Email: 753885 Autolearn: 0 AvgScore: 5.91 AvgScanTime: 3.96 sec Spam: 284918 Autolearn: 0 AvgScore: 15.76 AvgScanTime: 4.37 sec Ham: 468967 Autolearn: 0 AvgScore: -0.07 AvgScanTime: 3.70 sec Time Spent Running SA: 828.63 hours Time Spent Processing Spam: 346.13 hours Time Spent Processing Ham: 482.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 267342 84.85 93.83 79.40 2 DKIM_SIGNED 150484 62.15 52.82 67.82 3 DCC_CHECK 150320 40.76 52.76 33.46 4 XM_DK_Pass 146691 60.81 51.49 66.47 5 DKIM_VALID 141276 58.18 49.58 63.39 6 BAYES_50 138913 56.40 48.76 61.05 7 XMListUnsubscribeExists 133266 44.47 46.77 43.07 8 DCC_CHECK_NEGATIVE 131432 57.60 46.13 64.57 9 BOTNET 115375 15.95 40.49 1.04 10 DKIM_VALID_AU 114487 43.12 40.18 44.90 11 XM_H_QuotedFrom 107895 38.88 37.87 39.49 12 MIME_HTML_ONLY 91883 22.88 32.25 17.19 13 RCVD_IN_RP_RNBL 87889 11.68 30.85 0.03 14 XM_DK_Undo_02 79245 17.50 27.81 11.23 15 URI_HEX 72299 10.57 25.38 1.58 16 BAYES_99 71211 16.03 24.99 10.58 17 ANY_BOUNCE_MESSAGE 66618 10.76 23.38 3.09 18 BOUNCE_MESSAGE 66618 10.76 23.38 3.09 19 XMCapTrack 66086 9.67 23.19 1.46 20 NUMERIC_HTTP_ADDR 65567 8.76 23.01 0.11 21 HTML_FONT_LOW_CONTRAST 65559 23.72 23.01 24.15 22 LOC_TINY_FONT_1 65188 20.47 22.88 19.01 23 BAYES_999 59620 13.52 20.93 9.02 24 XMSubLong 57731 22.68 20.26 24.15 25 TR_DCC_Bayes_99 56838 11.02 19.95 5.60 26 FVGT_m_MULTI_ODD 55662 20.22 19.54 20.63 27 XM_URI_RBL 54308 7.28 19.06 0.12 28 URIBL_BLACK 51717 6.89 18.15 0.05 29 FROM_EXCESS_BASE64 47270 8.09 16.59 2.92 30 T_TM2_M_HEADER_IN_MSG 44546 25.71 15.63 31.82 31 DKIM_VALID_EF 43279 21.66 15.19 25.59 32 T_REMOTE_IMAGE 41481 8.00 14.56 4.02 33 DATE_IN_PAST_96_XX 38526 5.12 13.52 0.01 34 HTML_MIME_NO_HTML_TAG 38072 6.46 13.36 2.27 35 RELAYCOUNTRY_META 37904 7.99 13.30 4.76 36 XM_Body_Dirty_Words 37259 11.33 13.08 10.27 37 XM_Multi_Part_URI 36177 11.43 12.70 10.66 38 BODY_URI_ONLY 35188 4.72 12.35 0.09 39 T_KAM_HTML_FONT_INVALID 35182 13.71 12.35 14.54 40 HTML_SHORT_LINK_IMG_1 34901 4.65 12.25 0.03 41 MISSING_HEADERS 34379 5.08 12.07 0.83 42 MIME_HEADER_CTYPE_ONLY 34042 4.61 11.95 0.15 43 HTML_IMAGE_RATIO_02 32187 8.59 11.30 6.95 44 HTML_IMAGE_ONLY_04 32034 4.28 11.24 0.05 45 XM_Evil_Numbers_Gen 29362 8.48 10.31 7.37 46 SHORTENER_SHORT_IMG 29225 3.88 10.26 0.00 47 URI_BUFFLY 29222 3.88 10.26 0.00 48 HTML_SHORT_CENTER 27163 3.61 9.53 