Email: 586689 Autolearn: 0 AvgScore: 2.78 AvgScanTime: 2.01 sec Spam: 146130 Autolearn: 0 AvgScore: 12.48 AvgScanTime: 2.40 sec Ham: 440559 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 1.88 sec Time Spent Running SA: 328.06 hours Time Spent Processing Spam: 97.58 hours Time Spent Processing Ham: 230.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138130 89.53 94.53 87.87 2 DKIM_SIGNED 116983 75.82 80.05 74.42 3 DCC_CHECK 115800 48.35 79.24 38.10 4 XMListUnsubscribeExists 112758 54.86 77.16 47.47 5 XM_DK_Pass 111918 73.94 76.59 73.06 6 DKIM_VALID 106170 70.10 72.65 69.25 7 DKIM_VALID_AU 82745 52.72 56.62 51.42 8 XM_DK_Undo_02 69915 21.57 47.84 12.86 9 BAYES_99 64038 19.55 43.82 11.50 10 BAYES_999 53293 16.68 36.47 10.11 11 HTML_FONT_LOW_CONTRAST 52394 29.16 35.85 26.94 12 TR_DCC_Bayes_99 52295 12.82 35.79 5.20 13 LOC_TINY_FONT_1 48588 24.77 33.25 21.96 14 BAYES_50 47903 48.80 32.78 54.11 15 MIME_HTML_ONLY 46269 22.78 31.66 19.84 16 FVGT_m_MULTI_ODD 40434 22.64 27.67 20.97 17 XMSubLong 36923 22.68 25.27 21.83 18 DKIM_VALID_EF 31969 26.82 21.88 28.46 19 T_KAM_HTML_FONT_INVALID 30112 17.44 20.61 16.40 20 RELAYCOUNTRY_META 29322 9.39 20.07 5.85 21 XM_Body_Dirty_Words 29101 14.35 19.91 12.51 22 DCC_CHECK_NEGATIVE 27936 49.65 19.12 59.78 23 BOTNET_IPINHOSTNAME 26198 7.85 17.93 4.51 24 BOTNET 25805 5.70 17.66 1.73 25 T_TM2_M_HEADER_IN_MSG 25301 28.80 17.31 32.60 26 XM_Multi_Part_URI 23366 12.51 15.99 11.35 27 MultiRelay 21056 18.62 14.41 20.01 28 UNTRUSTED_Relay 19863 4.95 13.59 2.09 29 HTML_IMAGE_RATIO_02 18754 8.75 12.83 7.40 30 XM_Evil_Numbers_Gen 17817 9.92 12.19 9.17 31 XM_UncommonTLD01 17581 5.59 12.03 3.45 32 LOTS_OF_MONEY 17085 9.21 11.69 8.39 33 XMSexyCombo_05 15186 5.35 10.39 3.68 34 FSL_BULK_SIG 14870 7.96 10.18 7.23 35 LotsOfNums_01 12154 7.86 8.32 7.71 36 T_XMDrugObfuBody_14 12109 8.14 8.29 8.09 37 XM_H_Long_From01 12100 6.69 8.28 6.16 38 HTML_IMAGE_RATIO_04 11854 6.28 8.11 5.67 39 TooManyTo_001 11802 9.07 8.08 9.40 40 DKIM_INVALID 10813 5.72 7.40 5.16 41 BAYES_80 10565 4.59 7.23 3.71 42 XMSubMetaSx_00 10553 5.00 7.22 4.27 43 XM_B_Phish_Phrases 10505 5.97 7.19 5.56 44 MPART_ALT_DIFF 9507 3.86 6.51 2.98 45 FROM_EXCESS_BASE64 9263 4.28 6.34 3.59 46 RELAYCOUNTRY_FR 9195 1.76 6.29 0.25 47 BAYES_60 9173 6.07 6.28 6.01 48 XM_UB50 8965 2.53 6.13 1.33 49 HTML_MIME_NO_HTML_TAG 8515 3.67 5.83 