Email: 371757 Autolearn: 0 AvgScore: 3.59 AvgScanTime: 2.82 sec Spam: 102002 Autolearn: 0 AvgScore: 17.08 AvgScanTime: 3.33 sec Ham: 269755 Autolearn: 0 AvgScore: -1.51 AvgScanTime: 2.62 sec Time Spent Running SA: 290.84 hours Time Spent Processing Spam: 94.45 hours Time Spent Processing Ham: 196.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 91929 87.73 90.12 86.83 2 DCC_CHECK 75378 57.88 73.90 51.83 3 XM_B_Unicode 61151 70.40 59.95 74.36 4 DKIM_SIGNED 53559 73.60 52.51 81.57 5 XM_DK_Pass 52067 72.34 51.05 80.39 6 MIME_HTML_ONLY 50115 31.67 49.13 25.07 7 DKIM_VALID 48768 69.03 47.81 77.06 8 XMListUnsubscribeExists 44083 55.10 43.22 59.59 9 BAYES_50 40715 48.90 39.92 52.29 10 DKIM_VALID_AU 37692 56.83 36.95 64.34 11 XM_B_Unicode3 34814 44.64 34.13 48.61 12 FSL_BULK_SIG 33848 15.16 33.18 8.34 13 RELAYCOUNTRY_META 33154 12.52 32.50 4.96 14 XM_UncommonTLD01 31805 11.72 31.18 4.36 15 BOTNET 28729 9.42 28.17 2.33 16 XM_B_Unsub 26721 15.58 26.20 11.56 17 HTML_FONT_LOW_CONTRAST 25918 32.16 25.41 34.72 18 BAYES_99 25381 10.62 24.88 5.23 19 DCC_CHECK_NEGATIVE 24125 40.56 23.65 46.95 20 UNTRUSTED_Relay 23706 7.69 23.24 1.81 21 LOC_TINY_FONT_1 23626 28.79 23.16 30.92 22 XM_DK_Undo_02 23143 12.27 22.69 8.33 23 URIBL_RHS_DOB 22006 17.16 21.57 15.49 24 MultiRelay 21539 17.62 21.12 16.30 25 HTML_MIME_NO_HTML_TAG 21485 7.29 21.06 2.08 26 XMSubLong 21447 21.68 21.03 21.92 27 FVGT_m_MULTI_ODD 20409 21.71 20.01 22.35 28 HTML_IMAGE_RATIO_02 19882 13.55 19.49 11.31 29 BAYES_999 19720 8.45 19.33 4.34 30 BOTNET_IPINHOSTNAME 19181 9.55 18.80 6.04 31 XM_Body_Dirty_Words 18803 17.75 18.43 17.49 32 RCVD_IN_BL_SPAMCOP_NET 18307 5.60 17.95 0.93 33 RCVD_IN_RP_RNBL 17781 4.90 17.43 0.17 34 XMSexyCombo_05 17581 9.46 17.24 6.51 35 DKIM_VALID_EF 17208 24.52 16.87 27.41 36 RCVD_IN_MSPIKE_BL 16776 5.79 16.45 1.77 37 XM_H_Long_From01 16599 9.20 16.27 6.53 38 TR_DCC_Bayes_99 16203 6.51 15.88 2.97 39 KHOP_HELO_FCRDNS 15874 5.51 15.56 1.71 40 RDNS_DYNAMIC 15646 4.59 15.34 0.52 41 T_TM2_M_HEADER_IN_MSG 14732 20.94 14.44 23.40 42 XM_Multi_Part_URI 14461 14.44 14.18 14.54 43 SpammyFromTLD_02 13745 3.81 13.48 0.15 44 RCVD_IN_PSBL 13691 3.74 13.42 0.08 45 RCVD_IN_MSPIKE_L5 13111 3.64 12.85 0.16 46 T_KAM_HTML_FONT_INVALID 12413 15.21 12.17 16.36 47 XM_SPF_SoftFail 11095 3.96 10.88 1.34 48 FROM_EXCESS_BASE64 11053 6.29 10.84 4.57 49 XM_DIRTYINTL 10745 5.82 