Email: 696376 Autolearn: 0 AvgScore: 4.50 AvgScanTime: 4.78 sec Spam: 229892 Autolearn: 0 AvgScore: 12.70 AvgScanTime: 5.28 sec Ham: 466484 Autolearn: 0 AvgScore: 0.46 AvgScanTime: 4.53 sec Time Spent Running SA: 923.83 hours Time Spent Processing Spam: 337.29 hours Time Spent Processing Ham: 586.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 219145 90.21 95.33 87.69 2 DKIM_SIGNED 178484 71.86 77.64 69.02 3 XM_DK_Pass 173868 70.27 75.63 67.63 4 DKIM_VALID 166602 66.93 72.47 64.21 5 DCC_CHECK 164432 45.37 71.53 32.48 6 XMListUnsubscribeExists 149892 52.19 65.20 45.78 7 DKIM_VALID_AU 128219 48.61 55.77 45.08 8 XM_H_QuotedFrom 108908 38.65 47.37 34.34 9 XM_DK_Undo_02 99690 22.69 43.36 12.50 10 BAYES_99 91507 21.09 39.80 11.87 11 MIME_HTML_ONLY 85941 23.72 37.38 16.99 12 BAYES_999 77594 17.99 33.75 10.22 13 HTML_FONT_LOW_CONTRAST 76087 27.97 33.10 25.44 14 LOC_TINY_FONT_1 75109 23.60 32.67 19.13 15 BAYES_50 74672 50.62 32.48 59.56 16 TR_DCC_Bayes_99 71648 13.72 31.17 5.12 17 DCC_CHECK_NEGATIVE 62225 52.81 27.07 65.50 18 XMSubLong 61754 21.32 26.86 18.59 19 FVGT_m_MULTI_ODD 56537 22.10 24.59 20.87 20 DKIM_VALID_EF 49705 24.96 21.62 26.61 21 T_TM2_M_HEADER_IN_MSG 47306 27.34 20.58 30.67 22 T_KAM_HTML_FONT_INVALID 44332 16.75 19.28 15.51 23 XM_Body_Dirty_Words 42074 12.82 18.30 10.12 24 FROM_EXCESS_BASE64 39552 7.80 17.20 3.16 25 XM_Multi_Part_URI 35050 11.33 15.25 9.40 26 HTML_IMAGE_RATIO_02 33172 9.08 14.43 6.44 27 MultiRelay 32338 16.68 14.07 17.97 28 T_REMOTE_IMAGE 31590 7.62 13.74 4.60 29 RELAYCOUNTRY_META 30454 7.59 13.25 4.81 30 XM_Evil_Numbers_Gen 30394 9.35 13.22 7.44 31 HTML_MIME_NO_HTML_TAG 29361 5.71 12.77 2.23 32 FSL_BULK_SIG 26986 7.83 11.74 5.90 33 HTML_SHORT_LINK_IMG_1 26653 5.41 11.59 2.37 34 BODY_URI_ONLY 26271 3.85 11.43 0.12 35 BOTNET_IPINHOSTNAME 26230 7.17 11.41 5.08 36 RCVD_IN_RP_RNBL 26189 3.79 11.39 0.05 37 MISSING_HEADERS 25772 4.08 11.21 0.57 38 SHORTENED_URL_SRC 25666 5.25 11.16 2.33 39 SHORTENER_SHORT_IMG 25638 5.24 11.15 2.33 40 URI_BUFFLY 25619 5.24 11.14 2.33 41 MIME_HEADER_CTYPE_ONLY 25213 3.71 10.97 0.14 42 LOTS_OF_MONEY 24634 8.49 10.72 7.40 43 BOTNET 22469 3.86 9.77 0.94 44 BAYES_80 20794 5.76 9.05 4.14 45 HTML_IMAGE_RATIO_04 20759 6.55 9.03 5.33 46 XM_B_Phish_Phrases 20692 5.67 9.00 4.02 47 BAYES_60 20557 7.71 8.94 7.10 48 XMSexyCombo_05 20493 4.33 8.91 2.07 49 XMNumbers 