Email: 355858 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 2.38 sec Spam: 103840 Autolearn: 0 AvgScore: 13.53 AvgScanTime: 3.47 sec Ham: 252018 Autolearn: 0 AvgScore: -1.20 AvgScanTime: 1.93 sec Time Spent Running SA: 234.83 hours Time Spent Processing Spam: 100.04 hours Time Spent Processing Ham: 134.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96762 87.10 93.18 84.59 2 DCC_CHECK 81662 57.26 78.64 48.44 3 XM_B_Unicode 77647 71.81 74.78 70.58 4 DKIM_SIGNED 76950 78.26 74.10 79.97 5 XM_DK_Pass 73344 76.23 70.63 78.54 6 XMListUnsubscribeExists 72459 60.90 69.78 57.25 7 DKIM_VALID 71848 74.47 69.19 76.64 8 DKIM_VALID_AU 55362 57.73 53.31 59.54 9 XM_DK_Undo_02 47890 26.45 46.12 18.34 10 BAYES_99 42470 23.33 40.90 16.08 11 HTML_FONT_LOW_CONTRAST 37299 33.85 35.92 33.00 12 MIME_HTML_ONLY 36576 26.47 35.22 22.87 13 BAYES_999 35699 20.15 34.38 14.28 14 BAYES_50 35223 44.75 33.92 49.21 15 TR_DCC_Bayes_99 33718 14.71 32.47 7.39 16 LOC_TINY_FONT_1 33182 28.90 31.95 27.64 17 XM_Body_Dirty_Words 28379 18.79 27.33 15.27 18 FVGT_m_MULTI_ODD 27519 23.35 26.50 22.05 19 RELAYCOUNTRY_META 25979 10.27 25.02 4.20 20 BOTNET 22754 7.98 21.91 2.24 21 XMSubLong 21606 22.13 20.81 22.68 22 DCC_CHECK_NEGATIVE 20180 41.37 19.43 50.41 23 T_KAM_HTML_FONT_INVALID 19812 16.84 19.08 15.92 24 MultiRelay 19080 16.87 18.37 16.25 25 DKIM_VALID_EF 18167 26.85 17.50 30.70 26 XM_Multi_Part_URI 17851 15.99 17.19 15.49 27 UNTRUSTED_Relay 17404 5.83 16.76 1.33 28 T_TM2_M_HEADER_IN_MSG 17346 22.10 16.70 24.32 29 HTML_IMAGE_RATIO_02 16057 11.43 15.46 9.77 30 LOTS_OF_MONEY 15046 12.57 14.49 11.78 31 BOTNET_IPINHOSTNAME 14372 8.71 13.84 6.59 32 XMSexyCombo_05 13058 6.94 12.58 4.62 33 XM_Evil_Numbers_Gen 11329 10.04 10.91 9.68 34 XM_DIRTYINTL 10620 5.19 10.23 3.11 35 XM_UncommonTLD01 10180 6.92 9.80 5.73 36 RCVD_IN_PSBL 9941 2.87 9.57 0.10 37 BAYES_60 9899 7.32 9.53 6.40 38 FSL_BULK_SIG 9618 9.54 9.26 9.65 39 HTML_IMAGE_RATIO_04 9529 7.96 9.18 7.46 40 XMSubMetaSx_00 8839 5.43 8.51 4.16 41 BAYES_80 8726 5.57 8.40 4.41 42 XM_UB50 8325 2.88 8.02 0.77 43 NUMERIC_HTTP_ADDR 7895 2.45 7.60 0.33 44 XMBdyGiftCard01 7860 3.76 7.57 2.18 45 DKIM_ADSP_NXDOMAIN 7825 2.70 7.54 0.71 46 NORMAL_HTTP_TO_IP 7552 2.14 7.27 0.03 47 THIS_AD 7328 2.14 7.06 0.11 48 MPART_ALT_DIFF 7295 4.69 7.03 3.73 49 RCVD_IN_BL_SPAMCOP_NET 7125 3.02 6.86 1.43 50 