10.53 4.04 50 XMSubMetaSx_00 10720 5.97 10.51 4.26 51 HTML_SHORT_LINK_IMG_1 10638 2.90 10.43 0.05 52 BAYES_60 9748 6.46 9.56 5.29 53 BAYES_80 9728 4.62 9.54 2.77 54 LOTS_OF_MONEY 9640 9.54 9.45 9.58 55 TR_Mismatch_TLD_02 9133 2.51 8.95 0.08 56 XM_UB50 9105 3.12 8.93 0.93 57 BOTNET_NORDNS 8913 2.42 8.74 0.03 58 XM_CamelCaseFrm001 8558 4.06 8.39 2.42 59 T_REMOTE_IMAGE 8343 4.48 8.18 3.08 60 XM_Evil_Numbers_Gen 7528 10.86 7.38 12.18 61 FROM_SUSPICIOUS_NTLD 7507 2.04 7.36 0.03 62 FROM_SUSPICIOUS_NTLD_FP 7473 2.03 7.33 0.03 63 RCVD_IN_MSPIKE_H2 7353 10.77 7.21 12.12 64 DRUGS_ERECTILE 6947 1.89 6.81 0.02 65 XM_UB99 6749 1.82 6.62 0.01 66 XMSubMetaD_00 6673 1.85 6.54 0.08 67 XM_B_SpammyTLD 6204 3.16 6.08 2.06 68 DKIM_ADSP_NXDOMAIN 5860 2.34 5.74 1.05 69 XMNumbers 5709 4.90 5.60 4.64 70 XM_B_Phish_Phrases 5707 7.55 5.59 8.29 71 XM_UB999 5616 1.52 5.51 0.01 72 TooManyTo_001 5601 6.08 5.49 6.30 73 BODY_URI_ONLY 5508 1.50 5.40 0.03 74 MPART_ALT_DIFF 5503 4.81 5.39 4.58 75 LotsOfNums_01 5494 7.10 5.39 7.75 76 BAYES_95 5403 2.76 5.30 1.80 77 XMBdyGiftCard01 5248 3.66 5.14 3.10 78 SpammyFromTLD_01 5142 1.63 5.04 0.33 79 XM_SendGrid 5006 6.20 4.91 6.68 80 HTML_IMAGE_ONLY_12 4876 1.40 4.78 0.12 81 DKIM_INVALID 4791 4.57 4.70 4.52 82 HTML_TAG_BALANCE_CENTER 4576 1.27 4.49 0.05 83 HTML_IMAGE_RATIO_04 4548 7.21 4.46 8.25 84 XMSubGiftCard1 4455 1.30 4.37 0.14 85 XMSubGiftCard2 4417 1.21 4.33 0.03 86 BODY_SINGLE_WORD 4380 1.19 4.29 0.01 87 BODY_SINGLE_URI 4279 1.16 4.20 0.01 88 HDRS_MISSP 4235 1.15 4.15 0.01 89 TO_MALFORMED 4218 2.91 4.14 2.44 90 FROM_NTLD_LINKBAIT 4212 1.13 4.13 0.00 91 HTML_IMAGE_ONLY_04 4212 1.16 4.13 0.03 92 HTML_SHORT_CENTER 4166 1.12 4.08 0.00 93 SHORT_IMG_SUSP_NTLD 4166 1.12 4.08 0.00 94 UNPARSEABLE_RELAY 4120 3.99 4.04 3.97 95 RELAYCOUNTRY_CA 4013 2.56 3.93 2.05 96 T_XMDrugObfuBody_08 3993 1.89 3.91 1.12 97 RELAYCOUNTRY_FR 3926 1.23 3.85 0.24 98 MIME_HTML_MOSTLY 3817 4.21 3.74 4.38 99 NORDNS_LOW_CONTRAST 3689 1.00 3.62 0.01 100 BAYES_40 3559 4.43 3.49 4.78 101 MultiRelay_Combo 3489 1.04 3.42 0.15 102 MultiRelay_CC 3489 1.04 3.42 0.15 103 RELAYCOUNTRY_CN 3287 0.92 3.22 0.05 104 REPLYTO_WITHOUT_TO_CC 3281 0.90 3.22 0.03 105 XMStrtUSub 3220 4.85 3.16 5.49 106 XMGppyBdWords 3216 1.11 3.15 0.34 107 NO_FM_NAME_IP_HOSTN 3208 0.87 3.15 0.00 108 NO_DNS_FOR_FROM 3141 2.26 3.08 1.95 109 HTML_IMAGE_ONLY_08 3098 0.91 3.04 0.11 110 