Email: 341341 Autolearn: 0 AvgScore: 0.96 AvgScanTime: 2.01 sec Spam: 62335 Autolearn: 0 AvgScore: 12.44 AvgScanTime: 2.58 sec Ham: 279006 Autolearn: 0 AvgScore: -1.60 AvgScanTime: 1.89 sec Time Spent Running SA: 190.98 hours Time Spent Processing Spam: 44.60 hours Time Spent Processing Ham: 146.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 54754 88.67 87.84 88.85 2 DCC_CHECK 46890 57.27 75.22 53.26 3 DKIM_SIGNED 45457 81.33 72.92 83.20 4 XM_B_Unicode 44203 74.67 70.91 75.51 5 XM_DK_Pass 44031 80.05 70.64 82.15 6 DKIM_VALID 41284 76.38 66.23 78.65 7 XMListUnsubscribeExists 38029 61.34 61.01 61.41 8 DKIM_VALID_AU 32347 62.79 51.89 65.23 9 BAYES_50 30116 49.90 48.31 50.25 10 XM_B_Unicode3 27659 48.55 44.37 49.48 11 XM_DK_Undo_02 21709 13.29 34.83 8.47 12 HTML_FONT_LOW_CONTRAST 20976 35.74 33.65 36.21 13 MIME_HTML_ONLY 20803 26.74 33.37 25.26 14 LOC_TINY_FONT_1 19601 32.66 31.44 32.93 15 RELAYCOUNTRY_META 16745 9.20 26.86 5.25 16 FVGT_m_MULTI_ODD 15725 22.42 25.23 21.80 17 MultiRelay 15677 17.92 25.15 16.31 18 XMSubLong 15161 21.87 24.32 21.33 19 BAYES_99 15082 8.39 24.20 4.86 20 BOTNET 14747 6.24 23.66 2.35 21 DCC_CHECK_NEGATIVE 14435 41.50 23.16 45.60 22 DKIM_VALID_EF 13931 26.68 22.35 27.65 23 XM_Body_Dirty_Words 13529 16.91 21.70 15.83 24 BOTNET_IPINHOSTNAME 12623 8.64 20.25 6.04 25 XM_Multi_Part_URI 12487 15.81 20.03 14.86 26 BAYES_999 11801 6.79 18.93 4.08 27 XM_UncommonTLD01 11692 7.48 18.76 4.96 28 UNTRUSTED_Relay 11235 4.70 18.02 1.72 29 FSL_BULK_SIG 11160 10.46 17.90 8.80 30 TR_DCC_Bayes_99 10952 5.54 17.57 2.86 31 T_KAM_HTML_FONT_INVALID 10738 16.93 17.23 16.86 32 T_TM2_M_HEADER_IN_MSG 9747 20.18 15.64 21.19 33 XMSexyCombo_05 8704 7.34 13.96 5.86 34 HTML_IMAGE_RATIO_02 8641 12.99 13.86 12.80 35 RCVD_IN_MSPIKE_H2 8438 13.11 13.54 13.01 36 LOTS_OF_MONEY 8294 10.03 13.31 9.30 37 XM_B_Unsub 8163 11.04 13.10 10.58 38 XMSubMetaSx_00 6883 5.79 11.04 4.62 39 XM_UB50 6416 2.49 10.29 0.75 40 XM_Evil_Numbers_Gen 6356 11.39 10.20 11.66 41 XM_DIRTYINTL 5613 4.32 9.00 3.27 42 SpammyFromTLD_02 5538 1.76 8.88 0.17 43 MultiRelay_Combo 5008 1.59 8.03 0.15 44 MultiRelay_CC 5008 1.59 8.03 0.15 45 MPART_ALT_DIFF 4492 6.00 7.21 5.73 46 XM_H_Long_From01 4472 7.05 7.17 7.02 47 RCVD_IN_BL_SPAMCOP_NET 4435 2.43 7.11 1.38 48 RCVD_IN_RP_RNBL 4429 1.39 7.11 0.11 49 BOTNET_NORDNS 4292 1.27 6.89 0.02 50 