Email: 662340 Autolearn: 0 AvgScore: 1.12 AvgScanTime: 2.28 sec Spam: 103676 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 3.07 sec Ham: 558664 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 2.13 sec Time Spent Running SA: 418.81 hours Time Spent Processing Spam: 88.45 hours Time Spent Processing Ham: 330.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96517 88.18 93.09 87.26 2 DCC_CHECK 81836 49.00 78.93 43.45 3 DKIM_SIGNED 79025 76.09 76.22 76.06 4 XM_DK_Pass 75349 74.62 72.68 74.99 5 XM_B_Unicode 73582 69.52 70.97 69.25 6 XMListUnsubscribeExists 72218 55.50 69.66 52.87 7 DKIM_VALID 70307 70.89 67.81 71.46 8 DKIM_VALID_AU 52753 53.35 50.88 53.81 9 BAYES_50 51534 52.73 49.71 53.29 10 XM_B_Unicode3 45771 41.35 44.15 40.83 11 MIME_HTML_ONLY 35303 21.94 34.05 19.70 12 LOC_TINY_FONT_1 34674 25.99 33.44 24.60 13 XM_DK_Undo_02 34323 9.89 33.11 5.58 14 HTML_FONT_LOW_CONTRAST 34262 29.18 33.05 28.46 15 XMSubLong 27997 23.06 27.00 22.32 16 FVGT_m_MULTI_ODD 27500 23.01 26.52 22.35 17 RELAYCOUNTRY_META 27203 8.91 26.24 5.70 18 DKIM_VALID_EF 24776 25.70 23.90 26.04 19 XM_Body_Dirty_Words 23633 15.19 22.80 13.78 20 BOTNET 22304 5.29 21.51 2.28 21 BAYES_99 22257 5.46 21.47 2.49 22 BOTNET_IPINHOSTNAME 20690 7.17 19.96 4.80 23 T_KAM_HTML_FONT_INVALID 19612 18.71 18.92 18.67 24 MultiRelay 19452 18.41 18.76 18.34 25 DCC_CHECK_NEGATIVE 19370 48.96 18.68 54.58 26 XM_UncommonTLD01 17676 5.60 17.05 3.47 27 T_TM2_M_HEADER_IN_MSG 17602 27.99 16.98 30.03 28 XM_Multi_Part_URI 17417 12.71 16.80 11.95 29 TR_DCC_Bayes_99 17284 3.76 16.67 1.36 30 BAYES_999 17054 4.17 16.45 1.90 31 FSL_BULK_SIG 16443 8.17 15.86 6.74 32 UNTRUSTED_Relay 15006 3.72 14.47 1.73 33 XM_Evil_Numbers_Gen 13678 10.05 13.19 9.47 34 LOTS_OF_MONEY 12664 9.16 12.21 8.59 35 HTML_IMAGE_RATIO_02 12209 9.27 11.78 8.80 36 XMSexyCombo_05 11817 5.16 11.40 4.00 37 T_XMDrugObfuBody_14 10369 8.51 10.00 8.24 38 TooManyTo_001 10271 8.52 9.91 8.26 39 SpammyFromTLD_02 10012 1.74 9.66 0.28 40 LotsOfNums_01 9123 8.13 8.80 8.01 41 MPART_ALT_DIFF 8970 4.36 8.65 3.56 42 XMSubMetaSx_00 8927 4.70 8.61 3.97 43 DKIM_INVALID 8718 5.20 8.41 4.60 44 HTML_IMAGE_RATIO_04 8601 5.83 8.30 5.37 45 XM_UB50 8271 2.09 7.98 1.00 46 XM_H_Long_From01 8086 6.55 7.80 6.32 47 KHOP_HELO_FCRDNS 7903 3.06 7.62 2.21 48 XM_DIRTYINTL 6872 3.55 6.63 2.98 49 MIME_HTML_MOSTLY 6858 3.27 6.61 2.65 