Email: 293311 Autolearn: 0 AvgScore: 4.06 AvgScanTime: 1.22 sec Spam: 105686 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 1.28 sec Ham: 187625 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 1.19 sec Time Spent Running SA: 99.69 hours Time Spent Processing Spam: 37.67 hours Time Spent Processing Ham: 62.02 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100761 87.32 95.34 82.81 2 DKIM_SIGNED 97252 84.17 92.02 79.75 3 XM_DK_Pass 95980 82.20 90.82 77.34 4 DKIM_VALID 95303 81.67 90.18 76.88 5 RELAYCOUNTRY_US 84465 80.43 79.92 80.72 6 XM_B_Unicode 83765 74.97 79.26 72.56 7 XMListUnsubscribeExists 80768 63.52 76.42 56.26 8 DCC_CHECK 79195 54.53 74.93 43.04 9 DKIM_VALID_AU 78908 69.37 74.66 66.38 10 XM_B_SpammyWords 70035 54.61 66.27 48.05 11 RCVD_IN_MSPIKE_H2 52245 44.65 49.43 41.96 12 XM_DK_Undo_02 48182 21.97 45.59 8.67 13 XM_B_Unicode3 47073 45.63 44.54 46.24 14 BAYES_50 43923 51.23 41.56 56.68 15 FVGT_m_MULTI_ODD 43552 32.88 41.21 28.19 16 TR_XM_DKIM_Undo 39642 17.04 37.51 5.51 17 XM_B_SpammyWords2 39307 27.60 37.19 22.19 18 LOC_TINY_FONT_1 38878 32.67 36.79 30.35 19 BAYES_99 37500 17.20 35.48 6.90 20 MIME_HTML_ONLY 36959 26.36 34.97 21.50 21 HTML_FONT_LOW_CONTRAST 36645 34.47 34.67 34.35 22 DKIM_VALID_EF 34466 30.88 32.61 29.90 23 T_KAM_HTML_FONT_INVALID 30882 22.73 29.22 19.07 24 BAYES_999 29423 13.60 27.84 5.58 25 TR_DCC_Bayes_99 26844 11.34 25.40 3.42 26 DCC_CHECK_NEGATIVE 26472 45.43 25.05 56.91 27 XM_Body_Dirty_Words 25924 18.14 24.53 14.55 28 RELAYCOUNTRY_META 24164 10.56 22.86 3.63 29 RCVD_IN_MSPIKE_WL 21881 20.54 20.70 20.45 30 XM_Multi_Part_URI 20447 16.88 19.35 15.49 31 XMSubLong 20303 22.80 19.21 24.83 32 RCVD_IN_MSPIKE_H3 18531 13.95 17.53 11.94 33 T_TM2_M_HEADER_IN_MSG 17640 20.87 16.69 23.23 34 MPART_ALT_DIFF 15892 8.35 15.04 4.59 35 XM_B_Unsub 15455 10.81 14.62 8.67 36 TR_XM_SpammyWords2 15307 6.38 14.48 1.81 37 TR_XM_SpammyRelay 15289 6.23 14.47 1.60 38 TR_XM_BayesUnsub 15182 9.98 14.37 7.51 39 BOTNET_IPINHOSTNAME 14218 9.03 13.45 6.54 40 UNPARSEABLE_RELAY 13550 11.19 12.82 10.27 41 XMSexyCombo_05 12772 7.89 12.08 5.53 42 XM_UncommonTLD01 12136 7.17 11.48 4.75 43 TM2_M_VERY_LONG_WORD 11511 4.80 10.89 1.36 44 MIME_HTML_ONLY_MULTI 11443 5.41 10.83 2.35 45 XM_B_SpammyWords3 10910 7.18 10.32 5.40 46 RELAYCOUNTRY_CA 10397 4.35 9.84 1.27 47 BOTNET 10022 4.51 9.48 1.71 48 HTML_MIME_NO_HTML_TAG 