Email: 658636 Autolearn: 0 AvgScore: 2.02 AvgScanTime: 3.71 sec Spam: 145614 Autolearn: 0 AvgScore: 11.97 AvgScanTime: 4.33 sec Ham: 513022 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 3.53 sec Time Spent Running SA: 678.67 hours Time Spent Processing Spam: 175.19 hours Time Spent Processing Ham: 503.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132390 88.07 90.92 87.26 2 DCC_CHECK 114281 48.32 78.48 39.75 3 DKIM_SIGNED 112483 74.01 77.25 73.09 4 XM_DK_Pass 108878 72.42 74.77 71.75 5 DKIM_VALID 101278 67.82 69.55 67.33 6 XMListUnsubscribeExists 97522 53.42 66.97 49.58 7 DKIM_VALID_AU 81927 49.66 56.26 47.79 8 BAYES_50 76628 56.63 52.62 57.77 9 XM_H_QuotedFrom 72764 41.54 49.97 39.15 10 HTML_FONT_LOW_CONTRAST 50630 28.56 34.77 26.80 11 LOC_TINY_FONT_1 50613 23.79 34.76 20.68 12 MIME_HTML_ONLY 48469 21.95 33.29 18.74 13 XM_DK_Undo_02 47645 12.45 32.72 6.69 14 FVGT_m_MULTI_ODD 36560 21.69 25.11 20.72 15 XMSubLong 36470 21.41 25.05 20.38 16 BAYES_99 35774 9.23 24.57 4.87 17 STYLE_GIBBERISH 31844 19.11 21.87 18.33 18 TR_DCC_Bayes_99 29578 6.56 20.31 2.65 19 DCC_CHECK_NEGATIVE 29435 49.88 20.21 58.29 20 BAYES_999 29220 7.68 20.07 4.17 21 XM_Evil_Numbers_Gen 28845 11.15 19.81 8.70 22 RELAYCOUNTRY_META 28681 8.65 19.70 5.51 23 DKIM_VALID_EF 28518 24.28 19.58 25.62 24 XM_Body_Dirty_Words 27829 13.15 19.11 11.45 25 LOTS_OF_MONEY 27232 10.67 18.70 8.39 26 BOTNET 26903 5.65 18.48 2.01 27 T_KAM_HTML_FONT_INVALID 25847 16.56 17.75 16.22 28 T_TM2_M_HEADER_IN_MSG 23089 27.22 15.86 30.45 29 XM_Multi_Part_URI 22937 12.04 15.75 10.98 30 FSL_BULK_SIG 22086 8.76 15.17 6.94 31 HTML_IMAGE_RATIO_02 21697 9.43 14.90 7.88 32 MultiRelay 21581 17.60 14.82 18.39 33 BOTNET_IPINHOSTNAME 21488 7.30 14.76 5.18 34 UNTRUSTED_Relay 21377 4.39 14.68 1.47 35 XMSexyCombo_05 16601 5.11 11.40 3.33 36 HTML_IMAGE_RATIO_04 13713 6.08 9.42 5.13 37 RCVD_IN_RP_RNBL 13494 2.23 9.27 0.23 38 XM_UB50 13322 2.70 9.15 0.87 39 T_XMDrugObfuBody_14 13032 7.57 8.95 7.17 40 FROM_EXCESS_BASE64 13009 5.07 8.93 3.98 41 MPART_ALT_DIFF 12798 4.28 8.79 3.00 42 TR_LOTS_OF_MONEY3 12473 2.28 8.57 0.50 43 TooManyTo_001 12339 9.57 8.47 9.88 44 XMSubMetaSx_00 12143 5.08 8.34 4.16 45 XM_H_Long_From01 11918 6.79 8.18 6.39 46 XM_UncommonTLD01 11285 4.23 7.75 3.23 47 DKIM_INVALID 11205 6.19 7.70 5.77 48 XM_B_Phish_Phrases 10281 6.01 7.06 5.72 49 BAYES_80 9171 3.38 