Email: 783588 Autolearn: 0 AvgScore: 5.42 AvgScanTime: 4.68 sec Spam: 291070 Autolearn: 0 AvgScore: 15.29 AvgScanTime: 5.17 sec Ham: 492518 Autolearn: 0 AvgScore: -0.42 AvgScanTime: 4.39 sec Time Spent Running SA: 1018.42 hours Time Spent Processing Spam: 418.19 hours Time Spent Processing Ham: 600.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 275062 87.65 94.50 83.61 2 DKIM_SIGNED 174985 65.99 60.12 69.46 3 XM_DK_Pass 169423 64.36 58.21 67.99 4 DCC_CHECK 166140 41.74 57.08 32.68 5 DKIM_VALID 160734 60.64 55.22 63.83 6 BAYES_50 147114 54.69 50.54 57.14 7 XMListUnsubscribeExists 147032 48.24 50.51 46.90 8 DKIM_VALID_AU 125690 44.06 43.18 44.58 9 DCC_CHECK_NEGATIVE 121493 56.54 41.74 65.28 10 XM_H_QuotedFrom 115067 35.69 39.53 33.42 11 BOTNET 98368 13.28 33.80 1.16 12 XM_DK_Undo_02 92419 18.18 31.75 10.16 13 BAYES_99 82979 17.96 28.51 11.73 14 MIME_HTML_ONLY 80038 21.10 27.50 17.32 15 RCVD_IN_RP_RNBL 78873 10.09 27.10 0.04 16 URI_HEX 72993 10.63 25.08 2.10 17 HTML_FONT_LOW_CONTRAST 72432 24.91 24.88 24.93 18 LOC_TINY_FONT_1 70641 20.71 24.27 18.61 19 BAYES_999 69359 14.71 23.83 9.32 20 ANY_BOUNCE_MESSAGE 66049 10.08 22.69 2.62 21 BOUNCE_MESSAGE 66048 10.08 22.69 2.62 22 XMCapTrack 66001 9.36 22.68 1.50 23 NUMERIC_HTTP_ADDR 65648 8.45 22.55 0.12 24 FVGT_m_MULTI_ODD 64087 20.59 22.02 19.75 25 TR_DCC_Bayes_99 62848 10.97 21.59 4.69 26 XM_URI_RBL 54415 7.04 18.69 0.15 27 XMSubLong 52439 18.81 18.02 19.28 28 URIBL_BLACK 51855 6.64 17.82 0.04 29 DKIM_VALID_EF 51498 22.08 17.69 24.68 30 RELAYCOUNTRY_META 49598 9.73 17.04 5.40 31 T_TM2_M_HEADER_IN_MSG 47285 25.25 16.25 30.57 32 T_KAM_HTML_FONT_INVALID 44910 15.39 15.43 15.37 33 XM_Multi_Part_URI 42091 11.84 14.46 10.29 34 XM_Body_Dirty_Words 38899 11.66 13.36 10.65 35 DATE_IN_PAST_06_12 38718 4.96 13.30 0.03 36 UNTRUSTED_Relay 36133 5.71 12.41 1.75 37 HTML_IMAGE_RATIO_02 32994 8.37 11.34 6.62 38 FROM_EXCESS_BASE64 30773 5.98 10.57 3.26 39 FSL_BULK_SIG 30765 6.60 10.57 4.25 40 XM_Evil_Numbers_Gen 30060 8.05 10.33 6.70 41 MultiRelay 30044 14.85 10.32 17.53 42 XM_UncommonTLD01 29705 5.14 10.21 2.15 43 BOTNET_IPINHOSTNAME 28616 6.20 9.83 4.06 44 LOTS_OF_MONEY 27250 8.15 9.36 7.43 45 DATE_IN_PAST_12_24 26931 3.45 9.25 0.03 46 T_REMOTE_IMAGE 24779 6.40 8.51 5.14 47 HTML_MIME_NO_HTML_TAG 23813 4.49 8.18 2.31 48 XMSexyCombo_05 21369 4.42 7.34 2.69 49 HTML_IMAGE_RATIO_04 