Email: 620635 Autolearn: 0 AvgScore: 2.51 AvgScanTime: 1.99 sec Spam: 165279 Autolearn: 0 AvgScore: 12.36 AvgScanTime: 2.37 sec Ham: 455356 Autolearn: 0 AvgScore: -1.06 AvgScanTime: 1.86 sec Time Spent Running SA: 343.74 hours Time Spent Processing Spam: 108.86 hours Time Spent Processing Ham: 234.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158669 89.56 96.00 87.22 2 DKIM_SIGNED 141082 77.89 85.36 75.17 3 XM_DK_Pass 136698 76.05 82.71 73.63 4 DCC_CHECK 135464 50.18 81.96 38.64 5 DKIM_VALID 130281 72.35 78.82 70.00 6 XMListUnsubscribeExists 124493 56.85 75.32 50.15 7 DKIM_VALID_AU 105178 53.86 63.64 50.31 8 XM_H_QuotedFrom 89629 42.96 54.23 38.88 9 XM_DK_Undo_02 83978 24.68 50.81 15.20 10 BAYES_99 75952 22.22 45.95 13.60 11 HTML_FONT_LOW_CONTRAST 66158 31.19 40.03 27.99 12 BAYES_999 63558 19.10 38.45 12.07 13 TR_DCC_Bayes_99 62692 14.77 37.93 6.36 14 LOC_TINY_FONT_1 56875 25.03 34.41 21.62 15 BAYES_50 53042 46.00 32.09 51.05 16 MIME_HTML_ONLY 50060 21.90 30.29 18.85 17 FVGT_m_MULTI_ODD 46881 23.05 28.36 21.13 18 XMSubLong 45052 23.60 27.26 22.28 19 DKIM_VALID_EF 39299 27.06 23.78 28.26 20 T_KAM_HTML_FONT_INVALID 34669 17.73 20.98 16.56 21 XM_Body_Dirty_Words 33912 14.35 20.52 12.12 22 T_TM2_M_HEADER_IN_MSG 29899 27.52 18.09 30.95 23 XM_Multi_Part_URI 27926 13.76 16.90 12.63 24 DCC_CHECK_NEGATIVE 27542 47.95 16.66 59.30 25 MultiRelay 25369 18.05 15.35 19.04 26 BOTNET_IPINHOSTNAME 24490 7.75 14.82 5.18 27 RELAYCOUNTRY_META 24484 7.80 14.81 5.25 28 XM_Evil_Numbers_Gen 23441 9.89 14.18 8.34 29 BOTNET 21966 4.93 13.29 1.90 30 HTML_IMAGE_RATIO_02 21624 9.05 13.08 7.59 31 LOTS_OF_MONEY 20695 10.42 12.52 9.65 32 FSL_BULK_SIG 20428 8.31 12.36 6.84 33 XMSexyCombo_05 17780 5.34 10.76 3.37 34 T_XMDrugObfuBody_14 16450 8.64 9.95 8.16 35 HTML_IMAGE_RATIO_04 15821 6.77 9.57 5.76 36 XM_UncommonTLD01 15582 5.01 9.43 3.40 37 TooManyTo_001 14506 8.37 8.78 8.22 38 XM_H_Long_From01 13968 7.09 8.45 6.60 39 UNTRUSTED_Relay 13375 3.16 8.09 1.37 40 XM_B_Phish_Phrases 13299 6.66 8.05 6.16 41 MPART_ALT_DIFF 13286 4.42 8.04 3.11 42 XMSubMetaSx_00 13072 4.94 7.91 3.86 43 BAYES_80 11796 5.02 7.14 4.25 44 LotsOfNums_01 11562 8.61 7.00 9.19 45 XM_salutation2 10961 3.34 6.63 2.15 46 DKIM_INVALID 10801 5.54 6.54 5.18 47 HTML_IMAGE_RATIO_06 10138 3.89 6.13 3.08 48 FROM_EXCESS_BASE64 9040 4.00 5.47 3.47 49 BAYES_60 8757 