Email: 641809 Autolearn: 0 AvgScore: 2.80 AvgScanTime: 2.01 sec Spam: 150640 Autolearn: 0 AvgScore: 16.45 AvgScanTime: 2.55 sec Ham: 491169 Autolearn: 0 AvgScore: -1.39 AvgScanTime: 1.85 sec Time Spent Running SA: 358.89 hours Time Spent Processing Spam: 106.86 hours Time Spent Processing Ham: 252.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134454 89.15 89.26 89.12 2 DCC_CHECK 117269 47.81 77.85 38.59 3 XM_B_Unicode 80471 65.82 53.42 69.62 4 DKIM_SIGNED 78050 68.81 51.81 74.03 5 XM_DK_Pass 75042 67.56 49.82 73.00 6 MIME_HTML_ONLY 74202 27.60 49.26 20.96 7 DKIM_VALID 69818 63.97 46.35 69.38 8 BAYES_50 69765 51.96 46.31 53.69 9 XMListUnsubscribeExists 61928 46.92 41.11 48.70 10 RELAYCOUNTRY_META 53432 12.49 35.47 5.44 11 BOTNET 52416 9.65 34.80 1.94 12 XM_UncommonTLD01 52339 11.13 34.74 3.89 13 DKIM_VALID_AU 51158 48.53 33.96 53.00 14 XM_B_Unicode3 51033 38.30 33.88 39.65 15 FSL_BULK_SIG 44138 11.54 29.30 6.09 16 UNTRUSTED_Relay 41338 7.73 27.44 1.69 17 HTML_FONT_LOW_CONTRAST 37831 26.64 25.11 27.11 18 BOTNET_IPINHOSTNAME 37765 9.36 25.07 4.55 19 XM_DK_Undo_02 34797 10.15 23.10 6.17 20 T_REMOTE_IMAGE 34635 8.57 22.99 4.15 21 HTML_SHORT_LINK_IMG_1 34001 5.32 22.57 0.04 22 XMSubLong 31956 20.86 21.21 20.75 23 LOC_TINY_FONT_1 31704 21.93 21.05 22.20 24 FROM_SUSPICIOUS_NTLD 31621 4.95 20.99 0.03 25 FROM_SUSPICIOUS_NTLD_FP 31443 4.92 20.87 0.03 26 DCC_CHECK_NEGATIVE 31411 50.35 20.85 59.39 27 HTML_MIME_NO_HTML_TAG 29743 6.45 19.74 2.38 28 KHOP_HELO_FCRDNS 29415 6.33 19.53 2.28 29 HTML_IMAGE_ONLY_08 28858 4.59 19.16 0.12 30 DKIM_ADSP_NXDOMAIN 28857 5.38 19.16 1.15 31 XM_Body_Dirty_Words 28393 14.61 18.85 13.31 32 SpammyFromTLD_02 27871 4.50 18.50 0.21 33 DKIM_VALID_EF 27095 25.23 17.99 27.46 34 BAYES_99 26476 6.76 17.58 3.44 35 FVGT_m_MULTI_ODD 26036 19.82 17.28 20.60 36 SHORT_IMG_SUSP_NTLD 25324 3.95 16.81 0.00 37 MultiRelay 25201 18.58 16.73 19.15 38 HDRS_MISSP 23710 3.71 15.74 0.02 39 XMSexyCombo_05 23112 7.16 15.34 4.65 40 T_TM2_M_HEADER_IN_MSG 22625 28.88 15.02 33.13 41 XM_B_Unsub 22525 11.11 14.95 9.94 42 MIME_HEADER_CTYPE_ONLY 22009 3.52 14.61 0.12 43 T_KAM_HTML_FONT_INVALID 20971 16.18 13.92 16.87 44 BAYES_999 20150 5.31 13.38 2.84 45 RCVD_IN_BL_SPAMCOP_NET 19887 3.73 13.20 0.83 46 TR_DCC_Bayes_99 19413 4.24 12.89 1.59 47 HDRS_LCASE_IMGONLY 18597 2.93 12.35 0.04 48 XM_Multi_Part_URI 18433 11.78 12.24 11.64 49 XMNumbers 