Email: 664835 Autolearn: 0 AvgScore: 3.85 AvgScanTime: 2.09 sec Spam: 208417 Autolearn: 0 AvgScore: 13.40 AvgScanTime: 2.72 sec Ham: 456418 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.80 sec Time Spent Running SA: 385.36 hours Time Spent Processing Spam: 157.67 hours Time Spent Processing Ham: 227.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153521 83.05 73.66 87.34 2 DKIM_SIGNED 129429 67.13 62.10 69.43 3 DCC_CHECK 126467 43.34 60.68 35.42 4 XM_DK_Pass 126149 65.62 60.53 67.94 5 DKIM_VALID 119909 62.23 57.53 64.38 6 XMListUnsubscribeExists 113229 47.80 54.33 44.82 7 BAYES_50 102493 52.56 49.18 54.11 8 DKIM_VALID_AU 98153 46.63 47.09 46.41 9 DCC_CHECK_NEGATIVE 79686 54.88 38.23 62.48 10 XM_DK_Undo_02 78881 21.36 37.85 13.83 11 XM_H_QuotedFrom 78314 36.30 37.58 35.71 12 BOTNET 70662 11.83 33.90 1.75 13 BAYES_99 70562 19.33 33.86 12.70 14 HTML_FONT_LOW_CONTRAST 64007 26.34 30.71 24.34 15 T_TM2_M_HEADER_IN_MSG 63449 31.32 30.44 31.72 16 BAYES_999 59614 16.67 28.60 11.22 17 TR_DCC_Bayes_99 58446 13.00 28.04 6.13 18 LOC_TINY_FONT_1 57459 22.03 27.57 19.50 19 MIME_HTML_ONLY 56591 24.43 27.15 23.18 20 LOTS_OF_MONEY 54460 13.66 26.13 7.96 21 RCVD_IN_RP_RNBL 52015 7.85 24.96 0.03 22 RCVD_IN_PSBL 49022 7.37 23.52 0.00 23 ANY_BOUNCE_MESSAGE 48541 8.61 23.29 1.90 24 BOUNCE_MESSAGE 48541 8.61 23.29 1.90 25 FVGT_m_MULTI_ODD 45426 20.00 21.80 19.19 26 XMSubLong 42120 20.58 20.21 20.75 27 XM_OfRef6 40257 7.15 19.32 1.60 28 FILL_THIS_FORM 37630 5.90 18.06 0.35 29 XM_OfRef7 37022 5.70 17.76 0.19 30 MONEY_FORM 36582 5.51 17.55 0.01 31 XM_Body_Dirty_Words 36510 12.95 17.52 10.87 32 DATE_IN_PAST_24_48 35885 5.42 17.22 0.03 33 DEAR_FRIEND 35439 5.36 17.00 0.05 34 RELAYCOUNTRY_META 33550 8.85 16.10 5.54 35 DKIM_VALID_EF 33370 22.92 16.01 26.08 36 FORM_FRAUD 31471 4.74 15.10 0.00 37 T_KAM_HTML_FONT_INVALID 30808 14.86 14.78 14.90 38 XM_Multi_Part_URI 28410 12.09 13.63 11.38 39 MultiRelay 24234 16.87 11.63 19.27 40 HTML_IMAGE_RATIO_02 23776 8.66 11.41 7.40 41 UNTRUSTED_Relay 23613 4.38 11.33 1.21 42 XM_Evil_Numbers_Gen 23514 9.12 11.28 8.14 43 BOTNET_IPINHOSTNAME 22849 6.58 10.96 4.58 44 FSL_BULK_SIG 22213 7.91 10.66 6.66 45 XMSexyCombo_05 18982 4.83 9.11 2.88 46 XM_UncommonTLD01 18949 5.02 9.09 3.15 47 FROM_EXCESS_BASE64 16434 4.91 7.89 3.54 48 T_XMDrugObfuBody_14 15330 7.73 7.36 7.90 49 XM_UB50 13604 2.58 