Email: 747275 Autolearn: 0 AvgScore: 5.55 AvgScanTime: 4.31 sec Spam: 286677 Autolearn: 0 AvgScore: 15.06 AvgScanTime: 4.71 sec Ham: 460598 Autolearn: 0 AvgScore: -0.37 AvgScanTime: 4.06 sec Time Spent Running SA: 894.66 hours Time Spent Processing Spam: 374.92 hours Time Spent Processing Ham: 519.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279368 90.02 97.45 85.39 2 DCC_CHECK 166341 44.39 58.02 35.91 3 DKIM_SIGNED 160116 66.43 55.85 73.02 4 BAYES_50 155014 55.91 54.07 57.05 5 XM_DK_Pass 154894 64.84 54.03 71.57 6 DKIM_VALID 147310 61.23 51.39 67.37 7 XMListUnsubscribeExists 137430 48.04 47.94 48.10 8 DCC_CHECK_NEGATIVE 117659 53.97 41.04 62.02 9 DKIM_VALID_AU 117009 44.57 40.82 46.91 10 BOTNET 112985 16.10 39.41 1.59 11 XM_H_QuotedFrom 109397 36.35 38.16 35.22 12 RCVD_IN_RP_RNBL 85229 11.43 29.73 0.04 13 MIME_HTML_ONLY 83936 22.76 29.28 18.69 14 XM_DK_Undo_02 79841 18.00 27.85 11.87 15 URI_HEX 75287 11.14 26.26 1.74 16 HTML_FONT_LOW_CONTRAST 72319 25.88 25.23 26.28 17 BAYES_99 69674 15.96 24.30 10.77 18 BOUNCE_MESSAGE 69012 11.10 24.07 3.02 19 ANY_BOUNCE_MESSAGE 69012 11.10 24.07 3.02 20 LOC_TINY_FONT_1 67958 21.35 23.71 19.88 21 NUMERIC_HTTP_ADDR 67880 9.17 23.68 0.13 22 XMCapTrack 67789 10.06 23.65 1.60 23 BAYES_999 58578 13.44 20.43 9.09 24 FVGT_m_MULTI_ODD 57960 20.79 20.22 21.14 25 TR_DCC_Bayes_99 56699 11.17 19.78 5.82 26 XM_URI_RBL 55334 7.49 19.30 0.14 27 URIBL_BLACK 52783 7.09 18.41 0.05 28 XMSubLong 52568 20.35 18.34 21.61 29 DKIM_VALID_EF 46082 21.88 16.07 25.49 30 DATE_IN_PAST_96_XX 44611 5.98 15.56 0.01 31 T_TM2_M_HEADER_IN_MSG 39940 24.33 13.93 30.80 32 XM_Multi_Part_URI 39131 11.88 13.65 10.77 33 T_KAM_HTML_FONT_INVALID 38739 15.35 13.51 16.49 34 XM_Body_Dirty_Words 37944 11.74 13.24 10.81 35 FSL_BULK_SIG 37797 8.99 13.18 6.38 36 LOTS_OF_MONEY 37656 10.82 13.14 9.37 37 MISSING_HEADERS 37254 5.47 13.00 0.78 38 FROM_EXCESS_BASE64 35721 6.80 12.46 3.28 39 HTML_IMAGE_RATIO_02 30491 8.61 10.64 7.35 40 XM_Evil_Numbers_Gen 29856 8.85 10.41 7.88 41 MultiRelay 28598 15.68 9.98 19.22 42 RELAYCOUNTRY_META 28366 7.04 9.89 5.27 43 T_REMOTE_IMAGE 28043 6.65 9.78 4.69 44 HTML_MIME_NO_HTML_TAG 27941 5.21 9.75 2.39 45 BOTNET_IPINHOSTNAME 25431 6.42 8.87 4.89 46 MIME_HEADER_CTYPE_ONLY 23630 3.27 8.24 0.17 47 BODY_URI_ONLY 23366 3.20 8.15 0.12 48 HTML_SHORT_LINK_IMG_1 23108 3.11 8.06 0.03 49 XMSexyCombo_05 