Email: 397829 Autolearn: 0 AvgScore: 0.68 AvgScanTime: 1.79 sec Spam: 64161 Autolearn: 0 AvgScore: 11.83 AvgScanTime: 3.29 sec Ham: 333668 Autolearn: 0 AvgScore: -1.46 AvgScanTime: 1.51 sec Time Spent Running SA: 198.24 hours Time Spent Processing Spam: 58.59 hours Time Spent Processing Ham: 139.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 58625 88.50 91.37 87.95 2 DKIM_SIGNED 50392 71.98 78.54 70.72 3 XM_DK_Pass 49186 70.82 76.66 69.69 4 XM_B_Unicode 49039 75.06 76.43 74.80 5 DCC_CHECK 47519 48.41 74.06 43.47 6 RELAYCOUNTRY_US 46814 74.86 72.96 75.23 7 XMListUnsubscribeExists 42769 52.66 66.66 49.96 8 DKIM_VALID 42107 66.61 65.63 66.80 9 DKIM_VALID_AU 32918 53.68 51.31 54.13 10 XM_B_Unicode3 31255 49.96 48.71 50.20 11 BAYES_50 27849 51.89 43.40 53.52 12 XM_DK_Undo_02 25705 12.54 40.06 7.25 13 MIME_HTML_ONLY 23546 32.94 36.70 32.22 14 LOC_TINY_FONT_1 22516 27.74 35.09 26.33 15 HTML_FONT_LOW_CONTRAST 20320 37.58 31.67 38.72 16 FVGT_m_MULTI_ODD 17279 20.22 26.93 18.92 17 DKIM_VALID_EF 16440 24.62 25.62 24.43 18 RELAYCOUNTRY_META 16191 7.89 25.23 4.56 19 BAYES_99 16166 7.60 25.20 4.21 20 DCC_CHECK_NEGATIVE 15903 50.58 24.79 55.54 21 BOTNET 14928 5.73 23.27 2.36 22 XMSubLong 14613 19.73 22.78 19.14 23 XM_Multi_Part_URI 13411 21.26 20.90 21.33 24 T_KAM_HTML_FONT_INVALID 13118 15.39 20.45 14.42 25 XM_Body_Dirty_Words 12475 14.20 19.44 13.19 26 BAYES_999 12364 6.07 19.27 3.53 27 TR_DCC_Bayes_99 12187 5.19 18.99 2.53 28 T_TM2_M_HEADER_IN_MSG 11758 23.82 18.33 24.87 29 XM_UncommonTLD01 11175 5.94 17.42 3.73 30 HTML_IMAGE_RATIO_02 11137 11.17 17.36 9.98 31 UNTRUSTED_Relay 11131 4.17 17.35 1.63 32 BOTNET_IPINHOSTNAME 9861 6.52 15.37 4.82 33 XM_B_Unsub 9131 11.47 14.23 10.94 34 DKIM_INVALID 8285 5.36 12.91 3.91 35 FSL_BULK_SIG 7853 9.47 12.24 8.94 36 LOTS_OF_MONEY 6891 8.64 10.74 8.24 37 XM_Evil_Numbers_Gen 6811 10.91 10.62 10.96 38 XMSexyCombo_05 6754 5.74 10.53 4.82 39 XM_B_Phish_Phrases 6596 16.24 10.28 17.39 40 XM_UB50 6415 2.34 10.00 0.87 41 NO_DNS_FOR_FROM 6149 3.52 9.58 2.36 42 BAYES_80 5170 3.23 8.06 2.30 43 TooManyTo_001 4804 6.31 7.49 6.08 44 BAYES_60 4489 4.91 7.00 4.51 45 XM_B_SpammyTLD 4417 7.72 6.88 7.88 46 RCVD_IN_MSPIKE_H2 4272 8.30 6.66 8.62 47 XM_H_Long_From01 4233 5.72 6.60 5.56 48 LotsOfNums_01 4233 7.02 6.60 7.10 49 SpammyFromTLD_02 4196 1.23 6.54 0.21 50 MIME_QP_LONG_LINE 4028 