6.53 0.77 50 XM_B_Phish_Phrases 12729 5.82 6.11 5.68 51 XMSubMetaSx_00 12614 4.25 6.05 3.43 52 TooManyTo_001 12479 7.75 5.99 8.56 53 MPART_ALT_DIFF 12317 3.68 5.91 2.66 54 XM_H_Long_From01 11656 5.65 5.59 5.67 55 T_REMOTE_IMAGE 11454 4.30 5.50 3.76 56 HTML_IMAGE_RATIO_04 10979 4.83 5.27 4.63 57 BAYES_80 10833 4.15 5.20 3.67 58 HTML_MIME_NO_HTML_TAG 10114 3.93 4.85 3.51 59 DATE_IN_PAST_12_24 9782 1.54 4.69 0.10 60 HTML_IMAGE_RATIO_06 9536 3.33 4.58 2.77 61 DKIM_INVALID 9520 4.90 4.57 5.05 62 LotsOfNums_01 9472 6.88 4.54 7.95 63 MIME_HEADER_CTYPE_ONLY 9170 1.47 4.40 0.13 64 T_XMDrugObfuBody_01 9053 1.39 4.34 0.04 65 BODY_URI_ONLY 8618 1.37 4.13 0.11 66 XM_DIRTYINTL 8584 2.60 4.12 1.91 67 BAYES_60 8527 5.35 4.09 5.93 68 HTML_SHORT_LINK_IMG_1 7906 1.21 3.79 0.03 69 MIME_HTML_MOSTLY 7867 2.74 3.77 2.27 70 XM_SPF_SoftFail 7831 2.63 3.76 2.12 71 HTML_IMAGE_ONLY_08 6984 1.13 3.35 0.12 72 SpammyFromTLD_01 6911 1.51 3.32 0.69 73 XM_URI_RBL 6873 1.39 3.30 0.51 74 XM_SendGrid 6783 5.03 3.25 5.84 75 RCVD_IN_RP_SAFE 6778 8.18 3.25 10.43 76 XMStrtUSub 6639 3.70 3.19 3.93 77 XM_CamelCaseFrm001 6311 2.04 3.03 1.59 78 BAYES_95 6222 2.66 2.99 2.50 79 URI_HEX 6210 2.01 2.98 1.56 80 XMNumbers 6152 2.72 2.95 2.62 81 RELAYCOUNTRY_CA 5798 1.79 2.78 1.34 82 TM2_M_URI_OPT_OUT 5694 1.90 2.73 1.52 83 HTML_IMAGE_RATIO_08 5586 2.15 2.68 1.90 84 RCVD_IN_RP_CERTIFIED 5460 7.10 2.62 9.15 85 XMDiploma_00 5285 1.88 2.54 1.58 86 MIME_HTML_ONLY_MULTI 5133 1.61 2.46 1.21 87 SpammyFromTLD_02 5092 0.94 2.44 0.26 88 BOTNET_NORDNS 4859 0.74 2.33 0.02 89 XM_salutation2 4793 1.23 2.30 0.74 90 XMBdyGiftCard01 4625 1.34 2.22 0.94 91 FROM_SUSPICIOUS_NTLD 4479 0.71 2.15 0.05 92 XMSexyCombo_01 4460 1.07 2.14 0.58 93 NORDNS_LOW_CONTRAST 4411 0.67 2.12 0.01 94 XMStockSpam_06 4411 1.24 2.12 0.84 95 XMGenDplmaNmb 4303 1.30 2.06 0.95 96 T_TooManySym_01 4293 4.22 2.06 5.20 97 MIME_QP_LONG_LINE 4126 4.19 1.98 5.20 98 XMPhish11 3921 1.34 1.88 1.10 99 RCVD_IN_MSPIKE_H2 3902 3.60 1.87 4.39 100 BAYES_40 3865 3.62 1.85 4.43 101 MultiRelay_Combo 3651 0.92 1.75 0.55 102 MultiRelay_CC 3651 0.92 1.75 0.55 103 LongTLD 3595 0.64 1.72 0.15 104 SUBJ_ALL_CAPS 3416 1.71 1.64 1.74 105 NO_DNS_FOR_FROM 3265 1.36 1.57 1.26 106 RELAYCOUNTRY_DE 3260 1.07 1.56 0.85 107 T_XMHurry_00 3237 1.01 1.55 0.77 108 TR_XM_RelayPhish 3223 1.01 1.55 0.76 109 FSL_THIS_IS_ADV 3200 0.53 1.54 0.08 