Email: 617188 Autolearn: 0 AvgScore: 2.49 AvgScanTime: 1.99 sec Spam: 150619 Autolearn: 0 AvgScore: 12.62 AvgScanTime: 2.47 sec Ham: 466569 Autolearn: 0 AvgScore: -0.78 AvgScanTime: 1.84 sec Time Spent Running SA: 341.62 hours Time Spent Processing Spam: 103.15 hours Time Spent Processing Ham: 238.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140518 89.36 93.29 88.09 2 DCC_CHECK 116701 47.24 77.48 37.48 3 DKIM_SIGNED 116549 71.06 77.38 69.01 4 XM_DK_Pass 111158 69.09 73.80 67.57 5 XMListUnsubscribeExists 110318 51.38 73.24 44.32 6 DKIM_VALID 105083 65.38 69.77 63.96 7 DKIM_VALID_AU 83779 48.98 55.62 46.84 8 XM_H_QuotedFrom 70532 36.78 46.83 33.54 9 XM_DK_Undo_02 67023 20.25 44.50 12.42 10 BAYES_99 62029 18.38 41.18 11.01 11 BAYES_999 52657 15.88 34.96 9.73 12 BAYES_50 52401 49.12 34.79 53.75 13 HTML_FONT_LOW_CONTRAST 50953 27.90 33.83 25.99 14 TR_DCC_Bayes_99 49475 12.06 32.85 5.35 15 MIME_HTML_ONLY 47997 25.20 31.87 23.05 16 LOC_TINY_FONT_1 47820 23.42 31.75 20.73 17 FVGT_m_MULTI_ODD 43273 21.76 28.73 19.51 18 XMSubLong 37985 22.67 25.22 21.85 19 RELAYCOUNTRY_META 31530 8.72 20.93 4.77 20 DCC_CHECK_NEGATIVE 31137 50.86 20.67 60.61 21 XM_Body_Dirty_Words 30652 14.11 20.35 12.10 22 BOTNET 30470 6.31 20.23 1.82 23 T_KAM_HTML_FONT_INVALID 30379 16.29 20.17 15.03 24 T_TM2_M_HEADER_IN_MSG 30024 27.57 19.93 30.04 25 DKIM_VALID_EF 28204 23.95 18.73 25.64 26 BOTNET_IPINHOSTNAME 27243 7.89 18.09 4.60 27 MultiRelay 25479 18.06 16.92 18.43 28 XM_Multi_Part_URI 25006 11.97 16.60 10.48 29 HTML_IMAGE_RATIO_02 21873 10.43 14.52 9.11 30 XM_Evil_Numbers_Gen 21223 9.75 14.09 8.35 31 UNTRUSTED_Relay 19315 4.14 12.82 1.34 32 LOTS_OF_MONEY 18839 9.57 12.51 8.62 33 FSL_BULK_SIG 17869 9.89 11.86 9.25 34 XM_UncommonTLD01 17526 5.46 11.64 3.47 35 XMSexyCombo_05 16819 5.39 11.17 3.52 36 T_XMDrugObfuBody_14 14733 8.07 9.78 7.51 37 XM_B_Phish_Phrases 12437 6.34 8.26 5.73 38 XM_H_Long_From01 11743 6.15 7.80 5.62 39 TooManyTo_001 11651 8.69 7.74 9.00 40 DKIM_INVALID 11466 5.68 7.61 5.05 41 LotsOfNums_01 11067 7.97 7.35 8.17 42 BAYES_80 10554 4.29 7.01 3.41 43 MPART_ALT_DIFF 10044 3.81 6.67 2.88 44 XMSubMetaSx_00 9911 4.47 6.58 3.79 45 XM_UB50 9650 2.17 6.41 0.80 46 BAYES_60 9274 5.87 6.16 5.78 47 XM_DIRTYINTL 8479 3.15 5.63 2.35 48 FROM_EXCESS_BASE64 8231 7.32 5.46 7.91 49 HTML_IMAGE_RATIO_04 8225 5.31 5.46 5.26 50 