Email: 361856 Autolearn: 0 AvgScore: 2.53 AvgScanTime: 2.88 sec Spam: 105596 Autolearn: 0 AvgScore: 12.17 AvgScanTime: 3.27 sec Ham: 256260 Autolearn: 0 AvgScore: -1.44 AvgScanTime: 2.72 sec Time Spent Running SA: 289.84 hours Time Spent Processing Spam: 95.91 hours Time Spent Processing Ham: 193.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86432 83.09 81.85 83.60 2 DCC_CHECK 69655 54.78 65.96 50.17 3 DKIM_SIGNED 68323 74.69 64.70 78.80 4 XM_DK_Pass 66701 73.55 63.17 77.83 5 DKIM_VALID 63478 70.73 60.11 75.11 6 XMListUnsubscribeExists 60687 56.92 57.47 56.69 7 DKIM_VALID_AU 54788 57.95 51.88 60.45 8 BAYES_50 54675 52.52 51.78 52.82 9 XM_H_QuotedFrom 45501 40.62 43.09 39.61 10 DCC_CHECK_NEGATIVE 35032 44.22 33.18 48.77 11 LOC_TINY_FONT_1 33795 29.30 32.00 28.18 12 MIME_HTML_ONLY 33435 24.97 31.66 22.22 13 STYLE_GIBBERISH 32442 33.50 30.72 34.64 14 HTML_FONT_LOW_CONTRAST 31915 32.66 30.22 33.66 15 XM_DK_Undo_02 30839 15.74 29.20 10.20 16 BOTNET 28696 10.14 27.18 3.12 17 RELAYCOUNTRY_META 27079 11.11 25.64 5.12 18 XM_Evil_Numbers_Gen 26043 13.77 24.66 9.28 19 XMSubLong 24612 22.92 23.31 22.76 20 BAYES_99 24527 12.62 23.23 8.24 21 FVGT_m_MULTI_ODD 23319 21.64 22.08 21.46 22 XM_Multi_Part_URI 23185 16.82 21.96 14.70 23 LOTS_OF_MONEY 21638 12.30 20.49 8.93 24 UNTRUSTED_Relay 20781 6.71 19.68 1.36 25 BAYES_999 20436 10.61 19.35 7.01 26 TR_DCC_Bayes_99 19983 9.38 18.92 5.44 27 HTML_IMAGE_RATIO_02 18989 13.65 17.98 11.86 28 RCVD_IN_RP_RNBL 18530 5.38 17.55 0.37 29 T_TM2_M_HEADER_IN_MSG 17489 22.06 16.56 24.32 30 XM_Body_Dirty_Words 17113 14.70 16.21 14.08 31 DKIM_VALID_EF 16212 25.13 15.35 29.16 32 ANY_BOUNCE_MESSAGE 15145 7.26 14.34 4.34 33 BOUNCE_MESSAGE 15145 7.26 14.34 4.34 34 T_KAM_HTML_FONT_INVALID 15092 14.20 14.29 14.17 35 TR_LOTS_OF_MONEY3 14768 4.39 13.99 0.43 36 FROM_EXCESS_BASE64 14747 8.04 13.97 5.60 37 FSL_BULK_SIG 13702 9.64 12.98 8.26 38 BOTNET_IPINHOSTNAME 13131 8.89 12.44 7.43 39 MultiRelay 12232 13.18 11.58 13.83 40 XMSexyCombo_05 11800 7.35 11.17 5.78 41 HTML_MIME_NO_HTML_TAG 10011 3.70 9.48 1.32 42 XM_UB50 9554 3.09 9.05 0.63 43 XMSubMetaSx_00 9476 6.86 8.97 5.99 44 MISSING_HEADERS 9078 2.79 8.60 0.39 45 T_REMOTE_IMAGE 8724 4.86 8.26 3.46 46 MPART_ALT_DIFF 8676 5.04 8.22 3.73 47 HTML_IMAGE_RATIO_04 8514 7.26 8.06 6.93 48 XMNumbers 8104 5.61 7.67 4.75 49 BAYES_60 