Email: 298382 Autolearn: 0 AvgScore: 4.35 AvgScanTime: 1.55 sec Spam: 108305 Autolearn: 0 AvgScore: 13.34 AvgScanTime: 1.68 sec Ham: 190077 Autolearn: 0 AvgScore: -0.77 AvgScanTime: 1.48 sec Time Spent Running SA: 128.74 hours Time Spent Processing Spam: 50.53 hours Time Spent Processing Ham: 78.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101587 87.23 93.80 83.48 2 DKIM_SIGNED 99250 84.17 91.64 79.92 3 XM_DK_Pass 98147 82.28 90.62 77.53 4 DKIM_VALID 97478 81.80 90.00 77.12 5 XM_B_Unicode 90546 76.17 83.60 71.94 6 RELAYCOUNTRY_US 87554 80.56 80.84 80.39 7 XMListUnsubscribeExists 83484 63.63 77.08 55.96 8 DCC_CHECK 82706 54.50 76.36 42.05 9 DKIM_VALID_AU 79416 68.27 73.33 65.39 10 XM_B_SpammyWords 74913 55.37 69.17 47.51 11 RCVD_IN_MSPIKE_H2 53261 44.41 49.18 41.70 12 XM_B_Unicode3 50958 46.36 47.05 45.97 13 XM_DK_Undo_02 50526 22.30 46.65 8.42 14 XM_B_SpammyWords2 43973 28.61 40.60 21.78 15 LOC_TINY_FONT_1 42125 33.31 38.89 30.12 16 BAYES_50 41397 50.47 38.22 57.44 17 TR_XM_DKIM_Undo 40288 16.90 37.20 5.34 18 FVGT_m_MULTI_ODD 40213 31.86 37.13 28.85 19 BAYES_99 39834 17.48 36.78 6.49 20 HTML_FONT_LOW_CONTRAST 37297 33.58 34.44 33.10 21 DKIM_VALID_EF 35410 31.44 32.69 30.73 22 MIME_HTML_ONLY 34892 25.59 32.22 21.82 23 T_KAM_HTML_FONT_INVALID 32970 24.09 30.44 20.48 24 BAYES_999 31338 13.81 28.93 5.20 25 TR_DCC_Bayes_99 29474 11.64 27.21 2.77 26 XM_Body_Dirty_Words 26121 17.58 24.12 13.85 27 DCC_CHECK_NEGATIVE 25579 45.47 23.62 57.92 28 RELAYCOUNTRY_META 23000 10.14 21.24 3.82 29 T_TM2_M_HEADER_IN_MSG 21785 21.22 20.11 21.86 30 XM_Multi_Part_URI 20988 17.16 19.38 15.89 31 XMSubLong 20922 21.99 19.32 23.51 32 RCVD_IN_MSPIKE_WL 19095 19.44 17.63 20.47 33 RCVD_IN_MSPIKE_H3 16215 13.35 14.97 12.42 34 TR_XM_SpammyWords2 15740 6.01 14.53 1.16 35 TR_XM_SpammyRelay 15710 6.43 14.51 1.83 36 XM_B_Unsub 14280 10.83 13.18 9.48 37 BOTNET_IPINHOSTNAME 14025 8.72 12.95 6.31 38 TR_XM_BayesUnsub 13966 9.76 12.90 7.98 39 UNPARSEABLE_RELAY 13029 10.99 12.03 10.40 40 XM_B_SpammyWords3 12518 7.67 11.56 5.46 41 RELAYCOUNTRY_CA 12007 5.19 11.09 1.83 42 XMSexyCombo_05 11502 7.03 10.62 4.99 43 MPART_ALT_DIFF 11457 6.77 10.58 4.61 44 LOTS_OF_MONEY 10970 7.56 10.13 6.09 45 RCVD_IN_BL_SPAMCOP_NET 10356 3.95 9.56 0.76 46 XM_UncommonTLD01 10026 6.56 9.26 5.03 47 TR_XM_SpammyWords4 9471 5.85 8.74 4.21 48 BAYES_80 9314 6.59 8.60 5.45 49 