21344 5.57 7.33 4.53 50 T_XMDrugObfuBody_14 20475 7.61 7.03 7.96 51 XM_B_Phish_Phrases 20469 5.21 7.03 4.13 52 BAYES_60 20266 6.88 6.96 6.84 53 MISSING_HEADERS 19845 2.86 6.82 0.52 54 BODY_URI_ONLY 19744 2.62 6.78 0.16 55 HTML_SHORT_LINK_IMG_1 19373 2.49 6.66 0.03 56 BAYES_80 19321 5.62 6.64 5.02 57 HTML_IMAGE_ONLY_04 18957 2.46 6.51 0.07 58 MIME_HEADER_CTYPE_ONLY 18822 2.49 6.47 0.14 59 SHORTENER_SHORT_IMG 18739 2.39 6.44 0.00 60 SHORTENED_URL_SRC 18711 2.39 6.43 0.00 61 URI_BUFFLY 18664 2.38 6.41 0.00 62 XM_H_Long_From01 17792 5.80 6.11 5.62 63 TR_XM_DocInvoice 17280 4.29 5.94 3.32 64 TooManyTo_001 16152 9.66 5.55 12.08 65 RELAYCOUNTRY_FR 15589 2.10 5.36 0.18 66 HTML_SHORT_CENTER 15525 1.99 5.33 0.01 67 XMNumbers 15048 4.02 5.17 3.34 68 DKIM_INVALID 14251 5.35 4.90 5.63 69 XMSubMetaSx_00 14115 4.06 4.85 3.60 70 MPART_ALT_DIFF 12854 3.20 4.42 2.48 71 XM_UB50 12279 2.11 4.22 0.87 72 SpammyFromTLD_02 11851 1.77 4.07 0.40 73 LotsOfNums_01 11649 6.78 4.00 8.43 74 BAYES_95 10632 3.63 3.65 3.61 75 ALL_TRUSTED 10551 14.89 3.62 21.55 76 XM_UB60 9969 1.37 3.42 0.16 77 RCVD_IN_RP_SAFE 9768 6.93 3.36 9.04 78 XMStrtUSub 9375 3.63 3.22 3.88 79 MIME_HTML_MOSTLY 8833 2.68 3.03 2.47 80 TM2_M_URI_OPT_OUT 8622 2.23 2.96 1.80 81 HTML_IMAGE_RATIO_06 8620 3.00 2.96 3.02 82 XM_DIRTYINTL 8574 2.14 2.95 1.67 83 RCVD_IN_RP_CERTIFIED 7928 6.37 2.72 8.52 84 XM_SPF_SoftFail 7561 2.19 2.60 1.94 85 RELAYCOUNTRY_CA 7391 1.79 2.54 1.34 86 XM_SendGrid 7350 3.97 2.53 4.82 87 MIME_QP_LONG_LINE 6992 4.79 2.40 6.20 88 MIME_HTML_ONLY_MULTI 6833 1.56 2.35 1.10 89 RCVD_IN_MSPIKE_H2 6769 3.94 2.33 4.89 90 XM_OfRef6 6711 1.62 2.31 1.22 91 XM_CamelCaseFrm001 6309 1.84 2.17 1.65 92 TO_MALFORMED 6306 1.63 2.17 1.32 93 XM_UB80 6283 0.98 2.16 0.28 94 HTML_IMAGE_RATIO_08 6086 2.00 2.09 1.95 95 T_TooManySym_01 6073 3.85 2.09 4.88 96 DIET_1 5966 0.96 2.05 0.32 97 INVALID_MSGID 5940 0.97 2.04 0.34 98 XMDiploma_00 5886 1.85 2.02 1.75 99 RCVD_IN_BL_SPAMCOP_NET 5593 1.00 1.92 0.45 100 XMSubMetaI_00 5346 1.16 1.84 0.76 101 MultiRelay_CC 5343 0.78 1.84 0.15 102 MultiRelay_Combo 5343 0.78 1.84 0.15 103 SpammyFromTLD_01 5325 1.25 1.83 0.91 104 TR_LOTS_OF_MONEY3 4841 0.90 1.66 0.45 105 T_XMDrugObfuBody_00 4632 1.00 1.59 0.65 106 RELAYCOUNTRY_UA 4542 0.58 1.56 0.00 107 DKIM_ADSP_NXDOMAIN 4513 0.91 1.55 0.54 108 UNPARSEABLE_RELAY 4413 2.51 1.52 3.10 109 T_XMHurry_00 