Email: 363243 Autolearn: 0 AvgScore: 0.87 AvgScanTime: 2.16 sec Spam: 70029 Autolearn: 0 AvgScore: 12.45 AvgScanTime: 2.87 sec Ham: 293214 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 1.99 sec Time Spent Running SA: 217.88 hours Time Spent Processing Spam: 55.74 hours Time Spent Processing Ham: 162.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 63723 84.56 91.00 83.03 2 DCC_CHECK 52530 56.72 75.01 52.35 3 DKIM_SIGNED 51719 78.19 73.85 79.22 4 XMListUnsubscribeExists 49879 60.45 71.23 57.87 5 XM_DK_Pass 45801 75.69 65.40 78.15 6 XM_B_Unicode 43215 69.39 61.71 71.22 7 DKIM_VALID 42823 72.47 61.15 75.17 8 DKIM_VALID_AU 36105 59.88 51.56 61.87 9 BAYES_50 34860 51.10 49.78 51.42 10 XM_B_Unicode3 29517 44.96 42.15 45.63 11 HTML_FONT_LOW_CONTRAST 27488 35.89 39.25 35.08 12 LOC_TINY_FONT_1 24451 32.25 34.92 31.61 13 RELAYCOUNTRY_META 22962 10.73 32.79 5.46 14 MIME_HTML_ONLY 21015 24.55 30.01 23.24 15 XM_DK_Undo_02 20233 10.23 28.89 5.77 16 XM_UncommonTLD01 19005 9.33 27.14 5.07 17 MultiRelay 17485 17.24 24.97 15.39 18 BOTNET 17167 6.57 24.51 2.28 19 XM_Body_Dirty_Words 16676 18.47 23.81 17.19 20 FVGT_m_MULTI_ODD 16587 21.38 23.69 20.83 21 DCC_CHECK_NEGATIVE 16360 42.08 23.36 46.55 22 XMSubLong 15478 23.65 22.10 24.02 23 DKIM_VALID_EF 15454 25.98 22.07 26.92 24 BOTNET_IPINHOSTNAME 15310 9.21 21.86 6.19 25 BAYES_99 14016 6.60 20.01 3.40 26 TooManyTo_001 12885 8.38 18.40 5.99 27 BAYES_999 11050 5.36 15.78 2.87 28 XM_Multi_Part_URI 10779 14.43 15.39 14.20 29 TR_DCC_Bayes_99 10744 4.42 15.34 1.81 30 UNTRUSTED_Relay 10703 4.71 15.28 2.19 31 XM_H_Long_From01 10523 8.31 15.03 6.71 32 SpammyFromTLD_02 10218 2.99 14.59 0.22 33 T_KAM_HTML_FONT_INVALID 9794 14.82 13.99 15.02 34 XM_B_SpammyTLD 9174 6.00 13.10 4.31 35 HTML_IMAGE_RATIO_02 9171 12.27 13.10 12.07 36 FSL_BULK_SIG 8956 10.38 12.79 9.81 37 DKIM_INVALID 8896 5.72 12.70 4.05 38 T_TM2_M_HEADER_IN_MSG 8586 21.23 12.26 23.37 39 XMSexyCombo_05 7239 7.38 10.34 6.68 40 XMSubMetaSx_00 7197 5.19 10.28 3.98 41 XM_DIRTYINTL 6922 5.29 9.88 4.19 42 XMNumbers 6698 4.99 9.56 3.90 43 XM_Evil_Numbers_Gen 6684 10.88 9.54 11.19 44 XM_UB50 5933 2.21 8.47 0.71 45 DKIM_ADSP_NXDOMAIN 5741 2.07 8.20 0.60 46 RCVD_IN_BL_SPAMCOP_NET 5570 1.92 7.95 0.47 47 LOTS_OF_MONEY 5494 9.08 7.85 9.37 48 FROM_SUSPICIOUS_NTLD 5046 1.41 7.21 0.03 49 FROM_SUSPICIOUS_NTLD_FP 5025 1.41 