Email: 401650 Autolearn: 0 AvgScore: 1.78 AvgScanTime: 2.10 sec Spam: 76584 Autolearn: 0 AvgScore: 13.12 AvgScanTime: 2.62 sec Ham: 325066 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.98 sec Time Spent Running SA: 234.50 hours Time Spent Processing Spam: 55.83 hours Time Spent Processing Ham: 178.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 69499 80.72 90.75 78.35 2 DCC_CHECK 58330 53.17 76.16 47.75 3 DKIM_SIGNED 56634 74.75 73.95 74.94 4 XM_DK_Pass 54702 73.50 71.43 73.99 5 DKIM_VALID 51422 70.47 67.14 71.25 6 XM_B_Unicode 50919 68.64 66.49 69.15 7 XMListUnsubscribeExists 49721 57.42 64.92 55.65 8 DKIM_VALID_AU 41191 57.00 53.79 57.76 9 BAYES_50 35988 53.22 46.99 54.69 10 XM_B_Unicode3 33516 42.91 43.76 42.71 11 HTML_FONT_LOW_CONTRAST 29355 32.78 38.33 31.47 12 XM_DK_Undo_02 26309 12.22 34.35 7.01 13 LOC_TINY_FONT_1 26040 28.86 34.00 27.65 14 MIME_HTML_ONLY 25537 24.42 33.35 22.32 15 DKIM_VALID_EF 19020 26.03 24.84 26.31 16 XM_Body_Dirty_Words 18864 17.39 24.63 15.69 17 FVGT_m_MULTI_ODD 18648 21.49 24.35 20.82 18 BAYES_99 18366 8.07 23.98 4.32 19 XMSubLong 17652 22.85 23.05 22.81 20 RELAYCOUNTRY_META 17113 7.77 22.35 4.34 21 DCC_CHECK_NEGATIVE 16608 45.50 21.69 51.11 22 MultiRelay 16168 16.01 21.11 14.81 23 BOTNET 16161 5.72 21.10 2.10 24 BOTNET_IPINHOSTNAME 15931 8.66 20.80 5.80 25 XM_UncommonTLD01 14606 6.56 19.07 3.62 26 BAYES_999 13937 6.18 18.20 3.35 27 TR_DCC_Bayes_99 13781 4.90 17.99 1.82 28 XM_Multi_Part_URI 13322 14.11 17.40 13.33 29 FSL_BULK_SIG 13078 9.28 17.08 7.44 30 T_KAM_HTML_FONT_INVALID 12186 15.92 15.91 15.93 31 T_TM2_M_HEADER_IN_MSG 11927 21.33 15.57 22.69 32 LOTS_OF_MONEY 11852 10.49 15.48 9.31 33 HTML_IMAGE_RATIO_02 11532 11.56 15.06 10.73 34 XM_B_Unsub 11289 10.77 14.74 9.83 35 UNTRUSTED_Relay 10748 3.90 14.03 1.51 36 TooManyTo_001 10212 14.31 13.33 14.54 37 XMSexyCombo_05 9622 6.14 12.56 4.63 38 SpammyFromTLD_02 8661 2.36 11.31 0.25 39 XM_B_SpammyTLD 8455 6.73 11.04 5.71 40 XM_H_Long_From01 8100 7.21 10.58 6.41 41 T_XMDrugObfuBody_14 7122 7.51 9.30 7.09 42 XM_Evil_Numbers_Gen 7118 9.80 9.29 9.92 43 MPART_ALT_DIFF 6964 5.33 9.09 4.45 44 HTML_IMAGE_RATIO_04 6554 7.17 8.56 6.84 45 XM_UB50 6217 2.22 8.12 0.83 46 XM_DIRTYINTL 5753 4.17 7.51 3.39 47 XMSubMetaSx_00 5606 5.27 7.32 4.79 48 DKIM_INVALID 5212 4.28 6.81 3.69 49 MIME_HTML_MOSTLY 5010 4.01 6.54 3.42 50 