Email: 572738 Autolearn: 0 AvgScore: 2.80 AvgScanTime: 2.08 sec Spam: 159850 Autolearn: 0 AvgScore: 12.37 AvgScanTime: 2.46 sec Ham: 412888 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.93 sec Time Spent Running SA: 330.40 hours Time Spent Processing Spam: 109.06 hours Time Spent Processing Ham: 221.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153839 89.81 96.24 87.32 2 DKIM_SIGNED 135401 78.42 84.71 75.98 3 XM_DK_Pass 130445 76.67 81.60 74.76 4 DCC_CHECK 129692 52.29 81.13 41.12 5 DKIM_VALID 124254 73.04 77.73 71.22 6 XMListUnsubscribeExists 117549 58.30 73.54 52.40 7 DKIM_VALID_AU 102758 55.91 64.28 52.67 8 XM_DK_Undo_02 82449 26.33 51.58 16.56 9 XM_H_QuotedFrom 81111 42.57 50.74 39.40 10 BAYES_99 74911 23.74 46.86 14.79 11 BAYES_999 64086 20.62 40.09 13.09 12 TR_DCC_Bayes_99 63127 16.36 39.49 7.40 13 HTML_FONT_LOW_CONTRAST 62519 32.08 39.11 29.36 14 LOC_TINY_FONT_1 57627 27.34 36.05 23.97 15 MIME_HTML_ONLY 52284 23.68 32.71 20.19 16 BAYES_50 50643 46.92 31.68 52.82 17 FVGT_m_MULTI_ODD 45850 23.91 28.68 22.06 18 XMSubLong 43051 24.00 26.93 22.86 19 XM_Body_Dirty_Words 36688 14.92 22.95 11.81 20 DKIM_VALID_EF 36103 27.09 22.59 28.83 21 T_KAM_HTML_FONT_INVALID 32749 18.16 20.49 17.25 22 T_TM2_M_HEADER_IN_MSG 31825 27.28 19.91 30.14 23 RELAYCOUNTRY_META 28897 9.29 18.08 5.88 24 DCC_CHECK_NEGATIVE 27946 46.09 17.48 57.17 25 XM_Multi_Part_URI 26409 13.95 16.52 12.95 26 BOTNET 24081 5.72 15.06 2.11 27 HTML_IMAGE_RATIO_02 24011 10.10 15.02 8.20 28 MultiRelay 23702 16.97 14.83 17.79 29 XM_Evil_Numbers_Gen 23449 10.59 14.67 9.01 30 XMSexyCombo_05 20872 6.39 13.06 3.80 31 BOTNET_IPINHOSTNAME 20625 7.32 12.90 5.16 32 LOTS_OF_MONEY 19556 9.95 12.23 9.06 33 FSL_BULK_SIG 18909 8.49 11.83 7.20 34 HTML_IMAGE_RATIO_04 16658 6.72 10.42 5.29 35 UNTRUSTED_Relay 16331 3.97 10.22 1.56 36 XMSubMetaSx_00 15692 6.14 9.82 4.71 37 TooManyTo_001 14260 8.23 8.92 7.97 38 T_XMDrugObfuBody_14 13460 7.98 8.42 7.81 39 MPART_ALT_DIFF 13075 4.82 8.18 3.52 40 XM_H_Long_From01 12122 6.67 7.58 6.32 41 XM_B_Phish_Phrases 11752 6.74 7.35 6.51 42 LotsOfNums_01 11259 8.23 7.04 8.69 43 DKIM_INVALID 11147 5.38 6.97 4.76 44 XM_UncommonTLD01 10800 4.26 6.76 3.29 45 BAYES_80 10619 4.94 6.64 4.28 46 HTML_IMAGE_RATIO_06 9891 4.26 6.19 3.51 47 FROM_EXCESS_BASE64 9667 4.71 6.05 4.19 48 BAYES_60 9201 6.28 5.76 6.49 49 XM_DIRTYINTL 7564 