50 XM_B_Phish_Phrases 6571 6.05 6.34 6.00 51 RCVD_IN_MSPIKE_H2 6175 6.73 5.96 6.87 52 XMNumbers 5935 3.84 5.72 3.49 53 BAYES_80 5764 2.44 5.56 1.86 54 HTML_MIME_NO_HTML_TAG 5737 2.66 5.53 2.12 55 XM_B_SpammyTLD 5644 3.71 5.44 3.38 56 T_REMOTE_IMAGE 5495 3.88 5.30 3.62 57 BAYES_40 5432 6.59 5.24 6.85 58 HTML_IMAGE_RATIO_06 5328 3.66 5.14 3.39 59 XM_URI_RBL 4908 0.99 4.73 0.30 60 FROM_SUSPICIOUS_NTLD 4827 0.76 4.66 0.03 61 FROM_SUSPICIOUS_NTLD_FP 4773 0.75 4.60 0.03 62 MIME_QP_LONG_LINE 4658 5.79 4.49 6.03 63 BAYES_00 4592 18.86 4.43 21.54 64 RELAYCOUNTRY_GB 4565 1.65 4.40 1.14 65 BAYES_60 4521 4.01 4.36 3.95 66 MIME_HTML_ONLY_MULTI 4501 2.22 4.34 1.83 67 RELAYCOUNTRY_CA 4464 2.02 4.31 1.59 68 XM_SPF_SoftFail 4275 2.66 4.12 2.39 69 TR_Mismatch_TLD_02 4210 0.73 4.06 0.11 70 NO_DNS_FOR_FROM 4120 1.52 3.97 1.06 71 RCVD_IN_RP_RNBL 3983 0.66 3.84 0.07 72 BAYES_20 3956 5.16 3.82 5.41 73 TM2_M_URI_OPT_OUT 3930 2.08 3.79 1.76 74 T_TooManySym_01 3910 5.40 3.77 5.70 75 DKIM_ADSP_NXDOMAIN 3873 0.94 3.74 0.42 76 HTML_SHORT_LINK_IMG_1 3804 0.60 3.67 0.03 77 XMStrtUSub 3791 4.24 3.66 4.35 78 RCVD_IN_BL_SPAMCOP_NET 3713 1.15 3.58 0.70 79 XMSexyCombo_01 3640 1.36 3.51 0.96 80 URI_HEX 3561 2.29 3.43 2.07 81 REPLYTO_WITHOUT_TO_CC 3538 0.57 3.41 0.04 82 HTML_IMAGE_RATIO_08 3479 2.45 3.36 2.29 83 RELAYCOUNTRY_FR 3441 0.81 3.32 0.35 84 XMDiploma_00 3388 2.10 3.27 1.88 85 HTML_IMAGE_ONLY_12 3356 0.65 3.24 0.18 86 XM_SendGrid 3331 5.70 3.21 6.16 87 MultiRelay_CC 3319 0.68 3.20 0.22 88 MultiRelay_Combo 3319 0.68 3.20 0.22 89 HDRS_LCASE_IMGONLY 3310 0.54 3.19 0.04 90 BOTNET_NORDNS 3291 0.54 3.17 0.05 91 XM_CamelCaseFrm001 3190 2.39 3.08 2.26 92 XM_OfRef6 3149 1.69 3.04 1.44 93 FROM_EXCESS_BASE64 3129 3.23 3.02 3.27 94 SpammyFromTLD_01 3091 1.42 2.98 1.13 95 T_XMDrugObfuBody_08 3070 1.80 2.96 1.58 96 BAYES_95 3054 1.39 2.95 1.10 97 MIME_HEADER_CTYPE_ONLY 3031 0.56 2.92 0.12 98 TR_XM_PHPDW 2948 1.37 2.84 1.10 99 TR_XM_PHPForged 2868 1.35 2.77 1.09 100 TR_XM_FormFill2 2864 1.34 2.76 1.08 101 RDNS_DYNAMIC 2849 0.72 2.75 0.35 102 XM_H_PHPOS 2844 1.34 2.74 1.07 103 DEAR_FRIEND 2826 0.55 2.73 0.14 104 DATE_IN_PAST_03_06 2814 0.52 2.71 0.12 105 TR_XM_DK_Bayes 2784 15.31 2.69 17.66 106 TO_EQ_FM_DOM_HTML_IMG 2635 0.41 2.54 0.01 107 XM_BadFromFormat 2543 0.47 2.45 0.11 108 TR_XM_DK_Bayes1 2532 14.59 2.44 16.84 109 XMGenDplmaNmb 2387 1.32 2.30 