BAYES_60 4965 7.18 6.48 7.34 51 BAYES_80 4939 4.29 6.45 3.78 52 RCVD_IN_BL_SPAMCOP_NET 4789 2.13 6.25 1.16 53 HTML_MIME_NO_HTML_TAG 4598 2.50 6.00 1.67 54 FROM_SUSPICIOUS_NTLD 4570 1.16 5.97 0.03 55 FROM_SUSPICIOUS_NTLD_FP 4543 1.15 5.93 0.03 56 RCVD_IN_RP_RNBL 4536 1.16 5.92 0.04 57 LotsOfNums_01 4450 7.04 5.81 7.32 58 XM_B_Phish_Phrases 4319 6.33 5.64 6.50 59 US_DOLLARS_3 4279 2.80 5.59 2.14 60 SUBJ_ALL_CAPS 4274 2.30 5.58 1.52 61 KHOP_HELO_FCRDNS 4238 2.02 5.53 1.20 62 XMNumbers 4204 4.11 5.49 3.79 63 RCVD_IN_PSBL 4167 1.08 5.44 0.05 64 RCVD_IN_MSPIKE_H2 4090 5.92 5.34 6.06 65 MultiRelay_Combo 3990 1.16 5.21 0.21 66 MultiRelay_CC 3990 1.16 5.21 0.21 67 MIME_HTML_ONLY_MULTI 3928 2.57 5.13 1.96 68 URI_HEX 3613 2.58 4.72 2.07 69 XM_H_TOP 3487 0.88 4.55 0.01 70 RELAYCOUNTRY_CA 3446 2.22 4.50 1.69 71 FROM_MISSP_REPLYTO 3371 0.84 4.40 0.00 72 XM_SPF_SoftFail 3252 1.69 4.25 1.08 73 XM_SendGrid 3229 6.19 4.22 6.65 74 BAYES_40 3189 4.39 4.16 4.44 75 TR_Mismatch_TLD_02 3119 0.88 4.07 0.12 76 XM_CamelCaseFrm001 3106 2.72 4.06 2.41 77 TO_NO_BRKTS_FROM_MSSP 3086 0.78 4.03 0.01 78 MIME_QP_LONG_LINE 3077 4.20 4.02 4.24 79 T_REMOTE_IMAGE 3072 3.29 4.01 3.12 80 RELAYCOUNTRY_FR 3061 1.05 4.00 0.35 81 DKIM_ADSP_NXDOMAIN 3050 1.17 3.98 0.51 82 BAYES_95 2970 2.48 3.88 2.15 83 NORDNS_LOW_CONTRAST 2901 0.73 3.79 0.01 84 ALL_TRUSTED 2896 17.89 3.78 21.21 85 NO_DNS_FOR_FROM 2875 1.62 3.75 1.12 86 RDNS_DYNAMIC 2823 1.04 3.69 0.42 87 HTML_IMAGE_RATIO_06 2813 3.45 3.67 3.40 88 BAYES_20 2775 3.47 3.62 3.43 89 XMStrtUSub 2702 4.53 3.53 4.76 90 TooManyTo_002 2668 8.51 3.48 9.69 91 TooManyTo_003 2502 8.22 3.27 9.39 92 XMBody_17 2488 1.21 3.25 0.73 93 THIS_AD 2248 1.01 2.94 0.55 94 XM_OfRef6 2166 1.53 2.83 1.23 95 BOTNET_NORDNS 2151 0.55 2.81 0.02 96 TR_XM_PHPDW 2123 1.04 2.77 0.64 97 FROM_EXCESS_BASE64 2098 3.93 2.74 4.21 98 TR_XM_PHPForged 2059 1.02 2.69 0.62 99 XM_URI_RBL 2050 0.81 2.68 0.37 100 TR_XM_FormFill2 2046 1.00 2.67 0.61 101 XM_H_PHPOS 2040 1.00 2.66 0.60 102 T_TooManySym_01 2038 6.65 2.66 7.59 103 XMSexyCombo_01 1960 1.53 2.56 1.29 104 XMDiploma_00 1956 1.54 2.55 1.31 105 SpammyFromTLD_01 1942 0.97 2.54 0.60 106 TM2_M_URI_OPT_OUT 1893 1.57 2.47 1.35 107 XMSubMetaI_00 1858 1.12 2.43 0.81 108 FROM_MISSP_EH_MATCH 1855 0.47 2.42 0.01 109 BAYES_00 1821 14.43 2.38 17.27 110 TR_XM_DK_SendGrid 1770 3.61 2.31 3.92 111 UNPARSEABLE_RELAY 