Email: 329179 Autolearn: 0 AvgScore: 5.17 AvgScanTime: 1.16 sec Spam: 129421 Autolearn: 0 AvgScore: 15.66 AvgScanTime: 1.22 sec Ham: 199758 Autolearn: 0 AvgScore: -1.62 AvgScanTime: 1.12 sec Time Spent Running SA: 105.74 hours Time Spent Processing Spam: 43.76 hours Time Spent Processing Ham: 61.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122724 87.23 94.83 82.31 2 XM_B_Unicode 110466 76.33 85.35 70.48 3 DKIM_SIGNED 108226 80.63 83.62 78.70 4 XM_DK_Pass 106931 78.61 82.62 76.01 5 DKIM_VALID 106142 78.09 82.01 75.55 6 DCC_CHECK 97131 53.99 75.05 40.34 7 RELAYCOUNTRY_US 96627 78.64 74.66 81.22 8 XMListUnsubscribeExists 85761 60.38 66.27 56.57 9 XM_B_SpammyWords 84968 53.28 65.65 45.26 10 DKIM_VALID_AU 81661 63.01 63.10 62.95 11 XM_DK_Undo_02 60641 23.66 46.86 8.63 12 RCVD_IN_MSPIKE_H2 56471 42.27 43.63 41.39 13 XM_B_Unicode3 52272 42.14 40.39 43.27 14 MIME_HTML_ONLY 51765 28.59 40.00 21.20 15 BAYES_99 51694 20.23 39.94 7.45 16 TR_XM_DKIM_Undo 50436 18.26 38.97 4.85 17 XM_B_SpammyWords2 47987 25.89 37.08 18.64 18 BAYES_50 44274 48.04 34.21 57.00 19 DKIM_VALID_EF 43914 31.92 33.93 30.61 20 LOC_TINY_FONT_1 42945 30.02 33.18 27.96 21 BAYES_999 41197 16.25 31.83 6.15 22 HTML_FONT_LOW_CONTRAST 40828 31.63 31.55 31.69 23 TR_DCC_Bayes_99 38930 13.56 30.08 2.86 24 FVGT_m_MULTI_ODD 37823 28.68 29.22 28.32 25 T_KAM_HTML_FONT_INVALID 37416 22.86 28.91 18.94 26 RELAYCOUNTRY_META 36468 13.29 28.18 3.65 27 DCC_CHECK_NEGATIVE 32271 46.00 24.93 59.64 28 XM_Body_Dirty_Words 28011 16.16 21.64 12.60 29 RCVD_IN_BL_SPAMCOP_NET 24658 7.91 19.05 0.69 30 T_TM2_M_HEADER_IN_MSG 24245 20.53 18.73 21.69 31 XMSubLong 22866 20.17 17.67 21.79 32 RCVD_IN_MSPIKE_WL 22214 18.46 17.16 19.30 33 TR_XM_SpammyRelay 21186 7.52 16.37 1.79 34 FSL_BULK_SIG 21001 8.49 16.23 3.48 35 LOTS_OF_MONEY 19581 10.87 15.13 8.11 36 XM_Multi_Part_URI 19295 14.89 14.91 14.87 37 BOTNET 19095 6.69 14.75 1.47 38 XM_B_Unsub 19063 11.03 14.73 8.63 39 RCVD_IN_MSPIKE_H3 19032 13.58 14.71 12.86 40 TR_XM_BayesUnsub 18701 9.95 14.45 7.03 41 TR_XM_SpammyWords2 17670 6.06 13.65 1.13 42 RELAYCOUNTRY_CA 17573 