Email: 369620 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 2.09 sec Spam: 103909 Autolearn: 0 AvgScore: 12.63 AvgScanTime: 2.52 sec Ham: 265711 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.92 sec Time Spent Running SA: 214.76 hours Time Spent Processing Spam: 72.73 hours Time Spent Processing Ham: 142.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 98079 89.04 94.39 86.95 2 DKIM_SIGNED 82182 75.55 79.09 74.17 3 XMListUnsubscribeExists 79794 59.58 76.79 52.85 4 DCC_CHECK 79008 52.88 76.04 43.83 5 XM_DK_Pass 78306 73.82 75.36 73.22 6 DKIM_VALID 74081 70.43 71.29 70.09 7 DKIM_VALID_AU 62198 56.33 59.86 54.95 8 XM_H_QuotedFrom 49064 39.07 47.22 35.89 9 XM_DK_Undo_02 48388 25.98 46.57 17.92 10 BAYES_99 45488 24.05 43.78 16.33 11 MIME_HTML_ONLY 39710 31.18 38.22 28.43 12 BAYES_999 39186 21.08 37.71 14.58 13 LOC_TINY_FONT_1 38169 27.81 36.73 24.32 14 HTML_FONT_LOW_CONTRAST 37535 32.82 36.12 31.53 15 TR_DCC_Bayes_99 36363 15.35 35.00 7.67 16 BAYES_50 34891 45.73 33.58 50.48 17 FVGT_m_MULTI_ODD 26651 23.01 25.65 21.98 18 XMSubLong 24207 21.01 23.30 20.12 19 XM_Body_Dirty_Words 24015 15.95 23.11 13.15 20 DCC_CHECK_NEGATIVE 23596 46.03 22.71 55.15 21 RELAYCOUNTRY_META 23296 9.08 22.42 3.87 22 BOTNET 21736 7.34 20.92 2.04 23 T_KAM_HTML_FONT_INVALID 20270 16.28 19.51 15.02 24 DKIM_VALID_EF 19790 25.82 19.05 28.46 25 BOTNET_IPINHOSTNAME 17749 9.51 17.08 6.55 26 T_TM2_M_HEADER_IN_MSG 17745 21.00 17.08 22.53 27 MultiRelay 17370 15.53 16.72 15.07 28 XM_Multi_Part_URI 16273 14.44 15.66 13.97 29 HTML_IMAGE_RATIO_02 15100 11.55 14.53 10.38 30 XMSexyCombo_05 14717 7.01 14.16 4.22 31 XM_Evil_Numbers_Gen 13879 10.00 13.36 8.68 32 LOTS_OF_MONEY 13774 10.53 13.26 9.46 33 UNTRUSTED_Relay 13739 4.77 13.22 1.46 34 FSL_BULK_SIG 10301 8.54 9.91 8.00 35 XM_UncommonTLD01 9508 5.51 9.15 4.09 36 HTML_IMAGE_RATIO_04 9445 7.25 9.09 6.53 37 T_XMDrugObfuBody_14 8858 7.83 8.52 7.56 38 DKIM_ADSP_NXDOMAIN 8833 2.88 8.50 0.68 39 XMSubMetaSx_00 8743 5.50 8.41 4.36 40 DKIM_INVALID 8101 5.12 7.80 4.07 41 XM_H_Long_From01 7252 6.43 6.98 6.22 42 FROM_EXCESS_BASE64 7179 10.91 6.91 12.47 43 XM_DIRTYINTL 7158 3.91 6.89 2.75 44 MPART_ALT_DIFF 7084 4.57 6.82 3.69 45 XM_B_Phish_Phrases 6968 6.38 6.71 6.25 46 RCVD_IN_RP_SAFE 6762 12.02 6.51 14.18 47 BAYES_80 6757 4.78 6.50 4.10 48 TooManyTo_001 6672 5.81 6.42 