Email: 630915 Autolearn: 0 AvgScore: 2.63 AvgScanTime: 2.13 sec Spam: 150615 Autolearn: 0 AvgScore: 12.27 AvgScanTime: 2.69 sec Ham: 480300 Autolearn: 0 AvgScore: -0.39 AvgScanTime: 1.95 sec Time Spent Running SA: 373.06 hours Time Spent Processing Spam: 112.61 hours Time Spent Processing Ham: 260.45 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141831 88.27 94.17 86.42 2 DKIM_SIGNED 124771 77.08 82.84 75.28 3 XM_DK_Pass 121460 75.58 80.64 74.00 4 DCC_CHECK 119122 49.73 79.09 40.52 5 DKIM_VALID 117948 72.99 78.31 71.33 6 XM_B_Unicode 117719 70.61 78.16 68.24 7 XMListUnsubscribeExists 112005 55.94 74.37 50.16 8 DKIM_VALID_AU 88568 52.89 58.80 51.03 9 XM_DK_Undo_02 72729 20.54 48.29 11.84 10 BAYES_99 62809 17.71 41.70 10.18 11 HTML_FONT_LOW_CONTRAST 55775 30.71 37.03 28.73 12 LOC_TINY_FONT_1 51930 25.35 34.48 22.49 13 BAYES_50 51872 49.70 34.44 54.49 14 BAYES_999 51478 14.89 34.18 8.84 15 TR_DCC_Bayes_99 50693 11.48 33.66 4.52 16 RCVD_IN_MSPIKE_H2 47220 31.11 31.35 31.04 17 MIME_HTML_ONLY 46413 22.85 30.82 20.35 18 FVGT_m_MULTI_ODD 42473 22.84 28.20 21.16 19 XMSubLong 40610 24.05 26.96 23.14 20 XM_Body_Dirty_Words 35908 15.66 23.84 13.09 21 DKIM_VALID_EF 34787 26.78 23.10 27.93 22 T_KAM_HTML_FONT_INVALID 34520 18.90 22.92 17.64 23 T_TM2_M_HEADER_IN_MSG 29799 28.27 19.78 30.93 24 RELAYCOUNTRY_META 28867 8.90 19.17 5.68 25 DCC_CHECK_NEGATIVE 28220 48.21 18.74 57.45 26 XM_Multi_Part_URI 25286 12.29 16.79 10.88 27 MultiRelay 24750 19.43 16.43 20.37 28 BOTNET 24173 5.30 16.05 1.93 29 BOTNET_IPINHOSTNAME 22421 6.76 14.89 4.21 30 HTML_IMAGE_RATIO_02 21276 9.55 14.13 8.12 31 XM_Evil_Numbers_Gen 20245 9.91 13.44 8.80 32 LOTS_OF_MONEY 20039 10.69 13.30 9.86 33 UNTRUSTED_Relay 19099 4.08 12.68 1.39 34 FSL_BULK_SIG 17726 9.53 11.77 8.83 35 XMSexyCombo_05 16690 5.88 11.08 4.24 36 T_XMDrugObfuBody_14 15355 9.01 10.19 8.63 37 LotsOfNums_01 14724 8.17 9.78 7.66 38 HTML_IMAGE_RATIO_04 12147 6.26 8.06 5.70 39 XMSubMetaSx_00 11983 4.87 7.96 3.91 40 XM_UncommonTLD01 11868 4.93 7.88 4.01 41 BAYES_80 11673 4.84 7.75 3.93 42 TooManyTo_001 11541 8.20 7.66 8.37 43 XM_B_Phish_Phrases 11483 5.95 7.62 5.42 44 MPART_ALT_DIFF 11452 4.26 7.60 3.21 45 XM_H_Long_From01 11220 6.41 7.45 6.08 46 BAYES_60 9328 6.61 6.19 6.74 47 XM_UB50 9008 2.09 5.98 0.87 48 MIME_QP_LONG_LINE 8655 5.65 5.75 5.62 49 XM_DIRTYINTL 8498 3.58 5.64 2.93 50 