Email: 641108 Autolearn: 0 AvgScore: 2.24 AvgScanTime: 1.94 sec Spam: 156952 Autolearn: 0 AvgScore: 12.68 AvgScanTime: 2.30 sec Ham: 484156 Autolearn: 0 AvgScore: -1.15 AvgScanTime: 1.82 sec Time Spent Running SA: 344.93 hours Time Spent Processing Spam: 100.16 hours Time Spent Processing Ham: 244.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148936 84.99 94.89 81.79 2 DKIM_SIGNED 120957 70.81 77.07 68.78 3 DCC_CHECK 120367 45.57 76.69 35.49 4 XM_DK_Pass 116512 69.19 74.23 67.56 5 XMListUnsubscribeExists 113243 52.03 72.15 45.51 6 DKIM_VALID 110119 65.67 70.16 64.22 7 DKIM_VALID_AU 87669 49.11 55.86 46.92 8 XM_H_QuotedFrom 79804 38.80 50.85 34.89 9 XM_DK_Undo_02 67941 20.63 43.29 13.29 10 BAYES_99 61498 18.37 39.18 11.62 11 BAYES_50 57751 48.88 36.80 52.80 12 HTML_FONT_LOW_CONTRAST 54236 27.53 34.56 25.26 13 MIME_HTML_ONLY 53194 23.49 33.89 20.12 14 BAYES_999 51018 15.73 32.51 10.29 15 LOC_TINY_FONT_1 49648 23.54 31.63 20.92 16 TR_DCC_Bayes_99 48022 11.66 30.60 5.52 17 XMSubLong 43330 22.39 27.61 20.69 18 FVGT_m_MULTI_ODD 42046 20.70 26.79 18.73 19 DKIM_VALID_EF 35340 24.11 22.52 24.62 20 DCC_CHECK_NEGATIVE 34115 52.67 21.74 62.69 21 RELAYCOUNTRY_META 33928 8.68 21.62 4.49 22 XM_Body_Dirty_Words 31106 14.73 19.82 13.08 23 T_KAM_HTML_FONT_INVALID 29334 15.63 18.69 14.64 24 BOTNET 29317 5.99 18.68 1.88 25 T_TM2_M_HEADER_IN_MSG 29021 26.80 18.49 29.50 26 BOTNET_IPINHOSTNAME 28695 8.30 18.28 5.07 27 MultiRelay 26498 17.46 16.88 17.65 28 XM_Multi_Part_URI 23130 11.65 14.74 10.64 29 UNTRUSTED_Relay 22668 4.40 14.44 1.14 30 FSL_BULK_SIG 21143 8.54 13.47 6.94 31 XM_UncommonTLD01 19944 5.50 12.71 3.17 32 XM_Evil_Numbers_Gen 19616 9.77 12.50 8.89 33 XMSexyCombo_05 18735 6.22 11.94 4.37 34 HTML_IMAGE_RATIO_02 18445 7.81 11.75 6.54 35 LOTS_OF_MONEY 16218 9.02 10.33 8.59 36 TooManyTo_001 13802 8.30 8.79 8.14 37 XM_UB50 13528 2.59 8.62 0.64 38 XMSubMetaSx_00 13467 4.88 8.58 3.67 39 XM_salutation2 12120 3.00 7.72 1.48 40 BAYES_80 11769 5.23 7.50 4.49 41 HTML_IMAGE_RATIO_04 11397 6.51 7.26 6.27 42 T_XMDrugObfuBody_14 11196 8.10 7.13 8.41 43 XM_H_Long_From01 11116 6.31 7.08 6.06 44 DKIM_INVALID 10838 5.14 6.91 4.56 45 XMNumbers 10790 3.59 6.87 2.52 46 MPART_ALT_DIFF 10388 5.08 6.62 4.58 47 HTML_MIME_NO_HTML_TAG 10240 3.63 6.52 2.70 48 XM_B_Phish_Phrases 10216 6.32 6.51 6.26 49 BAYES_60 10168 6.49 6.48 6.49 50 