Email: 686821 Autolearn: 0 AvgScore: 2.01 AvgScanTime: 2.32 sec Spam: 125895 Autolearn: 0 AvgScore: 12.28 AvgScanTime: 2.97 sec Ham: 560926 Autolearn: 0 AvgScore: -0.30 AvgScanTime: 2.17 sec Time Spent Running SA: 441.82 hours Time Spent Processing Spam: 103.85 hours Time Spent Processing Ham: 337.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 120776 88.07 95.93 86.30 2 DCC_CHECK 103377 50.92 82.11 43.92 3 DKIM_SIGNED 94911 75.46 75.39 75.48 4 XM_DK_Pass 88279 73.60 70.12 74.39 5 XM_B_Unicode 87451 68.76 69.46 68.60 6 XMListUnsubscribeExists 83948 56.23 66.68 53.88 7 DKIM_VALID 83291 70.28 66.16 71.21 8 DKIM_VALID_AU 65194 53.07 51.78 53.36 9 BAYES_50 62568 53.03 49.70 53.78 10 XM_B_Unicode3 57598 41.29 45.75 40.28 11 HTML_FONT_LOW_CONTRAST 47777 30.49 37.95 28.81 12 LOC_TINY_FONT_1 46584 26.08 37.00 23.63 13 MIME_HTML_ONLY 44660 22.84 35.47 20.01 14 XM_DK_Undo_02 40306 10.73 32.02 5.95 15 XMSubLong 33391 22.37 26.52 21.44 16 FVGT_m_MULTI_ODD 31506 21.76 25.03 21.03 17 DKIM_VALID_EF 30865 25.67 24.52 25.93 18 XM_Body_Dirty_Words 29891 14.61 23.74 12.57 19 RELAYCOUNTRY_META 29558 8.81 23.48 5.52 20 BAYES_99 29118 6.26 23.13 2.48 21 BOTNET 25541 5.56 20.29 2.25 22 BOTNET_IPINHOSTNAME 24596 7.57 19.54 4.88 23 T_KAM_HTML_FONT_INVALID 24371 18.51 19.36 18.32 24 FSL_BULK_SIG 24249 8.53 19.26 6.12 25 TR_DCC_Bayes_99 24038 4.41 19.09 1.11 26 BAYES_999 23336 4.98 18.54 1.94 27 XM_UncommonTLD01 23313 6.01 18.52 3.21 28 XM_Multi_Part_URI 21795 12.66 17.31 11.62 29 MultiRelay 21155 17.38 16.80 17.51 30 DCC_CHECK_NEGATIVE 20493 47.06 16.28 53.97 31 T_TM2_M_HEADER_IN_MSG 19652 25.86 15.61 28.16 32 UNTRUSTED_Relay 17456 3.99 13.87 1.78 33 SpammyFromTLD_02 17185 2.86 13.65 0.44 34 HTML_IMAGE_RATIO_02 16212 9.48 12.88 8.71 35 LOTS_OF_MONEY 15995 9.18 12.71 8.39 36 XM_B_Unsub 15325 9.84 12.17 9.32 37 XM_Evil_Numbers_Gen 14937 10.14 11.86 9.75 38 XMSexyCombo_05 13584 5.11 10.79 3.83 39 T_XMDrugObfuBody_14 13093 8.51 10.40 8.09 40 XM_B_SpammyTLD 12896 3.59 10.24 2.10 41 TooManyTo_001 12855 8.10 10.21 7.63 42 DKIM_INVALID 11620 5.18 9.23 4.27 43 T_REMOTE_IMAGE 11495 4.66 9.13 3.65 44 XMSubMetaSx_00 11395 4.76 9.05 3.80 45 LotsOfNums_01 10445 8.13 8.30 8.09 46 HTML_IMAGE_RATIO_04 10319 6.05 8.20 5.57 47 MPART_ALT_DIFF 9824 4.38 7.80 3.61 48 XM_UB50 9695 2.18 7.70 0.95 49 XM_B_Phish_Phrases 9534 6.36 7.57 6.08 50 