Email: 330830 Autolearn: 0 AvgScore: 2.48 AvgScanTime: 2.09 sec Spam: 94376 Autolearn: 0 AvgScore: 12.18 AvgScanTime: 2.37 sec Ham: 236454 Autolearn: 0 AvgScore: -1.39 AvgScanTime: 1.97 sec Time Spent Running SA: 191.77 hours Time Spent Processing Spam: 62.19 hours Time Spent Processing Ham: 129.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86384 87.38 91.53 85.72 2 DKIM_SIGNED 75897 80.64 80.42 80.72 3 XM_DK_Pass 74478 79.54 78.92 79.79 4 XMListUnsubscribeExists 73034 64.26 77.39 59.02 5 DCC_CHECK 69944 57.17 74.11 50.40 6 DKIM_VALID 69366 75.61 73.50 76.45 7 DKIM_VALID_AU 59279 62.82 62.81 62.83 8 XM_H_QuotedFrom 49666 44.13 52.63 40.74 9 XM_DK_Undo_02 46682 29.29 49.46 21.23 10 BAYES_99 39965 25.76 42.35 19.13 11 HTML_FONT_LOW_CONTRAST 36141 36.05 38.29 35.15 12 BAYES_999 34263 22.79 36.30 17.39 13 MIME_HTML_ONLY 33252 26.64 35.23 23.21 14 LOC_TINY_FONT_1 33216 32.94 35.20 32.03 15 TR_DCC_Bayes_99 31725 17.18 33.62 10.63 16 BAYES_50 26486 40.77 28.06 45.84 17 FVGT_m_MULTI_ODD 24555 22.35 26.02 20.89 18 DCC_CHECK_NEGATIVE 23358 41.70 24.75 48.47 19 RELAYCOUNTRY_META 22415 9.44 23.75 3.73 20 XM_Body_Dirty_Words 21224 16.60 22.49 14.26 21 XMSubLong 20765 22.84 22.00 23.17 22 BOTNET_IPINHOSTNAME 20132 12.11 21.33 8.44 23 BOTNET 19790 7.66 20.97 2.35 24 DKIM_VALID_EF 17235 26.13 18.26 29.28 25 UNTRUSTED_Relay 16718 5.83 17.71 1.08 26 T_KAM_HTML_FONT_INVALID 16503 14.90 17.49 13.86 27 T_TM2_M_HEADER_IN_MSG 16045 21.03 17.00 22.64 28 XM_Multi_Part_URI 15717 14.84 16.65 14.12 29 HTML_IMAGE_RATIO_02 15428 13.54 16.35 12.42 30 MultiRelay 14680 14.58 15.55 14.19 31 XM_Evil_Numbers_Gen 12580 11.90 13.33 11.33 32 XMSexyCombo_05 11972 6.98 12.69 4.70 33 HTML_IMAGE_RATIO_04 10331 8.19 10.95 7.08 34 FSL_BULK_SIG 9838 8.74 10.42 8.07 35 LOTS_OF_MONEY 9572 8.96 10.14 8.49 36 RELAYCOUNTRY_FR 9391 2.94 9.95 0.15 37 HTML_MIME_NO_HTML_TAG 9123 3.88 9.67 1.57 38 DKIM_ADSP_NXDOMAIN 9114 3.19 9.66 0.60 39 XMSubMetaSx_00 8448 5.52 8.95 4.16 40 XM_H_Long_From01 7757 7.11 8.22 6.67 41 BAYES_80 7480 5.08 7.93 3.94 42 TooManyTo_001 7403 6.61 7.84 6.11 43 XM_B_Phish_Phrases 6861 8.41 7.27 8.86 44 DKIM_INVALID 6531 5.03 6.92 4.27 45 T_XMDrugObfuBody_14 6518 8.46 6.91 9.08 46 MPART_ALT_DIFF 5935 4.53 6.29 3.82 47 LotsOfNums_01 5915 7.82 6.27 8.44 48 XM_DIRTYINTL 5700 3.30 6.04 2.20 49 BAYES_60 5552 