Email: 636227 Autolearn: 0 AvgScore: 2.85 AvgScanTime: 2.02 sec Spam: 155211 Autolearn: 0 AvgScore: 12.07 AvgScanTime: 2.44 sec Ham: 481016 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.89 sec Time Spent Running SA: 357.81 hours Time Spent Processing Spam: 105.12 hours Time Spent Processing Ham: 252.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146502 90.15 94.39 88.78 2 DKIM_SIGNED 129046 77.16 83.14 75.24 3 DCC_CHECK 123371 49.30 79.49 39.56 4 XM_DK_Pass 122822 75.13 79.13 73.84 5 XMListUnsubscribeExists 121598 57.19 78.34 50.37 6 DKIM_VALID 116702 71.40 75.19 70.17 7 DKIM_VALID_AU 89215 52.33 57.48 50.67 8 XM_DK_Undo_02 73050 21.16 47.06 12.80 9 BAYES_99 65842 18.82 42.42 11.20 10 HTML_FONT_LOW_CONTRAST 55533 29.98 35.78 28.10 11 BAYES_999 53539 15.84 34.49 9.82 12 LOC_TINY_FONT_1 52915 25.13 34.09 22.24 13 TR_DCC_Bayes_99 52518 12.23 33.84 5.26 14 BAYES_50 51588 49.79 33.24 55.14 15 MIME_HTML_ONLY 48207 22.19 31.06 19.33 16 FVGT_m_MULTI_ODD 41463 22.62 26.71 21.30 17 XMSubLong 40664 22.61 26.20 21.45 18 DKIM_VALID_EF 35828 26.25 23.08 27.28 19 T_KAM_HTML_FONT_INVALID 35456 18.83 22.84 17.54 20 XM_Body_Dirty_Words 30716 14.31 19.79 12.54 21 T_TM2_M_HEADER_IN_MSG 30506 28.78 19.65 31.72 22 DCC_CHECK_NEGATIVE 28845 48.58 18.58 58.26 23 RELAYCOUNTRY_META 28484 8.81 18.35 5.72 24 BOTNET_IPINHOSTNAME 28437 7.92 18.32 4.56 25 XM_Multi_Part_URI 27135 12.76 17.48 11.24 26 MultiRelay 26071 18.55 16.80 19.12 27 BOTNET 25941 5.44 16.71 1.80 28 XM_Evil_Numbers_Gen 19902 9.83 12.82 8.86 29 LOTS_OF_MONEY 19311 9.65 12.44 8.74 30 HTML_IMAGE_RATIO_02 17975 8.99 11.58 8.16 31 XM_UncommonTLD01 16332 4.98 10.52 3.19 32 UNTRUSTED_Relay 15813 3.58 10.19 1.45 33 LotsOfNums_01 15221 8.64 9.81 8.26 34 XMSexyCombo_05 14979 4.71 9.65 3.11 35 T_XMDrugObfuBody_14 13994 8.47 9.02 8.30 36 FSL_BULK_SIG 13384 7.15 8.62 6.67 37 BAYES_80 12784 4.92 8.24 3.85 38 HTML_IMAGE_RATIO_04 12504 5.64 8.06 4.86 39 DKIM_INVALID 12344 5.77 7.95 5.06 40 TooManyTo_001 12101 8.28 7.80 8.43 41 XM_H_Long_From01 11899 6.82 7.67 6.55 42 MPART_ALT_DIFF 11686 4.53 7.53 3.57 43 XM_B_Phish_Phrases 11497 6.06 7.41 5.63 44 XMSubMetaSx_00 11380 4.65 7.33 3.79 45 MIME_QP_LONG_LINE 9922 6.11 6.39 6.02 46 BAYES_60 9506 6.35 6.12 6.42 47 RCVD_IN_MSPIKE_H2 9080 7.00 5.85 7.37 48 RCVD_IN_MSPIKE_BL 8802 3.20 5.67 2.40 49 HTML_IMAGE_RATIO_06 7508 