Email: 644058 Autolearn: 0 AvgScore: 3.00 AvgScanTime: 1.95 sec Spam: 192537 Autolearn: 0 AvgScore: 12.59 AvgScanTime: 2.29 sec Ham: 451521 Autolearn: 0 AvgScore: -1.09 AvgScanTime: 1.81 sec Time Spent Running SA: 349.65 hours Time Spent Processing Spam: 122.57 hours Time Spent Processing Ham: 227.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172499 88.19 89.59 87.60 2 DCC_CHECK 142616 48.38 74.07 37.43 3 DKIM_SIGNED 142138 73.68 73.82 73.62 4 XM_DK_Pass 138988 72.28 72.19 72.32 5 DKIM_VALID 132020 68.67 68.57 68.71 6 XMListUnsubscribeExists 129549 54.37 67.29 48.86 7 DKIM_VALID_AU 107540 50.81 55.85 48.66 8 XM_H_QuotedFrom 88802 39.90 46.12 37.25 9 XM_DK_Undo_02 88639 25.07 46.04 16.12 10 BAYES_99 81871 23.10 42.52 14.82 11 BAYES_999 70240 20.24 36.48 13.32 12 TR_DCC_Bayes_99 67852 15.65 35.24 7.30 13 HTML_FONT_LOW_CONTRAST 67414 29.48 35.01 27.13 14 MIME_HTML_ONLY 67215 24.57 34.91 20.17 15 BAYES_50 62877 47.88 32.66 54.37 16 LOC_TINY_FONT_1 60478 24.17 31.41 21.08 17 XMSubLong 53741 24.31 27.91 22.77 18 DCC_CHECK_NEGATIVE 47048 49.58 24.44 60.30 19 FVGT_m_MULTI_ODD 46157 22.01 23.97 21.17 20 XM_Body_Dirty_Words 38413 14.56 19.95 12.26 21 DKIM_VALID_EF 36577 24.98 19.00 27.53 22 T_KAM_HTML_FONT_INVALID 36134 17.27 18.77 16.63 23 T_TM2_M_HEADER_IN_MSG 35502 27.94 18.44 32.00 24 XM_Multi_Part_URI 34962 13.61 18.16 11.67 25 BOTNET 34894 6.61 18.12 1.70 26 RELAYCOUNTRY_META 33042 9.24 17.16 5.86 27 LOTS_OF_MONEY 31554 11.89 16.39 9.96 28 MultiRelay 28219 17.20 14.66 18.29 29 BOTNET_IPINHOSTNAME 24952 7.15 12.96 4.67 30 HTML_IMAGE_RATIO_02 24840 8.82 12.90 7.08 31 XM_Evil_Numbers_Gen 24694 9.60 12.83 8.22 32 XMSexyCombo_05 21336 6.02 11.08 3.86 33 FSL_BULK_SIG 19407 7.76 10.08 6.76 34 UNTRUSTED_Relay 18666 4.33 9.69 2.04 35 T_XMDrugObfuBody_14 18472 9.01 9.59 8.76 36 BAYES_80 18203 5.95 9.45 4.45 37 XM_UncommonTLD01 17111 4.82 8.89 3.09 38 RCVD_IN_RP_RNBL 16755 2.63 8.70 0.04 39 HTML_IMAGE_RATIO_04 16513 6.48 8.58 5.58 40 TooManyTo_001 15176 8.96 7.88 9.43 41 XM_B_Phish_Phrases 14424 6.25 7.49 5.72 42 XMSubMetaSx_00 14124 5.07 7.34 4.10 43 MPART_ALT_DIFF 13985 4.21 7.26 2.90 44 HTML_MIME_NO_HTML_TAG 13524 3.96 7.02 2.65 45 XM_H_Long_From01 13292 6.29 6.90 6.02 46 MIME_HEADER_CTYPE_ONLY 12987 2.15 6.75 0.19 47 LotsOfNums_01 12077 8.16 6.27 8.96 48 FROM_EXCESS_BASE64 11981 4.42 6.22 3.65 49 