Email: 688392 Autolearn: 0 AvgScore: 0.11 AvgScanTime: 1.89 sec Spam: 119761 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 3.42 sec Ham: 568631 Autolearn: 0 AvgScore: -2.51 AvgScanTime: 1.57 sec Time Spent Running SA: 362.35 hours Time Spent Processing Spam: 113.75 hours Time Spent Processing Ham: 248.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 107652 89.84 89.89 89.82 2 DKIM_SIGNED 91267 68.56 76.21 66.95 3 XM_DK_Pass 88705 67.26 74.07 65.83 4 RELAYCOUNTRY_US 88445 79.87 73.85 81.14 5 DCC_CHECK 88376 42.39 73.79 35.77 6 XM_B_Unicode 86278 71.43 72.04 71.30 7 XMListUnsubscribeExists 77840 48.26 65.00 44.74 8 DKIM_VALID 75900 62.41 63.38 62.21 9 DKIM_VALID_AU 57668 46.77 48.15 46.48 10 BAYES_50 53127 46.47 44.36 46.92 11 XM_B_Unicode3 51129 42.38 42.69 42.31 12 XM_DK_Undo_02 47207 12.79 39.42 7.19 13 MIME_HTML_ONLY 43898 24.82 36.65 22.33 14 LOC_TINY_FONT_1 37803 22.27 31.57 20.31 15 HTML_FONT_LOW_CONTRAST 33743 24.75 28.18 24.02 16 XMSubLong 32839 21.91 27.42 20.75 17 DKIM_VALID_EF 32043 23.88 26.76 23.28 18 BOTNET 30894 6.71 25.80 2.69 19 RELAYCOUNTRY_META 30675 8.83 25.61 5.29 20 BAYES_99 29029 7.22 24.24 3.64 21 DCC_CHECK_NEGATIVE 28895 55.71 24.13 62.36 22 FVGT_m_MULTI_ODD 28671 19.68 23.94 18.78 23 T_KAM_HTML_FONT_INVALID 24921 16.68 20.81 15.81 24 XM_Body_Dirty_Words 24097 13.62 20.12 12.25 25 T_TM2_M_HEADER_IN_MSG 23842 25.89 19.91 27.16 26 UNTRUSTED_Relay 22843 4.82 19.07 1.81 27 XM_UncommonTLD01 22521 5.94 18.80 3.23 28 BAYES_999 22408 5.68 18.71 2.94 29 TR_DCC_Bayes_99 21602 4.56 18.04 1.72 30 XM_Multi_Part_URI 19993 11.63 16.69 10.56 31 BOTNET_IPINHOSTNAME 18670 5.93 15.59 3.89 32 FSL_BULK_SIG 16553 8.28 13.82 7.12 33 LOTS_OF_MONEY 16384 9.05 13.68 8.07 34 DKIM_INVALID 15367 6.15 12.83 4.74 35 HTML_IMAGE_RATIO_02 14990 7.87 12.52 6.89 36 XM_B_Unsub 14776 9.64 12.34 9.07 37 XM_Evil_Numbers_Gen 13355 9.28 11.15 8.89 38 NO_DNS_FOR_FROM 12323 4.22 10.29 2.95 39 XMSexyCombo_05 12109 5.12 10.11 4.07 40 XM_UB50 12061 2.49 10.07 0.90 41 XM_H_Long_From01 10730 6.32 8.96 5.77 42 LotsOfNums_01 10331 7.33 8.63 7.06 43 XM_B_Phish_Phrases 10247 6.90 8.56 6.55 44 BAYES_80 10140 3.71 8.47 2.71 45 RCVD_IN_RP_RNBL 9735 1.57 8.13 0.19 46 BAYES_60 9519 5.33 7.95 4.78 47 XM_SPF_SoftFail 9127 2.79 7.62 1.77 48 XMSubMetaSx_00 8889 4.36 7.42 3.72 49 RCVD_IN_BL_SPAMCOP_NET 8630 2.17 7.21 1.11 50 MPART_ALT_DIFF 