Email: 665847 Autolearn: 0 AvgScore: 1.73 AvgScanTime: 3.09 sec Spam: 117370 Autolearn: 0 AvgScore: 12.80 AvgScanTime: 3.56 sec Ham: 548477 Autolearn: 0 AvgScore: -0.64 AvgScanTime: 2.99 sec Time Spent Running SA: 571.82 hours Time Spent Processing Spam: 116.05 hours Time Spent Processing Ham: 455.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109200 83.77 93.04 81.78 2 DCC_CHECK 93563 47.24 79.72 40.29 3 DKIM_SIGNED 84511 71.78 72.00 71.74 4 XM_DK_Pass 81495 70.46 69.43 70.68 5 XM_B_Unicode 78702 65.20 67.05 64.81 6 DKIM_VALID 75625 66.68 64.43 67.16 7 XMListUnsubscribeExists 72443 50.84 61.72 48.51 8 DKIM_VALID_AU 58533 50.81 49.87 51.01 9 BAYES_50 55086 51.48 46.93 52.46 10 XM_B_Unicode3 53874 38.97 45.90 37.48 11 MIME_HTML_ONLY 46113 22.79 39.29 19.26 12 HTML_FONT_LOW_CONTRAST 38626 28.67 32.91 27.76 13 LOC_TINY_FONT_1 37846 24.45 32.25 22.78 14 XM_DK_Undo_02 37839 10.21 32.24 5.49 15 XMSubLong 34635 23.59 29.51 22.32 16 RELAYCOUNTRY_META 29601 9.01 25.22 5.54 17 BOTNET 28107 5.88 23.95 2.02 18 DKIM_VALID_EF 27978 25.20 23.84 25.50 19 MultiRelay 27229 19.27 23.20 18.43 20 FVGT_m_MULTI_ODD 26038 20.72 22.18 20.40 21 BAYES_99 25852 6.15 22.03 2.76 22 XM_Body_Dirty_Words 25353 14.31 21.60 12.75 23 FSL_BULK_SIG 24509 8.82 20.88 6.24 24 DCC_CHECK_NEGATIVE 21280 50.81 18.13 57.80 25 T_KAM_HTML_FONT_INVALID 20738 16.41 17.67 16.14 26 TR_DCC_Bayes_99 20655 4.11 17.60 1.22 27 BOTNET_IPINHOSTNAME 19938 6.72 16.99 4.52 28 BAYES_999 19852 4.74 16.91 2.14 29 T_TM2_M_HEADER_IN_MSG 19585 27.20 16.69 29.45 30 XM_Multi_Part_URI 19380 12.05 16.51 11.10 31 XM_UncommonTLD01 18097 5.35 15.42 3.19 32 XM_B_Unsub 16582 10.62 14.13 9.87 33 UNTRUSTED_Relay 16552 3.91 14.10 1.73 34 HTML_IMAGE_RATIO_02 15405 8.84 13.13 7.92 35 XM_Evil_Numbers_Gen 14405 9.65 12.27 9.09 36 XMSexyCombo_05 14075 5.12 11.99 3.65 37 LOTS_OF_MONEY 13056 8.32 11.12 7.71 38 HTML_SHORT_LINK_IMG_1 12327 1.88 10.50 0.03 39 HTML_MIME_NO_HTML_TAG 12224 3.89 10.41 2.50 40 XMSubMetaSx_00 11498 5.06 9.80 4.05 41 SpammyFromTLD_02 11284 1.90 9.61 0.24 42 TooManyTo_001 10057 8.17 8.57 8.09 43 MPART_ALT_DIFF 9951 4.23 8.48 3.32 44 XM_UB50 9683 2.24 8.25 0.95 45 T_XMDrugObfuBody_14 9550 7.94 8.14 7.90 46 XM_B_Phish_Phrases 9270 6.10 7.90 5.72 47 T_REMOTE_IMAGE 8931 4.29 7.61 3.58 48 LotsOfNums_01 8906 7.47 7.59 7.45 49 DKIM_INVALID 8886 5.10 7.57 4.57 50 