11.29 6.28 12.26 51 MPART_ALT_DIFF 3918 7.32 6.11 7.56 52 HTML_IMAGE_RATIO_04 3874 6.27 6.04 6.31 53 RCVD_IN_RP_RNBL 3852 1.08 6.00 0.13 54 MIME_HTML_MOSTLY 3841 3.83 5.99 3.42 55 RELAYCOUNTRY_CA 3694 2.23 5.76 1.55 56 XM_CamelCaseFrm001 3646 2.56 5.68 1.96 57 TM2_M_URI_OPT_OUT 3551 13.00 5.53 14.44 58 XMSubMetaSx_00 3454 3.75 5.38 3.44 59 XM_SPF_SoftFail 3416 1.81 5.32 1.13 60 XM_SendGrid 3374 5.92 5.26 6.05 61 RCVD_IN_BL_SPAMCOP_NET 3229 1.45 5.03 0.76 62 KHOP_HELO_FCRDNS 3219 1.63 5.02 0.97 63 T_REMOTE_IMAGE 3157 3.47 4.92 3.19 64 RCVD_IN_MSPIKE_BL 3001 1.43 4.68 0.80 65 FROM_EXCESS_BASE64 2822 11.11 4.40 12.40 66 PDS_OTHER_BAD_TLD 2813 1.22 4.38 0.61 67 XMHTML_After_End 2700 8.49 4.21 9.32 68 XM_B_Unsub2 2623 1.63 4.09 1.16 69 XMNumbers 2596 4.26 4.05 4.30 70 BAYES_40 2541 4.64 3.96 4.77 71 BAYES_95 2484 1.84 3.87 1.45 72 XMStrtUSub 2472 5.43 3.85 5.73 73 RCVD_IN_MSPIKE_L3 2436 1.12 3.80 0.60 74 ALL_TRUSTED 2396 18.57 3.73 21.42 75 BOTNET_NORDNS 2394 0.62 3.73 0.02 76 RCVD_IN_RP_SAFE 2373 10.46 3.70 11.76 77 HTML_IMAGE_RATIO_06 2370 3.88 3.69 3.92 78 FROM_SUSPICIOUS_NTLD 2328 0.61 3.63 0.02 79 XM_DIRTYINTL 2296 0.99 3.58 0.49 80 BAYES_20 2244 3.86 3.50 3.93 81 RCVD_IN_PSBL 2222 0.61 3.46 0.06 82 FROM_SUSPICIOUS_NTLD_FP 2063 0.54 3.22 0.02 83 RELAYCOUNTRY_FR 2000 0.70 3.12 0.23 84 HTML_MIME_NO_HTML_TAG 1902 2.06 2.96 1.89 85 TR_XM_PHPDW 1861 0.86 2.90 0.46 86 SpammyFromTLD_01 1859 0.74 2.90 0.33 87 TR_Mismatch_TLD_02 1841 0.52 2.87 0.07 88 RCVD_IN_RP_CERTIFIED 1766 9.45 2.75 10.74 89 MIME_HTML_ONLY_MULTI 1765 4.60 2.75 4.96 90 BAYES_00 1744 19.33 2.72 22.52 91 TR_XM_INV_DKIM 1721 0.53 2.68 0.11 92 TR_XM_PHPForged 1694 0.81 2.64 0.46 93 URIBL_SBL_A 1669 0.56 2.60 0.17 94 TR_XM_FormFill2 1667 0.80 2.60 0.45 95 XM_H_PHPOS 1662 0.79 2.59 0.45 96 XM_URI_RBL 1648 0.57 2.57 0.19 97 REPLYTO_WITHOUT_TO_CC 1641 0.47 2.56 0.07 98 XMBody_17 1629 0.90 2.54 0.58 99 RELAYCOUNTRY_IN 1615 0.46 2.52 0.07 100 HTML_IMAGE_RATIO_08 1614 2.05 2.52 1.96 101 XM_H_PHPMailer 1608 8.12 2.51 9.20 102 T_TooManySym_01 1574 4.51 2.45 4.90 103 RCVD_IN_MSPIKE_H3 1573 8.20 2.45 9.31 104 RCVD_IN_MSPIKE_WL 1573 8.20 2.45 9.31 105 FROM_MISSP_REPLYTO 1536 0.41 2.39 0.03 106 XMLngstWrd_00 1528 0.99 2.38 0.72 107 RELAYCOUNTRY_DE 1518 0.87 2.37 0.58 108 BODY_URI_ONLY 1516 0.41 2.36 0.04 109 URI_HEX 1509 1.33 2.35 1.14 110 XMLngstWrd_01 