Email: 641825 Autolearn: 0 AvgScore: 1.42 AvgScanTime: 2.13 sec Spam: 105562 Autolearn: 0 AvgScore: 12.27 AvgScanTime: 2.87 sec Ham: 536263 Autolearn: 0 AvgScore: -0.71 AvgScanTime: 1.99 sec Time Spent Running SA: 380.08 hours Time Spent Processing Spam: 84.29 hours Time Spent Processing Ham: 295.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100302 89.11 95.02 87.95 2 DCC_CHECK 85179 51.05 80.69 45.21 3 DKIM_SIGNED 78588 77.06 74.45 77.57 4 XM_DK_Pass 75388 75.55 71.42 76.37 5 XM_B_Unicode 71851 70.47 68.07 70.94 6 XMListUnsubscribeExists 71289 56.52 67.53 54.36 7 DKIM_VALID 70368 71.83 66.66 72.85 8 DKIM_VALID_AU 53747 54.02 50.92 54.63 9 BAYES_50 51655 53.54 48.93 54.45 10 XM_B_Unicode3 46539 41.96 44.09 41.54 11 MIME_HTML_ONLY 40016 23.04 37.91 20.12 12 HTML_FONT_LOW_CONTRAST 34362 30.08 32.55 29.59 13 XM_DK_Undo_02 33978 9.99 32.19 5.62 14 LOC_TINY_FONT_1 33266 25.81 31.51 24.69 15 RELAYCOUNTRY_META 28073 8.96 26.59 5.49 16 FVGT_m_MULTI_ODD 26159 22.55 24.78 22.11 17 XMSubLong 26124 23.31 24.75 23.03 18 DKIM_VALID_EF 25949 26.25 24.58 26.58 19 BOTNET 23540 5.66 22.30 2.38 20 T_KAM_HTML_FONT_INVALID 21800 19.21 20.65 18.93 21 XM_Body_Dirty_Words 21576 14.87 20.44 13.78 22 BAYES_99 21267 5.28 20.15 2.36 23 T_TM2_M_HEADER_IN_MSG 20610 28.11 19.52 29.80 24 FSL_BULK_SIG 19769 9.28 18.73 7.42 25 BOTNET_IPINHOSTNAME 19615 7.26 18.58 5.03 26 HTML_IMAGE_RATIO_02 19611 10.57 18.58 8.99 27 MultiRelay 18645 18.02 17.66 18.09 28 DCC_CHECK_NEGATIVE 18038 46.83 17.09 52.69 29 XM_Multi_Part_URI 17826 12.82 16.89 12.03 30 TR_DCC_Bayes_99 16736 3.45 15.85 1.01 31 XM_UncommonTLD01 16523 5.33 15.65 3.30 32 BAYES_999 15921 4.03 15.08 1.86 33 UNTRUSTED_Relay 15862 3.87 15.03 1.68 34 XM_Evil_Numbers_Gen 13365 9.99 12.66 9.46 35 LOTS_OF_MONEY 12210 9.62 11.57 9.23 36 XMSexyCombo_05 12141 5.68 11.50 4.53 37 SpammyFromTLD_02 11051 2.07 10.47 0.42 38 HTML_MIME_NO_HTML_TAG 10367 3.57 9.82 2.33 39 T_XMDrugObfuBody_14 9727 9.07 9.21 9.04 40 XM_H_Long_From01 9622 6.84 9.12 6.39 41 XM_UB50 9396 2.22 8.90 0.91 42 XMSubMetaSx_00 8885 5.26 8.42 4.64 43 LotsOfNums_01 8594 8.52 8.14 8.59 44 MPART_ALT_DIFF 8328 4.33 7.89 3.63 45 DKIM_INVALID 8220 5.22 7.79 4.72 46 KHOP_HELO_FCRDNS 8023 2.91 7.60 1.99 47 XM_B_Phish_Phrases 7455 6.56 7.06 6.46 48 TooManyTo_001 7360 7.99 6.97 8.19 49 HTML_SHORT_LINK_IMG_1 7296 1.16 6.91 0.03 50 