Email: 601047 Autolearn: 0 AvgScore: 1.38 AvgScanTime: 2.07 sec Spam: 98451 Autolearn: 0 AvgScore: 12.96 AvgScanTime: 2.89 sec Ham: 502596 Autolearn: 0 AvgScore: -0.89 AvgScanTime: 1.91 sec Time Spent Running SA: 345.64 hours Time Spent Processing Spam: 79.08 hours Time Spent Processing Ham: 266.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90177 86.99 91.60 86.09 2 DCC_CHECK 73635 47.72 74.79 42.42 3 DKIM_SIGNED 65490 75.46 66.52 77.21 4 XM_B_Unicode 63260 67.17 64.26 67.74 5 XM_DK_Pass 62470 73.85 63.45 75.89 6 XMListUnsubscribeExists 61505 54.26 62.47 52.65 7 DKIM_VALID 58657 70.03 59.58 72.07 8 BAYES_50 51749 50.04 52.56 49.55 9 DKIM_VALID_AU 43735 53.24 44.42 54.97 10 MIME_HTML_ONLY 41582 24.59 42.24 21.13 11 XM_B_Unicode3 41439 40.07 42.09 39.68 12 HTML_FONT_LOW_CONTRAST 29774 29.75 30.24 29.66 13 RELAYCOUNTRY_META 28623 9.55 29.07 5.73 14 LOC_TINY_FONT_1 26733 24.38 27.15 23.84 15 XM_DK_Undo_02 26303 8.32 26.72 4.71 16 XMSubLong 25485 22.37 25.89 21.68 17 BOTNET 24128 5.76 24.51 2.08 18 BOTNET_IPINHOSTNAME 22825 7.75 23.18 4.72 19 DCC_CHECK_NEGATIVE 22408 50.04 22.76 55.38 20 FVGT_m_MULTI_ODD 21941 21.63 22.29 21.50 21 DKIM_VALID_EF 20824 26.27 21.15 27.27 22 FSL_BULK_SIG 20389 9.33 20.71 7.11 23 UNTRUSTED_Relay 19863 4.85 20.18 1.85 24 MultiRelay 19375 20.42 19.68 20.56 25 XM_UncommonTLD01 19258 7.46 19.56 5.08 26 XM_Body_Dirty_Words 18167 14.19 18.45 13.35 27 LOTS_OF_MONEY 17876 9.73 18.16 8.08 28 XM_Multi_Part_URI 17667 12.71 17.94 11.68 29 T_TM2_M_HEADER_IN_MSG 17433 28.30 17.71 30.38 30 BAYES_99 16851 4.89 17.12 2.50 31 T_KAM_HTML_FONT_INVALID 16368 16.98 16.63 17.05 32 TR_DCC_Bayes_99 13262 3.23 13.47 1.22 33 KHOP_HELO_FCRDNS 13019 3.82 13.22 1.98 34 HTML_IMAGE_RATIO_02 12735 8.94 12.94 8.16 35 BAYES_999 12722 3.86 12.92 2.08 36 T_REMOTE_IMAGE 12596 5.51 12.79 4.08 37 SpammyFromTLD_02 11958 2.36 12.15 0.44 38 XMSexyCombo_05 11326 5.50 11.50 4.32 39 XM_UB50 11029 2.55 11.20 0.85 40 XM_Evil_Numbers_Gen 10953 10.03 11.13 9.82 41 XMNumbers 9311 4.67 9.46 3.73 42 XMSubMetaSx_00 9041 4.83 9.18 3.97 43 REPLYTO_WITHOUT_TO_CC 8786 1.50 8.92 0.05 44 T_XMDrugObfuBody_14 8689 8.17 8.83 8.04 45 LotsOfNums_01 7918 7.99 8.04 7.98 46 TooManyTo_001 7773 8.22 7.90 8.28 47 HDRS_LCASE_IMGONLY 7612 1.31 7.73 0.05 48 HTML_SHORT_LINK_IMG_1 7595 1.29 7.71 0.04 49 XM_H_Long_From01 7570 6.67 7.69 6.47 50 XM_H_Long_From02 