6.30 2.55 50 LotsOfNums_01 8887 8.08 6.10 8.64 51 ANY_BOUNCE_MESSAGE 8641 3.66 5.93 3.02 52 BOUNCE_MESSAGE 8640 3.66 5.93 3.02 53 XMNumbers 8064 3.80 5.54 3.30 54 BAYES_60 7871 4.81 5.41 4.64 55 SpammyFromTLD_02 7346 1.35 5.04 0.30 56 T_REMOTE_IMAGE 7339 4.69 5.04 4.59 57 XM_DIRTYINTL 7217 2.43 4.96 1.72 58 MIME_HTML_ONLY_MULTI 7019 2.03 4.82 1.24 59 HTML_IMAGE_RATIO_06 6439 3.47 4.42 3.20 60 HTML_MIME_NO_HTML_TAG 6259 2.46 4.30 1.94 61 MISSING_HEADERS 6249 1.38 4.29 0.55 62 MIME_HTML_MOSTLY 6011 2.73 4.13 2.34 63 URI_HEX 5869 1.94 4.03 1.35 64 TM2_M_URI_OPT_OUT 5845 2.52 4.01 2.09 65 XM_SPF_SoftFail 5712 2.41 3.92 1.99 66 RELAYCOUNTRY_CA 5191 2.03 3.56 1.59 67 HTML_IMAGE_RATIO_08 5149 2.58 3.54 2.30 68 BAYES_95 5045 1.94 3.46 1.51 69 XMStrtUSub 4976 4.71 3.42 5.08 70 XM_CamelCaseFrm001 4793 2.21 3.29 1.90 71 XM_S_JOY_D 4470 0.94 3.07 0.33 72 HELO_NODOT 4341 2.19 2.98 1.97 73 BODY_URI_ONLY 4260 0.72 2.93 0.10 74 RCVD_IN_RP_SAFE 4165 7.10 2.86 8.30 75 T_XMDrugObfuBody_01 4147 0.67 2.85 0.05 76 HTML_SHORT_LINK_IMG_1 4025 0.63 2.76 0.02 77 XM_URI_RBL 3914 0.88 2.69 0.36 78 XMDiploma_00 3909 1.90 2.68 1.68 79 REPLYTO_WITHOUT_TO_CC 3886 0.68 2.67 0.11 80 TR_LOTS_OF_MONEY1 3780 0.59 2.60 0.02 81 XM_SendGrid 3779 4.93 2.60 5.59 82 T_TooManySym_01 3777 4.90 2.59 5.56 83 RCVD_IN_MSPIKE_H2 3746 4.14 2.57 4.59 84 UNPARSEABLE_RELAY 3709 2.87 2.55 2.97 85 SHORTENER_SHORT_IMG 3629 0.55 2.49 0.00 86 URI_BUFFLY 3608 0.55 2.48 0.00 87 MultiRelay_CC 3514 0.67 2.41 0.18 88 MultiRelay_Combo 3514 0.67 2.41 0.18 89 MIME_QP_LONG_LINE 3439 5.26 2.36 6.08 90 BAYES_40 3400 4.53 2.33 5.16 91 T_XMDrugObfuBody_08 3348 1.78 2.30 1.63 92 BAYES_20 3295 3.55 2.26 3.92 93 RCVD_IN_RP_CERTIFIED 3290 6.25 2.26 7.38 94 XMSexyCombo_01 3238 1.24 2.22 0.96 95 BOTNET_NORDNS 3218 0.50 2.21 0.02 96 XMBdyGiftCard01 3159 1.10 2.17 0.80 97 RCVD_IN_BL_SPAMCOP_NET 3069 0.92 2.11 0.58 98 MAILING_LIST_MULTI 3054 2.35 2.10 2.42 99 RELAYCOUNTRY_IN 3051 0.56 2.10 0.12 100 MIME_HEADER_CTYPE_ONLY 3026 0.56 2.08 0.13 101 XM_DK_Undo_01 2967 1.93 2.04 1.90 102 XM_OfRef6 2924 1.63 2.01 1.52 103 XMGenDplmaNmb 2880 1.28 1.98 1.08 104 TM2_M_VERY_LONG_WORD 2846 1.05 1.95 0.79 105 SUBJ_ALL_CAPS 2727 1.71 1.87 1.66 106 RELAYCOUNTRY_KR 2672 0.42 1.83 0.02 107 XMMoneyMeta_00 2662 0.80 1.83 0.51 108 SpammyFromTLD_01 2638 1.07 1.81 0.86 109 XM_UB60 2566 0.44 1.76 0.06 110 