Email: 358209 Autolearn: 0 AvgScore: 2.16 AvgScanTime: 2.13 sec Spam: 87945 Autolearn: 0 AvgScore: 14.73 AvgScanTime: 2.73 sec Ham: 270264 Autolearn: 0 AvgScore: -1.93 AvgScanTime: 1.93 sec Time Spent Running SA: 211.62 hours Time Spent Processing Spam: 66.69 hours Time Spent Processing Ham: 144.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77239 87.40 87.83 87.26 2 DCC_CHECK 69803 57.78 79.37 50.75 3 XM_B_Unicode 56341 71.57 64.06 74.01 4 DKIM_SIGNED 51454 75.27 58.51 80.73 5 XM_DK_Pass 48391 73.73 55.02 79.82 6 DKIM_VALID 44145 70.04 50.20 76.50 7 XMListUnsubscribeExists 42350 56.67 48.16 59.43 8 BAYES_50 37555 48.82 42.70 50.81 9 MIME_HTML_ONLY 36047 29.26 40.99 25.44 10 DKIM_VALID_AU 34690 57.77 39.45 63.73 11 XM_B_Unicode3 32314 45.25 36.74 48.02 12 RELAYCOUNTRY_META 30499 12.56 34.68 5.37 13 FSL_BULK_SIG 28805 13.76 32.75 7.59 14 XM_UncommonTLD01 28440 12.08 32.34 5.48 15 HTML_FONT_LOW_CONTRAST 26879 32.83 30.56 33.57 16 BOTNET 23075 8.04 26.24 2.12 17 XM_DK_Undo_02 23052 14.01 26.21 10.04 18 LOC_TINY_FONT_1 22152 30.79 25.19 32.61 19 UNTRUSTED_Relay 21025 7.06 23.91 1.57 20 MultiRelay 20239 17.75 23.01 16.04 21 XM_Body_Dirty_Words 19867 17.63 22.59 16.01 22 BAYES_99 19335 10.38 21.99 6.60 23 HTML_IMAGE_RATIO_02 17930 14.77 20.39 12.95 24 XMSubLong 17804 20.85 20.24 21.05 25 FVGT_m_MULTI_ODD 16614 20.79 18.89 21.41 26 DCC_CHECK_NEGATIVE 16449 40.75 18.70 47.92 27 RCVD_IN_BL_SPAMCOP_NET 15578 5.47 17.71 1.49 28 BAYES_999 15500 8.59 17.62 5.65 29 BOTNET_IPINHOSTNAME 15159 8.85 17.24 6.12 30 DKIM_VALID_EF 14770 25.21 16.79 27.94 31 TR_DCC_Bayes_99 14460 7.02 16.44 3.95 32 XM_B_Unsub 14088 11.35 16.02 9.83 33 T_TM2_M_HEADER_IN_MSG 13875 21.19 15.78 22.95 34 RCVD_IN_RP_RNBL 13643 3.89 15.51 0.10 35 XM_H_Long_From01 12696 8.53 14.44 6.61 36 XMSexyCombo_05 12558 8.26 14.28 6.30 37 KHOP_HELO_FCRDNS 12320 4.67 14.01 1.63 38 SpammyFromTLD_02 11846 3.44 13.47 0.17 39 T_KAM_HTML_FONT_INVALID 10905 15.30 12.40 16.25 40 XM_DIRTYINTL 10167 5.44 11.56 3.45 41 XM_Multi_Part_URI 10023 13.63 11.40 14.36 42 TR_Mismatch_TLD_02 9735 2.90 11.07 0.24 43 HTML_MIME_NO_HTML_TAG 9507 4.03 10.81 1.82 44 XM_UB50 9266 3.21 10.54 0.83 45 XM_B_SpammyTLD 9198 4.03 10.46 1.93 46 RCVD_IN_PSBL 9080 2.65 10.32 0.15 47 BAYES_60 8844 6.36 10.06 5.16 48 LOTS_OF_MONEY 8734 9.87 9.93 9.85 49 RDNS_DYNAMIC 8620 2.86 9.80 0.59 50 