Email: 593936 Autolearn: 0 AvgScore: 1.60 AvgScanTime: 2.10 sec Spam: 115707 Autolearn: 0 AvgScore: 13.06 AvgScanTime: 2.63 sec Ham: 478229 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 1.98 sec Time Spent Running SA: 347.15 hours Time Spent Processing Spam: 84.40 hours Time Spent Processing Ham: 262.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 111111 91.07 96.03 89.88 2 DCC_CHECK 94477 52.71 81.65 45.71 3 DKIM_SIGNED 83979 77.33 72.58 78.47 4 XM_B_Unicode 81978 71.34 70.85 71.46 5 XM_DK_Pass 81120 75.83 70.11 77.22 6 DKIM_VALID 75938 72.17 65.63 73.75 7 XMListUnsubscribeExists 72188 58.27 62.39 57.27 8 DKIM_VALID_AU 57198 54.59 49.43 55.84 9 BAYES_50 52365 52.73 45.26 54.54 10 XM_B_Unicode3 52099 43.57 45.03 43.22 11 MIME_HTML_ONLY 48685 25.28 42.08 21.22 12 XM_DK_Undo_02 40417 12.24 34.93 6.75 13 LOC_TINY_FONT_1 37402 26.76 32.32 25.41 14 HTML_FONT_LOW_CONTRAST 37299 29.75 32.24 29.15 15 BOTNET 30203 6.65 26.10 1.95 16 RELAYCOUNTRY_META 27783 8.86 24.01 5.19 17 BAYES_99 27738 7.78 23.97 3.87 18 FVGT_m_MULTI_ODD 27207 22.38 23.51 22.10 19 XMSubLong 24889 20.66 21.51 20.46 20 DKIM_VALID_EF 24138 25.66 20.86 26.82 21 XM_Body_Dirty_Words 23670 15.12 20.46 13.83 22 FSL_BULK_SIG 23374 9.05 20.20 6.36 23 TR_DCC_Bayes_99 22586 5.24 19.52 1.79 24 BAYES_999 22008 6.25 19.02 3.15 25 BOTNET_IPINHOSTNAME 20886 7.35 18.05 4.76 26 T_KAM_HTML_FONT_INVALID 20457 19.22 17.68 19.59 27 XM_UncommonTLD01 19820 6.66 17.13 4.12 28 XM_Multi_Part_URI 19577 13.16 16.92 12.25 29 UNTRUSTED_Relay 19112 4.59 16.52 1.70 30 DCC_CHECK_NEGATIVE 19039 45.19 16.45 52.14 31 HTML_IMAGE_RATIO_02 18633 11.05 16.10 9.82 32 MultiRelay 18085 16.72 15.63 16.98 33 T_TM2_M_HEADER_IN_MSG 17811 23.64 15.39 25.64 34 HTML_MIME_NO_HTML_TAG 17268 4.86 14.92 2.42 35 XM_B_Unsub 16605 10.33 14.35 9.36 36 XM_Evil_Numbers_Gen 14638 10.34 12.65 9.78 37 XMSexyCombo_05 13941 5.52 12.05 3.94 38 RCVD_IN_MSPIKE_H2 13094 14.94 11.32 15.82 39 HTML_SHORT_LINK_IMG_1 11913 2.03 10.30 0.02 40 T_REMOTE_IMAGE 11908 5.34 10.29 4.14 41 LOTS_OF_MONEY 11818 7.97 10.21 7.43 42 HTML_IMAGE_ONLY_08 11410 2.01 9.86 0.11 43 T_XMDrugObfuBody_14 10988 8.40 9.50 8.13 44 XM_H_Long_From01 10777 6.94 9.31 6.37 45 XM_UB50 10646 2.52 9.20 0.91 46 MPART_ALT_DIFF 10200 5.34 8.82 4.50 47 T_HTML_TAG_BALANCE_CENTER 9968 1.77 8.61 0.12 48 KHOP_HELO_FCRDNS 9769 3.34 8.44 2.11 