9761 4.23 9.24 1.40 49 UNTRUSTED_Relay 9661 4.33 9.14 1.63 50 XM_GoogleGroups 9319 3.97 8.82 1.24 51 XMLngstWrd_00 8828 3.65 8.35 1.00 52 XMLngstWrd_01 8801 3.57 8.33 0.89 53 XMLngstWrd_02 8723 3.44 8.25 0.73 54 LOTS_OF_MONEY 8704 7.12 8.24 6.49 55 RCVD_IN_BL_SPAMCOP_NET 8702 3.23 8.23 0.42 56 XMLngstWrd_03 8651 3.23 8.19 0.44 57 HTML_TITLE_SUBJ_DIFF 8635 2.96 8.17 0.02 58 XMLngstWrd_04 8630 3.17 8.17 0.35 59 UPPERCASE_75_100 8591 2.94 8.13 0.03 60 FSL_BULK_SIG 8330 5.12 7.88 3.56 61 BAYES_80 8248 6.19 7.80 5.29 62 TR_XM_UnparsRelay 8211 4.15 7.77 2.12 63 HTML_IMAGE_RATIO_02 8116 7.52 7.68 7.44 64 BAYES_60 7949 10.00 7.52 11.39 65 XM_Evil_Numbers_Gen 7555 8.97 7.15 9.99 66 TR_XM_SpammyWords4 7516 5.71 7.11 4.92 67 TR_XM_SPAMCOP 7197 2.59 6.81 0.21 68 XM_SendGrid 7169 6.78 6.78 6.78 69 XMSubMetaSx_00 6798 5.29 6.43 4.64 70 TR_XM_PhishingBody 6114 4.38 5.79 3.58 71 XM_B_SpammyTLD 5849 3.55 5.53 2.44 72 MIME_HTML_MOSTLY 5823 4.13 5.51 3.36 73 XM_H_Long_From01 5540 5.16 5.24 5.12 74 SpammyFromTLD_02 5256 1.94 4.97 0.23 75 RCVD_IN_VALIDITY_SAFE 5243 6.56 4.96 7.45 76 BAYES_95 5213 4.05 4.93 3.55 77 LotsOfNums_01 5193 6.98 4.91 8.14 78 XM_DIRTYINTL 5162 1.94 4.88 0.28 79 TR_XM_DK_SendGrid 5000 4.80 4.73 4.84 80 TooManyTo_001 4922 6.08 4.66 6.88 81 RCVD_IN_VALIDITY_CERTIFIED 4787 5.79 4.53 6.49 82 T_FILL_THIS_FORM_SHORT 4649 1.96 4.40 0.58 83 XMStrtUSub 4610 6.06 4.36 7.02 84 XM_UB50 4497 2.18 4.26 1.01 85 T_XMDrugObfuBody_14 4493 2.61 4.25 1.68 86 XM_B_Phish_Phrases 4453 4.78 4.21 5.09 87 T_XMDrugObfuBody_08 4388 2.21 4.15 1.11 88 XMNumbers 4337 5.07 4.10 5.62 89 XMBody_17 4210 1.73 3.98 0.46 90 HTML_IMAGE_RATIO_04 4113 4.91 3.89 5.48 91 URI_NOVOWEL 3985 2.32 3.77 1.50 92 RCVD_IN_MSPIKE_BL 3784 1.57 3.58 0.43 93 TR_XM_MSPIKECOMBO 3707 1.54 3.51 0.43 94 PDS_OTHER_BAD_TLD 3623 1.56 3.43 0.51 95 XM_DK_Undo_01 3570 2.02 3.38 1.25 96 TR_XM_SpammyWords5 3546 1.93 3.36 1.13 97 XM_B_Investor 3516 1.99 3.33 1.24 98 USER_IN_DEF_DKIM_WL 3361 13.34 3.18 19.07 99 HK_RANDOM_REPLYTO 3312 1.19 3.13 0.10 100 XM_SPF_SoftFail 3243 2.09 3.07 1.54 101 RCVD_IN_MSPIKE_H4 3166 5.58 3.00 7.03 102 XM_B_Phish66 3111 2.13 2.94 1.67 103 HTML_IMAGE_RATIO_06 3101 3.79 2.93 4.28 104 XM_OfRef6 2941 2.23 2.78 1.92 105 SpammyFromTLD_01 2789 1.25 2.64 0.46 106 T_REMOTE_IMAGE 2749 3.10 2.60 3.37 107 FONT_INVIS_LONG_LINE 2724 1.02 2.58 0.14 108 HTML_IMAGE_RATIO_08 