Email: 618037 Autolearn: 0 AvgScore: 3.40 AvgScanTime: 2.20 sec Spam: 157017 Autolearn: 0 AvgScore: 13.25 AvgScanTime: 2.78 sec Ham: 461020 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 2.00 sec Time Spent Running SA: 377.54 hours Time Spent Processing Spam: 121.43 hours Time Spent Processing Ham: 256.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148973 88.12 94.88 85.82 2 DCC_CHECK 122744 50.08 78.17 40.52 3 DKIM_SIGNED 117799 75.20 75.02 75.26 4 XM_DK_Pass 114448 73.69 72.89 73.97 5 XM_B_Unicode 110683 68.45 70.49 67.75 6 DKIM_VALID 110653 71.01 70.47 71.19 7 XMListUnsubscribeExists 109051 55.38 69.45 50.59 8 DKIM_VALID_AU 83507 52.75 53.18 52.60 9 XM_B_Unicode3 71513 41.06 45.54 39.53 10 XM_DK_Undo_02 67593 19.86 43.05 11.97 11 BAYES_50 61836 49.91 39.38 53.50 12 MIME_HTML_ONLY 58779 24.34 37.43 19.87 13 BAYES_99 57046 16.71 36.33 10.03 14 HTML_FONT_LOW_CONTRAST 52930 29.50 33.71 28.06 15 LOC_TINY_FONT_1 49313 25.37 31.41 23.31 16 BAYES_999 46899 14.16 29.87 8.82 17 TR_DCC_Bayes_99 46246 11.10 29.45 4.85 18 XMSubLong 40543 23.70 25.82 22.98 19 FVGT_m_MULTI_ODD 38828 22.55 24.73 21.80 20 RELAYCOUNTRY_META 38137 10.40 24.29 5.67 21 DKIM_VALID_EF 33734 26.18 21.48 27.78 22 XM_Body_Dirty_Words 33729 15.78 21.48 13.84 23 T_KAM_HTML_FONT_INVALID 32065 18.18 20.42 17.42 24 DCC_CHECK_NEGATIVE 31282 47.82 19.92 57.33 25 T_TM2_M_HEADER_IN_MSG 30685 28.25 19.54 31.21 26 BOTNET_IPINHOSTNAME 29487 8.02 18.78 4.35 27 MultiRelay 27215 19.39 17.33 20.09 28 UNTRUSTED_Relay 27162 5.56 17.30 1.56 29 BOTNET 26953 5.94 17.17 2.12 30 XM_Multi_Part_URI 25198 12.63 16.05 11.46 31 XM_UncommonTLD01 23392 6.50 14.90 3.64 32 HTML_IMAGE_RATIO_02 22579 9.44 14.38 7.75 33 FSL_BULK_SIG 22559 9.27 14.37 7.53 34 XM_Evil_Numbers_Gen 19359 9.90 12.33 9.07 35 LOTS_OF_MONEY 18225 9.65 11.61 8.99 36 T_REMOTE_IMAGE 18021 6.05 11.48 4.20 37 XMSexyCombo_05 17946 5.99 11.43 4.14 38 XM_UB50 15513 3.15 9.88 0.86 39 KHOP_HELO_FCRDNS 14179 3.90 9.03 2.16 40 XMSubMetaSx_00 13926 5.29 8.87 4.07 41 SpammyFromTLD_02 13723 2.51 8.74 0.38 42 T_XMDrugObfuBody_14 13516 8.77 8.61 8.82 43 XM_H_Long_From01 13476 7.05 8.58 6.53 44 LotsOfNums_01 13459 8.37 8.57 8.30 45 MPART_ALT_DIFF 12486 4.35 7.95 3.12 46 BAYES_80 11644 4.69 7.42 3.77 47 HTML_IMAGE_RATIO_04 11453 6.28 7.29 5.94 48 HDRS_LCASE_IMGONLY 11430 1.89 7.28 0.06 49 HTML_SHORT_LINK_IMG_1 11418 