Email: 671300 Autolearn: 0 AvgScore: 1.39 AvgScanTime: 1.94 sec Spam: 108562 Autolearn: 0 AvgScore: 11.95 AvgScanTime: 3.55 sec Ham: 562738 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 1.62 sec Time Spent Running SA: 361.13 hours Time Spent Processing Spam: 107.12 hours Time Spent Processing Ham: 254.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 100624 89.13 92.69 88.44 2 DKIM_SIGNED 83655 68.99 77.06 67.44 3 DCC_CHECK 82410 41.38 75.91 34.72 4 RELAYCOUNTRY_US 81936 73.82 75.47 73.50 5 XM_B_Unicode 80848 71.40 74.47 70.80 6 XM_DK_Pass 80790 67.48 74.42 66.14 7 XMListUnsubscribeExists 70565 47.74 65.00 44.41 8 DKIM_VALID 68512 62.28 63.11 62.12 9 DKIM_VALID_AU 51106 46.91 47.08 46.88 10 BAYES_50 49792 53.76 45.87 55.28 11 XM_B_Unicode3 47981 44.33 44.20 44.35 12 XM_DK_Undo_02 41441 11.63 38.17 6.51 13 MIME_HTML_ONLY 40207 29.91 37.04 28.54 14 LOC_TINY_FONT_1 36634 22.56 33.74 20.41 15 HTML_FONT_LOW_CONTRAST 34837 34.26 32.09 34.68 16 DKIM_VALID_EF 28956 24.08 26.67 23.57 17 FVGT_m_MULTI_ODD 27654 19.97 25.47 18.91 18 BOTNET 26721 6.16 24.61 2.60 19 RELAYCOUNTRY_META 26064 8.00 24.01 4.91 20 XMSubLong 26033 18.91 23.98 17.94 21 T_KAM_HTML_FONT_INVALID 25826 16.95 23.79 15.63 22 BAYES_99 25653 6.56 23.63 3.26 23 DCC_CHECK_NEGATIVE 23692 56.73 21.82 63.46 24 XM_Body_Dirty_Words 21965 13.55 20.23 12.26 25 T_TM2_M_HEADER_IN_MSG 21913 32.13 20.18 34.43 26 XM_Multi_Part_URI 21455 19.26 19.76 19.16 27 BAYES_999 19340 5.13 17.81 2.68 28 XM_UncommonTLD01 19285 5.25 17.76 2.83 29 TR_DCC_Bayes_99 19205 4.28 17.69 1.69 30 XM_B_Unsub 18086 10.14 16.66 8.88 31 UNTRUSTED_Relay 17979 4.01 16.56 1.59 32 HTML_IMAGE_RATIO_02 16492 8.65 15.19 7.39 33 BOTNET_IPINHOSTNAME 16274 5.57 14.99 3.75 34 FSL_BULK_SIG 16015 7.66 14.75 6.30 35 DKIM_INVALID 15143 6.72 13.95 5.32 36 LOTS_OF_MONEY 13820 8.44 12.73 7.61 37 XM_Evil_Numbers_Gen 12208 9.52 11.25 9.19 38 NO_DNS_FOR_FROM 12147 4.10 11.19 2.73 39 XMSexyCombo_05 11538 5.01 10.63 3.93 40 XM_B_Phish_Phrases 11177 14.62 10.30 15.46 41 XM_H_Long_From01 9960 5.93 9.17 5.31 42 XM_UB50 9922 2.19 9.14 0.84 43 LotsOfNums_01 8967 7.37 8.26 7.20 44 BAYES_80 8428 3.01 7.76 2.10 45 MIME_QP_LONG_LINE 8169 13.01 7.52 14.07 46 SpammyFromTLD_02 7680 1.36 7.07 0.26 47 XMSubMetaSx_00 7564 4.22 6.97 3.69 48 MPART_ALT_DIFF 7357 4.84 6.78 4.46 49 KHOP_HELO_FCRDNS 7287 2.64 6.71 1.86 50 BAYES_60 