Email: 520250 Autolearn: 0 AvgScore: 4.37 AvgScanTime: 1.22 sec Spam: 163113 Autolearn: 0 AvgScore: 15.35 AvgScanTime: 1.32 sec Ham: 357137 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 1.17 sec Time Spent Running SA: 175.99 hours Time Spent Processing Spam: 59.82 hours Time Spent Processing Ham: 116.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155025 89.19 95.04 86.51 2 DKIM_SIGNED 146904 79.63 90.06 74.86 3 XM_DK_Pass 143448 77.60 87.94 72.88 4 DKIM_VALID 142161 76.63 87.15 71.83 5 XM_B_Unicode 134053 72.35 82.18 67.86 6 RELAYCOUNTRY_US 130284 79.54 79.87 79.38 7 XMListUnsubscribeExists 117376 55.57 71.96 48.08 8 DCC_CHECK 116255 46.33 71.27 34.93 9 XM_B_SpammyWords 113841 52.13 69.79 44.06 10 DKIM_VALID_AU 107310 60.26 65.79 57.73 11 RCVD_IN_MSPIKE_H2 78450 41.60 48.10 38.64 12 XM_DK_Undo_02 75125 19.02 46.06 6.67 13 XM_B_Unicode3 73115 40.91 44.82 39.13 14 BAYES_50 64105 52.52 39.30 58.56 15 LOC_TINY_FONT_1 63316 28.85 38.82 24.29 16 XM_B_SpammyWords2 63077 24.77 38.67 18.42 17 TR_XM_DKIM_Undo 58167 14.59 35.66 4.96 18 HTML_FONT_LOW_CONTRAST 57276 30.31 35.11 28.11 19 DKIM_VALID_EF 56612 30.91 34.71 29.17 20 BAYES_99 56515 14.17 34.65 4.82 21 FVGT_m_MULTI_ODD 55504 28.31 34.03 25.69 22 MIME_HTML_ONLY 51555 23.02 31.61 19.09 23 DCC_CHECK_NEGATIVE 46826 53.64 28.71 65.02 24 T_KAM_HTML_FONT_INVALID 45891 21.88 28.13 19.02 25 BAYES_999 44486 11.13 27.27 3.75 26 TR_DCC_Bayes_99 41630 9.21 25.52 1.77 27 XM_Body_Dirty_Words 38547 15.21 23.63 11.36 28 RELAYCOUNTRY_META 36103 9.88 22.13 4.29 29 T_TM2_M_HEADER_IN_MSG 35621 28.26 21.84 31.20 30 XMSubLong 34729 21.89 21.29 22.17 31 XM_Multi_Part_URI 30122 14.59 18.47 12.81 32 RCVD_IN_MSPIKE_WL 26526 17.53 16.26 18.11 33 XM_B_Unsub 24102 10.16 14.78 8.05 34 TR_XM_SpammyRelay 24004 5.92 14.72 1.90 35 TR_XM_BayesUnsub 23318 8.82 14.30 6.31 36 UNPARSEABLE_RELAY 21387 10.53 13.11 9.36 37 BOTNET_IPINHOSTNAME 21204 7.34 13.00 4.76 38 RCVD_IN_MSPIKE_H3 20933 11.54 12.83 10.95 39 XM_B_SpammyWords3 20481 6.63 12.56 3.93 40 LOTS_OF_MONEY 18556 7.93 11.38 6.36 41 BOTNET 18442 4.85 11.31 1.90 42 TR_XM_SpammyWords2 18038 3.96 11.06 0.72 43 XMSexyCombo_05 17455 5.83 10.70 3.60 44 XM_Evil_Numbers_Gen 16386 9.51 10.05 9.26 45 RELAYCOUNTRY_CA 16172 3.98 9.91 1.26 46 TR_XM_SpammyWords4 14767 5.86 9.05 4.40 47 FSL_BULK_SIG 14760 5.41 9.05 3.75 48 RCVD_IN_BL_SPAMCOP_NET 14745 3.11 9.04 