8043 6.03 7.62 5.37 50 T_XMDrugObfuBody_14 7290 7.14 6.90 7.23 51 TooManyTo_001 7268 6.11 6.88 5.79 52 BAYES_80 7202 4.25 6.82 3.19 53 XM_UncommonTLD01 6938 4.76 6.57 4.02 54 BODY_URI_ONLY 6895 1.93 6.53 0.04 55 XM_H_Long_From01 6838 6.22 6.48 6.11 56 HTML_SHORT_LINK_IMG_1 6811 1.91 6.45 0.04 57 HTML_IMAGE_ONLY_04 6761 1.89 6.40 0.03 58 XM_B_Phish_Phrases 6171 6.98 5.84 7.45 59 RELAYCOUNTRY_DE 6134 1.88 5.81 0.27 60 MIME_HEADER_CTYPE_ONLY 5758 1.69 5.45 0.14 61 LotsOfNums_01 5237 6.67 4.96 7.38 62 HTML_SHORT_CENTER 4997 1.38 4.73 0.00 63 XM_UB60 4895 1.39 4.64 0.06 64 SpammyFromTLD_02 4845 1.46 4.59 0.18 65 DKIM_INVALID 4845 3.96 4.59 3.69 66 XMStrtUSub 4326 5.14 4.10 5.57 67 MIME_HTML_MOSTLY 4216 3.58 3.99 3.41 68 UNPARSEABLE_RELAY 4034 4.23 3.82 4.40 69 BOTNET_NORDNS 3983 1.11 3.77 0.02 70 XM_DIRTYINTL 3925 2.36 3.72 1.81 71 RCVD_IN_RP_SAFE 3893 11.47 3.69 14.68 72 URI_HEX 3761 2.45 3.56 1.99 73 XM_ShortIntro_01 3701 1.35 3.50 0.46 74 HK_RANDOM_FROM 3681 1.19 3.49 0.25 75 MIME_HTML_ONLY_MULTI 3672 1.87 3.48 1.21 76 TM2_M_URI_OPT_OUT 3569 2.16 3.38 1.66 77 RELAYCOUNTRY_CN 3560 1.01 3.37 0.04 78 HTML_IMAGE_RATIO_06 3514 3.72 3.33 3.88 79 BAYES_95 3514 2.49 3.33 2.15 80 REPLYTO_WITHOUT_TO_CC 3250 0.99 3.08 0.12 81 HELO_NODOT 3238 1.40 3.07 0.71 82 RELAYCOUNTRY_CA 3125 2.16 2.96 1.83 83 XM_UB80 3092 0.87 2.93 0.02 84 XM_CamelCaseFrm001 3054 1.98 2.89 1.60 85 BAYES_40 2903 4.30 2.75 4.94 86 RCVD_IN_RP_CERTIFIED 2876 9.98 2.72 12.97 87 XM_SendGrid 2787 4.69 2.64 5.54 88 TVD_SPACE_RATIO_MINFP 2741 0.77 2.60 0.01 89 XMSubMetaI_00 2635 1.19 2.50 0.65 90 MultiRelay_CC 2583 0.81 2.45 0.13 91 MultiRelay_Combo 2583 0.81 2.45 0.13 92 RCVD_IN_MSPIKE_H2 2525 4.06 2.39 4.75 93 XM_SPF_SoftFail 2462 1.94 2.33 1.77 94 HTML_IMAGE_RATIO_08 2296 2.28 2.17 2.32 95 DIET_1 2295 0.98 2.17 0.49 96 XM_OfRef6 2260 1.66 2.14 1.46 97 RELAYCOUNTRY_FR 2206 0.74 2.09 0.19 98 XMSexyCombo_01 2171 2.07 2.06 2.08 99 XMDiploma_00 2140 1.47 2.03 1.25 100 BAYES_20 2110 2.81 2.00 3.14 101 T_XMDrugObfuBody_08 2078 1.44 1.97 1.22 102 RELAYCOUNTRY_GB 2076 0.92 1.97 0.48 103 SpammyFromTLD_01 2043 0.81 1.93 0.35 104 T_XMDrugObfuBody_00 2025 1.06 1.92 0.70 105 RELAYCOUNTRY_TR 1969 0.59 1.86 0.06 106 SUBJ_ALL_CAPS 1934 1.41 1.83 1.24 107 XM_URI_RBL 1846 0.90 1.75 0.54 108 T_TooManySym_01 1807 6.38 1.71 8.31 109 LOW_PRICE 1750 0.55 