Email: 614761 Autolearn: 0 AvgScore: 2.86 AvgScanTime: 1.96 sec Spam: 167477 Autolearn: 0 AvgScore: 12.89 AvgScanTime: 2.29 sec Ham: 447284 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.84 sec Time Spent Running SA: 334.63 hours Time Spent Processing Spam: 106.61 hours Time Spent Processing Ham: 228.02 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156853 88.91 93.66 87.14 2 DKIM_SIGNED 133600 76.54 79.77 75.33 3 DCC_CHECK 131038 49.58 78.24 38.85 4 XMListUnsubscribeExists 127243 57.52 75.98 50.61 5 XM_DK_Pass 125394 74.11 74.87 73.83 6 DKIM_VALID 118526 70.29 70.77 70.10 7 DKIM_VALID_AU 96834 53.00 57.82 51.20 8 XM_H_QuotedFrom 79833 39.40 47.67 36.31 9 XM_DK_Undo_02 74523 22.96 44.50 14.90 10 BAYES_99 66733 20.33 39.85 13.03 11 HTML_FONT_LOW_CONTRAST 62655 30.44 37.41 27.83 12 LOC_TINY_FONT_1 57112 25.61 34.10 22.42 13 BAYES_50 56236 46.77 33.58 51.71 14 BAYES_999 55969 17.51 33.42 11.56 15 TR_DCC_Bayes_99 53568 13.38 31.99 6.41 16 MIME_HTML_ONLY 48369 22.37 28.88 19.93 17 XMSubLong 45850 23.60 27.38 22.18 18 FVGT_m_MULTI_ODD 43604 22.78 26.04 21.56 19 XM_Body_Dirty_Words 38177 15.87 22.80 13.28 20 DKIM_VALID_EF 37459 25.89 22.37 27.20 21 RELAYCOUNTRY_META 35573 9.63 21.24 5.28 22 BOTNET 32899 6.86 19.64 2.07 23 DCC_CHECK_NEGATIVE 32656 48.27 19.50 59.04 24 T_TM2_M_HEADER_IN_MSG 31124 27.97 18.58 31.48 25 T_KAM_HTML_FONT_INVALID 31095 16.68 18.57 15.98 26 BOTNET_IPINHOSTNAME 31080 9.12 18.56 5.58 27 MultiRelay 30764 19.43 18.37 19.83 28 XM_UncommonTLD01 25392 6.68 15.16 3.51 29 XM_Multi_Part_URI 23868 12.46 14.25 11.79 30 HTML_IMAGE_RATIO_02 23359 9.20 13.95 7.42 31 XM_Evil_Numbers_Gen 20276 9.69 12.11 8.79 32 UNTRUSTED_Relay 19544 4.12 11.67 1.30 33 FSL_BULK_SIG 18762 8.37 11.20 7.31 34 TooManyTo_001 18269 9.09 10.91 8.41 35 LOTS_OF_MONEY 17903 9.61 10.69 9.20 36 HTML_IMAGE_RATIO_04 17894 7.22 10.68 5.93 37 XMSexyCombo_05 17041 5.58 10.18 3.86 38 SpammyFromTLD_02 15706 2.81 9.38 0.36 39 XMSubMetaSx_00 15671 5.41 9.36 3.93 40 DKIM_INVALID 15074 6.25 9.00 5.22 41 T_XMDrugObfuBody_14 14727 8.41 8.79 8.27 42 XM_H_Long_From01 13750 6.89 8.21 6.40 43 BAYES_80 13284 4.99 7.93 3.89 44 FROM_SUSPICIOUS_NTLD 12582 2.13 7.51 0.11 45 MPART_ALT_DIFF 12573 4.33 7.51 3.14 46 XM_SPF_SoftFail 11903 3.40 7.11 2.01 47 XM_B_Phish_Phrases 11862 6.41 7.08 6.15 48 XM_DIRTYINTL 11848 3.90 7.07 2.71 49 