Email: 685612 Autolearn: 0 AvgScore: 1.83 AvgScanTime: 2.44 sec Spam: 164110 Autolearn: 0 AvgScore: 11.38 AvgScanTime: 3.31 sec Ham: 521502 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 2.17 sec Time Spent Running SA: 464.96 hours Time Spent Processing Spam: 150.88 hours Time Spent Processing Ham: 314.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157022 90.75 95.68 89.20 2 XM_B_Unicode 129167 71.76 78.71 69.57 3 DCC_CHECK 108178 46.05 65.92 39.79 4 DKIM_SIGNED 101029 71.07 61.56 74.07 5 XM_DK_Pass 96264 69.48 58.66 72.88 6 BAYES_50 96198 53.13 58.62 51.40 7 RELAYCOUNTRY_US 94365 74.86 57.50 80.33 8 XM_B_Unicode3 94063 44.38 57.32 40.31 9 XMListUnsubscribeExists 85502 50.77 52.10 50.35 10 DKIM_VALID 82287 64.08 50.14 68.47 11 MIME_HTML_ONLY 82069 27.86 50.01 20.88 12 URIBL_RHS_DOB 62056 20.37 37.81 14.88 13 DKIM_VALID_AU 59963 47.44 36.54 50.87 14 DCC_CHECK_NEGATIVE 53729 51.87 32.74 57.89 15 XM_DK_Undo_02 47212 11.85 28.77 6.52 16 ALL_TRUSTED 43042 18.00 26.23 15.41 17 HTML_IMAGE_RATIO_02 42469 11.66 25.88 7.19 18 XM_B_Unsub 42195 14.31 25.71 10.72 19 LOC_TINY_FONT_1 41651 23.73 25.38 23.21 20 HTML_FONT_LOW_CONTRAST 40008 26.05 24.38 26.58 21 T_HTML_ATTACH 39190 6.14 23.88 0.56 22 XMSubLong 35665 20.52 21.73 20.14 23 DKIM_VALID_EF 33759 25.03 20.57 26.43 24 FVGT_m_MULTI_ODD 32028 20.19 19.52 20.40 25 XMStrtUSub 31009 7.88 18.90 4.41 26 BAYES_99 30646 6.78 18.67 3.04 27 FSL_BULK_SIG 29187 9.47 17.79 6.86 28 T_KAM_HTML_FONT_INVALID 29137 17.90 17.75 17.94 29 RELAYCOUNTRY_META 27764 8.68 16.92 6.09 30 XMStockSpam_06 27433 4.68 16.72 0.89 31 DKIM_ADSP_NXDOMAIN 26558 4.13 16.18 0.33 32 HTML_COMMENT_SAVED_URL 26404 4.02 16.09 0.23 33 BOTNET 26241 5.89 15.99 2.71 34 NUMERIC_HTTP_ADDR 26061 4.07 15.88 0.35 35 XM_Body_Dirty_Words 26024 13.16 15.86 12.31 36 HTTP_ESCAPED_HOST 25741 3.92 15.69 0.21 37 URI_TRUNCATED 25669 3.89 15.64 0.19 38 T_TM2_M_HEADER_IN_MSG 24815 26.04 15.12 29.48 39 DATE_IN_FUTURE_06_12 24690 3.73 15.04 0.17 40 BAYES_999 22919 5.20 13.97 2.44 41 XM_Multi_Part_URI 21830 11.68 13.30 11.17 42 TR_DCC_Bayes_99 21738 4.33 13.25 1.53 43 XM_H_Long_From01 21245 8.00 12.95 6.44 44 MIME_QP_LONG_LINE 20724 7.63 12.63 6.05 45 UNTRUSTED_Relay 19749 4.20 12.03 1.74 46 BOTNET_IPINHOSTNAME 18874 5.86 11.50 4.09 47 XM_UncommonTLD01 18777 5.02 11.44 3.00 48 DKIM_INVALID 18742 6.99 11.42 5.60 49 XM_CamelCaseFrm001 