Email: 650204 Autolearn: 0 AvgScore: 1.40 AvgScanTime: 2.16 sec Spam: 107912 Autolearn: 0 AvgScore: 11.87 AvgScanTime: 2.95 sec Ham: 542292 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 2.00 sec Time Spent Running SA: 389.93 hours Time Spent Processing Spam: 88.57 hours Time Spent Processing Ham: 301.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102168 87.69 94.68 86.30 2 DCC_CHECK 86076 49.99 79.76 44.07 3 DKIM_SIGNED 83180 76.73 77.08 76.66 4 XM_DK_Pass 78589 74.98 72.83 75.41 5 XMListUnsubscribeExists 77454 57.92 71.78 55.17 6 XM_B_Unicode 76341 69.64 70.74 69.42 7 DKIM_VALID 73805 71.29 68.39 71.87 8 DKIM_VALID_AU 55479 52.15 51.41 52.30 9 BAYES_50 50605 51.48 46.89 52.39 10 XM_B_Unicode3 48367 40.87 44.82 40.09 11 HTML_FONT_LOW_CONTRAST 37519 30.85 34.77 30.06 12 MIME_HTML_ONLY 35729 23.20 33.11 21.22 13 XM_DK_Undo_02 35608 10.11 33.00 5.56 14 LOC_TINY_FONT_1 35498 25.16 32.90 23.62 15 FVGT_m_MULTI_ODD 28679 22.98 26.58 22.27 16 RELAYCOUNTRY_META 28521 9.08 26.43 5.63 17 XMSubLong 27224 22.13 25.23 21.52 18 DKIM_VALID_EF 24779 25.78 22.96 26.34 19 BAYES_99 23789 6.03 22.04 2.84 20 XM_Multi_Part_URI 21541 13.85 19.96 12.63 21 XM_Body_Dirty_Words 21487 14.54 19.91 13.47 22 BOTNET 20831 4.97 19.30 2.11 23 T_KAM_HTML_FONT_INVALID 20776 19.23 19.25 19.23 24 DCC_CHECK_NEGATIVE 20028 48.15 18.56 54.04 25 MultiRelay 19583 18.59 18.15 18.67 26 XM_UncommonTLD01 19526 5.67 18.09 3.20 27 BOTNET_IPINHOSTNAME 19194 6.73 17.79 4.53 28 T_TM2_M_HEADER_IN_MSG 18603 26.69 17.24 28.58 29 TR_DCC_Bayes_99 18541 3.90 17.18 1.25 30 BAYES_999 18451 4.76 17.10 2.31 31 UNTRUSTED_Relay 16943 4.13 15.70 1.83 32 FSL_BULK_SIG 16281 8.06 15.09 6.66 33 HTML_IMAGE_RATIO_02 15192 9.41 14.08 8.48 34 SpammyFromTLD_02 14613 2.67 13.54 0.50 35 LOTS_OF_MONEY 14264 9.77 13.22 9.08 36 XM_Evil_Numbers_Gen 12906 9.31 11.96 8.78 37 TooManyTo_001 10545 8.04 9.77 7.69 38 XMSexyCombo_05 10387 5.11 9.63 4.21 39 T_XMDrugObfuBody_14 10281 8.53 9.53 8.33 40 KHOP_HELO_FCRDNS 10066 3.36 9.33 2.17 41 LotsOfNums_01 9462 8.67 8.77 8.65 42 T_REMOTE_IMAGE 9384 5.25 8.70 4.56 43 DKIM_INVALID 9375 5.44 8.69 4.79 44 XMSubMetaSx_00 9166 4.49 8.49 3.70 45 XM_UB50 8683 2.12 8.05 0.95 46 MPART_ALT_DIFF 8044 4.09 7.45 3.42 47 HTML_SHORT_LINK_IMG_1 7678 1.21 7.12 0.04 48 XM_B_SpammyTLD 7634 4.19 7.07 3.62 49 HDRS_LCASE_IMGONLY 7620 1.21 7.06 0.04 50 