Email: 566132 Autolearn: 0 AvgScore: 2.59 AvgScanTime: 2.13 sec Spam: 137265 Autolearn: 0 AvgScore: 12.25 AvgScanTime: 2.66 sec Ham: 428867 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.96 sec Time Spent Running SA: 335.15 hours Time Spent Processing Spam: 101.28 hours Time Spent Processing Ham: 233.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129606 88.24 94.42 86.26 2 DKIM_SIGNED 113161 77.08 82.44 75.36 3 XM_DK_Pass 110399 75.62 80.43 74.08 4 XM_B_Unicode 108300 70.81 78.90 68.22 5 DKIM_VALID 106868 72.86 77.86 71.27 6 DCC_CHECK 104412 49.37 76.07 40.82 7 XMListUnsubscribeExists 102749 55.98 74.85 49.94 8 DKIM_VALID_AU 81749 53.62 59.56 51.72 9 XM_DK_Undo_02 65659 22.10 47.83 13.86 10 BAYES_99 56603 19.11 41.24 12.02 11 HTML_FONT_LOW_CONTRAST 54162 31.53 39.46 29.00 12 BAYES_50 47290 48.81 34.45 53.41 13 LOC_TINY_FONT_1 46677 26.16 34.01 23.64 14 BAYES_999 46501 16.28 33.88 10.64 15 TR_DCC_Bayes_99 44308 12.29 32.28 5.89 16 MIME_HTML_ONLY 41491 22.90 30.23 20.55 17 FVGT_m_MULTI_ODD 40342 23.46 29.39 21.56 18 RCVD_IN_MSPIKE_H2 38098 27.36 27.76 27.23 19 XMSubLong 37119 23.36 27.04 22.19 20 XM_Body_Dirty_Words 31813 15.49 23.18 13.03 21 DKIM_VALID_EF 30494 27.11 22.22 28.68 22 DCC_CHECK_NEGATIVE 30253 48.55 22.04 57.03 23 T_TM2_M_HEADER_IN_MSG 28434 27.81 20.71 30.07 24 T_KAM_HTML_FONT_INVALID 27244 18.43 19.85 17.98 25 RELAYCOUNTRY_META 26736 8.55 19.48 5.05 26 XM_Multi_Part_URI 24735 13.50 18.02 12.06 27 MultiRelay 22948 18.78 16.72 19.45 28 HTML_IMAGE_RATIO_02 22036 10.09 16.05 8.18 29 BOTNET_IPINHOSTNAME 21258 7.27 15.49 4.64 30 BOTNET 20466 5.11 14.91 1.97 31 LOTS_OF_MONEY 19179 10.46 13.97 9.33 32 XM_Evil_Numbers_Gen 18389 10.16 13.40 9.13 33 UNTRUSTED_Relay 17496 4.11 12.75 1.34 34 FSL_BULK_SIG 14566 8.93 10.61 8.39 35 XMSexyCombo_05 14444 5.33 10.52 3.67 36 T_XMDrugObfuBody_14 13499 8.44 9.83 8.00 37 TooManyTo_001 13012 9.02 9.48 8.87 38 XMSubMetaSx_00 12713 5.49 9.26 4.29 39 LotsOfNums_01 12518 8.61 9.12 8.44 40 MPART_ALT_DIFF 11859 4.66 8.64 3.39 41 XM_UncommonTLD01 11313 5.23 8.24 4.26 42 HTML_IMAGE_RATIO_04 11075 6.74 8.07 6.31 43 BAYES_80 10938 5.02 7.97 4.07 44 XM_H_Long_From01 10000 6.83 7.29 6.68 45 MIME_QP_LONG_LINE 9740 6.82 7.10 6.73 46 XM_B_Phish_Phrases 9517 5.87 6.93 5.54 47 BAYES_60 8802 6.42 6.41 6.42 48 XM_DIRTYINTL 8269 3.58 6.02 2.79 49 XM_UB50 7209 1.96 5.25 0.90 50 