5.57 49 RELAYCOUNTRY_FR 6496 1.96 6.25 0.28 50 HTML_MIME_NO_HTML_TAG 6331 3.11 6.09 1.95 51 RCVD_IN_RP_CERTIFIED 5778 10.73 5.56 12.75 52 BAYES_60 5741 6.43 5.53 6.79 53 XM_UB50 5244 2.05 5.05 0.88 54 LotsOfNums_01 5007 6.73 4.82 7.48 55 XMBdyGiftCard01 4992 2.69 4.80 1.86 56 XMNumbers 4973 8.91 4.79 10.53 57 RCVD_IN_BL_SPAMCOP_NET 4844 1.59 4.66 0.39 58 XMMoneyMeta_00 4755 1.49 4.58 0.28 59 ALL_TRUSTED 4727 16.90 4.55 21.73 60 MIME_HTML_ONLY_MULTI 4524 2.54 4.35 1.83 61 HTML_IMAGE_RATIO_06 4407 3.74 4.24 3.54 62 PDS_TO_EQ_FROM_NAME 4355 1.25 4.19 0.10 63 URI_HEX 4310 2.65 4.15 2.07 64 URIBL_DBL_ABUSE_REDIR 4296 1.23 4.13 0.09 65 MIME_HTML_MOSTLY 4277 3.07 4.12 2.66 66 XM_URI_RBL 4197 1.64 4.04 0.71 67 BOTNET_NORDNS 4082 1.11 3.93 0.01 68 XMStrtUSub 4063 4.66 3.91 4.95 69 XM_CamelCaseFrm001 4058 2.26 3.91 1.61 70 BAYES_95 4046 3.17 3.89 2.88 71 RELAYCOUNTRY_CA 4034 2.05 3.88 1.33 72 RELAYCOUNTRY_DE 3967 1.31 3.82 0.32 73 HTML_IMAGE_RATIO_08 3758 2.43 3.62 1.96 74 T_TooManySym_01 3710 6.39 3.57 7.49 75 NUMERIC_HTTP_ADDR 3608 1.20 3.47 0.31 76 RCVD_IN_RP_RNBL 3566 1.01 3.43 0.07 77 XM_SPF_SoftFail 3495 1.84 3.36 1.24 78 BAYES_40 3358 3.13 3.23 3.09 79 XM_SendGrid 3351 5.75 3.22 6.73 80 XMBody_17 3295 1.45 3.17 0.78 81 NORMAL_HTTP_TO_IP 3041 0.85 2.93 0.04 82 XMSexyCombo_01 2994 1.22 2.88 0.57 83 MultiRelay_CC 2993 0.90 2.88 0.13 84 MultiRelay_Combo 2993 0.90 2.88 0.13 85 SpammyFromTLD_02 2938 0.92 2.83 0.18 86 XMDiploma_00 2927 1.72 2.82 1.29 87 MIME_QP_LONG_LINE 2849 3.96 2.74 4.44 88 RELAYCOUNTRY_JP 2816 0.78 2.71 0.03 89 TR_XM_PHPDW 2797 1.22 2.69 0.64 90 TR_XM_PHPForged 2761 1.19 2.66 0.62 91 TR_XM_FormFill2 2736 1.18 2.63 0.61 92 XM_H_PHPOS 2715 1.17 2.61 0.61 93 FROM_SUSPICIOUS_NTLD 2686 0.78 2.58 0.08 94 NO_DNS_FOR_FROM 2647 1.67 2.55 1.33 95 MIME_HEADER_CTYPE_ONLY 2633 0.85 2.53 0.19 96 XM_ProductURIs 2605 1.55 2.51 1.18 97 BAD_ENC_HEADER 2546 0.70 2.45 0.02 98 XM_UB99 2540 0.70 2.44 0.01 99 XM_OfRef6 2498 1.63 2.40 1.33 100 SUBJ_ALL_CAPS 2480 1.69 2.39 1.42 101 XMSubGiftCard1 2349 0.71 2.26 0.11 102 TM2_M_URI_OPT_OUT 2344 1.57 2.26 1.30 103 T_REMOTE_IMAGE 2337 3.12 2.25 3.47 104 XM_UB999 2210 0.61 2.13 0.01 105 T_XMHurry_00 2107 1.10 2.03 0.74 106 RCVD_IN_MSPIKE_H2 2077 3.73 2.00 4.41 107 BODY_URI_ONLY 2042 0.57 1.97 0.03 108 SUBJ_DOLLARS 2017 1.05 1.94 0.71 109 SpammyFromTLD_01 