Email: 638144 Autolearn: 0 AvgScore: 2.93 AvgScanTime: 2.03 sec Spam: 163334 Autolearn: 0 AvgScore: 12.19 AvgScanTime: 2.40 sec Ham: 474810 Autolearn: 0 AvgScore: -0.25 AvgScanTime: 1.91 sec Time Spent Running SA: 360.64 hours Time Spent Processing Spam: 108.99 hours Time Spent Processing Ham: 251.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155408 89.97 95.15 88.19 2 DCC_CHECK 131767 50.57 80.67 40.21 3 DKIM_SIGNED 127943 75.81 78.33 74.94 4 XM_DK_Pass 122477 73.67 74.99 73.21 5 XMListUnsubscribeExists 120443 56.17 73.74 50.13 6 DKIM_VALID 116382 70.02 71.25 69.59 7 DKIM_VALID_AU 89231 52.51 54.63 51.78 8 XM_DK_Undo_02 75681 21.75 46.34 13.29 9 BAYES_99 66350 18.88 40.62 11.40 10 HTML_FONT_LOW_CONTRAST 61063 30.44 37.39 28.05 11 BAYES_999 54892 16.03 33.61 9.98 12 BAYES_50 54675 47.94 33.47 52.92 13 TR_DCC_Bayes_99 54119 12.49 33.13 5.39 14 LOC_TINY_FONT_1 49396 24.80 30.24 22.92 15 MIME_HTML_ONLY 45197 22.07 27.67 20.14 16 FVGT_m_MULTI_ODD 43105 22.54 26.39 21.21 17 XMSubLong 42843 22.55 26.23 21.29 18 T_KAM_HTML_FONT_INVALID 35406 17.66 21.68 16.28 19 XM_Body_Dirty_Words 34149 14.77 20.91 12.66 20 DKIM_VALID_EF 33443 25.62 20.48 27.38 21 RELAYCOUNTRY_META 32737 9.20 20.04 5.47 22 T_TM2_M_HEADER_IN_MSG 30628 27.41 18.75 30.38 23 BOTNET 29847 6.08 18.27 1.88 24 DCC_CHECK_NEGATIVE 28695 47.48 17.57 57.76 25 BOTNET_IPINHOSTNAME 28106 7.85 17.21 4.64 26 XM_Multi_Part_URI 26760 12.87 16.38 11.66 27 MultiRelay 25760 18.20 15.77 19.04 28 HTML_IMAGE_RATIO_02 24196 9.70 14.81 7.94 29 LOTS_OF_MONEY 23430 10.58 14.34 9.28 30 XM_UncommonTLD01 20879 5.97 12.78 3.63 31 FSL_BULK_SIG 20775 8.90 12.72 7.58 32 UNTRUSTED_Relay 19316 4.32 11.83 1.74 33 XM_Evil_Numbers_Gen 18668 9.49 11.43 8.82 34 XMSexyCombo_05 17081 5.34 10.46 3.57 35 MPART_ALT_DIFF 16381 5.24 10.03 3.60 36 XM_H_Long_From01 15669 7.26 9.59 6.46 37 BAYES_80 15173 5.39 9.29 4.05 38 XM_B_Phish_Phrases 14237 6.53 8.72 5.77 39 LotsOfNums_01 14161 8.44 8.67 8.36 40 T_XMDrugObfuBody_14 14058 8.45 8.61 8.39 41 XMSubMetaSx_00 13235 4.85 8.10 3.73 42 MIME_QP_LONG_LINE 11821 5.90 7.24 5.44 43 TooManyTo_001 11698 8.01 7.16 8.30 44 BAYES_60 11682 6.73 7.15 6.59 45 DKIM_INVALID 11561 5.80 7.08 5.35 46 HTML_IMAGE_RATIO_04 11107 6.01 6.80 5.74 47 MIME_HTML_MOSTLY 9124 3.22 5.59 2.41 48 HTML_IMAGE_RATIO_06 8628 4.27 5.28 3.93 49 XM_UB50 8465 2.16 5.18 1.11 