1.66 0.10 110 RCVD_IN_BL_SPAMCOP_NET 1701 0.64 1.61 0.24 111 MIME_QP_LONG_LINE 1647 3.26 1.56 3.96 112 RELAYCOUNTRY_IN 1589 0.48 1.50 0.06 113 XMPhish30 1554 0.84 1.47 0.58 114 XMBdyGiftCard01 1518 1.97 1.44 2.19 115 URIBL_DBL_SPAM 1495 0.46 1.42 0.07 116 T_XMHurry_00 1486 0.88 1.41 0.66 117 XM_H_Long_From02 1461 1.05 1.38 0.91 118 URIBL_BLACK 1432 0.46 1.36 0.09 119 BODY_ENHANCEMENT 1422 0.42 1.35 0.04 120 BAYES_00 1392 13.29 1.32 18.22 121 XMGenDplmaNmb 1373 0.81 1.30 0.61 122 DATE_IN_PAST_06_12 1328 0.41 1.26 0.07 123 RELAYCOUNTRY_AT 1318 0.61 1.25 0.35 124 ALL_TRUSTED 1303 11.67 1.23 15.97 125 XMBody_17 1238 0.84 1.17 0.71 126 XMStockSpam_06 1236 1.48 1.17 1.61 127 BAYES_05 1230 1.70 1.16 1.92 128 RDNS_DYNAMIC 1218 0.67 1.15 0.47 129 SUBJ_DOLLARS 1208 0.79 1.14 0.64 130 XM_B_REG_HTML 1199 0.99 1.14 0.93 131 RCVD_IN_IADB_LISTED 1148 2.99 1.09 3.78 132 FILL_THIS_FORM 1127 0.70 1.07 0.56 133 FSL_THIS_IS_ADV 1113 0.33 1.05 0.03 134 XMSexyCombo_04 1094 0.98 1.04 0.96 135 XMPhish11 1085 1.00 1.03 0.99 136 XM_UB95 1076 0.30 1.02 0.01 137 MAILING_LIST_MULTI 1075 1.75 1.02 2.05 138 FILL_THIS_FORM_LONG 1071 0.65 1.01 0.51 139 TR_Mismatch_TLD_02 1071 0.34 1.01 0.06 140 SHORTENER_SHORT_IMG 1052 0.29 1.00 0.00 141 URI_BUFFLY 1047 0.29 0.99 0.00 142 XMHTMLBadTable_001 1042 0.95 0.99 0.93 143 XM_UB99 1012 0.29 0.96 0.01 144 XM_ProductURIs 1008 1.53 0.95 1.77 145 DATE_IN_PAST_03_06 1003 0.33 0.95 0.08 146 TR_XM_RelayPhish 1002 0.56 0.95 0.40 147 HTML_FONT_FACE_BAD 1001 0.66 0.95 0.54 148 TR_XM_DK_Bayes 999 10.80 0.95 14.86 149 XM_H_PHPOS 959 0.95 0.91 0.96 150 TR_XM_DK_Bayes1 950 10.55 0.90 14.53 151 RCVD_IN_PSBL 923 0.31 0.87 0.08 152 FILL_THIS_FORM_LOAN 912 0.60 0.86 0.49 153 T_HTML_TAG_BALANCE_CENTER 912 0.35 0.86 0.14 154 RCVD_IN_IADB_SPF 904 2.59 0.86 3.31 155 URI_TRY_3LD 894 1.45 0.85 1.70 156 XM_Body_Obfu01 856 0.31 0.81 0.10 157 TR_XM_DK_Bayes2 855 9.45 0.81 13.01 158 RCVD_IN_IADB_SENDERID 845 2.33 0.80 2.96 159 TM2_M_VERY_LONG_WORD 845 0.84 0.80 0.85 160 XM_DK_Undo_01 844 1.28 0.80 1.47 161 MPART_ALT_DIFF_COUNT 843 0.37 0.80 0.20 162 XM_B_COPY_HTML 837 0.66 0.79 0.61 163 XM_RXBody 835 0.48 0.79 0.35 164 URIBL_DBL_ABUSE_REDIR 827 0.24 0.78 0.01 165 RCVD_IN_IADB_DK 825 2.27 0.78 2.88 166 XMSubMetaSxObfu_03 815 0.59 0.77 0.51 167 RCVD_IN_IADB_VOUCHED 792 1.94 0.75 2.43 168 FROM_SUSPICIOUS_NTLD 