XM_Evil_Numbers_Gen 9013 9.37 8.32 9.97 50 FSL_BULK_SIG 8707 5.35 8.04 3.82 51 BAYES_60 8482 10.34 7.83 11.77 52 BOTNET 8460 3.84 7.81 1.57 53 MIME_HTML_ONLY_MULTI 8312 4.33 7.67 2.42 54 TR_XM_UnparsRelay 7615 3.80 7.03 1.96 55 HTML_IMAGE_RATIO_02 7596 7.24 7.01 7.37 56 TM2_M_VERY_LONG_WORD 7508 3.43 6.93 1.44 57 XM_SendGrid 7486 6.99 6.91 7.04 58 TR_XM_SPAMCOP 7360 2.68 6.80 0.33 59 UNTRUSTED_Relay 6933 3.15 6.40 1.30 60 LotsOfNums_01 6331 7.37 5.85 8.23 61 HTML_MIME_NO_HTML_TAG 6151 3.03 5.68 1.52 62 XMSubMetaSx_00 6039 4.96 5.58 4.61 63 TR_XM_PhishingBody 5605 3.60 5.18 2.70 64 BAYES_95 5468 4.06 5.05 3.49 65 TR_XM_DK_SendGrid 5444 4.89 5.03 4.81 66 XM_GoogleGroups 5443 2.58 5.03 1.18 67 T_FILL_THIS_FORM_SHORT 5388 2.27 4.97 0.72 68 XMBody_17 5288 2.12 4.88 0.54 69 XM_H_Long_From01 5245 5.21 4.84 5.42 70 TR_XM_SpammyWords5 5193 2.89 4.79 1.80 71 XMLngstWrd_00 5030 2.36 4.64 1.06 72 XMLngstWrd_01 4997 2.28 4.61 0.96 73 XMLngstWrd_02 4936 2.18 4.56 0.83 74 RCVD_IN_VALIDITY_SAFE 4850 5.99 4.48 6.86 75 XMLngstWrd_03 4837 1.98 4.47 0.56 76 XMLngstWrd_04 4804 1.91 4.44 0.47 77 HTML_TITLE_SUBJ_DIFF 4800 1.63 4.43 0.03 78 UPPERCASE_75_100 4776 1.62 4.41 0.04 79 HTML_IMAGE_RATIO_04 4721 5.76 4.36 6.55 80 MIME_HTML_MOSTLY 4716 3.51 4.35 3.04 81 T_XMDrugObfuBody_14 4706 2.68 4.35 1.74 82 USER_IN_DEF_DKIM_WL 4696 13.85 4.34 19.27 83 XMStrtUSub 4675 5.45 4.32 6.10 84 XM_DIRTYINTL 4470 1.65 4.13 0.24 85 RCVD_IN_VALIDITY_CERTIFIED 4414 5.20 4.08 5.83 86 SpammyFromTLD_02 4413 1.63 4.07 0.23 87 XM_B_Phish_Phrases 4306 4.52 3.98 4.83 88 XM_B_SpammyTLD 4265 2.99 3.94 2.45 89 T_XMDrugObfuBody_08 4262 2.18 3.94 1.17 90 TooManyTo_001 4021 5.53 3.71 6.56 91 XM_B_Investor 3971 2.05 3.67 1.13 92 XMNumbers 3849 5.04 3.55 5.88 93 RCVD_IN_MSPIKE_BL 3766 1.55 3.48 0.45 94 TR_XM_MSPIKECOMBO 3726 1.54 3.44 0.45 95 FROM_EXCESS_BASE64 3628 3.50 3.35 3.58 96 XM_OfRef6 3616 1.79 3.34 0.91 97 HTML_IMAGE_RATIO_06 3475 3.43 3.21 3.55 98 XM_SPF_SoftFail 3461 1.90 3.20 1.16 99 TR_XM_FormFill 3451 1.17 3.19 0.03 100 SUBJ_ALL_CAPS 3246 1.87 3.00 1.24 101 SpammyFromTLD_01 3179 1.35 2.94 0.45 102 XM_UB50 3160 1.57 2.92 0.80 103 T_REMOTE_IMAGE 3092 3.53 2.85 3.91 104 RCVD_IN_MSPIKE_L3 2982 1.22 2.75 0.35 105 T_XMHurry_00 2953 1.36 2.73 0.58 106 XM_B_Phish66 2904 1.68 2.68 1.10 107 XM_CamelCaseFrm001 2855 2.33 2.64 2.16 108 TM2_M_URI_OPT_OUT 2797 2.21 2.58 2.00 109 