4178 1.19 1.44 1.05 110 XMSexyCombo_01 4159 0.82 1.43 0.47 111 T_XMDrugObfuBody_08 4101 1.31 1.41 1.26 112 XMBdyGiftCard01 4098 1.05 1.41 0.84 113 SUBJ_ALL_CAPS 3843 1.48 1.32 1.57 114 TR_XM_RelayPhish 3714 0.79 1.28 0.50 115 XM_UB99 3707 0.53 1.27 0.09 116 URI_TRY_3LD 3646 1.26 1.25 1.26 117 XMMoneyMeta_00 3640 0.82 1.25 0.56 118 BAYES_00 3638 5.28 1.25 7.66 119 XMHTML_After_End 3634 0.69 1.25 0.36 120 XMGenDplmaNmb 3606 1.11 1.24 1.03 121 BOTNET_NORDNS 3599 0.47 1.24 0.02 122 XMBody_17 3570 0.72 1.23 0.42 123 TM2_M_VERY_LONG_WORD 3416 0.96 1.17 0.84 124 TooManyTo_002 3328 3.97 1.14 5.63 125 XM_ProductURIs 3251 0.92 1.12 0.80 126 NO_DNS_FOR_FROM 3228 1.14 1.11 1.15 127 TR_XM_DK_Bayes 3169 3.79 1.09 5.38 128 BAYES_40 3166 2.59 1.09 3.47 129 TR_Symld_Words 3104 1.34 1.07 1.50 130 MAILING_LIST_MULTI 3020 1.96 1.04 2.51 131 TR_XM_DK_Bayes1 2963 3.47 1.02 4.91 132 XMPhish30 2892 0.53 0.99 0.26 133 RCVD_IN_IADB_LISTED 2853 4.27 0.98 6.22 134 TooManyTo_003 2846 2.98 0.98 4.16 135 TR_XM_DK_Bayes2 2830 2.96 0.97 4.13 136 XMStockSpam_06 2765 0.74 0.95 0.62 137 SUBJ_DOLLARS 2731 0.47 0.94 0.19 138 XM_H_Long_From02 2682 0.90 0.92 0.89 139 T_Symld_Words_02 2635 0.61 0.91 0.44 140 DEAR_SOMETHING 2532 0.38 0.87 0.09 141 LongTLD 2527 0.44 0.87 0.19 142 XM_DK_Undo_01 2515 1.53 0.86 1.92 143 XM_UB95 2480 0.41 0.85 0.15 144 RCVD_IN_IADB_SPF 2439 3.76 0.84 5.48 145 HTML_IMAGE_ONLY_20 2427 0.51 0.83 0.31 146 XM_HighProb1 2397 0.33 0.82 0.04 147 BAYES_20 2396 1.97 0.82 2.65 148 RELAYCOUNTRY_IN 2377 0.37 0.82 0.11 149 T_MONEY_PERCENT 2368 0.47 0.81 0.27 150 TR_LOTS_OF_MONEY2 2368 0.47 0.81 0.27 151 RCVD_IN_IADB_SENDERID 2317 3.36 0.80 4.88 152 TooManyTo_004 2310 2.23 0.79 3.07 153 XMBody_78 2299 0.49 0.79 0.31 154 RELAYCOUNTRY_AT 2288 0.75 0.79 0.73 155 RCVD_IN_IADB_DK 2280 3.30 0.78 4.78 156 XM_PDF 2261 3.43 0.78 4.99 157 XM_H_PHPOS 2159 1.42 0.74 1.82 158 XM_UB999 2118 0.28 0.73 0.02 159 XM_S_JOY_D 2107 0.51 0.72 0.38 160 RELAYCOUNTRY_GB 2104 0.84 0.72 0.91 161 XMSexyCombo_04 2064 0.32 0.71 0.10 162 T_TooManySym_02 2019 1.42 0.69 1.86 163 XMPhish11 2017 0.96 0.69 1.11 164 URIBL_DBL_SPAM 2014 0.27 0.69 0.01 165 XMHTMLBadTable_001 1982 0.63 0.68 0.61 166 MPART_ALT_DIFF_COUNT 1963 0.38 0.67 0.21 167 RELAYCOUNTRY_NL 1956 0.45 0.67 0.31 168 URI_NOVOWEL 1910 0.50 0.66 0.40 169 RCVD_IN_IADB_VOUCHED 1888 2.68 0.65 3.88 170 TR_Mismatch_TLD_02 