20119 4.77 8.75 2.81 50 T_XMDrugObfuBody_14 20112 8.34 8.75 8.13 51 UNTRUSTED_Relay 17932 3.38 7.80 1.19 52 XM_H_Long_From01 17456 6.34 7.59 5.72 53 HTML_IMAGE_ONLY_04 17054 3.41 7.42 1.43 54 XM_UncommonTLD01 15992 4.42 6.96 3.18 55 LotsOfNums_01 15890 7.93 6.91 8.44 56 TooManyTo_001 15542 8.09 6.76 8.74 57 XMSubMetaSx_00 15451 4.76 6.72 3.79 58 HTML_SHORT_CENTER 15172 3.06 6.60 1.31 59 MPART_ALT_DIFF 15053 4.07 6.55 2.85 60 TR_XM_DocInvoice 14836 4.36 6.45 3.33 61 BAYES_95 12761 3.71 5.55 2.80 62 RCVD_IN_RP_SAFE 12071 7.07 5.25 7.97 63 DKIM_INVALID 11882 4.93 5.17 4.81 64 XMStrtUSub 10922 4.20 4.75 3.93 65 HTML_IMAGE_RATIO_06 10310 3.47 4.48 2.98 66 HTML_IMAGE_ONLY_08 9906 2.16 4.31 1.10 67 RCVD_IN_RP_CERTIFIED 9715 6.51 4.23 7.64 68 MIME_HTML_MOSTLY 9692 3.10 4.22 2.54 69 MIME_QP_LONG_LINE 9410 5.48 4.09 6.17 70 XM_SendGrid 9301 4.58 4.05 4.85 71 TM2_M_URI_OPT_OUT 9017 2.87 3.92 2.35 72 XM_DIRTYINTL 7926 2.23 3.45 1.63 73 XM_UB50 7896 1.68 3.43 0.81 74 RCVD_IN_MSPIKE_H2 7814 4.46 3.40 4.99 75 DIET_1 7224 1.27 3.14 0.35 76 XM_CamelCaseFrm001 7150 2.25 3.11 1.82 77 XM_SPF_SoftFail 7063 2.39 3.07 2.06 78 RELAYCOUNTRY_CA 6968 1.93 3.03 1.39 79 RCVD_IN_BL_SPAMCOP_NET 6939 1.33 3.02 0.50 80 SpammyFromTLD_02 6689 1.11 2.91 0.23 81 URI_HEX 6594 2.11 2.87 1.74 82 MIME_HTML_ONLY_MULTI 6400 1.66 2.78 1.11 83 XM_OfRef6 6234 1.78 2.71 1.33 84 HTML_IMAGE_RATIO_08 6059 2.12 2.64 1.86 85 T_TooManySym_01 5934 3.30 2.58 3.65 86 XMDiploma_00 5901 2.28 2.57 2.14 87 T_XMDrugObfuBody_08 5613 1.74 2.44 1.40 88 SpammyFromTLD_01 5413 1.29 2.35 0.77 89 ALL_TRUSTED 5335 15.29 2.32 21.68 90 RCVD_IN_IADB_LISTED 5318 4.90 2.31 6.18 91 XM_URI_RBL 5308 0.84 2.31 0.12 92 RCVD_IN_IADB_SPF 4734 4.26 2.06 5.34 93 RCVD_IN_IADB_SENDERID 4483 3.76 1.95 4.65 94 XMSexyCombo_01 4453 0.93 1.94 0.43 95 RCVD_IN_IADB_DK 4426 3.68 1.93 4.54 96 MultiRelay_CC 4293 0.73 1.87 0.17 97 MultiRelay_Combo 4293 0.73 1.87 0.17 98 XMBdyGiftCard01 4200 1.10 1.83 0.75 99 XMGenDplmaNmb 4112 1.36 1.79 1.15 100 SUBJ_ALL_CAPS 3651 1.55 1.59 1.53 101 XMMoneyMeta_00 3637 0.85 1.58 0.48 102 MAILING_LIST_MULTI 3579 1.98 1.56 2.18 103 XM_DK_Undo_01 3569 1.73 1.55 1.82 104 TR_XM_RelayPhish 3429 0.81 1.49 0.47 105 XM_UB99 3305 0.51 1.44 0.05 106 TM2_M_VERY_LONG_WORD 3227 1.01 1.40 0.82 107 XM_ProductURIs 3188 1.09 1.39 0.94 108 BAYES_00 3176 4.92 1.38 6.67 109 T_Symld_Words_02 3168 