T_XMDrugObfuBody_14 7039 7.82 6.78 8.25 51 MIME_HEADER_CTYPE_ONLY 6922 2.07 6.67 0.17 52 RCVD_IN_MSPIKE_H2 6661 7.72 6.41 8.25 53 RELAYCOUNTRY_IN 6514 1.87 6.27 0.05 54 XM_H_Long_From01 6485 6.71 6.25 6.90 55 LotsOfNums_01 6390 7.06 6.15 7.43 56 TooManyTo_001 6286 6.08 6.05 6.10 57 RCVD_IN_MSPIKE_BL 5956 3.09 5.74 2.00 58 XMStrtUSub 5513 5.23 5.31 5.20 59 T_REMOTE_IMAGE 5329 4.43 5.13 4.13 60 FROM_EXCESS_BASE64 5199 4.85 5.01 4.79 61 DKIM_INVALID 5102 3.79 4.91 3.33 62 HTML_IMAGE_ONLY_24 4907 1.58 4.73 0.28 63 XM_B_Phish_Phrases 4803 6.06 4.63 6.65 64 RCVD_IN_RP_SAFE 4795 12.20 4.62 15.33 65 XMSubGiftCard1 4643 1.43 4.47 0.18 66 URI_HEX 4613 3.02 4.44 2.44 67 XM_SPF_SoftFail 4598 2.31 4.43 1.43 68 XMSexyCombo_01 4589 1.64 4.42 0.49 69 RCVD_IN_MSPIKE_L5 4584 1.96 4.41 0.95 70 SpammyFromTLD_02 4510 1.39 4.34 0.17 71 EXCUSE_4 4331 1.22 4.17 0.01 72 MIME_HTML_MOSTLY 4313 3.04 4.15 2.59 73 MIME_HTML_ONLY_MULTI 4280 2.48 4.12 1.81 74 XM_ProductURIs 4253 2.07 4.10 1.23 75 XMSubGiftCard2 4228 1.27 4.07 0.12 76 MIME_QP_LONG_LINE 4005 4.25 3.86 4.42 77 RCVD_IN_RP_CERTIFIED 3991 10.83 3.84 13.71 78 MultiRelay_CC 3960 1.22 3.81 0.15 79 MultiRelay_Combo 3960 1.22 3.81 0.15 80 RELAYCOUNTRY_CA 3906 2.22 3.76 1.59 81 XM_SendGrid 3848 6.27 3.71 7.33 82 HTML_IMAGE_RATIO_06 3724 3.31 3.59 3.20 83 BASE64_LENGTH_79_INF 3683 1.23 3.55 0.27 84 XM_UB60 3636 1.07 3.50 0.07 85 US_DOLLARS_3 3631 4.06 3.50 4.29 86 XM_B_SpammyTLD 3623 4.37 3.49 4.74 87 BAYES_95 3619 3.24 3.49 3.14 88 XM_OfRef6 3618 2.27 3.48 1.77 89 RELAYCOUNTRY_FR 3540 1.18 3.41 0.26 90 HTML_IMAGE_RATIO_08 3462 2.35 3.33 1.94 91 TR_Symld_Words 3425 2.40 3.30 2.03 92 BOTNET_NORDNS 3390 0.96 3.26 0.01 93 ALL_TRUSTED 3350 11.75 3.23 15.26 94 XMPhish11 3160 1.59 3.04 0.99 95 SUBJ_DOLLARS 3094 1.67 2.98 1.13 96 SUBJ_ALL_CAPS 2953 2.57 2.84 2.45 97 NO_DNS_FOR_FROM 2922 1.67 2.81 1.20 98 XM_CamelCaseFrm001 2920 2.34 2.81 2.15 99 HTML_MIME_NO_HTML_TAG 2810 2.33 2.71 2.18 100 XMDiploma_00 2733 1.73 2.63 1.36 101 NORDNS_LOW_CONTRAST 2668 0.76 2.57 0.02 102 RELAYCOUNTRY_JP 2666 0.76 2.57 0.01 103 TR_Mismatch_TLD_02 2628 0.79 2.53 0.07 104 TR_XM_PHPDW 2594 1.24 2.50 0.72 105 T_TooManySym_01 2591 6.03 2.50 7.49 106 TR_XM_PHPForged 2570 1.22 2.47 0.70 107 TR_XM_FormFill2 2547 1.15 2.45 0.61 108 XM_H_PHPOS 2535 1.14 2.44 0.61 109 TM2_M_URI_OPT_OUT 2532 1.63 2.44 1.30 110 