Email: 359571 Autolearn: 0 AvgScore: 1.77 AvgScanTime: 2.14 sec Spam: 72644 Autolearn: 0 AvgScore: 12.96 AvgScanTime: 2.60 sec Ham: 286927 Autolearn: 0 AvgScore: -1.07 AvgScanTime: 2.02 sec Time Spent Running SA: 213.61 hours Time Spent Processing Spam: 52.49 hours Time Spent Processing Ham: 161.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 68092 87.63 93.73 86.09 2 DCC_CHECK 56917 59.59 78.35 54.84 3 DKIM_SIGNED 56020 81.59 77.12 82.72 4 XM_DK_Pass 50897 79.32 70.06 81.66 5 XM_B_Unicode 50536 73.14 69.57 74.04 6 XMListUnsubscribeExists 49545 63.84 68.20 62.74 7 DKIM_VALID 47587 75.87 65.51 78.49 8 DKIM_VALID_AU 38801 63.25 53.41 65.74 9 BAYES_50 35432 54.77 48.77 56.29 10 XM_B_Unicode3 34666 46.84 47.72 46.62 11 HTML_FONT_LOW_CONTRAST 28068 36.60 38.64 36.09 12 XM_DK_Undo_02 25583 13.31 35.22 7.76 13 LOC_TINY_FONT_1 25427 32.54 35.00 31.92 14 MIME_HTML_ONLY 22549 24.71 31.04 23.11 15 RELAYCOUNTRY_META 19204 9.52 26.44 5.24 16 FVGT_m_MULTI_ODD 18502 22.63 25.47 21.91 17 XM_Body_Dirty_Words 18392 18.79 25.32 17.14 18 BAYES_99 18254 8.62 25.13 4.44 19 XMSubLong 16997 22.34 23.40 22.07 20 MultiRelay 16320 16.33 22.47 14.78 21 DKIM_VALID_EF 15541 26.33 21.39 27.58 22 BOTNET 15265 6.02 21.01 2.23 23 TR_DCC_Bayes_99 14562 6.06 20.05 2.52 24 BAYES_999 14404 6.93 19.83 3.66 25 BOTNET_IPINHOSTNAME 14394 8.90 19.81 6.14 26 DCC_CHECK_NEGATIVE 13814 38.92 19.02 43.96 27 XM_UncommonTLD01 13595 6.87 18.71 3.87 28 T_KAM_HTML_FONT_INVALID 12620 15.96 17.37 15.60 29 HTML_IMAGE_RATIO_02 12611 13.82 17.36 12.92 30 XM_Multi_Part_URI 11863 14.84 16.33 14.46 31 FSL_BULK_SIG 11816 9.51 16.27 7.79 32 UNTRUSTED_Relay 11766 4.62 16.20 1.69 33 T_TM2_M_HEADER_IN_MSG 11628 22.28 16.01 23.87 34 XM_B_Unsub 10331 10.35 14.22 9.37 35 XM_Evil_Numbers_Gen 8725 11.30 12.01 11.11 36 XMSexyCombo_05 8724 7.36 12.01 6.18 37 XM_H_Long_From01 8459 8.08 11.64 7.17 38 DKIM_INVALID 8433 5.72 11.61 4.23 39 SpammyFromTLD_02 8322 2.52 11.46 0.26 40 LOTS_OF_MONEY 8183 8.05 11.26 7.23 41 TooManyTo_001 7552 7.07 10.40 6.23 42 T_XMDrugObfuBody_14 6987 9.36 9.62 9.29 43 XM_UB50 6931 2.61 9.54 0.86 44 XM_B_SpammyTLD 6721 6.05 9.25 5.23 45 MPART_ALT_DIFF 6655 5.14 9.16 4.12 46 XMSubMetaSx_00 6173 5.82 8.50 5.15 47 LotsOfNums_01 5922 7.93 8.15 7.87 48 HTML_IMAGE_RATIO_04 5853 8.38 8.06 8.47 49 XMNumbers 5630 5.03 7.75 4.34 50 MIME_HTML_MOSTLY 