2.95 50 RCVD_IN_MSPIKE_BL 8167 2.88 5.59 1.98 51 FROM_SUSPICIOUS_NTLD 7875 1.38 5.39 0.05 52 XM_B_SpammyTLD 7694 3.77 5.27 3.28 53 RCVD_IN_MSPIKE_H2 7576 6.97 5.18 7.56 54 XM_DIRTYINTL 7515 3.21 5.14 2.57 55 SpammyFromTLD_02 7341 1.41 5.02 0.21 56 MIME_QP_LONG_LINE 7112 5.45 4.87 5.64 57 HTML_IMAGE_RATIO_06 6722 3.46 4.60 3.08 58 T_REMOTE_IMAGE 6658 4.37 4.56 4.30 59 BAYES_95 6419 2.99 4.39 2.53 60 RCVD_IN_MSPIKE_L5 6334 1.53 4.33 0.60 61 URI_HEX 5842 2.17 4.00 1.56 62 XMStrtUSub 5829 4.42 3.99 4.56 63 RELAYCOUNTRY_CA 5795 2.09 3.97 1.47 64 XMNumbers 5780 3.09 3.96 2.80 65 DKIM_ADSP_NXDOMAIN 5619 1.43 3.85 0.62 66 KHOP_HELO_FCRDNS 5574 2.67 3.81 2.29 67 XM_SPF_SoftFail 5540 2.49 3.79 2.06 68 HTML_IMAGE_RATIO_08 5399 2.36 3.69 1.92 69 MIME_HTML_MOSTLY 5389 2.65 3.69 2.30 70 RCVD_IN_PSBL 5110 0.96 3.50 0.11 71 TM2_M_URI_OPT_OUT 5035 2.06 3.45 1.61 72 XM_SendGrid 5004 5.59 3.42 6.31 73 RCVD_IN_RP_SAFE 4957 8.84 3.39 10.64 74 BOTNET_NORDNS 4905 0.86 3.36 0.03 75 MIME_HTML_ONLY_MULTI 4866 2.02 3.33 1.59 76 XMDiploma_00 4707 2.24 3.22 1.91 77 XM_CamelCaseFrm001 4696 2.29 3.21 1.98 78 T_TooManySym_01 4597 5.54 3.15 6.34 79 XM_URI_RBL 4509 1.12 3.09 0.47 80 DATE_IN_PAST_03_06 3943 0.73 2.70 0.08 81 XMSexyCombo_01 3921 1.52 2.68 1.14 82 RCVD_IN_RP_CERTIFIED 3891 7.72 2.66 9.40 83 TR_XM_PHPForged 3770 1.53 2.58 1.18 84 TR_XM_PHPDW 3743 1.54 2.56 1.21 85 TR_XM_FormFill2 3714 1.52 2.54 1.18 86 XM_H_PHPOS 3697 1.51 2.53 1.18 87 XMSubMetaI_00 3685 1.22 2.52 0.78 88 RCVD_IN_BL_SPAMCOP_NET 3647 0.99 2.50 0.50 89 PDS_TO_EQ_FROM_NAME 3563 0.64 2.44 0.05 90 MISSING_HEADERS 3561 1.09 2.44 0.64 91 BAYES_40 3546 4.05 2.43 4.59 92 RCVD_IN_IADB_LISTED 3453 4.17 2.36 4.77 93 MultiRelay_CC 3453 0.77 2.36 0.25 94 MultiRelay_Combo 3453 0.77 2.36 0.25 95 XM_OfRef6 3381 1.82 2.31 1.65 96 ALL_TRUSTED 3339 12.70 2.28 16.16 97 T_XMDrugObfuBody_08 3272 1.72 2.24 1.55 98 NO_DNS_FOR_FROM 3251 1.38 2.22 1.10 99 RCVD_IN_IADB_SPF 3175 3.68 2.17 4.17 100 XM_UB99 3115 0.54 2.13 0.01 101 RCVD_IN_IADB_DK 3039 3.24 2.08 3.63 102 RCVD_IN_IADB_SENDERID 3017 3.26 2.06 3.66 103 XMGenDplmaNmb 3009 1.44 2.06 1.23 104 XMBdyGiftCard01 2962 1.31 2.03 1.07 105 BODY_URI_ONLY 2912 0.55 1.99 0.07 106 URIBL_DBL_ABUSE_REDIR 2820 0.50 1.93 0.03 107 RCVD_IN_MSPIKE_WL 2816 5.06 1.93 6.10 108 RCVD_IN_MSPIKE_H3 2628 4.59 1.80 5.51 109 URI_TRY_3LD 2620 1.24 1.79 