Email: 360896 Autolearn: 0 AvgScore: 2.75 AvgScanTime: 2.05 sec Spam: 92056 Autolearn: 0 AvgScore: 12.45 AvgScanTime: 2.58 sec Ham: 268840 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.87 sec Time Spent Running SA: 205.55 hours Time Spent Processing Spam: 65.99 hours Time Spent Processing Ham: 139.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86687 87.40 94.17 85.08 2 DKIM_SIGNED 76089 79.95 82.66 79.02 3 XM_DK_Pass 74654 78.64 81.10 77.80 4 DCC_CHECK 74379 56.55 80.80 48.24 5 XM_B_Unicode 71199 71.69 77.34 69.75 6 DKIM_VALID 70579 75.22 76.67 74.73 7 XMListUnsubscribeExists 69491 60.09 75.49 54.81 8 DKIM_VALID_AU 54671 58.41 59.39 58.08 9 XM_B_Unicode3 46780 46.80 50.82 45.42 10 XM_DK_Undo_02 45464 24.40 49.39 15.84 11 BAYES_99 37716 21.21 40.97 14.44 12 HTML_FONT_LOW_CONTRAST 36721 34.21 39.89 32.26 13 LOC_TINY_FONT_1 33176 30.90 36.04 29.13 14 BAYES_50 32075 47.47 34.84 51.80 15 BAYES_999 31426 18.23 34.14 12.79 16 TR_DCC_Bayes_99 29829 13.72 32.40 7.33 17 MIME_HTML_ONLY 29021 28.29 31.53 27.18 18 FVGT_m_MULTI_ODD 25175 22.97 27.35 21.47 19 XMSubLong 23405 24.70 25.42 24.46 20 XM_Body_Dirty_Words 20842 16.55 22.64 14.46 21 XM_Multi_Part_URI 20209 15.94 21.95 13.89 22 T_KAM_HTML_FONT_INVALID 18788 16.98 20.41 15.80 23 DKIM_VALID_EF 18450 26.92 20.04 29.28 24 BOTNET_IPINHOSTNAME 17279 9.09 18.77 5.77 25 RELAYCOUNTRY_META 17104 7.98 18.58 4.35 26 DCC_CHECK_NEGATIVE 16674 42.40 18.11 50.72 27 T_TM2_M_HEADER_IN_MSG 15916 21.79 17.29 23.34 28 MultiRelay 15174 17.13 16.48 17.35 29 HTML_IMAGE_RATIO_02 14140 11.28 15.36 9.88 30 BOTNET 13588 5.06 14.76 1.74 31 XM_UncommonTLD01 12360 7.25 13.43 5.14 32 XM_Evil_Numbers_Gen 12310 11.03 13.37 10.23 33 FSL_BULK_SIG 12203 11.37 13.26 10.72 34 LOTS_OF_MONEY 11779 13.03 12.80 13.11 35 UNTRUSTED_Relay 11210 4.22 12.18 1.49 36 HTML_IMAGE_RATIO_04 10372 9.07 11.27 8.32 37 XMSexyCombo_05 10193 7.44 11.07 6.19 38 T_XMDrugObfuBody_14 8343 7.70 9.06 7.23 39 SpammyFromTLD_02 8040 2.35 8.73 0.16 40 BAYES_80 7659 5.26 8.32 4.21 41 XMSubMetaSx_00 7521 5.95 8.17 5.19 42 XM_H_Long_From01 7330 6.81 7.96 6.41 43 LotsOfNums_01 7290 7.40 7.92 7.22 44 MPART_ALT_DIFF 6812 4.81 7.40 3.92 45 TooManyTo_001 6753 6.06 7.34 5.62 46 BAYES_60 5992 6.15 6.51 6.02 47 XM_B_SpammyTLD 5890 4.91 6.40 4.40 48 XM_B_Phish_Phrases 5875 5.93 6.38 5.77 49 XM_DIRTYINTL 5731 4.17 6.23 