Email: 627166 Autolearn: 0 AvgScore: 3.01 AvgScanTime: 1.97 sec Spam: 159181 Autolearn: 0 AvgScore: 12.38 AvgScanTime: 2.42 sec Ham: 467985 Autolearn: 0 AvgScore: -0.17 AvgScanTime: 1.81 sec Time Spent Running SA: 342.59 hours Time Spent Processing Spam: 106.91 hours Time Spent Processing Ham: 235.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150052 89.57 94.27 87.97 2 DCC_CHECK 128065 49.43 80.45 38.87 3 DKIM_SIGNED 127259 76.16 79.95 74.87 4 XM_DK_Pass 121112 74.14 76.08 73.48 5 XMListUnsubscribeExists 117734 55.42 73.96 49.11 6 DKIM_VALID 114805 70.43 72.12 69.86 7 DKIM_VALID_AU 86093 51.41 54.08 50.50 8 XM_DK_Undo_02 75170 22.25 47.22 13.76 9 BAYES_99 67059 19.69 42.13 12.05 10 HTML_FONT_LOW_CONTRAST 59618 29.59 37.45 26.92 11 BAYES_999 56014 16.85 35.19 10.62 12 TR_DCC_Bayes_99 54240 12.97 34.07 5.79 13 LOC_TINY_FONT_1 53079 24.45 33.35 21.42 14 BAYES_50 52707 48.06 33.11 53.15 15 MIME_HTML_ONLY 49723 23.02 31.24 20.23 16 XMSubLong 43898 23.68 27.58 22.35 17 FVGT_m_MULTI_ODD 39480 22.36 24.80 21.53 18 XM_Body_Dirty_Words 33827 14.35 21.25 12.00 19 DKIM_VALID_EF 33421 26.93 21.00 28.96 20 T_KAM_HTML_FONT_INVALID 32899 17.46 20.67 16.37 21 T_TM2_M_HEADER_IN_MSG 28995 28.79 18.22 32.39 22 DCC_CHECK_NEGATIVE 28208 48.53 17.72 59.01 23 BOTNET_IPINHOSTNAME 27569 7.78 17.32 4.54 24 RELAYCOUNTRY_META 27199 8.34 17.09 5.37 25 XM_Multi_Part_URI 26785 12.72 16.83 11.33 26 BOTNET 26477 5.70 16.63 1.98 27 MultiRelay 24075 19.23 15.12 20.62 28 LOTS_OF_MONEY 23637 10.54 14.85 9.08 29 XM_Evil_Numbers_Gen 23475 10.38 14.75 8.89 30 HTML_IMAGE_RATIO_02 20580 8.79 12.93 7.38 31 XM_UncommonTLD01 20088 5.80 12.62 3.48 32 FSL_BULK_SIG 19548 8.16 12.28 6.76 33 LotsOfNums_01 17708 8.75 11.12 7.94 34 UNTRUSTED_Relay 16580 3.68 10.42 1.38 35 XMSexyCombo_05 16427 5.07 10.32 3.28 36 XM_H_Long_From01 15655 7.18 9.83 6.28 37 T_XMDrugObfuBody_14 13857 8.29 8.71 8.15 38 BAYES_80 13176 4.89 8.28 3.74 39 HTML_IMAGE_RATIO_04 12863 5.78 8.08 5.00 40 DKIM_INVALID 12454 5.73 7.82 5.01 41 XMSubMetaSx_00 11576 4.71 7.27 3.84 42 TooManyTo_001 11523 8.11 7.24 8.40 43 XM_B_Phish_Phrases 11249 5.93 7.07 5.55 44 MPART_ALT_DIFF 10828 4.45 6.80 3.65 45 BAYES_60 10521 6.26 6.61 6.14 46 MIME_QP_LONG_LINE 9411 5.72 5.91 5.66 47 FROM_SUSPICIOUS_NTLD 9298 1.51 5.84 0.04 48 XM_B_SpammyTLD 8571 3.76 5.38 3.20 49 XM_UB50 7695 1.85 4.83 0.83 50 