Email: 300581 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 1.20 sec Spam: 102888 Autolearn: 0 AvgScore: 13.91 AvgScanTime: 1.31 sec Ham: 197693 Autolearn: 0 AvgScore: -1.29 AvgScanTime: 1.14 sec Time Spent Running SA: 100.09 hours Time Spent Processing Spam: 37.30 hours Time Spent Processing Ham: 62.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95020 85.93 92.35 82.58 2 DKIM_SIGNED 92406 80.16 89.81 75.14 3 XM_DK_Pass 91216 78.26 88.66 72.84 4 DKIM_VALID 90411 77.67 87.87 72.37 5 XM_B_Unicode 81441 74.34 79.16 71.84 6 RELAYCOUNTRY_US 79990 76.92 77.74 76.48 7 XMListUnsubscribeExists 75043 59.60 72.94 52.65 8 DKIM_VALID_AU 73525 65.06 71.46 61.73 9 DCC_CHECK 72614 50.52 70.58 40.08 10 XM_B_SpammyWords 70864 51.52 68.87 42.49 11 RCVD_IN_MSPIKE_H2 48530 41.06 47.17 37.89 12 XM_DK_Undo_02 48246 21.27 46.89 7.94 13 XM_B_Unicode3 44147 41.85 42.91 41.31 14 TR_XM_DKIM_Undo 38914 16.34 37.82 5.15 15 LOC_TINY_FONT_1 38815 31.93 37.73 28.91 16 BAYES_99 38503 17.07 37.42 6.48 17 XM_B_SpammyWords2 38290 24.45 37.22 17.81 18 BAYES_50 38003 51.52 36.94 59.12 19 FVGT_m_MULTI_ODD 35371 29.36 34.38 26.75 20 DKIM_VALID_EF 34870 30.59 33.89 28.88 21 HTML_FONT_LOW_CONTRAST 34177 31.83 33.22 31.11 22 MIME_HTML_ONLY 31850 27.17 30.96 25.20 23 BAYES_999 30724 13.72 29.86 5.33 24 DCC_CHECK_NEGATIVE 30254 49.46 29.40 59.90 25 T_KAM_HTML_FONT_INVALID 28543 24.53 27.74 22.85 26 TR_DCC_Bayes_99 27429 10.88 26.66 2.66 27 RELAYCOUNTRY_META 25022 10.92 24.32 3.94 28 XM_Body_Dirty_Words 23169 16.12 22.52 12.78 29 XMSubLong 21376 22.30 20.78 23.09 30 T_TM2_M_HEADER_IN_MSG 20075 21.00 19.51 21.78 31 XM_Multi_Part_URI 19411 18.80 18.87 18.76 32 TR_XM_SpammyRelay 17906 7.21 17.40 1.91 33 RCVD_IN_MSPIKE_WL 17648 18.85 17.15 19.74 34 RCVD_IN_MSPIKE_H3 15078 13.03 14.65 12.19 35 XM_B_Unsub 14726 9.87 14.31 7.56 36 TR_XM_BayesUnsub 14504 9.14 14.10 6.56 37 XM_UncommonTLD01 13780 7.90 13.39 5.04 38 BOTNET_IPINHOSTNAME 13722 8.74 13.34 6.34 39 TR_XM_SpammyWords2 13193 5.45 12.82 1.61 40 RELAYCOUNTRY_CA 12230 4.99 11.89 1.40 41 UNPARSEABLE_RELAY 12058 10.19 11.72 9.39 42 XM_B_SpammyWords3 11333 6.72 11.01 4.48 43 MPART_ALT_DIFF 10790 7.50 10.49 5.94 44 LOTS_OF_MONEY 10768 6.95 10.47 5.12 45 XMSexyCombo_05 10375 6.32 10.08 4.36 46 RCVD_IN_BL_SPAMCOP_NET 9825 3.55 9.55 0.43 47 BOTNET 9759 4.20 9.49 1.45 48 FSL_BULK_SIG 9632 6.95 9.36 5.70 49 UNTRUSTED_Relay 