Email: 629164 Autolearn: 0 AvgScore: 1.21 AvgScanTime: 2.12 sec Spam: 96473 Autolearn: 0 AvgScore: 11.90 AvgScanTime: 2.92 sec Ham: 532691 Autolearn: 0 AvgScore: -0.72 AvgScanTime: 1.98 sec Time Spent Running SA: 370.45 hours Time Spent Processing Spam: 78.13 hours Time Spent Processing Ham: 292.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89967 88.70 93.26 87.87 2 DCC_CHECK 75061 49.86 77.81 44.80 3 DKIM_SIGNED 68977 75.84 71.50 76.62 4 XM_B_Unicode 67068 69.10 69.52 69.02 5 XM_DK_Pass 65906 74.17 68.32 75.23 6 XMListUnsubscribeExists 63718 56.09 66.05 54.29 7 DKIM_VALID 62143 70.60 64.41 71.73 8 BAYES_50 49449 50.48 51.26 50.34 9 DKIM_VALID_AU 46423 52.50 48.12 53.29 10 XM_B_Unicode3 41740 41.02 43.27 40.61 11 MIME_HTML_ONLY 37942 23.58 39.33 20.72 12 RELAYCOUNTRY_META 29632 9.81 30.72 6.03 13 LOC_TINY_FONT_1 28246 25.43 29.28 24.73 14 HTML_FONT_LOW_CONTRAST 28023 29.18 29.05 29.20 15 XM_DK_Undo_02 27891 8.80 28.91 5.15 16 XMSubLong 24190 23.57 25.07 23.30 17 FVGT_m_MULTI_ODD 22114 21.98 22.92 21.81 18 DKIM_VALID_EF 21956 25.78 22.76 26.33 19 XM_Body_Dirty_Words 20508 14.83 21.26 13.66 20 DCC_CHECK_NEGATIVE 19624 48.04 20.34 53.06 21 BOTNET 19559 5.11 20.27 2.37 22 BOTNET_IPINHOSTNAME 19147 7.50 19.85 5.27 23 MultiRelay 17892 18.14 18.55 18.06 24 UNTRUSTED_Relay 17651 4.48 18.30 1.98 25 T_KAM_HTML_FONT_INVALID 17579 18.05 18.22 18.02 26 BAYES_99 17278 4.67 17.91 2.27 27 FSL_BULK_SIG 16718 8.69 17.33 7.13 28 T_TM2_M_HEADER_IN_MSG 16637 27.86 17.25 29.78 29 XM_Multi_Part_URI 15312 12.40 15.87 11.78 30 XM_UncommonTLD01 14380 5.31 14.91 3.57 31 TR_DCC_Bayes_99 13874 3.07 14.38 1.03 32 BAYES_999 13422 3.68 13.91 1.83 33 LOTS_OF_MONEY 13277 9.70 13.76 8.97 34 HTML_IMAGE_RATIO_02 11934 8.83 12.37 8.19 35 XM_Evil_Numbers_Gen 11342 10.39 11.76 10.15 36 XMSexyCombo_05 11339 5.64 11.75 4.53 37 TooManyTo_001 10762 8.35 11.16 7.84 38 T_REMOTE_IMAGE 9887 4.84 10.25 3.86 39 XMSubMetaSx_00 9751 4.83 10.11 3.87 40 SpammyFromTLD_02 9163 1.83 9.50 0.44 41 XM_UB50 9112 2.35 9.45 1.07 42 T_XMDrugObfuBody_14 8794 8.39 9.12 8.26 43 XMNumbers 7738 4.12 8.02 3.41 44 LotsOfNums_01 7550 8.37 7.83 8.47 45 BODY_URI_ONLY 7464 1.28 7.74 0.11 46 MPART_ALT_DIFF 7443 4.36 7.72 3.76 47 KHOP_HELO_FCRDNS 7355 2.81 7.62 1.94 48 HDRS_LCASE_IMGONLY 7353 1.22 7.62 0.06 49 HTML_SHORT_LINK_IMG_1 7219 1.19 7.48 0.05 50 XM_DIRTYINTL 6893 