Email: 659866 Autolearn: 0 AvgScore: 1.54 AvgScanTime: 2.26 sec Spam: 124556 Autolearn: 0 AvgScore: 12.06 AvgScanTime: 3.01 sec Ham: 535310 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 2.08 sec Time Spent Running SA: 413.45 hours Time Spent Processing Spam: 104.03 hours Time Spent Processing Ham: 309.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 119438 90.56 95.89 89.32 2 DCC_CHECK 101829 52.97 81.75 46.27 3 DKIM_SIGNED 97968 79.12 78.65 79.23 4 XM_DK_Pass 95072 77.68 76.33 78.00 5 XM_B_Unicode 90026 71.86 72.28 71.76 6 DKIM_VALID 88848 73.77 71.33 74.33 7 XMListUnsubscribeExists 86637 57.73 69.56 54.98 8 DKIM_VALID_AU 69863 56.77 56.09 56.92 9 XM_B_Unicode3 59273 42.89 47.59 41.80 10 BAYES_50 56057 52.59 45.01 54.35 11 LOC_TINY_FONT_1 49013 28.41 39.35 25.86 12 HTML_FONT_LOW_CONTRAST 46500 31.61 37.33 30.28 13 MIME_HTML_ONLY 46352 24.08 37.21 21.02 14 XM_DK_Undo_02 45384 12.86 36.44 7.37 15 FVGT_m_MULTI_ODD 32428 22.31 26.03 21.44 16 XMSubLong 31341 22.10 25.16 21.39 17 BAYES_99 31154 7.96 25.01 4.00 18 DKIM_VALID_EF 31141 26.82 25.00 27.25 19 XM_Body_Dirty_Words 26377 16.13 21.18 14.95 20 TR_DCC_Bayes_99 25174 5.61 20.21 2.22 21 BAYES_999 24843 6.53 19.95 3.41 22 RELAYCOUNTRY_META 24761 8.30 19.88 5.61 23 BOTNET 24750 5.62 19.87 2.30 24 T_KAM_HTML_FONT_INVALID 22821 18.11 18.32 18.06 25 XM_Multi_Part_URI 22530 14.34 18.09 13.47 26 BOTNET_IPINHOSTNAME 22189 7.39 17.81 4.96 27 T_TM2_M_HEADER_IN_MSG 21926 28.04 17.60 30.47 28 DCC_CHECK_NEGATIVE 21070 45.18 16.92 51.76 29 FSL_BULK_SIG 20896 8.72 16.78 6.85 30 XM_UncommonTLD01 20003 5.63 16.06 3.20 31 MultiRelay 19782 18.88 15.88 19.58 32 XM_Evil_Numbers_Gen 18071 11.42 14.51 10.70 33 HTML_IMAGE_RATIO_02 17916 10.84 14.38 10.01 34 XM_B_Unsub 16283 11.02 13.07 10.54 35 LOTS_OF_MONEY 14628 9.05 11.74 8.43 36 UNTRUSTED_Relay 14408 3.62 11.57 1.76 37 XMSexyCombo_05 13979 5.85 11.22 4.61 38 MPART_ALT_DIFF 12914 5.17 10.37 3.96 39 TooManyTo_001 12749 8.81 10.24 8.48 40 XMNumbers 12628 4.67 10.14 3.40 41 HTML_IMAGE_RATIO_04 11204 7.35 9.00 6.96 42 SpammyFromTLD_02 11133 1.92 8.94 0.29 43 T_XMDrugObfuBody_14 10371 8.19 8.33 8.16 44 T_REMOTE_IMAGE 10188 4.71 8.18 3.90 45 XMSubMetaSx_00 9864 4.30 7.92 3.46 46 XM_B_Phish_Phrases 9672 6.56 7.77 6.28 47 LotsOfNums_01 9521 8.33 7.64 8.49 48 XM_H_Long_From01 9166 7.14 7.36 7.09 49 DKIM_INVALID 9120 5.35 7.32 4.89 