2013 0.86 1.94 0.44 110 DIET_1 1931 0.80 1.86 0.39 111 FSL_THIS_IS_ADV 1890 0.67 1.82 0.21 112 FILL_THIS_FORM 1879 0.79 1.81 0.39 113 BAYES_20 1857 2.20 1.79 2.37 114 T_XMDrugObfuBody_08 1842 1.44 1.77 1.30 115 XM_JunkDunk 1839 0.50 1.77 0.00 116 XM_B_REG_HTML 1808 0.80 1.74 0.43 117 XM_H_PHPMailer 1622 0.82 1.56 0.53 118 FILL_THIS_FORM_LONG 1614 0.68 1.55 0.33 119 TR_XM_RelayPhish 1612 1.29 1.55 1.18 120 XMSubGiftCard2 1610 0.50 1.55 0.09 121 XMSubMetaI_00 1593 0.94 1.53 0.71 122 MAILING_LIST_MULTI 1574 1.64 1.51 1.69 123 RELAYCOUNTRY_GB 1553 0.78 1.49 0.49 124 URI_TRY_3LD 1551 1.49 1.49 1.49 125 UNPARSEABLE_RELAY 1547 3.35 1.49 4.08 126 TR_XM_DK_SendGrid 1464 3.01 1.41 3.63 127 XMStockSpam_06 1456 0.97 1.40 0.80 128 XM_H_PHPOS_M 1436 0.58 1.38 0.26 129 RELAYCOUNTRY_IN 1408 0.41 1.36 0.04 130 XMGenDplmaNmb 1396 0.87 1.34 0.68 131 TM2_M_VERY_LONG_WORD 1387 1.57 1.33 1.66 132 T_Symld_Words_02 1371 0.92 1.32 0.76 133 XMSexyCombo_04 1358 0.45 1.31 0.12 134 ADMITS_SPAM 1356 0.38 1.30 0.02 135 TR_Caps_n_Bayes_99 1354 0.51 1.30 0.20 136 BODY_ENHANCEMENT 1349 0.42 1.30 0.08 137 XMPhish30 1229 0.77 1.18 0.61 138 TR_LOTS_OF_MONEY3 1228 0.57 1.18 0.34 139 XMBody_78 1227 0.70 1.18 0.51 140 XMHTMLBadTable_001 1186 0.67 1.14 0.48 141 URIBL_BLACK 1176 0.37 1.13 0.07 142 XM_H_Long_From02 1166 0.92 1.12 0.84 143 T_XMDrugObfuBody_00 1159 0.88 1.12 0.79 144 RELAYCOUNTRY_AT 1138 0.49 1.10 0.25 145 LONG_JUNK_URI 1136 0.36 1.09 0.07 146 RCVD_IN_IADB_LISTED 1135 3.54 1.09 4.49 147 HTML_TAG_BALANCE_BODY 1133 0.83 1.09 0.72 148 FROM_DOMAIN_NOVOWEL 1130 0.34 1.09 0.05 149 XMSlimDrugH 1099 0.49 1.06 0.27 150 XMBrknScrpt_02 1089 0.73 1.05 0.60 151 DATE_IN_PAST_03_06 1066 0.34 1.03 0.07 152 XM_UB60 1065 0.33 1.02 0.06 153 RELAYCOUNTRY_ES 1056 0.30 1.02 0.02 154 TR_LOTS_OF_MONEY2 1056 0.41 1.02 0.17 155 T_MONEY_PERCENT 1056 0.41 1.02 0.17 156 SHORT_URI_3 1037 0.51 1.00 0.32 157 XMSubMetaSx_01 1017 0.40 0.98 0.17 158 BOUNCE_MESSAGE 1016 1.78 0.98 2.10 159 ANY_BOUNCE_MESSAGE 1016 1.78 0.98 2.10 160 PLING_QUERY 999 1.18 0.96 1.27 161 URI_NOVOWEL 970 0.53 0.93 0.37 162 LongTLD 962 0.35 0.93 0.13 163 RCVD_IN_IADB_SPF 956 3.04 0.92 3.87 164 BAYES_05 948 1.37 0.91 1.55 165 RDNS_DYNAMIC 946 0.65 0.91 0.54 166 XMHTML_After_End 937 0.47 0.90 0.30 167 DATE_IN_PAST_24_48 936 0.26 0.90 0.01 168 TR_Mismatch_TLD_02 928 