Email: 562857 Autolearn: 0 AvgScore: 2.19 AvgScanTime: 1.99 sec Spam: 134200 Autolearn: 0 AvgScore: 12.11 AvgScanTime: 2.39 sec Ham: 428657 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 1.87 sec Time Spent Running SA: 311.82 hours Time Spent Processing Spam: 89.28 hours Time Spent Processing Ham: 222.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126607 88.76 94.34 87.01 2 DKIM_SIGNED 113174 76.79 84.33 74.43 3 XM_DK_Pass 110268 75.11 82.17 72.90 4 DKIM_VALID 104510 71.30 77.88 69.25 5 DCC_CHECK 103408 46.74 77.06 37.25 6 XMListUnsubscribeExists 100926 55.03 75.21 48.72 7 DKIM_VALID_AU 84188 53.89 62.73 51.13 8 XM_H_QuotedFrom 67385 39.29 50.21 35.87 9 XM_DK_Undo_02 66874 22.93 49.83 14.51 10 BAYES_99 57601 20.13 42.92 13.00 11 HTML_FONT_LOW_CONTRAST 52139 29.72 38.85 26.86 12 BAYES_999 48353 17.43 36.03 11.61 13 LOC_TINY_FONT_1 46459 24.99 34.62 21.98 14 TR_DCC_Bayes_99 44785 12.48 33.37 5.94 15 BAYES_50 43503 46.86 32.42 51.38 16 MIME_HTML_ONLY 42675 22.57 31.80 19.68 17 FVGT_m_MULTI_ODD 39272 22.69 29.26 20.64 18 XMSubLong 36065 23.67 26.87 22.67 19 DKIM_VALID_EF 30378 26.52 22.64 27.74 20 XM_Body_Dirty_Words 29438 15.63 21.94 13.66 21 T_KAM_HTML_FONT_INVALID 28945 17.10 21.57 15.70 22 DCC_CHECK_NEGATIVE 28561 51.24 21.28 60.63 23 T_TM2_M_HEADER_IN_MSG 26976 29.60 20.10 32.58 24 RELAYCOUNTRY_META 24024 8.04 17.90 4.95 25 BOTNET 23196 5.60 17.28 1.94 26 MultiRelay 22423 19.05 16.71 19.78 27 BOTNET_IPINHOSTNAME 21898 8.26 16.32 5.74 28 XM_Multi_Part_URI 20990 12.22 15.64 11.15 29 HTML_IMAGE_RATIO_02 20765 9.69 15.47 7.88 30 XM_Evil_Numbers_Gen 17828 9.84 13.28 8.76 31 LOTS_OF_MONEY 16176 8.98 12.05 8.01 32 FSL_BULK_SIG 15193 7.68 11.32 6.54 33 UNTRUSTED_Relay 14764 3.55 11.00 1.22 34 XMSexyCombo_05 14208 5.81 10.59 4.31 35 T_XMDrugObfuBody_14 11512 8.40 8.58 8.35 36 HTML_IMAGE_RATIO_04 11229 6.21 8.37 5.54 37 XM_UncommonTLD01 10937 4.45 8.15 3.29 38 XMSubMetaSx_00 10544 5.13 7.86 4.27 39 MPART_ALT_DIFF 10367 4.28 7.73 3.21 40 XM_B_Phish_Phrases 10244 6.21 7.63 5.77 41 BAYES_80 9987 4.59 7.44 3.70 42 TooManyTo_001 9947 8.88 7.41 9.33 43 XM_H_Long_From01 9915 6.18 7.39 5.81 44 LotsOfNums_01 9516 8.23 7.09 8.58 45 DKIM_INVALID 8664 5.49 6.46 5.18 46 XM_DIRTYINTL 8472 3.33 6.31 2.40 47 BAYES_60 8235 6.02 6.14 5.99 48 HTML_IMAGE_RATIO_06 7026 4.00 5.24 3.62 49 FROM_EXCESS_BASE64 6723 4.54 