6.30 5.30 6.67 50 XMStrtUSub 8271 4.63 5.00 4.49 51 XM_SendGrid 7586 5.76 4.59 6.18 52 MIME_HTML_MOSTLY 7583 2.75 4.59 2.08 53 BAYES_95 7558 3.29 4.57 2.83 54 XM_DIRTYINTL 7516 2.62 4.55 1.93 55 T_REMOTE_IMAGE 7180 4.45 4.34 4.49 56 XM_CamelCaseFrm001 7033 2.37 4.26 1.68 57 SpammyFromTLD_02 7016 1.41 4.24 0.38 58 XM_SPF_SoftFail 6944 2.73 4.20 2.20 59 FROM_SUSPICIOUS_NTLD 6713 1.15 4.06 0.09 60 RCVD_IN_RP_SAFE 6618 8.85 4.00 10.61 61 XM_UB50 6574 1.69 3.98 0.86 62 XMNumbers 6462 3.15 3.91 2.87 63 T_TooManySym_01 6211 4.97 3.76 5.41 64 MIME_HTML_ONLY_MULTI 6190 2.20 3.75 1.63 65 RELAYCOUNTRY_CA 5966 2.01 3.61 1.44 66 HTML_IMAGE_RATIO_08 5857 2.80 3.54 2.53 67 TM2_M_URI_OPT_OUT 5807 2.19 3.51 1.71 68 URI_HEX 5282 2.09 3.20 1.69 69 MIME_QP_LONG_LINE 5216 5.32 3.16 6.11 70 XM_URI_RBL 5086 1.18 3.08 0.50 71 XM_OfRef6 4952 1.96 3.00 1.59 72 RCVD_IN_RP_CERTIFIED 4791 7.75 2.90 9.51 73 XMBdyGiftCard01 4689 1.42 2.84 0.90 74 RCVD_IN_MSPIKE_H2 4633 4.27 2.80 4.80 75 XMDiploma_00 4560 1.99 2.76 1.71 76 SUBJ_ALL_CAPS 4387 2.06 2.65 1.84 77 RCVD_IN_RP_RNBL 4156 0.69 2.51 0.03 78 T_XMDrugObfuBody_08 3915 1.79 2.37 1.58 79 URI_TRY_3LD 3881 1.65 2.35 1.40 80 HTML_MIME_NO_HTML_TAG 3857 2.40 2.33 2.43 81 XMSexyCombo_01 3564 1.07 2.16 0.67 82 RCVD_IN_BL_SPAMCOP_NET 3464 1.02 2.10 0.62 83 XMGenDplmaNmb 3367 1.27 2.04 1.00 84 NUMERIC_HTTP_ADDR 3317 0.77 2.01 0.33 85 DATE_IN_PAST_03_06 3200 0.59 1.94 0.11 86 RCVD_IN_IADB_LISTED 3150 4.80 1.91 5.86 87 MAILING_LIST_MULTI 3015 2.47 1.82 2.70 88 XM_H_TOP 2999 0.49 1.81 0.00 89 NO_DNS_FOR_FROM 2972 1.36 1.80 1.20 90 MultiRelay_CC 2965 0.63 1.79 0.20 91 MultiRelay_Combo 2965 0.63 1.79 0.20 92 XMPhish11 2938 1.56 1.78 1.47 93 TR_Caps_n_Bayes_99 2883 0.55 1.74 0.11 94 XMSubMetaI_00 2880 0.91 1.74 0.61 95 XM_H_Long_From02 2856 1.13 1.73 0.92 96 XMBody_17 2849 0.82 1.72 0.49 97 T_XMHurry_00 2847 1.05 1.72 0.80 98 TR_XM_RelayPhish 2827 0.97 1.71 0.69 99 NORDNS_LOW_CONTRAST 2821 0.47 1.71 0.02 100 TM2_M_VERY_LONG_WORD 2817 1.12 1.70 0.91 101 BODY_URI_ONLY 2746 0.52 1.66 0.11 102 XMStockSpam_06 2668 1.41 1.61 1.33 103 HTML_FONT_SIZE_LARGE 2661 0.57 1.61 0.19 104 RCVD_IN_IADB_SPF 2635 4.22 1.59 5.17 105 SpammyFromTLD_01 2634 1.02 1.59 0.81 106 XMHTML_After_End 2556 0.66 1.55 0.33 107 BAYES_40 2549 3.40 1.54 4.07 108 HTML_IMAGE_ONLY_12 2536 0.59 1.53 0.25 109 RCVD_IN_PSBL 2523 