HTML_MIME_NO_HTML_TAG 9450 3.11 7.51 2.12 51 HTML_SHORT_LINK_IMG_1 9379 1.39 7.45 0.03 52 XM_H_Long_From01 7771 6.71 6.17 6.83 53 FROM_SUSPICIOUS_NTLD 7721 1.19 6.13 0.08 54 FROM_SUSPICIOUS_NTLD_FP 7687 1.18 6.11 0.08 55 XM_DIRTYINTL 7371 3.16 5.85 2.55 56 RCVD_IN_MSPIKE_H2 7330 6.76 5.82 6.97 57 XMNumbers 7244 4.37 5.75 4.06 58 MIME_QP_LONG_LINE 7098 5.94 5.64 6.00 59 HDRS_LCASE_IMGONLY 7097 1.06 5.64 0.03 60 MIME_HTML_MOSTLY 6911 2.99 5.49 2.43 61 BODY_URI_ONLY 6552 1.02 5.20 0.08 62 BAYES_80 6550 2.62 5.20 2.04 63 RELAYCOUNTRY_GB 5895 1.75 4.68 1.09 64 BAYES_40 5798 7.67 4.61 8.36 65 XM_SendGrid 5631 5.84 4.47 6.15 66 BAYES_60 5623 4.24 4.47 4.19 67 HTML_IMAGE_ONLY_08 5449 0.88 4.33 0.11 68 T_HTML_TAG_BALANCE_CENTER 5408 0.98 4.30 0.24 69 XM_H_TOP 5198 0.76 4.13 0.01 70 KHOP_HELO_FCRDNS 5188 2.17 4.12 1.73 71 RELAYCOUNTRY_FR 5104 1.10 4.05 0.43 72 XM_CamelCaseFrm001 5088 2.46 4.04 2.11 73 XM_BadFromFormat 5033 0.83 4.00 0.11 74 MIME_HEADER_CTYPE_ONLY 5003 0.82 3.97 0.11 75 URI_HEX 4973 2.15 3.95 1.75 76 BAYES_00 4903 15.67 3.89 18.32 77 RCVD_IN_BL_SPAMCOP_NET 4789 1.67 3.80 1.19 78 XM_URI_RBL 4772 0.93 3.79 0.29 79 XMStrtUSub 4762 4.23 3.78 4.33 80 TM2_M_URI_OPT_OUT 4707 2.10 3.74 1.74 81 MIME_HTML_ONLY_MULTI 4693 2.40 3.73 2.10 82 BAYES_20 4683 5.73 3.72 6.18 83 XM_SPF_SoftFail 4622 2.10 3.67 1.75 84 XMDiploma_00 4554 2.17 3.62 1.85 85 HTML_IMAGE_ONLY_12 4305 0.76 3.42 0.16 86 NORDNS_LOW_CONTRAST 4305 0.64 3.42 0.02 87 DKIM_ADSP_NXDOMAIN 4271 0.95 3.39 0.40 88 HTML_IMAGE_RATIO_06 4241 3.57 3.37 3.62 89 DATE_IN_PAST_03_06 4219 0.76 3.35 0.18 90 XMSexyCombo_01 4145 1.12 3.29 0.64 91 REPLYTO_WITHOUT_TO_CC 4127 0.63 3.28 0.04 92 RELAYCOUNTRY_CA 4122 1.90 3.27 1.59 93 NO_DNS_FOR_FROM 4117 1.36 3.27 0.94 94 BOTNET_NORDNS 3933 0.61 3.12 0.04 95 FROM_EXCESS_BASE64 3824 3.70 3.04 3.85 96 BAYES_95 3624 1.52 2.88 1.22 97 T_XMDrugObfuBody_08 3584 1.73 2.85 1.47 98 XM_B_Unsub2 3419 2.00 2.72 1.84 99 T_TooManySym_01 3386 3.57 2.69 3.77 100 SpammyFromTLD_01 3309 1.22 2.63 0.91 101 TO_EQ_FM_DOM_HTML_IMG 3241 0.48 2.57 0.01 102 RCVD_IN_RP_RNBL 3237 0.50 2.57 0.04 103 SUBJ_ALL_CAPS 3123 1.59 2.48 1.39 104 HTML_IMAGE_RATIO_08 3092 2.18 2.46 2.12 105 TR_LOTS_OF_MONEY2 3020 0.88 2.40 0.53 106 T_MONEY_PERCENT 3020 0.88 2.40 0.53 107 TR_XM_DK_SendGrid 2891 2.98 2.30 3.13 108 MultiRelay_CC 2742 0.57 2.18 0.21 109 MultiRelay_Combo 2742 