LotsOfNums_01 10075 7.67 6.42 8.08 51 XM_DIRTYINTL 8640 3.12 5.50 2.35 52 HTML_IMAGE_RATIO_06 8636 3.65 5.50 3.06 53 DKIM_ADSP_NXDOMAIN 7729 1.59 4.92 0.51 54 BAYES_95 7623 2.96 4.86 2.35 55 MIME_HTML_MOSTLY 7368 2.60 4.69 1.92 56 SpammyFromTLD_02 7278 1.38 4.64 0.33 57 FROM_SUSPICIOUS_NTLD 7182 1.19 4.58 0.09 58 XMStrtUSub 7091 4.58 4.52 4.60 59 FROM_EXCESS_BASE64 6771 4.12 4.31 4.05 60 T_REMOTE_IMAGE 6710 4.09 4.28 4.04 61 XM_SendGrid 6698 5.21 4.27 5.52 62 RELAYCOUNTRY_FR 6112 1.11 3.89 0.21 63 XM_SPF_SoftFail 5949 2.62 3.79 2.24 64 TM2_M_URI_OPT_OUT 5749 2.28 3.66 1.84 65 XMDiploma_00 5699 2.43 3.63 2.04 66 XM_CamelCaseFrm001 5685 2.09 3.62 1.59 67 RELAYCOUNTRY_CA 5684 1.88 3.62 1.31 68 RCVD_IN_RP_SAFE 5459 8.06 3.48 9.54 69 NUMERIC_HTTP_ADDR 5393 1.11 3.44 0.36 70 MIME_HTML_ONLY_MULTI 5378 3.03 3.43 2.90 71 T_TooManySym_01 5205 4.70 3.32 5.15 72 MIME_QP_LONG_LINE 4863 5.09 3.10 5.73 73 URI_HEX 4730 1.94 3.01 1.59 74 XM_URI_RBL 4647 1.01 2.96 0.38 75 TR_XM_PHPDW 4593 1.44 2.93 0.96 76 INVALID_MSGID 4543 1.87 2.89 1.54 77 TR_XM_PHPForged 4530 1.42 2.89 0.94 78 TR_XM_FormFill2 4503 1.41 2.87 0.94 79 XM_H_PHPOS 4484 1.41 2.86 0.94 80 RCVD_IN_RP_CERTIFIED 4429 7.24 2.82 8.67 81 HTML_IMAGE_RATIO_08 4422 2.11 2.82 1.88 82 MultiRelay_Combo 4421 0.81 2.82 0.16 83 MultiRelay_CC 4421 0.81 2.82 0.16 84 RCVD_IN_MSPIKE_H2 4381 3.67 2.79 3.96 85 NORMAL_HTTP_TO_IP 4377 0.72 2.79 0.05 86 T_XMDrugObfuBody_08 4323 1.77 2.75 1.45 87 RCVD_IN_BL_SPAMCOP_NET 4221 1.04 2.69 0.51 88 RELAYCOUNTRY_DE 4171 0.90 2.66 0.33 89 XM_OfRef6 4136 1.60 2.64 1.26 90 XMBdyGiftCard01 4086 1.27 2.60 0.84 91 XMSubMetaSxObfu_03 3818 0.87 2.43 0.36 92 RCVD_IN_RP_RNBL 3726 0.60 2.37 0.02 93 RELAYCOUNTRY_GB 3585 1.28 2.28 0.96 94 HTML_FONT_SIZE_LARGE 3529 0.66 2.25 0.14 95 XMSexyCombo_01 3455 1.13 2.20 0.78 96 HTML_TAG_BALANCE_BODY 3437 0.80 2.19 0.35 97 SpammyFromTLD_01 3218 1.06 2.05 0.74 98 NO_DNS_FOR_FROM 3195 1.49 2.04 1.32 99 TR_Mismatch_TLD_01 3087 0.58 1.97 0.14 100 TR_XM_DK_SendGrid 3004 2.67 1.91 2.91 101 XMHTML_After_End 2994 0.74 1.91 0.36 102 HTML_EXTRA_CLOSE 2989 0.48 1.90 0.01 103 XM_UB99 2984 0.47 1.90 0.01 104 T_XMDrugObfuBody_00 2955 0.90 1.88 0.58 105 BAYES_40 2934 3.21 1.87 3.65 106 BODY_URI_ONLY 2927 0.54 1.86 0.11 107 T_XMHurry_00 2917 0.83 1.86 0.50 108 BOTNET_NORDNS 2869 0.48 1.83 0.05 109 ALL_TRUSTED 2865 16.23 1.83 