7.18 0.03 50 TR_Mismatch_TLD_02 5002 1.43 7.14 0.07 51 DATE_IN_PAST_03_06 4885 1.62 6.98 0.35 52 XM_B_Phish_Phrases 4720 8.17 6.74 8.51 53 UNPARSEABLE_RELAY 4682 4.32 6.69 3.76 54 T_XMDrugObfuBody_14 4669 7.66 6.67 7.90 55 XM_H_TOP 4488 1.24 6.41 0.00 56 HTML_FONT_SIZE_HUGE 4363 1.28 6.23 0.09 57 RELAYCOUNTRY_RU 4281 1.20 6.11 0.03 58 RCVD_IN_MSPIKE_H2 4202 6.74 6.00 6.91 59 BAYES_00 4189 20.54 5.98 24.02 60 T_REMOTE_IMAGE 4149 3.39 5.92 2.78 61 HTML_TAG_BALANCE_HEAD 4059 1.18 5.80 0.07 62 INVALID_DATE 4025 1.13 5.75 0.03 63 XMSubject_70 3998 1.11 5.71 0.02 64 LotsOfNums_01 3855 7.13 5.50 7.52 65 MPART_ALT_DIFF 3851 4.31 5.50 4.02 66 KHOP_HELO_FCRDNS 3850 1.91 5.50 1.06 67 HTML_IMAGE_RATIO_04 3833 7.60 5.47 8.11 68 XM_SPF_SoftFail 3746 1.82 5.35 0.97 69 BAYES_60 3719 4.20 5.31 3.93 70 BAYES_80 3562 2.64 5.09 2.05 71 RCVD_IN_RP_RNBL 3507 1.00 5.01 0.04 72 XM_CamelCaseFrm001 3439 2.41 4.91 1.82 73 RELAYCOUNTRY_FR 3381 1.40 4.83 0.58 74 RELAYCOUNTRY_DE 3304 1.14 4.72 0.28 75 HTML_MIME_NO_HTML_TAG 3285 2.11 4.69 1.50 76 RCVD_IN_PSBL 3273 0.96 4.67 0.08 77 XMStrtUSub 3137 5.04 4.48 5.18 78 MultiRelay_Combo 3087 1.01 4.41 0.19 79 MultiRelay_CC 3087 1.01 4.41 0.19 80 BAYES_40 3072 5.58 4.39 5.86 81 BAYES_20 2852 4.63 4.07 4.77 82 MIME_HTML_MOSTLY 2839 4.53 4.05 4.64 83 XM_SendGrid 2787 5.93 3.98 6.39 84 INVALID_MSGID 2650 3.64 3.78 3.60 85 DKIM_ADSP_CUSTOM_MED 2644 1.40 3.78 0.83 86 RELAYCOUNTRY_CA 2616 2.03 3.74 1.62 87 HTML_TEXT_INVISIBLE_STYLE 2607 0.80 3.72 0.10 88 XMSexyCombo_01 2573 1.31 3.67 0.74 89 HTML_IMAGE_RATIO_06 2560 3.28 3.66 3.19 90 FORGED_GMAIL_RCVD 2550 1.06 3.64 0.44 91 FROM_EXCESS_BASE64 2476 4.27 3.54 4.45 92 NORDNS_LOW_CONTRAST 2442 0.68 3.49 0.01 93 NML_ADSP_CUSTOM_MED 2426 1.10 3.46 0.54 94 RELAYCOUNTRY_GB 2406 1.04 3.44 0.47 95 TR_XM_PHPDW 2389 1.10 3.41 0.55 96 TR_XM_PHPForged 2352 1.08 3.36 0.53 97 NO_DNS_FOR_FROM 2315 1.75 3.31 1.37 98 TR_XM_FormFill2 2315 1.06 3.31 0.53 99 URIBL_DBL_ABUSE_REDIR 2311 0.66 3.30 0.03 100 XM_H_PHPOS 2306 1.06 3.29 0.52 101 MIME_HTML_ONLY_MULTI 2265 2.42 3.23 2.22 102 URI_HEX 2228 2.47 3.18 2.30 103 T_XMHurry_00 2190 1.17 3.13 0.70 104 REPLYTO_WITHOUT_TO_CC 2140 1.22 3.06 0.78 105 MIME_HEADER_CTYPE_ONLY 2138 0.70 3.05 0.14 106 MPART_ALT_DIFF_COUNT 1972 0.74 2.82 0.24 107 T_TooManySym_01 1971 8.18 2.81 9.47 108 TR_XM_RelayPhish 1971 1.68 2.81 