Email: 647513 Autolearn: 0 AvgScore: 2.50 AvgScanTime: 3.79 sec Spam: 156207 Autolearn: 0 AvgScore: 12.53 AvgScanTime: 4.44 sec Ham: 491306 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 3.58 sec Time Spent Running SA: 681.76 hours Time Spent Processing Spam: 192.72 hours Time Spent Processing Ham: 489.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144600 87.34 92.57 85.67 2 DKIM_SIGNED 127438 75.14 81.58 73.09 3 DCC_CHECK 127411 48.99 81.57 38.64 4 XM_DK_Pass 122316 73.38 78.30 71.81 5 DKIM_VALID 115391 69.00 73.87 67.45 6 XMListUnsubscribeExists 110584 53.93 70.79 48.57 7 DKIM_VALID_AU 93082 50.31 59.59 47.36 8 XM_H_QuotedFrom 86896 41.44 55.63 36.93 9 BAYES_50 73200 55.59 46.86 58.37 10 HTML_FONT_LOW_CONTRAST 58178 28.30 37.24 25.45 11 LOC_TINY_FONT_1 54788 23.83 35.07 20.26 12 XM_DK_Undo_02 52728 13.43 33.76 6.97 13 MIME_HTML_ONLY 52389 22.06 33.54 18.42 14 XMSubLong 44183 23.37 28.28 21.81 15 BAYES_99 43378 10.78 27.77 5.37 16 FVGT_m_MULTI_ODD 40897 22.35 26.18 21.13 17 TR_DCC_Bayes_99 36105 7.94 23.11 3.12 18 BAYES_999 35588 8.92 22.78 4.52 19 XM_Body_Dirty_Words 32519 13.31 20.82 10.92 20 T_TM2_M_HEADER_IN_MSG 31844 29.01 20.39 31.75 21 DKIM_VALID_EF 29661 25.32 18.99 27.33 22 T_KAM_HTML_FONT_INVALID 29000 16.66 18.57 16.05 23 XM_Evil_Numbers_Gen 27909 10.24 17.87 7.81 24 MultiRelay 27758 18.76 17.77 19.08 25 RELAYCOUNTRY_META 27502 8.30 17.61 5.34 26 DCC_CHECK_NEGATIVE 25832 48.91 16.54 59.20 27 XM_Multi_Part_URI 25238 12.49 16.16 11.32 28 LOTS_OF_MONEY 24069 10.02 15.41 8.31 29 BOTNET 24036 5.32 15.39 2.12 30 HTML_IMAGE_RATIO_02 23836 9.48 15.26 7.64 31 FSL_BULK_SIG 21376 8.24 13.68 6.51 32 BOTNET_IPINHOSTNAME 21058 7.22 13.48 5.23 33 UNTRUSTED_Relay 17504 3.83 11.21 1.48 34 XMSexyCombo_05 17497 5.03 11.20 3.07 35 T_XMDrugObfuBody_14 15192 8.16 9.73 7.66 36 HTML_IMAGE_RATIO_04 15050 5.80 9.63 4.58 37 XM_H_Long_From01 14537 6.65 9.31 5.80 38 XMSubMetaSx_00 13546 4.97 8.67 3.80 39 TR_XM_DocInvoice 13286 5.19 8.51 4.13 40 FROM_EXCESS_BASE64 12892 4.53 8.25 3.35 41 XM_B_Phish_Phrases 12763 5.94 8.17 5.23 42 MPART_ALT_DIFF 12428 4.15 7.96 2.93 43 DKIM_INVALID 12047 6.13 7.71 5.63 44 BAYES_60 11870 5.48 7.60 4.80 45 TooManyTo_001 11590 7.95 7.42 8.12 46 BAYES_80 10287 3.56 6.59 2.59 47 XM_UncommonTLD01 10269 4.11 6.57 3.32 48 LotsOfNums_01 9026 7.94 5.78 8.63 49 RCVD_IN_RP_RNBL 8647 