3.47 50 DKIM_INVALID 5510 4.72 5.99 4.29 51 RCVD_IN_MSPIKE_H2 5003 6.27 5.43 6.55 52 T_REMOTE_IMAGE 4976 4.02 5.41 3.55 53 XM_UB50 4913 2.04 5.34 0.91 54 XM_CamelCaseFrm001 4611 2.87 5.01 2.13 55 XMNumbers 4521 4.13 4.91 3.86 56 MIME_HTML_ONLY_MULTI 4401 2.66 4.78 1.94 57 MIME_HTML_MOSTLY 4316 2.99 4.69 2.41 58 XM_SendGrid 4281 6.83 4.65 7.57 59 MIME_QP_LONG_LINE 4252 4.44 4.62 4.38 60 KHOP_HELO_FCRDNS 4227 2.17 4.59 1.34 61 BAYES_95 4192 3.33 4.55 2.91 62 URI_HEX 4186 2.69 4.55 2.06 63 RELAYCOUNTRY_CA 3965 2.21 4.31 1.49 64 RCVD_IN_RP_SAFE 3797 11.51 4.12 14.04 65 FROM_EXCESS_BASE64 3782 4.10 4.11 4.09 66 NORDNS_LOW_CONTRAST 3753 1.04 4.08 0.00 67 US_DOLLARS_3 3553 4.34 3.86 4.51 68 XMBdyGiftCard01 3513 2.11 3.82 1.52 69 RCVD_IN_PSBL 3471 0.99 3.77 0.04 70 RCVD_IN_BL_SPAMCOP_NET 3382 1.27 3.67 0.44 71 HTML_IMAGE_RATIO_06 3248 3.48 3.53 3.47 72 XMStrtUSub 3182 4.28 3.46 4.57 73 XMSubMetaI_00 3069 1.72 3.33 1.16 74 MultiRelay_Combo 2907 0.92 3.16 0.15 75 MultiRelay_CC 2907 0.92 3.16 0.15 76 TM2_M_URI_OPT_OUT 2822 1.87 3.07 1.45 77 RELAYCOUNTRY_FR 2770 0.91 3.01 0.20 78 RCVD_IN_RP_CERTIFIED 2710 10.26 2.94 12.76 79 XM_SPF_SoftFail 2695 1.62 2.93 1.18 80 HTML_IMAGE_RATIO_08 2609 2.46 2.83 2.34 81 T_TooManySym_01 2586 6.58 2.81 7.87 82 XMSexyCombo_01 2576 1.78 2.80 1.44 83 SUBJ_ALL_CAPS 2564 2.57 2.79 2.49 84 BODY_URI_ONLY 2536 0.75 2.75 0.06 85 XMDiploma_00 2485 1.83 2.70 1.53 86 RCVD_IN_IADB_LISTED 2352 3.87 2.55 4.32 87 RCVD_IN_RP_RNBL 2336 0.68 2.54 0.04 88 TR_XM_DK_SendGrid 2260 3.31 2.46 3.61 89 FROM_MISSP_REPLYTO 2245 0.63 2.44 0.01 90 HTML_SHORT_LINK_IMG_1 2161 0.63 2.35 0.04 91 XM_URI_RBL 2143 0.93 2.33 0.45 92 NUMERIC_HTTP_ADDR 2089 0.80 2.27 0.30 93 TR_XM_PHPDW 2072 0.94 2.25 0.49 94 XM_UB99 2067 0.58 2.25 0.01 95 XM_OfRef6 2055 1.83 2.23 1.70 96 RCVD_IN_IADB_SPF 2049 3.32 2.23 3.69 97 REPLYTO_WITHOUT_TO_CC 2043 0.59 2.22 0.03 98 TR_XM_PHPForged 2040 0.92 2.22 0.48 99 TR_XM_FormFill2 2017 0.91 2.19 0.47 100 XM_H_PHPOS 2009 0.90 2.18 0.47 101 NO_DNS_FOR_FROM 2002 1.40 2.17 1.14 102 RCVD_IN_IADB_SENDERID 1968 2.93 2.14 3.20 103 HTML_IMAGE_ONLY_12 1966 0.66 2.14 0.16 104 RCVD_IN_IADB_DK 1962 2.84 2.13 3.08 105 HTML_MIME_NO_HTML_TAG 1913 3.58 2.08 4.09 106 MIME_HEADER_CTYPE_ONLY 1911 0.66 2.08 0.17 107 XMLongAddy 1909 0.56 2.07 0.04 108 NORMAL_HTTP_TO_IP 1894 0.56 2.06 0.04 109 XM_H_Long_From03 