Email: 292821 Autolearn: 0 AvgScore: 3.19 AvgScanTime: 1.14 sec Spam: 94835 Autolearn: 0 AvgScore: 14.09 AvgScanTime: 1.26 sec Ham: 197986 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.08 sec Time Spent Running SA: 92.74 hours Time Spent Processing Spam: 33.12 hours Time Spent Processing Ham: 59.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86971 85.39 91.71 82.37 2 DKIM_SIGNED 81889 76.29 86.35 71.48 3 XM_DK_Pass 80563 75.19 84.95 70.51 4 DKIM_VALID 79646 74.54 83.98 70.02 5 RELAYCOUNTRY_US 74029 76.02 78.06 75.04 6 XM_B_Unicode 71410 68.52 75.30 65.27 7 DCC_CHECK 65709 45.86 69.29 34.64 8 XMListUnsubscribeExists 64399 55.82 67.91 50.03 9 DKIM_VALID_AU 61710 60.11 65.07 57.73 10 XM_B_SpammyWords 60036 51.79 63.31 46.27 11 XM_DK_Undo_02 44392 21.00 46.81 8.64 12 XM_B_Unicode3 40997 42.04 43.23 41.47 13 BAYES_50 36346 48.27 38.33 53.04 14 BAYES_99 35147 16.92 37.06 7.28 15 TR_XM_DKIM_Undo 34408 15.51 36.28 5.57 16 XM_B_SpammyWords2 32844 26.80 34.63 23.04 17 LOC_TINY_FONT_1 32739 28.54 34.52 25.67 18 MIME_HTML_ONLY 31996 26.03 33.74 22.33 19 HTML_FONT_LOW_CONTRAST 30434 30.74 32.09 30.10 20 FVGT_m_MULTI_ODD 30317 26.53 31.97 23.93 21 DCC_CHECK_NEGATIVE 29104 54.12 30.69 65.34 22 BAYES_999 28075 13.66 29.60 6.02 23 DKIM_VALID_EF 27800 27.98 29.31 27.34 24 RCVD_IN_MSPIKE_H2 27108 22.15 28.58 19.06 25 RELAYCOUNTRY_META 25044 10.90 26.41 3.48 26 TR_DCC_Bayes_99 24240 10.07 25.56 2.65 27 XM_Body_Dirty_Words 24072 16.24 25.38 11.86 28 T_KAM_HTML_FONT_INVALID 23624 19.49 24.91 16.89 29 RCVD_IN_MSPIKE_WL 21052 27.50 22.20 30.04 30 T_TM2_M_HEADER_IN_MSG 19819 21.20 20.90 21.34 31 XMSubLong 18652 19.65 19.67 19.65 32 UNPARSEABLE_RELAY 15809 11.20 16.67 8.58 33 LOTS_OF_MONEY 15546 10.21 16.39 7.25 34 TR_XM_UnparsRelay 15470 9.89 16.31 6.81 35 XM_Multi_Part_URI 15217 14.32 16.05 13.49 36 RCVD_IN_MSPIKE_H3 15108 16.00 15.93 16.03 37 XM_B_Unsub 14022 15.53 14.79 15.89 38 TR_XM_SpammyRelay 13422 5.59 14.15 1.49 39 FSL_BULK_SIG 13155 6.58 13.87 3.09 40 XM_UncommonTLD01 12220 7.11 12.89 4.35 41 TR_XM_SpammyWords4 12140 7.21 12.80 4.53 42 XMSexyCombo_05 12066 6.72 12.72 3.84 43 TR_XM_SpammyWords2 11628 5.09 12.26 1.65 44 XM_B_SpammyWords3 11540 7.19 12.17 4.81 45 MPART_ALT_DIFF 11041 8.17 11.64 6.51 46 RCVD_IN_BL_SPAMCOP_NET 10953 4.38 11.55 0.94 47 BOTNET 10942 4.71 11.54 1.44 48 UNTRUSTED_Relay 10765 4.46 11.35 1.16 49 