Email: 375313 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 1.58 sec Spam: 130660 Autolearn: 0 AvgScore: 13.29 AvgScanTime: 1.65 sec Ham: 244653 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 1.55 sec Time Spent Running SA: 164.96 hours Time Spent Processing Spam: 59.96 hours Time Spent Processing Ham: 105.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124811 89.63 95.52 86.48 2 DKIM_SIGNED 121549 86.29 93.03 82.69 3 XM_DK_Pass 119439 84.45 91.41 80.72 4 DKIM_VALID 118229 83.91 90.49 80.40 5 XM_B_Unicode 108113 79.11 82.74 77.16 6 RELAYCOUNTRY_US 106118 82.61 81.22 83.36 7 DCC_CHECK 99628 58.17 76.25 48.52 8 XMListUnsubscribeExists 98971 68.26 75.75 64.27 9 DKIM_VALID_AU 92026 67.96 70.43 66.64 10 XM_B_SpammyWords 86110 54.53 65.90 48.46 11 RCVD_IN_MSPIKE_H2 70083 46.20 53.64 42.23 12 XM_B_Unicode3 64995 50.71 49.74 51.22 13 XM_DK_Undo_02 63261 22.99 48.42 9.42 14 LOC_TINY_FONT_1 55781 36.97 42.69 33.92 15 BAYES_50 51078 51.50 39.09 58.13 16 FVGT_m_MULTI_ODD 51054 33.30 39.07 30.22 17 HTML_FONT_LOW_CONTRAST 50905 36.14 38.96 34.63 18 XM_B_SpammyWords2 47079 27.96 36.03 23.64 19 TR_XM_DKIM_Undo 46957 15.96 35.94 5.29 20 BAYES_99 46189 17.19 35.35 7.49 21 DKIM_VALID_EF 42216 28.86 32.31 27.03 22 MIME_HTML_ONLY 39854 24.76 30.50 21.69 23 T_KAM_HTML_FONT_INVALID 38300 24.04 29.31 21.22 24 BAYES_999 36746 13.72 28.12 6.03 25 TR_DCC_Bayes_99 33928 11.17 25.97 3.27 26 DCC_CHECK_NEGATIVE 31008 41.80 23.73 51.45 27 XM_Multi_Part_URI 29141 17.66 22.30 15.18 28 XM_Body_Dirty_Words 28574 16.68 21.87 13.91 29 RELAYCOUNTRY_META 26339 9.80 20.16 4.26 30 XMSubLong 24835 20.85 19.01 21.83 31 T_TM2_M_HEADER_IN_MSG 22217 19.76 17.00 21.24 32 UNPARSEABLE_RELAY 21555 13.13 16.50 11.33 33 XM_B_Unsub 19555 10.52 14.97 8.14 34 TR_XM_BayesUnsub 19245 9.80 14.73 7.17 35 BOTNET_IPINHOSTNAME 19192 9.29 14.69 6.41 36 RCVD_IN_MSPIKE_WL 19105 18.26 14.62 20.20 37 TR_XM_SpammyRelay 16668 5.66 12.76 1.87 38 MPART_ALT_DIFF 15365 7.08 11.76 4.58 39 TR_XM_SpammyWords2 14908 4.88 11.41 1.39 40 XM_B_SpammyWords3 14718 8.22 11.26 6.60 41 RCVD_IN_MSPIKE_H3 14701 11.63 11.25 11.83 42 TR_XM_UnparsRelay 14015 5.60 10.73 2.86 43 RCVD_IN_BL_SPAMCOP_NET 13728 4.18 10.51 0.80 44 HTML_IMAGE_RATIO_02 13044 10.27 9.98 10.43 45 UNTRUSTED_Relay 12460 4.70 9.54 2.12 46 XM_Evil_Numbers_Gen 12438 11.22 9.52 12.13 47 LOTS_OF_MONEY 12348 7.08 9.45 5.81 48 BOTNET 