Email: 676117 Autolearn: 0 AvgScore: 2.60 AvgScanTime: 2.08 sec Spam: 159412 Autolearn: 0 AvgScore: 15.85 AvgScanTime: 2.72 sec Ham: 516705 Autolearn: 0 AvgScore: -1.49 AvgScanTime: 1.88 sec Time Spent Running SA: 389.86 hours Time Spent Processing Spam: 120.45 hours Time Spent Processing Ham: 269.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143432 89.24 89.98 89.01 2 DCC_CHECK 116488 47.46 73.07 39.55 3 XM_B_Unicode 95379 66.50 59.83 68.55 4 DKIM_SIGNED 86295 69.77 54.13 74.60 5 XM_DK_Pass 82614 68.27 51.82 73.34 6 DKIM_VALID 77330 64.71 48.51 69.71 7 BAYES_50 74423 52.48 46.69 54.26 8 MIME_HTML_ONLY 73972 26.85 46.40 20.82 9 XMListUnsubscribeExists 70088 48.75 43.97 50.23 10 XM_B_Unicode3 61503 38.85 38.58 38.93 11 DKIM_VALID_AU 57858 48.43 36.29 52.18 12 HTML_FONT_LOW_CONTRAST 50749 27.71 31.84 26.43 13 RELAYCOUNTRY_META 48010 11.53 30.12 5.79 14 FSL_BULK_SIG 47659 11.70 29.90 6.09 15 XM_UncommonTLD01 43557 9.56 27.32 4.07 16 BOTNET 43199 7.74 27.10 1.77 17 DCC_CHECK_NEGATIVE 39658 50.24 24.88 58.06 18 XM_DK_Undo_02 37938 9.99 23.80 5.73 19 LOC_TINY_FONT_1 35285 22.17 22.13 22.18 20 XMSubLong 35010 21.89 21.96 21.87 21 UNTRUSTED_Relay 33639 6.24 21.10 1.65 22 BOTNET_IPINHOSTNAME 32976 8.10 20.69 4.22 23 XM_Body_Dirty_Words 32753 14.49 20.55 12.62 24 BAYES_99 30544 6.84 19.16 3.03 25 FVGT_m_MULTI_ODD 30368 20.25 19.05 20.62 26 MultiRelay 29893 19.06 18.75 19.15 27 DKIM_VALID_EF 27982 24.97 17.55 27.26 28 XM_Multi_Part_URI 27402 12.68 17.19 11.28 29 T_TM2_M_HEADER_IN_MSG 27012 27.24 16.94 30.42 30 XM_B_Unsub 25969 11.95 16.29 10.61 31 SpammyFromTLD_02 25781 4.09 16.17 0.37 32 XMSexyCombo_05 24161 6.23 15.16 3.47 33 T_KAM_HTML_FONT_INVALID 23281 17.17 14.60 17.97 34 BAYES_999 22944 5.24 14.39 2.41 35 HTML_SHORT_LINK_IMG_1 22413 3.34 14.06 0.03 36 T_REMOTE_IMAGE 21537 6.99 13.51 4.98 37 RCVD_IN_BL_SPAMCOP_NET 21532 3.95 13.51 1.01 38 TR_DCC_Bayes_99 21318 4.12 13.37 1.27 39 KHOP_HELO_FCRDNS 21102 5.02 13.24 2.49 40 RCVD_IN_RP_RNBL 20538 3.10 12.88 0.09 41 XM_B_Phish_Phrases 17840 7.36 11.19 6.18 42 FROM_SUSPICIOUS_NTLD 17763 2.65 