0.43 1.53 0.03 110 UNPARSEABLE_RELAY 2502 2.70 1.51 3.14 111 TR_Symld_Words 2493 1.60 1.51 1.64 112 NORMAL_HTTP_TO_IP 2492 0.45 1.51 0.06 113 HTML_SHORT_LINK_IMG_1 2455 0.42 1.49 0.03 114 BOTNET_NORDNS 2384 0.42 1.44 0.05 115 RCVD_IN_IADB_SENDERID 2368 3.73 1.43 4.57 116 TR_LOTS_OF_MONEY3 2356 0.69 1.43 0.42 117 XM_UB99 2353 0.39 1.42 0.01 118 XM_ProductURIs 2347 0.90 1.42 0.71 119 BAYES_20 2347 2.64 1.42 3.08 120 RCVD_IN_IADB_DK 2317 3.68 1.40 4.50 121 RELAYCOUNTRY_FR 2213 0.52 1.34 0.23 122 ALL_TRUSTED 2158 11.59 1.31 15.32 123 DIET_1 2136 0.66 1.29 0.43 124 XM_H_PHPOS 2119 1.25 1.28 1.24 125 XMBody_78 2110 0.77 1.28 0.59 126 TVD_IP_SING_HEX 2079 0.34 1.26 0.00 127 URI_HEX_IP 2079 0.34 1.26 0.00 128 TVD_IP_HEX 2079 0.34 1.26 0.00 129 RELAYCOUNTRY_GB 2032 1.11 1.23 1.07 130 RCVD_IN_IADB_VOUCHED 1972 2.97 1.19 3.62 131 T_TooManySym_02 1967 1.79 1.19 2.01 132 T_FILL_THIS_FORM_SHORT 1912 1.06 1.16 1.02 133 XMSubMetaSxObfu_03 1903 0.60 1.15 0.40 134 XM_DK_Undo_01 1874 1.78 1.13 2.01 135 XMPhish30 1857 0.61 1.12 0.43 136 FILL_THIS_FORM 1850 0.59 1.12 0.40 137 FSL_THIS_IS_ADV 1784 0.38 1.08 0.13 138 XMHTMLBadTable_001 1760 0.59 1.06 0.42 139 FILL_THIS_FORM_LONG 1743 0.51 1.05 0.31 140 XM_UB60 1722 0.33 1.04 0.07 141 XM_UB999 1718 0.28 1.04 0.01 142 HTML_FONT_FACE_BAD 1689 0.75 1.02 0.65 143 T_XMDrugObfuBody_00 1675 0.86 1.01 0.81 144 BAYES_00 1608 9.15 0.97 12.12 145 TR_LOTS_OF_MONEY2 1589 0.59 0.96 0.45 146 T_MONEY_PERCENT 1589 0.59 0.96 0.45 147 XM_B_REG_HTML 1587 0.64 0.96 0.52 148 FILL_THIS_FORM_LOAN 1586 0.48 0.96 0.31 149 TR_MetaPhish_Combo_01 1575 1.41 0.95 1.58 150 URIBL_BLACK 1555 0.29 0.94 0.05 151 XM_BadFromFormat 1553 0.34 0.94 0.12 152 XMGppyBdWords 1526 0.45 0.92 0.28 153 DKIM_ADSP_CUSTOM_MED 1506 1.09 0.91 1.15 154 XMSexyCombo_04 1501 0.42 0.91 0.24 155 RELAYCOUNTRY_AT 1493 0.41 0.90 0.23 156 T_Symld_Words_02 1489 0.69 0.90 0.61 157 DKIM_ADSP_NXDOMAIN 1469 0.64 0.89 0.55 158 HTML_IMAGE_ONLY_28 1450 0.55 0.88 0.43 159 BODY_ENHANCEMENT 1441 0.25 0.87 0.02 160 XM_HighProb1 1435 0.27 0.87 0.06 161 XMSlimDrugH 1431 0.47 0.87 0.33 162 RCVD_IN_IADB_OPTIN 1410 1.90 0.85 2.28 163 NML_ADSP_CUSTOM_MED 1400 0.81 0.85 0.79 164 RELAYCOUNTRY_IN 1392 0.33 0.84 0.14 165 RDNS_DYNAMIC 1375 0.51 0.83 0.40 166 HTML_OFF_PAGE 1367 0.22 0.83 0.00 167 BAYES_05 1366 1.69 0.83 2.00 168 TR_M_TOP_BAYES 1358 