785 0.26 0.74 0.06 169 XMBody_78 780 0.58 0.74 0.52 170 DKIM_ADSP_CUSTOM_MED 778 0.84 0.74 0.88 171 LongTLD 778 0.36 0.74 0.21 172 RCVD_IN_MSPIKE_WL 776 1.63 0.73 2.00 173 RCVD_IN_MSPIKE_H3 763 1.63 0.72 2.00 174 XMSlimDrugH 737 0.37 0.70 0.24 175 NML_ADSP_CUSTOM_MED 726 0.64 0.69 0.62 176 T_FILL_THIS_FORM_SHORT 720 0.62 0.68 0.59 177 TR_Symld_Words 719 1.29 0.68 1.55 178 XMSubMetaSSx_00 703 0.38 0.67 0.26 179 NO_DNS_FOR_FROM 687 0.62 0.65 0.61 180 TR_LOTS_OF_MONEY2 675 0.43 0.64 0.35 181 T_MONEY_PERCENT 675 0.43 0.64 0.35 182 URI_NOVOWEL 662 0.42 0.63 0.33 183 PLING_QUERY 656 0.83 0.62 0.91 184 T_Symld_Words_02 655 0.75 0.62 0.80 185 XMPhish14 653 0.37 0.62 0.27 186 XM_XX_Yahoo 648 0.22 0.61 0.06 187 XM_H_PHPMailer 626 0.70 0.59 0.74 188 XM_UB999 621 0.18 0.59 0.01 189 XMMoneyMeta_00 612 0.41 0.58 0.34 190 XMSubMetaI_01 608 0.19 0.58 0.04 191 FORGED_GMAIL_RCVD 604 0.47 0.57 0.43 192 PP_MIME_FAKE_ASCII_TEXT 600 0.27 0.57 0.15 193 LONG_HEX_URI 597 0.25 0.57 0.11 194 RCVD_IN_IADB_OPTIN 596 1.25 0.56 1.53 195 DKIM_ADSP_NXDOMAIN 596 0.64 0.56 0.67 196 RELAYCOUNTRY_NL 595 0.60 0.56 0.62 197 XM_S_JOY_D 580 0.33 0.55 0.24 198 XMSubMetaSSxObfu_04 576 0.19 0.55 0.05 199 URIBL_ABUSE_SURBL 561 0.18 0.53 0.04 200 XMBrknScrpt_02 557 0.79 0.53 0.90 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 214243 83.09 81.85 83.60 2 DKIM_SIGNED 201943 74.69 64.70 78.80 3 XM_DK_Pass 199440 73.55 63.17 77.83 4 DKIM_VALID 192475 70.73 60.11 75.11 5 DKIM_VALID_AU 154898 57.95 51.88 60.45 6 XMListUnsubscribeExists 145267 56.92 57.47 56.69 7 BAYES_50 135356 52.52 51.78 52.82 8 DCC_CHECK 128560 54.78 65.96 50.17 9 DCC_CHECK_NEGATIVE 124966 44.22 33.18 48.77 10 XM_H_QuotedFrom 101493 40.62 43.09 39.61 11 STYLE_GIBBERISH 88769 33.50 30.72 34.64 12 HTML_FONT_LOW_CONTRAST 86252 32.66 30.22 33.66 13 DKIM_VALID_EF 74714 25.13 15.35 29.16 14 LOC_TINY_FONT_1 72215 29.30 32.00 28.18 15 T_TM2_M_HEADER_IN_MSG 62327 22.06 16.56 24.32 16 XMSubLong 58331 22.92 23.31 22.76 17 MIME_HTML_ONLY 56933 24.97 31.66 22.22 18 FVGT_m_MULTI_ODD 54985 21.64 22.08 21.46 19 BAYES_00 46695 13.29 1.32 18.22 20 ALL_TRUSTED 40918 11.67 1.23 15.97 21 XM_DKIMWhitelistDomains 40685 11.25 0.02 15.88 22 TR_XM_DK_Bayes 38078 10.80 0.95 14.86 23 XM_Multi_Part_URI 37683 16.82 21.96 14.70 24 RCVD_IN_RP_SAFE 37611 11.47 3.69 14.68 25 TR_XM_DK_Bayes1 