1767 3.11 2.31 3.29 112 XM_BadFromFormat 1740 0.53 2.27 0.12 113 RCVD_IN_RP_SAFE 1735 11.71 2.27 13.94 114 DATE_IN_PAST_24_48 1586 0.41 2.07 0.02 115 TM2_M_VERY_LONG_WORD 1570 1.97 2.05 1.95 116 T_XMDrugObfuBody_00 1542 1.07 2.01 0.85 117 FSL_THIS_IS_ADV 1521 0.58 1.99 0.25 118 XM_H_PHPMailer 1516 0.89 1.98 0.63 119 SHORT_URI 1516 0.82 1.98 0.55 120 TR_Symld_Words 1474 1.55 1.92 1.46 121 XM_salutation 1467 0.81 1.92 0.54 122 HTML_IMAGE_RATIO_08 1459 1.93 1.91 1.93 123 XMStockSpam_06 1458 1.65 1.90 1.60 124 FROM_MISSP_DYNIP 1455 0.36 1.90 0.00 125 RCVD_IN_MSPIKE_WL 1440 4.70 1.88 5.36 126 XM_H_PHPOS_M 1435 0.63 1.87 0.34 127 XMGenDplmaNmb 1431 0.85 1.87 0.61 128 DKIM_ADSP_CUSTOM_MED 1427 0.92 1.86 0.69 129 TR_XM_RelayPhish 1424 1.44 1.86 1.34 130 BAYES_05 1377 2.19 1.80 2.28 131 NML_ADSP_CUSTOM_MED 1365 0.73 1.78 0.48 132 XMBdyGiftCard01 1350 2.21 1.76 2.32 133 URIBL_DBL_ABUSE_REDIR 1348 0.34 1.76 0.01 134 T_XMDrugObfuBody_08 1316 1.34 1.72 1.25 135 T_FILL_THIS_FORM_SHORT 1313 0.79 1.71 0.57 136 TR_LOTS_OF_MONEY2 1296 0.64 1.69 0.39 137 T_MONEY_PERCENT 1296 0.64 1.69 0.39 138 TR_XM_DK_Bayes 1286 13.13 1.68 15.83 139 TM2_M_A_HREF_HREF 1267 0.90 1.65 0.72 140 FORGED_GMAIL_RCVD 1249 0.63 1.63 0.39 141 TR_XM_INV_DKIM 1243 0.51 1.62 0.24 142 URI_TRY_3LD 1241 1.47 1.62 1.44 143 RELAYCOUNTRY_AT 1202 0.45 1.57 0.19 144 XM_OfRef7 1194 0.37 1.56 0.09 145 TR_XM_DK_Bayes1 1183 12.67 1.54 15.29 146 URIBL_DBL_SPAM 1170 0.36 1.53 0.08 147 DIET_1 1169 0.79 1.53 0.62 148 HK_SCAM 1147 0.29 1.50 0.01 149 MILLION_HUNDRED 1132 0.28 1.48 0.00 150 MSGID_SHORT 1109 0.28 1.45 0.01 151 RELAYCOUNTRY_CN 1103 0.30 1.44 0.03 152 SUBJ_DOLLARS 1084 0.64 1.42 0.45 153 XMPhish11 1070 0.94 1.40 0.84 154 XM_B_Unsub2 1061 1.11 1.39 1.04 155 FORGED_OUTLOOK_HTML 1044 0.26 1.36 0.00 156 RELAYCOUNTRY_NL 1013 0.36 1.32 0.14 157 XMBrknScrpt_02 1011 0.86 1.32 0.75 158 INVALID_MSGID 1009 2.13 1.32 2.32 159 RCVD_IN_IADB_LISTED 1003 3.41 1.31 3.90 160 RCVD_IN_MSPIKE_H3 976 3.42 1.27 3.93 161 MONEY_FRAUD_5 970 0.24 1.27 0.00 162 TR_Sbj_FN_Bdy 970 0.33 1.27 0.11 163 MONEY_FORM_SHORT 952 0.24 1.24 0.01 164 ADVANCE_FEE_4_NEW_MONEY 951 0.24 1.24 0.00 165 HTML_SHORT_LINK_IMG_1 950 0.26 1.24 0.02 166 FROM_MISSPACED 934 0.23 1.22 0.00 167 FORGED_MUA_OUTLOOK 923 0.26 1.21 0.03 168 TO_NO_BRKTS_MSFT 920 0.23 1.20 0.00 169 MONEY_ATM_CARD 920 0.23 1.20 