0.00 49 BAYES_80 26278 5.87 9.22 3.83 50 UNTRUSTED_Relay 26050 4.17 9.14 1.14 51 FSL_BULK_SIG 25864 7.40 9.08 6.37 52 BOTNET_IPINHOSTNAME 25419 6.01 8.92 4.24 53 MultiRelay 25237 14.81 8.86 18.42 54 BAYES_60 23562 7.11 8.27 6.40 55 XMSexyCombo_05 23023 4.97 8.08 3.08 56 LOTS_OF_MONEY 22587 7.45 7.93 7.15 57 T_XMDrugObfuBody_14 21373 7.38 7.50 7.30 58 XMSubMetaSx_00 20008 6.85 7.02 6.75 59 XM_UncommonTLD01 19572 4.46 6.87 3.00 60 XMNumbers 19140 4.68 6.72 3.44 61 TR_XM_DocInvoice 18138 4.64 6.37 3.59 62 XM_B_Phish_Phrases 18007 5.58 6.32 5.12 63 HTML_IMAGE_RATIO_04 17648 5.34 6.19 4.83 64 XM_H_Long_From01 15002 5.30 5.27 5.31 65 TooManyTo_001 14787 6.88 5.19 7.90 66 TM2_M_URI_OPT_OUT 14640 7.88 5.14 9.55 67 BAYES_95 14312 3.48 5.02 2.55 68 RCVD_IN_RP_SAFE 13286 7.33 4.66 8.95 69 MPART_ALT_DIFF 12443 3.09 4.37 2.32 70 MIME_QP_LONG_LINE 12186 10.01 4.28 13.49 71 XM_UB50 12022 2.03 4.22 0.69 72 LotsOfNums_01 11669 6.62 4.10 8.16 73 RCVD_IN_RP_CERTIFIED 10746 6.73 3.77 8.53 74 XM_SPF_SoftFail 10630 2.58 3.73 1.89 75 XMStrtUSub 10185 3.73 3.57 3.82 76 SpammyFromTLD_02 9544 1.38 3.35 0.18 77 DKIM_INVALID 9208 3.97 3.23 4.42 78 ALL_TRUSTED 9068 15.78 3.18 23.43 79 DIET_1 8274 1.32 2.90 0.36 80 HTML_IMAGE_RATIO_06 8220 2.88 2.89 2.88 81 SUBJ_ALL_CAPS 7303 2.34 2.56 2.20 82 MIME_HTML_MOSTLY 7195 2.34 2.53 2.23 83 XM_DIRTYINTL 7134 2.07 2.50 1.81 84 RCVD_IN_MSPIKE_H2 7078 3.84 2.48 4.66 85 XM_CamelCaseFrm001 6961 2.06 2.44 1.82 86 T_TooManySym_01 6571 4.21 2.31 5.36 87 RELAYCOUNTRY_CA 6435 1.65 2.26 1.28 88 MIME_HTML_ONLY_MULTI 6365 1.45 2.23 0.97 89 XM_OfRef6 6224 1.58 2.18 1.22 90 XMSlimDrugH 5786 1.22 2.03 0.72 91 XM_SendGrid 5669 4.19 1.99 5.52 92 XMSubMetaI_00 5491 1.16 1.93 0.69 93 BOTNET_NORDNS 5425 0.73 1.90 0.02 94 DATE_IN_PAST_24_48 5337 0.71 1.87 0.01 95 T_XMDrugObfuBody_00 4889 1.07 1.72 0.67 96 RELAYCOUNTRY_UA 4768 0.63 1.67 0.00 97 URI_WP_HACKED_2 4710 2.58 1.65 3.14 98 MultiRelay_Combo 4657 0.72 1.63 0.17 99 MultiRelay_CC 4657 0.72 1.63 0.17 100 XMBdyGiftCard01 4626 1.19 1.62 0.92 101 SpammyFromTLD_01 4618 1.02 1.62 0.66 102 T_FILL_THIS_FORM_SHORT 4585 1.15 1.61 0.87 103 T_XMDrugObfuBody_08 4584 1.49 1.61 1.42 104 XMBody_17 4577 0.88 1.61 0.44 105 XM_UB60 4469 0.66 1.57 0.11 106 HTML_IMAGE_RATIO_08 4467 1.96 1.57 2.21 107 IMPOTENCE 4221 2.28 1.48 2.76 108 RCVD_IN_BL_SPAMCOP_NET 3853 0.69 1.35 0.29 