3.61 7.15 2.97 51 DKIM_INVALID 6834 5.23 7.08 4.90 52 XM_H_Long_From01 6826 6.58 7.08 6.49 53 HTML_IMAGE_RATIO_04 6780 6.06 7.03 5.88 54 XM_B_Phish_Phrases 6595 5.97 6.84 5.81 55 HTML_MIME_NO_HTML_TAG 6299 3.00 6.53 2.36 56 RCVD_IN_MSPIKE_H2 6123 6.97 6.35 7.08 57 RELAYCOUNTRY_FR 6012 1.33 6.23 0.44 58 BAYES_80 5769 2.37 5.98 1.71 59 BAYES_40 5236 6.64 5.43 6.86 60 HTML_IMAGE_ONLY_12 5181 0.96 5.37 0.16 61 RELAYCOUNTRY_GB 5095 1.75 5.28 1.11 62 MIME_HEADER_CTYPE_ONLY 5006 0.91 5.19 0.14 63 XMLongAddy 5002 0.84 5.18 0.06 64 MIME_QP_LONG_LINE 4797 6.12 4.97 6.33 65 XM_SPF_SoftFail 4796 2.33 4.97 1.85 66 XM_URI_RBL 4577 1.01 4.74 0.33 67 BAYES_20 4513 5.44 4.68 5.58 68 BAYES_00 4450 21.86 4.61 24.98 69 BAYES_60 4444 3.59 4.61 3.40 70 XMStrtUSub 4378 4.11 4.54 4.03 71 RELAYCOUNTRY_CA 4324 2.18 4.48 1.77 72 MIME_HTML_ONLY_MULTI 4170 2.42 4.32 2.07 73 XM_B_SpammyTLD 4117 3.49 4.27 3.35 74 TM2_M_URI_OPT_OUT 4070 3.10 4.22 2.90 75 HTML_IMAGE_RATIO_06 3946 3.77 4.09 3.71 76 RCVD_IN_BL_SPAMCOP_NET 3707 1.43 3.84 0.99 77 MIME_HTML_MOSTLY 3525 2.78 3.65 2.62 78 XMSexyCombo_01 3503 1.01 3.63 0.54 79 DKIM_ADSP_NXDOMAIN 3456 1.04 3.58 0.58 80 XM_CamelCaseFrm001 3442 2.27 3.57 2.03 81 MultiRelay_Combo 3384 0.75 3.51 0.25 82 MultiRelay_CC 3384 0.75 3.51 0.25 83 ALL_TRUSTED 3371 13.47 3.49 15.27 84 BOTNET_NORDNS 3174 0.55 3.29 0.06 85 XMDiploma_00 3169 1.79 3.28 1.52 86 XM_SendGrid 3147 5.53 3.26 5.94 87 T_XMDrugObfuBody_08 3034 1.71 3.14 1.45 88 RCVD_IN_RP_RNBL 2982 0.53 3.09 0.07 89 XM_OfRef6 2878 1.64 2.98 1.40 90 BAYES_95 2855 1.27 2.96 0.97 91 XM_BadFromFormat 2833 0.56 2.94 0.13 92 SpammyFromTLD_01 2804 1.26 2.91 0.96 93 FVGT_m_MULTI_ODD_EMAIL 2745 0.46 2.85 0.02 94 HTML_IMAGE_RATIO_08 2737 2.54 2.84 2.49 95 FROM_EXCESS_BASE64 2678 3.22 2.78 3.30 96 TR_XM_PHPDW 2621 1.35 2.72 1.11 97 TR_XM_PHPForged 2582 1.34 2.68 1.09 98 TR_XM_FormFill2 2573 1.33 2.67 1.09 99 XM_H_PHPOS 2571 1.33 2.66 1.09 100 XMMoneyMeta_00 2523 1.03 2.62 0.74 101 HTML_IMAGE_ONLY_08 2506 0.51 2.60 0.13 102 US_DOLLARS_3 2495 1.20 2.59 0.94 103 NO_DNS_FOR_FROM 2479 1.38 2.57 1.17 104 SUBJ_ALL_CAPS 2464 1.85 2.55 1.72 105 RELAYCOUNTRY_DE 2445 0.96 2.53 0.67 106 URI_HEX 2442 1.94 2.53 1.83 107 T_TooManySym_01 2430 5.11 2.52 5.58 108 BAYES_05 2258 3.47 2.34 3.67 109 MISSING_HEADERS 2173 0.73 2.25 0.45 110 REPLYTO_WITHOUT_TO_CC 2164 0.39 2.24 0.05 