Email: 614355 Autolearn: 0 AvgScore: 1.43 AvgScanTime: 2.03 sec Spam: 113731 Autolearn: 0 AvgScore: 11.98 AvgScanTime: 3.72 sec Ham: 500624 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 1.65 sec Time Spent Running SA: 347.13 hours Time Spent Processing Spam: 117.59 hours Time Spent Processing Ham: 229.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 105476 89.43 92.74 88.68 2 DKIM_SIGNED 89764 75.36 78.93 74.55 3 DCC_CHECK 88684 45.69 77.98 38.36 4 XM_DK_Pass 85674 73.34 75.33 72.88 5 RELAYCOUNTRY_US 85533 81.27 75.21 82.65 6 XM_B_Unicode 80151 69.66 70.47 69.48 7 XMListUnsubscribeExists 76443 52.59 67.21 49.27 8 DKIM_VALID 72475 67.53 63.72 68.39 9 DKIM_VALID_AU 53711 49.08 47.23 49.50 10 BAYES_50 53086 51.98 46.68 53.19 11 XM_DK_Undo_02 46433 13.06 40.83 6.75 12 XM_B_Unicode3 46389 38.69 40.79 38.22 13 MIME_HTML_ONLY 39377 22.91 34.62 20.25 14 LOC_TINY_FONT_1 37660 23.79 33.11 21.68 15 HTML_FONT_LOW_CONTRAST 34616 26.85 30.44 26.03 16 FVGT_m_MULTI_ODD 32749 23.32 28.80 22.07 17 DKIM_VALID_EF 31302 26.43 27.52 26.18 18 RELAYCOUNTRY_META 28908 9.48 25.42 5.86 19 BAYES_99 28716 7.13 25.25 3.02 20 XMSubLong 27747 21.73 24.40 21.13 21 BOTNET 26978 6.87 23.72 3.04 22 T_KAM_HTML_FONT_INVALID 24625 18.56 21.65 17.86 23 T_TM2_M_HEADER_IN_MSG 23455 28.62 20.62 30.43 24 DCC_CHECK_NEGATIVE 23053 52.23 20.27 59.49 25 XM_Body_Dirty_Words 22721 13.28 19.98 11.76 26 TR_DCC_Bayes_99 22075 4.80 19.41 1.48 27 BAYES_999 21893 5.49 19.25 2.36 28 XM_UncommonTLD01 20886 6.25 18.36 3.50 29 BOTNET_IPINHOSTNAME 19808 7.07 17.42 4.72 30 UNTRUSTED_Relay 19191 4.42 16.87 1.59 31 XM_Multi_Part_URI 18375 12.11 16.16 11.20 32 FSL_BULK_SIG 17555 8.37 15.44 6.76 33 DKIM_INVALID 17289 7.83 15.20 6.16 34 LotsOfNums_01 14967 9.17 13.16 8.27 35 HTML_IMAGE_RATIO_02 14401 9.00 12.66 8.17 36 XM_Evil_Numbers_Gen 13883 9.55 12.21 8.95 37 XM_B_Unsub 13637 9.99 11.99 9.54 38 XMSexyCombo_05 13177 4.86 11.59 3.33 39 NO_DNS_FOR_FROM 12879 4.63 11.32 3.11 40 LOTS_OF_MONEY 12868 8.08 11.31 7.35 41 XM_B_Phish_Phrases 12608 8.95 11.09 8.47 42 XM_UB50 11246 2.60 9.89 0.95 43 RCVD_IN_MSPIKE_H2 9910 13.01 8.71 13.99 44 RCVD_IN_MSPIKE_BL 8642 2.81 7.60 1.72 45 KHOP_HELO_FCRDNS 8592 3.28 7.55 2.31 46 BAYES_60 8523 5.98 7.49 5.64 47 RCVD_IN_MSPIKE_L3 8428 2.66 7.41 1.58 48 XM_H_Long_From01 8295 5.84 7.29 5.51 49 TooManyTo_001 7608 9.02 6.69 9.55 50 XM_SPF_SoftFail 