Email: 352999 Autolearn: 0 AvgScore: 1.49 AvgScanTime: 2.27 sec Spam: 74246 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 2.76 sec Ham: 278753 Autolearn: 0 AvgScore: -1.56 AvgScanTime: 2.14 sec Time Spent Running SA: 222.44 hours Time Spent Processing Spam: 57.02 hours Time Spent Processing Ham: 165.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70726 90.41 95.26 89.12 2 DCC_CHECK 61500 61.34 82.83 55.62 3 XM_B_Unicode 58138 76.68 78.30 76.25 4 DKIM_SIGNED 57236 82.19 77.09 83.54 5 XM_DK_Pass 54569 80.49 73.50 82.35 6 DKIM_VALID 51173 77.16 68.92 79.35 7 XMListUnsubscribeExists 48300 64.46 65.05 64.31 8 DKIM_VALID_AU 41273 64.29 55.59 66.61 9 XM_B_Unicode3 37780 49.23 50.88 48.79 10 XM_DK_Undo_02 30393 15.46 40.94 8.68 11 HTML_FONT_LOW_CONTRAST 28607 35.80 38.53 35.07 12 BAYES_50 27812 49.72 37.46 52.99 13 MIME_HTML_ONLY 27129 26.52 36.54 23.85 14 LOC_TINY_FONT_1 26127 32.69 35.19 32.02 15 BAYES_99 24139 11.29 32.51 5.64 16 FVGT_m_MULTI_ODD 21746 24.97 29.29 23.82 17 XM_Body_Dirty_Words 21376 20.40 28.79 18.16 18 TR_DCC_Bayes_99 20428 8.25 27.51 3.12 19 BAYES_999 19812 9.42 26.68 4.82 20 XMSubLong 18866 22.75 25.41 22.04 21 FSL_BULK_SIG 15936 9.90 21.46 6.82 22 BOTNET_IPINHOSTNAME 15901 9.37 21.42 6.16 23 RELAYCOUNTRY_META 15144 7.60 20.40 4.20 24 BOTNET 14829 5.81 19.97 2.04 25 XM_B_Unsub 13855 11.27 18.66 9.30 26 MultiRelay 13809 15.79 18.60 15.04 27 XM_UncommonTLD01 13633 7.56 18.36 4.68 28 DKIM_VALID_EF 12739 25.74 17.16 28.03 29 XM_Multi_Part_URI 12092 16.09 16.29 16.04 30 XMSexyCombo_05 11730 7.88 15.80 5.77 31 HTML_IMAGE_RATIO_02 11704 13.75 15.76 13.21 32 DCC_CHECK_NEGATIVE 11468 37.33 15.45 43.16 33 T_KAM_HTML_FONT_INVALID 11391 16.60 15.34 16.94 34 T_XMDrugObfuBody_14 10986 10.00 14.80 8.73 35 RCVD_IN_MSPIKE_H2 10140 15.32 13.66 15.76 36 T_TM2_M_HEADER_IN_MSG 9817 19.04 13.22 20.59 37 HTML_IMAGE_RATIO_04 9491 9.76 12.78 8.95 38 XM_Evil_Numbers_Gen 9404 11.74 12.67 11.49 39 LOTS_OF_MONEY 8894 7.90 11.98 6.82 40 XMSubMetaSx_00 8813 5.45 11.87 3.74 41 XM_H_Long_From01 8605 7.81 11.59 6.80 42 MPART_ALT_DIFF 7367 5.78 9.92 4.67 43 UNTRUSTED_Relay 7308 3.24 9.84 1.48 44 BAYES_80 6467 4.20 8.71 2.99 45 XM_DIRTYINTL 6150 4.66 8.28 3.69 46 DKIM_INVALID 6063 5.03 8.17 4.19 47 SpammyFromTLD_02 5874 1.80 7.91 0.17 48 HTML_MIME_NO_HTML_TAG 5657 3.19 7.62 2.01 49 KHOP_HELO_FCRDNS 5622 