1.88 7.27 0.04 50 TooManyTo_001 11143 7.84 7.10 8.09 51 XM_DIRTYINTL 10947 4.04 6.97 3.04 52 MIME_HEADER_CTYPE_ONLY 10521 1.81 6.70 0.14 53 XM_SPF_SoftFail 10474 3.28 6.67 2.13 54 BAYES_60 10180 6.20 6.48 6.11 55 BODY_URI_ONLY 10093 1.71 6.43 0.10 56 XM_B_Phish_Phrases 10049 6.01 6.40 5.87 57 RCVD_IN_MSPIKE_H2 10020 7.40 6.38 7.74 58 HTML_MIME_NO_HTML_TAG 9792 3.39 6.24 2.42 59 FROM_EXCESS_BASE64 9481 3.98 6.04 3.27 60 MIME_QP_LONG_LINE 8957 5.78 5.70 5.80 61 XMStrtUSub 8060 4.34 5.13 4.07 62 XMNumbers 7746 4.23 4.93 3.99 63 XM_B_SpammyTLD 7355 3.70 4.68 3.37 64 REPLYTO_WITHOUT_TO_CC 7250 1.26 4.62 0.12 65 DKIM_INVALID 7146 4.19 4.55 4.07 66 MIME_HTML_ONLY_MULTI 6962 2.35 4.43 1.64 67 MIME_HTML_MOSTLY 6951 2.65 4.43 2.04 68 HTML_IMAGE_ONLY_12 6559 1.22 4.18 0.21 69 MultiRelay_CC 6391 1.24 4.07 0.27 70 MultiRelay_Combo 6391 1.24 4.07 0.27 71 BAYES_95 6276 2.82 4.00 2.42 72 FROM_SUSPICIOUS_NTLD 6006 1.00 3.83 0.03 73 HTML_IMAGE_RATIO_06 5976 3.13 3.81 2.90 74 RELAYCOUNTRY_FR 5965 1.18 3.80 0.29 75 FROM_SUSPICIOUS_NTLD_FP 5960 0.98 3.80 0.03 76 RCVD_IN_BL_SPAMCOP_NET 5947 1.45 3.79 0.66 77 HTML_IMAGE_ONLY_08 5815 1.04 3.70 0.13 78 XMLongAddy 5794 0.98 3.69 0.05 79 TM2_M_URI_OPT_OUT 5791 2.45 3.69 2.03 80 XM_SendGrid 5772 5.60 3.68 6.25 81 RELAYCOUNTRY_CA 5763 2.15 3.67 1.63 82 RCVD_IN_PSBL 5701 0.94 3.63 0.03 83 XM_URI_RBL 5333 1.06 3.40 0.27 84 XM_CamelCaseFrm001 5211 2.29 3.32 1.93 85 RCVD_IN_RP_RNBL 4943 0.83 3.15 0.05 86 XMSexyCombo_01 4935 1.39 3.14 0.80 87 T_TooManySym_01 4698 5.61 2.99 6.50 88 FROM_NTLD_LINKBAIT 4633 0.75 2.95 0.00 89 SHORT_IMG_SUSP_NTLD 4618 0.75 2.94 0.00 90 XMBdyGiftCard01 4536 1.46 2.89 0.98 91 RCVD_IN_RP_SAFE 4458 8.30 2.84 10.16 92 SUBJ_ALL_CAPS 4376 1.99 2.79 1.72 93 T_XMDrugObfuBody_08 4279 1.79 2.73 1.47 94 URI_HEX 4227 2.10 2.69 1.90 95 HTML_IMAGE_RATIO_08 4118 2.49 2.62 2.45 96 RCVD_IN_IADB_LISTED 4050 4.45 2.58 5.09 97 XMDiploma_00 4006 2.00 2.55 1.81 98 BAYES_40 3937 4.24 2.51 4.83 99 RELAYCOUNTRY_FI 3929 0.66 2.50 0.03 100 XMMoneyMeta_00 3739 1.03 2.38 0.57 101 BOTNET_NORDNS 3722 0.66 2.37 0.07 102 NO_FM_NAME_IP_HOSTN 3721 0.60 2.37 0.00 103 RCVD_IN_IADB_SPF 3645 3.91 2.32 4.45 104 NO_DNS_FOR_FROM 3530 1.33 2.25 1.01 105 RCVD_IN_IADB_SENDERID 3489 3.48 2.22 3.90 106 RCVD_IN_IADB_DK 3478 3.42 2.22 3.83 107 DKIM_ADSP_NXDOMAIN 3422 1.07 2.18 0.69 108 XM_OfRef6 3400 1.84 2.17 1.73 109 