Email: 643107 Autolearn: 0 AvgScore: 2.99 AvgScanTime: 2.09 sec Spam: 158853 Autolearn: 0 AvgScore: 12.11 AvgScanTime: 2.53 sec Ham: 484254 Autolearn: 0 AvgScore: -0.00 AvgScanTime: 1.94 sec Time Spent Running SA: 373.06 hours Time Spent Processing Spam: 111.81 hours Time Spent Processing Ham: 261.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151212 89.26 95.19 87.32 2 DKIM_SIGNED 128455 74.51 80.86 72.43 3 DCC_CHECK 124494 48.27 78.37 38.39 4 XM_DK_Pass 122892 72.59 77.36 71.03 5 DKIM_VALID 116606 69.02 73.40 67.59 6 XMListUnsubscribeExists 116242 54.78 73.18 48.75 7 DKIM_VALID_AU 88275 50.48 55.57 48.80 8 XM_DK_Undo_02 75174 21.70 47.32 13.29 9 BAYES_99 67883 19.25 42.73 11.54 10 BAYES_50 57358 49.27 36.11 53.59 11 HTML_FONT_LOW_CONTRAST 56157 29.45 35.35 27.52 12 BAYES_999 56019 16.37 35.26 10.18 13 TR_DCC_Bayes_99 54963 12.63 34.60 5.43 14 LOC_TINY_FONT_1 52311 23.82 32.93 20.83 15 MIME_HTML_ONLY 50129 23.18 31.56 20.43 16 FVGT_m_MULTI_ODD 43251 22.64 27.23 21.13 17 XMSubLong 41832 22.32 26.33 21.00 18 DKIM_VALID_EF 35693 25.11 22.47 25.98 19 T_TM2_M_HEADER_IN_MSG 35314 28.98 22.23 31.19 20 T_KAM_HTML_FONT_INVALID 32666 17.66 20.56 16.71 21 XM_Body_Dirty_Words 32516 14.73 20.47 12.85 22 DCC_CHECK_NEGATIVE 31939 49.71 20.11 59.42 23 RELAYCOUNTRY_META 27473 8.08 17.29 5.06 24 MultiRelay 25878 18.10 16.29 18.70 25 XM_Multi_Part_URI 25297 12.70 15.92 11.64 26 BOTNET 24979 5.14 15.72 1.66 27 BOTNET_IPINHOSTNAME 20827 6.36 13.11 4.14 28 XM_Evil_Numbers_Gen 20361 9.81 12.82 8.82 29 HTML_IMAGE_RATIO_02 20346 8.89 12.81 7.61 30 LOTS_OF_MONEY 18690 9.46 11.77 8.71 31 FSL_BULK_SIG 18117 8.18 11.40 7.12 32 XMSexyCombo_05 16948 5.11 10.67 3.29 33 UNTRUSTED_Relay 16724 3.59 10.53 1.32 34 XM_UncommonTLD01 15825 5.48 9.96 4.02 35 LotsOfNums_01 15437 8.42 9.72 8.00 36 T_XMDrugObfuBody_14 13695 7.65 8.62 7.33 37 XM_H_Long_From01 12956 6.76 8.16 6.30 38 XM_B_SpammyTLD 12320 4.37 7.76 3.26 39 DKIM_INVALID 11849 5.49 7.46 4.84 40 MPART_ALT_DIFF 11741 4.42 7.39 3.44 41 XMSubMetaSx_00 11726 4.45 7.38 3.49 42 TooManyTo_001 11621 7.82 7.32 7.99 43 BAYES_80 11510 5.22 7.25 4.55 44 HTML_IMAGE_RATIO_04 11468 5.69 7.22 5.19 45 XM_B_Phish_Phrases 11077 5.86 6.97 5.50 46 MIME_QP_LONG_LINE 9075 5.78 5.71 5.80 47 BAYES_60 8686 6.42 5.47 6.73 48 XM_DIRTYINTL 8614 3.19 5.42 2.46 49 XM_UB50 8115 1.89 5.11 0.83 50 SpammyFromTLD_02 