Email: 338162 Autolearn: 0 AvgScore: 5.37 AvgScanTime: 1.13 sec Spam: 131562 Autolearn: 0 AvgScore: 15.63 AvgScanTime: 1.15 sec Ham: 206600 Autolearn: 0 AvgScore: -1.16 AvgScanTime: 1.12 sec Time Spent Running SA: 106.30 hours Time Spent Processing Spam: 42.02 hours Time Spent Processing Ham: 64.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124266 86.86 94.45 82.03 2 DKIM_SIGNED 108720 80.95 82.64 79.87 3 XM_DK_Pass 107269 79.01 81.53 77.40 4 DKIM_VALID 106340 78.42 80.83 76.88 5 XM_B_Unicode 105957 73.99 80.54 69.82 6 RELAYCOUNTRY_US 98492 79.23 74.86 82.01 7 DCC_CHECK 92046 51.94 69.96 40.46 8 XMListUnsubscribeExists 88744 61.67 67.45 57.99 9 DKIM_VALID_AU 82219 64.48 62.49 65.74 10 XM_B_SpammyWords 79947 50.99 60.77 44.76 11 XM_DK_Undo_02 57750 22.38 43.90 8.69 12 MIME_HTML_ONLY 56031 30.21 42.59 22.33 13 RCVD_IN_MSPIKE_H2 53796 40.81 40.89 40.76 14 BAYES_99 51990 19.70 39.52 7.08 15 XM_B_Unicode3 49394 41.09 37.54 43.35 16 BAYES_50 46838 49.33 35.60 58.07 17 TR_XM_DKIM_Undo 46585 17.07 35.41 5.38 18 DKIM_VALID_EF 44576 31.93 33.88 30.68 19 XM_B_SpammyWords2 43946 24.18 33.40 18.30 20 BAYES_999 41995 16.02 31.92 5.90 21 LOC_TINY_FONT_1 41931 30.21 31.87 29.15 22 FVGT_m_MULTI_ODD 41455 29.99 31.51 29.02 23 HTML_FONT_LOW_CONTRAST 40153 32.08 30.52 33.08 24 DCC_CHECK_NEGATIVE 39492 48.04 30.02 59.52 25 RELAYCOUNTRY_META 38547 13.78 29.30 3.89 26 TR_DCC_Bayes_99 38514 13.21 29.27 2.98 27 T_KAM_HTML_FONT_INVALID 36339 22.21 27.62 18.77 28 XM_Body_Dirty_Words 26047 16.37 19.80 14.18 29 RCVD_IN_MSPIKE_WL 24327 19.72 18.49 20.50 30 T_TM2_M_HEADER_IN_MSG 22865 20.53 17.38 22.53 31 XMSubLong 22441 20.28 17.06 22.33 32 RCVD_IN_MSPIKE_H3 21180 14.49 16.10 13.47 33 RCVD_IN_BL_SPAMCOP_NET 20861 6.55 15.86 0.62 34 XM_Multi_Part_URI 20132 14.87 15.30 14.59 35 BOTNET 19133 6.62 14.54 1.58 36 FSL_BULK_SIG 19086 7.38 14.51 2.84 37 TR_XM_SpammyRelay 18936 6.38 14.39 1.28 38 XM_UncommonTLD01 17759 8.50 13.50 5.32 39 XM_B_Unsub 17447 9.94 13.26 7.83 40 TR_XM_BayesUnsub 17123 9.00 13.02 6.45 41 UNPARSEABLE_RELAY 17065 10.59 12.97 9.08 42 RELAYCOUNTRY_CA 