Email: 393128 Autolearn: 0 AvgScore: 1.35 AvgScanTime: 1.77 sec Spam: 83978 Autolearn: 0 AvgScore: 12.72 AvgScanTime: 2.94 sec Ham: 309150 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.45 sec Time Spent Running SA: 193.30 hours Time Spent Processing Spam: 68.51 hours Time Spent Processing Ham: 124.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 79088 82.48 94.18 79.31 2 RELAYCOUNTRY_US 66661 75.58 79.38 74.54 3 DCC_CHECK 65331 50.95 77.80 43.66 4 DKIM_SIGNED 64238 72.15 76.49 70.96 5 XM_DK_Pass 62697 71.07 74.66 70.10 6 XM_B_Unicode 62295 69.40 74.18 68.10 7 DKIM_VALID 55545 67.20 66.14 67.49 8 XMListUnsubscribeExists 52777 54.73 62.85 52.53 9 XM_B_Unicode3 41927 44.10 49.93 42.52 10 DKIM_VALID_AU 41716 52.94 49.67 53.83 11 BAYES_50 38190 45.23 45.48 45.17 12 MIME_HTML_ONLY 34070 27.83 40.57 24.37 13 HTML_FONT_LOW_CONTRAST 28734 28.97 34.22 27.54 14 XM_DK_Undo_02 27861 12.73 33.18 7.17 15 LOC_TINY_FONT_1 26745 26.27 31.85 24.75 16 XMSubLong 19949 20.54 23.76 19.66 17 DKIM_VALID_EF 19803 24.55 23.58 24.81 18 FVGT_m_MULTI_ODD 19566 19.98 23.30 19.08 19 BOTNET 19207 6.84 22.87 2.48 20 BAYES_99 18163 7.80 21.63 4.05 21 RELAYCOUNTRY_META 17610 8.19 20.97 4.71 22 XM_Body_Dirty_Words 17499 14.86 20.84 13.24 23 DCC_CHECK_NEGATIVE 16838 47.71 20.05 55.23 24 T_TM2_M_HEADER_IN_MSG 15683 20.62 18.68 21.15 25 T_KAM_HTML_FONT_INVALID 15674 15.46 18.66 14.59 26 FSL_BULK_SIG 15424 10.04 18.37 7.78 27 LOTS_OF_MONEY 15287 11.84 18.20 10.11 28 XM_Multi_Part_URI 14995 17.36 17.86 17.22 29 BAYES_999 13622 6.13 16.22 3.39 30 XM_B_Unsub 13074 11.40 15.57 10.27 31 XM_UncommonTLD01 12853 5.91 15.31 3.35 32 BOTNET_IPINHOSTNAME 12470 7.41 14.85 5.39 33 TR_DCC_Bayes_99 12249 4.89 14.59 2.25 34 UNTRUSTED_Relay 11832 4.15 14.09 1.44 35 HTML_IMAGE_RATIO_02 11615 10.91 13.83 10.12 36 XMSexyCombo_05 10630 6.85 12.66 5.27 37 T_REMOTE_IMAGE 9868 5.22 11.75 3.44 38 XM_Evil_Numbers_Gen 9504 9.72 11.32 9.28 39 DKIM_INVALID 8693 4.95 10.35 3.48 40 XMSubMetaSx_00 8516 5.64 10.14 4.42 41 NO_DNS_FOR_FROM 8301 3.81 9.88 2.16 42 RCVD_IN_MSPIKE_H2 8153 10.48 9.71 10.69 43 BAYES_60 7255 5.40 8.64 4.52 44 BAYES_80 7023 3.65 8.36 2.37 45 KHOP_HELO_FCRDNS 6990 2.59 8.32 1.03 46 HTML_IMAGE_ONLY_08 6720 1.78 8.00 0.09 47 FROM_MISSP_REPLYTO 6483 1.67 7.72 0.03 48 XM_UB50 6402 2.25 7.62 0.79 49 MPART_ALT_DIFF 6047 6.75 7.20 6.63 50 BODY_URI_ONLY 