50 KHOP_HELO_FCRDNS 8599 3.25 6.90 2.40 51 XM_UB50 8194 1.97 6.58 0.90 52 MIME_HTML_MOSTLY 8105 3.45 6.51 2.74 53 MIME_HEADER_CTYPE_ONLY 8052 1.29 6.46 0.09 54 BAYES_80 7869 3.13 6.32 2.38 55 BAYES_60 7524 4.93 6.04 4.67 56 XM_DIRTYINTL 7401 3.99 5.94 3.53 57 URI_HEX 7093 2.58 5.69 1.85 58 HTML_SHORT_LINK_IMG_1 6917 1.07 5.55 0.03 59 RCVD_IN_MSPIKE_H2 6827 7.80 5.48 8.34 60 MIME_HTML_ONLY_MULTI 6819 2.81 5.47 2.19 61 MIME_QP_LONG_LINE 6728 5.73 5.40 5.81 62 FROM_SUSPICIOUS_NTLD 6289 1.02 5.05 0.08 63 FROM_SUSPICIOUS_NTLD_FP 6230 1.01 5.00 0.08 64 XM_SPF_SoftFail 6193 2.71 4.97 2.18 65 BAYES_40 6107 5.83 4.90 6.05 66 REPLYTO_WITHOUT_TO_CC 5956 0.93 4.78 0.04 67 HTML_IMAGE_ONLY_12 5702 1.01 4.58 0.18 68 HDRS_LCASE_IMGONLY 5669 0.88 4.55 0.03 69 XM_B_SpammyTLD 5604 2.59 4.50 2.15 70 RCVD_IN_BL_SPAMCOP_NET 5470 1.71 4.39 1.08 71 FROM_EXCESS_BASE64 5445 3.90 4.37 3.80 72 TO_EQ_FM_DOM_HTML_IMG 5313 0.82 4.27 0.01 73 RELAYCOUNTRY_GB 5310 1.70 4.26 1.11 74 HTML_MIME_NO_HTML_TAG 5301 2.24 4.26 1.77 75 RDNS_DYNAMIC 5258 1.07 4.22 0.34 76 XM_SendGrid 5163 6.48 4.15 7.02 77 XMStrtUSub 5080 4.15 4.08 4.16 78 BAYES_20 5023 4.57 4.03 4.70 79 HTML_IMAGE_RATIO_06 4949 3.60 3.97 3.51 80 TM2_M_URI_OPT_OUT 4798 2.33 3.85 1.97 81 XM_URI_RBL 4598 0.99 3.69 0.36 82 XMSubMetaI_00 4146 1.45 3.33 1.01 83 RELAYCOUNTRY_FR 4105 0.98 3.30 0.44 84 T_TooManySym_01 3934 4.34 3.16 4.62 85 RELAYCOUNTRY_CA 3913 1.99 3.14 1.72 86 BAYES_95 3907 1.78 3.14 1.46 87 BAYES_00 3708 16.00 2.98 19.03 88 HTML_IMAGE_RATIO_08 3698 2.58 2.97 2.49 89 XM_CamelCaseFrm001 3652 2.50 2.93 2.40 90 XMSexyCombo_01 3526 1.05 2.83 0.63 91 DATE_IN_PAST_03_06 3485 0.62 2.80 0.11 92 T_HTML_TAG_BALANCE_CENTER 3328 0.68 2.67 0.21 93 XM_B_Unsub2 3305 2.33 2.65 2.25 94 XMDiploma_00 3283 1.81 2.64 1.61 95 MISSING_HEADERS 3177 0.91 2.55 0.53 96 NO_DNS_FOR_FROM 3151 1.42 2.53 1.16 97 XMBdyGiftCard01 3069 1.99 2.46 1.88 98 TR_LOTS_OF_MONEY2 2975 1.49 2.39 1.28 99 T_MONEY_PERCENT 2975 1.49 2.39 1.28 100 T_XMDrugObfuBody_08 2972 1.91 2.39 1.79 101 SpammyFromTLD_01 2924 1.09 2.35 0.80 102 XMBody_17 2901 0.97 2.33 0.65 103 XMHTML_After_End 2859 1.73 2.30 1.60 104 BAYES_05 2772 2.86 2.23 3.01 105 XM_OfRef6 2762 1.71 2.22 1.59 106 XMStockSpam_06 2757 1.60 2.21 1.46 107 SUBJ_ALL_CAPS 2757 2.09 2.21 2.06 108 TM2_M_VERY_LONG_WORD 2694 1.52 2.16 1.37 109 TR_XM_DK_SendGrid 2689 3.47 2.16 3.78 