XM_SPF_SoftFail 7291 2.86 4.84 2.24 51 FROM_EXCESS_BASE64 7067 3.43 4.69 3.03 52 MIME_HTML_MOSTLY 7040 2.64 4.67 2.01 53 BAYES_95 6883 3.01 4.57 2.52 54 XMStrtUSub 6869 4.33 4.56 4.25 55 DKIM_INVALID 6823 4.09 4.53 3.95 56 XM_OfRef6 6258 2.38 4.15 1.82 57 TM2_M_URI_OPT_OUT 6044 2.36 4.01 1.85 58 RELAYCOUNTRY_CA 5954 2.02 3.95 1.41 59 MIME_HTML_ONLY_MULTI 5925 2.35 3.93 1.86 60 SpammyFromTLD_02 5913 1.21 3.93 0.35 61 KHOP_HELO_FCRDNS 5876 2.78 3.90 2.43 62 XM_SendGrid 5834 6.17 3.87 6.89 63 HTML_IMAGE_RATIO_06 5818 3.55 3.86 3.45 64 XM_B_SpammyTLD 5794 3.58 3.85 3.50 65 XMNumbers 5785 3.01 3.84 2.75 66 URI_HEX 5718 2.51 3.80 2.10 67 RCVD_IN_BL_SPAMCOP_NET 5665 1.38 3.76 0.64 68 HTML_IMAGE_RATIO_08 5307 2.96 3.52 2.78 69 RELAYCOUNTRY_FR 5196 1.08 3.45 0.34 70 XM_URI_RBL 5107 1.02 3.39 0.28 71 XMDiploma_00 4921 2.31 3.27 2.01 72 T_XMDrugObfuBody_08 4837 1.89 3.21 1.48 73 HTML_MIME_NO_HTML_TAG 4765 2.53 3.16 2.33 74 RCVD_IN_RP_RNBL 4723 0.77 3.14 0.03 75 T_TooManySym_01 4691 5.01 3.11 5.61 76 RCVD_IN_IADB_LISTED 4646 5.26 3.08 5.94 77 T_REMOTE_IMAGE 4590 4.18 3.05 4.53 78 XMSexyCombo_01 4417 1.20 2.93 0.66 79 US_DOLLARS_3 4416 2.26 2.93 2.05 80 NO_DNS_FOR_FROM 4359 1.44 2.89 0.99 81 RCVD_IN_PSBL 4358 0.71 2.89 0.03 82 DKIM_ADSP_NXDOMAIN 4211 1.00 2.80 0.43 83 XMBody_17 4158 1.04 2.76 0.50 84 XM_CamelCaseFrm001 4032 2.13 2.68 1.95 85 RCVD_IN_IADB_SPF 3945 4.46 2.62 5.04 86 RCVD_IN_RP_SAFE 3901 8.41 2.59 10.23 87 XMGenDplmaNmb 3893 1.56 2.58 1.24 88 SUBJ_ALL_CAPS 3732 1.95 2.48 1.78 89 RCVD_IN_IADB_SENDERID 3699 3.85 2.46 4.29 90 RCVD_IN_IADB_DK 3654 3.78 2.43 4.21 91 MultiRelay_Combo 3605 0.73 2.39 0.21 92 MultiRelay_CC 3605 0.73 2.39 0.21 93 TM2_M_VERY_LONG_WORD 3388 1.43 2.25 1.17 94 TR_XM_PHPDW 3368 1.06 2.24 0.69 95 XM_UB99 3326 0.53 2.21 0.01 96 TR_XM_PHPForged 3315 1.03 2.20 0.66 97 TR_XM_FormFill2 3266 1.01 2.17 0.65 98 XM_H_PHPOS 3232 1.00 2.15 0.65 99 XMBdyGiftCard01 3137 1.24 2.08 0.97 100 ALL_TRUSTED 2950 12.42 1.96 15.70 101 XM_OfRef7 2935 0.61 1.95 0.19 102 XMHTML_After_End 2909 1.11 1.93 0.85 103 BOTNET_NORDNS 2859 0.48 1.90 0.03 104 XM_DK_Undo_01 2828 1.73 1.88 1.69 105 RCVD_IN_RP_CERTIFIED 2784 7.47 1.85 9.24 106 MAILING_LIST_MULTI 2749 2.64 1.83 2.89 107 BAYES_40 2747 3.81 1.82 4.44 108 TR_Symld_Words 2695 1.77 1.79 1.76 109 TR_XM_DK_SendGrid 2695 3.17 1.79 3.61 110 URI_TRY_3LD 2684 1.21 1.78 