Email: 549445 Autolearn: 0 AvgScore: 3.28 AvgScanTime: 1.25 sec Spam: 167873 Autolearn: 0 AvgScore: 13.74 AvgScanTime: 1.39 sec Ham: 381572 Autolearn: 0 AvgScore: -1.33 AvgScanTime: 1.18 sec Time Spent Running SA: 190.35 hours Time Spent Processing Spam: 65.05 hours Time Spent Processing Ham: 125.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159654 84.23 95.10 79.44 2 DKIM_SIGNED 147462 74.69 87.84 68.90 3 XM_DK_Pass 143934 72.71 85.74 66.97 4 DKIM_VALID 142716 71.85 85.01 66.05 5 XM_B_Unicode 133676 68.85 79.63 64.11 6 RELAYCOUNTRY_US 132361 76.85 78.85 75.96 7 DCC_CHECK 120257 43.43 71.64 31.03 8 XM_B_SpammyWords 120170 51.11 71.58 42.11 9 XMListUnsubscribeExists 119497 51.95 71.18 43.48 10 DKIM_VALID_AU 112250 57.17 66.87 52.90 11 RCVD_IN_MSPIKE_H2 78835 39.36 46.96 36.02 12 BAYES_50 75708 53.92 45.10 57.80 13 XM_B_Unicode3 73000 38.34 43.49 36.08 14 XM_B_SpammyWords2 66926 24.97 39.87 18.42 15 XM_DK_Undo_02 66527 15.87 39.63 5.41 16 LOC_TINY_FONT_1 64502 26.82 38.42 21.71 17 FVGT_m_MULTI_ODD 61257 27.67 36.49 23.79 18 HTML_FONT_LOW_CONTRAST 58000 27.50 34.55 24.40 19 TR_XM_DKIM_Undo 55728 12.76 33.20 3.77 20 DKIM_VALID_EF 55151 28.53 32.85 26.62 21 MIME_HTML_ONLY 55123 23.80 32.84 19.83 22 T_KAM_HTML_FONT_INVALID 50089 21.64 29.84 18.03 23 BAYES_99 49156 11.79 29.28 4.10 24 DCC_CHECK_NEGATIVE 47560 56.52 28.33 68.93 25 T_TM2_M_HEADER_IN_MSG 38852 27.87 23.14 29.95 26 BAYES_999 37912 9.10 22.58 3.17 27 RELAYCOUNTRY_META 36558 9.04 21.78 3.43 28 XM_Body_Dirty_Words 36450 13.99 21.71 10.59 29 TR_DCC_Bayes_99 35455 7.49 21.12 1.50 30 XMSubLong 35026 21.24 20.86 21.41 31 XM_Multi_Part_URI 31772 13.50 18.93 11.12 32 RCVD_IN_MSPIKE_WL 26586 16.02 15.84 16.10 33 TR_XM_SpammyRelay 25019 5.61 14.90 1.53 34 XM_B_Unsub 24265 10.46 14.45 8.70 35 BOTNET_IPINHOSTNAME 23768 7.31 14.16 4.30 36 TR_XM_BayesUnsub 23341 8.36 13.90 5.92 37 LOTS_OF_MONEY 23075 8.50 13.75 6.19 38 XM_B_SpammyWords3 22408 8.23 13.35 5.97 39 RCVD_IN_MSPIKE_H3 22117 11.02 13.17 10.07 40 TR_XM_SpammyWords2 19602 4.01 11.68 0.64 41 TR_XM_SpammyWords4 19410 6.39 11.56 4.12 42 MPART_ALT_DIFF 18386 7.94 10.95 6.62 43 XM_Evil_Numbers_Gen 18305 8.69 10.90 7.72 44 BOTNET 18238 4.29 10.86 1.40 45 UNPARSEABLE_RELAY 17511 8.49 10.43 7.64 46 XM_UncommonTLD01 16702 5.46 9.95 3.48 47 FSL_BULK_SIG 15712 5.09 9.36 3.21 48 XMSexyCombo_05 15331 5.12 9.13 3.35 49 RELAYCOUNTRY_CA 