Email: 578270 Autolearn: 0 AvgScore: 2.59 AvgScanTime: 2.04 sec Spam: 142078 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 2.47 sec Ham: 436192 Autolearn: 0 AvgScore: -0.55 AvgScanTime: 1.90 sec Time Spent Running SA: 327.40 hours Time Spent Processing Spam: 97.41 hours Time Spent Processing Ham: 230.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132054 89.01 92.94 87.72 2 DKIM_SIGNED 116250 77.35 81.82 75.90 3 XM_DK_Pass 110657 75.38 77.88 74.57 4 DCC_CHECK 108578 48.17 76.42 38.97 5 XMListUnsubscribeExists 107827 56.03 75.89 49.57 6 DKIM_VALID 104839 71.55 73.79 70.83 7 DKIM_VALID_AU 79710 52.44 56.10 51.24 8 XM_DK_Undo_02 64984 22.17 45.74 14.49 9 BAYES_99 58148 19.91 40.93 13.06 10 BAYES_50 50347 48.17 35.44 52.32 11 HTML_FONT_LOW_CONTRAST 48998 29.75 34.49 28.21 12 BAYES_999 48082 17.06 33.84 11.59 13 MIME_HTML_ONLY 46710 23.57 32.88 20.53 14 LOC_TINY_FONT_1 45732 23.83 32.19 21.10 15 TR_DCC_Bayes_99 45467 12.53 32.00 6.19 16 FVGT_m_MULTI_ODD 40446 22.81 28.47 20.97 17 XMSubLong 37603 23.48 26.47 22.50 18 DCC_CHECK_NEGATIVE 31110 49.93 21.90 59.07 19 DKIM_VALID_EF 30944 27.23 21.78 29.00 20 XM_Body_Dirty_Words 30343 15.44 21.36 13.52 21 T_KAM_HTML_FONT_INVALID 29915 17.39 21.06 16.20 22 RELAYCOUNTRY_META 28725 9.06 20.22 5.42 23 T_TM2_M_HEADER_IN_MSG 28339 27.72 19.95 30.25 24 BOTNET 26447 5.95 18.61 1.82 25 XM_Multi_Part_URI 24453 13.57 17.21 12.38 26 HTML_IMAGE_RATIO_02 23394 10.31 16.47 8.31 27 MultiRelay 23036 18.96 16.21 19.86 28 BOTNET_IPINHOSTNAME 21832 7.35 15.37 4.73 29 LOTS_OF_MONEY 18571 10.92 13.07 10.22 30 UNTRUSTED_Relay 18389 4.55 12.94 1.81 31 XM_UncommonTLD01 17301 5.76 12.18 3.66 32 XM_Evil_Numbers_Gen 16748 9.68 11.79 9.00 33 FSL_BULK_SIG 15276 8.01 10.75 7.12 34 XMSexyCombo_05 14648 5.26 10.31 3.62 35 T_XMDrugObfuBody_14 13854 8.78 9.75 8.47 36 LotsOfNums_01 12437 8.47 8.75 8.37 37 DKIM_INVALID 11411 5.80 8.03 5.07 38 XMSubMetaSx_00 11197 5.06 7.88 4.14 39 HTML_IMAGE_RATIO_04 10707 5.78 7.54 5.21 40 BAYES_80 10244 4.76 7.21 3.96 41 XM_H_Long_From01 10172 6.43 7.16 6.19 42 XM_UB50 9994 2.62 7.03 1.19 43 TooManyTo_001 9847 8.00 6.93 8.35 44 T_REMOTE_IMAGE 9820 5.02 6.91 4.40 45 XM_B_Phish_Phrases 9284 6.07 6.53 5.93 46 MPART_ALT_DIFF 9032 3.89 6.36 3.08 47 MIME_QP_LONG_LINE 8505 5.99 5.99 5.99 48 HTML_MIME_NO_HTML_TAG 8334 3.32 5.87 2.49 49 BAYES_60 8019 5.88 5.64 5.95 50 