2.66 4.73 1.86 50 XM_UB50 7556 1.99 4.73 0.94 51 XMStrtUSub 7387 4.33 4.62 4.22 52 MIME_HTML_MOSTLY 7082 2.97 4.43 2.40 53 XMNumbers 6701 3.26 4.19 2.90 54 RCVD_IN_RP_SAFE 6668 9.68 4.17 11.81 55 BAYES_95 6555 3.24 4.10 2.91 56 SpammyFromTLD_02 6378 1.36 3.99 0.35 57 XMSexyCombo_01 6239 1.46 3.90 0.51 58 MIME_HTML_ONLY_MULTI 6210 2.44 3.88 1.88 59 TM2_M_URI_OPT_OUT 6138 2.39 3.84 1.82 60 XM_SPF_SoftFail 6135 2.54 3.84 2.03 61 XM_SendGrid 6111 5.22 3.82 5.75 62 RELAYCOUNTRY_CA 5990 2.17 3.75 1.56 63 T_TooManySym_01 5730 5.11 3.58 5.70 64 XMBdyGiftCard01 5714 1.46 3.57 0.65 65 T_REMOTE_IMAGE 5682 3.83 3.55 3.94 66 URI_HEX 5614 2.17 3.51 1.65 67 XM_CamelCaseFrm001 5468 2.33 3.42 1.91 68 RCVD_IN_RP_RNBL 5465 0.97 3.42 0.02 69 XMStockSpam_06 4781 1.57 2.99 1.02 70 RCVD_IN_RP_CERTIFIED 4715 8.27 2.95 10.33 71 XM_URI_RBL 4690 1.29 2.93 0.65 72 HTML_IMAGE_RATIO_08 4551 2.17 2.85 1.91 73 MIME_QP_LONG_LINE 4515 4.94 2.82 5.76 74 DKIM_ADSP_NXDOMAIN 4260 1.49 2.66 1.03 75 HTML_MIME_NO_HTML_TAG 4247 2.68 2.66 2.69 76 RCVD_IN_MSPIKE_H2 4151 3.92 2.60 4.43 77 ALL_TRUSTED 4120 12.51 2.58 16.36 78 XMSubMetaI_00 3792 1.23 2.37 0.79 79 XMSexyCombo_04 3616 0.75 2.26 0.17 80 NO_DNS_FOR_FROM 3589 1.50 2.25 1.21 81 T_XMDrugObfuBody_08 3573 1.80 2.24 1.63 82 XM_OfRef6 3490 1.74 2.18 1.57 83 RCVD_IN_BL_SPAMCOP_NET 3473 1.01 2.17 0.56 84 SpammyFromTLD_01 3425 1.09 2.14 0.68 85 RELAYCOUNTRY_DE 3422 1.09 2.14 0.69 86 XMHTML_After_End 3387 0.87 2.12 0.38 87 XM_UB99 3358 0.60 2.10 0.02 88 MultiRelay_Combo 3280 0.70 2.05 0.18 89 MultiRelay_CC 3280 0.70 2.05 0.18 90 XMSolicitRefs_0 3235 0.84 2.02 0.38 91 RCVD_IN_PSBL 3212 0.56 2.01 0.00 92 XM_RXBody 3197 0.77 2.00 0.29 93 DATE_IN_PAST_06_12 3154 0.64 1.97 0.12 94 XMDiploma_00 3101 2.01 1.94 2.03 95 FROM_SUSPICIOUS_NTLD 3079 0.56 1.93 0.03 96 LOW_PRICE 3001 0.81 1.88 0.40 97 RELAYCOUNTRY_GB 2939 1.22 1.84 0.99 98 BAYES_40 2901 2.89 1.81 3.31 99 BOTNET_NORDNS 2835 0.53 1.77 0.05 100 XM_UB999 2823 0.51 1.77 0.02 101 TR_XM_RelayPhish 2782 0.94 1.74 0.63 102 XMBody_17 2749 0.86 1.72 0.52 103 FSL_THIS_IS_ADV 2723 0.52 1.70 0.07 104 MAILING_LIST_MULTI 2688 2.61 1.68 2.97 105 NUMERIC_HTTP_ADDR 2677 0.73 1.67 0.36 106 XM_salutation2 2674 0.99 1.67 0.73 107 TR_Symld_Words 2623 1.56 1.64 1.53 108 RCVD_IN_IADB_LISTED 2575 4.55 1.61 5.69 109 XMPhish11 2568 1.21 1.61 1.06 110 SUBJ_ALL_CAPS 2568 