XMNumbers 2496 2.90 2.40 3.11 111 XM_URI_RBL 2393 0.98 2.30 0.43 112 FILL_THIS_FORM 2304 1.16 2.22 0.72 113 HDRS_LCASE_IMGONLY 2248 0.65 2.16 0.03 114 HELO_NO_DOMAIN 2204 1.02 2.12 0.56 115 HELO_NODOT 2204 1.02 2.12 0.56 116 TM2_M_VERY_LONG_WORD 2141 1.60 2.06 1.40 117 XM_OfRef7 2106 0.72 2.03 0.18 118 RCVD_IN_IADB_LISTED 2081 4.15 2.00 5.04 119 FSL_HELO_NON_FQDN_1 2061 0.58 1.98 0.00 120 XMSubMetaI_00 2055 1.30 1.98 1.02 121 T_FILL_THIS_FORM_LONG 2045 1.02 1.97 0.63 122 MONEY_FORM 2034 0.58 1.96 0.01 123 HOSTED_IMG_MULTI 2033 0.57 1.96 0.00 124 XMWinner 1988 0.62 1.91 0.08 125 XM_UB99 1984 0.57 1.91 0.01 126 MONEY_FRAUD_5 1978 0.56 1.90 0.00 127 TR_XM_DK_SendGrid 1964 3.35 1.89 3.95 128 FROM_SUSPICIOUS_NTLD 1963 0.57 1.89 0.03 129 ADVANCE_FEE_5_NEW_FRM_MNY 1953 0.55 1.88 0.00 130 FROM_SUSPICIOUS_NTLD_FP 1946 0.57 1.87 0.03 131 EBAY_IMG_NOT_RCVD_EBAY 1943 0.55 1.87 0.00 132 SpammyFromTLD_01 1930 0.99 1.86 0.63 133 RCVD_IN_MSPIKE_WL 1910 5.54 1.84 7.07 134 KHOP_HELO_FCRDNS 1904 1.71 1.83 1.65 135 MONEY_ATM_CARD 1858 0.52 1.79 0.00 136 XM_OfRef8 1855 0.53 1.79 0.01 137 URI_TRY_3LD 1850 1.64 1.78 1.58 138 T_FILL_THIS_FORM_LOAN 1845 0.95 1.78 0.62 139 RELAYCOUNTRY_MY 1825 0.52 1.76 0.01 140 URI_WPADMIN 1802 0.52 1.74 0.02 141 RELAYCOUNTRY_BJ 1802 0.51 1.74 0.00 142 XMGenDplmaNmb 1781 0.95 1.72 0.63 143 HOSTED_IMG_DIRECT_MX 1774 0.50 1.71 0.00 144 DIET_1 1766 1.01 1.70 0.72 145 RCVD_IN_RP_RNBL 1735 0.53 1.67 0.06 146 ALIBABA_IMG_NOT_RCVD_ALI 1734 0.49 1.67 0.00 147 LOW_PRICE 1727 0.62 1.66 0.19 148 RCVD_IN_MSPIKE_H3 1722 4.98 1.66 6.34 149 RCVD_IN_IADB_SPF 1706 3.50 1.64 4.26 150 XM_B_REG_HTML 1668 0.81 1.61 0.49 151 XM_UB80 1665 0.48 1.60 0.02 152 T_XMDrugObfuBody_08 1629 1.19 1.57 1.04 153 XM_H_PHPMailer 1607 0.95 1.55 0.70 154 DATE_IN_PAST_06_12 1605 0.49 1.55 0.06 155 RCVD_IN_IADB_SENDERID 1592 3.04 1.53 3.66 156 RCVD_IN_IADB_DK 1574 2.94 1.52 3.52 157 XM_UB999 1549 0.44 1.49 0.01 158 XMBody_17 1549 0.87 1.49 0.62 159 MISSING_HEADERS 1538 0.60 1.48 0.23 160 RELAYCOUNTRY_SG 1529 0.46 1.47 0.04 161 PDS_TO_EQ_FROM_NAME 1507 0.45 1.45 0.04 162 SHORT_URI_3 1500 0.45 1.44 0.04 163 XMBody_78 1488 0.74 1.43 0.45 164 T_XMDrugObfuBody_00 1477 1.09 1.42 0.95 165 XMBrknScrpt_02 1472 1.01 1.42 0.84 166 XM_H_Long_From02 1458 1.14 1.40 1.03 167 HK_RANDOM_FROM 1446 0.49 1.39 0.12 168 XMHTMLBadTable_001 1409 0.82 