11.14 0.03 43 FROM_SUSPICIOUS_NTLD_FP 17562 2.62 11.02 0.03 44 HTML_MIME_NO_HTML_TAG 16972 4.86 10.65 3.08 45 FROM_EXCESS_BASE64 16918 4.67 10.61 2.83 46 LOTS_OF_MONEY 16639 8.85 10.44 8.36 47 HTML_IMAGE_ONLY_08 16463 2.54 10.33 0.14 48 DKIM_ADSP_NXDOMAIN 15579 3.33 9.77 1.35 49 XM_DIRTYINTL 14977 4.08 9.40 2.44 50 XMSubMetaSx_00 14867 5.05 9.33 3.73 51 XM_UB50 14833 2.83 9.30 0.83 52 RDNS_DYNAMIC 14655 2.41 9.19 0.32 53 XM_SPF_SoftFail 13854 3.87 8.69 2.38 54 RCVD_IN_PSBL 13756 2.06 8.63 0.03 55 HTML_IMAGE_RATIO_02 13270 7.55 8.32 7.32 56 TM2_M_URI_OPT_OUT 13241 3.43 8.31 1.93 57 XM_Evil_Numbers_Gen 13192 8.81 8.28 8.98 58 T_XMDrugObfuBody_14 12641 8.27 7.93 8.37 59 BOTNET_NORDNS 12631 1.91 7.92 0.05 60 XMNumbers 12280 4.58 7.70 3.61 61 BAYES_60 12219 5.32 7.67 4.60 62 XMHTML_After_End 11873 2.67 7.45 1.19 63 RCVD_IN_MSPIKE_BL 11785 2.52 7.39 1.02 64 BAYES_40 11778 6.59 7.39 6.34 65 BODY_URI_ONLY 11589 1.75 7.27 0.05 66 SHORT_IMG_SUSP_NTLD 11486 1.70 7.21 0.00 67 T_HTML_TAG_BALANCE_CENTER 11333 1.77 7.11 0.12 68 BAYES_80 11071 3.47 6.94 2.40 69 MIME_HEADER_CTYPE_ONLY 10953 1.68 6.87 0.08 70 HTML_FONT_SIZE_LARGE 10818 1.69 6.79 0.12 71 HDRS_MISSP 10274 1.53 6.44 0.02 72 ALL_TRUSTED 10194 12.47 6.39 14.35 73 XM_H_PHPMailer 10171 1.90 6.38 0.51 74 XM_H_Long_From01 10086 6.20 6.33 6.17 75 REPLYTO_WITHOUT_TO_CC 9854 1.49 6.18 0.05 76 XM_BadFromFormat 9641 1.51 6.05 0.11 77 FROM_NO_USER 9610 1.43 6.03 0.01 78 FROM_MISSP_REPLYTO 9440 1.40 5.92 0.00 79 FROM_OFFERS 9172 1.43 5.75 0.09 80 FROM_MISSP_DYNIP 9043 1.34 5.67 0.00 81 HDRS_LCASE_IMGONLY 9030 1.36 5.66 0.03 82 TO_MALFORMED 9026 2.31 5.66 1.28 83 MPART_ALT_DIFF 8995 4.94 5.64 4.73 84 DKIM_INVALID 8965 5.07 5.62 4.89 85 RCVD_IN_MSPIKE_L5 8866 1.50 5.56 0.24 86 SpammyFromTLD_01 8852 1.89 5.55 0.76 87 TooManyTo_001 8772 8.14 5.50 8.95 88 LotsOfNums_01 8642 7.30 5.42 7.88 89 XMEqualsVooDoo_00 8561 1.28 5.37 0.01 90 XMEqualsVooDoo_01 8506 1.26 5.34 0.00 91 XMEqualsVooDoo_02 8500 1.26 5.33 0.00 92 HTML_IMAGE_ONLY_12 8210 1.36 5.15 0.19 93 TO_EQ_FM_DOM_HTML_IMG 7776 1.16 4.88 0.01 94 XM_B_SpammyTLD 