14623 3.38 8.71 1.03 50 UNTRUSTED_Relay 14546 3.59 8.66 1.36 51 BAYES_60 14103 8.49 8.40 8.53 52 BAYES_80 13871 5.23 8.26 3.89 53 RCVD_IN_BL_SPAMCOP_NET 12968 2.56 7.72 0.29 54 MIME_HTML_ONLY_MULTI 12103 5.37 7.21 4.56 55 TR_XM_PhishingBody 11598 4.14 6.91 2.92 56 TM2_M_VERY_LONG_WORD 11548 2.86 6.88 1.09 57 XMStrtUSub 10994 4.78 6.55 4.00 58 HTML_MIME_NO_HTML_TAG 10311 3.18 6.14 1.88 59 LotsOfNums_01 10034 6.91 5.98 7.32 60 XM_SendGrid 9643 5.25 5.74 5.04 61 TR_XM_UnparsRelay 9543 2.59 5.68 1.23 62 HTML_IMAGE_RATIO_02 9473 5.30 5.64 5.14 63 XM_H_Long_From01 9397 5.03 5.60 4.78 64 XM_B_Phish_Phrases 9285 4.04 5.53 3.38 65 TR_XM_SPAMCOP 9211 1.77 5.49 0.13 66 XMSubMetaSx_00 8979 4.08 5.35 3.53 67 XM_B_Investor 8522 2.53 5.08 1.40 68 XM_GoogleGroups 8425 2.35 5.02 1.18 69 XM_B_SpammyTLD 8340 2.98 4.97 2.11 70 MIME_HTML_MOSTLY 8164 3.29 4.86 2.60 71 XMLngstWrd_00 8054 1.81 4.80 0.49 72 XMLngstWrd_01 7996 1.75 4.76 0.42 73 RCVD_IN_MSPIKE_BL 7939 1.79 4.73 0.49 74 BAYES_95 7917 3.17 4.72 2.49 75 TR_XM_MSPIKECOMBO 7880 1.77 4.69 0.49 76 XMLngstWrd_02 7860 1.66 4.68 0.33 77 XM_SPF_SoftFail 7853 3.06 4.68 2.35 78 TooManyTo_001 7834 6.79 4.67 7.72 79 XMLngstWrd_03 7699 1.54 4.59 0.20 80 XMLngstWrd_04 7623 1.49 4.54 0.14 81 HTML_TITLE_SUBJ_DIFF 7583 1.40 4.52 0.03 82 SpammyFromTLD_02 7451 1.53 4.44 0.26 83 UPPERCASE_75_100 7435 1.37 4.43 0.02 84 T_XMDrugObfuBody_08 7039 2.13 4.19 1.23 85 TR_XM_SpammyWords5 7037 2.30 4.19 1.46 86 XMNumbers 7007 4.06 4.17 4.00 87 XM_UB50 6884 1.89 4.10 0.92 88 TR_XM_SpammyWords3 6676 1.43 3.98 0.31 89 HTML_IMAGE_RATIO_04 6517 3.64 3.88 3.53 90 TR_XM_DK_SendGrid 6515 3.62 3.88 3.51 91 XMBody_17 6509 1.77 3.88 0.84 92 XM_B_Phish66 6369 2.46 3.79 1.87 93 URIBL_DBL_SPAM 6335 1.16 3.77 0.01 94 URI_NOVOWEL 6303 2.58 3.75 2.06 95 HTML_IMAGE_RATIO_06 5976 3.69 3.56 3.74 96 T_XMDrugObfuBody_14 5877 2.19 3.50 1.61 97 XM_DIRTYINTL 5819 1.24 3.47 0.26 98 T_FILL_THIS_FORM_SHORT 5687 1.62 3.39 0.84 99 ALL_TRUSTED 5387 15.79 3.21 21.32 100 XM_OfRef6 5232 1.98 3.12 1.48 101 RCVD_IN_VALIDITY_SAFE 5064 3.75 3.02 4.07 102 XM_DK_Undo_01 4975 1.89 2.96 1.42 103 MIME_QP_LONG_LINE 4864 3.90 2.90 4.34 104 HTML_IMAGE_RATIO_08 4807 2.64 2.86 2.55 105 DKIM_INVALID 4746 2.84 2.83 2.85 106 XM_H_Undi_Recip 4547 1.05 2.71 0.32 107 BOTNET_NORDNS 4545 0.84 2.71 0.02 108 RCVD_IN_VALIDITY_CERTIFIED 4486 3.31 2.67 3.59 109 XM_B_SpammyWords4 4458 