49 BODY_URI_ONLY 9213 1.63 7.96 0.09 50 XMSubMetaSx_00 9093 3.99 7.86 3.05 51 XM_B_Phish_Phrases 9017 6.98 7.79 6.78 52 TR_Mismatch_TLD_02 8990 1.57 7.77 0.07 53 BAYES_60 8883 6.00 7.68 5.60 54 HTML_IMAGE_RATIO_04 8882 6.85 7.68 6.66 55 XM_SPF_SoftFail 8700 2.89 7.52 1.77 56 LotsOfNums_01 8613 8.77 7.44 9.10 57 BAYES_80 8448 3.65 7.30 2.77 58 MIME_HTML_MOSTLY 8262 3.94 7.14 3.16 59 DKIM_INVALID 8041 5.16 6.95 4.73 60 FROM_SUSPICIOUS_NTLD 7488 1.30 6.47 0.04 61 TooManyTo_001 7462 7.35 6.45 7.57 62 FROM_SUSPICIOUS_NTLD_FP 7415 1.28 6.41 0.04 63 DKIM_ADSP_NXDOMAIN 7343 2.19 6.35 1.18 64 SpammyFromTLD_02 7204 1.40 6.23 0.23 65 XM_DIRTYINTL 6717 3.30 5.81 2.69 66 XMStrtUSub 6716 5.06 5.80 4.88 67 XMNumbers 5971 3.50 5.16 3.09 68 TR_Mismatch_TLD_01 5850 1.12 5.06 0.17 69 TM2_M_URI_OPT_OUT 5821 2.79 5.03 2.25 70 MIME_QP_LONG_LINE 5734 5.91 4.96 6.14 71 FROM_EXCESS_BASE64 5667 3.86 4.90 3.61 72 BAYES_40 5596 5.23 4.84 5.32 73 RCVD_IN_MSPIKE_WL 5201 9.57 4.49 10.80 74 XM_SendGrid 5086 6.38 4.40 6.86 75 TO_MALFORMED 5040 1.96 4.36 1.38 76 SHORT_IMG_SUSP_NTLD 4973 0.84 4.30 0.00 77 RDNS_DYNAMIC 4952 1.14 4.28 0.38 78 XM_BadFromFormat 4795 0.88 4.14 0.09 79 HTML_IMAGE_RATIO_06 4791 3.62 4.14 3.50 80 RELAYCOUNTRY_CA 4736 2.05 4.09 1.55 81 FROM_MISSP_REPLYTO 4704 0.79 4.07 0.00 82 RCVD_IN_MSPIKE_H3 4686 9.28 4.05 10.55 83 URI_HEX 4579 1.89 3.96 1.39 84 BOTNET_NORDNS 4519 0.80 3.91 0.05 85 HDRS_MISSP 4400 0.75 3.80 0.01 86 MIME_HTML_ONLY_MULTI 4211 2.87 3.64 2.68 87 RCVD_IN_BL_SPAMCOP_NET 3991 1.57 3.45 1.11 88 XMSexyCombo_01 3987 1.08 3.45 0.51 89 XM_URI_RBL 3973 0.96 3.43 0.36 90 RCVD_IN_RP_RNBL 3920 0.73 3.39 0.09 91 BAYES_20 3887 4.04 3.36 4.20 92 HDRS_LCASE_IMGONLY 3695 0.66 3.19 0.04 93 NO_DNS_FOR_FROM 3685 2.12 3.18 1.86 94 BAYES_95 3684 1.88 3.18 1.56 95 T_TooManySym_01 3675 4.62 3.18 4.97 96 XM_CamelCaseFrm001 3612 2.55 3.12 2.41 97 RELAYCOUNTRY_FR 3389 0.87 2.93 0.37 98 SpammyFromTLD_01 3340 1.30 2.89 0.92 99 LongTLD 3292 0.67 2.85 0.14 100 MIME_HEADER_CTYPE_ONLY 3270 0.62 2.83 0.09 101 XM_B_SpammyTLD 3085 2.32 2.67 2.23 102 XMBdyGiftCard01 3066 2.40 2.65 2.34 103 XMHTML_After_End 2854 1.79 2.47 1.62 104 T_XMDrugObfuBody_08 2836 1.51 2.45 1.29 105 MultiRelay_Combo 2829 0.69 2.44 0.26 106 MultiRelay_CC 2829 0.69 2.44 0.26 107 RELAYCOUNTRY_GR 2828 0.48 2.44 0.00 108 XMDiploma_00 2777 1.48 2.40 1.26 109 