5428 4.51 7.47 3.76 51 XM_B_Phish_Phrases 5318 8.58 7.32 8.90 52 XM_DIRTYINTL 5171 4.31 7.12 3.60 53 RCVD_IN_BL_SPAMCOP_NET 5128 2.44 7.06 1.27 54 KHOP_HELO_FCRDNS 5054 2.24 6.96 1.04 55 TR_Mismatch_TLD_02 4877 1.42 6.71 0.08 56 HTML_MIME_NO_HTML_TAG 4757 2.56 6.55 1.55 57 DKIM_ADSP_NXDOMAIN 4580 1.81 6.30 0.67 58 RCVD_IN_RP_RNBL 4366 1.26 6.01 0.06 59 BAYES_80 4189 3.32 5.77 2.70 60 UNPARSEABLE_RELAY 3967 4.35 5.46 4.07 61 NO_DNS_FOR_FROM 3956 2.20 5.45 1.37 62 RDNS_DYNAMIC 3877 1.45 5.34 0.46 63 BAYES_60 3663 4.87 5.04 4.82 64 HTML_IMAGE_RATIO_06 3461 3.26 4.76 2.88 65 RCVD_IN_PSBL 3430 1.01 4.72 0.06 66 RCVD_IN_MSPIKE_H2 3409 6.59 4.69 7.08 67 FROM_SUSPICIOUS_NTLD 3385 0.95 4.66 0.01 68 FROM_SUSPICIOUS_NTLD_FP 3339 0.94 4.60 0.01 69 DATE_IN_PAST_06_12 3333 1.02 4.59 0.11 70 XM_SendGrid 3282 6.45 4.52 6.94 71 XM_BadFromFormat 3205 0.97 4.41 0.10 72 FROM_MISSP_REPLYTO 3132 0.87 4.31 0.00 73 MIME_QP_LONG_LINE 3110 4.50 4.28 4.55 74 MultiRelay_Combo 3101 1.03 4.27 0.20 75 MultiRelay_CC 3101 1.03 4.27 0.20 76 XMStrtUSub 3024 5.69 4.16 6.07 77 URI_HEX 2989 2.43 4.11 2.01 78 FROM_MISSP_DYNIP 2797 0.78 3.85 0.00 79 XM_SPF_SoftFail 2783 1.51 3.83 0.92 80 MPART_ALT_DIFF_COUNT 2734 0.98 3.76 0.28 81 BAYES_40 2719 4.61 3.74 4.83 82 RELAYCOUNTRY_CA 2678 2.47 3.69 2.16 83 URIBL_DBL_ABUSE_REDIR 2676 0.76 3.68 0.02 84 RELAYCOUNTRY_RU 2632 0.75 3.62 0.03 85 MIME_HTML_ONLY_MULTI 2578 2.36 3.55 2.05 86 XM_H_TOP 2475 0.69 3.41 0.00 87 HTML_FONT_SIZE_HUGE 2465 0.77 3.39 0.10 88 XMSexyCombo_01 2438 1.10 3.36 0.53 89 BAYES_20 2427 3.61 3.34 3.68 90 RELAYCOUNTRY_FR 2395 0.95 3.30 0.35 91 T_TooManySym_01 2382 6.91 3.28 7.83 92 BAYES_95 2364 1.99 3.25 1.67 93 SUBJ_ALL_CAPS 2298 1.84 3.16 1.51 94 FROM_EXCESS_BASE64 2279 4.61 3.14 4.98 95 US_DOLLARS_3 2261 1.31 3.11 0.86 96 INVALID_DATE 2246 0.67 3.09 0.05 97 NORDNS_LOW_CONTRAST 2246 0.63 3.09 0.01 98 HTML_TAG_BALANCE_HEAD 2232 0.68 3.07 0.07 99 XM_CamelCaseFrm001 2231 2.60 3.07 2.47 100 XMBdyGiftCard01 2196 3.33 3.02 3.41 101 TM2_M_URI_OPT_OUT 2168 2.15 2.98 1.94 102 XM_URI_RBL 2149 0.91 2.96 0.39 103 T_REMOTE_IMAGE 2113 2.74 2.91 2.70 104 XMBody_17 2093 1.32 2.88 0.92 105 BAYES_00 2086 15.67 2.87 18.91 106 TR_M_TOP_BAYES 2062 0.57 2.84 0.00 107 XMDiploma_00 1925 1.56 2.65 1.29 108 RELAYCOUNTRY_IN 1866 0.58 2.57 0.07 109 RCVD_IN_RP_SAFE 1852 13.56 2.55 16.35 