Email: 593080 Autolearn: 0 AvgScore: 2.80 AvgScanTime: 1.94 sec Spam: 146560 Autolearn: 0 AvgScore: 12.30 AvgScanTime: 2.29 sec Ham: 446520 Autolearn: 0 AvgScore: -0.32 AvgScanTime: 1.83 sec Time Spent Running SA: 319.88 hours Time Spent Processing Spam: 93.15 hours Time Spent Processing Ham: 226.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136866 89.44 93.39 88.14 2 DKIM_SIGNED 116183 75.70 79.27 74.53 3 DCC_CHECK 112257 47.33 76.59 37.72 4 XM_DK_Pass 110767 73.71 75.58 73.09 5 XMListUnsubscribeExists 107969 54.38 73.67 48.05 6 DKIM_VALID 104888 69.79 71.57 69.20 7 DKIM_VALID_AU 78650 51.70 53.66 51.06 8 XM_DK_Undo_02 65791 21.10 44.89 13.29 9 BAYES_99 57973 18.40 39.56 11.46 10 BAYES_50 56391 50.55 38.48 54.52 11 MIME_HTML_ONLY 50277 23.80 34.30 20.36 12 HTML_FONT_LOW_CONTRAST 50000 28.89 34.12 27.17 13 BAYES_999 48556 15.79 33.13 10.10 14 TR_DCC_Bayes_99 45473 11.57 31.03 5.18 15 LOC_TINY_FONT_1 43788 24.27 29.88 22.43 16 XMSubLong 39992 23.54 27.29 22.31 17 FVGT_m_MULTI_ODD 38713 22.90 26.41 21.75 18 DCC_CHECK_NEGATIVE 31822 50.59 21.71 60.07 19 XM_Body_Dirty_Words 30515 14.58 20.82 12.54 20 DKIM_VALID_EF 30117 25.89 20.55 27.64 21 RELAYCOUNTRY_META 29419 9.06 20.07 5.44 22 T_KAM_HTML_FONT_INVALID 28543 16.99 19.48 16.17 23 BOTNET 28029 6.20 19.12 1.96 24 T_TM2_M_HEADER_IN_MSG 28008 28.84 19.11 32.03 25 BOTNET_IPINHOSTNAME 26351 7.89 17.98 4.58 26 XM_Multi_Part_URI 24566 12.84 16.76 11.55 27 MultiRelay 23014 18.90 15.70 19.95 28 UNTRUSTED_Relay 20194 4.58 13.78 1.57 29 LOTS_OF_MONEY 18583 10.12 12.68 9.28 30 HTML_IMAGE_RATIO_02 18006 9.01 12.29 7.93 31 XM_Evil_Numbers_Gen 17709 10.30 12.08 9.71 32 XM_UncommonTLD01 17070 5.41 11.65 3.36 33 XMSexyCombo_05 17061 6.02 11.64 4.18 34 FSL_BULK_SIG 16820 8.68 11.48 7.76 35 XMSubMetaSx_00 13930 5.91 9.50 4.73 36 HTML_IMAGE_RATIO_04 13707 6.58 9.35 5.68 37 T_XMDrugObfuBody_14 13277 8.67 9.06 8.54 38 LotsOfNums_01 12777 8.00 8.72 7.77 39 TooManyTo_001 11602 8.36 7.92 8.50 40 XM_H_Long_From01 11319 6.45 7.72 6.03 41 DKIM_INVALID 11295 5.91 7.71 5.33 42 XM_UB50 10901 2.55 7.44 0.95 43 BAYES_80 10296 4.63 7.03 3.84 44 XM_B_Phish_Phrases 9857 5.81 6.73 5.51 45 MPART_ALT_DIFF 9668 3.90 6.60 3.02 46 FROM_EXCESS_BASE64 9584 4.38 6.54 3.67 47 BAYES_60 9255 6.05 6.31 5.96 48 HTML_MIME_NO_HTML_TAG 9152 3.38 6.24 2.43 49 RCVD_IN_MSPIKE_H2 8548 7.44 5.83 7.97 50 