Email: 682455 Autolearn: 0 AvgScore: 3.14 AvgScanTime: 2.14 sec Spam: 182816 Autolearn: 0 AvgScore: 12.04 AvgScanTime: 2.59 sec Ham: 499639 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.98 sec Time Spent Running SA: 406.52 hours Time Spent Processing Spam: 131.31 hours Time Spent Processing Ham: 275.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 165725 86.57 90.65 85.08 2 DCC_CHECK 137273 47.09 75.09 36.85 3 DKIM_SIGNED 134785 71.12 73.73 70.17 4 XMListUnsubscribeExists 130832 54.20 71.56 47.85 5 XM_DK_Pass 127799 69.17 69.91 68.90 6 DKIM_VALID 122049 65.80 66.76 65.45 7 DKIM_VALID_AU 98914 48.77 54.11 46.82 8 XM_H_QuotedFrom 90169 40.09 49.32 36.72 9 BAYES_50 74532 50.44 40.77 53.99 10 XM_DK_Undo_02 73588 20.05 40.25 12.66 11 BAYES_99 65219 17.77 35.67 11.22 12 FVGT_m_MULTI_ODD 60820 25.13 33.27 22.16 13 HTML_FONT_LOW_CONTRAST 60610 28.24 33.15 26.45 14 LOC_TINY_FONT_1 56982 23.19 31.17 20.27 15 BAYES_999 54555 15.28 29.84 9.95 16 MIME_HTML_ONLY 52181 21.64 28.54 19.11 17 TR_DCC_Bayes_99 52083 11.70 28.49 5.55 18 XMSubLong 49884 24.42 27.29 23.37 19 DCC_CHECK_NEGATIVE 42804 51.10 23.41 61.23 20 RELAYCOUNTRY_META 39761 10.90 21.75 6.93 21 T_TM2_M_HEADER_IN_MSG 38536 26.54 21.08 28.54 22 T_KAM_HTML_FONT_INVALID 36832 16.92 20.15 15.74 23 BOTNET 36541 6.66 19.99 1.78 24 DKIM_VALID_EF 35255 23.55 19.28 25.12 25 XM_Body_Dirty_Words 35110 14.16 19.21 12.31 26 XM_Multi_Part_URI 32175 13.38 17.60 11.83 27 MultiRelay 30280 17.26 16.56 17.51 28 BOTNET_IPINHOSTNAME 27249 7.28 14.91 4.49 29 LOTS_OF_MONEY 25201 10.75 13.78 9.64 30 XM_Evil_Numbers_Gen 24063 9.52 13.16 8.19 31 UNTRUSTED_Relay 21996 5.76 12.03 3.47 32 FSL_BULK_SIG 21670 7.69 11.85 6.17 33 HTML_IMAGE_RATIO_02 21483 8.82 11.75 7.75 34 LotsOfNums_01 18073 9.66 9.89 9.58 35 XMSexyCombo_05 15610 4.85 8.54 3.50 36 T_XMDrugObfuBody_14 15266 7.67 8.35 7.42 37 XM_B_Phish_Phrases 15086 5.80 8.25 4.90 38 XM_UncommonTLD01 15055 4.58 8.24 3.25 39 XMNumbers 14708 6.67 8.05 6.16 40 TooManyTo_001 13747 8.23 7.52 8.48 41 T_TooManySym_01 13632 8.67 7.46 9.11 42 HTML_IMAGE_RATIO_04 13556 6.08 7.42 5.60 43 XMSubMetaSx_00 13065 4.72 7.15 3.83 44 DKIM_INVALID 12736 5.32 6.97 4.72 45 XM_SPF_SoftFail 12002 3.03 6.57 1.74 46 ALL_TRUSTED 11865 15.57 6.49 18.89 47 BAYES_80 11648 4.39 6.37 3.67 48 DKIM_ADSP_NXDOMAIN 11559 2.19 6.32 0.68 49 MPART_ALT_DIFF 11367 