FROM_EXCESS_BASE64 8013 4.39 5.64 3.98 51 XM_DIRTYINTL 7508 3.36 5.28 2.73 52 HTML_IMAGE_RATIO_06 6931 3.70 4.88 3.32 53 XMStrtUSub 6589 4.75 4.64 4.78 54 XMNumbers 6522 3.40 4.59 3.01 55 XMDiploma_00 6419 2.54 4.52 1.89 56 BAYES_95 6129 3.06 4.31 2.65 57 RELAYCOUNTRY_FR 6113 1.24 4.30 0.24 58 XM_SPF_SoftFail 5993 2.50 4.22 1.94 59 RELAYCOUNTRY_CA 5777 2.06 4.07 1.41 60 SpammyFromTLD_02 5754 1.30 4.05 0.41 61 BOTNET_NORDNS 5591 0.98 3.94 0.02 62 MIME_HTML_MOSTLY 5581 2.75 3.93 2.37 63 XM_SendGrid 5501 5.66 3.87 6.25 64 URI_HEX 5474 2.56 3.85 2.13 65 MIME_HTML_ONLY_MULTI 5412 2.09 3.81 1.53 66 XM_B_SpammyTLD 5252 3.40 3.70 3.31 67 FROM_SUSPICIOUS_NTLD 4897 0.87 3.45 0.03 68 TR_XM_PHPDW 4870 1.66 3.43 1.09 69 HTML_IMAGE_RATIO_08 4868 2.45 3.43 2.14 70 TM2_M_URI_OPT_OUT 4829 2.14 3.40 1.73 71 XM_CamelCaseFrm001 4816 2.17 3.39 1.77 72 TR_XM_PHPForged 4789 1.63 3.37 1.06 73 TR_XM_FormFill2 4766 1.62 3.35 1.06 74 XM_H_PHPOS 4750 1.62 3.34 1.06 75 DKIM_ADSP_NXDOMAIN 4651 1.17 3.27 0.49 76 XM_URI_RBL 4641 1.13 3.27 0.43 77 RCVD_IN_RP_SAFE 4567 8.92 3.21 10.78 78 XMGenDplmaNmb 4565 1.75 3.21 1.27 79 XM_OfRef6 4415 1.80 3.11 1.37 80 T_TooManySym_01 4346 5.60 3.06 6.42 81 RCVD_IN_IADB_LISTED 4249 5.24 2.99 5.98 82 XMSexyCombo_01 4101 1.29 2.89 0.77 83 SpammyFromTLD_01 4080 1.56 2.87 1.13 84 XMBdyGiftCard01 4078 1.50 2.87 1.05 85 RCVD_IN_MSPIKE_H2 4058 4.19 2.86 4.62 86 T_XMDrugObfuBody_08 3893 1.79 2.74 1.48 87 XMBody_17 3865 1.04 2.72 0.50 88 RCVD_IN_IADB_SPF 3706 4.52 2.61 5.14 89 KHOP_HELO_FCRDNS 3579 2.24 2.52 2.15 90 RCVD_IN_BL_SPAMCOP_NET 3545 1.00 2.50 0.51 91 RCVD_IN_IADB_SENDERID 3538 3.97 2.49 4.45 92 RCVD_IN_IADB_DK 3463 3.88 2.44 4.35 93 TR_Mismatch_TLD_02 3441 0.65 2.42 0.08 94 BAYES_40 3328 3.68 2.34 4.11 95 RCVD_IN_RP_CERTIFIED 3316 7.81 2.33 9.59 96 SUBJ_ALL_CAPS 3251 2.33 2.29 2.35 97 BODY_URI_ONLY 3250 0.66 2.29 0.13 98 PDS_TO_EQ_FROM_NAME 3109 0.56 2.19 0.03 99 T_XMHurry_00 3010 1.04 2.12 0.69 100 RELAYCOUNTRY_GB 2959 1.39 2.08 1.16 101 XM_UB99 2840 0.50 2.00 0.02 102 NO_DNS_FOR_FROM 2815 1.33 1.98 1.12 103 ALL_TRUSTED 2787 12.17 1.96 15.49 104 HTML_IMAGE_ONLY_24 2694 0.76 1.90 0.39 105 BAYES_20 2669 2.84 1.88 3.16 106 MultiRelay_CC 2621 0.62 1.84 0.23 107 MultiRelay_Combo 2621 0.62 1.84 0.23 108 RCVD_IN_PSBL 2610 0.51 1.84 0.08 109 MIME_HEADER_CTYPE_ONLY 2592 0.53 1.82 0.11 110 RELAYCOUNTRY_DE 2576 