Email: 638551 Autolearn: 0 AvgScore: 2.76 AvgScanTime: 2.15 sec Spam: 156160 Autolearn: 0 AvgScore: 12.20 AvgScanTime: 2.59 sec Ham: 482391 Autolearn: 0 AvgScore: -0.30 AvgScanTime: 2.01 sec Time Spent Running SA: 381.77 hours Time Spent Processing Spam: 112.17 hours Time Spent Processing Ham: 269.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148607 89.16 95.16 87.21 2 DKIM_SIGNED 129411 75.19 82.87 72.71 3 XM_DK_Pass 125390 73.60 80.30 71.43 4 DKIM_VALID 122124 71.15 78.20 68.87 5 DCC_CHECK 121894 48.49 78.06 38.91 6 XMListUnsubscribeExists 117470 55.43 75.22 49.02 7 XM_B_Unicode 116243 69.51 74.44 67.92 8 DKIM_VALID_AU 92802 52.81 59.43 50.67 9 XM_DK_Undo_02 76787 21.92 49.17 13.10 10 BAYES_99 68105 18.83 43.61 10.81 11 HTML_FONT_LOW_CONTRAST 58843 30.11 37.68 27.66 12 BAYES_999 55486 15.82 35.53 9.44 13 LOC_TINY_FONT_1 54913 25.75 35.16 22.70 14 TR_DCC_Bayes_99 54798 12.51 35.09 5.20 15 MIME_HTML_ONLY 50116 23.78 32.09 21.08 16 BAYES_50 48083 48.13 30.79 53.74 17 FVGT_m_MULTI_ODD 42645 22.43 27.31 20.85 18 XMSubLong 40676 22.47 26.05 21.31 19 DKIM_VALID_EF 35569 26.28 22.78 27.42 20 T_KAM_HTML_FONT_INVALID 35028 18.49 22.43 17.21 21 T_TM2_M_HEADER_IN_MSG 34141 29.52 21.86 32.00 22 XM_Body_Dirty_Words 33369 14.54 21.37 12.33 23 RELAYCOUNTRY_META 32241 9.02 20.65 5.26 24 DCC_CHECK_NEGATIVE 31217 49.42 19.99 58.94 25 MultiRelay 25641 18.02 16.42 18.54 26 XM_Multi_Part_URI 25069 13.21 16.05 12.29 27 BOTNET 24865 5.48 15.92 2.09 28 BOTNET_IPINHOSTNAME 23281 7.01 14.91 4.45 29 LOTS_OF_MONEY 21423 9.27 13.72 7.83 30 HTML_IMAGE_RATIO_02 19927 8.71 12.76 7.39 31 UNTRUSTED_Relay 19848 4.17 12.71 1.40 32 XM_Evil_Numbers_Gen 19409 9.49 12.43 8.54 33 FSL_BULK_SIG 17760 8.25 11.37 7.24 34 XMSexyCombo_05 16379 5.22 10.49 3.52 35 RCVD_IN_MSPIKE_H2 15821 11.13 10.13 11.45 36 LotsOfNums_01 14433 8.07 9.24 7.69 37 BAYES_80 14050 5.13 9.00 3.88 38 T_XMDrugObfuBody_14 13811 8.95 8.84 8.98 39 HTML_IMAGE_RATIO_04 12941 5.28 8.29 4.30 40 XM_H_Long_From01 12528 6.79 8.02 6.39 41 XM_B_Phish_Phrases 11921 6.09 7.63 5.58 42 XMSubMetaSx_00 11920 4.63 7.63 3.66 43 XM_UncommonTLD01 11577 4.87 7.41 4.05 44 TooManyTo_001 11501 8.10 7.36 8.33 45 BAYES_60 11185 6.62 7.16 6.44 46 MPART_ALT_DIFF 10600 5.50 6.79 5.08 47 MIME_QP_LONG_LINE 9241 5.84 5.92 5.81 48 XM_DIRTYINTL 8358 3.24 5.35 2.56 49 HTML_IMAGE_RATIO_06 7479 3.63 4.79 3.26 