Email: 695835 Autolearn: 0 AvgScore: 0.26 AvgScanTime: 1.98 sec Spam: 117774 Autolearn: 0 AvgScore: 13.23 AvgScanTime: 2.63 sec Ham: 578061 Autolearn: 0 AvgScore: -2.39 AvgScanTime: 1.84 sec Time Spent Running SA: 382.11 hours Time Spent Processing Spam: 86.20 hours Time Spent Processing Ham: 295.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 111387 91.30 94.58 90.63 2 DCC_CHECK 94355 48.58 80.12 42.15 3 XM_B_Unicode 85871 73.57 72.91 73.70 4 DKIM_SIGNED 81603 67.66 69.29 67.33 5 XM_DK_Pass 78337 66.20 66.51 66.14 6 DKIM_VALID 73902 63.04 62.75 63.09 7 XMListUnsubscribeExists 68327 48.17 58.02 46.16 8 BAYES_50 60460 50.04 51.34 49.78 9 DKIM_VALID_AU 54703 47.98 46.45 48.30 10 XM_B_Unicode3 49187 41.88 41.76 41.90 11 MIME_HTML_ONLY 46240 24.75 39.26 21.80 12 XM_DK_Undo_02 36198 10.22 30.74 6.04 13 HTML_FONT_LOW_CONTRAST 35117 25.86 29.82 25.06 14 LOC_TINY_FONT_1 31651 21.97 26.87 20.97 15 XM_Body_Dirty_Words 29484 17.41 25.03 15.86 16 XMSubLong 28916 20.76 24.55 19.99 17 DKIM_VALID_EF 28147 23.78 23.90 23.75 18 T_KAM_HTML_FONT_INVALID 27933 20.33 23.72 19.64 19 RELAYCOUNTRY_META 27005 8.07 22.93 5.04 20 FVGT_m_MULTI_ODD 26873 19.62 22.82 18.97 21 BOTNET 25947 5.39 22.03 2.00 22 BAYES_99 25516 6.03 21.67 2.85 23 XM_UncommonTLD01 25421 8.09 21.58 5.34 24 XM_B_Unsub 23557 14.49 20.00 13.36 25 BOTNET_IPINHOSTNAME 23341 6.71 19.82 4.03 26 FSL_BULK_SIG 22715 9.30 19.29 7.27 27 MultiRelay 22320 16.95 18.95 16.55 28 DCC_CHECK_NEGATIVE 21577 49.64 18.32 56.02 29 T_TM2_M_HEADER_IN_MSG 21002 24.40 17.83 25.74 30 XM_Multi_Part_URI 20795 11.88 17.66 10.70 31 TR_DCC_Bayes_99 19158 3.89 16.27 1.37 32 BAYES_999 18745 4.56 15.92 2.25 33 UNTRUSTED_Relay 16485 3.57 14.00 1.45 34 SpammyFromTLD_02 16196 2.59 13.75 0.32 35 LOTS_OF_MONEY 14582 8.99 12.38 8.29 36 RCVD_IN_MSPIKE_H2 13922 11.23 11.82 11.10 37 XMSexyCombo_05 13331 5.00 11.32 3.71 38 HTML_IMAGE_RATIO_02 12984 7.64 11.02 6.95 39 HTML_SHORT_LINK_IMG_1 12140 1.77 10.31 0.02 40 XM_Evil_Numbers_Gen 12027 8.96 10.21 8.70 41 T_REMOTE_IMAGE 11977 6.21 10.17 5.41 42 TooManyTo_001 11731 10.32 9.96 10.39 43 XMSubMetaSx_00 10268 4.22 8.72 3.31 44 XM_UB50 10247 2.14 8.70 0.81 45 HTML_MIME_NO_HTML_TAG 10049 3.13 8.53 2.03 46 KHOP_HELO_FCRDNS 9929 2.90 8.43 1.77 47 XMNumbers 9491 3.85 8.06 3.00 48 MPART_ALT_DIFF 9326 7.91 7.92 7.90 49 XM_DIRTYINTL 9257 3.48 7.86 2.59 50 LotsOfNums_01 