Email: 638312 Autolearn: 0 AvgScore: 0.95 AvgScanTime: 2.00 sec Spam: 113581 Autolearn: 0 AvgScore: 11.96 AvgScanTime: 3.53 sec Ham: 524731 Autolearn: 0 AvgScore: -1.44 AvgScanTime: 1.66 sec Time Spent Running SA: 353.78 hours Time Spent Processing Spam: 111.49 hours Time Spent Processing Ham: 242.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 107832 90.46 94.94 89.49 2 DKIM_SIGNED 89818 74.52 79.08 73.54 3 DCC_CHECK 89599 47.35 78.89 40.52 4 XM_DK_Pass 87302 73.09 76.86 72.27 5 RELAYCOUNTRY_US 86575 80.65 76.22 81.61 6 XM_B_Unicode 84094 72.72 74.04 72.43 7 XMListUnsubscribeExists 76313 53.46 67.19 50.48 8 DKIM_VALID 73920 67.78 65.08 68.37 9 DKIM_VALID_AU 54018 50.11 47.56 50.66 10 BAYES_50 52542 50.76 46.26 51.73 11 XM_B_Unicode3 50037 42.94 44.05 42.70 12 XM_DK_Undo_02 46836 12.97 41.24 6.86 13 MIME_HTML_ONLY 44254 26.58 38.96 23.90 14 LOC_TINY_FONT_1 38436 25.65 33.84 23.88 15 HTML_FONT_LOW_CONTRAST 35902 28.50 31.61 27.82 16 DKIM_VALID_EF 30759 25.83 27.08 25.56 17 FVGT_m_MULTI_ODD 28700 21.68 25.27 20.90 18 BAYES_99 28318 7.27 24.93 3.45 19 XMSubLong 28017 21.75 24.67 21.11 20 BOTNET 27174 6.44 23.92 2.65 21 T_KAM_HTML_FONT_INVALID 26069 18.53 22.95 17.58 22 RELAYCOUNTRY_META 24676 8.01 21.73 5.04 23 XM_Body_Dirty_Words 23739 14.28 20.90 12.85 24 BAYES_999 22263 5.77 19.60 2.77 25 T_TM2_M_HEADER_IN_MSG 22229 26.37 19.57 27.84 26 TR_DCC_Bayes_99 22012 4.77 19.38 1.61 27 DCC_CHECK_NEGATIVE 21985 50.77 19.36 57.57 28 XM_UncommonTLD01 20207 6.92 17.79 4.56 29 XM_Multi_Part_URI 19371 12.65 17.05 11.70 30 BOTNET_IPINHOSTNAME 17146 6.00 15.10 4.03 31 FSL_BULK_SIG 17114 9.44 15.07 8.22 32 XM_B_Unsub 16864 11.54 14.85 10.83 33 UNTRUSTED_Relay 16698 3.93 14.70 1.60 34 DKIM_INVALID 15898 6.74 14.00 5.17 35 LOTS_OF_MONEY 15636 11.36 13.77 10.84 36 HTML_IMAGE_RATIO_02 15551 8.49 13.69 7.36 37 NO_DNS_FOR_FROM 12806 4.35 11.27 2.85 38 XM_Evil_Numbers_Gen 11898 8.79 10.48 8.42 39 XMSexyCombo_05 11592 5.54 10.21 4.53 40 XM_B_Phish_Phrases 10112 6.94 8.90 6.51 41 XM_UB50 9726 2.23 8.56 0.86 42 XMSubMetaSx_00 9212 4.58 8.11 3.81 43 LotsOfNums_01 9197 7.91 8.10 7.87 44 BAYES_80 9136 3.53 8.04 2.55 45 T_REMOTE_IMAGE 8980 4.49 7.91 3.75 46 TooManyTo_001 8529 7.29 7.51 7.24 47 BAYES_60 7768 5.16 6.84 4.79 48 XM_H_Long_From01 7570 6.21 6.66 6.11 49 MPART_ALT_DIFF 7336 5.47 6.46 5.26 50 SpammyFromTLD_02 7061 1.51 6.22 