9282 4.09 9.02 1.52 50 BAYES_80 9222 6.20 8.96 4.76 51 TR_XM_SpammyWords4 9027 5.38 8.77 3.61 52 BAYES_60 7950 9.75 7.73 10.81 53 TR_XM_UnparsRelay 7705 3.75 7.49 1.80 54 XM_Evil_Numbers_Gen 7424 7.89 7.22 8.24 55 XMSubMetaSx_00 7396 4.79 7.19 3.54 56 TR_XM_SPAMCOP 7277 2.54 7.07 0.18 57 HTML_IMAGE_RATIO_02 7103 6.97 6.90 7.01 58 MIME_HTML_ONLY_MULTI 7026 4.39 6.83 3.11 59 XMBody_17 6880 3.13 6.69 1.27 60 TooManyTo_001 6852 6.66 6.66 6.65 61 TR_XM_PhishingBody 6674 4.38 6.49 3.29 62 XM_B_SpammyTLD 6574 3.56 6.39 2.09 63 XM_SendGrid 6410 6.24 6.23 6.25 64 SpammyFromTLD_02 6356 2.23 6.18 0.17 65 TM2_M_VERY_LONG_WORD 6297 3.38 6.12 1.96 66 T_FILL_THIS_FORM_SHORT 6152 2.48 5.98 0.66 67 XM_OfRef6 5909 2.64 5.74 1.03 68 T_XMDrugObfuBody_08 5454 2.62 5.30 1.22 69 LotsOfNums_01 5427 6.41 5.27 7.00 70 BAYES_95 5391 3.87 5.24 3.15 71 HTML_MIME_NO_HTML_TAG 5182 3.00 5.04 1.94 72 XM_H_Long_From01 5161 4.82 5.02 4.72 73 TR_XM_SpammyWords5 5070 2.49 4.93 1.22 74 XM_SPF_SoftFail 5034 5.76 4.89 6.20 75 MIME_HTML_MOSTLY 4754 4.14 4.62 3.89 76 XM_B_Investor 4706 2.39 4.57 1.26 77 XM_GoogleGroups 4547 2.82 4.42 1.99 78 XMLngstWrd_00 4477 2.45 4.35 1.47 79 XM_B_Phish_Phrases 4464 3.35 4.34 2.84 80 XMStrtUSub 4463 6.07 4.34 6.98 81 XMLngstWrd_01 4459 2.39 4.33 1.38 82 HTML_IMAGE_RATIO_04 4386 4.79 4.26 5.07 83 XMLngstWrd_02 4371 2.27 4.25 1.23 84 RCVD_IN_VALIDITY_SAFE 4360 5.98 4.24 6.88 85 T_XMDrugObfuBody_14 4357 3.06 4.23 2.45 86 TR_XM_DK_SendGrid 4354 4.33 4.23 4.38 87 UPPERCASE_75_100 4344 1.98 4.22 0.81 88 XM_UB50 4271 2.09 4.15 1.01 89 RCVD_IN_MSPIKE_BL 4270 1.66 4.15 0.36 90 TR_XM_MSPIKECOMBO 4256 1.65 4.14 0.36 91 SpammyFromTLD_01 4170 1.81 4.05 0.65 92 TR_XM_FormFill 4006 1.35 3.89 0.02 93 PDS_OTHER_BAD_TLD 4003 1.54 3.89 0.31 94 HTML_TITLE_SUBJ_DIFF 4002 1.85 3.89 0.79 95 XMLngstWrd_03 4001 2.06 3.89 1.10 96 XMLngstWrd_04 3961 2.00 3.85 1.03 97 XM_DIRTYINTL 3931 1.50 3.82 0.29 98 XMNumbers 3760 4.93 3.65 5.60 99 FROM_SUSPICIOUS_NTLD 3711 1.30 3.61 0.10 100 LongTLD 3484 1.30 3.39 0.21 101 XM_B_Phish66 3434 1.86 3.34 1.08 102 RCVD_IN_VALIDITY_CERTIFIED 3424 5.20 3.33 6.18 103 URIBL_DBL_SPAM 3419 1.14 3.32 0.00 104 FROM_SUSPICIOUS_NTLD_FP 3406 1.18 3.31 0.07 105 SUBJ_ALL_CAPS 3394 1.78 3.30 0.98 106 RCVD_IN_MSPIKE_L3 3232 1.29 3.14 0.33 107 TR_Mismatch_TLD_02 3143 1.11 3.05 0.09 108 FONT_INVIS_LONG_LINE 3127 1.12 3.04 0.13 109 