1.03 111 XMStockSpam_06 2635 1.40 1.75 1.29 112 XM_H_Long_From02 2582 1.43 1.71 1.35 113 SpammyFromTLD_01 2568 1.03 1.71 0.82 114 XMMoneyMeta_00 2498 0.82 1.66 0.56 115 XMPhish11 2474 1.32 1.64 1.23 116 TR_XM_RelayPhish 2449 1.10 1.63 0.94 117 DIET_1 2436 0.60 1.62 0.28 118 XMSubMetaI_00 2423 0.68 1.61 0.39 119 BAYES_20 2396 2.90 1.59 3.32 120 XM_UB999 2370 0.38 1.57 0.01 121 XM_ProductURIs 2341 1.21 1.55 1.10 122 RCVD_IN_IADB_VOUCHED 2336 3.59 1.55 4.23 123 TR_Mismatch_TLD_02 2284 0.42 1.52 0.07 124 XM_UB60 2264 0.44 1.50 0.11 125 XMSlimDrugH 2255 0.60 1.50 0.32 126 T_XMDrugObfuBody_00 2199 1.06 1.46 0.94 127 XM_H_PHPMailer 2155 0.76 1.43 0.56 128 SUBJ_DOLLARS 2098 0.75 1.39 0.55 129 XMBrknScrpt_02 2089 0.76 1.39 0.57 130 RELAYCOUNTRY_DE 1948 0.59 1.29 0.37 131 XMPhish30 1907 0.64 1.27 0.45 132 XM_UB80 1795 0.30 1.19 0.02 133 TooManyTo_002 1772 1.98 1.18 2.23 134 THIS_AD 1769 0.40 1.17 0.15 135 TM2_M_A_HREF_HREF 1729 0.75 1.15 0.62 136 XM_HighProb1 1723 0.28 1.14 0.01 137 FILL_THIS_FORM 1687 0.72 1.12 0.60 138 URIBL_DBL_ABUSE_REDIR 1683 0.27 1.12 0.01 139 FROM_SUSPICIOUS_NTLD 1634 0.29 1.08 0.04 140 URIBL_BLACK 1633 0.32 1.08 0.07 141 XMSubMetaSxObfu_03 1620 0.55 1.08 0.38 142 FROM_SUSPICIOUS_NTLD_FP 1615 0.28 1.07 0.03 143 HTML_TAG_BALANCE_BODY 1614 0.76 1.07 0.66 144 T_FILL_THIS_FORM_SHORT 1584 0.93 1.05 0.90 145 XMSubMetaSSx_00 1581 0.41 1.05 0.21 146 RELAYCOUNTRY_GB 1573 1.19 1.04 1.24 147 HTML_IMAGE_ONLY_24 1541 0.51 1.02 0.35 148 TR_LOTS_OF_MONEY3 1534 0.55 1.02 0.40 149 TooManyTo_003 1528 1.37 1.01 1.48 150 LOW_PRICE 1516 0.46 1.01 0.29 151 DKIM_ADSP_CUSTOM_MED 1507 0.97 1.00 0.96 152 RDNS_DYNAMIC 1502 0.52 1.00 0.38 153 XM_H_PHPOS_M 1499 0.36 1.00 0.16 154 T_XMHurry_00 1486 0.97 0.99 0.97 155 NUMERIC_HTTP_ADDR 1468 0.54 0.97 0.41 156 MIME_HEADER_CTYPE_ONLY 1436 0.32 0.95 0.13 157 XMSexyCombo_04 1429 0.37 0.95 0.19 158 RELAYCOUNTRY_IN 1424 0.31 0.95 0.11 159 XM_BadFromFormat 1420 0.31 0.94 0.11 160 LongTLD 1407 0.33 0.93 0.15 161 TR_LOTS_OF_MONEY2 1396 0.54 0.93 0.42 162 T_MONEY_PERCENT 1396 0.54 0.93 0.42 163 DATE_IN_PAST_03_06 1391 0.31 0.92 0.12 164 T_TooManySym_02 1386 1.65 0.92 1.88 165 FILL_THIS_FORM_LONG 1383 0.58 0.92 0.47 166 TooManyTo_004 1377 1.06 0.91 1.10 167 RELAYCOUNTRY_AT 1355 0.31 0.90 0.13 168 BAYES_00 1349 9.45 0.90 12.13 169 HTML_FONT_FACE_BAD 1345 0.68 0.89 0.61 170 