37222 10.55 0.90 14.53 26 T_KAM_HTML_FONT_INVALID 36304 14.20 14.29 14.17 27 XM_Body_Dirty_Words 36073 14.70 16.21 14.08 28 MultiRelay 35443 13.18 11.58 13.83 29 TR_XM_DK_Bayes2 33327 9.45 0.81 13.01 30 RCVD_IN_RP_CERTIFIED 33240 9.98 2.72 12.97 31 HTML_IMAGE_RATIO_02 30387 13.65 17.98 11.86 32 XM_DK_Undo_02 26133 15.74 29.20 10.20 33 XM_Evil_Numbers_Gen 23789 13.77 24.66 9.28 34 LOTS_OF_MONEY 22886 12.30 20.49 8.93 35 T_TooManySym_01 21286 6.38 1.71 8.31 36 FSL_BULK_SIG 21168 9.64 12.98 8.26 37 BAYES_99 21123 12.62 23.23 8.24 38 XM_B_Phish_Phrases 19085 6.98 5.84 7.45 39 BOTNET_IPINHOSTNAME 19031 8.89 12.44 7.43 40 LotsOfNums_01 18907 6.67 4.96 7.38 41 T_XMDrugObfuBody_14 18537 7.14 6.90 7.23 42 BAYES_999 17975 10.61 19.35 7.01 43 HTML_IMAGE_RATIO_04 17762 7.26 8.06 6.93 44 XM_H_Long_From01 15652 6.22 6.48 6.11 45 XMSubMetaSx_00 15362 6.86 8.97 5.99 46 TooManyTo_001 14833 6.11 6.88 5.79 47 XMSexyCombo_05 14803 7.35 11.17 5.78 48 FROM_EXCESS_BASE64 14360 8.04 13.97 5.60 49 XMStrtUSub 14275 5.14 4.10 5.57 50 XM_SendGrid 14185 4.69 2.64 5.54 51 TO_MALFORMED 13951 3.87 0.07 5.44 52 TR_DCC_Bayes_99 13946 9.38 18.92 5.44 53 BAYES_60 13769 6.03 7.62 5.37 54 RELAYCOUNTRY_META 13127 11.11 25.64 5.12 55 BAYES_40 12660 4.30 2.75 4.94 56 RCVD_IN_MSPIKE_H2 12184 4.06 2.39 4.75 57 XMNumbers 12179 5.61 7.67 4.75 58 UNPARSEABLE_RELAY 11275 4.23 3.82 4.40 59 ANY_BOUNCE_MESSAGE 11133 7.26 14.34 4.34 60 BOUNCE_MESSAGE 11132 7.26 14.34 4.34 61 TVD_RCVD_IP 10945 3.15 0.43 4.27 62 XM_UncommonTLD01 10293 4.76 6.57 4.02 63 MIME_QP_LONG_LINE 10138 3.26 1.56 3.96 64 HTML_IMAGE_RATIO_06 9947 3.72 3.33 3.88 65 RCVD_IN_IADB_LISTED 9676 2.99 1.09 3.78 66 MPART_ALT_DIFF 9564 5.04 8.22 3.73 67 DKIM_INVALID 9468 3.96 4.59 3.69 68 T_REMOTE_IMAGE 8867 4.86 8.26 3.46 69 MIME_HTML_MOSTLY 8747 3.58 3.99 3.41 70 RCVD_IN_IADB_SPF 8484 2.59 0.86 3.31 71 IN_ZIMBRA_NJ_WHITELIST 8463 2.34 0.01 3.30 72 BAYES_80 8172 4.25 6.82 3.19 73 BAYES_20 8058 2.81 2.00 3.14 74 BOTNET 7986 10.14 27.18 3.12 75 RCVD_IN_IADB_SENDERID 7576 2.33 0.80 2.96 76 RCVD_IN_IADB_DK 7388 2.27 0.78 2.88 77 INVALID_MSGID 6951 1.98 0.19 2.71 78 RCVD_IN_IADB_VOUCHED 6227 1.94 0.75 2.43 79 HTML_IMAGE_RATIO_08 5937 2.28 2.17 2.32 80 T_TooManySym_02 5875 1.77 0.49 2.29 81 XMBdyGiftCard01 5606 1.97 1.44 2.19 82 BAYES_95 5504 2.49 3.33 2.15 83 XMSexyCombo_01 