Email: 631667 Autolearn: 0 AvgScore: 3.00 AvgScanTime: 1.96 sec Spam: 169462 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 2.35 sec Ham: 462205 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 1.81 sec Time Spent Running SA: 343.14 hours Time Spent Processing Spam: 110.47 hours Time Spent Processing Ham: 232.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159938 90.19 94.38 88.66 2 DKIM_SIGNED 133564 73.99 78.82 72.22 3 XM_DK_Pass 128610 72.31 75.89 70.99 4 DCC_CHECK 127294 48.23 75.12 38.37 5 DKIM_VALID 122112 68.71 72.06 67.48 6 XMListUnsubscribeExists 118883 54.53 70.15 48.81 7 DKIM_VALID_AU 98540 50.79 58.15 48.09 8 XM_H_QuotedFrom 79368 41.79 46.84 39.94 9 XM_DK_Undo_02 78407 23.48 46.27 15.12 10 BAYES_99 71881 21.53 42.42 13.87 11 HTML_FONT_LOW_CONTRAST 61858 29.48 36.50 26.91 12 BAYES_999 61043 18.71 36.02 12.36 13 TR_DCC_Bayes_99 59708 14.88 35.23 7.42 14 MIME_HTML_ONLY 58511 23.76 34.53 19.81 15 BAYES_50 55007 48.03 32.46 53.74 16 LOC_TINY_FONT_1 54107 24.03 31.93 21.13 17 XMSubLong 52557 24.09 31.01 21.55 18 FVGT_m_MULTI_ODD 43283 21.63 25.54 20.19 19 DCC_CHECK_NEGATIVE 39661 49.81 23.40 59.49 20 DKIM_VALID_EF 36944 25.41 21.80 26.74 21 XM_Multi_Part_URI 36623 14.00 21.61 11.21 22 T_KAM_HTML_FONT_INVALID 31542 17.20 18.61 16.68 23 T_TM2_M_HEADER_IN_MSG 31118 27.85 18.36 31.32 24 XM_Body_Dirty_Words 30844 13.30 18.20 11.50 25 BOTNET 26412 5.48 15.59 1.77 26 RELAYCOUNTRY_META 25634 7.68 15.13 4.95 27 MultiRelay 24435 17.18 14.42 18.19 28 HTML_IMAGE_RATIO_02 22009 9.02 12.99 7.56 29 XM_Evil_Numbers_Gen 21863 9.60 12.90 8.38 30 BOTNET_IPINHOSTNAME 20545 6.72 12.12 4.74 31 LOTS_OF_MONEY 20528 9.22 12.11 8.16 32 BAYES_80 16989 5.43 10.03 3.74 33 XMSexyCombo_05 16961 4.89 10.01 3.01 34 FSL_BULK_SIG 16888 7.31 9.97 6.33 35 TooManyTo_001 15462 8.44 9.12 8.19 36 HTML_IMAGE_RATIO_04 15258 5.86 9.00 4.71 37 T_XMDrugObfuBody_14 13862 7.86 8.18 7.74 38 XM_B_Phish_Phrases 13709 6.33 8.09 5.68 39 UNTRUSTED_Relay 13651 3.05 8.06 1.22 40 XM_H_Long_From01 13118 6.78 7.74 6.42 41 XMSubMetaSx_00 12629 4.91 7.45 3.98 42 HTML_MIME_NO_HTML_TAG 12461 4.03 7.35 2.81 43 XM_UncommonTLD01 11966 4.16 7.06 3.10 44 ALL_TRUSTED 11932 16.02 7.04 19.31 45 MPART_ALT_DIFF 11662 4.12 6.88 3.11 46 DKIM_INVALID 11452 5.29 6.76 4.75 47 FROM_EXCESS_BASE64 10771 4.43 6.36 3.73 48 XM_H_PHPOS 10579 2.86 6.24 1.63 49 