Email: 619692 Autolearn: 0 AvgScore: 1.11 AvgScanTime: 2.28 sec Spam: 113587 Autolearn: 0 AvgScore: 11.94 AvgScanTime: 4.23 sec Ham: 506105 Autolearn: 0 AvgScore: -1.31 AvgScanTime: 1.84 sec Time Spent Running SA: 391.78 hours Time Spent Processing Spam: 133.53 hours Time Spent Processing Ham: 258.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108078 90.17 95.15 89.06 2 DKIM_SIGNED 91046 76.33 80.16 75.47 3 XM_DK_Pass 88862 74.91 78.23 74.17 4 DCC_CHECK 87832 47.13 77.33 40.35 5 XM_B_Unicode 86955 73.51 76.55 72.82 6 RELAYCOUNTRY_US 86460 80.89 76.12 81.97 7 XMListUnsubscribeExists 76192 53.59 67.08 50.57 8 DKIM_VALID 74153 68.68 65.28 69.44 9 DKIM_VALID_AU 55397 50.08 48.77 50.37 10 BAYES_50 53675 51.33 47.25 52.25 11 XM_B_Unicode3 49986 41.29 44.01 40.68 12 XM_DK_Undo_02 47477 13.46 41.80 7.11 13 LOC_TINY_FONT_1 40417 26.66 35.58 24.65 14 MIME_HTML_ONLY 40093 22.82 35.30 20.03 15 HTML_FONT_LOW_CONTRAST 37292 28.53 32.83 27.56 16 DKIM_VALID_EF 31666 25.85 27.88 25.40 17 FVGT_m_MULTI_ODD 31485 23.17 27.72 22.15 18 T_KAM_HTML_FONT_INVALID 30051 19.81 26.46 18.32 19 BAYES_99 28467 7.20 25.06 3.19 20 XMSubLong 28005 21.49 24.66 20.78 21 BOTNET 26891 6.84 23.67 3.06 22 RELAYCOUNTRY_META 24396 8.47 21.48 5.55 23 DCC_CHECK_NEGATIVE 23736 50.82 20.90 57.53 24 TR_DCC_Bayes_99 22088 4.84 19.45 1.57 25 T_TM2_M_HEADER_IN_MSG 21518 27.15 18.94 28.99 26 XM_Body_Dirty_Words 21370 13.97 18.81 12.88 27 BAYES_999 21179 5.34 18.65 2.35 28 XM_Multi_Part_URI 18626 12.73 16.40 11.91 29 BOTNET_IPINHOSTNAME 18583 7.01 16.36 4.92 30 XM_B_Unsub 17525 12.87 15.43 12.30 31 DKIM_INVALID 16893 7.65 14.87 6.03 32 UNTRUSTED_Relay 16764 4.10 14.76 1.71 33 XM_UncommonTLD01 15974 5.18 14.06 3.18 34 HTML_IMAGE_RATIO_02 14370 8.11 12.65 7.09 35 LOTS_OF_MONEY 14230 9.65 12.53 9.01 36 FSL_BULK_SIG 13614 7.80 11.99 6.86 37 NO_DNS_FOR_FROM 13360 4.74 11.76 3.16 38 XM_B_Phish_Phrases 12442 9.30 10.95 8.93 39 XM_Evil_Numbers_Gen 11366 8.94 10.01 8.70 40 XMSexyCombo_05 11058 4.81 9.74 3.71 41 XM_UB50 10737 2.49 9.45 0.93 42 RCVD_IN_MSPIKE_H2 10718 12.81 9.44 13.56 43 LotsOfNums_01 10344 8.96 9.11 8.92 44 TooManyTo_001 8627 8.87 7.60 9.16 45 HTML_IMAGE_RATIO_04 8429 6.94 7.42 6.83 46 MPART_ALT_DIFF 7963 5.60 7.01 5.29 47 XM_H_Long_From01 7931 5.87 6.98 5.62 48 BAYES_80 7726 3.65 6.80 2.95 49 KHOP_HELO_FCRDNS 7485 2.75 6.59 1.89 50 RCVD_IN_MSPIKE_BL 