7310 2.69 7.43 1.77 51 XM_SPF_SoftFail 7056 3.44 7.17 2.71 52 DKIM_INVALID 6833 5.44 6.94 5.14 53 MPART_ALT_DIFF 6781 4.39 6.89 3.90 54 HTML_IMAGE_ONLY_12 6620 1.28 6.72 0.22 55 HTML_MIME_NO_HTML_TAG 6574 3.40 6.68 2.75 56 MIME_HEADER_CTYPE_ONLY 6466 1.22 6.57 0.17 57 XM_B_Phish_Phrases 6323 5.38 6.42 5.17 58 TO_EQ_FM_DOM_HTML_IMG 6259 1.05 6.36 0.01 59 XM_DIRTYINTL 6245 3.51 6.34 2.96 60 BAYES_40 5805 6.55 5.90 6.68 61 RELAYCOUNTRY_FR 5689 1.32 5.78 0.45 62 RCVD_IN_MSPIKE_H2 5628 6.90 5.72 7.13 63 HTML_IMAGE_RATIO_04 5390 5.68 5.47 5.72 64 BAYES_80 5263 2.33 5.35 1.73 65 RCVD_IN_BL_SPAMCOP_NET 5013 1.28 5.09 0.53 66 BAYES_20 4834 5.36 4.91 5.44 67 MIME_QP_LONG_LINE 4773 5.45 4.85 5.57 68 BAYES_60 4369 3.62 4.44 3.46 69 DKIM_ADSP_NXDOMAIN 4298 1.14 4.37 0.51 70 XM_URI_RBL 4219 0.98 4.29 0.34 71 RELAYCOUNTRY_CA 4199 2.01 4.27 1.56 72 RCVD_IN_RP_RNBL 4136 0.76 4.20 0.08 73 MIME_HTML_ONLY_MULTI 4048 2.41 4.11 2.07 74 MultiRelay_Combo 3978 0.87 4.04 0.25 75 MultiRelay_CC 3978 0.87 4.04 0.25 76 SUBJ_ALL_CAPS 3888 2.09 3.95 1.73 77 BAYES_00 3881 21.90 3.94 25.42 78 MIME_HTML_MOSTLY 3856 2.70 3.92 2.46 79 TR_XM_PHPDW 3733 2.58 3.79 2.34 80 TR_XM_PHPForged 3707 2.56 3.77 2.32 81 TR_XM_FormFill2 3680 2.55 3.74 2.32 82 XM_H_PHPOS 3671 2.55 3.73 2.32 83 SpammyFromTLD_01 3562 2.73 3.62 2.55 84 TM2_M_URI_OPT_OUT 3540 2.13 3.60 1.85 85 XMMoneyMeta_00 3537 1.10 3.59 0.61 86 US_DOLLARS_3 3534 1.12 3.59 0.63 87 T_TooManySym_01 3487 5.38 3.54 5.75 88 XMStrtUSub 3386 3.96 3.44 4.06 89 XM_B_SpammyTLD 3344 3.24 3.40 3.21 90 XM_SendGrid 3244 5.55 3.30 6.00 91 HTML_IMAGE_RATIO_08 3205 2.71 3.26 2.60 92 URIBL_DBL_ABUSE_REDIR 3161 0.55 3.21 0.03 93 TR_Mismatch_TLD_02 3159 0.60 3.21 0.09 94 XMSexyCombo_01 3134 1.06 3.18 0.64 95 RCVD_IN_MSPIKE_WL 3097 4.51 3.15 4.77 96 BAYES_95 3059 1.34 3.11 1.00 97 ADVANCE_FEE_4_NEW_MONEY 2969 0.50 3.02 0.00 98 XM_OfRef6 2963 1.81 3.01 1.58 99 URI_HEX 2948 2.11 2.99 1.93 100 HTML_IMAGE_RATIO_06 2873 3.20 2.92 3.26 101 XM_CamelCaseFrm001 2790 2.08 2.83 1.94 102 RELAYCOUNTRY_GB 2775 1.42 2.82 1.15 103 T_XMDrugObfuBody_08 2728 1.68 2.77 1.47 104 TVD_RCVD_IP 2638 2.10 2.68 1.98 105 TR_LOTS_OF_MONEY3 2599 0.69 2.64 0.31 106 RCVD_IN_MSPIKE_H3 2597 4.15 2.64 4.44 107 RCVD_IN_PSBL 2558 0.52 2.60 0.11 108 FROM_EXCESS_BASE64 2550 3.23 2.59 3.35 109 RELAYCOUNTRY_NL 2450 0.53 2.49 0.15 110 MISSING_HEADERS 