2720 3.12 2.57 3.42 109 RCVD_IN_MSPIKE_L3 2709 1.18 2.56 0.40 110 TR_XM_SpammyWords3 2697 1.12 2.55 0.31 111 TR_XM_FormFill 2664 0.92 2.52 0.02 112 FROM_EXCESS_BASE64 2619 3.15 2.48 3.53 113 URIBL_DBL_SPAM 2611 0.89 2.47 0.01 114 RELAYCOUNTRY_IN 2427 0.85 2.30 0.04 115 RCVD_IN_VALIDITY_RPBL 2419 0.90 2.29 0.11 116 TR_XM_NoHeaderRelay 2407 0.89 2.28 0.10 117 T_TooManySym_01 2351 6.80 2.22 9.37 118 XMSexyCombo_01 2347 1.65 2.22 1.33 119 XMDiploma_00 2346 1.58 2.22 1.22 120 T_XMHurry_00 2340 1.21 2.21 0.64 121 TM2_M_URI_OPT_OUT 2294 1.99 2.17 1.89 122 BOTNET_NORDNS 2291 0.79 2.17 0.02 123 XMBdyGiftCard01 2283 2.10 2.16 2.07 124 XM_B_SpammyWords4 2187 1.43 2.07 1.07 125 XM_CamelCaseFrm001 2172 2.08 2.06 2.10 126 XM_B_Unsub2 2104 1.33 1.99 0.96 127 XM_ProductURIs 2065 1.31 1.95 0.95 128 XM_H_Undi_Recip 2061 0.92 1.95 0.34 129 DKIM_INVALID 1949 2.50 1.84 2.87 130 SUBJ_ALL_CAPS 1881 1.20 1.78 0.87 131 HTML_TAG_BALANCE_BODY 1858 1.08 1.76 0.70 132 XM_URI_RBL 1790 0.70 1.69 0.15 133 KHOP_HELO_FCRDNS 1764 1.14 1.67 0.85 134 XMPhish30 1759 1.23 1.66 0.99 135 MIME_QP_LONG_LINE 1751 2.65 1.66 3.21 136 TR_LOTS_OF_MONEY3 1728 0.76 1.64 0.27 137 XM_UB99 1588 0.54 1.50 0.00 138 SHOPIFY_IMG_NOT_RCVD_SFY 1539 0.72 1.46 0.31 139 TR_XM_Undi_Recip11 1535 0.57 1.45 0.07 140 RELAYCOUNTRY_RU 1508 0.56 1.43 0.07 141 URI_PHP_REDIR 1499 0.51 1.42 0.00 142 TR_XM_MSPIKECOMBO2 1494 0.52 1.41 0.02 143 MAILING_LIST_MULTI 1483 1.81 1.40 2.04 144 TR_XM_PHPDW 1480 0.73 1.40 0.35 145 XM_UB60 1478 0.56 1.40 0.08 146 XMStockSpam_06 1471 2.31 1.39 2.83 147 RCVD_IN_PSBL 1442 0.90 1.36 0.64 148 DIET_1 1406 0.95 1.33 0.73 149 TR_XM_PHPForged 1405 0.67 1.33 0.30 150 TR_XM_FormFill2 1372 0.65 1.30 0.29 151 XM_H_PHPOS 1368 0.65 1.29 0.28 152 TR_Mismatch_TLD_02 1363 0.52 1.29 0.09 153 TR_XM_BayesRelay 1337 0.46 1.27 0.00 154 ALL_TRUSTED 1323 10.71 1.25 16.03 155 TR_XM_SB_Phish 1320 1.49 1.25 1.62 156 HTTPS_HTTP_MISMATCH 1311 0.78 1.24 0.53 157 TR_XM_InvalidRelay 1285 0.45 1.22 0.03 158 XMHTMLBadTable_001 1271 0.93 1.20 0.77 159 XM_B_DNDMA 1257 0.78 1.19 0.55 160 MPART_ALT_DIFF_COUNT 1251 0.99 1.18 0.88 161 TR_XM_Base64_M1 1221 1.27 1.16 1.33 162 FROM_SUSPICIOUS_NTLD 1206 0.45 1.14 0.07 163 TR_XM_MaxSPIKE 1192 0.42 1.13 0.02 164 T_XMDrugObfuBody_00 1187 0.85 1.12 0.70 165 XM_UB999 1168 0.40 1.11 0.00 166 URI_TRY_3LD 1149 0.69 1.09 0.47 167 BAYES_40 1116 2.83 1.06 