Email: 328661 Autolearn: 0 AvgScore: 4.84 AvgScanTime: 1.21 sec Spam: 129238 Autolearn: 0 AvgScore: 13.47 AvgScanTime: 1.27 sec Ham: 199423 Autolearn: 0 AvgScore: -0.75 AvgScanTime: 1.18 sec Time Spent Running SA: 110.85 hours Time Spent Processing Spam: 45.52 hours Time Spent Processing Ham: 65.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121969 88.07 94.38 83.98 2 DKIM_SIGNED 116215 83.32 89.92 79.03 3 XM_DK_Pass 114890 81.52 88.90 76.74 4 DKIM_VALID 114039 80.99 88.24 76.29 5 XM_B_Unicode 105024 76.15 81.26 72.83 6 DCC_CHECK 97588 55.68 75.51 42.83 7 RELAYCOUNTRY_US 96793 77.68 74.90 79.48 8 XMListUnsubscribeExists 96269 63.09 74.49 55.70 9 XM_B_SpammyWords 91423 57.30 70.74 48.59 10 DKIM_VALID_AU 90480 67.27 70.01 65.49 11 RCVD_IN_MSPIKE_H2 61972 42.87 47.95 39.57 12 XM_DK_Undo_02 61520 23.73 47.60 8.26 13 XM_B_Unicode3 55351 44.16 42.83 45.02 14 LOC_TINY_FONT_1 52150 33.98 40.35 29.85 15 TR_XM_DKIM_Undo 51525 18.94 39.87 5.38 16 XM_B_SpammyWords2 51285 28.52 39.68 21.29 17 BAYES_50 50971 50.73 39.44 58.05 18 DKIM_VALID_EF 45993 32.53 35.59 30.55 19 BAYES_99 45125 17.67 34.92 6.50 20 MIME_HTML_ONLY 44418 26.72 34.37 21.76 21 FVGT_m_MULTI_ODD 44149 30.02 34.16 27.33 22 HTML_FONT_LOW_CONTRAST 43940 34.05 34.00 34.08 23 T_KAM_HTML_FONT_INVALID 36171 23.03 27.99 19.82 24 BAYES_999 35617 14.08 27.56 5.35 25 TR_DCC_Bayes_99 33599 11.85 26.00 2.69 26 DCC_CHECK_NEGATIVE 31630 44.29 24.47 57.13 27 RELAYCOUNTRY_META 31291 11.87 24.21 3.87 28 XM_Body_Dirty_Words 27307 15.84 21.13 12.42 29 RCVD_IN_MSPIKE_WL 26280 20.65 20.33 20.86 30 XMSubLong 25207 21.48 19.50 22.76 31 T_TM2_M_HEADER_IN_MSG 23959 19.93 18.54 20.83 32 XM_Multi_Part_URI 23846 15.96 18.45 14.34 33 TR_XM_SpammyRelay 23691 8.45 18.33 2.05 34 RCVD_IN_MSPIKE_H3 21811 13.92 16.88 12.00 35 TR_XM_SpammyWords2 17944 6.14 13.88 1.12 36 RCVD_IN_BL_SPAMCOP_NET 17907 5.98 13.86 0.88 37 XM_B_Unsub 17164 10.65 13.28 8.94 38 TR_XM_BayesUnsub 16812 9.60 13.01 7.39 39 RELAYCOUNTRY_CA 16802 6.14 13.00 1.69 40 UNPARSEABLE_RELAY 16637 11.03 12.87 9.84 41 MPART_ALT_DIFF 15187 7.53 11.75 4.79 42 TR_XM_SPAMCOP 14969 4.76 11.58 0.34 43 LOTS_OF_MONEY 14474 7.90 11.20 5.76 44 BOTNET_IPINHOSTNAME 14464 8.36 11.19 6.52 45 XM_B_SpammyWords3 14119 7.73 10.92 5.66 46 XMSexyCombo_05 13099 6.55 10.14 4.23 47 XM_UncommonTLD01 12929 6.86 10.00 4.83 48 FSL_BULK_SIG 12824 6.68 9.92 4.58 