Email: 642260 Autolearn: 0 AvgScore: 1.46 AvgScanTime: 2.22 sec Spam: 119831 Autolearn: 0 AvgScore: 12.97 AvgScanTime: 2.72 sec Ham: 522429 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 2.11 sec Time Spent Running SA: 396.95 hours Time Spent Processing Spam: 90.67 hours Time Spent Processing Ham: 306.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114163 91.12 95.27 90.17 2 DCC_CHECK 95553 51.44 79.74 44.95 3 DKIM_SIGNED 92760 78.14 77.41 78.30 4 XM_B_Unicode 89769 73.20 74.91 72.80 5 XM_DK_Pass 89645 76.50 74.81 76.89 6 DKIM_VALID 84119 72.94 70.20 73.57 7 XMListUnsubscribeExists 78655 58.62 65.64 57.01 8 DKIM_VALID_AU 64217 55.41 53.59 55.82 9 XM_B_Unicode3 60312 45.88 50.33 44.86 10 BAYES_50 51635 51.79 43.09 53.78 11 MIME_HTML_ONLY 48271 25.61 40.28 22.24 12 XM_DK_Undo_02 46061 12.75 38.44 6.86 13 HTML_FONT_LOW_CONTRAST 41544 29.95 34.67 28.87 14 LOC_TINY_FONT_1 40561 27.94 33.85 26.58 15 BAYES_99 34400 8.39 28.71 3.73 16 XMSubLong 31643 22.45 26.41 21.54 17 FVGT_m_MULTI_ODD 30231 22.38 25.23 21.72 18 BOTNET 27830 6.00 23.22 2.05 19 BAYES_999 27438 6.77 22.90 3.07 20 TR_DCC_Bayes_99 27270 5.63 22.76 1.71 21 DKIM_VALID_EF 26066 25.59 21.75 26.47 22 RELAYCOUNTRY_META 24918 8.24 20.79 5.36 23 XM_Body_Dirty_Words 23946 15.16 19.98 14.06 24 BOTNET_IPINHOSTNAME 23081 7.50 19.26 4.80 25 T_KAM_HTML_FONT_INVALID 22992 18.60 19.19 18.46 26 DCC_CHECK_NEGATIVE 22073 46.67 18.42 53.15 27 T_TM2_M_HEADER_IN_MSG 20932 24.79 17.47 26.47 28 FSL_BULK_SIG 20913 8.34 17.45 6.25 29 XM_Multi_Part_URI 20553 13.51 17.15 12.67 30 XM_B_Unsub 20360 10.77 16.99 9.34 31 MultiRelay 20032 17.38 16.72 17.53 32 HTML_IMAGE_RATIO_02 19474 11.40 16.25 10.28 33 XM_UncommonTLD01 18518 6.28 15.45 4.18 34 XM_Evil_Numbers_Gen 16765 10.64 13.99 9.87 35 LOTS_OF_MONEY 15710 9.38 13.11 8.53 36 UNTRUSTED_Relay 15266 3.75 12.74 1.69 37 XMSexyCombo_05 14597 6.06 12.18 4.66 38 RCVD_IN_MSPIKE_H2 14454 13.38 12.06 13.69 39 T_XMDrugObfuBody_14 11165 8.59 9.32 8.42 40 MPART_ALT_DIFF 10990 5.77 9.17 4.99 41 XMSubMetaSx_00 10334 4.61 8.62 3.69 42 XM_B_Phish_Phrases 10317 6.73 8.61 6.30 43 HTML_MIME_NO_HTML_TAG 10292 3.63 8.59 2.49 44 HTML_IMAGE_RATIO_04 10171 7.31 8.49 7.04 45 XM_H_Long_From01 9616 7.02 8.02 6.79 46 LotsOfNums_01 9208 8.71 7.68 8.94 47 T_REMOTE_IMAGE 9136 4.86 7.62 4.22 48 DKIM_INVALID 8641 5.19 7.21 4.73 49 XM_UB50 8334 2.02 6.95 0.89 