50 XM_DIRTYINTL 8298 3.25 5.08 2.62 51 BAYES_95 7619 3.16 4.66 2.64 52 XM_B_SpammyTLD 7193 3.65 4.40 3.39 53 FROM_EXCESS_BASE64 7085 3.96 4.34 3.83 54 FROM_SUSPICIOUS_NTLD 7073 1.19 4.33 0.11 55 XM_SPF_SoftFail 7000 2.50 4.29 1.89 56 XMNumbers 6976 3.21 4.27 2.85 57 MIME_HTML_ONLY_MULTI 6962 2.45 4.26 1.82 58 RCVD_IN_BL_SPAMCOP_NET 6843 1.72 4.19 0.87 59 XM_CamelCaseFrm001 6538 2.37 4.00 1.80 60 RELAYCOUNTRY_DE 6337 1.41 3.88 0.55 61 RELAYCOUNTRY_CA 6327 2.04 3.87 1.40 62 TM2_M_URI_OPT_OUT 6174 2.34 3.78 1.85 63 NUMERIC_HTTP_ADDR 6123 1.32 3.75 0.49 64 SpammyFromTLD_02 5949 1.20 3.64 0.36 65 T_REMOTE_IMAGE 5861 4.10 3.59 4.28 66 XM_URI_RBL 5807 1.25 3.56 0.46 67 NORDNS_LOW_CONTRAST 5756 0.96 3.52 0.08 68 NORMAL_HTTP_TO_IP 5422 0.90 3.32 0.06 69 BOTNET_NORDNS 5397 0.91 3.30 0.08 70 XMStrtUSub 5299 4.16 3.24 4.48 71 URI_HEX 5211 2.14 3.19 1.78 72 RCVD_IN_RP_SAFE 5068 9.05 3.10 11.09 73 XM_SendGrid 4855 5.52 2.97 6.40 74 DKIM_ADSP_CUSTOM_MED 4829 1.45 2.96 0.93 75 XMDiploma_00 4817 2.18 2.95 1.92 76 RCVD_IN_MSPIKE_H2 4552 3.90 2.79 4.28 77 XMSexyCombo_01 4454 1.17 2.73 0.64 78 MISSING_HEADERS 4429 1.30 2.71 0.81 79 NML_ADSP_CUSTOM_MED 4421 1.20 2.71 0.68 80 HTML_IMAGE_RATIO_08 4397 2.25 2.69 2.10 81 HELO_NODOT 4354 2.26 2.67 2.12 82 HELO_NO_DOMAIN 4339 2.26 2.66 2.12 83 XMBody_17 4251 1.01 2.60 0.46 84 REPLYTO_WITHOUT_TO_CC 4079 0.91 2.50 0.37 85 XMSubMetaI_00 3959 1.04 2.42 0.57 86 XMBdyGiftCard01 3945 1.42 2.42 1.08 87 TR_XM_PHPDW 3937 1.18 2.41 0.76 88 T_TooManySym_01 3927 4.63 2.40 5.40 89 TR_XM_PHPForged 3902 1.16 2.39 0.74 90 TR_XM_RelayPhish 3889 1.28 2.38 0.90 91 NO_DNS_FOR_FROM 3882 1.46 2.38 1.15 92 RCVD_IN_RP_CERTIFIED 3872 8.18 2.37 10.18 93 TR_XM_FormFill2 3844 1.15 2.35 0.74 94 XM_H_PHPOS 3823 1.15 2.34 0.73 95 XM_OfRef6 3823 1.91 2.34 1.76 96 RCVD_IN_IADB_LISTED 3819 4.32 2.34 5.00 97 ALL_TRUSTED 3749 12.42 2.30 15.90 98 T_XMDrugObfuBody_08 3735 1.74 2.29 1.55 99 HTML_MIME_NO_HTML_TAG 3615 2.56 2.21 2.68 100 RCVD_IN_IADB_SPF 3432 3.78 2.10 4.35 101 SpammyFromTLD_01 3425 1.12 2.10 0.79 102 HTML_SHORT_LINK_IMG_2 3404 0.58 2.08 0.06 103 RCVD_IN_RP_RNBL 3395 0.57 2.08 0.04 104 XM_UB80 3307 0.55 2.02 0.05 105 XMEmptySub 3305 0.80 2.02 0.39 106 RCVD_IN_IADB_SENDERID 3296 3.34 2.02 3.80 107 RCVD_IN_IADB_DK 3291 3.32 2.01 3.76 108 DKIM_ADSP_NXDOMAIN 3176 1.08 1.94 0.79 109 T_MONEY_PERCENT 3146 