Email: 736754 Autolearn: 0 AvgScore: 4.63 AvgScanTime: 3.66 sec Spam: 254586 Autolearn: 0 AvgScore: 15.48 AvgScanTime: 4.02 sec Ham: 482168 Autolearn: 0 AvgScore: -1.10 AvgScanTime: 3.48 sec Time Spent Running SA: 749.90 hours Time Spent Processing Spam: 284.15 hours Time Spent Processing Ham: 465.75 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 245638 84.50 96.49 78.17 2 BAYES_50 139305 55.13 54.72 55.35 3 DKIM_SIGNED 138728 63.52 54.49 68.28 4 DCC_CHECK 138003 41.73 54.21 35.14 5 XM_DK_Pass 134159 62.02 52.70 66.94 6 DKIM_VALID 128477 58.89 50.47 63.35 7 XMListUnsubscribeExists 117146 45.60 46.01 45.38 8 DCC_CHECK_NEGATIVE 114321 56.92 44.90 63.26 9 BOTNET 105787 15.81 41.55 2.22 10 DKIM_VALID_AU 99623 42.55 39.13 44.36 11 RCVD_IN_RP_RNBL 87844 12.16 34.50 0.36 12 XM_H_QuotedFrom 87823 32.53 34.50 31.50 13 URI_HEX 74581 11.30 29.30 1.81 14 MIME_HTML_ONLY 74468 22.43 29.25 18.83 15 ANY_BOUNCE_MESSAGE 70042 12.39 27.51 4.41 16 BOUNCE_MESSAGE 70040 12.39 27.51 4.41 17 DATE_IN_PAST_06_12 69616 9.69 27.34 0.37 18 NUMERIC_HTTP_ADDR 69292 9.48 27.22 0.11 19 XMCapTrack 69260 10.16 27.20 1.16 20 XM_DK_Undo_02 66020 15.11 25.93 9.39 21 HTML_FONT_LOW_CONTRAST 62193 24.99 24.43 25.28 22 LOC_TINY_FONT_1 61514 21.08 24.16 19.46 23 BAYES_99 59285 13.88 23.29 8.91 24 XM_URI_RBL 55774 7.78 21.91 0.32 25 URIBL_BLACK 53502 7.29 21.02 0.05 26 XMSubLong 49609 19.52 19.49 19.53 27 TR_DCC_Bayes_99 46352 9.19 18.21 4.43 28 BAYES_999 45980 10.89 18.06 7.11 29 FVGT_m_MULTI_ODD 45483 18.64 17.87 19.05 30 DKIM_VALID_EF 41850 22.38 16.44 25.52 31 FROM_EXCESS_BASE64 34919 6.96 13.72 3.39 32 T_KAM_HTML_FONT_INVALID 34855 14.12 13.69 14.35 33 T_TM2_M_HEADER_IN_MSG 34640 23.34 13.61 28.47 34 XM_Body_Dirty_Words 32533 13.15 12.78 13.35 35 XM_Multi_Part_URI 30247 11.57 11.88 11.41 36 FSL_BULK_SIG 28944 7.97 11.37 6.17 37 HTML_IMAGE_RATIO_02 28123 8.88 11.05 7.74 38 MISSING_HEADERS 27305 4.11 10.73 0.62 39 HTML_MIME_NO_HTML_TAG 26875 5.39 10.56 2.66 40 XM_UncommonTLD01 26206 5.80 10.29 3.42 41 XM_Evil_Numbers_Gen 25095 7.91 9.86 6.88 42 MultiRelay 24557 14.58 9.65 17.19 43 RELAYCOUNTRY_META 24418 6.41 9.59 4.73 44 XM_BadFromFormat 23573 3.31 9.26 0.17 45 BODY_URI_ONLY 23516 3.27 9.24 0.12 46 BOTNET_IPINHOSTNAME 23339 6.75 9.17 5.48 47 HTML_SHORT_LINK_IMG_1 23328 3.19 9.16 0.03 48 HTML_IMAGE_ONLY_08 23234 3.21 9.13 0.09 49 MIME_HEADER_CTYPE_ONLY 