Email: 804544 Autolearn: 0 AvgScore: 5.27 AvgScanTime: 4.37 sec Spam: 278443 Autolearn: 0 AvgScore: 15.14 AvgScanTime: 4.77 sec Ham: 526101 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 4.16 sec Time Spent Running SA: 976.30 hours Time Spent Processing Spam: 369.06 hours Time Spent Processing Ham: 607.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 264893 83.01 95.13 76.60 2 DKIM_SIGNED 161787 62.45 58.10 64.75 3 DCC_CHECK 160081 40.66 57.49 31.75 4 XM_DK_Pass 156186 60.90 56.09 63.44 5 DKIM_VALID 148754 57.65 53.42 59.88 6 BAYES_50 145710 57.88 52.33 60.82 7 XMListUnsubscribeExists 136775 45.22 49.12 43.16 8 DKIM_VALID_AU 117995 41.97 42.38 41.75 9 DCC_CHECK_NEGATIVE 115369 57.77 41.43 66.41 10 XM_H_QuotedFrom 114275 42.49 41.04 43.26 11 BOTNET 106684 14.14 38.31 1.35 12 MIME_HTML_ONLY 81433 20.60 29.25 16.02 13 RCVD_IN_RP_RNBL 81328 10.13 29.21 0.03 14 XM_DK_Undo_02 80161 16.17 28.79 9.49 15 URI_HEX 74692 10.25 26.82 1.48 16 BAYES_99 74458 14.83 26.74 8.52 17 LOC_TINY_FONT_1 70364 20.58 25.27 18.09 18 HTML_FONT_LOW_CONTRAST 69924 23.74 25.11 23.02 19 BOUNCE_MESSAGE 68146 10.10 24.47 2.49 20 ANY_BOUNCE_MESSAGE 68146 10.10 24.47 2.49 21 XMCapTrack 67851 9.39 24.37 1.46 22 NUMERIC_HTTP_ADDR 67556 8.47 24.26 0.12 23 TR_DCC_Bayes_99 59558 10.08 21.39 4.10 24 BAYES_999 59452 12.10 21.35 7.20 25 FVGT_m_MULTI_ODD 56501 19.55 20.29 19.15 26 XM_URI_RBL 55489 6.98 19.93 0.12 27 XMSubLong 53112 19.22 19.07 19.30 28 URIBL_BLACK 52569 6.57 18.88 0.06 29 DKIM_VALID_EF 48530 21.06 17.43 22.98 30 DATE_IN_PAST_96_XX 45617 5.67 16.38 0.00 31 T_KAM_HTML_FONT_INVALID 40198 14.48 14.44 14.50 32 T_TM2_M_HEADER_IN_MSG 39390 23.76 14.15 28.85 33 XM_Multi_Part_URI 37676 10.75 13.53 9.27 34 XM_Body_Dirty_Words 35917 11.12 12.90 10.18 35 FSL_BULK_SIG 33908 7.85 12.18 5.56 36 HTML_IMAGE_RATIO_02 31337 8.21 11.25 6.61 37 RELAYCOUNTRY_META 30841 6.79 11.08 4.52 38 MultiRelay 30312 14.67 10.89 16.67 39 FROM_EXCESS_BASE64 29828 5.72 10.71 3.07 40 XM_Evil_Numbers_Gen 29740 7.99 10.68 6.57 41 BOTNET_IPINHOSTNAME 24572 5.93 8.82 4.40 42 XM_UncommonTLD01 23569 4.89 8.46 2.99 43 HTML_MIME_NO_HTML_TAG 22203 4.10 7.97 2.05 44 LOTS_OF_MONEY 20719 6.96 7.44 6.70 45 T_XMDrugObfuBody_14 20696 7.22 7.43 7.11 46 BAYES_80 20363 4.73 7.31 3.37 47 BODY_URI_ONLY 18710 2.38 6.72 0.09 48 HTML_IMAGE_ONLY_08 18438 2.45 6.62 0.24 49 XMSexyCombo_05 