RCVD_IN_PSBL 11883 1.88 6.17 0.06 50 BAYES_60 10851 6.39 5.64 6.71 51 ALL_TRUSTED 10645 13.40 5.53 16.76 52 ANY_BOUNCE_MESSAGE 10549 2.94 5.48 1.85 53 BOUNCE_MESSAGE 10548 2.94 5.48 1.85 54 XM_UB50 10286 2.74 5.34 1.64 55 DKIM_INVALID 10118 5.01 5.26 4.91 56 XM_H_PHPOS 9998 2.28 5.19 1.04 57 BAYES_95 9370 3.35 4.87 2.70 58 HTML_IMAGE_RATIO_06 9308 3.68 4.83 3.19 59 TO_NO_BRKTS_HTML_ONLY 8781 1.50 4.56 0.19 60 XM_S_SubURI 8597 1.35 4.47 0.03 61 XM_DIRTYINTL 8427 2.57 4.38 1.79 62 XM_SPF_SoftFail 8158 2.76 4.24 2.14 63 HTML_IMAGE_RATIO_08 8079 2.90 4.20 2.34 64 MIME_HTML_ONLY_MULTI 7820 2.34 4.06 1.60 65 MIME_HTML_MOSTLY 7517 2.69 3.90 2.17 66 XMStrtUSub 7430 4.17 3.86 4.30 67 XMNumbers 7422 3.17 3.85 2.88 68 RCVD_IN_RP_SAFE 7355 8.48 3.82 10.47 69 XM_OfRef6 6760 2.38 3.51 1.90 70 RELAYCOUNTRY_CA 6612 2.04 3.43 1.44 71 XM_SendGrid 6414 4.86 3.33 5.51 72 RELAYCOUNTRY_DE 6379 1.31 3.31 0.46 73 TM2_M_URI_OPT_OUT 6252 2.41 3.25 2.05 74 URI_HEX 6152 2.17 3.20 1.74 75 T_TooManySym_01 6098 4.70 3.17 5.35 76 T_REMOTE_IMAGE 6061 4.10 3.15 4.51 77 XM_URI_RBL 5991 1.26 3.11 0.47 78 RCVD_IN_RP_CERTIFIED 5806 7.41 3.02 9.29 79 XM_CamelCaseFrm001 5564 2.15 2.89 1.83 80 FROM_SUSPICIOUS_NTLD 5468 0.89 2.84 0.06 81 NUMERIC_HTTP_ADDR 5400 1.19 2.80 0.51 82 SpammyFromTLD_01 5388 1.30 2.80 0.66 83 SUBJ_ALL_CAPS 5303 2.00 2.75 1.68 84 MIME_QP_LONG_LINE 5244 5.14 2.72 6.17 85 XMBdyGiftCard01 5213 1.19 2.71 0.55 86 RCVD_IN_MSPIKE_H2 5068 3.86 2.63 4.39 87 DKIM_ADSP_NXDOMAIN 4961 1.23 2.58 0.66 88 MultiRelay_Combo 4783 0.86 2.48 0.17 89 MultiRelay_CC 4783 0.86 2.48 0.17 90 TR_Mismatch_TLD_02 4700 0.77 2.44 0.05 91 XMDiploma_00 4645 1.83 2.41 1.59 92 FILL_THIS_FORM 4384 0.95 2.28 0.39 93 SpammyFromTLD_02 4367 0.94 2.27 0.37 94 FILL_THIS_FORM_LONG 4269 0.88 2.22 0.31 95 XM_H_Long_From02 4025 1.87 2.09 1.78 96 XMBody_17 4021 1.06 2.09 0.62 97 XMSubMetaI_00 3926 1.02 2.04 0.58 98 NORMAL_HTTP_TO_IP 3876 0.67 2.01 0.10 99 XMSexyCombo_01 3791 1.09 1.97 0.71 100 T_XMDrugObfuBody_08 3789 1.55 1.97 1.37 101 XMGenDplmaNmb 3751 1.26 1.95 0.96 102 NO_DNS_FOR_FROM 3577 1.34 1.86 1.13 103 HDRS_LCASE_IMGONLY 3552 0.58 1.84 0.04 104 T_TooManySym_02 3528 1.79 1.83 1.77 105 BAYES_40 3527 2.83 1.83 3.26 106 XMSubject_48 3527 0.56 1.83 0.02 107 URI_TRY_3LD 3442 1.82 1.79 1.84 108 T_XMDrugObfuBody_00 3428 1.09 1.78 0.79 109 XM_UB99 3381 0.54 1.76 0.02 