23207 3.25 9.12 0.15 50 LOTS_OF_MONEY 22893 9.27 8.99 9.42 51 HTML_FONT_SIZE_HUGE 22657 3.35 8.90 0.43 52 BAYES_80 21247 6.12 8.35 4.94 53 SpammyFromTLD_02 19248 2.85 7.56 0.36 54 XMSexyCombo_05 17947 4.86 7.05 3.71 55 BAYES_60 14839 6.66 5.83 7.11 56 T_XMDrugObfuBody_14 14584 6.48 5.73 6.87 57 HTML_IMAGE_RATIO_04 14533 4.98 5.71 4.59 58 UNTRUSTED_Relay 13958 2.98 5.48 1.66 59 TooManyTo_001 13686 10.34 5.38 12.97 60 XM_H_Long_From01 13328 5.26 5.24 5.27 61 XMNumbers 12939 4.37 5.08 4.00 62 MPART_ALT_DIFF 12720 3.35 5.00 2.47 63 TR_XM_DocInvoice 12691 4.19 4.98 3.77 64 XMSubMetaSx_00 12657 4.66 4.97 4.50 65 XM_B_Phish_Phrases 12606 5.12 4.95 5.21 66 BAYES_95 11274 3.52 4.43 3.05 67 HTML_IMAGE_RATIO_06 11146 3.69 4.38 3.32 68 DKIM_INVALID 10251 4.62 4.03 4.94 69 LotsOfNums_01 9989 6.78 3.92 8.29 70 XMStrtUSub 8029 3.40 3.15 3.53 71 MIME_HTML_MOSTLY 7648 2.28 3.00 1.89 72 ALL_TRUSTED 7487 16.29 2.94 23.34 73 TM2_M_URI_OPT_OUT 7341 2.10 2.88 1.68 74 MIME_HTML_ONLY_MULTI 7119 1.83 2.80 1.33 75 XM_DIRTYINTL 6900 2.05 2.71 1.71 76 XM_UB50 6466 1.70 2.54 1.25 77 XM_SendGrid 6385 4.20 2.51 5.09 78 T_TooManySym_01 6044 4.68 2.37 5.90 79 XM_SPF_SoftFail 5943 2.48 2.33 2.56 80 TR_Symld_Words 5828 1.90 2.29 1.70 81 XMSlimDrugH 5674 0.94 2.23 0.26 82 T_XMDrugObfuBody_08 5479 1.56 2.15 1.24 83 XM_CamelCaseFrm001 5446 1.73 2.14 1.51 84 TR_LOTS_OF_MONEY3 5226 1.24 2.05 0.81 85 RELAYCOUNTRY_CA 5222 1.51 2.05 1.23 86 DIET_1 5174 0.89 2.03 0.29 87 RCVD_IN_MSPIKE_H2 5166 3.73 2.03 4.63 88 T_REMOTE_IMAGE 4983 3.31 1.96 4.02 89 MIME_QP_LONG_LINE 4687 4.21 1.84 5.46 90 XM_S_JOY_D 4600 0.85 1.81 0.34 91 XM_OfRef6 4503 1.72 1.77 1.69 92 REPLYTO_WITHOUT_TO_CC 4154 0.59 1.63 0.05 93 XMDiploma_00 4142 1.45 1.63 1.36 94 RCVD_IN_RP_SAFE 4113 6.47 1.62 9.04 95 XM_H_Long_From02 4079 1.11 1.60 0.85 96 HTML_IMAGE_RATIO_08 3951 2.04 1.55 2.29 97 TR_LOTS_OF_MONEY1 3770 0.53 1.48 0.03 98 MultiRelay_Combo 3707 0.59 1.46 0.13 99 MultiRelay_CC 3707 0.59 1.46 0.13 100 RCVD_IN_BL_SPAMCOP_NET 3705 0.73 1.46 0.34 101 XM_JunkDunk 3698 0.50 1.45 0.00 102 XMMoneyMeta_00 3621 0.74 1.42 0.38 103 SUBJ_ALL_CAPS 3583 2.04 1.41 2.37 104 URI_TRY_3LD 3450 1.03 1.36 0.86 105 XMSexyCombo_01 3396 1.25 1.33 1.21 106 SpammyFromTLD_01 3394 1.23 1.33 1.17 107 RCVD_IN_RP_CERTIFIED 3231 5.91 1.27 8.36 108 XMGenDplmaNmb 3056 0.99 1.20 0.89 109 XMBdyGiftCard01 2839 1.07 