1.02 1.93 0.70 110 TR_LOTS_OF_MONEY2 3146 1.02 1.93 0.70 111 DATE_IN_PAST_12_24 3031 0.51 1.86 0.05 112 XMGenDplmaNmb 2987 1.32 1.83 1.15 113 T_HTML_TAG_BALANCE_CENTER 2968 0.54 1.82 0.10 114 XMBody_78 2901 0.77 1.78 0.43 115 XMPhish11 2880 1.34 1.76 1.19 116 XM_UB99 2858 0.46 1.75 0.02 117 RELAYCOUNTRY_TR 2848 0.50 1.74 0.07 118 HTML_TAG_BALANCE_BODY 2707 0.85 1.66 0.57 119 MAILING_LIST_MULTI 2704 2.17 1.66 2.35 120 XM_UB60 2685 0.51 1.64 0.12 121 MultiRelay_Combo 2680 0.62 1.64 0.27 122 MultiRelay_CC 2680 0.62 1.64 0.27 123 URI_TRY_3LD 2677 1.22 1.64 1.07 124 BAYES_40 2674 3.47 1.64 4.10 125 XMSubGiftCard1 2674 0.50 1.64 0.11 126 XM_BadFromFormat 2592 0.50 1.59 0.12 127 TM2_M_VERY_LONG_WORD 2589 1.34 1.59 1.26 128 REMOVE_BEFORE_LINK 2551 0.65 1.56 0.33 129 SUBJ_ALL_CAPS 2522 1.64 1.54 1.68 130 T_XMDrugObfuBody_00 2504 1.01 1.53 0.83 131 XM_ProductURIs 2489 0.90 1.52 0.69 132 T_FILL_THIS_FORM_SHORT 2454 1.14 1.50 1.01 133 RELAYCOUNTRY_FR 2452 0.57 1.50 0.25 134 XMSubMetaSxObfu_03 2397 0.74 1.47 0.49 135 HTML_IMAGE_ONLY_12 2380 0.55 1.46 0.23 136 XM_H_Long_From02 2347 1.16 1.44 1.07 137 BAYES_20 2321 2.70 1.42 3.14 138 UNPARSEABLE_RELAY 2284 2.26 1.40 2.55 139 XMMoneyMeta_00 2248 0.77 1.38 0.56 140 HTML_IMAGE_ONLY_32 2229 0.67 1.36 0.43 141 XM_UB999 2200 0.36 1.35 0.02 142 INVALID_DATE 2178 0.38 1.33 0.06 143 XMHTML_After_End 2171 0.67 1.33 0.44 144 MPART_ALT_DIFF_COUNT 2141 0.49 1.31 0.21 145 T_XMHurry_00 2127 0.88 1.30 0.73 146 TR_XM_DK_SendGrid 2058 2.81 1.26 3.35 147 XMStockSpam_06 2049 1.27 1.25 1.28 148 XM_HighProb1 2013 0.36 1.23 0.05 149 XM_H_PHPMailer 2007 0.74 1.23 0.57 150 RELAYCOUNTRY_IN 1925 0.39 1.18 0.13 151 HTML_IMAGE_ONLY_16 1882 0.50 1.15 0.27 152 RELAYCOUNTRY_JP 1825 0.33 1.12 0.05 153 XMHTMLBadTable_001 1755 0.60 1.07 0.44 154 XM_H_PHPOS_M 1731 0.42 1.06 0.20 155 XMBrknScrpt_02 1727 0.89 1.06 0.83 156 XMPhish30 1726 0.66 1.06 0.53 157 URIBL_BLACK 1723 0.31 1.05 0.06 158 MSGID_FROM_MTA_HEADER 1723 0.44 1.05 0.23 159 XM_DK_Undo_01 1707 1.53 1.05 1.69 160 TR_LOTS_OF_MONEY3 1681 0.63 1.03 0.49 161 XM_H_TOP 1633 0.26 1.00 0.00 162 TR_Symld_Words 1612 1.42 0.99 1.57 163 T_Symld_Words_02 1609 0.66 0.99 0.54 164 ANY_BOUNCE_MESSAGE 1595 2.37 0.98 2.85 165 BOUNCE_MESSAGE 1594 2.36 0.98 2.84 166 DATE_IN_PAST_03_06 1585 0.33 0.97 0.10 167 DATE_IN_PAST_06_12 1562 0.28 0.96 0.04 168 XMSexyCombo_04 