Email: 316954 Autolearn: 0 AvgScore: 4.53 AvgScanTime: 1.35 sec Spam: 108170 Autolearn: 0 AvgScore: 13.32 AvgScanTime: 1.44 sec Ham: 208784 Autolearn: 0 AvgScore: -0.03 AvgScanTime: 1.31 sec Time Spent Running SA: 119.14 hours Time Spent Processing Spam: 43.27 hours Time Spent Processing Ham: 75.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 103958 87.27 96.11 82.69 2 DKIM_SIGNED 96210 80.67 88.94 76.38 3 XM_DK_Pass 93566 79.26 86.50 75.51 4 DKIM_VALID 92806 78.73 85.80 75.07 5 RELAYCOUNTRY_US 92577 80.90 85.58 78.48 6 XM_B_Unicode 90668 76.00 83.82 71.95 7 DCC_CHECK 79904 56.86 73.87 48.05 8 XMListUnsubscribeExists 77643 59.89 71.78 53.73 9 XM_B_SpammyWords 74141 53.71 68.54 46.03 10 DKIM_VALID_AU 73575 65.68 68.02 64.47 11 XM_B_Unicode3 53819 47.04 49.75 45.63 12 LOC_TINY_FONT_1 51913 37.87 47.99 32.62 13 XM_DK_Undo_02 45169 18.22 41.76 6.02 14 HTML_FONT_LOW_CONTRAST 42726 34.75 39.50 32.29 15 XM_B_SpammyWords2 42159 26.55 38.97 20.11 16 RCVD_IN_MSPIKE_H2 41980 36.70 38.81 35.61 17 BAYES_99 39921 15.65 36.91 4.64 18 BAYES_50 39003 52.95 36.06 61.70 19 FVGT_m_MULTI_ODD 37452 27.85 34.62 24.34 20 MIME_HTML_ONLY 33699 23.64 31.15 19.75 21 TR_XM_DKIM_Undo 32185 11.83 29.75 2.55 22 BAYES_999 32068 12.51 29.65 3.63 23 T_KAM_HTML_FONT_INVALID 31544 22.85 29.16 19.59 24 DKIM_VALID_EF 28737 27.71 26.57 28.30 25 DCC_CHECK_NEGATIVE 27762 42.97 25.67 51.93 26 TR_DCC_Bayes_99 25840 9.54 23.89 2.11 27 XM_Multi_Part_URI 24308 22.40 22.47 22.36 28 XMSubLong 22301 21.00 20.62 21.20 29 XM_B_Unsub 21726 13.22 20.09 9.67 30 TR_XM_DK_Unsub 21617 15.51 19.98 13.18 31 TR_XM_BayesUnsub 20911 12.00 19.33 8.20 32 UNPARSEABLE_RELAY 20061 13.88 18.55 11.46 33 T_TM2_M_HEADER_IN_MSG 19922 20.90 18.42 22.19 34 TR_MAX_INTL_RELAY 16625 9.72 15.37 6.79 35 RELAYCOUNTRY_META 15924 7.65 14.72 3.98 36 XM_B_SpammyWords3 15641 9.34 14.46 6.69 37 TR_XM_SpammyWords2 13074 4.53 12.09 0.61 38 BOTNET_IPINHOSTNAME 12882 6.46 11.91 3.63 39 TR_XM_SpammyRelay 12001 5.37 11.09 2.40 40 TR_XM_UnparsRelay 10891 4.69 10.07 1.91 41 LOTS_OF_MONEY 10499 6.60 9.71 4.99 42 XM_Evil_Numbers_Gen 10086 9.70 9.32 9.89 43 BAYES_80 10058 5.96 9.30 4.24 44 TR_XM_SpammyWords4 9569 5.21 8.85 3.33 45 TooManyTo_001 9316 7.17 8.61 6.42 46 HTML_IMAGE_RATIO_02 9152 7.19 8.46 6.53 47 XM_B_PhoneNumber 8834 6.39 8.17 5.47 48 BAYES_60 8605 9.62 7.96 10.49 49 RCVD_IN_BL_SPAMCOP_NET 