Email: 617669 Autolearn: 0 AvgScore: 2.41 AvgScanTime: 2.01 sec Spam: 151874 Autolearn: 0 AvgScore: 12.14 AvgScanTime: 2.40 sec Ham: 465795 Autolearn: 0 AvgScore: -0.77 AvgScanTime: 1.89 sec Time Spent Running SA: 345.61 hours Time Spent Processing Spam: 101.35 hours Time Spent Processing Ham: 244.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145292 89.90 95.67 88.03 2 DKIM_SIGNED 127381 78.02 83.87 76.11 3 XM_DK_Pass 120444 75.82 79.31 74.68 4 DCC_CHECK 119640 49.83 78.78 40.39 5 XMListUnsubscribeExists 119392 58.87 78.61 52.43 6 DKIM_VALID 114151 71.95 75.16 70.90 7 DKIM_VALID_AU 90708 52.83 59.73 50.58 8 XM_H_QuotedFrom 73491 39.12 48.39 36.10 9 XM_DK_Undo_02 71885 22.46 47.33 14.35 10 BAYES_99 62036 19.35 40.85 12.34 11 HTML_FONT_LOW_CONTRAST 55293 30.49 36.41 28.56 12 LOC_TINY_FONT_1 55098 25.93 36.28 22.55 13 BAYES_999 52062 16.70 34.28 10.97 14 BAYES_50 50650 47.28 33.35 51.83 15 TR_DCC_Bayes_99 49028 12.42 32.28 5.95 16 MIME_HTML_ONLY 47019 22.82 30.96 20.17 17 FVGT_m_MULTI_ODD 44692 23.53 29.43 21.61 18 XMSubLong 37754 23.21 24.86 22.67 19 T_KAM_HTML_FONT_INVALID 35470 19.80 23.35 18.64 20 XM_Body_Dirty_Words 33362 15.63 21.97 13.57 21 DKIM_VALID_EF 32622 26.41 21.48 28.02 22 T_TM2_M_HEADER_IN_MSG 30986 28.45 20.40 31.08 23 DCC_CHECK_NEGATIVE 29299 48.11 19.29 57.50 24 BOTNET_IPINHOSTNAME 29262 9.01 19.27 5.66 25 RELAYCOUNTRY_META 28092 8.49 18.50 5.22 26 BOTNET 26655 5.86 17.55 2.05 27 MultiRelay 26518 18.49 17.46 18.83 28 XM_Multi_Part_URI 24241 12.68 15.96 11.61 29 HTML_IMAGE_RATIO_02 22989 10.02 15.14 8.36 30 XM_Evil_Numbers_Gen 20936 9.82 13.79 8.53 31 LOTS_OF_MONEY 19064 10.32 12.55 9.59 32 UNTRUSTED_Relay 16642 3.77 10.96 1.43 33 XMSexyCombo_05 16186 5.37 10.66 3.65 34 T_XMDrugObfuBody_14 14513 8.58 9.56 8.26 35 MPART_ALT_DIFF 14062 4.89 9.26 3.46 36 DKIM_INVALID 13230 6.07 8.71 5.20 37 FSL_BULK_SIG 13204 6.99 8.69 6.43 38 XM_B_Phish_Phrases 12999 6.65 8.56 6.03 39 XM_UncommonTLD01 12952 4.67 8.53 3.41 40 BAYES_80 12496 5.00 8.23 3.94 41 TooManyTo_001 11495 7.82 7.57 7.90 42 XMSubMetaSx_00 11188 4.87 7.37 4.05 43 LotsOfNums_01 11134 8.49 7.33 8.87 44 XM_H_Long_From01 10871 6.64 7.16 6.47 45 HTML_IMAGE_RATIO_04 10109 5.74 6.66 5.45 46 BAYES_60 9540 6.36 6.28 6.39 47 MIME_HTML_MOSTLY 8577 3.26 5.65 2.48 48 HTML_IMAGE_RATIO_06 8442 4.21 5.56 3.76 49 XM_DIRTYINTL 8156 3.02 5.37 2.26 