1.58 5.54 0.33 50 HTML_IMAGE_RATIO_06 7894 3.71 5.05 3.29 51 MultiRelay_Combo 7868 1.35 5.04 0.18 52 MultiRelay_CC 7868 1.35 5.04 0.18 53 XM_UB50 7574 1.72 4.85 0.73 54 XMNumbers 7349 3.77 4.70 3.48 55 XM_DIRTYINTL 7332 2.57 4.69 1.89 56 TM2_M_URI_OPT_OUT 7216 2.72 4.62 2.12 57 HTML_IMAGE_RATIO_08 7031 2.87 4.50 2.35 58 MIME_HTML_ONLY_MULTI 6914 2.11 4.43 1.37 59 XM_SPF_SoftFail 6591 2.68 4.22 2.20 60 T_REMOTE_IMAGE 6568 4.16 4.20 4.15 61 URI_HEX 6439 2.16 4.12 1.53 62 TR_LOTS_OF_MONEY3 6407 1.46 4.10 0.62 63 XMStrtUSub 6180 4.24 3.96 4.33 64 MIME_HTML_MOSTLY 6030 2.73 3.86 2.37 65 BAYES_95 6015 2.12 3.85 1.57 66 T_TooManySym_01 5815 5.22 3.72 5.70 67 XM_OfRef6 5779 1.84 3.70 1.25 68 SUBJ_ALL_CAPS 5529 2.06 3.54 1.59 69 XMDiploma_00 5486 2.21 3.51 1.80 70 XM_SendGrid 5284 4.95 3.38 5.44 71 ANY_BOUNCE_MESSAGE 5237 3.63 3.35 3.72 72 BOUNCE_MESSAGE 5237 3.63 3.35 3.72 73 RELAYCOUNTRY_CA 5070 2.02 3.25 1.64 74 HTML_MIME_NO_HTML_TAG 4902 2.62 3.14 2.45 75 T_XMDrugObfuBody_08 4725 1.95 3.02 1.61 76 RCVD_IN_MSPIKE_H2 4697 4.10 3.01 4.44 77 XM_CamelCaseFrm001 4604 2.07 2.95 1.79 78 MIME_QP_LONG_LINE 4591 5.34 2.94 6.11 79 SpammyFromTLD_02 4572 1.06 2.93 0.46 80 XMSexyCombo_01 4550 1.03 2.91 0.43 81 XM_UB60 4404 0.75 2.82 0.09 82 BAYES_40 4300 4.36 2.75 4.87 83 DATE_IN_PAST_03_06 4051 0.75 2.59 0.17 84 US_DOLLARS_3 3983 1.56 2.55 1.24 85 XM_URI_RBL 3940 0.83 2.52 0.29 86 XM_H_Long_From02 3921 1.39 2.51 1.04 87 RELAYCOUNTRY_CN 3881 0.64 2.48 0.06 88 BOTNET_NORDNS 3751 0.60 2.40 0.03 89 UNPARSEABLE_RELAY 3673 2.86 2.35 3.03 90 RCVD_IN_RP_SAFE 3530 7.19 2.26 8.76 91 RCVD_IN_BL_SPAMCOP_NET 3418 0.91 2.19 0.51 92 HTML_SHORT_LINK_IMG_1 3406 0.55 2.18 0.03 93 BODY_URI_ONLY 3397 0.58 2.17 0.08 94 XMGenDplmaNmb 3359 1.33 2.15 1.06 95 XMBdyGiftCard01 3357 1.15 2.15 0.83 96 XMSubMetaI_00 3261 1.02 2.09 0.68 97 HTML_IMAGE_ONLY_08 3252 0.61 2.08 0.15 98 HTML_FONT_SIZE_LARGE 3225 0.64 2.06 0.18 99 TM2_M_VERY_LONG_WORD 3130 1.26 2.00 1.03 100 TR_XM_RelayPhish 2970 0.86 1.90 0.53 101 SHORTENER_SHORT_IMG 2886 0.45 1.85 0.00 102 URI_BUFFLY 2885 0.45 1.85 0.00 103 XM_S_JOY_D 2880 0.66 1.84 0.28 104 BAYES_20 2858 3.25 1.83 3.70 105 MAILING_LIST_MULTI 2857 2.73 1.83 3.02 106 DKIM_ADSP_CUSTOM_MED 2777 1.16 1.78 0.97 107 XMSexyCombo_04 2681 0.51 1.72 0.12 108 FORGED_GMAIL_RCVD 2632 0.81 1.68 0.53 109 XMHTML_After_End 2607 0.80 1.67 