BOTNET_IPINHOSTNAME 9706 7.27 10.23 5.84 50 RELAYCOUNTRY_CA 8925 3.82 9.41 1.14 51 XM_SendGrid 8402 6.94 8.86 6.02 52 BAYES_80 7856 6.02 8.28 4.94 53 MIME_HTML_ONLY_MULTI 7830 5.76 8.26 4.56 54 TM2_M_VERY_LONG_WORD 7019 4.31 7.40 2.82 55 HTML_IMAGE_RATIO_02 6887 6.87 7.26 6.68 56 TR_XM_MaxUnsub 6799 3.46 7.17 1.68 57 BAYES_60 6715 9.86 7.08 11.20 58 HTML_MIME_NO_HTML_TAG 6666 4.14 7.03 2.76 59 XM_Evil_Numbers_Gen 6652 7.64 7.01 7.94 60 TR_XM_SPAMCOP 6110 2.25 6.44 0.24 61 XM_GoogleGroups 6088 3.91 6.42 2.71 62 XM_DIRTYINTL 5957 2.27 6.28 0.34 63 XMSubMetaSx_00 5752 4.57 6.07 3.85 64 RCVD_IN_MSPIKE_BL 5737 2.58 6.05 0.92 65 TR_XM_MSPIKECOMBO 5726 2.57 6.04 0.91 66 RCVD_IN_MSPIKE_H4 5678 10.01 5.99 11.94 67 TR_XM_DK_SendGrid 5493 4.73 5.79 4.21 68 TR_XM_PhishingBody 5473 3.50 5.77 2.41 69 LotsOfNums_01 5351 7.54 5.64 8.45 70 XMStrtUSub 5307 5.15 5.60 4.94 71 XMLngstWrd_00 5130 3.14 5.41 2.05 72 XMLngstWrd_01 5058 3.06 5.33 1.97 73 XMLngstWrd_02 5007 2.97 5.28 1.86 74 T_REMOTE_IMAGE 4954 4.29 5.22 3.85 75 XMLngstWrd_03 4926 2.88 5.19 1.78 76 XMLngstWrd_04 4889 2.84 5.16 1.73 77 BAYES_95 4861 3.83 5.13 3.21 78 HTML_TITLE_SUBJ_DIFF 4813 2.69 5.08 1.55 79 UPPERCASE_75_100 4775 2.68 5.04 1.56 80 XM_H_Long_From01 4729 4.88 4.99 4.83 81 XM_UB50 4695 2.12 4.95 0.76 82 HTML_IMAGE_RATIO_04 4545 5.11 4.79 5.27 83 XM_OfRef6 4505 2.06 4.75 0.78 84 XM_B_Investor 4324 2.68 4.56 1.79 85 TooManyTo_001 4281 9.15 4.51 11.38 86 T_FILL_THIS_FORM_SHORT 4230 1.78 4.46 0.50 87 RCVD_IN_VALIDITY_SAFE 4155 5.28 4.38 5.72 88 T_XMDrugObfuBody_14 4137 2.79 4.36 2.04 89 XM_B_Phish_Phrases 4121 3.39 4.35 2.93 90 SpammyFromTLD_01 4013 1.63 4.23 0.39 91 XM_SPF_SoftFail 3871 2.47 4.08 1.69 92 TR_Mismatch_TLD_02 3857 1.37 4.07 0.08 93 SpammyFromTLD_02 3745 1.40 3.95 0.18 94 TR_XM_SpammyWords5 3737 2.15 3.94 1.29 95 MIME_HTML_MOSTLY 3733 2.93 3.94 2.45 96 MONEY_NOHTML 3590 1.28 3.79 0.07 97 HTML_IMAGE_RATIO_06 3581 3.31 3.78 3.08 98 RCVD_IN_VALIDITY_CERTIFIED 3554 4.69 3.75 5.14 99 XM_B_SpammyTLD 3186 2.34 3.36 1.86 100 XM_B_Phish66 3159 1.77 3.33 1.03 101 RCVD_IN_VALIDITY_RPBL 3152 1.11 3.32 0.05 102 XMNumbers 3150 4.14 3.32 4.53 103 T_XMDrugObfuBody_08 2940 1.78 3.10 1.14 104 URI_NOVOWEL 2791 2.18 2.94 1.82 105 KHOP_HELO_FCRDNS 2765 1.80 2.92 1.27 106 SUBJ_ALL_CAPS 2764 1.71 2.91 1.13 107 RCVD_IN_MSPIKE_L3 2726 1.27 2.87 0.50 108 XM_B_SpammyWords4 2670 1.36 2.82 