110 TM2_M_VERY_LONG_WORD 3369 1.10 1.75 0.82 111 RCVD_IN_IADB_LISTED 3336 4.69 1.73 5.96 112 XMPhish11 3222 1.23 1.67 1.05 113 RCVD_IN_BL_SPAMCOP_NET 3091 0.83 1.61 0.50 114 BAYES_20 3013 2.23 1.56 2.51 115 XMMoneyMeta_00 2990 0.88 1.55 0.60 116 RELAYCOUNTRY_GB 2971 1.18 1.54 1.02 117 FILL_THIS_FORM_LOAN 2965 0.66 1.54 0.29 118 TR_LOTS_OF_MONEY2 2910 0.85 1.51 0.56 119 T_MONEY_PERCENT 2910 0.85 1.51 0.56 120 MAILING_LIST_MULTI 2864 2.37 1.49 2.74 121 T_FILL_THIS_FORM_SHORT 2845 1.10 1.48 0.94 122 XM_UB999 2812 0.45 1.46 0.01 123 RCVD_IN_IADB_SPF 2731 4.10 1.42 5.25 124 BOTNET_NORDNS 2679 0.43 1.39 0.01 125 XMBody_78 2593 0.68 1.35 0.40 126 XM_UB60 2558 0.46 1.33 0.09 127 XMStockSpam_06 2536 1.36 1.32 1.37 128 XMBrknScrpt_02 2534 0.88 1.32 0.69 129 LIST_PARTIAL 2493 0.43 1.29 0.06 130 RCVD_IN_IADB_SENDERID 2477 3.61 1.29 4.61 131 FSL_THIS_IS_ADV 2459 0.46 1.28 0.11 132 XM_OfRef7 2428 0.58 1.26 0.29 133 RCVD_IN_IADB_DK 2418 3.56 1.26 4.54 134 RELAYCOUNTRY_FR 2391 0.53 1.24 0.22 135 HTML_SHORT_LINK_IMG_3 2386 0.42 1.24 0.07 136 TR_XM_RelayPhish 2330 0.79 1.21 0.61 137 XMNoVowels 2305 0.82 1.20 0.65 138 UNPARSEABLE_RELAY 2292 2.23 1.19 2.67 139 XMPhish14 2280 0.65 1.18 0.42 140 T_XMHurry_00 2270 1.13 1.18 1.10 141 TR_Symld_Words 2251 1.53 1.17 1.69 142 HTML_IMAGE_ONLY_20 2219 0.53 1.15 0.26 143 XMPhish30 2158 0.61 1.12 0.39 144 HTML_FONT_FACE_BAD 2131 0.69 1.11 0.52 145 RCVD_IN_IADB_VOUCHED 2107 3.05 1.09 3.89 146 DIET_1 2106 0.56 1.09 0.33 147 XMSubGiftCard1 2075 0.36 1.08 0.05 148 XM_ProductURIs 2070 1.23 1.08 1.29 149 RELAYCOUNTRY_CN 2060 0.36 1.07 0.06 150 XM_Lotto 2023 0.47 1.05 0.22 151 XMHTML_After_End 1994 0.57 1.04 0.38 152 XM_H_TOP 1993 0.31 1.04 0.01 153 XM_salutation2 1988 0.79 1.03 0.68 154 XMHTMLBadTable_001 1987 0.66 1.03 0.51 155 MONEY_FORM 1980 0.31 1.03 0.01 156 T_Symld_Words_02 1959 0.82 1.02 0.74 157 DATE_IN_PAST_12_24 1941 0.36 1.01 0.08 158 XM_HighProb1 1928 0.31 1.00 0.02 159 RELAYCOUNTRY_IN 1919 0.38 1.00 0.11 160 TR_M_TOP_BAYES 1870 0.29 0.97 0.00 161 FROM_MISSP_REPLYTO 1868 0.30 0.97 0.01 162 TR_Caps_n_Bayes_99 1867 0.38 0.97 0.13 163 BODY_URI_ONLY 1829 0.33 0.95 0.06 164 URI_NOVOWEL 1811 0.80 0.94 0.73 165 ADVANCE_FEE_5_NEW_FRM_MNY 1778 0.28 0.92 0.00 166 TVD_RCVD_IP 1763 2.15 0.92 2.68 167 URIBL_BLACK 1752 0.31 0.91 0.06 168 MONEY_FRAUD_5 1751 0.27 0.91 0.00 169 HELO_NODOT 