USER_IN_DEF_DKIM_WL 3059 12.30 2.97 17.15 110 KHOP_HELO_FCRDNS 2944 1.84 2.86 1.32 111 HTML_IMAGE_RATIO_08 2935 2.58 2.85 2.44 112 TR_XM_SpammyWords3 2911 1.10 2.83 0.20 113 T_TooManySym_01 2826 6.87 2.75 9.01 114 HTML_IMAGE_RATIO_06 2765 3.35 2.69 3.70 115 URI_NOVOWEL 2536 1.96 2.46 1.70 116 XM_DK_Undo_01 2468 1.62 2.40 1.21 117 TM2_M_URI_OPT_OUT 2453 1.79 2.38 1.48 118 T_XMHurry_00 2415 1.34 2.35 0.81 119 RCVD_IN_MSPIKE_H4 2369 4.87 2.30 6.21 120 XMBdyGiftCard01 2287 1.87 2.22 1.68 121 XM_CamelCaseFrm001 2282 1.99 2.22 1.88 122 MIME_QP_LONG_LINE 2230 2.59 2.17 2.81 123 XM_H_Undi_Recip 2150 0.87 2.09 0.24 124 XMDiploma_00 2143 1.54 2.08 1.26 125 FROM_EXCESS_BASE64 2134 2.98 2.07 3.46 126 T_REMOTE_IMAGE 2091 2.63 2.03 2.94 127 TR_XM_InvalidRelay 2084 0.71 2.03 0.02 128 XM_B_Unsub2 2081 1.28 2.02 0.90 129 TR_LOTS_OF_MONEY3 2062 0.82 2.00 0.20 130 XM_OfRef7 2034 0.75 1.98 0.11 131 RCVD_IN_VALIDITY_RPBL 2008 0.75 1.95 0.13 132 TR_XM_NoHeaderRelay 2005 0.73 1.95 0.10 133 XMSexyCombo_01 2002 0.96 1.95 0.44 134 DKIM_INVALID 1995 2.49 1.94 2.77 135 DATE_IN_PAST_12_24 1976 0.68 1.92 0.03 136 HK_RANDOM_REPLYTO 1956 0.70 1.90 0.07 137 ALL_TRUSTED 1934 14.01 1.88 20.32 138 XM_B_SpammyWords4 1929 1.40 1.87 1.15 139 RELAYCOUNTRY_IN 1921 0.66 1.87 0.03 140 RELAYCOUNTRY_DE 1891 0.84 1.84 0.32 141 XMStockSpam_06 1833 1.98 1.78 2.09 142 XM_ProductURIs 1674 0.99 1.63 0.66 143 XMReplyNow 1617 0.68 1.57 0.21 144 TR_XM_SB_Phish 1564 1.47 1.52 1.45 145 TR_XM_MSPIKECOMBO2 1499 0.50 1.46 0.01 146 FILL_THIS_FORM 1496 0.73 1.45 0.36 147 XMPhish30 1478 1.10 1.44 0.92 148 HTML_TAG_BALANCE_BODY 1476 1.11 1.43 0.94 149 MPART_ALT_DIFF_COUNT 1473 1.06 1.43 0.86 150 T_XMDrugObfuBody_00 1441 0.96 1.40 0.73 151 FILL_THIS_FORM_LONG 1437 0.60 1.40 0.19 152 XM_URI_RBL 1429 0.58 1.39 0.16 153 BAYES_40 1428 3.20 1.39 4.14 154 TR_XM_PHPDW 1423 0.72 1.38 0.38 155 MONEY_FORM 1412 0.47 1.37 0.01 156 MONEY_FRAUD_8 1385 0.46 1.35 0.00 157 TR_XM_Undi_Recip5 1383 0.46 1.34 0.00 158 UNDISC_MONEY 1332 0.46 1.29 0.02 159 XM_OfRef8 1323 0.45 1.29 0.02 160 TR_XM_PHPForged 1311 0.64 1.27 0.31 161 TR_XM_BayesRelay 1293 0.43 1.26 0.00 162 TR_XM_Undi_Recip2 1278 0.45 1.24 0.04 163 XM_UB80 1267 0.43 1.23 0.02 164 DEAR_BENEFICIARY 1266 0.42 1.23 0.00 165 TR_XM_FormFill2 1265 0.63 1.23 0.31 166 XM_H_PHPOS 1261 0.62 1.23 0.30 167 SHOPIFY_IMG_NOT_RCVD_SFY 1246 0.67 1.21 0.39 168 