7199 3.01 6.34 2.27 51 FROM_SUSPICIOUS_NTLD 7197 1.21 6.34 0.06 52 FROM_SUSPICIOUS_NTLD_FP 7144 1.20 6.29 0.05 53 XMSubMetaSx_00 6986 3.75 6.15 3.21 54 RCVD_IN_MSPIKE_L3 6900 2.93 6.07 2.23 55 BAYES_60 6797 5.36 5.98 5.22 56 UNPARSEABLE_RELAY 6437 8.13 5.67 8.68 57 XM_SPF_SoftFail 6418 2.37 5.65 1.63 58 MIME_QP_LONG_LINE 6271 6.43 5.52 6.63 59 XM_CamelCaseFrm001 6164 2.51 5.43 1.85 60 LongTLD 6071 1.14 5.34 0.19 61 XMNumbers 5942 3.68 5.23 3.33 62 XM_SendGrid 5584 6.39 4.92 6.72 63 PDS_OTHER_BAD_TLD 5543 1.28 4.88 0.48 64 TR_Mismatch_TLD_01 5263 1.02 4.63 0.21 65 T_REMOTE_IMAGE 5219 3.98 4.59 3.84 66 HTML_MIME_NO_HTML_TAG 5189 2.71 4.57 2.29 67 ALL_TRUSTED 4805 12.54 4.23 14.41 68 T_XMDrugObfuBody_08 4787 2.19 4.21 1.74 69 MIME_HTML_MOSTLY 4782 2.61 4.21 2.25 70 XMStrtUSub 4766 3.99 4.20 3.95 71 XM_B_SpammyTLD 4715 2.46 4.15 2.08 72 RELAYCOUNTRY_CA 4694 2.06 4.13 1.59 73 HTML_IMAGE_RATIO_06 4686 3.65 4.13 3.54 74 XM_B_Unsub2 4674 2.65 4.11 2.32 75 TM2_M_URI_OPT_OUT 4560 3.34 4.01 3.19 76 BAYES_95 4540 2.27 4.00 1.88 77 RCVD_IN_BL_SPAMCOP_NET 4478 1.58 3.94 1.05 78 BAYES_40 4308 5.56 3.79 5.95 79 URIBL_SBL_A 4212 1.54 3.71 1.05 80 DKIM_ADSP_NXDOMAIN 3972 0.83 3.50 0.23 81 MIME_HTML_ONLY_MULTI 3850 3.39 3.39 3.39 82 XM_DIRTYINTL 3788 1.06 3.33 0.55 83 XM_OfRef6 3705 2.08 3.26 1.81 84 RELAYCOUNTRY_FR 3688 0.81 3.25 0.26 85 XM_URI_RBL 3594 0.78 3.16 0.25 86 XMHTML_After_End 3500 1.09 3.08 0.65 87 SpammyFromTLD_02 3391 0.87 2.99 0.40 88 BAYES_20 3363 4.47 2.96 4.81 89 RCVD_IN_MSPIKE_WL 3258 8.42 2.87 9.67 90 RCVD_IN_MSPIKE_H3 3258 8.42 2.87 9.67 91 SpammyFromTLD_01 3240 1.19 2.85 0.81 92 FROM_EXCESS_BASE64 3169 2.96 2.79 3.00 93 HTML_IMAGE_ONLY_08 3085 0.60 2.72 0.13 94 T_TooManySym_01 3053 3.76 2.69 4.01 95 HTML_SHORT_LINK_IMG_1 3034 0.50 2.67 0.02 96 DATE_IN_PAST_03_06 3029 0.67 2.67 0.22 97 RDNS_DYNAMIC 3003 0.75 2.64 0.32 98 HDRS_MISSP 2973 0.50 2.62 0.02 99 RELAYCOUNTRY_DE 2956 0.95 2.60 0.58 100 NO_FM_NAME_IP_HOSTN 2944 0.48 2.59 0.00 101 BAYES_00 2880 17.26 2.54 20.56 102 TR_XM_MaxBayes 2735 0.45 2.41 0.01 103 MIME_HEADER_CTYPE_ONLY 2729 0.63 2.40 0.23 104 FROM_DOMAIN_NOVOWEL 2712 0.45 2.39 0.02 105 FVGT_m_MULTI_ODD_EMAIL 2664 0.45 2.35 0.02 106 XMDiploma_00 2611 1.65 2.30 1.50 107 HDRS_LCASE_IMGONLY 2595 0.43 2.28 0.01 108 FROM_LOCAL_NOVOWEL 2578 0.43 2.27 0.02 109 HTML_IMAGE_RATIO_08 2567 2.23 2.26 2.22 110 