Email: 342274 Autolearn: 0 AvgScore: 2.59 AvgScanTime: 2.15 sec Spam: 99177 Autolearn: 0 AvgScore: 12.66 AvgScanTime: 2.45 sec Ham: 243097 Autolearn: 0 AvgScore: -1.52 AvgScanTime: 2.03 sec Time Spent Running SA: 204.56 hours Time Spent Processing Spam: 67.40 hours Time Spent Processing Ham: 137.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 91467 87.04 92.23 84.93 2 DKIM_SIGNED 79387 80.23 80.05 80.30 3 DCC_CHECK 78532 55.47 79.18 45.80 4 XM_DK_Pass 77425 78.85 78.07 79.16 5 XMListUnsubscribeExists 75869 62.66 76.50 57.01 6 DKIM_VALID 74003 75.56 74.62 75.94 7 DKIM_VALID_AU 61514 60.14 62.02 59.38 8 XM_H_QuotedFrom 51800 43.04 52.23 39.29 9 XM_DK_Undo_02 47398 28.16 47.79 20.15 10 HTML_FONT_LOW_CONTRAST 41739 35.98 42.09 33.49 11 BAYES_99 41130 25.13 41.47 18.46 12 LOC_TINY_FONT_1 36508 30.44 36.81 27.84 13 BAYES_999 35137 22.09 35.43 16.65 14 BAYES_50 34208 43.79 34.49 47.58 15 TR_DCC_Bayes_99 32260 15.74 32.53 8.88 16 MIME_HTML_ONLY 32114 25.16 32.38 22.22 17 FVGT_m_MULTI_ODD 24659 23.60 24.86 23.09 18 XM_Body_Dirty_Words 24162 17.23 24.36 14.32 19 XMSubLong 23835 23.80 24.03 23.70 20 BOTNET_IPINHOSTNAME 21710 12.11 21.89 8.12 21 RELAYCOUNTRY_META 20256 8.70 20.42 3.91 22 T_KAM_HTML_FONT_INVALID 20098 17.34 20.26 16.15 23 DKIM_VALID_EF 19435 27.53 19.60 30.77 24 DCC_CHECK_NEGATIVE 19360 43.45 19.52 53.21 25 BOTNET 19350 7.17 19.51 2.13 26 T_TM2_M_HEADER_IN_MSG 16941 22.27 17.08 24.39 27 HTML_IMAGE_RATIO_02 16647 12.44 16.79 10.67 28 XM_Multi_Part_URI 16032 15.22 16.17 14.84 29 UNTRUSTED_Relay 14389 5.09 14.51 1.25 30 XM_Evil_Numbers_Gen 13682 10.22 13.80 8.76 31 MultiRelay 13247 15.21 13.36 15.97 32 FSL_BULK_SIG 12641 9.47 12.75 8.13 33 LOTS_OF_MONEY 12515 10.98 12.62 10.32 34 XMSexyCombo_05 10583 6.26 10.67 4.46 35 XM_UncommonTLD01 10224 5.86 10.31 4.05 36 HTML_IMAGE_RATIO_04 9324 7.53 9.40 6.76 37 XM_H_Long_From01 9089 7.35 9.16 6.62 38 TooManyTo_001 8847 6.98 8.92 6.19 39 MPART_ALT_DIFF 8691 5.43 8.76 4.08 40 XM_UB50 7417 2.65 7.48 0.68 41 T_XMDrugObfuBody_14 7280 7.76 7.34 7.93 42 XM_B_Phish_Phrases 7235 7.48 7.30 7.55 43 XMSubMetaSx_00 7170 5.83 7.23 5.26 44 BAYES_80 6586 4.87 6.64 4.15 45 MIME_HTML_MOSTLY 6334 3.89 6.39 2.87 46 SpammyFromTLD_02 6214 1.95 6.27 0.18 47 LotsOfNums_01 5776 7.75 5.82 8.54 48 DKIM_ADSP_NXDOMAIN 5469 2.09 5.51 0.70 49 RCVD_IN_RP_SAFE 5426 