Email: 373963 Autolearn: 0 AvgScore: 0.95 AvgScanTime: 2.15 sec Spam: 60700 Autolearn: 0 AvgScore: 12.43 AvgScanTime: 2.74 sec Ham: 313263 Autolearn: 0 AvgScore: -1.28 AvgScanTime: 2.03 sec Time Spent Running SA: 223.09 hours Time Spent Processing Spam: 46.14 hours Time Spent Processing Ham: 176.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 50387 81.19 83.01 80.84 2 DCC_CHECK 48432 55.02 79.79 50.22 3 DKIM_SIGNED 45586 76.96 75.10 77.32 4 XM_DK_Pass 43850 75.59 72.24 76.24 5 DKIM_VALID 41114 72.42 67.73 73.33 6 XM_B_Unicode 40963 67.41 67.48 67.39 7 XMListUnsubscribeExists 39240 57.53 64.65 56.15 8 DKIM_VALID_AU 30927 59.16 50.95 60.75 9 BAYES_50 30175 50.27 49.71 50.38 10 XM_B_Unicode3 27256 43.41 44.90 43.12 11 HTML_FONT_LOW_CONTRAST 20977 32.69 34.56 32.33 12 LOC_TINY_FONT_1 19962 29.64 32.89 29.01 13 RELAYCOUNTRY_META 19037 9.23 31.36 4.95 14 XM_DK_Undo_02 17997 10.09 29.65 6.30 15 MultiRelay 17122 17.70 28.21 15.67 16 XMSubLong 16759 23.03 27.61 22.14 17 FVGT_m_MULTI_ODD 16031 21.87 26.41 21.00 18 MIME_HTML_ONLY 15298 23.15 25.20 22.75 19 BAYES_99 13575 6.72 22.36 3.69 20 XM_Body_Dirty_Words 13100 16.69 21.58 15.75 21 BOTNET_IPINHOSTNAME 12981 8.76 21.39 6.31 22 FSL_BULK_SIG 12725 10.55 20.96 8.54 23 DCC_CHECK_NEGATIVE 11216 43.76 18.48 48.65 24 DKIM_VALID_EF 11148 25.11 18.37 26.42 25 BOTNET 10803 4.83 17.80 2.32 26 BAYES_999 10683 5.48 17.60 3.13 27 T_TM2_M_HEADER_IN_MSG 10573 21.65 17.42 22.47 28 TR_DCC_Bayes_99 10561 4.62 17.40 2.14 29 T_KAM_HTML_FONT_INVALID 10392 14.93 17.12 14.51 30 XM_Multi_Part_URI 9908 13.91 16.32 13.45 31 UNTRUSTED_Relay 9901 4.32 16.31 1.99 32 HTML_IMAGE_RATIO_02 9386 13.05 15.46 12.58 33 XM_H_Long_From01 9141 7.44 15.06 5.96 34 XM_UncommonTLD01 8899 5.37 14.66 3.58 35 LOTS_OF_MONEY 8127 9.14 13.39 8.32 36 XM_Evil_Numbers_Gen 7147 10.88 11.77 10.71 37 T_XMDrugObfuBody_14 7054 8.09 11.62 7.40 38 SpammyFromTLD_02 6889 2.28 11.35 0.52 39 XMSexyCombo_05 6778 6.50 11.17 5.60 40 DKIM_ADSP_CUSTOM_MED 6706 2.55 11.05 0.90 41 NML_ADSP_CUSTOM_MED 6661 2.32 10.97 0.65 42 TooManyTo_001 6603 6.72 10.88 5.92 43 XMNumbers 5965 5.12 9.83 4.21 44 XM_B_SpammyTLD 5901 5.77 9.72 5.01 45 XMSubMetaSx_00 5127 5.50 8.45 4.93 46 XM_UB50 5120 2.07 8.43 0.84 47 FORGED_GMAIL_RCVD 4940 1.69 8.14 0.44 48 URG_BIZ 4590 1.24 7.56 0.01 49 DKIM_INVALID 4472 4.53 7.37 3.98 50 