3.98 6.22 3.16 50 XM_H_Long_From01 11322 6.03 6.19 5.97 51 MIME_QP_LONG_LINE 11166 6.06 6.11 6.04 52 BAYES_60 10439 6.33 5.71 6.56 53 TR_Symld_Words 9789 5.13 5.35 5.05 54 T_TooManySym_02 9401 5.32 5.14 5.39 55 XM_DIRTYINTL 9207 3.04 5.04 2.31 56 HTML_IMAGE_RATIO_06 8353 3.80 4.57 3.51 57 XM_H_SpoofStaff4 8268 4.03 4.52 3.85 58 XM_UB50 8197 2.74 4.48 2.10 59 XMSubject_78 8010 2.77 4.38 2.19 60 RELAYCOUNTRY_FR 7996 1.36 4.37 0.26 61 FROM_EXCESS_BASE64 7810 3.91 4.27 3.77 62 RELAYCOUNTRY_DE 7734 1.55 4.23 0.57 63 NUMERIC_HTTP_ADDR 7472 1.39 4.09 0.41 64 HTML_IMAGE_RATIO_08 7424 2.77 4.06 2.29 65 HTML_MIME_NO_HTML_TAG 7341 2.93 4.02 2.53 66 XMLngstWrd_00 7242 2.33 3.96 1.73 67 BAYES_95 7119 2.77 3.89 2.36 68 NORMAL_HTTP_TO_IP 6958 1.07 3.81 0.07 69 RCVD_IN_RP_SAFE 6816 7.86 3.73 9.37 70 REMOVE_BEFORE_LINK 6778 1.24 3.71 0.34 71 HELO_NODOT 6690 4.42 3.66 4.70 72 HELO_NO_DOMAIN 6664 4.42 3.65 4.70 73 MIME_HTML_MOSTLY 6404 2.36 3.50 1.95 74 MISSING_HEADERS 6360 3.48 3.48 3.48 75 T_REMOTE_IMAGE 6357 3.86 3.48 4.00 76 XM_OfRef6 6355 1.88 3.48 1.30 77 MIME_HTML_ONLY_MULTI 6335 2.21 3.47 1.76 78 RELAYCOUNTRY_CA 6320 1.91 3.46 1.34 79 XMLngstWrd_01 6185 1.95 3.38 1.43 80 XMStrtUSub 6065 3.78 3.32 3.94 81 URI_HEX 5926 2.31 3.24 1.96 82 XM_CamelCaseFrm001 5779 2.26 3.16 1.92 83 T_TooManySym_03 5776 2.01 3.16 1.59 84 SpammyFromTLD_02 5755 1.09 3.15 0.34 85 TM2_M_URI_OPT_OUT 5660 2.16 3.10 1.82 86 XMBdyGiftCard01 5596 1.42 3.06 0.82 87 XMHTML_After_End 5555 1.10 3.04 0.39 88 TR_LOTS_OF_MONEY1 5496 0.84 3.01 0.05 89 BAYES_40 5451 3.73 2.98 4.01 90 XMEmptySub 5400 2.10 2.95 1.79 91 XMMoneyMeta_00 5354 1.22 2.93 0.59 92 XM_URI_RBL 5322 1.12 2.91 0.46 93 XM_SendGrid 5289 4.96 2.89 5.72 94 RCVD_IN_RP_RNBL 5076 0.77 2.78 0.04 95 TR_LOTS_OF_MONEY3 4771 1.20 2.61 0.68 96 TR_XM_RelayPhish 4755 1.21 2.60 0.70 97 XMGappySubj_01 4670 1.48 2.55 1.09 98 RCVD_IN_RP_CERTIFIED 4662 6.92 2.55 8.52 99 SUBJ_ALL_CAPS 4638 1.90 2.54 1.66 100 FROM_SUSPICIOUS_NTLD 4619 0.73 2.53 0.07 101 BOTNET_NORDNS 4612 0.69 2.52 0.02 102 XMDiploma_00 4603 2.12 2.52 1.98 103 PDS_TO_EQ_FROM_NAME 4391 0.67 2.40 0.03 104 URIBL_DBL_ABUSE_REDIR 4363 0.74 2.39 0.13 105 RCVD_IN_MSPIKE_H2 4188 3.65 2.29 4.14 106 XMSubMetaSxObfu_03 4127 1.35 2.26 1.02 107 T_TooManySym_04 4104 1.07 2.24 0.63 108 XMSexyCombo_01 4070 0.98 2.23 0.53 109 RCVD_IN_BL_SPAMCOP_NET 