7953 1.48 5.01 0.33 51 HTML_IMAGE_RATIO_06 7922 3.64 4.99 3.20 52 ALL_TRUSTED 7697 15.32 4.85 18.75 53 RCVD_IN_MSPIKE_H2 7568 7.15 4.76 7.93 54 FROM_EXCESS_BASE64 7394 5.17 4.65 5.34 55 MIME_HTML_MOSTLY 7143 2.77 4.50 2.21 56 RCVD_IN_MSPIKE_BL 7069 2.82 4.45 2.28 57 XM_CamelCaseFrm001 7022 2.40 4.42 1.74 58 XM_SPF_SoftFail 7011 2.61 4.41 2.02 59 XMPhish11 6718 1.96 4.23 1.21 60 BAYES_95 6664 2.99 4.20 2.59 61 MIME_HTML_ONLY_MULTI 6527 2.36 4.11 1.79 62 TM2_M_URI_OPT_OUT 6331 2.49 3.99 1.99 63 RELAYCOUNTRY_CA 6119 2.08 3.85 1.49 64 XMNumbers 6109 4.07 3.85 4.15 65 XMStrtUSub 5843 4.52 3.68 4.80 66 XM_SendGrid 5842 5.49 3.68 6.08 67 HTTPS_HTTP_MISMATCH 5786 1.42 3.64 0.69 68 TVD_RCVD_IP 5476 2.41 3.45 2.07 69 XM_URI_RBL 5201 1.10 3.27 0.38 70 URI_HEX 5169 2.13 3.25 1.76 71 RCVD_IN_RP_SAFE 4997 7.88 3.15 9.44 72 RCVD_IN_IADB_LISTED 4825 4.94 3.04 5.57 73 XMPhish19 4818 0.77 3.03 0.02 74 HTML_IMAGE_RATIO_08 4784 2.12 3.01 1.83 75 XMDiploma_00 4752 2.48 2.99 2.31 76 XMSubPhish3 4689 0.73 2.95 0.00 77 T_XMDrugObfuBody_08 4565 1.86 2.87 1.53 78 T_REMOTE_IMAGE 4471 5.01 2.81 5.73 79 T_TooManySym_01 4392 4.36 2.76 4.88 80 BOTNET_NORDNS 4353 0.70 2.74 0.03 81 RCVD_IN_MSPIKE_L5 4346 1.44 2.74 1.01 82 RELAYCOUNTRY_FR 4327 0.85 2.72 0.24 83 RCVD_IN_IADB_SPF 4316 4.30 2.72 4.82 84 RCVD_IN_PSBL 4250 0.72 2.68 0.08 85 MultiRelay_CC 4173 0.82 2.63 0.22 86 MultiRelay_Combo 4173 0.82 2.63 0.22 87 RCVD_IN_BL_SPAMCOP_NET 4166 1.46 2.62 1.07 88 KHOP_HELO_FCRDNS 4148 2.31 2.61 2.21 89 TR_XM_PHPDW 4135 2.21 2.60 2.08 90 TR_XM_PHPForged 4117 2.10 2.59 1.94 91 RCVD_IN_IADB_DK 4116 3.70 2.59 4.07 92 RCVD_IN_IADB_SENDERID 4113 3.76 2.59 4.14 93 TR_XM_FormFill2 4057 1.63 2.55 1.33 94 XM_H_PHPOS 4037 1.62 2.54 1.32 95 XMSexyCombo_01 3887 1.05 2.45 0.59 96 XMBdyGiftCard01 3754 1.22 2.36 0.85 97 XM_UB99 3720 0.60 2.34 0.03 98 HTML_MIME_NO_HTML_TAG 3571 1.97 2.25 1.88 99 RCVD_IN_RP_CERTIFIED 3548 6.95 2.23 8.50 100 XM_OfRef6 3474 1.70 2.19 1.54 101 XM_H_Long_From02 3375 1.29 2.12 1.01 102 FROM_SUSPICIOUS_NTLD 3311 0.54 2.08 0.04 103 XMSubMetaI_00 3297 0.87 2.08 0.48 104 RCVD_IN_MSPIKE_WL 3287 5.36 2.07 6.44 105 DKIM_ADSP_NXDOMAIN 3284 0.93 2.07 0.55 106 SpammyFromTLD_01 3260 1.16 2.05 0.86 107 RELAYCOUNTRY_DE 3135 0.72 1.97 0.31 108 US_DOLLARS_3 3124 1.28 1.97 1.06 109 RCVD_IN_MSPIKE_H3 3036 4.93 1.91 5.92 110 FROM_SUSPICIOUS_NTLD_FP 3016 