1.12 1.04 110 BAYES_40 2831 2.98 1.11 3.97 111 XMBody_17 2803 0.62 1.10 0.37 112 XMGappySubj_01 2797 0.86 1.10 0.73 113 SUBJ_DOLLARS 2771 0.52 1.09 0.22 114 TM2_M_VERY_LONG_WORD 2766 0.89 1.09 0.78 115 XMStockSpam_06 2744 1.12 1.08 1.14 116 XMSubMetaI_00 2707 0.74 1.06 0.57 117 UNPARSEABLE_RELAY 2674 2.52 1.05 3.30 118 XMPhish11 2578 1.09 1.01 1.13 119 T_XMHurry_00 2499 0.71 0.98 0.57 120 T_TooManySym_02 2470 1.49 0.97 1.77 121 XMPhish30 2468 0.53 0.97 0.29 122 XMHTML_After_End 2450 0.56 0.96 0.35 123 TooManyTo_002 2424 4.88 0.95 6.95 124 BOTNET_NORDNS 2403 0.33 0.94 0.01 125 XM_ReplyTo_Bdy 2398 0.33 0.94 0.00 126 BAYES_00 2396 7.67 0.94 11.23 127 XMMoneyMeta_01 2390 0.34 0.94 0.02 128 XMSubMetaSSx_00 2377 0.52 0.93 0.30 129 TR_XM_RelayPhish 2368 1.02 0.93 1.07 130 RCVD_IN_IADB_LISTED 2313 4.15 0.91 5.87 131 MAILING_LIST_MULTI 2253 1.49 0.88 1.81 132 URIBL_DBL_SPAM 2242 0.38 0.88 0.11 133 XMGappySubj_02 2240 0.55 0.88 0.38 134 BAYES_20 2222 2.43 0.87 3.26 135 T_XMDrugObfuBody_00 2213 0.86 0.87 0.85 136 RELAYCOUNTRY_IN 2159 0.35 0.85 0.09 137 RELAYCOUNTRY_GB 2145 0.85 0.84 0.86 138 XM_H_PHPOS 2124 1.32 0.83 1.58 139 RCVD_IN_IADB_SPF 2071 3.64 0.81 5.13 140 XM_UB60 2047 0.34 0.80 0.09 141 TooManyTo_003 2042 3.72 0.80 5.27 142 T_Symld_Words_02 1975 0.59 0.78 0.49 143 RCVD_IN_IADB_SENDERID 1956 3.22 0.77 4.51 144 RELAYCOUNTRY_FR 1939 0.38 0.76 0.18 145 T_FILL_THIS_FORM_SHORT 1937 1.08 0.76 1.25 146 RCVD_IN_IADB_DK 1914 3.15 0.75 4.41 147 XMGppyBdWords 1877 0.43 0.74 0.28 148 DKIM_ADSP_NXDOMAIN 1857 0.49 0.73 0.36 149 XM_UB99 1842 0.27 0.72 0.03 150 XM_DK_Undo_01 1827 1.41 0.72 1.77 151 XM_HighProb1 1758 0.25 0.69 0.02 152 XMPhish14 1744 0.51 0.69 0.42 153 URI_NOVOWEL 1666 0.62 0.65 0.61 154 XM_PDF 1641 3.02 0.64 4.27 155 XM_ProductURIs 1634 0.74 0.64 0.79 156 XM_UB80 1632 0.24 0.64 0.02 157 T_HTML_TAG_BALANCE_CENTER 1613 0.27 0.63 0.07 158 TR_Mismatch_TLD_02 1595 0.25 0.63 0.06 159 XMSubMetaSxObfu_03 1591 0.82 0.62 0.93 160 REMOVE_BEFORE_LINK 1572 0.37 0.62 0.24 161 TR_XM_DK_Bayes 1528 5.17 0.60 7.58 162 RELAYCOUNTRY_AT 1528 0.37 0.60 0.25 163 XMBrknScrpt_02 1525 0.51 0.60 0.47 164 RELAYCOUNTRY_CN 1521 0.23 0.60 0.03 165 TooManyTo_004 1512 2.76 0.59 3.91 166 RCVD_IN_IADB_VOUCHED 1499 2.73 0.59 3.85 167 HTML_FONT_FACE_BAD 1491 0.51 0.59 0.47 168 RDNS_DYNAMIC 1486 0.44 0.58 0.36 169 BODY_ENHANCEMENT 1483 0.21 0.58 0.02 