22908 5.14 7.99 3.36 50 BAYES_80 22613 5.52 7.89 4.05 51 HTML_IMAGE_ONLY_04 22110 2.99 7.71 0.05 52 T_XMDrugObfuBody_14 21350 7.81 7.45 8.03 53 BAYES_60 20640 6.79 7.20 6.54 54 XM_B_Phish_Phrases 19242 5.92 6.71 5.43 55 HTML_SHORT_CENTER 18697 2.50 6.52 0.00 56 HTML_IMAGE_RATIO_04 17557 5.82 6.12 5.63 57 UNTRUSTED_Relay 16861 3.20 5.88 1.53 58 ALL_TRUSTED 16491 13.11 5.75 17.69 59 TM2_M_A_HREF_HREF 16231 2.56 5.66 0.63 60 XM_H_Long_From01 16177 5.63 5.64 5.62 61 XM_S_JOY_D 16114 2.48 5.62 0.53 62 TR_LOTS_OF_MONEY3 16071 2.39 5.61 0.39 63 TR_XM_DocInvoice 15697 4.23 5.48 3.45 64 TR_LOTS_OF_MONEY1 15092 2.04 5.26 0.04 65 MPART_ALT_DIFF 14726 3.38 5.14 2.28 66 XM_UncommonTLD01 14597 4.11 5.09 3.50 67 XMNumbers 14495 4.27 5.06 3.79 68 REPLYTO_WITHOUT_TO_CC 14442 2.09 5.04 0.25 69 XMSubMetaSx_00 14261 4.28 4.97 3.85 70 TooManyTo_001 13332 6.76 4.65 8.07 71 DKIM_INVALID 12806 5.20 4.47 5.65 72 LotsOfNums_01 12531 7.41 4.37 9.30 73 BAYES_95 10901 3.09 3.80 2.65 74 RCVD_IN_RP_SAFE 10027 6.84 3.50 8.92 75 HTML_IMAGE_RATIO_06 8896 3.03 3.10 2.99 76 TM2_M_URI_OPT_OUT 8258 2.50 2.88 2.27 77 RCVD_IN_RP_CERTIFIED 8239 6.42 2.87 8.63 78 XM_DIRTYINTL 8204 2.31 2.86 1.96 79 MIME_HTML_MOSTLY 7840 2.28 2.73 2.00 80 HTML_IMAGE_RATIO_08 7829 2.37 2.73 2.15 81 MIME_HTML_ONLY_MULTI 7790 1.82 2.72 1.26 82 XM_SPF_SoftFail 7644 2.37 2.67 2.18 83 XM_UB50 7388 1.48 2.58 0.80 84 XMStrtUSub 7133 3.39 2.49 3.95 85 T_TooManySym_01 6785 4.69 2.37 6.14 86 SpammyFromTLD_02 6774 1.11 2.36 0.33 87 XM_SendGrid 6770 4.24 2.36 5.41 88 XM_CamelCaseFrm001 6461 1.80 2.25 1.52 89 RELAYCOUNTRY_CA 5979 1.68 2.09 1.43 90 T_XMDrugObfuBody_08 5939 1.82 2.07 1.66 91 RCVD_IN_MSPIKE_H2 5835 3.80 2.04 4.90 92 DIET_1 5635 1.21 1.97 0.74 93 XM_OfRef6 5255 1.54 1.83 1.36 94 MIME_QP_LONG_LINE 5249 5.35 1.83 7.55 95 XMDiploma_00 4846 1.85 1.69 1.96 96 MultiRelay_CC 4365 0.69 1.52 0.17 97 MultiRelay_Combo 4365 0.69 1.52 0.17 98 XMBdyGiftCard01 4289 1.07 1.50 0.80 99 URI_TRY_3LD 4152 1.21 1.45 1.05 100 SpammyFromTLD_01 3986 1.18 1.39 1.05 101 XMGenDplmaNmb 3587 1.26 1.25 1.26 102 T_XMDrugObfuBody_00 3570 1.25 1.25 1.25 103 T_XMHurry_00 3560 0.75 1.24 0.44 104 RCVD_IN_BL_SPAMCOP_NET 3453 0.67 1.20 0.33 105 XMStockSpam_06 3426 1.37 1.20 1.48 106 XMSubMetaI_00 3333 0.85 1.16 0.66 107 MAILING_LIST_MULTI 3326 1.97 1.16 2.47 108 BAYES_40 3090 2.82 1.08 3.91 109 XMClaimOffer 3080 