Email: 657731 Autolearn: 0 AvgScore: 3.16 AvgScanTime: 1.94 sec Spam: 181578 Autolearn: 0 AvgScore: 12.63 AvgScanTime: 2.24 sec Ham: 476153 Autolearn: 0 AvgScore: -0.45 AvgScanTime: 1.83 sec Time Spent Running SA: 354.53 hours Time Spent Processing Spam: 113.12 hours Time Spent Processing Ham: 241.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 173298 90.00 95.44 87.93 2 DKIM_SIGNED 135320 72.17 74.52 71.27 3 DCC_CHECK 135291 47.22 74.51 36.82 4 XM_DK_Pass 132322 70.68 72.87 69.84 5 DKIM_VALID 126103 67.23 69.45 66.39 6 XMListUnsubscribeExists 118735 53.18 65.39 48.53 7 DKIM_VALID_AU 101775 49.96 56.05 47.63 8 XM_H_QuotedFrom 85193 40.33 46.92 37.81 9 XM_DK_Undo_02 78879 22.23 43.44 14.14 10 BAYES_99 73464 20.48 40.46 12.86 11 MIME_HTML_ONLY 72284 27.42 39.81 22.69 12 HTML_FONT_LOW_CONTRAST 66031 29.18 36.37 26.43 13 BAYES_999 61396 17.54 33.81 11.33 14 LOC_TINY_FONT_1 60156 23.80 33.13 20.25 15 TR_DCC_Bayes_99 58381 13.28 32.15 6.08 16 BAYES_50 55381 47.23 30.50 53.61 17 XMSubLong 50737 23.24 27.94 21.44 18 DCC_CHECK_NEGATIVE 43708 50.93 24.07 61.17 19 FVGT_m_MULTI_ODD 43641 20.78 24.03 19.53 20 DKIM_VALID_EF 37175 24.12 20.47 25.50 21 XM_Multi_Part_URI 36511 13.54 20.11 11.03 22 RELAYCOUNTRY_META 36059 9.08 19.86 4.97 23 XM_Body_Dirty_Words 34756 13.24 19.14 10.99 24 T_KAM_HTML_FONT_INVALID 32097 16.48 17.68 16.02 25 T_TM2_M_HEADER_IN_MSG 31109 27.42 17.13 31.34 26 FSL_BULK_SIG 27700 8.83 15.26 6.38 27 MultiRelay 27075 16.90 14.91 17.65 28 UNTRUSTED_Relay 25095 4.81 13.82 1.38 29 HTML_IMAGE_RATIO_02 24547 9.32 13.52 7.72 30 LOTS_OF_MONEY 23799 9.46 13.11 8.07 31 XM_Evil_Numbers_Gen 22083 9.24 12.16 8.13 32 BOTNET 21795 4.52 12.00 1.66 33 BAYES_80 21410 6.18 11.79 4.04 34 BOTNET_IPINHOSTNAME 21324 6.60 11.74 4.64 35 HTML_MIME_NO_HTML_TAG 19773 4.90 10.89 2.62 36 FROM_EXCESS_BASE64 19327 5.94 10.64 4.14 37 MIME_HEADER_CTYPE_ONLY 19164 3.14 10.55 0.31 38 XMSexyCombo_05 18835 5.16 10.37 3.17 39 T_XMDrugObfuBody_14 17408 8.28 9.59 7.79 40 XM_UncommonTLD01 16751 4.99 9.23 3.37 41 T_REMOTE_IMAGE 16750 5.71 9.22 4.37 42 HTML_IMAGE_RATIO_04 14062 5.13 7.74 4.13 43 BODY_URI_ONLY 13884 2.32 7.65 0.29 44 XM_B_Phish_Phrases 13472 5.88 7.42 5.30 45 MPART_ALT_DIFF 13458 4.29 7.41 3.10 46 TooManyTo_001 13186 7.71 7.26 7.89 47 XMSubMetaSx_00 12931 4.70 7.12 3.77 48 XM_H_Long_From01 12903 6.51 7.11 6.28 49 BAYES_60 