7552 2.78 6.64 1.90 51 XM_B_SpammyTLD 7512 3.03 6.61 2.22 52 BAYES_80 7472 3.61 6.57 2.94 53 MIME_QP_LONG_LINE 7368 6.25 6.48 6.20 54 HTML_IMAGE_RATIO_04 6970 4.29 6.13 3.87 55 XMSubMetaSx_00 6944 3.22 6.11 2.56 56 UNPARSEABLE_RELAY 6788 8.30 5.97 8.83 57 SpammyFromTLD_02 6606 1.25 5.81 0.21 58 MPART_ALT_DIFF 6454 5.13 5.67 5.01 59 PDS_OTHER_BAD_TLD 6272 1.49 5.51 0.58 60 FROM_SUSPICIOUS_NTLD 6263 1.05 5.51 0.04 61 FROM_SUSPICIOUS_NTLD_FP 6208 1.04 5.46 0.03 62 XM_SendGrid 5779 6.67 5.08 7.03 63 T_REMOTE_IMAGE 5658 4.26 4.97 4.10 64 RELAYCOUNTRY_CA 5409 2.14 4.76 1.55 65 XMNumbers 5187 3.46 4.56 3.21 66 RELAYCOUNTRY_FR 4832 1.00 4.25 0.26 67 MIME_HTML_MOSTLY 4731 2.62 4.16 2.27 68 RDNS_DYNAMIC 4645 1.02 4.08 0.33 69 TM2_M_URI_OPT_OUT 4484 2.98 3.94 2.77 70 RCVD_IN_BL_SPAMCOP_NET 4444 1.42 3.91 0.86 71 XM_CamelCaseFrm001 4311 2.36 3.79 2.04 72 LongTLD 4290 0.86 3.77 0.19 73 HTML_MIME_NO_HTML_TAG 4186 3.02 3.68 2.87 74 XMStrtUSub 4090 4.59 3.60 4.82 75 FROM_MISSP_REPLYTO 4048 0.68 3.56 0.02 76 XM_URI_RBL 3954 0.82 3.48 0.21 77 BAYES_40 3873 5.15 3.41 5.55 78 DATE_IN_PAST_06_12 3813 0.66 3.35 0.04 79 SUBJ_ALL_CAPS 3705 1.80 3.26 1.47 80 BAYES_95 3627 1.94 3.19 1.66 81 RCVD_IN_RP_RNBL 3562 0.62 3.13 0.05 82 T_XMDrugObfuBody_08 3463 1.93 3.04 1.67 83 HTML_SHORT_LINK_IMG_1 3442 0.58 3.03 0.02 84 BAYES_00 3359 17.27 2.95 20.52 85 XMBody_17 3345 1.00 2.94 0.56 86 HTML_IMAGE_RATIO_06 3335 3.27 2.93 3.35 87 XM_B_Unsub2 3328 2.16 2.93 1.98 88 RCVD_IN_MSPIKE_WL 3316 7.94 2.92 9.08 89 RCVD_IN_MSPIKE_H3 3316 7.94 2.92 9.08 90 BAYES_20 3311 4.19 2.91 4.48 91 XM_DIRTYINTL 3181 0.95 2.80 0.54 92 RCVD_IN_RP_SAFE 3146 6.57 2.77 7.44 93 FROM_MISSP_DYNIP 3136 0.51 2.76 0.00 94 HEXHASH_WORD 3114 0.51 2.74 0.00 95 RELAYCOUNTRY_DE 3057 0.95 2.69 0.55 96 XMNoVowels 2972 1.94 2.61 1.79 97 SpammyFromTLD_01 2967 1.22 2.61 0.91 98 FROM_EXCESS_BASE64 2909 2.97 2.56 3.06 99 XM_OfRef6 2880 1.55 2.53 1.32 100 DKIM_ADSP_NXDOMAIN 2814 0.67 2.47 0.26 101 T_TooManySym_01 2739 4.05 2.41 4.42 102 MIME_HTML_ONLY_MULTI 2716 3.08 2.39 3.23 103 DATE_IN_PAST_03_06 2684 0.52 2.36 0.10 104 RCVD_IN_IADB_LISTED 2593 4.78 2.28 5.35 105 TR_XM_INV_DKIM 2540 0.47 2.23 0.07 106 RELAYCOUNTRY_GB 2511 1.40 2.21 1.22 107 XMDiploma_00 2506 1.63 2.20 1.50 108 HTML_IMAGE_RATIO_08 2479 2.11 2.18 2.10 109 RCVD_IN_IADB_SPF 2471 4.14 2.17 4.59 110 TM2_M_VERY_LONG_WORD 2465 