Email: 646756 Autolearn: 0 AvgScore: 2.93 AvgScanTime: 3.72 sec Spam: 163406 Autolearn: 0 AvgScore: 15.56 AvgScanTime: 4.44 sec Ham: 483350 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 3.48 sec Time Spent Running SA: 668.99 hours Time Spent Processing Spam: 201.32 hours Time Spent Processing Ham: 467.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155576 90.34 95.21 88.69 2 DCC_CHECK 132577 51.62 81.13 41.64 3 XM_B_Unicode 103496 68.38 63.34 70.09 4 DKIM_SIGNED 89705 70.19 54.90 75.37 5 XM_DK_Pass 87399 68.95 53.49 74.18 6 MIME_HTML_ONLY 83387 28.82 51.03 21.31 7 DKIM_VALID 82029 65.52 50.20 70.70 8 XMListUnsubscribeExists 77259 49.85 47.28 50.71 9 BAYES_50 68276 50.63 41.78 53.62 10 DKIM_VALID_AU 61558 49.25 37.67 53.17 11 XM_B_Unicode3 57195 39.53 35.00 41.06 12 FSL_BULK_SIG 50156 12.69 30.69 6.60 13 RELAYCOUNTRY_META 46606 11.15 28.52 5.27 14 HTML_FONT_LOW_CONTRAST 44254 26.46 27.08 26.24 15 XM_UncommonTLD01 42643 9.51 26.10 3.90 16 XM_DK_Undo_02 41583 10.83 25.45 5.89 17 BOTNET 40735 7.76 24.93 1.96 18 XMSubLong 39658 21.69 24.27 20.82 19 LOC_TINY_FONT_1 38454 23.26 23.53 23.17 20 HTML_MIME_NO_HTML_TAG 35448 7.52 21.69 2.73 21 BAYES_99 35264 7.76 21.58 3.09 22 XM_Body_Dirty_Words 34015 15.59 20.82 13.82 23 BOTNET_IPINHOSTNAME 32710 8.33 20.02 4.38 24 KHOP_HELO_FCRDNS 31436 6.67 19.24 2.41 25 XM_B_Unsub 30329 14.12 18.56 12.62 26 UNTRUSTED_Relay 30211 5.71 18.49 1.40 27 T_TM2_M_HEADER_IN_MSG 30033 27.07 18.38 30.01 28 FVGT_m_MULTI_ODD 29141 19.42 17.83 19.96 29 T_KAM_HTML_FONT_INVALID 28540 18.73 17.47 19.16 30 DKIM_VALID_EF 28449 24.72 17.41 27.19 31 HTML_SHORT_LINK_IMG_1 27599 4.30 16.89 0.04 32 BAYES_999 27368 6.13 16.75 2.54 33 MultiRelay 27190 18.14 16.64 18.65 34 DCC_CHECK_NEGATIVE 26812 46.22 16.41 56.30 35 TR_DCC_Bayes_99 26437 5.02 16.18 1.25 36 XMSexyCombo_05 24574 7.18 15.04 4.52 37 RDNS_DYNAMIC 23895 3.97 14.62 0.37 38 RCVD_IN_BL_SPAMCOP_NET 21347 3.99 13.06 0.92 39 XM_SPF_SoftFail 21090 4.85 12.91 2.13 40 HTML_IMAGE_RATIO_02 20637 10.12 12.63 9.27 41 XM_Multi_Part_URI 20478 12.25 12.53 12.16 42 HTML_IMAGE_ONLY_08 20034 3.18 12.26 0.11 43 XM_H_Long_From01 18268 7.20 11.18 5.85 44 LOTS_OF_MONEY 18167 9.52 11.12 8.98 45 SpammyFromTLD_02 17911 2.99 10.96 0.30 46 RCVD_IN_RP_RNBL 17211 2.76 10.53 0.13 47 BAYES_80 16491 4.60 10.09 2.75 48 T_REMOTE_IMAGE 15719 5.46 9.62 4.05 49 XM_BadFromFormat 15279 2.44 