BOTNET_NORDNS 8529 1.31 7.27 0.04 51 FROM_MISSP_REPLYTO 8193 1.23 6.98 0.00 52 XM_BadFromFormat 7926 1.27 6.75 0.09 53 T_HTML_TAG_BALANCE_CENTER 7878 1.34 6.71 0.19 54 BODY_URI_ONLY 7869 1.25 6.70 0.08 55 HTML_IMAGE_ONLY_08 7803 1.28 6.65 0.13 56 XM_DIRTYINTL 7699 3.51 6.56 2.85 57 XMStrtUSub 7610 4.40 6.48 3.95 58 BAYES_80 7527 2.78 6.41 2.00 59 XMNumbers 7336 4.69 6.25 4.35 60 XM_SPF_SoftFail 7162 2.60 6.10 1.85 61 XM_H_Long_From01 7067 5.80 6.02 5.75 62 HTML_IMAGE_RATIO_04 6572 5.56 5.60 5.55 63 MIME_HTML_MOSTLY 6563 3.05 5.59 2.50 64 BAYES_60 6501 4.30 5.54 4.03 65 XM_B_SpammyTLD 6369 3.22 5.43 2.75 66 KHOP_HELO_FCRDNS 6339 2.48 5.40 1.85 67 MIME_QP_LONG_LINE 6180 5.15 5.27 5.13 68 RCVD_IN_MSPIKE_H2 6178 6.70 5.26 7.00 69 HTML_EXTRA_CLOSE 6018 0.91 5.13 0.01 70 HDRS_LCASE_IMGONLY 5934 0.93 5.06 0.05 71 BAYES_40 5866 8.79 5.00 9.60 72 RCVD_IN_BL_SPAMCOP_NET 5560 1.49 4.74 0.79 73 RELAYCOUNTRY_GB 5521 1.77 4.70 1.14 74 MIME_HTML_ONLY_MULTI 5201 2.15 4.43 1.66 75 HDRS_MISSP 5195 0.78 4.43 0.00 76 XM_SendGrid 5038 6.07 4.29 6.45 77 HTML_IMAGE_ONLY_12 5023 0.91 4.28 0.19 78 BAYES_00 4927 15.78 4.20 18.26 79 REPLYTO_WITHOUT_TO_CC 4855 0.77 4.14 0.05 80 FROM_SUSPICIOUS_NTLD 4822 0.81 4.11 0.10 81 MIME_HEADER_CTYPE_ONLY 4776 0.82 4.07 0.12 82 FROM_SUSPICIOUS_NTLD_FP 4763 0.79 4.06 0.10 83 URI_HEX 4545 2.18 3.87 1.82 84 TO_EQ_FM_DOM_HTML_IMG 4415 0.67 3.76 0.01 85 BAYES_95 4352 1.63 3.71 1.19 86 BAYES_20 4306 5.86 3.67 6.33 87 RELAYCOUNTRY_CA 4188 1.87 3.57 1.50 88 XM_B_Unsub2 4030 2.37 3.43 2.14 89 XMSexyCombo_01 3981 1.26 3.39 0.80 90 TM2_M_URI_OPT_OUT 3929 1.93 3.35 1.63 91 XM_URI_RBL 3828 0.81 3.26 0.29 92 RCVD_IN_RP_RNBL 3811 0.60 3.25 0.03 93 T_TooManySym_01 3750 4.60 3.20 4.91 94 MultiRelay_CC 3714 0.75 3.16 0.24 95 MultiRelay_Combo 3714 0.75 3.16 0.24 96 HTML_IMAGE_RATIO_06 3639 3.08 3.10 3.07 97 XMDiploma_00 3490 1.77 2.97 1.51 98 ALL_TRUSTED 3442 17.52 2.93 20.64 99 RELAYCOUNTRY_FR 3316 0.80 2.83 0.37 100 SpammyFromTLD_01 3242 1.20 2.76 0.86 101 HTML_IMAGE_RATIO_08 3189 2.21 2.72 2.10 102 FROM_EXCESS_BASE64 3093 3.25 2.64 3.38 103 NO_DNS_FOR_FROM 2956 1.26 2.52 0.99 104 XM_CamelCaseFrm001 2952 2.08 2.52 1.99 105 DATE_IN_PAST_03_06 2878 0.54 2.45 0.13 106 TR_XM_PHPDW 2853 0.93 2.43 0.60 107 RDNS_DYNAMIC 2844 0.68 2.42 0.31 108 TR_XM_PHPForged 2833 0.91 2.41 0.59 109 TR_XM_FormFill2 2819 0.91 2.40 0.59 110 