Email: 606381 Autolearn: 0 AvgScore: 2.90 AvgScanTime: 2.01 sec Spam: 151098 Autolearn: 0 AvgScore: 12.08 AvgScanTime: 2.44 sec Ham: 455283 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 1.87 sec Time Spent Running SA: 338.52 hours Time Spent Processing Spam: 102.52 hours Time Spent Processing Ham: 236.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139169 86.58 92.11 84.75 2 DKIM_SIGNED 124445 75.29 82.36 72.94 3 XM_DK_Pass 119812 73.59 79.29 71.70 4 DCC_CHECK 117185 47.16 77.56 37.07 5 XMListUnsubscribeExists 113187 54.28 74.91 47.44 6 DKIM_VALID 112828 69.60 74.67 67.91 7 DKIM_VALID_AU 88427 52.40 58.52 50.36 8 XM_DK_Undo_02 70813 21.43 46.87 12.98 9 BAYES_99 63751 18.72 42.19 10.93 10 BAYES_999 53591 16.08 35.47 9.64 11 HTML_FONT_LOW_CONTRAST 53404 28.06 35.34 25.64 12 BAYES_50 53230 48.57 35.23 53.00 13 TR_DCC_Bayes_99 51516 12.06 34.09 4.74 14 LOC_TINY_FONT_1 50603 23.69 33.49 20.43 15 MIME_HTML_ONLY 46026 22.11 30.46 19.34 16 FVGT_m_MULTI_ODD 41336 22.07 27.36 20.32 17 XMSubLong 35743 21.44 23.66 20.70 18 XM_Body_Dirty_Words 32587 15.51 21.57 13.50 19 DKIM_VALID_EF 32367 25.43 21.42 26.76 20 DCC_CHECK_NEGATIVE 31358 50.87 20.75 60.87 21 T_KAM_HTML_FONT_INVALID 30832 17.18 20.41 16.11 22 T_TM2_M_HEADER_IN_MSG 30241 28.87 20.01 31.81 23 MultiRelay 28618 20.53 18.94 21.05 24 RELAYCOUNTRY_META 26350 8.38 17.44 5.38 25 XM_Multi_Part_URI 23767 12.65 15.73 11.62 26 BOTNET 23638 5.25 15.64 1.80 27 HTML_IMAGE_RATIO_02 22253 9.00 14.73 7.10 28 BOTNET_IPINHOSTNAME 20192 6.48 13.36 4.20 29 FSL_BULK_SIG 18875 8.70 12.49 7.45 30 XM_Evil_Numbers_Gen 18254 9.54 12.08 8.70 31 XMSexyCombo_05 18106 5.78 11.98 3.72 32 LOTS_OF_MONEY 17965 8.78 11.89 7.75 33 XM_UncommonTLD01 17688 7.43 11.71 6.01 34 UNTRUSTED_Relay 17253 3.94 11.42 1.46 35 XMSubMetaSx_00 15063 5.28 9.97 3.73 36 LotsOfNums_01 13368 7.86 8.85 7.54 37 T_XMDrugObfuBody_14 12649 8.46 8.37 8.49 38 TooManyTo_001 12313 8.74 8.15 8.94 39 DKIM_INVALID 11617 5.69 7.69 5.03 40 MPART_ALT_DIFF 11300 4.31 7.48 3.26 41 XM_UB50 10632 2.43 7.04 0.90 42 XM_H_Long_From01 10469 6.18 6.93 5.93 43 BAYES_80 10403 4.90 6.88 4.24 44 XM_B_Phish_Phrases 10226 6.42 6.77 6.30 45 XM_SPF_SoftFail 10224 3.56 6.77 2.49 46 HTML_IMAGE_RATIO_04 10131 5.27 6.70 4.79 47 FROM_EXCESS_BASE64 9042 5.14 5.98 4.86 48 XM_DIRTYINTL 8814 3.58 5.83 2.83 49 TR_XM_PHPDW 8362 3.95 5.53 3.43 50 