T_REMOTE_IMAGE 7229 4.24 6.85 3.72 51 RELAYCOUNTRY_GB 6599 2.00 6.25 1.16 52 MIME_HTML_MOSTLY 6498 3.25 6.16 2.67 53 HTML_IMAGE_RATIO_04 6375 5.76 6.04 5.71 54 BAYES_40 6109 6.21 5.79 6.30 55 XM_DIRTYINTL 6003 3.55 5.69 3.12 56 RDNS_DYNAMIC 5975 1.22 5.66 0.34 57 FROM_MISSP_REPLYTO 5905 0.92 5.59 0.01 58 XMNumbers 5897 4.37 5.59 4.13 59 XM_B_SpammyTLD 5802 3.90 5.50 3.59 60 MIME_QP_LONG_LINE 5685 6.28 5.39 6.46 61 XM_BadFromFormat 5648 0.99 5.35 0.13 62 BAYES_80 5556 2.61 5.26 2.08 63 RCVD_IN_MSPIKE_H2 5177 6.69 4.90 7.04 64 BOTNET_NORDNS 5061 0.82 4.79 0.04 65 BAYES_00 5011 18.54 4.75 21.26 66 XM_SPF_SoftFail 5008 2.43 4.74 1.98 67 BAYES_60 4985 4.16 4.72 4.05 68 HTML_IMAGE_RATIO_06 4894 4.19 4.64 4.10 69 TR_Mismatch_TLD_02 4877 0.82 4.62 0.07 70 BAYES_20 4790 4.89 4.54 4.97 71 HDRS_LCASE_IMGONLY 4633 0.76 4.39 0.04 72 XM_URI_RBL 4601 0.98 4.36 0.31 73 T_HTML_TAG_BALANCE_CENTER 4518 0.89 4.28 0.22 74 MIME_HTML_ONLY_MULTI 4506 2.18 4.27 1.77 75 BODY_URI_ONLY 4499 0.77 4.26 0.08 76 TM2_M_URI_OPT_OUT 4358 2.15 4.13 1.76 77 RCVD_IN_BL_SPAMCOP_NET 4323 1.41 4.10 0.88 78 URI_HEX 4072 2.41 3.86 2.13 79 TO_NO_BRKTS_DYNIP 3984 0.62 3.77 0.00 80 RELAYCOUNTRY_CA 3974 1.94 3.76 1.59 81 MultiRelay_CC 3967 0.81 3.76 0.23 82 MultiRelay_Combo 3967 0.81 3.76 0.23 83 REPLYTO_WITHOUT_TO_CC 3939 0.65 3.73 0.04 84 HTML_IMAGE_ONLY_12 3844 0.75 3.64 0.18 85 HTML_IMAGE_ONLY_08 3837 0.69 3.63 0.11 86 RELAYCOUNTRY_IN 3752 0.71 3.55 0.16 87 T_TooManySym_01 3717 5.89 3.52 6.35 88 MIME_HEADER_CTYPE_ONLY 3699 0.67 3.50 0.11 89 XM_SendGrid 3662 5.91 3.47 6.39 90 XMStrtUSub 3445 3.74 3.26 3.83 91 XM_CamelCaseFrm001 3327 2.27 3.15 2.10 92 XMDiploma_00 3314 1.92 3.14 1.68 93 XMBdyGiftCard01 3232 1.63 3.06 1.35 94 FROM_MISSP_DYNIP 3169 0.49 3.00 0.00 95 NO_DNS_FOR_FROM 3130 1.43 2.97 1.13 96 RCVD_IN_RP_RNBL 3129 0.53 2.96 0.05 97 BAYES_95 3054 1.44 2.89 1.15 98 RELAYCOUNTRY_FR 2996 0.74 2.84 0.33 99 HTML_IMAGE_RATIO_08 2975 2.37 2.82 2.28 100 BAYES_05 2900 3.07 2.75 3.13 101 TO_EQ_FM_DOM_HTML_IMG 2896 0.46 2.74 0.01 102 T_XMDrugObfuBody_08 2849 1.76 2.70 1.58 103 XMSexyCombo_01 2769 0.99 2.62 0.67 104 SpammyFromTLD_01 2746 1.15 2.60 0.86 105 FROM_EXCESS_BASE64 2714 3.17 2.57 3.29 106 XMGenDplmaNmb 2651 1.31 2.51 1.07 107 RCVD_IN_IADB_LISTED 2604 5.00 2.47 5.49 108 TR_XM_PHPDW 2559 0.98 2.42 0.70 109 T_XMHurry_00 2522 0.99 2.39 0.72 110 XM_OfRef6 