XM_DIRTYINTL 7453 3.20 4.68 2.70 51 RCVD_IN_BL_SPAMCOP_NET 7420 1.60 4.66 0.56 52 FROM_EXCESS_BASE64 7383 4.22 4.64 4.07 53 RCVD_IN_PSBL 7248 1.22 4.55 0.08 54 RELAYCOUNTRY_CA 6996 2.18 4.39 1.43 55 HTML_IMAGE_RATIO_06 6811 3.56 4.28 3.32 56 T_REMOTE_IMAGE 6789 4.48 4.26 4.56 57 BAYES_95 6762 2.93 4.25 2.48 58 XM_URI_RBL 6355 1.35 3.99 0.46 59 SpammyFromTLD_02 6106 1.20 3.84 0.30 60 MIME_HTML_ONLY_MULTI 5989 2.42 3.76 1.96 61 HTML_IMAGE_RATIO_08 5944 2.64 3.73 2.27 62 XMNumbers 5748 3.14 3.61 2.99 63 TM2_M_URI_OPT_OUT 5724 2.32 3.60 1.89 64 XM_SendGrid 5679 5.71 3.57 6.44 65 MIME_HTML_MOSTLY 5549 2.48 3.49 2.13 66 BOTNET_NORDNS 5478 0.92 3.44 0.06 67 XM_SPF_SoftFail 5434 2.33 3.41 1.96 68 URI_HEX 5380 2.23 3.38 1.84 69 XMStrtUSub 5327 4.71 3.35 5.18 70 HTML_MIME_NO_HTML_TAG 5286 2.76 3.32 2.57 71 NORDNS_LOW_CONTRAST 5279 0.85 3.32 0.01 72 XM_OfRef6 5198 2.04 3.27 1.62 73 XM_CamelCaseFrm001 5143 2.18 3.23 1.82 74 XMSexyCombo_01 5078 1.21 3.19 0.54 75 RCVD_IN_IADB_LISTED 4768 4.98 3.00 5.66 76 RCVD_IN_RP_SAFE 4746 8.41 2.98 10.25 77 RELAYCOUNTRY_FR 4524 0.91 2.84 0.25 78 XMDiploma_00 4502 2.61 2.83 2.53 79 T_TooManySym_01 4456 4.83 2.80 5.52 80 RCVD_IN_IADB_SPF 4312 4.38 2.71 4.95 81 NO_DNS_FOR_FROM 4310 1.52 2.71 1.11 82 RCVD_IN_MSPIKE_H2 4260 3.95 2.68 4.39 83 T_XMDrugObfuBody_08 4247 1.77 2.67 1.47 84 MultiRelay_Combo 4164 0.84 2.62 0.24 85 MultiRelay_CC 4164 0.84 2.62 0.24 86 RCVD_IN_IADB_SENDERID 4100 3.83 2.58 4.26 87 RCVD_IN_IADB_DK 4089 3.78 2.57 4.19 88 DKIM_ADSP_NXDOMAIN 4077 1.16 2.56 0.69 89 XM_ProductURIs 4076 1.25 2.56 0.81 90 XMStockSpam_06 4010 1.38 2.52 1.00 91 ALL_TRUSTED 3917 12.38 2.46 15.75 92 KHOP_HELO_FCRDNS 3676 2.23 2.31 2.21 93 RCVD_IN_RP_CERTIFIED 3611 7.50 2.27 9.27 94 TR_XM_PHPDW 3578 1.24 2.25 0.89 95 TR_XM_PHPForged 3556 1.22 2.23 0.87 96 XMBody_78 3519 1.01 2.21 0.60 97 TR_XM_FormFill2 3515 1.21 2.21 0.87 98 XM_H_PHPOS 3504 1.20 2.20 0.86 99 XMSubMetaSxObfu_03 3441 1.05 2.16 0.67 100 XM_UB99 3361 0.54 2.11 0.01 101 XMSolicitRefs_0 3170 0.77 1.99 0.35 102 SUBJ_ALL_CAPS 3168 1.73 1.99 1.64 103 BAYES_40 3148 3.58 1.98 4.13 104 XMSexyCombo_04 3077 0.60 1.93 0.15 105 TR_LOTS_OF_MONEY2 3044 0.87 1.91 0.51 106 T_MONEY_PERCENT 3044 0.87 1.91 0.51 107 XMBdyGiftCard01 2969 1.13 1.87 0.89 108 URI_TRY_3LD 2957 1.39 1.86 1.23 109 XMGenDplmaNmb 2890 1.60 1.82 1.52 110 RCVD_IN_RP_RNBL 