XM_B_Phish_Phrases 7568 5.91 7.01 5.69 51 REPLYTO_WITHOUT_TO_CC 7081 1.13 6.56 0.05 52 HTML_IMAGE_ONLY_12 6894 1.70 6.39 0.77 53 XM_H_Long_From01 6689 6.40 6.20 6.45 54 XM_DIRTYINTL 6676 3.59 6.19 3.07 55 HTML_IMAGE_RATIO_04 6483 5.89 6.01 5.86 56 RCVD_IN_MSPIKE_H2 6477 7.86 6.00 8.23 57 MIME_HEADER_CTYPE_ONLY 6363 1.06 5.90 0.10 58 BAYES_00 6207 19.71 5.75 22.49 59 TO_EQ_FM_DOM_HTML_IMG 6198 0.97 5.74 0.03 60 MIME_HTML_MOSTLY 6110 2.76 5.66 2.19 61 BAYES_40 5737 6.03 5.32 6.18 62 BAYES_80 5693 2.60 5.28 2.07 63 MIME_QP_LONG_LINE 5580 6.48 5.17 6.74 64 RELAYCOUNTRY_FR 5473 1.28 5.07 0.52 65 BAYES_20 5212 5.07 4.83 5.11 66 HTML_MIME_NO_HTML_TAG 5073 3.22 4.70 2.93 67 XMNumbers 5038 3.36 4.67 3.10 68 FROM_SUSPICIOUS_NTLD 4888 0.79 4.53 0.04 69 FROM_SUSPICIOUS_NTLD_FP 4852 0.78 4.50 0.04 70 HTML_IMAGE_RATIO_08 4613 3.01 4.27 2.76 71 XM_SPF_SoftFail 4613 2.21 4.27 1.80 72 RCVD_IN_BL_SPAMCOP_NET 4572 1.56 4.24 1.03 73 XM_URI_RBL 4567 0.98 4.23 0.34 74 MIME_HTML_ONLY_MULTI 4533 2.31 4.20 1.93 75 HTML_IMAGE_RATIO_06 4463 4.61 4.14 4.71 76 RELAYCOUNTRY_GB 4376 1.61 4.06 1.12 77 BAYES_60 4364 4.01 4.04 4.00 78 RELAYCOUNTRY_CA 4141 1.98 3.84 1.61 79 XMStrtUSub 4128 3.83 3.83 3.83 80 XM_SendGrid 4013 6.48 3.72 7.03 81 TM2_M_URI_OPT_OUT 3976 4.16 3.68 4.26 82 T_TooManySym_01 3829 5.32 3.55 5.67 83 URI_HEX 3734 2.43 3.46 2.23 84 SpammyFromTLD_01 3723 1.33 3.45 0.91 85 T_XMDrugObfuBody_08 3537 1.96 3.28 1.69 86 DKIM_ADSP_NXDOMAIN 3389 1.00 3.14 0.58 87 XMDiploma_00 3303 2.05 3.06 1.85 88 NO_DNS_FOR_FROM 3273 1.58 3.03 1.29 89 XM_OfRef6 3244 1.83 3.01 1.60 90 URIBL_SBL_A 3242 3.46 3.00 3.55 91 BAYES_95 3159 1.51 2.93 1.22 92 BAYES_05 2921 3.36 2.71 3.48 93 DIET_1 2914 0.77 2.70 0.39 94 XMSexyCombo_01 2902 0.84 2.69 0.47 95 FROM_EXCESS_BASE64 2816 3.23 2.61 3.35 96 RCVD_IN_RP_RNBL 2814 0.48 2.61 0.05 97 XMSlimDrugH 2808 0.68 2.60 0.30 98 XM_H_TOP 2785 0.43 2.58 0.01 99 TR_LOTS_OF_MONEY3 2741 1.06 2.54 0.77 100 MultiRelay_Combo 2739 0.64 2.54 0.26 101 MultiRelay_CC 2739 0.64 2.54 0.26 102 TR_XM_PHPDW 2696 0.88 2.50 0.56 103 TR_XM_FormFill2 2649 0.86 2.45 0.55 104 TR_XM_PHPForged 2641 0.87 2.45 0.55 105 XM_H_PHPOS 2628 0.86 2.44 0.54 106 XM_CamelCaseFrm001 2611 2.20 2.42 2.15 107 BOTNET_NORDNS 2528 0.42 2.34 0.03 108 TR_XM_DK_Bayes 2503 15.17 2.32 17.73 109 DATE_IN_PAST_03_06 2467 0.50 2.29 0.15 110 XMGenDplmaNmb 2450 1.29 2.27 