Email: 595561 Autolearn: 0 AvgScore: 2.50 AvgScanTime: 2.34 sec Spam: 140095 Autolearn: 0 AvgScore: 12.15 AvgScanTime: 2.80 sec Ham: 455466 Autolearn: 0 AvgScore: -0.47 AvgScanTime: 2.20 sec Time Spent Running SA: 387.18 hours Time Spent Processing Spam: 108.98 hours Time Spent Processing Ham: 278.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132740 88.86 94.75 87.04 2 DKIM_SIGNED 114503 76.35 81.73 74.69 3 XM_DK_Pass 111432 74.76 79.54 73.29 4 DCC_CHECK 110340 49.04 78.76 39.90 5 DKIM_VALID 108080 72.09 77.15 70.53 6 XM_B_Unicode 107051 70.43 76.41 68.59 7 XMListUnsubscribeExists 103834 55.14 74.12 49.30 8 DKIM_VALID_AU 82265 54.19 58.72 52.79 9 XM_DK_Undo_02 66559 20.76 47.51 12.53 10 BAYES_99 57560 17.71 41.09 10.52 11 BAYES_50 49504 48.86 35.34 53.02 12 HTML_FONT_LOW_CONTRAST 48489 29.16 34.61 27.48 13 LOC_TINY_FONT_1 48018 25.91 34.28 23.33 14 MIME_HTML_ONLY 47317 23.73 33.77 20.64 15 BAYES_999 47095 14.88 33.62 9.12 16 TR_DCC_Bayes_99 45323 11.31 32.35 4.84 17 FVGT_m_MULTI_ODD 38021 22.60 27.14 21.21 18 XMSubLong 36548 23.16 26.09 22.26 19 XM_Body_Dirty_Words 33663 15.52 24.03 12.90 20 DKIM_VALID_EF 31682 26.69 22.61 27.94 21 T_KAM_HTML_FONT_INVALID 30694 18.19 21.91 17.04 22 RELAYCOUNTRY_META 27826 9.05 19.86 5.72 23 DCC_CHECK_NEGATIVE 27317 48.93 19.50 57.99 24 T_TM2_M_HEADER_IN_MSG 25830 28.14 18.44 31.12 25 XM_Multi_Part_URI 25429 13.13 18.15 11.59 26 MultiRelay 22975 18.77 16.40 19.50 27 BOTNET 20509 5.06 14.64 2.11 28 BOTNET_IPINHOSTNAME 19615 6.85 14.00 4.65 29 XM_Evil_Numbers_Gen 19361 10.19 13.82 9.07 30 UNTRUSTED_Relay 19335 4.57 13.80 1.73 31 HTML_IMAGE_RATIO_02 18991 9.11 13.56 7.74 32 XMSexyCombo_05 18109 6.20 12.93 4.13 33 LOTS_OF_MONEY 16780 9.77 11.98 9.09 34 FSL_BULK_SIG 16778 9.03 11.98 8.13 35 MPART_ALT_DIFF 12787 4.76 9.13 3.42 36 LotsOfNums_01 12484 8.30 8.91 8.11 37 T_XMDrugObfuBody_14 11984 8.92 8.55 9.03 38 XMSubMetaSx_00 11735 4.98 8.38 3.94 39 HTML_IMAGE_RATIO_04 11191 5.99 7.99 5.37 40 XM_UncommonTLD01 10667 5.05 7.61 4.27 41 XM_B_Unicode3 10665 6.55 7.61 6.22 42 BAYES_80 10310 4.63 7.36 3.79 43 TooManyTo_001 10023 8.30 7.15 8.65 44 XM_DIRTYINTL 9989 3.72 7.13 2.68 45 RCVD_IN_MSPIKE_H2 9821 7.58 7.01 7.75 46 XM_B_Phish_Phrases 9743 5.88 6.95 5.55 47 XM_H_Long_From01 9646 6.34 6.89 6.18 48 XM_UB50 9061 2.41 6.47 1.17 49 T_REMOTE_IMAGE 8718 4.66 6.22 4.18 50 