8764 6.95 7.44 6.85 51 XM_B_Unsub2 8319 6.44 7.06 6.31 52 BAYES_80 8311 2.97 7.06 2.14 53 RCVD_IN_BL_SPAMCOP_NET 7856 2.16 6.67 1.25 54 FROM_SUSPICIOUS_NTLD 7793 1.16 6.62 0.05 55 XM_H_Long_From01 7786 5.63 6.61 5.42 56 FROM_SUSPICIOUS_NTLD_FP 7772 1.15 6.60 0.05 57 DKIM_INVALID 7701 4.63 6.54 4.24 58 HDRS_LCASE_IMGONLY 7570 1.10 6.43 0.01 59 MIME_HEADER_CTYPE_ONLY 7555 1.22 6.41 0.16 60 XM_B_Phish_Phrases 7479 5.40 6.35 5.21 61 BAYES_60 7316 4.73 6.21 4.43 62 BODY_URI_ONLY 7296 1.11 6.19 0.07 63 DKIM_ADSP_NXDOMAIN 7234 3.33 6.14 2.76 64 ALL_TRUSTED 6946 14.00 5.90 15.65 65 HTML_IMAGE_ONLY_08 6743 1.05 5.73 0.10 66 XM_B_SpammyTLD 6687 2.80 5.68 2.21 67 HTML_IMAGE_RATIO_04 6215 11.97 5.28 13.33 68 XM_SPF_SoftFail 5930 2.40 5.04 1.86 69 TooManyTo_002 5928 4.49 5.03 4.38 70 XM_CamelCaseFrm001 5853 2.49 4.97 1.99 71 SHORT_IMG_SUSP_NTLD 5842 0.84 4.96 0.00 72 TooManyTo_003 5435 3.39 4.61 3.14 73 RELAYCOUNTRY_CA 5350 2.08 4.54 1.58 74 FROM_EXCESS_BASE64 5344 3.31 4.54 3.06 75 RCVD_IN_RP_RNBL 5117 0.83 4.34 0.12 76 REPLYTO_WITHOUT_TO_CC 5044 0.77 4.28 0.06 77 XM_SendGrid 5035 5.21 4.28 5.40 78 TooManyTo_004 4939 2.53 4.19 2.19 79 HTML_IMAGE_RATIO_06 4936 4.06 4.19 4.03 80 XMStrtUSub 4920 8.18 4.18 9.00 81 MIME_HTML_MOSTLY 4896 2.87 4.16 2.61 82 RDNS_DYNAMIC 4896 0.91 4.16 0.25 83 MIME_HTML_ONLY_MULTI 4883 5.70 4.15 6.02 84 RCVD_IN_MSPIKE_BL 4867 1.52 4.13 0.99 85 MIME_QP_LONG_LINE 4830 4.73 4.10 4.86 86 TM2_M_URI_OPT_OUT 4747 2.20 4.03 1.83 87 BAYES_95 4682 1.69 3.98 1.23 88 TO_EQ_FM_DOM_HTML_IMG 4566 0.66 3.88 0.01 89 HDRS_MISSP 4366 0.63 3.71 0.01 90 SpammyFromTLD_01 4349 1.20 3.69 0.69 91 HTML_IMAGE_ONLY_12 4150 0.73 3.52 0.16 92 XM_URI_RBL 4125 0.82 3.50 0.27 93 BODY_SINGLE_WORD 4075 0.59 3.46 0.01 94 BODY_SINGLE_URI 4072 0.59 3.46 0.01 95 RELAYCOUNTRY_DE 4070 0.97 3.46 0.47 96 RCVD_IN_MSPIKE_WL 4009 7.59 3.40 8.44 97 RCVD_IN_MSPIKE_H3 4009 7.59 3.40 8.44 98 BAYES_40 3941 5.51 3.35 5.95 99 XMSexyCombo_01 3926 1.05 3.33 0.59 100 T_XMDrugObfuBody_08 3804 1.82 3.23 1.53 101 TooManyTo_005 3757 1.84 3.19 1.56 102 HTML_TAG_BALANCE_CENTER 3735 0.61 3.17 0.09 103 DIET_1 3611 0.84 3.07 0.39 104 MultiRelay_CC 3570 0.65 3.03 0.16 105 MultiRelay_Combo 3570 0.65 3.03 0.16 106 XM_BadFromFormat 3462 0.59 2.94 0.11 107 RELAYCOUNTRY_GB 3430 1.37 2.91 1.05 108 BOTNET_NORDNS 3394 0.54 2.88 0.06 109 RCVD_IN_PSBL 3337 0.48 2.83 0.00 110 