12759 6.44 7.03 6.22 50 HTML_SHORT_LINK_IMG_1 12186 2.00 6.71 0.20 51 ALL_TRUSTED 10910 16.12 6.01 19.98 52 XM_H_PHPOS 10693 2.84 5.89 1.68 53 LotsOfNums_01 10556 7.70 5.81 8.42 54 BAYES_95 10289 3.53 5.67 2.71 55 XMStrtUSub 9690 4.28 5.34 3.87 56 XM_UB50 9253 1.90 5.10 0.69 57 HTML_IMAGE_RATIO_06 9218 3.33 5.08 2.66 58 DKIM_INVALID 9217 4.94 5.08 4.88 59 SpammyFromTLD_02 9142 1.67 5.03 0.39 60 TO_NO_BRKTS_HTML_ONLY 8878 1.86 4.89 0.70 61 MISSING_HEADERS 8742 1.68 4.81 0.48 62 XM_S_SubURI 8623 1.33 4.75 0.03 63 XM_SPF_SoftFail 8006 2.65 4.41 1.97 64 XM_DIRTYINTL 7999 2.55 4.41 1.84 65 XM_salutation2 7775 2.12 4.28 1.29 66 MIME_HTML_MOSTLY 7278 2.73 4.01 2.24 67 XMNumbers 7127 2.86 3.93 2.46 68 HTML_IMAGE_ONLY_04 7056 1.17 3.89 0.14 69 HTML_SHORT_CENTER 6990 1.13 3.85 0.09 70 XM_SendGrid 6937 5.08 3.82 5.56 71 MIME_HTML_ONLY_MULTI 6770 2.08 3.73 1.45 72 TM2_M_URI_OPT_OUT 6761 2.35 3.72 1.83 73 RELAYCOUNTRY_CA 6365 1.99 3.51 1.41 74 TR_LOTS_OF_MONEY3 6304 1.42 3.47 0.63 75 RELAYCOUNTRY_UA 6266 0.95 3.45 0.00 76 RCVD_IN_RP_SAFE 5949 8.23 3.28 10.12 77 URI_HEX 5888 1.99 3.24 1.52 78 HTML_IMAGE_RATIO_08 5655 2.41 3.11 2.13 79 XMDiploma_00 5650 2.10 3.11 1.72 80 NUMERIC_HTTP_ADDR 5626 1.06 3.10 0.28 81 XM_CamelCaseFrm001 5616 2.12 3.09 1.75 82 XMBdyGiftCard01 5338 1.49 2.94 0.94 83 XM_URI_RBL 5326 1.09 2.93 0.39 84 XM_OfRef6 5291 1.98 2.91 1.63 85 MultiRelay_CC 5262 0.91 2.90 0.15 86 MultiRelay_Combo 5262 0.91 2.90 0.15 87 MIME_QP_LONG_LINE 4958 5.11 2.73 6.01 88 NORMAL_HTTP_TO_IP 4954 0.81 2.73 0.07 89 T_XMDrugObfuBody_08 4934 1.80 2.72 1.45 90 RCVD_IN_MSPIKE_H2 4802 3.94 2.64 4.44 91 HTML_IMAGE_ONLY_12 4687 0.87 2.58 0.22 92 XM_UB60 4575 0.75 2.52 0.08 93 T_TooManySym_01 4527 4.31 2.49 5.00 94 XMBody_17 4519 1.17 2.49 0.66 95 RCVD_IN_RP_CERTIFIED 4469 7.35 2.46 9.21 96 XM_UB80 4458 0.70 2.46 0.03 97 NORDNS_LOW_CONTRAST 4381 0.70 2.41 0.04 98 TVD_IP_SING_HEX 4322 0.66 2.38 0.00 99 URI_HEX_IP 4322 0.66 2.38 0.00 100 TVD_IP_HEX 4322 0.66 2.38 0.00 101 BOTNET_NORDNS 4312 0.67 2.37 0.02 102 XMGenDplmaNmb 4280 1.43 2.36 1.08 103 DIET_1 4212 0.81 2.32 0.24 104 SUBJ_ALL_CAPS 4132 1.83 2.28 1.66 105 XMSubMetaI_00 4113 1.02 2.27 0.55 106 XMSexyCombo_01 4104 0.99 2.26 0.51 107 RCVD_IN_RP_RNBL 4094 0.65 2.25 0.04 108 RELAYCOUNTRY_DE 3984 0.86 2.19 0.35 109 XMPhish11 3513 1.44 1.93 1.25 110 XM_UB99 3467 0.55 1.91 0.02 