0.49 1.90 0.03 111 LOW_PRICE 2990 0.67 1.88 0.28 112 XM_UB999 2934 0.47 1.85 0.02 113 NO_DNS_FOR_FROM 2918 1.24 1.84 1.05 114 XM_ProductURIs 2911 0.96 1.83 0.68 115 TM2_M_VERY_LONG_WORD 2839 1.20 1.79 1.00 116 TR_XM_DK_SendGrid 2799 2.91 1.76 3.28 117 URI_TRY_3LD 2729 1.68 1.72 1.66 118 MAILING_LIST_MULTI 2672 1.96 1.68 2.06 119 XMGenDplmaNmb 2607 1.64 1.64 1.64 120 BAYES_40 2599 3.69 1.64 4.37 121 SUBJ_ALL_CAPS 2583 2.27 1.63 2.48 122 TR_XM_RelayPhish 2548 1.06 1.60 0.88 123 HTML_OFF_PAGE 2480 0.39 1.56 0.00 124 RCVD_IN_RP_RNBL 2467 0.41 1.55 0.03 125 T_HTML_TAG_BALANCE_CENTER 2417 0.46 1.52 0.12 126 XMStockSpam_06 2401 1.03 1.51 0.87 127 DATE_IN_PAST_03_06 2321 0.43 1.46 0.09 128 HTML_FONT_SIZE_LARGE 2284 0.51 1.44 0.20 129 XMSexyCombo_04 2275 0.46 1.43 0.15 130 XM_H_PHPMailer 2241 1.31 1.41 1.27 131 XMBody_17 2223 0.73 1.40 0.51 132 MIME_HEADER_CTYPE_ONLY 2205 0.44 1.39 0.13 133 T_XMDrugObfuBody_00 2150 0.85 1.35 0.69 134 XM_DK_Undo_01 2135 1.66 1.34 1.76 135 RELAYCOUNTRY_GB 2109 1.15 1.33 1.09 136 XMMoneyMeta_00 2098 0.73 1.32 0.54 137 RCVD_IN_MSPIKE_L3 2086 0.80 1.31 0.63 138 RCVD_IN_IADB_VOUCHED 2067 3.23 1.30 3.86 139 T_XMHurry_00 2061 0.82 1.30 0.66 140 DKIM_ADSP_CUSTOM_MED 2047 1.48 1.29 1.55 141 HTML_IMAGE_ONLY_12 2034 0.47 1.28 0.20 142 XMSubMetaSxObfu_03 2034 0.66 1.28 0.45 143 XMHTML_After_End 1969 0.60 1.24 0.39 144 XM_HighProb1 1932 0.31 1.22 0.01 145 XMBrknScrpt_02 1925 0.71 1.21 0.54 146 T_Symld_Words_02 1897 0.77 1.19 0.63 147 XMPhish30 1875 0.59 1.18 0.40 148 XM_H_PHPOS_M 1849 0.42 1.16 0.18 149 LongTLD 1831 0.39 1.15 0.14 150 BAYES_20 1773 2.67 1.12 3.18 151 DIET_1 1766 0.53 1.11 0.34 152 XM_UB60 1755 0.34 1.10 0.09 153 DATE_IN_PAST_06_12 1746 0.31 1.10 0.05 154 FORGED_GMAIL_RCVD 1703 0.96 1.07 0.92 155 T_MONEY_PERCENT 1700 0.47 1.07 0.27 156 TR_LOTS_OF_MONEY2 1700 0.47 1.07 0.27 157 UNPARSEABLE_RELAY 1700 2.06 1.07 2.39 158 HTML_SHORT_LINK_IMG_1 1696 0.29 1.07 0.03 159 XMHTMLBadTable_001 1690 0.61 1.06 0.46 160 NML_ADSP_CUSTOM_MED 1686 1.24 1.06 1.30 161 URIBL_BLACK 1635 0.29 1.03 0.05 162 SUBJ_DOLLARS 1598 0.43 1.01 0.24 163 TR_Symld_Words 1592 1.45 1.00 1.59 164 HDRS_LCASE_IMGONLY 1564 0.28 0.98 0.05 165 T_TooManySym_02 1531 1.39 0.96 1.53 166 XMBody_78 1521 0.51 0.96 0.36 167 TR_MetaPhish_Combo_01 1516 1.49 0.95 1.66 168 TR_Mismatch_TLD_02 1491 0.28 0.94 0.06 169 RDNS_DYNAMIC 1468 