RCVD_IN_MSPIKE_BL 8387 3.10 5.72 2.23 51 MIME_QP_LONG_LINE 8305 5.67 5.67 5.67 52 XM_DIRTYINTL 7159 3.04 4.88 2.43 53 HTML_IMAGE_RATIO_06 6843 3.42 4.67 3.01 54 RELAYCOUNTRY_FR 6840 1.37 4.67 0.29 55 XMStrtUSub 6664 5.10 4.55 5.28 56 RCVD_IN_MSPIKE_WL 6614 6.35 4.51 6.96 57 T_REMOTE_IMAGE 6470 4.51 4.41 4.54 58 BOTNET_NORDNS 6271 1.10 4.28 0.05 59 FROM_SUSPICIOUS_NTLD 6196 1.07 4.23 0.04 60 RCVD_IN_MSPIKE_L5 6160 1.57 4.20 0.71 61 URI_HEX 5826 2.49 3.98 2.01 62 XMNumbers 5726 3.30 3.91 3.11 63 TM2_M_URI_OPT_OUT 5724 2.47 3.91 1.99 64 RELAYCOUNTRY_CA 5703 2.06 3.89 1.45 65 XM_SPF_SoftFail 5681 2.48 3.88 2.02 66 DKIM_ADSP_NXDOMAIN 5673 1.44 3.87 0.64 67 MIME_HTML_ONLY_MULTI 5414 2.20 3.69 1.71 68 XMDiploma_00 5376 2.75 3.67 2.45 69 RCVD_IN_MSPIKE_H3 5213 5.55 3.56 6.21 70 BAYES_95 5175 2.80 3.53 2.55 71 SpammyFromTLD_02 5087 1.11 3.47 0.34 72 XMSexyCombo_01 4954 1.77 3.38 1.24 73 XM_SendGrid 4950 5.62 3.38 6.35 74 MIME_HTML_MOSTLY 4928 2.47 3.36 2.18 75 FROM_SUSPICIOUS_NTLD_FP 4928 0.85 3.36 0.03 76 XM_B_SpammyTLD 4883 3.35 3.33 3.35 77 XM_URI_RBL 4833 1.07 3.30 0.34 78 RCVD_IN_PSBL 4795 0.86 3.27 0.07 79 XM_OfRef6 4792 1.85 3.27 1.38 80 XM_CamelCaseFrm001 4488 2.12 3.06 1.81 81 KHOP_HELO_FCRDNS 4297 2.44 2.93 2.27 82 RCVD_IN_IADB_LISTED 4271 4.60 2.91 5.15 83 T_TooManySym_01 4128 4.98 2.82 5.68 84 TR_XM_PHPDW 4105 1.28 2.80 0.78 85 TR_XM_PHPForged 4085 1.26 2.79 0.76 86 TR_XM_FormFill2 4057 1.25 2.77 0.75 87 XM_H_PHPOS 4033 1.24 2.75 0.75 88 RCVD_IN_RP_SAFE 3963 8.17 2.70 9.96 89 RCVD_IN_IADB_SPF 3882 4.01 2.65 4.46 90 US_DOLLARS_3 3811 1.88 2.60 1.64 91 RCVD_IN_IADB_SENDERID 3728 3.53 2.54 3.86 92 RCVD_IN_IADB_DK 3724 3.48 2.54 3.79 93 T_XMDrugObfuBody_08 3517 1.71 2.40 1.49 94 HTML_IMAGE_RATIO_08 3496 2.53 2.39 2.58 95 XMBdyGiftCard01 3434 1.19 2.34 0.81 96 BODY_URI_ONLY 3393 0.61 2.32 0.06 97 SpammyFromTLD_01 3350 1.20 2.29 0.85 98 NO_DNS_FOR_FROM 3309 1.47 2.26 1.21 99 RCVD_IN_RP_CERTIFIED 3267 7.23 2.23 8.87 100 XM_UB99 3250 0.56 2.22 0.01 101 RCVD_IN_BL_SPAMCOP_NET 3236 1.15 2.21 0.81 102 ALL_TRUSTED 3100 12.77 2.12 16.26 103 SUBJ_ALL_CAPS 3079 2.38 2.10 2.47 104 BAYES_40 3028 3.68 2.07 4.21 105 FILL_THIS_FORM 2994 0.70 2.04 0.27 106 T_XMDrugObfuBody_00 2913 1.11 1.99 0.82 107 XM_ProductURIs 2882 1.14 1.97 0.87 108 MultiRelay_CC 2817 0.67 1.92 0.26 109 MultiRelay_Combo 2817 0.67 1.92 0.26 110 