Email: 374648 Autolearn: 0 AvgScore: 0.95 AvgScanTime: 1.70 sec Spam: 70081 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 2.82 sec Ham: 304567 Autolearn: 0 AvgScore: -1.76 AvgScanTime: 1.44 sec Time Spent Running SA: 176.56 hours Time Spent Processing Spam: 54.82 hours Time Spent Processing Ham: 121.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 64579 88.31 92.15 87.43 2 DKIM_SIGNED 56158 78.23 80.13 77.79 3 DCC_CHECK 54513 53.38 77.79 47.76 4 XM_DK_Pass 54206 76.69 77.35 76.54 5 XM_B_Unicode 52270 74.80 74.59 74.85 6 RELAYCOUNTRY_US 51846 81.28 73.98 82.96 7 XMListUnsubscribeExists 47668 58.26 68.02 56.02 8 DKIM_VALID 47399 72.27 67.63 73.33 9 DKIM_VALID_AU 37281 58.06 53.20 59.18 10 XM_B_Unicode3 30609 45.92 43.68 46.44 11 XM_DK_Undo_02 30333 14.91 43.28 8.38 12 BAYES_50 28506 47.79 40.68 49.43 13 MIME_HTML_ONLY 24545 26.64 35.02 24.71 14 LOC_TINY_FONT_1 23995 29.82 34.24 28.80 15 HTML_FONT_LOW_CONTRAST 22304 30.84 31.83 30.61 16 BAYES_99 20982 9.76 29.94 5.11 17 FVGT_m_MULTI_ODD 18087 21.84 25.81 20.92 18 RELAYCOUNTRY_META 17702 8.93 25.26 5.17 19 DKIM_VALID_EF 16858 25.29 24.06 25.58 20 BOTNET 16360 6.39 23.34 2.48 21 BAYES_999 16135 7.67 23.02 4.13 22 TR_DCC_Bayes_99 16122 6.94 23.00 3.25 23 T_KAM_HTML_FONT_INVALID 15036 17.36 21.46 16.42 24 XMSubLong 14765 20.12 21.07 19.90 25 DCC_CHECK_NEGATIVE 14452 45.30 20.62 50.98 26 XM_Body_Dirty_Words 13890 15.24 19.82 14.18 27 BOTNET_IPINHOSTNAME 13389 8.08 19.11 5.54 28 HTML_IMAGE_RATIO_02 12717 11.00 18.15 9.35 29 XM_UncommonTLD01 12428 6.30 17.73 3.66 30 T_TM2_M_HEADER_IN_MSG 12370 21.17 17.65 21.98 31 UNTRUSTED_Relay 12277 4.69 17.52 1.74 32 XM_Multi_Part_URI 11266 13.48 16.08 12.88 33 FSL_BULK_SIG 10757 10.45 15.35 9.32 34 DKIM_INVALID 8759 5.96 12.50 4.45 35 LOTS_OF_MONEY 8158 8.24 11.64 7.46 36 XM_B_Unsub 7953 11.37 11.35 11.38 37 XMSexyCombo_05 7119 6.17 10.16 5.25 38 XM_Evil_Numbers_Gen 7072 11.61 10.09 11.96 39 NO_DNS_FOR_FROM 6555 3.48 9.35 2.13 40 XM_B_Phish_Phrases 6554 10.27 9.35 10.48 41 XM_UB50 6088 2.38 8.69 0.93 42 KHOP_HELO_FCRDNS 5977 2.62 8.53 1.26 43 BAYES_80 5248 3.71 7.49 2.84 44 RCVD_IN_MSPIKE_H2 5206 10.90 7.43 11.70 45 LotsOfNums_01 5197 8.23 7.42 8.42 46 TooManyTo_001 5043 7.32 7.20 7.35 47 MPART_ALT_DIFF 4924 8.32 7.03 8.61 48 SpammyFromTLD_02 4877 1.55 6.96 0.31 49 RCVD_IN_MSPIKE_BL 4814 2.20 6.87 