XM_DIRTYINTL 4279 4.16 7.05 3.60 51 HTML_IMAGE_RATIO_04 4275 8.05 7.04 8.24 52 RCVD_IN_MSPIKE_H2 4202 8.09 6.92 8.32 53 BAYES_80 3950 2.97 6.51 2.29 54 MPART_ALT_DIFF 3934 4.31 6.48 3.89 55 LotsOfNums_01 3884 6.88 6.40 6.97 56 SUBJ_ALL_CAPS 3636 1.96 5.99 1.17 57 RELAYCOUNTRY_GB 3630 1.37 5.98 0.48 58 XM_B_Phish_Phrases 3507 7.03 5.78 7.27 59 XM_SPF_SoftFail 3396 1.77 5.59 1.03 60 BAYES_40 3168 5.34 5.22 5.36 61 HK_SCAM 3085 0.88 5.08 0.07 62 TR_Sbj_FN_Bdy 3002 0.90 4.95 0.12 63 XM_CamelCaseFrm001 2900 2.26 4.78 1.78 64 XMStrtUSub 2858 5.61 4.71 5.78 65 KHOP_HELO_FCRDNS 2834 1.75 4.67 1.19 66 MIME_HTML_MOSTLY 2740 3.64 4.51 3.47 67 NORDNS_LOW_CONTRAST 2697 0.72 4.44 0.00 68 HTML_IMAGE_RATIO_06 2690 3.80 4.43 3.68 69 MultiRelay_CC 2670 0.87 4.40 0.18 70 MultiRelay_Combo 2670 0.87 4.40 0.18 71 RELAYCOUNTRY_CA 2665 1.98 4.39 1.52 72 FROM_SUSPICIOUS_NTLD 2628 0.73 4.33 0.03 73 BAYES_60 2608 4.32 4.30 4.33 74 FROM_SUSPICIOUS_NTLD_FP 2596 0.71 4.28 0.02 75 RELAYCOUNTRY_FR 2525 0.91 4.16 0.28 76 XM_SendGrid 2480 6.81 4.09 7.33 77 ADVANCE_FEE_3_NEW_MONEY 2468 0.66 4.07 0.01 78 RCVD_IN_PSBL 2447 0.66 4.03 0.01 79 FROM_EXCESS_BASE64 2442 4.59 4.02 4.70 80 RCVD_IN_BL_SPAMCOP_NET 2416 1.24 3.98 0.71 81 MIME_HTML_ONLY_MULTI 2355 2.37 3.88 2.07 82 NO_DNS_FOR_FROM 2224 1.68 3.66 1.30 83 XMPhish11 2163 1.34 3.56 0.91 84 RCVD_IN_RP_RNBL 2153 0.60 3.55 0.03 85 BAYES_20 2117 4.57 3.49 4.78 86 XMBdyGiftCard01 2069 3.24 3.41 3.20 87 TM2_M_URI_OPT_OUT 2009 5.64 3.31 6.09 88 MIME_QP_LONG_LINE 1948 3.67 3.21 3.75 89 DEAR_BENEFICIARY 1912 0.51 3.15 0.00 90 T_REMOTE_IMAGE 1899 2.69 3.13 2.61 91 BAYES_95 1878 1.45 3.09 1.13 92 ADVANCE_FEE_3_NEW 1831 0.49 3.02 0.00 93 URI_HEX 1813 2.41 2.99 2.30 94 TR_XM_PHPDW 1804 0.98 2.97 0.59 95 T_TooManySym_01 1798 6.90 2.96 7.66 96 BAYES_00 1788 20.56 2.95 23.98 97 TR_XM_PHPForged 1782 0.96 2.94 0.58 98 TR_XM_FormFill2 1766 0.95 2.91 0.57 99 XM_H_PHPOS 1758 0.94 2.90 0.56 100 FORGED_YAHOO_RCVD 1722 0.52 2.84 0.07 101 ALL_TRUSTED 1692 16.31 2.79 18.93 102 XM_URI_RBL 1691 0.78 2.79 0.39 103 XMSexyCombo_01 1679 1.88 2.77 1.70 104 XMSubMetaI_00 1679 1.29 2.77 1.00 105 XM_OfRef6 1651 1.89 2.72 1.73 106 RELAYCOUNTRY_PL 1632 0.46 2.69 0.03 107 DKIM_ADSP_NXDOMAIN 1508 0.93 2.48 0.62 108 HTML_MIME_NO_HTML_TAG 1478 1.49 2.43 1.30 109 HTML_IMAGE_RATIO_08 1476 2.35 2.43 2.33 110 T_MONEY_PERCENT 