Email: 333204 Autolearn: 0 AvgScore: 2.07 AvgScanTime: 1.77 sec Spam: 85738 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 2.51 sec Ham: 247466 Autolearn: 0 AvgScore: -1.55 AvgScanTime: 1.51 sec Time Spent Running SA: 163.60 hours Time Spent Processing Spam: 59.71 hours Time Spent Processing Ham: 103.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 78597 87.06 91.67 85.47 2 DKIM_SIGNED 69069 79.12 80.56 78.63 3 XM_DK_Pass 66622 77.52 77.70 77.45 4 RELAYCOUNTRY_US 66616 80.16 77.70 81.01 5 DCC_CHECK 66415 55.60 77.46 48.03 6 XM_B_Unicode 60995 71.89 71.14 72.15 7 DKIM_VALID 59561 73.27 69.47 74.58 8 XMListUnsubscribeExists 57689 60.01 67.29 57.50 9 DKIM_VALID_AU 46420 59.90 54.14 61.90 10 BAYES_50 40591 49.32 47.34 50.01 11 XM_B_Unicode3 39090 45.46 45.59 45.41 12 LOC_TINY_FONT_1 29513 30.59 34.42 29.26 13 MIME_HTML_ONLY 28933 25.92 33.75 23.20 14 HTML_FONT_LOW_CONTRAST 28410 32.77 33.14 32.65 15 XM_DK_Undo_02 27930 14.52 32.58 8.26 16 URIBL_RHS_DOB 24639 18.69 28.74 15.21 17 DKIM_VALID_EF 22581 27.59 26.34 28.02 18 FVGT_m_MULTI_ODD 22446 22.58 26.18 21.33 19 XMSubLong 21051 22.35 24.55 21.59 20 BAYES_99 18436 9.32 21.50 5.10 21 XM_Multi_Part_URI 18162 15.82 21.18 13.96 22 DCC_CHECK_NEGATIVE 18057 43.06 21.06 50.68 23 T_KAM_HTML_FONT_INVALID 17686 17.02 20.63 15.77 24 XM_Body_Dirty_Words 17292 16.50 20.17 15.23 25 RELAYCOUNTRY_META 17210 9.20 20.07 5.44 26 XM_UncommonTLD01 17097 7.97 19.94 3.82 27 HTML_IMAGE_RATIO_02 15695 12.66 18.31 10.71 28 T_TM2_M_HEADER_IN_MSG 15244 21.24 17.78 22.43 29 BAYES_999 14304 7.38 16.68 4.15 30 BOTNET 14187 6.07 16.55 2.44 31 TR_DCC_Bayes_99 13666 6.43 15.94 3.14 32 FSL_BULK_SIG 13310 9.96 15.52 8.03 33 UNTRUSTED_Relay 10991 4.58 12.82 1.73 34 XM_B_Unsub 10987 9.91 12.81 8.91 35 BOTNET_IPINHOSTNAME 10259 7.38 11.97 5.80 36 LOTS_OF_MONEY 10070 9.15 11.75 8.25 37 XM_Evil_Numbers_Gen 9899 10.28 11.55 9.85 38 XMSexyCombo_05 9732 6.80 11.35 5.22 39 DKIM_INVALID 9508 5.86 11.09 4.04 40 TooManyTo_001 7939 7.00 9.26 6.22 41 XMSubMetaSx_00 7296 5.06 8.51 3.87 42 MPART_ALT_DIFF 7142 6.00 8.33 5.19 43 KHOP_HELO_FCRDNS 7011 2.83 8.18 0.98 44 BAYES_80 6883 3.82 8.03 2.37 45 NO_DNS_FOR_FROM 6803 3.62 7.93 2.13 46 RCVD_IN_MSPIKE_H2 6634 10.69 7.74 11.71 47 BAYES_60 6543 5.57 7.63 4.85 48 XM_UB50 6500 2.58 7.58 0.85 49 T_REMOTE_IMAGE 6163 4.06 7.19 2.97 50 LotsOfNums_01 