Email: 650193 Autolearn: 0 AvgScore: 2.90 AvgScanTime: 2.02 sec Spam: 159180 Autolearn: 0 AvgScore: 12.34 AvgScanTime: 2.46 sec Ham: 491013 Autolearn: 0 AvgScore: -0.16 AvgScanTime: 1.88 sec Time Spent Running SA: 365.37 hours Time Spent Processing Spam: 108.93 hours Time Spent Processing Ham: 256.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151802 89.23 95.36 87.25 2 DKIM_SIGNED 133462 77.10 83.84 74.91 3 DCC_CHECK 128277 49.94 80.59 40.01 4 XM_DK_Pass 124755 74.69 78.37 73.50 5 XMListUnsubscribeExists 121696 57.60 76.45 51.49 6 DKIM_VALID 118217 70.94 74.27 69.86 7 DKIM_VALID_AU 92026 52.00 57.81 50.11 8 XM_DK_Undo_02 79826 22.50 50.15 13.54 9 BAYES_99 72466 19.96 45.52 11.67 10 BAYES_999 61414 17.19 38.58 10.25 11 TR_DCC_Bayes_99 58161 12.98 36.54 5.34 12 HTML_FONT_LOW_CONTRAST 56931 30.40 35.77 28.66 13 BAYES_50 53723 47.69 33.75 52.21 14 LOC_TINY_FONT_1 52839 24.66 33.19 21.89 15 MIME_HTML_ONLY 50607 23.14 31.79 20.33 16 FVGT_m_MULTI_ODD 44490 23.44 27.95 21.98 17 XMSubLong 42617 23.43 26.77 22.35 18 T_KAM_HTML_FONT_INVALID 34681 18.43 21.79 17.34 19 DKIM_VALID_EF 34644 25.53 21.76 26.75 20 XM_Body_Dirty_Words 33514 15.45 21.05 13.64 21 T_TM2_M_HEADER_IN_MSG 32246 28.22 20.26 30.79 22 BOTNET 30559 6.19 19.20 1.98 23 DCC_CHECK_NEGATIVE 28364 48.11 17.82 57.93 24 RELAYCOUNTRY_META 26719 8.01 16.79 5.16 25 XM_Multi_Part_URI 26654 12.72 16.74 11.41 26 MultiRelay 24963 18.24 15.68 19.07 27 HTML_IMAGE_RATIO_02 23890 10.09 15.01 8.50 28 BOTNET_IPINHOSTNAME 23494 7.20 14.76 4.76 29 LOTS_OF_MONEY 20891 10.48 13.12 9.62 30 XM_Evil_Numbers_Gen 19028 9.71 11.95 8.98 31 FSL_BULK_SIG 17292 7.93 10.86 6.98 32 XM_UncommonTLD01 16889 4.99 10.61 3.17 33 UNTRUSTED_Relay 15715 3.51 9.87 1.45 34 LotsOfNums_01 15347 8.29 9.64 7.85 35 DKIM_INVALID 15245 6.16 9.58 5.05 36 XMSexyCombo_05 14737 5.17 9.26 3.85 37 T_XMDrugObfuBody_14 12746 8.82 8.01 9.08 38 TooManyTo_001 12164 8.34 7.64 8.57 39 MPART_ALT_DIFF 12060 4.44 7.58 3.43 40 XMSubMetaSx_00 11848 4.41 7.44 3.42 41 MIME_QP_LONG_LINE 11006 5.99 6.91 5.70 42 BAYES_80 10972 4.78 6.89 4.09 43 XM_B_Phish_Phrases 10856 6.29 6.82 6.12 44 HTML_IMAGE_RATIO_04 10617 6.01 6.67 5.80 45 XM_H_Long_From01 10562 6.66 6.64 6.67 46 BAYES_60 9317 6.45 5.85 6.64 47 HTML_IMAGE_RATIO_06 9185 4.04 5.77 3.48 48 RCVD_IN_BL_SPAMCOP_NET 8627 1.98 5.42 0.86 49 FROM_EXCESS_BASE64 