50 BAYES_95 7468 3.17 4.78 2.65 51 DKIM_INVALID 7287 4.04 4.67 3.84 52 XM_UB50 7244 1.79 4.64 0.87 53 SpammyFromTLD_02 7200 1.37 4.61 0.32 54 RELAYCOUNTRY_CA 7102 2.22 4.55 1.47 55 XM_SPF_SoftFail 6484 2.50 4.15 1.96 56 MIME_HTML_MOSTLY 6343 2.68 4.06 2.23 57 XMStrtUSub 6264 4.27 4.01 4.35 58 XM_SendGrid 6113 5.46 3.91 5.96 59 MIME_HTML_ONLY_MULTI 5997 3.65 3.84 3.59 60 XMNumbers 5944 3.01 3.81 2.75 61 RELAYCOUNTRY_FR 5918 1.12 3.79 0.25 62 FROM_EXCESS_BASE64 5855 3.68 3.75 3.66 63 TM2_M_URI_OPT_OUT 5796 2.19 3.71 1.69 64 DKIM_ADSP_NXDOMAIN 5668 1.34 3.63 0.59 65 XM_URI_RBL 5650 1.15 3.62 0.35 66 HTML_IMAGE_RATIO_08 5399 2.36 3.46 2.01 67 T_TooManySym_01 5141 4.67 3.29 5.11 68 RCVD_IN_MSPIKE_BL 5106 2.19 3.27 1.84 69 RCVD_IN_RP_SAFE 5036 7.95 3.22 9.48 70 URI_HEX 4985 1.88 3.19 1.46 71 RCVD_IN_IADB_LISTED 4800 4.62 3.07 5.12 72 XM_B_SpammyTLD 4752 3.26 3.04 3.33 73 RCVD_IN_BL_SPAMCOP_NET 4715 1.54 3.02 1.07 74 RCVD_IN_PSBL 4711 0.77 3.02 0.04 75 XM_CamelCaseFrm001 4676 2.33 2.99 2.12 76 T_REMOTE_IMAGE 4571 3.61 2.93 3.83 77 US_DOLLARS_3 4529 1.32 2.90 0.81 78 HTML_MIME_NO_HTML_TAG 4492 2.56 2.88 2.46 79 RCVD_IN_IADB_SPF 4318 4.05 2.77 4.47 80 XM_UB99 4202 0.68 2.69 0.02 81 NUMERIC_HTTP_ADDR 4141 0.89 2.65 0.33 82 RCVD_IN_IADB_DK 4122 3.55 2.64 3.85 83 XMDiploma_00 4117 1.96 2.64 1.73 84 T_XMDrugObfuBody_08 4105 1.71 2.63 1.41 85 RCVD_IN_IADB_SENDERID 4097 3.60 2.62 3.91 86 RCVD_IN_RP_CERTIFIED 4006 7.08 2.57 8.54 87 XMSexyCombo_01 3983 1.10 2.55 0.63 88 XMBody_17 3972 1.06 2.54 0.58 89 XM_ProductURIs 3906 1.37 2.50 1.01 90 RCVD_IN_MSPIKE_WL 3838 4.82 2.46 5.59 91 BOTNET_NORDNS 3826 0.62 2.45 0.03 92 NORMAL_HTTP_TO_IP 3744 0.63 2.40 0.05 93 URI_TRY_3LD 3689 1.57 2.36 1.32 94 NO_DNS_FOR_FROM 3674 1.36 2.35 1.04 95 TR_XM_PHPDW 3651 1.78 2.34 1.60 96 RCVD_IN_MSPIKE_H3 3635 4.37 2.33 5.03 97 XMBdyGiftCard01 3586 1.02 2.30 0.61 98 TR_XM_PHPForged 3563 1.75 2.28 1.58 99 TR_XM_FormFill2 3542 1.74 2.27 1.56 100 XM_OfRef6 3528 1.82 2.26 1.68 101 MIME_HEADER_CTYPE_ONLY 3525 0.68 2.26 0.17 102 XM_H_PHPOS 3524 1.73 2.26 1.56 103 MultiRelay_Combo 3470 0.73 2.22 0.25 104 MultiRelay_CC 3470 0.73 2.22 0.25 105 HTML_IMAGE_ONLY_24 3409 0.80 2.18 0.35 106 SUBJ_ALL_CAPS 3222 1.71 2.06 1.60 107 ALL_TRUSTED 3197 13.28 2.05 16.91 108 KHOP_HELO_FCRDNS 3149 2.08 2.02 2.10 109 THIS_AD 3132 0.60 2.01 0.15 110 TM2_M_VERY_LONG_WORD 3055 