110 TR_XM_DK_SendGrid 1792 3.84 2.47 4.19 111 T_XMDrugObfuBody_00 1778 0.91 2.45 0.52 112 TR_XM_PHPDW 1755 1.04 2.42 0.69 113 TR_XM_PHPForged 1735 1.03 2.39 0.69 114 TR_XM_FormFill2 1731 1.02 2.38 0.68 115 XM_H_PHPOS 1725 1.02 2.37 0.67 116 XMSubMetaI_00 1717 2.35 2.36 2.35 117 TM2_M_VERY_LONG_WORD 1645 1.83 2.26 1.72 118 BOTNET_NORDNS 1632 0.46 2.25 0.01 119 XMGenDplmaNmb 1610 1.06 2.22 0.76 120 HTML_IMAGE_RATIO_08 1559 2.55 2.15 2.66 121 XMSexyCombo_04 1536 0.54 2.11 0.15 122 TR_XM_RelayPhish 1531 1.56 2.11 1.42 123 T_XMHurry_00 1507 1.28 2.07 1.08 124 XM_H_PHPMailer 1413 0.93 1.95 0.67 125 SpammyFromTLD_01 1412 0.82 1.94 0.53 126 XM_OfRef6 1400 2.04 1.93 2.07 127 TR_XM_INV_DKIM 1396 0.49 1.92 0.12 128 TO_NO_BRKTS_FROM_MSSP 1363 0.39 1.88 0.01 129 BAYES_05 1335 2.30 1.84 2.41 130 RCVD_IN_MSPIKE_WL 1275 4.71 1.76 5.46 131 XM_H_PHPOS_M 1275 0.62 1.76 0.34 132 ALL_TRUSTED 1264 11.27 1.74 13.68 133 DATE_IN_PAST_03_06 1234 0.43 1.70 0.10 134 T_XMDrugObfuBody_08 1221 1.32 1.68 1.23 135 XM_B_Unsub2 1210 1.08 1.67 0.93 136 RCVD_IN_MSPIKE_BL 1202 0.40 1.65 0.08 137 XMStockSpam_06 1179 1.58 1.62 1.57 138 RELAYCOUNTRY_AT 1155 0.54 1.59 0.27 139 XMPhish11 1146 1.12 1.58 1.01 140 TR_Symld_Words 1122 1.09 1.54 0.97 141 RELAYCOUNTRY_PL 1100 0.32 1.51 0.02 142 RCVD_IN_RP_CERTIFIED 1094 11.93 1.51 14.57 143 XM_H_Long_From03 1068 0.33 1.47 0.05 144 XMLongAddy 1067 0.33 1.47 0.04 145 MSGID_SHORT 1058 0.30 1.46 0.00 146 XMMoneyMeta_00 1027 0.45 1.41 0.21 147 XMSubMetaSxObfu_03 1018 0.66 1.40 0.47 148 RCVD_IN_IADB_LISTED 994 2.70 1.37 3.04 149 XMBrknScrpt_02 965 0.94 1.33 0.84 150 T_HTML_TAG_BALANCE_CENTER 954 0.36 1.31 0.11 151 XM_DK_Undo_01 943 1.26 1.30 1.26 152 DIET_1 920 1.06 1.27 1.01 153 XMPhish30 920 0.84 1.27 0.74 154 HTML_TAG_BALANCE_BODY 905 0.87 1.25 0.78 155 T_MONEY_PERCENT 894 0.62 1.23 0.47 156 TR_LOTS_OF_MONEY2 894 0.62 1.23 0.47 157 XMHTML_After_End 882 0.86 1.21 0.77 158 RCVD_IN_MSPIKE_L5 880 0.29 1.21 0.06 159 RCVD_IN_IADB_SPF 876 2.38 1.21 2.67 160 RELAYCOUNTRY_IE 869 0.43 1.20 0.24 161 RCVD_IN_IADB_SENDERID 862 2.17 1.19 2.42 162 RCVD_IN_IADB_DK 862 2.11 1.19 2.34 163 XMReplyNow 851 0.33 1.17 0.11 164 DKIM_ADSP_CUSTOM_MED 849 1.01 1.17 0.97 165 PLING_QUERY 847 0.98 1.17 0.93 166 XM_UB60 840 0.29 1.16 0.07 167 TooManyTo_002 840 1.15 1.16 1.15 168 HTML_FONT_FACE_BAD 835 0.89 1.15 0.82 169 