1.37 2.17 1.18 111 BOTNET_NORDNS 2431 0.41 2.14 0.02 112 RCVD_IN_IADB_SENDERID 2410 3.59 2.12 3.93 113 RCVD_IN_IADB_DK 2409 3.61 2.12 3.95 114 XM_UB60 2384 0.46 2.10 0.09 115 TR_XM_DK_Bayes 2317 11.44 2.04 13.57 116 T_XMDrugObfuBody_14 2315 1.90 2.04 1.87 117 URI_HEX 2310 1.47 2.03 1.34 118 TR_XM_PHPDW 2218 0.73 1.95 0.46 119 TR_Symld_Words 2212 1.45 1.94 1.33 120 TR_XM_PHPForged 2195 0.72 1.93 0.44 121 RCVD_IN_RP_CERTIFIED 2189 5.78 1.92 6.66 122 TR_XM_FormFill2 2187 0.72 1.92 0.44 123 XM_H_PHPOS 2180 0.71 1.92 0.44 124 TR_XM_DK_SendGrid 2159 3.51 1.90 3.88 125 TR_Mismatch_TLD_01 2152 0.56 1.89 0.25 126 HDRS_LCASE_IMGONLY 2088 0.37 1.84 0.03 127 DKIM_ADSP_CUSTOM_MED 2064 1.42 1.81 1.33 128 RCVD_IN_PSBL 2014 0.37 1.77 0.05 129 XMStockSpam_06 1962 1.31 1.73 1.21 130 MIME_HEADER_CTYPE_ONLY 1952 0.53 1.72 0.25 131 NORDNS_LOW_CONTRAST 1948 0.32 1.71 0.01 132 ALL_TRUSTED 1947 11.50 1.71 13.72 133 TR_Mismatch_TLD_02 1927 0.37 1.69 0.07 134 TR_XM_RelayPhish 1913 0.50 1.68 0.23 135 FORGED_GMAIL_RCVD 1899 0.82 1.67 0.63 136 URIBL_SBL_A 1880 0.41 1.65 0.13 137 XMLngstWrd_00 1836 0.72 1.61 0.51 138 XMLngstWrd_01 1777 0.68 1.56 0.48 139 HTML_IMAGE_ONLY_08 1771 0.39 1.56 0.12 140 BAYES_05 1764 2.73 1.55 3.00 141 TR_XM_DK_Bayes1 1741 10.59 1.53 12.64 142 TR_LOTS_OF_MONEY3 1740 0.68 1.53 0.48 143 MAILING_LIST_MULTI 1736 2.57 1.53 2.81 144 NML_ADSP_CUSTOM_MED 1727 1.06 1.52 0.95 145 T_XMDrugObfuBody_00 1718 0.79 1.51 0.63 146 HDRS_MISSP 1717 0.33 1.51 0.06 147 XMSubMetaI_00 1694 0.90 1.49 0.77 148 XMLngstWrd_02 1660 0.59 1.46 0.39 149 RELAYCOUNTRY_FI 1655 0.29 1.46 0.03 150 XMSexyCombo_01 1637 0.56 1.44 0.36 151 T_XMHurry_00 1617 0.70 1.42 0.53 152 HTML_IMAGE_ONLY_04 1610 0.35 1.42 0.11 153 XMHTML_After_End 1607 0.81 1.41 0.67 154 URI_TRY_3LD 1600 1.27 1.41 1.23 155 DATE_IN_PAST_12_24 1585 0.29 1.39 0.04 156 TR_XM_DK_Bayes2 1573 9.20 1.38 10.98 157 XMLngstWrd_03 1569 0.49 1.38 0.29 158 REPLYTO_WITHOUT_TO_CC 1559 0.31 1.37 0.07 159 XMPhish08 1537 0.62 1.35 0.45 160 TR_MetaPhish_Combo_01 1520 1.07 1.34 1.00 161 RELAYCOUNTRY_RU 1514 0.28 1.33 0.04 162 TR_XM_MaxSPIKE 1511 0.28 1.33 0.05 163 XMLngstWrd_04 1508 0.46 1.33 0.26 164 XM_DK_Undo_01 1500 1.91 1.32 2.04 165 SHORT_IMG_SUSP_NTLD 1499 0.24 1.32 0.00 166 XM_B_Crypto 1449 0.29 1.27 0.06 167 FVGT_m_MULTI_ODD_EMAIL 1449 0.27 1.27 0.04 168 XMGenDplmaNmb 1445 1.04 1.27 0.98 169 