Email: 510291 Autolearn: 0 AvgScore: 1.35 AvgScanTime: 2.01 sec Spam: 123067 Autolearn: 0 AvgScore: 18.43 AvgScanTime: 2.36 sec Ham: 387224 Autolearn: 0 AvgScore: -4.07 AvgScanTime: 1.89 sec Time Spent Running SA: 284.46 hours Time Spent Processing Spam: 80.75 hours Time Spent Processing Ham: 203.71 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 107635 89.65 87.46 90.35 2 DCC_CHECK 95288 53.37 77.43 45.72 3 XM_B_Unicode 75619 73.39 61.45 77.19 4 DKIM_SIGNED 54752 60.25 44.49 65.26 5 XM_DK_Pass 53507 59.44 43.48 64.51 6 MIME_HTML_ONLY 52394 30.90 42.57 27.20 7 BOTNET 51146 11.36 41.56 1.76 8 DKIM_VALID 50128 56.78 40.73 61.88 9 BAYES_50 47525 42.74 38.62 44.05 10 RELAYCOUNTRY_META 45482 11.91 36.96 3.95 11 XMListUnsubscribeExists 43731 45.76 35.53 49.01 12 UNTRUSTED_Relay 39908 8.81 32.43 1.30 13 DKIM_VALID_AU 38448 45.60 31.24 50.17 14 BOTNET_IPINHOSTNAME 36659 11.11 29.79 5.17 15 XM_B_Unicode3 36234 44.02 29.44 48.65 16 XM_UncommonTLD01 32270 11.99 26.22 7.46 17 FSL_BULK_SIG 32242 12.15 26.20 7.69 18 XM_B_Unsub 31969 16.24 25.98 13.15 19 XM_DK_Undo_02 26630 10.06 21.64 6.39 20 BAYES_99 26155 7.86 21.25 3.61 21 XMSubLong 25761 18.44 20.93 17.65 22 DCC_CHECK_NEGATIVE 25673 45.50 20.86 53.33 23 T_KAM_HTML_FONT_INVALID 25283 19.53 20.54 19.21 24 HTML_FONT_LOW_CONTRAST 23560 25.84 19.14 27.97 25 LOC_TINY_FONT_1 23181 23.30 18.84 24.72 26 HTML_MIME_NO_HTML_TAG 22612 5.45 18.37 1.34 27 XM_Body_Dirty_Words 22277 12.97 18.10 11.34 28 KHOP_HELO_FCRDNS 20479 4.94 16.64 1.22 29 RCVD_IN_BL_SPAMCOP_NET 20012 4.79 16.26 1.14 30 FROM_SUSPICIOUS_NTLD 19857 3.92 16.14 0.04 31 FROM_SUSPICIOUS_NTLD_FP 19772 3.90 16.07 0.04 32 RCVD_IN_RP_RNBL 19512 3.87 15.85 0.06 33 FVGT_m_MULTI_ODD 18785 17.19 15.26 17.80 34 T_REMOTE_IMAGE 18760 8.69 15.24 6.61 35 BAYES_999 18675 5.90 15.17 2.95 36 XMSexyCombo_05 17501 6.72 14.22 4.33 37 DKIM_VALID_EF 17481 19.93 14.20 21.75 38 XM_UB50 17459 3.92 14.19 0.66 39 MultiRelay 17110 13.10 13.90 12.85 40 DKIM_ADSP_NXDOMAIN 17095 6.71 13.89 4.43 41 TR_DCC_Bayes_99 16641 4.65 13.52 1.83 42 HTML_SHORT_LINK_IMG_1 16258 3.21 13.21 0.03 43 TooManyTo_001 16139 9.17 13.11 7.92 44 T_TM2_M_HEADER_IN_MSG 14192 15.74 11.53 17.08 45 HDRS_LCASE_IMGONLY 13890 2.73 11.29 0.02 46 HTML_IMAGE_ONLY_08 13665 2.76 11.10 0.11 47 XM_B_Unsub2 13599 6.60 11.05 5.19 48 BAYES_80 13380 4.98 10.87 3.11 49 NO_FM_NAME_IP_HOSTN 12914 2.54 10.49 