109 XMDiploma_00 3738 1.35 1.31 1.38 110 MAILING_LIST_MULTI 3466 1.94 1.22 2.38 111 HTML_IMAGE_ONLY_08 3412 0.51 1.20 0.10 112 XMSexyCombo_01 3341 1.08 1.17 1.03 113 TR_Symld_Words 3305 1.46 1.16 1.65 114 XMMoneyMeta_00 3247 0.70 1.14 0.43 115 PLING_QUERY 3235 0.71 1.14 0.45 116 XM_UB80 3180 0.46 1.12 0.07 117 XMHTML_After_End 3167 0.62 1.11 0.32 118 BAYES_00 3126 5.13 1.10 7.58 119 RELAYCOUNTRY_FR 3096 0.55 1.09 0.23 120 NO_PRESCRIPTION 3029 0.55 1.06 0.24 121 RELAYCOUNTRY_JP 3009 0.42 1.06 0.04 122 UNPARSEABLE_RELAY 3007 2.52 1.06 3.40 123 XM_BadFromFormat 3005 0.53 1.05 0.21 124 XM_RXBody 2995 0.58 1.05 0.29 125 XM_H_PHPOS 2977 1.17 1.04 1.24 126 BAYES_40 2952 2.61 1.04 3.57 127 TM2_M_VERY_LONG_WORD 2943 0.89 1.03 0.81 128 LongTLD 2858 0.48 1.00 0.15 129 FORM_FRAUD_5 2803 0.37 0.98 0.00 130 XM_UB99 2800 0.40 0.98 0.04 131 RELAYCOUNTRY_GB 2790 0.94 0.98 0.92 132 T_FROM_SUSPICIOUS_NTLD 2783 0.40 0.98 0.04 133 TR_XM_RelayPhish 2783 0.71 0.98 0.54 134 XM_ProductURIs 2767 1.09 0.97 1.16 135 XM_XX_Yahoo 2723 0.40 0.96 0.06 136 XM_H_Long_From02 2697 0.93 0.95 0.92 137 XMGenDplmaNmb 2675 0.90 0.94 0.88 138 BAYES_20 2666 2.01 0.94 2.66 139 T_MONEY_PERCENT 2574 0.51 0.90 0.26 140 TR_LOTS_OF_MONEY2 2574 0.51 0.90 0.26 141 XMPhish30 2563 0.55 0.90 0.34 142 URI_TRY_3LD 2561 1.02 0.90 1.10 143 RCVD_IN_PSBL 2534 0.39 0.89 0.09 144 RELAYCOUNTRY_DE 2512 0.60 0.88 0.42 145 URIBL_DBL_SPAM 2503 0.34 0.88 0.02 146 XM_HighProb1 2498 0.34 0.88 0.01 147 RELAYCOUNTRY_IN 2463 0.41 0.86 0.13 148 HTML_FONT_FACE_BAD 2458 0.61 0.86 0.45 149 XMPhish11 2439 1.07 0.86 1.20 150 TR_XM_DK_Bayes 2436 3.65 0.85 5.35 151 XMBrknScrpt_02 2426 0.72 0.85 0.64 152 T_XMHurry_00 2367 0.76 0.83 0.72 153 TR_XM_DK_Bayes1 2363 3.44 0.83 5.02 154 RELAYCOUNTRY_AT 2359 0.40 0.83 0.14 155 REMOVE_BEFORE_LINK 2331 0.48 0.82 0.28 156 XM_S_JOY_D 2326 0.77 0.82 0.74 157 HTML_FONT_SIZE_LARGE 2322 0.41 0.81 0.16 158 TR_XM_DK_Bayes2 2307 2.94 0.81 4.23 159 XMSlimDrugs 2269 0.59 0.80 0.46 160 XMStockSpam_06 2256 1.08 0.79 1.25 161 XMPhish14 2225 0.64 0.78 0.56 162 SUBJ_DOLLARS 2105 0.50 0.74 0.36 163 XM_DK_Undo_01 2088 1.53 0.73 2.01 164 RCVD_IN_IADB_LISTED 2088 3.76 0.73 5.59 165 DKIM_ADSP_CUSTOM_MED 2015 0.87 0.71 0.97 166 XMSubMetaSSx_00 2008 0.71 0.70 0.71 167 ONLINE_PHARMACY 1990 1.30 0.70 1.67 168 T_TooManySym_02 1975 1.47 0.69 1.94 169 NO_DNS_FOR_FROM 1957 