BOTNET_NORDNS 8446 2.37 9.60 0.02 51 RCVD_IN_MSPIKE_BL 8354 3.22 9.50 1.18 52 XM_SPF_SoftFail 8341 3.53 9.48 1.59 53 T_XMDrugObfuBody_14 8126 8.30 9.24 8.00 54 TooManyTo_001 7936 6.80 9.02 6.08 55 BAYES_80 7347 4.10 8.35 2.71 56 RCVD_IN_MSPIKE_H2 7346 9.33 8.35 9.65 57 DKIM_INVALID 7309 5.23 8.31 4.22 58 HTML_IMAGE_ONLY_12 7007 2.06 7.97 0.14 59 XM_Evil_Numbers_Gen 6847 9.78 7.79 10.43 60 XMSubMetaSx_00 6762 5.78 7.69 5.16 61 RCVD_IN_MSPIKE_L5 6703 2.00 7.62 0.17 62 HTML_SHORT_LINK_IMG_1 6463 1.84 7.35 0.05 63 T_REMOTE_IMAGE 6287 4.56 7.15 3.72 64 FROM_SUSPICIOUS_NTLD 6240 1.76 7.10 0.02 65 FROM_EXCESS_BASE64 6236 5.27 7.09 4.68 66 FROM_SUSPICIOUS_NTLD_FP 6198 1.74 7.05 0.01 67 XMNumbers 6004 5.40 6.83 4.94 68 MPART_ALT_DIFF 5970 5.72 6.79 5.37 69 XM_B_Phish_Phrases 4698 6.93 5.34 7.45 70 REPLYTO_WITHOUT_TO_CC 4357 1.28 4.95 0.09 71 HTML_IMAGE_RATIO_04 4271 7.58 4.86 8.46 72 XM_CamelCaseFrm001 4181 3.14 4.75 2.62 73 BAYES_40 4070 4.95 4.63 5.05 74 LotsOfNums_01 3958 6.85 4.50 7.61 75 MIME_HTML_MOSTLY 3861 3.87 4.39 3.69 76 MIME_HEADER_CTYPE_ONLY 3630 1.08 4.13 0.08 77 DATE_IN_PAST_06_12 3598 1.06 4.09 0.07 78 XMStrtUSub 3578 5.40 4.07 5.83 79 HDRS_LCASE_IMGONLY 3569 1.01 4.06 0.02 80 TO_EQ_FM_DOM_HTML_IMG 3540 0.99 4.03 0.00 81 XM_SendGrid 3514 6.13 4.00 6.82 82 RELAYCOUNTRY_CA 3427 2.69 3.90 2.29 83 MultiRelay_Combo 3361 1.05 3.82 0.14 84 MultiRelay_CC 3361 1.05 3.82 0.14 85 NORDNS_LOW_CONTRAST 3333 0.93 3.79 0.00 86 BAYES_95 3193 2.12 3.63 1.63 87 XM_H_TOP 3177 0.89 3.61 0.00 88 XM_UB99 3137 0.88 3.57 0.01 89 BAYES_20 2988 3.92 3.40 4.09 90 RELAYCOUNTRY_FR 2965 1.03 3.37 0.26 91 RELAYCOUNTRY_CN 2956 0.87 3.36 0.05 92 NO_DNS_FOR_FROM 2931 2.83 3.33 2.66 93 DIET_1 2864 1.61 3.26 1.07 94 HTML_IMAGE_RATIO_06 2717 3.67 3.09 3.86 95 MIME_HTML_ONLY_MULTI 2652 3.10 3.02 3.13 96 XM_UB999 2635 0.74 3.00 0.01 97 SpammyFromTLD_01 2577 1.05 2.93 0.44 98 RELAYCOUNTRY_NL 2547 0.93 2.90 0.29 99 XM_OfRef6 2543 1.63 2.89 1.22 100 BAYES_00 2525 16.67 2.87 21.16 101 UNPARSEABLE_RELAY 2469 3.71 2.81 4.00 102 CHARSET_FARAWAY_HEADER 2400 0.71 2.73 0.06 103 XM_UB60 2390 0.74 2.72 0.10 104 TM2_M_URI_OPT_OUT 2285 2.29 2.60 2.19 105 T_TooManySym_01 2249 5.14 2.56 5.98 106 MIME_CHARSET_FARAWAY 2248 0.75 2.56 0.16 107 SERGIO_SUBJECT_PORN014 2235 0.63 2.54 0.01 108 MISSING_MIMEOLE 2233 0.67 2.54 0.06 109 DKIM_ADSP_NXDOMAIN 2213 1.94 2.52 