Email: 636815 Autolearn: 0 AvgScore: 1.56 AvgScanTime: 2.42 sec Spam: 121682 Autolearn: 0 AvgScore: 12.46 AvgScanTime: 3.20 sec Ham: 515133 Autolearn: 0 AvgScore: -1.02 AvgScanTime: 2.24 sec Time Spent Running SA: 428.84 hours Time Spent Processing Spam: 108.24 hours Time Spent Processing Ham: 320.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 116416 90.56 95.67 89.35 2 DCC_CHECK 95222 52.79 78.25 46.77 3 DKIM_SIGNED 94658 79.44 77.79 79.82 4 XM_DK_Pass 91311 77.97 75.04 78.66 5 DKIM_VALID 86023 74.38 70.69 75.26 6 XM_B_Unicode 85788 72.20 70.50 72.60 7 XMListUnsubscribeExists 81383 57.92 66.88 55.80 8 DKIM_VALID_AU 67939 56.37 55.83 56.50 9 XM_B_Unicode3 59390 44.74 48.81 43.78 10 BAYES_50 50198 52.44 41.25 55.08 11 HTML_FONT_LOW_CONTRAST 47565 31.76 39.09 30.03 12 LOC_TINY_FONT_1 46132 28.12 37.91 25.81 13 XM_DK_Undo_02 46040 12.87 37.84 6.97 14 MIME_HTML_ONLY 43538 24.88 35.78 22.30 15 BAYES_99 32656 8.04 26.84 3.60 16 DKIM_VALID_EF 31409 27.31 25.81 27.67 17 XMSubLong 31050 22.48 25.52 21.77 18 FVGT_m_MULTI_ODD 29315 21.92 24.09 21.41 19 BOTNET 28068 6.73 23.07 2.88 20 TR_DCC_Bayes_99 26035 5.45 21.40 1.68 21 BAYES_999 25513 6.36 20.97 2.91 22 XM_UncommonTLD01 24873 6.47 20.44 3.17 23 XM_Body_Dirty_Words 24381 16.23 20.04 15.33 24 DCC_CHECK_NEGATIVE 24251 45.39 19.93 51.40 25 RELAYCOUNTRY_META 22694 7.80 18.65 5.24 26 BOTNET_IPINHOSTNAME 21363 7.31 17.56 4.89 27 XM_Multi_Part_URI 21211 14.28 17.43 13.54 28 MultiRelay 20979 18.88 17.24 19.26 29 T_TM2_M_HEADER_IN_MSG 20761 25.09 17.06 26.99 30 T_KAM_HTML_FONT_INVALID 20478 18.00 16.83 18.28 31 FSL_BULK_SIG 19174 9.01 15.76 7.42 32 XM_B_Unsub 17156 11.34 14.10 10.69 33 HTML_IMAGE_RATIO_02 16706 10.94 13.73 10.28 34 TooManyTo_001 15955 8.57 13.11 7.49 35 SpammyFromTLD_02 15755 2.77 12.95 0.37 36 LOTS_OF_MONEY 15554 10.44 12.78 9.89 37 XMNumbers 15132 5.11 12.44 3.38 38 XM_Evil_Numbers_Gen 15106 10.95 12.41 10.60 39 XMSexyCombo_05 14685 6.53 12.07 5.22 40 UNTRUSTED_Relay 12358 3.37 10.16 1.77 41 MPART_ALT_DIFF 11872 5.24 9.76 4.18 42 XM_B_SpammyTLD 11450 3.79 9.41 2.47 43 XMSubMetaSx_00 11208 4.93 9.21 3.91 44 XM_B_Phish_Phrases 11020 7.53 9.06 7.17 45 T_XMDrugObfuBody_14 10266 8.48 8.44 8.49 46 T_REMOTE_IMAGE 10000 4.54 8.22 3.67 47 HTML_IMAGE_RATIO_04 9920 6.37 8.15 5.95 48 FROM_SUSPICIOUS_NTLD 9528 1.56 7.83 0.07 49 FROM_SUSPICIOUS_NTLD_FP 9486 1.55 7.80 