50 KHOP_HELO_FCRDNS 8317 2.79 6.94 1.83 51 TooManyTo_001 8218 6.96 6.86 6.99 52 BAYES_60 7911 5.61 6.60 5.38 53 BAYES_80 7861 3.42 6.56 2.70 54 TR_Mismatch_TLD_02 7603 1.23 6.34 0.06 55 MIME_HTML_MOSTLY 7434 3.41 6.20 2.76 56 XM_DIRTYINTL 7344 3.62 6.13 3.05 57 SpammyFromTLD_02 6948 1.42 5.80 0.42 58 RCVD_IN_BL_SPAMCOP_NET 6732 2.03 5.62 1.20 59 RCVD_IN_MSPIKE_WL 6581 9.94 5.49 10.96 60 DKIM_ADSP_NXDOMAIN 6414 2.17 5.35 1.44 61 FROM_EXCESS_BASE64 6408 3.87 5.35 3.54 62 XM_SPF_SoftFail 6223 2.22 5.19 1.54 63 RCVD_IN_MSPIKE_H3 6135 9.73 5.12 10.78 64 FROM_SUSPICIOUS_NTLD 6120 1.02 5.11 0.09 65 FROM_SUSPICIOUS_NTLD_FP 6098 1.02 5.09 0.08 66 HTML_SHORT_LINK_IMG_1 6047 0.96 5.05 0.02 67 HTML_IMAGE_ONLY_08 5995 1.01 5.00 0.10 68 XMStrtUSub 5970 4.36 4.98 4.21 69 XMNumbers 5885 3.40 4.91 3.06 70 MIME_HTML_ONLY_MULTI 5745 3.62 4.79 3.35 71 XM_SendGrid 5431 6.10 4.53 6.46 72 MIME_QP_LONG_LINE 5359 6.04 4.47 6.41 73 URI_HEX 5281 2.31 4.41 1.83 74 RDNS_DYNAMIC 5221 1.10 4.36 0.35 75 RELAYCOUNTRY_CA 5107 2.16 4.26 1.68 76 TM2_M_URI_OPT_OUT 5041 2.83 4.21 2.51 77 HTML_IMAGE_RATIO_06 5031 3.80 4.20 3.71 78 BAYES_40 4998 5.35 4.17 5.62 79 RCVD_IN_RP_RNBL 4497 0.76 3.75 0.07 80 SUBJ_ILLEGAL_CHARS 4488 0.74 3.75 0.05 81 SUBJECT_NEEDS_ENCODING 4487 0.74 3.74 0.05 82 HDRS_MISSP 4486 0.70 3.74 0.00 83 SHORT_IMG_SUSP_NTLD 4380 0.68 3.66 0.00 84 RCVD_IN_PSBL 4198 0.69 3.50 0.04 85 BAYES_95 4176 1.92 3.48 1.56 86 XM_CamelCaseFrm001 4090 2.48 3.41 2.26 87 BAYES_20 3857 4.13 3.22 4.34 88 XM_URI_RBL 3648 0.89 3.04 0.39 89 RELAYCOUNTRY_FR 3529 0.87 2.94 0.39 90 XMDiploma_00 3479 2.16 2.90 1.98 91 BOTNET_NORDNS 3455 0.57 2.88 0.04 92 T_HTML_TAG_BALANCE_CENTER 3397 0.60 2.83 0.09 93 XM_OfRef6 3370 1.66 2.81 1.39 94 XM_B_SpammyTLD 3356 2.66 2.80 2.62 95 HTML_IMAGE_RATIO_08 3281 2.52 2.74 2.46 96 MIME_HEADER_CTYPE_ONLY 3274 0.57 2.73 0.07 97 XMSexyCombo_01 3238 1.04 2.70 0.65 98 XM_B_Unsub2 3226 1.75 2.69 1.54 99 XMSubMetaI_00 3181 1.22 2.65 0.89 100 T_TooManySym_01 3171 4.07 2.65 4.40 101 TR_XM_INV_DKIM 3170 0.60 2.65 0.13 102 T_XMHurry_00 3104 1.23 2.59 0.92 103 HTML_IMAGE_ONLY_20 3079 0.94 2.57 0.57 104 HDRS_LCASE_IMGONLY 2979 0.48 2.49 0.02 105 BODY_URI_ONLY 2954 0.53 2.47 0.09 106 XM_DrugUnitList 2883 0.45 2.41 0.00 107 ALIBABA_IMG_NOT_RCVD_ALI 2882 0.45 2.41 0.00 108 XMBdyGiftCard01 2839 2.24 2.37 2.21 109 URI_TRY_3LD 2839 1.60 2.37 1.43 110 