Email: 638428 Autolearn: 0 AvgScore: 1.44 AvgScanTime: 2.12 sec Spam: 106024 Autolearn: 0 AvgScore: 13.18 AvgScanTime: 2.77 sec Ham: 532404 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.99 sec Time Spent Running SA: 376.28 hours Time Spent Processing Spam: 81.64 hours Time Spent Processing Ham: 294.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 94490 87.78 89.12 87.51 2 DCC_CHECK 80758 51.04 76.17 46.03 3 DKIM_SIGNED 73368 76.87 69.20 78.40 4 XM_B_Unicode 72940 70.67 68.80 71.05 5 XMListUnsubscribeExists 70139 57.24 66.15 55.46 6 XM_DK_Pass 70052 75.33 66.07 77.17 7 DKIM_VALID 67106 72.40 63.29 74.21 8 BAYES_50 59923 50.92 56.52 49.80 9 DKIM_VALID_AU 49856 53.03 47.02 54.22 10 XM_B_Unicode3 48158 43.32 45.42 42.90 11 MIME_HTML_ONLY 37797 23.28 35.65 20.82 12 HTML_FONT_LOW_CONTRAST 34942 31.92 32.96 31.71 13 LOC_TINY_FONT_1 34342 25.69 32.39 24.36 14 RELAYCOUNTRY_META 34153 10.15 32.21 5.76 15 XM_DK_Undo_02 29067 8.77 27.42 5.05 16 XMSubLong 27464 23.76 25.90 23.33 17 BOTNET 27154 6.20 25.61 2.34 18 XM_Body_Dirty_Words 25667 16.49 24.21 14.96 19 MultiRelay 25130 19.68 23.70 18.88 20 FVGT_m_MULTI_ODD 24423 23.82 23.04 23.98 21 DKIM_VALID_EF 23295 26.94 21.97 27.93 22 DCC_CHECK_NEGATIVE 23074 46.88 21.76 51.88 23 BOTNET_IPINHOSTNAME 22040 7.99 20.79 5.44 24 T_TM2_M_HEADER_IN_MSG 21526 28.05 20.30 29.59 25 T_KAM_HTML_FONT_INVALID 20681 19.45 19.51 19.44 26 UNTRUSTED_Relay 19795 4.65 18.67 1.86 27 BAYES_99 17646 4.64 16.64 2.25 28 XM_Multi_Part_URI 17246 13.43 16.27 12.87 29 FSL_BULK_SIG 16978 8.95 16.01 7.55 30 XM_UncommonTLD01 15301 5.07 14.43 3.20 31 XMSexyCombo_05 14954 6.28 14.10 4.72 32 TR_DCC_Bayes_99 14162 3.34 13.36 1.35 33 LOTS_OF_MONEY 14081 9.94 13.28 9.28 34 HTML_IMAGE_RATIO_02 13804 10.00 13.02 9.40 35 BAYES_999 13755 3.65 12.97 1.80 36 XM_SPF_SoftFail 12530 3.62 11.82 1.99 37 XM_Evil_Numbers_Gen 12105 9.52 11.42 9.14 38 XM_H_Long_From01 11693 7.14 11.03 6.37 39 XM_UB50 11273 2.53 10.63 0.91 40 XM_DIRTYINTL 11003 4.46 10.38 3.28 41 T_XMDrugObfuBody_14 10566 8.83 9.97 8.60 42 TooManyTo_001 10251 8.78 9.67 8.61 43 T_REMOTE_IMAGE 9949 4.79 9.38 3.88 44 XMSubMetaSx_00 9254 5.93 8.73 5.37 45 LotsOfNums_01 9102 8.53 8.58 8.52 46 MPART_ALT_DIFF 8852 4.40 8.35 3.62 47 RCVD_IN_BL_SPAMCOP_NET 8288 2.01 7.82 0.85 48 RCVD_IN_RP_RNBL 7784 1.29 7.34 0.09 49 RCVD_IN_MSPIKE_H2 7658 7.69 7.22 7.79 50 