1.12 50 RCVD_IN_MSPIKE_L3 4740 2.02 6.76 0.93 51 BAYES_60 4719 5.67 6.73 5.43 52 XM_H_Long_From01 4368 6.10 6.23 6.07 53 XMSubMetaSx_00 4328 3.64 6.18 3.06 54 RELAYCOUNTRY_CA 4298 2.73 6.13 1.95 55 HTML_IMAGE_RATIO_04 4289 6.95 6.12 7.15 56 PDS_OTHER_BAD_TLD 4178 1.71 5.96 0.73 57 XM_SPF_SoftFail 4142 1.96 5.91 1.05 58 MIME_HTML_MOSTLY 3817 3.13 5.45 2.60 59 XM_CamelCaseFrm001 3805 2.93 5.43 2.35 60 XMNumbers 3706 4.27 5.29 4.04 61 RCVD_IN_BL_SPAMCOP_NET 3332 1.67 4.75 0.96 62 T_REMOTE_IMAGE 3327 3.48 4.75 3.19 63 FROM_SUSPICIOUS_NTLD 3092 0.88 4.41 0.07 64 FROM_SUSPICIOUS_NTLD_FP 3044 0.87 4.34 0.07 65 XM_SendGrid 3026 6.57 4.32 7.09 66 BAYES_95 3025 2.27 4.32 1.80 67 DKIM_ADSP_NXDOMAIN 2871 1.12 4.10 0.44 68 RCVD_IN_RP_RNBL 2859 0.86 4.08 0.12 69 T_XMDrugObfuBody_08 2830 1.85 4.04 1.35 70 TR_Mismatch_TLD_02 2817 0.80 4.02 0.06 71 RCVD_IN_RP_SAFE 2807 11.64 4.01 13.40 72 XM_B_SpammyTLD 2702 2.36 3.86 2.01 73 MIME_QP_LONG_LINE 2686 4.64 3.83 4.83 74 T_Symld_Words_02 2645 0.93 3.77 0.27 75 FROM_EXCESS_BASE64 2604 3.85 3.72 3.88 76 RCVD_IN_PSBL 2601 0.75 3.71 0.06 77 BAYES_40 2594 4.65 3.70 4.87 78 XMHTML_After_End 2576 1.22 3.68 0.65 79 XM_DIRTYINTL 2575 1.12 3.67 0.53 80 RELAYCOUNTRY_DE 2494 0.98 3.56 0.38 81 XMStrtUSub 2467 4.23 3.52 4.40 82 HTML_IMAGE_RATIO_06 2447 3.68 3.49 3.73 83 XMSubGiftCard1 2312 0.77 3.30 0.19 84 MSGID_FROM_MTA_HEADER 2265 0.75 3.23 0.18 85 RELAYCOUNTRY_FR 2220 0.78 3.17 0.24 86 T_TooManySym_01 2216 5.29 3.16 5.78 87 LongTLD 2209 0.73 3.15 0.18 88 TM2_M_URI_OPT_OUT 2202 5.28 3.14 5.78 89 RCVD_IN_RP_CERTIFIED 2174 10.48 3.10 12.18 90 RDNS_DYNAMIC 2106 0.90 3.01 0.42 91 URI_HEX 2089 1.53 2.98 1.20 92 URIBL_SBL_A 2079 0.67 2.97 0.14 93 BODY_URI_ONLY 2075 0.59 2.96 0.04 94 DATE_IN_PAST_03_06 2025 0.62 2.89 0.10 95 RCVD_IN_MSPIKE_H3 2013 8.43 2.87 9.71 96 RCVD_IN_MSPIKE_WL 2013 8.43 2.87 9.71 97 BAYES_00 1979 19.88 2.82 23.80 98 TR_XM_PHPDW 1919 0.82 2.74 0.37 99 TR_XM_PHPForged 1868 0.79 2.67 0.35 100 BAYES_20 1858 3.66 2.65 3.90 101 TR_XM_FormFill2 1857 0.78 2.65 0.35 102 MIME_HTML_ONLY_MULTI 1852 4.92 2.64 5.45 103 XM_H_PHPOS 1852 0.78 2.64 0.35 104 TR_XM_INV_DKIM 1832 0.62 2.61 0.16 105 FROM_MISSP_REPLYTO 1824 0.51 2.60 0.03 106 XM_OfRef6 1818 1.54 2.59 1.30 107 XMDiploma_00 1785 1.67 2.55 1.47 108 UNPARSEABLE_RELAY 1713 3.26 2.44 3.45 109 XMBody_17 1670 1.38 2.38 1.15 