BAYES_60 8514 6.17 6.08 6.19 51 MIME_QP_LONG_LINE 8021 6.13 5.73 6.26 52 MIME_HTML_ONLY_MULTI 7815 2.81 5.58 1.95 53 SpammyFromTLD_02 7744 1.57 5.53 0.36 54 HTML_IMAGE_RATIO_06 6503 3.67 4.64 3.37 55 XM_B_SpammyTLD 6477 3.79 4.62 3.53 56 MIME_HTML_MOSTLY 6437 2.72 4.59 2.15 57 DKIM_INVALID 6423 4.26 4.58 4.16 58 BAYES_95 6068 3.01 4.33 2.61 59 RCVD_IN_BL_SPAMCOP_NET 5695 1.51 4.07 0.72 60 XMNumbers 5577 3.10 3.98 2.83 61 BODY_URI_ONLY 5464 0.97 3.90 0.07 62 XMStrtUSub 5418 4.07 3.87 4.13 63 XM_SPF_SoftFail 5376 2.61 3.84 2.23 64 XM_SendGrid 5363 5.55 3.83 6.09 65 RELAYCOUNTRY_CA 5353 2.05 3.82 1.51 66 TM2_M_URI_OPT_OUT 5090 2.36 3.63 1.97 67 HTML_SHORT_LINK_IMG_1 4960 0.86 3.54 0.04 68 URI_HEX 4717 2.25 3.37 1.91 69 XM_URI_RBL 4624 0.96 3.30 0.24 70 T_XMDrugObfuBody_08 4587 2.27 3.27 1.96 71 FROM_EXCESS_BASE64 4513 3.18 3.22 3.17 72 HTML_IMAGE_RATIO_08 4438 2.33 3.17 2.08 73 T_TooManySym_01 4285 5.03 3.06 5.64 74 XM_OfRef6 4258 2.00 3.04 1.68 75 KHOP_HELO_FCRDNS 4185 2.53 2.99 2.39 76 XMSexyCombo_01 4100 1.15 2.93 0.60 77 US_DOLLARS_3 4082 1.64 2.91 1.25 78 HTML_MIME_NO_HTML_TAG 3903 2.78 2.79 2.77 79 RCVD_IN_RP_SAFE 3900 8.38 2.78 10.10 80 XMDiploma_00 3894 1.97 2.78 1.72 81 XMBdyGiftCard01 3883 1.21 2.77 0.73 82 NO_DNS_FOR_FROM 3801 1.43 2.71 1.04 83 RELAYCOUNTRY_FR 3782 0.85 2.70 0.28 84 MultiRelay_Combo 3780 0.82 2.70 0.24 85 MultiRelay_CC 3780 0.82 2.70 0.24 86 XM_CamelCaseFrm001 3765 2.24 2.69 2.10 87 RCVD_IN_IADB_LISTED 3712 4.55 2.65 5.14 88 SUBJ_ALL_CAPS 3605 1.97 2.57 1.78 89 TR_XM_PHPDW 3558 1.37 2.54 1.02 90 XM_BadFromFormat 3541 0.69 2.53 0.12 91 TR_XM_PHPForged 3532 1.35 2.52 1.00 92 RCVD_IN_RP_RNBL 3513 0.62 2.51 0.03 93 TR_XM_FormFill2 3485 1.34 2.49 0.99 94 XM_H_PHPOS 3470 1.34 2.48 0.99 95 XM_UB99 3404 0.58 2.43 0.01 96 RCVD_IN_IADB_SPF 3394 3.99 2.42 4.48 97 ALL_TRUSTED 3319 12.84 2.37 16.06 98 RCVD_IN_IADB_SENDERID 3279 3.54 2.34 3.91 99 RCVD_IN_IADB_DK 3274 3.51 2.34 3.87 100 HTML_IMAGE_ONLY_08 3226 0.64 2.30 0.13 101 RELAYCOUNTRY_NL 3166 0.66 2.26 0.16 102 TR_XM_DK_SendGrid 2915 2.99 2.08 3.27 103 BAYES_40 2894 3.95 2.07 4.53 104 HDRS_LCASE_IMGONLY 2853 0.53 2.04 0.07 105 NUMERIC_HTTP_ADDR 2844 0.82 2.03 0.45 106 TM2_M_VERY_LONG_WORD 2764 1.24 1.97 1.02 107 RCVD_IN_RP_CERTIFIED 2750 7.42 1.96 9.10 108 T_FILL_THIS_FORM_SHORT 2705 1.20 1.93 0.97 109 DKIM_ADSP_NXDOMAIN 2547 0.80 1.82 