1.06 110 RCVD_IN_RP_RNBL 2597 0.47 1.78 0.03 111 HTML_SHORT_LINK_IMG_1 2546 0.45 1.74 0.03 112 XMBody_17 2541 0.85 1.74 0.55 113 SUBJ_ALL_CAPS 2510 1.62 1.72 1.59 114 SpammyFromTLD_01 2502 1.00 1.71 0.76 115 XMBody_78 2428 0.76 1.66 0.46 116 XMSexyCombo_04 2399 0.96 1.64 0.73 117 XM_UB999 2394 0.42 1.64 0.01 118 TM2_M_VERY_LONG_WORD 2371 1.32 1.62 1.23 119 MAILING_LIST_MULTI 2341 2.05 1.60 2.19 120 XM_H_TOP 2282 0.42 1.56 0.04 121 TR_XM_DK_SendGrid 2266 2.83 1.55 3.25 122 TR_XM_RelayPhish 2189 1.08 1.50 0.94 123 XMSubMetaSxObfu_03 2188 0.75 1.50 0.50 124 XM_H_Long_From02 2173 1.21 1.49 1.12 125 XM_H_PHPMailer 2123 1.15 1.45 1.05 126 TR_M_TOP_BAYES 2122 0.36 1.45 0.00 127 TR_LOTS_OF_MONEY3 2118 0.68 1.45 0.42 128 XM_ProductURIs 2091 0.98 1.43 0.82 129 BAYES_20 2080 2.86 1.42 3.34 130 XMHTML_After_End 2021 0.72 1.38 0.50 131 XMPhish11 2019 1.18 1.38 1.11 132 XM_UB60 2013 0.41 1.38 0.09 133 RELAYCOUNTRY_GB 1974 1.22 1.35 1.17 134 T_XMHurry_00 1964 0.74 1.34 0.53 135 XMMoneyMeta_00 1921 0.85 1.31 0.70 136 T_Symld_Words_02 1906 0.74 1.30 0.55 137 UNPARSEABLE_RELAY 1874 2.37 1.28 2.73 138 DIET_1 1836 0.54 1.26 0.30 139 HTML_IMAGE_ONLY_08 1821 0.41 1.25 0.14 140 TR_Symld_Words 1809 1.67 1.24 1.81 141 TR_LOTS_OF_MONEY2 1800 0.50 1.23 0.25 142 T_MONEY_PERCENT 1800 0.50 1.23 0.25 143 MIME_HEADER_CTYPE_ONLY 1800 0.40 1.23 0.12 144 XM_B_REG_HTML 1746 0.59 1.19 0.40 145 XM_H_PHPOS_M 1720 0.73 1.18 0.58 146 RELAYCOUNTRY_IN 1718 0.39 1.18 0.12 147 XMPhish30 1715 0.62 1.17 0.44 148 XMStockSpam_06 1700 1.41 1.16 1.49 149 XM_UB80 1692 0.31 1.16 0.03 150 XMBrknScrpt_02 1661 0.96 1.14 0.89 151 DATE_IN_PAST_06_12 1630 0.32 1.12 0.05 152 RELAYCOUNTRY_AT 1596 0.40 1.09 0.17 153 RCVD_IN_IADB_VOUCHED 1587 2.64 1.09 3.16 154 XM_HighProb1 1582 0.32 1.08 0.06 155 URIBL_BLACK 1544 0.32 1.06 0.08 156 XM_DK_Undo_01 1533 1.73 1.05 1.95 157 DKIM_ADSP_CUSTOM_MED 1513 1.09 1.04 1.11 158 HTML_FONT_FACE_BAD 1487 0.71 1.02 0.60 159 T_XMDrugObfuBody_00 1456 0.68 1.00 0.58 160 TR_Mismatch_TLD_02 1429 0.30 0.98 0.07 161 BODY_ENHANCEMENT 1421 0.27 0.97 0.03 162 XM_UB95 1415 0.25 0.97 0.01 163 XMHTMLBadTable_001 1412 0.60 0.97 0.48 164 HTML_TAG_BALANCE_BODY 1398 0.67 0.96 0.58 165 US_DOLLARS_3 1387 0.52 0.95 0.38 166 SHORT_URI_3 1315 0.32 0.90 0.13 167 NML_ADSP_CUSTOM_MED 1288 0.81 0.88 0.79 168 HTML_IMAGE_ONLY_32 1283 0.55 0.88 0.44 169 