Email: 483826 Autolearn: 0 AvgScore: 3.26 AvgScanTime: 3.61 sec Spam: 136241 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 4.19 sec Ham: 347585 Autolearn: 0 AvgScore: -0.92 AvgScanTime: 3.38 sec Time Spent Running SA: 484.73 hours Time Spent Processing Spam: 158.67 hours Time Spent Processing Ham: 326.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123651 81.65 90.76 78.08 2 DCC_CHECK 101254 52.28 74.32 43.65 3 DKIM_SIGNED 99044 71.96 72.70 71.66 4 XM_DK_Pass 96713 70.84 70.99 70.79 5 DKIM_VALID 91828 67.57 67.40 67.63 6 XMListUnsubscribeExists 89820 56.06 65.93 52.19 7 DKIM_VALID_AU 77547 53.33 56.92 51.92 8 XM_H_QuotedFrom 66499 40.70 48.81 37.52 9 BAYES_50 55401 54.24 40.66 59.57 10 MIME_HTML_ONLY 49942 25.74 36.66 21.47 11 XM_DK_Undo_02 46854 16.49 34.39 9.48 12 LOC_TINY_FONT_1 44911 26.96 32.96 24.60 13 HTML_FONT_LOW_CONTRAST 43122 29.63 31.65 28.84 14 BAYES_99 39517 13.50 29.01 7.42 15 TR_DCC_Bayes_99 33737 10.20 24.76 4.49 16 BAYES_999 32908 11.41 24.15 6.42 17 DCC_CHECK_NEGATIVE 32814 46.31 24.09 55.02 18 XMSubLong 31981 21.00 23.47 20.03 19 RELAYCOUNTRY_META 30850 10.30 22.64 5.46 20 FVGT_m_MULTI_ODD 30256 20.89 22.21 20.37 21 XM_UncommonTLD01 29952 8.63 21.98 3.39 22 BOTNET 29438 7.51 21.61 1.98 23 HTML_IMAGE_RATIO_02 25382 12.87 18.63 10.61 24 T_TM2_M_HEADER_IN_MSG 25002 21.92 18.35 23.32 25 FROM_EXCESS_BASE64 24746 9.08 18.16 5.51 26 UNTRUSTED_Relay 23689 6.26 17.39 1.90 27 MultiRelay 22504 13.85 16.52 12.80 28 DKIM_VALID_EF 21587 22.86 15.84 25.61 29 XM_Body_Dirty_Words 21270 12.94 15.61 11.90 30 XM_Evil_Numbers_Gen 20886 11.14 15.33 9.50 31 T_KAM_HTML_FONT_INVALID 20129 14.54 14.77 14.45 32 XM_Multi_Part_URI 19065 13.32 13.99 13.06 33 SpammyFromTLD_02 18966 4.28 13.92 0.50 34 BOTNET_IPINHOSTNAME 18542 8.29 13.61 6.20 35 FSL_BULK_SIG 17637 9.29 12.95 7.86 36 T_REMOTE_IMAGE 17437 5.76 12.80 2.99 37 MISSING_HEADERS 17435 3.82 12.80 0.31 38 RCVD_IN_RP_RNBL 17007 3.54 12.48 0.04 39 HTML_MIME_NO_HTML_TAG 16829 6.08 12.35 3.62 40 LOTS_OF_MONEY 15618 7.99 11.46 6.63 41 BODY_URI_ONLY 14853 3.09 10.90 0.03 42 HTML_SHORT_LINK_IMG_1 14731 3.07 10.81 0.03 43 SHORTENER_SHORT_IMG 14635 3.02 10.74 0.00 44 URI_BUFFLY 14635 3.03 10.74 0.00 45 MIME_HEADER_CTYPE_ONLY 14341 3.07 10.53 0.15 46 HTML_IMAGE_ONLY_04 13569 2.83 9.96 0.04 47 BAYES_80 13354 4.90 9.80 2.97 48 XMSexyCombo_05 11755 