49 TR_XM_SpammyWords4 11987 5.99 9.28 3.87 50 BAYES_80 11282 6.68 8.73 5.35 51 BAYES_60 10852 10.37 8.40 11.65 52 XM_Evil_Numbers_Gen 10186 8.61 7.88 9.08 53 TR_XM_UnparsRelay 9951 4.18 7.70 1.89 54 UNTRUSTED_Relay 9828 3.85 7.60 1.41 55 TM2_M_VERY_LONG_WORD 9396 3.72 7.27 1.42 56 MIME_HTML_ONLY_MULTI 9308 4.41 7.20 2.60 57 HTML_MIME_NO_HTML_TAG 9081 3.95 7.03 1.96 58 BOTNET 9023 3.68 6.98 1.54 59 HTML_IMAGE_RATIO_02 8436 8.00 6.53 8.95 60 XM_SendGrid 8333 6.08 6.45 5.85 61 LotsOfNums_01 7731 7.13 5.98 7.87 62 T_FILL_THIS_FORM_SHORT 7666 2.74 5.93 0.68 63 TR_XM_SpammyWords5 7617 3.26 5.89 1.55 64 TR_XM_PhishingBody 7579 4.15 5.86 3.04 65 XMBody_17 7304 2.60 5.65 0.62 66 XM_SPF_SoftFail 7303 2.99 5.65 1.27 67 MIME_HTML_MOSTLY 7235 4.11 5.60 3.15 68 XMSubMetaSx_00 7220 4.46 5.59 3.73 69 BAYES_95 7059 4.14 5.46 3.29 70 TooManyTo_001 7037 6.87 5.44 7.79 71 XM_H_Long_From01 6852 5.54 5.30 5.70 72 RCVD_IN_VALIDITY_SAFE 6681 6.16 5.17 6.80 73 XM_GoogleGroups 6557 2.77 5.07 1.28 74 XMLngstWrd_00 6435 2.28 4.98 0.53 75 XMLngstWrd_01 6395 2.21 4.95 0.44 76 XMLngstWrd_02 6322 2.14 4.89 0.35 77 HTML_IMAGE_RATIO_04 6016 5.15 4.65 5.47 78 XMLngstWrd_03 5955 1.97 4.61 0.26 79 XMLngstWrd_04 5912 1.93 4.57 0.22 80 TR_XM_DK_SendGrid 5899 4.27 4.56 4.09 81 HTML_TITLE_SUBJ_DIFF 5898 1.81 4.56 0.03 82 UPPERCASE_75_100 5883 1.81 4.55 0.03 83 RCVD_IN_VALIDITY_CERTIFIED 5881 5.40 4.55 5.96 84 SpammyFromTLD_02 5827 1.90 4.51 0.21 85 HK_RANDOM_REPLYTO 5718 1.80 4.42 0.10 86 XM_DIRTYINTL 5659 1.92 4.38 0.33 87 URI_NOVOWEL 5508 2.65 4.26 1.61 88 T_XMDrugObfuBody_08 5349 2.43 4.14 1.32 89 ALL_TRUSTED 5279 11.97 4.08 17.08 90 SpammyFromTLD_01 5247 1.87 4.06 0.46 91 XMNumbers 5210 5.15 4.03 5.87 92 SUBJ_ALL_CAPS 4913 2.23 3.80 1.21 93 XM_UB50 4864 2.05 3.76 0.94 94 USER_IN_DEF_DKIM_WL 4693 12.34 3.63 17.98 95 RCVD_IN_MSPIKE_BL 4671 1.71 3.61 0.47 96 TR_XM_MSPIKECOMBO 4639 1.70 3.59 0.47 97 XMStrtUSub 4576 4.98 3.54 5.92 98 T_XMDrugObfuBody_14 4546 2.86 3.52 2.44 99 XM_B_SpammyTLD 4400 2.63 3.40 2.12 100 T_REMOTE_IMAGE 4230 3.26 3.27 3.25 101 XMDiploma_00 4178 1.88 3.23 1.01 102 XM_B_Phish_Phrases 4119 3.35 3.19 3.45 103 RCVD_IN_MSPIKE_H4 4117 5.48 3.19 6.97 104 RELAYCOUNTRY_IN 4056 1.33 3.14 0.15 105 HTML_IMAGE_RATIO_06 4056 3.45 3.14 3.64 106 TR_XM_FormFill 4049 1.24 3.13 0.01 107 XM_B_Investor 3900 1.92 3.02 1.22 108 FONT_INVIS_LONG_LINE 3801 