1.75 110 XMDiploma_00 2202 1.71 2.50 1.46 111 T_XMDrugObfuBody_08 2137 1.57 2.43 1.29 112 XM_UB80 2091 0.61 2.38 0.03 113 TVD_SPACE_RATIO_MINFP 2047 0.58 2.33 0.01 114 XMSlimDrugH 2024 0.92 2.30 0.47 115 MIME_QP_LONG_LINE 2006 3.88 2.28 4.41 116 RCVD_IN_MSPIKE_WL 1954 8.61 2.22 10.69 117 RCVD_IN_MSPIKE_H3 1945 8.60 2.21 10.68 118 XMBdyGiftCard01 1856 2.24 2.11 2.28 119 TR_XM_RelayPhish 1822 1.16 2.07 0.86 120 BAYES_05 1797 2.39 2.04 2.51 121 TR_XM_DK_SendGrid 1797 3.42 2.04 3.86 122 RELAYCOUNTRY_AE 1771 0.51 2.01 0.02 123 TVD_RCVD_SPACE_BRACKET 1718 0.48 1.95 0.00 124 XM_URI_RBL 1698 0.67 1.93 0.26 125 RCVD_IN_RP_SAFE 1677 11.30 1.91 14.36 126 RELAYCOUNTRY_IN 1656 0.50 1.88 0.05 127 LongTLD 1648 0.55 1.87 0.13 128 XMSexyCombo_01 1626 1.56 1.85 1.46 129 DATE_IN_PAST_03_06 1613 0.52 1.83 0.09 130 T_Symld_Words_02 1598 0.72 1.82 0.36 131 XMWghtMeta_00 1575 0.46 1.79 0.03 132 RELAYCOUNTRY_TR 1563 0.45 1.78 0.02 133 RELAYCOUNTRY_GB 1550 0.83 1.76 0.53 134 XMSlimDrugs 1542 0.46 1.75 0.04 135 DKIM_ADSP_CUSTOM_MED 1524 1.30 1.73 1.16 136 RELAYCOUNTRY_RU 1500 0.44 1.71 0.03 137 HTML_IMAGE_RATIO_08 1460 2.45 1.66 2.70 138 XMGppyBdWords 1442 0.51 1.64 0.15 139 XMMoneyMeta_00 1441 0.59 1.64 0.25 140 XMGenDplmaNmb 1440 1.02 1.64 0.82 141 NML_ADSP_CUSTOM_MED 1435 1.03 1.63 0.83 142 XMSubMetaI_00 1412 1.17 1.61 1.03 143 RELAYCOUNTRY_DE 1400 0.68 1.59 0.38 144 TR_XM_INV_DKIM 1395 0.53 1.59 0.18 145 TR_XM_PHPDW 1356 0.75 1.54 0.50 146 SUBJ_ALL_CAPS 1346 1.32 1.53 1.25 147 TR_XM_PHPForged 1313 0.73 1.49 0.48 148 XM_B_Unsub2 1308 1.04 1.49 0.90 149 TR_XM_FormFill2 1303 0.72 1.48 0.47 150 XM_H_PHPOS 1297 0.71 1.47 0.47 151 HTML_SHORT_LINK_IMG_2 1288 0.39 1.46 0.05 152 ALL_TRUSTED 1258 9.84 1.43 12.58 153 TM2_M_VERY_LONG_WORD 1244 1.33 1.41 1.30 154 CHARSET_FARAWAY 1235 0.35 1.40 0.01 155 XMPhish11 1226 1.08 1.39 0.97 156 XMHTML_After_End 1216 1.91 1.38 2.08 157 FORGED_GMAIL_RCVD 1209 0.85 1.37 0.68 158 DATE_IN_FUTURE_06_12 1201 0.34 1.37 0.01 159 RELAYCOUNTRY_BR 1184 0.34 1.35 0.01 160 XM_H_PHPMailer 1183 0.73 1.35 0.53 161 T_XMHurry_00 1178 0.93 1.34 0.80 162 XMSubNoVowel 1165 1.36 1.32 1.38 163 XMSubMetaSx_01 1162 0.43 1.32 0.14 164 RELAYCOUNTRY_LT 1158 0.36 1.32 0.04 165 INVALID_MSGID 1156 2.37 1.31 2.72 166 FILL_THIS_FORM 1140 0.77 1.30 0.59 167 HK_RANDOM_REPLYTO 1134 0.43 1.29 0.15 168 SUBJECT_NEEDS_ENCODING 1124 0.32 