0.40 49 BAYES_80 14374 5.67 8.81 4.23 50 XM_UncommonTLD01 13517 5.26 8.29 3.87 51 MPART_ALT_DIFF 13353 7.09 8.19 6.59 52 BAYES_60 13230 9.04 8.11 9.47 53 UNTRUSTED_Relay 13215 3.61 8.10 1.56 54 TR_XM_SPAMCOP 12758 2.64 7.82 0.27 55 TR_XM_UnparsRelay 12491 3.46 7.66 1.55 56 TooManyTo_001 10856 8.00 6.66 8.62 57 HTML_IMAGE_RATIO_02 10461 6.15 6.41 6.04 58 LotsOfNums_01 10376 7.45 6.36 7.95 59 XM_SendGrid 10345 5.76 6.34 5.49 60 TR_XM_PhishingBody 10328 4.41 6.33 3.53 61 XMSubMetaSx_00 9686 3.92 5.94 3.00 62 XM_B_SpammyTLD 9505 3.16 5.83 1.94 63 MIME_HTML_ONLY_MULTI 9140 3.53 5.60 2.59 64 XM_B_Phish_Phrases 8851 4.15 5.43 3.57 65 XM_H_Long_From01 8844 5.40 5.42 5.39 66 TM2_M_VERY_LONG_WORD 8624 2.80 5.29 1.66 67 BAYES_95 8224 3.39 5.04 2.63 68 XM_DIRTYINTL 7708 1.70 4.73 0.32 69 T_XMDrugObfuBody_14 7065 2.44 4.33 1.57 70 HTML_IMAGE_RATIO_04 6978 4.26 4.28 4.25 71 T_XMDrugObfuBody_08 6768 2.30 4.15 1.45 72 XM_B_Investor 6752 2.28 4.14 1.43 73 TR_XM_DK_SendGrid 6537 3.77 4.01 3.66 74 XMBody_17 6394 1.57 3.92 0.49 75 XMStrtUSub 6373 4.79 3.91 5.20 76 RCVD_IN_VALIDITY_SAFE 6349 4.76 3.89 5.16 77 SpammyFromTLD_02 6329 1.42 3.88 0.29 78 XMNumbers 6317 3.90 3.87 3.91 79 HTML_MIME_NO_HTML_TAG 6111 2.69 3.75 2.21 80 XM_SPF_SoftFail 6095 2.56 3.74 2.02 81 MIME_HTML_MOSTLY 5970 4.11 3.66 4.32 82 T_FILL_THIS_FORM_SHORT 5844 1.74 3.58 0.91 83 HTML_IMAGE_RATIO_06 5824 3.84 3.57 3.96 84 MIME_QP_LONG_LINE 5614 4.32 3.44 4.72 85 HTML_IMAGE_RATIO_08 5554 3.05 3.41 2.89 86 PDS_OTHER_BAD_TLD 5488 1.17 3.36 0.17 87 XM_B_Phish66 5443 2.38 3.34 1.94 88 TR_XM_SpammyWords5 5282 1.79 3.24 1.13 89 RCVD_IN_VALIDITY_CERTIFIED 5216 4.04 3.20 4.43 90 XM_GoogleGroups 5206 2.16 3.19 1.69 91 RCVD_IN_MSPIKE_H4 4978 4.86 3.05 5.69 92 DKIM_INVALID 4743 2.99 2.91 3.03 93 HK_RANDOM_REPLYTO 4688 0.96 2.87 0.09 94 TM2_M_URI_OPT_OUT 4559 2.31 2.79 2.09 95 XM_UB50 4540 1.59 2.78 1.04 96 XM_UB99 4515 0.87 2.77 0.00 97 XM_OfRef6 4513 1.55 2.77 0.99 98 RELAYCOUNTRY_RU 4420 0.87 2.71 0.02 99 XMLngstWrd_00 4395 1.42 2.69 0.84 100 XMLngstWrd_01 4349 1.37 2.67 0.78 101 XMDiploma_00 4305 1.74 2.64 1.34 102 XMLngstWrd_02 4194 1.26 2.57 0.67 103 URIBL_DBL_SPAM 4109 0.81 2.52 0.02 104 SpammyFromTLD_01 4056 1.34 2.49 0.81 105 HTML_TITLE_SUBJ_DIFF 4000 1.00 2.45 0.34 106 XMLngstWrd_03 3974 1.13 2.44 0.53 107 USER_IN_DEF_DKIM_WL 3947 9.39 2.42 12.58 108 BOTNET_NORDNS 3927 0.76 2.41 