Email: 628825 Autolearn: 0 AvgScore: 1.45 AvgScanTime: 2.13 sec Spam: 122136 Autolearn: 0 AvgScore: 11.85 AvgScanTime: 3.88 sec Ham: 506689 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 1.71 sec Time Spent Running SA: 372.26 hours Time Spent Processing Spam: 131.49 hours Time Spent Processing Ham: 240.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117678 90.07 96.35 88.56 2 DKIM_SIGNED 104348 77.76 85.44 75.91 3 XM_DK_Pass 101715 76.33 83.28 74.65 4 RELAYCOUNTRY_US 97363 81.73 79.72 82.22 5 DCC_CHECK 95830 47.77 78.46 40.38 6 XM_B_Unicode 95163 71.40 77.92 69.82 7 XMListUnsubscribeExists 89242 54.66 73.07 50.22 8 DKIM_VALID 86169 69.92 70.55 69.77 9 DKIM_VALID_AU 63787 51.69 52.23 51.56 10 BAYES_50 59157 51.06 48.44 51.69 11 XM_B_Unicode3 54487 40.28 44.61 39.23 12 XM_DK_Undo_02 49505 13.23 40.53 6.65 13 LOC_TINY_FONT_1 45269 26.03 37.06 23.37 14 MIME_HTML_ONLY 44738 24.36 36.63 21.40 15 HTML_FONT_LOW_CONTRAST 37964 26.94 31.08 25.94 16 DKIM_VALID_EF 37311 26.86 30.55 25.98 17 T_KAM_HTML_FONT_INVALID 32856 19.90 26.90 18.22 18 FVGT_m_MULTI_ODD 31985 22.75 26.19 21.92 19 XMSubLong 30237 21.23 24.76 20.38 20 BAYES_99 29912 7.10 24.49 2.91 21 BOTNET 28228 6.79 23.11 2.86 22 T_TM2_M_HEADER_IN_MSG 26016 27.79 21.30 29.35 23 RELAYCOUNTRY_META 25468 8.42 20.85 5.43 24 XM_Body_Dirty_Words 24519 13.77 20.08 12.25 25 XM_B_Phish_Phrases 24452 10.03 20.02 7.62 26 DCC_CHECK_NEGATIVE 24085 50.17 19.72 57.51 27 TR_DCC_Bayes_99 23765 4.88 19.46 1.37 28 BAYES_999 23003 5.45 18.83 2.22 29 XM_Multi_Part_URI 22394 12.60 18.34 11.21 30 XM_UncommonTLD01 20709 6.06 16.96 3.44 31 BOTNET_IPINHOSTNAME 19640 6.72 16.08 4.47 32 DKIM_INVALID 18179 7.84 14.88 6.14 33 XM_B_COVIDMETA 17900 5.00 14.66 2.67 34 LOTS_OF_MONEY 17379 9.33 14.23 8.15 35 XM_B_Unsub 17062 10.74 13.97 9.97 36 UNTRUSTED_Relay 16665 3.89 13.64 1.54 37 FSL_BULK_SIG 15583 8.57 12.76 7.56 38 HTML_IMAGE_RATIO_02 13653 7.58 11.18 6.71 39 NO_DNS_FOR_FROM 13137 4.68 10.76 3.22 40 XM_Evil_Numbers_Gen 12964 9.64 10.61 9.41 41 XMSexyCombo_05 12951 4.93 10.60 3.56 42 LotsOfNums_01 11832 8.63 9.69 8.38 43 RCVD_IN_MSPIKE_H2 11555 14.13 9.46 15.26 44 XM_UB50 10814 2.47 8.85 0.94 45 RCVD_IN_MSPIKE_BL 9728 3.62 7.96 2.57 46 RCVD_IN_MSPIKE_L3 9529 3.57 7.80 2.55 47 XMSubMetaSx_00 8690 4.01 7.12 3.27 48 MIME_QP_LONG_LINE 8203 6.44 6.72 6.38 49 MPART_ALT_DIFF 7972 4.93 6.53 