HTML_IMAGE_RATIO_06 6959 3.62 5.07 3.16 51 SpammyFromTLD_02 6945 1.57 5.06 0.46 52 TM2_M_URI_OPT_OUT 6912 3.41 5.04 2.89 53 XM_B_SpammyTLD 6688 4.13 4.87 3.89 54 BAYES_95 6393 3.21 4.66 2.75 55 URI_HEX 6369 2.44 4.64 1.74 56 XMNumbers 6321 3.40 4.60 3.01 57 DKIM_INVALID 6293 4.21 4.58 4.10 58 MIME_HTML_MOSTLY 6085 2.87 4.43 2.36 59 MIME_HTML_ONLY_MULTI 5965 2.45 4.35 1.84 60 XMSexyCombo_01 5881 1.68 4.28 0.85 61 RELAYCOUNTRY_CA 5776 2.12 4.21 1.46 62 US_DOLLARS_3 5568 2.50 4.06 2.00 63 XM_SendGrid 5154 5.88 3.75 6.56 64 RELAYCOUNTRY_FR 5112 1.07 3.72 0.22 65 RCVD_IN_BL_SPAMCOP_NET 4949 1.36 3.61 0.64 66 XM_SPF_SoftFail 4743 2.31 3.46 1.94 67 XMStrtUSub 4726 3.84 3.44 3.97 68 T_REMOTE_IMAGE 4678 4.08 3.41 4.29 69 FROM_EXCESS_BASE64 4660 3.22 3.39 3.16 70 HTML_MIME_NO_HTML_TAG 4566 2.58 3.33 2.34 71 ALL_TRUSTED 4503 12.76 3.28 15.80 72 HTML_IMAGE_RATIO_08 4431 2.22 3.23 1.90 73 MultiRelay_Combo 4332 0.93 3.16 0.21 74 MultiRelay_CC 4332 0.93 3.16 0.21 75 XMBdyGiftCard01 4242 1.38 3.09 0.83 76 T_TooManySym_01 4231 5.14 3.08 5.79 77 XM_CamelCaseFrm001 4017 2.29 2.93 2.09 78 RCVD_IN_IADB_LISTED 3975 4.94 2.90 5.59 79 KHOP_HELO_FCRDNS 3972 2.40 2.89 2.24 80 XMDiploma_00 3911 1.98 2.85 1.70 81 DKIM_ADSP_NXDOMAIN 3809 1.01 2.77 0.44 82 XM_URI_RBL 3775 0.89 2.75 0.29 83 NO_DNS_FOR_FROM 3649 1.43 2.66 1.03 84 RCVD_IN_IADB_SPF 3592 4.32 2.62 4.87 85 RCVD_IN_PSBL 3562 0.65 2.59 0.03 86 T_XMDrugObfuBody_08 3507 1.81 2.55 1.57 87 XM_H_Long_From02 3493 1.39 2.54 1.02 88 XMSubMetaI_00 3471 0.97 2.53 0.47 89 XM_UB99 3454 0.62 2.52 0.02 90 RCVD_IN_IADB_SENDERID 3421 3.81 2.49 4.24 91 RCVD_IN_IADB_DK 3390 3.72 2.47 4.12 92 RCVD_IN_RP_SAFE 3331 8.42 2.43 10.34 93 TooManyTo_002 3082 2.52 2.25 2.61 94 TM2_M_VERY_LONG_WORD 3078 1.47 2.24 1.23 95 TR_XM_PHPDW 3053 0.98 2.22 0.58 96 RCVD_IN_RP_RNBL 3049 0.57 2.22 0.04 97 XMGenDplmaNmb 3028 1.38 2.21 1.11 98 XM_OfRef6 3006 1.75 2.19 1.61 99 TR_XM_PHPForged 2965 0.95 2.16 0.56 100 TR_XM_FormFill2 2949 0.94 2.15 0.55 101 XM_H_PHPOS 2933 0.93 2.14 0.55 102 BAYES_40 2918 3.62 2.13 4.10 103 SUBJ_ALL_CAPS 2832 2.08 2.06 2.09 104 TooManyTo_003 2733 1.88 1.99 1.84 105 SpammyFromTLD_01 2580 1.09 1.88 0.84 106 TR_Symld_Words 2536 1.80 1.85 1.78 107 TooManyTo_004 2471 1.50 1.80 1.40 108 T_XMDrugObfuBody_00 2390 1.17 1.74 0.99 109 XM_UB60 2301 0.47 1.68 0.09 110 XM_UB999 2296 0.42 1.67 0.02 111 