Email: 660212 Autolearn: 0 AvgScore: 2.00 AvgScanTime: 4.22 sec Spam: 136778 Autolearn: 0 AvgScore: 12.33 AvgScanTime: 4.93 sec Ham: 523434 Autolearn: 0 AvgScore: -0.70 AvgScanTime: 4.04 sec Time Spent Running SA: 774.80 hours Time Spent Processing Spam: 187.45 hours Time Spent Processing Ham: 587.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127895 88.71 93.51 87.46 2 DKIM_SIGNED 108017 72.80 78.97 71.19 3 DCC_CHECK 107675 46.66 78.72 38.28 4 XM_DK_Pass 104892 71.27 76.69 69.86 5 DKIM_VALID 97562 66.62 71.33 65.39 6 XMListUnsubscribeExists 92895 53.59 67.92 49.85 7 DKIM_VALID_AU 74720 48.35 54.63 46.71 8 XM_H_QuotedFrom 68225 40.65 49.88 38.24 9 BAYES_50 61540 55.04 44.99 57.67 10 XM_DK_Undo_02 50383 12.99 36.84 6.76 11 HTML_FONT_LOW_CONTRAST 49281 28.00 36.03 25.91 12 MIME_HTML_ONLY 44917 21.96 32.84 19.12 13 LOC_TINY_FONT_1 43949 22.66 32.13 20.18 14 BAYES_99 39336 10.22 28.76 5.37 15 FVGT_m_MULTI_ODD 38080 21.98 27.84 20.45 16 XMSubLong 37513 22.24 27.43 20.89 17 BAYES_999 32389 8.51 23.68 4.54 18 TR_DCC_Bayes_99 32161 7.19 23.51 2.92 19 RELAYCOUNTRY_META 28761 8.59 21.03 5.34 20 BOTNET_IPINHOSTNAME 28313 7.84 20.70 4.47 21 DCC_CHECK_NEGATIVE 26481 51.37 19.36 59.73 22 DKIM_VALID_EF 25757 23.15 18.83 24.28 23 XM_Body_Dirty_Words 25235 12.62 18.45 11.09 24 T_TM2_M_HEADER_IN_MSG 25176 27.46 18.41 29.83 25 T_KAM_HTML_FONT_INVALID 24627 16.91 18.01 16.63 26 MultiRelay 23186 17.32 16.95 17.41 27 BOTNET 22397 4.63 16.37 1.56 28 XM_Multi_Part_URI 22070 12.47 16.14 11.51 29 LOTS_OF_MONEY 21510 9.98 15.73 8.48 30 FSL_BULK_SIG 20671 7.89 15.11 6.01 31 XM_UncommonTLD01 18962 5.42 13.86 3.22 32 XM_Evil_Numbers_Gen 18824 9.34 13.76 8.18 33 UNTRUSTED_Relay 18488 4.04 13.52 1.56 34 HTML_IMAGE_RATIO_02 17938 9.09 13.11 8.04 35 XMSexyCombo_05 13910 4.65 10.17 3.21 36 XMSubMetaSx_00 12352 4.66 9.03 3.52 37 TooManyTo_001 11520 8.47 8.42 8.48 38 XM_H_Long_From01 11316 6.55 8.27 6.10 39 HTML_IMAGE_RATIO_04 11127 5.36 8.14 4.64 40 BAYES_60 10861 5.57 7.94 4.95 41 T_XMDrugObfuBody_14 10843 9.40 7.93 9.78 42 DKIM_INVALID 10455 6.18 7.64 5.80 43 BAYES_80 10263 3.70 7.50 2.71 44 T_REMOTE_IMAGE 9523 4.60 6.96 3.99 45 FROM_EXCESS_BASE64 9501 4.61 6.95 4.00 46 LotsOfNums_01 9375 7.95 6.85 8.24 47 MPART_ALT_DIFF 9138 3.79 6.68 3.04 48 XM_UB50 8908 2.05 6.51 0.89 49 XM_B_Phish_Phrases 8550 5.58 6.25 5.41 50 XMNumbers 7821 