1552 0.37 0.95 0.18 169 RELAYCOUNTRY_GB 1549 1.06 0.95 1.10 170 SUBJ_DOLLARS 1530 0.48 0.94 0.33 171 FORGED_GMAIL_RCVD 1486 0.53 0.91 0.40 172 XM_B_REG_HTML 1484 0.51 0.91 0.38 173 BAYES_00 1472 9.79 0.90 12.85 174 DIET_1 1464 0.47 0.90 0.33 175 XM_ShortIntro_01 1456 0.63 0.89 0.55 176 RCVD_IN_IADB_VOUCHED 1436 2.65 0.88 3.26 177 RDNS_DYNAMIC 1436 0.53 0.88 0.41 178 BODY_ENHANCEMENT 1426 0.25 0.87 0.03 179 XMLngstWrd_00 1415 0.67 0.87 0.60 180 XMSubMetaSSx_00 1383 0.36 0.85 0.19 181 TR_XM_SEO3 1371 0.38 0.84 0.22 182 XMLngstWrd_01 1353 0.63 0.83 0.56 183 RELAYCOUNTRY_AT 1352 0.36 0.83 0.20 184 XM_H_Undi_Recip 1347 0.37 0.82 0.21 185 XM_Combo_Sbj 1328 0.39 0.81 0.25 186 HTML_FONT_FACE_BAD 1308 0.68 0.80 0.63 187 URIBL_DBL_SPAM 1294 0.21 0.79 0.01 188 XM_Nigeria_01 1272 0.24 0.78 0.06 189 PLING_QUERY 1224 0.59 0.75 0.53 190 XMLngstWrd_02 1222 0.41 0.75 0.29 191 RELAYCOUNTRY_UA 1222 0.20 0.75 0.01 192 XM_UB95 1176 0.20 0.72 0.02 193 XMSlimDrugH 1160 0.45 0.71 0.35 194 THIS_AD 1139 0.27 0.70 0.12 195 BODY_URI_ONLY 1135 0.25 0.69 0.10 196 URI_NOVOWEL 1135 0.44 0.69 0.35 197 LONG_HEX_URI 1133 0.28 0.69 0.14 198 XM_RXBody 1121 0.75 0.69 0.77 199 MONEY_FORM_SHORT 1113 0.22 0.68 0.06 200 BAYES_05 1103 1.71 0.68 2.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 418714 89.97 95.15 88.19 2 DKIM_SIGNED 355844 75.81 78.33 74.94 3 XM_DK_Pass 347622 73.67 74.99 73.21 4 DKIM_VALID 330421 70.02 71.25 69.59 5 DCC_CHECK_NEGATIVE 274264 47.48 17.57 57.76 6 BAYES_50 251252 47.94 33.47 52.92 7 DKIM_VALID_AU 245869 52.51 54.63 51.78 8 XMListUnsubscribeExists 238004 56.17 73.74 50.13 9 DCC_CHECK 190932 50.57 80.67 40.21 10 T_TM2_M_HEADER_IN_MSG 144256 27.41 18.75 30.38 11 HTML_FONT_LOW_CONTRAST 133203 30.44 37.39 28.05 12 DKIM_VALID_EF 130025 25.62 20.48 27.38 13 LOC_TINY_FONT_1 108838 24.80 30.24 22.92 14 XMSubLong 101067 22.55 26.23 21.29 15 FVGT_m_MULTI_ODD 100725 22.54 26.39 21.21 16 MIME_HTML_ONLY 95645 22.07 27.67 20.14 17 MultiRelay 90414 18.20 15.77 19.04 18 T_KAM_HTML_FONT_INVALID 77296 17.66 21.68 16.28 19 ALL_TRUSTED 75481 12.42 2.30 15.90 20 XM_DK_Undo_02 63106 21.75 46.34 13.29 21 BAYES_00 60998 9.79 0.90 12.85 22 XM_Body_Dirty_Words 60129 14.77 20.91 12.66 23 XM_Multi_Part_URI 55367 12.87 16.38 11.66 24 BAYES_99 54123 18.88 40.62 11.40 25 RCVD_IN_RP_SAFE 52679 9.05 3.10 11.09 26 TR_XM_DK_Bayes 48549 