LotsOfNums_01 9639 7.70 5.69 8.44 50 HTML_IMAGE_RATIO_06 9154 3.50 5.40 2.81 51 MIME_HEADER_CTYPE_ONLY 9002 1.54 5.31 0.16 52 TO_NO_BRKTS_HTML_ONLY 8909 1.99 5.26 0.79 53 XM_S_SubURI 8725 1.40 5.15 0.02 54 RCVD_IN_RP_RNBL 8551 1.37 5.05 0.03 55 BAYES_95 8486 3.21 5.01 2.55 56 BAYES_60 8384 5.75 4.95 6.05 57 MIME_HTML_MOSTLY 7475 3.03 4.41 2.52 58 XM_URI_RBL 6861 1.43 4.05 0.47 59 XM_SPF_SoftFail 6503 2.44 3.84 1.92 60 URI_HEX 6459 2.11 3.81 1.49 61 RCVD_IN_PSBL 6428 1.02 3.79 0.00 62 TM2_M_URI_OPT_OUT 6417 2.31 3.79 1.76 63 XMNumbers 6332 2.93 3.74 2.63 64 XM_DIRTYINTL 6256 2.31 3.69 1.81 65 RELAYCOUNTRY_CA 6164 2.07 3.64 1.49 66 XM_SendGrid 6098 4.97 3.60 5.48 67 RCVD_IN_RP_SAFE 5937 8.66 3.50 10.55 68 XMStrtUSub 5761 4.51 3.40 4.92 69 XM_UB50 5745 1.46 3.39 0.76 70 ANY_BOUNCE_MESSAGE 5617 2.35 3.31 2.00 71 BOUNCE_MESSAGE 5617 2.35 3.31 2.00 72 MIME_QP_LONG_LINE 5586 5.44 3.30 6.22 73 MIME_HTML_ONLY_MULTI 5502 1.97 3.25 1.50 74 SpammyFromTLD_02 5480 1.16 3.23 0.40 75 XMBody_17 5353 1.20 3.16 0.48 76 XM_CamelCaseFrm001 5278 2.15 3.11 1.80 77 RCVD_IN_MSPIKE_H2 4842 4.06 2.86 4.50 78 T_REMOTE_IMAGE 4823 3.83 2.85 4.20 79 XMBdyGiftCard01 4691 1.13 2.77 0.53 80 XM_OfRef6 4467 1.68 2.64 1.33 81 MultiRelay_Combo 4247 0.78 2.51 0.15 82 MultiRelay_CC 4247 0.78 2.51 0.15 83 HTML_IMAGE_RATIO_08 4027 2.17 2.38 2.10 84 T_TooManySym_01 3977 4.23 2.35 4.93 85 RCVD_IN_RP_CERTIFIED 3763 7.20 2.22 9.02 86 XMDiploma_00 3682 1.69 2.17 1.52 87 T_XMDrugObfuBody_08 3559 1.67 2.10 1.51 88 TVD_APPROVED 3434 0.59 2.03 0.06 89 XM_Nigeria_01 3389 0.59 2.00 0.07 90 XMSexyCombo_01 3354 0.84 1.98 0.42 91 XM_H_Long_From02 3284 1.23 1.94 0.97 92 XMPhish14 3271 0.83 1.93 0.43 93 BAYES_40 3188 3.50 1.88 4.10 94 NORDNS_LOW_CONTRAST 3123 0.50 1.84 0.01 95 RCVD_IN_IADB_LISTED 3118 4.91 1.84 6.03 96 FROM_SUSPICIOUS_NTLD 3012 0.51 1.78 0.04 97 TM2_M_VERY_LONG_WORD 3005 1.10 1.77 0.85 98 RCVD_IN_BL_SPAMCOP_NET 2993 0.77 1.77 0.41 99 XM_salutation2 2982 1.04 1.76 0.77 100 MILLION_USD 2960 0.48 1.75 0.01 101 MONEY_FRAUD_8 2924 0.46 1.73 0.00 102 XM_Nigeria_02 2876 0.46 1.70 0.01 103 NO_DNS_FOR_FROM 2871 1.25 1.69 1.09 104 XMPhish11 2783 1.34 1.64 1.23 105 XMGenDplmaNmb 2749 1.08 1.62 0.88 106 XM_UB99 2742 0.45 1.62 0.03 107 MAILING_LIST_MULTI 2680 2.21 1.58 2.44 108 TR_XM_RelayPhish 2664 0.83 1.57 0.56 109 XMStockSpam_06 2649 0.89 1.56 0.65 110 