0.50 51 RCVD_IN_MSPIKE_H2 6820 8.74 6.00 9.33 52 HTML_IMAGE_RATIO_04 6590 6.63 5.80 6.81 53 XMNumbers 6379 3.97 5.62 3.61 54 XM_SPF_SoftFail 6372 2.57 5.61 1.91 55 XM_CamelCaseFrm001 6178 2.60 5.44 1.99 56 MIME_QP_LONG_LINE 5567 5.62 4.90 5.78 57 KHOP_HELO_FCRDNS 5505 2.27 4.85 1.71 58 XM_SendGrid 5382 6.18 4.74 6.49 59 RELAYCOUNTRY_CA 5260 2.04 4.63 1.48 60 RCVD_IN_MSPIKE_BL 5054 1.88 4.45 1.33 61 XMStrtUSub 4973 3.71 4.38 3.57 62 PDS_OTHER_BAD_TLD 4890 1.18 4.31 0.50 63 XM_B_SpammyTLD 4865 2.63 4.28 2.27 64 TM2_M_URI_OPT_OUT 4858 2.94 4.28 2.65 65 BODY_URI_ONLY 4730 0.80 4.16 0.07 66 MIME_HTML_MOSTLY 4665 2.57 4.11 2.24 67 XM_B_Unsub2 4575 2.27 4.03 1.89 68 FROM_EXCESS_BASE64 4551 3.06 4.01 2.86 69 XM_DIRTYINTL 4418 1.12 3.89 0.52 70 HTML_MIME_NO_HTML_TAG 4376 2.72 3.85 2.47 71 RELAYCOUNTRY_FR 4360 0.93 3.84 0.30 72 BAYES_95 4354 1.88 3.83 1.46 73 ALL_TRUSTED 4295 13.05 3.78 15.06 74 RCVD_IN_BL_SPAMCOP_NET 4243 1.48 3.74 1.00 75 RCVD_IN_RP_RNBL 4165 0.82 3.67 0.20 76 T_XMDrugObfuBody_08 4010 1.98 3.53 1.64 77 RCVD_IN_MSPIKE_L3 4003 1.43 3.52 0.97 78 HTML_IMAGE_RATIO_06 3995 3.57 3.52 3.58 79 HTML_IMAGE_ONLY_08 3947 0.72 3.48 0.12 80 REPLYTO_WITHOUT_TO_CC 3922 0.72 3.45 0.13 81 HTML_SHORT_LINK_IMG_1 3909 0.63 3.44 0.02 82 HDRS_LCASE_IMGONLY 3849 0.63 3.39 0.03 83 FROM_SUSPICIOUS_NTLD 3793 0.65 3.34 0.07 84 TR_Mismatch_TLD_02 3784 0.65 3.33 0.07 85 RDNS_DYNAMIC 3739 0.81 3.29 0.27 86 FROM_SUSPICIOUS_NTLD_FP 3690 0.64 3.25 0.07 87 BAYES_40 3687 5.14 3.25 5.55 88 RCVD_IN_MSPIKE_WL 3619 8.59 3.19 9.76 89 RCVD_IN_MSPIKE_H3 3619 8.59 3.19 9.76 90 XM_URI_RBL 3557 0.71 3.13 0.19 91 MIME_HTML_ONLY_MULTI 3510 3.42 3.09 3.49 92 FROM_MISSP_REPLYTO 3451 0.55 3.04 0.01 93 SpammyFromTLD_01 3402 1.07 3.00 0.65 94 URI_HEX 3373 1.76 2.97 1.49 95 DATE_IN_PAST_03_06 3330 0.62 2.93 0.13 96 TR_Symld_Words 3310 3.36 2.91 3.46 97 T_TooManySym_01 3272 4.83 2.88 5.25 98 URIBL_SBL_A 3044 0.67 2.68 0.23 99 BAYES_20 3019 4.26 2.66 4.61 100 HTML_IMAGE_RATIO_08 2959 2.85 2.61 2.91 101 XMSexyCombo_01 2923 1.14 2.57 0.83 102 XMDiploma_00 2799 1.95 2.46 1.84 103 FROM_MISSP_DYNIP 2790 0.44 2.46 0.00 104 RCVD_IN_RP_SAFE 2790 7.22 2.46 8.25 105 BAYES_00 2788 18.53 2.45 22.01 106 TR_XM_INV_DKIM 2745 0.55 2.42 0.14 107 BOTNET_NORDNS 2731 0.49 2.40 0.07 108 HTML_IMAGE_ONLY_12 2717 0.61 2.39 0.22 109 XM_OfRef6 2687 1.60 2.37 1.43 110 LongTLD 2589 