1.40 109 TM2_M_VERY_LONG_WORD 1942 1.44 2.77 1.12 110 DATE_IN_FUTURE_06_12 1938 0.54 2.77 0.01 111 RCVD_IN_RP_SAFE 1912 11.79 2.73 13.95 112 HDRS_LCASE_IMGONLY 1863 0.53 2.66 0.03 113 MIME_QP_LONG_LINE 1838 3.48 2.62 3.69 114 XM_OfRef6 1836 2.24 2.62 2.15 115 XM_URI_RBL 1824 0.83 2.60 0.41 116 TR_XM_DK_SendGrid 1786 3.39 2.55 3.59 117 TM2_M_URI_OPT_OUT 1786 3.78 2.55 4.08 118 RCVD_IN_MSPIKE_BL 1781 0.52 2.54 0.04 119 HTML_IMAGE_ONLY_12 1779 0.60 2.54 0.13 120 BAYES_95 1763 1.38 2.52 1.11 121 BAYES_05 1747 3.02 2.49 3.14 122 ALL_TRUSTED 1722 13.69 2.46 16.37 123 T_XMDrugObfuBody_08 1698 2.21 2.42 2.15 124 BOTNET_NORDNS 1681 0.48 2.40 0.02 125 HTML_SHORT_LINK_IMG_1 1668 0.47 2.38 0.02 126 TO_EQ_FM_DOM_HTML_IMG 1654 0.46 2.36 0.00 127 HTML_IMAGE_RATIO_08 1591 2.68 2.27 2.77 128 RCVD_IN_MSPIKE_L5 1565 0.45 2.23 0.02 129 XMSubMetaSxObfu_03 1550 0.78 2.21 0.43 130 TooManyTo_002 1540 1.31 2.20 1.10 131 XM_H_PHPMailer 1510 0.85 2.16 0.54 132 XMDiploma_00 1428 1.49 2.04 1.36 133 TR_XM_INV_DKIM 1414 0.52 2.02 0.16 134 TooManyTo_003 1351 1.02 1.93 0.80 135 XM_H_PHPOS_M 1335 0.59 1.91 0.27 136 TR_M_TOP_BAYES 1310 0.36 1.87 0.00 137 SpammyFromTLD_01 1225 0.61 1.75 0.34 138 XMSubMetaI_00 1204 0.92 1.72 0.73 139 XMBdyGiftCard01 1201 2.34 1.72 2.48 140 TooManyTo_004 1149 0.86 1.64 0.68 141 SUBJ_DOLLARS 1098 0.81 1.57 0.63 142 XMBrknScrpt_02 1083 1.25 1.55 1.17 143 RCVD_IN_RP_CERTIFIED 1068 9.82 1.53 11.80 144 XM_H_Long_From02 1055 1.25 1.51 1.19 145 DIET_1 1021 0.68 1.46 0.49 146 T_Symld_Words_02 1003 0.81 1.43 0.66 147 XMGenDplmaNmb 1000 0.88 1.43 0.75 148 FILL_THIS_FORM 987 1.38 1.41 1.37 149 XMBody_17 953 1.02 1.36 0.93 150 TooManyTo_005 943 0.72 1.35 0.57 151 RELAYCOUNTRY_AT 936 0.46 1.34 0.25 152 RCVD_IN_IADB_LISTED 900 2.96 1.29 3.36 153 T_HTML_TAG_BALANCE_CENTER 894 0.31 1.28 0.08 154 XMSexyCombo_04 886 0.34 1.27 0.12 155 XMPhish30 877 0.77 1.25 0.65 156 RDNS_DYNAMIC 871 0.65 1.24 0.51 157 T_XMDrugObfuBody_00 867 0.68 1.24 0.55 158 SUBJ_ALL_CAPS 859 1.37 1.23 1.40 159 MAILING_LIST_MULTI 824 1.84 1.18 2.00 160 THIS_AD 782 0.54 1.12 0.40 161 RCVD_IN_IADB_SPF 780 2.59 1.11 2.95 162 T_MONEY_PERCENT 778 0.41 1.11 0.24 163 TR_LOTS_OF_MONEY2 778 0.41 1.11 0.24 164 RCVD_IN_IADB_SENDERID 771 2.33 1.10 2.62 165 RCVD_IN_IADB_DK 771 2.27 1.10 2.55 166 T_FILL_THIS_FORM_SHORT 765 0.70 1.09 0.61 167 LONG_HEX_URI 757 0.28 