1737 1.41 0.90 1.62 170 MONEY_FROM_MISSP 1734 0.27 0.90 0.00 171 HELO_NO_DOMAIN 1716 1.40 0.89 1.62 172 HTML_IMAGE_ONLY_24 1708 0.52 0.89 0.37 173 MPART_ALT_DIFF_COUNT 1699 0.41 0.88 0.21 174 XMSlimDrugH 1693 0.49 0.88 0.32 175 XM_B_REG_HTML 1636 0.58 0.85 0.46 176 HK_LOTTO 1623 0.26 0.84 0.01 177 DEAR_WINNER 1601 0.25 0.83 0.00 178 HK_SCAM 1587 0.26 0.82 0.02 179 XM_RXBody 1587 0.38 0.82 0.19 180 DATE_IN_PAST_06_12 1582 0.27 0.82 0.03 181 XMSubMetaSxObfu_03 1579 0.52 0.82 0.39 182 LONG_JUNK_URI 1574 0.31 0.82 0.10 183 BIGNUM_EMAILS 1571 0.25 0.82 0.00 184 XMSubMetaSSx_00 1562 0.41 0.81 0.23 185 DATE_IN_PAST_03_06 1548 0.31 0.80 0.09 186 TR_LOTS_OF_MONEY3 1545 0.50 0.80 0.37 187 XM_DK_Undo_01 1516 1.56 0.79 1.89 188 BAYES_05 1500 1.31 0.78 1.53 189 HTML_FONT_SIZE_LARGE 1472 0.38 0.76 0.21 190 LongTLD 1469 0.33 0.76 0.15 191 RELAYCOUNTRY_NL 1461 0.33 0.76 0.14 192 BODY_ENHANCEMENT 1456 0.24 0.76 0.02 193 T_HTML_TAG_BALANCE_CENTER 1443 0.29 0.75 0.10 194 RCVD_IN_IADB_OPTIN 1439 1.96 0.75 2.47 195 XMSubMetaD_03 1426 0.25 0.74 0.03 196 XM_PDF 1417 3.60 0.74 4.82 197 RELAYCOUNTRY_AU 1407 0.64 0.73 0.61 198 HTML_IMAGE_ONLY_28 1391 0.47 0.72 0.36 199 HTML_IMAGE_ONLY_16 1390 0.44 0.72 0.32 200 XM_Body_Obfu01 1372 0.41 0.71 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 395520 88.19 89.59 87.60 2 DKIM_SIGNED 332403 73.68 73.82 73.62 3 XM_DK_Pass 326554 72.28 72.19 72.32 4 DKIM_VALID 310239 68.67 68.57 68.71 5 DCC_CHECK_NEGATIVE 272266 49.58 24.44 60.30 6 BAYES_50 245495 47.88 32.66 54.37 7 XMListUnsubscribeExists 220618 54.37 67.29 48.86 8 DKIM_VALID_AU 219715 50.81 55.85 48.66 9 DCC_CHECK 168983 48.38 74.07 37.43 10 XM_H_QuotedFrom 168189 39.90 46.12 37.25 11 T_TM2_M_HEADER_IN_MSG 144469 27.94 18.44 32.00 12 DKIM_VALID_EF 124299 24.98 19.00 27.53 13 HTML_FONT_LOW_CONTRAST 122477 29.48 35.01 27.13 14 XMSubLong 102816 24.31 27.91 22.77 15 FVGT_m_MULTI_ODD 95593 22.01 23.97 21.17 16 LOC_TINY_FONT_1 95162 24.17 31.41 21.08 17 MIME_HTML_ONLY 91051 24.57 34.91 20.17 18 MultiRelay 82566 17.20 14.66 18.29 19 ALL_TRUSTED 75666 13.40 5.53 16.76 20 T_KAM_HTML_FONT_INVALID 75076 17.27 18.77 16.63 21 XM_DK_Undo_02 72803 25.07 46.04 16.12 22 BAYES_99 66922 23.10 42.52 14.82 23 XM_DKIMWhitelistDomains 60514 9.42 0.08 13.40 24 BAYES_999 60123 20.24 36.48 13.32 25 XM_Body_Dirty_Words 55371 14.56 19.95 12.26 26 