Email: 420230 Autolearn: 0 AvgScore: 1.25 AvgScanTime: 2.36 sec Spam: 84245 Autolearn: 0 AvgScore: 12.31 AvgScanTime: 2.97 sec Ham: 335985 Autolearn: 0 AvgScore: -1.52 AvgScanTime: 2.21 sec Time Spent Running SA: 275.41 hours Time Spent Processing Spam: 69.47 hours Time Spent Processing Ham: 205.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 79870 90.15 94.81 88.98 2 DCC_CHECK 69358 61.35 82.33 56.08 3 DKIM_SIGNED 65501 83.10 77.75 84.44 4 XM_DK_Pass 63946 82.00 75.90 83.53 5 XM_B_Unicode 61210 75.68 72.66 76.44 6 DKIM_VALID 60085 78.63 71.32 80.46 7 XMListUnsubscribeExists 58795 64.93 69.79 63.71 8 DKIM_VALID_AU 49527 64.34 58.79 65.73 9 XM_B_Unicode3 40147 48.70 47.66 48.96 10 BAYES_50 36547 53.65 43.38 56.23 11 XM_DK_Undo_02 32233 14.79 38.26 8.91 12 LOC_TINY_FONT_1 31436 33.27 37.31 32.26 13 HTML_FONT_LOW_CONTRAST 30690 35.13 36.43 34.81 14 MIME_HTML_ONLY 28845 26.62 34.24 24.71 15 BAYES_99 23857 9.04 28.32 4.21 16 FVGT_m_MULTI_ODD 23176 23.99 27.51 23.11 17 XM_Body_Dirty_Words 22134 19.11 26.27 17.32 18 XMSubLong 20323 22.66 24.12 22.29 19 TR_DCC_Bayes_99 19324 6.15 22.94 1.94 20 BAYES_999 18801 7.26 22.32 3.48 21 DKIM_VALID_EF 18007 26.75 21.37 28.10 22 RELAYCOUNTRY_META 17562 7.89 20.85 4.64 23 XM_UncommonTLD01 17325 7.34 20.57 4.02 24 HTML_IMAGE_RATIO_02 17170 14.23 20.38 12.69 25 BOTNET_IPINHOSTNAME 16268 9.23 19.31 6.70 26 XM_Multi_Part_URI 16177 16.43 19.20 15.73 27 BOTNET 16125 6.67 19.14 3.54 28 T_KAM_HTML_FONT_INVALID 15667 18.26 18.60 18.18 29 MultiRelay 14274 16.46 16.94 16.33 30 FSL_BULK_SIG 14169 9.84 16.82 8.09 31 DCC_CHECK_NEGATIVE 13446 37.41 15.96 42.78 32 XM_B_Unsub 13345 11.86 15.84 10.86 33 XMSexyCombo_05 12210 8.19 14.49 6.61 34 T_TM2_M_HEADER_IN_MSG 11565 20.56 13.73 22.27 35 XM_Evil_Numbers_Gen 11474 12.75 13.62 12.54 36 UNTRUSTED_Relay 10486 3.86 12.45 1.71 37 LOTS_OF_MONEY 10285 9.93 12.21 9.35 38 XM_H_Long_From01 9202 8.65 10.92 8.08 39 MPART_ALT_DIFF 8648 5.76 10.27 4.63 40 KHOP_HELO_FCRDNS 7719 2.92 9.16 1.36 41 XMSubMetaSx_00 7718 5.04 9.16 4.01 42 MIME_HTML_MOSTLY 7486 4.54 8.89 3.45 43 TooManyTo_001 7399 6.36 8.78 5.76 44 HTML_MIME_NO_HTML_TAG 7266 2.92 8.62 1.49 45 RCVD_IN_MSPIKE_H2 7193 11.70 8.54 12.49 46 HTML_IMAGE_RATIO_04 6947 7.91 8.25 7.83 47 SpammyFromTLD_02 6658 1.76 7.90 0.22 48 T_XMDrugObfuBody_14 6484 7.98 7.70 8.05 49 XM_DIRTYINTL 6475 4.95 7.69 