XM_H_PHPOS 2818 0.90 2.40 0.58 111 SUBJ_ALL_CAPS 2755 1.88 2.35 1.77 112 XMSubMetaI_00 2750 1.17 2.34 0.92 113 TR_XM_RelayPhish 2740 1.22 2.33 0.98 114 XMGenDplmaNmb 2720 1.20 2.32 0.96 115 XMHTML_After_End 2636 1.40 2.25 1.22 116 RCVD_IN_IADB_LISTED 2635 3.94 2.25 4.31 117 XM_OfRef6 2611 1.65 2.22 1.52 118 BAYES_05 2561 2.86 2.18 3.01 119 RELAYCOUNTRY_DE 2536 0.77 2.16 0.47 120 TM2_M_VERY_LONG_WORD 2536 1.45 2.16 1.30 121 TR_XM_DK_SendGrid 2497 3.15 2.13 3.36 122 RCVD_IN_IADB_SPF 2487 3.49 2.12 3.78 123 T_XMDrugObfuBody_08 2469 1.43 2.10 1.28 124 TR_Mismatch_TLD_02 2451 0.42 2.09 0.06 125 RCVD_IN_IADB_DK 2448 3.07 2.09 3.29 126 RCVD_IN_IADB_SENDERID 2447 3.12 2.08 3.34 127 DKIM_ADSP_NXDOMAIN 2404 0.74 2.05 0.46 128 UNPARSEABLE_RELAY 2366 2.16 2.02 2.20 129 XMBody_17 2337 0.87 1.99 0.63 130 XM_H_TOP 2317 0.35 1.97 0.00 131 DIET_1 2275 0.60 1.94 0.32 132 XMMoneyMeta_00 2266 0.74 1.93 0.48 133 XMStockSpam_06 2089 1.33 1.78 1.24 134 TR_LOTS_OF_MONEY2 2076 0.93 1.77 0.75 135 T_MONEY_PERCENT 2076 0.93 1.77 0.75 136 RCVD_IN_PSBL 2014 0.33 1.72 0.03 137 RCVD_IN_RP_SAFE 1995 8.37 1.70 9.79 138 RCVD_IN_MSPIKE_WL 1935 4.52 1.65 5.14 139 T_XMDrugObfuBody_00 1934 0.95 1.65 0.80 140 TR_XM_INV_DKIM 1863 0.39 1.59 0.13 141 T_Symld_Words_02 1861 0.73 1.59 0.55 142 XMBrknScrpt_02 1829 0.85 1.56 0.70 143 XMSubMetaSSx_00 1807 0.51 1.54 0.29 144 XMPhish11 1729 1.18 1.47 1.11 145 US_DOLLARS_3 1705 0.76 1.45 0.61 146 XM_H_PHPMailer 1678 0.69 1.43 0.53 147 TR_XM_DK_Bayes 1644 12.46 1.40 14.83 148 XM_UB60 1622 0.28 1.38 0.05 149 DKIM_ADSP_CUSTOM_MED 1571 1.03 1.34 0.96 150 XM_H_PHPOS_M 1529 0.38 1.30 0.18 151 RELAYCOUNTRY_AT 1527 0.40 1.30 0.20 152 RELAYCOUNTRY_IN 1470 0.31 1.25 0.11 153 XMBody_78 1466 0.66 1.25 0.54 154 XMSubMetaSxObfu_03 1465 0.64 1.25 0.51 155 FORGED_GMAIL_RCVD 1462 0.64 1.25 0.51 156 T_XMHurry_00 1456 0.76 1.24 0.66 157 TR_Symld_Words 1448 2.19 1.23 2.39 158 XMBdyGiftCard01 1423 1.42 1.21 1.47 159 RCVD_IN_MSPIKE_H3 1412 3.43 1.20 3.91 160 HK_RANDOM_REPLYTO 1406 0.42 1.20 0.25 161 TR_XM_DK_Bayes1 1404 11.86 1.20 14.14 162 SUBJ_ILLEGAL_CHARS 1390 0.21 1.18 0.01 163 SUBJECT_NEEDS_ENCODING 1388 0.21 1.18 0.01 164 NML_ADSP_CUSTOM_MED 1341 0.75 1.14 0.66 165 URI_WP_HACKED_2 1309 0.43 1.12 0.28 166 XM_H_Long_From02 1306 1.29 1.11 1.33 167 TR_M_TOP_BAYES 1293 0.19 1.10 0.00 168 PLING_QUERY 1286 0.64 1.10 0.55 169 