1.29 2.66 0.70 110 SpammyFromTLD_01 4308 1.28 2.57 0.71 111 RCVD_IN_MSPIKE_H4 4270 4.21 2.54 4.95 112 FROM_EXCESS_BASE64 4230 2.47 2.52 2.44 113 TR_XM_NoHeaderRelay 4220 0.85 2.51 0.11 114 URI_PHP_REDIR 4158 0.76 2.48 0.00 115 TM2_M_URI_OPT_OUT 4147 8.16 2.47 10.67 116 XMDiploma_00 4044 1.63 2.41 1.29 117 RCVD_IN_MSPIKE_L3 3992 1.02 2.38 0.43 118 USER_IN_DEF_DKIM_WL 3833 8.68 2.28 11.50 119 PDS_OTHER_BAD_TLD 3782 0.80 2.25 0.16 120 XMBdyGiftCard01 3715 1.20 2.21 0.76 121 XM_B_Unsub2 3704 1.63 2.21 1.37 122 XM_CamelCaseFrm001 3626 1.83 2.16 1.68 123 TR_XM_FormFill 3586 0.67 2.14 0.02 124 RELAYCOUNTRY_IN 3576 0.70 2.13 0.07 125 T_TooManySym_01 3525 5.78 2.10 7.39 126 XM_BadFromFormat 3435 0.69 2.05 0.10 127 HK_RANDOM_REPLYTO 3280 0.67 1.95 0.10 128 XMSexyCombo_01 3251 1.25 1.94 0.94 129 RELAYCOUNTRY_RU 3237 0.65 1.93 0.08 130 RCVD_IN_VALIDITY_RPBL 3201 0.63 1.91 0.07 131 T_XMHurry_00 3190 0.96 1.90 0.54 132 RCVD_IN_IADB_LISTED 3152 3.44 1.88 4.12 133 TO_NO_BRKTS_FROM_MSSP 3146 0.59 1.87 0.02 134 KHOP_HELO_FCRDNS 3108 1.71 1.85 1.65 135 LongTLD 3107 0.73 1.85 0.24 136 RCVD_IN_MSPIKE_L5 3105 0.59 1.85 0.03 137 PDS_DBL_URL_TNB_RUNON 3074 0.56 1.83 0.00 138 T_REMOTE_IMAGE 3013 2.90 1.79 3.39 139 TR_LOTS_OF_MONEY3 3012 0.83 1.79 0.41 140 FROM_SUSPICIOUS_NTLD 3008 0.58 1.79 0.04 141 SUBJ_ALL_CAPS 2976 1.40 1.77 1.24 142 XMStockSpam_06 2958 1.66 1.76 1.61 143 RCVD_IN_IADB_SPF 2833 3.09 1.69 3.70 144 TR_XM_SB_Phish 2826 2.79 1.68 3.28 145 TR_Mismatch_TLD_02 2819 0.57 1.68 0.08 146 MAILING_LIST_MULTI 2750 3.17 1.64 3.85 147 XM_URI_RBL 2719 0.57 1.62 0.11 148 TR_XM_Undi_Recip11 2692 0.54 1.60 0.08 149 XMSubPhish11 2671 2.74 1.59 3.24 150 T_XMDrugObfuBody_00 2653 0.98 1.58 0.72 151 RCVD_IN_IADB_DK 2645 2.77 1.58 3.29 152 TR_XM_Undi_Recip5 2619 0.49 1.56 0.01 153 FROM_SUSPICIOUS_NTLD_FP 2608 0.50 1.55 0.04 154 RCVD_IN_IADB_SENDERID 2608 2.82 1.55 3.37 155 XM_ProductURIs 2533 0.82 1.51 0.52 156 RCVD_IN_PSBL 2516 0.71 1.50 0.37 157 BAYES_40 2512 3.64 1.50 4.58 158 HTTPS_HTTP_MISMATCH 2498 1.01 1.49 0.79 159 TR_XM_PHPDW 2397 0.74 1.43 0.44 160 LOADSA_MONEY_COMBO 2339 0.45 1.39 0.04 161 TR_XM_Undi_Recip2 2335 0.44 1.39 0.03 162 DATE_IN_PAST_03_06 2317 0.54 1.38 0.17 163 TR_XM_InvalidRelay 2310 0.43 1.38 0.01 164 UNDISC_MONEY 2299 0.43 1.37 0.01 165 TR_XM_PHPForged 2285 0.69 1.36 0.40 166 HTML_TAG_BALANCE_BODY 2262 0.81 1.35 0.57 167 URI_HEX 2257 