0.22 0.82 0.00 169 LONG_JUNK_URI 1319 0.29 0.80 0.11 170 RELAYCOUNTRY_DE 1302 0.64 0.79 0.59 171 URI_NOVOWEL 1296 0.60 0.78 0.53 172 XM_PDF 1294 4.09 0.78 5.29 173 FORGED_GMAIL_RCVD 1293 0.63 0.78 0.58 174 XMMoneyMeta_00 1272 0.67 0.77 0.63 175 XM_RXBody 1268 0.74 0.77 0.72 176 XMSubMetaSSx_00 1264 0.33 0.76 0.17 177 RELAYCOUNTRY_CN 1261 0.26 0.76 0.08 178 TooManyTo_002 1258 1.90 0.76 2.31 179 XMPhish14 1257 0.51 0.76 0.42 180 XM_OfRef7 1250 0.47 0.76 0.36 181 XM_B_COPY_HTML 1245 0.56 0.75 0.50 182 TR_Mismatch_TLD_02 1242 0.26 0.75 0.08 183 LongTLD 1240 0.33 0.75 0.17 184 RELAYCOUNTRY_AU 1209 0.60 0.73 0.55 185 HTTPS_HTTP_MISMATCH 1208 0.72 0.73 0.71 186 XMBrknScrpt_02 1194 0.67 0.72 0.65 187 XM_H_PHPMailer 1183 0.68 0.72 0.67 188 SUBJ_DOLLARS 1175 0.57 0.71 0.51 189 XM_UB80 1162 0.20 0.70 0.02 190 MPART_ALT_DIFF_COUNT 1161 0.34 0.70 0.20 191 XM_Combo_Sbj 1155 0.38 0.70 0.27 192 TR_XM_DK_Bayes 1139 6.97 0.69 9.25 193 XMLongAddy 1105 0.21 0.67 0.04 194 URIBL_DBL_SPAM 1092 0.18 0.66 0.01 195 LOW_PRICE 1062 0.35 0.64 0.25 196 HTML_TAG_BALANCE_BODY 1025 0.52 0.62 0.48 197 TooManyTo_003 1025 1.27 0.62 1.51 198 TR_XM_DK_Bayes1 1015 6.60 0.61 8.77 199 HELO_NODOT 1013 1.57 0.61 1.92 200 HELO_NO_DOMAIN 1008 1.57 0.61 1.92 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 397156 89.56 96.00 87.22 2 DKIM_SIGNED 342305 77.89 85.36 75.17 3 XM_DK_Pass 335285 76.05 82.71 73.63 4 DKIM_VALID 318734 72.35 78.82 70.00 5 DCC_CHECK_NEGATIVE 270047 47.95 16.66 59.30 6 BAYES_50 232443 46.00 32.09 51.05 7 DKIM_VALID_AU 229086 53.86 63.64 50.31 8 XMListUnsubscribeExists 228342 56.85 75.32 50.15 9 XM_H_QuotedFrom 177022 42.96 54.23 38.88 10 DCC_CHECK 175945 50.18 81.96 38.64 11 T_TM2_M_HEADER_IN_MSG 140916 27.52 18.09 30.95 12 DKIM_VALID_EF 128662 27.06 23.78 28.26 13 HTML_FONT_LOW_CONTRAST 127442 31.19 40.03 27.99 14 XMSubLong 101439 23.60 27.26 22.28 15 LOC_TINY_FONT_1 98447 25.03 34.41 21.62 16 FVGT_m_MULTI_ODD 96195 23.05 28.36 21.13 17 MultiRelay 86680 18.05 15.35 19.04 18 MIME_HTML_ONLY 85852 21.90 30.29 18.85 19 T_KAM_HTML_FONT_INVALID 75389 17.73 20.98 16.56 20 ALL_TRUSTED 69761 11.59 1.31 15.32 21 XM_DK_Undo_02 69212 24.68 50.81 15.20 22 BAYES_99 61930 22.22 45.95 13.60 23 XM_DKIMWhitelistDomains 57596 9.29 0.05 12.65 24 XM_Multi_Part_URI 57499 13.76 16.90 12.63 25 BAYES_00 55191 9.15 0.97 12.12 26 