0.01 109 XMLngstWrd_04 3903 1.08 2.39 0.48 110 XM_B_Unsub2 3808 1.89 2.33 1.69 111 XM_UB999 3759 0.72 2.30 0.00 112 UPPERCASE_75_100 3738 0.95 2.29 0.34 113 XM_B_SpammyWords4 3738 1.21 2.29 0.71 114 FROM_EXCESS_BASE64 3723 2.63 2.28 2.78 115 TR_XM_FormFill 3711 0.72 2.28 0.01 116 T_TooManySym_01 3705 5.93 2.27 7.60 117 FROM_SUSPICIOUS_NTLD 3552 0.70 2.18 0.03 118 MAILING_LIST_MULTI 3488 2.88 2.14 3.22 119 LongTLD 3439 0.94 2.11 0.41 120 XM_CamelCaseFrm001 3395 2.01 2.08 1.97 121 RCVD_IN_IADB_LISTED 3345 3.44 2.05 4.08 122 XM_DK_Undo_01 3332 1.83 2.04 1.73 123 RCVD_IN_MSPIKE_BL 3324 0.90 2.04 0.37 124 FROM_SUSPICIOUS_NTLD_FP 3286 0.65 2.01 0.03 125 TR_XM_NoHeaderRelay 3230 0.71 1.98 0.13 126 T_XMHurry_00 3063 0.93 1.88 0.50 127 DATE_IN_PAST_06_12 2949 0.63 1.81 0.09 128 RCVD_IN_IADB_SPF 2938 3.09 1.80 3.68 129 XMSexyCombo_01 2931 0.76 1.80 0.29 130 XMBdyGiftCard01 2927 1.21 1.79 0.94 131 TVD_PH_BODY_ACCOUNTS_PRE 2916 0.66 1.79 0.15 132 TR_XM_MSPIKECOMBO 2904 0.80 1.78 0.36 133 RCVD_IN_VALIDITY_RPBL 2892 0.57 1.77 0.03 134 URI_PHISH 2827 0.56 1.73 0.02 135 T_REMOTE_IMAGE 2804 3.17 1.72 3.84 136 RCVD_IN_IADB_DK 2786 2.76 1.71 3.25 137 XMStockSpam_06 2780 1.69 1.70 1.68 138 TR_XM_SB_Phish 2763 2.07 1.69 2.25 139 RCVD_IN_IADB_SENDERID 2757 2.82 1.69 3.33 140 URI_HEX 2757 1.38 1.69 1.23 141 XM_URI_RBL 2745 0.63 1.68 0.15 142 TR_Phish_OUT 2705 0.52 1.66 0.00 143 XM_H_Undi_Recip 2681 0.73 1.64 0.32 144 XMSubPhish11 2661 2.03 1.63 2.21 145 KHOP_HELO_FCRDNS 2659 1.40 1.63 1.30 146 URI_NOVOWEL 2636 1.71 1.62 1.75 147 TR_XM_PHPDW 2632 1.07 1.61 0.83 148 XMSubMetaI_00 2517 1.04 1.54 0.82 149 NORDNS_LOW_CONTRAST 2507 0.52 1.54 0.06 150 XM_B_COVIDMETA 2479 0.77 1.52 0.43 151 TR_XM_PHPForged 2475 1.01 1.52 0.77 152 XMHTML_After_End 2455 1.23 1.51 1.10 153 HTTPS_HTTP_MISMATCH 2446 0.98 1.50 0.74 154 TR_XM_FormFill2 2422 0.99 1.48 0.77 155 XM_H_PHPOS 2419 0.99 1.48 0.76 156 MPART_ALT_DIFF_COUNT 2410 0.87 1.48 0.59 157 SUBJ_ALL_CAPS 2380 1.40 1.46 1.38 158 FONT_INVIS_LONG_LINE 2366 0.50 1.45 0.07 159 ALL_TRUSTED 2341 12.44 1.44 17.47 160 TR_XM_BayesRelay 2280 0.44 1.40 0.00 161 BAYES_40 2277 3.76 1.40 4.84 162 XMBrknScrpt_02 2273 0.88 1.39 0.65 163 RELAYCOUNTRY_AU 2261 0.64 1.39 0.30 164 THIS_AD 2222 0.74 1.36 0.45 165 XMPhish30 2153 0.91 1.32 0.73 166 XMGenDplmaNmb 2104 0.83 1.29 0.61 167 HTML_TAG_BALANCE_BODY 2101 0.84 1.29 0.64 168 