Email: 629546 Autolearn: 0 AvgScore: 2.53 AvgScanTime: 1.96 sec Spam: 160743 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 2.32 sec Ham: 468803 Autolearn: 0 AvgScore: -0.79 AvgScanTime: 1.83 sec Time Spent Running SA: 341.98 hours Time Spent Processing Spam: 103.75 hours Time Spent Processing Ham: 238.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153165 89.26 95.29 87.19 2 DKIM_SIGNED 130043 75.26 80.90 73.32 3 DCC_CHECK 126753 48.86 78.85 38.58 4 XM_DK_Pass 126386 73.81 78.63 72.15 5 XMListUnsubscribeExists 123862 56.67 77.06 49.68 6 DKIM_VALID 120188 70.22 74.77 68.66 7 DKIM_VALID_AU 96229 52.19 59.87 49.56 8 XM_H_QuotedFrom 84785 42.69 52.75 39.24 9 XM_DK_Undo_02 73209 22.20 45.54 14.19 10 BAYES_99 64863 19.59 40.35 12.48 11 HTML_FONT_LOW_CONTRAST 59710 30.50 37.15 28.22 12 BAYES_50 56988 48.23 35.45 52.61 13 LOC_TINY_FONT_1 56420 24.91 35.10 21.41 14 BAYES_999 53804 16.77 33.47 11.04 15 TR_DCC_Bayes_99 51364 12.52 31.95 5.86 16 MIME_HTML_ONLY 47861 23.72 29.77 21.65 17 FVGT_m_MULTI_ODD 43724 22.47 27.20 20.85 18 XMSubLong 38467 22.19 23.93 21.59 19 DKIM_VALID_EF 35421 25.62 22.04 26.85 20 XM_Body_Dirty_Words 34329 15.16 21.36 13.04 21 T_KAM_HTML_FONT_INVALID 32762 17.76 20.38 16.86 22 T_TM2_M_HEADER_IN_MSG 31812 27.67 19.79 30.37 23 DCC_CHECK_NEGATIVE 30657 49.13 19.07 59.44 24 RELAYCOUNTRY_META 28172 7.93 17.53 4.64 25 BOTNET_IPINHOSTNAME 26774 8.13 16.66 5.21 26 XM_Multi_Part_URI 25244 12.57 15.70 11.50 27 BOTNET 24862 5.28 15.47 1.79 28 HTML_IMAGE_RATIO_02 23495 8.96 14.62 7.02 29 MultiRelay 22934 17.30 14.27 18.33 30 XM_Evil_Numbers_Gen 20350 9.57 12.66 8.51 31 LOTS_OF_MONEY 19940 9.69 12.40 8.76 32 XMSexyCombo_05 17578 5.84 10.94 4.09 33 XM_UncommonTLD01 17461 5.12 10.86 3.16 34 FSL_BULK_SIG 17423 7.76 10.84 6.70 35 T_XMDrugObfuBody_14 16169 8.55 10.06 8.04 36 UNTRUSTED_Relay 16121 3.40 10.03 1.13 37 XMSubMetaSx_00 13920 4.99 8.66 3.73 38 HTML_IMAGE_RATIO_04 13546 6.45 8.43 5.77 39 TooManyTo_001 13359 8.43 8.31 8.47 40 XM_H_Long_From01 12623 6.48 7.85 6.01 41 BAYES_80 12483 5.07 7.77 4.15 42 XM_B_Phish_Phrases 12266 6.09 7.63 5.56 43 SpammyFromTLD_02 11508 2.05 7.16 0.30 44 BAYES_60 11006 6.59 6.85 6.51 45 LotsOfNums_01 10951 8.33 6.81 8.86 46 MPART_ALT_DIFF 10922 4.31 6.79 3.46 47 DKIM_INVALID 9855 5.04 6.13 4.67 48 HTML_IMAGE_RATIO_06 9780 4.21 6.08 3.57 49 XM_DIRTYINTL 