3844 0.88 2.10 0.43 110 TR_XM_PHPDW 3801 1.10 2.08 0.74 111 REPLYTO_WITHOUT_TO_CC 3791 2.31 2.07 2.39 112 XMLngstWrd_02 3751 1.19 2.05 0.87 113 TR_XM_PHPForged 3750 1.07 2.05 0.72 114 TR_XM_FormFill2 3727 1.07 2.04 0.71 115 MultiRelay_CC 3703 0.66 2.03 0.16 116 MultiRelay_Combo 3703 0.66 2.03 0.16 117 XM_H_PHPOS 3702 1.06 2.02 0.71 118 XM_UB60 3588 1.02 1.96 0.67 119 ADVANCE_FEE_2_NEW_MONEY 3549 0.75 1.94 0.31 120 T_XMDrugObfuBody_08 3537 1.65 1.93 1.54 121 XMGappySubj_02 3507 1.06 1.92 0.75 122 SpammyFromTLD_01 3459 1.13 1.89 0.85 123 BAYES_20 3451 2.59 1.89 2.85 124 TM2_M_VERY_LONG_WORD 3291 1.21 1.80 1.00 125 DATE_IN_PAST_12_24 3286 0.51 1.80 0.03 126 HTML_TAG_BALANCE_BODY 3114 0.86 1.70 0.55 127 HTML_IMAGE_ONLY_20 3054 0.65 1.67 0.27 128 NO_DNS_FOR_FROM 2993 1.20 1.64 1.04 129 XMSubMetaI_00 2934 0.87 1.60 0.61 130 T_HTML_TAG_BALANCE_CENTER 2849 0.48 1.56 0.08 131 MAILING_LIST_MULTI 2842 2.22 1.55 2.46 132 XMGenDplmaNmb 2839 1.40 1.55 1.35 133 RCVD_IN_IADB_LISTED 2712 4.41 1.48 5.48 134 DATE_IN_PAST_03_06 2712 0.45 1.48 0.08 135 XMBody_17 2680 0.86 1.47 0.64 136 RELAYCOUNTRY_GB 2638 1.18 1.44 1.09 137 XM_OfRef7 2569 0.52 1.41 0.20 138 T_XMDrugObfuBody_00 2543 0.97 1.39 0.82 139 URI_TRY_3LD 2529 1.45 1.38 1.48 140 BAYES_00 2457 9.83 1.34 12.93 141 TR_XM_DK_SendGrid 2439 2.43 1.33 2.82 142 LUCRATIVE 2413 0.38 1.32 0.03 143 XMBody_78 2407 0.67 1.32 0.44 144 ANY_BOUNCE_MESSAGE 2387 2.22 1.31 2.56 145 BOUNCE_MESSAGE 2386 2.22 1.31 2.56 146 XMStockSpam_06 2385 1.24 1.30 1.21 147 FILL_THIS_FORM 2343 0.62 1.28 0.38 148 AMAZON_IMG_NOT_RCVD_AMZN 2325 0.37 1.27 0.05 149 XM_UB99 2295 0.34 1.26 0.01 150 RDNS_DYNAMIC 2207 0.61 1.21 0.39 151 XM_ProductURIs 2206 1.04 1.21 0.98 152 XMPhish11 2204 1.14 1.21 1.11 153 RELAYCOUNTRY_TR 2195 1.36 1.20 1.42 154 RCVD_IN_IADB_SPF 2178 3.87 1.19 4.86 155 XM_Lotto 2157 0.51 1.18 0.27 156 HK_SCAM 2087 0.75 1.14 0.61 157 FILL_THIS_FORM_LOAN 2078 0.51 1.14 0.28 158 XM_H_Long_From02 2070 1.26 1.13 1.31 159 RCVD_IN_IADB_SENDERID 2053 3.45 1.12 4.31 160 DATE_IN_PAST_06_12 2048 0.35 1.12 0.07 161 XMLngstWrd_03 2037 0.67 1.11 0.51 162 RCVD_IN_IADB_DK 2016 3.41 1.10 4.26 163 XM_UB80 2014 0.31 1.10 0.02 164 URIBL_BLACK 1997 0.33 1.09 0.05 165 UNPARSEABLE_RELAY 1989 2.08 1.09 2.44 166 XMPhish30 1947 0.62 1.07 0.46 167 BAYES_05 1947 1.74 1.07 1.98 168 DIET_1 1936 0.50 1.06 0.30 169 