110 TM2_M_VERY_LONG_WORD 3071 1.17 1.47 1.03 111 DATE_IN_PAST_06_12 3049 0.49 1.46 0.05 112 BAYES_20 3008 2.58 1.44 3.10 113 TR_Mismatch_TLD_01 2963 0.52 1.42 0.10 114 T_XMDrugObfuBody_08 2940 1.43 1.41 1.43 115 XMSubMetaSxObfu_03 2877 0.79 1.38 0.52 116 XMLngstWrd_00 2861 0.84 1.37 0.59 117 RELAYCOUNTRY_LT 2854 0.45 1.37 0.02 118 XMLngstWrd_01 2808 0.80 1.35 0.55 119 XMSubMetaI_00 2732 1.04 1.31 0.92 120 XMLngstWrd_02 2702 0.62 1.30 0.31 121 XMSexyCombo_04 2675 0.55 1.28 0.22 122 RCVD_IN_BL_SPAMCOP_NET 2653 0.51 1.27 0.16 123 RELAYCOUNTRY_RO 2622 0.41 1.26 0.02 124 FILL_THIS_FORM_LONG 2597 0.57 1.25 0.26 125 XMLngstWrd_03 2559 0.51 1.23 0.18 126 LOW_PRICE 2550 0.74 1.22 0.51 127 TR_Symld_Words 2541 1.45 1.22 1.55 128 XM_H_Long_From02 2512 0.99 1.21 0.89 129 XM_ProductURIs 2499 0.83 1.20 0.65 130 ALL_TRUSTED 2447 15.19 1.17 21.59 131 RELAYCOUNTRY_FR 2444 0.50 1.17 0.20 132 RCVD_IN_IADB_LISTED 2427 3.89 1.16 5.13 133 MAILING_LIST_MULTI 2371 2.05 1.14 2.47 134 URIBL_SBL_A 2359 0.37 1.13 0.02 135 XM_UB99 2340 0.36 1.12 0.01 136 FILL_THIS_FORM_LOAN 2322 0.52 1.11 0.26 137 RELAYCOUNTRY_GB 2304 1.04 1.11 1.00 138 THIS_AD 2281 0.45 1.09 0.15 139 XMSubMetaSx_01 2267 0.51 1.09 0.24 140 XMHTML_After_End 2251 0.63 1.08 0.42 141 UNPARSEABLE_RELAY 2240 2.17 1.07 2.67 142 XM_BadFromFormat 2235 0.41 1.07 0.10 143 DIET_1 2214 0.58 1.06 0.36 144 RELAYCOUNTRY_PT 2195 0.33 1.05 0.00 145 XM_UB60 2179 0.38 1.05 0.08 146 IMG_ONLY_FM_DOM_INFO 2175 0.33 1.04 0.00 147 XM_H_PHPOS 2174 1.78 1.04 2.12 148 XMPhish30 2146 0.66 1.03 0.49 149 BODY_ENHANCEMENT 2124 0.36 1.02 0.05 150 RCVD_IN_IADB_SPF 2119 3.45 1.02 4.56 151 XMBody_17 2119 0.69 1.02 0.54 152 T_XMDrugObfuBody_00 2101 0.74 1.01 0.62 153 TR_LOTS_OF_MONEY2 2039 0.46 0.98 0.23 154 T_MONEY_PERCENT 2039 0.46 0.98 0.23 155 DKIM_ADSP_NXDOMAIN 2029 0.66 0.97 0.52 156 URI_TRY_3LD 1974 1.24 0.95 1.37 157 TR_LOTS_OF_MONEY3 1903 0.58 0.91 0.43 158 XMSexyCombo_02 1898 0.39 0.91 0.15 159 XM_DKIMWhitelistDomains 1894 7.63 0.91 10.70 160 RCVD_IN_IADB_SENDERID 1890 3.03 0.91 4.00 161 RCVD_IN_IADB_DK 1857 3.00 0.89 3.96 162 XM_B_REG_HTML 1827 0.51 0.88 0.34 163 XMBrknScrpt_02 1817 0.76 0.87 0.71 164 XM_UB999 1813 0.28 0.87 0.01 165 URIBL_BLACK 1717 0.30 0.82 0.06 166 XMSubMetaSSx_00 1707 0.41 0.82 0.22 167 HK_RANDOM_FROM 1707 0.34 0.82 0.13 168 T_FILL_THIS_FORM_SHORT 1639 1.01 0.79 1.12 