Email: 646763 Autolearn: 0 AvgScore: 1.97 AvgScanTime: 2.28 sec Spam: 119197 Autolearn: 0 AvgScore: 12.62 AvgScanTime: 2.98 sec Ham: 527566 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 2.12 sec Time Spent Running SA: 409.18 hours Time Spent Processing Spam: 98.51 hours Time Spent Processing Ham: 310.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114224 91.04 95.83 89.96 2 DCC_CHECK 95142 50.34 79.82 43.68 3 DKIM_SIGNED 92263 79.25 77.40 79.66 4 XM_DK_Pass 86694 77.27 72.73 78.29 5 XM_B_Unicode 84217 72.11 70.65 72.44 6 DKIM_VALID 81724 73.86 68.56 75.05 7 XMListUnsubscribeExists 77113 57.79 64.69 56.23 8 DKIM_VALID_AU 62996 55.97 52.85 56.67 9 BAYES_50 58891 54.13 49.41 55.20 10 XM_B_Unicode3 55299 43.41 46.39 42.73 11 MIME_HTML_ONLY 45745 24.84 38.38 21.78 12 HTML_FONT_LOW_CONTRAST 42118 30.71 35.33 29.67 13 XM_DK_Undo_02 40637 11.32 34.09 6.18 14 LOC_TINY_FONT_1 39329 26.65 32.99 25.22 15 XMSubLong 33013 23.53 27.70 22.59 16 FVGT_m_MULTI_ODD 30776 23.06 25.82 22.44 17 XM_Body_Dirty_Words 28336 16.41 23.77 14.75 18 DKIM_VALID_EF 27826 26.97 23.34 27.79 19 BAYES_99 27268 6.39 22.88 2.67 20 RELAYCOUNTRY_META 27022 9.31 22.67 6.29 21 T_KAM_HTML_FONT_INVALID 25107 19.27 21.06 18.87 22 BOTNET 24765 5.76 20.78 2.37 23 XM_Multi_Part_URI 22708 13.56 19.05 12.32 24 DCC_CHECK_NEGATIVE 21747 47.59 18.24 54.22 25 T_TM2_M_HEADER_IN_MSG 21605 27.15 18.13 29.19 26 TR_DCC_Bayes_99 21443 4.24 17.99 1.14 27 BOTNET_IPINHOSTNAME 21210 7.36 17.79 5.00 28 FSL_BULK_SIG 21084 8.72 17.69 6.69 29 BAYES_999 20871 4.92 17.51 2.08 30 MultiRelay 20699 18.71 17.37 19.01 31 XM_B_Unsub 17740 10.75 14.88 9.82 32 XM_UncommonTLD01 16763 5.43 14.06 3.47 33 HTML_IMAGE_RATIO_02 16103 10.29 13.51 9.56 34 UNTRUSTED_Relay 15832 3.97 13.28 1.87 35 XMSexyCombo_05 15581 6.39 13.07 4.88 36 XM_Evil_Numbers_Gen 15362 10.30 12.89 9.71 37 LOTS_OF_MONEY 14494 9.76 12.16 9.22 38 HTML_MIME_NO_HTML_TAG 11392 3.86 9.56 2.57 39 T_REMOTE_IMAGE 11063 4.87 9.28 3.88 40 XMSubMetaSx_00 10878 4.75 9.13 3.77 41 LotsOfNums_01 10701 8.71 8.98 8.65 42 DKIM_INVALID 10539 5.39 8.84 4.61 43 T_XMDrugObfuBody_14 10200 8.68 8.56 8.71 44 XMNumbers 10117 4.24 8.49 3.28 45 MPART_ALT_DIFF 9942 4.74 8.34 3.92 46 HTML_SHORT_LINK_IMG_1 9812 1.54 8.23 0.03 47 SpammyFromTLD_02 9663 1.85 8.11 0.44 48 HDRS_LCASE_IMGONLY 9441 1.62 7.92 0.20 49 TooManyTo_001 9440 8.03 7.92 