XMPhish11 3393 1.53 2.16 1.31 110 TM2_M_VERY_LONG_WORD 3343 1.39 2.13 1.13 111 FVGT_m_MULTI_ODD_EMAIL 3260 0.55 2.08 0.04 112 NUMERIC_HTTP_ADDR 3244 0.82 2.07 0.40 113 RCVD_IN_RP_CERTIFIED 3161 7.15 2.01 8.89 114 TR_XM_DK_SendGrid 3147 3.04 2.00 3.39 115 US_DOLLARS_3 3115 1.51 1.98 1.35 116 XMGenDplmaNmb 2952 1.32 1.88 1.13 117 NORDNS_LOW_CONTRAST 2804 0.46 1.79 0.01 118 XM_UB60 2772 0.50 1.77 0.08 119 MAILING_LIST_MULTI 2771 2.60 1.76 2.89 120 NORMAL_HTTP_TO_IP 2738 0.48 1.74 0.05 121 T_Symld_Words_02 2738 0.98 1.74 0.72 122 DKIM_ADSP_CUSTOM_MED 2713 1.27 1.73 1.11 123 XM_UB99 2692 0.44 1.71 0.01 124 TR_XM_RelayPhish 2689 1.06 1.71 0.84 125 RELAYCOUNTRY_DE 2648 0.71 1.69 0.37 126 XMSubMetaI_00 2611 1.05 1.66 0.85 127 XMSexyCombo_04 2609 0.58 1.66 0.21 128 RCVD_IN_MSPIKE_WL 2583 4.40 1.65 5.34 129 HTML_IMAGE_ONLY_24 2547 0.67 1.62 0.35 130 FORGED_GMAIL_RCVD 2535 0.81 1.61 0.53 131 BAYES_20 2489 2.99 1.59 3.46 132 HK_RANDOM_REPLYTO 2455 0.58 1.56 0.24 133 URI_HEX_IP 2455 0.40 1.56 0.00 134 SUBJ_DOLLARS 2441 0.74 1.55 0.46 135 RELAYCOUNTRY_NG 2401 0.39 1.53 0.00 136 XM_H_Long_From02 2373 1.14 1.51 1.01 137 TR_XM_PHPDW 2352 0.84 1.50 0.61 138 XMBody_17 2344 0.72 1.49 0.46 139 TR_XM_PHPForged 2315 0.82 1.47 0.60 140 TR_Mismatch_TLD_02 2307 0.44 1.47 0.09 141 TR_XM_FormFill2 2296 0.81 1.46 0.59 142 XM_H_PHPOS 2284 0.81 1.45 0.59 143 TO_EQ_FM_DOM_HTML_IMG 2274 0.38 1.45 0.01 144 NML_ADSP_CUSTOM_MED 2271 0.96 1.45 0.79 145 RELAYCOUNTRY_GB 2266 1.25 1.44 1.19 146 DATE_IN_PAST_24_48 2236 0.37 1.42 0.01 147 TR_Symld_Words 2200 1.73 1.40 1.85 148 XM_DrugUnitList 2183 0.35 1.39 0.00 149 HOSTED_IMG_MULTI 2182 0.35 1.39 0.00 150 XM_UB80 2134 0.36 1.36 0.03 151 T_XMHurry_00 2113 0.86 1.35 0.70 152 XM_BadFromFormat 2070 0.42 1.32 0.11 153 T_FILL_THIS_FORM_SHORT 2034 1.17 1.30 1.13 154 SpammyFromTLD_01 2033 1.02 1.29 0.93 155 TR_LOTS_OF_MONEY3 2020 0.62 1.29 0.40 156 ALL_TRUSTED 2013 11.99 1.28 15.64 157 DIET_1 2012 0.53 1.28 0.28 158 XMBrknScrpt_02 1960 0.87 1.25 0.74 159 HOSTED_IMG_DIRECT_MX 1938 0.32 1.23 0.00 160 MISSING_HEADERS 1923 0.74 1.22 0.58 161 BAYES_00 1908 10.29 1.22 13.38 162 XM_UB999 1908 0.31 1.22 0.01 163 XM_DK_Undo_01 1883 1.68 1.20 1.85 164 TR_XM_SEO3 1882 0.47 1.20 0.22 165 XMHTML_After_End 1858 0.63 1.18 0.44 166 XMStockSpam_06 1846 1.22 1.18 1.23 167 XM_H_Undi_Recip 1844 0.46 1.17 0.22 168 URI_TRY_3LD 1837 