6000 1.54 7.14 0.02 51 XM_B_Phish_Phrases 5855 7.76 6.97 7.97 52 LotsOfNums_01 5742 7.11 6.84 7.19 53 HTML_IMAGE_RATIO_04 5625 5.94 6.70 5.74 54 XM_SPF_SoftFail 5595 2.34 6.66 1.17 55 MIME_HTML_MOSTLY 5393 3.35 6.42 2.52 56 XM_H_Long_From01 5353 5.85 6.37 5.70 57 TooManyTo_001 5272 5.26 6.28 4.99 58 RDNS_DYNAMIC 5120 1.60 6.10 0.38 59 TR_Mismatch_TLD_02 4970 1.32 5.92 0.07 60 NO_FM_NAME_IP_HOSTN 4847 1.23 5.77 0.00 61 T_Symld_Words_02 4719 1.67 5.62 0.59 62 XM_BadFromFormat 4580 1.23 5.45 0.08 63 XM_SendGrid 4480 6.06 5.33 6.25 64 HTML_SHORT_LINK_IMG_1 4271 1.10 5.09 0.02 65 FROM_MISSP_DYNIP 4033 1.03 4.80 0.00 66 XM_DIRTYINTL 3892 1.37 4.63 0.48 67 XMNumbers 3853 4.20 4.59 4.09 68 HTML_MIME_NO_HTML_TAG 3804 2.19 4.53 1.56 69 RCVD_IN_MSPIKE_BL 3749 1.99 4.46 1.32 70 BAYES_95 3728 2.04 4.44 1.39 71 RELAYCOUNTRY_CA 3728 2.52 4.44 2.00 72 RCVD_IN_BL_SPAMCOP_NET 3468 1.57 4.13 0.87 73 SpammyFromTLD_02 3421 0.96 4.07 0.11 74 HDRS_LCASE_IMGONLY 3330 0.85 3.97 0.01 75 FROM_EXCESS_BASE64 3228 3.95 3.84 3.98 76 BAYES_40 3203 4.36 3.81 4.51 77 HTML_IMAGE_RATIO_06 3133 3.42 3.73 3.33 78 SUBJ_ALL_CAPS 3077 2.52 3.66 2.20 79 XMSexyCombo_01 3051 1.53 3.63 0.95 80 RELAYCOUNTRY_DE 3031 1.00 3.61 0.29 81 MIME_QP_LONG_LINE 2992 3.99 3.56 4.10 82 URI_HEX 2840 1.81 3.38 1.38 83 MIME_HTML_ONLY_MULTI 2837 4.79 3.38 5.18 84 XM_CamelCaseFrm001 2828 2.48 3.37 2.24 85 DIET_1 2812 1.07 3.35 0.45 86 URIBL_DBL_ABUSE_REDIR 2774 1.08 3.30 0.48 87 DKIM_ADSP_NXDOMAIN 2733 1.01 3.25 0.40 88 XMStrtUSub 2683 3.95 3.19 4.15 89 XM_OfRef6 2588 1.74 3.08 1.37 90 BAYES_00 2507 24.54 2.99 30.40 91 BAYES_20 2482 3.73 2.96 3.94 92 REPLYTO_WITHOUT_TO_CC 2475 0.65 2.95 0.03 93 HTML_IMAGE_ONLY_12 2444 0.71 2.91 0.12 94 T_TooManySym_01 2420 4.84 2.88 5.37 95 RCVD_IN_RP_RNBL 2405 0.71 2.86 0.12 96 BOTNET_NORDNS 2395 0.63 2.85 0.03 97 XM_URI_RBL 2375 0.78 2.83 0.22 98 TM2_M_URI_OPT_OUT 2307 11.42 2.75 13.78 99 RELAYCOUNTRY_FR 2273 0.78 2.71 0.26 100 XMBody_17 2257 1.19 2.69 0.79 101 RCVD_IN_MSPIKE_WL 2229 7.68 2.65 9.04 102 RCVD_IN_MSPIKE_H3 2229 7.68 2.65 9.04 103 XMBdyGiftCard01 2222 1.92 2.65 1.72 104 RCVD_IN_MSPIKE_L3 2082 1.18 2.48 0.83 105 TR_XM_PHPDW 2080 0.96 2.48 0.55 106 T_XMDrugObfuBody_08 2057 1.51 2.45 1.25 107 FROM_SUSPICIOUS_NTLD 2052 0.53 2.44 0.02 108 HTML_TAG_BALANCE_CENTER 2051 0.58 2.44 0.08 109 TR_XM_DK_Bayes 2041 13.92 2.43 