Email: 388713 Autolearn: 0 AvgScore: 1.54 AvgScanTime: 2.27 sec Spam: 77373 Autolearn: 0 AvgScore: 12.84 AvgScanTime: 2.80 sec Ham: 311340 Autolearn: 0 AvgScore: -1.27 AvgScanTime: 2.13 sec Time Spent Running SA: 244.67 hours Time Spent Processing Spam: 60.16 hours Time Spent Processing Ham: 184.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 73366 89.94 94.82 88.73 2 DCC_CHECK 63657 60.17 82.27 54.67 3 DKIM_SIGNED 60698 82.20 78.45 83.13 4 XM_B_Unicode 60227 76.01 77.84 75.56 5 XM_DK_Pass 59197 80.99 76.51 82.10 6 DKIM_VALID 55542 77.67 71.78 79.14 7 XMListUnsubscribeExists 52643 63.97 68.04 62.96 8 DKIM_VALID_AU 43963 63.89 56.82 65.65 9 XM_B_Unicode3 43029 50.25 55.61 48.91 10 XM_DK_Undo_02 32684 14.87 42.24 8.07 11 HTML_FONT_LOW_CONTRAST 31557 35.26 40.79 33.89 12 BAYES_50 30782 51.32 39.78 54.19 13 MIME_HTML_ONLY 29698 26.33 38.38 23.33 14 LOC_TINY_FONT_1 28660 33.37 37.04 32.46 15 BAYES_99 22587 9.83 29.19 5.01 16 XMSubLong 20848 22.85 26.94 21.84 17 FVGT_m_MULTI_ODD 20647 24.12 26.69 23.48 18 XM_Body_Dirty_Words 19934 18.78 25.76 17.05 19 TR_DCC_Bayes_99 18493 6.82 23.90 2.58 20 BAYES_999 17613 7.86 22.76 4.15 21 DKIM_VALID_EF 16160 26.79 20.89 28.25 22 BOTNET 15932 5.82 20.59 2.15 23 T_KAM_HTML_FONT_INVALID 15257 18.44 19.72 18.12 24 XM_B_Unsub 15041 12.04 19.44 10.19 25 BOTNET_IPINHOSTNAME 14861 8.89 19.21 6.32 26 XM_Multi_Part_URI 14768 15.65 19.09 14.79 27 FSL_BULK_SIG 14197 10.12 18.35 8.08 28 RELAYCOUNTRY_META 13489 7.10 17.43 4.54 29 MultiRelay 12417 15.50 16.05 15.36 30 DCC_CHECK_NEGATIVE 12340 38.52 15.95 44.13 31 HTML_IMAGE_RATIO_02 12225 11.99 15.80 11.04 32 XM_UncommonTLD01 12114 6.61 15.66 4.36 33 T_TM2_M_HEADER_IN_MSG 11987 20.16 15.49 21.32 34 XMSexyCombo_05 11738 7.65 15.17 5.78 35 XM_H_Long_From01 10654 8.49 13.77 7.18 36 LOTS_OF_MONEY 9821 10.13 12.69 9.49 37 XM_Evil_Numbers_Gen 9505 11.65 12.28 11.49 38 RCVD_IN_MSPIKE_H2 9444 14.14 12.21 14.63 39 HTML_IMAGE_RATIO_04 8527 9.43 11.02 9.03 40 UNTRUSTED_Relay 8476 3.95 10.95 2.21 41 KHOP_HELO_FCRDNS 8262 3.01 10.68 1.11 42 MPART_ALT_DIFF 8113 5.81 10.49 4.65 43 HTML_MIME_NO_HTML_TAG 7792 3.61 10.07 2.01 44 RDNS_DYNAMIC 6974 2.20 9.01 0.51 45 XM_DIRTYINTL 6273 4.78 8.11 3.95 46 BAYES_80 6229 4.28 8.05 3.34 47 TR_Mismatch_TLD_02 6142 1.62 7.94 0.05 48 BAYES_60 6101 6.24 7.89 5.83 49 T_XMDrugObfuBody_14 5854 8.80 7.57 9.10 