Email: 356218 Autolearn: 0 AvgScore: 1.16 AvgScanTime: 1.90 sec Spam: 74966 Autolearn: 0 AvgScore: 12.04 AvgScanTime: 2.98 sec Ham: 281252 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.61 sec Time Spent Running SA: 187.63 hours Time Spent Processing Spam: 62.02 hours Time Spent Processing Ham: 125.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70092 88.79 93.50 87.53 2 DCC_CHECK 60738 56.30 81.02 49.71 3 DKIM_SIGNED 60305 79.24 80.44 78.92 4 XM_DK_Pass 58865 77.96 78.52 77.81 5 XM_B_Unicode 57271 73.87 76.40 73.19 6 DKIM_VALID 56873 75.43 75.87 75.32 7 RELAYCOUNTRY_US 55825 81.18 74.47 82.97 8 XMListUnsubscribeExists 52650 59.50 70.23 56.64 9 DKIM_VALID_AU 45364 61.46 60.51 61.71 10 XM_DK_Undo_02 32183 15.57 42.93 8.27 11 BAYES_50 31772 49.76 42.38 51.73 12 XM_B_Unicode3 29770 43.47 39.71 44.48 13 MIME_HTML_ONLY 26646 26.32 35.54 23.86 14 LOC_TINY_FONT_1 24917 30.30 33.24 29.51 15 DKIM_VALID_EF 23263 27.94 31.03 27.12 16 BAYES_99 21444 9.55 28.60 4.47 17 HTML_FONT_LOW_CONTRAST 21277 31.06 28.38 31.77 18 T_KAM_HTML_FONT_INVALID 19075 19.43 25.44 17.82 19 RELAYCOUNTRY_META 17969 9.20 23.97 5.26 20 FVGT_m_MULTI_ODD 17643 21.88 23.53 21.44 21 TR_DCC_Bayes_99 17250 6.84 23.01 2.54 22 BAYES_999 16952 7.56 22.61 3.55 23 XMSubLong 16942 21.63 22.60 21.37 24 BOTNET 16378 7.01 21.85 3.05 25 XM_UncommonTLD01 14641 7.18 19.53 3.89 26 HTML_IMAGE_RATIO_02 13463 11.57 17.96 9.87 27 XM_Multi_Part_URI 13396 15.50 17.87 14.87 28 DCC_CHECK_NEGATIVE 13240 42.41 17.66 49.00 29 XM_Body_Dirty_Words 13050 15.68 17.41 15.22 30 T_TM2_M_HEADER_IN_MSG 12901 21.97 17.21 23.24 31 BOTNET_IPINHOSTNAME 12280 8.56 16.38 6.48 32 UNTRUSTED_Relay 12122 4.68 16.17 1.62 33 FSL_BULK_SIG 9482 9.45 12.65 8.60 34 LOTS_OF_MONEY 8991 8.62 11.99 7.72 35 XM_B_Unsub 8793 10.97 11.73 10.77 36 XM_B_Phish_Phrases 8040 8.71 10.72 8.17 37 XM_UB50 7952 2.99 10.61 0.95 38 NO_DNS_FOR_FROM 7683 4.06 10.25 2.40 39 XM_Evil_Numbers_Gen 7619 10.03 10.16 9.99 40 XMSexyCombo_05 7110 6.75 9.48 6.03 41 XM_CamelCaseFrm001 7047 3.75 9.40 2.24 42 LotsOfNums_01 6457 9.03 8.61 9.15 43 BAYES_80 6311 4.09 8.42 2.94 44 TooManyTo_001 6297 7.73 8.40 7.56 45 RCVD_IN_MSPIKE_H2 5920 13.46 7.90 14.94 46 MPART_ALT_DIFF 5605 6.98 7.48 6.85 47 BAYES_60 5553 6.11 7.41 5.76 48 XMSubMetaSx_00 5126 4.25 6.84 3.56 49 RCVD_IN_MSPIKE_BL 4789 2.60 6.39 1.59 50 