RCVD_IN_RP_RNBL 2807 0.50 1.92 0.04 111 T_XMHurry_00 2764 0.96 1.89 0.66 112 FILL_THIS_FORM_LONG 2760 0.60 1.88 0.17 113 XMSubMetaSxObfu_03 2702 0.89 1.84 0.57 114 XMBody_78 2687 0.82 1.83 0.49 115 XMGenDplmaNmb 2668 1.66 1.82 1.61 116 XM_UB999 2655 0.45 1.81 0.01 117 PDS_TO_EQ_FROM_NAME 2650 0.48 1.81 0.04 118 XMMoneyMeta_00 2622 0.89 1.79 0.60 119 XMSexyCombo_04 2544 1.01 1.74 0.77 120 MIME_HEADER_CTYPE_ONLY 2534 0.51 1.73 0.11 121 MAILING_LIST_MULTI 2516 2.21 1.72 2.37 122 URIBL_DBL_ABUSE_REDIR 2503 0.44 1.71 0.02 123 HTML_IMAGE_ONLY_08 2476 0.52 1.69 0.13 124 RELAYCOUNTRY_DE 2471 0.85 1.69 0.57 125 HDRS_LCASE_IMGONLY 2470 0.46 1.69 0.06 126 UNPARSEABLE_RELAY 2456 2.42 1.68 2.66 127 HTML_SHORT_LINK_IMG_1 2406 0.43 1.64 0.03 128 XM_UB60 2351 0.47 1.60 0.09 129 TM2_M_VERY_LONG_WORD 2336 1.32 1.59 1.23 130 XMPhish11 2288 1.33 1.56 1.25 131 URI_TRY_3LD 2278 1.49 1.55 1.47 132 TR_XM_DK_SendGrid 2159 2.73 1.47 3.14 133 XMSubMetaI_00 2123 0.80 1.45 0.58 134 TR_XM_RelayPhish 2110 0.97 1.44 0.81 135 XM_H_Long_From02 2072 1.33 1.41 1.31 136 TR_Symld_Words 1956 2.02 1.33 2.25 137 XM_H_PHPMailer 1921 0.77 1.31 0.59 138 XMBody_17 1908 0.64 1.30 0.42 139 BAYES_20 1883 2.67 1.28 3.12 140 XM_DK_Undo_01 1786 2.03 1.22 2.29 141 XMBrknScrpt_02 1760 0.65 1.20 0.47 142 RCVD_IN_MSPIKE_L3 1690 0.90 1.15 0.82 143 T_Symld_Words_02 1683 0.69 1.15 0.54 144 TR_Mismatch_TLD_01 1671 0.38 1.14 0.13 145 RCVD_IN_IADB_VOUCHED 1666 2.93 1.14 3.51 146 REPLYTO_WITHOUT_TO_CC 1652 0.35 1.13 0.10 147 TR_Mismatch_TLD_02 1650 0.33 1.13 0.06 148 XMPhish30 1627 0.59 1.11 0.42 149 XMStockSpam_06 1608 1.27 1.10 1.33 150 RELAYCOUNTRY_NL 1606 0.37 1.10 0.13 151 DATE_IN_PAST_06_12 1601 0.30 1.09 0.04 152 XMHTML_After_End 1574 0.58 1.07 0.42 153 HTML_IMAGE_ONLY_32 1563 0.59 1.07 0.44 154 URIBL_BLACK 1556 0.30 1.06 0.05 155 DATE_IN_PAST_03_06 1518 0.31 1.04 0.08 156 XM_HighProb1 1510 0.27 1.03 0.01 157 FILL_THIS_FORM_LOAN 1510 0.39 1.03 0.18 158 XM_H_PHPOS_M 1482 0.38 1.01 0.17 159 XM_B_REG_HTML 1470 0.57 1.00 0.42 160 BAYES_00 1447 9.38 0.99 12.13 161 DKIM_ADSP_CUSTOM_MED 1422 1.12 0.97 1.17 162 TR_Caps_n_Bayes_99 1407 0.36 0.96 0.16 163 RELAYCOUNTRY_GB 1360 1.19 0.93 1.28 164 FROM_GOV_SPOOF 1348 0.67 0.92 0.58 165 DIET_1 1332 0.44 0.91 0.29 166 XM_UB80 1331 0.25 0.91 0.03 167 XM_RXBody 1329 0.43 0.91 0.27 168 RELAYCOUNTRY_IN 1316 0.32 0.90 0.13 169 