1.13 110 XM_H_TOP 2369 0.36 2.29 0.00 111 XMHTML_After_End 2347 1.15 2.26 0.94 112 RCVD_IN_IADB_LISTED 2341 4.62 2.26 5.05 113 BAYES_05 2291 3.09 2.21 3.25 114 RELAYCOUNTRY_DE 2226 0.74 2.15 0.48 115 RCVD_IN_IADB_SPF 2190 4.07 2.11 4.43 116 TR_XM_INV_DKIM 2158 0.38 2.08 0.07 117 RCVD_IN_IADB_DK 2139 3.56 2.06 3.84 118 RCVD_IN_IADB_SENDERID 2137 3.60 2.06 3.89 119 T_XMDrugObfuBody_00 2081 1.06 2.01 0.89 120 TM2_M_VERY_LONG_WORD 2003 1.49 1.93 1.41 121 TR_M_TOP_BAYES 2002 0.30 1.93 0.00 122 FROM_MISSP_REPLYTO 1997 0.30 1.93 0.00 123 DKIM_ADSP_CUSTOM_MED 1959 1.14 1.89 1.00 124 ALL_TRUSTED 1919 13.69 1.85 15.89 125 TR_XM_RelayPhish 1901 1.06 1.83 0.91 126 HK_SCAM 1861 0.31 1.80 0.04 127 XMBdyGiftCard01 1850 1.45 1.78 1.39 128 FROM_MISSP_DYNIP 1848 0.28 1.78 0.00 129 XMStockSpam_06 1832 1.32 1.77 1.23 130 T_XMHurry_00 1827 0.76 1.76 0.58 131 NML_ADSP_CUSTOM_MED 1813 0.89 1.75 0.73 132 T_MONEY_PERCENT 1810 0.69 1.75 0.49 133 TR_LOTS_OF_MONEY2 1810 0.69 1.75 0.49 134 RCVD_IN_PSBL 1778 0.30 1.71 0.04 135 XMPhish11 1745 1.30 1.68 1.23 136 TR_XM_DK_SendGrid 1736 3.13 1.67 3.40 137 RCVD_IN_RP_SAFE 1714 8.32 1.65 9.55 138 SUBJ_ALL_CAPS 1705 1.36 1.64 1.31 139 XMSubMetaI_00 1684 0.79 1.62 0.64 140 DOS_RCVD_IP_TWICE_B 1664 0.32 1.61 0.08 141 TR_Symld_Words 1653 1.48 1.59 1.46 142 RELAYCOUNTRY_IN 1634 0.36 1.58 0.13 143 XM_DK_Undo_01 1603 1.46 1.55 1.44 144 XM_H_PHPMailer 1564 0.64 1.51 0.48 145 XMBody_17 1557 1.04 1.50 0.95 146 XMBrknScrpt_02 1540 0.72 1.49 0.57 147 MAILING_LIST_MULTI 1520 2.26 1.47 2.41 148 TR_LOTS_OF_MONEY3 1519 0.63 1.47 0.47 149 XMSexyCombo_04 1498 0.33 1.44 0.12 150 URIBL_DBL_SPAM 1440 0.25 1.39 0.04 151 HK_RANDOM_REPLYTO 1419 0.47 1.37 0.30 152 XM_H_PHPOS_M 1384 0.35 1.33 0.16 153 XMPhish30 1362 0.70 1.31 0.59 154 XM_ProductURIs 1342 1.24 1.29 1.23 155 RELAYCOUNTRY_AT 1329 0.36 1.28 0.19 156 XM_H_Long_From02 1313 1.07 1.27 1.04 157 XMSubMetaSSx_00 1302 0.34 1.26 0.17 158 TR_XM_DK_Bayes2 1290 12.46 1.24 14.54 159 XM_UB60 1282 0.25 1.24 0.06 160 URIBL_DBL_ABUSE_REDIR 1268 0.20 1.22 0.00 161 RCVD_IN_MSPIKE_WL 1261 4.68 1.22 5.32 162 HELO_NODOT 1251 1.59 1.21 1.66 163 HELO_NO_DOMAIN 1250 1.59 1.21 1.66 164 DATE_IN_FUTURE_03_06 1246 0.19 1.20 0.00 165 FORGED_GMAIL_RCVD 1160 0.64 1.12 0.55 166 XMMoneyMeta_00 1150 0.74 1.11 0.67 167 FILL_THIS_FORM 1138 0.65 1.10 0.57 168 XM_XX_Yahoo 1137 0.26 1.10 0.11 