169 NUMERIC_HTTP_ADDR 1631 0.45 0.78 0.30 170 T_Symld_Words_02 1627 0.82 0.78 0.84 171 XMBody_78 1607 0.61 0.77 0.54 172 XMPhish14 1596 0.45 0.77 0.31 173 RELAYCOUNTRY_AT 1586 0.36 0.76 0.17 174 XM_DK_Undo_01 1577 1.47 0.76 1.80 175 RCVD_IN_IADB_VOUCHED 1562 2.52 0.75 3.33 176 MILLION_HUNDRED 1561 0.24 0.75 0.00 177 TooManyTo_002 1558 1.94 0.75 2.49 178 XMSubGiftCard1 1523 0.30 0.73 0.11 179 XM_HighProb1 1523 0.24 0.73 0.02 180 XM_RXBody 1503 0.40 0.72 0.25 181 RELAYCOUNTRY_CN 1460 0.26 0.70 0.07 182 FROM_MISSP_REPLYTO 1459 0.23 0.70 0.01 183 MONEY_FRAUD_8 1457 0.22 0.70 0.00 184 T_FILL_THIS_FORM_FRAUD_PHISH 1455 0.27 0.70 0.08 185 HTML_FONT_SIZE_LARGE 1445 0.32 0.69 0.15 186 BAYES_00 1442 8.01 0.69 11.35 187 HTML_FONT_FACE_BAD 1431 0.55 0.69 0.49 188 XM_UB80 1425 0.23 0.68 0.02 189 LONG_HEX_URI 1423 0.28 0.68 0.10 190 XMHTMLBadTable_001 1400 0.51 0.67 0.44 191 HTML_IMAGE_ONLY_12 1399 0.38 0.67 0.25 192 URIBL_DBL_SPAM 1395 0.21 0.67 0.01 193 XMGppyBdWords 1394 0.44 0.67 0.34 194 T_HTML_TAG_BALANCE_CENTER 1361 0.27 0.65 0.10 195 DEAR_BENEFICIARY 1349 0.20 0.65 0.00 196 DKIM_ADSP_CUSTOM_MED 1335 0.90 0.64 1.02 197 XM_H_TOP 1329 0.21 0.64 0.01 198 ADVANCE_FEE_5_NEW_FRM_MNY 1327 0.20 0.64 0.00 199 TooManyTo_003 1326 1.37 0.64 1.71 200 RDNS_DYNAMIC 1316 0.48 0.63 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 398629 83.05 73.66 87.34 2 DKIM_SIGNED 316888 67.13 62.10 69.43 3 XM_DK_Pass 310099 65.62 60.53 67.94 4 DKIM_VALID 293827 62.23 57.53 64.38 5 DCC_CHECK_NEGATIVE 285180 54.88 38.23 62.48 6 BAYES_50 246950 52.56 49.18 54.11 7 DKIM_VALID_AU 211844 46.63 47.09 46.41 8 XMListUnsubscribeExists 204562 47.80 54.33 44.82 9 XM_H_QuotedFrom 162996 36.30 37.58 35.71 10 DCC_CHECK 161679 43.34 60.68 35.42 11 T_TM2_M_HEADER_IN_MSG 144769 31.32 30.44 31.72 12 DKIM_VALID_EF 119042 22.92 16.01 26.08 13 HTML_FONT_LOW_CONTRAST 111084 26.34 30.71 24.34 14 MIME_HTML_ONLY 105816 24.43 27.15 23.18 15 ALL_TRUSTED 98535 15.19 1.17 21.59 16 XMSubLong 94721 20.58 20.21 20.75 17 LOC_TINY_FONT_1 88983 22.03 27.57 19.50 18 MultiRelay 87942 16.87 11.63 19.27 19 FVGT_m_MULTI_ODD 87571 20.00 21.80 19.19 20 T_KAM_HTML_FONT_INVALID 67985 14.86 14.78 14.90 21 XM_DK_Undo_02 63107 21.36 37.85 13.83 22 BAYES_99 57969 19.33 33.86 12.70 23 XM_Multi_Part_URI 51948 12.09 13.63 11.38 24 BAYES_00 51796 8.01 0.69 11.35 25 BAYES_999 51196 16.67 