0.56 2.28 0.19 111 MIME_HEADER_CTYPE_ONLY 2564 0.60 2.26 0.24 112 TR_XM_PHPDW 2560 0.81 2.25 0.49 113 TR_XM_PHPForged 2543 0.78 2.24 0.47 114 RELAYCOUNTRY_IN 2529 0.50 2.23 0.13 115 TR_XM_FormFill2 2509 0.78 2.21 0.46 116 XM_H_PHPOS 2504 0.77 2.20 0.46 117 RCVD_IN_RP_CERTIFIED 2456 6.60 2.16 7.56 118 TO_EQ_FM_DOM_HTML_IMG 2432 0.39 2.14 0.01 119 T_XMDrugObfuBody_14 2324 1.62 2.05 1.53 120 TR_LOTS_OF_MONEY3 2264 0.81 1.99 0.55 121 XMBdyGiftCard01 2180 1.54 1.92 1.46 122 HTML_TAG_BALANCE_CENTER 2158 0.40 1.90 0.07 123 XMBody_17 2123 0.97 1.87 0.78 124 XM_BadFromFormat 2105 0.41 1.85 0.10 125 RELAYCOUNTRY_DE 2091 0.65 1.84 0.40 126 RCVD_IN_IADB_LISTED 2066 4.69 1.82 5.31 127 URI_TRY_3LD 2059 1.43 1.81 1.35 128 TR_XM_MaxBayes 2029 0.33 1.79 0.01 129 XMGenDplmaNmb 2001 1.30 1.76 1.20 130 TR_XM_DK_Bayes 1973 12.61 1.74 14.96 131 DATE_IN_PAST_06_12 1955 0.35 1.72 0.06 132 RCVD_IN_IADB_SPF 1895 4.03 1.67 4.54 133 XM_DK_Undo_01 1860 1.76 1.64 1.78 134 TM2_M_VERY_LONG_WORD 1860 1.30 1.64 1.23 135 RCVD_IN_IADB_DK 1815 3.43 1.60 3.82 136 XMCapTrack 1813 1.21 1.60 1.13 137 RCVD_IN_IADB_SENDERID 1812 3.50 1.60 3.91 138 XMStockSpam_06 1807 1.50 1.59 1.49 139 TooManyTo_002 1764 1.80 1.55 1.85 140 RCVD_IN_PSBL 1743 0.30 1.53 0.03 141 XMNoVowels 1728 1.57 1.52 1.58 142 TR_XM_DK_SendGrid 1726 3.20 1.52 3.56 143 BAYES_05 1712 3.31 1.51 3.71 144 XM_H_PHPMailer 1701 0.66 1.50 0.47 145 XM_UB60 1654 0.30 1.46 0.05 146 SUBJ_ALL_CAPS 1638 1.73 1.44 1.79 147 XMHTML_After_End 1575 0.87 1.39 0.76 148 REMOVE_BEFORE_LINK 1545 0.59 1.36 0.43 149 XM_UB99 1528 0.25 1.35 0.01 150 XMSubMetaI_00 1504 0.81 1.32 0.70 151 MISSING_HEADERS 1500 0.72 1.32 0.59 152 XM_H_PHPOS_M 1490 0.38 1.31 0.18 153 URIBL_CSS_A 1482 0.26 1.30 0.03 154 URIBL_CSS 1482 0.26 1.30 0.03 155 T_XMDrugObfuBody_00 1482 1.11 1.30 1.07 156 T_XMHurry_00 1469 0.83 1.29 0.73 157 XMSubMetaSxObfu_03 1467 1.00 1.29 0.94 158 XMBrknScrpt_02 1458 0.68 1.28 0.54 159 TooManyTo_003 1455 1.22 1.28 1.21 160 MPART_ALT_DIFF_COUNT 1438 0.61 1.27 0.47 161 DKIM_ADSP_NXDOMAIN 1431 0.47 1.26 0.30 162 RELAYCOUNTRY_GB 1413 1.00 1.24 0.94 163 HELO_NO_DOMAIN 1376 1.48 1.21 1.54 164 HELO_NODOT 1376 1.49 1.21 1.55 165 XMPhish08 1344 0.65 1.18 0.54 166 XM_H_Long_From02 1325 1.18 1.17 1.18 167 TR_Mismatch_TLD_01 1311 0.38 1.15 0.21 168 URIBL_ABUSE_SURBL 1310 0.24 1.15 0.05 169 T_Symld_Words_02 1309 0.80 1.15 