0.00 170 FORM_FRAUD 918 0.23 1.20 0.00 171 FSL_NEW_HELO_USER 896 0.22 1.17 0.00 172 AXB_XMAILER_MIMEOLE_OL_1ECD5 896 0.22 1.17 0.00 173 TR_XM_DK_Bayes2 895 11.42 1.17 13.83 174 FROM_MISSP_XPRIO 890 0.22 1.16 0.00 175 FSL_CTYPE_WIN1251 890 0.22 1.16 0.00 176 FROM_MISSP_MSFT 890 0.22 1.16 0.00 177 T_LOTTO_AGENT 888 0.22 1.16 0.00 178 LOADSA_MONEY_COMBO 880 0.25 1.15 0.04 179 RCVD_IN_IADB_SPF 877 2.93 1.15 3.35 180 XMSubject_48 874 0.30 1.14 0.10 181 RCVD_IN_IADB_DK 861 2.53 1.12 2.86 182 RCVD_IN_IADB_SENDERID 861 2.60 1.12 2.94 183 XM_ProductURIs 858 2.15 1.12 2.40 184 RCVD_IN_RP_CERTIFIED 856 10.19 1.12 12.32 185 MONEY_FROM_MISSP 850 0.21 1.11 0.00 186 FORGED_OUTLOOK_TAGS 848 0.22 1.11 0.01 187 CK_HELO_DYNAMIC_SPLIT_IP 847 2.19 1.11 2.45 188 HDR_ORDER_FTSDMCXX_NORDNS 845 0.21 1.10 0.00 189 HTML_TAG_BALANCE_BODY 839 0.83 1.10 0.77 190 MPART_ALT_DIFF_COUNT 836 0.42 1.09 0.27 191 NSL_RCVD_FROM_USER 827 0.21 1.08 0.00 192 FROM_MISSP_USER 820 0.20 1.07 0.00 193 XM_Sams_Club_Forge 799 0.32 1.04 0.15 194 DATE_IN_PAST_03_06 795 0.30 1.04 0.13 195 RELAYCOUNTRY_IN 793 0.25 1.04 0.06 196 HTML_IMAGE_ONLY_08 786 0.26 1.03 0.08 197 MAILING_LIST_MULTI 780 1.82 1.02 2.01 198 RELAYCOUNTRY_GB 780 0.54 1.02 0.43 199 XMHTML_After_End 774 0.65 1.01 0.57 200 TooManyTo_004 773 0.69 1.01 0.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 254694 80.72 90.75 78.35 2 DKIM_SIGNED 243605 74.75 73.95 74.94 3 XM_DK_Pass 240522 73.50 71.43 73.99 4 DKIM_VALID 231613 70.47 67.14 71.25 5 XM_B_Unicode 224767 68.64 66.49 69.15 6 DKIM_VALID_AU 187766 57.00 53.79 57.76 7 XMListUnsubscribeExists 180901 57.42 64.92 55.65 8 BAYES_50 177788 53.22 46.99 54.69 9 DCC_CHECK_NEGATIVE 166133 45.50 21.69 51.11 10 DCC_CHECK 155208 53.17 76.16 47.75 11 XM_B_Unicode3 138832 42.91 43.76 42.71 12 HTML_FONT_LOW_CONTRAST 102300 32.78 38.33 31.47 13 LOC_TINY_FONT_1 89867 28.86 34.00 27.65 14 DKIM_VALID_EF 85530 26.03 24.84 26.31 15 XMSubLong 74137 22.85 23.05 22.81 16 T_TM2_M_HEADER_IN_MSG 73759 21.33 15.57 22.69 17 MIME_HTML_ONLY 72558 24.42 33.35 22.32 18 ALL_TRUSTED 68960 17.89 3.78 21.21 19 FVGT_m_MULTI_ODD 67670 21.49 24.35 20.82 20 BAYES_00 56133 14.43 2.38 17.27 21 T_KAM_HTML_FONT_INVALID 51770 15.92 15.91 15.93 22 TR_XM_DK_Bayes 51459 13.13 1.68 15.83 23 XM_Body_Dirty_Words 50997 17.39 24.63 15.69 24 TR_XM_DK_Bayes1 49699 12.67 1.54 15.29 25 