1.28 0.01 169 XMSubject_09 1121 0.32 1.27 0.01 170 SUBJ_ILLEGAL_CHARS 1116 0.32 1.27 0.01 171 RCVD_IN_RP_CERTIFIED 1114 10.21 1.27 13.12 172 TR_Symld_Words 1111 1.23 1.26 1.22 173 XMStockSpam_06 1098 1.68 1.25 1.82 174 NO_MEDICAL 1097 0.31 1.25 0.00 175 FILL_THIS_FORM_LONG 1085 0.66 1.23 0.47 176 RCVD_IN_MSPIKE_L3 1064 0.90 1.21 0.80 177 URI_HEX 1063 1.11 1.21 1.08 178 RELAYCOUNTRY_UA 1043 0.29 1.19 0.00 179 XM_ProductURIs 1013 1.23 1.15 1.25 180 TVD_SPACE_ENCODED 1007 0.28 1.15 0.00 181 FROM_MISSP_REPLYTO 998 0.29 1.13 0.01 182 HELO_MISC_IP 984 0.28 1.12 0.00 183 XM_UB95 978 0.29 1.11 0.02 184 RELAYCOUNTRY_JP 965 0.29 1.10 0.02 185 RELAYCOUNTRY_VN 963 0.27 1.10 0.01 186 MONEY_BACK 961 0.41 1.09 0.19 187 URIBL_DBL_ABUSE_REDIR 959 0.28 1.09 0.02 188 KB_FORGED_MOZ4 956 0.27 1.09 0.00 189 TO_EQ_FM_DIRECT_MX 931 0.27 1.06 0.01 190 MSGID_SHORT 928 0.26 1.06 0.00 191 XMSexyCombo_04 921 1.04 1.05 1.03 192 DOS_RCVD_IP_TWICE_B 914 0.32 1.04 0.09 193 CK_HELO_DYNAMIC_SPLIT_IP 908 2.21 1.03 2.59 194 MAILING_LIST_MULTI 901 1.68 1.02 1.89 195 TR_XM_DK_Bayes 899 13.41 1.02 17.45 196 TVD_SPACE_RATIO 898 0.49 1.02 0.31 197 TooManyTo_002 893 1.26 1.02 1.34 198 URIBL_DBL_SPAM 888 0.28 1.01 0.05 199 FILL_THIS_FORM_LOAN 875 0.57 0.99 0.43 200 XM_H_Long_From02 868 1.14 0.99 1.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 235843 87.40 87.83 87.26 2 DKIM_SIGNED 218173 75.27 58.51 80.73 3 XM_DK_Pass 215713 73.73 55.02 79.82 4 DKIM_VALID 206761 70.04 50.20 76.50 5 XM_B_Unicode 200032 71.57 64.06 74.01 6 DKIM_VALID_AU 172240 57.77 39.45 63.73 7 XMListUnsubscribeExists 160631 56.67 48.16 59.43 8 BAYES_50 137322 48.82 42.70 50.81 9 DCC_CHECK 137169 57.78 79.37 50.75 10 XM_B_Unicode3 129791 45.25 36.74 48.02 11 DCC_CHECK_NEGATIVE 129506 40.75 18.70 47.92 12 HTML_FONT_LOW_CONTRAST 90722 32.83 30.56 33.57 13 LOC_TINY_FONT_1 88143 30.79 25.19 32.61 14 DKIM_VALID_EF 75520 25.21 16.79 27.94 15 MIME_HTML_ONLY 68756 29.26 40.99 25.44 16 T_TM2_M_HEADER_IN_MSG 62020 21.19 15.78 22.95 17 FVGT_m_MULTI_ODD 57863 20.79 18.89 21.41 18 BAYES_00 57181 16.67 2.87 21.16 19 XMSubLong 56888 20.85 20.24 21.05 20 TR_XM_DK_Bayes 47150 13.41 1.02 17.45 21 TR_XM_DK_Bayes1 45312 12.86 0.86 16.77 22 T_KAM_HTML_FONT_INVALID 43918 15.30 12.40 16.25 23 MultiRelay 43343 17.75 23.01 16.04 24 XM_Body_Dirty_Words 43276 17.63 22.59 16.01 25 TR_XM_DK_Bayes2 43105 