RCVD_IN_MSPIKE_L3 4784 2.59 6.38 1.58 51 RELAYCOUNTRY_CA 4587 2.94 6.12 2.09 52 XM_H_Long_From01 4531 5.80 6.04 5.73 53 MIME_HTML_MOSTLY 4507 4.12 6.01 3.61 54 KHOP_HELO_FCRDNS 4461 2.27 5.95 1.29 55 HTML_IMAGE_RATIO_04 4308 7.22 5.75 7.62 56 URIBL_SBL_A 4233 1.32 5.65 0.16 57 XM_B_COVIDMETA 3801 2.76 5.07 2.14 58 XMStrtUSub 3794 5.27 5.06 5.33 59 UNPARSEABLE_RELAY 3737 9.95 4.98 11.27 60 XM_SPF_SoftFail 3708 1.96 4.95 1.16 61 XM_B_Unsub2 3680 2.21 4.91 1.49 62 TR_XM_MaxBayes 3569 1.02 4.76 0.02 63 FROM_EXCESS_BASE64 3461 4.92 4.62 5.01 64 DKIM_INVALID 3432 3.81 4.58 3.60 65 PDS_OTHER_BAD_TLD 3416 1.70 4.56 0.94 66 XM_OfRef6 3254 1.86 4.34 1.20 67 ALL_TRUSTED 3146 11.33 4.20 13.23 68 RELAYCOUNTRY_FR 3048 1.01 4.07 0.19 69 XMNumbers 3023 3.58 4.03 3.47 70 BAYES_95 3019 2.20 4.03 1.72 71 XM_B_SpammyTLD 2959 2.71 3.95 2.39 72 FROM_SUSPICIOUS_NTLD 2905 0.85 3.88 0.05 73 T_XMDrugObfuBody_08 2895 2.17 3.86 1.72 74 RCVD_IN_RP_RNBL 2893 0.90 3.86 0.11 75 SpammyFromTLD_01 2859 1.13 3.81 0.42 76 FROM_SUSPICIOUS_NTLD_FP 2832 0.82 3.78 0.04 77 RCVD_IN_BL_SPAMCOP_NET 2714 1.49 3.62 0.92 78 SpammyFromTLD_02 2650 0.90 3.53 0.20 79 XM_SendGrid 2626 6.51 3.50 7.31 80 RCVD_IN_RP_SAFE 2593 10.61 3.46 12.52 81 TooManyTo_002 2466 2.17 3.29 1.87 82 BAYES_40 2392 4.94 3.19 5.41 83 TR_XM_PHPDW 2388 1.00 3.19 0.41 84 LongTLD 2384 0.78 3.18 0.14 85 TR_XM_PHPForged 2337 0.97 3.12 0.40 86 TR_XM_FormFill2 2335 0.97 3.11 0.39 87 XM_H_PHPOS 2331 0.96 3.11 0.39 88 XMBody_17 2320 1.37 3.09 0.91 89 RCVD_IN_MSPIKE_WL 2315 8.43 3.09 9.86 90 RCVD_IN_MSPIKE_H3 2315 8.43 3.09 9.86 91 MIME_QP_LONG_LINE 2206 4.14 2.94 4.46 92 T_REMOTE_IMAGE 2171 3.25 2.90 3.34 93 TR_Mismatch_TLD_02 2145 0.68 2.86 0.09 94 TooManyTo_003 2140 1.64 2.85 1.32 95 RELAYCOUNTRY_IN 2115 0.63 2.82 0.05 96 T_TooManySym_01 2104 4.73 2.81 5.24 97 RCVD_IN_RP_CERTIFIED 2059 9.85 2.75 11.74 98 XMSexyCombo_01 2051 1.11 2.74 0.68 99 XM_DIRTYINTL 2036 0.98 2.72 0.52 100 HTML_IMAGE_RATIO_06 2026 4.52 2.70 5.01 101 HTML_IMAGE_RATIO_08 1969 2.38 2.63 2.32 102 TR_XM_PhishingBody 1953 2.11 2.61 1.98 103 RDNS_DYNAMIC 1951 0.93 2.60 0.48 104 XMHTML_After_End 1840 0.96 2.45 0.57 105 DATE_IN_PAST_06_12 1802 0.71 2.40 0.26 106 BAYES_20 1793 3.86 2.39 4.25 107 SUBJ_ALL_CAPS 1784 1.55 2.38 1.33 108 URI_HEX 1780 1.57 2.37 1.36 109 T_XMHurry_00 1765 0.89 2.35 0.50 110 