8751 3.08 5.44 2.28 50 XM_UB50 8318 1.86 5.17 0.72 51 FROM_EXCESS_BASE64 7989 4.72 4.97 4.63 52 BAYES_95 7763 3.14 4.83 2.56 53 XMNumbers 7586 4.07 4.72 3.84 54 XM_SPF_SoftFail 7234 2.67 4.50 2.05 55 MIME_HTML_MOSTLY 7213 2.64 4.49 2.00 56 RELAYCOUNTRY_CA 6700 2.08 4.17 1.37 57 XMStrtUSub 6492 4.66 4.04 4.87 58 HTML_MIME_NO_HTML_TAG 6389 2.59 3.97 2.11 59 TM2_M_URI_OPT_OUT 6015 2.07 3.74 1.50 60 RCVD_IN_RP_SAFE 5905 8.60 3.67 10.29 61 XM_CamelCaseFrm001 5672 2.37 3.53 1.97 62 MIME_HTML_ONLY_MULTI 5634 2.41 3.50 2.04 63 XM_SendGrid 5557 5.38 3.46 6.04 64 T_REMOTE_IMAGE 5423 4.08 3.37 4.32 65 MIME_QP_LONG_LINE 5307 5.54 3.30 6.31 66 HTML_IMAGE_RATIO_08 5214 2.90 3.24 2.78 67 URI_HEX 5097 1.91 3.17 1.48 68 XM_URI_RBL 4918 1.10 3.06 0.42 69 RCVD_IN_RP_CERTIFIED 4675 7.71 2.91 9.35 70 RCVD_IN_MSPIKE_H2 4263 3.92 2.65 4.35 71 XMBody_78 4107 0.97 2.56 0.42 72 XMBdyGiftCard01 4039 1.14 2.51 0.66 73 RELAYCOUNTRY_FR 3915 0.77 2.44 0.20 74 DKIM_ADSP_NXDOMAIN 3880 0.90 2.41 0.38 75 T_TooManySym_01 3865 4.48 2.40 5.20 76 RCVD_IN_RP_RNBL 3814 0.64 2.37 0.04 77 XM_OfRef6 3777 1.72 2.35 1.51 78 RCVD_IN_BL_SPAMCOP_NET 3712 1.12 2.31 0.71 79 RCVD_IN_IADB_LISTED 3630 5.07 2.26 6.04 80 T_XMDrugObfuBody_08 3575 1.82 2.22 1.69 81 RELAYCOUNTRY_GB 3561 1.32 2.22 1.01 82 XMDiploma_00 3471 2.65 2.16 2.82 83 XMSexyCombo_01 3452 0.94 2.15 0.52 84 SUBJ_ALL_CAPS 3421 1.93 2.13 1.87 85 TR_XM_PHPDW 3381 1.13 2.10 0.80 86 TR_XM_PHPForged 3334 1.11 2.07 0.78 87 BOTNET_NORDNS 3323 0.54 2.07 0.02 88 TR_XM_FormFill2 3311 1.11 2.06 0.78 89 XM_H_PHPOS 3296 1.10 2.05 0.78 90 HTML_IMAGE_ONLY_32 3270 0.82 2.03 0.40 91 T_MONEY_PERCENT 3202 0.79 1.99 0.38 92 TR_LOTS_OF_MONEY2 3202 0.79 1.99 0.38 93 ALL_TRUSTED 3127 13.99 1.95 18.12 94 MultiRelay_Combo 3102 0.60 1.93 0.14 95 MultiRelay_CC 3102 0.60 1.93 0.14 96 XMSubMetaSxObfu_03 3093 0.80 1.92 0.41 97 RCVD_IN_IADB_SPF 3054 4.48 1.90 5.37 98 XM_H_Long_From02 2990 1.53 1.86 1.41 99 TM2_M_VERY_LONG_WORD 2977 1.26 1.85 1.05 100 INVALID_MSGID 2952 1.66 1.84 1.60 101 NO_DNS_FOR_FROM 2899 1.26 1.80 1.08 102 MAILING_LIST_MULTI 2888 2.22 1.80 2.37 103 XMPhish11 2811 1.34 1.75 1.20 104 RCVD_IN_IADB_SENDERID 2806 3.99 1.75 4.76 105 BAYES_40 2804 3.36 1.74 3.91 106 FROM_SUSPICIOUS_NTLD 2799 0.57 1.74 0.17 107 RCVD_IN_IADB_DK 2770 3.94 1.72 4.70 108 XM_UB99 2698 0.45 1.68 0.02 109 XMSubMetaI_00 2593 0.83 