Email: 599383 Autolearn: 0 AvgScore: 1.88 AvgScanTime: 2.15 sec Spam: 136432 Autolearn: 0 AvgScore: 12.58 AvgScanTime: 3.51 sec Ham: 462951 Autolearn: 0 AvgScore: -1.27 AvgScanTime: 1.75 sec Time Spent Running SA: 358.33 hours Time Spent Processing Spam: 132.86 hours Time Spent Processing Ham: 225.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129359 89.04 94.82 87.34 2 DCC_CHECK 106112 47.74 77.78 38.89 3 RELAYCOUNTRY_US 106078 80.41 77.75 81.19 4 DKIM_SIGNED 102579 74.29 75.19 74.03 5 XM_DK_Pass 98958 72.61 72.53 72.63 6 XM_B_Unicode 96848 69.24 70.99 68.73 7 DKIM_VALID 85281 67.45 62.51 68.91 8 XMListUnsubscribeExists 84589 52.13 62.00 49.22 9 BAYES_50 67999 50.16 49.84 50.26 10 DKIM_VALID_AU 62267 50.17 45.64 51.51 11 MIME_HTML_ONLY 58540 27.05 42.91 22.38 12 XM_B_Unicode3 58004 41.23 42.51 40.85 13 XM_DK_Undo_02 42752 12.82 31.34 7.37 14 HTML_FONT_LOW_CONTRAST 42456 27.73 31.12 26.74 15 LOC_TINY_FONT_1 42236 24.35 30.96 22.40 16 XMSubLong 34793 22.19 25.50 21.22 17 DKIM_VALID_EF 31692 25.76 23.23 26.50 18 FVGT_m_MULTI_ODD 31241 20.91 22.90 20.33 19 RELAYCOUNTRY_META 29099 9.67 21.33 6.23 20 XM_Body_Dirty_Words 28971 15.60 21.23 13.95 21 DCC_CHECK_NEGATIVE 27699 50.41 20.30 59.29 22 BOTNET 26546 6.61 19.46 2.83 23 BAYES_99 26410 7.21 19.36 3.63 24 T_KAM_HTML_FONT_INVALID 26168 17.08 19.18 16.47 25 FSL_BULK_SIG 25917 10.25 19.00 7.67 26 T_TM2_M_HEADER_IN_MSG 25609 27.41 18.77 29.96 27 XM_UncommonTLD01 23914 6.41 17.53 3.13 28 XM_B_Unsub 22701 11.78 16.64 10.35 29 XM_Multi_Part_URI 22112 12.85 16.21 11.87 30 UNTRUSTED_Relay 21143 4.80 15.50 1.64 31 BAYES_999 19835 5.67 14.54 3.05 32 BOTNET_IPINHOSTNAME 19438 6.79 14.25 4.59 33 TR_DCC_Bayes_99 19093 4.72 13.99 1.98 34 LOTS_OF_MONEY 18287 11.31 13.40 10.69 35 HTML_MIME_NO_HTML_TAG 17312 5.29 12.69 3.11 36 DKIM_INVALID 17298 6.84 12.68 5.12 37 XMSexyCombo_05 16880 6.27 12.37 4.47 38 HTML_IMAGE_RATIO_02 16878 8.16 12.37 6.92 39 T_REMOTE_IMAGE 16616 5.57 12.18 3.62 40 KHOP_HELO_FCRDNS 15244 3.92 11.17 1.78 41 XM_Evil_Numbers_Gen 13623 8.97 9.99 8.67 42 NO_DNS_FOR_FROM 13514 4.34 9.91 2.70 43 XM_UB50 13147 2.89 9.64 0.90 44 BODY_URI_ONLY 12906 2.31 9.46 0.20 45 LotsOfNums_01 12130 7.95 8.89 7.68 46 XM_H_Long_From01 11630 6.72 8.52 6.19 47 XM_BadFromFormat 11618 2.02 8.52 0.11 48 RCVD_IN_MSPIKE_H2 11321 11.14 8.30 11.98 49 HTML_SHORT_LINK_IMG_1 11048 1.86 8.10 0.02 