6.10 5.88 6.19 50 XM_UncommonTLD01 5453 4.66 5.78 4.22 51 FROM_EXCESS_BASE64 5409 5.95 5.73 6.04 52 RCVD_IN_RP_SAFE 5365 14.11 5.68 17.48 53 XMStrtUSub 5290 6.11 5.61 6.31 54 MIME_HTML_MOSTLY 4730 3.72 5.01 3.21 55 XM_UB50 4567 1.79 4.84 0.58 56 XMBdyGiftCard01 4191 2.81 4.44 2.16 57 BAYES_00 4097 11.13 4.34 13.84 58 HTML_IMAGE_RATIO_06 4010 3.68 4.25 3.45 59 RELAYCOUNTRY_CA 3986 2.20 4.22 1.39 60 BAYES_40 3921 3.55 4.15 3.30 61 RCVD_IN_RP_CERTIFIED 3821 12.70 4.05 16.16 62 RCVD_IN_BL_SPAMCOP_NET 3684 1.37 3.90 0.36 63 BAYES_95 3475 3.05 3.68 2.80 64 XM_SendGrid 3451 5.76 3.66 6.61 65 XMNumbers 3403 3.55 3.61 3.52 66 SUBJ_ALL_CAPS 3353 2.20 3.55 1.66 67 MIME_HTML_ONLY_MULTI 3335 2.65 3.53 2.29 68 URI_HEX 3320 2.46 3.52 2.04 69 XMDiploma_00 3316 2.19 3.51 1.67 70 HTML_IMAGE_RATIO_08 3311 2.91 3.51 2.67 71 T_TooManySym_01 3068 6.50 3.25 7.80 72 XMSubMetaSxObfu_03 2850 1.17 3.02 0.43 73 NO_DNS_FOR_FROM 2828 1.88 3.00 1.43 74 XM_SPF_SoftFail 2761 1.60 2.93 1.07 75 XM_CamelCaseFrm001 2761 1.98 2.93 1.60 76 T_REMOTE_IMAGE 2583 2.91 2.74 2.98 77 XMBrknScrpt_02 2565 1.38 2.72 0.84 78 MultiRelay_CC 2447 0.83 2.59 0.13 79 MultiRelay_Combo 2447 0.83 2.59 0.13 80 TR_XM_PHPDW 2420 1.29 2.56 0.78 81 TR_XM_PHPForged 2379 1.27 2.52 0.77 82 TR_XM_FormFill2 2352 1.25 2.49 0.76 83 XM_H_PHPOS 2337 1.25 2.48 0.76 84 TM2_M_URI_OPT_OUT 2337 1.97 2.48 1.77 85 XMSexyCombo_01 2322 1.15 2.46 0.63 86 XM_OfRef6 2267 1.76 2.40 1.51 87 RCVD_IN_MSPIKE_H2 2266 4.18 2.40 4.90 88 MIME_QP_LONG_LINE 2188 3.75 2.32 4.32 89 DIET_1 2153 0.99 2.28 0.48 90 XM_UB99 2086 0.66 2.21 0.04 91 BAYES_20 2080 2.48 2.20 2.59 92 XMGappySubj_01 1979 0.73 2.10 0.19 93 RCVD_IN_RP_RNBL 1975 0.64 2.09 0.06 94 ALL_TRUSTED 1939 10.72 2.05 14.18 95 SpammyFromTLD_02 1909 0.74 2.02 0.22 96 T_XMHurry_00 1869 1.31 1.98 1.04 97 XM_UB999 1804 0.57 1.91 0.03 98 XM_URI_RBL 1787 1.05 1.89 0.71 99 XMGappySubj_02 1775 0.58 1.88 0.06 100 XMGenDplmaNmb 1761 1.05 1.87 0.72 101 XMBody_17 1759 0.89 1.86 0.50 102 XM_UB60 1686 0.57 1.79 0.08 103 FROM_DOMAIN_NOVOWEL 1681 0.53 1.78 0.04 104 TR_XM_DK_SendGrid 1675 3.08 1.77 3.61 105 TR_Mismatch_TLD_02 1606 0.54 1.70 0.08 106 UNPARSEABLE_RELAY 1584 4.64 1.68 5.83 107 BOTNET_NORDNS 1574 0.48 1.67 0.01 108 T_Symld_Words_02 1567 1.06 1.66 0.81 109 XMStockSpam_06 1522 1.99 1.61 2.14 110 XM_H_Long_From02 1455 