PDS_OTHER_BAD_TLD 3066 1.22 3.01 0.54 111 BAYES_20 3036 3.71 2.98 3.99 112 XMSubMetaSSx_00 3015 0.98 2.96 0.23 113 MIME_BASE64_TEXT 2925 0.84 2.87 0.07 114 T_XMDrugObfuBody_00 2920 1.56 2.86 1.07 115 HDRS_LCASE_IMGONLY 2869 0.78 2.81 0.02 116 MIME_HEADER_CTYPE_ONLY 2862 0.83 2.81 0.08 117 XM_UB60 2826 0.81 2.77 0.06 118 TO_EQ_FM_DOM_HTML_IMG 2742 0.74 2.69 0.00 119 CHARSET_FARAWAY_HEADER 2667 0.75 2.61 0.05 120 TR_XM_DK_SendGrid 2665 3.47 2.61 3.79 121 MALF_HTML_B64 2580 0.70 2.53 0.00 122 RELAYCOUNTRY_RU 2552 0.70 2.50 0.01 123 MIME_HTML_ONLY_MULTI 2523 2.59 2.47 2.64 124 MIME_CHARSET_FARAWAY 2510 0.79 2.46 0.16 125 SUBJECT_DRUG_GAP_C 2444 0.66 2.40 0.00 126 HTML_IMAGE_RATIO_06 2424 2.97 2.38 3.19 127 RELAYCOUNTRY_DE 2407 0.97 2.36 0.44 128 TVD_RCVD_SPACE_BRACKET 2384 0.64 2.34 0.00 129 SUBJ_BUY 2348 0.76 2.30 0.18 130 T_TooManySym_01 2331 5.92 2.29 7.29 131 MIME_QP_LONG_LINE 2300 3.36 2.25 3.78 132 SUBJ_ALL_CAPS 2296 2.02 2.25 1.93 133 CK_HELO_DYNAMIC_SPLIT_IP 2277 2.33 2.23 2.37 134 SERGIO_SUBJECT_PORN014 2242 0.61 2.20 0.01 135 BAYES_00 2242 15.85 2.20 21.02 136 TR_XM_RelayPhish 2194 1.18 2.15 0.81 137 TM2_M_URI_OPT_OUT 2170 2.14 2.13 2.14 138 RCVD_IN_MSPIKE_WL 2168 8.71 2.13 11.20 139 RCVD_IN_MSPIKE_H3 2168 8.71 2.13 11.20 140 KB_FORGED_MOZ4 2116 0.57 2.07 0.00 141 PDS_FROM_2_EMAILS 2115 0.57 2.07 0.01 142 FROM_2_EMAILS_SHORT 2109 0.57 2.07 0.00 143 XMObfuSubjects 2073 0.56 2.03 0.01 144 TR_XM_PHPDW 2058 1.10 2.02 0.75 145 DATE_IN_PAST_03_06 2029 0.62 1.99 0.11 146 URI_HEX 2020 1.33 1.98 1.09 147 PDS_TO_EQ_FROM_NAME 2012 0.55 1.97 0.01 148 RCVD_IN_MSPIKE_L4 2010 0.68 1.97 0.19 149 ALL_TRUSTED 2001 9.62 1.96 12.52 150 SERGIO_SUBJECT_VIAGRA01 1992 0.54 1.95 0.00 151 TR_XM_PHPForged 1976 1.04 1.94 0.70 152 TR_XM_FormFill2 1961 0.86 1.92 0.46 153 XM_H_PHPOS 1951 0.85 1.91 0.45 154 XMSubMetaD_01 1948 0.55 1.91 0.04 155 XM_OfRef6 1937 2.22 1.90 2.34 156 XM_UB80 1908 0.53 1.87 0.02 157 HK_RANDOM_FROM 1908 0.61 1.87 0.13 158 TM2_M_VERY_LONG_WORD 1901 1.71 1.86 1.65 159 RELAYCOUNTRY_GB 1879 0.84 1.84 0.47 160 XMSexyCombo_01 1870 1.34 1.83 1.16 161 XMSubMetaI_00 1867 1.44 1.83 1.30 162 XM_URI_RBL 1823 0.78 1.79 0.40 163 HTML_IMAGE_RATIO_08 1816 2.67 1.78 3.00 164 TR_Symld_Words 1795 1.88 1.76 1.92 165 SUBJECT_DRUG_GAP_L 1787 0.48 1.75 0.00 166 BAYES_05 1757 2.20 1.72 2.38 167 CK_HELO_GENERIC 1748 0.48 1.71 0.01 168 CHARSET_FARAWAY 