BAYES_60 10997 6.35 6.57 6.26 50 LotsOfNums_01 9882 8.14 5.90 8.97 51 RCVD_IN_RP_RNBL 8725 1.44 5.21 0.02 52 BAYES_95 8099 3.14 4.84 2.50 53 RCVD_IN_BL_SPAMCOP_NET 7759 1.82 4.63 0.77 54 URIBL_SBL_A 7754 1.35 4.63 0.12 55 XMSexyCombo_01 7677 1.77 4.58 0.71 56 RELAYCOUNTRY_DE 7569 1.52 4.52 0.39 57 HTML_IMAGE_RATIO_06 7476 3.77 4.46 3.51 58 TR_XM_PHPDW 7400 1.97 4.42 1.06 59 MIME_QP_LONG_LINE 7294 5.77 4.36 6.30 60 NUMERIC_HTTP_ADDR 7232 1.43 4.32 0.34 61 RELAYCOUNTRY_CA 7195 2.24 4.30 1.47 62 XM_CamelCaseFrm001 7061 2.46 4.22 1.80 63 XM_UB50 7013 1.72 4.19 0.79 64 NORMAL_HTTP_TO_IP 6775 1.16 4.05 0.08 65 MIME_HTML_MOSTLY 6768 2.75 4.04 2.26 66 XM_OfRef6 6751 2.26 4.03 1.59 67 BAD_ENC_HEADER 6620 1.10 3.95 0.03 68 XM_H_TOP 6619 1.08 3.95 0.01 69 XMNumbers 6264 3.33 3.74 3.18 70 XM_H_PHPMailer 6221 1.60 3.71 0.81 71 HTML_MIME_NO_HTML_TAG 6216 2.65 3.71 2.25 72 XMStrtUSub 6191 4.22 3.70 4.42 73 FROM_EXCESS_BASE64 6098 4.07 3.64 4.23 74 RELAYCOUNTRY_FR 6019 1.18 3.59 0.27 75 MIME_HTML_ONLY_MULTI 5556 2.05 3.32 1.57 76 XMStockSpam_06 5429 1.96 3.24 1.48 77 URI_HEX 5408 2.20 3.23 1.81 78 TM2_M_URI_OPT_OUT 5320 2.19 3.18 1.83 79 XM_SendGrid 5270 5.51 3.15 6.40 80 XMDiploma_00 5224 2.36 3.12 2.08 81 T_TooManySym_01 5205 4.90 3.11 5.58 82 RCVD_IN_RP_SAFE 5090 8.55 3.04 10.62 83 T_REMOTE_IMAGE 5059 3.75 3.02 4.03 84 MultiRelay_CC 4986 0.94 2.98 0.18 85 MultiRelay_Combo 4986 0.94 2.98 0.18 86 TR_M_TOP_BAYES 4835 0.79 2.89 0.00 87 DATE_IN_PAST_12_24 4787 0.81 2.86 0.05 88 DKIM_ADSP_NXDOMAIN 4784 1.21 2.86 0.60 89 TR_XM_PHPForged 4768 1.53 2.85 1.04 90 TR_XM_FormFill2 4739 1.53 2.83 1.04 91 XM_H_PHPOS 4719 1.52 2.82 1.03 92 XM_URI_RBL 4157 1.04 2.48 0.50 93 SUBJ_ALL_CAPS 4141 1.99 2.47 1.80 94 NORDNS_LOW_CONTRAST 4123 0.68 2.46 0.01 95 XMGenDplmaNmb 3932 1.58 2.35 1.30 96 RCVD_IN_RP_CERTIFIED 3929 7.74 2.35 9.76 97 HTML_IMAGE_RATIO_08 3914 2.07 2.34 1.96 98 XMSubMetaSSx_00 3904 0.74 2.33 0.14 99 T_XMDrugObfuBody_08 3876 1.94 2.31 1.80 100 FILL_THIS_FORM 3721 1.19 2.22 0.81 101 NO_DNS_FOR_FROM 3707 1.45 2.21 1.16 102 SUBJ_ILLEGAL_CHARS 3623 0.63 2.16 0.06 103 RCVD_IN_MSPIKE_H2 3604 3.91 2.15 4.57 104 FILL_THIS_FORM_LONG 3585 0.82 2.14 0.33 105 BAYES_00 3558 10.19 2.12 13.21 106 XMBody_17 3483 0.92 2.08 0.48 107 BAYES_40 3453 3.49 2.06 4.02 108 XMSubMetaI_00 3403 1.17 2.03 0.85 109 T_XMDrugObfuBody_00 3326 1.17 