8363 4.56 5.25 4.33 50 XM_DIRTYINTL 7790 3.07 4.89 2.48 51 XM_UB50 6939 1.76 4.36 0.92 52 HTML_IMAGE_RATIO_08 6857 2.82 4.31 2.34 53 XM_CamelCaseFrm001 6641 2.48 4.17 1.93 54 MIME_HTML_MOSTLY 6634 2.67 4.17 2.19 55 BAYES_95 6603 3.03 4.15 2.67 56 RELAYCOUNTRY_DE 6334 1.31 3.98 0.44 57 MIME_HTML_ONLY_MULTI 6318 2.45 3.97 1.95 58 BOTNET_NORDNS 6202 1.02 3.90 0.08 59 RELAYCOUNTRY_CA 5756 1.91 3.62 1.36 60 TM2_M_URI_OPT_OUT 5671 2.27 3.56 1.85 61 XM_B_SpammyTLD 5570 3.21 3.50 3.11 62 T_REMOTE_IMAGE 5500 4.28 3.46 4.54 63 T_TooManySym_01 5457 4.98 3.43 5.49 64 XM_SPF_SoftFail 5450 2.21 3.42 1.81 65 NUMERIC_HTTP_ADDR 5450 1.18 3.42 0.45 66 XM_URI_RBL 5304 1.10 3.33 0.38 67 XM_SendGrid 5227 5.75 3.28 6.55 68 XMNumbers 5216 3.02 3.28 2.94 69 URI_HEX 5039 2.28 3.17 2.00 70 XMDiploma_00 4932 2.44 3.10 2.22 71 NORMAL_HTTP_TO_IP 4919 0.79 3.09 0.05 72 XMStrtUSub 4775 3.67 3.00 3.89 73 RCVD_IN_IADB_LISTED 4676 5.12 2.94 5.82 74 RCVD_IN_MSPIKE_H2 4342 3.97 2.73 4.37 75 XMSexyCombo_01 4333 1.06 2.72 0.52 76 T_XMDrugObfuBody_08 4293 1.85 2.70 1.57 77 RCVD_IN_RP_SAFE 4236 8.55 2.66 10.46 78 RCVD_IN_IADB_SPF 4102 4.40 2.58 5.00 79 XMMoneyMeta_00 4087 1.07 2.57 0.58 80 FROM_SUSPICIOUS_NTLD 4053 0.69 2.55 0.09 81 XMBody_78 3972 1.03 2.50 0.55 82 XMBdyGiftCard01 3966 1.28 2.49 0.89 83 RCVD_IN_IADB_SENDERID 3940 3.88 2.48 4.34 84 RCVD_IN_IADB_DK 3896 3.79 2.45 4.22 85 DKIM_ADSP_NXDOMAIN 3802 0.91 2.39 0.42 86 NO_DNS_FOR_FROM 3690 1.42 2.32 1.13 87 RCVD_IN_PSBL 3641 0.59 2.29 0.04 88 XMSubMetaI_00 3620 1.06 2.27 0.66 89 XM_OfRef6 3595 1.92 2.26 1.81 90 TR_XM_PHPDW 3549 1.10 2.23 0.74 91 TR_XM_PHPForged 3530 1.09 2.22 0.72 92 SUBJ_ALL_CAPS 3504 2.19 2.20 2.18 93 TR_XM_FormFill2 3473 1.08 2.18 0.72 94 XM_H_PHPOS 3451 1.07 2.17 0.72 95 SpammyFromTLD_01 3410 1.09 2.14 0.75 96 HTML_MIME_NO_HTML_TAG 3326 2.50 2.09 2.64 97 MIME_HEADER_CTYPE_ONLY 3317 0.59 2.08 0.11 98 SpammyFromTLD_02 3312 0.75 2.08 0.32 99 RCVD_IN_RP_CERTIFIED 3178 7.64 2.00 9.47 100 MAILING_LIST_MULTI 3154 2.42 1.98 2.56 101 ALL_TRUSTED 3130 12.66 1.97 16.13 102 MultiRelay_CC 3122 0.65 1.96 0.22 103 MultiRelay_Combo 3122 0.65 1.96 0.22 104 NORDNS_LOW_CONTRAST 3117 0.49 1.96 0.01 105 RCVD_IN_RP_RNBL 3078 0.50 1.93 0.03 106 DATE_IN_PAST_03_06 2989 0.54 1.88 0.11 107 XMBody_17 2920 0.86 1.83 0.55 108 T_HTML_TAG_BALANCE_CENTER 2890 0.50 1.82 0.08 109 XMGenDplmaNmb 