8512 3.26 7.87 0.87 50 XM_Body_Dirty_Words 8363 5.40 7.73 4.19 51 XM_B_Phish_Phrases 7982 5.96 7.38 5.22 52 BOTNET 7839 3.38 7.25 1.37 53 RELAYCOUNTRY_CA 7522 3.51 6.95 1.72 54 XMSubMetaSx_00 7471 5.84 6.91 5.29 55 FSL_BULK_SIG 7385 8.01 6.83 8.62 56 LotsOfNums_01 7177 7.28 6.63 7.62 57 TR_XM_SPAMCOP 6957 2.51 6.43 0.48 58 XM_H_Long_From01 6439 5.32 5.95 4.99 59 XMSexyCombo_05 6421 3.34 5.94 2.00 60 XM_UncommonTLD01 6412 4.85 5.93 4.29 61 MPART_ALT_DIFF 6383 6.57 5.90 6.92 62 BAYES_95 6195 3.63 5.73 2.55 63 XM_H_GMP 5258 5.22 4.86 5.40 64 TooManyTo_002 4999 2.27 4.62 1.06 65 XM_CamelCaseFrm001 4993 3.36 4.62 2.70 66 XM_B_SEO 4980 2.16 4.60 0.89 67 UNTRUSTED_Relay 4864 2.51 4.50 1.49 68 TR_XM_FormFill 4862 1.54 4.49 0.01 69 T_XMDrugObfuBody_14 4861 2.60 4.49 1.62 70 TR_XM_SEO4 4490 1.76 4.15 0.51 71 TR_XM_PhishingBody 4472 2.45 4.13 1.58 72 XM_SPF_SoftFail 4423 2.37 4.09 1.49 73 RCVD_IN_MSPIKE_WL 4421 4.35 4.09 4.49 74 RCVD_IN_MSPIKE_H3 4421 4.35 4.09 4.49 75 HTML_IMAGE_RATIO_04 4391 5.56 4.06 6.34 76 TM2_M_VERY_LONG_WORD 4387 2.36 4.06 1.49 77 XM_B_FormFill 4270 1.42 3.95 0.11 78 XMStrtUSub 4245 5.15 3.92 5.78 79 XM_Appointment_Request 4217 1.34 3.90 0.01 80 MIME_HTML_MOSTLY 4183 4.36 3.87 4.62 81 XM_B_SpammyTLD 3977 5.35 3.68 6.22 82 MIME_HTML_ONLY_MULTI 3815 3.14 3.53 2.95 83 XM_B_Investor 3797 1.83 3.51 0.95 84 HTML_IMAGE_RATIO_06 3669 3.18 3.39 3.07 85 RCVD_IN_VALIDITY_SAFE 3505 5.69 3.24 6.95 86 TR_XM_SpammyWords5 3439 2.20 3.18 1.70 87 DKIM_INVALID 3404 1.94 3.15 1.32 88 XMNumbers 3368 3.15 3.11 3.17 89 USER_IN_DEF_DKIM_WL 3233 13.56 2.99 19.04 90 T_XMDrugObfuBody_08 3213 2.25 2.97 1.87 91 RELAYCOUNTRY_AU 3117 1.52 2.88 0.82 92 XM_URI_RBL 2981 1.26 2.76 0.48 93 HTML_IMAGE_RATIO_08 2942 2.23 2.72 1.98 94 RCVD_IN_VALIDITY_CERTIFIED 2909 4.40 2.69 5.28 95 TM2_M_URI_OPT_OUT 2869 2.99 2.65 3.17 96 XMBody_17 2785 1.31 2.57 0.66 97 XM_B_Unsub2 2753 1.54 2.55 1.01 98 RCVD_IN_VALIDITY_RPBL 2695 1.05 2.49 0.30 99 FROM_EXCESS_BASE64 2660 2.45 2.46 2.44 100 XM_OfRef6 2624 1.23 2.43 0.61 101 T_XMHurry_00 2616 1.36 2.42 0.81 102 T_TooManySym_01 2448 4.91 2.26 6.28 103 XM_B_URI_Unicode 2402 1.98 2.22 1.85 104 XMBrknScrpt_02 2368 1.44 2.19 1.05 105 XMStockSpam_06 2356 1.70 2.18 1.46 106 TR_XM_NoHeaderRelay 2347 0.83 2.17 0.13 107 XM_B_SpammyWords4 2295 1.15 2.12 0.65 108 MIME_QP_LONG_LINE 2272 3.89 2.10 4.82 