Email: 635996 Autolearn: 0 AvgScore: 2.80 AvgScanTime: 2.08 sec Spam: 160127 Autolearn: 0 AvgScore: 12.42 AvgScanTime: 2.51 sec Ham: 475869 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 1.93 sec Time Spent Running SA: 366.86 hours Time Spent Processing Spam: 111.51 hours Time Spent Processing Ham: 255.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153208 89.02 95.68 86.78 2 XM_B_Unicode2 150526 94.87 94.00 95.16 3 DKIM_SIGNED 129238 77.14 80.71 75.94 4 DCC_CHECK 126043 50.58 78.71 41.12 5 XMListUnsubscribeExists 125055 57.61 78.10 50.72 6 XM_DK_Pass 123911 75.21 77.38 74.48 7 DKIM_VALID 117817 71.47 73.58 70.76 8 XM_B_Unicode 116157 68.83 72.54 67.59 9 DKIM_VALID_AU 90239 52.20 56.35 50.80 10 XM_DK_Undo_02 74075 21.70 46.26 13.43 11 BAYES_99 67104 19.00 41.91 11.29 12 BAYES_50 57508 48.78 35.91 53.11 13 HTML_FONT_LOW_CONTRAST 56374 29.88 35.21 28.08 14 BAYES_999 55215 16.11 34.48 9.93 15 TR_DCC_Bayes_99 54308 12.49 33.92 5.29 16 LOC_TINY_FONT_1 52607 24.88 32.85 22.20 17 MIME_HTML_ONLY 48018 22.38 29.99 19.82 18 FVGT_m_MULTI_ODD 44632 22.74 27.87 21.02 19 XMSubLong 42286 22.30 26.41 20.92 20 DKIM_VALID_EF 36410 26.63 22.74 27.94 21 XM_Body_Dirty_Words 32826 15.57 20.50 13.91 22 T_KAM_HTML_FONT_INVALID 32412 18.46 20.24 17.86 23 DCC_CHECK_NEGATIVE 30903 47.35 19.30 56.78 24 T_TM2_M_HEADER_IN_MSG 29975 27.96 18.72 31.07 25 RELAYCOUNTRY_META 29688 8.79 18.54 5.50 26 BOTNET_IPINHOSTNAME 28836 8.13 18.01 4.80 27 BOTNET 28154 5.83 17.58 1.88 28 XM_Multi_Part_URI 26105 13.09 16.30 12.02 29 MultiRelay 24470 18.51 15.28 19.59 30 HTML_IMAGE_RATIO_02 21332 9.38 13.32 8.05 31 XM_Evil_Numbers_Gen 20139 9.51 12.58 8.47 32 LOTS_OF_MONEY 20002 10.01 12.49 9.17 33 UNTRUSTED_Relay 19410 4.20 12.12 1.53 34 XM_UncommonTLD01 17442 5.76 10.89 4.03 35 XMSexyCombo_05 15857 5.19 9.90 3.61 36 LotsOfNums_01 14120 8.17 8.82 7.95 37 TooManyTo_001 13929 8.68 8.70 8.67 38 FSL_BULK_SIG 13580 7.94 8.48 7.76 39 T_XMDrugObfuBody_14 12593 8.16 7.86 8.26 40 MPART_ALT_DIFF 12126 4.32 7.57 3.23 41 XM_H_Long_From01 11655 6.57 7.28 6.33 42 HTML_IMAGE_RATIO_04 11441 6.01 7.14 5.62 43 DKIM_INVALID 11421 5.67 7.13 5.18 44 XMSubMetaSx_00 11312 4.90 7.06 4.17 45 BAYES_80 11206 4.73 7.00 3.96 46 RCVD_IN_MSPIKE_H2 11028 7.82 6.89 8.13 47 RCVD_IN_MSPIKE_BL 10134 3.35 6.33 2.35 48 XM_B_Phish_Phrases 10115 5.98 6.32 5.86 49 BAYES_60 9883 6.33 