7599 2.83 4.77 2.23 95 T_XMDrugObfuBody_08 7531 2.28 4.72 1.52 96 RCVD_IN_MSPIKE_H2 7190 8.17 4.51 9.30 97 MIME_HTML_MOSTLY 7122 3.03 4.47 2.59 98 XMStrtUSub 7040 4.54 4.42 4.57 99 HTML_IMAGE_RATIO_04 6782 5.40 4.25 5.75 100 DRUGS_ERECTILE 6281 0.96 3.94 0.04 101 NO_DNS_FOR_FROM 6130 2.50 3.85 2.08 102 XM_SendGrid 6034 5.68 3.79 6.27 103 RELAYCOUNTRY_CA 5861 2.11 3.68 1.62 104 XM_CamelCaseFrm001 5817 2.55 3.65 2.22 105 MultiRelay_Combo 5712 1.01 3.58 0.22 106 MultiRelay_CC 5712 1.01 3.58 0.22 107 BAYES_95 5590 1.91 3.51 1.41 108 XM_SPF_Unknown 5560 1.42 3.49 0.78 109 MIME_QP_LONG_LINE 5523 5.54 3.46 6.18 110 HTML_IMAGE_RATIO_06 5404 4.25 3.39 4.51 111 BAYES_20 5394 4.54 3.38 4.89 112 T_XMDrugObfuBody_00 5095 1.40 3.20 0.84 113 RELAYCOUNTRY_FR 5087 0.98 3.19 0.29 114 XM_UB99 5064 0.75 3.18 0.01 115 RCVD_IN_MSPIKE_WL 5027 8.59 3.15 10.27 116 RCVD_IN_MSPIKE_H3 5027 8.59 3.15 10.26 117 XMMoneyMeta_00 4835 1.13 3.03 0.54 118 RELAYCOUNTRY_GB 4786 1.62 3.00 1.20 119 XMSubMetaD_00 4723 0.75 2.96 0.06 120 BAYES_00 4681 15.95 2.94 19.96 121 XMSexyCombo_01 4671 1.21 2.93 0.68 122 HK_RANDOM_FROM 4636 0.81 2.91 0.16 123 NORDNS_LOW_CONTRAST 4629 0.69 2.90 0.01 124 MISSING_HEADERS 4223 0.99 2.65 0.47 125 XMGppyBdWords 4169 0.79 2.62 0.23 126 DRUGS_ERECTILE_OBFU 4168 0.64 2.61 0.03 127 XM_URI_RBL 4043 0.80 2.54 0.26 128 MIME_HTML_ONLY_MULTI 4026 2.90 2.53 3.01 129 RELAYCOUNTRY_CN 4026 0.64 2.53 0.06 130 XMPhish11 3860 1.49 2.42 1.21 131 XM_UB999 3732 0.56 2.34 0.01 132 XM_UB60 3694 0.62 2.32 0.09 133 XM_OfRef6 3681 1.47 2.31 1.21 134 TR_XM_RelayPhish 3574 1.40 2.24 1.14 135 LongTLD 3515 0.65 2.20 0.16 136 NO_FM_NAME_IP_HOSTN 3496 0.52 2.19 0.00 137 XMSubMetaI_00 3444 1.03 2.16 0.68 138 XM_B_Unsub2 3319 2.81 2.08 3.04 139 BAYES_05 3319 2.66 2.08 2.83 140 HTML_IMAGE_RATIO_08 3278 2.40 2.06 2.51 141 T_TooManySym_01 3267 4.17 2.05 4.83 142 TR_XM_DK_SendGrid 3228 2.99 2.02 3.29 143 T_FILL_THIS_FORM_SHORT 3209 1.27 2.01 1.05 144 SUBJ_BUY 3203 0.52 2.01 0.06 145 PDS_FROM_2_EMAILS 3180 0.50 1.99 0.04 146 UNPARSEABLE_RELAY 3161 2.09 1.98 2.12 147 XMObfuSubjects 3127 