50 XM_UB50 7952 1.86 5.24 0.76 51 XMNumbers 7236 3.10 4.76 2.55 52 T_REMOTE_IMAGE 7174 4.43 4.72 4.34 53 BAYES_95 6787 3.05 4.47 2.58 54 XMDiploma_00 6719 2.64 4.42 2.06 55 MIME_HTML_ONLY_MULTI 6603 2.39 4.35 1.75 56 XMStrtUSub 6521 4.07 4.29 4.00 57 FROM_EXCESS_BASE64 6308 4.62 4.15 4.77 58 RELAYCOUNTRY_CA 6290 2.10 4.14 1.44 59 RCVD_IN_RP_SAFE 6188 8.50 4.07 9.94 60 RCVD_IN_BL_SPAMCOP_NET 5923 1.65 3.90 0.92 61 XM_SendGrid 5806 5.76 3.82 6.39 62 FROM_SUSPICIOUS_NTLD 5763 1.05 3.79 0.15 63 HTML_MIME_NO_HTML_TAG 5755 2.76 3.79 2.43 64 XM_SPF_SoftFail 5677 2.41 3.74 1.98 65 MultiRelay_Combo 5613 1.04 3.70 0.17 66 MultiRelay_CC 5613 1.04 3.70 0.17 67 TM2_M_URI_OPT_OUT 5498 2.27 3.62 1.82 68 XM_CamelCaseFrm001 5304 2.37 3.49 2.01 69 XMGenDplmaNmb 5174 1.88 3.41 1.38 70 MIME_QP_LONG_LINE 5024 5.51 3.31 6.23 71 URI_HEX 4994 2.07 3.29 1.67 72 RCVD_IN_RP_CERTIFIED 4866 7.57 3.20 9.00 73 XM_OfRef6 4639 2.02 3.05 1.68 74 TM2_M_VERY_LONG_WORD 4448 1.53 2.93 1.07 75 XMBdyGiftCard01 4355 1.15 2.87 0.59 76 RELAYCOUNTRY_DE 4349 1.07 2.86 0.48 77 HTML_IMAGE_RATIO_08 4291 2.71 2.83 2.67 78 XM_URI_RBL 4284 1.09 2.82 0.53 79 RELAYCOUNTRY_FR 4277 0.86 2.82 0.22 80 TR_XM_RelayPhish 4233 1.30 2.79 0.82 81 XMPhish11 4175 1.59 2.75 1.21 82 DKIM_ADSP_NXDOMAIN 4085 1.12 2.69 0.61 83 T_TooManySym_01 4033 4.93 2.66 5.67 84 T_XMDrugObfuBody_08 4008 1.81 2.64 1.54 85 RCVD_IN_MSPIKE_H2 3898 4.13 2.57 4.64 86 RCVD_IN_RP_RNBL 3788 0.64 2.49 0.03 87 UNPARSEABLE_RELAY 3765 3.07 2.48 3.27 88 XMSexyCombo_01 3757 1.03 2.47 0.56 89 RCVD_IN_IADB_LISTED 3570 5.21 2.35 6.14 90 BAYES_20 3533 2.88 2.33 3.05 91 BAYES_40 3380 3.67 2.23 4.15 92 T_XMDrugObfuBody_00 3368 1.23 2.22 0.91 93 XMSubMetaI_00 3304 1.07 2.18 0.71 94 TR_XM_PHPDW 3165 1.00 2.08 0.65 95 XMBody_78 3157 0.91 2.08 0.52 96 TR_XM_PHPForged 3132 0.99 2.06 0.64 97 MAILING_LIST_MULTI 3119 2.25 2.05 2.32 98 SpammyFromTLD_02 3115 0.80 2.05 0.40 99 NO_DNS_FOR_FROM 3113 1.40 2.05 1.19 100 TR_XM_FormFill2 3106 0.98 2.05 0.63 101 DKIM_ADSP_CUSTOM_MED 3097 1.37 2.04 1.16 102 XM_H_PHPOS 3084 0.97 2.03 0.63 103 NML_ADSP_CUSTOM_MED 3016 1.14 1.99 0.87 104 BOTNET_NORDNS 3008 0.50 1.98 0.01 105 HTML_TAG_BALANCE_BODY 2943 1.00 1.94 0.70 106 RCVD_IN_IADB_SPF 2934 4.55 1.93 5.41 107 URI_TRY_3LD 2900 1.47 1.91 1.33 108 ALL_TRUSTED 2830 11.62 1.86 14.81 109 TR_XM_DK_SendGrid 2784 2.73 1.83 3.03 