6.17 6.39 50 XM_DIRTYINTL 9828 3.33 6.14 2.39 51 XM_UB50 9178 2.20 5.73 1.01 52 XM_B_SpammyTLD 8862 3.83 5.53 3.25 53 MIME_QP_LONG_LINE 8219 5.67 5.13 5.85 54 HTML_IMAGE_RATIO_06 8160 3.79 5.10 3.35 55 RELAYCOUNTRY_FR 7741 1.44 4.83 0.30 56 FROM_SUSPICIOUS_NTLD 7522 1.22 4.70 0.05 57 FROM_SUSPICIOUS_NTLD_FP 7462 1.20 4.66 0.04 58 RCVD_IN_MSPIKE_L5 7377 1.94 4.61 1.04 59 SpammyFromTLD_02 7122 1.33 4.45 0.29 60 FROM_EXCESS_BASE64 7091 4.02 4.43 3.88 61 XMStrtUSub 6787 4.41 4.24 4.47 62 HTML_MIME_NO_HTML_TAG 6754 2.76 4.22 2.27 63 RCVD_IN_PSBL 6601 1.10 4.12 0.09 64 DKIM_ADSP_NXDOMAIN 6434 1.48 4.02 0.62 65 MIME_HTML_ONLY_MULTI 6426 2.21 4.01 1.60 66 BAYES_95 6401 3.02 4.00 2.69 67 XM_SPF_SoftFail 6056 2.48 3.78 2.04 68 TM2_M_URI_OPT_OUT 5881 2.18 3.67 1.67 69 MIME_HTML_MOSTLY 5845 2.46 3.65 2.06 70 URI_HEX 5830 2.18 3.64 1.69 71 RELAYCOUNTRY_CA 5747 2.04 3.59 1.52 72 XM_SendGrid 5737 5.57 3.58 6.24 73 XMNumbers 5638 3.00 3.52 2.83 74 XMDiploma_00 5405 2.46 3.38 2.15 75 RCVD_IN_BL_SPAMCOP_NET 5356 1.71 3.34 1.15 76 T_REMOTE_IMAGE 5048 3.88 3.15 4.12 77 HTML_IMAGE_RATIO_08 4947 2.53 3.09 2.34 78 XM_URI_RBL 4821 1.06 3.01 0.41 79 XMBdyGiftCard01 4695 1.44 2.93 0.94 80 T_TooManySym_01 4658 4.79 2.91 5.43 81 RCVD_IN_IADB_LISTED 4618 5.00 2.88 5.71 82 T_XMDrugObfuBody_08 4463 1.85 2.79 1.54 83 XM_CamelCaseFrm001 4434 2.52 2.77 2.43 84 BOTNET_NORDNS 4411 0.71 2.75 0.02 85 ALL_TRUSTED 4337 12.38 2.71 15.63 86 US_DOLLARS_3 4304 2.10 2.69 1.90 87 RCVD_IN_RP_SAFE 4284 8.19 2.68 10.04 88 XMBody_78 4148 1.00 2.59 0.46 89 RCVD_IN_IADB_SPF 4073 4.31 2.54 4.91 90 RCVD_IN_IADB_SENDERID 3869 3.77 2.42 4.23 91 RCVD_IN_IADB_DK 3837 3.68 2.40 4.11 92 PDS_TO_EQ_FROM_NAME 3684 0.62 2.30 0.05 93 KHOP_HELO_FCRDNS 3635 2.22 2.27 2.20 94 MultiRelay_Combo 3572 0.73 2.23 0.22 95 MultiRelay_CC 3572 0.73 2.23 0.22 96 TR_XM_PHPDW 3534 1.45 2.21 1.20 97 XMGenDplmaNmb 3516 1.52 2.20 1.30 98 TR_XM_PHPForged 3506 1.36 2.19 1.09 99 XMPhish11 3491 1.48 2.18 1.24 100 TR_XM_FormFill2 3472 1.06 2.17 0.69 101 MAILING_LIST_MULTI 3463 2.36 2.16 2.43 102 XM_H_PHPOS 3448 1.05 2.15 0.68 103 URI_TRY_3LD 3351 1.36 2.09 1.11 104 XM_UB99 3325 0.53 2.08 0.01 105 RCVD_IN_MSPIKE_WL 3208 5.77 2.00 7.04 106 URIBL_DBL_ABUSE_REDIR 3203 0.52 2.00 0.02 107 XMSexyCombo_01 3176 1.40 1.98 1.20 108 SUBJ_ALL_CAPS 3142 1.90 1.96 1.88 109 BAYES_40 3127 3.80 1.95 4.42 110 