2.00 1.61 2.16 111 URI_TRY_3LD 2555 1.74 1.60 1.79 112 BOUNCE_MESSAGE 2541 1.85 1.59 1.96 113 ANY_BOUNCE_MESSAGE 2541 1.85 1.59 1.96 114 XM_UB60 2448 0.51 1.53 0.11 115 TM2_M_VERY_LONG_WORD 2401 1.06 1.50 0.89 116 UNPARSEABLE_RELAY 2401 2.58 1.50 3.00 117 XM_ProductURIs 2400 0.91 1.50 0.69 118 T_XMDrugObfuBody_00 2330 0.76 1.46 0.48 119 HTML_TAG_BALANCE_BODY 2290 0.74 1.43 0.47 120 T_XMHurry_00 2289 0.84 1.43 0.61 121 BAYES_20 2258 2.17 1.41 2.47 122 NORMAL_HTTP_TO_IP 2256 0.43 1.41 0.05 123 XM_DKIMWhitelistDomains 2165 9.89 1.35 13.19 124 RELAYCOUNTRY_FR 2164 0.55 1.35 0.24 125 T_MANY_PILL_PRICE 2119 0.40 1.33 0.04 126 RCVD_IN_IADB_SPF 2100 3.96 1.31 4.98 127 MIME_HEADER_CTYPE_ONLY 2094 0.45 1.31 0.12 128 RELAYCOUNTRY_CN 2040 0.41 1.28 0.07 129 DATE_IN_PAST_03_06 2014 0.45 1.26 0.13 130 XMBrknScrpt_02 1976 0.87 1.24 0.73 131 XM_H_Long_From02 1968 0.97 1.23 0.86 132 TR_LOTS_OF_MONEY3 1951 0.82 1.22 0.66 133 XMPhish30 1948 0.68 1.22 0.47 134 HTML_IMAGE_ONLY_28 1930 0.58 1.21 0.33 135 RCVD_IN_IADB_SENDERID 1902 3.49 1.19 4.38 136 XM_H_TOP 1899 0.33 1.19 0.00 137 T_HTML_TAG_BALANCE_CENTER 1898 0.39 1.19 0.08 138 XMGenDplmaNmb 1889 1.06 1.18 1.02 139 TR_LOTS_OF_MONEY2 1860 0.77 1.16 0.61 140 T_MONEY_PERCENT 1860 0.77 1.16 0.61 141 DIET_1 1854 0.53 1.16 0.29 142 RCVD_IN_IADB_DK 1851 3.42 1.16 4.30 143 HELO_NODOT 1836 1.27 1.15 1.31 144 XMSubMetaSxObfu_03 1830 0.64 1.14 0.44 145 XMMoneyMeta_00 1830 0.67 1.14 0.49 146 HDRS_LCASE_IMGONLY 1819 0.36 1.14 0.05 147 XMSubNoVowel 1737 0.55 1.09 0.34 148 T_HTML_ATTACH 1727 0.45 1.08 0.20 149 RELAYCOUNTRY_AT 1725 0.43 1.08 0.18 150 TR_Mismatch_TLD_02 1609 0.34 1.01 0.08 151 RCVD_IN_IADB_VOUCHED 1608 2.88 1.01 3.61 152 XM_HighProb1 1608 0.30 1.01 0.03 153 BAYES_05 1606 1.46 1.00 1.63 154 HTML_IMAGE_ONLY_24 1591 0.46 1.00 0.26 155 T_FILL_THIS_FORM_SHORT 1587 1.00 0.99 1.00 156 XM_H_Undi_Recip 1574 0.86 0.98 0.81 157 HELO_NO_DOMAIN 1572 1.21 0.98 1.30 158 TR_M_TOP_BAYES 1568 0.27 0.98 0.00 159 URIBL_BLACK 1561 0.31 0.98 0.05 160 RELAYCOUNTRY_IN 1561 0.36 0.98 0.12 161 URIBL_RHS_DOB 1526 0.30 0.95 0.05 162 MISSING_HEADERS 1513 0.61 0.95 0.48 163 DKIM_ADSP_CUSTOM_MED 1494 0.96 0.93 0.97 164 XMBody_78 1438 0.64 0.90 0.54 165 RDNS_DYNAMIC 1435 0.61 0.90 0.49 166 XMSlimDrugH 1431 0.45 0.90 0.28 167 BASE64_LENGTH_79_INF 1426 0.50 0.89 0.34 168 XM_UB80 1421 0.30 0.89 0.08 169 