1.36 0.60 169 BAYES_40 1398 3.04 1.35 3.73 170 XMSexyCombo_04 1398 0.46 1.35 0.10 171 REPLYTO_WITHOUT_TO_CC 1386 0.47 1.33 0.12 172 URIBL_BLACK 1378 0.44 1.33 0.07 173 T_Symld_Words_02 1367 0.82 1.32 0.62 174 XM_H_PHPOS_M 1353 0.56 1.30 0.26 175 XMStockSpam_06 1353 1.07 1.30 0.97 176 BODY_ENHANCEMENT 1344 0.43 1.29 0.07 177 DKIM_ADSP_CUSTOM_MED 1318 0.89 1.27 0.74 178 MAILING_LIST_MULTI 1315 1.68 1.27 1.85 179 RELAYCOUNTRY_AT 1262 0.52 1.22 0.24 180 XMHTML_After_End 1261 0.59 1.21 0.33 181 URIBL_CSS 1241 0.70 1.20 0.49 182 URIBL_CSS_A 1241 0.70 1.20 0.49 183 NML_ADSP_CUSTOM_MED 1230 0.74 1.18 0.56 184 XMPhish30 1192 0.79 1.15 0.65 185 T_XMHurry_00 1186 0.87 1.14 0.76 186 TR_XM_RelayPhish 1145 1.12 1.10 1.13 187 RELAYCOUNTRY_FI 1132 0.33 1.09 0.01 188 URIBL_DBL_ABUSE_REDIR 1108 0.32 1.07 0.02 189 RDNS_DYNAMIC 1098 0.74 1.06 0.61 190 RCVD_IN_IADB_VOUCHED 1074 2.87 1.03 3.62 191 BODY_QUOTE_MALF_MSGID 1024 0.67 0.99 0.54 192 TR_LOTS_OF_MONEY3 985 0.50 0.95 0.32 193 XMSlimDrugH 976 0.63 0.94 0.51 194 BAYES_20 968 2.20 0.93 2.72 195 XMSubMetaSSx_00 939 0.39 0.90 0.18 196 XM_RXBody 929 0.52 0.89 0.37 197 DATE_IN_PAST_03_06 926 0.31 0.89 0.07 198 TR_LOTS_OF_MONEY2 917 0.54 0.88 0.40 199 T_MONEY_PERCENT 917 0.54 0.88 0.40 200 SHORT_URI_4 908 0.26 0.87 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 213180 87.10 93.18 84.59 2 DKIM_SIGNED 201547 78.26 74.10 79.97 3 XM_DK_Pass 197930 76.23 70.63 78.54 4 DKIM_VALID 193145 74.47 69.19 76.64 5 XM_B_Unicode 177883 71.81 74.78 70.58 6 DKIM_VALID_AU 150059 57.73 53.31 59.54 7 XMListUnsubscribeExists 144269 60.90 69.78 57.25 8 DCC_CHECK_NEGATIVE 127042 41.37 19.43 50.41 9 BAYES_50 124012 44.75 33.92 49.21 10 DCC_CHECK 122086 57.26 78.64 48.44 11 HTML_FONT_LOW_CONTRAST 83171 33.85 35.92 33.00 12 DKIM_VALID_EF 77381 26.85 17.50 30.70 13 LOC_TINY_FONT_1 69653 28.90 31.95 27.64 14 T_TM2_M_HEADER_IN_MSG 61290 22.10 16.70 24.32 15 MIME_HTML_ONLY 57627 26.47 35.22 22.87 16 XMSubLong 57147 22.13 20.81 22.68 17 FVGT_m_MULTI_ODD 55581 23.35 26.50 22.05 18 XM_DK_Undo_02 46220 26.45 46.12 18.34 19 MultiRelay 40944 16.87 18.37 16.25 20 BAYES_99 40534 23.33 40.90 16.08 21 T_KAM_HTML_FONT_INVALID 40132 16.84 19.08 15.92 22 XM_Multi_Part_URI 39044 15.99 17.19 15.49 23 RCVD_IN_RP_SAFE 38626 12.20 4.62 15.33 24 XM_Body_Dirty_Words 38490 18.79 27.33 15.27 25 ALL_TRUSTED 38451 