50 XMSubMetaSx_00 5772 4.90 7.46 4.26 51 MIME_HTML_MOSTLY 5617 4.31 7.26 3.58 52 FROM_MISSP_REPLYTO 5570 1.43 7.20 0.00 53 FROM_MISSP_DYNIP 5527 1.42 7.14 0.00 54 LotsOfNums_01 5338 7.84 6.90 8.07 55 DKIM_INVALID 5156 4.53 6.66 4.00 56 TooManyTo_001 5020 5.73 6.49 5.55 57 XM_UB50 4622 2.23 5.97 1.30 58 RCVD_IN_BL_SPAMCOP_NET 4560 2.08 5.89 1.13 59 URI_HEX 4542 2.74 5.87 1.96 60 MIME_HTML_ONLY_MULTI 4406 3.21 5.69 2.59 61 XM_B_Phish_Phrases 4267 7.81 5.51 8.39 62 RCVD_IN_MSPIKE_WL 3762 10.01 4.86 11.29 63 XM_SPF_SoftFail 3456 1.90 4.47 1.26 64 XM_SendGrid 3368 6.83 4.35 7.44 65 RELAYCOUNTRY_CA 3350 2.16 4.33 1.62 66 RCVD_IN_MSPIKE_H3 3345 9.76 4.32 11.12 67 FROM_EXCESS_BASE64 3327 4.29 4.30 4.29 68 BAYES_95 3240 2.39 4.19 1.94 69 XMStrtUSub 3234 4.65 4.18 4.77 70 DRUGS_ERECTILE 3164 0.84 4.09 0.04 71 SUBJ_ILLEGAL_CHARS 3144 0.86 4.06 0.07 72 SUBJECT_NEEDS_ENCODING 3143 0.86 4.06 0.07 73 BAYES_40 3039 4.50 3.93 4.64 74 DRUG_ED_SILD 3029 0.80 3.91 0.03 75 HTML_IMAGE_RATIO_08 2910 3.11 3.76 2.95 76 RCVD_IN_RP_RNBL 2851 0.79 3.68 0.07 77 HTML_IMAGE_RATIO_06 2825 3.75 3.65 3.77 78 XMNumbers 2700 3.34 3.49 3.31 79 MIME_QP_LONG_LINE 2688 4.78 3.47 5.11 80 XM_CamelCaseFrm001 2669 2.89 3.45 2.75 81 SpammyFromTLD_02 2602 0.84 3.36 0.21 82 XMSexyCombo_01 2393 1.31 3.09 0.87 83 TM2_M_URI_OPT_OUT 2297 1.76 2.97 1.46 84 XMBdyGiftCard01 2218 3.57 2.87 3.75 85 T_REMOTE_IMAGE 2191 3.57 2.83 3.76 86 T_TooManySym_01 2185 5.17 2.82 5.75 87 BAYES_20 2142 3.43 2.77 3.59 88 XM_OfRef6 2078 1.65 2.69 1.39 89 FROM_SUSPICIOUS_NTLD 1929 0.66 2.49 0.21 90 NO_DNS_FOR_FROM 1929 1.79 2.49 1.62 91 BOTNET_NORDNS 1925 0.51 2.49 0.02 92 FROM_SUSPICIOUS_NTLD_FP 1904 0.65 2.46 0.20 93 XMDiploma_00 1836 1.60 2.37 1.40 94 DKIM_ADSP_NXDOMAIN 1834 1.12 2.37 0.81 95 XM_URI_RBL 1788 0.80 2.31 0.43 96 BAYES_00 1764 15.56 2.28 18.86 97 XMBrknScrpt_02 1754 1.27 2.27 1.02 98 XM_B_SpammyTLD 1750 2.80 2.26 2.94 99 TR_XM_DK_SendGrid 1737 4.28 2.24 4.78 100 MultiRelay_Combo 1693 0.58 2.19 0.18 101 MultiRelay_CC 1693 0.58 2.19 0.18 102 RELAYCOUNTRY_FR 1689 0.79 2.18 0.45 103 RCVD_IN_RP_SAFE 1673 13.59 2.16 16.43 104 TR_XM_INV_DKIM 1654 0.63 2.14 0.25 105 TM2_M_VERY_LONG_WORD 1649 2.18 2.13 2.19 106 XMSubMetaI_00 1579 1.27 2.04 1.08 107 XMStockSpam_06 1562 1.83 2.02 1.79 108 HTML_SHORT_LINK_IMG_1 1543 0.42 1.99 0.03 109 XMHTML_After_End 1541 1.53 