UNPARSEABLE_RELAY 2587 2.38 1.53 2.69 111 RCVD_IN_IADB_SPF 2577 4.34 1.52 5.37 112 RELAYCOUNTRY_GB 2544 1.15 1.50 1.02 113 BOTNET_NORDNS 2530 0.42 1.49 0.02 114 BAYES_20 2461 2.42 1.45 2.77 115 SpammyFromTLD_01 2431 0.86 1.43 0.64 116 XMSubMetaI_00 2416 0.75 1.43 0.50 117 T_XMDrugObfuBody_00 2367 0.86 1.40 0.66 118 SUBJ_DOLLARS 2342 0.72 1.38 0.48 119 DKIM_ADSP_NXDOMAIN 2339 0.87 1.38 0.68 120 RCVD_IN_IADB_SENDERID 2325 3.86 1.37 4.77 121 RCVD_IN_IADB_DK 2282 3.81 1.35 4.71 122 SUBJ_ALL_CAPS 2253 1.55 1.33 1.64 123 URI_TRY_3LD 2151 1.21 1.27 1.18 124 RELAYCOUNTRY_DE 2133 0.60 1.26 0.36 125 XMHTML_After_End 2093 0.65 1.24 0.43 126 NUMERIC_HTTP_ADDR 2092 0.54 1.23 0.29 127 XMPhish30 2044 0.63 1.21 0.42 128 XM_H_TOP 2035 0.33 1.20 0.00 129 XM_UB999 2009 0.33 1.19 0.02 130 TVD_PH_BODY_ACCOUNTS_PRE 1951 0.41 1.15 0.14 131 XM_UB60 1929 0.36 1.14 0.08 132 XMSubMetaSxObfu_03 1922 0.58 1.13 0.38 133 T_MONEY_PERCENT 1921 0.52 1.13 0.30 134 TR_LOTS_OF_MONEY2 1921 0.52 1.13 0.30 135 TooManyTo_002 1912 1.92 1.13 2.21 136 RCVD_IN_IADB_VOUCHED 1907 3.03 1.13 3.72 137 RELAYCOUNTRY_FR 1897 0.47 1.12 0.24 138 T_XMHurry_00 1894 0.85 1.12 0.75 139 FSL_THIS_IS_ADV 1894 0.46 1.12 0.22 140 TR_Symld_Words 1852 1.40 1.09 1.51 141 XM_HighProb1 1784 0.30 1.05 0.02 142 HELO_NODOT 1739 1.43 1.03 1.58 143 T_HTML_TAG_BALANCE_CENTER 1719 0.34 1.01 0.09 144 TR_M_TOP_BAYES 1717 0.27 1.01 0.00 145 XMMoneyMeta_00 1709 0.72 1.01 0.62 146 REPLYTO_WITHOUT_TO_CC 1705 0.36 1.01 0.13 147 T_Symld_Words_02 1660 0.71 0.98 0.61 148 URIBL_BLACK 1657 0.30 0.98 0.05 149 FILL_THIS_FORM 1652 0.46 0.97 0.27 150 HELO_NO_DOMAIN 1645 1.41 0.97 1.57 151 BAYES_05 1638 1.54 0.97 1.75 152 TooManyTo_003 1603 1.33 0.95 1.47 153 RELAYCOUNTRY_IN 1598 0.34 0.94 0.12 154 DATE_IN_PAST_12_24 1591 0.29 0.94 0.05 155 DATE_IN_PAST_06_12 1578 0.27 0.93 0.03 156 RELAYCOUNTRY_CN 1550 0.29 0.91 0.06 157 XM_ProductURIs 1529 0.64 0.90 0.54 158 FILL_THIS_FORM_LONG 1525 0.38 0.90 0.18 159 XMHTMLBadTable_001 1524 0.65 0.90 0.56 160 XMBody_78 1519 0.47 0.90 0.32 161 DKIM_ADSP_CUSTOM_MED 1491 1.03 0.88 1.08 162 XM_UB80 1487 0.26 0.88 0.04 163 LONG_JUNK_URI 1471 0.28 0.87 0.06 164 XM_GoogleGroups 1450 1.13 0.86 1.23 165 RELAYCOUNTRY_AT 1449 0.33 0.86 0.14 166 DIET_1 1446 0.44 0.85 0.29 167 NML_ADSP_CUSTOM_MED 1420 0.77 0.84 0.75 168 NORMAL_HTTP_TO_IP 1388 0.27 0.82 0.06 169 XMSlimDrugH 