Email: 616010 Autolearn: 0 AvgScore: 1.08 AvgScanTime: 1.97 sec Spam: 107434 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 2.57 sec Ham: 508576 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 1.84 sec Time Spent Running SA: 336.60 hours Time Spent Processing Spam: 76.69 hours Time Spent Processing Ham: 259.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100841 87.16 93.86 85.75 2 DCC_CHECK 81572 45.42 75.93 38.98 3 DKIM_SIGNED 81213 74.35 75.59 74.09 4 XM_DK_Pass 79210 73.02 73.73 72.87 5 XM_B_Unicode 77634 68.30 72.26 67.47 6 DKIM_VALID 74008 69.10 68.89 69.14 7 XMListUnsubscribeExists 68284 52.26 63.56 49.87 8 DKIM_VALID_AU 53863 51.75 50.14 52.09 9 BAYES_50 49966 49.53 46.51 50.16 10 XM_B_Unicode3 49049 40.79 45.66 39.76 11 MIME_HTML_ONLY 42995 24.18 40.02 20.83 12 XM_DK_Undo_02 36229 11.06 33.72 6.28 13 HTML_FONT_LOW_CONTRAST 34320 28.01 31.95 27.18 14 LOC_TINY_FONT_1 33200 24.52 30.90 23.17 15 BAYES_99 27752 7.36 25.83 3.45 16 DKIM_VALID_EF 27699 26.11 25.78 26.18 17 FVGT_m_MULTI_ODD 27088 21.42 25.21 20.61 18 XMSubLong 26557 20.40 24.72 19.49 19 XM_Body_Dirty_Words 24185 14.97 22.51 13.38 20 RELAYCOUNTRY_META 23656 8.35 22.02 5.47 21 DCC_CHECK_NEGATIVE 23417 52.60 21.80 59.11 22 TR_DCC_Bayes_99 21362 4.97 19.88 1.82 23 BOTNET 21340 5.04 19.86 1.90 24 T_KAM_HTML_FONT_INVALID 21031 17.34 19.58 16.86 25 BAYES_999 20970 5.75 19.52 2.84 26 T_TM2_M_HEADER_IN_MSG 20797 28.12 19.36 29.97 27 MultiRelay 20792 18.95 19.35 18.86 28 XM_Multi_Part_URI 19849 13.63 18.48 12.61 29 XM_UncommonTLD01 18330 5.94 17.06 3.60 30 BOTNET_IPINHOSTNAME 17471 6.18 16.26 4.05 31 XM_B_Unsub 16576 10.95 15.43 10.01 32 FSL_BULK_SIG 16423 8.39 15.29 6.93 33 UNTRUSTED_Relay 16079 3.88 14.97 1.54 34 XMSexyCombo_05 15151 6.03 14.10 4.32 35 HTML_IMAGE_RATIO_02 14914 8.74 13.88 7.66 36 LOTS_OF_MONEY 12979 8.88 12.08 8.21 37 XM_Evil_Numbers_Gen 12969 9.81 12.07 9.34 38 RCVD_IN_MSPIKE_H2 10635 12.12 9.90 12.59 39 XM_UB50 10000 2.31 9.31 0.84 40 LotsOfNums_01 9987 7.88 9.30 7.58 41 XM_B_Phish_Phrases 9289 6.93 8.65 6.57 42 XMSubMetaSx_00 9129 5.26 8.50 4.57 43 KHOP_HELO_FCRDNS 8615 2.87 8.02 1.79 44 XM_H_Long_From01 8038 6.10 7.48 5.80 45 HTML_MIME_NO_HTML_TAG 7969 3.29 7.42 2.42 46 XM_DIRTYINTL 7956 3.43 7.41 2.59 47 BAYES_60 7920 4.91 7.37 4.39 48 BAYES_80 7832 3.16 7.29 2.29 49 MPART_ALT_DIFF 7772 4.90 7.23 4.40 50 DKIM_INVALID 