Email: 677831 Autolearn: 0 AvgScore: 2.12 AvgScanTime: 2.43 sec Spam: 128851 Autolearn: 0 AvgScore: 12.64 AvgScanTime: 3.13 sec Ham: 548980 Autolearn: 0 AvgScore: -0.35 AvgScanTime: 2.27 sec Time Spent Running SA: 458.42 hours Time Spent Processing Spam: 111.94 hours Time Spent Processing Ham: 346.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123841 91.65 96.11 90.60 2 DCC_CHECK 105704 52.77 82.04 45.91 3 DKIM_SIGNED 101379 79.45 78.68 79.63 4 XM_DK_Pass 97140 77.87 75.39 78.45 5 XM_B_Unicode 92433 72.92 71.74 73.20 6 DKIM_VALID 91604 74.25 71.09 74.99 7 XMListUnsubscribeExists 84265 59.25 65.40 57.81 8 DKIM_VALID_AU 71417 55.24 55.43 55.20 9 XM_B_Unicode3 60809 43.34 47.19 42.43 10 BAYES_50 59542 54.57 46.21 56.53 11 XM_DK_Undo_02 47149 12.53 36.59 6.88 12 LOC_TINY_FONT_1 46362 28.27 35.98 26.46 13 MIME_HTML_ONLY 46299 23.50 35.93 20.58 14 HTML_FONT_LOW_CONTRAST 45044 31.23 34.96 30.35 15 XMSubLong 35960 22.57 27.91 21.32 16 FVGT_m_MULTI_ODD 33516 22.77 26.01 22.01 17 BAYES_99 33161 7.32 25.74 2.99 18 DKIM_VALID_EF 32535 26.46 25.25 26.75 19 BOTNET 29725 6.35 23.07 2.42 20 RELAYCOUNTRY_META 27825 8.79 21.59 5.78 21 MultiRelay 27772 18.68 21.55 18.00 22 XM_Body_Dirty_Words 27412 15.16 21.27 13.73 23 TR_DCC_Bayes_99 27360 5.16 21.23 1.39 24 BAYES_999 25738 5.68 19.98 2.33 25 T_KAM_HTML_FONT_INVALID 25529 19.49 19.81 19.42 26 BOTNET_IPINHOSTNAME 24269 7.66 18.83 5.03 27 FSL_BULK_SIG 23869 8.98 18.52 6.73 28 XM_Multi_Part_URI 23768 13.52 18.45 12.36 29 T_TM2_M_HEADER_IN_MSG 21585 25.69 16.75 27.79 30 DCC_CHECK_NEGATIVE 21038 45.27 16.33 52.07 31 XM_B_Unsub 19805 11.45 15.37 10.53 32 XM_UncommonTLD01 19433 5.65 15.08 3.44 33 HTML_IMAGE_RATIO_02 18038 10.47 14.00 9.64 34 UNTRUSTED_Relay 17261 4.04 13.40 1.84 35 LOTS_OF_MONEY 16228 8.75 12.59 7.84 36 XM_Evil_Numbers_Gen 16198 10.65 12.57 10.20 37 XMSexyCombo_05 14253 5.40 11.06 4.07 38 TooManyTo_001 12088 7.97 9.38 7.64 39 LotsOfNums_01 12015 9.36 9.32 9.37 40 SpammyFromTLD_02 11768 2.07 9.13 0.41 41 XMSubMetaSx_00 11533 5.17 8.95 4.28 42 T_XMDrugObfuBody_14 11335 8.52 8.80 8.46 43 HTML_SHORT_LINK_IMG_1 10916 1.63 8.47 0.03 44 HTML_MIME_NO_HTML_TAG 10208 3.34 7.92 2.26 45 MPART_ALT_DIFF 10194 4.44 7.91 3.62 46 XM_B_Phish_Phrases 9911 6.71 7.69 6.48 47 T_REMOTE_IMAGE 9847 4.48 7.64 3.74 48 DKIM_INVALID 9775 5.19 7.59 4.63 49 XM_DIRTYINTL 9581 3.56 7.44 