0.29 0.89 0.05 169 XMBody_95 921 5.66 0.89 7.52 170 XMPhish11 918 0.87 0.88 0.86 171 TR_Symld_Words 898 1.50 0.86 1.75 172 XMSubMetaSSx_00 895 0.39 0.86 0.20 173 RCVD_IN_IADB_DK 889 2.61 0.86 3.30 174 XM_XX_Yahoo 886 0.41 0.85 0.23 175 HK_RANDOM_REPLYTO 880 0.39 0.85 0.22 176 RCVD_IN_IADB_SENDERID 878 2.69 0.84 3.41 177 T_TooManySym_02 874 1.77 0.84 2.13 178 T_HTML_TAG_BALANCE_CENTER 863 0.29 0.83 0.08 179 HTML_IMAGE_ONLY_32 856 0.42 0.82 0.26 180 HTML_FONT_FACE_BAD 832 0.62 0.80 0.55 181 XMSubMetaSxObfu_03 818 0.52 0.79 0.41 182 XM_UB80 817 0.24 0.79 0.02 183 DKIM_ADSP_CUSTOM_MED 809 0.74 0.78 0.73 184 THIS_AD 802 0.50 0.77 0.40 185 TM2_M_A_HREF_HREF 791 0.85 0.76 0.88 186 NML_ADSP_CUSTOM_MED 766 0.52 0.74 0.44 187 FVGT_m_MULTI_ODD_EMAIL 763 0.23 0.73 0.03 188 XMGppyBdWords 762 0.27 0.73 0.09 189 XM_B_COPY_HTML 742 0.79 0.71 0.82 190 REMOVE_BEFORE_LINK 733 0.45 0.71 0.35 191 DEAR_FRIEND 727 0.23 0.70 0.04 192 MPART_ALT_DIFF_COUNT 724 0.36 0.70 0.22 193 XM_DK_Undo_01 720 1.24 0.69 1.46 194 XM_RXBody 709 0.42 0.68 0.32 195 FILL_THIS_FORM_LOAN 709 0.43 0.68 0.33 196 MISSING_HEADERS 684 0.37 0.66 0.26 197 MIXED_ES 683 0.49 0.66 0.43 198 HK_RANDOM_FROM 669 0.25 0.64 0.09 199 T_FILL_THIS_FORM_SHORT 667 1.11 0.64 1.30 200 HK_SCAM 663 0.19 0.64 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 231038 89.04 94.39 86.95 2 DKIM_SIGNED 197076 75.55 79.09 74.17 3 XM_DK_Pass 194550 73.82 75.36 73.22 4 DKIM_VALID 186249 70.43 71.29 70.09 5 DCC_CHECK_NEGATIVE 146532 46.03 22.71 55.15 6 DKIM_VALID_AU 146001 56.33 59.86 54.95 7 XMListUnsubscribeExists 140416 59.58 76.79 52.85 8 BAYES_50 134128 45.73 33.58 50.48 9 DCC_CHECK 116449 52.88 76.04 43.83 10 XM_H_QuotedFrom 95354 39.07 47.22 35.89 11 HTML_FONT_LOW_CONTRAST 83777 32.82 36.12 31.53 12 DKIM_VALID_EF 75630 25.82 19.05 28.46 13 MIME_HTML_ONLY 75554 31.18 38.22 28.43 14 LOC_TINY_FONT_1 64615 27.81 36.73 24.32 15 T_TM2_M_HEADER_IN_MSG 59871 21.00 17.08 22.53 16 FVGT_m_MULTI_ODD 58404 23.01 25.65 21.98 17 ALL_TRUSTED 57751 16.90 4.55 21.73 18 XMSubLong 53457 21.01 23.30 20.12 19 XM_DK_Undo_02 47628 25.98 46.57 17.92 20 BAYES_99 43399 24.05 43.78 16.33 21 MultiRelay 40032 15.53 16.72 15.07 22 T_KAM_HTML_FONT_INVALID 39912 16.28 19.51 15.02 23 BAYES_999 38738 21.08 37.71 14.58 24 RCVD_IN_RP_SAFE 37677 12.02 6.51 14.18 25 XM_Multi_Part_URI 37108 