BOTNET_NORDNS 1243 0.42 1.21 0.01 169 XM_UB60 1235 0.47 1.20 0.09 170 RCVD_IN_IADB_LISTED 1232 2.16 1.20 2.66 171 XM_UB99 1224 0.41 1.19 0.00 172 PLING_QUERY 1208 0.86 1.17 0.70 173 MAILING_LIST_MULTI 1205 1.72 1.17 2.01 174 ADVANCE_FEE_5_NEW_FRM_MNY 1201 0.40 1.17 0.00 175 BAYES_20 1191 2.19 1.16 2.73 176 RELAYCOUNTRY_RU 1190 0.43 1.16 0.05 177 TR_XM_MaxSPIKE 1172 0.39 1.14 0.01 178 HTTPS_HTTP_MISMATCH 1169 0.95 1.14 0.86 179 TR_XM_Undi_Recip11 1140 0.42 1.11 0.07 180 RCVD_IN_IADB_SPF 1130 1.95 1.10 2.40 181 NO_DNS_FOR_FROM 1117 0.77 1.09 0.61 182 XMBrknScrpt_02 1113 0.89 1.08 0.80 183 RCVD_IN_IADB_DK 1092 1.74 1.06 2.09 184 XMGenDplmaNmb 1081 0.70 1.05 0.52 185 RCVD_IN_IADB_SENDERID 1073 1.79 1.04 2.18 186 URI_HEX 1062 1.08 1.03 1.10 187 TR_XM_MaxWHORU 1057 0.64 1.03 0.43 188 RCVD_IN_PSBL 1046 0.71 1.02 0.55 189 XM_B_COVIDMETA 997 0.56 0.97 0.35 190 T_TooManySym_02 989 4.57 0.96 6.45 191 RCVD_IN_RP_SAFE 986 1.27 0.96 1.43 192 ADVANCE_FEE_2_NEW_MONEY 980 0.33 0.95 0.01 193 XM_B_DNDMA 974 0.49 0.95 0.25 194 XM_RXBody 962 0.42 0.93 0.16 195 URIBL_BLACK 958 0.34 0.93 0.03 196 TR_Symld_Words 954 1.45 0.93 1.73 197 TR_XM_COVIDMETA1 946 0.38 0.92 0.11 198 XMSubPhish11 944 1.25 0.92 1.42 199 TR_XM_Base64_M1 936 1.15 0.91 1.27 200 DIET_1 933 0.52 0.91 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163257 85.93 92.35 82.58 2 RELAYCOUNTRY_US 151204 76.92 77.74 76.48 3 DKIM_SIGNED 148539 80.16 89.81 75.14 4 XM_DK_Pass 144006 78.26 88.66 72.84 5 DKIM_VALID 143061 77.67 87.87 72.37 6 XM_B_Unicode 142020 74.34 79.16 71.84 7 DKIM_VALID_AU 122029 65.06 71.46 61.73 8 DCC_CHECK_NEGATIVE 118425 49.46 29.40 59.90 9 BAYES_50 116871 51.52 36.94 59.12 10 XMListUnsubscribeExists 104095 59.60 72.94 52.65 11 XM_B_SpammyWords 84002 51.52 68.87 42.49 12 XM_B_Unicode3 81660 41.85 42.91 41.31 13 DCC_CHECK 79235 50.52 70.58 40.08 14 RCVD_IN_MSPIKE_H2 74896 41.06 47.17 37.89 15 HTML_FONT_LOW_CONTRAST 61503 31.83 33.22 31.11 16 LOC_TINY_FONT_1 57147 31.93 37.73 28.91 17 DKIM_VALID_EF 57084 30.59 33.89 28.88 18 FVGT_m_MULTI_ODD 52879 29.36 34.38 26.75 19 MIME_HTML_ONLY 49814 27.17 30.96 25.20 20 XMSubLong 45657 22.30 20.78 23.09 21 T_KAM_HTML_FONT_INVALID 45177 24.53 27.74 22.85 22 T_TM2_M_HEADER_IN_MSG 43054 21.00 19.51 21.78 23 ALL_TRUSTED 40175 14.01 1.88 20.32 24 RCVD_IN_MSPIKE_WL 39019 18.85 17.15 19.74 25 XM_Multi_Part_URI 37089 18.80 18.87 18.76 26 