RELAYCOUNTRY_FR 2456 0.57 1.69 0.25 111 XMSubMetaI_00 2437 0.91 1.67 0.69 112 BAYES_00 2393 13.60 1.64 17.00 113 HTML_IMAGE_ONLY_04 2388 0.41 1.64 0.06 114 RELAYCOUNTRY_CN 2372 0.40 1.63 0.05 115 XMPhish30 2261 0.62 1.55 0.36 116 SUBJ_DOLLARS 2221 0.70 1.53 0.46 117 URIBL_BLACK 2207 0.42 1.52 0.11 118 T_XMHurry_00 2185 0.77 1.50 0.57 119 RELAYCOUNTRY_ZA 2183 0.41 1.50 0.10 120 T_MONEY_PERCENT 2167 0.60 1.49 0.35 121 TR_LOTS_OF_MONEY2 2167 0.60 1.49 0.35 122 URIBL_DBL_SPAM 2156 0.36 1.48 0.04 123 RCVD_IN_IADB_LISTED 2139 4.67 1.47 5.58 124 XM_UB80 2111 0.36 1.45 0.05 125 XM_H_Long_From02 2100 1.15 1.44 1.07 126 T_XMDrugObfuBody_00 2094 0.97 1.44 0.83 127 ALL_TRUSTED 2085 14.28 1.43 17.92 128 HTML_FONT_SIZE_LARGE 2067 0.50 1.42 0.23 129 XMBody_17 2061 0.69 1.42 0.48 130 BAYES_05 2037 2.33 1.40 2.59 131 HTML_IMAGE_ONLY_08 1964 0.61 1.35 0.41 132 TR_XM_RelayPhish 1946 0.77 1.34 0.61 133 XMPhish11 1864 1.14 1.28 1.10 134 XMStockSpam_06 1838 1.22 1.26 1.21 135 DKIM_ADSP_NXDOMAIN 1816 0.65 1.25 0.48 136 XMHTML_After_End 1812 0.65 1.24 0.48 137 RCVD_IN_IADB_SPF 1780 4.11 1.22 4.92 138 RDNS_DYNAMIC 1779 0.60 1.22 0.42 139 HTTPS_HTTP_MISMATCH 1731 0.70 1.19 0.56 140 XM_H_PHPOS 1712 1.48 1.18 1.57 141 XMPhish14 1697 0.67 1.17 0.53 142 RCVD_IN_IADB_SENDERID 1693 3.64 1.16 4.34 143 TR_Symld_Words 1688 1.51 1.16 1.61 144 TR_XM_DK_Bayes 1676 10.51 1.15 13.17 145 RCVD_IN_IADB_DK 1675 3.62 1.15 4.32 146 RELAYCOUNTRY_GB 1625 1.15 1.12 1.16 147 DIET_1 1623 0.49 1.11 0.32 148 XMSubMetaSxObfu_03 1601 0.63 1.10 0.50 149 RELAYCOUNTRY_NG_I 1585 0.24 1.09 0.00 150 XMSexyCombo_04 1550 0.77 1.06 0.68 151 XM_UB99 1519 0.25 1.04 0.02 152 T_FILL_THIS_FORM_SHORT 1512 0.96 1.04 0.94 153 RELAYCOUNTRY_AT 1505 0.42 1.03 0.24 154 XMHTMLBadTable_001 1505 0.59 1.03 0.47 155 URI_TRY_3LD 1491 1.27 1.02 1.34 156 TR_Mismatch_TLD_02 1483 0.28 1.02 0.07 157 HTML_SHORT_CENTER 1480 0.23 1.02 0.00 158 HTML_FONT_FACE_BAD 1460 0.79 1.00 0.73 159 TR_XM_DK_Bayes1 1416 9.76 0.97 12.25 160 FROM_SUSPICIOUS_NTLD 1411 0.26 0.97 0.06 161 XM_BadFromFormat 1403 0.34 0.96 0.16 162 REMOVE_BEFORE_LINK 1394 0.55 0.96 0.44 163 LOW_PRICE 1393 0.36 0.96 0.20 164 RCVD_IN_IADB_VOUCHED 1336 2.85 0.92 3.40 165 T_Symld_Words_02 1327 0.66 0.91 0.59 166 XMBody_78 1316 0.54 0.90 0.44 167 XMSubMetaSSx_00 1307 0.34 0.90 0.18 168 PLING_QUERY 1285 0.49 0.88 0.38 169 DATE_IN_PAST_12_24 