Email: 567897 Autolearn: 0 AvgScore: 2.31 AvgScanTime: 1.98 sec Spam: 148400 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 2.38 sec Ham: 419497 Autolearn: 0 AvgScore: -1.19 AvgScanTime: 1.84 sec Time Spent Running SA: 312.16 hours Time Spent Processing Spam: 98.05 hours Time Spent Processing Ham: 214.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140383 88.76 94.60 86.69 2 DKIM_SIGNED 122758 77.78 82.72 76.04 3 XM_DK_Pass 119450 76.18 80.49 74.66 4 DCC_CHECK 116750 50.10 78.67 39.99 5 DKIM_VALID 113314 72.32 76.36 70.90 6 XMListUnsubscribeExists 110432 57.05 74.42 50.91 7 DKIM_VALID_AU 92565 54.03 62.38 51.07 8 XM_DK_Undo_02 71567 23.75 48.23 15.09 9 XM_H_QuotedFrom 69374 39.14 46.75 36.45 10 BAYES_99 64046 21.00 43.16 13.17 11 HTML_FONT_LOW_CONTRAST 62557 31.98 42.15 28.38 12 LOC_TINY_FONT_1 57112 26.61 38.49 22.41 13 BAYES_999 53182 18.00 35.84 11.69 14 TR_DCC_Bayes_99 50864 13.62 34.27 6.32 15 MIME_HTML_ONLY 49380 23.76 33.27 20.39 16 BAYES_50 47277 45.75 31.86 50.66 17 FVGT_m_MULTI_ODD 37815 21.86 25.48 20.58 18 XMSubLong 35913 22.37 24.20 21.72 19 DKIM_VALID_EF 35559 27.39 23.96 28.61 20 XM_Body_Dirty_Words 34331 15.74 23.13 13.13 21 T_KAM_HTML_FONT_INVALID 30702 17.25 20.69 16.03 22 DCC_CHECK_NEGATIVE 29154 48.04 19.65 58.08 23 T_TM2_M_HEADER_IN_MSG 28653 27.30 19.31 30.13 24 RELAYCOUNTRY_META 28027 8.63 18.89 5.00 25 BOTNET 23497 5.67 15.83 2.08 26 MultiRelay 23226 18.20 15.65 19.10 27 BOTNET_IPINHOSTNAME 23112 8.38 15.57 5.84 28 XM_Multi_Part_URI 22085 13.20 14.88 12.60 29 XMSexyCombo_05 19929 6.20 13.43 3.64 30 XM_Evil_Numbers_Gen 19795 9.31 13.34 7.88 31 FSL_BULK_SIG 19352 8.42 13.04 6.79 32 LOTS_OF_MONEY 19107 10.18 12.88 9.23 33 HTML_IMAGE_RATIO_02 18974 9.31 12.79 8.08 34 HTML_IMAGE_RATIO_04 17923 7.21 12.08 5.49 35 UNTRUSTED_Relay 16817 3.98 11.33 1.37 36 XM_UncommonTLD01 16554 5.54 11.15 3.55 37 TooManyTo_001 15403 8.94 10.38 8.43 38 XMSubMetaSx_00 14801 5.80 9.97 4.32 39 T_XMDrugObfuBody_14 12752 8.46 8.59 8.41 40 SpammyFromTLD_02 11825 2.43 7.97 0.48 41 BAYES_80 11733 5.30 7.91 4.38 42 XM_H_Long_From01 11515 6.93 7.76 6.64 43 MPART_ALT_DIFF 11212 4.47 7.56 3.38 44 XM_B_Phish_Phrases 10942 5.97 7.37 5.47 45 LotsOfNums_01 9564 8.21 6.44 8.84 46 DKIM_INVALID 9444 5.46 6.36 5.14 47 XM_DIRTYINTL 9321 3.51 6.28 2.53 48 BAYES_60 8918 6.31 6.01 6.42 49 HTML_IMAGE_RATIO_06 8092 