MultiRelay 48141 16.01 21.11 14.81 26 TooManyTo_001 47257 14.31 13.33 14.54 27 RCVD_IN_RP_SAFE 45304 11.71 2.27 13.94 28 TR_XM_DK_Bayes2 44967 11.42 1.17 13.83 29 XM_Multi_Part_URI 43341 14.11 17.40 13.33 30 RCVD_IN_RP_CERTIFIED 40054 10.19 1.12 12.32 31 HTML_IMAGE_RATIO_02 34881 11.56 15.06 10.73 32 XM_Evil_Numbers_Gen 32247 9.80 9.29 9.92 33 XM_DKIMWhitelistDomains 32132 8.03 0.14 9.88 34 XM_B_Unsub 31949 10.77 14.74 9.83 35 TooManyTo_002 31514 8.51 3.48 9.69 36 TooManyTo_003 30508 8.22 3.27 9.39 37 LOTS_OF_MONEY 30262 10.49 15.48 9.31 38 T_TooManySym_01 24667 6.65 2.66 7.59 39 FSL_BULK_SIG 24187 9.28 17.08 7.44 40 BAYES_60 23855 7.18 6.48 7.34 41 LotsOfNums_01 23808 7.04 5.81 7.32 42 T_XMDrugObfuBody_14 23032 7.51 9.30 7.09 43 XM_DK_Undo_02 22788 12.22 34.35 7.01 44 HTML_IMAGE_RATIO_04 22236 7.17 8.56 6.84 45 XM_SendGrid 21619 6.19 4.22 6.65 46 XM_B_Phish_Phrases 21125 6.33 5.64 6.50 47 XM_H_Long_From01 20841 7.21 10.58 6.41 48 RCVD_IN_MSPIKE_H2 19697 5.92 5.34 6.06 49 BOTNET_IPINHOSTNAME 18845 8.66 20.80 5.80 50 XM_B_SpammyTLD 18557 6.73 11.04 5.71 51 RCVD_IN_MSPIKE_WL 17435 4.70 1.88 5.36 52 XMSubMetaSx_00 15577 5.27 7.32 4.79 53 XMStrtUSub 15481 4.53 3.53 4.76 54 XMSexyCombo_05 15052 6.14 12.56 4.63 55 MPART_ALT_DIFF 14459 5.33 9.09 4.45 56 BAYES_40 14433 4.39 4.16 4.44 57 TO_MALFORMED 14387 3.58 0.00 4.43 58 RELAYCOUNTRY_META 14094 7.77 22.35 4.34 59 BAYES_99 14040 8.07 23.98 4.32 60 MIME_QP_LONG_LINE 13794 4.20 4.02 4.24 61 FROM_EXCESS_BASE64 13693 3.93 2.74 4.21 62 RCVD_IN_MSPIKE_H3 12765 3.42 1.27 3.93 63 TR_XM_DK_SendGrid 12739 3.61 2.31 3.92 64 RCVD_IN_IADB_LISTED 12682 3.41 1.31 3.90 65 XMNumbers 12319 4.11 5.49 3.79 66 BAYES_80 12283 4.29 6.45 3.78 67 DKIM_INVALID 11992 4.28 6.81 3.69 68 XM_UncommonTLD01 11758 6.56 19.07 3.62 69 BAYES_20 11164 3.47 3.62 3.43 70 MIME_HTML_MOSTLY 11115 4.01 6.54 3.42 71 HTML_IMAGE_RATIO_06 11057 3.45 3.67 3.40 72 XM_DIRTYINTL 11013 4.17 7.51 3.39 73 RCVD_IN_IADB_SPF 10885 2.93 1.15 3.35 74 BAYES_999 10885 6.18 18.20 3.35 75 UNPARSEABLE_RELAY 10710 3.11 2.31 3.29 76 T_REMOTE_IMAGE 10154 3.29 4.01 3.12 77 T_TooManySym_02 9880 2.59 0.70 3.04 78 IN_ZIMBRA_NJ_WHITELIST 9583 2.39 0.01 2.95 79 RCVD_IN_IADB_SENDERID 9573 2.60 1.12 2.94 80 RCVD_IN_IADB_DK 9302 2.53 1.12 2.86 81 TVD_RCVD_IP 9191 2.39 0.55 2.83 82 RCVD_IN_IADB_VOUCHED 8593 2.21 0.38 2.64 83 