3.73 4.84 3.37 50 BAYES_95 7502 3.06 4.83 2.49 51 XM_UB50 7333 1.86 4.72 0.93 52 XM_DIRTYINTL 7290 2.89 4.70 2.30 53 XM_CamelCaseFrm001 7147 2.66 4.60 2.03 54 RELAYCOUNTRY_CA 7066 2.67 4.55 2.06 55 XM_SendGrid 6972 5.67 4.49 6.05 56 MIME_HTML_ONLY_MULTI 6766 2.52 4.36 1.92 57 RCVD_IN_MSPIKE_L5 6673 1.70 4.30 0.86 58 TM2_M_URI_OPT_OUT 6601 2.55 4.25 1.99 59 HTML_MIME_NO_HTML_TAG 6539 2.45 4.21 1.88 60 RELAYCOUNTRY_FR 6445 1.19 4.15 0.23 61 XMStrtUSub 6138 4.43 3.95 4.58 62 XMNumbers 6080 3.03 3.92 2.75 63 XM_B_SpammyTLD 6075 3.34 3.91 3.16 64 HTML_IMAGE_RATIO_08 5995 2.56 3.86 2.14 65 FROM_EXCESS_BASE64 5711 3.92 3.68 4.00 66 URI_HEX 5645 2.21 3.64 1.76 67 XM_SPF_SoftFail 5624 2.34 3.62 1.92 68 MIME_HTML_MOSTLY 5576 2.68 3.59 2.39 69 RCVD_IN_PSBL 5576 0.94 3.59 0.08 70 XM_URI_RBL 5181 1.10 3.34 0.37 71 DKIM_ADSP_NXDOMAIN 5140 1.22 3.31 0.55 72 SpammyFromTLD_02 5129 1.06 3.30 0.34 73 FROM_SUSPICIOUS_NTLD 5070 0.82 3.27 0.03 74 FROM_SUSPICIOUS_NTLD_FP 5004 0.80 3.22 0.02 75 XMDiploma_00 4899 2.22 3.16 1.92 76 RCVD_IN_IADB_LISTED 4883 5.21 3.15 5.88 77 KHOP_HELO_FCRDNS 4509 2.36 2.91 2.18 78 RCVD_IN_IADB_SPF 4494 4.53 2.90 5.05 79 RCVD_IN_IADB_DK 4353 3.91 2.80 4.26 80 RCVD_IN_IADB_SENDERID 4317 3.99 2.78 4.38 81 RCVD_IN_MSPIKE_WL 4125 5.85 2.66 6.88 82 US_DOLLARS_3 3941 1.69 2.54 1.41 83 BOTNET_NORDNS 3927 0.63 2.53 0.02 84 RCVD_IN_MSPIKE_H3 3901 5.31 2.51 6.22 85 T_TooManySym_01 3870 4.47 2.49 5.10 86 T_XMDrugObfuBody_08 3775 1.69 2.43 1.45 87 RCVD_IN_RP_SAFE 3688 8.05 2.38 9.88 88 XMSubMetaI_00 3662 1.22 2.36 0.85 89 XM_OfRef6 3547 1.80 2.29 1.64 90 XMBdyGiftCard01 3526 1.29 2.27 0.97 91 T_REMOTE_IMAGE 3486 3.83 2.25 4.33 92 SpammyFromTLD_01 3443 1.11 2.22 0.75 93 TR_XM_PHPDW 3374 1.51 2.17 1.29 94 XMSexyCombo_01 3364 0.99 2.17 0.61 95 TR_XM_PHPForged 3354 1.49 2.16 1.27 96 TR_XM_FormFill2 3352 1.49 2.16 1.27 97 XM_H_PHPOS 3333 1.48 2.15 1.27 98 RCVD_IN_BL_SPAMCOP_NET 3268 0.97 2.11 0.60 99 XMGenDplmaNmb 3196 1.37 2.06 1.15 100 PDS_TO_EQ_FROM_NAME 3151 0.52 2.03 0.03 101 TR_XM_DK_SendGrid 3053 2.85 1.97 3.13 102 XMBody_17 3044 0.92 1.96 0.58 103 NO_DNS_FOR_FROM 3021 1.29 1.95 1.07 104 ALL_TRUSTED 2995 11.98 1.93 15.22 105 BAYES_40 2948 3.78 1.90 4.39 106 MAILING_LIST_MULTI 2831 2.12 1.82 2.22 107 XM_UB99 2804 0.46 1.81 0.02 108 URIBL_DBL_ABUSE_REDIR 2777 0.45 1.79 0.02 109 RCVD_IN_RP_RNBL 2767 0.46 