HELO_NODOT 1281 1.56 1.09 1.66 170 HELO_NO_DOMAIN 1277 1.56 1.09 1.66 171 MAILING_LIST_MULTI 1272 2.05 1.08 2.26 172 XM_DK_Undo_01 1272 1.37 1.08 1.44 173 XMSlimDrugH 1256 0.43 1.07 0.30 174 SUBJ_DOLLARS 1255 0.48 1.07 0.35 175 HK_SCAM 1237 0.20 1.05 0.02 176 LongTLD 1218 0.34 1.04 0.19 177 RELAYCOUNTRY_NL 1212 0.53 1.03 0.42 178 XMPhish30 1206 0.63 1.03 0.54 179 URIBL_DBL_ABUSE_REDIR 1186 0.18 1.01 0.00 180 XM_ProductURIs 1175 1.08 1.00 1.10 181 TooManyTo_002 1143 1.96 0.97 2.17 182 IMPOTENCE 1129 0.31 0.96 0.17 183 XMSexyCombo_04 1094 0.34 0.93 0.21 184 XM_UB99 1073 0.17 0.91 0.00 185 DATE_IN_PAST_06_12 1071 0.24 0.91 0.10 186 XMPhish14 1064 0.53 0.91 0.45 187 RCVD_IN_RP_CERTIFIED 1063 7.31 0.91 8.68 188 XM_PDF 1037 3.87 0.88 4.51 189 LOW_PRICE 1033 0.30 0.88 0.18 190 URIBL_DBL_SPAM 1026 0.18 0.87 0.03 191 MILLION_HUNDRED 1025 0.15 0.87 0.00 192 XM_Combo_Sbj 1024 0.38 0.87 0.27 193 RCVD_IN_MSPIKE_BL 1021 0.20 0.87 0.06 194 NUMERIC_HTTP_ADDR 1018 0.34 0.87 0.22 195 XM_NotFromAmazon 996 0.16 0.85 0.01 196 TR_XM_DK_Bayes2 964 10.31 0.82 12.34 197 TR_LOTS_OF_MONEY3 960 0.50 0.82 0.43 198 HTML_FONT_FACE_BAD 954 0.63 0.81 0.59 199 URI_TRY_3LD 952 1.14 0.81 1.21 200 HTML_TAG_BALANCE_BODY 938 0.64 0.80 0.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 448568 83.77 93.04 81.78 2 DKIM_SIGNED 393466 71.78 72.00 71.74 3 XM_DK_Pass 387664 70.46 69.43 70.68 4 DKIM_VALID 368384 66.68 64.43 67.16 5 XM_B_Unicode 355443 65.20 67.05 64.81 6 DCC_CHECK_NEGATIVE 317029 50.81 18.13 57.80 7 BAYES_50 287716 51.48 46.93 52.46 8 DKIM_VALID_AU 279771 50.81 49.87 51.01 9 XMListUnsubscribeExists 266054 50.84 61.72 48.51 10 DCC_CHECK 220974 47.24 79.72 40.29 11 XM_B_Unicode3 205583 38.97 45.90 37.48 12 T_TM2_M_HEADER_IN_MSG 161531 27.20 16.69 29.45 13 HTML_FONT_LOW_CONTRAST 152266 28.67 32.91 27.76 14 DKIM_VALID_EF 139839 25.20 23.84 25.50 15 LOC_TINY_FONT_1 124944 24.45 32.25 22.78 16 XMSubLong 122434 23.59 29.51 22.32 17 ALL_TRUSTED 113201 17.52 2.93 20.64 18 FVGT_m_MULTI_ODD 111895 20.72 22.18 20.40 19 MIME_HTML_ONLY 105620 22.79 39.29 19.26 20 MultiRelay 101076 19.27 23.20 18.43 21 BAYES_00 100127 15.78 4.20 18.26 22 T_KAM_HTML_FONT_INVALID 88525 16.41 17.67 16.14 23 TR_XM_DK_Bayes 81321 12.46 1.40 14.83 24 TR_XM_DK_Bayes1 77536 11.86 1.20 14.14 25 XM_Body_Dirty_Words 69924 14.31 21.60 12.75 26 TR_XM_DK_Bayes2 67699 10.31 