TM2_M_A_HREF_HREF 1276 0.61 0.87 0.52 170 RDNS_DYNAMIC 1272 0.52 0.87 0.40 171 TooManyTo_002 1267 2.32 0.87 2.80 172 FORGED_GMAIL_RCVD 1246 0.63 0.85 0.56 173 XM_B_COPY_HTML 1222 0.66 0.84 0.60 174 URI_NOVOWEL 1188 0.53 0.81 0.44 175 REPLYTO_WITHOUT_TO_CC 1184 0.27 0.81 0.10 176 FILL_THIS_FORM 1181 0.79 0.81 0.79 177 XM_PDF 1169 4.12 0.80 5.22 178 T_FILL_THIS_FORM_SHORT 1163 0.89 0.80 0.92 179 FSL_THIS_IS_ADV 1156 0.32 0.79 0.16 180 RCVD_IN_MSPIKE_L3 1145 0.82 0.78 0.83 181 BAYES_05 1144 1.76 0.78 2.08 182 LONG_JUNK_URI 1096 0.28 0.75 0.13 183 RELAYCOUNTRY_CN 1068 0.24 0.73 0.08 184 BASE64_LENGTH_79_INF 1067 0.40 0.73 0.30 185 TooManyTo_003 1062 1.60 0.73 1.89 186 XMPhish14 1050 0.44 0.72 0.34 187 HTTPS_HTTP_MISMATCH 1050 0.69 0.72 0.68 188 T_TooManySym_02 1048 1.84 0.72 2.21 189 FROM_DOMAIN_NOVOWEL 1047 0.21 0.72 0.05 190 XMSubMetaI_01 1038 0.20 0.71 0.04 191 XMSubMetaD_00 1034 0.22 0.71 0.06 192 XMSubMetaSSx_00 1033 0.29 0.71 0.15 193 URI_PHP_REDIR 1029 0.18 0.70 0.00 194 TR_MetaPhish_Combo_01 1025 1.50 0.70 1.77 195 XM_RXBody 1014 0.79 0.69 0.82 196 RELAYCOUNTRY_DE 1000 0.93 0.68 1.01 197 URIBL_ABUSE_SURBL 995 0.27 0.68 0.13 198 BAYES_00 993 9.05 0.68 11.83 199 RCVD_IN_IADB_OPTIN 979 1.64 0.67 1.96 200 LOW_PRICE 967 0.38 0.66 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 387128 89.53 94.53 87.87 2 DKIM_SIGNED 327843 75.82 80.05 74.42 3 XM_DK_Pass 321861 73.94 76.59 73.06 4 DKIM_VALID 305108 70.10 72.65 69.25 5 DCC_CHECK_NEGATIVE 263358 49.65 19.12 59.78 6 BAYES_50 238395 48.80 32.78 54.11 7 DKIM_VALID_AU 226534 52.72 56.62 51.42 8 XMListUnsubscribeExists 209115 54.86 77.16 47.47 9 DCC_CHECK 167850 48.35 79.24 38.10 10 T_TM2_M_HEADER_IN_MSG 143639 28.80 17.31 32.60 11 DKIM_VALID_EF 125394 26.82 21.88 28.46 12 HTML_FONT_LOW_CONTRAST 118707 29.16 35.85 26.94 13 LOC_TINY_FONT_1 96729 24.77 33.25 21.96 14 XMSubLong 96157 22.68 25.27 21.83 15 FVGT_m_MULTI_ODD 92390 22.64 27.67 20.97 16 MultiRelay 88167 18.62 14.41 20.01 17 MIME_HTML_ONLY 87388 22.78 31.66 19.84 18 T_KAM_HTML_FONT_INVALID 72231 17.44 20.61 16.40 19 ALL_TRUSTED 71183 12.70 2.28 16.16 20 XM_DK_Undo_02 56653 21.57 47.84 12.86 21 XM_Body_Dirty_Words 55115 14.35 19.91 12.51 22 BAYES_00 52123 9.05 0.68 11.83 23 BAYES_99 50648 19.55 43.82 11.50 24 XM_Multi_Part_URI 50021 12.51 15.99 11.35 25 RCVD_IN_RP_SAFE 46877 8.84 3.39 10.64 26 BAYES_999 