18126 4.47 11.05 2.40 50 LOTS_OF_MONEY 16662 9.09 10.15 8.75 51 XM_Evil_Numbers_Gen 13951 8.63 8.50 8.67 52 NO_DNS_FOR_FROM 13714 4.52 8.36 3.31 53 XMSexyCombo_05 13584 4.91 8.28 3.86 54 T_OBFU_HTML_ATTACH 13125 2.09 8.00 0.23 55 TR_XM_HtmlAttach 13125 2.09 8.00 0.23 56 LotsOfNums_01 12337 7.83 7.52 7.93 57 XM_UB50 10478 2.27 6.38 0.97 58 BAYES_80 10098 3.42 6.15 2.56 59 TooManyTo_001 9462 7.69 5.77 8.30 60 XM_B_Phish_Phrases 9170 6.41 5.59 6.67 61 MPART_ALT_DIFF 8899 5.43 5.42 5.43 62 BAYES_60 8712 4.85 5.31 4.70 63 RCVD_IN_MSPIKE_H2 8613 9.09 5.25 10.30 64 XMSubMetaSx_00 8351 3.62 5.09 3.16 65 XM_SPF_SoftFail 8240 2.61 5.02 1.85 66 HTML_IMAGE_RATIO_04 7314 5.20 4.46 5.43 67 KHOP_HELO_FCRDNS 6949 2.64 4.23 2.14 68 XMNumbers 6845 3.44 4.17 3.21 69 XM_B_SpammyTLD 6752 2.61 4.11 2.13 70 PDS_OTHER_BAD_TLD 6715 1.27 4.09 0.39 71 BODY_URI_ONLY 6452 1.13 3.93 0.25 72 T_REMOTE_IMAGE 6137 3.62 3.74 3.59 73 XM_SendGrid 6122 5.86 3.73 6.53 74 RELAYCOUNTRY_CA 5870 2.37 3.58 1.99 75 MIME_HTML_MOSTLY 5691 2.91 3.47 2.73 76 RELAYCOUNTRY_FR 5636 1.08 3.43 0.33 77 RCVD_IN_MSPIKE_BL 5600 1.53 3.41 0.94 78 HTML_MIME_NO_HTML_TAG 5557 2.72 3.39 2.51 79 SpammyFromTLD_02 5352 1.07 3.26 0.38 80 BAYES_95 5308 2.01 3.23 1.63 81 FROM_SUSPICIOUS_NTLD 5262 0.79 3.21 0.02 82 TM2_M_URI_OPT_OUT 5115 3.11 3.12 3.11 83 FROM_SUSPICIOUS_NTLD_FP 5032 0.75 3.07 0.02 84 RCVD_IN_BL_SPAMCOP_NET 4999 1.45 3.05 0.95 85 BAYES_40 4711 5.32 2.87 6.09 86 DATE_IN_PAST_03_06 4669 0.76 2.85 0.11 87 URI_HEX 4471 1.51 2.72 1.13 88 RDNS_DYNAMIC 4352 0.87 2.65 0.31 89 RCVD_IN_RP_RNBL 4293 0.71 2.62 0.11 90 FROM_MISSP_REPLYTO 4286 0.63 2.61 0.01 91 XM_URI_RBL 4205 0.76 2.56 0.19 92 HTML_IMAGE_RATIO_06 4203 3.96 2.56 4.40 93 FROM_EXCESS_BASE64 4184 2.71 2.55 2.76 94 RCVD_IN_MSPIKE_L3 4149 1.10 2.53 0.64 95 TR_Mismatch_TLD_02 4140 0.65 2.52 0.07 96 HTML_IMAGE_ONLY_08 4139 0.68 2.52 0.10 97 XM_DIRTYINTL 4133 1.01 2.52 0.54 98 T_XMDrugObfuBody_08 3951 1.70 2.41 1.48 99 XMHTML_After_End 3933 1.10 2.40 0.69 100 RCVD_IN_MSPIKE_WL 3926 7.81 2.39 9.51 101 RCVD_IN_MSPIKE_H3 3926 7.81 2.39 9.51 102 T_TooManySym_01 3702 3.93 2.26 4.45 103 MIME_HTML_ONLY_MULTI 3690 2.85 2.25 3.04 104 BAYES_20 3669 4.37 2.24 5.04 105 XM_BadFromFormat 3490 0.61 2.13 0.13 106 XM_OfRef6 3411 1.53 2.08 1.35 107 HTML_IMAGE_RATIO_08 3369 2.33 2.05 2.41 108 FROM_MISSP_DYNIP 3318 0.48 2.02 0.00 