6.11 13.58 1.28 43 UNPARSEABLE_RELAY 17057 10.61 13.18 8.95 44 TR_XM_SpammyWords4 16511 8.04 12.76 4.99 45 XM_UncommonTLD01 14667 7.42 11.33 4.89 46 TR_XM_SPAMCOP 14646 4.68 11.32 0.37 47 BOTNET_IPINHOSTNAME 14592 8.33 11.27 6.42 48 T_REMOTE_IMAGE 13518 6.30 10.44 3.61 49 XMSexyCombo_05 13471 6.61 10.41 4.15 50 XM_H_Long_From01 13330 7.40 10.30 5.52 51 XM_B_SpammyWords3 13078 7.20 10.11 5.32 52 UNTRUSTED_Relay 12540 4.71 9.69 1.49 53 BAYES_80 11677 6.56 9.02 4.97 54 XM_CamelCaseFrm001 11087 4.56 8.57 1.97 55 TR_XM_UnparsRelay 10257 4.10 7.93 1.61 56 BAYES_60 9961 9.65 7.70 10.92 57 RCVD_IN_VALIDITY_RPBL 9925 3.06 7.67 0.08 58 RCVD_IN_MSPIKE_BL 9225 2.98 7.13 0.29 59 TR_XM_MSPIKECOMBO 8699 2.82 6.72 0.29 60 HTML_IMAGE_RATIO_02 8340 6.65 6.44 6.79 61 HTML_IMAGE_ONLY_24 8328 2.67 6.43 0.24 62 HTTP_EXCESSIVE_ESCAPES 8242 2.52 6.37 0.03 63 XMBody_17 8162 3.04 6.31 0.93 64 XM_Evil_Numbers_Gen 7780 7.82 6.01 8.99 65 MPART_ALT_DIFF 7764 5.64 6.00 5.41 66 BAYES_95 7670 4.42 5.93 3.44 67 XM_SPF_SoftFail 7272 3.47 5.62 2.07 68 XM_SendGrid 7259 5.73 5.61 5.81 69 BOTNET_NORDNS 6938 2.12 5.36 0.01 70 RCVD_IN_PSBL 6908 2.40 5.34 0.50 71 TR_XM_SpammyWords5 6285 2.87 4.86 1.59 72 XM_DIRTYINTL 5998 1.99 4.63 0.28 73 LotsOfNums_01 5979 6.77 4.62 8.16 74 T_FILL_THIS_FORM_SHORT 5798 2.10 4.48 0.56 75 T_XMDrugObfuBody_14 5741 2.64 4.44 1.48 76 TR_XM_PhishingBody 5683 3.27 4.39 2.55 77 XMSubMetaSx_00 5639 3.91 4.36 3.63 78 T_XMDrugObfuBody_08 5592 3.00 4.32 2.14 79 XM_OfRef6 5565 2.29 4.30 0.99 80 HTML_MIME_NO_HTML_TAG 5533 2.84 4.28 1.90 81 TM2_M_VERY_LONG_WORD 5457 2.72 4.22 1.74 82 MIME_HTML_ONLY_MULTI 5373 3.64 4.15 3.30 83 XM_B_SpammyTLD 5190 2.92 4.01 2.22 84 HTML_IMAGE_RATIO_04 5159 4.83 3.99 5.38 85 XM_B_Phish_Phrases 5117 3.64 3.95 3.43 86 TooManyTo_001 5081 5.47 3.93 6.46 87 XM_B_Investor 5075 2.24 3.92 1.15 88 TR_XM_DK_SendGrid 4951 3.85 3.83 3.87 89 XMStrtUSub 4931 5.12 3.81 5.97 90 XMNumbers 4838 4.58 3.74 5.13 91 SpammyFromTLD_02 4734 1.60 3.66 0.27 92 SpammyFromTLD_01 4703 1.76 3.63 0.55 93 TR_LOTS_OF_MONEY3 4579 1.71 3.54 0.53 94 MIME_BASE64_TEXT 