8.05 50 XM_H_Long_From01 8850 6.74 7.42 6.58 51 HTML_IMAGE_RATIO_04 8814 6.20 7.39 5.93 52 XM_B_Phish_Phrases 8590 6.58 7.21 6.43 53 XM_UB50 8527 2.14 7.15 1.01 54 XM_DIRTYINTL 8206 3.79 6.88 3.09 55 BAYES_80 7676 2.97 6.44 2.19 56 XM_BadFromFormat 6957 1.17 5.84 0.12 57 BODY_URI_ONLY 6900 1.15 5.79 0.10 58 BAYES_60 6762 4.63 5.67 4.40 59 MIME_QP_LONG_LINE 6604 5.97 5.54 6.07 60 RCVD_IN_MSPIKE_H2 6475 7.21 5.43 7.61 61 XM_B_SpammyTLD 6410 2.74 5.38 2.14 62 HTML_IMAGE_ONLY_08 6187 1.04 5.19 0.11 63 T_HTML_TAG_BALANCE_CENTER 6135 1.08 5.15 0.16 64 FROM_SUSPICIOUS_NTLD 5999 1.01 5.03 0.10 65 FROM_SUSPICIOUS_NTLD_FP 5930 0.99 4.97 0.09 66 MIME_HTML_ONLY_MULTI 5791 2.78 4.86 2.31 67 KHOP_HELO_FCRDNS 5673 2.51 4.76 2.00 68 HTML_IMAGE_RATIO_06 5367 3.52 4.50 3.30 69 XMStrtUSub 5311 4.24 4.46 4.19 70 MIME_HTML_MOSTLY 5135 2.90 4.31 2.59 71 XM_SendGrid 5070 6.01 4.25 6.41 72 XM_B_Unsub2 4952 2.13 4.15 1.67 73 BAYES_40 4843 5.57 4.06 5.91 74 XM_URI_RBL 4830 1.01 4.05 0.32 75 XM_SPF_SoftFail 4763 2.26 4.00 1.86 76 NO_DNS_FOR_FROM 4731 1.57 3.97 1.03 77 URI_HEX 4680 2.54 3.93 2.22 78 RCVD_IN_BL_SPAMCOP_NET 4585 1.78 3.85 1.31 79 TM2_M_URI_OPT_OUT 4546 2.28 3.81 1.93 80 BAYES_95 4417 1.72 3.71 1.28 81 FROM_EXCESS_BASE64 4398 4.04 3.69 4.12 82 RELAYCOUNTRY_CA 4362 2.21 3.66 1.88 83 T_XMDrugObfuBody_08 4296 2.18 3.60 1.85 84 XM_OfRef6 4116 1.98 3.45 1.65 85 DKIM_ADSP_NXDOMAIN 4107 1.11 3.45 0.59 86 RELAYCOUNTRY_GB 4062 1.63 3.41 1.23 87 XMSexyCombo_01 3973 1.30 3.33 0.84 88 MIME_HEADER_CTYPE_ONLY 3867 0.68 3.24 0.11 89 RELAYCOUNTRY_FR 3849 0.99 3.23 0.49 90 T_TooManySym_01 3789 4.19 3.18 4.42 91 DATE_IN_PAST_03_06 3674 0.71 3.08 0.18 92 BAYES_20 3487 4.42 2.93 4.76 93 REPLYTO_WITHOUT_TO_CC 3399 0.56 2.85 0.04 94 BAYES_00 3332 16.98 2.80 20.19 95 RDNS_DYNAMIC 3325 0.78 2.79 0.33 96 XMDiploma_00 3319 2.02 2.78 1.85 97 XM_CamelCaseFrm001 3144 2.29 2.64 2.21 98 MultiRelay_CC 3138 0.68 2.63 0.24 99 MultiRelay_Combo 3138 0.68 2.63 0.24 100 HTML_IMAGE_ONLY_12 3117 0.63 2.61 0.18 101 XMBody_17 3111 1.23 2.61 0.91 102 RCVD_IN_RP_RNBL 2926 0.48 2.45 0.04 103 TM2_M_VERY_LONG_WORD 2878 1.59 2.41 1.41 104 SpammyFromTLD_01 2869 1.24 2.41 0.97 105 XM_H_TOP 2860 0.45 2.40 0.01 106 TR_XM_DK_SendGrid 2797 3.20 2.35 3.40 107 SUBJ_ALL_CAPS 2749 2.13 2.31 2.09 108 TO_EQ_FM_DOM_HTML_IMG 2660 0.42 2.23 0.01 109 XMBdyGiftCard01 2593 1.70 2.18 1.59 