50 BAYES_60 10864 5.33 7.96 4.56 51 MPART_ALT_DIFF 10451 5.86 7.66 5.33 52 HDRS_LCASE_IMGONLY 10449 1.76 7.66 0.02 53 BAYES_80 10309 3.36 7.56 2.13 54 XMSubMetaSx_00 10034 4.59 7.35 3.78 55 XM_B_Phish_Phrases 9818 6.71 7.20 6.56 56 HTML_IMAGE_ONLY_08 9630 1.69 7.06 0.11 57 TooManyTo_001 9599 7.55 7.04 7.71 58 XMNumbers 9293 4.37 6.81 3.65 59 RDNS_DYNAMIC 9234 1.78 6.77 0.31 60 HTML_TAG_BALANCE_CENTER 9125 1.57 6.69 0.06 61 RCVD_IN_MSPIKE_BL 9118 2.25 6.68 0.95 62 XMCapTrack 8655 2.37 6.34 1.20 63 TR_Mismatch_TLD_02 8549 1.47 6.27 0.05 64 XM_SendGrid 7716 6.28 5.66 6.46 65 SpammyFromTLD_02 7524 1.57 5.51 0.41 66 XM_SPF_SoftFail 7333 2.91 5.37 2.19 67 MIME_QP_LONG_LINE 7288 5.42 5.34 5.45 68 PDS_OTHER_BAD_TLD 7244 1.66 5.31 0.58 69 HTML_IMAGE_RATIO_04 7038 6.07 5.16 6.34 70 RELAYCOUNTRY_FR 6802 1.35 4.99 0.28 71 DATE_IN_PAST_03_06 6767 1.20 4.96 0.09 72 MIME_HTML_MOSTLY 6726 2.94 4.93 2.35 73 FROM_SUSPICIOUS_NTLD 6639 1.14 4.87 0.04 74 FROM_SUSPICIOUS_NTLD_FP 6592 1.13 4.83 0.04 75 URI_HEX 5974 2.01 4.38 1.31 76 XM_B_SpammyTLD 5600 2.71 4.10 2.30 77 BAYES_95 5519 1.94 4.05 1.32 78 XM_CamelCaseFrm001 5429 2.65 3.98 2.26 79 URIBL_RHS_DOB 5382 2.00 3.94 1.43 80 FROM_EXCESS_BASE64 5350 3.14 3.92 2.91 81 RELAYCOUNTRY_CA 5298 2.13 3.88 1.62 82 RCVD_IN_BL_SPAMCOP_NET 5096 1.72 3.74 1.13 83 FROM_MISSP_REPLYTO 5081 0.85 3.72 0.00 84 HTML_IMAGE_RATIO_06 4960 3.67 3.64 3.68 85 TM2_M_URI_OPT_OUT 4897 2.85 3.59 2.63 86 BAYES_40 4856 5.36 3.56 5.89 87 MIME_HTML_ONLY_MULTI 4726 3.40 3.46 3.38 88 RCVD_IN_MSPIKE_WL 4608 8.83 3.38 10.43 89 RCVD_IN_MSPIKE_H3 4608 8.83 3.38 10.43 90 FROM_MISSP_DYNIP 4532 0.76 3.32 0.00 91 DKIM_ADSP_NXDOMAIN 4530 0.99 3.32 0.30 92 RCVD_IN_MSPIKE_L3 4461 1.22 3.27 0.61 93 XMStrtUSub 4379 3.88 3.21 4.08 94 T_XMDrugObfuBody_08 4089 2.10 3.00 1.83 95 XM_DIRTYINTL 4021 1.11 2.95 0.57 96 XMBody_17 3954 1.24 2.90 0.75 97 BAYES_20 3897 4.47 2.86 4.94 98 BAYES_00 3864 18.86 2.83 23.58 99 XMDiploma_00 3799 1.83 2.78 1.55 100 SpammyFromTLD_01 3754 1.20 2.75 0.74 101 RCVD_IN_RP_RNBL 3736 0.71 2.74 0.12 102 TR_XM_INV_DKIM 3665 0.72 2.69 0.14 103 T_TooManySym_01 3650 4.73 2.68 5.33 104 DATE_IN_PAST_06_12 3426 0.60 2.51 0.04 105 HTML_IMAGE_ONLY_12 3378 0.72 2.48 0.20 106 TR_XM_PHPDW 3350 1.09 2.46 0.68 107 RELAYCOUNTRY_IN 3339 0.65 2.45 0.12 108 XM_URI_RBL 3314 0.69 2.43 0.17 109 XM_B_Unsub2 3295 2.19 2.42 2.13 110 