4499 1.47 3.48 0.16 95 XM_UB50 4487 1.90 3.47 0.88 96 SUBJ_ALL_CAPS 4379 2.16 3.38 1.36 97 RCVD_IN_VALIDITY_SAFE 4345 5.32 3.36 6.59 98 TR_XM_MSPIKECOMBO2 4263 1.33 3.29 0.06 99 RCVD_IN_MSPIKE_L3 4242 1.44 3.28 0.26 100 FONT_INVIS_LONG_LINE 4229 1.35 3.27 0.11 101 XM_UB99 4198 1.28 3.24 0.00 102 HTML_IMAGE_RATIO_08 4087 2.29 3.16 1.73 103 MIME_HTML_MOSTLY 4059 2.97 3.14 2.85 104 RCVD_IN_MSPIKE_L5 3900 1.20 3.01 0.03 105 TR_XM_SpammyWords3 3758 1.23 2.90 0.15 106 HTML_IMAGE_RATIO_06 3703 3.09 2.86 3.23 107 HK_RANDOM_REPLYTO 3609 1.14 2.79 0.08 108 TVD_RCVD_SPACE_BRACKET 3571 1.09 2.76 0.00 109 RCVD_IN_VALIDITY_CERTIFIED 3557 4.45 2.75 5.56 110 T_TooManySym_01 3466 6.33 2.68 8.69 111 XM_UB999 3423 1.04 2.64 0.00 112 TR_XM_FormFill 3366 1.03 2.60 0.01 113 XM_URI_RBL 3114 1.04 2.41 0.16 114 XM_DK_Undo_01 3068 1.66 2.37 1.20 115 RELAYCOUNTRY_RU 3048 0.94 2.36 0.02 116 USER_IN_DEF_DKIM_WL 3039 11.22 2.35 16.97 117 XM_GoogleGroups 3013 1.96 2.33 1.73 118 XM_H_Undi_Recip 3008 1.00 2.32 0.14 119 XM_B_Phish66 2945 1.55 2.28 1.07 120 FROM_EXCESS_BASE64 2927 3.00 2.26 3.47 121 RCVD_IN_MSPIKE_H4 2914 4.03 2.25 5.18 122 XMLngstWrd_00 2761 1.73 2.13 1.47 123 XMBrknScrpt_02 2720 1.21 2.10 0.64 124 XMLngstWrd_01 2720 1.64 2.10 1.35 125 URIBL_DBL_SPAM 2702 0.83 2.09 0.02 126 PDS_OTHER_BAD_TLD 2686 0.91 2.08 0.15 127 XMLngstWrd_02 2667 1.54 2.06 1.20 128 XMDiploma_00 2610 1.65 2.02 1.42 129 TR_XM_PHPDW 2588 1.12 2.00 0.55 130 XMReplyNow 2565 0.92 1.98 0.23 131 TM2_M_URI_OPT_OUT 2554 2.24 1.97 2.41 132 XM_B_SpammyWords4 2552 1.14 1.97 0.61 133 XMLngstWrd_03 2528 1.34 1.95 0.94 134 RELAYCOUNTRY_CN 2508 0.79 1.94 0.04 135 XMLngstWrd_04 2496 1.27 1.93 0.84 136 NO_DNS_FOR_FROM 2491 1.02 1.92 0.43 137 TR_XM_PHPForged 2466 1.03 1.91 0.47 138 TR_XM_BayesRelay 2464 0.75 1.90 0.00 139 XM_B_Unsub2 2459 1.35 1.90 0.99 140 TR_XM_MaxWHORU 2458 0.90 1.90 0.25 141 TR_XM_FormFill2 2453 1.03 1.90 0.47 142 XM_H_PHPOS 2449 1.02 1.89 0.46 143 MPART_ALT_DIFF_COUNT 2447 1.24 1.89 0.82 144 HTML_TITLE_SUBJ_DIFF 2444 1.09 1.89 0.58 145 UPPERCASE_75_100 2444 1.10 1.89 0.59 146 MIME_QP_LONG_LINE 