RELAYCOUNTRY_AU 1896 0.61 1.04 0.45 170 LongTLD 1877 0.40 1.03 0.17 171 HOSTED_IMG_DIRECT_MX 1869 0.27 1.02 0.00 172 XM_H_PHPMailer 1848 0.74 1.01 0.65 173 XM_UB999 1806 0.27 0.99 0.01 174 HTML_IMAGE_ONLY_28 1771 0.53 0.97 0.36 175 T_XMHurry_00 1768 0.84 0.97 0.79 176 XM_H_TOP 1766 0.26 0.97 0.01 177 T_Symld_Words_02 1763 0.77 0.96 0.70 178 TR_Caps_n_Bayes_99 1730 0.41 0.95 0.21 179 URI_NOVOWEL 1644 0.60 0.90 0.49 180 HTML_FONT_FACE_BAD 1602 0.62 0.88 0.53 181 RCVD_IN_IADB_VOUCHED 1599 2.70 0.87 3.37 182 XM_DK_Undo_01 1536 1.48 0.84 1.71 183 XMHTMLBadTable_001 1464 0.56 0.80 0.47 184 PLING_QUERY 1437 0.60 0.79 0.53 185 XMPhish14 1430 0.47 0.78 0.36 186 TR_M_TOP_BAYES 1417 0.21 0.78 0.00 187 XMBrknScrpt_02 1403 0.65 0.77 0.61 188 TVD_RCVD_IP 1390 1.71 0.76 2.06 189 BODY_ENHANCEMENT 1379 0.22 0.75 0.03 190 RELAYCOUNTRY_IN 1376 0.28 0.75 0.10 191 XMSexyCombo_04 1358 0.26 0.74 0.08 192 FILL_THIS_FORM_LONG 1349 0.41 0.74 0.29 193 SUBJ_DOLLARS 1341 0.57 0.73 0.51 194 XM_H_PHPOS_M 1340 0.31 0.73 0.16 195 XM_B_REG_HTML 1322 0.47 0.72 0.38 196 RELAYCOUNTRY_AT 1297 0.31 0.71 0.17 197 XM_XX_Yahoo 1257 0.26 0.69 0.11 198 T_FILL_THIS_FORM_SHORT 1239 0.78 0.68 0.82 199 TR_MetaPhish_Combo_01 1234 1.36 0.67 1.61 200 SHORT_URI_3 1223 0.30 0.67 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 425110 86.57 90.65 85.08 2 DKIM_SIGNED 350577 71.12 73.73 70.17 3 XM_DK_Pass 344239 69.17 69.91 68.90 4 DKIM_VALID 327019 65.80 66.76 65.45 5 DCC_CHECK_NEGATIVE 305943 51.10 23.41 61.23 6 BAYES_50 269731 50.44 40.77 53.99 7 XMListUnsubscribeExists 239064 54.20 71.56 47.85 8 DKIM_VALID_AU 233927 48.77 54.11 46.82 9 DCC_CHECK 184121 47.09 75.09 36.85 10 XM_H_QuotedFrom 183443 40.09 49.32 36.72 11 T_TM2_M_HEADER_IN_MSG 142581 26.54 21.08 28.54 12 HTML_FONT_LOW_CONTRAST 132137 28.24 33.15 26.45 13 DKIM_VALID_EF 125491 23.55 19.28 25.12 14 XMSubLong 116781 24.42 27.29 23.37 15 FVGT_m_MULTI_ODD 110713 25.13 33.27 22.16 16 LOC_TINY_FONT_1 101292 23.19 31.17 20.27 17 MIME_HTML_ONLY 95475 21.64 28.54 19.11 18 ALL_TRUSTED 94398 15.57 6.49 18.89 19 MultiRelay 87492 17.26 16.56 17.51 20 T_KAM_HTML_FONT_INVALID 78667 16.92 20.15 15.74 21 BAYES_00 64616 9.83 1.34 12.93 22 XM_DK_Undo_02 63244 20.05 40.25 12.66 23 XM_Body_Dirty_Words 61516 14.16 19.21 12.31 24 XM_Multi_Part_URI 59111 13.38 17.60 11.83 25 XM_DKIMWhitelistDomains 57249 8.39 