17.04 110 FROM_SUSPICIOUS_NTLD_FP 2040 0.53 2.43 0.01 111 TR_XM_PHPForged 2031 0.94 2.42 0.53 112 XMDiploma_00 2013 1.38 2.40 1.10 113 TR_XM_FormFill2 2010 0.93 2.39 0.53 114 XM_H_PHPOS 2005 0.92 2.39 0.53 115 MIME_HEADER_CTYPE_ONLY 1998 0.66 2.38 0.19 116 HTML_IMAGE_RATIO_08 1993 2.59 2.37 2.64 117 XM_B_Unsub2 1973 1.26 2.35 0.97 118 XM_B_SpammyTLD 1969 1.94 2.34 1.82 119 TR_XM_DK_SendGrid 1960 3.35 2.33 3.62 120 PDS_OTHER_BAD_TLD 1920 1.01 2.29 0.66 121 DATE_IN_PAST_03_06 1919 0.54 2.29 0.07 122 RCVD_IN_RP_SAFE 1902 10.11 2.26 12.24 123 XMSubMetaI_00 1894 1.25 2.26 0.98 124 ALL_TRUSTED 1823 17.64 2.17 21.84 125 RCVD_IN_RP_CERTIFIED 1698 9.31 2.02 11.29 126 XMHTML_After_End 1645 0.74 1.96 0.41 127 TR_XM_INV_DKIM 1623 0.58 1.93 0.21 128 T_XMDrugObfuBody_14 1605 1.84 1.91 1.83 129 XMStockSpam_06 1587 1.28 1.89 1.11 130 TM2_M_VERY_LONG_WORD 1578 1.48 1.88 1.37 131 URI_TRY_3LD 1550 1.43 1.85 1.32 132 XM_H_PHPOS_M 1547 0.65 1.84 0.33 133 XMSexyCombo_04 1533 0.66 1.83 0.35 134 XMSlimDrugH 1507 0.72 1.79 0.43 135 SpammyFromTLD_01 1500 0.63 1.79 0.32 136 DKIM_ADSP_CUSTOM_MED 1498 0.95 1.78 0.73 137 MPART_ALT_DIFF_COUNT 1484 0.60 1.77 0.28 138 XMGenDplmaNmb 1453 0.84 1.73 0.60 139 TR_Mismatch_TLD_01 1450 0.59 1.73 0.28 140 TR_Symld_Words 1422 1.63 1.69 1.62 141 XM_H_PHPMailer 1414 0.74 1.68 0.48 142 TR_XM_DK_Bayes1 1408 13.25 1.68 16.39 143 RCVD_IN_MSPIKE_L5 1401 0.53 1.67 0.22 144 HDRS_MISSP 1381 0.36 1.64 0.01 145 FORGED_GMAIL_RCVD 1374 0.68 1.64 0.42 146 NML_ADSP_CUSTOM_MED 1364 0.77 1.62 0.54 147 TR_LOTS_OF_MONEY3 1346 0.72 1.60 0.48 148 XM_UB60 1320 0.39 1.57 0.06 149 RELAYCOUNTRY_IN 1312 0.40 1.56 0.08 150 MISSING_HEADERS 1295 0.47 1.54 0.18 151 BAYES_05 1266 3.12 1.51 3.56 152 URIBL_CSS_A 1237 0.33 1.47 0.02 153 URIBL_CSS 1237 0.33 1.47 0.02 154 RCVD_IN_IADB_LISTED 1226 3.57 1.46 4.14 155 TR_XM_DK_Bayes2 1226 12.33 1.46 15.29 156 XM_UB80 1136 0.30 1.35 0.02 157 RCVD_IN_IADB_SPF 1110 3.00 1.32 3.46 158 MAILING_LIST_MULTI 1089 1.53 1.30 1.59 159 XMSolicitRefs_0 1086 0.50 1.29 0.28 160 TO_EQ_FM_DOM_HTML_IMG 1077 0.28 1.28 0.00 161 RCVD_IN_IADB_SENDERID 1067 2.64 1.27 3.01 162 RCVD_IN_IADB_DK 1065 2.53 1.27 2.88 163 TR_XM_RelayPhish 1050 0.39 1.25 0.15 164 HTML_TAG_BALANCE_BODY 1026 0.73 1.22 0.59 165 XM_UB99 1017 0.26 1.21 0.00 166 XM_OfRef7 1009 0.35 1.20 0.12 167 URIBL_DBL_SPAM 1005 0.28 1.20 0.03 168 