7205 5.25 6.71 4.94 51 XMNumbers 6988 3.90 6.50 3.34 52 SpammyFromTLD_02 6658 1.26 6.20 0.21 53 T_REMOTE_IMAGE 6501 4.34 6.05 3.98 54 TooManyTo_001 6101 7.96 5.68 8.44 55 MIME_QP_LONG_LINE 6013 5.66 5.60 5.67 56 HTML_IMAGE_RATIO_04 5878 5.79 5.47 5.86 57 TM2_M_URI_OPT_OUT 5596 4.75 5.21 4.65 58 XM_SendGrid 5471 6.22 5.09 6.46 59 RELAYCOUNTRY_CA 5384 2.19 5.01 1.59 60 MIME_HTML_MOSTLY 5212 2.73 4.85 2.29 61 FROM_EXCESS_BASE64 5202 3.45 4.84 3.16 62 HTML_SHORT_LINK_IMG_1 4865 0.81 4.53 0.02 63 RCVD_IN_MSPIKE_WL 4671 8.49 4.35 9.36 64 RCVD_IN_MSPIKE_H3 4671 8.49 4.35 9.36 65 XM_SPF_SoftFail 4627 2.09 4.31 1.63 66 RCVD_IN_BL_SPAMCOP_NET 4531 1.49 4.22 0.91 67 XMStrtUSub 4478 5.33 4.17 5.58 68 HTML_IMAGE_RATIO_06 4467 3.70 4.16 3.61 69 ALL_TRUSTED 4466 14.24 4.16 16.37 70 RDNS_DYNAMIC 4417 0.97 4.11 0.31 71 HTML_IMAGE_ONLY_08 4365 0.83 4.06 0.14 72 FROM_SUSPICIOUS_NTLD 4345 0.74 4.04 0.04 73 MIME_HEADER_CTYPE_ONLY 4327 0.87 4.03 0.21 74 FROM_SUSPICIOUS_NTLD_FP 4321 0.73 4.02 0.03 75 HDRS_LCASE_IMGONLY 4238 0.71 3.94 0.02 76 XM_CamelCaseFrm001 4105 2.61 3.82 2.35 77 XM_URI_RBL 4089 0.88 3.81 0.27 78 MIME_HTML_ONLY_MULTI 4050 2.85 3.77 2.66 79 BAYES_95 4002 1.81 3.73 1.41 80 TR_XM_PHPDW 3952 1.09 3.68 0.55 81 RELAYCOUNTRY_FR 3950 0.91 3.68 0.33 82 T_TooManySym_01 3726 4.30 3.47 4.48 83 XMHTML_After_End 3708 1.29 3.45 0.84 84 DKIM_ADSP_NXDOMAIN 3678 1.21 3.42 0.74 85 TR_Mismatch_TLD_02 3650 0.65 3.40 0.07 86 RCVD_IN_RP_RNBL 3563 0.65 3.32 0.09 87 XM_B_SpammyTLD 3505 1.95 3.26 1.67 88 XM_B_Unsub2 3409 2.51 3.17 2.37 89 SpammyFromTLD_01 3260 1.15 3.03 0.75 90 NO_DNS_FOR_FROM 3240 1.82 3.02 1.57 91 BOTNET_NORDNS 3207 0.57 2.99 0.06 92 XMBdyGiftCard01 3174 1.61 2.95 1.33 93 XMPhish11 2956 1.44 2.75 1.16 94 MultiRelay_CC 2948 0.63 2.74 0.19 95 MultiRelay_Combo 2948 0.63 2.74 0.19 96 XM_H_PHPMailer 2930 0.94 2.73 0.56 97 BAYES_40 2923 5.44 2.72 6.01 98 HTML_IMAGE_RATIO_08 2886 2.70 2.69 2.70 99 REPLYTO_WITHOUT_TO_CC 2875 0.51 2.68 0.05 100 URI_HEX 2871 1.50 2.67 1.26 101 RCVD_IN_MSPIKE_BL 2868 1.32 2.67 1.03 102 PDS_OTHER_BAD_TLD 2749 0.73 2.56 0.35 103 RELAYCOUNTRY_DE 2740 0.82 2.55 0.46 104 BAYES_00 2657 20.25 2.47 24.00 105 DIET_1 2603 0.86 2.42 0.53 106 T_XMDrugObfuBody_08 2571 1.48 2.39 1.28 107 BAYES_20 2541 4.38 2.37 4.81 108 TR_XM_PHPForged 2502 0.84 2.33 0.53 109 TR_XM_RelayPhish 2491 1.27 2.32 1.05 110 XMSexyCombo_01 