1.26 1.34 1.23 168 XM_UB99 2257 0.41 1.34 0.00 169 TR_XM_FormFill2 2246 0.68 1.34 0.39 170 XM_H_PHPOS 2240 0.68 1.33 0.39 171 XM_UB60 2213 0.46 1.32 0.08 172 XMHTML_After_End 2210 0.99 1.32 0.84 173 XFER_LOTSA_MONEY 2179 0.41 1.30 0.03 174 XM_B_COVIDMETA 2171 0.55 1.29 0.23 175 XMReplyNow 2158 0.55 1.29 0.22 176 TR_XM_BayesRelay 2152 0.39 1.28 0.00 177 ADVANCE_FEE_5_NEW_MONEY 2112 0.39 1.26 0.00 178 TR_Symld_Words 2070 1.40 1.23 1.47 179 XM_B_SEO 2053 0.44 1.22 0.10 180 XMPhish30 2043 0.68 1.22 0.45 181 SHOPIFY_IMG_NOT_RCVD_SFY 2029 0.51 1.21 0.21 182 TR_XM_MSPIKECOMBO2 2016 0.38 1.20 0.02 183 FONT_INVIS_LONG_LINE 2012 0.40 1.20 0.05 184 XMPhish08 2009 0.51 1.20 0.21 185 URIBL_BLACK 1976 0.39 1.18 0.05 186 HTML_FONT_TINY_NORDNS 1930 0.41 1.15 0.08 187 BAYES_20 1913 2.69 1.14 3.37 188 TR_XM_Base64_L1 1870 0.64 1.11 0.43 189 XMGenDplmaNmb 1855 0.78 1.11 0.64 190 TR_XM_Base64_M1 1846 1.02 1.10 0.98 191 TR_XM_SEO4 1841 0.37 1.10 0.06 192 URI_TRY_3LD 1833 0.68 1.09 0.50 193 XMSubMetaI_00 1832 0.69 1.09 0.52 194 XMBrknScrpt_02 1828 1.03 1.09 1.01 195 MPART_ALT_DIFF_COUNT 1772 0.67 1.06 0.49 196 XM_UB999 1667 0.30 0.99 0.00 197 PLING_QUERY 1640 0.65 0.98 0.51 198 BAYES_00 1638 9.39 0.98 13.10 199 DIET_1 1633 0.64 0.97 0.49 200 REMOVE_BEFORE_LINK 1629 0.52 0.97 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 303127 84.23 95.10 79.44 2 RELAYCOUNTRY_US 289861 76.85 78.85 75.96 3 DCC_CHECK_NEGATIVE 263004 56.52 28.33 68.93 4 DKIM_SIGNED 262918 74.69 87.84 68.90 5 XM_DK_Pass 255540 72.71 85.74 66.97 6 DKIM_VALID 252035 71.85 85.01 66.05 7 XM_B_Unicode 244627 68.85 79.63 64.11 8 BAYES_50 220531 53.92 45.10 57.80 9 DKIM_VALID_AU 201854 57.17 66.87 52.90 10 XMListUnsubscribeExists 165926 51.95 71.18 43.48 11 XM_B_SpammyWords 160676 51.11 71.58 42.11 12 XM_B_Unicode3 137656 38.34 43.49 36.08 13 RCVD_IN_MSPIKE_H2 137435 39.36 46.96 36.02 14 DCC_CHECK 118389 43.43 71.64 31.03 15 T_TM2_M_HEADER_IN_MSG 114270 27.87 23.14 29.95 16 DKIM_VALID_EF 101589 28.53 32.85 26.62 17 HTML_FONT_LOW_CONTRAST 93088 27.50 34.55 24.40 18 FVGT_m_MULTI_ODD 90772 27.67 36.49 23.79 19 LOC_TINY_FONT_1 82847 26.82 38.42 21.71 20 XMSubLong 81676 21.24 20.86 21.41 21 ALL_TRUSTED 81351 15.79 3.21 21.32 22 MIME_HTML_ONLY 75672 23.80 32.84 19.83 23 XM_B_SpammyWords2 70275 24.97 39.87 18.42 24 T_KAM_HTML_FONT_INVALID 68812 21.64 29.84 18.03 25 RCVD_IN_MSPIKE_WL 61429 16.02 