9.35 0.10 50 XM_Evil_Numbers_Gen 15274 8.95 9.35 8.82 51 HTML_FONT_SIZE_LARGE 14250 2.31 8.72 0.15 52 XM_UB50 14181 2.79 8.68 0.79 53 XM_DIRTYINTL 13817 4.18 8.46 2.74 54 RCVD_IN_MSPIKE_H2 13472 10.55 8.24 11.33 55 BAYES_60 13402 6.12 8.20 5.41 56 FROM_SUSPICIOUS_NTLD 13365 2.10 8.18 0.04 57 XMNumbers 13358 4.66 8.17 3.48 58 TooManyTo_001 13227 8.99 8.09 9.29 59 XMSubMetaSx_00 13225 5.21 8.09 4.24 60 FROM_SUSPICIOUS_NTLD_FP 13207 2.07 8.08 0.04 61 RCVD_IN_MSPIKE_BL 12972 3.02 7.94 1.36 62 RCVD_IN_PSBL 12727 2.00 7.79 0.04 63 FROM_EXCESS_BASE64 12416 4.26 7.60 3.13 64 FROM_MISSP_REPLYTO 11861 1.84 7.26 0.00 65 HDRS_LCASE_IMGONLY 11479 1.80 7.02 0.03 66 URIBL_DBL_ABUSE_REDIR 11444 1.78 7.00 0.01 67 XM_CamelCaseFrm001 11285 3.34 6.91 2.14 68 HTML_EXTRA_CLOSE 11265 1.76 6.89 0.02 69 FROM_MISSP_DYNIP 11088 1.71 6.79 0.00 70 MIME_HEADER_CTYPE_ONLY 11082 1.77 6.78 0.08 71 XM_B_Phish_Phrases 10982 5.82 6.72 5.52 72 MPART_ALT_DIFF 10959 5.24 6.71 4.74 73 LotsOfNums_01 10551 7.81 6.46 8.26 74 BOTNET_NORDNS 10313 1.62 6.31 0.03 75 DKIM_ADSP_NXDOMAIN 9870 2.54 6.04 1.36 76 RCVD_IN_MSPIKE_L5 9308 1.60 5.70 0.21 77 TR_Mismatch_TLD_02 9240 1.50 5.65 0.10 78 HDRS_MISSP 9073 1.40 5.55 0.00 79 HTML_IMAGE_ONLY_12 8816 1.48 5.40 0.16 80 DIET_1 8563 1.70 5.24 0.50 81 XM_B_SpammyTLD 8456 2.68 5.17 1.84 82 XMSlimDrugH 8089 1.64 4.95 0.52 83 BODY_URI_ONLY 7903 1.28 4.84 0.07 84 DKIM_INVALID 7676 4.67 4.70 4.66 85 SHORT_IMG_SUSP_NTLD 7513 1.16 4.60 0.00 86 BAYES_40 7477 5.65 4.58 6.02 87 BAYES_95 7393 2.26 4.52 1.50 88 HTML_IMAGE_RATIO_04 7393 5.42 4.52 5.72 89 XM_B_Unsub2 7192 4.48 4.40 4.50 90 RELAYCOUNTRY_CA 7158 2.41 4.38 1.74 91 LongTLD 7090 1.22 4.34 0.16 92 XMWghtMeta_00 7084 1.11 4.34 0.01 93 REPLYTO_WITHOUT_TO_CC 6982 1.11 4.27 0.04 94 XM_SendGrid 6649 5.67 4.07 6.22 95 ALL_TRUSTED 6575 11.71 4.02 14.30 96 PDS_OTHER_BAD_TLD 6452 1.29 3.95 0.39 97 XMSlimDrugs 6165 0.98 3.77 0.04 98 TO_EQ_FM_DOM_HTML_IMG 6059 0.94 3.71 0.00 99 BAYES_00 5969 15.81 3.65 19.92 100 MIME_HTML_MOSTLY 5775 2.78 3.53 2.52 101 MIME_QP_LONG_LINE 5648 5.18 3.46 5.76 102 SpammyFromTLD_01 5593 1.33 3.42 0.63 103 TooManyTo_002 5568 3.05 3.41 2.93 104 BAYES_20 5281 4.29 3.23 4.65 105 HK_RANDOM_FROM 4996 0.86 3.06 0.12 106 RCVD_IN_MSPIKE_WL 4987 7.93 3.05 9.58 107 RCVD_IN_MSPIKE_H3 4987 7.93 3.05 9.58 108 TooManyTo_003 4960 2.21 3.04 1.94 109 XM_UB99 4955 0.77 3.03 0.00 110 