Email: 684981 Autolearn: 0 AvgScore: 2.76 AvgScanTime: 3.97 sec Spam: 167396 Autolearn: 0 AvgScore: 14.97 AvgScanTime: 4.79 sec Ham: 517585 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 3.71 sec Time Spent Running SA: 755.61 hours Time Spent Processing Spam: 222.87 hours Time Spent Processing Ham: 532.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152180 88.47 90.91 87.68 2 DCC_CHECK 133035 48.55 79.47 38.55 3 XM_B_Unicode 109090 67.24 65.17 67.91 4 DKIM_SIGNED 103118 70.76 61.60 73.72 5 XM_DK_Pass 99836 69.44 59.64 72.61 6 DKIM_VALID 94475 65.96 56.44 69.04 7 XMListUnsubscribeExists 86606 50.29 51.74 49.82 8 MIME_HTML_ONLY 75164 26.03 44.90 19.92 9 BAYES_50 72987 50.27 43.60 52.43 10 DKIM_VALID_AU 72394 49.73 43.25 51.82 11 XM_B_Unicode3 64105 38.67 38.30 38.80 12 RELAYCOUNTRY_META 49943 11.56 29.84 5.65 13 HTML_FONT_LOW_CONTRAST 47372 26.65 28.30 26.12 14 FSL_BULK_SIG 46915 11.31 28.03 5.90 15 XM_DK_Undo_02 45813 10.69 27.37 5.29 16 LOC_TINY_FONT_1 43578 23.02 26.03 22.05 17 XM_UncommonTLD01 41405 8.77 24.73 3.61 18 BOTNET 41239 7.37 24.64 1.78 19 UNTRUSTED_Relay 37741 6.89 22.55 1.83 20 XMSubLong 37379 21.26 22.33 20.91 21 BAYES_99 37068 7.34 22.14 2.56 22 DKIM_VALID_EF 35632 25.91 21.29 27.41 23 XM_Body_Dirty_Words 32233 14.08 19.26 12.40 24 FVGT_m_MULTI_ODD 32007 20.32 19.12 20.71 25 DCC_CHECK_NEGATIVE 30883 49.27 18.45 59.24 26 T_TM2_M_HEADER_IN_MSG 29429 27.30 17.58 30.45 27 BOTNET_IPINHOSTNAME 28957 7.32 17.30 4.10 28 BAYES_999 28779 5.73 17.19 2.02 29 MultiRelay 28123 17.86 16.80 18.20 30 TR_DCC_Bayes_99 27754 4.72 16.58 0.88 31 XM_B_Unsub 26548 11.81 15.86 10.50 32 HTML_IMAGE_RATIO_02 26544 9.06 15.86 6.86 33 T_KAM_HTML_FONT_INVALID 26379 17.03 15.76 17.45 34 XMSexyCombo_05 26045 6.66 15.56 3.78 35 HTML_MIME_NO_HTML_TAG 24506 5.66 14.64 2.75 36 KHOP_HELO_FCRDNS 24189 5.16 14.45 2.16 37 XM_Multi_Part_URI 21876 11.46 13.07 10.94 38 LOTS_OF_MONEY 19296 8.81 11.53 7.93 39 T_REMOTE_IMAGE 19138 6.06 11.43 4.32 40 HTML_SHORT_LINK_IMG_1 19119 2.82 11.42 0.04 41 XM_H_Long_From01 18332 7.09 10.95 5.85 42 RCVD_IN_BL_SPAMCOP_NET 18017 3.37 10.76 0.98 43 XMSubMetaSx_00 17909 5.36 10.70 3.63 44 XM_Evil_Numbers_Gen 17578 8.86 10.50 8.32 45 RDNS_DYNAMIC 17050 2.74 10.19 0.33 46 SpammyFromTLD_02 16744 2.59 10.00 0.20 47 XM_UB50 16639 3.15 9.94 0.95 48 RCVD_IN_RP_RNBL 16532 2.49 9.88 0.11 49 URIBL_RHS_DOB 15547 5.30 