CK_HELO_DYNAMIC_SPLIT_IP 7969 2.19 1.11 2.45 84 HELO_DYNAMIC_IPADDR2 7954 2.01 0.15 2.45 85 TR_MetaPhish_Combo_01 7900 2.05 0.43 2.43 86 XM_CamelCaseFrm001 7827 2.72 4.06 2.41 87 XM_ProductURIs 7792 2.15 1.12 2.40 88 XMBdyGiftCard01 7544 2.21 1.76 2.32 89 INVALID_MSGID 7536 2.13 1.32 2.32 90 BAYES_05 7424 2.19 1.80 2.28 91 BAYES_95 6997 2.48 3.88 2.15 92 US_DOLLARS_3 6954 2.80 5.59 2.14 93 BOTNET 6828 5.72 21.10 2.10 94 URI_HEX 6735 2.58 4.72 2.07 95 XM_PDF 6697 1.72 0.29 2.06 96 MAILING_LIST_MULTI 6531 1.82 1.02 2.01 97 MIME_HTML_ONLY_MULTI 6379 2.57 5.13 1.96 98 TM2_M_VERY_LONG_WORD 6348 1.97 2.05 1.95 99 HTML_IMAGE_RATIO_08 6278 1.93 1.91 1.93 100 TR_DCC_Bayes_99 5901 4.90 17.99 1.82 101 RCVD_IN_IADB_OPTIN 5489 1.42 0.30 1.69 102 RELAYCOUNTRY_CA 5483 2.22 4.50 1.69 103 HTML_MIME_NO_HTML_TAG 5426 2.50 6.00 1.67 104 XM_H_Long_From02 5205 1.42 0.64 1.60 105 XMStockSpam_06 5189 1.65 1.90 1.60 106 USER_IN_DEF_DKIM_WL 5030 1.26 0.02 1.55 107 IN_HORDE_ADDRESS_BOOK 5020 1.26 0.05 1.54 108 SUBJ_ALL_CAPS 4956 2.30 5.58 1.52 109 UNTRUSTED_Relay 4918 3.90 14.03 1.51 110 TR_Symld_Words 4746 1.55 1.92 1.46 111 URI_TRY_3LD 4667 1.47 1.62 1.44 112 TM2_M_URI_OPT_OUT 4394 1.57 2.47 1.35 113 TR_XM_RelayPhish 4365 1.44 1.86 1.34 114 XMGappySubj_01 4243 1.14 0.45 1.31 115 XMDiploma_00 4243 1.54 2.55 1.31 116 XMSexyCombo_01 4183 1.53 2.56 1.29 117 T_XMDrugObfuBody_08 4064 1.34 1.72 1.25 118 XM_OfRef6 3983 1.53 2.83 1.23 119 ANY_BOUNCE_MESSAGE 3980 1.07 0.43 1.22 120 BOUNCE_MESSAGE 3979 1.07 0.43 1.22 121 KHOP_HELO_FCRDNS 3895 2.02 5.53 1.20 122 XMSubMetaSxObfu_03 3861 1.12 0.84 1.19 123 RCVD_IN_BL_SPAMCOP_NET 3770 2.13 6.25 1.16 124 XM_ShortIntro_01 3695 1.08 0.82 1.14 125 NO_DNS_FOR_FROM 3629 1.62 3.75 1.12 126 XM_DK_Undo_01 3547 1.05 0.88 1.09 127 XM_SPF_SoftFail 3524 1.69 4.25 1.08 128 T_XMHurry_00 3484 1.06 0.99 1.07 129 XM_B_Unsub2 3390 1.11 1.39 1.04 130 XM_GoogleGroups 3169 0.88 0.48 0.97 131 XM_B_REG_HTML 2933 0.81 0.41 0.90 132 T_XMDrugObfuBody_00 2775 1.07 2.01 0.85 133 XMPhish11 2721 0.94 1.40 0.84 134 XM_UB50 2708 2.22 8.12 0.83 135 PLING_QUERY 2684 0.75 0.41 0.83 136 XMSubMetaI_00 2642 1.12 2.43 0.81 137 USER_IN_WHITELIST 2605 0.65 0.00 0.80 138 RCVD_IN_MSPIKE_H5 2604 0.66 0.08 0.80 139 XMBody_95 2586 0.67 0.12 0.80 140 TVD_SPACE_RATIO 2510 0.70 0.40 0.77 141 HTML_TAG_BALANCE_BODY 2507 0.83 1.10 0.77 142 XMBrknScrpt_02 