1.61 0.56 110 RCVD_IN_PSBL 2590 0.43 1.61 0.02 111 DATE_IN_PAST_06_12 2417 0.41 1.50 0.04 112 TR_XM_DK_SendGrid 2392 2.58 1.49 2.95 113 TR_XM_RelayPhish 2368 1.01 1.47 0.85 114 TR_LOTS_OF_MONEY3 2326 0.62 1.45 0.34 115 XMHTMLBadTable_001 2287 0.72 1.42 0.48 116 XM_S_JOY_D 2252 0.73 1.40 0.50 117 T_XMHurry_00 2238 0.91 1.39 0.75 118 XM_ProductURIs 2220 1.13 1.38 1.05 119 XMGenDplmaNmb 2194 1.76 1.36 1.90 120 DKIM_ADSP_CUSTOM_MED 2182 1.13 1.36 1.06 121 RDNS_DYNAMIC 2160 0.62 1.34 0.38 122 XMStockSpam_06 2144 1.24 1.33 1.20 123 XMBody_17 2139 0.83 1.33 0.65 124 NML_ADSP_CUSTOM_MED 2130 0.86 1.33 0.71 125 RCVD_IN_IADB_VOUCHED 2111 3.07 1.31 3.68 126 XM_UB999 2106 0.35 1.31 0.02 127 UNPARSEABLE_RELAY 2076 2.74 1.29 3.24 128 XM_Dr_From 2065 0.41 1.28 0.11 129 XMPhish30 2064 0.69 1.28 0.49 130 SpammyFromTLD_01 2059 0.84 1.28 0.68 131 XM_UB60 2055 0.39 1.28 0.09 132 BAYES_20 2033 2.48 1.26 2.89 133 DIET_1 1972 0.52 1.23 0.28 134 FORGED_GMAIL_RCVD 1955 0.68 1.22 0.50 135 TR_MetaPhish_Combo_01 1947 1.44 1.21 1.52 136 XM_diabetes 1898 0.31 1.18 0.01 137 URI_TRY_3LD 1876 1.56 1.17 1.70 138 REPLYTO_WITHOUT_TO_CC 1861 0.38 1.16 0.11 139 FILL_THIS_FORM 1858 0.57 1.16 0.36 140 MISSING_HEADERS 1846 0.66 1.15 0.50 141 MPART_ALT_DIFF_COUNT 1842 0.46 1.15 0.22 142 XM_H_PHPMailer 1812 0.66 1.13 0.50 143 XM_H_TOP 1785 0.29 1.11 0.00 144 TR_Symld_Words 1767 1.39 1.10 1.49 145 FILL_THIS_FORM_LONG 1766 0.50 1.10 0.29 146 T_Symld_Words_02 1743 0.73 1.08 0.61 147 T_XMDrugObfuBody_00 1704 0.87 1.06 0.80 148 XM_DK_Undo_01 1667 1.62 1.04 1.82 149 URIBL_BLACK 1649 0.30 1.03 0.05 150 XMHTML_After_End 1633 0.55 1.02 0.39 151 NORDNS_LOW_CONTRAST 1630 0.26 1.01 0.01 152 XMSlimDrugH 1623 0.51 1.01 0.34 153 THIS_AD 1591 0.45 0.99 0.26 154 HTML_FONT_FACE_BAD 1504 0.64 0.94 0.54 155 PLING_QUERY 1495 0.66 0.93 0.56 156 URIBL_DBL_SPAM 1493 0.25 0.93 0.02 157 XMBrknScrpt_02 1480 0.88 0.92 0.87 158 XM_B_REG_HTML 1442 0.75 0.90 0.70 159 MONEY_FRAUD_8 1425 0.23 0.89 0.00 160 TR_Sbj_FN_Bdy 1425 0.37 0.89 0.19 161 REMOVE_BEFORE_LINK 1424 0.48 0.89 0.34 162 SUBJ_DOLLARS 1419 0.60 0.88 0.50 163 RCVD_IN_IADB_OPTIN 1412 2.00 0.88 2.38 164 XM_HighProb1 1410 0.23 0.88 0.01 165 T_FILL_THIS_FORM_SHORT 1390 1.09 0.86 1.16 166 TR_LOTS_OF_MONEY1 1386 0.24 0.86 0.03 167 HTTPS_HTTP_MISMATCH 1380 0.66 0.86 0.60 168 BODY_ENHANCEMENT 1372 0.24 0.85 0.02 169 