SUBJ_DOLLARS 1418 0.80 0.89 0.77 170 XMHTMLBadTable_001 1416 0.51 0.89 0.37 171 NML_ADSP_CUSTOM_MED 1416 0.73 0.89 0.66 172 XMPhish14 1390 0.47 0.87 0.32 173 PLING_QUERY 1379 0.62 0.86 0.53 174 HTML_FONT_SIZE_LARGE 1370 0.36 0.86 0.16 175 XM_B_REG_HTML 1360 0.62 0.85 0.53 176 URI_NOVOWEL 1343 0.63 0.84 0.55 177 XMSubEmpty 1340 0.37 0.84 0.19 178 FORGED_GMAIL_RCVD 1324 0.56 0.83 0.46 179 TO_NO_BRKTS_HTML_IMG 1317 0.28 0.82 0.07 180 LONG_JUNK_URI 1297 0.28 0.81 0.07 181 MPART_ALT_DIFF_COUNT 1281 0.40 0.80 0.24 182 BAD_ENC_HEADER 1258 0.25 0.79 0.04 183 XM_H_PHPOS 1247 0.94 0.78 1.00 184 FILL_THIS_FORM 1235 0.52 0.77 0.42 185 T_Symld_Words_02 1229 0.72 0.77 0.71 186 HTML_FONT_FACE_BAD 1199 0.64 0.75 0.60 187 XM_DK_Undo_01 1180 1.54 0.74 1.85 188 LongTLD 1162 0.32 0.73 0.17 189 RELAYCOUNTRY_AU 1145 0.54 0.72 0.48 190 TooManyTo_002 1131 1.52 0.71 1.83 191 RCVD_IN_IADB_OPTIN 1128 1.86 0.71 2.31 192 XM_Walgreens_Forge 1110 0.25 0.69 0.08 193 TR_Caps_n_Bayes_99 1107 0.31 0.69 0.17 194 T_TooManySym_02 1096 1.65 0.69 2.03 195 THIS_AD 1093 0.52 0.68 0.46 196 HTML_SHORT_LINK_IMG_1 1069 0.22 0.67 0.04 197 XMSubMetaSSx_00 1067 0.40 0.67 0.30 198 XM_PDF 1061 3.04 0.66 3.96 199 TVD_SPACE_RATIO_MINFP 1043 0.18 0.65 0.00 200 LONG_HEX_URI 1042 0.29 0.65 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 360540 89.81 96.24 87.32 2 DKIM_SIGNED 313718 78.42 84.71 75.98 3 XM_DK_Pass 308657 76.67 81.60 74.76 4 DKIM_VALID 294073 73.04 77.73 71.22 5 DCC_CHECK_NEGATIVE 236051 46.09 17.48 57.17 6 BAYES_50 218104 46.92 31.68 52.82 7 DKIM_VALID_AU 217452 55.91 64.28 52.67 8 XMListUnsubscribeExists 216353 58.30 73.54 52.40 9 DCC_CHECK 169790 52.29 81.13 41.12 10 XM_H_QuotedFrom 162687 42.57 50.74 39.40 11 T_TM2_M_HEADER_IN_MSG 124443 27.28 19.91 30.14 12 HTML_FONT_LOW_CONTRAST 121210 32.08 39.11 29.36 13 DKIM_VALID_EF 119036 27.09 22.59 28.83 14 LOC_TINY_FONT_1 98972 27.34 36.05 23.97 15 XMSubLong 94402 24.00 26.93 22.86 16 FVGT_m_MULTI_ODD 91068 23.91 28.68 22.06 17 MIME_HTML_ONLY 83356 23.68 32.71 20.19 18 MultiRelay 73470 16.97 14.83 17.79 19 T_KAM_HTML_FONT_INVALID 71234 18.16 20.49 17.25 20 XM_DK_Undo_02 68363 26.33 51.58 16.56 21 ALL_TRUSTED 67540 12.51 2.58 16.36 22 BAYES_99 61072 23.74 46.86 14.79 23 XM_DKIMWhitelistDomains 54459 9.89 1.35 13.19 24 BAYES_999 54035 20.62 40.09 13.09 25 XM_Multi_Part_URI 53485 13.95 16.52 12.95 