RELAYCOUNTRY_AT 1293 0.34 0.88 0.17 170 LongTLD 1282 0.33 0.87 0.15 171 HTML_IMAGE_ONLY_20 1280 0.43 0.87 0.28 172 MISSING_HEADERS 1267 0.63 0.86 0.55 173 RDNS_DYNAMIC 1263 0.57 0.86 0.47 174 XMSlimDrugH 1222 0.71 0.83 0.67 175 XM_OfRef7 1214 0.38 0.83 0.23 176 FORGED_GMAIL_RCVD 1198 0.63 0.82 0.57 177 XM_XX_Yahoo 1192 0.37 0.81 0.23 178 TR_LOTS_OF_MONEY2 1181 0.52 0.81 0.43 179 T_MONEY_PERCENT 1181 0.52 0.81 0.43 180 SUBJ_DOLLARS 1178 0.42 0.80 0.30 181 FROM_NTLD_LINKBAIT 1167 0.20 0.80 0.00 182 SHORT_IMG_SUSP_NTLD 1166 0.20 0.80 0.00 183 T_FILL_THIS_FORM_SHORT 1148 1.11 0.78 1.22 184 PLING_QUERY 1147 0.50 0.78 0.41 185 NML_ADSP_CUSTOM_MED 1146 0.88 0.78 0.91 186 XM_Combo_Sbj 1142 0.34 0.78 0.19 187 HK_RANDOM_REPLYTO 1127 0.34 0.77 0.20 188 DATE_IN_PAST_12_24 1125 0.21 0.77 0.03 189 HELO_NODOT 1124 1.68 0.77 1.99 190 XMHTMLBadTable_001 1112 0.47 0.76 0.38 191 TR_MetaPhish_Combo_01 1110 1.50 0.76 1.74 192 LONG_JUNK_URI 1106 0.28 0.75 0.12 193 HTML_FONT_FACE_BAD 1074 0.55 0.73 0.49 194 URI_NOVOWEL 1074 0.46 0.73 0.37 195 SHORT_URI_3 1064 0.27 0.73 0.12 196 RELAYCOUNTRY_CN 1056 0.23 0.72 0.07 197 XM_PDF 1048 3.86 0.72 4.89 198 THIS_AD 1047 0.28 0.71 0.14 199 HELO_NO_DOMAIN 1044 1.67 0.71 1.99 200 RCVD_IN_IADB_OPTIN 1015 1.88 0.69 2.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 393576 89.44 93.39 88.14 2 DKIM_SIGNED 332791 75.70 79.27 74.53 3 XM_DK_Pass 326372 73.71 75.58 73.09 4 DKIM_VALID 309007 69.79 71.57 69.20 5 DCC_CHECK_NEGATIVE 268221 50.59 21.71 60.07 6 BAYES_50 243433 50.55 38.48 54.52 7 DKIM_VALID_AU 227979 51.70 53.66 51.06 8 XMListUnsubscribeExists 214547 54.38 73.67 48.05 9 DCC_CHECK 168431 47.33 76.59 37.72 10 T_TM2_M_HEADER_IN_MSG 143026 28.84 19.11 32.03 11 DKIM_VALID_EF 123438 25.89 20.55 27.64 12 HTML_FONT_LOW_CONTRAST 121330 28.89 34.12 27.17 13 LOC_TINY_FONT_1 100145 24.27 29.88 22.43 14 XMSubLong 99630 23.54 27.29 22.31 15 FVGT_m_MULTI_ODD 97120 22.90 26.41 21.75 16 MIME_HTML_ONLY 90897 23.80 34.30 20.36 17 MultiRelay 89092 18.90 15.70 19.95 18 ALL_TRUSTED 72611 12.77 2.12 16.26 19 T_KAM_HTML_FONT_INVALID 72202 16.99 19.48 16.17 20 XM_DK_Undo_02 59326 21.10 44.89 13.29 21 XM_Body_Dirty_Words 55984 14.58 20.82 12.54 22 BAYES_00 54157 9.38 0.99 12.13 23 XM_Multi_Part_URI 51557 12.84 16.76 11.55 24 BAYES_99 51181 18.40 39.56 11.46 25 BAYES_999 45113 15.79 33.13 10.10 26 RCVD_IN_RP_SAFE 