17471 5.66 11.60 3.83 50 XM_UB50 17359 3.37 11.52 0.87 51 RCVD_IN_RP_RNBL 16577 2.64 11.00 0.08 52 XMSubMetaSx_00 15833 5.24 10.51 3.63 53 LOTS_OF_MONEY 14865 9.38 9.87 9.24 54 BODY_URI_ONLY 13853 2.22 9.20 0.08 55 T_HTML_TAG_BALANCE_CENTER 13580 2.28 9.01 0.21 56 HTML_FONT_SIZE_LARGE 13281 2.18 8.82 0.15 57 HTML_IMAGE_RATIO_02 13281 7.74 8.82 7.41 58 XM_SPF_SoftFail 13246 3.63 8.79 2.05 59 LongTLD 13192 2.17 8.76 0.15 60 TO_MALFORMED 12883 3.04 8.55 1.35 61 XM_BadFromFormat 12545 2.04 8.33 0.12 62 XM_Evil_Numbers_Gen 12496 9.04 8.30 9.27 63 FROM_MISSP_REPLYTO 12454 1.94 8.27 0.00 64 BAYES_60 12273 5.24 8.15 4.35 65 RDNS_DYNAMIC 12175 2.13 8.08 0.31 66 XM_DIRTYINTL 11587 4.06 7.69 2.95 67 RCVD_IN_PSBL 11289 1.81 7.49 0.07 68 BOTNET_NORDNS 10818 1.75 7.18 0.08 69 NO_DNS_FOR_FROM 10277 3.03 6.82 1.87 70 BAYES_40 10137 6.44 6.73 6.35 71 T_XMDrugObfuBody_14 9860 8.00 6.55 8.45 72 XM_B_Phish_Phrases 9808 5.88 6.51 5.69 73 REPLYTO_WITHOUT_TO_CC 9559 1.53 6.35 0.06 74 BAYES_80 9555 3.16 6.34 2.18 75 MPART_ALT_DIFF 9504 4.89 6.31 4.45 76 FROM_MISSP_DYNIP 9411 1.47 6.25 0.00 77 XM_H_Long_From01 8991 6.28 5.97 6.38 78 RCVD_IN_MSPIKE_BL 8553 1.99 5.68 0.86 79 DKIM_INVALID 8232 4.84 5.46 4.65 80 LotsOfNums_01 8117 6.95 5.39 7.43 81 HTML_IMAGE_ONLY_12 7878 1.40 5.23 0.22 82 TooManyTo_001 7870 8.11 5.22 8.99 83 RELAYCOUNTRY_DE 7591 1.50 5.04 0.42 84 FROM_EXCESS_BASE64 7443 3.64 4.94 3.24 85 NO_FM_NAME_IP_HOSTN 7361 1.15 4.89 0.00 86 SpammyFromTLD_01 7217 1.69 4.79 0.74 87 HTML_IMAGE_RATIO_04 7177 5.43 4.76 5.63 88 BAYES_20 6950 5.08 4.61 5.22 89 TO_EQ_FM_DOM_HTML_IMG 6890 1.09 4.57 0.02 90 RCVD_IN_MSPIKE_H2 6800 8.28 4.51 9.44 91 XMStrtUSub 6691 4.89 4.44 5.03 92 T_XMDrugObfuBody_08 6525 2.15 4.33 1.49 93 MIME_HTML_MOSTLY 6172 2.78 4.10 2.37 94 MISSING_HEADERS 6119 1.37 4.06 0.54 95 BAYES_00 6025 16.34 4.00 20.12 96 XM_B_SpammyTLD 5784 2.31 3.84 1.85 97 RCVD_IN_MSPIKE_L5 5691 1.04 3.78 0.20 98 XMMoneyMeta_00 5657 1.31 3.76 0.55 99 TM2_M_URI_OPT_OUT 5627 2.34 3.74 1.91 100 XM_SendGrid 5578 5.58 3.70 6.15 101 HK_RANDOM_FROM 5466 0.96 3.63 0.14 102 RELAYCOUNTRY_GB 5295 1.63 3.52 1.05 103 BAYES_95 5218 1.82 3.46 1.32 104 DRUGS_ERECTILE 5141 0.83 3.41 0.03 105 XM_CamelCaseFrm001 4933 2.40 3.27 2.13 106 FVGT_m_MULTI_ODD_EMAIL 4880 0.78 3.24 0.03 107 RELAYCOUNTRY_IN 4876 0.83 3.24 0.09 108 MIME_QP_LONG_LINE 4785 5.21 3.18 5.84 109 ALL_TRUSTED 