6118 7.13 7.14 7.13 51 HTML_IMAGE_RATIO_04 6072 6.77 7.08 6.66 52 TR_Mismatch_TLD_02 5966 1.83 6.96 0.05 53 XM_B_Phish_Phrases 5902 8.09 6.88 8.51 54 XM_SPF_SoftFail 5807 2.44 6.77 0.94 55 XM_H_Long_From01 5550 6.14 6.47 6.02 56 XM_B_SpammyTLD 5241 3.35 6.11 2.40 57 PDS_OTHER_BAD_TLD 5221 2.19 6.09 0.84 58 MIME_HTML_MOSTLY 5198 3.95 6.06 3.21 59 RCVD_IN_BL_SPAMCOP_NET 5070 2.14 5.91 0.83 60 BODY_URI_ONLY 5011 1.52 5.84 0.02 61 FROM_MISSP_REPLYTO 4940 1.49 5.76 0.01 62 RDNS_DYNAMIC 4597 1.72 5.36 0.46 63 FROM_EXCESS_BASE64 4597 4.62 5.36 4.36 64 XM_CamelCaseFrm001 4447 3.03 5.19 2.28 65 XM_SendGrid 4422 6.48 5.16 6.94 66 XMStrtUSub 4072 5.88 4.75 6.27 67 SpammyFromTLD_02 4068 1.36 4.74 0.18 68 XMNumbers 4012 4.87 4.68 4.94 69 FROM_SUSPICIOUS_NTLD 3989 1.21 4.65 0.02 70 HTML_IMAGE_ONLY_08 3985 1.28 4.65 0.11 71 RCVD_IN_RP_RNBL 3943 1.22 4.60 0.05 72 FROM_MISSP_DYNIP 3882 1.17 4.53 0.00 73 RELAYCOUNTRY_CA 3857 2.71 4.50 2.09 74 BAYES_95 3817 2.30 4.45 1.55 75 FROM_SUSPICIOUS_NTLD_FP 3803 1.15 4.44 0.02 76 RCVD_IN_MSPIKE_BL 3377 1.74 3.94 0.98 77 SpammyFromTLD_01 3322 1.25 3.87 0.34 78 MIME_QP_LONG_LINE 3288 3.67 3.83 3.61 79 DATE_IN_PAST_03_06 3169 1.11 3.70 0.21 80 XM_DIRTYINTL 3128 1.39 3.65 0.61 81 TM2_M_URI_OPT_OUT 2979 3.70 3.47 3.78 82 RELAYCOUNTRY_GB 2927 1.45 3.41 0.77 83 SUBJ_ALL_CAPS 2924 1.72 3.41 1.14 84 BAYES_40 2834 4.42 3.31 4.80 85 XMDiploma_00 2787 1.83 3.25 1.34 86 BOTNET_NORDNS 2782 0.86 3.24 0.03 87 RCVD_IN_RP_SAFE 2718 11.88 3.17 14.89 88 T_TooManySym_01 2684 5.92 3.13 6.89 89 BAYES_20 2610 3.79 3.04 4.05 90 URIBL_SBL_A 2565 0.89 2.99 0.17 91 URI_HEX 2557 1.47 2.98 0.94 92 RCVD_IN_MSPIKE_H3 2520 8.90 2.94 10.96 93 RCVD_IN_MSPIKE_WL 2520 8.90 2.94 10.96 94 RELAYCOUNTRY_FR 2509 0.95 2.93 0.27 95 BAYES_00 2499 18.58 2.91 24.01 96 MIME_HTML_ONLY_MULTI 2493 3.12 2.91 3.19 97 RCVD_IN_RP_CERTIFIED 2461 10.89 2.87 13.67 98 XMBdyGiftCard01 2422 2.46 2.82 2.33 99 NO_FM_NAME_IP_HOSTN 2403 0.72 2.80 0.00 100 TR_XM_PHPDW 2296 1.12 2.68 0.58 101 RCVD_IN_PSBL 2290 0.74 2.67 0.07 102 TR_Symld_Words 2258 1.56 2.63 1.19 103 T_XMDrugObfuBody_08 2254 1.86 2.63 1.59 104 ALL_TRUSTED 2239 11.83 2.61 15.02 105 XM_OfRef6 2221 1.94 2.59 1.71 106 TR_XM_PHPForged 2221 1.09 2.59 0.58 107 TR_XM_FormFill2 2202 1.08 2.57 0.57 108 XM_H_PHPOS 2200 1.08 2.57 0.56 109 HTML_IMAGE_RATIO_06 2104 4.02 2.45 4.57 110 