1.99 0.86 110 SpammyFromTLD_01 3308 1.20 1.98 0.91 111 XMBdyGiftCard01 3300 1.25 1.97 0.98 112 HTML_IMAGE_ONLY_24 3191 0.77 1.91 0.34 113 ALL_TRUSTED 3079 11.69 1.84 15.38 114 BAYES_20 3059 2.75 1.83 3.09 115 XMBody_78 2942 0.72 1.76 0.34 116 RCVD_IN_IADB_LISTED 2757 4.42 1.65 5.46 117 TR_XM_RelayPhish 2697 1.11 1.61 0.93 118 TM2_M_VERY_LONG_WORD 2638 1.32 1.58 1.22 119 XM_UB60 2570 0.47 1.53 0.07 120 MAILING_LIST_MULTI 2542 2.37 1.52 2.69 121 XM_UB99 2526 0.44 1.51 0.04 122 MONEY_FRAUD_8 2500 0.41 1.49 0.00 123 HK_SCAM 2498 0.43 1.49 0.03 124 HTML_TAG_BALANCE_BODY 2493 0.82 1.49 0.56 125 URI_TRY_3LD 2474 1.25 1.48 1.16 126 DATE_IN_PAST_06_12 2440 0.43 1.46 0.05 127 XM_ProductURIs 2409 0.87 1.44 0.66 128 TR_XM_DK_SendGrid 2381 2.87 1.42 3.41 129 RCVD_IN_IADB_SPF 2375 3.88 1.42 4.80 130 BOTNET_NORDNS 2346 0.42 1.40 0.05 131 TR_Mismatch_TLD_02 2287 0.42 1.37 0.07 132 XM_NotFromAmazon 2270 0.38 1.36 0.01 133 ADVANCE_FEE_5_NEW_FRM_MNY 2252 0.37 1.34 0.00 134 XMSubGiftCard1 2207 0.48 1.32 0.16 135 XM_UB80 2205 0.38 1.32 0.03 136 TR_LOTS_OF_MONEY2 2199 0.70 1.31 0.47 137 T_MONEY_PERCENT 2199 0.70 1.31 0.47 138 XM_OfRef7 2196 0.53 1.31 0.24 139 DIET_1 2189 0.56 1.31 0.28 140 UNPARSEABLE_RELAY 2176 2.78 1.30 3.33 141 RCVD_IN_IADB_SENDERID 2127 3.42 1.27 4.22 142 XM_Lotto 2110 0.38 1.26 0.06 143 HTML_IMAGE_ONLY_16 2076 0.55 1.24 0.30 144 RCVD_IN_IADB_DK 2070 3.38 1.24 4.19 145 T_XMHurry_00 2041 0.80 1.22 0.64 146 TR_Symld_Words 2007 1.59 1.20 1.73 147 T_FILL_THIS_FORM_SHORT 1982 0.96 1.18 0.88 148 XMHTML_After_End 1981 0.67 1.18 0.47 149 XMGppyBdWords 1965 0.46 1.17 0.19 150 XMMoneyMeta_00 1936 0.69 1.16 0.52 151 DATE_IN_PAST_03_06 1926 0.38 1.15 0.09 152 LongTLD 1923 0.41 1.15 0.14 153 XMSexyCombo_04 1906 0.40 1.14 0.13 154 XMPhish30 1894 0.66 1.13 0.49 155 XM_H_Long_From02 1889 1.04 1.13 1.01 156 HTML_SHORT_LINK_IMG_2 1862 0.36 1.11 0.08 157 XM_UB999 1812 0.31 1.08 0.02 158 DEAR_SOMETHING 1786 0.38 1.07 0.12 159 XMSubMetaI_01 1782 0.33 1.06 0.06 160 BAYES_05 1754 1.76 1.05 2.02 161 RCVD_IN_IADB_VOUCHED 1733 2.77 1.03 3.42 162 XMPhish14 1731 0.55 1.03 0.37 163 TRACKER_ID 1726 0.39 1.03 0.15 164 XMBrknScrpt_02 1711 0.81 1.02 0.73 165 T_TooManySym_02 1681 1.57 1.00 1.78 166 XMPhish11 1659 1.25 0.99 1.35 167 RELAYCOUNTRY_AT 1651 0.39 0.99 0.17 168 MONEY_FORM 1602 0.27 0.96 0.01 169 RELAYCOUNTRY_PL 1595 