RELAYCOUNTRY_FR 3310 0.76 2.81 0.34 111 HTML_FONT_SIZE_LARGE 3295 0.58 2.80 0.13 112 XMStockSpam_06 3137 1.30 2.66 1.03 113 BAYES_20 3117 5.23 2.65 5.76 114 URI_HEX 3110 1.57 2.64 1.35 115 HTML_IMAGE_RATIO_08 3051 2.40 2.59 2.36 116 TO_MALFORMED 2962 1.37 2.51 1.14 117 T_TooManySym_01 2860 3.78 2.43 4.06 118 XMDiploma_00 2858 1.68 2.43 1.53 119 NO_DNS_FOR_FROM 2815 3.19 2.39 3.35 120 XM_OfRef6 2763 1.35 2.35 1.15 121 PDS_OTHER_BAD_TLD 2732 0.75 2.32 0.43 122 NORDNS_LOW_CONTRAST 2669 0.39 2.27 0.01 123 URI_NOVOWEL 2496 0.68 2.12 0.38 124 FROM_NTLD_LINKBAIT 2482 0.36 2.11 0.00 125 SUSPICIOUS_RECIPS 2454 0.36 2.08 0.01 126 TR_XM_PHPDW 2421 0.76 2.06 0.50 127 TR_XM_DK_SendGrid 2392 3.05 2.03 3.26 128 BAYES_00 2387 19.94 2.03 23.60 129 RCVD_IN_MSPIKE_L3 2370 0.83 2.01 0.59 130 TR_XM_PHPForged 2365 0.74 2.01 0.49 131 TR_XM_FormFill2 2346 0.74 1.99 0.48 132 TR_LOTS_OF_MONEY3 2342 0.76 1.99 0.51 133 XM_H_PHPOS 2339 0.73 1.99 0.48 134 DATE_IN_PAST_03_06 2336 0.43 1.98 0.11 135 URIBL_SBL_A 2336 0.63 1.98 0.36 136 XMSlimDrugH 2279 0.62 1.94 0.35 137 RCVD_IN_IADB_LISTED 2256 3.82 1.92 4.21 138 XMBody_17 2229 0.91 1.89 0.70 139 TR_XM_RelayPhish 2219 0.98 1.88 0.79 140 TR_XM_INV_DKIM 2086 0.39 1.77 0.11 141 RCVD_IN_IADB_SPF 2082 3.32 1.77 3.63 142 TM2_M_VERY_LONG_WORD 2065 1.26 1.75 1.16 143 RCVD_IN_IADB_DK 2046 2.86 1.74 3.09 144 RCVD_IN_IADB_SENDERID 2044 2.91 1.74 3.15 145 HK_RANDOM_REPLYTO 2015 0.46 1.71 0.20 146 XMGenDplmaNmb 2001 1.07 1.70 0.94 147 XMHTML_After_End 1969 0.90 1.67 0.74 148 DATE_IN_PAST_06_12 1956 0.33 1.66 0.06 149 RELAYCOUNTRY_IN 1863 0.37 1.58 0.12 150 TR_Symld_Words 1849 1.41 1.57 1.38 151 XMSexyCombo_04 1840 0.36 1.56 0.11 152 SUBJ_ALL_CAPS 1780 1.49 1.51 1.49 153 XMMoneyMeta_00 1752 0.57 1.49 0.38 154 TR_XM_DK_Bayes 1736 12.17 1.47 14.35 155 XM_ProductURIs 1726 0.74 1.47 0.60 156 XM_Combo_Sbj 1707 0.54 1.45 0.36 157 BAYES_05 1686 3.57 1.43 4.00 158 URIBL_DBL_ABUSE_REDIR 1681 0.26 1.43 0.03 159 RCVD_IN_RP_SAFE 1672 7.19 1.42 8.37 160 MAILING_LIST_MULTI 1670 2.10 1.42 2.24 161 FVGT_m_MULTI_ODD_EMAIL 1649 0.26 1.40 0.02 162 URI_TRY_3LD 1636 1.21 1.39 1.17 163 HTML_IMAGE_ONLY_04 1629 0.27 1.38 0.04 164 XMPhish11 1623 1.09 1.38 1.03 165 XM_UB60 1613 0.28 1.37 0.06 166 HK_RANDOM_FROM 1610 0.35 1.37 0.14 167 T_XMDrugObfuBody_14 1604 1.31 1.36 1.29 168 HTML_SHORT_CENTER 1601 0.23 1.36 0.00 169 T_XMDrugObfuBody_00 