RCVD_IN_RP_CERTIFIED 3093 7.27 1.93 9.06 111 RCVD_IN_MSPIKE_H3 3041 5.26 1.90 6.39 112 SpammyFromTLD_01 2914 1.00 1.82 0.72 113 T_MONEY_PERCENT 2846 0.62 1.78 0.23 114 TR_LOTS_OF_MONEY2 2846 0.62 1.78 0.23 115 XM_OfRef6 2832 1.77 1.77 1.77 116 HTML_IMAGE_ONLY_32 2819 0.71 1.76 0.36 117 NO_DNS_FOR_FROM 2792 1.21 1.74 1.04 118 XM_ProductURIs 2790 0.99 1.74 0.73 119 HTTPS_HTTP_MISMATCH 2737 0.90 1.71 0.62 120 TR_XM_DK_SendGrid 2654 2.80 1.66 3.19 121 TM2_M_VERY_LONG_WORD 2627 1.29 1.64 1.17 122 XM_UB999 2575 0.41 1.61 0.01 123 LOW_PRICE 2496 0.58 1.56 0.25 124 XMSubMetaI_00 2443 0.99 1.53 0.80 125 DATE_IN_PAST_03_06 2438 0.50 1.52 0.16 126 RCVD_IN_RP_RNBL 2417 0.42 1.51 0.05 127 XMBody_17 2414 0.85 1.51 0.62 128 RELAYCOUNTRY_DE 2289 0.72 1.43 0.48 129 T_XMDrugObfuBody_00 2280 1.01 1.42 0.87 130 DIET_1 2234 0.60 1.40 0.34 131 TR_XM_RelayPhish 2206 0.95 1.38 0.80 132 T_XMHurry_00 2196 0.85 1.37 0.68 133 XM_DK_Undo_01 2193 1.52 1.37 1.58 134 XMMoneyMeta_00 2167 0.82 1.35 0.63 135 TVD_RCVD_IP 2144 2.15 1.34 2.42 136 RELAYCOUNTRY_IN 2135 0.42 1.33 0.11 137 XMSubMetaD_00 2093 0.39 1.31 0.08 138 XM_H_Long_From02 2065 1.31 1.29 1.32 139 RCVD_IN_IADB_VOUCHED 2031 3.26 1.27 3.93 140 BAYES_20 2025 2.75 1.26 3.24 141 XM_H_PHPMailer 2019 1.14 1.26 1.10 142 XMBrknScrpt_02 2003 0.80 1.25 0.64 143 TR_Symld_Words 1949 1.69 1.22 1.86 144 T_Symld_Words_02 1936 0.78 1.21 0.64 145 XM_UB60 1927 0.37 1.20 0.09 146 XMStockSpam_06 1845 1.25 1.15 1.28 147 URIBL_BLACK 1838 0.33 1.15 0.06 148 DKIM_ADSP_CUSTOM_MED 1799 1.27 1.12 1.32 149 RCVD_IN_MSPIKE_L3 1769 0.81 1.10 0.70 150 RELAYCOUNTRY_GB 1761 1.11 1.10 1.11 151 XMHTML_After_End 1753 0.59 1.09 0.42 152 MIME_HEADER_CTYPE_ONLY 1746 0.37 1.09 0.13 153 XMHTMLBadTable_001 1727 0.60 1.08 0.45 154 XMSubPhish3 1702 0.27 1.06 0.00 155 XM_H_TOP 1701 0.27 1.06 0.00 156 XM_UB80 1699 0.28 1.06 0.02 157 XMPhish19 1674 0.27 1.05 0.02 158 THIS_AD 1668 0.36 1.04 0.12 159 HTML_FONT_FACE_BAD 1652 0.66 1.03 0.53 160 TR_M_TOP_BAYES 1637 0.26 1.02 0.00 161 TR_Caps_n_Bayes_99 1608 0.31 1.00 0.08 162 XMPhish30 1605 0.57 1.00 0.43 163 BASE64_LENGTH_79_INF 1590 0.45 0.99 0.27 164 XMNoVowels 1581 0.77 0.99 0.70 165 FORGED_GMAIL_RCVD 1576 0.77 0.98 0.70 166 NORDNS_LOW_CONTRAST 1565 0.25 0.98 0.01 167 MISSING_HEADERS 1521 0.57 0.95 0.44 168 XMSlimDrugH 1513 0.64 0.94 0.54 169 PLING_QUERY 1507 0.54 0.94 0.41 170 