109 XMBdyGiftCard01 2222 1.73 2.05 1.57 110 SpammyFromTLD_02 2113 0.82 1.95 0.23 111 XM_UB50 2063 1.19 1.91 0.82 112 XM_ProductURIs 2027 1.70 1.87 1.61 113 T_FILL_THIS_FORM_SHORT 2001 0.97 1.85 0.51 114 XMDiploma_00 1961 1.37 1.81 1.14 115 MAILING_LIST_MULTI 1880 1.98 1.74 2.10 116 SpammyFromTLD_01 1874 0.92 1.73 0.50 117 XM_DK_Undo_01 1759 1.53 1.63 1.48 118 THIS_AD 1686 0.81 1.56 0.42 119 SHOPIFY_IMG_NOT_RCVD_SFY 1682 0.74 1.55 0.31 120 XMPhish30 1607 0.95 1.49 0.68 121 SUBJ_ALL_CAPS 1599 1.35 1.48 1.29 122 XM_SendGrid 1579 1.25 1.46 1.15 123 TR_MetaPhish_Combo_01 1557 1.01 1.44 0.79 124 LongTLD 1510 0.64 1.40 0.25 125 HTML_TAG_BALANCE_BODY 1451 0.91 1.34 0.68 126 URI_HEX 1429 1.15 1.32 1.05 127 TR_XM_PHPDW 1408 0.55 1.30 0.16 128 XMReplyNow 1408 0.57 1.30 0.19 129 TR_XM_PHPForged 1406 0.55 1.30 0.17 130 T_REMOTE_IMAGE 1401 2.35 1.30 2.90 131 TR_XM_FormFill2 1381 0.55 1.28 0.17 132 XMSubMetaI_00 1374 0.97 1.27 0.82 133 XM_B_REG_HTML 1372 0.60 1.27 0.25 134 XM_H_PHPOS 1360 0.53 1.26 0.16 135 ALL_TRUSTED 1324 12.28 1.22 18.00 136 BAYES_40 1298 3.24 1.20 4.30 137 T_STY_INVIS_DIRECT 1271 0.68 1.18 0.42 138 TR_Symld_Words 1270 1.54 1.17 1.73 139 XMClaimOffer 1269 0.68 1.17 0.43 140 TM2_M_OBFU_COMMENT 1263 0.80 1.17 0.61 141 XM_B_Phish66 1245 0.57 1.15 0.27 142 HK_RANDOM_REPLYTO 1227 0.53 1.13 0.21 143 XM_B_DNDMA 1226 0.97 1.13 0.88 144 DIET_1 1211 0.59 1.12 0.31 145 XMSexyCombo_01 1200 0.49 1.11 0.17 146 XM_H_Long_From02 1191 1.00 1.10 0.94 147 TR_XM_Base64_M1 1189 0.87 1.10 0.76 148 TR_LOTS_OF_MONEY3 1181 0.65 1.09 0.42 149 TR_Mismatch_TLD_02 1178 0.42 1.09 0.07 150 FROM_SUSPICIOUS_NTLD 1110 0.37 1.03 0.03 151 KHOP_HELO_FCRDNS 1109 1.11 1.03 1.15 152 RDNS_DYNAMIC 1092 0.57 1.01 0.34 153 MPART_ALT_DIFF_COUNT 1079 0.87 1.00 0.80 154 FROM_SUSPICIOUS_NTLD_FP 1078 0.36 1.00 0.02 155 PDS_RDNS_DYNAMIC_FP 1069 0.39 0.99 0.09 156 XM_B_COPY_HTML 1051 1.00 0.97 1.01 157 HOSTED_IMG_MULTI_PUB_01 1038 0.34 0.96 0.02 158 XM_HighProb1 1037 0.33 0.96 0.01 159 DKIM_ADSP_CUSTOM_MED 1020 0.89 0.94 0.87 160 TVD_RCVD_IP 1017 0.76 0.94 0.67 161 BAYES_20 1017 2.15 0.94 2.78 162 XMHTMLBadTable_001 1012 0.52 0.94 0.30 163 TR_XM_RelayPhish 998 0.36 0.92 0.07 164 T_XMDrugObfuBody_00 992 0.68 0.92 0.56 165 XM_UB99 991 0.32 0.92 0.01 166 HTTPS_HTTP_MISMATCH 984 0.63 0.91 0.48 167 TR_XM_DK_SendGrid 960 0.79 0.89 0.75 168 XMGenDplmaNmb 