0.52 110 BAYES_00 2598 12.82 1.66 16.36 111 NML_ADSP_CUSTOM_MED 2579 0.88 1.65 0.63 112 RCVD_IN_RP_CERTIFIED 2561 6.28 1.64 7.76 113 T_XMHurry_00 2529 0.81 1.62 0.56 114 RELAYCOUNTRY_NL 2522 0.52 1.61 0.18 115 SpammyFromTLD_01 2507 1.02 1.60 0.83 116 TR_Mismatch_TLD_02 2433 0.42 1.56 0.05 117 RELAYCOUNTRY_GB 2402 1.15 1.54 1.03 118 T_XMDrugObfuBody_00 2294 0.90 1.47 0.72 119 XMStockSpam_06 2272 1.05 1.45 0.92 120 XM_ShortIntro_01 2218 0.70 1.42 0.47 121 XM_ProductURIs 2213 0.80 1.42 0.60 122 XMPhish11 2211 1.24 1.42 1.18 123 URIBL_BLACK 2142 0.39 1.37 0.08 124 DIET_1 2087 0.64 1.34 0.41 125 T_Symld_Words_02 2082 0.77 1.33 0.59 126 TR_Symld_Words 2071 1.72 1.33 1.85 127 URI_TRY_3LD 2054 1.26 1.31 1.25 128 RCVD_IN_IADB_LISTED 2052 4.51 1.31 5.53 129 ALL_TRUSTED 2047 13.69 1.31 17.63 130 SUBJ_DOLLARS 1979 0.56 1.27 0.33 131 XMBody_17 1967 0.81 1.26 0.66 132 RELAYCOUNTRY_NG 1956 0.30 1.25 0.00 133 XMPhish30 1935 0.82 1.24 0.68 134 RELAYCOUNTRY_BR 1891 0.32 1.21 0.03 135 TR_XM_DK_Bayes 1890 9.79 1.21 12.52 136 TR_LOTS_OF_MONEY2 1880 0.53 1.20 0.31 137 T_MONEY_PERCENT 1880 0.53 1.20 0.31 138 RELAYCOUNTRY_FR 1861 0.52 1.19 0.31 139 TR_Caps_n_Bayes_99 1846 0.38 1.18 0.12 140 RELAYCOUNTRY_IN 1835 0.41 1.17 0.16 141 XM_UB99 1796 0.30 1.15 0.03 142 XMMoneyMeta_00 1770 0.69 1.13 0.56 143 XM_DK_Undo_01 1761 1.78 1.13 1.99 144 XMSubMetaSSx_00 1734 0.50 1.11 0.31 145 XMClaimOffer 1707 0.33 1.09 0.09 146 HTML_TAG_BALANCE_BODY 1702 0.58 1.09 0.42 147 BAYES_05 1701 2.05 1.09 2.36 148 TR_XM_DK_Bayes1 1699 9.10 1.09 11.64 149 HTML_FONT_FACE_BAD 1658 0.71 1.06 0.60 150 MPART_ALT_DIFF_COUNT 1638 0.38 1.05 0.17 151 RCVD_IN_IADB_SPF 1629 3.95 1.04 4.88 152 XMSubMetaSxObfu_03 1625 0.71 1.04 0.60 153 MONEY_FRAUD_3 1570 0.24 1.01 0.00 154 URIBL_DBL_SPAM 1567 0.28 1.00 0.05 155 T_FILL_THIS_FORM_SHORT 1565 0.99 1.00 0.98 156 T_TooManySym_02 1562 1.77 1.00 2.01 157 BODY_ENHANCEMENT 1540 0.25 0.99 0.02 158 ADVANCE_FEE_2_NEW_MONEY 1534 0.24 0.98 0.01 159 HTTPS_HTTP_MISMATCH 1531 0.74 0.98 0.66 160 RCVD_IN_IADB_SENDERID 1529 3.49 0.98 4.29 161 RCVD_IN_IADB_DK 1508 3.47 0.97 4.27 162 ADVANCE_FEE_3_NEW 1470 0.23 0.94 0.00 163 T_HTML_TAG_BALANCE_CENTER 1469 0.30 0.94 0.10 164 REMOVE_BEFORE_LINK 1463 0.45 0.94 0.29 165 URI_NOVOWEL 1448 0.62 0.93 0.53 166 TR_XM_DK_Bayes2 1440 7.35 0.92 9.40 167 XM_RXBody 1435 0.47 0.92 0.33 168 XMSlimDrugH 