8194 8.21 6.84 8.50 51 TooManyTo_001 7608 7.08 6.35 7.24 52 HTML_IMAGE_RATIO_04 7460 12.41 6.23 13.71 53 SpammyFromTLD_02 7353 1.34 6.14 0.33 54 XMNumbers 7165 3.72 5.98 3.24 55 RCVD_IN_MSPIKE_BL 6770 1.89 5.65 1.09 56 T_REMOTE_IMAGE 6560 3.91 5.48 3.58 57 MIME_QP_LONG_LINE 6290 5.02 5.25 4.98 58 RCVD_IN_MSPIKE_L3 6059 1.51 5.06 0.77 59 PDS_OTHER_BAD_TLD 5946 1.27 4.96 0.50 60 KHOP_HELO_FCRDNS 5593 2.30 4.67 1.80 61 XM_CamelCaseFrm001 5514 2.37 4.60 1.90 62 XM_URI_RBL 5464 0.95 4.56 0.19 63 XM_OfRef6 5458 1.90 4.56 1.34 64 RELAYCOUNTRY_CA 5406 2.12 4.51 1.61 65 RCVD_IN_MSPIKE_H2 5295 8.08 4.42 8.85 66 RELAYCOUNTRY_FR 5258 1.02 4.39 0.31 67 HTML_IMAGE_RATIO_06 5193 4.77 4.34 4.86 68 XM_B_SpammyTLD 5179 2.26 4.32 1.82 69 MIME_HTML_MOSTLY 5155 2.80 4.30 2.48 70 BAYES_95 5134 2.02 4.29 1.54 71 FROM_SUSPICIOUS_NTLD 4854 0.76 4.05 0.07 72 RCVD_IN_PSBL 4738 0.72 3.96 0.04 73 FROM_SUSPICIOUS_NTLD_FP 4616 0.73 3.85 0.07 74 TM2_M_URI_OPT_OUT 4480 2.44 3.74 2.16 75 BOTNET_NORDNS 4436 0.69 3.70 0.06 76 XM_SendGrid 4365 5.45 3.64 5.82 77 BAYES_40 4319 6.08 3.61 6.60 78 SpammyFromTLD_01 4264 1.36 3.56 0.89 79 TR_Mismatch_TLD_01 4161 0.91 3.47 0.38 80 T_XMDrugObfuBody_08 4154 1.70 3.47 1.33 81 FROM_MISSP_REPLYTO 4036 0.60 3.37 0.02 82 XMStrtUSub 3973 7.33 3.32 8.18 83 XMBody_17 3906 1.16 3.26 0.72 84 XM_B_Unsub2 3900 2.09 3.26 1.85 85 BODY_URI_ONLY 3889 0.60 3.25 0.05 86 XM_DIRTYINTL 3867 0.93 3.23 0.45 87 TR_XM_PHPDW 3858 2.01 3.22 1.75 88 TR_XM_PHPForged 3827 1.99 3.20 1.73 89 TR_XM_FormFill2 3795 1.98 3.17 1.73 90 XM_H_PHPOS 3789 1.97 3.16 1.72 91 LongTLD 3735 0.72 3.12 0.21 92 RDNS_DYNAMIC 3716 0.81 3.10 0.33 93 REPLYTO_WITHOUT_TO_CC 3705 0.74 3.09 0.24 94 BAYES_20 3685 5.70 3.08 6.26 95 MIME_HTML_ONLY_MULTI 3661 5.76 3.06 6.32 96 RCVD_IN_MSPIKE_H3 3651 7.73 3.05 8.71 97 RCVD_IN_MSPIKE_WL 3651 7.73 3.05 8.71 98 XMNoVowels 3564 2.18 2.98 2.02 99 HTML_IMAGE_ONLY_12 3450 0.66 2.88 0.20 100 SUBJ_ALL_CAPS 3392 1.71 2.83 1.47 101 HTML_SHORT_LINK_IMG_1 3385 0.50 2.83 0.02 102 FROM_EXCESS_BASE64 3340 2.67 2.79 2.65 103 TR_Mismatch_TLD_02 3318 0.56 2.77 0.10 104 XMDiploma_00 3242 1.95 2.71 1.80 105 MIME_HEADER_CTYPE_ONLY 3211 0.68 2.68 0.25 106 HDRS_LCASE_IMGONLY 3105 0.47 2.59 0.02 107 XM_BadFromFormat 3062 0.54 2.56 0.12 108 XMSexyCombo_01 3020 1.20 2.52 0.92 109 URI_HEX 2973 1.44 2.48 1.22 110 DIET_1 2889 0.89 2.41 0.57 111 