2519 1.81 2.39 1.69 111 TR_XM_PHPForged 2501 0.96 2.37 0.68 112 DATE_IN_PAST_03_06 2500 0.50 2.37 0.13 113 TR_XM_FormFill2 2483 0.95 2.35 0.67 114 XM_H_PHPOS 2472 0.94 2.34 0.67 115 HTML_EXTRA_CLOSE 2457 0.40 2.33 0.02 116 RCVD_IN_IADB_SPF 2452 4.40 2.32 4.81 117 RCVD_IN_IADB_DK 2406 3.87 2.28 4.18 118 RCVD_IN_IADB_SENDERID 2401 3.93 2.27 4.26 119 DKIM_ADSP_NXDOMAIN 2322 0.82 2.20 0.55 120 TM2_M_VERY_LONG_WORD 2280 1.40 2.16 1.25 121 XMSubMetaI_00 2216 1.52 2.10 1.41 122 RCVD_IN_MSPIKE_WL 2175 4.61 2.06 5.12 123 TR_Symld_Words 2174 1.64 2.06 1.56 124 XMPhish11 2110 1.29 2.00 1.15 125 T_XMDrugObfuBody_00 2051 1.04 1.94 0.87 126 XMSubGiftCard1 2033 0.35 1.93 0.04 127 FROM_SUSPICIOUS_NTLD 2031 0.36 1.92 0.06 128 DATE_IN_PAST_06_12 2016 0.38 1.91 0.07 129 XMSubGiftCard2 1979 0.32 1.87 0.01 130 FROM_SUSPICIOUS_NTLD_FP 1969 0.35 1.87 0.05 131 DOS_RCVD_IP_TWICE_B 1956 0.36 1.85 0.06 132 SUBJ_ALL_CAPS 1880 1.65 1.78 1.63 133 ALL_TRUSTED 1857 12.46 1.76 14.57 134 TR_XM_RelayPhish 1838 1.50 1.74 1.45 135 TR_XM_DK_SendGrid 1801 3.17 1.71 3.45 136 RCVD_IN_MSPIKE_H3 1783 3.65 1.69 4.04 137 XMStockSpam_06 1731 1.38 1.64 1.33 138 MAILING_LIST_MULTI 1714 2.13 1.62 2.23 139 XM_DK_Undo_01 1664 1.51 1.58 1.49 140 RCVD_IN_PSBL 1654 0.34 1.57 0.10 141 TR_XM_DK_Bayes 1602 15.09 1.52 17.76 142 XMBrknScrpt_02 1597 0.79 1.51 0.64 143 XMBody_17 1585 0.95 1.50 0.84 144 RCVD_IN_RP_SAFE 1582 9.05 1.50 10.54 145 XM_H_PHPMailer 1580 0.71 1.50 0.56 146 XMMoneyMeta_00 1506 0.71 1.43 0.57 147 TR_XM_INV_DKIM 1504 0.33 1.42 0.12 148 TR_XM_DK_Bayes1 1423 14.38 1.35 16.95 149 XM_Combo_Sbj 1392 0.49 1.32 0.32 150 HK_RANDOM_REPLYTO 1377 0.41 1.30 0.23 151 XM_H_PHPOS_M 1363 0.40 1.29 0.22 152 XMPhish30 1360 0.84 1.29 0.75 153 RELAYCOUNTRY_AT 1347 0.39 1.28 0.22 154 XM_ProductURIs 1317 1.02 1.25 0.98 155 DIET_1 1295 0.49 1.23 0.34 156 XM_UB60 1280 0.25 1.21 0.06 157 UNPARSEABLE_RELAY 1277 2.12 1.21 2.30 158 T_Symld_Words_02 1276 0.83 1.21 0.76 159 T_MONEY_PERCENT 1271 0.78 1.20 0.69 160 TR_LOTS_OF_MONEY2 1271 0.78 1.20 0.69 161 XMHTML_After_End 1249 1.06 1.18 1.04 162 XM_H_Long_From02 1248 1.44 1.18 1.49 163 LONG_HEX_URI 1222 0.35 1.16 0.19 164 XM_UB99 1188 0.19 1.13 0.01 165 URI_TRY_3LD 1155 1.30 1.09 1.34 166 T_TooManySym_02 1113 2.10 1.05 2.30 167 TR_LOTS_OF_MONEY3 1113 0.75 1.05 0.68 168 MPART_ALT_DIFF_COUNT 1086 0.43 1.03 0.31 169 HELO_NODOT 