14.44 15.66 13.97 26 XM_DKIMWhitelistDomains 36727 9.95 0.03 13.82 27 XM_Body_Dirty_Words 34935 15.95 23.11 13.15 28 RCVD_IN_RP_CERTIFIED 33867 10.73 5.56 12.75 29 FROM_EXCESS_BASE64 33136 10.91 6.91 12.47 30 BAYES_00 32005 8.82 0.57 12.05 31 TR_XM_DK_Bayes 29532 8.10 0.41 11.11 32 TR_XM_DK_Bayes1 28417 7.78 0.34 10.69 33 XMNumbers 27970 8.91 4.79 10.53 34 HTML_IMAGE_RATIO_02 27580 11.55 14.53 10.38 35 LOTS_OF_MONEY 25140 10.53 13.26 9.46 36 TR_XM_DK_Bayes2 25100 6.88 0.30 9.45 37 XM_Evil_Numbers_Gen 23069 10.00 13.36 8.68 38 FSL_BULK_SIG 21260 8.54 9.91 8.00 39 TR_DCC_Bayes_99 20375 15.35 35.00 7.67 40 T_XMDrugObfuBody_14 20082 7.83 8.52 7.56 41 XMBody_95 19989 5.66 0.89 7.52 42 T_TooManySym_01 19893 6.39 3.57 7.49 43 LotsOfNums_01 19875 6.73 4.82 7.48 44 BAYES_60 18029 6.43 5.53 6.79 45 XM_SendGrid 17894 5.75 3.22 6.73 46 TO_MALFORMED 17795 4.82 0.03 6.70 47 BOTNET_IPINHOSTNAME 17395 9.51 17.08 6.55 48 HTML_IMAGE_RATIO_04 17352 7.25 9.09 6.53 49 XM_B_Phish_Phrases 16609 6.38 6.71 6.25 50 XM_H_Long_From01 16521 6.43 6.98 6.22 51 TooManyTo_001 14800 5.81 6.42 5.57 52 XMStrtUSub 13146 4.66 3.91 4.95 53 RCVD_IN_IADB_LISTED 11932 3.54 1.09 4.49 54 MIME_QP_LONG_LINE 11804 3.96 2.74 4.44 55 RCVD_IN_MSPIKE_H2 11709 3.73 2.00 4.41 56 XMSubMetaSx_00 11572 5.50 8.41 4.36 57 XMSexyCombo_05 11207 7.01 14.16 4.22 58 BAYES_80 10907 4.78 6.50 4.10 59 XM_UncommonTLD01 10855 5.51 9.15 4.09 60 UNPARSEABLE_RELAY 10836 3.35 1.49 4.08 61 DKIM_INVALID 10827 5.12 7.80 4.07 62 RCVD_IN_IADB_SPF 10295 3.04 0.92 3.87 63 RELAYCOUNTRY_META 10274 9.08 22.42 3.87 64 MPART_ALT_DIFF 9795 4.57 6.82 3.69 65 TR_XM_DK_SendGrid 9647 3.01 1.41 3.63 66 TVD_RCVD_IP 9611 2.74 0.49 3.62 67 HTML_IMAGE_RATIO_06 9417 3.74 4.24 3.54 68 IN_ZIMBRA_NJ_WHITELIST 9344 2.53 0.01 3.52 69 T_REMOTE_IMAGE 9210 3.12 2.25 3.47 70 RCVD_IN_IADB_SENDERID 9074 2.69 0.84 3.41 71 RCVD_IN_IADB_DK 8766 2.61 0.86 3.30 72 BAYES_40 8205 3.13 3.23 3.09 73 RCVD_IN_IADB_VOUCHED 8064 2.36 0.63 3.03 74 BAYES_95 7661 3.17 3.89 2.88 75 XM_DIRTYINTL 7309 3.91 6.89 2.75 76 RCVD_IN_MSPIKE_WL 7248 2.04 0.29 2.73 77 RCVD_IN_MSPIKE_H3 7247 2.04 0.29 2.73 78 INVALID_MSGID 7247 2.02 0.20 2.73 79 MIME_HTML_MOSTLY 7073 3.07 4.12 2.66 80 TR_MetaPhish_Combo_01 6382 1.83 0.37 2.40 81 BAYES_20 6289 2.20 1.79 2.37 82 XM_PDF 6174 1.73 0.21 2.32 83 T_TooManySym_02 5654 1.77 