7.77 0.63 10.22 27 RCVD_IN_RP_CERTIFIED 48331 8.18 2.37 10.18 28 BAYES_999 47392 16.03 33.61 9.98 29 TR_XM_DK_Bayes1 45931 7.34 0.56 9.67 30 LOTS_OF_MONEY 44085 10.58 14.34 9.28 31 XM_Evil_Numbers_Gen 41893 9.49 11.43 8.82 32 T_XMDrugObfuBody_14 39845 8.45 8.61 8.39 33 LotsOfNums_01 39695 8.44 8.67 8.36 34 TooManyTo_001 39387 8.01 7.16 8.30 35 TR_XM_DK_Bayes2 39067 6.26 0.52 8.23 36 XM_DKIMWhitelistDomains 38600 6.05 0.02 8.13 37 HTML_IMAGE_RATIO_02 37704 9.70 14.81 7.94 38 FSL_BULK_SIG 36011 8.90 12.72 7.58 39 BAYES_60 31272 6.73 7.15 6.59 40 XM_H_Long_From01 30691 7.26 9.59 6.46 41 XM_SendGrid 30394 5.52 2.97 6.40 42 XM_B_Phish_Phrases 27416 6.53 8.72 5.77 43 HTML_IMAGE_RATIO_04 27256 6.01 6.80 5.74 44 RELAYCOUNTRY_META 25963 9.20 20.04 5.47 45 MIME_QP_LONG_LINE 25828 5.90 7.24 5.44 46 T_TooManySym_01 25644 4.63 2.40 5.40 47 TR_DCC_Bayes_99 25596 12.49 33.13 5.39 48 DKIM_INVALID 25423 5.80 7.08 5.35 49 XM_PDF 24037 3.91 0.57 5.06 50 RCVD_IN_IADB_LISTED 23748 4.32 2.34 5.00 51 BOTNET_IPINHOSTNAME 22018 7.85 17.21 4.64 52 XMStrtUSub 21264 4.16 3.24 4.48 53 RCVD_IN_IADB_SPF 20671 3.78 2.10 4.35 54 RCVD_IN_MSPIKE_H2 20339 3.90 2.79 4.28 55 T_REMOTE_IMAGE 20327 4.10 3.59 4.28 56 BAYES_40 19448 3.47 1.64 4.10 57 IN_ZIMBRA_NJ_WHITELIST 19338 3.04 0.02 4.07 58 BAYES_80 19221 5.39 9.29 4.05 59 HTML_IMAGE_RATIO_06 18639 4.27 5.28 3.93 60 FROM_EXCESS_BASE64 18190 3.96 4.34 3.83 61 RCVD_IN_IADB_SENDERID 18021 3.34 2.02 3.80 62 RCVD_IN_IADB_DK 17864 3.32 2.01 3.76 63 XMSubMetaSx_00 17694 4.85 8.10 3.73 64 TO_MALFORMED 17339 2.73 0.04 3.65 65 XM_UncommonTLD01 17242 5.97 12.78 3.63 66 MPART_ALT_DIFF 17089 5.24 10.03 3.60 67 XMSexyCombo_05 16968 5.34 10.46 3.57 68 XM_B_SpammyTLD 16085 3.65 4.40 3.39 69 TR_XM_DK_SendGrid 15892 2.81 1.26 3.35 70 RCVD_IN_IADB_VOUCHED 15489 2.65 0.88 3.26 71 BAYES_20 14907 2.70 1.42 3.14 72 ANY_BOUNCE_MESSAGE 13535 2.37 0.98 2.85 73 XMNumbers 13524 3.21 4.27 2.85 74 BOUNCE_MESSAGE 13495 2.36 0.98 2.84 75 HTML_MIME_NO_HTML_TAG 12733 2.56 2.21 2.68 76 BAYES_95 12537 3.16 4.66 2.64 77 XM_DIRTYINTL 12457 3.25 5.08 2.62 78 UNPARSEABLE_RELAY 12123 2.26 1.40 2.55 79 MIME_HTML_MOSTLY 11440 3.22 5.59 2.41 80 MAILING_LIST_MULTI 11139 2.17 1.66 2.35 81 TVD_RCVD_IP 10846 1.79 0.36 2.28 82 TooManyTo_002 10282 1.76 0.60 2.17 83 HELO_NODOT 10075 2.26 2.67 2.12 84 HELO_NO_DOMAIN 10074 2.26 2.66 