0.49 110 SpammyFromTLD_01 2529 1.13 1.81 0.93 111 XMGenDplmaNmb 2524 1.26 1.80 1.09 112 XM_UB999 2510 0.43 1.79 0.01 113 XMStockSpam_06 2494 1.39 1.78 1.27 114 BAYES_20 2432 3.07 1.74 3.48 115 RELAYCOUNTRY_IN 2413 0.51 1.72 0.14 116 TR_Symld_Words 2408 1.65 1.72 1.63 117 NORMAL_HTTP_TO_IP 2401 0.45 1.71 0.06 118 TR_XM_RelayPhish 2370 0.96 1.69 0.74 119 XM_UB60 2346 0.45 1.67 0.08 120 XMBody_17 2332 0.70 1.66 0.40 121 DIET_1 2286 0.63 1.63 0.32 122 HTML_IMAGE_ONLY_12 2242 0.55 1.60 0.22 123 MAILING_LIST_MULTI 2213 2.41 1.58 2.67 124 XMSubMetaI_00 2209 0.85 1.58 0.63 125 DATE_IN_PAST_03_06 2200 0.62 1.57 0.32 126 BOTNET_NORDNS 2165 0.42 1.55 0.08 127 XMHTML_After_End 2154 0.61 1.54 0.33 128 URI_TRY_3LD 2145 1.34 1.53 1.27 129 SUBJ_DOLLARS 2120 0.57 1.51 0.29 130 URI_HEX_IP 2117 0.36 1.51 0.00 131 RCVD_IN_MSPIKE_WL 2096 3.91 1.50 4.65 132 XMPhish11 2056 1.42 1.47 1.40 133 XMSlimDrugH 2027 0.73 1.45 0.52 134 XM_H_Long_From02 2007 1.01 1.43 0.88 135 RCVD_IN_PSBL 1909 0.34 1.36 0.03 136 XM_H_PHPMailer 1876 1.05 1.34 0.96 137 T_Symld_Words_02 1873 1.15 1.34 1.09 138 XMBody_78 1824 0.76 1.30 0.59 139 T_XMDrugObfuBody_00 1802 1.03 1.29 0.96 140 XM_DK_Undo_01 1786 1.63 1.27 1.74 141 XMSexyCombo_04 1725 0.37 1.23 0.10 142 DKIM_ADSP_CUSTOM_MED 1679 1.09 1.20 1.06 143 XMFunnyHTTP 1639 0.28 1.17 0.01 144 XM_ProductURIs 1633 0.76 1.17 0.63 145 RELAYCOUNTRY_GB 1629 1.28 1.16 1.31 146 URIBL_BLACK 1625 0.32 1.16 0.06 147 UNPARSEABLE_RELAY 1623 2.19 1.16 2.51 148 XM_H_PHPOS_M 1596 0.73 1.14 0.60 149 DATE_IN_PAST_06_12 1596 0.35 1.14 0.11 150 T_XMHurry_00 1581 0.76 1.13 0.64 151 XMPhish30 1579 0.66 1.13 0.52 152 XM_UB80 1577 0.28 1.13 0.02 153 FSL_THIS_IS_ADV 1559 0.48 1.11 0.28 154 TR_LOTS_OF_MONEY3 1479 0.62 1.06 0.48 155 LOADSA_MONEY_COMBO 1454 0.29 1.04 0.07 156 TooManyTo_002 1454 1.99 1.04 2.29 157 FORGED_GMAIL_RCVD 1451 0.63 1.04 0.51 158 RCVD_IN_MSPIKE_H3 1447 3.72 1.03 4.55 159 RELAYCOUNTRY_DE 1418 0.87 1.01 0.82 160 XM_B_REG_HTML 1360 0.61 0.97 0.50 161 RDNS_DYNAMIC 1354 0.53 0.97 0.40 162 XMBrknScrpt_02 1330 0.71 0.95 0.63 163 RCVD_IN_IADB_VOUCHED 1315 2.78 0.94 3.35 164 HTML_TAG_BALANCE_BODY 1313 0.61 0.94 0.51 165 BAYES_00 1286 10.41 0.92 13.33 166 TR_LOTS_OF_MONEY2 1264 0.60 0.90 0.50 167 T_MONEY_PERCENT 1264 0.60 0.90 0.50 168 RELAYCOUNTRY_AT 1240 0.36 0.89 0.20 169 BAYES_05 1236 1.88 0.88 2.19 170 