XM_SPF_SoftFail 7903 2.79 5.25 2.00 51 XMNumbers 7412 6.60 4.92 7.14 52 DKIM_ADSP_NXDOMAIN 6828 1.52 4.53 0.55 53 RCVD_IN_RP_SAFE 6698 8.21 4.45 9.43 54 BAYES_95 6217 2.78 4.13 2.34 55 XM_URI_RBL 6208 1.37 4.12 0.48 56 HTML_MIME_NO_HTML_TAG 6123 3.10 4.07 2.79 57 RCVD_IN_BL_SPAMCOP_NET 6120 1.30 4.06 0.41 58 RELAYCOUNTRY_CA 5957 1.92 3.96 1.26 59 MIME_HTML_MOSTLY 5942 2.71 3.95 2.31 60 MIME_QP_LONG_LINE 5906 5.04 3.92 5.40 61 RELAYCOUNTRY_FR 5892 1.14 3.91 0.25 62 ALL_TRUSTED 5877 16.69 3.90 20.82 63 URI_HEX 5709 2.02 3.79 1.44 64 FROM_SUSPICIOUS_NTLD 5556 0.98 3.69 0.11 65 T_TooManySym_01 5492 4.90 3.65 5.31 66 XMBdyGiftCard01 5464 1.56 3.63 0.89 67 NUMERIC_HTTP_ADDR 5356 1.09 3.56 0.29 68 HTML_IMAGE_RATIO_08 5347 2.73 3.55 2.47 69 XM_SendGrid 5320 5.20 3.53 5.73 70 HTML_IMAGE_RATIO_06 5170 2.99 3.43 2.85 71 RELAYCOUNTRY_DE 5165 1.16 3.43 0.43 72 RCVD_IN_RP_CERTIFIED 5154 7.32 3.42 8.58 73 BOTNET_NORDNS 5152 0.85 3.42 0.02 74 XM_CamelCaseFrm001 4907 2.13 3.26 1.77 75 XMStrtUSub 4884 4.86 3.24 5.38 76 TM2_M_URI_OPT_OUT 4857 2.15 3.22 1.80 77 XM_OfRef6 4833 1.71 3.21 1.22 78 MIME_HTML_ONLY_MULTI 4772 1.68 3.17 1.20 79 XMDiploma_00 4762 2.47 3.16 2.25 80 NORMAL_HTTP_TO_IP 4616 0.80 3.06 0.07 81 T_REMOTE_IMAGE 4504 4.15 2.99 4.52 82 TR_XM_PHPDW 4399 1.66 2.92 1.25 83 TR_XM_PHPForged 4357 1.64 2.89 1.24 84 BAYES_40 4340 3.85 2.88 4.17 85 TR_XM_FormFill2 4305 1.63 2.86 1.23 86 XM_H_PHPOS 4281 1.62 2.84 1.23 87 MultiRelay_Combo 3925 0.76 2.61 0.16 88 MultiRelay_CC 3925 0.76 2.61 0.16 89 T_XMDrugObfuBody_08 3899 1.58 2.59 1.26 90 SUBJ_ALL_CAPS 3872 2.14 2.57 2.00 91 XMBrknScrpt_02 3841 1.15 2.55 0.70 92 SpammyFromTLD_02 3596 0.76 2.39 0.23 93 RCVD_IN_RP_RNBL 3532 0.60 2.34 0.04 94 TR_XM_RelayPhish 3420 1.22 2.27 0.88 95 NO_DNS_FOR_FROM 3398 1.41 2.26 1.14 96 RCVD_IN_MSPIKE_H2 3395 3.73 2.25 4.21 97 XMMoneyMeta_00 3345 1.00 2.22 0.61 98 URI_NOVOWEL 3342 0.83 2.22 0.38 99 XMBody_17 3279 1.06 2.18 0.71 100 XMStockSpam_06 3102 1.57 2.06 1.41 101 HTML_TAG_BALANCE_BODY 3089 0.93 2.05 0.57 102 XMGenDplmaNmb 2989 1.60 1.98 1.47 103 URIBL_DBL_ABUSE_REDIR 2979 0.51 1.98 0.04 104 PDS_TO_EQ_FROM_NAME 2953 0.51 1.96 0.04 105 XM_ProductURIs 2825 1.06 1.88 0.79 106 BAYES_20 2768 2.87 1.84 3.21 107 XM_UB99 2766 0.45 1.84 0.01 108 MISSING_HEADERS 2729 0.88 1.81 0.58 109 XMLngstWrd_00 2685 0.88 1.78 0.58 110 TR_XM_DK_SendGrid 2648 