2.65 50 XM_UB50 9075 2.21 7.04 1.07 51 XM_B_SpammyTLD 8990 2.85 6.98 1.89 52 HTML_IMAGE_RATIO_04 8769 6.26 6.81 6.13 53 BOTNET_NORDNS 8582 1.34 6.66 0.09 54 XM_SendGrid 8110 6.47 6.29 6.51 55 FROM_SUSPICIOUS_NTLD 7821 1.20 6.07 0.06 56 MIME_QP_LONG_LINE 7766 6.71 6.03 6.87 57 FROM_SUSPICIOUS_NTLD_FP 7750 1.19 6.01 0.05 58 BAYES_80 7736 3.16 6.00 2.49 59 XM_H_Long_From01 7550 7.01 5.86 7.28 60 MIME_HTML_MOSTLY 7172 3.63 5.57 3.18 61 HTML_IMAGE_ONLY_08 7159 1.14 5.56 0.10 62 T_HTML_TAG_BALANCE_CENTER 6981 1.14 5.42 0.13 63 XMNumbers 6916 3.64 5.37 3.23 64 BAYES_60 6838 5.12 5.31 5.08 65 BODY_URI_ONLY 6832 1.10 5.30 0.11 66 XM_SPF_SoftFail 6728 2.60 5.22 1.98 67 XM_BadFromFormat 6230 1.00 4.84 0.10 68 XMStrtUSub 6134 4.13 4.76 3.98 69 HDRS_LCASE_IMGONLY 5988 0.91 4.65 0.03 70 BAYES_40 5914 5.45 4.59 5.65 71 RCVD_IN_MSPIKE_H2 5846 5.91 4.54 6.24 72 TM2_M_URI_OPT_OUT 5821 2.54 4.52 2.07 73 RCVD_IN_BL_SPAMCOP_NET 5484 2.14 4.26 1.65 74 RELAYCOUNTRY_GB 5307 1.68 4.12 1.11 75 HTML_IMAGE_RATIO_06 5239 4.05 4.07 4.04 76 KHOP_HELO_FCRDNS 5146 2.48 3.99 2.12 77 MIME_HTML_ONLY_MULTI 5065 2.19 3.93 1.78 78 XM_URI_RBL 4960 0.96 3.85 0.28 79 URI_HEX 4864 2.50 3.77 2.20 80 TR_XM_DK_SendGrid 4723 3.30 3.67 3.22 81 HTML_EXTRA_CLOSE 4530 0.70 3.52 0.04 82 BAYES_95 4497 1.83 3.49 1.44 83 REPLYTO_WITHOUT_TO_CC 4421 0.68 3.43 0.04 84 BAYES_20 4411 4.15 3.42 4.32 85 MIME_HEADER_CTYPE_ONLY 4395 0.74 3.41 0.11 86 FROM_EXCESS_BASE64 4321 3.73 3.35 3.82 87 XM_B_Unsub2 4268 2.15 3.31 1.88 88 FROM_MISSP_REPLYTO 4244 0.63 3.29 0.00 89 HTML_IMAGE_ONLY_12 4236 0.78 3.29 0.19 90 RELAYCOUNTRY_CA 4015 1.99 3.12 1.73 91 TM2_M_VERY_LONG_WORD 3946 1.51 3.06 1.15 92 XM_H_TOP 3936 0.59 3.05 0.01 93 BAYES_00 3931 15.50 3.05 18.43 94 XMSexyCombo_01 3760 1.29 2.92 0.90 95 TO_EQ_FM_DOM_HTML_IMG 3738 0.56 2.90 0.01 96 RELAYCOUNTRY_FR 3738 0.94 2.90 0.49 97 RCVD_IN_RP_RNBL 3711 0.59 2.88 0.05 98 NO_DNS_FOR_FROM 3636 1.36 2.82 1.02 99 HTML_IMAGE_RATIO_08 3569 2.46 2.77 2.38 100 T_TooManySym_01 3565 3.96 2.77 4.24 101 DATE_IN_PAST_03_06 3496 0.61 2.71 0.12 102 TR_XM_RelayPhish 3483 1.33 2.70 1.01 103 RCVD_IN_IADB_LISTED 3466 5.42 2.69 6.07 104 RCVD_IN_IADB_SPF 3352 4.81 2.60 5.33 105 RCVD_IN_IADB_SENDERID 3291 4.31 2.55 4.72 106 RCVD_IN_IADB_DK 3288 4.23 2.55 4.62 107 XMDiploma_00 3258 1.82 2.53 1.65 108 RDNS_DYNAMIC 3169 0.75 2.46 0.35 109 XM_OfRef6 