1711 0.46 1.68 0.00 169 RELAYCOUNTRY_BR 1708 0.46 1.67 0.01 170 TR_Mismatch_TLD_01 1700 0.60 1.67 0.20 171 XM_H_PHPMailer 1681 1.17 1.65 0.99 172 RCVD_IN_MSPIKE_L3 1656 1.47 1.62 1.41 173 TVD_SPACE_ENCODED 1623 0.44 1.59 0.00 174 HELO_MISC_IP 1608 0.43 1.58 0.00 175 URIBL_DBL_ABUSE_REDIR 1590 0.44 1.56 0.02 176 INVALID_MSGID 1584 2.37 1.55 2.68 177 XMBody_17 1565 1.22 1.53 1.10 178 XMStockSpam_06 1562 1.98 1.53 2.14 179 XMDiploma_00 1550 1.46 1.52 1.43 180 DKIM_ADSP_CUSTOM_MED 1493 1.18 1.46 1.07 181 DIET_1 1475 1.13 1.45 1.01 182 RCVD_IN_RP_SAFE 1448 10.35 1.42 13.72 183 HTML_SHORT_LINK_IMG_2 1432 0.41 1.40 0.03 184 XMSubNoVowel 1427 0.92 1.40 0.74 185 T_XMDrugObfuBody_14 1423 1.49 1.40 1.53 186 NML_ADSP_CUSTOM_MED 1416 0.98 1.39 0.83 187 DRUGS_ERECTILE_OBFU 1407 0.38 1.38 0.00 188 XM_B_Unsub2 1400 1.03 1.37 0.90 189 T_Symld_Words_02 1399 0.99 1.37 0.85 190 TVD_SPACE_RATIO_MINFP 1381 0.37 1.35 0.00 191 RELAYCOUNTRY_LT 1371 0.41 1.34 0.05 192 XM_H_PHPOS_M 1358 0.50 1.33 0.18 193 MSGID_SHORT 1339 0.36 1.31 0.00 194 RELAYCOUNTRY_UA 1300 0.35 1.27 0.00 195 TVD_RCVD_IP 1299 2.55 1.27 3.03 196 T_XMDrugObfuBody_09 1265 0.35 1.24 0.02 197 HTML_FONT_SIZE_HUGE 1256 0.41 1.23 0.09 198 RCVD_IN_SORBS_DUL 1238 0.44 1.21 0.15 199 FUZZY_PHARMACY 1233 0.34 1.21 0.01 200 URI_TRY_3LD 1229 1.22 1.20 1.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 234219 87.73 90.12 86.83 2 DKIM_SIGNED 220045 73.60 52.51 81.57 3 XM_DK_Pass 216853 72.34 51.05 80.39 4 DKIM_VALID 207861 69.03 47.81 77.06 5 XM_B_Unicode 200581 70.40 59.95 74.36 6 DKIM_VALID_AU 173562 56.83 36.95 64.34 7 XMListUnsubscribeExists 160750 55.10 43.22 59.59 8 BAYES_50 141065 48.90 39.92 52.29 9 DCC_CHECK 139812 57.88 73.90 51.83 10 XM_B_Unicode3 131120 44.64 34.13 48.61 11 DCC_CHECK_NEGATIVE 126648 40.56 23.65 46.95 12 HTML_FONT_LOW_CONTRAST 93657 32.16 25.41 34.72 13 LOC_TINY_FONT_1 83415 28.79 23.16 30.92 14 DKIM_VALID_EF 73950 24.52 16.87 27.41 15 MIME_HTML_ONLY 67615 31.67 49.13 25.07 16 T_TM2_M_HEADER_IN_MSG 63121 20.94 14.44 23.40 17 FVGT_m_MULTI_ODD 60299 21.71 20.01 22.35 18 XMSubLong 59143 21.68 21.03 21.92 19 BAYES_00 56691 15.85 2.20 21.02 20 TR_XM_DK_Bayes 47518 13.11 1.20 17.62 21 XM_Body_Dirty_Words 47185 17.75 18.43 17.49 22 TR_XM_DK_Bayes1 45813 12.61 1.05 16.98 23 T_KAM_HTML_FONT_INVALID 44122 15.21 12.17 16.36 24 MultiRelay 43970 17.62 21.12 16.30 25 