4.54 50 XM_CamelCaseFrm001 7955 2.92 6.51 2.06 51 TooManyTo_001 7906 8.48 6.47 8.96 52 HTML_IMAGE_RATIO_04 7819 5.79 6.40 5.64 53 XM_H_Long_From01 7765 5.69 6.36 5.53 54 BAYES_80 7735 3.37 6.33 2.66 55 UNPARSEABLE_RELAY 7376 8.19 6.04 8.71 56 RELAYCOUNTRY_CA 6743 2.30 5.52 1.52 57 FROM_SUSPICIOUS_NTLD 6592 1.10 5.40 0.07 58 BAYES_60 6545 4.95 5.36 4.86 59 FROM_SUSPICIOUS_NTLD_FP 6534 1.09 5.35 0.06 60 XM_SendGrid 6315 6.47 5.17 6.79 61 LongTLD 5668 1.08 4.64 0.23 62 XM_B_SpammyTLD 5664 2.40 4.64 1.86 63 PDS_OTHER_BAD_TLD 5611 1.28 4.59 0.48 64 SpammyFromTLD_02 5600 1.11 4.59 0.28 65 XMNumbers 5488 3.43 4.49 3.17 66 T_XMDrugObfuBody_08 5475 2.16 4.48 1.60 67 BAYES_40 5364 5.98 4.39 6.36 68 RELAYCOUNTRY_FR 5348 1.06 4.38 0.26 69 T_REMOTE_IMAGE 5132 4.58 4.20 4.67 70 XMStrtUSub 4946 4.27 4.05 4.33 71 XM_SPF_SoftFail 4915 2.24 4.02 1.81 72 XM_OfRef6 4908 1.57 4.02 0.98 73 TM2_M_URI_OPT_OUT 4869 3.18 3.99 2.98 74 RCVD_IN_BL_SPAMCOP_NET 4771 1.63 3.91 1.09 75 HTML_IMAGE_RATIO_06 4770 3.46 3.91 3.35 76 MIME_HTML_MOSTLY 4745 2.81 3.89 2.55 77 RCVD_IN_MSPIKE_WL 4446 8.44 3.64 9.60 78 RCVD_IN_MSPIKE_H3 4446 8.44 3.64 9.60 79 XMBody_17 4340 1.21 3.55 0.65 80 BAYES_95 4187 1.88 3.43 1.51 81 URIBL_SBL_A 4118 0.74 3.37 0.11 82 BAYES_20 4060 4.74 3.32 5.08 83 KHOP_HELO_FCRDNS 4026 2.25 3.30 1.99 84 XM_URI_RBL 3956 0.81 3.24 0.22 85 HTML_MIME_NO_HTML_TAG 3792 3.16 3.10 3.17 86 XM_DIRTYINTL 3734 1.01 3.06 0.51 87 TR_XM_PhishingBody 3631 1.65 2.97 1.33 88 FROM_EXCESS_BASE64 3579 3.25 2.93 3.32 89 XM_B_Unsub2 3558 2.14 2.91 1.96 90 SpammyFromTLD_01 3552 1.33 2.91 0.95 91 TR_LOTS_OF_MONEY3 3470 0.82 2.84 0.34 92 XMDiploma_00 3447 1.76 2.82 1.50 93 MIME_HTML_ONLY_MULTI 3411 2.70 2.79 2.68 94 TR_XM_MaxBayes 3238 0.53 2.65 0.01 95 URI_HEX 3224 1.83 2.64 1.64 96 RCVD_IN_IADB_LISTED 3084 4.59 2.53 5.09 97 HTML_IMAGE_ONLY_08 3070 0.59 2.51 0.12 98 T_TooManySym_01 3064 3.74 2.51 4.04 99 HTML_SHORT_LINK_IMG_1 2997 0.49 2.45 0.01 100 MIME_HEADER_CTYPE_ONLY 2936 0.63 2.40 0.20 101 RELAYCOUNTRY_DE 2918 0.83 2.39 0.46 102 XMStockSpam_06 2872 1.43 2.35 1.21 103 XMSexyCombo_01 2864 1.02 2.34 0.71 104 HDRS_LCASE_IMGONLY 2856 0.46 2.34 0.01 105 TR_XM_DK_SendGrid 2851 3.20 2.33 3.41 106 RCVD_IN_IADB_SPF 2834 4.04 2.32 4.45 107 RCVD_IN_IADB_DK 2786 3.56 2.28 3.87 108 RCVD_IN_IADB_SENDERID 2769 3.56 2.27 3.87 109 DATE_IN_PAST_03_06 2763 0.50 2.26 