T_XMHurry_00 2564 0.87 2.26 0.56 111 SHORT_IMG_SUSP_NTLD 2532 0.41 2.23 0.00 112 TR_XM_PHPDW 2486 0.69 2.19 0.36 113 URI_HEX 2478 1.48 2.18 1.32 114 T_XMDrugObfuBody_14 2464 1.88 2.17 1.81 115 TR_XM_PHPForged 2439 0.67 2.15 0.34 116 XMNoVowels 2437 1.84 2.15 1.77 117 DATE_IN_PAST_06_12 2424 0.62 2.13 0.28 118 TR_LOTS_OF_MONEY2 2422 0.67 2.13 0.35 119 T_MONEY_PERCENT 2422 0.67 2.13 0.35 120 TR_XM_FormFill2 2417 0.67 2.13 0.34 121 XM_H_PHPOS 2412 0.66 2.12 0.33 122 TR_XM_INV_DKIM 2373 0.45 2.09 0.08 123 RCVD_IN_RP_RNBL 2354 0.43 2.07 0.06 124 TR_XM_DK_SendGrid 2345 3.36 2.06 3.65 125 BODY_URI_ONLY 2341 0.46 2.06 0.10 126 TR_Mismatch_TLD_02 2304 0.42 2.03 0.06 127 TR_LOTS_OF_MONEY3 2238 0.91 1.97 0.67 128 RCVD_IN_IADB_LISTED 2228 5.18 1.96 5.91 129 XM_Nigeria_01 2194 0.40 1.93 0.06 130 URI_WP_HACKED_2 2187 0.75 1.93 0.48 131 RELAYCOUNTRY_FI 2183 0.37 1.92 0.02 132 BOTNET_NORDNS 2176 0.36 1.92 0.01 133 XMBody_17 2162 0.80 1.90 0.55 134 TM2_M_VERY_LONG_WORD 2137 1.40 1.88 1.29 135 RCVD_IN_IADB_SPF 2070 4.53 1.82 5.13 136 TooManyTo_002 2052 2.66 1.81 2.85 137 RCVD_IN_IADB_DK 2023 3.95 1.78 4.43 138 XMSexyCombo_01 2017 0.73 1.78 0.50 139 RCVD_IN_IADB_SENDERID 2015 3.98 1.77 4.47 140 TR_XM_DK_Bayes 1998 11.81 1.76 14.06 141 RCVD_IN_RP_SAFE 1994 6.38 1.76 7.42 142 HTML_TITLE_SUBJ_DIFF 1992 0.72 1.75 0.49 143 XMStockSpam_06 1966 1.24 1.73 1.14 144 TR_XM_RelayPhish 1929 0.55 1.70 0.29 145 XM_XX_Yahoo 1921 0.35 1.69 0.04 146 BAYES_05 1828 2.90 1.61 3.18 147 XM_Combo_Sbj 1808 0.43 1.59 0.17 148 XM_DK_Undo_01 1797 1.84 1.58 1.90 149 TooManyTo_003 1795 1.95 1.58 2.04 150 XMMoneyMeta_00 1773 0.89 1.56 0.75 151 URI_TRY_3LD 1752 1.57 1.54 1.57 152 T_XMDrugObfuBody_00 1741 0.83 1.53 0.67 153 NORDNS_LOW_CONTRAST 1732 0.30 1.52 0.02 154 XM_H_Undi_Recip 1731 0.51 1.52 0.28 155 HK_SCAM 1696 0.30 1.49 0.03 156 XMGenDplmaNmb 1689 0.98 1.49 0.86 157 TR_Symld_Words 1678 1.28 1.48 1.23 158 MAILING_LIST_MULTI 1676 2.43 1.48 2.64 159 SUBJ_ALL_CAPS 1615 1.70 1.42 1.76 160 RELAYCOUNTRY_GB 1614 1.21 1.42 1.16 161 XM_H_Long_From02 1569 1.21 1.38 1.17 162 URI_WP_DIRINDEX 1563 0.67 1.38 0.51 163 MPART_ALT_DIFF_COUNT 1536 0.61 1.35 0.45 164 MONEY_FRAUD_8 1532 0.25 1.35 0.00 165 TooManyTo_004 1525 1.53 1.34 1.57 166 XMPhish08 1524 0.61 1.34 0.44 167 XM_iOS_Forged_Message 1502 0.33 1.32 0.11 168 MILLION_HUNDRED 1478 0.24 1.30 0.00 169 TR_XM_Undi_Recip5 1469 