Email: 615957 Autolearn: 0 AvgScore: 2.48 AvgScanTime: 1.91 sec Spam: 155511 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 2.29 sec Ham: 460446 Autolearn: 0 AvgScore: -0.98 AvgScanTime: 1.79 sec Time Spent Running SA: 327.61 hours Time Spent Processing Spam: 99.11 hours Time Spent Processing Ham: 228.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146586 89.75 94.26 88.23 2 DCC_CHECK 124312 48.90 79.94 38.41 3 DKIM_SIGNED 123786 75.67 79.60 74.34 4 XM_DK_Pass 120574 74.10 77.53 72.95 5 DKIM_VALID 114513 70.42 73.64 69.34 6 XMListUnsubscribeExists 111186 55.76 71.50 50.45 7 DKIM_VALID_AU 92308 52.48 59.36 50.15 8 XM_H_QuotedFrom 78869 41.26 50.72 38.07 9 XM_DK_Undo_02 70391 22.02 45.26 14.17 10 BAYES_99 62780 19.62 40.37 12.61 11 HTML_FONT_LOW_CONTRAST 58466 29.75 37.60 27.10 12 BAYES_50 58232 48.93 37.45 52.81 13 LOC_TINY_FONT_1 54775 24.81 35.22 21.29 14 MIME_HTML_ONLY 53056 24.17 34.12 20.81 15 BAYES_999 52635 16.84 33.85 11.10 16 TR_DCC_Bayes_99 50143 12.75 32.24 6.17 17 XMSubLong 41717 23.18 26.83 21.95 18 FVGT_m_MULTI_ODD 41282 21.94 26.55 20.39 19 DKIM_VALID_EF 36987 26.29 23.78 27.14 20 RELAYCOUNTRY_META 36833 9.66 23.69 4.92 21 T_KAM_HTML_FONT_INVALID 30514 17.21 19.62 16.39 22 XM_Body_Dirty_Words 29698 13.36 19.10 11.43 23 BOTNET 29408 6.16 18.91 1.86 24 T_TM2_M_HEADER_IN_MSG 28660 28.08 18.43 31.35 25 DCC_CHECK_NEGATIVE 28413 49.06 18.27 59.45 26 MultiRelay 25620 18.23 16.47 18.82 27 BOTNET_IPINHOSTNAME 24710 8.07 15.89 5.43 28 XM_Multi_Part_URI 24011 12.51 15.44 11.51 29 FSL_BULK_SIG 23104 8.46 14.86 6.30 30 HTML_IMAGE_RATIO_02 22195 9.21 14.27 7.50 31 XM_Evil_Numbers_Gen 20618 9.86 13.26 8.72 32 UNTRUSTED_Relay 19886 4.16 12.79 1.24 33 LOTS_OF_MONEY 18392 8.58 11.83 7.49 34 XMSexyCombo_05 17938 5.34 11.53 3.25 35 XM_UncommonTLD01 16586 5.09 10.67 3.21 36 XM_salutation2 15714 4.27 10.10 2.30 37 T_XMDrugObfuBody_14 14542 8.35 9.35 8.01 38 XMSubMetaSx_00 13607 4.95 8.75 3.67 39 XM_UB50 12755 2.60 8.20 0.71 40 TooManyTo_001 12323 8.41 7.92 8.57 41 XM_H_Long_From01 11562 6.82 7.43 6.61 42 XM_B_Phish_Phrases 11221 5.56 7.22 4.99 43 HTML_IMAGE_RATIO_04 11042 5.66 7.10 5.18 44 BAYES_80 10948 4.50 7.04 3.64 45 MPART_ALT_DIFF 10487 4.17 6.74 3.29 46 LotsOfNums_01 9765 8.37 6.28 9.08 47 HTML_IMAGE_RATIO_06 9350 4.03 6.01 3.36 48 DKIM_INVALID 9273 5.24 5.96 5.00 49 BAYES_60 8855 5.95 5.69 6.03 