TooManyTo_003 1231 1.34 0.88 1.48 171 XMMoneyMeta_00 1227 0.62 0.88 0.54 172 NML_ADSP_CUSTOM_MED 1206 0.78 0.86 0.75 173 XM_HighProb1 1199 0.21 0.86 0.01 174 URIBL_DBL_ABUSE_REDIR 1183 0.20 0.84 0.01 175 T_TooManySym_02 1176 1.70 0.84 1.97 176 DEAR_SOMETHING 1163 0.28 0.83 0.11 177 LONG_HEX_URI 1150 0.30 0.82 0.14 178 FROM_SUSPICIOUS_NTLD 1146 0.20 0.82 0.02 179 HTML_FONT_FACE_BAD 1131 0.60 0.81 0.54 180 TooManyTo_004 1109 1.03 0.79 1.10 181 XMSubMetaSxObfu_03 1101 0.51 0.79 0.43 182 RELAYCOUNTRY_VN 1101 0.19 0.79 0.01 183 FORM_FRAUD_5 1090 0.19 0.78 0.01 184 XMGppyBdWords 1090 0.36 0.78 0.24 185 XM_RXBody 1066 0.69 0.76 0.67 186 XMSubMetaSSx_00 1063 0.36 0.76 0.23 187 XM_XX_Yahoo 1063 0.31 0.76 0.17 188 URI_NOVOWEL 1058 0.50 0.76 0.42 189 TR_Mismatch_TLD_02 1041 0.23 0.74 0.08 190 XM_PDF 1039 4.10 0.74 5.13 191 XM_Nigeria_01 1034 0.21 0.74 0.04 192 FROM_SUSPICIOUS_NTLD_FP 1023 0.18 0.73 0.01 193 XMHTMLBadTable_001 1022 0.45 0.73 0.36 194 TR_Mismatch_TLD_01 1018 0.30 0.73 0.17 195 MONEY_FORM_SHORT 1006 0.17 0.72 0.01 196 BODY_ENHANCEMENT 992 0.22 0.71 0.07 197 MONEY_FRAUD_5 987 0.17 0.70 0.01 198 XM_OfRef7 984 0.35 0.70 0.24 199 URIBL_DBL_SPAM 978 0.17 0.70 0.01 200 TooManyTo_005 959 0.87 0.68 0.92 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 396450 88.86 94.75 87.04 2 DKIM_SIGNED 340198 76.35 81.73 74.69 3 XM_DK_Pass 333800 74.76 79.54 73.29 4 DKIM_VALID 321255 72.09 77.15 70.53 5 XM_B_Unicode 312417 70.43 76.41 68.59 6 DCC_CHECK_NEGATIVE 264113 48.93 19.50 57.99 7 BAYES_50 241469 48.86 35.34 53.02 8 DKIM_VALID_AU 240461 54.19 58.72 52.79 9 XMListUnsubscribeExists 224551 55.14 74.12 49.30 10 DCC_CHECK 181750 49.04 78.76 39.90 11 T_TM2_M_HEADER_IN_MSG 141750 28.14 18.44 31.12 12 DKIM_VALID_EF 127256 26.69 22.61 27.94 13 HTML_FONT_LOW_CONTRAST 125178 29.16 34.61 27.48 14 LOC_TINY_FONT_1 106276 25.91 34.28 23.33 15 XMSubLong 101390 23.16 26.09 22.26 16 FVGT_m_MULTI_ODD 96594 22.60 27.14 21.21 17 MIME_HTML_ONLY 93986 23.73 33.77 20.64 18 MultiRelay 88828 18.77 16.40 19.50 19 T_KAM_HTML_FONT_INVALID 77614 18.19 21.91 17.04 20 ALL_TRUSTED 73161 12.84 2.37 16.06 21 BAYES_00 60718 10.41 0.92 13.33 22 XM_Body_Dirty_Words 58752 15.52 24.03 12.90 23 XM_DK_Undo_02 57056 20.76 47.51 12.53 24 XM_Multi_Part_URI 52776 13.13 18.15 11.59 25 BAYES_99 47908 17.71 41.09 10.52 26 TR_XM_DK_Bayes 47388 8.06 0.45 10.40 