4.18 5.72 3.78 51 HTML_MIME_NO_HTML_TAG 7776 2.86 5.69 2.12 52 XM_SPF_SoftFail 6634 2.73 4.85 2.18 53 RCVD_IN_RP_RNBL 6477 1.01 4.74 0.04 54 MultiRelay_Combo 5988 1.04 4.38 0.17 55 MultiRelay_CC 5988 1.04 4.38 0.17 56 HTML_IMAGE_RATIO_06 5926 3.29 4.33 3.02 57 HTML_IMAGE_RATIO_08 5884 2.54 4.30 2.08 58 XM_DIRTYINTL 5853 2.34 4.28 1.84 59 RELAYCOUNTRY_CA 5791 2.07 4.23 1.51 60 XMStrtUSub 5791 4.45 4.23 4.51 61 RCVD_IN_BL_SPAMCOP_NET 5408 1.08 3.95 0.32 62 TM2_M_URI_OPT_OUT 5404 2.48 3.95 2.09 63 MIME_HTML_ONLY_MULTI 5198 1.99 3.80 1.52 64 SpammyFromTLD_02 5151 1.04 3.77 0.33 65 XMSexyCombo_01 4979 1.18 3.64 0.54 66 MIME_HTML_MOSTLY 4905 2.88 3.59 2.70 67 BAYES_95 4883 2.07 3.57 1.67 68 XM_salutation2 4770 1.32 3.49 0.75 69 BODY_URI_ONLY 4753 0.85 3.47 0.16 70 XM_URI_RBL 4605 1.04 3.37 0.43 71 HTML_SHORT_LINK_IMG_1 4546 0.74 3.32 0.06 72 MIME_QP_LONG_LINE 4449 5.24 3.25 5.76 73 XM_SendGrid 4280 4.92 3.13 5.39 74 DKIM_ADSP_NXDOMAIN 4186 1.02 3.06 0.49 75 XMBody_17 4040 1.38 2.95 0.96 76 RCVD_IN_MSPIKE_H2 4001 3.90 2.93 4.16 77 URI_HEX 3981 1.89 2.91 1.63 78 XMSubMetaI_00 3944 1.05 2.88 0.57 79 XM_UB60 3912 0.68 2.86 0.11 80 T_TooManySym_01 3795 4.22 2.77 4.60 81 XM_CamelCaseFrm001 3785 2.05 2.77 1.86 82 MIME_HEADER_CTYPE_ONLY 3766 0.70 2.75 0.16 83 MISSING_HEADERS 3661 0.97 2.68 0.53 84 RELAYCOUNTRY_CN 3555 0.58 2.60 0.05 85 BOTNET_NORDNS 3536 0.55 2.59 0.02 86 T_XMDrugObfuBody_08 3524 1.67 2.58 1.44 87 RCVD_IN_RP_SAFE 3438 6.81 2.51 7.93 88 HTML_IMAGE_ONLY_04 3366 0.59 2.46 0.10 89 HTML_SHORT_CENTER 3316 0.53 2.42 0.04 90 XMBdyGiftCard01 3283 0.96 2.40 0.58 91 SpammyFromTLD_01 3062 1.18 2.24 0.90 92 BAYES_40 3052 4.81 2.23 5.49 93 XM_H_Long_From02 3027 1.32 2.21 1.09 94 XM_OfRef6 3025 1.34 2.21 1.11 95 RELAYCOUNTRY_IN 2960 0.54 2.16 0.11 96 UNPARSEABLE_RELAY 2918 2.35 2.13 2.41 97 SUBJ_ALL_CAPS 2917 1.65 2.13 1.52 98 RELAYCOUNTRY_FR 2855 0.63 2.09 0.25 99 XMDiploma_00 2835 1.85 2.07 1.79 100 ALL_TRUSTED 2831 16.38 2.07 20.12 101 XMSexyCombo_04 2772 0.50 2.03 0.10 102 TR_Mismatch_TLD_02 2738 0.47 2.00 0.07 103 URIBL_DBL_SPAM 2731 0.44 2.00 0.04 104 XMSubMetaSxObfu_03 2709 0.74 1.98 0.42 105 BAYES_20 2665 3.46 1.95 3.86 106 FROM_SUSPICIOUS_NTLD 2659 0.50 1.94 0.12 107 DATE_IN_PAST_06_12 2624 0.44 1.92 0.05 108 XM_BadFromFormat 2546 0.47 1.86 0.10 109 MAILING_LIST_MULTI 2491 2.24 1.82 2.35 110 BAYES_00 