1592 0.81 1.35 0.70 170 XMClaimOffer 1560 0.30 1.32 0.09 171 XMSubMetaI_00 1556 0.83 1.32 0.73 172 XMSubMetaSSx_00 1555 0.37 1.32 0.18 173 TR_XM_DK_Bayes1 1538 11.62 1.31 13.72 174 T_FILL_THIS_FORM_SHORT 1516 0.99 1.29 0.93 175 XM_H_PHPMailer 1463 0.58 1.24 0.44 176 LongTLD 1444 0.37 1.23 0.19 177 TR_Mismatch_TLD_02 1433 0.25 1.22 0.06 178 RCVD_IN_RP_CERTIFIED 1404 6.54 1.19 7.63 179 RCVD_IN_MSPIKE_L5 1377 0.30 1.17 0.12 180 T_MONEY_PERCENT 1332 0.51 1.13 0.38 181 TR_LOTS_OF_MONEY2 1332 0.51 1.13 0.38 182 DKIM_ADSP_CUSTOM_MED 1327 0.87 1.13 0.82 183 HTML_FONT_FACE_BAD 1325 8.42 1.13 9.90 184 XM_SPF_Unknown 1320 0.67 1.12 0.58 185 XM_H_PHPOS_M 1218 0.30 1.03 0.16 186 XM_DK_Undo_01 1190 1.35 1.01 1.42 187 T_XMHurry_00 1187 0.62 1.01 0.54 188 URI_NO_WWW_INFO_CGI 1187 0.22 1.01 0.06 189 XMBrknScrpt_02 1187 0.85 1.01 0.82 190 HTML_IMAGE_ONLY_24 1148 0.43 0.97 0.32 191 XMWghtMeta_00 1133 0.18 0.96 0.02 192 XM_H_Long_From02 1131 1.00 0.96 1.01 193 PLING_QUERY 1128 0.67 0.96 0.61 194 XMMoneyMeta_01 1121 0.19 0.95 0.03 195 RCVD_IN_MSPIKE_L4 1120 0.39 0.95 0.27 196 XMSlimDrugs 1119 0.18 0.95 0.02 197 FORGED_GMAIL_RCVD 1111 0.51 0.94 0.42 198 LONG_HEX_URI 1066 0.31 0.91 0.19 199 XMBdyGiftCard01 1055 1.19 0.90 1.25 200 MPART_ALT_DIFF_COUNT 1050 0.41 0.89 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 523890 91.30 94.58 90.63 2 XM_B_Unicode 426041 73.57 72.91 73.70 3 DKIM_SIGNED 389226 67.66 69.29 67.33 4 XM_DK_Pass 382334 66.20 66.51 66.14 5 DKIM_VALID 364718 63.04 62.75 63.09 6 DCC_CHECK_NEGATIVE 323810 49.64 18.32 56.02 7 BAYES_50 287740 50.04 51.34 49.78 8 DKIM_VALID_AU 279175 47.98 46.45 48.30 9 XMListUnsubscribeExists 266843 48.17 58.02 46.16 10 DCC_CHECK 243657 48.58 80.12 42.15 11 XM_B_Unicode3 242232 41.88 41.76 41.90 12 T_TM2_M_HEADER_IN_MSG 148767 24.40 17.83 25.74 13 HTML_FONT_LOW_CONTRAST 144849 25.86 29.82 25.06 14 DKIM_VALID_EF 137306 23.78 23.90 23.75 15 BAYES_00 136395 19.94 2.03 23.60 16 MIME_HTML_ONLY 126004 24.75 39.26 21.80 17 LOC_TINY_FONT_1 121211 21.97 26.87 20.97 18 XMSubLong 115551 20.76 24.55 19.99 19 T_KAM_HTML_FONT_INVALID 113515 20.33 23.72 19.64 20 FVGT_m_MULTI_ODD 109648 19.62 22.82 18.97 21 MultiRelay 95650 16.95 18.95 16.55 22 XM_Body_Dirty_Words 91666 17.41 25.03 15.86 23 ALL_TRUSTED 90487 14.00 5.90 15.65 24 TR_XM_DK_Bayes 82930 12.17 1.47 14.35 25 TR_XM_DK_Bayes1 79324 11.62 1.31 