1382 0.42 0.82 0.28 170 TooManyTo_004 1380 1.01 0.81 1.08 171 TR_Mismatch_TLD_02 1375 0.28 0.81 0.08 172 MISSING_HEADERS 1369 0.62 0.81 0.56 173 T_FILL_THIS_FORM_SHORT 1353 1.00 0.80 1.07 174 RCVD_IN_IADB_OPTIN 1329 1.96 0.78 2.39 175 FILL_THIS_FORM_LOAN 1310 0.32 0.77 0.16 176 RELAYCOUNTRY_AU 1287 0.56 0.76 0.49 177 TR_LOTS_OF_MONEY3 1279 0.57 0.75 0.50 178 FORGED_GMAIL_RCVD 1274 0.61 0.75 0.55 179 BODY_URI_ONLY 1265 0.27 0.75 0.09 180 LONG_HEX_URI 1261 0.31 0.74 0.15 181 HTML_TAG_BALANCE_BODY 1259 0.63 0.74 0.58 182 XMGppyBdWords 1246 0.34 0.74 0.20 183 TooManyTo_005 1239 0.83 0.73 0.87 184 XM_B_REG_HTML 1234 0.51 0.73 0.43 185 URI_NOVOWEL 1230 0.57 0.73 0.51 186 THIS_AD 1230 0.54 0.73 0.47 187 XM_PDF 1212 3.94 0.72 5.12 188 XMSubMetaSSx_00 1196 0.38 0.71 0.26 189 XMClaimOffer 1183 0.34 0.70 0.21 190 XM_B_COPY_HTML 1180 0.54 0.70 0.48 191 SHORT_URI_3 1175 0.22 0.69 0.04 192 XM_BadFromFormat 1148 0.26 0.68 0.10 193 RDNS_DYNAMIC 1110 0.55 0.66 0.51 194 BAYES_00 1110 8.28 0.66 11.07 195 XM_DK_Undo_01 1094 1.42 0.65 1.70 196 MPART_ALT_DIFF_COUNT 1094 0.33 0.65 0.21 197 HTML_FONT_FACE_BAD 1091 0.54 0.64 0.50 198 REMOVE_BEFORE_LINK 1089 0.42 0.64 0.33 199 XM_H_PHPMailer 1084 0.59 0.64 0.57 200 HTTPS_HTTP_MISMATCH 1084 0.60 0.64 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 409778 90.19 94.38 88.66 2 DKIM_SIGNED 333809 73.99 78.82 72.22 3 XM_DK_Pass 328126 72.31 75.89 70.99 4 DKIM_VALID 311876 68.71 72.06 67.48 5 DCC_CHECK_NEGATIVE 274983 49.81 23.40 59.49 6 BAYES_50 248406 48.03 32.46 53.74 7 XMListUnsubscribeExists 225583 54.53 70.15 48.81 8 DKIM_VALID_AU 222286 50.79 58.15 48.09 9 XM_H_QuotedFrom 184624 41.79 46.84 39.94 10 DCC_CHECK 177330 48.23 75.12 38.37 11 T_TM2_M_HEADER_IN_MSG 144773 27.85 18.36 31.32 12 HTML_FONT_LOW_CONTRAST 124358 29.48 36.50 26.91 13 DKIM_VALID_EF 123571 25.41 21.80 26.74 14 XMSubLong 99615 24.09 31.01 21.55 15 LOC_TINY_FONT_1 97665 24.03 31.93 21.13 16 FVGT_m_MULTI_ODD 93341 21.63 25.54 20.19 17 MIME_HTML_ONLY 91568 23.76 34.53 19.81 18 ALL_TRUSTED 89245 16.02 7.04 19.31 19 MultiRelay 84087 17.18 14.42 18.19 20 T_KAM_HTML_FONT_INVALID 77098 17.20 18.61 16.68 21 XM_DK_Undo_02 69905 23.48 46.27 15.12 22 BAYES_99 64091 21.53 42.42 13.87 23 BAYES_999 57128 18.71 36.02 12.36 24 XM_DKIMWhitelistDomains 56824 9.03 0.13 12.29 25 XM_Body_Dirty_Words 53140 13.30 18.20 11.50 