110 BOTNET_NORDNS 2486 0.45 2.09 0.08 111 RCVD_IN_IADB_LISTED 2451 4.62 2.06 5.20 112 TR_XM_INV_DKIM 2449 0.46 2.05 0.10 113 TR_Mismatch_TLD_02 2448 0.45 2.05 0.09 114 UNPARSEABLE_RELAY 2357 2.36 1.98 2.44 115 TR_XM_RelayPhish 2342 1.40 1.96 1.27 116 XMGenDplmaNmb 2336 1.30 1.96 1.15 117 HTML_IMAGE_RATIO_08 2322 2.40 1.95 2.50 118 TR_XM_PHPDW 2319 0.83 1.95 0.58 119 RCVD_IN_IADB_SPF 2314 4.06 1.94 4.54 120 TR_XM_PHPForged 2300 0.82 1.93 0.56 121 XM_DK_Undo_01 2292 1.69 1.92 1.63 122 TR_XM_FormFill2 2285 0.81 1.92 0.56 123 XM_H_PHPOS 2276 0.81 1.91 0.56 124 XMSubMetaI_00 2272 0.91 1.91 0.68 125 RCVD_IN_IADB_SENDERID 2272 3.60 1.91 3.98 126 RCVD_IN_IADB_DK 2267 3.57 1.90 3.95 127 BAYES_05 2203 2.91 1.85 3.15 128 XMStockSpam_06 2077 1.37 1.74 1.29 129 US_DOLLARS_3 2074 1.27 1.74 1.16 130 TR_XM_DK_Bayes 2048 13.87 1.72 16.61 131 FROM_MISSP_REPLYTO 2043 0.32 1.71 0.00 132 T_XMDrugObfuBody_00 2013 1.10 1.69 0.96 133 RELAYCOUNTRY_DE 2003 0.73 1.68 0.52 134 T_MONEY_PERCENT 1996 0.76 1.67 0.55 135 TR_LOTS_OF_MONEY2 1996 0.76 1.67 0.55 136 XMBrknScrpt_02 1900 0.90 1.59 0.74 137 TR_Symld_Words 1895 1.60 1.59 1.60 138 XMHTML_After_End 1895 1.14 1.59 1.04 139 TR_XM_DK_Bayes1 1883 13.30 1.58 15.95 140 XMPhish11 1848 1.26 1.55 1.19 141 RCVD_IN_MSPIKE_BL 1837 0.34 1.54 0.07 142 XMMoneyMeta_00 1808 0.73 1.52 0.55 143 TO_NO_BRKTS_FROM_MSSP 1793 0.29 1.50 0.01 144 XM_ProductURIs 1783 1.08 1.50 0.98 145 XM_UB60 1728 0.32 1.45 0.07 146 RCVD_IN_RP_SAFE 1724 9.15 1.45 10.89 147 FROM_MISSP_DYNIP 1716 0.27 1.44 0.00 148 XMPhish14 1710 0.61 1.43 0.43 149 TR_LOTS_OF_MONEY3 1610 0.70 1.35 0.56 150 ALL_TRUSTED 1592 10.33 1.34 12.36 151 T_XMHurry_00 1575 0.86 1.32 0.75 152 RCVD_IN_MSPIKE_L5 1560 0.29 1.31 0.06 153 RCVD_IN_PSBL 1549 0.29 1.30 0.06 154 TO_NO_BRKTS_DYNIP 1537 0.24 1.29 0.00 155 LongTLD 1525 0.43 1.28 0.24 156 URI_TRY_3LD 1520 1.28 1.28 1.28 157 XM_H_Long_From02 1520 1.48 1.28 1.52 158 RELAYCOUNTRY_AT 1514 0.39 1.27 0.19 159 DKIM_ADSP_CUSTOM_MED 1499 1.03 1.26 0.98 160 RELAYCOUNTRY_IN 1498 0.34 1.26 0.13 161 RCVD_IN_MSPIKE_WL 1474 4.95 1.24 5.79 162 MAILING_LIST_MULTI 1471 2.27 1.23 2.50 163 TM2_M_A_HREF_HREF 1420 0.59 1.19 0.45 164 XMBody_78 1399 0.68 1.17 0.57 165 T_FILL_THIS_FORM_SHORT 1390 0.86 1.17 0.79 166 SUBJ_DOLLARS 1389 0.65 1.17 0.54 167 URIBL_DBL_ABUSE_REDIR 1380 0.22 1.16 0.01 168 XM_H_PHPMailer 1376 0.65 1.15 