1.99 1.42 110 TR_XM_PHPDW 1537 0.88 1.99 0.60 111 XMBody_17 1536 0.97 1.99 0.71 112 TR_XM_DK_Bayes 1517 13.74 1.96 16.67 113 XM_B_Unsub2 1512 1.29 1.95 1.12 114 HTML_IMAGE_ONLY_08 1496 0.46 1.93 0.09 115 SUBJ_ALL_CAPS 1483 1.52 1.92 1.42 116 T_XMHurry_00 1475 1.38 1.91 1.24 117 TR_XM_PHPForged 1465 0.85 1.89 0.59 118 TR_XM_FormFill2 1458 0.84 1.88 0.58 119 XM_H_PHPOS 1455 0.84 1.88 0.58 120 RCVD_IN_PSBL 1406 0.42 1.82 0.08 121 LongTLD 1398 0.59 1.81 0.29 122 TR_XM_DK_Bayes1 1386 13.26 1.79 16.11 123 URI_TRY_3LD 1373 1.76 1.77 1.75 124 RCVD_IN_MSPIKE_BL 1360 1.27 1.76 1.14 125 MIME_HEADER_CTYPE_ONLY 1354 0.41 1.75 0.07 126 XMGenDplmaNmb 1351 0.85 1.75 0.63 127 XM_H_PHPMailer 1287 0.64 1.66 0.39 128 TR_XM_RelayPhish 1265 1.91 1.63 1.98 129 BAYES_05 1252 2.11 1.62 2.24 130 RCVD_IN_RP_CERTIFIED 1230 12.33 1.59 15.01 131 XMSexyCombo_04 1219 0.52 1.58 0.26 132 SpammyFromTLD_01 1204 0.65 1.56 0.43 133 DIET_1 1199 1.09 1.55 0.97 134 XMGetyour 1195 0.46 1.54 0.19 135 DATE_IN_PAST_03_06 1191 0.48 1.54 0.22 136 ALL_TRUSTED 1161 9.85 1.50 11.92 137 RCVD_IN_IADB_LISTED 1151 3.51 1.49 4.01 138 RELAYCOUNTRY_AT 1135 0.54 1.47 0.31 139 TR_LOTS_OF_MONEY3 1127 0.88 1.46 0.73 140 HDRS_LCASE_IMGONLY 1117 0.29 1.44 0.01 141 TR_Symld_Words 1096 1.38 1.42 1.37 142 XM_ProductURIs 1074 1.28 1.39 1.25 143 HK_SCAM 1072 0.28 1.39 0.01 144 REPLYTO_WITHOUT_TO_CC 1054 0.29 1.36 0.03 145 FILL_THIS_FORM 1032 0.58 1.33 0.39 146 RCVD_IN_IADB_SPF 1021 3.06 1.32 3.49 147 T_XMDrugObfuBody_08 1010 1.09 1.31 1.04 148 XMPhish11 1006 0.97 1.30 0.89 149 RCVD_IN_IADB_DK 1003 2.68 1.30 3.03 150 RCVD_IN_IADB_SENDERID 1001 2.74 1.29 3.10 151 XMSubMetaSSx_00 977 0.39 1.26 0.17 152 URG_BIZ 971 0.31 1.25 0.08 153 XM_B_REG_HTML 958 1.10 1.24 1.06 154 RELAYCOUNTRY_DE 950 0.51 1.23 0.33 155 TR_LOTS_OF_MONEY2 945 1.31 1.22 1.33 156 T_MONEY_PERCENT 945 1.31 1.22 1.33 157 DEAR_SOMETHING 944 0.29 1.22 0.06 158 MONEY_FRAUD_8 939 0.24 1.21 0.00 159 XM_H_Long_From02 917 1.11 1.19 1.10 160 UNPARSEABLE_RELAY 913 3.17 1.18 3.66 161 XM_OfRef7 903 0.35 1.17 0.15 162 TM2_M_A_HREF_HREF 902 0.72 1.17 0.62 163 FILL_THIS_FORM_LOAN 901 0.47 1.16 0.30 164 URIBL_DBL_ABUSE_REDIR 859 0.23 1.11 0.01 165 TO_NO_BRKTS_DYNIP 851 0.22 1.10 0.00 166 THIS_AD 807 0.57 1.04 0.45 167 XM_H_PHPOS_M 789 0.33 1.02 0.16 168 XMGppyBdWords 770 0.51 1.00 0.39 169 RELAYCOUNTRY_IE 769 0.32 