0.78 1.38 0.49 110 XMSubMetaI_00 3155 0.97 1.37 0.77 111 TR_LOTS_OF_MONEY1 3148 0.47 1.37 0.03 112 XM_RXBody 3098 0.51 1.35 0.10 113 T_XMHurry_00 3095 0.80 1.35 0.54 114 URIBL_BLACK 3070 0.46 1.34 0.03 115 RELAYCOUNTRY_FR 2961 0.60 1.29 0.26 116 HTML_FONT_SIZE_LARGE 2957 0.73 1.29 0.45 117 XM_H_Long_From02 2897 0.96 1.26 0.82 118 BOTNET_NORDNS 2842 0.42 1.24 0.01 119 XMBody_17 2823 0.69 1.23 0.43 120 XM_HighProb1 2823 0.41 1.23 0.01 121 XMPhish11 2822 1.18 1.23 1.16 122 TR_XM_DK_Bayes 2808 3.15 1.22 4.10 123 BAYES_40 2773 2.85 1.21 3.66 124 T_MONEY_PERCENT 2715 0.55 1.18 0.25 125 TR_LOTS_OF_MONEY2 2715 0.55 1.18 0.25 126 TR_XM_DK_Bayes1 2703 2.96 1.18 3.84 127 UNPARSEABLE_RELAY 2693 3.03 1.17 3.95 128 XMStockSpam_06 2630 0.80 1.14 0.64 129 XMHTML_After_End 2602 0.66 1.13 0.43 130 TR_XM_DK_Bayes2 2588 2.53 1.13 3.22 131 XMPhish30 2527 0.57 1.10 0.31 132 URI_TRY_3LD 2526 1.00 1.10 0.96 133 XMMoneyMeta_01 2486 0.37 1.08 0.02 134 XMPhish14 2481 0.52 1.08 0.25 135 T_XMDrugObfuBody_00 2438 0.75 1.06 0.60 136 RCVD_IN_IADB_VOUCHED 2428 3.25 1.06 4.33 137 URIBL_DBL_SPAM 2427 0.37 1.06 0.03 138 XM_UB999 2417 0.36 1.05 0.03 139 XMSubMetaSxObfu_03 2415 0.55 1.05 0.30 140 PLING_QUERY 2406 0.53 1.05 0.28 141 XMHTMLBadTable_001 2394 0.63 1.04 0.43 142 TR_Symld_Words 2360 1.39 1.03 1.57 143 BAYES_20 2335 2.09 1.02 2.61 144 LOW_PRICE 2323 0.47 1.01 0.21 145 XM_UB60 2307 0.39 1.00 0.09 146 XMSexyCombo_04 2291 0.37 1.00 0.06 147 XM_B_Crypto 2260 0.37 0.98 0.07 148 SUBJ_DOLLARS 2257 0.45 0.98 0.18 149 XM_B_REG_HTML 2197 0.55 0.96 0.35 150 ANY_BOUNCE_MESSAGE 2133 5.45 0.93 7.68 151 BOUNCE_MESSAGE 2132 5.45 0.93 7.68 152 RELAYCOUNTRY_AT 2127 0.39 0.93 0.13 153 RDNS_DYNAMIC 2111 0.58 0.92 0.42 154 XMClaimOffer 2075 0.37 0.90 0.10 155 TooManyTo_002 2053 2.40 0.89 3.14 156 HTML_TAG_BALANCE_BODY 2049 0.63 0.89 0.50 157 HTML_FONT_FACE_BAD 2028 0.62 0.88 0.49 158 BITCOIN_SPAM_07 2024 0.31 0.88 0.03 159 XMBody_78 2018 0.52 0.88 0.35 160 XM_H_PHPOS 1996 1.49 0.87 1.79 161 XMBrknScrpt_02 1970 0.68 0.86 0.59 162 RELAYCOUNTRY_GB 1953 0.97 0.85 1.03 163 HTTPS_HTTP_MISMATCH 1952 0.59 0.85 0.46 164 DKIM_ADSP_CUSTOM_MED 1945 1.02 0.85 1.10 165 XMSlimDrugH 1914 0.49 0.83 0.32 166 RELAYCOUNTRY_CN 1893 0.31 0.82 0.05 167 T_TooManySym_02 1893 1.35 0.82 1.61 168 TooManyTo_003 1850 1.85 0.80 2.37 169 XM_UB80 1822 0.28 0.79 0.03 170 XMSubMetaSSx_00 1819 