1.22 2.94 0.10 109 XM_B_Phish66 3722 1.93 2.88 1.32 110 HTML_IMAGE_RATIO_08 3702 2.17 2.86 1.73 111 RCVD_IN_MSPIKE_L3 3571 1.26 2.76 0.28 112 XM_OfRef6 3478 1.61 2.69 0.92 113 T_XMHurry_00 3161 1.97 2.45 1.67 114 TR_XM_BayesRelay 3053 0.93 2.36 0.00 115 TM2_M_URI_OPT_OUT 3029 2.08 2.34 1.91 116 TR_XM_SpammyWords3 3005 1.08 2.33 0.28 117 FROM_EXCESS_BASE64 2939 3.30 2.27 3.96 118 RCVD_IN_VALIDITY_RPBL 2860 0.94 2.21 0.11 119 XM_CamelCaseFrm001 2855 2.31 2.21 2.38 120 XM_H_Undi_Recip 2779 1.06 2.15 0.36 121 TR_LOTS_OF_MONEY3 2738 1.01 2.12 0.29 122 XMBdyGiftCard01 2734 2.09 2.12 2.07 123 XM_B_SpammyWords4 2724 1.46 2.11 1.03 124 XM_ProductURIs 2693 1.33 2.08 0.84 125 TR_Caps_n_Bayes_99 2669 0.96 2.07 0.24 126 TR_XM_PHPDW 2644 1.07 2.05 0.43 127 LongTLD 2585 1.07 2.00 0.47 128 XM_DK_Undo_01 2581 1.64 2.00 1.41 129 TR_XM_PHPForged 2553 1.00 1.98 0.37 130 TR_Mismatch_TLD_02 2539 0.82 1.96 0.08 131 TR_XM_FormFill2 2513 0.99 1.94 0.36 132 XM_H_PHPOS 2506 0.98 1.94 0.35 133 XMSexyCombo_01 2504 1.06 1.94 0.49 134 T_TooManySym_01 2498 6.30 1.93 9.14 135 FROM_SUSPICIOUS_NTLD 2465 0.79 1.91 0.07 136 TR_XM_NoHeaderRelay 2442 0.80 1.89 0.10 137 FROM_SUSPICIOUS_NTLD_FP 2349 0.76 1.82 0.07 138 URIBL_DBL_SPAM 2342 0.72 1.81 0.01 139 MIME_QP_LONG_LINE 2255 2.87 1.74 3.61 140 SHORT_URI_3 2204 1.58 1.71 1.50 141 DKIM_INVALID 2176 2.33 1.68 2.74 142 PDS_OTHER_BAD_TLD 2040 0.81 1.58 0.32 143 XMStockSpam_06 1990 1.58 1.54 1.61 144 XM_B_Unsub2 1947 1.46 1.51 1.43 145 XM_RXBody 1905 0.77 1.47 0.32 146 XMPhish30 1748 1.01 1.35 0.78 147 XMBrknScrpt_02 1712 1.08 1.32 0.93 148 TR_XM_MSPIKECOMBO2 1708 0.53 1.32 0.02 149 SUBJ_DOLLARS 1696 0.91 1.31 0.64 150 BAYES_40 1685 2.78 1.30 3.74 151 TR_XM_Undi_Recip2 1667 0.65 1.29 0.23 152 TR_XM_SB_Phish 1664 1.55 1.29 1.72 153 MPART_ALT_DIFF_COUNT 1656 0.91 1.28 0.67 154 XM_UB60 1574 0.52 1.22 0.07 155 TR_XM_Undi_Recip5 1571 0.52 1.22 0.07 156 XM_Body_Dirty_Words_01 1566 1.03 1.21 0.91 157 MAILING_LIST_MULTI 1545 1.81 1.20 2.21 158 SHOPIFY_IMG_NOT_RCVD_SFY 1543 0.65 1.19 0.29 159 XMReplyNow 1503 0.58 1.16 0.21 160 XMGenDplmaNmb 1493 0.73 1.16 0.45 161 UNDISC_MONEY 1486 0.45 1.15 0.00 162 TR_XM_MaxSPIKE 1469 0.46 1.14 0.02 163 DIET_1 1419 0.87 1.10 0.72 164 BOTNET_NORDNS 1390 0.43 1.08 0.01 165 TR_Sbj_FN_Bdy 1385 0.52 1.07 0.17 166 T_XMDrugObfuBody_00 1379 0.94 1.07 0.85 167 KHOP_HELO_FCRDNS 1364 0.70 1.06 