Email: 308333 Autolearn: 0 AvgScore: 4.41 AvgScanTime: 1.24 sec Spam: 112731 Autolearn: 0 AvgScore: 13.67 AvgScanTime: 1.29 sec Ham: 195602 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.21 sec Time Spent Running SA: 106.26 hours Time Spent Processing Spam: 40.32 hours Time Spent Processing Ham: 65.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108225 88.56 96.00 84.27 2 DKIM_SIGNED 100148 82.84 88.84 79.39 3 XM_DK_Pass 98995 81.02 87.82 77.11 4 XM_B_Unicode 98516 79.05 87.39 74.24 5 DKIM_VALID 98211 80.45 87.12 76.60 6 DCC_CHECK 85142 56.73 75.53 45.90 7 XM_B_SpammyWords 83923 58.56 74.45 49.41 8 XMListUnsubscribeExists 83860 63.62 74.39 57.42 9 RELAYCOUNTRY_US 82420 77.46 73.11 79.96 10 DKIM_VALID_AU 75668 66.70 67.12 66.46 11 XM_B_Unicode3 56979 49.20 50.54 48.42 12 XM_DK_Undo_02 56667 23.87 50.27 8.66 13 RCVD_IN_MSPIKE_H2 53954 43.03 47.86 40.24 14 XM_B_SpammyWords2 49694 30.47 44.08 22.63 15 TR_XM_DKIM_Undo 46767 18.94 41.49 5.95 16 LOC_TINY_FONT_1 44317 35.00 39.31 32.52 17 BAYES_99 42388 18.00 37.60 6.71 18 MIME_HTML_ONLY 39762 26.72 35.27 21.80 19 HTML_FONT_LOW_CONTRAST 39656 34.82 35.18 34.62 20 DKIM_VALID_EF 39648 31.53 35.17 29.44 21 BAYES_50 38928 49.51 34.53 58.15 22 FVGT_m_MULTI_ODD 34990 28.93 31.04 27.72 23 T_KAM_HTML_FONT_INVALID 33901 23.24 30.07 19.30 24 BAYES_999 33472 14.38 29.69 5.55 25 TR_DCC_Bayes_99 32445 12.73 28.78 3.48 26 DCC_CHECK_NEGATIVE 27574 43.24 24.46 54.07 27 XM_Body_Dirty_Words 26105 18.06 23.16 15.12 28 RELAYCOUNTRY_META 24658 10.20 21.87 3.48 29 XMSubLong 22233 22.36 19.72 23.89 30 T_TM2_M_HEADER_IN_MSG 21740 19.80 19.28 20.10 31 XM_Multi_Part_URI 21199 16.41 18.80 15.03 32 TR_XM_SpammyRelay 19948 7.47 17.70 1.58 33 RCVD_IN_MSPIKE_WL 18952 19.20 16.81 20.57 34 TR_XM_SpammyWords2 16936 6.67 15.02 1.85 35 XM_B_SpammyWords3 16238 8.44 14.40 5.00 36 RELAYCOUNTRY_CA 15784 5.95 14.00 1.30 37 RCVD_IN_BL_SPAMCOP_NET 15779 5.58 14.00 0.74 38 RCVD_IN_MSPIKE_H3 15166 12.25 13.45 11.56 39 XM_B_Unsub 14845 9.85 13.17 7.94 40 UNPARSEABLE_RELAY 14759 11.31 13.09 10.29 41 TR_XM_BayesUnsub 14596 8.95 12.95 6.65 42 BOTNET_IPINHOSTNAME 14493 8.73 12.86 6.35 43 TR_XM_SPAMCOP 13314 4.49 11.81 0.27 44 XMSexyCombo_05 11079 6.91 9.83 5.22 45 BAYES_80 10505 6.63 9.32 5.09 46 LOTS_OF_MONEY 10197 7.07 9.05 5.93 47 FSL_BULK_SIG 10020 5.88 8.89 4.14 48 TR_XM_UnparsRelay 9155 4.14 8.12 1.84 49 