1810 0.54 1.97 0.05 110 XMGenDplmaNmb 1809 1.13 1.97 0.84 111 TM2_M_VERY_LONG_WORD 1808 1.33 1.96 1.11 112 XMPhish11 1803 1.18 1.96 0.91 113 URI_HEX_IP 1791 0.50 1.95 0.00 114 URI_TRY_3LD 1775 1.82 1.93 1.78 115 DKIM_ADSP_NXDOMAIN 1775 0.90 1.93 0.55 116 TR_XM_RelayPhish 1717 0.99 1.87 0.68 117 T_XMDrugObfuBody_00 1713 1.15 1.86 0.91 118 TR_Mismatch_TLD_02 1705 0.58 1.85 0.15 119 XM_UB999 1703 0.48 1.85 0.01 120 XMBody_17 1685 0.94 1.83 0.63 121 T_XMDrugObfuBody_08 1658 1.44 1.80 1.31 122 XMStockSpam_06 1652 1.76 1.79 1.75 123 TR_Symld_Words 1648 2.69 1.79 2.99 124 BAYES_40 1614 3.07 1.75 3.53 125 DIET_1 1583 0.73 1.72 0.39 126 XM_ProductURIs 1581 1.28 1.72 1.13 127 XM_H_Long_From02 1552 1.25 1.69 1.10 128 T_Symld_Words_02 1508 0.85 1.64 0.58 129 SpammyFromTLD_01 1476 0.70 1.60 0.39 130 RELAYCOUNTRY_AT 1449 0.54 1.57 0.19 131 FROM_SUSPICIOUS_NTLD 1382 0.40 1.50 0.02 132 XMSexyCombo_04 1377 1.04 1.50 0.89 133 FROM_SUSPICIOUS_NTLD_FP 1351 0.39 1.47 0.02 134 TR_LOTS_OF_MONEY2 1335 0.73 1.45 0.49 135 T_MONEY_PERCENT 1335 0.73 1.45 0.49 136 XM_UB60 1332 0.42 1.45 0.07 137 SUBJ_DOLLARS 1308 0.97 1.42 0.81 138 ALL_TRUSTED 1296 12.70 1.41 16.57 139 XMBrknScrpt_02 1277 0.82 1.39 0.62 140 XM_H_PHPMailer 1248 0.69 1.36 0.46 141 T_FILL_THIS_FORM_SHORT 1243 0.89 1.35 0.73 142 XMHTMLBadTable_001 1184 0.70 1.29 0.50 143 T_XMHurry_00 1181 0.95 1.28 0.83 144 BAYES_20 1180 2.31 1.28 2.67 145 URIBL_BLACK 1146 0.36 1.24 0.05 146 RCVD_IN_MSPIKE_WL 1129 3.95 1.23 4.88 147 XMPhish30 1123 0.75 1.22 0.58 148 BOTNET_NORDNS 1091 0.31 1.19 0.02 149 RCVD_IN_MSPIKE_H3 1089 3.91 1.18 4.85 150 XM_H_PHPOS_M 1078 0.46 1.17 0.21 151 XMSubMetaSSx_00 1076 0.51 1.17 0.29 152 XMBody_78 1073 0.67 1.17 0.50 153 XM_B_REG_HTML 1070 0.81 1.16 0.69 154 XMSlimDrugH 1066 0.60 1.16 0.41 155 MAILING_LIST_MULTI 1061 1.59 1.15 1.74 156 UNPARSEABLE_RELAY 1007 3.12 1.09 3.81 157 XM_UB80 1005 0.30 1.09 0.03 158 RDNS_DYNAMIC 996 0.66 1.08 0.52 159 XMMoneyMeta_00 984 0.42 1.07 0.19 160 TR_LOTS_OF_MONEY3 958 0.66 1.04 0.53 161 BAYES_00 944 9.45 1.03 12.34 162 THIS_AD 940 0.77 1.02 0.68 163 URIBL_DBL_SPAM 926 0.28 1.01 0.03 164 HTML_FONT_FACE_BAD 908 0.60 0.99 0.47 165 HTML_TAG_BALANCE_BODY 893 0.72 0.97 0.63 166 TooManyTo_002 853 1.06 0.93 1.11 167 XMHTML_After_End 845 0.51 0.92 0.37 168 RCVD_IN_IADB_VOUCHED 843 2.47 0.92 3.01 169 TR_Caps_n_Bayes_99 