1075 1.49 1.02 1.58 170 NORDNS_LOW_CONTRAST 1074 0.17 1.02 0.01 171 HELO_NO_DOMAIN 1068 1.49 1.01 1.58 172 TM2_M_A_HREF_HREF 1059 0.53 1.00 0.44 173 RELAYCOUNTRY_IE 1014 0.32 0.96 0.19 174 TooManyTo_002 998 1.97 0.95 2.17 175 HTML_TAG_BALANCE_BODY 985 0.69 0.93 0.64 176 TR_XM_DK_Bayes2 945 12.44 0.90 14.71 177 SUBJ_OBFU_PUNCT_FEW 944 0.24 0.89 0.11 178 XMNoVowels 929 0.65 0.88 0.60 179 LongTLD 924 0.29 0.88 0.17 180 HDRS_MISSP 922 0.16 0.87 0.02 181 T_FILL_THIS_FORM_SHORT 919 0.87 0.87 0.87 182 DKIM_ADSP_CUSTOM_MED 912 0.96 0.86 0.98 183 XMSubMetaSxObfu_03 889 0.54 0.84 0.48 184 FSL_THIS_IS_ADV 884 0.44 0.84 0.36 185 XM_PDF 883 3.90 0.84 4.51 186 RELAYCOUNTRY_DE 880 0.45 0.83 0.37 187 REMOVE_BEFORE_LINK 873 0.46 0.83 0.38 188 URIBL_BLACK 871 0.15 0.83 0.02 189 RELAYCOUNTRY_AU 863 0.57 0.82 0.52 190 XMBody_78 849 0.66 0.80 0.63 191 XM_UB999 821 0.13 0.78 0.00 192 FILL_THIS_FORM 815 0.58 0.77 0.54 193 XMSubMetaSSx_00 787 0.29 0.75 0.20 194 XMSexyCombo_04 785 0.24 0.74 0.14 195 TooManyTo_003 781 1.31 0.74 1.43 196 FORGED_GMAIL_RCVD 780 0.52 0.74 0.47 197 RCVD_IN_IADB_VOUCHED 778 2.97 0.74 3.41 198 XM_SPF_Unknown 767 0.67 0.73 0.66 199 NML_ADSP_CUSTOM_MED 755 0.70 0.72 0.70 200 XM_OfRef7 747 0.26 0.71 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 471638 89.11 95.02 87.95 2 DKIM_SIGNED 415975 77.06 74.45 77.57 3 XM_DK_Pass 409519 75.55 71.42 76.37 4 DKIM_VALID 390672 71.83 66.66 72.85 5 XM_B_Unicode 380440 70.47 68.07 70.94 6 DKIM_VALID_AU 292948 54.02 50.92 54.63 7 BAYES_50 292002 53.54 48.93 54.45 8 XMListUnsubscribeExists 291489 56.52 67.53 54.36 9 DCC_CHECK_NEGATIVE 282541 46.83 17.09 52.69 10 DCC_CHECK 242443 51.05 80.69 45.21 11 XM_B_Unicode3 222743 41.96 44.09 41.54 12 T_TM2_M_HEADER_IN_MSG 159818 28.11 19.52 29.80 13 HTML_FONT_LOW_CONTRAST 158680 30.08 32.55 29.59 14 DKIM_VALID_EF 142535 26.25 24.58 26.58 15 LOC_TINY_FONT_1 132390 25.81 31.51 24.69 16 XMSubLong 123477 23.31 24.75 23.03 17 FVGT_m_MULTI_ODD 118579 22.55 24.78 22.11 18 BAYES_00 113995 18.54 4.75 21.26 19 MIME_HTML_ONLY 107881 23.04 37.91 20.12 20 T_KAM_HTML_FONT_INVALID 101499 19.21 20.65 18.93 21 MultiRelay 97012 18.02 17.66 18.09 22 TR_XM_DK_Bayes 95219 15.09 1.52 17.76 23 TR_XM_DK_Bayes1 90885 14.38 1.35 16.95 24 TR_XM_DK_Bayes2 78893 12.44 0.90 14.71 25 ALL_TRUSTED 78127 12.46 1.76 14.57 26 XM_Body_Dirty_Words 73895 14.87 