2431 13.08 1.78 16.03 111 TR_LOTS_OF_MONEY3 2426 0.80 1.77 0.55 112 RCVD_IN_RP_CERTIFIED 2379 5.62 1.74 6.63 113 RCVD_IN_IADB_LISTED 2359 4.77 1.72 5.57 114 XMStockSpam_06 2313 0.95 1.69 0.76 115 TVD_SPACE_RATIO_MINFP 2255 0.35 1.65 0.01 116 TR_XM_RelayPhish 2236 0.88 1.63 0.69 117 DIET_1 2197 0.68 1.61 0.44 118 TM2_M_VERY_LONG_WORD 2183 1.10 1.60 0.97 119 XM_DK_Undo_01 2155 1.79 1.58 1.84 120 HTML_IMAGE_ONLY_08 2117 0.42 1.55 0.12 121 XMGenDplmaNmb 2114 1.30 1.55 1.23 122 T_XMHurry_00 2098 0.90 1.53 0.73 123 FSL_THIS_IS_ADV 2074 0.46 1.52 0.18 124 URI_TRY_3LD 2063 1.36 1.51 1.33 125 T_HTML_TAG_BALANCE_CENTER 2045 0.42 1.50 0.14 126 TooManyTo_002 1975 1.97 1.44 2.11 127 DATE_IN_PAST_03_06 1958 0.54 1.43 0.31 128 MSGID_FROM_MTA_HEADER 1937 0.48 1.42 0.24 129 T_XMDrugObfuBody_00 1927 0.72 1.41 0.54 130 RCVD_IN_IADB_SPF 1908 4.17 1.39 4.90 131 RELAYCOUNTRY_GB 1905 1.13 1.39 1.06 132 XMGppyBdWords 1897 0.45 1.39 0.20 133 XM_UB80 1887 0.34 1.38 0.07 134 SUBJ_DOLLARS 1876 0.71 1.37 0.54 135 XMPhish30 1854 0.57 1.36 0.37 136 XM_ProductURIs 1812 0.98 1.32 0.89 137 RCVD_IN_IADB_SENDERID 1809 3.66 1.32 4.27 138 DKIM_ADSP_CUSTOM_MED 1805 1.07 1.32 1.01 139 TR_Symld_Words 1796 1.47 1.31 1.51 140 RCVD_IN_IADB_DK 1795 3.65 1.31 4.26 141 XMHTML_After_End 1788 0.76 1.31 0.62 142 TooManyTo_003 1754 1.40 1.28 1.43 143 XMPhish14 1692 0.72 1.24 0.59 144 NML_ADSP_CUSTOM_MED 1672 0.77 1.22 0.65 145 HTML_FONT_SIZE_LARGE 1665 0.42 1.22 0.21 146 TR_Mismatch_TLD_01 1658 0.36 1.21 0.13 147 BAYES_05 1658 2.02 1.21 2.23 148 URIBL_BLACK 1650 0.30 1.21 0.06 149 XMPhish11 1640 1.20 1.20 1.20 150 FORGED_GMAIL_RCVD 1635 0.70 1.20 0.57 151 RDNS_DYNAMIC 1611 0.53 1.18 0.36 152 MPART_ALT_DIFF_COUNT 1604 0.39 1.17 0.18 153 RELAYCOUNTRY_AT 1592 0.49 1.16 0.31 154 TooManyTo_004 1590 1.07 1.16 1.05 155 XM_H_PHPOS 1589 2.84 1.16 3.27 156 XMMoneyMeta_00 1561 0.67 1.14 0.55 157 T_Symld_Words_02 1558 0.83 1.14 0.75 158 TR_XM_DK_Bayes 1551 9.74 1.13 11.99 159 T_MONEY_PERCENT 1543 0.60 1.13 0.46 160 TR_LOTS_OF_MONEY2 1543 0.60 1.13 0.46 161 XMSlimDrugH 1508 0.60 1.10 0.47 162 TooManyTo_005 1488 0.91 1.09 0.87 163 XMBody_78 1485 0.68 1.09 0.58 164 XM_UB99 1485 0.24 1.09 0.02 165 HTML_IMAGE_ONLY_28 1477 0.50 1.08 0.35 166 RCVD_IN_IADB_VOUCHED 1421 2.98 1.04 3.49 167 T_FILL_THIS_FORM_SHORT 1414 0.91 1.03 0.87 168 RELAYCOUNTRY_NL 1398 0.38 1.02 0.21 