170 FILL_THIS_FORM 1455 0.64 0.57 0.68 171 MPART_ALT_DIFF_COUNT 1440 0.32 0.57 0.19 172 XMBody_78 1411 0.54 0.55 0.53 173 RELAYCOUNTRY_AU 1379 0.42 0.54 0.35 174 TR_XM_DK_Bayes1 1368 4.80 0.54 7.05 175 XM_H_PHPMailer 1359 0.58 0.53 0.60 176 HTTPS_HTTP_MISMATCH 1356 0.54 0.53 0.55 177 XMWghtMeta_00 1346 0.20 0.53 0.02 178 T_FILL_THIS_FORM_LONG 1327 0.58 0.52 0.61 179 LongTLD 1327 0.26 0.52 0.13 180 XM_B_COPY_HTML 1324 0.44 0.52 0.41 181 HTML_TAG_BALANCE_BODY 1315 0.43 0.52 0.38 182 INVALID_DATE 1305 0.22 0.51 0.07 183 RELAYCOUNTRY_DE 1289 0.72 0.51 0.83 184 TR_XM_DK_Bayes2 1265 4.06 0.50 5.93 185 XMHTMLBadTable_001 1257 0.67 0.49 0.76 186 T_MONEY_PERCENT 1257 0.30 0.49 0.20 187 TR_LOTS_OF_MONEY2 1257 0.30 0.49 0.20 188 PLING_QUERY 1245 0.43 0.49 0.40 189 URIBL_SBL_A 1245 0.34 0.49 0.26 190 DKIM_ADSP_CUSTOM_MED 1228 0.80 0.48 0.97 191 BAYES_05 1186 1.59 0.47 2.19 192 XM_UB999 1186 0.17 0.47 0.02 193 DATE_IN_PAST_03_06 1180 0.23 0.46 0.11 194 XMClaimOffer 1178 0.23 0.46 0.11 195 FVGT_m_MULTI_ODD_EMAIL 1176 0.19 0.46 0.05 196 TooManyTo_005 1176 1.95 0.46 2.74 197 T_FILL_THIS_FORM_LOAN 1174 0.41 0.46 0.38 198 RCVD_IN_MSPIKE_WL 1168 1.49 0.46 2.03 199 RCVD_IN_MSPIKE_H3 1161 1.48 0.46 2.03 200 URIBL_RHS_DOB 1153 0.91 0.45 1.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 376906 84.50 96.49 78.17 2 DKIM_SIGNED 329228 63.52 54.49 68.28 3 XM_DK_Pass 322755 62.02 52.70 66.94 4 DKIM_VALID 305431 58.89 50.47 63.35 5 DCC_CHECK_NEGATIVE 305031 56.92 44.90 63.26 6 BAYES_50 266904 55.13 54.72 55.35 7 XMListUnsubscribeExists 218799 45.60 46.01 45.38 8 DKIM_VALID_AU 213876 42.55 39.13 44.36 9 DCC_CHECK 169417 41.73 54.21 35.14 10 XM_H_QuotedFrom 151877 32.53 34.50 31.50 11 T_TM2_M_HEADER_IN_MSG 137289 23.34 13.61 28.47 12 DKIM_VALID_EF 123028 22.38 16.44 25.52 13 HTML_FONT_LOW_CONTRAST 121892 24.99 24.43 25.28 14 ALL_TRUSTED 112561 16.29 2.94 23.34 15 XMSubLong 94185 19.52 19.49 19.53 16 LOC_TINY_FONT_1 93822 21.08 24.16 19.46 17 FVGT_m_MULTI_ODD 91864 18.64 17.87 19.05 18 MIME_HTML_ONLY 90771 22.43 29.25 18.83 19 MultiRelay 82865 14.58 9.65 17.19 20 T_KAM_HTML_FONT_INVALID 69168 14.12 13.69 14.35 21 XM_Body_Dirty_Words 64373 13.15 12.78 13.35 22 XM_DKIMWhitelistDomains 63852 8.75 0.24 13.24 23 TooManyTo_001 62530 10.34 5.38 12.97 24 XM_Multi_Part_URI 55023 11.57 11.88 11.41 25 BAYES_00 54149 7.67 0.94 11.23 26 LOTS_OF_MONEY 