28.60 11.22 26 XM_Body_Dirty_Words 49610 12.95 17.52 10.87 27 XM_DKIMWhitelistDomains 48853 7.63 0.91 10.70 28 RCVD_IN_RP_SAFE 47605 8.18 3.25 10.43 29 RCVD_IN_RP_CERTIFIED 41769 7.10 2.62 9.15 30 TR_XM_DK_Bayes 39275 6.00 0.30 8.61 31 TooManyTo_001 39063 7.75 5.99 8.56 32 XM_Evil_Numbers_Gen 37138 9.12 11.28 8.14 33 TR_XM_DK_Bayes1 36923 5.63 0.25 8.09 34 LOTS_OF_MONEY 36326 13.66 26.13 7.96 35 LotsOfNums_01 36266 6.88 4.54 7.95 36 T_XMDrugObfuBody_14 36068 7.73 7.36 7.90 37 HTML_IMAGE_RATIO_02 33795 8.66 11.41 7.40 38 TR_XM_DK_Bayes2 31201 4.76 0.21 6.84 39 FSL_BULK_SIG 30390 7.91 10.66 6.66 40 TR_DCC_Bayes_99 27980 13.00 28.04 6.13 41 BAYES_60 27047 5.35 4.09 5.93 42 XM_SendGrid 26676 5.03 3.25 5.84 43 XM_B_Phish_Phrases 25943 5.82 6.11 5.68 44 XM_H_Long_From01 25879 5.65 5.59 5.67 45 RELAYCOUNTRY_META 25274 8.85 16.10 5.54 46 XM_PDF 24976 3.92 0.53 5.47 47 MIME_QP_LONG_LINE 23753 4.19 1.98 5.20 48 T_TooManySym_01 23747 4.22 2.06 5.20 49 RCVD_IN_IADB_LISTED 23413 3.89 1.16 5.13 50 DKIM_INVALID 23061 4.90 4.57 5.05 51 HTML_IMAGE_RATIO_04 21114 4.83 5.27 4.63 52 BOTNET_IPINHOSTNAME 20907 6.58 10.96 4.58 53 RCVD_IN_IADB_SPF 20801 3.45 1.02 4.56 54 BAYES_40 20214 3.62 1.85 4.43 55 RCVD_IN_MSPIKE_H2 20031 3.60 1.87 4.39 56 TO_NO_BRKTS_FROM_MSSP 19699 3.02 0.18 4.32 57 T_ISO_ATTACH 19682 2.97 0.04 4.31 58 RCVD_IN_IADB_SENDERID 18235 3.03 0.91 4.00 59 RCVD_IN_IADB_DK 18074 3.00 0.89 3.96 60 XMStrtUSub 17945 3.70 3.19 3.93 61 IN_ZIMBRA_NJ_WHITELIST 17881 2.69 0.02 3.92 62 T_REMOTE_IMAGE 17154 4.30 5.50 3.76 63 BAYES_80 16737 4.15 5.20 3.67 64 FROM_EXCESS_BASE64 16178 4.91 7.89 3.54 65 HTML_MIME_NO_HTML_TAG 16002 3.93 4.85 3.51 66 XMSubMetaSx_00 15674 4.25 6.05 3.43 67 RCVD_IN_IADB_VOUCHED 15179 2.52 0.75 3.33 68 XM_UncommonTLD01 14393 5.02 9.09 3.15 69 BAYES_20 14148 2.58 1.44 3.10 70 XMSexyCombo_05 13142 4.83 9.11 2.88 71 HTML_IMAGE_RATIO_06 12625 3.33 4.58 2.77 72 TO_MALFORMED 12318 2.03 0.58 2.70 73 UNPARSEABLE_RELAY 12172 2.17 1.07 2.67 74 MPART_ALT_DIFF 12119 3.68 5.91 2.66 75 XMNumbers 11936 2.72 2.95 2.62 76 TVD_RCVD_IP 11721 1.82 0.20 2.57 77 BAYES_95 11432 2.66 2.99 2.50 78 TooManyTo_002 11359 1.94 0.75 2.49 79 MAILING_LIST_MULTI 11284 2.05 1.14 2.47 80 MIME_HTML_MOSTLY 10338 2.74 3.77 2.27 81 XM_SPF_SoftFail 9664 2.63 3.76 2.12 82 XM_H_PHPOS 9662 1.78 1.04 2.12 83 RCVD_IN_IADB_OPTIN 9520 1.61 0.56 