2336 3.04 1.80 3.85 147 URI_NOVOWEL 2307 2.14 1.78 2.36 148 DKIM_ADSP_NXDOMAIN 2292 0.96 1.77 0.44 149 T_XMDrugObfuBody_00 2245 1.12 1.73 0.73 150 TR_XM_InvalidRelay 2193 0.68 1.69 0.02 151 T_XMHurry_00 2165 0.98 1.67 0.53 152 DKIM_INVALID 2084 2.55 1.61 3.15 153 MultiRelay_CC 2071 0.63 1.60 0.01 154 T_Symld_Words_02 2045 0.80 1.58 0.29 155 RCVD_IN_RP_RNBL 2005 0.62 1.55 0.01 156 NORDNS_LOW_CONTRAST 1994 0.62 1.54 0.02 157 RCVD_IN_IADB_LISTED 1992 3.10 1.54 4.11 158 TR_Symld_Words 1939 1.71 1.50 1.85 159 XM_H_Long_From02 1926 1.17 1.49 0.97 160 TR_XM_MaxSPIKE 1926 0.62 1.49 0.06 161 ALL_TRUSTED 1915 10.13 1.48 15.74 162 HTTPS_HTTP_MISMATCH 1902 0.95 1.47 0.62 163 XMSexyCombo_01 1891 0.85 1.46 0.45 164 HTML_FONT_TINY_NORDNS 1863 0.59 1.44 0.05 165 TR_XM_NoHeaderRelay 1831 0.63 1.41 0.11 166 XMStockSpam_06 1783 1.53 1.38 1.63 167 KHOP_HELO_FCRDNS 1769 1.44 1.37 1.49 168 XMBdyGiftCard01 1733 1.22 1.34 1.14 169 TR_Caps_n_Bayes_99 1723 0.72 1.33 0.33 170 HTML_TAG_BALANCE_BODY 1717 0.97 1.33 0.75 171 XM_OfRef7 1716 0.57 1.33 0.08 172 TR_XM_Undi_Recip5 1698 0.52 1.31 0.00 173 XMHTML_After_End 1687 0.86 1.30 0.57 174 RCVD_IN_IADB_SPF 1683 2.75 1.30 3.69 175 T_XMDrugObfuBody_10 1630 0.53 1.26 0.06 176 LONGLN_LOW_CONTRAST 1600 0.73 1.24 0.40 177 TR_XM_SB_Phish 1582 1.82 1.22 2.21 178 BAYES_40 1581 2.86 1.22 3.92 179 XM_HighProb1 1580 0.48 1.22 0.00 180 RCVD_IN_IADB_DK 1574 2.44 1.22 3.23 181 TR_XM_Undi_RecipCombo2 1573 0.48 1.22 0.00 182 LOADSA_MONEY_COMBO 1568 0.50 1.21 0.03 183 RCVD_IN_IADB_SENDERID 1565 2.49 1.21 3.33 184 TR_XM_Undi_Recip11 1559 0.49 1.20 0.02 185 UNDISC_MONEY 1538 0.47 1.19 0.00 186 RELAYCOUNTRY_AU 1537 0.59 1.19 0.20 187 FROM_SUSPICIOUS_NTLD 1519 0.48 1.17 0.02 188 URI_TRY_3LD 1517 0.83 1.17 0.62 189 XMSubPhish11 1499 1.80 1.16 2.21 190 TR_Sbj_FN_Bdy 1474 0.50 1.14 0.09 191 FILL_THIS_FORM 1460 0.63 1.13 0.32 192 MultiRelay 1457 0.44 1.13 0.00 193 TR_LOTS_OF_MONEY2 1436 0.51 1.11 0.12 194 T_MONEY_PERCENT 1436 0.51 1.11 0.12 195 MAILING_LIST_MULTI 1425 2.07 1.10 2.70 196 FILL_THIS_FORM_LONG 1414 0.51 1.09 0.13 197 FROM_SUSPICIOUS_NTLD_FP 