1841 0.29 0.63 0.09 171 HTML_TAG_BALANCE_BODY 1827 0.47 0.63 0.38 172 TooManyTo_005 1817 1.63 0.62 2.22 173 DATE_IN_PAST_24_48 1815 0.24 0.62 0.01 174 HTTPS_HTTP_MISMATCH 1798 0.55 0.62 0.51 175 RELAYCOUNTRY_CN 1769 0.25 0.61 0.04 176 XMSubMetaI_01 1765 0.26 0.61 0.05 177 T_FILL_THIS_FORM_SHORT 1753 0.68 0.60 0.73 178 T_HTML_TAG_BALANCE_CENTER 1747 0.30 0.60 0.12 179 TR_MetaPhish_Combo_01 1717 1.20 0.59 1.55 180 DKIM_ADSP_CUSTOM_MED 1700 1.50 0.58 2.03 181 FILL_THIS_FORM 1691 0.46 0.58 0.40 182 HTML_FONT_FACE_BAD 1687 0.52 0.58 0.48 183 XMClaimOffer 1681 0.31 0.58 0.15 184 REMOVE_BEFORE_LINK 1639 0.41 0.56 0.32 185 XMPhish14 1637 0.43 0.56 0.34 186 TR_LOTS_OF_MONEY1 1637 0.23 0.56 0.03 187 RELAYCOUNTRY_AU 1625 0.49 0.56 0.45 188 XM_GoogleGroups 1579 0.91 0.54 1.13 189 NML_ADSP_CUSTOM_MED 1557 1.24 0.53 1.66 190 XM_B_REG_HTML 1551 0.44 0.53 0.39 191 RDNS_DYNAMIC 1537 0.46 0.53 0.42 192 XMSubMetaSxObfu_03 1517 0.43 0.52 0.38 193 DRUGS_ERECTILE 1500 0.22 0.52 0.04 194 T_FILL_THIS_FORM_LONG 1452 0.37 0.50 0.30 195 XM_RXBody 1447 0.22 0.50 0.06 196 XMSlimDrugH 1443 0.38 0.50 0.31 197 XMGppyBdWords 1438 0.33 0.49 0.23 198 FORGED_GMAIL_RCVD 1423 0.58 0.49 0.63 199 KHOP_DYNAMIC 1403 0.58 0.48 0.64 200 RELAYCOUNTRY_DE 1390 0.45 0.48 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 411779 87.65 94.50 83.61 2 DKIM_SIGNED 342105 65.99 60.12 69.46 3 XM_DK_Pass 334885 64.36 58.21 67.99 4 DCC_CHECK_NEGATIVE 321533 56.54 41.74 65.28 5 DKIM_VALID 314397 60.64 55.22 63.83 6 BAYES_50 281437 54.69 50.54 57.14 7 XMListUnsubscribeExists 230992 48.24 50.51 46.90 8 DKIM_VALID_AU 219573 44.06 43.18 44.58 9 XM_H_QuotedFrom 164621 35.69 39.53 33.42 10 DCC_CHECK 160943 41.74 57.08 32.68 11 T_TM2_M_HEADER_IN_MSG 150552 25.25 16.25 30.57 12 HTML_FONT_LOW_CONTRAST 122793 24.91 24.88 24.93 13 DKIM_VALID_EF 121530 22.08 17.69 24.68 14 ALL_TRUSTED 106151 14.89 3.62 21.55 15 FVGT_m_MULTI_ODD 97272 20.59 22.02 19.75 16 XMSubLong 94954 18.81 18.02 19.28 17 LOC_TINY_FONT_1 91640 20.71 24.27 18.61 18 MultiRelay 86324 14.85 10.32 17.53 19 MIME_HTML_ONLY 85325 21.10 27.50 17.32 20 T_KAM_HTML_FONT_INVALID 75699 15.39 15.43 15.37 21 XM_DKIMWhitelistDomains 60730 7.75 0.01 12.33 22 TooManyTo_001 59512 9.66 5.55 12.08 23 BAYES_99 57756 17.96 28.51 11.73 24 XM_Body_Dirty_Words 52431 11.66 13.36 10.65 25 XM_Multi_Part_URI 50688 11.84 14.46 10.29 