1.13 1.17 1.12 169 LongTLD 1823 0.43 1.16 0.17 170 XMSubMetaSx_01 1795 0.37 1.14 0.10 171 PLING_QUERY 1769 0.67 1.13 0.52 172 RCVD_IN_MSPIKE_H3 1767 4.10 1.13 5.11 173 UNPARSEABLE_RELAY 1759 2.26 1.12 2.64 174 T_XMDrugObfuBody_00 1736 0.90 1.11 0.84 175 XMGappySubj_01 1704 1.12 1.09 1.13 176 XMSlimDrugH 1695 0.55 1.08 0.37 177 RCVD_IN_IADB_VOUCHED 1630 2.75 1.04 3.33 178 LOADSA_MONEY_COMBO 1625 0.29 1.03 0.03 179 XMSexyCombo_02 1622 0.28 1.03 0.02 180 XMPhish30 1615 0.65 1.03 0.53 181 TR_Sbj_FN_Bdy 1608 0.42 1.02 0.22 182 TR_LOTS_OF_MONEY2 1602 0.60 1.02 0.45 183 T_MONEY_PERCENT 1602 0.60 1.02 0.45 184 URIBL_DBL_ABUSE_REDIR 1588 0.26 1.01 0.01 185 XM_ShortIntro_01 1584 0.74 1.01 0.65 186 RELAYCOUNTRY_NL 1564 0.38 1.00 0.17 187 ADVANCE_FEE_4_NEW 1554 0.25 0.99 0.00 188 XM_HighProb1 1531 0.25 0.98 0.01 189 XM_PDF 1525 3.80 0.97 4.76 190 RELAYCOUNTRY_IN 1522 0.37 0.97 0.16 191 TooManyTo_002 1507 1.89 0.96 2.20 192 XMBody_78 1491 0.68 0.95 0.59 193 FROM_LOCAL_NOVOWEL 1471 0.26 0.94 0.03 194 TR_XM_Undi_Recip2 1469 0.25 0.94 0.01 195 URIBL_SBL_A 1460 0.31 0.93 0.10 196 XM_B_REG_HTML 1437 0.59 0.92 0.48 197 FROM_MISSP_REPLYTO 1434 0.24 0.91 0.01 198 DATE_IN_PAST_03_06 1423 0.33 0.91 0.13 199 RELAYCOUNTRY_NO 1416 0.24 0.90 0.01 200 BAYES_05 1414 1.87 0.90 2.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 395668 88.12 94.88 85.82 2 DKIM_SIGNED 346964 75.20 75.02 75.26 3 XM_DK_Pass 341013 73.69 72.89 73.97 4 DKIM_VALID 328209 71.01 70.47 71.19 5 XM_B_Unicode 312341 68.45 70.49 67.75 6 DCC_CHECK_NEGATIVE 264287 47.82 19.92 57.33 7 BAYES_50 246636 49.91 39.38 53.50 8 DKIM_VALID_AU 242518 52.75 53.18 52.60 9 XMListUnsubscribeExists 233213 55.38 69.45 50.59 10 DCC_CHECK 186786 50.08 78.17 40.52 11 XM_B_Unicode3 182245 41.06 45.54 39.53 12 T_TM2_M_HEADER_IN_MSG 143896 28.25 19.54 31.21 13 HTML_FONT_LOW_CONTRAST 129379 29.50 33.71 28.06 14 DKIM_VALID_EF 128093 26.18 21.48 27.78 15 LOC_TINY_FONT_1 107484 25.37 31.41 23.31 16 XMSubLong 105955 23.70 25.82 22.98 17 FVGT_m_MULTI_ODD 100524 22.55 24.73 21.80 18 MultiRelay 92634 19.39 17.33 20.09 19 MIME_HTML_ONLY 91624 24.34 37.43 19.87 20 T_KAM_HTML_FONT_INVALID 80312 18.18 20.42 17.42 21 ALL_TRUSTED 72084 11.99 1.28 15.64 22 XM_Body_Dirty_Words 63821 15.78 21.48 13.84 23 BAYES_00 61674 10.29 1.22 13.38 24 XM_DK_Undo_02 55169 19.86 43.05 11.97 25 XM_Multi_Part_URI 52841 12.63 16.05 