SpammyFromTLD_01 2827 1.05 2.36 0.75 111 XMStockSpam_06 2778 1.72 2.32 1.59 112 DATE_IN_PAST_24_48 2767 0.47 2.31 0.05 113 LongTLD 2699 0.59 2.25 0.21 114 XMGenDplmaNmb 2625 1.43 2.19 1.25 115 TM2_M_VERY_LONG_WORD 2582 1.84 2.15 1.77 116 BAYES_00 2567 16.48 2.14 19.77 117 HOSTED_IMG_DIRECT_MX 2549 0.40 2.13 0.00 118 SUBJ_ALL_CAPS 2515 2.39 2.10 2.46 119 TR_XM_DK_SendGrid 2510 3.46 2.09 3.77 120 MultiRelay_Combo 2474 0.57 2.06 0.23 121 MultiRelay_CC 2474 0.57 2.06 0.23 122 NO_DNS_FOR_FROM 2450 2.07 2.04 2.08 123 T_XMDrugObfuBody_08 2411 1.42 2.01 1.28 124 RCVD_IN_IADB_LISTED 2388 4.95 1.99 5.63 125 XMBody_17 2298 1.16 1.92 0.99 126 RCVD_IN_IADB_SPF 2214 4.31 1.85 4.87 127 T_FILL_THIS_FORM_SHORT 2212 0.94 1.85 0.73 128 RCVD_IN_IADB_SENDERID 2175 3.85 1.82 4.31 129 RCVD_IN_IADB_DK 2168 3.75 1.81 4.20 130 RCVD_IN_RP_SAFE 2166 10.06 1.81 11.96 131 BAYES_05 2134 2.60 1.78 2.79 132 HOSTED_IMG_MULTI 2123 0.33 1.77 0.00 133 EBAY_IMG_NOT_RCVD_EBAY 2106 0.33 1.76 0.00 134 XM_UB99 2096 0.34 1.75 0.01 135 REPLYTO_WITHOUT_TO_CC 2078 0.37 1.73 0.05 136 TR_XM_PHPDW 2045 0.74 1.71 0.52 137 TR_XM_RelayPhish 2034 1.42 1.70 1.35 138 T_XMDrugObfuBody_00 2009 0.87 1.68 0.68 139 TR_XM_PHPForged 1985 0.72 1.66 0.51 140 TR_XM_FormFill2 1964 0.72 1.64 0.50 141 XM_H_PHPOS 1957 0.71 1.63 0.50 142 TR_LOTS_OF_MONEY3 1913 0.77 1.60 0.58 143 RELAYCOUNTRY_GB 1899 1.02 1.58 0.89 144 XMHTML_After_End 1890 1.60 1.58 1.61 145 RCVD_IN_MSPIKE_BL 1785 1.59 1.49 1.61 146 XMBrknScrpt_02 1784 0.82 1.49 0.67 147 ALL_TRUSTED 1754 10.33 1.46 12.37 148 TR_XM_DK_Bayes 1743 12.35 1.45 14.86 149 XM_UB999 1701 0.27 1.42 0.01 150 TR_Symld_Words 1674 1.52 1.40 1.55 151 TR_XM_DK_Bayes1 1592 11.83 1.33 14.23 152 RCVD_IN_RP_CERTIFIED 1565 9.05 1.31 10.83 153 TO_NO_BRKTS_DYNIP 1564 0.25 1.31 0.00 154 UNPARSEABLE_RELAY 1551 2.11 1.29 2.30 155 RELAYCOUNTRY_NL 1529 0.42 1.28 0.22 156 T_MONEY_PERCENT 1520 0.88 1.27 0.79 157 TR_LOTS_OF_MONEY2 1520 0.88 1.27 0.79 158 RELAYCOUNTRY_FI 1511 0.26 1.26 0.03 159 XM_H_PHPMailer 1495 0.56 1.25 0.40 160 XMPhish11 1492 1.12 1.25 1.09 161 RELAYCOUNTRY_DE 1452 0.49 1.21 0.33 162 MONEY_FORM_SHORT 1441 0.23 1.20 0.01 163 XMPhish14 1349 0.50 1.13 0.35 164 T_FILL_THIS_FORM_FRAUD_PHISH 1344 0.23 1.12 0.02 165 FORM_FRAUD_5 1341 0.21 1.12 0.00 166 RELAYCOUNTRY_AT 1303 0.42 1.09 0.27 167 XM_DK_Undo_01 1284 1.39 1.07 1.47 168 XM_BadFromFormat 1268 