1.14 1.54 0.98 111 FILL_THIS_FORM 1381 0.89 1.46 0.66 112 RELAYCOUNTRY_DE 1376 0.60 1.46 0.26 113 BODY_ENHANCEMENT 1375 0.46 1.46 0.06 114 T_XMDrugObfuBody_08 1367 1.34 1.45 1.30 115 TR_Caps_n_Bayes_80 1359 0.49 1.44 0.11 116 XM_H_PHPMailer 1353 0.83 1.43 0.59 117 XM_B_REG_HTML 1327 0.92 1.41 0.73 118 FILL_THIS_FORM_LONG 1325 0.83 1.40 0.60 119 URIBL_BLACK 1287 0.44 1.36 0.07 120 MAILING_LIST_MULTI 1286 1.67 1.36 1.79 121 XMGppyBdWords 1283 0.56 1.36 0.24 122 XMHTMLBadTable_001 1281 0.82 1.36 0.61 123 XMPhish11 1255 1.23 1.33 1.19 124 XM_Lotto 1237 0.42 1.31 0.06 125 XMPhish30 1235 0.82 1.31 0.63 126 TM2_M_VERY_LONG_WORD 1235 1.39 1.31 1.42 127 XMSexyCombo_04 1214 0.43 1.29 0.09 128 FILL_THIS_FORM_LOAN 1213 0.79 1.29 0.60 129 RCVD_IN_IADB_LISTED 1204 2.98 1.28 3.66 130 XM_ProductURIs 1198 0.87 1.27 0.72 131 XMSubMetaI_00 1110 0.60 1.18 0.37 132 RELAYCOUNTRY_AR 1101 0.33 1.17 0.00 133 RELAYCOUNTRY_IN 1096 0.36 1.16 0.05 134 BAYES_05 1091 1.75 1.16 1.99 135 XM_H_PHPOS_M 1080 0.53 1.14 0.28 136 URI_TRY_3LD 1076 1.55 1.14 1.71 137 TR_XM_RelayPhish 1074 1.00 1.14 0.95 138 BODY_URI_ONLY 1070 0.34 1.13 0.03 139 RELAYCOUNTRY_AT 1029 0.46 1.09 0.21 140 NUMERIC_HTTP_ADDR 1011 0.58 1.07 0.39 141 LONG_JUNK_URI 994 0.37 1.05 0.10 142 SpammyFromTLD_01 981 0.53 1.04 0.32 143 MONEY_FRAUD_8 981 0.30 1.04 0.00 144 RCVD_IN_IADB_SPF 979 2.64 1.04 3.28 145 ADVANCE_FEE_5_NEW_MONEY 967 0.29 1.02 0.00 146 XMSubMetaSSx_00 946 0.40 1.00 0.16 147 SUBJ_DOLLARS 931 0.49 0.99 0.30 148 XMMoneyMeta_00 915 0.47 0.97 0.27 149 NORMAL_HTTP_TO_IP 912 0.34 0.97 0.09 150 XM_B_COPY_HTML 897 0.75 0.95 0.67 151 RCVD_IN_IADB_SENDERID 894 2.40 0.95 2.98 152 XMSubMetaD_03 890 0.54 0.94 0.38 153 RCVD_IN_IADB_DK 878 2.34 0.93 2.90 154 DKIM_ADSP_CUSTOM_MED 862 0.87 0.91 0.85 155 XM_RXBody 859 0.53 0.91 0.37 156 XM_UB80 857 0.28 0.91 0.02 157 XMBody_78 856 0.58 0.91 0.45 158 URIBL_DBL_SPAM 842 0.26 0.89 0.01 159 MSGID_FROM_MTA_HEADER 813 0.37 0.86 0.17 160 THIS_AD 808 0.33 0.86 0.12 161 NML_ADSP_CUSTOM_MED 806 0.63 0.85 0.54 162 RELAYCOUNTRY_CN 794 0.28 0.84 0.06 163 XMSlimDrugH 773 0.47 0.82 0.33 164 RCVD_IN_IADB_VOUCHED 773 1.78 0.82 2.16 165 T_FILL_THIS_FORM_SHORT 766 0.98 0.81 1.05 166 FROM_ILLEGAL_CHARS 740 0.22 0.78 0.00 167 TR_Symld_Words 732 1.17 0.78 1.33 168 XMHTML_After_End 707 0.44 0.75 0.31 169 FROM_SUSPICIOUS_NTLD 