MIME_HTML_ONLY_MULTI 1761 3.73 2.35 4.10 111 TM2_M_URI_OPT_OUT 1758 3.22 2.35 3.45 112 BAYES_00 1750 17.12 2.33 21.06 113 TooManyTo_004 1714 1.32 2.29 1.06 114 FROM_MISSP_REPLYTO 1712 0.49 2.28 0.01 115 XMDiploma_00 1692 1.37 2.26 1.13 116 XM_URI_RBL 1636 0.62 2.18 0.20 117 XM_OfRef7 1611 0.52 2.15 0.09 118 RELAYCOUNTRY_DE 1554 0.68 2.07 0.31 119 XM_BadFromFormat 1549 0.58 2.07 0.18 120 DATE_IN_PAST_03_06 1481 0.48 1.98 0.08 121 T_XMDrugObfuBody_14 1479 2.23 1.97 2.30 122 URI_WP_HACKED_2 1479 0.49 1.97 0.10 123 HTML_MIME_NO_HTML_TAG 1469 1.52 1.96 1.40 124 TR_LOTS_OF_MONEY3 1450 0.64 1.93 0.30 125 XMStockSpam_06 1431 1.81 1.91 1.78 126 TM2_M_VERY_LONG_WORD 1418 1.62 1.89 1.55 127 DATE_IN_PAST_12_24 1365 0.43 1.82 0.06 128 RCVD_IN_PSBL 1324 0.46 1.77 0.12 129 LOW_PRICE 1313 0.74 1.75 0.47 130 TR_XM_DK_Bayes 1294 12.16 1.73 14.94 131 TR_XM_DK_Bayes1 1252 11.80 1.67 14.50 132 T_Symld_Words_02 1249 0.55 1.67 0.25 133 DKIM_ADSP_NXDOMAIN 1244 0.61 1.66 0.33 134 SUSPICIOUS_RECIPS 1240 0.35 1.65 0.00 135 XMSexyCombo_04 1229 0.64 1.64 0.37 136 XMGenDplmaNmb 1209 0.92 1.61 0.74 137 TR_XM_MaxSPIKE 1208 0.40 1.61 0.08 138 TooManyTo_005 1200 1.07 1.60 0.93 139 TR_XM_DK_SendGrid 1174 3.68 1.57 4.25 140 BOTNET_NORDNS 1171 0.34 1.56 0.01 141 T_FILL_THIS_FORM_SHORT 1157 1.23 1.54 1.15 142 TR_Mismatch_TLD_01 1126 0.51 1.50 0.25 143 XMBdyGiftCard01 1116 1.78 1.49 1.86 144 TR_XM_DK_Bayes2 1084 11.03 1.45 13.59 145 XM_H_PHPMailer 1083 0.72 1.44 0.52 146 XMSubMetaI_00 1079 0.78 1.44 0.61 147 URI_TRY_3LD 1039 1.45 1.39 1.47 148 XMPhish30 986 0.91 1.32 0.81 149 XMSubGiftCard1 983 0.30 1.31 0.03 150 MSGID_FROM_MTA_HEADER 980 0.49 1.31 0.27 151 XM_UB99 975 0.28 1.30 0.00 152 DKIM_ADSP_CUSTOM_MED 972 1.34 1.30 1.35 153 XM_DK_Undo_01 969 1.64 1.29 1.73 154 XM_H_PHPOS_M 964 0.39 1.29 0.15 155 BODY_URI_ONLY 963 0.29 1.28 0.03 156 TR_XM_RelayPhish 953 0.36 1.27 0.12 157 FROM_MISSP_DYNIP 936 0.26 1.25 0.00 158 RCVD_IN_IADB_LISTED 933 2.80 1.24 3.21 159 BAYES_05 931 2.36 1.24 2.66 160 XMSubNoVowel 920 0.99 1.23 0.93 161 XM_UB60 913 0.31 1.22 0.07 162 TR_XM_INV_DKIM 908 0.34 1.21 0.10 163 T_XMDrugObfuBody_00 877 0.73 1.17 0.61 164 FILL_THIS_FORM 871 0.65 1.16 0.52 165 FORGED_GMAIL_RCVD 856 0.65 1.14 0.52 166 FILL_THIS_FORM_LONG 834 0.38 1.11 0.18 167 XMSubject_11 833 0.27 1.11 0.05 168 MONEY_FRAUD_5 830 0.24 1.11 0.00 169 