26 XM_Multi_Part_URI 51822 14.00 21.61 11.21 27 BAYES_00 51181 8.28 0.66 11.07 28 RCVD_IN_RP_SAFE 48745 8.66 3.50 10.55 29 RCVD_IN_RP_CERTIFIED 41711 7.20 2.22 9.02 30 TR_XM_DK_Bayes 39085 6.27 0.32 8.46 31 LotsOfNums_01 39023 7.70 5.69 8.44 32 XM_Evil_Numbers_Gen 38750 9.60 12.90 8.38 33 TooManyTo_001 37872 8.44 9.12 8.19 34 LOTS_OF_MONEY 37734 9.22 12.11 8.16 35 TR_XM_DK_Bayes1 37080 5.94 0.26 8.02 36 T_XMDrugObfuBody_14 35784 7.86 8.18 7.74 37 HTML_IMAGE_RATIO_02 34956 9.02 12.99 7.56 38 TR_DCC_Bayes_99 34293 14.88 35.23 7.42 39 TR_XM_DK_Bayes2 31675 5.07 0.21 6.85 40 XM_H_Long_From01 29681 6.78 7.74 6.42 41 FSL_BULK_SIG 29271 7.31 9.97 6.33 42 MIME_QP_LONG_LINE 28752 5.44 3.30 6.22 43 BAYES_60 27962 5.75 4.95 6.05 44 RCVD_IN_IADB_LISTED 27890 4.91 1.84 6.03 45 XM_B_Phish_Phrases 26246 6.33 8.09 5.68 46 XM_SendGrid 25312 4.97 3.60 5.48 47 RCVD_IN_IADB_SPF 24818 4.34 1.52 5.37 48 XM_PDF 23688 3.94 0.72 5.12 49 RELAYCOUNTRY_META 22861 7.68 15.13 4.95 50 T_TooManySym_01 22766 4.23 2.35 4.93 51 XMStrtUSub 22738 4.51 3.40 4.92 52 RCVD_IN_IADB_SENDERID 22059 3.86 1.37 4.77 53 DKIM_INVALID 21933 5.29 6.76 4.75 54 BOTNET_IPINHOSTNAME 21896 6.72 12.12 4.74 55 HTML_IMAGE_RATIO_04 21783 5.86 9.00 4.71 56 RCVD_IN_IADB_DK 21757 3.81 1.35 4.71 57 RCVD_IN_MSPIKE_H2 20814 4.06 2.86 4.50 58 T_REMOTE_IMAGE 19395 3.83 2.85 4.20 59 BAYES_40 18947 3.50 1.88 4.10 60 XMSubMetaSx_00 18386 4.91 7.45 3.98 61 IN_ZIMBRA_NJ_WHITELIST 18242 2.89 0.02 3.95 62 BAYES_80 17309 5.43 10.03 3.74 63 FROM_EXCESS_BASE64 17243 4.43 6.36 3.73 64 RCVD_IN_IADB_VOUCHED 17203 3.03 1.13 3.72 65 MPART_ALT_DIFF 14362 4.12 6.88 3.11 66 XM_UncommonTLD01 14318 4.16 7.06 3.10 67 XMSexyCombo_05 13901 4.89 10.01 3.01 68 HTML_MIME_NO_HTML_TAG 13002 4.03 7.35 2.81 69 HTML_IMAGE_RATIO_06 12983 3.50 5.40 2.81 70 BAYES_20 12805 2.42 1.45 2.77 71 UNPARSEABLE_RELAY 12423 2.38 1.53 2.69 72 TO_MALFORMED 12191 1.93 0.00 2.64 73 XMNumbers 12175 2.93 3.74 2.63 74 BAYES_95 11773 3.21 5.01 2.55 75 MIME_HTML_MOSTLY 11655 3.03 4.41 2.52 76 MAILING_LIST_MULTI 11263 2.21 1.58 2.44 77 RCVD_IN_IADB_OPTIN 11059 1.96 0.78 2.39 78 TVD_RCVD_IP 10709 1.78 0.30 2.32 79 TooManyTo_002 10203 1.92 1.13 2.21 80 HTML_IMAGE_RATIO_08 9697 2.17 2.38 2.10 81 ANY_BOUNCE_MESSAGE 9224 2.35 3.31 2.00 82 BOUNCE_MESSAGE 9222 2.35 3.31 2.00 83 RCVD_IN_MSPIKE_H3 9169 1.57 0.42 1.98 84 