XMSubGiftCard1 1491 0.26 0.93 0.03 171 MPART_ALT_DIFF_COUNT 1479 0.46 0.92 0.31 172 DATE_IN_PAST_06_12 1473 0.30 0.92 0.09 173 URI_NOVOWEL 1472 0.55 0.92 0.42 174 XM_H_PHPOS_M 1456 0.37 0.91 0.19 175 BAYES_00 1451 9.54 0.91 12.45 176 TR_Mismatch_TLD_02 1432 0.27 0.89 0.07 177 XMPhish14 1421 0.47 0.89 0.33 178 NML_ADSP_CUSTOM_MED 1405 1.02 0.88 1.07 179 HTML_IMAGE_ONLY_24 1397 0.49 0.87 0.36 180 UNPARSEABLE_RELAY 1373 2.11 0.86 2.54 181 RDNS_DYNAMIC 1371 0.53 0.86 0.42 182 XM_HighProb1 1345 0.25 0.84 0.05 183 XMObfuSubjects 1344 0.23 0.84 0.03 184 XMSexyCombo_04 1300 0.61 0.81 0.54 185 XMSubMetaSxObfu_03 1296 0.46 0.81 0.35 186 TR_LOTS_OF_MONEY3 1291 0.51 0.81 0.41 187 RELAYCOUNTRY_CN 1284 0.25 0.80 0.07 188 BODY_QUOTE_MALF_MSGID 1264 0.65 0.79 0.60 189 RELAYCOUNTRY_JP 1254 0.21 0.78 0.02 190 REMOVE_BEFORE_LINK 1246 0.45 0.78 0.34 191 TooManyTo_002 1244 1.82 0.78 2.17 192 RELAYCOUNTRY_AT 1214 0.31 0.76 0.16 193 FROM_MISSP_REPLYTO 1212 0.20 0.76 0.02 194 RCVD_IN_IADB_OPTIN 1200 2.09 0.75 2.54 195 XM_B_REG_HTML 1184 0.54 0.74 0.47 196 LongTLD 1177 0.28 0.74 0.13 197 DRUGS_ERECTILE 1175 0.23 0.73 0.05 198 URIBL_DBL_SPAM 1120 0.18 0.70 0.01 199 BODY_URI_ONLY 1120 0.25 0.70 0.10 200 BAYES_05 1114 1.71 0.70 2.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 XM_B_Unicode2 452815 94.87 94.00 95.16 2 HTML_MESSAGE 412964 89.02 95.68 86.78 3 DKIM_SIGNED 361358 77.14 80.71 75.94 4 XM_DK_Pass 354441 75.21 77.38 74.48 5 DKIM_VALID 336705 71.47 73.58 70.76 6 XM_B_Unicode 321617 68.83 72.54 67.59 7 DCC_CHECK_NEGATIVE 270220 47.35 19.30 56.78 8 BAYES_50 252752 48.78 35.91 53.11 9 DKIM_VALID_AU 241746 52.20 56.35 50.80 10 XMListUnsubscribeExists 241337 57.61 78.10 50.72 11 DCC_CHECK 195658 50.58 78.71 41.12 12 T_TM2_M_HEADER_IN_MSG 147857 27.96 18.72 31.07 13 HTML_FONT_LOW_CONTRAST 133647 29.88 35.21 28.08 14 DKIM_VALID_EF 132948 26.63 22.74 27.94 15 LOC_TINY_FONT_1 105637 24.88 32.85 22.20 16 FVGT_m_MULTI_ODD 100013 22.74 27.87 21.02 17 XMSubLong 99556 22.30 26.41 20.92 18 MIME_HTML_ONLY 94309 22.38 29.99 19.82 19 MultiRelay 93228 18.51 15.28 19.59 20 T_KAM_HTML_FONT_INVALID 84981 18.46 20.24 17.86 21 ALL_TRUSTED 74376 12.38 2.71 15.63 22 XM_Body_Dirty_Words 66207 15.57 20.50 13.91 23 XM_DK_Undo_02 63923 21.70 46.26 13.43 24 BAYES_00 59251 9.54 0.91 12.45 25 XM_Multi_Part_URI 57177 13.09 16.30 12.02 26 BAYES_99 53732 19.00 