1.06 1.81 0.81 111 HTML_SHORT_LINK_IMG_1 2564 0.46 1.80 0.02 112 TM2_M_VERY_LONG_WORD 2517 1.38 1.77 1.26 113 HTML_IMAGE_ONLY_08 2471 0.52 1.74 0.13 114 URI_TRY_3LD 2463 1.35 1.73 1.22 115 DATE_IN_PAST_03_06 2459 0.49 1.73 0.08 116 MAILING_LIST_MULTI 2453 2.21 1.73 2.37 117 XM_H_Long_From02 2444 1.22 1.72 1.06 118 HDRS_LCASE_IMGONLY 2417 0.45 1.70 0.04 119 URIBL_DBL_ABUSE_REDIR 2410 0.43 1.70 0.02 120 T_XMDrugObfuBody_00 2391 1.38 1.68 1.28 121 RCVD_IN_RP_RNBL 2373 0.44 1.67 0.04 122 UNPARSEABLE_RELAY 2370 2.47 1.67 2.74 123 XM_ProductURIs 2188 1.31 1.54 1.24 124 XMStockSpam_06 2109 1.48 1.48 1.48 125 TR_XM_DK_SendGrid 2088 2.77 1.47 3.20 126 XM_H_PHPMailer 2077 0.80 1.46 0.58 127 DIET_1 2072 0.56 1.46 0.27 128 TM2_M_BODY_EMPTY 2069 0.94 1.46 0.77 129 ALIBABA_IMG_NOT_RCVD_ALI 2045 0.36 1.44 0.00 130 XMEmptyBody_01 2004 0.69 1.41 0.45 131 XM_UB999 1995 0.36 1.40 0.01 132 RCVD_IN_IADB_VOUCHED 1987 3.36 1.40 4.00 133 TR_XM_RelayPhish 1985 1.00 1.40 0.87 134 BAYES_05 1931 1.85 1.36 2.02 135 XM_UB60 1854 0.40 1.30 0.10 136 XMMoneyMeta_00 1776 0.72 1.25 0.55 137 XMSubMetaI_00 1765 0.61 1.24 0.41 138 DATE_IN_PAST_06_12 1762 0.33 1.24 0.03 139 TR_Symld_Words 1755 1.84 1.24 2.03 140 URIBL_BLACK 1708 0.34 1.20 0.05 141 RELAYCOUNTRY_NL 1688 0.44 1.19 0.19 142 DKIM_ADSP_CUSTOM_MED 1687 1.16 1.19 1.15 143 HOSTED_IMG_DIRECT_MX 1664 0.29 1.17 0.00 144 XMSubMetaSxObfu_03 1654 0.72 1.16 0.58 145 T_Symld_Words_02 1653 0.86 1.16 0.76 146 XMBrknScrpt_02 1651 0.73 1.16 0.58 147 XM_DK_Undo_01 1649 1.58 1.16 1.71 148 XMPhish11 1636 1.15 1.15 1.15 149 RELAYCOUNTRY_IN 1600 0.35 1.13 0.10 150 FILL_THIS_FORM 1494 0.78 1.05 0.69 151 XM_HighProb1 1480 0.27 1.04 0.01 152 XMSlimDrugH 1473 0.48 1.04 0.29 153 XMPhish30 1465 0.65 1.03 0.53 154 PLING_QUERY 1463 0.55 1.03 0.39 155 FORGED_GMAIL_RCVD 1456 0.61 1.02 0.47 156 XM_H_PHPOS_M 1451 0.42 1.02 0.23 157 XMHTML_After_End 1416 0.56 1.00 0.42 158 XMSexyCombo_04 1383 0.37 0.97 0.17 159 FILL_THIS_FORM_LOAN 1381 0.45 0.97 0.28 160 RDNS_DYNAMIC 1378 0.53 0.97 0.39 161 RELAYCOUNTRY_AT 1372 0.35 0.97 0.15 162 HTML_FONT_FACE_BAD 1332 0.83 0.94 0.79 163 XM_B_REG_HTML 1320 0.73 0.93 0.67 164 TR_Caps_n_Bayes_99 1312 0.50 0.92 0.36 165 NML_ADSP_CUSTOM_MED 1298 0.87 0.91 0.85 166 SUBJ_DOLLARS 1272 0.47 0.90 0.33 167 NUMERIC_HTTP_ADDR 1262 0.52 0.89 0.40 168 XMBody_78 1242 0.76 0.87 0.73 169 TR_Mismatch_TLD_01 