HTML_MIME_NO_HTML_TAG 2847 2.11 2.38 2.06 112 FROM_MISSP_EH_MATCH 2760 0.41 2.30 0.01 113 T_TooManySym_01 2725 3.52 2.28 3.78 114 DATE_IN_PAST_03_06 2719 0.47 2.27 0.09 115 XM_UB60 2713 0.46 2.27 0.08 116 TR_XM_INV_DKIM 2710 0.50 2.26 0.13 117 T_XMDrugObfuBody_00 2710 1.21 2.26 0.99 118 HTML_IMAGE_RATIO_08 2680 2.03 2.24 1.99 119 TO_NO_BRKTS_FROM_MSSP 2658 0.40 2.22 0.02 120 RCVD_IN_RP_SAFE 2622 6.88 2.19 7.86 121 BAYES_00 2599 19.35 2.17 22.96 122 DKIM_ADSP_CUSTOM_MED 2594 1.18 2.17 0.98 123 XMGenDplmaNmb 2482 1.31 2.07 1.16 124 NML_ADSP_CUSTOM_MED 2453 0.97 2.05 0.74 125 FORGED_GMAIL_RCVD 2438 0.73 2.04 0.45 126 RELAYCOUNTRY_JP 2434 0.41 2.03 0.06 127 FILL_THIS_FORM 2381 0.79 1.99 0.53 128 T_XMDrugObfuBody_14 2351 1.82 1.96 1.79 129 RCVD_IN_IADB_LISTED 2332 3.97 1.95 4.39 130 CTE_8BIT_MISMATCH 2317 0.37 1.93 0.05 131 XMSubNoVowel 2312 3.53 1.93 3.86 132 FROM_MISSP_DYNIP 2299 0.33 1.92 0.00 133 TO_EQ_FM_DOM_HTML_IMG 2279 0.33 1.90 0.00 134 RELAYCOUNTRY_DE 2230 0.64 1.86 0.38 135 URI_TRY_3LD 2189 1.08 1.83 0.93 136 TR_Symld_Words 2165 2.22 1.81 2.31 137 RCVD_IN_IADB_SPF 2163 3.45 1.81 3.80 138 RCVD_IN_SORBS_DUL 2136 0.64 1.78 0.40 139 XM_UB99 2134 0.31 1.78 0.00 140 RCVD_IN_IADB_SENDERID 2120 3.01 1.77 3.27 141 RCVD_IN_IADB_DK 2114 2.97 1.77 3.22 142 ALL_TRUSTED 2111 12.79 1.76 15.11 143 TM2_M_VERY_LONG_WORD 2061 1.32 1.72 1.24 144 RCVD_IN_RP_CERTIFIED 2058 6.28 1.72 7.24 145 DATE_IN_PAST_06_12 2053 0.47 1.71 0.21 146 XMHTML_After_End 2037 0.88 1.70 0.71 147 T_XMHurry_00 2018 0.73 1.69 0.52 148 RELAYCOUNTRY_IN 2010 0.37 1.68 0.10 149 XMStockSpam_06 2008 1.33 1.68 1.25 150 URIBL_SBL_A 1996 0.42 1.67 0.16 151 TR_XM_DK_Bayes 1969 10.91 1.64 12.86 152 XMSubLongNoVowel 1950 1.46 1.63 1.42 153 REMOVE_BEFORE_LINK 1898 0.47 1.58 0.24 154 NO_FM_NAME_IP_HOSTN 1882 0.27 1.57 0.00 155 XM_DK_Undo_01 1878 1.44 1.57 1.41 156 BAYES_05 1866 3.96 1.56 4.46 157 RELAYCOUNTRY_VN 1866 0.28 1.56 0.01 158 RELAYCOUNTRY_GB 1821 1.04 1.52 0.93 159 XM_UB80 1795 0.28 1.50 0.03 160 TR_XM_DK_SendGrid 1720 2.92 1.44 3.23 161 XMMoneyMeta_00 1689 0.63 1.41 0.47 162 XM_H_PHPMailer 1679 1.56 1.40 1.59 163 UNPARSEABLE_RELAY 1674 1.93 1.40 2.04 164 XMSubMetaI_00 1662 0.66 1.39 0.51 165 FILL_THIS_FORM_LONG 1653 0.58 1.38 0.41 166 RELAYCOUNTRY_ID 1610 0.24 1.34 0.01 167 MAILING_LIST_MULTI 1572 1.99 1.31 2.13 168 TR_Sbj_FN_Bdy 1552 0.37 1.30 0.17 169 