2.46 7.57 1.10 50 MIME_HTML_MOSTLY 5186 4.88 6.98 4.31 51 XMSexyCombo_01 4743 1.96 6.39 0.78 52 TR_Mismatch_TLD_02 4712 1.38 6.35 0.05 53 LotsOfNums_01 4595 7.80 6.19 8.23 54 XM_CamelCaseFrm001 4576 3.24 6.16 2.46 55 XM_B_SpammyTLD 4513 3.96 6.08 3.40 56 RDNS_DYNAMIC 4458 1.66 6.00 0.50 57 XMBdyGiftCard01 4412 5.00 5.94 4.74 58 TooManyTo_001 4397 5.45 5.92 5.32 59 RCVD_IN_MSPIKE_WL 4376 10.17 5.89 11.31 60 BAYES_60 4372 5.99 5.89 6.01 61 RCVD_IN_MSPIKE_H3 4285 10.01 5.77 11.14 62 HTML_IMAGE_RATIO_08 4228 3.31 5.69 2.67 63 URI_HEX 4155 2.96 5.60 2.26 64 FROM_MISSP_REPLYTO 4010 1.14 5.40 0.00 65 FROM_EXCESS_BASE64 3973 5.37 5.35 5.38 66 XM_UB50 3955 1.76 5.33 0.80 67 FROM_MISSP_DYNIP 3934 1.11 5.30 0.00 68 XMStrtUSub 3790 5.43 5.10 5.52 69 XM_B_Phish_Phrases 3648 7.75 4.91 8.50 70 XMSexyCombo_04 3582 1.08 4.82 0.09 71 MIME_QP_LONG_LINE 3573 4.38 4.81 4.26 72 XMNumbers 3522 3.74 4.74 3.48 73 MIME_HTML_ONLY_MULTI 3496 2.96 4.71 2.50 74 SUBJECT_NEEDS_ENCODING 3430 0.98 4.62 0.01 75 SUBJ_ILLEGAL_CHARS 3420 0.98 4.61 0.01 76 RELAYCOUNTRY_CA 3416 2.19 4.60 1.54 77 XMSubMetaSSx_00 3388 1.11 4.56 0.19 78 XM_SendGrid 3374 7.37 4.54 8.12 79 T_TooManySym_01 3327 5.88 4.48 6.26 80 XMStockSpam_06 3200 2.24 4.31 1.68 81 T_REMOTE_IMAGE 3110 3.52 4.19 3.34 82 TM2_M_URI_OPT_OUT 3103 2.45 4.18 1.99 83 HTML_IMAGE_RATIO_06 2779 3.45 3.74 3.37 84 NORDNS_LOW_CONTRAST 2745 0.78 3.70 0.00 85 BAYES_40 2712 4.16 3.65 4.30 86 TR_LOTS_OF_MONEY2 2662 1.28 3.59 0.67 87 T_MONEY_PERCENT 2662 1.28 3.59 0.67 88 DKIM_ADSP_NXDOMAIN 2508 1.74 3.38 1.30 89 BAYES_95 2500 2.19 3.37 1.88 90 BAYES_20 2435 3.58 3.28 3.66 91 RCVD_IN_BL_SPAMCOP_NET 2423 1.49 3.26 1.01 92 HTML_SHORT_LINK_IMG_1 2393 0.70 3.22 0.02 93 RELAYCOUNTRY_GB 2365 1.06 3.19 0.49 94 XM_SPF_SoftFail 2352 1.62 3.17 1.20 95 XMDiploma_00 2331 1.70 3.14 1.31 96 REPLYTO_WITHOUT_TO_CC 2199 0.65 2.96 0.03 97 XM_OfRef6 2105 1.97 2.84 1.74 98 T_TooManySym_02 2080 2.65 2.80 2.61 99 URIBL_DBL_ABUSE_REDIR 2075 0.60 2.79 0.02 100 XM_RXBody 2042 1.97 2.75 1.77 101 RCVD_IN_RP_RNBL 2039 0.62 2.75 0.05 102 MIME_HEADER_CTYPE_ONLY 1984 0.63 2.67 0.08 103 DIET_1 1958 1.43 2.64 1.11 104 BOTNET_NORDNS 1930 0.55 2.60 0.01 105 BAYES_00 1909 16.31 2.57 19.97 106 UNPARSEABLE_RELAY 1895 3.35 2.55 3.57 107 NO_DNS_FOR_FROM 1866 2.19 2.51 2.10 108 RCVD_IN_RP_SAFE 1853 14.27 2.50 17.41 109 HDRS_LCASE_IMGONLY 