HK_RANDOM_REPLYTO 2765 1.02 2.55 0.15 110 URI_NOVOWEL 2734 1.89 2.52 1.53 111 RCVD_IN_MSPIKE_H4 2649 5.01 2.45 6.46 112 FONT_INVIS_LONG_LINE 2633 0.93 2.43 0.08 113 T_TooManySym_01 2576 7.35 2.38 10.18 114 XM_ProductURIs 2520 1.38 2.33 0.85 115 HTML_IMAGE_RATIO_08 2479 2.19 2.29 2.13 116 XM_B_Unsub2 2475 1.85 2.29 1.60 117 XMBdyGiftCard01 2449 1.86 2.26 1.64 118 LongTLD 2378 1.08 2.20 0.44 119 XMStockSpam_06 2378 2.62 2.20 2.86 120 XMDiploma_00 2366 1.55 2.18 1.19 121 TR_XM_SpammyWords3 2198 0.90 2.03 0.26 122 URIBL_DBL_SPAM 2195 0.74 2.03 0.01 123 XM_B_SpammyWords4 2170 1.21 2.00 0.76 124 XMSexyCombo_01 2151 1.63 1.99 1.42 125 MIME_QP_LONG_LINE 2084 3.11 1.92 3.79 126 TR_XM_NoHeaderRelay 2061 0.76 1.90 0.10 127 TR_XM_SB_Phish 2006 1.78 1.85 1.74 128 TR_XM_PHPDW 1983 0.92 1.83 0.41 129 TR_LOTS_OF_MONEY3 1975 0.82 1.82 0.26 130 HTML_TAG_BALANCE_BODY 1941 1.41 1.79 1.19 131 XM_DK_Undo_01 1937 1.56 1.79 1.42 132 RELAYCOUNTRY_IN 1926 0.68 1.78 0.05 133 PDS_OTHER_BAD_TLD 1926 0.97 1.78 0.51 134 DIET_1 1902 1.09 1.76 0.71 135 FROM_SUSPICIOUS_NTLD 1900 0.68 1.75 0.07 136 TR_XM_PHPForged 1863 0.84 1.72 0.34 137 XM_URI_RBL 1846 0.72 1.70 0.15 138 TR_Mismatch_TLD_02 1827 0.66 1.69 0.08 139 TR_XM_FormFill2 1825 0.82 1.69 0.33 140 RCVD_IN_VALIDITY_RPBL 1821 0.68 1.68 0.11 141 XM_H_PHPOS 1820 0.82 1.68 0.33 142 DKIM_INVALID 1772 2.38 1.64 2.80 143 FROM_SUSPICIOUS_NTLD_FP 1677 0.60 1.55 0.06 144 XMSubPhish11 1650 1.65 1.52 1.73 145 TR_XM_Base64_M1 1607 1.38 1.48 1.32 146 ALL_TRUSTED 1584 10.82 1.46 16.15 147 XMBrknScrpt_02 1558 0.92 1.44 0.62 148 TR_Caps_n_Bayes_99 1555 0.75 1.44 0.37 149 MPART_ALT_DIFF_COUNT 1550 1.01 1.43 0.77 150 BAYES_40 1546 2.93 1.43 3.78 151 TR_XM_BayesRelay 1506 0.51 1.39 0.00 152 RCVD_IN_PSBL 1478 0.72 1.36 0.35 153 XM_B_SEO 1477 0.56 1.36 0.11 154 XM_UB99 1432 0.48 1.32 0.01 155 SHOPIFY_IMG_NOT_RCVD_SFY 1416 0.68 1.31 0.32 156 RCVD_IN_IADB_LISTED 1410 2.62 1.30 3.37 157 TR_XM_MSPIKECOMBO2 1389 0.49 1.28 0.04 158 XM_RXBody 1388 1.95 1.28 2.34 159 KHOP_HELO_FCRDNS 1387 0.77 1.28 0.47 160 XM_H_Undi_Recip 1380 0.56 1.27 0.16 161 TR_XM_SEO4 1376 0.50 1.27 0.07 162 TR_Symld_Words 1339 1.84 1.24 2.19 163 XMReplyNow 1334 0.58 1.23 0.21 164 RCVD_IN_RP_SAFE 1303 1.21 1.20 1.21 165 RCVD_IN_IADB_SPF 1301 2.40 1.20 3.08 166 MAILING_LIST_MULTI 1300 1.87 1.20 2.26 167 URI_PHP_REDIR 1291 0.44 1.19 0.00 168 BOTNET_NORDNS 1285 0.44 