0.07 50 XM_H_Long_From01 8705 6.92 7.15 6.86 51 DKIM_INVALID 8635 5.05 7.10 4.57 52 LotsOfNums_01 8054 8.40 6.62 8.82 53 BAYES_80 8023 3.28 6.59 2.49 54 XM_DIRTYINTL 7807 4.20 6.42 3.68 55 HTML_SHORT_LINK_IMG_1 7100 1.14 5.83 0.03 56 XM_UB50 6826 1.86 5.61 0.98 57 HDRS_LCASE_IMGONLY 6817 1.11 5.60 0.05 58 MIME_HTML_ONLY_MULTI 6489 2.80 5.33 2.20 59 DATE_IN_PAST_06_12 6247 1.07 5.13 0.11 60 REPLYTO_WITHOUT_TO_CC 6244 1.01 5.13 0.04 61 HTML_IMAGE_ONLY_12 6223 1.11 5.11 0.16 62 BAYES_60 6182 4.87 5.08 4.82 63 MIME_HTML_MOSTLY 6141 3.38 5.05 2.99 64 MIME_HEADER_CTYPE_ONLY 6021 1.01 4.95 0.08 65 BAYES_40 5975 5.47 4.91 5.61 66 HTML_MIME_NO_HTML_TAG 5902 2.77 4.85 2.28 67 TO_EQ_FM_DOM_HTML_IMG 5784 0.91 4.75 0.01 68 XMStrtUSub 5784 4.53 4.75 4.47 69 URI_HEX 5742 2.49 4.72 1.97 70 MIME_QP_LONG_LINE 5735 6.10 4.71 6.43 71 BOTNET_NORDNS 5698 1.32 4.68 0.52 72 BAYES_00 5473 16.54 4.50 19.39 73 RELAYCOUNTRY_GB 5441 1.56 4.47 0.87 74 KHOP_HELO_FCRDNS 5310 2.57 4.36 2.15 75 NO_DNS_FOR_FROM 5279 1.67 4.34 1.03 76 BAYES_20 5191 4.32 4.27 4.33 77 XM_SendGrid 5172 6.68 4.25 7.25 78 XM_URI_RBL 5123 1.06 4.21 0.31 79 DKIM_ADSP_NXDOMAIN 4914 1.19 4.04 0.52 80 FROM_EXCESS_BASE64 4764 3.74 3.92 3.70 81 RCVD_IN_MSPIKE_H2 4700 6.70 3.86 7.37 82 BAYES_95 4648 1.90 3.82 1.45 83 TM2_M_URI_OPT_OUT 4531 2.36 3.72 2.04 84 HTML_IMAGE_RATIO_06 4527 4.12 3.72 4.21 85 XM_SPF_SoftFail 4434 2.37 3.64 2.07 86 RCVD_IN_BL_SPAMCOP_NET 4233 1.54 3.48 1.08 87 T_TooManySym_01 4186 4.59 3.44 4.87 88 XMDiploma_00 4042 2.09 3.32 1.80 89 MultiRelay_CC 3815 0.78 3.14 0.22 90 MultiRelay_Combo 3815 0.78 3.14 0.22 91 XM_OfRef6 3722 1.78 3.06 1.48 92 DATE_IN_PAST_03_06 3574 0.69 2.94 0.16 93 XM_CamelCaseFrm001 3531 2.50 2.90 2.40 94 HTML_IMAGE_RATIO_08 3524 2.44 2.90 2.33 95 RELAYCOUNTRY_CA 3418 1.84 2.81 1.61 96 XMSubNoVowel 3294 0.82 2.71 0.37 97 RCVD_IN_RP_RNBL 3230 0.55 2.65 0.06 98 XMGenDplmaNmb 3209 1.42 2.64 1.14 99 XM_B_Unsub2 3088 1.83 2.54 1.66 100 RELAYCOUNTRY_FR 2943 0.75 2.42 0.35 101 BAYES_05 2896 2.77 2.38 2.86 102 XMBody_17 2894 0.98 2.38 0.65 103 XMStockSpam_06 2818 1.79 2.32 1.66 104 XMSexyCombo_01 2814 1.06 2.31 0.77 105 AC_FROM_MANY_DOTS 2665 0.46 2.19 0.05 106 TR_XM_PHPDW 2642 0.87 2.17 0.56 107 T_XMDrugObfuBody_08 2629 1.53 2.16 1.39 108 TR_XM_DK_SendGrid 2609 3.46 2.14 3.77 109 TR_XM_PHPForged 2607 0.85 2.14 0.55 110 RDNS_DYNAMIC 2604 0.68 