0.62 0.69 0.58 170 XM_UB999 1950 0.28 0.68 0.03 171 TR_Mismatch_TLD_02 1946 0.29 0.68 0.06 172 NML_ADSP_CUSTOM_MED 1891 0.69 0.66 0.71 173 XM_ShortIntro_01 1881 0.55 0.66 0.48 174 XM_UB95 1875 0.27 0.66 0.04 175 T_Symld_Words_02 1873 0.49 0.66 0.38 176 TVD_VISIT_PHARMA 1857 1.07 0.65 1.32 177 XMSubMetaSxObfu_03 1856 0.81 0.65 0.91 178 BAYES_05 1832 1.33 0.64 1.74 179 HTML_IMAGE_ONLY_12 1826 0.38 0.64 0.21 180 FVGT_m_MULTI_ODD_EMAIL 1806 0.29 0.63 0.07 181 RCVD_IN_IADB_SPF 1765 3.32 0.62 4.96 182 DATE_IN_PAST_12_24 1763 0.25 0.62 0.03 183 XM_B_REG_HTML 1761 0.48 0.62 0.39 184 XM_PDF 1759 3.17 0.62 4.72 185 XMSexyCombo_04 1757 0.65 0.62 0.67 186 FORGED_GMAIL_RCVD 1745 0.50 0.61 0.44 187 HTML_TAG_BALANCE_BODY 1727 0.52 0.61 0.47 188 TR_Caps_n_Bayes_99 1716 0.31 0.60 0.13 189 HTML_IMAGE_ONLY_16 1661 0.43 0.58 0.34 190 RCVD_IN_IADB_SENDERID 1652 2.96 0.58 4.41 191 ADVANCE_FEE_5_NEW_MONEY 1635 0.22 0.57 0.01 192 XMHTMLBadTable_001 1633 0.47 0.57 0.41 193 RCVD_IN_IADB_DK 1627 2.93 0.57 4.36 194 XMSubMetaI_01 1616 0.24 0.57 0.04 195 HTML_IMAGE_ONLY_28 1597 0.45 0.56 0.38 196 MONEY_FORM_SHORT 1595 0.22 0.56 0.01 197 XMBody_78 1593 0.44 0.56 0.36 198 XM_OfRef7 1574 0.31 0.55 0.17 199 RELAYCOUNTRY_CN 1559 0.24 0.55 0.05 200 DATE_IN_PAST_03_06 1553 0.24 0.55 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 372344 84.85 93.83 79.40 2 DKIM_SIGNED 318044 62.15 52.82 67.82 3 XM_DK_Pass 311726 60.81 51.49 66.47 4 DCC_CHECK_NEGATIVE 302834 57.60 46.13 64.57 5 DKIM_VALID 297301 58.18 49.58 63.39 6 BAYES_50 286313 56.40 48.76 61.05 7 DKIM_VALID_AU 210556 43.12 40.18 44.90 8 XMListUnsubscribeExists 201978 44.47 46.77 43.07 9 XM_H_QuotedFrom 185195 38.88 37.87 39.49 10 DCC_CHECK 156932 40.76 52.76 33.46 11 T_TM2_M_HEADER_IN_MSG 149245 25.71 15.63 31.82 12 DKIM_VALID_EF 120014 21.66 15.19 25.59 13 XMSubLong 113278 22.68 20.26 24.15 14 HTML_FONT_LOW_CONTRAST 113267 23.72 23.01 24.15 15 ALL_TRUSTED 109902 15.78 3.18 23.43 16 FVGT_m_MULTI_ODD 96754 20.22 19.54 20.63 17 LOC_TINY_FONT_1 89149 20.47 22.88 19.01 18 MultiRelay 86396 14.81 8.86 18.42 19 MIME_HTML_ONLY 80631 22.88 32.25 17.19 20 T_KAM_HTML_FONT_INVALID 68202 13.71 12.35 14.54 21 MIME_QP_LONG_LINE 63266 10.01 4.28 13.49 22 XM_DKIMWhitelistDomains 62113 8.27 0.07 13.24 23 XM_DK_Undo_02 52680 17.50 27.81 11.23 24 XM_Multi_Part_URI 49983 11.43 12.70 10.66 25 BAYES_99 