4.00 5.45 3.48 50 FROM_EXCESS_BASE64 7209 4.50 4.86 4.38 51 T_TooManySym_01 6931 5.67 4.67 6.02 52 XM_CamelCaseFrm001 6864 2.53 4.63 1.79 53 DKIM_ADSP_NXDOMAIN 6803 1.57 4.58 0.51 54 BAYES_95 6785 3.19 4.57 2.70 55 FROM_SUSPICIOUS_NTLD 6624 1.26 4.46 0.13 56 XM_UB50 6523 1.71 4.40 0.77 57 MIME_HTML_MOSTLY 6390 2.93 4.31 2.44 58 XMStrtUSub 6276 4.54 4.23 4.65 59 URIBL_SBL_A 6180 1.13 4.16 0.05 60 HTML_IMAGE_RATIO_08 6047 2.89 4.07 2.47 61 HTML_MIME_NO_HTML_TAG 6037 2.87 4.07 2.45 62 XM_H_TOP 5858 1.04 3.95 0.01 63 MIME_HTML_ONLY_MULTI 5757 2.32 3.88 1.76 64 XM_SendGrid 5672 5.70 3.82 6.37 65 RELAYCOUNTRY_CA 5453 2.04 3.67 1.46 66 RCVD_IN_RP_SAFE 5400 8.86 3.64 10.70 67 XMSexyCombo_01 5313 1.43 3.58 0.66 68 URI_HEX 5284 2.07 3.56 1.54 69 RELAYCOUNTRY_FR 5119 1.04 3.45 0.18 70 XMNumbers 5048 2.99 3.40 2.84 71 TM2_M_URI_OPT_OUT 5034 2.00 3.39 1.50 72 XM_SPF_SoftFail 4838 2.26 3.26 1.90 73 XMBdyGiftCard01 4792 1.62 3.23 1.05 74 XM_OfRef6 4715 1.94 3.18 1.50 75 XMStockSpam_06 4554 1.46 3.07 0.89 76 RCVD_IN_RP_CERTIFIED 4287 7.84 2.89 9.59 77 MIME_QP_LONG_LINE 4259 5.15 2.87 5.96 78 RCVD_IN_RP_RNBL 4236 0.78 2.85 0.05 79 XMDiploma_00 4193 2.22 2.83 2.00 80 DATE_IN_PAST_12_24 3948 0.73 2.66 0.05 81 TR_M_TOP_BAYES 3942 0.69 2.66 0.00 82 T_XMDrugObfuBody_08 3822 1.99 2.58 1.78 83 ALL_TRUSTED 3769 12.13 2.54 15.52 84 DATE_IN_PAST_06_12 3768 0.70 2.54 0.04 85 XM_URI_RBL 3629 1.03 2.45 0.53 86 RELAYCOUNTRY_DE 3617 1.00 2.44 0.49 87 T_REMOTE_IMAGE 3543 3.62 2.39 4.06 88 XMSexyCombo_04 3396 0.68 2.29 0.12 89 RCVD_IN_MSPIKE_H2 3373 4.23 2.27 4.92 90 BAYES_40 3371 3.58 2.27 4.04 91 RCVD_IN_BL_SPAMCOP_NET 3309 1.02 2.23 0.59 92 BAYES_20 3292 2.94 2.22 3.20 93 FSL_THIS_IS_ADV 3225 0.72 2.17 0.21 94 XM_RXBody 3213 0.77 2.17 0.28 95 TR_XM_PHPDW 3193 1.08 2.15 0.70 96 NO_DNS_FOR_FROM 3165 1.50 2.13 1.28 97 TR_XM_PHPForged 3159 1.07 2.13 0.69 98 TR_XM_FormFill2 3148 1.06 2.12 0.69 99 XM_H_PHPOS 3130 1.05 2.11 0.68 100 XMGenDplmaNmb 3102 1.57 2.09 1.38 101 XMSubGiftCard1 2979 0.59 2.01 0.09 102 MIME_HEADER_CTYPE_ONLY 2943 0.60 1.98 0.11 103 MultiRelay_CC 2927 0.63 1.97 0.15 104 MultiRelay_Combo 2927 0.63 1.97 0.15 105 SpammyFromTLD_01 2876 1.09 1.94 0.79 106 URIBL_DBL_ABUSE_REDIR 2872 0.52 1.94 0.01 107 RELAYCOUNTRY_JP 2858 0.53 1.93 0.03 108 T_XMDrugObfuBody_00 2756 1.15 1.86 0.90 109 XMBody_17 2752 0.85 1.85 0.49 110 