11.74 5.47 14.30 50 BAYES_60 5409 5.81 5.45 5.95 51 DKIM_INVALID 5384 4.67 5.43 4.36 52 HTML_MIME_NO_HTML_TAG 5348 2.87 5.39 1.84 53 FROM_EXCESS_BASE64 5300 5.21 5.34 5.16 54 XM_DIRTYINTL 4992 3.39 5.03 2.72 55 XMBdyGiftCard01 4913 2.47 4.95 1.46 56 XM_CamelCaseFrm001 4813 2.68 4.85 1.80 57 RELAYCOUNTRY_FR 4810 1.55 4.85 0.21 58 HTML_IMAGE_RATIO_06 4682 3.93 4.72 3.60 59 HTML_IMAGE_RATIO_08 4662 2.93 4.70 2.21 60 XM_OfRef6 4484 2.30 4.52 1.39 61 BAYES_95 4363 3.36 4.40 2.94 62 URI_HEX 4321 2.81 4.36 2.18 63 RELAYCOUNTRY_CA 4154 2.24 4.19 1.44 64 RCVD_IN_RP_CERTIFIED 4056 10.47 4.09 13.08 65 MIME_HTML_ONLY_MULTI 3939 2.60 3.97 2.04 66 SUBJ_ALL_CAPS 3924 2.62 3.96 2.07 67 T_TooManySym_01 3869 6.69 3.90 7.83 68 PDS_TO_EQ_FROM_NAME 3835 1.14 3.87 0.03 69 URIBL_DBL_ABUSE_REDIR 3822 1.14 3.85 0.03 70 XMStrtUSub 3673 4.55 3.70 4.89 71 XMSubMetaI_00 3504 1.62 3.53 0.84 72 FROM_SUSPICIOUS_NTLD 3319 1.00 3.35 0.05 73 FILL_THIS_FORM 3143 1.38 3.17 0.64 74 XM_SendGrid 3129 6.15 3.15 7.37 75 FILL_THIS_FORM_LONG 3039 1.30 3.06 0.58 76 TR_Symld_Words 3000 2.26 3.02 1.94 77 BAYES_20 2818 2.56 2.84 2.44 78 T_REMOTE_IMAGE 2802 3.84 2.83 4.26 79 XMNumbers 2794 2.75 2.82 2.72 80 NORDNS_LOW_CONTRAST 2725 0.80 2.75 0.00 81 XM_E_Blogspot 2723 0.88 2.75 0.12 82 HK_SCAM 2703 0.80 2.73 0.01 83 XMDiploma_00 2648 1.81 2.67 1.45 84 TR_XM_PHPDW 2643 1.22 2.66 0.63 85 XM_SPF_SoftFail 2642 1.68 2.66 1.27 86 XM_OfRef7 2630 0.88 2.65 0.16 87 TR_XM_PHPForged 2607 1.20 2.63 0.61 88 TR_XM_FormFill2 2588 1.19 2.61 0.61 89 XM_H_PHPOS 2572 1.18 2.59 0.60 90 MIME_QP_LONG_LINE 2553 4.14 2.57 4.78 91 TM2_M_URI_OPT_OUT 2483 1.80 2.50 1.51 92 MONEY_FRAUD_8 2479 0.73 2.50 0.00 93 RELAYCOUNTRY_NL 2458 0.80 2.48 0.12 94 XMSexyCombo_01 2416 1.35 2.44 0.91 95 XMSubGiftCard1 2356 0.79 2.38 0.15 96 RCVD_IN_RP_RNBL 2351 0.71 2.37 0.03 97 MONEY_FORM 2333 0.68 2.35 0.00 98 BAYES_40 2326 3.24 2.35 3.61 99 XM_Nigeria_01 2293 0.70 2.31 0.05 100 ADVANCE_FEE_5_NEW_FRM_MNY 2258 0.66 2.28 0.00 101 MONEY_ATM_CARD 2228 0.65 2.25 0.00 102 XM_Lotto 2218 0.67 2.24 0.03 103 T_Symld_Words_02 2212 1.02 2.23 0.52 104 RCVD_IN_BL_SPAMCOP_NET 2206 0.93 2.22 0.40 105 XM_OfRef8 2188 0.65 2.21 0.01 106 XM_ProductURIs 2183 1.42 2.20 1.10 107 XM_URI_RBL 2130 1.07 2.15 0.63 108 ALL_TRUSTED 2119 11.45 2.14 15.25 109 MultiRelay_Combo 2117 0.71 2.13 0.13 110 