0.08 110 BAYES_00 2734 17.86 2.24 21.62 111 HTML_IMAGE_RATIO_08 2723 2.24 2.23 2.24 112 T_XMDrugObfuBody_14 2662 1.62 2.18 1.48 113 TR_XM_PHPDW 2650 0.81 2.17 0.49 114 TR_XM_PHPForged 2631 0.80 2.15 0.47 115 TR_XM_FormFill2 2601 0.79 2.13 0.47 116 XM_H_PHPOS 2590 0.79 2.12 0.47 117 TR_XM_INV_DKIM 2566 0.48 2.10 0.08 118 TR_XM_RelayPhish 2564 0.54 2.10 0.17 119 TM2_M_VERY_LONG_WORD 2457 1.49 2.01 1.37 120 BAYES_05 2441 3.06 2.00 3.32 121 RCVD_IN_RP_SAFE 2419 7.10 1.98 8.34 122 RCVD_IN_RP_RNBL 2304 0.43 1.89 0.08 123 TR_XM_DK_Bayes 2226 12.72 1.82 15.34 124 URI_TRY_3LD 2131 1.33 1.74 1.23 125 XMGenDplmaNmb 2097 1.15 1.72 1.01 126 T_FILL_THIS_FORM_SHORT 2061 1.36 1.69 1.29 127 URI_NOVOWEL 2047 0.62 1.68 0.37 128 DATE_IN_PAST_06_12 2033 0.38 1.66 0.07 129 DKIM_ADSP_NXDOMAIN 1938 0.51 1.59 0.25 130 XM_DK_Undo_01 1899 2.01 1.55 2.12 131 DATE_IN_PAST_12_24 1890 0.35 1.55 0.06 132 T_XMDrugObfuBody_00 1835 0.74 1.50 0.55 133 XMHTML_After_End 1770 0.88 1.45 0.75 134 MAILING_LIST_MULTI 1737 2.49 1.42 2.75 135 RCVD_IN_RP_CERTIFIED 1728 6.37 1.41 7.57 136 XMMoneyMeta_00 1661 0.93 1.36 0.83 137 RELAYCOUNTRY_GB 1654 1.28 1.35 1.27 138 T_XMHurry_00 1648 0.59 1.35 0.41 139 SUBJ_ALL_CAPS 1641 1.46 1.34 1.49 140 REPLYTO_WITHOUT_TO_CC 1630 0.34 1.33 0.10 141 HDRS_MISSP 1579 0.26 1.29 0.01 142 SHORT_IMG_SUSP_NTLD 1561 0.25 1.28 0.00 143 XMBrknScrpt_02 1513 0.84 1.24 0.75 144 TR_XM_MaxSPIKE 1498 0.32 1.23 0.11 145 TR_XM_DK_Bayes1 1463 11.67 1.20 14.19 146 TR_Symld_Words 1462 1.40 1.20 1.45 147 XMSubMetaSxObfu_03 1458 0.63 1.19 0.49 148 BOTNET_NORDNS 1440 0.24 1.18 0.02 149 XM_H_PHPMailer 1404 0.65 1.15 0.52 150 TR_Mismatch_TLD_02 1397 0.28 1.14 0.07 151 XMSexyCombo_04 1382 0.28 1.13 0.07 152 DIET_1 1358 0.45 1.11 0.29 153 DKIM_ADSP_CUSTOM_MED 1353 1.24 1.11 1.27 154 XMPhish30 1298 0.52 1.06 0.39 155 XM_H_MailChimp 1298 0.36 1.06 0.19 156 XM_UB60 1293 0.26 1.06 0.07 157 RELAYCOUNTRY_AU 1276 0.63 1.04 0.53 158 TR_Mismatch_TLD_01 1272 0.35 1.04 0.19 159 TO_EQ_FM_DOM_HTML_IMG 1260 0.21 1.03 0.01 160 XMSubMetaI_00 1255 0.57 1.03 0.46 161 ALL_TRUSTED 1249 11.73 1.02 14.31 162 HK_RANDOM_REPLYTO 1214 0.38 0.99 0.23 163 URIBL_BLACK 1198 0.22 0.98 0.04 164 XMPhish08 1151 0.52 0.94 0.41 165 FORGED_GMAIL_RCVD 1149 0.57 0.94 0.47 166 XMPhish14 1146 0.59 0.94 0.51 167 XM_OfRef7 1131 0.27 0.93 0.12 168 TR_XM_DK_Bayes2 1119 10.15 0.92 12.37 169 