0.28 1.06 0.10 169 MAILING_LIST_MULTI 1267 2.01 1.06 2.23 170 XMSubMetaSSx_00 1236 0.47 1.03 0.35 171 URIBL_DBL_ABUSE_REDIR 1235 0.20 1.03 0.01 172 MAY_BE_FORGED 1230 0.21 1.03 0.02 173 RELAYCOUNTRY_CL 1214 0.19 1.01 0.01 174 SUBJ_DOLLARS 1210 0.54 1.01 0.43 175 DATE_IN_PAST_03_06 1187 0.27 0.99 0.11 176 TO_EQ_FM_DOM_HTML_IMG 1172 0.19 0.98 0.00 177 XMSubMetaSx_01 1159 0.36 0.97 0.22 178 XM_H_Long_From02 1153 1.31 0.96 1.39 179 T_Symld_Words_02 1143 0.63 0.95 0.56 180 HK_RANDOM_FROM 1131 0.38 0.94 0.25 181 XMHTMLBadTable_001 1117 0.66 0.93 0.59 182 XMSubMetaSxObfu_03 1098 0.61 0.92 0.54 183 URI_NO_WWW_INFO_CGI 1086 0.21 0.91 0.05 184 TR_XM_DK_Bayes2 1080 10.63 0.90 12.86 185 HTML_FONT_FACE_BAD 1074 1.16 0.90 1.22 186 XMPhish30 1070 0.83 0.89 0.82 187 XMNoVowels 1038 0.52 0.87 0.44 188 FROM_MISSP_REPLYTO 1031 0.16 0.86 0.00 189 MPART_ALT_DIFF_COUNT 1021 0.49 0.85 0.41 190 DATE_IN_PAST_12_24 1013 0.32 0.85 0.20 191 PLING_QUERY 1000 0.63 0.83 0.58 192 FILL_THIS_FORM 998 0.49 0.83 0.41 193 XM_OfRef7 987 0.26 0.82 0.13 194 XMClaimOffer 976 0.27 0.81 0.15 195 RCVD_IN_MSPIKE_L5 965 0.53 0.81 0.46 196 THIS_AD 947 0.45 0.79 0.37 197 URIBL_DBL_SPAM 947 0.16 0.79 0.02 198 XM_ProductURIs 945 1.07 0.79 1.13 199 XM_UB80 932 0.17 0.78 0.03 200 DKIM_ADSP_CUSTOM_MED 929 0.91 0.78 0.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 471059 91.12 95.27 90.17 2 DKIM_SIGNED 409087 78.14 77.41 78.30 3 XM_DK_Pass 401683 76.50 74.81 76.89 4 DKIM_VALID 384367 72.94 70.20 73.57 5 XM_B_Unicode 380335 73.20 74.91 72.80 6 XMListUnsubscribeExists 297821 58.62 65.64 57.01 7 DKIM_VALID_AU 291635 55.41 53.59 55.82 8 BAYES_50 280970 51.79 43.09 53.78 9 DCC_CHECK_NEGATIVE 277662 46.67 18.42 53.15 10 DCC_CHECK 234823 51.44 79.74 44.95 11 XM_B_Unicode3 234360 45.88 50.33 44.86 12 HTML_FONT_LOW_CONTRAST 150832 29.95 34.67 28.87 13 LOC_TINY_FONT_1 138886 27.94 33.85 26.58 14 DKIM_VALID_EF 138304 25.59 21.75 26.47 15 T_TM2_M_HEADER_IN_MSG 138283 24.79 17.47 26.47 16 MIME_HTML_ONLY 116188 25.61 40.28 22.24 17 FVGT_m_MULTI_ODD 113484 22.38 25.23 21.72 18 XMSubLong 112519 22.45 26.41 21.54 19 BAYES_00 103300 16.48 2.14 19.77 20 T_KAM_HTML_FONT_INVALID 96441 18.60 19.19 18.46 21 MultiRelay 91606 17.38 16.72 17.53 22 TR_XM_DK_Bayes 77608 12.35 1.45 14.86 23 TR_XM_DK_Bayes1 74358 11.83 1.33 14.23 24 XM_Body_Dirty_Words 73428 15.16 19.98 14.06 25 RCVD_IN_MSPIKE_H2 