109 TR_XM_PHPDW 3227 1.30 1.97 1.09 110 TR_MetaPhish_Combo_01 3210 1.85 1.96 1.81 111 XMCapTrack 3190 1.52 1.94 1.39 112 HTML_TAG_BALANCE_CENTER 3166 0.60 1.93 0.18 113 SpammyFromTLD_01 3147 1.04 1.92 0.77 114 XM_B_Unsub2 3139 2.30 1.91 2.42 115 XMDiploma_00 3091 2.02 1.88 2.07 116 TR_XM_INV_DKIM 3082 0.53 1.88 0.10 117 TR_XM_PHPForged 2997 1.25 1.83 1.06 118 XMPhish14 2975 1.41 1.81 1.28 119 TR_XM_FormFill2 2942 1.23 1.79 1.06 120 XM_H_PHPOS 2940 1.23 1.79 1.05 121 RCVD_IN_IADB_LISTED 2935 4.22 1.79 4.99 122 LongTLD 2804 0.55 1.71 0.19 123 HTML_SHORT_LINK_IMG_1 2782 0.42 1.70 0.02 124 RCVD_IN_IADB_SPF 2769 3.70 1.69 4.33 125 URIBL_CSS_A 2721 0.41 1.66 0.01 126 URIBL_CSS 2721 0.41 1.66 0.01 127 RCVD_IN_IADB_DK 2717 3.22 1.66 3.72 128 HDRS_LCASE_IMGONLY 2716 0.41 1.65 0.02 129 RCVD_IN_IADB_SENDERID 2714 3.27 1.65 3.78 130 XM_UB60 2697 0.44 1.64 0.06 131 T_XMDrugObfuBody_14 2683 1.64 1.63 1.64 132 SUBJ_ALL_CAPS 2661 1.63 1.62 1.64 133 TO_IN_SUBJ 2653 1.07 1.62 0.90 134 BAYES_00 2624 16.98 1.60 21.82 135 MAILING_LIST_MULTI 2590 2.23 1.58 2.44 136 XMSexyCombo_01 2580 0.74 1.57 0.47 137 TR_XM_DK_SendGrid 2545 3.06 1.55 3.53 138 XM_UB80 2524 0.38 1.54 0.01 139 XMBody_17 2489 0.81 1.52 0.59 140 BOTNET_NORDNS 2371 0.39 1.44 0.06 141 RCVD_IN_RP_SAFE 2335 6.90 1.42 8.63 142 DATE_IN_PAST_06_12 2320 0.42 1.41 0.11 143 TM2_M_VERY_LONG_WORD 2259 1.17 1.38 1.11 144 XMMoneyMeta_00 2235 0.78 1.36 0.60 145 URIBL_SBL_A 2172 0.63 1.32 0.41 146 XMEqualsVooDoo_00 2129 0.32 1.30 0.02 147 XMEqualsVooDoo_01 2087 0.31 1.27 0.00 148 XMEqualsVooDoo_02 2085 0.30 1.27 0.00 149 XMEqualsVooDoo_03 2074 0.30 1.26 0.00 150 XMGenDplmaNmb 2050 1.22 1.25 1.22 151 RCVD_IN_RP_CERTIFIED 2038 6.36 1.24 7.97 152 T_XMHurry_00 1915 0.83 1.17 0.72 153 TR_XM_DK_Bayes 1906 11.97 1.16 15.37 154 XMNoVowels 1894 1.03 1.15 0.99 155 RCVD_IN_PSBL 1893 0.30 1.15 0.03 156 REMOVE_BEFORE_LINK 1882 0.48 1.15 0.27 157 TR_LOTS_OF_MONEY3 1827 0.84 1.11 0.75 158 TR_Symld_Words 1821 1.28 1.11 1.33 159 MPART_ALT_DIFF_COUNT 1779 0.54 1.08 0.37 160 NO_FM_NAME_IP_HOSTN 1777 0.26 1.08 0.00 161 BAYES_05 1777 2.95 1.08 3.54 162 XM_H_TOP 1730 0.26 1.05 0.00 163 DKIM_ADSP_CUSTOM_MED 1718 0.99 1.05 0.97 164 XMSubMetaI_00 1708 0.83 1.04 0.77 165 T_XMDrugObfuBody_00 1682 0.75 1.02 0.66 166 XM_DK_Undo_01 1679 1.68 1.02 1.89 167 T_Symld_Words_02 1676 0.72 1.02 0.62 168 XMPhish08 1619 