111 URIBL_DBL_ABUSE_REDIR 2040 0.34 2.11 0.01 112 RCVD_IN_IADB_LISTED 1995 4.92 2.07 5.44 113 XMSubMetaI_00 1937 0.96 2.01 0.77 114 DIET_1 1928 0.58 2.00 0.32 115 RCVD_IN_IADB_SPF 1853 4.30 1.92 4.74 116 RCVD_IN_PSBL 1809 0.33 1.88 0.05 117 RCVD_IN_IADB_DK 1807 3.73 1.87 4.07 118 RCVD_IN_IADB_SENDERID 1803 3.80 1.87 4.15 119 TR_Symld_Words 1785 1.52 1.85 1.46 120 RELAYCOUNTRY_NL 1738 0.40 1.80 0.14 121 BASE64_LENGTH_79_INF 1727 0.46 1.79 0.21 122 XMGenDplmaNmb 1689 1.12 1.75 1.00 123 TR_XM_RelayPhish 1643 1.00 1.70 0.88 124 TR_LOTS_OF_MONEY2 1610 0.52 1.67 0.32 125 T_MONEY_PERCENT 1610 0.52 1.67 0.32 126 T_Symld_Words_02 1606 0.97 1.66 0.84 127 SHORT_URI_3 1599 0.29 1.66 0.04 128 TM2_M_VERY_LONG_WORD 1587 1.41 1.65 1.36 129 TooManyTo_002 1568 1.87 1.63 1.92 130 RELAYCOUNTRY_JP 1564 0.28 1.62 0.04 131 XMBody_17 1476 0.80 1.53 0.66 132 XMPhish11 1467 1.24 1.52 1.19 133 XM_UB60 1464 0.27 1.52 0.05 134 TR_XM_DK_SendGrid 1458 2.95 1.51 3.21 135 SHORT_URI_4 1437 0.24 1.49 0.01 136 T_XMHurry_00 1415 0.96 1.47 0.87 137 TooManyTo_003 1399 1.32 1.45 1.30 138 TR_XM_DK_Bayes 1391 17.45 1.44 20.34 139 RDNS_DYNAMIC 1378 0.54 1.43 0.38 140 XMStockSpam_06 1354 1.36 1.40 1.36 141 T_XMDrugObfuBody_00 1349 0.85 1.40 0.75 142 TR_Mismatch_TLD_01 1345 0.38 1.39 0.19 143 RCVD_IN_RP_SAFE 1334 8.25 1.38 9.49 144 MAILING_LIST_MULTI 1295 2.24 1.34 2.40 145 XMBody_78 1276 0.58 1.32 0.45 146 RCVD_IN_MSPIKE_WL 1272 4.74 1.32 5.36 147 URIBL_BLACK 1264 0.23 1.31 0.04 148 FROM_LOCAL_NOVOWEL 1262 0.22 1.31 0.02 149 TooManyTo_004 1243 1.01 1.29 0.96 150 XM_H_Long_From02 1240 1.28 1.29 1.28 151 TR_LOTS_OF_MONEY3 1235 0.62 1.28 0.50 152 XMPhish30 1229 0.72 1.27 0.62 153 T_FILL_THIS_FORM_SHORT 1224 1.14 1.27 1.12 154 RCVD_IN_MSPIKE_H3 1220 4.37 1.26 4.93 155 FROM_SUSPICIOUS_NTLD 1215 0.23 1.26 0.04 156 PLING_QUERY 1210 0.59 1.25 0.46 157 XMSexyCombo_04 1207 0.29 1.25 0.11 158 TR_XM_DK_Bayes1 1175 16.64 1.22 19.43 159 THIS_AD 1173 0.60 1.22 0.49 160 XMHTML_After_End 1172 0.55 1.21 0.43 161 XM_DK_Undo_01 1164 1.57 1.21 1.63 162 DATE_IN_PAST_12_24 1163 0.28 1.21 0.11 163 XMBrknScrpt_02 1158 0.64 1.20 0.54 164 NORDNS_LOW_CONTRAST 1138 0.19 1.18 0.01 165 HK_RANDOM_REPLYTO 1138 0.35 1.18 0.20 166 FROM_SUSPICIOUS_NTLD_FP 1135 0.21 1.18 0.03 167 TooManyTo_005 1125 0.86 1.17 0.80 168 XM_H_PHPMailer 1098 0.59 1.14 0.49 169 TR_Mismatch_TLD_02 1088 