Email: 379329 Autolearn: 0 AvgScore: 5.17 AvgScanTime: 1.27 sec Spam: 152095 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.27 sec Ham: 227234 Autolearn: 0 AvgScore: -0.62 AvgScanTime: 1.27 sec Time Spent Running SA: 133.61 hours Time Spent Processing Spam: 53.52 hours Time Spent Processing Ham: 80.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142233 89.11 93.52 86.15 2 DKIM_SIGNED 139692 86.30 91.85 82.58 3 XM_DK_Pass 137949 84.60 90.70 80.51 4 DKIM_VALID 137143 84.13 90.17 80.09 5 RELAYCOUNTRY_US 121375 81.72 79.80 83.00 6 XMListUnsubscribeExists 118859 68.50 78.15 62.05 7 DCC_CHECK 117327 60.05 77.14 48.60 8 XM_B_Unicode 113345 75.30 74.52 75.83 9 DKIM_VALID_AU 110618 70.12 72.73 68.38 10 XM_B_SpammyWords 93334 54.57 61.37 50.02 11 RCVD_IN_MSPIKE_H2 74863 45.51 49.22 43.02 12 XM_DK_Undo_02 73843 25.08 48.55 9.37 13 XM_B_Unicode3 63719 46.39 41.89 49.39 14 LOC_TINY_FONT_1 63040 36.54 41.45 33.26 15 FVGT_m_MULTI_ODD 60550 33.43 39.81 29.17 16 BAYES_50 57704 49.70 37.94 57.57 17 HTML_FONT_LOW_CONTRAST 56946 35.54 37.44 34.27 18 BAYES_99 55072 19.02 36.21 7.52 19 TR_XM_DKIM_Undo 53885 18.21 35.43 6.68 20 XM_B_SpammyWords2 51469 27.71 33.84 23.61 21 DKIM_VALID_EF 50388 30.39 33.13 28.56 22 MIME_HTML_ONLY 49169 25.63 32.33 21.15 23 BAYES_999 43721 15.24 28.75 6.19 24 TR_DCC_Bayes_99 42695 13.47 28.07 3.70 25 T_KAM_HTML_FONT_INVALID 39212 22.19 25.78 19.78 26 RELAYCOUNTRY_META 36268 11.88 23.85 3.87 27 DCC_CHECK_NEGATIVE 34743 39.93 22.84 51.37 28 XM_Body_Dirty_Words 30047 15.84 19.76 13.22 29 RCVD_IN_MSPIKE_WL 29347 20.65 19.30 21.55 30 XM_Multi_Part_URI 28666 17.84 18.85 17.16 31 XMSubLong 26149 20.87 17.19 23.34 32 XM_UncommonTLD01 24268 8.95 15.96 4.27 33 RCVD_IN_MSPIKE_H3 24032 13.71 15.80 12.32 34 T_TM2_M_HEADER_IN_MSG 23265 18.93 15.30 21.37 35 UNPARSEABLE_RELAY 22229 12.98 14.62 11.89 36 MPART_ALT_DIFF 20963 8.72 13.78 5.34 37 TR_XM_SpammyRelay 20318 6.71 13.36 2.27 38 BOTNET_IPINHOSTNAME 19395 8.84 12.75 6.22 39 XM_B_Unsub 18472 9.76 12.15 8.16 40 TR_XM_BayesUnsub 18136 9.07 11.92 7.17 41 TR_XM_SpammyWords2 17846 5.89 11.73 1.98 42 XM_B_SpammyTLD 17374 5.96 11.42 2.30 43 BOTNET 17141 5.40 11.27 1.48 44 SpammyFromTLD_02 16882 4.58 11.10 0.22 45 TM2_M_VERY_LONG_WORD 16555 5.27 10.88 1.52 46 RCVD_IN_BL_SPAMCOP_NET 15815 4.60 10.40 0.73 47 MIME_HTML_ONLY_MULTI 15699 5.62 10.32 2.48 48 XM_B_SpammyWords3 15320 