5.01 4.39 50 MIME_HTML_MOSTLY 6310 2.91 4.70 2.34 51 XM_SendGrid 6281 5.97 4.68 6.37 52 XMStrtUSub 5732 4.41 4.27 4.45 53 XM_UB50 5525 1.51 4.12 0.70 54 HTML_MIME_NO_HTML_TAG 5491 2.82 4.09 2.42 55 BAYES_95 5475 2.83 4.08 2.44 56 XM_CamelCaseFrm001 5352 2.25 3.99 1.70 57 RELAYCOUNTRY_CA 5294 2.07 3.94 1.48 58 XM_SPF_SoftFail 5267 2.72 3.92 2.35 59 TM2_M_URI_OPT_OUT 5239 2.27 3.90 1.76 60 RELAYCOUNTRY_FR 5200 1.12 3.87 0.25 61 URI_HEX 5133 2.17 3.82 1.65 62 RCVD_IN_RP_SAFE 5056 8.52 3.77 10.01 63 MIME_HTML_ONLY_MULTI 4718 1.89 3.52 1.38 64 XMNumbers 4639 2.99 3.46 2.85 65 HTML_IMAGE_RATIO_08 4619 2.57 3.44 2.30 66 DKIM_ADSP_NXDOMAIN 4591 1.20 3.42 0.50 67 T_REMOTE_IMAGE 4581 4.03 3.41 4.22 68 SpammyFromTLD_02 4580 0.99 3.41 0.23 69 T_TooManySym_01 4511 5.24 3.36 5.83 70 MIME_QP_LONG_LINE 4372 5.17 3.26 5.77 71 XMDiploma_00 4280 2.20 3.19 1.89 72 RCVD_IN_RP_CERTIFIED 4101 7.64 3.06 9.07 73 RCVD_IN_BL_SPAMCOP_NET 4054 1.05 3.02 0.43 74 XM_URI_RBL 3845 1.04 2.87 0.46 75 XM_OfRef6 3751 1.77 2.80 1.45 76 NO_DNS_FOR_FROM 3663 1.52 2.73 1.15 77 RCVD_IN_MSPIKE_H2 3609 4.15 2.69 4.60 78 TR_XM_PHPDW 3544 1.46 2.64 1.09 79 TR_XM_PHPForged 3514 1.43 2.62 1.06 80 TR_XM_FormFill2 3498 1.42 2.61 1.05 81 XM_H_PHPOS 3470 1.41 2.59 1.04 82 XMSubMetaI_00 3446 1.42 2.57 1.06 83 SUBJ_ALL_CAPS 3378 1.99 2.52 1.83 84 T_XMDrugObfuBody_08 3131 1.60 2.33 1.38 85 XMBdyGiftCard01 3123 1.44 2.33 1.17 86 RCVD_IN_RP_RNBL 3104 0.58 2.31 0.04 87 XMSexyCombo_01 2980 1.49 2.22 1.27 88 ALL_TRUSTED 2939 13.16 2.19 16.59 89 TR_XM_DK_SendGrid 2785 2.91 2.08 3.17 90 BAYES_00 2759 10.80 2.06 13.54 91 XMGenDplmaNmb 2744 1.41 2.04 1.22 92 MultiRelay_Combo 2663 0.61 1.98 0.18 93 MultiRelay_CC 2663 0.61 1.98 0.18 94 PDS_TO_EQ_FROM_NAME 2608 0.48 1.94 0.02 95 T_XMDrugObfuBody_00 2572 0.95 1.92 0.64 96 FROM_SUSPICIOUS_NTLD 2549 0.48 1.90 0.03 97 XMHTMLBadTable_001 2549 0.77 1.90 0.41 98 XMBody_17 2535 0.91 1.89 0.61 99 RCVD_IN_IADB_LISTED 2501 4.35 1.86 5.13 100 BAYES_40 2500 3.71 1.86 4.29 101 BAYES_20 2481 2.91 1.85 3.24 102 BOTNET_NORDNS 2463 0.46 1.84 0.02 103 T_XMHurry_00 2456 0.95 1.83 0.67 104 XM_ProductURIs 2445 1.01 1.82 0.76 105 TM2_M_VERY_LONG_WORD 2417 1.21 1.80 1.03 106 XM_UB99 2390 0.43 1.78 0.01 107 MAILING_LIST_MULTI 2336 2.27 1.74 2.43 108 TR_XM_RelayPhish 2180 0.98 1.62 0.78 109 HK_RANDOM_REPLYTO 2162 0.53 1.61 0.19 110 