TR_XM_DK_Bayes2 43369 11.92 0.91 16.08 26 URIBL_RHS_DOB 41794 17.16 21.57 15.49 27 XM_Multi_Part_URI 39219 14.44 14.18 14.54 28 RCVD_IN_RP_SAFE 37020 10.35 1.42 13.72 29 RCVD_IN_RP_CERTIFIED 34227 9.46 0.91 12.69 30 ALL_TRUSTED 33767 9.62 1.96 12.52 31 XM_Evil_Numbers_Gen 32845 10.86 7.38 12.18 32 RCVD_IN_MSPIKE_H2 32686 10.77 7.21 12.12 33 XM_DKIMWhitelistDomains 31472 8.55 0.29 11.67 34 XM_B_Unsub 31181 15.58 26.20 11.56 35 HTML_IMAGE_RATIO_02 30498 13.55 19.49 11.31 36 RCVD_IN_MSPIKE_WL 30202 8.71 2.13 11.20 37 RCVD_IN_MSPIKE_H3 30200 8.71 2.13 11.20 38 LOTS_OF_MONEY 25843 9.54 9.45 9.58 39 FSL_BULK_SIG 22497 15.16 33.18 8.34 40 XM_DK_Undo_02 22480 12.27 22.69 8.33 41 XM_B_Phish_Phrases 22368 7.55 5.59 8.29 42 HTML_IMAGE_RATIO_04 22244 7.21 4.46 8.25 43 LotsOfNums_01 20906 7.10 5.39 7.75 44 T_TooManySym_01 19663 5.92 2.29 7.29 45 XM_SendGrid 18029 6.20 4.91 6.68 46 XM_H_Long_From01 17609 9.20 16.27 6.53 47 XMSexyCombo_05 17569 9.46 17.24 6.51 48 TooManyTo_001 16989 6.08 5.49 6.30 49 BOTNET_IPINHOSTNAME 16305 9.55 18.80 6.04 50 XMStrtUSub 14802 4.85 3.16 5.49 51 BAYES_60 14270 6.46 9.56 5.29 52 BAYES_99 14114 10.62 24.88 5.23 53 RELAYCOUNTRY_META 13387 12.52 32.50 4.96 54 BAYES_40 12892 4.43 3.49 4.78 55 XMNumbers 12516 4.90 5.60 4.64 56 MPART_ALT_DIFF 12361 4.81 5.39 4.58 57 FROM_EXCESS_BASE64 12337 6.29 10.84 4.57 58 DKIM_INVALID 12184 4.57 4.70 4.52 59 MIME_HTML_MOSTLY 11821 4.21 3.74 4.38 60 XM_UncommonTLD01 11772 11.72 31.18 4.36 61 BAYES_999 11704 8.45 19.33 4.34 62 XMSubMetaSx_00 11485 5.97 10.51 4.26 63 XM_DIRTYINTL 10898 5.82 10.53 4.04 64 BAYES_20 10764 3.71 2.98 3.99 65 UNPARSEABLE_RELAY 10708 3.99 4.04 3.97 66 T_TooManySym_02 10305 2.97 0.71 3.82 67 TR_XM_DK_SendGrid 10219 3.47 2.61 3.79 68 MIME_QP_LONG_LINE 10193 3.36 2.25 3.78 69 RCVD_IN_IADB_LISTED 8633 2.62 1.09 3.20 70 HTML_IMAGE_RATIO_06 8617 2.97 2.38 3.19 71 IN_ZIMBRA_NJ_WHITELIST 8581 2.33 0.06 3.18 72 XMBdyGiftCard01 8363 3.66 5.14 3.10 73 T_REMOTE_IMAGE 8319 4.48 8.18 3.08 74 TVD_RCVD_IP 8170 2.55 1.27 3.03 75 HTML_IMAGE_RATIO_08 8098 2.67 1.78 3.00 76 TR_DCC_Bayes_99 8002 6.51 15.88 2.97 77 BAYES_80 7465 4.62 9.54 2.77 78 RCVD_IN_IADB_SPF 7430 2.28 1.02 2.75 79 INVALID_MSGID 7225 2.37 1.55 2.68 80 MIME_HTML_ONLY_MULTI 7113 2.59 2.47 2.64 81 TO_MALFORMED 6589 2.91 4.14 2.44 82 RCVD_IN_IADB_SENDERID 6568 2.04 1.00 2.43 83 XM_CamelCaseFrm001 6535 