TR_XM_Base64_M1 2094 1.11 1.28 1.03 169 TR_Symld_Words 2026 1.36 1.24 1.41 170 XMReplyNow 1994 0.53 1.22 0.21 171 TR_LOTS_OF_MONEY3 1984 0.59 1.22 0.31 172 TR_XM_Undi_Recip5 1936 0.38 1.19 0.01 173 T_XMDrugObfuBody_00 1924 0.80 1.18 0.62 174 BAYES_20 1842 2.85 1.13 3.64 175 TR_XM_Undi_Recip2 1758 0.35 1.08 0.01 176 TR_XM_COVIDMETA1 1742 0.48 1.07 0.21 177 XM_B_SEO 1741 0.42 1.07 0.13 178 TR_XM_InvalidRelay 1739 0.35 1.07 0.02 179 TR_XM_Undi_RecipCombo2 1734 0.34 1.06 0.01 180 XM_OfRef7 1716 0.40 1.05 0.10 181 URIBL_BLACK 1703 0.36 1.04 0.04 182 HTML_FONT_FACE_BAD 1702 1.13 1.04 1.18 183 UNDISC_MONEY 1693 0.33 1.04 0.00 184 XM_Body_Dirty_Words_01 1685 0.51 1.03 0.28 185 URI_PHP_REDIR 1660 0.32 1.02 0.00 186 TR_XM_SEO4 1624 0.36 1.00 0.07 187 BAYES_00 1607 6.92 0.99 9.63 188 NO_DNS_FOR_FROM 1605 0.51 0.98 0.29 189 TR_XM_SpammyWords3 1604 0.43 0.98 0.17 190 RCVD_IN_IADB_VOUCHED 1601 1.95 0.98 2.39 191 VFY_ACCT_NORDNS 1548 0.30 0.95 0.01 192 RELAYCOUNTRY_FR 1538 0.52 0.94 0.33 193 TR_Mismatch_TLD_01 1492 0.45 0.91 0.24 194 XM_H_Long_From02 1492 0.98 0.91 1.00 195 XM_UB60 1489 0.34 0.91 0.08 196 PLING_QUERY 1489 0.56 0.91 0.40 197 TR_XM_MaxWHORU 1480 0.44 0.91 0.23 198 URI_TRY_3LD 1414 0.64 0.87 0.53 199 RCVD_IN_PSBL 1396 0.57 0.86 0.44 200 REMOVE_BEFORE_LINK 1392 0.40 0.85 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 308968 89.19 95.04 86.51 2 RELAYCOUNTRY_US 283497 79.54 79.87 79.38 3 DKIM_SIGNED 267354 79.63 90.06 74.86 4 XM_DK_Pass 260283 77.60 87.94 72.88 5 DKIM_VALID 256524 76.63 87.15 71.83 6 XM_B_Unicode 242345 72.35 82.18 67.86 7 DCC_CHECK_NEGATIVE 232227 53.64 28.71 65.02 8 BAYES_50 209144 52.52 39.30 58.56 9 DKIM_VALID_AU 206180 60.26 65.79 57.73 10 XMListUnsubscribeExists 171722 55.57 71.96 48.08 11 XM_B_SpammyWords 157352 52.13 69.79 44.06 12 XM_B_Unicode3 139742 40.91 44.82 39.13 13 RCVD_IN_MSPIKE_H2 137989 41.60 48.10 38.64 14 DCC_CHECK 124751 46.33 71.27 34.93 15 T_TM2_M_HEADER_IN_MSG 111414 28.26 21.84 31.20 16 DKIM_VALID_EF 104183 30.91 34.71 29.17 17 HTML_FONT_LOW_CONTRAST 100403 30.31 35.11 28.11 18 FVGT_m_MULTI_ODD 91765 28.31 34.03 25.69 19 LOC_TINY_FONT_1 86760 28.85 38.82 24.29 20 XMSubLong 79176 21.89 21.29 22.17 21 MIME_HTML_ONLY 68193 23.02 31.61 19.09 22 T_KAM_HTML_FONT_INVALID 67920 21.88 28.13 19.02 23 XM_B_SpammyWords2 65783 24.77 38.67 18.42 24 RCVD_IN_MSPIKE_WL 64678 17.53 16.26 18.11 25 