111 RCVD_IN_IADB_LISTED 3402 4.69 1.87 5.77 112 NO_DNS_FOR_FROM 3240 1.32 1.78 1.14 113 RCVD_IN_BL_SPAMCOP_NET 3091 0.85 1.70 0.52 114 HTML_FONT_SIZE_LARGE 2970 0.57 1.64 0.17 115 URI_TRY_3LD 2964 1.48 1.63 1.43 116 XMSlimDrugH 2949 0.64 1.62 0.27 117 TR_Mismatch_TLD_01 2895 0.53 1.59 0.13 118 SpammyFromTLD_01 2884 1.12 1.59 0.94 119 FROM_SUSPICIOUS_NTLD 2867 0.47 1.58 0.05 120 RCVD_IN_IADB_SPF 2848 4.12 1.57 5.10 121 BAYES_40 2785 3.57 1.53 4.35 122 REPLYTO_WITHOUT_TO_CC 2781 0.47 1.53 0.06 123 TM2_M_VERY_LONG_WORD 2766 0.96 1.52 0.75 124 T_XMHurry_00 2680 0.84 1.48 0.60 125 MAILING_LIST_MULTI 2647 2.14 1.46 2.39 126 RCVD_IN_IADB_SENDERID 2626 3.66 1.45 4.50 127 XM_H_Long_From02 2619 1.20 1.44 1.11 128 RCVD_IN_IADB_DK 2572 3.61 1.42 4.44 129 HK_SCAM 2568 0.41 1.41 0.02 130 XM_UB999 2542 0.40 1.40 0.02 131 FSL_THIS_IS_ADV 2512 0.48 1.38 0.14 132 TR_XM_RelayPhish 2335 0.77 1.29 0.57 133 BAYES_20 2262 2.43 1.25 2.88 134 RELAYCOUNTRY_FR 2259 0.49 1.24 0.20 135 XMMoneyMeta_00 2242 0.83 1.23 0.68 136 XMSubMetaSxObfu_03 2240 0.70 1.23 0.50 137 FVGT_m_MULTI_ODD_EMAIL 2236 0.36 1.23 0.03 138 TR_LOTS_OF_MONEY1 2206 0.35 1.21 0.02 139 XMWghtMeta_00 2177 0.34 1.20 0.02 140 UNPARSEABLE_RELAY 2177 2.18 1.20 2.55 141 XMStockSpam_06 2158 0.79 1.19 0.64 142 XM_BadFromFormat 2156 0.40 1.19 0.10 143 DKIM_ADSP_NXDOMAIN 2150 0.69 1.18 0.51 144 XMPhish30 2124 0.61 1.17 0.40 145 XMHTML_After_End 2106 0.64 1.16 0.45 146 RELAYCOUNTRY_GH 2102 0.32 1.16 0.00 147 RCVD_IN_PSBL 2102 0.32 1.16 0.01 148 MONEY_FROM_41 2096 0.32 1.15 0.00 149 MONEY_FRAUD_5 2083 0.32 1.15 0.00 150 RELAYCOUNTRY_VE 2075 0.32 1.14 0.00 151 T_XMDrugObfuBody_00 2072 0.89 1.14 0.79 152 T_Symld_Words_02 2031 0.73 1.12 0.58 153 XM_HighProb1 2014 0.32 1.11 0.01 154 RELAYCOUNTRY_GB 1981 1.02 1.09 0.99 155 XM_ProductURIs 1981 0.93 1.09 0.87 156 ADVANCE_FEE_4_NEW_MONEY 1972 0.30 1.09 0.00 157 XMSexyCombo_04 1972 0.36 1.09 0.08 158 RCVD_IN_IADB_VOUCHED 1955 2.89 1.08 3.58 159 T_FILL_THIS_FORM_SHORT 1941 0.98 1.07 0.94 160 T_MONEY_PERCENT 1916 0.49 1.06 0.27 161 TR_LOTS_OF_MONEY2 1916 0.49 1.06 0.27 162 TR_Symld_Words 1888 1.45 1.04 1.61 163 XMBody_78 1835 0.60 1.01 0.44 164 XMPhish14 1833 0.60 1.01 0.45 165 RELAYCOUNTRY_IN 1761 0.36 0.97 0.13 166 HK_RANDOM_FROM 1721 0.36 0.95 0.14 167 TR_Caps_n_Bayes_80 1697 0.29 0.93 0.04 168 MPART_ALT_DIFF_COUNT 1693 0.41 0.93 0.21 