1474 1.19 2.43 0.95 111 TR_LOTS_OF_MONEY2 1474 1.19 2.43 0.95 112 T_XMDrugObfuBody_08 1441 1.57 2.37 1.42 113 BOTNET_NORDNS 1432 0.40 2.36 0.02 114 XM_H_TOP 1335 0.36 2.20 0.00 115 TM2_M_VERY_LONG_WORD 1323 1.68 2.18 1.59 116 TR_Mismatch_TLD_02 1319 0.41 2.17 0.06 117 XM_H_PHPMailer 1305 0.85 2.15 0.60 118 TR_XM_DK_SendGrid 1273 4.09 2.10 4.47 119 SpammyFromTLD_01 1254 0.67 2.07 0.40 120 RCVD_IN_RP_SAFE 1209 12.10 1.99 14.06 121 BAYES_05 1194 3.43 1.97 3.72 122 RELAYCOUNTRY_DE 1140 0.54 1.88 0.28 123 DIET_1 1135 0.75 1.87 0.53 124 XM_H_PHPOS_M 1112 0.54 1.83 0.29 125 TR_XM_DK_Bayes 1096 16.66 1.81 19.54 126 XMDiploma_00 1090 1.40 1.80 1.32 127 RELAYCOUNTRY_AT 1067 0.60 1.76 0.38 128 TR_XM_RelayPhish 1058 1.30 1.74 1.22 129 URIBL_SBL_A 1035 0.66 1.71 0.46 130 TR_XM_INV_DKIM 995 0.34 1.64 0.09 131 TR_XM_DK_Bayes1 988 16.03 1.63 18.82 132 T_XMHurry_00 981 0.97 1.62 0.84 133 XMBody_17 958 1.13 1.58 1.04 134 XMGppyBdWords 956 0.44 1.57 0.22 135 RDNS_DYNAMIC 952 0.63 1.57 0.45 136 XMStockSpam_06 940 1.73 1.55 1.77 137 DATE_IN_PAST_06_12 930 0.35 1.53 0.12 138 RCVD_IN_MSPIKE_WL 919 3.59 1.51 3.99 139 T_XMDrugObfuBody_00 910 0.87 1.50 0.74 140 XM_UB99 904 0.25 1.49 0.01 141 TR_LOTS_OF_MONEY3 892 1.35 1.47 1.33 142 FILL_THIS_FORM 888 0.98 1.46 0.88 143 XMBrknScrpt_02 880 0.84 1.45 0.72 144 XM_H_Long_From02 872 1.12 1.44 1.06 145 THIS_AD 870 0.87 1.43 0.76 146 XMSexyCombo_04 857 1.08 1.41 1.02 147 XMGenDplmaNmb 852 0.86 1.40 0.76 148 RELAYCOUNTRY_IN 833 0.47 1.37 0.30 149 FILL_THIS_FORM_LONG 816 0.90 1.34 0.81 150 TR_XM_DK_Bayes2 814 14.90 1.34 17.52 151 HTML_FONT_FACE_BAD 813 0.83 1.34 0.73 152 UNPARSEABLE_RELAY 805 3.35 1.33 3.75 153 T_TooManySym_02 789 2.56 1.30 2.81 154 RCVD_IN_IADB_LISTED 778 2.67 1.28 2.93 155 XMPhish30 774 1.09 1.28 1.05 156 REPLYTO_WITHOUT_TO_CC 759 0.23 1.25 0.03 157 RELAYCOUNTRY_VN 755 0.21 1.24 0.01 158 XMSubNoVowel 742 0.35 1.22 0.18 159 RCVD_IN_IADB_SPF 740 2.32 1.22 2.53 160 TooManyTo_002 740 1.13 1.22 1.11 161 RCVD_IN_IADB_SENDERID 733 2.07 1.21 2.24 162 RCVD_IN_IADB_DK 728 2.02 1.20 2.18 163 XM_DK_Undo_01 727 1.34 1.20 1.37 164 MAILING_LIST_MULTI 698 1.42 1.15 1.47 165 HTML_TAG_BALANCE_BODY 694 0.79 1.14 0.72 166 HELO_MISC_IP 684 0.20 1.13 0.02 167 MONEY_FORM 681 0.19 1.12 0.02 168 TR_Symld_Words 668 1.23 1.10 1.25 169 XMhairloss01 668 0.19 1.10 0.01 170 DATE_IN_PAST_03_06 