7249 4.39 6.68 3.95 51 TooManyTo_001 7202 7.79 6.63 8.01 52 RCVD_IN_MSPIKE_H2 6464 8.35 5.95 8.81 53 XMStrtUSub 6459 5.50 5.95 5.41 54 HTML_MIME_NO_HTML_TAG 6016 3.00 5.54 2.51 55 HTML_IMAGE_RATIO_04 5889 5.19 5.42 5.14 56 TM2_M_URI_OPT_OUT 5824 10.54 5.36 11.54 57 XMNumbers 5649 3.57 5.20 3.25 58 XM_SendGrid 5634 5.73 5.19 5.84 59 XM_B_SpammyTLD 5385 6.64 4.96 6.97 60 T_REMOTE_IMAGE 5344 3.82 4.92 3.61 61 XM_SPF_SoftFail 5055 2.24 4.66 1.78 62 MIME_HTML_MOSTLY 5012 2.53 4.62 2.13 63 RELAYCOUNTRY_CA 4735 1.87 4.36 1.39 64 TR_Mismatch_TLD_02 4689 0.75 4.32 0.06 65 RCVD_IN_BL_SPAMCOP_NET 4655 1.44 4.29 0.89 66 PDS_OTHER_BAD_TLD 4589 1.12 4.23 0.51 67 XM_DIRTYINTL 4357 1.09 4.01 0.52 68 RCVD_IN_RP_RNBL 4344 0.76 4.00 0.14 69 BAYES_40 4324 5.37 3.98 5.64 70 XM_B_Unsub2 4299 2.20 3.96 1.86 71 RELAYCOUNTRY_FR 4069 0.84 3.75 0.28 72 BAYES_95 4023 1.69 3.71 1.30 73 RDNS_DYNAMIC 3957 0.81 3.64 0.27 74 XM_URI_RBL 3929 0.71 3.62 0.15 75 RCVD_IN_MSPIKE_BL 3719 1.33 3.43 0.93 76 FROM_EXCESS_BASE64 3714 10.38 3.42 11.73 77 XMNoVowels 3656 2.55 3.37 2.40 78 FROM_SUSPICIOUS_NTLD 3604 0.60 3.32 0.08 79 MIME_HTML_ONLY_MULTI 3603 2.81 3.32 2.71 80 XMHTML_After_End 3599 8.73 3.32 9.78 81 BAYES_20 3537 4.45 3.26 4.68 82 HTML_IMAGE_RATIO_06 3360 3.00 3.10 2.98 83 SpammyFromTLD_01 3301 1.08 3.04 0.71 84 T_TooManySym_01 3298 4.87 3.04 5.23 85 FROM_SUSPICIOUS_NTLD_FP 3281 0.55 3.02 0.07 86 URI_HEX 3241 1.41 2.99 1.11 87 BAYES_00 3189 17.68 2.94 20.53 88 RCVD_IN_MSPIKE_H3 3176 7.74 2.93 8.67 89 RCVD_IN_MSPIKE_WL 3176 7.74 2.93 8.67 90 RCVD_IN_MSPIKE_L3 3172 1.02 2.92 0.66 91 DATE_IN_PAST_03_06 3119 0.57 2.87 0.12 92 XM_CamelCaseFrm001 3081 2.10 2.84 1.96 93 ALL_TRUSTED 2947 19.99 2.71 23.32 94 TR_XM_PHPDW 2943 0.89 2.71 0.54 95 HDRS_LCASE_IMGONLY 2878 0.45 2.65 0.03 96 HTML_SHORT_LINK_IMG_1 2848 0.44 2.62 0.02 97 XMDiploma_00 2760 1.84 2.54 1.70 98 T_XMDrugObfuBody_08 2742 1.64 2.53 1.47 99 LongTLD 2694 0.59 2.48 0.22 100 REPLYTO_WITHOUT_TO_CC 2657 0.45 2.45 0.06 101 XMSexyCombo_01 2628 1.05 2.42 0.78 102 XM_BadFromFormat 2621 0.52 2.41 0.15 103 XM_OfRef6 2598 1.40 2.39 1.20 104 TR_XM_PHPForged 2591 0.83 2.39 0.53 105 HTML_IMAGE_ONLY_12 2589 0.57 2.38 0.22 106 TR_XM_FormFill2 2551 0.82 2.35 0.52 107 XM_H_PHPOS 2548 0.81 2.35 0.52 108 RCVD_IN_RP_SAFE 2494 6.73 2.30 7.59 109 T_XMDrugObfuBody_14 2381 1.56 2.19 1.44 110 XM_H_PHPMailer 2351 8.43 