XMSexyCombo_04 1364 0.34 0.85 0.16 170 HTML_TAG_BALANCE_BODY 1331 0.64 0.83 0.57 171 RELAYCOUNTRY_DE 1320 0.46 0.82 0.33 172 ADVANCE_FEE_4_NEW_MONEY 1314 0.21 0.82 0.00 173 HTML_IMAGE_ONLY_16 1311 0.40 0.82 0.26 174 HK_RANDOM_REPLYTO 1286 0.36 0.80 0.22 175 FILL_THIS_FORM_LOAN 1281 0.42 0.80 0.29 176 RELAYCOUNTRY_AT 1277 0.30 0.79 0.13 177 HTML_IMAGE_ONLY_24 1257 0.44 0.78 0.33 178 XM_H_PHPOS_M 1242 0.35 0.77 0.21 179 DATE_IN_PAST_03_06 1239 0.28 0.77 0.11 180 BAYES_05 1237 1.60 0.77 1.88 181 NUMERIC_HTTP_ADDR 1233 0.40 0.77 0.28 182 XM_UB80 1221 0.21 0.76 0.03 183 XMSubMetaSSx_00 1197 0.31 0.74 0.16 184 URI_NOVOWEL 1195 0.62 0.74 0.58 185 TR_Mismatch_TLD_02 1190 0.24 0.74 0.07 186 RELAYCOUNTRY_AU 1190 0.54 0.74 0.48 187 RELAYCOUNTRY_CH 1186 0.22 0.74 0.04 188 BAYES_00 1166 9.62 0.73 12.67 189 URIBL_SBL_A 1161 0.22 0.72 0.05 190 XM_PDF 1158 3.98 0.72 5.10 191 XM_Combo_Sbj 1141 0.36 0.71 0.25 192 TooManyTo_002 1137 2.03 0.71 2.48 193 RELAYCOUNTRY_CN 1127 0.22 0.70 0.05 194 RELAYCOUNTRY_IN 1113 0.25 0.69 0.10 195 SHORT_URI_3 1101 0.28 0.68 0.15 196 T_TooManySym_02 1085 1.40 0.67 1.65 197 XMPhish14 1074 0.49 0.67 0.42 198 XMMoneyMeta_00 1071 0.56 0.67 0.52 199 LONG_JUNK_URI 1070 0.21 0.67 0.05 200 LONG_HEX_URI 1042 0.26 0.65 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 408741 89.26 95.29 87.19 2 DKIM_SIGNED 343745 75.26 80.90 73.32 3 XM_DK_Pass 338258 73.81 78.63 72.15 4 DKIM_VALID 321869 70.22 74.77 68.66 5 DCC_CHECK_NEGATIVE 278644 49.13 19.07 59.44 6 BAYES_50 246648 48.23 35.45 52.61 7 XMListUnsubscribeExists 232883 56.67 77.06 49.68 8 DKIM_VALID_AU 232317 52.19 59.87 49.56 9 XM_H_QuotedFrom 183975 42.69 52.75 39.24 10 DCC_CHECK 180869 48.86 78.85 38.58 11 T_TM2_M_HEADER_IN_MSG 142389 27.67 19.79 30.37 12 HTML_FONT_LOW_CONTRAST 132300 30.50 37.15 28.22 13 DKIM_VALID_EF 125859 25.62 22.04 26.85 14 MIME_HTML_ONLY 101474 23.72 29.77 21.65 15 XMSubLong 101207 22.19 23.93 21.59 16 LOC_TINY_FONT_1 100370 24.91 35.10 21.41 17 FVGT_m_MULTI_ODD 97740 22.47 27.20 20.85 18 MultiRelay 85952 17.30 14.27 18.33 19 ALL_TRUSTED 84935 13.99 1.95 18.12 20 T_KAM_HTML_FONT_INVALID 79033 17.76 20.38 16.86 21 XM_DK_Undo_02 66544 22.20 45.54 14.19 22 XM_Body_Dirty_Words 61128 15.16 21.36 13.04 23 XM_DKIMWhitelistDomains 60961 9.69 0.02 13.00 24 BAYES_00 59401 9.62 0.73 12.67 25 BAYES_99 58490 19.59 40.35 12.48 26 