110 MultiRelay_CC 2683 0.60 2.15 0.23 111 MultiRelay_Combo 2683 0.60 2.15 0.23 112 DKIM_ADSP_NXDOMAIN 2584 0.66 2.07 0.33 113 RCVD_IN_RP_RNBL 2546 0.42 2.04 0.05 114 RCVD_IN_IADB_LISTED 2500 4.31 2.01 4.85 115 RCVD_IN_RP_SAFE 2489 9.50 2.00 11.25 116 XMSubMetaSxObfu_03 2483 0.81 1.99 0.53 117 RCVD_IN_IADB_SPF 2442 3.81 1.96 4.24 118 RCVD_IN_IADB_DK 2388 3.33 1.92 3.66 119 URI_TRY_3LD 2382 1.28 1.91 1.14 120 RCVD_IN_IADB_SENDERID 2374 3.37 1.91 3.72 121 TR_XM_INV_DKIM 2365 0.47 1.90 0.14 122 ALL_TRUSTED 2361 10.59 1.90 12.62 123 XMGenDplmaNmb 2329 1.11 1.87 0.94 124 XMBrknScrpt_02 2278 1.08 1.83 0.91 125 TR_XM_PHPDW 2247 0.89 1.80 0.68 126 TR_XM_PHPForged 2231 0.87 1.79 0.66 127 TR_XM_FormFill2 2206 0.87 1.77 0.66 128 XM_H_PHPOS 2197 0.86 1.76 0.65 129 TR_XM_RelayPhish 2119 1.17 1.70 1.05 130 T_XMHurry_00 2100 0.98 1.69 0.81 131 BOTNET_NORDNS 2040 0.34 1.64 0.03 132 TO_NO_BRKTS_DYNIP 1975 0.30 1.59 0.01 133 RCVD_IN_MSPIKE_WL 1915 3.65 1.54 4.14 134 XM_BadFromFormat 1902 0.37 1.53 0.10 135 TR_XM_DK_Bayes 1896 12.72 1.52 15.32 136 BODY_URI_ONLY 1869 0.35 1.50 0.08 137 DATE_IN_PAST_06_12 1821 0.34 1.46 0.08 138 XMPhish11 1813 1.36 1.46 1.34 139 RCVD_IN_MSPIKE_H3 1757 3.30 1.41 3.74 140 XM_Palau_URI 1744 0.27 1.40 0.00 141 MAILING_LIST_MULTI 1703 2.05 1.37 2.21 142 TR_Mismatch_TLD_02 1689 0.31 1.36 0.06 143 THIS_AD 1665 0.77 1.34 0.63 144 TR_XM_DK_Bayes1 1659 12.13 1.33 14.64 145 HTML_IMAGE_ONLY_08 1643 0.34 1.32 0.11 146 UNPARSEABLE_RELAY 1577 2.21 1.27 2.43 147 RCVD_IN_RP_CERTIFIED 1560 8.41 1.25 10.07 148 XM_ProductURIs 1544 1.30 1.24 1.32 149 RCVD_IN_MSPIKE_BL 1537 1.25 1.23 1.25 150 T_XMDrugObfuBody_00 1535 0.87 1.23 0.79 151 RELAYCOUNTRY_AT 1525 0.47 1.22 0.29 152 HTML_TAG_BALANCE_BODY 1515 0.71 1.22 0.59 153 TR_Symld_Words 1482 1.44 1.19 1.49 154 URIBL_DBL_ABUSE_REDIR 1469 0.24 1.18 0.02 155 SUBJ_DOLLARS 1439 0.48 1.16 0.32 156 HK_RANDOM_FROM 1435 0.35 1.15 0.16 157 FSL_THIS_IS_ADV 1413 0.43 1.13 0.27 158 XMPhish30 1409 0.66 1.13 0.55 159 DKIM_ADSP_CUSTOM_MED 1384 1.11 1.11 1.12 160 XMMoneyMeta_00 1380 0.66 1.11 0.56 161 XM_H_PHPMailer 1375 0.66 1.10 0.55 162 XM_H_Long_From02 1372 1.21 1.10 1.23 163 HK_RANDOM_REPLYTO 1341 0.43 1.08 0.28 164 RCVD_IN_PSBL 1296 0.23 1.04 0.04 165 TR_LOTS_OF_MONEY3 1252 0.59 1.01 0.49 166 XMPhish14 1228 0.68 0.99 0.61 167 FORGED_GMAIL_RCVD 1224 0.68 0.98 0.61 168 URI_NO_WWW_INFO_CGI 