1506 0.90 2.35 0.63 111 TR_XM_DK_SendGrid 1449 3.20 2.26 3.39 112 TR_XM_RelayPhish 1447 0.47 2.26 0.13 113 URI_OPTOUT_3LD 1410 0.57 2.20 0.25 114 TM2_M_VERY_LONG_WORD 1407 1.45 2.19 1.31 115 MY_SERVERS_FOUND 1400 0.52 2.18 0.20 116 URI_TRY_3LD 1397 1.28 2.18 1.11 117 BAYES_05 1380 2.61 2.15 2.69 118 XMNoVowels 1372 1.81 2.14 1.74 119 T_XMDrugObfuBody_08 1366 1.39 2.13 1.24 120 XMSexyCombo_01 1326 0.84 2.07 0.60 121 TR_XM_DK_Bayes 1305 13.94 2.03 16.23 122 LongTLD 1299 0.44 2.02 0.14 123 XMStockSpam_06 1252 1.66 1.95 1.61 124 XM_UB60 1241 0.42 1.93 0.12 125 XM_BadFromFormat 1234 0.43 1.92 0.14 126 XMSubMetaI_00 1198 1.34 1.87 1.24 127 XMDiploma_00 1196 1.42 1.86 1.34 128 T_XMHurry_00 1183 0.82 1.84 0.62 129 TR_XM_MaxBayes 1179 0.31 1.84 0.01 130 XMSlimDrugH 1177 0.51 1.83 0.26 131 DKIM_ADSP_NXDOMAIN 1169 0.69 1.82 0.47 132 XM_OfRef6 1167 1.97 1.82 2.00 133 XM_H_PHPOS_M 1160 0.45 1.81 0.19 134 DATE_IN_PAST_03_06 1155 0.37 1.80 0.10 135 SUBJ_ALL_CAPS 1123 1.52 1.75 1.47 136 T_XMDrugObfuBody_14 1118 1.63 1.74 1.61 137 DATE_IN_PAST_06_12 1108 0.35 1.73 0.09 138 DKIM_ADSP_CUSTOM_MED 1065 1.16 1.66 1.06 139 XM_ProductURIs 1065 1.14 1.66 1.05 140 MAILING_LIST_MULTI 1061 1.91 1.65 1.96 141 DIET_1 1060 0.74 1.65 0.56 142 LONG_JUNK_URI2 1045 0.33 1.63 0.07 143 XMBrknScrpt_02 1012 1.08 1.58 0.98 144 HTML_IMAGE_ONLY_12 978 0.35 1.52 0.13 145 NML_ADSP_CUSTOM_MED 948 0.84 1.48 0.72 146 FORGED_GMAIL_RCVD 927 0.70 1.44 0.56 147 TR_LOTS_OF_MONEY3 925 0.73 1.44 0.59 148 RCVD_IN_IADB_LISTED 924 2.89 1.44 3.17 149 TR_Mismatch_TLD_01 915 0.41 1.43 0.22 150 XMBdyGiftCard01 899 2.14 1.40 2.29 151 HTML_SHORT_LINK_IMG_1 891 0.24 1.39 0.02 152 RELAYCOUNTRY_AT 880 0.34 1.37 0.15 153 TR_Symld_Words 880 1.10 1.37 1.05 154 T_Symld_Words_02 871 0.61 1.36 0.46 155 UNPARSEABLE_RELAY 845 2.65 1.32 2.91 156 RCVD_IN_IADB_SPF 842 2.51 1.31 2.74 157 MIME_HEADER_CTYPE_ONLY 829 0.34 1.29 0.16 158 RCVD_IN_IADB_SENDERID 827 2.24 1.29 2.43 159 RCVD_IN_IADB_DK 824 2.18 1.28 2.35 160 BASE64_LENGTH_79_INF 816 0.44 1.27 0.28 161 XM_Combo_Sbj 812 0.42 1.27 0.25 162 XMMoneyMeta_00 800 0.35 1.25 0.18 163 XM_UB80 800 0.22 1.25 0.02 164 TR_XM_DK_Bayes1 795 13.19 1.24 15.49 165 XMGenDplmaNmb 788 0.94 1.23 0.88 166 HDRS_LCASE_IMGONLY 787 0.21 1.23 0.01 167 TO_EQ_FM_DOM_HTML_IMG 774 0.22 1.21 0.02 168 RDNS_DYNAMIC 766 0.49 1.19 0.35 169 TR_XM_DK_Bayes2 