49638 16.03 24.99 10.58 26 XM_Body_Dirty_Words 48147 11.33 13.08 10.27 27 TM2_M_URI_OPT_OUT 44774 7.88 5.14 9.55 28 BAYES_999 42300 13.52 20.93 9.02 29 RCVD_IN_RP_SAFE 41968 7.33 4.66 8.95 30 RCVD_IN_RP_CERTIFIED 40003 6.73 3.77 8.53 31 LotsOfNums_01 38268 6.62 4.10 8.16 32 TooManyTo_001 37058 6.88 5.19 7.90 33 BAYES_00 35569 5.13 1.10 7.58 34 XM_Evil_Numbers_Gen 34572 8.48 10.31 7.37 35 T_XMDrugObfuBody_14 34250 7.38 7.50 7.30 36 LOTS_OF_MONEY 33540 7.45 7.93 7.15 37 HTML_IMAGE_RATIO_02 32571 8.59 11.30 6.95 38 XMSubMetaSx_00 31640 6.85 7.02 6.75 39 BAYES_60 30013 7.11 8.27 6.40 40 FSL_BULK_SIG 29893 7.40 9.08 6.37 41 TR_DCC_Bayes_99 26239 11.02 19.95 5.60 42 RCVD_IN_IADB_LISTED 26228 3.76 0.73 5.59 43 XM_SendGrid 25890 4.19 1.99 5.52 44 T_TooManySym_01 25137 4.21 2.31 5.36 45 TR_XM_DK_Bayes 25072 3.65 0.85 5.35 46 XM_H_Long_From01 24917 5.30 5.27 5.31 47 XM_B_Phish_Phrases 24024 5.58 6.32 5.12 48 TR_XM_DK_Bayes1 23560 3.44 0.83 5.02 49 RCVD_IN_IADB_SPF 23250 3.32 0.62 4.96 50 HTML_IMAGE_RATIO_04 22647 5.34 6.19 4.83 51 RELAYCOUNTRY_META 22317 7.99 13.30 4.76 52 XM_PDF 22117 3.17 0.62 4.72 53 RCVD_IN_MSPIKE_H2 21834 3.84 2.48 4.66 54 DKIM_INVALID 20743 3.97 3.23 4.42 55 RCVD_IN_IADB_SENDERID 20690 2.96 0.58 4.41 56 RCVD_IN_IADB_DK 20435 2.93 0.57 4.36 57 BOTNET_IPINHOSTNAME 19895 6.01 8.92 4.24 58 TR_XM_DK_Bayes2 19836 2.94 0.81 4.23 59 T_REMOTE_IMAGE 18858 8.00 14.56 4.02 60 BAYES_80 17971 5.87 9.22 3.83 61 XMStrtUSub 17901 3.73 3.57 3.82 62 IN_ZIMBRA_NJ_WHITELIST 17651 2.35 0.02 3.76 63 TR_XM_DocInvoice 16852 4.64 6.37 3.59 64 BAYES_40 16719 2.61 1.04 3.57 65 RCVD_IN_IADB_VOUCHED 16215 2.33 0.48 3.46 66 XMNumbers 16114 4.68 6.72 3.44 67 UNPARSEABLE_RELAY 15967 2.52 1.06 3.40 68 URI_WP_HACKED_2 14727 2.58 1.65 3.14 69 ANY_BOUNCE_MESSAGE 14502 10.76 23.38 3.09 70 BOUNCE_MESSAGE 14497 10.76 23.38 3.09 71 XMSexyCombo_05 14424 4.97 8.08 3.08 72 TVD_RCVD_IP 14340 1.97 0.17 3.06 73 XM_UncommonTLD01 14085 4.46 6.87 3.00 74 FROM_EXCESS_BASE64 13710 8.09 16.59 2.92 75 HTML_IMAGE_RATIO_06 13511 2.88 2.89 2.88 76 IMPOTENCE 12945 2.28 1.48 2.76 77 BAYES_20 12488 2.01 0.94 2.66 78 TO_MALFORMED 12468 1.66 0.02 2.66 79 BAYES_95 11957 3.48 5.02 2.55 80 TooManyTo_002 11879 1.75 0.47 2.53 81 MAILING_LIST_MULTI 11176 1.94 1.22 2.38 82 MPART_ALT_DIFF 10882 3.09 4.37 2.32 83 HTML_MIME_NO_HTML_TAG 10631 6.46 13.36 2.27 84 