LotsOfNums_01 4277 7.18 6.86 7.25 51 XM_B_Phish_Phrases 4266 8.38 6.84 8.72 52 DKIM_INVALID 4173 4.94 6.69 4.55 53 BAYES_80 4103 3.55 6.58 2.87 54 XMNumbers 4080 5.02 6.55 4.68 55 TooManyTo_001 4069 6.16 6.53 6.08 56 XM_B_SpammyTLD 4008 2.89 6.43 2.10 57 BAYES_60 3850 5.42 6.18 5.25 58 HTML_IMAGE_RATIO_04 3675 8.43 5.90 8.99 59 RELAYCOUNTRY_CA 3468 2.88 5.56 2.28 60 MIME_HTML_MOSTLY 3421 4.18 5.49 3.88 61 T_REMOTE_IMAGE 3353 4.25 5.38 3.99 62 REPLYTO_WITHOUT_TO_CC 3288 1.00 5.27 0.04 63 XM_SendGrid 3286 7.13 5.27 7.55 64 XM_CamelCaseFrm001 3072 3.16 4.93 2.77 65 HTML_IMAGE_RATIO_06 2894 3.94 4.64 3.78 66 FROM_EXCESS_BASE64 2649 5.17 4.25 5.37 67 XM_SPF_SoftFail 2569 1.63 4.12 1.07 68 XMStrtUSub 2451 5.79 3.93 6.20 69 NORDNS_LOW_CONTRAST 2447 0.72 3.93 0.00 70 MIME_HTML_ONLY_MULTI 2339 3.42 3.75 3.35 71 TM2_M_URI_OPT_OUT 2227 2.84 3.57 2.67 72 XM_OfRef6 2189 2.35 3.51 2.09 73 HTML_SHORT_LINK_IMG_1 2164 0.66 3.47 0.03 74 RCVD_IN_PSBL 2163 0.64 3.47 0.01 75 HTML_IMAGE_ONLY_08 2154 0.72 3.46 0.11 76 MIME_HEADER_CTYPE_ONLY 2148 0.77 3.45 0.17 77 BAYES_95 2124 1.94 3.41 1.61 78 HDRS_LCASE_IMGONLY 2086 0.62 3.35 0.01 79 TO_EQ_FM_DOM_HTML_IMG 2068 0.61 3.32 0.00 80 BAYES_40 2025 4.67 3.25 4.99 81 XMSexyCombo_01 2024 1.02 3.25 0.52 82 KHOP_HELO_FCRDNS 2020 1.39 3.24 0.97 83 BAYES_00 2013 19.56 3.23 23.21 84 T_TooManySym_01 1991 6.28 3.19 6.97 85 MIME_QP_LONG_LINE 1969 3.76 3.16 3.89 86 RELAYCOUNTRY_AT 1890 0.91 3.03 0.44 87 HTML_IMAGE_RATIO_08 1887 3.52 3.03 3.63 88 TR_LOTS_OF_MONEY3 1831 0.95 2.94 0.51 89 TR_Mismatch_TLD_01 1809 0.70 2.90 0.21 90 PDS_OTHER_BAD_TLD 1808 1.08 2.90 0.67 91 RCVD_IN_MSPIKE_WL 1805 9.86 2.90 11.42 92 RCVD_IN_MSPIKE_H3 1805 9.86 2.90 11.42 93 NO_DNS_FOR_FROM 1754 2.67 2.81 2.64 94 SpammyFromTLD_01 1744 0.80 2.80 0.35 95 BAYES_20 1727 3.88 2.77 4.13 96 XM_URI_RBL 1710 0.84 2.74 0.42 97 TR_XM_PHPDW 1709 0.83 2.74 0.41 98 TR_XM_DK_SendGrid 1679 3.83 2.69 4.08 99 TR_XM_PHPForged 1659 0.81 2.66 0.39 100 RCVD_IN_MSPIKE_BL 1652 1.28 2.65 0.98 101 RELAYCOUNTRY_IN 1650 0.53 2.65 0.05 102 TR_XM_FormFill2 1643 0.80 2.64 0.39 103 XM_H_PHPOS 1640 0.79 2.63 0.38 104 URI_HEX 1618 1.60 2.60 1.38 105 ALL_TRUSTED 1593 9.33 2.56 10.85 106 HTML_MIME_NO_HTML_TAG 1565 1.81 2.51 1.65 107 RELAYCOUNTRY_GB 1528 0.86 2.45 0.50 108 XMStockSpam_06 1527 2.01 2.45 1.91 109 XM_B_Unsub2 1514 1.27 2.43 1.01 110 