7.85 10.07 6.36 49 RELAYCOUNTRY_CA 15315 4.99 10.07 1.59 50 TR_XM_UnparsRelay 15108 5.58 9.93 2.66 51 XMSexyCombo_05 14870 6.80 9.78 4.81 52 UNTRUSTED_Relay 14259 4.79 9.38 1.72 53 TR_XM_SPAMCOP 13849 3.84 9.11 0.31 54 BAYES_80 13335 6.71 8.77 5.33 55 XM_Evil_Numbers_Gen 13317 9.92 8.76 10.70 56 HTML_MIME_NO_HTML_TAG 13266 4.21 8.72 1.19 57 TooManyTo_001 13148 7.08 8.64 6.03 58 XM_GoogleGroups 13059 4.21 8.59 1.28 59 XMLngstWrd_00 12964 3.87 8.52 0.75 60 XMLngstWrd_01 12832 3.79 8.44 0.67 61 XMLngstWrd_02 12743 3.67 8.38 0.53 62 XMLngstWrd_03 12333 3.49 8.11 0.40 63 XMLngstWrd_04 12293 3.43 8.08 0.32 64 HTML_TITLE_SUBJ_DIFF 12284 3.27 8.08 0.05 65 LOTS_OF_MONEY 12273 7.14 8.07 6.53 66 UPPERCASE_75_100 12203 3.22 8.02 0.01 67 BAYES_60 12091 10.04 7.95 11.44 68 HTML_IMAGE_RATIO_02 11895 8.78 7.82 9.42 69 XM_SendGrid 11717 7.53 7.70 7.42 70 FSL_BULK_SIG 11262 5.00 7.40 3.38 71 TR_XM_SpammyWords4 11111 5.73 7.31 4.68 72 PDS_OTHER_BAD_TLD 8693 2.49 5.72 0.34 73 BAYES_95 8297 4.32 5.46 3.55 74 XMSubMetaSx_00 8297 4.56 5.46 3.95 75 XMBody_17 8271 2.70 5.44 0.87 76 LotsOfNums_01 8211 7.30 5.40 8.57 77 TR_XM_DK_SendGrid 7672 5.08 5.04 5.11 78 TR_XM_PhishingBody 7661 3.68 5.04 2.76 79 RCVD_IN_VALIDITY_SAFE 7578 7.14 4.98 8.59 80 FROM_SUSPICIOUS_NTLD 7163 1.92 4.71 0.05 81 LongTLD 7092 2.05 4.66 0.30 82 MIME_HTML_MOSTLY 6959 4.15 4.58 3.86 83 XM_H_Long_From01 6771 5.39 4.45 6.02 84 FROM_SUSPICIOUS_NTLD_FP 6674 1.79 4.39 0.04 85 XM_DIRTYINTL 6530 1.91 4.29 0.32 86 XM_UB50 6521 2.34 4.29 1.04 87 TR_XM_SpammyWords5 6297 2.76 4.14 1.84 88 XMStrtUSub 6233 5.47 4.10 6.38 89 XM_B_Phish_Phrases 6137 4.59 4.03 4.97 90 T_FILL_THIS_FORM_SHORT 6067 1.91 3.99 0.51 91 NORDNS_LOW_CONTRAST 6023 1.64 3.96 0.09 92 RCVD_IN_VALIDITY_CERTIFIED 6009 6.13 3.95 7.59 93 HTML_IMAGE_RATIO_04 5843 5.59 3.84 6.77 94 ANY_BOUNCE_MESSAGE 5368 2.32 3.53 1.50 95 BOUNCE_MESSAGE 5364 2.31 3.53 1.50 96 DKIM_ADSP_NXDOMAIN 5134 1.57 3.38 0.36 97 RELAYCOUNTRY_SG 5033 1.35 3.31 0.04 98 USER_IN_DEF_DKIM_WL 5008 13.02 3.29 19.54 99 URIBL_DBL_SPAM 4892 1.30 3.22 0.02 100 XMBounce_01 4832 1.29 3.18 0.03 101 HTML_IMAGE_RATIO_08 4814 2.78 3.17 2.51 102 T_XMDrugObfuBody_14 4799 2.13 3.16 1.44 103 HTML_IMAGE_RATIO_06 4790 4.00 3.15 4.57 104 XMBounce_02 4768 1.26 3.13 0.01 105 XMMailDelErr 4654 1.23 3.06 0.00 106 SpammyFromTLD_01 4582 1.43 3.01 0.37 107 T_XMDrugObfuBody_08 4564 1.84 3.00 