RELAYCOUNTRY_FR 4882 0.97 2.99 0.29 111 XMDiploma_00 4785 2.04 2.93 1.74 112 RELAYCOUNTRY_GB 4740 1.59 2.90 1.15 113 NORDNS_LOW_CONTRAST 4696 0.73 2.87 0.01 114 DRUGS_ERECTILE 4670 0.73 2.86 0.01 115 MIME_HTML_ONLY_MULTI 4550 3.02 2.78 3.10 116 DATE_IN_PAST_03_06 4515 0.79 2.76 0.12 117 TR_XM_RelayPhish 4506 1.29 2.76 0.80 118 URI_NOVOWEL 4478 0.95 2.74 0.35 119 MultiRelay_Combo 4463 0.84 2.73 0.20 120 MultiRelay_CC 4463 0.84 2.73 0.20 121 TM2_M_URI_OPT_OUT 4425 2.24 2.71 2.09 122 XMClaimOffer 4273 0.78 2.61 0.16 123 NO_DNS_FOR_FROM 4267 2.15 2.61 1.99 124 NO_FM_NAME_IP_HOSTN 4246 0.66 2.60 0.00 125 BODY_SINGLE_WORD 4244 0.66 2.60 0.01 126 BODY_SINGLE_URI 4214 0.66 2.58 0.01 127 DKIM_ADSP_CUSTOM_MED 4180 1.40 2.56 1.00 128 T_TooManySym_01 4126 4.41 2.52 5.05 129 XMSubMetaD_00 4085 0.67 2.50 0.05 130 XMStrtUSub 4008 4.24 2.45 4.84 131 NML_ADSP_CUSTOM_MED 3954 1.16 2.42 0.74 132 XM_UB999 3953 0.61 2.42 0.00 133 TooManyTo_004 3908 1.66 2.39 1.41 134 XMGenDplmaNmb 3897 1.50 2.38 1.20 135 RELAYCOUNTRY_DE 3785 0.87 2.32 0.37 136 FVGT_m_MULTI_ODD_EMAIL 3750 0.60 2.29 0.02 137 UNPARSEABLE_RELAY 3598 2.17 2.20 2.16 138 XM_URI_RBL 3598 0.76 2.20 0.27 139 SUBJECT_NEEDS_ENCODING 3544 0.55 2.17 0.00 140 T_XMDrugObfuBody_08 3512 1.65 2.15 1.49 141 HTML_TAG_BALANCE_CENTER 3496 0.58 2.14 0.05 142 RELAYCOUNTRY_CN 3441 0.57 2.11 0.05 143 SUBJ_ILLEGAL_CHARS 3438 0.53 2.10 0.00 144 FORGED_GMAIL_RCVD 3417 0.89 2.09 0.48 145 FROM_NTLD_LINKBAIT 3402 0.53 2.08 0.00 146 HTML_IMAGE_RATIO_08 3348 2.03 2.05 2.02 147 BAYES_05 3326 2.53 2.04 2.69 148 HTML_IMAGE_RATIO_06 3294 3.18 2.02 3.57 149 XMSexyCombo_01 3286 1.15 2.01 0.85 150 SUBJ_ALL_CAPS 3082 1.71 1.89 1.65 151 TR_XM_DK_SendGrid 3044 2.80 1.86 3.12 152 XMBody_17 3010 1.00 1.84 0.72 153 CHARSET_FARAWAY_HEADER 2952 0.49 1.81 0.05 154 T_XMDrugObfuBody_14 2888 1.59 1.77 1.53 155 MIME_CHARSET_FARAWAY 2787 0.49 1.71 0.08 156 XMBdyGiftCard01 2778 1.32 1.70 1.19 157 RELAYCOUNTRY_RU 2754 0.44 1.69 0.01 158 TooManyTo_005 2688 1.23 1.64 1.09 159 XM_SPF_Unknown 2659 0.98 1.63 0.76 160 URI_HEX 2616 1.31 1.60 1.21 161 XM_OfRef6 2601 1.57 1.59 1.57 162 MIME_BASE64_TEXT 2489 0.44 1.52 0.08 163 TO_MALFORMED 2423 1.40 1.48 1.37 164 TR_XM_PHPDW 2396 0.72 1.47 0.47 165 TR_XM_PHPForged 2336 0.70 1.43 0.45 166 RCVD_IN_IADB_LISTED 2333 4.11 1.43 5.02 167 TR_XM_FormFill2 2329 0.70 1.43 0.45 168 RELAYCOUNTRY_FI 2325 0.38 