0.48 1.96 0.02 148 FROM_2_EMAILS_SHORT 3109 0.46 1.95 0.00 149 DATE_IN_PAST_03_06 3078 0.55 1.93 0.12 150 XM_UB80 2974 0.46 1.87 0.02 151 URI_HEX 2949 1.49 1.85 1.38 152 PDS_TO_EQ_FROM_NAME 2932 0.44 1.84 0.01 153 TVD_SPACE_RATIO_MINFP 2924 0.45 1.83 0.02 154 XMDiploma_00 2924 1.83 1.83 1.83 155 TR_MetaPhish_Combo_01 2914 1.14 1.83 0.93 156 RELAYCOUNTRY_DE 2889 0.74 1.81 0.41 157 MIMEOLE_DIRECT_TO_MX 2789 0.41 1.75 0.00 158 TR_XM_PHPDW 2782 1.32 1.75 1.18 159 XMSubMetaSxObfu_03 2692 0.83 1.69 0.56 160 TR_XM_PHPForged 2678 1.28 1.68 1.15 161 TR_XM_FormFill2 2662 1.27 1.67 1.15 162 XMSubMetaD_01 2661 0.40 1.67 0.01 163 XM_H_PHPOS 2660 1.27 1.67 1.14 164 HK_RANDOM_REPLYTO 2640 0.60 1.66 0.28 165 TR_Symld_Words 2636 1.50 1.65 1.45 166 XMSexyCombo_04 2603 0.45 1.63 0.09 167 CHARSET_FARAWAY_HEADER 2567 0.42 1.61 0.06 168 TR_Mismatch_TLD_02 2541 0.42 1.59 0.06 169 DKIM_ADSP_CUSTOM_MED 2502 1.17 1.57 1.05 170 RELAYCOUNTRY_IN 2490 0.45 1.56 0.11 171 HDR_ORDER_FTSDMCXX_DIRECT 2467 0.37 1.55 0.00 172 RCVD_IN_IADB_LISTED 2434 4.56 1.53 5.50 173 XMBody_17 2389 0.92 1.50 0.75 174 NML_ADSP_CUSTOM_MED 2344 0.91 1.47 0.74 175 XMGenDplmaNmb 2333 1.41 1.46 1.40 176 MIME_CHARSET_FARAWAY 2307 0.42 1.45 0.10 177 URIBL_RHS_DOB 2292 0.35 1.44 0.02 178 RCVD_IN_IADB_SPF 2278 3.94 1.43 4.72 179 T_XMDrugObfuBody_09 2260 0.35 1.42 0.02 180 FVGT_m_MULTI_ODD_EMAIL 2258 0.35 1.42 0.02 181 SERGIO_SUBJECT_PORN014 2236 0.33 1.40 0.00 182 XMSpoofStaff2 2233 0.35 1.40 0.03 183 RCVD_IN_IADB_SENDERID 2215 3.48 1.39 4.12 184 RCVD_IN_IADB_DK 2212 3.43 1.39 4.06 185 TM2_M_VERY_LONG_WORD 2184 1.23 1.37 1.19 186 RCVD_IN_SORBS_DUL 2175 0.63 1.36 0.40 187 DATE_IN_PAST_06_12 2147 0.37 1.35 0.07 188 FORGED_GMAIL_RCVD 2108 0.74 1.32 0.57 189 RCVD_IN_RP_SAFE 2097 7.12 1.32 8.91 190 TVD_SPACE_RATIO 2080 0.55 1.30 0.32 191 TR_XM_INV_DKIM 1988 0.36 1.25 0.09 192 RELAYCOUNTRY_RU 1935 0.30 1.21 0.02 193 CK_HELO_DYNAMIC_SPLIT_IP 1923 1.33 1.21 1.37 194 SUBJ_ALL_CAPS 1923 1.39 1.21 1.44 195 TR_LOTS_OF_MONEY2 1900 0.63 1.19 0.46 196 T_MONEY_PERCENT 1900 0.63 1.19 0.46 197 RELAYCOUNTRY_VN 1864 0.28 