11909 4.27 9.11 1.69 49 XMSexyCombo_05 11702 6.76 8.96 5.59 50 XM_SendGrid 11669 7.69 8.93 7.02 51 BAYES_80 11544 6.69 8.84 5.55 52 FSL_BULK_SIG 11024 5.36 8.44 3.72 53 XM_UncommonTLD01 10698 5.52 8.19 4.09 54 TR_XM_SPAMCOP 10363 3.05 7.93 0.44 55 TR_XM_SpammyWords4 10009 5.17 7.66 3.84 56 BAYES_60 9929 10.13 7.60 11.48 57 TM2_M_VERY_LONG_WORD 9731 3.51 7.45 1.41 58 RELAYCOUNTRY_CA 9705 3.42 7.43 1.28 59 MIME_HTML_ONLY_MULTI 9400 4.20 7.19 2.61 60 LotsOfNums_01 8453 8.63 6.47 9.78 61 MIME_HTML_MOSTLY 7920 3.91 6.06 2.76 62 TR_XM_DK_SendGrid 7599 5.14 5.82 4.78 63 TR_XM_PhishingBody 7396 3.86 5.66 2.90 64 XM_H_Long_From01 7350 5.94 5.63 6.10 65 BAYES_95 7119 4.12 5.45 3.41 66 T_XMDrugObfuBody_08 6828 2.47 5.23 1.00 67 XM_B_SpammyTLD 6769 3.62 5.18 2.79 68 HTML_IMAGE_RATIO_04 6714 6.83 5.14 7.73 69 XMSubMetaSx_00 6686 4.47 5.12 4.12 70 HTML_MIME_NO_HTML_TAG 6373 2.38 4.88 1.05 71 XMBody_17 6246 2.24 4.78 0.88 72 XM_GoogleGroups 5967 2.35 4.57 1.17 73 RCVD_IN_VALIDITY_SAFE 5959 7.17 4.56 8.56 74 XM_UB50 5867 2.42 4.49 1.31 75 TooManyTo_001 5706 5.41 4.37 5.97 76 XMLngstWrd_00 5509 1.84 4.22 0.56 77 XMLngstWrd_01 5465 1.78 4.18 0.49 78 XMLngstWrd_02 5380 1.69 4.12 0.39 79 TR_XM_SpammyWords5 5358 2.74 4.10 2.02 80 XM_B_Phish_Phrases 5303 4.48 4.06 4.70 81 RCVD_IN_VALIDITY_CERTIFIED 5249 6.53 4.02 7.88 82 HTML_TITLE_SUBJ_DIFF 5247 1.43 4.02 0.04 83 USER_IN_DEF_DKIM_WL 5239 14.35 4.01 19.87 84 XMLngstWrd_03 5201 1.59 3.98 0.31 85 XMLngstWrd_04 5164 1.54 3.95 0.25 86 T_FILL_THIS_FORM_SHORT 5146 1.62 3.94 0.39 87 UPPERCASE_75_100 5055 1.36 3.87 0.01 88 URI_NOVOWEL 4722 2.62 3.61 2.09 89 FROM_EXCESS_BASE64 4684 3.55 3.58 3.53 90 XM_DIRTYINTL 4664 1.44 3.57 0.30 91 T_XMDrugObfuBody_14 4657 2.00 3.56 1.17 92 XMNumbers 4290 4.22 3.28 4.72 93 HTML_IMAGE_RATIO_06 4212 4.57 3.22 5.29 94 XM_B_Phish66 4140 1.69 3.17 0.91 95 SpammyFromTLD_02 4012 1.40 3.07 0.51 96 XMStrtUSub 3962 3.66 3.03 3.99 97 XM_SPF_SoftFail 3958 1.73 3.03 1.04 98 RCVD_IN_MSPIKE_BL 3915 1.36 3.00 0.49 99 TM2_M_URI_OPT_OUT 3894 2.84 2.98 2.76 100 RCVD_IN_MSPIKE_H4 3880 5.59 2.97 7.00 101 TR_XM_MSPIKECOMBO 3850 1.34 2.95 0.48 102 XM_OfRef6 3850 1.41 2.95 0.59 103 SpammyFromTLD_01 3723 1.31 2.85 0.49 104 XM_B_Investor 3477 1.63 2.66 1.07 105 HTML_IMAGE_RATIO_08 3455 2.34 2.64 2.18 106 MIME_QP_LONG_LINE 3344 4.46 2.56 5.47 107 TR_XM_FormFill 3342 0.90 2.56 0.01 108 DKIM_INVALID 