0.57 2.18 0.21 110 RELAYCOUNTRY_DE 2733 0.72 2.17 0.39 111 BAYES_05 2721 2.96 2.16 3.14 112 XM_OfRef6 2686 1.51 2.13 1.37 113 XMMoneyMeta_00 2654 0.89 2.11 0.62 114 XMGenDplmaNmb 2649 1.37 2.10 1.20 115 TM2_M_VERY_LONG_WORD 2619 1.36 2.08 1.20 116 TR_XM_PHPDW 2603 1.28 2.07 1.10 117 TR_XM_PHPForged 2577 1.27 2.05 1.09 118 TR_XM_FormFill2 2568 1.26 2.04 1.09 119 XM_H_PHPOS 2565 1.26 2.04 1.08 120 RCVD_IN_IADB_LISTED 2526 4.66 2.01 5.25 121 RCVD_IN_RP_SAFE 2522 8.36 2.00 9.79 122 RCVD_IN_IADB_SPF 2423 4.08 1.92 4.57 123 US_DOLLARS_3 2413 0.88 1.92 0.65 124 HDRS_MISSP 2409 0.35 1.91 0.00 125 RCVD_IN_IADB_DK 2393 3.59 1.90 3.97 126 RCVD_IN_IADB_SENDERID 2390 3.63 1.90 4.01 127 XMStockSpam_06 2302 1.03 1.83 0.85 128 XMHTML_After_End 2245 1.25 1.78 1.14 129 TR_XM_RelayPhish 2237 1.09 1.78 0.94 130 TR_XM_INV_DKIM 2199 0.40 1.75 0.09 131 XMSexyCombo_04 2131 0.43 1.69 0.14 132 XMPhish11 2119 1.30 1.68 1.22 133 XMBody_17 2019 0.76 1.60 0.57 134 RCVD_IN_PSBL 2011 0.33 1.60 0.04 135 DIET_1 1971 0.56 1.57 0.33 136 RCVD_IN_MSPIKE_BL 1966 0.33 1.56 0.05 137 HTML_FONT_FACE_BAD 1939 0.79 1.54 0.62 138 T_Symld_Words_02 1939 0.97 1.54 0.84 139 XM_DK_Undo_01 1923 1.39 1.53 1.36 140 T_XMDrugObfuBody_00 1900 0.98 1.51 0.86 141 SUBJECT_NEEDS_ENCODING 1879 0.28 1.49 0.01 142 TR_XM_DK_Bayes 1862 12.72 1.48 15.24 143 SUBJ_ILLEGAL_CHARS 1857 0.28 1.48 0.01 144 TR_M_TOP_BAYES 1839 0.27 1.46 0.00 145 TR_Symld_Words 1825 2.00 1.45 2.13 146 XMBody_78 1824 0.61 1.45 0.42 147 XMSubMetaI_00 1814 1.06 1.44 0.98 148 FROM_MISSP_REPLYTO 1811 0.27 1.44 0.00 149 ALL_TRUSTED 1768 14.27 1.40 17.16 150 T_XMHurry_00 1739 0.83 1.38 0.71 151 RDNS_DYNAMIC 1710 0.51 1.36 0.32 152 URI_TRY_3LD 1707 1.27 1.36 1.25 153 TR_LOTS_OF_MONEY3 1704 0.65 1.35 0.49 154 RCVD_IN_MSPIKE_WL 1694 4.95 1.35 5.75 155 XM_UB60 1684 0.30 1.34 0.06 156 XM_H_Long_From02 1682 1.25 1.34 1.23 157 TR_XM_DK_Bayes1 1677 12.17 1.33 14.61 158 MAILING_LIST_MULTI 1656 2.16 1.32 2.34 159 XMSubMetaSxObfu_03 1655 0.58 1.31 0.42 160 RELAYCOUNTRY_IN 1607 0.36 1.28 0.16 161 XM_XX_Yahoo 1590 0.32 1.26 0.10 162 RCVD_IN_RP_CERTIFIED 1588 7.18 1.26 8.51 163 UNPARSEABLE_RELAY 1572 2.01 1.25 2.18 164 XMSubNoVowel 1568 0.45 1.25 0.27 165 SUBJ_DOLLARS 1556 0.48 1.24 0.31 166 URI_NOVOWEL 1542 0.61 1.22 0.47 167 XM_H_PHPMailer 1540 0.61 1.22 0.48 168 HTML_EXTRA_CLOSE 1512 0.23 1.20 0.01 169 XMBdyGiftCard01 