835 0.59 0.91 0.49 170 XM_RXBody 826 0.49 0.90 0.35 171 PLING_QUERY 823 0.54 0.89 0.42 172 XMSubMetaSxObfu_03 821 1.30 0.89 1.43 173 XM_B_COPY_HTML 814 0.66 0.88 0.58 174 XM_BadFromFormat 813 0.35 0.88 0.17 175 LongTLD 804 0.31 0.87 0.11 176 MONEY_FROM_MISSP 796 0.22 0.86 0.01 177 DATE_IN_PAST_12_24 795 0.26 0.86 0.06 178 URI_NOVOWEL 784 0.56 0.85 0.46 179 TVD_RCVD_IP 771 2.84 0.84 3.52 180 URIBL_DBL_ABUSE_REDIR 763 0.22 0.83 0.00 181 TM2_M_A_HREF_HREF 762 1.38 0.83 1.56 182 RELAYCOUNTRY_DE 760 0.61 0.83 0.53 183 RELAYCOUNTRY_NL 754 0.32 0.82 0.15 184 FVGT_m_MULTI_ODD_EMAIL 740 0.22 0.80 0.02 185 RELAYCOUNTRY_GB 732 0.58 0.80 0.51 186 LOADSA_MONEY_COMBO 731 0.30 0.79 0.13 187 TooManyTo_003 708 0.77 0.77 0.77 188 BODY_ENHANCEMENT 706 0.21 0.77 0.02 189 XM_DK_Undo_01 704 1.23 0.76 1.39 190 DKIM_ADSP_CUSTOM_MED 703 0.75 0.76 0.74 191 RELAYCOUNTRY_EC 693 0.19 0.75 0.00 192 HK_RANDOM_REPLYTO 686 0.36 0.75 0.23 193 TR_XM_DK_Bayes 685 8.38 0.74 10.99 194 MPART_ALT_DIFF_COUNT 676 0.46 0.73 0.36 195 RCVD_IN_MSPIKE_BL 667 0.20 0.72 0.02 196 HTTPS_HTTP_MISMATCH 655 0.50 0.71 0.43 197 XMSubMetaSx_01 649 0.93 0.71 1.01 198 FILL_THIS_FORM 640 0.62 0.70 0.59 199 RELAYCOUNTRY_TR 636 0.18 0.69 0.01 200 RCVD_IN_MSPIKE_L5 618 0.18 0.67 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 228721 87.40 94.17 85.08 2 DKIM_SIGNED 212438 79.95 82.66 79.02 3 XM_DK_Pass 209157 78.64 81.10 77.80 4 DKIM_VALID 200897 75.22 76.67 74.73 5 XM_B_Unicode 187514 71.69 77.34 69.75 6 DKIM_VALID_AU 156145 58.41 59.39 58.08 7 XMListUnsubscribeExists 147354 60.09 75.49 54.81 8 BAYES_50 139246 47.47 34.84 51.80 9 DCC_CHECK_NEGATIVE 136348 42.40 18.11 50.72 10 DCC_CHECK 129696 56.55 80.80 48.24 11 XM_B_Unicode3 122119 46.80 50.82 45.42 12 HTML_FONT_LOW_CONTRAST 86738 34.21 39.89 32.26 13 DKIM_VALID_EF 78712 26.92 20.04 29.28 14 LOC_TINY_FONT_1 78324 30.90 36.04 29.13 15 MIME_HTML_ONLY 73074 28.29 31.53 27.18 16 XMSubLong 65746 24.70 25.42 24.46 17 T_TM2_M_HEADER_IN_MSG 62739 21.79 17.29 23.34 18 FVGT_m_MULTI_ODD 57710 22.97 27.35 21.47 19 MultiRelay 46635 17.13 16.48 17.35 20 ALL_TRUSTED 44548 12.70 1.41 16.57 21 XM_DK_Undo_02 42593 24.40 49.39 15.84 22 T_KAM_HTML_FONT_INVALID 42475 16.98 20.41 15.80 23 XM_Body_Dirty_Words 38885 16.55 22.64 14.46 24 BAYES_99 38814 21.21 40.97 14.44 25 RCVD_IN_RP_SAFE 37734 11.51 4.12 14.04 26 