3320 2.37 2.54 2.28 109 SUBJ_ALL_CAPS 3229 2.32 2.47 2.24 110 XM_B_SpammyWords4 3045 1.39 2.33 0.89 111 FONT_INVIS_LONG_LINE 2927 0.88 2.24 0.15 112 XMDiploma_00 2871 1.22 2.20 0.69 113 T_XMDrugObfuBody_00 2845 1.79 2.18 1.59 114 XM_DK_Undo_01 2834 1.48 2.17 1.11 115 URIBL_DBL_SPAM 2782 0.75 2.13 0.01 116 XM_CamelCaseFrm001 2774 2.23 2.12 2.29 117 T_TooManySym_01 2704 5.80 2.07 7.79 118 TR_XM_Base64_M1 2676 1.58 2.05 1.33 119 XMSexyCombo_01 2671 1.36 2.04 1.00 120 RCVD_IN_MSPIKE_L3 2644 0.97 2.02 0.40 121 TR_XM_SpammyWords3 2601 0.83 1.99 0.21 122 MPART_ALT_DIFF_COUNT 2568 1.21 1.97 0.80 123 XM_B_Unsub2 2530 1.24 1.94 0.86 124 TR_XM_NoHeaderRelay 2462 0.76 1.88 0.16 125 RELAYCOUNTRY_IN 2433 0.69 1.86 0.06 126 HK_RANDOM_REPLYTO 2419 0.71 1.85 0.09 127 XM_ProductURIs 2318 1.25 1.77 0.97 128 T_XMHurry_00 2277 1.58 1.74 1.49 129 RELAYCOUNTRY_AU 2276 0.78 1.74 0.27 130 XM_H_Undi_Recip 2264 0.70 1.73 0.14 131 MAILING_LIST_MULTI 2256 2.37 1.73 2.71 132 XMStockSpam_06 2208 2.47 1.69 2.88 133 PDS_OTHER_BAD_TLD 2200 0.88 1.68 0.45 134 URI_HEX 2146 1.84 1.64 1.94 135 XMBdyGiftCard01 2026 2.00 1.55 2.24 136 XM_URI_RBL 2015 0.62 1.54 0.13 137 TR_XM_PHPDW 1992 0.85 1.52 0.49 138 RCVD_IN_IADB_LISTED 1980 3.65 1.52 4.79 139 TR_XM_PHPForged 1883 0.80 1.44 0.46 140 BAYES_40 1875 2.71 1.44 3.39 141 XM_UB99 1861 0.50 1.42 0.01 142 TR_XM_FormFill2 1824 0.78 1.40 0.45 143 XM_H_PHPOS 1811 0.77 1.39 0.44 144 XMSubMetaI_00 1801 1.48 1.38 1.53 145 RCVD_IN_VALIDITY_RPBL 1799 0.53 1.38 0.08 146 T_REMOTE_IMAGE 1779 2.20 1.36 2.65 147 TR_XM_Undi_Recip5 1772 0.48 1.36 0.00 148 RCVD_IN_IADB_SPF 1752 3.30 1.34 4.35 149 TR_XM_MSPIKECOMBO2 1750 0.50 1.34 0.05 150 THIS_AD 1741 0.74 1.33 0.43 151 XMPhish30 1693 1.17 1.30 1.10 152 RCVD_IN_IADB_DK 1668 3.00 1.28 3.93 153 XMSubMetaSxObfu_03 1657 1.18 1.27 1.14 154 RCVD_IN_IADB_SENDERID 1650 3.06 1.26 4.02 155 BOTNET_NORDNS 1649 0.45 1.26 0.01 156 RCVD_IN_PSBL 1640 0.86 1.26 0.65 157 URIBL_BLACK 1640 0.47 1.26 0.05 158 TR_XM_SB_Phish 1629 1.41 1.25 1.49 159 UNDISC_MONEY 1613 0.43 1.23 0.00 160 ALL_TRUSTED 1606 8.71 1.23 12.71 161 XMHTMLBadTable_001 1599 0.90 1.22 0.72 162 SHOPIFY_IMG_NOT_RCVD_SFY 1582 0.68 1.21 0.40 163 TR_LOTS_OF_MONEY3 1568 0.58 1.20 0.25 164 DIET_1 1524 0.80 1.17 0.60 165 URI_PHP_REDIR 1522 0.41 1.16 0.01 166 KHOP_HELO_FCRDNS 1506 0.76 1.15 0.54 167 XMSubPhish11 1432 1.34 1.10 1.48 168 XM_UB80 