RCVD_IN_IADB_SPF 2069 3.82 1.54 4.54 111 TR_MetaPhish_Combo_01 2053 1.96 1.53 2.09 112 XMStockSpam_06 2039 1.63 1.52 1.66 113 XMHTML_After_End 2011 0.65 1.50 0.39 114 UNPARSEABLE_RELAY 2004 2.99 1.49 3.45 115 SpammyFromTLD_01 1997 0.87 1.49 0.67 116 XM_UB999 1959 0.35 1.46 0.01 117 DIET_1 1924 0.61 1.43 0.35 118 RCVD_IN_IADB_SENDERID 1905 3.39 1.42 4.00 119 RCVD_IN_IADB_DK 1873 3.32 1.40 3.93 120 XM_UB60 1858 0.39 1.38 0.08 121 XM_B_REG_HTML 1825 0.66 1.36 0.44 122 XM_H_TOP 1793 0.32 1.34 0.00 123 T_Symld_Words_02 1788 0.80 1.33 0.63 124 XM_H_Long_From02 1781 1.03 1.33 0.94 125 URI_TRY_3LD 1774 1.18 1.32 1.14 126 XMBody_78 1773 0.57 1.32 0.33 127 XM_H_PHPMailer 1768 0.80 1.32 0.64 128 XMPhish11 1759 1.30 1.31 1.30 129 TR_Symld_Words 1747 1.54 1.30 1.62 130 HK_RANDOM_ENVFROM 1744 0.42 1.30 0.14 131 RELAYCOUNTRY_AT 1690 0.45 1.26 0.20 132 XMPhish30 1685 0.69 1.26 0.51 133 XMBrknScrpt_02 1673 0.85 1.25 0.72 134 T_MONEY_PERCENT 1652 0.52 1.23 0.29 135 TR_LOTS_OF_MONEY2 1652 0.52 1.23 0.29 136 RCVD_IN_IADB_VOUCHED 1641 2.74 1.22 3.22 137 FILL_THIS_FORM 1641 0.62 1.22 0.43 138 DATE_IN_PAST_03_06 1632 0.36 1.22 0.09 139 MPART_ALT_DIFF_COUNT 1601 0.52 1.19 0.31 140 URIBL_BLACK 1573 0.32 1.17 0.06 141 XM_RXBody 1573 0.88 1.17 0.78 142 FILL_THIS_FORM_LONG 1544 0.53 1.15 0.33 143 RELAYCOUNTRY_IN 1504 0.33 1.12 0.09 144 TR_Mismatch_TLD_02 1499 0.32 1.12 0.08 145 T_FILL_THIS_FORM_SHORT 1490 1.17 1.11 1.18 146 XMSubMetaSxObfu_03 1488 0.53 1.11 0.35 147 TR_LOTS_OF_MONEY3 1487 0.44 1.11 0.23 148 RELAYCOUNTRY_GB 1413 1.03 1.05 1.03 149 XM_UB80 1413 0.27 1.05 0.03 150 XMSlimDrugH 1409 0.48 1.05 0.30 151 HTML_FONT_FACE_BAD 1384 0.66 1.03 0.55 152 BAYES_05 1383 1.83 1.03 2.08 153 NUMERIC_HTTP_ADDR 1372 0.50 1.02 0.34 154 XMMoneyMeta_00 1358 0.67 1.01 0.57 155 XM_HighProb1 1355 0.25 1.01 0.01 156 PLING_QUERY 1324 0.74 0.99 0.66 157 HTML_TAG_BALANCE_BODY 1303 0.58 0.97 0.46 158 XM_DK_Undo_01 1265 1.69 0.94 1.92 159 XM_H_PHPOS_M 1248 0.40 0.93 0.24 160 XM_Lotto 1241 0.27 0.92 0.07 161 HTML_IMAGE_ONLY_28 1227 0.59 0.91 0.49 162 FILL_THIS_FORM_LOAN 1224 0.47 0.91 0.33 163 RDNS_DYNAMIC 1218 0.50 0.91 0.37 164 URIBL_DBL_SPAM 1210 0.22 0.90 0.01 165 T_TooManySym_02 1187 1.66 0.88 1.91 166 XMPhish14 1171 0.50 0.87 0.38 167 XM_PDF 1149 4.12 0.86 5.15 168 DKIM_ADSP_CUSTOM_MED 1142 0.96 0.85 1.00 169 XMSexyCombo_04 1139 0.67 0.85 0.61 