XM_ProductURIs 830 0.89 1.11 0.83 170 MAILING_LIST_MULTI 829 1.96 1.11 2.19 171 DIET_1 818 0.53 1.09 0.39 172 XM_RXBody 812 0.99 1.08 0.97 173 XM_UB80 809 0.24 1.08 0.02 174 XMReplyNow 805 0.28 1.07 0.07 175 NML_ADSP_CUSTOM_MED 803 1.02 1.07 1.00 176 RELAYCOUNTRY_GB 792 0.93 1.06 0.89 177 RCVD_IN_IADB_SPF 780 2.47 1.04 2.85 178 T_FILL_THIS_FORM_LOAN 772 0.36 1.03 0.18 179 RCVD_IN_IADB_DK 766 2.19 1.02 2.50 180 RCVD_IN_IADB_SENDERID 765 2.24 1.02 2.57 181 MPART_ALT_DIFF_COUNT 761 0.51 1.02 0.38 182 TR_Symld_Words 759 0.93 1.01 0.90 183 XM_OfRef8 753 0.22 1.00 0.01 184 TR_LOTS_OF_MONEY2 746 1.14 1.00 1.17 185 T_MONEY_PERCENT 746 1.14 1.00 1.17 186 FORM_FRAUD_5 729 0.21 0.97 0.00 187 URIBL_BLACK 725 0.21 0.97 0.01 188 XMBrknScrpt_02 720 0.81 0.96 0.77 189 URIBL_DBL_ABUSE_REDIR 719 0.21 0.96 0.01 190 RELAYCOUNTRY_AT 687 0.34 0.92 0.19 191 TVD_RCVD_IP 684 2.95 0.91 3.50 192 HTML_IMAGE_ONLY_16 647 0.72 0.86 0.69 193 RELAYCOUNTRY_CN 645 0.22 0.86 0.04 194 HK_RANDOM_REPLYTO 624 0.35 0.83 0.23 195 URIBL_DBL_SPAM 606 0.18 0.81 0.02 196 T_TooManySym_02 605 2.48 0.81 2.93 197 XM_B_COPY_HTML 601 0.47 0.80 0.38 198 SUBJ_DOLLARS 601 0.50 0.80 0.42 199 XM_ShortIntro_01 600 0.53 0.80 0.46 200 XM_UB999 599 0.17 0.80 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 246183 88.79 93.50 87.53 2 RELAYCOUNTRY_US 233344 81.18 74.47 82.97 3 DKIM_SIGNED 221966 79.24 80.44 78.92 4 XM_DK_Pass 218840 77.96 78.52 77.81 5 DKIM_VALID 211833 75.43 75.87 75.32 6 XM_B_Unicode 205854 73.87 76.40 73.19 7 DKIM_VALID_AU 173560 61.46 60.51 61.71 8 XMListUnsubscribeExists 159299 59.50 70.23 56.64 9 BAYES_50 145478 49.76 42.38 51.73 10 DCC_CHECK 139823 56.30 81.02 49.71 11 DCC_CHECK_NEGATIVE 137819 42.41 17.66 49.00 12 XM_B_Unicode3 125093 43.47 39.71 44.48 13 HTML_FONT_LOW_CONTRAST 89355 31.06 28.38 31.77 14 LOC_TINY_FONT_1 83007 30.30 33.24 29.51 15 DKIM_VALID_EF 76265 27.94 31.03 27.12 16 MIME_HTML_ONLY 67107 26.32 35.54 23.86 17 T_TM2_M_HEADER_IN_MSG 65361 21.97 17.21 23.24 18 FVGT_m_MULTI_ODD 60301 21.88 23.53 21.44 19 XMSubLong 60102 21.63 22.60 21.37 20 BAYES_00 59227 17.12 2.33 21.06 21 T_KAM_HTML_FONT_INVALID 50131 19.43 25.44 17.82 22 XM_Body_Dirty_Words 42802 15.68 17.41 15.22 23 RCVD_IN_MSPIKE_H2 42017 13.46 7.90 14.94 24 TR_XM_DK_Bayes 42006 12.16 1.73 14.94 25 XM_Multi_Part_URI 41833 15.50 17.87 14.87 26 TR_XM_DK_Bayes1 