REMOVE_BEFORE_LINK 1316 0.50 0.87 0.38 171 FORGED_GMAIL_RCVD 1316 0.53 0.87 0.42 172 RCVD_IN_IADB_OPTIN 1313 2.26 0.87 2.70 173 XMHTMLBadTable_001 1309 0.58 0.87 0.49 174 PLING_QUERY 1306 0.56 0.87 0.47 175 XMBody_78 1297 0.59 0.86 0.51 176 RELAYCOUNTRY_PL 1297 0.23 0.86 0.03 177 TR_MetaPhish_Combo_01 1294 1.39 0.86 1.55 178 HELO_NODOT 1287 1.59 0.85 1.82 179 HELO_NO_DOMAIN 1284 1.59 0.85 1.81 180 BAYES_05 1274 1.72 0.85 1.99 181 BODY_ENHANCEMENT 1274 0.23 0.85 0.03 182 TooManyTo_005 1194 0.88 0.79 0.91 183 T_Symld_Words_02 1187 0.71 0.79 0.68 184 XM_PDF 1179 4.13 0.78 5.18 185 UNPARSEABLE_RELAY 1177 2.00 0.78 2.38 186 XM_B_REG_HTML 1167 0.54 0.77 0.46 187 ADVANCE_FEE_5_NEW_MONEY 1149 0.18 0.76 0.00 188 T_FILL_THIS_FORM_FRAUD_PHISH 1141 0.21 0.76 0.04 189 NML_ADSP_CUSTOM_MED 1131 0.70 0.75 0.68 190 MONEY_FRAUD_8 1117 0.18 0.74 0.00 191 URI_NOVOWEL 1104 0.47 0.73 0.39 192 DEAR_BENEFICIARY 1102 0.18 0.73 0.00 193 RELAYCOUNTRY_AU 1099 0.56 0.73 0.50 194 LONG_HEX_URI 1072 0.30 0.71 0.17 195 NORMAL_HTTP_TO_IP 1052 0.21 0.70 0.05 196 TR_Caps_n_Bayes_99 1047 0.28 0.70 0.15 197 HTTPS_HTTP_MISMATCH 1047 0.57 0.70 0.53 198 XM_Combo_Sbj 1018 0.34 0.68 0.23 199 RELAYCOUNTRY_ID 999 0.17 0.66 0.01 200 MPART_ALT_DIFF_COUNT 998 0.42 0.66 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 415094 88.27 94.17 86.42 2 DKIM_SIGNED 361560 77.08 82.84 75.28 3 XM_DK_Pass 355415 75.58 80.64 74.00 4 DKIM_VALID 342580 72.99 78.31 71.33 5 XM_B_Unicode 327767 70.61 78.16 68.24 6 DCC_CHECK_NEGATIVE 275934 48.21 18.74 57.45 7 BAYES_50 261705 49.70 34.44 54.49 8 DKIM_VALID_AU 245098 52.89 58.80 51.03 9 XMListUnsubscribeExists 240926 55.94 74.37 50.16 10 DCC_CHECK 194608 49.73 79.09 40.52 11 RCVD_IN_MSPIKE_H2 149062 31.11 31.35 31.04 12 T_TM2_M_HEADER_IN_MSG 148559 28.27 19.78 30.93 13 HTML_FONT_LOW_CONTRAST 137980 30.71 37.03 28.73 14 DKIM_VALID_EF 134161 26.78 23.10 27.93 15 XMSubLong 111131 24.05 26.96 23.14 16 LOC_TINY_FONT_1 108003 25.35 34.48 22.49 17 FVGT_m_MULTI_ODD 101610 22.84 28.20 21.16 18 MultiRelay 97829 19.43 16.43 20.37 19 MIME_HTML_ONLY 97738 22.85 30.82 20.35 20 T_KAM_HTML_FONT_INVALID 84728 18.90 22.92 17.64 21 ALL_TRUSTED 75405 12.42 1.96 15.70 22 XM_Body_Dirty_Words 62872 15.66 23.84 13.09 23 BAYES_00 58241 9.45 0.90 12.13 24 XM_DK_Undo_02 56873 20.54 48.29 11.84 25 XM_Multi_Part_URI 52248 12.29 16.79 10.88 26 RCVD_IN_RP_SAFE 