0.46 168 TR_XM_Base64_M1 1331 1.13 1.03 1.19 169 URI_PHP_REDIR 1329 0.41 1.03 0.01 170 RCVD_IN_RP_SAFE 1321 1.21 1.02 1.34 171 HTML_TAG_BALANCE_BODY 1291 1.00 1.00 1.00 172 XM_URI_RBL 1286 0.48 1.00 0.15 173 URI_HEX 1282 0.98 0.99 0.97 174 URI_TRY_3LD 1279 0.91 0.99 0.85 175 RCVD_IN_IADB_LISTED 1257 2.28 0.97 3.13 176 PLING_QUERY 1247 0.71 0.96 0.54 177 HK_SCAM 1240 0.42 0.96 0.08 178 MIME_BASE64_TEXT 1214 0.42 0.94 0.08 179 XM_UB99 1204 0.37 0.93 0.01 180 XMSubPhish11 1201 1.40 0.93 1.71 181 XM_B_REG_HTML 1182 0.67 0.91 0.51 182 RCVD_IN_PSBL 1178 0.77 0.91 0.68 183 HTTPS_HTTP_MISMATCH 1178 0.58 0.91 0.37 184 BAYES_20 1175 2.04 0.91 2.78 185 RELAYCOUNTRY_AU 1147 0.48 0.89 0.22 186 TR_MetaPhish_Combo_01 1146 0.85 0.89 0.83 187 XMHTML_After_End 1145 0.67 0.89 0.54 188 RCVD_IN_RP_CERTIFIED 1140 1.06 0.88 1.18 189 RELAYCOUNTRY_RU 1136 0.37 0.88 0.03 190 XM_UB80 1122 0.35 0.87 0.02 191 RCVD_IN_IADB_SPF 1106 2.08 0.86 2.87 192 XM_B_COPY_HTML 1102 0.91 0.85 0.94 193 MONEY_FORM_SHORT 1096 0.38 0.85 0.07 194 TR_Mismatch_TLD_01 1054 0.53 0.82 0.34 195 LOADSA_MONEY_COMBO 1045 0.35 0.81 0.05 196 XMHTMLBadTable_001 1037 0.66 0.80 0.57 197 LOW_PRICE 1035 0.47 0.80 0.26 198 XM_H_NotFromAmazon 1033 0.33 0.80 0.03 199 RCVD_IN_IADB_DK 1022 1.90 0.79 2.62 200 T_HTML_ATTACH 1021 0.32 0.79 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167481 88.07 94.38 83.98 2 RELAYCOUNTRY_US 158504 77.68 74.90 79.48 3 DKIM_SIGNED 157609 83.32 89.92 79.03 4 XM_DK_Pass 153047 81.52 88.90 76.74 5 DKIM_VALID 152141 80.99 88.24 76.29 6 XM_B_Unicode 145240 76.15 81.26 72.83 7 DKIM_VALID_AU 130595 67.27 70.01 65.49 8 BAYES_50 115764 50.73 39.44 58.05 9 DCC_CHECK_NEGATIVE 113923 44.29 24.47 57.13 10 XMListUnsubscribeExists 111083 63.09 74.49 55.70 11 XM_B_SpammyWords 96893 57.30 70.74 48.59 12 XM_B_Unicode3 89779 44.16 42.83 45.02 13 DCC_CHECK 85422 55.68 75.51 42.83 14 RCVD_IN_MSPIKE_H2 78920 42.87 47.95 39.57 15 HTML_FONT_LOW_CONTRAST 67968 34.05 34.00 34.08 16 DKIM_VALID_EF 60919 32.53 35.59 30.55 17 LOC_TINY_FONT_1 59530 33.98 40.35 29.85 18 FVGT_m_MULTI_ODD 54510 30.02 34.16 27.33 19 XMSubLong 45386 21.48 19.50 22.76 20 MIME_HTML_ONLY 43392 26.72 34.37 21.76 21 XM_B_SpammyWords2 42457 28.52 39.68 21.29 22 RCVD_IN_MSPIKE_WL 41591 20.65 20.33 20.86 23 T_TM2_M_HEADER_IN_MSG 41544 19.93 18.54 20.83 24 T_KAM_HTML_FONT_INVALID 39526 23.03 27.99 19.82 25 