XM_Multi_Part_URI 53902 12.57 15.70 11.50 27 BAYES_999 51754 16.77 33.47 11.04 28 RCVD_IN_RP_SAFE 48248 8.60 3.67 10.29 29 TR_XM_DK_Bayes 47492 7.67 0.51 10.13 30 TR_XM_DK_Bayes1 45231 7.30 0.45 9.65 31 RCVD_IN_RP_CERTIFIED 43838 7.71 2.91 9.35 32 LotsOfNums_01 41518 8.33 6.81 8.86 33 LOTS_OF_MONEY 41054 9.69 12.40 8.76 34 XM_Evil_Numbers_Gen 39897 9.57 12.66 8.51 35 TooManyTo_001 39719 8.43 8.31 8.47 36 TR_XM_DK_Bayes2 39631 6.39 0.35 8.45 37 T_XMDrugObfuBody_14 37686 8.55 10.06 8.04 38 HTML_IMAGE_RATIO_02 32899 8.96 14.62 7.02 39 FSL_BULK_SIG 31404 7.76 10.84 6.70 40 BAYES_60 30503 6.59 6.85 6.51 41 MIME_QP_LONG_LINE 29565 5.54 3.30 6.31 42 XM_SendGrid 28319 5.38 3.46 6.04 43 RCVD_IN_IADB_LISTED 28302 5.07 2.26 6.04 44 XM_H_Long_From01 28161 6.48 7.85 6.01 45 TR_DCC_Bayes_99 27462 12.52 31.95 5.86 46 HTML_IMAGE_RATIO_04 27041 6.45 8.43 5.77 47 XM_B_Phish_Phrases 26055 6.09 7.63 5.56 48 RCVD_IN_IADB_SPF 25171 4.48 1.90 5.37 49 BOTNET_IPINHOSTNAME 24412 8.13 16.66 5.21 50 T_TooManySym_01 24369 4.48 2.40 5.20 51 XM_PDF 23913 3.98 0.72 5.10 52 XMStrtUSub 22852 4.66 4.04 4.87 53 RCVD_IN_IADB_SENDERID 22333 3.99 1.75 4.76 54 RCVD_IN_IADB_DK 22024 3.94 1.72 4.70 55 DKIM_INVALID 21876 5.04 6.13 4.67 56 RELAYCOUNTRY_META 21762 7.93 17.53 4.64 57 FROM_EXCESS_BASE64 21699 4.72 4.97 4.63 58 RCVD_IN_MSPIKE_H2 20386 3.92 2.65 4.35 59 T_REMOTE_IMAGE 20275 4.08 3.37 4.32 60 IN_ZIMBRA_NJ_WHITELIST 19801 3.15 0.02 4.22 61 BAYES_80 19435 5.07 7.77 4.15 62 XMSexyCombo_05 19180 5.84 10.94 4.09 63 BAYES_40 18338 3.36 1.74 3.91 64 XMNumbers 18006 4.07 4.72 3.84 65 XMSubMetaSx_00 17502 4.99 8.66 3.73 66 RCVD_IN_IADB_VOUCHED 17245 3.07 1.31 3.68 67 HTML_IMAGE_RATIO_06 16744 4.21 6.08 3.57 68 MPART_ALT_DIFF 16209 4.31 6.79 3.46 69 UNPARSEABLE_RELAY 15166 2.74 1.29 3.24 70 XM_UncommonTLD01 14799 5.12 10.86 3.16 71 TVD_RCVD_IP 14060 2.31 0.31 3.00 72 TR_XM_DK_SendGrid 13852 2.58 1.49 2.95 73 RCVD_IN_MSPIKE_WL 13612 2.29 0.49 2.90 74 RCVD_IN_MSPIKE_H3 13604 2.29 0.49 2.90 75 BAYES_20 13570 2.48 1.26 2.89 76 TO_MALFORMED 13359 2.14 0.07 2.85 77 XMDiploma_00 13199 2.65 2.16 2.82 78 HTML_IMAGE_RATIO_08 13040 2.90 3.24 2.78 79 BAYES_95 12018 3.14 4.83 2.56 80 TooManyTo_002 11639 2.03 0.71 2.48 81 RCVD_IN_IADB_OPTIN 11173 2.00 0.88 2.38 82 MAILING_LIST_MULTI 11096 2.22 1.80 2.37 83 XM_DIRTYINTL 10667 3.08 5.44 2.28 84 HTML_MIME_NO_HTML_TAG 