ALL_TRUSTED 62374 12.44 1.44 17.47 26 XM_Multi_Part_URI 45758 14.59 18.47 12.81 27 USER_IN_DEF_DKIM_WL 44918 9.39 2.42 12.58 28 XM_Body_Dirty_Words 40576 15.21 23.63 11.36 29 RCVD_IN_MSPIKE_H3 39116 11.54 12.83 10.95 30 BAYES_00 34407 6.92 0.99 9.63 31 BAYES_60 33819 9.04 8.11 9.47 32 UNPARSEABLE_RELAY 33419 10.53 13.11 9.36 33 XM_DKIMWhitelistDomains 33235 6.40 0.04 9.31 34 XM_Evil_Numbers_Gen 33071 9.51 10.05 9.26 35 TooManyTo_001 30782 8.00 6.66 8.62 36 XM_B_Unsub 28744 10.16 14.78 8.05 37 LotsOfNums_01 28396 7.45 6.36 7.95 38 T_TooManySym_01 27142 5.93 2.27 7.60 39 IN_ZIMBRA_NJ_WHITELIST 25022 4.84 0.09 7.01 40 XM_DK_Undo_02 23816 19.02 46.06 6.67 41 TR_XM_DK_Bayes 23664 4.76 0.68 6.63 42 MPART_ALT_DIFF 23547 7.09 8.19 6.59 43 TR_XM_DK_Bayes1 23239 4.68 0.67 6.51 44 LOTS_OF_MONEY 22725 7.93 11.38 6.36 45 TR_XM_BayesUnsub 22547 8.82 14.30 6.31 46 HTML_IMAGE_RATIO_02 21554 6.15 6.41 6.04 47 TR_XM_DK_Bayes2 20355 4.09 0.57 5.70 48 RCVD_IN_MSPIKE_H4 20318 4.86 3.05 5.69 49 XM_SendGrid 19603 5.76 6.34 5.49 50 XM_H_Long_From01 19249 5.40 5.42 5.39 51 XMStrtUSub 18559 4.79 3.91 5.20 52 RCVD_IN_VALIDITY_SAFE 18438 4.76 3.89 5.16 53 TR_XM_DKIM_Undo 17714 14.59 35.66 4.96 54 XM_PDF 17377 3.56 0.69 4.87 55 BAYES_40 17293 3.76 1.40 4.84 56 BAYES_99 17200 14.17 34.65 4.82 57 BOTNET_IPINHOSTNAME 16982 7.34 13.00 4.76 58 MIME_QP_LONG_LINE 16873 4.32 3.44 4.72 59 RCVD_IN_VALIDITY_CERTIFIED 15813 4.04 3.20 4.43 60 TR_XM_SpammyWords4 15711 5.86 9.05 4.40 61 MIME_HTML_MOSTLY 15425 4.11 3.66 4.32 62 T_TooManySym_02 15407 3.20 0.77 4.31 63 RELAYCOUNTRY_META 15317 9.88 22.13 4.29 64 HTML_IMAGE_RATIO_04 15190 4.26 4.28 4.25 65 BAYES_80 15117 5.67 8.81 4.23 66 RCVD_IN_IADB_LISTED 14558 3.44 2.05 4.08 67 HTML_IMAGE_RATIO_06 14146 3.84 3.57 3.96 68 XM_B_SpammyWords3 14020 6.63 12.56 3.93 69 XMNumbers 13958 3.90 3.87 3.91 70 XM_UncommonTLD01 13830 5.26 8.29 3.87 71 T_REMOTE_IMAGE 13703 3.17 1.72 3.84 72 BAYES_999 13400 11.13 27.27 3.75 73 FSL_BULK_SIG 13399 5.41 9.05 3.75 74 RCVD_IN_IADB_SPF 13140 3.09 1.80 3.68 75 TR_XM_DK_SendGrid 13061 3.77 4.01 3.66 76 BAYES_20 12994 2.85 1.13 3.64 77 XMSexyCombo_05 12861 5.83 10.70 3.60 78 XM_B_Phish_Phrases 12746 4.15 5.43 3.57 79 TR_XM_PhishingBody 12623 4.41 6.33 3.53 80 RCVD_IN_IADB_SENDERID 11890 2.82 1.69 3.33 81 RCVD_IN_IADB_DK 11593 2.76 1.71 3.25 82 MAILING_LIST_MULTI 11502 2.88 2.14 3.22 83 DKIM_INVALID 