20.89 110 XM_UB60 2807 0.50 1.79 0.08 111 XMGenDplmaNmb 2797 1.52 1.78 1.43 112 DIET_1 2788 0.66 1.78 0.30 113 RCVD_IN_IADB_LISTED 2715 4.58 1.73 5.50 114 XMMoneyMeta_00 2586 0.83 1.65 0.56 115 T_Symld_Words_02 2555 0.87 1.63 0.63 116 T_HTML_TAG_BALANCE_CENTER 2554 0.49 1.63 0.12 117 XMSubMetaI_00 2537 1.13 1.62 0.97 118 SUBJ_ALL_CAPS 2537 1.61 1.62 1.61 119 MAILING_LIST_MULTI 2517 2.09 1.60 2.24 120 XMBody_78 2514 0.68 1.60 0.38 121 HTML_IMAGE_ONLY_12 2497 0.56 1.59 0.23 122 XM_UB999 2404 0.38 1.53 0.01 123 XM_H_Long_From02 2389 1.01 1.52 0.84 124 HTML_IMAGE_ONLY_28 2387 0.66 1.52 0.39 125 RCVD_IN_IADB_SPF 2330 4.07 1.48 4.90 126 XM_ProductURIs 2318 0.89 1.48 0.70 127 TR_XM_RelayPhish 2305 1.02 1.47 0.87 128 URIBL_SBL_A 2290 0.39 1.46 0.04 129 BAD_ENC_HEADER 2261 0.37 1.44 0.02 130 BAYES_20 2240 2.57 1.43 2.94 131 HTML_SHORT_LINK_IMG_1 2232 0.37 1.42 0.03 132 TM2_M_VERY_LONG_WORD 2206 1.14 1.41 1.05 133 TR_Symld_Words 2185 1.49 1.39 1.52 134 RCVD_IN_IADB_SENDERID 2142 3.62 1.36 4.36 135 XM_H_TOP 2139 0.34 1.36 0.01 136 RCVD_IN_IADB_DK 2110 3.60 1.34 4.33 137 HTML_IMAGE_ONLY_32 2096 0.66 1.34 0.44 138 XMStockSpam_06 2037 1.59 1.30 1.69 139 XM_H_PHPMailer 2008 0.70 1.28 0.52 140 XMSlimDrugH 1953 0.63 1.24 0.43 141 XMPhish30 1906 0.58 1.21 0.38 142 TR_Mismatch_TLD_02 1901 0.34 1.21 0.05 143 XMPhish11 1841 1.11 1.17 1.09 144 TR_LOTS_OF_MONEY2 1835 0.53 1.17 0.32 145 T_MONEY_PERCENT 1835 0.53 1.17 0.32 146 T_FILL_THIS_FORM_SHORT 1827 1.03 1.16 0.98 147 UNPARSEABLE_RELAY 1788 2.62 1.14 3.10 148 XMBody_17 1742 0.65 1.11 0.50 149 XMSexyCombo_04 1712 0.51 1.09 0.32 150 TR_M_TOP_BAYES 1684 0.26 1.07 0.00 151 XM_B_REG_HTML 1668 0.59 1.06 0.44 152 FILL_THIS_FORM 1667 0.77 1.06 0.68 153 SUBJ_DOLLARS 1666 0.46 1.06 0.27 154 RELAYCOUNTRY_AT 1655 0.39 1.05 0.17 155 SHORT_URI_3 1595 0.33 1.02 0.11 156 XM_H_PHPOS_M 1589 0.41 1.01 0.22 157 XM_RXBody 1582 0.67 1.01 0.56 158 DATE_IN_PAST_12_24 1580 0.28 1.01 0.05 159 XMHTMLBadTable_001 1573 0.49 1.00 0.32 160 HTML_FONT_SIZE_HUGE 1566 0.31 1.00 0.09 161 FILL_THIS_FORM_LONG 1541 0.45 0.98 0.27 162 URI_TRY_3LD 1514 1.01 0.96 1.03 163 RCVD_IN_IADB_VOUCHED 1506 2.63 0.96 3.17 164 XM_HighProb1 1489 0.24 0.95 0.01 165 RELAYCOUNTRY_IN 1457 0.31 0.93 0.11 166 HK_RANDOM_REPLYTO 1445 0.36 0.92 0.18 167 TVD_IP_HEX 1413 0.22 0.90 0.00 168 TVD_IP_SING_HEX 1413 0.22 0.90 0.00 169 URI_HEX_IP 