26 RCVD_IN_RP_SAFE 48750 9.68 4.17 11.81 27 XM_Body_Dirty_Words 48743 14.92 22.95 11.81 28 BAYES_00 45224 8.04 0.53 10.95 29 RCVD_IN_RP_CERTIFIED 42641 8.27 2.95 10.33 30 LOTS_OF_MONEY 37408 9.95 12.23 9.06 31 XM_Evil_Numbers_Gen 37181 10.59 14.67 9.01 32 TR_XM_DK_Bayes 36381 6.46 0.38 8.81 33 LotsOfNums_01 35900 8.23 7.04 8.69 34 TR_XM_DK_Bayes1 34735 6.15 0.32 8.41 35 HTML_IMAGE_RATIO_02 33862 10.10 15.02 8.20 36 TooManyTo_001 32901 8.23 8.92 7.97 37 T_XMDrugObfuBody_14 32230 7.98 8.42 7.81 38 TR_XM_DK_Bayes2 30868 5.46 0.25 7.48 39 TR_DCC_Bayes_99 30573 16.36 39.49 7.40 40 FSL_BULK_SIG 29739 8.49 11.83 7.20 41 XM_B_Phish_Phrases 26862 6.74 7.35 6.51 42 BAYES_60 26789 6.28 5.76 6.49 43 XM_H_Long_From01 26102 6.67 7.58 6.32 44 RELAYCOUNTRY_META 24297 9.29 18.08 5.88 45 MIME_QP_LONG_LINE 23779 4.94 2.82 5.76 46 XM_SendGrid 23760 5.22 3.82 5.75 47 T_TooManySym_01 23550 5.11 3.58 5.70 48 RCVD_IN_IADB_LISTED 23499 4.55 1.61 5.69 49 HTML_IMAGE_RATIO_04 21823 6.72 10.42 5.29 50 BOTNET_IPINHOSTNAME 21320 7.32 12.90 5.16 51 RCVD_IN_IADB_SPF 20578 3.96 1.31 4.98 52 DKIM_INVALID 19645 5.38 6.97 4.76 53 XMSubMetaSx_00 19464 6.14 9.82 4.71 54 RCVD_IN_MSPIKE_H2 18273 3.92 2.60 4.43 55 RCVD_IN_IADB_SENDERID 18089 3.49 1.19 4.38 56 RCVD_IN_IADB_DK 17741 3.42 1.16 4.30 57 BAYES_80 17654 4.94 6.64 4.28 58 XMStrtUSub 17436 4.33 4.62 4.22 59 FROM_EXCESS_BASE64 17282 4.71 6.05 4.19 60 IN_ZIMBRA_NJ_WHITELIST 17099 2.99 0.02 4.14 61 XM_PDF 16330 3.04 0.66 3.96 62 T_REMOTE_IMAGE 16252 3.83 3.55 3.94 63 XMSexyCombo_05 15700 6.39 13.06 3.80 64 RCVD_IN_IADB_VOUCHED 14915 2.88 1.01 3.61 65 MPART_ALT_DIFF 14530 4.82 8.18 3.52 66 HTML_IMAGE_RATIO_06 14505 4.26 6.19 3.51 67 BAYES_40 13650 2.89 1.81 3.31 68 XM_UncommonTLD01 13586 4.26 6.76 3.29 69 UNPARSEABLE_RELAY 12404 2.58 1.50 3.00 70 TO_MALFORMED 12307 2.15 0.00 2.98 71 MAILING_LIST_MULTI 12261 2.61 1.68 2.97 72 BAYES_95 12018 3.24 4.10 2.91 73 XMNumbers 11958 3.26 4.19 2.90 74 TVD_RCVD_IP 11448 2.07 0.27 2.77 75 HTML_MIME_NO_HTML_TAG 11108 2.68 2.66 2.69 76 BAYES_20 10186 2.17 1.41 2.47 77 MIME_HTML_MOSTLY 9923 2.97 4.43 2.40 78 RCVD_IN_IADB_OPTIN 9553 1.86 0.71 2.31 79 SUBJ_ALL_CAPS 8912 2.00 1.61 2.16 80 BOTNET 8706 5.72 15.06 2.11 81 RCVD_IN_MSPIKE_WL 8602 1.65 0.53 2.08 82 RCVD_IN_MSPIKE_H3 8602 1.65 0.53 2.08 83 XMDiploma_00 8397 2.01 1.94 2.03 84 XM_SPF_SoftFail 8388 