0.53 169 DIET_1 1343 0.50 1.13 0.36 170 RELAYCOUNTRY_IE 1342 0.33 1.13 0.15 171 XM_UB99 1341 0.21 1.13 0.01 172 RELAYCOUNTRY_RU 1335 0.22 1.12 0.01 173 XMSexyCombo_04 1333 0.32 1.12 0.14 174 HTML_TAG_BALANCE_BODY 1313 0.74 1.10 0.66 175 NML_ADSP_CUSTOM_MED 1311 0.78 1.10 0.70 176 FORGED_GMAIL_RCVD 1279 0.62 1.07 0.52 177 INVALID_DATE 1267 0.25 1.06 0.07 178 HTML_FONT_SIZE_HUGE 1251 0.26 1.05 0.09 179 FSL_THIS_IS_ADV 1251 0.57 1.05 0.46 180 XMSubMetaSxObfu_03 1231 0.54 1.03 0.43 181 TR_M_TOP_BAYES 1218 0.19 1.02 0.00 182 MPART_ALT_DIFF_COUNT 1178 0.35 0.99 0.20 183 XM_H_PHPOS_M 1148 0.32 0.96 0.18 184 XMPhish30 1142 0.66 0.96 0.59 185 TR_XM_DK_Bayes2 1112 11.51 0.93 13.90 186 XM_PDF 1081 4.04 0.91 4.75 187 HK_RANDOM_REPLYTO 1079 0.38 0.91 0.26 188 HTML_FONT_FACE_BAD 1077 0.76 0.90 0.72 189 HDRS_MISSP 1067 0.17 0.90 0.01 190 RCVD_IN_MSPIKE_H3 1043 3.69 0.88 4.32 191 LONG_HEX_URI 1038 0.42 0.87 0.32 192 XM_UB80 1030 0.17 0.86 0.01 193 T_TooManySym_02 1024 1.88 0.86 2.12 194 RCVD_IN_RP_CERTIFIED 964 8.01 0.81 9.64 195 HTML_IMAGE_ONLY_04 962 0.24 0.81 0.11 196 SHORT_IMG_SUSP_NTLD 959 0.15 0.80 0.00 197 HELO_NODOT 955 1.42 0.80 1.56 198 HELO_NO_DOMAIN 953 1.42 0.80 1.56 199 T_Symld_Words_02 947 0.73 0.79 0.72 200 XM_UB999 940 0.15 0.79 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 474580 91.04 95.83 89.96 2 DKIM_SIGNED 420280 79.25 77.40 79.66 3 XM_DK_Pass 413053 77.27 72.73 78.29 4 DKIM_VALID 395963 73.86 68.56 75.05 5 XM_B_Unicode 382158 72.11 70.65 72.44 6 DKIM_VALID_AU 298989 55.97 52.85 56.67 7 XMListUnsubscribeExists 296628 57.79 64.69 56.23 8 BAYES_50 291227 54.13 49.41 55.20 9 DCC_CHECK_NEGATIVE 286059 47.59 18.24 54.22 10 DCC_CHECK 230433 50.34 79.82 43.68 11 XM_B_Unicode3 225444 43.41 46.39 42.73 12 HTML_FONT_LOW_CONTRAST 156525 30.71 35.33 29.67 13 T_TM2_M_HEADER_IN_MSG 153989 27.15 18.13 29.19 14 DKIM_VALID_EF 146627 26.97 23.34 27.79 15 LOC_TINY_FONT_1 133039 26.65 32.99 25.22 16 XMSubLong 119159 23.53 27.70 22.59 17 FVGT_m_MULTI_ODD 118375 23.06 25.82 22.44 18 MIME_HTML_ONLY 114922 24.84 38.38 21.78 19 BAYES_00 106519 16.98 2.80 20.19 20 MultiRelay 100313 18.71 17.37 19.01 21 T_KAM_HTML_FONT_INVALID 99545 19.27 21.06 18.87 22 TR_XM_DK_Bayes 87653 13.87 1.72 16.61 23 TR_XM_DK_Bayes1 84168 13.30 1.58 15.95 24 XM_Body_Dirty_Words 77792 16.41 23.77 14.75 25 TR_XM_DK_Bayes2 73310 11.51 0.93 13.90 