USER_IN_DEF_DKIM_WL 35858 12.34 3.63 17.98 26 ALL_TRUSTED 34066 11.97 4.08 17.08 27 XM_Multi_Part_URI 28597 15.96 18.45 14.34 28 XM_Body_Dirty_Words 24764 15.84 21.13 12.42 29 XM_DKIMWhitelistDomains 24056 7.33 0.01 12.06 30 RCVD_IN_MSPIKE_H3 23930 13.92 16.88 12.00 31 BAYES_60 23227 10.37 8.40 11.65 32 UNPARSEABLE_RELAY 19617 11.03 12.87 9.84 33 T_TooManySym_01 18222 6.30 1.93 9.14 34 XM_Evil_Numbers_Gen 18101 8.61 7.88 9.08 35 HTML_IMAGE_RATIO_02 17850 8.00 6.53 8.95 36 XM_B_Unsub 17828 10.65 13.28 8.94 37 XM_DK_Undo_02 16467 23.73 47.60 8.26 38 LotsOfNums_01 15699 7.13 5.98 7.87 39 TooManyTo_001 15528 6.87 5.44 7.79 40 TR_XM_BayesUnsub 14747 9.60 13.01 7.39 41 BAYES_00 14002 4.44 0.45 7.02 42 RCVD_IN_MSPIKE_H4 13894 5.48 3.19 6.97 43 RCVD_IN_VALIDITY_SAFE 13558 6.16 5.17 6.80 44 BOTNET_IPINHOSTNAME 13003 8.36 11.19 6.52 45 BAYES_99 12957 17.67 34.92 6.50 46 T_TooManySym_02 12214 3.97 0.65 6.12 47 IN_ZIMBRA_NJ_WHITELIST 11948 3.65 0.04 5.99 48 RCVD_IN_VALIDITY_CERTIFIED 11878 5.40 4.55 5.96 49 XMStrtUSub 11803 4.98 3.54 5.92 50 XMNumbers 11715 5.15 4.03 5.87 51 XM_SendGrid 11666 6.08 6.45 5.85 52 TR_XM_DK_Bayes 11615 3.66 0.32 5.82 53 TR_XM_DK_Bayes1 11507 3.63 0.32 5.77 54 LOTS_OF_MONEY 11495 7.90 11.20 5.76 55 XM_H_Long_From01 11367 5.54 5.30 5.70 56 XM_B_SpammyWords3 11285 7.73 10.92 5.66 57 HTML_IMAGE_RATIO_04 10912 5.15 4.65 5.47 58 TR_XM_DKIM_Undo 10733 18.94 39.87 5.38 59 BAYES_999 10673 14.08 27.56 5.35 60 BAYES_80 10665 6.68 8.73 5.35 61 TR_XM_DK_Bayes2 10461 3.30 0.30 5.25 62 XM_UncommonTLD01 9628 6.86 10.00 4.83 63 MPART_ALT_DIFF 9558 7.53 11.75 4.79 64 FSL_BULK_SIG 9142 6.68 9.92 4.58 65 XMSexyCombo_05 8439 6.55 10.14 4.23 66 TR_XM_DK_SendGrid 8151 4.27 4.56 4.09 67 FROM_EXCESS_BASE64 7896 3.30 2.27 3.96 68 RELAYCOUNTRY_META 7719 11.87 24.21 3.87 69 TR_XM_SpammyWords4 7710 5.99 9.28 3.87 70 BAYES_40 7462 2.78 1.30 3.74 71 XMSubMetaSx_00 7436 4.46 5.59 3.73 72 HTML_IMAGE_RATIO_06 7268 3.45 3.14 3.64 73 MIME_QP_LONG_LINE 7191 2.87 1.74 3.61 74 INVALID_MSGID 7043 2.21 0.16 3.53 75 XM_B_Phish_Phrases 6883 3.35 3.19 3.45 76 MSGID_NOFQDN1 6727 2.07 0.06 3.37 77 BAYES_95 6561 4.14 5.46 3.29 78 T_REMOTE_IMAGE 6481 3.26 3.27 3.25 79 MIME_HTML_MOSTLY 6280 4.11 5.60 3.15 80 RCVD_IN_IADB_LISTED 6235 2.28 0.97 3.13 81 TR_XM_PhishingBody 6057 4.15 5.86 3.04 82 TO_MALFORMED 5914 1.80 0.01 2.97 83 RCVD_IN_IADB_SPF 