XMSubMetaI_00 2603 0.93 1.75 0.64 111 BAD_ENC_HEADER 2595 0.47 1.75 0.02 112 UNPARSEABLE_RELAY 2567 3.11 1.73 3.60 113 SUBJ_DOLLARS 2558 0.89 1.72 0.59 114 NORDNS_LOW_CONTRAST 2530 0.45 1.70 0.01 115 TM2_M_VERY_LONG_WORD 2420 1.25 1.63 1.11 116 SUBJ_ALL_CAPS 2364 1.91 1.59 2.03 117 XM_UB60 2363 0.50 1.59 0.12 118 PDS_TO_EQ_FROM_NAME 2347 0.42 1.58 0.02 119 TR_XM_DK_SendGrid 2338 2.77 1.58 3.19 120 BODY_URI_ONLY 2315 0.49 1.56 0.11 121 XM_H_Long_From02 2230 1.16 1.50 1.04 122 RCVD_IN_IADB_LISTED 2192 4.93 1.48 6.15 123 TR_XM_RelayPhish 2132 1.10 1.44 0.99 124 XM_DKIMWhitelistDomains 2111 10.13 1.42 13.21 125 T_XMHurry_00 2097 0.83 1.41 0.62 126 T_MANY_PILL_PRICE 2089 0.40 1.41 0.05 127 ADMITS_SPAM 2082 0.39 1.40 0.03 128 XM_UB80 2068 0.42 1.39 0.08 129 XMPhish30 2022 0.71 1.36 0.48 130 XMSubGiftCard2 2018 0.40 1.36 0.05 131 XM_ProductURIs 1944 0.83 1.31 0.67 132 XMSubMetaSxObfu_03 1915 0.81 1.29 0.65 133 XM_UB99 1892 0.35 1.27 0.03 134 BOTNET_NORDNS 1886 0.35 1.27 0.02 135 TR_Mismatch_TLD_02 1871 0.41 1.26 0.11 136 RCVD_IN_IADB_SPF 1812 4.26 1.22 5.33 137 XMPhish11 1807 1.19 1.22 1.18 138 MAILING_LIST_MULTI 1793 2.06 1.21 2.36 139 URI_TRY_3LD 1763 1.36 1.19 1.43 140 BAYES_05 1742 1.76 1.17 1.97 141 XMHTML_After_End 1718 0.62 1.16 0.43 142 XM_OfRef7 1706 0.46 1.15 0.22 143 XM_B_REG_HTML 1702 0.59 1.15 0.40 144 T_MONEY_PERCENT 1681 0.47 1.13 0.23 145 TR_LOTS_OF_MONEY2 1681 0.47 1.13 0.23 146 TR_Symld_Words 1664 1.93 1.12 2.22 147 RCVD_IN_IADB_SENDERID 1650 3.70 1.11 4.61 148 RCVD_IN_IADB_DK 1645 3.64 1.11 4.54 149 XMSubMetaSSx_00 1640 0.44 1.11 0.21 150 DATE_IN_PAST_03_06 1554 0.32 1.05 0.07 151 BODY_ENHANCEMENT 1529 0.29 1.03 0.03 152 RELAYCOUNTRY_IN 1523 0.35 1.03 0.11 153 URIBL_BLACK 1503 0.30 1.01 0.05 154 DIET_1 1451 0.50 0.98 0.33 155 URIBL_DBL_SPAM 1449 0.26 0.98 0.01 156 XM_H_PHPMailer 1445 0.62 0.97 0.49 157 FILL_THIS_FORM 1436 0.58 0.97 0.44 158 RELAYCOUNTRY_GB 1432 1.00 0.96 1.01 159 RELAYCOUNTRY_AT 1428 0.40 0.96 0.21 160 T_FILL_THIS_FORM_SHORT 1427 1.14 0.96 1.21 161 XM_B_COPY_HTML 1385 0.63 0.93 0.52 162 XMBody_78 1359 0.55 0.92 0.42 163 FILL_THIS_FORM_LONG 1339 0.51 0.90 0.37 164 XM_UB999 1322 0.24 0.89 0.01 165 URI_NOVOWEL 1298 0.55 0.87 0.43 166 RCVD_IN_IADB_VOUCHED 1293 3.23 0.87 4.07 167 XMHTMLBadTable_001 1292 0.67 0.87 0.60 168 TR_LOTS_OF_MONEY3 1290 0.49 0.87 0.35 169 XM_H_PHPOS_M 