4.27 50 BAYES_80 6363 3.90 7.55 2.98 51 XM_UB50 6305 2.25 7.48 0.93 52 TR_Mismatch_TLD_02 5898 1.45 7.00 0.06 53 XM_B_Phish_Phrases 5455 8.16 6.48 8.59 54 DKIM_INVALID 5416 4.47 6.43 3.98 55 LotsOfNums_01 5280 8.24 6.27 8.73 56 RCVD_IN_MSPIKE_WL 4978 10.60 5.91 11.77 57 BAYES_60 4825 5.78 5.73 5.79 58 XMNumbers 4694 4.04 5.57 3.65 59 RDNS_DYNAMIC 4634 1.47 5.50 0.45 60 XM_B_SpammyTLD 4509 3.40 5.35 2.91 61 XM_SendGrid 4095 7.23 4.86 7.83 62 URI_HEX 3896 2.62 4.62 2.12 63 MIME_QP_LONG_LINE 3879 5.00 4.60 5.10 64 XMBdyGiftCard01 3818 2.77 4.53 2.33 65 DKIM_ADSP_NXDOMAIN 3759 1.70 4.46 1.00 66 BAYES_40 3637 4.47 4.32 4.51 67 XMSexyCombo_01 3592 1.66 4.26 1.01 68 RELAYCOUNTRY_CA 3581 2.29 4.25 1.79 69 HTML_IMAGE_ONLY_08 3525 0.91 4.18 0.09 70 REPLYTO_WITHOUT_TO_CC 3520 0.87 4.18 0.04 71 MIME_HTML_ONLY_MULTI 3516 2.85 4.17 2.52 72 HTML_SHORT_LINK_IMG_1 3489 0.85 4.14 0.02 73 RCVD_IN_MSPIKE_H3 3486 9.81 4.14 11.24 74 T_REMOTE_IMAGE 3413 3.60 4.05 3.49 75 HTML_IMAGE_RATIO_06 3365 3.96 3.99 3.96 76 BAYES_95 3211 2.09 3.81 1.66 77 FROM_SUSPICIOUS_NTLD 3203 0.80 3.80 0.05 78 MIME_HEADER_CTYPE_ONLY 3193 0.82 3.79 0.07 79 FROM_SUSPICIOUS_NTLD_FP 3178 0.80 3.77 0.05 80 XMStrtUSub 3166 4.60 3.76 4.81 81 HDRS_LCASE_IMGONLY 3164 0.78 3.76 0.03 82 DATE_IN_PAST_03_06 3045 0.86 3.61 0.16 83 RCVD_IN_BL_SPAMCOP_NET 3025 1.76 3.59 1.30 84 MultiRelay_Combo 3025 0.87 3.59 0.19 85 MultiRelay_CC 3025 0.87 3.59 0.19 86 SUBJ_ALL_CAPS 2891 2.48 3.43 2.24 87 RELAYCOUNTRY_FR 2858 1.01 3.39 0.42 88 BAYES_20 2806 3.75 3.33 3.85 89 FROM_EXCESS_BASE64 2722 4.47 3.23 4.78 90 RELAYCOUNTRY_GB 2665 1.05 3.16 0.52 91 XMDiploma_00 2599 1.85 3.09 1.54 92 TM2_M_VERY_LONG_WORD 2533 2.04 3.01 1.80 93 XM_CamelCaseFrm001 2451 2.87 2.91 2.86 94 RCVD_IN_RP_SAFE 2440 14.14 2.90 16.96 95 XM_URI_RBL 2223 0.90 2.64 0.46 96 NO_DNS_FOR_FROM 2179 1.95 2.59 1.79 97 TR_XM_DK_SendGrid 2175 4.28 2.58 4.71 98 XMBody_17 2160 1.33 2.56 1.02 99 XM_SPF_SoftFail 2151 1.77 2.55 1.57 100 TM2_M_URI_OPT_OUT 2126 1.88 2.52 1.72 101 HTML_IMAGE_RATIO_08 2100 2.34 2.49 2.30 102 T_XMHurry_00 2085 1.50 2.47 1.25 103 XMBrknScrpt_02 2061 1.18 2.45 0.86 104 XMStockSpam_06 2052 2.52 2.44 2.55 105 XMGenDplmaNmb 2047 1.02 2.43 0.67 106 LongTLD 2046 0.61 2.43 0.16 107 T_TooManySym_01 2007 4.59 2.38 5.14 108 XM_OfRef6 2001 1.51 2.38 1.29 109 MORE_SEX 1994 0.48 2.37 0.01 110 