15.84 16.10 26 BAYES_00 49978 9.39 0.98 13.10 27 USER_IN_DEF_DKIM_WL 43880 8.68 2.28 11.50 28 XM_Multi_Part_URI 42427 13.50 18.93 11.12 29 TM2_M_URI_OPT_OUT 40698 8.16 2.47 10.67 30 XM_Body_Dirty_Words 40390 13.99 21.71 10.59 31 RCVD_IN_MSPIKE_H3 38407 11.02 13.17 10.07 32 BOUNCE_MESSAGE 33630 6.32 0.67 8.81 33 ANY_BOUNCE_MESSAGE 33630 6.32 0.67 8.81 34 XM_B_Unsub 33189 10.46 14.45 8.70 35 BAYES_60 32559 8.49 8.40 8.53 36 XM_DKIMWhitelistDomains 31752 5.79 0.04 8.32 37 TooManyTo_001 29455 6.79 4.67 7.72 38 XM_Evil_Numbers_Gen 29455 8.69 10.90 7.72 39 UNPARSEABLE_RELAY 29163 8.49 10.43 7.64 40 T_TooManySym_01 28216 5.78 2.10 7.39 41 LotsOfNums_01 27940 6.91 5.98 7.32 42 MPART_ALT_DIFF 25258 7.94 10.95 6.62 43 LOTS_OF_MONEY 23628 8.50 13.75 6.19 44 XM_B_SpammyWords3 22787 8.23 13.35 5.97 45 TR_XM_BayesUnsub 22582 8.36 13.90 5.92 46 IN_ZIMBRA_NJ_WHITELIST 22491 4.12 0.09 5.89 47 XM_DK_Undo_02 20651 15.87 39.63 5.41 48 TR_XM_DK_Bayes 20620 3.96 0.67 5.40 49 TR_XM_DK_Bayes1 20250 3.89 0.67 5.31 50 HTML_IMAGE_RATIO_02 19623 5.30 5.64 5.14 51 XM_SendGrid 19228 5.25 5.74 5.04 52 RCVD_IN_MSPIKE_H4 18889 4.21 2.54 4.95 53 XM_H_Long_From01 18238 5.03 5.60 4.78 54 TR_XM_DK_Bayes2 17534 3.37 0.59 4.60 55 BAYES_40 17467 3.64 1.50 4.58 56 T_TooManySym_02 17461 3.37 0.62 4.58 57 MIME_HTML_ONLY_MULTI 17386 5.37 7.21 4.56 58 XM_PDF 17208 3.32 0.61 4.51 59 MIME_QP_LONG_LINE 16576 3.90 2.90 4.34 60 BOTNET_IPINHOSTNAME 16417 7.31 14.16 4.30 61 RCVD_IN_IADB_LISTED 15724 3.44 1.88 4.12 62 TR_XM_SpammyWords4 15708 6.39 11.56 4.12 63 BAYES_99 15645 11.79 29.28 4.10 64 RCVD_IN_VALIDITY_SAFE 15514 3.75 3.02 4.07 65 XMNumbers 15281 4.06 4.17 4.00 66 XMStrtUSub 15252 4.78 6.55 4.00 67 BAYES_80 14842 5.23 8.26 3.89 68 MAILING_LIST_MULTI 14676 3.17 1.64 3.85 69 TR_XM_DKIM_Undo 14375 12.76 33.20 3.77 70 HTML_IMAGE_RATIO_06 14289 3.69 3.56 3.74 71 RCVD_IN_IADB_SPF 14134 3.09 1.69 3.70 72 RCVD_IN_VALIDITY_CERTIFIED 13704 3.31 2.67 3.59 73 HTML_IMAGE_RATIO_04 13460 3.64 3.88 3.53 74 XMSubMetaSx_00 13455 4.08 5.35 3.53 75 TR_XM_DK_SendGrid 13399 3.62 3.88 3.51 76 XM_H_Trusted_IP 13360 2.43 0.00 3.50 77 XM_UncommonTLD01 13286 5.46 9.95 3.48 78 RELAYCOUNTRY_META 13095 9.04 21.78 3.43 79 T_REMOTE_IMAGE 12922 2.90 1.79 3.39 80 XM_B_Phish_Phrases 12887 4.04 5.53 3.38 81 BAYES_20 12877 2.69 1.14 3.37 82 RCVD_IN_IADB_SENDERID 12863 2.82 1.55 3.37 83 XMSexyCombo_05 12797 