1433 0.45 0.92 0.30 169 XMSubNoVowel 1431 0.49 0.92 0.35 170 XM_UB999 1409 0.24 0.90 0.03 171 XMGppyBdWords 1405 0.41 0.90 0.25 172 XMSubMetaSxObfu_04 1373 0.25 0.88 0.05 173 XM_H_PHPOS 1362 1.08 0.87 1.14 174 XM_UB80 1340 0.23 0.86 0.03 175 LongTLD 1333 0.34 0.85 0.18 176 XMBody_78 1313 0.61 0.84 0.53 177 RELAYCOUNTRY_DE 1302 0.58 0.83 0.50 178 XM_PDF 1291 4.11 0.83 5.16 179 PLING_QUERY 1259 0.55 0.81 0.47 180 XM_B_REG_HTML 1255 0.61 0.80 0.55 181 RCVD_IN_IADB_VOUCHED 1248 2.86 0.80 3.51 182 XMHTMLBadTable_001 1241 0.54 0.79 0.46 183 FROM_SUSPICIOUS_NTLD 1240 0.24 0.79 0.06 184 TM2_M_A_HREF_HREF 1226 0.51 0.78 0.42 185 LONG_HEX_URI 1206 0.31 0.77 0.17 186 HTML_TITLE_SUBJ_DIFF 1198 0.26 0.77 0.10 187 RELAYCOUNTRY_AU 1178 0.50 0.75 0.42 188 RDNS_DYNAMIC 1178 0.48 0.75 0.39 189 LONG_JUNK_URI3 1172 0.19 0.75 0.02 190 NORMAL_HTTP_TO_IP 1152 0.22 0.74 0.05 191 MISSING_HEADERS 1152 0.56 0.74 0.51 192 RELAYCOUNTRY_AT 1151 0.34 0.74 0.22 193 TooManyTo_002 1147 1.82 0.73 2.17 194 XM_Body_Obfu01 1147 0.34 0.73 0.21 195 XM_B_COPY_HTML 1142 0.49 0.73 0.41 196 DKIM_ADSP_NXDOMAIN 1116 0.57 0.71 0.53 197 XMCapTrack 1091 1.32 0.70 1.52 198 XMBrknScrpt_02 1082 0.58 0.69 0.55 199 LONG_JUNK_URI 1078 0.19 0.69 0.03 200 XM_OfRef7 1073 0.34 0.69 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420906 87.34 92.57 85.67 2 DKIM_SIGNED 359077 75.14 81.58 73.09 3 XM_DK_Pass 352807 73.38 78.30 71.81 4 DKIM_VALID 331401 69.00 73.87 67.45 5 DCC_CHECK_NEGATIVE 290865 48.91 16.54 59.20 6 BAYES_50 286762 55.59 46.86 58.37 7 XMListUnsubscribeExists 238623 53.93 70.79 48.57 8 DKIM_VALID_AU 232670 50.31 59.59 47.36 9 DCC_CHECK 189831 48.99 81.57 38.64 10 XM_H_QuotedFrom 181448 41.44 55.63 36.93 11 T_TM2_M_HEADER_IN_MSG 155975 29.01 20.39 31.75 12 DKIM_VALID_EF 134270 25.32 18.99 27.33 13 HTML_FONT_LOW_CONTRAST 125044 28.30 37.24 25.45 14 XMSubLong 107133 23.37 28.28 21.81 15 FVGT_m_MULTI_ODD 103825 22.35 26.18 21.13 16 LOC_TINY_FONT_1 99540 23.83 35.07 20.26 17 MultiRelay 93736 18.76 17.77 19.08 18 MIME_HTML_ONLY 90482 22.06 33.54 18.42 19 ALL_TRUSTED 86609 13.69 1.31 17.63 20 BAYES_00 80385 12.82 1.66 16.36 21 T_KAM_HTML_FONT_INVALID 78872 16.66 18.57 16.05 22 TR_XM_DK_Bayes 61526 9.79 1.21 12.52 23 TR_XM_DK_Bayes1 57207 9.10 1.09 11.64 24 XM_DKIMWhitelistDomains 56429 8.72 0.01 11.49 25 XM_Multi_Part_URI 55631 12.49 16.16 11.32 