41.91 11.29 27 RCVD_IN_RP_SAFE 47777 8.19 2.68 10.04 28 BAYES_999 47237 16.11 34.48 9.93 29 TR_XM_DK_Bayes 47000 7.48 0.37 9.88 30 TR_XM_DK_Bayes1 44734 7.11 0.32 9.40 31 LOTS_OF_MONEY 43634 10.01 12.49 9.17 32 RCVD_IN_RP_CERTIFIED 43122 7.27 1.93 9.06 33 TooManyTo_001 41265 8.68 8.70 8.67 34 XM_Evil_Numbers_Gen 40316 9.51 12.58 8.47 35 XM_DKIMWhitelistDomains 39521 6.22 0.04 8.31 36 T_XMDrugObfuBody_14 39328 8.16 7.86 8.26 37 RCVD_IN_MSPIKE_H2 38678 7.82 6.89 8.13 38 HTML_IMAGE_RATIO_02 38317 9.38 13.32 8.05 39 LotsOfNums_01 37832 8.17 8.82 7.95 40 TR_XM_DK_Bayes2 37232 5.92 0.26 7.82 41 FSL_BULK_SIG 36928 7.94 8.48 7.76 42 RCVD_IN_MSPIKE_WL 33518 5.77 2.00 7.04 43 RCVD_IN_MSPIKE_H3 30426 5.26 1.90 6.39 44 BAYES_60 30389 6.33 6.17 6.39 45 XM_H_Long_From01 30119 6.57 7.28 6.33 46 XM_SendGrid 29703 5.57 3.58 6.24 47 XM_B_Phish_Phrases 27901 5.98 6.32 5.86 48 MIME_QP_LONG_LINE 27843 5.67 5.13 5.85 49 RCVD_IN_IADB_LISTED 27174 5.00 2.88 5.71 50 HTML_IMAGE_RATIO_04 26751 6.01 7.14 5.62 51 RELAYCOUNTRY_META 26185 8.79 18.54 5.50 52 T_TooManySym_01 25823 4.79 2.91 5.43 53 TR_DCC_Bayes_99 25150 12.49 33.92 5.29 54 TO_MALFORMED 24780 3.92 0.11 5.21 55 DKIM_INVALID 24653 5.67 7.13 5.18 56 RCVD_IN_IADB_SPF 23358 4.31 2.54 4.91 57 BOTNET_IPINHOSTNAME 22848 8.13 18.01 4.80 58 XM_PDF 22562 3.71 0.66 4.74 59 XMStrtUSub 21292 4.41 4.24 4.47 60 BAYES_40 21043 3.80 1.95 4.42 61 RCVD_IN_IADB_SENDERID 20123 3.77 2.42 4.23 62 XMSubMetaSx_00 19843 4.90 7.06 4.17 63 T_REMOTE_IMAGE 19627 3.88 3.15 4.12 64 RCVD_IN_IADB_DK 19582 3.68 2.40 4.11 65 XM_UncommonTLD01 19168 5.76 10.89 4.03 66 IN_ZIMBRA_NJ_WHITELIST 18978 2.99 0.02 3.99 67 BAYES_80 18866 4.73 7.00 3.96 68 RCVD_IN_IADB_VOUCHED 18705 3.26 1.27 3.93 69 FROM_EXCESS_BASE64 18454 4.02 4.43 3.88 70 XMSexyCombo_05 17159 5.19 9.90 3.61 71 HTML_IMAGE_RATIO_06 15938 3.79 5.10 3.35 72 XM_B_SpammyTLD 15470 3.83 5.53 3.25 73 BAYES_20 15439 2.75 1.26 3.24 74 MPART_ALT_DIFF 15373 4.32 7.57 3.23 75 TR_XM_DK_SendGrid 15164 2.80 1.66 3.19 76 XMNumbers 13446 3.00 3.52 2.83 77 BAYES_95 12805 3.02 4.00 2.69 78 RCVD_IN_IADB_OPTIN 12076 2.09 0.75 2.54 79 UNPARSEABLE_RELAY 12068 2.11 0.86 2.54 80 XM_CamelCaseFrm001 11562 2.52 2.77 2.43 81 MAILING_LIST_MULTI 11546 2.36 2.16 2.43 82 TVD_RCVD_IP 11504 2.15 1.34 2.42 83 XM_DIRTYINTL 11354 3.33 6.14 2.39 84 RCVD_IN_MSPIKE_BL 11167 3.35 6.33 2.35 85 