0.99 0.16 170 MONEY_FRAUD_5 754 0.19 0.97 0.00 171 URI_NOVOWEL 751 0.69 0.97 0.62 172 MONEY_FORM 739 0.19 0.96 0.00 173 MPART_ALT_DIFF_COUNT 737 0.48 0.95 0.36 174 TR_XM_DK_Bayes2 736 12.42 0.95 15.27 175 RCVD_IN_SORBS_DUL 734 0.31 0.95 0.15 176 ADMITS_SPAM 729 0.21 0.94 0.03 177 RELAYCOUNTRY_GB 711 0.58 0.92 0.49 178 DKIM_ADSP_CUSTOM_MED 696 0.91 0.90 0.91 179 MAILING_LIST_MULTI 679 1.54 0.88 1.71 180 LONG_HEX_URI 671 0.28 0.87 0.14 181 HDRS_MISSP 670 0.17 0.87 0.00 182 T_FILL_THIS_FORM_SHORT 667 0.65 0.86 0.60 183 FSL_THIS_IS_ADV 665 0.44 0.86 0.34 184 ADVANCE_FEE_5_NEW_FRM_MNY 660 0.17 0.85 0.00 185 XMSubMetaSxObfu_03 658 0.52 0.85 0.44 186 T_XMDrugObfuBody_00 656 0.82 0.85 0.81 187 XM_DK_Undo_01 655 1.14 0.85 1.21 188 MILLION_HUNDRED 647 0.17 0.84 0.00 189 SHORT_IMG_SUSP_NTLD 641 0.16 0.83 0.00 190 NO_FM_NAME_IP_HOSTN 633 0.16 0.82 0.00 191 URIBL_BLACK 633 0.17 0.82 0.01 192 RELAYCOUNTRY_IN 633 0.21 0.82 0.06 193 URIBL_DBL_SPAM 632 0.32 0.82 0.19 194 XMHTMLBadTable_001 631 0.68 0.82 0.64 195 RELAYCOUNTRY_SE 621 0.17 0.80 0.01 196 LOTTO_AGENT 621 0.16 0.80 0.00 197 FORGED_GMAIL_RCVD 613 0.65 0.79 0.61 198 T_Symld_Words_02 610 0.44 0.79 0.35 199 XMPhish14 610 0.40 0.79 0.31 200 DEAR_WINNER 609 0.16 0.79 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276238 89.94 94.82 88.73 2 DKIM_SIGNED 258832 82.20 78.45 83.13 3 XM_DK_Pass 255609 80.99 76.51 82.10 4 DKIM_VALID 246382 77.67 71.78 79.14 5 XM_B_Unicode 235252 76.01 77.84 75.56 6 DKIM_VALID_AU 204388 63.89 56.82 65.65 7 XMListUnsubscribeExists 196012 63.97 68.04 62.96 8 DCC_CHECK 170217 60.17 82.27 54.67 9 BAYES_50 168717 51.32 39.78 54.19 10 XM_B_Unicode3 152290 50.25 55.61 48.91 11 DCC_CHECK_NEGATIVE 137398 38.52 15.95 44.13 12 HTML_FONT_LOW_CONTRAST 105509 35.26 40.79 33.89 13 LOC_TINY_FONT_1 101058 33.37 37.04 32.46 14 DKIM_VALID_EF 87967 26.79 20.89 28.25 15 FVGT_m_MULTI_ODD 73095 24.12 26.69 23.48 16 MIME_HTML_ONLY 72636 26.33 38.38 23.33 17 XMSubLong 67986 22.85 26.94 21.84 18 T_TM2_M_HEADER_IN_MSG 66392 20.16 15.49 21.32 19 BAYES_00 58712 15.56 2.28 18.86 20 T_KAM_HTML_FONT_INVALID 56421 18.44 19.72 18.12 21 XM_Body_Dirty_Words 53080 18.78 25.76 17.05 22 TR_XM_DK_Bayes 51895 13.74 1.96 16.67 23 RCVD_IN_RP_SAFE 51148 13.59 2.16 16.43 24 TR_XM_DK_Bayes1 50164 13.26 1.79 16.11 25 MultiRelay 47828 15.50 16.05 15.36 26 TR_XM_DK_Bayes2 