HTTPS_HTTP_MISMATCH 1115 0.91 0.91 0.90 170 XMGppyBdWords 1114 0.28 0.91 0.13 171 TR_MetaPhish_Combo_01 1110 1.12 0.91 1.17 172 XM_H_PHPOS_M 1098 0.32 0.90 0.18 173 RCVD_IN_PSBL 1075 0.19 0.88 0.02 174 T_Symld_Words_02 1075 0.56 0.88 0.48 175 XM_UB80 1045 0.18 0.86 0.02 176 XM_H_Long_From02 1044 1.08 0.85 1.14 177 XMBody_78 1034 0.46 0.85 0.37 178 DEAR_FRIEND 1032 0.23 0.84 0.08 179 XM_UB99 995 0.17 0.81 0.01 180 NUMERIC_HTTP_ADDR 987 0.45 0.81 0.37 181 T_TooManySym_02 974 1.77 0.80 2.00 182 TR_LOTS_OF_MONEY2 972 0.37 0.80 0.27 183 T_MONEY_PERCENT 972 0.37 0.80 0.27 184 XM_PDF 969 4.40 0.79 5.27 185 XM_ProductURIs 965 0.72 0.79 0.71 186 NML_ADSP_CUSTOM_MED 953 0.92 0.78 0.95 187 FVGT_m_MULTI_ODD_EMAIL 935 0.17 0.77 0.03 188 XM_B_COPY_HTML 899 0.39 0.74 0.31 189 RCVD_IN_IADB_VOUCHED 897 2.73 0.73 3.21 190 RELAYCOUNTRY_AT 884 0.24 0.72 0.12 191 XMBdyGiftCard01 877 0.87 0.72 0.91 192 TooManyTo_002 874 2.15 0.72 2.49 193 RELAYCOUNTRY_IN 868 0.21 0.71 0.09 194 XM_Nigeria_01 861 0.17 0.70 0.05 195 LONG_HEX_URI 854 0.29 0.70 0.19 196 XM_B_SEO 843 0.24 0.69 0.14 197 FROM_DOMAIN_NOVOWEL 842 0.15 0.69 0.02 198 XM_H_TOP 835 0.14 0.68 0.00 199 HELO_NO_DOMAIN 834 1.52 0.68 1.72 200 HELO_NODOT 834 1.52 0.68 1.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 448713 90.07 96.35 88.56 2 RELAYCOUNTRY_US 416594 81.73 79.72 82.22 3 DKIM_SIGNED 384631 77.76 85.44 75.91 4 XM_DK_Pass 378252 76.33 83.28 74.65 5 XM_B_Unicode 353789 71.40 77.92 69.82 6 DKIM_VALID 353529 69.92 70.55 69.77 7 DCC_CHECK_NEGATIVE 291392 50.17 19.72 57.51 8 BAYES_50 261895 51.06 48.44 51.69 9 DKIM_VALID_AU 261247 51.69 52.23 51.56 10 XMListUnsubscribeExists 254459 54.66 73.07 50.22 11 DCC_CHECK 204585 47.77 78.46 40.38 12 XM_B_Unicode3 198781 40.28 44.61 39.23 13 T_TM2_M_HEADER_IN_MSG 148737 27.79 21.30 29.35 14 DKIM_VALID_EF 131614 26.86 30.55 25.98 15 HTML_FONT_LOW_CONTRAST 131423 26.94 31.08 25.94 16 LOC_TINY_FONT_1 118427 26.03 37.06 23.37 17 FVGT_m_MULTI_ODD 111083 22.75 26.19 21.92 18 BAYES_00 109560 17.86 2.24 21.62 19 MIME_HTML_ONLY 108429 24.36 36.63 21.40 20 XMSubLong 103271 21.23 24.76 20.38 21 T_KAM_HTML_FONT_INVALID 92294 19.90 26.90 18.22 22 TR_XM_DK_Bayes 77730 12.72 1.82 15.34 23 RCVD_IN_MSPIKE_H2 77309 14.13 9.46 15.26 24 ALL_TRUSTED 72523 11.73 1.02 14.31 25 TR_XM_DK_Bayes1 71922 11.67 1.20 14.19 26 TR_XM_DK_Bayes2 62701 10.15 0.92 12.37 