Email: 632389 Autolearn: 0 AvgScore: 2.92 AvgScanTime: 2.10 sec Spam: 163093 Autolearn: 0 AvgScore: 12.52 AvgScanTime: 2.47 sec Ham: 469296 Autolearn: 0 AvgScore: -0.42 AvgScanTime: 1.98 sec Time Spent Running SA: 369.29 hours Time Spent Processing Spam: 111.76 hours Time Spent Processing Ham: 257.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150790 89.47 92.46 88.43 2 DKIM_SIGNED 129267 76.97 79.26 76.17 3 DCC_CHECK 127475 49.71 78.16 39.82 4 XM_DK_Pass 122823 74.81 75.31 74.63 5 XMListUnsubscribeExists 121972 56.81 74.79 50.57 6 DKIM_VALID 116459 71.01 71.41 70.88 7 DKIM_VALID_AU 89013 52.11 54.58 51.25 8 XM_DK_Undo_02 75255 21.41 46.14 12.81 9 BAYES_99 67422 19.13 41.34 11.41 10 BAYES_50 57438 49.08 35.22 53.90 11 BAYES_999 56902 16.44 34.89 10.03 12 HTML_FONT_LOW_CONTRAST 56004 29.57 34.34 27.92 13 TR_DCC_Bayes_99 54460 12.64 33.39 5.43 14 LOC_TINY_FONT_1 51925 24.66 31.84 22.17 15 MIME_HTML_ONLY 48949 22.63 30.01 20.07 16 XMSubLong 42721 23.45 26.19 22.49 17 FVGT_m_MULTI_ODD 42480 22.48 26.05 21.24 18 DKIM_VALID_EF 35547 26.96 21.80 28.76 19 T_KAM_HTML_FONT_INVALID 34812 18.72 21.34 17.81 20 T_TM2_M_HEADER_IN_MSG 34623 28.65 21.23 31.23 21 XM_Body_Dirty_Words 34513 15.11 21.16 13.01 22 RELAYCOUNTRY_META 33589 9.64 20.59 5.83 23 DCC_CHECK_NEGATIVE 32559 48.24 19.96 58.06 24 BOTNET_IPINHOSTNAME 31056 8.30 19.04 4.57 25 BOTNET 29952 6.00 18.36 1.71 26 XM_Multi_Part_URI 26377 12.66 16.17 11.43 27 MultiRelay 25980 18.83 15.93 19.84 28 HTML_IMAGE_RATIO_02 23717 9.97 14.54 8.37 29 UNTRUSTED_Relay 23479 5.22 14.40 2.02 30 LOTS_OF_MONEY 22841 10.57 14.00 9.37 31 FSL_BULK_SIG 20240 8.36 12.41 6.95 32 XM_Evil_Numbers_Gen 19892 9.61 12.20 8.70 33 XM_UncommonTLD01 18521 5.41 11.36 3.35 34 XMSexyCombo_05 16752 5.57 10.27 3.94 35 LotsOfNums_01 15216 8.51 9.33 8.22 36 T_XMDrugObfuBody_14 13260 8.03 8.13 7.99 37 DKIM_INVALID 12808 5.95 7.85 5.29 38 XM_UB50 12703 3.12 7.79 1.50 39 TooManyTo_001 12245 8.29 7.51 8.56 40 XM_H_Long_From01 12130 6.77 7.44 6.54 41 BAYES_80 12095 4.71 7.42 3.77 42 HTML_IMAGE_RATIO_04 11841 5.99 7.26 5.56 43 XMSubMetaSx_00 11744 4.66 7.20 3.77 44 MPART_ALT_DIFF 11615 4.18 7.12 3.15 45 XM_B_Phish_Phrases 10559 5.37 6.47 4.99 46 BAYES_60 10491 6.27 6.43 6.21 47 XM_B_SpammyTLD 9443 3.87 5.79 3.20 48 FROM_EXCESS_BASE64 8492 3.91 5.21 3.46 49 HTML_MIME_NO_HTML_TAG 8388 3.35 5.14 2.73 50 