XM_B_SpammyWords2 35214 24.45 37.22 17.81 27 USER_IN_DEF_DKIM_WL 33913 12.30 2.97 17.15 28 XM_Body_Dirty_Words 25270 16.12 22.52 12.78 29 XM_DKIMWhitelistDomains 24513 8.18 0.08 12.40 30 RCVD_IN_MSPIKE_H3 24098 13.03 14.65 12.19 31 BAYES_60 21365 9.75 7.73 10.81 32 UNPARSEABLE_RELAY 18561 10.19 11.72 9.39 33 T_TooManySym_01 17819 6.87 2.75 9.01 34 XM_Evil_Numbers_Gen 16289 7.89 7.22 8.24 35 XM_DK_Undo_02 15692 21.27 46.89 7.94 36 XM_B_Unsub 14946 9.87 14.31 7.56 37 BAYES_00 14108 4.91 0.65 7.14 38 HTML_IMAGE_RATIO_02 13852 6.97 6.90 7.01 39 LotsOfNums_01 13848 6.41 5.27 7.00 40 XMStrtUSub 13794 6.07 4.34 6.98 41 RCVD_IN_VALIDITY_SAFE 13606 5.98 4.24 6.88 42 TooManyTo_001 13153 6.66 6.66 6.65 43 TR_XM_BayesUnsub 12968 9.14 14.10 6.56 44 BAYES_99 12813 17.07 37.42 6.48 45 T_TooManySym_02 12760 4.57 0.96 6.45 46 BOTNET_IPINHOSTNAME 12534 8.74 13.34 6.34 47 XM_SendGrid 12349 6.24 6.23 6.25 48 RCVD_IN_MSPIKE_H4 12277 4.87 2.30 6.21 49 XM_SPF_SoftFail 12265 5.76 4.89 6.20 50 RCVD_IN_VALIDITY_CERTIFIED 12212 5.20 3.33 6.18 51 MPART_ALT_DIFF 11749 7.50 10.49 5.94 52 FSL_BULK_SIG 11262 6.95 9.36 5.70 53 XMNumbers 11069 4.93 3.65 5.60 54 BAYES_999 10528 13.72 29.86 5.33 55 TR_XM_DK_Bayes 10356 3.64 0.56 5.24 56 IN_ZIMBRA_NJ_WHITELIST 10353 3.46 0.06 5.24 57 TR_XM_DK_Bayes1 10270 3.61 0.56 5.19 58 TR_XM_DKIM_Undo 10190 16.34 37.82 5.15 59 LOTS_OF_MONEY 10121 6.95 10.47 5.12 60 HTML_IMAGE_RATIO_04 10025 4.79 4.26 5.07 61 XM_UncommonTLD01 9969 7.90 13.39 5.04 62 BAYES_80 9413 6.20 8.96 4.76 63 TR_XM_DK_Bayes2 9346 3.30 0.55 4.73 64 XM_H_Long_From01 9334 4.82 5.02 4.72 65 XM_B_SpammyWords3 8860 6.72 11.01 4.48 66 TR_XM_DK_SendGrid 8650 4.33 4.23 4.38 67 XMSexyCombo_05 8627 6.32 10.08 4.36 68 TVD_PH_BODY_ACCOUNTS_PRE 8393 2.92 0.36 4.25 69 BAYES_40 8185 3.20 1.39 4.14 70 PDS_FROM_NAME_TO_DOMAIN 8079 2.79 0.30 4.09 71 PDS_FRNOM_TODOM_NAKED_TO 8079 2.79 0.30 4.09 72 RELAYCOUNTRY_META 7793 10.92 24.32 3.94 73 MIME_HTML_MOSTLY 7681 4.14 4.62 3.89 74 INVALID_MSGID 7447 2.54 0.18 3.77 75 HTML_IMAGE_RATIO_06 7314 3.35 2.69 3.70 76 TR_XM_SpammyWords4 7132 5.38 8.77 3.61 77 MSGID_NOFQDN1 7117 2.39 0.06 3.60 78 XMSubMetaSx_00 6992 4.79 7.19 3.54 79 TVD_RCVD_IP 6926 2.39 0.25 3.50 80 FROM_EXCESS_BASE64 6836 2.98 2.07 3.46 81 TR_XM_PhishingBody 6498 4.38 6.49 3.29 82 BAYES_95 6234 3.87 5.24 3.15 83 TO_MALFORMED 6164 2.06 0.04 3.12 84 MIME_HTML_ONLY_MULTI 