9901 2.59 3.97 2.11 85 XM_SPF_SoftFail 9605 2.67 4.50 2.05 86 MIME_HTML_ONLY_MULTI 9546 2.41 3.50 2.04 87 MIME_HTML_MOSTLY 9377 2.64 4.49 2.00 88 XM_CamelCaseFrm001 9252 2.37 3.53 1.97 89 ANY_BOUNCE_MESSAGE 9129 1.56 0.44 1.95 90 BOUNCE_MESSAGE 9128 1.56 0.44 1.95 91 XMGenDplmaNmb 8912 1.76 1.36 1.90 92 BAYES_05 8833 1.60 0.77 1.88 93 SUBJ_ALL_CAPS 8753 1.93 2.13 1.87 94 XM_DK_Undo_01 8532 1.62 1.04 1.82 95 BOTNET 8386 5.28 15.47 1.79 96 XMBody_95 8154 1.33 0.14 1.74 97 IN_HORDE_ADDRESS_BOOK 8071 1.29 0.03 1.72 98 URI_TRY_3LD 7951 1.56 1.17 1.70 99 T_XMDrugObfuBody_08 7901 1.82 2.22 1.69 100 T_TooManySym_02 7732 1.40 0.67 1.65 101 TooManyTo_003 7668 1.35 0.52 1.64 102 INVALID_MSGID 7512 1.66 1.84 1.60 103 HELO_NODOT 7443 1.32 0.53 1.59 104 HELO_NO_DOMAIN 7438 1.32 0.53 1.59 105 TR_MetaPhish_Combo_01 7119 1.44 1.21 1.52 106 XM_OfRef6 7077 1.72 2.35 1.51 107 TM2_M_URI_OPT_OUT 7021 2.07 3.74 1.50 108 TR_Symld_Words 6973 1.39 1.10 1.49 109 URI_HEX 6940 1.91 3.17 1.48 110 XM_H_Long_From02 6630 1.53 1.86 1.41 111 RELAYCOUNTRY_CA 6418 2.08 4.17 1.37 112 XMCapTrack 6293 1.06 0.25 1.34 113 T_OBFU_PDF_ATTACH 5902 1.00 0.24 1.26 114 USER_IN_DEF_DKIM_WL 5831 0.93 0.01 1.24 115 XM_GoogleGroups 5827 1.04 0.43 1.24 116 XMStockSpam_06 5646 1.24 1.33 1.20 117 XMPhish11 5624 1.34 1.75 1.20 118 TooManyTo_004 5600 1.00 0.42 1.19 119 T_FILL_THIS_FORM_SHORT 5461 1.09 0.86 1.16 120 UNTRUSTED_Relay 5291 3.40 10.03 1.13 121 NO_DNS_FOR_FROM 5046 1.26 1.80 1.08 122 DKIM_ADSP_CUSTOM_MED 4950 1.13 1.36 1.06 123 TM2_M_VERY_LONG_WORD 4943 1.26 1.85 1.05 124 XM_ProductURIs 4899 1.13 1.38 1.05 125 RELAYCOUNTRY_GB 4738 1.32 2.22 1.01 126 TooManyTo_005 4472 0.79 0.29 0.95 127 XMSubNoVowel 4231 0.80 0.50 0.90 128 XMGappySubj_01 4202 0.73 0.25 0.90 129 XMBrknScrpt_02 4066 0.88 0.92 0.87 130 TR_XM_RelayPhish 3963 1.01 1.47 0.85 131 T_XMDrugObfuBody_00 3764 0.87 1.06 0.80 132 TR_XM_PHPDW 3762 1.13 2.10 0.80 133 TR_XM_PHPForged 3673 1.11 2.07 0.78 134 TR_XM_FormFill2 3663 1.11 2.06 0.78 135 XM_H_PHPOS 3658 1.10 2.05 0.78 136 XM_B_COPY_HTML 3638 0.74 0.63 0.78 137 TM2_M_A_HREF_HREF 3538 0.71 0.57 0.75 138 T_XMHurry_00 3520 0.91 1.39 0.75 139 XM_UB50 3384 1.86 5.17 0.72 140 RCVD_IN_BL_SPAMCOP_NET 3340 1.12 2.31 0.71 141 NML_ADSP_CUSTOM_MED 3310 0.86 1.33 0.71 142 XM_B_REG_HTML 3261 0.75 0.90 0.70 143 XMLngstWrd_00 3224 0.65 0.55 