5726 2.08 0.86 2.87 84 XM_PDF 5659 1.81 0.23 2.84 85 BAYES_20 5538 2.04 0.91 2.78 86 DKIM_INVALID 5468 2.33 1.68 2.74 87 TR_DCC_Bayes_99 5362 11.85 26.00 2.69 88 RCVD_IN_IADB_SENDERID 5296 1.92 0.78 2.66 89 RCVD_IN_IADB_DK 5228 1.90 0.79 2.62 90 MIME_HTML_ONLY_MULTI 5185 4.41 7.20 2.60 91 TVD_RCVD_IP 5053 1.63 0.23 2.53 92 T_TooManySym_03 4913 1.58 0.22 2.46 93 T_XMDrugObfuBody_14 4869 2.86 3.52 2.44 94 XM_CamelCaseFrm001 4749 2.31 2.21 2.38 95 TVD_SPACE_RATIO 4651 1.46 0.11 2.33 96 MAILING_LIST_MULTI 4404 1.81 1.20 2.21 97 XM_B_SpammyTLD 4237 2.63 3.40 2.12 98 IN_HORDE_ADDRESS_BOOK 4204 1.30 0.06 2.11 99 XMBdyGiftCard01 4134 2.09 2.12 2.07 100 TR_XM_SpammyRelay 4090 8.45 18.33 2.05 101 XMBSHREFv2 3921 1.27 0.19 1.97 102 HTML_MIME_NO_HTML_TAG 3902 3.95 7.03 1.96 103 XMBody_95 3834 1.20 0.10 1.92 104 TM2_M_URI_OPT_OUT 3817 2.08 2.34 1.91 105 TR_XM_UnparsRelay 3778 4.18 7.70 1.89 106 RCVD_IN_MSPIKE_H5 3767 1.25 0.27 1.89 107 HTML_IMAGE_RATIO_08 3441 2.17 2.86 1.73 108 TR_XM_SB_Phish 3433 1.55 1.29 1.72 109 XMSubPhish11 3408 1.40 0.93 1.71 110 RELAYCOUNTRY_CA 3376 6.14 13.00 1.69 111 RCVD_IN_IADB_VOUCHED 3370 1.21 0.47 1.69 112 T_XMHurry_00 3323 1.97 2.45 1.67 113 XM_H_Long_From02 3257 1.23 0.61 1.63 114 BAYES_05 3247 1.14 0.39 1.63 115 ANY_BOUNCE_MESSAGE 3234 1.20 0.55 1.62 116 BOUNCE_MESSAGE 3233 1.20 0.55 1.62 117 XMStockSpam_06 3215 1.58 1.54 1.61 118 URI_NOVOWEL 3210 2.65 4.26 1.61 119 TR_XM_SpammyWords5 3092 3.26 5.89 1.55 120 BOTNET 3064 3.68 6.98 1.54 121 SHORT_URI_3 2990 1.58 1.71 1.50 122 FVGT_m_MULTI_ODD_EMAIL 2919 0.92 0.09 1.46 123 XM_B_Unsub2 2854 1.46 1.51 1.43 124 TM2_M_VERY_LONG_WORD 2836 3.72 7.27 1.42 125 UNTRUSTED_Relay 2817 3.85 7.60 1.41 126 XM_DK_Undo_01 2814 1.64 2.00 1.41 127 XMGappySubj_01 2792 0.90 0.14 1.40 128 RCVD_IN_RP_SAFE 2668 1.21 1.02 1.34 129 T_XMDrugObfuBody_08 2635 2.43 4.14 1.32 130 XM_B_Phish66 2624 1.93 2.88 1.32 131 XM_GoogleGroups 2556 2.77 5.07 1.28 132 XM_SPF_SoftFail 2540 2.99 5.65 1.27 133 XM_B_Investor 2426 1.92 3.02 1.22 134 XM_H_Trusted_IP 2416 0.74 0.00 1.21 135 SUBJ_ALL_CAPS 2406 2.23 3.80 1.21 136 TR_XM_Base64_M1 2368 1.13 1.03 1.19 137 RCVD_IN_RP_CERTIFIED 2359 1.06 0.88 1.18 138 TooManyTo_002 2358 0.88 0.42 1.18 139 RCVD_IN_IADB_OPTIN 2286 0.81 0.29 1.15 140 TR_Symld_Words 2267 0.93 0.61 1.14 141 TR_XM_SpammyWords2 2236 6.14 13.88 1.12 142 XM_B_SpammyWords4 2062 1.46 