110 XMEqualsVooDoo_00 1606 0.44 2.29 0.01 111 XM_URI_RBL 1595 0.60 2.28 0.22 112 XMEqualsVooDoo_01 1586 0.43 2.26 0.00 113 SCRIPT_GIBBERISH 1584 0.42 2.26 0.00 114 XMEqualsVooDoo_02 1583 0.42 2.26 0.00 115 XMEqualsVooDoo_03 1577 0.42 2.25 0.00 116 TM2_M_VERY_LONG_WORD 1576 1.72 2.25 1.60 117 HTML_IMAGE_RATIO_08 1570 2.14 2.24 2.12 118 TR_XM_MaxBayes 1558 0.43 2.22 0.02 119 FROM_MISSP_DYNIP 1545 0.41 2.20 0.00 120 ALL_TRUSTED 1535 11.20 2.19 13.27 121 DKIM_ADSP_CUSTOM_MED 1529 1.37 2.18 1.19 122 XM_UB60 1437 0.43 2.05 0.06 123 XM_H_PHPMailer 1435 0.80 2.05 0.51 124 NML_ADSP_CUSTOM_MED 1423 1.03 2.03 0.80 125 HTML_MIME_NO_HTML_TAG 1414 1.76 2.02 1.70 126 XM_B_Unsub2 1406 1.25 2.01 1.08 127 XM_UB99 1384 0.37 1.97 0.01 128 FORGED_GMAIL_RCVD 1362 0.84 1.94 0.59 129 XMGenDplmaNmb 1358 1.16 1.94 0.98 130 XMNoVowels 1325 1.81 1.89 1.79 131 DIET_1 1315 0.83 1.88 0.59 132 XM_H_PHPOS_M 1284 0.50 1.83 0.19 133 TR_XM_DK_Bayes 1271 13.96 1.81 16.76 134 TR_Mismatch_TLD_01 1267 0.68 1.81 0.42 135 XMSexyCombo_01 1261 0.72 1.80 0.47 136 XM_ProductURIs 1260 1.37 1.80 1.27 137 XMSlimDrugH 1259 0.65 1.80 0.39 138 T_XMHurry_00 1254 0.86 1.79 0.65 139 DATE_IN_PAST_06_12 1253 0.54 1.79 0.25 140 TR_XM_DK_SendGrid 1244 3.47 1.78 3.86 141 XMStockSpam_06 1244 1.54 1.78 1.49 142 T_XMDrugObfuBody_14 1215 1.71 1.73 1.70 143 RELAYCOUNTRY_IN 1180 0.38 1.68 0.08 144 TR_XM_RelayPhish 1176 0.47 1.68 0.19 145 MISSING_HEADERS 1164 0.79 1.66 0.59 146 SUBJ_ALL_CAPS 1157 1.56 1.65 1.53 147 TR_XM_MaxSPIKE 1147 0.33 1.64 0.03 148 XMSubMetaI_00 1117 0.81 1.59 0.63 149 BOTNET_NORDNS 1110 0.31 1.58 0.02 150 T_XMDrugObfuBody_00 1100 0.87 1.57 0.71 151 TR_LOTS_OF_MONEY3 1098 0.55 1.57 0.32 152 SpammyFromTLD_01 1097 0.64 1.57 0.42 153 XM_UB80 1075 0.30 1.53 0.02 154 BAYES_05 1074 2.50 1.53 2.73 155 XM_OfRef7 1032 0.38 1.47 0.12 156 URI_TRY_3LD 1031 1.42 1.47 1.41 157 TR_Symld_Words 1028 1.01 1.47 0.91 158 XMPhish14 1012 0.51 1.44 0.29 159 XMPhish30 1012 1.00 1.44 0.90 160 REPLYTO_WITHOUT_TO_CC 1011 0.45 1.44 0.22 161 TR_LOTS_OF_MONEY1 1001 0.34 1.43 0.09 162 RCVD_IN_IADB_LISTED 995 3.08 1.42 3.46 163 T_FILL_THIS_FORM_SHORT 963 1.19 1.37 1.14 164 RELAYCOUNTRY_GB 940 0.89 1.34 0.78 165 LOW_PRICE 929 0.73 1.33 0.59 166 RCVD_IN_IADB_SPF 905 2.72 1.29 3.04 167 RCVD_IN_IADB_SENDERID 899 2.45 1.28 2.72 168 RCVD_IN_IADB_DK 897 2.40 1.28 2.65 