1283 0.36 0.86 0.18 170 XMMoneyMeta_00 1277 0.59 0.86 0.49 171 XMSubMetaSx_01 1273 0.29 0.86 0.09 172 XM_HighProb1 1250 0.23 0.84 0.02 173 DKIM_ADSP_CUSTOM_MED 1250 1.07 0.84 1.15 174 T_Symld_Words_02 1246 0.61 0.84 0.53 175 XMGppyBdWords 1222 0.41 0.82 0.26 176 NML_ADSP_CUSTOM_MED 1190 0.78 0.80 0.77 177 TM2_M_BODY_EMPTY 1188 0.70 0.80 0.67 178 TR_Caps_n_Bayes_99 1181 0.31 0.80 0.13 179 XMPhish14 1158 0.64 0.78 0.59 180 NUMERIC_HTTP_ADDR 1149 0.50 0.77 0.40 181 XMSubject_48 1147 0.22 0.77 0.03 182 MPART_ALT_DIFF_COUNT 1136 0.39 0.77 0.26 183 XMEmptyBody_01 1135 0.47 0.76 0.37 184 EXCUSE_4 1112 0.20 0.75 0.01 185 XM_H_Undi_Recip 1111 0.35 0.75 0.21 186 XM_DK_Undo_01 1107 1.48 0.75 1.73 187 XMSlimDrugH 1107 0.47 0.75 0.37 188 TM2_M_A_HREF_HREF 1077 0.91 0.73 0.98 189 HTML_FONT_FACE_BAD 1076 0.55 0.73 0.49 190 THIS_AD 1054 0.36 0.71 0.23 191 LONG_HEX_URI 1048 0.28 0.71 0.13 192 T_TooManySym_02 1045 1.65 0.70 1.98 193 TR_MetaPhish_Combo_01 1041 1.43 0.70 1.69 194 XM_UB95 1039 0.20 0.70 0.02 195 XMBrknScrpt_02 1035 0.71 0.70 0.71 196 FORGED_GMAIL_RCVD 1026 0.56 0.69 0.52 197 LONG_JUNK_URI 1013 0.25 0.68 0.10 198 XM_PDF 1002 3.86 0.68 4.99 199 FILL_THIS_FORM_LOAN 987 0.42 0.67 0.34 200 HTML_TAG_BALANCE_BODY 983 0.52 0.66 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 363674 88.76 94.60 86.69 2 DKIM_SIGNED 318969 77.78 82.72 76.04 3 XM_DK_Pass 313197 76.18 80.49 74.66 4 DKIM_VALID 297408 72.32 76.36 70.90 5 DCC_CHECK_NEGATIVE 243653 48.04 19.65 58.08 6 DKIM_VALID_AU 214254 54.03 62.38 51.07 7 XMListUnsubscribeExists 213579 57.05 74.42 50.91 8 BAYES_50 212526 45.75 31.86 50.66 9 DCC_CHECK 167744 50.10 78.67 39.99 10 XM_H_QuotedFrom 152910 39.14 46.75 36.45 11 T_TM2_M_HEADER_IN_MSG 126410 27.30 19.31 30.13 12 DKIM_VALID_EF 120012 27.39 23.96 28.61 13 HTML_FONT_LOW_CONTRAST 119047 31.98 42.15 28.38 14 LOC_TINY_FONT_1 94014 26.61 38.49 22.41 15 XMSubLong 91134 22.37 24.20 21.72 16 FVGT_m_MULTI_ODD 86328 21.86 25.48 20.58 17 MIME_HTML_ONLY 85538 23.76 33.27 20.39 18 MultiRelay 80142 18.20 15.65 19.10 19 T_KAM_HTML_FONT_INVALID 67263 17.25 20.69 16.03 20 ALL_TRUSTED 65095 12.13 2.54 15.52 21 XM_DK_Undo_02 63290 23.75 48.23 15.09 22 BAYES_00 55426 9.93 0.66 13.21 23 XM_DKIMWhitelistDomains 55410 10.13 1.42 13.21 24 BAYES_99 55238 21.00 43.16 13.17 25 XM_Body_Dirty_Words 55079 15.74 23.13 13.13 26 