XM_H_PHPOS_M 1543 1.21 1.29 1.19 170 THIS_AD 1542 0.46 1.29 0.29 171 XMBody_78 1505 0.45 1.26 0.28 172 DKIM_ADSP_NXDOMAIN 1478 0.59 1.23 0.46 173 XM_ProductURIs 1447 0.75 1.21 0.65 174 TR_XM_MaxSPIKE 1441 0.24 1.20 0.04 175 XMBdyGiftCard01 1428 1.10 1.19 1.07 176 SUBJECT_NEEDS_ENCODING 1413 0.21 1.18 0.00 177 SUBJ_ILLEGAL_CHARS 1405 0.21 1.17 0.00 178 HK_RANDOM_REPLYTO 1403 0.34 1.17 0.17 179 FORM_FRAUD 1380 0.20 1.15 0.00 180 XM_UB999 1360 0.20 1.14 0.00 181 XMPhish08 1357 0.58 1.13 0.46 182 T_Symld_Words_02 1347 0.80 1.12 0.73 183 XMBrknScrpt_02 1347 0.74 1.12 0.66 184 DATE_IN_FUTURE_12_24 1346 0.20 1.12 0.00 185 XM_H_Long_From02 1329 1.10 1.11 1.09 186 TR_MetaPhish_Combo_01 1309 0.87 1.09 0.83 187 TR_XM_DK_Bayes1 1287 10.17 1.07 12.09 188 XMSlimDrugH 1285 0.45 1.07 0.31 189 XM_OfRef7 1285 0.28 1.07 0.11 190 FILL_THIS_FORM_SHORT 1275 0.91 1.06 0.88 191 TR_LOTS_OF_MONEY2 1267 0.63 1.06 0.54 192 T_MONEY_PERCENT 1267 0.63 1.06 0.54 193 XM_UB95 1204 0.18 1.01 0.01 194 TR_XM_DK_Bayes2 1181 8.95 0.99 10.63 195 TR_XM_MaxBayes 1180 0.18 0.99 0.01 196 XMSexyCombo_04 1176 0.29 0.98 0.14 197 TVD_SPACE_RATIO 1173 0.61 0.98 0.53 198 HELO_NODOT 1146 1.65 0.96 1.79 199 HELO_NO_DOMAIN 1143 1.64 0.95 1.79 200 TR_LOTS_OF_MONEY3 1126 0.39 0.94 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 510770 89.84 89.89 89.82 2 RELAYCOUNTRY_US 461363 79.87 73.85 81.14 3 XM_B_Unicode 405432 71.43 72.04 71.30 4 DKIM_SIGNED 380694 68.56 76.21 66.95 5 XM_DK_Pass 374308 67.26 74.07 65.83 6 DCC_CHECK_NEGATIVE 354574 55.71 24.13 62.36 7 DKIM_VALID 353721 62.41 63.38 62.21 8 BAYES_50 266796 46.47 44.36 46.92 9 DKIM_VALID_AU 264303 46.77 48.15 46.48 10 XMListUnsubscribeExists 254403 48.26 65.00 44.74 11 XM_B_Unicode3 240592 42.38 42.69 42.31 12 DCC_CHECK 203413 42.39 73.79 35.77 13 T_TM2_M_HEADER_IN_MSG 154417 25.89 19.91 27.16 14 HTML_FONT_LOW_CONTRAST 136607 24.75 28.18 24.02 15 DKIM_VALID_EF 132352 23.88 26.76 23.28 16 BAYES_00 130575 19.35 2.17 22.96 17 MIME_HTML_ONLY 126962 24.82 36.65 22.33 18 XMSubLong 117966 21.91 27.42 20.75 19 LOC_TINY_FONT_1 115513 22.27 31.57 20.31 20 FVGT_m_MULTI_ODD 106793 19.68 23.94 18.78 21 T_KAM_HTML_FONT_INVALID 89908 16.68 20.81 15.81 22 ALL_TRUSTED 85939 12.79 1.76 15.11 23 HTML_IMAGE_RATIO_04 77969 12.41 6.23 13.71 24 TR_XM_DK_Bayes 73101 10.91 1.64 12.86 25 XM_Body_Dirty_Words 69648 13.62 20.12 12.25 26 