Email: 327558 Autolearn: 0 AvgScore: 4.61 AvgScanTime: 1.38 sec Spam: 121073 Autolearn: 0 AvgScore: 13.75 AvgScanTime: 1.38 sec Ham: 206485 Autolearn: 0 AvgScore: -0.75 AvgScanTime: 1.38 sec Time Spent Running SA: 125.76 hours Time Spent Processing Spam: 46.53 hours Time Spent Processing Ham: 79.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114504 88.11 94.57 84.33 2 DKIM_SIGNED 111021 84.55 91.70 80.37 3 XM_DK_Pass 108979 82.54 90.01 78.16 4 DKIM_VALID 108216 82.03 89.38 77.72 5 RELAYCOUNTRY_US 97495 80.97 80.53 81.23 6 XM_B_Unicode 96153 74.92 79.42 72.28 7 XMListUnsubscribeExists 89971 63.46 74.31 57.09 8 DCC_CHECK 85745 52.25 70.82 41.35 9 DKIM_VALID_AU 84835 67.90 70.07 66.62 10 XM_B_SpammyWords 78570 54.18 64.89 47.90 11 XM_DK_Undo_02 57635 22.86 47.60 8.36 12 RCVD_IN_MSPIKE_H2 57625 42.93 47.60 40.20 13 XM_B_Unicode3 51862 45.55 42.84 47.14 14 LOC_TINY_FONT_1 46706 34.36 38.58 31.89 15 BAYES_50 44642 50.66 36.87 58.75 16 MIME_HTML_ONLY 44301 28.53 36.59 23.80 17 TR_XM_DKIM_Undo 44017 17.16 36.36 5.91 18 BAYES_99 43933 17.42 36.29 6.35 19 HTML_FONT_LOW_CONTRAST 43332 33.70 35.79 32.48 20 DKIM_VALID_EF 42902 30.74 35.43 27.98 21 FVGT_m_MULTI_ODD 42175 30.63 34.83 28.16 22 XM_B_SpammyWords2 42007 25.50 34.70 20.11 23 DCC_CHECK_NEGATIVE 35309 47.73 29.16 58.62 24 BAYES_999 34443 13.76 28.45 5.14 25 T_KAM_HTML_FONT_INVALID 34091 22.76 28.16 19.59 26 TR_DCC_Bayes_99 31358 11.01 25.90 2.29 27 RELAYCOUNTRY_META 28019 11.37 23.14 4.47 28 XM_Body_Dirty_Words 25925 16.46 21.41 13.55 29 XMSubLong 24221 22.78 20.01 24.41 30 RCVD_IN_MSPIKE_WL 23629 20.84 19.52 21.62 31 T_TM2_M_HEADER_IN_MSG 22385 20.39 18.49 21.51 32 XM_Multi_Part_URI 20628 16.82 17.04 16.70 33 RCVD_IN_MSPIKE_H3 19875 14.22 16.42 12.93 34 TR_XM_SpammyRelay 18553 7.06 15.32 2.21 35 UNPARSEABLE_RELAY 18078 12.19 14.93 10.59 36 XM_B_Unsub 17525 10.83 14.47 8.70 37 TR_XM_BayesUnsub 17136 9.62 14.15 6.96 38 RELAYCOUNTRY_CA 15687 5.84 12.96 1.67 39 XM_UncommonTLD01 15511 7.52 12.81 4.42 40 BOTNET_IPINHOSTNAME 14404 7.75 11.90 5.32 41 XMSexyCombo_05 13873 7.37 11.46 4.97 42 RCVD_IN_BL_SPAMCOP_NET 13804 4.84 11.40 1.00 43 MPART_ALT_DIFF 13478 7.86 11.13 5.94 44 TR_XM_SpammyWords2 13081 4.87 10.80 1.39 45 XM_B_SpammyWords3 12306 6.86 10.16 4.93 46 TR_XM_SPAMCOP 11820 3.88 9.76 0.43 47 TR_XM_UnparsRelay 11658 4.88 9.63 2.10 48 FSL_BULK_SIG 11240 5.51 9.28 