0.44 0.79 0.27 171 XM_PDF 1817 3.49 0.79 4.82 172 REMOVE_BEFORE_LINK 1763 0.50 0.77 0.37 173 DATE_IN_PAST_03_06 1705 0.32 0.74 0.11 174 RELAYCOUNTRY_AU 1676 0.55 0.73 0.47 175 FORGED_GMAIL_RCVD 1675 0.61 0.73 0.56 176 URI_NOVOWEL 1673 0.52 0.73 0.42 177 XM_BadFromFormat 1663 0.37 0.72 0.19 178 T_FILL_THIS_FORM_SHORT 1647 0.78 0.72 0.82 179 TR_LOTS_OF_MONEY3 1620 0.39 0.70 0.23 180 RELAYCOUNTRY_DE 1612 0.49 0.70 0.39 181 TR_Mismatch_TLD_02 1605 0.27 0.70 0.06 182 T_HTML_TAG_BALANCE_CENTER 1592 0.33 0.69 0.16 183 NML_ADSP_CUSTOM_MED 1581 0.79 0.69 0.84 184 RCVD_IN_MSPIKE_WL 1558 1.71 0.68 2.21 185 BODY_ENHANCEMENT 1545 0.23 0.67 0.01 186 RCVD_IN_IADB_OPTIN 1529 2.09 0.67 2.79 187 RELAYCOUNTRY_IN 1528 0.28 0.66 0.09 188 ADVANCE_FEE_5_NEW_MONEY 1524 0.23 0.66 0.01 189 XM_Body_Obfu01 1522 0.39 0.66 0.26 190 RCVD_IN_MSPIKE_H3 1505 1.70 0.65 2.21 191 FILL_THIS_FORM 1475 0.46 0.64 0.38 192 RELAYCOUNTRY_NL 1471 0.35 0.64 0.20 193 TooManyTo_004 1461 1.05 0.64 1.26 194 XM_H_PHPMailer 1451 0.68 0.63 0.71 195 XMCapTrack 1451 1.19 0.63 1.46 196 LongTLD 1387 0.30 0.60 0.15 197 TR_Caps_n_Bayes_99 1370 0.25 0.60 0.08 198 NO_DNS_FOR_FROM 1365 0.45 0.59 0.38 199 XM_B_COPY_HTML 1349 0.49 0.59 0.45 200 KHOP_DYNAMIC 1343 0.60 0.58 0.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 409045 90.21 95.33 87.69 2 DKIM_SIGNED 321961 71.86 77.64 69.02 3 XM_DK_Pass 315480 70.27 75.63 67.63 4 DCC_CHECK_NEGATIVE 305561 52.81 27.07 65.50 5 DKIM_VALID 299514 66.93 72.47 64.21 6 BAYES_50 277833 50.62 32.48 59.56 7 XMListUnsubscribeExists 213567 52.19 65.20 45.78 8 DKIM_VALID_AU 210295 48.61 55.77 45.08 9 XM_H_QuotedFrom 160213 38.65 47.37 34.34 10 DCC_CHECK 151518 45.37 71.53 32.48 11 T_TM2_M_HEADER_IN_MSG 143082 27.34 20.58 30.67 12 DKIM_VALID_EF 124143 24.96 21.62 26.61 13 HTML_FONT_LOW_CONTRAST 118678 27.97 33.10 25.44 14 ALL_TRUSTED 101152 15.29 2.32 21.68 15 FVGT_m_MULTI_ODD 97366 22.10 24.59 20.87 16 LOC_TINY_FONT_1 89248 23.60 32.67 19.13 17 XMSubLong 86726 21.32 26.86 18.59 18 MultiRelay 83824 16.68 14.07 17.97 19 MIME_HTML_ONLY 79266 23.72 37.38 16.99 20 T_KAM_HTML_FONT_INVALID 72334 16.75 19.28 15.51 21 XM_DK_Undo_02 58288 22.69 43.36 12.50 22 BAYES_99 55356 21.09 39.80 11.87 23 BAYES_999 47674 17.99 33.75 10.22 24 XM_Body_Dirty_Words 47215 12.82 18.30 10.12 25 XM_Multi_Part_URI 43835 11.33 15.25 9.40 26 TooManyTo_001 40783 8.09 