169 XMHTMLBadTable_001 1692 0.63 0.93 0.52 170 FILL_THIS_FORM 1672 0.50 0.92 0.34 171 BAYES_00 1669 8.40 0.92 11.25 172 URIBL_BLACK 1611 0.27 0.89 0.04 173 SUBJ_DOLLARS 1608 0.48 0.89 0.32 174 HTTPS_HTTP_MISMATCH 1590 0.68 0.88 0.61 175 HTML_FONT_FACE_BAD 1555 0.61 0.86 0.51 176 XM_UB95 1530 0.25 0.84 0.02 177 LongTLD 1520 0.36 0.84 0.18 178 FILL_THIS_FORM_LONG 1513 0.40 0.83 0.23 179 HTML_IMAGE_ONLY_28 1468 0.50 0.81 0.38 180 XM_B_COPY_HTML 1453 0.62 0.80 0.55 181 TooManyTo_002 1451 1.84 0.80 2.24 182 BODY_ENHANCEMENT 1447 0.23 0.80 0.02 183 XM_DK_Undo_01 1431 1.43 0.79 1.68 184 LONG_JUNK_URI 1424 0.27 0.78 0.07 185 DATE_IN_PAST_06_12 1419 0.24 0.78 0.03 186 URI_NOVOWEL 1368 0.55 0.75 0.47 187 DKIM_ADSP_CUSTOM_MED 1359 0.95 0.75 1.02 188 RCVD_IN_IADB_OPTIN 1314 1.84 0.72 2.26 189 TR_Mismatch_TLD_02 1298 0.25 0.71 0.07 190 XM_H_PHPMailer 1290 0.64 0.71 0.62 191 XMGppyBdWords 1283 0.34 0.71 0.20 192 RELAYCOUNTRY_CN 1276 0.24 0.70 0.06 193 XMLongAddy 1271 0.22 0.70 0.03 194 XM_B_REG_HTML 1265 0.49 0.70 0.41 195 NML_ADSP_CUSTOM_MED 1263 0.67 0.70 0.67 196 XM_RXBody 1256 0.31 0.69 0.16 197 RDNS_DYNAMIC 1240 0.56 0.68 0.52 198 XM_JunkDunk 1222 0.19 0.67 0.00 199 XM_H_TOP 1195 0.18 0.66 0.00 200 TooManyTo_003 1193 1.25 0.66 1.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 418683 90.00 95.44 87.93 2 DKIM_SIGNED 339354 72.17 74.52 71.27 3 XM_DK_Pass 332531 70.68 72.87 69.84 4 DKIM_VALID 316103 67.23 69.45 66.39 5 DCC_CHECK_NEGATIVE 291281 50.93 24.07 61.17 6 BAYES_50 255257 47.23 30.50 53.61 7 XMListUnsubscribeExists 231054 53.18 65.39 48.53 8 DKIM_VALID_AU 226803 49.96 56.05 47.63 9 XM_H_QuotedFrom 180048 40.33 46.92 37.81 10 DCC_CHECK 175303 47.22 74.51 36.82 11 T_TM2_M_HEADER_IN_MSG 149245 27.42 17.13 31.34 12 HTML_FONT_LOW_CONTRAST 125871 29.18 36.37 26.43 13 DKIM_VALID_EF 121437 24.12 20.47 25.50 14 MIME_HTML_ONLY 108035 27.42 39.81 22.69 15 XMSubLong 102103 23.24 27.94 21.44 16 LOC_TINY_FONT_1 96403 23.80 33.13 20.25 17 ALL_TRUSTED 95137 16.12 6.01 19.98 18 FVGT_m_MULTI_ODD 93008 20.78 24.03 19.53 19 MultiRelay 84063 16.90 14.91 17.65 20 T_KAM_HTML_FONT_INVALID 76271 16.48 17.68 16.02 21 XM_DK_Undo_02 67331 22.23 43.44 14.14 22 BAYES_99 61227 20.48 40.46 12.86 23 BAYES_999 53947 17.54 33.81 11.33 24 BAYES_00 53564 8.40 0.92 11.25 25 XM_DKIMWhitelistDomains 53409 8.15 0.13 11.22 26 XM_Multi_Part_URI 