44546 16.68 36.47 10.11 27 TooManyTo_001 41399 9.07 8.08 9.40 28 RCVD_IN_RP_CERTIFIED 41399 7.72 2.66 9.40 29 XM_Evil_Numbers_Gen 40379 9.92 12.19 9.17 30 TR_XM_DK_Bayes 40322 6.94 0.28 9.15 31 TR_XM_DK_Bayes1 38548 6.63 0.22 8.75 32 LOTS_OF_MONEY 36977 9.21 11.69 8.39 33 XM_DKIMWhitelistDomains 35763 6.10 0.03 8.12 34 T_XMDrugObfuBody_14 35648 8.14 8.29 8.09 35 LotsOfNums_01 33957 7.86 8.32 7.71 36 RCVD_IN_MSPIKE_H2 33325 6.97 5.18 7.56 37 TR_XM_DK_Bayes2 32932 5.66 0.17 7.48 38 HTML_IMAGE_RATIO_02 32594 8.75 12.83 7.40 39 FSL_BULK_SIG 31847 7.96 10.18 7.23 40 T_TooManySym_01 27911 5.54 3.15 6.34 41 XM_SendGrid 27778 5.59 3.42 6.31 42 XM_H_Long_From01 27146 6.69 8.28 6.16 43 RCVD_IN_MSPIKE_WL 26881 5.06 1.93 6.10 44 BAYES_60 26462 6.07 6.28 6.01 45 RELAYCOUNTRY_META 25758 9.39 20.07 5.85 46 HTML_IMAGE_RATIO_04 24990 6.28 8.11 5.67 47 MIME_QP_LONG_LINE 24836 5.45 4.87 5.64 48 XM_B_Phish_Phrases 24504 5.97 7.19 5.56 49 RCVD_IN_MSPIKE_H3 24278 4.59 1.80 5.51 50 XM_PDF 22985 4.12 0.80 5.22 51 TR_DCC_Bayes_99 22907 12.82 35.79 5.20 52 DKIM_INVALID 22735 5.72 7.40 5.16 53 RCVD_IN_IADB_LISTED 21035 4.17 2.36 4.77 54 TO_MALFORMED 20568 3.52 0.05 4.67 55 BAYES_40 20220 4.05 2.43 4.59 56 XMStrtUSub 20099 4.42 3.99 4.56 57 BOTNET_IPINHOSTNAME 19848 7.85 17.93 4.51 58 T_REMOTE_IMAGE 18960 4.37 4.56 4.30 59 XMSubMetaSx_00 18798 5.00 7.22 4.27 60 IN_ZIMBRA_NJ_WHITELIST 18692 3.19 0.02 4.24 61 RCVD_IN_IADB_SPF 18387 3.68 2.17 4.17 62 BAYES_80 16355 4.59 7.23 3.71 63 XMSexyCombo_05 16206 5.35 10.39 3.68 64 RCVD_IN_IADB_SENDERID 16132 3.26 2.06 3.66 65 RCVD_IN_IADB_DK 15975 3.24 2.08 3.63 66 FROM_EXCESS_BASE64 15830 4.28 6.34 3.59 67 XM_UncommonTLD01 15191 5.59 12.03 3.45 68 BAYES_20 14700 2.86 1.42 3.34 69 XM_B_SpammyTLD 14436 3.77 5.27 3.28 70 TR_XM_DK_SendGrid 14325 2.83 1.55 3.25 71 RCVD_IN_IADB_VOUCHED 13904 2.64 1.09 3.16 72 HTML_IMAGE_RATIO_06 13569 3.46 4.60 3.08 73 MPART_ALT_DIFF 13119 3.86 6.51 2.98 74 HTML_MIME_NO_HTML_TAG 13010 3.67 5.83 2.95 75 TooManyTo_002 12334 2.32 0.87 2.80 76 XMNumbers 12329 3.09 3.96 2.80 77 UNPARSEABLE_RELAY 12022 2.37 1.28 2.73 78 XM_DIRTYINTL 11337 3.21 5.14 2.57 79 BAYES_95 11130 2.99 4.39 2.53 80 TVD_RCVD_IP 10572 1.92 0.47 2.40 81 MIME_HTML_MOSTLY 10133 2.65 3.69 2.30 82 KHOP_HELO_FCRDNS 10090 2.67 3.81 2.29 83 T_TooManySym_02 9745 1.84 0.72 2.21 84 HELO_NODOT 9708 1.81 0.63 