HTML_IMAGE_RATIO_08 2067 2.86 2.41 3.02 111 DATE_IN_PAST_06_12 1971 1.02 2.30 0.58 112 HDRS_MISSP 1949 0.59 2.27 0.01 113 TR_XM_DK_Bayes 1838 14.90 2.14 19.31 114 TM2_M_VERY_LONG_WORD 1830 1.66 2.13 1.49 115 NORDNS_LOW_CONTRAST 1809 0.54 2.11 0.00 116 TR_XM_DK_SendGrid 1808 3.63 2.11 4.16 117 LongTLD 1730 0.60 2.02 0.11 118 RCVD_IN_MSPIKE_L3 1728 1.08 2.02 0.76 119 RELAYCOUNTRY_DE 1716 0.80 2.00 0.39 120 T_FILL_THIS_FORM_SHORT 1690 1.42 1.97 1.22 121 HTML_MIME_NO_HTML_TAG 1670 2.02 1.95 2.04 122 XMBrknScrpt_02 1661 1.00 1.94 0.67 123 XM_H_PHPMailer 1622 0.98 1.89 0.66 124 XMSexyCombo_01 1619 0.83 1.89 0.47 125 RCVD_IN_IADB_LISTED 1616 3.01 1.88 3.40 126 T_XMHurry_00 1596 1.49 1.86 1.36 127 XM_H_PHPOS_M 1574 0.71 1.84 0.32 128 TR_XM_INV_DKIM 1566 0.60 1.83 0.17 129 XM_URI_RBL 1563 0.67 1.82 0.26 130 XM_B_Unsub2 1526 1.07 1.78 0.82 131 RCVD_IN_IADB_SPF 1499 2.61 1.75 2.91 132 T_XMDrugObfuBody_14 1475 1.93 1.72 2.00 133 XM_H_TOP 1471 0.44 1.72 0.00 134 RCVD_IN_IADB_DK 1469 2.28 1.71 2.47 135 RCVD_IN_IADB_SENDERID 1459 2.33 1.70 2.55 136 FORM_FRAUD_5 1444 0.43 1.68 0.00 137 XMSubGiftCard1 1401 0.84 1.63 0.57 138 RCVD_IN_MSPIKE_L5 1395 0.44 1.63 0.03 139 BAYES_05 1385 2.74 1.62 3.13 140 DIET_1 1384 0.85 1.61 0.58 141 XM_ProductURIs 1359 1.27 1.59 1.17 142 XM_UB60 1318 0.45 1.54 0.07 143 HK_RANDOM_REPLYTO 1310 0.54 1.53 0.19 144 URI_TRY_3LD 1298 1.63 1.51 1.67 145 TR_XM_DK_Bayes1 1291 14.19 1.51 18.58 146 URI_NOVOWEL 1250 0.64 1.46 0.35 147 TR_XM_MaxBayes 1238 0.38 1.44 0.01 148 REPLYTO_WITHOUT_TO_CC 1234 0.41 1.44 0.06 149 TR_Mismatch_TLD_01 1225 0.55 1.43 0.24 150 XMStockSpam_06 1221 1.02 1.42 0.88 151 TR_XM_DK_Bayes2 1218 13.41 1.42 17.56 152 DKIM_ADSP_CUSTOM_MED 1164 1.16 1.36 1.09 153 MISSING_HEADERS 1156 0.61 1.35 0.35 154 RELAYCOUNTRY_RU 1153 0.37 1.34 0.03 155 REMOVE_BEFORE_LINK 1149 0.54 1.34 0.27 156 UNPARSEABLE_RELAY 1133 3.18 1.32 3.83 157 XMGenDplmaNmb 1129 0.91 1.32 0.77 158 XM_DK_Undo_01 1113 1.65 1.30 1.77 159 XMSubject_48 1086 0.59 1.27 0.35 160 MONEY_FRAUD_8 1066 0.32 1.24 0.00 161 NML_ADSP_CUSTOM_MED 1055 0.91 1.23 0.81 162 MAILING_LIST_MULTI 1042 1.91 1.22 2.15 163 MONEY_FORM_SHORT 1035 0.31 1.21 0.01 164 DATE_IN_FUTURE_06_12 1030 0.32 1.20 0.01 165 XMHTML_After_End 1026 0.76 1.20 0.61 166 MONEY_ATM_CARD 1002 0.30 1.17 0.00 167 XMSubMetaI_00 994 0.95 1.16 0.88 168 XM_OfRef7 990 