13.72 26 XM_B_Unsub 77237 14.49 20.00 13.36 27 HTML_IMAGE_RATIO_04 77074 11.97 5.28 13.33 28 TR_XM_DK_Bayes2 70785 10.30 0.77 12.25 29 RCVD_IN_MSPIKE_H2 64190 11.23 11.82 11.10 30 XM_Multi_Part_URI 61839 11.88 17.66 10.70 31 XM_H_Trusted_IP 60173 8.65 0.00 10.41 32 TooManyTo_001 60083 10.32 9.96 10.39 33 HTML_FONT_FACE_BAD 57249 8.42 1.13 9.90 34 XMStrtUSub 51997 8.18 4.18 9.00 35 XM_Evil_Numbers_Gen 50306 8.96 10.21 8.70 36 RCVD_IN_MSPIKE_WL 48786 7.59 3.40 8.44 37 RCVD_IN_MSPIKE_H3 48785 7.59 3.40 8.44 38 RCVD_IN_RP_SAFE 48367 7.19 1.42 8.37 39 LOTS_OF_MONEY 47941 8.99 12.38 8.29 40 MPART_ALT_DIFF 45688 7.91 7.92 7.90 41 RCVD_IN_RP_CERTIFIED 44098 6.54 1.19 7.63 42 FSL_BULK_SIG 42013 9.30 19.29 7.27 43 HTML_IMAGE_RATIO_02 40182 7.64 11.02 6.95 44 LotsOfNums_01 39599 6.95 7.44 6.85 45 XM_B_Unsub2 36486 6.44 7.06 6.31 46 XM_DKIMWhitelistDomains 35389 5.09 0.02 6.12 47 XM_DK_Undo_02 34898 10.22 30.74 6.04 48 MIME_HTML_ONLY_MULTI 34781 5.70 4.15 6.02 49 BAYES_40 34393 5.51 3.35 5.95 50 BAYES_20 33269 5.23 2.65 5.76 51 XM_H_Long_From01 31357 5.63 6.61 5.42 52 T_REMOTE_IMAGE 31253 6.21 10.17 5.41 53 XM_SendGrid 31197 5.21 4.28 5.40 54 XM_UncommonTLD01 30888 8.09 21.58 5.34 55 XM_B_Phish_Phrases 30127 5.40 6.35 5.21 56 RELAYCOUNTRY_META 29126 8.07 22.93 5.04 57 MIME_QP_LONG_LINE 28078 4.73 4.10 4.86 58 BAYES_60 25608 4.73 6.21 4.43 59 XM_PDF 25563 3.79 0.69 4.42 60 TooManyTo_002 25310 4.49 5.03 4.38 61 DKIM_INVALID 24508 4.63 6.54 4.24 62 RCVD_IN_IADB_LISTED 24313 3.82 1.92 4.21 63 T_TooManySym_01 23454 3.78 2.43 4.06 64 BOTNET_IPINHOSTNAME 23323 6.71 19.82 4.03 65 HTML_IMAGE_RATIO_06 23296 4.06 4.19 4.03 66 BAYES_05 23131 3.57 1.43 4.00 67 XMSubNoVowel 21752 3.18 0.30 3.76 68 XMSexyCombo_05 21429 5.00 11.32 3.71 69 RCVD_IN_IADB_SPF 20994 3.32 1.77 3.63 70 IN_ZIMBRA_NJ_WHITELIST 20505 2.95 0.01 3.55 71 NO_DNS_FOR_FROM 19369 3.19 2.39 3.35 72 XMSubMetaSx_00 19131 4.22 8.72 3.31 73 TR_XM_DK_SendGrid 18818 3.05 2.03 3.26 74 RCVD_IN_IADB_SENDERID 18229 2.91 1.74 3.15 75 TooManyTo_003 18152 3.39 4.61 3.14 76 RCVD_IN_IADB_DK 17870 2.86 1.74 3.09 77 FROM_EXCESS_BASE64 17692 3.31 4.54 3.06 78 XMNumbers 17333 3.85 8.06 3.00 79 BAYES_99 16451 6.03 21.67 2.85 80 RCVD_IN_IADB_VOUCHED 15960 2.38 0.51 2.76 81 DKIM_ADSP_NXDOMAIN 15955 3.33 6.14 2.76 82 MIME_HTML_MOSTLY 15068 2.87 4.16 2.61 83 XM_DIRTYINTL 14976 3.48 7.86 2.59 84 