2.17 9.63 111 MIME_HEADER_CTYPE_ONLY 2346 0.54 2.16 0.23 112 BOTNET_NORDNS 2340 0.42 2.16 0.09 113 HTML_IMAGE_RATIO_08 2339 1.95 2.15 1.91 114 TR_XM_DK_Bayes 2330 12.36 2.15 14.33 115 RCVD_IN_PSBL 2285 0.38 2.10 0.05 116 TR_XM_DK_SendGrid 2239 2.96 2.06 3.13 117 TR_XM_INV_DKIM 2212 0.45 2.04 0.14 118 TO_EQ_FM_DOM_HTML_IMG 2202 0.34 2.03 0.02 119 T_XMHurry_00 2175 0.76 2.00 0.52 120 XMPhish08 2159 0.77 1.99 0.53 121 BAYES_05 2148 2.95 1.98 3.14 122 DIET_1 2135 0.68 1.97 0.43 123 RELAYCOUNTRY_IN 2133 0.40 1.96 0.09 124 XMBody_17 2133 1.01 1.96 0.83 125 URI_TRY_3LD 2106 1.19 1.94 1.05 126 TM2_M_VERY_LONG_WORD 2049 1.25 1.89 1.13 127 XMSubMetaI_00 2044 0.82 1.88 0.62 128 RCVD_IN_IADB_LISTED 2022 3.93 1.86 4.33 129 TR_XM_RelayPhish 2015 0.52 1.86 0.26 130 XM_DK_Undo_01 1966 1.65 1.81 1.62 131 XMGenDplmaNmb 1923 1.20 1.77 1.09 132 SUBJ_ALL_CAPS 1889 1.53 1.74 1.49 133 TR_Symld_Words 1863 1.41 1.72 1.35 134 RCVD_IN_IADB_SPF 1858 3.43 1.71 3.76 135 RCVD_IN_RP_CERTIFIED 1855 6.00 1.71 6.83 136 RCVD_IN_IADB_SENDERID 1832 3.02 1.69 3.28 137 RCVD_IN_IADB_DK 1823 2.97 1.68 3.22 138 XMStockSpam_06 1760 1.09 1.62 0.99 139 MAILING_LIST_MULTI 1712 2.32 1.58 2.46 140 TR_LOTS_OF_MONEY2 1709 0.81 1.57 0.67 141 T_MONEY_PERCENT 1709 0.81 1.57 0.67 142 TR_LOTS_OF_MONEY3 1681 0.60 1.55 0.42 143 XMLngstWrd_00 1649 0.55 1.52 0.37 144 T_XMDrugObfuBody_00 1634 0.78 1.51 0.64 145 REMOVE_BEFORE_LINK 1628 0.45 1.50 0.24 146 XMBody_78 1616 0.56 1.49 0.38 147 XM_UB99 1602 0.24 1.48 0.00 148 XM_UB60 1588 0.27 1.46 0.05 149 DKIM_ADSP_CUSTOM_MED 1579 1.16 1.45 1.10 150 XMLngstWrd_01 1571 0.50 1.45 0.32 151 XM_ProductURIs 1564 0.83 1.44 0.71 152 UNPARSEABLE_RELAY 1548 1.80 1.43 1.87 153 TO_NO_BRKTS_FROM_MSSP 1505 0.25 1.39 0.03 154 RELAYCOUNTRY_DE 1499 0.75 1.38 0.63 155 XM_H_PHPOS_M 1491 0.38 1.37 0.19 156 TR_XM_DK_Bayes1 1481 11.42 1.36 13.36 157 RELAYCOUNTRY_GB 1478 1.02 1.36 0.96 158 FROM_MISSP_EH_MATCH 1472 0.25 1.36 0.04 159 FORGED_GMAIL_RCVD 1409 0.67 1.30 0.55 160 T_Symld_Words_02 1358 0.56 1.25 0.43 161 MPART_ALT_DIFF_COUNT 1355 0.50 1.25 0.36 162 DATE_IN_PAST_06_12 1351 0.32 1.24 0.14 163 URIBL_SBL_A 1332 0.29 1.23 0.11 164 FROM_MISSP_REPLYTO 1313 0.22 1.21 0.03 165 URI_OPTOUT_3LD 1303 0.25 1.20 0.07 166 BODY_URI_ONLY 1274 0.23 1.17 0.04 167 MY_SERVERS_FOUND 1268 0.28 1.17 0.11 168 XMBrknScrpt_02 1268 0.78 1.17 0.71 169 RELAYCOUNTRY_SG 1259 