4.06 8.39 2.42 84 BAYES_05 6410 2.20 1.72 2.38 85 RCVD_IN_IADB_DK 6407 2.00 1.01 2.38 86 CK_HELO_DYNAMIC_SPLIT_IP 6383 2.33 2.23 2.37 87 HELO_DYNAMIC_IPADDR2 6380 2.01 1.08 2.37 88 XM_OfRef6 6299 2.22 1.90 2.34 89 BOTNET 6281 9.42 28.17 2.33 90 XM_PDF 6236 1.75 0.28 2.31 91 XMStockSpam_06 5784 1.98 1.53 2.14 92 TM2_M_URI_OPT_OUT 5774 2.14 2.13 2.14 93 HTML_MIME_NO_HTML_TAG 5614 7.29 21.06 2.08 94 XM_B_SpammyTLD 5560 3.16 6.08 2.06 95 ANY_BOUNCE_MESSAGE 5526 1.69 0.75 2.05 96 BOUNCE_MESSAGE 5523 1.69 0.75 2.05 97 RELAYCOUNTRY_CA 5517 2.56 3.93 2.05 98 RCVD_IN_IADB_VOUCHED 5374 1.51 0.24 1.99 99 NO_DNS_FOR_FROM 5265 2.26 3.08 1.95 100 SUBJ_ALL_CAPS 5198 2.02 2.25 1.93 101 TR_Symld_Words 5179 1.88 1.76 1.92 102 USER_IN_DEF_DKIM_WL 4905 1.32 0.01 1.82 103 UNTRUSTED_Relay 4870 7.69 23.24 1.81 104 BAYES_95 4853 2.76 5.30 1.80 105 RCVD_IN_MSPIKE_BL 4762 5.79 16.45 1.77 106 XM_H_Trusted_IP 4727 1.27 0.00 1.75 107 KHOP_HELO_FCRDNS 4607 5.51 15.56 1.71 108 IN_HORDE_ADDRESS_BOOK 4514 1.32 0.38 1.67 109 TM2_M_VERY_LONG_WORD 4461 1.71 1.86 1.65 110 MAILING_LIST_MULTI 4304 1.41 0.91 1.60 111 T_XMDrugObfuBody_14 4129 1.49 1.40 1.53 112 XMDiploma_00 3866 1.46 1.52 1.43 113 RCVD_IN_MSPIKE_L3 3816 1.47 1.62 1.41 114 TooManyTo_002 3727 1.26 0.95 1.38 115 XM_SPF_SoftFail 3620 3.96 10.88 1.34 116 XM_DK_Undo_01 3611 1.15 0.66 1.34 117 XMSubMetaI_00 3501 1.44 1.83 1.30 118 XMPhish11 3501 1.26 1.15 1.30 119 RCVD_IN_IADB_OPTIN 3423 1.00 0.28 1.27 120 XMGappySubj_01 3396 1.02 0.40 1.26 121 XM_H_Long_From02 3393 1.17 0.92 1.26 122 URI_TRY_3LD 3321 1.22 1.20 1.23 123 XM_ProductURIs 3314 1.12 0.82 1.23 124 T_MONEY_PERCENT 3228 1.11 0.89 1.20 125 TR_LOTS_OF_MONEY2 3228 1.11 0.89 1.20 126 XM_RXBody 3178 0.95 0.34 1.18 127 XMSexyCombo_01 3127 1.34 1.83 1.16 128 T_XMDrugObfuBody_08 3034 1.89 3.91 1.12 129 XMBody_17 2974 1.22 1.53 1.10 130 URI_HEX 2940 1.33 1.98 1.09 131 XM_B_REG_HTML 2932 0.88 0.34 1.09 132 THIS_AD 2897 1.04 0.94 1.07 133 XM_GoogleGroups 2896 0.85 0.27 1.07 134 DKIM_ADSP_CUSTOM_MED 2886 1.18 1.46 1.07 135 T_XMDrugObfuBody_00 2882 1.56 2.86 1.07 136 DKIM_ADSP_NXDOMAIN 2822 2.34 5.74 1.05 137 TooManyTo_003 2783 0.94 0.71 1.03 138 DIET_1 2737 1.13 1.45 1.01 139 XMBrknScrpt_02 2733 0.87 0.50 1.01 140 XM_H_PHPMailer 2668 1.17 1.65 0.99 141 XMBody_95 2667 0.82 0.36 0.99 142 HTML_FONT_FACE_BAD 2633 0.86 0.56 0.98 143 RCVD_IN_BL_SPAMCOP_NET 2520 