SUBJ_ALL_CAPS 2719 1.69 2.35 1.54 110 DIET_1 2706 0.95 2.34 0.62 111 HTML_IMAGE_RATIO_08 2696 2.63 2.33 2.70 112 RELAYCOUNTRY_GB 2689 1.22 2.32 0.95 113 HK_RANDOM_FROM 2638 0.54 2.28 0.12 114 RCVD_IN_IADB_LISTED 2455 5.23 2.12 5.98 115 XMBody_17 2433 1.12 2.10 0.88 116 XMSexyCombo_04 2422 0.50 2.09 0.12 117 ALL_TRUSTED 2419 10.58 2.09 12.63 118 RCVD_IN_SORBS_DUL 2408 0.62 2.08 0.27 119 BAYES_00 2404 15.83 2.08 19.16 120 T_XMHurry_00 2391 1.12 2.07 0.89 121 TO_NO_BRKTS_DYNIP 2385 0.40 2.06 0.00 122 XM_OfRef6 2380 1.19 2.06 0.98 123 XM_UB60 2370 0.46 2.05 0.07 124 BAYES_05 2367 2.53 2.05 2.65 125 RCVD_IN_IADB_SPF 2328 4.57 2.01 5.19 126 XMPhish11 2294 1.18 1.98 0.98 127 RCVD_IN_IADB_DK 2270 3.98 1.96 4.46 128 RELAYCOUNTRY_DE 2258 0.62 1.95 0.30 129 RCVD_IN_IADB_SENDERID 2252 4.05 1.95 4.56 130 TR_XM_PHPDW 2242 0.84 1.94 0.58 131 TR_XM_INV_DKIM 2193 0.52 1.90 0.19 132 TR_XM_PHPForged 2192 0.82 1.89 0.56 133 TR_XM_FormFill2 2180 0.81 1.88 0.56 134 XM_H_PHPOS 2170 0.81 1.88 0.55 135 TR_XM_RelayPhish 2166 1.31 1.87 1.17 136 XM_H_PHPMailer 2109 0.72 1.82 0.45 137 XM_B_Unsub2 2068 1.95 1.79 1.99 138 RCVD_IN_PSBL 2003 0.37 1.73 0.04 139 TR_XM_DK_SendGrid 1990 3.43 1.72 3.85 140 TM2_M_VERY_LONG_WORD 1980 1.64 1.71 1.62 141 UNPARSEABLE_RELAY 1966 2.19 1.70 2.30 142 XMGenDplmaNmb 1903 0.98 1.64 0.83 143 XMSubMetaI_00 1902 0.97 1.64 0.81 144 RCVD_IN_RP_SAFE 1889 9.28 1.63 11.13 145 RCVD_IN_MSPIKE_BL 1855 1.46 1.60 1.42 146 RELAYCOUNTRY_IN 1835 0.40 1.59 0.11 147 XMStockSpam_06 1758 0.86 1.52 0.70 148 T_MONEY_PERCENT 1660 0.81 1.43 0.66 149 TR_LOTS_OF_MONEY2 1660 0.81 1.43 0.66 150 PLING_QUERY 1659 1.47 1.43 1.47 151 URI_TRY_3LD 1632 1.43 1.41 1.44 152 XMBrknScrpt_02 1604 0.74 1.39 0.58 153 TR_LOTS_OF_MONEY3 1591 0.82 1.38 0.68 154 DATE_IN_PAST_03_06 1588 0.37 1.37 0.13 155 DKIM_ADSP_CUSTOM_MED 1563 1.04 1.35 0.96 156 TR_Symld_Words 1550 1.37 1.34 1.38 157 XMSlimDrugH 1550 0.47 1.34 0.25 158 XM_H_Long_From02 1522 1.47 1.32 1.51 159 T_XMDrugObfuBody_00 1501 0.83 1.30 0.72 160 HK_SCAM 1498 0.27 1.29 0.03 161 XM_DK_Undo_01 1472 1.44 1.27 1.48 162 RCVD_IN_RP_CERTIFIED 1442 8.34 1.25 10.06 163 FORGED_GMAIL_RCVD 1435 0.68 1.24 0.54 164 FROM_MISSP_DYNIP 1355 0.23 1.17 0.00 165 MAILING_LIST_MULTI 1335 1.73 1.15 1.86 166 XM_SPF_Unknown 1318 0.75 1.14 0.66 167 NML_ADSP_CUSTOM_MED 1311 0.76 1.13 0.67 168 RCVD_IN_MSPIKE_L5 1292 