26 XM_Body_Dirty_Words 53654 13.31 20.82 10.92 27 TR_XM_DK_Bayes2 46161 7.35 0.92 9.40 28 RCVD_IN_RP_SAFE 43037 7.19 2.26 8.76 29 LotsOfNums_01 42390 7.94 5.78 8.63 30 LOTS_OF_MONEY 40833 10.02 15.41 8.31 31 TooManyTo_001 39895 7.95 7.42 8.12 32 XM_Evil_Numbers_Gen 38392 10.24 17.87 7.81 33 RCVD_IN_RP_CERTIFIED 38135 6.28 1.64 7.76 34 T_XMDrugObfuBody_14 37615 8.16 9.73 7.66 35 HTML_IMAGE_RATIO_02 37520 9.48 15.26 7.64 36 XM_DK_Undo_02 34223 13.43 33.76 6.97 37 FSL_BULK_SIG 31976 8.24 13.68 6.51 38 MIME_QP_LONG_LINE 30004 5.34 2.94 6.11 39 XM_H_Long_From01 28498 6.65 9.31 5.80 40 T_TooManySym_01 28014 5.22 3.72 5.70 41 DKIM_INVALID 27676 6.13 7.71 5.63 42 RCVD_IN_IADB_LISTED 27170 4.51 1.31 5.53 43 XM_SendGrid 26744 4.95 3.38 5.44 44 BAYES_99 26399 10.78 27.77 5.37 45 RELAYCOUNTRY_META 26212 8.30 17.61 5.34 46 XM_B_Phish_Phrases 25701 5.94 8.17 5.23 47 BOTNET_IPINHOSTNAME 25676 7.22 13.48 5.23 48 XM_PDF 25341 4.11 0.83 5.16 49 RCVD_IN_IADB_SPF 23966 3.95 1.04 4.88 50 BAYES_40 23946 4.36 2.75 4.87 51 BAYES_60 23602 5.48 7.60 4.80 52 HTML_IMAGE_RATIO_04 22507 5.80 9.63 4.58 53 BAYES_999 22196 8.92 22.78 4.52 54 RCVD_IN_MSPIKE_H2 21835 4.10 3.01 4.44 55 XMStrtUSub 21283 4.24 3.96 4.33 56 RCVD_IN_IADB_SENDERID 21086 3.49 0.98 4.29 57 RCVD_IN_IADB_DK 20959 3.47 0.97 4.27 58 T_REMOTE_IMAGE 20384 4.16 4.20 4.15 59 TR_XM_DocInvoice 20303 5.19 8.51 4.13 60 IN_ZIMBRA_NJ_WHITELIST 18867 2.92 0.02 3.84 61 XMSubMetaSx_00 18661 4.97 8.67 3.80 62 BOUNCE_MESSAGE 18255 3.63 3.35 3.72 63 ANY_BOUNCE_MESSAGE 18255 3.63 3.35 3.72 64 BAYES_20 18156 3.25 1.83 3.70 65 RCVD_IN_IADB_VOUCHED 17260 2.86 0.80 3.51 66 XMNumbers 17080 3.77 4.70 3.48 67 FROM_EXCESS_BASE64 16447 4.53 8.25 3.35 68 XM_UncommonTLD01 16333 4.11 6.57 3.32 69 HTML_IMAGE_RATIO_06 16160 3.71 5.05 3.29 70 TR_DCC_Bayes_99 15320 7.94 23.11 3.12 71 XMSexyCombo_05 15080 5.03 11.20 3.07 72 UNPARSEABLE_RELAY 14865 2.86 2.35 3.03 73 MAILING_LIST_MULTI 14823 2.73 1.83 3.02 74 MPART_ALT_DIFF 14412 4.15 7.96 2.93 75 TVD_RCVD_IP 13751 2.16 0.16 2.80 76 TO_MALFORMED 13168 2.20 0.67 2.68 77 BAYES_80 12746 3.56 6.59 2.59 78 HTML_MIME_NO_HTML_TAG 12052 2.62 3.14 2.45 79 MIME_HTML_MOSTLY 11643 2.73 3.86 2.37 80 BAYES_05 11584 2.05 1.09 2.36 81 HTML_IMAGE_RATIO_08 11558 2.87 4.50 2.35 82 RCVD_IN_IADB_OPTIN 10921 1.82 0.54 2.22 83 XM_SPF_SoftFail 10794 2.68 4.22 2.20 84 