5.12 9.13 3.35 84 RCVD_IN_IADB_DK 12565 2.77 1.58 3.29 85 TR_XM_SB_Phish 12502 2.79 1.68 3.28 86 XMSubPhish11 12363 2.74 1.59 3.24 87 FSL_BULK_SIG 12262 5.09 9.36 3.21 88 BAYES_999 12109 9.10 22.58 3.17 89 TR_XM_PhishingBody 11149 4.14 6.91 2.92 90 DKIM_INVALID 10883 2.84 2.83 2.85 91 MIME_HTML_MOSTLY 9920 3.29 4.86 2.60 92 HTML_IMAGE_RATIO_08 9720 2.64 2.86 2.55 93 BAYES_95 9500 3.17 4.72 2.49 94 FROM_EXCESS_BASE64 9317 2.47 2.52 2.44 95 RCVD_IN_IADB_VOUCHED 9222 1.93 0.83 2.42 96 XM_SPF_SoftFail 8984 3.06 4.68 2.35 97 TooManyTo_002 8350 1.70 0.60 2.19 98 BAYES_05 8173 1.68 0.63 2.14 99 XM_B_SpammyTLD 8060 2.98 4.97 2.11 100 URI_NOVOWEL 7849 2.58 3.75 2.06 101 XMNoVowels 7613 1.58 0.63 2.00 102 T_TooManySym_03 7192 1.40 0.30 1.88 103 HTML_MIME_NO_HTML_TAG 7184 3.18 6.14 1.88 104 XM_B_Phish66 7135 2.46 3.79 1.87 105 TVD_RCVD_IP 7073 1.34 0.18 1.85 106 INVALID_MSGID 6760 1.27 0.12 1.77 107 HELO_NODOT 6726 1.41 0.62 1.76 108 HELO_NO_DOMAIN 6724 1.41 0.62 1.76 109 XM_CamelCaseFrm001 6428 1.83 2.16 1.68 110 IN_HORDE_ADDRESS_BOOK 6376 1.19 0.08 1.67 111 KHOP_HELO_FCRDNS 6304 1.71 1.85 1.65 112 MSGID_NOFQDN1 6241 1.14 0.01 1.64 113 T_XMDrugObfuBody_14 6160 2.19 3.50 1.61 114 XMStockSpam_06 6146 1.66 1.76 1.61 115 RCVD_IN_IADB_OPTIN 6138 1.27 0.51 1.61 116 TO_MALFORMED 5974 1.09 0.02 1.57 117 TR_XM_SpammyRelay 5824 5.61 14.90 1.53 118 TR_DCC_Bayes_99 5715 7.49 21.12 1.50 119 XM_OfRef6 5656 1.98 3.12 1.48 120 TR_Symld_Words 5622 1.40 1.23 1.47 121 TooManyTo_003 5611 1.16 0.47 1.47 122 TR_XM_SpammyWords5 5578 2.30 4.19 1.46 123 TVD_SPACE_RATIO 5458 1.02 0.08 1.43 124 XM_DK_Undo_01 5403 1.89 2.96 1.42 125 XM_B_Investor 5359 2.53 5.08 1.40 126 BOTNET 5336 4.29 10.86 1.40 127 XM_B_Unsub2 5240 1.63 2.21 1.37 128 UNTRUSTED_Relay 5199 3.59 8.66 1.36 129 XMDiploma_00 4932 1.63 2.41 1.29 130 HTML_FONT_FACE_BAD 4915 1.11 0.71 1.29 131 SUBJ_ALL_CAPS 4722 1.40 1.77 1.24 132 TR_XM_UnparsRelay 4695 2.59 5.68 1.23 133 T_XMDrugObfuBody_08 4689 2.13 4.19 1.23 134 URI_HEX 4677 1.26 1.34 1.23 135 XM_GoogleGroups 4513 2.35 5.02 1.18 136 XMGappySubj_01 4460 0.86 0.14 1.17 137 XMSubNoVowel 4374 0.92 0.40 1.15 138 XMCapTrack 4316 0.91 0.40 1.13 139 TM2_M_VERY_LONG_WORD 4170 2.86 6.88 1.09 140 TooManyTo_004 4146 0.88 0.42 1.09 141 RCVD_IN_MSPIKE_H5 4133 0.79 0.12 1.08 142 XMBSHREFv2 3986 0.79 0.22 1.04 143 RELAYCOUNTRY_CA 3947 3.38 8.71 1.03 144 XM_H_Long_From02 