2.75 1.76 3.06 111 XMLngstWrd_01 2628 0.84 1.74 0.55 112 XMBody_78 2584 0.69 1.72 0.36 113 XMSexyCombo_01 2549 0.82 1.69 0.54 114 T_Symld_Words_02 2540 0.87 1.69 0.61 115 XM_H_PHPMailer 2514 0.85 1.67 0.58 116 XMLngstWrd_02 2508 0.59 1.67 0.24 117 PP_MIME_FAKE_ASCII_TEXT 2503 0.54 1.66 0.18 118 SpammyFromTLD_01 2415 1.01 1.60 0.81 119 XMLngstWrd_03 2390 0.51 1.59 0.17 120 TM2_M_VERY_LONG_WORD 2378 1.30 1.58 1.21 121 UNPARSEABLE_RELAY 2365 2.31 1.57 2.54 122 RCVD_IN_IADB_LISTED 2309 4.15 1.53 4.99 123 T_XMHurry_00 2299 0.82 1.53 0.59 124 REMOVE_BEFORE_LINK 2297 0.62 1.53 0.33 125 XM_UB999 2295 0.38 1.52 0.01 126 XMSubEmpty 2258 0.59 1.50 0.29 127 MAILING_LIST_MULTI 2233 2.03 1.48 2.21 128 XM_H_Long_From02 2201 1.05 1.46 0.92 129 XMNoSubject 2137 0.40 1.42 0.07 130 MISSING_SUBJECT 2137 0.40 1.42 0.07 131 XMSubMetaI_00 2126 0.74 1.41 0.52 132 SUBJ_DOLLARS 2075 0.52 1.38 0.24 133 XM_H_PHPOS_M 1995 0.51 1.32 0.25 134 XM_B_REG_HTML 1986 0.61 1.32 0.39 135 FILL_THIS_FORM 1971 0.78 1.31 0.62 136 RCVD_IN_IADB_SPF 1964 3.64 1.30 4.39 137 MISSING_FROM 1956 0.32 1.30 0.00 138 T_XMDrugObfuBody_00 1895 0.85 1.26 0.71 139 DIET_1 1893 0.55 1.26 0.32 140 XMPhish11 1891 1.18 1.26 1.16 141 XM_UB60 1840 0.35 1.22 0.07 142 BODY_URI_ONLY 1840 0.39 1.22 0.12 143 DATE_IN_PAST_03_06 1826 0.35 1.21 0.08 144 RCVD_IN_IADB_SENDERID 1811 3.20 1.20 3.85 145 TR_Symld_Words 1797 1.38 1.19 1.44 146 RCVD_IN_IADB_DK 1768 3.17 1.17 3.82 147 XMHTML_After_End 1767 0.57 1.17 0.38 148 XM_HighProb1 1755 0.29 1.17 0.01 149 XMPhish30 1736 0.64 1.15 0.48 150 XM_OfRef7 1734 0.41 1.15 0.17 151 URI_TRY_3LD 1724 1.17 1.14 1.17 152 DKIM_ADSP_CUSTOM_MED 1687 1.08 1.12 1.07 153 TR_Caps_n_Bayes_99 1636 0.57 1.09 0.40 154 RELAYCOUNTRY_JP 1633 0.29 1.08 0.03 155 XM_DK_Undo_01 1621 1.66 1.08 1.85 156 RDNS_DYNAMIC 1611 0.55 1.07 0.39 157 T_HTML_TAG_BALANCE_CENTER 1581 0.33 1.05 0.10 158 NML_ADSP_CUSTOM_MED 1571 0.80 1.04 0.73 159 XM_UB80 1565 0.27 1.04 0.02 160 RELAYCOUNTRY_AT 1557 0.40 1.03 0.20 161 XM_RXBody 1554 0.46 1.03 0.28 162 FILL_THIS_FORM_LOAN 1553 0.47 1.03 0.29 163 TR_LOTS_OF_MONEY2 1516 0.55 1.01 0.40 164 T_MONEY_PERCENT 1516 0.55 1.01 0.40 165 FSL_THIS_IS_ADV 1510 0.51 1.00 0.35 166 BAYES_05 1468 1.77 0.97 2.03 167 T_TooManySym_02 1435 1.55 0.95 1.74 168 HTML_IMAGE_ONLY_28 1423 0.52 0.94 0.38 169 URIBL_BLACK 1422 0.27 0.94 0.05 170 FORGED_GMAIL_RCVD 