0.26 1.16 0.08 170 RELAYCOUNTRY_AT 1215 0.31 1.12 0.15 171 RELAYCOUNTRY_RU 1212 0.23 1.12 0.06 172 NML_ADSP_CUSTOM_MED 1206 0.86 1.11 0.81 173 TR_Mismatch_TLD_01 1178 0.37 1.09 0.23 174 NORDNS_LOW_CONTRAST 1163 0.18 1.07 0.01 175 FILL_THIS_FORM_SHORT 1138 1.02 1.05 1.01 176 TR_XM_DK_Bayes2 1114 9.88 1.03 11.58 177 XM_UB80 1114 0.18 1.03 0.01 178 URI_WP_HACKED 1111 0.17 1.02 0.00 179 DKIM_ADSP_NXDOMAIN 1092 0.42 1.01 0.31 180 XM_PDF 1091 4.56 1.00 5.25 181 HTML_FONT_SIZE_LARGE 1086 0.27 1.00 0.13 182 LOW_PRICE 1076 0.35 0.99 0.23 183 RELAYCOUNTRY_JP 1069 0.19 0.98 0.03 184 DEAR_FRIEND 1052 0.21 0.97 0.06 185 XM_H_Long_From02 1046 1.19 0.96 1.23 186 URIBL_BLACK 1041 0.17 0.96 0.01 187 XM_UB999 990 0.15 0.91 0.00 188 XMCapTrack 976 1.30 0.90 1.38 189 XM_H_MailChimp 970 0.26 0.89 0.14 190 THIS_AD 942 0.36 0.87 0.26 191 T_TooManySym_02 938 2.50 0.86 2.82 192 XMSubMetaSxObfu_03 934 0.63 0.86 0.58 193 XMBdyGiftCard01 932 1.24 0.86 1.31 194 TO_EQ_FM_DOM_HTML_ONLY 931 0.17 0.86 0.04 195 TR_MetaPhish_Combo_01 918 1.22 0.85 1.29 196 PDS_FROM_NAME_TO_DOMAIN 898 0.14 0.83 0.00 197 PDS_FRNOM_TODOM_NAKED_TO 895 0.14 0.82 0.00 198 URG_BIZ 882 0.17 0.81 0.05 199 XM_B_COPY_HTML 876 0.40 0.81 0.32 200 PLING_QUERY 865 0.64 0.80 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 497711 89.13 92.69 88.44 2 RELAYCOUNTRY_US 413588 73.82 75.47 73.50 3 XM_B_Unicode 398443 71.40 74.47 70.80 4 DKIM_SIGNED 379505 68.99 77.06 67.44 5 XM_DK_Pass 372222 67.48 74.42 66.14 6 DCC_CHECK_NEGATIVE 357110 56.73 21.82 63.46 7 DKIM_VALID 349553 62.28 63.11 62.12 8 BAYES_50 311092 53.76 45.87 55.28 9 DKIM_VALID_AU 263796 46.91 47.08 46.88 10 XMListUnsubscribeExists 249922 47.74 65.00 44.41 11 XM_B_Unicode3 249588 44.33 44.20 44.35 12 DCC_CHECK 195406 41.38 75.91 34.72 13 HTML_FONT_LOW_CONTRAST 195130 34.26 32.09 34.68 14 T_TM2_M_HEADER_IN_MSG 193761 32.13 20.18 34.43 15 MIME_HTML_ONLY 160584 29.91 37.04 28.54 16 DKIM_VALID_EF 132665 24.08 26.67 23.57 17 ALL_TRUSTED 131245 19.99 2.71 23.32 18 BAYES_00 115517 17.68 2.94 20.53 19 LOC_TINY_FONT_1 114843 22.56 33.74 20.41 20 XM_Multi_Part_URI 107817 19.26 19.76 19.16 21 FVGT_m_MULTI_ODD 106411 19.97 25.47 18.91 22 XMSubLong 100941 18.91 23.98 17.94 23 T_KAM_HTML_FONT_INVALID 87931 16.95 23.79 15.63 24 XM_B_Phish_Phrases 86979 14.62 10.30 15.46 25 TR_XM_DK_Bayes 80628 12.36 2.15 14.33 26 MIME_QP_LONG_LINE 