49155 8.41 2.59 10.23 27 BAYES_99 48917 17.71 41.70 10.18 28 LOTS_OF_MONEY 47375 10.69 13.30 9.86 29 TR_XM_DK_Bayes 46103 7.43 0.52 9.60 30 TR_XM_DK_Bayes1 44727 7.21 0.49 9.31 31 RCVD_IN_RP_CERTIFIED 44357 7.47 1.85 9.24 32 BAYES_999 42455 14.89 34.18 8.84 33 FSL_BULK_SIG 42422 9.53 11.77 8.83 34 XM_Evil_Numbers_Gen 42283 9.91 13.44 8.80 35 T_XMDrugObfuBody_14 41467 9.01 10.19 8.63 36 TooManyTo_001 40205 8.20 7.66 8.37 37 HTML_IMAGE_RATIO_02 38995 9.55 14.13 8.12 38 TR_XM_DK_Bayes2 37582 6.05 0.41 7.82 39 XM_DKIMWhitelistDomains 37066 5.88 0.04 7.72 40 LotsOfNums_01 36812 8.17 9.78 7.66 41 XM_SendGrid 33100 6.17 3.87 6.89 42 BAYES_60 32379 6.61 6.19 6.74 43 XM_H_Long_From01 29196 6.41 7.45 6.08 44 RCVD_IN_IADB_LISTED 28517 5.26 3.08 5.94 45 HTML_IMAGE_RATIO_04 27358 6.26 8.06 5.70 46 RELAYCOUNTRY_META 27292 8.90 19.17 5.68 47 MIME_QP_LONG_LINE 26992 5.65 5.75 5.62 48 T_TooManySym_01 26927 5.01 3.11 5.61 49 XM_B_Phish_Phrases 26052 5.95 7.62 5.42 50 XM_PDF 24859 4.13 0.78 5.18 51 RCVD_IN_IADB_SPF 24223 4.46 2.62 5.04 52 TO_MALFORMED 24218 3.85 0.06 5.04 53 T_REMOTE_IMAGE 21767 4.18 3.05 4.53 54 TR_DCC_Bayes_99 21727 11.48 33.66 4.52 55 BAYES_40 21318 3.81 1.82 4.44 56 RCVD_IN_IADB_SENDERID 20590 3.85 2.46 4.29 57 XMStrtUSub 20429 4.33 4.56 4.25 58 XMSexyCombo_05 20380 5.88 11.08 4.24 59 RCVD_IN_IADB_VOUCHED 20332 3.59 1.55 4.23 60 RCVD_IN_IADB_DK 20222 3.78 2.43 4.21 61 BOTNET_IPINHOSTNAME 20199 6.76 14.89 4.21 62 IN_ZIMBRA_NJ_WHITELIST 19622 3.11 0.02 4.09 63 XM_UncommonTLD01 19240 4.93 7.88 4.01 64 DKIM_INVALID 18980 4.09 4.53 3.95 65 BAYES_80 18889 4.84 7.75 3.93 66 XMSubMetaSx_00 18769 4.87 7.96 3.91 67 TR_XM_DK_SendGrid 17322 3.17 1.79 3.61 68 XM_B_SpammyTLD 16794 3.58 3.85 3.50 69 HTML_IMAGE_RATIO_06 16592 3.55 3.86 3.45 70 BAYES_20 15927 2.90 1.59 3.32 71 MPART_ALT_DIFF 15427 4.26 7.60 3.21 72 FROM_EXCESS_BASE64 14568 3.43 4.69 3.03 73 XM_DIRTYINTL 14084 3.58 5.64 2.93 74 MAILING_LIST_MULTI 13896 2.64 1.83 2.89 75 HTML_IMAGE_RATIO_08 13372 2.96 3.52 2.78 76 XMNumbers 13214 3.01 3.84 2.75 77 RCVD_IN_IADB_OPTIN 12973 2.26 0.87 2.70 78 BAYES_95 12087 3.01 4.57 2.52 79 KHOP_HELO_FCRDNS 11653 2.78 3.90 2.43 80 TVD_RCVD_IP 11560 1.93 0.42 2.41 81 UNPARSEABLE_RELAY 11424 2.00 0.78 2.38 82 HTML_MIME_NO_HTML_TAG 11195 2.53 3.16 2.33 83 INVALID_MSGID 11127 1.79 0.12 2.32 84 XM_SPF_SoftFail 10782 2.86 