RCVD_IN_MSPIKE_H2 2117 4.19 2.13 5.03 111 MultiRelay_CC 2117 0.71 2.13 0.13 112 XMGenDplmaNmb 2065 1.18 2.08 0.81 113 XMSubject_48 1856 0.56 1.87 0.03 114 NO_DNS_FOR_FROM 1822 1.44 1.84 1.28 115 DIET_1 1806 0.88 1.82 0.50 116 XM_H_Long_From02 1763 1.23 1.78 1.01 117 T_XMDrugObfuBody_08 1744 1.58 1.76 1.50 118 XM_B_REG_HTML 1709 0.91 1.72 0.58 119 XMBody_17 1704 0.96 1.72 0.65 120 XMBrknScrpt_02 1672 1.15 1.69 0.93 121 TM2_M_VERY_LONG_WORD 1625 1.69 1.64 1.71 122 XM_H_TOP 1564 0.46 1.58 0.01 123 UNPARSEABLE_RELAY 1539 4.46 1.55 5.65 124 TR_XM_DK_SendGrid 1531 3.14 1.54 3.79 125 XMSlimDrugH 1510 0.70 1.52 0.36 126 XMStockSpam_06 1495 1.30 1.51 1.22 127 MAILING_LIST_MULTI 1460 1.67 1.47 1.75 128 T_XMDrugObfuBody_00 1458 0.99 1.47 0.79 129 XM_H_PHPMailer 1436 0.85 1.45 0.60 130 XMHTMLBadTable_001 1413 0.88 1.42 0.66 131 T_XMHurry_00 1405 0.90 1.42 0.69 132 URIBL_SBL_A 1391 0.47 1.40 0.09 133 SpammyFromTLD_01 1385 0.67 1.40 0.37 134 TR_LOTS_OF_MONEY2 1341 0.76 1.35 0.52 135 T_MONEY_PERCENT 1341 0.76 1.35 0.52 136 RELAYCOUNTRY_IN 1325 0.43 1.34 0.06 137 BODY_ENHANCEMENT 1310 0.45 1.32 0.09 138 XMPhish11 1309 1.19 1.32 1.13 139 XMPhish30 1308 0.86 1.32 0.68 140 DATE_IN_PAST_06_12 1290 0.41 1.30 0.05 141 TR_Mismatch_TLD_02 1283 0.41 1.29 0.06 142 URI_TRY_3LD 1274 1.62 1.28 1.76 143 XM_UB99 1264 0.38 1.27 0.01 144 TR_XM_RelayPhish 1233 1.05 1.24 0.98 145 URIBL_BLACK 1215 0.40 1.23 0.07 146 XMSubMetaSSx_00 1201 0.52 1.21 0.24 147 T_FILL_THIS_FORM_SHORT 1194 1.12 1.20 1.09 148 DATE_IN_PAST_12_24 1167 0.40 1.18 0.08 149 XM_H_PHPOS_M 1166 0.55 1.18 0.30 150 RCVD_IN_IADB_LISTED 1159 3.69 1.17 4.72 151 XM_Combo_Sbj 1141 0.45 1.15 0.17 152 RELAYCOUNTRY_AT 1134 0.52 1.14 0.26 153 RELAYCOUNTRY_DE 1123 0.58 1.13 0.35 154 TM2_M_A_HREF_HREF 1108 1.40 1.12 1.52 155 TR_M_TOP_BAYES 1091 0.32 1.10 0.00 156 XM_UB60 1088 0.36 1.10 0.06 157 BAYES_00 1083 9.42 1.09 12.81 158 XMSexyCombo_04 1056 0.42 1.06 0.16 159 XMHTML_After_End 1053 0.54 1.06 0.32 160 URIBL_DBL_SPAM 1044 0.33 1.05 0.03 161 XMSubMetaSxObfu_03 1033 0.68 1.04 0.54 162 BODY_URI_ONLY 1025 0.32 1.03 0.02 163 THIS_AD 1021 0.64 1.03 0.48 164 LONG_JUNK_URI 1013 0.34 1.02 0.07 165 BAYES_05 1012 1.43 1.02 1.60 166 SUBJ_DOLLARS 989 0.75 1.00 0.64 167 FROM_DOMAIN_NOVOWEL 968 0.30 0.98 0.02 168 XMBody_78 962 0.60 0.97 0.44 169 XM_UB999 957 0.29 0.96 