1830 0.54 2.46 0.02 110 TR_XM_INV_DKIM 1812 0.68 2.44 0.21 111 SUBJ_ALL_CAPS 1794 2.18 2.42 2.11 112 TR_XM_DK_SendGrid 1781 4.53 2.40 5.10 113 TO_EQ_FM_DOM_HTML_IMG 1768 0.50 2.38 0.00 114 XMSubMetaI_00 1764 1.45 2.38 1.21 115 XM_URI_RBL 1761 0.76 2.37 0.33 116 XMGenDplmaNmb 1753 1.11 2.36 0.78 117 URI_TRY_3LD 1746 1.86 2.35 1.73 118 BAYES_05 1704 2.25 2.30 2.24 119 XM_DKIMWhitelistDomains 1670 9.73 2.25 11.73 120 RELAYCOUNTRY_FR 1615 0.67 2.18 0.27 121 MultiRelay_CC 1455 0.55 1.96 0.17 122 MultiRelay_Combo 1455 0.55 1.96 0.17 123 RCVD_IN_RP_CERTIFIED 1436 12.66 1.93 15.51 124 XM_B_Unsub2 1425 1.26 1.92 1.09 125 TR_XM_PHPDW 1405 0.74 1.89 0.43 126 RCVD_IN_PSBL 1390 0.45 1.87 0.07 127 TM2_M_VERY_LONG_WORD 1384 2.17 1.86 2.25 128 TR_XM_PHPForged 1354 0.72 1.82 0.43 129 HTML_IMAGE_ONLY_12 1349 0.46 1.82 0.10 130 TR_XM_FormFill2 1342 0.71 1.81 0.42 131 XM_H_PHPOS 1341 0.71 1.81 0.42 132 T_XMDrugObfuBody_08 1327 1.28 1.79 1.14 133 ALL_TRUSTED 1327 9.53 1.79 11.59 134 RELAYCOUNTRY_RU 1300 0.39 1.75 0.02 135 HTML_FONT_SIZE_HUGE 1259 0.47 1.70 0.14 136 XMPhish11 1245 1.04 1.68 0.87 137 SUBJ_OBFU_PUNCT_FEW 1229 0.37 1.66 0.02 138 XMLngstWrd_00 1198 0.90 1.61 0.71 139 XMSubject_48 1185 0.61 1.60 0.35 140 RCVD_IN_IADB_LISTED 1174 2.98 1.58 3.35 141 XMLngstWrd_01 1172 0.87 1.58 0.68 142 FILL_THIS_FORM 1172 0.67 1.58 0.43 143 HTML_IMAGE_ONLY_08 1148 0.41 1.55 0.10 144 TR_Symld_Words 1139 1.14 1.53 1.04 145 XMLngstWrd_02 1138 0.77 1.53 0.57 146 XMBody_17 1135 1.19 1.53 1.10 147 XM_H_PHPMailer 1114 0.62 1.50 0.39 148 XMLngstWrd_03 1107 0.72 1.49 0.51 149 TR_LOTS_OF_MONEY3 1097 0.63 1.48 0.41 150 XM_ProductURIs 1088 1.28 1.47 1.24 151 XMGappySubj_01 1060 1.25 1.43 1.20 152 FILL_THIS_FORM_LONG 1019 0.56 1.37 0.34 153 XMLngstWrd_04 1000 0.66 1.35 0.47 154 HTML_TAG_BALANCE_HEAD 989 0.33 1.33 0.07 155 RCVD_IN_IADB_SPF 987 2.61 1.33 2.95 156 XM_OfRef7 975 0.44 1.31 0.21 157 TR_XM_DK_Bayes 973 13.93 1.31 17.29 158 RCVD_IN_IADB_DK 970 2.28 1.31 2.55 159 XMHTML_After_End 967 1.12 1.30 1.07 160 RCVD_IN_IADB_SENDERID 966 2.33 1.30 2.61 161 TR_XM_RelayPhish 940 1.89 1.27 2.05 162 XM_DK_Undo_01 938 1.28 1.26 1.29 163 SpammyFromTLD_01 932 0.64 1.26 0.47 164 DATE_IN_PAST_03_06 923 0.34 1.24 0.10 165 MPART_ALT_DIFF_COUNT 895 0.68 1.21 0.55 166 RELAYCOUNTRY_AT 891 0.41 1.20 0.20 167 XMBrknScrpt_02 878 0.89 1.18 0.82 168 