52534 13.54 20.11 11.03 27 XM_Body_Dirty_Words 52352 13.24 19.14 10.99 28 RCVD_IN_RP_SAFE 48185 8.23 3.28 10.12 29 RCVD_IN_RP_CERTIFIED 43868 7.35 2.46 9.21 30 TR_XM_DK_Bayes 40881 6.33 0.43 8.59 31 LotsOfNums_01 40086 7.70 5.81 8.42 32 XM_Evil_Numbers_Gen 38705 9.24 12.16 8.13 33 TR_XM_DK_Bayes1 38667 5.98 0.37 8.12 34 LOTS_OF_MONEY 38438 9.46 13.11 8.07 35 TooManyTo_001 37554 7.71 7.26 7.89 36 T_XMDrugObfuBody_14 37084 8.28 9.59 7.79 37 HTML_IMAGE_RATIO_02 36772 9.32 13.52 7.72 38 TR_XM_DK_Bayes2 32730 5.04 0.24 6.87 39 FSL_BULK_SIG 30382 8.83 15.26 6.38 40 XM_H_Long_From01 29910 6.51 7.11 6.28 41 BAYES_60 29603 6.44 7.03 6.22 42 TR_DCC_Bayes_99 28964 13.28 32.15 6.08 43 MIME_QP_LONG_LINE 28634 5.11 2.73 6.01 44 RCVD_IN_IADB_LISTED 27474 4.69 1.87 5.77 45 XM_SendGrid 26464 5.08 3.82 5.56 46 XM_B_Phish_Phrases 25217 5.88 7.42 5.30 47 RCVD_IN_IADB_SPF 24277 4.12 1.57 5.10 48 XM_PDF 23926 3.81 0.62 5.02 49 T_TooManySym_01 23831 4.31 2.49 5.00 50 RELAYCOUNTRY_META 23667 9.08 19.86 4.97 51 DKIM_INVALID 23251 4.94 5.08 4.88 52 BOTNET_IPINHOSTNAME 22075 6.60 11.74 4.64 53 RCVD_IN_IADB_SENDERID 21433 3.66 1.45 4.50 54 RCVD_IN_IADB_DK 21148 3.61 1.42 4.44 55 RCVD_IN_MSPIKE_H2 21134 3.94 2.64 4.44 56 T_REMOTE_IMAGE 20789 5.71 9.22 4.37 57 BAYES_40 20700 3.57 1.53 4.35 58 FROM_EXCESS_BASE64 19718 5.94 10.64 4.14 59 HTML_IMAGE_RATIO_04 19684 5.13 7.74 4.13 60 BAYES_80 19241 6.18 11.79 4.04 61 IN_ZIMBRA_NJ_WHITELIST 18610 2.83 0.02 3.91 62 XMStrtUSub 18444 4.28 5.34 3.87 63 XMSubMetaSx_00 17966 4.70 7.12 3.77 64 RCVD_IN_IADB_VOUCHED 17031 2.89 1.08 3.58 65 XM_UncommonTLD01 16042 4.99 9.23 3.37 66 TO_NO_BRKTS_FROM_MSSP 15356 2.39 0.19 3.23 67 T_ISO_ATTACH 15344 2.34 0.03 3.22 68 XMSexyCombo_05 15103 5.16 10.37 3.17 69 MPART_ALT_DIFF 14737 4.29 7.41 3.10 70 BAYES_20 13731 2.43 1.25 2.88 71 BAYES_95 12905 3.53 5.67 2.71 72 HTML_IMAGE_RATIO_06 12671 3.33 5.08 2.66 73 HTML_MIME_NO_HTML_TAG 12464 4.90 10.89 2.62 74 TO_MALFORMED 12401 1.89 0.02 2.60 75 UNPARSEABLE_RELAY 12160 2.18 1.20 2.55 76 XMNumbers 11698 2.86 3.93 2.46 77 MAILING_LIST_MULTI 11400 2.14 1.46 2.39 78 TVD_RCVD_IP 11218 1.80 0.33 2.36 79 RCVD_IN_IADB_OPTIN 10767 1.84 0.72 2.26 80 MIME_HTML_MOSTLY 10683 2.73 4.01 2.24 81 TooManyTo_002 10658 1.84 0.80 2.24 82 HTML_IMAGE_RATIO_08 10165 2.41 3.11 2.13 83 XM_SPF_SoftFail 9400 2.65 4.41 1.97 84 RCVD_IN_MSPIKE_H3 