0.57 0.92 0.46 170 XMPhish14 1464 0.55 0.92 0.43 171 HTML_IMAGE_ONLY_24 1438 0.49 0.91 0.35 172 XM_UB80 1422 0.25 0.90 0.03 173 XMSlimDrugH 1362 0.45 0.86 0.32 174 HTML_FONT_FACE_BAD 1335 0.65 0.84 0.59 175 T_FILL_THIS_FORM_SHORT 1330 0.92 0.84 0.95 176 XM_B_REG_HTML 1276 0.51 0.80 0.41 177 TR_LOTS_OF_MONEY3 1261 0.50 0.79 0.40 178 URIBL_DBL_SPAM 1261 0.20 0.79 0.01 179 BODY_QUOTE_MALF_MSGID 1260 0.64 0.79 0.59 180 HTML_IMAGE_ONLY_20 1253 0.41 0.79 0.28 181 RCVD_IN_IADB_OPTIN 1243 2.08 0.78 2.50 182 URIBL_ABUSE_SURBL 1239 0.26 0.78 0.09 183 URI_NOVOWEL 1225 0.55 0.77 0.48 184 SHORT_URI_3 1216 0.31 0.77 0.16 185 BAYES_00 1210 8.60 0.76 11.18 186 TM2_M_A_HREF_HREF 1188 0.56 0.75 0.50 187 HK_RANDOM_REPLYTO 1187 0.38 0.75 0.26 188 XMSubMetaSSx_00 1157 0.34 0.73 0.22 189 RELAYCOUNTRY_IN 1154 0.26 0.73 0.11 190 TooManyTo_002 1149 1.82 0.72 2.18 191 NUMERIC_HTTP_ADDR 1120 0.40 0.71 0.29 192 HTML_TAG_BALANCE_BODY 1118 0.60 0.70 0.57 193 RELAYCOUNTRY_AT 1115 0.29 0.70 0.16 194 XM_RXBody 1105 0.38 0.70 0.28 195 XMCmmnCold 1100 0.19 0.69 0.03 196 PLING_QUERY 1089 0.45 0.69 0.37 197 MISSING_HEADERS 1088 0.49 0.68 0.43 198 BODY_URI_ONLY 1086 0.25 0.68 0.10 199 HTML_SHORT_LINK_IMG_3 1069 0.23 0.67 0.09 200 THIS_AD 1042 0.27 0.66 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 422850 89.26 95.19 87.32 2 DKIM_SIGNED 350735 74.51 80.86 72.43 3 XM_DK_Pass 343951 72.59 77.36 71.03 4 DKIM_VALID 327293 69.02 73.40 67.59 5 DCC_CHECK_NEGATIVE 287727 49.71 20.11 59.42 6 BAYES_50 259522 49.27 36.11 53.59 7 DKIM_VALID_AU 236336 50.48 55.57 48.80 8 XMListUnsubscribeExists 236065 54.78 73.18 48.75 9 DCC_CHECK 185929 48.27 78.37 38.39 10 T_TM2_M_HEADER_IN_MSG 151044 28.98 22.23 31.19 11 HTML_FONT_LOW_CONTRAST 133266 29.45 35.35 27.52 12 DKIM_VALID_EF 125796 25.11 22.47 25.98 13 FVGT_m_MULTI_ODD 102344 22.64 27.23 21.13 14 XMSubLong 101717 22.32 26.33 21.00 15 LOC_TINY_FONT_1 100882 23.82 32.93 20.83 16 MIME_HTML_ONLY 98955 23.18 31.56 20.43 17 ALL_TRUSTED 90796 15.32 4.85 18.75 18 MultiRelay 90551 18.10 16.29 18.70 19 T_KAM_HTML_FONT_INVALID 80921 17.66 20.56 16.71 20 XM_DK_Undo_02 64351 21.70 47.32 13.29 21 XM_Body_Dirty_Words 62210 14.73 20.47 12.85 22 XM_Multi_Part_URI 56371 12.70 15.92 11.64 23 BAYES_99 55884 19.25 42.73 11.54 24 BAYES_00 54123 8.60 0.76 11.18 25 BAYES_999 49286 16.37 35.26 10.18 26 RCVD_IN_RP_SAFE 45698 7.88 