5337 2.07 2.06 2.08 84 MAILING_LIST_MULTI 5259 1.75 1.02 2.05 85 RCVD_IN_MSPIKE_WL 5132 1.63 0.73 2.00 86 RCVD_IN_MSPIKE_H3 5118 1.63 0.72 2.00 87 URI_HEX 5097 2.45 3.56 1.99 88 TR_MetaPhish_Combo_01 5032 1.48 0.32 1.96 89 BAYES_05 4923 1.70 1.16 1.92 90 IN_HORDE_ADDRESS_BOOK 4879 1.35 0.02 1.90 91 RELAYCOUNTRY_CA 4683 2.16 2.96 1.83 92 XM_DIRTYINTL 4628 2.36 3.72 1.81 93 XM_SPF_SoftFail 4544 1.94 2.33 1.77 94 XM_ProductURIs 4531 1.53 0.95 1.77 95 XM_PDF 4500 1.31 0.22 1.76 96 URI_TRY_3LD 4350 1.45 0.85 1.70 97 USER_IN_DEF_DKIM_WL 4281 1.19 0.01 1.67 98 TM2_M_URI_OPT_OUT 4245 2.16 3.38 1.66 99 XMStockSpam_06 4122 1.48 1.17 1.61 100 XM_CamelCaseFrm001 4099 1.98 2.89 1.60 101 TR_Symld_Words 3966 1.29 0.68 1.55 102 RCVD_IN_IADB_OPTIN 3921 1.25 0.56 1.53 103 XM_DK_Undo_01 3770 1.28 0.80 1.47 104 XM_OfRef6 3738 1.66 2.14 1.46 105 UNTRUSTED_Relay 3489 6.71 19.68 1.36 106 HTML_MIME_NO_HTML_TAG 3385 3.70 9.48 1.32 107 XM_GoogleGroups 3372 1.06 0.45 1.32 108 XMDiploma_00 3192 1.47 2.03 1.25 109 SUBJ_ALL_CAPS 3171 1.41 1.83 1.24 110 T_XMDrugObfuBody_08 3127 1.44 1.97 1.22 111 TooManyTo_002 3124 0.99 0.42 1.22 112 MIME_HTML_ONLY_MULTI 3107 1.87 3.48 1.21 113 XMBody_95 2672 0.75 0.05 1.04 114 XMPhish11 2525 1.00 1.03 0.99 115 XM_H_PHPOS 2470 0.95 0.91 0.96 116 XMSexyCombo_04 2449 0.98 1.04 0.96 117 XMHTMLBadTable_001 2392 0.95 0.99 0.93 118 XM_B_REG_HTML 2382 0.99 1.14 0.93 119 XM_H_Long_From02 2338 1.05 1.38 0.91 120 PLING_QUERY 2332 0.83 0.62 0.91 121 TooManyTo_003 2306 0.74 0.34 0.90 122 XMBrknScrpt_02 2296 0.79 0.53 0.90 123 DKIM_ADSP_CUSTOM_MED 2255 0.84 0.74 0.88 124 USER_IN_WHITELIST 2198 0.61 0.00 0.86 125 TM2_M_VERY_LONG_WORD 2189 0.84 0.80 0.85 126 T_TooManySym_03 2085 0.64 0.20 0.81 127 T_Symld_Words_02 2059 0.75 0.62 0.80 128 XMNoVowels 2028 0.64 0.27 0.79 129 TooManyTo_004 1924 0.61 0.28 0.75 130 XM_H_PHPMailer 1890 0.70 0.59 0.74 131 HELO_NODOT 1816 1.40 3.07 0.71 132 XMBody_17 1813 0.84 1.17 0.71 133 T_XMDrugObfuBody_00 1800 1.06 1.92 0.70 134 XMSubMetaSxObfu_02 1796 0.60 0.36 0.70 135 DKIM_ADSP_NXDOMAIN 1727 0.64 0.56 0.67 136 T_XMHurry_00 1685 0.88 1.41 0.66 137 TooManyTo_005 1669 0.53 0.25 0.65 138 XMSubMetaI_00 1665 1.19 2.50 0.65 139 SUBJ_DOLLARS 1643 0.79 1.14 0.64 140 XM_UB50 1616 3.09 9.05 0.63 141 RELAYCOUNTRY_NL 1590 0.60 0.56 0.62 142 NML_ADSP_CUSTOM_MED 1589 0.64 0.69 