6.76 8.74 27 XM_DKIMWhitelistDomains 40129 5.79 0.09 8.60 28 LotsOfNums_01 39349 7.93 6.91 8.44 29 T_XMDrugObfuBody_14 37944 8.34 8.75 8.13 30 RCVD_IN_RP_SAFE 37161 7.07 5.25 7.97 31 ANY_BOUNCE_MESSAGE 35842 5.45 0.93 7.68 32 BOUNCE_MESSAGE 35841 5.45 0.93 7.68 33 RCVD_IN_RP_CERTIFIED 35628 6.51 4.23 7.64 34 XM_Evil_Numbers_Gen 34693 9.35 13.22 7.44 35 LOTS_OF_MONEY 34517 8.49 10.72 7.40 36 BAYES_60 33099 7.71 8.94 7.10 37 BAYES_00 31110 4.92 1.38 6.67 38 HTML_IMAGE_RATIO_02 30047 9.08 14.43 6.44 39 RCVD_IN_IADB_LISTED 28821 4.90 2.31 6.18 40 MIME_QP_LONG_LINE 28766 5.48 4.09 6.17 41 FSL_BULK_SIG 27533 7.83 11.74 5.90 42 XM_H_Long_From01 26680 6.34 7.59 5.72 43 RCVD_IN_IADB_SPF 24904 4.26 2.06 5.34 44 HTML_IMAGE_RATIO_04 24851 6.55 9.03 5.33 45 TR_DCC_Bayes_99 23885 13.72 31.17 5.12 46 BOTNET_IPINHOSTNAME 23694 7.17 11.41 5.08 47 RCVD_IN_MSPIKE_H2 23266 4.46 3.40 4.99 48 IN_ZIMBRA_NJ_WHITELIST 23116 3.33 0.02 4.96 49 XM_SendGrid 22618 4.58 4.05 4.85 50 XM_PDF 22490 3.49 0.79 4.82 51 DKIM_INVALID 22447 4.93 5.17 4.81 52 RELAYCOUNTRY_META 22415 7.59 13.25 4.81 53 RCVD_IN_IADB_SENDERID 21711 3.76 1.95 4.65 54 T_REMOTE_IMAGE 21457 7.62 13.74 4.60 55 RCVD_IN_IADB_DK 21189 3.68 1.93 4.54 56 RCVD_IN_IADB_VOUCHED 20189 3.25 1.06 4.33 57 BAYES_80 19291 5.76 9.05 4.14 58 TR_XM_DK_Bayes 19149 3.15 1.22 4.10 59 XM_B_Phish_Phrases 18774 5.67 9.00 4.02 60 UNPARSEABLE_RELAY 18420 3.03 1.17 3.95 61 XMStrtUSub 18338 4.20 4.75 3.93 62 TR_XM_DK_Bayes1 17913 2.96 1.18 3.84 63 XMSubMetaSx_00 17662 4.76 6.72 3.79 64 TVD_RCVD_IP 17403 2.59 0.29 3.73 65 BAYES_40 17091 2.85 1.21 3.66 66 T_TooManySym_01 17048 3.30 2.58 3.65 67 TR_XM_DocInvoice 15524 4.36 6.45 3.33 68 TR_XM_DK_Bayes2 15005 2.53 1.13 3.22 69 XM_UncommonTLD01 14817 4.42 6.96 3.18 70 FROM_EXCESS_BASE64 14740 7.80 17.20 3.16 71 TooManyTo_002 14657 2.40 0.89 3.14 72 HTML_IMAGE_RATIO_06 13889 3.47 4.48 2.98 73 MPART_ALT_DIFF 13301 4.07 6.55 2.85 74 XMNumbers 13101 4.77 8.75 2.81 75 BAYES_95 13079 3.71 5.55 2.80 76 RCVD_IN_IADB_OPTIN 13009 2.09 0.67 2.79 77 BAYES_20 12187 2.09 1.02 2.61 78 MIME_HTML_MOSTLY 11866 3.10 4.22 2.54 79 TooManyTo_003 11055 1.85 0.80 2.37 80 HTML_SHORT_LINK_IMG_1 11038 5.41 11.59 2.37 81 TM2_M_URI_OPT_OUT 10965 2.87 3.92 2.35 82 SHORTENED_URL_SRC 10885 5.25 11.16 2.33 83 SHORTENER_SHORT_IMG 10871 5.24 11.15 2.33 84 URI_BUFFLY 10869 5.24 11.14 2.33 85 