40791 11.80 1.67 14.50 27 TR_XM_DK_Bayes2 38220 11.03 1.45 13.59 28 ALL_TRUSTED 37217 11.33 4.20 13.23 29 RCVD_IN_RP_SAFE 35215 10.61 3.46 12.52 30 RCVD_IN_RP_CERTIFIED 33026 9.85 2.75 11.74 31 UNPARSEABLE_RELAY 31689 9.95 4.98 11.27 32 XM_DKIMWhitelistDomains 30543 8.58 0.05 10.86 33 XM_B_Unsub 30292 10.97 11.73 10.77 34 XM_Evil_Numbers_Gen 28108 10.03 10.16 9.99 35 HTML_IMAGE_RATIO_02 27749 11.57 17.96 9.87 36 RCVD_IN_MSPIKE_H3 27719 8.43 3.09 9.86 37 RCVD_IN_MSPIKE_WL 27719 8.43 3.09 9.86 38 LotsOfNums_01 25727 9.03 8.61 9.15 39 FSL_BULK_SIG 24185 9.45 12.65 8.60 40 XM_DK_Undo_02 23264 15.57 42.93 8.27 41 XM_B_Phish_Phrases 22978 8.71 10.72 8.17 42 LOTS_OF_MONEY 21725 8.62 11.99 7.72 43 HTML_IMAGE_RATIO_04 21419 7.22 5.75 7.62 44 TooManyTo_001 21253 7.73 8.40 7.56 45 XM_SendGrid 20561 6.51 3.50 7.31 46 MPART_ALT_DIFF 19270 6.98 7.48 6.85 47 BOTNET_IPINHOSTNAME 18222 8.56 16.38 6.48 48 XMSexyCombo_05 16952 6.75 9.48 6.03 49 BAYES_60 16207 6.11 7.41 5.76 50 XM_H_Long_From01 16116 5.80 6.04 5.73 51 BAYES_40 15206 4.94 3.19 5.41 52 XMStrtUSub 14987 5.27 5.06 5.33 53 RELAYCOUNTRY_META 14797 9.20 23.97 5.26 54 T_TooManySym_01 14736 4.73 2.81 5.24 55 HTML_IMAGE_RATIO_06 14091 4.52 2.70 5.01 56 FROM_EXCESS_BASE64 14082 4.92 4.62 5.01 57 BAYES_99 12567 9.55 28.60 4.47 58 MIME_QP_LONG_LINE 12543 4.14 2.94 4.46 59 BAYES_20 11966 3.86 2.39 4.25 60 TR_XM_DK_SendGrid 11947 3.68 1.57 4.25 61 MIME_HTML_ONLY_MULTI 11532 3.73 2.35 4.10 62 XM_UncommonTLD01 10949 7.18 19.53 3.89 63 XM_H_Trusted_IP 10355 2.91 0.00 3.68 64 MIME_HTML_MOSTLY 10155 4.12 6.01 3.61 65 DKIM_INVALID 10133 3.81 4.58 3.60 66 XMSubMetaSx_00 10022 4.25 6.84 3.56 67 BAYES_999 9986 7.56 22.61 3.55 68 TVD_RCVD_IP 9832 2.95 0.91 3.50 69 XMNumbers 9747 3.58 4.03 3.47 70 TM2_M_URI_OPT_OUT 9701 3.22 2.35 3.45 71 T_REMOTE_IMAGE 9402 3.25 2.90 3.34 72 RCVD_IN_IADB_LISTED 9042 2.80 1.24 3.21 73 BOTNET 8579 7.01 21.85 3.05 74 IN_ZIMBRA_NJ_WHITELIST 8537 2.40 0.01 3.04 75 CK_HELO_DYNAMIC_SPLIT_IP 8391 2.46 0.51 2.98 76 HELO_DYNAMIC_IPADDR2 8389 2.45 0.47 2.98 77 BAYES_80 8273 4.09 8.42 2.94 78 T_TooManySym_02 8237 2.48 0.81 2.93 79 RCVD_IN_IADB_SPF 8025 2.47 1.04 2.85 80 HTML_FONT_FACE_BAD 7989 2.38 0.64 2.84 81 BAYES_05 7485 2.36 1.24 2.66 82 INVALID_MSGID 7344 2.10 0.17 2.61 83 RCVD_IN_IADB_SENDERID 7220 2.24 1.02 2.57 84 TR_DCC_Bayes_99 