1199 0.20 0.96 0.02 169 XM_DK_Undo_01 1198 1.36 0.96 1.45 170 XM_UB99 1196 0.19 0.96 0.01 171 LOADSA_MONEY_COMBO 1158 0.19 0.93 0.02 172 XM_H_PHPOS_M 1157 0.33 0.93 0.18 173 RELAYCOUNTRY_DE 1152 0.49 0.92 0.39 174 XMHTMLBadTable_001 1131 0.63 0.91 0.56 175 DIET_1 1115 0.59 0.90 0.52 176 HTML_FONT_FACE_BAD 1113 0.69 0.89 0.64 177 RELAYCOUNTRY_IN 1083 0.29 0.87 0.16 178 XM_B_COPY_HTML 1070 0.52 0.86 0.45 179 NML_ADSP_CUSTOM_MED 1067 0.81 0.86 0.80 180 HTML_IMAGE_ONLY_28 1065 0.47 0.86 0.38 181 FROM_MISSP_REPLYTO 1024 0.16 0.82 0.00 182 LOW_PRICE 1019 0.34 0.82 0.23 183 XM_PDF 995 3.40 0.80 4.00 184 T_Symld_Words_02 993 0.53 0.80 0.47 185 XM_UB60 991 0.21 0.80 0.07 186 XM_SPF_Unknown 986 0.76 0.79 0.75 187 T_TooManySym_02 973 1.67 0.78 1.88 188 TVD_SPACE_RATIO 935 0.42 0.75 0.34 189 XM_XX_Yahoo 935 0.26 0.75 0.15 190 URIBL_BLACK 927 0.16 0.74 0.02 191 SUBJ_OBFU_PUNCT_FEW 906 0.23 0.73 0.12 192 HTML_IMAGE_ONLY_16 902 0.37 0.72 0.28 193 PLING_QUERY 889 0.58 0.71 0.55 194 ANY_BOUNCE_MESSAGE 885 1.52 0.71 1.71 195 BOUNCE_MESSAGE 885 1.52 0.71 1.71 196 SUBJ_ILLEGAL_CHARS 871 0.14 0.70 0.01 197 SUBJECT_NEEDS_ENCODING 871 0.14 0.70 0.01 198 HTML_IMAGE_ONLY_24 870 0.43 0.70 0.37 199 XMGappySubj_01 869 0.86 0.70 0.90 200 TRACKER_ID 866 0.24 0.70 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 478142 90.56 95.89 89.32 2 DKIM_SIGNED 424100 79.12 78.65 79.23 3 XM_DK_Pass 417534 77.68 76.33 78.00 4 DKIM_VALID 397915 73.77 71.33 74.33 5 XM_B_Unicode 384148 71.86 72.28 71.76 6 DKIM_VALID_AU 304725 56.77 56.09 56.92 7 XMListUnsubscribeExists 294307 57.73 69.56 54.98 8 BAYES_50 290940 52.59 45.01 54.35 9 DCC_CHECK_NEGATIVE 277087 45.18 16.92 51.76 10 DCC_CHECK 247673 52.97 81.75 46.27 11 XM_B_Unicode3 223739 42.89 47.59 41.80 12 T_TM2_M_HEADER_IN_MSG 163095 28.04 17.60 30.47 13 HTML_FONT_LOW_CONTRAST 162101 31.61 37.33 30.28 14 DKIM_VALID_EF 145855 26.82 25.00 27.25 15 LOC_TINY_FONT_1 138439 28.41 39.35 25.86 16 FVGT_m_MULTI_ODD 114774 22.31 26.03 21.44 17 XMSubLong 114497 22.10 25.16 21.39 18 MIME_HTML_ONLY 112534 24.08 37.21 21.02 19 MultiRelay 104793 18.88 15.88 19.58 20 BAYES_00 101886 16.00 2.98 19.03 21 T_KAM_HTML_FONT_INVALID 96674 18.11 18.32 18.06 22 TR_XM_DK_Bayes 82031 12.72 1.52 15.32 23 XM_Body_Dirty_Words 80030 16.13 21.18 14.95 24 TR_XM_DK_Bayes1 78356 12.13 1.33 14.64 25 XM_Multi_Part_URI 72089 14.34 18.09 