12.22 0.76 15.95 26 XM_Multi_Part_URI 38818 13.63 11.40 14.36 27 RCVD_IN_RP_SAFE 38808 11.30 1.91 14.36 28 RCVD_IN_RP_CERTIFIED 35457 10.21 1.27 13.12 29 HTML_IMAGE_RATIO_02 34991 14.77 20.39 12.95 30 ALL_TRUSTED 33989 9.84 1.43 12.58 31 XM_DKIMWhitelistDomains 30444 8.52 0.07 11.26 32 RCVD_IN_MSPIKE_WL 28904 8.61 2.22 10.69 33 RCVD_IN_MSPIKE_H3 28857 8.60 2.21 10.68 34 XM_Evil_Numbers_Gen 28195 9.78 7.79 10.43 35 XM_DK_Undo_02 27123 14.01 26.21 10.04 36 LOTS_OF_MONEY 26622 9.87 9.93 9.85 37 XM_B_Unsub 26562 11.35 16.02 9.83 38 RCVD_IN_MSPIKE_H2 26089 9.33 8.35 9.65 39 HTML_IMAGE_RATIO_04 22869 7.58 4.86 8.46 40 T_XMDrugObfuBody_14 21609 8.30 9.24 8.00 41 LotsOfNums_01 20563 6.85 4.50 7.61 42 FSL_BULK_SIG 20501 13.76 32.75 7.59 43 XM_B_Phish_Phrases 20137 6.93 5.34 7.45 44 XM_SendGrid 18433 6.13 4.00 6.82 45 XM_H_Long_From01 17875 8.53 14.44 6.61 46 BAYES_99 17838 10.38 21.99 6.60 47 XMSexyCombo_05 17036 8.26 14.28 6.30 48 BOTNET_IPINHOSTNAME 16553 8.85 17.24 6.12 49 TooManyTo_001 16440 6.80 9.02 6.08 50 T_TooManySym_01 16156 5.14 2.56 5.98 51 XMStrtUSub 15752 5.40 4.07 5.83 52 BAYES_999 15270 8.59 17.62 5.65 53 XM_UncommonTLD01 14819 12.08 32.34 5.48 54 MPART_ALT_DIFF 14515 5.72 6.79 5.37 55 RELAYCOUNTRY_META 14509 12.56 34.68 5.37 56 XMSubMetaSx_00 13941 5.78 7.69 5.16 57 BAYES_60 13936 6.36 10.06 5.16 58 BAYES_40 13656 4.95 4.63 5.05 59 XMNumbers 13340 5.40 6.83 4.94 60 FROM_EXCESS_BASE64 12642 5.27 7.09 4.68 61 MIME_QP_LONG_LINE 11908 3.88 2.28 4.41 62 DKIM_INVALID 11412 5.23 8.31 4.22 63 BAYES_20 11051 3.92 3.40 4.09 64 UNPARSEABLE_RELAY 10819 3.71 2.81 4.00 65 TR_DCC_Bayes_99 10680 7.02 16.44 3.95 66 TR_XM_DK_SendGrid 10437 3.42 2.04 3.86 67 HTML_IMAGE_RATIO_06 10426 3.67 3.09 3.86 68 T_REMOTE_IMAGE 10062 4.56 7.15 3.72 69 MIME_HTML_MOSTLY 9984 3.87 4.39 3.69 70 XM_DIRTYINTL 9332 5.44 11.56 3.45 71 T_TooManySym_02 9083 2.69 0.61 3.36 72 TVD_RCVD_IP 9017 2.71 0.80 3.34 73 RCVD_IN_IADB_LISTED 9006 2.71 0.81 3.33 74 IN_ZIMBRA_NJ_WHITELIST 8522 2.38 0.01 3.15 75 MIME_HTML_ONLY_MULTI 8454 3.10 3.02 3.13 76 RCVD_IN_IADB_SPF 7741 2.35 0.76 2.86 77 USER_IN_DEF_DKIM_WL 7388 2.07 0.01 2.73 78 INVALID_MSGID 7342 2.37 1.31 2.72 79 BAYES_80 7334 4.10 8.35 2.71 80 HTML_IMAGE_RATIO_08 7307 2.45 1.66 2.70 81 NO_DNS_FOR_FROM 7201 2.83 3.33 2.66 82 XM_CamelCaseFrm001 7069 3.14 4.75 2.62 83 CK_HELO_DYNAMIC_SPLIT_IP 