79198 13.01 7.52 14.07 27 TR_XM_DK_Bayes1 75155 11.42 1.36 13.36 28 XM_Body_Dirty_Words 68976 13.55 20.23 12.26 29 FROM_EXCESS_BASE64 65992 10.38 3.42 11.73 30 TR_XM_DK_Bayes2 65177 9.88 1.03 11.58 31 TM2_M_URI_OPT_OUT 64953 10.54 5.36 11.54 32 XMHTML_After_End 55032 8.73 3.32 9.78 33 XM_H_PHPMailer 54213 8.43 2.17 9.63 34 XM_Evil_Numbers_Gen 51705 9.52 11.25 9.19 35 XM_B_Unsub 49980 10.14 16.66 8.88 36 RCVD_IN_MSPIKE_H2 49600 8.35 5.95 8.81 37 RCVD_IN_MSPIKE_H3 48798 7.74 2.93 8.67 38 RCVD_IN_MSPIKE_WL 48798 7.74 2.93 8.67 39 TooManyTo_001 45090 7.79 6.63 8.01 40 LOTS_OF_MONEY 42838 8.44 12.73 7.61 41 RCVD_IN_RP_SAFE 42715 6.73 2.30 7.59 42 HTML_IMAGE_RATIO_02 41604 8.65 15.19 7.39 43 LotsOfNums_01 40515 7.37 8.26 7.20 44 XM_DKIMWhitelistDomains 39206 5.84 0.02 6.97 45 XM_B_SpammyTLD 39202 6.64 4.96 6.97 46 RCVD_IN_RP_CERTIFIED 38426 6.00 1.71 6.83 47 XM_DK_Undo_02 36662 11.63 38.17 6.51 48 FSL_BULK_SIG 35434 7.66 14.75 6.30 49 XM_SendGrid 32864 5.73 5.19 5.84 50 BAYES_40 31713 5.37 3.98 5.64 51 XMStrtUSub 30448 5.50 5.95 5.41 52 DKIM_INVALID 29952 6.72 13.95 5.32 53 XM_H_Long_From01 29880 5.93 9.17 5.31 54 XM_PDF 29553 4.56 1.00 5.25 55 T_TooManySym_01 29405 4.87 3.04 5.23 56 HTML_IMAGE_RATIO_04 28949 5.19 5.42 5.14 57 RELAYCOUNTRY_META 27645 8.00 24.01 4.91 58 BAYES_20 26338 4.45 3.26 4.68 59 MPART_ALT_DIFF 25123 4.84 6.78 4.46 60 RCVD_IN_IADB_LISTED 24340 3.93 1.86 4.33 61 BAYES_60 22252 4.39 6.68 3.95 62 XMSexyCombo_05 22120 5.01 10.63 3.93 63 RCVD_IN_IADB_SPF 21142 3.43 1.71 3.76 64 BOTNET_IPINHOSTNAME 21120 5.57 14.99 3.75 65 XMSubMetaSx_00 20769 4.22 6.97 3.69 66 T_REMOTE_IMAGE 20305 3.82 4.92 3.61 67 IN_ZIMBRA_NJ_WHITELIST 19550 2.92 0.03 3.47 68 RCVD_IN_IADB_SENDERID 18442 3.02 1.69 3.28 69 BAYES_99 18363 6.56 23.63 3.26 70 XMNumbers 18315 3.57 5.20 3.25 71 RCVD_IN_IADB_DK 18119 2.97 1.68 3.22 72 BAYES_05 17687 2.95 1.98 3.14 73 TR_XM_DK_SendGrid 17609 2.96 2.06 3.13 74 HTML_IMAGE_RATIO_06 16762 3.00 3.10 2.98 75 XM_UncommonTLD01 15928 5.25 17.76 2.83 76 RCVD_IN_IADB_VOUCHED 15918 2.46 0.57 2.83 77 T_TooManySym_02 15850 2.50 0.86 2.82 78 NO_DNS_FOR_FROM 15377 4.10 11.19 2.73 79 MIME_HTML_ONLY_MULTI 15271 2.81 3.32 2.71 80 BAYES_999 15067 5.13 17.81 2.68 81 BOTNET 14638 6.16 24.61 2.60 82 HTML_MIME_NO_HTML_TAG 14147 3.00 5.54 2.51 83 MAILING_LIST_MULTI 13842 2.32 1.58 2.46 84 XMNoVowels 13486 2.55 3.37 2.40 