0.63 0.99 0.52 169 XM_H_PHPMailer 1614 0.68 0.98 0.59 170 RELAYCOUNTRY_DE 1607 0.65 0.98 0.54 171 UNPARSEABLE_RELAY 1588 2.04 0.97 2.38 172 FORGED_GMAIL_RCVD 1537 0.57 0.94 0.45 173 XM_H_Long_From02 1528 1.03 0.93 1.07 174 XM_PDF 1526 3.96 0.93 4.92 175 XMSubject_78 1510 0.94 0.92 0.94 176 RELAYCOUNTRY_IN 1495 0.31 0.91 0.12 177 FILL_THIS_FORM_SHORT 1490 1.04 0.91 1.08 178 RELAYCOUNTRY_GB 1489 0.96 0.91 0.98 179 XMSlimDrugH 1478 0.50 0.90 0.37 180 XMBrknScrpt_02 1439 0.61 0.88 0.52 181 T_MONEY_PERCENT 1427 0.48 0.87 0.35 182 TR_LOTS_OF_MONEY2 1427 0.48 0.87 0.35 183 TR_Mismatch_TLD_01 1413 0.37 0.86 0.21 184 DIET_1 1401 0.68 0.85 0.62 185 XMBdyGiftCard01 1367 1.04 0.83 1.10 186 NML_ADSP_CUSTOM_MED 1320 0.74 0.80 0.71 187 XM_ProductURIs 1293 0.67 0.79 0.64 188 XM_XX_Yahoo 1250 0.24 0.76 0.08 189 RELAYCOUNTRY_RU 1242 0.22 0.76 0.05 190 TR_XM_RelayPhish 1230 0.29 0.75 0.15 191 XM_H_PHPOS_M 1228 0.30 0.75 0.16 192 THIS_AD 1220 0.37 0.74 0.25 193 XMBody_78 1204 0.42 0.73 0.32 194 XMPhish30 1187 0.61 0.72 0.57 195 RCVD_IN_MSPIKE_L5 1186 0.19 0.72 0.02 196 XM_UB95 1186 0.18 0.72 0.01 197 TR_XM_DK_Bayes1 1183 11.08 0.72 14.34 198 URI_TRY_3LD 1180 1.25 0.72 1.42 199 TR_XM_MaxBayes 1174 0.18 0.72 0.01 200 XM_UB99 1132 0.17 0.69 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 465160 90.75 95.68 89.20 2 RELAYCOUNTRY_US 418915 74.86 57.50 80.33 3 DKIM_SIGNED 386257 71.07 61.56 74.07 4 XM_DK_Pass 380083 69.48 58.66 72.88 5 XM_B_Unicode 362824 71.76 78.71 69.57 6 DKIM_VALID 357047 64.08 50.14 68.47 7 DCC_CHECK_NEGATIVE 301909 51.87 32.74 57.89 8 BAYES_50 268054 53.13 58.62 51.40 9 DKIM_VALID_AU 265296 47.44 36.54 50.87 10 XMListUnsubscribeExists 262597 50.77 52.10 50.35 11 XM_B_Unicode3 210211 44.38 57.32 40.31 12 DCC_CHECK 207530 46.05 65.92 39.79 13 T_TM2_M_HEADER_IN_MSG 153713 26.04 15.12 29.48 14 HTML_FONT_LOW_CONTRAST 138597 26.05 24.38 26.58 15 DKIM_VALID_EF 137819 25.03 20.57 26.43 16 LOC_TINY_FONT_1 121018 23.73 25.38 23.21 17 BAYES_00 113809 16.98 1.60 21.82 18 MIME_HTML_ONLY 108912 27.86 50.01 20.88 19 FVGT_m_MULTI_ODD 106380 20.19 19.52 20.40 20 XMSubLong 105026 20.52 21.73 20.14 21 T_KAM_HTML_FONT_INVALID 93579 17.90 17.75 17.94 22 ALL_TRUSTED 80350 18.00 26.23 15.41 23 TR_XM_DK_Bayes 80139 11.97 1.16 15.37 24 URIBL_RHS_DOB 77621 20.37 37.81 14.88 25 TR_XM_DK_Bayes1 74790 11.08 0.72 14.34 26 TR_XM_DK_Bayes2 