7012 2.21 1.03 2.59 84 HELO_DYNAMIC_IPADDR2 7010 2.08 0.51 2.59 85 RCVD_IN_IADB_SENDERID 6817 2.09 0.75 2.52 86 BAYES_05 6781 2.39 2.04 2.51 87 RCVD_IN_IADB_DK 6616 2.03 0.75 2.45 88 TO_MALFORMED 6588 1.84 0.01 2.44 89 XM_H_Trusted_IP 6532 1.82 0.00 2.42 90 RELAYCOUNTRY_CA 6191 2.69 3.90 2.29 91 XMBdyGiftCard01 6173 2.24 2.11 2.28 92 TM2_M_URI_OPT_OUT 5909 2.29 2.60 2.19 93 RCVD_IN_IADB_VOUCHED 5756 1.65 0.19 2.13 94 BOTNET 5720 8.04 26.24 2.12 95 XMHTML_After_End 5618 1.91 1.38 2.08 96 XM_PDF 5354 1.56 0.25 1.98 97 XM_B_SpammyTLD 5222 4.03 10.46 1.93 98 MAILING_LIST_MULTI 5105 1.68 1.02 1.89 99 HTML_MIME_NO_HTML_TAG 4932 4.03 10.81 1.82 100 XMStockSpam_06 4913 1.68 1.25 1.82 101 DKIM_ADSP_NXDOMAIN 4721 1.94 2.52 1.75 102 IN_HORDE_ADDRESS_BOOK 4636 1.30 0.02 1.72 103 BAYES_95 4406 2.12 3.63 1.63 104 KHOP_HELO_FCRDNS 4397 4.67 14.01 1.63 105 XM_DK_Undo_01 4306 1.40 0.80 1.59 106 XM_SPF_SoftFail 4304 3.53 9.48 1.59 107 UNTRUSTED_Relay 4252 7.06 23.91 1.57 108 XMSubMetaSxObfu_03 4170 1.40 0.97 1.54 109 RCVD_IN_BL_SPAMCOP_NET 4030 5.47 17.71 1.49 110 ANY_BOUNCE_MESSAGE 4002 1.17 0.21 1.48 111 BOUNCE_MESSAGE 4000 1.17 0.21 1.48 112 XMSexyCombo_01 3945 1.56 1.85 1.46 113 XMDiploma_00 3940 1.71 2.50 1.46 114 XMSubNoVowel 3724 1.36 1.32 1.38 115 RCVD_IN_IADB_OPTIN 3660 1.08 0.24 1.35 116 TooManyTo_002 3629 1.26 1.02 1.34 117 TM2_M_VERY_LONG_WORD 3515 1.33 1.41 1.30 118 T_XMDrugObfuBody_08 3490 1.57 2.43 1.29 119 AC_FROM_MANY_DOTS 3476 0.98 0.02 1.29 120 URI_TRY_3LD 3468 1.13 0.67 1.28 121 XM_ProductURIs 3378 1.23 1.15 1.25 122 SUBJ_ALL_CAPS 3368 1.32 1.53 1.25 123 XM_OfRef6 3291 1.63 2.89 1.22 124 TR_Symld_Words 3287 1.23 1.26 1.22 125 XM_GoogleGroups 3225 0.98 0.34 1.19 126 XM_H_Long_From02 3221 1.14 0.99 1.19 127 XMGappySubj_01 3188 0.94 0.21 1.18 128 RCVD_IN_MSPIKE_BL 3185 3.22 9.50 1.18 129 DKIM_ADSP_CUSTOM_MED 3132 1.30 1.73 1.16 130 XM_B_REG_HTML 3084 0.95 0.37 1.14 131 URI_HEX 2915 1.11 1.21 1.08 132 DIET_1 2899 1.61 3.26 1.07 133 XMBody_95 2852 0.81 0.04 1.06 134 XMSexyCombo_04 2792 1.04 1.05 1.03 135 XMSubMetaI_00 2789 1.17 1.61 1.03 136 XMBody_17 2781 0.99 0.86 1.03 137 XMSubMetaSSx_00 2702 0.88 0.52 1.00 138 XMPhish11 2627 1.08 1.39 0.97 139 XMBrknScrpt_02 2564 0.83 0.47 0.95 140 TooManyTo_003 2512 0.91 0.84 0.93 141 T_FILL_THIS_FORM_SHORT 2508 0.90 0.83 0.93 142 HTML_FONT_FACE_BAD 2440 0.86 0.73 0.90 