0.36 1.15 0.08 169 FORGED_GMAIL_RCVD 989 0.66 1.15 0.48 170 LOW_PRICE 960 0.46 1.12 0.24 171 XM_BadFromFormat 958 0.37 1.12 0.11 172 DKIM_ADSP_NXDOMAIN 939 0.61 1.10 0.45 173 DATE_IN_PAST_12_24 922 0.36 1.08 0.11 174 URIBL_DBL_ABUSE_REDIR 909 0.51 1.06 0.32 175 XM_SPF_Unknown 908 0.52 1.06 0.33 176 XM_UB80 900 0.29 1.05 0.02 177 MPART_ALT_DIFF_COUNT 880 0.52 1.03 0.35 178 TR_LOTS_OF_MONEY2 873 0.59 1.02 0.44 179 T_MONEY_PERCENT 873 0.59 1.02 0.44 180 XMSubMetaSxObfu_03 855 0.61 1.00 0.48 181 XMBody_17 841 0.91 0.98 0.89 182 TR_LOTS_OF_MONEY3 825 0.63 0.96 0.51 183 XMSlimDrugH 810 0.44 0.94 0.27 184 XMBody_78 809 0.52 0.94 0.38 185 XM_XX_Yahoo 800 0.33 0.93 0.12 186 XMPhish08 795 0.96 0.93 0.97 187 XMPhish30 790 0.59 0.92 0.47 188 URIBL_ABUSE_SURBL 774 0.27 0.90 0.05 189 T_TooManySym_02 774 2.97 0.90 3.68 190 URIBL_BLACK 772 0.24 0.90 0.01 191 MIME_CHARSET_FARAWAY 768 0.34 0.90 0.14 192 T_XMDrugObfuBody_00 760 0.74 0.89 0.69 193 XM_B_COPY_HTML 748 0.56 0.87 0.45 194 XMSexyCombo_04 746 0.30 0.87 0.10 195 XMHTMLBadTable_001 739 0.78 0.86 0.75 196 XM_OfRef8 724 0.23 0.84 0.01 197 TR_XM_RelayPhish 724 0.34 0.84 0.17 198 RELAYCOUNTRY_IN 723 0.27 0.84 0.07 199 HTML_COMMENT_SAVED_URL 720 0.27 0.84 0.08 200 XMSubNoVowel 711 1.44 0.83 1.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211506 87.06 91.67 85.47 2 RELAYCOUNTRY_US 200468 80.16 77.70 81.01 3 DKIM_SIGNED 194573 79.12 80.56 78.63 4 XM_DK_Pass 191672 77.52 77.70 77.45 5 DKIM_VALID 184564 73.27 69.47 74.58 6 XM_B_Unicode 178535 71.89 71.14 72.15 7 DKIM_VALID_AU 153183 59.90 54.14 61.90 8 XMListUnsubscribeExists 142282 60.01 67.29 57.50 9 DCC_CHECK_NEGATIVE 125418 43.06 21.06 50.68 10 BAYES_50 123754 49.32 47.34 50.01 11 DCC_CHECK 118862 55.60 77.46 48.03 12 XM_B_Unicode3 112378 45.46 45.59 45.41 13 HTML_FONT_LOW_CONTRAST 80795 32.77 33.14 32.65 14 LOC_TINY_FONT_1 72402 30.59 34.42 29.26 15 DKIM_VALID_EF 69342 27.59 26.34 28.02 16 BAYES_00 59415 18.58 2.91 24.01 17 MIME_HTML_ONLY 57420 25.92 33.75 23.20 18 T_TM2_M_HEADER_IN_MSG 55516 21.24 17.78 22.43 19 XMSubLong 53422 22.35 24.55 21.59 20 FVGT_m_MULTI_ODD 52794 22.58 26.18 21.33 21 TR_XM_DK_Bayes 47795 14.90 2.14 19.31 22 TR_XM_DK_Bayes1 45982 14.19 1.51 18.58 23 TR_XM_DK_Bayes2 43461 13.41 1.42 17.56 24 T_KAM_HTML_FONT_INVALID 39037 17.02 20.63 15.77 25 XM_Body_Dirty_Words 37684 16.50 20.17 