1.17 0.01 198 XMStockSpam_06 1833 0.96 1.15 0.90 199 XM_H_SpoofStaff4 1831 0.40 1.15 0.17 200 FUZZY_PHARMACY 1804 0.27 1.13 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 459930 89.24 89.98 89.01 2 DKIM_SIGNED 385461 69.77 54.13 74.60 3 XM_DK_Pass 378949 68.27 51.82 73.34 4 DKIM_VALID 360175 64.71 48.51 69.71 5 XM_B_Unicode 354215 66.50 59.83 68.55 6 DCC_CHECK_NEGATIVE 300000 50.24 24.88 58.06 7 BAYES_50 280375 52.48 46.69 54.26 8 DKIM_VALID_AU 269599 48.43 36.29 52.18 9 XMListUnsubscribeExists 259521 48.75 43.97 50.23 10 DCC_CHECK 204377 47.46 73.07 39.55 11 XM_B_Unicode3 201164 38.85 38.58 38.93 12 T_TM2_M_HEADER_IN_MSG 157165 27.24 16.94 30.42 13 DKIM_VALID_EF 140871 24.97 17.55 27.26 14 HTML_FONT_LOW_CONTRAST 136588 27.71 31.84 26.43 15 LOC_TINY_FONT_1 114625 22.17 22.13 22.18 16 XMSubLong 113022 21.89 21.96 21.87 17 MIME_HTML_ONLY 107583 26.85 46.40 20.82 18 FVGT_m_MULTI_ODD 106524 20.25 19.05 20.62 19 BAYES_00 103160 15.95 2.94 19.96 20 MultiRelay 98958 19.06 18.75 19.15 21 T_KAM_HTML_FONT_INVALID 92836 17.17 14.60 17.97 22 ALL_TRUSTED 74143 12.47 6.39 14.35 23 TR_XM_DK_Bayes 72963 11.03 1.01 14.12 24 TR_XM_DK_Bayes1 69866 10.54 0.88 13.52 25 XM_Body_Dirty_Words 65213 14.49 20.55 12.62 26 TR_XM_DK_Bayes2 62064 9.30 0.53 12.01 27 XM_Multi_Part_URI 58308 12.68 17.19 11.28 28 XM_B_Unsub 54834 11.95 16.29 10.61 29 RCVD_IN_MSPIKE_WL 53065 8.59 3.15 10.27 30 RCVD_IN_MSPIKE_H3 53021 8.59 3.15 10.26 31 RCVD_IN_MSPIKE_H2 48057 8.17 4.51 9.30 32 XM_Evil_Numbers_Gen 46383 8.81 8.28 8.98 33 TooManyTo_001 46248 8.14 5.50 8.95 34 RCVD_IN_RP_SAFE 46037 7.12 1.32 8.91 35 T_XMDrugObfuBody_14 43254 8.27 7.93 8.37 36 LOTS_OF_MONEY 43210 8.85 10.44 8.36 37 RCVD_IN_RP_CERTIFIED 41177 6.32 0.97 7.97 38 LotsOfNums_01 40719 7.30 5.42 7.88 39 HTML_IMAGE_RATIO_02 37809 7.55 8.32 7.32 40 XM_DKIMWhitelistDomains 35965 5.32 0.01 6.96 41 BAYES_40 32782 6.59 7.39 6.34 42 XM_SendGrid 32385 5.68 3.79 6.27 43 XM_B_Phish_Phrases 31934 7.36 11.19 6.18 44 MIME_QP_LONG_LINE 31918 5.54 3.46 6.18 45 XM_H_Long_From01 31856 6.20 6.33 6.17 46 FSL_BULK_SIG 31456 11.70 