64775 9.60 0.65 12.42 27 XM_Body_Dirty_Words 64207 13.16 15.86 12.31 28 XM_Multi_Part_URI 58274 11.68 13.30 11.17 29 XM_B_Unsub 55903 14.31 25.71 10.72 30 RCVD_IN_MSPIKE_H2 53710 9.09 5.25 10.30 31 RCVD_IN_MSPIKE_H3 49610 7.81 2.39 9.51 32 RCVD_IN_MSPIKE_WL 49610 7.81 2.39 9.51 33 LOTS_OF_MONEY 45650 9.09 10.15 8.75 34 XM_Evil_Numbers_Gen 45232 8.63 8.50 8.67 35 RCVD_IN_RP_SAFE 44997 6.90 1.42 8.63 36 TooManyTo_001 43282 7.69 5.77 8.30 37 RCVD_IN_RP_CERTIFIED 41554 6.36 1.24 7.97 38 LotsOfNums_01 41380 7.83 7.52 7.93 39 HTML_IMAGE_RATIO_02 37505 11.66 25.88 7.19 40 XM_DKIMWhitelistDomains 36005 5.26 0.04 6.90 41 FSL_BULK_SIG 35767 9.47 17.79 6.86 42 XM_B_Phish_Phrases 34788 6.41 5.59 6.67 43 XM_SendGrid 34072 5.86 3.73 6.53 44 XM_DK_Undo_02 34009 11.85 28.77 6.52 45 XM_H_Long_From01 33587 8.00 12.95 6.44 46 BAYES_40 31780 5.32 2.87 6.09 47 RELAYCOUNTRY_META 31737 8.68 16.92 6.09 48 MIME_QP_LONG_LINE 31558 7.63 12.63 6.05 49 DKIM_INVALID 29210 6.99 11.42 5.60 50 MPART_ALT_DIFF 28342 5.43 5.42 5.43 51 HTML_IMAGE_RATIO_04 28327 5.20 4.46 5.43 52 BAYES_20 26264 4.37 2.24 5.04 53 RCVD_IN_IADB_LISTED 26020 4.22 1.79 4.99 54 XM_PDF 25652 3.96 0.93 4.92 55 BAYES_60 24521 4.85 5.31 4.70 56 T_TooManySym_01 23215 3.93 2.26 4.45 57 XMStrtUSub 22994 7.88 18.90 4.41 58 HTML_IMAGE_RATIO_06 22960 3.96 2.56 4.40 59 RCVD_IN_IADB_SPF 22577 3.70 1.69 4.33 60 BOTNET_IPINHOSTNAME 21309 5.86 11.50 4.09 61 IN_ZIMBRA_NJ_WHITELIST 20647 3.01 0.01 3.96 62 XMSexyCombo_05 20110 4.91 8.28 3.86 63 RCVD_IN_IADB_SENDERID 19694 3.27 1.65 3.78 64 RCVD_IN_IADB_DK 19393 3.22 1.66 3.72 65 T_REMOTE_IMAGE 18706 3.62 3.74 3.59 66 BAYES_05 18445 2.95 1.08 3.54 67 TR_XM_DK_SendGrid 18417 3.06 1.55 3.53 68 NO_DNS_FOR_FROM 17259 4.52 8.36 3.31 69 RCVD_IN_IADB_VOUCHED 16906 2.57 0.42 3.24 70 XMNumbers 16743 3.44 4.17 3.21 71 XMSubMetaSx_00 16486 3.62 5.09 3.16 72 TM2_M_URI_OPT_OUT 16194 3.11 3.12 3.11 73 MIME_HTML_ONLY_MULTI 15846 2.85 2.25 3.04 74 BAYES_99 15844 6.78 18.67 3.04 75 XM_UncommonTLD01 15654 5.02 11.44 3.00 76 FROM_EXCESS_BASE64 14392 2.71 2.55 2.76 77 MIME_HTML_MOSTLY 14231 2.91 3.47 2.73 78 BOTNET 14125 5.89 15.99 2.71 79 XM_H_Trusted_IP 13887 2.03 0.00 2.66 80 BAYES_80 13341 3.42 6.15 2.56 81 HTML_MIME_NO_HTML_TAG 13069 2.72 3.39 2.51 82 BAYES_999 12736 5.20 13.97 2.44 83 MAILING_LIST_MULTI 12702 2.23 1.58 2.44 84 XM_B_Unsub2 12621 2.30 1.91 