1268 0.25 0.87 0.07 170 XMSlimDrugH 1260 0.45 0.87 0.34 171 TR_MetaPhish_Combo_01 1259 1.46 0.86 1.62 172 TooManyTo_002 1245 2.00 0.86 2.32 173 DATE_IN_PAST_06_12 1225 0.22 0.84 0.04 174 HTML_TAG_BALANCE_BODY 1204 0.49 0.83 0.40 175 XM_RXBody 1199 0.65 0.82 0.60 176 MPART_ALT_DIFF_COUNT 1192 0.32 0.82 0.17 177 TM2_M_A_HREF_HREF 1186 0.46 0.81 0.36 178 URI_NOVOWEL 1177 0.58 0.81 0.51 179 XM_ProductURIs 1150 0.69 0.79 0.66 180 TR_XM_DK_Bayes2 1140 8.04 0.78 10.10 181 INVALID_DATE 1140 0.24 0.78 0.09 182 T_TooManySym_02 1130 1.43 0.78 1.62 183 TooManyTo_003 1115 1.37 0.77 1.54 184 XM_Body_Obfu01 1101 0.39 0.76 0.29 185 DKIM_ADSP_CUSTOM_MED 1093 0.95 0.75 1.01 186 XM_UB999 1088 0.17 0.75 0.01 187 XM_B_COPY_HTML 1087 0.50 0.75 0.43 188 LOCALPART_IN_SUBJECT 1084 0.18 0.74 0.02 189 LongTLD 1081 0.31 0.74 0.19 190 HTML_TEXT_INVISIBLE_STYLE 1044 0.21 0.72 0.06 191 RCVD_IN_IADB_OPTIN 1034 1.90 0.71 2.24 192 NO_DNS_FOR_FROM 1034 0.40 0.71 0.32 193 XM_B_REG_HTML 1010 0.53 0.69 0.49 194 NML_ADSP_CUSTOM_MED 1006 0.65 0.69 0.64 195 XM_PDF 1001 3.79 0.69 4.67 196 XM_H_PHPMailer 1000 0.68 0.69 0.67 197 T_HTML_TAG_BALANCE_CENTER 991 0.22 0.68 0.10 198 RELAYCOUNTRY_AU 987 0.55 0.68 0.51 199 XMBrknScrpt_02 986 0.53 0.68 0.48 200 RELAYCOUNTRY_DE 968 0.49 0.66 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 447680 88.07 90.92 87.26 2 DKIM_SIGNED 374977 74.01 77.25 73.09 3 XM_DK_Pass 368087 72.42 74.77 71.75 4 DKIM_VALID 345396 67.82 69.55 67.33 5 DCC_CHECK_NEGATIVE 299066 49.88 20.21 58.29 6 BAYES_50 296380 56.63 52.62 57.77 7 XMListUnsubscribeExists 254333 53.42 66.97 49.58 8 DKIM_VALID_AU 245151 49.66 56.26 47.79 9 DCC_CHECK 203943 48.32 78.48 39.75 10 XM_H_QuotedFrom 200836 41.54 49.97 39.15 11 T_TM2_M_HEADER_IN_MSG 156201 27.22 15.86 30.45 12 HTML_FONT_LOW_CONTRAST 137492 28.56 34.77 26.80 13 DKIM_VALID_EF 131417 24.28 19.58 25.62 14 FVGT_m_MULTI_ODD 106322 21.69 25.11 20.72 15 LOC_TINY_FONT_1 106091 23.79 34.76 20.68 16 XMSubLong 104552 21.41 25.05 20.38 17 MIME_HTML_ONLY 96119 21.95 33.29 18.74 18 MultiRelay 94360 17.60 14.82 18.39 19 STYLE_GIBBERISH 94027 19.11 21.87 18.33 20 ALL_TRUSTED 91952 14.28 1.43 17.92 21 BAYES_00 87203 13.60 1.64 17.00 22 T_KAM_HTML_FONT_INVALID 83235 16.56 17.75 16.22 23 TR_XM_DK_Bayes 67541 10.51 1.15 13.17 24 TR_XM_DK_Bayes1 62835 9.76 0.97 12.25 25 XM_DKIMWhitelistDomains 60551 9.21 0.06 