169 LONG_JUNK_URI 1363 0.27 1.00 0.08 170 TR_XM_DK_Bayes1 1359 9.07 0.99 11.19 171 XMSubNoVowel 1313 0.44 0.96 0.30 172 DATE_IN_PAST_12_24 1281 0.23 0.94 0.04 173 XMSubMetaI_01 1270 0.22 0.93 0.04 174 NO_DNS_FOR_FROM 1245 0.44 0.91 0.32 175 XM_ShortIntro_01 1236 0.61 0.90 0.54 176 XM_HighProb1 1225 0.22 0.90 0.04 177 XMLongAddy 1222 0.23 0.89 0.06 178 TR_MetaPhish_Combo_01 1189 1.37 0.87 1.50 179 XMHTMLBadTable_001 1182 0.60 0.86 0.54 180 T_TooManySym_02 1156 1.35 0.85 1.49 181 NORDNS_LOW_CONTRAST 1152 0.19 0.84 0.02 182 XM_H_PHPMailer 1152 2.14 0.84 2.48 183 TR_XM_DK_Bayes2 1144 7.68 0.84 9.47 184 RELAYCOUNTRY_DE 1134 0.50 0.83 0.41 185 XM_PDF 1124 3.61 0.82 4.34 186 LONG_HEX_URI 1118 0.28 0.82 0.14 187 ANY_BOUNCE_MESSAGE 1109 3.08 0.81 3.68 188 BOUNCE_MESSAGE 1100 3.08 0.80 3.67 189 LongTLD 1092 0.30 0.80 0.17 190 BILLION_DOLLARS 1083 0.17 0.79 0.01 191 XM_UB999 1065 0.17 0.78 0.01 192 XM_RXBody 1061 0.34 0.78 0.22 193 XMSubMetaSSx_00 1055 0.33 0.77 0.21 194 XM_B_REG_HTML 1054 0.56 0.77 0.50 195 HTML_FONT_FACE_BAD 1004 0.57 0.73 0.52 196 HTML_IMAGE_ONLY_32 1001 0.48 0.73 0.41 197 XMEmptySub 993 0.22 0.73 0.09 198 LONG_JUNK_URI2 992 0.16 0.73 0.02 199 FILL_THIS_FORM 961 0.46 0.70 0.39 200 TM2_M_OBFU_COMMENT 949 0.21 0.69 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 457802 88.71 93.51 87.46 2 DKIM_SIGNED 372622 72.80 78.97 71.19 3 XM_DK_Pass 365672 71.27 76.69 69.86 4 DKIM_VALID 342267 66.62 71.33 65.39 5 DCC_CHECK_NEGATIVE 312648 51.37 19.36 59.73 6 BAYES_50 301872 55.04 44.99 57.67 7 XMListUnsubscribeExists 260908 53.59 67.92 49.85 8 DKIM_VALID_AU 244485 48.35 54.63 46.71 9 DCC_CHECK 200360 46.66 78.72 38.28 10 XM_H_QuotedFrom 200182 40.65 49.88 38.24 11 T_TM2_M_HEADER_IN_MSG 156128 27.46 18.41 29.83 12 HTML_FONT_LOW_CONTRAST 135600 28.00 36.03 25.91 13 DKIM_VALID_EF 127099 23.15 18.83 24.28 14 XMSubLong 109342 22.24 27.43 20.89 15 FVGT_m_MULTI_ODD 107039 21.98 27.84 20.45 16 LOC_TINY_FONT_1 105627 22.66 32.13 20.18 17 ALL_TRUSTED 105322 16.38 2.07 20.12 18 MIME_HTML_ONLY 100091 21.96 32.84 19.12 19 MultiRelay 91134 17.32 16.95 17.41 20 T_KAM_HTML_FONT_INVALID 87028 16.91 18.01 16.63 21 BAYES_00 83907 13.08 1.78 16.03 22 TR_XM_DK_Bayes 62756 9.74 1.13 11.99 23 XM_Multi_Part_URI 60268 12.47 16.14 11.51 24 TR_XM_DK_Bayes1 58554 9.07 0.99 11.19 25 XM_Body_Dirty_Words 58052 12.62 18.45 11.09 26 