1407 0.40 1.08 0.04 169 MIME_CHARSET_FARAWAY 1383 0.60 1.06 0.36 170 HTML_TAG_BALANCE_BODY 1358 0.88 1.04 0.80 171 TR_XM_MaxSPIKE 1351 0.39 1.03 0.04 172 TR_XM_Base64_L1 1339 0.67 1.02 0.48 173 T_MONEY_PERCENT 1319 0.54 1.01 0.28 174 TR_LOTS_OF_MONEY2 1319 0.54 1.01 0.28 175 XM_UB999 1319 0.35 1.01 0.00 176 XMSlimDrugH 1310 0.56 1.00 0.32 177 TR_XM_BayesRelay 1300 0.35 0.99 0.00 178 XM_UB60 1279 0.43 0.98 0.14 179 XMGenDplmaNmb 1227 0.52 0.94 0.29 180 XM_B_COPY_HTML 1214 0.96 0.93 0.98 181 RCVD_IN_RP_SAFE 1211 1.41 0.93 1.67 182 TR_XM_InvalidRelay 1206 0.34 0.92 0.02 183 PLING_QUERY 1205 0.72 0.92 0.61 184 TR_XM_Undi_Recip11 1190 0.33 0.91 0.02 185 XM_H_PHPMailer 1188 0.70 0.91 0.58 186 TR_MetaPhish_Combo_01 1169 0.70 0.89 0.60 187 TR_XM_Undi_Recip2 1157 0.33 0.89 0.03 188 RELAYCOUNTRY_FR 1144 0.49 0.88 0.29 189 BAYES_20 1139 1.76 0.87 2.23 190 XMSubNoVowel 1134 0.84 0.87 0.82 191 XMBody_29 1121 0.43 0.86 0.20 192 TR_XM_Undi_RecipCombo2 1116 0.30 0.85 0.00 193 XMBrknScrpt_02 1099 1.04 0.84 1.15 194 RELAYCOUNTRY_AT 1098 0.41 0.84 0.19 195 XM_B_REG_HTML 1095 0.82 0.84 0.81 196 BAYES_00 1094 4.83 0.84 6.97 197 FROM_SUSPICIOUS_NTLD 1093 0.33 0.84 0.06 198 HTTPS_HTTP_MISMATCH 1087 0.49 0.83 0.31 199 XMHTML_After_End 1072 0.75 0.82 0.71 200 RELAYCOUNTRY_RU 1067 0.31 0.82 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211588 89.63 95.52 86.48 2 RELAYCOUNTRY_US 203934 82.61 81.22 83.36 3 DKIM_SIGNED 202303 86.29 93.03 82.69 4 XM_DK_Pass 197496 84.45 91.41 80.72 5 DKIM_VALID 196713 83.91 90.49 80.40 6 XM_B_Unicode 188786 79.11 82.74 77.16 7 DKIM_VALID_AU 163048 67.96 70.43 66.64 8 XMListUnsubscribeExists 157236 68.26 75.75 64.27 9 BAYES_50 142205 51.50 39.09 58.13 10 DCC_CHECK_NEGATIVE 125882 41.80 23.73 51.45 11 XM_B_Unicode3 125318 50.71 49.74 51.22 12 DCC_CHECK 118703 58.17 76.25 48.52 13 XM_B_SpammyWords 118550 54.53 65.90 48.46 14 RCVD_IN_MSPIKE_H2 103314 46.20 53.64 42.23 15 HTML_FONT_LOW_CONTRAST 84721 36.14 38.96 34.63 16 LOC_TINY_FONT_1 82987 36.97 42.69 33.92 17 FVGT_m_MULTI_ODD 73939 33.30 39.07 30.22 18 DKIM_VALID_EF 66118 28.86 32.31 27.03 19 XM_B_SpammyWords2 57843 27.96 36.03 23.64 20 XMSubLong 53416 20.85 19.01 21.83 21 MIME_HTML_ONLY 53057 24.76 30.50 21.69 22 T_TM2_M_HEADER_IN_MSG 51953 19.76 17.00 21.24 23 T_KAM_HTML_FONT_INVALID 51914 24.04 29.31 21.22 24 RCVD_IN_MSPIKE_WL 49414 18.26 14.62 20.20 25 