4.84 2.24 85 TooManyTo_002 10706 1.98 1.18 2.23 86 URI_HEX 10087 2.51 3.80 2.10 87 US_DOLLARS_3 9841 2.26 2.93 2.05 88 XMDiploma_00 9638 2.31 3.27 2.01 89 MIME_HTML_MOSTLY 9633 2.64 4.67 2.01 90 BAYES_05 9574 1.72 0.85 1.99 91 XM_CamelCaseFrm001 9387 2.13 2.68 1.95 92 BOTNET 9259 5.30 16.05 1.93 93 T_TooManySym_02 9011 1.65 0.92 1.88 94 MIME_HTML_ONLY_MULTI 8929 2.35 3.93 1.86 95 TM2_M_URI_OPT_OUT 8865 2.36 4.01 1.85 96 XM_OfRef6 8753 2.38 4.15 1.82 97 HELO_NODOT 8718 1.59 0.85 1.82 98 HELO_NO_DOMAIN 8717 1.59 0.85 1.81 99 SUBJ_ALL_CAPS 8553 1.95 2.48 1.78 100 TR_Symld_Words 8465 1.77 1.79 1.76 101 ANY_BOUNCE_MESSAGE 8311 1.40 0.36 1.73 102 BOUNCE_MESSAGE 8300 1.40 0.36 1.73 103 IN_HORDE_ADDRESS_BOOK 8194 1.31 0.04 1.71 104 XM_DK_Undo_01 8116 1.73 1.88 1.69 105 TR_MetaPhish_Combo_01 7462 1.39 0.86 1.55 106 T_XMDrugObfuBody_08 7093 1.89 3.21 1.48 107 TooManyTo_003 7087 1.37 1.01 1.48 108 RELAYCOUNTRY_CA 6776 2.02 3.95 1.41 109 UNTRUSTED_Relay 6672 4.08 12.68 1.39 110 XMCapTrack 6650 1.13 0.32 1.38 111 XM_H_Long_From02 6463 1.43 1.71 1.35 112 USER_IN_DEF_DKIM_WL 6332 1.01 0.02 1.32 113 XMStockSpam_06 6201 1.40 1.75 1.29 114 XMGenDplmaNmb 5954 1.56 2.58 1.24 115 RELAYCOUNTRY_GB 5934 1.19 1.04 1.24 116 XMPhish11 5884 1.32 1.64 1.23 117 XM_GoogleGroups 5726 1.04 0.54 1.19 118 TM2_M_VERY_LONG_WORD 5642 1.43 2.25 1.17 119 TooManyTo_004 5289 1.06 0.91 1.10 120 XM_ProductURIs 5281 1.21 1.55 1.10 121 URI_TRY_3LD 4961 1.21 1.78 1.03 122 XMNoVowels 4820 0.89 0.52 1.00 123 NO_DNS_FOR_FROM 4737 1.44 2.89 0.99 124 XMBdyGiftCard01 4676 1.24 2.08 0.97 125 T_XMHurry_00 4642 0.97 0.99 0.97 126 DKIM_ADSP_CUSTOM_MED 4610 0.97 1.00 0.96 127 T_XMDrugObfuBody_00 4504 1.06 1.46 0.94 128 TR_XM_RelayPhish 4497 1.10 1.63 0.94 129 TooManyTo_005 4354 0.88 0.79 0.91 130 T_FILL_THIS_FORM_SHORT 4300 0.93 1.05 0.90 131 XM_UB50 4190 2.09 5.98 0.87 132 XMHTML_After_End 4068 1.11 1.93 0.85 133 SpammyFromTLD_01 3940 1.03 1.71 0.82 134 XMGappySubj_01 3699 0.66 0.32 0.77 135 XM_B_COPY_HTML 3591 0.72 0.61 0.75 136 T_OBFU_PDF_ATTACH 3543 0.62 0.23 0.74 137 TR_XM_PHPDW 3322 1.06 2.24 0.69 138 T_Symld_Words_02 3282 0.71 0.79 0.68 139 NML_ADSP_CUSTOM_MED 3281 0.70 0.75 0.68 140 RELAYCOUNTRY_NL 3264 0.62 0.42 0.68 141 T_TooManySym_03 3236 0.56 0.21 0.67 142 XM_ShortIntro_01 3180 0.60 0.40 0.66 143 TR_XM_PHPForged 3176 1.03 2.20 0.66 144 HTML_TAG_BALANCE_BODY 