18412 3.72 6.61 2.19 50 HTML_SHORT_LINK_IMG_1 18384 2.31 6.60 0.03 51 MISSING_HEADERS 18095 2.61 6.50 0.55 52 XM_BadFromFormat 17996 2.33 6.46 0.15 53 TR_XM_DocInvoice 17757 4.65 6.38 3.74 54 MIME_HEADER_CTYPE_ONLY 17588 2.27 6.32 0.12 55 UNTRUSTED_Relay 17552 3.02 6.30 1.29 56 HTML_FONT_SIZE_HUGE 17336 2.22 6.23 0.10 57 HTML_IMAGE_RATIO_04 16778 5.19 6.03 4.74 58 XM_H_Long_From01 16225 5.37 5.83 5.13 59 XM_B_Phish_Phrases 16216 4.92 5.82 4.45 60 BAYES_60 15059 5.88 5.41 6.13 61 SpammyFromTLD_02 14605 2.02 5.25 0.31 62 XMSubMetaSx_00 14502 4.70 5.21 4.43 63 TooManyTo_001 13726 6.65 4.93 7.56 64 TM2_M_URI_OPT_OUT 13700 10.27 4.92 13.09 65 MPART_ALT_DIFF 13529 3.30 4.86 2.47 66 DKIM_INVALID 13033 4.81 4.68 4.87 67 XMNumbers 12802 3.80 4.60 3.38 68 BAYES_95 12763 3.12 4.58 2.34 69 LotsOfNums_01 12086 6.69 4.34 7.93 70 ALL_TRUSTED 11569 19.19 4.15 27.15 71 MIME_QP_LONG_LINE 11059 12.44 3.97 16.92 72 RCVD_IN_RP_SAFE 10021 6.26 3.60 7.67 73 XM_SendGrid 8973 4.17 3.22 4.68 74 XM_UB50 8732 1.53 3.14 0.68 75 HTML_IMAGE_RATIO_06 8722 2.77 3.13 2.57 76 MIME_HTML_MOSTLY 8659 2.61 3.11 2.35 77 RCVD_IN_RP_CERTIFIED 8458 5.89 3.04 7.39 78 XM_SPF_SoftFail 8398 2.25 3.02 1.84 79 XMStrtUSub 7969 3.32 2.86 3.56 80 XM_DIRTYINTL 7358 1.93 2.64 1.56 81 RELAYCOUNTRY_CA 7202 1.68 2.59 1.21 82 HTML_IMAGE_RATIO_08 6819 2.10 2.45 1.91 83 MIME_HTML_ONLY_MULTI 6747 1.58 2.42 1.13 84 T_TooManySym_01 6690 3.93 2.40 4.74 85 T_REMOTE_IMAGE 5876 3.37 2.11 4.03 86 RCVD_IN_MSPIKE_H2 5863 3.47 2.11 4.20 87 XM_CamelCaseFrm001 5644 1.76 2.03 1.62 88 XMSlimDrugH 5621 0.98 2.02 0.43 89 T_XMDrugObfuBody_08 5465 1.52 1.96 1.28 90 XM_OfRef6 5053 1.37 1.81 1.14 91 MultiRelay_Combo 4897 0.70 1.76 0.15 92 MultiRelay_CC 4897 0.70 1.76 0.15 93 XMDiploma_00 4799 1.57 1.72 1.48 94 URI_WP_HACKED_2 4694 3.90 1.69 5.07 95 SpammyFromTLD_01 4672 1.14 1.68 0.86 96 DIET_1 4490 0.79 1.61 0.35 97 RCVD_IN_BL_SPAMCOP_NET 3817 0.64 1.37 0.25 98 BAYES_40 3749 3.19 1.35 4.17 99 XMMoneyMeta_00 3730 0.76 1.34 0.46 100 SUBJ_ALL_CAPS 3677 1.56 1.32 1.69 101 XMBdyGiftCard01 3486 1.02 1.25 0.90 102 XM_JunkDunk 3439 0.43 1.24 0.00 103 SUBJ_DOLLARS 3426 0.60 1.23 0.26 104 URI_TRY_3LD 3393 0.96 1.22 0.82 105 DKIM_ADSP_NXDOMAIN 3391 0.67 1.22 0.38 106 MAILING_LIST_MULTI 3259 1.87 1.17 2.24 107 TR_Symld_Words 3256 1.52 1.17 1.71 108 XMHTML_After_End 3187 0.63 1.14 0.36 109 XMGenDplmaNmb 