15.23 26 URIBL_RHS_DOB 37637 18.69 28.74 15.21 27 ALL_TRUSTED 37169 11.83 2.61 15.02 28 RCVD_IN_RP_SAFE 36851 11.88 3.17 14.89 29 XM_Multi_Part_URI 34552 15.82 21.18 13.96 30 RCVD_IN_RP_CERTIFIED 33826 10.89 2.87 13.67 31 RCVD_IN_MSPIKE_H2 28975 10.69 7.74 11.71 32 XM_DKIMWhitelistDomains 28037 8.42 0.02 11.33 33 RCVD_IN_MSPIKE_H3 27132 8.90 2.94 10.96 34 RCVD_IN_MSPIKE_WL 27132 8.90 2.94 10.96 35 HTML_IMAGE_RATIO_02 26502 12.66 18.31 10.71 36 XM_Evil_Numbers_Gen 24370 10.28 11.55 9.85 37 XM_B_Unsub 22043 9.91 12.81 8.91 38 XM_B_Phish_Phrases 21068 8.09 6.88 8.51 39 XM_DK_Undo_02 20445 14.52 32.58 8.26 40 LOTS_OF_MONEY 20415 9.15 11.75 8.25 41 FSL_BULK_SIG 19862 9.96 15.52 8.03 42 LotsOfNums_01 17647 7.13 7.14 7.13 43 XM_SendGrid 17181 6.48 5.16 6.94 44 T_TooManySym_01 17039 5.92 3.13 6.89 45 HTML_IMAGE_RATIO_04 16471 6.77 7.08 6.66 46 XMStrtUSub 15526 5.88 4.75 6.27 47 TooManyTo_001 15386 7.00 9.26 6.22 48 XM_H_Long_From01 14909 6.14 6.47 6.02 49 BOTNET_IPINHOSTNAME 14343 7.38 11.97 5.80 50 RELAYCOUNTRY_META 13450 9.20 20.07 5.44 51 XMSexyCombo_05 12919 6.80 11.35 5.22 52 MPART_ALT_DIFF 12855 6.00 8.33 5.19 53 BAYES_99 12631 9.32 21.50 5.10 54 XMNumbers 12230 4.87 4.68 4.94 55 BAYES_60 12011 5.57 7.63 4.85 56 BAYES_40 11889 4.42 3.31 4.80 57 HTML_IMAGE_RATIO_06 11299 4.02 2.45 4.57 58 FROM_EXCESS_BASE64 10797 4.62 5.36 4.36 59 TR_XM_DK_SendGrid 10289 3.63 2.11 4.16 60 BAYES_999 10277 7.38 16.68 4.15 61 BAYES_20 10029 3.79 3.04 4.05 62 DKIM_INVALID 10009 5.86 11.09 4.04 63 XMSubMetaSx_00 9580 5.06 8.51 3.87 64 UNPARSEABLE_RELAY 9476 3.18 1.32 3.83 65 XM_UncommonTLD01 9456 7.97 19.94 3.82 66 TM2_M_URI_OPT_OUT 9354 3.70 3.47 3.78 67 T_TooManySym_02 9117 2.97 0.90 3.68 68 MIME_QP_LONG_LINE 8930 3.67 3.83 3.61 69 RCVD_IN_IADB_LISTED 8411 3.01 1.88 3.40 70 IN_ZIMBRA_NJ_WHITELIST 8175 2.46 0.02 3.30 71 MIME_HTML_MOSTLY 7952 3.95 6.06 3.21 72 MIME_HTML_ONLY_MULTI 7905 3.12 2.91 3.19 73 TR_DCC_Bayes_99 7762 6.43 15.94 3.14 74 BAYES_05 7742 2.74 1.62 3.13 75 HTML_IMAGE_RATIO_08 7466 2.86 2.41 3.02 76 T_REMOTE_IMAGE 7353 4.06 7.19 2.97 77 TVD_RCVD_IP 7317 2.35 0.61 2.96 78 INVALID_MSGID 7263 2.25 0.29 2.93 79 RCVD_IN_IADB_SPF 7210 2.61 1.75 2.91 80 ANY_BOUNCE_MESSAGE 6961 2.15 0.22 2.81 81 BOUNCE_MESSAGE 6961 2.15 0.22 2.81 82 TO_MALFORMED 6942 2.09 0.01 2.81 83 XM_H_Trusted_IP 6657 2.00 0.00 2.69 84 XM_PDF 