3152 1.59 2.45 1.39 110 XM_CamelCaseFrm001 3123 2.38 2.42 2.36 111 DKIM_ADSP_NXDOMAIN 3097 0.87 2.40 0.51 112 TR_M_TOP_BAYES 3029 0.45 2.35 0.00 113 MultiRelay_CC 2964 0.64 2.30 0.25 114 MultiRelay_Combo 2964 0.64 2.30 0.25 115 T_XMDrugObfuBody_08 2857 1.57 2.22 1.41 116 XM_UB99 2837 0.42 2.20 0.01 117 XMBody_17 2828 0.98 2.19 0.69 118 XMStockSpam_06 2722 1.35 2.11 1.18 119 SpammyFromTLD_01 2674 1.27 2.08 1.08 120 T_XMDrugObfuBody_00 2631 1.53 2.04 1.40 121 HDRS_MISSP 2617 0.39 2.03 0.00 122 TR_XM_PHPDW 2532 1.25 1.97 1.08 123 BAYES_05 2508 2.63 1.95 2.79 124 TR_XM_FormFill2 2502 1.23 1.94 1.06 125 TR_XM_PHPForged 2443 1.22 1.90 1.06 126 XM_H_PHPOS 2427 1.21 1.88 1.05 127 XMSubMetaSxObfu_03 2422 0.99 1.88 0.78 128 TR_XM_INV_DKIM 2330 0.42 1.81 0.09 129 XMMoneyMeta_00 2327 0.74 1.81 0.49 130 XMSubMetaI_00 2310 0.99 1.79 0.80 131 T_MONEY_PERCENT 2309 0.75 1.79 0.51 132 TR_LOTS_OF_MONEY2 2309 0.75 1.79 0.51 133 DATE_IN_PAST_06_12 2300 0.44 1.79 0.13 134 UNPARSEABLE_RELAY 2294 2.10 1.78 2.17 135 XM_DK_Undo_01 2288 1.55 1.78 1.50 136 XM_UB999 2266 0.34 1.76 0.00 137 XMGenDplmaNmb 2253 1.19 1.75 1.06 138 RCVD_IN_RP_SAFE 2229 8.44 1.73 10.02 139 XMBdyGiftCard01 2158 1.60 1.67 1.58 140 SUBJ_ALL_CAPS 2143 1.55 1.66 1.52 141 RCVD_IN_MSPIKE_WL 2108 4.47 1.64 5.14 142 TR_LOTS_OF_MONEY3 2036 0.78 1.58 0.59 143 T_XMHurry_00 1910 1.12 1.48 1.04 144 RCVD_IN_MSPIKE_BL 1880 0.85 1.46 0.71 145 US_DOLLARS_3 1876 0.74 1.46 0.58 146 RCVD_IN_PSBL 1869 0.32 1.45 0.05 147 ALL_TRUSTED 1806 10.13 1.40 12.18 148 XMSexyCombo_04 1794 0.41 1.39 0.18 149 XMPhish11 1770 1.21 1.37 1.18 150 HTML_FONT_FACE_BAD 1759 0.75 1.37 0.61 151 LongTLD 1715 0.44 1.33 0.23 152 TR_XM_DK_Bayes 1708 12.63 1.33 15.28 153 XM_H_Long_From02 1633 1.03 1.27 0.97 154 T_FILL_THIS_FORM_SHORT 1616 0.79 1.25 0.68 155 RCVD_IN_RP_CERTIFIED 1607 7.54 1.25 9.02 156 TR_Mismatch_TLD_02 1583 0.32 1.23 0.10 157 TR_XM_DK_Bayes1 1539 12.09 1.19 14.65 158 XM_UB60 1523 0.27 1.18 0.06 159 RELAYCOUNTRY_DE 1511 0.57 1.17 0.43 160 URI_TRY_3LD 1458 1.10 1.13 1.09 161 RCVD_IN_MSPIKE_H3 1455 3.81 1.13 4.43 162 HK_RANDOM_REPLYTO 1426 0.53 1.11 0.39 163 TR_Symld_Words 1423 1.28 1.10 1.33 164 SUBJECT_NEEDS_ENCODING 1391 0.21 1.08 0.01 165 RELAYCOUNTRY_AT 1383 0.34 1.07 0.17 166 SUBJ_ILLEGAL_CHARS 1369 0.21 1.06 0.01 167 XM_H_PHPMailer 1367 0.62 1.06 0.51 168 MAILING_LIST_MULTI 1365 