XM_Multi_Part_URI 52857 13.20 14.88 12.60 27 BAYES_999 49057 18.00 35.84 11.69 28 TR_XM_DK_Bayes 45072 8.04 0.40 10.74 29 RCVD_IN_RP_SAFE 44888 8.86 3.64 10.70 30 TR_XM_DK_Bayes1 42705 7.60 0.32 10.18 31 RCVD_IN_RP_CERTIFIED 40219 7.84 2.89 9.59 32 LOTS_OF_MONEY 38712 10.18 12.88 9.23 33 LotsOfNums_01 37087 8.21 6.44 8.84 34 TR_XM_DK_Bayes2 36592 6.52 0.30 8.72 35 TooManyTo_001 35348 8.94 10.38 8.43 36 T_XMDrugObfuBody_14 35281 8.46 8.59 8.41 37 HTML_IMAGE_RATIO_02 33880 9.31 12.79 8.08 38 XM_Evil_Numbers_Gen 33051 9.31 13.34 7.88 39 FSL_BULK_SIG 28467 8.42 13.04 6.79 40 XM_H_Long_From01 27866 6.93 7.76 6.64 41 BAYES_60 26944 6.31 6.01 6.42 42 XM_SendGrid 26713 5.70 3.82 6.37 43 TR_DCC_Bayes_99 26506 13.62 34.27 6.32 44 RCVD_IN_IADB_LISTED 25783 4.93 1.48 6.15 45 T_TooManySym_01 25247 5.67 4.67 6.02 46 MIME_QP_LONG_LINE 25012 5.15 2.87 5.96 47 BOTNET_IPINHOSTNAME 24487 8.38 15.57 5.84 48 HTML_IMAGE_RATIO_04 23034 7.21 12.08 5.49 49 XM_B_Phish_Phrases 22951 5.97 7.37 5.47 50 RCVD_IN_IADB_SPF 22368 4.26 1.22 5.33 51 DKIM_INVALID 21561 5.46 6.36 5.14 52 RELAYCOUNTRY_META 20982 8.63 18.89 5.00 53 XM_PDF 20937 3.86 0.68 4.99 54 RCVD_IN_MSPIKE_H2 20652 4.23 2.27 4.92 55 XMStrtUSub 19503 4.54 4.23 4.65 56 RCVD_IN_IADB_SENDERID 19354 3.70 1.11 4.61 57 RCVD_IN_IADB_DK 19051 3.64 1.11 4.54 58 TO_MALFORMED 18640 3.31 0.10 4.44 59 BAYES_80 18368 5.30 7.91 4.38 60 FROM_EXCESS_BASE64 18359 4.50 4.86 4.38 61 XMSubMetaSx_00 18127 5.80 9.97 4.32 62 IN_ZIMBRA_NJ_WHITELIST 17397 3.07 0.03 4.15 63 RCVD_IN_IADB_VOUCHED 17057 3.23 0.87 4.07 64 T_REMOTE_IMAGE 17024 3.62 2.39 4.06 65 BAYES_40 16957 3.58 2.27 4.04 66 XMSexyCombo_05 15264 6.20 13.43 3.64 67 UNPARSEABLE_RELAY 15096 3.11 1.73 3.60 68 XM_UncommonTLD01 14899 5.54 11.15 3.55 69 HTML_IMAGE_RATIO_06 14604 4.00 5.45 3.48 70 MPART_ALT_DIFF 14159 4.47 7.56 3.38 71 TVD_RCVD_IP 13716 2.52 0.42 3.27 72 BAYES_20 13405 2.94 2.22 3.20 73 TR_XM_DK_SendGrid 13382 2.77 1.58 3.19 74 XMNumbers 11919 2.99 3.40 2.84 75 BAYES_95 11316 3.19 4.57 2.70 76 RCVD_IN_IADB_OPTIN 11126 2.12 0.60 2.65 77 RCVD_IN_MSPIKE_WL 10753 2.00 0.40 2.56 78 RCVD_IN_MSPIKE_H3 10753 2.00 0.40 2.56 79 XM_DIRTYINTL 10631 3.51 6.28 2.53 80 HTML_IMAGE_RATIO_08 10380 2.89 4.07 2.47 81 HTML_MIME_NO_HTML_TAG 10266 2.87 4.07 2.45 82 MIME_HTML_MOSTLY 10233 2.93 4.31 2.44 83 MAILING_LIST_MULTI 9905 2.06 1.21 2.36 84 