RELAYCOUNTRY_IN 2268 0.47 1.65 0.09 112 RCVD_IN_RP_CERTIFIED 2265 7.34 1.65 9.17 113 TR_XM_DK_SendGrid 2201 2.80 1.60 3.18 114 TR_Mismatch_TLD_02 2193 0.43 1.60 0.06 115 TooManyTo_005 2183 1.27 1.59 1.17 116 XMStockSpam_06 2176 1.53 1.59 1.52 117 URIBL_DBL_ABUSE_REDIR 2164 0.40 1.58 0.02 118 BAYES_20 2157 2.79 1.57 3.18 119 XMBody_17 2042 0.72 1.49 0.47 120 TM2_M_A_HREF_HREF 2028 0.91 1.48 0.73 121 XMSubMetaSxObfu_03 2011 0.93 1.47 0.76 122 T_Symld_Words_02 1985 0.80 1.45 0.60 123 TR_XM_RelayPhish 1959 0.84 1.43 0.65 124 XMPhish11 1954 1.35 1.42 1.33 125 DIET_1 1944 0.54 1.42 0.26 126 URI_TRY_3LD 1939 1.78 1.41 1.90 127 MAILING_LIST_MULTI 1938 2.08 1.41 2.30 128 XM_DK_Undo_01 1879 1.61 1.37 1.69 129 NORDNS_LOW_CONTRAST 1847 0.33 1.35 0.01 130 XMSlimDrugH 1837 0.57 1.34 0.33 131 XM_H_PHPMailer 1785 0.70 1.30 0.51 132 NUMERIC_HTTP_ADDR 1776 0.64 1.29 0.43 133 HK_RANDOM_REPLYTO 1771 0.44 1.29 0.17 134 T_FILL_THIS_FORM_SHORT 1761 0.99 1.28 0.90 135 XMSexyCombo_04 1724 0.37 1.26 0.09 136 BODY_URI_ONLY 1706 0.36 1.24 0.08 137 XM_UB80 1682 0.32 1.23 0.03 138 XMBody_78 1670 0.67 1.22 0.49 139 XMPhish30 1636 0.68 1.19 0.52 140 XM_ProductURIs 1634 0.98 1.19 0.91 141 XMPhish14 1627 0.51 1.19 0.30 142 TR_LOTS_OF_MONEY3 1585 0.60 1.15 0.42 143 HTML_FONT_FACE_BAD 1571 0.84 1.14 0.74 144 RCVD_IN_IADB_VOUCHED 1543 3.11 1.12 3.75 145 BOTNET_NORDNS 1512 0.29 1.10 0.03 146 RELAYCOUNTRY_GB 1506 1.09 1.10 1.09 147 XMHTML_After_End 1502 0.56 1.09 0.39 148 TR_MetaPhish_Combo_01 1491 1.46 1.09 1.57 149 URIBL_BLACK 1457 0.30 1.06 0.06 150 RELAYCOUNTRY_AT 1443 0.36 1.05 0.14 151 DKIM_ADSP_CUSTOM_MED 1424 1.12 1.04 1.15 152 HTML_OFF_PAGE 1422 0.47 1.04 0.29 153 HTML_TAG_BALANCE_BODY 1416 0.62 1.03 0.48 154 FILL_THIS_FORM 1365 0.75 0.99 0.67 155 HTML_IMAGE_ONLY_12 1365 0.43 0.99 0.25 156 RDNS_DYNAMIC 1355 0.55 0.99 0.41 157 T_XMHurry_00 1347 0.66 0.98 0.56 158 DATE_IN_PAST_03_06 1346 0.31 0.98 0.09 159 XMHTMLBadTable_001 1329 0.67 0.97 0.57 160 XM_H_PHPOS_M 1324 0.37 0.96 0.18 161 UNPARSEABLE_RELAY 1320 2.35 0.96 2.79 162 XMBrknScrpt_02 1309 0.68 0.95 0.60 163 TR_LOTS_OF_MONEY2 1221 0.40 0.89 0.25 164 T_MONEY_PERCENT 1221 0.40 0.89 0.25 165 RELAYCOUNTRY_JP 1200 0.24 0.87 0.04 166 XMSubNoVowel 1198 0.49 0.87 0.37 167 FORGED_GMAIL_RCVD 1195 0.61 0.87 0.52 168 URI_WP_HACKED_2 1186 0.45 0.86 0.32 169 FROM_MISSP_REPLYTO 1171 0.21 0.85 0.01 170 