XMSexyCombo_04 1958 0.70 2.32 0.29 111 URI_TRY_3LD 1958 1.61 2.32 1.44 112 RCVD_IN_RP_RNBL 1927 0.50 2.29 0.06 113 SpammyFromTLD_01 1791 0.89 2.13 0.58 114 T_MONEY_PERCENT 1788 0.94 2.12 0.64 115 TR_LOTS_OF_MONEY2 1788 0.94 2.12 0.64 116 RCVD_IN_RP_CERTIFIED 1787 12.61 2.12 15.24 117 TO_EQ_FM_DOM_HTML_IMG 1775 0.42 2.11 0.00 118 T_XMDrugObfuBody_08 1767 1.83 2.10 1.77 119 RELAYCOUNTRY_DE 1684 0.65 2.00 0.32 120 TR_XM_RelayPhish 1633 1.78 1.94 1.74 121 TR_XM_INV_DKIM 1600 0.50 1.90 0.15 122 SUBJ_DOLLARS 1576 1.19 1.87 1.02 123 TR_XM_PHPDW 1526 0.75 1.81 0.48 124 RCVD_IN_IADB_LISTED 1497 3.46 1.78 3.88 125 RCVD_IN_MSPIKE_H4 1492 0.77 1.77 0.52 126 XMSubMetaI_00 1489 1.21 1.77 1.08 127 NUMERIC_HTTP_ADDR 1475 0.66 1.75 0.38 128 MISSING_HEADERS 1462 0.51 1.74 0.21 129 TR_XM_PHPForged 1450 0.72 1.72 0.47 130 TR_XM_FormFill2 1440 0.72 1.71 0.47 131 BAYES_05 1439 2.21 1.71 2.34 132 XM_H_PHPOS 1437 0.71 1.71 0.47 133 HDRS_MISSP 1434 0.34 1.70 0.00 134 TR_LOTS_OF_MONEY1 1392 0.33 1.65 0.00 135 RCVD_IN_IADB_SPF 1371 3.08 1.63 3.45 136 RCVD_IN_IADB_DK 1356 2.76 1.61 3.05 137 DIET_1 1352 1.21 1.60 1.11 138 RCVD_IN_IADB_SENDERID 1352 2.82 1.60 3.13 139 UNPARSEABLE_RELAY 1342 2.98 1.59 3.33 140 SHORT_IMG_SUSP_NTLD 1340 0.32 1.59 0.00 141 BAYES_00 1328 14.78 1.58 18.09 142 RCVD_IN_MSPIKE_BL 1316 1.17 1.56 1.08 143 RCVD_IN_PSBL 1309 0.36 1.55 0.06 144 XM_H_PHPMailer 1276 0.65 1.51 0.43 145 ALL_TRUSTED 1256 8.83 1.49 10.67 146 NORMAL_HTTP_TO_IP 1254 0.32 1.49 0.02 147 HK_SCAM 1240 0.30 1.47 0.00 148 XM_ProductURIs 1231 1.93 1.46 2.05 149 RELAYCOUNTRY_AT 1226 0.58 1.46 0.36 150 URIBL_DBL_ABUSE_REDIR 1208 0.29 1.43 0.01 151 NORDNS_LOW_CONTRAST 1202 0.29 1.43 0.01 152 HK_RANDOM_REPLYTO 1196 0.58 1.42 0.37 153 URG_BIZ 1177 0.32 1.40 0.06 154 BOTNET_NORDNS 1126 0.45 1.34 0.23 155 XM_B_Unsub2 1099 1.82 1.30 1.95 156 XMHTML_After_End 1087 1.23 1.29 1.22 157 TR_XM_DK_Bayes 1067 12.91 1.27 15.83 158 TR_Symld_Words 1035 1.19 1.23 1.19 159 T_Symld_Words_02 1032 0.70 1.22 0.57 160 XM_H_PHPOS_M 1024 0.40 1.22 0.19 161 THIS_AD 984 0.61 1.17 0.47 162 XM_B_COPY_HTML 982 0.62 1.17 0.48 163 TM2_M_A_HREF_HREF 968 0.81 1.15 0.72 164 PLING_QUERY 946 0.89 1.12 0.83 165 XMPhish30 943 0.83 1.12 0.76 166 ADVANCE_FEE_3_NEW_MONEY 939 0.23 1.11 0.00 167 FILL_THIS_FORM 939 0.68 1.11 0.57 168 RCVD_IN_MSPIKE_L5 938 0.44 1.11 0.28 169 TR_XM_DK_Bayes1 931 