5.79 8.63 4.68 49 HTML_IMAGE_RATIO_04 11312 6.03 8.30 5.14 50 T_XMDrugObfuBody_14 11311 6.87 8.30 6.31 51 XMNumbers 11276 6.50 8.28 5.81 52 HTML_SHORT_CENTER 11274 2.33 8.28 0.00 53 BAYES_60 10709 6.49 7.86 5.96 54 MultiRelay_Combo 10311 2.26 7.57 0.18 55 MultiRelay_CC 10311 2.26 7.57 0.18 56 TR_XM_DocInvoice 10024 4.48 7.36 3.36 57 XM_UB50 9822 2.58 7.21 0.76 58 TR_Mismatch_TLD_02 9425 1.99 6.92 0.06 59 SUBJ_ALL_CAPS 9306 2.86 6.83 1.30 60 XMSubMetaSx_00 8987 4.35 6.60 3.46 61 XM_H_Long_From01 8906 5.67 6.54 5.33 62 XMStrtUSub 8625 4.88 6.33 4.31 63 TooManyTo_001 8510 5.91 6.25 5.78 64 BAYES_95 8400 3.00 6.17 1.76 65 MPART_ALT_DIFF 8338 3.86 6.12 2.97 66 XM_B_Phish_Phrases 8187 5.64 6.01 5.50 67 HTML_IMAGE_RATIO_06 7636 5.13 5.60 4.94 68 LotsOfNums_01 7422 7.58 5.45 8.41 69 DKIM_INVALID 7216 4.39 5.30 4.03 70 US_DOLLARS_3 6514 1.71 4.78 0.51 71 MIME_HTML_MOSTLY 5835 3.43 4.28 3.10 72 RELAYCOUNTRY_AT 5717 1.48 4.20 0.41 73 URI_HEX 5653 2.52 4.15 1.89 74 RCVD_IN_RP_SAFE 5457 9.41 4.01 11.52 75 XM_OfRef6 4517 2.19 3.32 1.75 76 T_TooManySym_01 4305 5.57 3.16 6.52 77 XM_SPF_SoftFail 4252 1.56 3.12 0.94 78 FORM_FRAUD_5 4218 0.88 3.10 0.00 79 MIME_HTML_ONLY_MULTI 4185 1.70 3.07 1.16 80 RCVD_IN_RP_CERTIFIED 3991 8.30 2.93 10.41 81 XM_DIRTYINTL 3891 1.83 2.86 1.43 82 RELAYCOUNTRY_CA 3887 2.00 2.85 1.67 83 TM2_M_URI_OPT_OUT 3865 2.22 2.84 1.97 84 RCVD_IN_MSPIKE_H2 3683 3.92 2.70 4.40 85 RCVD_IN_BL_SPAMCOP_NET 3498 1.05 2.57 0.46 86 DIET_1 3454 1.20 2.54 0.68 87 XMBdyGiftCard01 3357 1.93 2.46 1.72 88 TR_Symld_Words 3307 2.54 2.43 2.58 89 XM_CamelCaseFrm001 3229 1.80 2.37 1.58 90 T_FILL_THIS_FORM_SHORT 3199 1.53 2.35 1.21 91 XMSubMetaI_00 3197 1.83 2.35 1.63 92 LongTLD 3128 0.73 2.30 0.11 93 XM_SendGrid 3090 4.71 2.27 5.67 94 ALL_TRUSTED 2974 17.96 2.18 24.14 95 HTML_IMAGE_RATIO_08 2936 2.13 2.16 2.12 96 XMSexyCombo_01 2842 0.98 2.09 0.55 97 XM_UB99 2841 0.61 2.09 0.03 98 REPLYTO_WITHOUT_TO_CC 2826 0.61 2.07 0.04 99 XM_UB80 2799 0.61 2.05 0.04 100 XM_URI_RBL 2774 0.83 2.04 0.36 101 XM_OfRef7 2696 0.68 1.98 0.17 102 XM_UB95 2695 0.57 1.98 0.01 103 BAYES_40 2668 3.24 1.96 3.74 104 BAYES_00 2636 10.51 1.93 13.88 105 MIME_QP_LONG_LINE 2604 3.89 1.91 4.66 106 XM_RXBody 2572 1.30 1.89 1.07 107 XM_H_Long_From02 2545 1.14 1.87 0.86 108 RELAYCOUNTRY_ZA 2485 0.52 1.82 0.00 109 UNPARSEABLE_RELAY 2460 3.33 1.81 