1407 0.60 0.93 0.49 171 RCVD_IN_IADB_VOUCHED 1404 2.58 0.93 3.11 172 URIBL_DBL_SPAM 1393 0.24 0.92 0.01 173 T_FILL_THIS_FORM_SHORT 1386 0.83 0.92 0.80 174 XM_B_SpammyTLD 1379 0.77 0.92 0.72 175 RELAYCOUNTRY_GB 1369 1.05 0.91 1.10 176 LongTLD 1356 0.36 0.90 0.19 177 TR_Mismatch_TLD_02 1331 0.28 0.88 0.09 178 HTML_FONT_FACE_BAD 1293 0.61 0.86 0.53 179 XMSubMetaSxObfu_03 1270 0.55 0.84 0.46 180 TO_NO_BRKTS_PCNT 1266 0.21 0.84 0.00 181 FILL_THIS_FORM_LONG 1264 0.43 0.84 0.30 182 BAYES_00 1241 10.77 0.82 13.99 183 DATE_IN_PAST_06_12 1211 0.24 0.80 0.06 184 MIME_HEADER_CTYPE_ONLY 1185 0.31 0.79 0.15 185 REPLYTO_WITHOUT_TO_CC 1178 0.24 0.78 0.06 186 XMSubGiftCard1 1172 0.28 0.78 0.11 187 TooManyTo_002 1151 2.22 0.76 2.69 188 LONG_JUNK_URI 1132 0.27 0.75 0.11 189 XM_H_Undi_Recip 1130 0.42 0.75 0.31 190 TR_MetaPhish_Combo_01 1122 1.63 0.74 1.92 191 XMHTMLBadTable_001 1119 0.46 0.74 0.37 192 XM_PDF 1103 4.16 0.73 5.26 193 XMSlimDrugH 1089 0.42 0.72 0.32 194 XMGppyBdWords 1076 0.35 0.71 0.23 195 XM_XX_Yahoo 1071 0.28 0.71 0.14 196 MPART_ALT_DIFF_COUNT 1068 0.34 0.71 0.23 197 TM2_M_A_HREF_HREF 1056 0.44 0.70 0.35 198 FROM_MISSP_REPLYTO 1021 0.17 0.68 0.01 199 SHORT_URI_3 1006 0.27 0.67 0.14 200 TR_LOTS_OF_MONEY3 1005 0.39 0.67 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 411001 89.36 93.29 88.09 2 DKIM_SIGNED 321997 71.06 77.38 69.01 3 XM_DK_Pass 315272 69.09 73.80 67.57 4 DKIM_VALID 298424 65.38 69.77 63.96 5 DCC_CHECK_NEGATIVE 282784 50.86 20.67 60.61 6 BAYES_50 250776 49.12 34.79 53.75 7 DKIM_VALID_AU 218525 48.98 55.62 46.84 8 XMListUnsubscribeExists 206777 51.38 73.24 44.32 9 DCC_CHECK 174864 47.24 77.48 37.48 10 XM_H_QuotedFrom 156471 36.78 46.83 33.54 11 T_TM2_M_HEADER_IN_MSG 140137 27.57 19.93 30.04 12 HTML_FONT_LOW_CONTRAST 121256 27.90 33.83 25.99 13 DKIM_VALID_EF 119625 23.95 18.73 25.64 14 MIME_HTML_ONLY 107527 25.20 31.87 23.05 15 XMSubLong 101939 22.67 25.22 21.85 16 ALL_TRUSTED 97139 16.69 3.90 20.82 17 LOC_TINY_FONT_1 96737 23.42 31.75 20.73 18 FVGT_m_MULTI_ODD 91019 21.76 28.73 19.51 19 MultiRelay 86005 18.06 16.92 18.43 20 T_KAM_HTML_FONT_INVALID 70146 16.29 20.17 15.03 21 BAYES_00 65251 10.77 0.82 13.99 22 XM_DK_Undo_02 57933 20.25 44.50 12.42 23 XM_Body_Dirty_Words 56460 14.11 20.35 12.10 24 XM_DKIMWhitelistDomains 51640 8.37 0.02 11.07 25 BAYES_99 51392 18.38 41.18 11.01 26 