702 0.25 0.74 0.06 170 TR_MetaPhish_Combo_01 699 1.91 0.74 2.38 171 DATE_IN_PAST_06_12 691 0.24 0.73 0.04 172 RDNS_DYNAMIC 682 0.60 0.72 0.56 173 TR_Caps_n_Bayes_99 681 0.38 0.72 0.25 174 RELAYCOUNTRY_GB 661 0.54 0.70 0.48 175 MPART_ALT_DIFF_COUNT 657 0.40 0.70 0.28 176 FORGED_GMAIL_RCVD 649 0.49 0.69 0.41 177 T_MONEY_PERCENT 642 0.31 0.68 0.16 178 TR_LOTS_OF_MONEY2 642 0.31 0.68 0.16 179 T_TooManySym_02 635 1.83 0.67 2.29 180 HTML_TAG_BALANCE_BODY 629 0.61 0.67 0.59 181 XM_HighProb1 621 0.20 0.66 0.02 182 TVD_RCVD_IP 619 4.05 0.66 5.40 183 URI_NOVOWEL 589 0.43 0.62 0.35 184 DATE_IN_PAST_03_06 585 0.24 0.62 0.08 185 HK_RANDOM_REPLYTO 583 0.31 0.62 0.19 186 HTML_FONT_FACE_BAD 577 0.63 0.61 0.64 187 SHORT_URI_3 570 0.32 0.60 0.21 188 TooManyTo_002 566 1.15 0.60 1.37 189 XMPhish14 565 0.39 0.60 0.31 190 FVGT_m_MULTI_ODD_EMAIL 563 0.20 0.60 0.04 191 PLING_QUERY 561 0.76 0.59 0.83 192 T_XMDrugObfuBody_00 555 0.69 0.59 0.73 193 RCVD_IN_IADB_OPTIN 551 1.16 0.58 1.38 194 XM_DK_Undo_01 527 1.28 0.56 1.57 195 TVD_SPACE_RATIO_MINFP 513 0.16 0.54 0.01 196 HTML_TITLE_SUBJ_DIFF 503 0.22 0.53 0.10 197 LongTLD 498 0.30 0.53 0.21 198 PP_MIME_FAKE_ASCII_TEXT 490 0.30 0.52 0.21 199 SHORT_URI_2 477 0.23 0.51 0.12 200 XM_Combo_Sbj 468 0.25 0.50 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 202692 87.38 91.53 85.72 2 DKIM_SIGNED 190869 80.64 80.42 80.72 3 XM_DK_Pass 188678 79.54 78.92 79.79 4 DKIM_VALID 180773 75.61 73.50 76.45 5 DKIM_VALID_AU 148562 62.82 62.81 62.83 6 XMListUnsubscribeExists 139563 64.26 77.39 59.02 7 DCC_CHECK 119179 57.17 74.11 50.40 8 DCC_CHECK_NEGATIVE 114604 41.70 24.75 48.47 9 BAYES_50 108388 40.77 28.06 45.84 10 XM_H_QuotedFrom 96331 44.13 52.63 40.74 11 HTML_FONT_LOW_CONTRAST 83116 36.05 38.29 35.15 12 LOC_TINY_FONT_1 75744 32.94 35.20 32.03 13 DKIM_VALID_EF 69227 26.13 18.26 29.28 14 MIME_HTML_ONLY 54872 26.64 35.23 23.21 15 XMSubLong 54794 22.84 22.00 23.17 16 T_TM2_M_HEADER_IN_MSG 53543 21.03 17.00 22.64 17 XM_DK_Undo_02 50204 29.29 49.46 21.23 18 FVGT_m_MULTI_ODD 49392 22.35 26.02 20.89 19 BAYES_99 45242 25.76 42.35 19.13 20 XM_DKIMWhitelistDomains 41740 12.69 0.24 17.65 21 RCVD_IN_RP_SAFE 41329 14.11 5.68 17.48 22 BAYES_999 41122 22.79 36.30 17.39 23 RCVD_IN_RP_CERTIFIED 38203 12.70 4.05 16.16 24 XM_Body_Dirty_Words 33710 16.60 22.49 14.26 25 MultiRelay 