SUBJECT_NEEDS_ENCODING 826 0.24 1.14 0.01 170 TR_Mismatch_TLD_01 812 0.48 1.12 0.32 171 URI_TRY_3LD 804 1.48 1.11 1.57 172 SUBJ_ILLEGAL_CHARS 804 0.23 1.11 0.01 173 RCVD_IN_MSPIKE_H3 796 3.53 1.10 4.14 174 NML_ADSP_CUSTOM_MED 795 0.79 1.09 0.71 175 CK_HELO_DYNAMIC_SPLIT_IP 789 2.44 1.09 2.79 176 RELAYCOUNTRY_DE 788 0.42 1.08 0.26 177 XMSubGiftCard1 787 0.30 1.08 0.10 178 TO_NO_BRKTS_DYNIP 765 0.21 1.05 0.00 179 XMSubGiftCard2 751 0.26 1.03 0.06 180 THIS_AD 736 0.75 1.01 0.68 181 TR_XM_DK_Bayes 730 14.04 1.00 17.34 182 MAILING_LIST_MULTI 720 1.55 0.99 1.69 183 FORGED_GMAIL_RCVD 717 0.59 0.99 0.49 184 TooManyTo_003 714 0.87 0.98 0.84 185 TR_LOTS_OF_MONEY3 711 0.73 0.98 0.67 186 FILL_THIS_FORM 706 1.03 0.97 1.05 187 XM_UB99 699 0.21 0.96 0.02 188 XM_XX_Yahoo 686 0.33 0.94 0.17 189 HELO_MISC_IP 683 0.20 0.94 0.01 190 TM2_M_A_HREF_HREF 670 0.41 0.92 0.28 191 HTML_SHORT_LINK_IMG_1 644 0.20 0.89 0.03 192 RELAYCOUNTRY_BG 640 0.18 0.88 0.01 193 T_FILL_THIS_FORM_SHORT 620 0.61 0.85 0.55 194 TR_XM_DK_Bayes1 619 13.47 0.85 16.67 195 XM_ProductURIs 614 0.94 0.85 0.96 196 TRACKER_ID 610 0.25 0.84 0.10 197 INVALID_MSGID 605 2.22 0.83 2.57 198 T_Symld_Words_02 605 0.49 0.83 0.40 199 TooManyTo_004 603 0.72 0.83 0.69 200 LOW_PRICE 598 0.36 0.82 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247014 87.63 93.73 86.09 2 DKIM_SIGNED 237348 81.59 77.12 82.72 3 XM_DK_Pass 234305 79.32 70.06 81.66 4 DKIM_VALID 225206 75.87 65.51 78.49 5 XM_B_Unicode 212443 73.14 69.57 74.04 6 DKIM_VALID_AU 188621 63.25 53.41 65.74 7 XMListUnsubscribeExists 180021 63.84 68.20 62.74 8 BAYES_50 161523 54.77 48.77 56.29 9 DCC_CHECK 157365 59.59 78.35 54.84 10 XM_B_Unicode3 133772 46.84 47.72 46.62 11 DCC_CHECK_NEGATIVE 126126 38.92 19.02 43.96 12 HTML_FONT_LOW_CONTRAST 103539 36.60 38.64 36.09 13 LOC_TINY_FONT_1 91589 32.54 35.00 31.92 14 DKIM_VALID_EF 79141 26.33 21.39 27.58 15 T_TM2_M_HEADER_IN_MSG 68476 22.28 16.01 23.87 16 MIME_HTML_ONLY 66311 24.71 31.04 23.11 17 XMSubLong 63332 22.34 23.40 22.07 18 FVGT_m_MULTI_ODD 62862 22.63 25.47 21.91 19 BAYES_00 54259 15.67 2.87 18.91 20 TR_XM_DK_Bayes 49766 14.04 1.00 17.34 21 XM_Body_Dirty_Words 49182 18.79 25.32 17.14 22 TR_XM_DK_Bayes1 47832 13.47 0.85 16.67 23 RCVD_IN_RP_SAFE 46919 13.56 2.55 16.35 24 TR_XM_DK_Bayes2 45011 12.66 0.70 15.69 25 T_KAM_HTML_FONT_INVALID 44763 15.96 17.37 