2.05 1.06 2.29 169 XMPhish30 1335 0.64 1.04 0.54 170 T_Symld_Words_02 1320 0.53 1.02 0.41 171 DIET_1 1313 0.53 1.02 0.42 172 XM_ProductURIs 1297 0.85 1.01 0.81 173 RELAYCOUNTRY_IE 1291 0.39 1.00 0.24 174 SUBJ_DOLLARS 1272 0.53 0.99 0.43 175 TooManyTo_002 1266 1.71 0.98 1.88 176 MPART_ALT_DIFF_COUNT 1232 0.42 0.96 0.29 177 XM_XX_Yahoo 1217 0.30 0.94 0.14 178 XMBody_78 1208 0.51 0.94 0.41 179 THIS_AD 1205 0.41 0.94 0.29 180 XMPhish14 1201 0.48 0.93 0.37 181 XMBrknScrpt_02 1198 0.85 0.93 0.83 182 RCVD_IN_MSPIKE_L5 1195 0.28 0.93 0.13 183 FSL_THIS_IS_ADV 1172 0.41 0.91 0.30 184 LOW_PRICE 1160 0.42 0.90 0.31 185 DKIM_ADSP_CUSTOM_MED 1155 1.03 0.90 1.06 186 XM_H_PHPOS_M 1152 0.33 0.89 0.20 187 XMGppyBdWords 1099 0.27 0.85 0.13 188 RELAYCOUNTRY_IN 1090 0.26 0.85 0.13 189 RELAYCOUNTRY_TR 1065 0.17 0.83 0.01 190 XMSlimDrugH 1044 0.38 0.81 0.28 191 XMHTMLBadTable_001 1035 0.78 0.80 0.77 192 XMHTML_After_End 1034 1.10 0.80 1.17 193 XMSubNoVowel 1034 0.38 0.80 0.29 194 FORGED_GMAIL_RCVD 1030 0.68 0.80 0.65 195 TooManyTo_003 1024 1.16 0.79 1.24 196 XM_OfRef7 1003 0.28 0.78 0.16 197 XM_PDF 999 3.67 0.78 4.36 198 XM_UB80 991 0.16 0.77 0.02 199 RELAYCOUNTRY_RU 976 0.16 0.76 0.02 200 TM2_M_A_HREF_HREF 973 0.37 0.76 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 497381 91.65 96.11 90.60 2 DKIM_SIGNED 437127 79.45 78.68 79.63 3 XM_DK_Pass 430689 77.87 75.39 78.45 4 DKIM_VALID 411692 74.25 71.09 74.99 5 XM_B_Unicode 401848 72.92 71.74 73.20 6 XMListUnsubscribeExists 317355 59.25 65.40 57.81 7 BAYES_50 310325 54.57 46.21 56.53 8 DKIM_VALID_AU 303037 55.24 55.43 55.20 9 DCC_CHECK_NEGATIVE 285828 45.27 16.33 52.07 10 DCC_CHECK 252011 52.77 82.04 45.91 11 XM_B_Unicode3 232938 43.34 47.19 42.43 12 HTML_FONT_LOW_CONTRAST 166632 31.23 34.96 30.35 13 T_TM2_M_HEADER_IN_MSG 152575 25.69 16.75 27.79 14 DKIM_VALID_EF 146841 26.46 25.25 26.75 15 LOC_TINY_FONT_1 145244 28.27 35.98 26.46 16 FVGT_m_MULTI_ODD 120835 22.77 26.01 22.01 17 XMSubLong 117055 22.57 27.91 21.32 18 MIME_HTML_ONLY 112973 23.50 35.93 20.58 19 T_KAM_HTML_FONT_INVALID 106602 19.49 19.81 19.42 20 BAYES_00 101154 15.50 3.05 18.43 21 MultiRelay 98826 18.68 21.55 18.00 22 TR_XM_DK_Bayes 83882 12.63 1.33 15.28 23 TR_XM_DK_Bayes1 80406 12.09 1.19 14.65 24 XM_Body_Dirty_Words 75356 15.16 21.27 13.73 25 TR_XM_DK_Bayes2 68778 10.28 0.69 12.53 26 XM_Multi_Part_URI 67875 