2874 1.51 1.81 1.41 110 TR_Mismatch_TLD_01 2819 0.55 1.77 0.15 111 XMSubMetaSxObfu_03 2768 0.84 1.74 0.54 112 URI_TRY_3LD 2728 1.38 1.71 1.27 113 XM_UB60 2696 0.49 1.69 0.09 114 XM_DK_Undo_01 2644 1.63 1.66 1.62 115 XM_UB99 2578 0.40 1.62 0.01 116 XMHTML_After_End 2547 0.67 1.60 0.36 117 HTML_IMAGE_ONLY_32 2521 0.69 1.58 0.40 118 RELAYCOUNTRY_FR 2486 0.55 1.56 0.22 119 XMStockSpam_06 2450 1.40 1.54 1.36 120 TM2_M_VERY_LONG_WORD 2438 1.34 1.53 1.27 121 DATE_IN_PAST_06_12 2412 0.41 1.52 0.05 122 T_XMDrugObfuBody_00 2338 1.32 1.47 1.27 123 TR_XM_RelayPhish 2320 1.06 1.46 0.93 124 TR_XM_DK_SendGrid 2316 2.77 1.45 3.19 125 XM_H_Long_From02 2280 1.20 1.43 1.13 126 XM_DrugUnitList 2226 0.34 1.40 0.00 127 BAYES_40 2225 3.49 1.40 4.17 128 T_XMHurry_00 2022 0.80 1.27 0.65 129 XM_ProductURIs 1984 1.02 1.25 0.95 130 T_Symld_Words_02 1981 0.76 1.24 0.60 131 XM_UB999 1975 0.31 1.24 0.01 132 RELAYCOUNTRY_GB 1970 1.17 1.24 1.15 133 RCVD_IN_IADB_VOUCHED 1942 3.33 1.22 4.01 134 TR_LOTS_OF_MONEY2 1939 0.82 1.22 0.69 135 T_MONEY_PERCENT 1939 0.82 1.22 0.69 136 HTML_FONT_SIZE_LARGE 1886 0.39 1.18 0.13 137 UNPARSEABLE_RELAY 1846 2.16 1.16 2.48 138 T_TooManySym_02 1832 1.59 1.15 1.73 139 XMSexyCombo_04 1823 0.37 1.15 0.12 140 XM_H_PHPMailer 1820 0.64 1.14 0.48 141 TR_Symld_Words 1797 1.53 1.13 1.67 142 T_FILL_THIS_FORM_SHORT 1786 1.16 1.12 1.18 143 TR_LOTS_OF_MONEY3 1783 0.64 1.12 0.49 144 DKIM_ADSP_CUSTOM_MED 1757 1.06 1.10 1.04 145 XMHTMLBadTable_001 1738 0.58 1.09 0.41 146 XMPhish30 1736 0.67 1.09 0.54 147 HTML_FONT_FACE_BAD 1732 0.68 1.09 0.54 148 URIBL_BLACK 1728 0.31 1.09 0.06 149 XMPhish11 1727 1.18 1.08 1.21 150 BAYES_20 1720 2.67 1.08 3.19 151 XM_UB80 1712 0.28 1.08 0.03 152 DATE_IN_PAST_12_24 1681 0.32 1.06 0.09 153 DIET_1 1673 0.45 1.05 0.26 154 LONG_HEX_URI 1645 0.42 1.03 0.22 155 XMBrknScrpt_02 1629 0.89 1.02 0.85 156 XM_HighProb1 1618 0.26 1.02 0.01 157 TR_Mismatch_TLD_02 1597 0.30 1.00 0.07 158 NML_ADSP_CUSTOM_MED 1565 0.79 0.98 0.73 159 XMSubMetaSSx_00 1535 0.43 0.96 0.26 160 HK_RANDOM_FROM 1517 0.35 0.95 0.16 161 XM_H_PHPOS_M 1494 0.35 0.94 0.16 162 URI_NOVOWEL 1492 0.49 0.94 0.35 163 TM2_M_A_HREF_HREF 1481 0.68 0.93 0.60 164 RELAYCOUNTRY_AT 1454 0.35 0.91 0.16 165 TR_Caps_n_Bayes_99 1442 0.30 0.91 0.11 166 BODY_URI_ONLY 1436 0.31 0.90 0.12 167 REMOVE_BEFORE_LINK 1402 0.43 0.88 0.29 168 XMSlimDrugH 