0.01 50 XM_Multi_Part_URI 12744 11.20 10.36 11.47 51 ALL_TRUSTED 12641 12.86 10.27 13.68 52 MIME_HEADER_CTYPE_ONLY 12546 2.52 10.19 0.08 53 HTML_IMAGE_RATIO_02 12447 9.39 10.11 9.16 54 XMSubMetaSx_00 12357 5.04 10.04 3.45 55 RDNS_DYNAMIC 11977 2.58 9.73 0.31 56 SHORT_IMG_SUSP_NTLD 11714 2.30 9.52 0.00 57 BAYES_60 11342 6.19 9.22 5.23 58 HDRS_MISSP 11295 2.24 9.18 0.03 59 TooManyTo_002 11078 4.62 9.00 3.22 60 SpammyFromTLD_02 11000 2.34 8.94 0.24 61 LongTLD 10750 2.21 8.74 0.14 62 XM_H_Long_From01 10535 6.20 8.56 5.45 63 RCVD_IN_PSBL 10524 2.11 8.55 0.07 64 TooManyTo_003 10047 3.64 8.16 2.20 65 LOTS_OF_MONEY 10033 6.18 8.15 5.56 66 RCVD_IN_MSPIKE_H2 9947 10.64 8.08 11.46 67 T_XMDrugObfuBody_08 9733 2.67 7.91 1.01 68 BODY_URI_ONLY 9699 1.93 7.88 0.04 69 RCVD_IN_MSPIKE_BL 9514 2.41 7.73 0.72 70 XMNumbers 9211 4.32 7.48 3.32 71 URI_NOVOWEL 9101 2.05 7.40 0.35 72 XMSubMetaD_00 8533 1.71 6.93 0.05 73 TR_Mismatch_TLD_02 8530 1.72 6.93 0.07 74 BAYES_95 8359 3.22 6.79 2.08 75 XM_SPF_SoftFail 8335 2.64 6.77 1.33 76 TooManyTo_004 8314 2.76 6.76 1.48 77 SUBJ_BUY 8107 1.62 6.59 0.05 78 BOTNET_NORDNS 8080 1.60 6.57 0.02 79 T_HTML_TAG_BALANCE_CENTER 8030 1.63 6.52 0.08 80 PDS_FROM_2_EMAILS 8013 1.59 6.51 0.02 81 FROM_2_EMAILS_SHORT 7990 1.58 6.49 0.02 82 XMObfuSubjects 7838 1.55 6.37 0.02 83 XM_Evil_Numbers_Gen 7783 9.76 6.32 10.85 84 MIME_CHARSET_FARAWAY 7678 1.58 6.24 0.10 85 NO_DNS_FOR_FROM 7563 5.38 6.15 5.14 86 PDS_TO_EQ_FROM_NAME 7547 1.49 6.13 0.02 87 T_XMDrugObfuBody_00 7385 1.92 6.00 0.62 88 RCVD_IN_MSPIKE_L5 7288 1.60 5.92 0.23 89 XMGppyBdWords 7197 1.49 5.85 0.11 90 XM_BadFromFormat 6733 1.42 5.47 0.13 91 XMSubMetaD_01 6640 1.31 5.40 0.01 92 MPART_ALT_DIFF 6619 10.39 5.38 11.99 93 XM_UB99 6459 1.27 5.25 0.01 94 DRUGS_ERECTILE 6408 1.27 5.21 0.03 95 MIMEOLE_DIRECT_TO_MX 6299 1.24 5.12 0.01 96 XM_DIRTYINTL 6158 2.94 5.00 2.28 97 T_Symld_Words_02 5687 1.25 4.62 0.17 98 TooManyTo_005 5634 1.90 4.58 1.05 99 XMSexyCombo_01 5634 1.59 4.58 0.64 100 HTML_IMAGE_RATIO_08 5614 2.78 4.56 2.22 101 HTML_IMAGE_RATIO_04 5521 14.89 4.49 18.20 102 XM_B_SpammyTLD 5475 2.61 4.45 2.02 103 HDR_ORDER_FTSDMCXX_DIRECT 5363 1.06 4.36 0.01 104 HTML_IMAGE_ONLY_12 5243 1.13 4.26 0.13 105 PDS_BTC_ID 5207 1.04 4.23 0.02 106 XM_UB999 5190 1.02 4.22 0.01 107 LotsOfNums_01 5174 6.50 4.20 7.23 108 FUZZY_WALLET 5154 1.01 4.19 0.00 109 T_XMDrugObfuBody_14 5152 6.02 