11.80 26 XM_Body_Dirty_Words 58766 13.15 19.11 11.45 27 XM_Multi_Part_URI 56347 12.04 15.75 10.98 28 TR_XM_DK_Bayes2 51811 8.04 0.78 10.10 29 TooManyTo_001 50662 9.57 8.47 9.88 30 XM_Evil_Numbers_Gen 44613 11.15 19.81 8.70 31 LotsOfNums_01 44337 8.08 6.10 8.64 32 LOTS_OF_MONEY 43054 10.67 18.70 8.39 33 RCVD_IN_RP_SAFE 42584 7.10 2.86 8.30 34 HTML_IMAGE_RATIO_02 40402 9.43 14.90 7.88 35 RCVD_IN_RP_CERTIFIED 37858 6.25 2.26 7.38 36 T_XMDrugObfuBody_14 36795 7.57 8.95 7.17 37 FSL_BULK_SIG 35615 8.76 15.17 6.94 38 XM_DK_Undo_02 34323 12.45 32.72 6.69 39 XM_H_Long_From01 32799 6.79 8.18 6.39 40 MIME_QP_LONG_LINE 31213 5.26 2.36 6.08 41 DKIM_INVALID 29581 6.19 7.70 5.77 42 XM_B_Phish_Phrases 29332 6.01 7.06 5.72 43 XM_SendGrid 28689 4.93 2.60 5.59 44 RCVD_IN_IADB_LISTED 28640 4.67 1.47 5.58 45 T_TooManySym_01 28526 4.90 2.59 5.56 46 RELAYCOUNTRY_META 28265 8.65 19.70 5.51 47 BOTNET_IPINHOSTNAME 26575 7.30 14.76 5.18 48 BAYES_40 26469 4.53 2.33 5.16 49 HTML_IMAGE_RATIO_04 26308 6.08 9.42 5.13 50 XMStrtUSub 26054 4.71 3.42 5.08 51 RCVD_IN_IADB_SPF 25258 4.11 1.22 4.92 52 BAYES_99 24989 9.23 24.57 4.87 53 XM_PDF 23983 3.79 0.69 4.67 54 BAYES_60 23805 4.81 5.41 4.64 55 RCVD_IN_MSPIKE_H2 23545 4.14 2.57 4.59 56 T_REMOTE_IMAGE 23538 4.69 5.04 4.59 57 RCVD_IN_IADB_SENDERID 22267 3.64 1.16 4.34 58 RCVD_IN_IADB_DK 22147 3.62 1.15 4.32 59 BAYES_999 21373 7.68 20.07 4.17 60 XMSubMetaSx_00 21339 5.08 8.34 4.16 61 FROM_EXCESS_BASE64 20416 5.07 8.93 3.98 62 BAYES_20 20086 3.55 2.26 3.92 63 IN_ZIMBRA_NJ_WHITELIST 18892 2.87 0.02 3.68 64 RCVD_IN_IADB_VOUCHED 17427 2.85 0.92 3.40 65 XMSexyCombo_05 17061 5.11 11.40 3.33 66 XMNumbers 16945 3.80 5.54 3.30 67 XM_UncommonTLD01 16577 4.23 7.75 3.23 68 HTML_IMAGE_RATIO_06 16438 3.47 4.42 3.20 69 ANY_BOUNCE_MESSAGE 15490 3.66 5.93 3.02 70 BOUNCE_MESSAGE 15484 3.66 5.93 3.02 71 MPART_ALT_DIFF 15370 4.28 8.79 3.00 72 UNPARSEABLE_RELAY 15224 2.87 2.55 2.97 73 TO_MALFORMED 13975 2.13 0.05 2.72 74 TVD_RCVD_IP 13769 2.15 0.28 2.68 75 TR_DCC_Bayes_99 13616 6.56 20.31 2.65 76 BAYES_05 13286 2.33 1.40 2.59 77 BAYES_80 13075 3.38 6.30 2.55 78 MAILING_LIST_MULTI 12407 2.35 2.10 2.42 79 MIME_HTML_MOSTLY 11981 2.73 4.13 2.34 80 TooManyTo_002 11909 2.00 0.86 2.32 81 HTML_IMAGE_RATIO_08 11812 2.58 3.54 2.30 82 RCVD_IN_IADB_OPTIN 11492 1.90 0.71 2.24 83 TM2_M_URI_OPT_OUT 10726 2.52 4.01 2.09 84 BOTNET 