TR_XM_DK_Bayes1 68749 10.17 1.07 12.09 27 HTML_FONT_FACE_BAD 62151 9.15 0.69 10.93 28 XM_H_Trusted_IP 60971 8.86 0.00 10.72 29 TR_XM_DK_Bayes2 60428 8.95 0.99 10.63 30 XM_Multi_Part_URI 60063 11.63 16.69 10.56 31 XM_B_Unsub 51580 9.64 12.34 9.07 32 XM_Evil_Numbers_Gen 50534 9.28 11.15 8.89 33 RCVD_IN_MSPIKE_H2 50319 8.08 4.42 8.85 34 RCVD_IN_MSPIKE_WL 49533 7.73 3.05 8.71 35 RCVD_IN_MSPIKE_H3 49533 7.73 3.05 8.71 36 MPART_ALT_DIFF 48322 8.21 6.84 8.50 37 XMStrtUSub 46504 7.33 3.32 8.18 38 LOTS_OF_MONEY 45904 9.05 13.68 8.07 39 RCVD_IN_RP_SAFE 44709 6.88 2.19 7.86 40 TooManyTo_001 41162 7.08 6.35 7.24 41 RCVD_IN_RP_CERTIFIED 41147 6.28 1.72 7.24 42 XM_DK_Undo_02 40865 12.79 39.42 7.19 43 FSL_BULK_SIG 40470 8.28 13.82 7.12 44 LotsOfNums_01 40131 7.33 8.63 7.06 45 HTML_IMAGE_RATIO_02 39173 7.87 12.52 6.89 46 BAYES_40 37535 6.08 3.61 6.60 47 XM_B_Phish_Phrases 37266 6.90 8.56 6.55 48 MIME_HTML_ONLY_MULTI 35961 5.76 3.06 6.32 49 BAYES_20 35568 5.70 3.08 6.26 50 XM_DKIMWhitelistDomains 35311 5.14 0.05 6.21 51 XM_SendGrid 33122 5.45 3.64 5.82 52 XM_H_Long_From01 32795 6.32 8.96 5.77 53 RELAYCOUNTRY_META 30105 8.83 25.61 5.29 54 MIME_QP_LONG_LINE 28299 5.02 5.25 4.98 55 HTML_IMAGE_RATIO_06 27638 4.77 4.34 4.86 56 BAYES_60 27163 5.33 7.95 4.78 57 DKIM_INVALID 26973 6.15 12.83 4.74 58 BAYES_05 25380 3.96 1.56 4.46 59 RCVD_IN_IADB_LISTED 24963 3.97 1.95 4.39 60 XM_PDF 24264 3.67 0.82 4.27 61 XMSexyCombo_05 23121 5.12 10.11 4.07 62 BOTNET_IPINHOSTNAME 22138 5.93 15.59 3.89 63 XMSubNoVowel 21967 3.53 1.93 3.86 64 RCVD_IN_IADB_SPF 21595 3.45 1.81 3.80 65 T_TooManySym_01 21482 3.52 2.28 3.78 66 XMSubMetaSx_00 21133 4.36 7.42 3.72 67 BAYES_99 20702 7.22 24.24 3.64 68 T_REMOTE_IMAGE 20382 3.91 5.48 3.58 69 IN_ZIMBRA_NJ_WHITELIST 18974 2.76 0.02 3.34 70 RCVD_IN_IADB_SENDERID 18586 3.01 1.77 3.27 71 XMNumbers 18448 3.72 5.98 3.24 72 XM_UncommonTLD01 18395 5.94 18.80 3.23 73 TR_XM_DK_SendGrid 18375 2.92 1.44 3.23 74 RCVD_IN_IADB_DK 18331 2.97 1.77 3.22 75 ANY_BOUNCE_MESSAGE 16878 2.57 0.66 2.97 76 BOUNCE_MESSAGE 16875 2.57 0.65 2.97 77 NO_DNS_FOR_FROM 16759 4.22 10.29 2.95 78 BAYES_999 16717 5.68 18.71 2.94 79 RCVD_IN_IADB_VOUCHED 16595 2.49 0.46 2.92 80 BAYES_80 15393 3.71 8.47 2.71 81 BOTNET 15301 6.71 25.80 2.69 82 FROM_EXCESS_BASE64 15063 2.67 2.79 2.65 83 MIME_HTML_MOSTLY 14091 2.80 4.30 2.48 84 TR_Symld_Words 13148 2.22 1.81 