Email: 640854 Autolearn: 0 AvgScore: 3.13 AvgScanTime: 2.12 sec Spam: 157613 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 2.70 sec Ham: 483241 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 1.93 sec Time Spent Running SA: 377.60 hours Time Spent Processing Spam: 118.20 hours Time Spent Processing Ham: 259.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145540 88.35 92.34 87.04 2 DCC_CHECK 126461 50.35 80.24 40.61 3 DKIM_SIGNED 126412 77.02 80.20 75.99 4 XM_DK_Pass 122074 75.31 77.45 74.61 5 XM_B_Unicode 119286 69.80 75.68 67.88 6 DKIM_VALID 118556 72.80 75.22 72.01 7 XMListUnsubscribeExists 115026 56.51 72.98 51.13 8 DKIM_VALID_AU 90267 53.85 57.27 52.73 9 XM_B_Unicode3 75178 40.67 47.70 38.37 10 XM_DK_Undo_02 72711 20.48 46.13 12.12 11 BAYES_99 61380 17.18 38.94 10.08 12 HTML_FONT_LOW_CONTRAST 58584 30.56 37.17 28.40 13 BAYES_50 56494 48.80 35.84 53.02 14 LOC_TINY_FONT_1 54419 25.68 34.53 22.79 15 TR_DCC_Bayes_99 50468 11.49 32.02 4.79 16 BAYES_999 50370 14.45 31.96 8.74 17 MIME_HTML_ONLY 48168 22.53 30.56 19.91 18 FVGT_m_MULTI_ODD 40747 22.20 25.85 21.01 19 XMSubLong 39848 22.90 25.28 22.12 20 DKIM_VALID_EF 34823 26.69 22.09 28.19 21 T_KAM_HTML_FONT_INVALID 34085 18.78 21.63 17.85 22 RELAYCOUNTRY_META 34020 9.38 21.58 5.40 23 XM_Body_Dirty_Words 33992 14.83 21.57 12.63 24 MultiRelay 30144 19.29 19.13 19.34 25 T_TM2_M_HEADER_IN_MSG 28954 27.65 18.37 30.67 26 BOTNET_IPINHOSTNAME 28437 7.87 18.04 4.55 27 DCC_CHECK_NEGATIVE 27838 47.41 17.66 57.11 28 XM_Multi_Part_URI 26833 12.57 17.02 11.11 29 BOTNET 24535 5.42 15.57 2.11 30 UNTRUSTED_Relay 23817 4.81 15.11 1.45 31 HTML_IMAGE_RATIO_02 22521 9.20 14.29 7.55 32 FSL_BULK_SIG 22094 8.77 14.02 7.06 33 LOTS_OF_MONEY 19575 9.06 12.42 7.96 34 XM_Evil_Numbers_Gen 19408 9.86 12.31 9.06 35 XM_UncommonTLD01 18235 5.34 11.57 3.31 36 TooManyTo_001 15941 8.74 10.11 8.29 37 XMSexyCombo_05 15609 5.12 9.90 3.55 38 LotsOfNums_01 15135 8.36 9.60 7.95 39 T_XMDrugObfuBody_14 14351 8.36 9.11 8.12 40 SpammyFromTLD_02 13349 2.28 8.47 0.25 41 HTML_IMAGE_RATIO_04 12922 5.53 8.20 4.66 42 XM_UB50 12853 2.71 8.15 0.93 43 BAYES_80 12563 5.02 7.97 4.06 44 XM_H_Long_From01 12540 6.78 7.96 6.39 45 XMSubMetaSx_00 11988 4.61 7.61 3.63 46 XM_B_Phish_Phrases 11418 6.29 7.24 5.98 47 MPART_ALT_DIFF 11337 4.29 7.19 3.34 48 XM_B_SpammyTLD 10427 4.11 6.62 3.30 49 MIME_QP_LONG_LINE 