85 ANY_BOUNCE_MESSAGE 13044 2.06 0.75 2.32 86 BOUNCE_MESSAGE 13034 2.06 0.74 2.32 87 TooManyTo_002 12556 1.98 0.66 2.23 88 XM_H_Trusted_IP 12285 1.83 0.00 2.18 89 MIME_HTML_MOSTLY 12005 2.53 4.62 2.13 90 BAYES_80 11803 3.01 7.76 2.10 91 XM_CamelCaseFrm001 11019 2.10 2.84 1.96 92 HTML_IMAGE_RATIO_08 10731 1.95 2.15 1.91 93 RCVD_IN_IADB_OPTIN 10512 1.64 0.45 1.87 94 UNPARSEABLE_RELAY 10503 1.80 1.43 1.87 95 XM_B_Unsub2 10478 2.20 3.96 1.86 96 KHOP_HELO_FCRDNS 10458 2.64 6.71 1.86 97 XM_SPF_SoftFail 10005 2.24 4.66 1.78 98 HELO_NODOT 9921 1.59 0.69 1.76 99 HELO_NO_DOMAIN 9876 1.58 0.69 1.75 100 XMDiploma_00 9572 1.84 2.54 1.70 101 TR_DCC_Bayes_99 9534 4.28 17.69 1.69 102 XM_DK_Undo_01 9090 1.65 1.81 1.62 103 UNTRUSTED_Relay 8944 4.01 16.56 1.59 104 TooManyTo_003 8623 1.37 0.53 1.53 105 SUBJ_ALL_CAPS 8372 1.53 1.74 1.49 106 T_XMDrugObfuBody_08 8258 1.64 2.53 1.47 107 TVD_RCVD_IP 8187 1.32 0.64 1.45 108 T_XMDrugObfuBody_14 8107 1.56 2.19 1.44 109 IN_HORDE_ADDRESS_BOOK 7998 1.20 0.04 1.42 110 RELAYCOUNTRY_CA 7819 1.87 4.36 1.39 111 XMCapTrack 7743 1.30 0.90 1.38 112 TR_Symld_Words 7612 1.41 1.72 1.35 113 INVALID_MSGID 7583 1.16 0.16 1.35 114 XMBdyGiftCard01 7389 1.24 0.86 1.31 115 BAYES_95 7324 1.69 3.71 1.30 116 TO_MALFORMED 7259 1.09 0.05 1.29 117 TR_MetaPhish_Combo_01 7253 1.22 0.85 1.29 118 XM_H_Long_From02 6943 1.19 0.96 1.23 119 XM_OfRef6 6779 1.40 2.39 1.20 120 XM_GoogleGroups 6636 1.10 0.67 1.18 121 TooManyTo_004 6593 1.05 0.40 1.17 122 CK_HELO_DYNAMIC_SPLIT_IP 6496 0.99 0.14 1.15 123 HELO_DYNAMIC_IPADDR2 6493 0.97 0.05 1.15 124 TM2_M_VERY_LONG_WORD 6367 1.25 1.89 1.13 125 URI_HEX 6239 1.41 2.99 1.11 126 DKIM_ADSP_CUSTOM_MED 6193 1.16 1.45 1.10 127 XMGenDplmaNmb 6134 1.20 1.77 1.09 128 T_TooManySym_03 6086 0.94 0.20 1.08 129 URI_TRY_3LD 5898 1.19 1.94 1.05 130 USER_IN_DEF_DKIM_WL 5773 0.86 0.02 1.03 131 FILL_THIS_FORM_SHORT 5702 1.02 1.05 1.01 132 TooManyTo_005 5673 0.90 0.37 1.01 133 XMStockSpam_06 5560 1.09 1.62 0.99 134 RELAYCOUNTRY_GB 5402 1.02 1.36 0.96 135 RCVD_IN_MSPIKE_BL 5226 1.33 3.43 0.93 136 XMSubNoVowel 5206 0.85 0.47 0.93 137 T_OBFU_PDF_ATTACH 5156 0.83 0.40 0.92 138 XMGappySubj_01 5047 0.78 0.18 0.90 139 RCVD_IN_BL_SPAMCOP_NET 4988 1.44 4.29 0.89 140 XM_UB50 4753 2.19 9.14 0.84 141 NUMERIC_HTTP_ADDR 4694 0.80 0.61 0.83 142 XMBody_17 4673 1.01 1.96 0.83 143 NML_ADSP_CUSTOM_MED 4582 0.86 1.11 0.81 