TooManyTo_002 9789 1.87 0.56 2.33 85 TR_Symld_Words 9316 1.93 1.12 2.22 86 ANY_BOUNCE_MESSAGE 8973 1.70 0.45 2.14 87 BOUNCE_MESSAGE 8972 1.70 0.44 2.14 88 BOTNET 8705 5.67 15.83 2.08 89 SUBJ_ALL_CAPS 8496 1.91 1.59 2.03 90 XMDiploma_00 8410 2.22 2.83 2.00 91 T_TooManySym_02 8324 1.65 0.70 1.98 92 BAYES_05 8278 1.76 1.17 1.97 93 XM_SPF_SoftFail 7975 2.26 3.26 1.90 94 IN_HORDE_ADDRESS_BOOK 7700 1.37 0.05 1.84 95 XM_CamelCaseFrm001 7500 2.53 4.63 1.79 96 T_XMDrugObfuBody_08 7456 1.99 2.58 1.78 97 MIME_HTML_ONLY_MULTI 7394 2.32 3.88 1.76 98 INVALID_MSGID 7349 1.32 0.12 1.75 99 XM_DK_Undo_01 7270 1.48 0.75 1.73 100 HELO_NODOT 7144 1.41 0.59 1.70 101 HELO_NO_DOMAIN 7143 1.41 0.58 1.70 102 TR_MetaPhish_Combo_01 7093 1.43 0.70 1.69 103 TooManyTo_003 6638 1.28 0.44 1.58 104 URI_HEX 6464 2.07 3.56 1.54 105 TM2_M_URI_OPT_OUT 6304 2.00 3.39 1.50 106 XM_OfRef6 6289 1.94 3.18 1.50 107 RELAYCOUNTRY_CA 6113 2.04 3.67 1.46 108 URI_TRY_3LD 5982 1.36 1.19 1.43 109 XMGenDplmaNmb 5802 1.57 2.09 1.38 110 XMCapTrack 5784 1.08 0.23 1.38 111 UNTRUSTED_Relay 5762 3.98 11.33 1.37 112 NO_DNS_FOR_FROM 5351 1.50 2.13 1.28 113 XM_GoogleGroups 5141 1.05 0.54 1.23 114 T_FILL_THIS_FORM_SHORT 5074 1.14 0.96 1.21 115 TooManyTo_004 4995 0.97 0.36 1.19 116 XMPhish11 4967 1.19 1.22 1.18 117 DKIM_ADSP_CUSTOM_MED 4809 1.07 0.84 1.15 118 USER_IN_DEF_DKIM_WL 4699 0.83 0.01 1.12 119 TM2_M_VERY_LONG_WORD 4652 1.25 1.63 1.11 120 XMBdyGiftCard01 4396 1.62 3.23 1.05 121 XM_H_Long_From02 4342 1.16 1.50 1.04 122 RELAYCOUNTRY_GB 4242 1.00 0.96 1.01 123 TR_XM_RelayPhish 4142 1.10 1.44 0.99 124 TM2_M_A_HREF_HREF 4096 0.91 0.73 0.98 125 TooManyTo_005 3848 0.75 0.29 0.92 126 T_XMDrugObfuBody_00 3762 1.15 1.86 0.90 127 XMStockSpam_06 3725 1.46 3.07 0.89 128 SpammyFromTLD_01 3313 1.09 1.94 0.79 129 NML_ADSP_CUSTOM_MED 3247 0.78 0.80 0.77 130 FROM_GOV_SPOOF 3232 0.62 0.21 0.77 131 XM_UB50 3212 1.71 4.40 0.77 132 XMGappySubj_01 3147 0.67 0.45 0.75 133 XM_D_tchamptons_WL 3046 0.54 0.00 0.73 134 XMBody_95 2977 0.54 0.06 0.71 135 XMBrknScrpt_02 2973 0.71 0.70 0.71 136 TR_XM_PHPDW 2953 1.08 2.15 0.70 137 T_TooManySym_03 2935 0.57 0.21 0.70 138 USER_IN_WHITELIST 2923 0.51 0.00 0.70 139 TR_XM_PHPForged 2897 1.07 2.13 0.69 140 TR_XM_FormFill2 2876 1.06 2.12 0.69 141 XM_H_PHPOS 2860 1.05 2.11 0.68 142 TM2_M_BODY_EMPTY 2808 0.70 0.80 0.67 143 XM_ProductURIs 2794 0.83 1.31 