XM_ProductURIs 992 1.15 1.18 1.14 169 TR_Sbj_FN_Bdy 962 0.33 1.15 0.11 170 T_XMDrugObfuBody_00 949 0.90 1.13 0.84 171 DATE_IN_PAST_12_24 948 0.27 1.13 0.04 172 TM2_M_A_HREF_HREF 933 1.00 1.11 0.97 173 T_XMHurry_00 932 0.77 1.11 0.68 174 T_FILL_THIS_FORM_SHORT 921 0.99 1.10 0.96 175 XMBrknScrpt_02 911 0.58 1.08 0.44 176 TooManyTo_002 909 0.98 1.08 0.95 177 XMPhish08 897 0.76 1.07 0.68 178 RCVD_IN_PSBL 868 0.22 1.03 0.00 179 XM_SPF_Unknown 867 0.43 1.03 0.26 180 XM_DK_Undo_01 863 1.14 1.03 1.17 181 THIS_AD 827 0.66 0.98 0.58 182 SHORT_IMG_SUSP_NTLD 826 0.21 0.98 0.00 183 T_TooManySym_02 823 2.57 0.98 3.00 184 TR_Caps_n_Bayes_99 816 0.28 0.97 0.09 185 RELAYCOUNTRY_GB 814 0.71 0.97 0.64 186 HTML_SHORT_LINK_IMG_2 799 0.25 0.95 0.05 187 XMSubGiftCard1 799 0.36 0.95 0.20 188 RELAYCOUNTRY_AT 799 0.40 0.95 0.26 189 XM_Nigeria_01 788 0.22 0.94 0.03 190 URIBL_BLACK 787 0.21 0.94 0.01 191 UNPARSEABLE_RELAY 785 2.65 0.93 3.11 192 LongTLD 782 0.29 0.93 0.11 193 TooManyTo_003 753 0.70 0.90 0.64 194 XMBody_78 748 0.43 0.89 0.31 195 XMPhish30 736 0.57 0.88 0.49 196 FVGT_m_MULTI_ODD_EMAIL 731 0.21 0.87 0.03 197 T_MONEY_PERCENT 729 0.56 0.87 0.48 198 TR_LOTS_OF_MONEY2 729 0.56 0.87 0.48 199 URIBL_SBL_A 724 0.39 0.86 0.26 200 DEAR_FRIEND 712 0.21 0.85 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 245183 82.48 94.18 79.31 2 RELAYCOUNTRY_US 230451 75.58 79.38 74.54 3 DKIM_SIGNED 219388 72.15 76.49 70.96 4 XM_DK_Pass 216707 71.07 74.66 70.10 5 XM_B_Unicode 210538 69.40 74.18 68.10 6 DKIM_VALID 208630 67.20 66.14 67.49 7 DCC_CHECK_NEGATIVE 170733 47.71 20.05 55.23 8 DKIM_VALID_AU 166400 52.94 49.67 53.83 9 XMListUnsubscribeExists 162383 54.73 62.85 52.53 10 BAYES_50 139639 45.23 45.48 45.17 11 DCC_CHECK 134982 50.95 77.80 43.66 12 XM_B_Unicode3 131458 44.10 49.93 42.52 13 BAYES_00 93969 24.54 2.99 30.40 14 HTML_FONT_LOW_CONTRAST 85142 28.97 34.22 27.54 15 DKIM_VALID_EF 76712 24.55 23.58 24.81 16 LOC_TINY_FONT_1 76514 26.27 31.85 24.75 17 MIME_HTML_ONLY 75344 27.83 40.57 24.37 18 ALL_TRUSTED 67511 17.64 2.17 21.84 19 T_TM2_M_HEADER_IN_MSG 65379 20.62 18.68 21.15 20 XMSubLong 60781 20.54 23.76 19.66 21 FVGT_m_MULTI_ODD 58989 19.98 23.30 19.08 22 XM_Multi_Part_URI 53237 17.36 17.86 17.22 23 TR_XM_DK_Bayes 52679 13.92 2.43 17.04 24 TR_XM_DK_Bayes1 50683 13.25 1.68 16.39 25 TR_XM_DK_Bayes2 47259 12.33 1.46 15.29 26 