TR_XM_DK_Bayes1 873 13.42 1.18 16.67 169 FILL_THIS_FORM_LOAN 861 0.48 1.16 0.30 170 T_XMHurry_00 843 0.94 1.14 0.89 171 RCVD_IN_MSPIKE_BL 836 0.92 1.13 0.87 172 TR_Mismatch_TLD_01 791 0.46 1.07 0.30 173 DATE_IN_PAST_06_12 788 0.31 1.06 0.10 174 FROM_SUSPICIOUS_NTLD 788 0.28 1.06 0.07 175 PLING_QUERY 781 1.06 1.05 1.06 176 THIS_AD 763 0.68 1.03 0.58 177 FROM_SUSPICIOUS_NTLD_FP 740 0.26 1.00 0.06 178 XMGppyBdWords 735 0.37 0.99 0.21 179 MONEY_FORM 730 0.21 0.98 0.01 180 XMGappySubj_02 727 0.38 0.98 0.23 181 T_XMDrugObfuBody_00 715 0.59 0.96 0.49 182 DKIM_ADSP_CUSTOM_MED 709 0.95 0.95 0.95 183 XMSubMetaSx_01 709 0.27 0.95 0.09 184 XM_H_PHPOS_M 699 0.34 0.94 0.18 185 XM_B_COPY_HTML 687 0.76 0.93 0.71 186 URIBL_DBL_SPAM 687 0.22 0.93 0.03 187 RELAYCOUNTRY_DE 683 0.40 0.92 0.27 188 URIBL_BLACK 683 0.20 0.92 0.01 189 SUBJ_DOLLARS 680 0.46 0.92 0.34 190 LongTLD 669 0.29 0.90 0.12 191 XMPhish30 665 0.64 0.90 0.57 192 XM_H_Long_From02 661 1.08 0.89 1.13 193 XMHTMLBadTable_001 659 0.84 0.89 0.82 194 XMSlimDrugH 657 0.41 0.88 0.28 195 TVD_SPACE_RATIO 654 0.40 0.88 0.27 196 TR_XM_DK_Bayes2 651 12.67 0.88 15.81 197 LOW_PRICE 648 0.53 0.87 0.44 198 NML_ADSP_CUSTOM_MED 640 0.73 0.86 0.70 199 XMBody_78 636 0.95 0.86 0.98 200 HK_RANDOM_REPLYTO 634 0.29 0.85 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 248429 90.41 95.26 89.12 2 DKIM_SIGNED 232878 82.19 77.09 83.54 3 XM_DK_Pass 229563 80.49 73.50 82.35 4 DKIM_VALID 221189 77.16 68.92 79.35 5 XM_B_Unicode 212541 76.68 78.30 76.25 6 DKIM_VALID_AU 185668 64.29 55.59 66.61 7 XMListUnsubscribeExists 179253 64.46 65.05 64.31 8 DCC_CHECK 155033 61.34 82.83 55.62 9 BAYES_50 147701 49.72 37.46 52.99 10 XM_B_Unicode3 136005 49.23 50.88 48.79 11 DCC_CHECK_NEGATIVE 120307 37.33 15.45 43.16 12 HTML_FONT_LOW_CONTRAST 97754 35.80 38.53 35.07 13 LOC_TINY_FONT_1 89252 32.69 35.19 32.02 14 DKIM_VALID_EF 78135 25.74 17.16 28.03 15 MIME_HTML_ONLY 66484 26.52 36.54 23.85 16 FVGT_m_MULTI_ODD 66399 24.97 29.29 23.82 17 XMSubLong 61447 22.75 25.41 22.04 18 T_TM2_M_HEADER_IN_MSG 57390 19.04 13.22 20.59 19 BAYES_00 55677 16.31 2.57 19.97 20 XM_Body_Dirty_Words 50624 20.40 28.79 18.16 21 RCVD_IN_RP_SAFE 48518 14.27 2.50 17.41 22 TR_XM_DK_Bayes 48188 13.93 1.31 17.29 23 T_KAM_HTML_FONT_INVALID 47210 16.60 15.34 16.94 24 TR_XM_DK_Bayes1 46482 13.42 1.18 16.67 25 XM_Multi_Part_URI 44720 