666 0.27 1.10 0.11 171 XMLngstWrd_00 654 0.64 1.08 0.55 172 XM_UB999 653 0.18 1.08 0.01 173 RCVD_IN_MSPIKE_BL 639 0.20 1.05 0.03 174 HTML_FONT_SIZE_HUGE 625 0.24 1.03 0.08 175 TooManyTo_003 624 0.85 1.03 0.82 176 CK_HELO_DYNAMIC_SPLIT_IP 616 2.67 1.01 2.99 177 FROM_MISSP_REPLYTO 609 0.17 1.00 0.01 178 RCVD_IN_MSPIKE_L5 608 0.17 1.00 0.01 179 XM_BadFromFormat 603 0.26 0.99 0.11 180 XM_OfRef7 586 0.27 0.97 0.14 181 URIBL_DBL_ABUSE_REDIR 586 0.17 0.97 0.01 182 SHORT_URI 583 0.19 0.96 0.04 183 XM_UB60 581 0.20 0.96 0.06 184 URIBL_BLACK 579 0.17 0.95 0.01 185 T_HTML_TAG_BALANCE_CENTER 569 0.23 0.94 0.09 186 ANY_BOUNCE_MESSAGE 565 5.12 0.93 5.93 187 XMSubMetaSxObfu_03 564 0.60 0.93 0.53 188 BOUNCE_MESSAGE 561 5.12 0.92 5.93 189 URIBL_DBL_SPAM 556 0.23 0.92 0.09 190 XMLngstWrd_01 556 0.56 0.92 0.49 191 XMMoneyMeta_00 553 0.37 0.91 0.26 192 MISSING_HEADERS 544 0.38 0.90 0.28 193 RCVD_IN_MSPIKE_H3 544 3.08 0.90 3.50 194 RELAYCOUNTRY_CN 542 0.19 0.89 0.05 195 HTML_TEXT_INVISIBLE_STYLE 541 0.23 0.89 0.10 196 TM2_M_A_HREF_HREF 537 0.52 0.88 0.45 197 XM_ProductURIs 535 1.42 0.88 1.53 198 BODY_ENHANCEMENT 535 0.31 0.88 0.19 199 MIME_CHARSET_FARAWAY 528 0.22 0.87 0.10 200 XM_XX_Yahoo 527 0.26 0.87 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 253234 81.19 83.01 80.84 2 DKIM_SIGNED 242201 76.96 75.10 77.32 3 XM_DK_Pass 238835 75.59 72.24 76.24 4 DKIM_VALID 229720 72.42 67.73 73.33 5 XM_B_Unicode 211108 67.41 67.48 67.39 6 DKIM_VALID_AU 190297 59.16 50.95 60.75 7 XMListUnsubscribeExists 175905 57.53 64.65 56.15 8 BAYES_50 157811 50.27 49.71 50.38 9 DCC_CHECK 157313 55.02 79.79 50.22 10 DCC_CHECK_NEGATIVE 152417 43.76 18.48 48.65 11 XM_B_Unicode3 135088 43.41 44.90 43.12 12 HTML_FONT_LOW_CONTRAST 101267 32.69 34.56 32.33 13 LOC_TINY_FONT_1 90875 29.64 32.89 29.01 14 DKIM_VALID_EF 82749 25.11 18.37 26.42 15 BAYES_00 75111 20.56 2.95 23.98 16 MIME_HTML_ONLY 71270 23.15 25.20 22.75 17 T_TM2_M_HEADER_IN_MSG 70384 21.65 17.42 22.47 18 XMSubLong 69349 23.03 27.61 22.14 19 FVGT_m_MULTI_ODD 65771 21.87 26.41 21.00 20 TR_XM_DK_Bayes 61210 16.66 1.81 19.54 21 ALL_TRUSTED 59296 16.31 2.79 18.93 22 TR_XM_DK_Bayes1 58963 16.03 1.63 18.82 23 TR_XM_DK_Bayes2 54896 14.90 1.34 17.52 24 XM_Body_Dirty_Words 49330 16.69 21.58 15.75 25 MultiRelay 49077 17.70 28.21 15.67 26 T_KAM_HTML_FONT_INVALID 45448 14.93 