1367 0.43 1.06 0.02 198 MONEY_FORM 1363 0.41 1.05 0.00 199 RELAYCOUNTRY_FR 1345 0.54 1.04 0.21 200 URIBL_DBL_ABUSE_SPAM 1338 0.42 1.03 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164420 87.23 94.83 82.31 2 RELAYCOUNTRY_US 162247 78.64 74.66 81.22 3 DKIM_SIGNED 157207 80.63 83.62 78.70 4 XM_DK_Pass 151827 78.61 82.62 76.01 5 DKIM_VALID 150910 78.09 82.01 75.55 6 XM_B_Unicode 140786 76.33 85.35 70.48 7 DKIM_VALID_AU 125744 63.01 63.10 62.95 8 DCC_CHECK_NEGATIVE 119135 46.00 24.93 59.64 9 BAYES_50 113862 48.04 34.21 57.00 10 XMListUnsubscribeExists 113004 60.38 66.27 56.57 11 XM_B_SpammyWords 90416 53.28 65.65 45.26 12 XM_B_Unicode3 86431 42.14 40.39 43.27 13 RCVD_IN_MSPIKE_H2 82671 42.27 43.63 41.39 14 DCC_CHECK 80585 53.99 75.05 40.34 15 HTML_FONT_LOW_CONTRAST 63294 31.63 31.55 31.69 16 DKIM_VALID_EF 61150 31.92 33.93 30.61 17 FVGT_m_MULTI_ODD 56570 28.68 29.22 28.32 18 LOC_TINY_FONT_1 55862 30.02 33.18 27.96 19 XMSubLong 43532 20.17 17.67 21.79 20 T_TM2_M_HEADER_IN_MSG 43330 20.53 18.73 21.69 21 MIME_HTML_ONLY 42351 28.59 40.00 21.20 22 RCVD_IN_MSPIKE_WL 38556 18.46 17.16 19.30 23 T_KAM_HTML_FONT_INVALID 37828 22.86 28.91 18.94 24 XM_B_SpammyWords2 37232 25.89 37.08 18.64 25 USER_IN_DEF_DKIM_WL 33889 11.22 2.35 16.97 26 ALL_TRUSTED 31442 10.13 1.48 15.74 27 XM_Multi_Part_URI 29704 14.89 14.91 14.87 28 RCVD_IN_MSPIKE_H3 25682 13.58 14.71 12.86 29 XM_Body_Dirty_Words 25177 16.16 21.64 12.60 30 XM_DKIMWhitelistDomains 23308 7.10 0.06 11.67 31 BAYES_60 21812 9.65 7.70 10.92 32 XM_Evil_Numbers_Gen 17950 7.82 6.01 8.99 33 UNPARSEABLE_RELAY 17874 10.61 13.18 8.95 34 T_TooManySym_01 17356 6.33 2.68 8.69 35 XM_B_Unsub 17248 11.03 14.73 8.63 36 XM_DK_Undo_02 17244 23.66 46.86 8.63 37 LotsOfNums_01 16307 6.77 4.62 8.16 38 LOTS_OF_MONEY 16198 10.87 15.13 8.11 39 BAYES_00 15875 5.00 0.46 7.95 40 BAYES_99 14890 20.23 39.94 7.45 41 TR_XM_BayesUnsub 14037 9.95 14.45 7.03 42 HTML_IMAGE_RATIO_02 13555 6.65 6.44 6.79 43 RCVD_IN_VALIDITY_SAFE 13156 5.32 3.36 6.59 44 TooManyTo_001 12914 5.47 3.93 6.46 45 BOTNET_IPINHOSTNAME 12828 8.33 11.27 6.42 46 