3.15 9.44 27 XM_Evil_Numbers_Gen 42702 9.81 12.82 8.82 28 LOTS_OF_MONEY 42167 9.46 11.77 8.71 29 TR_XM_DK_Bayes 42055 6.63 0.37 8.68 30 RCVD_IN_RP_CERTIFIED 41179 6.95 2.23 8.50 31 TR_XM_DK_Bayes1 40205 6.33 0.32 8.30 32 LotsOfNums_01 38726 8.42 9.72 8.00 33 TooManyTo_001 38681 7.82 7.32 7.99 34 RCVD_IN_MSPIKE_H2 38409 7.15 4.76 7.93 35 XM_DKIMWhitelistDomains 36921 5.75 0.04 7.62 36 HTML_IMAGE_RATIO_02 36845 8.89 12.81 7.61 37 T_XMDrugObfuBody_14 35515 7.65 8.62 7.33 38 TR_XM_DK_Bayes2 34683 5.45 0.23 7.16 39 FSL_BULK_SIG 34491 8.18 11.40 7.12 40 BAYES_60 32579 6.42 5.47 6.73 41 RCVD_IN_MSPIKE_WL 31207 5.36 2.07 6.44 42 XM_H_Long_From01 30526 6.76 8.16 6.30 43 XM_SendGrid 29435 5.49 3.68 6.08 44 RCVD_IN_MSPIKE_H3 28667 4.93 1.91 5.92 45 MIME_QP_LONG_LINE 28076 5.78 5.71 5.80 46 T_REMOTE_IMAGE 27740 5.01 2.81 5.73 47 RCVD_IN_IADB_LISTED 26957 4.94 3.04 5.57 48 XM_B_Phish_Phrases 26636 5.86 6.97 5.50 49 TR_DCC_Bayes_99 26275 12.63 34.60 5.43 50 FROM_EXCESS_BASE64 25852 5.17 4.65 5.34 51 HTML_IMAGE_RATIO_04 25153 5.69 7.22 5.19 52 RELAYCOUNTRY_META 24511 8.08 17.29 5.06 53 TO_MALFORMED 23993 3.75 0.10 4.95 54 T_TooManySym_01 23645 4.36 2.76 4.88 55 DKIM_INVALID 23442 5.49 7.46 4.84 56 RCVD_IN_IADB_SPF 23321 4.30 2.72 4.82 57 XMStrtUSub 23227 4.52 3.68 4.80 58 BAYES_80 22033 5.22 7.25 4.55 59 XM_PDF 21921 3.57 0.64 4.53 60 BAYES_40 21160 3.69 1.64 4.37 61 XMNumbers 20089 4.07 3.85 4.15 62 BOTNET_IPINHOSTNAME 20062 6.36 13.11 4.14 63 RCVD_IN_IADB_SENDERID 20036 3.76 2.59 4.14 64 RCVD_IN_IADB_DK 19693 3.70 2.59 4.07 65 XM_UncommonTLD01 19449 5.48 9.96 4.02 66 IN_ZIMBRA_NJ_WHITELIST 19080 2.97 0.02 3.94 67 RCVD_IN_IADB_VOUCHED 18703 3.23 1.30 3.86 68 XMSubMetaSx_00 16892 4.45 7.38 3.49 69 MPART_ALT_DIFF 16676 4.42 7.39 3.44 70 XMSexyCombo_05 15939 5.11 10.67 3.29 71 TR_XM_DK_SendGrid 15886 2.91 1.76 3.28 72 XM_B_SpammyTLD 15764 4.37 7.76 3.26 73 HTML_IMAGE_RATIO_06 15507 3.64 4.99 3.20 74 BAYES_20 15377 2.67 1.12 3.18 75 BAYES_95 12563 2.99 4.20 2.59 76 RCVD_IN_IADB_OPTIN 12108 2.08 0.78 2.50 77 SUBJ_ALL_CAPS 12020 2.27 1.63 2.48 78 XM_DIRTYINTL 11933 3.19 5.42 2.46 79 UNPARSEABLE_RELAY 11555 2.06 1.07 2.39 80 XMDiploma_00 11180 2.48 2.99 2.31 81 RCVD_IN_MSPIKE_BL 11062 2.82 4.45 2.28 82 INVALID_MSGID 10910 1.74 0.18 2.25 83 KHOP_HELO_FCRDNS 10718 2.31 2.61 2.21 84 MIME_HTML_MOSTLY 10693 2.77 4.50 2.21 85 