XM_B_Phish_Phrases 7652 6.86 7.22 6.79 51 FROM_SUSPICIOUS_NTLD 7094 1.15 6.69 0.04 52 HTML_MIME_NO_HTML_TAG 7053 2.76 6.65 1.98 53 FROM_SUSPICIOUS_NTLD_FP 7039 1.13 6.64 0.04 54 HTML_IMAGE_RATIO_04 6839 6.24 6.45 6.20 55 BOTNET_NORDNS 6699 1.09 6.32 0.05 56 DKIM_INVALID 6262 4.48 5.91 4.19 57 FROM_EXCESS_BASE64 5840 3.66 5.51 3.29 58 XM_B_SpammyTLD 5830 3.65 5.50 3.28 59 HELO_NO_DOMAIN 5675 2.16 5.35 1.52 60 HELO_NODOT 5675 2.16 5.35 1.52 61 DKIM_ADSP_CUSTOM_MED 5544 1.73 5.23 1.03 62 KHOP_HELO_FCRDNS 5539 2.53 5.22 2.00 63 FSL_HELO_NON_FQDN_1 5452 0.86 5.14 0.01 64 MIME_QP_LONG_LINE 5382 5.88 5.08 6.04 65 FORGED_GMAIL_RCVD 5343 1.27 5.04 0.52 66 NML_ADSP_CUSTOM_MED 5315 1.42 5.01 0.70 67 BAYES_40 5274 6.56 4.97 6.87 68 RELAYCOUNTRY_FR 5043 1.09 4.76 0.36 69 SpammyFromTLD_02 4922 1.29 4.64 0.62 70 XMNumbers 4918 3.66 4.64 3.47 71 RELAYCOUNTRY_KR 4735 0.77 4.47 0.03 72 MIME_HTML_ONLY_MULTI 4681 2.42 4.42 2.03 73 BAYES_20 4654 5.21 4.39 5.37 74 BAYES_80 4653 2.09 4.39 1.63 75 BAYES_00 4593 22.51 4.33 26.13 76 BODY_URI_ONLY 4521 0.77 4.26 0.08 77 XMStrtUSub 4479 4.99 4.22 5.14 78 MIME_HTML_MOSTLY 4350 2.62 4.10 2.33 79 XM_URI_RBL 4268 0.97 4.03 0.36 80 RELAYCOUNTRY_CA 4267 2.13 4.02 1.75 81 HDRS_LCASE_IMGONLY 4247 0.71 4.01 0.06 82 ADVANCE_FEE_3_NEW 4115 0.65 3.88 0.00 83 HTML_SHORT_LINK_IMG_1 4094 0.67 3.86 0.03 84 RCVD_IN_PSBL 4088 0.68 3.86 0.05 85 TM2_M_URI_OPT_OUT 3995 2.80 3.77 2.61 86 SUBJ_ALL_CAPS 3987 2.22 3.76 1.91 87 BAYES_60 3982 3.38 3.76 3.31 88 HTML_IMAGE_RATIO_06 3962 4.51 3.74 4.67 89 MultiRelay_CC 3950 0.85 3.73 0.27 90 MultiRelay_Combo 3950 0.85 3.73 0.27 91 URG_BIZ 3877 0.64 3.66 0.04 92 RCVD_IN_MSPIKE_WL 3750 4.89 3.54 5.16 93 XM_SendGrid 3631 6.20 3.42 6.75 94 XMPhish11 3564 1.55 3.36 1.19 95 T_XMDrugObfuBody_08 3546 1.94 3.34 1.66 96 TR_XM_PHPDW 3541 1.03 3.34 0.57 97 TR_XM_PHPForged 3503 1.02 3.30 0.56 98 HTML_IMAGE_ONLY_08 3490 0.65 3.29 0.12 99 TR_XM_FormFill2 3474 1.01 3.28 0.56 100 XM_H_PHPOS 3461 1.00 3.26 0.55 101 NO_DNS_FOR_FROM 3308 1.37 3.12 1.02 102 US_DOLLARS_3 3299 1.78 3.11 1.51 103 XMSexyCombo_01 3295 1.39 3.11 1.04 104 MIME_HEADER_CTYPE_ONLY 3257 0.61 3.07 0.13 105 MAILING_LIST_MULTI 3150 2.40 2.97 2.29 106 URI_HEX 2999 2.22 2.83 2.10 107 XM_CamelCaseFrm001 2982 2.33 2.81 2.23 108 HTML_IMAGE_RATIO_08 2935 2.71 2.77 2.70 109 NO_FM_NAME_IP_HOSTN 2926 0.46 2.76 0.00 110 DKIM_ADSP_NXDOMAIN 