BAYES_999 12294 16.25 31.83 6.15 47 T_TooManySym_02 12101 4.04 0.93 6.06 48 XMStrtUSub 11934 5.12 3.81 5.97 49 XM_SendGrid 11614 5.73 5.61 5.81 50 IN_ZIMBRA_NJ_WHITELIST 11288 3.44 0.04 5.65 51 RCVD_IN_VALIDITY_CERTIFIED 11105 4.45 2.75 5.56 52 TR_XM_DK_Bayes 11094 3.52 0.38 5.55 53 XM_H_Long_From01 11023 7.40 10.30 5.52 54 TR_XM_DK_Bayes1 10980 3.48 0.37 5.50 55 MPART_ALT_DIFF 10805 5.64 6.00 5.41 56 HTML_IMAGE_RATIO_04 10748 4.83 3.99 5.38 57 XM_B_SpammyWords3 10618 7.20 10.11 5.32 58 RCVD_IN_MSPIKE_H4 10354 4.03 2.25 5.18 59 XMNumbers 10241 4.58 3.74 5.13 60 TR_XM_SpammyWords4 9971 8.04 12.76 4.99 61 BAYES_80 9919 6.56 9.02 4.97 62 TR_XM_DK_Bayes2 9879 3.09 0.24 4.95 63 XM_UncommonTLD01 9759 7.42 11.33 4.89 64 TR_XM_DKIM_Undo 9681 18.26 38.97 4.85 65 XMSexyCombo_05 8291 6.61 10.41 4.15 66 RCVD_IN_IADB_LISTED 8209 3.10 1.54 4.11 67 BAYES_40 7822 2.86 1.22 3.92 68 TR_XM_DK_SendGrid 7726 3.85 3.83 3.87 69 MIME_QP_LONG_LINE 7681 3.04 1.80 3.85 70 RCVD_IN_IADB_SPF 7362 2.75 1.30 3.69 71 RELAYCOUNTRY_META 7292 13.29 28.18 3.65 72 XMSubMetaSx_00 7245 3.91 4.36 3.63 73 T_REMOTE_IMAGE 7219 6.30 10.44 3.61 74 INVALID_MSGID 7063 2.20 0.13 3.54 75 FSL_BULK_SIG 6960 8.49 16.23 3.48 76 FROM_EXCESS_BASE64 6937 3.00 2.26 3.47 77 BAYES_95 6868 4.42 5.93 3.44 78 XM_B_Phish_Phrases 6850 3.64 3.95 3.43 79 TVD_RCVD_IP 6791 2.21 0.38 3.40 80 RCVD_IN_IADB_SENDERID 6646 2.49 1.21 3.33 81 MSGID_NOFQDN1 6642 2.03 0.03 3.33 82 MIME_HTML_ONLY_MULTI 6596 3.64 4.15 3.30 83 HTML_IMAGE_RATIO_06 6461 3.09 2.86 3.23 84 RCVD_IN_IADB_DK 6449 2.44 1.22 3.23 85 DKIM_INVALID 6297 2.55 1.61 3.15 86 TO_MALFORMED 6003 1.94 0.29 3.01 87 TR_DCC_Bayes_99 5722 13.56 30.08 2.86 88 MIME_HTML_MOSTLY 5702 2.97 3.14 2.85 89 MAILING_LIST_MULTI 5403 2.07 1.10 2.70 90 BAYES_20 5353 2.00 0.96 2.68 91 RCVD_IN_IADB_VOUCHED 5323 1.94 0.82 2.66 92 TVD_SPACE_RATIO 5119 1.62 0.17 2.56 93 TR_XM_PhishingBody 5085 3.27 4.39 2.55 94 T_TooManySym_03 5052 1.71 0.44 2.53 95 XM_PDF 4850 1.54 0.18 2.43 96 TM2_M_URI_OPT_OUT 4817 2.24 1.97 2.41 97 URI_NOVOWEL 4721 2.14 1.78 2.36 98 XM_B_SpammyTLD 4437 2.92 4.01 