1512 1.55 1.20 1.63 170 HK_RANDOM_REPLYTO 1504 0.43 1.19 0.25 171 DATE_IN_PAST_06_12 1485 0.36 1.18 0.18 172 XMBrknScrpt_02 1479 0.87 1.17 0.80 173 TR_Mismatch_TLD_02 1387 0.26 1.10 0.08 174 URIBL_DBL_ABUSE_REDIR 1358 0.20 1.08 0.01 175 XMPhish30 1313 0.66 1.04 0.57 176 LongTLD 1300 0.36 1.03 0.21 177 PLING_QUERY 1299 0.51 1.03 0.39 178 XM_H_PHPOS_M 1298 0.34 1.03 0.18 179 XMBSHREFv2 1298 0.43 1.03 0.30 180 RCVD_IN_MSPIKE_H3 1259 3.79 1.00 4.41 181 XM_Combo_Sbj 1257 0.45 1.00 0.32 182 TR_MetaPhish_Combo_01 1253 0.98 1.00 0.97 183 RELAYCOUNTRY_AT 1213 0.33 0.96 0.19 184 RCVD_IN_MSPIKE_L5 1192 0.20 0.95 0.03 185 XMPhish14 1137 0.63 0.90 0.57 186 XM_ProductURIs 1130 0.89 0.90 0.89 187 XMSubMetaSx_01 1124 0.23 0.89 0.08 188 TR_XM_DK_Bayes2 1124 10.45 0.89 12.59 189 XM_B_COPY_HTML 1108 0.45 0.88 0.35 190 DKIM_ADSP_CUSTOM_MED 1092 0.90 0.87 0.91 191 XM_UB80 1072 0.17 0.85 0.02 192 XM_UB99 1062 0.16 0.84 0.01 193 BODY_ENHANCEMENT 1051 0.24 0.83 0.11 194 XMHTMLBadTable_001 1035 0.57 0.82 0.52 195 XM_PDF 1010 3.47 0.80 4.07 196 XMGppyBdWords 1004 0.26 0.80 0.14 197 LONG_HEX_URI 994 0.28 0.79 0.17 198 FORGED_GMAIL_RCVD 962 0.54 0.76 0.49 199 HELO_NODOT 961 1.39 0.76 1.54 200 T_FILL_THIS_FORM_SHORT 952 0.75 0.76 0.75 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 484099 88.07 95.93 86.30 2 DKIM_SIGNED 423364 75.46 75.39 75.48 3 XM_DK_Pass 417249 73.60 70.12 74.39 4 DKIM_VALID 399412 70.28 66.16 71.21 5 XM_B_Unicode 384811 68.76 69.46 68.60 6 DCC_CHECK_NEGATIVE 302735 47.06 16.28 53.97 7 XMListUnsubscribeExists 302248 56.23 66.68 53.88 8 BAYES_50 301682 53.03 49.70 53.78 9 DKIM_VALID_AU 299315 53.07 51.78 53.36 10 DCC_CHECK 246367 50.92 82.11 43.92 11 XM_B_Unicode3 225968 41.29 45.75 40.28 12 HTML_FONT_LOW_CONTRAST 161613 30.49 37.95 28.81 13 T_TM2_M_HEADER_IN_MSG 157943 25.86 15.61 28.16 14 DKIM_VALID_EF 145470 25.67 24.52 25.93 15 LOC_TINY_FONT_1 132531 26.08 37.00 23.63 16 XMSubLong 120264 22.37 26.52 21.44 17 FVGT_m_MULTI_ODD 117939 21.76 25.03 21.03 18 MIME_HTML_ONLY 112238 22.84 35.47 20.01 19 T_KAM_HTML_FONT_INVALID 102782 18.51 19.36 18.32 20 BAYES_00 102756 15.67 3.89 18.32 21 MultiRelay 98201 17.38 16.80 17.51 22 ALL_TRUSTED 96264 14.27 1.40 17.16 23 TR_XM_DK_Bayes 85504 12.72 1.48 15.24 24 TR_XM_DK_Bayes1 81929 12.17 1.33 14.61 25 TR_XM_DK_Bayes2 70624 10.45 0.89 12.59 26 XM_Body_Dirty_Words 