HTML_MIME_NO_HTML_TAG 10396 5.71 12.77 2.23 86 RCVD_IN_MSPIKE_WL 10323 1.71 0.68 2.21 87 RCVD_IN_MSPIKE_H3 10311 1.70 0.65 2.21 88 MAILING_LIST_MULTI 10180 1.98 1.56 2.18 89 XMDiploma_00 9969 2.28 2.57 2.14 90 HELO_NODOT 9860 1.51 0.29 2.11 91 XMSexyCombo_05 9674 4.33 8.91 2.07 92 XM_SPF_SoftFail 9614 2.39 3.07 2.06 93 HTML_IMAGE_RATIO_08 8699 2.12 2.64 1.86 94 XM_DK_Undo_01 8493 1.73 1.55 1.82 95 XM_CamelCaseFrm001 8484 2.25 3.11 1.82 96 XM_H_PHPOS 8353 1.49 0.87 1.79 97 IN_HORDE_ADDRESS_BOOK 8341 1.22 0.06 1.79 98 URI_HEX 8117 2.11 2.87 1.74 99 XM_DIRTYINTL 7624 2.23 3.45 1.63 100 T_TooManySym_02 7533 1.35 0.82 1.61 101 BAYES_05 7321 1.23 0.55 1.57 102 TR_Symld_Words 7321 1.39 1.03 1.57 103 INVALID_MSGID 7160 1.10 0.21 1.53 104 SUBJ_ALL_CAPS 7115 1.55 1.59 1.53 105 XMCapTrack 6802 1.19 0.63 1.46 106 HTML_IMAGE_ONLY_04 6665 3.41 7.42 1.43 107 T_XMDrugObfuBody_08 6526 1.74 2.44 1.40 108 TO_MALFORMED 6493 0.94 0.01 1.39 109 RELAYCOUNTRY_CA 6487 1.93 3.03 1.39 110 XM_GoogleGroups 6192 1.03 0.43 1.33 111 XM_OfRef6 6191 1.78 2.71 1.33 112 HTML_SHORT_CENTER 6103 3.06 6.60 1.31 113 TooManyTo_004 5860 1.05 0.64 1.26 114 UNTRUSTED_Relay 5571 3.38 7.80 1.19 115 USER_IN_DEF_DKIM_WL 5516 0.80 0.03 1.18 116 XMPhish11 5416 1.18 1.23 1.16 117 XMGenDplmaNmb 5348 1.36 1.79 1.15 118 MIME_HTML_ONLY_MULTI 5170 1.66 2.78 1.11 119 HTML_IMAGE_ONLY_08 5149 2.16 4.31 1.10 120 DKIM_ADSP_CUSTOM_MED 5136 1.02 0.85 1.10 121 XMLngstWrd_00 5051 0.81 0.27 1.08 122 TooManyTo_005 4917 0.89 0.55 1.05 123 RELAYCOUNTRY_GB 4784 0.97 0.85 1.03 124 XMLngstWrd_01 4476 0.72 0.24 0.96 125 URI_TRY_3LD 4472 1.00 1.10 0.96 126 BOTNET 4403 3.86 9.77 0.94 127 XM_ProductURIs 4383 1.09 1.39 0.94 128 TR_MetaPhish_Combo_01 4300 0.78 0.50 0.92 129 NML_ADSP_CUSTOM_MED 3903 0.79 0.69 0.84 130 TO_NO_BRKTS_HTML_ONLY 3846 0.60 0.13 0.82 131 XM_H_Long_From02 3808 0.96 1.26 0.82 132 TM2_M_VERY_LONG_WORD 3802 1.01 1.40 0.82 133 T_FILL_THIS_FORM_SHORT 3802 0.78 0.72 0.82 134 XM_UB50 3783 1.68 3.43 0.81 135 XMSubMetaI_00 3594 0.97 1.37 0.77 136 SpammyFromTLD_01 3576 1.29 2.35 0.77 137 XMBdyGiftCard01 3480 1.10 1.83 0.75 138 XM_H_PHPMailer 3311 0.68 0.63 0.71 139 XMNoVowels 3043 0.59 0.46 0.65 140 XMStockSpam_06 2963 0.80 1.14 0.64 141 T_OBFU_PDF_ATTACH 2889 0.48 0.20 0.62 142 USER_IN_WHITELIST 2852 0.41 0.00 0.61 143 KHOP_DYNAMIC 2840 0.60 0.58 0.61 144 T_TooManySym_03 