11.46 26 TR_XM_DK_Bayes 48929 8.00 0.32 10.61 27 TR_XM_DK_Bayes1 47108 7.69 0.29 10.22 28 RCVD_IN_RP_SAFE 46826 8.30 2.84 10.16 29 BAYES_99 46244 16.71 36.33 10.03 30 XM_Evil_Numbers_Gen 41815 9.90 12.33 9.07 31 LOTS_OF_MONEY 41431 9.65 11.61 8.99 32 RCVD_IN_RP_CERTIFIED 40998 7.15 2.01 8.89 33 T_XMDrugObfuBody_14 40678 8.77 8.61 8.82 34 BAYES_999 40642 14.16 29.87 8.82 35 TR_XM_DK_Bayes2 40489 6.60 0.21 8.78 36 LotsOfNums_01 38247 8.37 8.57 8.30 37 TooManyTo_001 37295 7.84 7.10 8.09 38 XM_DKIMWhitelistDomains 35928 5.84 0.12 7.79 39 HTML_IMAGE_RATIO_02 35745 9.44 14.38 7.75 40 RCVD_IN_MSPIKE_H2 35699 7.40 6.38 7.74 41 FSL_BULK_SIG 34718 9.27 14.37 7.53 42 XM_H_Long_From01 30090 7.05 8.58 6.53 43 T_TooManySym_01 29967 5.61 2.99 6.50 44 XM_SendGrid 28813 5.60 3.68 6.25 45 BAYES_60 28167 6.20 6.48 6.11 46 HTML_IMAGE_RATIO_04 27390 6.28 7.29 5.94 47 XM_B_Phish_Phrases 27084 6.01 6.40 5.87 48 MIME_QP_LONG_LINE 26756 5.78 5.70 5.80 49 RELAYCOUNTRY_META 26122 10.40 24.29 5.67 50 RCVD_IN_MSPIKE_WL 24636 4.40 1.65 5.34 51 RCVD_IN_MSPIKE_H3 23580 4.10 1.13 5.11 52 RCVD_IN_IADB_LISTED 23466 4.45 2.58 5.09 53 TR_DCC_Bayes_99 22353 11.10 29.45 4.85 54 BAYES_40 22246 4.24 2.51 4.83 55 XM_PDF 21964 3.80 0.97 4.76 56 RCVD_IN_IADB_SPF 20502 3.91 2.32 4.45 57 BOTNET_IPINHOSTNAME 20058 8.02 18.78 4.35 58 T_REMOTE_IMAGE 19372 6.05 11.48 4.20 59 XMSexyCombo_05 19089 5.99 11.43 4.14 60 XMStrtUSub 18777 4.34 5.13 4.07 61 DKIM_INVALID 18755 4.19 4.55 4.07 62 XMSubMetaSx_00 18746 5.29 8.87 4.07 63 IN_ZIMBRA_NJ_WHITELIST 18517 3.00 0.02 4.02 64 XMNumbers 18374 4.23 4.93 3.99 65 RCVD_IN_IADB_SENDERID 17988 3.48 2.22 3.90 66 RCVD_IN_IADB_DK 17643 3.42 2.22 3.83 67 BAYES_80 17368 4.69 7.42 3.77 68 XM_UncommonTLD01 16793 6.50 14.90 3.64 69 BAYES_20 15965 2.99 1.59 3.46 70 TR_XM_DK_SendGrid 15614 3.04 2.00 3.39 71 XM_B_SpammyTLD 15522 3.70 4.68 3.37 72 RCVD_IN_IADB_VOUCHED 15372 2.75 1.04 3.33 73 FROM_EXCESS_BASE64 15089 3.98 6.04 3.27 74 ANY_BOUNCE_MESSAGE 14777 2.51 0.45 3.21 75 BOUNCE_MESSAGE 14776 2.51 0.45 3.21 76 MPART_ALT_DIFF 14374 4.35 7.95 3.12 77 XM_DIRTYINTL 14026 4.04 6.97 3.04 78 TO_MALFORMED 13975 2.32 0.24 3.03 79 HTML_IMAGE_RATIO_06 13373 3.13 3.81 2.90 80 MAILING_LIST_MULTI 13321 2.60 1.76 2.89 81 T_TooManySym_02 12313 2.20 0.80 2.67 82 UNPARSEABLE_RELAY 12179 2.26 1.12 2.64 83 HTML_IMAGE_RATIO_08 11275 2.49 2.62 2.45 84 