16456 5.60 12.51 1.20 43 TR_XM_SpammyWords2 16274 5.85 12.37 1.70 44 LOTS_OF_MONEY 16043 9.21 12.19 7.31 45 UNTRUSTED_Relay 15067 5.30 11.45 1.39 46 BOTNET_IPINHOSTNAME 14854 8.14 11.29 6.14 47 TR_XM_SpammyWords4 14275 7.35 10.85 5.12 48 XMSexyCombo_05 12711 7.09 9.66 5.45 49 T_REMOTE_IMAGE 12670 5.83 9.63 3.41 50 XM_B_SpammyWords3 12628 6.60 9.60 4.68 51 TR_XM_SPAMCOP 12592 3.85 9.57 0.21 52 MPART_ALT_DIFF 12243 7.25 9.31 5.94 53 XM_H_Long_From01 11872 6.40 9.02 4.72 54 BAYES_80 11466 6.33 8.72 4.82 55 RCVD_IN_VALIDITY_RPBL 11265 3.38 8.56 0.08 56 TR_XM_UnparsRelay 10840 4.12 8.24 1.49 57 XM_CamelCaseFrm001 10707 4.43 8.14 2.07 58 RCVD_IN_MSPIKE_BL 10182 3.15 7.74 0.22 59 BAYES_60 9940 9.45 7.56 10.65 60 TR_XM_MSPIKECOMBO 9639 2.99 7.33 0.22 61 HTML_MIME_NO_HTML_TAG 9532 4.51 7.25 2.76 62 MIME_HTML_ONLY_MULTI 9213 5.08 7.00 3.85 63 TM2_M_VERY_LONG_WORD 8799 4.22 6.69 2.65 64 HTML_IMAGE_ONLY_24 8299 2.63 6.31 0.28 65 XM_SPF_SoftFail 8210 3.46 6.24 1.69 66 HTTP_EXCESSIVE_ESCAPES 8202 2.45 6.23 0.03 67 XMStrtUSub 8107 6.25 6.16 6.31 68 HTML_IMAGE_RATIO_02 7909 7.01 6.01 7.65 69 XM_SendGrid 7718 5.89 5.87 5.90 70 XM_Evil_Numbers_Gen 7335 7.99 5.58 9.53 71 XM_GoogleGroups 7114 4.36 5.41 3.70 72 BOTNET_NORDNS 6991 2.07 5.31 0.01 73 XMLngstWrd_00 6882 3.50 5.23 2.39 74 XMLngstWrd_01 6838 3.39 5.20 2.24 75 XMLngstWrd_02 6785 3.26 5.16 2.06 76 RCVD_IN_PSBL 6663 2.39 5.06 0.68 77 BAYES_95 6618 3.91 5.03 3.20 78 HTML_TITLE_SUBJ_DIFF 6583 2.90 5.00 1.55 79 XMLngstWrd_03 6551 3.10 4.98 1.91 80 XMSubMetaSx_00 6550 4.75 4.98 4.61 81 XMLngstWrd_04 6514 3.03 4.95 1.81 82 XM_UB50 6468 2.43 4.92 0.85 83 UPPERCASE_75_100 6465 2.85 4.91 1.53 84 T_FILL_THIS_FORM_SHORT 6458 2.24 4.91 0.54 85 SpammyFromTLD_02 6282 1.99 4.77 0.22 86 XMBody_17 6183 2.37 4.70 0.89 87 T_XMDrugObfuBody_14 6154 2.69 4.68 1.42 88 T_XMDrugObfuBody_08 6154 2.54 4.68 1.18 89 TooManyTo_001 6019 5.56 4.58 6.19 90 SpammyFromTLD_01 5917 2.50 4.50 1.23 91 TR_XM_PhishingBody 5662 3.18 4.30 2.46 92 HTML_IMAGE_RATIO_04 5603 5.02 4.26 5.50 93 LotsOfNums_01 5527 6.53 4.20 8.01 94 TR_XM_SpammyWords5 5360 