1.19 0.01 169 XMGenDplmaNmb 1271 0.71 1.17 0.44 170 XMPhish30 1264 0.98 1.17 0.87 171 RCVD_IN_IADB_DK 1256 2.19 1.16 2.78 172 RCVD_IN_IADB_SENDERID 1253 2.23 1.16 2.83 173 T_XMDrugObfuBody_00 1249 0.73 1.15 0.49 174 XMSubMetaI_00 1197 0.96 1.11 0.88 175 XMHTMLBadTable_001 1183 0.87 1.09 0.75 176 HTML_TEXT_INVISIBLE_STYLE 1172 0.60 1.08 0.32 177 RELAYCOUNTRY_AU 1162 0.53 1.07 0.22 178 TR_XM_MaxSPIKE 1155 0.41 1.07 0.03 179 TR_MetaPhish_Combo_01 1130 0.77 1.04 0.62 180 TR_XM_Undi_Recip5 1126 0.38 1.04 0.01 181 XM_UB999 1107 0.37 1.02 0.00 182 XM_H_PHPMailer 1105 0.79 1.02 0.66 183 RCVD_IN_RP_CERTIFIED 1102 1.04 1.02 1.05 184 PLING_QUERY 1086 0.68 1.00 0.50 185 URIBL_BLACK 1077 0.38 0.99 0.03 186 XM_B_REG_HTML 1053 0.74 0.97 0.61 187 XMHTML_After_End 1052 0.75 0.97 0.62 188 TR_Mismatch_TLD_01 1022 0.54 0.94 0.31 189 HTTPS_HTTP_MISMATCH 1019 0.73 0.94 0.60 190 URI_HEX 1009 1.01 0.93 1.06 191 UNDISC_MONEY 1008 0.34 0.93 0.01 192 T_Symld_Words_02 1007 0.53 0.93 0.30 193 BAYES_20 1000 1.98 0.92 2.58 194 XM_HighProb1 996 0.34 0.92 0.00 195 URI_TRY_3LD 990 0.71 0.91 0.60 196 TR_XM_Undi_Recip11 972 0.35 0.90 0.03 197 FORGED_RELAY_MUA_TO_MX 951 0.34 0.88 0.03 198 TR_XM_Undi_RecipCombo2 945 0.32 0.87 0.00 199 MIME_CHARSET_FARAWAY 881 0.40 0.81 0.16 200 FILL_THIS_FORM 871 0.51 0.80 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158681 87.23 93.80 83.48 2 RELAYCOUNTRY_US 152808 80.56 80.84 80.39 3 DKIM_SIGNED 151913 84.17 91.64 79.92 4 XM_DK_Pass 147369 82.28 90.62 77.53 5 DKIM_VALID 146596 81.80 90.00 77.12 6 XM_B_Unicode 136735 76.17 83.60 71.94 7 DKIM_VALID_AU 124283 68.27 73.33 65.39 8 DCC_CHECK_NEGATIVE 110090 45.47 23.62 57.92 9 BAYES_50 109185 50.47 38.22 57.44 10 XMListUnsubscribeExists 106362 63.63 77.08 55.96 11 XM_B_SpammyWords 90306 55.37 69.17 47.51 12 XM_B_Unicode3 87371 46.36 47.05 45.97 13 DCC_CHECK 79924 54.50 76.36 42.05 14 RCVD_IN_MSPIKE_H2 79259 44.41 49.18 41.70 15 HTML_FONT_LOW_CONTRAST 62913 33.58 34.44 33.10 16 DKIM_VALID_EF 58410 31.44 32.69 30.73 17 LOC_TINY_FONT_1 57253 33.31 38.89 30.12 18 FVGT_m_MULTI_ODD 54844 31.86 37.13 28.85 19 XMSubLong 44681 21.99 19.32 23.51 20 T_TM2_M_HEADER_IN_MSG 41546 21.22 20.11 21.86 21 MIME_HTML_ONLY 41468 25.59 32.22 21.82 22 XM_B_SpammyWords2 41407 28.61 40.60 21.78 23 T_KAM_HTML_FONT_INVALID 38924 24.09 30.44 20.48 24 RCVD_IN_MSPIKE_WL 38903 19.44 17.63 20.47 25 