T_KAM_HTML_FONT_INVALID 45105 15.46 18.66 14.59 27 TM2_M_URI_OPT_OUT 42602 11.42 2.75 13.78 28 XM_Body_Dirty_Words 40937 14.86 20.84 13.24 29 RCVD_IN_RP_SAFE 37847 10.11 2.26 12.24 30 ANY_BOUNCE_MESSAGE 36510 9.36 0.33 11.81 31 BOUNCE_MESSAGE 36510 9.36 0.33 11.81 32 RCVD_IN_RP_CERTIFIED 34904 9.31 2.02 11.29 33 RCVD_IN_MSPIKE_H2 33037 10.48 9.71 10.69 34 XM_B_Unsub 31762 11.40 15.57 10.27 35 HTML_IMAGE_RATIO_02 31271 10.91 13.83 10.12 36 LOTS_OF_MONEY 31265 11.84 18.20 10.11 37 XM_Evil_Numbers_Gen 28691 9.72 11.32 9.28 38 XM_DKIMWhitelistDomains 27980 7.12 0.02 9.05 39 RCVD_IN_MSPIKE_H3 27951 7.68 2.65 9.04 40 RCVD_IN_MSPIKE_WL 27951 7.68 2.65 9.04 41 XM_B_Phish_Phrases 24635 7.76 6.97 7.97 42 FSL_BULK_SIG 24057 10.04 18.37 7.78 43 LotsOfNums_01 22218 7.11 6.84 7.19 44 XM_DK_Undo_02 22176 12.73 33.18 7.17 45 MPART_ALT_DIFF 20502 6.75 7.20 6.63 46 XM_SendGrid 19336 6.06 5.33 6.25 47 HTML_IMAGE_RATIO_04 17738 5.94 6.70 5.74 48 XM_H_Long_From01 17626 5.85 6.37 5.70 49 BOTNET_IPINHOSTNAME 16665 7.41 14.85 5.39 50 T_TooManySym_01 16595 4.84 2.88 5.37 51 XMSexyCombo_05 16300 6.85 12.66 5.27 52 MIME_HTML_ONLY_MULTI 16006 4.79 3.38 5.18 53 TooManyTo_001 15423 5.26 6.28 4.99 54 RELAYCOUNTRY_META 14575 8.19 20.97 4.71 55 BAYES_60 13981 5.40 8.64 4.52 56 BAYES_40 13957 4.36 3.81 4.51 57 XMSubMetaSx_00 13676 5.64 10.14 4.42 58 XMStrtUSub 12830 3.95 3.19 4.15 59 RCVD_IN_IADB_LISTED 12810 3.57 1.46 4.14 60 MIME_QP_LONG_LINE 12680 3.99 3.56 4.10 61 XMNumbers 12643 4.20 4.59 4.09 62 BAYES_99 12512 7.80 21.63 4.05 63 FROM_EXCESS_BASE64 12317 3.95 3.84 3.98 64 BAYES_20 12188 3.73 2.96 3.94 65 XM_H_Trusted_IP 11705 2.98 0.00 3.79 66 TR_XM_DK_SendGrid 11194 3.35 2.33 3.62 67 BAYES_05 11018 3.12 1.51 3.56 68 DKIM_INVALID 10758 4.95 10.35 3.48 69 RCVD_IN_IADB_SPF 10700 3.00 1.32 3.46 70 T_REMOTE_IMAGE 10642 5.22 11.75 3.44 71 BAYES_999 10476 6.13 16.22 3.39 72 XM_UncommonTLD01 10368 5.91 15.31 3.35 73 HTML_IMAGE_RATIO_06 10300 3.42 3.73 3.33 74 UNPARSEABLE_RELAY 9621 2.65 0.93 3.11 75 RCVD_IN_IADB_VOUCHED 9309 2.47 0.45 3.01 76 RCVD_IN_IADB_SENDERID 9297 2.64 1.27 3.01 77 T_TooManySym_02 9284 2.57 0.98 3.00 78 IN_ZIMBRA_NJ_WHITELIST 9115 2.32 0.02 2.95 79 RCVD_IN_IADB_DK 8900 2.53 1.27 2.88 80 HTML_IMAGE_RATIO_08 8172 2.59 2.37 2.64 81 MIME_HTML_MOSTLY 7784 3.35 6.42 2.52 82 TVD_RCVD_IP 7695 2.10 0.68 2.49 83 INVALID_MSGID 7683 