2.14 0.33 111 TR_XM_FormFill2 2594 0.85 2.13 0.55 112 TR_XM_INV_DKIM 2590 0.56 2.13 0.18 113 XM_H_PHPOS 2586 0.84 2.13 0.54 114 TM2_M_VERY_LONG_WORD 2501 1.65 2.06 1.55 115 XMSubMetaI_00 2449 1.30 2.01 1.13 116 T_Symld_Words_02 2436 0.84 2.00 0.57 117 RCVD_IN_RP_SAFE 2431 9.60 2.00 11.40 118 TR_Symld_Words 2393 1.72 1.97 1.66 119 SpammyFromTLD_01 2317 1.04 1.90 0.84 120 XMSubMetaSSx_00 2262 0.52 1.86 0.21 121 TR_XM_RelayPhish 2252 1.70 1.85 1.66 122 RCVD_IN_IADB_LISTED 2171 4.72 1.78 5.41 123 XM_BadFromFormat 2155 0.41 1.77 0.09 124 XMBdyGiftCard01 2148 1.91 1.77 1.94 125 TR_Mismatch_TLD_02 2065 0.37 1.70 0.06 126 SUBJ_ALL_CAPS 2045 2.19 1.68 2.31 127 RCVD_IN_IADB_SPF 2030 4.08 1.67 4.64 128 TR_XM_DK_Bayes 1993 13.11 1.64 15.81 129 RCVD_IN_IADB_DK 1983 3.50 1.63 3.95 130 RCVD_IN_IADB_SENDERID 1967 3.60 1.62 4.07 131 DKIM_ADSP_CUSTOM_MED 1963 1.20 1.61 1.10 132 ALL_TRUSTED 1921 10.26 1.58 12.31 133 XMBrknScrpt_02 1815 0.74 1.49 0.56 134 FROM_MISSP_REPLYTO 1808 0.29 1.49 0.00 135 TR_XM_DK_Bayes1 1805 12.52 1.48 15.13 136 T_XMDrugObfuBody_00 1789 1.21 1.47 1.14 137 NML_ADSP_CUSTOM_MED 1778 0.96 1.46 0.84 138 TR_Mismatch_TLD_01 1776 0.52 1.46 0.30 139 FORGED_GMAIL_RCVD 1773 0.73 1.46 0.56 140 XMPhish11 1754 1.10 1.44 1.02 141 HELO_NODOT 1714 1.39 1.41 1.38 142 HELO_NO_DOMAIN 1712 1.39 1.41 1.38 143 RCVD_IN_MSPIKE_BL 1686 1.40 1.39 1.40 144 HK_RANDOM_REPLYTO 1659 0.48 1.36 0.27 145 RELAYCOUNTRY_NL 1610 0.42 1.32 0.20 146 HTML_FONT_FACE_BAD 1608 0.81 1.32 0.69 147 XMSubMetaSxObfu_03 1604 0.80 1.32 0.68 148 UNPARSEABLE_RELAY 1602 2.04 1.32 2.21 149 T_XMHurry_00 1598 0.84 1.31 0.73 150 FROM_MISSP_DYNIP 1596 0.25 1.31 0.00 151 T_HTML_TAG_BALANCE_CENTER 1590 0.37 1.31 0.15 152 RCVD_IN_MSPIKE_WL 1574 3.95 1.29 4.58 153 XM_H_PHPMailer 1569 0.62 1.29 0.46 154 DIET_1 1565 0.87 1.29 0.77 155 PDS_BTC_ID 1540 1.16 1.27 1.14 156 XMHTML_After_End 1527 1.35 1.25 1.38 157 TO_NO_BRKTS_FROM_MSSP 1522 0.25 1.25 0.01 158 RELAYCOUNTRY_AT 1501 0.40 1.23 0.20 159 XMMoneyMeta_00 1439 0.60 1.18 0.46 160 RCVD_IN_RP_CERTIFIED 1405 8.64 1.15 10.40 161 MAILING_LIST_MULTI 1397 1.89 1.15 2.07 162 FILL_THIS_FORM 1388 0.72 1.14 0.62 163 XMSolicitRefs_0 1386 0.79 1.14 0.71 164 THIS_AD 1377 0.37 1.13 0.19 165 XM_DK_Undo_01 1372 1.35 1.13 1.41 166 FSL_HELO_NON_FQDN_1 1357 0.22 1.12 0.00 167 FSL_THIS_IS_ADV 1355 0.51 1.11 0.37 168 TR_LOTS_OF_MONEY3 1341 