2803 0.74 1.76 0.39 111 XMBody_17 2708 0.78 1.70 0.46 112 XM_DKIMWhitelistDomains 2668 6.19 1.68 7.72 113 MAILING_LIST_MULTI 2621 2.45 1.65 2.73 114 XM_UB999 2589 0.42 1.63 0.01 115 XM_H_Long_From02 2577 1.13 1.62 0.96 116 SpammyFromTLD_01 2562 1.08 1.61 0.90 117 XM_HighProb1 2540 0.47 1.60 0.09 118 XMSubMetaI_00 2456 0.75 1.54 0.48 119 TR_XM_DK_SendGrid 2446 2.93 1.54 3.41 120 XMPhish30 2435 0.75 1.53 0.49 121 TM2_M_VERY_LONG_WORD 2423 1.29 1.52 1.22 122 TR_XM_RelayPhish 2377 1.03 1.49 0.87 123 BAYES_20 2362 2.74 1.48 3.16 124 TR_MetaPhish_Combo_01 2354 1.68 1.48 1.74 125 XM_DK_Undo_01 2344 1.71 1.47 1.79 126 DATE_IN_PAST_06_12 2326 0.44 1.46 0.09 127 XMHTML_After_End 2272 0.68 1.43 0.43 128 HTML_IMAGE_ONLY_20 2167 0.60 1.36 0.35 129 TR_Symld_Words 2164 1.75 1.36 1.89 130 FILL_THIS_FORM 2154 0.80 1.35 0.61 131 XMPhish11 2105 1.30 1.32 1.30 132 SUBJ_DOLLARS 2071 0.54 1.30 0.27 133 T_XMHurry_00 2048 0.76 1.29 0.59 134 BAYES_00 2038 10.01 1.28 12.98 135 T_FILL_THIS_FORM_SHORT 2023 0.99 1.27 0.90 136 XM_H_PHPMailer 1988 0.83 1.25 0.69 137 FILL_THIS_FORM_LONG 1955 0.50 1.23 0.26 138 UNPARSEABLE_RELAY 1952 2.22 1.23 2.55 139 T_XMDrugObfuBody_00 1936 0.93 1.22 0.83 140 RCVD_IN_IADB_VOUCHED 1895 3.15 1.19 3.82 141 DKIM_ADSP_CUSTOM_MED 1877 1.05 1.18 1.00 142 DATE_IN_PAST_03_06 1848 0.40 1.16 0.14 143 XMMoneyMeta_00 1826 0.73 1.15 0.59 144 SHORT_URI_3 1794 0.39 1.13 0.14 145 PDS_TO_EQ_FROM_NAME 1792 0.30 1.13 0.02 146 T_TooManySym_02 1772 1.73 1.11 1.94 147 MISSING_HEADERS 1732 0.69 1.09 0.56 148 XM_H_PHPOS_M 1695 0.48 1.06 0.28 149 FORGED_GMAIL_RCVD 1677 0.61 1.05 0.46 150 XM_OfRef7 1649 0.41 1.04 0.20 151 XMBrknScrpt_02 1637 0.67 1.03 0.54 152 FILL_THIS_FORM_LOAN 1582 0.45 0.99 0.26 153 XMFrmHeader_21 1580 0.25 0.99 0.00 154 DIET_1 1530 0.49 0.96 0.32 155 T_Symld_Words_02 1530 0.62 0.96 0.50 156 RELAYCOUNTRY_GB 1499 1.16 0.94 1.24 157 XMGppyBdWords 1485 0.36 0.93 0.16 158 NML_ADSP_CUSTOM_MED 1455 0.77 0.91 0.73 159 XM_B_REG_HTML 1444 0.55 0.91 0.43 160 HTML_FONT_FACE_BAD 1434 0.66 0.90 0.58 161 XMPhish14 1433 0.50 0.90 0.37 162 XM_UB60 1432 0.29 0.90 0.09 163 RELAYCOUNTRY_AT 1421 0.38 0.89 0.21 164 XM_XX_Yahoo 1410 0.36 0.89 0.19 165 URIBL_BLACK 1403 0.26 0.88 0.05 166 XMHTMLBadTable_001 1376 0.47 0.86 0.33 167 REPLYTO_WITHOUT_TO_CC 1365 0.28 0.86 0.08 168 XM_H_TOP 1353 0.22 0.85 0.01 169 BASE64_LENGTH_79_INF 