0.57 1.12 0.43 169 DATE_IN_PAST_06_12 1279 0.30 1.11 0.11 170 XM_ProductURIs 1214 0.88 1.05 0.84 171 XMSubGiftCard1 1209 0.24 1.04 0.04 172 XM_UB99 1205 0.21 1.04 0.00 173 RELAYCOUNTRY_AT 1178 0.42 1.02 0.27 174 URIBL_DBL_SPAM 1163 0.23 1.01 0.04 175 RELAYCOUNTRY_NL 1156 0.32 1.00 0.16 176 XMMoneyMeta_00 1144 0.69 0.99 0.62 177 XM_H_PHPOS_M 1123 0.32 0.97 0.16 178 XMSubGiftCard2 1107 0.20 0.96 0.01 179 XMSubMetaSSx_00 1083 0.30 0.94 0.15 180 TR_XM_DK_Bayes 1038 12.15 0.90 14.87 181 FILL_THIS_FORM 1034 0.46 0.89 0.36 182 HTML_IMAGE_ONLY_12 1024 0.35 0.88 0.22 183 THIS_AD 1012 0.56 0.87 0.48 184 URIBL_DBL_ABUSE_REDIR 1011 0.17 0.87 0.01 185 MPART_ALT_DIFF_COUNT 1010 0.47 0.87 0.38 186 XMPhish04 1005 0.17 0.87 0.00 187 XMPhish30 1002 0.65 0.87 0.59 188 LOW_PRICE 1001 0.33 0.87 0.20 189 XMWghtMeta_00 993 0.19 0.86 0.02 190 REPLYTO_WITHOUT_TO_CC 992 0.19 0.86 0.03 191 XM_UB80 975 0.18 0.84 0.02 192 XMSubject_48 974 0.21 0.84 0.05 193 XM_XX_Yahoo 971 0.26 0.84 0.13 194 FROM_LOCAL_NOVOWEL 928 0.17 0.80 0.02 195 URI_NO_WWW_INFO_CGI 920 0.22 0.80 0.08 196 NUMERIC_HTTP_ADDR 911 0.40 0.79 0.30 197 XMPhish14 902 0.58 0.78 0.53 198 HTML_FONT_FACE_BAD 898 0.85 0.78 0.87 199 TR_XM_DK_Bayes1 884 11.62 0.76 14.25 200 SUBJ_DOLLARS 871 0.56 0.75 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 429816 91.07 96.03 89.88 2 DKIM_SIGNED 375284 77.33 72.58 78.47 3 XM_DK_Pass 369274 75.83 70.11 77.22 4 DKIM_VALID 352677 72.17 65.63 73.75 5 XM_B_Unicode 341730 71.34 70.85 71.46 6 XMListUnsubscribeExists 273880 58.27 62.39 57.27 7 DKIM_VALID_AU 267046 54.59 49.43 55.84 8 BAYES_50 260824 52.73 45.26 54.54 9 DCC_CHECK_NEGATIVE 249349 45.19 16.45 52.14 10 DCC_CHECK 218585 52.71 81.65 45.71 11 XM_B_Unicode3 206699 43.57 45.03 43.22 12 HTML_FONT_LOW_CONTRAST 139386 29.75 32.24 29.15 13 DKIM_VALID_EF 128259 25.66 20.86 26.82 14 T_TM2_M_HEADER_IN_MSG 122617 23.64 15.39 25.64 15 LOC_TINY_FONT_1 121535 26.76 32.32 25.41 16 FVGT_m_MULTI_ODD 105696 22.38 23.51 22.10 17 MIME_HTML_ONLY 101483 25.28 42.08 21.22 18 XMSubLong 97830 20.66 21.51 20.46 19 T_KAM_HTML_FONT_INVALID 93679 19.22 17.68 19.59 20 BAYES_00 91642 15.83 2.08 19.16 21 MultiRelay 81200 16.72 15.63 16.98 22 RCVD_IN_MSPIKE_H2 75649 14.94 11.32 15.82 23 TR_XM_DK_Bayes 71103 12.15 0.90 14.87 24 TR_XM_DK_Bayes1 68136 11.62 0.76 14.25 25 XM_Body_Dirty_Words 66151 15.12 20.46 