169 T_TooManySym_02 1131 2.09 1.09 2.28 170 SUBJ_DOLLARS 1118 0.51 1.08 0.41 171 RCVD_IN_MSPIKE_H3 1106 3.97 1.07 4.51 172 BODY_ENHANCEMENT 1094 0.25 1.06 0.10 173 URI_NOVOWEL 1079 0.68 1.04 0.61 174 XMSubMetaSxObfu_03 1060 0.62 1.02 0.54 175 NORDNS_LOW_CONTRAST 1053 0.17 1.02 0.01 176 BODY_URI_ONLY 1053 0.26 1.02 0.12 177 XM_Combo_Sbj 1052 0.32 1.01 0.19 178 FSL_THIS_IS_ADV 1041 0.41 1.00 0.30 179 HTML_IMAGE_ONLY_08 1039 0.26 1.00 0.12 180 XMBody_78 1037 0.65 1.00 0.58 181 UNPARSEABLE_RELAY 1018 2.05 0.98 2.25 182 T_HTML_TAG_BALANCE_CENTER 1010 0.35 0.97 0.23 183 LOW_PRICE 1002 0.39 0.97 0.29 184 T_Symld_Words_02 994 0.55 0.96 0.48 185 DATE_IN_FUTURE_06_12 984 0.15 0.95 0.00 186 MPART_ALT_DIFF_COUNT 981 0.37 0.95 0.26 187 DATE_IN_PAST_12_24 979 0.20 0.94 0.06 188 XM_PDF 964 3.66 0.93 4.16 189 RELAYCOUNTRY_LT 963 0.20 0.93 0.07 190 SUBJ_OBFU_PUNCT_FEW 960 0.24 0.93 0.11 191 T_FILL_THIS_FORM_SHORT 934 0.89 0.90 0.89 192 URIBL_BLACK 929 0.16 0.90 0.02 193 XMhairloss01 928 0.15 0.90 0.02 194 ADMITS_SPAM 927 0.19 0.89 0.06 195 FILL_THIS_FORM_LONG 895 0.43 0.86 0.35 196 XM_OfRef7 871 0.32 0.84 0.22 197 XMNoVowels 849 0.56 0.82 0.51 198 ADVANCE_FEE_5_NEW_MONEY 846 0.13 0.82 0.00 199 LONG_HEX_URI 846 0.26 0.82 0.16 200 XM_UB99 830 0.13 0.80 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 487510 88.18 93.09 87.26 2 DKIM_SIGNED 424924 76.09 76.22 76.06 3 XM_DK_Pass 418920 74.62 72.68 74.99 4 DKIM_VALID 399208 70.89 67.81 71.46 5 XM_B_Unicode 386857 69.52 70.97 69.25 6 DCC_CHECK_NEGATIVE 304936 48.96 18.68 54.58 7 DKIM_VALID_AU 300632 53.35 50.88 53.81 8 BAYES_50 297732 52.73 49.71 53.29 9 XMListUnsubscribeExists 295375 55.50 69.66 52.87 10 DCC_CHECK 242726 49.00 78.93 43.45 11 XM_B_Unicode3 228106 41.35 44.15 40.83 12 T_TM2_M_HEADER_IN_MSG 167778 27.99 16.98 30.03 13 HTML_FONT_LOW_CONTRAST 158990 29.18 33.05 28.46 14 DKIM_VALID_EF 145470 25.70 23.90 26.04 15 LOC_TINY_FONT_1 137448 25.99 33.44 24.60 16 FVGT_m_MULTI_ODD 124874 23.01 26.52 22.35 17 XMSubLong 124713 23.06 27.00 22.32 18 BAYES_00 120358 18.86 4.43 21.54 19 MIME_HTML_ONLY 110043 21.94 34.05 19.70 20 T_KAM_HTML_FONT_INVALID 104296 18.71 18.92 18.67 21 MultiRelay 102461 18.41 18.76 18.34 22 TR_XM_DK_Bayes 98648 15.31 2.69 17.66 23 TR_XM_DK_Bayes1 94104 14.59 2.44 16.84 24 ALL_TRUSTED 88770 13.69 1.85 15.89 25 TR_XM_DK_Bayes2 81238 12.46 1.24 14.54 26 