1342 0.46 0.84 0.33 170 RELAYCOUNTRY_NL 1329 0.48 0.83 0.36 171 URIBL_DBL_ABUSE_REDIR 1326 0.22 0.83 0.01 172 HK_RANDOM_REPLYTO 1308 0.35 0.82 0.19 173 TR_M_TOP_BAYES 1301 0.21 0.82 0.00 174 HELO_NODOT 1295 1.71 0.81 2.01 175 XMClaimOffer 1289 0.36 0.81 0.20 176 HELO_NO_DOMAIN 1284 1.70 0.81 2.01 177 TooManyTo_002 1273 2.03 0.80 2.44 178 TR_XM_DK_Bayes 1272 7.83 0.80 10.22 179 NUMERIC_HTTP_ADDR 1268 0.51 0.80 0.41 180 XM_Combo_Sbj 1266 0.40 0.80 0.26 181 RDNS_DYNAMIC 1251 0.50 0.79 0.41 182 RELAYCOUNTRY_IN 1228 0.30 0.77 0.14 183 TR_Mismatch_TLD_02 1227 0.25 0.77 0.07 184 BAYES_05 1219 1.68 0.77 1.99 185 URI_NOVOWEL 1206 0.50 0.76 0.41 186 RCVD_IN_IADB_OPTIN 1166 2.03 0.73 2.48 187 HTML_TAG_BALANCE_BODY 1158 0.52 0.73 0.45 188 TR_XM_DK_Bayes1 1143 7.39 0.72 9.65 189 XM_Lotto 1138 0.27 0.71 0.12 190 XM_BadFromFormat 1136 0.27 0.71 0.12 191 RELAYCOUNTRY_CN 1133 0.25 0.71 0.09 192 THIS_AD 1123 0.41 0.71 0.31 193 MPART_ALT_DIFF_COUNT 1110 0.38 0.70 0.27 194 FROM_MISSP_REPLYTO 1103 0.19 0.69 0.02 195 XM_UB80 1080 0.19 0.68 0.03 196 XM_B_COPY_HTML 1068 0.58 0.67 0.54 197 HTML_FONT_SIZE_LARGE 1065 0.30 0.67 0.17 198 XM_PDF 1058 4.19 0.66 5.39 199 TM2_M_A_HREF_HREF 1057 0.61 0.66 0.60 200 TooManyTo_003 1044 1.36 0.66 1.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 411705 89.57 94.27 87.97 2 DKIM_SIGNED 350370 76.16 79.95 74.87 3 XM_DK_Pass 343877 74.14 76.08 73.48 4 DKIM_VALID 326917 70.43 72.12 69.86 5 DCC_CHECK_NEGATIVE 276157 48.53 17.72 59.01 6 BAYES_50 248728 48.06 33.11 53.15 7 DKIM_VALID_AU 236316 51.41 54.08 50.50 8 XMListUnsubscribeExists 229845 55.42 73.96 49.11 9 DCC_CHECK 181917 49.43 80.45 38.87 10 T_TM2_M_HEADER_IN_MSG 151572 28.79 18.22 32.39 11 DKIM_VALID_EF 135506 26.93 21.00 28.96 12 HTML_FONT_LOW_CONTRAST 125979 29.59 37.45 26.92 13 XMSubLong 104610 23.68 27.58 22.35 14 FVGT_m_MULTI_ODD 100740 22.36 24.80 21.53 15 LOC_TINY_FONT_1 100241 24.45 33.35 21.42 16 MultiRelay 96512 19.23 15.12 20.62 17 MIME_HTML_ONLY 94679 23.02 31.24 20.23 18 T_KAM_HTML_FONT_INVALID 76591 17.46 20.67 16.37 19 ALL_TRUSTED 73731 12.38 2.46 15.75 20 XM_DK_Undo_02 64391 22.25 47.22 13.76 21 BAYES_00 60729 10.01 1.28 12.98 22 BAYES_99 56415 19.69 42.13 12.05 23 XM_Body_Dirty_Words 56146 14.35 21.25 12.00 24 XM_Multi_Part_URI 53004 12.72 16.83 11.33 25 BAYES_999 49684 16.85 35.19 10.62 26 RCVD_IN_RP_SAFE 47975 