RCVD_IN_MSPIKE_WL 9169 1.57 0.42 1.98 85 XM_SPF_SoftFail 8879 2.44 3.84 1.92 86 XM_DIRTYINTL 8360 2.31 3.69 1.81 87 XM_CamelCaseFrm001 8300 2.15 3.11 1.80 88 BOTNET 8196 5.48 15.59 1.77 89 TM2_M_URI_OPT_OUT 8154 2.31 3.79 1.76 90 BAYES_05 8097 1.54 0.97 1.75 91 IN_HORDE_ADDRESS_BOOK 7937 1.27 0.04 1.72 92 XM_DK_Undo_01 7859 1.42 0.65 1.70 93 SUBJ_ALL_CAPS 7562 1.55 1.33 1.64 94 XM_H_PHPOS 7515 2.86 6.24 1.63 95 T_TooManySym_02 7513 1.36 0.63 1.63 96 HELO_NODOT 7290 1.43 1.03 1.58 97 TR_MetaPhish_Combo_01 7279 1.31 0.59 1.57 98 HELO_NO_DOMAIN 7258 1.41 0.97 1.57 99 XMCapTrack 7200 1.20 0.23 1.56 100 INVALID_MSGID 7152 1.20 0.24 1.55 101 XMDiploma_00 7008 1.69 2.17 1.52 102 T_XMDrugObfuBody_08 6973 1.67 2.10 1.51 103 TR_Symld_Words 6968 1.40 1.09 1.51 104 MIME_HTML_ONLY_MULTI 6949 1.97 3.25 1.50 105 RELAYCOUNTRY_CA 6894 2.07 3.64 1.49 106 URI_HEX 6871 2.11 3.81 1.49 107 TooManyTo_003 6772 1.33 0.95 1.47 108 XM_OfRef6 6132 1.68 2.64 1.33 109 XM_GoogleGroups 5677 1.13 0.86 1.23 110 XMPhish11 5666 1.34 1.64 1.23 111 UNTRUSTED_Relay 5627 3.05 8.06 1.22 112 URI_TRY_3LD 5472 1.21 1.27 1.18 113 USER_IN_DEF_DKIM_WL 5439 0.86 0.01 1.18 114 NO_DNS_FOR_FROM 5038 1.25 1.69 1.09 115 DKIM_ADSP_CUSTOM_MED 5001 1.03 0.88 1.08 116 TooManyTo_004 4971 1.01 0.81 1.08 117 T_FILL_THIS_FORM_SHORT 4962 1.00 0.80 1.07 118 RELAYCOUNTRY_GB 4708 1.15 1.50 1.02 119 XM_H_Long_From02 4462 1.23 1.94 0.97 120 XMGenDplmaNmb 4089 1.08 1.62 0.88 121 TooManyTo_005 4029 0.83 0.73 0.87 122 TM2_M_VERY_LONG_WORD 3920 1.10 1.77 0.85 123 TO_NO_BRKTS_HTML_ONLY 3639 1.99 5.26 0.79 124 XM_salutation2 3562 1.04 1.76 0.77 125 FROM_GOV_SPOOF 3559 0.62 0.21 0.77 126 XM_UB50 3504 1.46 3.39 0.76 127 NML_ADSP_CUSTOM_MED 3472 0.77 0.84 0.75 128 T_XMHurry_00 3457 0.85 1.12 0.75 129 DKIM_ADSP_NXDOMAIN 3151 0.87 1.38 0.68 130 T_XMDrugObfuBody_00 3073 0.86 1.40 0.66 131 XMBrknScrpt_02 3034 0.65 0.64 0.66 132 XMStockSpam_06 2986 0.89 1.56 0.65 133 SpammyFromTLD_01 2977 0.86 1.43 0.64 134 T_OBFU_PDF_ATTACH 2966 0.51 0.16 0.64 135 XMMoneyMeta_00 2844 0.72 1.01 0.62 136 XM_H_Undi_Recip 2830 0.60 0.58 0.61 137 T_Symld_Words_02 2797 0.71 0.98 0.61 138 HTTPS_HTTP_MISMATCH 2733 0.60 0.64 0.59 139 HTML_TAG_BALANCE_BODY 2699 0.63 0.74 0.58 140 XMBody_95 2691 0.45 0.10 0.58 141 XMNoVowels 2647 0.55 0.48 0.57 142 XM_ShortIntro_01 2641 0.57 0.55 0.57 143 XM_H_PHPMailer 2624 0.59 