TR_XM_DK_SendGrid 3279 3.19 2.40 3.42 111 T_XMDrugObfuBody_14 3231 1.98 2.37 1.86 112 HTML_IMAGE_RATIO_08 3180 2.43 2.33 2.46 113 XM_OfRef6 3150 1.72 2.31 1.55 114 TR_XM_PHPForged 3134 1.04 2.30 0.67 115 XMSexyCombo_01 3131 0.93 2.29 0.53 116 TR_XM_FormFill2 3122 1.03 2.29 0.67 117 XM_H_PHPOS 3108 1.03 2.28 0.66 118 XMGenDplmaNmb 2849 1.31 2.09 1.07 119 RCVD_IN_MSPIKE_L4 2829 0.71 2.07 0.31 120 RCVD_IN_IADB_LISTED 2804 4.54 2.06 5.27 121 BOTNET_NORDNS 2788 0.53 2.04 0.08 122 TR_XM_DK_Bayes 2741 13.37 2.01 16.71 123 XM_UB60 2704 0.50 1.98 0.06 124 ALL_TRUSTED 2671 12.16 1.96 15.16 125 RELAYCOUNTRY_GB 2642 1.56 1.94 1.45 126 RCVD_IN_IADB_SPF 2625 3.92 1.92 4.51 127 TR_LOTS_OF_MONEY2 2553 0.80 1.87 0.48 128 T_MONEY_PERCENT 2553 0.80 1.87 0.48 129 RCVD_IN_IADB_SENDERID 2550 3.45 1.87 3.92 130 RCVD_IN_IADB_DK 2539 3.35 1.86 3.80 131 LongTLD 2356 0.51 1.73 0.14 132 TM2_M_VERY_LONG_WORD 2320 1.47 1.70 1.40 133 BAYES_05 2282 3.10 1.67 3.52 134 XMStockSpam_06 2232 1.23 1.64 1.12 135 RCVD_IN_RP_SAFE 2212 7.70 1.62 9.49 136 XMBrknScrpt_02 2133 0.74 1.56 0.50 137 URI_TRY_3LD 2076 1.60 1.52 1.62 138 T_XMDrugObfuBody_00 2059 1.21 1.51 1.13 139 XM_DK_Undo_01 2049 1.82 1.50 1.91 140 HDRS_MISSP 2038 0.35 1.49 0.01 141 SUBJ_ALL_CAPS 2030 1.78 1.49 1.87 142 XMSubMetaI_00 2022 0.76 1.48 0.54 143 TR_Symld_Words 2011 1.86 1.47 1.98 144 XMHTML_After_End 1978 0.85 1.45 0.67 145 MIME_HEADER_CTYPE_ONLY 1946 0.58 1.43 0.33 146 HTML_IMAGE_ONLY_04 1937 0.37 1.42 0.06 147 RCVD_IN_RP_CERTIFIED 1916 7.04 1.40 8.70 148 NORDNS_LOW_CONTRAST 1888 0.32 1.38 0.01 149 XM_H_PHPMailer 1833 0.70 1.34 0.50 150 RCVD_IN_MSPIKE_L5 1828 0.32 1.34 0.03 151 TR_LOTS_OF_MONEY3 1824 0.58 1.34 0.35 152 SHORT_IMG_SUSP_NTLD 1802 0.30 1.32 0.00 153 FVGT_m_MULTI_ODD_EMAIL 1762 0.31 1.29 0.02 154 TR_XM_DK_Bayes1 1739 12.47 1.27 15.77 155 XM_H_Long_From02 1737 1.16 1.27 1.13 156 URIBL_SBL_A 1727 0.49 1.27 0.26 157 RELAYCOUNTRY_DE 1671 0.58 1.22 0.39 158 XM_H_PHPOS_M 1662 0.47 1.22 0.25 159 XM_H_TOP 1648 0.28 1.21 0.00 160 MAILING_LIST_MULTI 1636 2.30 1.20 2.62 161 RELAYCOUNTRY_RU 1621 0.29 1.19 0.03 162 TM2_M_A_HREF_HREF 1594 0.81 1.17 0.70 163 TR_XM_DK_Bayes2 1569 10.95 1.15 13.83 164 XM_ProductURIs 1564 0.78 1.15 0.68 165 RCVD_IN_PSBL 1558 0.30 1.14 0.05 166 T_XMHurry_00 1537 0.60 1.13 0.45 167 XMSlimDrugH 1536 0.61 1.13 0.45 168 XMNoVowels 1462 1.24 1.07 1.29 169 