NORMAL_HTTP_TO_IP 1153 0.24 0.84 0.04 171 SUBJ_DOLLARS 1151 0.48 0.84 0.37 172 T_FILL_THIS_FORM_FRAUD_PHISH 1144 0.23 0.83 0.04 173 TVD_PH_BODY_ACCOUNTS_PRE 1115 0.33 0.81 0.18 174 MIME_CHARSET_FARAWAY 1113 0.26 0.81 0.08 175 XM_B_COPY_HTML 1105 0.60 0.81 0.53 176 LongTLD 1101 0.30 0.80 0.13 177 RELAYCOUNTRY_DE 1097 0.45 0.80 0.34 178 REMOVE_BEFORE_LINK 1095 0.54 0.80 0.46 179 FILL_THIS_FORM_LOAN 1087 0.60 0.79 0.54 180 TR_XM_SEO3 1078 0.35 0.79 0.21 181 XM_HighProb1 1074 0.20 0.78 0.01 182 FROM_SUSPICIOUS_NTLD 1054 0.20 0.77 0.02 183 XM_H_Undi_Recip 1052 0.34 0.77 0.21 184 HTML_SHORT_LINK_IMG_1 1051 0.22 0.77 0.04 185 FORM_FRAUD_5 1036 0.18 0.75 0.00 186 MONEY_FORM 1036 0.20 0.75 0.03 187 PLING_QUERY 1032 0.60 0.75 0.55 188 FROM_SUSPICIOUS_NTLD_FP 1028 0.19 0.75 0.02 189 HTML_IMAGE_ONLY_28 1017 0.49 0.74 0.41 190 RCVD_IN_IADB_OPTIN 1006 1.99 0.73 2.40 191 MONEY_FRAUD_5 999 0.18 0.73 0.00 192 DATE_IN_PAST_06_12 984 0.22 0.72 0.06 193 ANY_BOUNCE_MESSAGE 983 1.57 0.72 1.84 194 BOUNCE_MESSAGE 981 1.57 0.71 1.84 195 BAYES_00 967 8.98 0.70 11.63 196 T_TooManySym_02 962 1.48 0.70 1.74 197 NML_ADSP_CUSTOM_MED 955 0.81 0.70 0.84 198 XM_iOS_Forged_Message 948 0.18 0.69 0.01 199 XM_UB95 944 0.18 0.69 0.01 200 LONG_HEX_URI 944 0.29 0.69 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 369930 88.24 94.42 86.26 2 DKIM_SIGNED 323198 77.08 82.44 75.36 3 XM_DK_Pass 317685 75.62 80.43 74.08 4 DKIM_VALID 305634 72.86 77.86 71.27 5 XM_B_Unicode 292563 70.81 78.90 68.22 6 DCC_CHECK_NEGATIVE 244589 48.55 22.04 57.03 7 BAYES_50 229045 48.81 34.45 53.41 8 DKIM_VALID_AU 221813 53.62 59.56 51.72 9 XMListUnsubscribeExists 214166 55.98 74.85 49.94 10 DCC_CHECK 175067 49.37 76.07 40.82 11 T_TM2_M_HEADER_IN_MSG 128981 27.81 20.71 30.07 12 HTML_FONT_LOW_CONTRAST 124360 31.53 39.46 29.00 13 DKIM_VALID_EF 122985 27.11 22.22 28.68 14 RCVD_IN_MSPIKE_H2 116798 27.36 27.76 27.23 15 LOC_TINY_FONT_1 101402 26.16 34.01 23.64 16 XMSubLong 95145 23.36 27.04 22.19 17 FVGT_m_MULTI_ODD 92464 23.46 29.39 21.56 18 MIME_HTML_ONLY 88147 22.90 30.23 20.55 19 MultiRelay 83395 18.78 16.72 19.45 20 T_KAM_HTML_FONT_INVALID 77117 18.43 19.85 17.98 21 ALL_TRUSTED 67761 12.76 3.28 15.80 22 XM_DK_Undo_02 59434 22.10 47.83 13.86 23 XM_Body_Dirty_Words 55881 15.49 23.18 13.03 24 XM_Multi_Part_URI 51702 13.50 18.02 12.06 25 BAYES_99 51569 19.11 41.24 12.02 26 BAYES_00 