TM2_M_VERY_LONG_WORD 1513 1.75 2.43 1.59 111 RCVD_IN_RP_SAFE 1509 13.16 2.42 15.56 112 TR_XM_RelayPhish 1470 1.35 2.36 1.13 113 XMBody_17 1461 1.26 2.34 1.02 114 RCVD_IN_RP_CERTIFIED 1450 12.31 2.33 14.54 115 TR_Mismatch_TLD_02 1434 0.46 2.30 0.05 116 URIBL_SBL_A 1431 0.63 2.30 0.25 117 RELAYCOUNTRY_FR 1424 0.65 2.28 0.29 118 HELO_LH_HOME 1366 0.40 2.19 0.00 119 T_XMDrugObfuBody_08 1352 1.32 2.17 1.14 120 XMDiploma_00 1335 1.82 2.14 1.75 121 RELAYCOUNTRY_ID 1332 0.40 2.14 0.02 122 PLING_QUERY 1330 1.57 2.13 1.45 123 RELAYCOUNTRY_KE 1322 0.39 2.12 0.00 124 FROM_SUSPICIOUS_NTLD 1318 0.41 2.11 0.03 125 FROM_SUSPICIOUS_NTLD_FP 1301 0.40 2.09 0.03 126 XM_H_PHPMailer 1252 0.77 2.01 0.50 127 TR_XM_INV_DKIM 1238 0.50 1.99 0.17 128 DATE_IN_PAST_03_06 1206 0.43 1.93 0.09 129 MISSING_HEADERS 1174 0.61 1.88 0.33 130 T_XMDrugObfuBody_14 1158 1.71 1.86 1.68 131 BAYES_05 1152 2.48 1.85 2.62 132 DIET_1 1144 0.93 1.84 0.73 133 T_FILL_THIS_FORM_SHORT 1117 1.15 1.79 1.00 134 DKIM_ADSP_CUSTOM_MED 1097 1.14 1.76 1.01 135 XM_ProductURIs 1097 1.36 1.76 1.27 136 XM_UB99 1062 0.32 1.70 0.01 137 XM_H_PHPOS_M 1047 0.44 1.68 0.17 138 XMSexyCombo_04 1043 0.41 1.67 0.13 139 XMSubMetaSSx_00 1040 0.65 1.67 0.42 140 NML_ADSP_CUSTOM_MED 1035 0.92 1.66 0.75 141 TR_XM_DK_Bayes 990 16.58 1.59 19.92 142 XMPhish11 990 1.17 1.59 1.08 143 FROM_MISSP_REPLYTO 970 0.29 1.56 0.01 144 XMClaimOffer 967 0.52 1.55 0.29 145 TR_Symld_Words 961 1.11 1.54 1.01 146 FORGED_GMAIL_RCVD 944 0.65 1.51 0.45 147 T_XMHurry_00 894 1.32 1.43 1.30 148 URIBL_DBL_SPAM 878 0.29 1.41 0.04 149 XM_UB999 876 0.26 1.41 0.01 150 SUBJ_ALL_CAPS 871 1.35 1.40 1.34 151 TR_LOTS_OF_MONEY1 861 0.26 1.38 0.01 152 TR_XM_DK_Bayes1 851 15.90 1.37 19.15 153 RCVD_IN_IADB_LISTED 827 2.92 1.33 3.27 154 XM_H_Long_From02 826 1.32 1.33 1.32 155 XMBrknScrpt_02 807 1.01 1.29 0.94 156 XMHTML_After_End 804 0.74 1.29 0.62 157 T_TooManySym_02 787 2.98 1.26 3.36 158 MPART_ALT_DIFF_COUNT 784 0.56 1.26 0.40 159 HK_RANDOM_REPLYTO 783 0.37 1.26 0.18 160 FROM_MISSP_EH_MATCH 775 0.24 1.24 0.01 161 XMSubMetaI_00 769 0.82 1.23 0.72 162 MAILING_LIST_MULTI 769 1.55 1.23 1.62 163 DATE_IN_PAST_06_12 768 0.27 1.23 0.05 164 RCVD_IN_MSPIKE_L5 757 0.33 1.21 0.13 165 RELAYCOUNTRY_IT 756 0.24 1.21 0.03 166 RCVD_IN_MSPIKE_L3 744 0.77 1.19 0.68 167 RCVD_IN_IADB_SPF 742 2.52 1.19 2.82 168 XM_UB60 738 0.26 1.18 