9887 6.05 6.27 5.97 50 KHOP_HELO_FCRDNS 9309 3.08 5.91 2.16 51 XM_DIRTYINTL 9207 3.31 5.84 2.48 52 BAYES_60 8942 6.34 5.67 6.56 53 XMNumbers 8900 4.51 5.65 4.14 54 RCVD_IN_MSPIKE_H2 8633 7.04 5.48 7.55 55 MultiRelay_CC 8503 1.53 5.39 0.27 56 MultiRelay_Combo 8503 1.53 5.39 0.27 57 RCVD_IN_BL_SPAMCOP_NET 8400 1.78 5.33 0.63 58 T_REMOTE_IMAGE 8068 4.34 5.12 4.09 59 DKIM_INVALID 7856 4.23 4.98 3.98 60 BAYES_95 7042 3.05 4.47 2.58 61 HTML_IMAGE_RATIO_06 6926 3.64 4.39 3.39 62 RCVD_IN_RP_RNBL 6777 1.09 4.30 0.04 63 XM_SendGrid 6676 5.99 4.24 6.56 64 MIME_HTML_MOSTLY 6654 2.88 4.22 2.44 65 XM_OfRef6 6501 2.32 4.12 1.73 66 XM_SPF_SoftFail 6397 2.51 4.06 2.00 67 MIME_HTML_ONLY_MULTI 6295 2.20 3.99 1.61 68 XMStrtUSub 6221 4.57 3.95 4.77 69 TM2_M_URI_OPT_OUT 6084 2.21 3.86 1.67 70 RELAYCOUNTRY_CA 5915 2.05 3.75 1.50 71 US_DOLLARS_3 5816 1.55 3.69 0.86 72 FROM_EXCESS_BASE64 5568 3.32 3.53 3.24 73 RELAYCOUNTRY_FR 5560 1.04 3.53 0.23 74 T_XMDrugObfuBody_08 5401 2.15 3.43 1.73 75 XM_URI_RBL 5262 1.04 3.34 0.30 76 RCVD_IN_IADB_LISTED 5150 4.91 3.27 5.45 77 URI_HEX 4945 1.96 3.14 1.58 78 BAYES_40 4789 4.28 3.04 4.69 79 BODY_URI_ONLY 4788 0.84 3.04 0.12 80 XM_CamelCaseFrm001 4787 2.39 3.04 2.18 81 T_FILL_THIS_FORM_SHORT 4738 1.48 3.01 0.98 82 XMSexyCombo_01 4677 1.12 2.97 0.51 83 RCVD_IN_IADB_SPF 4669 4.32 2.96 4.77 84 HTML_IMAGE_RATIO_08 4568 2.48 2.90 2.35 85 RCVD_IN_RP_SAFE 4561 7.97 2.89 9.62 86 RCVD_IN_IADB_DK 4469 3.76 2.84 4.06 87 RCVD_IN_IADB_SENDERID 4460 3.84 2.83 4.17 88 HDRS_LCASE_IMGONLY 4442 0.74 2.82 0.06 89 HTML_SHORT_LINK_IMG_1 4397 0.71 2.79 0.04 90 SUBJ_ALL_CAPS 4254 2.01 2.70 1.78 91 NO_DNS_FOR_FROM 4171 1.42 2.65 1.02 92 XMDiploma_00 3988 2.06 2.53 1.90 93 HTML_MIME_NO_HTML_TAG 3897 2.31 2.47 2.25 94 XMPhish11 3838 1.70 2.44 1.47 95 FROM_SUSPICIOUS_NTLD 3699 0.60 2.35 0.03 96 RCVD_IN_PSBL 3671 0.59 2.33 0.03 97 FROM_SUSPICIOUS_NTLD_FP 3642 0.58 2.31 0.02 98 TR_XM_DK_SendGrid 3513 3.13 2.23 3.43 99 T_TooManySym_01 3486 5.11 2.21 6.05 100 FORM_FRAUD_5 3411 0.55 2.16 0.02 101 TR_XM_PHPDW 3399 1.50 2.16 1.29 102 XM_UB99 3372 0.54 2.14 0.02 103 TR_XM_PHPForged 3365 1.48 2.13 1.27 104 XMBdyGiftCard01 3354 1.28 2.13 1.00 105 TR_XM_FormFill2 3338 1.47 2.12 1.26 106 SpammyFromTLD_01 3328 1.09 2.11 0.75 107 NUMERIC_HTTP_ADDR 3327 0.69 2.11 0.23 108 XM_H_PHPOS 3325 1.47 2.11 1.26 109 ADVANCE_FEE_3_NEW_MONEY 