2918 1.04 2.75 0.70 111 T_XMHurry_00 2852 1.12 2.69 0.80 112 T_TooManySym_01 2801 4.93 2.64 5.39 113 FROM_NTLD_LINKBAIT 2787 0.44 2.63 0.00 114 SHORT_IMG_SUSP_NTLD 2784 0.44 2.63 0.00 115 HTML_IMAGE_ONLY_20 2764 0.68 2.61 0.30 116 XMDiploma_00 2757 1.89 2.60 1.75 117 TR_XM_DK_Bayes 2667 18.91 2.52 22.18 118 RCVD_IN_MSPIKE_H5 2655 0.56 2.50 0.17 119 XM_OfRef6 2643 1.67 2.49 1.51 120 TR_XM_RelayPhish 2565 1.30 2.42 1.08 121 DATE_IN_PAST_24_48 2557 0.41 2.41 0.01 122 TR_XM_DK_Bayes1 2539 18.21 2.39 21.36 123 BAYES_05 2532 3.21 2.39 3.37 124 HOSTED_IMG_MULTI 2513 0.39 2.37 0.00 125 ALIBABA_IMG_NOT_RCVD_ALI 2513 0.39 2.37 0.00 126 XM_DrugUnitList 2513 0.40 2.37 0.00 127 LongTLD 2512 0.56 2.37 0.20 128 EBAY_IMG_NOT_RCVD_EBAY 2496 0.39 2.35 0.00 129 BAYES_95 2470 1.22 2.33 1.00 130 RELAYCOUNTRY_FI 2461 0.41 2.32 0.03 131 MPART_ALT_DIFF_COUNT 2458 0.65 2.32 0.32 132 RELAYCOUNTRY_DE 2398 0.68 2.26 0.37 133 DEAR_BENEFICIARY 2380 0.38 2.24 0.01 134 DATE_IN_PAST_12_24 2277 0.44 2.15 0.10 135 TR_Symld_Words 2249 1.90 2.12 1.85 136 SpammyFromTLD_01 2238 1.00 2.11 0.77 137 T_FILL_THIS_FORM_SHORT 2169 1.40 2.05 1.27 138 XM_H_TOP 2119 0.33 2.00 0.00 139 XMSlimDrugH 2092 0.67 1.97 0.41 140 RCVD_IN_IADB_LISTED 2086 4.80 1.97 5.36 141 TR_LOTS_OF_MONEY2 2052 0.67 1.94 0.41 142 T_MONEY_PERCENT 2052 0.67 1.94 0.41 143 HOSTED_IMG_DIRECT_MX 2051 0.32 1.93 0.00 144 XM_GoogleGroups 2010 1.28 1.90 1.16 145 T_XMDrugObfuBody_00 2002 0.95 1.89 0.76 146 XM_H_Long_From02 1998 1.53 1.88 1.46 147 RELAYCOUNTRY_IN 1980 0.46 1.87 0.18 148 XMGenDplmaNmb 1974 1.17 1.86 1.03 149 XM_BadFromFormat 1942 0.39 1.83 0.10 150 RCVD_IN_IADB_SPF 1932 4.21 1.82 4.68 151 XMSexyCombo_04 1913 0.45 1.80 0.18 152 RCVD_IN_IADB_DK 1887 3.66 1.78 4.04 153 RCVD_IN_IADB_SENDERID 1882 3.72 1.78 4.11 154 NORDNS_LOW_CONTRAST 1881 0.30 1.77 0.01 155 XM_DK_Undo_01 1872 1.75 1.77 1.75 156 XMBody_17 1872 0.82 1.77 0.64 157 RELAYCOUNTRY_AU 1820 0.71 1.72 0.51 158 HTML_IMAGE_ONLY_12 1816 0.49 1.71 0.24 159 URIBL_DBL_ABUSE_REDIR 1764 0.28 1.66 0.01 160 DIET_1 1713 0.65 1.62 0.46 161 TM2_M_VERY_LONG_WORD 1652 1.41 1.56 1.38 162 RELAYCOUNTRY_NL 1643 0.39 1.55 0.16 163 TR_Mismatch_TLD_02 1612 0.35 1.52 0.11 164 TR_XM_SEO3 1602 0.41 1.51 0.19 165 XM_H_Undi_Recip 1592 0.40 1.50 0.18 166 ALL_TRUSTED 1576 11.57 1.49 13.58 167 TR_XM_DK_Bayes2 1574 15.46 1.48 18.24 168 TR_XM_DK_SendGrid 1561 