0.72 170 XM_UB80 1267 0.21 1.12 0.02 171 THIS_AD 1260 0.55 1.11 0.43 172 DKIM_ADSP_CUSTOM_MED 1256 1.08 1.11 1.08 173 MAILING_LIST_MULTI 1241 2.21 1.09 2.46 174 DIET_1 1233 0.52 1.09 0.40 175 TM2_M_A_HREF_HREF 1233 0.86 1.09 0.81 176 XMMoneyMeta_00 1227 0.56 1.08 0.45 177 UNPARSEABLE_RELAY 1206 1.79 1.06 1.95 178 T_TooManySym_02 1197 1.92 1.05 2.10 179 TooManyTo_004 1179 0.91 1.04 0.88 180 TR_MetaPhish_Combo_01 1150 0.73 1.01 0.67 181 FILL_THIS_FORM_SHORT 1146 0.86 1.01 0.83 182 XM_UB999 1144 0.19 1.01 0.01 183 TR_XM_DK_Bayes1 1142 11.67 1.01 13.98 184 XM_ProductURIs 1138 0.90 1.00 0.88 185 XMPhish30 1120 0.71 0.99 0.65 186 URIBL_DBL_SPAM 1112 0.19 0.98 0.02 187 TR_XM_RelayPhish 1107 0.29 0.97 0.14 188 XMBody_78 1085 0.44 0.96 0.32 189 FORGED_GMAIL_RCVD 1075 0.58 0.95 0.51 190 TR_LOTS_OF_MONEY2 1068 0.36 0.94 0.24 191 T_MONEY_PERCENT 1068 0.36 0.94 0.24 192 HK_SCAM 1055 0.26 0.93 0.12 193 NO_FM_NAME_IP_HOSTN 1054 0.17 0.93 0.00 194 TR_XM_DK_Bayes2 1043 10.15 0.92 12.14 195 HK_RANDOM_REPLYTO 1035 0.32 0.91 0.19 196 NML_ADSP_CUSTOM_MED 1024 0.82 0.90 0.80 197 XMSubGiftCard1 1005 0.21 0.88 0.07 198 XM_H_MailChimp 1001 0.30 0.88 0.18 199 XM_ShortIntro_01 1001 0.68 0.88 0.64 200 URIBL_BLACK 978 0.17 0.86 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 469565 90.46 94.94 89.49 2 RELAYCOUNTRY_US 428248 80.65 76.22 81.61 3 DKIM_SIGNED 385867 74.52 79.08 73.54 4 XM_B_Unicode 380065 72.72 74.04 72.43 5 XM_DK_Pass 379226 73.09 76.86 72.27 6 DKIM_VALID 358759 67.78 65.08 68.37 7 DCC_CHECK_NEGATIVE 302103 50.77 19.36 57.57 8 BAYES_50 271439 50.76 46.26 51.73 9 DKIM_VALID_AU 265825 50.11 47.56 50.66 10 XMListUnsubscribeExists 264910 53.46 67.19 50.48 11 XM_B_Unicode3 224076 42.94 44.05 42.70 12 DCC_CHECK 212632 47.35 78.89 40.52 13 T_TM2_M_HEADER_IN_MSG 146096 26.37 19.57 27.84 14 HTML_FONT_LOW_CONTRAST 145989 28.50 31.61 27.82 15 DKIM_VALID_EF 134143 25.83 27.08 25.56 16 MIME_HTML_ONLY 125386 26.58 38.96 23.90 17 LOC_TINY_FONT_1 125285 25.65 33.84 23.88 18 BAYES_00 115497 18.53 2.45 22.01 19 XMSubLong 110789 21.75 24.67 21.11 20 FVGT_m_MULTI_ODD 109666 21.68 25.27 20.90 21 T_KAM_HTML_FONT_INVALID 92230 18.53 22.95 17.58 22 ALL_TRUSTED 79013 13.05 3.78 15.06 23 TR_XM_DK_Bayes 78494 12.61 1.74 14.96 24 TR_XM_DK_Bayes1 73342 11.67 1.01 13.98 25 XM_Body_Dirty_Words 67429 14.28 20.90 12.85 26 TR_XM_DK_Bayes2 63726 10.15 