3.93 110 RELAYCOUNTRY_IN 2411 0.69 1.77 0.26 111 XM_UB60 2376 0.55 1.74 0.09 112 FILL_THIS_FORM 2361 1.25 1.73 1.06 113 T_XMDrugObfuBody_08 2343 1.09 1.72 0.85 114 BOTNET_NORDNS 2271 0.48 1.67 0.02 115 XMBody_17 2231 0.88 1.64 0.59 116 XMDiploma_00 2209 1.16 1.62 0.98 117 URIBL_BLACK 2195 0.51 1.61 0.08 118 MONEY_FORM 2168 0.45 1.59 0.01 119 BAYES_20 2153 2.52 1.58 2.89 120 T_FILL_THIS_FORM_LOAN 2147 1.13 1.58 0.96 121 T_XMHurry_00 2137 1.49 1.57 1.47 122 XM_OfRef8 2113 0.45 1.55 0.02 123 BODY_ENHANCEMENT 2108 0.48 1.55 0.06 124 MONEY_FRAUD_5 2083 0.44 1.53 0.01 125 RELAYCOUNTRY_FR 2078 0.75 1.53 0.45 126 URG_BIZ 2067 0.48 1.52 0.08 127 XM_Lotto 2065 0.46 1.52 0.04 128 XMPhish30 2057 0.75 1.51 0.46 129 T_DEAR_BENEFICIARY 2057 0.43 1.51 0.00 130 RELAYCOUNTRY_JP 2049 0.44 1.50 0.02 131 TR_Caps_n_Bayes_99 2024 0.44 1.49 0.04 132 TR_XM_DK_Bayes 2023 8.65 1.48 11.46 133 TM2_M_VERY_LONG_WORD 1987 1.16 1.46 1.04 134 RELAYCOUNTRY_NG_I 1952 0.41 1.43 0.00 135 UNCLAIMED_MONEY 1930 0.40 1.42 0.00 136 RELAYCOUNTRY_KR 1928 0.42 1.42 0.03 137 RELAYCOUNTRY_CN 1926 0.46 1.41 0.09 138 TR_XM_DK_Bayes1 1923 8.26 1.41 10.95 139 RELAYCOUNTRY_BJ 1919 0.40 1.41 0.00 140 XMStockSpam_06 1905 1.91 1.40 2.10 141 DKIM_ADSP_NXDOMAIN 1883 0.74 1.38 0.49 142 XMMoneyMeta_00 1828 0.52 1.34 0.20 143 SpammyFromTLD_01 1815 0.67 1.33 0.41 144 XM_DK_Undo_01 1775 1.45 1.30 1.51 145 TR_XM_DK_Bayes2 1755 7.37 1.29 9.75 146 XMSexyCombo_04 1724 0.48 1.27 0.18 147 URIBL_DBL_SPAM 1709 0.38 1.25 0.04 148 T_XMDrugObfuBody_00 1675 0.65 1.23 0.43 149 XMPhish11 1638 1.04 1.20 0.97 150 MAILING_LIST_MULTI 1611 1.74 1.18 1.96 151 URI_TRY_3LD 1606 1.18 1.18 1.18 152 RELAYCOUNTRY_GB 1597 0.79 1.17 0.64 153 TR_LOTS_OF_MONEY1 1588 0.33 1.17 0.01 154 XM_UB999 1561 0.33 1.15 0.01 155 XM_ProductURIs 1554 1.01 1.14 0.96 156 RELAYCOUNTRY_IT 1529 0.34 1.12 0.04 157 XMSubMetaSSx_00 1481 0.54 1.09 0.32 158 XMGenDplmaNmb 1457 0.64 1.07 0.48 159 XMSubMetaSxObfu_03 1450 0.58 1.06 0.40 160 DATE_IN_PAST_03_06 1449 0.47 1.06 0.24 161 SUBJ_DOLLARS 1448 0.60 1.06 0.42 162 XM_B_REG_HTML 1423 0.75 1.04 0.64 163 RCVD_IN_IADB_LISTED 1417 3.40 1.04 4.32 164 RELAYCOUNTRY_DE 1397 0.61 1.03 0.45 165 BAYES_05 1387 1.58 1.02 1.80 166 T_MONEY_PERCENT 1373 0.40 1.01 0.16 167 TR_LOTS_OF_MONEY2 1373 0.40 1.01 0.16 168 HTML_FONT_SIZE_LARGE 1370 0.39 1.01 0.14 169 RELAYCOUNTRY_NL 