9186 1.49 0.36 1.93 85 RCVD_IN_MSPIKE_WL 9186 1.49 0.36 1.93 86 TR_MetaPhish_Combo_01 9077 1.55 0.61 1.91 87 XM_DIRTYINTL 8773 2.55 4.41 1.84 88 TM2_M_URI_OPT_OUT 8724 2.35 3.72 1.83 89 BOUNCE_MESSAGE 8564 1.40 0.37 1.80 90 ANY_BOUNCE_MESSAGE 8564 1.40 0.37 1.80 91 HELO_NODOT 8437 1.40 0.42 1.77 92 HELO_NO_DOMAIN 8410 1.38 0.37 1.77 93 IN_HORDE_ADDRESS_BOOK 8401 1.29 0.04 1.76 94 XM_CamelCaseFrm001 8355 2.12 3.09 1.75 95 BAYES_05 8287 1.44 0.65 1.74 96 XMDiploma_00 8168 2.10 3.11 1.72 97 XM_DK_Undo_01 7983 1.43 0.79 1.68 98 XM_H_PHPOS 7979 2.84 5.89 1.68 99 SUBJ_ALL_CAPS 7924 1.83 2.28 1.66 100 BOTNET 7914 4.52 12.00 1.66 101 T_TooManySym_02 7864 1.32 0.46 1.65 102 XM_OfRef6 7744 1.98 2.91 1.63 103 TR_Symld_Words 7644 1.45 1.04 1.61 104 INVALID_MSGID 7317 1.14 0.08 1.54 105 URI_HEX 7226 1.99 3.24 1.52 106 TooManyTo_003 7045 1.25 0.66 1.48 107 T_XMDrugObfuBody_08 6925 1.80 2.72 1.45 108 MIME_HTML_ONLY_MULTI 6912 2.08 3.73 1.45 109 XMCapTrack 6865 1.11 0.24 1.44 110 URI_TRY_3LD 6786 1.48 1.63 1.43 111 RELAYCOUNTRY_CA 6703 1.99 3.51 1.41 112 UNTRUSTED_Relay 6548 4.81 13.82 1.38 113 XM_salutation2 6142 2.12 4.28 1.29 114 XMPhish11 5949 1.44 1.93 1.25 115 USER_IN_DEF_DKIM_WL 5905 0.90 0.01 1.24 116 XM_GoogleGroups 5793 1.00 0.42 1.22 117 NO_DNS_FOR_FROM 5430 1.32 1.78 1.14 118 XM_H_Long_From02 5301 1.20 1.44 1.11 119 XMGenDplmaNmb 5144 1.43 2.36 1.08 120 TooManyTo_004 5021 0.92 0.56 1.05 121 DKIM_ADSP_CUSTOM_MED 4863 0.95 0.75 1.02 122 RELAYCOUNTRY_GB 4720 1.02 1.09 0.99 123 T_FILL_THIS_FORM_SHORT 4482 0.98 1.07 0.94 124 SpammyFromTLD_01 4466 1.12 1.59 0.94 125 XMBdyGiftCard01 4462 1.49 2.94 0.94 126 TooManyTo_005 4165 0.76 0.46 0.87 127 XM_ProductURIs 4153 0.93 1.09 0.87 128 T_XMDrugObfuBody_00 3776 0.89 1.14 0.79 129 TM2_M_VERY_LONG_WORD 3576 0.96 1.52 0.75 130 TO_NO_BRKTS_HTML_ONLY 3332 1.86 4.89 0.70 131 XM_UB50 3268 1.90 5.10 0.69 132 XMMoneyMeta_00 3247 0.83 1.23 0.68 133 XMBrknScrpt_02 3203 0.63 0.53 0.67 134 NML_ADSP_CUSTOM_MED 3168 0.67 0.70 0.67 135 XMBody_17 3145 1.17 2.49 0.66 136 XMStockSpam_06 3040 0.79 1.19 0.64 137 TR_LOTS_OF_MONEY3 3021 1.42 3.47 0.63 138 PLING_QUERY 2948 0.55 0.38 0.62 139 XM_H_PHPMailer 2934 0.64 0.71 0.62 140 HTTPS_HTTP_MISMATCH 2881 0.68 0.88 0.61 141 T_XMHurry_00 2876 0.84 1.48 0.60 142 USER_IN_WHITELIST 2872 0.44 0.00 0.60 143 XMLngstWrd_00 2847 0.51 0.29 0.60 144 