3.29 49 BAYES_80 11007 6.42 9.09 4.85 50 MIME_HTML_ONLY_MULTI 10402 5.56 8.59 3.79 51 LOTS_OF_MONEY 10264 6.64 8.48 5.57 52 BAYES_60 10201 10.14 8.43 11.15 53 XM_Evil_Numbers_Gen 10070 9.94 8.32 10.90 54 XM_B_SpammyTLD 9473 4.21 7.82 2.09 55 SpammyFromTLD_02 9457 3.04 7.81 0.24 56 TM2_M_VERY_LONG_WORD 9318 4.38 7.70 2.43 57 BOTNET 9263 3.89 7.65 1.69 58 TooManyTo_001 9100 6.85 7.52 6.47 59 XM_SendGrid 8931 6.83 7.38 6.51 60 TR_XM_SpammyWords4 8587 4.91 7.09 3.63 61 HTML_IMAGE_RATIO_02 8441 7.31 6.97 7.51 62 HTML_MIME_NO_HTML_TAG 7949 4.01 6.57 2.52 63 XM_GoogleGroups 7567 3.85 6.25 2.44 64 XMLngstWrd_00 7443 3.55 6.15 2.03 65 XMLngstWrd_01 7403 3.50 6.11 1.96 66 XMLngstWrd_02 7322 3.37 6.05 1.81 67 BAYES_95 7104 4.15 5.87 3.14 68 XMLngstWrd_03 6881 3.17 5.68 1.70 69 HTML_TITLE_SUBJ_DIFF 6838 2.87 5.65 1.25 70 XM_H_Long_From01 6824 5.35 5.64 5.18 71 XMLngstWrd_04 6765 3.07 5.59 1.59 72 UPPERCASE_75_100 6735 2.85 5.56 1.25 73 XMSubMetaSx_00 6597 3.96 5.45 3.08 74 PDS_OTHER_BAD_TLD 6405 2.20 5.29 0.39 75 UNTRUSTED_Relay 6303 2.91 5.21 1.56 76 TR_XM_PhishingBody 6213 3.86 5.13 3.11 77 FROM_SUSPICIOUS_NTLD 5646 1.77 4.66 0.08 78 LotsOfNums_01 5579 7.04 4.61 8.46 79 XM_DIRTYINTL 5565 1.88 4.60 0.29 80 XMNumbers 5505 5.27 4.55 5.69 81 LongTLD 5430 1.76 4.48 0.16 82 TR_XM_DK_SendGrid 5407 4.57 4.47 4.63 83 FROM_SUSPICIOUS_NTLD_FP 5257 1.65 4.34 0.08 84 HTML_IMAGE_RATIO_04 5227 5.71 4.32 6.53 85 XMBody_17 5121 1.93 4.23 0.57 86 TR_XM_SpammyWords5 5006 2.56 4.13 1.64 87 HTML_IMAGE_RATIO_06 4873 4.79 4.02 5.23 88 XMStrtUSub 4853 5.20 4.01 5.91 89 RCVD_IN_VALIDITY_SAFE 4735 6.67 3.91 8.29 90 XM_B_Phish_Phrases 4602 3.88 3.80 3.93 91 T_FILL_THIS_FORM_SHORT 4507 1.73 3.72 0.56 92 URIBL_DBL_SPAM 4428 1.36 3.66 0.02 93 T_XMDrugObfuBody_08 4402 2.16 3.64 1.30 94 HTML_IMAGE_RATIO_08 4093 2.65 3.38 2.23 95 XM_SPF_SoftFail 4042 1.83 3.34 0.94 96 T_XMDrugObfuBody_14 3967 2.21 3.28 1.59 97 MIME_HTML_MOSTLY 3959 3.05 3.27 2.92 98 XM_DK_Undo_01 3696 2.04 3.05 1.44 99 XM_OfRef6 3620 1.66 2.99 0.89 100 USER_IN_DEF_DKIM_WL 3570 13.08 2.95 19.03 101 DATE_IN_PAST_96_XX 3518 1.08 2.91 0.00 102 XM_B_Investor 3508 1.81 2.90 1.17 103 XM_B_Phish66 3501 1.90 2.89 1.32 104 RCVD_IN_VALIDITY_CERTIFIED 3462 5.37 2.86 6.84 105 FROM_EXCESS_BASE64 3397 3.49 2.81 3.90 106 SpammyFromTLD_01 3291 1.29 2.72 0.45 107 RCVD_IN_MSPIKE_H4 3184 5.23 2.63 6.75 108 