4762 12.71 3.16 15.63 110 MIME_HTML_ONLY_MULTI 4749 2.87 3.15 2.78 111 MultiRelay_CC 4662 0.91 3.09 0.23 112 MultiRelay_Combo 4662 0.91 3.09 0.23 113 RELAYCOUNTRY_CA 4639 2.02 3.08 1.69 114 T_XMDrugObfuBody_00 4551 1.37 3.02 0.86 115 RELAYCOUNTRY_FR 4333 0.91 2.88 0.31 116 XM_UB99 3964 0.62 2.63 0.00 117 XM_UB60 3950 0.67 2.62 0.08 118 RELAYCOUNTRY_CN 3942 0.66 2.62 0.06 119 BAYES_05 3903 2.93 2.59 3.04 120 XMSexyCombo_01 3879 1.01 2.58 0.53 121 RCVD_IN_MSPIKE_H3 3866 8.06 2.57 9.75 122 RCVD_IN_MSPIKE_WL 3866 8.08 2.57 9.77 123 DRUGS_ERECTILE_OBFU 3852 0.61 2.56 0.02 124 T_Symld_Words_02 3835 1.01 2.55 0.54 125 XM_URI_RBL 3802 0.81 2.52 0.28 126 XMHTML_After_End 3728 1.64 2.47 1.38 127 HTML_IMAGE_RATIO_06 3622 3.29 2.40 3.56 128 DATE_IN_PAST_03_06 3598 0.65 2.39 0.12 129 XM_H_PHPMailer 3561 1.00 2.36 0.59 130 SHORT_URI_3 3540 0.58 2.35 0.04 131 XMSubMetaSxObfu_03 3538 0.99 2.35 0.57 132 XMDiploma_00 3469 1.74 2.30 1.57 133 XM_SPF_Unknown 3328 1.07 2.21 0.72 134 T_TooManySym_01 3197 4.12 2.12 4.73 135 XMSubMetaD_00 3093 0.55 2.05 0.09 136 XMPhish11 3071 1.44 2.04 1.25 137 DKIM_ADSP_CUSTOM_MED 3009 1.33 2.00 1.12 138 HTML_IMAGE_RATIO_08 2964 2.61 1.97 2.81 139 TVD_SPACE_RATIO_MINFP 2961 0.48 1.97 0.02 140 NORDNS_LOW_CONTRAST 2866 0.45 1.90 0.01 141 NML_ADSP_CUSTOM_MED 2832 1.06 1.88 0.81 142 XM_UB999 2828 0.44 1.88 0.00 143 XM_OfRef6 2816 1.55 1.87 1.45 144 DIET_1 2811 1.16 1.87 0.95 145 PDS_FROM_2_EMAILS 2783 0.47 1.85 0.05 146 FROM_2_EMAILS_SHORT 2731 0.43 1.81 0.00 147 TR_XM_PHPDW 2655 0.97 1.76 0.72 148 XMGppyBdWords 2635 0.51 1.75 0.12 149 XM_B_Unsub2 2626 2.17 1.74 2.30 150 SUBJ_BUY 2614 0.49 1.74 0.11 151 TR_XM_DK_SendGrid 2611 3.12 1.73 3.55 152 URI_HEX 2583 1.28 1.71 1.15 153 PDS_TO_EQ_FROM_NAME 2581 0.41 1.71 0.01 154 SUBJECT_NEEDS_ENCODING 2580 0.41 1.71 0.01 155 T_FILL_THIS_FORM_SHORT 2573 1.26 1.71 1.12 156 TR_XM_PHPForged 2565 0.93 1.70 0.69 157 TR_MetaPhish_Combo_01 2563 1.12 1.70 0.94 158 TR_XM_FormFill2 2545 0.93 1.69 0.69 159 XM_H_PHPOS 2530 0.92 1.68 0.69 160 RELAYCOUNTRY_FI 2529 0.41 1.68 0.02 161 XM_UB80 2507 0.41 1.66 0.02 162 DOS_RCVD_IP_TWICE_B 2501 0.46 1.66 0.09 163 TR_XM_RelayPhish 2485 1.11 1.65 0.95 164 SUBJ_ILLEGAL_CHARS 2483 0.39 1.65 0.01 165 FORGED_GMAIL_RCVD 2442 0.84 1.62 0.60 166 XMSubMetaSSx_00 2423 0.55 1.61 0.23 167 TVD_SPACE_RATIO 2340 0.65 1.55 0.37 168 HTML_SHORT_LINK_IMG_2 2332 0.38 