2.92 1.47 3.21 169 XMBody_78 1559 0.73 1.47 0.58 170 URI_TRY_3LD 1536 1.44 1.45 1.44 171 XMSubject_48 1521 0.27 1.43 0.04 172 XM_GoogleGroups2 1514 0.30 1.43 0.07 173 XM_H_PHPMailer 1494 0.61 1.41 0.45 174 DATE_IN_PAST_03_06 1478 0.41 1.39 0.21 175 T_Symld_Words_02 1466 0.85 1.38 0.74 176 XM_GoogleGroups3 1434 0.24 1.35 0.02 177 XM_GoogleGroups4 1434 0.24 1.35 0.02 178 TR_Sbj_FN_Bdy 1405 0.37 1.33 0.18 179 ADVANCE_FEE_4_NEW 1397 0.22 1.32 0.00 180 RELAYCOUNTRY_NG 1395 0.22 1.32 0.00 181 RDNS_DYNAMIC 1387 0.55 1.31 0.40 182 RCVD_IN_RP_SAFE 1360 8.21 1.28 9.59 183 FORM_FRAUD_3 1309 0.21 1.23 0.00 184 XMStockSpam_06 1297 1.80 1.22 1.92 185 RELAYCOUNTRY_NO 1297 0.21 1.22 0.01 186 TR_XM_Undi_Recip2 1296 0.21 1.22 0.01 187 XM_Combo_Sbj 1224 0.35 1.15 0.19 188 TM2_M_A_HREF_HREF 1205 0.72 1.14 0.64 189 XM_H_PHPOS_M 1196 0.30 1.13 0.14 190 XMSubMetaI_00 1183 0.76 1.12 0.69 191 RELAYCOUNTRY_AT 1161 0.35 1.10 0.21 192 XM_diabetes 1150 0.19 1.08 0.01 193 XMPhish30 1148 0.65 1.08 0.56 194 MONEY_FRAUD_8 1118 0.18 1.05 0.00 195 XMBdyGiftCard01 1116 1.28 1.05 1.32 196 XM_XX_Yahoo 1114 0.30 1.05 0.15 197 ADVANCE_FEE_5_NEW_MONEY 1098 0.17 1.04 0.00 198 UNPARSEABLE_RELAY 1093 2.12 1.03 2.34 199 SUBJ_ILLEGAL_CHARS 1083 0.22 1.02 0.06 200 SUBJECT_NEEDS_ENCODING 1082 0.22 1.02 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 465916 87.78 89.12 87.51 2 DKIM_SIGNED 417421 76.87 69.20 78.40 3 XM_DK_Pass 410873 75.33 66.07 77.17 4 DKIM_VALID 395098 72.40 63.29 74.21 5 XM_B_Unicode 378266 70.67 68.80 71.05 6 XMListUnsubscribeExists 295270 57.24 66.15 55.46 7 DKIM_VALID_AU 288677 53.03 47.02 54.22 8 DCC_CHECK_NEGATIVE 276221 46.88 21.76 51.88 9 BAYES_50 265140 50.92 56.52 49.80 10 DCC_CHECK 245091 51.04 76.17 46.03 11 XM_B_Unicode3 228419 43.32 45.42 42.90 12 HTML_FONT_LOW_CONTRAST 168845 31.92 32.96 31.71 13 T_TM2_M_HEADER_IN_MSG 157537 28.05 20.30 29.59 14 DKIM_VALID_EF 148714 26.94 21.97 27.93 15 BAYES_00 139096 22.51 4.33 26.13 16 LOC_TINY_FONT_1 129702 25.69 32.39 24.36 17 FVGT_m_MULTI_ODD 127674 23.82 23.04 23.98 18 XMSubLong 124216 23.76 25.90 23.33 19 TR_XM_DK_Bayes 118085 18.91 2.52 22.18 20 TR_XM_DK_Bayes1 113732 18.21 2.39 21.36 21 MIME_HTML_ONLY 110821 23.28 35.65 20.82 22 T_KAM_HTML_FONT_INVALID 103522 19.45 19.51 19.44 23 MultiRelay 100543 19.68 23.70 18.88 24 TR_XM_DK_Bayes2 97099 15.46 1.48 18.24 25 XM_Body_Dirty_Words 79628 