27 RCVD_IN_RP_SAFE 46003 8.38 2.78 10.10 28 TR_XM_DK_Bayes1 45450 7.73 0.40 9.98 29 BAYES_999 41526 14.88 33.62 9.12 30 RCVD_IN_RP_CERTIFIED 41442 7.42 1.96 9.10 31 LOTS_OF_MONEY 41398 9.77 11.98 9.09 32 XM_Evil_Numbers_Gen 41308 10.19 13.82 9.07 33 T_XMDrugObfuBody_14 41151 8.92 8.55 9.03 34 TooManyTo_001 39397 8.30 7.15 8.65 35 TR_XM_DK_Bayes2 38619 6.56 0.33 8.48 36 FSL_BULK_SIG 37027 9.03 11.98 8.13 37 LotsOfNums_01 36926 8.30 8.91 8.11 38 XM_DKIMWhitelistDomains 35418 6.02 0.30 7.78 39 RCVD_IN_MSPIKE_H2 35303 7.58 7.01 7.75 40 HTML_IMAGE_RATIO_02 35250 9.11 13.56 7.74 41 MIME_QP_LONG_LINE 28503 6.13 5.73 6.26 42 XM_B_Unicode3 28347 6.55 7.61 6.22 43 BAYES_60 28207 6.17 6.08 6.19 44 XM_H_Long_From01 28142 6.34 6.89 6.18 45 XM_SendGrid 27716 5.55 3.83 6.09 46 RELAYCOUNTRY_META 26064 9.05 19.86 5.72 47 T_TooManySym_01 25668 5.03 3.06 5.64 48 XM_B_Phish_Phrases 25271 5.88 6.95 5.55 49 HTML_IMAGE_RATIO_04 24455 5.99 7.99 5.37 50 RCVD_IN_IADB_LISTED 23412 4.55 2.65 5.14 51 XM_PDF 23354 4.10 0.74 5.13 52 TR_DCC_Bayes_99 22055 11.31 32.35 4.84 53 RCVD_IN_MSPIKE_WL 21182 3.91 1.50 4.65 54 BOTNET_IPINHOSTNAME 21157 6.85 14.00 4.65 55 RCVD_IN_MSPIKE_H3 20719 3.72 1.03 4.55 56 BAYES_40 20640 3.95 2.07 4.53 57 RCVD_IN_IADB_SPF 20395 3.99 2.42 4.48 58 XM_UncommonTLD01 19438 5.05 7.61 4.27 59 T_REMOTE_IMAGE 19043 4.66 6.22 4.18 60 DKIM_INVALID 18943 4.26 4.58 4.16 61 XMStrtUSub 18795 4.07 3.87 4.13 62 XMSexyCombo_05 18794 6.20 12.93 4.13 63 IN_ZIMBRA_NJ_WHITELIST 18485 3.11 0.02 4.06 64 XMSubMetaSx_00 17927 4.98 8.38 3.94 65 RCVD_IN_IADB_SENDERID 17801 3.54 2.34 3.91 66 RCVD_IN_IADB_DK 17609 3.51 2.34 3.87 67 BAYES_80 17249 4.63 7.36 3.79 68 TO_MALFORMED 17027 2.86 0.00 3.74 69 XM_B_SpammyTLD 16091 3.79 4.62 3.53 70 BAYES_20 15836 3.07 1.74 3.48 71 MPART_ALT_DIFF 15572 4.76 9.13 3.42 72 HTML_IMAGE_RATIO_06 15331 3.67 4.64 3.37 73 RCVD_IN_IADB_VOUCHED 15268 2.78 0.94 3.35 74 TR_XM_DK_SendGrid 14894 2.99 2.08 3.27 75 FROM_EXCESS_BASE64 14438 3.18 3.22 3.17 76 XMNumbers 12868 3.10 3.98 2.83 77 HTML_MIME_NO_HTML_TAG 12625 2.78 2.79 2.77 78 XM_DIRTYINTL 12186 3.72 7.13 2.68 79 MAILING_LIST_MULTI 12151 2.41 1.58 2.67 80 BAYES_95 11865 3.01 4.33 2.61 81 UNPARSEABLE_RELAY 11444 2.19 1.16 2.51 82 TVD_RCVD_IP 11232 2.03 0.63 2.47 83 INVALID_MSGID 10978 1.90 0.25 2.41 84 KHOP_HELO_FCRDNS 10881 2.53 2.99 2.39 85 TooManyTo_002 