29.90 6.09 47 RELAYCOUNTRY_META 29924 11.53 30.12 5.79 48 HTML_IMAGE_RATIO_04 29734 5.40 4.25 5.75 49 XM_DK_Undo_02 29631 9.99 23.80 5.73 50 RCVD_IN_IADB_LISTED 28412 4.56 1.53 5.50 51 T_REMOTE_IMAGE 25739 6.99 13.51 4.98 52 BAYES_20 25290 4.54 3.38 4.89 53 DKIM_INVALID 25286 5.07 5.62 4.89 54 T_TooManySym_01 24938 4.17 2.05 4.83 55 MPART_ALT_DIFF 24425 4.94 5.64 4.73 56 RCVD_IN_IADB_SPF 24393 3.94 1.43 4.72 57 XM_PDF 24138 3.72 0.65 4.67 58 BAYES_60 23750 5.32 7.67 4.60 59 XMStrtUSub 23626 4.54 4.42 4.57 60 HTML_IMAGE_RATIO_06 23318 4.25 3.39 4.51 61 BOTNET_IPINHOSTNAME 21792 8.10 20.69 4.22 62 RCVD_IN_IADB_SENDERID 21287 3.48 1.39 4.12 63 XM_UncommonTLD01 21055 9.56 27.32 4.07 64 RCVD_IN_IADB_DK 20955 3.43 1.39 4.06 65 XMSubMetaSx_00 19252 5.05 9.33 3.73 66 IN_ZIMBRA_NJ_WHITELIST 18941 2.82 0.08 3.67 67 XMNumbers 18661 4.58 7.70 3.61 68 RCVD_IN_IADB_VOUCHED 18229 2.80 0.45 3.53 69 XMSexyCombo_05 17945 6.23 15.16 3.47 70 TR_XM_DK_SendGrid 16998 2.99 2.02 3.29 71 HTML_MIME_NO_HTML_TAG 15914 4.86 10.65 3.08 72 XM_B_Unsub2 15709 2.81 2.08 3.04 73 BAYES_99 15669 6.84 19.16 3.03 74 MIME_HTML_ONLY_MULTI 15550 2.90 2.53 3.01 75 FROM_EXCESS_BASE64 14644 4.67 10.61 2.83 76 BAYES_05 14635 2.66 2.08 2.83 77 XM_H_Trusted_IP 13650 2.02 0.00 2.64 78 MIME_HTML_MOSTLY 13359 3.03 4.47 2.59 79 HTML_IMAGE_RATIO_08 12952 2.40 2.06 2.51 80 KHOP_HELO_FCRDNS 12859 5.02 13.24 2.49 81 XM_DIRTYINTL 12623 4.08 9.40 2.44 82 MAILING_LIST_MULTI 12515 2.11 1.08 2.42 83 BAYES_999 12466 5.24 14.39 2.41 84 BAYES_80 12424 3.47 6.94 2.40 85 XM_SPF_SoftFail 12284 3.87 8.69 2.38 86 TooManyTo_002 11991 2.02 1.05 2.32 87 T_TooManySym_02 11838 1.88 0.55 2.29 88 RCVD_IN_IADB_OPTIN 11569 1.79 0.33 2.24 89 XM_B_SpammyTLD 11515 2.83 4.77 2.23 90 XM_CamelCaseFrm001 11449 2.55 3.65 2.22 91 TVD_RCVD_IP 11327 1.88 0.88 2.19 92 UNPARSEABLE_RELAY 10965 2.09 1.98 2.12 93 NO_DNS_FOR_FROM 10755 2.50 3.85 2.08 94 TM2_M_URI_OPT_OUT 9968 3.43 8.31 1.93 95 XMDiploma_00 9470 1.83 1.83 1.83 96 BOTNET 9132 7.74 27.10 1.77 97 HELO_NODOT 8621 1.43 0.65 1.67 98 HELO_NO_DOMAIN 8616 1.42 0.61 1.67 99 