16.49 24.21 14.96 26 ALL_TRUSTED 72322 11.57 1.49 13.58 27 XM_Multi_Part_URI 68520 13.43 16.27 12.87 28 RCVD_IN_RP_SAFE 51073 8.21 1.28 9.59 29 HTML_IMAGE_RATIO_02 50058 10.00 13.02 9.40 30 LOTS_OF_MONEY 49385 9.94 13.28 9.28 31 XM_Evil_Numbers_Gen 48657 9.52 11.42 9.14 32 TooManyTo_001 45828 8.78 9.67 8.61 33 T_XMDrugObfuBody_14 45812 8.83 9.97 8.60 34 LotsOfNums_01 45383 8.53 8.58 8.52 35 RCVD_IN_RP_CERTIFIED 44448 7.05 0.53 8.35 36 RCVD_IN_MSPIKE_H2 41448 7.69 7.22 7.79 37 FSL_BULK_SIG 40179 8.95 16.01 7.55 38 XM_DKIMWhitelistDomains 38780 6.08 0.02 7.28 39 BAYES_40 36580 6.56 4.97 6.87 40 XM_B_Phish_Phrases 36146 6.86 7.22 6.79 41 XM_SendGrid 35952 6.20 3.42 6.75 42 XM_H_Long_From01 33893 7.14 11.03 6.37 43 HTML_IMAGE_RATIO_04 33006 6.24 6.45 6.20 44 MIME_QP_LONG_LINE 32137 5.88 5.08 6.04 45 RELAYCOUNTRY_META 30676 10.15 32.21 5.76 46 BOTNET_IPINHOSTNAME 28955 7.99 20.79 5.44 47 T_TooManySym_01 28681 4.93 2.64 5.39 48 BAYES_20 28602 5.21 4.39 5.37 49 XMSubMetaSx_00 28574 5.93 8.73 5.37 50 RCVD_IN_IADB_LISTED 28556 4.80 1.97 5.36 51 RCVD_IN_MSPIKE_WL 27484 4.89 3.54 5.16 52 XMStrtUSub 27388 4.99 4.22 5.14 53 XM_DK_Undo_02 26908 8.77 27.42 5.05 54 RCVD_IN_MSPIKE_H3 26157 4.26 0.96 4.91 55 XMSexyCombo_05 25146 6.28 14.10 4.72 56 RCVD_IN_IADB_SPF 24920 4.21 1.82 4.68 57 HTML_IMAGE_RATIO_06 24845 4.51 3.74 4.67 58 DKIM_INVALID 22323 4.48 5.91 4.19 59 RCVD_IN_IADB_SENDERID 21893 3.72 1.78 4.11 60 RCVD_IN_IADB_DK 21504 3.66 1.78 4.04 61 XM_PDF 20821 3.37 0.65 3.91 62 T_REMOTE_IMAGE 20647 4.79 9.38 3.88 63 MPART_ALT_DIFF 19258 4.40 8.35 3.62 64 IN_ZIMBRA_NJ_WHITELIST 19243 3.02 0.02 3.61 65 XMNumbers 18458 3.66 4.64 3.47 66 RCVD_IN_IADB_VOUCHED 18234 2.95 0.59 3.42 67 BAYES_05 17946 3.21 2.39 3.37 68 BAYES_60 17604 3.38 3.76 3.31 69 FROM_EXCESS_BASE64 17517 3.66 5.51 3.29 70 XM_DIRTYINTL 17462 4.46 10.38 3.28 71 XM_B_SpammyTLD 17441 3.65 5.50 3.28 72 TR_XM_DK_SendGrid 17102 2.92 1.47 3.21 73 XM_UncommonTLD01 17038 5.07 14.43 3.20 74 BOUNCE_MESSAGE 14970 2.43 0.52 2.81 75 ANY_BOUNCE_MESSAGE 14970 2.43 0.52 2.81 76 HTML_IMAGE_RATIO_08 14358 2.71 2.77 2.70 77 TO_MALFORMED 13969 2.19 0.01 2.62 78 TM2_M_URI_OPT_OUT 13871 2.80 3.77 2.61 79 BOTNET 12457 6.20 25.61 2.34 80 UNPARSEABLE_RELAY 12434 2.12 1.03 2.34 81 MIME_HTML_MOSTLY 12397 2.62 4.10 2.33 82 MAILING_LIST_MULTI 12193 2.40 2.97 2.29 83 BAYES_99 11973 4.64 16.64 2.25 