49874 8.98 0.70 11.63 27 BAYES_999 45640 16.28 33.88 10.64 28 RCVD_IN_RP_SAFE 44360 8.42 2.43 10.34 29 XM_DKIMWhitelistDomains 40943 7.25 0.07 9.55 30 LOTS_OF_MONEY 40024 10.46 13.97 9.33 31 TR_XM_DK_Bayes 39616 7.07 0.32 9.24 32 RCVD_IN_RP_CERTIFIED 39317 7.34 1.65 9.17 33 XM_Evil_Numbers_Gen 39141 10.16 13.40 9.13 34 TR_XM_DK_Bayes1 38370 6.85 0.28 8.95 35 TooManyTo_001 38042 9.02 9.48 8.87 36 LotsOfNums_01 36214 8.61 9.12 8.44 37 FSL_BULK_SIG 35967 8.93 10.61 8.39 38 HTML_IMAGE_RATIO_02 35078 10.09 16.05 8.18 39 T_XMDrugObfuBody_14 34304 8.44 9.83 8.00 40 TR_XM_DK_Bayes2 31885 5.69 0.23 7.43 41 MIME_QP_LONG_LINE 28875 6.82 7.10 6.73 42 XM_H_Long_From01 28649 6.83 7.29 6.68 43 XM_SendGrid 28151 5.88 3.75 6.56 44 BAYES_60 27534 6.42 6.41 6.42 45 HTML_IMAGE_RATIO_04 27055 6.74 8.07 6.31 46 TR_DCC_Bayes_99 25243 12.29 32.28 5.89 47 T_TooManySym_01 24840 5.14 3.08 5.79 48 RCVD_IN_IADB_LISTED 23972 4.94 2.90 5.59 49 XM_B_Phish_Phrases 23738 5.87 6.93 5.54 50 RELAYCOUNTRY_META 21676 8.55 19.48 5.05 51 XM_PDF 21106 3.89 0.66 4.92 52 RCVD_IN_IADB_SPF 20877 4.32 2.62 4.87 53 TO_MALFORMED 20282 3.59 0.03 4.73 54 BOTNET_IPINHOSTNAME 19919 7.27 15.49 4.64 55 T_REMOTE_IMAGE 18410 4.08 3.41 4.29 56 XMSubMetaSx_00 18390 5.49 9.26 4.29 57 XM_UncommonTLD01 18289 5.23 8.24 4.26 58 RCVD_IN_IADB_SENDERID 18173 3.81 2.49 4.24 59 IN_ZIMBRA_NJ_WHITELIST 17916 3.17 0.03 4.18 60 RCVD_IN_IADB_DK 17653 3.72 2.47 4.12 61 BAYES_40 17577 3.62 2.13 4.10 62 DKIM_INVALID 17564 4.21 4.58 4.10 63 BAYES_80 17454 5.02 7.97 4.07 64 XMStrtUSub 17020 3.84 3.44 3.97 65 XM_B_SpammyTLD 16676 4.13 4.87 3.89 66 RCVD_IN_IADB_VOUCHED 16076 3.11 1.12 3.75 67 XMSexyCombo_05 15726 5.33 10.52 3.67 68 MPART_ALT_DIFF 14540 4.66 8.64 3.39 69 TR_XM_DK_SendGrid 13650 2.80 1.60 3.18 70 BAYES_20 13631 2.79 1.57 3.18 71 FROM_EXCESS_BASE64 13549 3.22 3.39 3.16 72 HTML_IMAGE_RATIO_06 13534 3.62 5.07 3.16 73 XMNumbers 12916 3.40 4.60 3.01 74 TM2_M_URI_OPT_OUT 12399 3.41 5.04 2.89 75 UNPARSEABLE_RELAY 11979 2.35 0.96 2.79 76 XM_DIRTYINTL 11972 3.58 6.02 2.79 77 BAYES_95 11783 3.21 4.66 2.75 78 TooManyTo_002 11198 2.52 2.25 2.61 79 INVALID_MSGID 10839 1.93 0.08 2.53 80 TVD_RCVD_IP 10437 1.95 0.43 2.43 81 RCVD_IN_IADB_OPTIN 10282 1.99 0.73 2.40 82 MIME_HTML_MOSTLY 10138 2.87 4.43 2.36 83 HTML_MIME_NO_HTML_TAG 10047 2.58 3.33 2.34 84 MAILING_LIST_MULTI 9848 2.08 1.41 