4.19 6.61 110 FUZZY_BTC_WALLET 5149 1.01 4.18 0.00 111 OBFU_BITCOIN 5149 1.01 4.18 0.00 112 FUZZY_BITCOIN 5149 1.01 4.18 0.00 113 MIME_HTML_MOSTLY 5068 2.76 4.12 2.33 114 BAYES_00 4951 21.25 4.02 26.72 115 T_XMDrugObfuBody_09 4924 0.98 4.00 0.02 116 XMStrtUSub 4872 9.51 3.96 11.28 117 DATE_IN_PAST_03_06 4860 1.02 3.95 0.09 118 DRUGS_ERECTILE_OBFU 4839 0.96 3.93 0.01 119 BITCOIN_DEADLINE 4828 0.95 3.92 0.00 120 BAYES_40 4791 4.78 3.89 5.06 121 BITCOIN_MALWARE 4776 0.94 3.88 0.00 122 XMSubMetaSSx_00 4770 1.03 3.88 0.12 123 FUZZY_PHARMACY 4695 0.93 3.81 0.01 124 DKIM_INVALID 4624 3.47 3.76 3.38 125 XM_SendGrid 4599 5.35 3.74 5.86 126 XMSpoofStaff2 4555 0.91 3.70 0.02 127 RELAYCOUNTRY_DE 4473 1.15 3.63 0.35 128 XMSexyCombo_04 4463 0.99 3.63 0.15 129 MISSING_HEADERS 4193 0.96 3.41 0.19 130 DOS_OE_TO_MX 4158 0.82 3.38 0.01 131 RELAYCOUNTRY_IN 4088 0.83 3.32 0.04 132 DATE_IN_FUTURE_06_12 3836 0.76 3.12 0.01 133 XM_B_Phish_Phrases 3715 5.47 3.02 6.24 134 FROM_EXCESS_BASE64 3691 3.56 3.00 3.73 135 XM_H_SpoofStaff4 3677 0.85 2.99 0.17 136 RELAYCOUNTRY_CN 3548 0.73 2.88 0.04 137 URI_ONLY_MSGID_MALF 3451 0.68 2.80 0.01 138 BAYES_20 3418 5.04 2.78 5.76 139 XMSubMetaSxObfu_03 3364 1.19 2.73 0.70 140 RELAYCOUNTRY_FR 3286 0.83 2.67 0.25 141 XM_UB60 3282 0.69 2.67 0.06 142 SUBJECT_DRUG_GAP_L 3280 0.65 2.67 0.01 143 XM_URI_RBL 3258 0.86 2.65 0.29 144 FUZZY_PRICES 3220 0.64 2.62 0.01 145 HK_RANDOM_FROM 3196 0.71 2.60 0.11 146 HTML_IMAGE_RATIO_06 3157 4.87 2.57 5.61 147 RELAYCOUNTRY_CA 3134 1.62 2.55 1.33 148 XMSubMetaD_02 3081 0.61 2.50 0.01 149 TVD_RCVD_IP 3080 2.63 2.50 2.67 150 SUSPICIOUS_RECIPS 3063 0.61 2.49 0.01 151 SUBJECT_DRUG_GAP_C 3052 0.60 2.48 0.01 152 SpammyFromTLD_01 3042 0.88 2.47 0.38 153 TO_EQ_FM_DIRECT_MX 2984 0.60 2.42 0.01 154 DOS_OUTLOOK_TO_MX 2981 0.59 2.42 0.01 155 RELAYCOUNTRY_FI 2971 0.59 2.41 0.01 156 MIME_HTML_ONLY_MULTI 2865 8.29 2.33 10.18 157 URIBL_RHS_DOB 2768 0.57 2.25 0.04 158 XMHTML_After_End 2756 1.04 2.24 0.66 159 BAYES_05 2746 3.63 2.23 4.07 160 RELAYCOUNTRY_GB 2722 0.94 2.21 0.54 161 CHARSET_FARAWAY_HEADER 2716 0.57 2.21 0.05 162 RCVD_IN_SORBS_DUL 2612 0.63 2.12 0.16 163 CK_HELO_DYNAMIC_SPLIT_IP 2607 2.17 2.12 2.19 164 MultiRelay_CC 2571 0.60 2.09 0.13 165 MultiRelay_Combo 2571 0.60 2.09 0.13 166 FROM_MISSP_REPLYTO 2569 0.51 2.09 0.00 167 SHORTENER_SHORT_IMG 2566 0.51 2.09 0.00 168 UNPARSEABLE_RELAY 2554 