AC_FROM_MANY_DOTS 14588 2.10 0.01 2.52 85 HTML_IMAGE_RATIO_08 13652 2.40 2.59 2.36 86 BAYES_999 13001 4.56 15.92 2.25 87 MAILING_LIST_MULTI 12927 2.10 1.42 2.24 88 XM_B_SpammyTLD 12777 2.80 5.68 2.21 89 TooManyTo_004 12643 2.53 4.19 2.19 90 BAYES_80 12375 2.97 7.06 2.14 91 T_TooManySym_02 11771 1.81 0.71 2.04 92 HTML_MIME_NO_HTML_TAG 11717 3.13 8.53 2.03 93 BOTNET 11559 5.39 22.03 2.00 94 XM_CamelCaseFrm001 11507 2.49 4.97 1.99 95 ANY_BOUNCE_MESSAGE 10894 1.65 0.48 1.88 96 BOUNCE_MESSAGE 10890 1.64 0.47 1.88 97 UNPARSEABLE_RELAY 10844 1.70 0.84 1.88 98 XM_SPF_SoftFail 10760 2.40 5.04 1.86 99 TM2_M_URI_OPT_OUT 10596 2.20 4.03 1.83 100 KHOP_HELO_FCRDNS 10222 2.90 8.43 1.77 101 RCVD_IN_IADB_OPTIN 10128 1.52 0.38 1.75 102 TVD_RCVD_IP 9594 1.43 0.33 1.66 103 RELAYCOUNTRY_CA 9114 2.08 4.54 1.58 104 TooManyTo_005 9012 1.84 3.19 1.56 105 XMDiploma_00 8836 1.68 2.43 1.53 106 T_XMDrugObfuBody_08 8829 1.82 3.23 1.53 107 HELO_NODOT 8763 1.36 0.62 1.52 108 HELO_NO_DOMAIN 8719 1.36 0.62 1.51 109 SUBJ_ALL_CAPS 8621 1.49 1.51 1.49 110 UNTRUSTED_Relay 8380 3.57 14.00 1.45 111 XM_DK_Undo_01 8231 1.35 1.01 1.42 112 TR_Symld_Words 7952 1.41 1.57 1.38 113 TR_DCC_Bayes_99 7924 3.89 16.27 1.37 114 URI_HEX 7822 1.57 2.64 1.35 115 INVALID_MSGID 7692 1.16 0.29 1.33 116 IN_HORDE_ADDRESS_BOOK 7605 1.10 0.03 1.32 117 T_XMDrugObfuBody_14 7477 1.31 1.36 1.29 118 XMSubGarbage 7339 1.06 0.05 1.27 119 XMSubLongNoVowel 7280 1.06 0.09 1.26 120 XMCapTrack 7240 1.11 0.40 1.25 121 XMBdyGiftCard01 7222 1.19 0.90 1.25 122 RCVD_IN_BL_SPAMCOP_NET 7197 2.16 6.67 1.25 123 BAYES_95 7096 1.69 3.98 1.23 124 URI_TRY_3LD 6766 1.21 1.39 1.17 125 TM2_M_VERY_LONG_WORD 6726 1.26 1.75 1.16 126 XM_OfRef6 6642 1.35 2.35 1.15 127 TO_MALFORMED 6591 1.37 2.51 1.14 128 CK_HELO_DYNAMIC_SPLIT_IP 6328 0.93 0.13 1.09 129 HELO_DYNAMIC_IPADDR2 6322 0.92 0.04 1.09 130 RELAYCOUNTRY_GB 6091 1.37 2.91 1.05 131 XMPhish11 5934 1.09 1.38 1.03 132 XMStockSpam_06 5932 1.30 2.66 1.03 133 XM_H_Long_From02 5820 1.00 0.96 1.01 134 XM_GoogleGroups 5753 0.90 0.42 1.00 135 RCVD_IN_MSPIKE_BL 5719 1.52 4.13 0.99 136 USER_IN_DEF_DKIM_WL 5675 0.82 0.01 0.98 137 XM_E_Blogspot 5607 0.82 0.07 0.97 138 XMGenDplmaNmb 5442 1.07 1.70 0.94 139 T_FILL_THIS_FORM_SHORT 5349 0.99 1.29 0.93 140 XMGappySubj_01 5086 0.82 0.53 0.88 141 DKIM_ADSP_CUSTOM_MED 4752 0.87 1.13 0.82 142 XMBrknScrpt_02 4723 0.85 1.01 0.82 