1.06 108 RCVD_IN_MSPIKE_H4 4539 5.71 2.98 7.54 109 SUBJ_ALL_CAPS 4496 2.54 2.96 2.26 110 T_XMHurry_00 4423 1.95 2.91 1.30 111 FROM_EXCESS_BASE64 4135 3.36 2.72 3.79 112 DATE_IN_PAST_12_24 4107 1.11 2.70 0.04 113 XMNumbers 4088 3.89 2.69 4.70 114 XM_B_Investor 3896 1.75 2.56 1.21 115 URI_NOVOWEL 3702 2.11 2.43 1.90 116 FONT_INVIS_LONG_LINE 3698 1.03 2.43 0.10 117 XMBrknScrpt_02 3609 1.82 2.37 1.45 118 XM_SPF_SoftFail 3521 1.60 2.32 1.13 119 XM_B_Phish66 3489 1.45 2.29 0.88 120 TR_XM_FormFill 3444 0.91 2.26 0.01 121 HK_RANDOM_REPLYTO 3437 0.96 2.26 0.09 122 XMBdyGiftCard01 3416 2.09 2.25 1.98 123 XM_OfRef6 3381 1.32 2.22 0.72 124 XM_B_SpammyWords4 3180 1.45 2.09 1.02 125 XM_DK_Undo_01 3090 1.59 2.03 1.29 126 XM_CamelCaseFrm001 3087 2.08 2.03 2.12 127 RCVD_IN_MSPIKE_BL 3034 1.07 1.99 0.46 128 TM2_M_URI_OPT_OUT 3009 1.85 1.98 1.77 129 TR_XM_MSPIKECOMBO 2995 1.06 1.97 0.46 130 XM_UB60 2899 0.81 1.91 0.08 131 T_TooManySym_01 2840 5.71 1.87 8.29 132 XMSexyCombo_01 2592 1.18 1.70 0.83 133 MIME_QP_LONG_LINE 2588 2.90 1.70 3.71 134 XMSubMetaI_00 2565 1.61 1.69 1.56 135 DKIM_INVALID 2549 2.16 1.68 2.49 136 DATE_IN_PAST_06_12 2547 0.72 1.67 0.07 137 TR_LOTS_OF_MONEY3 2535 0.90 1.67 0.39 138 XMStockSpam_06 2262 2.05 1.49 2.43 139 TR_XM_BayesRelay 2261 0.60 1.49 0.00 140 RELAYCOUNTRY_IN 2247 0.62 1.48 0.05 141 XMPhish30 2245 1.11 1.48 0.87 142 T_REMOTE_IMAGE 2212 2.43 1.45 3.08 143 XM_B_Unsub2 2193 1.21 1.44 1.05 144 TR_XM_Base64_M1 2174 1.51 1.43 1.56 145 TR_XM_SpammyWords3 2171 0.75 1.43 0.29 146 MPART_ALT_DIFF_COUNT 2168 1.09 1.43 0.87 147 BOTNET_NORDNS 2101 0.56 1.38 0.02 148 XMSubMetaSxObfu_03 2046 1.04 1.35 0.84 149 HTML_FONT_TINY_NORDNS 2023 0.61 1.33 0.12 150 URI_HEX 2006 1.55 1.32 1.71 151 XMDiploma_00 1949 1.13 1.28 1.03 152 BAYES_40 1918 2.83 1.26 3.88 153 RCVD_IN_MSPIKE_L3 1875 0.70 1.23 0.34 154 SHOPIFY_IMG_NOT_RCVD_SFY 1872 0.77 1.23 0.46 155 HTML_TAG_BALANCE_BODY 1871 0.91 1.23 0.69 156 XMClaimOffer 1768 0.57 1.16 0.17 157 RELAYCOUNTRY_AU 1767 0.60 1.16 0.22 158 RCVD_IN_VALIDITY_RPBL 1763 0.52 1.16 0.10 159 TR_XM_PHPDW 1753 0.68 1.15 0.37 160 XM_UB80 1708 0.47 1.12 0.03 161 TR_XM_PHPForged 1676 0.63 1.10 0.31 162 TR_Caps_n_Bayes_99 1657 0.52 1.09 0.13 163 XM_H_Undi_Recip 1656 0.53 1.09 0.16 164 XM_URI_RBL 1637 0.53 1.08 0.17 165 T_XMDrugObfuBody_00 1635 0.84 1.07 0.68 166 TR_XM_FormFill2 1631 0.61 1.07 0.30 167 XM_H_PHPOS 