45399 9.27 8.99 9.42 27 XM_DK_Undo_02 45279 15.11 25.93 9.39 28 RCVD_IN_RP_SAFE 43575 6.47 1.62 9.04 29 BAYES_99 42957 13.88 23.29 8.91 30 RCVD_IN_RP_CERTIFIED 40306 5.91 1.27 8.36 31 LotsOfNums_01 39952 6.78 3.92 8.29 32 HTML_IMAGE_RATIO_02 37326 8.88 11.05 7.74 33 TR_XM_DK_Bayes 36571 5.17 0.60 7.58 34 BAYES_999 34281 10.89 18.06 7.11 35 BAYES_60 34259 6.66 5.83 7.11 36 TR_XM_DK_Bayes1 33988 4.80 0.54 7.05 37 TooManyTo_002 33526 4.88 0.95 6.95 38 XM_Evil_Numbers_Gen 33191 7.91 9.86 6.88 39 T_XMDrugObfuBody_14 33123 6.48 5.73 6.87 40 FSL_BULK_SIG 29770 7.97 11.37 6.17 41 TR_XM_DK_Bayes2 28615 4.06 0.50 5.93 42 T_TooManySym_01 28446 4.68 2.37 5.90 43 RCVD_IN_IADB_LISTED 28280 4.15 0.91 5.87 44 BOTNET_IPINHOSTNAME 26419 6.75 9.17 5.48 45 MIME_QP_LONG_LINE 26334 4.21 1.84 5.46 46 TooManyTo_003 25402 3.72 0.80 5.27 47 XM_H_Long_From01 25390 5.26 5.24 5.27 48 XM_B_Phish_Phrases 25110 5.12 4.95 5.21 49 RCVD_IN_IADB_SPF 24742 3.64 0.81 5.13 50 XM_SendGrid 24553 4.20 2.51 5.09 51 BAYES_80 23838 6.12 8.35 4.94 52 DKIM_INVALID 23797 4.62 4.03 4.94 53 RELAYCOUNTRY_META 22818 6.41 9.59 4.73 54 RCVD_IN_MSPIKE_H2 22344 3.73 2.03 4.63 55 HTML_IMAGE_RATIO_04 22151 4.98 5.71 4.59 56 RCVD_IN_IADB_SENDERID 21736 3.22 0.77 4.51 57 XMSubMetaSx_00 21692 4.66 4.97 4.50 58 TR_DCC_Bayes_99 21343 9.19 18.21 4.43 59 RCVD_IN_IADB_DK 21257 3.15 0.75 4.41 60 ANY_BOUNCE_MESSAGE 21244 12.39 27.51 4.41 61 BOUNCE_MESSAGE 21241 12.39 27.51 4.41 62 XM_PDF 20575 3.02 0.64 4.27 63 T_REMOTE_IMAGE 19394 3.31 1.96 4.02 64 XMNumbers 19287 4.37 5.08 4.00 65 BAYES_40 19131 2.98 1.11 3.97 66 IN_ZIMBRA_NJ_WHITELIST 19032 2.59 0.01 3.95 67 TooManyTo_004 18859 2.76 0.59 3.91 68 RCVD_IN_IADB_VOUCHED 18581 2.73 0.59 3.85 69 TR_XM_DocInvoice 18162 4.19 4.98 3.77 70 XMSexyCombo_05 17893 4.86 7.05 3.71 71 XMStrtUSub 17005 3.40 3.15 3.53 72 TVD_RCVD_IP 16959 2.35 0.15 3.52 73 XM_UncommonTLD01 16506 5.80 10.29 3.42 74 FROM_EXCESS_BASE64 16361 6.96 13.72 3.39 75 HTML_IMAGE_RATIO_06 16005 3.69 4.38 3.32 76 UNPARSEABLE_RELAY 15921 2.52 1.05 3.30 77 BAYES_20 15696 2.43 0.87 3.26 78 BAYES_95 14689 3.52 4.43 3.05 79 TooManyTo_005 13219 1.95 0.46 2.74 80 TO_MALFORMED 12878 1.76 0.04 2.67 81 HTML_MIME_NO_HTML_TAG 12820 5.39 10.56 2.66 82 XM_SPF_SoftFail 12337 2.48 2.33 2.56 83 MPART_ALT_DIFF 11930 3.35 5.00 2.47 84 RCVD_IN_IADB_OPTIN 11787 1.75 0.44 2.44 85 SUBJ_ALL_CAPS 