1.55 0.03 169 RCVD_IN_MSPIKE_L3 2321 0.60 1.54 0.31 170 CHARSET_FARAWAY_HEADER 2304 0.40 1.53 0.05 171 TR_Symld_Words 2261 1.47 1.50 1.46 172 XMSubMetaI_00 2246 1.09 1.49 0.97 173 DATE_IN_PAST_06_12 2189 0.37 1.45 0.04 174 UNPARSEABLE_RELAY 2186 2.07 1.45 2.26 175 RCVD_IN_RP_SAFE 2172 7.30 1.44 9.09 176 HK_RANDOM_REPLYTO 2157 0.52 1.43 0.24 177 XMSubject_48 2152 0.36 1.43 0.03 178 XMObfuSubjects 2123 0.37 1.41 0.06 179 XMSlimDrugH 2111 0.57 1.40 0.32 180 RCVD_IN_IADB_LISTED 2101 3.89 1.39 4.66 181 MIME_CHARSET_FARAWAY 2084 0.43 1.38 0.14 182 TM2_M_VERY_LONG_WORD 2057 1.30 1.37 1.28 183 TR_XM_INV_DKIM 2045 0.38 1.36 0.08 184 XMBody_17 1968 1.02 1.31 0.94 185 XMSexyCombo_04 1939 0.38 1.29 0.11 186 RCVD_IN_IADB_SPF 1898 3.38 1.26 4.03 187 RELAYCOUNTRY_TR 1875 0.32 1.24 0.04 188 RCVD_IN_IADB_DK 1857 2.95 1.23 3.47 189 RCVD_IN_IADB_SENDERID 1857 2.98 1.23 3.52 190 MIMEOLE_DIRECT_TO_MX 1842 0.29 1.22 0.00 191 TR_Mismatch_TLD_01 1801 0.49 1.20 0.27 192 MAILING_LIST_MULTI 1799 1.90 1.19 2.12 193 TR_XM_DK_Bayes 1798 11.53 1.19 14.71 194 RCVD_IN_RP_CERTIFIED 1782 6.50 1.18 8.13 195 RCVD_IN_SORBS_DUL 1759 0.61 1.17 0.44 196 FROM_LOCAL_NOVOWEL 1726 0.28 1.15 0.02 197 T_XMDrugObfuBody_09 1717 0.28 1.14 0.02 198 XMEqualsVooDoo_00 1713 0.30 1.14 0.05 199 XMSubMetaD_01 1700 0.27 1.13 0.00 200 FROM_NO_USER 1682 0.27 1.12 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 437722 89.15 89.26 89.12 2 DKIM_SIGNED 363603 68.81 51.81 74.03 3 XM_DK_Pass 358561 67.56 49.82 73.00 4 XM_B_Unicode 341966 65.82 53.42 69.62 5 DKIM_VALID 340765 63.97 46.35 69.38 6 DCC_CHECK_NEGATIVE 291726 50.35 20.85 59.39 7 BAYES_50 263711 51.96 46.31 53.69 8 DKIM_VALID_AU 260324 48.53 33.96 53.00 9 XMListUnsubscribeExists 239194 46.92 41.11 48.70 10 XM_B_Unicode3 194768 38.30 33.88 39.65 11 DCC_CHECK 189566 47.81 77.85 38.59 12 T_TM2_M_HEADER_IN_MSG 162731 28.88 15.02 33.13 13 DKIM_VALID_EF 134852 25.23 17.99 27.46 14 HTML_FONT_LOW_CONTRAST 133148 26.64 25.11 27.11 15 LOC_TINY_FONT_1 109021 21.93 21.05 22.20 16 MIME_HTML_ONLY 102941 27.60 49.26 20.96 17 XMSubLong 101900 20.86 21.21 20.75 18 FVGT_m_MULTI_ODD 101184 19.82 17.28 20.60 19 BAYES_00 98841 16.34 4.00 20.12 20 MultiRelay 94044 18.58 16.73 19.15 21 T_KAM_HTML_FONT_INVALID 82857 16.18 13.92 16.87 22 ALL_TRUSTED 76785 12.71 3.16 15.63 23 TR_XM_DK_Bayes 72233 11.53 1.19 14.71 24 TR_XM_DK_Bayes1 69317 11.05 1.06 