0.24 1.13 0.08 170 MPART_ALT_DIFF_COUNT 1081 0.37 1.12 0.24 171 XMBdyGiftCard01 1081 1.19 1.12 1.21 172 UNPARSEABLE_RELAY 1071 2.21 1.11 2.41 173 DKIM_ADSP_CUSTOM_MED 1070 0.96 1.11 0.94 174 T_HTML_TAG_BALANCE_CENTER 1060 0.36 1.10 0.23 175 XM_Combo_Sbj 1051 0.41 1.09 0.29 176 URI_TRY_3LD 1051 1.32 1.09 1.36 177 URIBL_SBL_A 1048 0.31 1.09 0.17 178 DATE_IN_PAST_06_12 1036 0.23 1.07 0.08 179 XM_XX_Yahoo 1023 0.28 1.06 0.14 180 XM_UB80 1018 0.18 1.06 0.02 181 HELO_NODOT 1012 1.58 1.05 1.67 182 HELO_NO_DOMAIN 1011 1.58 1.05 1.67 183 XMSubMetaSxObfu_03 993 0.50 1.03 0.40 184 TR_XM_SEO3 912 0.34 0.95 0.23 185 XM_H_Undi_Recip 894 0.33 0.93 0.23 186 TR_XM_DK_Bayes2 893 13.93 0.93 16.29 187 XM_H_PHPOS_M 892 0.30 0.92 0.19 188 XMPhish14 878 0.49 0.91 0.41 189 RELAYCOUNTRY_AT 876 0.32 0.91 0.21 190 XMSubMetaSx_01 869 0.24 0.90 0.12 191 FORGED_GMAIL_RCVD 861 0.54 0.89 0.48 192 NUMERIC_HTTP_ADDR 846 0.30 0.88 0.20 193 LongTLD 841 0.29 0.87 0.18 194 DATE_IN_PAST_03_06 839 0.26 0.87 0.15 195 RELAYCOUNTRY_IN 830 0.24 0.86 0.13 196 URIBL_DBL_SPAM 829 0.16 0.86 0.04 197 MONEY_FRAUD_5 825 0.13 0.86 0.00 198 XM_PDF 822 3.93 0.85 4.49 199 HTML_IMAGE_ONLY_28 821 0.48 0.85 0.42 200 NML_ADSP_CUSTOM_MED 807 0.69 0.84 0.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 468084 88.70 93.26 87.87 2 DKIM_SIGNED 408154 75.84 71.50 76.62 3 XM_DK_Pass 400724 74.17 68.32 75.23 4 DKIM_VALID 382074 70.60 64.41 71.73 5 XM_B_Unicode 367677 69.10 69.52 69.02 6 XMListUnsubscribeExists 289209 56.09 66.05 54.29 7 DKIM_VALID_AU 283875 52.50 48.12 53.29 8 DCC_CHECK_NEGATIVE 282624 48.04 20.34 53.06 9 BAYES_50 268155 50.48 51.26 50.34 10 DCC_CHECK 238660 49.86 77.81 44.80 11 XM_B_Unicode3 216342 41.02 43.27 40.61 12 T_TM2_M_HEADER_IN_MSG 158638 27.86 17.25 29.78 13 HTML_FONT_LOW_CONTRAST 155560 29.18 29.05 29.20 14 DKIM_VALID_EF 140252 25.78 22.76 26.33 15 BAYES_00 133062 21.86 4.61 24.98 16 LOC_TINY_FONT_1 131757 25.43 29.28 24.73 17 XMSubLong 124095 23.57 25.07 23.30 18 FVGT_m_MULTI_ODD 116199 21.98 22.92 21.81 19 MIME_HTML_ONLY 110396 23.58 39.33 20.72 20 TR_XM_DK_Bayes 108370 17.45 1.44 20.34 21 TR_XM_DK_Bayes1 103512 16.64 1.22 19.43 22 MultiRelay 96211 18.14 18.55 18.06 23 T_KAM_HTML_FONT_INVALID 95988 18.05 18.22 18.02 24 TR_XM_DK_Bayes2 86749 13.93 0.93 16.29 25 ALL_TRUSTED 81348 13.47 3.49 15.27 26 XM_Body_Dirty_Words 72775 14.83 21.26 