27 XM_Body_Dirty_Words 62065 13.77 20.08 12.25 28 XM_Multi_Part_URI 56808 12.60 18.34 11.21 29 XM_B_Unsub 50500 10.74 13.97 9.97 30 RCVD_IN_MSPIKE_H3 48635 8.44 3.64 9.60 31 RCVD_IN_MSPIKE_WL 48635 8.44 3.64 9.60 32 XM_Evil_Numbers_Gen 47685 9.64 10.61 9.41 33 TooManyTo_001 45405 8.48 6.47 8.96 34 UNPARSEABLE_RELAY 44134 8.19 6.04 8.71 35 LotsOfNums_01 42446 8.63 9.69 8.38 36 RCVD_IN_RP_SAFE 42241 7.10 1.98 8.34 37 LOTS_OF_MONEY 41305 9.33 14.23 8.15 38 XM_DKIMWhitelistDomains 38665 6.16 0.07 7.63 39 XM_B_Phish_Phrases 38590 10.03 20.02 7.62 40 RCVD_IN_RP_CERTIFIED 38337 6.37 1.41 7.57 41 FSL_BULK_SIG 38317 8.57 12.76 7.56 42 XM_SendGrid 34401 6.47 5.17 6.79 43 HTML_IMAGE_RATIO_02 33994 7.58 11.18 6.71 44 XM_DK_Undo_02 33714 13.23 40.53 6.65 45 MIME_QP_LONG_LINE 32321 6.44 6.72 6.38 46 BAYES_40 32215 5.98 4.39 6.36 47 DKIM_INVALID 31102 7.84 14.88 6.14 48 HTML_IMAGE_RATIO_04 28580 5.79 6.40 5.64 49 XM_H_Long_From01 28029 5.69 6.36 5.53 50 RELAYCOUNTRY_META 27503 8.42 20.85 5.43 51 XM_PDF 26723 4.40 0.79 5.27 52 RCVD_IN_IADB_LISTED 25799 4.59 2.53 5.09 53 BAYES_20 25715 4.74 3.32 5.08 54 BAYES_60 24608 4.95 5.36 4.86 55 T_REMOTE_IMAGE 23674 4.58 4.20 4.67 56 MPART_ALT_DIFF 23000 4.93 6.53 4.54 57 BOTNET_IPINHOSTNAME 22634 6.72 16.08 4.47 58 RCVD_IN_IADB_SPF 22560 4.04 2.32 4.45 59 XMStrtUSub 21923 4.27 4.05 4.33 60 T_TooManySym_01 20477 3.74 2.51 4.04 61 RCVD_IN_IADB_DK 19620 3.56 2.28 3.87 62 RCVD_IN_IADB_SENDERID 19602 3.56 2.27 3.87 63 IN_ZIMBRA_NJ_WHITELIST 18176 2.90 0.03 3.59 64 XMSexyCombo_05 18035 4.93 10.60 3.56 65 XM_UncommonTLD01 17420 6.06 16.96 3.44 66 TR_XM_DK_SendGrid 17300 3.20 2.33 3.41 67 HTML_IMAGE_RATIO_06 16964 3.46 3.91 3.35 68 FROM_EXCESS_BASE64 16845 3.25 2.93 3.32 69 BAYES_05 16798 3.06 2.00 3.32 70 XMSubMetaSx_00 16556 4.01 7.12 3.27 71 NO_DNS_FOR_FROM 16318 4.68 10.76 3.22 72 RCVD_IN_IADB_VOUCHED 16287 2.73 0.73 3.21 73 XMNumbers 16072 3.43 4.49 3.17 74 HTML_MIME_NO_HTML_TAG 16069 3.16 3.10 3.17 75 TM2_M_URI_OPT_OUT 15109 3.18 3.99 2.98 76 BAYES_99 14758 7.10 24.49 2.91 77 BOTNET 14466 6.79 23.11 2.86 78 MAILING_LIST_MULTI 13924 2.49 1.42 2.75 79 MIME_HTML_ONLY_MULTI 13554 2.70 2.79 2.68 80 XM_B_COVIDMETA 13520 5.00 14.66 2.67 81 BAYES_80 13487 3.37 6.33 2.66 82 ANY_BOUNCE_MESSAGE 13304 2.17 0.27 2.63 83 BOUNCE_MESSAGE 13303 2.17 0.27 2.63 84 RCVD_IN_MSPIKE_BL 13030 3.62 7.96 2.57 85 