1.08 0.09 168 XMStockSpam_06 755 2.11 1.08 2.35 169 TVD_RCVD_IP 751 2.84 1.07 3.26 170 TR_XM_DK_Bayes 733 16.30 1.05 19.94 171 XM_ProductURIs 722 1.33 1.03 1.41 172 XMClaimOffer 705 0.31 1.01 0.14 173 XM_DK_Undo_01 693 1.16 0.99 1.20 174 RELAYCOUNTRY_VN 693 0.21 0.99 0.02 175 XM_UB60 691 0.24 0.99 0.06 176 XMLngstWrd_00 671 0.78 0.96 0.74 177 URIBL_BLACK 661 0.19 0.94 0.01 178 XM_OfRef7 642 0.44 0.92 0.32 179 NUMERIC_HTTP_ADDR 621 0.41 0.89 0.30 180 TR_XM_DK_Bayes1 621 15.70 0.89 19.23 181 HK_RANDOM_REPLYTO 616 0.35 0.88 0.23 182 XMPhish11 615 1.07 0.88 1.11 183 XMLngstWrd_01 614 0.72 0.88 0.68 184 TR_Symld_Words 612 1.31 0.87 1.41 185 LOADSA_MONEY_COMBO 611 0.20 0.87 0.04 186 XM_UB99 604 0.18 0.86 0.01 187 SUBJECT_NEEDS_ENCODING 601 0.24 0.86 0.09 188 SUBJ_ILLEGAL_CHARS 601 0.24 0.86 0.09 189 TM2_M_A_HREF_HREF 599 0.55 0.86 0.48 190 XMSubMetaSxObfu_02 597 0.86 0.85 0.87 191 RCVD_IN_MSPIKE_WL 595 3.77 0.85 4.46 192 CK_HELO_DYNAMIC_SPLIT_IP 589 2.55 0.84 2.96 193 PLING_QUERY 589 0.47 0.84 0.38 194 DRUGS_ERECTILE 572 0.25 0.82 0.11 195 XMLngstWrd_02 564 0.58 0.81 0.53 196 FROM_DOMAIN_NOVOWEL 562 0.20 0.80 0.06 197 RELAYCOUNTRY_BR 554 0.17 0.79 0.02 198 XMLngstWrd_03 545 0.50 0.78 0.44 199 NO_MEDICAL 543 0.15 0.78 0.00 200 T_TooManySym_02 538 3.35 0.77 3.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243442 84.56 91.00 83.03 2 DKIM_SIGNED 232288 78.19 73.85 79.22 3 XM_DK_Pass 229144 75.69 65.40 78.15 4 DKIM_VALID 220411 72.47 61.15 75.17 5 XM_B_Unicode 208822 69.39 61.71 71.22 6 DKIM_VALID_AU 181418 59.88 51.56 61.87 7 XMListUnsubscribeExists 169689 60.45 71.23 57.87 8 DCC_CHECK 153496 56.72 75.01 52.35 9 BAYES_50 150771 51.10 49.78 51.42 10 DCC_CHECK_NEGATIVE 136497 42.08 23.36 46.55 11 XM_B_Unicode3 133806 44.96 42.15 45.63 12 HTML_FONT_LOW_CONTRAST 102873 35.89 39.25 35.08 13 LOC_TINY_FONT_1 92686 32.25 34.92 31.61 14 DKIM_VALID_EF 78933 25.98 22.07 26.92 15 BAYES_00 70420 20.54 5.98 24.02 16 XMSubLong 70416 23.65 22.10 24.02 17 T_TM2_M_HEADER_IN_MSG 68525 21.23 12.26 23.37 18 MIME_HTML_ONLY 68145 24.55 30.01 23.24 19 FVGT_m_MULTI_ODD 61077 21.38 23.69 20.83 20 TR_XM_DK_Bayes 58468 16.30 1.05 19.94 21 TR_XM_DK_Bayes1 56399 15.70 0.89 19.23 22 TR_XM_DK_Bayes2 52167 14.49 0.67 17.79 23 XM_Body_Dirty_Words 50400 18.47 23.81 17.19 24 ALL_TRUSTED 48011 13.69 2.46 16.37 25 MultiRelay 45121 17.24 