13.66 27 XM_Multi_Part_URI 62727 12.40 15.87 11.78 28 XM_Evil_Numbers_Gen 54056 10.39 11.76 10.15 29 RCVD_IN_RP_SAFE 50549 8.25 1.38 9.49 30 LOTS_OF_MONEY 47758 9.70 13.76 8.97 31 LotsOfNums_01 45110 8.37 7.83 8.47 32 T_XMDrugObfuBody_14 43979 8.39 9.12 8.26 33 HTML_IMAGE_RATIO_02 43652 8.83 12.37 8.19 34 RCVD_IN_RP_CERTIFIED 42089 6.77 0.52 7.90 35 TooManyTo_001 41753 8.35 11.16 7.84 36 FSL_BULK_SIG 37986 8.69 17.33 7.13 37 RCVD_IN_MSPIKE_H2 37722 6.97 6.35 7.08 38 XM_DKIMWhitelistDomains 37460 5.96 0.02 7.03 39 BAYES_40 36566 6.64 5.43 6.86 40 XM_H_Long_From01 34571 6.58 7.08 6.49 41 MIME_QP_LONG_LINE 33717 6.12 4.97 6.33 42 RELAYCOUNTRY_META 32108 9.81 30.72 6.03 43 XM_SendGrid 31644 5.53 3.26 5.94 44 HTML_IMAGE_RATIO_04 31343 6.06 7.03 5.88 45 XM_B_Phish_Phrases 30944 5.97 6.84 5.81 46 BAYES_20 29726 5.44 4.68 5.58 47 T_TooManySym_01 29716 5.11 2.52 5.58 48 RCVD_IN_IADB_LISTED 28983 4.92 2.07 5.44 49 RCVD_IN_MSPIKE_WL 28551 4.74 1.32 5.36 50 BOTNET_IPINHOSTNAME 28053 7.50 19.85 5.27 51 XM_DK_Undo_02 27446 8.80 28.91 5.15 52 RCVD_IN_MSPIKE_H3 26272 4.37 1.26 4.93 53 DKIM_INVALID 26080 5.23 7.08 4.90 54 RCVD_IN_IADB_SPF 25225 4.30 1.92 4.74 55 XMSexyCombo_05 24140 5.64 11.75 4.53 56 XM_PDF 23900 3.93 0.85 4.49 57 RCVD_IN_IADB_SENDERID 22102 3.80 1.87 4.15 58 RCVD_IN_IADB_DK 21683 3.73 1.87 4.07 59 XMStrtUSub 21493 4.11 4.54 4.03 60 XMSubMetaSx_00 20614 4.83 10.11 3.87 61 T_REMOTE_IMAGE 20568 4.84 10.25 3.86 62 MPART_ALT_DIFF 20003 4.36 7.72 3.76 63 HTML_IMAGE_RATIO_06 19746 3.77 4.09 3.71 64 BAYES_05 19555 3.47 2.34 3.67 65 XM_UncommonTLD01 19017 5.31 14.91 3.57 66 RCVD_IN_IADB_VOUCHED 19009 3.12 0.62 3.57 67 IN_ZIMBRA_NJ_WHITELIST 18299 2.91 0.02 3.44 68 XMNumbers 18168 4.12 8.02 3.41 69 BAYES_60 18125 3.59 4.61 3.40 70 XM_B_SpammyTLD 17825 3.49 4.27 3.35 71 FROM_EXCESS_BASE64 17593 3.22 2.78 3.30 72 TR_XM_DK_SendGrid 17120 2.95 1.51 3.21 73 XM_DIRTYINTL 15835 3.61 7.15 2.97 74 TM2_M_URI_OPT_OUT 15450 3.10 4.22 2.90 75 TO_MALFORMED 15150 2.41 0.03 2.84 76 MIME_HTML_MOSTLY 13981 2.78 3.65 2.62 77 BOUNCE_MESSAGE 13420 2.20 0.45 2.52 78 ANY_BOUNCE_MESSAGE 13420 2.20 0.45 2.52 79 HTML_IMAGE_RATIO_08 13265 2.54 2.84 2.49 80 UNPARSEABLE_RELAY 12850 2.21 1.11 2.41 81 MAILING_LIST_MULTI 12785 2.24 1.34 2.40 82 BOTNET 12621 5.11 20.27 2.37 83 HTML_MIME_NO_HTML_TAG 12584 3.00 6.53 2.36 84 BAYES_99 12079 4.67 