16.09 16.29 16.04 26 TR_XM_DK_Bayes2 44066 12.67 0.88 15.81 27 RCVD_IN_MSPIKE_H2 43943 15.32 13.66 15.76 28 RCVD_IN_RP_CERTIFIED 43246 12.66 1.93 15.51 29 MultiRelay 41936 15.79 18.60 15.04 30 HTML_IMAGE_RATIO_02 36818 13.75 15.76 13.21 31 XM_DKIMWhitelistDomains 32690 9.73 2.25 11.73 32 ALL_TRUSTED 32315 9.53 1.79 11.59 33 XM_Evil_Numbers_Gen 32041 11.74 12.67 11.49 34 RCVD_IN_MSPIKE_WL 31520 10.17 5.89 11.31 35 RCVD_IN_MSPIKE_H3 31056 10.01 5.77 11.14 36 XM_B_Unsub 25934 11.27 18.66 9.30 37 HTML_IMAGE_RATIO_04 24952 9.76 12.78 8.95 38 T_XMDrugObfuBody_14 24327 10.00 14.80 8.73 39 XM_DK_Undo_02 24187 15.46 40.94 8.68 40 XM_B_Phish_Phrases 23693 7.75 4.91 8.50 41 LotsOfNums_01 22940 7.80 6.19 8.23 42 XM_SendGrid 22648 7.37 4.54 8.12 43 FSL_BULK_SIG 19008 9.90 21.46 6.82 44 LOTS_OF_MONEY 19006 7.90 11.98 6.82 45 XM_H_Long_From01 18969 7.81 11.59 6.80 46 T_TooManySym_01 17444 5.88 4.48 6.26 47 BOTNET_IPINHOSTNAME 17169 9.37 21.42 6.16 48 BAYES_60 16762 5.99 5.89 6.01 49 XMSexyCombo_05 16072 7.88 15.80 5.77 50 BAYES_99 15732 11.29 32.51 5.64 51 XMStrtUSub 15382 5.43 5.10 5.52 52 FROM_EXCESS_BASE64 14996 5.37 5.35 5.38 53 TooManyTo_001 14835 5.45 5.92 5.32 54 TR_XM_DK_SendGrid 14222 4.53 2.40 5.10 55 BAYES_999 13446 9.42 26.68 4.82 56 XMBdyGiftCard01 13221 5.00 5.94 4.74 57 XM_UncommonTLD01 13040 7.56 18.36 4.68 58 MPART_ALT_DIFF 13025 5.78 9.92 4.67 59 MIME_HTML_MOSTLY 12025 4.88 6.98 4.31 60 BAYES_40 11977 4.16 3.65 4.30 61 MIME_QP_LONG_LINE 11875 4.38 4.81 4.26 62 RELAYCOUNTRY_META 11700 7.60 20.40 4.20 63 DKIM_INVALID 11689 5.03 8.17 4.19 64 XMSubMetaSx_00 10412 5.45 11.87 3.74 65 XM_DIRTYINTL 10294 4.66 8.28 3.69 66 BAYES_20 10197 3.58 3.28 3.66 67 UNPARSEABLE_RELAY 9940 3.35 2.55 3.57 68 XMNumbers 9688 3.74 4.74 3.48 69 XM_B_SpammyTLD 9466 3.96 6.08 3.40 70 HTML_IMAGE_RATIO_06 9388 3.45 3.74 3.37 71 RCVD_IN_IADB_LISTED 9347 2.98 1.58 3.35 72 T_REMOTE_IMAGE 9298 3.52 4.19 3.34 73 IN_ZIMBRA_NJ_WHITELIST 8811 2.50 0.02 3.16 74 TVD_RCVD_IP 8713 2.58 0.53 3.13 75 TR_DCC_Bayes_99 8690 8.25 27.51 3.12 76 BAYES_80 8344 4.20 8.71 2.99 77 RCVD_IN_IADB_SPF 8230 2.61 1.33 2.95 78 CK_HELO_DYNAMIC_SPLIT_IP 7487 2.24 0.56 2.69 79 HELO_DYNAMIC_IPADDR2 7486 2.14 0.07 2.69 80 HTML_IMAGE_RATIO_08 7447 3.31 5.69 2.67 81 T_TooManySym_02 7283 2.65 2.80 2.61 82 INVALID_MSGID 7273 2.17 0.54 2.61 83 RCVD_IN_IADB_SENDERID 