17.12 14.51 27 RCVD_IN_RP_SAFE 44041 12.10 1.99 14.06 28 XM_Multi_Part_URI 42124 13.91 16.32 13.45 29 HTML_IMAGE_RATIO_02 39401 13.05 15.46 12.58 30 RCVD_IN_RP_CERTIFIED 38498 10.41 0.69 12.29 31 XM_DKIMWhitelistDomains 34345 9.20 0.08 10.96 32 XM_Evil_Numbers_Gen 33551 10.88 11.77 10.71 33 FSL_BULK_SIG 26744 10.55 20.96 8.54 34 LOTS_OF_MONEY 26048 9.14 13.39 8.32 35 RCVD_IN_MSPIKE_H2 26048 8.09 6.92 8.32 36 HTML_IMAGE_RATIO_04 25821 8.05 7.04 8.24 37 T_TooManySym_01 24005 6.90 2.96 7.66 38 T_XMDrugObfuBody_14 23181 8.09 11.62 7.40 39 XM_SendGrid 22973 6.81 4.09 7.33 40 XM_B_Phish_Phrases 22776 7.03 5.78 7.27 41 LotsOfNums_01 21841 6.88 6.40 6.97 42 BOTNET_IPINHOSTNAME 19766 8.76 21.39 6.31 43 XM_DK_Undo_02 19739 10.09 29.65 6.30 44 TM2_M_URI_OPT_OUT 19072 5.64 3.31 6.09 45 XM_H_Long_From01 18685 7.44 15.06 5.96 46 ANY_BOUNCE_MESSAGE 18584 5.12 0.93 5.93 47 BOUNCE_MESSAGE 18582 5.12 0.92 5.93 48 TooManyTo_001 18546 6.72 10.88 5.92 49 XMStrtUSub 18116 5.61 4.71 5.78 50 XMSexyCombo_05 17529 6.50 11.17 5.60 51 BAYES_40 16799 5.34 5.22 5.36 52 XM_B_SpammyTLD 15694 5.77 9.72 5.01 53 RELAYCOUNTRY_META 15498 9.23 31.36 4.95 54 XMSubMetaSx_00 15438 5.50 8.45 4.93 55 BAYES_20 14963 4.57 3.49 4.78 56 FROM_EXCESS_BASE64 14711 4.59 4.02 4.70 57 TO_MALFORMED 14473 3.88 0.05 4.62 58 TR_XM_DK_SendGrid 14013 4.09 2.10 4.47 59 BAYES_60 13562 4.32 4.30 4.33 60 XMNumbers 13183 5.12 9.83 4.21 61 RCVD_IN_MSPIKE_WL 12504 3.59 1.51 3.99 62 DKIM_INVALID 12481 4.53 7.37 3.98 63 MPART_ALT_DIFF 12196 4.31 6.48 3.89 64 MIME_QP_LONG_LINE 11760 3.67 3.21 3.75 65 UNPARSEABLE_RELAY 11735 3.35 1.33 3.75 66 BAYES_05 11641 3.43 1.97 3.72 67 BAYES_99 11555 6.72 22.36 3.69 68 HTML_IMAGE_RATIO_06 11515 3.80 4.43 3.68 69 XM_DIRTYINTL 11291 4.16 7.05 3.60 70 XM_UncommonTLD01 11200 5.37 14.66 3.58 71 RCVD_IN_MSPIKE_H3 10960 3.08 0.90 3.50 72 MIME_HTML_MOSTLY 10872 3.64 4.51 3.47 73 TVD_RCVD_IP 10539 2.93 0.66 3.36 74 XMBdyGiftCard01 10034 3.24 3.41 3.20 75 BAYES_999 9797 5.48 17.60 3.13 76 CK_HELO_DYNAMIC_SPLIT_IP 9378 2.67 1.01 2.99 77 IN_ZIMBRA_NJ_WHITELIST 9360 2.51 0.02 2.99 78 HELO_DYNAMIC_IPADDR2 9321 2.52 0.19 2.98 79 RCVD_IN_IADB_LISTED 9189 2.67 1.28 2.93 80 T_TooManySym_02 8803 2.56 1.30 2.81 81 T_REMOTE_IMAGE 8175 2.69 3.13 2.61 82 RCVD_IN_IADB_SPF 7921 2.32 1.22 2.53 83 INVALID_MSGID 7746 2.10 0.18 2.47 84 URI_OPTOUT_3LD 