SpammyFromTLD_02 8340 1.58 5.11 0.35 51 XM_DIRTYINTL 8216 3.09 5.04 2.42 52 RELAYCOUNTRY_FR 8186 1.52 5.02 0.31 53 MIME_QP_LONG_LINE 8141 5.54 4.99 5.73 54 XM_SPF_SoftFail 7551 2.62 4.63 1.92 55 XM_OfRef6 7429 2.34 4.56 1.57 56 HTML_IMAGE_RATIO_06 7093 3.84 4.35 3.67 57 BAYES_95 6578 2.95 4.03 2.57 58 FROM_SUSPICIOUS_NTLD 6540 1.06 4.01 0.04 59 XMNumbers 6488 3.12 3.98 2.82 60 T_REMOTE_IMAGE 6482 4.30 3.97 4.41 61 XM_SendGrid 6372 5.77 3.91 6.42 62 MIME_HTML_ONLY_MULTI 6219 2.24 3.81 1.70 63 MIME_HTML_MOSTLY 6187 2.60 3.79 2.18 64 RELAYCOUNTRY_CA 6090 2.08 3.73 1.51 65 RCVD_IN_RP_RNBL 6053 1.03 3.71 0.10 66 RCVD_IN_BL_SPAMCOP_NET 6035 1.35 3.70 0.54 67 XMStrtUSub 5928 4.12 3.63 4.29 68 BOTNET_NORDNS 5832 0.94 3.58 0.02 69 KHOP_HELO_FCRDNS 5626 2.48 3.45 2.14 70 TM2_M_URI_OPT_OUT 5582 2.18 3.42 1.74 71 SUBJ_ALL_CAPS 5438 2.41 3.33 2.08 72 XMDiploma_00 5394 2.37 3.31 2.04 73 XM_CamelCaseFrm001 5375 2.49 3.30 2.20 74 DKIM_ADSP_NXDOMAIN 5336 1.33 3.27 0.66 75 URI_HEX 5243 2.26 3.21 1.93 76 XM_URI_RBL 5233 1.15 3.21 0.43 77 RCVD_IN_RP_SAFE 5106 8.51 3.13 10.38 78 RCVD_IN_PSBL 4973 0.84 3.05 0.08 79 T_TooManySym_01 4880 4.78 2.99 5.40 80 TR_XM_PHPDW 4505 1.40 2.76 0.93 81 FILL_THIS_FORM 4504 1.08 2.76 0.49 82 RCVD_IN_IADB_LISTED 4457 4.95 2.73 5.71 83 TR_XM_PHPForged 4455 1.37 2.73 0.90 84 RCVD_IN_MSPIKE_H2 4424 3.95 2.71 4.38 85 TR_XM_FormFill2 4412 1.36 2.71 0.89 86 XM_H_PHPOS 4389 1.35 2.69 0.89 87 MultiRelay_CC 4312 0.85 2.64 0.23 88 MultiRelay_Combo 4312 0.85 2.64 0.23 89 HTML_IMAGE_RATIO_08 4163 2.25 2.55 2.15 90 RCVD_IN_RP_CERTIFIED 4099 7.61 2.51 9.38 91 RCVD_IN_IADB_SPF 3954 4.31 2.42 4.97 92 T_XMDrugObfuBody_08 3940 1.81 2.42 1.60 93 TR_Symld_Words 3928 1.96 2.41 1.80 94 XMSexyCombo_01 3763 1.08 2.31 0.66 95 RELAYCOUNTRY_NL 3760 0.74 2.31 0.20 96 URI_TRY_3LD 3728 1.51 2.29 1.24 97 RCVD_IN_IADB_DK 3727 3.73 2.29 4.24 98 RCVD_IN_IADB_SENDERID 3726 3.78 2.28 4.30 99 XM_UB99 3700 0.59 2.27 0.01 100 XM_OfRef7 3685 0.70 2.26 0.16 101 XMBdyGiftCard01 3658 1.19 2.24 0.83 102 NO_DNS_FOR_FROM 3514 1.38 2.15 1.11 103 BAYES_40 3489 3.69 2.14 4.23 104 FILL_THIS_FORM_LONG 3473 0.77 2.13 0.30 105 URIBL_DBL_ABUSE_REDIR 3283 0.53 2.01 0.02 106 MONEY_FORM 3253 0.52 1.99 0.01 107 XM_UB999 3108 0.50 1.91 0.01 108 XM_OfRef8 3084 0.51 1.89 0.03 109 MAILING_LIST_MULTI 3027 2.39 1.86 2.58 110 SpammyFromTLD_01 2944 1.17 1.81 