26 ALL_TRUSTED 65214 10.33 1.34 12.36 27 XM_Multi_Part_URI 65004 13.56 19.05 12.32 28 RCVD_IN_RP_SAFE 57438 9.15 1.45 10.89 29 XM_B_Unsub 51817 10.75 14.88 9.82 30 XM_Evil_Numbers_Gen 51253 10.30 12.89 9.71 31 RCVD_IN_RP_CERTIFIED 50858 8.01 0.81 9.64 32 HTML_IMAGE_RATIO_02 50438 10.29 13.51 9.56 33 LOTS_OF_MONEY 48657 9.76 12.16 9.22 34 T_XMDrugObfuBody_14 45967 8.68 8.56 8.71 35 LotsOfNums_01 45644 8.71 8.98 8.65 36 TooManyTo_001 42477 8.03 7.92 8.05 37 RCVD_IN_MSPIKE_H2 40159 7.21 5.43 7.61 38 XM_DKIMWhitelistDomains 38402 5.95 0.06 7.28 39 FSL_BULK_SIG 35302 8.72 17.69 6.69 40 XM_H_Long_From01 34725 6.74 7.42 6.58 41 XM_B_Phish_Phrases 33935 6.58 7.21 6.43 42 XM_SendGrid 33803 6.01 4.25 6.41 43 RELAYCOUNTRY_META 33194 9.31 22.67 6.29 44 XM_DK_Undo_02 32601 11.32 34.09 6.18 45 MIME_QP_LONG_LINE 32014 5.97 5.54 6.07 46 HTML_IMAGE_RATIO_04 31270 6.20 7.39 5.93 47 BAYES_40 31200 5.57 4.06 5.91 48 RCVD_IN_MSPIKE_WL 30542 4.95 1.24 5.79 49 RCVD_IN_IADB_LISTED 27412 4.62 2.06 5.20 50 BOTNET_IPINHOSTNAME 26370 7.36 17.79 5.00 51 XMSexyCombo_05 25733 6.39 13.07 4.88 52 BAYES_20 25091 4.42 2.93 4.76 53 XM_PDF 25070 4.04 0.91 4.75 54 DKIM_INVALID 24317 5.39 8.84 4.61 55 RCVD_IN_IADB_SPF 23973 4.06 1.94 4.54 56 T_TooManySym_01 23333 4.19 3.18 4.42 57 BAYES_60 23196 4.63 5.67 4.40 58 RCVD_IN_MSPIKE_H3 22791 3.69 0.88 4.32 59 XMStrtUSub 22124 4.24 4.46 4.19 60 FROM_EXCESS_BASE64 21725 4.04 3.69 4.12 61 RCVD_IN_IADB_SENDERID 21021 3.60 1.91 3.98 62 RCVD_IN_IADB_DK 20838 3.57 1.90 3.95 63 MPART_ALT_DIFF 20705 4.74 8.34 3.92 64 T_REMOTE_IMAGE 20464 4.87 9.28 3.88 65 XMSubMetaSx_00 19869 4.75 9.13 3.77 66 IN_ZIMBRA_NJ_WHITELIST 18623 2.88 0.02 3.53 67 XM_UncommonTLD01 18327 5.43 14.06 3.47 68 TR_XM_DK_SendGrid 17914 3.20 2.35 3.40 69 HTML_IMAGE_RATIO_06 17420 3.52 4.50 3.30 70 XMNumbers 17314 4.24 8.49 3.28 71 RCVD_IN_IADB_VOUCHED 16640 2.67 0.54 3.15 72 BAYES_05 16620 2.91 1.85 3.15 73 XM_DIRTYINTL 16324 3.79 6.88 3.09 74 BAYES_99 14092 6.39 22.88 2.67 75 MIME_HTML_MOSTLY 13644 2.90 4.31 2.59 76 HTML_MIME_NO_HTML_TAG 13567 3.86 9.56 2.57 77 MAILING_LIST_MULTI 13206 2.27 1.23 2.50 78 HTML_IMAGE_RATIO_08 13170 2.40 1.95 2.50 79 UNPARSEABLE_RELAY 12889 2.36 1.98 2.44 80 BOTNET 12519 5.76 20.78 2.37 81 MIME_HTML_ONLY_MULTI 12206 2.78 4.86 2.31 82 URI_HEX 11721 2.54 3.93 2.22 83 XM_CamelCaseFrm001 11651 2.29 2.64 2.21 84 