XM_Multi_Part_URI 48876 11.97 16.60 10.48 27 BAYES_999 45378 15.88 34.96 9.73 28 TR_XM_DK_Bayes 45315 7.45 0.45 9.71 29 RCVD_IN_RP_SAFE 44002 8.21 4.45 9.43 30 FSL_BULK_SIG 43157 9.89 11.86 9.25 31 TR_XM_DK_Bayes1 42871 7.03 0.36 9.19 32 HTML_IMAGE_RATIO_02 42494 10.43 14.52 9.11 33 TooManyTo_001 41980 8.69 7.74 9.00 34 LOTS_OF_MONEY 40202 9.57 12.51 8.62 35 RCVD_IN_RP_CERTIFIED 40031 7.32 3.42 8.58 36 XM_Evil_Numbers_Gen 38937 9.75 14.09 8.35 37 LotsOfNums_01 38101 7.97 7.35 8.17 38 FROM_EXCESS_BASE64 36926 7.32 5.46 7.91 39 TR_XM_DK_Bayes2 36639 6.02 0.35 7.85 40 T_XMDrugObfuBody_14 35045 8.07 9.78 7.51 41 XMNumbers 33299 6.60 4.92 7.14 42 BAYES_60 26972 5.87 6.16 5.78 43 XM_SendGrid 26747 5.20 3.53 5.73 44 XM_B_Phish_Phrases 26716 6.34 8.26 5.73 45 XM_H_Long_From01 26204 6.15 7.80 5.62 46 MIME_QP_LONG_LINE 25209 5.04 3.92 5.40 47 XMStrtUSub 25105 4.86 3.24 5.38 48 TR_DCC_Bayes_99 24950 12.06 32.85 5.35 49 T_TooManySym_01 24754 4.90 3.65 5.31 50 XM_PDF 24562 4.16 0.73 5.26 51 HTML_IMAGE_RATIO_04 24536 5.31 5.46 5.26 52 IN_ZIMBRA_NJ_WHITELIST 24044 3.90 0.02 5.15 53 DKIM_INVALID 23573 5.68 7.61 5.05 54 RCVD_IN_IADB_LISTED 23297 4.15 1.53 4.99 55 RELAYCOUNTRY_META 22268 8.72 20.93 4.77 56 BOTNET_IPINHOSTNAME 21468 7.89 18.09 4.60 57 T_REMOTE_IMAGE 21100 4.15 2.99 4.52 58 RCVD_IN_IADB_SPF 20503 3.64 1.30 4.39 59 RCVD_IN_MSPIKE_H2 19629 3.73 2.25 4.21 60 BAYES_40 19446 3.85 2.88 4.17 61 RCVD_IN_IADB_SENDERID 17942 3.20 1.20 3.85 62 RCVD_IN_IADB_DK 17813 3.17 1.17 3.82 63 TO_MALFORMED 17719 2.88 0.05 3.80 64 XMSubMetaSx_00 17679 4.47 6.58 3.79 65 XMSexyCombo_05 16417 5.39 11.17 3.52 66 XM_UncommonTLD01 16182 5.46 11.64 3.47 67 BAYES_80 15918 4.29 7.01 3.41 68 BAYES_20 14955 2.87 1.84 3.21 69 RCVD_IN_IADB_VOUCHED 14509 2.58 0.93 3.11 70 TR_XM_DK_SendGrid 14296 2.75 1.76 3.06 71 MPART_ALT_DIFF 13452 3.81 6.67 2.88 72 HTML_IMAGE_RATIO_06 13286 2.99 3.43 2.85 73 HTML_MIME_NO_HTML_TAG 13001 3.10 4.07 2.79 74 TooManyTo_002 12532 2.22 0.76 2.69 75 UNPARSEABLE_RELAY 11873 2.31 1.57 2.54 76 HTML_IMAGE_RATIO_08 11517 2.73 3.55 2.47 77 XM_DIRTYINTL 10964 3.15 5.63 2.35 78 BAYES_95 10912 2.78 4.13 2.34 79 MIME_HTML_MOSTLY 10792 2.71 3.95 2.31 80 TVD_RCVD_IP 10515 1.80 0.41 2.25 81 XMDiploma_00 10477 2.47 3.16 2.25 82 MAILING_LIST_MULTI 10299 2.03 1.48 2.21 83 ANY_BOUNCE_MESSAGE 9671 1.71 0.60 2.07 84 BOUNCE_MESSAGE 9666 