UNTRUSTED_Relay 8523 6.24 21.10 1.65 100 RELAYCOUNTRY_CA 8379 2.11 3.68 1.62 101 XM_DK_Undo_01 8125 1.46 1.09 1.57 102 ANY_BOUNCE_MESSAGE 7902 1.28 0.45 1.53 103 BOUNCE_MESSAGE 7901 1.28 0.45 1.53 104 T_XMDrugObfuBody_08 7866 2.28 4.72 1.52 105 TooManyTo_003 7749 1.33 0.79 1.50 106 IN_HORDE_ADDRESS_BOOK 7716 1.22 0.33 1.49 107 INVALID_MSGID 7587 1.34 0.91 1.47 108 TR_Symld_Words 7481 1.50 1.65 1.45 109 SUBJ_ALL_CAPS 7462 1.39 1.21 1.44 110 BAYES_95 7308 1.91 3.51 1.41 111 XMCapTrack 7211 1.14 0.31 1.40 112 XMGenDplmaNmb 7211 1.41 1.46 1.40 113 URI_HEX 7143 1.49 1.85 1.38 114 CK_HELO_DYNAMIC_SPLIT_IP 7066 1.33 1.21 1.37 115 HELO_DYNAMIC_IPADDR2 7062 1.19 0.62 1.37 116 DKIM_ADSP_NXDOMAIN 6956 3.33 9.77 1.35 117 TO_MALFORMED 6590 2.31 5.66 1.28 118 TR_DCC_Bayes_99 6567 4.12 13.37 1.27 119 XMSubNoVowel 6490 1.15 0.79 1.26 120 XM_OfRef6 6264 1.47 2.31 1.21 121 XMPhish11 6234 1.49 2.42 1.21 122 RELAYCOUNTRY_GB 6188 1.62 3.00 1.20 123 XMHTML_After_End 6154 2.67 7.45 1.19 124 TM2_M_VERY_LONG_WORD 6154 1.23 1.37 1.19 125 TR_XM_PHPDW 6122 1.32 1.75 1.18 126 XMGappySubj_01 6063 0.98 0.35 1.17 127 XM_GoogleGroups 6017 0.97 0.33 1.16 128 TR_XM_PHPForged 5950 1.28 1.68 1.15 129 TR_XM_FormFill2 5943 1.27 1.67 1.15 130 XM_H_PHPOS 5913 1.27 1.67 1.14 131 TR_XM_RelayPhish 5869 1.40 2.24 1.14 132 XM_H_Long_From02 5635 1.06 0.97 1.09 133 TooManyTo_004 5492 0.96 0.62 1.06 134 DKIM_ADSP_CUSTOM_MED 5429 1.17 1.57 1.05 135 T_FILL_THIS_FORM_SHORT 5401 1.27 2.01 1.05 136 URI_TRY_3LD 5353 1.02 0.95 1.04 137 AC_FROM_MANY_DOTS 5318 0.79 0.03 1.03 138 RCVD_IN_MSPIKE_BL 5282 2.52 7.39 1.02 139 RCVD_IN_BL_SPAMCOP_NET 5197 3.95 13.51 1.01 140 USER_IN_DEF_DKIM_WL 5076 0.75 0.00 0.98 141 TR_MetaPhish_Combo_01 4813 1.14 1.83 0.93 142 XMStockSpam_06 4647 0.96 1.15 0.90 143 HTML_FONT_FACE_BAD 4557 0.83 0.64 0.88 144 TooManyTo_005 4550 0.78 0.47 0.88 145 XMBdyGiftCard01 4469 0.88 0.92 0.86 146 T_XMDrugObfuBody_00 4348 1.40 3.20 0.84 147 XM_UB50 4286 2.83 9.30 0.83 148 XM_SPF_Unknown 4011 1.42 3.49 0.78 149 XMBody_95 4000 0.61 0.07 0.77 150 T_OBFU_PDF_ATTACH 3990 0.63 0.18 0.77 151 