XM_Body_Dirty_Words 76960 15.19 22.80 13.78 27 XM_Multi_Part_URI 66782 12.71 16.80 11.95 28 RCVD_IN_RP_SAFE 53368 8.32 1.65 9.55 29 XM_Evil_Numbers_Gen 52899 10.05 13.19 9.47 30 HTML_IMAGE_RATIO_02 49187 9.27 11.78 8.80 31 LOTS_OF_MONEY 47985 9.16 12.21 8.59 32 TooManyTo_001 46148 8.52 9.91 8.26 33 T_XMDrugObfuBody_14 46018 8.51 10.00 8.24 34 RCVD_IN_RP_CERTIFIED 45844 7.02 0.64 8.21 35 LotsOfNums_01 44723 8.13 8.80 8.01 36 XM_DKIMWhitelistDomains 41136 6.22 0.03 7.36 37 RCVD_IN_MSPIKE_H2 38371 6.73 5.96 6.87 38 BAYES_40 38245 6.59 5.24 6.85 39 FSL_BULK_SIG 37643 8.17 15.86 6.74 40 XM_H_Long_From01 35326 6.55 7.80 6.32 41 XM_SendGrid 34436 5.70 3.21 6.16 42 MIME_QP_LONG_LINE 33682 5.79 4.49 6.03 43 XM_B_Phish_Phrases 33506 6.05 6.34 6.00 44 RELAYCOUNTRY_META 31838 8.91 26.24 5.70 45 T_TooManySym_01 31824 5.40 3.77 5.70 46 XM_DK_Undo_02 31189 9.89 33.11 5.58 47 BAYES_20 30220 5.16 3.82 5.41 48 HTML_IMAGE_RATIO_04 29982 5.83 8.30 5.37 49 RCVD_IN_MSPIKE_WL 29733 4.68 1.22 5.32 50 RCVD_IN_IADB_LISTED 28233 4.62 2.26 5.05 51 BOTNET_IPINHOSTNAME 26831 7.17 19.96 4.80 52 DKIM_INVALID 25716 5.20 8.41 4.60 53 RCVD_IN_MSPIKE_H3 25174 3.97 1.07 4.51 54 RCVD_IN_IADB_SPF 24743 4.07 2.11 4.43 55 XMStrtUSub 24275 4.24 3.66 4.35 56 XM_PDF 23265 3.66 0.93 4.16 57 XMSexyCombo_05 22367 5.16 11.40 4.00 58 XMSubMetaSx_00 22192 4.70 8.61 3.97 59 BAYES_60 22059 4.01 4.36 3.95 60 RCVD_IN_IADB_SENDERID 21714 3.60 2.06 3.89 61 RCVD_IN_IADB_DK 21425 3.56 2.06 3.84 62 T_REMOTE_IMAGE 20207 3.88 5.30 3.62 63 MPART_ALT_DIFF 19904 4.36 8.65 3.56 64 XMNumbers 19491 3.84 5.72 3.49 65 XM_UncommonTLD01 19385 5.60 17.05 3.47 66 IN_ZIMBRA_NJ_WHITELIST 19060 2.88 0.02 3.41 67 TR_XM_DK_SendGrid 18975 3.13 1.67 3.40 68 HTML_IMAGE_RATIO_06 18945 3.66 5.14 3.39 69 XM_B_SpammyTLD 18909 3.71 5.44 3.38 70 FROM_EXCESS_BASE64 18267 3.23 3.02 3.27 71 BAYES_05 18173 3.09 2.21 3.25 72 RCVD_IN_IADB_VOUCHED 17917 2.80 0.62 3.21 73 XM_DIRTYINTL 16656 3.55 6.63 2.98 74 MIME_HTML_MOSTLY 14816 3.27 6.61 2.65 75 TO_MALFORMED 14364 2.19 0.12 2.57 76 ANY_BOUNCE_MESSAGE 14023 2.19 0.50 2.51 77 BAYES_99 13928 5.46 21.47 2.49 78 BOUNCE_MESSAGE 13869 2.17 0.46 2.48 79 MAILING_LIST_MULTI 13459 2.26 1.47 2.41 80 XM_SPF_SoftFail 13343 2.66 4.12 2.39 81 HTML_IMAGE_RATIO_08 12773 2.45 3.36 2.29 82 BOTNET 12748 5.29 21.51 2.28 83 T_TooManySym_02 12737 2.09 1.09 2.28 84 