3.83 168 URI_HEX 1105 1.14 1.05 1.19 169 RCVD_IN_RP_SAFE 1095 1.33 1.04 1.49 170 XMSubPhish11 1083 1.39 1.02 1.60 171 XM_B_REG_HTML 1079 0.74 1.02 0.58 172 XMReplyNow 1071 0.56 1.01 0.31 173 XMSexyCombo_04 1065 0.99 1.01 0.98 174 RELAYCOUNTRY_AU 1021 0.53 0.97 0.29 175 HTML_FONT_TINY_NORDNS 1007 0.39 0.95 0.07 176 URIBL_BLACK 1001 0.36 0.95 0.02 177 XMSubMetaSx_01 982 0.38 0.93 0.06 178 XMSubMetaI_00 974 0.73 0.92 0.62 179 XM_UB80 973 0.35 0.92 0.02 180 RCVD_IN_IADB_LISTED 946 2.04 0.90 2.69 181 XM_HighProb1 941 0.32 0.89 0.00 182 XM_Body_Dirty_Words_01 938 1.02 0.89 1.10 183 RCVD_IN_RP_CERTIFIED 932 1.17 0.88 1.34 184 MIME_CHARSET_FARAWAY 922 0.45 0.87 0.21 185 NORDNS_LOW_CONTRAST 903 0.33 0.85 0.03 186 XMSubNoVowel 894 0.66 0.85 0.55 187 XMGenDplmaNmb 865 0.61 0.82 0.50 188 XMBrknScrpt_02 861 0.91 0.81 0.96 189 LONGLN_LOW_CONTRAST 861 0.45 0.81 0.24 190 RELAYCOUNTRY_FR 854 0.43 0.81 0.22 191 HTML_TEXT_INVISIBLE_STYLE 853 0.56 0.81 0.42 192 XMHTML_After_End 848 0.67 0.80 0.59 193 RCVD_IN_IADB_SPF 841 1.86 0.80 2.46 194 XM_H_Long_From02 841 1.52 0.80 1.92 195 XMSlimDrugH 824 0.56 0.78 0.44 196 TM2_M_OBFU_COMMENT 821 0.38 0.78 0.16 197 TR_Mismatch_TLD_01 817 0.49 0.77 0.33 198 XM_S_SpammyWords 812 0.46 0.77 0.28 199 TR_XM_Spammywords 812 0.46 0.77 0.28 200 XM_RXBody 789 0.50 0.75 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155366 87.32 95.34 82.81 2 RELAYCOUNTRY_US 151451 80.43 79.92 80.72 3 DKIM_SIGNED 149632 84.17 92.02 79.75 4 XM_DK_Pass 145118 82.20 90.82 77.34 5 DKIM_VALID 144242 81.67 90.18 76.88 6 XM_B_Unicode 136141 74.97 79.26 72.56 7 DKIM_VALID_AU 124554 69.37 74.66 66.38 8 DCC_CHECK_NEGATIVE 106782 45.43 25.05 56.91 9 BAYES_50 106340 51.23 41.56 56.68 10 XMListUnsubscribeExists 105550 63.52 76.42 56.26 11 XM_B_SpammyWords 90145 54.61 66.27 48.05 12 XM_B_Unicode3 86757 45.63 44.54 46.24 13 DCC_CHECK 80762 54.53 74.93 43.04 14 RCVD_IN_MSPIKE_H2 78721 44.65 49.43 41.96 15 HTML_FONT_LOW_CONTRAST 64457 34.47 34.67 34.35 16 LOC_TINY_FONT_1 56935 32.67 36.79 30.35 17 DKIM_VALID_EF 56108 30.88 32.61 29.90 18 FVGT_m_MULTI_ODD 52892 32.88 41.21 28.19 19 XMSubLong 46584 22.80 19.21 24.83 20 T_TM2_M_HEADER_IN_MSG 43582 20.87 16.69 23.23 21 XM_B_SpammyWords2 41641 27.60 37.19 22.19 22 MIME_HTML_ONLY 40348 26.36 34.97 21.50 23 RCVD_IN_MSPIKE_WL 38367 20.54 20.70 20.45 24 T_KAM_HTML_FONT_INVALID 35786 22.73 29.22 