0.95 111 TR_XM_DK_SendGrid 2880 2.73 1.77 3.07 112 T_XMDrugObfuBody_00 2878 1.50 1.76 1.41 113 ALL_TRUSTED 2830 11.55 1.74 14.96 114 XMGenDplmaNmb 2800 1.31 1.72 1.17 115 XMSubMetaI_00 2745 0.82 1.68 0.53 116 XMBody_78 2738 0.88 1.68 0.60 117 HK_SCAM 2611 0.43 1.60 0.02 118 XM_Lotto 2576 0.50 1.58 0.13 119 XM_Nigeria_01 2570 0.44 1.58 0.04 120 BAYES_20 2564 2.68 1.57 3.07 121 TM2_M_VERY_LONG_WORD 2500 1.27 1.53 1.17 122 TR_XM_RelayPhish 2425 0.93 1.49 0.74 123 BODY_URI_ONLY 2405 0.46 1.47 0.11 124 RELAYCOUNTRY_GB 2364 1.23 1.45 1.16 125 NORDNS_LOW_CONTRAST 2354 0.38 1.44 0.01 126 DATE_IN_PAST_06_12 2343 0.43 1.44 0.08 127 XM_UB60 2315 0.45 1.42 0.11 128 PDS_TO_EQ_FROM_NAME 2289 0.39 1.40 0.03 129 MONEY_FRAUD_8 2280 0.36 1.40 0.00 130 MONEY_ATM_CARD 2240 0.36 1.37 0.00 131 XM_H_PHPMailer 2228 0.77 1.37 0.56 132 DATE_IN_PAST_03_06 2192 0.46 1.34 0.15 133 MIME_HEADER_CTYPE_ONLY 2188 0.44 1.34 0.12 134 ADVANCE_FEE_5_NEW_FRM_MNY 2187 0.35 1.34 0.00 135 XMBody_17 2130 0.71 1.31 0.50 136 XM_ProductURIs 2104 0.96 1.29 0.85 137 XMPhish11 2092 1.27 1.28 1.27 138 T_XMHurry_00 1999 0.70 1.23 0.51 139 DIET_1 1997 0.52 1.22 0.27 140 RELAYCOUNTRY_IN 1995 0.40 1.22 0.11 141 XMHTML_After_End 1993 0.58 1.22 0.36 142 FILL_THIS_FORM_LOAN 1978 0.53 1.21 0.30 143 XMStockSpam_06 1976 1.17 1.21 1.16 144 XM_DK_Undo_01 1976 1.57 1.21 1.70 145 RELAYCOUNTRY_DE 1964 1.09 1.20 1.05 146 HTML_SHORT_LINK_IMG_1 1933 0.33 1.19 0.03 147 RCVD_IN_IADB_VOUCHED 1922 3.19 1.18 3.89 148 HDRS_LCASE_IMGONLY 1912 0.33 1.17 0.04 149 UNPARSEABLE_RELAY 1911 2.19 1.17 2.54 150 XM_H_Long_From02 1907 1.25 1.17 1.28 151 XMPhish30 1868 0.70 1.15 0.55 152 XM_BadFromFormat 1867 0.37 1.14 0.10 153 TR_Mismatch_TLD_02 1855 0.34 1.14 0.07 154 XMSlimDrugH 1850 0.52 1.13 0.31 155 XMSexyCombo_04 1850 0.37 1.13 0.11 156 XMBrknScrpt_02 1835 0.69 1.13 0.55 157 URIBL_BLACK 1793 0.32 1.10 0.05 158 XM_HighProb1 1776 0.29 1.09 0.01 159 FROM_MISSP_REPLYTO 1739 0.29 1.07 0.01 160 XM_UB80 1695 0.29 1.04 0.03 161 TR_LOTS_OF_MONEY2 1688 0.57 1.03 0.41 162 T_MONEY_PERCENT 1688 0.57 1.03 0.41 163 XM_B_REG_HTML 1664 0.54 1.02 0.37 164 T_Symld_Words_02 1638 0.90 1.00 0.86 165 PLING_QUERY 1624 0.58 1.00 0.43 166 XM_H_PHPOS_M 1595 0.40 0.98 0.20 167 TR_LOTS_OF_MONEY3 1574 0.49 0.97 0.33 168 HTML_FONT_FACE_BAD 1557 0.61 0.95 0.50 169 HELO_NODOT 1550 1.64 0.95 1.88 170 HELO_NO_DOMAIN 