BAYES_60 8329 6.51 5.51 6.84 51 TR_XM_PHPForged 8307 3.84 5.50 3.29 52 TR_XM_FormFill2 8263 3.35 5.47 2.64 53 XM_H_PHPOS 8247 3.34 5.46 2.64 54 MIME_QP_LONG_LINE 7574 5.18 5.01 5.23 55 SpammyFromTLD_01 7463 3.22 4.94 2.65 56 T_REMOTE_IMAGE 7295 5.38 4.83 5.56 57 RCVD_IN_MSPIKE_BL 7274 2.64 4.81 1.92 58 HTML_IMAGE_RATIO_08 6634 2.70 4.39 2.14 59 RCVD_IN_MSPIKE_H2 6556 7.10 4.34 8.01 60 HTML_IMAGE_RATIO_06 6374 3.48 4.22 3.24 61 XM_B_SpammyTLD 5970 3.31 3.95 3.09 62 RELAYCOUNTRY_CA 5955 2.14 3.94 1.54 63 XM_URI_RBL 5853 1.24 3.87 0.36 64 MIME_HTML_MOSTLY 5838 2.74 3.86 2.37 65 TM2_M_URI_OPT_OUT 5817 2.10 3.85 1.52 66 MIME_HTML_ONLY_MULTI 5761 2.09 3.81 1.51 67 XMStrtUSub 5632 4.18 3.73 4.33 68 BAYES_95 5618 2.84 3.72 2.55 69 XM_SendGrid 5429 5.55 3.59 6.20 70 URI_HEX 5199 2.02 3.44 1.55 71 SpammyFromTLD_02 5186 1.03 3.43 0.23 72 XM_CamelCaseFrm001 5158 2.29 3.41 1.92 73 XMNumbers 5031 3.10 3.33 3.02 74 XMDiploma_00 5007 2.39 3.31 2.08 75 RCVD_IN_MSPIKE_L5 4956 1.41 3.28 0.79 76 RCVD_IN_RP_SAFE 4950 7.87 3.28 9.40 77 XMSexyCombo_01 4813 1.32 3.19 0.70 78 XM_ProductURIs 4781 1.37 3.16 0.78 79 T_TooManySym_01 4774 4.91 3.16 5.50 80 MISSING_HEADERS 4705 1.23 3.11 0.60 81 HELO_NODOT 4336 2.25 2.87 2.04 82 HELO_NO_DOMAIN 4332 2.24 2.87 2.04 83 RCVD_IN_IADB_LISTED 4212 4.46 2.79 5.01 84 REPLYTO_WITHOUT_TO_CC 4180 0.80 2.77 0.14 85 XM_ShortIntro_01 4139 1.24 2.74 0.74 86 ALL_TRUSTED 4122 14.33 2.73 18.18 87 BAYES_20 4095 3.42 2.71 3.65 88 RCVD_IN_PSBL 4000 0.71 2.65 0.06 89 FROM_SUSPICIOUS_NTLD 3975 0.68 2.63 0.04 90 XM_OfRef6 3973 1.81 2.63 1.54 91 T_XMDrugObfuBody_08 3954 1.74 2.62 1.45 92 RCVD_IN_RP_CERTIFIED 3949 6.93 2.61 8.37 93 FROM_SUSPICIOUS_NTLD_FP 3916 0.66 2.59 0.02 94 RCVD_IN_MSPIKE_WL 3824 5.36 2.53 6.29 95 RCVD_IN_IADB_SPF 3731 3.87 2.47 4.34 96 RELAYCOUNTRY_HK 3725 0.66 2.47 0.07 97 BOTNET_NORDNS 3631 0.63 2.40 0.04 98 RCVD_IN_IADB_DK 3577 3.37 2.37 3.70 99 RCVD_IN_IADB_SENDERID 3573 3.39 2.36 3.74 100 BAYES_40 3525 3.90 2.33 4.42 101 RCVD_IN_MSPIKE_H3 3514 4.95 2.33 5.82 102 XMBody_17 3403 1.01 2.25 0.59 103 US_DOLLARS_3 3399 1.25 2.25 0.92 104 KHOP_HELO_FCRDNS 3371 2.25 2.23 2.26 105 XMBdyGiftCard01 3303 1.27 2.19 0.97 106 MultiRelay_Combo 3253 0.72 2.15 0.25 107 MultiRelay_CC 3253 0.72 2.15 0.25 108 HTML_MIME_NO_HTML_TAG 3052 2.08 2.02 2.11 109 RCVD_IN_BL_SPAMCOP_NET 2973 1.43 1.97 1.25 110 XMGenDplmaNmb 