1.78 0.03 110 MultiRelay_CC 2755 0.61 1.78 0.24 111 MultiRelay_Combo 2755 0.61 1.78 0.24 112 RCVD_IN_RP_CERTIFIED 2753 7.08 1.77 8.79 113 TM2_M_VERY_LONG_WORD 2544 1.18 1.64 1.04 114 SUBJ_ALL_CAPS 2542 1.68 1.64 1.70 115 XM_H_Long_From02 2443 1.14 1.57 1.00 116 XMHTML_After_End 2442 0.69 1.57 0.40 117 HTML_IMAGE_ONLY_32 2438 0.77 1.57 0.51 118 XMPhish11 2371 1.33 1.53 1.26 119 DATE_IN_PAST_12_24 2342 0.44 1.51 0.10 120 TR_XM_RelayPhish 2330 0.98 1.50 0.81 121 T_XMDrugObfuBody_00 2316 0.97 1.49 0.80 122 RELAYCOUNTRY_GB 2255 1.16 1.45 1.06 123 XMMoneyMeta_00 2215 0.82 1.43 0.62 124 URI_TRY_3LD 2151 1.62 1.39 1.70 125 XMBody_78 2148 0.77 1.38 0.57 126 HK_SCAM 2097 0.35 1.35 0.03 127 BAYES_20 2093 2.72 1.35 3.17 128 XMPhish30 2083 0.65 1.34 0.43 129 XM_UB999 2054 0.34 1.32 0.02 130 T_XMHurry_00 2042 0.82 1.32 0.66 131 TR_Mismatch_TLD_02 1989 0.36 1.28 0.06 132 TR_Symld_Words 1944 1.50 1.25 1.58 133 XMStockSpam_06 1898 0.82 1.22 0.69 134 T_Symld_Words_02 1872 1.01 1.21 0.94 135 UNPARSEABLE_RELAY 1846 2.21 1.19 2.54 136 XM_HighProb1 1841 0.30 1.19 0.01 137 XMHTMLBadTable_001 1817 0.63 1.17 0.46 138 DIET_1 1810 0.49 1.17 0.27 139 XM_DK_Undo_01 1798 1.68 1.16 1.85 140 XM_H_PHPMailer 1751 0.69 1.13 0.55 141 XMBrknScrpt_02 1711 0.75 1.10 0.64 142 XM_ProductURIs 1707 1.02 1.10 0.99 143 BAYES_00 1688 8.73 1.09 11.19 144 DKIM_ADSP_CUSTOM_MED 1674 1.04 1.08 1.03 145 XM_UB60 1668 0.32 1.07 0.08 146 URIBL_BLACK 1667 0.30 1.07 0.05 147 RCVD_IN_IADB_VOUCHED 1639 3.31 1.06 4.04 148 DATE_IN_PAST_06_12 1581 0.28 1.02 0.04 149 XMPhish14 1572 0.52 1.01 0.36 150 T_MONEY_PERCENT 1554 0.56 1.00 0.41 151 TR_LOTS_OF_MONEY2 1554 0.56 1.00 0.41 152 XMSubMetaSxObfu_03 1510 0.64 0.97 0.53 153 RELAYCOUNTRY_NL 1474 0.36 0.95 0.16 154 URI_NOVOWEL 1463 0.54 0.94 0.40 155 XM_H_PHPOS_M 1462 0.37 0.94 0.18 156 T_FILL_THIS_FORM_SHORT 1460 1.00 0.94 1.02 157 TM2_M_A_HREF_HREF 1443 0.59 0.93 0.48 158 RCVD_IN_MSPIKE_L3 1437 0.86 0.93 0.84 159 XMSexyCombo_04 1433 0.30 0.92 0.10 160 FORGED_GMAIL_RCVD 1398 0.58 0.90 0.48 161 SUBJ_DOLLARS 1397 0.54 0.90 0.43 162 TR_LOTS_OF_MONEY3 1392 0.56 0.90 0.45 163 RDNS_DYNAMIC 1384 0.53 0.89 0.42 164 LongTLD 1330 0.32 0.86 0.15 165 XM_UB80 1309 0.23 0.84 0.03 166 NORDNS_LOW_CONTRAST 1298 0.21 0.84 0.01 167 PLING_QUERY 1286 0.60 0.83 0.53 168 DATE_IN_PAST_03_06 1283 0.30 0.83 0.13 169 SHORT_URI_3 1234 0.31 