84 XM_CamelCaseFrm001 11880 2.33 2.81 2.23 85 RCVD_IN_IADB_OPTIN 11400 1.86 0.44 2.14 86 TooManyTo_002 11294 1.93 0.95 2.12 87 T_TooManySym_02 11219 1.86 0.62 2.11 88 URI_HEX 11154 2.22 2.83 2.10 89 TVD_RCVD_IP 10788 1.79 0.61 2.03 90 MIME_HTML_ONLY_MULTI 10787 2.42 4.42 2.03 91 KHOP_HELO_FCRDNS 10626 2.53 5.22 2.00 92 XM_SPF_SoftFail 10610 3.62 11.82 1.99 93 HTML_MIME_NO_HTML_TAG 10557 2.76 6.65 1.98 94 XMStockSpam_06 10202 1.80 1.22 1.92 95 SUBJ_ALL_CAPS 10177 2.22 3.76 1.91 96 UNTRUSTED_Relay 9922 4.65 18.67 1.86 97 TR_Symld_Words 9874 1.90 2.12 1.85 98 BAYES_999 9579 3.65 12.97 1.80 99 RELAYCOUNTRY_CA 9327 2.13 4.02 1.75 100 XMDiploma_00 9301 1.89 2.60 1.75 101 XM_DK_Undo_01 9294 1.75 1.77 1.75 102 T_XMDrugObfuBody_08 8839 1.94 3.34 1.66 103 BAYES_80 8694 2.09 4.39 1.63 104 TR_MetaPhish_Combo_01 8681 1.49 0.81 1.63 105 CK_HELO_DYNAMIC_SPLIT_IP 8423 1.35 0.18 1.58 106 HELO_DYNAMIC_IPADDR2 8411 1.33 0.08 1.58 107 HELO_NODOT 8108 2.16 5.35 1.52 108 HELO_NO_DOMAIN 8107 2.16 5.35 1.52 109 XM_OfRef6 8046 1.67 2.49 1.51 110 US_DOLLARS_3 8034 1.78 3.11 1.51 111 IN_HORDE_ADDRESS_BOOK 7868 1.24 0.03 1.48 112 INVALID_MSGID 7808 1.25 0.15 1.47 113 XM_H_Long_From02 7761 1.53 1.88 1.46 114 TooManyTo_003 7719 1.34 0.78 1.45 115 URI_TRY_3LD 7652 1.44 1.45 1.44 116 TM2_M_VERY_LONG_WORD 7342 1.41 1.56 1.38 117 TR_DCC_Bayes_99 7175 3.34 13.36 1.35 118 XMBdyGiftCard01 7032 1.28 1.05 1.32 119 XMGappySubj_01 6925 1.15 0.40 1.30 120 T_FILL_THIS_FORM_SHORT 6778 1.40 2.05 1.27 121 USER_IN_DEF_DKIM_WL 6741 1.06 0.02 1.27 122 XMCapTrack 6493 1.07 0.33 1.22 123 XMPhish11 6353 1.55 3.36 1.19 124 XMSubMetaSxObfu_03 6244 1.13 0.93 1.17 125 XM_GoogleGroups 6150 1.28 1.90 1.16 126 TooManyTo_004 5774 1.01 0.64 1.08 127 TR_XM_RelayPhish 5743 1.30 2.42 1.08 128 XMSexyCombo_01 5562 1.39 3.11 1.04 129 DKIM_ADSP_CUSTOM_MED 5500 1.73 5.23 1.03 130 XMGenDplmaNmb 5491 1.17 1.86 1.03 131 RELAYCOUNTRY_GB 5455 0.99 0.82 1.02 132 NO_DNS_FOR_FROM 5410 1.37 3.12 1.02 133 BAYES_95 5349 1.22 2.33 1.00 134 XM_UB50 4867 2.53 10.63 0.91 135 TooManyTo_005 4678 0.82 0.55 0.88 136 XM_B_REG_HTML 4648 0.77 0.27 0.87 137 RCVD_IN_BL_SPAMCOP_NET 4529 2.01 7.82 0.85 138 T_XMHurry_00 4271 1.12 2.69 0.80 139 XM_B_COPY_HTML 4243 0.77 0.66 0.80 140 HTML_TAG_BALANCE_BODY 4135 0.74 0.53 0.78 141 SpammyFromTLD_01 4126 1.00 2.11 0.77 142 XM_ProductURIs 4070 0.77 0.82 0.76 143 