1413 0.22 0.90 0.00 170 TR_MetaPhish_Combo_01 1407 1.38 0.90 1.54 171 HTML_IMAGE_ONLY_24 1406 0.46 0.90 0.31 172 PLING_QUERY 1405 0.48 0.90 0.34 173 BAYES_00 1398 10.21 0.89 13.23 174 XM_UB80 1396 0.25 0.89 0.04 175 URIBL_BLACK 1388 0.25 0.88 0.04 176 TR_LOTS_OF_MONEY3 1376 0.39 0.88 0.23 177 DKIM_ADSP_CUSTOM_MED 1356 1.00 0.86 1.05 178 XM_PDF 1345 3.50 0.86 4.36 179 XMSubMetaSSx_00 1297 0.33 0.83 0.17 180 NML_ADSP_CUSTOM_MED 1279 0.70 0.81 0.66 181 DATE_IN_PAST_06_12 1264 0.23 0.81 0.04 182 FILL_THIS_FORM_LOAN 1262 0.41 0.80 0.28 183 REPLYTO_WITHOUT_TO_CC 1258 0.45 0.80 0.33 184 BAYES_05 1247 1.79 0.79 2.11 185 TooManyTo_002 1240 1.88 0.79 2.23 186 URI_NOVOWEL 1228 0.49 0.78 0.40 187 HTML_FONT_FACE_BAD 1178 0.61 0.75 0.56 188 TVD_RCVD_IP 1170 2.53 0.75 3.10 189 RELAYCOUNTRY_CN 1168 0.22 0.74 0.05 190 NORDNS_LOW_CONTRAST 1162 0.18 0.74 0.00 191 HTTPS_HTTP_MISMATCH 1161 0.64 0.74 0.61 192 XMPhish14 1156 0.54 0.74 0.47 193 XMSolicitRefs_0 1150 0.41 0.73 0.31 194 DATE_IN_PAST_03_06 1147 0.26 0.73 0.11 195 THIS_AD 1139 0.48 0.73 0.39 196 URIBL_DBL_SPAM 1129 0.18 0.72 0.01 197 T_TooManySym_02 1127 1.37 0.72 1.58 198 LONG_JUNK_URI 1112 0.24 0.71 0.09 199 FORGED_GMAIL_RCVD 1106 0.58 0.70 0.54 200 XM_DK_Undo_01 1075 1.55 0.68 1.83 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 395968 84.99 94.89 81.79 2 DKIM_SIGNED 333020 70.81 77.07 68.78 3 XM_DK_Pass 327079 69.19 74.23 67.56 4 DKIM_VALID 310927 65.67 70.16 64.22 5 DCC_CHECK_NEGATIVE 303536 52.67 21.74 62.69 6 BAYES_50 255620 48.88 36.80 52.80 7 DKIM_VALID_AU 227182 49.11 55.86 46.92 8 XMListUnsubscribeExists 220347 52.03 72.15 45.51 9 DCC_CHECK 171806 45.57 76.69 35.49 10 XM_H_QuotedFrom 168924 38.80 50.85 34.89 11 T_TM2_M_HEADER_IN_MSG 142810 26.80 18.49 29.50 12 HTML_FONT_LOW_CONTRAST 122285 27.53 34.56 25.26 13 DKIM_VALID_EF 119214 24.11 22.52 24.62 14 LOC_TINY_FONT_1 101291 23.54 31.63 20.92 15 ALL_TRUSTED 101164 16.23 1.83 20.89 16 XMSubLong 100193 22.39 27.61 20.69 17 MIME_HTML_ONLY 97410 23.49 33.89 20.12 18 FVGT_m_MULTI_ODD 90661 20.70 26.79 18.73 19 MultiRelay 85437 17.46 16.88 17.65 20 T_KAM_HTML_FONT_INVALID 70895 15.63 18.69 14.64 21 XM_DK_Undo_02 64349 20.63 43.29 13.29 22 BAYES_00 64056 10.21 0.89 13.23 23 XM_Body_Dirty_Words 63314 14.73 19.82 13.08 24 XM_DKIMWhitelistDomains 58774 9.19 0.09 12.14 25 BAYES_99 56252 18.37 39.18 11.62 