33553 14.58 15.55 14.19 26 ALL_TRUSTED 33537 10.72 2.05 14.18 27 XM_Multi_Part_URI 33383 14.84 16.65 14.12 28 T_KAM_HTML_FONT_INVALID 32776 14.90 17.49 13.86 29 BAYES_00 32732 11.13 4.34 13.84 30 HTML_IMAGE_RATIO_02 29373 13.54 16.35 12.42 31 TR_XM_DK_Bayes 29140 8.94 0.47 12.32 32 TR_XM_DK_Bayes1 28078 8.60 0.38 11.87 33 XM_Evil_Numbers_Gen 26782 11.90 13.33 11.33 34 TR_XM_DK_Bayes2 26297 8.05 0.36 11.12 35 TR_DCC_Bayes_99 25125 17.18 33.62 10.63 36 T_XMDrugObfuBody_14 21462 8.46 6.91 9.08 37 XM_B_Phish_Phrases 20956 8.41 7.27 8.86 38 LOTS_OF_MONEY 20068 8.96 10.14 8.49 39 LotsOfNums_01 19966 7.82 6.27 8.44 40 BOTNET_IPINHOSTNAME 19946 12.11 21.33 8.44 41 FSL_BULK_SIG 19088 8.74 10.42 8.07 42 T_TooManySym_01 18450 6.50 3.25 7.80 43 HTML_IMAGE_RATIO_04 16748 8.19 10.95 7.08 44 XM_H_Long_From01 15767 7.11 8.22 6.67 45 XM_SendGrid 15619 5.76 3.66 6.61 46 XMStrtUSub 14918 6.11 5.61 6.31 47 BAYES_60 14642 6.10 5.88 6.19 48 TooManyTo_001 14458 6.61 7.84 6.11 49 FROM_EXCESS_BASE64 14289 5.95 5.73 6.04 50 UNPARSEABLE_RELAY 13780 4.64 1.68 5.83 51 TO_MALFORMED 13632 4.12 0.00 5.77 52 TVD_RCVD_IP 12768 4.05 0.66 5.40 53 RCVD_IN_MSPIKE_H2 11576 4.18 2.40 4.90 54 XMSexyCombo_05 11125 6.98 12.69 4.70 55 MIME_QP_LONG_LINE 10207 3.75 2.32 4.32 56 IN_ZIMBRA_NJ_WHITELIST 10132 3.07 0.01 4.28 57 DKIM_INVALID 10096 5.03 6.92 4.27 58 XM_UncommonTLD01 9968 4.66 5.78 4.22 59 XMSubMetaSx_00 9828 5.52 8.95 4.16 60 BAYES_80 9319 5.08 7.93 3.94 61 MPART_ALT_DIFF 9037 4.53 6.29 3.82 62 RELAYCOUNTRY_META 8826 9.44 23.75 3.73 63 RCVD_IN_IADB_LISTED 8653 2.98 1.28 3.66 64 TR_XM_DK_SendGrid 8529 3.08 1.77 3.61 65 RCVD_IN_MSPIKE_H3 8365 2.64 0.40 3.54 66 RCVD_IN_MSPIKE_WL 8365 2.64 0.40 3.54 67 XMNumbers 8329 3.55 3.61 3.52 68 HTML_IMAGE_RATIO_06 8169 3.68 4.25 3.45 69 BAYES_40 7813 3.55 4.15 3.30 70 RCVD_IN_IADB_SPF 7751 2.64 1.04 3.28 71 MIME_HTML_MOSTLY 7580 3.72 5.01 3.21 72 INVALID_MSGID 7263 2.26 0.22 3.07 73 T_REMOTE_IMAGE 7050 2.91 2.74 2.98 74 RCVD_IN_IADB_SENDERID 7048 2.40 0.95 2.98 75 RCVD_IN_IADB_DK 6853 2.34 0.93 2.90 76 BAYES_95 6617 3.05 3.68 2.80 77 HTML_IMAGE_RATIO_08 6321 2.91 3.51 2.67 78 BAYES_20 6124 2.48 2.20 2.59 79 TR_MetaPhish_Combo_01 5622 1.91 0.74 2.38 80 BOTNET 5552 7.66 20.97 2.35 81 MIME_HTML_ONLY_MULTI 5421 2.65 3.53 2.29 82 T_TooManySym_02 5405 1.83 0.67 2.29 83 XM_DIRTYINTL 