XM_Body_Dirty_Words 55169 14.35 20.52 12.12 27 BAYES_999 54955 19.10 38.45 12.07 28 RCVD_IN_RP_SAFE 48323 8.85 4.00 10.61 29 LOTS_OF_MONEY 43960 10.42 12.52 9.65 30 RCVD_IN_RP_CERTIFIED 43302 7.75 2.90 9.51 31 TR_XM_DK_Bayes 42131 6.97 0.69 9.25 32 LotsOfNums_01 41852 8.61 7.00 9.19 33 TR_XM_DK_Bayes1 39940 6.60 0.61 8.77 34 XM_Evil_Numbers_Gen 37968 9.89 14.18 8.34 35 TooManyTo_001 37416 8.37 8.78 8.22 36 T_XMDrugObfuBody_14 37170 8.64 9.95 8.16 37 HTML_IMAGE_RATIO_02 34568 9.05 13.08 7.59 38 TR_XM_DK_Bayes2 34123 5.63 0.51 7.49 39 FSL_BULK_SIG 31162 8.31 12.36 6.84 40 BAYES_60 30354 6.30 5.30 6.67 41 XM_H_Long_From01 30055 7.09 8.45 6.60 42 TR_DCC_Bayes_99 28952 14.77 37.93 6.36 43 XM_SendGrid 28143 5.76 4.59 6.18 44 XM_B_Phish_Phrases 28042 6.66 8.05 6.16 45 MIME_QP_LONG_LINE 27815 5.32 3.16 6.11 46 RCVD_IN_IADB_LISTED 26665 4.80 1.91 5.86 47 HTML_IMAGE_RATIO_04 26208 6.77 9.57 5.76 48 T_TooManySym_01 24620 4.97 3.76 5.41 49 XM_PDF 24070 4.09 0.78 5.29 50 RELAYCOUNTRY_META 23911 7.80 14.81 5.25 51 BOTNET_IPINHOSTNAME 23590 7.75 14.82 5.18 52 DKIM_INVALID 23571 5.54 6.54 5.18 53 RCVD_IN_IADB_SPF 23557 4.22 1.59 5.17 54 RCVD_IN_MSPIKE_H2 21842 4.27 2.80 4.80 55 RCVD_IN_IADB_SENDERID 20800 3.73 1.43 4.57 56 RCVD_IN_IADB_DK 20497 3.68 1.40 4.50 57 XMStrtUSub 20449 4.63 5.00 4.49 58 T_REMOTE_IMAGE 20429 4.45 4.34 4.49 59 IN_ZIMBRA_NJ_WHITELIST 19402 3.13 0.02 4.26 60 BAYES_80 19357 5.02 7.14 4.25 61 BAYES_40 18535 3.40 1.54 4.07 62 XMSubMetaSx_00 17573 4.94 7.91 3.86 63 RCVD_IN_IADB_VOUCHED 16488 2.97 1.19 3.62 64 FROM_EXCESS_BASE64 15805 4.00 5.47 3.47 65 XM_UncommonTLD01 15501 5.01 9.43 3.40 66 XMSexyCombo_05 15346 5.34 10.76 3.37 67 UNPARSEABLE_RELAY 14276 2.70 1.51 3.14 68 MPART_ALT_DIFF 14173 4.42 8.04 3.11 69 BAYES_20 14043 2.64 1.42 3.08 70 HTML_IMAGE_RATIO_06 14019 3.89 6.13 3.08 71 TVD_RCVD_IP 13259 2.28 0.52 2.91 72 XMNumbers 13064 3.15 3.91 2.87 73 BAYES_95 12889 3.29 4.57 2.83 74 TO_MALFORMED 12555 2.10 0.28 2.76 75 MAILING_LIST_MULTI 12300 2.47 1.82 2.70 76 HTML_IMAGE_RATIO_08 11498 2.80 3.54 2.53 77 HTML_MIME_NO_HTML_TAG 11069 2.40 2.33 2.43 78 TooManyTo_002 10513 1.90 0.76 2.31 79 RCVD_IN_IADB_OPTIN 10372 1.90 0.85 2.28 80 RCVD_IN_MSPIKE_H3 10337 1.80 0.49 2.27 81 RCVD_IN_MSPIKE_WL 10337 1.80 0.49 2.27 82 XM_SPF_SoftFail 9998 2.73 4.20 2.20 83 ANY_BOUNCE_MESSAGE 9925 1.74 0.51 2.18 84 