0.55 1.10 0.42 169 XM_H_Long_From02 1319 1.17 1.08 1.19 170 XM_H_PHPOS_M 1308 0.32 1.07 0.14 171 BODY_URI_ONLY 1307 0.29 1.07 0.10 172 XMPhish14 1272 0.49 1.05 0.35 173 XMPhish30 1263 0.64 1.04 0.55 174 FILL_THIS_FORM_LONG 1254 0.62 1.03 0.52 175 RCVD_IN_MSPIKE_H3 1253 3.46 1.03 4.04 176 TR_LOTS_OF_MONEY2 1230 0.70 1.01 0.62 177 T_MONEY_PERCENT 1230 0.70 1.01 0.62 178 LongTLD 1229 0.34 1.01 0.19 179 RELAYCOUNTRY_SG 1217 0.28 1.00 0.11 180 HTML_IMAGE_ONLY_08 1216 0.29 1.00 0.12 181 XM_ProductURIs 1216 1.19 1.00 1.24 182 URIBL_DBL_ABUSE_REDIR 1198 0.20 0.98 0.01 183 T_TooManySym_02 1197 1.79 0.98 1.98 184 XM_UB60 1192 0.24 0.98 0.06 185 RCVD_IN_MSPIKE_L5 1176 0.32 0.97 0.17 186 TM2_M_A_HREF_HREF 1169 0.66 0.96 0.59 187 URI_TRY_3LD 1132 1.38 0.93 1.48 188 XM_B_COPY_HTML 1113 0.48 0.91 0.38 189 XMGppyBdWords 1112 0.32 0.91 0.18 190 XMSexyCombo_04 1084 0.29 0.89 0.15 191 RCVD_IN_PSBL 1064 0.20 0.87 0.04 192 T_FILL_THIS_FORM_SHORT 1063 0.76 0.87 0.74 193 RELAYCOUNTRY_DE 1044 0.57 0.86 0.51 194 LOW_PRICE 1043 0.36 0.86 0.24 195 XM_UB99 1005 0.17 0.83 0.01 196 XMSlimDrugH 1000 0.36 0.82 0.26 197 TR_XM_DK_Bayes2 999 10.73 0.82 13.07 198 DATE_IN_FUTURE_06_12 981 0.16 0.81 0.00 199 HTML_IMAGE_ONLY_20 963 0.36 0.79 0.26 200 TooManyTo_002 958 1.62 0.79 1.82 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 460264 90.56 95.67 89.35 2 DKIM_SIGNED 411197 79.44 77.79 79.82 3 XM_DK_Pass 405226 77.97 75.04 78.66 4 DKIM_VALID 387667 74.38 70.69 75.26 5 XM_B_Unicode 373983 72.20 70.50 72.60 6 DKIM_VALID_AU 291027 56.37 55.83 56.50 7 XMListUnsubscribeExists 287438 57.92 66.88 55.80 8 BAYES_50 283742 52.44 41.25 55.08 9 DCC_CHECK_NEGATIVE 264780 45.39 19.93 51.40 10 DCC_CHECK 240932 52.79 78.25 46.77 11 XM_B_Unicode3 225513 44.74 48.81 43.78 12 HTML_FONT_LOW_CONTRAST 154679 31.76 39.09 30.03 13 DKIM_VALID_EF 142526 27.31 25.81 27.67 14 T_TM2_M_HEADER_IN_MSG 139016 25.09 17.06 26.99 15 LOC_TINY_FONT_1 132959 28.12 37.91 25.81 16 MIME_HTML_ONLY 114871 24.88 35.78 22.30 17 XMSubLong 112126 22.48 25.52 21.77 18 FVGT_m_MULTI_ODD 110303 21.92 24.09 21.41 19 BAYES_00 99879 16.54 4.50 19.39 20 MultiRelay 99229 18.88 17.24 19.26 21 T_KAM_HTML_FONT_INVALID 94178 18.00 16.83 18.28 22 TR_XM_DK_Bayes 81466 13.11 1.64 15.81 23 XM_Body_Dirty_Words 78976 16.23 20.04 15.33 24 TR_XM_DK_Bayes1 77927 12.52 1.48 15.13 25 XM_Multi_Part_URI 69736 14.28 17.43 