15.60 26 MultiRelay 42404 16.33 22.47 14.78 27 RCVD_IN_RP_CERTIFIED 41792 11.93 1.51 14.57 28 XM_Multi_Part_URI 41485 14.84 16.33 14.46 29 ALL_TRUSTED 39253 11.27 1.74 13.68 30 HTML_IMAGE_RATIO_02 37084 13.82 17.36 12.92 31 XM_DKIMWhitelistDomains 33283 9.27 0.05 11.60 32 XM_Evil_Numbers_Gen 31889 11.30 12.01 11.11 33 XM_B_Unsub 26887 10.35 14.22 9.37 34 T_XMDrugObfuBody_14 26658 9.36 9.62 9.29 35 XM_B_Phish_Phrases 25538 8.58 7.32 8.90 36 HTML_IMAGE_RATIO_04 24290 8.38 8.06 8.47 37 LotsOfNums_01 22582 7.93 8.15 7.87 38 T_TooManySym_01 22475 6.91 3.28 7.83 39 FSL_BULK_SIG 22362 9.51 16.27 7.79 40 XM_DK_Undo_02 22265 13.31 35.22 7.76 41 LOTS_OF_MONEY 20749 8.05 11.26 7.23 42 XM_H_Long_From01 20584 8.08 11.64 7.17 43 RCVD_IN_MSPIKE_H2 20302 6.59 4.69 7.08 44 XM_SendGrid 19901 6.45 4.52 6.94 45 TooManyTo_001 17886 7.07 10.40 6.23 46 XMSexyCombo_05 17730 7.36 12.01 6.18 47 BOTNET_IPINHOSTNAME 17605 8.90 19.81 6.14 48 XMStrtUSub 17418 5.69 4.16 6.07 49 RCVD_IN_MSPIKE_WL 15672 4.71 1.76 5.46 50 RELAYCOUNTRY_META 15031 9.52 26.44 5.24 51 XM_B_SpammyTLD 15017 6.05 9.25 5.23 52 XMSubMetaSx_00 14769 5.82 8.50 5.15 53 TO_MALFORMED 14617 4.08 0.07 5.09 54 FROM_EXCESS_BASE64 14296 4.61 3.14 4.98 55 BAYES_40 13852 4.61 3.74 4.83 56 BAYES_60 13836 4.87 5.04 4.82 57 MIME_QP_LONG_LINE 13059 4.50 4.28 4.55 58 BAYES_99 12732 8.62 25.13 4.44 59 XMNumbers 12445 5.03 7.75 4.34 60 DKIM_INVALID 12142 5.72 11.61 4.23 61 TR_XM_DK_SendGrid 12024 3.84 2.47 4.19 62 RCVD_IN_MSPIKE_H3 11889 3.53 1.10 4.14 63 MPART_ALT_DIFF 11825 5.14 9.16 4.12 64 UNPARSEABLE_RELAY 11670 4.35 5.46 4.07 65 XM_UncommonTLD01 11115 6.87 18.71 3.87 66 MIME_HTML_MOSTLY 10799 4.51 7.47 3.76 67 BAYES_20 10549 3.61 3.34 3.68 68 BAYES_999 10514 6.93 19.83 3.66 69 XM_DIRTYINTL 10336 4.31 7.12 3.60 70 XMBdyGiftCard01 9793 3.33 3.02 3.41 71 IN_ZIMBRA_NJ_WHITELIST 9017 2.51 0.02 3.14 72 T_TooManySym_02 8962 2.57 0.41 3.12 73 TVD_RCVD_IP 8756 2.57 0.68 3.05 74 RCVD_IN_IADB_LISTED 8728 2.70 1.37 3.04 75 HTML_IMAGE_RATIO_06 8275 3.26 4.76 2.88 76 CK_HELO_DYNAMIC_SPLIT_IP 7992 2.44 1.09 2.79 77 HELO_DYNAMIC_IPADDR2 7958 2.26 0.21 2.77 78 BAYES_80 7760 3.32 5.77 2.70 79 T_REMOTE_IMAGE 7751 2.74 2.91 2.70 80 RCVD_IN_IADB_SPF 7675 2.38 1.21 2.67 81 HTML_IMAGE_RATIO_08 7626 2.55 2.15 2.66 82 INVALID_MSGID 7387 2.22 0.83 2.57 83 TR_DCC_Bayes_99 7218 6.06 20.05 