2.09 84 RCVD_IN_MSPIKE_WL 8874 1.44 0.35 1.94 85 BAYES_05 8854 1.49 0.51 1.94 86 RCVD_IN_MSPIKE_H3 8812 1.43 0.35 1.93 87 XM_DIRTYINTL 8725 2.60 4.12 1.91 88 HTML_IMAGE_RATIO_08 8688 2.15 2.68 1.90 89 ANY_BOUNCE_MESSAGE 8684 8.61 23.29 1.90 90 BOUNCE_MESSAGE 8680 8.61 23.29 1.90 91 HELO_NODOT 8317 1.41 0.52 1.82 92 HELO_NO_DOMAIN 8261 1.40 0.50 1.81 93 XM_DK_Undo_01 8204 1.47 0.76 1.80 94 T_TooManySym_02 8098 1.36 0.45 1.77 95 BOTNET 8004 11.83 33.90 1.75 96 SUBJ_ALL_CAPS 7962 1.71 1.64 1.74 97 IN_HORDE_ADDRESS_BOOK 7882 1.19 0.02 1.73 98 TooManyTo_003 7791 1.37 0.64 1.71 99 INVALID_MSGID 7354 1.14 0.12 1.61 100 XM_OfRef6 7304 7.15 19.32 1.60 101 XM_CamelCaseFrm001 7257 2.04 3.03 1.59 102 XMDiploma_00 7209 1.88 2.54 1.58 103 URI_HEX 7133 2.01 2.98 1.56 104 TR_Symld_Words 7082 1.45 1.22 1.55 105 XMCapTrack 7012 1.12 0.20 1.54 106 TR_MetaPhish_Combo_01 6986 1.17 0.37 1.53 107 TM2_M_URI_OPT_OUT 6935 1.90 2.73 1.52 108 T_XMDrugObfuBody_08 6547 1.43 1.41 1.43 109 URI_TRY_3LD 6245 1.24 0.95 1.37 110 RELAYCOUNTRY_CA 6096 1.79 2.78 1.34 111 XM_GoogleGroups 5754 0.98 0.35 1.26 112 NO_DNS_FOR_FROM 5749 1.36 1.57 1.26 113 TooManyTo_004 5696 1.03 0.56 1.25 114 MIME_HTML_ONLY_MULTI 5538 1.61 2.46 1.21 115 UNTRUSTED_Relay 5521 4.38 11.33 1.21 116 USER_IN_DEF_DKIM_WL 5384 0.81 0.01 1.18 117 T_FILL_THIS_FORM_SHORT 5098 1.01 0.79 1.12 118 XMPhish11 4999 1.34 1.88 1.10 119 TooManyTo_005 4730 0.86 0.47 1.04 120 TM2_M_VERY_LONG_WORD 4682 1.17 1.47 1.03 121 DKIM_ADSP_CUSTOM_MED 4662 0.90 0.64 1.02 122 RELAYCOUNTRY_GB 4583 1.04 1.11 1.00 123 XMGenDplmaNmb 4353 1.30 2.06 0.95 124 XMBdyGiftCard01 4296 1.34 2.22 0.94 125 XMNoVowels 4256 0.75 0.37 0.93 126 XMSubMetaI_00 4185 1.04 1.31 0.92 127 XM_H_Long_From02 4051 0.99 1.21 0.89 128 RELAYCOUNTRY_DE 3877 1.07 1.56 0.85 129 XMStockSpam_06 3845 1.24 2.12 0.84 130 T_Symld_Words_02 3816 0.82 0.78 0.84 131 RELAYCOUNTRY_AU 3668 0.68 0.42 0.80 132 XM_UB50 3529 2.58 6.53 0.77 133 T_XMHurry_00 3502 1.01 1.55 0.77 134 TR_XM_RelayPhish 3482 1.01 1.55 0.76 135 NML_ADSP_CUSTOM_MED 3388 0.70 0.60 0.74 136 XM_salutation2 3370 1.23 2.30 0.74 137 XMBrknScrpt_02 3251 0.76 0.87 0.71 138 SpammyFromTLD_01 3127 1.51 3.32 0.69 139 XMMoneyMeta_00 3091 0.60 0.44 0.68 140 XM_H_PHPMailer 3061 0.65 0.60 0.67 141 XM_ProductURIs 2986 0.83 1.20 0.65 142 HTTPS_HTTP_MISMATCH 2985 0.58 0.42 0.65 143 T_XMDrugObfuBody_00 