5203 3.30 6.04 2.20 84 RCVD_IN_IADB_VOUCHED 5103 1.78 0.82 2.16 85 XMBdyGiftCard01 5099 2.81 4.44 2.16 86 XMStockSpam_06 5070 1.99 1.61 2.14 87 IN_HORDE_ADDRESS_BOOK 4840 1.48 0.05 2.05 88 URI_HEX 4826 2.46 3.52 2.04 89 BAYES_05 4697 1.75 1.16 1.99 90 XM_PDF 4667 1.47 0.22 1.97 91 USER_IN_DEF_DKIM_WL 4660 1.41 0.01 1.97 92 MAILING_LIST_MULTI 4235 1.67 1.36 1.79 93 TM2_M_URI_OPT_OUT 4182 1.97 2.48 1.77 94 URI_TRY_3LD 4049 1.55 1.14 1.71 95 XMDiploma_00 3939 2.19 3.51 1.67 96 SUBJ_ALL_CAPS 3931 2.20 3.55 1.66 97 XM_CamelCaseFrm001 3792 1.98 2.93 1.60 98 HTML_MIME_NO_HTML_TAG 3714 3.88 9.67 1.57 99 XM_DK_Undo_01 3713 1.28 0.56 1.57 100 ANY_BOUNCE_MESSAGE 3629 1.17 0.24 1.53 101 BOUNCE_MESSAGE 3629 1.17 0.24 1.53 102 XM_OfRef6 3570 1.76 2.40 1.51 103 NO_DNS_FOR_FROM 3392 1.88 3.00 1.43 104 TM2_M_VERY_LONG_WORD 3350 1.39 1.31 1.42 105 RELAYCOUNTRY_CA 3294 2.20 4.22 1.39 106 RCVD_IN_IADB_OPTIN 3272 1.16 0.58 1.38 107 TooManyTo_002 3238 1.15 0.60 1.37 108 TR_Symld_Words 3134 1.17 0.78 1.33 109 T_XMDrugObfuBody_08 3069 1.34 1.45 1.30 110 XM_GoogleGroups 3022 1.04 0.43 1.28 111 XMPhish11 2820 1.23 1.33 1.19 112 XMBody_95 2604 0.86 0.27 1.10 113 UNTRUSTED_Relay 2557 5.83 17.71 1.08 114 XM_SPF_SoftFail 2530 1.60 2.93 1.07 115 T_FILL_THIS_FORM_SHORT 2485 0.98 0.81 1.05 116 T_XMHurry_00 2458 1.31 1.98 1.04 117 XM_H_Long_From02 2316 1.14 1.54 0.98 118 USER_IN_WHITELIST 2253 0.68 0.00 0.95 119 TR_XM_RelayPhish 2243 1.00 1.14 0.95 120 XMSubMetaSxObfu_02 2151 0.78 0.46 0.91 121 TooManyTo_003 2141 0.79 0.49 0.91 122 DKIM_ADSP_CUSTOM_MED 2019 0.87 0.91 0.85 123 XMBrknScrpt_02 1995 1.38 2.72 0.84 124 PLING_QUERY 1964 0.76 0.59 0.83 125 T_Symld_Words_02 1926 1.06 1.66 0.81 126 TR_XM_PHPDW 1842 1.29 2.56 0.78 127 TR_XM_PHPForged 1815 1.27 2.52 0.77 128 TR_XM_FormFill2 1794 1.25 2.49 0.76 129 XM_H_PHPOS 1792 1.25 2.48 0.76 130 TooManyTo_004 1779 0.66 0.42 0.75 131 XMLngstWrd_00 1756 0.63 0.36 0.74 132 HTML_SHORT_CENTER 1747 0.54 0.03 0.74 133 T_XMDrugObfuBody_00 1732 0.69 0.59 0.73 134 XM_B_REG_HTML 1723 0.92 1.41 0.73 135 XMGenDplmaNmb 1711 1.05 1.87 0.72 136 XM_ProductURIs 1694 0.87 1.27 0.72 137 XM_URI_RBL 1680 1.05 1.89 0.71 138 XMLngstWrd_01 1658 0.60 0.34 0.70 139 T_TooManySym_03 1635 0.52 0.10 0.69 140 XM_B_COPY_HTML 1596 0.75 0.95 0.67 141 TooManyTo_005 1563 0.57 0.35 0.66 142 FILL_THIS_FORM 