0.92 12.14 27 XM_Multi_Part_URI 61368 12.65 17.05 11.70 28 LOTS_OF_MONEY 56855 11.36 13.77 10.84 29 XM_B_Unsub 56828 11.54 14.85 10.83 30 RCVD_IN_MSPIKE_WL 51201 8.59 3.19 9.76 31 RCVD_IN_MSPIKE_H3 51201 8.59 3.19 9.76 32 RCVD_IN_MSPIKE_H2 48941 8.74 6.00 9.33 33 XM_Evil_Numbers_Gen 44185 8.79 10.48 8.42 34 RCVD_IN_RP_SAFE 43292 7.22 2.46 8.25 35 FSL_BULK_SIG 43137 9.44 15.07 8.22 36 LotsOfNums_01 41308 7.91 8.10 7.87 37 RCVD_IN_RP_CERTIFIED 39670 6.60 2.16 7.56 38 HTML_IMAGE_RATIO_02 38621 8.49 13.69 7.36 39 TooManyTo_001 37979 7.29 7.51 7.24 40 XM_DKIMWhitelistDomains 37431 5.87 0.02 7.13 41 XM_DK_Undo_02 35973 12.97 41.24 6.86 42 HTML_IMAGE_RATIO_04 35740 6.63 5.80 6.81 43 XM_B_Phish_Phrases 34157 6.94 8.90 6.51 44 XM_SendGrid 34039 6.18 4.74 6.49 45 XM_H_Long_From01 32082 6.21 6.66 6.11 46 MIME_QP_LONG_LINE 30305 5.62 4.90 5.78 47 BAYES_40 29132 5.14 3.25 5.55 48 RCVD_IN_IADB_LISTED 27877 4.69 1.82 5.31 49 MPART_ALT_DIFF 27594 5.47 6.46 5.26 50 T_TooManySym_01 27528 4.83 2.88 5.25 51 DKIM_INVALID 27108 6.74 14.00 5.17 52 RELAYCOUNTRY_META 26446 8.01 21.73 5.04 53 BAYES_60 25153 5.16 6.84 4.79 54 XM_PDF 24948 4.04 0.73 4.75 55 BAYES_20 24169 4.26 2.66 4.61 56 XM_UncommonTLD01 23951 6.92 17.79 4.56 57 RCVD_IN_IADB_SPF 23838 4.03 1.67 4.54 58 XMSexyCombo_05 23749 5.54 10.21 4.53 59 XM_H_Trusted_IP 23608 3.70 0.00 4.50 60 BOTNET_IPINHOSTNAME 21125 6.00 15.10 4.03 61 RCVD_IN_IADB_SENDERID 20520 3.50 1.60 3.91 62 RCVD_IN_IADB_DK 20058 3.43 1.60 3.82 63 XMSubMetaSx_00 20002 4.58 8.11 3.81 64 T_REMOTE_IMAGE 19655 4.49 7.91 3.75 65 BAYES_05 19445 3.31 1.51 3.71 66 XMNumbers 18955 3.97 5.62 3.61 67 RCVD_IN_IADB_VOUCHED 18941 3.07 0.58 3.61 68 HTML_IMAGE_RATIO_06 18796 3.57 3.52 3.58 69 XMStrtUSub 18721 3.71 4.38 3.57 70 TR_XM_DK_SendGrid 18677 3.20 1.52 3.56 71 MIME_HTML_ONLY_MULTI 18333 3.42 3.09 3.49 72 TR_Symld_Words 18163 3.36 2.91 3.46 73 BAYES_99 18103 7.27 24.93 3.45 74 IN_ZIMBRA_NJ_WHITELIST 17999 2.82 0.01 3.43 75 HTML_IMAGE_RATIO_08 15252 2.85 2.61 2.91 76 FROM_EXCESS_BASE64 15010 3.06 4.01 2.86 77 NO_DNS_FOR_FROM 14980 4.35 11.27 2.85 78 BAYES_999 14555 5.77 19.60 2.77 79 BOTNET 13924 6.44 23.92 2.65 80 TM2_M_URI_OPT_OUT 13922 2.94 4.28 2.65 81 BAYES_80 13393 3.53 8.04 2.55 82 HTML_MIME_NO_HTML_TAG 12966 2.72 3.85 2.47 83 MAILING_LIST_MULTI 12890 2.21 1.09 2.46 84 XMSubNoVowel 12672 2.09 0.57 2.41 85 