44477 8.17 2.70 9.96 27 XM_Evil_Numbers_Gen 43349 10.30 12.08 9.71 28 TR_XM_DK_Bayes 42270 7.28 0.62 9.47 29 LOTS_OF_MONEY 41424 10.12 12.68 9.28 30 TR_XM_DK_Bayes1 40247 6.92 0.55 9.01 31 RCVD_IN_RP_CERTIFIED 39609 7.23 2.23 8.87 32 XM_DKIMWhitelistDomains 38307 6.49 0.14 8.58 33 T_XMDrugObfuBody_14 38129 8.67 9.06 8.54 34 TooManyTo_001 37964 8.36 7.92 8.50 35 RCVD_IN_MSPIKE_H2 35568 7.44 5.83 7.97 36 HTML_IMAGE_RATIO_02 35404 9.01 12.29 7.93 37 LotsOfNums_01 34673 8.00 8.72 7.77 38 FSL_BULK_SIG 34649 8.68 11.48 7.76 39 TR_XM_DK_Bayes2 34122 5.88 0.52 7.64 40 RCVD_IN_MSPIKE_WL 31058 6.35 4.51 6.96 41 XM_SendGrid 28361 5.62 3.38 6.35 42 RCVD_IN_MSPIKE_H3 27722 5.55 3.56 6.21 43 XM_H_Long_From01 26912 6.45 7.72 6.03 44 BAYES_60 26629 6.05 6.31 5.96 45 T_TooManySym_01 25384 4.98 2.82 5.68 46 HTML_IMAGE_RATIO_04 25342 6.58 9.35 5.68 47 MIME_QP_LONG_LINE 25320 5.67 5.67 5.67 48 XM_B_Phish_Phrases 24603 5.81 6.73 5.51 49 RELAYCOUNTRY_META 24309 9.06 20.07 5.44 50 DKIM_INVALID 23784 5.91 7.71 5.33 51 XMStrtUSub 23584 5.10 4.55 5.28 52 TR_DCC_Bayes_99 23130 11.57 31.03 5.18 53 RCVD_IN_IADB_LISTED 22997 4.60 2.91 5.15 54 XM_PDF 21817 3.86 0.72 4.89 55 XMSubMetaSx_00 21109 5.91 9.50 4.73 56 TO_MALFORMED 20750 3.51 0.06 4.65 57 BOTNET_IPINHOSTNAME 20436 7.89 17.98 4.58 58 T_REMOTE_IMAGE 20286 4.51 4.41 4.54 59 RCVD_IN_IADB_SPF 19898 4.01 2.65 4.46 60 BAYES_40 18782 3.68 2.07 4.21 61 XMSexyCombo_05 18648 6.02 11.64 4.18 62 IN_ZIMBRA_NJ_WHITELIST 18474 3.12 0.02 4.14 63 RCVD_IN_IADB_SENDERID 17234 3.53 2.54 3.86 64 BAYES_80 17138 4.63 7.03 3.84 65 RCVD_IN_IADB_DK 16935 3.48 2.54 3.79 66 FROM_EXCESS_BASE64 16400 4.38 6.54 3.67 67 RCVD_IN_IADB_VOUCHED 15682 2.93 1.14 3.51 68 XM_UncommonTLD01 15001 5.41 11.65 3.36 69 XM_B_SpammyTLD 14965 3.35 3.33 3.35 70 TR_XM_DK_SendGrid 14017 2.73 1.47 3.14 71 BAYES_20 13927 2.67 1.28 3.12 72 XMNumbers 13867 3.30 3.91 3.11 73 MPART_ALT_DIFF 13483 3.90 6.60 3.02 74 HTML_IMAGE_RATIO_06 13419 3.42 4.67 3.01 75 UNPARSEABLE_RELAY 11884 2.42 1.68 2.66 76 HTML_IMAGE_RATIO_08 11512 2.53 2.39 2.58 77 BAYES_95 11402 2.80 3.53 2.55 78 SUBJ_ALL_CAPS 11034 2.38 2.10 2.47 79 XMDiploma_00 10944 2.75 3.67 2.45 80 HTML_MIME_NO_HTML_TAG 10867 3.38 6.24 2.43 81 XM_DIRTYINTL 10844 3.04 4.88 2.43 82 TooManyTo_002 10759 1.97 0.65 2.41 83 MAILING_LIST_MULTI 10577 2.21 1.72 2.37 84 TVD_RCVD_IP 10424 1.84 