11.75 3.23 15.26 26 BAYES_999 35998 20.15 34.38 14.28 27 RCVD_IN_RP_CERTIFIED 34544 10.83 3.84 13.71 28 BAYES_00 30597 8.80 0.70 12.14 29 LOTS_OF_MONEY 29680 12.57 14.49 11.78 30 XM_DKIMWhitelistDomains 29165 8.21 0.04 11.57 31 TR_XM_DK_Bayes 26763 7.64 0.41 10.62 32 TR_XM_DK_Bayes1 26237 7.49 0.41 10.41 33 TO_MALFORMED 24739 6.98 0.10 9.82 34 HTML_IMAGE_RATIO_02 24617 11.43 15.46 9.77 35 XM_Evil_Numbers_Gen 24406 10.04 10.91 9.68 36 FSL_BULK_SIG 24330 9.54 9.26 9.65 37 TR_XM_DK_Bayes2 22759 6.50 0.34 9.03 38 RCVD_IN_MSPIKE_H2 20794 7.72 6.41 8.25 39 T_XMDrugObfuBody_14 20784 7.82 6.78 8.25 40 T_TooManySym_01 18872 6.03 2.50 7.49 41 HTML_IMAGE_RATIO_04 18793 7.96 9.18 7.46 42 LotsOfNums_01 18733 7.06 6.15 7.43 43 TR_DCC_Bayes_99 18621 14.71 32.47 7.39 44 XM_SendGrid 18468 6.27 3.71 7.33 45 RCVD_IN_MSPIKE_WL 17806 5.54 1.84 7.07 46 XM_H_Long_From01 17382 6.71 6.25 6.90 47 XM_B_Phish_Phrases 16749 6.06 4.63 6.65 48 BOTNET_IPINHOSTNAME 16614 8.71 13.84 6.59 49 BAYES_60 16136 7.32 9.53 6.40 50 RCVD_IN_MSPIKE_H3 15982 4.98 1.66 6.34 51 TooManyTo_001 15363 6.08 6.05 6.10 52 XM_UncommonTLD01 14438 6.92 9.80 5.73 53 XMStrtUSub 13103 5.23 5.31 5.20 54 RCVD_IN_IADB_LISTED 12701 4.15 2.00 5.04 55 FROM_EXCESS_BASE64 12061 4.85 5.01 4.79 56 XM_B_SpammyTLD 11940 4.37 3.49 4.74 57 XMSexyCombo_05 11638 6.94 12.58 4.62 58 MIME_QP_LONG_LINE 11135 4.25 3.86 4.42 59 BAYES_80 11109 5.57 8.40 4.41 60 UNPARSEABLE_RELAY 11025 3.35 0.86 4.37 61 INVALID_MSGID 10840 3.08 0.13 4.30 62 US_DOLLARS_3 10812 4.06 3.50 4.29 63 RCVD_IN_IADB_SPF 10743 3.50 1.64 4.26 64 TVD_RCVD_IP 10615 3.18 0.69 4.21 65 RELAYCOUNTRY_META 10574 10.27 25.02 4.20 66 XMSubMetaSx_00 10486 5.43 8.51 4.16 67 T_REMOTE_IMAGE 10419 4.43 5.13 4.13 68 TR_XM_DK_SendGrid 9966 3.35 1.89 3.95 69 IN_ZIMBRA_NJ_WHITELIST 9635 2.71 0.01 3.82 70 MPART_ALT_DIFF 9410 4.69 7.03 3.73 71 BAYES_40 9409 3.04 1.35 3.73 72 RCVD_IN_IADB_SENDERID 9214 3.04 1.53 3.66 73 RCVD_IN_IADB_VOUCHED 9123 2.87 1.03 3.62 74 RCVD_IN_IADB_DK 8873 2.94 1.52 3.52 75 DKIM_INVALID 8402 3.79 4.91 3.33 76 HTML_IMAGE_RATIO_06 8056 3.31 3.59 3.20 77 BAYES_95 7907 3.24 3.49 3.14 78 XM_DIRTYINTL 7849 5.19 10.23 3.11 79 XMNumbers 7831 2.90 2.40 3.11 80 BAYES_20 6858 2.20 0.93 2.72 81 XM_PDF 6706 1.95 0.23 2.66 82 MIME_HTML_MOSTLY 6520 3.04 4.15 2.59 83 SUBJ_ALL_CAPS 6179 2.57 2.84 2.45 84 URI_HEX 6143 