50 XM_DIRTYINTL 7809 2.82 5.02 2.08 51 FROM_EXCESS_BASE64 7715 4.43 4.96 4.25 52 RELAYCOUNTRY_CA 6858 2.22 4.41 1.48 53 BAYES_95 6656 2.90 4.28 2.43 54 DKIM_ADSP_NXDOMAIN 6567 1.37 4.22 0.40 55 XM_SendGrid 6392 5.72 4.11 6.26 56 RELAYCOUNTRY_GB 6248 1.72 4.02 0.95 57 MIME_HTML_MOSTLY 6243 2.66 4.01 2.20 58 FROM_SUSPICIOUS_NTLD 6025 1.01 3.87 0.05 59 XMStrtUSub 5943 4.21 3.82 4.35 60 XM_SPF_SoftFail 5764 2.68 3.71 2.33 61 XMNumbers 5714 2.95 3.67 2.70 62 URI_HEX 5691 2.17 3.66 1.67 63 TM2_M_URI_OPT_OUT 5605 2.28 3.60 1.83 64 XM_OfRef6 5600 1.87 3.60 1.28 65 XM_CamelCaseFrm001 5537 2.34 3.56 1.93 66 HTML_MIME_NO_HTML_TAG 5497 3.08 3.53 2.92 67 RELAYCOUNTRY_FR 5479 1.05 3.52 0.21 68 T_REMOTE_IMAGE 5438 4.09 3.50 4.30 69 MIME_HTML_ONLY_MULTI 5416 2.15 3.48 1.70 70 RELAYCOUNTRY_DE 5326 1.09 3.42 0.30 71 MIME_QP_LONG_LINE 5179 5.69 3.33 6.48 72 RCVD_IN_PSBL 5071 0.84 3.26 0.02 73 HTML_IMAGE_RATIO_08 5033 2.61 3.24 2.40 74 RCVD_IN_RP_RNBL 4988 0.83 3.21 0.02 75 NUMERIC_HTTP_ADDR 4919 1.06 3.16 0.35 76 XM_URI_RBL 4882 1.12 3.14 0.44 77 RCVD_IN_RP_SAFE 4699 8.68 3.02 10.59 78 MultiRelay_CC 4660 0.88 3.00 0.16 79 MultiRelay_Combo 4660 0.88 3.00 0.16 80 XMHTML_After_End 4531 1.07 2.91 0.45 81 RCVD_IN_MSPIKE_H2 4394 4.24 2.83 4.71 82 T_TooManySym_01 4353 4.63 2.80 5.25 83 NORMAL_HTTP_TO_IP 4295 0.74 2.76 0.05 84 SpammyFromTLD_02 4290 0.95 2.76 0.34 85 MIME_HEADER_CTYPE_ONLY 4243 0.79 2.73 0.14 86 BOTNET_NORDNS 4217 0.70 2.71 0.02 87 RCVD_IN_BL_SPAMCOP_NET 4191 0.99 2.69 0.42 88 XMDiploma_00 4028 1.88 2.59 1.65 89 HTML_FONT_SIZE_LARGE 3871 0.78 2.49 0.20 90 XMBdyGiftCard01 3765 1.34 2.42 0.97 91 RCVD_IN_RP_CERTIFIED 3667 7.79 2.36 9.62 92 HDRS_LCASE_IMGONLY 3371 0.58 2.17 0.05 93 RCVD_IN_IADB_LISTED 3219 5.45 2.07 6.60 94 T_XMDrugObfuBody_08 3175 1.65 2.04 1.52 95 INVALID_MSGID 3147 1.70 2.02 1.59 96 XMMoneyMeta_00 3121 0.95 2.01 0.60 97 NO_DNS_FOR_FROM 3104 1.39 2.00 1.18 98 SUBJ_ALL_CAPS 3054 1.72 1.96 1.63 99 NORDNS_LOW_CONTRAST 3031 0.50 1.95 0.01 100 XMGenDplmaNmb 2849 1.31 1.83 1.14 101 BAYES_40 2835 3.78 1.82 4.44 102 HTML_IMAGE_ONLY_12 2801 0.64 1.80 0.24 103 XMPhish11 2732 1.39 1.76 1.26 104 RCVD_IN_IADB_SPF 2706 4.81 1.74 5.85 105 XMSubMetaI_00 2684 1.25 1.73 1.09 106 SpammyFromTLD_01 2679 0.93 1.72 0.66 107 XMSexyCombo_01 2675 0.83 1.72 0.54 108 TR_XM_PHPForged 2643 2.17 1.70 2.33 109 XMStockSpam_06 2639 