2.22 99 TR_XM_SB_Phish 4422 1.82 1.22 2.21 100 XMSubPhish11 4412 1.80 1.16 2.21 101 T_XMDrugObfuBody_08 4280 3.00 4.32 2.14 102 XMBSHREFv2 4154 1.33 0.16 2.08 103 XM_SPF_SoftFail 4141 3.47 5.62 2.07 104 IN_HORDE_ADDRESS_BOOK 4105 1.28 0.08 2.05 105 XM_CamelCaseFrm001 3936 4.56 8.57 1.97 106 HTML_MIME_NO_HTML_TAG 3805 2.84 4.28 1.90 107 TR_Symld_Words 3694 1.71 1.50 1.85 108 BOUNCE_MESSAGE 3607 1.26 0.42 1.81 109 ANY_BOUNCE_MESSAGE 3607 1.26 0.42 1.81 110 TR_XM_SpammyRelay 3574 7.52 16.37 1.79 111 XM_H_Trusted_IP 3549 1.08 0.00 1.78 112 TM2_M_VERY_LONG_WORD 3483 2.72 4.22 1.74 113 HTML_IMAGE_RATIO_08 3456 2.29 3.16 1.73 114 XM_GoogleGroups 3447 1.96 2.33 1.73 115 RCVD_IN_IADB_OPTIN 3377 1.22 0.50 1.69 116 BAYES_05 3357 1.24 0.56 1.68 117 TR_XM_Base64_M1 3356 1.40 0.96 1.68 118 XMStockSpam_06 3255 1.53 1.38 1.63 119 TR_XM_UnparsRelay 3223 4.10 7.93 1.61 120 XMGappySubj_01 3199 1.01 0.09 1.60 121 TR_XM_SpammyWords5 3170 2.87 4.86 1.59 122 KHOP_HELO_FCRDNS 2981 1.44 1.37 1.49 123 UNTRUSTED_Relay 2975 4.71 9.69 1.49 124 T_XMDrugObfuBody_14 2949 2.64 4.44 1.48 125 XMLngstWrd_00 2939 1.73 2.13 1.47 126 FVGT_m_MULTI_ODD_EMAIL 2928 1.02 0.33 1.47 127 BOTNET 2928 6.69 14.75 1.47 128 XMDiploma_00 2828 1.65 2.02 1.42 129 SUBJ_ALL_CAPS 2715 2.16 3.38 1.36 130 XMLngstWrd_01 2689 1.64 2.10 1.35 131 URI_HEX 2686 1.21 0.99 1.34 132 RELAYCOUNTRY_CA 2553 6.11 13.58 1.28 133 RCVD_IN_MSPIKE_H5 2520 0.85 0.21 1.26 134 RCVD_IN_RP_SAFE 2486 1.05 0.74 1.24 135 TooManyTo_002 2431 0.89 0.39 1.22 136 XM_DK_Undo_01 2405 1.66 2.37 1.20 137 XMLngstWrd_02 2388 1.54 2.06 1.20 138 XM_B_Investor 2305 2.24 3.92 1.15 139 XMBdyGiftCard01 2272 1.22 1.34 1.14 140 XMBody_95 2262 0.72 0.07 1.13 141 TR_XM_SpammyWords2 2262 6.06 13.65 1.13 142 RCVD_IN_RP_CERTIFIED 2183 0.88 0.56 1.09 143 XM_B_Phish66 2146 1.55 2.28 1.07 144 XM_OfRef6 1978 2.29 4.30 0.99 145 XM_B_Unsub2 1972 1.35 1.90 0.99 146 XM_H_Long_From02 1937 1.17 1.49 0.97 147 XMLngstWrd_03 1882 1.34 1.95 0.94 148 HTML_FONT_FACE_BAD 1878 0.95 0.96 0.94 149 XMBody_17 1849 3.04 6.31 0.93 150 XM_B_COPY_HTML 1840 0.77 0.55 0.92 151 