0.53 1.07 0.19 110 XM_ProductURIs 3029 0.83 1.06 0.68 111 TM2_M_VERY_LONG_WORD 3010 1.00 1.05 0.96 112 XMSlimDrugH 3004 0.60 1.05 0.33 113 SUBJ_ALL_CAPS 2950 1.55 1.03 1.88 114 XM_UB60 2912 0.45 1.02 0.10 115 BOTNET_NORDNS 2841 0.40 0.99 0.03 116 XMBody_17 2811 0.71 0.98 0.54 117 XMSexyCombo_01 2807 0.65 0.98 0.45 118 TR_Symld_Words 2766 1.46 0.96 1.76 119 UNPARSEABLE_RELAY 2708 2.41 0.94 3.31 120 MPART_ALT_DIFF_COUNT 2706 0.50 0.94 0.22 121 XMPhish11 2697 1.04 0.94 1.10 122 RELAYCOUNTRY_DE 2654 0.78 0.93 0.68 123 T_Symld_Words_02 2645 0.67 0.92 0.52 124 SUBJ_DOLLARS 2619 0.45 0.91 0.16 125 XMHTML_After_End 2615 0.61 0.91 0.43 126 T_FILL_THIS_FORM_SHORT 2605 0.88 0.91 0.85 127 RCVD_IN_IADB_LISTED 2483 4.24 0.87 6.34 128 XM_HighProb1 2470 0.34 0.86 0.02 129 TR_XM_RelayPhish 2449 0.63 0.85 0.50 130 BAYES_20 2437 2.12 0.85 2.90 131 XM_BadFromFormat 2435 0.44 0.85 0.19 132 XM_UB80 2435 0.36 0.85 0.06 133 XM_H_PHPOS 2417 1.21 0.84 1.44 134 XM_H_Long_From02 2364 0.95 0.82 1.02 135 XMPhish30 2352 0.53 0.82 0.35 136 XMPhish14 2352 0.55 0.82 0.39 137 RCVD_IN_PSBL 2302 0.37 0.80 0.10 138 HTML_FONT_SIZE_HUGE 2291 0.41 0.80 0.17 139 RELAYCOUNTRY_GB 2290 0.96 0.80 1.07 140 PLING_QUERY 2290 0.56 0.80 0.41 141 XM_UB99 2193 0.38 0.76 0.13 142 XMMoneyMeta_00 2167 0.55 0.76 0.43 143 HTML_TITLE_SUBJ_DIFF 2150 0.30 0.75 0.03 144 XM_DK_Undo_01 2148 1.65 0.75 2.21 145 DKIM_ADSP_NXDOMAIN 2111 0.54 0.74 0.42 146 DKIM_ADSP_CUSTOM_MED 2105 0.92 0.73 1.03 147 XMBody_78 2083 0.50 0.73 0.36 148 REMOVE_BEFORE_LINK 2079 0.48 0.73 0.32 149 RELAYCOUNTRY_FR 2071 0.38 0.72 0.17 150 RCVD_IN_IADB_SPF 2063 3.73 0.72 5.60 151 XMGppyBdWords 2053 0.41 0.72 0.22 152 NML_ADSP_CUSTOM_MED 2010 0.69 0.70 0.68 153 RDNS_DYNAMIC 1966 0.48 0.69 0.36 154 RCVD_IN_IADB_SENDERID 1937 3.30 0.68 4.93 155 FORGED_GMAIL_RCVD 1931 0.58 0.67 0.52 156 RCVD_IN_IADB_DK 1912 3.27 0.67 4.89 157 T_TooManySym_02 1889 1.37 0.66 1.81 158 DATE_IN_PAST_03_06 1876 0.32 0.65 0.12 159 XM_PDF 1867 3.14 0.65 4.68 160 RELAYCOUNTRY_IN 1794 0.31 0.63 0.12 161 URIBL_DBL_SPAM 1777 0.26 0.62 0.03 162 XMHTMLBadTable_001 1767 0.45 0.62 0.35 163 TR_LOTS_OF_MONEY2 1706 0.37 0.60 0.24 164 T_MONEY_PERCENT 1706 0.37 0.60 0.24 165 XM_Body_Obfu01 1705 0.36 0.59 0.22 166 XMBrknScrpt_02 1704 0.59 0.59 0.58 167 XM_B_REG_HTML 1696 0.54 0.59 0.51 168 URI_NOVOWEL 1685 0.48 0.59 0.42 169 XMSubMetaSSx_00 1662 0.33 