170 HELO_NODOT 1106 1.70 0.82 1.98 171 HELO_NO_DOMAIN 1097 1.70 0.82 1.98 172 NML_ADSP_CUSTOM_MED 1079 0.75 0.80 0.73 173 HTTPS_HTTP_MISMATCH 1078 0.68 0.80 0.64 174 RCVD_IN_IADB_OPTIN 1073 1.74 0.80 2.04 175 XMGppyBdWords 1059 0.31 0.79 0.16 176 LONG_JUNK_URI 1059 0.24 0.79 0.06 177 URI_NOVOWEL 1054 0.53 0.79 0.45 178 XM_B_COPY_HTML 1050 0.65 0.78 0.61 179 SUBJ_DOLLARS 1045 0.44 0.78 0.34 180 TR_Caps_n_Bayes_99 1041 0.26 0.78 0.10 181 MONEY_FRAUD_8 1038 0.18 0.77 0.00 182 LongTLD 998 0.28 0.74 0.14 183 ADVANCE_FEE_5_NEW_MONEY 994 0.18 0.74 0.00 184 TooManyTo_002 987 2.32 0.74 2.81 185 RELAYCOUNTRY_DE 975 0.43 0.73 0.33 186 FORGED_GMAIL_RCVD 941 0.51 0.70 0.45 187 RELAYCOUNTRY_CN 908 0.20 0.68 0.06 188 DATE_IN_PAST_06_12 893 0.18 0.67 0.03 189 TRACKER_ID 842 0.31 0.63 0.21 190 T_HTML_TAG_BALANCE_CENTER 802 0.24 0.60 0.13 191 HTML_IMAGE_ONLY_32 795 0.52 0.59 0.50 192 RELAYCOUNTRY_IE 794 0.28 0.59 0.18 193 BODY_ENHANCEMENT 764 0.15 0.57 0.01 194 XM_Nigeria_01 756 0.18 0.56 0.06 195 TR_Mismatch_TLD_01 754 0.23 0.56 0.13 196 REPLYTO_WITHOUT_TO_CC 744 0.17 0.55 0.05 197 RELAYCOUNTRY_AU 743 0.52 0.55 0.51 198 FSL_THIS_IS_ADV 742 0.54 0.55 0.53 199 URIBL_ABUSE_SURBL 742 0.19 0.55 0.07 200 TooManyTo_003 735 1.59 0.55 1.92 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 372986 88.76 94.34 87.01 2 DKIM_SIGNED 319044 76.79 84.33 74.43 3 XM_DK_Pass 312477 75.11 82.17 72.90 4 DKIM_VALID 296832 71.30 77.88 69.25 5 DCC_CHECK_NEGATIVE 259874 51.24 21.28 60.63 6 BAYES_50 220225 46.86 32.42 51.38 7 DKIM_VALID_AU 219162 53.89 62.73 51.13 8 XMListUnsubscribeExists 208822 55.03 75.21 48.72 9 DCC_CHECK 159656 46.74 77.06 37.25 10 XM_H_QuotedFrom 153777 39.29 50.21 35.87 11 T_TM2_M_HEADER_IN_MSG 139652 29.60 20.10 32.58 12 DKIM_VALID_EF 118893 26.52 22.64 27.74 13 HTML_FONT_LOW_CONTRAST 115123 29.72 38.85 26.86 14 XMSubLong 97167 23.67 26.87 22.67 15 LOC_TINY_FONT_1 94214 24.99 34.62 21.98 16 FVGT_m_MULTI_ODD 88461 22.69 29.26 20.64 17 MultiRelay 84793 19.05 16.71 19.78 18 MIME_HTML_ONLY 84357 22.57 31.80 19.68 19 ALL_TRUSTED 71122 13.16 2.19 16.59 20 T_KAM_HTML_FONT_INVALID 67292 17.10 21.57 15.70 21 XM_DK_Undo_02 62211 22.93 49.83 14.51 22 XM_Body_Dirty_Words 58558 15.63 21.94 13.66 23 BAYES_00 58042 10.80 2.06 13.54 24 BAYES_99 55719 20.13 42.92 13.00 25 XM_DKIMWhitelistDomains 53723 9.57 0.11 12.53 26 BAYES_999 