0.62 143 XMGenDplmaNmb 1572 0.81 1.30 0.61 144 XM_B_COPY_HTML 1568 0.66 0.79 0.61 145 NO_DNS_FOR_FROM 1552 0.62 0.65 0.61 146 T_FILL_THIS_FORM_SHORT 1515 0.62 0.68 0.59 147 XMPhish30 1495 0.84 1.47 0.58 148 XM_shorewaves_Whitelist 1493 0.41 0.00 0.58 149 FILL_THIS_FORM 1424 0.70 1.07 0.56 150 TM2_M_A_HREF_HREF 1395 0.48 0.32 0.54 151 XM_URI_RBL 1394 0.90 1.75 0.54 152 HTML_FONT_FACE_BAD 1378 0.66 0.95 0.54 153 XMBody_78 1321 0.58 0.74 0.52 154 XMSubMetaSxObfu_03 1311 0.59 0.77 0.51 155 XMLngstWrd_00 1303 0.46 0.35 0.51 156 FILL_THIS_FORM_LONG 1297 0.65 1.01 0.51 157 DIET_1 1267 0.98 2.17 0.49 158 XMHTML_After_End 1257 0.50 0.51 0.49 159 FILL_THIS_FORM_LOAN 1257 0.60 0.86 0.49 160 XM_H_PHPOS_M 1253 0.48 0.47 0.49 161 RELAYCOUNTRY_GB 1242 0.92 1.97 0.48 162 RDNS_DYNAMIC 1209 0.67 1.15 0.47 163 T_TooManySym_04 1205 0.34 0.02 0.47 164 XM_ShortIntro_01 1173 1.35 3.50 0.46 165 XMLngstWrd_01 1147 0.41 0.32 0.45 166 XMBSHREFv2 1130 0.39 0.28 0.44 167 TR_LOTS_OF_MONEY3 1109 4.39 13.99 0.43 168 XM_Walgreens_Forge 1101 0.31 0.03 0.43 169 FORGED_GMAIL_RCVD 1090 0.47 0.57 0.43 170 HTML_TAG_BALANCE_BODY 1086 0.45 0.51 0.42 171 TR_XM_RelayPhish 1028 0.56 0.95 0.40 172 RELAYCOUNTRY_AU 1013 0.38 0.36 0.40 173 MISSING_HEADERS 1007 2.79 8.60 0.39 174 XMCapTrack 997 0.32 0.15 0.39 175 RCVD_IN_RP_RNBL 951 5.38 17.55 0.37 176 RELAYCOUNTRY_AT 896 0.61 1.25 0.35 177 SpammyFromTLD_01 894 0.81 1.93 0.35 178 HTTPS_HTTP_MISMATCH 892 0.39 0.50 0.35 179 XM_RXBody 890 0.48 0.79 0.35 180 TR_LOTS_OF_MONEY2 887 0.43 0.64 0.35 181 T_MONEY_PERCENT 887 0.43 0.64 0.35 182 XMClaimOffer 885 0.35 0.37 0.35 183 XM_Akamai 872 0.25 0.02 0.34 184 XMMoneyMeta_00 864 0.41 0.58 0.34 185 XMLKML 844 0.23 0.00 0.33 186 URI_NOVOWEL 841 0.42 0.63 0.33 187 XMLngstWrd_02 778 0.27 0.20 0.30 188 XMRcvdHeader_15 763 0.21 0.00 0.30 189 XMSolicitRefs_0 713 0.29 0.32 0.28 190 XM_H_SpoofStaff4 712 0.20 0.02 0.28 191 XMPhish14 689 0.37 0.62 0.27 192 RELAYCOUNTRY_DE 686 1.88 5.81 0.27 193 XMDateMe_00 680 0.22 0.12 0.27 194 XMSUPPORT 665 0.18 0.00 0.26 195 T_OBFU_PDF_ATTACH 658 0.20 0.06 0.26 196 XMSubMetaSSx_00 656 0.38 0.67 0.26 197 XM_OfRef7 650 0.30 0.40 0.25 198 FROM_EGROUPS 650 0.18 0.00 0.25 199 HK_RANDOM_FROM 642 1.19 3.49 0.25 200 RCVD_IN_BL_SPAMCOP_NET 622 0.64 1.61 0.24 ----------------------------------------------------------------------