ANY_BOUNCE_MESSAGE 12480 2.09 0.73 2.38 86 BOUNCE_MESSAGE 12464 2.08 0.73 2.38 87 RCVD_IN_IADB_OPTIN 12458 2.04 0.48 2.37 88 XM_B_SpammyTLD 11915 2.63 4.28 2.27 89 MIME_HTML_MOSTLY 11744 2.57 4.11 2.24 90 T_TooManySym_02 11033 1.92 1.05 2.10 91 XM_CamelCaseFrm001 10445 2.60 5.44 1.99 92 UNPARSEABLE_RELAY 10248 1.79 1.06 1.95 93 XM_SPF_SoftFail 10013 2.57 5.61 1.91 94 XM_B_Unsub2 9911 2.27 4.03 1.89 95 TooManyTo_002 9703 1.80 1.55 1.85 96 XMDiploma_00 9650 1.95 2.46 1.84 97 SUBJ_ALL_CAPS 9417 1.73 1.44 1.79 98 XM_DK_Undo_01 9354 1.76 1.64 1.78 99 KHOP_HELO_FCRDNS 8977 2.27 4.85 1.71 100 T_XMDrugObfuBody_08 8619 1.98 3.53 1.64 101 TR_DCC_Bayes_99 8452 4.77 19.38 1.61 102 UNTRUSTED_Relay 8376 3.93 14.70 1.60 103 XMNoVowels 8282 1.57 1.52 1.58 104 HELO_NODOT 8113 1.49 1.21 1.55 105 HELO_NO_DOMAIN 8071 1.48 1.21 1.54 106 T_XMDrugObfuBody_14 8021 1.62 2.05 1.53 107 URI_HEX 7839 1.76 2.97 1.49 108 XMStockSpam_06 7797 1.50 1.59 1.49 109 TVD_RCVD_IP 7784 1.34 0.66 1.48 110 RELAYCOUNTRY_CA 7751 2.04 4.63 1.48 111 IN_HORDE_ADDRESS_BOOK 7700 1.21 0.03 1.47 112 XMBdyGiftCard01 7679 1.54 1.92 1.46 113 BAYES_95 7663 1.88 3.83 1.46 114 XM_OfRef6 7526 1.60 2.37 1.43 115 INVALID_MSGID 7482 1.23 0.30 1.43 116 HTML_FONT_FACE_BAD 7377 1.26 0.56 1.41 117 TO_MALFORMED 7321 1.15 0.01 1.40 118 URI_TRY_3LD 7098 1.43 1.81 1.35 119 RCVD_IN_MSPIKE_BL 6973 1.88 4.45 1.33 120 XM_GoogleGroups 6540 1.10 0.45 1.25 121 CK_HELO_DYNAMIC_SPLIT_IP 6479 1.04 0.15 1.23 122 HELO_DYNAMIC_IPADDR2 6475 1.02 0.05 1.23 123 TM2_M_VERY_LONG_WORD 6438 1.30 1.64 1.23 124 TooManyTo_003 6351 1.22 1.28 1.21 125 XMGenDplmaNmb 6280 1.30 1.76 1.20 126 XM_H_Long_From02 6208 1.18 1.17 1.18 127 XMCapTrack 5907 1.21 1.60 1.13 128 XMGappySubj_01 5692 0.93 0.21 1.08 129 DKIM_ADSP_CUSTOM_MED 5654 1.08 1.11 1.08 130 T_XMDrugObfuBody_00 5597 1.11 1.30 1.07 131 RCVD_IN_BL_SPAMCOP_NET 5225 1.48 3.74 1.00 132 TR_MSPIKEBAYES00 5166 0.81 0.01 0.98 133 RCVD_IN_MSPIKE_L3 5107 1.43 3.52 0.97 134 USER_IN_DEF_DKIM_WL 4965 0.78 0.00 0.95 135 RELAYCOUNTRY_GB 4952 1.00 1.24 0.94 136 XMSubMetaSxObfu_03 4921 1.00 1.29 0.94 137 XM_ProductURIs 4621 0.90 1.00 0.88 138 TooManyTo_004 4604 0.91 1.04 0.88 139 XM_UB50 4527 2.23 8.56 0.86 140 FILL_THIS_FORM_SHORT 4343 0.86 1.01 0.83 141 XMSexyCombo_01 4341 1.14 2.57 0.83 142 TM2_M_A_HREF_HREF 4271 0.86 1.09 0.81 143 NML_ADSP_CUSTOM_MED 4224 0.82 0.90 