1.09 111 DATE_IN_PAST_06_12 2395 0.52 2.22 0.18 112 TR_XM_INV_DKIM 2316 0.44 2.15 0.10 113 T_HTML_TAG_BALANCE_CENTER 2311 0.49 2.14 0.17 114 BODY_URI_ONLY 2297 0.45 2.13 0.11 115 TR_XM_DK_Bayes1 2285 14.47 2.12 16.93 116 T_Symld_Words_02 2240 0.75 2.08 0.48 117 TM2_M_VERY_LONG_WORD 2223 1.50 2.06 1.38 118 XM_BadFromFormat 2176 0.46 2.02 0.15 119 RCVD_IN_IADB_LISTED 2152 4.89 1.99 5.46 120 ALL_TRUSTED 2113 13.18 1.96 15.41 121 URI_TRY_3LD 2097 1.64 1.94 1.58 122 SUBJ_ALL_CAPS 2074 1.64 1.92 1.59 123 SUBJ_DOLLARS 2043 0.54 1.89 0.27 124 RCVD_IN_IADB_SPF 2007 4.24 1.86 4.72 125 XM_DK_Undo_01 2000 1.81 1.85 1.80 126 RELAYCOUNTRY_DE 1969 0.67 1.82 0.44 127 XMBdyGiftCard01 1963 1.31 1.82 1.20 128 RCVD_IN_IADB_SENDERID 1959 3.74 1.82 4.13 129 RCVD_IN_IADB_DK 1955 3.66 1.81 4.03 130 XMWghtMeta_00 1952 0.32 1.81 0.02 131 TR_Mismatch_TLD_01 1908 0.50 1.77 0.25 132 HTML_EXTRA_CLOSE 1900 0.42 1.76 0.15 133 FROM_MISSP_REPLYTO 1885 0.30 1.75 0.01 134 XMBody_17 1879 1.06 1.74 0.93 135 TR_XM_RelayPhish 1877 1.24 1.74 1.14 136 TR_XM_DK_SendGrid 1864 3.22 1.73 3.51 137 XMSubMetaI_00 1811 0.82 1.68 0.64 138 T_XMHurry_00 1785 0.97 1.65 0.83 139 TR_Symld_Words 1780 1.45 1.65 1.42 140 RELAYCOUNTRY_IN 1753 0.38 1.62 0.14 141 XMPhish11 1729 1.19 1.60 1.10 142 LOADSA_MONEY_COMBO 1704 0.29 1.58 0.04 143 XMStockSpam_06 1686 1.33 1.56 1.29 144 UNPARSEABLE_RELAY 1667 2.44 1.54 2.61 145 RCVD_IN_PSBL 1634 0.26 1.51 0.01 146 URIBL_DBL_SPAM 1624 0.28 1.50 0.04 147 XMBrknScrpt_02 1607 0.89 1.49 0.77 148 XM_H_PHPMailer 1605 0.66 1.49 0.49 149 MAILING_LIST_MULTI 1598 2.30 1.48 2.46 150 HK_RANDOM_REPLYTO 1557 0.39 1.44 0.18 151 HTML_IMAGE_ONLY_08 1515 0.32 1.40 0.11 152 RCVD_IN_MSPIKE_WL 1493 4.63 1.38 5.28 153 RCVD_IN_RP_SAFE 1485 7.70 1.38 8.96 154 LONG_HEX_URI 1483 0.42 1.37 0.23 155 XM_H_PHPOS_M 1412 0.38 1.31 0.19 156 T_XMDrugObfuBody_00 1358 1.00 1.26 0.95 157 XMSubMetaSxObfu_03 1343 0.64 1.24 0.52 158 MANY_HDRS_LCASE 1324 0.22 1.23 0.01 159 XM_UB99 1291 0.20 1.20 0.00 160 XMHTML_After_End 1290 0.66 1.20 0.56 161 RCVD_IN_MSPIKE_H3 1260 3.92 1.17 4.46 162 XMPhish14 1241 0.51 1.15 0.38 163 RDNS_DYNAMIC 1203 0.50 1.11 0.37 164 TR_Mismatch_TLD_02 1176 0.25 1.09 0.09 165 TM2_M_A_HREF_HREF 1162 0.61 1.08 0.51 166 URIBL_DBL_ABUSE_REDIR 1161 0.20 1.08 0.02 167 SUBJ_OBFU_PUNCT_FEW 1147 0.29 1.06 0.13 168 RELAYCOUNTRY_AT 1142 0.32 1.06 0.17 169 