0.02 11.46 26 BAYES_99 56056 17.77 35.67 11.22 27 BAYES_999 49729 15.28 29.84 9.95 28 TR_XM_DK_Bayes 49299 7.39 0.63 9.87 29 LOTS_OF_MONEY 48149 10.75 13.78 9.64 30 LotsOfNums_01 47884 9.66 9.89 9.58 31 TR_XM_DK_Bayes1 46897 7.02 0.55 9.39 32 RCVD_IN_RP_SAFE 46795 7.86 3.73 9.37 33 T_TooManySym_01 45511 8.67 7.46 9.11 34 RCVD_IN_RP_CERTIFIED 42573 6.92 2.55 8.52 35 TooManyTo_001 42385 8.23 7.52 8.48 36 XM_Evil_Numbers_Gen 40930 9.52 13.16 8.19 37 TR_XM_DK_Bayes2 40381 6.05 0.50 8.08 38 HTML_IMAGE_RATIO_02 38724 8.82 11.75 7.75 39 T_XMDrugObfuBody_14 37065 7.67 8.35 7.42 40 RELAYCOUNTRY_META 34631 10.90 21.75 6.93 41 BAYES_60 32785 6.33 5.71 6.56 42 FSL_BULK_SIG 30836 7.69 11.85 6.17 43 XMNumbers 30796 6.67 8.05 6.16 44 MIME_QP_LONG_LINE 30190 6.06 6.11 6.04 45 XM_H_Long_From01 29837 6.03 6.19 5.97 46 XM_SendGrid 28590 4.96 2.89 5.72 47 HTML_IMAGE_RATIO_04 27969 6.08 7.42 5.60 48 TR_DCC_Bayes_99 27731 11.70 28.49 5.55 49 RCVD_IN_IADB_LISTED 27386 4.41 1.48 5.48 50 T_TooManySym_02 26906 5.32 5.14 5.39 51 TR_Symld_Words 25252 5.13 5.35 5.05 52 XM_B_Phish_Phrases 24467 5.80 8.25 4.90 53 RCVD_IN_IADB_SPF 24260 3.87 1.19 4.86 54 XM_PDF 23585 3.61 0.56 4.72 55 DKIM_INVALID 23558 5.32 6.97 4.72 56 HELO_NODOT 23488 4.42 3.66 4.70 57 HELO_NO_DOMAIN 23487 4.42 3.65 4.70 58 BOTNET_IPINHOSTNAME 22410 7.28 14.91 4.49 59 RCVD_IN_IADB_SENDERID 21523 3.45 1.12 4.31 60 RCVD_IN_IADB_DK 21270 3.41 1.10 4.26 61 RCVD_IN_MSPIKE_H2 20702 3.65 2.29 4.14 62 BAYES_40 20024 3.73 2.98 4.01 63 T_REMOTE_IMAGE 19997 3.86 3.48 4.00 64 XMStrtUSub 19698 3.78 3.32 3.94 65 XM_H_SpoofStaff4 19252 4.03 4.52 3.85 66 XMSubMetaSx_00 19129 4.72 7.15 3.83 67 FROM_EXCESS_BASE64 18857 3.91 4.27 3.77 68 IN_ZIMBRA_NJ_WHITELIST 18836 2.77 0.02 3.77 69 BAYES_80 18330 4.39 6.37 3.67 70 TO_MALFORMED 17785 2.65 0.17 3.56 71 HTML_IMAGE_RATIO_06 17557 3.80 4.57 3.51 72 XMSexyCombo_05 17468 4.85 8.54 3.50 73 MISSING_HEADERS 17371 3.48 3.48 3.48 74 UNTRUSTED_Relay 17344 5.76 12.03 3.47 75 RCVD_IN_IADB_VOUCHED 16817 2.70 0.87 3.37 76 XM_UncommonTLD01 16218 4.58 8.24 3.25 77 MPART_ALT_DIFF 15788 3.98 6.22 3.16 78 BAYES_20 14242 2.59 1.89 2.85 79 TR_XM_DK_SendGrid 14112 2.43 1.33 2.82 80 ANY_BOUNCE_MESSAGE 12784 2.22 1.31 2.56 81 BOUNCE_MESSAGE 12779 2.22 1.31 2.56 82 HTML_MIME_NO_HTML_TAG 12645 2.93 4.02 2.53 83 MAILING_LIST_MULTI 12283 2.22 1.55 2.46 84 