0.05 169 T_MONEY_PERCENT 732 0.55 1.17 0.41 170 TR_LOTS_OF_MONEY2 732 0.55 1.17 0.41 171 XMBdyGiftCard01 732 2.69 1.17 3.03 172 T_XMDrugObfuBody_00 727 0.99 1.17 0.95 173 FORGED_MUA_OUTLOOK 726 0.25 1.16 0.04 174 FROM_MISSPACED 725 0.22 1.16 0.01 175 UNPARSEABLE_RELAY 722 3.18 1.16 3.63 176 RCVD_IN_IADB_DK 722 2.20 1.16 2.44 177 RCVD_IN_IADB_SENDERID 717 2.26 1.15 2.51 178 TR_XM_DK_Bayes2 716 14.87 1.15 17.94 179 LOW_PRICE 710 0.33 1.14 0.14 180 URIBL_BLACK 692 0.21 1.11 0.01 181 DKIM_ADSP_NXDOMAIN 684 1.54 1.10 1.63 182 RDNS_DYNAMIC 664 0.58 1.07 0.48 183 THIS_AD 658 0.50 1.06 0.37 184 FROM_MISSP_XPRIO 657 0.19 1.05 0.00 185 FROM_MISSP_MSFT 657 0.19 1.05 0.00 186 XMSlimDrugH 653 0.56 1.05 0.45 187 MONEY_FORM_SHORT 653 0.20 1.05 0.01 188 FSL_CTYPE_WIN1251 652 0.19 1.05 0.00 189 XMPhish30 648 0.67 1.04 0.59 190 XMGenDplmaNmb 630 1.06 1.01 1.08 191 URI_TRY_3LD 628 1.35 1.01 1.43 192 FORGED_OUTLOOK_HTML 627 0.18 1.01 0.00 193 XM_DK_Undo_01 625 1.31 1.00 1.38 194 FORGED_OUTLOOK_TAGS 624 0.19 1.00 0.01 195 RELAYCOUNTRY_DE 615 0.41 0.99 0.28 196 XM_Sft_Co_L33T 610 0.92 0.98 0.90 197 XM_OfRef7 583 0.25 0.94 0.10 198 RELAYCOUNTRY_RU 573 0.18 0.92 0.02 199 LongTLD 562 0.29 0.90 0.16 200 TM2_M_A_HREF_HREF 554 0.55 0.89 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 247896 88.67 87.84 88.85 2 DKIM_SIGNED 232139 81.33 72.92 83.20 3 XM_DK_Pass 229201 80.05 70.64 82.15 4 DKIM_VALID 219442 76.38 66.23 78.65 5 XM_B_Unicode 210664 74.67 70.91 75.51 6 DKIM_VALID_AU 181986 62.79 51.89 65.23 7 XMListUnsubscribeExists 171334 61.34 61.01 61.41 8 DCC_CHECK 148586 57.27 75.22 53.26 9 BAYES_50 140204 49.90 48.31 50.25 10 XM_B_Unicode3 138051 48.55 44.37 49.48 11 DCC_CHECK_NEGATIVE 127236 41.50 23.16 45.60 12 HTML_FONT_LOW_CONTRAST 101035 35.74 33.65 36.21 13 LOC_TINY_FONT_1 91871 32.66 31.44 32.93 14 DKIM_VALID_EF 77141 26.68 22.35 27.65 15 MIME_HTML_ONLY 70466 26.74 33.37 25.26 16 BAYES_00 64758 19.56 3.23 23.21 17 FVGT_m_MULTI_ODD 60816 22.42 25.23 21.80 18 XMSubLong 59506 21.87 24.32 21.33 19 T_TM2_M_HEADER_IN_MSG 59123 20.18 15.64 21.19 20 TR_XM_DK_Bayes 55588 16.58 1.59 19.92 21 TR_XM_DK_Bayes1 53429 15.90 1.37 19.15 22 TR_XM_DK_Bayes2 50043 14.87 1.15 17.94 23 T_KAM_HTML_FONT_INVALID 47047 16.93 17.23 16.86 24 MultiRelay 45499 17.92 25.15 16.31 25 XM_Body_Dirty_Words 44179 16.91 21.70 15.83 26 RCVD_IN_RP_SAFE 