0.66 109 XMSexyCombo_01 2648 1.23 2.79 0.48 110 TM2_M_URI_OPT_OUT 2619 6.10 2.76 7.70 111 TR_XM_MSPIKECOMBO2 2566 0.96 2.71 0.12 112 BOTNET_NORDNS 2499 0.87 2.64 0.02 113 XM_CamelCaseFrm001 2490 2.10 2.63 1.84 114 T_TooManySym_01 2446 5.85 2.58 7.42 115 XM_URI_RBL 2443 0.92 2.58 0.13 116 RCVD_IN_MSPIKE_L5 2390 0.83 2.52 0.02 117 MIME_QP_LONG_LINE 2388 7.13 2.52 9.34 118 T_XMHurry_00 2348 1.44 2.48 0.95 119 DKIM_INVALID 2243 1.75 2.37 1.46 120 USER_IN_DEF_DKIM_WL 2235 11.43 2.36 15.78 121 ALL_TRUSTED 2215 16.02 2.34 22.58 122 MAILING_LIST_MULTI 2121 2.07 2.24 1.99 123 MILLION_USD 2104 0.72 2.22 0.01 124 TR_XM_BayesRelay 2095 0.72 2.21 0.00 125 XM_UB99 2076 0.71 2.19 0.00 126 TR_XM_SpammyWords3 2069 0.95 2.18 0.36 127 XMBody_17 2046 1.00 2.16 0.44 128 MONEY_FORM_SHORT 2015 0.69 2.12 0.00 129 HTML_IMAGE_RATIO_08 2007 1.92 2.12 1.83 130 HK_RANDOM_REPLYTO 1971 0.77 2.08 0.14 131 XM_B_Unsub2 1970 1.37 2.08 1.03 132 TR_XM_NoHeaderRelay 1964 0.76 2.07 0.14 133 DKIM_ADSP_NXDOMAIN 1938 2.09 2.04 2.12 134 XM_DK_Undo_01 1934 1.47 2.04 1.20 135 XM_Attn_01 1924 0.69 2.03 0.05 136 TR_Symld_Words 1900 1.62 2.00 1.43 137 TR_LOTS_OF_MONEY3 1876 0.77 1.98 0.20 138 FORM_FRAUD 1840 0.63 1.94 0.00 139 NO_DNS_FOR_FROM 1805 0.82 1.90 0.30 140 HTML_FONT_TINY_NORDNS 1804 0.67 1.90 0.08 141 TR_XM_MaxWHORU 1801 0.78 1.90 0.24 142 XM_UB999 1751 0.60 1.85 0.00 143 TR_XM_PHPDW 1746 0.91 1.84 0.46 144 RCVD_IN_IADB_LISTED 1709 3.24 1.80 3.94 145 XMStockSpam_06 1705 1.06 1.80 0.71 146 TR_XM_PHPForged 1701 0.86 1.79 0.41 147 TR_XM_SB_Phish 1695 1.66 1.79 1.60 148 TR_XM_FormFill2 1665 0.85 1.76 0.41 149 XM_H_PHPOS 1654 0.83 1.74 0.40 150 BAYES_40 1651 3.22 1.74 3.93 151 XM_H_Undi_Recip 1638 0.67 1.73 0.17 152 XMDiploma_00 1621 1.24 1.71 1.01 153 DIET_1 1594 0.78 1.68 0.35 154 RCVD_IN_PSBL 1588 0.57 1.67 0.04 155 RELAYCOUNTRY_RU 1577 0.56 1.66 0.03 156 URIBL_DBL_SPAM 1569 0.55 1.65 0.01 157 FROM_EXCESS_BASE64 1563 3.03 1.65 3.69 158 RELAYCOUNTRY_IR 1548 0.53 1.63 0.00 159 T_XMDrugObfuBody_00 1539 1.06 1.62 0.79 160 XMHTML_After_End 1527 0.86 1.61 0.50 161 URI_HEX 1504 1.31 1.59 1.18 162 XM_UB60 1468 0.53 1.55 0.05 163 RELAYCOUNTRY_FR 1464 0.63 1.54 0.19 164 TR_XM_Undi_Recip11 1453 0.51 1.53 0.03 165 HTML_TAG_BALANCE_BODY 1428 0.93 1.51 0.65 166 FILL_THIS_FORM 1418 0.69 1.50 0.30 167 TR_XM_MaxSPIKE 1410 0.51 1.49 0.04 168 XMSubNoVowel 1376 1.07 1.45 0.89 169 