9.29 4.01 50 XMNumbers 15454 5.00 9.23 3.63 51 RCVD_IN_MSPIKE_H2 15097 11.26 9.02 11.98 52 FROM_SUSPICIOUS_NTLD 13355 2.04 7.98 0.12 53 FROM_SUSPICIOUS_NTLD_FP 13284 2.03 7.94 0.12 54 XM_B_Phish_Phrases 13180 6.20 7.87 5.66 55 HDRS_LCASE_IMGONLY 12817 1.88 7.66 0.01 56 HTML_IMAGE_ONLY_08 12715 1.94 7.60 0.12 57 BAYES_60 12693 5.48 7.58 4.80 58 BAYES_80 12639 3.67 7.55 2.42 59 XM_DIRTYINTL 12600 3.55 7.53 2.26 60 DKIM_ADSP_NXDOMAIN 11971 2.42 7.15 0.90 61 FROM_EXCESS_BASE64 11731 3.82 7.01 2.79 62 MPART_ALT_DIFF 11432 5.11 6.83 4.56 63 XM_SPF_SoftFail 11049 3.29 6.60 2.21 64 BODY_URI_ONLY 10595 1.61 6.33 0.08 65 RCVD_IN_PSBL 10543 1.56 6.30 0.03 66 RCVD_IN_MSPIKE_BL 10538 2.57 6.30 1.37 67 TR_Mismatch_TLD_02 10230 1.54 6.11 0.07 68 LotsOfNums_01 9893 7.27 5.91 7.70 69 MIME_HEADER_CTYPE_ONLY 8975 1.37 5.36 0.08 70 HTML_TAG_BALANCE_CENTER 8862 1.35 5.29 0.08 71 BOTNET_NORDNS 8849 1.33 5.29 0.04 72 HTML_IMAGE_RATIO_04 8788 5.45 5.25 5.51 73 DKIM_INVALID 8643 4.80 5.16 4.68 74 TooManyTo_001 8355 7.21 4.99 7.93 75 BAYES_95 8101 2.25 4.84 1.41 76 REPLYTO_WITHOUT_TO_CC 7704 1.18 4.60 0.07 77 RELAYCOUNTRY_FR 7432 1.34 4.44 0.34 78 BAYES_40 7426 6.58 4.44 7.27 79 TR_Symld_Words 7387 2.28 4.41 1.59 80 SpammyFromTLD_01 7198 1.56 4.30 0.68 81 XM_BadFromFormat 7043 1.15 4.21 0.16 82 RELAYCOUNTRY_CA 6982 2.24 4.17 1.61 83 XM_SendGrid 6951 5.54 4.15 6.00 84 NO_DNS_FOR_FROM 6771 2.18 4.04 1.58 85 XMPhish14 6716 1.38 4.01 0.53 86 XM_B_SpammyTLD 6541 2.32 3.91 1.80 87 BAYES_00 6449 16.52 3.85 20.62 88 SHORT_IMG_SUSP_NTLD 6440 0.94 3.85 0.00 89 MIME_HTML_MOSTLY 6343 3.13 3.79 2.92 90 PDS_OTHER_BAD_TLD 6240 1.28 3.73 0.48 91 LongTLD 5922 1.07 3.54 0.27 92 TM2_M_URI_OPT_OUT 5910 2.26 3.53 1.85 93 TO_EQ_FM_DOM_HTML_IMG 5792 0.86 3.46 0.02 94 HTML_IMAGE_ONLY_12 5754 0.97 3.44 0.17 95 RCVD_IN_MSPIKE_H3 5691 7.86 3.40 9.31 96 RCVD_IN_MSPIKE_WL 5691 7.86 3.40 9.31 97 XMStrtUSub 5667 4.36 3.39 4.67 98 BAYES_20 5658 4.78 3.38 5.24 99 MultiRelay_Combo 5634 0.98 3.37 0.20 100 MultiRelay_CC 5634 0.98 3.37 0.20 101 MIME_QP_LONG_LINE 5612 5.13 3.35 5.70 102 XM_UB99 5579 0.82 3.33 0.00 103 HDRS_MISSP 5450 0.80 3.26 0.00 104 XMSubMetaSSx_00 5403 0.88 3.23 0.12 105 BODY_SINGLE_WORD 5254 0.78 3.14 0.02 106 BODY_SINGLE_URI 5181 0.77 3.10 0.01 107 RCVD_IN_MSPIKE_L5 5089 0.92 3.04 0.23 108 HTML_FONT_SIZE_LARGE 5011 0.81 2.99 0.10 109 XM_CamelCaseFrm001 4967 2.18 2.97 