10427 1.99 1.04 2.29 86 XM_SPF_SoftFail 10151 2.61 3.84 2.23 87 BAYES_05 9974 1.88 0.88 2.19 88 MIME_HTML_MOSTLY 9778 2.72 4.59 2.15 89 BOTNET 9611 5.06 14.64 2.11 90 XM_CamelCaseFrm001 9578 2.24 2.69 2.10 91 HTML_IMAGE_RATIO_08 9460 2.33 3.17 2.08 92 RCVD_IN_IADB_OPTIN 9396 1.70 0.53 2.06 93 ANY_BOUNCE_MESSAGE 9058 1.62 0.42 1.99 94 BOUNCE_MESSAGE 9057 1.62 0.41 1.99 95 T_TooManySym_02 8978 1.70 0.84 1.97 96 TM2_M_URI_OPT_OUT 8950 2.36 3.63 1.97 97 T_XMDrugObfuBody_08 8948 2.27 3.27 1.96 98 MIME_HTML_ONLY_MULTI 8893 2.81 5.58 1.95 99 URI_HEX 8693 2.25 3.37 1.91 100 HELO_NODOT 8692 1.61 0.66 1.91 101 HELO_NO_DOMAIN 8691 1.61 0.65 1.91 102 TR_MetaPhish_Combo_01 8615 1.60 0.64 1.89 103 CK_HELO_DYNAMIC_SPLIT_IP 8226 1.46 0.35 1.81 104 HELO_DYNAMIC_IPADDR2 8223 1.43 0.20 1.81 105 SUBJ_ALL_CAPS 8120 1.97 2.57 1.78 106 IN_HORDE_ADDRESS_BOOK 8088 1.37 0.05 1.78 107 XM_DK_Undo_01 7943 1.63 1.27 1.74 108 UNTRUSTED_Relay 7868 4.57 13.80 1.73 109 XMDiploma_00 7818 1.97 2.78 1.72 110 XM_OfRef6 7639 2.00 3.04 1.68 111 TR_Symld_Words 7424 1.65 1.72 1.63 112 XMCapTrack 7154 1.28 0.34 1.57 113 RELAYCOUNTRY_CA 6862 2.05 3.82 1.51 114 TooManyTo_003 6748 1.34 0.88 1.48 115 XMPhish11 6398 1.42 1.47 1.40 116 RELAYCOUNTRY_GB 5965 1.28 1.16 1.31 117 URI_TRY_3LD 5806 1.34 1.53 1.27 118 XMStockSpam_06 5778 1.39 1.78 1.27 119 US_DOLLARS_3 5695 1.64 2.91 1.25 120 USER_IN_DEF_DKIM_WL 5633 0.95 0.02 1.24 121 XM_GoogleGroups 5374 1.02 0.51 1.18 122 XM_UB50 5310 2.41 6.47 1.17 123 TooManyTo_004 5013 1.03 0.79 1.10 124 T_Symld_Words_02 4985 1.15 1.34 1.09 125 XMGenDplmaNmb 4958 1.26 1.80 1.09 126 DKIM_ADSP_CUSTOM_MED 4834 1.09 1.20 1.06 127 NO_DNS_FOR_FROM 4721 1.43 2.71 1.04 128 TR_XM_PHPDW 4629 1.37 2.54 1.02 129 TM2_M_VERY_LONG_WORD 4624 1.24 1.97 1.02 130 TR_XM_PHPForged 4537 1.35 2.52 1.00 131 TR_XM_FormFill2 4502 1.34 2.49 0.99 132 XM_H_PHPOS 4488 1.34 2.48 0.99 133 T_FILL_THIS_FORM_SHORT 4439 1.20 1.93 0.97 134 T_XMDrugObfuBody_00 4354 1.03 1.29 0.96 135 XM_H_PHPMailer 4354 1.05 1.34 0.96 136 SpammyFromTLD_01 4229 1.13 1.81 0.93 137 HTML_IMAGE_ONLY_32 4219 0.83 0.53 0.93 138 TooManyTo_005 4193 0.87 0.68 0.92 139 XM_H_Long_From02 3989 1.01 1.43 0.88 140 RELAYCOUNTRY_DE 3755 0.87 1.01 0.82 141 NML_ADSP_CUSTOM_MED 3436 0.78 0.86 0.75 142 TR_XM_RelayPhish 3374 0.96 1.69 0.74 143 XMGappySubj_01 3321 0.69 0.56 0.73 144 