HTML_FONT_SIZE_HUGE 1142 0.36 1.06 0.23 170 HTML_TAG_BALANCE_BODY 1079 0.62 1.00 0.54 171 TooManyTo_002 1074 1.89 1.00 2.07 172 MPART_ALT_DIFF_COUNT 1070 0.41 0.99 0.29 173 DATE_IN_PAST_12_24 1065 0.25 0.99 0.11 174 XMSubMetaSSx_00 1054 0.26 0.98 0.12 175 DKIM_ADSP_CUSTOM_MED 1054 1.03 0.98 1.04 176 XMMoneyMeta_00 1044 0.64 0.97 0.57 177 RELAYCOUNTRY_RU 1037 0.18 0.96 0.03 178 XMSlimDrugs 1034 0.18 0.96 0.02 179 XMBody_78 1030 0.54 0.95 0.46 180 XMPhish30 1024 0.63 0.95 0.56 181 XM_H_Long_From02 1021 1.31 0.95 1.38 182 T_FILL_THIS_FORM_SHORT 1016 0.88 0.94 0.87 183 HTML_FONT_FACE_BAD 1009 0.93 0.94 0.92 184 HELO_NO_DOMAIN 1006 1.32 0.93 1.40 185 HELO_NODOT 1006 1.32 0.93 1.40 186 XM_UB60 980 0.20 0.91 0.05 187 T_MONEY_PERCENT 969 0.56 0.90 0.49 188 TR_LOTS_OF_MONEY2 969 0.56 0.90 0.49 189 XMSexyCombo_04 962 0.24 0.89 0.11 190 XM_OfRef7 955 0.31 0.88 0.20 191 RCVD_IN_MSPIKE_BL 955 0.18 0.88 0.03 192 XM_ProductURIs 953 1.11 0.88 1.15 193 T_TooManySym_02 932 1.94 0.86 2.16 194 XM_XX_Yahoo 930 0.24 0.86 0.11 195 XM_UB999 921 0.15 0.85 0.00 196 URI_NO_WWW_INFO_CGI 915 0.18 0.85 0.05 197 HK_RANDOM_FROM 912 0.23 0.85 0.11 198 TooManyTo_003 881 1.28 0.82 1.38 199 HDRS_MISSP 878 0.15 0.81 0.02 200 FSL_THIS_IS_ADV 875 0.42 0.81 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 467977 87.69 94.68 86.30 2 DKIM_SIGNED 415718 76.73 77.08 76.66 3 XM_DK_Pass 408953 74.98 72.83 75.41 4 DKIM_VALID 389733 71.29 68.39 71.87 5 XM_B_Unicode 376440 69.64 70.74 69.42 6 XMListUnsubscribeExists 299158 57.92 71.78 55.17 7 DCC_CHECK_NEGATIVE 293072 48.15 18.56 54.04 8 BAYES_50 284117 51.48 46.89 52.39 9 DKIM_VALID_AU 283623 52.15 51.41 52.30 10 DCC_CHECK 238963 49.99 79.76 44.07 11 XM_B_Unicode3 217399 40.87 44.82 40.09 12 HTML_FONT_LOW_CONTRAST 163037 30.85 34.77 30.06 13 T_TM2_M_HEADER_IN_MSG 154964 26.69 17.24 28.58 14 DKIM_VALID_EF 142849 25.78 22.96 26.34 15 LOC_TINY_FONT_1 128064 25.16 32.90 23.62 16 BAYES_00 121947 19.71 5.75 22.49 17 FVGT_m_MULTI_ODD 120759 22.98 26.58 22.27 18 XMSubLong 116696 22.13 25.23 21.52 19 MIME_HTML_ONLY 115090 23.20 33.11 21.22 20 T_KAM_HTML_FONT_INVALID 104257 19.23 19.25 19.23 21 MultiRelay 101265 18.59 18.15 18.67 22 TR_XM_DK_Bayes 96148 15.17 2.32 17.73 23 TR_XM_DK_Bayes1 91791 14.47 2.12 16.93 24 ALL_TRUSTED 83556 13.18 1.96 15.41 25 TR_XM_DK_Bayes2 78046 12.12 0.68 14.39 26 XM_Body_Dirty_Words 