1534 1.64 0.94 1.88 171 XMHTMLBadTable_001 1514 0.61 0.93 0.50 172 XMClaimOffer 1507 0.36 0.92 0.16 173 HTML_IMAGE_ONLY_28 1500 0.52 0.92 0.38 174 HTML_IMAGE_ONLY_24 1483 0.54 0.91 0.41 175 XMMoneyMeta_00 1476 0.67 0.91 0.59 176 DKIM_ADSP_CUSTOM_MED 1470 0.98 0.90 1.01 177 XMSubMetaSxObfu_03 1447 0.55 0.89 0.44 178 HK_RANDOM_FROM 1441 0.35 0.88 0.16 179 HTML_IMAGE_ONLY_08 1438 0.32 0.88 0.13 180 BAYES_05 1400 1.70 0.86 1.99 181 T_FILL_THIS_FORM_SHORT 1391 0.94 0.85 0.97 182 T_TooManySym_02 1384 1.44 0.85 1.65 183 EBAY_IMG_NOT_RCVD_EBAY 1380 0.22 0.85 0.00 184 BODY_ENHANCEMENT 1376 0.24 0.84 0.03 185 TR_MetaPhish_Combo_01 1372 1.42 0.84 1.62 186 HOSTED_IMG_DIRECT_MX 1359 0.22 0.83 0.00 187 SHORT_URI_3 1356 0.35 0.83 0.18 188 URIBL_DBL_SPAM 1299 0.21 0.80 0.01 189 URI_NOVOWEL 1296 0.50 0.79 0.40 190 TM2_M_BODY_EMPTY 1287 0.62 0.79 0.56 191 BAYES_00 1282 9.46 0.79 12.47 192 XM_H_TOP 1276 0.21 0.78 0.01 193 XM_XX_Yahoo 1239 0.32 0.76 0.17 194 TR_Mismatch_TLD_01 1208 0.31 0.74 0.16 195 XMEmptyBody_01 1191 0.38 0.73 0.25 196 TR_M_TOP_BAYES 1191 0.19 0.73 0.00 197 SUBJ_DOLLARS 1189 0.44 0.73 0.34 198 FORGED_GMAIL_RCVD 1180 0.48 0.72 0.40 199 SHORT_IMG_SUSP_NTLD 1174 0.19 0.72 0.00 200 FROM_NTLD_LINKBAIT 1173 0.19 0.72 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 415019 89.47 92.46 88.43 2 DKIM_SIGNED 357467 76.97 79.26 76.17 3 XM_DK_Pass 350251 74.81 75.31 74.63 4 DKIM_VALID 332618 71.01 71.41 70.88 5 DCC_CHECK_NEGATIVE 272495 48.24 19.96 58.06 6 BAYES_50 252939 49.08 35.22 53.90 7 DKIM_VALID_AU 240504 52.11 54.58 51.25 8 XMListUnsubscribeExists 237314 56.81 74.79 50.57 9 DCC_CHECK 186858 49.71 78.16 39.82 10 T_TM2_M_HEADER_IN_MSG 146562 28.65 21.23 31.23 11 DKIM_VALID_EF 134955 26.96 21.80 28.76 12 HTML_FONT_LOW_CONTRAST 131016 29.57 34.34 27.92 13 XMSubLong 105556 23.45 26.19 22.49 14 LOC_TINY_FONT_1 104039 24.66 31.84 22.17 15 FVGT_m_MULTI_ODD 99683 22.48 26.05 21.24 16 MIME_HTML_ONLY 94190 22.63 30.01 20.07 17 MultiRelay 93087 18.83 15.93 19.84 18 T_KAM_HTML_FONT_INVALID 83569 18.72 21.34 17.81 19 ALL_TRUSTED 70197 11.55 1.74 14.96 20 XM_Body_Dirty_Words 61065 15.11 21.16 13.01 21 XM_DK_Undo_02 60113 21.41 46.14 12.81 22 BAYES_00 58539 9.46 0.79 12.47 23 XM_Multi_Part_URI 53657 12.66 16.17 11.43 24 BAYES_99 53551 19.13 41.34 11.41 25 RCVD_IN_RP_SAFE 48715 8.51 3.13 10.38 26 BAYES_999 47077 16.44 