1.00 1.70 0.77 110 ALL_TRUSTED 2627 12.83 1.69 16.59 111 XM_H_Long_From02 2622 1.12 1.69 0.93 112 XM_H_PHPOS 2605 2.16 1.68 2.32 113 TR_XM_RelayPhish 2565 0.80 1.65 0.51 114 HTML_SHORT_LINK_IMG_1 2561 0.43 1.65 0.03 115 RCVD_IN_IADB_SENDERID 2511 4.30 1.61 5.21 116 MAILING_LIST_MULTI 2498 2.31 1.61 2.54 117 RCVD_IN_IADB_DK 2464 4.25 1.58 5.15 118 RELAYCOUNTRY_AU 2448 0.77 1.57 0.50 119 TM2_M_VERY_LONG_WORD 2443 1.05 1.57 0.88 120 FILL_THIS_FORM 2408 0.68 1.55 0.39 121 XMBody_17 2407 0.74 1.55 0.47 122 FILL_THIS_FORM_LONG 2268 0.56 1.46 0.26 123 XM_UB99 2248 0.38 1.45 0.03 124 XM_UB60 2242 0.42 1.44 0.07 125 UNPARSEABLE_RELAY 2179 2.84 1.40 3.33 126 BAYES_20 2157 2.81 1.39 3.29 127 T_HTML_TAG_BALANCE_CENTER 2134 0.52 1.37 0.23 128 TR_Symld_Words 2099 1.51 1.35 1.57 129 T_Symld_Words_02 2061 0.75 1.33 0.56 130 XM_DK_Undo_01 2040 1.72 1.31 1.86 131 RCVD_IN_IADB_VOUCHED 1908 3.24 1.23 3.92 132 XMPhish30 1879 0.71 1.21 0.54 133 T_XMDrugObfuBody_00 1879 0.95 1.21 0.87 134 URIBL_SBL_A 1876 0.32 1.21 0.02 135 DIET_1 1871 0.58 1.20 0.38 136 XM_Doc_Oz_Body 1863 0.38 1.20 0.10 137 DRUGS_ERECTILE 1830 0.30 1.18 0.01 138 T_XMHurry_00 1821 0.99 1.17 0.93 139 URI_TRY_3LD 1819 1.23 1.17 1.25 140 FILL_THIS_FORM_LOAN 1757 0.48 1.13 0.26 141 XMHTMLBadTable_001 1734 0.64 1.12 0.48 142 XMBody_78 1721 0.64 1.11 0.49 143 XM_UB999 1715 0.29 1.10 0.02 144 DATE_IN_PAST_06_12 1700 0.30 1.09 0.04 145 URI_NOVOWEL 1693 0.59 1.09 0.42 146 XMSubMetaSxObfu_03 1680 0.60 1.08 0.44 147 XM_OfRef7 1668 0.38 1.07 0.14 148 XM_H_Undi_Recip 1650 0.48 1.06 0.28 149 XM_H_TOP 1624 0.27 1.04 0.00 150 XMBrknScrpt_02 1623 0.77 1.04 0.67 151 TR_LOTS_OF_MONEY2 1613 0.51 1.04 0.33 152 T_MONEY_PERCENT 1613 0.51 1.04 0.33 153 HTTPS_HTTP_MISMATCH 1585 0.75 1.02 0.66 154 TR_M_TOP_BAYES 1548 0.25 1.00 0.00 155 XM_HighProb1 1546 0.27 0.99 0.02 156 URIBL_BLACK 1531 0.29 0.98 0.05 157 XM_H_PHPMailer 1514 0.65 0.97 0.54 158 TR_XM_PHPDW 1493 0.47 0.96 0.31 159 T_FILL_THIS_FORM_SHORT 1478 0.84 0.95 0.80 160 BAYES_00 1473 9.55 0.95 12.46 161 TR_XM_FormFill2 1466 0.47 0.94 0.30 162 TR_XM_DK_SendGrid 1450 1.37 0.93 1.52 163 TR_Mismatch_TLD_02 1428 0.32 0.92 0.12 164 SUBJ_DOLLARS 1401 0.43 0.90 0.26 165 HTML_IMAGE_ONLY_28 1393 0.55 0.90 0.43 166 BODY_ENHANCEMENT 1391 0.25 0.89 0.03 167 SHORT_URI_3 1371 0.32 0.88 0.12 168 HTML_IMAGE_ONLY_20 1369 0.44 0.88 0.29 169 