SpammyFromTLD_01 3925 1.89 5.55 0.76 152 XMBody_17 3852 0.92 1.50 0.75 153 TO_NO_BRKTS_HTML_ONLY 3811 0.61 0.21 0.74 154 NML_ADSP_CUSTOM_MED 3799 0.91 1.47 0.74 155 T_XMHurry_00 3631 0.78 1.05 0.70 156 XMSexyCombo_01 3538 1.21 2.93 0.68 157 XMSubMetaI_00 3515 1.03 2.16 0.68 158 T_Symld_Words_02 3473 0.69 0.75 0.67 159 XMNoVowels 3407 0.63 0.55 0.66 160 XM_ProductURIs 3365 0.67 0.74 0.65 161 XMHTMLBadTable_001 3190 0.66 0.79 0.62 162 PLING_QUERY 3144 0.68 0.93 0.61 163 HTTPS_HTTP_MISMATCH 3011 0.54 0.41 0.58 164 HTML_IMAGE_ONLY_20 3007 0.50 0.26 0.58 165 XM_shorewaves_Whitelist 2972 0.44 0.00 0.58 166 FORGED_GMAIL_RCVD 2920 0.74 1.32 0.57 167 XMSubMetaSxObfu_03 2902 0.83 1.69 0.56 168 XM_B_REG_HTML 2876 0.46 0.16 0.56 169 MPART_ALT_DIFF_COUNT 2868 0.57 0.63 0.56 170 XMBody_78 2868 0.60 0.76 0.56 171 XM_ShortIntro_01 2855 0.49 0.30 0.55 172 XMMoneyMeta_00 2804 1.13 3.03 0.54 173 FROM_GOV_DKIM_AU 2789 0.46 0.21 0.54 174 XMBrknScrpt_02 2703 0.54 0.60 0.52 175 XM_H_PHPMailer 2652 1.90 6.38 0.51 176 T_TooManySym_03 2562 0.41 0.14 0.50 177 XMLngstWrd_00 2478 0.45 0.37 0.48 178 XMPhish30 2475 0.55 0.77 0.48 179 XMDateMe_00 2456 0.47 0.44 0.48 180 MISSING_HEADERS 2454 0.99 2.65 0.47 181 USER_IN_WHITELIST 2451 0.36 0.00 0.47 182 DIET_1 2446 0.60 1.00 0.47 183 HTML_TAG_BALANCE_BODY 2441 0.51 0.64 0.47 184 TR_LOTS_OF_MONEY2 2364 0.63 1.19 0.46 185 T_MONEY_PERCENT 2364 0.63 1.19 0.46 186 RCVD_IN_MSPIKE_L4 2357 0.53 0.76 0.46 187 XMLngstWrd_01 2328 0.42 0.34 0.45 188 RELAYCOUNTRY_AU 2281 0.44 0.43 0.44 189 XM_Body_Obfu01 2258 0.41 0.33 0.44 190 HTML_IMAGE_ONLY_32 2240 0.38 0.21 0.43 191 SHORT_HELO_AND_INLINE_IMAGE 2214 0.33 0.03 0.43 192 XMPhish14 2170 0.51 0.82 0.42 193 FROM_GOV_SPOOF 2151 0.37 0.22 0.42 194 RELAYCOUNTRY_DE 2137 0.74 1.81 0.41 195 RCVD_IN_SORBS_DUL 2084 0.63 1.36 0.40 196 HTML_IMAGE_ONLY_28 2081 0.42 0.47 0.40 197 TM2_M_BODY_EMPTY 1991 0.31 0.08 0.39 198 SpammyFromTLD_02 1887 4.09 16.17 0.37 199 URI_NOVOWEL 1881 0.46 0.76 0.36 200 RELAYCOUNTRY_NL 1832 0.42 0.61 0.35 ----------------------------------------------------------------------