7271 2.33 1.30 2.61 84 RCVD_IN_IADB_DK 7095 2.28 1.31 2.55 85 MIME_HTML_ONLY_MULTI 6959 2.96 4.71 2.50 86 XM_CamelCaseFrm001 6858 3.24 6.16 2.46 87 TO_MALFORMED 6573 1.86 0.01 2.36 88 XM_PDF 6490 1.92 0.37 2.33 89 URI_HEX 6296 2.96 5.60 2.26 90 TM2_M_VERY_LONG_WORD 6266 2.17 1.86 2.25 91 BAYES_05 6232 2.25 2.30 2.24 92 SUBJ_ALL_CAPS 5891 2.18 2.42 2.11 93 NO_DNS_FOR_FROM 5865 2.19 2.51 2.10 94 TR_XM_RelayPhish 5721 1.89 1.27 2.05 95 BOTNET 5681 5.81 19.97 2.04 96 HTML_MIME_NO_HTML_TAG 5598 3.19 7.62 2.01 97 TM2_M_URI_OPT_OUT 5537 2.45 4.18 1.99 98 USER_IN_DEF_DKIM_WL 5532 1.57 0.01 1.98 99 RCVD_IN_IADB_VOUCHED 5498 1.67 0.53 1.97 100 BAYES_95 5246 2.19 3.37 1.88 101 XM_RXBody 4920 1.97 2.75 1.77 102 XM_OfRef6 4851 1.97 2.84 1.74 103 URI_TRY_3LD 4814 1.86 2.35 1.73 104 XM_H_Trusted_IP 4718 1.34 0.00 1.69 105 XMStockSpam_06 4694 2.24 4.31 1.68 106 IN_HORDE_ADDRESS_BOOK 4686 1.33 0.03 1.68 107 RELAYCOUNTRY_CA 4301 2.19 4.60 1.54 108 MAILING_LIST_MULTI 4291 1.38 0.80 1.54 109 UNTRUSTED_Relay 4122 3.24 9.84 1.48 110 XMDiploma_00 3660 1.70 3.14 1.31 111 DKIM_ADSP_NXDOMAIN 3623 1.74 3.38 1.30 112 ANY_BOUNCE_MESSAGE 3614 1.08 0.25 1.30 113 BOUNCE_MESSAGE 3613 1.08 0.25 1.30 114 XM_DK_Undo_01 3594 1.28 1.26 1.29 115 RCVD_IN_IADB_OPTIN 3473 1.05 0.33 1.25 116 XM_ProductURIs 3448 1.28 1.47 1.24 117 XMSubMetaI_00 3370 1.45 2.38 1.21 118 XM_SPF_SoftFail 3358 1.62 3.17 1.20 119 XMGappySubj_01 3353 1.25 1.43 1.20 120 T_XMDrugObfuBody_08 3174 1.28 1.79 1.14 121 XM_H_Long_From02 3138 1.08 0.89 1.13 122 DIET_1 3100 1.43 2.64 1.11 123 KHOP_HELO_FCRDNS 3063 2.46 7.57 1.10 124 XMBody_17 3062 1.19 1.53 1.10 125 XM_GoogleGroups 3039 0.96 0.46 1.09 126 XM_B_Unsub2 3030 1.26 1.92 1.09 127 XMHTML_After_End 2994 1.12 1.30 1.07 128 PLING_QUERY 2954 1.06 1.05 1.06 129 TR_Symld_Words 2894 1.14 1.53 1.04 130 XMSubNoVowel 2879 0.89 0.35 1.03 131 XM_B_REG_HTML 2863 0.91 0.48 1.03 132 RCVD_IN_BL_SPAMCOP_NET 2828 1.49 3.26 1.01 133 XMBody_95 2739 0.80 0.10 0.98 134 XMBody_78 2725 0.95 0.86 0.98 135 TooManyTo_002 2724 0.89 0.58 0.98 136 HTML_FONT_FACE_BAD 2690 0.92 0.77 0.97 137 AC_FROM_MANY_DOTS 2661 0.76 0.01 0.95 138 DKIM_ADSP_CUSTOM_MED 2657 0.95 0.95 0.95 139 T_XMHurry_00 2473 0.94 1.14 0.89 140 HTML_TAG_BALANCE_BODY 2452 0.79 0.45 0.88 141 RCVD_IN_MSPIKE_BL 2425 0.92 1.13 0.87 142 XMPhish11 2422 1.04 1.68 0.87 143 