2.55 4.07 1.57 95 HTML_IMAGE_RATIO_08 5247 3.11 3.99 2.55 96 RCVD_IN_VALIDITY_SAFE 5181 5.85 3.94 7.06 97 XMNumbers 5170 4.70 3.93 5.19 98 XM_DIRTYINTL 5140 1.66 3.91 0.23 99 XM_B_SpammyTLD 5099 2.94 3.88 2.34 100 FONT_INVIS_LONG_LINE 5078 1.59 3.86 0.15 101 XM_OfRef6 4777 2.03 3.63 1.01 102 TR_XM_DK_SendGrid 4762 3.79 3.62 3.89 103 RCVD_IN_MSPIKE_L5 4741 1.41 3.60 0.01 104 TR_LOTS_OF_MONEY3 4717 1.72 3.59 0.54 105 XM_B_Phish_Phrases 4572 3.36 3.48 3.29 106 MIME_BASE64_TEXT 4481 1.41 3.41 0.14 107 RCVD_IN_MSPIKE_L3 4389 1.43 3.34 0.21 108 MIME_HTML_MOSTLY 4330 3.34 3.29 3.36 109 TR_XM_MSPIKECOMBO2 4255 1.28 3.23 0.03 110 HTTPS_HTTP_MISMATCH 4244 1.74 3.23 0.79 111 RCVD_IN_VALIDITY_CERTIFIED 4156 5.04 3.16 6.24 112 XM_UB99 4069 1.21 3.09 0.00 113 TR_XM_SpammyWords3 3887 1.21 2.95 0.10 114 XM_URI_RBL 3854 1.22 2.93 0.13 115 HTML_IMAGE_RATIO_06 3843 3.75 2.92 4.27 116 HK_RANDOM_REPLYTO 3799 1.17 2.89 0.08 117 XM_B_Investor 3514 1.83 2.67 1.29 118 TR_XM_FormFill 3471 1.04 2.64 0.03 119 TVD_RCVD_SPACE_BRACKET 3453 1.02 2.62 0.00 120 XMBrknScrpt_02 3395 1.54 2.58 0.88 121 SUBJ_ALL_CAPS 3350 1.76 2.55 1.25 122 XM_UB999 3308 0.98 2.51 0.00 123 TR_XM_PHPDW 3251 1.67 2.47 1.16 124 T_XMHurry_00 3174 1.46 2.41 0.86 125 TR_XM_PHPForged 3133 1.59 2.38 1.09 126 TR_XM_FormFill2 3098 1.58 2.35 1.08 127 XM_H_PHPOS 3090 1.57 2.35 1.07 128 RELAYCOUNTRY_RU 3062 0.92 2.33 0.02 129 XM_DK_Undo_01 3045 1.59 2.31 1.13 130 T_TooManySym_01 3025 6.11 2.30 8.53 131 XM_B_Phish66 2975 1.45 2.26 0.93 132 RCVD_IN_MSPIKE_H4 2950 4.38 2.24 5.75 133 RELAYCOUNTRY_CN 2818 0.87 2.14 0.06 134 PDS_OTHER_BAD_TLD 2794 0.95 2.12 0.20 135 XMDiploma_00 2742 1.57 2.08 1.24 136 URIBL_DBL_SPAM 2739 0.82 2.08 0.01 137 TR_XM_BayesRelay 2672 0.79 2.03 0.00 138 USER_IN_DEF_DKIM_WL 2567 11.54 1.95 17.64 139 TM2_M_URI_OPT_OUT 2527 2.08 1.92 2.18 140 DKIM_INVALID 2380 2.53 1.81 2.99 141 TR_XM_InvalidRelay 2362 0.71 1.80 0.02 142 DKIM_ADSP_NXDOMAIN 2348 0.94 1.78 0.40 143 NO_DNS_FOR_FROM 2303 0.94 1.75 0.43 144 TR_XM_MaxWHORU 2264 0.83 1.72 0.26 145 URI_NOVOWEL 2236 1.82 1.70 1.90 146 FROM_EXCESS_BASE64 