BAYES_80 11536 2.97 6.44 2.19 85 XM_B_SpammyTLD 11287 2.74 5.38 2.14 86 T_TooManySym_02 11167 1.88 0.86 2.12 87 SUBJ_ALL_CAPS 11031 2.13 2.31 2.09 88 BAYES_999 10957 4.92 17.51 2.08 89 KHOP_HELO_FCRDNS 10549 2.51 4.76 2.00 90 RCVD_IN_IADB_OPTIN 10244 1.67 0.44 1.94 91 TM2_M_URI_OPT_OUT 10207 2.28 3.81 1.93 92 TooManyTo_002 10197 1.71 0.71 1.93 93 TVD_RCVD_IP 9949 1.63 0.50 1.89 94 RELAYCOUNTRY_CA 9944 2.21 3.66 1.88 95 UNTRUSTED_Relay 9864 3.97 13.28 1.87 96 XM_SPF_SoftFail 9822 2.26 4.00 1.86 97 T_XMDrugObfuBody_08 9780 2.18 3.60 1.85 98 XMDiploma_00 9740 2.02 2.78 1.85 99 XM_B_Unsub2 8807 2.13 4.15 1.67 100 XM_OfRef6 8711 1.98 3.45 1.65 101 XM_DK_Undo_01 8609 1.69 1.92 1.63 102 TR_Symld_Words 8425 1.60 1.59 1.60 103 XMBdyGiftCard01 8411 1.70 2.18 1.59 104 HELO_NODOT 8232 1.42 0.80 1.56 105 HELO_NO_DOMAIN 8231 1.42 0.80 1.56 106 IN_HORDE_ADDRESS_BOOK 8181 1.27 0.04 1.55 107 CK_HELO_DYNAMIC_SPLIT_IP 8110 1.32 0.38 1.54 108 HELO_DYNAMIC_IPADDR2 8067 1.27 0.10 1.53 109 XM_H_Long_From02 8044 1.48 1.28 1.52 110 ANY_BOUNCE_MESSAGE 7942 1.33 0.58 1.51 111 BOUNCE_MESSAGE 7939 1.33 0.58 1.50 112 INVALID_MSGID 7924 1.30 0.42 1.50 113 TM2_M_VERY_LONG_WORD 7424 1.59 2.41 1.41 114 XMCapTrack 7282 1.19 0.32 1.38 115 TO_MALFORMED 6934 1.08 0.03 1.31 116 RCVD_IN_BL_SPAMCOP_NET 6897 1.78 3.85 1.31 117 TooManyTo_003 6807 1.15 0.55 1.29 118 XMStockSpam_06 6789 1.37 1.74 1.29 119 URI_TRY_3LD 6758 1.28 1.28 1.28 120 BAYES_95 6727 1.72 3.71 1.28 121 TR_XM_RelayPhish 6720 1.40 1.96 1.27 122 RELAYCOUNTRY_GB 6505 1.63 3.41 1.23 123 XMPhish11 6275 1.26 1.55 1.19 124 US_DOLLARS_3 6125 1.27 1.74 1.16 125 XMGenDplmaNmb 6041 1.30 1.96 1.15 126 TR_DCC_Bayes_99 5997 4.24 17.99 1.14 127 USER_IN_DEF_DKIM_WL 5939 0.92 0.02 1.13 128 XMGappySubj_01 5803 0.95 0.30 1.10 129 TR_MetaPhish_Combo_01 5635 0.99 0.67 1.07 130 XM_GoogleGroups 5505 0.96 0.56 1.04 131 XMHTML_After_End 5479 1.14 1.59 1.04 132 NO_DNS_FOR_FROM 5448 1.57 3.97 1.03 133 XM_UB50 5340 2.14 7.15 1.01 134 XM_RXBody 5271 0.89 0.41 1.00 135 RCVD_IN_MSPIKE_H5 5218 0.83 0.10 0.99 136 XM_ProductURIs 5188 1.08 1.50 0.98 137 DKIM_ADSP_CUSTOM_MED 5145 1.03 1.26 0.98 138 SpammyFromTLD_01 5130 1.24 2.41 0.97 139 TooManyTo_004 5120 0.88 0.47 0.97 140 T_XMDrugObfuBody_00 5081 1.10 1.69 0.96 141 XMBody_17 4820 1.23 2.61 0.91 142 XMSexyCombo_01 4419 1.30 3.33 0.84 143 TooManyTo_005 4282 0.73 0.38 