47555 12.42 0.95 15.27 27 RCVD_IN_RP_CERTIFIED 46717 12.33 1.59 15.01 28 XM_Multi_Part_URI 46050 15.65 19.09 14.79 29 RCVD_IN_MSPIKE_H2 45538 14.14 12.21 14.63 30 ALL_TRUSTED 37123 9.85 1.50 11.92 31 XM_Evil_Numbers_Gen 35786 11.65 12.28 11.49 32 XM_DKIMWhitelistDomains 35484 9.14 0.06 11.40 33 RCVD_IN_MSPIKE_WL 35137 10.01 4.86 11.29 34 RCVD_IN_MSPIKE_H3 34607 9.76 4.32 11.12 35 HTML_IMAGE_RATIO_02 34373 11.99 15.80 11.04 36 XM_B_Unsub 31741 12.04 19.44 10.19 37 LOTS_OF_MONEY 29556 10.13 12.69 9.49 38 T_XMDrugObfuBody_14 28343 8.80 7.57 9.10 39 HTML_IMAGE_RATIO_04 28118 9.43 11.02 9.03 40 XM_B_Phish_Phrases 26110 7.81 5.51 8.39 41 FSL_BULK_SIG 25145 10.12 18.35 8.08 42 LotsOfNums_01 25132 7.84 6.90 8.07 43 XM_DK_Undo_02 25117 14.87 42.24 8.07 44 XM_SendGrid 23174 6.83 4.35 7.44 45 XM_H_Long_From01 22341 8.49 13.77 7.18 46 BOTNET_IPINHOSTNAME 19686 8.89 19.21 6.32 47 BAYES_60 18154 6.24 7.89 5.83 48 XMSexyCombo_05 17991 7.65 15.17 5.78 49 T_TooManySym_01 17916 5.17 2.82 5.75 50 TooManyTo_001 17267 5.73 6.49 5.55 51 MIME_QP_LONG_LINE 15903 4.78 3.47 5.11 52 BAYES_99 15605 9.83 29.19 5.01 53 TR_XM_DK_SendGrid 14886 4.28 2.24 4.78 54 XMStrtUSub 14854 4.65 4.18 4.77 55 MPART_ALT_DIFF 14472 5.81 10.49 4.65 56 BAYES_40 14445 4.50 3.93 4.64 57 RELAYCOUNTRY_META 14129 7.10 17.43 4.54 58 XM_UncommonTLD01 13580 6.61 15.66 4.36 59 FROM_EXCESS_BASE64 13363 4.29 4.30 4.29 60 XMSubMetaSx_00 13276 4.90 7.46 4.26 61 BAYES_999 12922 7.86 22.76 4.15 62 RCVD_IN_IADB_LISTED 12495 3.51 1.49 4.01 63 DKIM_INVALID 12450 4.53 6.66 4.00 64 XM_DIRTYINTL 12310 4.78 8.11 3.95 65 HTML_IMAGE_RATIO_06 11750 3.75 3.65 3.77 66 T_REMOTE_IMAGE 11699 3.57 2.83 3.76 67 XMBdyGiftCard01 11672 3.57 2.87 3.75 68 UNPARSEABLE_RELAY 11399 3.17 1.18 3.66 69 BAYES_20 11174 3.43 2.77 3.59 70 MIME_HTML_MOSTLY 11153 4.31 7.26 3.58 71 RCVD_IN_IADB_SPF 10865 3.06 1.32 3.49 72 BAYES_80 10397 4.28 8.05 3.34 73 XMNumbers 10296 3.34 3.49 3.31 74 TVD_RCVD_IP 9908 2.64 0.47 3.18 75 RCVD_IN_IADB_SENDERID 9655 2.74 1.29 3.10 76 IN_ZIMBRA_NJ_WHITELIST 9635 2.48 0.01 3.09 77 T_TooManySym_02 9590 2.61 0.72 3.08 78 RCVD_IN_IADB_DK 9423 2.68 1.30 3.03 79 HTML_IMAGE_RATIO_08 9186 3.11 3.76 2.95 80 XM_B_SpammyTLD 9143 2.80 2.26 2.94 81 CK_HELO_DYNAMIC_SPLIT_IP 8882 2.36 0.37 2.85 82 HELO_DYNAMIC_IPADDR2 8879 2.30 0.10 2.85 83 XM_CamelCaseFrm001 8559 2.89 3.45 2.75 