NO_FM_NAME_IP_HOSTN 1444 0.24 1.27 0.00 170 URI_NOVOWEL 1384 0.55 1.22 0.40 171 T_MONEY_PERCENT 1358 0.57 1.19 0.43 172 TR_LOTS_OF_MONEY2 1358 0.57 1.19 0.43 173 XM_H_MailChimp 1343 0.40 1.18 0.22 174 HTML_TAG_BALANCE_CENTER 1342 0.32 1.18 0.12 175 XM_H_Long_From02 1341 1.02 1.18 0.98 176 T_FILL_THIS_FORM_SHORT 1329 0.97 1.17 0.92 177 TR_XM_MaxBayes 1323 0.22 1.16 0.01 178 TO_MALFORMED 1302 1.37 1.14 1.42 179 MONERO_EXTORT_01 1268 0.24 1.11 0.04 180 TR_XM_Crypto2 1262 0.23 1.11 0.03 181 DIET_1 1257 0.50 1.11 0.36 182 XMPhish30 1247 0.44 1.10 0.29 183 XM_UB99 1235 0.20 1.09 0.00 184 XM_ProductURIs 1232 0.85 1.08 0.79 185 XM_H_PHPMailer 1189 0.63 1.05 0.53 186 FROM_DOMAIN_NOVOWEL 1180 0.21 1.04 0.02 187 HTTPS_HTTP_MISMATCH 1168 1.07 1.03 1.08 188 T_Symld_Words_02 1076 0.49 0.95 0.39 189 XM_H_TOP 1068 0.18 0.94 0.00 190 XM_H_PHPOS_M 1038 0.31 0.91 0.18 191 BODY_URI_ONLY 1037 0.25 0.91 0.11 192 XMBrknScrpt_02 1029 1.02 0.90 1.05 193 XMMoneyMeta_00 1023 0.70 0.90 0.66 194 HELO_NODOT 1005 1.69 0.88 1.88 195 HELO_NO_DOMAIN 1004 1.69 0.88 1.88 196 XM_PDF 993 4.25 0.87 5.02 197 XMSubMetaSxObfu_03 981 0.46 0.86 0.37 198 MPART_ALT_DIFF_COUNT 980 0.57 0.86 0.50 199 TO_EQ_FM_DOM_HTML_IMG 977 0.17 0.86 0.01 200 XM_SPF_Unknown 976 0.74 0.86 0.71 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 443944 89.43 92.74 88.68 2 RELAYCOUNTRY_US 413784 81.27 75.21 82.65 3 DKIM_SIGNED 373204 75.36 78.93 74.55 4 XM_DK_Pass 364878 73.34 75.33 72.88 5 XM_B_Unicode 347826 69.66 70.47 69.48 6 DKIM_VALID 342373 67.53 63.72 68.39 7 DCC_CHECK_NEGATIVE 297843 52.23 20.27 59.49 8 BAYES_50 266271 51.98 46.68 53.19 9 DKIM_VALID_AU 247820 49.08 47.23 49.50 10 XMListUnsubscribeExists 246652 52.59 67.21 49.27 11 DCC_CHECK 192015 45.69 77.98 38.36 12 XM_B_Unicode3 191325 38.69 40.79 38.22 13 T_TM2_M_HEADER_IN_MSG 152358 28.62 20.62 30.43 14 DKIM_VALID_EF 131056 26.43 27.52 26.18 15 HTML_FONT_LOW_CONTRAST 130309 26.85 30.44 26.03 16 FVGT_m_MULTI_ODD 110497 23.32 28.80 22.07 17 LOC_TINY_FONT_1 108511 23.79 33.11 21.68 18 XMSubLong 105777 21.73 24.40 21.13 19 BAYES_00 102737 17.27 2.95 20.52 20 MIME_HTML_ONLY 101361 22.91 34.62 20.25 21 T_KAM_HTML_FONT_INVALID 89394 18.56 21.65 17.86 22 RCVD_IN_MSPIKE_H2 70041 13.01 8.71 13.99 23 ALL_TRUSTED 68701 11.50 1.71 13.72 24 TR_XM_DK_Bayes 67939 11.44 2.04 13.57 25 TR_XM_DK_Bayes1 63300 10.59 1.53 12.64 26 XM_Body_Dirty_Words 