7131 6.84 23.01 2.54 85 TO_MALFORMED 7100 2.01 0.06 2.52 86 RCVD_IN_IADB_DK 7040 2.19 1.02 2.50 87 NO_DNS_FOR_FROM 6762 4.06 10.25 2.40 88 XM_B_SpammyTLD 6711 2.71 3.95 2.39 89 ANY_BOUNCE_MESSAGE 6661 1.91 0.20 2.37 90 BOUNCE_MESSAGE 6660 1.91 0.20 2.37 91 HTML_IMAGE_RATIO_08 6526 2.38 2.63 2.32 92 T_XMDrugObfuBody_14 6471 2.23 1.97 2.30 93 XM_CamelCaseFrm001 6299 3.75 9.40 2.24 94 MAILING_LIST_MULTI 6148 1.96 1.11 2.19 95 XM_B_COVIDMETA 6016 2.76 5.07 2.14 96 RELAYCOUNTRY_CA 5885 2.94 6.12 2.09 97 XM_PDF 5616 1.70 0.59 2.00 98 TR_XM_PhishingBody 5562 2.11 2.61 1.98 99 TooManyTo_002 5255 2.17 3.29 1.87 100 XMBdyGiftCard01 5242 1.78 1.49 1.86 101 RCVD_IN_IADB_VOUCHED 5234 1.56 0.45 1.86 102 IN_HORDE_ADDRESS_BOOK 5001 1.41 0.03 1.78 103 XMStockSpam_06 4999 1.81 1.91 1.78 104 XM_DK_Undo_01 4858 1.64 1.29 1.73 105 T_XMDrugObfuBody_08 4845 2.17 3.86 1.72 106 BAYES_95 4835 2.20 4.03 1.72 107 USER_IN_DEF_DKIM_WL 4694 1.32 0.01 1.67 108 UNTRUSTED_Relay 4549 4.68 16.17 1.62 109 RCVD_IN_MSPIKE_BL 4468 2.60 6.39 1.59 110 RCVD_IN_MSPIKE_L3 4446 2.59 6.38 1.58 111 XM_GoogleGroups 4394 1.33 0.45 1.56 112 TM2_M_VERY_LONG_WORD 4355 1.62 1.89 1.55 113 XM_B_Unsub2 4198 2.21 4.91 1.49 114 URI_TRY_3LD 4140 1.45 1.39 1.47 115 HTML_MIME_NO_HTML_TAG 3949 1.52 1.96 1.40 116 URI_HEX 3830 1.57 2.37 1.36 117 DKIM_ADSP_CUSTOM_MED 3791 1.34 1.30 1.35 118 SUBJ_ALL_CAPS 3735 1.55 2.38 1.33 119 TooManyTo_003 3700 1.64 2.85 1.32 120 KHOP_HELO_FCRDNS 3635 2.27 5.95 1.29 121 XM_OfRef6 3367 1.86 4.34 1.20 122 T_MONEY_PERCENT 3300 1.14 1.00 1.17 123 TR_LOTS_OF_MONEY2 3300 1.14 1.00 1.17 124 XM_SPF_SoftFail 3273 1.96 4.95 1.16 125 RCVD_IN_IADB_OPTIN 3250 0.97 0.29 1.16 126 T_FILL_THIS_FORM_SHORT 3226 1.23 1.54 1.15 127 XMDiploma_00 3187 1.37 2.26 1.13 128 XMGappySubj_01 3148 0.91 0.14 1.12 129 TooManyTo_004 2987 1.32 2.29 1.06 130 TR_MSPIKEBAYES00 2839 0.80 0.00 1.01 131 NML_ADSP_CUSTOM_MED 2813 1.02 1.07 1.00 132 XM_RXBody 2728 0.99 1.08 0.97 133 XM_UB50 2685 2.99 10.61 0.95 134 PDS_OTHER_BAD_TLD 2634 1.70 4.56 0.94 135 XMSubNoVowel 2616 0.99 1.23 0.93 136 TooManyTo_005 2615 1.07 1.60 0.93 137 RCVD_IN_BL_SPAMCOP_NET 2600 1.49 3.62 0.92 138 XMBody_17 2548 1.37 3.09 0.91 139 TR_Symld_Words 2542 0.93 1.01 0.90 140 SUBJ_YOUR_FAMILY 2515 0.79 0.41 0.89 141 RELAYCOUNTRY_GB 2513 0.93 1.06 0.89 142 XM_H_Long_From02 2508 0.81 0.51 