34.89 10.03 27 TR_XM_DK_Bayes 46473 7.44 0.35 9.90 28 TR_XM_DK_Bayes1 44034 7.04 0.28 9.38 29 RCVD_IN_RP_CERTIFIED 44020 7.61 2.51 9.38 30 LOTS_OF_MONEY 43988 10.57 14.00 9.37 31 XM_Evil_Numbers_Gen 40850 9.61 12.20 8.70 32 TooManyTo_001 40173 8.29 7.51 8.56 33 HTML_IMAGE_RATIO_02 39303 9.97 14.54 8.37 34 XM_DKIMWhitelistDomains 39168 6.20 0.02 8.35 35 LotsOfNums_01 38582 8.51 9.33 8.22 36 T_XMDrugObfuBody_14 37512 8.03 8.13 7.99 37 TR_XM_DK_Bayes2 37027 5.92 0.25 7.89 38 FSL_BULK_SIG 32614 8.36 12.41 6.95 39 XM_H_Long_From01 30692 6.77 7.44 6.54 40 XM_SendGrid 30110 5.77 3.91 6.42 41 BAYES_60 29162 6.27 6.43 6.21 42 RELAYCOUNTRY_META 27368 9.64 20.59 5.83 43 MIME_QP_LONG_LINE 26887 5.54 4.99 5.73 44 RCVD_IN_IADB_LISTED 26816 4.95 2.73 5.71 45 HTML_IMAGE_RATIO_04 26070 5.99 7.26 5.56 46 TR_DCC_Bayes_99 25474 12.64 33.39 5.43 47 T_TooManySym_01 25343 4.78 2.99 5.40 48 DKIM_INVALID 24849 5.95 7.85 5.29 49 XM_B_Phish_Phrases 23426 5.37 6.47 4.99 50 RCVD_IN_IADB_SPF 23324 4.31 2.42 4.97 51 XM_PDF 23253 3.84 0.64 4.95 52 BOTNET_IPINHOSTNAME 21431 8.30 19.04 4.57 53 TO_MALFORMED 20728 3.30 0.07 4.42 54 T_REMOTE_IMAGE 20691 4.30 3.97 4.41 55 RCVD_IN_MSPIKE_H2 20549 3.95 2.71 4.38 56 RCVD_IN_IADB_SENDERID 20181 3.78 2.28 4.30 57 XMStrtUSub 20138 4.12 3.63 4.29 58 RCVD_IN_IADB_DK 19878 3.73 2.29 4.24 59 BAYES_40 19874 3.69 2.14 4.23 60 IN_ZIMBRA_NJ_WHITELIST 19787 3.13 0.02 4.22 61 XMSexyCombo_05 18467 5.57 10.27 3.94 62 RCVD_IN_IADB_VOUCHED 18279 3.19 1.18 3.89 63 XMSubMetaSx_00 17700 4.66 7.20 3.77 64 BAYES_80 17687 4.71 7.42 3.77 65 HTML_IMAGE_RATIO_06 17218 3.84 4.35 3.67 66 FROM_EXCESS_BASE64 16233 3.91 5.21 3.46 67 XM_UncommonTLD01 15698 5.41 11.36 3.35 68 XM_B_SpammyTLD 15021 3.87 5.79 3.20 69 MPART_ALT_DIFF 14796 4.18 7.12 3.15 70 TR_XM_DK_SendGrid 14409 2.73 1.77 3.07 71 BAYES_20 14389 2.68 1.57 3.07 72 XMNumbers 13254 3.12 3.98 2.82 73 HTML_MIME_NO_HTML_TAG 12801 3.35 5.14 2.73 74 MAILING_LIST_MULTI 12091 2.39 1.86 2.58 75 BAYES_95 12083 2.95 4.03 2.57 76 UNPARSEABLE_RELAY 11936 2.19 1.17 2.54 77 RCVD_IN_IADB_OPTIN 11782 2.03 0.66 2.51 78 TooManyTo_002 11395 1.97 0.65 2.43 79 XM_DIRTYINTL 11335 3.09 5.04 2.42 80 TVD_RCVD_IP 10488 1.74 0.31 2.23 81 XM_CamelCaseFrm001 10342 2.49 3.30 2.20 82 MIME_HTML_MOSTLY 10243 2.60 3.79 2.18 83 HTML_IMAGE_RATIO_08 10092 2.25 2.55 2.15 84 KHOP_HELO_FCRDNS 10063 2.48 