DKIM_ADSP_CUSTOM_MED 1459 1.09 1.07 1.09 170 XMBdyGiftCard01 1441 1.18 1.06 1.22 171 TR_M_TOP_BAYES 1409 0.24 1.03 0.00 172 XMMoneyMeta_00 1343 0.55 0.98 0.43 173 NO_FM_NAME_IP_HOSTN 1334 0.22 0.98 0.00 174 HK_RANDOM_FROM 1322 0.32 0.97 0.13 175 XMBody_78 1319 0.48 0.97 0.33 176 T_FILL_THIS_FORM_SHORT 1319 1.17 0.97 1.23 177 THIS_AD 1300 0.32 0.95 0.14 178 RELAYCOUNTRY_IT 1296 0.25 0.95 0.04 179 FORGED_GMAIL_RCVD 1271 0.57 0.93 0.46 180 XM_UB80 1270 0.23 0.93 0.03 181 MPART_ALT_DIFF_COUNT 1256 0.45 0.92 0.31 182 HK_RANDOM_ENVFROM 1252 0.31 0.92 0.13 183 REMOVE_BEFORE_LINK 1250 0.47 0.92 0.34 184 T_Symld_Words_02 1231 0.62 0.90 0.54 185 UNPARSEABLE_RELAY 1210 1.84 0.89 2.12 186 HTML_SHORT_CENTER 1203 0.20 0.88 0.00 187 XM_B_COPY_HTML 1200 0.46 0.88 0.34 188 XMSubMetaSxObfu_03 1167 0.63 0.86 0.56 189 FSL_THIS_IS_ADV 1153 0.33 0.85 0.18 190 XM_UB99 1147 0.20 0.84 0.00 191 SUBJ_DOLLARS 1146 0.47 0.84 0.36 192 XM_SPF_Unknown 1136 0.69 0.83 0.65 193 DIET_1 1135 0.45 0.83 0.33 194 TR_Mismatch_TLD_01 1118 0.36 0.82 0.23 195 XM_H_MailChimp 1103 0.30 0.81 0.14 196 HTTPS_HTTP_MISMATCH 1102 0.62 0.81 0.56 197 NML_ADSP_CUSTOM_MED 1099 0.83 0.81 0.84 198 TR_XM_RelayPhish 1097 0.32 0.80 0.18 199 XMPhish30 1093 0.54 0.80 0.47 200 XMSexyCombo_04 1063 0.28 0.78 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 404361 89.04 94.82 87.34 2 RELAYCOUNTRY_US 375876 80.41 77.75 81.19 3 DKIM_SIGNED 342724 74.29 75.19 74.03 4 XM_DK_Pass 336260 72.61 72.53 72.63 5 DKIM_VALID 319021 67.45 62.51 68.91 6 XM_B_Unicode 318181 69.24 70.99 68.73 7 DCC_CHECK_NEGATIVE 274474 50.41 20.30 59.29 8 DKIM_VALID_AU 238472 50.17 45.64 51.51 9 BAYES_50 232681 50.16 49.84 50.26 10 XMListUnsubscribeExists 227850 52.13 62.00 49.22 11 XM_B_Unicode3 189115 41.23 42.51 40.85 12 DCC_CHECK 180031 47.74 77.78 38.89 13 T_TM2_M_HEADER_IN_MSG 138711 27.41 18.77 29.96 14 HTML_FONT_LOW_CONTRAST 123780 27.73 31.12 26.74 15 DKIM_VALID_EF 122703 25.76 23.23 26.50 16 BAYES_00 109184 18.86 2.83 23.58 17 LOC_TINY_FONT_1 103710 24.35 30.96 22.40 18 MIME_HTML_ONLY 103616 27.05 42.91 22.38 19 XMSubLong 98236 22.19 25.50 21.22 20 FVGT_m_MULTI_ODD 94100 20.91 22.90 20.33 21 TR_XM_DK_Bayes 77370 13.37 2.01 16.71 22 T_KAM_HTML_FONT_INVALID 76227 17.08 19.18 16.47 23 TR_XM_DK_Bayes1 72996 12.47 1.27 15.77 24 ALL_TRUSTED 70197 12.16 1.96 15.16 25 XM_Body_Dirty_Words 64562 15.60 21.23 13.95 26 