24.97 15.39 26 T_KAM_HTML_FONT_INVALID 44029 14.82 13.99 15.02 27 XM_Multi_Part_URI 41642 14.43 15.39 14.20 28 RCVD_IN_RP_SAFE 40908 11.79 2.73 13.95 29 HTML_IMAGE_RATIO_02 35382 12.27 13.10 12.07 30 RCVD_IN_RP_CERTIFIED 34608 9.82 1.53 11.80 31 XM_DKIMWhitelistDomains 34486 9.50 0.06 11.76 32 XM_Evil_Numbers_Gen 32821 10.88 9.54 11.19 33 FSL_BULK_SIG 28761 10.38 12.79 9.81 34 T_TooManySym_01 27756 8.18 2.81 9.47 35 LOTS_OF_MONEY 27477 9.08 7.85 9.37 36 XM_B_Phish_Phrases 24944 8.17 6.74 8.51 37 HTML_IMAGE_RATIO_04 23789 7.60 5.47 8.11 38 T_XMDrugObfuBody_14 23170 7.66 6.67 7.90 39 LotsOfNums_01 22040 7.13 5.50 7.52 40 RCVD_IN_MSPIKE_H2 20267 6.74 6.00 6.91 41 XM_H_Long_From01 19665 8.31 15.03 6.71 42 XMSexyCombo_05 19584 7.38 10.34 6.68 43 XM_SendGrid 18736 5.93 3.98 6.39 44 BOTNET_IPINHOSTNAME 18148 9.21 21.86 6.19 45 TooManyTo_001 17560 8.38 18.40 5.99 46 BAYES_40 17187 5.58 4.39 5.86 47 TO_MALFORMED 17023 4.70 0.09 5.81 48 XM_DK_Undo_02 16920 10.23 28.89 5.77 49 RELAYCOUNTRY_META 16019 10.73 32.79 5.46 50 XMStrtUSub 15180 5.04 4.48 5.18 51 XM_UncommonTLD01 14879 9.33 27.14 5.07 52 BAYES_20 13974 4.63 4.07 4.77 53 MIME_HTML_MOSTLY 13609 4.53 4.05 4.64 54 RCVD_IN_MSPIKE_WL 13084 3.77 0.85 4.46 55 FROM_EXCESS_BASE64 13049 4.27 3.54 4.45 56 XM_B_SpammyTLD 12627 6.00 13.10 4.31 57 XM_DIRTYINTL 12290 5.29 9.88 4.19 58 RCVD_IN_MSPIKE_H3 12218 3.51 0.76 4.17 59 TM2_M_URI_OPT_OUT 11955 3.78 2.55 4.08 60 DKIM_INVALID 11877 5.72 12.70 4.05 61 MPART_ALT_DIFF 11793 4.31 5.50 4.02 62 XMSubMetaSx_00 11665 5.19 10.28 3.98 63 ANY_BOUNCE_MESSAGE 11660 3.29 0.42 3.98 64 BOUNCE_MESSAGE 11660 3.29 0.42 3.98 65 T_TooManySym_02 11613 3.35 0.77 3.96 66 BAYES_60 11529 4.20 5.31 3.93 67 XMNumbers 11429 4.99 9.56 3.90 68 UNPARSEABLE_RELAY 11019 4.32 6.69 3.76 69 MIME_QP_LONG_LINE 10818 3.48 2.62 3.69 70 INVALID_MSGID 10554 3.64 3.78 3.60 71 TR_XM_DK_SendGrid 10536 3.39 2.55 3.59 72 BAYES_99 9963 6.60 20.01 3.40 73 RCVD_IN_IADB_LISTED 9838 2.96 1.29 3.36 74 TVD_RCVD_IP 9565 2.84 1.07 3.26 75 HTML_IMAGE_RATIO_06 9366 3.28 3.66 3.19 76 BAYES_05 9218 3.02 2.49 3.14 77 IN_ZIMBRA_NJ_WHITELIST 8858 2.44 0.01 3.02 78 CK_HELO_DYNAMIC_SPLIT_IP 8675 2.55 0.84 2.96 79 RCVD_IN_IADB_SPF 8644 2.59 1.11 2.95 80 HELO_DYNAMIC_IPADDR2 8595 2.40 0.19 2.93 81 BAYES_999 8424 5.36 15.78 2.87 82 T_REMOTE_IMAGE 8160 3.39 5.92 2.78 83 