13.83 26 TR_XM_DK_Bayes2 60466 10.30 0.61 12.64 27 ALL_TRUSTED 60415 10.58 2.09 12.63 28 XM_Multi_Part_URI 58569 13.16 16.92 12.25 29 RCVD_IN_RP_SAFE 53233 9.28 1.63 11.13 30 RCVD_IN_MSPIKE_WL 51654 9.57 4.49 10.80 31 RCVD_IN_MSPIKE_H3 50438 9.28 4.05 10.55 32 RCVD_IN_RP_CERTIFIED 48112 8.34 1.25 10.06 33 HTML_IMAGE_RATIO_02 46973 11.05 16.10 9.82 34 XM_Evil_Numbers_Gen 46771 10.34 12.65 9.78 35 XM_B_Unsub 44742 10.33 14.35 9.36 36 LotsOfNums_01 43500 8.77 7.44 9.10 37 T_XMDrugObfuBody_14 38883 8.40 9.50 8.13 38 XM_DKIMWhitelistDomains 38107 6.42 0.03 7.97 39 TooManyTo_001 36205 7.35 6.45 7.57 40 LOTS_OF_MONEY 35539 7.97 10.21 7.43 41 XM_SendGrid 32783 6.38 4.40 6.86 42 XM_B_Phish_Phrases 32421 6.98 7.79 6.78 43 XM_DK_Undo_02 32276 12.24 34.93 6.75 44 HTML_IMAGE_RATIO_04 31828 6.85 7.68 6.66 45 XM_H_Long_From01 30461 6.94 9.31 6.37 46 FSL_BULK_SIG 30393 9.05 20.20 6.36 47 MIME_QP_LONG_LINE 29366 5.91 4.96 6.14 48 RCVD_IN_IADB_LISTED 28605 5.23 2.12 5.98 49 BAYES_60 26766 6.00 7.68 5.60 50 BAYES_40 25441 5.23 4.84 5.32 51 RCVD_IN_IADB_SPF 24836 4.57 2.01 5.19 52 RELAYCOUNTRY_META 24826 8.86 24.01 5.19 53 T_TooManySym_01 23770 4.62 3.18 4.97 54 XMStrtUSub 23320 5.06 5.80 4.88 55 BOTNET_IPINHOSTNAME 22759 7.35 18.05 4.76 56 DKIM_INVALID 22607 5.16 6.95 4.73 57 XM_PDF 22037 3.86 0.74 4.61 58 RCVD_IN_IADB_SENDERID 21826 4.05 1.95 4.56 59 MPART_ALT_DIFF 21522 5.34 8.82 4.50 60 RCVD_IN_IADB_DK 21346 3.98 1.96 4.46 61 BAYES_20 20108 4.04 3.36 4.20 62 T_REMOTE_IMAGE 19779 5.34 10.29 4.14 63 XM_UncommonTLD01 19707 6.66 17.13 4.12 64 XMSexyCombo_05 18835 5.52 12.05 3.94 65 BAYES_99 18497 7.78 23.97 3.87 66 TR_XM_DK_SendGrid 18400 3.43 1.72 3.85 67 RCVD_IN_IADB_VOUCHED 18257 3.21 0.70 3.82 68 FROM_EXCESS_BASE64 17282 3.86 4.90 3.61 69 HTML_IMAGE_RATIO_06 16715 3.62 4.14 3.50 70 IN_ZIMBRA_NJ_WHITELIST 16186 2.73 0.03 3.38 71 MIME_HTML_MOSTLY 15113 3.94 7.14 3.16 72 BAYES_999 15085 6.25 19.02 3.15 73 XMNumbers 14793 3.50 5.16 3.09 74 XMSubMetaSx_00 14580 3.99 7.86 3.05 75 BAYES_80 13230 3.65 7.30 2.77 76 HTML_IMAGE_RATIO_08 12897 2.63 2.33 2.70 77 XM_DIRTYINTL 12879 3.30 5.81 2.69 78 MIME_HTML_ONLY_MULTI 12827 2.87 3.64 2.68 79 BAYES_05 12684 2.53 2.05 2.65 80 HTML_MIME_NO_HTML_TAG 11585 4.86 14.92 2.42 81 XM_CamelCaseFrm001 11540 2.55 3.12 2.41 82 RCVD_IN_IADB_OPTIN 11520 2.04 0.51 2.41 83 XMBdyGiftCard01 11183 