1362 0.47 1.00 0.27 170 TR_XM_RelayPhish 1345 0.51 0.99 0.32 171 DATE_IN_PAST_06_12 1344 0.37 0.99 0.13 172 HK_RANDOM_FROM 1304 0.41 0.96 0.20 173 NUMERIC_HTTP_ADDR 1302 0.42 0.96 0.21 174 XMBody_78 1290 0.50 0.95 0.32 175 T_XMDrugObfuBody_12 1260 0.33 0.92 0.10 176 XMPhish14 1255 0.57 0.92 0.43 177 PLING_QUERY 1244 0.66 0.91 0.56 178 URI_WP_HACKED_2 1235 1.81 0.91 2.17 179 HTML_IMAGE_ONLY_08 1230 0.33 0.90 0.10 180 XMHTML_After_End 1223 0.50 0.90 0.34 181 RCVD_IN_IADB_SPF 1210 3.03 0.89 3.87 182 XM_H_PHPOS 1206 2.52 0.89 3.16 183 XMSlimDrugH 1199 0.40 0.88 0.21 184 RCVD_IN_IADB_SENDERID 1166 2.78 0.86 3.53 185 FROM_SUSPICIOUS_NTLD 1164 0.27 0.85 0.04 186 XM_B_COPY_HTML 1151 0.70 0.84 0.65 187 RCVD_IN_IADB_DK 1148 2.72 0.84 3.45 188 LOADSA_MONEY_COMBO 1130 0.27 0.83 0.05 189 T_TooManySym_02 1112 1.93 0.82 2.37 190 LOW_PRICE 1095 0.40 0.80 0.24 191 XMHTMLBadTable_001 1089 0.61 0.80 0.54 192 XM_Combo_Sbj 1068 0.32 0.78 0.14 193 DKIM_ADSP_CUSTOM_MED 1055 0.90 0.77 0.96 194 XMSubEmpty 1047 1.32 0.77 1.54 195 HTML_TAG_BALANCE_BODY 1034 0.44 0.76 0.31 196 XM_Body_Obfu01 1006 0.35 0.74 0.19 197 XMGppyBdWords 981 0.29 0.72 0.12 198 T_HTML_TAG_BALANCE_CENTER 952 0.26 0.70 0.09 199 NML_ADSP_CUSTOM_MED 933 0.66 0.68 0.65 200 T_Symld_Words_02 916 0.42 0.67 0.33 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271391 81.65 90.76 78.08 2 DKIM_SIGNED 249093 71.96 72.70 71.66 3 XM_DK_Pass 246052 70.84 70.99 70.79 4 DKIM_VALID 235077 67.57 67.40 67.63 5 BAYES_50 207045 54.24 40.66 59.57 6 DCC_CHECK_NEGATIVE 191241 46.31 24.09 55.02 7 XMListUnsubscribeExists 181416 56.06 65.93 52.19 8 DKIM_VALID_AU 180480 53.33 56.92 51.92 9 DCC_CHECK 151712 52.28 74.32 43.65 10 XM_H_QuotedFrom 130426 40.70 48.81 37.52 11 HTML_FONT_LOW_CONTRAST 100251 29.63 31.65 28.84 12 DKIM_VALID_EF 89000 22.86 15.84 25.61 13 LOC_TINY_FONT_1 85521 26.96 32.96 24.60 14 ALL_TRUSTED 83919 17.96 2.18 24.14 15 T_TM2_M_HEADER_IN_MSG 81067 21.92 18.35 23.32 16 MIME_HTML_ONLY 74615 25.74 36.66 21.47 17 FVGT_m_MULTI_ODD 70819 20.89 22.21 20.37 18 XMSubLong 69628 21.00 23.47 20.03 19 T_KAM_HTML_FONT_INVALID 50235 14.54 14.77 14.45 20 XM_DKIMWhitelistDomains 49396 10.21 0.01 14.21 21 BAYES_00 48235 10.51 1.93 13.88 22 XM_Multi_Part_URI 45386 13.32 13.99 13.06 23 MultiRelay 44497 13.85 16.52 12.80 24 XM_Body_Dirty_Words 41352 12.94 15.61 11.90 