0.81 144 T_FILL_THIS_FORM_SHORT 4165 0.86 1.17 0.79 145 T_XMHurry_00 3969 0.86 1.32 0.75 146 XMBrknScrpt_02 3926 0.90 1.59 0.74 147 HTML_FONT_FACE_BAD 3811 0.76 0.90 0.72 148 T_Symld_Words_02 3784 0.73 0.79 0.72 149 NML_ADSP_CUSTOM_MED 3719 0.78 1.10 0.70 150 XMSubMetaI_00 3608 0.91 1.91 0.68 151 XMBody_95 3520 0.58 0.18 0.67 152 HTTPS_HTTP_MISMATCH 3505 0.67 0.67 0.66 153 HTML_TAG_BALANCE_BODY 3466 0.74 1.10 0.66 154 XMSolicitRefs_0 3448 0.64 0.59 0.65 155 XM_SPF_Unknown 3438 0.64 0.59 0.65 156 XM_B_REG_HTML 3406 0.62 0.51 0.65 157 URIBL_CSS_A 3233 0.62 0.63 0.61 158 URIBL_CSS 3233 0.62 0.63 0.61 159 T_OBFU_PDF_ATTACH 3208 0.55 0.27 0.61 160 XMPhish30 3108 0.66 0.96 0.59 161 DKIM_ADSP_NXDOMAIN 3097 1.11 3.45 0.59 162 TR_XM_PHPDW 3067 0.83 1.95 0.58 163 T_TooManySym_03 3050 0.53 0.31 0.58 164 XMBody_78 3029 0.68 1.17 0.57 165 XM_ShortIntro_01 3024 0.55 0.47 0.57 166 HTML_IMAGE_ONLY_28 3008 0.53 0.37 0.57 167 TR_XM_PHPForged 2977 0.82 1.93 0.56 168 FROM_GOV_SPOOF 2977 0.52 0.30 0.56 169 TR_XM_FormFill2 2954 0.81 1.92 0.56 170 TR_LOTS_OF_MONEY3 2943 0.70 1.35 0.56 171 XMNoVowels 2938 0.52 0.36 0.56 172 XM_H_PHPOS 2934 0.81 1.91 0.56 173 TR_LOTS_OF_MONEY2 2890 0.76 1.67 0.55 174 T_MONEY_PERCENT 2890 0.76 1.67 0.55 175 XMMoneyMeta_00 2888 0.73 1.52 0.55 176 URI_NOVOWEL 2845 0.52 0.42 0.54 177 SUBJ_DOLLARS 2842 0.65 1.17 0.54 178 RELAYCOUNTRY_AU 2836 0.54 0.53 0.54 179 XM_H_PHPMailer 2810 0.65 1.15 0.53 180 FILL_THIS_FORM 2791 0.57 0.77 0.53 181 RELAYCOUNTRY_DE 2737 0.73 1.68 0.52 182 FORGED_GMAIL_RCVD 2732 0.62 1.07 0.52 183 XMHTMLBadTable_001 2732 0.55 0.69 0.52 184 FROM_GOV_DKIM_AU 2637 0.42 0.08 0.50 185 XM_B_COPY_HTML 2620 0.52 0.60 0.50 186 RELAYCOUNTRY_FR 2586 0.99 3.23 0.49 187 RCVD_IN_MSPIKE_H4 2533 0.44 0.26 0.48 188 USER_IN_WHITELIST 2469 0.38 0.00 0.47 189 TM2_M_BODY_EMPTY 2464 0.40 0.09 0.47 190 AC_DIV_BONANZA 2432 0.40 0.11 0.46 191 FSL_THIS_IS_ADV 2409 0.57 1.05 0.46 192 XMLngstWrd_00 2403 0.46 0.46 0.46 193 PLING_QUERY 2388 0.50 0.73 0.45 194 TM2_M_A_HREF_HREF 2378 0.59 1.19 0.45 195 MISSING_HEADERS 2369 0.51 0.76 0.45 196 FILL_THIS_FORM_LONG 2340 0.49 0.68 0.44 197 SpammyFromTLD_02 2318 1.85 8.11 0.44 198 XMSubMetaSxObfu_03 2274 0.54 1.03 0.43 199 XMPhish14 2254 0.61 1.43 0.43 200 SHORT_HELO_AND_INLINE_IMAGE 2245 0.37 0.10 0.43 ----------------------------------------------------------------------