TR_XM_DK_Bayes2 64048 10.95 1.15 13.83 27 RCVD_IN_MSPIKE_H2 55448 11.14 8.30 11.98 28 XM_Multi_Part_URI 54935 12.85 16.21 11.87 29 LOTS_OF_MONEY 49495 11.31 13.40 10.69 30 RCVD_IN_MSPIKE_WL 48297 8.83 3.38 10.43 31 RCVD_IN_MSPIKE_H3 48297 8.83 3.38 10.43 32 XM_B_Unsub 47907 11.78 16.64 10.35 33 RCVD_IN_RP_SAFE 43916 7.70 1.62 9.49 34 RCVD_IN_RP_CERTIFIED 40291 7.04 1.40 8.70 35 XM_Evil_Numbers_Gen 40119 8.97 9.99 8.67 36 TooManyTo_001 35674 7.55 7.04 7.71 37 XM_DKIMWhitelistDomains 35598 5.97 0.16 7.69 38 LotsOfNums_01 35546 7.95 8.89 7.68 39 FSL_BULK_SIG 35497 10.25 19.00 7.67 40 XM_DK_Undo_02 34104 12.82 31.34 7.37 41 HTML_IMAGE_RATIO_02 32059 8.16 12.37 6.92 42 XM_B_Phish_Phrases 30387 6.71 7.20 6.56 43 XM_SendGrid 29914 6.28 5.66 6.46 44 HTML_IMAGE_RATIO_04 29361 6.07 5.16 6.34 45 RELAYCOUNTRY_META 28838 9.67 21.33 6.23 46 XM_H_Long_From01 28641 6.72 8.52 6.19 47 BAYES_40 27264 5.36 3.56 5.89 48 MIME_QP_LONG_LINE 25212 5.42 5.34 5.45 49 T_TooManySym_01 24677 4.73 2.68 5.33 50 MPART_ALT_DIFF 24664 5.86 7.66 5.33 51 XM_PDF 24494 4.25 0.71 5.29 52 RCVD_IN_IADB_LISTED 24405 4.54 2.06 5.27 53 DKIM_INVALID 23703 6.84 12.68 5.12 54 BAYES_20 22887 4.47 2.86 4.94 55 BOTNET_IPINHOSTNAME 21269 6.79 14.25 4.59 56 BAYES_60 21102 5.33 7.96 4.56 57 RCVD_IN_IADB_SPF 20860 3.92 1.92 4.51 58 XMSexyCombo_05 20711 6.27 12.37 4.47 59 XMStrtUSub 18886 3.88 3.21 4.08 60 RCVD_IN_IADB_SENDERID 18130 3.45 1.87 3.92 61 IN_ZIMBRA_NJ_WHITELIST 18109 3.02 0.01 3.91 62 RCVD_IN_IADB_DK 17570 3.35 1.86 3.80 63 XMSubMetaSx_00 17497 4.59 7.35 3.78 64 XM_H_Trusted_IP 17058 2.85 0.00 3.68 65 HTML_IMAGE_RATIO_06 17049 3.67 3.64 3.68 66 XMNumbers 16914 4.37 6.81 3.65 67 BAYES_99 16792 7.21 19.36 3.63 68 T_REMOTE_IMAGE 16748 5.57 12.18 3.62 69 RCVD_IN_IADB_VOUCHED 16594 2.88 0.51 3.58 70 BAYES_05 16314 3.10 1.67 3.52 71 TR_XM_DK_SendGrid 15832 3.19 2.40 3.42 72 MIME_HTML_ONLY_MULTI 15636 3.40 3.46 3.38 73 XM_UncommonTLD01 14490 6.41 17.53 3.13 74 HTML_MIME_NO_HTML_TAG 14417 5.29 12.69 3.11 75 BAYES_999 14122 5.67 14.54 3.05 76 T_TooManySym_02 13791 2.46 0.71 2.98 77 FROM_EXCESS_BASE64 13478 3.14 3.92 2.91 78 ANY_BOUNCE_MESSAGE 13168 2.34 0.61 2.84 79 BOUNCE_MESSAGE 13146 2.33 0.61 2.84 80 BOTNET 13081 6.61 19.46 2.83 81 NO_DNS_FOR_FROM 12506 4.34 9.91 2.70 82 TM2_M_URI_OPT_OUT 12164 2.85 3.59 2.63 83 MAILING_LIST_MULTI 12124 2.30 1.20 2.62 84 