0.28 0.95 0.02 170 RELAYCOUNTRY_IN 1583 0.36 0.95 0.14 171 TR_MetaPhish_Combo_01 1576 1.53 0.94 1.75 172 SUBJ_DOLLARS 1574 0.63 0.94 0.51 173 TR_Caps_n_Bayes_99 1525 0.31 0.91 0.09 174 XM_UB95 1514 0.26 0.90 0.03 175 XM_B_REG_HTML 1478 0.56 0.88 0.44 176 URIBL_BLACK 1476 0.28 0.88 0.06 177 RELAYCOUNTRY_NL 1471 0.45 0.88 0.29 178 HTML_IMAGE_ONLY_28 1461 0.54 0.87 0.41 179 XMHTMLBadTable_001 1460 0.64 0.87 0.56 180 TR_XM_DK_Bayes 1448 7.81 0.86 10.41 181 XM_RXBody 1427 0.83 0.85 0.82 182 URIBL_DBL_SPAM 1406 0.23 0.84 0.01 183 XM_Nigeria_01 1400 0.27 0.84 0.05 184 MONEY_FROM_MISSP 1387 0.23 0.83 0.00 185 XM_HighProb1 1377 0.24 0.82 0.02 186 XM_H_PHPOS_M 1372 0.40 0.82 0.24 187 FROM_ADDR_WS 1366 0.22 0.82 0.00 188 BODY_ENHANCEMENT 1355 0.24 0.81 0.02 189 T_Symld_Words_02 1344 0.67 0.80 0.62 190 XM_DrOz_From 1335 0.22 0.80 0.01 191 XM_XX_Yahoo 1321 0.34 0.79 0.17 192 RELAYCOUNTRY_GB 1319 1.04 0.79 1.13 193 HTML_FONT_FACE_BAD 1315 0.67 0.79 0.63 194 PLING_QUERY 1299 0.66 0.78 0.62 195 LONG_JUNK_URI 1294 0.26 0.77 0.06 196 XMSubMetaD_03 1291 0.32 0.77 0.15 197 RDNS_DYNAMIC 1281 0.50 0.76 0.40 198 XM_DK_Undo_01 1265 1.66 0.76 2.00 199 XMEmptySub 1264 0.29 0.75 0.11 200 TR_XM_DK_Bayes1 1256 7.41 0.75 9.90 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 389746 88.91 93.66 87.14 2 DKIM_SIGNED 336917 76.54 79.77 75.33 3 XM_DK_Pass 330230 74.11 74.87 73.83 4 DKIM_VALID 313564 70.29 70.77 70.10 5 DCC_CHECK_NEGATIVE 264086 48.27 19.50 59.04 6 BAYES_50 231281 46.77 33.58 51.71 7 DKIM_VALID_AU 229007 53.00 57.82 51.20 8 XMListUnsubscribeExists 226352 57.52 75.98 50.61 9 DCC_CHECK 173767 49.58 78.24 38.85 10 XM_H_QuotedFrom 162413 39.40 47.67 36.31 11 T_TM2_M_HEADER_IN_MSG 140824 27.97 18.58 31.48 12 HTML_FONT_LOW_CONTRAST 124487 30.44 37.41 27.83 13 DKIM_VALID_EF 121672 25.89 22.37 27.20 14 LOC_TINY_FONT_1 100298 25.61 34.10 22.42 15 XMSubLong 99210 23.60 27.38 22.18 16 FVGT_m_MULTI_ODD 96439 22.78 26.04 21.56 17 MIME_HTML_ONLY 89127 22.37 28.88 19.93 18 MultiRelay 88680 19.43 18.37 19.83 19 T_KAM_HTML_FONT_INVALID 71460 16.68 18.57 15.98 20 ALL_TRUSTED 68770 11.69 1.84 15.38 21 XM_DK_Undo_02 66652 22.96 44.50 14.90 22 XM_Body_Dirty_Words 59387 15.87 22.80 13.28 23 BAYES_00 59081 10.19 2.12 13.21 24 BAYES_99 58267 20.33 39.85 13.03 25 XM_DKIMWhitelistDomains 56140 9.16 0.09 12.55 26 XM_Multi_Part_URI 52726 