12.43 1.11 15.27 170 XMPhish14 927 0.48 1.10 0.33 171 MAILING_LIST_MULTI 915 1.53 1.09 1.64 172 XMPhish11 898 0.99 1.07 0.98 173 FILL_THIS_FORM_LONG 895 0.59 1.06 0.48 174 HTML_FONT_FACE_BAD 881 0.98 1.05 0.96 175 RELAYCOUNTRY_NG_I 847 0.20 1.01 0.00 176 XM_UB60 823 0.25 0.98 0.07 177 TR_LOTS_OF_MONEY3 822 0.58 0.98 0.48 178 DKIM_ADSP_CUSTOM_MED 817 0.87 0.97 0.85 179 LOW_PRICE 766 0.37 0.91 0.23 180 MONEY_FORM 765 0.19 0.91 0.01 181 XMSubject_09 754 0.44 0.90 0.33 182 XMSubMetaSxObfu_03 750 0.62 0.89 0.55 183 XMHTMLBadTable_001 748 0.71 0.89 0.66 184 URI_NO_WWW_INFO_CGI 746 0.29 0.89 0.14 185 XM_H_Long_From02 745 0.99 0.88 1.02 186 FORGED_GMAIL_RCVD 743 0.61 0.88 0.54 187 TR_Mismatch_TLD_01 737 0.47 0.87 0.37 188 NML_ADSP_CUSTOM_MED 731 0.65 0.87 0.59 189 XMSexyCombo_03 723 0.17 0.86 0.00 190 XMGppyBdWords 723 0.48 0.86 0.39 191 DATE_IN_PAST_12_24 721 0.19 0.86 0.03 192 XMSubMetaSxObfu_02 709 0.60 0.84 0.54 193 T_XMDrugObfuBody_00 698 0.59 0.83 0.53 194 TR_XM_DK_Bayes2 692 11.31 0.82 13.94 195 XMMoneyMeta_00 684 0.31 0.81 0.19 196 T_FILL_THIS_FORM_SHORT 681 0.65 0.81 0.61 197 URIBL_BLACK 678 0.17 0.80 0.01 198 DATE_IN_PAST_06_12 675 0.22 0.80 0.07 199 XM_DK_Undo_01 665 1.17 0.79 1.27 200 XMSlimDrugH 662 0.45 0.79 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 298968 90.15 94.81 88.98 2 DKIM_SIGNED 283712 83.10 77.75 84.44 3 XM_DK_Pass 280654 82.00 75.90 83.53 4 DKIM_VALID 270332 78.63 71.32 80.46 5 XM_B_Unicode 256823 75.68 72.66 76.44 6 DKIM_VALID_AU 220857 64.34 58.79 65.73 7 XMListUnsubscribeExists 214069 64.93 69.79 63.71 8 BAYES_50 188913 53.65 43.38 56.23 9 DCC_CHECK 188434 61.35 82.33 56.08 10 XM_B_Unicode3 164503 48.70 47.66 48.96 11 DCC_CHECK_NEGATIVE 143744 37.41 15.96 42.78 12 HTML_FONT_LOW_CONTRAST 116951 35.13 36.43 34.81 13 LOC_TINY_FONT_1 108393 33.27 37.31 32.26 14 DKIM_VALID_EF 94411 26.75 21.37 28.10 15 MIME_HTML_ONLY 83027 26.62 34.24 24.71 16 FVGT_m_MULTI_ODD 77647 23.99 27.51 23.11 17 XMSubLong 74907 22.66 24.12 22.29 18 T_TM2_M_HEADER_IN_MSG 74830 20.56 13.73 22.27 19 T_KAM_HTML_FONT_INVALID 61073 18.26 18.60 18.18 20 BAYES_00 60794 14.78 1.58 18.09 21 XM_Body_Dirty_Words 58181 19.11 26.27 17.32 22 RCVD_IN_RP_SAFE 56977 14.14 2.90 16.96 23 MultiRelay 54879 16.46 16.94 16.33 24 TR_XM_DK_Bayes 53190 12.91 1.27 15.83 25 XM_Multi_Part_URI 52853 16.43 19.20 15.73 26 TR_XM_DK_Bayes1 