0.01 170 RELAYCOUNTRY_JP 945 0.29 0.95 0.01 171 BOTNET_NORDNS 942 0.29 0.95 0.02 172 RCVD_IN_IADB_SPF 939 3.15 0.95 4.05 173 T_TooManySym_02 900 1.87 0.91 2.26 174 XM_B_COPY_HTML 890 0.82 0.90 0.78 175 DATE_IN_PAST_03_06 887 0.33 0.89 0.10 176 XMSubMetaI_01 870 0.35 0.88 0.14 177 XMMoneyMeta_00 867 0.43 0.87 0.25 178 RCVD_IN_IADB_SENDERID 840 2.77 0.85 3.55 179 RCVD_IN_IADB_DK 836 2.67 0.84 3.42 180 XMGppyBdWords 831 0.34 0.84 0.14 181 TR_Caps_n_Bayes_99 826 0.43 0.83 0.27 182 DKIM_ADSP_CUSTOM_MED 802 0.75 0.81 0.73 183 XMSubMetaD_03 799 0.32 0.81 0.13 184 TRACKER_ID 796 0.33 0.80 0.13 185 TR_XM_DK_Bayes 794 8.49 0.80 11.62 186 NML_ADSP_CUSTOM_MED 771 0.57 0.78 0.49 187 FSL_THIS_IS_ADV 754 0.41 0.76 0.26 188 XM_UB80 743 0.23 0.75 0.01 189 XM_RXBody 741 0.51 0.75 0.42 190 RDNS_DYNAMIC 736 0.64 0.74 0.60 191 MIME_HEADER_CTYPE_ONLY 735 0.31 0.74 0.14 192 TR_MetaPhish_Combo_01 734 1.97 0.74 2.47 193 MPART_ALT_DIFF_COUNT 731 0.46 0.74 0.34 194 XM_HighProb1 718 0.22 0.72 0.01 195 TR_XM_DK_Bayes1 715 8.17 0.72 11.20 196 LONG_IMG_URI 709 0.23 0.71 0.03 197 XM_B_Crypto 708 0.25 0.71 0.06 198 RCVD_IN_IADB_VOUCHED 705 2.42 0.71 3.12 199 URI_NOVOWEL 705 0.53 0.71 0.46 200 MISSING_HEADERS 698 0.40 0.70 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 206457 87.04 92.23 84.93 2 DKIM_SIGNED 195211 80.23 80.05 80.30 3 XM_DK_Pass 192446 78.85 78.07 79.16 4 DKIM_VALID 184607 75.56 74.62 75.94 5 DKIM_VALID_AU 144346 60.14 62.02 59.38 6 XMListUnsubscribeExists 138592 62.66 76.50 57.01 7 DCC_CHECK_NEGATIVE 129360 43.45 19.52 53.21 8 BAYES_50 115658 43.79 34.49 47.58 9 DCC_CHECK 111327 55.47 79.18 45.80 10 XM_H_QuotedFrom 95513 43.04 52.23 39.29 11 HTML_FONT_LOW_CONTRAST 81425 35.98 42.09 33.49 12 DKIM_VALID_EF 74796 27.53 19.60 30.77 13 LOC_TINY_FONT_1 67672 30.44 36.81 27.84 14 T_TM2_M_HEADER_IN_MSG 59299 22.27 17.08 24.39 15 XMSubLong 57625 23.80 24.03 23.70 16 FVGT_m_MULTI_ODD 56122 23.60 24.86 23.09 17 MIME_HTML_ONLY 54016 25.16 32.38 22.22 18 XM_DK_Undo_02 48985 28.16 47.79 20.15 19 BAYES_99 44883 25.13 41.47 18.46 20 BAYES_999 40478 22.09 35.43 16.65 21 XM_DKIMWhitelistDomains 40077 11.72 0.04 16.49 22 T_KAM_HTML_FONT_INVALID 39266 17.34 20.26 16.15 23 MultiRelay 38828 15.21 13.36 15.97 24 ALL_TRUSTED 37068 11.45 2.14 15.25 25 XM_Multi_Part_URI 36076 15.22 16.17 14.84 26 XM_Body_Dirty_Words 