17.91 2.27 85 RCVD_IN_IADB_OPTIN 12026 1.98 0.45 2.26 86 T_TooManySym_02 11158 1.88 0.67 2.09 87 MIME_HTML_ONLY_MULTI 11045 2.42 4.32 2.07 88 TVD_RCVD_IP 11028 1.85 0.66 2.07 89 XM_CamelCaseFrm001 10830 2.27 3.57 2.03 90 UNTRUSTED_Relay 10561 4.48 18.30 1.98 91 KHOP_HELO_FCRDNS 10342 2.81 7.62 1.94 92 TooManyTo_002 10224 1.87 1.63 1.92 93 TR_MetaPhish_Combo_01 9848 1.65 0.57 1.85 94 XM_SPF_SoftFail 9838 2.33 4.97 1.85 95 BAYES_999 9754 3.68 13.91 1.83 96 URI_HEX 9735 1.94 2.53 1.83 97 RELAYCOUNTRY_CA 9413 2.18 4.48 1.77 98 SUBJ_ALL_CAPS 9178 1.85 2.55 1.72 99 BAYES_80 9124 2.37 5.98 1.71 100 HELO_NODOT 8904 1.58 1.05 1.67 101 HELO_NO_DOMAIN 8901 1.58 1.05 1.67 102 INVALID_MSGID 8840 1.46 0.38 1.66 103 CK_HELO_DYNAMIC_SPLIT_IP 8838 1.46 0.36 1.66 104 HELO_DYNAMIC_IPADDR2 8768 1.41 0.08 1.65 105 XM_DK_Undo_01 8687 1.57 1.21 1.63 106 XMDiploma_00 8106 1.79 3.28 1.52 107 IN_HORDE_ADDRESS_BOOK 8058 1.29 0.04 1.51 108 TR_Symld_Words 7788 1.52 1.85 1.46 109 T_XMDrugObfuBody_08 7736 1.71 3.14 1.45 110 XMCapTrack 7548 1.24 0.29 1.42 111 XM_OfRef6 7443 1.64 2.98 1.40 112 TM2_M_VERY_LONG_WORD 7253 1.41 1.65 1.36 113 URI_TRY_3LD 7252 1.32 1.09 1.36 114 XMStockSpam_06 7229 1.36 1.40 1.36 115 TooManyTo_003 6913 1.32 1.45 1.30 116 XM_H_Long_From02 6828 1.28 1.29 1.28 117 XMBdyGiftCard01 6436 1.19 1.12 1.21 118 XMPhish11 6328 1.24 1.52 1.19 119 NO_DNS_FOR_FROM 6232 1.38 2.57 1.17 120 XMGappySubj_01 6145 1.05 0.50 1.15 121 XM_GoogleGroups 6079 1.06 0.60 1.14 122 T_FILL_THIS_FORM_SHORT 5955 1.14 1.27 1.12 123 RELAYCOUNTRY_GB 5922 1.75 5.28 1.11 124 TR_XM_PHPDW 5902 1.35 2.72 1.11 125 TR_XM_PHPForged 5819 1.34 2.68 1.09 126 TR_XM_FormFill2 5801 1.33 2.67 1.09 127 XM_H_PHPOS 5782 1.33 2.66 1.09 128 XM_UB50 5683 2.35 9.45 1.07 129 TR_DCC_Bayes_99 5472 3.07 14.38 1.03 130 XMGenDplmaNmb 5344 1.12 1.75 1.00 131 RCVD_IN_BL_SPAMCOP_NET 5297 1.43 3.84 0.99 132 BAYES_95 5151 1.27 2.96 0.97 133 SpammyFromTLD_01 5130 1.26 2.91 0.96 134 TooManyTo_004 5125 1.01 1.29 0.96 135 US_DOLLARS_3 5029 1.20 2.59 0.94 136 DKIM_ADSP_CUSTOM_MED 4989 0.96 1.11 0.94 137 USER_IN_DEF_DKIM_WL 4796 0.76 0.01 0.90 138 TR_XM_RelayPhish 4666 1.00 1.70 0.88 139 T_XMHurry_00 4621 0.96 1.47 0.87 140 T_Symld_Words_02 4483 0.97 1.66 0.84 141 TooManyTo_005 4273 0.86 1.17 0.80 142 HTTPS_HTTP_MISMATCH 4161 0.76 0.64 0.78 143 XMSubMetaI_00 4124 0.96 2.01 0.77 144 