2487 0.97 2.31 0.68 111 TR_XM_FormFill2 2461 0.83 2.29 0.53 112 XM_H_PHPOS 2447 0.83 2.28 0.52 113 TR_XM_DK_SendGrid 2410 3.26 2.24 3.48 114 XMDiploma_00 2366 1.91 2.20 1.85 115 XMSubGiftCard1 2314 0.43 2.15 0.06 116 XM_OfRef6 2267 1.49 2.11 1.36 117 XMSubGiftCard2 2261 0.39 2.10 0.03 118 HDRS_MISSP 2241 0.37 2.09 0.01 119 LongTLD 2220 0.49 2.07 0.16 120 RCVD_IN_IADB_LISTED 2204 4.37 2.05 4.86 121 NO_FM_NAME_IP_HOSTN 2173 0.35 2.02 0.00 122 XMStockSpam_06 2171 1.30 2.02 1.14 123 TO_EQ_FM_DOM_HTML_IMG 2134 0.36 1.99 0.01 124 TR_Symld_Words 2125 1.52 1.98 1.43 125 RCVD_IN_IADB_SPF 2110 3.84 1.96 4.24 126 RCVD_IN_IADB_DK 2083 3.37 1.94 3.67 127 RCVD_IN_RP_SAFE 2079 7.68 1.94 8.90 128 RCVD_IN_IADB_SENDERID 2065 3.38 1.92 3.69 129 SHORT_IMG_SUSP_NTLD 2062 0.33 1.92 0.00 130 URIBL_SBL_A 2017 0.56 1.88 0.29 131 RCVD_IN_PSBL 1999 0.33 1.86 0.01 132 TVD_SPACE_RATIO 1979 0.65 1.84 0.40 133 XMSubMetaI_00 1947 0.86 1.81 0.66 134 XMBody_17 1928 0.91 1.79 0.72 135 DATE_IN_PAST_03_06 1920 0.44 1.79 0.16 136 SUBJ_ALL_CAPS 1885 1.60 1.75 1.57 137 RCVD_IN_RP_CERTIFIED 1873 7.02 1.74 8.14 138 TM2_M_VERY_LONG_WORD 1871 1.31 1.74 1.22 139 URI_TRY_3LD 1853 1.23 1.72 1.13 140 T_XMDrugObfuBody_00 1788 0.85 1.66 0.67 141 TR_XM_DK_Bayes 1759 13.18 1.64 15.62 142 T_XMDrugObfuBody_14 1754 1.59 1.63 1.58 143 RCVD_IN_MSPIKE_L3 1741 0.75 1.62 0.57 144 TVD_SPACE_RATIO_MINFP 1736 0.30 1.62 0.02 145 TR_XM_INV_DKIM 1699 0.36 1.58 0.10 146 HTML_TAG_BALANCE_CENTER 1664 0.36 1.55 0.10 147 DATE_IN_PAST_06_12 1645 0.31 1.53 0.05 148 RELAYCOUNTRY_GB 1641 1.38 1.53 1.35 149 XM_UB60 1618 0.32 1.51 0.07 150 MAILING_LIST_MULTI 1600 2.05 1.49 2.16 151 BAYES_05 1580 2.90 1.47 3.20 152 TR_XM_DK_Bayes1 1547 12.54 1.44 14.88 153 XMEqualsVooDoo_00 1541 0.28 1.43 0.04 154 TR_LOTS_OF_MONEY3 1535 0.54 1.43 0.35 155 XMEqualsVooDoo_01 1519 0.25 1.41 0.00 156 XMEqualsVooDoo_02 1514 0.25 1.41 0.00 157 XMPhish04 1478 0.24 1.38 0.00 158 RELAYCOUNTRY_IN 1452 0.34 1.35 0.12 159 XMGenDplmaNmb 1437 1.20 1.34 1.18 160 T_MONEY_PERCENT 1430 0.61 1.33 0.45 161 TR_LOTS_OF_MONEY2 1430 0.61 1.33 0.45 162 HK_SCAM 1344 0.24 1.25 0.03 163 DEAR_FRIEND 1328 0.28 1.24 0.08 164 DKIM_ADSP_CUSTOM_MED 1320 1.12 1.23 1.09 165 THIS_AD 1317 0.43 1.23 0.26 166 LOCALPART_IN_SUBJECT 1238 0.21 1.15 0.01 167 XM_H_PHPOS_M 1226 0.35 1.14 0.18 168 XM_UB99 1221 0.20 1.14 0.00 169 XMSexyCombo_04 1219 