13.54 26 TR_XM_DK_Bayes2 67317 10.73 0.82 13.07 27 ALL_TRUSTED 63423 10.26 1.58 12.31 28 RCVD_IN_RP_SAFE 58735 9.60 2.00 11.40 29 XM_B_Unsub 55046 11.34 14.10 10.69 30 XM_Evil_Numbers_Gen 54619 10.95 12.41 10.60 31 RCVD_IN_RP_CERTIFIED 53598 8.64 1.15 10.40 32 HTML_IMAGE_RATIO_02 52952 10.94 13.73 10.28 33 LOTS_OF_MONEY 50927 10.44 12.78 9.89 34 LotsOfNums_01 45451 8.40 6.62 8.82 35 XM_DKIMWhitelistDomains 44260 6.97 0.08 8.59 36 T_XMDrugObfuBody_14 43750 8.48 8.44 8.49 37 TooManyTo_001 38600 8.57 13.11 7.49 38 FSL_BULK_SIG 38228 9.01 15.76 7.42 39 RCVD_IN_MSPIKE_H2 37981 6.70 3.86 7.37 40 XM_SendGrid 37348 6.68 4.25 7.25 41 XM_B_Phish_Phrases 36953 7.53 9.06 7.17 42 XM_DK_Undo_02 35904 12.87 37.84 6.97 43 XM_H_Long_From01 35356 6.92 7.15 6.86 44 MIME_QP_LONG_LINE 33109 6.10 4.71 6.43 45 HTML_IMAGE_RATIO_04 30658 6.37 8.15 5.95 46 BAYES_40 28875 5.47 4.91 5.61 47 RCVD_IN_IADB_LISTED 27857 4.72 1.78 5.41 48 RELAYCOUNTRY_META 26968 7.80 18.65 5.24 49 XMSexyCombo_05 26884 6.53 12.07 5.22 50 BOTNET_IPINHOSTNAME 25203 7.31 17.56 4.89 51 T_TooManySym_01 25067 4.59 3.44 4.87 52 BAYES_60 24849 4.87 5.08 4.82 53 RCVD_IN_IADB_SPF 23926 4.08 1.67 4.64 54 RCVD_IN_MSPIKE_WL 23596 3.95 1.29 4.58 55 DKIM_INVALID 23530 5.05 7.10 4.57 56 XMStrtUSub 23036 4.53 4.75 4.47 57 BAYES_20 22298 4.32 4.27 4.33 58 HTML_IMAGE_RATIO_06 21708 4.12 3.72 4.21 59 MPART_ALT_DIFF 21525 5.24 9.76 4.18 60 XM_PDF 21100 3.46 0.78 4.10 61 RCVD_IN_IADB_SENDERID 20984 3.60 1.62 4.07 62 RCVD_IN_MSPIKE_H3 20796 3.46 1.03 4.04 63 RCVD_IN_IADB_DK 20324 3.50 1.63 3.95 64 XMSubMetaSx_00 20160 4.93 9.21 3.91 65 TR_XM_DK_SendGrid 19431 3.46 2.14 3.77 66 FROM_EXCESS_BASE64 19062 3.74 3.92 3.70 67 IN_ZIMBRA_NJ_WHITELIST 18948 2.98 0.01 3.68 68 XM_DIRTYINTL 18940 4.20 6.42 3.68 69 T_REMOTE_IMAGE 18908 4.54 8.22 3.67 70 RCVD_IN_IADB_VOUCHED 18670 3.04 0.57 3.62 71 BAYES_99 18520 8.04 26.84 3.60 72 XMNumbers 17393 5.11 12.44 3.38 73 XM_UncommonTLD01 16308 6.47 20.44 3.17 74 MIME_HTML_MOSTLY 15408 3.38 5.05 2.99 75 BAYES_999 14987 6.36 20.97 2.91 76 BOTNET 14815 6.73 23.07 2.88 77 BAYES_05 14745 2.77 2.38 2.86 78 BAYES_80 12841 3.28 6.59 2.49 79 XM_B_SpammyTLD 12708 3.79 9.41 2.47 80 XM_CamelCaseFrm001 12383 2.50 2.90 2.40 81 RCVD_IN_IADB_OPTIN 12222 2.00 0.44 2.37 82 HTML_IMAGE_RATIO_08 12026 2.44 2.90 2.33 83 SUBJ_ALL_CAPS 11902 2.19 1.68 2.31 84 HTML_MIME_NO_HTML_TAG 