20.44 13.78 27 XM_Multi_Part_URI 64486 12.82 16.89 12.03 28 RCVD_IN_RP_SAFE 56504 9.05 1.50 10.54 29 XM_Evil_Numbers_Gen 50731 9.99 12.66 9.46 30 RCVD_IN_RP_CERTIFIED 50098 7.90 0.58 9.34 31 LOTS_OF_MONEY 49521 9.62 11.57 9.23 32 T_XMDrugObfuBody_14 48477 9.07 9.21 9.04 33 HTML_IMAGE_RATIO_02 48228 10.57 18.58 8.99 34 LotsOfNums_01 46063 8.52 8.14 8.59 35 TooManyTo_001 43945 7.99 6.97 8.19 36 FSL_BULK_SIG 39776 9.28 18.73 7.42 37 XM_DKIMWhitelistDomains 38687 6.04 0.05 7.21 38 RCVD_IN_MSPIKE_H2 37768 6.69 4.90 7.04 39 MIME_QP_LONG_LINE 34650 6.28 5.39 6.46 40 XM_B_Phish_Phrases 34617 6.56 7.06 6.46 41 XM_SendGrid 34274 5.91 3.47 6.39 42 XM_H_Long_From01 34256 6.84 9.12 6.39 43 T_TooManySym_01 34060 5.89 3.52 6.35 44 BAYES_40 33774 6.21 5.79 6.30 45 HTML_IMAGE_RATIO_04 30608 5.76 6.04 5.71 46 XM_DK_Undo_02 30130 9.99 32.19 5.62 47 RCVD_IN_IADB_LISTED 29456 5.00 2.47 5.49 48 RELAYCOUNTRY_META 29452 8.96 26.59 5.49 49 RCVD_IN_MSPIKE_WL 27433 4.61 2.06 5.12 50 BOTNET_IPINHOSTNAME 26978 7.26 18.58 5.03 51 BAYES_20 26626 4.89 4.54 4.97 52 RCVD_IN_IADB_SPF 25778 4.40 2.32 4.81 53 DKIM_INVALID 25303 5.22 7.79 4.72 54 XMSubMetaSx_00 24878 5.26 8.42 4.64 55 XMSexyCombo_05 24288 5.68 11.50 4.53 56 XM_PDF 24172 3.90 0.84 4.51 57 RCVD_IN_IADB_SENDERID 22826 3.93 2.27 4.26 58 RCVD_IN_IADB_DK 22419 3.87 2.28 4.18 59 XMNumbers 22139 4.37 5.59 4.13 60 HTML_IMAGE_RATIO_06 21989 4.19 4.64 4.10 61 BAYES_60 21719 4.16 4.72 4.05 62 RCVD_IN_MSPIKE_H3 21660 3.65 1.69 4.04 63 XMStrtUSub 20540 3.74 3.26 3.83 64 T_REMOTE_IMAGE 19961 4.24 6.85 3.72 65 MPART_ALT_DIFF 19478 4.33 7.89 3.63 66 XM_B_SpammyTLD 19248 3.90 5.50 3.59 67 IN_ZIMBRA_NJ_WHITELIST 18638 2.91 0.02 3.48 68 TR_XM_DK_SendGrid 18515 3.17 1.71 3.45 69 RCVD_IN_IADB_VOUCHED 18268 2.97 0.74 3.41 70 XM_UncommonTLD01 17676 5.33 15.65 3.30 71 FROM_EXCESS_BASE64 17617 3.17 2.57 3.29 72 BAYES_05 16781 3.07 2.75 3.13 73 XM_DIRTYINTL 16752 3.55 5.69 3.12 74 TO_MALFORMED 14425 2.25 0.02 2.69 75 MIME_HTML_MOSTLY 14343 3.25 6.16 2.67 76 BOTNET 12756 5.66 22.30 2.38 77 BAYES_99 12640 5.28 20.15 2.36 78 HTML_MIME_NO_HTML_TAG 12517 3.57 9.82 2.33 79 UNPARSEABLE_RELAY 12358 2.12 1.21 2.30 80 T_TooManySym_02 12340 2.10 1.05 2.30 81 HTML_IMAGE_RATIO_08 12224 2.37 2.82 2.28 82 MAILING_LIST_MULTI 11971 2.13 1.62 2.23 83 TooManyTo_002 11646 1.97 0.95 2.17 84 RCVD_IN_IADB_OPTIN 11520 1.88 