USER_IN_DEF_DKIM_WL 36631 13.85 4.34 19.27 26 ALL_TRUSTED 30702 10.82 1.46 16.15 27 XM_Multi_Part_URI 30204 17.16 19.38 15.89 28 XM_Body_Dirty_Words 26320 17.58 24.12 13.85 29 XM_DKIMWhitelistDomains 25386 8.59 0.23 13.36 30 RCVD_IN_MSPIKE_H3 23614 13.35 14.97 12.42 31 BAYES_60 22371 10.34 7.83 11.77 32 UNPARSEABLE_RELAY 19760 10.99 12.03 10.40 33 T_TooManySym_01 19343 7.35 2.38 10.18 34 XM_Evil_Numbers_Gen 18960 9.37 8.32 9.97 35 XM_B_Unsub 18023 10.83 13.18 9.48 36 XM_DK_Undo_02 16008 22.30 46.65 8.42 37 LotsOfNums_01 15649 7.37 5.85 8.23 38 TR_XM_BayesUnsub 15162 9.76 12.90 7.98 39 BAYES_00 14175 5.02 0.73 7.46 40 HTML_IMAGE_RATIO_02 14002 7.24 7.01 7.37 41 XM_SendGrid 13382 6.99 6.91 7.04 42 RCVD_IN_VALIDITY_SAFE 13036 5.99 4.48 6.86 43 TooManyTo_001 12475 5.53 3.71 6.56 44 HTML_IMAGE_RATIO_04 12455 5.76 4.36 6.55 45 BAYES_99 12332 17.48 36.78 6.49 46 RCVD_IN_MSPIKE_H4 12288 5.01 2.45 6.46 47 TR_XM_DK_Bayes 12039 4.24 0.57 6.33 48 BOTNET_IPINHOSTNAME 11995 8.72 12.95 6.31 49 TR_XM_DK_Bayes1 11959 4.21 0.57 6.29 50 T_TooManySym_02 11896 4.17 0.49 6.26 51 XMStrtUSub 11587 5.45 4.32 6.10 52 LOTS_OF_MONEY 11585 7.56 10.13 6.09 53 XMNumbers 11186 5.04 3.55 5.88 54 RCVD_IN_VALIDITY_CERTIFIED 11088 5.20 4.08 5.83 55 TR_XM_DK_Bayes2 10799 3.73 0.31 5.68 56 XM_B_SpammyWords3 10373 7.67 11.56 5.46 57 BAYES_80 10360 6.59 8.60 5.45 58 XM_H_Long_From01 10302 5.21 4.84 5.42 59 IN_ZIMBRA_NJ_WHITELIST 10212 3.44 0.04 5.37 60 TR_XM_DKIM_Undo 10144 16.90 37.20 5.34 61 BAYES_999 9875 13.81 28.93 5.20 62 XM_UncommonTLD01 9558 6.56 9.26 5.03 63 XMSexyCombo_05 9476 7.03 10.62 4.99 64 XM_B_Phish_Phrases 9190 4.52 3.98 4.83 65 TR_XM_DK_SendGrid 9141 4.89 5.03 4.81 66 MPART_ALT_DIFF 8756 6.77 10.58 4.61 67 XMSubMetaSx_00 8755 4.96 5.58 4.61 68 TR_XM_SpammyWords4 7996 5.85 8.74 4.21 69 T_REMOTE_IMAGE 7432 3.53 2.85 3.91 70 RELAYCOUNTRY_META 7267 10.14 21.24 3.82 71 FSL_BULK_SIG 7267 5.35 8.04 3.82 72 INVALID_MSGID 7214 2.50 0.22 3.80 73 MIME_QP_LONG_LINE 7208 3.11 1.92 3.79 74 BAYES_40 7192 2.93 1.43 3.78 75 MSGID_NOFQDN1 6830 2.33 0.12 3.59 76 FROM_EXCESS_BASE64 6801 3.50 3.35 3.58 77 HTML_IMAGE_RATIO_06 6748 3.43 3.21 3.55 78 BAYES_95 6640 4.06 5.05 3.49 79 RCVD_IN_IADB_LISTED 6414 2.62 1.30 3.37 80 TO_MALFORMED 5915 1.99 0.01 3.11 81 RCVD_IN_IADB_SPF 5857 2.40 1.20 3.08 82 MIME_HTML_MOSTLY 5771 3.51 4.35 3.04 83 XMStockSpam_06 5440 2.62 2.20 