UNPARSEABLE_RELAY 12201 2.08 1.09 2.44 85 REPLYTO_WITHOUT_TO_CC 11962 2.31 2.07 2.39 86 BAYES_95 11779 2.77 3.89 2.36 87 XM_DIRTYINTL 11524 3.04 5.04 2.31 88 TooManyTo_002 11496 1.83 0.53 2.30 89 HTML_IMAGE_RATIO_08 11446 2.77 4.06 2.29 90 XMSubject_78 10928 2.77 4.38 2.19 91 XM_UB50 10495 2.74 4.48 2.10 92 RCVD_IN_IADB_OPTIN 10489 1.68 0.54 2.10 93 TVD_RCVD_IP 10300 1.71 0.76 2.06 94 BAYES_05 9910 1.74 1.07 1.98 95 XMDiploma_00 9869 2.12 2.52 1.98 96 URI_HEX 9808 2.31 3.24 1.96 97 MIME_HTML_MOSTLY 9725 2.36 3.50 1.95 98 XM_CamelCaseFrm001 9611 2.26 3.16 1.92 99 RCVD_IN_MSPIKE_WL 9512 1.49 0.35 1.90 100 RCVD_IN_MSPIKE_H3 9507 1.49 0.35 1.90 101 TM2_M_URI_OPT_OUT 9094 2.16 3.10 1.82 102 XMEmptySub 8957 2.10 2.95 1.79 103 BOTNET 8914 6.66 19.99 1.78 104 MIME_HTML_ONLY_MULTI 8770 2.21 3.47 1.76 105 XM_SPF_SoftFail 8678 3.03 6.57 1.74 106 XMLngstWrd_00 8629 2.33 3.96 1.73 107 XM_DK_Undo_01 8536 1.48 0.84 1.71 108 SUBJ_ALL_CAPS 8300 1.90 2.54 1.66 109 TR_MetaPhish_Combo_01 8035 1.36 0.67 1.61 110 IN_HORDE_ADDRESS_BOOK 7991 1.18 0.03 1.60 111 T_TooManySym_03 7969 2.01 3.16 1.59 112 TooManyTo_003 7758 1.25 0.41 1.55 113 T_XMDrugObfuBody_08 7705 1.65 1.93 1.54 114 INVALID_MSGID 7589 1.14 0.10 1.52 115 URI_TRY_3LD 7372 1.45 1.38 1.48 116 XMLngstWrd_01 7149 1.95 3.38 1.43 117 RELAYCOUNTRY_TR 7116 1.36 1.20 1.42 118 XMGenDplmaNmb 6746 1.40 1.55 1.35 119 RELAYCOUNTRY_CA 6701 1.91 3.46 1.34 120 XMCapTrack 6664 1.06 0.33 1.33 121 XM_H_Long_From02 6525 1.26 1.13 1.31 122 XM_OfRef6 6484 1.88 3.48 1.30 123 XMStockSpam_06 6055 1.24 1.30 1.21 124 XM_GoogleGroups 5601 0.93 0.42 1.12 125 XMPhish11 5557 1.14 1.21 1.11 126 TooManyTo_004 5554 0.90 0.33 1.11 127 XMGappySubj_01 5456 1.48 2.55 1.09 128 RELAYCOUNTRY_GB 5424 1.18 1.44 1.09 129 NO_DNS_FOR_FROM 5177 1.20 1.64 1.04 130 XMSubMetaSxObfu_03 5104 1.35 2.26 1.02 131 TM2_M_VERY_LONG_WORD 4990 1.21 1.80 1.00 132 USER_IN_DEF_DKIM_WL 4985 0.73 0.00 1.00 133 DKIM_ADSP_CUSTOM_MED 4893 0.89 0.63 0.98 134 XM_ProductURIs 4892 1.04 1.21 0.98 135 XMSubNoVowel 4708 0.85 0.61 0.94 136 TooManyTo_005 4450 0.73 0.29 0.89 137 XMLngstWrd_02 4340 1.19 2.05 0.87 138 SpammyFromTLD_01 4257 1.13 1.89 0.85 139 XMBdyGiftCard01 4103 1.42 3.06 0.82 140 T_XMDrugObfuBody_00 4101 0.97 1.39 0.82 141 T_FILL_THIS_FORM_SHORT 4101 0.78 0.68 0.82 142 HTTPS_HTTP_MISMATCH 4061 0.72 0.47 0.81 143 T_XMHurry_00 