XM_CamelCaseFrm001 12647 2.39 3.08 2.26 85 UNPARSEABLE_RELAY 12574 2.05 0.98 2.25 86 KHOP_HELO_FCRDNS 12346 3.06 7.62 2.21 87 TVD_RCVD_IP 12223 1.93 0.53 2.19 88 HTML_MIME_NO_HTML_TAG 11855 2.66 5.53 2.12 89 RCVD_IN_IADB_OPTIN 11588 1.83 0.52 2.07 90 URI_HEX 11578 2.29 3.43 2.07 91 TooManyTo_002 11026 1.79 0.80 1.97 92 BAYES_999 10587 4.17 16.45 1.90 93 XMDiploma_00 10522 2.10 3.27 1.88 94 BAYES_80 10412 2.44 5.56 1.86 95 MIME_HTML_ONLY_MULTI 10211 2.22 4.34 1.83 96 TM2_M_URI_OPT_OUT 9814 2.08 3.79 1.76 97 UNTRUSTED_Relay 9646 3.72 14.47 1.73 98 TR_MetaPhish_Combo_01 9518 1.51 0.49 1.70 99 HELO_NODOT 9274 1.59 1.21 1.66 100 HELO_NO_DOMAIN 9271 1.59 1.21 1.66 101 RELAYCOUNTRY_CA 8909 2.02 4.31 1.59 102 T_XMDrugObfuBody_08 8847 1.80 2.96 1.58 103 CK_HELO_DYNAMIC_SPLIT_IP 8339 1.36 0.66 1.49 104 HELO_DYNAMIC_IPADDR2 8292 1.27 0.11 1.48 105 URI_TRY_3LD 8163 1.35 0.72 1.46 106 TR_Symld_Words 8149 1.48 1.59 1.46 107 XM_DK_Undo_01 8043 1.46 1.55 1.44 108 XM_OfRef6 8029 1.69 3.04 1.44 109 IN_HORDE_ADDRESS_BOOK 7927 1.20 0.02 1.42 110 TM2_M_VERY_LONG_WORD 7868 1.49 1.93 1.41 111 XMBdyGiftCard01 7768 1.45 1.78 1.39 112 INVALID_MSGID 7680 1.23 0.44 1.37 113 TR_DCC_Bayes_99 7602 3.76 16.67 1.36 114 XMCapTrack 7525 1.18 0.28 1.35 115 TooManyTo_003 7411 1.21 0.61 1.33 116 SUBJ_ALL_CAPS 7335 1.36 1.64 1.31 117 USER_IN_DEF_DKIM_WL 6944 1.05 0.00 1.24 118 XMStockSpam_06 6889 1.32 1.77 1.23 119 XM_ProductURIs 6864 1.24 1.29 1.23 120 XMPhish11 6862 1.30 1.68 1.23 121 RELAYCOUNTRY_GB 6352 1.65 4.40 1.14 122 SpammyFromTLD_01 6330 1.42 2.98 1.13 123 XMGenDplmaNmb 6328 1.32 2.30 1.13 124 BAYES_95 6160 1.39 2.95 1.10 125 TR_XM_PHPDW 6158 1.37 2.84 1.10 126 TR_XM_PHPForged 6088 1.35 2.77 1.09 127 TR_XM_FormFill2 6030 1.34 2.76 1.08 128 XM_H_PHPOS 6001 1.34 2.74 1.07 129 NO_DNS_FOR_FROM 5921 1.52 3.97 1.06 130 XM_H_Long_From02 5790 1.07 1.27 1.04 131 XM_GoogleGroups 5768 0.95 0.53 1.03 132 DKIM_ADSP_CUSTOM_MED 5593 1.14 1.89 1.00 133 XM_UB50 5588 2.09 7.98 1.00 134 TooManyTo_004 5523 0.91 0.48 0.99 135 XMSexyCombo_01 5343 1.36 3.51 0.96 136 XMBody_17 5312 1.04 1.50 0.95 137 XMHTML_After_End 5250 1.15 2.26 0.94 138 TR_XM_RelayPhish 5103 1.06 1.83 0.91 139 T_XMDrugObfuBody_00 4972 1.06 2.01 0.89 140 T_FILL_THIS_FORM_SHORT 4963 0.89 0.90 0.89 141 XMGappySubj_01 4921 0.78 0.25 0.88 142 TooManyTo_005 4653 0.76 0.37 0.83 143 XM_SPF_Unknown 4179 