DKIM_ADSP_CUSTOM_MED 1799 0.75 0.51 0.90 152 XM_UB50 1760 1.90 3.47 0.88 153 TooManyTo_003 1755 0.65 0.31 0.88 154 XMSubNoVowel 1686 0.86 0.90 0.84 155 XMLngstWrd_04 1686 1.27 1.93 0.84 156 XM_shorewaves_Whitelist 1657 0.50 0.00 0.83 157 MPART_ALT_DIFF_COUNT 1643 1.24 1.89 0.82 158 HTML_TAG_BALANCE_BODY 1491 0.97 1.33 0.75 159 XMPhish30 1483 0.78 0.83 0.74 160 T_XMDrugObfuBody_00 1457 1.12 1.73 0.73 161 USER_IN_WELCOMELIST 1432 0.44 0.00 0.72 162 USER_IN_WHITELIST 1432 0.44 0.00 0.72 163 XMSubMetaSxObfu_02 1402 0.62 0.48 0.70 164 RCVD_IN_BL_SPAMCOP_NET 1371 7.91 19.05 0.69 165 XMSubMetaI_00 1352 0.68 0.68 0.68 166 XMBrknScrpt_02 1271 1.21 2.10 0.64 167 TR_MetaPhish_Combo_01 1252 0.64 0.66 0.63 168 TooManyTo_004 1247 0.50 0.30 0.62 169 XM_D_tchamptons_WL 1246 0.38 0.01 0.62 170 XM_ProductURIs 1242 0.66 0.73 0.62 171 HTTPS_HTTP_MISMATCH 1239 0.95 1.47 0.62 172 HTML_IMAGE_ONLY_20 1234 0.62 0.62 0.62 173 XM_H_PHPMailer 1230 0.67 0.75 0.62 174 URI_TRY_3LD 1230 0.83 1.17 0.62 175 XM_B_SpammyWords4 1213 1.14 1.97 0.61 176 UPPERCASE_75_100 1185 1.10 1.89 0.59 177 HTML_TITLE_SUBJ_DIFF 1150 1.09 1.89 0.58 178 FORGED_GMAIL_RCVD 1140 0.51 0.41 0.57 179 XMHTML_After_End 1138 0.86 1.30 0.57 180 T_FILL_THIS_FORM_SHORT 1128 2.10 4.48 0.56 181 TR_XM_PHPDW 1105 1.12 2.00 0.55 182 SpammyFromTLD_01 1094 1.76 3.63 0.55 183 PLING_QUERY 1083 0.70 0.94 0.54 184 XM_S_SubURI 1072 0.33 0.02 0.54 185 TooManyTo_005 1071 0.44 0.29 0.54 186 T_XMHurry_00 1065 0.98 1.67 0.53 187 TR_LOTS_OF_MONEY3 1052 1.71 3.54 0.53 188 XM_B_DNDMA 1045 0.71 1.00 0.52 189 NML_ADSP_CUSTOM_MED 1021 0.46 0.37 0.51 190 DATE_IN_PAST_03_06 1017 0.46 0.39 0.51 191 RCVD_IN_PSBL 1001 2.40 5.34 0.50 192 TM2_M_A_HREF_HREF 972 0.49 0.51 0.49 193 XMHTMLBadTable_001 958 0.59 0.76 0.48 194 XM_B_REG_HTML 955 0.61 0.83 0.48 195 T_OBFU_PDF_ATTACH 950 0.30 0.03 0.48 196 TR_XM_PHPForged 936 1.03 1.91 0.47 197 TR_XM_FormFill2 933 1.03 1.90 0.47 198 XM_H_PHPOS 914 1.02 1.89 0.46 199 HELO_NO_DOMAIN 912 0.46 0.46 0.46 200 HELO_NODOT 912 0.54 0.66 0.46 ----------------------------------------------------------------------