TR_XM_SpammyWords4 9015 5.67 8.00 4.33 50 XM_Evil_Numbers_Gen 8941 9.40 7.93 10.24 51 BAYES_60 8717 10.33 7.73 11.83 52 HTML_IMAGE_RATIO_02 8405 8.02 7.46 8.35 53 BOTNET 8144 3.62 7.22 1.54 54 UNTRUSTED_Relay 7875 3.55 6.99 1.57 55 MPART_ALT_DIFF 7582 5.01 6.73 4.02 56 XM_UncommonTLD01 7114 5.29 6.31 4.70 57 XM_SendGrid 7072 6.17 6.27 6.11 58 TooManyTo_001 7007 7.51 6.22 8.25 59 T_XMDrugObfuBody_08 6811 3.12 6.04 1.43 60 LotsOfNums_01 6542 7.07 5.80 7.79 61 XMSubMetaSx_00 6480 4.79 5.75 4.24 62 XMBody_17 6361 2.50 5.64 0.69 63 T_FILL_THIS_FORM_SHORT 6274 2.34 5.57 0.49 64 BAYES_95 6252 3.96 5.55 3.05 65 ALL_TRUSTED 6207 12.68 5.51 16.81 66 XM_H_Long_From01 5770 5.50 5.12 5.72 67 RCVD_IN_VALIDITY_SAFE 5467 7.17 4.85 8.51 68 TR_XM_PhishingBody 5384 3.85 4.78 3.31 69 HTML_IMAGE_RATIO_04 5188 5.72 4.60 6.36 70 XM_DIRTYINTL 5073 1.83 4.50 0.29 71 HTML_MIME_NO_HTML_TAG 4934 2.64 4.38 1.65 72 XMStrtUSub 4927 5.76 4.37 6.56 73 TR_XM_SpammyWords5 4873 2.65 4.32 1.69 74 XM_SPF_SoftFail 4830 2.70 4.28 1.79 75 MIME_HTML_MOSTLY 4738 3.41 4.20 2.95 76 T_XMDrugObfuBody_14 4727 2.90 4.19 2.16 77 TR_XM_DK_SendGrid 4666 4.22 4.14 4.26 78 RCVD_IN_VALIDITY_CERTIFIED 4643 6.38 4.12 7.68 79 USER_IN_DEF_DKIM_WL 4469 13.64 3.96 19.22 80 RCVD_IN_MSPIKE_BL 4414 1.79 3.92 0.56 81 FONT_INVIS_LONG_LINE 4388 1.50 3.89 0.12 82 TR_XM_MSPIKECOMBO 4362 1.77 3.87 0.56 83 HK_RANDOM_REPLYTO 4335 1.46 3.85 0.08 84 XM_B_SpammyTLD 4181 2.75 3.71 2.20 85 HTML_IMAGE_RATIO_08 4075 2.86 3.61 2.43 86 XM_B_Phish_Phrases 4061 4.58 3.60 5.14 87 TR_XM_FormFill 4060 1.35 3.60 0.05 88 XMNumbers 4040 4.69 3.58 5.33 89 BAYES_40 3981 3.79 3.53 3.94 90 HTML_IMAGE_RATIO_06 3905 4.43 3.46 4.98 91 XM_UB50 3767 1.88 3.34 1.03 92 XM_OfRef6 3734 1.70 3.31 0.77 93 XM_B_Investor 3693 1.98 3.28 1.23 94 XMDiploma_00 3584 1.79 3.18 0.99 95 MIME_HTML_ONLY_MULTI 3550 2.50 3.15 2.13 96 RCVD_IN_MSPIKE_H4 3522 5.88 3.12 7.47 97 TM2_M_VERY_LONG_WORD 3508 2.02 3.11 1.39 98 TR_XM_SpammyWords3 3417 1.33 3.03 0.34 99 T_XMHurry_00 3299 1.52 2.93 0.71 100 TM2_M_URI_OPT_OUT 3286 2.21 2.91 1.80 101 MIME_BASE64_TEXT 3281 1.12 2.91 0.09 102 RCVD_IN_MSPIKE_L3 3272 1.30 2.90 0.38 103 TO_NO_BRKTS_HTML_IMG 3120 1.02 2.77 0.02 104 T_HTML_ATTACH 3086 1.01 2.74 0.02 105 XM_H_NotFromAmazon 3059 1.00 2.71 0.01 106 MALF_HTML_B64 3052 0.99 2.71 0.01 107 T_TooManySym_01 3039 7.18 2.70 9.77 108 URIBL_DBL_SPAM 3009 0.98 