0.82 12.34 27 XM_Multi_Part_URI 60859 12.05 16.51 11.10 28 XM_B_Unsub 54118 10.62 14.13 9.87 29 RCVD_IN_RP_SAFE 53715 8.37 1.70 9.79 30 BAYES_40 52632 8.79 5.00 9.60 31 XM_Evil_Numbers_Gen 49870 9.65 12.27 9.09 32 RCVD_IN_RP_CERTIFIED 47623 7.31 0.91 8.68 33 TooManyTo_001 44346 8.17 8.57 8.09 34 HTML_IMAGE_RATIO_02 43464 8.84 13.13 7.92 35 T_XMDrugObfuBody_14 43330 7.94 8.14 7.90 36 LOTS_OF_MONEY 42314 8.32 11.12 7.71 37 ANY_BOUNCE_MESSAGE 41578 6.36 0.64 7.58 38 BOUNCE_MESSAGE 41577 6.36 0.64 7.58 39 LotsOfNums_01 40848 7.47 7.59 7.45 40 XM_DKIMWhitelistDomains 40785 6.13 0.03 7.44 41 RCVD_IN_MSPIKE_H2 38408 6.70 5.26 7.00 42 XM_SendGrid 35360 6.07 4.29 6.45 43 BAYES_20 34700 5.86 3.67 6.33 44 FSL_BULK_SIG 34218 8.82 20.88 6.24 45 XM_H_Long_From01 31525 5.80 6.02 5.75 46 XM_B_Phish_Phrases 31368 6.10 7.90 5.72 47 HTML_IMAGE_RATIO_04 30461 5.56 5.60 5.55 48 RELAYCOUNTRY_META 30362 9.01 25.22 5.54 49 XM_DK_Undo_02 30114 10.21 32.24 5.49 50 RCVD_IN_MSPIKE_WL 28188 4.52 1.65 5.14 51 MIME_QP_LONG_LINE 28141 5.15 5.27 5.13 52 T_TooManySym_01 26910 4.60 3.20 4.91 53 DKIM_INVALID 25082 5.10 7.57 4.57 54 BOTNET_IPINHOSTNAME 24812 6.72 16.99 4.52 55 XM_PDF 24744 3.87 0.88 4.51 56 XMNumbers 23880 4.69 6.25 4.35 57 RCVD_IN_IADB_LISTED 23617 3.94 2.25 4.31 58 XMSubMetaSx_00 22220 5.06 9.80 4.05 59 BAYES_60 22126 4.30 5.54 4.03 60 XMStrtUSub 21690 4.40 6.48 3.95 61 RCVD_IN_MSPIKE_H3 21448 3.43 1.20 3.91 62 RCVD_IN_IADB_SPF 20719 3.49 2.12 3.78 63 XMSexyCombo_05 20042 5.12 11.99 3.65 64 T_REMOTE_IMAGE 19645 4.29 7.61 3.58 65 FROM_EXCESS_BASE64 18559 3.25 2.64 3.38 66 TR_XM_DK_SendGrid 18451 3.15 2.13 3.36 67 RCVD_IN_IADB_SENDERID 18302 3.12 2.08 3.34 68 IN_ZIMBRA_NJ_WHITELIST 18233 2.74 0.02 3.32 69 MPART_ALT_DIFF 18220 4.23 8.48 3.32 70 RCVD_IN_IADB_DK 18026 3.07 2.09 3.29 71 XM_UncommonTLD01 17512 5.35 15.42 3.19 72 HTML_IMAGE_RATIO_06 16840 3.08 3.10 3.07 73 BAYES_05 16486 2.86 2.18 3.01 74 XM_DIRTYINTL 15653 3.51 6.56 2.85 75 BAYES_99 15130 6.15 22.03 2.76 76 XM_B_SpammyTLD 15070 3.22 5.43 2.75 77 RCVD_IN_IADB_VOUCHED 14825 2.34 0.67 2.70 78 MIME_HTML_MOSTLY 13729 3.05 5.59 2.50 79 HTML_MIME_NO_HTML_TAG 13706 3.89 10.41 2.50 80 TR_Symld_Words 13116 2.19 1.23 2.39 81 MAILING_LIST_MULTI 12376 2.05 1.08 2.26 82 UNPARSEABLE_RELAY 12049 2.16 2.02 2.20 83 TooManyTo_002 11912 1.96 0.97 2.17 84 XM_B_Unsub2 11725 2.37 