XM_Multi_Part_URI 52685 13.61 18.16 11.67 27 RCVD_IN_RP_SAFE 47270 8.48 3.82 10.47 28 LOTS_OF_MONEY 44993 11.89 16.39 9.96 29 TooManyTo_001 42559 8.96 7.88 9.43 30 BAYES_00 42340 6.73 0.53 9.38 31 RCVD_IN_RP_CERTIFIED 41936 7.41 3.02 9.29 32 LotsOfNums_01 40476 8.16 6.27 8.96 33 T_XMDrugObfuBody_14 39552 9.01 9.59 8.76 34 XM_Evil_Numbers_Gen 37107 9.60 12.83 8.22 35 TR_DCC_Bayes_99 32947 15.65 35.24 7.30 36 HTML_IMAGE_RATIO_02 31980 8.82 12.90 7.08 37 TR_XM_DK_Bayes 31387 4.95 0.26 6.95 38 FSL_BULK_SIG 30544 7.76 10.08 6.76 39 BAYES_60 30282 6.39 5.64 6.71 40 TR_XM_DK_Bayes1 29861 4.70 0.21 6.61 41 MIME_QP_LONG_LINE 27872 5.14 2.72 6.17 42 XM_H_Long_From01 27188 6.29 6.90 6.02 43 RCVD_IN_IADB_LISTED 26899 4.69 1.73 5.96 44 TR_XM_DK_Bayes2 26476 4.16 0.17 5.86 45 RELAYCOUNTRY_META 26455 9.24 17.16 5.86 46 XM_B_Phish_Phrases 25846 6.25 7.49 5.72 47 HTML_IMAGE_RATIO_04 25211 6.48 8.58 5.58 48 XM_SendGrid 24872 4.86 3.33 5.51 49 T_TooManySym_01 24146 4.70 3.17 5.35 50 RCVD_IN_IADB_SPF 23683 4.10 1.42 5.25 51 DKIM_INVALID 22164 5.01 5.26 4.91 52 XM_PDF 21767 3.60 0.74 4.82 53 BOTNET_IPINHOSTNAME 21105 7.15 12.96 4.67 54 RCVD_IN_IADB_SENDERID 20799 3.61 1.29 4.61 55 RCVD_IN_IADB_DK 20517 3.56 1.26 4.54 56 T_REMOTE_IMAGE 20366 4.10 3.15 4.51 57 BAYES_80 20102 5.95 9.45 4.45 58 RCVD_IN_MSPIKE_H2 19817 3.86 2.63 4.39 59 XMStrtUSub 19397 4.17 3.86 4.30 60 IN_ZIMBRA_NJ_WHITELIST 19278 3.00 0.03 4.27 61 XMSubMetaSx_00 18517 5.07 7.34 4.10 62 RCVD_IN_IADB_VOUCHED 17554 3.05 1.09 3.89 63 XMSexyCombo_05 17449 6.02 11.08 3.86 64 FROM_EXCESS_BASE64 16467 4.42 6.22 3.65 65 BAYES_40 14724 2.83 1.83 3.26 66 HTML_IMAGE_RATIO_06 14383 3.68 4.83 3.19 67 XM_UncommonTLD01 13964 4.82 8.89 3.09 68 MPART_ALT_DIFF 13111 4.21 7.26 2.90 69 XMNumbers 13021 3.17 3.85 2.88 70 MAILING_LIST_MULTI 12374 2.37 1.49 2.74 71 TO_MALFORMED 12354 1.94 0.09 2.74 72 BAYES_95 12189 3.35 4.87 2.70 73 TVD_RCVD_IP 12100 2.15 0.92 2.68 74 UNPARSEABLE_RELAY 12075 2.23 1.19 2.67 75 HTML_MIME_NO_HTML_TAG 11952 3.96 7.02 2.65 76 BAYES_20 11348 2.23 1.56 2.51 77 RCVD_IN_IADB_OPTIN 11173 1.96 0.75 2.47 78 TooManyTo_002 10689 1.82 0.53 2.37 79 HTML_IMAGE_RATIO_08 10569 2.90 4.20 2.34 80 MIME_HTML_MOSTLY 9796 2.69 3.90 2.17 81 XM_SPF_SoftFail 9644 2.76 4.24 2.14 82 TM2_M_URI_OPT_OUT 9260 2.41 3.25 2.05 83 UNTRUSTED_Relay 9226 4.33 9.69 2.04 84 RCVD_IN_MSPIKE_WL 