2.86 84 RCVD_IN_IADB_SENDERID 5387 2.23 1.16 2.83 85 DKIM_INVALID 5317 2.38 1.64 2.80 86 RCVD_IN_IADB_DK 5285 2.19 1.16 2.78 87 TR_DCC_Bayes_99 5259 11.64 27.21 2.77 88 TR_XM_PhishingBody 5128 3.60 5.18 2.70 89 TVD_SPACE_RATIO 4942 1.70 0.11 2.60 90 T_TooManySym_03 4907 1.72 0.21 2.58 91 BAYES_20 4900 1.98 0.92 2.58 92 TVD_RCVD_IP 4899 1.76 0.32 2.58 93 XM_B_SpammyTLD 4663 2.99 3.94 2.45 94 MIME_HTML_ONLY_MULTI 4598 4.33 7.67 2.42 95 XM_PDF 4562 1.62 0.25 2.40 96 XM_RXBody 4441 1.95 1.28 2.34 97 MAILING_LIST_MULTI 4293 1.87 1.20 2.26 98 IN_HORDE_ADDRESS_BOOK 4212 1.44 0.08 2.22 99 TR_Symld_Words 4162 1.84 1.24 2.19 100 XM_CamelCaseFrm001 4100 2.33 2.64 2.16 101 HTML_IMAGE_RATIO_08 4054 2.19 2.29 2.13 102 XMBSHREFv2 3886 1.37 0.20 2.04 103 TM2_M_URI_OPT_OUT 3810 2.21 2.58 2.00 104 RCVD_IN_IADB_VOUCHED 3766 1.41 0.40 1.98 105 TR_XM_UnparsRelay 3724 3.80 7.03 1.96 106 ANY_BOUNCE_MESSAGE 3571 1.42 0.62 1.88 107 BOUNCE_MESSAGE 3570 1.42 0.62 1.88 108 TR_XM_SpammyRelay 3484 6.43 14.51 1.83 109 RELAYCOUNTRY_CA 3479 5.19 11.09 1.83 110 TR_XM_SpammyWords5 3419 2.89 4.79 1.80 111 T_XMDrugObfuBody_14 3305 2.68 4.35 1.74 112 TR_XM_SB_Phish 3300 1.78 1.85 1.74 113 XMSubPhish11 3287 1.65 1.52 1.73 114 XMBdyGiftCard01 3109 1.86 2.26 1.64 115 XM_B_Unsub2 3033 1.85 2.29 1.60 116 RCVD_IN_MSPIKE_H5 3001 1.08 0.21 1.58 117 BOTNET 2988 3.84 7.81 1.57 118 FVGT_m_MULTI_ODD_EMAIL 2931 1.04 0.15 1.54 119 BAYES_05 2921 1.14 0.44 1.54 120 URI_NOVOWEL 2912 1.89 2.52 1.53 121 HTML_MIME_NO_HTML_TAG 2880 3.03 5.68 1.52 122 TM2_M_VERY_LONG_WORD 2740 3.43 6.93 1.44 123 XM_DK_Undo_01 2708 1.56 1.79 1.42 124 XMSexyCombo_01 2705 1.63 1.99 1.42 125 XMGappySubj_01 2698 0.95 0.12 1.42 126 RCVD_IN_IADB_OPTIN 2520 0.93 0.23 1.33 127 TR_XM_Base64_M1 2507 1.38 1.48 1.32 128 UNTRUSTED_Relay 2468 3.15 6.40 1.30 129 TooManyTo_002 2413 0.96 0.42 1.27 130 XMBody_95 2400 1.05 0.66 1.26 131 XMSubMetaSxObfu_03 2388 1.06 0.71 1.26 132 XM_H_Long_From02 2359 1.04 0.70 1.24 133 SUBJ_ALL_CAPS 2348 1.87 3.00 1.24 134 RCVD_IN_RP_SAFE 2297 1.21 1.20 1.21 135 HTML_TAG_BALANCE_BODY 2268 1.41 1.79 1.19 136 XMDiploma_00 2255 1.55 2.18 1.19 137 XM_GoogleGroups 2247 2.58 5.03 1.18 138 T_XMDrugObfuBody_08 2228 2.18 3.94 1.17 139 XM_SPF_SoftFail 2205 1.90 3.20 1.16 140 TR_XM_SpammyWords2 2202 6.01 14.53 1.16 141 XM_B_Investor 2146 2.05 3.67 1.13 142 XM_B_Phish66 2097 1.68 2.68 1.10 143 