49777 17.43 36.03 11.61 27 XM_Multi_Part_URI 47793 12.22 15.64 11.15 28 TR_XM_DK_Bayes 44879 8.09 0.51 10.47 29 RCVD_IN_RP_SAFE 42901 8.52 3.77 10.01 30 TR_XM_DK_Bayes1 42586 7.67 0.42 9.93 31 TooManyTo_001 40011 8.88 7.41 9.33 32 RCVD_IN_RP_CERTIFIED 38880 7.64 3.06 9.07 33 XM_Evil_Numbers_Gen 37571 9.84 13.28 8.76 34 TR_XM_DK_Bayes2 37465 6.75 0.38 8.74 35 LotsOfNums_01 36781 8.23 7.09 8.58 36 T_XMDrugObfuBody_14 35776 8.40 8.58 8.35 37 LOTS_OF_MONEY 34345 8.98 12.05 8.01 38 HTML_IMAGE_RATIO_02 33788 9.69 15.47 7.88 39 FSL_BULK_SIG 28044 7.68 11.32 6.54 40 XM_SendGrid 27319 5.97 4.68 6.37 41 BAYES_60 25664 6.02 6.14 5.99 42 TR_DCC_Bayes_99 25461 12.48 33.37 5.94 43 T_TooManySym_01 24983 5.24 3.36 5.83 44 XM_H_Long_From01 24896 6.18 7.39 5.81 45 MIME_QP_LONG_LINE 24742 5.17 3.26 5.77 46 XM_B_Phish_Phrases 24727 6.21 7.63 5.77 47 BOTNET_IPINHOSTNAME 24591 8.26 16.32 5.74 48 HTML_IMAGE_RATIO_04 23737 6.21 8.37 5.54 49 DKIM_INVALID 22212 5.49 6.46 5.18 50 XM_PDF 22064 4.12 0.86 5.15 51 RCVD_IN_IADB_LISTED 21999 4.35 1.86 5.13 52 RELAYCOUNTRY_META 21223 8.04 17.90 4.95 53 RCVD_IN_MSPIKE_H2 19735 4.15 2.69 4.60 54 RCVD_IN_IADB_SPF 19446 3.82 1.54 4.54 55 XMStrtUSub 19068 4.41 4.27 4.45 56 FROM_EXCESS_BASE64 18819 4.54 5.01 4.39 57 XMSexyCombo_05 18482 5.81 10.59 4.31 58 BAYES_40 18393 3.71 1.86 4.29 59 XMSubMetaSx_00 18319 5.13 7.86 4.27 60 IN_ZIMBRA_NJ_WHITELIST 18279 3.26 0.04 4.26 61 T_REMOTE_IMAGE 18110 4.03 3.41 4.22 62 RCVD_IN_IADB_SENDERID 17150 3.39 1.42 4.00 63 RCVD_IN_IADB_DK 16834 3.32 1.40 3.93 64 BAYES_80 15839 4.59 7.44 3.70 65 HTML_IMAGE_RATIO_06 15516 4.00 5.24 3.62 66 UNPARSEABLE_RELAY 14806 2.99 1.49 3.45 67 TVD_RCVD_IP 14543 2.68 0.39 3.39 68 XM_UncommonTLD01 14098 4.45 8.15 3.29 69 BAYES_20 13881 2.91 1.85 3.24 70 RCVD_IN_IADB_VOUCHED 13782 2.74 1.22 3.22 71 MPART_ALT_DIFF 13740 4.28 7.73 3.21 72 TR_XM_DK_SendGrid 13587 2.91 2.08 3.17 73 TO_MALFORMED 13402 2.38 0.01 3.13 74 RCVD_IN_MSPIKE_H3 12598 2.36 0.53 2.94 75 RCVD_IN_MSPIKE_WL 12598 2.36 0.53 2.94 76 XMNumbers 12206 2.99 3.46 2.85 77 TooManyTo_002 12065 2.32 0.74 2.81 78 BAYES_95 10472 2.83 4.08 2.44 79 MAILING_LIST_MULTI 10419 2.27 1.74 2.43 80 HTML_MIME_NO_HTML_TAG 10376 2.82 4.09 2.42 81 XM_DIRTYINTL 10272 3.33 6.31 2.40 82 XM_SPF_SoftFail 10059 2.72 3.92 2.35 83 MIME_HTML_MOSTLY 10043 2.91 4.70 2.34 84 HTML_IMAGE_RATIO_08 