HTML_IMAGE_RATIO_08 11369 2.43 2.33 2.46 85 MIME_HTML_MOSTLY 10885 2.94 4.93 2.35 86 XM_B_SpammyTLD 10670 2.71 4.10 2.30 87 RCVD_IN_IADB_OPTIN 10660 1.86 0.38 2.30 88 XM_CamelCaseFrm001 10446 2.65 3.98 2.26 89 XM_SPF_SoftFail 10138 2.91 5.37 2.19 90 XM_B_Unsub2 9857 2.19 2.42 2.13 91 BAYES_80 9848 3.36 7.56 2.13 92 UNPARSEABLE_RELAY 9814 1.84 0.89 2.12 93 TooManyTo_002 9180 1.67 0.61 1.98 94 TR_DCC_Bayes_99 9179 4.72 13.99 1.98 95 TR_Symld_Words 9163 1.86 1.47 1.98 96 XM_DK_Undo_01 8837 1.82 1.50 1.91 97 SUBJ_ALL_CAPS 8654 1.78 1.49 1.87 98 T_XMDrugObfuBody_14 8621 1.98 2.37 1.86 99 T_XMDrugObfuBody_08 8488 2.10 3.00 1.83 100 KHOP_HELO_FCRDNS 8254 3.92 11.17 1.78 101 TVD_RCVD_IP 7786 1.41 0.48 1.68 102 INVALID_MSGID 7677 1.33 0.19 1.66 103 XMSubNoVowel 7649 1.41 0.57 1.65 104 UNTRUSTED_Relay 7613 4.80 15.50 1.64 105 IN_HORDE_ADDRESS_BOOK 7516 1.26 0.03 1.62 106 URI_TRY_3LD 7498 1.60 1.52 1.62 107 RELAYCOUNTRY_CA 7484 2.13 3.88 1.62 108 HELO_NODOT 7261 1.36 0.64 1.57 109 HELO_NO_DOMAIN 7251 1.35 0.62 1.57 110 XMDiploma_00 7187 1.83 2.78 1.55 111 XM_OfRef6 7173 1.72 2.31 1.55 112 TO_MALFORMED 6958 1.17 0.02 1.50 113 RELAYCOUNTRY_GB 6692 1.56 1.94 1.45 114 URIBL_RHS_DOB 6631 2.00 3.94 1.43 115 TM2_M_VERY_LONG_WORD 6478 1.47 1.70 1.40 116 TooManyTo_003 6230 1.14 0.46 1.35 117 CK_HELO_DYNAMIC_SPLIT_IP 6158 1.06 0.15 1.33 118 HELO_DYNAMIC_IPADDR2 6154 1.04 0.04 1.33 119 HTML_FONT_FACE_BAD 6124 1.19 0.75 1.32 120 BAYES_95 6100 1.94 4.05 1.32 121 URI_HEX 6086 2.01 4.38 1.31 122 XMNoVowels 5995 1.24 1.07 1.29 123 T_FILL_THIS_FORM_SHORT 5678 1.17 0.97 1.23 124 XMBdyGiftCard01 5626 1.18 1.06 1.22 125 XMCapTrack 5555 2.37 6.34 1.20 126 XM_GoogleGroups 5483 1.01 0.42 1.18 127 XMGappySubj_01 5481 0.96 0.19 1.18 128 USER_IN_DEF_DKIM_WL 5423 0.91 0.01 1.17 129 RCVD_IN_BL_SPAMCOP_NET 5228 1.72 3.74 1.13 130 XM_H_Long_From02 5211 1.16 1.27 1.13 131 T_XMDrugObfuBody_00 5209 1.21 1.51 1.13 132 XMStockSpam_06 5166 1.23 1.64 1.12 133 DKIM_ADSP_CUSTOM_MED 5047 1.09 1.07 1.09 134 XMGenDplmaNmb 4975 1.31 2.09 1.07 135 TooManyTo_004 4679 0.87 0.39 1.01 136 TR_MSPIKEBAYES00 4477 0.75 0.03 0.97 137 RCVD_IN_MSPIKE_BL 4385 2.25 6.68 0.95 138 XM_UB50 4155 2.89 9.64 0.90 139 TooManyTo_005 3905 0.73 0.33 0.84 140 NML_ADSP_CUSTOM_MED 3894 0.83 0.81 0.84 141 TR_MetaPhish_Combo_01 3675 0.77 0.70 0.79 142 XMBody_17 3472 1.24 2.90 0.75 143 SpammyFromTLD_01 3432 