BAYES_95 11172 2.82 4.00 2.42 85 HTML_MIME_NO_HTML_TAG 11147 3.39 6.24 2.42 86 BAYES_05 10151 1.87 0.90 2.20 87 TooManyTo_002 10150 1.89 0.96 2.20 88 KHOP_HELO_FCRDNS 9939 3.90 9.03 2.16 89 TVD_RCVD_IP 9909 1.76 0.60 2.15 90 XM_SPF_SoftFail 9804 3.28 6.67 2.13 91 BOTNET 9769 5.94 17.17 2.12 92 RCVD_IN_IADB_OPTIN 9649 1.72 0.61 2.09 93 MIME_HTML_MOSTLY 9411 2.65 4.43 2.04 94 TM2_M_URI_OPT_OUT 9343 2.45 3.69 2.03 95 XM_CamelCaseFrm001 8919 2.29 3.32 1.93 96 URI_HEX 8776 2.10 2.69 1.90 97 XM_DK_Undo_01 8529 1.68 1.20 1.85 98 TR_Symld_Words 8511 1.73 1.40 1.85 99 HELO_NODOT 8383 1.52 0.65 1.82 100 HELO_NO_DOMAIN 8382 1.52 0.65 1.82 101 TR_MetaPhish_Combo_01 8367 1.50 0.56 1.81 102 XMDiploma_00 8346 2.00 2.55 1.81 103 CK_HELO_DYNAMIC_SPLIT_IP 8234 1.42 0.34 1.79 104 HELO_DYNAMIC_IPADDR2 8226 1.37 0.17 1.78 105 XM_OfRef6 7986 1.84 2.17 1.73 106 SUBJ_ALL_CAPS 7917 1.99 2.79 1.72 107 IN_HORDE_ADDRESS_BOOK 7874 1.28 0.02 1.71 108 MIME_HTML_ONLY_MULTI 7544 2.35 4.43 1.64 109 RELAYCOUNTRY_CA 7524 2.15 3.67 1.63 110 INVALID_MSGID 7329 1.23 0.18 1.59 111 UNTRUSTED_Relay 7196 5.56 17.30 1.56 112 XMCapTrack 7112 1.22 0.27 1.54 113 T_XMDrugObfuBody_08 6789 1.79 2.73 1.47 114 TooManyTo_003 6753 1.29 0.79 1.46 115 US_DOLLARS_3 6235 1.51 1.98 1.35 116 XMPhish11 6048 1.53 2.16 1.31 117 USER_IN_DEF_DKIM_WL 5972 0.97 0.01 1.30 118 XM_GoogleGroups 5945 1.14 0.69 1.29 119 XMStockSpam_06 5688 1.22 1.18 1.23 120 RELAYCOUNTRY_GB 5489 1.25 1.44 1.19 121 TM2_M_VERY_LONG_WORD 5218 1.39 2.13 1.13 122 XMGenDplmaNmb 5205 1.32 1.88 1.13 123 T_FILL_THIS_FORM_SHORT 5201 1.17 1.30 1.13 124 XMGappySubj_01 5200 1.12 1.09 1.13 125 URI_TRY_3LD 5153 1.13 1.17 1.12 126 DKIM_ADSP_CUSTOM_MED 5107 1.27 1.73 1.11 127 TooManyTo_004 5024 0.97 0.62 1.09 128 NO_DNS_FOR_FROM 4666 1.33 2.25 1.01 129 XM_H_Long_From02 4656 1.14 1.51 1.01 130 XMBdyGiftCard01 4495 1.46 2.89 0.98 131 SpammyFromTLD_01 4282 1.02 1.29 0.93 132 TooManyTo_005 4213 0.81 0.52 0.91 133 XM_UB50 3955 3.15 9.88 0.86 134 XMSubMetaI_00 3905 1.05 1.66 0.85 135 TR_XM_RelayPhish 3858 1.06 1.71 0.84 136 T_XMDrugObfuBody_00 3855 0.90 1.11 0.84 137 T_OBFU_PDF_ATTACH 3693 0.65 0.20 0.80 138 XMNoVowels 3679 0.76 0.66 0.80 139 XMSexyCombo_01 3679 1.39 3.14 0.80 140 NML_ADSP_CUSTOM_MED 3635 0.96 1.45 0.79 141 XMBrknScrpt_02 3401 0.87 1.25 0.74 142 T_TooManySym_03 3389 0.63 0.33 0.74 143 T_Symld_Words_02 3322 0.98 