1.93 110 T_XMDrugObfuBody_08 4933 1.86 2.95 1.51 111 T_TooManySym_01 4847 4.22 2.90 4.65 112 TR_XM_RelayPhish 4775 1.32 2.85 0.83 113 XM_UB999 4709 0.69 2.81 0.00 114 MIME_HTML_ONLY_MULTI 4601 2.83 2.75 2.86 115 HTML_IMAGE_RATIO_06 4563 3.67 2.73 3.97 116 XMSexyCombo_01 4546 1.22 2.72 0.73 117 XMDiploma_00 4517 2.35 2.70 2.24 118 RCVD_IN_MSPIKE_L3 4429 1.28 2.65 0.84 119 XM_URI_RBL 4198 0.77 2.51 0.21 120 RELAYCOUNTRY_CN 4112 0.63 2.46 0.05 121 XM_UB60 4006 0.66 2.39 0.09 122 XMHTML_After_End 3983 1.57 2.38 1.31 123 PDS_FROM_2_EMAILS 3881 0.60 2.32 0.05 124 FROM_2_EMAILS_SHORT 3854 0.57 2.30 0.01 125 NO_FM_NAME_IP_HOSTN 3848 0.57 2.30 0.00 126 CANT_SEE_AD 3773 0.56 2.25 0.01 127 TO_MALFORMED 3750 1.51 2.24 1.27 128 URI_HEX 3701 1.42 2.21 1.17 129 DATE_IN_PAST_03_06 3687 0.62 2.20 0.11 130 BAYES_05 3673 2.68 2.19 2.84 131 ALL_TRUSTED 3662 12.61 2.19 15.98 132 PDS_TO_EQ_FROM_NAME 3660 0.54 2.19 0.01 133 XMGenDplmaNmb 3602 1.64 2.15 1.48 134 FROM_MISSP_REPLYTO 3528 0.52 2.11 0.01 135 XMPhish11 3525 1.43 2.11 1.21 136 TR_XM_DK_SendGrid 3504 3.02 2.09 3.32 137 XM_OfRef6 3500 1.59 2.09 1.43 138 RELAYCOUNTRY_GB 3492 1.32 2.09 1.08 139 RELAYCOUNTRY_NL 3441 0.71 2.06 0.27 140 DIET_1 3420 0.85 2.04 0.47 141 XM_B_Unsub2 3281 2.82 1.96 3.09 142 HTML_IMAGE_RATIO_08 3272 2.50 1.95 2.68 143 SUBJ_ALL_CAPS 3252 1.57 1.94 1.45 144 T_XMDrugObfuBody_00 3224 0.97 1.93 0.66 145 DKIM_ADSP_CUSTOM_MED 3218 1.19 1.92 0.95 146 RELAYCOUNTRY_DE 3142 0.87 1.88 0.55 147 T_XMDrugObfuBody_14 3084 1.58 1.84 1.49 148 RELAYCOUNTRY_JP 3074 0.47 1.84 0.03 149 TR_XM_PHPDW 3007 1.26 1.80 1.08 150 XMSlimDrugH 2977 0.70 1.78 0.35 151 TR_XM_PHPForged 2935 1.23 1.75 1.06 152 NML_ADSP_CUSTOM_MED 2934 0.94 1.75 0.68 153 TR_XM_FormFill2 2918 1.22 1.74 1.06 154 XM_H_PHPOS 2914 1.22 1.74 1.05 155 URI_NOVOWEL 2890 0.73 1.73 0.41 156 TR_XM_DK_Bayes 2870 11.89 1.71 15.18 157 XMSubMetaSxObfu_03 2843 0.82 1.70 0.53 158 FROM_NTLD_LINKBAIT 2839 0.41 1.70 0.00 159 XMSexyCombo_04 2793 0.56 1.67 0.21 160 FORGED_GMAIL_RCVD 2779 0.76 1.66 0.46 161 XMGppyBdWords 2768 0.53 1.65 0.17 162 XM_H_PHPMailer 2749 0.76 1.64 0.48 163 XMMoneyMeta_00 2748 0.86 1.64 0.61 164 HK_RANDOM_FROM 2681 0.49 1.60 0.13 165 URIBL_DBL_ABUSE_REDIR 2643 0.40 1.58 0.01 166 TVD_SPACE_RATIO_MINFP 2599 0.39 1.55 0.01 167 TR_XM_DK_Bayes1 2588 11.34 1.55 14.51 168 NORDNS_LOW_CONTRAST 2573 0.38 1.54 0.00 169 XMSubMetaI_00 