DATE_IN_PAST_03_06 1346 0.30 0.87 0.11 170 RCVD_IN_IADB_OPTIN 1326 2.09 0.85 2.51 171 XM_ProductURIs 1291 0.81 0.83 0.80 172 HTML_TAG_BALANCE_BODY 1278 0.61 0.82 0.54 173 BAYES_05 1263 1.69 0.81 1.98 174 XMSubMetaSSx_00 1254 0.32 0.81 0.15 175 HTML_SHORT_LINK_IMG_3 1243 0.27 0.80 0.09 176 HK_RANDOM_FROM 1241 0.31 0.80 0.14 177 LONG_JUNK_URI 1236 0.25 0.79 0.06 178 XM_PDF 1219 3.52 0.78 4.45 179 RELAYCOUNTRY_AT 1214 0.34 0.78 0.19 180 HTML_FONT_FACE_BAD 1210 0.59 0.78 0.52 181 RELAYCOUNTRY_IN 1181 0.28 0.76 0.11 182 XMPhish14 1180 0.56 0.76 0.49 183 TR_LOTS_OF_MONEY3 1162 0.38 0.75 0.25 184 DKIM_ADSP_CUSTOM_MED 1158 0.94 0.74 1.01 185 TVD_RCVD_IP 1119 2.67 0.72 3.33 186 XM_H_PHPOS_M 1113 0.35 0.72 0.23 187 URIBL_DBL_SPAM 1110 0.19 0.71 0.01 188 HK_RANDOM_REPLYTO 1100 0.36 0.71 0.24 189 XM_B_REG_HTML 1093 0.56 0.70 0.51 190 NML_ADSP_CUSTOM_MED 1084 0.69 0.70 0.68 191 XMNoVowels 1082 0.55 0.70 0.50 192 XMSlimDrugH 1081 0.43 0.70 0.35 193 TR_MetaPhish_Combo_01 1061 1.51 0.68 1.79 194 XM_B_COPY_HTML 1031 0.58 0.66 0.56 195 RELAYCOUNTRY_CN 1026 0.20 0.66 0.05 196 HTML_OFF_PAGE 1026 0.17 0.66 0.00 197 HTML_FONT_SIZE_HUGE 1024 0.23 0.66 0.08 198 TM2_M_A_HREF_HREF 1015 0.50 0.65 0.45 199 TR_XM_Undi_Recip6 1011 0.16 0.65 0.00 200 T_TooManySym_02 1000 1.52 0.64 1.81 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 406251 89.75 94.26 88.23 2 DKIM_SIGNED 342279 75.67 79.60 74.34 3 XM_DK_Pass 335880 74.10 77.53 72.95 4 DKIM_VALID 319259 70.42 73.64 69.34 5 DCC_CHECK_NEGATIVE 273748 49.06 18.27 59.45 6 BAYES_50 243143 48.93 37.45 52.81 7 XMListUnsubscribeExists 232278 55.76 71.50 50.45 8 DKIM_VALID_AU 230931 52.48 59.36 50.15 9 DCC_CHECK 176878 48.90 79.94 38.41 10 XM_H_QuotedFrom 175302 41.26 50.72 38.07 11 T_TM2_M_HEADER_IN_MSG 144329 28.08 18.43 31.35 12 DKIM_VALID_EF 124972 26.29 23.78 27.14 13 HTML_FONT_LOW_CONTRAST 124776 29.75 37.60 27.10 14 XMSubLong 101090 23.18 26.83 21.95 15 LOC_TINY_FONT_1 98050 24.81 35.22 21.29 16 MIME_HTML_ONLY 95830 24.17 34.12 20.81 17 FVGT_m_MULTI_ODD 93875 21.94 26.55 20.39 18 MultiRelay 86657 18.23 16.47 18.82 19 ALL_TRUSTED 76372 12.83 1.69 16.59 20 T_KAM_HTML_FONT_INVALID 75480 17.21 19.62 16.39 21 XM_DK_Undo_02 65252 22.02 45.26 14.17 22 XM_DKIMWhitelistDomains 59889 9.73 0.02 13.01 23 BAYES_99 58063 19.62 40.37 12.61 24 BAYES_00 57365 9.55 0.95 12.46 25 XM_Multi_Part_URI 53017 