12.46 14.25 11.79 27 BAYES_999 51691 17.51 33.42 11.56 28 RCVD_IN_RP_SAFE 47492 8.55 3.04 10.62 29 TR_XM_DK_Bayes 46564 7.81 0.86 10.41 30 TR_XM_DK_Bayes1 44285 7.41 0.75 9.90 31 RCVD_IN_RP_CERTIFIED 43662 7.74 2.35 9.76 32 LOTS_OF_MONEY 41154 9.61 10.69 9.20 33 LotsOfNums_01 40138 8.14 5.90 8.97 34 XM_Evil_Numbers_Gen 39310 9.69 12.11 8.79 35 TR_XM_DK_Bayes2 38529 6.45 0.67 8.61 36 TooManyTo_001 37616 9.09 10.91 8.41 37 T_XMDrugObfuBody_14 37000 8.41 8.79 8.27 38 HTML_IMAGE_RATIO_02 33185 9.20 13.95 7.42 39 FSL_BULK_SIG 32682 8.37 11.20 7.31 40 TR_DCC_Bayes_99 28669 13.38 31.99 6.41 41 XM_SendGrid 28629 5.51 3.15 6.40 42 XM_H_Long_From01 28617 6.89 8.21 6.40 43 MIME_QP_LONG_LINE 28160 5.77 4.36 6.30 44 BAYES_60 28013 6.35 6.57 6.26 45 XM_B_Phish_Phrases 27521 6.41 7.08 6.15 46 HTML_IMAGE_RATIO_04 26509 7.22 10.68 5.93 47 BOTNET_IPINHOSTNAME 24959 9.12 18.56 5.58 48 T_TooManySym_01 24943 4.90 3.11 5.58 49 RCVD_IN_IADB_LISTED 24417 4.42 1.65 5.46 50 RELAYCOUNTRY_META 23618 9.63 21.24 5.28 51 DKIM_INVALID 23353 6.25 9.00 5.22 52 XM_PDF 21616 3.70 0.68 4.83 53 RCVD_IN_IADB_SPF 21451 3.88 1.42 4.80 54 RCVD_IN_MSPIKE_H2 20446 3.91 2.15 4.57 55 XMStrtUSub 19781 4.22 3.70 4.42 56 FROM_EXCESS_BASE64 18932 4.07 3.64 4.23 57 RCVD_IN_IADB_SENDERID 18890 3.42 1.27 4.22 58 IN_ZIMBRA_NJ_WHITELIST 18762 3.06 0.02 4.19 59 RCVD_IN_IADB_DK 18727 3.38 1.24 4.19 60 TO_MALFORMED 18138 2.96 0.03 4.06 61 T_REMOTE_IMAGE 18016 3.75 3.02 4.03 62 BAYES_40 17991 3.49 2.06 4.02 63 XMSubMetaSx_00 17583 5.41 9.36 3.93 64 BAYES_80 17408 4.99 7.93 3.89 65 XMSexyCombo_05 17287 5.58 10.18 3.86 66 HTML_IMAGE_RATIO_06 15706 3.77 4.46 3.51 67 XM_UncommonTLD01 15688 6.68 15.16 3.51 68 RCVD_IN_IADB_VOUCHED 15297 2.77 1.03 3.42 69 TR_XM_DK_SendGrid 15259 2.87 1.42 3.41 70 UNPARSEABLE_RELAY 14892 2.78 1.30 3.33 71 XMNumbers 14203 3.33 3.74 3.18 72 MPART_ALT_DIFF 14046 4.33 7.51 3.14 73 BAYES_20 13819 2.75 1.83 3.09 74 TVD_RCVD_IP 13522 2.32 0.43 3.02 75 XM_DIRTYINTL 12106 3.90 7.07 2.71 76 MAILING_LIST_MULTI 12050 2.37 1.52 2.69 77 RCVD_IN_MSPIKE_WL 11664 2.02 0.45 2.61 78 RCVD_IN_MSPIKE_H3 11663 2.02 0.45 2.61 79 BAYES_95 11202 3.14 4.84 2.50 80 TooManyTo_002 10555 1.92 0.73 2.36 81 MIME_HTML_MOSTLY 10114 2.75 4.04 2.26 82 HTML_MIME_NO_HTML_TAG 10084 2.65 3.71 2.25 83 HELO_NODOT 9911 1.81 0.73 2.22 84 HELO_NO_DOMAIN 9893 1.81 0.73 