2.67 0.01 109 TR_XM_BayesRelay 2983 0.97 2.65 0.01 110 FROM_EXCESS_BASE64 2961 3.38 2.63 3.82 111 XM_DK_Undo_01 2950 1.75 2.62 1.25 112 XM_B_SpammyWords4 2949 1.69 2.62 1.15 113 URI_NOVOWEL 2917 2.05 2.59 1.75 114 SpammyFromTLD_01 2749 1.21 2.44 0.51 115 XMSexyCombo_01 2622 1.20 2.33 0.55 116 T_REMOTE_IMAGE 2594 2.85 2.30 3.17 117 POSSIBLE_AMAZON_PHISH_02 2531 0.83 2.25 0.01 118 XM_B_Phish66 2482 1.47 2.20 1.05 119 XM_CamelCaseFrm001 2437 2.37 2.16 2.49 120 SUBJ_ALL_CAPS 2423 1.86 2.15 1.69 121 MIME_QP_LONG_LINE 2379 2.73 2.11 3.09 122 XMBdyGiftCard01 2342 1.94 2.08 1.87 123 PDS_OTHER_BAD_TLD 2093 0.83 1.86 0.23 124 XM_H_Undi_Recip 2071 0.79 1.84 0.18 125 HTML_TAG_BALANCE_BODY 2065 1.16 1.83 0.77 126 TR_XM_MSPIKECOMBO2 2010 0.67 1.78 0.03 127 TR_LOTS_OF_MONEY3 2004 0.80 1.78 0.23 128 DKIM_INVALID 1937 2.40 1.72 2.79 129 RCVD_IN_VALIDITY_RPBL 1914 0.67 1.70 0.07 130 SHORT_URI_3 1844 1.83 1.64 1.93 131 SpammyFromTLD_02 1800 0.75 1.60 0.26 132 DIET_1 1791 1.02 1.59 0.70 133 XM_B_Unsub2 1781 1.34 1.58 1.20 134 T_XMDrugObfuBody_00 1774 1.16 1.57 0.93 135 TR_XM_PHPDW 1718 0.80 1.52 0.38 136 TR_XM_MaxSPIKE 1709 0.56 1.52 0.02 137 TR_XM_PHPForged 1708 0.76 1.52 0.32 138 MAILING_LIST_MULTI 1689 1.88 1.50 2.09 139 TR_XM_NoHeaderRelay 1674 0.62 1.48 0.12 140 TR_XM_FormFill2 1666 0.74 1.48 0.32 141 XM_H_PHPOS 1658 0.74 1.47 0.31 142 XM_ProductURIs 1610 1.03 1.43 0.80 143 XMReplyNow 1556 0.66 1.38 0.24 144 XM_Body_Dirty_Words_01 1535 0.60 1.36 0.15 145 XMPhish30 1530 1.42 1.36 1.46 146 XMStockSpam_06 1519 2.13 1.35 2.57 147 URI_PHP_REDIR 1502 0.49 1.33 0.00 148 XMSubMetaSxObfu_03 1495 0.92 1.33 0.69 149 XMBrknScrpt_02 1488 1.32 1.32 1.32 150 XM_B_REG_HTML 1469 0.90 1.30 0.67 151 URI_HEX 1437 1.29 1.27 1.30 152 XM_URI_RBL 1418 0.55 1.26 0.13 153 MPART_ALT_DIFF_COUNT 1366 0.90 1.21 0.72 154 SHOPIFY_IMG_NOT_RCVD_SFY 1360 0.61 1.21 0.27 155 TR_XM_Base64_M1 1311 1.27 1.16 1.34 156 XM_GoogleGroups 1297 1.20 1.15 1.23 157 KHOP_HELO_FCRDNS 1289 0.79 1.14 0.59 158 XM_UB99 1184 0.39 1.05 0.01 159 XMLngstWrd_00 1183 0.83 1.05 0.70 160 TR_XM_InvalidRelay 1182 0.39 1.05 0.02 161 RELAYCOUNTRY_IN 1166 0.39 1.03 0.02 162 RCVD_IN_IADB_LISTED 1158 2.11 1.03 2.73 163 XMLngstWrd_01 1151 0.76 1.02 0.60 164 XMHTML_After_End 1148 0.83 1.02 0.72 165 XMGenDplmaNmb 1147 0.64 1.02 0.43 166 RCVD_IN_PSBL 1138 0.87 1.01 0.78 167 BOTNET_NORDNS 1117 0.37 0.99 0.01 