6157 4.39 6.83 3.11 85 T_REMOTE_IMAGE 5820 2.63 2.03 2.94 86 XM_B_Phish_Phrases 5617 3.35 4.34 2.84 87 MIME_QP_LONG_LINE 5555 2.59 2.17 2.81 88 T_TooManySym_03 5516 1.94 0.30 2.79 89 DKIM_INVALID 5478 2.49 1.94 2.77 90 BAYES_20 5406 2.19 1.16 2.73 91 TR_DCC_Bayes_99 5268 10.88 26.66 2.66 92 TVD_SPACE_RATIO 5261 1.78 0.08 2.66 93 RCVD_IN_IADB_LISTED 5251 2.16 1.20 2.66 94 T_XMDrugObfuBody_14 4841 3.06 4.23 2.45 95 HTML_IMAGE_RATIO_08 4829 2.58 2.85 2.44 96 RCVD_IN_IADB_SPF 4744 1.95 1.10 2.40 97 RCVD_IN_IADB_SENDERID 4307 1.79 1.04 2.18 98 XM_PDF 4274 1.52 0.28 2.16 99 RCVD_IN_IADB_DK 4137 1.74 1.06 2.09 100 XMBSHREFv2 4132 1.44 0.18 2.09 101 XMStockSpam_06 4126 1.98 1.78 2.09 102 XM_B_SpammyTLD 4123 3.56 6.39 2.09 103 MAILING_LIST_MULTI 3969 1.72 1.17 2.01 104 XM_GoogleGroups 3937 2.82 4.42 1.99 105 IN_HORDE_ADDRESS_BOOK 3926 1.33 0.07 1.99 106 TM2_M_VERY_LONG_WORD 3870 3.38 6.12 1.96 107 HTML_MIME_NO_HTML_TAG 3839 3.00 5.04 1.94 108 TR_XM_SpammyRelay 3771 7.21 17.40 1.91 109 XM_CamelCaseFrm001 3712 1.99 2.22 1.88 110 TR_XM_UnparsRelay 3556 3.75 7.49 1.80 111 TR_Symld_Words 3412 1.45 0.93 1.73 112 URI_NOVOWEL 3360 1.96 2.46 1.70 113 RCVD_IN_IADB_VOUCHED 3357 1.28 0.47 1.70 114 XMBdyGiftCard01 3329 1.87 2.22 1.68 115 BAYES_05 3297 1.27 0.52 1.67 116 TR_XM_SpammyWords2 3179 5.45 12.82 1.61 117 FVGT_m_MULTI_ODD_EMAIL 3035 1.09 0.24 1.54 118 UNTRUSTED_Relay 3005 4.09 9.02 1.52 119 XMGappySubj_01 2923 1.04 0.19 1.48 120 TM2_M_URI_OPT_OUT 2917 1.79 2.38 1.48 121 XMLngstWrd_00 2902 2.45 4.35 1.47 122 BOUNCE_MESSAGE 2900 1.17 0.59 1.47 123 ANY_BOUNCE_MESSAGE 2900 1.17 0.59 1.47 124 BOTNET 2870 4.20 9.49 1.45 125 TR_XM_SB_Phish 2857 1.47 1.52 1.45 126 RCVD_IN_RP_SAFE 2834 1.27 0.96 1.43 127 XMSubPhish11 2812 1.25 0.92 1.42 128 RELAYCOUNTRY_CA 2760 4.99 11.89 1.40 129 TooManyTo_002 2727 1.07 0.47 1.38 130 XMLngstWrd_01 2720 2.39 4.33 1.38 131 RCVD_IN_MSPIKE_H5 2644 0.95 0.20 1.34 132 KHOP_HELO_FCRDNS 2601 1.84 2.86 1.32 133 RCVD_IN_RP_CERTIFIED 2560 1.12 0.77 1.29 134 XMBody_17 2518 3.13 6.69 1.27 135 TR_XM_Base64_M1 2506 1.15 0.91 1.27 136 XMDiploma_00 2497 1.54 2.08 1.26 137 XM_B_Investor 2486 2.39 4.57 1.26 138 XMLngstWrd_02 2438 2.27 4.25 1.23 139 T_XMDrugObfuBody_08 2411 2.62 5.30 1.22 140 TR_XM_SpammyWords5 2405 2.49 4.93 1.22 141 XM_DK_Undo_01 2390 1.62 2.40 1.21 142 XMBody_95 2347 0.81 0.08 1.19 143 RCVD_IN_IADB_OPTIN 