0.25 1.29 0.01 170 RCVD_IN_RP_CERTIFIED 1441 5.64 1.27 6.63 171 XMSubMetaI_00 1416 0.75 1.25 0.64 172 TR_XM_MaxSPIKE 1412 0.28 1.24 0.07 173 XMBdyGiftCard01 1401 1.03 1.23 0.98 174 XMPhish30 1373 0.47 1.21 0.31 175 XM_ProductURIs 1325 0.74 1.17 0.65 176 XM_H_MailChimp 1318 0.40 1.16 0.23 177 XMSubMetaSxObfu_03 1303 0.68 1.15 0.57 178 TR_MetaPhish_Combo_01 1299 1.00 1.14 0.96 179 RELAYCOUNTRY_IN 1248 0.25 1.10 0.06 180 TR_XM_DK_Bayes1 1230 10.79 1.08 12.97 181 T_FILL_THIS_FORM_SHORT 1204 1.21 1.06 1.25 182 XM_H_PHPMailer 1203 0.56 1.06 0.45 183 XM_UB99 1187 0.21 1.05 0.02 184 XM_SPF_Unknown 1177 0.67 1.04 0.59 185 XM_CreditScore_03 1160 0.20 1.02 0.02 186 DIET_1 1160 0.42 1.02 0.29 187 XM_B_COPY_HTML 1147 0.48 1.01 0.36 188 DKIM_ADSP_CUSTOM_MED 1146 1.38 1.01 1.46 189 XM_UB60 1145 0.25 1.01 0.08 190 TooManyTo_005 1125 1.24 0.99 1.30 191 XMMoneyMeta_01 1122 0.26 0.99 0.09 192 HTTPS_HTTP_MISMATCH 1073 0.84 0.94 0.81 193 XM_BadFromFormat 1037 0.26 0.91 0.12 194 URIBL_BLACK 1023 0.18 0.90 0.02 195 XMBrknScrpt_02 1011 0.70 0.89 0.66 196 DATE_IN_PAST_12_24 1009 0.22 0.89 0.07 197 FORGED_GMAIL_RCVD 994 0.58 0.88 0.52 198 XM_H_PHPOS_M 990 0.27 0.87 0.14 199 LONG_IMG_URI 982 0.22 0.86 0.07 200 TVD_RCVD_IP 958 1.89 0.84 2.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 450725 90.17 95.15 89.06 2 RELAYCOUNTRY_US 414830 80.89 76.12 81.97 3 DKIM_SIGNED 381965 76.33 80.16 75.47 4 XM_DK_Pass 375366 74.91 78.23 74.17 5 XM_B_Unicode 368558 73.51 76.55 72.82 6 DKIM_VALID 351430 68.68 65.28 69.44 7 DCC_CHECK_NEGATIVE 291186 50.82 20.90 57.53 8 BAYES_50 264435 51.33 47.25 52.25 9 XMListUnsubscribeExists 255917 53.59 67.08 50.57 10 DKIM_VALID_AU 254922 50.08 48.77 50.37 11 XM_B_Unicode3 205890 41.29 44.01 40.68 12 DCC_CHECK 204225 47.13 77.33 40.35 13 T_TM2_M_HEADER_IN_MSG 146734 27.15 18.94 28.99 14 HTML_FONT_LOW_CONTRAST 139482 28.53 32.83 27.56 15 DKIM_VALID_EF 128528 25.85 27.88 25.40 16 LOC_TINY_FONT_1 124773 26.66 35.58 24.65 17 FVGT_m_MULTI_ODD 112101 23.17 27.72 22.15 18 XMSubLong 105156 21.49 24.66 20.78 19 BAYES_00 104068 17.26 2.54 20.56 20 MIME_HTML_ONLY 101349 22.82 35.30 20.03 21 T_KAM_HTML_FONT_INVALID 92701 19.81 26.46 18.32 22 ALL_TRUSTED 72910 12.54 4.23 14.41 23 TR_XM_DK_Bayes 71170 11.81 1.76 14.06 24 RCVD_IN_MSPIKE_H2 68652 12.81 9.44 13.56 25 TR_XM_DK_Bayes1 65659 10.79 1.08 12.97 26 XM_Body_Dirty_Words 