T_TooManySym_01 3171 6.89 2.62 9.39 109 XMBdyGiftCard01 3125 2.04 2.58 1.72 110 TR_XM_FormFill 2907 0.89 2.40 0.01 111 TM2_M_URI_OPT_OUT 2829 2.25 2.34 2.20 112 FONT_INVIS_LONG_LINE 2810 0.89 2.32 0.05 113 DKIM_INVALID 2805 2.53 2.32 2.65 114 HK_RANDOM_REPLYTO 2767 0.94 2.29 0.16 115 T_REMOTE_IMAGE 2736 3.54 2.26 4.29 116 XM_B_SpammyWords4 2678 1.38 2.21 0.90 117 XM_CamelCaseFrm001 2499 2.40 2.06 2.59 118 XM_UB50 2472 1.33 2.04 0.92 119 XM_B_Unsub2 2422 1.57 2.00 1.32 120 XM_H_Undi_Recip 2421 0.84 2.00 0.16 121 ALL_TRUSTED 2318 10.36 1.91 15.31 122 XMDiploma_00 2227 1.37 1.84 1.10 123 TR_XM_BayesRelay 2153 0.66 1.78 0.00 124 HTML_TAG_BALANCE_BODY 2068 1.30 1.71 1.06 125 KHOP_HELO_FCRDNS 2051 0.94 1.69 0.50 126 T_XMHurry_00 1998 1.06 1.65 0.71 127 MPART_ALT_DIFF_COUNT 1995 1.05 1.65 0.71 128 RCVD_IN_VALIDITY_RPBL 1937 0.61 1.60 0.03 129 XM_UB99 1917 0.59 1.58 0.01 130 TR_Mismatch_TLD_02 1899 0.63 1.57 0.09 131 TR_XM_NoHeaderRelay 1885 0.63 1.56 0.09 132 TR_XM_PHPDW 1883 0.88 1.56 0.49 133 XM_URI_RBL 1873 0.69 1.55 0.18 134 XMSexyCombo_01 1854 0.77 1.53 0.32 135 TR_XM_PHPForged 1850 0.83 1.53 0.42 136 XMBrknScrpt_02 1841 0.93 1.52 0.58 137 BOTNET_NORDNS 1821 0.56 1.50 0.01 138 SUBJ_ALL_CAPS 1821 1.45 1.50 1.43 139 TR_XM_FormFill2 1807 0.82 1.49 0.42 140 XM_H_PHPOS 1804 0.81 1.49 0.41 141 XMStockSpam_06 1795 2.13 1.48 2.51 142 XMReplyNow 1793 0.71 1.48 0.26 143 MIME_QP_LONG_LINE 1758 2.83 1.45 3.64 144 XMClaimOffer 1689 0.59 1.40 0.12 145 RCVD_IN_MSPIKE_BL 1672 0.70 1.38 0.31 146 XMSlimDrugH 1607 0.87 1.33 0.61 147 XMPhish30 1604 1.09 1.32 0.96 148 TR_Symld_Words 1575 1.44 1.30 1.52 149 XM_UB999 1557 0.48 1.29 0.01 150 TR_XM_Undi_Recip11 1539 0.48 1.27 0.02 151 T_TooManySym_02 1535 4.43 1.27 6.28 152 TR_XM_MSPIKECOMBO 1533 0.64 1.27 0.28 153 URI_NOVOWEL 1514 1.44 1.25 1.54 154 XMSubMetaI_00 1452 0.79 1.20 0.55 155 SUBJ_DOLLARS 1452 0.64 1.20 0.32 156 RELAYCOUNTRY_NL 1451 0.52 1.20 0.12 157 XMHTML_After_End 1430 0.93 1.18 0.78 158 TR_XM_Base64_M1 1429 1.12 1.18 1.09 159 TR_LOTS_OF_MONEY3 1428 0.58 1.18 0.22 160 HTML_TEXT_INVISIBLE_STYLE 1420 0.63 1.17 0.32 161 MAILING_LIST_MULTI 1398 1.74 1.15 2.08 162 BAYES_40 1397 2.70 1.15 3.60 163 URI_PHP_REDIR 1388 0.43 1.15 0.00 164 HTML_IMAGE_ONLY_20 1317 0.97 1.09 0.90 165 URI_HEX 1307 1.08 1.08 1.07 166 TR_XM_SB_Phish 1303 1.41 1.08 1.61 167 XMBody_78 1264 0.66 1.04 0.43 168 THIS_AD 