58867 13.28 19.98 11.76 27 XM_Multi_Part_URI 56049 12.11 16.16 11.20 28 TR_XM_DK_Bayes2 54958 9.20 1.38 10.98 29 TooManyTo_001 47824 9.02 6.69 9.55 30 XM_B_Unsub 47740 9.99 11.99 9.54 31 RCVD_IN_MSPIKE_H3 45437 7.94 2.92 9.08 32 RCVD_IN_MSPIKE_WL 45437 7.94 2.92 9.08 33 XM_Evil_Numbers_Gen 44796 9.55 12.21 8.95 34 UNPARSEABLE_RELAY 44183 8.30 5.97 8.83 35 XM_B_Phish_Phrases 42385 8.95 11.09 8.47 36 LotsOfNums_01 41400 9.17 13.16 8.27 37 HTML_IMAGE_RATIO_02 40895 9.00 12.66 8.17 38 RCVD_IN_RP_SAFE 37241 6.57 2.77 7.44 39 LOTS_OF_MONEY 36789 8.08 11.31 7.35 40 XM_SendGrid 35218 6.67 5.08 7.03 41 FSL_BULK_SIG 33838 8.37 15.44 6.76 42 XM_DK_Undo_02 33777 13.06 40.83 6.75 43 RCVD_IN_RP_CERTIFIED 33348 5.78 1.92 6.66 44 XM_DKIMWhitelistDomains 32849 5.35 0.03 6.56 45 MIME_QP_LONG_LINE 31053 6.25 6.48 6.20 46 DKIM_INVALID 30831 7.83 15.20 6.16 47 RELAYCOUNTRY_META 29325 9.48 25.42 5.86 48 BAYES_60 28232 5.98 7.49 5.64 49 BAYES_40 27788 5.15 3.41 5.55 50 XM_H_Long_From01 27606 5.84 7.29 5.51 51 RCVD_IN_IADB_LISTED 26798 4.78 2.28 5.35 52 XM_PDF 25128 4.25 0.87 5.02 53 MPART_ALT_DIFF 25075 5.13 5.67 5.01 54 XMStrtUSub 24133 4.59 3.60 4.82 55 BOTNET_IPINHOSTNAME 23611 7.07 17.42 4.72 56 RCVD_IN_IADB_SPF 22966 4.14 2.17 4.59 57 BAYES_20 22445 4.19 2.91 4.48 58 T_TooManySym_01 22136 4.05 2.41 4.42 59 T_REMOTE_IMAGE 20519 4.26 4.97 4.10 60 RCVD_IN_IADB_DK 19772 3.61 2.12 3.95 61 RCVD_IN_IADB_SENDERID 19654 3.59 2.12 3.93 62 TR_XM_DK_SendGrid 19428 3.51 1.90 3.88 63 HTML_IMAGE_RATIO_04 19359 4.29 6.13 3.87 64 RCVD_IN_IADB_VOUCHED 17852 3.01 0.58 3.57 65 IN_ZIMBRA_NJ_WHITELIST 17834 2.91 0.02 3.56 66 XM_UncommonTLD01 17500 6.25 18.36 3.50 67 HTML_IMAGE_RATIO_06 16776 3.27 2.93 3.35 68 XMSexyCombo_05 16653 4.86 11.59 3.33 69 MIME_HTML_ONLY_MULTI 16181 3.08 2.39 3.23 70 XMNumbers 16084 3.46 4.56 3.21 71 XM_H_Trusted_IP 15725 2.56 0.00 3.14 72 NO_DNS_FOR_FROM 15556 4.63 11.32 3.11 73 FROM_EXCESS_BASE64 15328 2.97 2.56 3.06 74 BOTNET 15198 6.87 23.72 3.04 75 BAYES_99 15109 7.13 25.25 3.02 76 BAYES_05 14999 2.73 1.55 3.00 77 BAYES_80 14709 3.61 6.57 2.94 78 HTML_MIME_NO_HTML_TAG 14347 3.02 3.68 2.87 79 TooManyTo_002 14277 2.47 0.77 2.85 80 MAILING_LIST_MULTI 14052 2.57 1.53 2.81 81 TM2_M_URI_OPT_OUT 13844 2.98 3.94 2.77 82 XMSubMetaSx_00 12838 3.22 6.11 2.56 83 BAYES_999 11812 5.49 19.25 2.36 84 ANY_BOUNCE_MESSAGE 11610 1.96 0.35 