26 XM_Multi_Part_URI 51537 11.65 14.74 10.64 27 BAYES_999 49817 15.73 32.51 10.29 28 TR_XM_DK_Bayes 47768 7.59 0.56 9.87 29 RCVD_IN_RP_SAFE 46209 8.06 3.48 9.54 30 TR_XM_DK_Bayes1 45448 7.20 0.47 9.39 31 TO_MALFORMED 45437 7.09 0.02 9.38 32 XM_Evil_Numbers_Gen 43052 9.77 12.50 8.89 33 RCVD_IN_RP_CERTIFIED 41980 7.24 2.82 8.67 34 LOTS_OF_MONEY 41593 9.02 10.33 8.59 35 T_XMDrugObfuBody_14 40709 8.10 7.13 8.41 36 TR_XM_DK_Bayes2 39542 6.25 0.33 8.17 37 TooManyTo_001 39429 8.30 8.79 8.14 38 LotsOfNums_01 39108 7.67 6.42 8.08 39 FSL_BULK_SIG 33595 8.54 13.47 6.94 40 HTML_IMAGE_RATIO_02 31642 7.81 11.75 6.54 41 BAYES_60 31434 6.49 6.48 6.49 42 HTML_IMAGE_RATIO_04 30348 6.51 7.26 6.27 43 XM_B_Phish_Phrases 30320 6.32 6.51 6.26 44 XM_H_Long_From01 29364 6.31 7.08 6.06 45 MIME_QP_LONG_LINE 27756 5.09 3.10 5.73 46 TR_DCC_Bayes_99 26720 11.66 30.60 5.52 47 XM_SendGrid 26715 5.21 4.27 5.52 48 RCVD_IN_IADB_LISTED 26626 4.58 1.73 5.50 49 T_TooManySym_01 24952 4.70 3.32 5.15 50 BOTNET_IPINHOSTNAME 24533 8.30 18.28 5.07 51 IN_ZIMBRA_NJ_WHITELIST 24321 3.80 0.03 5.02 52 RCVD_IN_IADB_SPF 23733 4.07 1.48 4.90 53 XMStrtUSub 22267 4.58 4.52 4.60 54 MPART_ALT_DIFF 22158 5.08 6.62 4.58 55 DKIM_INVALID 22093 5.14 6.91 4.56 56 BAYES_80 21759 5.23 7.50 4.49 57 RELAYCOUNTRY_META 21723 8.68 21.62 4.49 58 XMSexyCombo_05 21147 6.22 11.94 4.37 59 XM_PDF 21125 3.50 0.86 4.36 60 RCVD_IN_IADB_SENDERID 21094 3.62 1.36 4.36 61 RCVD_IN_IADB_DK 20986 3.60 1.34 4.33 62 FROM_EXCESS_BASE64 19620 4.12 4.31 4.05 63 T_REMOTE_IMAGE 19538 4.09 4.28 4.04 64 RCVD_IN_MSPIKE_H2 19152 3.67 2.79 3.96 65 XMSubMetaSx_00 17791 4.88 8.58 3.67 66 BAYES_40 17666 3.21 1.87 3.65 67 RCVD_IN_IADB_VOUCHED 15360 2.63 0.96 3.17 68 XM_UncommonTLD01 15348 5.50 12.71 3.17 69 TVD_RCVD_IP 15033 2.53 0.75 3.10 70 UNPARSEABLE_RELAY 14993 2.62 1.14 3.10 71 HTML_IMAGE_RATIO_06 14792 3.65 5.50 3.06 72 BAYES_20 14239 2.57 1.43 2.94 73 TR_XM_DK_SendGrid 14101 2.67 1.91 2.91 74 MIME_HTML_ONLY_MULTI 14033 3.03 3.43 2.90 75 HTML_MIME_NO_HTML_TAG 13064 3.63 6.52 2.70 76 RCVD_IN_MSPIKE_WL 12984 2.16 0.54 2.68 77 RCVD_IN_MSPIKE_H3 12983 2.16 0.54 2.68 78 XMNumbers 12203 3.59 6.87 2.52 79 BAYES_95 11368 2.96 4.86 2.35 80 XM_DIRTYINTL 11367 3.12 5.50 2.35 81 MAILING_LIST_MULTI 10861 2.09 1.60 2.24 82 XM_SPF_SoftFail 10833 2.62 3.79 2.24 83 TooManyTo_002 10781 1.88 0.79 2.23 84 BAYES_05 