1.20 2.75 0.74 144 FILL_THIS_FORM 3337 0.63 0.33 0.72 145 XMSolicitRefs_0 3319 0.69 0.58 0.72 146 XMBody_95 3251 0.57 0.12 0.70 147 TM2_M_A_HREF_HREF 3238 0.81 1.17 0.70 148 TR_XM_PHPDW 3158 1.09 2.46 0.68 149 XM_ProductURIs 3129 0.78 1.15 0.68 150 XM_RXBody 3127 0.61 0.40 0.68 151 XMHTML_After_End 3106 0.85 1.45 0.67 152 TR_XM_FormFill2 3081 1.03 2.29 0.67 153 TR_XM_PHPForged 3080 1.04 2.30 0.67 154 XM_H_PHPOS 3044 1.03 2.28 0.66 155 T_TooManySym_03 3024 0.54 0.17 0.65 156 XM_SPF_Unknown 3019 0.69 0.83 0.65 157 T_OBFU_PDF_ATTACH 2993 0.54 0.18 0.65 158 RELAYCOUNTRY_NL 2981 0.56 0.29 0.64 159 XMLngstWrd_00 2859 0.59 0.48 0.62 160 XM_D_tchamptons_WL 2846 0.48 0.00 0.61 161 RCVD_IN_MSPIKE_L3 2844 1.22 3.27 0.61 162 FROM_GOV_SPOOF 2745 0.56 0.46 0.59 163 FILL_THIS_FORM_LONG 2728 0.52 0.30 0.59 164 TM2_M_BODY_EMPTY 2698 0.51 0.25 0.58 165 XM_B_REG_HTML 2686 0.56 0.49 0.58 166 PDS_OTHER_BAD_TLD 2680 1.66 5.31 0.58 167 HTML_IMAGE_ONLY_20 2666 0.52 0.32 0.58 168 XMLngstWrd_01 2665 0.54 0.44 0.58 169 XM_ShortIntro_01 2635 0.53 0.39 0.57 170 XM_DIRTYINTL 2618 1.11 2.95 0.57 171 HTTPS_HTTP_MISMATCH 2615 0.62 0.81 0.56 172 FROM_GOV_DKIM_AU 2610 0.51 0.33 0.56 173 XMSubMetaSxObfu_03 2583 0.63 0.86 0.56 174 XMSubMetaI_00 2510 0.76 1.48 0.54 175 T_Symld_Words_02 2487 0.62 0.90 0.54 176 XMSexyCombo_01 2455 0.93 2.29 0.53 177 XM_H_PHPMailer 2333 0.70 1.34 0.50 178 XMBrknScrpt_02 2329 0.74 1.56 0.50 179 T_FILL_THIS_FORM_LOAN 2304 0.41 0.09 0.50 180 XMHTMLBadTable_001 2252 0.50 0.53 0.49 181 XMLngstWrd_02 2249 0.46 0.36 0.49 182 MISSING_HEADERS 2244 0.51 0.61 0.48 183 TR_LOTS_OF_MONEY2 2230 0.80 1.87 0.48 184 T_MONEY_PERCENT 2230 0.80 1.87 0.48 185 RELAYCOUNTRY_AU 2203 0.46 0.40 0.48 186 XMLKML 2173 0.36 0.00 0.47 187 XMPhish30 2157 0.54 0.80 0.47 188 FORGED_GMAIL_RCVD 2121 0.57 0.93 0.46 189 USER_IN_WHITELIST 2120 0.35 0.00 0.46 190 AC_DIV_BONANZA 2107 0.38 0.14 0.46 191 XMSlimDrugH 2093 0.61 1.13 0.45 192 T_XMHurry_00 2084 0.60 1.13 0.45 193 PLING_QUERY 1995 0.47 0.62 0.43 194 SHORT_HELO_AND_INLINE_IMAGE 1988 0.34 0.03 0.43 195 XMMoneyMeta_00 1972 0.55 0.98 0.43 196 XMRcvdHeader_15 1942 0.32 0.00 0.42 197 HTML_TAG_BALANCE_BODY 1938 0.43 0.49 0.42 198 SpammyFromTLD_02 1880 1.57 5.51 0.41 199 XMPhish08 1855 0.47 0.69 0.40 200 RELAYCOUNTRY_DE 1828 0.58 1.22 0.39 ----------------------------------------------------------------------