2.42 85 HTML_IMAGE_RATIO_08 12591 2.33 2.05 2.41 86 XM_CamelCaseFrm001 12534 4.47 11.05 2.40 87 UNPARSEABLE_RELAY 12386 2.04 0.97 2.38 88 ANY_BOUNCE_MESSAGE 11826 1.82 0.38 2.27 89 BOUNCE_MESSAGE 11824 1.81 0.38 2.27 90 KHOP_HELO_FCRDNS 11176 2.64 4.23 2.14 91 XM_B_SpammyTLD 11122 2.61 4.11 2.13 92 T_TooManySym_02 10929 1.74 0.61 2.10 93 RCVD_IN_IADB_OPTIN 10910 1.66 0.31 2.09 94 XMDiploma_00 10791 2.02 1.88 2.07 95 TooManyTo_002 10548 1.64 0.40 2.02 96 RELAYCOUNTRY_CA 10372 2.37 3.58 1.99 97 XM_DK_Undo_01 9851 1.68 1.02 1.89 98 XM_SPF_SoftFail 9629 2.61 5.02 1.85 99 TR_MetaPhish_Combo_01 9460 1.85 1.96 1.81 100 TVD_RCVD_IP 9412 1.51 0.57 1.80 101 HELO_NODOT 9197 1.47 0.53 1.76 102 HELO_NO_DOMAIN 9153 1.46 0.53 1.76 103 UNTRUSTED_Relay 9075 4.20 12.03 1.74 104 SUBJ_ALL_CAPS 8533 1.63 1.62 1.64 105 T_XMDrugObfuBody_14 8531 1.64 1.63 1.64 106 BAYES_95 8485 2.01 3.23 1.63 107 TR_DCC_Bayes_99 7977 4.33 13.25 1.53 108 IN_HORDE_ADDRESS_BOOK 7775 1.14 0.01 1.49 109 XMSubNoVowel 7716 1.22 0.40 1.48 110 T_XMDrugObfuBody_08 7701 1.70 2.41 1.48 111 INVALID_MSGID 7653 1.17 0.22 1.47 112 URI_TRY_3LD 7418 1.25 0.72 1.42 113 TooManyTo_003 7248 1.13 0.31 1.39 114 XMCapTrack 7245 1.52 1.94 1.39 115 TO_MALFORMED 7085 1.05 0.06 1.36 116 XM_OfRef6 7048 1.53 2.08 1.35 117 TR_Symld_Words 6936 1.28 1.11 1.33 118 XMPhish14 6663 1.41 1.81 1.28 119 CK_HELO_DYNAMIC_SPLIT_IP 6468 0.96 0.07 1.24 120 HELO_DYNAMIC_IPADDR2 6465 0.95 0.02 1.24 121 XMGenDplmaNmb 6347 1.22 1.25 1.22 122 XM_GoogleGroups 6343 1.02 0.38 1.22 123 URI_HEX 5910 1.51 2.72 1.13 124 TM2_M_VERY_LONG_WORD 5792 1.17 1.38 1.11 125 XMBdyGiftCard01 5738 1.04 0.83 1.10 126 XMGappySubj_01 5681 0.87 0.17 1.09 127 TR_XM_PHPDW 5667 1.30 1.97 1.09 128 FILL_THIS_FORM_SHORT 5637 1.04 0.91 1.08 129 XM_H_Long_From02 5565 1.03 0.93 1.07 130 TR_XM_PHPForged 5542 1.25 1.83 1.06 131 TR_XM_FormFill2 5507 1.23 1.79 1.06 132 XM_H_PHPOS 5494 1.23 1.79 1.05 133 TR_MSPIKEBAYES00 5468 0.80 0.01 1.05 134 TooManyTo_004 5395 0.85 0.26 1.03 135 XMNoVowels 5187 1.03 1.15 0.99 136 RELAYCOUNTRY_GB 5085 0.96 0.91 0.98 137 XM_UB50 5065 2.27 6.38 0.97 138 DKIM_ADSP_CUSTOM_MED 5048 0.99 1.05 0.97 139 RCVD_IN_BL_SPAMCOP_NET 4953 1.45 3.05 0.95 140 XMSubject_78 4914 0.94 0.92 0.94 141 RCVD_IN_MSPIKE_BL 4912 1.53 3.41 0.94 142 TO_IN_SUBJ 4695 1.07 1.62 0.90 143 USER_IN_DEF_DKIM_WL 4691 0.68 0.00 0.90 144 