0.80 0.15 170 HTML_FONT_FACE_BAD 1210 0.55 0.78 0.48 171 NML_ADSP_CUSTOM_MED 1209 0.76 0.78 0.75 172 THIS_AD 1181 0.29 0.76 0.13 173 RELAYCOUNTRY_AT 1176 0.35 0.76 0.21 174 XMSubMetaD_03 1175 0.20 0.76 0.03 175 FILL_THIS_FORM 1158 0.55 0.75 0.49 176 TR_MetaPhish_Combo_01 1156 1.63 0.74 1.91 177 RELAYCOUNTRY_IN 1144 0.28 0.74 0.13 178 XMSubMetaI_01 1117 0.21 0.72 0.05 179 LONG_JUNK_URI 1109 0.25 0.71 0.10 180 XM_PDF 1106 3.69 0.71 4.65 181 URIBL_DBL_SPAM 1099 0.18 0.71 0.01 182 XM_diabetes 1099 0.17 0.71 0.00 183 XM_B_REG_HTML 1086 0.49 0.70 0.43 184 TR_XM_DK_Bayes 1055 6.81 0.68 8.79 185 RELAYCOUNTRY_IT 1048 0.20 0.68 0.05 186 BAYES_05 1047 1.64 0.67 1.95 187 XMSlimDrugH 1047 0.51 0.67 0.45 188 RELAYCOUNTRY_AU 1037 0.54 0.67 0.50 189 URIBL_ABUSE_SURBL 1030 0.20 0.66 0.05 190 HTTPS_HTTP_MISMATCH 1014 0.62 0.65 0.61 191 RELAYCOUNTRY_DE 1013 0.48 0.65 0.42 192 RCVD_IN_IADB_OPTIN 1008 2.18 0.65 2.67 193 XM_B_COPY_HTML 993 0.58 0.64 0.56 194 RELAYCOUNTRY_CN 983 0.20 0.63 0.06 195 XM_H_TOP 982 0.16 0.63 0.00 196 HK_RANDOM_REPLYTO 964 0.37 0.62 0.29 197 NUMERIC_HTTP_ADDR 961 0.38 0.62 0.30 198 FILL_THIS_FORM_LONG 954 0.40 0.61 0.33 199 XM_Combo_Sbj 927 0.47 0.60 0.42 200 TooManyTo_002 923 1.92 0.59 2.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 427053 90.15 94.39 88.78 2 DKIM_SIGNED 361896 77.16 83.14 75.24 3 XM_DK_Pass 355168 75.13 79.13 73.84 4 DKIM_VALID 337551 71.40 75.19 70.17 5 DCC_CHECK_NEGATIVE 280256 48.58 18.58 58.26 6 BAYES_50 265217 49.79 33.24 55.14 7 DKIM_VALID_AU 243745 52.33 57.48 50.67 8 XMListUnsubscribeExists 242282 57.19 78.34 50.37 9 DCC_CHECK 190285 49.30 79.49 39.56 10 T_TM2_M_HEADER_IN_MSG 152586 28.78 19.65 31.72 11 HTML_FONT_LOW_CONTRAST 135186 29.98 35.78 28.10 12 DKIM_VALID_EF 131202 26.25 23.08 27.28 13 LOC_TINY_FONT_1 106974 25.13 34.09 22.24 14 XMSubLong 103157 22.61 26.20 21.45 15 FVGT_m_MULTI_ODD 102438 22.62 26.71 21.30 16 MIME_HTML_ONLY 92968 22.19 31.06 19.33 17 MultiRelay 91964 18.55 16.80 19.12 18 T_KAM_HTML_FONT_INVALID 84362 18.83 22.84 17.54 19 ALL_TRUSTED 73196 11.98 1.93 15.22 20 XM_DK_Undo_02 61569 21.16 47.06 12.80 21 XM_Body_Dirty_Words 60331 14.31 19.79 12.54 22 XM_Multi_Part_URI 54049 12.76 17.48 11.24 23 BAYES_99 53894 18.82 42.42 11.20 24 BAYES_00 53834 8.73 1.09 11.19 25 RCVD_IN_RP_SAFE 47504 8.05 2.38 9.88 26 BAYES_999 47222 15.84 34.49 9.82 