3904 0.98 0.89 1.02 145 XMBrknScrpt_02 3845 1.03 1.09 1.01 146 TR_XM_Base64_M1 3739 1.02 1.10 0.98 147 XM_Body_Dirty_Words_01 3643 0.95 0.93 0.95 148 XMSexyCombo_01 3596 1.25 1.94 0.94 149 DKIM_ADSP_CUSTOM_MED 3564 0.85 0.66 0.93 150 XM_UB50 3522 1.89 4.10 0.92 151 TooManyTo_005 3436 0.74 0.36 0.90 152 XMSubMetaSxObfu_03 3236 0.84 0.83 0.85 153 XMHTML_After_End 3208 0.99 1.32 0.84 154 XMBody_17 3204 1.77 3.88 0.84 155 T_FILL_THIS_FORM_SHORT 3197 1.62 3.39 0.84 156 RCVD_IN_RP_SAFE 3162 0.77 0.62 0.83 157 XMBody_95 3149 0.61 0.12 0.83 158 HTTPS_HTTP_MISMATCH 3028 1.01 1.49 0.79 159 FVGT_m_MULTI_ODD_EMAIL 3005 0.58 0.12 0.79 160 XMBdyGiftCard01 2898 1.20 2.21 0.76 161 RCVD_IN_RP_CERTIFIED 2867 0.68 0.50 0.75 162 T_XMDrugObfuBody_00 2749 0.98 1.58 0.72 163 SpammyFromTLD_01 2722 1.28 2.57 0.71 164 XM_B_SpammyWords4 2657 1.29 2.66 0.70 165 FROM_GOV_DKIM_AU 2648 0.53 0.15 0.69 166 XMGenDplmaNmb 2450 0.78 1.11 0.64 167 TR_XM_SpammyWords2 2427 4.01 11.68 0.64 168 XM_ShortIntro_01 2367 0.60 0.56 0.62 169 NML_ADSP_CUSTOM_MED 2362 0.58 0.48 0.62 170 XM_B_COPY_HTML 2298 0.61 0.62 0.60 171 XM_H_PHPMailer 2277 0.65 0.77 0.60 172 XMSexyCombo_04 2177 0.63 0.77 0.57 173 HTML_TAG_BALANCE_BODY 2173 0.81 1.35 0.57 174 T_TooManySym_04 2162 0.43 0.13 0.57 175 MISSING_HEADERS 2155 0.49 0.33 0.56 176 T_OBFU_PDF_ATTACH 2123 0.41 0.09 0.56 177 TR_MetaPhish_Combo_01 2107 0.68 0.96 0.55 178 FORGED_GMAIL_RCVD 2084 0.54 0.53 0.55 179 T_XMHurry_00 2058 0.96 1.90 0.54 180 XMSubMetaI_00 1974 0.69 1.09 0.52 181 XM_ProductURIs 1969 0.82 1.51 0.52 182 PLING_QUERY 1957 0.65 0.98 0.51 183 HTML_IMAGE_ONLY_20 1933 0.46 0.37 0.51 184 URI_TRY_3LD 1907 0.68 1.09 0.50 185 RELAYCOUNTRY_GB 1900 0.60 0.83 0.50 186 XMLngstWrd_00 1885 1.81 4.80 0.49 187 MPART_ALT_DIFF_COUNT 1882 0.67 1.06 0.49 188 DIET_1 1877 0.64 0.97 0.49 189 RCVD_IN_MSPIKE_BL 1870 1.79 4.73 0.49 190 TR_XM_MSPIKECOMBO 1868 1.77 4.69 0.49 191 SHORT_HELO_AND_INLINE_IMAGE 1802 0.34 0.05 0.47 192 T_Symld_Words_02 1799 0.56 0.75 0.47 193 XM_shorewaves_Whitelist 1790 0.33 0.00 0.47 194 FILL_THIS_FORM 1765 0.42 0.32 0.46 195 XMSexyCombo_02 1739 0.37 0.16 0.46 196 XMMoneyMeta_00 1715 0.58 0.87 0.45 197 XMPhish30 1710 0.68 1.22 0.45 198 HTML_IMAGE_ONLY_32 1694 0.37 0.19 0.44 199 TR_XM_PHPDW 1693 0.74 1.43 0.44 200 TR_XM_Base64_L1 1649 0.64 1.11 0.43 ----------------------------------------------------------------------