2.12 85 HTML_IMAGE_RATIO_08 9971 2.25 2.69 2.10 86 RCVD_IN_IADB_OPTIN 9837 1.68 0.53 2.07 87 BAYES_05 9786 1.71 0.68 2.06 88 RCVD_IN_MSPIKE_WL 9329 1.57 0.43 1.96 89 RCVD_IN_MSPIKE_H3 9329 1.57 0.43 1.96 90 XMDiploma_00 9116 2.18 2.95 1.92 91 XM_SPF_SoftFail 8973 2.50 4.29 1.89 92 BOTNET 8921 6.08 18.27 1.88 93 TM2_M_URI_OPT_OUT 8764 2.34 3.78 1.85 94 MIME_HTML_ONLY_MULTI 8649 2.45 4.26 1.82 95 TR_MetaPhish_Combo_01 8563 1.51 0.67 1.80 96 XM_CamelCaseFrm001 8556 2.37 4.00 1.80 97 URI_HEX 8462 2.14 3.19 1.78 98 XM_OfRef6 8374 1.91 2.34 1.76 99 UNTRUSTED_Relay 8280 4.32 11.83 1.74 100 T_TooManySym_02 8245 1.46 0.67 1.74 101 IN_HORDE_ADDRESS_BOOK 8177 1.29 0.02 1.72 102 XM_DK_Undo_01 8031 1.53 1.05 1.69 103 SUBJ_ALL_CAPS 7974 1.64 1.54 1.68 104 TR_Symld_Words 7441 1.42 0.99 1.57 105 INVALID_MSGID 7417 1.21 0.19 1.56 106 T_XMDrugObfuBody_08 7351 1.74 2.29 1.55 107 XMCapTrack 7003 1.17 0.29 1.47 108 TooManyTo_003 6927 1.20 0.46 1.46 109 RELAYCOUNTRY_CA 6663 2.04 3.87 1.40 110 USER_IN_DEF_DKIM_WL 6478 1.02 0.01 1.36 111 XMStockSpam_06 6057 1.27 1.25 1.28 112 TM2_M_VERY_LONG_WORD 5970 1.34 1.59 1.26 113 XMPhish11 5652 1.34 1.76 1.19 114 XM_GoogleGroups 5609 0.99 0.44 1.18 115 XMGenDplmaNmb 5459 1.32 1.83 1.15 116 NO_DNS_FOR_FROM 5439 1.46 2.38 1.15 117 XM_UB50 5291 2.16 5.18 1.11 118 RELAYCOUNTRY_GB 5227 1.06 0.95 1.10 119 XMBdyGiftCard01 5140 1.42 2.42 1.08 120 URI_TRY_3LD 5094 1.22 1.64 1.07 121 XM_H_Long_From02 5060 1.16 1.44 1.07 122 TooManyTo_004 4906 0.86 0.37 1.03 123 T_FILL_THIS_FORM_SHORT 4803 1.14 1.50 1.01 124 DKIM_ADSP_CUSTOM_MED 4412 1.45 2.96 0.93 125 TR_XM_RelayPhish 4262 1.28 2.38 0.90 126 RCVD_IN_BL_SPAMCOP_NET 4136 1.72 4.19 0.87 127 TooManyTo_005 4120 0.73 0.32 0.87 128 T_XMDrugObfuBody_00 3962 1.01 1.53 0.83 129 XMBrknScrpt_02 3930 0.89 1.06 0.83 130 MISSING_HEADERS 3850 1.30 2.71 0.81 131 SpammyFromTLD_01 3749 1.12 2.10 0.79 132 DKIM_ADSP_NXDOMAIN 3735 1.08 1.94 0.79 133 XM_RXBody 3673 0.75 0.69 0.77 134 FILL_THIS_FORM 3627 0.70 0.53 0.76 135 TR_XM_PHPDW 3588 1.18 2.41 0.76 136 TR_XM_PHPForged 3525 1.16 2.39 0.74 137 TR_XM_FormFill2 3499 1.15 2.35 0.74 138 XM_H_PHPOS 3489 1.15 2.34 0.73 139 T_XMHurry_00 3473 0.88 1.30 0.73 140 LOW_PRICE 3338 0.64 0.47 0.70 141 TR_LOTS_OF_MONEY2 3338 1.02 1.93 0.70 142 T_MONEY_PERCENT 3338 1.02 1.93 0.70 143 XM_ProductURIs 3272 0.90 1.52 0.69 144 