1.36 1.96 1.16 111 HDRS_LCASE_IMGONLY 3054 0.51 1.96 0.05 112 XM_H_Long_From02 3049 1.18 1.95 0.93 113 XM_UB999 3039 0.49 1.95 0.02 114 TR_XM_DK_SendGrid 3029 2.98 1.94 3.32 115 XM_UB60 2903 0.52 1.86 0.09 116 RCVD_IN_RP_RNBL 2895 0.49 1.85 0.05 117 MAILING_LIST_MULTI 2857 2.14 1.83 2.24 118 TR_XM_RelayPhish 2809 1.06 1.80 0.83 119 XMGenDplmaNmb 2806 1.20 1.80 1.01 120 RCVD_IN_MSPIKE_L5 2802 1.09 1.79 0.86 121 RELAYCOUNTRY_DE 2746 0.71 1.76 0.37 122 T_XMDrugObfuBody_00 2744 0.97 1.76 0.71 123 FROM_SUSPICIOUS_NTLD 2602 0.44 1.67 0.04 124 XMPhish11 2580 1.35 1.65 1.25 125 BAYES_40 2569 3.55 1.65 4.17 126 FROM_SUSPICIOUS_NTLD_FP 2548 0.42 1.63 0.03 127 XM_UB80 2477 0.40 1.59 0.02 128 TR_Symld_Words 2449 1.59 1.57 1.59 129 XMMoneyMeta_00 2449 0.89 1.57 0.67 130 T_XMHurry_00 2417 0.92 1.55 0.71 131 XMSubMetaI_00 2410 0.82 1.54 0.59 132 SpammyFromTLD_01 2384 0.97 1.53 0.80 133 BAYES_20 2366 2.62 1.52 2.98 134 TR_LOTS_OF_MONEY3 2175 0.72 1.39 0.50 135 DATE_IN_PAST_03_06 2134 0.39 1.37 0.07 136 RCVD_IN_IADB_VOUCHED 2129 2.86 1.36 3.35 137 XMBody_78 2129 0.71 1.36 0.50 138 XMStockSpam_06 2123 0.95 1.36 0.81 139 XMHTML_After_End 2072 0.63 1.33 0.40 140 XMPhish30 1984 0.64 1.27 0.43 141 TR_Mismatch_TLD_02 1973 0.36 1.26 0.07 142 RELAYCOUNTRY_RO 1964 0.31 1.26 0.01 143 DKIM_ADSP_CUSTOM_MED 1915 1.02 1.23 0.95 144 XM_DK_Undo_01 1909 1.60 1.22 1.72 145 XM_HighProb1 1880 0.31 1.20 0.02 146 RELAYCOUNTRY_IN 1850 0.39 1.18 0.13 147 T_TooManySym_02 1826 1.58 1.17 1.71 148 XM_H_PHPMailer 1813 0.93 1.16 0.86 149 XM_B_REG_HTML 1808 0.54 1.16 0.33 150 T_Symld_Words_02 1765 0.81 1.13 0.70 151 T_MONEY_PERCENT 1740 0.46 1.11 0.25 152 TR_LOTS_OF_MONEY2 1740 0.46 1.11 0.25 153 URIBL_DBL_ABUSE_REDIR 1736 0.30 1.11 0.04 154 DATE_IN_PAST_06_12 1732 0.30 1.11 0.04 155 PDS_TO_EQ_FROM_NAME 1724 0.28 1.10 0.02 156 XMBrknScrpt_02 1680 0.72 1.08 0.61 157 RCVD_IN_MSPIKE_L3 1667 0.66 1.07 0.53 158 URIBL_BLACK 1657 0.30 1.06 0.06 159 FORGED_GMAIL_RCVD 1653 0.60 1.06 0.45 160 XMHTMLBadTable_001 1643 0.71 1.05 0.60 161 RELAYCOUNTRY_GB 1628 1.10 1.04 1.12 162 DATE_IN_PAST_12_24 1606 0.30 1.03 0.06 163 RELAYCOUNTRY_JP 1597 0.27 1.02 0.02 164 SUBJ_DOLLARS 1571 0.55 1.01 0.41 165 HTML_TAG_BALANCE_BODY 1570 0.83 1.01 0.78 166 RELAYCOUNTRY_AT 1562 0.42 1.00 0.23 167 DIET_1 1560 0.46 1.00 0.28 168 NML_ADSP_CUSTOM_MED 1546 0.78 0.99 0.71 169 RDNS_DYNAMIC 1506 