1225 0.32 0.86 0.14 170 LongTLD 1202 0.32 0.85 0.15 171 XM_UB80 1187 0.23 0.84 0.04 172 FILL_THIS_FORM_LONG 1186 0.41 0.83 0.27 173 SHORT_IMG_SUSP_NTLD 1168 0.20 0.82 0.00 174 FROM_NTLD_LINKBAIT 1167 0.20 0.82 0.00 175 XMHTMLBadTable_001 1166 0.65 0.82 0.60 176 TR_LOTS_OF_MONEY3 1161 0.49 0.82 0.39 177 T_MONEY_PERCENT 1104 0.51 0.78 0.42 178 TR_LOTS_OF_MONEY2 1104 0.51 0.78 0.42 179 RCVD_IN_IADB_OPTIN 1081 2.08 0.76 2.51 180 FROM_MISSP_REPLYTO 1073 0.20 0.76 0.02 181 TR_MetaPhish_Combo_01 1066 1.58 0.75 1.85 182 XM_BadFromFormat 1054 0.26 0.74 0.10 183 XMSubMetaSSx_00 1054 0.34 0.74 0.21 184 MISSING_HEADERS 1018 0.59 0.72 0.54 185 BAYES_00 1010 9.59 0.71 12.49 186 T_FILL_THIS_FORM_SHORT 1003 1.02 0.71 1.12 187 XM_PDF 998 3.86 0.70 4.89 188 URI_NOVOWEL 996 0.46 0.70 0.38 189 XM_OfRef7 978 0.27 0.69 0.14 190 XM_RXBody 957 0.39 0.67 0.29 191 LONG_JUNK_URI 956 0.24 0.67 0.10 192 XM_Combo_Sbj 951 0.38 0.67 0.29 193 RELAYCOUNTRY_CN 951 0.21 0.67 0.06 194 TM2_M_A_HREF_HREF 949 0.67 0.67 0.68 195 T_TooManySym_02 944 1.77 0.66 2.13 196 XM_B_COPY_HTML 931 0.77 0.66 0.81 197 XMGppyBdWords 930 0.35 0.65 0.25 198 URIBL_DBL_SPAM 926 0.17 0.65 0.01 199 REPLYTO_WITHOUT_TO_CC 902 0.21 0.63 0.08 200 HTML_TAG_BALANCE_BODY 892 0.57 0.63 0.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 382645 89.01 92.94 87.72 2 DKIM_SIGNED 331067 77.35 81.82 75.90 3 XM_DK_Pass 325260 75.38 77.88 74.57 4 DKIM_VALID 308938 71.55 73.79 70.83 5 DCC_CHECK_NEGATIVE 257649 49.93 21.90 59.07 6 BAYES_50 228208 48.17 35.44 52.32 7 DKIM_VALID_AU 223512 52.44 56.10 51.24 8 XMListUnsubscribeExists 216206 56.03 75.89 49.57 9 DCC_CHECK 169985 48.17 76.42 38.97 10 T_TM2_M_HEADER_IN_MSG 131963 27.72 19.95 30.25 11 DKIM_VALID_EF 126493 27.23 21.78 29.00 12 HTML_FONT_LOW_CONTRAST 123053 29.75 34.49 28.21 13 XMSubLong 98157 23.48 26.47 22.50 14 LOC_TINY_FONT_1 92056 23.83 32.19 21.10 15 FVGT_m_MULTI_ODD 91462 22.81 28.47 20.97 16 MIME_HTML_ONLY 89565 23.57 32.88 20.53 17 MultiRelay 86610 18.96 16.21 19.86 18 T_KAM_HTML_FONT_INVALID 70643 17.39 21.06 16.20 19 ALL_TRUSTED 67581 12.17 1.96 15.49 20 XM_DK_Undo_02 63193 22.17 45.74 14.49 21 XM_Body_Dirty_Words 58965 15.44 21.36 13.52 22 BAYES_99 56964 19.91 40.93 13.06 23 BAYES_00 54464 9.59 0.71 12.49 24 XM_Multi_Part_URI 54014 13.57 17.21 12.38 25 BAYES_999 50545 17.06 33.84 11.59 26 RCVD_IN_RP_SAFE 