34812 17.23 24.36 14.32 27 RCVD_IN_RP_SAFE 34760 11.74 5.47 14.30 28 RCVD_IN_RP_CERTIFIED 31794 10.47 4.09 13.08 29 BAYES_00 31148 9.42 1.09 12.81 30 TR_XM_DK_Bayes 28259 8.49 0.80 11.62 31 TR_XM_DK_Bayes1 27234 8.17 0.72 11.20 32 HTML_IMAGE_RATIO_02 25927 12.44 16.79 10.67 33 LOTS_OF_MONEY 25077 10.98 12.62 10.32 34 TR_XM_DK_Bayes2 23929 7.19 0.67 9.84 35 TR_DCC_Bayes_99 21597 15.74 32.53 8.88 36 XM_Evil_Numbers_Gen 21285 10.22 13.80 8.76 37 LotsOfNums_01 20765 7.75 5.82 8.54 38 FSL_BULK_SIG 19768 9.47 12.75 8.13 39 BOTNET_IPINHOSTNAME 19733 12.11 21.89 8.12 40 T_XMDrugObfuBody_14 19274 7.76 7.34 7.93 41 T_TooManySym_01 19034 6.69 3.90 7.83 42 XM_B_Phish_Phrases 18357 7.48 7.30 7.55 43 TO_MALFORMED 18192 5.35 0.13 7.48 44 XM_SendGrid 17922 6.15 3.15 7.37 45 HTML_IMAGE_RATIO_04 16442 7.53 9.40 6.76 46 XM_H_Long_From01 16085 7.35 9.16 6.62 47 TooManyTo_001 15055 6.98 8.92 6.19 48 BAYES_60 14471 5.81 5.45 5.95 49 UNPARSEABLE_RELAY 13739 4.46 1.55 5.65 50 XMSubMetaSx_00 12776 5.83 7.23 5.26 51 TVD_RCVD_IP 12748 3.88 0.54 5.24 52 FROM_EXCESS_BASE64 12538 5.21 5.34 5.16 53 RCVD_IN_MSPIKE_H2 12224 4.19 2.13 5.03 54 XMStrtUSub 11885 4.55 3.70 4.89 55 MIME_QP_LONG_LINE 11624 4.14 2.57 4.78 56 RCVD_IN_IADB_LISTED 11478 3.69 1.17 4.72 57 XMSexyCombo_05 10834 6.26 10.67 4.46 58 DKIM_INVALID 10604 4.67 5.43 4.36 59 T_REMOTE_IMAGE 10352 3.84 2.83 4.26 60 BAYES_80 10097 4.87 6.64 4.15 61 MPART_ALT_DIFF 9907 5.43 8.76 4.08 62 XM_UncommonTLD01 9850 5.86 10.31 4.05 63 RCVD_IN_IADB_SPF 9835 3.15 0.95 4.05 64 IN_ZIMBRA_NJ_WHITELIST 9515 2.79 0.02 3.91 65 RELAYCOUNTRY_META 9506 8.70 20.42 3.91 66 TR_XM_DK_SendGrid 9204 3.14 1.54 3.79 67 BAYES_40 8770 3.24 2.35 3.61 68 HTML_IMAGE_RATIO_06 8758 3.93 4.72 3.60 69 RCVD_IN_IADB_SENDERID 8628 2.77 0.85 3.55 70 RCVD_IN_IADB_DK 8308 2.67 0.84 3.42 71 RCVD_IN_MSPIKE_WL 8179 2.48 0.32 3.36 72 RCVD_IN_MSPIKE_H3 8179 2.48 0.32 3.36 73 RCVD_IN_IADB_VOUCHED 7588 2.42 0.71 3.12 74 INVALID_MSGID 7248 2.18 0.20 2.98 75 BAYES_95 7135 3.36 4.40 2.94 76 MIME_HTML_MOSTLY 6976 3.89 6.39 2.87 77 XMNumbers 6621 2.75 2.82 2.72 78 XM_DIRTYINTL 6616 3.39 5.03 2.72 79 TR_MetaPhish_Combo_01 5996 1.97 0.74 2.47 80 BAYES_20 5935 2.56 2.84 2.44 81 T_TooManySym_02 5491 1.87 0.91 2.26 82 XM_PDF 5442 1.66 0.23 2.24 83 HTML_IMAGE_RATIO_08 5373 2.93 4.70 2.21 84 URI_HEX 5291 2.81 4.36 