0.29 1.13 0.11 170 XMPhish14 1184 0.49 1.10 0.36 171 T_FILL_THIS_FORM_SHORT 1184 0.98 1.10 0.95 172 MPART_ALT_DIFF_COUNT 1183 0.44 1.10 0.30 173 XM_ProductURIs 1181 0.70 1.10 0.62 174 HTML_IMAGE_ONLY_28 1143 0.54 1.06 0.42 175 T_Symld_Words_02 1142 0.74 1.06 0.67 176 LOW_PRICE 1138 0.38 1.06 0.23 177 BODY_URI_ONLY 1130 0.26 1.05 0.10 178 TR_MetaPhish_Combo_01 1121 0.92 1.04 0.90 179 TEQF_USR_POLITE 1109 0.19 1.03 0.02 180 XM_DK_Undo_01 1104 1.52 1.03 1.62 181 DEAR_SOMETHING 1102 0.29 1.03 0.14 182 FORGED_GMAIL_RCVD 1083 0.66 1.01 0.58 183 XM_B_COPY_HTML 1077 0.47 1.00 0.36 184 HK_RANDOM_REPLYTO 1075 0.29 1.00 0.14 185 REMOVE_BEFORE_LINK 1071 0.49 1.00 0.38 186 XM_H_Long_From02 1057 1.34 0.98 1.42 187 NML_ADSP_CUSTOM_MED 1056 0.80 0.98 0.77 188 XMMoneyMeta_00 1051 0.49 0.98 0.39 189 URI_NO_WWW_INFO_CGI 1042 0.23 0.97 0.07 190 LONG_HEX_URI 1040 0.31 0.97 0.17 191 XMSubject_48 1035 0.20 0.96 0.04 192 XM_UB80 1031 0.18 0.96 0.01 193 HTML_TITLE_SUBJ_DIFF 1015 0.20 0.94 0.04 194 XM_BadFromFormat 1012 0.26 0.94 0.11 195 FSL_THIS_IS_ADV 1009 0.43 0.94 0.32 196 XMSubMetaSxObfu_03 1000 0.76 0.93 0.72 197 TR_XM_DK_Bayes2 1000 10.95 0.93 13.07 198 URIBL_DBL_ABUSE_REDIR 994 0.17 0.93 0.01 199 XMPhish30 989 0.56 0.92 0.48 200 URIBL_BLACK 974 0.17 0.91 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 436096 87.16 93.86 85.75 2 DKIM_SIGNED 376779 74.35 75.59 74.09 3 XM_DK_Pass 370617 73.02 73.73 72.87 4 DKIM_VALID 351636 69.10 68.89 69.14 5 XM_B_Unicode 343125 68.30 72.26 67.47 6 DCC_CHECK_NEGATIVE 300608 52.60 21.80 59.11 7 DKIM_VALID_AU 264926 51.75 50.14 52.09 8 BAYES_50 255121 49.53 46.51 50.16 9 XMListUnsubscribeExists 253638 52.26 63.56 49.87 10 XM_B_Unicode3 202226 40.79 45.66 39.76 11 DCC_CHECK 198243 45.42 75.93 38.98 12 T_TM2_M_HEADER_IN_MSG 152435 28.12 19.36 29.97 13 HTML_FONT_LOW_CONTRAST 138224 28.01 31.95 27.18 14 DKIM_VALID_EF 133130 26.11 25.78 26.18 15 BAYES_00 122060 20.25 2.47 24.00 16 LOC_TINY_FONT_1 117838 24.52 30.90 23.17 17 MIME_HTML_ONLY 105931 24.18 40.02 20.83 18 FVGT_m_MULTI_ODD 104841 21.42 25.21 20.61 19 XMSubLong 99113 20.40 24.72 19.49 20 MultiRelay 95928 18.95 19.35 18.86 21 T_KAM_HTML_FONT_INVALID 85762 17.34 19.58 16.86 22 ALL_TRUSTED 83248 14.24 4.16 16.37 23 TR_XM_DK_Bayes 79433 13.18 1.64 15.62 24 TR_XM_DK_Bayes1 75675 12.54 1.44 14.88 25 XM_Body_Dirty_Words 68053 14.97 22.51 13.38 26 