2.30 85 KHOP_HELO_FCRDNS 9605 2.40 2.89 2.24 86 SUBJ_ALL_CAPS 8964 2.08 2.06 2.09 87 XM_CamelCaseFrm001 8963 2.29 2.93 2.09 88 BAYES_05 8896 1.73 0.65 2.07 89 US_DOLLARS_3 8569 2.50 4.06 2.00 90 BOTNET 8436 5.11 14.91 1.97 91 XM_SPF_SoftFail 8336 2.31 3.46 1.94 92 HTML_IMAGE_RATIO_08 8146 2.22 3.23 1.90 93 URI_TRY_3LD 8135 1.78 1.41 1.90 94 IN_HORDE_ADDRESS_BOOK 7956 1.42 0.05 1.86 95 ANY_BOUNCE_MESSAGE 7910 1.57 0.72 1.84 96 BOUNCE_MESSAGE 7905 1.57 0.71 1.84 97 MIME_HTML_ONLY_MULTI 7901 2.45 4.35 1.84 98 TooManyTo_003 7894 1.88 1.99 1.84 99 TR_Symld_Words 7635 1.80 1.85 1.78 100 HELO_NODOT 7519 1.46 0.54 1.75 101 HELO_NO_DOMAIN 7518 1.46 0.53 1.75 102 URI_HEX 7451 2.44 4.64 1.74 103 T_TooManySym_02 7444 1.48 0.70 1.74 104 XMDiploma_00 7301 1.98 2.85 1.70 105 XM_DK_Undo_01 7256 1.61 1.37 1.69 106 XM_OfRef6 6885 1.75 2.19 1.61 107 TR_MetaPhish_Combo_01 6747 1.46 1.09 1.57 108 T_XMDrugObfuBody_08 6717 1.81 2.55 1.57 109 XMStockSpam_06 6508 1.53 1.59 1.52 110 USER_IN_DEF_DKIM_WL 6258 1.11 0.02 1.46 111 RELAYCOUNTRY_CA 6243 2.12 4.21 1.46 112 TooManyTo_004 6020 1.50 1.80 1.40 113 RCVD_IN_MSPIKE_WL 5828 1.07 0.16 1.36 114 RCVD_IN_MSPIKE_H3 5828 1.07 0.16 1.36 115 XMCapTrack 5806 1.12 0.39 1.35 116 UNTRUSTED_Relay 5754 4.11 12.75 1.34 117 XMPhish11 5690 1.35 1.42 1.33 118 TM2_M_VERY_LONG_WORD 5270 1.47 2.24 1.23 119 XM_GoogleGroups 5070 1.02 0.52 1.18 120 TooManyTo_005 5002 1.27 1.59 1.17 121 DKIM_ADSP_CUSTOM_MED 4942 1.12 1.04 1.15 122 XMGenDplmaNmb 4773 1.38 2.21 1.11 123 RELAYCOUNTRY_GB 4681 1.09 1.10 1.09 124 CK_HELO_DYNAMIC_SPLIT_IP 4659 0.88 0.25 1.09 125 HELO_DYNAMIC_IPADDR2 4658 0.85 0.11 1.09 126 NO_DNS_FOR_FROM 4422 1.43 2.66 1.03 127 XM_H_Long_From02 4371 1.39 2.54 1.02 128 T_XMDrugObfuBody_00 4237 1.17 1.74 0.99 129 XM_ProductURIs 3886 0.98 1.19 0.91 130 T_FILL_THIS_FORM_SHORT 3870 0.99 1.28 0.90 131 XM_UB50 3859 1.96 5.25 0.90 132 XMSexyCombo_01 3645 1.68 4.28 0.85 133 NML_ADSP_CUSTOM_MED 3607 0.81 0.70 0.84 134 SpammyFromTLD_01 3592 1.09 1.88 0.84 135 XMBdyGiftCard01 3555 1.38 3.09 0.83 136 XMSubMetaSxObfu_03 3243 0.93 1.47 0.76 137 HTML_FONT_FACE_BAD 3164 0.84 1.14 0.74 138 TM2_M_A_HREF_HREF 3151 0.91 1.48 0.73 139 T_OBFU_PDF_ATTACH 3082 0.59 0.20 0.72 140 XM_RXBody 2974 0.63 0.44 0.69 141 FILL_THIS_FORM 2884 0.75 0.99 0.67 142 XMGappySubj_01 2854 0.59 0.34 0.67 143 TR_XM_RelayPhish 2808 0.84 1.43 0.65 