2843 0.74 1.01 0.62 144 T_OBFU_PDF_ATTACH 2818 0.46 0.13 0.62 145 XM_ShortIntro_01 2736 0.50 0.29 0.60 146 XMLngstWrd_00 2714 0.84 1.37 0.59 147 T_TooManySym_03 2700 0.43 0.07 0.59 148 XMSexyCombo_01 2637 1.07 2.14 0.58 149 XMBody_95 2566 0.40 0.05 0.56 150 USER_IN_WHITELIST 2540 0.38 0.00 0.56 151 SHORT_HELO_AND_INLINE_IMAGE 2516 0.40 0.07 0.55 152 XMLngstWrd_01 2514 0.80 1.35 0.55 153 MultiRelay_CC 2498 0.92 1.75 0.55 154 MultiRelay_Combo 2498 0.92 1.75 0.55 155 XMBody_17 2486 0.69 1.02 0.54 156 XMBody_78 2455 0.61 0.77 0.54 157 DKIM_ADSP_NXDOMAIN 2388 0.66 0.97 0.52 158 XMSubMetaSxObfu_03 2383 0.79 1.38 0.52 159 LOW_PRICE 2347 0.74 1.22 0.51 160 XMEmptySub 2339 0.38 0.09 0.51 161 MISSING_HEADERS 2339 0.47 0.38 0.51 162 XM_URI_RBL 2337 1.39 3.30 0.51 163 XMGappySubj_01 2335 0.47 0.38 0.51 164 RELAYCOUNTRY_NL 2320 0.43 0.26 0.51 165 XM_B_COPY_HTML 2317 0.50 0.49 0.51 166 FORGED_GMAIL_RCVD 2269 0.51 0.54 0.50 167 HTML_FONT_FACE_BAD 2250 0.55 0.69 0.49 168 XMPhish30 2239 0.66 1.03 0.49 169 RELAYCOUNTRY_IN 2187 0.50 0.54 0.48 170 HTML_TAG_BALANCE_BODY 2169 0.44 0.37 0.48 171 TM2_M_A_HREF_HREF 2159 0.45 0.40 0.47 172 TM2_M_BODY_EMPTY 2149 0.35 0.08 0.47 173 XMLKML 2058 0.31 0.00 0.45 174 RCVD_IN_SORBS_DUL 2009 0.36 0.17 0.44 175 XMHTMLBadTable_001 1987 0.51 0.67 0.44 176 TR_LOTS_OF_MONEY3 1967 0.58 0.91 0.43 177 HTML_IMAGE_ONLY_32 1940 0.35 0.18 0.43 178 XMHTML_After_End 1924 0.63 1.08 0.42 179 URI_NOVOWEL 1919 0.48 0.61 0.42 180 AC_DIV_BONANZA 1899 0.30 0.06 0.42 181 XMDateMe_00 1887 0.35 0.22 0.41 182 RDNS_DYNAMIC 1869 0.48 0.63 0.41 183 XMSubMetaSxObfu_02 1792 0.34 0.23 0.39 184 XM_H_PHPOS_M 1779 0.38 0.37 0.39 185 FROM_GOV_SPOOF 1778 0.30 0.09 0.39 186 PLING_QUERY 1777 0.38 0.36 0.39 187 HTML_IMAGE_ONLY_28 1713 0.41 0.49 0.38 188 FROM_GOV_DKIM_AU 1692 0.28 0.07 0.37 189 DIET_1 1660 0.58 1.06 0.36 190 FILL_THIS_FORM 1579 5.90 18.06 0.35 191 HTML_IMAGE_ONLY_24 1561 0.32 0.27 0.34 192 XM_B_REG_HTML 1553 0.51 0.88 0.34 193 XMGppyBdWords 1548 0.44 0.67 0.34 194 XMSubNoVowel 1517 0.43 0.63 0.33 195 XMSolicitRefs_0 1500 0.35 0.39 0.33 196 BASE64_LENGTH_79_INF 1500 0.26 0.10 0.33 197 HTML_IMAGE_ONLY_20 1474 0.31 0.28 0.32 198 TVD_SPACE_RATIO 1436 0.32 0.34 0.31 199 XMSubEmpty 1423 0.30 0.28 0.31 200 XMLngstWrd_02 1421 0.62 1.30 0.31 ----------------------------------------------------------------------