2.11 1.03 143 XMDiploma_00 2015 1.88 3.23 1.01 144 HTML_TAG_BALANCE_BODY 1993 1.00 1.00 1.00 145 URI_HEX 1934 0.98 0.99 0.97 146 HTML_FONT_FACE_BAD 1897 0.81 0.59 0.95 147 XM_UB50 1880 2.05 3.76 0.94 148 XM_B_COPY_HTML 1873 0.91 0.85 0.94 149 XMBrknScrpt_02 1852 1.08 1.32 0.93 150 XM_OfRef6 1826 1.61 2.69 0.92 151 XM_Body_Dirty_Words_01 1806 1.03 1.21 0.91 152 RCVD_IN_BL_SPAMCOP_NET 1758 5.98 13.86 0.88 153 URI_TRY_3LD 1703 0.91 0.99 0.85 154 T_XMDrugObfuBody_00 1696 0.94 1.07 0.85 155 TooManyTo_003 1681 0.65 0.36 0.84 156 XM_ProductURIs 1666 1.33 2.08 0.84 157 TR_MetaPhish_Combo_01 1660 0.85 0.89 0.83 158 DKIM_ADSP_CUSTOM_MED 1645 0.67 0.43 0.82 159 XMPhish30 1556 1.01 1.35 0.78 160 XMSubNoVowel 1529 0.69 0.56 0.77 161 DIET_1 1426 0.87 1.10 0.72 162 XMSubMetaI_00 1426 0.69 0.65 0.72 163 USER_IN_WELCOMELIST 1423 0.43 0.00 0.71 164 USER_IN_WHITELIST 1423 0.43 0.00 0.71 165 RCVD_IN_PSBL 1354 0.77 0.91 0.68 166 T_FILL_THIS_FORM_SHORT 1351 2.74 5.93 0.68 167 MPART_ALT_DIFF_COUNT 1343 0.91 1.28 0.67 168 SUBJ_DOLLARS 1283 0.91 1.31 0.64 169 TooManyTo_004 1248 0.51 0.33 0.63 170 XM_H_PHPMailer 1238 0.68 0.76 0.62 171 XMBody_17 1237 2.60 5.65 0.62 172 HTML_IMAGE_ONLY_20 1210 0.50 0.33 0.61 173 XMSubMetaSxObfu_03 1202 0.67 0.78 0.60 174 XMSubMetaSxObfu_02 1133 0.50 0.39 0.57 175 XMHTMLBadTable_001 1128 0.66 0.80 0.57 176 XMPhish08 1086 0.62 0.75 0.54 177 TooManyTo_005 1082 0.46 0.32 0.54 178 PLING_QUERY 1071 0.71 0.96 0.54 179 XMHTML_After_End 1067 0.67 0.89 0.54 180 XMLngstWrd_00 1063 2.28 4.98 0.53 181 FORGED_GMAIL_RCVD 1060 0.45 0.34 0.53 182 XM_S_SubURI 1056 0.33 0.01 0.53 183 XM_B_REG_HTML 1021 0.67 0.91 0.51 184 NML_ADSP_CUSTOM_MED 1001 0.44 0.34 0.50 185 DATE_IN_PAST_03_06 994 0.44 0.36 0.50 186 XMSexyCombo_01 979 1.06 1.94 0.49 187 XMSlimDrugH 967 0.52 0.56 0.48 188 HTML_TEXT_INVISIBLE_STYLE 953 0.54 0.64 0.48 189 XMOemUri 941 0.34 0.13 0.47 190 LongTLD 937 1.07 2.00 0.47 191 RCVD_IN_MSPIKE_BL 936 1.71 3.61 0.47 192 TR_XM_MSPIKECOMBO 935 1.70 3.59 0.47 193 KHOP_HELO_FCRDNS 925 0.70 1.06 0.46 194 SpammyFromTLD_01 912 1.87 4.06 0.46 195 XMNoVowels 902 0.40 0.31 0.45 196 XMGenDplmaNmb 896 0.73 1.16 0.45 197 TR_XM_Base64_L1 891 0.47 0.51 0.45 198 HELO_NO_DOMAIN 884 0.46 0.48 0.44 199 HELO_NODOT 884 0.46 0.48 0.44 200 T_TooManySym_04 877 0.33 0.15 0.44 ----------------------------------------------------------------------