1.42 0.03 169 XM_H_PHPOS 2318 0.69 1.42 0.44 170 DATE_IN_PAST_06_12 2285 0.41 1.40 0.07 171 XMPhish11 2226 1.08 1.36 0.99 172 FSL_THIS_IS_ADV 2195 0.51 1.34 0.23 173 SERGIO_SUBJECT_PORN014 2195 0.34 1.34 0.00 174 RCVD_IN_IADB_SPF 2193 3.57 1.34 4.33 175 XM_ProductURIs 2178 0.82 1.33 0.65 176 TVD_RCVD_SPACE_BRACKET 2158 0.34 1.32 0.00 177 TR_Symld_Words 2155 1.58 1.32 1.67 178 XMSubMetaI_00 2155 0.94 1.32 0.81 179 RCVD_IN_IADB_DK 2152 3.12 1.32 3.73 180 RCVD_IN_IADB_SENDERID 2151 3.17 1.32 3.80 181 XMStockSpam_06 2147 1.27 1.31 1.26 182 RCVD_IN_RP_SAFE 2133 4.18 1.31 5.16 183 MALF_HTML_B64 2122 0.34 1.30 0.01 184 TR_LOTS_OF_MONEY2 2103 0.79 1.29 0.62 185 T_MONEY_PERCENT 2103 0.79 1.29 0.62 186 TM2_M_VERY_LONG_WORD 2076 1.25 1.27 1.25 187 RCVD_IN_MSPIKE_L3 2025 0.92 1.24 0.81 188 URI_TRY_3LD 2015 1.21 1.23 1.20 189 XMSubMetaSxObfu_03 1982 0.89 1.21 0.78 190 XM_UB60 1961 0.35 1.20 0.06 191 HK_RANDOM_REPLYTO 1910 0.46 1.17 0.22 192 MISSING_HEADERS 1869 0.60 1.14 0.42 193 CHARSET_FARAWAY 1865 0.29 1.14 0.00 194 XMMoneyMeta_00 1862 0.64 1.14 0.48 195 INVALID_MSGID 1861 1.43 1.14 1.53 196 XM_Sft_Brands_C01 1859 0.34 1.14 0.07 197 TR_XM_INV_DKIM 1831 0.42 1.12 0.18 198 TR_XM_DK_Bayes 1822 11.08 1.12 14.44 199 XMSubMetaSSx_00 1787 0.47 1.09 0.26 200 RELAYCOUNTRY_IN 1774 0.34 1.09 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 428690 90.34 95.21 88.69 2 DKIM_SIGNED 364280 70.19 54.90 75.37 3 XM_DK_Pass 358557 68.95 53.49 74.18 4 DKIM_VALID 341750 65.52 50.20 70.70 5 XM_B_Unicode 338770 68.38 63.34 70.09 6 DCC_CHECK_NEGATIVE 272139 46.22 16.41 56.30 7 BAYES_50 259158 50.63 41.78 53.62 8 DKIM_VALID_AU 257001 49.25 37.67 53.17 9 XMListUnsubscribeExists 245121 49.85 47.28 50.71 10 DCC_CHECK 201290 51.62 81.13 41.64 11 XM_B_Unicode3 198456 39.53 35.00 41.06 12 T_TM2_M_HEADER_IN_MSG 145071 27.07 18.38 30.01 13 DKIM_VALID_EF 131444 24.72 17.41 27.19 14 HTML_FONT_LOW_CONTRAST 126848 26.46 27.08 26.24 15 LOC_TINY_FONT_1 112001 23.26 23.53 23.17 16 MIME_HTML_ONLY 103012 28.82 51.03 21.31 17 XMSubLong 100633 21.69 24.27 20.82 18 FVGT_m_MULTI_ODD 96453 19.42 17.83 19.96 19 BAYES_00 96262 15.81 3.65 19.92 20 T_KAM_HTML_FONT_INVALID 92598 18.73 17.47 19.16 21 MultiRelay 90157 18.14 16.64 18.65 22 TR_XM_DK_Bayes 69807 11.08 1.12 14.44 23 ALL_TRUSTED 69142 11.71 4.02 14.30 24 XM_Body_Dirty_Words 66786 15.59 20.82 13.82 25 TR_XM_DK_Bayes1 66582 