10298 5.65 18.48 2.01 85 XM_SPF_SoftFail 10188 2.41 3.92 1.99 86 HELO_NODOT 10084 2.19 2.98 1.97 87 HTML_MIME_NO_HTML_TAG 9930 2.46 4.30 1.94 88 XM_DK_Undo_01 9771 1.93 2.04 1.90 89 XM_CamelCaseFrm001 9769 2.21 3.29 1.90 90 RCVD_IN_MSPIKE_WL 9621 1.56 0.44 1.88 91 RCVD_IN_MSPIKE_H3 9615 1.56 0.44 1.87 92 XM_DIRTYINTL 8808 2.43 4.96 1.72 93 XMDiploma_00 8609 1.90 2.68 1.68 94 SUBJ_ALL_CAPS 8518 1.71 1.87 1.66 95 T_XMDrugObfuBody_08 8382 1.78 2.30 1.63 96 TR_MetaPhish_Combo_01 8327 1.46 0.86 1.62 97 T_TooManySym_02 8313 1.43 0.78 1.62 98 TR_Symld_Words 8237 1.51 1.16 1.61 99 RELAYCOUNTRY_CA 8174 2.03 3.56 1.59 100 IN_HORDE_ADDRESS_BOOK 8037 1.23 0.03 1.57 101 XM_H_PHPOS 8032 1.48 1.18 1.57 102 TooManyTo_003 7887 1.37 0.77 1.54 103 XM_OfRef6 7815 1.63 2.01 1.52 104 BAYES_95 7729 1.94 3.46 1.51 105 XMCapTrack 7579 1.21 0.25 1.48 106 UNTRUSTED_Relay 7545 4.39 14.68 1.47 107 INVALID_MSGID 7302 1.15 0.20 1.42 108 URI_HEX 6935 1.94 4.03 1.35 109 URI_TRY_3LD 6882 1.27 1.02 1.34 110 MIME_HTML_ONLY_MULTI 6375 2.03 4.82 1.24 111 XMStockSpam_06 6206 1.22 1.26 1.21 112 XM_GoogleGroups 6140 1.03 0.45 1.20 113 RELAYCOUNTRY_GB 5926 1.15 1.12 1.16 114 TooManyTo_004 5679 1.01 0.65 1.11 115 XMPhish11 5629 1.14 1.28 1.10 116 XMGenDplmaNmb 5523 1.28 1.98 1.08 117 USER_IN_DEF_DKIM_WL 5522 0.84 0.00 1.08 118 XM_H_Long_From02 5466 1.15 1.44 1.07 119 DKIM_ADSP_CUSTOM_MED 5176 0.95 0.75 1.01 120 XMSexyCombo_01 4931 1.24 2.22 0.96 121 T_FILL_THIS_FORM_SHORT 4807 0.96 1.04 0.94 122 TooManyTo_005 4694 0.84 0.58 0.91 123 XM_UB50 4471 2.70 9.15 0.87 124 SpammyFromTLD_01 4407 1.07 1.81 0.86 125 T_XMDrugObfuBody_00 4265 0.97 1.44 0.83 126 XMBdyGiftCard01 4112 1.10 2.17 0.80 127 TM2_M_VERY_LONG_WORD 4071 1.05 1.95 0.79 128 T_OBFU_PDF_ATTACH 3996 0.63 0.13 0.78 129 HTML_FONT_FACE_BAD 3728 0.79 1.00 0.73 130 TO_NO_BRKTS_HTML_ONLY 3567 0.57 0.14 0.70 131 XMSubMetaI_00 3533 0.91 1.67 0.69 132 XMSexyCombo_04 3499 0.77 1.06 0.68 133 XM_H_PHPMailer 3456 0.68 0.69 0.67 134 XM_ProductURIs 3400 0.69 0.79 0.66 135 NML_ADSP_CUSTOM_MED 3305 0.65 0.69 0.64 136 FILL_THIS_FORM 3214 0.56 0.31 0.63 137 TR_XM_RelayPhish 3135 0.77 1.34 0.61 138 XMSubNoVowel 3096 0.55 0.35 0.60 139 XM_RXBody 3053 0.65 0.82 0.60 140 T_Symld_Words_02 3042 0.66 0.91 0.59 141 FORGED_GMAIL_RCVD 3032 0.60 0.65 0.59 142 XMGappySubj_01 3030 0.54 0.37 0.59 143 RCVD_IN_BL_SPAMCOP_NET 2973 