13.52 18.45 12.36 27 ALL_TRUSTED 66844 10.13 1.40 12.18 28 XM_B_Unsub 57832 11.45 15.37 10.53 29 XM_Evil_Numbers_Gen 55975 10.65 12.57 10.20 30 RCVD_IN_RP_SAFE 54989 8.44 1.73 10.02 31 HTML_IMAGE_RATIO_02 52934 10.47 14.00 9.64 32 LotsOfNums_01 51459 9.36 9.32 9.37 33 RCVD_IN_RP_CERTIFIED 49514 7.54 1.25 9.02 34 T_XMDrugObfuBody_14 46439 8.52 8.80 8.46 35 LOTS_OF_MONEY 43053 8.75 12.59 7.84 36 TooManyTo_001 41946 7.97 9.38 7.64 37 XM_DKIMWhitelistDomains 41114 6.07 0.03 7.49 38 XM_H_Long_From01 39959 7.01 5.86 7.28 39 XM_DK_Undo_02 37756 12.53 36.59 6.88 40 MIME_QP_LONG_LINE 37693 6.71 6.03 6.87 41 FSL_BULK_SIG 36970 8.98 18.52 6.73 42 XM_SendGrid 35716 6.47 6.29 6.51 43 XM_B_Phish_Phrases 35584 6.71 7.69 6.48 44 RCVD_IN_MSPIKE_H2 34232 5.91 4.54 6.24 45 HTML_IMAGE_RATIO_04 33649 6.26 6.81 6.13 46 RCVD_IN_IADB_LISTED 33304 5.42 2.69 6.07 47 RELAYCOUNTRY_META 31758 8.79 21.59 5.78 48 BAYES_40 31015 5.45 4.59 5.65 49 RCVD_IN_IADB_SPF 29279 4.81 2.60 5.33 50 RCVD_IN_MSPIKE_WL 28198 4.47 1.64 5.14 51 BAYES_60 27861 5.12 5.31 5.08 52 BOTNET_IPINHOSTNAME 27634 7.66 18.83 5.03 53 RCVD_IN_IADB_SENDERID 25921 4.31 2.55 4.72 54 DKIM_INVALID 25435 5.19 7.59 4.63 55 RCVD_IN_IADB_DK 25364 4.23 2.55 4.62 56 RCVD_IN_MSPIKE_H3 24343 3.81 1.13 4.43 57 XM_PDF 23910 3.67 0.78 4.36 58 BAYES_20 23717 4.15 3.42 4.32 59 XMSubMetaSx_00 23486 5.17 8.95 4.28 60 T_TooManySym_01 23290 3.96 2.77 4.24 61 XMSexyCombo_05 22367 5.40 11.06 4.07 62 HTML_IMAGE_RATIO_06 22186 4.05 4.07 4.04 63 XMStrtUSub 21830 4.13 4.76 3.98 64 RCVD_IN_IADB_VOUCHED 21132 3.26 0.75 3.85 65 FROM_EXCESS_BASE64 20966 3.73 3.35 3.82 66 T_REMOTE_IMAGE 20553 4.48 7.64 3.74 67 MPART_ALT_DIFF 19887 4.44 7.91 3.62 68 IN_ZIMBRA_NJ_WHITELIST 19534 2.88 0.01 3.56 69 XM_UncommonTLD01 18887 5.65 15.08 3.44 70 XMNumbers 17750 3.64 5.37 3.23 71 TR_XM_DK_SendGrid 17674 3.30 3.67 3.22 72 MIME_HTML_MOSTLY 17446 3.63 5.57 3.18 73 BAYES_99 16431 7.32 25.74 2.99 74 BAYES_05 15336 2.63 1.95 2.79 75 XM_DIRTYINTL 14554 3.56 7.44 2.65 76 BAYES_80 13694 3.16 6.00 2.49 77 BOTNET 13291 6.35 23.07 2.42 78 RCVD_IN_IADB_OPTIN 13215 2.05 0.55 2.41 79 HTML_IMAGE_RATIO_08 13078 2.46 2.77 2.38 80 XM_CamelCaseFrm001 12983 2.38 2.42 2.36 81 BAYES_999 12784 5.68 19.98 2.33 82 MAILING_LIST_MULTI 12546 2.05 1.06 2.29 83 HTML_MIME_NO_HTML_TAG 12430 3.34 7.92 2.26 84 URI_HEX 12069 2.50 3.77 2.20 