13.47 26 TR_XM_DK_Bayes2 68384 10.48 0.61 12.77 27 ALL_TRUSTED 67535 10.59 1.90 12.62 28 RCVD_IN_RP_SAFE 60211 9.50 2.00 11.25 29 XM_Evil_Numbers_Gen 57283 11.42 14.51 10.70 30 XM_B_Unsub 56413 11.02 13.07 10.54 31 RCVD_IN_RP_CERTIFIED 53917 8.41 1.25 10.07 32 HTML_IMAGE_RATIO_02 53596 10.84 14.38 10.01 33 XM_DKIMWhitelistDomains 47050 7.16 0.15 8.79 34 LotsOfNums_01 45455 8.33 7.64 8.49 35 TooManyTo_001 45410 8.81 10.24 8.48 36 LOTS_OF_MONEY 45103 9.05 11.74 8.43 37 RCVD_IN_MSPIKE_H2 44628 7.80 5.48 8.34 38 T_XMDrugObfuBody_14 43675 8.19 8.33 8.16 39 XM_DK_Undo_02 39467 12.86 36.44 7.37 40 XM_H_Long_From01 37935 7.14 7.36 7.09 41 XM_SendGrid 37579 6.48 4.15 7.02 42 HTML_IMAGE_RATIO_04 37283 7.35 9.00 6.96 43 FSL_BULK_SIG 36644 8.72 16.78 6.85 44 XM_B_Phish_Phrases 33597 6.56 7.77 6.28 45 BAYES_40 32381 5.83 4.90 6.05 46 MIME_QP_LONG_LINE 31110 5.73 5.40 5.81 47 RELAYCOUNTRY_META 30031 8.30 19.88 5.61 48 BOTNET_IPINHOSTNAME 26562 7.39 17.81 4.96 49 DKIM_INVALID 26185 5.35 7.32 4.89 50 RCVD_IN_IADB_LISTED 25943 4.31 2.01 4.85 51 BAYES_20 25154 4.57 4.03 4.70 52 BAYES_60 25001 4.93 6.04 4.67 53 T_TooManySym_01 24724 4.34 3.16 4.62 54 XMSexyCombo_05 24653 5.85 11.22 4.61 55 RCVD_IN_IADB_SPF 22721 3.81 1.96 4.24 56 XMStrtUSub 22280 4.15 4.08 4.16 57 RCVD_IN_MSPIKE_WL 22140 3.65 1.54 4.14 58 XM_PDF 21431 3.40 0.80 4.00 59 BAYES_99 21389 7.96 25.01 4.00 60 MPART_ALT_DIFF 21204 5.17 10.37 3.96 61 T_REMOTE_IMAGE 20881 4.71 8.18 3.90 62 FROM_EXCESS_BASE64 20316 3.90 4.37 3.80 63 TR_XM_DK_SendGrid 20214 3.47 2.16 3.78 64 RCVD_IN_MSPIKE_H3 20031 3.30 1.41 3.74 65 RCVD_IN_IADB_SENDERID 19891 3.37 1.91 3.72 66 IN_ZIMBRA_NJ_WHITELIST 19838 3.01 0.01 3.71 67 RCVD_IN_IADB_DK 19600 3.33 1.92 3.66 68 XM_DIRTYINTL 18913 3.99 5.94 3.53 69 HTML_IMAGE_RATIO_06 18774 3.60 3.97 3.51 70 XMSubMetaSx_00 18512 4.30 7.92 3.46 71 BAYES_999 18277 6.53 19.95 3.41 72 XMNumbers 18219 4.67 10.14 3.40 73 XM_UncommonTLD01 17121 5.63 16.06 3.20 74 RCVD_IN_IADB_VOUCHED 16193 2.57 0.62 3.02 75 BAYES_05 16120 2.86 2.23 3.01 76 MIME_HTML_MOSTLY 14681 3.45 6.51 2.74 77 HTML_IMAGE_RATIO_08 13316 2.58 2.97 2.49 78 UNPARSEABLE_RELAY 13004 2.21 1.27 2.43 79 KHOP_HELO_FCRDNS 12843 3.25 6.90 2.40 80 XM_CamelCaseFrm001 12833 2.50 2.93 2.40 81 BAYES_80 12756 3.13 6.32 2.38 82 BOTNET 12335 5.62 19.87 2.30 83 XM_B_Unsub2 12068 2.33 2.65 2.25 84 TR_DCC_Bayes_99 