2868 1.52 1.90 1.39 111 DKIM_ADSP_NXDOMAIN 2827 0.87 1.87 0.54 112 XMSubMetaI_00 2821 0.90 1.87 0.58 113 NO_DNS_FOR_FROM 2743 1.31 1.82 1.14 114 TM2_M_VERY_LONG_WORD 2645 1.35 1.75 1.21 115 RELAYCOUNTRY_DE 2532 0.69 1.68 0.37 116 TR_XM_DK_SendGrid 2526 2.92 1.67 3.33 117 XM_UB99 2514 0.42 1.66 0.01 118 XM_H_Long_From02 2501 1.05 1.66 0.86 119 T_HTML_TAG_BALANCE_CENTER 2489 0.50 1.65 0.12 120 MAILING_LIST_MULTI 2465 2.00 1.63 2.12 121 RELAYCOUNTRY_FR 2352 0.55 1.56 0.22 122 SUBJ_ALL_CAPS 2321 1.44 1.54 1.41 123 T_Symld_Words_02 2275 0.93 1.51 0.74 124 RCVD_IN_RP_RNBL 2267 0.40 1.50 0.04 125 DIET_1 2265 0.66 1.50 0.38 126 TR_LOTS_OF_MONEY2 2174 0.64 1.44 0.37 127 T_MONEY_PERCENT 2174 0.64 1.44 0.37 128 XM_HighProb1 2158 0.37 1.43 0.01 129 HTML_IMAGE_ONLY_24 2127 0.63 1.41 0.37 130 XMStockSpam_06 2121 1.60 1.40 1.67 131 T_XMHurry_00 2111 0.86 1.40 0.68 132 MIME_HEADER_CTYPE_ONLY 2107 0.49 1.39 0.18 133 BODY_ENHANCEMENT 2092 0.38 1.38 0.04 134 XM_B_REG_HTML 2090 0.66 1.38 0.42 135 XMHTML_After_End 2078 0.72 1.38 0.50 136 XM_H_PHPMailer 2064 1.37 1.37 1.37 137 TR_XM_RelayPhish 2059 1.02 1.36 0.90 138 HTML_FONT_SIZE_LARGE 2042 0.47 1.35 0.18 139 XMBody_78 2042 0.65 1.35 0.42 140 XM_UB999 2020 0.34 1.34 0.01 141 XM_H_TOP 1964 0.33 1.30 0.00 142 RCVD_IN_IADB_VOUCHED 1945 2.93 1.29 3.47 143 XMSubNoVowel 1914 1.54 1.27 1.64 144 XMSexyCombo_04 1892 0.51 1.25 0.26 145 RCVD_IN_MSPIKE_L3 1880 0.77 1.24 0.61 146 XMPhish11 1857 1.29 1.23 1.31 147 XMBrknScrpt_02 1815 0.68 1.20 0.50 148 DKIM_ADSP_CUSTOM_MED 1802 1.49 1.19 1.59 149 T_XMDrugObfuBody_00 1793 0.75 1.19 0.61 150 TR_M_TOP_BAYES 1767 0.29 1.17 0.00 151 XM_DK_Undo_01 1752 1.65 1.16 1.81 152 XMPhish30 1734 0.57 1.15 0.37 153 URI_TRY_3LD 1719 1.18 1.14 1.19 154 TR_Symld_Words 1697 1.42 1.12 1.52 155 DATE_IN_PAST_96_XX 1691 0.28 1.12 0.00 156 XM_H_PHPOS_M 1666 0.44 1.10 0.22 157 XMMoneyMeta_00 1655 0.68 1.10 0.54 158 HTML_FONT_FACE_BAD 1612 0.72 1.07 0.61 159 ALIBABA_IMG_NOT_RCVD_ALI 1550 0.26 1.03 0.00 160 XM_DrugUnitList 1544 0.26 1.02 0.01 161 LOW_PRICE 1537 0.35 1.02 0.13 162 XMSubMetaSxObfu_03 1535 0.53 1.02 0.37 163 URIBL_BLACK 1490 0.28 0.99 0.05 164 XMSubMetaSSx_00 1454 0.36 0.96 0.16 165 NML_ADSP_CUSTOM_MED 1434 1.17 0.95 1.25 166 HTML_IMAGE_ONLY_12 1433 0.41 0.95 0.22 167 HOSTED_IMG_DIRECT_MX 1430 0.24 0.95 0.00 168 DATE_IN_PAST_03_06 1410 0.28 0.93 0.07 