11428 2.04 1.41 2.37 86 HTML_IMAGE_RATIO_08 11061 2.04 1.55 2.29 87 BOTNET 10694 15.81 41.55 2.22 88 BAYES_05 10545 1.59 0.47 2.19 89 RCVD_IN_MSPIKE_WL 9795 1.49 0.46 2.03 90 RCVD_IN_MSPIKE_H3 9776 1.48 0.46 2.03 91 MIME_HTML_MOSTLY 9115 2.28 3.00 1.89 92 TR_MetaPhish_Combo_01 8924 1.34 0.38 1.85 93 MAILING_LIST_MULTI 8724 1.49 0.88 1.81 94 URI_HEX 8708 11.30 29.30 1.81 95 XM_DK_Undo_01 8555 1.41 0.72 1.77 96 T_TooManySym_02 8515 1.49 0.97 1.77 97 IN_HORDE_ADDRESS_BOOK 8410 1.15 0.04 1.74 98 XM_DIRTYINTL 8236 2.05 2.71 1.71 99 TR_Symld_Words 8179 1.90 2.29 1.70 100 XM_OfRef6 8145 1.72 1.77 1.69 101 TM2_M_URI_OPT_OUT 8103 2.10 2.88 1.68 102 UNTRUSTED_Relay 8001 2.98 5.48 1.66 103 XM_H_PHPOS 7619 1.32 0.83 1.58 104 XM_CamelCaseFrm001 7273 1.73 2.14 1.51 105 HELO_NODOT 7267 1.06 0.22 1.51 106 INVALID_MSGID 7071 1.01 0.13 1.47 107 XMDiploma_00 6569 1.45 1.63 1.36 108 MIME_HTML_ONLY_MULTI 6391 1.83 2.80 1.33 109 USER_IN_DEF_DKIM_WL 6297 0.87 0.06 1.31 110 T_FILL_THIS_FORM_SHORT 6037 1.08 0.76 1.25 111 XM_UB50 6028 1.70 2.54 1.25 112 T_XMDrugObfuBody_08 5987 1.56 2.15 1.24 113 RELAYCOUNTRY_CA 5919 1.51 2.05 1.23 114 XMSexyCombo_01 5844 1.25 1.33 1.21 115 SpammyFromTLD_01 5637 1.23 1.33 1.17 116 XMCapTrack 5591 10.16 27.20 1.16 117 URIBL_RHS_DOB 5550 0.91 0.45 1.15 118 XMStockSpam_06 5500 1.12 1.08 1.14 119 XMPhish11 5458 1.09 1.01 1.13 120 TR_XM_RelayPhish 5164 1.02 0.93 1.07 121 XMBdyGiftCard01 5035 1.07 1.12 1.04 122 XM_GoogleGroups 4960 0.77 0.29 1.03 123 DKIM_ADSP_CUSTOM_MED 4679 0.80 0.48 0.97 124 XMSubMetaSxObfu_03 4483 0.82 0.62 0.93 125 TM2_M_A_HREF_HREF 4384 0.74 0.41 0.91 126 XMGenDplmaNmb 4274 0.99 1.20 0.89 127 URI_TRY_3LD 4168 1.03 1.36 0.86 128 RELAYCOUNTRY_GB 4123 0.85 0.84 0.86 129 T_XMDrugObfuBody_00 4115 0.86 0.87 0.85 130 XM_H_Long_From02 4114 1.11 1.60 0.85 131 RELAYCOUNTRY_DE 4023 0.72 0.51 0.83 132 XM_ShortIntro_01 4017 0.68 0.38 0.83 133 TR_LOTS_OF_MONEY3 3915 1.24 2.05 0.81 134 XM_ProductURIs 3789 0.74 0.64 0.79 135 TM2_M_VERY_LONG_WORD 3760 0.89 1.09 0.78 136 XMHTMLBadTable_001 3654 0.67 0.49 0.76 137 XMGappySubj_01 3518 0.86 1.10 0.73 138 FILL_THIS_FORM 3269 0.64 0.57 0.68 139 XMBody_95 3201 0.48 0.13 0.66 140 MSGID_RANDY 3136 0.46 0.10 0.65 141 XM_H_Trusted_IP 3054 0.41 0.00 0.63 142 XM_shorewaves_Whitelist 3032 0.41 0.00 0.63 143 NML_ADSP_CUSTOM_MED 3027 0.57 0.45 0.63 144 MISSING_HEADERS 