27 XM_Evil_Numbers_Gen 42610 9.83 12.82 8.86 28 RCVD_IN_RP_CERTIFIED 42304 7.08 1.77 8.79 29 TR_XM_DK_Bayes 42290 6.81 0.68 8.79 30 LOTS_OF_MONEY 42060 9.65 12.44 8.74 31 TooManyTo_001 40555 8.28 7.80 8.43 32 TR_XM_DK_Bayes1 40328 6.48 0.59 8.38 33 T_XMDrugObfuBody_14 39908 8.47 9.02 8.30 34 LotsOfNums_01 39725 8.64 9.81 8.26 35 HTML_IMAGE_RATIO_02 39252 8.99 11.58 8.16 36 XM_DKIMWhitelistDomains 37869 5.96 0.02 7.87 37 RCVD_IN_MSPIKE_H2 35466 7.00 5.85 7.37 38 TR_XM_DK_Bayes2 35165 5.63 0.42 7.31 39 RCVD_IN_MSPIKE_WL 33101 5.85 2.66 6.88 40 FSL_BULK_SIG 32091 7.15 8.62 6.67 41 XM_H_Long_From01 31495 6.82 7.67 6.55 42 BAYES_60 30865 6.35 6.12 6.42 43 RCVD_IN_MSPIKE_H3 29905 5.31 2.51 6.22 44 XM_SendGrid 29091 5.67 4.49 6.05 45 MIME_QP_LONG_LINE 28957 6.11 6.39 6.02 46 RCVD_IN_IADB_LISTED 28271 5.21 3.15 5.88 47 RELAYCOUNTRY_META 27538 8.81 18.35 5.72 48 XM_B_Phish_Phrases 27059 6.06 7.41 5.63 49 TR_DCC_Bayes_99 25323 12.23 33.84 5.26 50 T_TooManySym_01 24550 4.47 2.49 5.10 51 DKIM_INVALID 24345 5.77 7.95 5.06 52 RCVD_IN_IADB_SPF 24305 4.53 2.90 5.05 53 HTML_IMAGE_RATIO_04 23392 5.64 8.06 4.86 54 XM_PDF 22365 3.69 0.71 4.65 55 XMStrtUSub 22030 4.43 3.95 4.58 56 BOTNET_IPINHOSTNAME 21954 7.92 18.32 4.56 57 BAYES_40 21120 3.78 1.90 4.39 58 RCVD_IN_IADB_SENDERID 21084 3.99 2.78 4.38 59 TO_MALFORMED 21017 3.32 0.05 4.37 60 T_REMOTE_IMAGE 20850 3.83 2.25 4.33 61 RCVD_IN_IADB_DK 20499 3.91 2.80 4.26 62 IN_ZIMBRA_NJ_WHITELIST 19604 3.09 0.02 4.08 63 RCVD_IN_IADB_VOUCHED 19415 3.31 1.06 4.04 64 FROM_EXCESS_BASE64 19238 3.92 3.68 4.00 65 BAYES_80 18528 4.92 8.24 3.85 66 XMSubMetaSx_00 18226 4.65 7.33 3.79 67 MPART_ALT_DIFF 17163 4.53 7.53 3.57 68 HTML_IMAGE_RATIO_06 16234 3.73 4.84 3.37 69 XM_UncommonTLD01 15342 4.98 10.52 3.19 70 BAYES_20 15232 2.72 1.35 3.17 71 XM_B_SpammyTLD 15191 3.34 3.91 3.16 72 TR_XM_DK_SendGrid 15050 2.85 1.97 3.13 73 XMSexyCombo_05 14956 4.71 9.65 3.11 74 XMNumbers 13226 3.03 3.92 2.75 75 RCVD_IN_IADB_OPTIN 12845 2.18 0.65 2.67 76 HELO_NODOT 12705 2.14 0.59 2.64 77 HELO_NO_DOMAIN 12702 2.14 0.59 2.64 78 UNPARSEABLE_RELAY 12206 2.21 1.19 2.54 79 BAYES_95 11997 3.06 4.83 2.49 80 RCVD_IN_MSPIKE_BL 11533 3.20 5.67 2.40 81 MIME_HTML_MOSTLY 11478 2.68 3.59 2.39 82 TooManyTo_002 11288 1.92 0.59 2.35 83 XM_DIRTYINTL 11079 2.89 4.70 2.30 84 TVD_RCVD_IP 10886 1.79 0.34 2.26 85 MAILING_LIST_MULTI 