84 MIME_HTML_ONLY_MULTI 8066 3.21 5.69 2.59 85 TR_DCC_Bayes_99 8032 6.82 23.90 2.58 86 RCVD_IN_IADB_VOUCHED 7939 2.13 0.42 2.55 87 INVALID_MSGID 7705 2.08 0.47 2.47 88 XM_PDF 7411 1.96 0.27 2.38 89 BAYES_05 6962 2.11 1.62 2.24 90 UNTRUSTED_Relay 6880 3.95 10.95 2.21 91 TM2_M_VERY_LONG_WORD 6813 2.18 2.13 2.19 92 BOTNET 6685 5.82 20.59 2.15 93 TO_MALFORMED 6569 1.69 0.02 2.11 94 HTML_MIME_NO_HTML_TAG 6256 3.61 10.07 2.01 95 TR_XM_RelayPhish 6171 1.91 1.63 1.98 96 URI_HEX 6093 2.74 5.87 1.96 97 BAYES_95 6041 2.39 4.19 1.94 98 XMStockSpam_06 5564 1.83 2.02 1.79 99 URI_TRY_3LD 5459 1.76 1.77 1.75 100 MAILING_LIST_MULTI 5320 1.54 0.88 1.71 101 IN_HORDE_ADDRESS_BOOK 5093 1.32 0.03 1.64 102 RCVD_IN_IADB_OPTIN 5079 1.38 0.35 1.63 103 RELAYCOUNTRY_CA 5044 2.16 4.33 1.62 104 NO_DNS_FOR_FROM 5040 1.79 2.49 1.62 105 USER_IN_DEF_DKIM_WL 5015 1.29 0.01 1.61 106 TM2_M_URI_OPT_OUT 4557 1.76 2.97 1.46 107 ANY_BOUNCE_MESSAGE 4441 1.21 0.32 1.43 108 BOUNCE_MESSAGE 4441 1.21 0.32 1.43 109 SUBJ_ALL_CAPS 4431 1.52 1.92 1.42 110 XMHTML_After_End 4411 1.53 1.99 1.42 111 XMDiploma_00 4365 1.60 2.37 1.40 112 XM_OfRef6 4317 1.65 2.69 1.39 113 TR_Symld_Words 4260 1.38 1.42 1.37 114 XMGappySubj_01 4146 1.18 0.59 1.33 115 TR_LOTS_OF_MONEY2 4135 1.31 1.22 1.33 116 T_MONEY_PERCENT 4135 1.31 1.22 1.33 117 XM_UB50 4052 2.23 5.97 1.30 118 XM_SPF_SoftFail 3938 1.90 4.47 1.26 119 XM_ProductURIs 3884 1.28 1.39 1.25 120 T_XMHurry_00 3875 1.38 1.91 1.24 121 HTML_FONT_FACE_BAD 3873 1.15 0.75 1.24 122 XM_DK_Undo_01 3770 1.14 0.85 1.21 123 XM_GoogleGroups 3573 1.00 0.40 1.15 124 RCVD_IN_MSPIKE_BL 3562 1.27 1.76 1.14 125 RCVD_IN_BL_SPAMCOP_NET 3532 2.08 5.89 1.13 126 XM_B_Unsub2 3492 1.29 1.95 1.12 127 KHOP_HELO_FCRDNS 3457 3.01 10.68 1.11 128 XMBody_95 3452 0.91 0.11 1.11 129 XM_H_Long_From02 3415 1.11 1.19 1.10 130 T_TooManySym_03 3412 0.95 0.36 1.10 131 XM_H_Trusted_IP 3369 0.87 0.00 1.08 132 XMSubMetaI_00 3362 1.27 2.04 1.08 133 XM_B_REG_HTML 3299 1.10 1.24 1.06 134 T_XMDrugObfuBody_08 3237 1.09 1.31 1.04 135 XMBrknScrpt_02 3170 1.27 2.27 1.02 136 TooManyTo_002 3047 0.91 0.65 0.98 137 DIET_1 3030 1.09 1.55 0.97 138 DKIM_ADSP_CUSTOM_MED 2827 0.91 0.90 0.91 139 XMPhish11 2783 0.97 1.30 0.89 140 XMSexyCombo_01 2696 1.31 3.09 0.87 141 TR_MetaPhish_Combo_01 2611 0.77 0.51 0.84 142 PLING_QUERY 2587 0.82 0.76 0.83 143 T_XMDrugObfuBody_00 2526 