0.80 144 XMBody_17 4084 0.97 1.87 0.78 145 XMHTML_After_End 3981 0.87 1.39 0.76 146 T_XMHurry_00 3816 0.83 1.29 0.73 147 T_Symld_Words_02 3794 0.80 1.15 0.72 148 TooManyTo_005 3788 0.73 0.75 0.72 149 XMSubMetaI_00 3674 0.81 1.32 0.70 150 FILL_THIS_FORM 3584 0.61 0.25 0.68 151 XMBody_95 3548 0.58 0.13 0.68 152 TR_MetaPhish_Combo_01 3541 0.73 1.01 0.67 153 HTTPS_HTTP_MISMATCH 3421 0.68 0.83 0.65 154 SpammyFromTLD_01 3411 1.07 3.00 0.65 155 XMPhish30 3410 0.71 0.99 0.65 156 XM_ShortIntro_01 3356 0.68 0.88 0.64 157 HTML_IMAGE_ONLY_20 3352 0.57 0.24 0.64 158 T_OBFU_PDF_ATTACH 3196 0.54 0.20 0.61 159 MISSING_HEADERS 3113 0.72 1.32 0.59 160 XM_B_REG_HTML 3073 0.54 0.34 0.59 161 XM_SPF_Unknown 3057 0.60 0.68 0.58 162 TR_LOTS_OF_MONEY3 2886 0.81 1.99 0.55 163 XMBrknScrpt_02 2854 0.68 1.28 0.54 164 XMPhish08 2833 0.65 1.18 0.54 165 FROM_GOV_SPOOF 2807 0.48 0.25 0.53 166 XM_DIRTYINTL 2707 1.12 3.89 0.52 167 FROM_GOV_DKIM_AU 2692 0.45 0.17 0.51 168 XMHTMLBadTable_001 2666 0.56 0.79 0.51 169 FORGED_GMAIL_RCVD 2654 0.58 0.95 0.51 170 FILL_THIS_FORM_LONG 2639 0.45 0.20 0.50 171 PDS_OTHER_BAD_TLD 2619 1.18 4.31 0.50 172 SpammyFromTLD_02 2605 1.51 6.22 0.50 173 TM2_M_BODY_EMPTY 2596 0.43 0.11 0.49 174 TR_XM_PHPDW 2585 0.81 2.25 0.49 175 XMLngstWrd_00 2571 0.49 0.49 0.49 176 T_FILL_THIS_FORM_LOAN 2522 0.41 0.07 0.48 177 HTML_TAG_BALANCE_BODY 2501 0.48 0.52 0.48 178 XM_H_PHPMailer 2489 0.66 1.50 0.47 179 XMSexyCombo_04 2473 0.52 0.74 0.47 180 TR_XM_PHPForged 2467 0.78 2.24 0.47 181 MPART_ALT_DIFF_COUNT 2456 0.61 1.27 0.47 182 TR_XM_FormFill2 2439 0.78 2.21 0.46 183 XM_H_PHPOS 2428 0.77 2.20 0.46 184 XMLngstWrd_01 2394 0.45 0.45 0.46 185 XMMoneyMeta_00 2359 0.56 1.08 0.45 186 REMOVE_BEFORE_LINK 2252 0.59 1.36 0.43 187 THIS_AD 2242 0.55 1.11 0.43 188 USER_IN_WHITELIST 2236 0.35 0.00 0.43 189 XMSubMetaSx_01 2170 0.41 0.39 0.41 190 DIET_1 2117 0.52 1.09 0.40 191 XM_D_tchamptons_WL 2078 0.33 0.00 0.40 192 RELAYCOUNTRY_DE 2076 0.65 1.84 0.40 193 SHORT_HELO_AND_INLINE_IMAGE 2033 0.33 0.04 0.39 194 T_TooManySym_03 2020 0.35 0.18 0.38 195 PLING_QUERY 2008 0.39 0.44 0.38 196 HTML_IMAGE_ONLY_32 2000 0.37 0.29 0.38 197 XMSexyCombo_02 1992 0.37 0.31 0.38 198 XMLngstWrd_02 1975 0.37 0.33 0.38 199 XM_B_COPY_HTML 1964 0.43 0.71 0.37 200 RELAYCOUNTRY_AU 1957 0.39 0.49 0.37 ----------------------------------------------------------------------