TR_XM_DK_Bayes2 66482 10.95 0.93 13.07 27 XM_Multi_Part_URI 64107 13.63 18.48 12.61 28 RCVD_IN_MSPIKE_H2 64043 12.12 9.90 12.59 29 XM_B_Unsub 50899 10.95 15.43 10.01 30 RCVD_IN_MSPIKE_WL 47605 8.49 4.35 9.36 31 RCVD_IN_MSPIKE_H3 47604 8.49 4.35 9.36 32 XM_Evil_Numbers_Gen 47481 9.81 12.07 9.34 33 RCVD_IN_RP_SAFE 45252 7.68 1.94 8.90 34 TooManyTo_001 42947 7.96 5.68 8.44 35 LOTS_OF_MONEY 41753 8.88 12.08 8.21 36 RCVD_IN_RP_CERTIFIED 41380 7.02 1.74 8.14 37 HTML_IMAGE_RATIO_02 38946 8.74 13.88 7.66 38 LotsOfNums_01 38565 7.88 9.30 7.58 39 XM_DKIMWhitelistDomains 36733 5.97 0.01 7.22 40 FSL_BULK_SIG 35241 8.39 15.29 6.93 41 XM_B_Phish_Phrases 33389 6.93 8.65 6.57 42 XM_SendGrid 32833 6.22 5.09 6.46 43 XM_DK_Undo_02 31921 11.06 33.72 6.28 44 BAYES_40 30565 5.44 2.72 6.01 45 HTML_IMAGE_RATIO_04 29792 5.79 5.47 5.86 46 XM_H_Long_From01 29510 6.10 7.48 5.80 47 MIME_QP_LONG_LINE 28856 5.66 5.60 5.67 48 XMStrtUSub 28358 5.33 4.17 5.58 49 RELAYCOUNTRY_META 27809 8.35 22.02 5.47 50 DKIM_INVALID 25143 5.25 6.71 4.94 51 RCVD_IN_IADB_LISTED 24719 4.37 2.05 4.86 52 BAYES_20 24448 4.38 2.37 4.81 53 XM_PDF 24357 4.09 0.79 4.79 54 ANY_BOUNCE_MESSAGE 24114 3.99 0.44 4.74 55 BOUNCE_MESSAGE 24109 3.99 0.44 4.74 56 TM2_M_URI_OPT_OUT 23653 4.75 5.21 4.65 57 XMSubMetaSx_00 23248 5.26 8.50 4.57 58 T_TooManySym_01 22781 4.30 3.47 4.48 59 MPART_ALT_DIFF 22386 4.90 7.23 4.40 60 BAYES_60 22329 4.91 7.37 4.39 61 XMSexyCombo_05 21983 6.03 14.10 4.32 62 RCVD_IN_IADB_SPF 21568 3.84 1.96 4.24 63 BOTNET_IPINHOSTNAME 20613 6.18 16.26 4.05 64 T_REMOTE_IMAGE 20250 4.34 6.05 3.98 65 IN_ZIMBRA_NJ_WHITELIST 19003 3.09 0.02 3.74 66 RCVD_IN_IADB_SENDERID 18783 3.38 1.92 3.69 67 RCVD_IN_IADB_DK 18671 3.37 1.94 3.67 68 HTML_IMAGE_RATIO_06 18342 3.70 4.16 3.61 69 XM_UncommonTLD01 18286 5.94 17.06 3.60 70 TR_XM_DK_SendGrid 17700 3.26 2.24 3.48 71 BAYES_99 17560 7.36 25.83 3.45 72 XMNumbers 17006 3.90 6.50 3.34 73 BAYES_05 16281 2.90 1.47 3.20 74 FROM_EXCESS_BASE64 16073 3.45 4.84 3.16 75 RCVD_IN_IADB_VOUCHED 15534 2.59 0.40 3.05 76 BAYES_999 14430 5.75 19.52 2.84 77 HTML_IMAGE_RATIO_08 13746 2.70 2.69 2.70 78 MIME_HTML_ONLY_MULTI 13525 2.85 3.77 2.66 79 XM_DIRTYINTL 13164 3.43 7.41 2.59 80 XM_H_Trusted_IP 12546 2.04 0.00 2.47 81 HTML_MIME_NO_HTML_TAG 12302 3.29 7.42 2.42 82 XM_B_Unsub2 12078 2.51 3.17 2.37 83 XM_CamelCaseFrm001 11947 2.61 3.82 2.35 84 TooManyTo_002 