756 12.23 1.18 14.35 170 SHORT_SHORTNER 739 0.22 1.15 0.04 171 MISSING_HEADERS 736 0.46 1.15 0.32 172 XMBSHREFv2 730 0.55 1.14 0.44 173 URIBL_BLACK 724 0.19 1.13 0.01 174 XMSubNoVowel 723 1.57 1.13 1.66 175 FILL_THIS_FORM_SHORT 721 1.05 1.12 1.04 176 XM_DK_Undo_01 721 1.38 1.12 1.42 177 MPART_ALT_DIFF_COUNT 703 0.48 1.10 0.36 178 HK_RANDOM_REPLYTO 690 0.31 1.08 0.16 179 BAD_ENC_HEADER 683 0.19 1.06 0.02 180 RELAYCOUNTRY_GB 675 0.67 1.05 0.60 181 T_XMDrugObfuBody_00 652 0.80 1.02 0.76 182 XM_B_REG_HTML 642 0.89 1.00 0.87 183 URIBL_DBL_SPAM 641 0.21 1.00 0.06 184 XM_H_Long_From02 628 1.21 0.98 1.25 185 XM_B_COPY_HTML 616 0.50 0.96 0.42 186 TO_NO_BRKTS_FROM_MSSP 607 0.16 0.95 0.01 187 XM_XX_Yahoo 598 0.23 0.93 0.10 188 XMPhish30 594 0.55 0.93 0.48 189 FROM_MISSP_EH_MATCH 593 0.15 0.92 0.01 190 XMBody_78 590 0.43 0.92 0.34 191 XMPhish08 584 0.76 0.91 0.73 192 T_TooManySym_02 568 2.50 0.89 2.81 193 XMLngstWrd_02 568 0.55 0.89 0.49 194 T_MONEY_PERCENT 562 0.34 0.88 0.24 195 TR_LOTS_OF_MONEY2 562 0.34 0.88 0.24 196 XMSexyCombo_04 556 0.24 0.87 0.12 197 SHOPIFY_IMG_NOT_RCVD_SFY 537 0.27 0.84 0.16 198 PLING_QUERY 530 0.38 0.83 0.30 199 MIME_CHARSET_FARAWAY 530 0.24 0.83 0.13 200 NUMERIC_HTTP_ADDR 525 0.32 0.82 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 293463 88.50 91.37 87.95 2 RELAYCOUNTRY_US 251018 74.86 72.96 75.23 3 XM_B_Unicode 249574 75.06 76.43 74.80 4 DKIM_SIGNED 235963 71.98 78.54 70.72 5 XM_DK_Pass 232542 70.82 76.66 69.69 6 DKIM_VALID 222906 66.61 65.63 66.80 7 DCC_CHECK_NEGATIVE 185311 50.58 24.79 55.54 8 DKIM_VALID_AU 180628 53.68 51.31 54.13 9 BAYES_50 178575 51.89 43.40 53.52 10 XM_B_Unicode3 167500 49.96 48.71 50.20 11 XMListUnsubscribeExists 166713 52.66 66.66 49.96 12 DCC_CHECK 145055 48.41 74.06 43.47 13 HTML_FONT_LOW_CONTRAST 129204 37.58 31.67 38.72 14 MIME_HTML_ONLY 107494 32.94 36.70 32.22 15 LOC_TINY_FONT_1 87847 27.74 35.09 26.33 16 T_TM2_M_HEADER_IN_MSG 82999 23.82 18.33 24.87 17 DKIM_VALID_EF 81516 24.62 25.62 24.43 18 BAYES_00 75142 19.33 2.72 22.52 19 ALL_TRUSTED 71476 18.57 3.73 21.42 20 XM_Multi_Part_URI 71182 21.26 20.90 21.33 21 XMSubLong 63878 19.73 22.78 19.14 22 FVGT_m_MULTI_ODD 63143 20.22 26.93 18.92 23 XM_B_Phish_Phrases 58025 16.24 10.28 17.39 24 TR_XM_DK_Bayes 54158 13.94 2.03 16.23 25 TR_XM_DK_Bayes1 51685 13.19 1.24 15.49 26 TM2_M_URI_OPT_OUT 48171 