19.07 25 USER_IN_DEF_DKIM_WL 35774 13.34 3.18 19.07 26 ALL_TRUSTED 30083 10.71 1.25 16.03 27 XM_Multi_Part_URI 29064 16.88 19.35 15.49 28 XM_Body_Dirty_Words 27293 18.14 24.53 14.55 29 XM_DKIMWhitelistDomains 26760 9.13 0.03 14.26 30 RCVD_IN_MSPIKE_H3 22400 13.95 17.53 11.94 31 BAYES_60 21379 10.00 7.52 11.39 32 UNPARSEABLE_RELAY 19274 11.19 12.82 10.27 33 XM_Evil_Numbers_Gen 18746 8.97 7.15 9.99 34 T_TooManySym_01 17581 6.80 2.22 9.37 35 XM_DK_Undo_02 16270 21.97 45.59 8.67 36 XM_B_Unsub 16263 10.81 14.62 8.67 37 LotsOfNums_01 15269 6.98 4.91 8.14 38 BAYES_00 14503 5.12 0.49 7.73 39 TR_XM_BayesUnsub 14084 9.98 14.37 7.51 40 RCVD_IN_VALIDITY_SAFE 13986 6.56 4.96 7.45 41 HTML_IMAGE_RATIO_02 13952 7.52 7.68 7.44 42 RCVD_IN_MSPIKE_H4 13187 5.58 3.00 7.03 43 XMStrtUSub 13174 6.06 4.36 7.02 44 BAYES_99 12948 17.20 35.48 6.90 45 TooManyTo_001 12908 6.08 4.66 6.88 46 XM_SendGrid 12713 6.78 6.78 6.78 47 BOTNET_IPINHOSTNAME 12272 9.03 13.45 6.54 48 RCVD_IN_VALIDITY_CERTIFIED 12184 5.79 4.53 6.49 49 LOTS_OF_MONEY 12177 7.12 8.24 6.49 50 T_TooManySym_02 12166 4.39 0.67 6.48 51 TR_XM_DK_Bayes 11763 4.14 0.37 6.27 52 TR_XM_DK_Bayes1 11681 4.11 0.37 6.23 53 TR_XM_DK_Bayes2 10817 3.81 0.35 5.77 54 XMNumbers 10540 5.07 4.10 5.62 55 BAYES_999 10471 13.60 27.84 5.58 56 XMSexyCombo_05 10384 7.89 12.08 5.53 57 TR_XM_DKIM_Undo 10334 17.04 37.51 5.51 58 HTML_IMAGE_RATIO_04 10279 4.91 3.89 5.48 59 IN_ZIMBRA_NJ_WHITELIST 10266 3.52 0.05 5.47 60 XM_B_SpammyWords3 10138 7.18 10.32 5.40 61 BAYES_80 9919 6.19 7.80 5.29 62 XM_H_Long_From01 9600 5.16 5.24 5.12 63 XM_B_Phish_Phrases 9559 4.78 4.21 5.09 64 TR_XM_SpammyWords4 9240 5.71 7.11 4.92 65 TR_XM_DK_SendGrid 9072 4.80 4.73 4.84 66 XM_UncommonTLD01 8909 7.17 11.48 4.75 67 XMSubMetaSx_00 8704 5.29 6.43 4.64 68 MPART_ALT_DIFF 8614 8.35 15.04 4.59 69 HTML_IMAGE_RATIO_06 8029 3.79 2.93 4.28 70 BAYES_40 7181 2.83 1.06 3.83 71 INVALID_MSGID 6954 2.44 0.18 3.71 72 RELAYCOUNTRY_META 6805 10.56 22.86 3.63 73 TR_XM_PhishingBody 6723 4.38 5.79 3.58 74 FSL_BULK_SIG 6687 5.12 7.88 3.56 75 BAYES_95 6662 4.05 4.93 3.55 76 FROM_EXCESS_BASE64 6622 3.15 2.48 3.53 77 MSGID_NOFQDN1 6553 2.27 0.10 3.49 78 HTML_IMAGE_RATIO_08 6424 3.12 2.57 3.42 79 TR_DCC_Bayes_99 6417 11.34 25.40 3.42 80 T_REMOTE_IMAGE 6329 3.10 2.60 3.37 81 MIME_HTML_MOSTLY 6304 4.13 5.51 3.36 82 MIME_QP_LONG_LINE 6030 2.65 1.66 3.21 83 TO_MALFORMED 