10.55 1.00 13.78 26 XM_B_Unsub 61000 14.12 18.56 12.62 27 XM_Multi_Part_URI 58771 12.25 12.53 12.16 28 TR_XM_DK_Bayes2 58245 9.17 0.65 12.05 29 RCVD_IN_MSPIKE_H2 54775 10.55 8.24 11.33 30 RCVD_IN_MSPIKE_WL 46293 7.93 3.05 9.58 31 RCVD_IN_MSPIKE_H3 46291 7.93 3.05 9.58 32 TooManyTo_001 44920 8.99 8.09 9.29 33 HTML_IMAGE_RATIO_02 44809 10.12 12.63 9.27 34 LOTS_OF_MONEY 43401 9.52 11.12 8.98 35 XM_Evil_Numbers_Gen 42609 8.95 9.35 8.82 36 LotsOfNums_01 39936 7.81 6.46 8.26 37 XM_DKIMWhitelistDomains 36298 5.63 0.08 7.51 38 FSL_BULK_SIG 31910 12.69 30.69 6.60 39 XM_SendGrid 30043 5.67 4.07 6.22 40 BAYES_40 29089 5.65 4.58 6.02 41 XM_DK_Undo_02 28468 10.83 25.45 5.89 42 XM_H_Long_From01 28278 7.20 11.18 5.85 43 MIME_QP_LONG_LINE 27844 5.18 3.46 5.76 44 HTML_IMAGE_RATIO_04 27670 5.42 4.52 5.72 45 XM_B_Phish_Phrases 26670 5.82 6.72 5.52 46 BAYES_60 26173 6.12 8.20 5.41 47 RELAYCOUNTRY_META 25479 11.15 28.52 5.27 48 RCVD_IN_RP_SAFE 24921 4.18 1.31 5.16 49 T_TooManySym_01 24389 4.41 2.52 5.05 50 RCVD_IN_IADB_LISTED 24273 4.11 1.43 5.02 51 XMStrtUSub 23402 4.24 2.45 4.84 52 MPART_ALT_DIFF 22920 5.24 6.71 4.74 53 DKIM_INVALID 22530 4.67 4.70 4.66 54 XM_PDF 22483 3.61 0.52 4.65 55 BAYES_20 22455 4.29 3.23 4.65 56 RCVD_IN_RP_CERTIFIED 22444 3.72 0.99 4.64 57 XMSexyCombo_05 21838 7.18 15.04 4.52 58 XM_B_Unsub2 21759 4.48 4.40 4.50 59 BOTNET_IPINHOSTNAME 21175 8.33 20.02 4.38 60 RCVD_IN_IADB_SPF 20908 3.57 1.34 4.33 61 XMSubMetaSx_00 20488 5.21 8.09 4.24 62 T_REMOTE_IMAGE 19578 5.46 9.62 4.05 63 XM_UncommonTLD01 18848 9.51 26.10 3.90 64 RCVD_IN_IADB_SENDERID 18370 3.17 1.32 3.80 65 RCVD_IN_IADB_DK 18032 3.12 1.32 3.73 66 HTML_IMAGE_RATIO_06 17256 3.18 2.02 3.57 67 IN_ZIMBRA_NJ_WHITELIST 17123 2.65 0.02 3.54 68 XMNumbers 16802 4.66 8.17 3.48 69 RCVD_IN_IADB_VOUCHED 15610 2.51 0.39 3.23 70 FROM_EXCESS_BASE64 15140 4.26 7.60 3.13 71 TR_XM_DK_SendGrid 15087 2.80 1.86 3.12 72 MIME_HTML_ONLY_MULTI 14998 3.02 2.78 3.10 73 BAYES_99 14943 7.76 21.58 3.09 74 TooManyTo_002 14176 3.05 3.41 2.93 75 BAYES_80 13282 4.60 10.09 2.75 76 XM_DIRTYINTL 13224 4.18 8.46 2.74 77 HTML_MIME_NO_HTML_TAG 13206 7.52 21.69 2.73 78 BAYES_05 13005 2.53 2.04 2.69 79 XM_H_Trusted_IP 12866 1.99 0.00 2.66 80 BAYES_999 12284 6.13 16.75 2.54 81 MIME_HTML_MOSTLY 12180 2.78 3.53 2.52 82 KHOP_HELO_FCRDNS 11672 6.67 19.24 2.41 83 T_TooManySym_02 10868 1.95 1.07 2.25 84 MAILING_LIST_MULTI 