2403 0.90 2.44 0.60 111 T_Symld_Words_02 2390 0.85 2.43 0.54 112 TR_LOTS_OF_MONEY2 2381 0.79 2.42 0.48 113 T_MONEY_PERCENT 2381 0.79 2.42 0.48 114 NO_DNS_FOR_FROM 2375 1.42 2.41 1.22 115 BAYES_05 2325 3.68 2.36 3.94 116 RELAYCOUNTRY_CH 2299 0.42 2.34 0.04 117 XM_Attn_01 2296 0.51 2.33 0.15 118 FROM_BANK_NOAUTH 2235 0.37 2.27 0.00 119 HTML_IMAGE_ONLY_20 2174 0.63 2.21 0.32 120 TR_XM_DK_Bayes 2167 18.14 2.20 21.26 121 TooManyTo_002 2110 2.31 2.14 2.34 122 ALL_TRUSTED 2076 12.60 2.11 14.66 123 AMAZON_IMG_NOT_RCVD_AMZN 2048 0.37 2.08 0.03 124 TR_XM_RelayPhish 2045 0.97 2.08 0.75 125 XM_BadFromFormat 2010 0.43 2.04 0.11 126 XM_DrugUnitList 1989 0.34 2.02 0.01 127 BOTNET_NORDNS 1987 0.37 2.02 0.05 128 HOSTED_IMG_MULTI 1983 0.33 2.01 0.00 129 RCVD_IN_IADB_LISTED 1967 4.27 2.00 4.72 130 RELAYCOUNTRY_IN 1960 0.51 1.99 0.23 131 TR_LOTS_OF_MONEY1 1952 0.34 1.98 0.02 132 TR_XM_DK_Bayes1 1935 17.22 1.97 20.20 133 HK_RANDOM_FROM 1917 0.42 1.95 0.13 134 XMDiploma_00 1901 1.83 1.93 1.81 135 TooManyTo_003 1897 1.67 1.93 1.62 136 XMBody_17 1768 0.87 1.80 0.69 137 TooManyTo_004 1735 1.32 1.76 1.24 138 TR_Mismatch_TLD_01 1712 0.42 1.74 0.16 139 RCVD_IN_IADB_SPF 1710 3.76 1.74 4.15 140 SUBJ_DOLLARS 1686 0.64 1.71 0.42 141 RCVD_IN_IADB_SENDERID 1660 3.35 1.69 3.68 142 RCVD_IN_IADB_DK 1656 3.28 1.68 3.60 143 HOSTED_IMG_DIRECT_MX 1621 0.27 1.65 0.00 144 XMSexyCombo_04 1617 0.39 1.64 0.14 145 TooManyTo_005 1613 1.15 1.64 1.05 146 XMPhish11 1598 1.26 1.62 1.19 147 TM2_M_VERY_LONG_WORD 1584 1.19 1.61 1.11 148 FVGT_m_MULTI_ODD_EMAIL 1547 0.28 1.57 0.03 149 DATE_IN_PAST_03_06 1544 0.40 1.57 0.18 150 XM_H_PHPMailer 1532 0.75 1.56 0.59 151 T_XMHurry_00 1531 0.92 1.56 0.80 152 NORDNS_LOW_CONTRAST 1520 0.26 1.54 0.01 153 TR_Symld_Words 1513 1.60 1.54 1.61 154 XMSubMetaSSx_00 1479 0.46 1.50 0.26 155 BODY_URI_ONLY 1471 0.36 1.49 0.13 156 RCVD_IN_RP_SAFE 1425 8.04 1.45 9.33 157 XMGenDplmaNmb 1405 1.22 1.43 1.18 158 TR_XM_DK_SendGrid 1391 3.00 1.41 3.31 159 XMSubMetaSxObfu_03 1372 0.61 1.39 0.45 160 HTML_IMAGE_ONLY_08 1357 0.33 1.38 0.12 161 DIET_1 1327 0.58 1.35 0.42 162 XM_H_PHPOS_M 1294 0.39 1.31 0.21 163 XMSubMetaI_00 1284 1.14 1.30 1.11 164 XMBody_78 1282 0.62 1.30 0.48 165 HK_SCAM 1280 0.23 1.30 0.02 166 MAILING_LIST_MULTI 1280 2.16 1.30 2.33 167 T_XMDrugObfuBody_00 1272 0.72 1.29 0.61 168 XM_UB60 1270 0.25 1.29 0.04 169 FROM_MISSP_REPLYTO 