MIME_HTML_MOSTLY 12931 2.81 3.89 2.55 86 RCVD_IN_MSPIKE_L3 12897 3.57 7.80 2.55 87 TooManyTo_002 12617 2.15 0.72 2.49 88 HTML_IMAGE_RATIO_08 11371 2.24 2.23 2.24 89 BAYES_999 11269 5.45 18.83 2.22 90 XM_DK_Undo_01 10744 2.01 1.55 2.12 91 XM_CamelCaseFrm001 10431 2.92 6.51 2.06 92 T_TooManySym_02 10137 1.77 0.80 2.00 93 RCVD_IN_IADB_OPTIN 10118 1.69 0.44 2.00 94 KHOP_HELO_FCRDNS 10094 2.25 3.30 1.99 95 XM_H_Trusted_IP 10034 1.60 0.00 1.98 96 XM_B_Unsub2 9908 2.14 2.91 1.96 97 XM_B_SpammyTLD 9445 2.40 4.64 1.86 98 TVD_RCVD_IP 9375 1.58 0.47 1.85 99 XM_SPF_SoftFail 9176 2.24 4.02 1.81 100 TooManyTo_003 8811 1.51 0.58 1.74 101 HELO_NODOT 8715 1.52 0.68 1.72 102 HELO_NO_DOMAIN 8713 1.52 0.68 1.72 103 IN_HORDE_ADDRESS_BOOK 8351 1.34 0.04 1.65 104 URI_HEX 8296 1.83 2.64 1.64 105 T_XMDrugObfuBody_08 8123 2.16 4.48 1.60 106 XM_GoogleGroups 7906 1.36 0.55 1.56 107 UNTRUSTED_Relay 7801 3.89 13.64 1.54 108 RELAYCOUNTRY_CA 7712 2.30 5.52 1.52 109 INVALID_MSGID 7705 1.27 0.23 1.52 110 BAYES_95 7650 1.88 3.43 1.51 111 XMDiploma_00 7611 1.76 2.82 1.50 112 SUBJ_ALL_CAPS 7561 1.46 1.34 1.49 113 T_XMDrugObfuBody_14 7517 1.62 2.18 1.48 114 CK_HELO_DYNAMIC_SPLIT_IP 7499 1.23 0.21 1.48 115 HELO_DYNAMIC_IPADDR2 7495 1.21 0.07 1.48 116 XMCapTrack 7355 1.25 0.39 1.45 117 TR_Symld_Words 7331 1.40 1.20 1.45 118 TO_MALFORMED 7142 1.14 0.01 1.41 119 TR_DCC_Bayes_99 6953 4.88 19.46 1.37 120 TM2_M_VERY_LONG_WORD 6926 1.49 2.01 1.37 121 TR_XM_PhishingBody 6752 1.65 2.97 1.33 122 TooManyTo_004 6743 1.17 0.50 1.33 123 T_FILL_THIS_FORM_SHORT 6517 1.36 1.69 1.29 124 DKIM_ADSP_CUSTOM_MED 6420 1.24 1.11 1.27 125 RELAYCOUNTRY_GB 6410 1.28 1.35 1.27 126 URI_TRY_3LD 6233 1.33 1.74 1.23 127 XMStockSpam_06 6109 1.43 2.35 1.21 128 TR_MetaPhish_Combo_01 5937 1.12 0.91 1.17 129 XM_H_Long_From02 5765 1.08 0.85 1.14 130 USER_IN_DEF_DKIM_WL 5672 0.90 0.00 1.12 131 TooManyTo_005 5648 0.98 0.44 1.11 132 RCVD_IN_BL_SPAMCOP_NET 5505 1.63 3.91 1.09 133 XM_SPF_Unknown 5223 0.93 0.54 1.03 134 XMGenDplmaNmb 5135 1.15 1.72 1.01 135 XM_OfRef6 4941 1.57 4.02 0.98 136 NML_ADSP_CUSTOM_MED 4813 0.92 0.78 0.95 137 SpammyFromTLD_01 4802 1.33 2.91 0.95 138 XMGappySubj_01 4797 0.83 0.32 0.95 139 HTML_FONT_FACE_BAD 4766 0.85 0.46 0.94 140 XM_UB50 4741 2.47 8.85 0.94 141 XMBdyGiftCard01 4586 0.87 0.72 0.91 142 HTTPS_HTTP_MISMATCH 4585 0.91 0.91 0.90 143 XMSubNoVowel 4251 0.80 