XM_DKIMWhitelistDomains 54972 8.33 0.01 10.50 27 T_XMDrugObfuBody_14 51206 9.40 7.93 9.78 28 TR_XM_DK_Bayes2 49571 7.68 0.84 9.47 29 LOTS_OF_MONEY 44412 9.98 15.73 8.48 30 TooManyTo_001 44370 8.47 8.42 8.48 31 LotsOfNums_01 43132 7.95 6.85 8.24 32 XM_Evil_Numbers_Gen 42832 9.34 13.76 8.18 33 HTML_IMAGE_RATIO_02 42090 9.09 13.11 8.04 34 RCVD_IN_RP_SAFE 41503 6.81 2.51 7.93 35 XM_DK_Undo_02 35382 12.99 36.84 6.76 36 RCVD_IN_RP_CERTIFIED 34721 5.62 1.74 6.63 37 XM_H_Long_From01 31922 6.55 8.27 6.10 38 FSL_BULK_SIG 31439 7.89 15.11 6.01 39 DKIM_INVALID 30355 6.18 7.64 5.80 40 MIME_QP_LONG_LINE 30169 5.24 3.25 5.76 41 RCVD_IN_IADB_LISTED 29130 4.77 1.72 5.57 42 BAYES_40 28713 4.81 2.23 5.49 43 XM_B_Phish_Phrases 28301 5.58 6.25 5.41 44 XM_SendGrid 28221 4.92 3.13 5.39 45 BAYES_99 28127 10.22 28.76 5.37 46 RELAYCOUNTRY_META 27941 8.59 21.03 5.34 47 BAYES_60 25890 5.57 7.94 4.95 48 RCVD_IN_IADB_SPF 25642 4.17 1.39 4.90 49 HTML_IMAGE_RATIO_04 24282 5.36 8.14 4.64 50 T_TooManySym_01 24064 4.22 2.77 4.60 51 BAYES_999 23771 8.51 23.68 4.54 52 XMStrtUSub 23613 4.45 4.23 4.51 53 BOTNET_IPINHOSTNAME 23415 7.84 20.70 4.47 54 XM_PDF 22740 3.61 0.82 4.34 55 RCVD_IN_IADB_SENDERID 22345 3.66 1.32 4.27 56 RCVD_IN_IADB_DK 22309 3.65 1.31 4.26 57 RCVD_IN_MSPIKE_H2 21753 3.90 2.93 4.16 58 FROM_EXCESS_BASE64 20944 4.61 6.95 4.00 59 T_REMOTE_IMAGE 20862 4.60 6.96 3.99 60 BAYES_20 20204 3.46 1.95 3.86 61 XMNumbers 19789 4.18 5.72 3.78 62 ANY_BOUNCE_MESSAGE 19240 3.08 0.81 3.68 63 BOUNCE_MESSAGE 19232 3.08 0.80 3.67 64 XMSubMetaSx_00 18446 4.66 9.03 3.52 65 IN_ZIMBRA_NJ_WHITELIST 18429 2.80 0.03 3.52 66 RCVD_IN_IADB_VOUCHED 18276 2.98 1.04 3.49 67 XM_H_PHPOS 17136 2.84 1.16 3.27 68 XM_UncommonTLD01 16831 5.42 13.86 3.22 69 XMSexyCombo_05 16799 4.65 10.17 3.21 70 MPART_ALT_DIFF 15908 3.79 6.68 3.04 71 HTML_IMAGE_RATIO_06 15824 3.29 4.33 3.02 72 TR_DCC_Bayes_99 15282 7.19 23.51 2.92 73 BAYES_80 14178 3.70 7.50 2.71 74 MIME_HTML_MOSTLY 14133 2.88 3.59 2.70 75 XM_H_PHPMailer 12968 2.14 0.84 2.48 76 UNPARSEABLE_RELAY 12625 2.35 2.13 2.41 77 MAILING_LIST_MULTI 12307 2.24 1.82 2.35 78 BAYES_05 11650 2.02 1.21 2.23 79 RCVD_IN_IADB_OPTIN 11587 1.90 0.69 2.21 80 XM_SPF_SoftFail 11422 2.73 4.85 2.18 81 TO_MALFORMED 11306 1.72 0.04 2.16 82 XM_H_PHPOS_M 11214 1.80 0.48 2.14 83 HTML_MIME_NO_HTML_TAG 11078 2.86 5.69 2.12 84 TooManyTo_002 11037 