3.45 2.14 85 RCVD_IN_MSPIKE_WL 10041 1.69 0.41 2.14 86 RCVD_IN_MSPIKE_H3 10041 1.69 0.41 2.14 87 SUBJ_ALL_CAPS 9776 2.41 3.33 2.08 88 ANY_BOUNCE_MESSAGE 9656 1.61 0.34 2.06 89 BOUNCE_MESSAGE 9652 1.61 0.34 2.06 90 XMDiploma_00 9566 2.37 3.31 2.04 91 UNTRUSTED_Relay 9501 5.22 14.40 2.02 92 BAYES_05 9346 1.70 0.86 1.99 93 URI_HEX 9034 2.26 3.21 1.93 94 XM_SPF_SoftFail 9004 2.62 4.63 1.92 95 HELO_NODOT 8809 1.64 0.95 1.88 96 HELO_NO_DOMAIN 8808 1.64 0.94 1.88 97 TR_Symld_Words 8460 1.96 2.41 1.80 98 TM2_M_URI_OPT_OUT 8187 2.18 3.42 1.74 99 IN_HORDE_ADDRESS_BOOK 8119 1.29 0.04 1.73 100 BOTNET 8013 6.00 18.36 1.71 101 MIME_HTML_ONLY_MULTI 7970 2.24 3.81 1.70 102 XM_DK_Undo_01 7969 1.57 1.21 1.70 103 T_TooManySym_02 7723 1.44 0.85 1.65 104 TooManyTo_003 7627 1.34 0.50 1.63 105 TR_MetaPhish_Combo_01 7626 1.42 0.84 1.62 106 INVALID_MSGID 7598 1.23 0.10 1.62 107 T_XMDrugObfuBody_08 7525 1.81 2.42 1.60 108 XM_OfRef6 7362 2.34 4.56 1.57 109 XMCapTrack 7184 1.21 0.29 1.53 110 RELAYCOUNTRY_CA 7071 2.08 3.73 1.51 111 XM_UB50 7025 3.12 7.79 1.50 112 T_XMDrugObfuBody_00 6616 1.50 1.76 1.41 113 XM_H_Long_From02 6017 1.25 1.17 1.28 114 XMPhish11 5958 1.27 1.28 1.27 115 URI_TRY_3LD 5833 1.51 2.29 1.24 116 USER_IN_DEF_DKIM_WL 5694 0.90 0.01 1.21 117 XM_GoogleGroups 5678 1.01 0.45 1.21 118 TooManyTo_004 5651 0.99 0.38 1.20 119 TM2_M_VERY_LONG_WORD 5508 1.27 1.53 1.17 120 XMGenDplmaNmb 5482 1.31 1.72 1.17 121 XMStockSpam_06 5445 1.17 1.21 1.16 122 RELAYCOUNTRY_GB 5427 1.23 1.45 1.16 123 NO_DNS_FOR_FROM 5205 1.38 2.15 1.11 124 RELAYCOUNTRY_DE 4930 1.09 1.20 1.05 125 DKIM_ADSP_CUSTOM_MED 4759 0.98 0.90 1.01 126 TooManyTo_005 4725 0.83 0.32 1.01 127 T_FILL_THIS_FORM_SHORT 4562 0.94 0.85 0.97 128 SpammyFromTLD_01 4443 1.17 1.81 0.95 129 TR_XM_PHPDW 4348 1.40 2.76 0.93 130 TR_XM_PHPForged 4207 1.37 2.73 0.90 131 TR_XM_FormFill2 4188 1.36 2.71 0.89 132 XM_H_PHPOS 4172 1.35 2.69 0.89 133 T_Symld_Words_02 4041 0.90 1.00 0.86 134 XM_ProductURIs 3998 0.96 1.29 0.85 135 XMBdyGiftCard01 3875 1.19 2.24 0.83 136 T_OBFU_PDF_ATTACH 3635 0.61 0.15 0.77 137 XM_H_Trusted_IP 3489 0.55 0.00 0.74 138 NML_ADSP_CUSTOM_MED 3486 0.73 0.70 0.74 139 TR_XM_RelayPhish 3484 0.93 1.49 0.74 140 XMGappySubj_01 3381 0.62 0.33 0.72 141 XM_RXBody 3359 0.65 0.44 0.72 142 TM2_M_A_HREF_HREF 3341 0.67 0.56 0.71 143 XMNoVowels 3299 0.64 0.46 0.70 144 HTTPS_HTTP_MISMATCH 