URI_HEX 2012 1.01 0.93 1.06 144 XMLngstWrd_00 2009 2.36 4.64 1.06 145 RCVD_IN_RP_CERTIFIED 1989 1.04 1.02 1.05 146 XM_Body_Dirty_Words_01 1983 0.94 0.76 1.04 147 HTML_FONT_FACE_BAD 1964 0.90 0.65 1.03 148 XM_B_COPY_HTML 1937 0.91 0.73 1.02 149 XMLngstWrd_01 1820 2.28 4.61 0.96 150 XM_H_Trusted_IP 1818 0.61 0.00 0.96 151 DKIM_ADSP_CUSTOM_MED 1734 0.83 0.67 0.91 152 XM_OfRef6 1723 1.79 3.34 0.91 153 TooManyTo_003 1697 0.70 0.36 0.89 154 XMSubMetaI_00 1675 0.96 1.11 0.88 155 XMSubMetaSx_01 1661 0.68 0.34 0.87 156 XMPhish30 1651 0.98 1.17 0.87 157 XMSexyCombo_04 1633 0.79 0.68 0.86 158 XM_ProductURIs 1609 1.38 2.33 0.85 159 XMSexyCombo_02 1589 0.67 0.38 0.84 160 XMLngstWrd_02 1575 2.18 4.56 0.83 161 XM_UB50 1516 1.57 2.92 0.80 162 MPART_ALT_DIFF_COUNT 1470 1.01 1.43 0.77 163 XM_B_SpammyWords4 1452 1.21 2.00 0.76 164 RCVD_IN_BL_SPAMCOP_NET 1444 3.95 9.56 0.76 165 XMHTMLBadTable_001 1427 0.87 1.09 0.75 166 T_FILL_THIS_FORM_SHORT 1374 2.27 4.97 0.72 167 XMSubMetaSxObfu_02 1360 0.60 0.41 0.72 168 DIET_1 1348 1.09 1.76 0.71 169 USER_IN_WELCOMELIST 1341 0.45 0.00 0.71 170 USER_IN_WHITELIST 1341 0.45 0.00 0.71 171 XM_H_PHPMailer 1246 0.79 1.02 0.66 172 TooManyTo_004 1243 0.54 0.33 0.65 173 XMSlimDrugH 1220 0.70 0.80 0.64 174 XMBrknScrpt_02 1187 0.92 1.44 0.62 175 XMHTML_After_End 1177 0.75 0.97 0.62 176 TR_MetaPhish_Combo_01 1172 0.77 1.04 0.62 177 FORGED_GMAIL_RCVD 1172 0.59 0.54 0.62 178 XM_B_REG_HTML 1162 0.74 0.97 0.61 179 HTML_IMAGE_ONLY_20 1151 0.48 0.25 0.61 180 HTTPS_HTTP_MISMATCH 1147 0.73 0.94 0.60 181 URI_TRY_3LD 1140 0.71 0.91 0.60 182 NML_ADSP_CUSTOM_MED 1117 0.56 0.52 0.59 183 T_XMHurry_00 1094 1.36 2.73 0.58 184 XMLngstWrd_03 1070 1.98 4.47 0.56 185 XM_S_SubURI 1038 0.35 0.01 0.55 186 XMBody_17 1034 2.12 4.88 0.54 187 TooManyTo_005 1014 0.46 0.32 0.53 188 PDS_OTHER_BAD_TLD 973 0.97 1.78 0.51 189 PLING_QUERY 946 0.68 1.00 0.50 190 XMMoneyMeta_00 943 0.48 0.45 0.50 191 T_XMDrugObfuBody_00 924 0.73 1.15 0.49 192 TR_XM_Base64_M2 917 0.44 0.35 0.48 193 XMSubNoVowel 917 0.49 0.52 0.48 194 KHOP_HELO_FCRDNS 901 0.77 1.28 0.47 195 XMLngstWrd_04 887 1.91 4.44 0.47 196 XMNoVowels 884 0.40 0.27 0.47 197 SpammyFromTLD_01 863 1.35 2.94 0.45 198 TR_XM_Base64_L1 862 0.52 0.63 0.45 199 RCVD_IN_MSPIKE_BL 861 1.55 3.48 0.45 200 TR_XM_MSPIKECOMBO 858 1.54 3.44 0.45 ----------------------------------------------------------------------