T_XMDrugObfuBody_00 4038 0.95 1.89 0.76 144 T_Symld_Words_02 3965 0.85 1.38 0.74 145 XMBrknScrpt_02 3868 0.77 0.96 0.73 146 HTTPS_HTTP_MISMATCH 3802 0.73 0.78 0.71 147 NML_ADSP_CUSTOM_MED 3748 1.42 5.01 0.70 148 DKIM_ADSP_NXDOMAIN 3747 1.04 2.75 0.70 149 XM_GRM 3707 0.58 0.00 0.70 150 XMSubMetaI_00 3647 0.76 1.12 0.69 151 TM2_M_A_HREF_HREF 3408 0.72 1.14 0.64 152 XMBody_17 3392 0.82 1.77 0.64 153 SpammyFromTLD_02 3301 1.29 4.64 0.62 154 XMNoVowels 3289 0.59 0.48 0.62 155 XMHTMLBadTable_001 3177 0.59 0.58 0.60 156 FILL_THIS_FORM 3147 0.58 0.52 0.59 157 XMBody_78 3086 0.73 1.47 0.58 158 TR_XM_PHPDW 3059 1.03 3.34 0.57 159 T_OBFU_PDF_ATTACH 3048 0.51 0.18 0.57 160 XMMoneyMeta_00 3042 0.61 0.80 0.57 161 PLING_QUERY 3023 0.54 0.42 0.57 162 XMPhish30 3007 0.65 1.08 0.56 163 TR_XM_PHPForged 3001 1.02 3.30 0.56 164 TR_XM_FormFill2 2969 1.01 3.28 0.56 165 URI_NOVOWEL 2956 0.58 0.72 0.56 166 HTML_FONT_FACE_BAD 2949 0.54 0.45 0.55 167 XM_H_PHPOS 2944 1.00 3.26 0.55 168 XM_ShortIntro_01 2879 0.56 0.66 0.54 169 XMSubMetaSxObfu_02 2861 0.55 0.59 0.54 170 MISSING_HEADERS 2803 0.57 0.79 0.53 171 FORGED_GMAIL_RCVD 2770 1.27 5.04 0.52 172 XMHTML_After_End 2761 0.60 1.00 0.52 173 XMBody_95 2756 0.45 0.11 0.52 174 FSL_THIS_IS_ADV 2740 0.57 0.85 0.51 175 T_TooManySym_03 2729 0.46 0.22 0.51 176 RELAYCOUNTRY_AU 2716 0.71 1.72 0.51 177 FILL_THIS_FORM_LONG 2684 0.49 0.42 0.50 178 FROM_GOV_SPOOF 2667 0.48 0.38 0.50 179 XMGappySubj_02 2632 0.43 0.08 0.49 180 XMLngstWrd_00 2631 0.49 0.49 0.49 181 FILL_THIS_FORM_LOAN 2625 0.46 0.27 0.49 182 XMPhish14 2596 0.56 0.93 0.49 183 DIET_1 2450 0.65 1.62 0.46 184 TR_LOTS_OF_MONEY3 2420 0.55 1.01 0.45 185 XMLngstWrd_01 2409 0.45 0.46 0.45 186 USER_IN_WHITELIST 2409 0.38 0.00 0.45 187 XM_H_PHPMailer 2382 0.61 1.41 0.45 188 HTML_IMAGE_ONLY_32 2375 0.43 0.33 0.45 189 TM2_M_BODY_EMPTY 2288 0.38 0.14 0.43 190 LOW_PRICE 2239 0.42 0.43 0.42 191 SHORT_HELO_AND_INLINE_IMAGE 2231 0.35 0.03 0.42 192 FROM_GOV_DKIM_AU 2230 0.37 0.15 0.42 193 TR_LOTS_OF_MONEY2 2201 0.67 1.94 0.41 194 T_MONEY_PERCENT 2201 0.67 1.94 0.41 195 REMOVE_BEFORE_LINK 2191 0.45 0.62 0.41 196 XMSlimDrugH 2159 0.67 1.97 0.41 197 RDNS_DYNAMIC 2156 0.55 1.31 0.40 198 HTML_IMAGE_ONLY_28 2099 0.39 0.36 0.39 199 NUMERIC_HTTP_ADDR 2089 0.42 0.57 0.39 200 XMOemUri 2043 0.35 0.16 0.38 ----------------------------------------------------------------------