2.54 3.84 2.03 85 T_TooManySym_02 8374 1.65 0.69 2.03 86 ANY_BOUNCE_MESSAGE 8074 1.85 1.59 1.96 87 BOUNCE_MESSAGE 8073 1.85 1.59 1.96 88 XM_CamelCaseFrm001 7892 2.33 3.42 1.91 89 HTML_IMAGE_RATIO_08 7884 2.17 2.85 1.91 90 MIME_HTML_ONLY_MULTI 7744 2.44 3.88 1.88 91 XM_DIRTYINTL 7684 2.66 4.73 1.86 92 XM_DK_Undo_01 7643 1.54 0.74 1.85 93 TooManyTo_002 7558 1.52 0.71 1.83 94 TM2_M_URI_OPT_OUT 7529 2.39 3.84 1.82 95 IN_HORDE_ADDRESS_BOOK 7523 1.33 0.04 1.82 96 URI_TRY_3LD 7388 1.74 1.60 1.79 97 INVALID_MSGID 7244 1.42 0.54 1.75 98 URI_HEX 6828 2.17 3.51 1.65 99 T_XMDrugObfuBody_08 6742 1.80 2.24 1.63 100 BAYES_05 6739 1.46 1.00 1.63 101 TR_MetaPhish_Combo_01 6615 1.33 0.63 1.60 102 XM_OfRef6 6483 1.74 2.18 1.57 103 RELAYCOUNTRY_CA 6446 2.17 3.75 1.56 104 UNTRUSTED_Relay 6427 3.97 10.22 1.56 105 TR_Symld_Words 6335 1.56 1.64 1.53 106 USER_IN_DEF_DKIM_WL 6089 1.07 0.03 1.47 107 XM_GoogleGroups 5757 1.13 0.44 1.39 108 HELO_NODOT 5413 1.27 1.15 1.31 109 HELO_NO_DOMAIN 5352 1.21 0.98 1.30 110 NO_DNS_FOR_FROM 5001 1.50 2.25 1.21 111 TooManyTo_003 4935 1.03 0.59 1.20 112 XMPhish11 4377 1.21 1.61 1.06 113 DKIM_ADSP_NXDOMAIN 4270 1.49 2.66 1.03 114 XMNoVowels 4255 0.88 0.49 1.03 115 XMStockSpam_06 4222 1.57 2.99 1.02 116 XMGenDplmaNmb 4200 1.06 1.18 1.02 117 T_FILL_THIS_FORM_SHORT 4140 1.00 0.99 1.00 118 XM_H_PHPOS 4129 0.94 0.78 1.00 119 RELAYCOUNTRY_GB 4075 1.22 1.84 0.99 120 XMCapTrack 4069 0.79 0.27 0.99 121 DKIM_ADSP_CUSTOM_MED 3998 0.96 0.93 0.97 122 XM_UB50 3864 1.99 4.73 0.94 123 TooManyTo_004 3715 0.79 0.49 0.90 124 TM2_M_VERY_LONG_WORD 3684 1.06 1.50 0.89 125 XM_H_Long_From02 3564 0.97 1.23 0.86 126 XM_H_Undi_Recip 3346 0.86 0.98 0.81 127 XMSubMetaI_00 3264 1.23 2.37 0.79 128 SUBJ_DOLLARS 3187 0.80 0.89 0.77 129 TooManyTo_005 3104 0.66 0.43 0.75 130 XM_salutation2 3016 0.99 1.67 0.73 131 XMBrknScrpt_02 3009 0.87 1.24 0.73 132 USER_IN_WHITELIST 2929 0.51 0.00 0.71 133 T_Symld_Words_02 2920 0.72 0.77 0.71 134 RELAYCOUNTRY_DE 2835 1.09 2.14 0.69 135 XM_ProductURIs 2829 0.91 1.50 0.69 136 SpammyFromTLD_01 2818 1.09 2.14 0.68 137 RELAYCOUNTRY_NL 2788 0.63 0.51 0.68 138 NML_ADSP_CUSTOM_MED 2741 0.73 0.89 0.66 139 TR_LOTS_OF_MONEY3 2731 0.82 1.22 0.66 140 XM_URI_RBL 2692 1.29 2.93 0.65 141 XM_H_PHPMailer 2673 0.61 0.51 0.65 142 XMBdyGiftCard01 2664 1.46 3.57 0.65 143 TR_XM_RelayPhish 2615 0.94 1.74 0.63 144 