47031 8.92 3.21 10.78 27 LOTS_OF_MONEY 44572 10.92 13.07 10.22 28 TR_XM_DK_Bayes 44413 7.76 0.33 10.18 29 TR_XM_DK_Bayes1 42080 7.34 0.27 9.65 30 RCVD_IN_RP_CERTIFIED 41829 7.81 2.33 9.59 31 XM_Evil_Numbers_Gen 39241 9.68 11.79 9.00 32 XM_DKIMWhitelistDomains 38619 6.68 0.02 8.85 33 T_XMDrugObfuBody_14 36944 8.78 9.75 8.47 34 LotsOfNums_01 36527 8.47 8.75 8.37 35 TooManyTo_001 36442 8.00 6.93 8.35 36 HTML_IMAGE_RATIO_02 36251 10.31 16.47 8.31 37 TR_XM_DK_Bayes2 35581 6.20 0.19 8.16 38 FSL_BULK_SIG 31052 8.01 10.75 7.12 39 T_TooManySym_01 28019 5.60 3.06 6.42 40 XM_SendGrid 27245 5.66 3.87 6.25 41 XM_H_Long_From01 27005 6.43 7.16 6.19 42 TR_DCC_Bayes_99 26981 12.53 32.00 6.19 43 MIME_QP_LONG_LINE 26112 5.99 5.99 5.99 44 RCVD_IN_IADB_LISTED 26079 5.24 2.99 5.98 45 BAYES_60 25970 5.88 5.64 5.95 46 XM_B_Phish_Phrases 25845 6.07 6.53 5.93 47 RELAYCOUNTRY_META 23648 9.06 20.22 5.42 48 HTML_IMAGE_RATIO_04 22729 5.78 7.54 5.21 49 RCVD_IN_IADB_SPF 22407 4.52 2.61 5.14 50 DKIM_INVALID 22129 5.80 8.03 5.07 51 XM_PDF 21346 3.86 0.70 4.89 52 XMStrtUSub 20865 4.75 4.64 4.78 53 BOTNET_IPINHOSTNAME 20647 7.35 15.37 4.73 54 TO_MALFORMED 20632 3.59 0.07 4.73 55 RCVD_IN_MSPIKE_H2 20170 4.19 2.86 4.62 56 RCVD_IN_IADB_SENDERID 19403 3.97 2.49 4.45 57 T_REMOTE_IMAGE 19189 5.02 6.91 4.40 58 RCVD_IN_IADB_DK 18969 3.88 2.44 4.35 59 XMSubMetaSx_00 18044 5.06 7.88 4.14 60 BAYES_40 17942 3.68 2.34 4.11 61 IN_ZIMBRA_NJ_WHITELIST 17669 3.06 0.02 4.05 62 RCVD_IN_IADB_VOUCHED 17444 3.36 1.40 4.00 63 FROM_EXCESS_BASE64 17374 4.39 5.64 3.98 64 BAYES_80 17280 4.76 7.21 3.96 65 XM_UncommonTLD01 15982 5.76 12.18 3.66 66 XMSexyCombo_05 15774 5.26 10.31 3.62 67 HTML_IMAGE_RATIO_06 14482 3.70 4.88 3.32 68 XM_B_SpammyTLD 14420 3.40 3.70 3.31 69 TR_XM_DK_SendGrid 13942 2.77 1.47 3.20 70 BAYES_20 13764 2.84 1.88 3.16 71 MPART_ALT_DIFF 13446 3.89 6.36 3.08 72 XMNumbers 13135 3.40 4.59 3.01 73 UNPARSEABLE_RELAY 11933 2.47 1.67 2.74 74 XM_DIRTYINTL 11895 3.36 5.28 2.73 75 BAYES_95 11544 3.06 4.31 2.65 76 RCVD_IN_IADB_OPTIN 10969 2.08 0.76 2.51 77 HTML_MIME_NO_HTML_TAG 10866 3.32 5.87 2.49 78 TooManyTo_002 10708 2.00 0.60 2.45 79 MIME_HTML_MOSTLY 10349 2.75 3.93 2.37 80 MAILING_LIST_MULTI 10323 2.21 1.73 2.37 81 TVD_RCVD_IP 10268 1.87 0.38 2.35 82 SUBJ_ALL_CAPS 10234 2.33 2.29 2.35 83 RCVD_IN_MSPIKE_WL 9737 1.78 0.41 2.23 84 RCVD_IN_MSPIKE_H3 9737 1.78 