14.11 25 XM_Body_Dirty_Words 65353 14.61 18.85 13.31 26 TR_XM_DK_Bayes2 61652 9.76 0.65 12.55 27 XM_Multi_Part_URI 57165 11.78 12.24 11.64 28 XM_B_Unsub 48798 11.11 14.95 9.94 29 RCVD_IN_MSPIKE_WL 47980 8.08 2.57 9.77 30 RCVD_IN_MSPIKE_H3 47875 8.06 2.57 9.75 31 RCVD_IN_MSPIKE_H2 46350 8.28 4.51 9.44 32 XM_Evil_Numbers_Gen 45552 9.04 8.30 9.27 33 LOTS_OF_MONEY 45363 9.38 9.87 9.24 34 RCVD_IN_RP_SAFE 44658 7.30 1.44 9.09 35 TooManyTo_001 44155 8.11 5.22 8.99 36 T_XMDrugObfuBody_14 41489 8.00 6.55 8.45 37 RCVD_IN_RP_CERTIFIED 39934 6.50 1.18 8.13 38 XM_DKIMWhitelistDomains 37255 5.81 0.03 7.58 39 LotsOfNums_01 36512 6.95 5.39 7.43 40 HTML_IMAGE_RATIO_02 36395 7.74 8.82 7.41 41 XM_H_Long_From01 31339 6.28 5.97 6.38 42 BAYES_40 31191 6.44 6.73 6.35 43 XM_DK_Undo_02 30325 10.15 23.10 6.17 44 XM_SendGrid 30222 5.58 3.70 6.15 45 FSL_BULK_SIG 29906 11.54 29.30 6.09 46 MIME_QP_LONG_LINE 28668 5.21 3.18 5.84 47 XM_B_Phish_Phrases 27954 5.88 6.51 5.69 48 HTML_IMAGE_RATIO_04 27656 5.43 4.76 5.63 49 RELAYCOUNTRY_META 26733 12.49 35.47 5.44 50 BAYES_20 25653 5.08 4.61 5.22 51 XMStrtUSub 24711 4.89 4.44 5.03 52 XM_PDF 23285 3.78 0.66 4.74 53 T_TooManySym_01 23245 4.12 2.12 4.73 54 RCVD_IN_IADB_LISTED 22869 3.89 1.39 4.66 55 DKIM_INVALID 22838 4.84 5.46 4.65 56 XMSexyCombo_05 22820 7.16 15.34 4.65 57 BOTNET_IPINHOSTNAME 22326 9.36 25.07 4.55 58 MPART_ALT_DIFF 21872 4.89 6.31 4.45 59 BAYES_60 21354 5.24 8.15 4.35 60 T_REMOTE_IMAGE 20394 8.57 22.99 4.15 61 RCVD_IN_IADB_SPF 19817 3.38 1.26 4.03 62 XM_UncommonTLD01 19126 11.13 34.74 3.89 63 XMNumbers 18828 5.66 11.60 3.83 64 XMSubMetaSx_00 17813 5.24 10.51 3.63 65 IN_ZIMBRA_NJ_WHITELIST 17564 2.75 0.07 3.58 66 HTML_IMAGE_RATIO_06 17495 3.29 2.40 3.56 67 TR_XM_DK_SendGrid 17424 3.12 1.73 3.55 68 RCVD_IN_IADB_SENDERID 17271 2.98 1.23 3.52 69 RCVD_IN_IADB_DK 17057 2.95 1.23 3.47 70 BAYES_99 16879 6.76 17.58 3.44 71 FROM_EXCESS_BASE64 15906 3.64 4.94 3.24 72 BAYES_05 14927 2.93 2.59 3.04 73 RCVD_IN_IADB_VOUCHED 14567 2.37 0.43 2.97 74 XM_DIRTYINTL 14469 4.06 7.69 2.95 75 BAYES_999 13959 5.31 13.38 2.84 76 HTML_IMAGE_RATIO_08 13785 2.61 1.97 2.81 77 MIME_HTML_ONLY_MULTI 13671 2.87 3.15 2.78 78 TooManyTo_002 11822 2.06 0.94 2.41 79 XM_H_Trusted_IP 11680 1.82 0.00 2.38 80 HTML_MIME_NO_HTML_TAG 11678 6.45 19.74 2.38 81 MIME_HTML_MOSTLY 11650 2.78 4.10 2.37 82 T_XMHurry_00 11554 1.94 0.59 2.35 83 