USER_IN_DEF_DKIM_WL 48618 14.35 4.01 19.87 26 XM_Multi_Part_URI 37147 17.66 22.30 15.18 27 XM_Body_Dirty_Words 34023 16.68 21.87 13.91 28 ALL_TRUSTED 31090 8.71 1.23 12.71 29 XM_Evil_Numbers_Gen 29665 11.22 9.52 12.13 30 XM_DKIMWhitelistDomains 29557 7.88 0.02 12.08 31 RCVD_IN_MSPIKE_H3 28938 11.63 11.25 11.83 32 BAYES_60 28079 10.13 7.60 11.48 33 UNPARSEABLE_RELAY 27727 13.13 16.50 11.33 34 HTML_IMAGE_RATIO_02 25514 10.27 9.98 10.43 35 LotsOfNums_01 23937 8.63 6.47 9.78 36 XM_DK_Undo_02 23039 22.99 48.42 9.42 37 RCVD_IN_VALIDITY_SAFE 20947 7.17 4.56 8.56 38 XM_B_Unsub 19911 10.52 14.97 8.14 39 RCVD_IN_VALIDITY_CERTIFIED 19272 6.53 4.02 7.88 40 T_TooManySym_01 19052 5.80 2.07 7.79 41 HTML_IMAGE_RATIO_04 18922 6.83 5.14 7.73 42 BAYES_99 18330 17.19 35.35 7.49 43 TR_XM_BayesUnsub 17548 9.80 14.73 7.17 44 XM_SendGrid 17174 7.69 8.93 7.02 45 RCVD_IN_MSPIKE_H4 17118 5.59 2.97 7.00 46 BAYES_00 17052 4.83 0.84 6.97 47 XM_B_SpammyWords3 16135 8.22 11.26 6.60 48 BOTNET_IPINHOSTNAME 15688 9.29 14.69 6.41 49 XM_H_Long_From01 14933 5.94 5.63 6.10 50 BAYES_999 14764 13.72 28.12 6.03 51 TooManyTo_001 14607 5.41 4.37 5.97 52 TR_XM_DK_Bayes 14227 4.04 0.73 5.82 53 LOTS_OF_MONEY 14211 7.08 9.45 5.81 54 TR_XM_DK_Bayes1 14168 4.03 0.73 5.79 55 XMSexyCombo_05 13687 6.76 8.96 5.59 56 BAYES_80 13582 6.69 8.84 5.55 57 MIME_QP_LONG_LINE 13389 4.46 2.56 5.47 58 TR_XM_DK_Bayes2 13057 3.69 0.60 5.34 59 T_TooManySym_02 12955 3.67 0.63 5.30 60 HTML_IMAGE_RATIO_06 12953 4.57 3.22 5.29 61 IN_ZIMBRA_NJ_WHITELIST 12939 3.47 0.06 5.29 62 TR_XM_DKIM_Undo 12936 15.96 35.94 5.29 63 RCVD_IN_IADB_LISTED 11725 3.65 1.52 4.79 64 TR_XM_DK_SendGrid 11687 5.14 5.82 4.78 65 XMNumbers 11539 4.22 3.28 4.72 66 XM_B_Phish_Phrases 11502 4.48 4.06 4.70 67 MPART_ALT_DIFF 11208 7.08 11.76 4.58 68 RCVD_IN_IADB_SPF 10638 3.30 1.34 4.35 69 RELAYCOUNTRY_META 10423 9.80 20.16 4.26 70 XMSubMetaSx_00 10079 4.47 5.12 4.12 71 XM_UncommonTLD01 10015 5.52 8.19 4.09 72 RCVD_IN_IADB_SENDERID 9829 3.06 1.26 4.02 73 XMStrtUSub 9762 3.66 3.03 3.99 74 RCVD_IN_IADB_DK 9605 3.00 1.28 3.93 75 TR_XM_SpammyWords4 9384 5.17 7.66 3.84 76 FSL_BULK_SIG 9094 5.36 8.44 3.72 77 FROM_EXCESS_BASE64 8627 3.55 3.58 3.53 78 BAYES_95 8342 4.12 5.45 3.41 79 BAYES_40 8301 2.71 1.44 3.39 80 TR_DCC_Bayes_99 7989 11.17 25.97 3.27 81 TR_XM_PhishingBody 7106 3.86 5.66 2.90 82 XMStockSpam_06 7051 2.47 1.69 2.88 83 TR_XM_UnparsRelay 