1628 0.61 1.07 0.30 168 TR_XM_NoHeaderRelay 1612 0.48 1.06 0.10 169 XMHTMLBadTable_001 1606 0.88 1.06 0.75 170 THIS_AD 1603 0.74 1.05 0.53 171 BAYES_00 1577 4.30 1.04 6.48 172 MAILING_LIST_MULTI 1570 1.68 1.03 2.12 173 RCVD_IN_RP_SAFE 1499 1.43 0.99 1.73 174 RCVD_IN_IADB_LISTED 1498 2.49 0.98 3.50 175 XMReplyNow 1470 0.50 0.97 0.19 176 ALL_TRUSTED 1470 8.35 0.97 13.28 177 HTTPS_HTTP_MISMATCH 1458 0.63 0.96 0.41 178 URI_PHP_REDIR 1449 0.39 0.95 0.01 179 TR_XM_DK_Bayes1 1444 3.48 0.95 5.17 180 TR_XM_DK_Bayes 1444 3.50 0.95 5.21 181 TR_XM_SB_Phish 1438 1.24 0.95 1.44 182 DIET_1 1430 0.69 0.94 0.53 183 RELAYCOUNTRY_RU 1416 0.40 0.93 0.04 184 TR_XM_DK_Bayes2 1412 3.23 0.93 4.77 185 KHOP_HELO_FCRDNS 1410 0.71 0.93 0.56 186 XM_ProductURIs 1407 0.85 0.93 0.80 187 BAYES_20 1385 1.93 0.91 2.61 188 RCVD_IN_IADB_SPF 1368 2.27 0.90 3.19 189 URIBL_BLACK 1349 0.37 0.89 0.03 190 XMSubPhish11 1334 1.21 0.88 1.43 191 XM_B_REG_HTML 1321 0.80 0.87 0.75 192 RCVD_IN_IADB_SENDERID 1306 2.12 0.86 2.96 193 RCVD_IN_IADB_DK 1304 2.07 0.86 2.88 194 HTML_FONT_FACE_BAD 1284 1.32 0.84 1.65 195 XM_Body_Dirty_Words_01 1242 0.84 0.82 0.85 196 TR_XM_Base64_L1 1237 0.58 0.81 0.43 197 XM_H_Long_From02 1209 1.00 0.79 1.14 198 XM_UB99 1198 0.32 0.79 0.00 199 UNDISC_MONEY 1179 0.31 0.78 0.00 200 RELAYCOUNTRY_AT 1153 0.39 0.76 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 195772 89.11 93.52 86.15 2 RELAYCOUNTRY_US 188596 81.72 79.80 83.00 3 DKIM_SIGNED 187655 86.30 91.85 82.58 4 XM_DK_Pass 182951 84.60 90.70 80.51 5 DKIM_VALID 181998 84.13 90.17 80.09 6 XM_B_Unicode 172308 75.30 74.52 75.83 7 DKIM_VALID_AU 155382 70.12 72.73 68.38 8 XMListUnsubscribeExists 140988 68.50 78.15 62.05 9 BAYES_50 130817 49.70 37.94 57.57 10 DCC_CHECK_NEGATIVE 116725 39.93 22.84 51.37 11 XM_B_SpammyWords 113667 54.57 61.37 50.02 12 XM_B_Unicode3 112235 46.39 41.89 49.39 13 DCC_CHECK 110443 60.05 77.14 48.60 14 RCVD_IN_MSPIKE_H2 97765 45.51 49.22 43.02 15 HTML_FONT_LOW_CONTRAST 77878 35.54 37.44 34.27 16 LOC_TINY_FONT_1 75577 36.54 41.45 33.26 17 FVGT_m_MULTI_ODD 66273 33.43 39.81 29.17 18 DKIM_VALID_EF 64898 30.39 33.13 28.56 19 XM_B_SpammyWords2 53645 27.71 33.84 23.61 20 XMSubLong 53032 20.87 17.19 23.34 21 RCVD_IN_MSPIKE_WL 48980 20.65 19.30 21.55 22 T_TM2_M_HEADER_IN_MSG 48560 18.93 15.30 21.37 23 MIME_HTML_ONLY 48049 25.63 32.33 21.15 24 T_KAM_HTML_FONT_INVALID 44957 22.19 25.78 