XM_B_Unsub2 11320 2.17 1.74 2.30 84 KHOP_HELO_FCRDNS 11207 6.33 19.53 2.28 85 UNPARSEABLE_RELAY 11114 2.07 1.45 2.26 86 T_TooManySym_02 11003 1.82 0.46 2.24 87 BAYES_80 10698 3.16 6.34 2.18 88 XM_CamelCaseFrm001 10440 2.40 3.27 2.13 89 MAILING_LIST_MULTI 10405 1.90 1.19 2.12 90 TVD_RCVD_IP 10122 1.75 0.74 2.06 91 XM_SPF_SoftFail 10075 3.63 8.79 2.05 92 BOTNET 9539 9.65 34.80 1.94 93 TM2_M_URI_OPT_OUT 9360 2.34 3.74 1.91 94 RCVD_IN_IADB_OPTIN 9201 1.51 0.31 1.87 95 NO_DNS_FOR_FROM 9185 3.03 6.82 1.87 96 XM_B_SpammyTLD 9072 2.31 3.84 1.85 97 HELO_NODOT 9051 1.61 0.87 1.84 98 HELO_NO_DOMAIN 9045 1.61 0.84 1.84 99 TooManyTo_003 8370 1.48 0.74 1.70 100 RELAYCOUNTRY_CA 8317 2.02 3.08 1.69 101 UNTRUSTED_Relay 8305 7.73 27.44 1.69 102 XM_DK_Undo_01 8303 1.52 0.95 1.69 103 INVALID_MSGID 7900 1.42 0.79 1.61 104 ANY_BOUNCE_MESSAGE 7831 1.34 0.49 1.59 105 BOUNCE_MESSAGE 7828 1.33 0.49 1.59 106 TR_DCC_Bayes_99 7791 4.24 12.89 1.59 107 XMDiploma_00 7694 1.74 2.30 1.57 108 SUBJ_ALL_CAPS 7547 1.43 1.07 1.54 109 XMCapTrack 7443 1.23 0.30 1.52 110 IN_HORDE_ADDRESS_BOOK 7353 1.22 0.32 1.50 111 CK_HELO_DYNAMIC_SPLIT_IP 7314 1.30 0.70 1.49 112 HELO_DYNAMIC_IPADDR2 7308 1.23 0.38 1.49 113 T_XMDrugObfuBody_08 7305 2.15 4.33 1.49 114 TR_Symld_Words 7190 1.47 1.50 1.46 115 XM_OfRef6 7111 1.55 1.87 1.45 116 XMHTML_After_End 6792 1.64 2.47 1.38 117 USER_IN_DEF_DKIM_WL 6770 1.06 0.01 1.38 118 URI_TRY_3LD 6699 1.21 0.71 1.36 119 TO_MALFORMED 6617 3.04 8.55 1.35 120 BAYES_95 6478 1.82 3.46 1.32 121 XMStockSpam_06 6339 1.25 1.10 1.29 122 TM2_M_VERY_LONG_WORD 6285 1.30 1.37 1.28 123 TooManyTo_004 6279 1.12 0.61 1.28 124 XM_H_Long_From02 6239 1.21 1.01 1.27 125 XMPhish11 6147 1.44 2.04 1.25 126 XMSubNoVowel 5974 1.13 0.86 1.22 127 URI_HEX 5652 1.28 1.71 1.15 128 DKIM_ADSP_NXDOMAIN 5646 5.38 19.16 1.15 129 XM_GoogleGroups 5574 0.94 0.30 1.13 130 XMGenDplmaNmb 5553 1.13 1.12 1.13 131 T_FILL_THIS_FORM_SHORT 5510 1.26 1.71 1.12 132 DKIM_ADSP_CUSTOM_MED 5504 1.33 2.00 1.12 133 TooManyTo_005 5334 0.95 0.50 1.09 134 RELAYCOUNTRY_GB 5140 1.63 3.52 1.05 135 XMSubMetaI_00 4762 1.09 1.49 0.97 136 XMGappySubj_01 4693 0.79 0.25 0.96 137 XMBdyGiftCard01 4673 0.99 1.10 0.95 138 DIET_1 4664 1.16 1.87 0.95 139 TR_XM_RelayPhish 4662 1.11 1.65 0.95 140 XMBody_17 4604 1.02 1.31 0.94 141 TR_MetaPhish_Combo_01 4601 1.12 1.70 0.94 142 HTML_FONT_FACE_BAD 4322 0.84 0.71 0.88 143 XM_UB50 