169 UNPARSEABLE_RELAY 1392 2.17 0.92 2.59 170 RELAYCOUNTRY_GB 1390 1.15 0.92 1.23 171 XMSlimDrugH 1389 0.56 0.92 0.44 172 XMGppyBdWords 1347 0.37 0.89 0.19 173 XM_OfRef7 1347 0.41 0.89 0.25 174 RELAYCOUNTRY_AT 1336 0.39 0.88 0.22 175 XM_UB60 1320 0.29 0.87 0.09 176 FORGED_GMAIL_RCVD 1315 0.93 0.87 0.95 177 HTTPS_HTTP_MISMATCH 1312 0.66 0.87 0.60 178 DATE_IN_PAST_06_12 1292 0.24 0.86 0.03 179 XMHTMLBadTable_001 1292 0.57 0.86 0.48 180 T_FILL_THIS_FORM_SHORT 1272 1.12 0.84 1.22 181 HTML_SHORT_LINK_IMG_1 1234 0.23 0.82 0.03 182 XMLngstWrd_00 1232 0.73 0.82 0.70 183 FILL_THIS_FORM 1221 0.60 0.81 0.53 184 TR_Mismatch_TLD_02 1217 0.26 0.81 0.07 185 XM_RXBody 1209 0.35 0.80 0.20 186 HDRS_LCASE_IMGONLY 1201 0.24 0.79 0.05 187 MPART_ALT_DIFF_COUNT 1193 0.39 0.79 0.26 188 T_TooManySym_02 1182 1.43 0.78 1.64 189 RDNS_DYNAMIC 1156 0.52 0.77 0.43 190 HTML_IMAGE_ONLY_32 1155 0.50 0.76 0.42 191 XM_PDF 1151 4.09 0.76 5.19 192 RCVD_IN_IADB_OPTIN 1123 1.81 0.74 2.16 193 XMPhish14 1120 0.43 0.74 0.33 194 NUMERIC_HTTP_ADDR 1104 0.42 0.73 0.31 195 XM_UB80 1085 0.20 0.72 0.02 196 HK_RANDOM_REPLYTO 1083 0.37 0.72 0.26 197 URIBL_DBL_SPAM 1053 0.18 0.70 0.01 198 URIBL_ABUSE_SURBL 1027 0.24 0.68 0.09 199 TooManyTo_002 1000 2.05 0.66 2.51 200 SHORT_URI_3 985 0.27 0.65 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 385844 86.58 92.11 84.75 2 DKIM_SIGNED 332077 75.29 82.36 72.94 3 XM_DK_Pass 326420 73.59 79.29 71.70 4 DKIM_VALID 309198 69.60 74.67 67.91 5 DCC_CHECK_NEGATIVE 277115 50.87 20.75 60.87 6 BAYES_50 241314 48.57 35.23 53.00 7 DKIM_VALID_AU 229289 52.40 58.52 50.36 8 XMListUnsubscribeExists 215967 54.28 74.91 47.44 9 DCC_CHECK 168772 47.16 77.56 37.07 10 T_TM2_M_HEADER_IN_MSG 144844 28.87 20.01 31.81 11 DKIM_VALID_EF 121824 25.43 21.42 26.76 12 HTML_FONT_LOW_CONTRAST 116755 28.06 35.34 25.64 13 MultiRelay 95858 20.53 18.94 21.05 14 XMSubLong 94240 21.44 23.66 20.70 15 LOC_TINY_FONT_1 93030 23.69 33.49 20.43 16 FVGT_m_MULTI_ODD 92491 22.07 27.36 20.32 17 MIME_HTML_ONLY 88049 22.11 30.46 19.34 18 ALL_TRUSTED 82750 14.33 2.73 18.18 19 T_KAM_HTML_FONT_INVALID 73354 17.18 20.41 16.11 20 XM_Body_Dirty_Words 61482 15.51 21.57 13.50 21 XM_DK_Undo_02 59111 21.43 46.87 12.98 22 XM_Multi_Part_URI 52910 12.65 15.73 11.62 23 BAYES_00 52533 8.82 0.62 11.54 24 BAYES_99 49782 18.72 42.19 10.93 25 BAYES_999 43887 16.08 35.47 9.64 26 