8.41 2.98 10.25 27 TR_XM_DK_Bayes 47839 7.83 0.80 10.22 28 TR_XM_DK_Bayes1 45174 7.39 0.72 9.65 29 RCVD_IN_RP_CERTIFIED 43398 7.50 2.27 9.27 30 LOTS_OF_MONEY 42491 10.54 14.85 9.08 31 XM_Evil_Numbers_Gen 41614 10.38 14.75 8.89 32 TooManyTo_001 39314 8.11 7.24 8.40 33 T_XMDrugObfuBody_14 38156 8.29 8.71 8.15 34 TR_XM_DK_Bayes2 37759 6.18 0.62 8.07 35 LotsOfNums_01 37151 8.75 11.12 7.94 36 XM_DKIMWhitelistDomains 36133 6.19 1.68 7.72 37 HTML_IMAGE_RATIO_02 34556 8.79 12.93 7.38 38 FSL_BULK_SIG 31627 8.16 12.28 6.76 39 XM_SendGrid 30161 5.71 3.57 6.44 40 XM_H_Long_From01 29401 7.18 9.83 6.28 41 BAYES_60 28732 6.26 6.61 6.14 42 TR_DCC_Bayes_99 27084 12.97 34.07 5.79 43 MIME_QP_LONG_LINE 26492 5.72 5.91 5.66 44 RCVD_IN_IADB_LISTED 26465 4.98 3.00 5.66 45 XM_B_Phish_Phrases 25972 5.93 7.07 5.55 46 T_TooManySym_01 25844 4.83 2.80 5.52 47 XM_PDF 25219 4.19 0.66 5.39 48 RELAYCOUNTRY_META 25134 8.34 17.09 5.37 49 XMStrtUSub 24229 4.71 3.35 5.18 50 DKIM_INVALID 23453 5.73 7.82 5.01 51 HTML_IMAGE_RATIO_04 23380 5.78 8.08 5.00 52 RCVD_IN_IADB_SPF 23144 4.38 2.71 4.95 53 T_REMOTE_IMAGE 21337 4.48 4.26 4.56 54 BOTNET_IPINHOSTNAME 21226 7.78 17.32 4.54 55 RCVD_IN_MSPIKE_H2 20531 3.95 2.68 4.39 56 RCVD_IN_IADB_SENDERID 19949 3.83 2.58 4.26 57 RCVD_IN_IADB_DK 19619 3.78 2.57 4.19 58 IN_ZIMBRA_NJ_WHITELIST 19357 3.09 0.02 4.14 59 BAYES_40 19335 3.58 1.98 4.13 60 FROM_EXCESS_BASE64 19062 4.22 4.64 4.07 61 TO_MALFORMED 18055 2.90 0.08 3.86 62 XMSubMetaSx_00 17948 4.71 7.27 3.84 63 RCVD_IN_IADB_VOUCHED 17873 3.15 1.19 3.82 64 BAYES_80 17481 4.89 8.28 3.74 65 MPART_ALT_DIFF 17104 4.45 6.80 3.65 66 XM_UncommonTLD01 16265 5.80 12.62 3.48 67 TR_XM_DK_SendGrid 15954 2.93 1.54 3.41 68 HTML_IMAGE_RATIO_06 15545 3.56 4.28 3.32 69 XMSexyCombo_05 15352 5.07 10.32 3.28 70 XM_B_SpammyTLD 14988 3.76 5.38 3.20 71 BAYES_20 14802 2.74 1.48 3.16 72 XMNumbers 13970 3.14 3.61 2.99 73 MAILING_LIST_MULTI 12764 2.45 1.65 2.73 74 XM_DIRTYINTL 12633 3.20 4.68 2.70 75 HTML_MIME_NO_HTML_TAG 12013 2.76 3.32 2.57 76 UNPARSEABLE_RELAY 11952 2.22 1.23 2.55 77 XMDiploma_00 11839 2.61 2.83 2.53 78 RCVD_IN_IADB_OPTIN 11587 2.03 0.73 2.48 79 BAYES_95 11583 2.93 4.25 2.48 80 TooManyTo_002 11430 2.03 0.80 2.44 81 HTML_IMAGE_RATIO_08 10606 2.64 3.73 2.27 82 TVD_RCVD_IP 10427 1.75 0.36 2.23 83 KHOP_HELO_FCRDNS 10334 2.23 2.31 2.21 84 MIME_HTML_MOSTLY 9989 