26 XM_DK_Undo_02 50048 18.18 31.75 10.16 27 BAYES_999 45920 14.71 23.83 9.32 28 RCVD_IN_RP_SAFE 44544 6.93 3.36 9.04 29 RCVD_IN_RP_CERTIFIED 41974 6.37 2.72 8.52 30 LotsOfNums_01 41504 6.78 4.00 8.43 31 T_XMDrugObfuBody_14 39192 7.61 7.03 7.96 32 BAYES_00 37709 5.28 1.25 7.66 33 LOTS_OF_MONEY 36586 8.15 9.36 7.43 34 BAYES_60 33683 6.88 6.96 6.84 35 XM_Evil_Numbers_Gen 33007 8.05 10.33 6.70 36 HTML_IMAGE_RATIO_02 32586 8.37 11.34 6.62 37 RCVD_IN_IADB_LISTED 30612 4.27 0.98 6.22 38 MIME_QP_LONG_LINE 30513 4.79 2.40 6.20 39 TooManyTo_002 27745 3.97 1.14 5.63 40 DKIM_INVALID 27708 5.35 4.90 5.63 41 XM_H_Long_From01 27668 5.80 6.11 5.62 42 RCVD_IN_IADB_SPF 27003 3.76 0.84 5.48 43 RELAYCOUNTRY_META 26615 9.73 17.04 5.40 44 TR_XM_DK_Bayes 26497 3.79 1.09 5.38 45 T_REMOTE_IMAGE 25336 6.40 8.51 5.14 46 BAYES_80 24717 5.62 6.64 5.02 47 XM_PDF 24581 3.43 0.78 4.99 48 TR_XM_DK_Bayes1 24201 3.47 1.02 4.91 49 RCVD_IN_MSPIKE_H2 24071 3.94 2.33 4.89 50 T_TooManySym_01 24058 3.85 2.09 4.88 51 RCVD_IN_IADB_SENDERID 24050 3.36 0.80 4.88 52 XM_SendGrid 23741 3.97 2.53 4.82 53 RCVD_IN_IADB_DK 23550 3.30 0.78 4.78 54 TR_DCC_Bayes_99 23077 10.97 21.59 4.69 55 HTML_IMAGE_RATIO_04 22332 5.57 7.33 4.53 56 FSL_BULK_SIG 20926 6.60 10.57 4.25 57 TooManyTo_003 20485 2.98 0.98 4.16 58 XM_B_Phish_Phrases 20337 5.21 7.03 4.13 59 TR_XM_DK_Bayes2 20333 2.96 0.97 4.13 60 BOTNET_IPINHOSTNAME 19995 6.20 9.83 4.06 61 XMStrtUSub 19104 3.63 3.22 3.88 62 RCVD_IN_IADB_VOUCHED 19089 2.68 0.65 3.88 63 IN_ZIMBRA_NJ_WHITELIST 18984 2.43 0.01 3.85 64 BAYES_95 17781 3.63 3.65 3.61 65 XMSubMetaSx_00 17737 4.06 4.85 3.60 66 BAYES_40 17114 2.59 1.09 3.47 67 XMNumbers 16446 4.02 5.17 3.34 68 TR_XM_DocInvoice 16364 4.29 5.94 3.32 69 FROM_EXCESS_BASE64 16070 5.98 10.57 3.26 70 UNPARSEABLE_RELAY 15276 2.51 1.52 3.10 71 TooManyTo_004 15144 2.23 0.79 3.07 72 HTML_IMAGE_RATIO_06 14880 3.00 2.96 3.02 73 TVD_RCVD_IP 13861 1.84 0.19 2.81 74 XMSexyCombo_05 13245 4.42 7.34 2.69 75 BAYES_20 13056 1.97 0.82 2.65 76 ANY_BOUNCE_MESSAGE 12924 10.08 22.69 2.62 77 BOUNCE_MESSAGE 12919 10.08 22.69 2.62 78 MAILING_LIST_MULTI 12363 1.96 1.04 2.51 79 MPART_ALT_DIFF 12199 3.20 4.42 2.48 80 MIME_HTML_MOSTLY 12172 2.68 3.03 2.47 81 RCVD_IN_IADB_OPTIN 12095 1.70 0.43 2.46 82 HTML_MIME_NO_HTML_TAG 11354 4.49 8.18 2.31 83 TooManyTo_005 10936 1.63 0.62 2.22 84 XM_UncommonTLD01 10604 5.14 