0.58 0.18 170 HTML_FONT_SIZE_LARGE 1657 0.37 0.58 0.24 171 RELAYCOUNTRY_CN 1656 0.25 0.58 0.05 172 XM_XX_Yahoo 1639 0.30 0.57 0.14 173 RCVD_IN_IADB_VOUCHED 1637 2.67 0.57 3.97 174 XM_UB999 1625 0.25 0.57 0.06 175 RCVD_IN_MSPIKE_WL 1620 1.48 0.57 2.05 176 RCVD_IN_MSPIKE_H3 1604 1.48 0.56 2.05 177 XM_RXBody 1583 0.31 0.55 0.15 178 FILL_THIS_FORM 1554 0.50 0.54 0.47 179 HTML_FONT_FACE_BAD 1540 0.51 0.54 0.49 180 XM_H_PHPMailer 1462 0.61 0.51 0.67 181 T_FILL_THIS_FORM_LONG 1431 0.43 0.50 0.39 182 HTML_TEXT_INVISIBLE_STYLE 1407 0.20 0.49 0.01 183 HTML_TAG_BALANCE_BODY 1378 0.48 0.48 0.49 184 TR_Mismatch_TLD_02 1378 0.24 0.48 0.08 185 RELAYCOUNTRY_AT 1378 0.34 0.48 0.26 186 HTTPS_HTTP_MISMATCH 1377 0.56 0.48 0.62 187 LONG_HEX_URI 1358 0.28 0.47 0.16 188 XM_Combo_Sbj 1348 0.34 0.47 0.26 189 BAYES_00 1295 6.49 0.45 10.25 190 HTML_IMAGE_ONLY_08 1291 0.25 0.45 0.12 191 XMSubMetaI_01 1286 0.19 0.45 0.03 192 T_HTML_TAG_BALANCE_CENTER 1245 0.24 0.43 0.12 193 RELAYCOUNTRY_AU 1185 0.49 0.41 0.53 194 FROM_ADDR_WS 1180 0.16 0.41 0.00 195 URIBL_ABUSE_SURBL 1177 0.19 0.41 0.06 196 FVGT_m_MULTI_ODD_EMAIL 1177 0.19 0.41 0.06 197 XMSubGiftCard1 1172 0.22 0.41 0.10 198 TR_MetaPhish_Combo_01 1146 1.11 0.40 1.56 199 XMSexyCombo_04 1120 0.21 0.39 0.10 200 RCVD_IN_IADB_OPTIN 1113 1.66 0.39 2.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 393324 90.02 97.45 85.39 2 DKIM_SIGNED 336316 66.43 55.85 73.02 3 XM_DK_Pass 329645 64.84 54.03 71.57 4 DKIM_VALID 310283 61.23 51.39 67.37 5 DCC_CHECK_NEGATIVE 285668 53.97 41.04 62.02 6 BAYES_50 262765 55.91 54.07 57.05 7 XMListUnsubscribeExists 221526 48.04 47.94 48.10 8 DKIM_VALID_AU 216065 44.57 40.82 46.91 9 DCC_CHECK 165382 44.39 58.02 35.91 10 XM_H_QuotedFrom 162207 36.35 38.16 35.22 11 T_TM2_M_HEADER_IN_MSG 141885 24.33 13.93 30.80 12 HTML_FONT_LOW_CONTRAST 121058 25.88 25.23 26.28 13 DKIM_VALID_EF 117412 21.88 16.07 25.49 14 XMSubLong 99525 20.35 18.34 21.61 15 FVGT_m_MULTI_ODD 97372 20.79 20.22 21.14 16 LOC_TINY_FONT_1 91581 21.35 23.71 19.88 17 MultiRelay 88539 15.68 9.98 19.22 18 MIME_HTML_ONLY 86107 22.76 29.28 18.69 19 ALL_TRUSTED 81461 13.11 5.75 17.69 20 T_KAM_HTML_FONT_INVALID 75950 15.35 13.51 16.49 21 XM_DKIMWhitelistDomains 62713 8.41 0.04 13.62 22 XM_DK_Undo_02 54670 18.00 27.85 11.87 23 XM_Body_Dirty_Words 49804 11.74 13.24 10.81 24 XM_Multi_Part_URI 49626 11.88 13.65 10.77 25 