11873 5.61 20.21 2.22 85 TooManyTo_002 11851 1.93 0.69 2.21 86 MAILING_LIST_MULTI 11847 2.05 1.37 2.21 87 MIME_HTML_ONLY_MULTI 11712 2.81 5.47 2.19 88 XM_SPF_SoftFail 11687 2.71 4.97 2.18 89 XM_B_SpammyTLD 11488 2.59 4.50 2.15 90 TVD_RCVD_IP 11364 1.80 0.39 2.12 91 SUBJ_ALL_CAPS 11037 2.09 2.21 2.06 92 TM2_M_URI_OPT_OUT 10559 2.33 3.85 1.97 93 RCVD_IN_IADB_OPTIN 10186 1.64 0.49 1.90 94 XMBdyGiftCard01 10088 1.99 2.46 1.88 95 T_TooManySym_02 10058 1.67 0.78 1.88 96 URI_HEX 9909 2.58 5.69 1.85 97 T_XMDrugObfuBody_08 9607 1.91 2.39 1.79 98 HTML_MIME_NO_HTML_TAG 9478 2.24 4.26 1.77 99 UNTRUSTED_Relay 9448 3.62 11.57 1.76 100 RELAYCOUNTRY_CA 9217 1.99 3.14 1.72 101 ANY_BOUNCE_MESSAGE 9177 1.52 0.71 1.71 102 BOUNCE_MESSAGE 9174 1.52 0.71 1.71 103 HELO_NODOT 8782 1.44 0.56 1.64 104 HELO_NO_DOMAIN 8780 1.43 0.55 1.64 105 XMDiploma_00 8640 1.81 2.64 1.61 106 XMHTML_After_End 8567 1.73 2.30 1.60 107 XM_OfRef6 8533 1.71 2.22 1.59 108 IN_HORDE_ADDRESS_BOOK 8363 1.27 0.04 1.56 109 TooManyTo_003 8029 1.32 0.53 1.50 110 TR_Symld_Words 8002 1.44 1.19 1.49 111 USER_IN_DEF_DKIM_WL 7845 1.19 0.03 1.47 112 BAYES_95 7819 1.78 3.14 1.46 113 XMStockSpam_06 7795 1.60 2.21 1.46 114 XM_DK_Undo_01 7779 1.36 0.96 1.45 115 CK_HELO_DYNAMIC_SPLIT_IP 7514 1.22 0.45 1.40 116 HELO_DYNAMIC_IPADDR2 7512 1.15 0.06 1.40 117 INVALID_MSGID 7482 1.18 0.22 1.40 118 TM2_M_VERY_LONG_WORD 7342 1.52 2.16 1.37 119 XMPhish11 7178 1.36 1.46 1.34 120 XMCapTrack 7123 1.14 0.33 1.33 121 XM_ProductURIs 7049 1.30 1.24 1.32 122 TR_LOTS_OF_MONEY2 6838 1.49 2.39 1.28 123 T_MONEY_PERCENT 6838 1.49 2.39 1.28 124 RCVD_IN_MSPIKE_BL 6713 1.25 1.23 1.25 125 TO_MALFORMED 6636 1.12 0.59 1.24 126 XM_H_Long_From02 6602 1.21 1.10 1.23 127 NO_DNS_FOR_FROM 6210 1.42 2.53 1.16 128 URI_TRY_3LD 6078 1.28 1.91 1.14 129 DKIM_ADSP_CUSTOM_MED 5973 1.11 1.11 1.12 130 TooManyTo_004 5958 0.98 0.42 1.11 131 RELAYCOUNTRY_GB 5920 1.70 4.26 1.11 132 RCVD_IN_BL_SPAMCOP_NET 5785 1.71 4.39 1.08 133 TR_XM_RelayPhish 5634 1.17 1.70 1.05 134 XM_GoogleGroups 5544 0.93 0.47 1.04 135 XMSubMetaI_00 5408 1.45 3.33 1.01 136 TooManyTo_005 5050 0.83 0.37 0.94 137 XMGenDplmaNmb 5011 1.11 1.87 0.94 138 XMBrknScrpt_02 4856 1.08 1.83 0.91 139 XM_UB50 4826 1.97 6.58 0.90 140 XMGappySubj_01 4814 0.86 0.70 0.90 141 T_FILL_THIS_FORM_SHORT 4800 0.84 0.59 0.90 142 TR_MetaPhish_Combo_01 4507 0.80 0.63 0.84 143 T_XMHurry_00 