TooManyTo_002 10570 1.82 0.72 2.18 86 TR_XM_PHPDW 10084 2.21 2.60 2.08 87 TVD_RCVD_IP 10031 2.41 3.45 2.07 88 MAILING_LIST_MULTI 9965 1.96 1.68 2.06 89 XM_SPF_SoftFail 9759 2.61 4.41 2.02 90 BAYES_05 9667 1.65 0.59 2.00 91 TM2_M_URI_OPT_OUT 9658 2.49 3.99 1.99 92 TR_XM_PHPForged 9376 2.10 2.59 1.94 93 HTML_MIME_NO_HTML_TAG 9087 1.97 2.25 1.88 94 HELO_NODOT 9076 1.56 0.58 1.87 95 HELO_NO_DOMAIN 9073 1.55 0.58 1.87 96 HTML_IMAGE_RATIO_08 8855 2.12 3.01 1.83 97 MIME_HTML_ONLY_MULTI 8678 2.36 4.11 1.79 98 URI_HEX 8536 2.13 3.25 1.76 99 XM_DK_Undo_01 8511 1.66 1.34 1.76 100 XM_CamelCaseFrm001 8436 2.40 4.42 1.74 101 IN_HORDE_ADDRESS_BOOK 8241 1.29 0.04 1.70 102 ANY_BOUNCE_MESSAGE 8215 1.38 0.42 1.70 103 BOUNCE_MESSAGE 8199 1.38 0.42 1.69 104 BOTNET 8061 5.14 15.72 1.66 105 URI_TRY_3LD 8051 1.68 1.72 1.66 106 TR_MetaPhish_Combo_01 8046 1.49 0.95 1.66 107 XMGenDplmaNmb 7930 1.64 1.64 1.64 108 TR_Symld_Words 7709 1.45 1.00 1.59 109 DKIM_ADSP_CUSTOM_MED 7488 1.48 1.29 1.55 110 XM_OfRef6 7468 1.70 2.19 1.54 111 T_TooManySym_02 7408 1.39 0.96 1.53 112 T_XMDrugObfuBody_08 7403 1.86 2.87 1.53 113 RELAYCOUNTRY_CA 7231 2.08 3.85 1.49 114 XMCapTrack 7184 1.19 0.32 1.48 115 TooManyTo_003 7156 1.26 0.58 1.48 116 TR_XM_FormFill2 6422 1.63 2.55 1.33 117 XM_H_PHPOS 6412 1.62 2.54 1.32 118 UNTRUSTED_Relay 6380 3.59 10.53 1.32 119 NML_ADSP_CUSTOM_MED 6281 1.24 1.06 1.30 120 XM_H_PHPMailer 6166 1.31 1.41 1.27 121 XMPhish11 5881 1.96 4.23 1.21 122 XM_GoogleGroups 5740 1.01 0.47 1.19 123 TooManyTo_004 5393 0.95 0.46 1.11 124 RELAYCOUNTRY_GB 5283 1.15 1.33 1.09 125 RCVD_IN_BL_SPAMCOP_NET 5194 1.46 2.62 1.07 126 US_DOLLARS_3 5133 1.28 1.97 1.06 127 USER_IN_DEF_DKIM_WL 5127 0.80 0.01 1.06 128 NO_DNS_FOR_FROM 5068 1.24 1.84 1.05 129 XM_H_Long_From02 4894 1.29 2.12 1.01 130 RCVD_IN_MSPIKE_L5 4885 1.44 2.74 1.01 131 TM2_M_VERY_LONG_WORD 4857 1.20 1.79 1.00 132 XMNoVowels 4740 0.83 0.37 0.98 133 T_FILL_THIS_FORM_SHORT 4582 0.92 0.84 0.95 134 TooManyTo_005 4481 0.79 0.39 0.93 135 FORGED_GMAIL_RCVD 4468 0.96 1.07 0.92 136 TR_XM_RelayPhish 4252 1.06 1.60 0.88 137 XMStockSpam_06 4203 1.03 1.51 0.87 138 SpammyFromTLD_01 4168 1.16 2.05 0.86 139 XMBdyGiftCard01 4119 1.22 2.36 0.85 140 XM_UB50 4013 1.89 5.11 0.83 141 TO_NO_BRKTS_HTML_ONLY 3622 0.63 0.28 0.75 142 HTTPS_HTTP_MISMATCH 3349 1.42 3.64 0.69 143 T_XMDrugObfuBody_00 3330 0.85 1.35 0.69 144 