11829 2.06 0.82 2.33 85 BAYES_80 11659 3.16 7.29 2.29 86 MIME_HTML_MOSTLY 11622 2.73 4.85 2.29 87 T_TooManySym_02 11460 2.00 0.80 2.25 88 MAILING_LIST_MULTI 11010 2.05 1.49 2.16 89 UNPARSEABLE_RELAY 10097 1.79 0.87 1.99 90 RCVD_IN_IADB_OPTIN 9894 1.66 0.33 1.95 91 BOTNET 9686 5.04 19.86 1.90 92 XMDiploma_00 9411 1.91 2.20 1.85 93 TR_DCC_Bayes_99 9280 4.97 19.88 1.82 94 KHOP_HELO_FCRDNS 9085 2.87 8.02 1.79 95 HELO_NODOT 8665 1.54 0.77 1.70 96 HELO_NO_DOMAIN 8623 1.53 0.77 1.70 97 XM_B_SpammyTLD 8477 1.95 3.26 1.67 98 XM_SPF_SoftFail 8272 2.09 4.31 1.63 99 XM_DK_Undo_01 8259 1.52 1.03 1.62 100 INVALID_MSGID 8155 1.35 0.16 1.60 101 TooManyTo_003 8096 1.43 0.67 1.59 102 RELAYCOUNTRY_CA 8081 2.19 5.01 1.59 103 T_XMDrugObfuBody_14 8035 1.59 1.63 1.58 104 NO_DNS_FOR_FROM 7969 1.82 3.02 1.57 105 SUBJ_ALL_CAPS 7960 1.60 1.75 1.57 106 UNTRUSTED_Relay 7838 3.88 14.97 1.54 107 IN_HORDE_ADDRESS_BOOK 7776 1.27 0.04 1.53 108 TVD_RCVD_IP 7740 1.34 0.46 1.52 109 TR_Symld_Words 7255 1.52 1.98 1.43 110 XM_H_Long_From02 7217 1.34 0.98 1.42 111 BAYES_95 7161 1.81 3.73 1.41 112 XM_OfRef6 6921 1.49 2.11 1.36 113 RELAYCOUNTRY_GB 6845 1.38 1.53 1.35 114 TO_MALFORMED 6754 1.10 0.01 1.33 115 XMBdyGiftCard01 6739 1.61 2.95 1.33 116 XMCapTrack 6664 1.15 0.40 1.31 117 XMSubNoVowel 6598 1.15 0.43 1.30 118 T_XMDrugObfuBody_08 6531 1.48 2.39 1.28 119 USER_IN_DEF_DKIM_WL 6527 1.06 0.01 1.28 120 URI_HEX 6383 1.50 2.67 1.26 121 TM2_M_VERY_LONG_WORD 6194 1.31 1.74 1.22 122 CK_HELO_DYNAMIC_SPLIT_IP 6071 1.00 0.06 1.19 123 HELO_DYNAMIC_IPADDR2 6065 0.99 0.03 1.19 124 TooManyTo_004 6037 1.08 0.56 1.19 125 XMGenDplmaNmb 5982 1.20 1.34 1.18 126 XMPhish11 5919 1.44 2.75 1.16 127 XM_GoogleGroups 5849 1.03 0.46 1.15 128 XMStockSpam_06 5819 1.30 2.02 1.14 129 URI_TRY_3LD 5747 1.23 1.72 1.13 130 XMGappySubj_01 5675 0.97 0.28 1.12 131 DKIM_ADSP_CUSTOM_MED 5564 1.12 1.23 1.09 132 TR_XM_RelayPhish 5320 1.27 2.32 1.05 133 RCVD_IN_MSPIKE_BL 5239 1.32 2.67 1.03 134 TooManyTo_005 5073 0.91 0.47 1.00 135 T_OBFU_PDF_ATTACH 4929 0.85 0.26 0.97 136 T_FILL_THIS_FORM_SHORT 4826 0.98 1.10 0.95 137 RCVD_IN_BL_SPAMCOP_NET 4653 1.49 4.22 0.91 138 TR_MetaPhish_Combo_01 4563 0.92 1.04 0.90 139 HTML_FONT_FACE_BAD 4269 0.85 0.88 0.84 140 XMHTML_After_End 4254 1.29 3.45 0.84 141 XM_UB50 4253 2.31 9.31 0.84 142 XM_SPF_Unknown 4110 0.81 0.84 0.81 143 NML_ADSP_CUSTOM_MED 3898 0.80 