2231 2.66 1.70 3.28 147 NORDNS_LOW_CONTRAST 2186 0.67 1.66 0.03 148 MPART_ALT_DIFF_COUNT 2134 1.18 1.62 0.89 149 RCVD_IN_RP_RNBL 2128 0.64 1.62 0.02 150 XM_B_COPY_HTML 2103 1.19 1.60 0.94 151 XMSexyCombo_01 2080 1.37 1.58 1.23 152 MIME_QP_LONG_LINE 2064 2.64 1.57 3.32 153 TR_Symld_Words 2054 1.59 1.56 1.61 154 XM_B_Unsub2 2027 1.12 1.54 0.85 155 XM_B_SpammyWords4 1992 1.22 1.51 1.04 156 XM_H_Undi_Recip 1989 0.69 1.51 0.16 157 HTML_TAG_BALANCE_BODY 1933 0.96 1.47 0.63 158 MultiRelay_CC 1922 0.57 1.46 0.00 159 HTML_FONT_TINY_NORDNS 1918 0.60 1.46 0.06 160 URI_TRY_3LD 1917 0.95 1.46 0.63 161 TR_XM_MaxSPIKE 1902 0.58 1.45 0.03 162 T_XMDrugObfuBody_00 1891 0.99 1.44 0.70 163 TR_XM_NoHeaderRelay 1822 0.60 1.38 0.11 164 XMClaimOffer 1811 0.61 1.38 0.13 165 MAILING_LIST_MULTI 1725 2.27 1.31 2.89 166 RELAYCOUNTRY_BD 1716 0.51 1.30 0.00 167 XMStockSpam_06 1672 2.03 1.27 2.52 168 KHOP_HELO_FCRDNS 1670 1.08 1.27 0.96 169 BAYES_40 1647 2.93 1.25 4.00 170 HTML_FONT_FACE_BAD 1646 1.16 1.25 1.10 171 BAYES_20 1632 2.30 1.24 2.97 172 XM_HighProb1 1625 0.48 1.24 0.00 173 FROM_SUSPICIOUS_NTLD 1604 0.49 1.22 0.03 174 TR_Caps_n_Bayes_99 1573 0.53 1.20 0.11 175 XM_H_Long_From02 1557 1.15 1.18 1.13 176 XM_UB60 1532 0.50 1.16 0.08 177 XM_UB80 1525 0.46 1.16 0.02 178 XMSubNoVowel 1520 1.01 1.16 0.91 179 RCVD_IN_IADB_LISTED 1492 2.43 1.13 3.25 180 RELAYCOUNTRY_FR 1485 0.54 1.13 0.17 181 ALL_TRUSTED 1475 9.68 1.12 15.12 182 XMBdyGiftCard01 1474 1.22 1.12 1.28 183 TR_XM_SpoofStaff 1466 0.54 1.11 0.18 184 LONGLN_LOW_CONTRAST 1456 0.66 1.11 0.37 185 XMSpoofStaff2 1455 0.54 1.11 0.18 186 TR_XM_SB_Phish 1454 1.40 1.11 1.60 187 PDS_FROM_NAME_TO_DOMAIN 1452 0.43 1.10 0.00 188 PDS_FRNOM_TODOM_NAKED_TO 1450 0.43 1.10 0.00 189 URI_WP_HACKED 1442 0.43 1.10 0.00 190 XMSubPhish11 1441 1.40 1.10 1.59 191 XM_H_SpoofStaff4 1436 0.54 1.09 0.19 192 TR_XM_PSC1 1435 0.53 1.09 0.18 193 TO_EQ_FM_DOM_HTML_ONLY 1433 0.44 1.09 0.02 194 RELAYCOUNTRY_NG 1432 0.42 1.09 0.00 195 TO_NO_BRKTS_HTML_IMG 1426 0.43 1.08 0.01 196 TR_XM_SpoofStaff2 1400 0.41 1.06 0.00 197 RELAYCOUNTRY_DE 1394 0.62 1.06 