11730 2.77 4.85 2.28 85 UNPARSEABLE_RELAY 11366 2.04 1.32 2.21 86 MIME_HTML_ONLY_MULTI 11343 2.80 5.33 2.20 87 KHOP_HELO_FCRDNS 11084 2.57 4.36 2.15 88 TVD_RCVD_IP 10964 1.79 0.38 2.13 89 XM_SPF_SoftFail 10657 2.37 3.64 2.07 90 MAILING_LIST_MULTI 10639 1.89 1.15 2.07 91 TM2_M_URI_OPT_OUT 10503 2.36 3.72 2.04 92 T_TooManySym_02 10204 1.79 0.98 1.98 93 URI_HEX 10136 2.49 4.72 1.97 94 XMBdyGiftCard01 10018 1.91 1.77 1.94 95 TooManyTo_002 9373 1.62 0.79 1.82 96 XMDiploma_00 9289 2.09 3.32 1.80 97 UNTRUSTED_Relay 9115 3.37 10.16 1.77 98 TR_DCC_Bayes_99 8650 5.45 21.40 1.68 99 TR_Symld_Words 8568 1.72 1.97 1.66 100 XMStockSpam_06 8563 1.79 2.32 1.66 101 TR_XM_RelayPhish 8556 1.70 1.85 1.66 102 XM_B_Unsub2 8554 1.83 2.54 1.66 103 RELAYCOUNTRY_CA 8313 1.84 2.81 1.61 104 IN_HORDE_ADDRESS_BOOK 8082 1.28 0.03 1.57 105 TM2_M_VERY_LONG_WORD 8005 1.65 2.06 1.55 106 URI_TRY_3LD 7649 1.38 0.93 1.48 107 XM_OfRef6 7623 1.78 3.06 1.48 108 CK_HELO_DYNAMIC_SPLIT_IP 7593 1.24 0.26 1.47 109 HELO_DYNAMIC_IPADDR2 7591 1.20 0.07 1.47 110 INVALID_MSGID 7535 1.23 0.23 1.46 111 ANY_BOUNCE_MESSAGE 7504 1.26 0.43 1.46 112 BOUNCE_MESSAGE 7502 1.26 0.43 1.46 113 BAYES_95 7461 1.90 3.82 1.45 114 XM_DK_Undo_01 7246 1.35 1.13 1.41 115 RCVD_IN_MSPIKE_BL 7223 1.40 1.39 1.40 116 T_XMDrugObfuBody_08 7137 1.53 2.16 1.39 117 HELO_NODOT 7116 1.39 1.41 1.38 118 HELO_NO_DOMAIN 7115 1.39 1.41 1.38 119 XMHTML_After_End 7097 1.35 1.25 1.38 120 USER_IN_DEF_DKIM_WL 7008 1.10 0.01 1.36 121 TO_MALFORMED 6664 1.05 0.02 1.29 122 XM_ProductURIs 6366 1.19 1.00 1.24 123 TooManyTo_003 6317 1.12 0.64 1.23 124 XM_H_Long_From02 6121 1.17 1.08 1.19 125 XM_RXBody 6030 1.02 0.37 1.17 126 XM_SPF_Unknown 5935 1.04 0.58 1.15 127 T_XMDrugObfuBody_00 5891 1.21 1.47 1.14 128 PDS_BTC_ID 5872 1.16 1.27 1.14 129 XMGenDplmaNmb 5861 1.42 2.64 1.14 130 XMGappySubj_01 5846 1.00 0.44 1.13 131 XMSubMetaI_00 5809 1.30 2.01 1.13 132 DKIM_ADSP_CUSTOM_MED 5661 1.20 1.61 1.10 133 XMCapTrack 5610 0.94 0.30 1.09 134 RCVD_IN_BL_SPAMCOP_NET 5543 1.54 3.48 1.08 135 NO_DNS_FOR_FROM 5331 1.67 4.34 1.03 136 XMPhish11 5258 1.10 1.44 1.02 137 XM_GoogleGroups 5220 0.90 0.43 1.01 138 XM_UB50 5048 1.86 5.61 0.98 139 TooManyTo_004 4646 0.83 0.54 0.90 140 RELAYCOUNTRY_GB 4465 1.56 4.47 0.87 141 NML_ADSP_CUSTOM_MED 4338 0.96 1.46 0.84 142 SpammyFromTLD_01 4317 1.04 1.90 0.84 143 DIET_1 3975 0.87 1.29 0.77 