HTML_IMAGE_RATIO_08 8127 2.68 2.27 2.77 84 RCVD_IN_IADB_SENDERID 7679 2.33 1.10 2.62 85 RCVD_IN_IADB_DK 7474 2.27 1.10 2.55 86 XMBdyGiftCard01 7281 2.34 1.72 2.48 87 XMStockSpam_06 6893 2.11 1.08 2.35 88 URI_HEX 6752 2.47 3.18 2.30 89 BOTNET 6688 6.57 24.51 2.28 90 MIME_HTML_ONLY_MULTI 6509 2.42 3.23 2.22 91 TR_MetaPhish_Combo_01 6493 1.87 0.43 2.21 92 UNTRUSTED_Relay 6413 4.71 15.28 2.19 93 T_XMDrugObfuBody_08 6312 2.21 2.42 2.15 94 XM_OfRef6 6296 2.24 2.62 2.15 95 RCVD_IN_IADB_VOUCHED 6282 1.80 0.35 2.14 96 BAYES_80 6022 2.64 5.09 2.05 97 MAILING_LIST_MULTI 5870 1.84 1.18 2.00 98 USER_IN_DEF_DKIM_WL 5511 1.52 0.01 1.88 99 XM_CamelCaseFrm001 5322 2.41 4.91 1.82 100 TR_DCC_Bayes_99 5300 4.42 15.34 1.81 101 URI_TRY_3LD 5259 1.59 0.75 1.79 102 XM_PDF 5246 1.50 0.30 1.79 103 IN_HORDE_ADDRESS_BOOK 4798 1.33 0.02 1.64 104 RELAYCOUNTRY_CA 4750 2.03 3.74 1.62 105 HTML_MIME_NO_HTML_TAG 4384 2.11 4.69 1.50 106 TR_Symld_Words 4146 1.31 0.87 1.41 107 XM_ProductURIs 4123 1.33 1.03 1.41 108 TR_XM_RelayPhish 4118 1.68 2.81 1.40 109 SUBJ_ALL_CAPS 4103 1.37 1.23 1.40 110 NO_DNS_FOR_FROM 4029 1.75 3.31 1.37 111 FILL_THIS_FORM 4029 1.38 1.41 1.37 112 RCVD_IN_IADB_OPTIN 3986 1.14 0.21 1.36 113 XMDiploma_00 3974 1.49 2.04 1.36 114 XMGappySubj_01 3692 1.15 0.70 1.26 115 HELO_NODOT 3618 1.13 0.68 1.23 116 XM_DK_Undo_01 3533 1.16 0.99 1.20 117 HELO_NO_DOMAIN 3521 1.10 0.67 1.20 118 XM_H_Long_From02 3475 1.25 1.51 1.19 119 XMBrknScrpt_02 3445 1.25 1.55 1.17 120 URI_OPTOUT_3LD 3415 0.96 0.10 1.16 121 FILL_THIS_FORM_LONG 3348 0.99 0.37 1.14 122 FILL_THIS_FORM_LOAN 3312 0.97 0.28 1.13 123 TM2_M_VERY_LONG_WORD 3278 1.44 2.77 1.12 124 XMPhish11 3269 1.07 0.88 1.11 125 BAYES_95 3256 1.38 2.52 1.11 126 TooManyTo_002 3226 1.31 2.20 1.10 127 XM_B_REG_HTML 3112 0.95 0.48 1.06 128 MISSING_HEADERS 3108 0.98 0.65 1.06 129 KHOP_HELO_FCRDNS 3105 1.91 5.50 1.06 130 XM_GoogleGroups 3030 0.91 0.38 1.03 131 XMSubNoVowel 2953 0.93 0.63 1.01 132 XM_SPF_SoftFail 2853 1.82 5.35 0.97 133 XMBody_17 2740 1.02 1.36 0.93 134 XMSubMetaSxObfu_02 2541 0.86 0.85 0.87 135 XMOemUri 2486 0.74 0.29 0.85 136 XM_RXBody 2474 0.77 0.46 0.84 137 HTML_TAG_BALANCE_BODY 2469 0.78 0.53 0.84 138 DKIM_ADSP_CUSTOM_MED 2425 1.40 3.78 0.83 139 TooManyTo_003 2341 1.02 1.93 0.80 140 T_TooManySym_03 2302 0.65 0.10 0.79 141 REPLYTO_WITHOUT_TO_CC 2291 1.22 3.06 0.78 142 