25 RCVD_IN_RP_SAFE 40048 9.41 4.01 11.52 26 TR_XM_DK_Bayes 39838 8.65 1.48 11.46 27 TR_XM_DK_Bayes1 38064 8.26 1.41 10.95 28 HTML_IMAGE_RATIO_02 36874 12.87 18.63 10.61 29 RCVD_IN_RP_CERTIFIED 36172 8.30 2.93 10.41 30 TR_XM_DK_Bayes2 33900 7.37 1.29 9.75 31 XM_Evil_Numbers_Gen 33028 11.14 15.33 9.50 32 XM_DK_Undo_02 32943 16.49 34.39 9.48 33 LotsOfNums_01 29232 7.58 5.45 8.41 34 FSL_BULK_SIG 27320 9.29 12.95 7.86 35 BAYES_99 25806 13.50 29.01 7.42 36 ANY_BOUNCE_MESSAGE 24135 5.16 0.60 6.94 37 BOUNCE_MESSAGE 24134 5.16 0.59 6.94 38 LOTS_OF_MONEY 23053 7.99 11.46 6.63 39 T_TooManySym_01 22661 5.57 3.16 6.52 40 BAYES_999 22302 11.41 24.15 6.42 41 T_XMDrugObfuBody_14 21936 6.87 8.30 6.31 42 BOTNET_IPINHOSTNAME 21564 8.29 13.61 6.20 43 BAYES_60 20707 6.49 7.86 5.96 44 XMNumbers 20181 6.50 8.28 5.81 45 TooManyTo_001 20104 5.91 6.25 5.78 46 XM_SendGrid 19703 4.71 2.27 5.67 47 FROM_EXCESS_BASE64 19162 9.08 18.16 5.51 48 XM_B_Phish_Phrases 19116 5.64 6.01 5.50 49 RELAYCOUNTRY_META 18970 10.30 22.64 5.46 50 XM_H_Long_From01 18539 5.67 6.54 5.33 51 HTML_IMAGE_RATIO_04 17872 6.03 8.30 5.14 52 HTML_IMAGE_RATIO_06 17178 5.13 5.60 4.94 53 XMSexyCombo_05 16256 5.79 8.63 4.68 54 MIME_QP_LONG_LINE 16214 3.89 1.91 4.66 55 TR_DCC_Bayes_99 15594 10.20 24.76 4.49 56 RCVD_IN_MSPIKE_H2 15278 3.92 2.70 4.40 57 RCVD_IN_IADB_LISTED 15026 3.40 1.04 4.32 58 XMStrtUSub 14979 4.88 6.33 4.31 59 DKIM_INVALID 14016 4.39 5.30 4.03 60 UNPARSEABLE_RELAY 13668 3.33 1.81 3.93 61 RCVD_IN_IADB_SPF 13449 3.03 0.89 3.87 62 TO_MALFORMED 13043 2.78 0.31 3.75 63 BAYES_40 12990 3.24 1.96 3.74 64 HTML_MIME_NO_HTML_TAG 12587 6.08 12.35 3.62 65 RCVD_IN_IADB_SENDERID 12281 2.78 0.86 3.53 66 XMSubMetaSx_00 12039 4.35 6.60 3.46 67 RCVD_IN_IADB_DK 12003 2.72 0.84 3.45 68 XM_UncommonTLD01 11791 8.63 21.98 3.39 69 TR_XM_DocInvoice 11670 4.48 7.36 3.36 70 TVD_RCVD_IP 11489 2.44 0.22 3.31 71 XM_H_PHPOS 10969 2.52 0.89 3.16 72 MIME_HTML_MOSTLY 10774 3.43 4.28 3.10 73 IN_ZIMBRA_NJ_WHITELIST 10427 2.16 0.01 3.00 74 T_REMOTE_IMAGE 10410 5.76 12.80 2.99 75 BAYES_80 10336 4.90 9.80 2.97 76 MPART_ALT_DIFF 10323 3.86 6.12 2.97 77 BAYES_20 10051 2.52 1.58 2.89 78 TR_Symld_Words 8979 2.54 2.43 2.58 79 RCVD_IN_IADB_VOUCHED 8725 1.97 0.61 2.51 80 T_TooManySym_02 8225 1.93 0.82 2.37 81 URI_WP_HACKED_2 7539 1.81 0.91 2.17 82 HTML_IMAGE_RATIO_08 7379 2.13 2.16 2.12 