169 MPART_ALT_DIFF_COUNT 876 0.88 1.25 0.80 170 XMWghtMeta_00 876 0.29 1.25 0.06 171 XM_DK_Undo_01 862 1.56 1.23 1.63 172 XMBrknScrpt_02 813 0.81 1.16 0.73 173 XM_B_COPY_HTML 800 0.54 1.14 0.40 174 XM_UB999 799 0.22 1.14 0.00 175 TR_XM_DK_Bayes1 795 13.20 1.13 15.97 176 MAILING_LIST_MULTI 791 2.07 1.13 2.29 177 RELAYCOUNTRY_AT 790 0.39 1.13 0.22 178 XM_UB95 783 0.21 1.12 0.01 179 XMSlimDrugs 758 0.24 1.08 0.05 180 THIS_AD 757 0.37 1.08 0.21 181 TR_XM_DK_Bayes2 757 12.37 1.08 14.97 182 XMGppyBdWords 756 0.33 1.08 0.16 183 TR_MetaPhish_Combo_01 754 0.99 1.08 0.97 184 HTML_TAG_BALANCE_CENTER 753 0.31 1.07 0.14 185 T_TooManySym_02 737 2.81 1.05 3.22 186 HTML_OBFUSCATE_05_10 724 0.44 1.03 0.30 187 URIBL_BLACK 703 0.20 1.00 0.01 188 URIBL_DBL_SPAM 701 0.21 1.00 0.03 189 XMBody_78 699 0.51 1.00 0.40 190 RELAYCOUNTRY_FI 696 0.21 0.99 0.02 191 XMBdyGiftCard01 691 1.73 0.99 1.90 192 XM_H_TOP 680 0.18 0.97 0.00 193 URIBL_DBL_ABUSE_REDIR 669 0.22 0.95 0.05 194 XM_H_Long_From02 661 0.90 0.94 0.89 195 SUBJ_DOLLARS 643 0.63 0.92 0.56 196 XM_B_REG_HTML 630 0.82 0.90 0.80 197 XMPhish08 619 0.79 0.88 0.76 198 SUBJECT_NEEDS_ENCODING 616 0.21 0.88 0.05 199 XMSubNoVowel 607 1.58 0.87 1.74 200 XM_BadFromFormat 607 0.29 0.87 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 266285 88.31 92.15 87.43 2 RELAYCOUNTRY_US 252661 81.28 73.98 82.96 3 DKIM_SIGNED 236911 78.23 80.13 77.79 4 XM_DK_Pass 233122 76.69 77.35 76.54 5 XM_B_Unicode 227963 74.80 74.59 74.85 6 DKIM_VALID 223354 72.27 67.63 73.33 7 DKIM_VALID_AU 180234 58.06 53.20 59.18 8 XMListUnsubscribeExists 170604 58.26 68.02 56.02 9 DCC_CHECK_NEGATIVE 155281 45.30 20.62 50.98 10 BAYES_50 150552 47.79 40.68 49.43 11 DCC_CHECK 145456 53.38 77.79 47.76 12 XM_B_Unicode3 141430 45.92 43.68 46.44 13 HTML_FONT_LOW_CONTRAST 93224 30.84 31.83 30.61 14 LOC_TINY_FONT_1 87715 29.82 34.24 28.80 15 DKIM_VALID_EF 77898 25.29 24.06 25.58 16 MIME_HTML_ONLY 75268 26.64 35.02 24.71 17 BAYES_00 72496 19.88 2.82 23.80 18 T_TM2_M_HEADER_IN_MSG 66935 21.17 17.65 21.98 19 FVGT_m_MULTI_ODD 63730 21.84 25.81 20.92 20 XMSubLong 60620 20.12 21.07 19.90 21 TR_XM_DK_Bayes 51036 13.96 1.81 16.76 22 T_KAM_HTML_FONT_INVALID 49998 17.36 21.46 16.42 23 TR_XM_DK_Bayes1 48654 13.20 1.13 15.97 24 TR_XM_DK_Bayes2 45579 12.37 1.08 14.97 25 XM_Body_Dirty_Words 43193 15.24 19.82 14.18 26 RCVD_IN_RP_SAFE 