3252 0.51 2.06 0.00 110 BAYES_20 3196 3.19 2.03 3.56 111 HTML_IMAGE_ONLY_12 3063 0.65 1.94 0.23 112 TM2_M_VERY_LONG_WORD 3062 1.26 1.94 1.04 113 DATE_IN_PAST_12_24 2956 0.51 1.88 0.06 114 TR_Mismatch_TLD_02 2912 0.53 1.85 0.10 115 NORMAL_HTTP_TO_IP 2879 0.49 1.83 0.05 116 RCVD_IN_RP_CERTIFIED 2800 6.96 1.78 8.65 117 MIME_HEADER_CTYPE_ONLY 2786 0.55 1.77 0.15 118 DKIM_ADSP_NXDOMAIN 2775 0.87 1.76 0.58 119 XMBody_17 2707 0.85 1.72 0.57 120 XMGenDplmaNmb 2656 1.26 1.69 1.12 121 XMSubMetaI_00 2655 0.75 1.68 0.44 122 XM_UB999 2636 0.42 1.67 0.02 123 XM_H_Long_From02 2629 1.22 1.67 1.07 124 URI_HEX_IP 2628 0.41 1.67 0.00 125 MAILING_LIST_MULTI 2619 2.29 1.66 2.50 126 DATE_IN_PAST_06_12 2608 0.47 1.65 0.08 127 RELAYCOUNTRY_DE 2498 0.76 1.58 0.48 128 NORDNS_LOW_CONTRAST 2490 0.40 1.58 0.01 129 XM_DK_Undo_01 2484 1.77 1.58 1.84 130 RCVD_IN_MSPIKE_WL 2462 4.35 1.56 5.26 131 XM_BadFromFormat 2443 0.47 1.55 0.12 132 URI_TRY_3LD 2442 1.41 1.55 1.37 133 RELAYCOUNTRY_NL 2431 0.53 1.54 0.20 134 XMBody_78 2390 0.72 1.52 0.46 135 TR_XM_RelayPhish 2364 0.98 1.50 0.82 136 XM_UB60 2354 0.43 1.49 0.08 137 BOTNET_NORDNS 2305 0.38 1.46 0.03 138 XMBrknScrpt_02 2301 0.93 1.46 0.75 139 XMStockSpam_06 2260 0.96 1.43 0.80 140 RELAYCOUNTRY_ES 2234 0.37 1.42 0.02 141 RELAYCOUNTRY_SE 2170 0.36 1.38 0.02 142 T_XMDrugObfuBody_00 2148 0.86 1.36 0.69 143 XM_H_TOP 2132 0.34 1.35 0.00 144 SUBJ_DOLLARS 2116 0.69 1.34 0.47 145 XM_UB80 2092 0.35 1.33 0.03 146 RCVD_IN_MSPIKE_H3 1997 4.13 1.27 5.06 147 DATE_IN_PAST_96_XX 1972 0.32 1.25 0.01 148 XMMoneyMeta_00 1927 0.68 1.22 0.50 149 XMPhish30 1925 0.64 1.22 0.45 150 TR_LOTS_OF_MONEY3 1922 0.60 1.22 0.39 151 ALL_TRUSTED 1905 11.83 1.21 15.30 152 ADVANCE_FEE_4_NEW 1863 0.30 1.18 0.01 153 RELAYCOUNTRY_IN 1862 0.38 1.18 0.12 154 RCVD_IN_IADB_VOUCHED 1859 3.06 1.18 3.67 155 RELAYCOUNTRY_CL 1851 0.30 1.17 0.01 156 RELAYCOUNTRY_GB 1838 1.14 1.17 1.13 157 THIS_AD 1826 0.61 1.16 0.43 158 DIET_1 1822 0.50 1.16 0.29 159 HTML_IMAGE_ONLY_08 1804 0.37 1.14 0.12 160 BAYES_00 1804 10.03 1.14 12.93 161 TR_Symld_Words 1765 1.43 1.12 1.53 162 XM_OfRef7 1756 0.46 1.11 0.25 163 T_XMHurry_00 1641 0.79 1.04 0.71 164 MONEY_FORM_SHORT 1640 0.27 1.04 0.01 165 XM_HighProb1 1640 0.30 1.04 0.06 166 UNPARSEABLE_RELAY 1633 2.14 1.04 2.49 167 XMSubMetaSxObfu_03 1567 0.56 0.99 0.42 168 DATE_IN_PAST_03_06 1562 0.35 0.99 0.14 169 