144 XM_ShortIntro_01 2788 0.59 0.38 0.65 145 RCVD_IN_BL_SPAMCOP_NET 2735 1.36 3.61 0.64 146 USER_IN_WHITELIST 2687 0.47 0.00 0.63 147 T_TooManySym_03 2601 0.51 0.20 0.61 148 XMBrknScrpt_02 2563 0.68 0.95 0.60 149 FROM_GOV_SPOOF 2559 0.54 0.38 0.60 150 T_Symld_Words_02 2555 0.80 1.45 0.60 151 TR_XM_PHPDW 2507 0.98 2.22 0.58 152 XMHTMLBadTable_001 2461 0.67 0.97 0.57 153 TR_XM_PHPForged 2406 0.95 2.16 0.56 154 T_XMHurry_00 2394 0.66 0.98 0.56 155 MISSING_HEADERS 2384 0.58 0.66 0.56 156 TR_XM_FormFill2 2378 0.94 2.15 0.55 157 HTTPS_HTTP_MISMATCH 2370 0.56 0.57 0.55 158 XM_H_PHPOS 2360 0.93 2.14 0.55 159 PLING_QUERY 2358 0.60 0.75 0.55 160 XM_D_tchamptons_WL 2352 0.42 0.00 0.55 161 FILL_THIS_FORM_LONG 2346 0.50 0.33 0.55 162 XMSubMetaSxObfu_02 2329 0.50 0.37 0.54 163 FILL_THIS_FORM_LOAN 2318 0.60 0.79 0.54 164 TM2_M_BODY_EMPTY 2315 0.45 0.15 0.54 165 RELAYCOUNTRY_AU 2296 0.55 0.61 0.54 166 XM_B_COPY_HTML 2284 0.60 0.81 0.53 167 XM_B_REG_HTML 2284 0.56 0.64 0.53 168 FORGED_GMAIL_RCVD 2239 0.61 0.87 0.52 169 XMPhish30 2215 0.68 1.19 0.52 170 XMBody_95 2207 0.42 0.12 0.51 171 XM_H_PHPMailer 2186 0.70 1.30 0.51 172 XMBody_78 2108 0.67 1.22 0.49 173 SHORT_HELO_AND_INLINE_IMAGE 2099 0.38 0.04 0.49 174 XMNoVowels 2083 0.50 0.54 0.49 175 HTML_TAG_BALANCE_BODY 2068 0.62 1.03 0.48 176 XMMoneyMeta_00 2033 0.52 0.68 0.47 177 XMBody_17 2019 0.72 1.49 0.47 178 XMSubMetaI_00 2006 0.97 2.53 0.47 179 REMOVE_BEFORE_LINK 1972 0.54 0.80 0.46 180 SpammyFromTLD_02 1962 1.57 5.06 0.46 181 XM_Body_Obfu01 1945 0.44 0.41 0.45 182 HTML_IMAGE_ONLY_32 1936 0.43 0.36 0.45 183 DKIM_ADSP_NXDOMAIN 1903 1.01 2.77 0.44 184 XMLngstWrd_00 1854 0.48 0.65 0.43 185 NUMERIC_HTTP_ADDR 1844 0.64 1.29 0.43 186 TR_LOTS_OF_MONEY3 1785 0.60 1.15 0.42 187 XMSolicitRefs_0 1762 0.39 0.32 0.41 188 RDNS_DYNAMIC 1758 0.55 0.99 0.41 189 HTML_IMAGE_ONLY_28 1738 0.49 0.74 0.41 190 RCVD_IN_SORBS_DUL 1719 0.35 0.18 0.40 191 AC_DIV_BONANZA 1699 0.37 0.31 0.40 192 XMRcvdHeader_15 1697 0.30 0.00 0.40 193 HTML_IMAGE_ONLY_24 1673 0.37 0.30 0.39 194 XMLngstWrd_01 1673 0.45 0.63 0.39 195 URI_NOVOWEL 1667 0.43 0.55 0.39 196 XMHTML_After_End 1661 0.56 1.09 0.39 197 FROM_GOV_DKIM_AU 1611 0.32 0.13 0.38 198 XMDateMe_00 1600 0.36 0.33 0.37 199 SUBJ_DOLLARS 1576 0.48 0.84 0.37 200 XMSubNoVowel 1568 0.49 0.87 0.37 ----------------------------------------------------------------------