RELAYCOUNTRY_JP 2256 0.68 0.30 0.77 143 XMSubLongNoVowel 2236 0.64 0.15 0.76 144 XMBody_95 2220 0.67 0.30 0.76 145 XMSubGarbage 2212 0.62 0.07 0.75 146 XMGenDplmaNmb 2186 0.88 1.43 0.75 147 XMHTMLBadTable_001 2178 0.69 0.47 0.74 148 XMSexyCombo_01 2177 1.31 3.67 0.74 149 XMLngstWrd_00 2175 0.78 0.96 0.74 150 USER_IN_WHITELIST 2168 0.60 0.00 0.74 151 XMSubMetaI_00 2146 0.92 1.72 0.73 152 XM_UB50 2079 2.21 8.47 0.71 153 XMNoVowels 2069 0.63 0.30 0.71 154 T_XMHurry_00 2058 1.17 3.13 0.70 155 XMLngstWrd_01 2006 0.72 0.88 0.68 156 TooManyTo_004 1985 0.86 1.64 0.68 157 T_Symld_Words_02 1926 0.81 1.43 0.66 158 XMPhish30 1917 0.77 1.25 0.65 159 SUBJ_DOLLARS 1860 0.81 1.57 0.63 160 T_FILL_THIS_FORM_SHORT 1781 0.70 1.09 0.61 161 XMBody_78 1778 0.59 0.51 0.61 162 DKIM_ADSP_NXDOMAIN 1773 2.07 8.20 0.60 163 XMBSHREFv2 1710 0.53 0.31 0.58 164 XMRcvdHeader_15 1700 0.47 0.00 0.58 165 RELAYCOUNTRY_FR 1699 1.40 4.83 0.58 166 TR_LOTS_OF_MONEY3 1691 0.61 0.76 0.58 167 TooManyTo_005 1682 0.72 1.35 0.57 168 T_XMDrugObfuBody_00 1612 0.68 1.24 0.55 169 HTML_FONT_FACE_BAD 1609 0.57 0.65 0.55 170 TR_XM_PHPDW 1609 1.10 3.41 0.55 171 XM_H_SpoofStaff4 1587 0.45 0.07 0.54 172 XM_H_PHPMailer 1582 0.85 2.16 0.54 173 NML_ADSP_CUSTOM_MED 1571 1.10 3.46 0.54 174 TR_XM_PHPForged 1567 1.08 3.36 0.53 175 XMSUPPORT 1557 0.43 0.00 0.53 176 XMLngstWrd_02 1555 0.58 0.81 0.53 177 TR_XM_FormFill2 1543 1.06 3.31 0.53 178 XM_H_PHPOS 1527 1.06 3.29 0.52 179 RDNS_DYNAMIC 1481 0.65 1.24 0.51 180 XM_B_COPY_HTML 1447 0.50 0.53 0.49 181 DIET_1 1442 0.68 1.46 0.49 182 XMSubject_48 1440 0.42 0.15 0.49 183 TM2_M_A_HREF_HREF 1394 0.55 0.86 0.48 184 RCVD_IN_BL_SPAMCOP_NET 1387 1.92 7.95 0.47 185 RELAYCOUNTRY_GB 1387 1.04 3.44 0.47 186 XMHTML_After_End 1384 0.51 0.67 0.47 187 XM_Walgreens_Forge 1341 0.42 0.24 0.46 188 FORGED_GMAIL_RCVD 1286 1.06 3.64 0.44 189 XMLngstWrd_03 1283 0.50 0.78 0.44 190 XMSubMetaSxObfu_03 1274 0.78 2.21 0.43 191 XMSlimDrugH 1270 0.43 0.42 0.43 192 URI_NOVOWEL 1262 0.41 0.33 0.43 193 XM_URI_RBL 1206 0.83 2.60 0.41 194 THIS_AD 1172 0.54 1.12 0.40 195 RELAYCOUNTRY_AU 1162 0.43 0.56 0.40 196 XMCapTrack 1144 0.35 0.16 0.39 197 PLING_QUERY 1115 0.47 0.84 0.38 198 XMPhish14 1091 0.37 0.35 0.37 199 T_TooManySym_04 1044 0.30 0.05 0.36 200 XMLngstWrd_04 1019 0.40 0.62 0.35 ----------------------------------------------------------------------