0.41 2.23 85 KHOP_HELO_FCRDNS 9389 2.24 2.52 2.15 86 HTML_IMAGE_RATIO_08 9322 2.45 3.43 2.14 87 URI_HEX 9305 2.56 3.85 2.13 88 T_TooManySym_02 9296 1.77 0.66 2.13 89 TR_Symld_Words 8868 1.84 1.24 2.03 90 BAYES_05 8791 1.85 1.36 2.02 91 XM_SPF_SoftFail 8455 2.50 4.22 1.94 92 XMDiploma_00 8241 2.54 4.52 1.89 93 TR_MetaPhish_Combo_01 8088 1.58 0.75 1.85 94 BOTNET 7933 5.95 18.61 1.82 95 HELO_NODOT 7927 1.50 0.54 1.82 96 HELO_NO_DOMAIN 7926 1.50 0.54 1.82 97 UNTRUSTED_Relay 7896 4.55 12.94 1.81 98 IN_HORDE_ADDRESS_BOOK 7820 1.36 0.04 1.79 99 XM_CamelCaseFrm001 7709 2.17 3.39 1.77 100 TM2_M_URI_OPT_OUT 7566 2.14 3.40 1.73 101 INVALID_MSGID 7479 1.32 0.12 1.71 102 XM_DK_Undo_01 7459 1.58 1.16 1.71 103 TooManyTo_003 7201 1.36 0.48 1.65 104 ANY_BOUNCE_MESSAGE 6805 1.29 0.45 1.56 105 BOUNCE_MESSAGE 6800 1.29 0.45 1.56 106 MIME_HTML_ONLY_MULTI 6687 2.09 3.81 1.53 107 XMStockSpam_06 6469 1.48 1.48 1.48 108 T_XMDrugObfuBody_08 6438 1.79 2.74 1.48 109 RELAYCOUNTRY_CA 6147 2.06 4.07 1.41 110 XMCapTrack 6041 1.12 0.30 1.38 111 XM_OfRef6 5991 1.80 3.11 1.37 112 USER_IN_DEF_DKIM_WL 5639 0.99 0.04 1.29 113 T_XMDrugObfuBody_00 5568 1.38 1.68 1.28 114 XMGenDplmaNmb 5543 1.75 3.21 1.27 115 TM2_M_VERY_LONG_WORD 5482 1.38 1.77 1.26 116 XM_ProductURIs 5403 1.31 1.54 1.24 117 XM_GoogleGroups 5379 1.05 0.48 1.23 118 URI_TRY_3LD 5341 1.35 1.73 1.22 119 TooManyTo_004 5288 1.00 0.35 1.21 120 XM_UB50 5176 2.62 7.03 1.19 121 RELAYCOUNTRY_GB 5058 1.39 2.08 1.16 122 DKIM_ADSP_CUSTOM_MED 5000 1.16 1.19 1.15 123 XMPhish11 4996 1.15 1.15 1.15 124 SpammyFromTLD_01 4934 1.56 2.87 1.13 125 NO_DNS_FOR_FROM 4899 1.33 1.98 1.12 126 T_FILL_THIS_FORM_SHORT 4867 1.02 0.71 1.12 127 TR_XM_PHPDW 4744 1.66 3.43 1.09 128 TR_XM_PHPForged 4639 1.63 3.37 1.06 129 XM_H_Long_From02 4624 1.22 1.72 1.06 130 TR_XM_FormFill2 4617 1.62 3.35 1.06 131 XM_H_PHPOS 4611 1.62 3.34 1.06 132 XMBdyGiftCard01 4596 1.50 2.87 1.05 133 XMGappySubj_01 4553 0.91 0.51 1.04 134 TooManyTo_005 4268 0.81 0.29 0.98 135 TR_XM_RelayPhish 3777 1.00 1.40 0.87 136 NML_ADSP_CUSTOM_MED 3720 0.87 0.91 0.85 137 XM_B_COPY_HTML 3543 0.77 0.66 0.81 138 RELAYCOUNTRY_DE 3536 1.06 1.81 0.81 139 HTML_FONT_FACE_BAD 3463 0.83 0.94 0.79 140 TM2_M_BODY_EMPTY 3365 0.94 1.46 0.77 141 XMSexyCombo_01 3337 1.29 2.89 0.77 142 T_Symld_Words_02 3325 0.86 1.16 0.76 143 XMBody_78 3172 0.76 0.87 0.73 144 T_OBFU_PDF_ATTACH 