XMStockSpam_06 4656 4.68 16.72 0.89 145 TooManyTo_005 4539 0.72 0.23 0.87 146 HTML_FONT_FACE_BAD 4466 0.78 0.52 0.86 147 XMSubMetaI_00 4009 0.83 1.04 0.77 148 RELAYCOUNTRY_AU 4001 0.71 0.53 0.77 149 SpammyFromTLD_01 3990 1.04 1.92 0.77 150 TR_LOTS_OF_MONEY3 3930 0.84 1.11 0.75 151 TO_NO_BRKTS_HTML_ONLY 3775 0.58 0.13 0.72 152 T_XMHurry_00 3751 0.83 1.17 0.72 153 NML_ADSP_CUSTOM_MED 3727 0.74 0.80 0.71 154 XMBody_95 3713 0.56 0.07 0.71 155 XMHTML_After_End 3601 1.10 2.40 0.69 156 XMHTMLBadTable_001 3494 0.63 0.52 0.67 157 HTTPS_HTTP_MISMATCH 3450 0.67 0.68 0.66 158 XM_SPF_Unknown 3443 0.66 0.66 0.66 159 T_XMDrugObfuBody_00 3440 0.75 1.02 0.66 160 RCVD_IN_MSPIKE_L3 3361 1.10 2.53 0.64 161 XM_ProductURIs 3323 0.67 0.79 0.64 162 T_Symld_Words_02 3254 0.72 1.02 0.62 163 DIET_1 3238 0.68 0.85 0.62 164 T_OBFU_PDF_ATTACH 3165 0.50 0.15 0.61 165 XMMoneyMeta_00 3141 0.78 1.36 0.60 166 PLING_QUERY 3139 0.60 0.57 0.60 167 XMBody_17 3088 0.81 1.52 0.59 168 XM_H_PHPMailer 3054 0.68 0.98 0.59 169 XMPhish30 2986 0.61 0.72 0.57 170 T_HTML_ATTACH 2930 6.14 23.88 0.56 171 FROM_GOV_DKIM_AU 2852 0.43 0.07 0.55 172 HTML_IMAGE_ONLY_20 2849 0.47 0.22 0.55 173 RELAYCOUNTRY_DE 2835 0.65 0.98 0.54 174 XMSolicitRefs_0 2817 0.50 0.37 0.54 175 XM_DIRTYINTL 2806 1.01 2.52 0.54 176 FILL_THIS_FORM 2746 0.44 0.17 0.53 177 FROM_GOV_SPOOF 2743 0.46 0.27 0.53 178 XMBrknScrpt_02 2724 0.61 0.88 0.52 179 XM_ShortIntro_01 2723 0.46 0.26 0.52 180 HTML_IMAGE_ONLY_32 2717 0.44 0.19 0.52 181 XMPhish08 2713 0.63 0.99 0.52 182 MISSING_HEADERS 2681 0.51 0.50 0.51 183 USER_IN_WHITELIST 2591 0.38 0.00 0.50 184 HTML_IMAGE_ONLY_28 2585 0.45 0.32 0.50 185 BASE64_LENGTH_79_INF 2551 0.42 0.19 0.49 186 HTML_TAG_BALANCE_BODY 2478 0.49 0.53 0.48 187 XMSexyCombo_01 2472 0.74 1.57 0.47 188 XM_B_REG_HTML 2456 0.45 0.37 0.47 189 T_TooManySym_03 2429 0.39 0.15 0.47 190 SHORT_HELO_AND_INLINE_IMAGE 2381 0.36 0.04 0.46 191 FORGED_GMAIL_RCVD 2347 0.57 0.94 0.45 192 TM2_M_BODY_EMPTY 2290 0.37 0.15 0.44 193 XMLngstWrd_00 2170 0.38 0.29 0.42 194 URIBL_SBL_A 2142 0.63 1.32 0.41 195 XM_Body_Obfu01 2079 0.38 0.31 0.40 196 XMSubMetaSxObfu_03 2068 0.43 0.54 0.40 197 XMDateMe_00 2049 0.36 0.27 0.39 198 FILL_THIS_FORM_LONG 2015 0.32 0.11 0.39 199 PDS_OTHER_BAD_TLD 2015 1.27 4.09 0.39 200 XMLngstWrd_01 1981 0.35 0.26 0.38 ----------------------------------------------------------------------