110 XM_GoogleGroups 2758 1.37 1.82 1.22 111 SUBJ_ALL_CAPS 2658 1.73 1.75 1.72 112 RCVD_IN_IADB_SENDERID 2644 3.97 1.74 4.70 113 XM_ProductURIs 2638 1.06 1.74 0.84 114 T_HTML_TAG_BALANCE_CENTER 2616 0.50 1.72 0.11 115 RCVD_IN_IADB_DK 2575 3.94 1.70 4.67 116 XMLngstWrd_00 2491 0.77 1.64 0.49 117 XMStockSpam_06 2488 1.16 1.64 1.01 118 HTML_TAG_BALANCE_HEAD 2423 0.42 1.60 0.04 119 T_XMHurry_00 2417 0.97 1.59 0.77 120 XM_UB99 2386 0.40 1.57 0.02 121 FILL_THIS_FORM 2340 0.68 1.54 0.40 122 SpammyFromTLD_01 2318 0.96 1.53 0.78 123 NUMERIC_HTTP_ADDR 2301 0.79 1.52 0.55 124 RCVD_IN_IADB_VOUCHED 2292 3.33 1.51 3.92 125 MIME_HEADER_CTYPE_ONLY 2259 0.45 1.49 0.11 126 NORDNS_LOW_CONTRAST 2254 0.38 1.48 0.02 127 XM_H_Long_From03 2241 0.40 1.48 0.05 128 FILL_THIS_FORM_LONG 2224 0.59 1.46 0.31 129 XMPhish30 2213 0.71 1.46 0.46 130 XMLongAddy 2212 0.39 1.46 0.04 131 XMSubMetaSxObfu_03 2194 0.69 1.44 0.44 132 XMHTML_After_End 2185 0.72 1.44 0.48 133 URIBL_CSS_A 2172 0.37 1.43 0.02 134 URIBL_CSS 2172 0.37 1.43 0.02 135 XM_DK_Undo_01 2171 1.78 1.43 1.89 136 DIET_1 2130 0.56 1.40 0.29 137 XMBody_17 2129 0.73 1.40 0.51 138 URIBL_SBL_A 2099 0.44 1.38 0.13 139 HTML_EMBEDS 2005 0.33 1.32 0.00 140 XM_B_REG_HTML 2005 0.64 1.32 0.42 141 XM_H_Long_From02 1926 1.40 1.27 1.44 142 XM_UB999 1883 0.32 1.24 0.02 143 T_MONEY_PERCENT 1860 0.90 1.22 0.80 144 TR_LOTS_OF_MONEY2 1860 0.90 1.22 0.80 145 XMPhish14 1828 0.76 1.20 0.62 146 XMMoneyMeta_00 1778 0.73 1.17 0.58 147 XM_UB60 1774 0.37 1.17 0.10 148 PLING_QUERY 1772 0.72 1.17 0.58 149 XM_H_PHPMailer 1748 0.65 1.15 0.49 150 BAYES_05 1708 1.76 1.12 1.97 151 FORGED_GMAIL_RCVD 1706 0.63 1.12 0.46 152 XM_UB80 1669 0.30 1.10 0.03 153 TR_LOTS_OF_MONEY3 1627 0.55 1.07 0.38 154 HTML_IMAGE_ONLY_28 1625 0.57 1.07 0.40 155 TR_Symld_Words 1624 1.71 1.07 1.92 156 LONG_HEX_URI 1580 0.37 1.04 0.14 157 NORMAL_HTTP_TO_IP 1560 0.41 1.03 0.21 158 RCVD_IN_IADB_OPTIN 1541 2.14 1.01 2.51 159 REMOVE_BEFORE_LINK 1538 0.50 1.01 0.33 160 XMHTMLBadTable_001 1508 0.65 0.99 0.54 161 T_FILL_THIS_FORM_SHORT 1496 1.06 0.99 1.08 162 URIBL_BLACK 1462 0.29 0.96 0.07 163 RELAYCOUNTRY_AT 1434 0.48 0.94 0.33 164 XMSubMetaSSx_00 1427 0.36 0.94 0.17 165 BAYES_00 1424 10.37 0.94 13.44 166 XM_HighProb1 1380 0.27 0.91 0.06 167 XM_RXBody 1360 0.40 0.90 0.24 168 XMGppyBdWords 1331 0.32 0.88 0.13 169 XMSexyCombo_04 1324 0.28 0.87 