3103 1.03 1.11 0.98 110 BOTNET_NORDNS 2978 0.38 1.07 0.02 111 XMSubMetaI_00 2885 0.71 1.04 0.53 112 XMSexyCombo_01 2862 0.80 1.03 0.69 113 T_XMDrugObfuBody_00 2838 0.77 1.02 0.64 114 RELAYCOUNTRY_GB 2830 0.98 1.02 0.96 115 XM_H_PHPOS 2827 1.48 1.02 1.73 116 TM2_M_VERY_LONG_WORD 2826 0.88 1.01 0.81 117 DATE_IN_PAST_24_48 2823 0.36 1.01 0.01 118 BAYES_20 2783 2.33 1.00 3.04 119 TR_XM_RelayPhish 2745 0.63 0.99 0.43 120 XM_H_Long_From02 2744 0.88 0.99 0.82 121 SHORT_URI 2728 0.60 0.98 0.40 122 T_XMHurry_00 2723 0.66 0.98 0.49 123 UNPARSEABLE_RELAY 2708 2.17 0.97 2.80 124 XM_salutation 2654 0.59 0.95 0.39 125 RCVD_IN_IADB_LISTED 2622 4.13 0.94 5.81 126 XM_DK_Undo_01 2612 1.51 0.94 1.82 127 HTTPS_HTTP_MISMATCH 2542 0.62 0.91 0.46 128 XMStockSpam_06 2524 0.72 0.91 0.62 129 XM_HighProb1 2508 0.32 0.90 0.01 130 XMPhish30 2433 0.50 0.87 0.30 131 RELAYCOUNTRY_NL 2387 0.43 0.86 0.21 132 XM_ProductURIs 2383 0.72 0.86 0.65 133 XM_UB60 2329 0.33 0.84 0.06 134 XM_PDF 2310 3.13 0.83 4.34 135 URIBL_DBL_SPAM 2282 0.30 0.82 0.03 136 XM_UB99 2276 0.33 0.82 0.07 137 DEAR_FRIEND 2169 0.31 0.78 0.05 138 HTML_FONT_FACE_BAD 2165 0.62 0.78 0.53 139 RELAYCOUNTRY_FR 2155 0.38 0.77 0.17 140 XMPhish11 2155 0.91 0.77 0.98 141 XMLngstWrd_00 2152 0.67 0.77 0.61 142 XMClaimOffer 2130 0.44 0.76 0.27 143 REMOVE_BEFORE_LINK 2125 0.47 0.76 0.31 144 BAYES_00 2118 6.61 0.76 9.71 145 XMLngstWrd_01 2087 0.62 0.75 0.56 146 RCVD_IN_IADB_SPF 2083 3.60 0.75 5.11 147 T_FILL_THIS_FORM_SHORT 2019 0.71 0.73 0.70 148 PLING_QUERY 1989 0.54 0.71 0.45 149 URI_NOVOWEL 1989 0.51 0.71 0.40 150 RELAYCOUNTRY_DE 1985 0.56 0.71 0.48 151 XMWghtMeta_00 1964 0.26 0.71 0.02 152 XMBody_17 1950 0.50 0.70 0.39 153 XMMoneyMeta_01 1942 0.26 0.70 0.03 154 RCVD_IN_IADB_SENDERID 1942 3.18 0.70 4.50 155 RCVD_IN_PSBL 1925 0.31 0.69 0.10 156 RELAYCOUNTRY_AT 1923 0.36 0.69 0.19 157 RCVD_IN_IADB_DK 1911 3.14 0.69 4.43 158 XM_B_REG_HTML 1876 0.43 0.67 0.30 159 XMPhish14 1818 0.42 0.65 0.29 160 TR_MetaPhish_Combo_01 1804 1.20 0.65 1.49 161 TR_Mismatch_TLD_02 1786 0.26 0.64 0.06 162 XMBody_78 1756 0.41 0.63 0.29 163 T_FROM_SUSPICIOUS_NTLD 1749 0.27 0.63 0.08 164 TR_LOTS_OF_MONEY2 1737 0.39 0.62 0.27 165 T_MONEY_PERCENT 1737 0.39 0.62 0.27 166 RCVD_IN_IADB_VOUCHED 1687 2.64 0.61 3.71 167 RELAYCOUNTRY_IN 1686 0.27 0.61 0.10 168 T_HTML_TAG_BALANCE_CENTER 1672 0.28 0.60 0.11 169 XMEqualsVooDoo_00 