0.59 0.96 0.46 170 XMSexyCombo_04 1491 0.38 0.95 0.19 171 RELAYCOUNTRY_AU 1446 0.67 0.93 0.59 172 XM_H_PHPOS_M 1442 0.58 0.92 0.47 173 HTML_FONT_FACE_BAD 1424 0.62 0.91 0.53 174 XMPhish14 1417 0.56 0.91 0.45 175 BODY_QUOTE_MALF_MSGID 1407 0.62 0.90 0.53 176 URI_NOVOWEL 1387 0.63 0.89 0.55 177 XMSlimDrugH 1386 0.56 0.89 0.45 178 UNPARSEABLE_RELAY 1372 2.07 0.88 2.45 179 BODY_ENHANCEMENT 1335 0.24 0.85 0.04 180 TR_MetaPhish_Combo_01 1323 1.38 0.85 1.55 181 T_FILL_THIS_FORM_SHORT 1320 0.89 0.85 0.91 182 HTTPS_HTTP_MISMATCH 1315 0.72 0.84 0.68 183 XM_UB95 1292 0.21 0.83 0.01 184 TooManyTo_002 1268 1.88 0.81 2.22 185 XMGppyBdWords 1256 0.34 0.80 0.20 186 XMSubMetaSSx_00 1209 0.37 0.77 0.24 187 XM_RXBody 1201 0.27 0.77 0.11 188 MPART_ALT_DIFF_COUNT 1179 0.36 0.75 0.23 189 URIBL_DBL_SPAM 1174 0.19 0.75 0.01 190 XMSubMetaSxObfu_03 1163 0.42 0.74 0.32 191 LongTLD 1154 0.31 0.74 0.17 192 RCVD_IN_IADB_OPTIN 1100 1.75 0.70 2.09 193 ANY_BOUNCE_MESSAGE 1080 1.54 0.69 1.82 194 BOUNCE_MESSAGE 1080 1.54 0.69 1.82 195 HTML_IMAGE_ONLY_12 1071 0.31 0.69 0.19 196 HELO_NODOT 1069 1.55 0.68 1.83 197 TR_Caps_n_Bayes_99 1064 0.30 0.68 0.17 198 XM_B_COPY_HTML 1061 0.55 0.68 0.50 199 HK_RANDOM_FROM 1060 0.27 0.68 0.13 200 HELO_NO_DOMAIN 1060 1.55 0.68 1.83 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420703 89.16 95.16 87.21 2 DKIM_SIGNED 350727 75.19 82.87 72.71 3 XM_DK_Pass 344560 73.60 80.30 71.43 4 DKIM_VALID 332204 71.15 78.20 68.87 5 XM_B_Unicode 327641 69.51 74.44 67.92 6 DCC_CHECK_NEGATIVE 284338 49.42 19.99 58.94 7 BAYES_50 259239 48.13 30.79 53.74 8 DKIM_VALID_AU 244430 52.81 59.43 50.67 9 XMListUnsubscribeExists 236463 55.43 75.22 49.02 10 DCC_CHECK 187709 48.49 78.06 38.91 11 T_TM2_M_HEADER_IN_MSG 154351 29.52 21.86 32.00 12 HTML_FONT_LOW_CONTRAST 133447 30.11 37.68 27.66 13 DKIM_VALID_EF 132250 26.28 22.78 27.42 14 LOC_TINY_FONT_1 109482 25.75 35.16 22.70 15 XMSubLong 102788 22.47 26.05 21.31 16 MIME_HTML_ONLY 101703 23.78 32.09 21.08 17 FVGT_m_MULTI_ODD 100601 22.43 27.31 20.85 18 MultiRelay 89430 18.02 16.42 18.54 19 T_KAM_HTML_FONT_INVALID 83039 18.49 22.43 17.21 20 ALL_TRUSTED 81576 13.28 2.05 16.91 21 XM_DK_Undo_02 63190 21.92 49.17 13.10 22 BAYES_00 63150 10.05 0.64 13.09 23 XM_Body_Dirty_Words 59487 14.54 21.37 12.33 24 XM_Multi_Part_URI 59272 13.21 16.05 12.29 25 RCVD_IN_MSPIKE_H2 55237 11.13 10.13 11.45 