2.32 85 BOUNCE_MESSAGE 11604 1.95 0.35 2.32 86 KHOP_HELO_FCRDNS 11579 3.28 7.55 2.31 87 MIME_HTML_MOSTLY 11386 2.62 4.16 2.27 88 XM_B_SpammyTLD 11114 3.03 6.61 2.22 89 RCVD_IN_IADB_OPTIN 10893 1.85 0.43 2.18 90 T_TooManySym_02 10644 1.88 0.79 2.13 91 HTML_IMAGE_RATIO_08 10493 2.11 2.18 2.10 92 XM_DK_Undo_01 10237 1.91 1.32 2.04 93 XM_CamelCaseFrm001 10216 2.36 3.79 2.04 94 TooManyTo_003 10189 1.78 0.64 2.04 95 XM_B_Unsub2 9937 2.16 2.93 1.98 96 XM_SPF_SoftFail 9535 2.78 6.64 1.90 97 HELO_NODOT 9408 1.69 0.88 1.88 98 HELO_NO_DOMAIN 9407 1.69 0.88 1.88 99 T_XMDrugObfuBody_14 9346 1.90 2.04 1.87 100 TVD_RCVD_IP 9051 1.57 0.52 1.81 101 XMNoVowels 8944 1.94 2.61 1.79 102 RCVD_IN_MSPIKE_BL 8601 2.81 7.60 1.72 103 T_XMDrugObfuBody_08 8367 1.93 3.04 1.67 104 BAYES_95 8321 1.94 3.19 1.66 105 IN_HORDE_ADDRESS_BOOK 8128 1.35 0.14 1.62 106 INVALID_MSGID 8124 1.38 0.30 1.62 107 XMSubNoVowel 8086 1.42 0.55 1.62 108 TooManyTo_004 8063 1.41 0.52 1.61 109 UNTRUSTED_Relay 7973 4.42 16.87 1.59 110 RCVD_IN_MSPIKE_L3 7913 2.66 7.41 1.58 111 RELAYCOUNTRY_CA 7746 2.14 4.76 1.55 112 XM_GoogleGroups 7602 1.33 0.50 1.52 113 XMDiploma_00 7501 1.63 2.20 1.50 114 XMCapTrack 7430 1.32 0.61 1.48 115 TR_DCC_Bayes_99 7386 4.80 19.41 1.48 116 SUBJ_ALL_CAPS 7380 1.80 3.26 1.47 117 CK_HELO_DYNAMIC_SPLIT_IP 7344 1.24 0.24 1.47 118 HELO_DYNAMIC_IPADDR2 7340 1.21 0.07 1.47 119 TO_MALFORMED 7128 1.37 1.14 1.42 120 TooManyTo_005 6892 1.20 0.44 1.38 121 URI_HEX 6726 1.47 2.03 1.34 122 TR_Symld_Words 6677 1.45 1.94 1.33 123 DKIM_ADSP_CUSTOM_MED 6654 1.42 1.81 1.33 124 XM_OfRef6 6620 1.55 2.53 1.32 125 XM_E_Blogspot 6579 1.10 0.17 1.31 126 URI_TRY_3LD 6177 1.27 1.41 1.23 127 RELAYCOUNTRY_GB 6108 1.40 2.21 1.22 128 XMStockSpam_06 6067 1.31 1.73 1.21 129 TM2_M_VERY_LONG_WORD 5929 1.37 2.17 1.18 130 HTTPS_HTTP_MISMATCH 5397 1.07 1.03 1.08 131 XMBrknScrpt_02 5234 1.02 0.90 1.05 132 TR_MetaPhish_Combo_01 5026 1.07 1.34 1.00 133 XMBdyGiftCard01 4946 0.91 0.55 0.99 134 XM_H_Long_From02 4931 1.02 1.18 0.98 135 USER_IN_DEF_DKIM_WL 4927 0.80 0.00 0.98 136 XMGenDplmaNmb 4923 1.04 1.27 0.98 137 XMGappySubj_01 4865 0.89 0.51 0.97 138 NML_ADSP_CUSTOM_MED 4757 1.06 1.52 0.95 139 XM_UB50 4731 2.60 9.89 0.95 140 T_FILL_THIS_FORM_SHORT 4608 0.97 1.17 0.92 141 SpammyFromTLD_01 4548 1.22 2.61 0.91 142 HTML_FONT_FACE_BAD 4506 0.83 0.54 0.90 143 RCVD_IN_BL_SPAMCOP_NET 4285 1.42 