935 0.55 0.86 0.39 169 HELO_DYNAMIC_SPLIT_IP 917 0.32 0.85 0.04 170 XMPhish14 916 0.52 0.85 0.35 171 RCVD_IN_PBL 912 0.58 0.84 0.44 172 RCVD_IN_IADB_LISTED 911 2.11 0.84 2.77 173 TR_LOTS_OF_MONEY2 911 0.34 0.84 0.09 174 T_MONEY_PERCENT 911 0.34 0.84 0.09 175 TR_XM_BayesRelay 908 0.29 0.84 0.00 176 XMHTML_After_End 905 0.43 0.84 0.22 177 TR_XM_InvalidRelay 904 0.30 0.84 0.02 178 HTML_MIME_NO_HTML_TAG 891 1.13 0.82 1.29 179 RCVD_IN_XBL 880 0.29 0.81 0.02 180 TR_Mismatch_TLD_01 869 0.42 0.80 0.23 181 XM_S_SpammyWords 860 0.39 0.80 0.18 182 TR_XM_Spammywords 860 0.39 0.80 0.18 183 TR_XM_INV_DKIM 855 0.33 0.79 0.09 184 BAYES_00 854 5.40 0.79 7.78 185 NML_ADSP_CUSTOM_MED 852 0.70 0.79 0.66 186 XMPhish08 852 0.47 0.79 0.30 187 XMSubMetaSSx_00 849 0.45 0.78 0.28 188 URI_NOVOWEL 841 3.46 0.78 4.86 189 URI_TRY_3LD 838 0.64 0.77 0.56 190 XM_DIRTYINTL 836 0.31 0.77 0.06 191 FILL_THIS_FORM 801 0.33 0.74 0.11 192 PLING_QUERY 798 0.66 0.74 0.62 193 FORGED_GMAIL_RCVD 792 0.67 0.73 0.64 194 MIME_CHARSET_FARAWAY 791 0.49 0.73 0.37 195 RCVD_IN_IADB_SPF 776 1.89 0.72 2.49 196 TR_XM_DK_Bayes 761 4.66 0.70 6.70 197 LONGLN_LOW_CONTRAST 760 0.49 0.70 0.38 198 XM_OfRef7 756 0.30 0.70 0.09 199 XMSubMetaSxObfu_02 754 0.41 0.70 0.27 200 TR_XM_DK_Bayes1 753 4.63 0.70 6.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172648 87.27 96.11 82.69 2 RELAYCOUNTRY_US 163847 80.90 85.58 78.48 3 DKIM_SIGNED 159478 80.67 88.94 76.38 4 XM_DK_Pass 157661 79.26 86.50 75.51 5 DKIM_VALID 156731 78.73 85.80 75.07 6 XM_B_Unicode 150225 76.00 83.82 71.95 7 DKIM_VALID_AU 134605 65.68 68.02 64.47 8 BAYES_50 128826 52.95 36.06 61.70 9 XMListUnsubscribeExists 112177 59.89 71.78 53.73 10 DCC_CHECK_NEGATIVE 108418 42.97 25.67 51.93 11 DCC_CHECK 100326 56.86 73.87 48.05 12 XM_B_SpammyWords 96093 53.71 68.54 46.03 13 XM_B_Unicode3 95272 47.04 49.75 45.63 14 RCVD_IN_MSPIKE_H2 74354 36.70 38.81 35.61 15 LOC_TINY_FONT_1 68103 37.87 47.99 32.62 16 HTML_FONT_LOW_CONTRAST 67412 34.75 39.50 32.29 17 DKIM_VALID_EF 59095 27.71 26.57 28.30 18 FVGT_m_MULTI_ODD 50815 27.85 34.62 24.34 19 XM_Multi_Part_URI 46680 22.40 22.47 22.36 20 T_TM2_M_HEADER_IN_MSG 46329 20.90 18.42 22.19 21 XMSubLong 44253 21.00 20.62 21.20 22 XM_B_SpammyWords2 41994 26.55 38.97 20.11 23 MIME_HTML_ONLY 41228 23.64 31.15 19.75 24 T_KAM_HTML_FONT_INVALID 40894 22.85 29.16 19.59 25 USER_IN_DEF_DKIM_WL 