26 BAYES_99 52147 18.83 43.61 10.81 27 RCVD_IN_RP_SAFE 45712 7.95 3.22 9.48 28 BAYES_999 45518 15.82 35.53 9.44 29 TR_XM_DK_Bayes 43913 6.97 0.39 9.10 30 T_XMDrugObfuBody_14 43322 8.95 8.84 8.98 31 TR_XM_DK_Bayes1 42550 6.76 0.38 8.82 32 RCVD_IN_RP_CERTIFIED 41187 7.08 2.57 8.54 33 XM_Evil_Numbers_Gen 41187 9.49 12.43 8.54 34 TooManyTo_001 40206 8.10 7.36 8.33 35 LOTS_OF_MONEY 37761 9.27 13.72 7.83 36 XM_DKIMWhitelistDomains 37453 5.89 0.11 7.76 37 LotsOfNums_01 37110 8.07 9.24 7.69 38 TR_XM_DK_Bayes2 36457 5.78 0.28 7.56 39 HTML_IMAGE_RATIO_02 35672 8.71 12.76 7.39 40 FSL_BULK_SIG 34930 8.25 11.37 7.24 41 BAYES_60 31061 6.62 7.16 6.44 42 XM_H_Long_From01 30847 6.79 8.02 6.39 43 XM_SendGrid 28739 5.46 3.91 5.96 44 MIME_QP_LONG_LINE 28035 5.84 5.92 5.81 45 RCVD_IN_MSPIKE_WL 26960 4.82 2.46 5.59 46 XM_B_Phish_Phrases 26935 6.09 7.63 5.58 47 IN_ZIMBRA_NJ_WHITELIST 26038 4.08 0.02 5.40 48 RELAYCOUNTRY_META 25366 9.02 20.65 5.26 49 TR_DCC_Bayes_99 25089 12.51 35.09 5.20 50 RCVD_IN_IADB_LISTED 24692 4.62 3.07 5.12 51 T_TooManySym_01 24673 4.67 3.29 5.11 52 TO_MALFORMED 24628 3.89 0.12 5.11 53 XM_PDF 24527 4.00 0.65 5.08 54 MPART_ALT_DIFF 24516 5.50 6.79 5.08 55 RCVD_IN_MSPIKE_H3 24261 4.37 2.33 5.03 56 RCVD_IN_IADB_SPF 21568 4.05 2.77 4.47 57 BOTNET_IPINHOSTNAME 21486 7.01 14.91 4.45 58 XMStrtUSub 20994 4.27 4.01 4.35 59 HTML_IMAGE_RATIO_04 20758 5.28 8.29 4.30 60 BAYES_40 20100 3.55 1.65 4.17 61 XM_UncommonTLD01 19543 4.87 7.41 4.05 62 RCVD_IN_IADB_SENDERID 18871 3.60 2.62 3.91 63 BAYES_80 18731 5.13 9.00 3.88 64 RCVD_IN_IADB_DK 18567 3.55 2.64 3.85 65 DKIM_INVALID 18523 4.04 4.67 3.84 66 T_REMOTE_IMAGE 18472 3.61 2.93 3.83 67 FROM_EXCESS_BASE64 17669 3.68 3.75 3.66 68 XMSubMetaSx_00 17642 4.63 7.63 3.66 69 MIME_HTML_ONLY_MULTI 17307 3.65 3.84 3.59 70 XMSexyCombo_05 16973 5.22 10.49 3.52 71 RCVD_IN_IADB_VOUCHED 16143 2.86 1.36 3.35 72 XM_B_SpammyTLD 16075 3.26 3.04 3.33 73 TR_XM_DK_SendGrid 16018 2.98 1.94 3.32 74 HTML_IMAGE_RATIO_06 15721 3.63 4.79 3.26 75 BAYES_20 14357 2.62 1.52 2.98 76 XMNumbers 13258 3.01 3.81 2.75 77 BAYES_95 12781 3.17 4.78 2.65 78 XM_DIRTYINTL 12352 3.24 5.35 2.56 79 HTML_MIME_NO_HTML_TAG 11847 2.56 2.88 2.46 80 UNPARSEABLE_RELAY 11839 2.07 0.88 2.45 81 TVD_RCVD_IP 11313 1.87 0.42 2.35 82 INVALID_MSGID 10946 1.74 0.12 2.27 83 MAILING_LIST_MULTI 10795 2.14 1.83 2.24 84 MIME_HTML_MOSTLY 10746 