0.64 0.57 144 USER_IN_WHITELIST 2614 0.41 0.00 0.57 145 TR_XM_RelayPhish 2581 0.83 1.57 0.56 146 XMHTMLBadTable_001 2569 0.65 0.90 0.56 147 MISSING_HEADERS 2567 0.62 0.81 0.56 148 FORGED_GMAIL_RCVD 2558 0.61 0.75 0.55 149 XM_ProductURIs 2517 0.64 0.90 0.54 150 PLING_QUERY 2511 0.56 0.61 0.54 151 XMBdyGiftCard01 2433 1.13 2.77 0.53 152 T_TooManySym_03 2403 0.42 0.15 0.52 153 RDNS_DYNAMIC 2363 0.55 0.66 0.51 154 XMLngstWrd_00 2362 0.49 0.42 0.51 155 URI_NOVOWEL 2344 0.57 0.73 0.51 156 TR_LOTS_OF_MONEY3 2324 0.57 0.75 0.50 157 XMGappySubj_01 2320 0.48 0.43 0.50 158 XMSubMetaI_00 2317 0.75 1.43 0.50 159 HTML_FONT_FACE_BAD 2310 0.54 0.64 0.50 160 RELAYCOUNTRY_AU 2278 0.56 0.76 0.49 161 XMBody_17 2239 1.20 3.16 0.48 162 XM_B_COPY_HTML 2221 0.54 0.70 0.48 163 XMLngstWrd_01 2217 0.46 0.40 0.48 164 SUBJ_DOLLARS 2210 0.72 1.38 0.48 165 XM_URI_RBL 2184 1.43 4.05 0.47 166 THIS_AD 2165 0.54 0.73 0.47 167 TM2_M_A_HREF_HREF 2159 0.47 0.49 0.47 168 SHORT_HELO_AND_INLINE_IMAGE 2142 0.38 0.16 0.46 169 XMDateMe_00 2046 0.48 0.58 0.44 170 XMSubMetaSxObfu_02 2019 0.42 0.36 0.44 171 XMHTML_After_End 1990 0.65 1.24 0.43 172 XM_B_REG_HTML 1980 0.51 0.73 0.43 173 XMPhish14 1977 0.83 1.93 0.43 174 XMSexyCombo_01 1964 0.84 1.98 0.42 175 XMPhish30 1920 0.63 1.21 0.42 176 TM2_M_BODY_EMPTY 1895 0.33 0.10 0.41 177 HTML_IMAGE_ONLY_32 1892 0.37 0.26 0.41 178 RCVD_IN_BL_SPAMCOP_NET 1872 0.77 1.77 0.41 179 SpammyFromTLD_02 1855 1.16 3.23 0.40 180 AC_DIV_BONANZA 1738 0.31 0.12 0.38 181 XMSubMetaSxObfu_03 1736 0.58 1.13 0.38 182 HTML_IMAGE_ONLY_28 1735 0.44 0.63 0.38 183 FROM_GOV_DKIM_AU 1726 0.33 0.20 0.37 184 XMSolicitRefs_0 1667 0.34 0.28 0.36 185 RELAYCOUNTRY_DE 1661 0.60 1.26 0.36 186 RCVD_IN_SORBS_DUL 1638 0.33 0.26 0.35 187 XM_USANA_RCVD 1610 0.25 0.00 0.35 188 XMSubNoVowel 1558 0.39 0.55 0.34 189 REMOVE_BEFORE_LINK 1538 0.42 0.64 0.33 190 HTML_IMAGE_ONLY_24 1525 0.35 0.41 0.33 191 XMBody_78 1480 0.47 0.90 0.32 192 HTML_IMAGE_ONLY_20 1453 0.33 0.37 0.31 193 XM_Body_Obfu01 1423 0.33 0.38 0.31 194 XM_H_PHPOS_M 1413 0.34 0.44 0.31 195 T_MONEY_PERCENT 1391 0.52 1.13 0.30 196 TR_LOTS_OF_MONEY2 1391 0.52 1.13 0.30 197 TVD_SPACE_RATIO 1334 0.28 0.24 0.29 198 DIET_1 1333 0.44 0.85 0.29 199 NUMERIC_HTTP_ADDR 1332 0.54 1.23 0.29 200 BASE64_LENGTH_79_INF 1300 0.24 0.14 0.28 ----------------------------------------------------------------------