0.92 2.11 0.58 144 XMLngstWrd_00 2933 0.55 0.49 0.57 145 XMNoVowels 2926 0.56 0.53 0.57 146 FROM_GOV_SPOOF 2922 0.54 0.43 0.57 147 T_XMHurry_00 2912 0.77 1.50 0.57 148 HTTPS_HTTP_MISMATCH 2887 0.70 1.19 0.56 149 MISSING_HEADERS 2810 1.38 4.29 0.55 150 T_FILL_THIS_FORM_LONG 2765 0.46 0.20 0.54 151 USER_IN_WHITELIST 2755 0.42 0.00 0.54 152 T_HTML_ATTACH 2732 0.45 0.17 0.53 153 XMPhish14 2724 0.67 1.17 0.53 154 XMLngstWrd_01 2707 0.50 0.40 0.53 155 T_TooManySym_03 2632 0.44 0.20 0.51 156 URI_NOVOWEL 2623 0.58 0.81 0.51 157 RELAYCOUNTRY_AU 2616 0.55 0.68 0.51 158 XMMoneyMeta_00 2597 0.80 1.83 0.51 159 XMSubMetaSxObfu_03 2564 0.63 1.10 0.50 160 TR_LOTS_OF_MONEY3 2554 2.28 8.57 0.50 161 SHORT_HELO_AND_INLINE_IMAGE 2520 0.39 0.05 0.49 162 XM_B_REG_HTML 2509 0.53 0.69 0.49 163 XMBrknScrpt_02 2479 0.53 0.68 0.48 164 XMBody_17 2451 0.69 1.42 0.48 165 DKIM_ADSP_NXDOMAIN 2447 0.65 1.25 0.48 166 XMHTML_After_End 2443 0.65 1.24 0.48 167 XMBody_95 2404 0.39 0.09 0.47 168 XMHTMLBadTable_001 2392 0.59 1.03 0.47 169 SUBJ_DOLLARS 2370 0.70 1.53 0.46 170 XM_ShortIntro_01 2308 0.45 0.46 0.45 171 TM2_M_BODY_EMPTY 2289 0.37 0.12 0.45 172 RELAYCOUNTRY_DE 2272 0.49 0.66 0.44 173 REMOVE_BEFORE_LINK 2252 0.55 0.96 0.44 174 XMBody_78 2250 0.54 0.90 0.44 175 HTML_IMAGE_ONLY_28 2218 0.47 0.61 0.43 176 XMSubMetaSxObfu_02 2203 0.39 0.25 0.43 177 XM_B_COPY_HTML 2198 0.50 0.75 0.43 178 XMDateMe_00 2183 0.42 0.42 0.43 179 XM_USANA_RCVD 2173 0.33 0.00 0.42 180 RDNS_DYNAMIC 2147 0.60 1.22 0.42 181 RCVD_IN_SORBS_DUL 2091 0.38 0.29 0.41 182 HTML_IMAGE_ONLY_08 2083 0.61 1.35 0.41 183 HTML_IMAGE_ONLY_32 2041 0.42 0.48 0.40 184 HTML_TAG_BALANCE_BODY 2030 0.49 0.83 0.40 185 PLING_QUERY 1933 0.49 0.88 0.38 186 XM_URI_RBL 1868 0.88 2.69 0.36 187 TM2_M_A_HREF_HREF 1862 0.46 0.81 0.36 188 XMPhish30 1833 0.62 1.55 0.36 189 XMSolicitRefs_0 1812 0.34 0.30 0.35 190 T_MONEY_PERCENT 1804 0.60 1.49 0.35 191 TR_LOTS_OF_MONEY2 1804 0.60 1.49 0.35 192 T_FROM_GOV_DKIM_AU 1757 0.40 0.60 0.34 193 XMSlimDrugH 1732 0.45 0.87 0.34 194 XM_S_JOY_D 1693 0.94 3.07 0.33 195 HTML_IMAGE_ONLY_24 1677 0.36 0.49 0.33 196 FILL_THIS_FORM_LOAN 1654 0.28 0.15 0.32 197 XM_H_PHPOS_M 1649 0.36 0.48 0.32 198 T_OBFU_HTML_ATTACH 1629 0.27 0.11 0.32 199 NO_DNS_FOR_FROM 1626 0.40 0.71 0.32 200 DIET_1 1625 0.49 1.11 0.32 ----------------------------------------------------------------------