10.21 2.15 85 URI_HEX 10325 10.63 25.08 2.10 86 DKIM_ADSP_CUSTOM_MED 10022 1.50 0.58 2.03 87 HELO_NODOT 9660 1.31 0.20 1.96 88 HTML_IMAGE_RATIO_08 9592 2.00 2.09 1.95 89 XM_SPF_SoftFail 9563 2.19 2.60 1.94 90 RCVD_IN_MSPIKE_WL 9480 1.35 0.37 1.92 91 XM_DK_Undo_01 9478 1.53 0.86 1.92 92 RCVD_IN_MSPIKE_H3 9464 1.34 0.36 1.92 93 T_TooManySym_02 9144 1.42 0.69 1.86 94 XM_H_PHPOS 8980 1.42 0.74 1.82 95 TM2_M_URI_OPT_OUT 8856 2.23 2.96 1.80 96 XMDiploma_00 8629 1.85 2.02 1.75 97 UNTRUSTED_Relay 8605 5.71 12.41 1.75 98 BAYES_05 8453 1.25 0.46 1.72 99 IN_HORDE_ADDRESS_BOOK 8449 1.10 0.05 1.72 100 USER_IN_DEF_DKIM_WL 8369 1.07 0.00 1.70 101 XM_DIRTYINTL 8227 2.14 2.95 1.67 102 NML_ADSP_CUSTOM_MED 8161 1.24 0.53 1.66 103 XM_CamelCaseFrm001 8118 1.84 2.17 1.65 104 SUBJ_ALL_CAPS 7739 1.48 1.32 1.57 105 TR_MetaPhish_Combo_01 7653 1.20 0.59 1.55 106 TR_Symld_Words 7403 1.34 1.07 1.50 107 XMCapTrack 7375 9.36 22.68 1.50 108 RELAYCOUNTRY_CA 6622 1.79 2.54 1.34 109 TO_MALFORMED 6478 1.63 2.17 1.32 110 URI_TRY_3LD 6189 1.26 1.25 1.26 111 T_XMDrugObfuBody_08 6184 1.31 1.41 1.26 112 XM_OfRef6 6001 1.62 2.31 1.22 113 BOTNET 5727 13.28 33.80 1.16 114 NO_DNS_FOR_FROM 5686 1.14 1.11 1.15 115 XM_GoogleGroups 5581 0.91 0.54 1.13 116 HTML_IMAGE_ONLY_12 5505 0.77 0.17 1.12 117 XMPhish11 5483 0.96 0.69 1.11 118 MIME_HTML_ONLY_MULTI 5415 1.56 2.35 1.10 119 T_XMHurry_00 5159 1.19 1.44 1.05 120 XMGenDplmaNmb 5064 1.11 1.24 1.03 121 FORGED_YAHOO_RCVD 4806 0.63 0.03 0.98 122 HTML_SHORT_LINK_IMG_2 4724 0.63 0.08 0.96 123 SpammyFromTLD_01 4480 1.25 1.83 0.91 124 RELAYCOUNTRY_GB 4475 0.84 0.72 0.91 125 XM_H_Long_From02 4372 0.90 0.92 0.89 126 XM_UB50 4273 2.11 4.22 0.87 127 XMBdyGiftCard01 4152 1.05 1.41 0.84 128 TM2_M_VERY_LONG_WORD 4135 0.96 1.17 0.84 129 XM_ProductURIs 3942 0.92 1.12 0.80 130 TO_NO_BRKTS_HTML_ONLY 3844 0.55 0.17 0.78 131 XMSubMetaI_00 3767 1.16 1.84 0.76 132 XMNoVowels 3766 0.62 0.37 0.76 133 XM_ShortIntro_01 3743 0.64 0.43 0.76 134 T_OBFU_PDF_ATTACH 3672 0.55 0.23 0.75 135 T_FILL_THIS_FORM_SHORT 3586 0.68 0.60 0.73 136 RELAYCOUNTRY_AT 3582 0.75 0.79 0.73 137 XM_H_PHPMailer 3484 0.57 0.34 0.71 138 T_XMDrugObfuBody_00 3210 1.00 1.59 0.65 139 XMBrknScrpt_02 3160 0.58 0.47 0.64 140 KHOP_DYNAMIC 3159 0.58 0.48 0.64 141 FORGED_GMAIL_RCVD 3084 0.58 0.49 0.63 142 T_TooManySym_03 3068 0.46 0.17 0.62 143 XMStockSpam_06 3034 0.74 0.95 