9126 1.61 0.66 2.02 85 RCVD_IN_MSPIKE_H3 9125 1.61 0.66 2.02 86 XM_OfRef6 8578 2.38 3.51 1.90 87 XM_DK_Undo_01 8523 1.56 0.79 1.89 88 BOUNCE_MESSAGE 8360 2.94 5.48 1.85 89 ANY_BOUNCE_MESSAGE 8360 2.94 5.48 1.85 90 URI_TRY_3LD 8312 1.82 1.79 1.84 91 XM_CamelCaseFrm001 8262 2.15 2.89 1.83 92 XM_DIRTYINTL 8097 2.57 4.38 1.79 93 XM_H_Long_From02 8036 1.87 2.09 1.78 94 T_TooManySym_02 7993 1.79 1.83 1.77 95 IN_HORDE_ADDRESS_BOOK 7975 1.25 0.03 1.77 96 URI_HEX 7837 2.17 3.20 1.74 97 BOTNET 7655 6.61 18.12 1.70 98 TR_Symld_Words 7616 1.53 1.17 1.69 99 SUBJ_ALL_CAPS 7573 2.00 2.75 1.68 100 TR_MetaPhish_Combo_01 7468 1.35 0.63 1.65 101 XM_UB50 7387 2.74 5.34 1.64 102 HELO_NODOT 7334 1.41 0.90 1.62 103 HELO_NO_DOMAIN 7333 1.40 0.89 1.62 104 TooManyTo_003 7265 1.25 0.39 1.61 105 INVALID_MSGID 7257 1.18 0.17 1.61 106 MIME_HTML_ONLY_MULTI 7220 2.34 4.06 1.60 107 XMDiploma_00 7161 1.83 2.41 1.59 108 BAYES_05 6928 1.31 0.78 1.53 109 XMCapTrack 6588 1.09 0.24 1.46 110 RELAYCOUNTRY_CA 6498 2.04 3.43 1.44 111 USER_IN_DEF_DKIM_WL 6478 1.02 0.03 1.43 112 T_XMDrugObfuBody_08 6201 1.55 1.97 1.37 113 XMStockSpam_06 6201 1.36 1.32 1.37 114 XM_ProductURIs 5823 1.23 1.08 1.29 115 XM_GoogleGroups 5821 1.02 0.40 1.29 116 TooManyTo_004 5090 0.88 0.31 1.13 117 NO_DNS_FOR_FROM 5085 1.34 1.86 1.13 118 T_XMHurry_00 4986 1.13 1.18 1.10 119 DKIM_ADSP_CUSTOM_MED 4886 0.94 0.60 1.08 120 XMPhish11 4723 1.23 1.67 1.05 121 XM_H_PHPOS 4687 2.28 5.19 1.04 122 RELAYCOUNTRY_GB 4618 1.18 1.54 1.02 123 XMGenDplmaNmb 4357 1.26 1.95 0.96 124 T_FILL_THIS_FORM_SHORT 4259 1.10 1.48 0.94 125 XMGappySubj_01 4113 0.81 0.58 0.91 126 TooManyTo_005 4032 0.71 0.27 0.89 127 RELAYCOUNTRY_PH 3988 0.62 0.02 0.88 128 TM2_M_VERY_LONG_WORD 3707 1.10 1.75 0.82 129 T_XMDrugObfuBody_00 3581 1.09 1.78 0.79 130 NML_ADSP_CUSTOM_MED 3474 0.71 0.56 0.77 131 T_Symld_Words_02 3320 0.82 1.02 0.74 132 URI_NOVOWEL 3315 0.80 0.94 0.73 133 XMSexyCombo_01 3198 1.09 1.97 0.71 134 XMBrknScrpt_02 3117 0.88 1.32 0.69 135 XMBody_95 3114 0.50 0.06 0.69 136 XM_salutation2 3090 0.79 1.03 0.68 137 USER_IN_WHITELIST 3031 0.47 0.00 0.67 138 DKIM_ADSP_NXDOMAIN 2972 1.23 2.58 0.66 139 SpammyFromTLD_01 2971 1.30 2.80 0.66 140 XMNoVowels 2950 0.82 1.20 0.65 141 XMBody_17 2811 1.06 2.09 0.62 142 T_OBFU_PDF_ATTACH 2809 0.49 0.17 0.62 143 TR_XM_RelayPhish 2760 0.79 1.21 0.61 144 RELAYCOUNTRY_AU 