5923 2.10 0.23 3.16 84 TVD_RCVD_IP 5669 2.02 0.24 3.02 85 DKIM_INVALID 5390 2.50 1.84 2.87 86 XMStockSpam_06 5317 2.31 1.39 2.83 87 BAYES_20 5267 2.06 0.74 2.81 88 T_TooManySym_03 5062 1.80 0.20 2.70 89 RCVD_IN_IADB_LISTED 5040 2.04 0.90 2.69 90 TVD_SPACE_RATIO 4923 1.72 0.12 2.62 91 RCVD_IN_IADB_SPF 4617 1.86 0.80 2.46 92 XM_B_SpammyTLD 4576 3.55 5.53 2.44 93 MIME_HTML_ONLY_MULTI 4416 5.41 10.83 2.35 94 RCVD_IN_IADB_SENDERID 4273 1.72 0.74 2.28 95 RCVD_IN_IADB_DK 4194 1.70 0.75 2.24 96 IN_HORDE_ADDRESS_BOOK 4136 1.43 0.07 2.20 97 TR_XM_UnparsRelay 3976 4.15 7.77 2.12 98 XMBSHREFv2 3946 1.39 0.13 2.10 99 XM_CamelCaseFrm001 3932 2.08 2.06 2.10 100 XM_PDF 3913 1.45 0.33 2.09 101 XMBdyGiftCard01 3882 2.10 2.16 2.07 102 MAILING_LIST_MULTI 3829 1.81 1.40 2.04 103 XM_OfRef6 3609 2.23 2.78 1.92 104 XM_H_Long_From02 3605 1.52 0.80 1.92 105 TM2_M_URI_OPT_OUT 3538 1.99 2.17 1.89 106 BAYES_05 3421 1.31 0.41 1.82 107 TR_XM_SpammyWords2 3392 6.38 14.48 1.81 108 BOTNET 3217 4.51 9.48 1.71 109 T_XMDrugObfuBody_14 3150 2.61 4.25 1.68 110 XM_B_Phish66 3130 2.13 2.94 1.67 111 UNTRUSTED_Relay 3050 4.33 9.14 1.63 112 TR_XM_SB_Phish 3046 1.49 1.25 1.62 113 ANY_BOUNCE_MESSAGE 3035 1.20 0.47 1.62 114 BOUNCE_MESSAGE 3033 1.20 0.47 1.62 115 RCVD_IN_IADB_VOUCHED 3009 1.17 0.40 1.60 116 XMSubPhish11 3007 1.39 1.02 1.60 117 TR_XM_SpammyRelay 2995 6.23 14.47 1.60 118 FVGT_m_MULTI_ODD_EMAIL 2930 1.06 0.16 1.56 119 XM_SPF_SoftFail 2882 2.09 3.07 1.54 120 XMBody_95 2863 1.01 0.10 1.53 121 URI_NOVOWEL 2820 2.32 3.77 1.50 122 RCVD_IN_RP_SAFE 2799 1.33 1.04 1.49 123 RCVD_IN_MSPIKE_H5 2780 1.01 0.17 1.48 124 XMGappySubj_01 2728 1.00 0.20 1.45 125 HTML_MIME_NO_HTML_TAG 2635 4.23 9.24 1.40 126 TM2_M_VERY_LONG_WORD 2560 4.80 10.89 1.36 127 TooManyTo_002 2515 0.99 0.38 1.34 128 XMSubMetaSxObfu_03 2508 1.05 0.55 1.34 129 RCVD_IN_RP_CERTIFIED 2506 1.17 0.88 1.34 130 XMSexyCombo_01 2504 1.65 2.22 1.33 131 TR_XM_Base64_M1 2501 1.27 1.16 1.33 132 TR_Symld_Words 2438 1.10 0.75 1.30 133 RELAYCOUNTRY_CA 2375 4.35 9.84 1.27 134 XM_DK_Undo_01 2353 2.02 3.38 1.25 135 XM_GoogleGroups 2330 3.97 8.82 1.24 136 XM_B_Investor 2323 1.99 3.33 1.24 137 XMDiploma_00 2292 1.58 2.22 1.22 138 HTML_FONT_FACE_BAD 2281 1.02 0.66 1.22 139 URI_HEX 2239 1.14 1.05 1.19 140 XM_H_Trusted_IP 2177 0.74 0.00 1.16 141 TR_XM_SpammyWords5 2126 1.93 3.36 1.13 142 T_XMDrugObfuBody_08 2084 2.21 4.15 