BOUNCE_MESSAGE 9922 1.73 0.51 2.18 85 XM_salutation2 9795 3.34 6.63 2.15 86 MIME_HTML_MOSTLY 9492 2.75 4.59 2.08 87 XM_DK_Undo_01 9159 1.78 1.13 2.01 88 T_TooManySym_02 9137 1.79 1.19 2.01 89 BAYES_05 9116 1.69 0.83 2.00 90 XM_DIRTYINTL 8769 2.62 4.55 1.93 91 HELO_NODOT 8725 1.57 0.61 1.92 92 HELO_NO_DOMAIN 8724 1.57 0.61 1.92 93 BOTNET 8631 4.93 13.29 1.90 94 SUBJ_ALL_CAPS 8374 2.06 2.65 1.84 95 IN_HORDE_ADDRESS_BOOK 8214 1.33 0.03 1.80 96 TM2_M_URI_OPT_OUT 7797 2.19 3.51 1.71 97 XMDiploma_00 7787 1.99 2.76 1.71 98 URI_HEX 7695 2.09 3.20 1.69 99 XM_CamelCaseFrm001 7656 2.37 4.26 1.68 100 TR_Symld_Words 7451 1.60 1.51 1.64 101 MIME_HTML_ONLY_MULTI 7437 2.20 3.75 1.63 102 INVALID_MSGID 7433 1.25 0.18 1.63 103 XM_OfRef6 7238 1.96 3.00 1.59 104 TR_MetaPhish_Combo_01 7205 1.41 0.95 1.58 105 T_XMDrugObfuBody_08 7185 1.79 2.37 1.58 106 USER_IN_DEF_DKIM_WL 7110 1.15 0.03 1.56 107 TooManyTo_003 6868 1.27 0.62 1.51 108 XMCapTrack 6827 1.17 0.27 1.50 109 XMPhish11 6716 1.56 1.78 1.47 110 RELAYCOUNTRY_CA 6538 2.01 3.61 1.44 111 URI_TRY_3LD 6370 1.65 2.35 1.40 112 UNTRUSTED_Relay 6220 3.16 8.09 1.37 113 XM_GoogleGroups 6088 1.09 0.41 1.34 114 XMStockSpam_06 6055 1.41 1.61 1.33 115 XM_H_PHPOS 5660 1.25 1.28 1.24 116 NO_DNS_FOR_FROM 5481 1.36 1.80 1.20 117 DKIM_ADSP_CUSTOM_MED 5253 1.09 0.91 1.15 118 TooManyTo_004 5129 0.96 0.52 1.13 119 RELAYCOUNTRY_GB 4880 1.11 1.23 1.07 120 T_FILL_THIS_FORM_SHORT 4642 1.06 1.16 1.02 121 XMGenDplmaNmb 4539 1.27 2.04 1.00 122 TooManyTo_005 4270 0.81 0.46 0.94 123 XM_H_Long_From02 4186 1.13 1.73 0.92 124 T_OBFU_PDF_ATTACH 4151 0.73 0.23 0.91 125 TM2_M_VERY_LONG_WORD 4135 1.12 1.70 0.91 126 XMBdyGiftCard01 4096 1.42 2.84 0.90 127 XM_UB50 3931 1.69 3.98 0.86 128 SpammyFromTLD_01 3700 1.02 1.59 0.81 129 T_XMDrugObfuBody_00 3673 0.86 1.01 0.81 130 T_XMHurry_00 3642 1.05 1.72 0.80 131 NML_ADSP_CUSTOM_MED 3617 0.81 0.85 0.79 132 PLING_QUERY 3364 0.64 0.35 0.74 133 XM_RXBody 3295 0.74 0.77 0.72 134 HTTPS_HTTP_MISMATCH 3244 0.72 0.73 0.71 135 XM_ProductURIs 3235 0.90 1.42 0.71 136 TR_XM_RelayPhish 3163 0.97 1.71 0.69 137 XMSexyCombo_01 3056 1.07 2.16 0.67 138 XM_H_PHPMailer 3032 0.68 0.72 0.67 139 USER_IN_WHITELIST 3016 0.49 0.00 0.66 140 XMBrknScrpt_02 2974 0.67 0.72 0.65 141 HTML_FONT_FACE_BAD 2949 0.75 1.02 0.65 142 TM2_M_A_HREF_HREF 2946 0.59 0.43 0.65 143 XMLngstWrd_00 2912 