10209 1.79 0.79 2.11 85 XMDiploma_00 9865 2.43 3.63 2.04 86 RCVD_IN_IADB_OPTIN 9782 1.69 0.68 2.02 87 HELO_NODOT 9594 1.66 0.66 1.98 88 HELO_NO_DOMAIN 9593 1.66 0.66 1.98 89 BOUNCE_MESSAGE 9506 1.61 0.52 1.96 90 ANY_BOUNCE_MESSAGE 9506 1.61 0.52 1.96 91 MIME_HTML_MOSTLY 9320 2.60 4.69 1.92 92 HTML_IMAGE_RATIO_08 9121 2.11 2.82 1.88 93 BOTNET 9085 5.99 18.68 1.88 94 TM2_M_URI_OPT_OUT 8890 2.28 3.66 1.84 95 XM_DK_Undo_01 8851 1.55 0.68 1.83 96 XMStockSpam_06 8186 1.59 1.30 1.69 97 IN_HORDE_ADDRESS_BOOK 8087 1.27 0.03 1.67 98 SUBJ_ALL_CAPS 7790 1.61 1.62 1.61 99 XM_CamelCaseFrm001 7705 2.09 3.62 1.59 100 URI_HEX 7697 1.94 3.01 1.59 101 T_TooManySym_02 7667 1.37 0.72 1.58 102 INVALID_MSGID 7448 1.87 2.89 1.54 103 TR_MetaPhish_Combo_01 7433 1.38 0.90 1.54 104 TR_Symld_Words 7382 1.49 1.39 1.52 105 XM_salutation2 7142 3.00 7.72 1.48 106 TooManyTo_003 7136 1.26 0.62 1.47 107 T_XMDrugObfuBody_08 7033 1.77 2.75 1.45 108 XMGenDplmaNmb 6922 1.52 1.78 1.43 109 XMCapTrack 6810 1.13 0.28 1.41 110 NO_DNS_FOR_FROM 6382 1.49 2.04 1.32 111 RELAYCOUNTRY_CA 6363 1.88 3.62 1.31 112 XM_OfRef6 6117 1.60 2.64 1.26 113 USER_IN_DEF_DKIM_WL 6101 0.96 0.02 1.26 114 XM_GoogleGroups 5616 0.98 0.43 1.16 115 UNTRUSTED_Relay 5531 4.40 14.44 1.14 116 XMPhish11 5277 1.11 1.17 1.09 117 TooManyTo_004 5174 0.93 0.51 1.07 118 TM2_M_VERY_LONG_WORD 5100 1.14 1.41 1.05 119 DKIM_ADSP_CUSTOM_MED 5083 1.00 0.86 1.05 120 URI_TRY_3LD 4993 1.01 0.96 1.03 121 T_FILL_THIS_FORM_SHORT 4755 1.03 1.16 0.98 122 XMSubMetaI_00 4684 1.13 1.62 0.97 123 RELAYCOUNTRY_GB 4649 1.28 2.28 0.96 124 TR_XM_PHPDW 4644 1.44 2.93 0.96 125 TR_XM_PHPForged 4575 1.42 2.89 0.94 126 TR_XM_FormFill2 4556 1.41 2.87 0.94 127 XM_H_PHPOS 4545 1.41 2.86 0.94 128 TR_XM_RelayPhish 4226 1.02 1.47 0.87 129 TooManyTo_005 4192 0.72 0.27 0.87 130 XM_H_Long_From02 4078 1.01 1.52 0.84 131 XMBdyGiftCard01 4055 1.27 2.60 0.84 132 XMSexyCombo_01 3786 1.13 2.20 0.78 133 MISSING_HEADERS 3721 0.74 0.66 0.77 134 SpammyFromTLD_01 3565 1.06 2.05 0.74 135 T_OBFU_PDF_ATTACH 3535 0.61 0.24 0.73 136 LOW_PRICE 3425 0.67 0.57 0.71 137 XM_ProductURIs 3365 0.89 1.48 0.70 138 FILL_THIS_FORM 3292 0.77 1.06 0.68 139 XMSubNoVowel 3212 0.63 0.53 0.66 140 NML_ADSP_CUSTOM_MED 3192 0.70 0.81 0.66 141 XM_UB50 3096 2.59 8.62 0.64 142 XMLngstWrd_00 3083 0.64 0.65 0.64 143 T_Symld_Words_02 3035 0.87 1.63 0.63 144 