1248 0.62 1.03 0.38 169 DIET_1 1229 0.69 1.02 0.50 170 XM_ProductURIs 1215 1.45 1.00 1.72 171 T_XMDrugObfuBody_00 1207 0.83 1.00 0.74 172 RCVD_IN_RP_SAFE 1202 1.36 0.99 1.57 173 RCVD_IN_PSBL 1186 0.74 0.98 0.60 174 XMWghtMeta_00 1158 0.54 0.96 0.29 175 NORDNS_LOW_CONTRAST 1143 0.40 0.94 0.08 176 BAYES_00 1143 5.37 0.94 7.97 177 XM_H_PHPMailer 1115 0.72 0.92 0.61 178 RELAYCOUNTRY_AU 1114 0.47 0.92 0.21 179 XMSubGiftCard1 1108 0.62 0.92 0.45 180 BAYES_20 1103 1.99 0.91 2.62 181 T_TooManySym_03 1098 2.06 0.91 2.74 182 XMSubPhish11 1076 1.34 0.89 1.60 183 RELAYCOUNTRY_IE 1068 0.47 0.88 0.22 184 TR_MetaPhish_Combo_01 1057 0.76 0.87 0.69 185 XM_B_REG_HTML 1050 0.74 0.87 0.67 186 RELAYCOUNTRY_RU 1049 0.34 0.87 0.03 187 XMGenDplmaNmb 1040 0.64 0.86 0.52 188 RCVD_IN_IADB_LISTED 1036 2.45 0.86 3.38 189 XM_B_COPY_HTML 1026 1.13 0.85 1.30 190 XM_Body_Dirty_Words_01 1024 0.40 0.85 0.14 191 SUSP_UTF8_WORD_SUBJ 1012 0.33 0.84 0.03 192 URI_TRY_3LD 1008 0.69 0.83 0.60 193 RELAYCOUNTRY_TR 1005 0.40 0.83 0.15 194 PLING_QUERY 995 0.54 0.82 0.38 195 URIBL_BLACK 986 0.32 0.81 0.03 196 TR_Mismatch_TLD_01 976 0.46 0.81 0.25 197 ANY_BOUNCE_MESSAGE 968 1.24 0.80 1.50 198 BOUNCE_MESSAGE 968 1.24 0.80 1.50 199 TR_XM_COVIDMETA1 950 0.46 0.78 0.26 200 TR_XM_InvalidRelay 930 0.31 0.77 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174123 88.11 94.57 84.33 2 RELAYCOUNTRY_US 167719 80.97 80.53 81.23 3 DKIM_SIGNED 165942 84.55 91.70 80.37 4 XM_DK_Pass 161382 82.54 90.01 78.16 5 DKIM_VALID 160473 82.03 89.38 77.72 6 XM_B_Unicode 149251 74.92 79.42 72.28 7 DKIM_VALID_AU 137561 67.90 70.07 66.62 8 BAYES_50 121304 50.66 36.87 58.75 9 DCC_CHECK_NEGATIVE 121038 47.73 29.16 58.62 10 XMListUnsubscribeExists 117887 63.46 74.31 57.09 11 XM_B_SpammyWords 98898 54.18 64.89 47.90 12 XM_B_Unicode3 97329 45.55 42.84 47.14 13 DCC_CHECK 85388 52.25 70.82 41.35 14 RCVD_IN_MSPIKE_H2 83004 42.93 47.60 40.20 15 HTML_FONT_LOW_CONTRAST 67068 33.70 35.79 32.48 16 LOC_TINY_FONT_1 65847 34.36 38.58 31.89 17 FVGT_m_MULTI_ODD 58144 30.63 34.83 28.16 18 DKIM_VALID_EF 57778 30.74 35.43 27.98 19 XMSubLong 50413 22.78 20.01 24.41 20 MIME_HTML_ONLY 49143 28.53 36.59 23.80 21 RCVD_IN_MSPIKE_WL 44634 20.84 19.52 21.62 22 T_TM2_M_HEADER_IN_MSG 44405 20.39 18.49 21.51 23 XM_B_SpammyWords2 41532 25.50 34.70 20.11 24 T_KAM_HTML_FONT_INVALID 40453 22.76 28.16 19.59 25 