XM_ProductURIs 3272 0.96 1.83 0.68 145 T_OBFU_PDF_ATTACH 3262 0.56 0.20 0.67 146 T_XMHurry_00 3214 0.82 1.30 0.66 147 RCVD_IN_MSPIKE_L4 3125 0.58 0.40 0.65 148 XMLngstWrd_00 3096 0.57 0.34 0.64 149 RCVD_IN_MSPIKE_L3 3052 0.80 1.31 0.63 150 T_Symld_Words_02 3031 0.77 1.19 0.63 151 FILL_THIS_FORM 3016 0.61 0.56 0.62 152 XMSexyCombo_01 2875 1.05 2.45 0.59 153 BODY_QUOTE_MALF_MSGID 2870 0.64 0.79 0.59 154 HTML_FONT_FACE_BAD 2844 0.65 0.84 0.59 155 XMLngstWrd_01 2831 0.52 0.32 0.58 156 XM_ShortIntro_01 2781 0.55 0.49 0.57 157 XMBody_95 2768 0.47 0.17 0.57 158 HTML_TAG_BALANCE_BODY 2743 0.60 0.70 0.57 159 DKIM_ADSP_NXDOMAIN 2685 0.93 2.07 0.55 160 XMMoneyMeta_00 2618 0.73 1.32 0.54 161 XMBrknScrpt_02 2617 0.71 1.21 0.54 162 T_FILL_THIS_FORM_LONG 2603 0.51 0.42 0.54 163 XMGappySubj_01 2553 0.48 0.34 0.53 164 T_TooManySym_03 2529 0.49 0.38 0.52 165 RELAYCOUNTRY_AU 2522 0.55 0.65 0.52 166 SHORT_HELO_AND_INLINE_IMAGE 2509 0.40 0.05 0.52 167 XMBody_17 2474 0.73 1.40 0.51 168 TM2_M_A_HREF_HREF 2439 0.56 0.75 0.50 169 FROM_GOV_SPOOF 2390 0.45 0.33 0.49 170 USER_IN_WHITELIST 2386 0.37 0.00 0.49 171 TR_Caps_n_Bayes_80 2344 0.41 0.17 0.48 172 XM_B_COPY_HTML 2343 0.50 0.54 0.48 173 URI_NOVOWEL 2342 0.55 0.77 0.48 174 TM2_M_BODY_EMPTY 2328 0.38 0.07 0.48 175 XMSubMetaI_00 2309 0.87 2.08 0.48 176 RDNS_DYNAMIC 2226 0.57 0.92 0.46 177 XMHTMLBadTable_001 2204 0.61 1.06 0.46 178 XMSubMetaSxObfu_03 2181 0.66 1.28 0.45 179 HTML_IMAGE_ONLY_32 2170 0.46 0.50 0.45 180 FILL_THIS_FORM_LOAN 2110 0.35 0.08 0.44 181 XMDateMe_00 2109 0.40 0.30 0.44 182 XMPhish14 2073 0.55 0.92 0.43 183 MISSING_HEADERS 2063 0.49 0.68 0.43 184 AC_DIV_BONANZA 2022 0.34 0.09 0.42 185 RCVD_IN_SORBS_DUL 1996 0.38 0.28 0.41 186 XM_B_REG_HTML 1985 0.51 0.80 0.41 187 TR_LOTS_OF_MONEY3 1945 0.50 0.79 0.40 188 XMPhish30 1913 0.59 1.18 0.40 189 XM_D_tchamptons_WL 1898 0.30 0.00 0.39 190 XMHTML_After_End 1871 0.60 1.24 0.39 191 XM_URI_RBL 1843 1.10 3.27 0.38 192 HTML_IMAGE_ONLY_28 1816 0.41 0.53 0.38 193 PLING_QUERY 1803 0.45 0.69 0.37 194 XMSubMetaSxObfu_02 1800 0.37 0.35 0.37 195 XMBody_78 1766 0.51 0.96 0.36 196 FROM_GOV_DKIM_AU 1722 0.29 0.10 0.36 197 HTML_IMAGE_ONLY_24 1691 0.49 0.91 0.35 198 XM_Body_Obfu01 1654 0.33 0.31 0.34 199 DIET_1 1644 0.53 1.11 0.34 200 XMSolicitRefs_0 1620 0.36 0.43 0.33 ----------------------------------------------------------------------