2.68 4.06 2.23 85 TooManyTo_002 10722 1.88 0.81 2.22 86 XM_CamelCaseFrm001 10219 2.33 2.99 2.12 87 KHOP_HELO_FCRDNS 10149 2.08 2.02 2.10 88 BOTNET 10101 5.48 15.92 2.09 89 RCVD_IN_IADB_OPTIN 10089 1.75 0.70 2.09 90 HTML_IMAGE_RATIO_08 9689 2.36 3.46 2.01 91 XM_SPF_SoftFail 9448 2.50 4.15 1.96 92 BAYES_05 9172 1.60 0.67 1.90 93 RCVD_IN_MSPIKE_BL 8882 2.19 3.27 1.84 94 HELO_NODOT 8825 1.55 0.68 1.83 95 HELO_NO_DOMAIN 8821 1.55 0.68 1.83 96 ANY_BOUNCE_MESSAGE 8758 1.54 0.69 1.82 97 BOUNCE_MESSAGE 8756 1.54 0.69 1.82 98 XMDiploma_00 8369 1.96 2.64 1.73 99 XM_DK_Undo_01 8307 1.60 1.22 1.72 100 T_TooManySym_02 8233 1.58 1.17 1.71 101 TM2_M_URI_OPT_OUT 8172 2.19 3.71 1.69 102 XM_OfRef6 8092 1.82 2.26 1.68 103 IN_HORDE_ADDRESS_BOOK 8053 1.27 0.03 1.67 104 SUBJ_ALL_CAPS 7718 1.71 2.06 1.60 105 TR_XM_PHPDW 7706 1.78 2.34 1.60 106 TR_Symld_Words 7683 1.59 1.57 1.59 107 TR_XM_PHPForged 7631 1.75 2.28 1.58 108 TR_XM_FormFill2 7544 1.74 2.27 1.56 109 XM_H_PHPOS 7525 1.73 2.26 1.56 110 TR_MetaPhish_Combo_01 7500 1.38 0.85 1.55 111 TooManyTo_003 7360 1.31 0.66 1.53 112 XMCapTrack 7092 1.18 0.30 1.47 113 RELAYCOUNTRY_CA 7074 2.22 4.55 1.47 114 URI_HEX 7035 1.88 3.19 1.46 115 T_XMDrugObfuBody_08 6814 1.71 2.63 1.41 116 UNTRUSTED_Relay 6771 4.17 12.71 1.40 117 URI_TRY_3LD 6356 1.57 2.36 1.32 118 XMPhish11 6034 1.35 1.65 1.25 119 XM_UCStrings02 5966 0.94 0.04 1.24 120 USER_IN_DEF_DKIM_WL 5761 0.90 0.00 1.19 121 TM2_M_VERY_LONG_WORD 5605 1.36 1.96 1.16 122 TooManyTo_004 5584 1.02 0.58 1.16 123 RELAYCOUNTRY_GB 5425 1.10 1.04 1.12 124 XM_GoogleGroups 5371 0.98 0.56 1.11 125 RCVD_IN_BL_SPAMCOP_NET 5148 1.54 3.02 1.07 126 NO_DNS_FOR_FROM 5033 1.36 2.35 1.04 127 XMGenDplmaNmb 4886 1.20 1.80 1.01 128 XM_ProductURIs 4856 1.37 2.50 1.01 129 TooManyTo_005 4657 0.85 0.50 0.97 130 DKIM_ADSP_CUSTOM_MED 4581 1.02 1.23 0.95 131 XM_H_Long_From02 4478 1.18 1.95 0.93 132 T_FILL_THIS_FORM_SHORT 4392 0.89 0.85 0.91 133 XM_UB50 4190 1.79 4.64 0.87 134 XM_H_PHPMailer 4139 0.93 1.16 0.86 135 RCVD_IN_MSPIKE_L5 4132 1.09 1.79 0.86 136 TR_XM_RelayPhish 3982 1.06 1.80 0.83 137 XMStockSpam_06 3918 0.95 1.36 0.81 138 US_DOLLARS_3 3887 1.32 2.90 0.81 139 SpammyFromTLD_01 3841 0.97 1.53 0.80 140 HTML_TAG_BALANCE_BODY 3743 0.83 1.01 0.78 141 XM_Body_Obfu01 3699 0.65 0.31 0.77 142 FILL_THIS_FORM 3496 0.67 0.50 0.72 143 T_XMHurry_00 3432 0.92 1.55 0.71 144 