2.02 0.31 2.49 84 BOTNET 7664 6.84 22.87 2.48 85 BAYES_80 7338 3.65 8.36 2.37 86 TR_DCC_Bayes_99 6962 4.89 14.59 2.25 87 XM_CamelCaseFrm001 6927 2.48 3.37 2.24 88 TO_MALFORMED 6830 1.74 0.03 2.21 89 SUBJ_ALL_CAPS 6813 2.52 3.66 2.20 90 XM_PDF 6739 1.77 0.28 2.18 91 NO_DNS_FOR_FROM 6665 3.81 9.88 2.16 92 CK_HELO_DYNAMIC_SPLIT_IP 6335 1.66 0.23 2.05 93 HELO_DYNAMIC_IPADDR2 6334 1.62 0.06 2.05 94 RCVD_IN_IADB_OPTIN 6230 1.67 0.38 2.02 95 RELAYCOUNTRY_CA 6168 2.52 4.44 2.00 96 T_XMDrugObfuBody_14 5644 1.84 1.91 1.83 97 XM_B_SpammyTLD 5639 1.94 2.34 1.82 98 XMBdyGiftCard01 5308 1.92 2.65 1.72 99 XMSubNoVowel 5118 1.43 0.62 1.66 100 USER_IN_DEF_DKIM_WL 5060 1.31 0.09 1.64 101 TR_Symld_Words 4993 1.63 1.69 1.62 102 MAILING_LIST_MULTI 4920 1.53 1.30 1.59 103 HTML_MIME_NO_HTML_TAG 4814 2.19 4.53 1.56 104 IN_HORDE_ADDRESS_BOOK 4688 1.20 0.05 1.52 105 UNTRUSTED_Relay 4465 4.15 14.09 1.44 106 BAYES_95 4300 2.04 4.44 1.39 107 URI_HEX 4265 1.81 3.38 1.38 108 XM_OfRef6 4250 1.74 3.08 1.37 109 TM2_M_VERY_LONG_WORD 4240 1.48 1.88 1.37 110 URI_TRY_3LD 4090 1.43 1.85 1.32 111 RCVD_IN_MSPIKE_BL 4080 1.99 4.46 1.32 112 T_XMDrugObfuBody_08 3874 1.51 2.45 1.25 113 XM_H_Long_From02 3658 1.09 0.73 1.18 114 XM_DK_Undo_01 3631 1.14 1.03 1.17 115 XM_SPF_SoftFail 3616 2.34 6.66 1.17 116 XM_RXBody 3546 1.06 0.75 1.15 117 XM_ProductURIs 3513 1.15 1.18 1.14 118 XMStockSpam_06 3432 1.28 1.89 1.11 119 XMDiploma_00 3412 1.38 2.40 1.10 120 XM_GoogleGroups 3362 0.95 0.45 1.09 121 TR_MSPIKEBAYES00 3242 0.83 0.01 1.05 122 KHOP_HELO_FCRDNS 3182 2.59 8.32 1.03 123 XMGappySubj_01 3130 0.82 0.10 1.01 124 XMSubMetaI_00 3022 1.25 2.26 0.98 125 TM2_M_A_HREF_HREF 3006 1.00 1.11 0.97 126 XM_B_Unsub2 2992 1.26 2.35 0.97 127 T_FILL_THIS_FORM_SHORT 2955 0.99 1.10 0.96 128 XMSexyCombo_01 2949 1.53 3.63 0.95 129 TooManyTo_002 2933 0.98 1.08 0.95 130 RCVD_IN_BL_SPAMCOP_NET 2697 1.57 4.13 0.87 131 T_XMDrugObfuBody_00 2607 0.90 1.13 0.84 132 RCVD_IN_MSPIKE_L3 2575 1.18 2.48 0.83 133 HTML_FONT_FACE_BAD 2542 0.79 0.66 0.82 134 XMBody_95 2535 0.66 0.07 0.82 135 XM_UB50 2439 2.25 7.62 0.79 136 XMBody_17 2427 1.19 2.69 0.79 137 XM_B_REG_HTML 2328 0.72 0.59 0.75 138 PLING_QUERY 2277 0.68 0.48 0.74 139 DKIM_ADSP_CUSTOM_MED 2249 0.95 1.78 0.73 140 USER_IN_WHITELIST 2159 0.55 0.00 0.70 141 XM_D_tchamptons_WL 2121 0.54 0.00 0.69 142 XMPhish08 2108 0.76 1.07 0.68 143 