2.52 84 XM_CamelCaseFrm001 7101 2.60 3.07 2.47 85 RCVD_IN_IADB_SENDERID 6941 2.17 1.19 2.42 86 BAYES_05 6919 2.30 1.84 2.41 87 XMSubMetaI_00 6735 2.35 2.36 2.35 88 RCVD_IN_IADB_DK 6715 2.11 1.19 2.34 89 TR_MetaPhish_Combo_01 6446 1.89 0.48 2.25 90 BOTNET 6397 6.02 21.01 2.23 91 RELAYCOUNTRY_CA 6203 2.47 3.69 2.16 92 XM_OfRef6 5933 2.04 1.93 2.07 93 MIME_HTML_ONLY_MULTI 5894 2.36 3.55 2.05 94 URI_HEX 5766 2.43 4.11 2.01 95 TM2_M_URI_OPT_OUT 5572 2.15 2.98 1.94 96 XM_PDF 5403 1.56 0.28 1.88 97 RCVD_IN_IADB_VOUCHED 5167 1.52 0.39 1.80 98 IN_HORDE_ADDRESS_BOOK 5011 1.40 0.03 1.75 99 USER_IN_DEF_DKIM_WL 4999 1.39 0.01 1.74 100 TM2_M_VERY_LONG_WORD 4924 1.83 2.26 1.72 101 MAILING_LIST_MULTI 4841 1.55 0.99 1.69 102 UNTRUSTED_Relay 4840 4.62 16.20 1.69 103 BAYES_95 4784 1.99 3.25 1.67 104 URI_TRY_3LD 4508 1.48 1.11 1.57 105 XMStockSpam_06 4504 1.58 1.62 1.57 106 HTML_MIME_NO_HTML_TAG 4452 2.56 6.55 1.55 107 SUBJ_ALL_CAPS 4327 1.84 3.16 1.51 108 TR_XM_RelayPhish 4065 1.56 2.11 1.42 109 NO_DNS_FOR_FROM 3941 2.20 5.45 1.37 110 XMGappySubj_01 3924 1.16 0.36 1.37 111 XMDiploma_00 3695 1.56 2.65 1.29 112 RCVD_IN_BL_SPAMCOP_NET 3641 2.44 7.06 1.27 113 XM_DK_Undo_01 3601 1.26 1.30 1.26 114 T_XMDrugObfuBody_08 3535 1.32 1.68 1.23 115 TooManyTo_002 3303 1.15 1.16 1.15 116 XM_GoogleGroups 3238 1.00 0.48 1.13 117 RCVD_IN_IADB_OPTIN 3210 0.96 0.32 1.12 118 T_XMHurry_00 3099 1.28 2.07 1.08 119 XM_H_Long_From02 3031 0.99 0.73 1.06 120 FILL_THIS_FORM 3000 1.03 0.97 1.05 121 ANY_BOUNCE_MESSAGE 2999 0.87 0.16 1.05 122 BOUNCE_MESSAGE 2999 0.87 0.16 1.05 123 KHOP_HELO_FCRDNS 2994 2.24 6.96 1.04 124 DIET_1 2909 1.06 1.27 1.01 125 XMPhish11 2894 1.12 1.58 1.01 126 XM_B_REG_HTML 2810 0.94 0.77 0.98 127 DKIM_ADSP_CUSTOM_MED 2785 1.01 1.17 0.97 128 TR_Symld_Words 2782 1.09 1.54 0.97 129 FILL_THIS_FORM_LONG 2778 0.92 0.75 0.97 130 XM_ProductURIs 2754 0.94 0.85 0.96 131 T_FILL_THIS_FORM_LOAN 2689 0.82 0.37 0.94 132 PLING_QUERY 2669 0.98 1.17 0.93 133 T_TooManySym_03 2666 0.76 0.11 0.93 134 XM_B_Unsub2 2660 1.08 1.67 0.93 135 XMBody_17 2639 1.32 2.88 0.92 136 XM_SPF_SoftFail 2630 1.51 3.83 0.92 137 XMBody_95 2516 0.71 0.06 0.88 138 XMSubMetaSxObfu_02 2498 0.75 0.26 0.87 139 XM_UB50 2469 2.61 9.54 0.86 140 US_DOLLARS_3 2455 1.31 3.11 0.86 141 XMBrknScrpt_02 2418 0.94 1.33 0.84 142 TooManyTo_003 2413 0.87 0.98 0.84 143 