0.84 2.13 84 ANY_BOUNCE_MESSAGE 5573 1.78 0.98 2.10 85 BOUNCE_MESSAGE 5571 1.78 0.98 2.10 86 URI_HEX 5493 2.65 4.15 2.07 87 BOTNET 5411 7.34 20.92 2.04 88 HTML_IMAGE_RATIO_08 5215 2.43 3.62 1.96 89 HTML_MIME_NO_HTML_TAG 5173 3.11 6.09 1.95 90 RCVD_IN_IADB_OPTIN 5152 1.54 0.51 1.94 91 XMBdyGiftCard01 4936 2.69 4.80 1.86 92 MIME_HTML_ONLY_MULTI 4861 2.54 4.35 1.83 93 IN_HORDE_ADDRESS_BOOK 4842 1.32 0.03 1.82 94 TR_Symld_Words 4655 1.50 0.86 1.75 95 MAILING_LIST_MULTI 4485 1.64 1.51 1.69 96 TM2_M_VERY_LONG_WORD 4424 1.57 1.33 1.66 97 XM_CamelCaseFrm001 4282 2.26 3.91 1.61 98 USER_IN_DEF_DKIM_WL 4248 1.16 0.03 1.60 99 BAYES_05 4117 1.37 0.91 1.55 100 URI_TRY_3LD 3962 1.49 1.49 1.49 101 UNTRUSTED_Relay 3887 4.77 13.22 1.46 102 XM_DK_Undo_01 3872 1.24 0.69 1.46 103 SUBJ_ALL_CAPS 3784 1.69 2.39 1.42 104 NO_DNS_FOR_FROM 3532 1.67 2.55 1.33 105 XM_OfRef6 3532 1.63 2.40 1.33 106 RELAYCOUNTRY_CA 3527 2.05 3.88 1.33 107 T_XMDrugObfuBody_08 3466 1.44 1.77 1.30 108 T_FILL_THIS_FORM_SHORT 3451 1.11 0.64 1.30 109 TM2_M_URI_OPT_OUT 3446 1.57 2.26 1.30 110 XMDiploma_00 3419 1.72 2.82 1.29 111 PLING_QUERY 3375 1.18 0.96 1.27 112 XM_SPF_SoftFail 3300 1.84 3.36 1.24 113 TooManyTo_002 3287 1.02 0.45 1.24 114 XM_GoogleGroups 3232 0.99 0.41 1.22 115 TR_XM_RelayPhish 3145 1.29 1.55 1.18 116 XM_ProductURIs 3135 1.55 2.51 1.18 117 USER_IN_WHITELIST 2588 0.70 0.00 0.97 118 XM_UB50 2350 2.05 5.05 0.88 119 TM2_M_A_HREF_HREF 2347 0.85 0.76 0.88 120 TooManyTo_003 2307 0.72 0.33 0.87 121 XMPhish11 2294 0.87 0.88 0.86 122 XM_H_Long_From02 2232 0.92 1.12 0.84 123 XM_B_COPY_HTML 2176 0.79 0.71 0.82 124 XMStockSpam_06 2126 0.97 1.40 0.80 125 T_XMDrugObfuBody_00 2105 0.88 1.12 0.79 126 XMBody_17 2071 1.45 3.17 0.78 127 T_Symld_Words_02 2020 0.92 1.32 0.76 128 T_TooManySym_03 2006 0.63 0.31 0.75 129 T_XMHurry_00 1961 1.10 2.03 0.74 130 DKIM_ADSP_CUSTOM_MED 1943 0.74 0.78 0.73 131 HTML_TAG_BALANCE_BODY 1925 0.83 1.09 0.72 132 XMSubMetaI_00 1885 0.94 1.53 0.71 133 XM_URI_RBL 1883 1.64 4.04 0.71 134 SUBJ_DOLLARS 1877 1.05 1.94 0.71 135 XMSubMetaSxObfu_02 1837 0.57 0.26 0.69 136 XMGenDplmaNmb 1802 0.87 1.34 0.68 137 DKIM_ADSP_NXDOMAIN 1794 2.88 8.50 0.68 138 TooManyTo_004 1784 0.55 0.24 0.67 139 TR_XM_PHPDW 1698 1.22 2.69 0.64 140 TR_XM_PHPForged 1655 1.19 2.66 0.62 141 XMPhish30 1629 0.77 1.18 0.61 142 TR_XM_FormFill2 