65208 13.97 18.81 12.88 27 XM_B_Unsub 62257 12.87 15.43 12.30 28 XM_Multi_Part_URI 60288 12.73 16.40 11.91 29 TR_XM_DK_Bayes2 57569 9.43 0.76 11.37 30 RCVD_IN_MSPIKE_H3 48922 8.42 2.87 9.67 31 RCVD_IN_MSPIKE_WL 48922 8.42 2.87 9.67 32 TooManyTo_001 46348 8.87 7.60 9.16 33 LOTS_OF_MONEY 45583 9.65 12.53 9.01 34 XM_B_Phish_Phrases 45191 9.30 10.95 8.93 35 LotsOfNums_01 45152 8.96 9.11 8.92 36 XM_Evil_Numbers_Gen 44049 8.94 10.01 8.70 37 UNPARSEABLE_RELAY 43921 8.13 5.67 8.68 38 RCVD_IN_RP_SAFE 37566 6.38 1.76 7.42 39 XM_DKIMWhitelistDomains 36150 5.88 0.26 7.14 40 XM_DK_Undo_02 35964 13.46 41.80 7.11 41 HTML_IMAGE_RATIO_02 35870 8.11 12.65 7.09 42 FSL_BULK_SIG 34725 7.80 11.99 6.86 43 HTML_IMAGE_RATIO_04 34562 6.94 7.42 6.83 44 XM_SendGrid 33987 6.39 4.92 6.72 45 MIME_QP_LONG_LINE 33568 6.43 5.52 6.63 46 RCVD_IN_RP_CERTIFIED 33530 5.64 1.27 6.63 47 DKIM_INVALID 30535 7.65 14.87 6.03 48 BAYES_40 30122 5.56 3.79 5.95 49 RCVD_IN_IADB_LISTED 29899 5.18 1.96 5.91 50 XM_H_Long_From01 28460 5.87 6.98 5.62 51 RELAYCOUNTRY_META 28064 8.47 21.48 5.55 52 MPART_ALT_DIFF 26763 5.60 7.01 5.29 53 BAYES_60 26415 5.36 5.98 5.22 54 RCVD_IN_IADB_SPF 25980 4.53 1.82 5.13 55 BOTNET_IPINHOSTNAME 24880 7.01 16.36 4.92 56 BAYES_20 24352 4.47 2.96 4.81 57 XM_PDF 22687 3.79 0.71 4.48 58 RCVD_IN_IADB_SENDERID 22631 3.98 1.77 4.47 59 RCVD_IN_IADB_DK 22430 3.95 1.78 4.43 60 T_TooManySym_01 20274 3.76 2.69 4.01 61 XMStrtUSub 19969 3.99 4.20 3.95 62 T_REMOTE_IMAGE 19442 3.98 4.59 3.84 63 XMSexyCombo_05 18777 4.81 9.74 3.71 64 RCVD_IN_IADB_VOUCHED 18756 3.12 0.53 3.71 65 TR_XM_DK_SendGrid 18448 3.36 2.06 3.65 66 HTML_IMAGE_RATIO_06 17935 3.65 4.13 3.54 67 IN_ZIMBRA_NJ_WHITELIST 17295 2.79 0.01 3.42 68 MIME_HTML_ONLY_MULTI 17171 3.39 3.39 3.39 69 XMNumbers 16877 3.68 5.23 3.33 70 XM_H_Trusted_IP 16715 2.70 0.00 3.30 71 XMSubMetaSx_00 16230 3.75 6.15 3.21 72 TM2_M_URI_OPT_OUT 16154 3.34 4.01 3.19 73 BAYES_99 16149 7.20 25.06 3.19 74 BAYES_05 16116 2.90 1.61 3.18 75 XM_UncommonTLD01 16110 5.18 14.06 3.18 76 NO_DNS_FOR_FROM 15998 4.74 11.76 3.16 77 BOTNET 15507 6.84 23.67 3.06 78 FROM_EXCESS_BASE64 15164 2.96 2.79 3.00 79 BAYES_80 14918 3.65 6.80 2.95 80 TooManyTo_002 14442 2.66 1.81 2.85 81 MAILING_LIST_MULTI 13370 2.43 1.48 2.64 82 ANY_BOUNCE_MESSAGE 12136 2.05 0.51 2.40 83 BOUNCE_MESSAGE 12126 2.05 0.51 2.40 84 BAYES_999 11882 5.34 18.65 2.35 85 