0.54 2.15 85 URI_HEX 11409 2.41 3.86 2.13 86 XM_CamelCaseFrm001 11270 2.27 3.15 2.10 87 BAYES_80 11181 2.61 5.26 2.08 88 KHOP_HELO_FCRDNS 10679 2.91 7.60 1.99 89 XM_SPF_SoftFail 10609 2.43 4.74 1.98 90 TVD_RCVD_IP 10386 1.70 0.49 1.94 91 BAYES_999 9950 4.03 15.08 1.86 92 ANY_BOUNCE_MESSAGE 9838 1.62 0.51 1.83 93 BOUNCE_MESSAGE 9832 1.62 0.51 1.83 94 MIME_HTML_ONLY_MULTI 9484 2.18 4.27 1.77 95 TM2_M_URI_OPT_OUT 9448 2.15 4.13 1.76 96 XM_OfRef6 9076 1.81 2.39 1.69 97 XMDiploma_00 9028 1.92 3.14 1.68 98 UNTRUSTED_Relay 9004 3.87 15.03 1.68 99 SUBJ_ALL_CAPS 8742 1.65 1.78 1.63 100 RELAYCOUNTRY_CA 8501 1.94 3.76 1.59 101 HELO_NODOT 8477 1.49 1.02 1.58 102 HELO_NO_DOMAIN 8476 1.49 1.01 1.58 103 T_XMDrugObfuBody_08 8458 1.76 2.70 1.58 104 TR_Symld_Words 8364 1.64 2.06 1.56 105 CK_HELO_DYNAMIC_SPLIT_IP 8311 1.36 0.42 1.55 106 HELO_DYNAMIC_IPADDR2 8278 1.31 0.12 1.54 107 TR_MetaPhish_Combo_01 8225 1.39 0.63 1.53 108 IN_HORDE_ADDRESS_BOOK 8104 1.27 0.03 1.51 109 XM_DK_Undo_01 8006 1.51 1.58 1.49 110 XM_H_Long_From02 7984 1.44 1.18 1.49 111 TR_XM_RelayPhish 7783 1.50 1.74 1.45 112 XMGappySubj_01 7696 1.26 0.34 1.44 113 TooManyTo_003 7654 1.31 0.74 1.43 114 XMSubMetaI_00 7550 1.52 2.10 1.41 115 INVALID_MSGID 7504 1.23 0.37 1.40 116 XMBdyGiftCard01 7243 1.63 3.06 1.35 117 URI_TRY_3LD 7197 1.30 1.09 1.34 118 XMStockSpam_06 7124 1.38 1.64 1.33 119 XMCapTrack 6990 1.15 0.36 1.30 120 TM2_M_VERY_LONG_WORD 6684 1.40 2.16 1.25 121 RELAYCOUNTRY_GB 6245 2.00 6.25 1.16 122 BAYES_95 6169 1.44 2.89 1.15 123 XMPhish11 6148 1.29 2.00 1.15 124 NO_DNS_FOR_FROM 6070 1.43 2.97 1.13 125 USER_IN_DEF_DKIM_WL 5783 0.90 0.01 1.08 126 XMGenDplmaNmb 5755 1.31 2.51 1.07 127 TooManyTo_004 5653 0.98 0.63 1.05 128 XM_GoogleGroups 5582 0.97 0.59 1.04 129 XMHTML_After_End 5562 1.06 1.18 1.04 130 TR_DCC_Bayes_99 5428 3.45 15.85 1.01 131 XM_ProductURIs 5260 1.02 1.25 0.98 132 DKIM_ADSP_CUSTOM_MED 5250 0.96 0.86 0.98 133 XM_UB50 4854 2.22 8.90 0.91 134 RCVD_IN_BL_SPAMCOP_NET 4744 1.41 4.10 0.88 135 T_XMDrugObfuBody_00 4653 1.04 1.94 0.87 136 T_FILL_THIS_FORM_SHORT 4639 0.87 0.87 0.87 137 SpammyFromTLD_01 4615 1.15 2.60 0.86 138 TooManyTo_005 4601 0.80 0.53 0.86 139 XMBody_17 4522 0.95 1.50 0.84 140 T_Symld_Words_02 4081 0.83 1.21 0.76 141 XMPhish30 4006 0.84 1.29 0.75 142 T_XMHurry_00 3848 0.99 2.39 0.72 143 NML_ADSP_CUSTOM_MED 3768 0.70 0.72 0.70 144 