71506 13.38 12.06 13.69 26 TR_XM_DK_Bayes2 67172 10.63 0.90 12.86 27 XM_Multi_Part_URI 66191 13.51 17.15 12.67 28 ALL_TRUSTED 64613 10.33 1.46 12.37 29 RCVD_IN_RP_SAFE 62457 10.06 1.81 11.96 30 RCVD_IN_MSPIKE_WL 57257 9.94 5.49 10.96 31 RCVD_IN_RP_CERTIFIED 56569 9.05 1.31 10.83 32 RCVD_IN_MSPIKE_H3 56330 9.73 5.12 10.78 33 HTML_IMAGE_RATIO_02 53712 11.40 16.25 10.28 34 XM_Evil_Numbers_Gen 51579 10.64 13.99 9.87 35 XM_B_Unsub 48800 10.77 16.99 9.34 36 LotsOfNums_01 46723 8.71 7.68 8.94 37 LOTS_OF_MONEY 44541 9.38 13.11 8.53 38 T_XMDrugObfuBody_14 44004 8.59 9.32 8.42 39 XM_DKIMWhitelistDomains 41315 6.44 0.02 7.91 40 HTML_IMAGE_RATIO_04 36776 7.31 8.49 7.04 41 TooManyTo_001 36515 6.96 6.86 6.99 42 XM_DK_Undo_02 35829 12.75 38.44 6.86 43 XM_H_Long_From01 35487 7.02 8.02 6.79 44 XM_SendGrid 33760 6.10 4.53 6.46 45 MIME_QP_LONG_LINE 33463 6.04 4.47 6.41 46 XM_B_Phish_Phrases 32915 6.73 8.61 6.30 47 FSL_BULK_SIG 32677 8.34 17.45 6.25 48 RCVD_IN_IADB_LISTED 29416 4.95 1.99 5.63 49 BAYES_40 29349 5.35 4.17 5.62 50 BAYES_60 28131 5.61 6.60 5.38 51 RELAYCOUNTRY_META 27990 8.24 20.79 5.36 52 MPART_ALT_DIFF 26061 5.77 9.17 4.99 53 RCVD_IN_IADB_SPF 25466 4.31 1.85 4.87 54 BOTNET_IPINHOSTNAME 25100 7.50 19.26 4.80 55 DKIM_INVALID 24720 5.19 7.21 4.73 56 XMSexyCombo_05 24350 6.06 12.18 4.66 57 T_TooManySym_01 22974 4.07 2.65 4.40 58 BAYES_20 22679 4.13 3.22 4.34 59 RCVD_IN_IADB_SENDERID 22532 3.85 1.82 4.31 60 XM_PDF 22329 3.59 0.62 4.27 61 T_REMOTE_IMAGE 22072 4.86 7.62 4.22 62 XMStrtUSub 22001 4.36 4.98 4.21 63 RCVD_IN_IADB_DK 21931 3.75 1.81 4.20 64 XM_UncommonTLD01 21824 6.28 15.45 4.18 65 TR_XM_DK_SendGrid 19687 3.46 2.09 3.77 66 BAYES_99 19490 8.39 28.71 3.73 67 HTML_IMAGE_RATIO_06 19398 3.80 4.20 3.71 68 XMSubMetaSx_00 19283 4.61 8.62 3.69 69 RCVD_IN_IADB_VOUCHED 18639 3.01 0.56 3.57 70 FROM_EXCESS_BASE64 18468 3.87 5.35 3.54 71 IN_ZIMBRA_NJ_WHITELIST 17814 2.78 0.02 3.41 72 MIME_HTML_ONLY_MULTI 17480 3.62 4.79 3.35 73 BAYES_999 16038 6.77 22.90 3.07 74 XMNumbers 15978 3.40 4.91 3.06 75 XM_DIRTYINTL 15930 3.62 6.13 3.05 76 BAYES_05 14595 2.60 1.78 2.79 77 XM_H_Trusted_IP 14516 2.26 0.00 2.78 78 MIME_HTML_MOSTLY 14436 3.41 6.20 2.76 79 BAYES_80 14107 3.42 6.56 2.70 80 XM_B_SpammyTLD 13702 2.66 2.80 2.62 81 TM2_M_URI_OPT_OUT 13106 2.83 4.21 2.51 82 HTML_MIME_NO_HTML_TAG 13015 3.63 8.59 2.49 83 HTML_IMAGE_RATIO_08 