1.11 143 XM_Body_Dirty_Words_01 2056 1.02 0.89 1.10 144 DKIM_ADSP_CUSTOM_MED 2056 0.91 0.57 1.10 145 XM_B_SpammyWords4 2006 1.43 2.07 1.07 146 RCVD_IN_IADB_OPTIN 1992 0.75 0.21 1.06 147 XM_UB50 1887 2.18 4.26 1.01 148 XMLngstWrd_00 1878 3.65 8.35 1.00 149 XMPhish30 1858 1.23 1.66 0.99 150 XMSexyCombo_04 1834 0.99 1.01 0.98 151 TooManyTo_003 1819 0.74 0.34 0.97 152 XM_B_COPY_HTML 1807 0.87 0.70 0.96 153 XMBrknScrpt_02 1805 0.91 0.81 0.96 154 XM_B_Unsub2 1792 1.33 1.99 0.96 155 XMSexyCombo_02 1785 0.88 0.74 0.95 156 XM_ProductURIs 1785 1.31 1.95 0.95 157 XMLngstWrd_01 1672 3.57 8.33 0.89 158 MPART_ALT_DIFF_COUNT 1642 0.99 1.18 0.88 159 SUBJ_ALL_CAPS 1635 1.20 1.78 0.87 160 KHOP_HELO_FCRDNS 1589 1.14 1.67 0.85 161 XMHTMLBadTable_001 1451 0.93 1.20 0.77 162 FORGED_GMAIL_RCVD 1393 0.64 0.45 0.74 163 TooManyTo_004 1388 0.59 0.32 0.74 164 DIET_1 1373 0.95 1.33 0.73 165 XMLngstWrd_02 1363 3.44 8.25 0.73 166 USER_IN_WELCOMELIST 1321 0.45 0.00 0.70 167 USER_IN_WHITELIST 1321 0.45 0.00 0.70 168 T_XMDrugObfuBody_00 1319 0.85 1.12 0.70 169 XMSubMetaSxObfu_02 1317 0.69 0.67 0.70 170 NML_ADSP_CUSTOM_MED 1311 0.62 0.49 0.70 171 HTML_TAG_BALANCE_BODY 1308 1.08 1.76 0.70 172 XM_H_PHPMailer 1273 0.68 0.69 0.68 173 RCVD_IN_PSBL 1209 0.90 1.36 0.64 174 T_XMHurry_00 1202 1.21 2.21 0.64 175 HTML_IMAGE_ONLY_20 1191 0.52 0.31 0.63 176 TooManyTo_005 1184 0.52 0.31 0.63 177 NUMERIC_HTTP_ADDR 1170 0.47 0.21 0.62 178 XMSubMetaI_00 1157 0.73 0.92 0.62 179 XMHTML_After_End 1114 0.67 0.80 0.59 180 T_FILL_THIS_FORM_SHORT 1097 1.96 4.40 0.58 181 XM_B_REG_HTML 1079 0.74 1.02 0.58 182 TR_MetaPhish_Combo_01 1068 0.60 0.67 0.57 183 XM_S_SubURI 1036 0.36 0.01 0.55 184 XMSubNoVowel 1028 0.66 0.85 0.55 185 XM_B_DNDMA 1025 0.78 1.19 0.55 186 MISSING_HEADERS 1016 0.53 0.50 0.54 187 PLING_QUERY 1016 0.61 0.72 0.54 188 HTTPS_HTTP_MISMATCH 986 0.78 1.24 0.53 189 TR_XM_Base64_M2 983 0.44 0.30 0.52 190 TR_XM_Base64_L1 970 0.54 0.59 0.52 191 PDS_OTHER_BAD_TLD 957 1.56 3.43 0.51 192 XMNoVowels 949 0.50 0.50 0.51 193 XMGenDplmaNmb 937 0.61 0.82 0.50 194 XMPhish08 907 0.53 0.60 0.48 195 T_TooManySym_04 901 0.36 0.15 0.48 196 AC_BR_BONANZA 880 0.46 0.46 0.47 197 URI_TRY_3LD 880 0.69 1.09 0.47 198 SpammyFromTLD_01 863 1.25 2.64 0.46 199 XMBody_17 861 1.73 3.98 0.46 200 FILL_THIS_FORM 858 0.37 0.23 0.46 ----------------------------------------------------------------------