0.82 0.85 0.81 144 DKIM_ADSP_NXDOMAIN 2520 1.12 2.37 0.81 145 XMSubMetaSxObfu_02 2457 0.73 0.50 0.79 146 XMPhish30 2451 0.79 0.78 0.79 147 XMSolicitRefs_0 2329 0.71 0.53 0.75 148 USER_IN_WHITELIST 2328 0.60 0.00 0.75 149 HTML_TAG_BALANCE_BODY 2294 0.71 0.58 0.74 150 TR_LOTS_OF_MONEY3 2280 0.88 1.46 0.73 151 XMBSHREFv2 2271 0.64 0.29 0.73 152 XMBody_17 2225 0.97 1.99 0.71 153 TVD_SPACE_RATIO 2185 0.60 0.20 0.70 154 NML_ADSP_CUSTOM_MED 2036 0.68 0.79 0.65 155 TooManyTo_003 2025 0.62 0.51 0.65 156 XMHTMLBadTable_001 1997 0.68 0.82 0.64 157 XMGenDplmaNmb 1962 0.85 1.75 0.63 158 URI_NOVOWEL 1938 0.69 0.97 0.62 159 XMLngstWrd_00 1930 0.57 0.38 0.62 160 TM2_M_A_HREF_HREF 1916 0.72 1.17 0.62 161 FORGED_GMAIL_RCVD 1903 0.65 0.79 0.61 162 T_FILL_THIS_FORM_SHORT 1867 0.65 0.86 0.60 163 TR_XM_PHPDW 1867 0.88 1.99 0.60 164 XMSubNoVowel 1857 0.55 0.35 0.60 165 TR_XM_PHPForged 1839 0.85 1.89 0.59 166 XMLngstWrd_01 1833 0.54 0.36 0.59 167 TR_XM_FormFill2 1821 0.84 1.88 0.58 168 XM_H_PHPOS 1807 0.84 1.88 0.58 169 XM_SPF_Unknown 1657 0.48 0.25 0.53 170 TooManyTo_004 1626 0.50 0.40 0.52 171 XMBody_78 1621 0.52 0.51 0.52 172 AC_FROM_MANY_DOTS 1600 0.42 0.03 0.51 173 RDNS_DYNAMIC 1584 2.20 9.01 0.51 174 XM_B_COPY_HTML 1567 0.55 0.74 0.50 175 XMOemUri 1539 0.41 0.08 0.49 176 RELAYCOUNTRY_GB 1532 0.58 0.92 0.49 177 HELO_NODOT 1444 0.45 0.41 0.46 178 HELO_NO_DOMAIN 1443 0.45 0.41 0.46 179 TooManyTo_005 1436 0.43 0.32 0.46 180 HTML_IMAGE_ONLY_20 1421 0.43 0.34 0.46 181 TR_Mismatch_TLD_01 1404 0.43 0.37 0.45 182 THIS_AD 1398 0.57 1.04 0.45 183 RELAYCOUNTRY_FR 1397 0.79 2.18 0.45 184 HTTPS_HTTP_MISMATCH 1383 0.44 0.44 0.44 185 XMSubMetaSxObfu_03 1373 0.52 0.85 0.44 186 SUBJ_DOLLARS 1367 0.46 0.57 0.44 187 XM_Walgreens_Forge 1363 0.36 0.05 0.44 188 TVD_SPACE_RATIO_MINFP 1356 0.36 0.04 0.44 189 XM_URI_RBL 1340 0.80 2.31 0.43 190 RCVD_IN_MSPIKE_L3 1332 0.46 0.60 0.43 191 SpammyFromTLD_01 1324 0.65 1.56 0.43 192 RCVD_IN_MSPIKE_L4 1296 0.45 0.59 0.42 193 MISSING_HEADERS 1285 0.44 0.54 0.41 194 XMNoVowels 1272 0.43 0.52 0.41 195 XM_Ancestry_Forge 1272 0.33 0.03 0.41 196 XM_H_PHPMailer 1219 0.64 1.66 0.39 197 XMSubMetaSx_01 1216 0.41 0.50 0.39 198 XMGppyBdWords 1214 0.51 1.00 0.39 199 FILL_THIS_FORM 1214 0.58 1.33 0.39 200 XMRcvdHeader_15 1208 0.31 0.00 0.39 ----------------------------------------------------------------------