1668 0.23 0.60 0.04 170 XMHTMLBadTable_001 1658 0.51 0.60 0.46 171 XM_UB999 1658 0.23 0.60 0.03 172 RDNS_DYNAMIC 1630 0.43 0.59 0.35 173 RELAYCOUNTRY_CN 1620 0.23 0.58 0.05 174 XMEqualsVooDoo_01 1604 0.21 0.58 0.02 175 XMBrknScrpt_02 1602 0.55 0.58 0.53 176 TR_XM_DK_Bayes 1593 4.34 0.57 6.33 177 XM_RXBody 1586 0.28 0.57 0.13 178 XM_Body_Obfu01 1583 0.34 0.57 0.23 179 T_TooManySym_02 1568 1.30 0.56 1.68 180 XM_UB80 1563 0.22 0.56 0.04 181 T_Symld_Words_02 1559 0.56 0.56 0.56 182 HTML_TAG_BALANCE_BODY 1555 0.52 0.56 0.50 183 TR_Caps_n_Bayes_99 1552 0.24 0.56 0.08 184 DKIM_ADSP_CUSTOM_MED 1551 0.83 0.56 0.98 185 IMPOTENCE 1509 0.70 0.54 0.79 186 XM_ShortIntro_01 1483 0.81 0.53 0.96 187 TR_XM_DK_Bayes1 1458 4.04 0.52 5.90 188 NML_ADSP_CUSTOM_MED 1452 0.61 0.52 0.66 189 RELAYCOUNTRY_AU 1451 0.49 0.52 0.48 190 HTML_IMAGE_ONLY_28 1446 0.39 0.52 0.32 191 BODY_ENHANCEMENT 1439 0.20 0.52 0.03 192 BAYES_05 1431 1.42 0.51 1.90 193 MPART_ALT_DIFF_COUNT 1430 0.31 0.51 0.19 194 XMSubMetaSSx_00 1410 0.36 0.51 0.28 195 TR_LOTS_OF_MONEY3 1407 0.30 0.51 0.19 196 NO_PRESCRIPTION 1395 0.22 0.50 0.07 197 XMGppyBdWords 1395 0.63 0.50 0.69 198 FORGED_GMAIL_RCVD 1378 0.52 0.49 0.53 199 XMSubMetaSxObfu_03 1374 0.52 0.49 0.54 200 XM_B_COPY_HTML 1349 0.40 0.48 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 402976 83.01 95.13 76.60 2 DCC_CHECK_NEGATIVE 349406 57.77 41.43 66.41 3 DKIM_SIGNED 340655 62.45 58.10 64.75 4 XM_DK_Pass 333765 60.90 56.09 63.44 5 BAYES_50 319998 57.88 52.33 60.82 6 DKIM_VALID 315028 57.65 53.42 59.88 7 XM_H_QuotedFrom 227568 42.49 41.04 43.26 8 XMListUnsubscribeExists 227077 45.22 49.12 43.16 9 DKIM_VALID_AU 219656 41.97 42.38 41.75 10 DCC_CHECK 167026 40.66 57.49 31.75 11 T_TM2_M_HEADER_IN_MSG 151784 23.76 14.15 28.85 12 ALL_TRUSTED 142811 19.19 4.15 27.15 13 HTML_FONT_LOW_CONTRAST 121083 23.74 25.11 23.02 14 DKIM_VALID_EF 120879 21.06 17.43 22.98 15 XMSubLong 101552 19.22 19.07 19.30 16 FVGT_m_MULTI_ODD 100750 19.55 20.29 19.15 17 LOC_TINY_FONT_1 95173 20.58 25.27 18.09 18 MIME_QP_LONG_LINE 89019 12.44 3.97 16.92 19 MultiRelay 87700 14.67 10.89 16.67 20 MIME_HTML_ONLY 84276 20.60 29.25 16.02 21 T_KAM_HTML_FONT_INVALID 76263 14.48 14.44 14.50 22 TM2_M_URI_OPT_OUT 68889 10.27 4.92 13.09 23 XM_DKIMWhitelistDomains 60037 7.47 0.02 11.41 24 XM_Body_Dirty_Words 53566 11.12 12.90 10.18 25 BAYES_00 51086 