3.02 4.44 2.44 85 TR_MetaPhish_Combo_01 6123 1.87 0.52 2.43 86 RCVD_IN_IADB_OPTIN 6059 1.88 0.59 2.40 87 T_TooManySym_02 5698 1.79 0.64 2.26 88 BOTNET 5635 7.98 21.91 2.24 89 XMBdyGiftCard01 5503 3.76 7.57 2.18 90 HTML_MIME_NO_HTML_TAG 5486 2.33 2.71 2.18 91 XM_CamelCaseFrm001 5421 2.34 2.81 2.15 92 TR_Symld_Words 5104 2.40 3.30 2.03 93 RCVD_IN_MSPIKE_BL 5040 3.09 5.74 2.00 94 HTML_IMAGE_RATIO_08 4887 2.35 3.33 1.94 95 IN_HORDE_ADDRESS_BOOK 4753 1.35 0.03 1.89 96 USER_IN_DEF_DKIM_WL 4703 1.33 0.02 1.87 97 MAILING_LIST_MULTI 4656 1.68 1.27 1.85 98 BAYES_05 4606 1.45 0.55 1.83 99 MIME_HTML_ONLY_MULTI 4563 2.48 4.12 1.81 100 XM_OfRef6 4464 2.27 3.48 1.77 101 KHOP_HELO_FCRDNS 4167 1.71 1.83 1.65 102 RELAYCOUNTRY_CA 3998 2.22 3.76 1.59 103 URI_TRY_3LD 3988 1.64 1.78 1.58 104 XM_DK_Undo_01 3694 1.26 0.76 1.47 105 XM_SPF_SoftFail 3615 2.31 4.43 1.43 106 RCVD_IN_BL_SPAMCOP_NET 3609 3.02 6.86 1.43 107 TM2_M_VERY_LONG_WORD 3536 1.60 2.06 1.40 108 XMDiploma_00 3415 1.73 2.63 1.36 109 T_FILL_THIS_FORM_SHORT 3373 1.10 0.53 1.34 110 ANY_BOUNCE_MESSAGE 3347 1.02 0.29 1.33 111 BOUNCE_MESSAGE 3346 1.02 0.29 1.33 112 UNTRUSTED_Relay 3340 5.83 16.76 1.33 113 TM2_M_URI_OPT_OUT 3271 1.63 2.44 1.30 114 XM_GoogleGroups 3173 1.02 0.44 1.26 115 TM2_M_A_HREF_HREF 3158 1.07 0.63 1.25 116 XM_ProductURIs 3099 2.07 4.10 1.23 117 NO_DNS_FOR_FROM 3020 1.67 2.81 1.20 118 TooManyTo_002 3009 1.09 0.85 1.19 119 TR_XM_RelayPhish 2855 1.12 1.10 1.13 120 SUBJ_DOLLARS 2838 1.67 2.98 1.13 121 T_XMDrugObfuBody_08 2615 1.19 1.57 1.04 122 XM_H_Long_From02 2586 1.14 1.40 1.03 123 XMSubMetaI_00 2575 1.30 1.98 1.02 124 XM_D_tchamptons_WL 2519 0.71 0.00 1.00 125 XMPhish11 2486 1.59 3.04 0.99 126 XMStockSpam_06 2438 1.07 1.30 0.97 127 T_XMDrugObfuBody_00 2392 1.09 1.42 0.95 128 RCVD_IN_MSPIKE_L5 2382 1.96 4.41 0.95 129 XMBody_95 2298 0.66 0.06 0.91 130 USER_IN_WHITELIST 2201 0.62 0.00 0.87 131 XMBrknScrpt_02 2119 1.01 1.42 0.84 132 TooManyTo_003 2068 0.79 0.73 0.82 133 HTML_TAG_BALANCE_BODY 2047 0.72 0.49 0.81 134 T_TooManySym_03 1958 0.58 0.10 0.78 135 PLING_QUERY 1937 0.65 0.37 0.77 136 XM_UB50 1929 2.88 8.02 0.77 137 T_XMHurry_00 1915 0.87 1.14 0.76 138 DKIM_ADSP_CUSTOM_MED 1860 0.89 1.27 0.74 139 TR_XM_PHPDW 1823 1.24 2.50 0.72 140 DIET_1 1823 1.01 1.70 0.72 141 FILL_THIS_FORM 1822 1.16 2.22 0.72 142 DKIM_ADSP_NXDOMAIN 1798 2.70 7.54 0.71 