T_Symld_Words_02 2773 0.73 1.12 0.58 145 HTML_TAG_BALANCE_BODY 2769 0.58 0.59 0.58 146 XM_ShortIntro_01 2747 0.51 0.34 0.58 147 TR_XM_RelayPhish 2731 0.77 1.29 0.57 148 T_OBFU_PDF_ATTACH 2728 0.47 0.19 0.57 149 XMLngstWrd_01 2689 0.48 0.27 0.56 150 XM_B_COPY_HTML 2632 0.62 0.80 0.55 151 XMSubMetaI_00 2612 1.02 2.27 0.55 152 XMBody_95 2598 0.42 0.08 0.55 153 XMNoVowels 2557 0.52 0.48 0.54 154 XMGappySubj_01 2533 0.51 0.45 0.53 155 XMDateMe_00 2529 0.49 0.37 0.53 156 TM2_M_BODY_EMPTY 2497 0.41 0.11 0.52 157 FORGED_GMAIL_RCVD 2488 0.55 0.62 0.52 158 RCVD_IN_BL_SPAMCOP_NET 2478 0.85 1.70 0.52 159 XMHTMLBadTable_001 2470 0.63 0.93 0.52 160 RDNS_DYNAMIC 2464 0.56 0.68 0.52 161 FROM_GOV_SPOOF 2441 0.42 0.19 0.51 162 SHORT_HELO_AND_INLINE_IMAGE 2436 0.38 0.04 0.51 163 HTML_FONT_FACE_BAD 2428 0.61 0.86 0.51 164 T_TooManySym_03 2426 0.40 0.11 0.51 165 XMSexyCombo_01 2411 0.99 2.26 0.51 166 DKIM_ADSP_NXDOMAIN 2406 0.69 1.18 0.51 167 XMSubMetaSxObfu_03 2377 0.70 1.23 0.50 168 RELAYCOUNTRY_AU 2305 0.52 0.63 0.48 169 MISSING_HEADERS 2292 1.68 4.81 0.48 170 URI_NOVOWEL 2227 0.55 0.75 0.47 171 TM2_M_A_HREF_HREF 2150 0.50 0.64 0.45 172 XMPhish14 2139 0.60 1.01 0.45 173 XMHTML_After_End 2125 0.64 1.16 0.45 174 XMBody_78 2096 0.60 1.01 0.44 175 HTML_IMAGE_ONLY_32 2015 0.37 0.23 0.42 176 AC_DIV_BONANZA 1941 0.32 0.10 0.41 177 XM_B_REG_HTML 1930 0.49 0.70 0.41 178 XMPhish30 1913 0.61 1.17 0.40 179 RCVD_IN_SORBS_DUL 1911 0.34 0.19 0.40 180 XM_Combo_Sbj 1898 0.44 0.55 0.40 181 SpammyFromTLD_02 1865 1.67 5.03 0.39 182 XM_USANA_RCVD 1852 0.28 0.00 0.39 183 XM_URI_RBL 1841 1.09 2.93 0.39 184 HTML_IMAGE_ONLY_28 1812 0.50 0.81 0.38 185 XMSubMetaSxObfu_02 1754 0.34 0.28 0.37 186 XM_Body_Obfu01 1707 0.38 0.44 0.36 187 FROM_GOV_DKIM_AU 1693 0.28 0.07 0.36 188 RELAYCOUNTRY_DE 1658 0.86 2.19 0.35 189 FILL_THIS_FORM 1626 0.50 0.92 0.34 190 XM_H_PHPOS_M 1592 0.36 0.41 0.33 191 HTML_IMAGE_ONLY_24 1571 0.39 0.56 0.33 192 XMLKML 1527 0.23 0.00 0.32 193 SUBJ_DOLLARS 1522 0.48 0.89 0.32 194 REMOVE_BEFORE_LINK 1485 0.37 0.50 0.31 195 MIME_HEADER_CTYPE_ONLY 1483 3.14 10.55 0.31 196 GMD_PDF_EMPTY_BODY 1475 0.25 0.09 0.31 197 TVD_SPACE_RATIO 1460 0.29 0.25 0.31 198 XMSubNoVowel 1437 0.32 0.37 0.30 199 XMLngstWrd_02 1436 0.28 0.22 0.30 200 HTML_IMAGE_ONLY_20 1417 0.27 0.20 0.30 ----------------------------------------------------------------------