6.61 0.76 9.71 26 XM_DK_Undo_02 49931 16.17 28.79 9.49 27 XM_Multi_Part_URI 48773 10.75 13.53 9.27 28 BAYES_99 44818 14.83 26.74 8.52 29 LotsOfNums_01 41731 6.69 4.34 7.93 30 RCVD_IN_RP_SAFE 40351 6.26 3.60 7.67 31 TooManyTo_001 39769 6.65 4.93 7.56 32 RCVD_IN_RP_CERTIFIED 38902 5.89 3.04 7.39 33 BAYES_999 37878 12.10 21.35 7.20 34 T_XMDrugObfuBody_14 37402 7.22 7.43 7.11 35 LOTS_OF_MONEY 35258 6.96 7.44 6.70 36 HTML_IMAGE_RATIO_02 34756 8.21 11.25 6.61 37 XM_Evil_Numbers_Gen 34550 7.99 10.68 6.57 38 TR_XM_DK_Bayes 33313 4.34 0.57 6.33 39 BAYES_60 32253 5.88 5.41 6.13 40 TR_XM_DK_Bayes1 31019 4.04 0.52 5.90 41 RCVD_IN_IADB_LISTED 30585 4.13 0.94 5.81 42 FSL_BULK_SIG 29243 7.85 12.18 5.56 43 XM_H_Long_From01 26997 5.37 5.83 5.13 44 RCVD_IN_IADB_SPF 26866 3.60 0.75 5.11 45 URI_WP_HACKED_2 26676 3.90 1.69 5.07 46 TR_XM_DK_Bayes2 26144 3.41 0.47 4.97 47 DKIM_INVALID 25627 4.81 4.68 4.87 48 HTML_IMAGE_RATIO_04 24943 5.19 6.03 4.74 49 T_TooManySym_01 24942 3.93 2.40 4.74 50 XM_SendGrid 24599 4.17 3.22 4.68 51 RELAYCOUNTRY_META 23794 6.79 11.08 4.52 52 RCVD_IN_IADB_SENDERID 23649 3.18 0.70 4.50 53 XM_B_Phish_Phrases 23405 4.92 5.82 4.45 54 RCVD_IN_IADB_DK 23322 3.14 0.69 4.43 55 XMSubMetaSx_00 23287 4.70 5.21 4.43 56 BOTNET_IPINHOSTNAME 23150 5.93 8.82 4.40 57 XM_PDF 22847 3.13 0.83 4.34 58 RCVD_IN_MSPIKE_H2 22090 3.47 2.11 4.20 59 BAYES_40 21937 3.19 1.35 4.17 60 TR_DCC_Bayes_99 21555 10.08 21.39 4.10 61 T_REMOTE_IMAGE 21214 3.37 2.11 4.03 62 TR_XM_DocInvoice 19679 4.65 6.38 3.74 63 RCVD_IN_IADB_VOUCHED 19515 2.64 0.61 3.71 64 IN_ZIMBRA_NJ_WHITELIST 19203 2.39 0.01 3.65 65 XMStrtUSub 18734 3.32 2.86 3.56 66 XMNumbers 17773 3.80 4.60 3.38 67 BAYES_80 17714 4.73 7.31 3.37 68 FROM_EXCESS_BASE64 16165 5.72 10.71 3.07 69 BAYES_20 15968 2.33 1.00 3.04 70 XM_UncommonTLD01 15748 4.89 8.46 2.99 71 UNPARSEABLE_RELAY 14717 2.17 0.97 2.80 72 TVD_RCVD_IP 13714 1.77 0.20 2.61 73 HTML_IMAGE_RATIO_06 13537 2.77 3.13 2.57 74 ANY_BOUNCE_MESSAGE 13085 10.10 24.47 2.49 75 BOUNCE_MESSAGE 13084 10.10 24.47 2.49 76 MPART_ALT_DIFF 12991 3.30 4.86 2.47 77 TO_MALFORMED 12444 1.56 0.05 2.37 78 RCVD_IN_IADB_OPTIN 12391 1.67 0.39 2.36 79 MIME_HTML_MOSTLY 12338 2.61 3.11 2.35 80 BAYES_95 12314 3.12 4.58 2.34 81 MAILING_LIST_MULTI 11777 1.87 1.17 2.24 82 TooManyTo_002 11604 1.60 0.45 2.21 83 XMSexyCombo_05 11515 3.72 6.61 2.19 84 HTML_MIME_NO_HTML_TAG 