1361 0.46 0.86 0.34 169 BODY_ENHANCEMENT 1349 0.23 0.85 0.03 170 RDNS_DYNAMIC 1301 0.52 0.82 0.42 171 HTML_TAG_BALANCE_BODY 1287 0.50 0.81 0.40 172 XM_XX_Yahoo 1286 0.32 0.81 0.16 173 LongTLD 1284 0.30 0.81 0.14 174 FORGED_GMAIL_RCVD 1266 0.56 0.80 0.49 175 URI_PHP_REDIR 1257 0.20 0.79 0.00 176 FILL_THIS_FORM 1155 0.65 0.73 0.63 177 XM_H_TOP 1145 0.18 0.72 0.01 178 SHORT_URI_3 1137 0.31 0.71 0.18 179 XM_UB95 1128 0.19 0.71 0.02 180 FROM_GOV_DKIM_AU 1125 0.51 0.71 0.45 181 BAYES_00 1112 10.06 0.70 13.09 182 RELAYCOUNTRY_IN 1104 0.28 0.69 0.14 183 XM_B_REG_HTML 1083 0.45 0.68 0.37 184 XMSubNoVowel 1059 0.46 0.67 0.39 185 TR_MetaPhish_Combo_01 1036 1.43 0.65 1.69 186 RELAYCOUNTRY_CN 1024 0.23 0.64 0.09 187 URIBL_DBL_SPAM 1022 0.16 0.64 0.01 188 XMPhish14 1018 0.42 0.64 0.35 189 RCVD_IN_IADB_OPTIN 1003 2.16 0.63 2.65 190 LONG_JUNK_URI 999 0.26 0.63 0.14 191 XMGppyBdWords 996 0.32 0.63 0.23 192 XM_PDF 995 4.16 0.63 5.31 193 XM_BadFromFormat 992 0.24 0.62 0.12 194 SUBJ_DOLLARS 983 0.54 0.62 0.52 195 TooManyTo_002 977 2.03 0.61 2.49 196 XM_B_COPY_HTML 965 0.50 0.61 0.46 197 TR_M_TOP_BAYES 959 0.15 0.60 0.00 198 FILL_THIS_FORM_LONG 949 0.45 0.60 0.40 199 HK_RANDOM_REPLYTO 943 0.31 0.59 0.22 200 THIS_AD 942 0.22 0.59 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 428394 89.23 95.36 87.25 2 DKIM_SIGNED 367821 77.10 83.84 74.91 3 XM_DK_Pass 360889 74.69 78.37 73.50 4 DKIM_VALID 343019 70.94 74.27 69.86 5 DCC_CHECK_NEGATIVE 284435 48.11 17.82 57.93 6 BAYES_50 256355 47.69 33.75 52.21 7 XMListUnsubscribeExists 252821 57.60 76.45 51.49 8 DKIM_VALID_AU 246058 52.00 57.81 50.11 9 DCC_CHECK 196461 49.94 80.59 40.01 10 T_TM2_M_HEADER_IN_MSG 151207 28.22 20.26 30.79 11 HTML_FONT_LOW_CONTRAST 140741 30.40 35.77 28.66 12 DKIM_VALID_EF 131341 25.53 21.76 26.75 13 XMSubLong 109738 23.43 26.77 22.35 14 FVGT_m_MULTI_ODD 107941 23.44 27.95 21.98 15 LOC_TINY_FONT_1 107506 24.66 33.19 21.89 16 MIME_HTML_ONLY 99841 23.14 31.79 20.33 17 MultiRelay 93636 18.24 15.68 19.07 18 T_KAM_HTML_FONT_INVALID 85163 18.43 21.79 17.34 19 ALL_TRUSTED 79213 12.66 1.97 16.13 20 XM_Body_Dirty_Words 66973 15.45 21.05 13.64 21 XM_DK_Undo_02 66466 22.50 50.15 13.54 22 BAYES_00 64274 10.06 0.70 13.09 23 BAYES_99 57310 19.96 45.52 11.67 24 XM_Multi_Part_URI 56046 12.72 16.74 11.41 25 TR_XM_DK_Bayes 51732 8.07 0.48 10.54 26 RCVD_IN_RP_SAFE 