83 XMStockSpam_06 7313 1.91 1.40 2.10 84 BOTNET 6893 7.51 21.61 1.98 85 TM2_M_URI_OPT_OUT 6856 2.22 2.84 1.97 86 MAILING_LIST_MULTI 6816 1.74 1.18 1.96 87 INVALID_MSGID 6704 1.42 0.13 1.93 88 UNTRUSTED_Relay 6599 6.26 17.39 1.90 89 URI_HEX 6552 2.52 4.15 1.89 90 BAYES_05 6255 1.58 1.02 1.80 91 XM_PDF 6224 1.37 0.29 1.79 92 BAYES_95 6121 3.00 6.17 1.76 93 XM_OfRef6 6100 2.19 3.32 1.75 94 XMBdyGiftCard01 5965 1.93 2.46 1.72 95 RELAYCOUNTRY_CA 5792 2.00 2.85 1.67 96 RCVD_IN_MSPIKE_WL 5753 1.35 0.57 1.66 97 RCVD_IN_MSPIKE_H3 5743 1.35 0.56 1.65 98 TR_MetaPhish_Combo_01 5697 1.27 0.32 1.64 99 XMSubMetaI_00 5676 1.83 2.35 1.63 100 XM_CamelCaseFrm001 5486 1.80 2.37 1.58 101 IN_HORDE_ADDRESS_BOOK 5370 1.12 0.05 1.54 102 XMSubEmpty 5362 1.32 0.77 1.54 103 XM_DK_Undo_01 5260 1.45 1.30 1.51 104 RCVD_IN_IADB_OPTIN 5228 1.23 0.52 1.50 105 USER_IN_DEF_DKIM_WL 5187 1.09 0.08 1.49 106 T_XMHurry_00 5094 1.49 1.57 1.47 107 XM_DIRTYINTL 4958 1.83 2.86 1.43 108 TooManyTo_002 4785 1.18 0.67 1.38 109 XMNoSubject 4757 1.14 0.56 1.37 110 MISSING_SUBJECT 4757 1.14 0.56 1.37 111 SUBJ_ALL_CAPS 4530 2.86 6.83 1.30 112 T_FILL_THIS_FORM_SHORT 4201 1.53 2.35 1.21 113 URI_TRY_3LD 4098 1.18 1.18 1.18 114 MIME_HTML_ONLY_MULTI 4028 1.70 3.07 1.16 115 XM_RXBody 3720 1.30 1.89 1.07 116 FILL_THIS_FORM 3697 1.25 1.73 1.06 117 TM2_M_VERY_LONG_WORD 3631 1.16 1.46 1.04 118 TooManyTo_003 3505 0.89 0.59 1.01 119 T_FILL_THIS_FORM_LONG 3458 0.79 0.25 0.99 120 XM_GoogleGroups 3438 0.83 0.43 0.99 121 XMDiploma_00 3415 1.16 1.62 0.98 122 XMPhish11 3376 1.04 1.20 0.97 123 T_FILL_THIS_FORM_LOAN 3343 1.13 1.58 0.96 124 XM_ProductURIs 3342 1.01 1.14 0.96 125 DKIM_ADSP_CUSTOM_MED 3323 0.90 0.77 0.96 126 XM_SPF_SoftFail 3272 1.56 3.12 0.94 127 T_TooManySym_03 3056 0.69 0.22 0.88 128 XM_H_Long_From02 2991 1.14 1.87 0.86 129 T_XMDrugObfuBody_08 2952 1.09 1.72 0.85 130 TooManyTo_004 2837 0.72 0.46 0.82 131 XMBrknScrpt_02 2670 0.71 0.55 0.77 132 XM_UB50 2651 2.58 7.21 0.76 133 TooManyTo_005 2453 0.62 0.41 0.71 134 USER_IN_WHITELIST 2390 0.49 0.00 0.69 135 DIET_1 2376 1.20 2.54 0.68 136 XM_H_PHPMailer 2351 0.67 0.64 0.68 137 XMSubMetaSxObfu_02 2345 0.57 0.30 0.67 138 HELO_NODOT 2293 0.63 0.57 0.66 139 NML_ADSP_CUSTOM_MED 2263 0.66 0.68 0.65 140 XM_B_COPY_HTML 2252 0.70 0.84 0.65 141 XM_B_REG_HTML 2222 0.75 1.04 0.64 142 RELAYCOUNTRY_GB 2211 0.79 1.17 