10790 4.10 7.97 2.05 85 HTML_IMAGE_RATIO_08 10069 2.10 2.45 1.91 86 BAYES_05 9983 1.42 0.51 1.90 87 RCVD_IN_MSPIKE_WL 9747 1.38 0.48 1.85 88 RCVD_IN_MSPIKE_H3 9739 1.37 0.45 1.85 89 XM_SPF_SoftFail 9677 2.25 3.02 1.84 90 XM_DK_Undo_01 9575 1.51 0.94 1.82 91 HELO_NODOT 9484 1.25 0.20 1.80 92 XM_H_PHPOS 9110 1.48 1.02 1.73 93 TR_Symld_Words 9013 1.52 1.17 1.71 94 SUBJ_ALL_CAPS 8913 1.56 1.32 1.69 95 T_TooManySym_02 8857 1.30 0.56 1.68 96 XM_CamelCaseFrm001 8500 1.76 2.03 1.62 97 XM_DIRTYINTL 8209 1.93 2.64 1.56 98 TooManyTo_003 7977 1.12 0.37 1.52 99 IN_HORDE_ADDRESS_BOOK 7842 0.99 0.04 1.49 100 TR_MetaPhish_Combo_01 7832 1.20 0.65 1.49 101 URI_HEX 7795 10.25 26.82 1.48 102 XMDiploma_00 7794 1.57 1.72 1.48 103 XMCapTrack 7679 9.39 24.37 1.46 104 INVALID_MSGID 7240 0.96 0.18 1.38 105 BOTNET 7116 14.14 38.31 1.35 106 UNTRUSTED_Relay 6770 3.02 6.30 1.29 107 T_XMDrugObfuBody_08 6726 1.52 1.96 1.28 108 USER_IN_DEF_DKIM_WL 6616 0.83 0.02 1.26 109 RELAYCOUNTRY_CA 6347 1.68 2.59 1.21 110 XM_OfRef6 5995 1.37 1.81 1.14 111 TooManyTo_004 5972 0.83 0.25 1.14 112 MIME_HTML_ONLY_MULTI 5950 1.58 2.42 1.13 113 XM_GoogleGroups 5683 0.82 0.32 1.08 114 XMPhish11 5159 0.91 0.77 0.98 115 XMGenDplmaNmb 5153 1.03 1.11 0.98 116 DKIM_ADSP_CUSTOM_MED 5136 0.83 0.56 0.98 117 RELAYCOUNTRY_GB 5073 0.98 1.02 0.96 118 XM_ShortIntro_01 5071 0.81 0.53 0.96 119 TooManyTo_005 4842 0.68 0.22 0.92 120 XMBdyGiftCard01 4717 1.02 1.25 0.90 121 SpammyFromTLD_01 4536 1.14 1.68 0.86 122 XM_H_Long_From02 4340 0.88 0.99 0.82 123 URI_TRY_3LD 4294 0.96 1.22 0.82 124 TM2_M_VERY_LONG_WORD 4272 0.88 1.01 0.81 125 IMPOTENCE 4156 0.70 0.54 0.79 126 TO_NO_BRKTS_HTML_ONLY 3699 0.52 0.16 0.70 127 T_FILL_THIS_FORM_SHORT 3660 0.71 0.73 0.70 128 XMGppyBdWords 3645 0.63 0.50 0.69 129 XMSexyCombo_01 3609 0.80 1.03 0.69 130 XM_UB50 3585 1.53 3.14 0.68 131 NML_ADSP_CUSTOM_MED 3455 0.61 0.52 0.66 132 XM_ProductURIs 3440 0.72 0.86 0.65 133 XM_H_PHPMailer 3432 0.59 0.48 0.65 134 T_XMDrugObfuBody_00 3382 0.77 1.02 0.64 135 XMStockSpam_06 3250 0.72 0.91 0.62 136 XMLngstWrd_00 3222 0.67 0.77 0.61 137 AC_DIV_BONANZA 3029 0.40 0.07 0.58 138 T_Symld_Words_02 2941 0.56 0.56 0.56 139 XMLngstWrd_01 2927 0.62 0.75 0.56 140 MISSING_HEADERS 2918 2.61 6.50 0.55 141 XMSubMetaSxObfu_03 2835 0.52 0.49 0.54 142 T_FROM_GOV_SPOOF 2804 0.43 0.24 0.53 143 XMSubMetaI_00 2803 0.71 1.04 0.53 