2.74 2.08 2.95 169 MIME_QP_LONG_LINE 2515 3.70 2.04 4.23 170 XM_CamelCaseFrm001 2495 2.21 2.03 2.27 171 DATE_IN_PAST_06_12 2399 0.51 1.95 0.05 172 SUBJ_ALL_CAPS 2374 1.26 1.93 1.04 173 TR_XM_DK_SendGrid 2362 2.92 1.92 3.24 174 URI_HEX 2275 1.33 1.85 1.16 175 TM2_M_URI_OPT_OUT 2264 3.14 1.84 3.55 176 RCVD_IN_MSPIKE_WL 2253 7.27 1.83 9.00 177 RCVD_IN_MSPIKE_H3 2250 7.25 1.83 8.98 178 XMSlimDrugH 2206 0.69 1.79 0.34 179 XM_UB80 2205 0.44 1.79 0.01 180 RELAYCOUNTRY_VN 2147 0.43 1.74 0.01 181 FUZZY_CPILL 2094 0.42 1.70 0.02 182 PDS_BTC_MSGID 2023 0.40 1.64 0.00 183 XMDiploma_00 2019 1.18 1.64 1.04 184 HDR_ORDER_FTSDMCXX_NORDNS 1962 0.39 1.59 0.00 185 INVALID_MSGID 1952 1.78 1.59 1.85 186 RELAYCOUNTRY_TW 1939 0.42 1.58 0.06 187 XMPhish11 1930 0.86 1.57 0.64 188 REPLYTO_WITHOUT_TO_CC 1918 0.39 1.56 0.02 189 HTML_IMAGE_ONLY_04 1858 0.40 1.51 0.05 190 IN_HORDE_ADDRESS_BOOK 1795 1.38 1.46 1.36 191 SUBJECT_NEEDS_ENCODING 1780 0.35 1.45 0.00 192 HELO_DYNAMIC_IPADDR2 1752 2.00 1.42 2.18 193 FVGT_m_MULTI_ODD_EMAIL 1748 0.36 1.42 0.03 194 HTML_FONT_SIZE_HUGE 1748 0.42 1.42 0.11 195 HELO_DYNAMIC_IPADDR 1744 0.35 1.42 0.02 196 XM_Lotto 1739 0.38 1.41 0.05 197 SUBJ_ILLEGAL_CHARS 1732 0.34 1.41 0.00 198 FROM_NTLD_LINKBAIT 1732 0.34 1.41 0.00 199 DATE_IN_FUTURE_03_06 1721 0.34 1.40 0.00 200 HTML_SHORT_CENTER 1720 0.34 1.40 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 349845 89.65 87.46 90.35 2 XM_B_Unicode 298895 73.39 61.45 77.19 3 DKIM_SIGNED 252699 60.25 44.49 65.26 4 XM_DK_Pass 249815 59.44 43.48 64.51 5 DKIM_VALID 239607 56.78 40.73 61.88 6 DCC_CHECK_NEGATIVE 206515 45.50 20.86 53.33 7 DKIM_VALID_AU 194260 45.60 31.24 50.17 8 XMListUnsubscribeExists 189795 45.76 35.53 49.01 9 XM_B_Unicode3 188379 44.02 29.44 48.65 10 DCC_CHECK 177054 53.37 77.43 45.72 11 BAYES_50 170584 42.74 38.62 44.05 12 HTML_FONT_LOW_CONTRAST 108311 25.84 19.14 27.97 13 MIME_HTML_ONLY 105306 30.90 42.57 27.20 14 BAYES_00 103475 21.25 4.02 26.72 15 LOC_TINY_FONT_1 95703 23.30 18.84 24.72 16 DKIM_VALID_EF 84233 19.93 14.20 21.75 17 T_KAM_HTML_FONT_INVALID 74394 19.53 20.54 19.21 18 HTML_IMAGE_RATIO_04 70469 14.89 4.49 18.20 19 FVGT_m_MULTI_ODD 68911 17.19 15.26 17.80 20 XMSubLong 68329 18.44 20.93 17.65 21 XM_H_Trusted_IP 67851 13.30 0.00 17.52 22 T_TM2_M_HEADER_IN_MSG 66145 15.74 11.53 17.08 23 HTML_FONT_FACE_BAD 57219 11.31 0.42 14.78 24 TR_XM_DK_Bayes 55766 