13.00 5.53 14.44 27 T_KAM_HTML_FONT_INVALID 48110 15.39 20.45 14.42 28 TR_XM_DK_Bayes2 47886 12.23 1.18 14.35 29 XM_Body_Dirty_Words 44023 14.20 19.44 13.19 30 FROM_EXCESS_BASE64 41366 11.11 4.40 12.40 31 MIME_QP_LONG_LINE 40892 11.29 6.28 12.26 32 RCVD_IN_RP_SAFE 39254 10.46 3.70 11.76 33 XM_Evil_Numbers_Gen 36584 10.91 10.62 10.96 34 XM_B_Unsub 36494 11.47 14.23 10.94 35 RCVD_IN_RP_CERTIFIED 35829 9.45 2.75 10.74 36 XM_DKIMWhitelistDomains 33561 8.44 0.03 10.06 37 HTML_IMAGE_RATIO_02 33298 11.17 17.36 9.98 38 XMHTML_After_End 31087 8.49 4.21 9.32 39 RCVD_IN_MSPIKE_WL 31065 8.20 2.45 9.31 40 RCVD_IN_MSPIKE_H3 31065 8.20 2.45 9.31 41 XM_H_PHPMailer 30705 8.12 2.51 9.20 42 FSL_BULK_SIG 29824 9.47 12.24 8.94 43 RCVD_IN_MSPIKE_H2 28764 8.30 6.66 8.62 44 LOTS_OF_MONEY 27491 8.64 10.74 8.24 45 XM_B_SpammyTLD 26291 7.72 6.88 7.88 46 MPART_ALT_DIFF 25215 7.32 6.11 7.56 47 XM_DK_Undo_02 24200 12.54 40.06 7.25 48 LotsOfNums_01 23688 7.02 6.60 7.10 49 HTML_IMAGE_RATIO_04 21061 6.27 6.04 6.31 50 TooManyTo_001 20284 6.31 7.49 6.08 51 XM_SendGrid 20187 5.92 5.26 6.05 52 XMStrtUSub 19133 5.43 3.85 5.73 53 XM_H_Long_From01 18536 5.72 6.60 5.56 54 MIME_HTML_ONLY_MULTI 16547 4.60 2.75 4.96 55 T_TooManySym_01 16355 4.51 2.45 4.90 56 XMSexyCombo_05 16094 5.74 10.53 4.82 57 BOTNET_IPINHOSTNAME 16070 6.52 15.37 4.82 58 BAYES_40 15916 4.64 3.96 4.77 59 RELAYCOUNTRY_META 15214 7.89 25.23 4.56 60 BAYES_60 15044 4.91 7.00 4.51 61 XM_H_Trusted_IP 14921 3.75 0.00 4.47 62 XMNumbers 14355 4.26 4.05 4.30 63 BAYES_99 14058 7.60 25.20 4.21 64 BAYES_20 13129 3.86 3.50 3.93 65 HTML_IMAGE_RATIO_06 13084 3.88 3.69 3.92 66 DKIM_INVALID 13057 5.36 12.91 3.91 67 XM_UncommonTLD01 12440 5.94 17.42 3.73 68 BAYES_999 11793 6.07 19.27 3.53 69 XMSubMetaSx_00 11483 3.75 5.38 3.44 70 MIME_HTML_MOSTLY 11400 3.83 5.99 3.42 71 TR_XM_DK_SendGrid 11297 3.20 2.26 3.39 72 T_REMOTE_IMAGE 10633 3.47 4.92 3.19 73 RCVD_IN_IADB_LISTED 10576 2.89 1.44 3.17 74 UNPARSEABLE_RELAY 9709 2.65 1.32 2.91 75 T_TooManySym_02 9367 2.50 0.89 2.81 76 RCVD_IN_IADB_SPF 9159 2.51 1.31 2.74 77 IN_ZIMBRA_NJ_WHITELIST 9108 2.29 0.01 2.73 78 BAYES_05 8990 2.61 2.15 2.69 79 XM_PDF 8878 2.32 0.53 2.66 80 TR_DCC_Bayes_99 8442 5.19 18.99 2.53 81 BOUNCE_MESSAGE 8252 2.14 0.39 2.47 82 ANY_BOUNCE_MESSAGE 8252 2.14 0.39 2.47 83 RCVD_IN_IADB_SENDERID 8099 2.24 1.29 2.43 84 BOTNET 7860 