1.97 1.44 2.11 85 TM2_M_URI_OPT_OUT 10945 2.48 3.95 2.09 86 HTML_IMAGE_RATIO_08 10873 2.54 4.30 2.08 87 TVD_RCVD_IP 10761 1.72 0.45 2.06 88 XM_CamelCaseFrm001 9737 2.05 2.77 1.86 89 HELO_NODOT 9706 1.57 0.46 1.85 90 XM_DK_Undo_01 9654 1.79 1.58 1.84 91 XM_DIRTYINTL 9617 2.34 4.28 1.84 92 XMDiploma_00 9354 1.85 2.07 1.79 93 RCVD_IN_MSPIKE_WL 9280 1.48 0.36 1.77 94 RCVD_IN_MSPIKE_H3 9263 1.47 0.32 1.77 95 BAYES_95 8755 2.07 3.57 1.67 96 URI_HEX 8510 1.89 2.91 1.63 97 IN_HORDE_ADDRESS_BOOK 8227 1.26 0.05 1.57 98 BOTNET 8160 4.63 16.37 1.56 99 UNTRUSTED_Relay 8159 4.04 13.52 1.56 100 SUBJ_ALL_CAPS 7958 1.65 2.13 1.52 101 MIME_HTML_ONLY_MULTI 7946 1.99 3.80 1.52 102 TR_Symld_Words 7912 1.47 1.31 1.51 103 RELAYCOUNTRY_CA 7902 2.07 4.23 1.51 104 TR_MetaPhish_Combo_01 7860 1.37 0.87 1.50 105 T_TooManySym_02 7782 1.35 0.85 1.49 106 T_XMDrugObfuBody_08 7522 1.67 2.58 1.44 107 TooManyTo_003 7466 1.40 1.28 1.43 108 INVALID_MSGID 7227 1.14 0.22 1.38 109 XMCapTrack 7099 1.14 0.30 1.36 110 USER_IN_DEF_DKIM_WL 6989 1.06 0.01 1.34 111 URI_TRY_3LD 6948 1.36 1.51 1.33 112 XMGenDplmaNmb 6446 1.30 1.55 1.23 113 XM_GoogleGroups 6343 1.05 0.42 1.21 114 XMPhish11 6273 1.20 1.20 1.20 115 XM_OfRef6 5832 1.34 2.21 1.11 116 XM_H_Long_From02 5689 1.32 2.21 1.09 117 RELAYCOUNTRY_GB 5572 1.13 1.39 1.06 118 TooManyTo_004 5471 1.07 1.16 1.05 119 DKIM_ADSP_CUSTOM_MED 5270 1.07 1.32 1.01 120 TM2_M_VERY_LONG_WORD 5055 1.10 1.60 0.97 121 XMBody_17 5043 1.38 2.95 0.96 122 SpammyFromTLD_01 4727 1.18 2.24 0.90 123 XM_UB50 4642 2.05 6.51 0.89 124 XM_ProductURIs 4634 0.98 1.32 0.89 125 T_FILL_THIS_FORM_SHORT 4563 0.91 1.03 0.87 126 TooManyTo_005 4542 0.91 1.09 0.87 127 XMStockSpam_06 3978 0.95 1.69 0.76 128 XM_salutation2 3932 1.32 3.49 0.75 129 T_Symld_Words_02 3909 0.83 1.14 0.75 130 T_XMHurry_00 3821 0.90 1.53 0.73 131 TO_NO_BRKTS_HTML_ONLY 3689 0.61 0.26 0.70 132 TR_XM_RelayPhish 3601 0.88 1.63 0.69 133 NML_ADSP_CUSTOM_MED 3420 0.77 1.22 0.65 134 XMHTML_After_End 3259 0.76 1.31 0.62 135 HTTPS_HTTP_MISMATCH 3125 0.59 0.58 0.60 136 PLING_QUERY 3125 0.60 0.61 0.60 137 XMPhish14 3070 0.72 1.24 0.59 138 URI_NOVOWEL 3066 0.61 0.68 0.59 139 XMBdyGiftCard01 3055 0.96 2.40 0.58 140 XMBody_78 3025 0.68 1.09 0.58 141 FROM_GOV_SPOOF 3010 0.50 0.20 0.58 142 T_OBFU_PDF_ATTACH 2985 0.50 0.21 0.57 143 FORGED_GMAIL_RCVD 2985 0.70 1.20 0.57 144 XMSubMetaI_00 