T_XMDrugObfuBody_00 3422 0.97 1.76 0.71 145 NML_ADSP_CUSTOM_MED 3411 0.78 0.99 0.71 146 TO_NO_BRKTS_HTML_ONLY 3408 0.60 0.28 0.71 147 T_Symld_Words_02 3379 0.81 1.13 0.70 148 T_OBFU_PDF_ATTACH 3294 0.56 0.17 0.68 149 HTTPS_HTTP_MISMATCH 3270 0.72 0.84 0.68 150 XMMoneyMeta_00 3251 0.89 1.57 0.67 151 XMSexyCombo_01 3053 1.10 2.55 0.63 152 XMBody_95 2951 0.50 0.16 0.61 153 XMBdyGiftCard01 2934 1.02 2.30 0.61 154 XMBrknScrpt_02 2919 0.72 1.08 0.61 155 XMHTMLBadTable_001 2877 0.71 1.05 0.60 156 DKIM_ADSP_NXDOMAIN 2862 1.34 3.63 0.59 157 RELAYCOUNTRY_AU 2844 0.67 0.93 0.59 158 XMSubMetaI_00 2838 0.82 1.54 0.59 159 XM_ShortIntro_01 2836 0.52 0.31 0.59 160 XMBody_17 2802 1.06 2.54 0.58 161 XMGappySubj_01 2662 0.50 0.35 0.55 162 XMLngstWrd_00 2652 0.56 0.60 0.55 163 URI_NOVOWEL 2643 0.63 0.89 0.55 164 RCVD_IN_MSPIKE_L3 2564 0.66 1.07 0.53 165 BODY_QUOTE_MALF_MSGID 2549 0.62 0.90 0.53 166 HTML_FONT_FACE_BAD 2538 0.62 0.91 0.53 167 SHORT_HELO_AND_INLINE_IMAGE 2506 0.40 0.05 0.52 168 MISSING_HEADERS 2501 0.50 0.45 0.52 169 XMLngstWrd_01 2483 0.52 0.56 0.51 170 XMBody_78 2428 0.71 1.36 0.50 171 TR_LOTS_OF_MONEY3 2423 0.72 1.39 0.50 172 XM_B_COPY_HTML 2422 0.55 0.68 0.50 173 USER_IN_WHITELIST 2410 0.38 0.00 0.50 174 FROM_GOV_SPOOF 2408 0.46 0.32 0.50 175 XMNoVowels 2379 0.50 0.52 0.49 176 TM2_M_BODY_EMPTY 2332 0.40 0.16 0.48 177 T_TooManySym_03 2323 0.41 0.20 0.48 178 PLING_QUERY 2310 0.49 0.51 0.48 179 XM_H_PHPOS_M 2287 0.58 0.92 0.47 180 XMSubMetaSxObfu_02 2273 0.47 0.48 0.47 181 T_FILL_THIS_FORM_LONG 2250 0.42 0.26 0.47 182 RDNS_DYNAMIC 2240 0.59 0.96 0.46 183 XMSlimDrugH 2189 0.56 0.89 0.45 184 RCVD_IN_MSPIKE_L4 2186 0.44 0.41 0.45 185 XMPhish14 2174 0.56 0.91 0.45 186 FORGED_GMAIL_RCVD 2169 0.60 1.06 0.45 187 T_FILL_THIS_FORM_LOAN 2128 0.37 0.14 0.44 188 XMPhish30 2091 0.64 1.27 0.43 189 SUBJ_DOLLARS 1962 0.55 1.01 0.41 190 XMHTML_After_End 1952 0.63 1.33 0.40 191 HTML_IMAGE_ONLY_32 1950 0.40 0.39 0.40 192 TM2_M_A_HREF_HREF 1946 0.44 0.57 0.40 193 RCVD_IN_SORBS_DUL 1944 0.36 0.23 0.40 194 AC_DIV_BONANZA 1930 0.32 0.08 0.40 195 XMSubNoVowel 1928 0.42 0.47 0.40 196 XMDateMe_00 1856 0.38 0.36 0.38 197 RELAYCOUNTRY_DE 1791 0.71 1.76 0.37 198 HTML_IMAGE_ONLY_28 1785 0.41 0.53 0.37 199 HTML_IMAGE_ONLY_24 1707 0.80 2.18 0.35 200 XMOemUri 1692 0.32 0.21 0.35 ----------------------------------------------------------------------