USER_IN_DEF_DKIM_WL 39289 13.08 2.95 19.03 26 XM_Multi_Part_URI 34481 16.82 17.04 16.70 27 ALL_TRUSTED 31618 10.36 1.91 15.31 28 XM_Body_Dirty_Words 27987 16.46 21.41 13.55 29 RCVD_IN_MSPIKE_H3 26704 14.22 16.42 12.93 30 XM_DKIMWhitelistDomains 24739 7.57 0.04 11.98 31 BAYES_60 23013 10.14 8.43 11.15 32 XM_Evil_Numbers_Gen 22502 9.94 8.32 10.90 33 UNPARSEABLE_RELAY 21865 12.19 14.93 10.59 34 T_TooManySym_01 19396 6.89 2.62 9.39 35 XM_B_Unsub 17956 10.83 14.47 8.70 36 LotsOfNums_01 17465 7.04 4.61 8.46 37 XM_DK_Undo_02 17253 22.86 47.60 8.36 38 RCVD_IN_VALIDITY_SAFE 17119 6.67 3.91 8.29 39 BAYES_00 16457 5.37 0.94 7.97 40 HTML_IMAGE_RATIO_02 15502 7.31 6.97 7.51 41 TR_XM_BayesUnsub 14364 9.62 14.15 6.96 42 RCVD_IN_VALIDITY_CERTIFIED 14125 5.37 2.86 6.84 43 RCVD_IN_MSPIKE_H4 13944 5.23 2.63 6.75 44 TR_XM_DK_Bayes 13557 4.42 0.76 6.57 45 HTML_IMAGE_RATIO_04 13480 5.71 4.32 6.53 46 XM_SendGrid 13444 6.83 7.38 6.51 47 TR_XM_DK_Bayes1 13414 4.37 0.76 6.50 48 TooManyTo_001 13352 6.85 7.52 6.47 49 BAYES_99 13112 17.42 36.29 6.35 50 T_TooManySym_02 12960 4.43 1.27 6.28 51 TR_XM_DK_Bayes2 12437 4.00 0.55 6.02 52 MPART_ALT_DIFF 12268 7.86 11.13 5.94 53 TR_XM_DKIM_Undo 12198 17.16 36.36 5.91 54 XMStrtUSub 12195 5.20 4.01 5.91 55 XMNumbers 11757 5.27 4.55 5.69 56 LOTS_OF_MONEY 11493 6.64 8.48 5.57 57 IN_ZIMBRA_NJ_WHITELIST 11323 3.47 0.05 5.48 58 BOTNET_IPINHOSTNAME 10986 7.75 11.90 5.32 59 HTML_IMAGE_RATIO_06 10803 4.79 4.02 5.23 60 XM_H_Long_From01 10688 5.35 5.64 5.18 61 BAYES_999 10617 13.76 28.45 5.14 62 XMSexyCombo_05 10264 7.37 11.46 4.97 63 XM_B_SpammyWords3 10172 6.86 10.16 4.93 64 BAYES_80 10011 6.42 9.09 4.85 65 TR_XM_DK_SendGrid 9559 4.57 4.47 4.63 66 RELAYCOUNTRY_META 9229 11.37 23.14 4.47 67 XM_UncommonTLD01 9130 7.52 12.81 4.42 68 T_REMOTE_IMAGE 8868 3.54 2.26 4.29 69 XM_B_Phish_Phrases 8122 3.88 3.80 3.93 70 FROM_EXCESS_BASE64 8047 3.49 2.81 3.90 71 MIME_HTML_ONLY_MULTI 7819 5.56 8.59 3.79 72 MIME_QP_LONG_LINE 7513 2.83 1.45 3.64 73 TR_XM_SpammyWords4 7495 4.91 7.09 3.63 74 BAYES_40 7433 2.70 1.15 3.60 75 INVALID_MSGID 7141 2.22 0.12 3.46 76 RCVD_IN_IADB_LISTED 6979 2.45 0.86 3.38 77 FSL_BULK_SIG 6799 5.51 9.28 3.29 78 MSGID_NOFQDN1 6756 2.07 0.01 3.27 79 BAYES_95 6475 4.15 5.87 3.14 80 TR_XM_PhishingBody 6421 3.86 5.13 3.11 81 XMSubMetaSx_00 6368 3.96 5.45 3.08 82 RCVD_IN_IADB_SPF 6322 2.19 0.72 3.06 83 MIME_HTML_MOSTLY 