4289 3.37 11.52 0.87 144 RCVD_IN_MSPIKE_BL 4241 1.99 5.68 0.86 145 T_XMDrugObfuBody_00 4236 1.37 3.02 0.86 146 RCVD_IN_BL_SPAMCOP_NET 4068 3.73 13.20 0.83 147 XM_RXBody 4010 0.68 0.22 0.82 148 AC_FROM_MANY_DOTS 3978 0.62 0.02 0.81 149 NML_ADSP_CUSTOM_MED 3966 1.06 1.88 0.81 150 XMBody_95 3885 0.62 0.05 0.79 151 XMSolicitRefs_0 3756 0.66 0.32 0.76 152 SpammyFromTLD_01 3622 1.69 4.79 0.74 153 XMBrknScrpt_02 3608 0.75 0.81 0.73 154 XM_SPF_Unknown 3552 1.07 2.21 0.72 155 TR_XM_PHPDW 3540 0.97 1.76 0.72 156 XM_ProductURIs 3515 0.74 0.81 0.72 157 TR_XM_PHPForged 3410 0.93 1.70 0.69 158 TR_XM_FormFill2 3406 0.93 1.69 0.69 159 XM_H_PHPOS 3382 0.92 1.68 0.69 160 T_OBFU_PDF_ATTACH 3190 0.53 0.16 0.65 161 XM_ShortIntro_01 3112 0.54 0.25 0.63 162 XM_E_Blogspot 3072 0.51 0.12 0.63 163 FORGED_GMAIL_RCVD 2941 0.84 1.62 0.60 164 HTTPS_HTTP_MISMATCH 2922 0.53 0.32 0.59 165 XM_H_PHPMailer 2885 1.00 2.36 0.59 166 XMSubMetaSxObfu_03 2785 0.99 2.35 0.57 167 XMNoVowels 2748 0.54 0.46 0.56 168 XM_B_REG_HTML 2746 0.49 0.26 0.56 169 TM2_M_BODY_EMPTY 2739 0.45 0.11 0.56 170 XMMoneyMeta_00 2723 1.31 3.76 0.55 171 XMHTMLBadTable_001 2712 0.60 0.77 0.55 172 AC_DIV_BONANZA 2684 0.45 0.14 0.55 173 MISSING_HEADERS 2662 1.37 4.06 0.54 174 T_Symld_Words_02 2641 1.01 2.55 0.54 175 XMSexyCombo_01 2587 1.01 2.58 0.53 176 HTML_IMAGE_ONLY_20 2567 0.45 0.20 0.52 177 USER_IN_WHITELIST 2541 0.40 0.00 0.52 178 XMPhish30 2521 0.54 0.64 0.51 179 HTML_TAG_BALANCE_BODY 2499 0.48 0.37 0.51 180 FROM_GOV_SPOOF 2492 0.41 0.10 0.51 181 SHORT_HELO_AND_INLINE_IMAGE 2439 0.39 0.04 0.50 182 TR_LOTS_OF_MONEY2 2279 0.57 0.91 0.46 183 T_MONEY_PERCENT 2279 0.57 0.91 0.46 184 FROM_GOV_DKIM_AU 2245 0.38 0.13 0.46 185 T_TooManySym_03 2212 0.37 0.11 0.45 186 XMDateMe_00 2178 0.43 0.40 0.44 187 RCVD_IN_SORBS_DUL 2168 0.61 1.17 0.44 188 XM_B_COPY_HTML 2146 0.46 0.53 0.44 189 FILL_THIS_FORM 2052 0.52 0.83 0.42 190 RELAYCOUNTRY_DE 2049 1.50 5.04 0.42 191 URI_NOVOWEL 2024 0.37 0.23 0.41 192 RELAYCOUNTRY_AU 2023 0.40 0.36 0.41 193 HTML_IMAGE_ONLY_32 2009 0.37 0.23 0.41 194 XMBody_78 1987 0.41 0.44 0.40 195 THIS_AD 1980 0.47 0.67 0.40 196 XM_H_Undi_Recip 1939 0.37 0.29 0.39 197 T_MANY_PILL_PRICE 1879 0.30 0.03 0.38 198 TVD_SPACE_RATIO 1811 0.65 1.55 0.37 199 XMOemUri 1777 0.30 0.10 0.36 200 PLING_QUERY 1771 0.39 0.47 0.36 ----------------------------------------------------------------------