70487 14.61 23.74 12.57 27 XM_Multi_Part_URI 65188 12.66 17.31 11.62 28 RCVD_IN_RP_SAFE 54898 8.36 2.00 9.79 29 XM_Evil_Numbers_Gen 54710 10.14 11.86 9.75 30 XM_B_Unsub 52267 9.84 12.17 9.32 31 HTML_IMAGE_RATIO_02 48878 9.48 12.88 8.71 32 RCVD_IN_RP_CERTIFIED 47720 7.18 1.26 8.51 33 LOTS_OF_MONEY 47076 9.18 12.71 8.39 34 BAYES_40 46875 7.67 4.61 8.36 35 LotsOfNums_01 45393 8.13 8.30 8.09 36 T_XMDrugObfuBody_14 45381 8.51 10.40 8.09 37 TooManyTo_001 42787 8.10 10.21 7.63 38 XM_DKIMWhitelistDomains 41671 6.07 0.03 7.43 39 RCVD_IN_MSPIKE_H2 39089 6.76 5.82 6.97 40 XM_H_Long_From01 38309 6.71 6.17 6.83 41 BAYES_20 34644 5.73 3.72 6.18 42 XM_SendGrid 34474 5.84 4.47 6.15 43 FSL_BULK_SIG 34309 8.53 19.26 6.12 44 XM_B_Phish_Phrases 34131 6.36 7.57 6.08 45 MIME_QP_LONG_LINE 33671 5.94 5.64 6.00 46 XM_DK_Undo_02 33378 10.73 32.02 5.95 47 RCVD_IN_MSPIKE_WL 32273 4.95 1.35 5.75 48 HTML_IMAGE_RATIO_04 31236 6.05 8.20 5.57 49 RELAYCOUNTRY_META 30970 8.81 23.48 5.52 50 ANY_BOUNCE_MESSAGE 30022 4.44 0.39 5.35 51 BOUNCE_MESSAGE 30017 4.44 0.39 5.35 52 RCVD_IN_IADB_LISTED 29464 4.66 2.01 5.25 53 BOTNET_IPINHOSTNAME 27401 7.57 19.54 4.88 54 RCVD_IN_IADB_SPF 25620 4.08 1.92 4.57 55 RCVD_IN_MSPIKE_H3 24745 3.79 1.00 4.41 56 XMStrtUSub 24291 4.23 3.78 4.33 57 DKIM_INVALID 23952 5.18 9.23 4.27 58 BAYES_60 23515 4.24 4.47 4.19 59 XM_PDF 22813 3.47 0.80 4.07 60 XMNumbers 22786 4.37 5.75 4.06 61 RCVD_IN_IADB_SENDERID 22516 3.63 1.90 4.01 62 RCVD_IN_IADB_DK 22245 3.59 1.90 3.97 63 FROM_EXCESS_BASE64 21569 3.70 3.04 3.85 64 XMSexyCombo_05 21486 5.11 10.79 3.83 65 XMSubMetaSx_00 21322 4.76 9.05 3.80 66 T_TooManySym_01 21140 3.57 2.69 3.77 67 T_REMOTE_IMAGE 20481 4.66 9.13 3.65 68 HTML_IMAGE_RATIO_06 20305 3.57 3.37 3.62 69 MPART_ALT_DIFF 20273 4.38 7.80 3.61 70 RCVD_IN_IADB_VOUCHED 18930 2.87 0.64 3.37 71 IN_ZIMBRA_NJ_WHITELIST 18490 2.69 0.02 3.30 72 XM_UncommonTLD01 17979 6.01 18.52 3.21 73 BAYES_05 17624 2.96 2.16 3.14 74 TR_XM_DK_SendGrid 17559 2.98 2.30 3.13 75 XM_DIRTYINTL 14320 3.16 5.85 2.55 76 BAYES_99 13909 6.26 23.13 2.48 77 MIME_HTML_MOSTLY 13604 2.99 5.49 2.43 78 MAILING_LIST_MULTI 13152 2.16 1.32 2.34 79 BOTNET 12636 5.56 20.29 2.25 80 UNPARSEABLE_RELAY 12237 2.01 1.25 2.18 81 TR_Symld_Words 11935 2.00 1.45 2.13 82 HTML_MIME_NO_HTML_TAG 11919 3.11 7.51 2.12 83 RCVD_IN_IADB_OPTIN 11902 1.80 0.39 2.12 84 HTML_IMAGE_RATIO_08 