12.51 15.44 11.51 26 XM_Body_Dirty_Words 52621 13.36 19.10 11.43 27 BAYES_999 51095 16.84 33.85 11.10 28 RCVD_IN_RP_SAFE 48779 8.68 3.02 10.59 29 RCVD_IN_RP_CERTIFIED 44299 7.79 2.36 9.62 30 TR_XM_DK_Bayes 44134 7.33 0.64 9.59 31 TR_XM_DK_Bayes1 41934 6.95 0.54 9.11 32 LotsOfNums_01 41804 8.37 6.28 9.08 33 XM_Evil_Numbers_Gen 40132 9.86 13.26 8.72 34 TooManyTo_001 39466 8.41 7.92 8.57 35 T_XMDrugObfuBody_14 36888 8.35 9.35 8.01 36 TR_XM_DK_Bayes2 35890 5.93 0.41 7.79 37 HTML_IMAGE_RATIO_02 34515 9.21 14.27 7.50 38 LOTS_OF_MONEY 34484 8.58 11.83 7.49 39 XM_H_Long_From01 30447 6.82 7.43 6.61 40 RCVD_IN_IADB_LISTED 30368 5.45 2.07 6.60 41 MIME_QP_LONG_LINE 29853 5.69 3.33 6.48 42 FSL_BULK_SIG 29003 8.46 14.86 6.30 43 XM_SendGrid 28831 5.72 4.11 6.26 44 TR_DCC_Bayes_99 28418 12.75 32.24 6.17 45 BAYES_60 27774 5.95 5.69 6.03 46 RCVD_IN_IADB_SPF 26923 4.81 1.74 5.85 47 BOTNET_IPINHOSTNAME 24986 8.07 15.89 5.43 48 T_TooManySym_01 24159 4.63 2.80 5.25 49 RCVD_IN_IADB_SENDERID 23990 4.30 1.61 5.21 50 HTML_IMAGE_RATIO_04 23843 5.66 7.10 5.18 51 RCVD_IN_IADB_DK 23703 4.25 1.58 5.15 52 DKIM_INVALID 23020 5.24 5.96 5.00 53 XM_B_Phish_Phrases 22996 5.56 7.22 4.99 54 RELAYCOUNTRY_META 22668 9.66 23.69 4.92 55 RCVD_IN_MSPIKE_H2 21699 4.24 2.83 4.71 56 XM_PDF 20478 3.52 0.78 4.45 57 BAYES_40 20435 3.78 1.82 4.44 58 XMStrtUSub 20011 4.21 3.82 4.35 59 T_REMOTE_IMAGE 19784 4.09 3.50 4.30 60 FROM_EXCESS_BASE64 19570 4.43 4.96 4.25 61 IN_ZIMBRA_NJ_WHITELIST 18791 3.06 0.03 4.08 62 RCVD_IN_IADB_VOUCHED 18054 3.24 1.23 3.92 63 XMSubMetaSx_00 16882 4.95 8.75 3.67 64 BAYES_80 16776 4.50 7.04 3.64 65 HTML_IMAGE_RATIO_06 15477 4.03 6.01 3.36 66 TVD_RCVD_IP 15348 2.67 0.72 3.33 67 UNPARSEABLE_RELAY 15316 2.84 1.40 3.33 68 MPART_ALT_DIFF 15168 4.17 6.74 3.29 69 BAYES_20 15162 2.81 1.39 3.29 70 XMSexyCombo_05 14942 5.34 11.53 3.25 71 XM_UncommonTLD01 14779 5.09 10.67 3.21 72 HTML_MIME_NO_HTML_TAG 13446 3.08 3.53 2.92 73 TO_MALFORMED 13007 2.21 0.39 2.82 74 XMNumbers 12437 2.95 3.67 2.70 75 RCVD_IN_MSPIKE_WL 12148 2.10 0.50 2.64 76 RCVD_IN_MSPIKE_H3 12148 2.10 0.50 2.64 77 MAILING_LIST_MULTI 11716 2.31 1.61 2.54 78 RCVD_IN_IADB_OPTIN 11562 2.09 0.85 2.51 79 BAYES_95 11180 2.90 4.28 2.43 80 HTML_IMAGE_RATIO_08 11031 2.61 3.24 2.40 81 TooManyTo_002 10813 1.92 0.64 2.35 82 XM_SPF_SoftFail 10724 2.68 3.71 2.33 83 TR_XM_PHPForged 10713 2.17 1.70 