6991 5.60 10.73 2.86 84 XM_B_SpammyTLD 6823 3.62 5.18 2.79 85 TM2_M_URI_OPT_OUT 6758 2.84 2.98 2.76 86 MIME_HTML_MOSTLY 6743 3.91 6.06 2.76 87 MAILING_LIST_MULTI 6627 2.37 1.73 2.71 88 INVALID_MSGID 6505 1.78 0.14 2.66 89 T_REMOTE_IMAGE 6475 2.20 1.36 2.65 90 RCVD_IN_IADB_VOUCHED 6432 1.95 0.68 2.63 91 MIME_HTML_ONLY_MULTI 6378 4.20 7.19 2.61 92 MSGID_NOFQDN1 6034 1.62 0.02 2.47 93 TO_MALFORMED 6015 1.61 0.03 2.46 94 TVD_RCVD_IP 5872 1.69 0.37 2.40 95 XM_CamelCaseFrm001 5594 2.23 2.12 2.29 96 DKIM_INVALID 5590 2.37 2.54 2.28 97 SUBJ_ALL_CAPS 5481 2.32 2.47 2.24 98 XMBdyGiftCard01 5474 2.00 1.55 2.24 99 BAYES_20 5464 1.76 0.87 2.23 100 HTML_IMAGE_RATIO_08 5332 2.34 2.64 2.18 101 T_TooManySym_03 5231 1.48 0.24 2.14 102 UNTRUSTED_Relay 5192 4.70 9.54 2.12 103 URI_NOVOWEL 5106 2.62 3.61 2.09 104 XMBSHREFv2 4948 1.38 0.17 2.02 105 TR_XM_SpammyWords5 4931 2.74 4.10 2.02 106 XM_H_Trusted_IP 4786 1.28 0.00 1.96 107 URI_HEX 4745 1.84 1.64 1.94 108 TVD_SPACE_RATIO 4600 1.26 0.11 1.88 109 TR_XM_SpammyRelay 4570 5.66 12.76 1.87 110 IN_HORDE_ADDRESS_BOOK 4446 1.21 0.08 1.82 111 RCVD_IN_IADB_OPTIN 4238 1.26 0.37 1.73 112 BOTNET 4132 4.27 9.11 1.69 113 RCVD_IN_RP_SAFE 4084 1.41 0.93 1.67 114 HTML_FONT_FACE_BAD 3884 1.29 0.75 1.59 115 T_XMDrugObfuBody_00 3884 1.79 2.18 1.59 116 RCVD_IN_RP_CERTIFIED 3815 1.29 0.79 1.56 117 XMSubMetaI_00 3746 1.48 1.38 1.53 118 T_XMHurry_00 3656 1.58 1.74 1.49 119 TR_XM_SB_Phish 3652 1.41 1.25 1.49 120 XMSubPhish11 3612 1.34 1.10 1.48 121 ANY_BOUNCE_MESSAGE 3527 1.12 0.53 1.44 122 BOUNCE_MESSAGE 3526 1.12 0.53 1.44 123 TM2_M_VERY_LONG_WORD 3449 3.51 7.45 1.41 124 XMGappySubj_01 3437 0.95 0.09 1.40 125 TR_XM_SpammyWords2 3394 4.88 11.41 1.39 126 XM_H_Long_From02 3387 1.13 0.66 1.38 127 RCVD_IN_MSPIKE_H5 3358 1.03 0.40 1.37 128 BAYES_05 3297 1.06 0.53 1.35 129 TR_XM_Base64_M1 3243 1.58 2.05 1.33 130 XM_UB50 3207 2.42 4.49 1.31 131 XM_PDF 3201 0.94 0.25 1.31 132 RELAYCOUNTRY_CA 3133 3.42 7.43 1.28 133 XMBody_95 2933 0.84 0.16 1.20 134 FVGT_m_MULTI_ODD_EMAIL 2918 0.83 0.14 1.19 135 T_XMDrugObfuBody_14 2868 2.00 3.56 1.17 136 XM_GoogleGroups 2864 2.35 4.57 1.17 137 XMBrknScrpt_02 2802 1.04 0.84 1.15 138 XMSubMetaSxObfu_03 2783 1.18 1.27 1.14 139 XM_DK_Undo_01 2713 1.48 2.17 1.11 140 XMPhish30 2685 1.17 1.30 1.10 141 XMOemUri 2673 0.87 0.46 1.09 142 XM_B_Investor 2622 1.63 2.66 1.07 143 HTML_MIME_NO_HTML_TAG 2569 