0.89 143 T_TooManySym_03 2403 0.71 0.18 0.85 144 XM_ProductURIs 2347 0.89 1.11 0.83 145 XMPhish30 2270 0.91 1.32 0.81 146 XMPhish08 2267 0.78 0.69 0.81 147 XMBrknScrpt_02 2178 0.81 0.96 0.77 148 TR_MetaPhish_Combo_01 2085 0.73 0.71 0.74 149 XMGenDplmaNmb 2079 0.92 1.61 0.74 150 HTML_IMAGE_ONLY_16 1935 0.72 0.86 0.69 151 XMSexyCombo_01 1899 1.11 2.74 0.68 152 HELO_NODOT 1860 0.66 0.65 0.66 153 HELO_NO_DOMAIN 1855 0.66 0.65 0.66 154 USER_IN_WHITELIST 1834 0.51 0.00 0.65 155 XM_B_REG_HTML 1742 0.58 0.45 0.62 156 T_XMDrugObfuBody_00 1726 0.73 1.17 0.61 157 XMSubMetaI_00 1715 0.78 1.44 0.61 158 HTTPS_HTTP_MISMATCH 1681 0.56 0.42 0.60 159 XMHTML_After_End 1592 0.96 2.45 0.57 160 XMCapTrack 1495 0.53 0.54 0.53 161 XMBody_78 1494 0.52 0.48 0.53 162 XM_H_PHPMailer 1469 0.72 1.44 0.52 163 XM_DIRTYINTL 1468 0.98 2.72 0.52 164 FILL_THIS_FORM 1462 0.65 1.16 0.52 165 FORGED_GMAIL_RCVD 1450 0.65 1.14 0.52 166 T_XMHurry_00 1410 0.89 2.35 0.50 167 XMLngstWrd_00 1405 0.50 0.52 0.50 168 PLING_QUERY 1392 0.50 0.52 0.49 169 RDNS_DYNAMIC 1351 0.93 2.60 0.48 170 XMSubMetaSxObfu_02 1343 0.50 0.57 0.48 171 HTML_TAG_BALANCE_BODY 1332 0.47 0.45 0.47 172 XMAntiAgingB 1330 0.46 0.41 0.47 173 XMHTMLBadTable_001 1330 0.49 0.54 0.47 174 LOW_PRICE 1324 0.74 1.75 0.47 175 XM_ShortIntro_01 1301 0.53 0.80 0.46 176 XMLngstWrd_01 1289 0.46 0.47 0.46 177 MISSING_HEADERS 1280 0.51 0.69 0.46 178 HTML_IMAGE_ONLY_20 1241 0.42 0.33 0.44 179 SUBJ_DOLLARS 1185 0.50 0.80 0.42 180 SpammyFromTLD_01 1181 1.13 3.81 0.42 181 TR_XM_PHPDW 1163 1.00 3.19 0.41 182 XMNoVowels 1162 0.42 0.44 0.41 183 XM_Body_Obfu01 1119 0.35 0.16 0.40 184 TR_XM_PHPForged 1112 0.97 3.12 0.40 185 TR_XM_FormFill2 1105 0.97 3.11 0.39 186 XM_H_PHPOS 1090 0.96 3.11 0.39 187 DIET_1 1085 0.53 1.09 0.39 188 URI_NOVOWEL 1079 0.43 0.61 0.38 189 XMSubMetaSxObfu_03 1070 0.45 0.73 0.38 190 XM_B_COPY_HTML 1069 0.47 0.80 0.38 191 BODY_ENHANCEMENT 1063 0.31 0.05 0.38 192 MPART_ALT_DIFF_COUNT 1062 0.51 1.02 0.38 193 XMSexyCombo_04 1043 0.64 1.64 0.37 194 T_TooManySym_04 1028 0.30 0.05 0.37 195 XMLngstWrd_02 1024 0.36 0.35 0.36 196 XMPhish14 985 0.39 0.55 0.35 197 XMMoneyMeta_00 965 0.40 0.63 0.34 198 TVD_SPACE_RATIO 949 0.29 0.13 0.34 199 DKIM_ADSP_NXDOMAIN 922 0.61 1.66 0.33 200 XMBody_95 921 0.27 0.05 0.33 ----------------------------------------------------------------------