73047 14.54 19.91 13.47 27 XM_Multi_Part_URI 68484 13.85 19.96 12.63 28 LOTS_OF_MONEY 49238 9.77 13.22 9.08 29 RCVD_IN_RP_SAFE 48611 7.70 1.38 8.96 30 XM_Evil_Numbers_Gen 47639 9.31 11.96 8.78 31 LotsOfNums_01 46913 8.67 8.77 8.65 32 HTML_IMAGE_RATIO_02 45978 9.41 14.08 8.48 33 T_XMDrugObfuBody_14 45176 8.53 9.53 8.33 34 RCVD_IN_MSPIKE_H2 44617 7.86 6.00 8.23 35 TooManyTo_001 41724 8.04 9.77 7.69 36 RCVD_IN_RP_CERTIFIED 41319 6.44 0.53 7.62 37 XM_SendGrid 38125 6.48 3.72 7.03 38 XM_DKIMWhitelistDomains 37248 5.73 0.03 6.87 39 MIME_QP_LONG_LINE 36526 6.48 5.17 6.74 40 FSL_BULK_SIG 36128 8.06 15.09 6.66 41 XM_H_Long_From01 34956 6.40 6.20 6.45 42 BAYES_40 33494 6.03 5.32 6.18 43 HTML_IMAGE_RATIO_04 31791 5.89 6.01 5.86 44 XM_B_Phish_Phrases 30866 5.91 7.01 5.69 45 T_TooManySym_01 30754 5.32 3.55 5.67 46 RELAYCOUNTRY_META 30542 9.08 26.43 5.63 47 XM_DK_Undo_02 30155 10.11 33.00 5.56 48 RCVD_IN_IADB_LISTED 29627 4.89 1.99 5.46 49 RCVD_IN_MSPIKE_WL 28641 4.63 1.38 5.28 50 BAYES_20 27726 5.07 4.83 5.11 51 DKIM_INVALID 25985 5.44 8.69 4.79 52 RCVD_IN_IADB_SPF 25580 4.24 1.86 4.72 53 HTML_IMAGE_RATIO_06 25518 4.61 4.14 4.71 54 T_REMOTE_IMAGE 24744 5.25 8.70 4.56 55 BOTNET_IPINHOSTNAME 24556 6.73 17.79 4.53 56 RCVD_IN_MSPIKE_H3 24213 3.92 1.17 4.46 57 XM_PDF 23538 3.75 0.77 4.34 58 TM2_M_URI_OPT_OUT 23092 4.16 3.68 4.26 59 XMSexyCombo_05 22845 5.11 9.63 4.21 60 RCVD_IN_IADB_SENDERID 22375 3.74 1.82 4.13 61 RCVD_IN_IADB_DK 21862 3.66 1.81 4.03 62 ANY_BOUNCE_MESSAGE 21777 3.47 0.70 4.02 63 BOUNCE_MESSAGE 21777 3.47 0.70 4.02 64 BAYES_60 21700 4.01 4.04 4.00 65 XMStrtUSub 20786 3.83 3.83 3.83 66 XMSubMetaSx_00 20041 4.49 8.49 3.70 67 RCVD_IN_IADB_VOUCHED 19726 3.13 0.58 3.64 68 XM_B_SpammyTLD 19610 4.19 7.07 3.62 69 URIBL_SBL_A 19277 3.46 3.00 3.55 70 TR_XM_DK_SendGrid 19057 3.22 1.73 3.51 71 BAYES_05 18896 3.36 2.71 3.48 72 IN_ZIMBRA_NJ_WHITELIST 18673 2.87 0.02 3.44 73 MPART_ALT_DIFF 18530 4.09 7.45 3.42 74 FROM_EXCESS_BASE64 18155 3.23 2.61 3.35 75 XM_UncommonTLD01 17349 5.67 18.09 3.20 76 XMNumbers 16825 3.36 4.67 3.10 77 XM_DIRTYINTL 16651 3.59 6.19 3.07 78 HTML_MIME_NO_HTML_TAG 15887 3.22 4.70 2.93 79 BAYES_99 15400 6.03 22.04 2.84 80 HTML_IMAGE_RATIO_08 14946 3.01 4.27 2.76 81 UNPARSEABLE_RELAY 14168 2.44 1.54 2.61 82 TO_MALFORMED 13825 2.13 0.04 2.55 83 MAILING_LIST_MULTI 13332 2.30 1.48 2.46 84 BAYES_999 