10671 1.89 0.93 2.21 85 UNPARSEABLE_RELAY 10421 2.17 2.20 2.16 86 XM_CamelCaseFrm001 10346 3.34 6.91 2.14 87 XM_SPF_SoftFail 10272 4.85 12.91 2.13 88 TM2_M_URI_OPT_OUT 10080 2.24 2.71 2.09 89 TVD_RCVD_IP 9832 1.78 1.02 2.03 90 HTML_IMAGE_RATIO_08 9763 2.03 2.05 2.02 91 RCVD_IN_IADB_OPTIN 9686 1.56 0.25 2.00 92 NO_DNS_FOR_FROM 9615 2.15 2.61 1.99 93 BOTNET 9451 7.76 24.93 1.96 94 TooManyTo_003 9365 2.21 3.04 1.94 95 XM_B_SpammyTLD 8891 2.68 5.17 1.84 96 ANY_BOUNCE_MESSAGE 8728 1.45 0.38 1.81 97 BOUNCE_MESSAGE 8727 1.45 0.38 1.81 98 RELAYCOUNTRY_CA 8411 2.41 4.38 1.74 99 XMDiploma_00 8405 2.04 2.93 1.74 100 TR_Symld_Words 8053 1.58 1.32 1.67 101 SUBJ_ALL_CAPS 7999 1.71 1.89 1.65 102 XM_OfRef6 7584 1.57 1.59 1.57 103 HELO_NODOT 7508 1.31 0.59 1.55 104 HELO_NO_DOMAIN 7506 1.31 0.58 1.55 105 T_XMDrugObfuBody_14 7398 1.59 1.77 1.53 106 INVALID_MSGID 7397 1.43 1.14 1.53 107 XM_DK_Undo_01 7271 1.29 0.66 1.50 108 BAYES_95 7241 2.26 4.52 1.50 109 T_XMDrugObfuBody_08 7189 1.65 2.15 1.49 110 IN_HORDE_ADDRESS_BOOK 7147 1.11 0.02 1.48 111 XMGappySubj_01 6857 1.13 0.29 1.42 112 TooManyTo_004 6826 1.66 2.39 1.41 113 UNTRUSTED_Relay 6747 5.71 18.49 1.40 114 TO_MALFORMED 6604 1.40 1.48 1.37 115 DKIM_ADSP_NXDOMAIN 6558 2.54 6.04 1.36 116 RCVD_IN_MSPIKE_BL 6556 3.02 7.94 1.36 117 XMStockSpam_06 6074 1.27 1.31 1.26 118 TR_DCC_Bayes_99 6049 5.02 16.18 1.25 119 CK_HELO_DYNAMIC_SPLIT_IP 6042 1.20 1.07 1.25 120 HELO_DYNAMIC_IPADDR2 6040 1.04 0.43 1.25 121 TM2_M_VERY_LONG_WORD 6033 1.25 1.27 1.25 122 XMCapTrack 5964 0.99 0.26 1.23 123 URI_HEX 5830 1.31 1.60 1.21 124 XMGenDplmaNmb 5808 1.50 2.38 1.20 125 URI_TRY_3LD 5795 1.21 1.23 1.20 126 HTML_FONT_FACE_BAD 5729 1.04 0.61 1.19 127 XMBdyGiftCard01 5728 1.32 1.70 1.19 128 XM_H_Long_From02 5636 1.07 0.79 1.17 129 RELAYCOUNTRY_GB 5560 1.59 2.90 1.15 130 T_XMDrugObfuBody_00 5549 1.12 1.02 1.15 131 TooManyTo_005 5274 1.23 1.64 1.09 132 XM_GoogleGroups 5216 0.87 0.25 1.08 133 USER_IN_DEF_DKIM_WL 5149 0.80 0.01 1.07 134 DKIM_ADSP_CUSTOM_MED 4844 1.40 2.56 1.00 135 XMSubNoVowel 4799 0.97 0.91 0.99 136 XMPhish11 4773 1.08 1.36 0.99 137 T_FILL_THIS_FORM_SHORT 4577 0.92 0.82 0.95 138 PLING_QUERY 4488 0.93 0.95 0.93 139 AC_FROM_MANY_DOTS 4474 0.70 0.01 0.93 140 RCVD_IN_BL_SPAMCOP_NET 4461 3.99 13.06 0.92 141 TR_MetaPhish_Combo_01 4428 0.83 0.58 0.92 142 XMSexyCombo_01 4132 1.15 2.01 0.85 143 XMSubMetaI_00 