1251 0.21 1.27 0.00 170 HTML_FONT_FACE_BAD 1229 0.64 1.25 0.53 171 TR_XM_DK_Bayes2 1225 14.56 1.24 17.17 172 XMBrknScrpt_02 1187 0.70 1.21 0.60 173 DATE_IN_PAST_12_24 1186 0.30 1.20 0.12 174 UNPARSEABLE_RELAY 1179 2.19 1.20 2.38 175 RELAYCOUNTRY_DE 1170 0.58 1.19 0.46 176 TO_NO_BRKTS_FROM_MSSP 1169 0.20 1.19 0.01 177 RELAYCOUNTRY_AT 1160 0.36 1.18 0.20 178 XMStockSpam_06 1158 1.25 1.18 1.27 179 PLING_QUERY 1151 0.59 1.17 0.47 180 XMSubEmpty 1150 0.42 1.17 0.28 181 FILL_THIS_FORM 1141 0.72 1.16 0.63 182 DATE_IN_PAST_06_12 1128 0.28 1.15 0.11 183 XMPhish30 1123 0.67 1.14 0.57 184 FROM_SUSPICIOUS_NTLD 1102 0.23 1.12 0.05 185 XM_ProductURIs 1101 0.88 1.12 0.83 186 DEAR_SOMETHING 1090 0.30 1.11 0.14 187 FROM_MISSP_EH_MATCH 1085 0.19 1.10 0.01 188 RELAYCOUNTRY_HK 1064 0.19 1.08 0.01 189 FROM_SUSPICIOUS_NTLD_FP 1055 0.22 1.07 0.05 190 XM_UB99 1054 0.18 1.07 0.00 191 URI_TRY_3LD 1033 1.30 1.05 1.35 192 XM_UB80 1027 0.18 1.04 0.01 193 RDNS_DYNAMIC 1024 0.50 1.04 0.40 194 URIBL_BLACK 1011 0.22 1.03 0.06 195 THIS_AD 1011 0.43 1.03 0.32 196 XM_B_REG_HTML 1010 0.72 1.03 0.67 197 EBAY_IMG_NOT_RCVD_EBAY 1010 0.17 1.03 0.00 198 RELAYCOUNTRY_NG 1005 0.17 1.02 0.00 199 DKIM_ADSP_CUSTOM_MED 1000 1.03 1.02 1.04 200 MISSING_SUBJECT 994 0.23 1.01 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 432666 86.99 91.60 86.09 2 DKIM_SIGNED 388079 75.46 66.52 77.21 3 XM_DK_Pass 381404 73.85 63.45 75.89 4 DKIM_VALID 362236 70.03 59.58 72.07 5 XM_B_Unicode 340456 67.17 64.26 67.74 6 DCC_CHECK_NEGATIVE 278341 50.04 22.76 55.38 7 DKIM_VALID_AU 276258 53.24 44.42 54.97 8 XMListUnsubscribeExists 264604 54.26 62.47 52.65 9 BAYES_50 249014 50.04 52.56 49.55 10 DCC_CHECK 213196 47.72 74.79 42.42 11 XM_B_Unicode3 199424 40.07 42.09 39.68 12 T_TM2_M_HEADER_IN_MSG 152692 28.30 17.71 30.38 13 HTML_FONT_LOW_CONTRAST 149063 29.75 30.24 29.66 14 DKIM_VALID_EF 137068 26.27 21.15 27.27 15 BAYES_00 127765 21.90 3.94 25.42 16 LOC_TINY_FONT_1 119824 24.38 27.15 23.84 17 XMSubLong 108983 22.37 25.89 21.68 18 FVGT_m_MULTI_ODD 108064 21.63 22.29 21.50 19 TR_XM_DK_Bayes 106864 18.14 2.20 21.26 20 MIME_HTML_ONLY 106207 24.59 42.24 21.13 21 MultiRelay 103345 20.42 19.68 20.56 22 TR_XM_DK_Bayes1 101538 17.22 1.97 20.20 23 TR_XM_DK_Bayes2 86315 14.56 1.24 17.17 24 T_KAM_HTML_FONT_INVALID 85713 16.98 16.63 17.05 25 ALL_TRUSTED 73670 12.60 2.11 14.66 26 