0.67 144 XMSexyCombo_01 2784 1.43 3.58 0.66 145 XMSubMetaSxObfu_03 2707 0.81 1.29 0.65 146 T_OBFU_PDF_ATTACH 2690 0.54 0.26 0.64 147 XMSubMetaI_00 2684 0.93 1.75 0.64 148 MISSING_HEADERS 2654 0.57 0.38 0.63 149 T_XMHurry_00 2603 0.83 1.41 0.62 150 XMHTMLBadTable_001 2534 0.67 0.87 0.60 151 SUBJ_DOLLARS 2492 0.89 1.72 0.59 152 XMPhish14 2485 0.64 0.78 0.59 153 RCVD_IN_BL_SPAMCOP_NET 2466 1.02 2.23 0.59 154 XMNoVowels 2446 0.59 0.60 0.58 155 XM_ShortIntro_01 2389 0.48 0.23 0.57 156 PLING_QUERY 2308 0.55 0.55 0.55 157 HTTPS_HTTP_MISMATCH 2222 0.54 0.59 0.53 158 T_Symld_Words_02 2218 0.61 0.84 0.53 159 XM_URI_RBL 2203 1.03 2.45 0.53 160 XM_B_COPY_HTML 2202 0.63 0.93 0.52 161 XMSubMetaSxObfu_02 2199 0.47 0.31 0.52 162 FORGED_GMAIL_RCVD 2166 0.56 0.69 0.52 163 DKIM_ADSP_NXDOMAIN 2139 1.57 4.58 0.51 164 SHORT_HELO_AND_INLINE_IMAGE 2123 0.38 0.03 0.51 165 XMLngstWrd_00 2103 0.49 0.47 0.50 166 XMMoneyMeta_00 2075 0.59 0.86 0.49 167 XM_H_PHPMailer 2068 0.62 0.97 0.49 168 RELAYCOUNTRY_DE 2059 1.00 2.44 0.49 169 XMBody_17 2057 0.85 1.85 0.49 170 HTML_FONT_FACE_BAD 2049 0.55 0.73 0.49 171 XMPhish30 2010 0.71 1.36 0.48 172 SpammyFromTLD_02 1996 2.43 7.97 0.48 173 HTML_TAG_BALANCE_BODY 1995 0.52 0.66 0.48 174 XMLngstWrd_01 1945 0.42 0.29 0.46 175 RDNS_DYNAMIC 1936 0.50 0.62 0.46 176 HTML_IMAGE_ONLY_32 1851 0.40 0.27 0.44 177 FILL_THIS_FORM 1841 0.58 0.97 0.44 178 XMHTML_After_End 1812 0.62 1.16 0.43 179 RELAYCOUNTRY_AU 1799 0.48 0.62 0.43 180 URI_NOVOWEL 1798 0.55 0.87 0.43 181 XMBody_78 1782 0.55 0.92 0.42 182 XMDateMe_00 1766 0.40 0.33 0.42 183 RCVD_IN_SORBS_DUL 1726 0.35 0.19 0.41 184 REMOVE_BEFORE_LINK 1722 0.41 0.40 0.41 185 XMRcvdHeader_15 1701 0.30 0.00 0.41 186 NUMERIC_HTTP_ADDR 1675 0.50 0.77 0.40 187 XM_B_REG_HTML 1671 0.59 1.15 0.40 188 UPPERCASE_50_75 1652 0.33 0.16 0.39 189 HTML_IMAGE_ONLY_28 1622 0.39 0.42 0.39 190 XMSlimDrugH 1567 0.47 0.75 0.37 191 XMEmptyBody_01 1538 0.47 0.76 0.37 192 AC_DIV_BONANZA 1537 0.29 0.07 0.37 193 FILL_THIS_FORM_LONG 1537 0.51 0.90 0.37 194 TR_LOTS_OF_MONEY3 1489 0.49 0.87 0.35 195 FILL_THIS_FORM_LOAN 1415 0.42 0.67 0.34 196 DIET_1 1401 0.50 0.98 0.33 197 XMBSHREFv2 1327 0.30 0.26 0.32 198 XM_Body_Obfu01 1327 0.33 0.37 0.32 199 HTML_IMAGE_ONLY_24 1326 0.29 0.23 0.32 200 TRACKER_ID 1302 0.27 0.16 0.31 ----------------------------------------------------------------------