RCVD_IN_RP_SAFE 42801 7.87 3.28 9.40 27 TR_XM_DK_Bayes 40942 6.83 0.33 8.99 28 TooManyTo_001 40683 8.74 8.15 8.94 29 XM_Evil_Numbers_Gen 39616 9.54 12.08 8.70 30 TR_XM_DK_Bayes1 39089 6.51 0.25 8.59 31 T_XMDrugObfuBody_14 38654 8.46 8.37 8.49 32 RCVD_IN_RP_CERTIFIED 38092 6.93 2.61 8.37 33 RCVD_IN_MSPIKE_H2 36476 7.10 4.34 8.01 34 XM_DKIMWhitelistDomains 35982 5.98 0.17 7.90 35 LOTS_OF_MONEY 35299 8.78 11.89 7.75 36 TR_XM_DK_Bayes2 34350 5.72 0.21 7.54 37 LotsOfNums_01 34315 7.86 8.85 7.54 38 FSL_BULK_SIG 33897 8.70 12.49 7.45 39 HTML_IMAGE_RATIO_02 32315 9.00 14.73 7.10 40 BAYES_60 31155 6.51 5.51 6.84 41 XM_B_Phish_Phrases 28675 6.42 6.77 6.30 42 RCVD_IN_MSPIKE_WL 28651 5.36 2.53 6.29 43 XM_SendGrid 28235 5.55 3.59 6.20 44 XM_UncommonTLD01 27380 7.43 11.71 6.01 45 XM_H_Long_From01 26987 6.18 6.93 5.93 46 RCVD_IN_MSPIKE_H3 26478 4.95 2.33 5.82 47 T_REMOTE_IMAGE 25334 5.38 4.83 5.56 48 T_TooManySym_01 25019 4.91 3.16 5.50 49 RELAYCOUNTRY_META 24484 8.38 17.44 5.38 50 TO_MALFORMED 24232 4.01 0.07 5.32 51 MIME_QP_LONG_LINE 23817 5.18 5.01 5.23 52 XM_PDF 23631 4.09 0.76 5.19 53 DKIM_INVALID 22879 5.69 7.69 5.03 54 RCVD_IN_IADB_LISTED 22826 4.46 2.79 5.01 55 FROM_EXCESS_BASE64 22142 5.14 5.98 4.86 56 HTML_IMAGE_RATIO_04 21820 5.27 6.70 4.79 57 TR_DCC_Bayes_99 21595 12.06 34.09 4.74 58 BAYES_40 20132 3.90 2.33 4.42 59 RCVD_IN_IADB_SPF 19760 3.87 2.47 4.34 60 XMStrtUSub 19713 4.18 3.73 4.33 61 BAYES_80 19316 4.90 6.88 4.24 62 BOTNET_IPINHOSTNAME 19124 6.48 13.36 4.20 63 IN_ZIMBRA_NJ_WHITELIST 18227 3.01 0.02 4.00 64 RCVD_IN_IADB_SENDERID 17006 3.39 2.36 3.74 65 XMSubMetaSx_00 16976 5.28 9.97 3.73 66 XMSexyCombo_05 16942 5.78 11.98 3.72 67 RCVD_IN_IADB_DK 16859 3.37 2.37 3.70 68 BAYES_20 16631 3.42 2.71 3.65 69 RCVD_IN_IADB_VOUCHED 15808 2.93 1.29 3.47 70 TR_XM_PHPDW 15611 3.95 5.53 3.43 71 TR_XM_DK_SendGrid 15178 2.92 1.67 3.33 72 TR_XM_PHPForged 14992 3.84 5.50 3.29 73 MPART_ALT_DIFF 14828 4.31 7.48 3.26 74 HTML_IMAGE_RATIO_06 14731 3.48 4.22 3.24 75 XM_B_SpammyTLD 14075 3.31 3.95 3.09 76 XMNumbers 13760 3.10 3.33 3.02 77 XM_DIRTYINTL 12899 3.58 5.83 2.83 78 SpammyFromTLD_01 12050 3.22 4.94 2.65 79 TR_XM_FormFill2 12028 3.35 5.47 2.64 80 XM_H_PHPOS 12018 3.34 5.46 2.64 81 UNPARSEABLE_RELAY 11796 2.17 0.92 2.59 82 BAYES_95 11592 2.84 3.72 2.55 83 TooManyTo_002 11438 2.05 0.66 2.51 84 BAYES_05 11373 2.02 0.60 2.50 85 