0.08 170 T_Symld_Words_02 1323 0.68 0.87 0.62 171 TRACKER_ID 1311 0.38 0.86 0.22 172 XMSlimDrugH 1305 0.46 0.86 0.33 173 RELAYCOUNTRY_AU 1304 0.64 0.86 0.57 174 RELAYCOUNTRY_GB 1291 1.00 0.85 1.05 175 RCVD_IN_PSBL 1283 0.23 0.84 0.02 176 HTML_FONT_FACE_BAD 1281 0.62 0.84 0.55 177 XM_H_PHPOS_M 1274 0.34 0.84 0.18 178 HTTPS_HTTP_MISMATCH 1263 0.70 0.83 0.65 179 MPART_ALT_DIFF_COUNT 1226 0.45 0.81 0.33 180 RELAYCOUNTRY_IN 1214 0.25 0.80 0.07 181 TR_MetaPhish_Combo_01 1208 1.52 0.80 1.75 182 XMSubMetaI_01 1204 0.34 0.79 0.19 183 XMClaimOffer 1192 0.27 0.78 0.11 184 T_TooManySym_02 1183 1.50 0.78 1.74 185 URI_NOVOWEL 1176 0.45 0.77 0.35 186 URIBL_DBL_SPAM 1162 0.20 0.77 0.01 187 PDS_TO_EQ_FROM_NAME 1149 0.20 0.76 0.01 188 LONG_JUNK_URI 1134 0.23 0.75 0.06 189 XMSubMetaD_03 1120 0.32 0.74 0.18 190 XMBrknScrpt_02 1119 0.74 0.74 0.74 191 FILL_THIS_FORM_LOAN 1105 0.41 0.73 0.30 192 THIS_AD 1073 0.37 0.71 0.26 193 TR_Mismatch_TLD_02 1070 0.23 0.70 0.07 194 RELAYCOUNTRY_CN 1051 0.20 0.69 0.05 195 RDNS_DYNAMIC 1045 0.47 0.69 0.40 196 TVD_PH_BODY_ACCOUNTS_PRE 1041 0.33 0.69 0.22 197 XM_B_COPY_HTML 1021 0.52 0.67 0.47 198 DATE_IN_PAST_03_06 1010 0.26 0.67 0.12 199 XM_OfRef7 1000 0.31 0.66 0.20 200 MONEY_FORM 997 0.17 0.66 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 410019 89.90 95.67 88.03 2 DKIM_SIGNED 354496 78.02 83.87 76.11 3 XM_DK_Pass 347862 75.82 79.31 74.68 4 DKIM_VALID 330254 71.95 75.16 70.90 5 DCC_CHECK_NEGATIVE 267838 48.11 19.29 57.50 6 XMListUnsubscribeExists 244230 58.87 78.61 52.43 7 BAYES_50 241403 47.28 33.35 51.83 8 DKIM_VALID_AU 235592 52.83 59.73 50.58 9 DCC_CHECK 188125 49.83 78.78 40.39 10 XM_H_QuotedFrom 168140 39.12 48.39 36.10 11 T_TM2_M_HEADER_IN_MSG 144758 28.45 20.40 31.08 12 HTML_FONT_LOW_CONTRAST 133009 30.49 36.41 28.56 13 DKIM_VALID_EF 130516 26.41 21.48 28.02 14 XMSubLong 105602 23.21 24.86 22.67 15 LOC_TINY_FONT_1 105035 25.93 36.28 22.55 16 FVGT_m_MULTI_ODD 100658 23.53 29.43 21.61 17 MIME_HTML_ONLY 93948 22.82 30.96 20.17 18 MultiRelay 87704 18.49 17.46 18.83 19 T_KAM_HTML_FONT_INVALID 86831 19.80 23.35 18.64 20 ALL_TRUSTED 68971 11.62 1.86 14.81 21 XM_DK_Undo_02 66863 22.46 47.33 14.35 22 XM_Body_Dirty_Words 63199 15.63 21.97 13.57 23 BAYES_00 62598 10.37 0.94 13.44 24 BAYES_99 57493 19.35 40.85 12.34 25 XM_DKIMWhitelistDomains 56712 9.19 0.03 12.18 26 XM_Multi_Part_URI 