2.20 85 HELO_NO_DOMAIN 9706 1.81 0.61 2.20 86 MAILING_LIST_MULTI 9668 2.05 1.60 2.19 87 UNTRUSTED_Relay 9203 4.95 13.59 2.09 88 BAYES_05 9156 1.76 0.78 2.08 89 XM_SPF_SoftFail 9075 2.49 3.79 2.06 90 XM_CamelCaseFrm001 8732 2.29 3.21 1.98 91 RCVD_IN_MSPIKE_BL 8718 2.88 5.59 1.98 92 RCVD_IN_IADB_OPTIN 8644 1.64 0.67 1.96 93 XM_DK_Undo_01 8590 1.73 1.05 1.95 94 HTML_IMAGE_RATIO_08 8472 2.36 3.69 1.92 95 XMDiploma_00 8416 2.24 3.22 1.91 96 TooManyTo_003 8347 1.60 0.73 1.89 97 ANY_BOUNCE_MESSAGE 8160 1.49 0.41 1.85 98 BOUNCE_MESSAGE 8154 1.49 0.41 1.85 99 TR_Symld_Words 7960 1.67 1.24 1.81 100 TR_MetaPhish_Combo_01 7783 1.50 0.70 1.77 101 IN_HORDE_ADDRESS_BOOK 7742 1.33 0.04 1.76 102 BOTNET 7617 5.70 17.66 1.73 103 XMCapTrack 7491 1.35 0.31 1.70 104 INVALID_MSGID 7351 1.30 0.20 1.67 105 XM_OfRef6 7280 1.82 2.31 1.65 106 TM2_M_URI_OPT_OUT 7076 2.06 3.45 1.61 107 MIME_HTML_ONLY_MULTI 7014 2.02 3.33 1.59 108 SUBJ_ALL_CAPS 6989 1.62 1.72 1.59 109 URI_HEX 6883 2.17 4.00 1.56 110 T_XMDrugObfuBody_08 6821 1.72 2.24 1.55 111 XMStockSpam_06 6555 1.41 1.16 1.49 112 RELAYCOUNTRY_CA 6458 2.09 3.97 1.47 113 TooManyTo_004 6329 1.23 0.63 1.44 114 USER_IN_DEF_DKIM_WL 5994 1.03 0.01 1.36 115 XM_UB50 5870 2.53 6.13 1.33 116 XM_GoogleGroups 5474 1.05 0.47 1.24 117 XMGenDplmaNmb 5423 1.44 2.06 1.23 118 TooManyTo_005 5411 1.06 0.56 1.23 119 TM2_M_VERY_LONG_WORD 5402 1.32 1.62 1.23 120 TR_XM_PHPDW 5315 1.54 2.56 1.21 121 TR_XM_PHPForged 5216 1.53 2.58 1.18 122 TR_XM_FormFill2 5196 1.52 2.54 1.18 123 XM_H_PHPOS 5184 1.51 2.53 1.18 124 RELAYCOUNTRY_GB 5158 1.22 1.35 1.17 125 XMSexyCombo_01 5022 1.52 2.68 1.14 126 XM_H_Long_From02 4932 1.21 1.49 1.12 127 XMPhish11 4888 1.18 1.38 1.11 128 DKIM_ADSP_CUSTOM_MED 4873 1.09 1.04 1.11 129 NO_DNS_FOR_FROM 4845 1.38 2.22 1.10 130 XMBdyGiftCard01 4728 1.31 2.03 1.07 131 URI_TRY_3LD 4679 1.24 1.79 1.06 132 XM_H_PHPMailer 4621 1.15 1.45 1.05 133 RELAYCOUNTRY_DE 4470 0.93 0.68 1.01 134 XMGappySubj_01 4258 0.79 0.26 0.97 135 TR_XM_RelayPhish 4155 1.08 1.50 0.94 136 T_FILL_THIS_FORM_SHORT 4045 0.89 0.80 0.92 137 XMBrknScrpt_02 3942 0.96 1.14 0.89 138 PLING_QUERY 3690 0.78 0.62 0.84 139 RCVD_IN_MSPIKE_L3 3659 0.82 0.78 0.83 140 XM_ProductURIs 3634 0.98 1.43 0.82 141 XM_RXBody 3624 0.79 0.69 0.82 142 NML_ADSP_CUSTOM_MED 3487 0.81 0.88 0.79 143 FILL_THIS_FORM 3474 0.79 0.81 0.79 144 XMSubMetaI_00 