168 TR_XM_Undi_Recip6 1110 0.36 0.98 0.00 169 TR_Mismatch_TLD_02 1092 0.40 0.97 0.07 170 RCVD_IN_RP_SAFE 1088 1.41 0.97 1.66 171 XMLngstWrd_02 1076 0.64 0.95 0.46 172 XM_UB60 1072 0.42 0.95 0.11 173 TR_Caps_n_Bayes_99 1069 0.59 0.95 0.39 174 TRANSFORM_LIFE 1063 0.89 0.94 0.85 175 HTML_TEXT_INVISIBLE_STYLE 1061 0.64 0.94 0.47 176 TR_XM_Undi_Recip5 1058 0.35 0.94 0.01 177 HTTPS_HTTP_MISMATCH 1036 0.57 0.92 0.37 178 RCVD_IN_IADB_SPF 1035 1.90 0.92 2.47 179 XMClaimOffer 1020 0.38 0.90 0.08 180 TR_XM_Undi_Recip11 1019 0.35 0.90 0.03 181 XMBody_78 1016 0.52 0.90 0.30 182 URIBL_BLACK 1014 0.35 0.90 0.04 183 RELAYCOUNTRY_AU 1004 0.48 0.89 0.24 184 URI_TRY_3LD 982 0.88 0.87 0.88 185 RCVD_IN_IADB_DK 981 1.73 0.87 2.23 186 RCVD_IN_IADB_SENDERID 974 1.76 0.86 2.27 187 XM_Combo_Sbj 957 0.40 0.85 0.14 188 T_TooManySym_02 954 4.24 0.85 6.19 189 BAYES_20 951 2.04 0.84 2.73 190 UNDISC_MONEY 935 0.31 0.83 0.01 191 XM_Lotto 930 0.52 0.82 0.34 192 TR_XM_SB_Phish 927 1.28 0.82 1.54 193 RCVD_IN_RP_CERTIFIED 914 1.26 0.81 1.51 194 XMHTMLBadTable_001 897 0.67 0.80 0.60 195 TR_Mismatch_TLD_01 866 0.48 0.77 0.31 196 XMSubPhish11 846 1.23 0.75 1.51 197 XMSubMetaI_00 837 0.54 0.74 0.42 198 TR_XM_Undi_RecipCombo2 829 0.27 0.74 0.00 199 XM_H_PHPMailer 826 0.65 0.73 0.59 200 XM_S_SpammyWords 818 0.54 0.73 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164843 88.56 96.00 84.27 2 RELAYCOUNTRY_US 156411 77.46 73.11 79.96 3 DKIM_SIGNED 155285 82.84 88.84 79.39 4 XM_DK_Pass 150830 81.02 87.82 77.11 5 DKIM_VALID 149829 80.45 87.12 76.60 6 XM_B_Unicode 145219 79.05 87.39 74.24 7 DKIM_VALID_AU 129989 66.70 67.12 66.46 8 BAYES_50 113742 49.51 34.53 58.15 9 XMListUnsubscribeExists 112305 63.62 74.39 57.42 10 DCC_CHECK_NEGATIVE 105762 43.24 24.46 54.07 11 XM_B_SpammyWords 96648 58.56 74.45 49.41 12 XM_B_Unicode3 94719 49.20 50.54 48.42 13 DCC_CHECK 89774 56.73 75.53 45.90 14 RCVD_IN_MSPIKE_H2 78720 43.03 47.86 40.24 15 HTML_FONT_LOW_CONTRAST 67711 34.82 35.18 34.62 16 LOC_TINY_FONT_1 63607 35.00 39.31 32.52 17 DKIM_VALID_EF 57582 31.53 35.17 29.44 18 FVGT_m_MULTI_ODD 54214 28.93 31.04 27.72 19 XMSubLong 46724 22.36 19.72 23.89 20 XM_B_SpammyWords2 44260 30.47 44.08 22.63 21 MIME_HTML_ONLY 42635 26.72 35.27 21.80 22 RCVD_IN_MSPIKE_WL 40241 19.20 16.81 20.57 23 T_TM2_M_HEADER_IN_MSG 39309 19.80 19.28 20.10 24 T_KAM_HTML_FONT_INVALID 37747 23.24 30.07 19.30 