54077 12.68 15.96 11.61 27 BAYES_999 51110 16.70 34.28 10.97 28 TR_XM_DK_Bayes 49556 8.16 0.55 10.64 29 TR_XM_DK_Bayes1 47079 7.73 0.45 10.11 30 RCVD_IN_RP_SAFE 46318 8.50 4.07 9.94 31 LOTS_OF_MONEY 44652 10.32 12.55 9.59 32 RCVD_IN_RP_CERTIFIED 41902 7.57 3.20 9.00 33 LotsOfNums_01 41323 8.49 7.33 8.87 34 TR_XM_DK_Bayes2 39880 6.55 0.37 8.56 35 XM_Evil_Numbers_Gen 39721 9.82 13.79 8.53 36 HTML_IMAGE_RATIO_02 38925 10.02 15.14 8.36 37 T_XMDrugObfuBody_14 38465 8.58 9.56 8.26 38 TooManyTo_001 36790 7.82 7.57 7.90 39 XM_H_Long_From01 30119 6.64 7.16 6.47 40 FSL_BULK_SIG 29956 6.99 8.69 6.43 41 BAYES_60 29753 6.36 6.28 6.39 42 XM_SendGrid 29752 5.76 3.82 6.39 43 MIME_QP_LONG_LINE 29019 5.51 3.31 6.23 44 RCVD_IN_IADB_LISTED 28593 5.21 2.35 6.14 45 XM_B_Phish_Phrases 28065 6.65 8.56 6.03 46 TR_DCC_Bayes_99 27696 12.42 32.28 5.95 47 T_TooManySym_01 26402 4.93 2.66 5.67 48 BOTNET_IPINHOSTNAME 26379 9.01 19.27 5.66 49 HTML_IMAGE_RATIO_04 25371 5.74 6.66 5.45 50 RCVD_IN_IADB_SPF 25178 4.55 1.93 5.41 51 RELAYCOUNTRY_META 24327 8.49 18.50 5.22 52 DKIM_INVALID 24242 6.07 8.71 5.20 53 XM_PDF 22292 3.76 0.62 4.79 54 FROM_EXCESS_BASE64 22226 4.62 4.15 4.77 55 RCVD_IN_IADB_SENDERID 21906 3.97 1.74 4.70 56 RCVD_IN_IADB_DK 21739 3.94 1.70 4.67 57 RCVD_IN_MSPIKE_H2 21598 4.13 2.57 4.64 58 T_REMOTE_IMAGE 20202 4.43 4.72 4.34 59 BAYES_40 19316 3.67 2.23 4.15 60 IN_ZIMBRA_NJ_WHITELIST 18981 3.08 0.02 4.07 61 XMSubMetaSx_00 18862 4.87 7.37 4.05 62 XMStrtUSub 18636 4.07 4.29 4.00 63 TO_MALFORMED 18465 3.00 0.04 3.96 64 BAYES_80 18361 5.00 8.23 3.94 65 RCVD_IN_IADB_VOUCHED 18249 3.33 1.51 3.92 66 HTML_IMAGE_RATIO_06 17532 4.21 5.56 3.76 67 XMSexyCombo_05 17005 5.37 10.66 3.65 68 MPART_ALT_DIFF 16130 4.89 9.26 3.46 69 XM_UncommonTLD01 15888 4.67 8.53 3.41 70 UNPARSEABLE_RELAY 15214 3.07 2.48 3.27 71 BAYES_20 14228 2.88 2.33 3.05 72 TR_XM_DK_SendGrid 14097 2.73 1.83 3.03 73 TVD_RCVD_IP 13963 2.39 0.51 3.00 74 HTML_IMAGE_RATIO_08 12457 2.71 2.83 2.67 75 BAYES_95 12033 3.05 4.47 2.58 76 XMNumbers 11898 3.10 4.76 2.55 77 RCVD_IN_MSPIKE_WL 11863 2.04 0.48 2.55 78 RCVD_IN_MSPIKE_H3 11861 2.04 0.48 2.55 79 RCVD_IN_IADB_OPTIN 11683 2.14 1.01 2.51 80 MIME_HTML_MOSTLY 11570 3.26 5.65 2.48 81 HTML_MIME_NO_HTML_TAG 11302 2.76 3.79 2.43 82 MAILING_LIST_MULTI 10789 2.25 2.05 2.32 83 XM_DIRTYINTL 10508 3.02 5.37 2.26 84 ANY_BOUNCE_MESSAGE 