TR_XM_FormFill 1374 0.48 1.45 0.01 170 RCVD_IN_IADB_SPF 1371 2.90 1.45 3.60 171 FILL_THIS_FORM_LONG 1357 0.55 1.43 0.13 172 XMSubPhish11 1334 1.53 1.41 1.59 173 TR_XM_Undi_Recip5 1320 0.45 1.39 0.01 174 TR_XM_Undi_RecipCombo2 1309 0.45 1.38 0.00 175 XM_H_Long_From02 1284 0.97 1.35 0.78 176 XMReplyNow 1283 0.59 1.35 0.22 177 LOADSA_MONEY_COMBO 1252 0.44 1.32 0.02 178 XM_UB80 1241 0.44 1.31 0.02 179 RCVD_IN_IADB_DK 1214 2.57 1.28 3.19 180 XMHTMLBadTable_001 1213 0.90 1.28 0.72 181 PDS_OTHER_BAD_TLD 1202 0.57 1.27 0.23 182 RELAYCOUNTRY_AU 1199 0.52 1.26 0.17 183 RCVD_IN_IADB_SENDERID 1190 2.64 1.25 3.31 184 XFER_LOTSA_MONEY 1181 0.41 1.25 0.00 185 XMBrknScrpt_02 1178 0.84 1.24 0.64 186 RCVD_IN_IADB_VOUCHED 1152 2.00 1.21 2.37 187 XM_RXBody 1151 1.28 1.21 1.31 188 XM_Nigeria_01 1146 0.40 1.21 0.01 189 XMSlimDrugH 1134 0.81 1.20 0.62 190 XM_Body_Dirty_Words_01 1134 0.46 1.20 0.11 191 FROM_SUSPICIOUS_NTLD 1126 0.43 1.19 0.07 192 MONEY_FORM 1122 0.39 1.18 0.00 193 XM_ProductURIs 1118 0.95 1.18 0.84 194 UNDISC_MONEY 1116 0.39 1.18 0.01 195 BAYES_20 1093 2.94 1.15 3.79 196 MONEY_FRAUD_5 1089 0.37 1.15 0.00 197 XMBdyGiftCard01 1076 1.24 1.13 1.28 198 FROM_SUSPICIOUS_NTLD_FP 1061 0.41 1.12 0.07 199 TR_XM_Undi_Recip9 1059 0.36 1.12 0.00 200 ADVANCE_FEE_5_NEW_FRM_MNY 1054 0.36 1.11 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163072 85.39 91.71 82.37 2 RELAYCOUNTRY_US 148561 76.02 78.06 75.04 3 DKIM_SIGNED 141515 76.29 86.35 71.48 4 XM_DK_Pass 139597 75.19 84.95 70.51 5 DKIM_VALID 138630 74.54 83.98 70.02 6 DCC_CHECK_NEGATIVE 129358 54.12 30.69 65.34 7 XM_B_Unicode 129232 68.52 75.30 65.27 8 DKIM_VALID_AU 114307 60.11 65.07 57.73 9 BAYES_50 105008 48.27 38.33 53.04 10 XMListUnsubscribeExists 99047 55.82 67.91 50.03 11 XM_B_SpammyWords 91610 51.79 63.31 46.27 12 XM_B_Unicode3 82098 42.04 43.23 41.47 13 DCC_CHECK 68585 45.86 69.29 34.64 14 HTML_FONT_LOW_CONTRAST 59588 30.74 32.09 30.10 15 RCVD_IN_MSPIKE_WL 59466 27.50 22.20 30.04 16 DKIM_VALID_EF 54139 27.98 29.31 27.34 17 LOC_TINY_FONT_1 50829 28.54 34.52 25.67 18 FVGT_m_MULTI_ODD 47382 26.53 31.97 23.93 19 XM_B_SpammyWords2 45622 26.80 34.63 23.04 20 ALL_TRUSTED 44703 16.02 2.34 22.58 21 MIME_HTML_ONLY 44215 26.03 33.74 22.33 22 T_TM2_M_HEADER_IN_MSG 42259 21.20 20.90 21.34 23 XMSubLong 38896 19.65 19.67 19.65 24 RCVD_IN_MSPIKE_H2 37746 22.15 28.58 19.06 25 T_KAM_HTML_FONT_INVALID 