39748 13.56 2.99 19.04 26 ALL_TRUSTED 37587 12.28 1.22 18.00 27 TR_XM_DK_Unsub 27527 15.51 19.98 13.18 28 UNPARSEABLE_RELAY 23928 13.88 18.55 11.46 29 XM_DKIMWhitelistDomains 22186 7.02 0.06 10.63 30 BAYES_60 21892 9.62 7.96 10.49 31 XM_Evil_Numbers_Gen 20649 9.70 9.32 9.89 32 XM_B_Unsub 20191 13.22 20.09 9.67 33 FSL_BULK_SIG 18005 8.01 6.83 8.62 34 TR_XM_BayesUnsub 17120 12.00 19.33 8.20 35 BAYES_00 16251 5.40 0.79 7.78 36 LotsOfNums_01 15911 7.28 6.63 7.62 37 RCVD_IN_VALIDITY_SAFE 14515 5.69 3.24 6.95 38 MPART_ALT_DIFF 14443 6.57 5.90 6.92 39 TR_MAX_INTL_RELAY 14169 9.72 15.37 6.79 40 TR_XM_DK_Bayes 13996 4.66 0.70 6.70 41 XM_B_SpammyWords3 13964 9.34 14.46 6.69 42 TR_XM_DK_Bayes1 13909 4.63 0.70 6.66 43 HTML_IMAGE_RATIO_02 13642 7.19 8.46 6.53 44 TooManyTo_001 13404 7.17 8.61 6.42 45 HTML_IMAGE_RATIO_04 13236 5.56 4.06 6.34 46 T_TooManySym_01 13110 4.91 2.26 6.28 47 XM_B_SpammyTLD 12986 5.35 3.68 6.22 48 XM_DK_Undo_02 12569 18.22 41.76 6.02 49 TR_XM_DK_Bayes2 12247 4.02 0.47 5.87 50 IN_ZIMBRA_NJ_WHITELIST 12103 3.84 0.07 5.80 51 XMStrtUSub 12070 5.15 3.92 5.78 52 XM_B_PhoneNumber 11420 6.39 8.17 5.47 53 XM_H_GMP 11273 5.22 4.86 5.40 54 XMSubMetaSx_00 11049 5.84 6.91 5.29 55 RCVD_IN_VALIDITY_CERTIFIED 11031 4.40 2.69 5.28 56 XM_B_Phish_Phrases 10908 5.96 7.38 5.22 57 XM_H_Long_From01 10425 5.32 5.95 4.99 58 LOTS_OF_MONEY 10422 6.60 9.71 4.99 59 URI_NOVOWEL 10141 3.46 0.78 4.86 60 MIME_QP_LONG_LINE 10060 3.89 2.10 4.82 61 BAYES_99 9681 15.65 36.91 4.64 62 MIME_HTML_MOSTLY 9651 4.36 3.87 4.62 63 RCVD_IN_MSPIKE_H3 9377 4.35 4.09 4.49 64 RCVD_IN_MSPIKE_WL 9377 4.35 4.09 4.49 65 BAYES_40 8977 3.24 1.20 4.30 66 XM_UncommonTLD01 8950 4.85 5.93 4.29 67 BAYES_80 8848 5.96 9.30 4.24 68 XM_Body_Dirty_Words 8758 5.40 7.73 4.19 69 RELAYCOUNTRY_META 8310 7.65 14.72 3.98 70 BOUNCE_MESSAGE 7722 2.63 0.56 3.70 71 ANY_BOUNCE_MESSAGE 7722 2.63 0.56 3.70 72 BOTNET_IPINHOSTNAME 7583 6.46 11.91 3.63 73 BAYES_999 7578 12.51 29.65 3.63 74 TR_XM_SpammyWords4 6952 5.21 8.85 3.33 75 T_TooManySym_02 6763 2.34 0.62 3.24 76 INVALID_MSGID 6664 2.17 0.18 3.19 77 XMNumbers 6622 3.15 3.11 3.17 78 TM2_M_URI_OPT_OUT 6618 2.99 2.65 3.17 79 HTML_IMAGE_RATIO_06 6416 3.18 3.39 3.07 80 TO_MALFORMED 6167 1.95 0.01 2.95 81 MIME_HTML_ONLY_MULTI 6149 3.14 3.53 2.95 82 T_REMOTE_IMAGE 6051 2.35 1.30 2.90 83 BAYES_20 5795 2.15 0.94 2.78 84 