2.48 3.49 2.13 85 RCVD_IN_MSPIKE_WL 9589 1.64 0.46 2.05 86 RCVD_IN_MSPIKE_H3 9540 1.64 0.46 2.04 87 HELO_NODOT 9404 1.71 0.81 2.01 88 HELO_NO_DOMAIN 9403 1.70 0.81 2.01 89 BAYES_05 9336 1.68 0.77 1.99 90 BOTNET 9254 5.70 16.63 1.98 91 XM_SPF_SoftFail 9185 2.33 3.41 1.96 92 MIME_HTML_ONLY_MULTI 9179 2.42 3.76 1.96 93 T_TooManySym_02 9082 1.73 1.11 1.94 94 TM2_M_URI_OPT_OUT 8854 2.32 3.60 1.89 95 TR_Symld_Words 8824 1.75 1.36 1.89 96 URI_HEX 8631 2.23 3.38 1.84 97 ANY_BOUNCE_MESSAGE 8618 1.48 0.43 1.84 98 BOUNCE_MESSAGE 8617 1.48 0.43 1.84 99 XM_CamelCaseFrm001 8528 2.18 3.23 1.82 100 XM_DK_Undo_01 8378 1.71 1.47 1.79 101 IN_HORDE_ADDRESS_BOOK 8324 1.33 0.03 1.78 102 TR_MetaPhish_Combo_01 8163 1.68 1.48 1.74 103 SUBJ_ALL_CAPS 7661 1.73 1.99 1.64 104 XM_OfRef6 7566 2.04 3.27 1.62 105 XMCapTrack 7549 1.29 0.35 1.61 106 INVALID_MSGID 7549 1.26 0.20 1.61 107 TooManyTo_003 7501 1.36 0.66 1.60 108 XMGenDplmaNmb 7136 1.60 1.82 1.52 109 T_XMDrugObfuBody_08 6884 1.77 2.67 1.47 110 RELAYCOUNTRY_CA 6685 2.18 4.39 1.43 111 UNTRUSTED_Relay 6474 3.68 10.42 1.38 112 XMPhish11 6066 1.30 1.32 1.30 113 USER_IN_DEF_DKIM_WL 5948 0.95 0.01 1.27 114 XM_GoogleGroups 5831 1.05 0.47 1.25 115 RELAYCOUNTRY_GB 5781 1.16 0.94 1.24 116 URI_TRY_3LD 5741 1.39 1.86 1.23 117 TM2_M_VERY_LONG_WORD 5694 1.29 1.52 1.22 118 TooManyTo_004 5605 1.02 0.50 1.20 119 NO_DNS_FOR_FROM 5209 1.52 2.71 1.11 120 TooManyTo_005 4708 0.86 0.44 1.01 121 DKIM_ADSP_CUSTOM_MED 4677 1.05 1.18 1.00 122 XMStockSpam_06 4675 1.38 2.52 1.00 123 XM_H_Long_From02 4499 1.13 1.62 0.96 124 SpammyFromTLD_01 4216 1.08 1.61 0.90 125 T_FILL_THIS_FORM_SHORT 4207 0.99 1.27 0.90 126 TR_XM_PHPDW 4182 1.24 2.25 0.89 127 XMBdyGiftCard01 4149 1.13 1.87 0.89 128 TR_XM_PHPForged 4082 1.22 2.23 0.87 129 TR_XM_FormFill2 4062 1.21 2.21 0.87 130 TR_XM_RelayPhish 4053 1.03 1.49 0.87 131 XM_H_PHPOS 4048 1.20 2.20 0.86 132 T_OBFU_PDF_ATTACH 3974 0.68 0.20 0.85 133 T_XMDrugObfuBody_00 3893 0.93 1.22 0.83 134 XM_UB50 3891 1.85 4.83 0.83 135 XM_ProductURIs 3794 1.25 2.56 0.81 136 NML_ADSP_CUSTOM_MED 3399 0.77 0.91 0.73 137 XMNoVowels 3323 0.69 0.65 0.71 138 XM_H_PHPMailer 3235 0.83 1.25 0.69 139 DKIM_ADSP_NXDOMAIN 3211 1.16 2.56 0.69 140 XM_ShortIntro_01 3155 0.58 0.31 0.67 141 T_TooManySym_03 3153 0.55 0.18 0.67 142 XMSubMetaSxObfu_03 3114 1.05 2.16 0.67 143 FILL_THIS_FORM 2855 0.80 1.35 0.61 