144 HTML_FONT_FACE_BAD 2800 0.62 0.78 0.53 145 T_OBFU_PDF_ATTACH 2796 0.40 0.16 0.53 146 FORGED_GMAIL_RCVD 2792 0.52 0.49 0.53 147 XMBrknScrpt_02 2784 0.55 0.58 0.53 148 URIBL_DBL_ABUSE_SPAM 2688 0.41 0.23 0.51 149 USER_IN_WHITELIST 2668 0.33 0.00 0.51 150 HTML_TAG_BALANCE_BODY 2628 0.52 0.56 0.50 151 T_TooManySym_03 2608 0.36 0.12 0.50 152 T_XMHurry_00 2598 0.66 0.98 0.49 153 TM2_M_A_HREF_HREF 2583 0.47 0.44 0.49 154 XMSubMetaSxObfu_02 2581 0.39 0.20 0.49 155 XMDateMe_00 2576 0.40 0.23 0.49 156 SHORT_HELO_AND_INLINE_IMAGE 2572 0.34 0.07 0.49 157 XMNoVowels 2554 0.39 0.22 0.49 158 RELAYCOUNTRY_AU 2517 0.49 0.52 0.48 159 RELAYCOUNTRY_DE 2505 0.56 0.71 0.48 160 XM_S_JOY_D 2490 0.46 0.44 0.47 161 XMHTMLBadTable_001 2436 0.51 0.60 0.46 162 XMMoneyMeta_00 2419 0.76 1.34 0.46 163 ONLINE_PHARMACY 2418 0.39 0.25 0.46 164 HTTPS_HTTP_MISMATCH 2413 0.62 0.91 0.46 165 PLING_QUERY 2364 0.54 0.71 0.45 166 XMGappySubj_01 2336 0.41 0.35 0.44 167 TR_XM_RelayPhish 2286 0.63 0.99 0.43 168 XMSlimDrugH 2253 0.98 2.02 0.43 169 RCVD_IN_SORBS_DUL 2142 0.34 0.22 0.41 170 SHORT_URI 2124 0.60 0.98 0.40 171 URI_NOVOWEL 2090 0.51 0.71 0.40 172 XMBody_17 2054 0.50 0.70 0.39 173 XM_salutation 2053 0.59 0.95 0.39 174 XMBody_95 2042 0.30 0.13 0.39 175 HTML_IMAGE_ONLY_32 2030 0.32 0.19 0.39 176 TM2_M_BODY_EMPTY 2023 0.33 0.24 0.38 177 DKIM_ADSP_NXDOMAIN 2022 0.67 1.22 0.38 178 FILL_THIS_FORM 1940 0.35 0.32 0.37 179 XMSubNoVowel 1940 0.30 0.16 0.37 180 XMHTML_After_End 1896 0.63 1.14 0.36 181 TVD_VISIT_PHARMA 1883 0.31 0.23 0.36 182 XM_B_COPY_HTML 1882 0.40 0.48 0.36 183 XM_H_PHPOS_M 1871 0.33 0.29 0.36 184 DIET_1 1846 0.79 1.61 0.35 185 XMSolicitRefs_0 1843 0.33 0.28 0.35 186 RDNS_DYNAMIC 1817 0.43 0.59 0.35 187 HTML_IMAGE_ONLY_24 1791 0.31 0.25 0.34 188 HTML_IMAGE_ONLY_28 1663 0.39 0.52 0.32 189 REMOVE_BEFORE_LINK 1656 0.47 0.76 0.31 190 T_FROM_GOV_DKIM_AU 1628 0.26 0.16 0.31 191 SpammyFromTLD_02 1608 2.02 5.25 0.31 192 XM_B_REG_HTML 1594 0.43 0.67 0.30 193 T_FILL_THIS_FORM_LONG 1591 0.29 0.27 0.30 194 XMPhish30 1577 0.50 0.87 0.30 195 HTML_IMAGE_ONLY_16 1561 0.27 0.21 0.30 196 HTML_IMAGE_ONLY_20 1549 0.25 0.17 0.29 197 XMBody_78 1538 0.41 0.63 0.29 198 XM_D_tchamptons_WL 1535 0.19 0.00 0.29 199 XMPhish14 1526 0.42 0.65 0.29 200 T_FILL_THIS_FORM_LOAN 1471 0.26 0.22 0.28 ----------------------------------------------------------------------