7315 2.06 0.64 2.34 85 HTML_IMAGE_RATIO_08 7295 2.35 2.43 2.33 86 BOTNET 7270 4.83 17.80 2.32 87 URI_HEX 7206 2.41 2.99 2.30 88 BAYES_80 7171 2.97 6.51 2.29 89 RCVD_IN_IADB_SENDERID 7025 2.07 1.21 2.24 90 TR_MetaPhish_Combo_01 6899 1.98 0.84 2.20 91 RCVD_IN_IADB_DK 6837 2.02 1.20 2.18 92 TR_DCC_Bayes_99 6713 4.62 17.40 2.14 93 MIME_HTML_ONLY_MULTI 6497 2.37 3.88 2.07 94 UNTRUSTED_Relay 6237 4.32 16.31 1.99 95 RCVD_IN_IADB_VOUCHED 5835 1.60 0.26 1.86 96 XM_CamelCaseFrm001 5565 2.26 4.78 1.78 97 XMStockSpam_06 5541 1.73 1.55 1.77 98 XM_OfRef6 5407 1.89 2.72 1.73 99 XMSexyCombo_01 5340 1.88 2.77 1.70 100 XM_PDF 5138 1.44 0.38 1.64 101 TM2_M_VERY_LONG_WORD 4974 1.68 2.18 1.59 102 USER_IN_DEF_DKIM_WL 4950 1.32 0.01 1.58 103 IN_HORDE_ADDRESS_BOOK 4893 1.32 0.04 1.56 104 XM_ProductURIs 4787 1.42 0.88 1.53 105 RELAYCOUNTRY_CA 4758 1.98 4.39 1.52 106 MAILING_LIST_MULTI 4600 1.42 1.15 1.47 107 T_XMDrugObfuBody_08 4446 1.57 2.37 1.42 108 XM_DK_Undo_01 4291 1.34 1.20 1.37 109 TR_LOTS_OF_MONEY3 4162 1.35 1.47 1.33 110 XMDiploma_00 4139 1.40 1.80 1.32 111 URI_TRY_3LD 4094 1.23 0.82 1.31 112 HTML_MIME_NO_HTML_TAG 4082 1.49 2.43 1.30 113 NO_DNS_FOR_FROM 4076 1.68 3.66 1.30 114 TR_Symld_Words 3925 1.23 1.10 1.25 115 TR_XM_RelayPhish 3815 1.30 1.74 1.22 116 KHOP_HELO_FCRDNS 3721 1.75 4.67 1.19 117 SUBJ_ALL_CAPS 3677 1.96 5.99 1.17 118 RCVD_IN_IADB_OPTIN 3662 1.02 0.25 1.17 119 BAYES_95 3551 1.45 3.09 1.13 120 TooManyTo_002 3471 1.13 1.22 1.11 121 XMGappySubj_01 3324 0.95 0.35 1.06 122 XM_H_Long_From02 3314 1.12 1.44 1.06 123 XMPhish30 3286 1.09 1.28 1.05 124 XMBody_17 3264 1.13 1.58 1.04 125 XM_SPF_SoftFail 3213 1.77 5.59 1.03 126 XMSexyCombo_04 3181 1.08 1.41 1.02 127 XMSubMetaI_00 3136 1.29 2.77 1.00 128 XMSolicitRefs_0 3104 0.87 0.25 0.99 129 XM_GoogleGroups 3033 0.88 0.42 0.97 130 T_MONEY_PERCENT 2974 1.19 2.43 0.95 131 TR_LOTS_OF_MONEY2 2974 1.19 2.43 0.95 132 XMPhish11 2863 1.34 3.56 0.91 133 DKIM_ADSP_CUSTOM_MED 2829 2.55 11.05 0.90 134 XM_B_REG_HTML 2796 0.80 0.33 0.89 135 FILL_THIS_FORM 2760 0.98 1.46 0.88 136 T_XMHurry_00 2643 0.97 1.62 0.84 137 XM_UB50 2638 2.07 8.43 0.84 138 XMBody_95 2618 0.71 0.05 0.84 139 SUBJ_DOLLARS 2583 0.76 0.44 0.82 140 T_FILL_THIS_FORM_SHORT 2575 0.82 0.82 0.82 141 TooManyTo_003 2558 0.85 1.03 0.82 142 FILL_THIS_FORM_LONG 2531 0.90 1.34 0.81 143 XM_RXBody 2457 0.71 