85 UNPARSEABLE_RELAY 11928 2.10 1.78 2.17 86 KHOP_HELO_FCRDNS 11644 2.48 3.99 2.12 87 TM2_M_URI_OPT_OUT 11390 2.54 4.52 2.07 88 XM_SPF_SoftFail 10877 2.60 5.22 1.98 89 T_TooManySym_02 10636 1.67 0.53 1.94 90 XM_B_SpammyTLD 10351 2.85 6.98 1.89 91 XM_B_Unsub2 10338 2.15 3.31 1.88 92 TooManyTo_002 10319 1.71 0.98 1.88 93 TVD_RCVD_IP 10272 1.60 0.44 1.87 94 UNTRUSTED_Relay 10105 4.04 13.40 1.84 95 MIME_HTML_ONLY_MULTI 9763 2.19 3.93 1.78 96 RELAYCOUNTRY_CA 9474 1.99 3.12 1.73 97 ANY_BOUNCE_MESSAGE 9212 1.46 0.54 1.68 98 BOUNCE_MESSAGE 9212 1.46 0.54 1.68 99 XMDiploma_00 9045 1.82 2.53 1.65 100 RCVD_IN_BL_SPAMCOP_NET 9034 2.14 4.26 1.65 101 XMBdyGiftCard01 8670 1.60 1.67 1.58 102 SUBJ_ALL_CAPS 8364 1.55 1.66 1.52 103 IN_HORDE_ADDRESS_BOOK 8295 1.23 0.02 1.51 104 XM_DK_Undo_01 8223 1.55 1.78 1.50 105 CK_HELO_DYNAMIC_SPLIT_IP 7959 1.25 0.40 1.45 106 HELO_DYNAMIC_IPADDR2 7953 1.19 0.08 1.45 107 BAYES_95 7906 1.83 3.49 1.44 108 HELO_NODOT 7877 1.28 0.64 1.43 109 HELO_NO_DOMAIN 7874 1.28 0.64 1.43 110 T_XMDrugObfuBody_08 7761 1.57 2.22 1.41 111 T_XMDrugObfuBody_00 7710 1.53 2.04 1.40 112 XM_OfRef6 7658 1.59 2.45 1.39 113 TR_DCC_Bayes_99 7611 5.16 21.23 1.39 114 INVALID_MSGID 7494 1.16 0.26 1.37 115 TR_Symld_Words 7274 1.28 1.10 1.33 116 XMCapTrack 6957 1.09 0.32 1.27 117 TO_MALFORMED 6864 1.02 0.05 1.25 118 TooManyTo_003 6826 1.16 0.79 1.24 119 XMStockSpam_06 6460 1.35 2.11 1.18 120 XMPhish11 6456 1.21 1.37 1.18 121 XMHTML_After_End 6409 1.10 0.80 1.17 122 TM2_M_VERY_LONG_WORD 6286 1.51 3.06 1.15 123 RELAYCOUNTRY_GB 6075 1.68 4.12 1.11 124 URI_TRY_3LD 6001 1.10 1.13 1.09 125 SpammyFromTLD_01 5954 1.27 2.08 1.08 126 USER_IN_DEF_DKIM_WL 5950 0.88 0.00 1.08 127 TR_XM_PHPDW 5917 1.25 1.97 1.08 128 XM_UB50 5900 2.21 7.04 1.07 129 XMGenDplmaNmb 5824 1.19 1.75 1.06 130 TR_XM_PHPForged 5814 1.22 1.90 1.06 131 XM_GoogleGroups 5805 0.94 0.42 1.06 132 TR_XM_FormFill2 5805 1.23 1.94 1.06 133 DKIM_ADSP_CUSTOM_MED 5802 1.03 0.90 1.06 134 XM_H_PHPOS 5780 1.21 1.88 1.05 135 T_XMHurry_00 5701 1.12 1.48 1.04 136 NO_DNS_FOR_FROM 5598 1.36 2.82 1.02 137 TR_XM_RelayPhish 5554 1.33 2.70 1.01 138 XMGappySubj_01 5429 0.90 0.51 0.99 139 XM_H_Long_From02 5343 1.03 1.27 0.97 140 TooManyTo_004 5161 0.89 0.67 0.94 141 TR_MetaPhish_Combo_01 4964 0.87 0.73 0.90 142 XMSexyCombo_01 4962 1.29 2.92 0.90 143 XMBrknScrpt_02 4576 0.85 0.93 0.83 144 