XM_Body_Dirty_Words 67120 14.19 18.45 13.35 27 XM_Multi_Part_URI 58716 12.71 17.94 11.68 28 XM_Evil_Numbers_Gen 49333 10.03 11.13 9.82 29 RCVD_IN_RP_SAFE 46878 8.04 1.45 9.33 30 TooManyTo_001 41619 8.22 7.90 8.28 31 HTML_IMAGE_RATIO_02 41016 8.94 12.94 8.16 32 LOTS_OF_MONEY 40598 9.73 18.16 8.08 33 T_XMDrugObfuBody_14 40409 8.17 8.83 8.04 34 RCVD_IN_RP_CERTIFIED 40201 6.80 0.67 8.00 35 LotsOfNums_01 40116 7.99 8.04 7.98 36 XM_DKIMWhitelistDomains 36763 6.12 0.02 7.31 37 RCVD_IN_MSPIKE_H2 35830 6.90 5.72 7.13 38 FSL_BULK_SIG 35712 9.33 20.71 7.11 39 BAYES_40 33557 6.55 5.90 6.68 40 XM_H_Long_From01 32511 6.67 7.69 6.47 41 XM_SendGrid 30131 5.55 3.30 6.00 42 T_TooManySym_01 28875 5.38 3.54 5.75 43 RELAYCOUNTRY_META 28786 9.55 29.07 5.73 44 HTML_IMAGE_RATIO_04 28725 5.68 5.47 5.72 45 MIME_QP_LONG_LINE 28001 5.45 4.85 5.57 46 BAYES_20 27364 5.36 4.91 5.44 47 XM_B_Phish_Phrases 25993 5.38 6.42 5.17 48 DKIM_INVALID 25843 5.44 6.94 5.14 49 XM_PDF 25685 4.40 0.79 5.11 50 XM_UncommonTLD01 25551 7.46 19.56 5.08 51 RCVD_IN_MSPIKE_WL 23990 4.51 3.15 4.77 52 BOTNET_IPINHOSTNAME 23733 7.75 23.18 4.72 53 RCVD_IN_IADB_LISTED 23708 4.27 2.00 4.72 54 XM_DK_Undo_02 23695 8.32 26.72 4.71 55 RCVD_IN_MSPIKE_H3 22330 4.15 2.64 4.44 56 XMSexyCombo_05 21717 5.50 11.50 4.32 57 RCVD_IN_IADB_SPF 20861 3.76 1.74 4.15 58 T_REMOTE_IMAGE 20493 5.51 12.79 4.08 59 XMStrtUSub 20390 3.96 3.44 4.06 60 XMSubMetaSx_00 19978 4.83 9.18 3.97 61 BAYES_05 19816 3.68 2.36 3.94 62 MPART_ALT_DIFF 19625 4.39 6.89 3.90 63 XMNumbers 18752 4.67 9.46 3.73 64 RCVD_IN_IADB_SENDERID 18479 3.35 1.69 3.68 65 RCVD_IN_IADB_DK 18077 3.28 1.68 3.60 66 IN_ZIMBRA_NJ_WHITELIST 17934 2.99 0.02 3.57 67 BAYES_60 17380 3.62 4.44 3.46 68 FROM_EXCESS_BASE64 16843 3.23 2.59 3.35 69 TR_XM_DK_SendGrid 16640 3.00 1.41 3.31 70 HTML_IMAGE_RATIO_06 16376 3.20 2.92 3.26 71 XM_B_SpammyTLD 16117 3.24 3.40 3.21 72 RCVD_IN_IADB_VOUCHED 15146 2.64 0.75 3.01 73 XM_DIRTYINTL 14866 3.51 6.34 2.96 74 HTML_MIME_NO_HTML_TAG 13846 3.40 6.68 2.75 75 TO_MALFORMED 13667 2.28 0.03 2.72 76 XM_SPF_SoftFail 13634 3.44 7.17 2.71 77 HTML_IMAGE_RATIO_08 13078 2.71 3.26 2.60 78 SpammyFromTLD_01 12820 2.73 3.62 2.55 79 BAYES_99 12568 4.89 17.12 2.50 80 MIME_HTML_MOSTLY 12384 2.70 3.92 2.46 81 UNPARSEABLE_RELAY 11967 2.19 1.20 2.38 82 TR_XM_PHPDW 11785 2.58 3.79 2.34 83 TooManyTo_002 11748 2.31 2.14 2.34 84 