144 HTML_FONT_FACE_BAD 4479 0.78 0.70 0.80 145 XMSexyCombo_01 4406 1.05 2.42 0.78 146 TR_MSPIKEBAYES00 4345 0.65 0.01 0.77 147 XM_ProductURIs 3994 0.83 1.44 0.71 148 XMBrknScrpt_02 3974 0.78 1.17 0.71 149 SpammyFromTLD_01 3970 1.08 3.04 0.71 150 XMBody_95 3846 0.60 0.15 0.68 151 XM_SPF_Unknown 3758 0.66 0.63 0.67 152 TR_LOTS_OF_MONEY2 3751 0.81 1.57 0.67 153 T_MONEY_PERCENT 3751 0.81 1.57 0.67 154 RCVD_IN_MSPIKE_L3 3691 1.02 2.92 0.66 155 NORMAL_HTTP_TO_IP 3655 0.57 0.17 0.65 156 HTML_TITLE_SUBJ_DIFF 3655 0.61 0.39 0.65 157 T_XMDrugObfuBody_00 3617 0.78 1.51 0.64 158 XM_E_Blogspot 3577 0.55 0.13 0.64 159 RELAYCOUNTRY_DE 3523 0.75 1.38 0.63 160 XMSubMetaI_00 3489 0.82 1.88 0.62 161 HTTPS_HTTP_MISMATCH 3445 0.61 0.60 0.61 162 PLING_QUERY 3404 0.64 0.80 0.60 163 MISSING_HEADERS 3331 0.60 0.65 0.59 164 XMSubMetaSxObfu_03 3282 0.63 0.86 0.58 165 FROM_GOV_SPOOF 3186 0.51 0.23 0.57 166 XM_ShortIntro_01 3142 0.54 0.46 0.56 167 FORGED_GMAIL_RCVD 3067 0.67 1.30 0.55 168 TR_XM_PHPDW 3048 0.89 2.71 0.54 169 FILL_THIS_FORM 3043 0.54 0.52 0.54 170 XMMoneyMeta_00 3043 0.55 0.60 0.54 171 XMPhish08 2992 0.77 1.99 0.53 172 TR_XM_PHPForged 2956 0.83 2.39 0.53 173 XM_DIRTYINTL 2931 1.09 4.01 0.52 174 T_XMHurry_00 2926 0.76 2.00 0.52 175 TR_XM_FormFill2 2922 0.82 2.35 0.52 176 XM_H_PHPOS 2904 0.81 2.35 0.52 177 PDS_OTHER_BAD_TLD 2898 1.12 4.23 0.51 178 HTML_TAG_BALANCE_BODY 2772 0.49 0.50 0.49 179 HTML_IMAGE_ONLY_32 2717 0.44 0.21 0.48 180 TM2_M_BODY_EMPTY 2694 0.43 0.15 0.48 181 XM_Body_Obfu01 2621 0.46 0.44 0.47 182 XM_B_REG_HTML 2615 0.49 0.61 0.46 183 AC_DIV_BONANZA 2610 0.41 0.12 0.46 184 HTML_IMAGE_ONLY_20 2552 0.44 0.35 0.45 185 XMHTMLBadTable_001 2525 0.48 0.67 0.45 186 HTML_IMAGE_ONLY_28 2460 0.49 0.78 0.44 187 DIET_1 2437 0.68 1.97 0.43 188 T_Symld_Words_02 2431 0.56 1.25 0.43 189 XMSexyCombo_04 2401 0.48 0.75 0.43 190 SHORT_HELO_AND_INLINE_IMAGE 2398 0.37 0.06 0.43 191 TR_LOTS_OF_MONEY3 2339 0.60 1.55 0.42 192 USER_IN_WHITELIST 2321 0.35 0.00 0.41 193 FILL_THIS_FORM_LONG 2317 0.40 0.34 0.41 194 RCVD_IN_SORBS_DUL 2286 0.36 0.12 0.41 195 XMSubMetaSx_01 2268 0.38 0.29 0.40 196 T_FILL_THIS_FORM_LOAN 2139 0.36 0.23 0.38 197 XMPhish30 2134 0.44 0.78 0.38 198 XMBody_78 2120 0.56 1.49 0.38 199 XMPhish14 2092 0.42 0.69 0.37 200 RELAYCOUNTRY_AU 2071 0.42 0.69 0.37 ----------------------------------------------------------------------