51361 8.55 2.66 10.46 27 BAYES_999 50349 17.19 38.58 10.25 28 TR_XM_DK_Bayes1 49144 7.66 0.42 10.01 29 LOTS_OF_MONEY 47252 10.48 13.12 9.62 30 RCVD_IN_RP_CERTIFIED 46489 7.64 2.00 9.47 31 T_XMDrugObfuBody_14 44602 8.82 8.01 9.08 32 XM_Evil_Numbers_Gen 44115 9.71 11.95 8.98 33 TooManyTo_001 42066 8.34 7.64 8.57 34 HTML_IMAGE_RATIO_02 41729 10.09 15.01 8.50 35 TR_XM_DK_Bayes2 41644 6.49 0.35 8.48 36 XM_DKIMWhitelistDomains 39920 6.14 0.02 8.13 37 LotsOfNums_01 38567 8.29 9.64 7.85 38 FSL_BULK_SIG 34255 7.93 10.86 6.98 39 XM_H_Long_From01 32736 6.66 6.64 6.67 40 BAYES_60 32599 6.45 5.85 6.64 41 XM_SendGrid 32170 5.75 3.28 6.55 42 XM_B_Phish_Phrases 30069 6.29 6.82 6.12 43 RCVD_IN_IADB_LISTED 28588 5.12 2.94 5.82 44 HTML_IMAGE_RATIO_04 28484 6.01 6.67 5.80 45 MIME_QP_LONG_LINE 27970 5.99 6.91 5.70 46 T_TooManySym_01 26934 4.98 3.43 5.49 47 TR_DCC_Bayes_99 26240 12.98 36.54 5.34 48 XM_PDF 26056 4.16 0.63 5.31 49 RELAYCOUNTRY_META 25345 8.01 16.79 5.16 50 DKIM_INVALID 24802 6.16 9.58 5.05 51 RCVD_IN_IADB_SPF 24527 4.40 2.58 5.00 52 BOTNET_IPINHOSTNAME 23352 7.20 14.76 4.76 53 T_REMOTE_IMAGE 22303 4.28 3.46 4.54 54 RCVD_IN_MSPIKE_H2 21452 3.97 2.73 4.37 55 RCVD_IN_IADB_SENDERID 21301 3.88 2.48 4.34 56 FROM_EXCESS_BASE64 21274 4.56 5.25 4.33 57 RCVD_IN_IADB_DK 20738 3.79 2.45 4.22 58 BAYES_40 20463 3.49 1.40 4.17 59 BAYES_80 20076 4.78 6.89 4.09 60 RCVD_IN_IADB_VOUCHED 19685 3.33 1.22 4.01 61 XMStrtUSub 19112 3.67 3.00 3.89 62 IN_ZIMBRA_NJ_WHITELIST 19101 2.94 0.03 3.89 63 XMSexyCombo_05 18892 5.17 9.26 3.85 64 HTML_IMAGE_RATIO_06 17104 4.04 5.77 3.48 65 TO_MALFORMED 16884 2.61 0.06 3.44 66 MPART_ALT_DIFF 16825 4.44 7.58 3.43 67 XMSubMetaSx_00 16812 4.41 7.44 3.42 68 TR_XM_DK_SendGrid 15676 2.77 1.45 3.19 69 BAYES_20 15644 2.67 1.08 3.19 70 XM_UncommonTLD01 15562 4.99 10.61 3.17 71 XM_B_SpammyTLD 15280 3.21 3.50 3.11 72 XMNumbers 14439 3.02 3.28 2.94 73 BAYES_95 13119 3.03 4.15 2.67 74 RCVD_IN_IADB_OPTIN 13016 2.16 0.63 2.65 75 HTML_MIME_NO_HTML_TAG 12952 2.50 2.09 2.64 76 MAILING_LIST_MULTI 12591 2.42 1.98 2.56 77 TooManyTo_002 12216 2.03 0.61 2.49 78 XM_DIRTYINTL 12201 3.07 4.89 2.48 79 UNPARSEABLE_RELAY 12167 2.16 1.16 2.48 80 HTML_IMAGE_RATIO_08 11491 2.82 4.31 2.34 81 XMDiploma_00 10918 2.44 3.10 2.22 82 MIME_HTML_MOSTLY 10737 2.67 4.17 2.19 83 SUBJ_ALL_CAPS 10727 2.19 2.20 2.18 84 TVD_RCVD_IP 10690 