12873 2.52 2.74 2.46 84 SUBJ_ALL_CAPS 12855 2.39 2.10 2.46 85 UNPARSEABLE_RELAY 11992 2.11 1.29 2.30 86 XM_CamelCaseFrm001 11817 2.48 3.41 2.26 87 RCVD_IN_IADB_OPTIN 11787 1.91 0.40 2.26 88 MAILING_LIST_MULTI 11660 2.01 1.06 2.23 89 XMBdyGiftCard01 11562 2.24 2.37 2.21 90 NO_DNS_FOR_FROM 10869 2.07 2.04 2.08 91 BOTNET 10727 6.00 23.22 2.05 92 T_TooManySym_02 10581 1.75 0.54 2.03 93 XMDiploma_00 10368 2.16 2.90 1.98 94 TVD_RCVD_IP 9759 1.61 0.50 1.87 95 ANY_BOUNCE_MESSAGE 9652 1.62 0.62 1.85 96 BOUNCE_MESSAGE 9647 1.62 0.62 1.85 97 KHOP_HELO_FCRDNS 9572 2.79 6.94 1.83 98 URI_HEX 9557 2.31 4.41 1.83 99 TM2_M_VERY_LONG_WORD 9256 1.84 2.15 1.77 100 TR_DCC_Bayes_99 8916 5.63 22.76 1.71 101 UNTRUSTED_Relay 8829 3.75 12.74 1.69 102 RELAYCOUNTRY_CA 8775 2.16 4.26 1.68 103 TooManyTo_002 8551 1.45 0.63 1.64 104 RCVD_IN_MSPIKE_BL 8422 1.59 1.49 1.61 105 XMHTML_After_End 8414 1.60 1.58 1.61 106 XMStockSpam_06 8285 1.72 2.32 1.59 107 BAYES_95 8168 1.92 3.48 1.56 108 TR_Symld_Words 8103 1.52 1.40 1.55 109 XM_B_Unsub2 8027 1.75 2.69 1.54 110 XM_SPF_SoftFail 8026 2.22 5.19 1.54 111 IN_HORDE_ADDRESS_BOOK 7953 1.24 0.03 1.52 112 CK_HELO_DYNAMIC_SPLIT_IP 7823 1.29 0.40 1.50 113 HELO_DYNAMIC_IPADDR2 7819 1.23 0.07 1.50 114 XM_DK_Undo_01 7661 1.39 1.07 1.47 115 DKIM_ADSP_NXDOMAIN 7544 2.17 5.35 1.44 116 URI_TRY_3LD 7469 1.60 2.37 1.43 117 INVALID_MSGID 7426 1.22 0.35 1.42 118 XM_OfRef6 7275 1.66 2.81 1.39 119 XM_H_Long_From02 7257 1.31 0.96 1.39 120 TR_XM_RelayPhish 7062 1.42 1.70 1.35 121 T_XMDrugObfuBody_08 6696 1.42 2.01 1.28 122 TO_MALFORMED 6610 1.03 0.03 1.27 123 XMGenDplmaNmb 6533 1.43 2.19 1.25 124 XMSubNoVowel 6500 1.08 0.34 1.24 125 HTML_FONT_FACE_BAD 6381 1.16 0.90 1.22 126 RCVD_IN_BL_SPAMCOP_NET 6282 2.03 5.62 1.20 127 XMGappySubj_01 6127 1.04 0.45 1.17 128 HELO_NODOT 5957 1.04 0.61 1.14 129 HELO_NO_DOMAIN 5956 1.04 0.60 1.14 130 XM_ProductURIs 5924 1.07 0.79 1.13 131 AC_FROM_MANY_DOTS 5905 0.92 0.02 1.13 132 TooManyTo_003 5742 0.99 0.50 1.10 133 XMPhish11 5710 1.12 1.25 1.09 134 XMCapTrack 5709 0.93 0.23 1.09 135 XM_GoogleGroups 5689 0.95 0.37 1.09 136 USER_IN_DEF_DKIM_WL 5482 0.85 0.01 1.05 137 XMBody_17 5171 1.16 1.92 0.99 138 DKIM_ADSP_CUSTOM_MED 4904 0.91 0.78 0.94 139 T_XMHurry_00 4827 1.23 2.59 0.92 140 XMSubMetaI_00 4662 1.22 2.65 0.89 141 XM_UB50 4660 2.02 6.95 0.89 142 RELAYCOUNTRY_GB 4644 1.02 1.58 0.89 143 XMPhish30 