51300 12.43 1.11 15.27 27 RCVD_IN_RP_CERTIFIED 51209 12.61 2.12 15.24 28 TR_XM_DK_Bayes2 46841 11.31 0.82 13.94 29 HTML_IMAGE_RATIO_02 42637 14.23 20.38 12.69 30 XM_Evil_Numbers_Gen 42118 12.75 13.62 12.54 31 RCVD_IN_MSPIKE_H2 41957 11.70 8.54 12.49 32 XM_DKIMWhitelistDomains 40633 9.69 0.09 12.09 33 RCVD_IN_MSPIKE_WL 39551 10.60 5.91 11.77 34 RCVD_IN_MSPIKE_H3 37754 9.81 4.14 11.24 35 XM_B_Unsub 36498 11.86 15.84 10.86 36 ALL_TRUSTED 35845 8.83 1.49 10.67 37 LOTS_OF_MONEY 31430 9.93 12.21 9.35 38 XM_DK_Undo_02 29921 14.79 38.26 8.91 39 LotsOfNums_01 29336 8.24 6.27 8.73 40 XM_B_Phish_Phrases 28850 8.16 6.48 8.59 41 FSL_BULK_SIG 27172 9.84 16.82 8.09 42 XM_H_Long_From01 27149 8.65 10.92 8.08 43 T_XMDrugObfuBody_14 27038 7.98 7.70 8.05 44 XM_SendGrid 26306 7.23 4.86 7.83 45 HTML_IMAGE_RATIO_04 26305 7.91 8.25 7.83 46 BOTNET_IPINHOSTNAME 22505 9.23 19.31 6.70 47 XMSexyCombo_05 22209 8.19 14.49 6.61 48 BAYES_60 19469 5.78 5.73 5.79 49 TooManyTo_001 19347 6.36 8.78 5.76 50 T_TooManySym_01 17285 4.59 2.38 5.14 51 MIME_QP_LONG_LINE 17148 5.00 4.60 5.10 52 XMStrtUSub 16161 4.60 3.76 4.81 53 FROM_EXCESS_BASE64 16063 4.47 3.23 4.78 54 TR_XM_DK_SendGrid 15819 4.28 2.58 4.71 55 RELAYCOUNTRY_META 15590 7.89 20.85 4.64 56 MPART_ALT_DIFF 15560 5.76 10.27 4.63 57 BAYES_40 15168 4.47 4.32 4.51 58 XM_DIRTYINTL 14345 4.95 7.69 4.27 59 BAYES_99 14143 9.04 28.32 4.21 60 XM_UncommonTLD01 13502 7.34 20.57 4.02 61 XMSubMetaSx_00 13472 5.04 9.16 4.01 62 DKIM_INVALID 13380 4.47 6.43 3.98 63 HTML_IMAGE_RATIO_06 13291 3.96 3.99 3.96 64 RCVD_IN_IADB_LISTED 13053 3.46 1.78 3.88 65 BAYES_20 12951 3.75 3.33 3.85 66 XMNumbers 12268 4.04 5.57 3.65 67 BOTNET 11888 6.67 19.14 3.54 68 T_REMOTE_IMAGE 11725 3.60 4.05 3.49 69 BAYES_999 11690 7.26 22.32 3.48 70 MIME_HTML_MOSTLY 11605 4.54 8.89 3.45 71 RCVD_IN_IADB_SPF 11580 3.08 1.63 3.45 72 UNPARSEABLE_RELAY 11196 2.98 1.59 3.33 73 IN_ZIMBRA_NJ_WHITELIST 10967 2.61 0.01 3.26 74 RCVD_IN_IADB_SENDERID 10518 2.82 1.60 3.13 75 RCVD_IN_IADB_DK 10255 2.76 1.61 3.05 76 TVD_RCVD_IP 10222 2.52 0.44 3.04 77 BAYES_80 10009 3.90 7.55 2.98 78 XM_B_SpammyTLD 9774 3.40 5.35 2.91 79 XM_CamelCaseFrm001 9599 2.87 2.91 2.86 80 T_TooManySym_02 8637 2.14 0.42 2.57 81 XMStockSpam_06 8558 2.52 2.44 2.55 82 MIME_HTML_ONLY_MULTI 8453 2.85 4.17 2.52 83 CK_HELO_DYNAMIC_SPLIT_IP 7981 1.99 0.44 2.38 84 