10686 2.12 1.82 2.22 86 KHOP_HELO_FCRDNS 10510 2.36 2.91 2.18 87 HTML_IMAGE_RATIO_08 10295 2.56 3.86 2.14 88 RELAYCOUNTRY_CA 9895 2.67 4.55 2.06 89 XM_CamelCaseFrm001 9765 2.66 4.60 2.03 90 TM2_M_URI_OPT_OUT 9592 2.55 4.25 1.99 91 BAYES_05 9362 1.64 0.67 1.95 92 XMDiploma_00 9255 2.22 3.16 1.92 93 MIME_HTML_ONLY_MULTI 9249 2.52 4.36 1.92 94 XM_SPF_SoftFail 9238 2.34 3.62 1.92 95 TR_MetaPhish_Combo_01 9196 1.63 0.74 1.91 96 HTML_MIME_NO_HTML_TAG 9026 2.45 4.21 1.88 97 XM_DK_Undo_01 8921 1.68 1.16 1.85 98 BOTNET 8670 5.44 16.71 1.80 99 ANY_BOUNCE_MESSAGE 8492 1.45 0.48 1.77 100 BOUNCE_MESSAGE 8485 1.45 0.48 1.76 101 URI_HEX 8447 2.21 3.64 1.76 102 IN_HORDE_ADDRESS_BOOK 8179 1.30 0.04 1.70 103 URI_TRY_3LD 8179 1.62 1.39 1.70 104 SUBJ_ALL_CAPS 8163 1.68 1.64 1.70 105 XM_OfRef6 7883 1.80 2.29 1.64 106 INVALID_MSGID 7641 1.29 0.37 1.59 107 TR_Symld_Words 7577 1.50 1.25 1.58 108 TooManyTo_003 7576 1.31 0.48 1.57 109 T_TooManySym_02 7575 1.33 0.58 1.57 110 XMCapTrack 7382 1.23 0.27 1.53 111 T_XMDrugObfuBody_08 6984 1.69 2.43 1.45 112 UNTRUSTED_Relay 6959 3.58 10.19 1.45 113 US_DOLLARS_3 6780 1.69 2.54 1.41 114 TR_XM_PHPDW 6215 1.51 2.17 1.29 115 TR_XM_PHPForged 6124 1.49 2.16 1.27 116 TR_XM_FormFill2 6106 1.49 2.16 1.27 117 XM_H_PHPOS 6097 1.48 2.15 1.27 118 XMPhish11 6062 1.33 1.53 1.26 119 TooManyTo_004 5608 0.98 0.38 1.17 120 USER_IN_DEF_DKIM_WL 5558 0.88 0.01 1.16 121 XMGenDplmaNmb 5541 1.37 2.06 1.15 122 MISSING_HEADERS 5537 0.99 0.49 1.15 123 XM_GoogleGroups 5360 0.96 0.49 1.11 124 NO_DNS_FOR_FROM 5159 1.29 1.95 1.07 125 RELAYCOUNTRY_GB 5116 1.16 1.45 1.06 126 TM2_M_VERY_LONG_WORD 4987 1.18 1.64 1.04 127 DKIM_ADSP_CUSTOM_MED 4964 1.04 1.08 1.03 128 T_FILL_THIS_FORM_SHORT 4891 1.00 0.94 1.02 129 XM_H_Long_From02 4813 1.14 1.57 1.00 130 XM_ProductURIs 4770 1.02 1.10 0.99 131 XMBdyGiftCard01 4676 1.29 2.27 0.97 132 TooManyTo_005 4665 0.81 0.32 0.97 133 T_Symld_Words_02 4534 1.01 1.21 0.94 134 XM_UB50 4481 1.86 4.72 0.93 135 RCVD_IN_MSPIKE_L5 4138 1.70 4.30 0.86 136 XMSubMetaI_00 4079 1.22 2.36 0.85 137 RCVD_IN_MSPIKE_L3 4059 0.86 0.93 0.84 138 TR_XM_RelayPhish 3888 0.98 1.50 0.81 139 T_XMDrugObfuBody_00 3871 0.97 1.49 0.80 140 NML_ADSP_CUSTOM_MED 3624 0.76 0.78 0.75 141 SpammyFromTLD_01 3605 1.11 2.22 0.75 142 TO_NO_BRKTS_HTML_ONLY 3594 0.63 0.27 0.75 143 RCVD_IN_MSPIKE_L4 3336 0.63 0.45 0.69 144 