XM_Multi_Part_URI 37331 15.94 21.95 13.89 27 LOTS_OF_MONEY 35256 13.03 12.80 13.11 28 BAYES_999 34381 18.23 34.14 12.79 29 RCVD_IN_RP_CERTIFIED 34306 10.26 2.94 12.76 30 BAYES_00 33178 9.45 1.03 12.34 31 XM_DKIMWhitelistDomains 30441 8.51 0.29 11.32 32 TR_XM_DK_Bayes 29549 8.38 0.74 10.99 33 FSL_BULK_SIG 28826 11.37 13.26 10.72 34 TR_XM_DK_Bayes1 28350 8.02 0.66 10.55 35 XM_Evil_Numbers_Gen 27509 11.03 13.37 10.23 36 HTML_IMAGE_RATIO_02 26570 11.28 15.36 9.88 37 TR_XM_DK_Bayes2 23565 6.68 0.58 8.77 38 HTML_IMAGE_RATIO_04 22361 9.07 11.27 8.32 39 T_TooManySym_01 21163 6.58 2.81 7.87 40 XM_SendGrid 20359 6.83 4.65 7.57 41 TR_DCC_Bayes_99 19701 13.72 32.40 7.33 42 T_XMDrugObfuBody_14 19441 7.70 9.06 7.23 43 LotsOfNums_01 19399 7.40 7.92 7.22 44 RCVD_IN_MSPIKE_H2 17615 6.27 5.43 6.55 45 XM_H_Long_From01 17237 6.81 7.96 6.41 46 TO_MALFORMED 17104 4.74 0.00 6.36 47 XMSexyCombo_05 16645 7.44 11.07 6.19 48 BAYES_60 16195 6.15 6.51 6.02 49 BOTNET_IPINHOSTNAME 15525 9.09 18.77 5.77 50 XM_B_Phish_Phrases 15523 5.93 6.38 5.77 51 TooManyTo_001 15101 6.06 7.34 5.62 52 XMSubMetaSx_00 13942 5.95 8.17 5.19 53 XM_UncommonTLD01 13816 7.25 13.43 5.14 54 RCVD_IN_MSPIKE_WL 13126 3.95 1.23 4.88 55 RCVD_IN_MSPIKE_H3 13032 3.91 1.18 4.85 56 XMStrtUSub 12274 4.28 3.46 4.57 57 US_DOLLARS_3 12123 4.34 3.86 4.51 58 XM_B_SpammyTLD 11820 4.91 6.40 4.40 59 MIME_QP_LONG_LINE 11778 4.44 4.62 4.38 60 RELAYCOUNTRY_META 11698 7.98 18.58 4.35 61 RCVD_IN_IADB_LISTED 11603 3.87 2.55 4.32 62 DKIM_INVALID 11541 4.72 5.99 4.29 63 BAYES_80 11311 5.26 8.32 4.21 64 HTML_MIME_NO_HTML_TAG 11002 3.58 2.08 4.09 65 FROM_EXCESS_BASE64 10998 4.10 4.11 4.09 66 INVALID_MSGID 10583 2.95 0.08 3.94 67 MPART_ALT_DIFF 10541 4.81 7.40 3.92 68 XMNumbers 10386 4.13 4.91 3.86 69 UNPARSEABLE_RELAY 10237 3.12 1.09 3.81 70 RCVD_IN_IADB_SPF 9933 3.32 2.23 3.69 71 TR_XM_DK_SendGrid 9698 3.31 2.46 3.61 72 T_REMOTE_IMAGE 9533 4.02 5.41 3.55 73 BAYES_40 9482 3.07 1.75 3.53 74 TVD_RCVD_IP 9471 2.84 0.84 3.52 75 IN_ZIMBRA_NJ_WHITELIST 9432 2.62 0.01 3.51 76 XM_DIRTYINTL 9331 4.17 6.23 3.47 77 HTML_IMAGE_RATIO_06 9322 3.48 3.53 3.47 78 T_TooManySym_02 8618 2.53 0.56 3.21 79 RCVD_IN_IADB_SENDERID 8601 2.93 2.14 3.20 80 RCVD_IN_IADB_DK 8271 2.84 2.13 3.08 81 RCVD_IN_IADB_VOUCHED 8080 2.47 0.92 3.01 82 TR_Symld_Words 8043 2.69 1.79 2.99 83 CK_HELO_DYNAMIC_SPLIT_IP 8035 2.35 