HELO_DYNAMIC_IPADDR2 7980 1.91 0.07 2.38 85 BAYES_05 7847 2.21 1.71 2.34 86 XMBdyGiftCard01 7840 2.77 4.53 2.33 87 HTML_IMAGE_RATIO_08 7744 2.34 2.49 2.30 88 RCVD_IN_IADB_VOUCHED 7691 1.92 0.43 2.29 89 SUBJ_ALL_CAPS 7537 2.48 3.43 2.24 90 INVALID_MSGID 7295 1.81 0.35 2.17 91 URI_HEX 7135 2.62 4.62 2.12 92 XM_ProductURIs 6899 1.93 1.46 2.05 93 TO_MALFORMED 6559 1.57 0.05 1.95 94 XM_B_Unsub2 6546 1.82 1.30 1.95 95 TR_DCC_Bayes_99 6511 6.15 22.94 1.94 96 TM2_M_VERY_LONG_WORD 6047 2.04 3.01 1.80 97 RELAYCOUNTRY_CA 6029 2.29 4.25 1.79 98 NO_DNS_FOR_FROM 5998 1.95 2.59 1.79 99 XM_PDF 5996 1.47 0.24 1.78 100 T_XMDrugObfuBody_08 5934 1.83 2.10 1.77 101 TR_XM_RelayPhish 5838 1.78 1.94 1.74 102 TM2_M_URI_OPT_OUT 5772 1.88 2.52 1.72 103 UNTRUSTED_Relay 5743 3.86 12.45 1.71 104 XM_RXBody 5668 1.46 0.55 1.69 105 IN_HORDE_ADDRESS_BOOK 5631 1.35 0.03 1.68 106 BAYES_95 5577 2.09 3.81 1.66 107 MAILING_LIST_MULTI 5510 1.53 1.09 1.64 108 ANY_BOUNCE_MESSAGE 5398 1.33 0.20 1.61 109 BOUNCE_MESSAGE 5393 1.32 0.20 1.61 110 XM_SPF_SoftFail 5270 1.77 2.55 1.57 111 USER_IN_DEF_DKIM_WL 5177 1.23 0.01 1.54 112 XMDiploma_00 5158 1.85 3.09 1.54 113 HTML_MIME_NO_HTML_TAG 5017 2.92 8.62 1.49 114 URI_TRY_3LD 4828 1.61 2.32 1.44 115 RCVD_IN_IADB_OPTIN 4701 1.18 0.30 1.40 116 KHOP_HELO_FCRDNS 4566 2.92 9.16 1.36 117 RCVD_IN_BL_SPAMCOP_NET 4362 1.76 3.59 1.30 118 XM_OfRef6 4339 1.51 2.38 1.29 119 XM_DK_Undo_01 4253 1.17 0.79 1.27 120 T_XMHurry_00 4213 1.50 2.47 1.25 121 XMHTML_After_End 4085 1.23 1.29 1.22 122 TR_Symld_Words 3983 1.19 1.23 1.19 123 XM_H_Trusted_IP 3785 0.90 0.00 1.13 124 DIET_1 3738 1.21 1.60 1.11 125 RCVD_IN_MSPIKE_BL 3613 1.17 1.56 1.08 126 XMSubMetaI_00 3613 1.21 1.77 1.08 127 XM_H_Long_From02 3432 0.99 0.88 1.02 128 SUBJ_DOLLARS 3431 1.19 1.87 1.02 129 XMGappySubj_01 3422 0.86 0.22 1.02 130 XMBody_17 3416 1.33 2.56 1.02 131 XMSexyCombo_01 3379 1.66 4.26 1.01 132 DKIM_ADSP_NXDOMAIN 3373 1.70 4.46 1.00 133 XM_GoogleGroups 3347 0.87 0.39 1.00 134 XMPhish11 3277 0.99 1.07 0.98 135 XMBody_95 3249 0.81 0.17 0.97 136 HTML_FONT_FACE_BAD 3235 0.98 1.05 0.96 137 FROM_GOV_DKIM_AU 3212 0.77 0.02 0.96 138 XM_UB50 3138 2.25 7.48 0.93 139 TooManyTo_002 3130 0.86 0.57 0.93 140 XMBrknScrpt_02 2905 1.18 2.45 0.86 141 DKIM_ADSP_CUSTOM_MED 2854 0.87 0.97 0.85 142 PLING_QUERY 2797 0.89 1.12 0.83 143 XM_B_REG_HTML 2791 0.72 0.28 0.83 144 XMPhish30 