43411 13.16 2.42 15.56 27 XM_Multi_Part_URI 41472 15.81 20.03 14.86 28 RCVD_IN_RP_CERTIFIED 40568 12.31 2.33 14.54 29 RCVD_IN_MSPIKE_H2 36303 13.11 13.54 13.01 30 HTML_IMAGE_RATIO_02 35703 12.99 13.86 12.80 31 XM_Evil_Numbers_Gen 32530 11.39 10.20 11.66 32 RCVD_IN_MSPIKE_WL 31864 9.86 2.90 11.42 33 RCVD_IN_MSPIKE_H3 31861 9.86 2.90 11.42 34 ALL_TRUSTED 30264 9.33 2.56 10.85 35 XM_DKIMWhitelistDomains 29726 8.71 0.01 10.65 36 XM_B_Unsub 29505 11.04 13.10 10.58 37 LOTS_OF_MONEY 25950 10.03 13.31 9.30 38 HTML_IMAGE_RATIO_04 25087 8.43 5.90 8.99 39 FSL_BULK_SIG 24553 10.46 17.90 8.80 40 XM_B_Phish_Phrases 24328 8.38 6.84 8.72 41 XM_DK_Undo_02 23641 13.29 34.83 8.47 42 XM_SendGrid 21068 7.13 5.27 7.55 43 LotsOfNums_01 20233 7.18 6.86 7.25 44 XM_H_Long_From01 19580 7.05 7.17 7.02 45 T_TooManySym_01 19452 6.28 3.19 6.97 46 XMStrtUSub 17308 5.79 3.93 6.20 47 TooManyTo_001 16950 6.16 6.53 6.08 48 BOTNET_IPINHOSTNAME 16854 8.64 20.25 6.04 49 XMSexyCombo_05 16358 7.34 13.96 5.86 50 MPART_ALT_DIFF 16000 6.00 7.21 5.73 51 FROM_EXCESS_BASE64 14982 5.17 4.25 5.37 52 RELAYCOUNTRY_META 14661 9.20 26.86 5.25 53 BAYES_60 14638 5.42 6.18 5.25 54 BAYES_40 13917 4.67 3.25 4.99 55 XM_UncommonTLD01 13840 7.48 18.76 4.96 56 BAYES_99 13569 8.39 24.20 4.86 57 XMNumbers 13064 5.02 6.55 4.68 58 XMSubMetaSx_00 12884 5.79 11.04 4.62 59 DKIM_INVALID 12697 4.94 6.69 4.55 60 BAYES_20 11519 3.88 2.77 4.13 61 TR_XM_DK_SendGrid 11394 3.83 2.69 4.08 62 BAYES_999 11391 6.79 18.93 4.08 63 T_REMOTE_IMAGE 11139 4.25 5.38 3.99 64 MIME_QP_LONG_LINE 10859 3.76 3.16 3.89 65 MIME_HTML_MOSTLY 10831 4.18 5.49 3.88 66 HTML_IMAGE_RATIO_06 10543 3.94 4.64 3.78 67 HTML_IMAGE_RATIO_08 10135 3.52 3.03 3.63 68 UNPARSEABLE_RELAY 10117 3.18 1.16 3.63 69 T_TooManySym_02 9382 2.98 1.26 3.36 70 MIME_HTML_ONLY_MULTI 9346 3.42 3.75 3.35 71 XM_DIRTYINTL 9132 4.32 9.00 3.27 72 RCVD_IN_IADB_LISTED 9124 2.92 1.33 3.27 73 IN_ZIMBRA_NJ_WHITELIST 8849 2.59 0.01 3.17 74 XMBdyGiftCard01 8454 2.69 1.17 3.03 75 BAYES_80 8009 3.55 6.58 2.87 76 TR_DCC_Bayes_99 7973 5.54 17.57 2.86 77 RCVD_IN_IADB_SPF 7866 2.52 1.19 2.82 78 XM_CamelCaseFrm001 7729 3.16 4.93 2.77 79 TM2_M_URI_OPT_OUT 7458 2.84 3.57 2.67 80 NO_DNS_FOR_FROM 7364 2.67 2.81 2.64 81 BAYES_05 7307 2.48 1.85 2.62 82 INVALID_MSGID 7266 2.18 0.27 2.60 83 TVD_RCVD_IP 7117 2.20 0.64 2.55 84 RCVD_IN_IADB_SENDERID 