XMBdyGiftCard01 3319 1.21 2.77 0.73 145 XMPhish14 3306 0.69 0.58 0.73 146 RCVD_IN_BL_SPAMCOP_NET 3299 1.51 4.07 0.72 147 T_OBFU_PDF_ATTACH 3288 0.60 0.21 0.72 148 XMBody_95 3192 0.56 0.10 0.70 149 XM_RXBody 3039 0.69 0.76 0.67 150 T_XMHurry_00 2932 0.76 1.13 0.64 151 HTTPS_HTTP_MISMATCH 2928 0.64 0.63 0.64 152 XM_ProductURIs 2892 0.76 1.17 0.63 153 XMBrknScrpt_02 2883 0.71 0.95 0.63 154 XMSubMetaI_00 2880 0.85 1.58 0.63 155 XM_ShortIntro_01 2860 0.63 0.65 0.63 156 XMSexyCombo_01 2739 1.15 2.93 0.60 157 XM_H_PHPOS_M 2736 0.73 1.14 0.60 158 USER_IN_WHITELIST 2734 0.46 0.00 0.60 159 XMBody_78 2700 0.76 1.30 0.59 160 FROM_GOV_SPOOF 2602 0.50 0.28 0.57 161 T_TooManySym_03 2464 0.46 0.21 0.54 162 HTML_FONT_FACE_BAD 2456 0.60 0.81 0.54 163 XMMoneyMeta_00 2444 0.62 0.88 0.54 164 AC_DIV_BONANZA 2443 0.43 0.10 0.54 165 FILL_THIS_FORM 2412 0.53 0.53 0.53 166 XM_B_COPY_HTML 2394 0.56 0.68 0.53 167 TM2_M_BODY_EMPTY 2362 0.42 0.10 0.52 168 XMSlimDrugH 2348 0.73 1.45 0.52 169 SHORT_HELO_AND_INLINE_IMAGE 2347 0.41 0.05 0.52 170 XMPhish30 2346 0.66 1.13 0.52 171 FORGED_GMAIL_RCVD 2328 0.63 1.04 0.51 172 HTML_TAG_BALANCE_BODY 2320 0.61 0.94 0.51 173 T_MONEY_PERCENT 2280 0.60 0.90 0.50 174 TR_LOTS_OF_MONEY2 2280 0.60 0.90 0.50 175 XM_B_REG_HTML 2272 0.61 0.97 0.50 176 DKIM_ADSP_NXDOMAIN 2245 0.80 1.82 0.49 177 XMNoVowels 2238 0.51 0.58 0.49 178 FROM_GOV_DKIM_AU 2233 0.40 0.12 0.49 179 TR_LOTS_OF_MONEY3 2187 0.62 1.06 0.48 180 XM_H_Trusted_IP 2162 0.36 0.00 0.47 181 TM2_M_A_HREF_HREF 2116 0.48 0.53 0.46 182 RELAYCOUNTRY_AU 2108 0.47 0.51 0.46 183 NUMERIC_HTTP_ADDR 2066 0.82 2.03 0.45 184 XMhairloss01 2040 0.39 0.21 0.45 185 MISSING_HEADERS 2036 0.46 0.51 0.45 186 FILL_THIS_FORM_LONG 2018 0.44 0.44 0.44 187 T_MANY_PILL_PRICE 2004 0.38 0.18 0.44 188 FILL_THIS_FORM_LOAN 1997 0.38 0.20 0.44 189 XMDateMe_00 1994 0.45 0.49 0.44 190 RCVD_IN_SORBS_DUL 1961 0.38 0.20 0.43 191 XMSubMetaSxObfu_03 1958 0.51 0.79 0.43 192 URI_NOVOWEL 1922 0.50 0.76 0.42 193 REMOVE_BEFORE_LINK 1896 0.42 0.43 0.42 194 HTML_IMAGE_ONLY_28 1885 0.44 0.54 0.41 195 XMBody_17 1834 0.70 1.66 0.40 196 RDNS_DYNAMIC 1821 0.53 0.97 0.40 197 XMLngstWrd_00 1802 0.39 0.38 0.40 198 XMSubMetaSxObfu_02 1774 0.37 0.32 0.39 199 XMLngstWrd_01 1670 0.36 0.36 0.37 200 XMHTMLBadTable_001 1661 0.45 0.73 0.36 ----------------------------------------------------------------------