33435 19.49 24.91 16.89 26 RCVD_IN_MSPIKE_H3 31739 16.00 15.93 16.03 27 XM_B_Unsub 31453 15.53 14.79 15.89 28 USER_IN_DEF_DKIM_WL 31234 11.43 2.36 15.78 29 XM_Multi_Part_URI 26713 14.32 16.05 13.49 30 RCVD_IN_MSPIKE_H4 23648 10.01 5.99 11.94 31 XM_Body_Dirty_Words 23472 16.24 25.38 11.86 32 TooManyTo_001 22521 9.15 4.51 11.38 33 BAYES_60 22167 9.86 7.08 11.20 34 BAYES_00 20943 7.36 0.64 10.58 35 XM_DKIMWhitelistDomains 20645 7.06 0.03 10.43 36 MIME_QP_LONG_LINE 18493 7.13 2.52 9.34 37 XM_DK_Undo_02 17104 21.00 46.81 8.64 38 UNPARSEABLE_RELAY 16982 11.20 16.67 8.58 39 LotsOfNums_01 16735 7.54 5.64 8.45 40 XM_Evil_Numbers_Gen 15729 7.64 7.01 7.94 41 TM2_M_URI_OPT_OUT 15249 6.10 2.76 7.70 42 T_TooManySym_01 14688 5.85 2.58 7.42 43 BAYES_99 14405 16.92 37.06 7.28 44 LOTS_OF_MONEY 14349 10.21 16.39 7.25 45 TR_XM_UnparsRelay 13487 9.89 16.31 6.81 46 HTML_IMAGE_RATIO_02 13217 6.87 7.26 6.68 47 MPART_ALT_DIFF 12892 8.17 11.64 6.51 48 XM_SendGrid 11920 6.94 8.86 6.02 49 BAYES_999 11914 13.66 29.60 6.02 50 BOTNET_IPINHOSTNAME 11570 7.27 10.23 5.84 51 TR_XM_DK_Bayes 11499 4.10 0.54 5.81 52 TR_XM_DK_Bayes1 11336 4.05 0.54 5.73 53 RCVD_IN_VALIDITY_SAFE 11317 5.28 4.38 5.72 54 TR_XM_DKIM_Undo 11018 15.51 36.28 5.57 55 IN_ZIMBRA_NJ_WHITELIST 10879 3.74 0.06 5.49 56 HTML_IMAGE_RATIO_04 10426 5.11 4.79 5.27 57 TR_XM_DK_Bayes2 10399 3.69 0.41 5.25 58 RCVD_IN_VALIDITY_CERTIFIED 10168 4.69 3.75 5.14 59 XMStrtUSub 9781 5.15 5.60 4.94 60 BAYES_80 9777 6.02 8.28 4.94 61 T_TooManySym_02 9612 3.53 0.75 4.85 62 XM_H_Long_From01 9566 4.88 4.99 4.83 63 XM_B_SpammyWords3 9515 7.19 12.17 4.81 64 SHORT_URI_2 9314 3.39 0.64 4.70 65 MIME_HTML_ONLY_MULTI 9032 5.76 8.26 4.56 66 XMNumbers 8972 4.14 3.32 4.53 67 TR_XM_SpammyWords4 8961 7.21 12.80 4.53 68 XM_UncommonTLD01 8609 7.11 12.89 4.35 69 TR_XM_DK_SendGrid 8345 4.73 5.79 4.21 70 RCVD_IN_IADB_LISTED 7791 3.24 1.80 3.94 71 BAYES_40 7782 3.22 1.74 3.93 72 XMSubMetaSx_00 7626 4.57 6.07 3.85 73 T_REMOTE_IMAGE 7621 4.29 5.22 3.85 74 XMSexyCombo_05 7603 6.72 12.72 3.84 75 BAYES_20 7504 2.94 1.15 3.79 76 FROM_EXCESS_BASE64 7312 3.03 1.65 3.69 77 RCVD_IN_IADB_SPF 7129 2.90 1.45 3.60 78 INVALID_MSGID 6945 2.43 0.19 3.51 79 RELAYCOUNTRY_META 6884 10.90 26.41 3.48 80 RCVD_IN_IADB_SENDERID 6553 2.64 1.25 3.31 81 BAYES_95 6353 3.83 5.13 3.21 82 RCVD_IN_IADB_DK 6316 2.57 1.28 3.19 83 TVD_RCVD_IP 6249 2.20 0.20 3.16 