0.58 0.41 0.64 144 XM_ShortIntro_01 2882 0.54 0.27 0.63 145 XMMoneyMeta_00 2882 0.67 0.77 0.63 146 RCVD_IN_BL_SPAMCOP_NET 2841 1.02 2.10 0.62 147 T_Symld_Words_02 2800 0.69 0.90 0.61 148 XMNoVowels 2793 0.53 0.30 0.61 149 XMSubMetaI_00 2768 0.91 1.74 0.61 150 XMBody_95 2746 0.48 0.16 0.60 151 XMLngstWrd_01 2733 0.54 0.39 0.60 152 T_TooManySym_03 2697 0.51 0.27 0.59 153 RELAYCOUNTRY_DE 2694 0.64 0.79 0.59 154 XMBody_78 2669 0.77 1.28 0.59 155 FORGED_GMAIL_RCVD 2631 0.63 0.78 0.58 156 XMGappySubj_01 2576 0.48 0.26 0.57 157 AC_DIV_BONANZA 2560 0.44 0.10 0.56 158 FROM_GOV_SPOOF 2559 0.45 0.13 0.56 159 RELAYCOUNTRY_AU 2521 0.60 0.73 0.55 160 DKIM_ADSP_NXDOMAIN 2507 0.64 0.89 0.55 161 URI_NOVOWEL 2409 0.60 0.78 0.53 162 XM_B_REG_HTML 2382 0.64 0.96 0.52 163 SUBJ_DOLLARS 2333 0.57 0.71 0.51 164 SHORT_HELO_AND_INLINE_IMAGE 2292 0.38 0.04 0.50 165 XM_URI_RBL 2259 1.18 3.08 0.50 166 XM_B_COPY_HTML 2257 0.56 0.75 0.50 167 XMBody_17 2223 0.82 1.72 0.49 168 HTML_TAG_BALANCE_BODY 2195 0.52 0.62 0.48 169 XMDateMe_00 2177 0.44 0.33 0.48 170 MISSING_HEADERS 2164 0.42 0.26 0.48 171 HTML_IMAGE_ONLY_32 2099 0.45 0.43 0.46 172 T_MONEY_PERCENT 2065 0.59 0.96 0.45 173 TR_LOTS_OF_MONEY2 2065 0.59 0.96 0.45 174 TM2_M_BODY_EMPTY 1998 0.35 0.11 0.44 175 HTML_IMAGE_ONLY_28 1966 0.55 0.88 0.43 176 XMPhish30 1943 0.61 1.12 0.43 177 DIET_1 1941 0.66 1.29 0.43 178 XMSubMetaSxObfu_02 1934 0.40 0.34 0.42 179 TR_LOTS_OF_MONEY3 1930 0.69 1.43 0.42 180 XMHTMLBadTable_001 1919 0.59 1.06 0.42 181 XMPhish14 1900 0.51 0.76 0.42 182 XM_H_PHPOS_M 1879 0.42 0.44 0.41 183 RCVD_IN_SORBS_DUL 1858 0.36 0.21 0.41 184 FILL_THIS_FORM 1833 0.59 1.12 0.40 185 FROM_GOV_DKIM_AU 1831 0.33 0.13 0.40 186 XMSubMetaSxObfu_03 1819 0.60 1.15 0.40 187 RDNS_DYNAMIC 1815 0.51 0.83 0.40 188 XMSolicitRefs_0 1791 0.39 0.36 0.39 189 SpammyFromTLD_02 1724 1.41 4.24 0.38 190 XM_Ancestry_Forge 1690 0.28 0.02 0.37 191 XM_OfRef7 1651 0.47 0.76 0.36 192 XMLKML 1602 0.26 0.00 0.35 193 BASE64_LENGTH_79_INF 1570 0.30 0.17 0.34 194 XMRcvdHeader_15 1554 0.25 0.00 0.34 195 XMSubNoVowel 1550 0.33 0.31 0.34 196 XM_Body_Obfu01 1536 0.38 0.51 0.34 197 HTML_IMAGE_ONLY_24 1522 0.34 0.35 0.33 198 XMHTML_After_End 1510 0.66 1.55 0.33 199 XMSlimDrugH 1504 0.47 0.87 0.33 200 NUMERIC_HTTP_ADDR 1490 0.77 2.01 0.33 ----------------------------------------------------------------------