6614 2.08 0.38 2.67 85 CK_HELO_DYNAMIC_SPLIT_IP 6391 1.99 0.26 2.58 86 HELO_DYNAMIC_IPADDR2 6389 1.95 0.12 2.58 87 RCVD_IN_IADB_SENDERID 6299 2.33 1.70 2.55 88 RCVD_IN_IADB_DK 6113 2.28 1.71 2.47 89 BOTNET 6050 6.07 16.55 2.44 90 XM_B_SpammyTLD 5930 3.35 6.11 2.40 91 BAYES_80 5854 3.82 8.03 2.37 92 XMBdyGiftCard01 5775 2.46 2.82 2.33 93 RCVD_IN_IADB_VOUCHED 5722 1.83 0.44 2.31 94 XM_CamelCaseFrm001 5652 3.03 5.19 2.28 95 MAILING_LIST_MULTI 5321 1.91 1.22 2.15 96 NO_DNS_FOR_FROM 5268 3.62 7.93 2.13 97 USER_IN_DEF_DKIM_WL 5242 1.60 0.09 2.12 98 RELAYCOUNTRY_CA 5183 2.71 4.50 2.09 99 HTML_MIME_NO_HTML_TAG 5058 2.02 1.95 2.04 100 T_XMDrugObfuBody_14 4951 1.93 1.72 2.00 101 TR_MSPIKEBAYES00 4704 1.42 0.03 1.90 102 IN_HORDE_ADDRESS_BOOK 4671 1.41 0.03 1.89 103 XM_DK_Undo_01 4373 1.65 1.30 1.77 104 UNTRUSTED_Relay 4280 4.58 12.82 1.73 105 XM_OfRef6 4232 1.94 2.59 1.71 106 URI_TRY_3LD 4125 1.63 1.51 1.67 107 XMSubNoVowel 4099 1.44 0.83 1.66 108 T_XMDrugObfuBody_08 3938 1.86 2.63 1.59 109 BAYES_95 3833 2.30 4.45 1.55 110 RCVD_IN_IADB_OPTIN 3723 1.21 0.37 1.50 111 TM2_M_VERY_LONG_WORD 3691 1.66 2.13 1.49 112 T_XMHurry_00 3366 1.49 1.86 1.36 113 XM_GoogleGroups 3350 1.16 0.61 1.35 114 XMGappySubj_01 3339 1.04 0.16 1.35 115 TooManyTo_002 3338 1.16 0.63 1.35 116 XMDiploma_00 3327 1.83 3.25 1.34 117 XM_H_Long_From02 3264 1.17 0.75 1.32 118 T_FILL_THIS_FORM_SHORT 3031 1.42 1.97 1.22 119 TR_Symld_Words 2938 1.56 2.63 1.19 120 XM_ProductURIs 2885 1.27 1.59 1.17 121 SUBJ_ALL_CAPS 2815 1.72 3.41 1.14 122 DKIM_ADSP_CUSTOM_MED 2700 1.16 1.36 1.09 123 XM_B_REG_HTML 2519 0.93 0.67 1.02 124 TR_MetaPhish_Combo_01 2474 0.93 0.73 1.00 125 FILL_THIS_FORM 2451 0.93 0.74 0.99 126 RCVD_IN_MSPIKE_BL 2434 1.74 3.94 0.98 127 KHOP_HELO_FCRDNS 2430 2.83 8.18 0.98 128 XMPhish08 2407 0.96 0.93 0.97 129 XMBody_95 2403 0.76 0.16 0.97 130 USER_IN_WHITELIST 2336 0.70 0.00 0.94 131 URI_HEX 2328 1.47 2.98 0.94 132 XM_SPF_SoftFail 2328 2.44 6.77 0.94 133 TooManyTo_003 2268 0.81 0.51 0.92 134 XMBody_17 2195 0.91 0.98 0.89 135 XMSubMetaI_00 2184 0.95 1.16 0.88 136 XMStockSpam_06 2176 1.02 1.42 0.88 137 HTML_FONT_FACE_BAD 2146 0.81 0.65 0.87 138 FILL_THIS_FORM_LONG 2137 0.69 0.20 0.86 139 T_FILL_THIS_FORM_LOAN 2124 0.79 0.61 0.86 140 XM_UB50 2109 2.58 7.58 0.85 141 PDS_OTHER_BAD_TLD 2088 2.19 6.09 0.84 142 T_TooManySym_03 2079 0.68 0.23 