11868 2.18 2.46 2.12 85 XM_CamelCaseFrm001 11829 2.46 4.04 2.11 86 MIME_HTML_ONLY_MULTI 11804 2.40 3.73 2.10 87 XM_B_SpammyTLD 11769 3.59 10.24 2.10 88 BAYES_80 11470 2.62 5.20 2.04 89 BAYES_999 10901 4.98 18.54 1.94 90 TooManyTo_002 10532 1.66 0.71 1.88 91 XMDiploma_00 10369 2.17 3.62 1.85 92 XM_B_Unsub2 10343 2.00 2.72 1.84 93 UNTRUSTED_Relay 9957 3.99 13.87 1.78 94 T_TooManySym_02 9901 1.55 0.59 1.77 95 TVD_RCVD_IP 9825 1.49 0.34 1.75 96 URI_HEX 9822 2.15 3.95 1.75 97 XM_SPF_SoftFail 9811 2.10 3.67 1.75 98 TM2_M_URI_OPT_OUT 9743 2.10 3.74 1.74 99 KHOP_HELO_FCRDNS 9718 2.17 4.12 1.73 100 XMBdyGiftCard01 9146 1.55 1.20 1.63 101 RELAYCOUNTRY_CA 8938 1.90 3.27 1.59 102 HELO_NODOT 8617 1.39 0.76 1.54 103 HELO_NO_DOMAIN 8614 1.36 0.60 1.54 104 T_XMDrugObfuBody_08 8272 1.73 2.85 1.47 105 IN_HORDE_ADDRESS_BOOK 8240 1.21 0.03 1.47 106 CK_HELO_DYNAMIC_SPLIT_IP 7972 1.26 0.56 1.42 107 HELO_DYNAMIC_IPADDR2 7933 1.17 0.06 1.41 108 SUBJ_ALL_CAPS 7814 1.59 2.48 1.39 109 XM_OfRef6 7686 1.51 2.13 1.37 110 XM_DK_Undo_01 7615 1.39 1.53 1.36 111 INVALID_MSGID 7497 1.14 0.28 1.34 112 XMCapTrack 7368 1.13 0.32 1.31 113 TooManyTo_003 7076 1.13 0.57 1.26 114 URI_TRY_3LD 7031 1.27 1.36 1.25 115 TO_MALFORMED 7024 1.04 0.11 1.25 116 XM_H_Long_From02 6905 1.25 1.34 1.23 117 BAYES_95 6820 1.52 2.88 1.22 118 XMPhish11 6818 1.30 1.68 1.22 119 XMGenDplmaNmb 6733 1.37 2.10 1.20 120 TM2_M_VERY_LONG_WORD 6726 1.36 2.08 1.20 121 RCVD_IN_BL_SPAMCOP_NET 6652 1.67 3.80 1.19 122 XMHTML_After_End 6371 1.25 1.78 1.14 123 TR_DCC_Bayes_99 6246 4.41 19.09 1.11 124 TR_XM_PHPDW 6189 1.28 2.07 1.10 125 RELAYCOUNTRY_GB 6121 1.75 4.68 1.09 126 TR_XM_PHPForged 6116 1.27 2.05 1.09 127 TR_XM_FormFill2 6109 1.26 2.04 1.09 128 XM_H_PHPOS 6086 1.26 2.04 1.08 129 XM_GoogleGroups 6028 0.97 0.50 1.07 130 USER_IN_DEF_DKIM_WL 5986 0.87 0.00 1.07 131 XMSubMetaI_00 5480 1.06 1.44 0.98 132 XMGappySubj_01 5469 0.86 0.34 0.97 133 TR_MetaPhish_Combo_01 5449 0.98 1.00 0.97 134 TooManyTo_004 5322 0.86 0.46 0.95 135 XM_UB50 5305 2.18 7.70 0.95 136 TR_XM_RelayPhish 5258 1.09 1.78 0.94 137 NO_DNS_FOR_FROM 5252 1.36 3.27 0.94 138 DKIM_ADSP_CUSTOM_MED 5117 0.90 0.87 0.91 139 SpammyFromTLD_01 5091 1.22 2.63 0.91 140 XM_ProductURIs 4973 0.89 0.90 0.89 141 T_XMDrugObfuBody_00 4845 0.98 1.51 0.86 142 XMStockSpam_06 4757 1.03 1.83 0.85 143 T_Symld_Words_02 4726 0.97 1.54 0.84 144 