0.98 0.77 144 XMBody_95 3871 0.65 0.14 0.76 145 SpammyFromTLD_01 3798 1.15 3.03 0.75 146 DKIM_ADSP_NXDOMAIN 3749 1.21 3.42 0.74 147 XMNoVowels 3740 0.73 0.73 0.74 148 XMSubMetaSxObfu_03 3652 0.76 0.93 0.72 149 XMBody_17 3648 0.91 1.79 0.72 150 XM_E_Blogspot 3598 0.60 0.11 0.71 151 XMSexyCombo_01 3480 0.97 2.31 0.68 152 T_XMDrugObfuBody_00 3418 0.85 1.66 0.67 153 HTTPS_HTTP_MISMATCH 3413 0.67 0.64 0.67 154 T_Symld_Words_02 3403 0.74 1.06 0.67 155 XMSubMetaI_00 3336 0.86 1.81 0.66 156 XMBrknScrpt_02 3308 0.65 0.68 0.65 157 FILL_THIS_FORM 3224 0.68 0.90 0.63 158 XM_ProductURIs 3148 0.70 1.10 0.62 159 T_XMHurry_00 2974 0.61 0.72 0.58 160 FORGED_GMAIL_RCVD 2955 0.66 1.01 0.58 161 RCVD_IN_MSPIKE_L3 2881 0.75 1.62 0.57 162 XM_ShortIntro_01 2852 0.53 0.36 0.56 163 XM_H_PHPMailer 2838 0.94 2.73 0.56 164 TR_XM_PHPDW 2779 1.09 3.68 0.55 165 XM_B_REG_HTML 2760 0.58 0.75 0.54 166 HTML_IMAGE_ONLY_20 2699 0.55 0.65 0.53 167 DIET_1 2687 0.86 2.42 0.53 168 TR_XM_PHPForged 2679 0.84 2.33 0.53 169 TR_XM_FormFill2 2672 0.83 2.29 0.53 170 XM_H_PHPOS 2643 0.83 2.28 0.52 171 MISSING_HEADERS 2604 0.52 0.58 0.51 172 RCVD_IN_SORBS_DUL 2594 0.46 0.21 0.51 173 AC_DIV_BONANZA 2561 0.44 0.12 0.50 174 USER_IN_WHITELIST 2533 0.41 0.00 0.50 175 T_TooManySym_03 2490 0.44 0.23 0.49 176 AC_FROM_MANY_DOTS 2469 0.40 0.01 0.49 177 XMPhish30 2461 0.56 0.92 0.48 178 HTML_TAG_BALANCE_BODY 2420 0.49 0.56 0.48 179 RELAYCOUNTRY_DE 2340 0.82 2.55 0.46 180 TR_LOTS_OF_MONEY2 2300 0.61 1.33 0.45 181 T_MONEY_PERCENT 2300 0.61 1.33 0.45 182 FILL_THIS_FORM_LONG 2288 0.51 0.79 0.45 183 XMHTMLBadTable_001 2285 0.50 0.76 0.45 184 TM2_M_BODY_EMPTY 2269 0.41 0.21 0.45 185 PLING_QUERY 2253 0.48 0.64 0.44 186 RELAYCOUNTRY_AU 2234 0.45 0.49 0.44 187 XM_Body_Obfu01 2205 0.42 0.37 0.43 188 HTML_IMAGE_ONLY_28 2155 0.54 1.06 0.42 189 XMDateMe_00 2145 0.42 0.42 0.42 190 SHORT_HELO_AND_INLINE_IMAGE 2145 0.36 0.04 0.42 191 TM2_M_A_HREF_HREF 2056 0.45 0.65 0.40 192 FROM_GOV_SPOOF 2053 0.38 0.26 0.40 193 XMGappySubj_02 2051 0.34 0.07 0.40 194 TVD_SPACE_RATIO 2043 0.65 1.84 0.40 195 T_FILL_THIS_FORM_LOAN 2037 0.37 0.20 0.40 196 XMBSHREFv2 2027 0.39 0.37 0.40 197 XM_Combo_Sbj 2025 0.43 0.58 0.40 198 HTML_IMAGE_ONLY_32 2011 0.40 0.43 0.40 199 XMMoneyMeta_00 1973 0.49 0.98 0.39 200 XMSlimDrugH 1968 0.45 0.73 0.39 ----------------------------------------------------------------------