84 FSL_BULK_SIG 6121 6.58 13.87 3.09 85 HTML_IMAGE_RATIO_06 6097 3.31 3.78 3.08 86 BOUNCE_MESSAGE 5881 2.23 0.69 2.97 87 ANY_BOUNCE_MESSAGE 5881 2.23 0.69 2.97 88 XM_B_Phish_Phrases 5807 3.39 4.35 2.93 89 TO_MALFORMED 5767 1.98 0.03 2.91 90 TM2_M_VERY_LONG_WORD 5589 4.31 7.40 2.82 91 HTML_MIME_NO_HTML_TAG 5459 4.14 7.03 2.76 92 XM_GoogleGroups 5375 3.91 6.42 2.71 93 TR_DCC_Bayes_99 5237 10.07 25.56 2.65 94 XM_H_Trusted_IP 5060 1.73 0.00 2.56 95 MIME_HTML_MOSTLY 4860 2.93 3.94 2.45 96 TR_XM_PhishingBody 4770 3.50 5.77 2.41 97 RCVD_IN_IADB_VOUCHED 4701 2.00 1.21 2.37 98 XM_PDF 4279 1.60 0.44 2.16 99 DKIM_ADSP_NXDOMAIN 4188 2.09 2.04 2.12 100 RCVD_IN_MSPIKE_H5 4079 1.48 0.28 2.06 101 XMLngstWrd_00 4050 3.14 5.41 2.05 102 BAYES_05 4045 1.56 0.56 2.04 103 T_XMDrugObfuBody_14 4030 2.79 4.36 2.04 104 MAILING_LIST_MULTI 3938 2.07 2.24 1.99 105 XMLngstWrd_01 3905 3.06 5.33 1.97 106 IN_HORDE_ADDRESS_BOOK 3867 1.34 0.05 1.95 107 XMBSHREFv2 3687 1.34 0.26 1.86 108 XMLngstWrd_02 3685 2.97 5.28 1.86 109 XM_B_SpammyTLD 3674 2.34 3.36 1.86 110 XM_CamelCaseFrm001 3645 2.10 2.63 1.84 111 HTML_IMAGE_RATIO_08 3614 1.92 2.12 1.83 112 URI_NOVOWEL 3601 2.18 2.94 1.82 113 XM_B_Investor 3536 2.68 4.56 1.79 114 XMLngstWrd_03 3518 2.88 5.19 1.78 115 XMLngstWrd_04 3416 2.84 5.16 1.73 116 XM_SPF_SoftFail 3351 2.47 4.08 1.69 117 TR_XM_MaxUnsub 3329 3.46 7.17 1.68 118 XMGappySubj_01 3308 1.32 0.60 1.67 119 TR_XM_SpammyWords2 3263 5.09 12.26 1.65 120 RCVD_IN_IADB_OPTIN 3250 1.36 0.77 1.64 121 TR_XM_SB_Phish 3171 1.66 1.79 1.60 122 XMSubPhish11 3143 1.53 1.41 1.59 123 TVD_SPACE_RATIO 3139 1.10 0.10 1.59 124 UPPERCASE_75_100 3081 2.68 5.04 1.56 125 HTML_TITLE_SUBJ_DIFF 3065 2.69 5.08 1.55 126 TR_XM_SpammyRelay 2956 5.59 14.15 1.49 127 DKIM_INVALID 2885 1.75 2.37 1.46 128 BOTNET 2852 4.71 11.54 1.44 129 TR_Symld_Words 2835 1.62 2.00 1.43 130 XM_RXBody 2595 1.28 1.21 1.31 131 TR_XM_SpammyWords5 2557 2.15 3.94 1.29 132 XMBdyGiftCard01 2542 1.24 1.13 1.28 133 KHOP_HELO_FCRDNS 2516 1.80 2.92 1.27 134 TooManyTo_002 2483 1.11 0.82 1.25 135 MSGID_NOFQDN1 2379 0.82 0.01 1.20 136 XM_DK_Undo_01 2377 1.47 2.04 1.20 137 T_TooManySym_03 2364 0.91 0.31 1.19 138 XMBody_95 2355 0.85 0.15 1.19 139 URI_HEX 2338 1.31 1.59 1.18 140 UNTRUSTED_Relay 2290 4.46 11.35 1.16 141 T_XMDrugObfuBody_08 2263 1.78 3.10 1.14 142 RELAYCOUNTRY_CA 2252 3.82 9.41 1.14 143 SUBJ_ALL_CAPS 2246 1.71 