19.78 25 USER_IN_DEF_DKIM_WL 44394 13.02 3.29 19.54 26 XM_Multi_Part_URI 38997 17.84 18.85 17.16 27 ALL_TRUSTED 30187 8.35 0.97 13.28 28 XM_Body_Dirty_Words 30037 15.84 19.76 13.22 29 XM_DKIMWhitelistDomains 29852 7.88 0.04 13.14 30 RCVD_IN_MSPIKE_H3 27986 13.71 15.80 12.32 31 UNPARSEABLE_RELAY 27025 12.98 14.62 11.89 32 BAYES_60 25995 10.04 7.95 11.44 33 XM_Evil_Numbers_Gen 24325 9.92 8.76 10.70 34 HTML_IMAGE_RATIO_02 21414 8.78 7.82 9.42 35 XM_DK_Undo_02 21302 25.08 48.55 9.37 36 RCVD_IN_VALIDITY_SAFE 19509 7.14 4.98 8.59 37 LotsOfNums_01 19478 7.30 5.40 8.57 38 T_TooManySym_01 18834 5.71 1.87 8.29 39 XM_B_Unsub 18549 9.76 12.15 8.16 40 RCVD_IN_VALIDITY_CERTIFIED 17257 6.13 3.95 7.59 41 RCVD_IN_MSPIKE_H4 17124 5.71 2.98 7.54 42 BAYES_99 17081 19.02 36.21 7.52 43 XM_SendGrid 16851 7.53 7.70 7.42 44 TR_XM_BayesUnsub 16285 9.07 11.92 7.17 45 HTML_IMAGE_RATIO_04 15374 5.59 3.84 6.77 46 TR_XM_DKIM_Undo 15190 18.21 35.43 6.68 47 LOTS_OF_MONEY 14829 7.14 8.07 6.53 48 BAYES_00 14717 4.30 1.04 6.48 49 XMStrtUSub 14507 5.47 4.10 6.38 50 XM_B_SpammyWords3 14451 7.85 10.07 6.36 51 BOTNET_IPINHOSTNAME 14135 8.84 12.75 6.22 52 BAYES_999 14071 15.24 28.75 6.19 53 TooManyTo_001 13698 7.08 8.64 6.03 54 XM_H_Long_From01 13674 5.39 4.45 6.02 55 IN_ZIMBRA_NJ_WHITELIST 12695 3.38 0.07 5.59 56 T_TooManySym_02 12258 3.36 0.33 5.39 57 MPART_ALT_DIFF 12125 8.72 13.78 5.34 58 BAYES_80 12112 6.71 8.77 5.33 59 TR_XM_DK_Bayes 11830 3.50 0.95 5.21 60 TR_XM_DK_Bayes1 11747 3.48 0.95 5.17 61 TR_XM_DK_SendGrid 11601 5.08 5.04 5.11 62 XM_B_Phish_Phrases 11286 4.59 4.03 4.97 63 XMSexyCombo_05 10931 6.80 9.78 4.81 64 TR_XM_DK_Bayes2 10828 3.23 0.93 4.77 65 XMNumbers 10672 3.89 2.69 4.70 66 TR_XM_SpammyWords4 10643 5.73 7.31 4.68 67 HTML_IMAGE_RATIO_06 10387 4.00 3.15 4.57 68 XM_UncommonTLD01 9692 8.95 15.96 4.27 69 XMSubMetaSx_00 8985 4.56 5.46 3.95 70 BAYES_40 8822 2.83 1.26 3.88 71 RELAYCOUNTRY_META 8786 11.88 23.85 3.87 72 MIME_HTML_MOSTLY 8766 4.15 4.58 3.86 73 FROM_EXCESS_BASE64 8610 3.36 2.72 3.79 74 MIME_QP_LONG_LINE 8430 2.90 1.70 3.71 75 TR_DCC_Bayes_99 8414 13.47 28.07 3.70 76 BAYES_95 8072 4.32 5.46 3.55 77 RCVD_IN_IADB_LISTED 7954 2.49 0.98 3.50 78 FSL_BULK_SIG 7689 5.00 7.40 3.38 79 RCVD_IN_IADB_SPF 7255 2.27 0.90 3.19 80 T_REMOTE_IMAGE 7009 2.43 1.45 3.08 81 INVALID_MSGID 6890 1.90 0.22 3.03 82 RCVD_IN_IADB_SENDERID 6720 2.12 0.86 2.96 83 