11.24 1.29 14.40 25 TR_XM_DK_Bayes1 53670 10.79 1.14 13.86 26 ALL_TRUSTED 52969 12.86 10.27 13.68 27 XM_B_Unsub 50910 16.24 25.98 13.15 28 TR_XM_DK_Bayes2 50657 10.08 0.64 13.08 29 MultiRelay 49760 13.10 13.90 12.85 30 MPART_ALT_DIFF 46415 10.39 5.38 11.99 31 RCVD_IN_RP_SAFE 45239 9.18 1.32 11.68 32 XM_Multi_Part_URI 44417 11.20 10.36 11.47 33 RCVD_IN_MSPIKE_H2 44359 10.64 8.08 11.46 34 XM_Body_Dirty_Words 43924 12.97 18.10 11.34 35 XMStrtUSub 43674 9.51 3.96 11.28 36 XM_Evil_Numbers_Gen 42009 9.76 6.32 10.85 37 RCVD_IN_RP_CERTIFIED 40746 8.23 1.01 10.52 38 MIME_HTML_ONLY_MULTI 39419 8.29 2.33 10.18 39 HTML_IMAGE_RATIO_02 35454 9.39 10.11 9.16 40 RCVD_IN_MSPIKE_WL 34836 7.27 1.83 9.00 41 RCVD_IN_MSPIKE_H3 34768 7.25 1.83 8.98 42 XM_DKIMWhitelistDomains 31998 6.27 0.01 8.26 43 TooManyTo_001 30654 9.17 13.11 7.92 44 FSL_BULK_SIG 29776 12.15 26.20 7.69 45 XM_UncommonTLD01 28891 11.99 26.22 7.46 46 LotsOfNums_01 28003 6.50 4.20 7.23 47 T_REMOTE_IMAGE 25592 8.69 15.24 6.61 48 T_XMDrugObfuBody_14 25582 6.02 4.19 6.61 49 XM_DK_Undo_02 24730 10.06 21.64 6.39 50 XMSubNoVowel 24569 5.09 1.14 6.34 51 XM_B_Phish_Phrases 24180 5.47 3.02 6.24 52 XM_SendGrid 22696 5.35 3.74 5.86 53 BAYES_20 22310 5.04 2.78 5.76 54 HTML_IMAGE_RATIO_06 21705 4.87 2.57 5.61 55 LOTS_OF_MONEY 21517 6.18 8.15 5.56 56 XM_H_Long_From01 21092 6.20 8.56 5.45 57 BAYES_60 20240 6.19 9.22 5.23 58 XM_B_Unsub2 20099 6.60 11.05 5.19 59 BOTNET_IPINHOSTNAME 20025 11.11 29.79 5.17 60 NO_DNS_FOR_FROM 19902 5.38 6.15 5.14 61 BAYES_40 19590 4.78 3.89 5.06 62 T_TooManySym_01 17182 3.68 1.29 4.44 63 DKIM_ADSP_NXDOMAIN 17171 6.71 13.89 4.43 64 XMSexyCombo_05 16768 6.72 14.22 4.33 65 MIME_QP_LONG_LINE 16363 3.70 2.04 4.23 66 BAYES_05 15761 3.63 2.23 4.07 67 AC_FROM_MANY_DOTS 15623 3.07 0.04 4.03 68 RELAYCOUNTRY_META 15286 11.91 36.96 3.95 69 FROM_EXCESS_BASE64 14455 3.56 3.00 3.73 70 RCVD_IN_IADB_LISTED 14112 2.98 0.87 3.64 71 BAYES_99 13970 7.86 21.25 3.61 72 TM2_M_URI_OPT_OUT 13751 3.14 1.84 3.55 73 XMSubMetaSx_00 13364 5.04 10.04 3.45 74 DKIM_INVALID 13092 3.47 3.76 3.38 75 XMNumbers 12851 4.32 7.48 3.32 76 TR_XM_DK_SendGrid 12547 2.92 1.92 3.24 77 TooManyTo_002 12475 4.62 9.00 3.22 78 RCVD_IN_IADB_SPF 12294 2.59 0.75 3.17 79 BAYES_80 12032 4.98 10.87 3.11 80 BAYES_999 11417 5.90 15.17 2.95 81 UNPARSEABLE_RELAY 11410 2.74 2.08 2.95 82 RCVD_IN_IADB_SENDERID 10974 2.33 0.74 2.83 83 