BAYES_99 49607 15.96 24.30 10.77 26 BAYES_00 47192 6.49 0.45 10.25 27 LOTS_OF_MONEY 43176 10.82 13.14 9.37 28 LotsOfNums_01 42856 7.41 4.37 9.30 29 BAYES_999 41859 13.44 20.43 9.09 30 RCVD_IN_RP_SAFE 41083 6.84 3.50 8.92 31 RCVD_IN_RP_CERTIFIED 39771 6.42 2.87 8.63 32 TooManyTo_001 37165 6.76 4.65 8.07 33 T_XMDrugObfuBody_14 36998 7.81 7.45 8.03 34 XM_Evil_Numbers_Gen 36291 8.85 10.41 7.88 35 MIME_QP_LONG_LINE 34766 5.35 1.83 7.55 36 HTML_IMAGE_RATIO_02 33863 8.61 10.64 7.35 37 TR_XM_DK_Bayes 31987 4.39 0.29 6.94 38 BAYES_60 30132 6.79 7.20 6.54 39 TR_XM_DK_Bayes1 29435 4.04 0.26 6.39 40 FSL_BULK_SIG 29407 8.99 13.18 6.38 41 RCVD_IN_IADB_LISTED 29201 4.24 0.87 6.34 42 T_TooManySym_01 28267 4.69 2.37 6.14 43 TR_DCC_Bayes_99 26790 11.17 19.78 5.82 44 DKIM_INVALID 26033 5.20 4.47 5.65 45 HTML_IMAGE_RATIO_04 25911 5.82 6.12 5.63 46 XM_H_Long_From01 25869 5.63 5.64 5.62 47 RCVD_IN_IADB_SPF 25791 3.73 0.72 5.60 48 TR_XM_DK_Bayes2 25149 3.45 0.22 5.46 49 XM_B_Phish_Phrases 24993 5.92 6.71 5.43 50 XM_SendGrid 24923 4.24 2.36 5.41 51 RELAYCOUNTRY_META 24260 7.04 9.89 5.27 52 RCVD_IN_IADB_SENDERID 22702 3.30 0.68 4.93 53 RCVD_IN_MSPIKE_H2 22571 3.80 2.04 4.90 54 BOTNET_IPINHOSTNAME 22544 6.42 8.87 4.89 55 RCVD_IN_IADB_DK 22505 3.27 0.67 4.89 56 T_REMOTE_IMAGE 21625 6.65 9.78 4.69 57 XM_PDF 21566 3.14 0.65 4.68 58 IN_ZIMBRA_NJ_WHITELIST 18990 2.55 0.02 4.12 59 BAYES_80 18643 5.52 7.89 4.05 60 RCVD_IN_IADB_VOUCHED 18305 2.67 0.57 3.97 61 XMStrtUSub 18216 3.39 2.49 3.95 62 BAYES_40 17991 2.82 1.08 3.91 63 XMSubMetaSx_00 17722 4.28 4.97 3.85 64 XMNumbers 17436 4.27 5.06 3.79 65 XM_UncommonTLD01 16140 4.11 5.09 3.50 66 TR_XM_DocInvoice 15898 4.23 5.48 3.45 67 XMSexyCombo_05 15494 5.14 7.99 3.36 68 UNPARSEABLE_RELAY 15266 2.41 0.94 3.31 69 FROM_EXCESS_BASE64 15086 6.80 12.46 3.28 70 ANY_BOUNCE_MESSAGE 13917 11.10 24.07 3.02 71 BOUNCE_MESSAGE 13916 11.10 24.07 3.02 72 HTML_IMAGE_RATIO_06 13776 3.03 3.10 2.99 73 BAYES_20 13370 2.12 0.85 2.90 74 TVD_RCVD_IP 13185 1.87 0.28 2.86 75 TO_MALFORMED 12602 1.71 0.06 2.74 76 BAYES_95 12225 3.09 3.80 2.65 77 MAILING_LIST_MULTI 11375 1.97 1.16 2.47 78 RCVD_IN_IADB_OPTIN 11276 1.66 0.39 2.45 79 HTML_MIME_NO_HTML_TAG 10988 5.21 9.75 2.39 80 TooManyTo_002 10882 1.60 0.37 2.36 81 MPART_ALT_DIFF 10509 3.38 5.14 2.28 82 TM2_M_URI_OPT_OUT 10454 2.50 2.88 2.27 83 XM_DK_Undo_01 10183 1.65 0.75 2.21 84 