RCVD_IN_IADB_OPTIN 11787 1.98 0.42 2.33 86 XM_B_Unsub2 11727 2.65 4.11 2.32 87 HTML_MIME_NO_HTML_TAG 11575 2.71 4.57 2.29 88 RCVD_IN_MSPIKE_BL 11470 3.01 6.34 2.27 89 MIME_HTML_MOSTLY 11407 2.61 4.21 2.25 90 RCVD_IN_MSPIKE_L3 11275 2.93 6.07 2.23 91 HTML_IMAGE_RATIO_08 11241 2.23 2.26 2.22 92 TVD_RCVD_IP 10747 1.89 0.84 2.12 93 XM_B_SpammyTLD 10521 2.46 4.15 2.08 94 TooManyTo_003 10316 1.95 1.58 2.04 95 T_TooManySym_02 10243 1.75 0.55 2.02 96 XM_DK_Undo_01 9591 1.84 1.58 1.90 97 KHOP_HELO_FCRDNS 9541 2.75 6.59 1.89 98 BAYES_95 9519 2.27 4.00 1.88 99 XM_CamelCaseFrm001 9388 2.51 5.43 1.85 100 T_XMDrugObfuBody_14 9180 1.88 2.17 1.81 101 XM_OfRef6 9173 2.08 3.26 1.81 102 XMNoVowels 8982 1.84 2.15 1.77 103 SUBJ_ALL_CAPS 8907 1.70 1.42 1.76 104 T_XMDrugObfuBody_08 8788 2.19 4.21 1.74 105 UNTRUSTED_Relay 8643 4.10 14.76 1.71 106 XM_SPF_SoftFail 8263 2.37 5.65 1.63 107 IN_HORDE_ADDRESS_BOOK 8169 1.32 0.03 1.61 108 RELAYCOUNTRY_CA 8066 2.06 4.13 1.59 109 TooManyTo_004 7950 1.53 1.34 1.57 110 CK_HELO_DYNAMIC_SPLIT_IP 7948 1.34 0.33 1.57 111 URI_TRY_3LD 7948 1.57 1.54 1.57 112 HELO_DYNAMIC_IPADDR2 7942 1.29 0.05 1.57 113 TR_DCC_Bayes_99 7936 4.84 19.45 1.57 114 INVALID_MSGID 7876 1.31 0.21 1.56 115 HELO_NODOT 7737 1.37 0.65 1.53 116 HELO_NO_DOMAIN 7736 1.37 0.64 1.53 117 XMDiploma_00 7606 1.65 2.30 1.50 118 DKIM_ADSP_CUSTOM_MED 7392 1.38 1.01 1.46 119 XM_GoogleGroups 7294 1.27 0.49 1.44 120 XMGappySubj_01 7022 1.17 0.18 1.39 121 TO_MALFORMED 6913 1.12 0.03 1.37 122 HTML_FONT_FACE_BAD 6805 1.20 0.54 1.34 123 URI_HEX 6691 1.48 2.18 1.32 124 XMCapTrack 6644 1.16 0.47 1.31 125 TooManyTo_005 6569 1.24 0.99 1.30 126 TM2_M_VERY_LONG_WORD 6508 1.40 1.88 1.29 127 T_FILL_THIS_FORM_SHORT 6311 1.21 1.06 1.25 128 TR_Symld_Words 6238 1.28 1.48 1.23 129 XM_H_Long_From02 5906 1.21 1.38 1.17 130 RELAYCOUNTRY_GB 5873 1.21 1.42 1.16 131 XMStockSpam_06 5749 1.24 1.73 1.14 132 NML_ADSP_CUSTOM_MED 5570 1.03 0.71 1.10 133 XMSubNoVowel 5348 0.98 0.65 1.06 134 RCVD_IN_BL_SPAMCOP_NET 5321 1.58 3.94 1.05 135 URIBL_SBL_A 5319 1.54 3.71 1.05 136 XMBdyGiftCard01 4976 1.03 1.23 0.98 137 TR_MetaPhish_Combo_01 4872 1.00 1.14 0.96 138 XM_UB50 4716 2.49 9.45 0.93 139 USER_IN_DEF_DKIM_WL 4594 0.74 0.01 0.91 140 TR_MSPIKEBAYES00 4480 0.73 0.01 0.89 141 XMGenDplmaNmb 4370 0.98 1.49 0.86 142 HTTPS_HTTP_MISMATCH 4111 0.84 0.94 0.81 143 SpammyFromTLD_01 4107 1.19 2.85 