1.74 0.37 2.18 85 RCVD_IN_MSPIKE_WL 10387 1.69 0.39 2.12 86 RCVD_IN_MSPIKE_H3 10364 1.69 0.39 2.11 87 BAYES_05 10036 1.67 0.52 2.04 88 URI_HEX 9811 2.28 3.17 2.00 89 BOTNET 9712 6.19 19.20 1.98 90 MIME_HTML_ONLY_MULTI 9599 2.45 3.97 1.95 91 XM_CamelCaseFrm001 9477 2.48 4.17 1.93 92 TM2_M_URI_OPT_OUT 9099 2.27 3.56 1.85 93 XM_SPF_SoftFail 8910 2.21 3.42 1.81 94 XM_OfRef6 8863 1.92 2.26 1.81 95 HELO_NODOT 8728 1.47 0.52 1.78 96 HELO_NO_DOMAIN 8727 1.47 0.52 1.78 97 T_TooManySym_02 8516 1.59 1.15 1.73 98 ANY_BOUNCE_MESSAGE 8386 1.39 0.42 1.71 99 BOUNCE_MESSAGE 8384 1.39 0.42 1.71 100 TR_MetaPhish_Combo_01 8289 1.43 0.65 1.69 101 TooManyTo_003 8203 1.38 0.47 1.67 102 TR_Symld_Words 8180 1.53 1.13 1.67 103 IN_HORDE_ADDRESS_BOOK 8137 1.26 0.03 1.66 104 XM_DK_Undo_01 7936 1.63 1.66 1.62 105 T_XMDrugObfuBody_08 7719 1.85 2.70 1.57 106 INVALID_MSGID 7434 1.18 0.15 1.51 107 UNTRUSTED_Relay 7124 3.51 9.87 1.45 108 XMGenDplmaNmb 6914 1.51 1.81 1.41 109 XMCapTrack 6823 1.11 0.26 1.39 110 RELAYCOUNTRY_CA 6673 1.91 3.62 1.36 111 XMStockSpam_06 6667 1.40 1.54 1.36 112 USER_IN_DEF_DKIM_WL 6646 1.03 0.02 1.35 113 TM2_M_VERY_LONG_WORD 6256 1.34 1.53 1.27 114 T_XMDrugObfuBody_00 6244 1.32 1.47 1.27 115 URI_TRY_3LD 6226 1.38 1.71 1.27 116 XMPhish11 5965 1.18 1.08 1.21 117 TooManyTo_004 5893 1.00 0.37 1.20 118 T_FILL_THIS_FORM_SHORT 5788 1.16 1.12 1.18 119 XM_GoogleGroups 5765 1.00 0.46 1.17 120 RELAYCOUNTRY_GB 5636 1.17 1.24 1.15 121 NO_DNS_FOR_FROM 5561 1.42 2.32 1.13 122 XM_H_Long_From02 5532 1.20 1.43 1.13 123 DKIM_ADSP_CUSTOM_MED 5111 1.06 1.10 1.04 124 TooManyTo_005 4828 0.82 0.32 0.98 125 XM_ProductURIs 4668 1.02 1.25 0.95 126 TR_XM_RelayPhish 4543 1.06 1.46 0.93 127 XM_UB50 4508 1.76 4.36 0.92 128 XMSolicitRefs_0 4459 0.80 0.48 0.91 129 XMBdyGiftCard01 4372 1.28 2.49 0.89 130 XMGappySubj_01 4369 0.77 0.38 0.89 131 RCVD_IN_BL_SPAMCOP_NET 4246 1.98 5.42 0.86 132 XMBrknScrpt_02 4185 0.89 1.02 0.85 133 SpammyFromTLD_01 3689 1.09 2.14 0.75 134 TR_XM_PHPDW 3618 1.10 2.23 0.74 135 HTTPS_HTTP_MISMATCH 3611 0.69 0.53 0.74 136 NML_ADSP_CUSTOM_MED 3590 0.79 0.98 0.73 137 TR_XM_PHPForged 3557 1.09 2.22 0.72 138 TR_XM_FormFill2 3548 1.08 2.18 0.72 139 XM_H_PHPOS 3531 1.07 2.17 0.72 140 TR_LOTS_OF_MONEY2 3395 0.82 1.22 0.69 141 T_MONEY_PERCENT 3395 0.82 1.22 0.69 142 XMSubMetaI_00 3246 1.06 2.27 0.66 143 XM_ShortIntro_01 