XM_SPF_SoftFail 10047 2.37 2.67 2.18 85 HTML_IMAGE_RATIO_08 9907 2.37 2.73 2.15 86 RCVD_IN_MSPIKE_WL 9427 1.48 0.57 2.05 87 RCVD_IN_MSPIKE_H3 9420 1.48 0.56 2.05 88 MIME_HTML_MOSTLY 9198 2.28 2.73 2.00 89 XM_DIRTYINTL 9022 2.31 2.86 1.96 90 XMDiploma_00 9007 1.85 1.69 1.96 91 HELO_NODOT 8946 1.29 0.23 1.94 92 BAYES_05 8673 1.30 0.35 1.88 93 SUBJ_ALL_CAPS 8644 1.55 1.03 1.88 94 T_TooManySym_02 8343 1.37 0.66 1.81 95 TR_Symld_Words 8129 1.46 0.96 1.76 96 URI_HEX 7992 11.14 26.26 1.74 97 IN_HORDE_ADDRESS_BOOK 7949 1.08 0.04 1.73 98 T_XMDrugObfuBody_08 7652 1.82 2.07 1.66 99 XMCapTrack 7387 10.06 23.65 1.60 100 BOTNET 7346 16.10 39.41 1.59 101 TooManyTo_003 7272 1.09 0.30 1.58 102 TR_MetaPhish_Combo_01 7182 1.11 0.40 1.56 103 INVALID_MSGID 7129 1.01 0.15 1.55 104 UNTRUSTED_Relay 7058 3.20 5.88 1.53 105 XM_CamelCaseFrm001 7006 1.80 2.25 1.52 106 XMStockSpam_06 6825 1.37 1.20 1.48 107 XM_H_PHPOS 6610 1.21 0.84 1.44 108 RELAYCOUNTRY_CA 6568 1.68 2.09 1.43 109 USER_IN_DEF_DKIM_WL 6312 0.86 0.05 1.37 110 XM_OfRef6 6252 1.54 1.83 1.36 111 XM_GoogleGroups 5860 0.89 0.27 1.27 112 MIME_HTML_ONLY_MULTI 5820 1.82 2.72 1.26 113 XMGenDplmaNmb 5820 1.26 1.25 1.26 114 T_XMDrugObfuBody_00 5780 1.25 1.25 1.25 115 TooManyTo_004 5547 0.83 0.23 1.20 116 XMPhish11 5060 1.04 0.94 1.10 117 RELAYCOUNTRY_GB 4917 0.96 0.80 1.07 118 URI_TRY_3LD 4856 1.21 1.45 1.05 119 SpammyFromTLD_01 4828 1.18 1.39 1.05 120 DKIM_ADSP_CUSTOM_MED 4741 0.92 0.73 1.03 121 XM_H_Long_From02 4709 0.95 0.82 1.02 122 TooManyTo_005 4601 0.69 0.19 1.00 123 TM2_M_VERY_LONG_WORD 4441 1.00 1.05 0.96 124 T_FILL_THIS_FORM_SHORT 3935 0.88 0.91 0.85 125 XMBdyGiftCard01 3700 1.07 1.50 0.80 126 XM_UB50 3699 1.48 2.58 0.80 127 XMSolicitRefs_0 3683 0.61 0.30 0.80 128 MISSING_HEADERS 3589 5.47 13.00 0.78 129 DIET_1 3410 1.21 1.97 0.74 130 RELAYCOUNTRY_DE 3151 0.78 0.93 0.68 131 XM_ProductURIs 3150 0.83 1.06 0.68 132 NML_ADSP_CUSTOM_MED 3117 0.69 0.70 0.68 133 XMLngstWrd_00 3096 0.55 0.35 0.67 134 XM_H_PHPMailer 3080 0.61 0.51 0.67 135 XMSubMetaI_00 3053 0.85 1.16 0.66 136 TM2_M_A_HREF_HREF 2911 2.56 5.66 0.63 137 XMLngstWrd_01 2861 0.50 0.30 0.62 138 T_TooManySym_03 2844 0.44 0.15 0.62 139 HTTPS_HTTP_MISMATCH 2835 0.56 0.48 0.62 140 XMBrknScrpt_02 2691 0.59 0.59 0.58 141 T_FROM_GOV_SPOOF 2638 0.43 0.21 0.57 142 T_OBFU_PDF_ATTACH 2613 0.41 0.15 0.57 143 XMNoVowels 2570 0.47 0.34 0.56 