1.71 0.60 2.07 85 BAYES_05 9474 1.77 0.97 2.03 86 XM_SPF_SoftFail 9336 2.79 5.25 2.00 87 SUBJ_ALL_CAPS 9335 2.14 2.57 2.00 88 RCVD_IN_IADB_OPTIN 9254 1.66 0.66 1.98 89 RCVD_IN_MSPIKE_WL 9025 1.56 0.42 1.93 90 RCVD_IN_MSPIKE_H3 9025 1.56 0.42 1.93 91 TR_MetaPhish_Combo_01 8968 1.63 0.74 1.92 92 HELO_NODOT 8934 1.60 0.64 1.91 93 HELO_NO_DOMAIN 8931 1.60 0.64 1.91 94 XM_DK_Undo_01 8627 1.66 1.08 1.85 95 TooManyTo_003 8608 1.53 0.57 1.84 96 BOTNET 8472 6.31 20.23 1.82 97 TM2_M_URI_OPT_OUT 8404 2.15 3.22 1.80 98 XM_CamelCaseFrm001 8254 2.13 3.26 1.77 99 T_TooManySym_02 8105 1.55 0.95 1.74 100 IN_HORDE_ADDRESS_BOOK 7964 1.30 0.05 1.71 101 XM_E_Blogspot 7771 1.28 0.08 1.67 102 USER_IN_DEF_DKIM_WL 7279 1.18 0.02 1.56 103 INVALID_MSGID 7212 1.31 0.58 1.55 104 XMCapTrack 6948 1.19 0.25 1.49 105 XMGenDplmaNmb 6881 1.60 1.98 1.47 106 URI_HEX 6734 2.02 3.79 1.44 107 TR_Symld_Words 6701 1.38 1.19 1.44 108 XMStockSpam_06 6575 1.57 2.06 1.41 109 TooManyTo_004 6338 1.14 0.46 1.36 110 UNTRUSTED_Relay 6246 4.14 12.82 1.34 111 RELAYCOUNTRY_CA 5888 1.92 3.96 1.26 112 T_XMDrugObfuBody_08 5862 1.58 2.59 1.26 113 TR_XM_PHPDW 5854 1.66 2.92 1.25 114 TR_XM_PHPForged 5780 1.64 2.89 1.24 115 TR_XM_FormFill2 5752 1.63 2.86 1.23 116 XM_H_PHPOS 5742 1.62 2.84 1.23 117 XM_OfRef6 5698 1.71 3.21 1.22 118 TM2_M_VERY_LONG_WORD 5657 1.30 1.58 1.21 119 MIME_HTML_ONLY_MULTI 5589 1.68 3.17 1.20 120 XMSubNoVowel 5541 1.00 0.40 1.19 121 URI_TRY_3LD 5474 1.17 1.14 1.17 122 XM_GoogleGroups 5432 0.99 0.43 1.16 123 XMPhish11 5417 1.18 1.26 1.16 124 TooManyTo_005 5337 0.96 0.40 1.14 125 NO_DNS_FOR_FROM 5335 1.41 2.26 1.14 126 RELAYCOUNTRY_GB 5116 1.05 0.91 1.10 127 DKIM_ADSP_CUSTOM_MED 4971 1.08 1.12 1.07 128 XM_H_Long_From02 4299 1.05 1.46 0.92 129 XMBdyGiftCard01 4153 1.56 3.63 0.89 130 TR_XM_RelayPhish 4100 1.22 2.27 0.88 131 SpammyFromTLD_01 3801 1.01 1.60 0.81 132 T_FILL_THIS_FORM_SHORT 3755 0.83 0.92 0.80 133 XM_UB50 3743 2.17 6.41 0.80 134 XM_ProductURIs 3701 1.06 1.88 0.79 135 LOW_PRICE 3433 0.70 0.60 0.74 136 NML_ADSP_CUSTOM_MED 3394 0.80 1.04 0.73 137 XM_B_SpammyTLD 3382 0.77 0.92 0.72 138 T_XMDrugObfuBody_00 3323 0.85 1.26 0.71 139 XMBody_17 3291 1.06 2.18 0.71 140 XMBrknScrpt_02 3257 1.15 2.55 0.70 141 XMBody_95 3195 0.56 0.19 0.68 142 T_OBFU_PDF_ATTACH 2934 0.53 0.24 0.63 143 FILL_THIS_FORM 2870 0.78 1.31 0.62 144 HTTPS_HTTP_MISMATCH 