TooManyTo_002 10638 1.82 0.73 2.17 85 TM2_M_URI_OPT_OUT 10427 2.72 4.62 2.12 86 BOTNET 10425 5.32 15.39 2.12 87 HELO_NODOT 10068 1.66 0.45 2.05 88 T_TooManySym_02 9896 1.77 1.00 2.01 89 XM_DK_Undo_01 9767 1.78 1.13 1.99 90 XM_DIRTYINTL 9279 2.57 4.69 1.89 91 TR_Symld_Words 9073 1.72 1.33 1.85 92 XMDiploma_00 8852 2.21 3.51 1.80 93 XM_CamelCaseFrm001 8796 2.07 2.95 1.79 94 RCVD_IN_MSPIKE_WL 8706 1.49 0.60 1.77 95 RCVD_IN_MSPIKE_H3 8691 1.49 0.59 1.77 96 RELAYCOUNTRY_CA 8039 2.02 3.25 1.64 97 IN_HORDE_ADDRESS_BOOK 7927 1.23 0.04 1.61 98 T_XMDrugObfuBody_08 7922 1.95 3.02 1.61 99 SUBJ_ALL_CAPS 7836 2.06 3.54 1.59 100 BAYES_95 7726 2.12 3.85 1.57 101 URI_HEX 7525 2.16 4.12 1.53 102 XMCapTrack 7470 1.32 0.70 1.52 103 INVALID_MSGID 7299 1.17 0.16 1.49 104 UNTRUSTED_Relay 7286 3.83 11.21 1.48 105 TooManyTo_003 7069 1.24 0.62 1.44 106 TR_MetaPhish_Combo_01 6903 1.22 0.65 1.41 107 MIME_HTML_ONLY_MULTI 6748 2.11 4.43 1.37 108 XM_GoogleGroups 6284 1.11 0.58 1.28 109 XM_OfRef6 6165 1.84 3.70 1.25 110 URI_TRY_3LD 6118 1.26 1.31 1.25 111 US_DOLLARS_3 6092 1.56 2.55 1.24 112 USER_IN_DEF_DKIM_WL 6080 0.96 0.11 1.24 113 XMPhish11 5818 1.24 1.42 1.18 114 XM_H_PHPOS 5611 1.08 0.87 1.14 115 XMNoVowels 5491 0.97 0.51 1.12 116 TooManyTo_004 5223 0.91 0.45 1.06 117 XMGenDplmaNmb 5222 1.33 2.15 1.06 118 XM_H_Long_From02 5110 1.39 2.51 1.04 119 TM2_M_VERY_LONG_WORD 5056 1.26 2.00 1.03 120 RELAYCOUNTRY_GB 5049 1.15 1.54 1.03 121 T_FILL_THIS_FORM_SHORT 4816 0.99 1.00 0.98 122 DKIM_ADSP_CUSTOM_MED 4759 1.16 1.78 0.97 123 XMStockSpam_06 4538 1.05 1.45 0.92 124 TooManyTo_005 4338 0.76 0.38 0.88 125 SpammyFromTLD_01 4074 1.02 1.60 0.83 126 XMBdyGiftCard01 4067 1.15 2.15 0.83 127 XM_UB50 3594 1.72 4.85 0.73 128 T_XMDrugObfuBody_00 3554 0.90 1.47 0.72 129 T_TooManySym_03 3371 0.55 0.11 0.69 130 XMLngstWrd_00 3354 0.67 0.62 0.68 131 XMPhish30 3353 0.82 1.24 0.68 132 XMSubMetaI_00 3317 1.02 2.09 0.68 133 XMBody_17 3262 0.81 1.26 0.66 134 HTTPS_HTTP_MISMATCH 3246 0.74 0.98 0.66 135 T_OBFU_PDF_ATTACH 3206 0.54 0.18 0.65 136 XM_H_PHPMailer 3198 0.62 0.54 0.65 137 XMLngstWrd_01 3169 0.57 0.35 0.65 138 NML_ADSP_CUSTOM_MED 3113 0.88 1.65 0.63 139 TR_LOTS_OF_MONEY3 3061 1.46 4.10 0.62 140 XMSubMetaSxObfu_03 2971 0.71 1.04 0.60 141 HTML_FONT_FACE_BAD 2964 0.71 1.06 0.60 142 FROM_GOV_SPOOF 2953 0.56 0.41 0.60 143 XM_ProductURIs 2938 0.80 1.42 0.60 