25 USER_IN_DEF_DKIM_WL 37598 13.64 3.96 19.22 26 ALL_TRUSTED 32890 12.68 5.51 16.81 27 XM_Body_Dirty_Words 29578 18.06 23.16 15.12 28 XM_Multi_Part_URI 29406 16.41 18.80 15.03 29 XM_DKIMWhitelistDomains 26008 8.44 0.01 13.30 30 BAYES_60 23134 10.33 7.73 11.83 31 RCVD_IN_MSPIKE_H3 22619 12.25 13.45 11.56 32 UNPARSEABLE_RELAY 20120 11.31 13.09 10.29 33 XM_Evil_Numbers_Gen 20029 9.40 7.93 10.24 34 T_TooManySym_01 19102 7.18 2.70 9.77 35 XM_DK_Undo_02 16945 23.87 50.27 8.66 36 RCVD_IN_VALIDITY_SAFE 16650 7.17 4.85 8.51 37 HTML_IMAGE_RATIO_02 16324 8.02 7.46 8.35 38 TooManyTo_001 16142 7.51 6.22 8.25 39 XM_B_Unsub 15529 9.85 13.17 7.94 40 LotsOfNums_01 15247 7.07 5.80 7.79 41 RCVD_IN_VALIDITY_CERTIFIED 15026 6.38 4.12 7.68 42 RCVD_IN_MSPIKE_H4 14609 5.88 3.12 7.47 43 BAYES_00 13556 4.56 0.44 6.93 44 BAYES_99 13125 18.00 37.60 6.71 45 TR_XM_BayesUnsub 13007 8.95 12.95 6.65 46 XMStrtUSub 12826 5.76 4.37 6.56 47 HTML_IMAGE_RATIO_04 12439 5.72 4.60 6.36 48 BOTNET_IPINHOSTNAME 12413 8.73 12.86 6.35 49 T_TooManySym_02 12110 4.24 0.85 6.19 50 XM_SendGrid 11956 6.17 6.27 6.11 51 TR_XM_DKIM_Undo 11637 18.94 41.49 5.95 52 LOTS_OF_MONEY 11601 7.07 9.05 5.93 53 IN_ZIMBRA_NJ_WHITELIST 11433 3.73 0.05 5.85 54 TR_XM_DK_Bayes 11235 3.76 0.31 5.74 55 XM_H_Long_From01 11189 5.50 5.12 5.72 56 TR_XM_DK_Bayes1 11158 3.73 0.30 5.70 57 BAYES_999 10859 14.38 29.69 5.55 58 XMNumbers 10418 4.69 3.58 5.33 59 TR_XM_DK_Bayes2 10296 3.44 0.27 5.26 60 XMSexyCombo_05 10219 6.91 9.83 5.22 61 XM_B_Phish_Phrases 10047 4.58 3.60 5.14 62 BAYES_80 9950 6.63 9.32 5.09 63 XM_B_SpammyWords3 9788 8.44 14.40 5.00 64 HTML_IMAGE_RATIO_06 9742 4.43 3.46 4.98 65 XM_UncommonTLD01 9197 5.29 6.31 4.70 66 TR_XM_SpammyWords4 8467 5.67 8.00 4.33 67 TR_XM_DK_SendGrid 8334 4.22 4.14 4.26 68 XMSubMetaSx_00 8284 4.79 5.75 4.24 69 FSL_BULK_SIG 8106 5.88 8.89 4.14 70 MPART_ALT_DIFF 7871 5.01 6.73 4.02 71 BAYES_40 7709 3.79 3.53 3.94 72 FROM_EXCESS_BASE64 7471 3.38 2.63 3.82 73 INVALID_MSGID 6944 2.30 0.13 3.55 74 TR_DCC_Bayes_99 6812 12.73 28.78 3.48 75 RELAYCOUNTRY_META 6805 10.20 21.87 3.48 76 MSGID_NOFQDN1 6628 2.17 0.05 3.39 77 TR_XM_PhishingBody 6472 3.85 4.78 3.31 78 T_REMOTE_IMAGE 6204 2.85 2.30 3.17 79 MIME_QP_LONG_LINE 6045 2.73 2.11 3.09 80 BAYES_95 5957 3.96 5.55 3.05 81 TO_MALFORMED 5912 1.92 0.01 3.02 82 MIME_HTML_MOSTLY 5767 3.41 4.20 2.95 83 DKIM_INVALID 5456 2.40 1.72 