10830 2.99 2.91 3.03 84 XMSubMetaSx_00 10698 3.92 5.94 3.00 85 HTML_IMAGE_RATIO_08 10323 3.05 3.41 2.89 86 FROM_EXCESS_BASE64 9942 2.63 2.28 2.78 87 BAYES_95 9395 3.39 5.04 2.63 88 MIME_HTML_ONLY_MULTI 9243 3.53 5.60 2.59 89 TooManyTo_002 8606 1.90 0.79 2.41 90 RCVD_IN_IADB_VOUCHED 8551 1.95 0.98 2.39 91 TR_XM_SB_Phish 8029 2.07 1.69 2.25 92 HTML_MIME_NO_HTML_TAG 7903 2.69 3.75 2.21 93 XMSubPhish11 7899 2.03 1.63 2.21 94 BAYES_05 7768 1.67 0.58 2.18 95 TM2_M_URI_OPT_OUT 7465 2.31 2.79 2.09 96 INVALID_MSGID 7435 1.47 0.14 2.08 97 XM_SPF_SoftFail 7231 2.56 3.74 2.02 98 XM_CamelCaseFrm001 7044 2.01 2.08 1.97 99 MSGID_NOFQDN1 7012 1.36 0.04 1.96 100 XM_B_Phish66 6933 2.38 3.34 1.94 101 XM_B_SpammyTLD 6927 3.16 5.83 1.94 102 TR_XM_SpammyRelay 6793 5.92 14.72 1.90 103 BOTNET 6780 4.85 11.31 1.90 104 HELO_NODOT 6680 1.48 0.62 1.87 105 HELO_NO_DOMAIN 6676 1.48 0.61 1.87 106 IN_HORDE_ADDRESS_BOOK 6394 1.26 0.10 1.79 107 TR_DCC_Bayes_99 6304 9.21 25.52 1.77 108 URI_NOVOWEL 6262 1.71 1.62 1.75 109 XM_DK_Undo_01 6177 1.83 2.04 1.73 110 XM_B_Unsub2 6043 1.89 2.33 1.69 111 XM_GoogleGroups 6025 2.16 3.19 1.69 112 TO_MALFORMED 6020 1.17 0.03 1.69 113 XMStockSpam_06 5998 1.69 1.70 1.68 114 TM2_M_VERY_LONG_WORD 5940 2.80 5.29 1.66 115 T_TooManySym_03 5928 1.22 0.27 1.66 116 TooManyTo_003 5910 1.34 0.65 1.65 117 TVD_RCVD_IP 5895 1.21 0.26 1.65 118 ANY_BOUNCE_MESSAGE 5869 1.37 0.78 1.64 119 BOUNCE_MESSAGE 5866 1.37 0.77 1.64 120 RCVD_IN_IADB_OPTIN 5726 1.27 0.55 1.60 121 T_HTML_ATTACH 5692 1.14 0.16 1.59 122 T_XMDrugObfuBody_14 5621 2.44 4.33 1.57 123 UNTRUSTED_Relay 5570 3.61 8.10 1.56 124 TR_XM_UnparsRelay 5527 3.46 7.66 1.55 125 TVD_SPACE_RATIO 5450 1.08 0.11 1.53 126 RCVD_IN_MSPIKE_H5 5244 1.13 0.38 1.47 127 T_XMDrugObfuBody_08 5188 2.30 4.15 1.45 128 XM_B_Investor 5100 2.28 4.14 1.43 129 TR_Symld_Words 5035 1.36 1.24 1.41 130 SUBJ_ALL_CAPS 4917 1.40 1.46 1.38 131 XMDiploma_00 4772 1.74 2.64 1.34 132 KHOP_HELO_FCRDNS 4649 1.40 1.63 1.30 133 RELAYCOUNTRY_CA 4509 3.98 9.91 1.26 134 TooManyTo_004 4440 1.01 0.49 1.24 135 URI_HEX 4398 1.38 1.69 1.23 136 XM_H_Trusted_IP 4394 0.84 0.00 1.23 137 XMBody_95 4258 0.88 0.18 1.19 138 HTML_FONT_FACE_BAD 4198 1.13 1.04 1.18 139 XMCapTrack 4196 0.94 0.44 1.17 140 XMBSHREFv2 4085 0.89 0.34 1.14 141 TR_XM_SpammyWords5 4032 1.79 3.24 1.13 142 XMGappySubj_01 3949 0.86 0.33 1.11 143 XMHTML_After_End 3932 1.23 