T_XMHurry_00 2103 0.77 1.11 0.68 144 TR_MetaPhish_Combo_01 2053 0.64 0.55 0.66 145 PDS_OTHER_BAD_TLD 2031 1.01 2.29 0.66 146 TooManyTo_003 1994 0.70 0.90 0.64 147 RELAYCOUNTRY_GB 1992 0.71 0.97 0.64 148 XMGenDplmaNmb 1849 0.84 1.73 0.60 149 T_Symld_Words_02 1836 1.67 5.62 0.59 150 HTML_TAG_BALANCE_BODY 1835 0.73 1.22 0.59 151 THIS_AD 1784 0.66 0.98 0.58 152 XMSubMetaSxObfu_02 1783 0.54 0.39 0.58 153 HELO_NODOT 1782 0.56 0.51 0.58 154 HELO_NO_DOMAIN 1769 0.55 0.47 0.57 155 TR_XM_PHPDW 1711 0.96 2.48 0.55 156 T_TooManySym_03 1685 0.46 0.15 0.55 157 FILL_THIS_FORM 1670 0.53 0.52 0.54 158 NML_ADSP_CUSTOM_MED 1667 0.77 1.62 0.54 159 TR_XM_PHPForged 1648 0.94 2.42 0.53 160 XMOemUri 1646 0.46 0.17 0.53 161 TR_XM_FormFill2 1635 0.93 2.39 0.53 162 XM_H_PHPOS 1624 0.92 2.39 0.53 163 TooManyTo_004 1606 0.58 0.78 0.52 164 XM_E_Blogspot 1588 0.42 0.07 0.51 165 SHORT_SHORTNER 1575 0.54 0.64 0.51 166 XM_Body_Obfu01 1563 0.45 0.23 0.51 167 XMPhish30 1517 0.57 0.88 0.49 168 XM_H_PHPMailer 1486 0.74 1.68 0.48 169 T_MONEY_PERCENT 1485 0.56 0.87 0.48 170 TR_LOTS_OF_MONEY2 1485 0.56 0.87 0.48 171 XM_DIRTYINTL 1484 1.37 4.63 0.48 172 TR_LOTS_OF_MONEY3 1481 0.72 1.60 0.48 173 URIBL_DBL_ABUSE_REDIR 1478 1.08 3.30 0.48 174 XMHTMLBadTable_001 1451 0.54 0.80 0.47 175 HTML_IMAGE_ONLY_20 1417 0.43 0.34 0.46 176 DIET_1 1393 1.07 3.35 0.45 177 TooManyTo_005 1376 0.49 0.64 0.45 178 XM_B_COPY_HTML 1371 0.50 0.73 0.44 179 XMBrknScrpt_02 1370 0.58 1.08 0.44 180 FILL_THIS_FORM_LONG 1329 0.44 0.47 0.43 181 XMNoVowels 1329 0.51 0.80 0.43 182 XMSlimDrugH 1315 0.72 1.79 0.43 183 FORGED_GMAIL_RCVD 1300 0.68 1.64 0.42 184 T_FILL_THIS_FORM_LOAN 1300 0.39 0.26 0.42 185 XMHTML_After_End 1269 0.74 1.96 0.41 186 DKIM_ADSP_NXDOMAIN 1227 1.01 3.25 0.40 187 XMBSHREFv2 1210 0.38 0.36 0.39 188 XMRcvdHeader_15 1207 0.31 0.00 0.39 189 FSL_THIS_IS_ADV 1204 0.34 0.14 0.39 190 XMSubMetaSSx_00 1172 0.48 0.84 0.38 191 RDNS_DYNAMIC 1162 1.60 6.10 0.38 192 XMPhish14 1156 0.40 0.51 0.37 193 XMSubMetaSxObfu_03 1141 0.41 0.54 0.37 194 XMCapTrack 1126 0.33 0.20 0.36 195 HTTPS_HTTP_MISMATCH 1110 0.44 0.76 0.36 196 RELAYCOUNTRY_AU 1082 0.33 0.26 0.35 197 XMSexyCombo_04 1071 0.66 1.83 0.35 198 XMLngstWrd_00 1020 0.31 0.23 0.33 199 XM_H_PHPOS_M 1009 0.65 1.84 0.33 200 XMhairloss01 1001 0.29 0.16 0.32 ----------------------------------------------------------------------