2572 0.96 1.54 0.78 170 XM_UB80 2551 0.39 1.52 0.03 171 XMSpoofStaff2 2494 0.39 1.49 0.03 172 SUBJ_BUY 2447 0.40 1.46 0.06 173 TM2_M_VERY_LONG_WORD 2424 1.30 1.45 1.25 174 T_XMHurry_00 2396 0.71 1.43 0.48 175 XM_ProductURIs 2377 0.88 1.42 0.70 176 TR_XM_DK_Bayes2 2375 10.06 1.42 12.86 177 TVD_SPACE_RATIO 2371 0.61 1.42 0.35 178 MSGID_FROM_MTA_HEADER 2312 0.50 1.38 0.22 179 RCVD_IN_IADB_LISTED 2307 4.27 1.38 5.20 180 XMSubMetaD_00 2285 0.39 1.37 0.08 181 DRUGS_ERECTILE 2284 0.34 1.36 0.01 182 XMStockSpam_06 2278 0.91 1.36 0.76 183 MISSING_HEADERS 2218 0.69 1.33 0.49 184 CHARSET_FARAWAY_HEADER 2191 0.35 1.31 0.04 185 MAILING_LIST_MULTI 2162 2.10 1.29 2.36 186 HTML_EXTRA_CLOSE 2161 0.35 1.29 0.04 187 T_FILL_THIS_FORM_SHORT 2148 1.07 1.28 1.00 188 RCVD_IN_IADB_SPF 2145 3.71 1.28 4.49 189 RCVD_IN_IADB_SENDERID 2105 3.22 1.26 3.85 190 RCVD_IN_IADB_DK 2102 3.21 1.26 3.85 191 TR_XM_INV_DKIM 2078 0.36 1.24 0.07 192 XMObfuSubjects 2040 0.33 1.22 0.04 193 DATE_IN_PAST_06_12 2030 0.34 1.21 0.06 194 TR_Mismatch_TLD_01 2026 0.45 1.21 0.21 195 RELAYCOUNTRY_IN 1989 0.38 1.19 0.12 196 MIME_CHARSET_FARAWAY 1952 0.43 1.17 0.19 197 TO_NO_BRKTS_FROM_MSSP 1950 0.34 1.16 0.08 198 XM_H_SpoofStaff4 1943 0.43 1.16 0.20 199 URI_TRY_3LD 1933 1.09 1.15 1.07 200 XMBody_17 1928 0.81 1.15 0.70 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 453833 88.47 90.91 87.68 2 DKIM_SIGNED 381556 70.76 61.60 73.72 3 XM_DK_Pass 375793 69.44 59.64 72.61 4 DKIM_VALID 357354 65.96 56.44 69.04 5 XM_B_Unicode 351496 67.24 65.17 67.91 6 DCC_CHECK_NEGATIVE 306608 49.27 18.45 59.24 7 BAYES_50 271383 50.27 43.60 52.43 8 DKIM_VALID_AU 268234 49.73 43.25 51.82 9 XMListUnsubscribeExists 257848 50.29 51.74 49.82 10 XM_B_Unicode3 200800 38.67 38.30 38.80 11 DCC_CHECK 199553 48.55 79.47 38.55 12 T_TM2_M_HEADER_IN_MSG 157591 27.30 17.58 30.45 13 DKIM_VALID_EF 141876 25.91 21.29 27.41 14 HTML_FONT_LOW_CONTRAST 135198 26.65 28.30 26.12 15 LOC_TINY_FONT_1 114132 23.02 26.03 22.05 16 XMSubLong 108237 21.26 22.33 20.91 17 FVGT_m_MULTI_ODD 107173 20.32 19.12 20.71 18 BAYES_00 106720 16.52 3.85 20.62 19 MIME_HTML_ONLY 103109 26.03 44.90 19.92 20 MultiRelay 94209 17.86 16.80 18.20 21 T_KAM_HTML_FONT_INVALID 90295 17.03 15.76 17.45 22 ALL_TRUSTED 82699 12.61 2.19 15.98 23 TR_XM_DK_Bayes 78557 11.89 1.71 15.18 24 TR_XM_DK_Bayes1 75088 11.34 1.55 14.51 25 TR_XM_DK_Bayes2 66552 10.06 