0.33 198 XM_UCStrings02 1393 0.45 1.06 0.07 199 URIBL_DBL_ABUSE_SPAM 1384 0.42 1.05 0.02 200 XMSubMetaI_00 1374 0.90 1.04 0.80 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 169469 86.86 94.45 82.03 2 RELAYCOUNTRY_US 169441 79.23 74.86 82.01 3 DKIM_SIGNED 165007 80.95 82.64 79.87 4 XM_DK_Pass 159901 79.01 81.53 77.40 5 DKIM_VALID 158833 78.42 80.83 76.88 6 XM_B_Unicode 144238 73.99 80.54 69.82 7 DKIM_VALID_AU 135821 64.48 62.49 65.74 8 DCC_CHECK_NEGATIVE 122961 48.04 30.02 59.52 9 BAYES_50 119982 49.33 35.60 58.07 10 XMListUnsubscribeExists 119813 61.67 67.45 57.99 11 XM_B_SpammyWords 92468 50.99 60.77 44.76 12 XM_B_Unicode3 89566 41.09 37.54 43.35 13 RCVD_IN_MSPIKE_H2 84213 40.81 40.89 40.76 14 DCC_CHECK 83588 51.94 69.96 40.46 15 HTML_FONT_LOW_CONTRAST 68346 32.08 30.52 33.08 16 DKIM_VALID_EF 63389 31.93 33.88 30.68 17 LOC_TINY_FONT_1 60215 30.21 31.87 29.15 18 FVGT_m_MULTI_ODD 59946 29.99 31.51 29.02 19 T_TM2_M_HEADER_IN_MSG 46545 20.53 17.38 22.53 20 MIME_HTML_ONLY 46129 30.21 42.59 22.33 21 XMSubLong 46128 20.28 17.06 22.33 22 RCVD_IN_MSPIKE_WL 42359 19.72 18.49 20.50 23 T_KAM_HTML_FONT_INVALID 38779 22.21 27.62 18.77 24 XM_B_SpammyWords2 37812 24.18 33.40 18.30 25 USER_IN_DEF_DKIM_WL 36446 11.54 1.95 17.64 26 ALL_TRUSTED 31246 9.68 1.12 15.12 27 XM_Multi_Part_URI 30142 14.87 15.30 14.59 28 XM_Body_Dirty_Words 29302 16.37 19.80 14.18 29 RCVD_IN_MSPIKE_H3 27820 14.49 16.10 13.47 30 XM_DKIMWhitelistDomains 25854 7.68 0.10 12.51 31 BAYES_60 22010 9.45 7.56 10.65 32 XM_Evil_Numbers_Gen 19695 7.99 5.58 9.53 33 UNPARSEABLE_RELAY 18755 10.59 12.97 9.08 34 XM_DK_Undo_02 17944 22.38 43.90 8.69 35 T_TooManySym_01 17632 6.11 2.30 8.53 36 LotsOfNums_01 16544 6.53 4.20 8.01 37 XM_B_Unsub 16168 9.94 13.26 7.83 38 HTML_IMAGE_RATIO_02 15808 7.01 6.01 7.65 39 BAYES_00 15522 4.76 0.45 7.51 40 LOTS_OF_MONEY 15099 9.21 12.19 7.31 41 BAYES_99 14624 19.70 39.52 7.08 42 RCVD_IN_VALIDITY_SAFE 14588 5.85 3.94 7.06 43 TR_XM_BayesUnsub 13327 9.00 13.02 6.45 44 XMStrtUSub 13034 6.25 6.16 6.31 45 RCVD_IN_VALIDITY_CERTIFIED 12893 5.04 3.16 6.24 46 TooManyTo_001 