2.31 85 TM2_M_URI_OPT_OUT 12289 2.44 3.74 2.16 86 MAILING_LIST_MULTI 12123 1.99 1.31 2.13 87 HTML_MIME_NO_HTML_TAG 11701 2.11 2.38 2.06 88 UNPARSEABLE_RELAY 11620 1.93 1.40 2.04 89 XMNoVowels 11473 2.18 2.98 2.02 90 T_TooManySym_02 11349 1.75 0.56 2.00 91 HTML_IMAGE_RATIO_08 11321 2.03 2.24 1.99 92 TooManyTo_002 10943 1.69 0.56 1.92 93 XM_CamelCaseFrm001 10795 2.37 4.60 1.90 94 RCVD_IN_IADB_OPTIN 10679 1.62 0.37 1.88 95 XM_B_Unsub2 10502 2.09 3.26 1.85 96 XM_B_SpammyTLD 10370 2.26 4.32 1.82 97 UNTRUSTED_Relay 10307 4.82 19.07 1.81 98 KHOP_HELO_FCRDNS 10257 2.30 4.67 1.80 99 XMDiploma_00 10213 1.95 2.71 1.80 100 T_XMDrugObfuBody_14 10202 1.82 1.96 1.79 101 HELO_NODOT 10194 1.65 0.96 1.79 102 HELO_NO_DOMAIN 10151 1.64 0.95 1.79 103 XM_SPF_SoftFail 10057 2.79 7.62 1.77 104 TR_XM_PHPDW 9950 2.01 3.22 1.75 105 TR_XM_PHPForged 9854 1.99 3.20 1.73 106 TR_XM_FormFill2 9814 1.98 3.17 1.73 107 XM_H_PHPOS 9805 1.97 3.16 1.72 108 TR_DCC_Bayes_99 9755 4.56 18.04 1.72 109 RELAYCOUNTRY_CA 9183 2.12 4.51 1.61 110 XM_H_PHPMailer 9055 1.56 1.40 1.59 111 BAYES_95 8739 2.02 4.29 1.54 112 SUBJ_ALL_CAPS 8361 1.71 2.83 1.47 113 TVD_RCVD_IP 8237 1.30 0.58 1.45 114 XMSubLongNoVowel 8083 1.46 1.63 1.42 115 XM_DK_Undo_01 8002 1.44 1.57 1.41 116 XMSubGarbage 7986 1.17 0.04 1.40 117 IN_HORDE_ADDRESS_BOOK 7906 1.15 0.02 1.39 118 INVALID_MSGID 7610 1.13 0.15 1.34 119 XM_OfRef6 7602 1.90 4.56 1.34 120 T_XMDrugObfuBody_08 7543 1.70 3.47 1.33 121 TooManyTo_003 7226 1.13 0.43 1.27 122 XMStockSpam_06 7129 1.33 1.68 1.25 123 TO_MALFORMED 7117 1.04 0.02 1.25 124 TM2_M_VERY_LONG_WORD 7039 1.32 1.72 1.24 125 XMCapTrack 7031 1.08 0.34 1.24 126 URI_HEX 6934 1.44 2.48 1.22 127 XM_H_PHPOS_M 6756 1.21 1.29 1.19 128 XMLngstWrd_00 6665 1.08 0.66 1.17 129 XMGenDplmaNmb 6568 1.31 2.07 1.16 130 CK_HELO_DYNAMIC_SPLIT_IP 6461 0.97 0.18 1.14 131 HELO_DYNAMIC_IPADDR2 6456 0.94 0.03 1.14 132 XMLngstWrd_01 6366 1.02 0.54 1.12 133 RCVD_IN_BL_SPAMCOP_NET 6316 2.17 7.21 1.11 134 RCVD_IN_MSPIKE_BL 6223 1.89 5.65 1.09 135 XM_H_Long_From02 6219 1.10 1.11 1.09 136 XMBdyGiftCard01 6112 1.10 1.19 1.07 137 XM_GoogleGroups 6110 0.96 0.41 1.07 138 XM_E_Blogspot 5836 0.87 0.10 1.03 139 USER_IN_DEF_DKIM_WL 5726 0.83 0.01 1.01 140 XMLngstWrd_02 5697 0.90 0.44 1.00 141 T_XMDrugObfuBody_00 5613 1.21 2.26 0.99 142 DKIM_ADSP_CUSTOM_MED 5558 1.18 2.17 0.98 143 TooManyTo_004 5318 0.83 0.36 