144 TooManyTo_005 3963 0.71 0.47 0.77 145 XMSexyCombo_01 3961 1.06 2.31 0.77 146 T_FILL_THIS_FORM_SHORT 3800 0.76 0.87 0.74 147 FROM_GOV_DKIM_AU 3792 0.63 0.17 0.74 148 T_XMHurry_00 3761 0.84 1.31 0.73 149 XMSolicitRefs_0 3654 0.79 1.14 0.71 150 XMBody_95 3624 0.61 0.24 0.70 151 TR_MetaPhish_Combo_01 3579 0.70 0.70 0.69 152 HTML_FONT_FACE_BAD 3562 0.81 1.32 0.69 153 PLING_QUERY 3539 0.70 0.76 0.69 154 XMHTMLBadTable_001 3532 0.70 0.77 0.69 155 XMSubMetaSxObfu_03 3517 0.80 1.32 0.68 156 XMBody_17 3345 0.98 2.38 0.65 157 RCVD_IN_MSPIKE_L4 3310 0.56 0.19 0.64 158 TR_LOTS_OF_MONEY2 3217 0.70 1.01 0.62 159 T_MONEY_PERCENT 3217 0.70 1.01 0.62 160 HTML_TAG_BALANCE_BODY 3207 0.63 0.69 0.62 161 FILL_THIS_FORM 3197 0.72 1.14 0.62 162 TM2_M_A_HREF_HREF 3048 0.66 0.96 0.59 163 RCVD_IN_MSPIKE_L3 3045 0.52 0.23 0.59 164 XMBody_78 3014 0.58 0.58 0.59 165 USER_IN_WHITELIST 2956 0.46 0.00 0.57 166 T_Symld_Words_02 2929 0.84 2.00 0.57 167 XMBrknScrpt_02 2902 0.74 1.49 0.56 168 TR_XM_PHPDW 2898 0.87 2.17 0.56 169 URI_NOVOWEL 2893 0.53 0.41 0.56 170 FORGED_GMAIL_RCVD 2886 0.73 1.46 0.56 171 XMPhish30 2843 0.64 1.04 0.55 172 TR_XM_PHPForged 2828 0.85 2.14 0.55 173 TR_XM_FormFill2 2810 0.85 2.13 0.55 174 XM_ShortIntro_01 2787 0.48 0.24 0.54 175 XM_H_PHPOS 2786 0.84 2.13 0.54 176 T_OBFU_PDF_ATTACH 2729 0.47 0.24 0.53 177 HTTPS_HTTP_MISMATCH 2703 0.52 0.51 0.52 178 BOTNET_NORDNS 2699 1.32 4.68 0.52 179 FILL_THIS_FORM_LONG 2676 0.62 1.03 0.52 180 DKIM_ADSP_NXDOMAIN 2670 1.19 4.04 0.52 181 T_FILL_THIS_FORM_LOAN 2635 0.43 0.07 0.51 182 RELAYCOUNTRY_DE 2607 0.57 0.86 0.51 183 XMLngstWrd_00 2589 0.55 0.75 0.50 184 FROM_GOV_SPOOF 2454 0.46 0.37 0.48 185 NUMERIC_HTTP_ADDR 2442 0.45 0.36 0.47 186 REMOVE_BEFORE_LINK 2411 0.44 0.30 0.47 187 MISSING_HEADERS 2405 0.48 0.56 0.47 188 XMLngstWrd_01 2393 0.52 0.73 0.46 189 XMMoneyMeta_00 2380 0.60 1.18 0.46 190 XM_H_PHPMailer 2361 0.62 1.29 0.46 191 SUBJ_DOLLARS 2266 0.46 0.56 0.44 192 XMNoVowels 2261 0.41 0.30 0.44 193 RELAYCOUNTRY_AU 2250 0.43 0.42 0.44 194 XM_B_REG_HTML 2247 0.43 0.42 0.44 195 TM2_M_BODY_EMPTY 2203 0.37 0.11 0.43 196 T_TooManySym_03 2180 0.38 0.18 0.42 197 TR_LOTS_OF_MONEY3 2150 0.55 1.10 0.42 198 XMOemUri 2133 0.37 0.20 0.41 199 XM_shorewaves_Whitelist 2122 0.33 0.00 0.41 200 RCVD_IN_MSPIKE_H4 2109 0.37 0.21 0.41 ----------------------------------------------------------------------