XMStockSpam_06 3335 0.82 1.22 0.69 145 T_OBFU_PDF_ATTACH 3312 0.57 0.19 0.69 146 T_XMHurry_00 3161 0.82 1.32 0.66 147 REPLYTO_WITHOUT_TO_CC 3160 0.57 0.32 0.66 148 XMBrknScrpt_02 3060 0.75 1.10 0.64 149 XMMoneyMeta_00 2971 0.82 1.43 0.62 150 XMSexyCombo_01 2943 0.99 2.17 0.61 151 HTTPS_HTTP_MISMATCH 2927 0.62 0.65 0.61 152 RCVD_IN_BL_SPAMCOP_NET 2879 0.97 2.11 0.60 153 SHORT_HELO_AND_INLINE_IMAGE 2834 0.46 0.06 0.59 154 TR_Orig_Subnet 2827 0.46 0.07 0.59 155 XMBody_17 2779 0.92 1.96 0.58 156 HTML_TAG_BALANCE_BODY 2779 0.58 0.59 0.58 157 XM_ShortIntro_01 2764 0.53 0.37 0.57 158 XMBody_95 2760 0.47 0.16 0.57 159 XMBody_78 2730 0.77 1.38 0.57 160 XM_B_COPY_HTML 2689 0.58 0.64 0.56 161 XM_H_PHPMailer 2653 0.69 1.13 0.55 162 DKIM_ADSP_NXDOMAIN 2632 1.22 3.31 0.55 163 XMSolicitRefs_0 2588 0.52 0.48 0.54 164 XMGappySubj_01 2562 0.47 0.29 0.53 165 XMDateMe_00 2557 0.49 0.37 0.53 166 USER_IN_WHITELIST 2554 0.40 0.00 0.53 167 XMSubMetaSxObfu_03 2548 0.64 0.97 0.53 168 PLING_QUERY 2538 0.60 0.83 0.53 169 T_TooManySym_03 2530 0.45 0.20 0.53 170 HTML_IMAGE_ONLY_32 2449 0.77 1.57 0.51 171 XMLngstWrd_00 2448 0.45 0.25 0.51 172 FROM_GOV_SPOOF 2446 0.45 0.28 0.51 173 RELAYCOUNTRY_AU 2398 0.54 0.67 0.50 174 FILL_THIS_FORM 2347 0.55 0.75 0.49 175 XMNoVowels 2336 0.48 0.46 0.49 176 TM2_M_A_HREF_HREF 2317 0.59 0.93 0.48 177 FORGED_GMAIL_RCVD 2315 0.58 0.90 0.48 178 HTML_FONT_FACE_BAD 2295 0.55 0.78 0.48 179 XMLngstWrd_01 2279 0.41 0.23 0.47 180 XMHTMLBadTable_001 2220 0.63 1.17 0.46 181 XMSlimDrugH 2169 0.51 0.67 0.45 182 TR_LOTS_OF_MONEY3 2158 0.56 0.90 0.45 183 RCVD_IN_SORBS_DUL 2068 0.39 0.28 0.43 184 TM2_M_BODY_EMPTY 2065 0.42 0.40 0.43 185 XM_B_REG_HTML 2056 0.49 0.70 0.43 186 XMPhish30 2054 0.65 1.34 0.43 187 SUBJ_DOLLARS 2047 0.54 0.90 0.43 188 XM_Combo_Sbj 2035 0.47 0.60 0.42 189 FROM_GOV_DKIM_AU 2031 0.35 0.13 0.42 190 RDNS_DYNAMIC 2019 0.53 0.89 0.42 191 RELAYCOUNTRY_DE 2014 0.48 0.65 0.42 192 T_MONEY_PERCENT 1990 0.56 1.00 0.41 193 TR_LOTS_OF_MONEY2 1990 0.56 1.00 0.41 194 HTML_IMAGE_ONLY_28 1971 0.44 0.54 0.41 195 XMClaimOffer 1970 0.45 0.58 0.41 196 URI_NOVOWEL 1947 0.54 0.94 0.40 197 XMHTML_After_End 1933 0.69 1.57 0.40 198 RCVD_IN_MSPIKE_H5 1870 0.33 0.13 0.39 199 XM_URI_RBL 1799 1.10 3.34 0.37 200 HTML_IMAGE_ONLY_20 1770 0.35 0.28 0.37 ----------------------------------------------------------------------