9844 2.57 3.44 2.30 85 TR_MetaPhish_Combo_01 8953 1.96 1.53 2.09 86 BAYES_05 8905 1.83 1.03 2.08 87 RCVD_IN_IADB_OPTIN 8736 1.74 0.80 2.04 88 HELO_NODOT 8490 1.70 0.82 1.98 89 HELO_NO_DOMAIN 8487 1.70 0.82 1.98 90 BOTNET 8305 5.60 17.28 1.94 91 XM_DK_Undo_01 8220 1.69 0.94 1.92 92 TooManyTo_003 8211 1.59 0.55 1.92 93 T_TooManySym_02 8171 1.66 0.88 1.91 94 XMDiploma_00 8114 2.20 3.19 1.89 95 IN_HORDE_ADDRESS_BOOK 7969 1.43 0.05 1.86 96 SUBJ_ALL_CAPS 7837 1.99 2.52 1.83 97 ANY_BOUNCE_MESSAGE 7683 1.48 0.49 1.79 98 BOUNCE_MESSAGE 7681 1.48 0.49 1.79 99 USER_IN_DEF_DKIM_WL 7568 1.35 0.03 1.77 100 TM2_M_URI_OPT_OUT 7537 2.27 3.90 1.76 101 INVALID_MSGID 7384 1.34 0.11 1.72 102 XM_CamelCaseFrm001 7294 2.25 3.99 1.70 103 XMStockSpam_06 7114 1.63 1.52 1.66 104 XMCapTrack 7095 1.32 0.26 1.66 105 URI_HEX 7055 2.17 3.82 1.65 106 TR_Symld_Words 6943 1.54 1.30 1.62 107 RELAYCOUNTRY_CA 6346 2.07 3.94 1.48 108 XM_OfRef6 6218 1.77 2.80 1.45 109 TooManyTo_004 6078 1.19 0.45 1.42 110 MIME_HTML_ONLY_MULTI 5929 1.89 3.52 1.38 111 T_XMDrugObfuBody_08 5902 1.60 2.33 1.38 112 XMPhish11 5584 1.30 1.31 1.30 113 XM_GoogleGroups 5470 1.08 0.46 1.28 114 XMSexyCombo_01 5431 1.49 2.22 1.27 115 UNTRUSTED_Relay 5226 3.55 11.00 1.22 116 XMGenDplmaNmb 5213 1.41 2.04 1.22 117 T_FILL_THIS_FORM_SHORT 5070 1.17 1.11 1.18 118 TooManyTo_005 5052 0.99 0.38 1.18 119 XMBdyGiftCard01 4999 1.44 2.33 1.17 120 NO_DNS_FOR_FROM 4910 1.52 2.73 1.15 121 URI_TRY_3LD 4892 1.18 1.32 1.14 122 TR_XM_PHPDW 4652 1.46 2.64 1.09 123 TR_XM_PHPForged 4527 1.43 2.62 1.06 124 XMSubMetaI_00 4525 1.42 2.57 1.06 125 TR_XM_FormFill2 4485 1.42 2.61 1.05 126 XM_H_PHPOS 4471 1.41 2.59 1.04 127 RELAYCOUNTRY_GB 4406 1.03 1.05 1.03 128 TM2_M_VERY_LONG_WORD 4401 1.21 1.80 1.03 129 DKIM_ADSP_CUSTOM_MED 4289 0.96 0.85 1.00 130 XM_H_Long_From02 4036 1.03 1.33 0.94 131 TR_XM_RelayPhish 3364 0.98 1.62 0.78 132 XM_RXBody 3354 0.88 1.17 0.78 133 XMLngstWrd_00 3249 0.66 0.34 0.76 134 XM_ProductURIs 3237 1.01 1.82 0.76 135 NML_ADSP_CUSTOM_MED 3127 0.75 0.80 0.73 136 XMLngstWrd_01 3119 0.63 0.33 0.73 137 XMBrknScrpt_02 3097 0.85 1.25 0.72 138 XM_UB50 2981 1.51 4.12 0.70 139 XM_ShortIntro_01 2895 0.60 0.37 0.68 140 SpammyFromTLD_01 2880 0.87 1.49 0.67 141 T_XMHurry_00 2866 0.95 1.83 0.67 142 XMBody_95 2824 0.54 0.16 0.66 143 PLING_QUERY 2816 0.74 0.99 0.66 144 T_XMDrugObfuBody_00 