3.43 2.14 85 BAYES_999 11722 4.74 16.91 2.14 86 T_TooManySym_02 11686 1.87 0.67 2.13 87 HTML_IMAGE_RATIO_08 11531 2.21 2.72 2.10 88 TO_MALFORMED 11114 1.68 0.08 2.03 89 BOTNET 11063 5.88 23.95 2.02 90 BAYES_80 10991 2.78 6.41 2.00 91 XM_CamelCaseFrm001 10893 2.08 2.52 1.99 92 XM_SPF_SoftFail 10173 2.60 6.10 1.85 93 KHOP_HELO_FCRDNS 10141 2.48 5.40 1.85 94 TVD_RCVD_IP 9978 1.58 0.44 1.82 95 URI_HEX 9956 2.18 3.87 1.82 96 SUBJ_ALL_CAPS 9732 1.88 2.35 1.77 97 UNTRUSTED_Relay 9467 3.91 14.10 1.73 98 RCVD_IN_IADB_OPTIN 9423 1.49 0.40 1.72 99 HELO_NODOT 9128 1.56 1.09 1.66 100 HELO_NO_DOMAIN 9127 1.56 1.09 1.66 101 MIME_HTML_ONLY_MULTI 9108 2.15 4.43 1.66 102 TM2_M_URI_OPT_OUT 8913 1.93 3.35 1.63 103 XM_OfRef6 8346 1.65 2.22 1.52 104 XMDiploma_00 8295 1.77 2.97 1.51 105 RELAYCOUNTRY_CA 8231 1.87 3.57 1.50 106 TooManyTo_003 8216 1.37 0.77 1.50 107 IN_HORDE_ADDRESS_BOOK 8167 1.23 0.05 1.49 108 CK_HELO_DYNAMIC_SPLIT_IP 8083 1.31 0.53 1.47 109 XMBdyGiftCard01 8063 1.42 1.21 1.47 110 HELO_DYNAMIC_IPADDR2 8042 1.22 0.08 1.47 111 XM_DK_Undo_01 7882 1.37 1.08 1.44 112 INVALID_MSGID 7500 1.16 0.19 1.37 113 XMCapTrack 7306 1.15 0.29 1.33 114 XM_H_Long_From02 7274 1.29 1.11 1.33 115 TM2_M_VERY_LONG_WORD 7142 1.45 2.16 1.30 116 USER_IN_DEF_DKIM_WL 7136 1.08 0.02 1.30 117 T_XMDrugObfuBody_08 7023 1.43 2.10 1.28 118 XMStockSpam_06 6781 1.33 1.78 1.24 119 TR_DCC_Bayes_99 6700 4.11 17.60 1.22 120 XMHTML_After_End 6664 1.40 2.25 1.22 121 URI_TRY_3LD 6626 1.14 0.81 1.21 122 BAYES_95 6500 1.63 3.71 1.19 123 TR_MetaPhish_Combo_01 6363 1.08 0.71 1.16 124 TooManyTo_004 6249 1.05 0.64 1.14 125 RELAYCOUNTRY_GB 6232 1.77 4.70 1.14 126 XMPhish11 6113 1.18 1.47 1.11 127 XM_ProductURIs 6033 1.08 1.00 1.10 128 XM_GoogleGroups 5534 0.92 0.48 1.01 129 NO_DNS_FOR_FROM 5438 1.26 2.52 0.99 130 TR_XM_RelayPhish 5399 1.22 2.33 0.98 131 DKIM_ADSP_CUSTOM_MED 5291 1.03 1.34 0.96 132 TooManyTo_005 5265 0.89 0.56 0.96 133 XMGenDplmaNmb 5244 1.20 2.32 0.96 134 XM_UB50 5224 2.24 8.25 0.95 135 XMGappySubj_01 5137 0.81 0.22 0.94 136 XMSubMetaI_00 5064 1.17 2.34 0.92 137 SpammyFromTLD_01 4721 1.20 2.76 0.86 138 T_XMDrugObfuBody_00 4408 0.95 1.65 0.80 139 XMSexyCombo_01 4385 1.26 3.39 0.80 140 RCVD_IN_BL_SPAMCOP_NET 4356 1.49 4.74 0.79 141 T_FILL_THIS_FORM_SHORT 4126 0.74 0.71 0.75 142 T_MONEY_PERCENT 4115 0.93 1.77 0.75 143 TR_LOTS_OF_MONEY2 4115 0.93 1.77 