2.79 84 RCVD_IN_IADB_LISTED 5347 2.11 1.03 2.73 85 BAYES_20 5335 2.04 0.84 2.73 86 TVD_RCVD_IP 5267 1.79 0.22 2.69 87 T_TooManySym_03 5080 1.74 0.24 2.60 88 XMStockSpam_06 5036 2.13 1.35 2.57 89 XM_CamelCaseFrm001 4871 2.37 2.16 2.49 90 RCVD_IN_IADB_SPF 4828 1.90 0.92 2.47 91 HTML_IMAGE_RATIO_08 4757 2.86 3.61 2.43 92 TVD_SPACE_RATIO 4689 1.56 0.11 2.40 93 RCVD_IN_IADB_SENDERID 4448 1.76 0.86 2.27 94 RCVD_IN_IADB_DK 4356 1.73 0.87 2.23 95 IN_HORDE_ADDRESS_BOOK 4324 1.42 0.05 2.21 96 XM_PDF 4312 1.51 0.30 2.20 97 XM_B_SpammyTLD 4310 2.75 3.71 2.20 98 T_XMDrugObfuBody_14 4220 2.90 4.19 2.16 99 XMBSHREFv2 4203 1.49 0.34 2.15 100 MIME_HTML_ONLY_MULTI 4169 2.50 3.15 2.13 101 MAILING_LIST_MULTI 4097 1.88 1.50 2.09 102 SHORT_URI_3 3784 1.83 1.64 1.93 103 XMBdyGiftCard01 3655 1.94 2.08 1.87 104 TR_XM_SpammyWords2 3624 6.67 15.02 1.85 105 TR_XM_UnparsRelay 3599 4.14 8.12 1.84 106 TM2_M_URI_OPT_OUT 3530 2.21 2.91 1.80 107 XM_SPF_SoftFail 3495 2.70 4.28 1.79 108 URI_NOVOWEL 3418 2.05 2.59 1.75 109 XMBody_95 3365 1.12 0.07 1.72 110 TR_XM_SpammyWords5 3307 2.65 4.32 1.69 111 SUBJ_ALL_CAPS 3303 1.86 2.15 1.69 112 RCVD_IN_RP_SAFE 3255 1.41 0.97 1.66 113 HTML_MIME_NO_HTML_TAG 3218 2.64 4.38 1.65 114 RCVD_IN_IADB_VOUCHED 3164 1.21 0.50 1.62 115 TR_XM_SpammyRelay 3099 7.47 17.70 1.58 116 BAYES_05 3094 1.17 0.46 1.58 117 UNTRUSTED_Relay 3070 3.55 6.99 1.57 118 TR_XM_SB_Phish 3018 1.28 0.82 1.54 119 BOTNET 3016 3.62 7.22 1.54 120 RCVD_IN_MSPIKE_H5 3013 1.06 0.23 1.54 121 XMSubPhish11 2958 1.23 0.75 1.51 122 RCVD_IN_RP_CERTIFIED 2958 1.26 0.81 1.51 123 FVGT_m_MULTI_ODD_EMAIL 2941 1.01 0.15 1.50 124 XMPhish30 2852 1.42 1.36 1.46 125 T_XMDrugObfuBody_08 2798 3.12 6.04 1.43 126 TM2_M_VERY_LONG_WORD 2725 2.02 3.11 1.39 127 ANY_BOUNCE_MESSAGE 2717 1.08 0.55 1.39 128 BOUNCE_MESSAGE 2716 1.08 0.55 1.39 129 XMGappySubj_01 2691 0.89 0.05 1.38 130 TR_XM_Base64_M1 2615 1.27 1.16 1.34 131 XMBrknScrpt_02 2573 1.32 1.32 1.32 132 RELAYCOUNTRY_CA 2548 5.95 14.00 1.30 133 URI_HEX 2542 1.29 1.27 1.30 134 TooManyTo_002 2482 1.00 0.54 1.27 135 XM_DK_Undo_01 2442 1.75 2.62 1.25 136 XM_H_Long_From02 2435 1.03 0.65 1.24 137 XM_GoogleGroups 2406 1.20 1.15 1.23 138 XM_B_Investor 2404 1.98 3.28 1.23 139 XM_B_Unsub2 2348 1.34 1.58 1.20 140 XM_B_SpammyWords4 2258 1.69 2.62 1.15 141 HTML_FONT_FACE_BAD 2240 0.97 0.67 1.15 142 XM_H_Trusted_IP 2210 0.72 0.00 1.13 143 