4356 0.98 1.69 0.81 144 NML_ADSP_CUSTOM_MED 4278 0.81 0.86 0.80 145 SpammyFromTLD_01 4256 1.09 2.35 0.80 146 T_XMDrugObfuBody_00 4207 0.87 1.23 0.79 147 XMNoVowels 4077 0.70 0.43 0.76 148 XM_SPF_Unknown 4027 0.76 0.79 0.75 149 XMBody_95 3847 0.62 0.20 0.72 150 HTTPS_HTTP_MISMATCH 3781 0.70 0.66 0.71 151 XM_RXBody 3767 0.65 0.44 0.70 152 TR_XM_PHPDW 3641 0.89 1.80 0.68 153 TR_XM_PHPForged 3537 0.87 1.79 0.66 154 TR_XM_FormFill2 3529 0.87 1.77 0.66 155 XM_H_PHPOS 3500 0.86 1.76 0.65 156 XMBody_17 3492 0.97 2.33 0.65 157 HTML_FONT_FACE_BAD 3419 0.69 0.89 0.64 158 THIS_AD 3389 0.77 1.34 0.63 159 XMSexyCombo_01 3372 1.05 2.83 0.63 160 XM_ShortIntro_01 3317 0.55 0.26 0.62 161 XMPhish14 3268 0.68 0.99 0.61 162 FORGED_GMAIL_RCVD 3259 0.68 0.98 0.61 163 HTML_TAG_BALANCE_BODY 3152 0.71 1.22 0.59 164 URI_NOVOWEL 3093 0.53 0.33 0.58 165 RCVD_IN_MSPIKE_L3 3022 0.53 0.40 0.56 166 XMHTMLBadTable_001 3008 0.63 0.91 0.56 167 XMMoneyMeta_00 3008 0.66 1.11 0.56 168 XM_H_PHPMailer 2962 0.66 1.10 0.55 169 XMPhish30 2942 0.66 1.13 0.55 170 PLING_QUERY 2939 0.58 0.71 0.55 171 T_OBFU_PDF_ATTACH 2913 0.49 0.24 0.54 172 FILL_THIS_FORM 2898 0.56 0.64 0.54 173 MISSING_HEADERS 2845 0.91 2.55 0.53 174 XMSubMetaSxObfu_03 2845 0.81 1.99 0.53 175 XM_B_REG_HTML 2825 0.49 0.33 0.53 176 DIET_1 2792 0.59 0.90 0.52 177 FROM_GOV_DKIM_AU 2791 0.44 0.11 0.52 178 XMLngstWrd_00 2754 0.48 0.35 0.51 179 USER_IN_WHITELIST 2675 0.41 0.00 0.50 180 TR_LOTS_OF_MONEY3 2635 0.59 1.01 0.49 181 RCVD_IN_MSPIKE_L4 2596 0.44 0.24 0.48 182 XMLngstWrd_01 2578 0.45 0.29 0.48 183 T_Symld_Words_02 2511 0.53 0.80 0.47 184 AC_DIV_BONANZA 2495 0.40 0.11 0.47 185 XMBody_78 2453 0.49 0.64 0.46 186 URIBL_CSS_A 2443 0.45 0.42 0.46 187 URIBL_CSS 2443 0.45 0.42 0.46 188 FILL_THIS_FORM_LONG 2417 0.47 0.54 0.45 189 SHORT_HELO_AND_INLINE_IMAGE 2409 0.37 0.03 0.45 190 XM_B_COPY_HTML 2387 0.52 0.86 0.45 191 T_TooManySym_03 2383 0.40 0.19 0.45 192 XM_shorewaves_Whitelist 2382 0.36 0.00 0.44 193 RELAYCOUNTRY_FR 2382 0.98 3.30 0.44 194 XMDateMe_00 2296 0.40 0.29 0.43 195 T_FILL_THIS_FORM_LOAN 2246 0.36 0.13 0.42 196 TM2_M_BODY_EMPTY 2173 0.35 0.09 0.41 197 HTML_IMAGE_ONLY_32 2171 0.41 0.42 0.41 198 RELAYCOUNTRY_AU 2162 0.40 0.38 0.40 199 RELAYCOUNTRY_DE 2100 0.49 0.92 0.39 200 NUMERIC_HTTP_ADDR 2091 0.42 0.54 0.39 ----------------------------------------------------------------------