3238 0.59 0.39 0.66 144 T_XMHurry_00 3208 0.80 1.27 0.65 145 FILL_THIS_FORM 3090 0.65 0.73 0.63 146 TM2_M_BODY_EMPTY 3006 0.49 0.12 0.61 147 T_OBFU_PDF_ATTACH 2983 0.50 0.15 0.61 148 TM2_M_A_HREF_HREF 2952 0.68 0.93 0.60 149 T_Symld_Words_02 2937 0.76 1.24 0.60 150 MISSING_HEADERS 2904 0.56 0.45 0.59 151 XMMoneyMeta_00 2871 1.07 2.57 0.58 152 XMBody_95 2830 0.47 0.15 0.58 153 USER_IN_WHITELIST 2826 0.43 0.00 0.58 154 XMBody_78 2718 1.03 2.50 0.55 155 PLING_QUERY 2697 0.56 0.58 0.55 156 XMBody_17 2677 0.86 1.83 0.55 157 HTML_FONT_FACE_BAD 2673 0.68 1.09 0.54 158 XMSubMetaSxObfu_03 2663 0.84 1.74 0.54 159 T_TooManySym_03 2660 0.47 0.26 0.54 160 XMPhish30 2632 0.67 1.09 0.54 161 XMGappySubj_02 2586 0.43 0.12 0.53 162 SUBJ_DOLLARS 2546 0.54 0.62 0.52 163 XMSexyCombo_01 2531 1.06 2.72 0.52 164 AC_DIV_BONANZA 2495 0.41 0.09 0.51 165 XMNoVowels 2412 0.51 0.58 0.49 166 FORGED_GMAIL_RCVD 2387 0.56 0.80 0.49 167 SHORT_HELO_AND_INLINE_IMAGE 2385 0.38 0.05 0.49 168 TR_LOTS_OF_MONEY3 2384 0.64 1.12 0.49 169 XM_H_PHPMailer 2359 0.64 1.14 0.48 170 FROM_GOV_SPOOF 2319 0.41 0.20 0.47 171 RELAYCOUNTRY_AU 2306 0.47 0.46 0.47 172 XMLngstWrd_00 2283 0.44 0.38 0.46 173 XM_B_COPY_HTML 2259 0.50 0.61 0.46 174 NUMERIC_HTTP_ADDR 2206 1.18 3.42 0.45 175 FROM_GOV_DKIM_AU 2188 0.51 0.71 0.45 176 RELAYCOUNTRY_DE 2179 1.31 3.98 0.44 177 XMLngstWrd_01 2099 0.41 0.35 0.43 178 DKIM_ADSP_NXDOMAIN 2084 0.91 2.39 0.42 179 RDNS_DYNAMIC 2079 0.52 0.82 0.42 180 XMHTMLBadTable_001 2004 0.58 1.09 0.41 181 HTML_IMAGE_ONLY_32 1986 0.69 1.58 0.40 182 HTML_TAG_BALANCE_BODY 1968 0.50 0.81 0.40 183 FILL_THIS_FORM_LONG 1963 0.45 0.60 0.40 184 FILL_THIS_FORM_LOAN 1937 0.41 0.45 0.39 185 XMSubNoVowel 1900 0.46 0.67 0.39 186 XM_Body_Obfu01 1887 0.40 0.46 0.38 187 XMDateMe_00 1885 0.37 0.31 0.38 188 XM_URI_RBL 1879 1.10 3.33 0.38 189 XM_USANA_RCVD 1848 0.28 0.00 0.38 190 RCVD_IN_SORBS_DUL 1844 0.34 0.23 0.38 191 HTML_IMAGE_ONLY_28 1828 0.41 0.53 0.37 192 XM_B_REG_HTML 1818 0.45 0.68 0.37 193 XMLKML 1789 0.28 0.00 0.36 194 XMHTML_After_End 1781 0.67 1.60 0.36 195 XM_D_tchamptons_WL 1731 0.27 0.00 0.35 196 XMPhish14 1722 0.42 0.64 0.35 197 URI_NOVOWEL 1719 0.49 0.94 0.35 198 FSL_THIS_IS_ADV 1675 0.38 0.51 0.34 199 XMSlimDrugH 1662 0.46 0.86 0.34 200 XM_B_Crypto 1659 0.31 0.20 0.34 ----------------------------------------------------------------------