2.33 84 XM_H_PHPOS 10682 2.16 1.68 2.32 85 XM_salutation2 10584 4.27 10.10 2.30 86 MIME_HTML_MOSTLY 10143 2.66 4.01 2.20 87 XM_DIRTYINTL 9573 2.82 5.02 2.08 88 BAYES_05 9125 1.69 0.81 1.98 89 XM_CamelCaseFrm001 8896 2.34 3.56 1.93 90 HELO_NODOT 8647 1.54 0.53 1.88 91 HELO_NO_DOMAIN 8643 1.54 0.53 1.88 92 XM_DK_Undo_01 8572 1.72 1.31 1.86 93 BOTNET 8542 6.16 18.91 1.86 94 ANY_BOUNCE_MESSAGE 8462 1.48 0.41 1.84 95 BOUNCE_MESSAGE 8461 1.48 0.41 1.84 96 TM2_M_URI_OPT_OUT 8418 2.28 3.60 1.83 97 T_TooManySym_02 8346 1.52 0.64 1.81 98 TR_MetaPhish_Combo_01 8245 1.51 0.68 1.79 99 IN_HORDE_ADDRESS_BOOK 7988 1.31 0.04 1.73 100 MIME_HTML_ONLY_MULTI 7817 2.15 3.48 1.70 101 URI_HEX 7695 2.17 3.66 1.67 102 XMDiploma_00 7575 1.88 2.59 1.65 103 SUBJ_ALL_CAPS 7518 1.72 1.96 1.63 104 INVALID_MSGID 7312 1.70 2.02 1.59 105 TR_Symld_Words 7222 1.51 1.35 1.57 106 TooManyTo_003 7201 1.30 0.50 1.56 107 T_XMDrugObfuBody_08 7003 1.65 2.04 1.52 108 TR_XM_DK_SendGrid 6984 1.37 0.93 1.52 109 RELAYCOUNTRY_CA 6804 2.22 4.41 1.48 110 XMCapTrack 6709 1.14 0.21 1.46 111 XM_GoogleGroups 6064 1.11 0.48 1.32 112 XM_OfRef6 5889 1.87 3.60 1.28 113 XMPhish11 5819 1.39 1.76 1.26 114 USER_IN_DEF_DKIM_WL 5769 0.94 0.01 1.25 115 URI_TRY_3LD 5739 1.23 1.17 1.25 116 UNTRUSTED_Relay 5709 4.16 12.79 1.24 117 NO_DNS_FOR_FROM 5430 1.39 2.00 1.18 118 XMGenDplmaNmb 5246 1.31 1.83 1.14 119 TooManyTo_004 5173 0.94 0.41 1.12 120 XMSubMetaI_00 4997 1.25 1.73 1.09 121 DKIM_ADSP_CUSTOM_MED 4656 0.94 0.74 1.01 122 XMBdyGiftCard01 4463 1.34 2.42 0.97 123 RELAYCOUNTRY_GB 4357 1.72 4.02 0.95 124 T_XMHurry_00 4296 0.99 1.17 0.93 125 TooManyTo_005 4269 0.76 0.26 0.93 126 XM_H_Long_From02 4261 1.12 1.69 0.93 127 TM2_M_VERY_LONG_WORD 4035 1.05 1.57 0.88 128 T_XMDrugObfuBody_00 3991 0.95 1.21 0.87 129 XM_ProductURIs 3685 0.81 0.83 0.80 130 T_FILL_THIS_FORM_SHORT 3670 0.84 0.95 0.80 131 XMStockSpam_06 3527 1.00 1.70 0.77 132 TO_NO_BRKTS_HTML_ONLY 3330 0.61 0.28 0.72 133 XM_UB50 3282 2.60 8.20 0.71 134 NML_ADSP_CUSTOM_MED 3138 0.69 0.70 0.68 135 XMBrknScrpt_02 3105 0.77 1.04 0.67 136 SpammyFromTLD_01 3061 0.93 1.72 0.66 137 HTTPS_HTTP_MISMATCH 3033 0.75 1.02 0.66 138 XM_ShortIntro_01 2978 0.60 0.44 0.65 139 MISSING_HEADERS 2953 0.56 0.33 0.64 140 T_TooManySym_03 2850 0.50 0.15 0.62 141 XMMoneyMeta_00 2748 0.95 2.01 0.60 142 T_OBFU_PDF_ATTACH 2745 0.50 0.20 0.60 143 