2.18 85 BOTNET 5189 7.17 19.51 2.13 86 SUBJ_ALL_CAPS 5036 2.62 3.96 2.07 87 MIME_HTML_ONLY_MULTI 4971 2.60 3.97 2.04 88 IN_HORDE_ADDRESS_BOOK 4958 1.47 0.07 2.04 89 RCVD_IN_IADB_OPTIN 4947 1.60 0.52 2.03 90 BOUNCE_MESSAGE 4760 1.45 0.21 1.96 91 ANY_BOUNCE_MESSAGE 4760 1.45 0.21 1.96 92 TR_Symld_Words 4723 2.26 3.02 1.94 93 TooManyTo_002 4552 1.50 0.60 1.87 94 HTML_MIME_NO_HTML_TAG 4470 2.87 5.39 1.84 95 XM_CamelCaseFrm001 4371 2.68 4.85 1.80 96 URI_TRY_3LD 4286 1.62 1.28 1.76 97 MAILING_LIST_MULTI 4259 1.67 1.47 1.75 98 USER_IN_DEF_DKIM_WL 4233 1.24 0.01 1.74 99 TM2_M_VERY_LONG_WORD 4162 1.69 1.64 1.71 100 BAYES_05 3889 1.43 1.02 1.60 101 TM2_M_A_HREF_HREF 3691 1.40 1.12 1.52 102 TM2_M_URI_OPT_OUT 3672 1.80 2.50 1.51 103 T_XMDrugObfuBody_08 3649 1.58 1.76 1.50 104 XMBdyGiftCard01 3552 2.47 4.95 1.46 105 XMDiploma_00 3534 1.81 2.67 1.45 106 XM_DK_Undo_01 3526 1.17 0.48 1.45 107 RELAYCOUNTRY_CA 3510 2.24 4.19 1.44 108 XM_OfRef6 3374 2.30 4.52 1.39 109 TooManyTo_003 3287 1.09 0.44 1.35 110 NO_DNS_FOR_FROM 3116 1.44 1.84 1.28 111 XM_SPF_SoftFail 3098 1.68 2.66 1.27 112 UNTRUSTED_Relay 3045 5.09 14.51 1.25 113 XM_GoogleGroups 3036 1.00 0.39 1.25 114 XMStockSpam_06 2965 1.30 1.51 1.22 115 XMPhish11 2758 1.19 1.32 1.13 116 XM_ProductURIs 2679 1.42 2.20 1.10 117 T_FILL_THIS_FORM_SHORT 2650 1.12 1.20 1.09 118 XMBody_95 2632 0.83 0.20 1.08 119 TooManyTo_004 2554 0.86 0.38 1.05 120 XM_H_Long_From02 2455 1.23 1.78 1.01 121 XMGappySubj_01 2403 0.76 0.21 0.99 122 TR_XM_RelayPhish 2377 1.05 1.24 0.98 123 USER_IN_WHITELIST 2374 0.69 0.00 0.98 124 HTML_TAG_BALANCE_BODY 2326 0.87 0.66 0.96 125 XMBrknScrpt_02 2258 1.15 1.69 0.93 126 XMSexyCombo_01 2203 1.35 2.44 0.91 127 XMSubMetaI_00 2048 1.62 3.53 0.84 128 TooManyTo_005 1991 0.67 0.29 0.82 129 XMGenDplmaNmb 1978 1.18 2.08 0.81 130 XMSubMetaSxObfu_02 1976 0.64 0.22 0.81 131 T_XMDrugObfuBody_00 1923 0.99 1.47 0.79 132 XM_B_COPY_HTML 1902 0.82 0.90 0.78 133 XM_D_tchamptons_WL 1876 0.55 0.00 0.77 134 XMGappySubj_02 1861 0.57 0.08 0.77 135 T_TooManySym_03 1800 0.57 0.15 0.74 136 DKIM_ADSP_CUSTOM_MED 1775 0.75 0.81 0.73 137 DKIM_ADSP_NXDOMAIN 1701 2.09 5.51 0.70 138 T_XMHurry_00 1680 0.90 1.42 0.69 139 XM_UB50 1659 2.65 7.48 0.68 140 XMPhish30 1643 0.86 1.32 0.68 141 XMHTMLBadTable_001 1602 0.88 1.42 0.66 142 XMBody_17 1568 0.96 1.72 0.65 143 FILL_THIS_FORM 