40814 11.64 4.01 13.40 27 ALL_TRUSTED 40423 11.20 2.19 13.27 28 XM_Multi_Part_URI 39228 13.48 16.08 12.88 29 RCVD_IN_RP_CERTIFIED 37095 10.48 3.10 12.18 30 XM_Evil_Numbers_Gen 36425 11.61 10.09 11.96 31 RCVD_IN_MSPIKE_H2 35642 10.90 7.43 11.70 32 XM_B_Unsub 34650 11.37 11.35 11.38 33 XM_B_Phish_Phrases 31927 10.27 9.35 10.48 34 RCVD_IN_MSPIKE_WL 29572 8.43 2.87 9.71 35 RCVD_IN_MSPIKE_H3 29572 8.43 2.87 9.71 36 HTML_IMAGE_RATIO_02 28487 11.00 18.15 9.35 37 FSL_BULK_SIG 28396 10.45 15.35 9.32 38 XM_DKIMWhitelistDomains 26269 7.03 0.09 8.63 39 MPART_ALT_DIFF 26232 8.32 7.03 8.61 40 LotsOfNums_01 25655 8.23 7.42 8.42 41 XM_DK_Undo_02 25509 14.91 43.28 8.38 42 LOTS_OF_MONEY 22707 8.24 11.64 7.46 43 TooManyTo_001 22379 7.32 7.20 7.35 44 HTML_IMAGE_RATIO_04 21765 6.95 6.12 7.15 45 XM_SendGrid 21596 6.57 4.32 7.09 46 XM_H_Long_From01 18482 6.10 6.23 6.07 47 TM2_M_URI_OPT_OUT 17593 5.28 3.14 5.78 48 T_TooManySym_01 17593 5.29 3.16 5.78 49 BOTNET_IPINHOSTNAME 16885 8.08 19.11 5.54 50 MIME_HTML_ONLY_MULTI 16597 4.92 2.64 5.45 51 BAYES_60 16527 5.67 6.73 5.43 52 XMSexyCombo_05 15989 6.17 10.16 5.25 53 RELAYCOUNTRY_META 15753 8.93 25.26 5.17 54 BAYES_99 15569 9.76 29.94 5.11 55 BAYES_40 14844 4.65 3.70 4.87 56 MIME_QP_LONG_LINE 14703 4.64 3.83 4.83 57 XM_H_Trusted_IP 14503 3.87 0.00 4.76 58 DKIM_INVALID 13557 5.96 12.50 4.45 59 XMStrtUSub 13388 4.23 3.52 4.40 60 BAYES_999 12592 7.67 23.02 4.13 61 XMNumbers 12305 4.27 5.29 4.04 62 BAYES_20 11865 3.66 2.65 3.90 63 FROM_EXCESS_BASE64 11804 3.85 3.72 3.88 64 TR_XM_DK_SendGrid 11757 3.47 1.78 3.86 65 HTML_IMAGE_RATIO_06 11358 3.68 3.49 3.73 66 XM_UncommonTLD01 11159 6.30 17.73 3.66 67 RCVD_IN_IADB_LISTED 10527 3.08 1.42 3.46 68 UNPARSEABLE_RELAY 10516 3.26 2.44 3.45 69 TR_DCC_Bayes_99 9897 6.94 23.00 3.25 70 T_TooManySym_02 9804 2.81 1.05 3.22 71 T_REMOTE_IMAGE 9701 3.48 4.75 3.19 72 XMSubMetaSx_00 9311 3.64 6.18 3.06 73 RCVD_IN_IADB_SPF 9267 2.72 1.29 3.04 74 IN_ZIMBRA_NJ_WHITELIST 9022 2.41 0.01 2.96 75 BAYES_80 8640 3.71 7.49 2.84 76 BAYES_05 8308 2.50 1.53 2.73 77 RCVD_IN_IADB_SENDERID 8277 2.45 1.28 2.72 78 RCVD_IN_IADB_DK 8085 2.40 1.28 2.65 79 INVALID_MSGID 8058 2.20 0.26 2.65 80 MIME_HTML_MOSTLY 7927 3.13 5.45 2.60 81 TVD_RCVD_IP 7768 2.20 0.70 2.55 82 BOTNET 7565 6.39 23.34 2.48 83 ANY_BOUNCE_MESSAGE 7160 1.96 0.26 2.35 84 XM_CamelCaseFrm001 7157 