2.91 1.13 144 RCVD_IN_RP_SAFE 2112 1.03 0.95 1.07 145 XM_B_Unsub2 2049 1.37 2.08 1.03 146 XM_B_Phish66 2035 1.77 3.33 1.03 147 XMDiploma_00 2008 1.24 1.71 1.01 148 SHORTENED_URL_HREF 1929 0.75 0.28 0.97 149 RCVD_IN_RP_CERTIFIED 1904 0.91 0.82 0.96 150 XM_B_COPY_HTML 1887 0.86 0.65 0.95 151 T_XMHurry_00 1871 1.44 2.48 0.95 152 RCVD_IN_BL_SPAMCOP_NET 1869 4.38 11.55 0.94 153 HTML_FONT_FACE_BAD 1839 0.98 1.08 0.93 154 RCVD_IN_MSPIKE_BL 1812 2.58 6.05 0.92 155 TR_XM_MSPIKECOMBO 1810 2.57 6.04 0.91 156 XMSubNoVowel 1768 1.07 1.45 0.89 157 TooManyTo_003 1713 0.82 0.74 0.87 158 XM_ProductURIs 1656 0.95 1.18 0.84 159 TR_MetaPhish_Combo_01 1645 0.74 0.54 0.83 160 XM_shorewaves_Whitelist 1618 0.55 0.00 0.82 161 DKIM_ADSP_CUSTOM_MED 1598 0.85 0.93 0.81 162 T_XMDrugObfuBody_00 1571 1.06 1.62 0.79 163 XM_H_Long_From02 1552 0.97 1.35 0.78 164 XMSubMetaI_00 1537 0.88 1.09 0.78 165 XM_OfRef6 1537 2.06 4.75 0.78 166 XM_UB50 1508 2.12 4.95 0.76 167 HTML_IMAGE_ONLY_20 1458 0.64 0.45 0.74 168 XMHTMLBadTable_001 1416 0.90 1.28 0.72 169 MPART_ALT_DIFF_COUNT 1405 0.78 0.92 0.71 170 XMStockSpam_06 1403 1.06 1.80 0.71 171 XMPhish30 1401 0.84 1.10 0.71 172 USER_IN_WHITELIST 1395 0.48 0.00 0.70 173 USER_IN_WELCOMELIST 1395 0.48 0.00 0.70 174 XM_H_PHPMailer 1347 0.74 0.87 0.68 175 XM_B_SpammyWords4 1301 1.36 2.82 0.66 176 HTML_TAG_BALANCE_BODY 1294 0.93 1.51 0.65 177 SHORT_URI_3 1286 0.48 0.11 0.65 178 XMBrknScrpt_02 1270 0.84 1.24 0.64 179 TooManyTo_004 1259 0.64 0.64 0.64 180 XMSlimDrugH 1224 0.81 1.20 0.62 181 RDNS_DYNAMIC 1110 0.56 0.55 0.56 182 XMSubMetaSxObfu_02 1089 0.56 0.58 0.55 183 PRICES_ARE_AFFORDABLE 1083 0.44 0.21 0.55 184 URI_TRY_3LD 1076 0.64 0.85 0.54 185 TooManyTo_005 1029 0.55 0.62 0.52 186 NML_ADSP_CUSTOM_MED 1011 0.60 0.79 0.51 187 RELAYCOUNTRY_GB 1007 0.58 0.74 0.51 188 XMHTML_After_End 992 0.86 1.61 0.50 189 RCVD_IN_MSPIKE_L3 990 1.27 2.87 0.50 190 XMSubMetaSxObfu_03 988 0.45 0.36 0.50 191 T_FILL_THIS_FORM_SHORT 988 1.78 4.46 0.50 192 XMSexyCombo_01 958 1.23 2.79 0.48 193 XMGenDplmaNmb 954 0.55 0.69 0.48 194 TR_XM_PHPDW 918 0.91 1.84 0.46 195 FORGED_GMAIL_RCVD 909 0.56 0.77 0.46 196 TVD_QUAL_MEDS 894 0.34 0.10 0.45 197 TR_MSPIKEBAYES00 886 0.31 0.01 0.45 198 XMBody_17 874 1.00 2.16 0.44 199 XM_B_REG_HTML 869 0.59 0.92 0.44 200 XMSubject_09 856 0.36 0.21 0.43 ----------------------------------------------------------------------