MSGID_NOFQDN1 6620 1.81 0.16 2.91 84 RCVD_IN_IADB_DK 6548 2.07 0.86 2.88 85 TR_XM_PhishingBody 6280 3.68 5.04 2.76 86 TR_XM_UnparsRelay 6042 5.58 9.93 2.66 87 TO_MALFORMED 6007 1.59 0.01 2.64 88 BAYES_20 5942 1.93 0.91 2.61 89 HTML_IMAGE_RATIO_08 5713 2.78 3.17 2.51 90 DKIM_INVALID 5657 2.16 1.68 2.49 91 MIME_HTML_ONLY_MULTI 5633 5.62 10.32 2.48 92 XMStockSpam_06 5513 2.05 1.49 2.43 93 TVD_RCVD_IP 5408 1.51 0.20 2.38 94 XM_B_SpammyTLD 5235 5.96 11.42 2.30 95 TR_XM_SpammyRelay 5153 6.71 13.36 2.27 96 SUBJ_ALL_CAPS 5133 2.54 2.96 2.26 97 T_TooManySym_03 5038 1.39 0.15 2.22 98 XM_CamelCaseFrm001 4815 2.08 2.03 2.12 99 MAILING_LIST_MULTI 4807 1.68 1.03 2.12 100 TVD_SPACE_RATIO 4640 1.25 0.07 2.04 101 XMBdyGiftCard01 4506 2.09 2.25 1.98 102 TR_XM_SpammyWords2 4496 5.89 11.73 1.98 103 IN_HORDE_ADDRESS_BOOK 4395 1.18 0.06 1.93 104 RCVD_IN_IADB_VOUCHED 4364 1.32 0.41 1.92 105 URI_NOVOWEL 4315 2.11 2.43 1.90 106 XMBSHREFv2 4280 1.24 0.28 1.88 107 TR_XM_SpammyWords5 4182 2.76 4.14 1.84 108 TM2_M_URI_OPT_OUT 4021 1.85 1.98 1.77 109 XM_RXBody 3993 1.17 0.30 1.76 110 RCVD_IN_RP_SAFE 3921 1.43 0.99 1.73 111 UNTRUSTED_Relay 3899 4.79 9.38 1.72 112 URI_HEX 3890 1.55 1.32 1.71 113 RCVD_IN_MSPIKE_H5 3870 1.22 0.51 1.70 114 XM_PDF 3838 1.10 0.23 1.69 115 HTML_FONT_FACE_BAD 3740 1.32 0.84 1.65 116 BAYES_05 3671 1.16 0.47 1.62 117 RELAYCOUNTRY_CA 3612 4.99 10.07 1.59 118 XMBody_95 3577 0.98 0.09 1.57 119 TR_XM_Base64_M1 3538 1.51 1.43 1.56 120 XMSubMetaI_00 3534 1.61 1.69 1.56 121 RCVD_IN_RP_CERTIFIED 3520 1.23 0.75 1.55 122 TM2_M_VERY_LONG_WORD 3447 5.27 10.88 1.52 123 ANY_BOUNCE_MESSAGE 3414 2.32 3.53 1.50 124 BOUNCE_MESSAGE 3412 2.31 3.53 1.50 125 XM_H_Trusted_IP 3367 0.89 0.00 1.48 126 BOTNET 3357 5.40 11.27 1.48 127 XMBrknScrpt_02 3294 1.82 2.37 1.45 128 T_XMDrugObfuBody_14 3282 2.13 3.16 1.44 129 TR_XM_SB_Phish 3274 1.24 0.95 1.44 130 XMSubPhish11 3252 1.21 0.88 1.43 131 T_XMHurry_00 2956 1.95 2.91 1.30 132 XM_DK_Undo_01 2933 1.59 2.03 1.29 133 FVGT_m_MULTI_ODD_EMAIL 2927 0.82 0.12 1.29 134 XM_GoogleGroups 2901 4.21 8.59 1.28 135 XMGappySubj_01 2836 0.80 0.12 1.25 136 RCVD_IN_IADB_OPTIN 2790 0.84 0.26 1.23 137 XM_B_Investor 2741 1.75 2.56 1.21 138 HTML_MIME_NO_HTML_TAG 2707 4.21 8.72 1.19 139 XM_H_Long_From02 2591 1.00 0.79 1.14 140 XM_SPF_SoftFail 2559 1.60 2.32 1.13 141 T_XMDrugObfuBody_08 2415 1.84 3.00 1.06 142 XM_B_COPY_HTML 2397 0.91 0.69 