4262 0.83 0.89 0.82 144 TooManyTo_004 4206 0.73 0.40 0.81 145 T_MONEY_PERCENT 4141 0.88 1.27 0.79 146 TR_LOTS_OF_MONEY2 4141 0.88 1.27 0.79 147 XM_B_REG_HTML 4084 0.68 0.26 0.78 148 SpammyFromTLD_01 3938 1.05 2.36 0.75 149 TR_MetaPhish_Combo_01 3917 0.73 0.63 0.75 150 T_FILL_THIS_FORM_SHORT 3825 0.94 1.85 0.73 151 XM_SPF_Unknown 3706 0.70 0.66 0.71 152 XMBody_95 3645 0.60 0.19 0.70 153 NML_ADSP_CUSTOM_MED 3607 0.68 0.62 0.69 154 T_XMDrugObfuBody_00 3574 0.87 1.68 0.68 155 XMBrknScrpt_02 3508 0.82 1.49 0.67 156 TooManyTo_005 3482 0.60 0.33 0.67 157 FROM_GOV_SPOOF 3432 0.58 0.26 0.66 158 XMSexyCombo_01 3410 1.04 2.70 0.65 159 REMOVE_BEFORE_LINK 3278 0.60 0.47 0.63 160 RCVD_IN_MSPIKE_L4 3173 0.57 0.41 0.61 161 XMHTMLBadTable_001 3091 0.66 0.93 0.59 162 PLING_QUERY 3050 0.63 0.83 0.58 163 TR_LOTS_OF_MONEY3 3042 0.77 1.60 0.58 164 HTML_IMAGE_ONLY_20 2978 0.94 2.57 0.57 165 T_Symld_Words_02 2927 0.63 0.95 0.56 166 XMBody_78 2910 0.57 0.61 0.56 167 DIET_1 2896 0.57 0.63 0.55 168 URI_NOVOWEL 2878 0.51 0.31 0.55 169 XMLngstWrd_00 2846 0.57 0.66 0.54 170 RCVD_IN_MSPIKE_L3 2837 0.49 0.28 0.54 171 XMSubMetaSxObfu_03 2821 0.61 0.92 0.54 172 HTML_TAG_BALANCE_BODY 2813 0.54 0.57 0.54 173 TR_XM_PHPDW 2728 0.74 1.71 0.52 174 XMLngstWrd_01 2712 0.54 0.63 0.52 175 T_OBFU_PDF_ATTACH 2670 0.45 0.20 0.51 176 TR_XM_PHPForged 2648 0.72 1.66 0.51 177 XM_ShortIntro_01 2645 0.45 0.22 0.51 178 TR_XM_FormFill2 2637 0.72 1.64 0.50 179 HTTPS_HTTP_MISMATCH 2616 0.53 0.68 0.50 180 XM_H_PHPOS 2608 0.71 1.63 0.50 181 XM_B_COPY_HTML 2608 0.52 0.63 0.50 182 RELAYCOUNTRY_AU 2520 0.47 0.41 0.48 183 USER_IN_WHITELIST 2452 0.38 0.00 0.47 184 RCVD_IN_MSPIKE_L5 2412 0.53 0.81 0.46 185 XM_RXBody 2404 0.42 0.25 0.46 186 FORGED_GMAIL_RCVD 2309 0.49 0.70 0.44 187 XMNoVowels 2309 0.52 0.87 0.44 188 T_TooManySym_03 2297 0.39 0.19 0.44 189 NUMERIC_HTTP_ADDR 2247 0.45 0.52 0.43 190 SUBJ_DOLLARS 2234 0.54 1.01 0.43 191 XM_B_TRADE_HTML 2210 0.37 0.12 0.42 192 SpammyFromTLD_02 2181 1.42 5.80 0.42 193 MISSING_HEADERS 2163 0.44 0.57 0.41 194 FILL_THIS_FORM 2156 0.49 0.83 0.41 195 URIBL_CSS_A 2145 0.43 0.52 0.41 196 URIBL_CSS 2145 0.43 0.52 0.41 197 MPART_ALT_DIFF_COUNT 2132 0.49 0.85 0.41 198 XMBSHREFv2 2114 0.40 0.38 0.40 199 XM_H_PHPMailer 2108 0.56 1.25 0.40 200 XMLngstWrd_02 2095 0.43 0.54 0.40 ----------------------------------------------------------------------