3447 1.22 2.52 0.78 145 SpammyFromTLD_01 3344 1.00 1.71 0.76 146 XM_H_Trusted_IP 3292 0.56 0.00 0.75 147 XMSexyCombo_04 3208 0.96 1.64 0.73 148 XMGappySubj_02 3099 0.56 0.12 0.70 149 XMMoneyMeta_00 3081 0.85 1.31 0.70 150 T_OBFU_PDF_ATTACH 3037 0.56 0.16 0.69 151 HTTPS_HTTP_MISMATCH 2999 0.69 0.72 0.68 152 XM_ShortIntro_01 2960 0.63 0.49 0.67 153 XMBody_95 2855 0.52 0.14 0.65 154 SHORT_HELO_AND_INLINE_IMAGE 2822 0.49 0.05 0.64 155 MISSING_HEADERS 2812 1.09 2.44 0.64 156 AC_DIV_BONANZA 2783 0.51 0.13 0.63 157 DKIM_ADSP_NXDOMAIN 2750 1.43 3.85 0.62 158 T_TooManySym_03 2711 0.52 0.24 0.62 159 HTML_FONT_FACE_BAD 2661 0.71 1.02 0.60 160 RCVD_IN_MSPIKE_L5 2660 1.53 4.33 0.60 161 XM_B_COPY_HTML 2625 0.66 0.84 0.60 162 HTML_TAG_BALANCE_BODY 2550 0.67 0.96 0.58 163 XM_H_PHPOS_M 2537 0.73 1.18 0.58 164 T_XMDrugObfuBody_00 2536 0.68 1.00 0.58 165 XMNoVowels 2510 0.57 0.55 0.57 166 FORGED_GMAIL_RCVD 2467 0.63 0.85 0.56 167 XMBody_17 2440 0.85 1.74 0.55 168 T_Symld_Words_02 2434 0.74 1.30 0.55 169 USER_IN_WHITELIST 2419 0.41 0.00 0.55 170 RCVD_IN_MSPIKE_L4 2399 0.53 0.47 0.54 171 T_XMHurry_00 2354 0.74 1.34 0.53 172 XMhairloss01 2336 0.41 0.04 0.53 173 TM2_M_A_HREF_HREF 2309 0.61 0.87 0.52 174 XMLngstWrd_00 2271 0.47 0.31 0.52 175 XMSubMetaSxObfu_03 2221 0.75 1.50 0.50 176 XMHTML_After_End 2209 0.72 1.38 0.50 177 RCVD_IN_SORBS_DUL 2200 0.46 0.35 0.50 178 RCVD_IN_BL_SPAMCOP_NET 2183 0.99 2.50 0.50 179 XMDateMe_00 2146 0.46 0.36 0.49 180 XMLngstWrd_01 2111 0.43 0.29 0.48 181 TM2_M_BODY_EMPTY 2111 0.46 0.40 0.48 182 XMHTMLBadTable_001 2102 0.60 0.97 0.48 183 XM_URI_RBL 2059 1.12 3.09 0.47 184 XMBody_78 2032 0.76 1.66 0.46 185 XMSubMetaSxObfu_02 1933 0.40 0.28 0.44 186 HTML_IMAGE_ONLY_28 1929 0.42 0.37 0.44 187 HTML_IMAGE_ONLY_32 1927 0.55 0.88 0.44 188 URI_NOVOWEL 1922 0.53 0.81 0.44 189 XMPhish30 1922 0.62 1.17 0.44 190 FROM_GOV_SPOOF 1917 0.35 0.11 0.44 191 RELAYCOUNTRY_AU 1898 0.45 0.49 0.43 192 TR_LOTS_OF_MONEY3 1866 0.68 1.45 0.42 193 FILL_THIS_FORM_LONG 1820 0.47 0.64 0.41 194 FILL_THIS_FORM_LOAN 1804 0.40 0.37 0.41 195 RDNS_DYNAMIC 1778 0.52 0.87 0.40 196 XMSlimDrugH 1761 0.43 0.53 0.40 197 FROM_GOV_DKIM_AU 1759 0.32 0.08 0.40 198 SUBJ_DOLLARS 1755 0.46 0.64 0.40 199 XM_B_REG_HTML 1743 0.59 1.19 0.40 200 XMSolicitRefs_0 1714 0.39 0.39 0.39 ----------------------------------------------------------------------