6030 3.05 3.27 2.92 84 TO_MALFORMED 6007 1.84 0.01 2.91 85 RCVD_IN_IADB_SENDERID 5810 2.02 0.66 2.81 86 RCVD_IN_IADB_DK 5707 1.99 0.67 2.76 87 T_TooManySym_03 5650 2.06 0.91 2.74 88 DKIM_INVALID 5469 2.53 2.32 2.65 89 BAYES_20 5404 1.99 0.91 2.62 90 XM_CamelCaseFrm001 5350 2.40 2.06 2.59 91 HTML_MIME_NO_HTML_TAG 5199 4.01 6.57 2.52 92 XMStockSpam_06 5176 2.13 1.48 2.51 93 XM_GoogleGroups 5047 3.85 6.25 2.44 94 TM2_M_VERY_LONG_WORD 5020 4.38 7.70 2.43 95 TVD_SPACE_RATIO 4861 1.52 0.09 2.35 96 TR_DCC_Bayes_99 4722 11.01 25.90 2.29 97 HTML_IMAGE_RATIO_08 4596 2.65 3.38 2.23 98 TR_XM_SpammyRelay 4562 7.06 15.32 2.21 99 XM_PDF 4558 1.48 0.23 2.21 100 TM2_M_URI_OPT_OUT 4549 2.25 2.34 2.20 101 TR_XM_UnparsRelay 4340 4.88 9.63 2.10 102 XM_B_SpammyTLD 4325 4.21 7.82 2.09 103 MAILING_LIST_MULTI 4295 1.74 1.15 2.08 104 IN_HORDE_ADDRESS_BOOK 4282 1.33 0.07 2.07 105 XMLngstWrd_00 4201 3.55 6.15 2.03 106 RCVD_IN_IADB_VOUCHED 4104 1.42 0.44 1.99 107 XMLngstWrd_01 4047 3.50 6.11 1.96 108 RCVD_IN_MSPIKE_H5 3986 1.39 0.47 1.93 109 XMLngstWrd_02 3732 3.37 6.05 1.81 110 TVD_RCVD_IP 3586 1.19 0.26 1.74 111 XM_ProductURIs 3550 1.45 1.00 1.72 112 XMBdyGiftCard01 3544 2.04 2.58 1.72 113 XMLngstWrd_03 3502 3.17 5.68 1.70 114 BOTNET 3492 3.89 7.65 1.69 115 RELAYCOUNTRY_CA 3447 5.84 12.96 1.67 116 XM_H_Trusted_IP 3444 1.05 0.00 1.67 117 TR_XM_SpammyWords5 3388 2.56 4.13 1.64 118 TR_XM_SB_Phish 3330 1.41 1.08 1.61 119 XMSubPhish11 3308 1.34 0.89 1.60 120 XMLngstWrd_04 3288 3.07 5.59 1.59 121 T_XMDrugObfuBody_14 3283 2.21 3.28 1.59 122 BAYES_05 3276 1.17 0.45 1.59 123 RCVD_IN_RP_SAFE 3239 1.36 0.99 1.57 124 UNTRUSTED_Relay 3229 2.91 5.21 1.56 125 URI_NOVOWEL 3189 1.44 1.25 1.54 126 TR_Symld_Words 3140 1.44 1.30 1.52 127 XMBody_95 3114 1.00 0.12 1.51 128 BOUNCE_MESSAGE 3102 1.24 0.80 1.50 129 ANY_BOUNCE_MESSAGE 3102 1.24 0.80 1.50 130 XM_DK_Undo_01 2974 2.04 3.05 1.44 131 XMGappySubj_01 2949 0.98 0.20 1.43 132 FVGT_m_MULTI_ODD_EMAIL 2947 0.96 0.15 1.43 133 SUBJ_ALL_CAPS 2943 1.45 1.50 1.43 134 TR_XM_SpammyWords2 2878 4.87 10.80 1.39 135 RCVD_IN_IADB_OPTIN 2780 0.93 0.23 1.35 136 XM_B_Unsub2 2732 1.57 2.00 1.32 137 XM_B_Phish66 2726 1.90 2.89 1.32 138 XM_B_COPY_HTML 2682 1.13 0.85 1.30 139 T_XMDrugObfuBody_08 2680 2.16 3.64 1.30 140 RCVD_IN_RP_CERTIFIED 2657 1.09 0.76 1.29 141 UPPERCASE_75_100 2585 2.85 5.56 1.25 142 HTML_TITLE_SUBJ_DIFF 2577 