XM_SPF_SoftFail 11357 3.56 6.77 2.49 86 MIME_HTML_MOSTLY 10786 2.74 3.86 2.37 87 INVALID_MSGID 10749 1.81 0.14 2.36 88 TVD_RCVD_IP 10356 1.80 0.39 2.27 89 KHOP_HELO_FCRDNS 10287 2.25 2.23 2.26 90 RCVD_IN_IADB_OPTIN 9852 1.81 0.74 2.16 91 HTML_IMAGE_RATIO_08 9741 2.70 4.39 2.14 92 MAILING_LIST_MULTI 9665 2.00 1.63 2.12 93 HTML_MIME_NO_HTML_TAG 9585 2.08 2.02 2.11 94 XMDiploma_00 9481 2.39 3.31 2.08 95 HELO_NODOT 9281 2.25 2.87 2.04 96 HELO_NO_DOMAIN 9279 2.24 2.87 2.04 97 RCVD_IN_MSPIKE_BL 8760 2.64 4.81 1.92 98 XM_CamelCaseFrm001 8746 2.29 3.41 1.92 99 ANY_BOUNCE_MESSAGE 8460 1.56 0.64 1.86 100 BOUNCE_MESSAGE 8455 1.55 0.64 1.86 101 XM_DK_Undo_01 8229 1.65 1.16 1.81 102 BOTNET 8192 5.25 15.64 1.80 103 IN_HORDE_ADDRESS_BOOK 8127 1.35 0.04 1.79 104 TooManyTo_003 7960 1.44 0.53 1.75 105 XMStockSpam_06 7586 1.60 1.40 1.67 106 T_TooManySym_02 7461 1.43 0.78 1.64 107 XMSubNoVowel 7453 1.54 1.27 1.64 108 XMCapTrack 7341 1.30 0.37 1.61 109 DKIM_ADSP_CUSTOM_MED 7233 1.49 1.19 1.59 110 TR_MetaPhish_Combo_01 7075 1.30 0.54 1.55 111 URI_HEX 7039 2.02 3.44 1.55 112 XM_OfRef6 7021 1.81 2.63 1.54 113 RELAYCOUNTRY_CA 7018 2.14 3.94 1.54 114 TM2_M_URI_OPT_OUT 6939 2.10 3.85 1.52 115 TR_Symld_Words 6931 1.42 1.12 1.52 116 MIME_HTML_ONLY_MULTI 6883 2.09 3.81 1.51 117 UNTRUSTED_Relay 6652 3.94 11.42 1.46 118 T_XMDrugObfuBody_08 6579 1.74 2.62 1.45 119 SUBJ_ALL_CAPS 6425 1.44 1.54 1.41 120 XMGenDplmaNmb 6325 1.52 1.90 1.39 121 XM_H_PHPMailer 6225 1.37 1.37 1.37 122 TooManyTo_004 6025 1.10 0.41 1.32 123 USER_IN_DEF_DKIM_WL 6010 1.00 0.02 1.32 124 XMPhish11 5956 1.29 1.23 1.31 125 NML_ADSP_CUSTOM_MED 5688 1.17 0.95 1.25 126 RCVD_IN_BL_SPAMCOP_NET 5687 1.43 1.97 1.25 127 RELAYCOUNTRY_GB 5589 1.15 0.92 1.23 128 T_FILL_THIS_FORM_SHORT 5539 1.12 0.84 1.22 129 XM_GoogleGroups 5534 1.04 0.50 1.22 130 TM2_M_VERY_LONG_WORD 5529 1.35 1.75 1.21 131 URI_TRY_3LD 5419 1.18 1.14 1.19 132 NO_DNS_FOR_FROM 5186 1.31 1.82 1.14 133 TooManyTo_005 5103 0.93 0.35 1.12 134 XMBdyGiftCard01 4423 1.27 2.19 0.97 135 FORGED_GMAIL_RCVD 4337 0.93 0.87 0.95 136 US_DOLLARS_3 4184 1.25 2.25 0.92 137 XM_UB50 4113 2.43 7.04 0.90 138 TR_XM_RelayPhish 4097 1.02 1.36 0.90 139 XMSolicitRefs_0 3903 0.74 0.40 0.86 140 XM_H_Long_From02 3895 1.05 1.66 0.86 141 RCVD_IN_MSPIKE_L5 3594 1.41 3.28 0.79 142 XM_ProductURIs 3536 1.37 3.16 0.78 143 XM_ShortIntro_01 3373 1.24 2.74 