12529 4.76 17.10 2.31 85 RCVD_IN_IADB_OPTIN 12381 1.98 0.44 2.28 86 URI_HEX 12066 2.43 3.46 2.23 87 MIME_HTML_MOSTLY 11860 2.76 5.66 2.19 88 KHOP_HELO_FCRDNS 11762 3.36 9.33 2.17 89 T_TooManySym_02 11699 1.94 0.86 2.16 90 XM_CamelCaseFrm001 11681 2.20 2.42 2.15 91 BOTNET 11464 4.97 19.30 2.11 92 TooManyTo_002 11227 1.89 1.00 2.07 93 BAYES_80 11205 2.60 5.28 2.07 94 TVD_RCVD_IP 10800 1.76 0.57 1.99 95 MIME_HTML_ONLY_MULTI 10455 2.31 4.20 1.93 96 XMDiploma_00 10007 2.05 3.06 1.85 97 UNTRUSTED_Relay 9937 4.13 15.70 1.83 98 XM_SPF_SoftFail 9759 2.21 4.27 1.80 99 XM_DK_Undo_01 9740 1.81 1.85 1.80 100 T_XMDrugObfuBody_08 9185 1.96 3.28 1.69 101 RELAYCOUNTRY_CA 8746 1.98 3.84 1.61 102 IN_HORDE_ADDRESS_BOOK 8697 1.34 0.04 1.60 103 XM_OfRef6 8660 1.83 3.01 1.60 104 CK_HELO_DYNAMIC_SPLIT_IP 8641 1.41 0.49 1.59 105 SUBJ_ALL_CAPS 8599 1.64 1.92 1.59 106 HELO_DYNAMIC_IPADDR2 8595 1.35 0.15 1.58 107 URI_TRY_3LD 8559 1.64 1.94 1.58 108 TR_MetaPhish_Combo_01 7960 1.32 0.60 1.47 109 TR_Symld_Words 7678 1.45 1.65 1.42 110 HELO_NODOT 7566 1.32 0.93 1.40 111 HELO_NO_DOMAIN 7565 1.32 0.93 1.40 112 INVALID_MSGID 7562 1.21 0.30 1.39 113 TM2_M_VERY_LONG_WORD 7507 1.50 2.06 1.38 114 XM_H_Long_From02 7503 1.31 0.95 1.38 115 TooManyTo_003 7463 1.28 0.82 1.38 116 XM_GoogleGroups 7180 1.18 0.47 1.32 117 NO_DNS_FOR_FROM 6993 1.58 3.03 1.29 118 XMStockSpam_06 6991 1.33 1.56 1.29 119 URI_OPTOUT_3LD 6833 1.07 0.14 1.26 120 TR_DCC_Bayes_99 6792 3.90 17.18 1.25 121 BAYES_95 6639 1.51 2.93 1.22 122 XMGappySubj_01 6602 1.07 0.34 1.22 123 XMBdyGiftCard01 6533 1.31 1.82 1.20 124 XMCapTrack 6331 1.02 0.25 1.17 125 XM_ProductURIs 6236 1.11 0.88 1.15 126 TR_XM_RelayPhish 6199 1.24 1.74 1.14 127 RELAYCOUNTRY_GB 6069 1.61 4.06 1.12 128 XMPhish11 5984 1.19 1.60 1.10 129 XMGenDplmaNmb 5926 1.29 2.27 1.09 130 DKIM_ADSP_CUSTOM_MED 5620 1.03 0.98 1.04 131 RCVD_IN_BL_SPAMCOP_NET 5597 1.56 4.24 1.03 132 TooManyTo_004 5582 0.97 0.65 1.03 133 USER_IN_DEF_DKIM_WL 5575 0.86 0.01 1.03 134 T_XMDrugObfuBody_00 5132 1.00 1.26 0.95 135 XM_UB50 5128 2.12 8.05 0.95 136 XMBody_17 5017 1.06 1.74 0.93 137 HTML_FONT_FACE_BAD 5014 0.93 0.94 0.92 138 SpammyFromTLD_01 4950 1.33 3.45 0.91 139 T_FILL_THIS_FORM_SHORT 4707 0.88 0.94 0.87 140 TooManyTo_005 4520 0.78 0.54 0.83 141 T_XMHurry_00 4510 0.97 1.65 0.83 142 XMBrknScrpt_02 4194 0.89 1.49 0.77 143 TR_LOTS_OF_MONEY3 4174 1.06 