SHORT_HELO_AND_INLINE_IMAGE 2689 0.45 0.05 0.58 144 XMLngstWrd_00 2661 0.51 0.31 0.58 145 XMGappySubj_01 2619 0.50 0.31 0.57 146 T_Symld_Words_02 2568 0.75 1.33 0.56 147 XM_B_COPY_HTML 2560 0.58 0.66 0.56 148 XMBody_95 2539 0.44 0.11 0.55 149 XMPhish30 2506 0.71 1.21 0.54 150 HTML_TAG_BALANCE_BODY 2491 0.61 0.82 0.54 151 XMSexyCombo_01 2466 0.83 1.72 0.54 152 XM_H_PHPMailer 2465 0.65 0.97 0.54 153 XMLngstWrd_01 2450 0.47 0.28 0.53 154 FROM_GOV_SPOOF 2432 0.44 0.16 0.53 155 HTML_FONT_FACE_BAD 2399 0.59 0.78 0.52 156 USER_IN_WHITELIST 2356 0.38 0.00 0.51 157 TR_XM_RelayPhish 2349 0.80 1.65 0.51 158 XMBody_29 2338 0.43 0.22 0.51 159 XM_B_REG_HTML 2337 0.56 0.70 0.51 160 RELAYCOUNTRY_AU 2301 0.77 1.57 0.50 161 XMNoVowels 2287 0.55 0.70 0.50 162 XMPhish14 2267 0.56 0.76 0.49 163 XMBody_78 2248 0.64 1.11 0.49 164 XMDateMe_00 2236 0.47 0.41 0.49 165 XMHTMLBadTable_001 2225 0.64 1.12 0.48 166 FORGED_GMAIL_RCVD 2210 0.50 0.57 0.48 167 XM_shorewaves_Whitelist 2178 0.35 0.00 0.47 168 XMBody_17 2176 0.74 1.55 0.47 169 XMSubMetaSxObfu_02 2127 0.41 0.26 0.46 170 XMHTML_After_End 2057 1.07 2.91 0.45 171 TM2_M_A_HREF_HREF 2055 0.50 0.65 0.45 172 XM_RXBody 2036 0.49 0.62 0.44 173 XMSubMetaSxObfu_03 2031 0.60 1.08 0.44 174 XM_URI_RBL 2030 1.12 3.14 0.44 175 HTML_IMAGE_ONLY_28 2001 0.55 0.90 0.43 176 URI_NOVOWEL 1950 0.59 1.09 0.42 177 THIS_AD 1948 0.45 0.55 0.42 178 TM2_M_BODY_EMPTY 1929 0.36 0.19 0.42 179 RCVD_IN_BL_SPAMCOP_NET 1925 0.99 2.69 0.42 180 RDNS_DYNAMIC 1890 0.45 0.57 0.41 181 AC_DIV_BONANZA 1881 0.32 0.07 0.41 182 RCVD_IN_SORBS_DUL 1874 0.37 0.26 0.41 183 DKIM_ADSP_NXDOMAIN 1857 1.37 4.22 0.40 184 HTML_IMAGE_ONLY_32 1826 0.41 0.45 0.40 185 FILL_THIS_FORM 1810 0.68 1.55 0.39 186 XMSubNoVowel 1790 0.38 0.35 0.39 187 FROM_GOV_DKIM_AU 1771 0.31 0.10 0.38 188 DIET_1 1730 0.58 1.20 0.38 189 HTML_IMAGE_ONLY_24 1712 0.37 0.35 0.37 190 NUMERIC_HTTP_ADDR 1624 1.06 3.16 0.35 191 XM_Body_Obfu01 1616 0.34 0.29 0.35 192 XMSlimDrugH 1594 0.43 0.70 0.35 193 XMSolicitRefs_0 1589 0.37 0.45 0.35 194 SpammyFromTLD_02 1583 0.95 2.76 0.34 195 FSL_THIS_IS_ADV 1550 0.38 0.49 0.34 196 T_MONEY_PERCENT 1540 0.51 1.04 0.33 197 TR_LOTS_OF_MONEY2 1540 0.51 1.04 0.33 198 XM_USANA_RCVD 1495 0.24 0.00 0.32 199 XMSubEmpty 1491 0.28 0.15 0.32 200 XMLngstWrd_02 1477 0.30 0.24 0.32 ----------------------------------------------------------------------