0.74 144 T_Symld_Words_02 3369 0.93 1.51 0.74 145 PLING_QUERY 3305 0.69 0.57 0.73 146 T_OBFU_PDF_ATTACH 3273 0.59 0.19 0.72 147 XMLngstWrd_00 3205 0.73 0.82 0.70 148 XMSexyCombo_01 3182 1.32 3.19 0.70 149 T_XMHurry_00 3083 0.86 1.40 0.68 150 AC_DIV_BONANZA 2806 0.49 0.09 0.62 151 T_XMDrugObfuBody_00 2785 0.75 1.19 0.61 152 RCVD_IN_MSPIKE_L3 2773 0.77 1.24 0.61 153 HTML_FONT_FACE_BAD 2760 0.72 1.07 0.61 154 MISSING_HEADERS 2749 1.23 3.11 0.60 155 HTTPS_HTTP_MISMATCH 2718 0.66 0.87 0.60 156 XMBody_17 2708 1.01 2.25 0.59 157 XMSubMetaI_00 2637 0.90 1.87 0.58 158 XM_B_COPY_HTML 2575 0.57 0.59 0.57 159 XMBody_95 2534 0.45 0.14 0.56 160 XMMoneyMeta_00 2481 0.68 1.10 0.54 161 DKIM_ADSP_NXDOMAIN 2473 0.87 1.87 0.54 162 SHORT_HELO_AND_INLINE_IMAGE 2437 0.41 0.05 0.54 163 XMLngstWrd_01 2436 0.52 0.48 0.54 164 USER_IN_WHITELIST 2423 0.40 0.00 0.53 165 FILL_THIS_FORM 2418 0.60 0.81 0.53 166 RCVD_IN_MSPIKE_L4 2393 0.47 0.29 0.53 167 HTML_TAG_BALANCE_BODY 2373 0.52 0.53 0.52 168 RELAYCOUNTRY_AU 2327 0.51 0.51 0.51 169 T_TooManySym_03 2322 0.44 0.22 0.51 170 XMBrknScrpt_02 2284 0.68 1.20 0.50 171 XMHTML_After_End 2279 0.72 1.38 0.50 172 T_MANY_PILL_PRICE 2266 0.37 0.00 0.50 173 TM2_M_BODY_EMPTY 2253 0.42 0.18 0.49 174 URI_NOVOWEL 2251 0.52 0.60 0.49 175 XMHTMLBadTable_001 2183 0.57 0.86 0.48 176 XMNoVowels 2143 0.45 0.38 0.47 177 XMSubMetaSxObfu_02 2096 0.43 0.32 0.46 178 RCVD_IN_SORBS_DUL 2092 0.40 0.23 0.46 179 HTML_IMAGE_ONLY_28 2027 0.44 0.41 0.45 180 XMSlimDrugH 2021 0.56 0.92 0.44 181 FILL_THIS_FORM_LOAN 1994 0.44 0.43 0.44 182 RDNS_DYNAMIC 1970 0.52 0.77 0.43 183 XMDateMe_00 1956 0.41 0.33 0.43 184 HTML_IMAGE_ONLY_32 1906 0.50 0.76 0.42 185 XM_B_REG_HTML 1900 0.66 1.38 0.42 186 XMBody_78 1894 0.65 1.35 0.42 187 XMGappySubj_01 1836 0.39 0.35 0.40 188 FROM_GOV_DKIM_AU 1726 0.30 0.07 0.38 189 DIET_1 1722 0.66 1.50 0.38 190 T_MONEY_PERCENT 1701 0.64 1.44 0.37 191 TR_LOTS_OF_MONEY2 1701 0.64 1.44 0.37 192 XMPhish30 1697 0.57 1.15 0.37 193 XMSubMetaSxObfu_03 1694 0.53 1.02 0.37 194 HTML_IMAGE_ONLY_24 1691 0.63 1.41 0.37 195 RELAYCOUNTRY_DE 1676 0.69 1.68 0.37 196 TM2_M_A_HREF_HREF 1672 0.44 0.65 0.37 197 XM_URI_RBL 1658 1.24 3.87 0.36 198 FROM_GOV_SPOOF 1637 0.34 0.26 0.36 199 BASE64_LENGTH_79_INF 1542 0.37 0.46 0.34 200 XMBSHREFv2 1485 0.33 0.35 0.33 ----------------------------------------------------------------------