T_TooManySym_03 2614 0.52 0.24 0.63 145 T_XMHurry_00 2527 0.84 1.43 0.61 146 T_MONEY_PERCENT 2522 0.77 1.16 0.61 147 TR_LOTS_OF_MONEY2 2522 0.77 1.16 0.61 148 XMBody_95 2476 0.47 0.12 0.60 149 HTML_FONT_FACE_BAD 2473 0.64 0.75 0.60 150 XM_B_COPY_HTML 2449 0.57 0.53 0.59 151 TM2_M_A_HREF_HREF 2447 0.59 0.58 0.59 152 XMLngstWrd_00 2359 0.49 0.27 0.57 153 XMLKML 2320 0.41 0.00 0.56 154 RCVD_IN_BL_SPAMCOP_NET 2301 1.01 2.17 0.56 155 FROM_GOV_DKIM_AU 2270 0.43 0.11 0.55 156 T_OBFU_PDF_ATTACH 2269 0.44 0.17 0.55 157 URI_NOVOWEL 2257 0.63 0.84 0.55 158 XMBody_78 2221 0.64 0.90 0.54 159 XMLngstWrd_01 2205 0.46 0.26 0.53 160 XM_B_REG_HTML 2204 0.62 0.85 0.53 161 PLING_QUERY 2195 0.62 0.86 0.53 162 XMBody_17 2154 0.86 1.72 0.52 163 XMSexyCombo_01 2122 1.46 3.90 0.51 164 XMGappySubj_01 2114 0.43 0.21 0.51 165 HTTPS_HTTP_MISMATCH 2111 0.51 0.51 0.51 166 AC_DIV_BONANZA 2049 0.39 0.10 0.50 167 RDNS_DYNAMIC 2031 0.61 0.90 0.49 168 XMMoneyMeta_00 2024 0.67 1.14 0.49 169 T_XMDrugObfuBody_00 1995 0.76 1.46 0.48 170 XM_ShortIntro_01 1993 0.49 0.51 0.48 171 MISSING_HEADERS 1974 0.61 0.95 0.48 172 RELAYCOUNTRY_AU 1966 0.54 0.72 0.48 173 XMPhish30 1941 0.68 1.22 0.47 174 HTML_TAG_BALANCE_BODY 1936 0.74 1.43 0.47 175 XMSubMetaSxObfu_02 1905 0.44 0.37 0.46 176 THIS_AD 1889 0.52 0.68 0.46 177 FORGED_GMAIL_RCVD 1881 0.56 0.83 0.46 178 XMSubMetaSxObfu_03 1832 0.64 1.14 0.44 179 REMOVE_BEFORE_LINK 1783 0.49 0.65 0.43 180 FILL_THIS_FORM 1727 0.52 0.77 0.42 181 HTML_IMAGE_ONLY_32 1681 0.37 0.29 0.41 182 LOW_PRICE 1659 0.81 1.88 0.40 183 FROM_GOV_SPOOF 1625 0.31 0.10 0.39 184 XMHTML_After_End 1581 0.87 2.12 0.38 185 TR_XM_Undi_Recip5 1562 0.40 0.44 0.38 186 XMSolicitRefs_0 1552 0.84 2.02 0.38 187 XMDateMe_00 1527 0.37 0.36 0.37 188 XM_shorewaves_Whitelist 1526 0.27 0.00 0.37 189 XMHTMLBadTable_001 1523 0.51 0.89 0.37 190 XM_H_Trusted_IP 1522 0.27 0.00 0.37 191 XM_USANA_RCVD 1477 0.26 0.00 0.36 192 NUMERIC_HTTP_ADDR 1476 0.73 1.67 0.36 193 FILL_THIS_FORM_LONG 1440 0.43 0.63 0.35 194 SpammyFromTLD_02 1438 1.36 3.99 0.35 195 SHORT_HELO_AND_INLINE_IMAGE 1424 0.29 0.13 0.34 196 BASE64_LENGTH_79_INF 1412 0.50 0.89 0.34 197 XMSubNoVowel 1401 0.55 1.09 0.34 198 XMBSHREFv2 1398 0.37 0.47 0.34 199 TM2_M_BODY_EMPTY 1385 0.27 0.10 0.34 200 HTML_IMAGE_ONLY_28 1377 0.58 1.21 0.33 ----------------------------------------------------------------------