TR_XM_PHPDW 3742 0.98 2.42 0.70 145 TR_LOTS_OF_MONEY2 3723 0.78 1.20 0.69 146 T_MONEY_PERCENT 3723 0.78 1.20 0.69 147 RCVD_IN_MSPIKE_H5 3685 0.59 0.12 0.69 148 TR_LOTS_OF_MONEY3 3670 0.75 1.05 0.68 149 TR_XM_PHPForged 3629 0.96 2.37 0.68 150 TR_XM_FormFill2 3603 0.95 2.35 0.67 151 XMSexyCombo_01 3590 0.99 2.62 0.67 152 XM_H_PHPOS 3579 0.94 2.34 0.67 153 FROM_GOV_DKIM_AU 3552 0.58 0.18 0.66 154 XM_SPF_Unknown 3516 0.67 0.73 0.66 155 XMSubMetaSxObfu_02 3490 0.61 0.38 0.65 156 HTML_TAG_BALANCE_BODY 3457 0.69 0.93 0.64 157 XMBrknScrpt_02 3450 0.79 1.51 0.64 158 XMBody_78 3400 0.66 0.80 0.63 159 XM_B_REG_HTML 3383 0.58 0.34 0.63 160 XMBody_95 3306 0.54 0.18 0.62 161 XMNoVowels 3243 0.65 0.88 0.60 162 T_OBFU_PDF_ATTACH 3236 0.54 0.24 0.60 163 HTML_FONT_FACE_BAD 3146 0.60 0.69 0.59 164 HTTPS_HTTP_MISMATCH 3097 0.60 0.71 0.58 165 XMMoneyMeta_00 3054 0.71 1.43 0.57 166 XMGappySubj_02 3008 0.49 0.10 0.56 167 XM_H_PHPMailer 2984 0.71 1.50 0.56 168 SUBJ_DOLLARS 2976 0.51 0.31 0.55 169 DKIM_ADSP_NXDOMAIN 2933 0.82 2.20 0.55 170 FILL_THIS_FORM 2922 0.58 0.77 0.54 171 URI_NOVOWEL 2920 0.53 0.45 0.54 172 T_TooManySym_03 2799 0.50 0.42 0.52 173 RELAYCOUNTRY_AU 2778 0.57 0.82 0.52 174 XMHTMLBadTable_001 2698 0.53 0.65 0.50 175 PLING_QUERY 2679 0.53 0.70 0.50 176 XM_ShortIntro_01 2626 0.48 0.41 0.49 177 FROM_GOV_SPOOF 2595 0.47 0.42 0.48 178 XMSubMetaSxObfu_03 2589 0.54 0.84 0.48 179 FORGED_GMAIL_RCVD 2543 0.52 0.74 0.47 180 USER_IN_WHITELIST 2536 0.40 0.00 0.47 181 FILL_THIS_FORM_LONG 2484 0.49 0.64 0.46 182 XMLngstWrd_00 2468 0.48 0.61 0.46 183 TM2_M_BODY_EMPTY 2405 0.39 0.09 0.45 184 XM_RXBody 2370 0.42 0.30 0.44 185 XM_Ancestry_Forge 2353 0.37 0.03 0.44 186 TM2_M_A_HREF_HREF 2346 0.53 1.00 0.44 187 XMLngstWrd_01 2319 0.46 0.59 0.43 188 SpammyFromTLD_02 2261 2.07 10.47 0.42 189 SHORT_HELO_AND_INLINE_IMAGE 2231 0.37 0.17 0.42 190 XMBSHREFv2 2224 0.44 0.57 0.41 191 MISSING_HEADERS 2147 0.44 0.64 0.40 192 RCVD_IN_MSPIKE_H4 2088 0.37 0.25 0.39 193 REMOVE_BEFORE_LINK 2051 0.46 0.83 0.38 194 HTML_IMAGE_ONLY_32 2041 0.37 0.32 0.38 195 URIBL_SBL_A 2039 0.41 0.54 0.38 196 XMPhish14 2032 0.43 0.68 0.38 197 RELAYCOUNTRY_DE 1988 0.45 0.83 0.37 198 XM_Body_Obfu01 1988 0.40 0.52 0.37 199 HTML_IMAGE_ONLY_28 1988 0.36 0.30 0.37 200 XM_B_COPY_HTML 1984 0.41 0.63 0.37 ----------------------------------------------------------------------