ANY_BOUNCE_MESSAGE 11740 2.04 0.50 2.34 85 BOUNCE_MESSAGE 11737 2.03 0.50 2.34 86 MAILING_LIST_MULTI 11716 2.16 1.30 2.33 87 TR_XM_PHPForged 11684 2.56 3.77 2.32 88 TR_XM_FormFill2 11657 2.55 3.74 2.32 89 XM_H_PHPOS 11643 2.55 3.73 2.32 90 T_TooManySym_02 10565 1.89 0.79 2.10 91 BAYES_999 10475 3.86 12.92 2.08 92 BOTNET 10472 5.76 24.51 2.08 93 MIME_HTML_ONLY_MULTI 10409 2.41 4.11 2.07 94 TVD_RCVD_IP 9972 2.10 2.68 1.98 95 KHOP_HELO_FCRDNS 9960 3.82 13.22 1.98 96 XM_CamelCaseFrm001 9741 2.08 2.83 1.94 97 URI_HEX 9722 2.11 2.99 1.93 98 RCVD_IN_IADB_OPTIN 9296 1.62 0.45 1.85 99 TM2_M_URI_OPT_OUT 9285 2.13 3.60 1.85 100 UNTRUSTED_Relay 9274 4.85 20.18 1.85 101 HELO_NODOT 9235 1.69 0.97 1.84 102 HELO_NO_DOMAIN 9233 1.69 0.96 1.84 103 XM_DK_Undo_01 9209 1.67 0.86 1.83 104 TR_MetaPhish_Combo_01 9138 1.65 0.79 1.82 105 XMDiploma_00 9078 1.83 1.93 1.81 106 XM_H_Long_From02 8880 2.69 7.43 1.77 107 BAYES_80 8715 2.33 5.35 1.73 108 SUBJ_ALL_CAPS 8692 2.09 3.95 1.73 109 CK_HELO_DYNAMIC_SPLIT_IP 8428 1.45 0.31 1.68 110 HELO_DYNAMIC_IPADDR2 8384 1.41 0.09 1.67 111 TooManyTo_003 8122 1.67 1.93 1.62 112 TR_Symld_Words 8105 1.60 1.54 1.61 113 XM_OfRef6 7923 1.81 3.01 1.58 114 IN_HORDE_ADDRESS_BOOK 7885 1.32 0.03 1.57 115 RELAYCOUNTRY_CA 7856 2.01 4.27 1.56 116 XMBdyGiftCard01 7749 1.38 0.58 1.54 117 INVALID_MSGID 7453 1.27 0.16 1.48 118 T_XMDrugObfuBody_08 7395 1.68 2.77 1.47 119 XMCapTrack 7098 1.23 0.32 1.41 120 URI_TRY_3LD 6773 1.30 1.05 1.35 121 XMStockSpam_06 6378 1.25 1.18 1.27 122 USER_IN_DEF_DKIM_WL 6300 1.05 0.02 1.25 123 TooManyTo_004 6208 1.32 1.76 1.24 124 NO_DNS_FOR_FROM 6152 1.42 2.41 1.22 125 TR_DCC_Bayes_99 6125 3.23 13.47 1.22 126 XMPhish11 5969 1.26 1.62 1.19 127 XMGenDplmaNmb 5951 1.22 1.43 1.18 128 RELAYCOUNTRY_GB 5756 1.42 2.82 1.15 129 XM_GoogleGroups 5682 1.02 0.46 1.13 130 XMSubMetaI_00 5570 1.14 1.30 1.11 131 TM2_M_VERY_LONG_WORD 5558 1.19 1.61 1.11 132 XMGappySubj_01 5380 0.96 0.37 1.07 133 TooManyTo_005 5294 1.15 1.64 1.05 134 DKIM_ADSP_CUSTOM_MED 5220 1.03 1.02 1.04 135 BAYES_95 5022 1.34 3.11 1.00 136 T_FILL_THIS_FORM_SHORT 4713 0.93 0.90 0.94 137 XM_UB50 4274 2.55 11.20 0.85 138 XM_ProductURIs 4183 0.88 1.12 0.83 139 T_XMHurry_00 4025 0.92 1.56 0.80 140 TR_XM_RelayPhish 3792 0.97 2.08 0.75 141 NML_ADSP_CUSTOM_MED 3663 0.75 0.84 0.73 142 XMSubNoVowel 3625 0.68 0.50 0.72 143 XMBody_17 3482 0.87 1.80 0.69 144 