2762 0.95 1.92 0.64 145 HTTPS_HTTP_MISMATCH 2741 0.68 0.80 0.64 146 T_OBFU_PDF_ATTACH 2739 0.54 0.22 0.64 147 AC_DIV_BONANZA 2732 0.52 0.13 0.64 148 XM_H_PHPMailer 2731 0.80 1.32 0.64 149 T_Symld_Words_02 2701 0.80 1.33 0.63 150 XMGappySubj_01 2659 0.58 0.46 0.62 151 XM_B_COPY_HTML 2634 0.65 0.78 0.61 152 XMSexyCombo_04 2628 0.67 0.85 0.61 153 USER_IN_WHITELIST 2628 0.47 0.00 0.61 154 XMBody_17 2599 0.91 1.89 0.61 155 XMMoneyMeta_00 2426 0.67 1.01 0.57 156 SHORT_HELO_AND_INLINE_IMAGE 2387 0.44 0.07 0.56 157 XMNoVowels 2351 0.51 0.39 0.55 158 HTML_FONT_FACE_BAD 2347 0.66 1.03 0.55 159 MISSING_HEADERS 2291 0.53 0.53 0.53 160 FSL_THIS_IS_ADV 2286 0.54 0.55 0.53 161 T_TooManySym_03 2284 0.47 0.26 0.53 162 TM2_M_BODY_EMPTY 2242 0.46 0.26 0.52 163 XMSubMetaSxObfu_02 2200 0.50 0.46 0.51 164 XMPhish30 2179 0.69 1.26 0.51 165 RELAYCOUNTRY_AU 2171 0.52 0.55 0.51 166 DKIM_ADSP_NXDOMAIN 2153 1.20 3.42 0.50 167 HTML_IMAGE_ONLY_32 2122 0.52 0.59 0.50 168 HTML_IMAGE_ONLY_28 2112 0.59 0.91 0.49 169 XMDateMe_00 2059 0.45 0.36 0.48 170 XM_URI_RBL 1991 1.04 2.87 0.46 171 HTML_TAG_BALANCE_BODY 1980 0.58 0.97 0.46 172 URI_NOVOWEL 1929 0.53 0.79 0.45 173 FORGED_GMAIL_RCVD 1919 0.51 0.70 0.45 174 XM_B_REG_HTML 1868 0.66 1.36 0.44 175 FILL_THIS_FORM 1860 0.62 1.22 0.43 176 FROM_GOV_SPOOF 1859 0.35 0.09 0.43 177 RCVD_IN_BL_SPAMCOP_NET 1840 1.05 3.02 0.43 178 RCVD_IN_SORBS_DUL 1832 0.41 0.37 0.43 179 XMHTMLBadTable_001 1760 0.77 1.90 0.41 180 XMSubPhish11 1759 0.37 0.23 0.41 181 XMHTML_After_End 1671 0.65 1.50 0.39 182 HTML_IMAGE_ONLY_24 1644 0.40 0.44 0.38 183 XMPhish14 1634 0.50 0.87 0.38 184 RDNS_DYNAMIC 1570 0.50 0.91 0.37 185 XMGappySubj_02 1526 0.29 0.07 0.36 186 XMSubMetaSxObfu_03 1513 0.53 1.11 0.35 187 TM2_M_A_HREF_HREF 1511 0.40 0.53 0.35 188 DIET_1 1505 0.61 1.43 0.35 189 XM_Body_Obfu01 1494 0.36 0.39 0.35 190 XMSubNoVowel 1494 0.33 0.25 0.35 191 TVD_SPACE_RATIO 1486 0.32 0.24 0.35 192 NUMERIC_HTTP_ADDR 1470 0.50 1.02 0.34 193 FROM_GOV_DKIM_AU 1469 0.29 0.12 0.34 194 SUBJ_DOLLARS 1458 0.44 0.78 0.34 195 BASE64_LENGTH_79_INF 1438 0.28 0.10 0.34 196 RELAYCOUNTRY_DE 1434 0.43 0.73 0.33 197 FILL_THIS_FORM_LOAN 1427 0.47 0.91 0.33 198 XMBody_78 1421 0.57 1.32 0.33 199 FILL_THIS_FORM_LONG 1419 0.53 1.15 0.33 200 HTML_IMAGE_ONLY_20 1392 0.30 0.24 0.32 ----------------------------------------------------------------------