3174 0.76 1.07 0.66 145 XMSexyCombo_01 3155 1.20 2.93 0.66 146 TR_XM_FormFill2 3122 1.01 2.17 0.65 147 XM_H_PHPOS 3100 1.00 2.15 0.65 148 RCVD_IN_BL_SPAMCOP_NET 3051 1.38 3.76 0.64 149 TM2_M_A_HREF_HREF 2980 0.75 1.15 0.62 150 HTML_FONT_FACE_BAD 2937 0.68 0.89 0.61 151 FROM_GOV_SPOOF 2902 0.53 0.29 0.60 152 FILL_THIS_FORM 2865 0.72 1.12 0.60 153 XMBrknScrpt_02 2726 0.76 1.39 0.57 154 XMMoneyMeta_00 2685 0.82 1.66 0.56 155 XM_H_PHPMailer 2667 0.76 1.43 0.56 156 SUBJ_DOLLARS 2637 0.75 1.39 0.55 157 XMLngstWrd_00 2583 0.50 0.39 0.54 158 HTTPS_HTTP_MISMATCH 2567 0.57 0.70 0.53 159 XMBody_29 2478 0.43 0.16 0.52 160 SHORT_HELO_AND_INLINE_IMAGE 2451 0.40 0.04 0.51 161 XMBody_78 2436 0.59 0.86 0.51 162 RELAYCOUNTRY_AU 2423 0.56 0.73 0.50 163 USER_IN_WHITELIST 2403 0.38 0.00 0.50 164 XMBody_17 2383 1.04 2.76 0.50 165 XMBody_95 2382 0.44 0.26 0.50 166 XMHTMLBadTable_001 2374 0.58 0.87 0.49 167 XM_D_tchamptons_WL 2372 0.38 0.00 0.49 168 XMLngstWrd_01 2305 0.44 0.31 0.48 169 FILL_THIS_FORM_LOAN 2257 0.41 0.22 0.47 170 FILL_THIS_FORM_LONG 2253 0.58 0.92 0.47 171 XMLKML 2246 0.36 0.00 0.47 172 PLING_QUERY 2237 0.56 0.87 0.47 173 TM2_M_BODY_EMPTY 2220 0.38 0.11 0.46 174 XM_B_REG_HTML 2217 0.54 0.77 0.46 175 XM_Body_Obfu01 2195 0.48 0.56 0.46 176 XMPhish30 2159 0.64 1.27 0.45 177 XMDateMe_00 2070 0.43 0.44 0.43 178 DKIM_ADSP_NXDOMAIN 2067 1.00 2.80 0.43 179 MISSING_HEADERS 2016 0.47 0.62 0.42 180 FORGED_GMAIL_RCVD 2001 0.53 0.87 0.42 181 T_MONEY_PERCENT 1999 0.54 0.93 0.42 182 TR_LOTS_OF_MONEY2 1999 0.54 0.93 0.42 183 FROM_GOV_DKIM_AU 1989 0.39 0.32 0.41 184 XMSubMetaSxObfu_02 1988 0.42 0.44 0.41 185 NUMERIC_HTTP_ADDR 1947 0.54 0.97 0.41 186 TR_LOTS_OF_MONEY3 1907 0.55 1.02 0.40 187 XM_shorewaves_Whitelist 1891 0.30 0.00 0.39 188 RCVD_IN_SORBS_DUL 1889 0.34 0.17 0.39 189 XMSubMetaI_00 1863 0.68 1.61 0.39 190 URI_NOVOWEL 1850 0.47 0.73 0.39 191 TVD_SPACE_RATIO 1846 0.35 0.22 0.38 192 XMSubMetaSxObfu_03 1829 0.55 1.08 0.38 193 REMOVE_BEFORE_LINK 1828 0.50 0.87 0.38 194 RDNS_DYNAMIC 1802 0.52 1.00 0.38 195 RELAYCOUNTRY_DE 1788 0.59 1.29 0.37 196 HTML_IMAGE_ONLY_28 1768 0.38 0.44 0.37 197 XMGappySubj_02 1752 0.30 0.08 0.36 198 HTML_IMAGE_ONLY_32 1734 0.36 0.35 0.36 199 FSL_THIS_IS_ADV 1708 0.40 0.56 0.36 200 SpammyFromTLD_02 1695 1.21 3.93 0.35 ----------------------------------------------------------------------