HTTPS_HTTP_MISMATCH 3414 0.69 0.73 0.68 145 XM_B_REG_HTML 3346 0.72 1.03 0.67 146 T_OBFU_PDF_ATTACH 3341 0.59 0.23 0.66 147 XMLngstWrd_00 3334 0.67 0.70 0.66 148 XMSexyCombo_01 3228 1.06 3.18 0.64 149 FILL_THIS_FORM 3185 0.72 1.16 0.63 150 US_DOLLARS_3 3175 1.12 3.59 0.63 151 XM_ShortIntro_01 3070 0.57 0.35 0.61 152 XMMoneyMeta_00 3064 1.10 3.59 0.61 153 T_XMDrugObfuBody_00 3051 0.72 1.29 0.61 154 XMBrknScrpt_02 3021 0.70 1.21 0.60 155 MISSING_HEADERS 3016 0.90 2.44 0.60 156 XMNoVowels 3015 0.60 0.62 0.60 157 XM_H_PHPMailer 2964 0.75 1.56 0.59 158 XMPhish30 2878 0.67 1.14 0.57 159 T_Symld_Words_02 2701 0.85 2.43 0.54 160 XMBody_95 2688 0.46 0.06 0.53 161 RCVD_IN_BL_SPAMCOP_NET 2673 1.28 5.09 0.53 162 T_TooManySym_03 2660 0.49 0.28 0.53 163 HTML_FONT_FACE_BAD 2641 0.64 1.25 0.53 164 DKIM_ADSP_NXDOMAIN 2552 1.14 4.37 0.51 165 TM2_M_BODY_EMPTY 2548 0.45 0.18 0.51 166 URI_NOVOWEL 2529 0.50 0.48 0.50 167 AC_DIV_BONANZA 2528 0.44 0.11 0.50 168 FORGED_GMAIL_RCVD 2512 0.55 0.79 0.50 169 HTML_IMAGE_ONLY_32 2506 0.48 0.39 0.50 170 SHORT_HELO_AND_INLINE_IMAGE 2482 0.42 0.03 0.49 171 HTML_TAG_BALANCE_BODY 2468 0.46 0.33 0.49 172 FILL_THIS_FORM_LONG 2465 0.48 0.45 0.49 173 XMDateMe_00 2461 0.47 0.36 0.49 174 XMHTMLBadTable_001 2455 0.51 0.62 0.49 175 XMBody_78 2419 0.62 1.30 0.48 176 FILL_THIS_FORM_LOAN 2399 0.43 0.19 0.48 177 XM_B_COPY_HTML 2398 0.52 0.76 0.48 178 USER_IN_WHITELIST 2390 0.40 0.00 0.48 179 TR_LOTS_OF_MONEY2 2389 0.79 2.42 0.48 180 T_MONEY_PERCENT 2389 0.79 2.42 0.48 181 PLING_QUERY 2384 0.59 1.17 0.47 182 XMHTML_After_End 2367 0.55 0.93 0.47 183 RELAYCOUNTRY_DE 2337 0.58 1.19 0.46 184 XM_Body_Obfu01 2335 0.50 0.70 0.46 185 T_MANY_PILL_PRICE 2280 0.38 0.01 0.45 186 XMPhish14 2276 0.51 0.79 0.45 187 XMSubMetaSxObfu_03 2272 0.61 1.39 0.45 188 RELAYCOUNTRY_AU 2256 0.45 0.47 0.45 189 RELAYCOUNTRY_FR 2250 1.32 5.78 0.45 190 XMSubMetaSxObfu_02 2218 0.42 0.31 0.44 191 SpammyFromTLD_02 2209 2.36 12.15 0.44 192 XMLngstWrd_01 2196 0.45 0.50 0.44 193 RCVD_IN_SORBS_DUL 2142 0.40 0.25 0.43 194 SUBJ_DOLLARS 2132 0.64 1.71 0.42 195 DIET_1 2131 0.58 1.35 0.42 196 HTML_IMAGE_ONLY_28 2047 0.48 0.82 0.41 197 RDNS_DYNAMIC 1993 0.50 1.04 0.40 198 REMOVE_BEFORE_LINK 1971 0.42 0.55 0.39 199 FROM_GOV_SPOOF 1950 0.37 0.29 0.39 200 XMOemUri 1894 0.34 0.12 0.38 ----------------------------------------------------------------------