1.51 1.10 144 XM_UB50 3707 1.59 2.78 1.04 145 TooManyTo_005 3692 0.85 0.45 1.03 146 RCVD_IN_RP_SAFE 3673 0.96 0.81 1.03 147 TR_XM_Base64_M1 3662 1.11 1.28 1.03 148 XM_H_Long_From02 3587 0.98 0.91 1.00 149 XM_OfRef6 3530 1.55 2.77 0.99 150 XMNoVowels 3454 0.81 0.46 0.97 151 XMBdyGiftCard01 3364 1.21 1.79 0.94 152 HTML_OBFUSCATE_20_30 3341 0.64 0.01 0.94 153 FROM_GOV_DKIM_AU 3320 0.70 0.19 0.93 154 XM_ShortIntro_01 3275 0.77 0.45 0.92 155 T_FILL_THIS_FORM_SHORT 3234 1.74 3.58 0.91 156 RCVD_IN_RP_CERTIFIED 3184 0.82 0.67 0.89 157 DKIM_ADSP_CUSTOM_MED 3154 0.84 0.74 0.88 158 XMLngstWrd_00 3000 1.42 2.69 0.84 159 FVGT_m_MULTI_ODD_EMAIL 2976 0.64 0.20 0.83 160 TR_XM_PHPDW 2948 1.07 1.61 0.83 161 XMSubMetaI_00 2915 1.04 1.54 0.82 162 SpammyFromTLD_01 2906 1.34 2.49 0.81 163 XMLngstWrd_01 2773 1.37 2.67 0.78 164 TR_XM_PHPForged 2765 1.01 1.52 0.77 165 TR_XM_FormFill2 2749 0.99 1.48 0.77 166 XM_H_PHPOS 2719 0.99 1.48 0.76 167 HTTPS_HTTP_MISMATCH 2656 0.98 1.50 0.74 168 XMPhish30 2597 0.91 1.32 0.73 169 TR_XM_SpammyWords2 2581 3.96 11.06 0.72 170 T_OBFU_PDF_ATTACH 2575 0.53 0.10 0.72 171 XM_B_SpammyWords4 2538 1.21 2.29 0.71 172 TR_MetaPhish_Combo_01 2487 0.70 0.71 0.70 173 XMLngstWrd_02 2379 1.26 2.57 0.67 174 XMBrknScrpt_02 2313 0.88 1.39 0.65 175 HTML_TAG_BALANCE_BODY 2276 0.84 1.29 0.64 176 T_XMDrugObfuBody_00 2231 0.80 1.18 0.62 177 XMGenDplmaNmb 2190 0.83 1.29 0.61 178 XM_H_PHPMailer 2164 0.68 0.84 0.61 179 MPART_ALT_DIFF_COUNT 2094 0.87 1.48 0.59 180 RCVD_IN_SORBS_DUL 2080 0.43 0.11 0.58 181 XM_B_COPY_HTML 2069 0.60 0.64 0.58 182 XM_RXBody 2063 0.54 0.47 0.58 183 HTML_IMAGE_ONLY_20 2053 0.51 0.37 0.57 184 NML_ADSP_CUSTOM_MED 2016 0.57 0.57 0.56 185 XMSubNoVowel 1987 0.51 0.42 0.56 186 RELAYCOUNTRY_GB 1949 0.60 0.71 0.55 187 SHORT_HELO_AND_INLINE_IMAGE 1942 0.40 0.08 0.54 188 XMLngstWrd_03 1909 1.13 2.44 0.53 189 URI_TRY_3LD 1900 0.64 0.87 0.53 190 T_Symld_Words_02 1855 0.53 0.57 0.52 191 XMPhish14 1839 0.61 0.82 0.51 192 XMOemUri 1819 0.43 0.26 0.51 193 T_XMHurry_00 1798 0.93 1.88 0.50 194 XM_ProductURIs 1772 0.60 0.82 0.50 195 XMBody_17 1759 1.57 3.92 0.49 196 XMLngstWrd_04 1702 1.08 2.39 0.48 197 HTML_IMAGE_ONLY_32 1701 0.40 0.24 0.48 198 MISSING_HEADERS 1680 0.43 0.35 0.47 199 FORGED_GMAIL_RCVD 1656 0.49 0.55 0.46 200 XMMoneyMeta_00 1622 0.52 0.67 0.45 ----------------------------------------------------------------------