TR_M_TOP_BAYES 1547 0.24 0.98 0.00 170 T_MONEY_PERCENT 1525 0.56 0.97 0.43 171 TR_LOTS_OF_MONEY2 1525 0.56 0.97 0.43 172 TR_MetaPhish_Combo_01 1514 1.82 0.96 2.10 173 RELAYCOUNTRY_SC 1486 0.24 0.94 0.01 174 XMSexyCombo_04 1475 0.27 0.94 0.06 175 BODY_ENHANCEMENT 1465 0.27 0.93 0.06 176 MONEY_FRAUD_5 1452 0.23 0.92 0.01 177 HTML_FONT_FACE_BAD 1447 0.60 0.92 0.50 178 HK_RANDOM_REPLYTO 1429 0.37 0.91 0.19 179 URIBL_SBL_A 1422 0.31 0.90 0.12 180 TooManyTo_002 1417 1.88 0.90 2.21 181 URIBL_BLACK 1378 0.24 0.87 0.03 182 LongTLD 1374 0.33 0.87 0.16 183 TVD_RCVD_IP 1370 1.77 0.87 2.06 184 T_Symld_Words_02 1363 0.65 0.86 0.58 185 XMPhish14 1359 0.55 0.86 0.44 186 XMSlimDrugH 1353 0.45 0.86 0.31 187 XMHTML_After_End 1347 0.48 0.85 0.36 188 XM_ProductURIs 1347 0.73 0.85 0.68 189 PLING_QUERY 1338 0.57 0.85 0.48 190 XMHTMLBadTable_001 1336 0.56 0.85 0.47 191 XM_B_REG_HTML 1329 0.53 0.84 0.42 192 RELAYCOUNTRY_AT 1268 0.29 0.80 0.12 193 MPART_ALT_DIFF_COUNT 1248 0.43 0.79 0.31 194 XM_H_PHPMailer 1216 0.56 0.77 0.48 195 SUBJ_YOUR_FAMILY 1202 0.21 0.76 0.02 196 BAYES_05 1182 1.91 0.75 2.29 197 RDNS_DYNAMIC 1179 0.48 0.75 0.40 198 XMWhlSbjSex 1178 0.26 0.75 0.10 199 TooManyTo_003 1171 1.29 0.74 1.46 200 TM2_M_BODY_EMPTY 1164 0.57 0.74 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420631 88.35 92.34 87.04 2 DKIM_SIGNED 367196 77.02 80.20 75.99 3 XM_DK_Pass 360561 75.31 77.45 74.61 4 DKIM_VALID 347958 72.80 75.22 72.01 5 XM_B_Unicode 328004 69.80 75.68 67.88 6 DCC_CHECK_NEGATIVE 276003 47.41 17.66 57.11 7 BAYES_50 256224 48.80 35.84 53.02 8 DKIM_VALID_AU 254818 53.85 57.27 52.73 9 XMListUnsubscribeExists 247098 56.51 72.98 51.13 10 DCC_CHECK 196221 50.35 80.24 40.61 11 XM_B_Unicode3 185438 40.67 47.70 38.37 12 T_TM2_M_HEADER_IN_MSG 148222 27.65 18.37 30.67 13 HTML_FONT_LOW_CONTRAST 137233 30.56 37.17 28.40 14 DKIM_VALID_EF 136228 26.69 22.09 28.19 15 LOC_TINY_FONT_1 110132 25.68 34.53 22.79 16 XMSubLong 106913 22.90 25.28 22.12 17 FVGT_m_MULTI_ODD 101536 22.20 25.85 21.01 18 MIME_HTML_ONLY 96197 22.53 30.56 19.91 19 MultiRelay 93463 19.29 19.13 19.34 20 T_KAM_HTML_FONT_INVALID 86268 18.78 21.63 17.85 21 ALL_TRUSTED 73922 11.83 1.21 15.30 22 BAYES_00 62489 10.03 1.14 12.93 23 XM_Body_Dirty_Words 61018 14.83 21.57 12.63 24 XM_DK_Undo_02 58567 20.48 46.13 12.12 25 XM_Multi_Part_URI 53701 12.57 17.02 11.11 26 BAYES_99 48730 