9941 1.69 0.32 2.13 85 BOUNCE_MESSAGE 9940 1.69 0.32 2.13 86 TooManyTo_002 9719 1.70 0.53 2.09 87 XMDiploma_00 9596 2.64 4.42 2.06 88 BOTNET 9554 5.86 17.55 2.05 89 XM_CamelCaseFrm001 9363 2.37 3.49 2.01 90 XM_SPF_SoftFail 9209 2.41 3.74 1.98 91 BAYES_05 9187 1.76 1.12 1.97 92 HELO_NODOT 9154 1.63 0.59 1.97 93 HELO_NO_DOMAIN 9106 1.61 0.57 1.95 94 TR_Symld_Words 8935 1.71 1.07 1.92 95 XM_DK_Undo_01 8807 1.78 1.43 1.89 96 TM2_M_URI_OPT_OUT 8494 2.27 3.62 1.82 97 IN_HORDE_ADDRESS_BOOK 8232 1.34 0.04 1.77 98 TR_MetaPhish_Combo_01 8165 1.52 0.80 1.75 99 MIME_HTML_ONLY_MULTI 8148 2.39 4.35 1.75 100 T_TooManySym_02 8109 1.50 0.78 1.74 101 SUBJ_ALL_CAPS 7999 1.73 1.75 1.72 102 XM_OfRef6 7833 2.02 3.05 1.68 103 URI_HEX 7777 2.07 3.29 1.67 104 USER_IN_DEF_DKIM_WL 7673 1.25 0.03 1.65 105 INVALID_MSGID 7342 1.22 0.14 1.58 106 T_XMDrugObfuBody_08 7159 1.81 2.64 1.54 107 XM_H_Long_From02 6712 1.40 1.27 1.44 108 RELAYCOUNTRY_CA 6707 2.10 4.14 1.44 109 UNTRUSTED_Relay 6647 3.77 10.96 1.43 110 TooManyTo_003 6493 1.15 0.41 1.39 111 XMGenDplmaNmb 6433 1.88 3.41 1.38 112 XMCapTrack 6255 1.06 0.21 1.34 113 URI_TRY_3LD 6184 1.47 1.91 1.33 114 XM_GoogleGroups 5692 1.37 1.82 1.22 115 XMPhish11 5645 1.59 2.75 1.21 116 NO_DNS_FOR_FROM 5523 1.40 2.05 1.19 117 DKIM_ADSP_CUSTOM_MED 5384 1.37 2.04 1.16 118 T_FILL_THIS_FORM_SHORT 5032 1.06 0.99 1.08 119 TM2_M_VERY_LONG_WORD 4987 1.53 2.93 1.07 120 RELAYCOUNTRY_GB 4913 1.00 0.85 1.05 121 TooManyTo_004 4838 0.87 0.34 1.04 122 XMStockSpam_06 4691 1.16 1.64 1.01 123 RCVD_IN_BL_SPAMCOP_NET 4292 1.65 3.90 0.92 124 T_XMDrugObfuBody_00 4243 1.23 2.22 0.91 125 NML_ADSP_CUSTOM_MED 4041 1.14 1.99 0.87 126 TM2_M_A_HREF_HREF 3966 0.78 0.56 0.85 127 XM_ProductURIs 3923 1.06 1.74 0.84 128 TooManyTo_005 3884 0.69 0.25 0.83 129 TR_XM_RelayPhish 3818 1.30 2.79 0.82 130 TR_LOTS_OF_MONEY2 3723 0.90 1.22 0.80 131 T_MONEY_PERCENT 3723 0.90 1.22 0.80 132 SpammyFromTLD_01 3639 0.96 1.53 0.78 133 T_XMHurry_00 3572 0.97 1.59 0.77 134 XM_UB50 3548 1.86 5.24 0.76 135 XMBrknScrpt_02 3469 0.74 0.74 0.74 136 XMSubMetaI_00 3284 1.07 2.18 0.71 137 HTML_TAG_BALANCE_BODY 3244 1.00 1.94 0.70 138 T_OBFU_PDF_ATTACH 3086 0.55 0.20 0.66 139 HTTPS_HTTP_MISMATCH 3040 0.70 0.83 0.65 140 TR_XM_PHPDW 3024 1.00 2.08 0.65 141 USER_IN_WHITELIST 2978 0.48 0.00 0.64 142 TR_XM_PHPForged 2970 0.99 2.06 0.64 143 TR_XM_FormFill2 