HTML_IMAGE_RATIO_08 11122 2.53 3.09 2.34 86 INVALID_MSGID 10997 1.75 0.10 2.31 87 HTML_MIME_NO_HTML_TAG 10779 2.76 4.22 2.27 88 KHOP_HELO_FCRDNS 10466 2.22 2.27 2.20 89 TooManyTo_002 10348 1.82 0.78 2.17 90 XMDiploma_00 10227 2.46 3.38 2.15 91 ANY_BOUNCE_MESSAGE 9808 1.61 0.28 2.06 92 BOUNCE_MESSAGE 9807 1.61 0.28 2.06 93 MIME_HTML_MOSTLY 9793 2.46 3.65 2.06 94 BAYES_05 9781 1.71 0.70 2.06 95 XM_SPF_SoftFail 9701 2.48 3.78 2.04 96 US_DOLLARS_3 9036 2.10 2.69 1.90 97 SUBJ_ALL_CAPS 8966 1.90 1.96 1.88 98 BOTNET 8943 5.83 17.58 1.88 99 T_TooManySym_02 8829 1.53 0.57 1.86 100 TR_Symld_Words 8828 1.69 1.22 1.86 101 XM_OfRef6 8417 1.77 1.77 1.77 102 HELO_NODOT 8262 1.44 0.55 1.74 103 HELO_NO_DOMAIN 8261 1.44 0.55 1.74 104 IN_HORDE_ADDRESS_BOOK 8123 1.29 0.04 1.71 105 URI_HEX 8023 2.18 3.64 1.69 106 TM2_M_URI_OPT_OUT 7963 2.18 3.67 1.67 107 MIME_HTML_ONLY_MULTI 7603 2.21 4.01 1.60 108 XM_DK_Undo_01 7501 1.52 1.37 1.58 109 TR_MetaPhish_Combo_01 7416 1.33 0.65 1.56 110 T_XMDrugObfuBody_08 7328 1.85 2.79 1.54 111 UNTRUSTED_Relay 7304 4.20 12.12 1.53 112 XMCapTrack 7252 1.22 0.32 1.52 113 RELAYCOUNTRY_CA 7223 2.04 3.59 1.52 114 TooManyTo_003 6870 1.24 0.65 1.44 115 DKIM_ADSP_CUSTOM_MED 6302 1.27 1.12 1.32 116 XM_H_Long_From02 6283 1.31 1.29 1.32 117 XMGenDplmaNmb 6177 1.52 2.20 1.30 118 XMStockSpam_06 6076 1.25 1.15 1.28 119 XMPhish11 5905 1.48 2.18 1.24 120 XM_GoogleGroups 5841 1.03 0.45 1.23 121 TR_XM_PHPDW 5719 1.45 2.21 1.20 122 XMSexyCombo_01 5709 1.40 1.98 1.20 123 TM2_M_VERY_LONG_WORD 5582 1.29 1.64 1.17 124 RCVD_IN_BL_SPAMCOP_NET 5495 1.71 3.34 1.15 125 RELAYCOUNTRY_GB 5278 1.11 1.10 1.11 126 URI_TRY_3LD 5273 1.36 2.09 1.11 127 XM_H_PHPMailer 5238 1.14 1.26 1.10 128 TR_XM_PHPForged 5164 1.36 2.19 1.09 129 NML_ADSP_CUSTOM_MED 5079 1.02 0.88 1.07 130 T_FILL_THIS_FORM_SHORT 5025 0.96 0.68 1.06 131 RCVD_IN_MSPIKE_L5 4947 1.94 4.61 1.04 132 TooManyTo_004 4943 0.89 0.46 1.04 133 USER_IN_DEF_DKIM_WL 4941 0.78 0.00 1.04 134 NO_DNS_FOR_FROM 4934 1.21 1.74 1.04 135 XM_UB50 4817 2.20 5.73 1.01 136 XMBdyGiftCard01 4471 1.44 2.93 0.94 137 T_XMDrugObfuBody_00 4139 1.01 1.42 0.87 138 TooManyTo_005 4041 0.73 0.40 0.85 139 XMSubMetaI_00 3830 0.99 1.53 0.80 140 TR_XM_RelayPhish 3827 0.95 1.38 0.80 141 T_OBFU_PDF_ATTACH 3713 0.64 0.24 0.78 142 HTML_TAG_BALANCE_BODY 3578 0.72 0.62 0.75 143 XM_ProductURIs 3495 0.99 1.74 0.73 144 