0.94 144 RELAYCOUNTRY_GB 5304 1.04 1.52 0.93 145 URI_TRY_3LD 5260 1.08 1.83 0.93 146 XMSexyCombo_01 5241 1.20 2.52 0.92 147 XM_ShortIntro_01 5229 0.86 0.55 0.92 148 XMLngstWrd_03 5163 0.81 0.33 0.91 149 XM_UB50 5111 2.49 10.07 0.90 150 SpammyFromTLD_01 5085 1.36 3.56 0.89 151 FILL_THIS_FORM_SHORT 4979 0.91 1.06 0.88 152 XMGappySubj_01 4967 0.75 0.15 0.87 153 XMLngstWrd_04 4908 0.75 0.21 0.86 154 TR_MetaPhish_Combo_01 4704 0.87 1.09 0.83 155 TR_MSPIKEBAYES00 4526 0.66 0.03 0.80 156 TooManyTo_005 4389 0.69 0.31 0.77 157 RCVD_IN_MSPIKE_L3 4363 1.51 5.06 0.77 158 NML_ADSP_CUSTOM_MED 4196 0.97 2.05 0.74 159 T_Symld_Words_02 4168 0.80 1.12 0.73 160 XMBody_17 4074 1.16 3.26 0.72 161 XMHTML_After_End 4024 0.88 1.70 0.71 162 T_OBFU_PDF_ATTACH 3913 0.61 0.22 0.69 163 FROM_GOV_DKIM_AU 3855 0.60 0.22 0.68 164 XMBrknScrpt_02 3780 0.74 1.12 0.66 165 MISSING_HEADERS 3774 0.67 0.71 0.66 166 XMBody_95 3706 0.56 0.12 0.65 167 XM_ProductURIs 3705 0.75 1.21 0.65 168 DIET_1 3230 0.89 2.41 0.57 169 HTTPS_HTTP_MISMATCH 3224 0.56 0.54 0.57 170 XM_B_REG_HTML 3166 0.56 0.60 0.56 171 TR_LOTS_OF_MONEY2 3078 0.63 1.06 0.54 172 T_MONEY_PERCENT 3078 0.63 1.06 0.54 173 XM_SPF_Unknown 3069 0.56 0.67 0.54 174 TVD_SPACE_RATIO 3033 0.61 0.98 0.53 175 FILL_THIS_FORM 3028 0.79 1.99 0.53 176 T_XMHurry_00 2982 0.73 1.69 0.52 177 XMSubMetaI_00 2913 0.66 1.39 0.51 178 XM_RXBody 2849 0.47 0.31 0.50 179 PDS_OTHER_BAD_TLD 2824 1.27 4.96 0.50 180 XMSubMetaSxObfu_03 2724 0.56 0.94 0.48 181 XM_B_COPY_HTML 2711 0.52 0.72 0.48 182 XMMoneyMeta_00 2657 0.63 1.41 0.47 183 TM2_M_A_HREF_HREF 2627 0.49 0.65 0.46 184 FROM_GOV_SPOOF 2625 0.41 0.16 0.46 185 XMPhish08 2614 0.58 1.13 0.46 186 DKIM_ADSP_NXDOMAIN 2596 0.59 1.23 0.46 187 FORGED_GMAIL_RCVD 2565 0.73 2.04 0.45 188 PLING_QUERY 2562 0.51 0.78 0.45 189 XM_DIRTYINTL 2557 0.93 3.23 0.45 190 AC_DIV_BONANZA 2554 0.39 0.13 0.45 191 MY_SERVERS_FOUND 2427 0.40 0.27 0.43 192 USER_IN_WHITELIST 2408 0.35 0.00 0.42 193 FILL_THIS_FORM_LONG 2334 0.58 1.38 0.41 194 HTML_IMAGE_ONLY_20 2328 0.41 0.44 0.41 195 SHORT_HELO_AND_INLINE_IMAGE 2321 0.34 0.03 0.41 196 HTML_IMAGE_ONLY_28 2318 0.44 0.62 0.41 197 SUBJ_DOLLARS 2315 0.42 0.47 0.41 198 T_TooManySym_03 2287 0.36 0.18 0.40 199 XMHTMLBadTable_001 2271 0.45 0.68 0.40 200 RCVD_IN_SORBS_DUL 2262 0.64 1.78 0.40 ----------------------------------------------------------------------