144 XMBody_78 2808 1.01 2.21 0.60 145 FROM_GOV_DKIM_AU 2807 0.51 0.25 0.60 146 TM2_M_A_HREF_HREF 2787 0.61 0.66 0.60 147 XMMoneyMeta_00 2756 0.73 1.15 0.59 148 T_XMHurry_00 2745 0.76 1.29 0.59 149 FROM_GOV_SPOOF 2730 0.50 0.25 0.58 150 HTML_FONT_FACE_BAD 2723 0.66 0.90 0.58 151 HTTPS_HTTP_MISMATCH 2720 0.59 0.62 0.58 152 SHORT_HELO_AND_INLINE_IMAGE 2708 0.44 0.03 0.58 153 MISSING_HEADERS 2610 0.69 1.09 0.56 154 RCVD_IN_BL_SPAMCOP_NET 2610 1.60 4.66 0.56 155 AC_DIV_BONANZA 2604 0.45 0.15 0.56 156 XMBody_95 2598 0.46 0.18 0.56 157 XMGappySubj_01 2595 0.49 0.30 0.55 158 USER_IN_WHITELIST 2567 0.41 0.00 0.55 159 XMLngstWrd_00 2560 0.49 0.32 0.55 160 XM_B_COPY_HTML 2550 0.58 0.67 0.54 161 XMBrknScrpt_02 2535 0.67 1.03 0.54 162 XMSexyCombo_01 2531 1.21 3.19 0.54 163 T_MONEY_PERCENT 2397 0.87 1.91 0.51 164 TR_LOTS_OF_MONEY2 2397 0.87 1.91 0.51 165 XMLngstWrd_01 2383 0.45 0.29 0.51 166 T_Symld_Words_02 2362 0.62 0.96 0.50 167 RCVD_IN_SORBS_DUL 2360 0.45 0.28 0.50 168 XMPhish30 2282 0.75 1.53 0.49 169 RELAYCOUNTRY_AU 2271 0.51 0.58 0.49 170 XMSubMetaI_00 2225 0.75 1.54 0.48 171 TM2_M_BODY_EMPTY 2172 0.43 0.35 0.46 172 XMBody_17 2166 0.78 1.70 0.46 173 FORGED_GMAIL_RCVD 2161 0.61 1.05 0.46 174 XM_URI_RBL 2130 1.35 3.99 0.46 175 HTML_TAG_BALANCE_BODY 2107 0.52 0.73 0.45 176 XMDateMe_00 2098 0.43 0.39 0.45 177 XMHTML_After_End 2024 0.68 1.43 0.43 178 HTML_IMAGE_ONLY_32 2016 0.48 0.63 0.43 179 XM_B_REG_HTML 1991 0.55 0.91 0.43 180 HTML_IMAGE_ONLY_28 1971 0.47 0.63 0.42 181 XMLKML 1941 0.31 0.00 0.41 182 NUMERIC_HTTP_ADDR 1939 0.51 0.80 0.41 183 URI_NOVOWEL 1928 0.50 0.76 0.41 184 HTML_IMAGE_ONLY_24 1920 0.39 0.32 0.41 185 RDNS_DYNAMIC 1898 0.50 0.79 0.41 186 RCVD_IN_RP_RNBL 1817 0.74 1.76 0.39 187 RELAYCOUNTRY_DE 1743 0.44 0.64 0.37 188 TR_LOTS_OF_MONEY3 1729 0.43 0.60 0.37 189 XMPhish14 1709 0.50 0.90 0.37 190 PLING_QUERY 1677 0.38 0.43 0.36 191 RELAYCOUNTRY_NL 1668 0.48 0.83 0.36 192 XMSolicitRefs_0 1649 0.77 1.99 0.35 193 XMSubMetaSxObfu_02 1638 0.34 0.29 0.35 194 FSL_THIS_IS_ADV 1631 0.39 0.53 0.35 195 XMSubNoVowel 1626 0.36 0.41 0.35 196 HTML_IMAGE_ONLY_20 1626 0.60 1.36 0.35 197 HTML_IMAGE_ONLY_16 1624 0.30 0.17 0.35 198 XM_Body_Obfu01 1616 0.33 0.30 0.35 199 BASE64_LENGTH_79_INF 1563 0.46 0.84 0.33 200 XMRcvdHeader_15 1562 0.25 0.00 0.33 ----------------------------------------------------------------------