1.74 0.72 144 T_XMHurry_00 3224 0.86 1.35 0.70 145 DKIM_ADSP_NXDOMAIN 3161 1.07 2.18 0.69 146 HTTPS_HTTP_MISMATCH 3139 0.70 0.74 0.68 147 RCVD_IN_BL_SPAMCOP_NET 3044 1.45 3.79 0.66 148 XM_ShortIntro_01 2981 0.74 1.01 0.65 149 FILL_THIS_FORM 2886 0.59 0.47 0.63 150 HTML_FONT_FACE_BAD 2844 0.62 0.61 0.62 151 TR_XM_PHPDW 2820 0.84 1.50 0.61 152 TR_XM_PHPForged 2765 0.82 1.47 0.60 153 HTML_TAG_BALANCE_BODY 2729 0.62 0.70 0.59 154 TR_XM_FormFill2 2720 0.81 1.46 0.59 155 XM_H_PHPOS 2713 0.81 1.45 0.59 156 XMBody_78 2712 0.68 0.95 0.59 157 MISSING_HEADERS 2678 0.74 1.22 0.58 158 XMBody_95 2650 0.45 0.09 0.57 159 XMMoneyMeta_00 2628 1.03 2.38 0.57 160 XMPhish14 2591 0.64 0.86 0.56 161 XMSubMetaSxObfu_03 2587 0.61 0.76 0.56 162 XMLngstWrd_00 2578 0.52 0.39 0.56 163 USER_IN_WHITELIST 2562 0.41 0.00 0.56 164 RELAYCOUNTRY_AU 2552 0.54 0.49 0.55 165 XM_B_COPY_HTML 2495 0.55 0.57 0.54 166 FORGED_GMAIL_RCVD 2466 0.81 1.61 0.53 167 XM_H_PHPMailer 2466 0.62 0.86 0.53 168 XM_ProductURIs 2434 0.59 0.77 0.53 169 TM2_M_A_HREF_HREF 2434 0.60 0.80 0.53 170 AC_DIV_BONANZA 2432 0.41 0.08 0.53 171 XMPhish30 2427 0.65 1.03 0.53 172 XMLngstWrd_01 2422 0.48 0.36 0.53 173 PLING_QUERY 2383 0.67 1.13 0.52 174 SHORT_HELO_AND_INLINE_IMAGE 2309 0.38 0.03 0.50 175 TM2_M_BODY_EMPTY 2303 0.43 0.22 0.50 176 T_MANY_PILL_PRICE 2291 0.37 0.00 0.50 177 FROM_GOV_DKIM_AU 2249 0.43 0.24 0.49 178 XM_B_REG_HTML 2224 0.59 0.92 0.48 179 FILL_THIS_FORM_LONG 2209 0.45 0.35 0.48 180 FROM_GOV_SPOOF 2199 0.45 0.36 0.48 181 FILL_THIS_FORM_LOAN 2177 0.41 0.24 0.47 182 XMBody_17 2115 0.72 1.49 0.46 183 SUBJ_DOLLARS 2113 0.74 1.55 0.46 184 URI_NOVOWEL 2113 0.52 0.68 0.46 185 T_MONEY_PERCENT 2079 0.60 1.02 0.45 186 TR_LOTS_OF_MONEY2 2079 0.60 1.02 0.45 187 HTML_IMAGE_ONLY_32 2054 0.44 0.42 0.45 188 XMDateMe_00 2050 0.41 0.31 0.44 189 XMHTML_After_End 2038 0.63 1.18 0.44 190 RCVD_IN_SORBS_DUL 1945 0.37 0.22 0.42 191 HTML_IMAGE_ONLY_28 1896 0.41 0.40 0.41 192 NUMERIC_HTTP_ADDR 1854 0.82 2.07 0.40 193 XMSubMetaSxObfu_02 1841 0.42 0.49 0.40 194 TR_LOTS_OF_MONEY3 1823 0.62 1.29 0.40 195 RDNS_DYNAMIC 1816 0.48 0.73 0.39 196 XMLKML 1800 0.29 0.00 0.39 197 SpammyFromTLD_02 1769 2.51 8.74 0.38 198 XMLngstWrd_02 1747 0.35 0.28 0.38 199 RELAYCOUNTRY_DE 1728 0.71 1.69 0.37 200 XMHTMLBadTable_001 1728 0.47 0.74 0.37 ----------------------------------------------------------------------