2.38 4.88 1.05 144 XM_SPF_SoftFail 2546 1.73 3.03 1.04 145 TooManyTo_002 2521 0.83 0.46 1.03 146 T_XMDrugObfuBody_08 2447 2.47 5.23 1.00 147 XMSexyCombo_01 2435 1.36 2.04 1.00 148 LOW_PRICE 2405 0.90 0.74 0.98 149 XM_B_COPY_HTML 2403 0.96 0.93 0.98 150 XM_ProductURIs 2374 1.25 1.77 0.97 151 XM_B_Phish66 2220 1.69 3.17 0.91 152 XM_B_SpammyWords4 2168 1.39 2.33 0.89 153 XMBody_17 2161 2.24 4.78 0.88 154 XM_B_Unsub2 2111 1.24 1.94 0.86 155 TR_Symld_Words 2007 0.78 0.71 0.82 156 XMSubNoVowel 2005 0.84 0.87 0.82 157 DKIM_ADSP_CUSTOM_MED 1988 0.79 0.74 0.81 158 XM_B_REG_HTML 1981 0.82 0.84 0.81 159 RCVD_IN_BL_SPAMCOP_NET 1969 4.18 10.51 0.80 160 MPART_ALT_DIFF_COUNT 1969 1.21 1.97 0.80 161 HTML_TAG_BALANCE_BODY 1949 0.88 1.04 0.80 162 NUMERIC_HTTP_ADDR 1827 0.58 0.26 0.75 163 XMHTMLBadTable_001 1770 0.90 1.22 0.72 164 TooManyTo_003 1769 0.62 0.43 0.72 165 XMSexyCombo_04 1761 0.63 0.46 0.72 166 XMHTML_After_End 1728 0.75 0.82 0.71 167 XMDiploma_00 1699 1.22 2.20 0.69 168 RCVD_IN_PSBL 1584 0.86 1.26 0.65 169 XM_E_Blogspot 1538 0.44 0.09 0.63 170 PLING_QUERY 1502 0.72 0.92 0.61 171 URI_TRY_3LD 1482 0.63 0.67 0.61 172 TR_MetaPhish_Combo_01 1464 0.70 0.89 0.60 173 DIET_1 1462 0.80 1.17 0.60 174 XM_OfRef6 1454 1.41 2.95 0.59 175 XM_H_PHPMailer 1423 0.70 0.91 0.58 176 USER_IN_WELCOMELIST 1420 0.38 0.00 0.58 177 USER_IN_WHITELIST 1420 0.38 0.00 0.58 178 FORGED_GMAIL_RCVD 1416 0.60 0.65 0.58 179 DATE_IN_PAST_03_06 1413 0.47 0.26 0.58 180 XMLngstWrd_00 1379 1.84 4.22 0.56 181 XMSubMetaSxObfu_02 1367 0.50 0.40 0.56 182 KHOP_HELO_FCRDNS 1331 0.76 1.15 0.54 183 TooManyTo_004 1303 0.48 0.39 0.53 184 RELAYCOUNTRY_DE 1297 0.58 0.66 0.53 185 NML_ADSP_CUSTOM_MED 1256 0.55 0.62 0.51 186 SpammyFromTLD_02 1254 1.40 3.07 0.51 187 XM_Ancestry_Forge 1241 0.33 0.00 0.51 188 RELAYCOUNTRY_GB 1213 0.49 0.48 0.50 189 SpammyFromTLD_01 1210 1.31 2.85 0.49 190 XMLngstWrd_01 1209 1.78 4.18 0.49 191 RCVD_IN_MSPIKE_BL 1194 1.36 3.00 0.49 192 TR_XM_PHPDW 1191 0.85 1.52 0.49 193 TR_XM_MSPIKECOMBO 1183 1.34 2.95 0.48 194 TR_XM_Base64_L1 1170 0.67 1.02 0.48 195 XMNoVowels 1167 0.43 0.34 0.48 196 XMSubMetaD_03 1150 0.41 0.30 0.47 197 HTML_IMAGE_ONLY_20 1147 0.48 0.49 0.47 198 HTML_TEXT_INVISIBLE_STYLE 1138 0.45 0.42 0.47 199 TR_XM_PHPForged 1133 0.80 1.44 0.46 200 PDS_OTHER_BAD_TLD 1106 0.88 1.68 0.45 ----------------------------------------------------------------------