XMBrknScrpt_02 4492 0.87 1.17 0.80 145 TooManyTo_005 4456 0.72 0.38 0.79 146 RCVD_IN_MSPIKE_H5 4272 0.64 0.08 0.76 147 T_FILL_THIS_FORM_SHORT 4220 0.75 0.76 0.75 148 URIBL_CSS_A 4193 0.72 0.58 0.75 149 URIBL_CSS 4193 0.72 0.58 0.75 150 T_XMHurry_00 3979 0.83 1.38 0.71 151 HTTPS_HTTP_MISMATCH 3919 0.67 0.55 0.70 152 US_DOLLARS_3 3656 0.88 1.92 0.65 153 XM_SPF_Unknown 3654 0.67 0.73 0.65 154 FROM_GOV_DKIM_AU 3635 0.56 0.16 0.65 155 XMSexyCombo_01 3571 1.12 3.29 0.64 156 XM_B_REG_HTML 3554 0.65 0.70 0.63 157 TO_NO_BRKTS_HTML_ONLY 3533 0.56 0.25 0.63 158 HTML_FONT_FACE_BAD 3500 0.79 1.54 0.62 159 XMMoneyMeta_00 3460 0.89 2.11 0.62 160 NML_ADSP_CUSTOM_MED 3448 0.62 0.65 0.61 161 RCVD_IN_MSPIKE_H4 3256 0.52 0.27 0.58 162 XMBody_95 3253 0.49 0.08 0.58 163 XMPhish30 3207 0.66 1.04 0.57 164 XMPhish14 3202 0.63 0.90 0.57 165 XMBody_17 3171 0.76 1.60 0.57 166 HTML_TAG_BALANCE_BODY 3125 0.59 0.72 0.56 167 TR_LOTS_OF_MONEY2 2996 0.88 2.40 0.53 168 T_MONEY_PERCENT 2996 0.88 2.40 0.53 169 XM_ShortIntro_01 2984 0.49 0.30 0.53 170 XMLngstWrd_00 2926 0.49 0.35 0.52 171 RELAYCOUNTRY_AU 2914 0.51 0.46 0.52 172 XMHTMLBadTable_001 2909 0.57 0.82 0.52 173 T_OBFU_PDF_ATTACH 2817 0.45 0.24 0.50 174 TR_LOTS_OF_MONEY3 2771 0.65 1.35 0.49 175 XMNoVowels 2755 0.49 0.49 0.49 176 FORGED_GMAIL_RCVD 2752 0.54 0.76 0.49 177 XMLngstWrd_01 2736 0.46 0.33 0.49 178 T_TooManySym_03 2697 0.43 0.23 0.48 179 XM_H_PHPMailer 2673 0.61 1.22 0.48 180 URI_NOVOWEL 2654 0.61 1.22 0.47 181 FROM_GOV_SPOOF 2624 0.45 0.37 0.47 182 FILL_THIS_FORM 2523 0.47 0.56 0.45 183 TM2_M_BODY_EMPTY 2517 0.39 0.10 0.45 184 XMSlimDrugH 2480 0.49 0.72 0.44 185 SpammyFromTLD_02 2479 2.86 13.65 0.44 186 XMSubMetaSxObfu_02 2467 0.41 0.30 0.44 187 RELAYCOUNTRY_FR 2428 1.10 4.05 0.43 188 MISSING_HEADERS 2385 0.44 0.53 0.43 189 USER_IN_WHITELIST 2383 0.35 0.00 0.42 190 XMBody_78 2376 0.61 1.45 0.42 191 SHORT_HELO_AND_INLINE_IMAGE 2369 0.36 0.10 0.42 192 TM2_M_A_HREF_HREF 2362 0.46 0.64 0.42 193 XMSubMetaSxObfu_03 2342 0.58 1.31 0.42 194 DKIM_ADSP_NXDOMAIN 2267 0.95 3.39 0.40 195 HTML_IMAGE_ONLY_32 2217 0.38 0.32 0.40 196 PLING_QUERY 2191 0.51 1.03 0.39 197 REMOVE_BEFORE_LINK 2189 0.41 0.51 0.39 198 RELAYCOUNTRY_DE 2183 0.72 2.17 0.39 199 RCVD_IN_SORBS_DUL 2120 0.36 0.27 0.38 200 XM_RXBody 2105 0.35 0.26 0.38 ----------------------------------------------------------------------