HTML_FONT_FACE_BAD 2349 0.89 1.15 0.82 144 USER_IN_WHITELIST 2330 0.65 0.00 0.81 145 RCVD_IN_MSPIKE_H4 2270 0.75 0.57 0.79 146 HTML_TAG_BALANCE_BODY 2225 0.87 1.25 0.78 147 XMHTML_After_End 2197 0.86 1.21 0.77 148 XMGenDplmaNmb 2189 1.06 2.22 0.76 149 XMPhish30 2110 0.84 1.27 0.74 150 NML_ADSP_CUSTOM_MED 2043 0.79 1.09 0.71 151 XMBody_78 2004 0.64 0.39 0.70 152 TR_XM_PHPForged 1975 1.03 2.39 0.69 153 TR_XM_PHPDW 1972 1.04 2.42 0.69 154 TooManyTo_004 1969 0.72 0.83 0.69 155 TR_XM_FormFill2 1950 1.02 2.38 0.68 156 THIS_AD 1945 0.75 1.01 0.68 157 XM_H_PHPMailer 1935 0.93 1.95 0.67 158 XM_H_PHPOS 1933 1.02 2.37 0.67 159 DKIM_ADSP_NXDOMAIN 1927 1.81 6.30 0.67 160 TR_LOTS_OF_MONEY3 1918 0.73 0.98 0.67 161 XMBSHREFv2 1897 0.63 0.50 0.66 162 XMLngstWrd_00 1815 0.57 0.34 0.63 163 XM_RXBody 1790 0.54 0.22 0.62 164 XMSlimDrugH 1722 0.62 0.69 0.60 165 TooManyTo_005 1721 0.62 0.69 0.60 166 XMHTMLBadTable_001 1718 0.64 0.78 0.60 167 XMLngstWrd_01 1680 0.53 0.32 0.59 168 T_FILL_THIS_FORM_SHORT 1583 0.61 0.85 0.55 169 SpammyFromTLD_01 1534 0.82 1.94 0.53 170 XM_B_COPY_HTML 1516 0.54 0.58 0.53 171 RCVD_IN_MSPIKE_H5 1513 0.44 0.09 0.53 172 XMSexyCombo_01 1507 1.10 3.36 0.53 173 BODY_ENHANCEMENT 1496 0.47 0.26 0.52 174 T_XMDrugObfuBody_00 1486 0.91 2.45 0.52 175 SUBJ_DOLLARS 1470 0.50 0.46 0.51 176 FORGED_GMAIL_RCVD 1406 0.59 0.99 0.49 177 RELAYCOUNTRY_GB 1388 0.55 0.82 0.48 178 NUMERIC_HTTP_ADDR 1382 0.55 0.80 0.48 179 HELO_NODOT 1381 0.47 0.44 0.48 180 XMSubMetaSxObfu_03 1344 0.66 1.40 0.47 181 URI_NOVOWEL 1343 0.51 0.70 0.47 182 TR_LOTS_OF_MONEY2 1337 0.62 1.23 0.47 183 T_MONEY_PERCENT 1337 0.62 1.23 0.47 184 XM_Walgreens_Forge 1332 0.42 0.22 0.46 185 RDNS_DYNAMIC 1329 1.45 5.34 0.46 186 HELO_NO_DOMAIN 1286 0.45 0.44 0.45 187 XMNoVowels 1280 0.40 0.20 0.45 188 RELAYCOUNTRY_AU 1207 0.41 0.37 0.42 189 XMCapTrack 1169 0.36 0.16 0.41 190 XMOemUri 1164 0.34 0.10 0.41 191 T_Symld_Words_02 1153 0.49 0.83 0.40 192 XM_URI_RBL 1122 0.91 2.96 0.39 193 XM_Body_Obfu01 1061 0.44 0.71 0.37 194 XM_SPF_Unknown 1029 0.38 0.45 0.36 195 RELAYCOUNTRY_FR 1005 0.95 3.30 0.35 196 XMLngstWrd_02 988 0.33 0.28 0.34 197 XM_H_PHPOS_M 967 0.62 1.76 0.34 198 FSL_THIS_IS_ADV 946 0.41 0.74 0.33 199 T_TooManySym_04 934 0.26 0.02 0.33 200 HTTPS_HTTP_MISMATCH 929 0.31 0.27 0.32 ----------------------------------------------------------------------