0.33 2.33 85 XM_DK_Undo_01 10242 2.03 1.22 2.29 86 KHOP_HELO_FCRDNS 10155 2.44 2.93 2.27 87 RCVD_IN_IADB_OPTIN 10133 1.88 0.69 2.27 88 TR_Symld_Words 10049 2.02 1.33 2.25 89 RCVD_IN_MSPIKE_BL 9975 3.10 5.72 2.23 90 MIME_HTML_MOSTLY 9733 2.47 3.36 2.18 91 XM_SPF_SoftFail 9009 2.48 3.88 2.02 92 URI_HEX 8955 2.49 3.98 2.01 93 TM2_M_URI_OPT_OUT 8901 2.47 3.91 1.99 94 HELO_NODOT 8866 1.68 0.77 1.99 95 HELO_NO_DOMAIN 8865 1.67 0.71 1.99 96 BAYES_05 8788 1.64 0.63 1.97 97 BOTNET 8760 6.20 19.12 1.96 98 XM_CamelCaseFrm001 8099 2.12 3.06 1.81 99 T_TooManySym_02 7858 1.49 0.68 1.76 100 IN_HORDE_ADDRESS_BOOK 7846 1.33 0.05 1.76 101 ANY_BOUNCE_MESSAGE 7801 1.41 0.40 1.75 102 BOUNCE_MESSAGE 7796 1.41 0.39 1.75 103 TR_MetaPhish_Combo_01 7783 1.50 0.76 1.74 104 MIME_HTML_ONLY_MULTI 7636 2.20 3.69 1.71 105 TooManyTo_003 7437 1.39 0.54 1.67 106 INVALID_MSGID 7415 1.32 0.27 1.66 107 US_DOLLARS_3 7337 1.88 2.60 1.64 108 XMGenDplmaNmb 7180 1.66 1.82 1.61 109 XMCapTrack 7069 1.26 0.28 1.58 110 UNTRUSTED_Relay 6989 4.58 13.78 1.57 111 T_XMDrugObfuBody_08 6633 1.71 2.40 1.49 112 URI_TRY_3LD 6565 1.49 1.55 1.47 113 RELAYCOUNTRY_CA 6494 2.06 3.89 1.45 114 XM_OfRef6 6155 1.85 3.27 1.38 115 XMStockSpam_06 5926 1.27 1.10 1.33 116 XM_H_Long_From02 5836 1.33 1.41 1.31 117 USER_IN_DEF_DKIM_WL 5828 0.99 0.04 1.31 118 RELAYCOUNTRY_GB 5725 1.19 0.93 1.28 119 XMPhish11 5588 1.33 1.56 1.25 120 TooManyTo_004 5586 1.05 0.43 1.25 121 XMSexyCombo_01 5526 1.77 3.38 1.24 122 TM2_M_VERY_LONG_WORD 5501 1.32 1.59 1.23 123 XM_GoogleGroups 5479 1.04 0.45 1.23 124 T_FILL_THIS_FORM_SHORT 5461 1.11 0.78 1.22 125 NO_DNS_FOR_FROM 5392 1.47 2.26 1.21 126 DKIM_ADSP_CUSTOM_MED 5241 1.12 0.97 1.17 127 TooManyTo_005 4626 0.87 0.36 1.04 128 XM_UB50 4223 2.55 7.44 0.95 129 NML_ADSP_CUSTOM_MED 4077 0.88 0.78 0.91 130 XM_ProductURIs 3896 1.14 1.97 0.87 131 SpammyFromTLD_01 3777 1.20 2.29 0.85 132 T_XMDrugObfuBody_00 3681 1.11 1.99 0.82 133 RCVD_IN_MSPIKE_L3 3669 0.90 1.15 0.82 134 XMBdyGiftCard01 3619 1.19 2.34 0.81 135 TR_XM_RelayPhish 3616 0.97 1.44 0.81 136 RCVD_IN_BL_SPAMCOP_NET 3602 1.15 2.21 0.81 137 XMGappySubj_01 3531 0.67 0.32 0.79 138 TR_XM_PHPDW 3473 1.28 2.80 0.78 139 XMSexyCombo_04 3456 1.01 1.74 0.77 140 TR_XM_PHPForged 3373 1.26 2.79 0.76 141 TR_XM_FormFill2 3346 1.25 2.77 0.75 142 XM_H_PHPOS 3335 1.24 2.75 0.75 143 HTTPS_HTTP_MISMATCH 3279 0.72 