0.75 144 XMNoVowels 3900 0.67 0.47 0.71 145 XMBrknScrpt_02 3839 0.85 1.56 0.70 146 XM_SPF_Unknown 3805 0.70 0.76 0.69 147 XMBody_95 3664 0.57 0.10 0.67 148 NML_ADSP_CUSTOM_MED 3626 0.75 1.14 0.66 149 T_XMHurry_00 3609 0.76 1.24 0.66 150 RCVD_IN_MSPIKE_H5 3607 0.57 0.17 0.66 151 T_OBFU_PDF_ATTACH 3481 0.55 0.17 0.63 152 XMBody_17 3435 0.87 1.99 0.63 153 US_DOLLARS_3 3341 0.76 1.45 0.61 154 HTML_TAG_BALANCE_BODY 3335 0.64 0.80 0.61 155 TR_XM_PHPDW 3311 0.93 2.43 0.60 156 HTML_FONT_FACE_BAD 3262 0.63 0.81 0.59 157 XM_B_REG_HTML 3260 0.54 0.27 0.59 158 TR_XM_FormFill2 3225 0.91 2.40 0.59 159 TR_XM_PHPForged 3222 0.91 2.41 0.59 160 XM_H_PHPOS 3194 0.90 2.40 0.58 161 HTTPS_HTTP_MISMATCH 3173 0.55 0.43 0.58 162 RCVD_IN_MSPIKE_H4 3133 0.52 0.28 0.57 163 T_TooManySym_03 3124 0.51 0.24 0.57 164 XM_ShortIntro_01 3088 0.52 0.33 0.56 165 T_Symld_Words_02 3020 0.73 1.59 0.55 166 PLING_QUERY 3000 0.64 1.10 0.55 167 XMPhish30 2987 0.63 1.03 0.54 168 FILL_THIS_FORM 2982 0.56 0.63 0.54 169 XMBody_78 2943 0.66 1.25 0.54 170 XM_H_PHPMailer 2909 0.69 1.43 0.53 171 FROM_GOV_DKIM_AU 2876 0.45 0.08 0.52 172 TM2_M_BODY_EMPTY 2849 0.45 0.10 0.52 173 XMSubMetaSxObfu_03 2819 0.64 1.25 0.51 174 FORGED_GMAIL_RCVD 2818 0.64 1.25 0.51 175 URI_NOVOWEL 2763 0.51 0.55 0.50 176 MISSING_HEADERS 2687 0.54 0.77 0.49 177 XMMoneyMeta_00 2659 0.74 1.93 0.48 178 XMLngstWrd_00 2601 0.47 0.43 0.47 179 RELAYCOUNTRY_DE 2569 0.77 2.16 0.47 180 DKIM_ADSP_NXDOMAIN 2511 0.74 2.05 0.46 181 XMPhish14 2488 0.53 0.91 0.45 182 USER_IN_WHITELIST 2452 0.37 0.00 0.45 183 AC_DIV_BONANZA 2449 0.39 0.10 0.45 184 FILL_THIS_FORM_LONG 2428 0.45 0.50 0.44 185 SHORT_HELO_AND_INLINE_IMAGE 2418 0.38 0.12 0.44 186 XM_Body_Obfu01 2407 0.47 0.63 0.44 187 XMLngstWrd_01 2401 0.43 0.41 0.44 188 TR_LOTS_OF_MONEY3 2374 0.50 0.82 0.43 189 RELAYCOUNTRY_NL 2329 0.53 1.03 0.42 190 T_FILL_THIS_FORM_LOAN 2314 0.38 0.19 0.42 191 XM_RXBody 2295 0.41 0.39 0.42 192 XMHTMLBadTable_001 2260 0.45 0.62 0.41 193 RCVD_IN_SORBS_DUL 2248 0.39 0.28 0.41 194 XMBSHREFv2 2213 0.42 0.51 0.40 195 RELAYCOUNTRY_AU 2171 0.45 0.72 0.40 196 XMSubMetaSxObfu_02 2150 0.42 0.58 0.39 197 HTML_IMAGE_ONLY_28 2120 0.37 0.27 0.39 198 XMDateMe_00 2053 0.36 0.32 0.37 199 RELAYCOUNTRY_FR 2043 0.80 2.83 0.37 200 HTML_IMAGE_ONLY_32 2031 0.36 0.28 0.37 ----------------------------------------------------------------------