2.87 5.65 1.25 143 XM_H_Long_From02 2495 1.02 0.71 1.21 144 XMBSHREFv2 2491 0.87 0.30 1.21 145 XM_B_Investor 2425 1.81 2.90 1.17 146 TooManyTo_002 2333 0.91 0.54 1.13 147 XMDiploma_00 2268 1.37 1.84 1.10 148 TR_XM_Base64_M1 2252 1.12 1.18 1.09 149 URI_HEX 2216 1.08 1.08 1.07 150 XM_RXBody 2215 0.88 0.56 1.07 151 HTML_TAG_BALANCE_BODY 2197 1.30 1.71 1.06 152 XMSubNoVowel 2133 0.82 0.44 1.03 153 DKIM_ADSP_CUSTOM_MED 2103 0.88 0.65 1.02 154 RCVD_IN_BL_SPAMCOP_NET 2061 4.84 11.40 1.00 155 XMPhish30 1980 1.09 1.32 0.96 156 HTML_FONT_FACE_BAD 1977 0.85 0.67 0.96 157 XM_SPF_SoftFail 1937 1.83 3.34 0.94 158 XM_UB50 1897 1.33 2.04 0.92 159 XM_B_SpammyWords4 1857 1.38 2.21 0.90 160 HTML_IMAGE_ONLY_20 1849 0.97 1.09 0.90 161 XM_OfRef6 1832 1.66 2.99 0.89 162 TooManyTo_003 1672 0.69 0.50 0.81 163 XMHTML_After_End 1610 0.93 1.18 0.78 164 BASE64_LENGTH_79_INF 1522 0.74 0.76 0.74 165 T_XMDrugObfuBody_00 1520 0.83 1.00 0.74 166 T_XMHurry_00 1468 1.06 1.65 0.71 167 MPART_ALT_DIFF_COUNT 1456 1.05 1.65 0.71 168 FORGED_GMAIL_RCVD 1448 0.64 0.53 0.70 169 TR_MetaPhish_Combo_01 1424 0.76 0.87 0.69 170 XM_B_REG_HTML 1374 0.74 0.87 0.67 171 NML_ADSP_CUSTOM_MED 1372 0.63 0.57 0.66 172 USER_IN_WHITELIST 1311 0.40 0.00 0.63 173 USER_IN_WELCOMELIST 1311 0.40 0.00 0.63 174 TooManyTo_004 1304 0.58 0.49 0.63 175 LOW_PRICE 1267 0.49 0.28 0.61 176 XM_H_PHPMailer 1253 0.72 0.92 0.61 177 XMSlimDrugH 1252 0.87 1.33 0.61 178 RCVD_IN_PSBL 1247 0.74 0.98 0.60 179 URI_TRY_3LD 1245 0.69 0.83 0.60 180 XMBrknScrpt_02 1198 0.93 1.52 0.58 181 XMBody_17 1185 1.93 4.23 0.57 182 T_FILL_THIS_FORM_SHORT 1163 1.73 3.72 0.56 183 XMSubMetaI_00 1139 0.79 1.20 0.55 184 XMSubMetaSxObfu_02 1132 0.58 0.64 0.55 185 TooManyTo_005 1115 0.52 0.47 0.54 186 XMNoVowels 1087 0.52 0.51 0.53 187 T_TooManySym_04 1081 0.46 0.34 0.52 188 XMGenDplmaNmb 1069 0.64 0.86 0.52 189 XM_S_SubURI 1039 0.32 0.01 0.50 190 XM_Walgreens_Forge 1039 0.33 0.03 0.50 191 KHOP_HELO_FCRDNS 1028 0.94 1.69 0.50 192 XM_B_DNDMA 1026 0.56 0.66 0.50 193 DIET_1 1023 0.69 1.02 0.50 194 TR_XM_PHPDW 1011 0.88 1.56 0.49 195 XMOemUri 986 0.38 0.21 0.48 196 XMHTMLBadTable_001 965 0.57 0.75 0.47 197 XMSubGiftCard1 939 0.62 0.92 0.45 198 TR_XM_Base64_L1 928 0.54 0.69 0.45 199 SpammyFromTLD_01 923 1.29 2.72 0.45 200 XM_ShortIntro_01 912 0.51 0.62 0.44 ----------------------------------------------------------------------