0.35 0.78 144 FILL_THIS_FORM_LOAN 2415 0.68 0.24 0.77 145 XMSubMetaSxObfu_02 2392 0.69 0.32 0.76 146 THIS_AD 2378 0.87 1.43 0.76 147 XMGenDplmaNmb 2375 0.86 1.40 0.76 148 T_XMDrugObfuBody_00 2326 0.87 1.50 0.74 149 URI_WP_HACKED_2 2325 0.68 0.39 0.74 150 HTML_FONT_FACE_BAD 2274 0.83 1.34 0.73 151 HTML_TAG_BALANCE_BODY 2264 0.79 1.14 0.72 152 XMBrknScrpt_02 2263 0.84 1.45 0.72 153 RCVD_IN_BL_SPAMCOP_NET 2215 1.24 3.98 0.71 154 USER_IN_WHITELIST 2090 0.56 0.00 0.67 155 TooManyTo_004 2088 0.70 0.85 0.67 156 T_TooManySym_03 2067 0.63 0.46 0.66 157 NUMERIC_HTTP_ADDR 2053 0.59 0.24 0.66 158 XMSubEmpty 2047 0.60 0.30 0.65 159 HK_RANDOM_REPLYTO 2044 0.66 0.72 0.65 160 NML_ADSP_CUSTOM_MED 2027 2.32 10.97 0.65 161 DKIM_ADSP_NXDOMAIN 1954 0.93 2.48 0.62 162 PLING_QUERY 1928 0.62 0.62 0.62 163 XMBSHREFv2 1905 0.57 0.38 0.61 164 XM_H_PHPMailer 1871 0.85 2.15 0.60 165 TR_XM_PHPDW 1851 0.98 2.97 0.59 166 TooManyTo_005 1836 0.61 0.70 0.59 167 TR_XM_PHPForged 1809 0.96 2.94 0.58 168 TR_XM_FormFill2 1781 0.95 2.91 0.57 169 XM_H_PHPOS 1764 0.94 2.90 0.56 170 XMLngstWrd_00 1725 0.64 1.08 0.55 171 XMNoSubject 1704 0.48 0.14 0.54 172 MISSING_SUBJECT 1704 0.48 0.14 0.54 173 XMHTMLBadTable_001 1688 0.56 0.69 0.54 174 DIET_1 1675 0.75 1.87 0.53 175 XMSubMetaSxObfu_03 1673 0.60 0.93 0.53 176 XMBody_78 1649 0.57 0.82 0.53 177 SpammyFromTLD_02 1623 2.28 11.35 0.52 178 XM_B_COPY_HTML 1577 0.56 0.84 0.50 179 XMLngstWrd_01 1544 0.56 0.92 0.49 180 RELAYCOUNTRY_GB 1505 1.37 5.98 0.48 181 HELO_NODOT 1475 0.45 0.35 0.47 182 URIBL_SBL_A 1445 0.66 1.71 0.46 183 TM2_M_A_HREF_HREF 1411 0.52 0.88 0.45 184 RDNS_DYNAMIC 1403 0.63 1.57 0.45 185 HELO_NO_DOMAIN 1380 0.43 0.35 0.44 186 FORGED_GMAIL_RCVD 1372 1.69 8.14 0.44 187 XMHTML_After_End 1332 0.43 0.43 0.43 188 HTTPS_HTTP_MISMATCH 1300 0.39 0.25 0.41 189 MPART_ALT_DIFF_COUNT 1299 0.46 0.69 0.41 190 NORMAL_HTTP_TO_IP 1288 0.36 0.08 0.41 191 XM_Body_Obfu01 1268 0.44 0.63 0.40 192 SpammyFromTLD_01 1248 0.67 2.07 0.40 193 XMCapTrack 1239 0.36 0.18 0.40 194 XM_URI_RBL 1236 0.78 2.79 0.39 195 URI_NOVOWEL 1206 0.38 0.35 0.38 196 RELAYCOUNTRY_AU 1206 0.39 0.41 0.38 197 XMSlimDrugH 1188 0.41 0.59 0.38 198 RELAYCOUNTRY_AT 1185 0.60 1.76 0.38 199 XM_ShortIntro_01 1155 0.39 0.50 0.37 200 FSL_HELO_FAKE 1148 0.31 0.03 0.37 ----------------------------------------------------------------------