0.84 143 RCVD_IN_BL_SPAMCOP_NET 2066 2.14 5.91 0.83 144 XM_B_Unsub2 2038 1.07 1.78 0.82 145 NML_ADSP_CUSTOM_MED 1993 0.91 1.23 0.81 146 XMGenDplmaNmb 1913 0.91 1.32 0.77 147 RELAYCOUNTRY_GB 1912 1.45 3.41 0.77 148 RCVD_IN_MSPIKE_L3 1877 1.08 2.02 0.76 149 TooManyTo_004 1865 0.67 0.42 0.75 150 XMHTMLBadTable_001 1847 0.78 0.86 0.75 151 T_XMDrugObfuBody_00 1700 0.74 0.89 0.69 152 XM_RXBody 1667 0.63 0.52 0.67 153 XMBrknScrpt_02 1666 1.00 1.94 0.67 154 XM_H_PHPMailer 1641 0.98 1.89 0.66 155 TooManyTo_005 1602 0.58 0.37 0.65 156 XMNoVowels 1574 0.61 0.52 0.64 157 XMHTML_After_End 1510 0.76 1.20 0.61 158 XM_DIRTYINTL 1510 1.39 3.65 0.61 159 XMBSHREFv2 1481 0.53 0.35 0.60 160 HELO_NODOT 1461 0.60 0.62 0.59 161 XMSubMetaSxObfu_02 1455 0.52 0.31 0.59 162 HELO_NO_DOMAIN 1445 0.58 0.58 0.58 163 TR_XM_PHPDW 1443 1.12 2.68 0.58 164 DIET_1 1443 0.85 1.61 0.58 165 DATE_IN_PAST_06_12 1436 1.02 2.30 0.58 166 TR_XM_PHPForged 1426 1.09 2.59 0.58 167 TR_XM_FormFill2 1413 1.08 2.57 0.57 168 PLING_QUERY 1410 0.57 0.56 0.57 169 XMSubGiftCard1 1409 0.84 1.63 0.57 170 XM_H_PHPOS 1392 1.08 2.57 0.56 171 HTML_TAG_BALANCE_BODY 1346 0.54 0.53 0.54 172 T_Symld_Words_02 1344 0.57 0.64 0.54 173 XMLngstWrd_00 1265 0.47 0.34 0.51 174 TR_LOTS_OF_MONEY3 1260 0.63 0.96 0.51 175 XMUrgent 1196 0.38 0.07 0.48 176 FORGED_GMAIL_RCVD 1196 0.66 1.15 0.48 177 XMSubMetaSxObfu_03 1180 0.61 1.00 0.48 178 HTML_IMAGE_ONLY_20 1173 0.41 0.22 0.47 179 XMPhish30 1160 0.59 0.92 0.47 180 XMSexyCombo_01 1152 0.83 1.89 0.47 181 XMCapTrack 1143 0.43 0.33 0.46 182 SUBJ_DOLLARS 1135 0.54 0.78 0.46 183 RDNS_DYNAMIC 1133 1.72 5.36 0.46 184 XMLngstWrd_01 1118 0.41 0.30 0.45 185 DKIM_ADSP_NXDOMAIN 1108 0.61 1.10 0.45 186 XM_B_COPY_HTML 1104 0.56 0.87 0.45 187 FSL_HELO_FAKE 1102 0.34 0.04 0.45 188 HTTPS_HTTP_MISMATCH 1100 0.51 0.69 0.44 189 T_MONEY_PERCENT 1087 0.59 1.02 0.44 190 TR_LOTS_OF_MONEY2 1087 0.59 1.02 0.44 191 T_TooManySym_04 1072 0.34 0.08 0.43 192 XMRcvdHeader_15 1061 0.32 0.00 0.43 193 ADMITS_SPAM 1052 0.39 0.28 0.43 194 TM2_M_A_HREF_HREF 1008 0.42 0.47 0.41 195 XM_Body_Obfu01 992 0.35 0.19 0.40 196 RELAYCOUNTRY_DE 963 0.80 2.00 0.39 197 XMSubMetaD_03 962 0.33 0.15 0.39 198 XMBody_78 939 0.52 0.94 0.38 199 XMLngstWrd_02 928 0.34 0.25 0.38 200 TM2_M_BODY_EMPTY 908 0.29 0.07 0.37 ----------------------------------------------------------------------