12790 5.56 4.58 6.19 47 BOTNET_IPINHOSTNAME 12680 8.14 11.29 6.14 48 MPART_ALT_DIFF 12262 7.25 9.31 5.94 49 BAYES_999 12195 16.02 31.92 5.90 50 XM_SendGrid 12188 5.89 5.87 5.90 51 T_TooManySym_02 12179 3.81 0.53 5.89 52 RCVD_IN_MSPIKE_H4 11875 4.38 2.24 5.75 53 HTML_IMAGE_RATIO_04 11357 5.02 4.26 5.50 54 TR_XM_DK_Bayes 11308 3.48 0.36 5.47 55 XMSexyCombo_05 11270 7.09 9.66 5.45 56 TR_XM_DK_Bayes1 11215 3.46 0.36 5.43 57 IN_ZIMBRA_NJ_WHITELIST 11128 3.31 0.04 5.39 58 TR_XM_DKIM_Undo 11124 17.07 35.41 5.38 59 XM_UncommonTLD01 10992 8.50 13.50 5.32 60 XMNumbers 10727 4.70 3.93 5.19 61 TR_XM_SpammyWords4 10581 7.35 10.85 5.12 62 TR_XM_DK_Bayes2 10311 3.16 0.28 4.99 63 BAYES_80 9951 6.33 8.72 4.82 64 XM_H_Long_From01 9755 6.40 9.02 4.72 65 XM_B_SpammyWords3 9674 6.60 9.60 4.68 66 XMSubMetaSx_00 9518 4.75 4.98 4.61 67 HTML_IMAGE_RATIO_06 8825 3.75 2.92 4.27 68 BAYES_40 8272 2.93 1.25 4.00 69 RELAYCOUNTRY_META 8047 13.78 29.30 3.89 70 TR_XM_DK_SendGrid 8043 3.79 3.62 3.89 71 MIME_HTML_ONLY_MULTI 7962 5.08 7.00 3.85 72 XM_GoogleGroups 7636 4.36 5.41 3.70 73 T_REMOTE_IMAGE 7044 5.83 9.63 3.41 74 MIME_HTML_MOSTLY 6950 3.34 3.29 3.36 75 INVALID_MSGID 6920 2.14 0.23 3.35 76 MIME_QP_LONG_LINE 6861 2.64 1.57 3.32 77 XM_B_Phish_Phrases 6793 3.36 3.48 3.29 78 FROM_EXCESS_BASE64 6774 2.66 1.70 3.28 79 RCVD_IN_IADB_LISTED 6724 2.43 1.13 3.25 80 MSGID_NOFQDN1 6662 2.01 0.10 3.22 81 BAYES_95 6613 3.91 5.03 3.20 82 XM_PDF 6286 1.95 0.24 3.04 83 DKIM_INVALID 6174 2.53 1.81 2.99 84 TR_DCC_Bayes_99 6161 13.21 29.27 2.98 85 BAYES_20 6146 2.30 1.24 2.97 86 RCVD_IN_IADB_SPF 6004 2.17 1.01 2.91 87 MAILING_LIST_MULTI 5965 2.27 1.31 2.89 88 TO_MALFORMED 5963 1.81 0.11 2.89 89 TVD_RCVD_IP 5911 1.91 0.42 2.86 90 FSL_BULK_SIG 5859 7.38 14.51 2.84 91 HTML_MIME_NO_HTML_TAG 5712 4.51 7.25 2.76 92 RCVD_IN_IADB_SENDERID 5482 1.99 0.95 2.65 93 TM2_M_VERY_LONG_WORD 5469 4.22 6.69 2.65 94 RCVD_IN_IADB_DK 5325 1.95 0.96 2.58 95 TVD_SPACE_RATIO 5264 1.60 0.11 2.55 96 HTML_IMAGE_RATIO_08 5259 3.11 3.99 2.55 97 T_TooManySym_03 5238 1.68 0.33 2.54 98 XMStockSpam_06 5201 2.03 1.27 2.52 99 