17.18 38.94 10.08 27 TR_XM_DK_Bayes 47321 7.52 0.57 9.79 28 RCVD_IN_RP_SAFE 46502 7.97 2.89 9.62 29 TR_XM_DK_Bayes1 45602 7.25 0.55 9.44 30 XM_Evil_Numbers_Gen 43785 9.86 12.31 9.06 31 BAYES_999 42252 14.45 31.96 8.74 32 RCVD_IN_RP_CERTIFIED 41800 6.96 1.78 8.65 33 TooManyTo_001 40067 8.74 10.11 8.29 34 T_XMDrugObfuBody_14 39226 8.36 9.11 8.12 35 TR_XM_DK_Bayes2 38925 6.18 0.45 8.05 36 LOTS_OF_MONEY 38476 9.06 12.42 7.96 37 LotsOfNums_01 38416 8.36 9.60 7.95 38 RCVD_IN_MSPIKE_H2 36491 7.04 5.48 7.55 39 HTML_IMAGE_RATIO_02 36467 9.20 14.29 7.55 40 XM_DKIMWhitelistDomains 36195 5.68 0.12 7.49 41 FSL_BULK_SIG 34119 8.77 14.02 7.06 42 XM_SendGrid 31707 5.99 4.24 6.56 43 BAYES_60 31693 6.34 5.67 6.56 44 XM_H_Long_From01 30885 6.78 7.96 6.39 45 T_TooManySym_01 29233 5.11 2.21 6.05 46 XM_B_Phish_Phrases 28895 6.29 7.24 5.98 47 MIME_QP_LONG_LINE 28866 6.05 6.27 5.97 48 RCVD_IN_IADB_LISTED 26317 4.91 3.27 5.45 49 RELAYCOUNTRY_META 26076 9.38 21.58 5.40 50 RCVD_IN_MSPIKE_WL 25423 4.35 1.56 5.26 51 RCVD_IN_MSPIKE_H3 24466 4.13 1.27 5.06 52 TR_DCC_Bayes_99 23166 11.49 32.02 4.79 53 XMStrtUSub 23073 4.57 3.95 4.77 54 RCVD_IN_IADB_SPF 23027 4.32 2.96 4.77 55 XM_PDF 22994 3.72 0.55 4.76 56 BAYES_40 22666 4.28 3.04 4.69 57 HTML_IMAGE_RATIO_04 22538 5.53 8.20 4.66 58 BOTNET_IPINHOSTNAME 21984 7.87 18.04 4.55 59 RCVD_IN_IADB_SENDERID 20142 3.84 2.83 4.17 60 XMNumbers 20000 4.51 5.65 4.14 61 T_REMOTE_IMAGE 19770 4.34 5.12 4.09 62 RCVD_IN_IADB_DK 19638 3.76 2.84 4.06 63 BAYES_80 19610 5.02 7.97 4.06 64 DKIM_INVALID 19238 4.23 4.98 3.98 65 IN_ZIMBRA_NJ_WHITELIST 18642 2.91 0.02 3.86 66 RCVD_IN_IADB_VOUCHED 17750 3.06 1.18 3.67 67 XMSubMetaSx_00 17524 4.61 7.61 3.63 68 BAYES_20 17218 3.19 2.03 3.56 69 XMSexyCombo_05 17172 5.12 9.90 3.55 70 TR_XM_DK_SendGrid 16564 3.13 2.23 3.43 71 HTML_IMAGE_RATIO_06 16396 3.64 4.39 3.39 72 MPART_ALT_DIFF 16160 4.29 7.19 3.34 73 XM_UncommonTLD01 15983 5.34 11.57 3.31 74 XM_B_SpammyTLD 15923 4.11 6.62 3.30 75 FROM_EXCESS_BASE64 15677 3.32 3.53 3.24 76 TO_MALFORMED 14037 2.26 0.28 2.90 77 ANY_BOUNCE_MESSAGE 12542 2.03 0.31 2.60 78 BOUNCE_MESSAGE 12540 2.03 0.31 2.59 79 BAYES_95 12478 3.05 4.47 2.58 80 MAILING_LIST_MULTI 12058 2.29 1.66 2.50 81 UNPARSEABLE_RELAY 12055 2.14 1.04 2.49 82 T_TooManySym_02 12047 2.05 0.71 2.49 83 XM_DIRTYINTL 11985 3.31 5.84 2.48 84 MIME_HTML_MOSTLY 11782 2.88 4.22 2.44 