STYLE 1155 0.49 0.27 0.63 170 HTML_IMAGE_ONLY_20 1150 0.55 0.44 0.62 171 T_XMHurry_00 1139 1.36 2.58 0.62 172 XM_B_REG_HTML 1115 0.61 0.62 0.61 173 T_FILL_THIS_FORM_SHORT 1105 2.65 6.01 0.60 174 XMGenDplmaNmb 1093 0.72 0.94 0.59 175 TR_MetaPhish_Combo_01 1089 0.62 0.67 0.59 176 XM_H_PHPMailer 1045 0.72 0.98 0.57 177 XM_S_SubURI 1038 0.36 0.02 0.56 178 DATE_IN_PAST_03_06 1030 0.49 0.39 0.56 179 XMSexyCombo_01 1010 0.93 1.56 0.55 180 XM_shorewaves_Whitelist 977 0.33 0.00 0.53 181 T_XMDrugObfuBody_00 975 0.82 1.29 0.53 182 XMHTML_After_End 954 0.78 1.20 0.52 183 T_TooManySym_04 935 0.38 0.16 0.51 184 NML_ADSP_CUSTOM_MED 927 0.51 0.52 0.50 185 FORGED_GMAIL_RCVD 925 0.53 0.58 0.50 186 TR_XM_Base64_L1 908 0.51 0.55 0.49 187 XMSubMetaI_00 898 0.59 0.76 0.49 188 URI_TRY_3LD 896 0.62 0.83 0.49 189 RCVD_IN_PSBL 895 1.64 3.55 0.49 190 HELO_NODOT 882 0.54 0.64 0.48 191 HELO_NO_DOMAIN 882 0.54 0.64 0.48 192 XMHTMLBadTable_001 834 0.66 1.01 0.45 193 PLING_QUERY 827 0.69 1.08 0.45 194 XMSubMetaSxObfu_03 824 0.43 0.39 0.45 195 XMLngstWrd_03 799 0.35 0.20 0.43 196 XMCapTrack 792 0.37 0.26 0.43 197 TVD_SPACE_RATIO_MINFP 772 0.32 0.16 0.42 198 XMNoVowels 767 0.36 0.27 0.42 199 TR_XM_Base64_M2 762 0.40 0.39 0.41 200 XMSlimDrugH 762 0.47 0.56 0.41 ----------------------------------------------------------------------