2998 4.11 10.73 0.62 145 T_FILL_THIS_FORM_LONG 2940 0.58 0.52 0.61 146 URI_NOVOWEL 2930 0.62 0.65 0.61 147 XM_H_PHPMailer 2894 0.58 0.53 0.60 148 XMLngstWrd_00 2816 0.51 0.37 0.58 149 USER_IN_WHITELIST 2788 0.38 0.00 0.58 150 T_XMHurry_00 2761 0.71 0.98 0.57 151 XMSubMetaI_00 2735 0.74 1.06 0.57 152 T_FROM_GOV_SPOOF 2652 0.43 0.19 0.55 153 XMBounce_01 2646 0.45 0.27 0.55 154 HTTPS_HTTP_MISMATCH 2634 0.54 0.53 0.55 155 XMLngstWrd_01 2620 0.47 0.34 0.54 156 TO_IN_SUBJ 2587 0.37 0.06 0.54 157 XM_D_omniadmin_Whitelist 2578 0.35 0.00 0.53 158 XMBody_78 2535 0.54 0.55 0.53 159 XM_B_REG_HTML 2514 0.40 0.16 0.52 160 T_OBFU_PDF_ATTACH 2475 0.39 0.15 0.51 161 T_Symld_Words_02 2363 0.59 0.78 0.49 162 XMSubMetaSxObfu_02 2346 0.40 0.24 0.49 163 FORGED_GMAIL_RCVD 2306 0.45 0.40 0.48 164 T_TooManySym_03 2294 0.38 0.19 0.48 165 XMBrknScrpt_02 2262 0.51 0.60 0.47 166 HTML_FONT_FACE_BAD 2248 0.51 0.59 0.47 167 XM_D_tchamptons_WL 2241 0.30 0.00 0.46 168 XMNoVowels 2228 0.41 0.31 0.46 169 T_MANY_PILL_PRICE 2121 0.30 0.03 0.44 170 HTML_FONT_SIZE_HUGE 2059 3.35 8.90 0.43 171 XMPhish14 2041 0.51 0.69 0.42 172 XM_B_COPY_HTML 1954 0.44 0.52 0.41 173 PLING_QUERY 1935 0.43 0.49 0.40 174 TM2_M_BODY_EMPTY 1898 0.29 0.10 0.39 175 XMMoneyMeta_00 1833 0.74 1.42 0.38 176 SHORT_HELO_AND_INLINE_IMAGE 1832 0.27 0.05 0.38 177 XMGappySubj_02 1824 0.55 0.88 0.38 178 HTML_TAG_BALANCE_BODY 1824 0.43 0.52 0.38 179 T_FILL_THIS_FORM_LOAN 1818 0.41 0.46 0.38 180 DATE_IN_PAST_06_12 1797 9.69 27.34 0.37 181 XMBody_17 1780 0.62 1.10 0.37 182 SpammyFromTLD_02 1753 2.85 7.56 0.36 183 RCVD_IN_RP_RNBL 1751 12.16 34.50 0.36 184 RDNS_DYNAMIC 1750 0.44 0.58 0.36 185 XMDateMe_00 1745 0.31 0.22 0.36 186 DKIM_ADSP_NXDOMAIN 1718 0.49 0.73 0.36 187 XMHTML_After_End 1711 0.56 0.96 0.35 188 XM_H_PHPOS_M 1697 0.34 0.33 0.35 189 RELAYCOUNTRY_AU 1680 0.42 0.54 0.35 190 XM_Combo_Sbj 1675 0.34 0.32 0.35 191 TVD_SPACE_RATIO 1664 0.32 0.28 0.35 192 RCVD_IN_BL_SPAMCOP_NET 1658 0.73 1.46 0.34 193 HTML_IMAGE_ONLY_32 1655 0.29 0.18 0.34 194 RCVD_IN_SORBS_DUL 1647 0.28 0.16 0.34 195 HTML_IMAGE_ONLY_24 1634 0.29 0.20 0.34 196 XM_S_JOY_D 1633 0.85 1.81 0.34 197 XM_URI_RBL 1557 7.78 21.91 0.32 198 XMRcvdHeader_15 1473 0.20 0.00 0.31 199 HTML_IMAGE_ONLY_28 1433 0.33 0.38 0.30 200 TR_MetaPhish_Combo_01b 1430 0.22 0.07 0.30 ----------------------------------------------------------------------