1566 1.38 3.17 0.64 144 SUBJ_DOLLARS 1564 0.75 1.00 0.64 145 XM_URI_RBL 1539 1.07 2.15 0.63 146 TR_XM_PHPDW 1525 1.22 2.66 0.63 147 TR_XM_PHPForged 1488 1.20 2.63 0.61 148 TR_XM_FormFill2 1474 1.19 2.61 0.61 149 XM_H_PHPOS 1463 1.18 2.59 0.60 150 XM_H_PHPMailer 1461 0.85 1.45 0.60 151 RDNS_DYNAMIC 1451 0.64 0.74 0.60 152 XM_B_REG_HTML 1420 0.91 1.72 0.58 153 FILL_THIS_FORM_LONG 1406 1.30 3.06 0.58 154 HELO_NODOT 1373 0.49 0.31 0.56 155 HELO_NO_DOMAIN 1372 0.49 0.30 0.56 156 XMSubMetaSxObfu_03 1301 0.68 1.04 0.54 157 XMNoVowels 1271 0.51 0.48 0.52 158 T_Symld_Words_02 1270 1.02 2.23 0.52 159 T_MONEY_PERCENT 1266 0.76 1.35 0.52 160 TR_LOTS_OF_MONEY2 1266 0.76 1.35 0.52 161 HTML_FONT_FACE_BAD 1263 0.54 0.58 0.52 162 PLING_QUERY 1248 0.52 0.53 0.51 163 DIET_1 1212 0.88 1.82 0.50 164 NML_ADSP_CUSTOM_MED 1195 0.57 0.78 0.49 165 XMBSHREFv2 1186 0.41 0.20 0.49 166 THIS_AD 1175 0.64 1.03 0.48 167 RELAYCOUNTRY_GB 1167 0.52 0.62 0.48 168 URI_NOVOWEL 1115 0.53 0.71 0.46 169 XMBody_78 1079 0.60 0.97 0.44 170 XMLngstWrd_00 1079 0.38 0.22 0.44 171 XM_USANA_RCVD 1057 0.31 0.00 0.43 172 FILL_THIS_FORM_LOAN 1056 0.51 0.70 0.43 173 XMRcvdHeader_15 1052 0.31 0.00 0.43 174 XMCapTrack 1049 0.35 0.15 0.43 175 XM_RXBody 1009 0.51 0.75 0.42 176 HTTPS_HTTP_MISMATCH 1004 0.42 0.43 0.41 177 XMLngstWrd_01 985 0.34 0.20 0.41 178 REMOVE_BEFORE_LINK 983 0.37 0.27 0.40 179 RCVD_IN_BL_SPAMCOP_NET 973 0.93 2.22 0.40 180 XM_Walgreens_Forge 905 0.27 0.01 0.37 181 SpammyFromTLD_01 901 0.67 1.40 0.37 182 XMSlimDrugH 883 0.70 1.52 0.36 183 RELAYCOUNTRY_AU 857 0.35 0.33 0.35 184 RELAYCOUNTRY_DE 853 0.58 1.13 0.35 185 XM_Akamai 852 0.25 0.01 0.35 186 MPART_ALT_DIFF_COUNT 836 0.46 0.74 0.34 187 T_TooManySym_04 819 0.25 0.02 0.34 188 XMFunnyHTTP 815 0.24 0.00 0.34 189 TR_MetaPhish_Combo_01b 799 0.37 0.46 0.33 190 FORGED_GMAIL_RCVD 796 0.43 0.67 0.33 191 XMHTML_After_End 787 0.54 1.06 0.32 192 XM_Body_Obfu01 758 0.29 0.25 0.31 193 XM_ShortIntro_01 752 0.34 0.42 0.31 194 TR_LOTS_OF_MONEY3 732 0.41 0.68 0.30 195 XM_H_PHPOS_M 728 0.55 1.18 0.30 196 XMSolicitRefs_0 728 0.27 0.20 0.30 197 HTML_FONT_SIZE_LARGE 716 0.33 0.42 0.29 198 XM_H_SpoofStaff4 715 0.22 0.02 0.29 199 TM2_M_BODY_EMPTY 699 0.25 0.15 0.29 200 XM_shorewaves_Whitelist 680 0.20 0.00 0.28 ----------------------------------------------------------------------