143 XM_B_Unsub2 2433 1.04 1.49 0.90 144 TR_XM_RelayPhish 2333 1.16 2.07 0.86 145 NML_ADSP_CUSTOM_MED 2256 1.03 1.63 0.83 146 XM_UB50 2240 3.21 10.54 0.83 147 XMGenDplmaNmb 2208 1.02 1.64 0.82 148 T_XMHurry_00 2165 0.93 1.34 0.80 149 RCVD_IN_MSPIKE_L3 2155 0.90 1.21 0.80 150 T_TooManySym_03 2078 0.62 0.17 0.77 151 USER_IN_WHITELIST 2060 0.58 0.00 0.76 152 TooManyTo_004 2010 0.72 0.63 0.74 153 TR_MetaPhish_Combo_01 1990 0.72 0.66 0.74 154 XMSubMetaSxObfu_02 1970 0.62 0.29 0.73 155 FORGED_GMAIL_RCVD 1849 0.85 1.37 0.68 156 T_XMDrugObfuBody_00 1753 0.62 0.53 0.65 157 XMPhish30 1748 0.69 0.83 0.65 158 TooManyTo_005 1740 0.62 0.53 0.64 159 HTML_TAG_BALANCE_BODY 1660 0.58 0.47 0.61 160 XMHTMLBadTable_001 1611 0.64 0.77 0.60 161 RDNS_DYNAMIC 1608 2.86 9.80 0.59 162 FILL_THIS_FORM 1601 0.77 1.30 0.59 163 XMUrgent 1548 0.46 0.12 0.57 164 HTML_IMAGE_ONLY_20 1527 0.47 0.17 0.57 165 XMBody_78 1515 0.55 0.51 0.56 166 XMSolicitRefs_0 1440 0.57 0.69 0.53 167 RELAYCOUNTRY_GB 1432 0.83 1.76 0.53 168 XM_H_PHPMailer 1430 0.73 1.35 0.53 169 THIS_AD 1423 0.52 0.49 0.53 170 PLING_QUERY 1394 0.59 0.81 0.52 171 XM_shorewaves_Whitelist 1361 0.38 0.00 0.50 172 TR_XM_PHPDW 1344 0.75 1.54 0.50 173 XM_B_COPY_HTML 1328 0.51 0.58 0.49 174 HELO_NODOT 1301 0.48 0.48 0.48 175 T_MONEY_PERCENT 1300 0.56 0.78 0.48 176 TR_LOTS_OF_MONEY2 1300 0.56 0.78 0.48 177 HELO_NO_DOMAIN 1293 0.48 0.47 0.48 178 TR_XM_PHPForged 1292 0.73 1.49 0.48 179 XMCapTrack 1281 0.40 0.18 0.47 180 TR_XM_FormFill2 1277 0.72 1.48 0.47 181 FILL_THIS_FORM_LONG 1269 0.66 1.23 0.47 182 XMSlimDrugH 1267 0.92 2.30 0.47 183 XM_H_PHPOS 1261 0.71 1.47 0.47 184 XM_Body_Obfu01 1248 0.38 0.12 0.46 185 MPART_ALT_DIFF_COUNT 1247 0.51 0.67 0.46 186 SUBJ_DOLLARS 1193 0.39 0.25 0.44 187 XM_SPF_Unknown 1185 0.52 0.78 0.44 188 SpammyFromTLD_01 1182 1.05 2.93 0.44 189 XMNoVowels 1176 0.40 0.29 0.44 190 FILL_THIS_FORM_LOAN 1169 0.57 0.99 0.43 191 TM2_M_A_HREF_HREF 1131 0.50 0.76 0.42 192 T_TooManySym_04 1117 0.32 0.03 0.41 193 FSL_HELO_FAKE 1094 0.42 0.45 0.40 194 XMRcvdHeader_15 1089 0.30 0.00 0.40 195 MISSING_HEADERS 1089 0.48 0.72 0.40 196 RELAYCOUNTRY_DE 1028 0.68 1.59 0.38 197 XM_RXBody 1021 0.38 0.38 0.38 198 T_Symld_Words_02 984 0.72 1.82 0.36 199 XMBSHREFv2 973 0.36 0.38 0.36 200 FSL_THIS_IS_ADV 944 0.29 0.13 0.35 ----------------------------------------------------------------------