143 XM_UB50 4660 2.14 8.70 0.81 144 TR_XM_RelayPhish 4592 0.98 1.88 0.79 145 XMHTML_After_End 4287 0.90 1.67 0.74 146 XMSubMetaI_00 4241 0.83 1.32 0.73 147 T_Symld_Words_02 4191 0.73 0.73 0.73 148 T_OBFU_PDF_ATTACH 4139 0.62 0.17 0.72 149 TR_MetaPhish_Combo_01 4099 0.72 0.76 0.71 150 XMBody_17 4071 0.91 1.89 0.70 151 T_XMDrugObfuBody_00 4070 0.81 1.35 0.70 152 SpammyFromTLD_01 3985 1.20 3.69 0.69 153 FROM_GOV_DKIM_AU 3914 0.61 0.26 0.68 154 PLING_QUERY 3501 0.67 0.96 0.61 155 XMPhish30 3455 0.63 0.78 0.60 156 XM_ProductURIs 3455 0.74 1.47 0.60 157 XMBody_95 3441 0.51 0.09 0.60 158 RCVD_IN_MSPIKE_L3 3430 0.83 2.01 0.59 159 XMSexyCombo_01 3382 1.05 3.33 0.59 160 XM_B_REG_HTML 3379 0.53 0.28 0.58 161 XM_SPF_Unknown 3364 0.67 1.12 0.58 162 REMOVE_BEFORE_LINK 3362 0.61 0.77 0.58 163 URIBL_CSS_A 3314 0.60 0.71 0.57 164 URIBL_CSS 3314 0.60 0.71 0.57 165 NML_ADSP_CUSTOM_MED 3312 0.63 0.89 0.57 166 T_XMHurry_00 3123 0.62 1.01 0.54 167 XMNoVowels 3052 0.55 0.63 0.53 168 TR_LOTS_OF_MONEY3 2972 0.76 1.99 0.51 169 HTTPS_HTTP_MISMATCH 2892 0.53 0.70 0.50 170 TR_XM_PHPDW 2886 0.76 2.06 0.50 171 XMHTMLBadTable_001 2882 0.51 0.58 0.50 172 HTML_IMAGE_ONLY_20 2837 0.49 0.51 0.49 173 TR_XM_PHPForged 2816 0.74 2.01 0.49 174 XM_ShortIntro_01 2807 0.49 0.50 0.49 175 TR_XM_FormFill2 2799 0.74 1.99 0.48 176 SUBJ_DOLLARS 2774 0.47 0.43 0.48 177 XM_H_PHPOS 2771 0.73 1.99 0.48 178 RELAYCOUNTRY_DE 2689 0.97 3.46 0.47 179 FILL_THIS_FORM 2643 0.44 0.35 0.46 180 TM2_M_A_HREF_HREF 2581 0.48 0.67 0.45 181 XM_H_PHPMailer 2570 0.58 1.24 0.44 182 AC_DIV_BONANZA 2568 0.39 0.11 0.44 183 PDS_OTHER_BAD_TLD 2501 0.75 2.32 0.43 184 RELAYCOUNTRY_AU 2489 0.44 0.48 0.43 185 USER_IN_WHITELIST 2485 0.36 0.00 0.43 186 XMOemUri 2466 0.39 0.22 0.43 187 T_TooManySym_03 2466 0.39 0.22 0.43 188 FORGED_GMAIL_RCVD 2426 0.51 0.94 0.42 189 XMPhish14 2423 0.49 0.86 0.42 190 HTML_TAG_BALANCE_BODY 2350 0.42 0.51 0.41 191 SHORT_HELO_AND_INLINE_IMAGE 2336 0.34 0.03 0.40 192 XMBody_78 2326 0.48 0.86 0.40 193 FROM_GOV_SPOOF 2268 0.37 0.24 0.39 194 DIET_1 2247 0.84 3.07 0.39 195 HTML_IMAGE_ONLY_32 2237 0.36 0.22 0.39 196 URI_NOVOWEL 2208 0.68 2.12 0.38 197 T_MONEY_PERCENT 2194 0.51 1.13 0.38 198 TR_LOTS_OF_MONEY2 2194 0.51 1.13 0.38 199 XMMoneyMeta_00 2192 0.57 1.49 0.38 200 TM2_M_BODY_EMPTY 2181 0.33 0.07 0.38 ----------------------------------------------------------------------