2.93 5.43 2.35 85 BOUNCE_MESSAGE 7157 1.96 0.26 2.35 86 TO_MALFORMED 7103 1.90 0.03 2.33 87 MAILING_LIST_MULTI 6974 2.07 1.13 2.29 88 CK_HELO_DYNAMIC_SPLIT_IP 6670 1.81 0.17 2.19 89 HELO_DYNAMIC_IPADDR2 6665 1.80 0.09 2.19 90 NO_DNS_FOR_FROM 6476 3.48 9.35 2.13 91 HTML_IMAGE_RATIO_08 6446 2.14 2.24 2.12 92 RCVD_IN_IADB_VOUCHED 6409 1.78 0.39 2.10 93 XM_B_SpammyTLD 6137 2.36 3.86 2.01 94 RELAYCOUNTRY_CA 5926 2.73 6.13 1.95 95 XMBdyGiftCard01 5783 1.73 0.99 1.90 96 XM_PDF 5540 1.55 0.40 1.82 97 BAYES_95 5482 2.27 4.32 1.80 98 XMNoVowels 5438 1.81 1.89 1.79 99 USER_IN_DEF_DKIM_WL 5369 1.43 0.01 1.76 100 XMSubNoVowel 5311 1.58 0.87 1.74 101 UNTRUSTED_Relay 5294 4.69 17.52 1.74 102 IN_HORDE_ADDRESS_BOOK 5213 1.40 0.03 1.71 103 T_XMDrugObfuBody_14 5183 1.71 1.73 1.70 104 HTML_MIME_NO_HTML_TAG 5178 1.76 2.02 1.70 105 TooManyTo_002 5034 1.46 0.60 1.65 106 XM_DK_Undo_01 4964 1.56 1.23 1.63 107 TM2_M_VERY_LONG_WORD 4861 1.72 2.25 1.60 108 SUBJ_ALL_CAPS 4670 1.56 1.65 1.53 109 XMStockSpam_06 4538 1.54 1.78 1.49 110 XMDiploma_00 4470 1.67 2.55 1.47 111 XM_GoogleGroups 4357 1.24 0.40 1.43 112 URI_TRY_3LD 4307 1.42 1.47 1.41 113 T_XMDrugObfuBody_08 4103 1.85 4.04 1.35 114 RCVD_IN_IADB_OPTIN 4056 1.15 0.34 1.33 115 XM_OfRef6 3954 1.54 2.59 1.30 116 XM_ProductURIs 3861 1.37 1.80 1.27 117 HTML_FONT_FACE_BAD 3854 1.13 0.53 1.27 118 KHOP_HELO_FCRDNS 3830 2.62 8.53 1.26 119 XMGappySubj_01 3823 1.06 0.23 1.26 120 TooManyTo_003 3711 1.09 0.52 1.22 121 URI_HEX 3641 1.53 2.98 1.20 122 DKIM_ADSP_CUSTOM_MED 3622 1.37 2.18 1.19 123 XMBody_17 3493 1.38 2.38 1.15 124 T_FILL_THIS_FORM_SHORT 3480 1.19 1.37 1.14 125 RCVD_IN_MSPIKE_BL 3420 2.20 6.87 1.12 126 TR_MSPIKEBAYES00 3326 0.89 0.01 1.09 127 XM_B_Unsub2 3286 1.25 2.01 1.08 128 XM_SPF_SoftFail 3203 1.96 5.91 1.05 129 TooManyTo_004 3137 0.92 0.45 1.03 130 XMGenDplmaNmb 2985 1.16 1.94 0.98 131 TR_MetaPhish_Combo_01 2958 0.99 1.08 0.97 132 RCVD_IN_BL_SPAMCOP_NET 2926 1.67 4.75 0.96 133 RCVD_IN_MSPIKE_L3 2832 2.02 6.76 0.93 134 XM_UB50 2828 2.38 8.69 0.93 135 TR_Symld_Words 2770 1.01 1.47 0.91 136 XMPhish30 2743 1.00 1.44 0.90 137 XM_H_Long_From02 2715 0.90 0.94 0.89 138 TooManyTo_005 2710 0.79 0.38 0.89 139 T_TooManySym_03 2647 0.81 0.55 0.87 140 XM_B_REG_HTML 2451 0.82 0.90 0.80 141 XM_E_Blogspot 2448 0.68 0.12 0.80 142 MPART_ALT_DIFF_COUNT 2431 0.88 1.25 0.80 143 