0.81 144 T_Symld_Words_02 3974 0.76 0.67 0.79 145 XMMoneyMeta_00 3771 0.89 1.56 0.75 146 XMSolicitRefs_0 3769 0.73 0.68 0.74 147 FROM_GOV_DKIM_AU 3477 0.59 0.16 0.69 148 TR_LOTS_OF_MONEY3 3415 0.91 1.97 0.67 149 T_XMDrugObfuBody_00 3377 0.83 1.53 0.67 150 XMBrknScrpt_02 3318 0.70 0.89 0.66 151 XMHTML_After_End 3273 1.09 3.08 0.65 152 XM_ProductURIs 3272 0.74 1.17 0.65 153 XMSubMetaI_00 3255 0.75 1.25 0.64 154 T_OBFU_PDF_ATTACH 3225 0.55 0.17 0.64 155 T_TooManySym_03 3105 0.55 0.24 0.61 156 HTML_IMAGE_ONLY_20 3024 0.55 0.34 0.60 157 MISSING_HEADERS 3002 0.55 0.34 0.59 158 XM_SPF_Unknown 2984 0.67 1.04 0.59 159 RELAYCOUNTRY_DE 2939 0.95 2.60 0.58 160 XMSubMetaSxObfu_03 2907 0.68 1.15 0.57 161 T_XMHurry_00 2821 0.87 2.26 0.56 162 XMBody_17 2805 0.80 1.90 0.55 163 XM_DIRTYINTL 2759 1.06 3.33 0.55 164 XMGappySubj_02 2642 0.44 0.07 0.52 165 FORGED_GMAIL_RCVD 2621 0.58 0.88 0.52 166 URI_WP_DIRINDEX 2579 0.67 1.38 0.51 167 TM2_M_BODY_EMPTY 2554 0.43 0.09 0.50 168 XM_ShortIntro_01 2531 0.47 0.31 0.50 169 FILL_THIS_FORM 2509 0.45 0.22 0.50 170 XMSexyCombo_01 2509 0.73 1.78 0.50 171 XMRcvdHeader_15 2493 0.40 0.00 0.49 172 HTML_TITLE_SUBJ_DIFF 2471 0.72 1.75 0.49 173 XM_RXBody 2463 0.49 0.48 0.49 174 RCVD_IN_SORBS_DUL 2462 0.41 0.06 0.49 175 URI_WP_HACKED_2 2431 0.75 1.93 0.48 176 PDS_OTHER_BAD_TLD 2420 1.28 4.88 0.48 177 PLING_QUERY 2341 0.48 0.57 0.46 178 XM_Body_Obfu01 2296 0.43 0.32 0.45 179 XM_H_PHPMailer 2286 0.56 1.06 0.45 180 MPART_ALT_DIFF_COUNT 2265 0.61 1.35 0.45 181 FROM_GOV_SPOOF 2249 0.40 0.22 0.44 182 XMPhish08 2236 0.61 1.34 0.44 183 RELAYCOUNTRY_AU 2159 0.48 0.73 0.43 184 HTML_IMAGE_ONLY_32 2098 0.41 0.38 0.41 185 HTML_TAG_BALANCE_BODY 2097 0.44 0.53 0.41 186 XMBody_95 2041 0.35 0.12 0.40 187 XMHTMLBadTable_001 2039 0.44 0.61 0.40 188 USER_IN_WHITELIST 2032 0.33 0.00 0.40 189 SpammyFromTLD_02 2029 0.87 2.99 0.40 190 XMBody_78 2000 0.45 0.71 0.40 191 SHORT_HELO_AND_INLINE_IMAGE 1998 0.33 0.02 0.39 192 XMSUPPORT 1987 0.32 0.00 0.39 193 XM_B_REG_HTML 1949 0.39 0.43 0.39 194 XMDateMe_00 1912 0.38 0.38 0.38 195 XM_H_SpoofStaff4 1900 0.32 0.08 0.38 196 MY_SERVERS_FOUND 1895 0.34 0.19 0.37 197 URI_NOVOWEL 1882 0.41 0.55 0.37 198 HK_RANDOM_REPLYTO 1848 0.45 0.80 0.37 199 GMD_PDF_EMPTY_BODY 1847 0.31 0.09 0.36 200 XMLngstWrd_00 1842 0.38 0.46 0.36 ----------------------------------------------------------------------