3958 0.84 0.97 0.79 144 XMGappySubj_02 3730 1.06 1.92 0.75 145 TR_XM_PHPDW 3674 1.10 2.08 0.74 146 TR_XM_PHPForged 3584 1.07 2.05 0.72 147 TR_XM_FormFill2 3568 1.07 2.04 0.71 148 XM_H_PHPOS 3544 1.06 2.02 0.71 149 T_Symld_Words_02 3516 0.77 0.96 0.70 150 TR_XM_RelayPhish 3474 1.21 2.60 0.70 151 DKIM_ADSP_NXDOMAIN 3420 2.19 6.32 0.68 152 TR_LOTS_OF_MONEY3 3390 1.20 2.61 0.68 153 XMNoVowels 3372 0.66 0.64 0.67 154 XM_UB60 3346 1.02 1.96 0.67 155 T_OBFU_PDF_ATTACH 3296 0.53 0.18 0.66 156 NML_ADSP_CUSTOM_MED 3278 0.64 0.59 0.66 157 XM_H_PHPMailer 3229 0.74 1.01 0.65 158 XMBody_17 3208 0.86 1.47 0.64 159 T_TooManySym_04 3168 1.07 2.24 0.63 160 XMSubEmpty 3143 0.50 0.15 0.63 161 HK_SCAM 3053 0.75 1.14 0.61 162 XMBrknScrpt_02 3044 0.65 0.77 0.61 163 XMSubMetaI_00 3029 0.87 1.60 0.61 164 TM2_M_A_HREF_HREF 2984 0.56 0.46 0.60 165 XMMoneyMeta_00 2943 1.22 2.93 0.59 166 RELAYCOUNTRY_DE 2849 1.55 4.23 0.57 167 XM_ShortIntro_01 2778 0.47 0.22 0.56 168 HTML_TAG_BALANCE_BODY 2744 0.86 1.70 0.55 169 XMSexyCombo_01 2646 0.98 2.23 0.53 170 PLING_QUERY 2642 0.60 0.79 0.53 171 HTML_FONT_FACE_BAD 2633 0.62 0.88 0.53 172 XMBody_95 2594 0.41 0.11 0.52 173 FROM_GOV_SPOOF 2558 0.41 0.13 0.51 174 XMLngstWrd_03 2533 0.67 1.11 0.51 175 SUBJ_DOLLARS 2524 0.57 0.73 0.51 176 USER_IN_WHITELIST 2460 0.36 0.00 0.49 177 URI_NOVOWEL 2448 0.60 0.90 0.49 178 TM2_M_BODY_EMPTY 2438 0.43 0.28 0.49 179 SHORT_HELO_AND_INLINE_IMAGE 2374 0.36 0.03 0.48 180 XMHTMLBadTable_001 2346 0.56 0.80 0.47 181 XMPhish30 2318 0.62 1.07 0.46 182 FORGED_GMAIL_RCVD 2306 0.47 0.48 0.46 183 XM_URI_RBL 2288 1.12 2.91 0.46 184 RELAYCOUNTRY_AU 2244 0.61 1.04 0.45 185 XMBody_78 2197 0.67 1.32 0.44 186 XMSlimDrugH 2187 0.50 0.66 0.44 187 RCVD_IN_BL_SPAMCOP_NET 2139 0.88 2.10 0.43 188 BASE64_LENGTH_79_INF 2036 0.32 0.08 0.41 189 NUMERIC_HTTP_ADDR 2031 1.39 4.09 0.41 190 XM_B_COPY_HTML 1955 0.45 0.63 0.39 191 XMHTML_After_End 1953 1.10 3.04 0.39 192 RDNS_DYNAMIC 1930 0.61 1.21 0.39 193 XM_B_REG_HTML 1898 0.47 0.72 0.38 194 FILL_THIS_FORM 1893 0.62 1.28 0.38 195 XMDateMe_00 1871 0.36 0.30 0.37 196 XMSubMetaSxObfu_02 1859 0.34 0.26 0.37 197 XMLngstWrd_04 1844 0.38 0.42 0.37 198 HTML_IMAGE_ONLY_32 1834 0.38 0.41 0.37 199 FROM_GOV_DKIM_AU 1827 0.29 0.10 0.37 200 HTML_IMAGE_ONLY_28 1818 0.53 0.97 0.36 ----------------------------------------------------------------------