XM_ProductURIs 4453 0.85 1.01 0.81 145 XMSubMetaI_00 4407 0.99 1.79 0.80 146 TooManyTo_005 4362 0.75 0.55 0.79 147 XMSubMetaSxObfu_03 4300 0.99 1.88 0.78 148 FROM_GOV_DKIM_AU 4258 0.67 0.22 0.78 149 XMHTMLBadTable_001 4233 0.78 0.80 0.77 150 NML_ADSP_CUSTOM_MED 4031 0.73 0.70 0.73 151 RCVD_IN_MSPIKE_BL 3890 0.85 1.46 0.71 152 XMBody_17 3786 0.98 2.19 0.69 153 T_FILL_THIS_FORM_SHORT 3744 0.79 1.25 0.68 154 TO_NO_BRKTS_HTML_ONLY 3620 0.58 0.24 0.66 155 FORGED_GMAIL_RCVD 3583 0.68 0.80 0.65 156 XM_SPF_Unknown 3549 0.67 0.75 0.65 157 T_OBFU_PDF_ATTACH 3477 0.56 0.26 0.63 158 XMBody_95 3430 0.53 0.14 0.62 159 URI_NOVOWEL 3360 0.63 0.70 0.61 160 HTML_FONT_FACE_BAD 3338 0.75 1.37 0.61 161 URIBL_CSS 3302 0.59 0.57 0.60 162 URIBL_CSS_A 3302 0.59 0.57 0.60 163 HTTPS_HTTP_MISMATCH 3300 0.61 0.64 0.60 164 TR_LOTS_OF_MONEY3 3221 0.78 1.58 0.59 165 US_DOLLARS_3 3173 0.74 1.46 0.58 166 MISSING_HEADERS 3121 0.56 0.54 0.57 167 RCVD_IN_MSPIKE_H4 3049 0.52 0.38 0.56 168 XMPhish30 2984 0.64 1.04 0.54 169 XMLngstWrd_00 2945 0.51 0.42 0.54 170 XM_ShortIntro_01 2941 0.51 0.42 0.54 171 RELAYCOUNTRY_AU 2840 0.50 0.42 0.52 172 XM_H_PHPMailer 2821 0.62 1.06 0.51 173 DKIM_ADSP_NXDOMAIN 2821 0.87 2.40 0.51 174 TR_LOTS_OF_MONEY2 2786 0.75 1.79 0.51 175 T_MONEY_PERCENT 2786 0.75 1.79 0.51 176 TM2_M_BODY_EMPTY 2785 0.43 0.08 0.51 177 XMLngstWrd_01 2753 0.48 0.40 0.50 178 HTML_TAG_BALANCE_BODY 2738 0.52 0.60 0.50 179 XMMoneyMeta_00 2685 0.74 1.81 0.49 180 RCVD_IN_MSPIKE_L3 2679 0.48 0.43 0.49 181 RELAYCOUNTRY_FR 2663 0.94 2.90 0.49 182 XMNoVowels 2647 0.52 0.67 0.48 183 XM_B_REG_HTML 2631 0.45 0.31 0.48 184 T_TooManySym_03 2581 0.41 0.16 0.47 185 PLING_QUERY 2429 0.50 0.72 0.44 186 USER_IN_WHITELIST 2382 0.35 0.00 0.43 187 XMSolicitRefs_0 2355 0.43 0.41 0.43 188 REMOVE_BEFORE_LINK 2354 0.45 0.53 0.43 189 RELAYCOUNTRY_DE 2351 0.57 1.17 0.43 190 SUBJ_DOLLARS 2349 0.53 0.99 0.43 191 HTML_IMAGE_ONLY_32 2306 0.40 0.29 0.42 192 FROM_GOV_SPOOF 2300 0.40 0.33 0.42 193 DIET_1 2279 0.53 1.02 0.42 194 XMBSHREFv2 2267 0.43 0.52 0.41 195 T_Symld_Words_02 2254 0.53 1.02 0.41 196 SpammyFromTLD_02 2254 2.07 9.13 0.41 197 XMBody_78 2228 0.51 0.94 0.41 198 SHORT_HELO_AND_INLINE_IMAGE 2206 0.34 0.07 0.40 199 XM_B_COPY_HTML 2170 0.41 0.46 0.40 200 HK_RANDOM_REPLYTO 2135 0.53 1.11 0.39 ----------------------------------------------------------------------