TR_XM_PhishingBody 5076 3.18 4.30 2.46 100 XMLngstWrd_00 4948 3.50 5.23 2.39 101 XM_B_SpammyTLD 4834 2.94 3.88 2.34 102 XMLngstWrd_01 4637 3.39 5.20 2.24 103 TM2_M_URI_OPT_OUT 4510 2.08 1.92 2.18 104 XM_CamelCaseFrm001 4280 4.43 8.14 2.07 105 IN_HORDE_ADDRESS_BOOK 4254 1.29 0.07 2.06 106 XMLngstWrd_02 4247 3.26 5.16 2.06 107 RCVD_IN_IADB_VOUCHED 4216 1.50 0.65 2.04 108 XMBSHREFv2 4210 1.28 0.09 2.04 109 XMLngstWrd_03 3948 3.10 4.98 1.91 110 URI_NOVOWEL 3923 1.82 1.70 1.90 111 XM_H_Trusted_IP 3890 1.15 0.00 1.88 112 XMLngstWrd_04 3744 3.03 4.95 1.81 113 ANY_BOUNCE_MESSAGE 3518 1.19 0.38 1.70 114 BOUNCE_MESSAGE 3518 1.19 0.38 1.70 115 TR_XM_SpammyWords2 3513 5.85 12.37 1.70 116 XM_SPF_SoftFail 3498 3.46 6.24 1.69 117 BAYES_05 3480 1.28 0.64 1.68 118 TR_Symld_Words 3316 1.59 1.56 1.61 119 TR_XM_SB_Phish 3296 1.40 1.11 1.60 120 XMSubPhish11 3286 1.40 1.10 1.59 121 BOTNET 3254 6.62 14.54 1.58 122 TR_XM_SpammyWords5 3248 2.55 4.07 1.57 123 HTML_TITLE_SUBJ_DIFF 3209 2.90 5.00 1.55 124 UPPERCASE_75_100 3170 2.85 4.91 1.53 125 TR_XM_UnparsRelay 3079 4.12 8.24 1.49 126 T_XMDrugObfuBody_14 2943 2.69 4.68 1.42 127 FVGT_m_MULTI_ODD_EMAIL 2925 0.98 0.30 1.42 128 UNTRUSTED_Relay 2863 5.30 11.45 1.39 129 RCVD_IN_RP_SAFE 2815 1.15 0.81 1.36 130 RCVD_IN_IADB_OPTIN 2777 0.98 0.42 1.34 131 XM_B_Investor 2675 1.83 2.67 1.29 132 XMGappySubj_01 2674 0.81 0.06 1.29 133 RCVD_IN_MSPIKE_H5 2664 0.85 0.15 1.29 134 XMSubMetaSxObfu_03 2652 0.97 0.48 1.28 135 XMBdyGiftCard01 2647 1.22 1.12 1.28 136 TR_XM_SpammyRelay 2646 6.38 14.39 1.28 137 XM_RXBody 2635 1.05 0.69 1.28 138 TR_XM_Base64_M1 2595 1.09 0.83 1.26 139 SUBJ_ALL_CAPS 2590 1.76 2.55 1.25 140 XMDiploma_00 2565 1.57 2.08 1.24 141 XMSexyCombo_01 2539 1.37 1.58 1.23 142 SpammyFromTLD_01 2536 2.50 4.50 1.23 143 RCVD_IN_RP_CERTIFIED 2515 0.99 0.64 1.22 144 RELAYCOUNTRY_CA 2480 5.60 12.51 1.20 145 URI_HEX 2448 1.06 0.87 1.18 146 TVD_PH_BODY_ACCOUNTS_PRE 2431 0.79 0.17 1.18 147 T_XMDrugObfuBody_08 2429 2.54 4.68 1.18 148 TooManyTo_002 2399 0.85 0.36 1.16 149 TR_XM_PHPDW 2392 1.67 2.47 1.16 150 XMBody_95 2340 0.71 0.05 1.13 