5.73 23.27 2.36 85 NO_DNS_FOR_FROM 7858 3.52 9.58 2.36 86 RCVD_IN_IADB_DK 7847 2.18 1.28 2.35 87 TVD_RCVD_IP 7704 2.06 0.78 2.31 88 BAYES_80 7686 3.23 8.06 2.30 89 XMBdyGiftCard01 7631 2.14 1.40 2.29 90 INVALID_MSGID 7431 1.91 0.24 2.23 91 TO_MALFORMED 7313 1.86 0.12 2.19 92 RCVD_IN_IADB_VOUCHED 6788 1.77 0.40 2.03 93 CK_HELO_DYNAMIC_SPLIT_IP 6715 1.73 0.26 2.01 94 HELO_DYNAMIC_IPADDR2 6711 1.70 0.08 2.01 95 XM_OfRef6 6686 1.97 1.82 2.00 96 XM_CamelCaseFrm001 6548 2.56 5.68 1.96 97 HTML_IMAGE_RATIO_08 6531 2.05 2.52 1.96 98 MAILING_LIST_MULTI 6524 1.91 1.65 1.96 99 HTML_MIME_NO_HTML_TAG 6306 2.06 2.96 1.89 100 XMNoVowels 5815 1.81 2.14 1.74 101 XMSubNoVowel 5523 1.57 1.13 1.66 102 UNTRUSTED_Relay 5450 4.17 17.35 1.63 103 IN_HORDE_ADDRESS_BOOK 5392 1.36 0.04 1.62 104 T_XMDrugObfuBody_14 5382 1.63 1.74 1.61 105 XMStockSpam_06 5359 1.66 1.95 1.61 106 RELAYCOUNTRY_CA 5183 2.23 5.76 1.55 107 USER_IN_DEF_DKIM_WL 5164 1.30 0.00 1.55 108 SUBJ_ALL_CAPS 4909 1.52 1.75 1.47 109 BAYES_95 4854 1.84 3.87 1.45 110 XM_DK_Undo_01 4752 1.38 1.12 1.42 111 XMDiploma_00 4473 1.42 1.86 1.34 112 TM2_M_VERY_LONG_WORD 4379 1.45 2.19 1.31 113 RCVD_IN_IADB_OPTIN 4345 1.15 0.37 1.30 114 TR_MSPIKEBAYES00 4189 1.05 0.00 1.26 115 XM_H_Long_From02 4166 1.21 0.98 1.25 116 T_XMDrugObfuBody_08 4150 1.39 2.13 1.24 117 XMSubMetaI_00 4143 1.34 1.87 1.24 118 TooManyTo_002 4006 1.10 0.59 1.20 119 XM_B_Unsub2 3864 1.63 4.09 1.16 120 URI_HEX 3790 1.33 2.35 1.14 121 XM_SPF_SoftFail 3779 1.81 5.32 1.13 122 XM_GoogleGroups 3712 1.05 0.74 1.11 123 URI_TRY_3LD 3698 1.28 2.18 1.11 124 DKIM_ADSP_CUSTOM_MED 3541 1.16 1.66 1.06 125 TR_Symld_Words 3515 1.10 1.37 1.05 126 XM_ProductURIs 3487 1.14 1.66 1.05 127 FILL_THIS_FORM_SHORT 3457 1.05 1.12 1.04 128 XMGappySubj_01 3310 0.85 0.11 0.99 129 XMBrknScrpt_02 3284 1.08 1.58 0.98 130 KHOP_HELO_FCRDNS 3251 1.63 5.02 0.97 131 FILL_THIS_FORM 3123 0.88 0.59 0.94 132 XM_SPF_Unknown 3082 0.86 0.52 0.92 133 HTML_FONT_FACE_BAD 2958 0.84 0.57 0.89 134 XMGenDplmaNmb 2943 0.94 1.23 0.88 135 XM_B_REG_HTML 2894 0.89 1.00 0.87 136 XM_UB50 2893 2.34 10.00 0.87 137 TooManyTo_003 2859 0.79 0.47 0.86 138 THIS_AD 2800 0.82 0.71 0.84 139 RCVD_IN_MSPIKE_BL 2672 1.43 4.68 0.80 140 FILL_THIS_FORM_LONG 2595 0.67 0.10 0.78 141 RCVD_IN_BL_SPAMCOP_NET 2551 1.45 5.03 0.76 142 T_XMDrugObfuBody_00 2537 0.80 1.02 0.76 143 T_FILL_THIS_FORM_LOAN 