2852 0.60 0.56 0.61 145 XMMoneyMeta_00 2850 1.00 2.22 0.61 146 XM_ShortIntro_01 2829 0.53 0.30 0.61 147 T_Symld_Words_02 2829 0.87 1.69 0.61 148 XMSubMetaSxObfu_02 2753 0.52 0.32 0.59 149 T_XMHurry_00 2750 0.82 1.53 0.59 150 XM_H_PHPMailer 2729 0.85 1.67 0.58 151 XMLngstWrd_00 2727 0.88 1.78 0.58 152 MISSING_HEADERS 2718 0.88 1.81 0.58 153 HTML_TAG_BALANCE_BODY 2663 0.93 2.05 0.57 154 XMNoVowels 2629 0.52 0.37 0.56 155 XMGappySubj_01 2622 0.50 0.29 0.56 156 DKIM_ADSP_NXDOMAIN 2563 1.52 4.53 0.55 157 XMLngstWrd_01 2559 0.84 1.74 0.55 158 XMSexyCombo_01 2527 0.82 1.69 0.54 159 USER_IN_WHITELIST 2522 0.41 0.00 0.54 160 HTML_FONT_FACE_BAD 2484 0.61 0.86 0.53 161 T_TooManySym_03 2434 0.43 0.16 0.52 162 XMSubMetaI_00 2422 0.74 1.41 0.52 163 AC_DIV_BONANZA 2407 0.41 0.10 0.52 164 SHORT_HELO_AND_INLINE_IMAGE 2324 0.39 0.05 0.50 165 XM_B_COPY_HTML 2322 0.52 0.61 0.50 166 FORGED_GMAIL_RCVD 2303 0.60 0.93 0.49 167 T_ANY_PILL_PRICE 2276 0.37 0.00 0.49 168 XM_URI_RBL 2225 1.37 4.12 0.48 169 XMPhish30 2222 0.64 1.15 0.48 170 XMSubMetaSxObfu_03 2155 0.55 0.84 0.46 171 TM2_M_BODY_EMPTY 2132 0.38 0.13 0.46 172 HTML_IMAGE_ONLY_32 2061 0.46 0.51 0.44 173 RELAYCOUNTRY_DE 2006 1.16 3.43 0.43 174 XMDateMe_00 1989 0.39 0.28 0.43 175 RCVD_IN_SORBS_DUL 1969 0.38 0.27 0.42 176 RCVD_IN_BL_SPAMCOP_NET 1909 1.30 4.06 0.41 177 TR_LOTS_OF_MONEY2 1875 0.55 1.01 0.40 178 T_MONEY_PERCENT 1875 0.55 1.01 0.40 179 TR_Caps_n_Bayes_99 1860 0.57 1.09 0.40 180 RDNS_DYNAMIC 1812 0.55 1.07 0.39 181 XM_B_REG_HTML 1807 0.61 1.32 0.39 182 FROM_GOV_SPOOF 1780 0.32 0.13 0.38 183 HTML_IMAGE_ONLY_28 1776 0.52 0.94 0.38 184 XMHTML_After_End 1768 0.57 1.17 0.38 185 URI_NOVOWEL 1764 0.83 2.22 0.38 186 XMHTMLBadTable_001 1749 0.46 0.74 0.37 187 RELAYCOUNTRY_AU 1700 0.40 0.51 0.36 188 XMBody_78 1693 0.69 1.72 0.36 189 PLING_QUERY 1651 0.41 0.57 0.35 190 FROM_GOV_DKIM_AU 1651 0.29 0.10 0.35 191 TM2_M_A_HREF_HREF 1640 0.44 0.70 0.35 192 FSL_THIS_IS_ADV 1632 0.51 1.00 0.35 193 XMRcvdHeader_15 1585 0.26 0.00 0.34 194 HTML_IMAGE_ONLY_24 1579 0.36 0.43 0.34 195 HTML_IMAGE_ONLY_16 1564 0.34 0.34 0.34 196 REMOVE_BEFORE_LINK 1552 0.62 1.53 0.33 197 TVD_SPACE_RATIO 1528 0.30 0.21 0.33 198 XM_B_TRADE_HTML 1509 0.31 0.27 0.32 199 XMSolicitRefs_0 1506 0.38 0.55 0.32 200 DIET_1 1502 0.55 1.26 0.32 ----------------------------------------------------------------------