144 T_Symld_Words_02 2911 0.77 1.33 0.59 145 HTML_IMAGE_ONLY_32 2780 0.50 0.27 0.57 146 T_XMHurry_00 2740 0.81 1.62 0.56 147 XMMoneyMeta_00 2730 0.69 1.13 0.56 148 XMBrknScrpt_02 2698 0.58 0.69 0.55 149 XM_B_REG_HTML 2679 0.61 0.80 0.55 150 USER_IN_WHITELIST 2657 0.41 0.00 0.54 151 XMGappySubj_01 2642 0.49 0.34 0.54 152 FORGED_GMAIL_RCVD 2610 0.81 1.68 0.53 153 XMBody_78 2607 0.61 0.84 0.53 154 TR_XM_RelayPhish 2605 0.86 1.90 0.53 155 DKIM_ADSP_NXDOMAIN 2595 0.57 0.71 0.53 156 URI_NOVOWEL 2593 0.62 0.93 0.53 157 XMHTML_After_End 2579 0.80 1.67 0.52 158 XMLKML 2563 0.40 0.00 0.52 159 SHORT_HELO_AND_INLINE_IMAGE 2528 0.41 0.08 0.51 160 AC_DIV_BONANZA 2510 0.42 0.15 0.51 161 RCVD_IN_BL_SPAMCOP_NET 2501 0.91 2.19 0.51 162 MISSING_HEADERS 2491 0.56 0.74 0.51 163 TM2_M_BODY_EMPTY 2449 0.41 0.15 0.50 164 RELAYCOUNTRY_DE 2436 0.58 0.83 0.50 165 XMBody_95 2377 0.39 0.09 0.48 166 XM_ShortIntro_01 2312 0.70 1.42 0.47 167 PLING_QUERY 2295 0.55 0.81 0.47 168 XMHTMLBadTable_001 2278 0.54 0.79 0.46 169 SpammyFromTLD_02 2264 1.06 2.93 0.46 170 HTML_IMAGE_ONLY_20 2209 0.44 0.41 0.45 171 XMDateMe_00 2208 0.43 0.35 0.45 172 RCVD_IN_SORBS_DUL 2123 0.38 0.22 0.43 173 XMSexyCombo_01 2117 1.03 2.91 0.43 174 FILL_THIS_FORM 2086 0.45 0.55 0.42 175 TM2_M_A_HREF_HREF 2053 0.51 0.78 0.42 176 HTML_TAG_BALANCE_BODY 2048 0.58 1.09 0.42 177 RELAYCOUNTRY_AU 2045 0.50 0.75 0.42 178 DIET_1 2038 0.64 1.34 0.41 179 XM_B_COPY_HTML 2027 0.49 0.73 0.41 180 XMSubMetaSxObfu_02 1991 0.35 0.19 0.41 181 XM_USANA_RCVD 1948 0.30 0.00 0.40 182 RDNS_DYNAMIC 1927 0.48 0.75 0.39 183 T_FROM_GOV_DKIM_AU 1917 0.34 0.19 0.39 184 XMPhish14 1892 0.46 0.68 0.39 185 HTML_IMAGE_ONLY_28 1781 0.42 0.59 0.36 186 T_FILL_THIS_FORM_LONG 1723 0.38 0.46 0.35 187 HTML_IMAGE_ONLY_16 1721 0.33 0.27 0.35 188 XMSubNoVowel 1718 0.49 0.92 0.35 189 T_TooManySym_04 1682 0.26 0.01 0.34 190 HTML_IMAGE_ONLY_24 1666 0.33 0.31 0.34 191 SUBJ_DOLLARS 1632 0.56 1.27 0.33 192 XMSolicitRefs_0 1631 0.34 0.37 0.33 193 RCVD_IN_RP_RNBL 1612 1.58 5.54 0.33 194 XM_RXBody 1605 0.47 0.92 0.33 195 T_MONEY_PERCENT 1544 0.53 1.20 0.31 196 TR_LOTS_OF_MONEY2 1544 0.53 1.20 0.31 197 XMSubMetaSSx_00 1511 0.50 1.11 0.31 198 RELAYCOUNTRY_FR 1502 0.52 1.19 0.31 199 XM_H_PHPOS_M 1491 0.31 0.31 0.30 200 XMSubEmpty 1471 0.33 0.43 0.30 ----------------------------------------------------------------------