85 RCVD_IN_IADB_OPTIN 11429 1.96 0.73 2.37 86 HTML_IMAGE_RATIO_08 11354 2.48 2.90 2.35 87 BAYES_05 11074 1.91 0.75 2.29 88 HTML_MIME_NO_HTML_TAG 10888 2.31 2.47 2.25 89 TooManyTo_002 10658 1.88 0.90 2.21 90 XM_CamelCaseFrm001 10522 2.39 3.04 2.18 91 KHOP_HELO_FCRDNS 10426 3.08 5.91 2.16 92 BOTNET 10193 5.42 15.57 2.11 93 TR_MetaPhish_Combo_01 10142 1.82 0.96 2.10 94 TVD_RCVD_IP 9976 1.77 0.87 2.06 95 XM_SPF_SoftFail 9681 2.51 4.06 2.00 96 XMDiploma_00 9194 2.06 2.53 1.90 97 XM_DK_Undo_01 8871 1.77 1.58 1.84 98 SUBJ_ALL_CAPS 8621 2.01 2.70 1.78 99 IN_HORDE_ADDRESS_BOOK 8389 1.32 0.04 1.74 100 XM_OfRef6 8373 2.32 4.12 1.73 101 T_XMDrugObfuBody_08 8349 2.15 3.43 1.73 102 HELO_NODOT 8259 1.42 0.53 1.71 103 HELO_NO_DOMAIN 8254 1.42 0.53 1.71 104 CK_HELO_DYNAMIC_SPLIT_IP 8226 1.35 0.28 1.70 105 HELO_DYNAMIC_IPADDR2 8224 1.33 0.18 1.70 106 TM2_M_URI_OPT_OUT 8092 2.21 3.86 1.67 107 MIME_HTML_ONLY_MULTI 7789 2.20 3.99 1.61 108 URI_HEX 7616 1.96 3.14 1.58 109 INVALID_MSGID 7495 1.21 0.16 1.55 110 TR_Symld_Words 7376 1.43 1.12 1.53 111 RELAYCOUNTRY_CA 7231 2.05 3.75 1.50 112 XMCapTrack 7192 1.19 0.29 1.49 113 XMPhish11 7080 1.70 2.44 1.47 114 TooManyTo_003 7073 1.29 0.74 1.46 115 UNTRUSTED_Relay 7019 4.81 15.11 1.45 116 URI_TRY_3LD 6621 1.41 1.55 1.37 117 TR_XM_PHPDW 6210 1.50 2.16 1.29 118 TR_XM_PHPForged 6121 1.48 2.13 1.27 119 TR_XM_FormFill2 6089 1.47 2.12 1.26 120 XM_GoogleGroups 6076 1.05 0.43 1.26 121 XM_H_PHPOS 6071 1.47 2.11 1.26 122 RELAYCOUNTRY_GB 5467 1.14 1.17 1.13 123 XMGenDplmaNmb 5418 1.26 1.69 1.12 124 USER_IN_DEF_DKIM_WL 5402 0.85 0.02 1.12 125 TooManyTo_004 5335 0.98 0.60 1.10 126 XMGappySubj_01 5295 0.91 0.32 1.10 127 XM_H_Long_From02 5163 1.22 1.67 1.07 128 DKIM_ADSP_CUSTOM_MED 5038 0.95 0.65 1.04 129 TM2_M_VERY_LONG_WORD 5032 1.26 1.94 1.04 130 NO_DNS_FOR_FROM 4915 1.42 2.65 1.02 131 XMBdyGiftCard01 4822 1.28 2.13 1.00 132 T_FILL_THIS_FORM_SHORT 4745 1.48 3.01 0.98 133 TooManyTo_005 4528 0.83 0.49 0.94 134 XM_UB50 4510 2.71 8.15 0.93 135 US_DOLLARS_3 4132 1.55 3.69 0.86 136 TR_XM_RelayPhish 3947 0.98 1.50 0.82 137 XMStockSpam_06 3883 0.96 1.43 0.80 138 SpammyFromTLD_01 3638 1.09 2.11 0.75 139 XMBrknScrpt_02 3629 0.93 1.46 0.75 140 TO_NO_BRKTS_HTML_ONLY 3625 0.61 0.19 0.75 141 NML_ADSP_CUSTOM_MED 3624 0.70 0.54 0.75 142 T_TooManySym_03 3520 0.60 0.23 0.73 143 T_XMHurry_00 3441 0.79 1.04 0.71 144 