1.42 12.86 26 XM_Body_Dirty_Words 64188 14.08 19.26 12.40 27 RCVD_IN_MSPIKE_H2 62029 11.26 9.02 11.98 28 XM_Multi_Part_URI 56618 11.46 13.07 10.94 29 XM_B_Unsub 54326 11.81 15.86 10.50 30 RCVD_IN_MSPIKE_WL 48169 7.86 3.40 9.31 31 RCVD_IN_MSPIKE_H3 48168 7.86 3.40 9.31 32 XM_Evil_Numbers_Gen 43080 8.86 10.50 8.32 33 TooManyTo_001 41046 7.21 4.99 7.93 34 LOTS_OF_MONEY 41037 8.81 11.53 7.93 35 LotsOfNums_01 39873 7.27 5.91 7.70 36 BAYES_40 37637 6.58 4.44 7.27 37 HTML_IMAGE_RATIO_02 35507 9.06 15.86 6.86 38 XM_DKIMWhitelistDomains 34043 4.97 0.02 6.58 39 XM_SendGrid 31031 5.54 4.15 6.00 40 FSL_BULK_SIG 30544 11.31 28.03 5.90 41 XM_H_Long_From01 30267 7.09 10.95 5.85 42 MIME_QP_LONG_LINE 29516 5.13 3.35 5.70 43 XM_B_Phish_Phrases 29278 6.20 7.87 5.66 44 RELAYCOUNTRY_META 29240 11.56 29.84 5.65 45 HTML_IMAGE_RATIO_04 28534 5.45 5.25 5.51 46 XM_PDF 28213 4.31 0.79 5.45 47 XM_DK_Undo_02 27378 10.69 27.37 5.29 48 BAYES_20 27099 4.78 3.38 5.24 49 RCVD_IN_IADB_LISTED 26920 4.27 1.38 5.20 50 BAYES_60 24849 5.48 7.58 4.80 51 DKIM_INVALID 24202 4.80 5.16 4.68 52 XMStrtUSub 24174 4.36 3.39 4.67 53 T_TooManySym_01 24043 4.22 2.90 4.65 54 MPART_ALT_DIFF 23596 5.11 6.83 4.56 55 RCVD_IN_IADB_SPF 23245 3.71 1.28 4.49 56 T_REMOTE_IMAGE 22376 6.06 11.43 4.32 57 BOTNET_IPINHOSTNAME 21216 7.32 17.30 4.10 58 URIBL_RHS_DOB 20762 5.30 9.29 4.01 59 HTML_IMAGE_RATIO_06 20551 3.67 2.73 3.97 60 RCVD_IN_IADB_SENDERID 19945 3.22 1.26 3.85 61 RCVD_IN_IADB_DK 19918 3.21 1.26 3.85 62 XMSexyCombo_05 19559 6.66 15.56 3.78 63 RCVD_IN_RP_SAFE 19525 3.08 0.96 3.77 64 XMNumbers 18791 5.00 9.23 3.63 65 XMSubMetaSx_00 18781 5.36 10.70 3.63 66 XM_UncommonTLD01 18698 8.77 24.73 3.61 67 IN_ZIMBRA_NJ_WHITELIST 18033 2.65 0.08 3.48 68 RCVD_IN_IADB_VOUCHED 17805 2.69 0.39 3.44 69 RCVD_IN_RP_CERTIFIED 17712 2.73 0.61 3.42 70 TR_XM_DK_SendGrid 17164 3.02 2.09 3.32 71 XM_B_Unsub2 16019 2.82 1.96 3.09 72 ANY_BOUNCE_MESSAGE 15536 2.36 0.36 3.00 73 BOUNCE_MESSAGE 15533 2.36 0.36 3.00 74 MIME_HTML_MOSTLY 15119 3.13 3.79 2.92 75 MIME_HTML_ONLY_MULTI 14778 2.83 2.75 2.86 76 BAYES_05 14677 2.68 2.19 2.84 77 FROM_EXCESS_BASE64 14460 3.82 7.01 2.79 78 HTML_MIME_NO_HTML_TAG 14250 5.66 14.64 2.75 79 HTML_IMAGE_RATIO_08 13883 2.50 1.95 2.68 80 BAYES_99 13232 7.34 22.14 2.56 81 BAYES_80 12508 3.67 7.55 2.42 82 MAILING_LIST_MULTI 12203 2.10 1.29 2.36 83 T_TooManySym_02 11831 1.90 0.72 2.29 