HTTPS_HTTP_MISMATCH 2955 0.64 0.74 0.61 145 TM2_M_A_HREF_HREF 2948 0.61 0.60 0.61 146 XMLngstWrd_01 2933 0.61 0.63 0.61 147 USER_IN_WHITELIST 2876 0.45 0.00 0.59 148 T_XMDrugObfuBody_00 2823 0.90 1.88 0.58 149 HTML_FONT_FACE_BAD 2717 0.61 0.75 0.56 150 XMMoneyMeta_00 2709 0.83 1.65 0.56 151 XM_RXBody 2700 0.67 1.01 0.56 152 XM_ShortIntro_01 2644 0.51 0.39 0.55 153 FORGED_GMAIL_RCVD 2599 0.58 0.70 0.54 154 AC_DIV_BONANZA 2573 0.43 0.11 0.53 155 XMBody_95 2513 0.42 0.10 0.52 156 XM_H_PHPMailer 2499 0.70 1.28 0.52 157 RCVD_IN_BL_SPAMCOP_NET 2470 1.04 2.69 0.51 158 DKIM_ADSP_NXDOMAIN 2454 1.59 4.92 0.51 159 XM_B_COPY_HTML 2433 0.54 0.65 0.50 160 XMBody_17 2431 0.65 1.11 0.50 161 XMGappySubj_01 2423 0.44 0.25 0.50 162 T_XMHurry_00 2398 0.83 1.86 0.50 163 SHORT_HELO_AND_INLINE_IMAGE 2361 0.38 0.06 0.49 164 FROM_GOV_SPOOF 2343 0.46 0.38 0.48 165 HTML_SHORT_CENTER 2299 0.36 0.01 0.47 166 XMPhish14 2293 0.54 0.74 0.47 167 XMSubMetaSxObfu_02 2286 0.47 0.46 0.47 168 XMBrknScrpt_02 2271 0.50 0.61 0.47 169 XMNoVowels 2213 0.44 0.39 0.46 170 FROM_GOV_DKIM_AU 2206 0.37 0.13 0.46 171 T_TooManySym_03 2163 0.38 0.16 0.45 172 XM_shorewaves_Whitelist 2154 0.34 0.00 0.44 173 XM_USANA_RCVD 2130 0.33 0.00 0.44 174 RELAYCOUNTRY_AU 2125 0.48 0.61 0.44 175 XM_B_REG_HTML 2122 0.59 1.06 0.44 176 HTML_IMAGE_ONLY_32 2120 0.66 1.34 0.44 177 XMSlimDrugH 2080 0.63 1.24 0.43 178 RCVD_IN_SORBS_DUL 2040 0.38 0.26 0.42 179 XMDateMe_00 1982 0.38 0.31 0.41 180 RDNS_DYNAMIC 1962 0.45 0.57 0.41 181 URI_NOVOWEL 1933 0.49 0.78 0.40 182 TM2_M_BODY_EMPTY 1911 0.34 0.18 0.39 183 THIS_AD 1909 0.48 0.73 0.39 184 HTML_IMAGE_ONLY_28 1871 0.66 1.52 0.39 185 XM_URI_RBL 1827 1.01 2.96 0.38 186 XMPhish30 1824 0.58 1.21 0.38 187 XMBody_78 1818 0.68 1.60 0.38 188 XMHTML_After_End 1752 0.74 1.91 0.36 189 XMSubMetaSxObfu_03 1745 0.87 2.43 0.36 190 NUMERIC_HTTP_ADDR 1744 1.11 3.44 0.36 191 HTML_TAG_BALANCE_BODY 1694 0.80 2.19 0.35 192 PLING_QUERY 1643 0.48 0.90 0.34 193 REPLYTO_WITHOUT_TO_CC 1619 0.45 0.80 0.33 194 SpammyFromTLD_02 1590 1.38 4.64 0.33 195 RELAYCOUNTRY_DE 1580 0.90 2.66 0.33 196 T_MONEY_PERCENT 1572 0.53 1.17 0.32 197 TR_LOTS_OF_MONEY2 1572 0.53 1.17 0.32 198 XMSexyCombo_04 1563 0.51 1.09 0.32 199 XMHTMLBadTable_001 1552 0.49 1.00 0.32 200 HTML_IMAGE_ONLY_24 1523 0.46 0.90 0.31 ----------------------------------------------------------------------