6996 2.26 1.15 2.51 85 RCVD_IN_IADB_DK 6799 2.20 1.16 2.44 86 XM_H_Trusted_IP 6753 1.98 0.00 2.42 87 TO_MALFORMED 6610 1.94 0.01 2.37 88 BOTNET 6558 6.24 23.66 2.35 89 CK_HELO_DYNAMIC_SPLIT_IP 6459 1.91 0.08 2.32 90 HELO_DYNAMIC_IPADDR2 6459 1.90 0.03 2.32 91 RELAYCOUNTRY_CA 6362 2.88 5.56 2.28 92 XM_B_SpammyTLD 5871 2.89 6.43 2.10 93 USER_IN_DEF_DKIM_WL 5865 1.72 0.02 2.10 94 XM_OfRef6 5832 2.35 3.51 2.09 95 RCVD_IN_IADB_VOUCHED 5683 1.73 0.35 2.04 96 XM_PDF 5467 1.70 0.52 1.96 97 XMStockSpam_06 5332 2.01 2.45 1.91 98 XMDiploma_00 4882 1.82 2.14 1.75 99 UNTRUSTED_Relay 4804 4.70 18.02 1.72 100 T_XMDrugObfuBody_14 4675 1.71 1.86 1.68 101 IN_HORDE_ADDRESS_BOOK 4602 1.35 0.02 1.65 102 HTML_MIME_NO_HTML_TAG 4597 1.81 2.51 1.65 103 DKIM_ADSP_NXDOMAIN 4561 1.54 1.10 1.63 104 MAILING_LIST_MULTI 4529 1.55 1.23 1.62 105 BAYES_95 4490 1.94 3.41 1.61 106 TM2_M_VERY_LONG_WORD 4447 1.75 2.43 1.59 107 PLING_QUERY 4038 1.57 2.13 1.45 108 URI_TRY_3LD 3980 1.35 1.01 1.43 109 XMSubNoVowel 3961 1.31 0.82 1.42 110 HTML_FONT_FACE_BAD 3957 1.30 0.77 1.42 111 RCVD_IN_BL_SPAMCOP_NET 3848 2.43 7.11 1.38 112 URI_HEX 3846 1.60 2.60 1.38 113 XM_DK_Undo_01 3838 1.31 1.00 1.38 114 SUBJ_ALL_CAPS 3741 1.35 1.40 1.34 115 XM_H_Long_From02 3682 1.32 1.33 1.32 116 T_XMHurry_00 3615 1.32 1.43 1.30 117 RCVD_IN_IADB_OPTIN 3567 1.11 0.34 1.28 118 XM_ProductURIs 3549 1.36 1.76 1.27 119 AC_FROM_MANY_DOTS 3539 1.04 0.02 1.27 120 XM_GoogleGroups 3298 1.05 0.45 1.18 121 TooManyTo_002 3242 1.10 0.81 1.16 122 XMGappySubj_01 3229 1.02 0.42 1.16 123 T_XMDrugObfuBody_08 3167 1.32 2.17 1.14 124 TR_XM_RelayPhish 3148 1.35 2.36 1.13 125 XMGenDplmaNmb 3005 1.06 1.01 1.08 126 XMPhish11 3003 1.17 1.59 1.08 127 XM_SPF_SoftFail 2982 1.63 4.12 1.07 128 ANY_BOUNCE_MESSAGE 2960 0.91 0.22 1.06 129 BOUNCE_MESSAGE 2956 0.91 0.22 1.06 130 XMBody_17 2852 1.26 2.34 1.02 131 XMBody_95 2851 0.84 0.04 1.02 132 TR_Symld_Words 2822 1.11 1.54 1.01 133 DKIM_ADSP_CUSTOM_MED 2810 1.14 1.76 1.01 134 XM_B_Unsub2 2808 1.27 2.43 1.01 135 T_FILL_THIS_FORM_SHORT 2801 1.15 1.79 1.00 136 XM_B_REG_HTML 2789 0.87 0.29 1.00 137 RCVD_IN_MSPIKE_BL 2734 1.28 2.65 0.98 138 KHOP_HELO_FCRDNS 2712 1.39 3.24 0.97 139 T_XMDrugObfuBody_00 2643 0.99 1.17 0.95 140 XMBrknScrpt_02 2627 1.01 1.29 0.94 141 FILL_THIS_FORM 2570 0.88 0.72 0.92 142 XM_Sft_Co_L33T 2514 0.92 0.98 0.90 143 