2.54 0.77 144 HTML_IMAGE_ONLY_12 4152 1.70 6.39 0.77 145 NML_ADSP_CUSTOM_MED 4075 0.74 0.71 0.75 146 HTTPS_HTTP_MISMATCH 4033 0.73 0.69 0.74 147 XM_B_REG_HTML 3866 0.66 0.40 0.71 148 FILL_THIS_FORM 3835 0.68 0.54 0.71 149 XMSubMetaI_00 3493 0.82 1.68 0.64 150 T_OBFU_PDF_ATTACH 3417 0.56 0.23 0.63 151 XMBody_95 3270 0.52 0.13 0.60 152 XM_B_COPY_HTML 3210 0.56 0.41 0.59 153 DKIM_ADSP_NXDOMAIN 3144 1.00 3.14 0.58 154 XMMoneyMeta_00 3112 0.64 0.97 0.57 155 RCVD_IN_MSPIKE_H5 3110 0.49 0.07 0.57 156 XMPhish30 3063 0.63 0.95 0.56 157 TR_XM_PHPDW 3054 0.88 2.50 0.56 158 XMHTML_After_End 3032 0.66 1.20 0.56 159 TR_XM_PHPForged 2994 0.87 2.45 0.55 160 RELAYCOUNTRY_AU 2965 0.54 0.52 0.55 161 TR_XM_FormFill2 2961 0.86 2.45 0.55 162 HTML_TAG_BALANCE_BODY 2948 0.62 1.00 0.54 163 XM_H_PHPOS 2938 0.86 2.44 0.54 164 URI_NOVOWEL 2885 0.57 0.75 0.53 165 FORGED_GMAIL_RCVD 2877 0.56 0.72 0.53 166 XMSubMetaSxObfu_03 2823 0.64 1.24 0.52 167 RELAYCOUNTRY_FR 2818 1.28 5.07 0.52 168 T_TooManySym_03 2804 0.47 0.24 0.52 169 TM2_M_A_HREF_HREF 2783 0.61 1.08 0.51 170 SpammyFromTLD_02 2719 2.67 13.54 0.50 171 XMOemUri 2700 0.44 0.16 0.50 172 XM_H_PHPMailer 2668 0.66 1.49 0.49 173 TR_LOTS_OF_MONEY2 2657 0.56 0.90 0.49 174 T_MONEY_PERCENT 2657 0.56 0.90 0.49 175 TM2_M_BODY_EMPTY 2644 0.43 0.11 0.49 176 T_Symld_Words_02 2627 0.75 2.08 0.48 177 XMGappySubj_02 2568 0.42 0.12 0.47 178 XMSexyCombo_01 2543 0.84 2.69 0.47 179 XM_ShortIntro_01 2512 0.46 0.42 0.46 180 XMBody_78 2498 0.54 0.95 0.46 181 FROM_GOV_SPOOF 2484 0.43 0.29 0.46 182 XMSubMetaSxObfu_02 2483 0.43 0.31 0.46 183 PLING_QUERY 2470 0.46 0.49 0.46 184 XMSubject_60 2443 0.41 0.22 0.45 185 USER_IN_WHITELIST 2423 0.37 0.00 0.45 186 NUMERIC_HTTP_ADDR 2403 0.44 0.41 0.44 187 RELAYCOUNTRY_DE 2391 0.67 1.82 0.44 188 XMNoVowels 2377 0.43 0.39 0.44 189 XMHTMLBadTable_001 2345 0.46 0.62 0.43 190 FILL_THIS_FORM_LONG 2266 0.41 0.38 0.42 191 SHORT_HELO_AND_INLINE_IMAGE 2201 0.35 0.05 0.41 192 FROM_GOV_DKIM_AU 2172 0.37 0.23 0.40 193 MISSING_HEADERS 2165 0.41 0.48 0.40 194 XM_RXBody 2165 0.38 0.29 0.40 195 XM_Body_Obfu01 2158 0.42 0.53 0.40 196 FILL_THIS_FORM_LOAN 2110 0.37 0.27 0.39 197 DIET_1 2107 0.77 2.70 0.39 198 HTML_IMAGE_ONLY_32 2065 0.36 0.25 0.38 199 XMPhish14 2063 0.51 1.15 0.38 200 RDNS_DYNAMIC 2030 0.50 1.11 0.37 ----------------------------------------------------------------------