2813 0.51 0.31 0.60 145 T_XMDrugObfuBody_00 2783 0.75 1.06 0.60 146 XMBrknScrpt_02 2766 0.68 0.86 0.59 147 MISSING_HEADERS 2646 4.08 11.21 0.57 148 FORGED_GMAIL_RCVD 2605 0.61 0.73 0.56 149 SHORT_HELO_AND_INLINE_IMAGE 2593 0.39 0.06 0.56 150 XMSubMetaSxObfu_02 2558 0.49 0.37 0.55 151 XMLngstWrd_02 2522 0.43 0.20 0.54 152 T_XMHurry_00 2504 0.80 1.35 0.54 153 HTML_TAG_BALANCE_BODY 2341 0.63 0.89 0.50 154 HTML_IMAGE_ONLY_28 2330 0.49 0.48 0.50 155 RCVD_IN_BL_SPAMCOP_NET 2328 1.33 3.02 0.50 156 RCVD_IN_SORBS_DUL 2309 0.40 0.20 0.49 157 T_Symld_Words_02 2290 0.78 1.38 0.49 158 HTML_FONT_FACE_BAD 2274 0.62 0.88 0.49 159 XMMoneyMeta_00 2262 0.85 1.58 0.48 160 XM_ShortIntro_01 2215 0.44 0.38 0.47 161 TR_XM_RelayPhish 2191 0.81 1.49 0.47 162 HTML_IMAGE_ONLY_32 2186 0.43 0.34 0.47 163 RELAYCOUNTRY_AU 2176 0.55 0.73 0.47 164 HTTPS_HTTP_MISMATCH 2158 0.59 0.85 0.46 165 XMGappySubj_01 2127 0.41 0.31 0.46 166 HTML_FONT_SIZE_LARGE 2099 0.73 1.29 0.45 167 XM_B_COPY_HTML 2079 0.49 0.59 0.45 168 TM2_M_BODY_EMPTY 2068 0.35 0.15 0.44 169 DKIM_ADSP_NXDOMAIN 2063 0.42 0.38 0.44 170 XMHTMLBadTable_001 2027 0.63 1.04 0.43 171 XMBody_17 2015 0.69 1.23 0.43 172 XMSexyCombo_01 2009 0.93 1.94 0.43 173 XMHTML_After_End 1991 0.66 1.13 0.43 174 XMDateMe_00 1979 0.38 0.28 0.42 175 XMSolicitRefs_0 1967 0.38 0.29 0.42 176 URI_NOVOWEL 1950 0.52 0.73 0.42 177 RDNS_DYNAMIC 1946 0.58 0.92 0.42 178 TM2_M_A_HREF_HREF 1894 0.45 0.53 0.41 179 XMBody_95 1873 0.31 0.12 0.40 180 RELAYCOUNTRY_DE 1833 0.49 0.70 0.39 181 AC_DIV_BONANZA 1812 0.29 0.09 0.39 182 HTML_IMAGE_ONLY_24 1766 0.37 0.36 0.38 183 NO_DNS_FOR_FROM 1764 0.45 0.59 0.38 184 FILL_THIS_FORM 1751 0.46 0.64 0.38 185 XM_H_PHPOS_M 1735 0.37 0.38 0.37 186 REMOVE_BEFORE_LINK 1730 0.50 0.77 0.37 187 MPART_ALT_DIFF_COUNT 1653 0.41 0.52 0.35 188 XM_B_REG_HTML 1635 0.55 0.96 0.35 189 XMBody_78 1619 0.52 0.88 0.35 190 DIET_1 1618 1.27 3.14 0.35 191 XMLngstWrd_03 1617 0.28 0.13 0.35 192 XMSubNoVowel 1604 0.31 0.25 0.34 193 HTML_IMAGE_ONLY_16 1527 0.28 0.18 0.33 194 HTML_IMAGE_ONLY_20 1507 0.34 0.38 0.32 195 UPPERCASE_50_75 1493 0.25 0.10 0.32 196 XMSlimDrugH 1486 0.49 0.83 0.32 197 XMPhish30 1464 0.57 1.10 0.31 198 XM_B_TRADE_HTML 1421 0.30 0.30 0.30 199 XMSubMetaSxObfu_03 1413 0.55 1.05 0.30 200 T_FILL_THIS_FORM_LONG 1373 0.38 0.55 0.29 ----------------------------------------------------------------------