2.21 85 RCVD_IN_IADB_OPTIN 9539 1.75 0.73 2.13 86 ANY_BOUNCE_MESSAGE 9475 1.67 0.47 2.12 87 BOUNCE_MESSAGE 9474 1.67 0.47 2.12 88 XMDiploma_00 9307 2.36 3.12 2.08 89 BOTNET 9269 6.86 19.64 2.07 90 BAYES_05 9042 1.76 1.05 2.02 91 XM_SPF_SoftFail 8985 3.40 7.11 2.01 92 XM_DK_Undo_01 8949 1.66 0.76 2.00 93 HTML_IMAGE_RATIO_08 8789 2.07 2.34 1.96 94 TM2_M_URI_OPT_OUT 8169 2.19 3.18 1.83 95 URI_HEX 8102 2.20 3.23 1.81 96 SUBJ_ALL_CAPS 8064 1.99 2.47 1.80 97 T_XMDrugObfuBody_08 8063 1.94 2.31 1.80 98 IN_HORDE_ADDRESS_BOOK 8055 1.32 0.04 1.80 99 XM_CamelCaseFrm001 8052 2.46 4.22 1.80 100 T_TooManySym_02 7957 1.57 1.00 1.78 101 TR_MetaPhish_Combo_01 7806 1.53 0.94 1.75 102 TR_Symld_Words 7746 1.59 1.20 1.73 103 INVALID_MSGID 7448 1.23 0.08 1.67 104 XM_OfRef6 7115 2.26 4.03 1.59 105 MIME_HTML_ONLY_MULTI 7022 2.05 3.32 1.57 106 XMCapTrack 6757 1.15 0.20 1.51 107 TooManyTo_003 6734 1.25 0.57 1.51 108 XMStockSpam_06 6630 1.96 3.24 1.48 109 RELAYCOUNTRY_CA 6560 2.24 4.30 1.47 110 XMPhish11 6017 1.25 0.99 1.35 111 XMGenDplmaNmb 5801 1.58 2.35 1.30 112 UNTRUSTED_Relay 5795 4.12 11.67 1.30 113 USER_IN_DEF_DKIM_WL 5791 0.95 0.02 1.29 114 XM_GoogleGroups 5569 1.01 0.39 1.25 115 TM2_M_VERY_LONG_WORD 5454 1.32 1.58 1.22 116 NO_DNS_FOR_FROM 5202 1.45 2.21 1.16 117 URI_TRY_3LD 5188 1.25 1.48 1.16 118 RELAYCOUNTRY_GB 5072 1.04 0.79 1.13 119 TooManyTo_004 4986 0.94 0.48 1.11 120 TR_XM_PHPDW 4735 1.97 4.42 1.06 121 TR_XM_PHPForged 4640 1.53 2.85 1.04 122 TR_XM_FormFill2 4637 1.53 2.83 1.04 123 XM_H_PHPOS 4611 1.52 2.82 1.03 124 XM_H_Long_From02 4534 1.04 1.13 1.01 125 XMBdyGiftCard01 4396 1.25 1.97 0.98 126 DKIM_ADSP_CUSTOM_MED 4382 0.91 0.71 0.98 127 HTTPS_HTTP_MISMATCH 4290 0.85 0.57 0.96 128 TR_XM_RelayPhish 4155 1.11 1.61 0.93 129 SpammyFromTLD_01 4058 1.20 1.98 0.91 130 TooManyTo_005 4046 0.72 0.24 0.90 131 T_FILL_THIS_FORM_SHORT 3915 0.96 1.18 0.88 132 T_XMDrugObfuBody_00 3841 1.17 1.99 0.86 133 XMSubMetaI_00 3799 1.17 2.03 0.85 134 XM_RXBody 3653 0.83 0.85 0.82 135 XM_H_PHPMailer 3616 1.60 3.71 0.81 136 FILL_THIS_FORM 3608 1.19 2.22 0.81 137 XM_UB50 3532 1.72 4.19 0.79 138 RCVD_IN_BL_SPAMCOP_NET 3456 1.82 4.63 0.77 139 TM2_M_A_HREF_HREF 3438 0.70 0.51 0.77 140 XMLngstWrd_00 3421 0.64 0.31 0.76 141 XMSubMetaSxObfu_02 3377 0.67 0.44 0.76 142 LOW_PRICE 3343 0.65 0.39 0.75 143 XM_ShortIntro_01 3341 0.61 0.26 0.75 144 