0.50 2.99 84 HELO_DYNAMIC_IPADDR2 8033 2.29 0.26 2.99 85 BAYES_95 7819 3.33 4.55 2.91 86 HTML_FONT_SIZE_HUGE 7392 2.18 0.50 2.75 87 BAYES_20 7170 2.31 1.28 2.67 88 USER_IN_DEF_DKIM_WL 6924 1.92 0.02 2.58 89 HTTP_ESCAPED_HOST 6897 1.92 0.04 2.57 90 SUBJ_ALL_CAPS 6704 2.57 2.79 2.49 91 TR_MetaPhish_Combo_01 6655 1.98 0.53 2.48 92 MIME_HTML_MOSTLY 6483 2.99 4.69 2.41 93 HTML_IMAGE_RATIO_08 6284 2.46 2.83 2.34 94 XM_CamelCaseFrm001 5733 2.87 5.01 2.13 95 URI_HEX 5534 2.69 4.55 2.06 96 RCVD_IN_IADB_OPTIN 5370 1.62 0.52 2.00 97 MIME_HTML_ONLY_MULTI 5215 2.66 4.78 1.94 98 XM_PDF 5047 1.50 0.39 1.88 99 BAYES_05 4821 1.48 0.57 1.79 100 URI_TRY_3LD 4780 1.82 1.93 1.78 101 IN_HORDE_ADDRESS_BOOK 4720 1.32 0.04 1.76 102 XMStockSpam_06 4706 1.76 1.79 1.75 103 BOTNET 4682 5.06 14.76 1.74 104 MAILING_LIST_MULTI 4669 1.59 1.15 1.74 105 XM_OfRef6 4560 1.83 2.23 1.70 106 TM2_M_A_HREF_HREF 4203 1.38 0.83 1.56 107 XMDiploma_00 4110 1.83 2.70 1.53 108 XMBdyGiftCard01 4096 2.11 3.82 1.52 109 UNTRUSTED_Relay 4014 4.22 12.18 1.49 110 RELAYCOUNTRY_CA 4006 2.21 4.31 1.49 111 TM2_M_URI_OPT_OUT 3910 1.87 3.07 1.45 112 XMSexyCombo_01 3860 1.78 2.80 1.44 113 XMSubMetaSxObfu_03 3856 1.30 0.89 1.43 114 XM_DK_Undo_01 3734 1.23 0.76 1.39 115 XMGappySubj_01 3696 1.09 0.26 1.37 116 KHOP_HELO_FCRDNS 3607 2.17 4.59 1.34 117 BOUNCE_MESSAGE 3582 1.04 0.18 1.33 118 ANY_BOUNCE_MESSAGE 3582 1.04 0.18 1.33 119 T_XMDrugObfuBody_08 3531 1.44 1.80 1.31 120 XM_D_tchamptons_WL 3198 0.89 0.00 1.19 121 XM_SPF_SoftFail 3166 1.62 2.93 1.18 122 XMSubMetaI_00 3131 1.72 3.33 1.16 123 NO_DNS_FOR_FROM 3056 1.40 2.17 1.14 124 XM_GoogleGroups 3038 0.95 0.41 1.13 125 XM_ProductURIs 3038 1.28 1.72 1.13 126 TM2_M_VERY_LONG_WORD 2992 1.33 1.96 1.11 127 TooManyTo_002 2989 1.06 0.93 1.11 128 XM_H_Long_From02 2954 1.25 1.69 1.10 129 XMSubMetaSx_01 2709 0.93 0.71 1.01 130 T_XMDrugObfuBody_00 2452 1.15 1.86 0.91 131 XMPhish11 2446 1.18 1.96 0.91 132 XM_UB50 2442 2.04 5.34 0.91 133 XMSexyCombo_04 2380 1.04 1.50 0.89 134 XMBody_95 2283 0.66 0.09 0.85 135 XMGenDplmaNmb 2261 1.13 1.97 0.84 136 USER_IN_WHITELIST 2243 0.62 0.00 0.83 137 T_XMHurry_00 2234 0.95 1.28 0.83 138 XMSexyCombo_02 2202 0.71 0.37 0.82 139 SUBJ_DOLLARS 2178 0.97 1.42 0.81 140 TooManyTo_003 2061 0.77 0.77 0.77 141 DKIM_ADSP_CUSTOM_MED 1986 0.75 0.76 0.74 142 XMSubMetaSxObfu_02 1971 0.70 0.61 0.73 143 