3059 0.57 0.17 0.70 145 FILL_THIS_FORM 3013 0.78 1.05 0.69 146 T_XMHurry_00 2997 1.04 2.12 0.69 147 XM_D_tchamptons_WL 2991 0.52 0.00 0.69 148 TM2_M_A_HREF_HREF 2950 0.67 0.67 0.68 149 XM_B_REG_HTML 2903 0.73 0.93 0.67 150 USER_IN_WHITELIST 2752 0.48 0.00 0.63 151 T_TooManySym_03 2732 0.51 0.16 0.63 152 FROM_GOV_SPOOF 2638 0.52 0.26 0.60 153 XMHTMLBadTable_001 2620 0.65 0.82 0.60 154 XMBody_95 2600 0.49 0.18 0.60 155 XMBrknScrpt_02 2551 0.73 1.16 0.58 156 XMSubMetaSxObfu_03 2529 0.72 1.16 0.58 157 XM_H_PHPMailer 2524 0.80 1.46 0.58 158 HTTPS_HTTP_MISMATCH 2519 0.57 0.56 0.58 159 XM_ShortIntro_01 2461 0.51 0.34 0.56 160 HTML_TAG_BALANCE_BODY 2415 0.57 0.63 0.55 161 XMMoneyMeta_00 2413 0.72 1.25 0.55 162 MISSING_HEADERS 2370 0.59 0.72 0.54 163 XM_H_Trusted_IP 2350 0.41 0.00 0.54 164 XMNoVowels 2336 0.53 0.49 0.54 165 XMPhish30 2318 0.65 1.03 0.53 166 RCVD_IN_BL_SPAMCOP_NET 2220 1.00 2.50 0.51 167 SHORT_HELO_AND_INLINE_IMAGE 2208 0.39 0.04 0.51 168 XMBody_17 2160 1.04 2.72 0.50 169 AC_DIV_BONANZA 2158 0.40 0.13 0.49 170 XMGappySubj_02 2137 0.39 0.09 0.49 171 DKIM_ADSP_NXDOMAIN 2130 1.17 3.27 0.49 172 FORGED_GMAIL_RCVD 2054 0.61 1.02 0.47 173 XMRcvdHeader_15 1997 0.35 0.00 0.46 174 XMEmptyBody_01 1961 0.69 1.41 0.45 175 RCVD_IN_SORBS_DUL 1950 0.40 0.26 0.45 176 XMLngstWrd_00 1938 0.42 0.35 0.44 177 XM_URI_RBL 1897 1.13 3.27 0.43 178 RELAYCOUNTRY_AU 1894 0.44 0.44 0.43 179 XMSubMetaSxObfu_02 1843 0.41 0.37 0.42 180 T_MONEY_PERCENT 1843 0.51 0.78 0.42 181 TR_LOTS_OF_MONEY2 1843 0.51 0.78 0.42 182 XMLngstWrd_01 1828 0.40 0.33 0.42 183 XMHTML_After_End 1813 0.56 1.00 0.42 184 SpammyFromTLD_02 1791 1.30 4.05 0.41 185 XMSubMetaI_00 1777 0.61 1.24 0.41 186 XMDateMe_00 1762 0.41 0.42 0.40 187 HTML_IMAGE_ONLY_32 1755 0.46 0.62 0.40 188 HTML_IMAGE_ONLY_28 1747 0.44 0.54 0.40 189 NUMERIC_HTTP_ADDR 1732 0.52 0.89 0.40 190 RDNS_DYNAMIC 1714 0.53 0.97 0.39 191 PLING_QUERY 1708 0.55 1.03 0.39 192 TR_LOTS_OF_MONEY3 1695 0.49 0.82 0.39 193 FROM_GOV_DKIM_AU 1686 0.32 0.11 0.39 194 HTML_IMAGE_ONLY_24 1685 0.76 1.90 0.39 195 URI_NOVOWEL 1661 0.46 0.70 0.38 196 REMOVE_BEFORE_LINK 1655 0.40 0.47 0.38 197 XM_Body_Obfu01 1601 0.37 0.36 0.37 198 TR_Caps_n_Bayes_99 1563 0.50 0.92 0.36 199 HTML_IMAGE_ONLY_16 1482 0.29 0.14 0.34 200 SUBJ_DOLLARS 1437 0.47 0.90 0.33 ----------------------------------------------------------------------