RCVD_IN_IADB_DK 10581 2.25 0.74 2.73 84 TVD_RCVD_IP 10341 2.63 2.50 2.67 85 IN_ZIMBRA_NJ_WHITELIST 10162 2.04 0.19 2.62 86 T_TooManySym_02 9608 1.96 0.30 2.48 87 MIME_HTML_MOSTLY 9020 2.76 4.12 2.33 88 RCVD_IN_IADB_VOUCHED 8861 1.80 0.28 2.29 89 XM_DIRTYINTL 8828 2.94 5.00 2.28 90 XM_CamelCaseFrm001 8783 2.21 2.03 2.27 91 XMSubLongNoVowel 8674 1.74 0.16 2.24 92 HTML_IMAGE_RATIO_08 8586 2.78 4.56 2.22 93 TooManyTo_003 8535 3.64 8.16 2.20 94 CK_HELO_DYNAMIC_SPLIT_IP 8471 2.17 2.12 2.19 95 HELO_DYNAMIC_IPADDR2 8460 2.00 1.42 2.18 96 XMSubGarbage 8456 1.69 0.12 2.18 97 BAYES_95 8054 3.22 6.79 2.08 98 XM_B_SpammyTLD 7819 2.61 4.45 2.02 99 XM_PDF 7454 1.56 0.41 1.92 100 INVALID_MSGID 7155 1.78 1.59 1.85 101 TR_DCC_Bayes_99 7076 4.65 13.52 1.83 102 BOTNET 6823 11.36 41.56 1.76 103 XMBdyGiftCard01 6590 1.55 1.05 1.70 104 TO_MALFORMED 6558 1.46 0.71 1.69 105 XM_E_Blogspot 6196 1.23 0.07 1.60 106 MAILING_LIST_MULTI 6181 1.39 0.73 1.60 107 TooManyTo_004 5750 2.76 6.76 1.48 108 RCVD_IN_IADB_OPTIN 5580 1.13 0.16 1.44 109 USER_IN_DEF_DKIM_WL 5260 1.04 0.02 1.36 110 IN_HORDE_ADDRESS_BOOK 5247 1.38 1.46 1.36 111 ANY_BOUNCE_MESSAGE 5224 1.20 0.71 1.35 112 BOUNCE_MESSAGE 5223 1.20 0.71 1.35 113 HTML_MIME_NO_HTML_TAG 5186 5.45 18.37 1.34 114 XM_SPF_SoftFail 5153 2.64 6.77 1.33 115 RELAYCOUNTRY_CA 5139 1.62 2.55 1.33 116 UNTRUSTED_Relay 5033 8.81 32.43 1.30 117 XMStockSpam_06 4843 1.18 0.97 1.25 118 KHOP_HELO_FCRDNS 4738 4.94 16.64 1.22 119 URI_HEX 4509 1.33 1.85 1.16 120 URI_TRY_3LD 4460 0.99 0.50 1.15 121 RCVD_IN_BL_SPAMCOP_NET 4421 4.79 16.26 1.14 122 XM_DK_Undo_01 4294 1.02 0.75 1.11 123 TM2_M_VERY_LONG_WORD 4257 1.09 1.05 1.10 124 XM_H_Long_From02 4247 1.10 1.10 1.10 125 TooManyTo_005 4082 1.90 4.58 1.05 126 SUBJ_ALL_CAPS 4038 1.26 1.93 1.04 127 XMDiploma_00 4009 1.18 1.64 1.04 128 T_XMDrugObfuBody_08 3892 2.67 7.91 1.01 129 DKIM_ADSP_CUSTOM_MED 3575 0.94 0.99 0.92 130 XM_OfRef6 3507 0.95 1.07 0.91 131 XMGappySubj_01 3502 0.73 0.18 0.90 132 XM_ProductURIs 3350 0.82 0.70 0.87 133 DIET_1 3308 0.89 1.01 0.85 134 XMBody_95 3196 0.64 0.07 0.83 135 XM_B_REG_HTML 3173 0.68 0.23 0.82 136 XM_GoogleGroups 3167 0.67 0.19 0.82 137 TR_XM_RelayPhish 3065 0.78 0.75 0.79 138 XM_SPF_Unknown 3030 0.86 1.11 0.78 139 T_FILL_THIS_FORM_SHORT 2871 0.65 0.37 0.74 140 RCVD_IN_MSPIKE_BL 2779 2.41 7.73 0.72 141 NML_ADSP_CUSTOM_MED 2706 0.75 0.90 0.70 142 XMSubMetaSxObfu_03 