2480 0.64 0.08 0.74 144 XMBody_95 2457 0.64 0.16 0.74 145 XMPhish08 2428 0.76 0.91 0.73 146 XMLngstWrd_00 2400 0.99 2.38 0.72 147 NML_ADSP_CUSTOM_MED 2397 0.84 1.48 0.72 148 TooManyTo_004 2371 0.65 0.35 0.71 149 USER_IN_WHITELIST 2265 0.57 0.00 0.68 150 XM_E_Blogspot 2245 0.59 0.19 0.67 151 TooManyTo_005 2096 0.58 0.31 0.63 152 XMLngstWrd_01 2093 0.90 2.35 0.63 153 T_XMHurry_00 2079 0.82 1.84 0.62 154 PDS_OTHER_BAD_TLD 2040 1.22 4.38 0.61 155 RCVD_IN_MSPIKE_L3 2016 1.12 3.80 0.60 156 XMSexyCombo_01 2009 0.84 2.07 0.60 157 RELAYCOUNTRY_GB 1996 0.67 1.05 0.60 158 TR_LOTS_OF_MONEY3 1979 0.73 1.44 0.59 159 TR_MetaPhish_Combo_01 1974 0.60 0.62 0.59 160 XMBody_17 1949 0.90 2.54 0.58 161 RELAYCOUNTRY_DE 1939 0.87 2.37 0.58 162 XMHTMLBadTable_001 1929 0.60 0.74 0.58 163 DIET_1 1879 0.74 1.65 0.56 164 HTML_TAG_BALANCE_BODY 1873 0.57 0.63 0.56 165 FORGED_GMAIL_RCVD 1860 0.70 1.44 0.56 166 T_TooManySym_03 1811 0.48 0.17 0.54 167 HELO_NODOT 1637 0.49 0.48 0.49 168 XM_DIRTYINTL 1624 0.99 3.58 0.49 169 XMLngstWrd_02 1623 0.55 0.89 0.49 170 XM_RXBody 1595 0.51 0.66 0.48 171 HELO_NO_DOMAIN 1591 0.48 0.48 0.48 172 XMPhish30 1588 0.55 0.93 0.48 173 DKIM_ADSP_NXDOMAIN 1579 0.69 1.82 0.47 174 HTML_IMAGE_ONLY_20 1565 0.48 0.56 0.47 175 T_OBFU_PDF_ATTACH 1551 0.43 0.24 0.46 176 TR_XM_PHPDW 1549 0.86 2.90 0.46 177 T_Symld_Words_02 1544 0.61 1.36 0.46 178 TR_XM_PHPForged 1525 0.81 2.64 0.46 179 XMSubMetaSxObfu_02 1522 0.43 0.28 0.46 180 TR_XM_FormFill2 1501 0.80 2.60 0.45 181 XM_H_PHPOS 1491 0.79 2.59 0.45 182 XMBSHREFv2 1477 0.55 1.14 0.44 183 HTTPS_HTTP_MISMATCH 1453 0.47 0.66 0.44 184 XMCapTrack 1415 0.41 0.32 0.42 185 XM_B_COPY_HTML 1392 0.50 0.96 0.42 186 XMSubMetaSxObfu_03 1328 0.44 0.68 0.40 187 FROM_EGROUPS 1316 0.33 0.00 0.39 188 XMLngstWrd_03 1259 0.39 0.43 0.38 189 XM_Body_Obfu01 1247 0.36 0.26 0.37 190 MPART_ALT_DIFF_COUNT 1201 0.48 1.10 0.36 191 XM_Walgreens_Forge 1197 0.31 0.03 0.36 192 XMRcvdHeader_15 1187 0.30 0.00 0.36 193 RELAYCOUNTRY_AU 1187 0.37 0.46 0.36 194 SUBJ_DOLLARS 1174 0.40 0.67 0.35 195 RDNS_DYNAMIC 1173 0.49 1.19 0.35 196 T_TooManySym_04 1136 0.30 0.08 0.34 197 XMBody_78 1127 0.43 0.92 0.34 198 TM2_M_A_HREF_HREF 1109 0.37 0.57 0.33 199 SpammyFromTLD_01 1091 0.74 2.90 0.33 200 XM_ShortIntro_01 1076 0.31 0.25 0.32 ----------------------------------------------------------------------