NML_ADSP_CUSTOM_MED 2423 1.03 2.03 0.80 144 RELAYCOUNTRY_GB 2378 0.89 1.34 0.78 145 XMPhish08 2324 0.79 0.88 0.76 146 PDS_OTHER_BAD_TLD 2223 1.71 5.96 0.73 147 XMBrknScrpt_02 2211 0.81 1.16 0.73 148 FILL_THIS_FORM 2193 0.65 0.33 0.72 149 T_XMDrugObfuBody_00 2174 0.87 1.57 0.71 150 HTTPS_HTTP_MISMATCH 2160 0.68 0.57 0.71 151 HELO_NODOT 2095 0.66 0.54 0.69 152 HELO_NO_DOMAIN 2090 0.66 0.54 0.69 153 XMHTML_After_End 1984 1.22 3.68 0.65 154 T_XMHurry_00 1970 0.86 1.79 0.65 155 XMSubMetaI_00 1927 0.81 1.59 0.63 156 PLING_QUERY 1917 0.66 0.79 0.63 157 HTML_IMAGE_ONLY_20 1829 0.56 0.38 0.60 158 XMHTMLBadTable_001 1817 0.64 0.83 0.60 159 DIET_1 1806 0.83 1.88 0.59 160 MISSING_HEADERS 1802 0.79 1.66 0.59 161 LOW_PRICE 1793 0.73 1.33 0.59 162 FORGED_GMAIL_RCVD 1792 0.84 1.94 0.59 163 USER_IN_WHITELIST 1780 0.48 0.00 0.58 164 SUBJ_DOLLARS 1712 0.63 0.92 0.56 165 XMCapTrack 1704 0.52 0.37 0.56 166 FILL_THIS_FORM_LONG 1662 0.48 0.19 0.55 167 XM_DIRTYINTL 1606 1.12 3.67 0.53 168 T_FILL_THIS_FORM_LOAN 1597 0.45 0.14 0.52 169 XM_H_PHPMailer 1548 0.80 2.05 0.51 170 XMLngstWrd_00 1535 0.46 0.28 0.50 171 TR_LOTS_OF_MONEY2 1477 0.53 0.72 0.48 172 T_MONEY_PERCENT 1477 0.53 0.72 0.48 173 XMSexyCombo_01 1427 0.72 1.80 0.47 174 XMLngstWrd_01 1397 0.42 0.26 0.46 175 XMBSHREFv2 1368 0.48 0.59 0.45 176 DKIM_ADSP_NXDOMAIN 1338 1.12 4.10 0.44 177 XM_RXBody 1325 0.50 0.80 0.44 178 HTML_TAG_BALANCE_BODY 1324 0.45 0.50 0.43 179 SpammyFromTLD_01 1294 0.64 1.57 0.42 180 RDNS_DYNAMIC 1282 0.90 3.01 0.42 181 TR_Mismatch_TLD_01 1271 0.68 1.81 0.42 182 XM_B_COPY_HTML 1211 0.54 1.14 0.40 183 XMBody_78 1210 0.51 1.00 0.40 184 XMSlimDrugH 1194 0.65 1.80 0.39 185 XMSubMetaSxObfu_02 1174 0.37 0.32 0.39 186 XMManySubDom_06 1172 0.36 0.23 0.38 187 RELAYCOUNTRY_DE 1171 0.98 3.56 0.38 188 TRACKER_ID 1160 0.38 0.37 0.38 189 XMLngstWrd_02 1149 0.35 0.21 0.38 190 TR_XM_PHPDW 1142 0.82 2.74 0.37 191 XMOemUri 1130 0.36 0.30 0.37 192 URG_BIZ 1123 0.38 0.45 0.37 193 XM_SPF_Unknown 1111 0.43 0.71 0.36 194 XMManySubDom_07 1100 0.31 0.09 0.36 195 XMRcvdHeader_15 1091 0.29 0.00 0.36 196 TR_XM_FormFill2 1077 0.78 2.65 0.35 197 TR_XM_PHPForged 1077 0.79 2.67 0.35 198 T_TooManySym_04 1077 0.31 0.14 0.35 199 NUMERIC_HTTP_ADDR 1077 0.36 0.37 0.35 200 TVD_SPACE_RATIO 1073 0.33 0.25 0.35 ----------------------------------------------------------------------