XMBrknScrpt_02 3279 0.81 1.02 0.73 145 XMLngstWrd_01 3256 0.61 0.30 0.73 146 XMSexyCombo_01 3178 1.77 4.58 0.71 147 T_OBFU_PDF_ATTACH 3103 0.57 0.24 0.69 148 XMNoVowels 3048 0.59 0.36 0.68 149 NML_ADSP_CUSTOM_MED 3002 0.67 0.68 0.67 150 XM_ProductURIs 2948 0.87 1.44 0.66 151 SHORT_HELO_AND_INLINE_IMAGE 2898 0.48 0.04 0.65 152 T_XMHurry_00 2847 0.80 1.22 0.64 153 HTML_FONT_FACE_BAD 2808 0.67 0.79 0.63 154 XMBody_95 2791 0.47 0.06 0.62 155 PLING_QUERY 2768 0.66 0.78 0.62 156 T_Symld_Words_02 2762 0.67 0.80 0.62 157 AC_DIV_BONANZA 2716 0.47 0.09 0.61 158 FROM_GOV_DKIM_AU 2704 0.48 0.15 0.60 159 DKIM_ADSP_NXDOMAIN 2667 1.21 2.86 0.60 160 RCVD_IN_SORBS_DUL 2629 0.50 0.25 0.59 161 T_TooManySym_03 2602 0.51 0.33 0.58 162 MISSING_HEADERS 2586 0.57 0.56 0.58 163 USER_IN_WHITELIST 2572 0.42 0.00 0.58 164 HTML_TAG_BALANCE_BODY 2526 0.82 1.49 0.56 165 XMHTMLBadTable_001 2489 0.64 0.87 0.56 166 XM_B_COPY_HTML 2399 0.53 0.51 0.54 167 XMMoneyMeta_00 2334 0.69 1.16 0.52 168 XMGappySubj_01 2311 0.56 0.69 0.52 169 BASE64_LENGTH_79_INF 2308 0.40 0.09 0.52 170 RELAYCOUNTRY_AU 2306 0.56 0.66 0.52 171 SUBJ_DOLLARS 2282 0.63 0.94 0.51 172 XM_URI_RBL 2219 1.04 2.48 0.50 173 XMPhish30 2191 0.66 1.13 0.49 174 T_MANY_PILL_PRICE 2168 0.37 0.07 0.48 175 XMBody_17 2145 0.92 2.08 0.48 176 FROM_GOV_SPOOF 2125 0.41 0.23 0.48 177 XMHTML_After_End 2115 0.67 1.18 0.47 178 T_MONEY_PERCENT 2098 0.70 1.31 0.47 179 TR_LOTS_OF_MONEY2 2098 0.70 1.31 0.47 180 XM_Body_Obfu01 2086 0.45 0.42 0.47 181 XM_B_REG_HTML 1969 0.56 0.88 0.44 182 TM2_M_BODY_EMPTY 1908 0.35 0.13 0.43 183 FORGED_GMAIL_RCVD 1888 0.47 0.58 0.42 184 XMLngstWrd_02 1854 0.36 0.23 0.41 185 HTML_IMAGE_ONLY_28 1853 0.54 0.87 0.41 186 HTML_IMAGE_ONLY_32 1805 0.37 0.27 0.40 187 RDNS_DYNAMIC 1802 0.50 0.76 0.40 188 XMDateMe_00 1793 0.38 0.33 0.40 189 XMSolicitRefs_0 1789 0.42 0.46 0.40 190 RELAYCOUNTRY_DE 1766 1.52 4.52 0.39 191 URI_NOVOWEL 1761 0.45 0.60 0.39 192 XMSubMetaSxObfu_03 1740 0.46 0.64 0.39 193 XMPhish14 1647 0.55 1.03 0.37 194 XMRcvdHeader_15 1630 0.27 0.00 0.36 195 SpammyFromTLD_02 1598 2.81 9.38 0.36 196 XM_Ancestry_Forge 1581 0.26 0.01 0.35 197 XMLKML 1557 0.25 0.00 0.35 198 NUMERIC_HTTP_ADDR 1539 1.43 4.32 0.34 199 HTML_IMAGE_ONLY_24 1531 0.77 1.91 0.34 200 FSL_THIS_IS_ADV 1523 0.32 0.25 0.34 ----------------------------------------------------------------------