XMHTMLBadTable_001 2295 0.84 0.89 0.82 144 XMBrknScrpt_02 2278 0.89 1.18 0.82 145 XM_UB50 2242 1.76 5.33 0.80 146 TR_MetaPhish_Combo_01 2239 0.75 0.53 0.80 147 XMGenDplmaNmb 2169 1.11 2.36 0.78 148 XMSexyCombo_01 2164 1.96 6.39 0.78 149 USER_IN_WHITELIST 2058 0.58 0.00 0.74 150 XMLngstWrd_00 1990 0.90 1.61 0.71 151 XM_B_COPY_HTML 1983 0.76 0.93 0.71 152 NML_ADSP_CUSTOM_MED 1946 0.73 0.86 0.70 153 XMLngstWrd_01 1889 0.87 1.58 0.68 154 TooManyTo_003 1882 0.63 0.48 0.68 155 T_MONEY_PERCENT 1856 1.28 3.59 0.67 156 TR_LOTS_OF_MONEY2 1856 1.28 3.59 0.67 157 XMBSHREFv2 1842 0.57 0.25 0.66 158 XM_Walgreens_Forge 1635 0.47 0.06 0.59 159 THIS_AD 1627 0.68 1.03 0.58 160 URI_NOVOWEL 1624 0.55 0.44 0.58 161 XMPhish30 1588 0.64 0.90 0.57 162 XMLngstWrd_02 1588 0.77 1.53 0.57 163 XMSubMetaSxObfu_02 1581 0.52 0.33 0.57 164 ADMITS_SPAM 1579 0.58 0.61 0.57 165 TooManyTo_004 1566 0.53 0.40 0.56 166 FORGED_GMAIL_RCVD 1543 0.61 0.81 0.55 167 T_TooManySym_03 1535 0.47 0.17 0.55 168 MPART_ALT_DIFF_COUNT 1520 0.68 1.21 0.55 169 HTML_IMAGE_ONLY_20 1492 0.45 0.13 0.54 170 T_Symld_Words_02 1426 0.51 0.51 0.51 171 XMLngstWrd_03 1424 0.72 1.49 0.51 172 RDNS_DYNAMIC 1399 1.66 6.00 0.50 173 TooManyTo_005 1375 0.46 0.34 0.49 174 RELAYCOUNTRY_GB 1363 1.06 3.19 0.49 175 T_XMDrugObfuBody_00 1359 0.59 0.96 0.49 176 SpammyFromTLD_01 1323 0.64 1.26 0.47 177 XMLngstWrd_04 1319 0.66 1.35 0.47 178 BODY_ENHANCEMENT 1265 0.37 0.05 0.45 179 URIBL_CSS_A 1251 0.42 0.33 0.45 180 URIBL_CSS 1251 0.42 0.33 0.45 181 LOW_PRICE 1228 0.53 0.87 0.44 182 TR_XM_PHPDW 1208 0.74 1.89 0.43 183 FILL_THIS_FORM 1198 0.67 1.58 0.43 184 TR_XM_PHPForged 1193 0.72 1.82 0.43 185 T_FILL_THIS_FORM_SHORT 1190 0.50 0.77 0.43 186 NUMERIC_HTTP_ADDR 1184 0.42 0.41 0.42 187 TR_XM_FormFill2 1174 0.71 1.81 0.42 188 XM_H_PHPOS 1165 0.71 1.81 0.42 189 TM2_M_A_HREF_HREF 1146 0.44 0.56 0.41 190 XM_SPF_Unknown 1143 0.40 0.39 0.41 191 TR_LOTS_OF_MONEY3 1141 0.63 1.48 0.41 192 XMSubMetaSxObfu_03 1130 0.48 0.78 0.41 193 HTTPS_HTTP_MISMATCH 1115 0.40 0.41 0.40 194 XMOemUri 1107 0.33 0.06 0.40 195 FSL_HELO_FAKE 1093 0.33 0.09 0.39 196 XM_H_PHPMailer 1086 0.62 1.50 0.39 197 XMRcvdHeader_15 1070 0.30 0.00 0.38 198 T_TooManySym_04 1035 0.31 0.06 0.37 199 XMNoVowels 1001 0.34 0.25 0.36 200 RCVD_IN_MSPIKE_L3 994 0.32 0.20 0.36 ----------------------------------------------------------------------