RCVD_IN_IADB_LISTED 5792 2.11 0.84 2.77 85 XM_CamelCaseFrm001 5643 3.36 4.62 2.70 86 TR_XM_DKIM_Undo 5325 11.83 29.75 2.55 87 BAYES_95 5316 3.63 5.73 2.55 88 RCVD_IN_IADB_SPF 5206 1.89 0.72 2.49 89 FROM_EXCESS_BASE64 5103 2.45 2.46 2.44 90 TR_XM_SpammyRelay 5009 5.37 11.09 2.40 91 RCVD_IN_IADB_SENDERID 4765 1.73 0.67 2.28 92 RCVD_IN_IADB_DK 4630 1.69 0.68 2.22 93 TR_DCC_Bayes_99 4413 9.54 23.89 2.11 94 MAILING_LIST_MULTI 4384 1.98 1.74 2.10 95 XMSexyCombo_05 4181 3.34 5.94 2.00 96 XM_PDF 4165 1.40 0.26 1.99 97 HTML_IMAGE_RATIO_08 4127 2.23 2.72 1.98 98 TR_XM_UnparsRelay 3983 4.69 10.07 1.91 99 XM_TLDProd2 3960 1.32 0.21 1.90 100 T_XMDrugObfuBody_08 3911 2.25 2.97 1.87 101 XM_B_URI_Unicode 3871 1.98 2.22 1.85 102 RCVD_IN_IADB_VOUCHED 3627 1.29 0.41 1.74 103 TR_Symld_Words 3610 1.54 1.17 1.73 104 RELAYCOUNTRY_CA 3589 3.51 6.95 1.72 105 TR_XM_SpammyWords5 3544 2.20 3.18 1.70 106 XMGappySubj_01 3410 1.13 0.15 1.63 107 IN_HORDE_ADDRESS_BOOK 3398 1.11 0.11 1.63 108 T_XMDrugObfuBody_14 3377 2.60 4.49 1.62 109 XM_ProductURIs 3364 1.70 1.87 1.61 110 TR_XM_PhishingBody 3305 2.45 4.13 1.58 111 XMBdyGiftCard01 3275 1.73 2.05 1.57 112 BAYES_05 3198 1.24 0.66 1.53 113 TVD_SPACE_RATIO 3181 1.04 0.11 1.52 114 TM2_M_VERY_LONG_WORD 3104 2.36 4.06 1.49 115 UNTRUSTED_Relay 3103 2.51 4.50 1.49 116 XM_SPF_SoftFail 3102 2.37 4.09 1.49 117 XM_DK_Undo_01 3096 1.53 1.63 1.48 118 XMStockSpam_06 3042 1.70 2.18 1.46 119 BOTNET 2869 3.38 7.25 1.37 120 XMGappySubj_02 2753 0.89 0.07 1.32 121 DKIM_INVALID 2747 1.94 3.15 1.32 122 HTML_MIME_NO_HTML_TAG 2696 1.13 0.82 1.29 123 SUBJ_ALL_CAPS 2692 1.35 1.48 1.29 124 RCVD_IN_IADB_OPTIN 2521 0.88 0.24 1.21 125 KHOP_HELO_FCRDNS 2410 1.11 1.03 1.15 126 T_TooManySym_03 2392 0.83 0.21 1.15 127 XM_SendGrid 2391 1.25 1.46 1.15 128 XMDiploma_00 2374 1.37 1.81 1.14 129 TooManyTo_002 2211 2.27 4.62 1.06 130 T_TVD_MIME_NO_HEADERS 2206 0.71 0.05 1.06 131 URI_HEX 2202 1.15 1.32 1.05 132 XMBrknScrpt_02 2200 1.44 2.19 1.05 133 XM_GoogleGroups 2153 0.88 0.59 1.03 134 XM_B_COPY_HTML 2115 1.00 0.97 1.01 135 XM_B_Unsub2 2113 1.54 2.55 1.01 136 XM_B_Investor 1993 1.83 3.51 0.95 137 XM_H_Long_From02 1968 1.00 1.10 0.94 138 LOW_PRICE 1961 0.76 0.41 0.94 139 XM_B_SEO 1851 2.16 4.60 0.89 140 XM_B_DNDMA 1838 0.97 1.13 0.88 141 RCVD_IN_BL_SPAMCOP_NET 1823 3.26 7.87 0.87 142 DKIM_ADSP_CUSTOM_MED 1815 0.89 0.94 0.87 143 XMBody_95 