0.68 0.73 144 T_OBFU_PDF_ATTACH 3274 0.60 0.19 0.73 145 RCVD_IN_MSPIKE_L5 3166 1.57 4.20 0.71 146 RCVD_IN_MSPIKE_L4 3140 0.62 0.37 0.70 147 XMSolicitRefs_0 3070 0.67 0.62 0.69 148 TM2_M_A_HREF_HREF 3020 0.63 0.49 0.68 149 XMSlimDrugH 2983 0.71 0.83 0.67 150 T_XMHurry_00 2939 0.96 1.89 0.66 151 DKIM_ADSP_NXDOMAIN 2860 1.44 3.87 0.64 152 XM_ShortIntro_01 2807 0.61 0.55 0.63 153 USER_IN_WHITELIST 2716 0.46 0.00 0.61 154 XMMoneyMeta_00 2661 0.89 1.79 0.60 155 FROM_GOV_DKIM_AU 2656 0.51 0.26 0.59 156 AC_DIV_BONANZA 2652 0.48 0.13 0.59 157 XM_H_PHPMailer 2632 0.77 1.31 0.59 158 FROM_GOV_SPOOF 2612 0.67 0.92 0.58 159 XMSubMetaI_00 2592 0.80 1.45 0.58 160 XMSubMetaSxObfu_03 2558 0.89 1.84 0.57 161 RELAYCOUNTRY_DE 2551 0.85 1.69 0.57 162 FORGED_GMAIL_RCVD 2548 0.63 0.82 0.57 163 T_TooManySym_03 2516 0.46 0.14 0.56 164 XM_B_COPY_HTML 2509 0.57 0.60 0.56 165 MISSING_HEADERS 2476 0.63 0.86 0.55 166 XMBody_95 2455 0.47 0.21 0.55 167 T_Symld_Words_02 2431 0.69 1.15 0.54 168 SHORT_HELO_AND_INLINE_IMAGE 2418 0.42 0.04 0.54 169 HTML_TAG_BALANCE_BODY 2359 0.53 0.55 0.53 170 XMNoVowels 2355 0.52 0.50 0.53 171 XMLngstWrd_00 2311 0.46 0.28 0.52 172 T_MANY_PILL_PRICE 2269 0.38 0.00 0.51 173 TM2_M_BODY_EMPTY 2256 0.48 0.41 0.51 174 RELAYCOUNTRY_AU 2220 0.52 0.57 0.50 175 HTML_FONT_FACE_BAD 2210 0.55 0.73 0.49 176 XMBody_78 2174 0.82 1.83 0.49 177 XMLngstWrd_01 2137 0.43 0.26 0.48 178 XMBrknScrpt_02 2096 0.65 1.20 0.47 179 RDNS_DYNAMIC 2096 0.57 0.86 0.47 180 HTML_IMAGE_ONLY_28 1970 0.47 0.56 0.44 181 HTML_IMAGE_ONLY_32 1954 0.59 1.07 0.44 182 T_MONEY_PERCENT 1919 0.52 0.81 0.43 183 TR_LOTS_OF_MONEY2 1919 0.52 0.81 0.43 184 XMDateMe_00 1911 0.40 0.30 0.43 185 XMPhish30 1895 0.59 1.11 0.42 186 XM_B_REG_HTML 1886 0.57 1.00 0.42 187 XMHTML_After_End 1882 0.58 1.07 0.42 188 XMBody_17 1872 0.64 1.30 0.42 189 RCVD_IN_MSPIKE_H5 1849 0.45 0.58 0.41 190 PLING_QUERY 1841 0.50 0.78 0.41 191 RCVD_IN_SORBS_DUL 1835 0.37 0.24 0.41 192 XMSubMetaSxObfu_02 1766 0.40 0.43 0.40 193 XMHTMLBadTable_001 1702 0.47 0.76 0.38 194 URI_NOVOWEL 1641 0.46 0.73 0.37 195 XMGappySubj_02 1635 0.29 0.07 0.37 196 XMSubNoVowel 1593 0.39 0.51 0.36 197 XM_Body_Obfu01 1564 0.36 0.39 0.35 198 XMPhish14 1544 0.42 0.64 0.35 199 XM_URI_RBL 1525 1.07 3.30 0.34 200 SpammyFromTLD_02 1516 1.11 3.47 0.34 ----------------------------------------------------------------------