0.64 143 XMGappySubj_01 2207 0.50 0.14 0.63 144 XMBody_17 2050 0.88 1.64 0.59 145 HTML_FONT_FACE_BAD 2035 0.58 0.55 0.59 146 XMBody_95 2000 0.45 0.14 0.58 147 PLING_QUERY 1940 0.66 0.91 0.56 148 XMSexyCombo_01 1919 0.98 2.09 0.55 149 XM_ShortIntro_01 1914 0.51 0.39 0.55 150 XMHTMLBadTable_001 1874 0.61 0.80 0.54 151 XMNoVowels 1803 0.54 0.58 0.52 152 FORGED_GMAIL_RCVD 1793 0.55 0.63 0.52 153 US_DOLLARS_3 1768 1.71 4.78 0.51 154 XMCapTrack 1760 0.42 0.19 0.51 155 XMRcvdHeader_15 1744 0.36 0.00 0.50 156 SpammyFromTLD_02 1721 4.28 13.92 0.50 157 DKIM_ADSP_NXDOMAIN 1713 0.74 1.38 0.49 158 T_TooManySym_04 1707 0.37 0.07 0.49 159 XMGenDplmaNmb 1655 0.64 1.07 0.48 160 RCVD_IN_BL_SPAMCOP_NET 1603 1.05 2.57 0.46 161 XMPhish30 1589 0.75 1.51 0.46 162 XMSUPPORT 1586 0.33 0.00 0.46 163 XM_H_SpoofStaff4 1576 0.34 0.06 0.45 164 RELAYCOUNTRY_DE 1567 0.61 1.03 0.45 165 RELAYCOUNTRY_FR 1555 0.75 1.53 0.45 166 RDNS_DYNAMIC 1527 0.50 0.65 0.44 167 XMLngstWrd_00 1491 0.36 0.19 0.43 168 T_XMDrugObfuBody_00 1488 0.65 1.23 0.43 169 XMPhish14 1486 0.57 0.92 0.43 170 SUBJ_DOLLARS 1473 0.60 1.06 0.42 171 XM_H_PHPOS_M 1467 0.43 0.46 0.42 172 XMGappySubj_02 1459 0.31 0.04 0.42 173 RELAYCOUNTRY_AT 1427 1.48 4.20 0.41 174 SpammyFromTLD_01 1418 0.67 1.33 0.41 175 URI_NOVOWEL 1398 0.44 0.53 0.40 176 XMLngstWrd_01 1382 0.33 0.17 0.40 177 XMSubMetaSxObfu_03 1380 0.58 1.06 0.40 178 NO_DNS_FOR_FROM 1369 0.39 0.39 0.39 179 TM2_M_A_HREF_HREF 1354 0.43 0.54 0.39 180 XM_URI_RBL 1241 0.83 2.04 0.36 181 HTTPS_HTTP_MISMATCH 1240 0.40 0.53 0.36 182 HTML_IMAGE_ONLY_20 1191 0.30 0.20 0.34 183 XMHTML_After_End 1190 0.50 0.90 0.34 184 AC_DIV_BONANZA 1165 0.27 0.12 0.34 185 T_Symld_Words_02 1133 0.42 0.67 0.33 186 URIBL_DBL_ABUSE_SPAM 1127 0.33 0.34 0.32 187 XMSubMetaSSx_00 1115 0.54 1.09 0.32 188 XMDateMe_00 1114 0.28 0.17 0.32 189 XMBody_78 1113 0.50 0.95 0.32 190 MSGID_RANDY 1108 0.31 0.29 0.32 191 TR_XM_RelayPhish 1106 0.51 0.99 0.32 192 HTML_TAG_BALANCE_BODY 1078 0.44 0.76 0.31 193 MISSING_HEADERS 1071 3.82 12.80 0.31 194 XMManySubDom_06 1012 0.24 0.10 0.29 195 XMSubNoVowel 1000 0.33 0.42 0.29 196 THIS_AD 995 0.33 0.43 0.29 197 RELAYCOUNTRY_AU 991 0.30 0.34 0.29 198 XM_S_JOY_D 958 0.36 0.58 0.28 199 XMLKML 955 0.20 0.00 0.27 200 RELAYCOUNTRY_NL 935 0.47 1.00 0.27 ----------------------------------------------------------------------