84 XM_DIRTYINTL 11695 3.55 7.53 2.26 85 XMDiploma_00 11600 2.35 2.70 2.24 86 TVD_RCVD_IP 11523 1.84 0.67 2.23 87 XM_SPF_SoftFail 11456 3.29 6.60 2.21 88 RCVD_IN_IADB_OPTIN 11259 1.71 0.28 2.18 89 KHOP_HELO_FCRDNS 11176 5.16 14.45 2.16 90 XM_H_Trusted_IP 11062 1.61 0.00 2.14 91 TooManyTo_002 11038 1.82 0.85 2.13 92 BAYES_999 10458 5.73 17.19 2.02 93 XM_CamelCaseFrm001 9964 2.18 2.97 1.93 94 UNPARSEABLE_RELAY 9939 1.72 1.11 1.92 95 TM2_M_URI_OPT_OUT 9561 2.26 3.53 1.85 96 UNTRUSTED_Relay 9467 6.89 22.55 1.83 97 XM_B_SpammyTLD 9340 2.32 3.91 1.80 98 BOTNET 9225 7.37 24.64 1.78 99 HELO_NODOT 9069 1.45 0.50 1.75 100 HELO_NO_DOMAIN 9025 1.43 0.45 1.74 101 RELAYCOUNTRY_CA 8352 2.24 4.17 1.61 102 TR_Symld_Words 8204 2.28 4.41 1.59 103 NO_DNS_FOR_FROM 8155 2.18 4.04 1.58 104 XM_DK_Undo_01 8049 1.35 0.71 1.56 105 T_XMDrugObfuBody_08 7808 1.86 2.95 1.51 106 T_XMDrugObfuBody_14 7707 1.58 1.84 1.49 107 XMGenDplmaNmb 7658 1.64 2.15 1.48 108 IN_HORDE_ADDRESS_BOOK 7653 1.21 0.39 1.48 109 INVALID_MSGID 7577 1.30 0.80 1.46 110 SUBJ_ALL_CAPS 7505 1.57 1.94 1.45 111 XM_OfRef6 7389 1.59 2.09 1.43 112 BAYES_95 7283 2.25 4.84 1.41 113 XMCapTrack 7248 1.13 0.29 1.40 114 TooManyTo_003 7179 1.21 0.68 1.39 115 RCVD_IN_MSPIKE_BL 7067 2.57 6.30 1.37 116 XMHTML_After_End 6761 1.57 2.38 1.31 117 TO_MALFORMED 6592 1.51 2.24 1.27 118 TM2_M_VERY_LONG_WORD 6489 1.30 1.45 1.25 119 CK_HELO_DYNAMIC_SPLIT_IP 6393 1.07 0.56 1.24 120 HELO_DYNAMIC_IPADDR2 6391 1.02 0.35 1.23 121 XMPhish11 6267 1.43 2.11 1.21 122 URI_HEX 6033 1.42 2.21 1.17 123 XM_GoogleGroups 5794 0.92 0.30 1.12 124 TR_MetaPhish_Combo_01 5635 1.02 0.80 1.09 125 TR_XM_PHPDW 5602 1.26 1.80 1.08 126 RELAYCOUNTRY_GB 5576 1.32 2.09 1.08 127 URI_TRY_3LD 5559 1.09 1.15 1.07 128 XMBdyGiftCard01 5534 1.06 1.03 1.07 129 TR_XM_PHPForged 5509 1.23 1.75 1.06 130 USER_IN_DEF_DKIM_WL 5475 0.80 0.00 1.06 131 XM_H_Long_From02 5474 0.97 0.68 1.06 132 TR_XM_FormFill2 5470 1.22 1.74 1.06 133 XM_H_PHPOS 5446 1.22 1.74 1.05 134 XMGappySubj_01 5349 0.86 0.31 1.03 135 TooManyTo_004 5166 0.89 0.55 1.00 136 T_FILL_THIS_FORM_SHORT 5157 1.07 1.28 1.00 137 RCVD_IN_BL_SPAMCOP_NET 5080 3.37 10.76 0.98 138 XM_UB50 4923 3.15 9.94 0.95 139 DKIM_ADSP_CUSTOM_MED 4903 1.19 1.92 0.95 140 DKIM_ADSP_NXDOMAIN 4633 2.42 7.15 0.90 141 TR_DCC_Bayes_99 4546 4.72 16.58 0.88 142 XMSubNoVowel 4433 0.87 0.90 0.86 143 HTML_FONT_FACE_BAD 4404 0.78 0.57 