144 USER_IN_WHITELIST 2533 0.34 0.00 0.55 145 XMSubNoVowel 2485 0.40 0.17 0.54 146 XMBody_17 2481 0.71 0.98 0.54 147 AC_DIV_BONANZA 2476 0.39 0.15 0.54 148 RELAYCOUNTRY_AU 2462 0.49 0.41 0.53 149 XMBody_95 2460 0.37 0.11 0.53 150 XM_S_JOY_D 2441 2.48 5.62 0.53 151 T_Symld_Words_02 2398 0.67 0.92 0.52 152 FORGED_GMAIL_RCVD 2393 0.58 0.67 0.52 153 XM_B_REG_HTML 2336 0.54 0.59 0.51 154 SHORT_HELO_AND_INLINE_IMAGE 2302 0.33 0.05 0.50 155 TR_XM_RelayPhish 2296 0.63 0.85 0.50 156 HTML_FONT_FACE_BAD 2272 0.51 0.54 0.49 157 HTML_TAG_BALANCE_BODY 2240 0.48 0.48 0.49 158 XMSubMetaSxObfu_02 2201 0.37 0.20 0.48 159 T_FROM_GOV_DKIM_AU 2201 0.32 0.08 0.48 160 FILL_THIS_FORM 2148 0.50 0.54 0.47 161 XMSubMetaSxObfu_03 2117 0.42 0.37 0.46 162 XMDateMe_00 2116 0.39 0.28 0.46 163 T_MANY_PILL_PRICE 2112 0.29 0.03 0.46 164 XMGappySubj_01 2090 0.36 0.22 0.45 165 RCVD_IN_SORBS_DUL 2065 0.33 0.15 0.45 166 XMSexyCombo_01 2053 0.65 0.98 0.45 167 T_XMHurry_00 2019 0.75 1.24 0.44 168 XM_H_Trusted_IP 2010 0.27 0.00 0.44 169 HTML_IMAGE_ONLY_32 1978 0.36 0.25 0.43 170 TM2_M_BODY_EMPTY 1969 0.30 0.09 0.43 171 XMMoneyMeta_00 1961 0.55 0.76 0.43 172 XMHTML_After_End 1960 0.61 0.91 0.43 173 HTML_IMAGE_ONLY_28 1926 0.37 0.30 0.42 174 DKIM_ADSP_NXDOMAIN 1916 0.54 0.74 0.42 175 XM_ShortIntro_01 1914 0.39 0.34 0.42 176 URI_NOVOWEL 1912 0.48 0.59 0.42 177 PLING_QUERY 1910 0.56 0.80 0.41 178 XM_B_COPY_HTML 1864 0.39 0.37 0.40 179 TR_LOTS_OF_MONEY3 1798 2.39 5.61 0.39 180 XMPhish14 1789 0.55 0.82 0.39 181 T_FILL_THIS_FORM_LONG 1783 0.43 0.50 0.39 182 XM_USANA_RCVD 1726 0.23 0.00 0.37 183 XMBody_78 1665 0.50 0.73 0.36 184 RDNS_DYNAMIC 1645 0.48 0.69 0.36 185 XM_H_PHPOS_M 1621 0.33 0.30 0.35 186 XMHTMLBadTable_001 1617 0.45 0.62 0.35 187 XMPhish30 1593 0.53 0.82 0.35 188 T_FILL_THIS_FORM_LOAN 1588 0.33 0.31 0.34 189 HTML_IMAGE_ONLY_24 1574 0.26 0.14 0.34 190 RCVD_IN_BL_SPAMCOP_NET 1542 0.67 1.20 0.33 191 NO_DNS_FOR_FROM 1521 0.33 0.34 0.33 192 XMOemUri 1517 0.29 0.22 0.33 193 SpammyFromTLD_02 1501 1.11 2.36 0.33 194 XMSlimDrugH 1497 0.60 1.05 0.33 195 REMOVE_BEFORE_LINK 1492 0.48 0.73 0.32 196 HTML_IMAGE_ONLY_20 1469 0.25 0.15 0.32 197 XM_D_tchamptons_WL 1449 0.20 0.01 0.31 198 XMLngstWrd_02 1426 0.28 0.23 0.31 199 HTML_IMAGE_ONLY_16 1392 0.24 0.14 0.30 200 XMSubEmpty 1372 0.22 0.10 0.30 ----------------------------------------------------------------------