0.65 0.84 144 XMMoneyMeta_00 4215 0.93 1.36 0.83 145 TR_MSPIKEBAYES00 4086 0.65 0.01 0.81 146 HTML_IMAGE_ONLY_20 4068 0.70 0.30 0.80 147 XM_RXBody 4031 0.75 0.54 0.80 148 XMDateMe_00 3837 0.70 0.47 0.76 149 XMBrknScrpt_02 3796 0.84 1.24 0.75 150 XMHTML_After_End 3789 0.88 1.45 0.75 151 XM_ProductURIs 3593 0.72 0.79 0.71 152 XMSexyCombo_01 3574 1.02 2.34 0.71 153 XMBody_17 3275 1.21 3.55 0.65 154 XMNoVowels 3155 0.62 0.59 0.62 155 MISSING_HEADERS 3120 0.57 0.40 0.62 156 T_TooManySym_03 3030 0.52 0.18 0.60 157 HTML_TAG_BALANCE_BODY 2965 0.59 0.63 0.59 158 RCVD_IN_SORBS_DUL 2912 0.48 0.09 0.57 159 T_OBFU_PDF_ATTACH 2878 0.49 0.19 0.57 160 T_XMDrugObfuBody_00 2803 0.74 1.50 0.55 161 RELAYCOUNTRY_AU 2701 0.63 1.04 0.53 162 XM_ShortIntro_01 2684 0.48 0.25 0.53 163 XM_H_PHPMailer 2657 0.65 1.15 0.52 164 XM_DIRTYINTL 2589 1.01 3.06 0.51 165 XMPhish14 2559 0.59 0.94 0.51 166 XMSubMetaSxObfu_03 2501 0.63 1.19 0.49 167 TR_XM_PHPDW 2466 0.81 2.17 0.49 168 T_Symld_Words_02 2433 0.56 0.88 0.48 169 PDS_OTHER_BAD_TLD 2429 1.28 4.59 0.48 170 FORGED_GMAIL_RCVD 2404 0.57 0.94 0.47 171 TR_XM_FormFill2 2398 0.79 2.13 0.47 172 TR_XM_PHPForged 2393 0.80 2.15 0.47 173 FROM_GOV_SPOOF 2389 0.42 0.21 0.47 174 XM_H_PHPOS 2367 0.79 2.12 0.47 175 FROM_GOV_DKIM_AU 2350 0.43 0.29 0.46 176 XMSubMetaI_00 2329 0.57 1.03 0.46 177 RELAYCOUNTRY_DE 2321 0.83 2.39 0.46 178 LOW_PRICE 2285 0.48 0.59 0.45 179 HTML_IMAGE_ONLY_28 2253 0.46 0.51 0.44 180 XMHTMLBadTable_001 2192 0.45 0.54 0.43 181 USER_IN_WHITELIST 2144 0.34 0.00 0.42 182 REMOVE_BEFORE_LINK 2126 0.44 0.51 0.42 183 AC_DIV_BONANZA 2118 0.37 0.16 0.42 184 MPART_ALT_DIFF_COUNT 2101 0.46 0.67 0.41 185 SHORT_HELO_AND_INLINE_IMAGE 2096 0.34 0.05 0.41 186 XMPhish08 2091 0.52 0.94 0.41 187 TO_NO_BRKTS_HTML_ONLY 2088 0.36 0.16 0.41 188 T_XMHurry_00 2081 0.59 1.35 0.41 189 XM_Body_Obfu01 2037 0.40 0.40 0.40 190 XMSubMetaSSx_00 1990 0.41 0.49 0.39 191 HTML_IMAGE_ONLY_32 1977 0.35 0.19 0.39 192 XMPhish30 1972 0.52 1.06 0.39 193 TM2_M_BODY_EMPTY 1936 0.32 0.06 0.38 194 HTML_SHORT_LINK_IMG_3 1920 0.34 0.16 0.38 195 MSGID_FROM_MTA_HEADER 1902 0.35 0.23 0.38 196 XMOemUri 1883 0.39 0.45 0.37 197 XMBody_78 1872 0.46 0.85 0.37 198 URI_NOVOWEL 1869 0.62 1.68 0.37 199 NUMERIC_HTTP_ADDR 1868 0.45 0.81 0.37 200 XM_B_REG_HTML 1867 0.36 0.35 0.37 ----------------------------------------------------------------------