2947 0.98 2.05 0.63 144 XMGappySubj_01 2945 0.55 0.31 0.63 145 XM_ShortIntro_01 2934 0.54 0.25 0.63 146 XM_H_PHPOS 2923 0.97 2.03 0.63 147 XMPhish14 2873 0.76 1.20 0.62 148 T_Symld_Words_02 2870 0.68 0.87 0.62 149 DKIM_ADSP_NXDOMAIN 2859 1.12 2.69 0.61 150 XMBdyGiftCard01 2763 1.15 2.87 0.59 151 XMMoneyMeta_00 2716 0.73 1.17 0.58 152 PLING_QUERY 2691 0.72 1.17 0.58 153 SHORT_HELO_AND_INLINE_IMAGE 2683 0.44 0.02 0.58 154 RELAYCOUNTRY_AU 2633 0.64 0.86 0.57 155 XM_Body_Obfu01 2621 0.54 0.49 0.56 156 XMSexyCombo_01 2586 1.03 2.47 0.56 157 NUMERIC_HTTP_ADDR 2576 0.79 1.52 0.55 158 HTML_FONT_FACE_BAD 2574 0.62 0.84 0.55 159 XMBody_95 2511 0.43 0.10 0.54 160 XMHTMLBadTable_001 2498 0.65 0.99 0.54 161 T_TooManySym_03 2496 0.46 0.23 0.54 162 FROM_GOV_SPOOF 2488 0.44 0.17 0.53 163 XM_URI_RBL 2476 1.09 2.82 0.53 164 XMBody_78 2444 0.91 2.08 0.52 165 XMNoVowels 2443 0.49 0.40 0.52 166 AC_DIV_BONANZA 2423 0.42 0.12 0.52 167 XMBody_17 2395 0.73 1.40 0.51 168 XM_H_PHPMailer 2276 0.65 1.15 0.49 169 XMLngstWrd_00 2276 0.77 1.64 0.49 170 FSL_THIS_IS_ADV 2275 0.45 0.33 0.49 171 RELAYCOUNTRY_DE 2240 1.07 2.86 0.48 172 XMHTML_After_End 2240 0.72 1.44 0.48 173 XM_B_COPY_HTML 2206 0.52 0.67 0.47 174 RCVD_IN_SORBS_DUL 2204 0.40 0.20 0.47 175 XMSubMetaSxObfu_02 2180 0.44 0.35 0.47 176 XMPhish30 2162 0.71 1.46 0.46 177 FORGED_GMAIL_RCVD 2161 0.63 1.12 0.46 178 MISSING_HEADERS 2145 0.43 0.34 0.46 179 XMDateMe_00 2084 0.47 0.54 0.45 180 XMLngstWrd_01 2078 0.41 0.30 0.45 181 TM2_M_BODY_EMPTY 2073 0.37 0.12 0.45 182 XMSubMetaSxObfu_03 2041 0.69 1.44 0.44 183 XM_B_REG_HTML 1971 0.64 1.32 0.42 184 HTML_IMAGE_ONLY_28 1884 0.57 1.07 0.40 185 RDNS_DYNAMIC 1865 0.47 0.69 0.40 186 HTML_IMAGE_ONLY_32 1856 0.39 0.37 0.40 187 FILL_THIS_FORM 1850 0.68 1.54 0.40 188 SpammyFromTLD_02 1849 0.80 2.05 0.40 189 SUBJ_DOLLARS 1822 0.42 0.51 0.39 190 ADMITS_SPAM 1809 0.36 0.28 0.39 191 TR_LOTS_OF_MONEY3 1784 0.55 1.07 0.38 192 URI_NOVOWEL 1621 0.45 0.77 0.35 193 XMSlimDrugH 1556 0.46 0.86 0.33 194 RELAYCOUNTRY_AT 1549 0.48 0.94 0.33 195 XMRcvdHeader_15 1545 0.25 0.00 0.33 196 REMOVE_BEFORE_LINK 1544 0.50 1.01 0.33 197 MPART_ALT_DIFF_COUNT 1537 0.45 0.81 0.33 198 FROM_GOV_DKIM_AU 1509 0.27 0.09 0.32 199 HTML_IMAGE_ONLY_24 1506 0.30 0.24 0.32 200 XM_B_TRADE_HTML 1482 0.35 0.46 0.32 ----------------------------------------------------------------------