MIME_HTML_MOSTLY 10475 2.34 2.53 2.23 85 HTML_IMAGE_RATIO_08 10345 1.96 1.57 2.21 86 SUBJ_ALL_CAPS 10326 2.34 2.56 2.20 87 RCVD_IN_IADB_OPTIN 9692 1.40 0.31 2.07 88 XM_DK_Undo_01 9440 1.53 0.73 2.01 89 RCVD_IN_MSPIKE_WL 9305 1.38 0.38 1.98 90 RCVD_IN_MSPIKE_H3 9297 1.38 0.38 1.98 91 T_TooManySym_02 9106 1.47 0.69 1.94 92 HELO_NODOT 8880 1.27 0.24 1.89 93 XM_SPF_SoftFail 8853 2.58 3.73 1.89 94 XM_CamelCaseFrm001 8539 2.06 2.44 1.82 95 XM_DIRTYINTL 8475 2.07 2.50 1.81 96 TooManyTo_003 8306 1.25 0.39 1.77 97 BAYES_05 8163 1.33 0.64 1.74 98 IN_HORDE_ADDRESS_BOOK 7978 1.07 0.04 1.70 99 ONLINE_PHARMACY 7839 1.30 0.70 1.67 100 TR_MetaPhish_Combo_01 7809 1.19 0.40 1.67 101 TR_Symld_Words 7718 1.46 1.16 1.65 102 URI_HEX 7413 10.57 25.38 1.58 103 INVALID_MSGID 7108 0.98 0.10 1.52 104 XMCapTrack 6825 9.67 23.19 1.46 105 T_XMDrugObfuBody_08 6676 1.49 1.61 1.42 106 USER_IN_DEF_DKIM_WL 6615 0.89 0.03 1.41 107 XMDiploma_00 6469 1.35 1.31 1.38 108 TooManyTo_004 6360 0.96 0.32 1.36 109 TVD_VISIT_PHARMA 6175 1.07 0.65 1.32 110 RELAYCOUNTRY_CA 6015 1.65 2.26 1.28 111 XMStockSpam_06 5878 1.08 0.79 1.25 112 XM_H_PHPOS 5826 1.17 1.04 1.24 113 XM_OfRef6 5706 1.58 2.18 1.22 114 XMPhish11 5650 1.07 0.86 1.20 115 XM_GoogleGroups 5498 0.85 0.33 1.17 116 XM_ProductURIs 5452 1.09 0.97 1.16 117 UNTRUSTED_Relay 5363 4.17 9.14 1.14 118 URI_TRY_3LD 5146 1.02 0.90 1.10 119 TooManyTo_005 5140 0.79 0.27 1.10 120 BOTNET 4891 15.95 40.49 1.04 121 XMSexyCombo_01 4830 1.08 1.17 1.03 122 MIME_HTML_ONLY_MULTI 4540 1.45 2.23 0.97 123 DKIM_ADSP_CUSTOM_MED 4538 0.87 0.71 0.97 124 XMBdyGiftCard01 4325 1.19 1.62 0.92 125 RELAYCOUNTRY_GB 4307 0.94 0.98 0.92 126 XM_H_Long_From02 4303 0.93 0.95 0.92 127 XMSubMetaSxObfu_03 4281 0.81 0.65 0.91 128 XMGenDplmaNmb 4137 0.90 0.94 0.88 129 T_FILL_THIS_FORM_SHORT 4075 1.15 1.61 0.87 130 MISSING_HEADERS 3907 5.08 12.07 0.83 131 TM2_M_VERY_LONG_WORD 3799 0.89 1.03 0.81 132 XM_S_JOY_D 3468 0.77 0.82 0.74 133 T_XMHurry_00 3393 0.76 0.83 0.72 134 XMSlimDrugH 3374 1.22 2.03 0.72 135 XMSubMetaSSx_00 3337 0.71 0.70 0.71 136 NML_ADSP_CUSTOM_MED 3325 0.69 0.66 0.71 137 XM_H_PHPMailer 3311 0.59 0.40 0.71 138 XM_UB50 3258 2.03 4.22 0.69 139 XMSubMetaI_00 3230 1.16 1.93 0.69 140 T_XMDrugObfuBody_00 3161 1.07 1.72 0.67 141 XMLngstWrd_00 3142 0.52 0.28 0.67 142 XMSexyCombo_04 3126 0.65 0.62 0.67 143 SpammyFromTLD_01 3099 1.02 