1.05 143 XM_B_Unsub2 2379 1.21 1.44 1.05 144 XM_UB50 2364 2.34 4.29 1.04 145 XMDiploma_00 2347 1.13 1.28 1.03 146 XM_B_SpammyWords4 2321 1.45 2.09 1.02 147 TooManyTo_002 2208 0.77 0.46 0.97 148 XMSolicitRefs_0 2136 0.69 0.31 0.94 149 XM_B_Phish66 2001 1.45 2.29 0.88 150 XMOemUri 1985 0.60 0.18 0.87 151 XMPhish30 1982 1.11 1.48 0.87 152 XMBody_17 1978 2.70 5.44 0.87 153 XMHTML_After_End 1978 0.80 0.69 0.87 154 MPART_ALT_DIFF_COUNT 1972 1.09 1.43 0.87 155 TR_Symld_Words 1939 0.71 0.50 0.85 156 XM_Body_Dirty_Words_01 1935 0.84 0.82 0.85 157 XMSubMetaSxObfu_03 1917 1.04 1.35 0.84 158 XMSexyCombo_01 1879 1.18 1.70 0.83 159 DKIM_ADSP_CUSTOM_MED 1871 0.68 0.47 0.82 160 XM_ProductURIs 1815 0.85 0.93 0.80 161 XM_B_REG_HTML 1715 0.80 0.87 0.75 162 XMHTMLBadTable_001 1714 0.88 1.06 0.75 163 XMLngstWrd_00 1709 3.87 8.52 0.75 164 RCVD_IN_BL_SPAMCOP_NET 1648 4.60 10.40 0.73 165 RCVD_IN_PSBL 1642 0.70 0.67 0.72 166 XM_OfRef6 1629 1.32 2.22 0.72 167 URI_TRY_3LD 1626 0.72 0.73 0.72 168 TooManyTo_003 1601 0.59 0.42 0.70 169 HTML_TAG_BALANCE_BODY 1566 0.91 1.23 0.69 170 T_XMDrugObfuBody_00 1555 0.84 1.07 0.68 171 XMLngstWrd_01 1529 3.79 8.44 0.67 172 PLING_QUERY 1470 0.62 0.58 0.65 173 XM_H_PHPMailer 1345 0.63 0.69 0.59 174 XMSubMetaSxObfu_02 1317 0.51 0.41 0.58 175 DATE_IN_PAST_03_06 1286 0.48 0.34 0.57 176 KHOP_HELO_FCRDNS 1278 0.71 0.93 0.56 177 USER_IN_WELCOMELIST 1277 0.34 0.00 0.56 178 USER_IN_WHITELIST 1277 0.34 0.00 0.56 179 TooManyTo_004 1261 0.49 0.39 0.55 180 LOW_PRICE 1249 0.54 0.51 0.55 181 TR_MetaPhish_Combo_01 1208 0.56 0.60 0.53 182 THIS_AD 1197 0.74 1.05 0.53 183 DIET_1 1196 0.69 0.94 0.53 184 XMLngstWrd_02 1196 3.67 8.38 0.53 185 FORGED_GMAIL_RCVD 1189 0.46 0.37 0.52 186 T_FILL_THIS_FORM_SHORT 1167 1.91 3.99 0.51 187 NUMERIC_HTTP_ADDR 1143 0.36 0.15 0.50 188 XMPhish08 1129 0.55 0.62 0.50 189 XMNoVowels 1115 0.55 0.64 0.49 190 NML_ADSP_CUSTOM_MED 1100 0.44 0.37 0.48 191 XMPhish14 1062 0.49 0.52 0.47 192 TooManyTo_005 1055 0.42 0.35 0.46 193 XM_S_SubURI 1044 0.28 0.01 0.46 194 RCVD_IN_MSPIKE_BL 1043 1.07 1.99 0.46 195 SHOPIFY_IMG_NOT_RCVD_SFY 1038 0.77 1.23 0.46 196 TR_XM_MSPIKECOMBO 1038 1.06 1.97 0.46 197 XMSubNoVowel 1017 0.43 0.40 0.45 198 XM_Ancestry_Forge 990 0.26 0.00 0.44 199 HTML_IMAGE_ONLY_20 988 0.39 0.33 0.43 200 TR_XM_Base64_L1 978 0.58 0.81 0.43 ----------------------------------------------------------------------