3276 0.65 0.49 0.70 145 DKIM_ADSP_NXDOMAIN 3098 1.33 3.27 0.66 146 XMSexyCombo_01 3082 1.08 2.31 0.66 147 FROM_GOV_SPOOF 3059 0.54 0.20 0.65 148 XMLngstWrd_00 3030 0.56 0.31 0.65 149 XM_ShortIntro_01 2951 0.55 0.31 0.63 150 USER_IN_WHITELIST 2924 0.46 0.00 0.62 151 XMBody_78 2830 0.88 1.68 0.60 152 HTML_TAG_BALANCE_BODY 2810 0.61 0.65 0.60 153 XMBody_95 2799 0.47 0.11 0.60 154 XMLngstWrd_01 2788 0.51 0.26 0.59 155 XMMoneyMeta_00 2756 0.67 0.91 0.59 156 T_TooManySym_03 2713 0.47 0.15 0.58 157 XM_H_PHPMailer 2642 0.77 1.37 0.56 158 TM2_M_BODY_EMPTY 2629 0.62 0.79 0.56 159 XMPhish30 2574 0.70 1.15 0.55 160 XMBrknScrpt_02 2558 0.69 1.13 0.55 161 RCVD_IN_BL_SPAMCOP_NET 2521 1.35 3.70 0.54 162 XMSubMetaI_00 2471 0.82 1.68 0.53 163 T_XMHurry_00 2402 0.70 1.23 0.51 164 SHORT_HELO_AND_INLINE_IMAGE 2396 0.39 0.06 0.51 165 XMHTMLBadTable_001 2347 0.61 0.93 0.50 166 XMBody_17 2338 0.71 1.31 0.50 167 HTML_FONT_FACE_BAD 2331 0.61 0.95 0.50 168 RELAYCOUNTRY_AU 2324 0.50 0.53 0.50 169 XMDateMe_00 2313 0.45 0.34 0.49 170 FILL_THIS_FORM 2302 1.08 2.76 0.49 171 MISSING_HEADERS 2294 0.48 0.46 0.49 172 NUMERIC_HTTP_ADDR 2291 0.48 0.44 0.49 173 T_MANY_PILL_PRICE 2274 0.36 0.00 0.48 174 XM_B_COPY_HTML 2267 0.49 0.52 0.48 175 XMSubject_78 2167 0.35 0.01 0.46 176 XM_D_omniadmin_Whitelist 2113 0.33 0.00 0.45 177 FROM_GOV_DKIM_AU 2089 0.37 0.14 0.45 178 XMBounce_01 2062 0.36 0.13 0.44 179 XMSubMetaSxObfu_03 2061 0.55 0.89 0.44 180 PLING_QUERY 2041 0.58 1.00 0.43 181 XM_URI_RBL 2037 1.15 3.21 0.43 182 XM_Body_Obfu01 2006 0.44 0.48 0.43 183 RCVD_IN_SORBS_DUL 1988 0.36 0.18 0.42 184 RDNS_DYNAMIC 1950 0.49 0.69 0.42 185 HTML_IMAGE_ONLY_24 1928 0.54 0.91 0.41 186 REMOVE_BEFORE_LINK 1915 0.46 0.61 0.41 187 TR_LOTS_OF_MONEY2 1906 0.57 1.03 0.41 188 T_MONEY_PERCENT 1906 0.57 1.03 0.41 189 URI_NOVOWEL 1891 0.50 0.79 0.40 190 HTML_IMAGE_ONLY_20 1874 0.36 0.26 0.40 191 FORGED_GMAIL_RCVD 1862 0.48 0.72 0.40 192 AC_DIV_BONANZA 1839 0.31 0.09 0.39 193 HTML_IMAGE_ONLY_32 1829 0.47 0.71 0.39 194 XMSubMetaSxObfu_02 1822 0.39 0.39 0.39 195 HTML_IMAGE_ONLY_28 1800 0.52 0.92 0.38 196 XM_B_REG_HTML 1725 0.54 1.02 0.37 197 XMHTML_After_End 1704 0.58 1.22 0.36 198 HTML_IMAGE_ONLY_16 1646 0.31 0.18 0.35 199 SpammyFromTLD_02 1638 1.58 5.11 0.35 200 XMSubNoVowel 1611 0.35 0.35 0.34 ----------------------------------------------------------------------