0.85 144 RCVD_IN_MSPIKE_L3 4334 1.28 2.65 0.84 145 TooManyTo_005 4321 0.75 0.47 0.83 146 TR_XM_RelayPhish 4271 1.32 2.85 0.83 147 XMSubMetaI_00 4021 0.96 1.54 0.78 148 XMStockSpam_06 3951 0.91 1.36 0.76 149 XM_SPF_Unknown 3901 0.78 0.85 0.75 150 TO_NO_BRKTS_HTML_ONLY 3892 0.62 0.22 0.75 151 XMSexyCombo_01 3781 1.22 2.72 0.73 152 XMBody_95 3653 0.56 0.09 0.71 153 XMBody_17 3630 0.81 1.15 0.70 154 XM_ProductURIs 3618 0.88 1.42 0.70 155 HTTPS_HTTP_MISMATCH 3608 0.70 0.70 0.70 156 NML_ADSP_CUSTOM_MED 3524 0.94 1.75 0.68 157 SpammyFromTLD_01 3521 1.56 4.30 0.68 158 T_OBFU_PDF_ATTACH 3507 0.56 0.18 0.68 159 T_Symld_Words_02 3442 0.76 1.04 0.67 160 T_XMDrugObfuBody_00 3413 0.97 1.93 0.66 161 XMBrknScrpt_02 3401 0.69 0.81 0.66 162 XMMoneyMeta_00 3158 0.86 1.64 0.61 163 XM_ShortIntro_01 3125 0.57 0.45 0.60 164 AC_FROM_MANY_DOTS 3092 0.46 0.02 0.60 165 XMNoVowels 3014 0.57 0.54 0.58 166 RELAYCOUNTRY_DE 2841 0.87 1.88 0.55 167 XMSubMetaSxObfu_03 2757 0.82 1.70 0.53 168 XM_shorewaves_Whitelist 2744 0.40 0.00 0.53 169 XMHTMLBadTable_001 2737 0.62 0.91 0.53 170 XMPhish14 2721 1.38 4.01 0.53 171 FILL_THIS_FORM 2659 0.47 0.34 0.51 172 RELAYCOUNTRY_AU 2648 0.51 0.51 0.51 173 T_TooManySym_03 2579 0.43 0.21 0.50 174 HTML_TAG_BALANCE_BODY 2530 0.49 0.49 0.49 175 MISSING_HEADERS 2520 0.69 1.33 0.49 176 PDS_OTHER_BAD_TLD 2509 1.28 3.73 0.48 177 T_XMHurry_00 2491 0.71 1.43 0.48 178 AC_DIV_BONANZA 2484 0.39 0.09 0.48 179 XM_H_PHPMailer 2475 0.76 1.64 0.48 180 XMPhish30 2442 0.62 1.10 0.47 181 TM2_M_BODY_EMPTY 2431 0.38 0.10 0.47 182 DIET_1 2429 0.85 2.04 0.47 183 USER_IN_WHITELIST 2417 0.35 0.00 0.47 184 FORGED_GMAIL_RCVD 2403 0.76 1.66 0.46 185 SHORT_HELO_AND_INLINE_IMAGE 2397 0.36 0.03 0.46 186 FROM_GOV_SPOOF 2395 0.42 0.29 0.46 187 HTML_IMAGE_ONLY_28 2312 0.52 0.74 0.45 188 XMBody_78 2297 0.49 0.64 0.44 189 XMSubMetaSxObfu_02 2239 0.44 0.48 0.43 190 HTML_IMAGE_ONLY_20 2197 0.38 0.24 0.42 191 HTML_IMAGE_ONLY_32 2193 0.38 0.25 0.42 192 TM2_M_A_HREF_HREF 2175 0.48 0.67 0.42 193 URI_NOVOWEL 2135 0.73 1.73 0.41 194 FROM_GOV_DKIM_AU 2106 0.34 0.14 0.41 195 THIS_AD 2090 0.50 0.81 0.40 196 XMDateMe_00 2089 0.40 0.37 0.40 197 XM_Body_Obfu01 2057 0.36 0.23 0.40 198 RCVD_IN_SORBS_DUL 2052 0.50 0.83 0.40 199 FILL_THIS_FORM_LONG 2040 0.36 0.27 0.39 200 XM_B_COPY_HTML 1993 0.50 0.86 0.39 ----------------------------------------------------------------------