1.62 0.66 144 XMNoVowels 3083 0.49 0.23 0.66 145 T_TooManySym_03 3005 0.52 0.32 0.64 146 XMBrknScrpt_02 2992 0.72 0.85 0.64 147 XMLngstWrd_01 2944 0.49 0.26 0.63 148 AC_DIV_BONANZA 2896 0.41 0.06 0.62 149 T_OBFU_PDF_ATTACH 2848 0.43 0.13 0.61 150 XMSubMetaSxObfu_02 2823 0.44 0.16 0.60 151 XMBody_95 2817 0.41 0.10 0.60 152 TM2_M_A_HREF_HREF 2762 0.47 0.28 0.59 153 NO_DNS_FOR_FROM 2711 0.62 0.69 0.58 154 HTTPS_HTTP_MISMATCH 2617 0.50 0.41 0.56 155 XMPhish14 2605 0.64 0.78 0.56 156 TR_XM_RelayPhish 2547 0.71 0.98 0.54 157 USER_IN_WHITELIST 2484 0.33 0.00 0.53 158 SHORT_HELO_AND_INLINE_IMAGE 2275 0.33 0.06 0.49 159 XM_ShortIntro_01 2245 0.55 0.66 0.48 160 URI_NOVOWEL 2234 0.47 0.47 0.48 161 TM2_M_BODY_EMPTY 2222 0.33 0.10 0.47 162 HTML_TAG_BALANCE_BODY 2193 0.52 0.61 0.47 163 RCVD_IN_SORBS_DUL 2188 0.35 0.16 0.47 164 XMSlimDrugs 2174 0.59 0.80 0.46 165 HTML_FONT_FACE_BAD 2124 0.61 0.86 0.45 166 XMGappySubj_01 2117 0.43 0.41 0.45 167 HTML_IMAGE_ONLY_32 2101 0.34 0.17 0.45 168 PLING_QUERY 2092 0.71 1.14 0.45 169 T_MANY_PILL_PRICE 2089 0.29 0.03 0.45 170 RELAYCOUNTRY_AU 2076 0.43 0.41 0.44 171 XMBody_17 2073 0.88 1.61 0.44 172 FORGED_GMAIL_RCVD 2056 0.50 0.61 0.44 173 XMDateMe_00 2055 0.34 0.19 0.44 174 FILL_THIS_FORM 2046 0.47 0.53 0.44 175 XMMoneyMeta_00 2038 0.70 1.14 0.43 176 RELAYCOUNTRY_DE 1977 0.60 0.88 0.42 177 XMSolicitRefs_0 1941 0.44 0.48 0.41 178 XMHTMLBadTable_001 1903 0.47 0.57 0.41 179 XMSubMetaSx_01 1887 0.41 0.43 0.40 180 XM_B_REG_HTML 1835 0.48 0.62 0.39 181 XM_B_COPY_HTML 1813 0.43 0.51 0.39 182 HTML_IMAGE_ONLY_28 1804 0.45 0.56 0.38 183 T_Symld_Words_02 1793 0.49 0.66 0.38 184 XM_H_PHPOS_M 1769 0.33 0.25 0.38 185 RELAYCOUNTRY_NL 1764 0.35 0.31 0.38 186 T_FROM_GOV_SPOOF 1754 0.27 0.10 0.37 187 DKIM_ADSP_NXDOMAIN 1743 0.39 0.43 0.37 188 XMBody_78 1704 0.44 0.56 0.36 189 DIET_1 1691 1.32 2.90 0.36 190 SUBJ_DOLLARS 1681 0.50 0.74 0.36 191 XMLKML 1668 0.22 0.00 0.36 192 RDNS_DYNAMIC 1658 0.42 0.52 0.35 193 HTML_IMAGE_ONLY_24 1619 0.33 0.31 0.35 194 T_FILL_THIS_FORM_LONG 1610 0.39 0.48 0.34 195 HTML_IMAGE_ONLY_16 1593 0.43 0.58 0.34 196 XMSubNoVowel 1576 0.35 0.36 0.34 197 XMPhish30 1576 0.55 0.90 0.34 198 T_FROM_GOV_DKIM_AU 1510 0.24 0.11 0.32 199 XMHTML_After_End 1493 0.62 1.11 0.32 200 HTML_IMAGE_ONLY_20 1407 0.29 0.27 0.30 ----------------------------------------------------------------------