XM_B_Phish66 2055 1.47 2.20 1.05 144 XM_B_COPY_HTML 2046 0.93 0.72 1.05 145 XM_UB50 2018 1.88 3.34 1.03 146 RCVD_IN_IADB_OPTIN 2011 0.76 0.31 1.03 147 XM_RXBody 2000 0.82 0.47 1.02 148 XMDiploma_00 1939 1.79 3.18 0.99 149 DKIM_ADSP_CUSTOM_MED 1938 0.81 0.49 0.99 150 TR_Symld_Words 1920 0.87 0.67 0.98 151 TooManyTo_003 1862 0.77 0.47 0.95 152 T_XMDrugObfuBody_00 1816 1.16 1.57 0.93 153 URI_TRY_3LD 1724 0.88 0.87 0.88 154 TRANSFORM_LIFE 1671 0.89 0.94 0.85 155 XM_ProductURIs 1557 1.03 1.43 0.80 156 RCVD_IN_PSBL 1531 0.87 1.01 0.78 157 HTML_TAG_BALANCE_BODY 1504 1.16 1.83 0.77 158 XM_OfRef6 1497 1.70 3.31 0.77 159 RCVD_IN_BL_SPAMCOP_NET 1440 5.58 14.00 0.74 160 XMHTML_After_End 1401 0.83 1.02 0.72 161 MPART_ALT_DIFF_COUNT 1400 0.90 1.21 0.72 162 T_XMHurry_00 1398 1.52 2.93 0.71 163 TooManyTo_004 1391 0.61 0.43 0.71 164 XMLngstWrd_00 1371 0.83 1.05 0.70 165 DIET_1 1364 1.02 1.59 0.70 166 XMSubMetaSxObfu_03 1351 0.92 1.33 0.69 167 XMBody_17 1347 2.50 5.64 0.69 168 XM_B_REG_HTML 1313 0.90 1.30 0.67 169 XMOemUri 1295 0.51 0.23 0.66 170 USER_IN_WELCOMELIST 1286 0.42 0.00 0.66 171 USER_IN_WHITELIST 1286 0.42 0.00 0.66 172 TR_MetaPhish_Combo_01 1285 0.65 0.64 0.66 173 FORGED_GMAIL_RCVD 1275 0.55 0.36 0.65 174 XMSubNoVowel 1245 0.62 0.58 0.64 175 TooManyTo_005 1200 0.54 0.42 0.61 176 NML_ADSP_CUSTOM_MED 1200 0.54 0.40 0.61 177 XMHTMLBadTable_001 1182 0.67 0.80 0.60 178 XMLngstWrd_01 1182 0.76 1.02 0.60 179 XM_H_PHPMailer 1163 0.65 0.73 0.59 180 KHOP_HELO_FCRDNS 1161 0.79 1.14 0.59 181 DATE_IN_PAST_03_06 1117 0.42 0.16 0.57 182 XMSubMetaSxObfu_02 1101 0.46 0.29 0.56 183 RCVD_IN_MSPIKE_BL 1098 1.79 3.92 0.56 184 TR_XM_MSPIKECOMBO 1094 1.77 3.87 0.56 185 XMSexyCombo_01 1067 1.20 2.33 0.55 186 XM_S_SubURI 1045 0.34 0.01 0.53 187 TR_XM_Base64_L1 1037 0.57 0.64 0.53 188 SpammyFromTLD_01 989 1.21 2.44 0.51 189 HTML_IMAGE_ONLY_20 988 0.40 0.22 0.51 190 T_FILL_THIS_FORM_SHORT 953 2.34 5.57 0.49 191 T_TooManySym_04 950 0.37 0.16 0.49 192 PLING_QUERY 925 0.52 0.61 0.47 193 HTML_TEXT_INVISIBLE_STYLE 921 0.64 0.94 0.47 194 AC_BR_BONANZA 916 0.50 0.56 0.47 195 TR_XM_Base64_M2 908 0.44 0.39 0.46 196 XMLngstWrd_02 905 0.64 0.95 0.46 197 XMSlimDrugH 848 0.52 0.66 0.43 198 XM_S_SpammyWords 838 0.54 0.73 0.43 199 TR_XM_Spammywords 838 0.54 0.73 0.43 200 XM_B_DNDMA 837 0.49 0.60 0.43 ----------------------------------------------------------------------