2968 1.05 2.88 0.57 145 TR_LOTS_OF_MONEY3 2886 0.80 1.77 0.55 146 XMMoneyMeta_00 2857 0.67 1.14 0.55 147 T_XMDrugObfuBody_00 2831 0.72 1.41 0.54 148 SUBJ_DOLLARS 2829 0.71 1.37 0.54 149 XMHTMLBadTable_001 2812 0.60 0.86 0.54 150 XM_ShortIntro_01 2805 0.61 0.90 0.54 151 XMSexyCombo_01 2801 1.18 3.64 0.54 152 USER_IN_WHITELIST 2789 0.42 0.00 0.53 153 XMNoVowels 2769 0.50 0.40 0.53 154 MISSING_HEADERS 2756 0.97 2.68 0.53 155 HTML_FONT_FACE_BAD 2740 0.57 0.73 0.52 156 XMBrknScrpt_02 2706 0.55 0.69 0.52 157 XMLngstWrd_00 2703 0.47 0.31 0.52 158 XM_B_REG_HTML 2613 0.56 0.77 0.50 159 DKIM_ADSP_NXDOMAIN 2578 1.02 3.06 0.49 160 XMBody_95 2555 0.41 0.09 0.49 161 HTML_TAG_BALANCE_BODY 2550 0.51 0.58 0.49 162 RELAYCOUNTRY_AU 2545 0.51 0.62 0.49 163 T_TooManySym_03 2528 0.43 0.22 0.48 164 TM2_M_A_HREF_HREF 2524 0.52 0.68 0.48 165 XMGappySubj_01 2524 0.44 0.28 0.48 166 XMLngstWrd_01 2490 0.43 0.28 0.48 167 XMSlimDrugH 2484 0.60 1.10 0.47 168 XM_B_COPY_HTML 2471 0.48 0.50 0.47 169 T_MONEY_PERCENT 2401 0.60 1.13 0.46 170 TR_LOTS_OF_MONEY2 2401 0.60 1.13 0.46 171 REMOVE_BEFORE_LINK 2390 0.46 0.48 0.46 172 SHORT_HELO_AND_INLINE_IMAGE 2388 0.37 0.04 0.46 173 DIET_1 2322 0.68 1.61 0.44 174 XM_URI_RBL 2264 1.04 3.37 0.43 175 XMSubMetaSxObfu_03 2185 0.74 1.98 0.42 176 RELAYCOUNTRY_DE 2168 0.50 0.83 0.41 177 XMDateMe_00 2151 0.40 0.38 0.41 178 HTML_IMAGE_ONLY_32 2138 0.48 0.73 0.41 179 FILL_THIS_FORM 2048 0.46 0.70 0.39 180 T_HTML_ATTACH 1923 0.31 0.08 0.37 181 XMPhish30 1921 0.57 1.36 0.37 182 AC_DIV_BONANZA 1915 0.31 0.10 0.37 183 RDNS_DYNAMIC 1909 0.53 1.18 0.36 184 TM2_M_BODY_EMPTY 1901 0.33 0.20 0.36 185 XMSubMetaSxObfu_02 1901 0.40 0.55 0.36 186 RCVD_IN_SORBS_DUL 1857 0.36 0.39 0.35 187 HTML_IMAGE_ONLY_28 1841 0.50 1.08 0.35 188 TVD_SPACE_RATIO 1832 0.36 0.38 0.35 189 FROM_GOV_DKIM_AU 1746 0.29 0.10 0.33 190 SpammyFromTLD_02 1710 1.04 3.77 0.33 191 XM_Body_Obfu01 1704 0.35 0.45 0.33 192 RCVD_IN_BL_SPAMCOP_NET 1701 1.08 3.95 0.32 193 XMOemUri 1661 0.30 0.21 0.32 194 NO_DNS_FOR_FROM 1655 0.44 0.91 0.32 195 RELAYCOUNTRY_AT 1623 0.49 1.16 0.31 196 FILL_THIS_FORM_LONG 1619 0.37 0.61 0.31 197 DATE_IN_PAST_03_06 1598 0.54 1.43 0.31 198 XMSolicitRefs_0 1580 0.33 0.42 0.30 199 XMSubNoVowel 1573 0.44 0.96 0.30 200 HTML_IMAGE_ONLY_24 1518 0.29 0.29 0.29 ----------------------------------------------------------------------