2.40 2.65 2.34 84 UNPARSEABLE_RELAY 11015 2.19 1.70 2.30 85 TM2_M_URI_OPT_OUT 10763 2.79 5.03 2.25 86 XM_B_SpammyTLD 10682 2.32 2.67 2.23 87 KHOP_HELO_FCRDNS 10095 3.34 8.44 2.11 88 TVD_RCVD_IP 10021 1.76 0.40 2.10 89 T_TooManySym_02 9938 1.81 0.70 2.08 90 XM_H_Trusted_IP 9740 1.64 0.00 2.04 91 XM_B_Unsub2 9535 1.95 1.79 1.99 92 BOTNET 9321 6.65 26.10 1.95 93 BOUNCE_MESSAGE 9235 1.66 0.53 1.93 94 ANY_BOUNCE_MESSAGE 9235 1.66 0.53 1.93 95 TooManyTo_002 9188 1.68 0.66 1.92 96 MAILING_LIST_MULTI 8914 1.73 1.15 1.86 97 NO_DNS_FOR_FROM 8896 2.12 3.18 1.86 98 TR_DCC_Bayes_99 8549 5.24 19.52 1.79 99 XM_SPF_SoftFail 8455 2.89 7.52 1.77 100 UNTRUSTED_Relay 8123 4.59 16.52 1.70 101 INVALID_MSGID 7791 1.41 0.52 1.63 102 TM2_M_VERY_LONG_WORD 7763 1.64 1.71 1.62 103 XMHTML_After_End 7760 1.79 2.47 1.62 104 CK_HELO_DYNAMIC_SPLIT_IP 7546 1.36 0.48 1.58 105 HELO_DYNAMIC_IPADDR2 7542 1.29 0.13 1.58 106 BAYES_95 7479 1.88 3.18 1.56 107 IN_HORDE_ADDRESS_BOOK 7444 1.26 0.03 1.56 108 RELAYCOUNTRY_CA 7425 2.05 4.09 1.55 109 SUBJ_ALL_CAPS 7346 1.69 2.35 1.54 110 XM_H_Long_From02 7222 1.47 1.32 1.51 111 XM_DK_Undo_01 7074 1.44 1.27 1.48 112 PLING_QUERY 7043 1.47 1.43 1.47 113 URI_TRY_3LD 6874 1.43 1.41 1.44 114 RCVD_IN_MSPIKE_BL 6796 1.46 1.60 1.42 115 URI_HEX 6660 1.89 3.96 1.39 116 TR_Symld_Words 6615 1.37 1.34 1.38 117 TO_MALFORMED 6582 1.96 4.36 1.38 118 TooManyTo_003 6185 1.15 0.54 1.29 119 T_XMDrugObfuBody_08 6151 1.51 2.45 1.29 120 XMDiploma_00 6022 1.48 2.40 1.26 121 USER_IN_DEF_DKIM_WL 5969 1.01 0.02 1.25 122 HELO_NODOT 5671 1.09 0.68 1.19 123 HELO_NO_DOMAIN 5669 1.09 0.68 1.19 124 XMSubNoVowel 5666 1.05 0.47 1.18 125 DKIM_ADSP_NXDOMAIN 5639 2.19 6.35 1.18 126 TR_XM_RelayPhish 5595 1.31 1.87 1.17 127 RCVD_IN_BL_SPAMCOP_NET 5324 1.57 3.45 1.11 128 XM_OfRef6 4693 1.19 2.06 0.98 129 XMPhish11 4687 1.18 1.98 0.98 130 XMGappySubj_01 4667 0.87 0.44 0.98 131 DKIM_ADSP_CUSTOM_MED 4606 1.04 1.35 0.96 132 XM_GoogleGroups 4587 0.85 0.41 0.96 133 TooManyTo_004 4553 0.85 0.43 0.95 134 XMCapTrack 4548 0.82 0.28 0.95 135 RELAYCOUNTRY_GB 4540 1.22 2.32 0.95 136 SpammyFromTLD_01 4377 1.30 2.89 0.92 137 XM_UB50 4338 2.52 9.20 0.91 138 XMBody_95 4289 0.75 0.15 0.90 139 T_XMHurry_00 4255 1.12 2.07 0.89 140 XMBody_17 4219 1.12 2.10 0.88 141 HTML_FONT_FACE_BAD 4141 0.85 0.78 0.87 142 XM_ProductURIs 4036 0.88 1.05 0.84 143 XMGenDplmaNmb 