0.62 144 XMHTMLBadTable_001 2989 0.63 0.68 0.61 145 XMLngstWrd_00 2925 0.45 0.20 0.59 146 XMBody_29 2859 0.43 0.17 0.58 147 XMMoneyMeta_00 2754 0.82 1.25 0.56 148 USER_IN_WHITELIST 2725 0.35 0.00 0.55 149 XMLngstWrd_01 2697 0.41 0.19 0.55 150 XMRcvdHeader_15 2696 0.34 0.00 0.55 151 DKIM_ADSP_NXDOMAIN 2646 0.91 1.55 0.54 152 XMGappySubj_01 2634 0.44 0.28 0.53 153 MISSING_HEADERS 2549 2.86 6.82 0.52 154 HTTPS_HTTP_MISMATCH 2506 0.55 0.62 0.51 155 TR_XM_RelayPhish 2445 0.79 1.28 0.50 156 SHORT_HELO_AND_INLINE_IMAGE 2413 0.32 0.04 0.49 157 HTML_FONT_FACE_BAD 2356 0.52 0.58 0.48 158 XMSexyCombo_01 2296 0.82 1.43 0.47 159 XMDateMe_00 2287 0.37 0.22 0.46 160 RELAYCOUNTRY_AU 2234 0.49 0.56 0.45 161 HTML_IMAGE_ONLY_32 2233 0.39 0.28 0.45 162 RCVD_IN_BL_SPAMCOP_NET 2230 1.00 1.92 0.45 163 TR_LOTS_OF_MONEY3 2209 0.90 1.66 0.45 164 RELAYCOUNTRY_DE 2166 0.45 0.48 0.44 165 RCVD_IN_SORBS_DUL 2154 0.32 0.13 0.44 166 T_Symld_Words_02 2147 0.61 0.91 0.44 167 XMBody_95 2126 0.32 0.12 0.43 168 RDNS_DYNAMIC 2085 0.46 0.53 0.42 169 TM2_M_BODY_EMPTY 2084 0.31 0.11 0.42 170 XMBody_17 2082 0.72 1.23 0.42 171 XM_B_COPY_HTML 2082 0.41 0.39 0.42 172 XMSubMetaSxObfu_02 2033 0.32 0.16 0.41 173 SpammyFromTLD_02 1990 1.77 4.07 0.40 174 TVD_SPACE_RATIO 1985 0.36 0.30 0.40 175 URI_NOVOWEL 1982 0.50 0.66 0.40 176 AC_DIV_BONANZA 1954 0.28 0.08 0.40 177 FILL_THIS_FORM 1947 0.46 0.58 0.40 178 HTML_IMAGE_ONLY_28 1947 0.42 0.45 0.40 179 XM_B_REG_HTML 1916 0.44 0.53 0.39 180 XMSubMetaSxObfu_03 1875 0.43 0.52 0.38 181 XM_H_PHPOS_M 1867 0.31 0.21 0.38 182 XM_S_JOY_D 1862 0.51 0.72 0.38 183 HTML_TAG_BALANCE_BODY 1858 0.47 0.63 0.38 184 XM_Combo_Sbj 1792 0.37 0.37 0.36 185 XMHTML_After_End 1785 0.69 1.25 0.36 186 XMPhish14 1698 0.43 0.56 0.34 187 INVALID_MSGID 1691 0.97 2.04 0.34 188 XMSubNoVowel 1663 0.29 0.22 0.34 189 DIET_1 1582 0.96 2.05 0.32 190 REMOVE_BEFORE_LINK 1578 0.41 0.56 0.32 191 HTML_IMAGE_ONLY_20 1551 0.51 0.83 0.31 192 HTML_IMAGE_ONLY_24 1541 0.26 0.17 0.31 193 RELAYCOUNTRY_NL 1534 0.45 0.67 0.31 194 XMSlimDrugH 1532 0.38 0.50 0.31 195 XMBody_78 1526 0.49 0.79 0.31 196 T_HTML_ATTACH 1490 0.21 0.06 0.30 197 XMSolicitRefs_0 1481 0.30 0.31 0.30 198 TM2_M_A_HREF_HREF 1478 0.30 0.30 0.30 199 T_FILL_THIS_FORM_LONG 1470 0.37 0.50 0.30 200 UPPERCASE_50_75 1454 0.21 0.06 0.30 ----------------------------------------------------------------------