2431 0.86 1.32 0.75 143 XMBody_17 2374 1.21 3.25 0.73 144 TM2_M_A_HREF_HREF 2354 0.90 1.65 0.72 145 XMPhish30 2270 0.75 0.99 0.70 146 DKIM_ADSP_CUSTOM_MED 2251 0.92 1.86 0.69 147 XMSubMetaSx_01 2182 0.66 0.62 0.67 148 XMBody_78 2157 0.70 0.83 0.66 149 T_TooManySym_03 2136 0.55 0.12 0.66 150 RCVD_IN_MSPIKE_H4 2066 0.61 0.53 0.64 151 TR_XM_PHPDW 2066 1.04 2.77 0.64 152 XM_H_PHPMailer 2055 0.89 1.98 0.63 153 XMSexyCombo_04 2040 0.68 0.93 0.63 154 XM_D_tchamptons_WL 2032 0.51 0.00 0.63 155 TR_XM_PHPForged 2027 1.02 2.69 0.62 156 T_Symld_Words_02 2020 0.66 0.80 0.62 157 DIET_1 2015 0.79 1.53 0.62 158 XMGenDplmaNmb 1998 0.85 1.87 0.61 159 TooManyTo_004 1995 0.69 1.01 0.61 160 TR_XM_FormFill2 1972 1.00 2.67 0.61 161 XM_H_PHPOS 1960 1.00 2.66 0.60 162 SpammyFromTLD_01 1951 0.97 2.54 0.60 163 XMSexyCombo_02 1880 0.57 0.54 0.58 164 T_FILL_THIS_FORM_SHORT 1840 0.79 1.71 0.57 165 XMHTML_After_End 1837 0.65 1.01 0.57 166 HTML_FONT_FACE_BAD 1824 0.62 0.87 0.56 167 SHORT_URI 1795 0.82 1.98 0.55 168 THIS_AD 1791 1.01 2.94 0.55 169 TooManyTo_005 1769 0.60 0.86 0.54 170 XM_salutation 1767 0.81 1.92 0.54 171 FILL_THIS_FORM 1715 0.55 0.64 0.53 172 DKIM_ADSP_NXDOMAIN 1665 1.17 3.98 0.51 173 XM_RXBody 1615 0.44 0.22 0.50 174 SUBJ_BUY 1574 0.47 0.40 0.48 175 NML_ADSP_CUSTOM_MED 1554 0.73 1.78 0.48 176 XMHTMLBadTable_001 1512 0.47 0.48 0.47 177 FILL_THIS_FORM_LONG 1507 0.47 0.51 0.46 178 SUBJ_DOLLARS 1472 0.64 1.42 0.45 179 XMSubMetaSxObfu_02 1470 0.41 0.24 0.45 180 XMNoVowels 1468 0.42 0.28 0.45 181 XM_B_COPY_HTML 1433 0.48 0.67 0.44 182 T_FILL_THIS_FORM_LOAN 1412 0.39 0.20 0.43 183 URI_NOVOWEL 1395 0.49 0.77 0.43 184 RELAYCOUNTRY_GB 1387 0.54 1.02 0.43 185 XM_SPF_Unknown 1387 0.42 0.37 0.43 186 NUMERIC_HTTP_ADDR 1375 0.47 0.68 0.42 187 XMBSHREFv2 1368 0.40 0.31 0.42 188 RDNS_DYNAMIC 1357 1.04 3.69 0.42 189 RELAYCOUNTRY_AU 1311 0.40 0.36 0.40 190 XMPhish14 1298 0.42 0.49 0.40 191 HELO_NODOT 1296 0.45 0.65 0.40 192 HELO_NO_DOMAIN 1295 0.45 0.64 0.40 193 FORGED_GMAIL_RCVD 1275 0.63 1.63 0.39 194 T_MONEY_PERCENT 1265 0.64 1.69 0.39 195 TR_LOTS_OF_MONEY2 1265 0.64 1.69 0.39 196 XMOemUri 1258 0.33 0.08 0.39 197 XMSolicitRefs_0 1241 0.36 0.29 0.38 198 XM_URI_RBL 1217 0.81 2.68 0.37 199 XMGappySubj_02 1213 0.37 0.35 0.37 200 XMLngstWrd_00 1185 0.34 0.23 0.36 ----------------------------------------------------------------------