2740 0.64 0.73 0.61 145 XM_H_PHPMailer 2737 0.57 0.48 0.61 146 XMMoneyMeta_00 2689 0.88 1.55 0.60 147 XM_ShortIntro_01 2635 0.55 0.47 0.58 148 XMSubMetaI_00 2623 1.02 2.04 0.58 149 XMLngstWrd_00 2596 0.49 0.31 0.57 150 TM2_M_A_HREF_HREF 2588 0.52 0.39 0.57 151 HTTPS_HTTP_MISMATCH 2585 0.54 0.46 0.57 152 T_MONEY_PERCENT 2534 0.85 1.51 0.56 153 TR_LOTS_OF_MONEY2 2534 0.85 1.51 0.56 154 T_TooManySym_03 2508 0.41 0.06 0.56 155 FROM_GOV_SPOOF 2495 0.42 0.10 0.55 156 XMBdyGiftCard01 2481 1.19 2.71 0.55 157 FORGED_GMAIL_RCVD 2422 0.53 0.50 0.54 158 AC_DIV_BONANZA 2404 0.40 0.09 0.53 159 XMLngstWrd_01 2375 0.45 0.29 0.53 160 HTML_TAG_BALANCE_BODY 2359 0.54 0.57 0.52 161 HTML_FONT_FACE_BAD 2341 0.69 1.11 0.52 162 XMHTMLBadTable_001 2294 0.66 1.03 0.51 163 XMSolicitRefs_0 2285 0.47 0.38 0.51 164 XM_B_COPY_HTML 2282 0.50 0.48 0.51 165 NUMERIC_HTTP_ADDR 2281 1.19 2.80 0.51 166 RCVD_IN_BL_SPAMCOP_NET 2267 0.83 1.61 0.50 167 XM_shorewaves_Whitelist 2174 0.34 0.00 0.48 168 XMGappySubj_02 2150 0.43 0.33 0.48 169 XM_URI_RBL 2112 1.26 3.11 0.47 170 XM_B_REG_HTML 2077 0.58 0.85 0.46 171 RELAYCOUNTRY_DE 2075 1.31 3.31 0.46 172 MISSING_HEADERS 2028 0.42 0.34 0.45 173 REMOVE_BEFORE_LINK 1948 0.51 0.68 0.43 174 XMDateMe_00 1912 0.43 0.43 0.42 175 XMPhish14 1911 0.65 1.18 0.42 176 SHORT_HELO_AND_INLINE_IMAGE 1908 0.33 0.11 0.42 177 RDNS_DYNAMIC 1900 0.51 0.71 0.42 178 XMSubMetaSxObfu_02 1861 0.36 0.22 0.41 179 HTML_IMAGE_ONLY_32 1851 0.34 0.19 0.41 180 SUBJ_DOLLARS 1800 0.46 0.62 0.40 181 XMBody_78 1784 0.68 1.35 0.40 182 XMPhish30 1777 0.61 1.12 0.39 183 FILL_THIS_FORM 1755 0.95 2.28 0.39 184 TM2_M_BODY_EMPTY 1749 0.30 0.10 0.39 185 XMSubMetaSxObfu_03 1740 0.52 0.82 0.39 186 XMHTML_After_End 1702 0.57 1.04 0.38 187 TR_LOTS_OF_MONEY3 1692 0.50 0.80 0.37 188 RCVD_IN_SORBS_DUL 1669 0.33 0.25 0.37 189 SpammyFromTLD_02 1664 0.94 2.27 0.37 190 HTML_IMAGE_ONLY_24 1656 0.52 0.89 0.37 191 HTML_IMAGE_ONLY_28 1633 0.47 0.72 0.36 192 FROM_GOV_DKIM_AU 1578 0.28 0.13 0.35 193 TVD_SPACE_RATIO 1575 0.29 0.15 0.35 194 BASE64_LENGTH_79_INF 1564 0.34 0.33 0.35 195 XMLKML 1545 0.24 0.00 0.34 196 PLING_QUERY 1528 0.38 0.46 0.34 197 DIET_1 1476 0.56 1.09 0.33 198 XMSubNoVowel 1465 0.40 0.57 0.32 199 HTML_IMAGE_ONLY_16 1438 0.44 0.72 0.32 200 XMSlimDrugH 1434 0.49 0.88 0.32 ----------------------------------------------------------------------