NML_ADSP_CUSTOM_MED 3217 1.20 2.71 0.68 145 USER_IN_WHITELIST 3063 0.48 0.00 0.65 146 XMSexyCombo_01 3016 1.17 2.73 0.64 147 HTML_FONT_FACE_BAD 3004 0.68 0.80 0.63 148 T_OBFU_PDF_ATTACH 2969 0.51 0.17 0.63 149 XMBody_95 2895 0.49 0.12 0.61 150 XMLngstWrd_00 2859 0.67 0.87 0.60 151 HTTPS_HTTP_MISMATCH 2799 0.54 0.39 0.59 152 HTML_TAG_BALANCE_BODY 2715 0.85 1.66 0.57 153 XMSubMetaI_00 2696 1.04 2.42 0.57 154 XM_H_PHPMailer 2691 0.74 1.23 0.57 155 XMMoneyMeta_00 2669 0.77 1.38 0.56 156 XMLngstWrd_01 2637 0.63 0.83 0.56 157 RELAYCOUNTRY_DE 2631 1.41 3.88 0.55 158 XM_ShortIntro_01 2595 0.63 0.89 0.55 159 T_Symld_Words_02 2576 0.66 0.99 0.54 160 XM_B_COPY_HTML 2576 0.56 0.63 0.54 161 FROM_GOV_SPOOF 2575 0.46 0.21 0.54 162 XMGappySubj_01 2571 0.52 0.45 0.54 163 PLING_QUERY 2528 0.59 0.75 0.53 164 XMPhish30 2497 0.66 1.06 0.53 165 TM2_M_A_HREF_HREF 2493 0.54 0.57 0.53 166 AC_DIV_BONANZA 2432 0.40 0.08 0.51 167 T_TooManySym_03 2416 0.42 0.16 0.51 168 SHORT_HELO_AND_INLINE_IMAGE 2410 0.39 0.04 0.51 169 RELAYCOUNTRY_AU 2340 0.49 0.47 0.49 170 TR_LOTS_OF_MONEY3 2319 0.63 1.03 0.49 171 NUMERIC_HTTP_ADDR 2307 1.32 3.75 0.49 172 XMSubMetaSxObfu_03 2306 0.74 1.47 0.49 173 XMSolicitRefs_0 2282 0.47 0.45 0.48 174 XMNoVowels 2264 0.43 0.30 0.48 175 TM2_M_BODY_EMPTY 2260 0.39 0.13 0.48 176 XMBody_17 2196 1.01 2.60 0.46 177 XM_URI_RBL 2170 1.25 3.56 0.46 178 XMHTML_After_End 2104 0.67 1.33 0.44 179 XMHTMLBadTable_001 2100 0.60 1.07 0.44 180 HTML_IMAGE_ONLY_32 2040 0.67 1.36 0.43 181 XMBody_78 2040 0.77 1.78 0.43 182 XMDateMe_00 2015 0.38 0.23 0.42 183 FILL_THIS_FORM_LONG 2009 0.43 0.46 0.42 184 FILL_THIS_FORM_LOAN 2007 0.37 0.20 0.42 185 RDNS_DYNAMIC 1932 0.53 0.88 0.41 186 FORGED_GMAIL_RCVD 1897 0.53 0.91 0.40 187 XMEmptySub 1831 0.80 2.02 0.39 188 MIXED_ES 1819 0.35 0.27 0.38 189 RCVD_IN_SORBS_DUL 1812 0.34 0.23 0.38 190 XM_B_REG_HTML 1793 0.51 0.91 0.38 191 REPLYTO_WITHOUT_TO_CC 1734 0.91 2.50 0.37 192 HTML_IMAGE_ONLY_28 1712 0.38 0.43 0.36 193 XMSubMetaSxObfu_02 1703 0.35 0.31 0.36 194 SpammyFromTLD_02 1699 1.20 3.64 0.36 195 HTML_IMAGE_ONLY_24 1697 0.42 0.60 0.36 196 FROM_GOV_DKIM_AU 1687 0.29 0.09 0.36 197 XMSlimDrugH 1685 0.45 0.71 0.35 198 URI_NOVOWEL 1677 0.44 0.69 0.35 199 XMSubNoVowel 1609 0.35 0.39 0.34 200 REMOVE_BEFORE_LINK 1578 0.65 1.56 0.33 ----------------------------------------------------------------------