1629 1.18 2.63 0.61 143 XM_H_PHPOS 1628 1.17 2.61 0.61 144 XMBrknScrpt_02 1602 0.73 1.05 0.60 145 XM_D_tchamptons_WL 1570 0.42 0.00 0.59 146 TooManyTo_005 1561 0.48 0.20 0.59 147 XMSexyCombo_01 1514 1.22 2.88 0.57 148 HTML_FONT_FACE_BAD 1453 0.62 0.80 0.55 149 RDNS_DYNAMIC 1446 0.65 0.91 0.54 150 HELO_NODOT 1422 0.52 0.50 0.54 151 HELO_NO_DOMAIN 1421 0.52 0.50 0.53 152 XM_H_PHPMailer 1407 0.82 1.56 0.53 153 XMBody_78 1364 0.70 1.18 0.51 154 RELAYCOUNTRY_GB 1313 0.78 1.49 0.49 155 XMHTMLBadTable_001 1280 0.67 1.14 0.48 156 HTTPS_HTTP_MISMATCH 1182 0.43 0.39 0.44 157 NML_ADSP_CUSTOM_MED 1169 0.52 0.74 0.44 158 SpammyFromTLD_01 1156 0.86 1.94 0.44 159 MIXED_ES 1139 0.49 0.66 0.43 160 XM_B_REG_HTML 1136 0.80 1.74 0.43 161 XMSubMetaSxObfu_03 1094 0.52 0.79 0.41 162 THIS_AD 1059 0.50 0.77 0.40 163 XMLngstWrd_00 1059 0.39 0.36 0.40 164 FILL_THIS_FORM 1045 0.79 1.81 0.39 165 XMRcvdHeader_15 1044 0.28 0.00 0.39 166 DIET_1 1042 0.80 1.86 0.39 167 FORGED_GMAIL_RCVD 1040 0.46 0.62 0.39 168 RCVD_IN_BL_SPAMCOP_NET 1029 1.59 4.66 0.39 169 XMCapTrack 1021 0.32 0.16 0.38 170 T_TooManySym_04 1001 0.28 0.04 0.38 171 XMBSHREFv2 999 0.39 0.42 0.38 172 URI_NOVOWEL 981 0.53 0.93 0.37 173 XMLngstWrd_01 946 0.33 0.26 0.36 174 REMOVE_BEFORE_LINK 927 0.45 0.71 0.35 175 RELAYCOUNTRY_AU 910 0.35 0.36 0.34 176 TR_LOTS_OF_MONEY3 895 0.57 1.18 0.34 177 FILL_THIS_FORM_LONG 888 0.68 1.55 0.33 178 FILL_THIS_FORM_LOAN 884 0.43 0.68 0.33 179 XMNoVowels 860 0.32 0.31 0.32 180 XM_RXBody 859 0.42 0.68 0.32 181 RELAYCOUNTRY_DE 857 1.31 3.82 0.32 182 SHORT_URI_3 837 0.51 1.00 0.32 183 XM_Akamai 835 0.23 0.02 0.31 184 XM_Body_Obfu01 832 0.29 0.22 0.31 185 NUMERIC_HTTP_ADDR 825 1.20 3.47 0.31 186 XM_ShortIntro_01 814 0.30 0.28 0.31 187 TM2_M_BODY_EMPTY 809 0.26 0.16 0.30 188 XM_S_JOY_D 802 0.37 0.55 0.30 189 LOW_PRICE 794 0.33 0.41 0.30 190 XMHTML_After_End 790 0.47 0.90 0.30 191 RELAYCOUNTRY_FR 747 1.96 6.25 0.28 192 XMMoneyMeta_00 740 1.49 4.58 0.28 193 XMGappySubj_01 736 0.27 0.26 0.28 194 XMSlimDrugH 717 0.49 1.06 0.27 195 XM_H_PHPOS_M 700 0.58 1.38 0.26 196 XM_Walgreens_Forge 694 0.19 0.01 0.26 197 TVD_SPACE_RATIO 692 0.25 0.23 0.26 198 T_OBFU_PDF_ATTACH 691 0.20 0.04 0.26 199 HTML_IMAGE_ONLY_32 688 0.42 0.82 0.26 200 MISSING_HEADERS 678 0.37 0.66 0.26 ----------------------------------------------------------------------