2697 1.19 2.73 0.70 143 TR_MetaPhish_Combo_01 2637 0.59 0.32 0.68 144 XMGenDplmaNmb 2566 0.77 1.10 0.66 145 XMHTML_After_End 2549 1.04 2.24 0.66 146 XM_UB50 2540 3.92 14.19 0.66 147 XMSexyCombo_01 2493 1.59 4.58 0.64 148 XMPhish11 2475 0.86 1.57 0.64 149 T_XMDrugObfuBody_00 2412 1.92 6.00 0.62 150 TR_Symld_Words 2410 0.79 1.32 0.62 151 XMBody_78 2390 0.61 0.60 0.62 152 XMHTMLBadTable_001 2326 0.56 0.45 0.60 153 XMBrknScrpt_02 2317 0.57 0.50 0.60 154 XMSubMetaI_00 2293 0.76 1.29 0.59 155 XMBody_17 2291 0.69 1.01 0.59 156 USER_IN_WHITELIST 2261 0.44 0.00 0.58 157 FORGED_GMAIL_RCVD 2229 0.64 0.86 0.58 158 T_XMHurry_00 2176 0.66 0.98 0.56 159 XM_RXBody 2151 0.51 0.35 0.56 160 RELAYCOUNTRY_GB 2087 0.94 2.21 0.54 161 XMPhish30 1990 0.56 0.72 0.51 162 XMSubMetaSxObfu_02 1832 0.39 0.14 0.47 163 XMBSHREFv2 1808 0.39 0.16 0.47 164 SUBJ_DOLLARS 1805 0.40 0.20 0.47 165 T_TooManySym_03 1645 0.34 0.07 0.42 166 TR_LOTS_OF_MONEY3 1590 0.41 0.39 0.41 167 HELO_NODOT 1587 0.45 0.59 0.41 168 HELO_NO_DOMAIN 1585 0.43 0.48 0.41 169 HTML_TAG_BALANCE_BODY 1568 0.41 0.41 0.40 170 PLING_QUERY 1555 0.38 0.31 0.40 171 T_MONEY_PERCENT 1554 0.45 0.58 0.40 172 TR_LOTS_OF_MONEY2 1554 0.45 0.58 0.40 173 XM_H_PHPMailer 1547 0.48 0.72 0.40 174 HTML_IMAGE_ONLY_20 1545 0.34 0.16 0.40 175 MPART_ALT_DIFF_COUNT 1506 0.40 0.44 0.39 176 XM_Body_Obfu01 1504 0.33 0.15 0.39 177 XM_B_COPY_HTML 1490 0.41 0.51 0.38 178 T_OBFU_PDF_ATTACH 1487 0.34 0.21 0.38 179 SpammyFromTLD_01 1456 0.88 2.47 0.38 180 NUMERIC_HTTP_ADDR 1421 0.34 0.27 0.37 181 TR_XM_PHPDW 1385 0.56 1.20 0.36 182 URI_NOVOWEL 1374 2.05 7.40 0.35 183 RELAYCOUNTRY_DE 1372 1.15 3.63 0.35 184 XMLngstWrd_00 1336 0.39 0.54 0.35 185 TR_XM_PHPForged 1323 0.54 1.17 0.34 186 FILL_THIS_FORM 1323 0.48 0.92 0.34 187 XMSlimDrugH 1315 0.69 1.79 0.34 188 TR_XM_FormFill2 1313 0.54 1.16 0.34 189 XM_shorewaves_Whitelist 1312 0.26 0.00 0.34 190 XM_H_PHPOS 1287 0.53 1.15 0.33 191 XMLngstWrd_01 1224 0.37 0.53 0.32 192 RDNS_DYNAMIC 1206 2.58 9.73 0.31 193 FSL_THIS_IS_ADV 1174 0.25 0.08 0.30 194 XMRcvdHeader_15 1166 0.23 0.00 0.30 195 RCVD_IN_MSPIKE_L3 1150 0.55 1.35 0.30 196 XMCapTrack 1138 0.27 0.20 0.29 197 XM_ShortIntro_01 1123 0.29 0.28 0.29 198 XMSolicitRefs_0 1112 0.28 0.24 0.29 199 T_TooManySym_04 1110 0.22 0.02 0.29 200 XM_URI_RBL 1105 0.86 2.65 0.29 ----------------------------------------------------------------------