3946 0.98 1.64 0.83 144 XMSubMetaI_00 3881 0.97 1.64 0.81 145 TooManyTo_005 3786 0.71 0.36 0.79 146 AC_FROM_MANY_DOTS 3778 0.64 0.01 0.79 147 TR_MetaPhish_Combo_01 3705 0.73 0.57 0.77 148 T_XMDrugObfuBody_00 3422 0.83 1.30 0.72 149 XMStockSpam_06 3361 0.86 1.52 0.70 150 T_OBFU_PDF_ATTACH 3264 0.60 0.25 0.68 151 XM_E_Blogspot 3258 0.57 0.09 0.68 152 TR_LOTS_OF_MONEY3 3256 0.82 1.38 0.68 153 NML_ADSP_CUSTOM_MED 3225 0.76 1.13 0.67 154 HTML_TAG_BALANCE_BODY 3166 0.64 0.54 0.66 155 XM_SPF_Unknown 3154 0.75 1.14 0.66 156 T_MONEY_PERCENT 3147 0.81 1.43 0.66 157 TR_LOTS_OF_MONEY2 3147 0.81 1.43 0.66 158 T_FILL_THIS_FORM_SHORT 3101 0.64 0.63 0.65 159 RCVD_IN_MSPIKE_L4 2995 0.53 0.16 0.63 160 XMMoneyMeta_00 2981 0.69 0.99 0.62 161 DIET_1 2954 0.95 2.34 0.62 162 XMPhish30 2834 0.65 0.87 0.59 163 XM_B_REG_HTML 2830 0.56 0.42 0.59 164 TR_XM_PHPDW 2765 0.84 1.94 0.58 165 XMBrknScrpt_02 2764 0.74 1.39 0.58 166 TR_XM_PHPForged 2675 0.82 1.89 0.56 167 TR_XM_FormFill2 2657 0.81 1.88 0.56 168 XM_H_PHPOS 2638 0.81 1.88 0.55 169 FORGED_GMAIL_RCVD 2581 0.68 1.24 0.54 170 XMHTMLBadTable_001 2543 0.56 0.66 0.53 171 XMPhish14 2517 0.58 0.78 0.53 172 USER_IN_WHITELIST 2459 0.41 0.00 0.51 173 SUBJ_DOLLARS 2457 0.56 0.75 0.51 174 XMSexyCombo_01 2432 1.08 3.45 0.51 175 XM_Body_Obfu01 2410 0.54 0.71 0.50 176 RELAYCOUNTRY_AU 2344 0.47 0.38 0.49 177 URI_NOVOWEL 2335 0.46 0.35 0.49 178 HTTPS_HTTP_MISMATCH 2295 0.47 0.41 0.48 179 THIS_AD 2287 0.56 0.87 0.48 180 XMLngstWrd_00 2261 0.52 0.73 0.47 181 XM_B_COPY_HTML 2219 0.50 0.64 0.46 182 HTML_IMAGE_ONLY_20 2184 0.41 0.23 0.46 183 XM_ShortIntro_01 2171 0.42 0.27 0.45 184 XM_H_PHPMailer 2151 0.72 1.82 0.45 185 XM_RXBody 2128 0.42 0.29 0.44 186 MISSING_HEADERS 2075 0.49 0.71 0.43 187 RCVD_IN_MSPIKE_L5 2070 0.57 1.12 0.43 188 XMLngstWrd_01 2060 0.48 0.68 0.43 189 T_TooManySym_03 2042 0.37 0.14 0.43 190 TM2_M_BODY_EMPTY 1969 0.35 0.08 0.41 191 XMBody_78 1952 0.44 0.58 0.41 192 XMNoVowels 1923 0.37 0.26 0.40 193 AC_DIV_BONANZA 1899 0.34 0.11 0.40 194 XMSubMetaSxObfu_03 1868 0.45 0.68 0.39 195 FSL_THIS_IS_ADV 1818 0.39 0.44 0.38 196 XMDateMe_00 1807 0.40 0.50 0.38 197 MPART_ALT_DIFF_COUNT 1806 0.47 0.87 0.38 198 RDNS_DYNAMIC 1797 1.14 4.28 0.38 199 RELAYCOUNTRY_FR 1788 0.87 2.93 0.37 200 XM_URI_RBL 1738 0.96 3.43 0.36 ----------------------------------------------------------------------