TR_MetaPhish_Combo_01 2429 0.87 0.87 0.87 144 TooManyTo_003 2319 0.80 0.64 0.83 145 FILL_THIS_FORM_LONG 2184 0.73 0.50 0.78 146 NML_ADSP_CUSTOM_MED 2099 0.92 1.66 0.75 147 XM_UB50 2084 2.49 10.29 0.75 148 SUBJ_DOLLARS 2078 0.73 0.64 0.74 149 DIET_1 2044 0.93 1.84 0.73 150 USER_IN_WHITELIST 2030 0.59 0.00 0.73 151 T_FILL_THIS_FORM_LOAN 2023 0.63 0.19 0.73 152 XMSubMetaI_00 2013 0.82 1.23 0.72 153 TooManyTo_004 1950 0.67 0.52 0.70 154 RCVD_IN_MSPIKE_L3 1890 0.77 1.19 0.68 155 PDS_OTHER_BAD_TLD 1875 1.08 2.90 0.67 156 XMBSHREFv2 1831 0.61 0.43 0.66 157 HTML_TAG_BALANCE_BODY 1806 0.68 0.81 0.65 158 XMSubMetaSxObfu_03 1732 0.66 0.82 0.62 159 XMHTML_After_End 1721 0.74 1.29 0.62 160 TooManyTo_005 1714 0.58 0.43 0.61 161 HTML_IMAGE_ONLY_20 1691 0.56 0.36 0.61 162 XMHTMLBadTable_001 1664 0.62 0.71 0.60 163 XMPhish30 1640 0.67 1.04 0.59 164 T_TooManySym_03 1630 0.54 0.34 0.58 165 HELO_NODOT 1589 0.57 0.55 0.57 166 XMSubMetaSxObfu_02 1565 0.51 0.29 0.56 167 HELO_NO_DOMAIN 1542 0.55 0.55 0.55 168 XM_B_COPY_HTML 1507 0.60 0.84 0.54 169 XMSexyCombo_01 1446 1.02 3.25 0.52 170 TR_LOTS_OF_MONEY3 1421 0.95 2.94 0.51 171 RELAYCOUNTRY_GB 1394 0.86 2.45 0.50 172 XM_H_PHPMailer 1384 0.77 2.01 0.50 173 RDNS_DYNAMIC 1332 0.58 1.07 0.48 174 TM2_M_A_HREF_HREF 1315 0.55 0.89 0.47 175 FORGED_GMAIL_RCVD 1266 0.65 1.51 0.45 176 XMCapTrack 1251 0.42 0.27 0.45 177 XMSlimDrugH 1251 0.56 1.05 0.45 178 RELAYCOUNTRY_AT 1216 0.91 3.03 0.44 179 XMBody_78 1195 0.50 0.81 0.43 180 XMSubMetaSSx_00 1184 0.65 1.67 0.42 181 XM_Combo_Sbj 1176 0.43 0.47 0.42 182 XMLngstWrd_00 1172 0.43 0.46 0.42 183 XM_RXBody 1171 0.45 0.61 0.42 184 XM_URI_RBL 1165 0.84 2.74 0.42 185 T_MONEY_PERCENT 1151 0.55 1.17 0.41 186 TR_LOTS_OF_MONEY2 1151 0.55 1.17 0.41 187 XMRcvdHeader_15 1146 0.34 0.00 0.41 188 TR_XM_PHPDW 1137 0.83 2.74 0.41 189 T_Symld_Words_02 1129 0.43 0.54 0.40 190 MPART_ALT_DIFF_COUNT 1125 0.56 1.26 0.40 191 T_OBFU_PDF_ATTACH 1114 0.38 0.27 0.40 192 ADMITS_SPAM 1099 0.36 0.19 0.39 193 TR_XM_PHPForged 1096 0.81 2.66 0.39 194 TR_XM_FormFill2 1081 0.80 2.64 0.39 195 XM_H_PHPOS 1070 0.79 2.63 0.38 196 XMLngstWrd_01 1063 0.39 0.43 0.38 197 XMNoVowels 1054 0.38 0.41 0.38 198 HTML_IMAGE_ONLY_28 1044 0.43 0.68 0.37 199 XMSubject_48 1038 0.38 0.39 0.37 200 THIS_AD 1037 0.50 1.06 0.37 ----------------------------------------------------------------------