SpammyFromTLD_01 3435 1.00 1.82 0.72 145 RCVD_IN_MSPIKE_L3 3352 0.81 1.10 0.70 146 XMNoVowels 3323 0.77 0.99 0.70 147 FORGED_GMAIL_RCVD 3318 0.77 0.98 0.70 148 TR_XM_FormFill2 3263 1.06 2.17 0.69 149 XM_H_PHPOS 3248 1.05 2.15 0.68 150 T_XMHurry_00 3234 0.85 1.37 0.68 151 FILL_THIS_FORM 3210 0.63 0.50 0.67 152 TM2_M_A_HREF_HREF 3087 0.61 0.49 0.65 153 USER_IN_WHITELIST 3075 0.48 0.00 0.65 154 XMBrknScrpt_02 3065 0.80 1.25 0.64 155 T_Symld_Words_02 3022 0.78 1.21 0.64 156 XMMoneyMeta_00 3020 0.82 1.35 0.63 157 HTTPS_HTTP_MISMATCH 2970 0.90 1.71 0.62 158 XMBody_17 2970 0.85 1.51 0.62 159 DKIM_ADSP_NXDOMAIN 2964 1.48 4.02 0.62 160 RCVD_IN_MSPIKE_L4 2869 0.61 0.62 0.60 161 BODY_QUOTE_MALF_MSGID 2857 0.65 0.79 0.60 162 T_FILL_THIS_FORM_LONG 2845 0.54 0.37 0.60 163 XM_ShortIntro_01 2831 0.52 0.32 0.59 164 FROM_GOV_SPOOF 2755 0.51 0.30 0.58 165 XMGappySubj_01 2636 0.47 0.21 0.55 166 T_FILL_THIS_FORM_LOAN 2634 0.43 0.05 0.55 167 XMSlimDrugH 2560 0.64 0.94 0.54 168 XMSexyCombo_04 2548 0.61 0.81 0.54 169 HTML_FONT_FACE_BAD 2526 0.66 1.03 0.53 170 RELAYCOUNTRY_AU 2501 0.55 0.64 0.53 171 T_TooManySym_03 2481 0.43 0.17 0.52 172 XMBody_95 2470 0.42 0.12 0.52 173 SHORT_HELO_AND_INLINE_IMAGE 2404 0.39 0.04 0.51 174 TM2_M_BODY_EMPTY 2372 0.40 0.09 0.50 175 XMLngstWrd_00 2316 0.43 0.28 0.49 176 RELAYCOUNTRY_DE 2272 0.72 1.43 0.48 177 XM_B_COPY_HTML 2249 0.51 0.64 0.47 178 XM_B_REG_HTML 2240 0.54 0.74 0.47 179 XM_D_tchamptons_WL 2231 0.35 0.00 0.47 180 XMBody_78 2209 1.00 2.59 0.46 181 XMLngstWrd_01 2138 0.40 0.24 0.45 182 XMHTMLBadTable_001 2118 0.60 1.08 0.45 183 MISSING_HEADERS 2117 0.57 0.95 0.44 184 XMPhish30 2030 0.57 1.00 0.43 185 RDNS_DYNAMIC 2020 0.53 0.86 0.42 186 XMHTML_After_End 2012 0.59 1.09 0.42 187 URI_NOVOWEL 2008 0.55 0.92 0.42 188 PLING_QUERY 1955 0.54 0.94 0.41 189 HTML_IMAGE_ONLY_28 1938 0.45 0.57 0.41 190 NUMERIC_HTTP_ADDR 1933 0.41 0.41 0.41 191 XM_URI_RBL 1932 1.06 3.01 0.41 192 TR_LOTS_OF_MONEY3 1928 0.51 0.81 0.41 193 SUBJ_DOLLARS 1906 0.46 0.63 0.40 194 RCVD_IN_SORBS_DUL 1905 0.34 0.17 0.40 195 XM_Body_Obfu01 1879 0.43 0.55 0.39 196 FROM_GOV_DKIM_AU 1873 0.33 0.16 0.39 197 XMDateMe_00 1812 0.40 0.46 0.38 198 XMSubMetaSxObfu_02 1746 0.37 0.37 0.37 199 HTML_IMAGE_ONLY_32 1724 0.71 1.76 0.36 200 HTML_IMAGE_ONLY_24 1704 0.49 0.87 0.36 ----------------------------------------------------------------------