5.60 17.95 0.93 144 XM_UB50 2512 3.12 8.93 0.93 145 XM_B_Unsub2 2427 1.03 1.37 0.90 146 FILL_THIS_FORM 2421 0.75 0.36 0.90 147 T_FILL_THIS_FORM_SHORT 2414 0.86 0.76 0.89 148 TooManyTo_004 2348 0.79 0.57 0.87 149 T_Symld_Words_02 2290 0.99 1.37 0.85 150 XMSexyCombo_04 2273 0.89 1.02 0.84 151 NML_ADSP_CUSTOM_MED 2242 0.98 1.39 0.83 152 XMGenDplmaNmb 2238 0.88 1.03 0.83 153 TR_XM_RelayPhish 2189 1.18 2.15 0.81 154 TooManyTo_005 2148 0.70 0.45 0.80 155 FILL_THIS_FORM_LONG 2120 0.65 0.29 0.79 156 T_FILL_THIS_FORM_LOAN 2101 0.62 0.18 0.78 157 TR_MetaPhish_Combo_01 2031 0.66 0.43 0.75 158 TR_XM_PHPDW 2021 1.10 2.02 0.75 159 USER_IN_WHITELIST 2011 0.54 0.00 0.75 160 XM_ShortIntro_01 2009 0.75 0.75 0.74 161 URI_OPTOUT_3LD 1993 0.66 0.46 0.74 162 XMSubNoVowel 1986 0.92 1.40 0.74 163 XMPhish30 1979 0.74 0.76 0.73 164 TR_XM_PHPForged 1887 1.04 1.94 0.70 165 XMHTMLBadTable_001 1864 0.59 0.34 0.69 166 XMBSHREFv2 1838 0.57 0.29 0.68 167 T_XMHurry_00 1819 0.81 1.16 0.67 168 HELO_NODOT 1784 0.63 0.55 0.66 169 T_TooManySym_03 1766 0.52 0.17 0.65 170 HELO_NO_DOMAIN 1735 0.61 0.52 0.64 171 TM2_M_A_HREF_HREF 1718 0.67 0.76 0.64 172 REMOVE_BEFORE_LINK 1625 0.57 0.48 0.60 173 HTML_TAG_BALANCE_BODY 1618 0.59 0.55 0.60 174 FORGED_GMAIL_RCVD 1596 0.76 1.19 0.59 175 AC_FROM_MANY_DOTS 1545 0.42 0.02 0.57 176 XMSubMetaSxObfu_03 1542 0.72 1.12 0.57 177 XMSubMetaSxObfu_02 1525 0.59 0.66 0.57 178 PDS_OTHER_BAD_TLD 1458 1.22 3.01 0.54 179 XMHTML_After_End 1435 0.67 1.02 0.53 180 RDNS_DYNAMIC 1414 4.59 15.34 0.52 181 XMLngstWrd_00 1335 0.48 0.43 0.49 182 MISSING_HEADERS 1308 0.53 0.65 0.48 183 XMBody_78 1299 0.50 0.53 0.48 184 LOW_PRICE 1293 0.50 0.57 0.48 185 RELAYCOUNTRY_GB 1256 0.84 1.84 0.47 186 XM_shorewaves_Whitelist 1239 0.33 0.00 0.46 187 TR_XM_FormFill2 1237 0.86 1.92 0.46 188 XMLngstWrd_01 1235 0.44 0.40 0.46 189 XM_H_PHPOS 1222 0.85 1.91 0.45 190 XM_Body_Obfu01 1195 0.35 0.11 0.44 191 RELAYCOUNTRY_DE 1182 0.97 2.36 0.44 192 TR_LOTS_OF_MONEY3 1177 0.52 0.73 0.44 193 SUBJ_DOLLARS 1119 0.39 0.31 0.41 194 HTTPS_HTTP_MISMATCH 1090 0.40 0.41 0.40 195 XMMoneyMeta_00 1084 0.53 0.86 0.40 196 XMRcvdHeader_15 1077 0.29 0.00 0.40 197 XM_URI_RBL 1069 0.78 1.79 0.40 198 T_TooManySym_04 1057 0.30 0.04 0.39 199 XM_B_COPY_HTML 1049 0.43 0.55 0.39 200 HTML_IMAGE_ONLY_20 1042 0.34 0.22 0.39 ----------------------------------------------------------------------