2327 0.86 0.27 1.18 144 XM_B_SpammyWords4 2268 1.40 1.87 1.15 145 XM_H_Trusted_IP 2253 0.75 0.00 1.14 146 XM_H_Long_From02 2211 1.02 0.82 1.12 147 URI_HEX 2177 1.08 1.03 1.10 148 XMLngstWrd_03 2176 2.06 3.89 1.10 149 HTML_FONT_FACE_BAD 2172 0.94 0.62 1.10 150 XM_B_Phish66 2142 1.86 3.34 1.08 151 DKIM_ADSP_CUSTOM_MED 2109 0.92 0.63 1.07 152 XMLngstWrd_04 2043 2.00 3.85 1.03 153 XM_OfRef6 2031 2.64 5.74 1.03 154 TooManyTo_003 2028 0.82 0.43 1.03 155 XM_UB50 2003 2.09 4.15 1.01 156 XM_B_COPY_HTML 1986 0.90 0.69 1.00 157 XMPhish14 1968 0.91 0.75 1.00 158 SUBJ_ALL_CAPS 1946 1.78 3.30 0.98 159 HTML_TAG_BALANCE_BODY 1856 1.11 1.43 0.94 160 XMPhish30 1816 1.10 1.44 0.92 161 XM_Body_Dirty_Words_01 1778 0.84 0.74 0.90 162 XM_B_Unsub2 1772 1.28 2.02 0.90 163 MPART_ALT_DIFF_COUNT 1702 1.06 1.43 0.86 164 HTTPS_HTTP_MISMATCH 1693 0.95 1.14 0.86 165 XM_shorewaves_Whitelist 1660 0.55 0.00 0.84 166 XM_B_REG_HTML 1632 0.80 0.76 0.83 167 T_MANY_PILL_PRICE 1608 0.54 0.00 0.81 168 T_XMHurry_00 1602 1.34 2.35 0.81 169 UPPERCASE_75_100 1596 1.98 4.22 0.81 170 XMBrknScrpt_02 1573 0.89 1.08 0.80 171 HTML_TITLE_SUBJ_DIFF 1571 1.85 3.89 0.79 172 XMSubMetaSxObfu_02 1525 0.67 0.49 0.77 173 TooManyTo_004 1509 0.63 0.38 0.76 174 NML_ADSP_CUSTOM_MED 1453 0.67 0.54 0.73 175 FORGED_GMAIL_RCVD 1451 0.65 0.50 0.73 176 T_XMDrugObfuBody_00 1436 0.96 1.40 0.73 177 PLING_QUERY 1381 0.86 1.17 0.70 178 XMHTML_After_End 1327 0.75 0.90 0.67 179 XMSubNoVowel 1314 0.69 0.73 0.66 180 XM_ProductURIs 1312 0.99 1.63 0.66 181 T_FILL_THIS_FORM_SHORT 1311 2.48 5.98 0.66 182 TooManyTo_005 1303 0.56 0.36 0.66 183 SUBJ_YOUR_FAMILY 1288 0.46 0.09 0.65 184 USER_IN_WELCOMELIST 1283 0.43 0.00 0.65 185 USER_IN_WHITELIST 1283 0.43 0.00 0.65 186 SpammyFromTLD_01 1279 1.81 4.05 0.65 187 XM_H_PHPMailer 1275 0.63 0.61 0.64 188 NO_DNS_FOR_FROM 1207 0.77 1.09 0.61 189 HTML_IMAGE_ONLY_20 1178 0.51 0.35 0.60 190 XMSlimDrugH 1155 0.56 0.53 0.58 191 TR_XM_Base64_L1 1149 0.61 0.68 0.58 192 TR_MetaPhish_Combo_01 1129 0.57 0.57 0.57 193 XMHTMLBadTable_001 1109 0.65 0.82 0.56 194 RCVD_IN_PSBL 1092 0.71 1.02 0.55 195 XM_S_SubURI 1088 0.37 0.01 0.55 196 XMGenDplmaNmb 1025 0.70 1.05 0.52 197 TO_IN_SUBJ 1005 0.48 0.44 0.51 198 XMNoVowels 996 0.50 0.49 0.50 199 T_TooManySym_04 984 0.39 0.17 0.50 200 T_Symld_Words_02 926 0.58 0.81 0.47 ----------------------------------------------------------------------