0.69 144 SpammyFromTLD_01 3203 0.84 1.28 0.68 145 XMBdyGiftCard01 3116 1.14 2.51 0.66 146 XMBody_17 3058 0.83 1.33 0.65 147 XMLngstWrd_01 2947 0.60 0.50 0.63 148 T_Symld_Words_02 2865 0.73 1.08 0.61 149 USER_IN_WHITELIST 2824 0.45 0.00 0.60 150 HTTPS_HTTP_MISMATCH 2790 0.66 0.86 0.60 151 URI_NOVOWEL 2723 0.62 0.74 0.58 152 HTML_TAG_BALANCE_BODY 2691 0.64 0.83 0.57 153 PLING_QUERY 2633 0.66 0.93 0.56 154 XMSubMetaI_00 2606 0.83 1.61 0.56 155 XMNoVowels 2549 0.50 0.39 0.54 156 HTML_FONT_FACE_BAD 2532 0.64 0.94 0.54 157 XMGappySubj_02 2529 0.42 0.08 0.54 158 XM_ShortIntro_01 2493 0.50 0.40 0.53 159 T_TooManySym_03 2477 0.42 0.12 0.53 160 XMSexyCombo_01 2455 0.94 2.15 0.52 161 XMMoneyMeta_00 2436 0.56 0.67 0.52 162 XM_RXBody 2414 0.53 0.57 0.51 163 FROM_GOV_SPOOF 2404 0.43 0.17 0.51 164 SUBJ_DOLLARS 2363 0.60 0.88 0.50 165 XM_H_PHPMailer 2356 0.66 1.13 0.50 166 MISSING_HEADERS 2334 0.66 1.15 0.50 167 XM_S_JOY_D 2331 0.73 1.40 0.50 168 FORGED_GMAIL_RCVD 2331 0.68 1.22 0.50 169 XMPhish30 2303 0.69 1.28 0.49 170 RELAYCOUNTRY_AU 2233 0.54 0.74 0.48 171 XMHTMLBadTable_001 2232 0.72 1.42 0.48 172 SHORT_HELO_AND_INLINE_IMAGE 2214 0.36 0.04 0.47 173 XMSubMetaSxObfu_02 2083 0.42 0.36 0.44 174 TM2_M_BODY_EMPTY 2057 0.37 0.18 0.44 175 XMPhish14 1984 0.49 0.67 0.42 176 XM_URI_RBL 1984 1.10 3.06 0.42 177 XMBody_78 1971 0.97 2.56 0.42 178 XMDateMe_00 1964 0.39 0.32 0.42 179 XMSubMetaSxObfu_03 1928 0.80 1.92 0.41 180 HTML_IMAGE_ONLY_32 1886 0.82 2.03 0.40 181 XMLngstWrd_02 1878 0.40 0.38 0.40 182 FROM_GOV_DKIM_AU 1861 0.33 0.12 0.40 183 XMHTML_After_End 1848 0.55 1.02 0.39 184 FSL_THIS_IS_ADV 1802 0.38 0.38 0.38 185 T_MONEY_PERCENT 1774 0.79 1.99 0.38 186 TR_LOTS_OF_MONEY2 1774 0.79 1.99 0.38 187 DKIM_ADSP_NXDOMAIN 1774 0.90 2.41 0.38 188 RDNS_DYNAMIC 1761 0.62 1.34 0.38 189 AC_DIV_BONANZA 1749 0.30 0.09 0.37 190 XM_Body_Obfu01 1730 0.39 0.47 0.37 191 RCVD_IN_SORBS_DUL 1719 0.34 0.27 0.37 192 FILL_THIS_FORM 1708 0.57 1.16 0.36 193 HTML_IMAGE_ONLY_28 1654 0.41 0.59 0.35 194 XMSlimDrugH 1600 0.51 1.01 0.34 195 REMOVE_BEFORE_LINK 1580 0.48 0.89 0.34 196 TR_LOTS_OF_MONEY3 1571 0.62 1.45 0.34 197 RELAYCOUNTRY_DE 1570 0.46 0.82 0.33 198 HTML_IMAGE_ONLY_24 1528 0.44 0.78 0.33 199 XM_B_TRADE_HTML 1460 0.30 0.27 0.31 200 SpammyFromTLD_02 1405 2.05 7.16 0.30 ----------------------------------------------------------------------