3925 0.94 1.32 0.81 144 RCVD_IN_MSPIKE_L3 3904 0.92 1.24 0.81 145 TR_XM_RelayPhish 3860 1.29 2.76 0.80 146 XM_UB50 3834 2.79 8.68 0.79 147 XMHTML_After_End 3830 0.81 0.88 0.79 148 XMSubMetaSxObfu_03 3767 0.89 1.21 0.78 149 TM2_M_A_HREF_HREF 3742 0.73 0.61 0.77 150 XM_SPF_Unknown 3651 0.98 1.63 0.76 151 NML_ADSP_CUSTOM_MED 3554 1.16 2.42 0.74 152 XMBody_78 3513 0.72 0.70 0.73 153 XMBody_95 3482 0.58 0.18 0.72 154 XMBody_17 3458 1.00 1.84 0.72 155 FILL_THIS_FORM 3247 0.59 0.36 0.67 156 XM_ProductURIs 3148 0.82 1.33 0.65 157 T_OBFU_PDF_ATTACH 3113 0.52 0.15 0.64 158 SpammyFromTLD_01 3039 1.33 3.42 0.63 159 T_MONEY_PERCENT 3014 0.79 1.29 0.62 160 TR_LOTS_OF_MONEY2 3014 0.79 1.29 0.62 161 XMBrknScrpt_02 2725 0.60 0.70 0.56 162 T_XMHurry_00 2723 0.68 1.03 0.56 163 T_Symld_Words_02 2678 0.67 1.02 0.55 164 XM_ShortIntro_01 2650 0.50 0.36 0.55 165 USER_IN_WHITELIST 2634 0.41 0.00 0.54 166 HTTPS_HTTP_MISMATCH 2629 0.50 0.35 0.54 167 FILL_THIS_FORM_LONG 2625 0.49 0.32 0.54 168 T_FILL_THIS_FORM_LOAN 2568 0.41 0.07 0.53 169 XM_shorewaves_Whitelist 2567 0.40 0.00 0.53 170 XMSlimDrugH 2517 1.64 4.95 0.52 171 XMPhish30 2475 0.60 0.85 0.51 172 XMGappySubj_02 2456 0.40 0.07 0.51 173 HTML_IMAGE_ONLY_20 2417 0.44 0.26 0.50 174 XMNoVowels 2411 0.49 0.48 0.50 175 XMHTMLBadTable_001 2407 0.49 0.48 0.50 176 DIET_1 2406 1.70 5.24 0.50 177 T_TooManySym_03 2356 0.43 0.24 0.49 178 HTML_TAG_BALANCE_BODY 2352 0.52 0.61 0.49 179 FORGED_GMAIL_RCVD 2319 0.89 2.09 0.48 180 FROM_GOV_DKIM_AU 2319 0.40 0.15 0.48 181 XMMoneyMeta_00 2298 0.64 1.14 0.48 182 FROM_GOV_SPOOF 2293 0.41 0.20 0.47 183 TR_XM_PHPDW 2270 0.72 1.47 0.47 184 TR_XM_PHPForged 2190 0.70 1.43 0.45 185 TR_XM_FormFill2 2166 0.70 1.43 0.45 186 XM_H_PHPOS 2144 0.69 1.42 0.44 187 XM_H_PHPMailer 2140 0.53 0.81 0.44 188 HTML_IMAGE_ONLY_32 2136 0.37 0.15 0.44 189 REMOVE_BEFORE_LINK 2091 0.41 0.36 0.43 190 XMLngstWrd_00 2049 0.40 0.34 0.42 191 MISSING_HEADERS 2041 0.60 1.14 0.42 192 XM_B_REG_HTML 1991 0.58 1.08 0.41 193 XMhairloss01 1976 0.31 0.03 0.41 194 SHORT_HELO_AND_INLINE_IMAGE 1972 0.31 0.02 0.41 195 XMLngstWrd_01 1936 0.38 0.32 0.40 196 RCVD_IN_SORBS_DUL 1914 0.46 0.64 0.40 197 TM2_M_BODY_EMPTY 1912 0.31 0.06 0.40 198 T_MANY_PILL_PRICE 1903 0.29 0.00 0.39 199 THIS_AD 1903 0.49 0.78 0.39 200 PDS_OTHER_BAD_TLD 1901 1.29 3.95 0.39 ----------------------------------------------------------------------