2541 0.83 1.12 0.76 145 XMOemUri 2513 0.65 0.26 0.75 146 TM2_M_A_HREF_HREF 2416 0.81 1.15 0.72 147 TR_MetaPhish_Combo_01 2411 0.66 0.41 0.72 148 XMBody_78 2379 0.65 0.43 0.71 149 USER_IN_WHITELIST 2369 0.56 0.00 0.71 150 HTML_TAG_BALANCE_BODY 2319 0.64 0.42 0.69 151 XMGenDplmaNmb 2244 1.02 2.43 0.67 152 XMHTMLBadTable_001 2224 0.71 0.89 0.66 153 T_MONEY_PERCENT 2157 0.94 2.12 0.64 154 TR_LOTS_OF_MONEY2 2157 0.94 2.12 0.64 155 XMSubNoVowel 2130 0.61 0.53 0.63 156 TooManyTo_003 2118 0.59 0.42 0.63 157 T_FILL_THIS_FORM_SHORT 2040 0.65 0.81 0.61 158 NML_ADSP_CUSTOM_MED 1994 0.65 0.87 0.59 159 XMLngstWrd_00 1980 0.52 0.25 0.59 160 SpammyFromTLD_01 1953 0.89 2.13 0.58 161 FILL_THIS_FORM 1909 0.68 1.11 0.57 162 XM_SPF_Unknown 1902 0.50 0.24 0.57 163 T_Symld_Words_02 1901 0.70 1.22 0.57 164 URI_NOVOWEL 1887 0.60 0.74 0.56 165 T_TooManySym_03 1881 0.47 0.12 0.56 166 XMLngstWrd_01 1872 0.49 0.23 0.56 167 XMSubMetaSxObfu_03 1858 0.62 0.89 0.55 168 AC_FROM_MANY_DOTS 1846 0.44 0.01 0.55 169 XMSolicitRefs_0 1838 0.56 0.62 0.55 170 XM_Sams_Club_Forge 1827 0.53 0.47 0.54 171 FORGED_GMAIL_RCVD 1809 0.61 0.88 0.54 172 XMSubMetaSxObfu_02 1803 0.60 0.84 0.54 173 T_XMDrugObfuBody_00 1782 0.59 0.83 0.53 174 RELAYCOUNTRY_GB 1753 1.05 3.16 0.52 175 RCVD_IN_MSPIKE_H4 1752 0.77 1.77 0.52 176 TooManyTo_004 1723 0.47 0.32 0.51 177 XM_shorewaves_Whitelist 1691 0.40 0.00 0.50 178 TR_XM_PHPDW 1616 0.75 1.81 0.48 179 XM_B_COPY_HTML 1610 0.62 1.17 0.48 180 TR_LOTS_OF_MONEY3 1602 0.58 0.98 0.48 181 FILL_THIS_FORM_LONG 1598 0.59 1.06 0.48 182 THIS_AD 1587 0.61 1.17 0.47 183 TR_XM_PHPForged 1582 0.72 1.72 0.47 184 TR_XM_FormFill2 1573 0.72 1.71 0.47 185 XM_H_PHPOS 1565 0.71 1.71 0.47 186 HELO_NODOT 1558 0.51 0.72 0.46 187 HELO_NO_DOMAIN 1557 0.51 0.72 0.46 188 T_FILL_THIS_FORM_LOAN 1557 0.39 0.12 0.46 189 XM_URI_RBL 1557 0.90 2.64 0.46 190 RDNS_DYNAMIC 1524 1.47 5.50 0.45 191 TooManyTo_005 1521 0.42 0.28 0.45 192 XM_H_PHPMailer 1457 0.65 1.51 0.43 193 RCVD_IN_MSPIKE_L3 1431 0.40 0.31 0.43 194 XMLngstWrd_02 1418 0.37 0.17 0.42 195 XM_Body_Obfu01 1409 0.44 0.54 0.42 196 RELAYCOUNTRY_FR 1397 1.01 3.39 0.42 197 XM_Walgreens_Forge 1383 0.33 0.02 0.41 198 HTML_IMAGE_ONLY_20 1352 0.36 0.19 0.40 199 XMUrgent 1349 0.39 0.32 0.40 200 REMOVE_BEFORE_LINK 1328 0.36 0.22 0.40 ----------------------------------------------------------------------