143 XM_H_PHPMailer 1769 0.95 1.55 0.70 144 TR_XM_PHPForged 1764 1.22 2.47 0.70 145 XM_B_COPY_HTML 1745 0.71 0.75 0.69 146 XMSubMetaSxObfu_02 1679 0.53 0.21 0.67 147 XMPhish30 1630 0.79 1.15 0.65 148 TooManyTo_004 1617 0.63 0.60 0.64 149 XMGenDplmaNmb 1592 0.95 1.72 0.63 150 SpammyFromTLD_01 1592 0.99 1.86 0.63 151 T_FILL_THIS_FORM_LONG 1583 1.02 1.97 0.63 152 T_Symld_Words_02 1557 0.82 1.32 0.62 153 XMBody_17 1554 0.87 1.49 0.62 154 T_FILL_THIS_FORM_LOAN 1551 0.95 1.78 0.62 155 TR_XM_FormFill2 1536 1.15 2.45 0.61 156 XM_H_PHPOS 1530 1.14 2.44 0.61 157 RDNS_DYNAMIC 1528 0.74 1.06 0.61 158 XMHTMLBadTable_001 1518 0.82 1.36 0.60 159 XMGappySubj_01 1439 0.52 0.39 0.57 160 HELO_NODOT 1420 1.02 2.12 0.56 161 HELO_NO_DOMAIN 1419 1.02 2.12 0.56 162 NML_ADSP_CUSTOM_MED 1407 0.74 1.18 0.56 163 HTML_FONT_FACE_BAD 1396 0.60 0.72 0.55 164 TooManyTo_005 1393 0.54 0.51 0.55 165 BODY_QUOTE_MALF_MSGID 1373 0.67 0.99 0.54 166 RCVD_IN_MSPIKE_L4 1364 0.63 0.84 0.54 167 XM_shorewaves_Whitelist 1295 0.36 0.00 0.51 168 RCVD_IN_MSPIKE_L3 1294 0.51 0.49 0.51 169 XMSlimDrugH 1273 0.63 0.94 0.51 170 XMSexyCombo_01 1246 1.64 4.42 0.49 171 URIBL_CSS_A 1237 0.70 1.20 0.49 172 URIBL_CSS 1237 0.70 1.20 0.49 173 RCVD_IN_MSPIKE_H5 1230 0.39 0.14 0.49 174 XM_B_REG_HTML 1227 0.81 1.61 0.49 175 RELAYCOUNTRY_GB 1220 0.54 0.67 0.48 176 URI_NOVOWEL 1155 0.55 0.76 0.46 177 XMBody_78 1146 0.74 1.43 0.45 178 HTTPS_HTTP_MISMATCH 1140 0.41 0.32 0.45 179 XMCapTrack 1127 0.37 0.18 0.45 180 RELAYCOUNTRY_AU 1110 0.43 0.41 0.44 181 XM_URI_RBL 1092 0.98 2.30 0.43 182 TR_Caps_n_Bayes_99 1021 0.51 0.76 0.41 183 XMGappySubj_02 1014 0.32 0.12 0.40 184 TR_LOTS_OF_MONEY2 998 0.54 0.88 0.40 185 T_MONEY_PERCENT 998 0.54 0.88 0.40 186 FORGED_GMAIL_RCVD 964 0.50 0.79 0.38 187 XMBSHREFv2 961 0.35 0.29 0.38 188 XM_RXBody 935 0.52 0.89 0.37 189 XMNoVowels 925 0.32 0.19 0.37 190 XMRcvdHeader_15 912 0.26 0.00 0.36 191 XM_Body_Obfu01 891 0.34 0.32 0.35 192 TM2_M_BODY_EMPTY 884 0.26 0.05 0.35 193 REMOVE_BEFORE_LINK 881 0.43 0.61 0.35 194 XM_ShortIntro_01 855 0.32 0.29 0.34 195 GAPPY_SUBJECT 855 0.27 0.11 0.34 196 XMPhish14 847 0.39 0.52 0.34 197 XMLngstWrd_00 842 0.33 0.32 0.33 198 XM_Akamai 828 0.25 0.06 0.33 199 NUMERIC_HTTP_ADDR 827 2.45 7.60 0.33 200 XMHTML_After_End 822 0.59 1.21 0.33 ----------------------------------------------------------------------