1800 0.75 0.52 0.86 144 HTML_EXTRA_CLOSE 1740 0.56 0.04 0.83 145 XMSubMetaI_00 1708 0.97 1.27 0.82 146 RELAYCOUNTRY_AU 1707 1.52 2.88 0.82 147 XM_UB50 1704 1.19 1.91 0.82 148 T_XMHurry_00 1691 1.36 2.42 0.81 149 MPART_ALT_DIFF_COUNT 1664 0.87 1.00 0.80 150 TR_MetaPhish_Combo_01 1641 1.01 1.44 0.79 151 TR_XM_Base64_M1 1578 0.87 1.10 0.76 152 TR_XM_DK_SendGrid 1556 0.79 0.89 0.75 153 TooManyTo_003 1544 0.72 0.67 0.74 154 USER_IN_WHITELIST 1466 0.46 0.00 0.70 155 USER_IN_WELCOMELIST 1466 0.46 0.00 0.70 156 HTML_TAG_BALANCE_BODY 1426 0.91 1.34 0.68 157 XMPhish30 1416 0.95 1.49 0.68 158 TVD_RCVD_IP 1405 0.76 0.94 0.67 159 XMBody_17 1382 1.31 2.57 0.66 160 NML_ADSP_CUSTOM_MED 1378 0.70 0.79 0.66 161 XM_B_SpammyWords4 1350 1.15 2.12 0.65 162 FORGED_GMAIL_RCVD 1336 0.67 0.73 0.64 163 PLING_QUERY 1286 0.66 0.74 0.62 164 TM2_M_OBFU_COMMENT 1276 0.80 1.17 0.61 165 XM_OfRef6 1270 1.23 2.43 0.61 166 TR_XM_SpammyWords2 1270 4.53 12.09 0.61 167 HTML_FONT_FACE_BAD 1244 0.63 0.69 0.60 168 HTML_TEXT_INVISIBLE_STYLE 1203 0.52 0.42 0.58 169 TooManyTo_004 1185 0.59 0.64 0.57 170 URI_TRY_3LD 1175 0.64 0.77 0.56 171 T_XMDrugObfuBody_00 1161 0.68 0.92 0.56 172 HTML_IMAGE_ONLY_20 1082 0.53 0.54 0.52 173 TR_XM_SEO4 1075 1.76 4.15 0.51 174 XM_H_PHPMailer 1069 0.53 0.55 0.51 175 T_FILL_THIS_FORM_SHORT 1061 0.97 1.85 0.51 176 SpammyFromTLD_01 1053 0.92 1.73 0.50 177 T_TooManySym_04 1039 0.35 0.06 0.50 178 XM_URI_RBL 1007 1.26 2.76 0.48 179 HTTPS_HTTP_MISMATCH 1003 0.63 0.91 0.48 180 TR_XM_SPAMCOP 1001 2.51 6.43 0.48 181 TooManyTo_005 999 0.53 0.62 0.48 182 XMBSHREFv2 987 0.39 0.22 0.47 183 RCVD_IN_PBL 925 0.58 0.84 0.44 184 XMNoVowels 897 0.43 0.44 0.43 185 XMClaimOffer 896 0.68 1.17 0.43 186 TR_LOTS_OF_MONEY3 879 0.65 1.09 0.42 187 HTML_TAG_BALANCE_CENTER 877 0.38 0.30 0.42 188 T_STY_INVIS_DIRECT 876 0.68 1.18 0.42 189 SUBJ_DOLLARS 876 0.46 0.53 0.42 190 THIS_AD 870 0.81 1.56 0.42 191 NO_DNS_FOR_FROM 852 0.48 0.61 0.41 192 XMLngstWrd_00 850 0.40 0.40 0.41 193 XMGenDplmaNmb 821 0.55 0.86 0.39 194 NUMERIC_HTTP_ADDR 817 0.29 0.10 0.39 195 LONGLN_LOW_CONTRAST 787 0.49 0.70 0.38 196 XM_S_SubURI 787 0.27 0.05 0.38 197 MIME_CHARSET_FARAWAY 773 0.49 0.73 0.37 198 DKIM_ADSP_NXDOMAIN 767 0.47 0.66 0.37 199 MAY_BE_FORGED 756 0.24 0.01 0.36 200 XMPhish14 725 0.52 0.85 0.35 ----------------------------------------------------------------------