3.91 0.86 144 XM_ProductURIs 3965 0.85 1.08 0.79 145 XMSubMetaI_00 3832 0.90 1.49 0.77 146 XM_SPF_Unknown 3576 0.74 0.86 0.71 147 MISSING_HEADERS 3572 0.70 0.63 0.71 148 XMHTML_After_End 3362 0.81 1.41 0.67 149 TR_MSPIKEBAYES00 3294 0.54 0.01 0.66 150 XMMoneyMeta_00 3291 0.70 0.90 0.66 151 T_TooManySym_03 3245 0.59 0.31 0.65 152 RCVD_IN_SORBS_DUL 3152 0.56 0.24 0.63 153 FORGED_GMAIL_RCVD 3144 0.82 1.67 0.63 154 T_XMDrugObfuBody_00 3139 0.79 1.51 0.63 155 PDS_OTHER_BAD_TLD 2903 1.49 5.51 0.58 156 RELAYCOUNTRY_AU 2829 0.58 0.64 0.57 157 XMBody_17 2804 1.00 2.94 0.56 158 XM_ShortIntro_01 2767 0.56 0.61 0.55 159 RELAYCOUNTRY_DE 2756 0.95 2.69 0.55 160 FROM_GOV_DKIM_AU 2732 0.49 0.26 0.55 161 XM_DIRTYINTL 2684 0.95 2.80 0.54 162 T_XMHurry_00 2674 0.70 1.42 0.53 163 XM_H_PHPMailer 2653 0.63 1.05 0.53 164 THIS_AD 2629 0.57 0.79 0.53 165 XM_B_REG_HTML 2605 0.55 0.67 0.52 166 T_OBFU_PDF_ATTACH 2603 0.45 0.15 0.52 167 XMLngstWrd_00 2576 0.72 1.61 0.51 168 TM2_M_BODY_EMPTY 2524 0.43 0.09 0.50 169 MPART_ALT_DIFF_COUNT 2522 0.57 0.86 0.50 170 TR_LOTS_OF_MONEY3 2408 0.68 1.53 0.48 171 XMLngstWrd_01 2398 0.68 1.56 0.48 172 HTML_IMAGE_ONLY_28 2361 0.50 0.61 0.47 173 XMPhish14 2348 0.51 0.69 0.47 174 SHORT_HELO_AND_INLINE_IMAGE 2332 0.39 0.05 0.47 175 FROM_GOV_SPOOF 2331 0.45 0.36 0.47 176 TR_XM_PHPDW 2281 0.73 1.95 0.46 177 HTML_IMAGE_ONLY_32 2279 0.42 0.24 0.46 178 XMPhish08 2246 0.62 1.35 0.45 179 TR_XM_PHPForged 2225 0.72 1.93 0.44 180 XMHTMLBadTable_001 2221 0.49 0.67 0.44 181 TR_XM_FormFill2 2214 0.72 1.92 0.44 182 XM_H_PHPOS 2193 0.71 1.92 0.44 183 HTML_IMAGE_ONLY_20 2173 0.42 0.35 0.43 184 TR_LOTS_OF_MONEY2 2159 0.57 1.19 0.43 185 T_MONEY_PERCENT 2159 0.57 1.19 0.43 186 AC_DIV_BONANZA 2126 0.38 0.17 0.42 187 HTML_TAG_BALANCE_BODY 2123 0.45 0.56 0.42 188 TR_MetaPhish_Combo_01b 2094 0.38 0.22 0.42 189 XMBody_95 1995 0.35 0.11 0.40 190 URI_NOVOWEL 1991 0.55 1.22 0.40 191 USER_IN_WHITELIST 1989 0.32 0.00 0.40 192 MSGID_FROM_MTA_HEADER 1973 0.37 0.27 0.39 193 T_Symld_Words_02 1958 0.49 0.95 0.39 194 T_MANY_PILL_PRICE 1937 0.32 0.01 0.39 195 XMLngstWrd_02 1936 0.59 1.46 0.39 196 XM_Body_Obfu01 1911 0.46 0.79 0.38 197 TVD_SPACE_RATIO 1877 0.45 0.76 0.37 198 XMSubMetaSxObfu_03 1854 0.46 0.86 0.37 199 LOW_PRICE 1843 0.44 0.74 0.37 200 XMDateMe_00 1828 0.35 0.28 0.37 ----------------------------------------------------------------------