151 XM_DK_Undo_01 2329 1.59 2.31 1.13 152 XM_H_Long_From02 2328 1.15 1.18 1.13 153 HTML_FONT_FACE_BAD 2271 1.16 1.25 1.10 154 TR_XM_PHPForged 2242 1.59 2.38 1.09 155 TR_XM_FormFill2 2229 1.58 2.35 1.08 156 XM_H_PHPOS 2214 1.57 2.35 1.07 157 XM_B_SpammyWords4 2145 1.22 1.51 1.04 158 XM_OfRef6 2086 2.03 3.63 1.01 159 KHOP_HELO_FCRDNS 1975 1.08 1.27 0.96 160 XM_B_COPY_HTML 1932 1.19 1.60 0.94 161 XM_B_Phish66 1919 1.45 2.26 0.93 162 XMPhish30 1892 0.93 0.96 0.92 163 HTML_IMAGE_ONLY_20 1887 0.82 0.68 0.91 164 XMSubNoVowel 1882 1.01 1.16 0.91 165 XMSexyCombo_04 1870 0.91 0.91 0.91 166 MPART_ALT_DIFF_COUNT 1842 1.18 1.62 0.89 167 XMBody_17 1837 2.37 4.70 0.89 168 TooManyTo_003 1831 0.67 0.32 0.89 169 XMBrknScrpt_02 1828 1.54 2.58 0.88 170 T_XMHurry_00 1772 1.46 2.41 0.86 171 XM_UB50 1766 2.43 4.92 0.85 172 T_MANY_PILL_PRICE 1765 0.52 0.00 0.85 173 XM_B_Unsub2 1758 1.12 1.54 0.85 174 DKIM_ADSP_CUSTOM_MED 1738 0.76 0.62 0.84 175 XMSubMetaSxObfu_02 1684 0.61 0.28 0.82 176 XMSubMetaI_00 1659 0.90 1.04 0.80 177 HTTPS_HTTP_MISMATCH 1628 1.74 3.23 0.79 178 XM_ProductURIs 1588 0.72 0.64 0.77 179 T_XMDrugObfuBody_00 1448 0.99 1.44 0.70 180 RCVD_IN_PSBL 1407 2.39 5.06 0.68 181 TooManyTo_004 1389 0.53 0.29 0.67 182 XM_H_PHPMailer 1321 0.70 0.80 0.64 183 XMHTML_After_End 1315 0.71 0.83 0.64 184 URI_TRY_3LD 1307 0.95 1.46 0.63 185 HTML_TAG_BALANCE_BODY 1302 0.96 1.47 0.63 186 USER_IN_WELCOMELIST 1296 0.38 0.00 0.63 187 USER_IN_WHITELIST 1296 0.38 0.00 0.63 188 RCVD_IN_BL_SPAMCOP_NET 1288 6.55 15.86 0.62 189 TR_MetaPhish_Combo_01 1243 0.61 0.63 0.60 190 XM_Walgreens_Forge 1238 0.37 0.00 0.60 191 XM_B_REG_HTML 1209 0.73 0.96 0.59 192 TooManyTo_005 1134 0.44 0.28 0.55 193 TR_LOTS_OF_MONEY3 1116 1.72 3.59 0.54 194 T_FILL_THIS_FORM_SHORT 1109 2.24 4.91 0.54 195 FORGED_GMAIL_RCVD 1084 0.51 0.49 0.52 196 XMHTMLBadTable_001 1078 0.62 0.78 0.52 197 XM_S_SubURI 1051 0.32 0.02 0.51 198 NML_ADSP_CUSTOM_MED 1043 0.50 0.49 0.50 199 XMGenDplmaNmb 1027 0.63 0.84 0.50 200 DATE_IN_PAST_03_06 1008 0.46 0.41 0.49 ----------------------------------------------------------------------