1555 0.89 1.46 0.66 143 HTML_FONT_FACE_BAD 1519 0.63 0.61 0.64 144 XMSexyCombo_01 1485 1.15 2.46 0.63 145 XMPhish30 1478 0.82 1.31 0.63 146 HELO_NODOT 1474 0.54 0.32 0.62 147 XMHTMLBadTable_001 1444 0.82 1.36 0.61 148 DKIM_ADSP_NXDOMAIN 1426 3.19 9.66 0.60 149 FILL_THIS_FORM_LONG 1419 0.83 1.40 0.60 150 FILL_THIS_FORM_LOAN 1411 0.79 1.29 0.60 151 HTML_TAG_BALANCE_BODY 1401 0.61 0.67 0.59 152 XM_H_PHPMailer 1384 0.83 1.43 0.59 153 HELO_NO_DOMAIN 1381 0.51 0.32 0.58 154 XM_UB50 1369 1.79 4.84 0.58 155 RDNS_DYNAMIC 1319 0.60 0.72 0.56 156 NML_ADSP_CUSTOM_MED 1284 0.63 0.85 0.54 157 XMBSHREFv2 1193 0.50 0.49 0.50 158 XMBody_17 1179 0.89 1.86 0.50 159 DIET_1 1137 0.99 2.28 0.48 160 RELAYCOUNTRY_GB 1129 0.54 0.70 0.48 161 XMLngstWrd_02 1112 0.43 0.32 0.47 162 XMSubNoVowel 1082 0.45 0.43 0.46 163 XMBody_78 1073 0.58 0.91 0.45 164 XMCapTrack 1059 0.36 0.15 0.45 165 TM2_M_A_HREF_HREF 1052 0.45 0.45 0.44 166 XMSubMetaSxObfu_03 1017 1.17 3.02 0.43 167 FORGED_GMAIL_RCVD 979 0.49 0.69 0.41 168 XMLngstWrd_03 948 0.37 0.30 0.40 169 XM_Walgreens_Forge 920 0.33 0.19 0.39 170 T_TooManySym_04 914 0.28 0.02 0.39 171 NUMERIC_HTTP_ADDR 913 0.58 1.07 0.39 172 XMSubMetaD_03 890 0.54 0.94 0.38 173 XM_RXBody 882 0.53 0.91 0.37 174 XM_Akamai 876 0.27 0.03 0.37 175 HTTPS_HTTP_MISMATCH 875 0.32 0.21 0.37 176 XMNoVowels 874 0.36 0.35 0.37 177 XMSubMetaI_00 871 0.60 1.18 0.37 178 RCVD_IN_BL_SPAMCOP_NET 860 1.37 3.90 0.36 179 URI_NOVOWEL 825 0.43 0.62 0.35 180 XMSolicitRefs_0 807 0.33 0.31 0.34 181 XMLngstWrd_04 802 0.32 0.26 0.34 182 XM_Body_Obfu01 791 0.31 0.27 0.33 183 XMSlimDrugH 780 0.47 0.82 0.33 184 XMRcvdHeader_15 772 0.23 0.00 0.33 185 SpammyFromTLD_01 763 0.53 1.04 0.32 186 XMHTML_After_End 744 0.44 0.75 0.31 187 XMPhish14 741 0.39 0.60 0.31 188 RELAYCOUNTRY_AU 735 0.32 0.35 0.31 189 XM_H_SpoofStaff4 715 0.23 0.06 0.30 190 XM_ShortIntro_01 703 0.30 0.31 0.30 191 SUBJ_DOLLARS 701 0.49 0.99 0.30 192 XMSUPPORT 685 0.21 0.00 0.29 193 FSL_THIS_IS_ADV 679 0.28 0.27 0.29 194 XM_S_JOY_D 679 0.28 0.28 0.29 195 XMDateMe_00 669 0.25 0.17 0.28 196 XM_OverStock_LProb 663 0.21 0.02 0.28 197 MPART_ALT_DIFF_COUNT 662 0.40 0.70 0.28 198 XM_H_PHPOS_M 661 0.53 1.14 0.28 199 FROM_EGROUPS 652 0.20 0.01 0.28 200 XMMoneyMeta_00 643 0.47 0.97 0.27 ----------------------------------------------------------------------