T_XMDrugObfuBody_00 3350 0.86 1.36 0.69 145 XM_ProductURIs 3308 0.73 0.85 0.68 146 MISSING_HEADERS 3252 0.67 0.64 0.67 147 HTML_TAG_BALANCE_BODY 3115 0.65 0.66 0.64 148 T_OBFU_PDF_ATTACH 3076 0.52 0.15 0.64 149 RCVD_IN_BL_SPAMCOP_NET 3022 1.78 5.33 0.63 150 HTTPS_HTTP_MISMATCH 2932 0.63 0.70 0.61 151 XMLngstWrd_00 2904 0.54 0.35 0.60 152 XMNoVowels 2842 0.58 0.56 0.59 153 FROM_GOV_DKIM_AU 2824 0.49 0.21 0.58 154 DKIM_ADSP_NXDOMAIN 2813 0.87 1.76 0.58 155 RELAYCOUNTRY_AU 2792 0.55 0.48 0.58 156 T_Symld_Words_02 2788 0.65 0.86 0.58 157 XM_ShortIntro_01 2768 0.57 0.56 0.57 158 XMBody_17 2731 0.85 1.72 0.57 159 XMLngstWrd_01 2712 0.50 0.30 0.56 160 FILL_THIS_FORM 2643 0.54 0.51 0.55 161 USER_IN_WHITELIST 2508 0.39 0.00 0.52 162 TM2_M_BODY_EMPTY 2487 0.57 0.74 0.51 163 XMSexyCombo_01 2473 1.12 2.97 0.51 164 XMMoneyMeta_00 2434 0.68 1.22 0.50 165 HTML_FONT_FACE_BAD 2401 0.60 0.92 0.50 166 XMBody_95 2392 0.40 0.12 0.49 167 FORGED_GMAIL_RCVD 2387 0.51 0.54 0.49 168 XM_H_PHPMailer 2343 0.56 0.77 0.48 169 RELAYCOUNTRY_DE 2341 0.76 1.58 0.48 170 PLING_QUERY 2337 0.57 0.85 0.48 171 XMOemUri 2323 0.44 0.32 0.48 172 SUBJ_DOLLARS 2286 0.69 1.34 0.47 173 SHORT_HELO_AND_INLINE_IMAGE 2269 0.36 0.04 0.47 174 XMHTMLBadTable_001 2265 0.56 0.85 0.47 175 TM2_M_A_HREF_HREF 2240 0.45 0.40 0.46 176 XMBody_78 2205 0.72 1.52 0.46 177 XMPhish30 2186 0.64 1.22 0.45 178 XMDateMe_00 2172 0.44 0.40 0.45 179 XM_Body_Obfu01 2155 0.42 0.33 0.45 180 XMSubMetaI_00 2149 0.75 1.68 0.44 181 XMPhish14 2149 0.55 0.86 0.44 182 FILL_THIS_FORM_LONG 2134 0.44 0.41 0.44 183 FILL_THIS_FORM_LOAN 2092 0.37 0.17 0.43 184 THIS_AD 2085 0.61 1.16 0.43 185 HTML_IMAGE_ONLY_32 2068 0.43 0.45 0.43 186 T_MONEY_PERCENT 2057 0.56 0.97 0.43 187 TR_LOTS_OF_MONEY2 2057 0.56 0.97 0.43 188 XM_B_REG_HTML 2048 0.53 0.84 0.42 189 URI_NOVOWEL 2040 0.49 0.68 0.42 190 XMSubMetaSxObfu_03 2022 0.56 0.99 0.42 191 HTML_IMAGE_ONLY_28 2001 0.46 0.58 0.41 192 XM_B_COPY_HTML 1966 0.47 0.66 0.41 193 FROM_GOV_SPOOF 1958 0.37 0.24 0.41 194 RDNS_DYNAMIC 1922 0.48 0.75 0.40 195 RCVD_IN_SORBS_DUL 1910 0.35 0.22 0.40 196 TR_LOTS_OF_MONEY3 1894 0.60 1.22 0.39 197 HTML_IMAGE_ONLY_24 1849 0.38 0.37 0.38 198 XMSubMetaSxObfu_02 1732 0.43 0.64 0.36 199 AC_DIV_BONANZA 1727 0.29 0.08 0.36 200 XMHTML_After_End 1721 0.48 0.85 0.36 ----------------------------------------------------------------------