T_FILL_THIS_FORM_SHORT 1971 0.89 1.35 0.73 144 XM_B_REG_HTML 1844 0.81 1.16 0.69 145 TR_XM_RelayPhish 1841 0.99 1.87 0.68 146 THIS_AD 1822 0.77 1.02 0.68 147 HTML_TAG_BALANCE_BODY 1700 0.72 0.97 0.63 148 XMBody_17 1694 0.94 1.83 0.63 149 HELO_NODOT 1687 0.59 0.46 0.63 150 HELO_NO_DOMAIN 1686 0.59 0.46 0.63 151 T_TooManySym_03 1677 0.51 0.19 0.62 152 XMBrknScrpt_02 1668 0.82 1.39 0.62 153 TooManyTo_004 1638 0.62 0.64 0.61 154 FILL_THIS_FORM 1596 0.62 0.70 0.59 155 XMPhish30 1572 0.75 1.22 0.58 156 XM_B_COPY_HTML 1564 0.66 0.88 0.58 157 T_Symld_Words_02 1551 0.85 1.64 0.58 158 DKIM_ADSP_NXDOMAIN 1486 0.90 1.93 0.55 159 TR_LOTS_OF_MONEY3 1433 0.66 1.04 0.53 160 TooManyTo_005 1429 0.53 0.53 0.53 161 RELAYCOUNTRY_DE 1424 0.61 0.83 0.53 162 NML_ADSP_CUSTOM_MED 1424 0.54 0.55 0.53 163 RDNS_DYNAMIC 1391 0.66 1.08 0.52 164 RELAYCOUNTRY_GB 1377 0.58 0.80 0.51 165 FILL_THIS_FORM_LOAN 1372 0.43 0.19 0.51 166 FILL_THIS_FORM_LONG 1369 0.52 0.57 0.51 167 XMHTMLBadTable_001 1339 0.70 1.29 0.50 168 XMBody_78 1334 0.67 1.17 0.50 169 TR_XM_PHPDW 1319 0.94 2.25 0.49 170 T_MONEY_PERCENT 1315 0.73 1.45 0.49 171 TR_LOTS_OF_MONEY2 1315 0.73 1.45 0.49 172 TR_Caps_n_Bayes_99 1311 0.59 0.91 0.49 173 XMBSHREFv2 1291 0.49 0.52 0.48 174 TR_XM_PHPForged 1284 0.92 2.22 0.48 175 TR_XM_FormFill2 1263 0.91 2.19 0.47 176 XM_H_PHPOS 1257 0.90 2.18 0.47 177 HTML_FONT_FACE_BAD 1256 0.60 0.99 0.47 178 XM_H_PHPMailer 1240 0.69 1.36 0.46 179 URI_NOVOWEL 1233 0.56 0.85 0.46 180 XM_URI_RBL 1207 0.93 2.33 0.45 181 RCVD_IN_BL_SPAMCOP_NET 1192 1.27 3.67 0.44 182 RELAYCOUNTRY_AU 1173 0.42 0.36 0.44 183 HTTPS_HTTP_MISMATCH 1166 0.50 0.71 0.43 184 PLING_QUERY 1128 0.54 0.89 0.42 185 XMSlimDrugH 1109 0.60 1.16 0.41 186 UPPERCASE_50_75 1106 0.38 0.27 0.41 187 XMPhish14 1083 0.39 0.36 0.40 188 DIET_1 1058 0.73 1.72 0.39 189 TM2_M_BODY_EMPTY 1049 0.31 0.06 0.39 190 SpammyFromTLD_01 1045 0.70 1.60 0.39 191 XMCapTrack 1043 0.33 0.16 0.39 192 XMLngstWrd_00 1036 0.34 0.23 0.39 193 FORGED_GMAIL_RCVD 1021 0.44 0.62 0.38 194 XMHTML_After_End 1001 0.51 0.92 0.37 195 MPART_ALT_DIFF_COUNT 978 0.46 0.73 0.36 196 XMLngstWrd_01 940 0.31 0.20 0.35 197 XM_RXBody 935 0.49 0.90 0.35 198 XM_Walgreens_Forge 931 0.26 0.01 0.35 199 XMNoVowels 914 0.36 0.40 0.34 200 XMGappySubj_02 899 0.26 0.04 0.33 ----------------------------------------------------------------------