T_XMDrugObfuBody_00 3985 0.85 1.40 0.75 145 XMMoneyMeta_00 3951 1.03 2.62 0.74 146 TO_NO_BRKTS_HTML_ONLY 3722 0.63 0.28 0.70 147 RELAYCOUNTRY_DE 3594 0.96 2.53 0.67 148 XMNoVowels 3546 0.65 0.53 0.67 149 XMBody_17 3541 0.80 1.53 0.66 150 NML_ADSP_CUSTOM_MED 3504 0.69 0.84 0.66 151 HTML_TAG_BALANCE_BODY 3435 0.67 0.82 0.64 152 T_OBFU_PDF_ATTACH 3411 0.59 0.29 0.64 153 XMPhish30 3281 0.72 1.27 0.62 154 XM_B_REG_HTML 3123 0.54 0.31 0.59 155 DKIM_ADSP_NXDOMAIN 3083 1.04 3.58 0.58 156 XMSlimDrugH 3081 0.61 0.77 0.58 157 XMBody_95 3007 0.50 0.15 0.56 158 URI_OPTOUT_3LD 2977 0.50 0.15 0.56 159 XM_ProductURIs 2922 0.56 0.61 0.55 160 RELAYCOUNTRY_AU 2895 0.55 0.57 0.54 161 XMSexyCombo_01 2873 1.01 3.63 0.54 162 XMBrknScrpt_02 2860 0.64 1.20 0.54 163 T_TooManySym_03 2830 0.48 0.20 0.53 164 XM_ShortIntro_01 2781 0.54 0.62 0.52 165 XMHTMLBadTable_001 2764 0.53 0.61 0.52 166 TR_LOTS_OF_MONEY3 2658 0.62 1.28 0.50 167 XM_H_PHPMailer 2613 0.59 1.14 0.49 168 THIS_AD 2611 0.60 1.22 0.49 169 URI_NOVOWEL 2598 0.50 0.56 0.49 170 FROM_GOV_SPOOF 2583 0.49 0.53 0.48 171 REMOVE_BEFORE_LINK 2579 0.50 0.57 0.48 172 FORGED_GMAIL_RCVD 2553 0.54 0.89 0.48 173 HTML_FONT_FACE_BAD 2502 0.52 0.81 0.47 174 PLING_QUERY 2477 0.59 1.25 0.46 175 MISSING_HEADERS 2404 0.73 2.25 0.45 176 USER_IN_WHITELIST 2402 0.38 0.00 0.45 177 FILL_THIS_FORM 2400 0.50 0.80 0.45 178 XMBody_78 2387 0.58 1.32 0.45 179 SHORT_HELO_AND_INLINE_IMAGE 2374 0.38 0.04 0.45 180 RELAYCOUNTRY_FR 2341 1.33 6.23 0.44 181 SpammyFromTLD_02 2338 1.83 9.50 0.44 182 FROM_GOV_DKIM_AU 2332 0.39 0.15 0.44 183 XM_B_COPY_HTML 2320 0.46 0.59 0.44 184 XMHTML_After_End 2296 0.55 1.21 0.43 185 HTML_IMAGE_ONLY_32 2266 0.40 0.25 0.43 186 HTML_IMAGE_ONLY_28 2218 0.48 0.85 0.42 187 XMPhish14 2187 0.49 0.91 0.41 188 TM2_M_A_HREF_HREF 2184 0.43 0.53 0.41 189 XMSubMetaSxObfu_02 2177 0.41 0.45 0.41 190 XMLngstWrd_00 2162 0.41 0.46 0.41 191 TM2_M_BODY_EMPTY 2148 0.36 0.11 0.40 192 XMSubMetaSxObfu_03 2125 0.50 1.03 0.40 193 AC_DIV_BONANZA 2037 0.33 0.06 0.38 194 XMOemUri 2025 0.35 0.17 0.38 195 XMGappySubj_02 2014 0.34 0.11 0.38 196 XM_H_Trusted_IP 2014 0.32 0.00 0.38 197 RDNS_DYNAMIC 2011 0.54 1.43 0.38 198 RCVD_IN_SORBS_DUL 2006 0.36 0.28 0.38 199 XMLngstWrd_01 1995 0.38 0.43 0.37 200 FILL_THIS_FORM_LONG 1984 0.43 0.74 0.37 ----------------------------------------------------------------------