0.72 0.59 0.75 144 NML_ADSP_CUSTOM_MED 4070 0.89 1.75 0.73 145 XM_RXBody 4002 0.66 0.36 0.72 146 RCVD_IN_BL_SPAMCOP_NET 3929 1.15 3.58 0.70 147 HTTPS_HTTP_MISMATCH 3888 0.71 0.79 0.70 148 XMHTMLBadTable_001 3872 0.67 0.53 0.69 149 TO_NO_BRKTS_HTML_ONLY 3757 0.60 0.23 0.67 150 XMMoneyMeta_00 3754 0.74 1.11 0.67 151 XMSubMetaI_00 3580 0.79 1.62 0.64 152 URI_NOVOWEL 3425 0.68 1.04 0.61 153 XMPhish30 3290 0.70 1.31 0.59 154 XMBody_95 3277 0.52 0.14 0.59 155 XMBody_78 3262 0.65 1.00 0.58 156 T_OBFU_PDF_ATTACH 3229 0.53 0.27 0.58 157 T_XMHurry_00 3227 0.76 1.76 0.58 158 XMBrknScrpt_02 3202 0.72 1.49 0.57 159 FILL_THIS_FORM 3199 0.65 1.10 0.57 160 XM_ShortIntro_01 3196 0.54 0.37 0.57 161 XMSubNoVowel 3133 0.58 0.70 0.56 162 FORGED_GMAIL_RCVD 3056 0.64 1.12 0.55 163 XMSubMetaSxObfu_03 3029 0.62 1.02 0.54 164 HTML_TAG_BALANCE_BODY 3012 0.55 0.59 0.54 165 RCVD_IN_MSPIKE_H5 2995 0.47 0.10 0.54 166 T_TooManySym_03 2995 0.52 0.42 0.54 167 HTML_FONT_FACE_BAD 2980 0.54 0.60 0.53 168 FROM_GOV_DKIM_AU 2980 0.47 0.16 0.53 169 XMLngstWrd_00 2952 0.51 0.42 0.53 170 NUMERIC_HTTP_ADDR 2902 0.51 0.48 0.52 171 XMNoVowels 2858 0.56 0.82 0.51 172 T_MONEY_PERCENT 2764 0.69 1.75 0.49 173 TR_LOTS_OF_MONEY2 2764 0.69 1.75 0.49 174 RELAYCOUNTRY_AU 2689 0.48 0.50 0.48 175 XMLngstWrd_01 2679 0.47 0.40 0.48 176 XM_H_PHPMailer 2668 0.64 1.51 0.48 177 T_Symld_Words_02 2662 0.55 0.96 0.48 178 RELAYCOUNTRY_DE 2658 0.74 2.15 0.48 179 TR_LOTS_OF_MONEY3 2646 0.63 1.47 0.47 180 XMPhish14 2638 0.52 0.79 0.47 181 XM_B_REG_HTML 2560 0.46 0.50 0.46 182 SHORT_HELO_AND_INLINE_IMAGE 2546 0.41 0.15 0.46 183 USER_IN_WHITELIST 2522 0.38 0.00 0.45 184 HTML_IMAGE_ONLY_32 2521 0.43 0.35 0.45 185 PLING_QUERY 2506 0.47 0.60 0.45 186 MISSING_HEADERS 2499 0.49 0.75 0.45 187 XM_shorewaves_Whitelist 2474 0.37 0.00 0.44 188 URIBL_SBL_A 2455 0.48 0.69 0.44 189 DIET_1 2452 0.49 0.79 0.44 190 XMBSHREFv2 2408 0.46 0.64 0.43 191 TM2_M_BODY_EMPTY 2376 0.38 0.13 0.43 192 XMDateMe_00 2353 0.43 0.46 0.42 193 DKIM_ADSP_NXDOMAIN 2327 0.94 3.74 0.42 194 SUBJ_DOLLARS 2288 0.51 1.08 0.41 195 XMOemUri 2281 0.37 0.17 0.41 196 RCVD_IN_SORBS_DUL 2163 0.37 0.30 0.39 197 XMSolicitRefs_0 2142 0.41 0.58 0.38 198 XMSubMetaSxObfu_02 2126 0.39 0.47 0.38 199 THIS_AD 2035 0.40 0.62 0.36 200 XM_Body_Obfu01 1981 0.42 0.79 0.35 ----------------------------------------------------------------------