Email: 343317 Autolearn: 0 AvgScore: 3.09 AvgScanTime: 2.10 sec Spam: 91607 Autolearn: 0 AvgScore: 12.17 AvgScanTime: 2.58 sec Ham: 251710 Autolearn: 0 AvgScore: -0.22 AvgScanTime: 1.92 sec Time Spent Running SA: 200.18 hours Time Spent Processing Spam: 65.77 hours Time Spent Processing Ham: 134.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 85727 86.98 93.58 84.58 2 DKIM_SIGNED 77706 82.20 84.83 81.24 3 XM_DK_Pass 74890 80.44 81.75 79.96 4 DCC_CHECK 74862 60.29 81.72 52.49 5 DKIM_VALID 73470 78.55 80.20 77.95 6 XM_B_Unicode 73193 74.12 79.90 72.02 7 XMListUnsubscribeExists 69449 61.78 75.81 56.67 8 DKIM_VALID_AU 59052 63.56 64.46 63.23 9 XM_DK_Undo_02 48353 27.50 52.78 18.30 10 BAYES_99 43090 24.48 47.04 16.28 11 HTML_FONT_LOW_CONTRAST 37154 35.38 40.56 33.50 12 BAYES_999 36662 21.43 40.02 14.66 13 LOC_TINY_FONT_1 36143 32.48 39.45 29.95 14 TR_DCC_Bayes_99 35235 16.61 38.46 8.66 15 RCVD_IN_MSPIKE_H2 28190 31.66 30.77 31.98 16 BAYES_50 28154 45.25 30.73 50.54 17 MIME_HTML_ONLY 26436 24.69 28.86 23.18 18 FVGT_m_MULTI_ODD 25089 23.32 27.39 21.84 19 XM_Body_Dirty_Words 22606 18.03 24.68 15.62 20 XMSubLong 19842 21.23 21.66 21.07 21 T_KAM_HTML_FONT_INVALID 19066 16.21 20.81 14.54 22 DKIM_VALID_EF 17784 28.20 19.41 31.40 23 T_TM2_M_HEADER_IN_MSG 17533 22.21 19.14 23.33 24 RELAYCOUNTRY_META 17266 8.25 18.85 4.40 25 HTML_IMAGE_RATIO_02 16990 12.97 18.55 10.94 26 XM_Multi_Part_URI 15751 14.51 17.19 13.53 27 DCC_CHECK_NEGATIVE 15551 38.44 16.98 46.26 28 MultiRelay 15148 17.33 16.54 17.62 29 BOTNET 13525 5.73 14.76 2.44 30 BOTNET_IPINHOSTNAME 12296 8.19 13.42 6.28 31 XM_Evil_Numbers_Gen 12133 11.40 13.24 10.73 32 UNTRUSTED_Relay 11490 4.46 12.54 1.51 33 LOTS_OF_MONEY 11393 10.76 12.44 10.16 34 XMSexyCombo_05 11044 7.67 12.06 6.08 35 FSL_BULK_SIG 10855 11.51 11.85 11.39 36 T_XMDrugObfuBody_14 8024 9.09 8.76 9.22 37 MPART_ALT_DIFF 7839 4.94 8.56 3.62 38 XM_H_Long_From01 7706 7.00 8.41 6.48 39 XM_UncommonTLD01 7625 6.34 8.32 5.61 40 HTML_IMAGE_RATIO_04 7293 8.42 7.96 8.58 41 XMSubMetaSx_00 7263 5.03 7.93 3.98 42 TooManyTo_001 7218 6.87 7.88 6.51 43 XM_B_Phish_Phrases 7084 7.98 7.73 8.07 44 LotsOfNums_01 6627 7.07 7.23 7.01 45 BAYES_80 6613 4.86 7.22 4.00 46 XM_UB50 5745 2.35 6.27 0.93 47 BAYES_60 5668 6.07 6.19 6.02 48 XM_DIRTYINTL 5646 5.04 6.16 4.64 49 RCVD_IN_RP_SAFE 5227 12.61 5.71 15.12 50 FROM_EXCESS_BASE64 5065 5.15 5.53 5.02 51 MIME_HTML_MOSTLY 4986 3.74 5.44 3.13 52 XMBdyGiftCard01 4521 2.80 4.94 2.02 53 RCVD_IN_RP_CERTIFIED 4344 11.13 4.74 13.45 54 BAYES_95 4317 3.38 4.71 2.90 55 XMStrtUSub 4248 5.17 4.64 5.36 56 DKIM_INVALID 4236 3.65 4.62 3.30 57 RELAYCOUNTRY_CA 3873 2.18 4.23 1.44 58 XM_SendGrid 3837 6.59 4.19 7.46 59 XM_B_SpammyTLD 3815 4.46 4.16 4.56 60 NO_DNS_FOR_FROM 3808 2.05 4.16 1.28 61 SpammyFromTLD_02 3683 1.20 4.02 0.17 62 MIME_HTML_ONLY_MULTI 3605 2.25 3.94 1.64 63 MIME_QP_LONG_LINE 3514 3.81 3.84 3.81 64 HTML_IMAGE_RATIO_06 3478 3.09 3.80 2.83 65 HTML_IMAGE_RATIO_08 3450 2.39 3.77 1.89 66 DKIM_ADSP_NXDOMAIN 3447 1.53 3.76 0.72 67 T_REMOTE_IMAGE 3399 3.13 3.71 2.91 68 URI_HEX 3236 2.20 3.53 1.71 69 XM_SPF_SoftFail 3105 1.57 3.39 0.91 70 RCVD_IN_RP_RNBL 3048 0.92 3.33 0.04 71 RCVD_IN_PSBL 3033 0.93 3.31 0.07 72 XM_OfRef6 2802 2.64 3.06 2.48 73 MultiRelay_Combo 2794 0.93 3.05 0.16 74 MultiRelay_CC 2794 0.93 3.05 0.16 75 US_DOLLARS_3 2682 2.03 2.93 1.71 76 T_TooManySym_01 2674 7.34 2.92 8.95 77 TM2_M_URI_OPT_OUT 2627 2.27 2.87 2.06 78 T_XMDrugObfuBody_08 2608 1.54 2.85 1.07 79 XMBody_17 2606 1.30 2.84 0.73 80 RCVD_IN_BL_SPAMCOP_NET 2600 1.07 2.84 0.43 81 XMNumbers 2591 3.32 2.83 3.49 82 URI_TRY_3LD 2574 1.97 2.81 1.67 83 XM_H_Long_From02 2553 1.51 2.79 1.05 84 XMDiploma_00 2512 1.64 2.74 1.23 85 XM_CamelCaseFrm001 2470 2.10 2.70 1.88 86 KHOP_HELO_FCRDNS 2399 1.55 2.62 1.17 87 RELAYCOUNTRY_DE 2358 0.96 2.57 0.37 88 XM_ProductURIs 2331 2.68 2.54 2.72 89 XMSexyCombo_01 2255 1.00 2.46 0.47 90 DIET_1 2216 1.03 2.42 0.53 91 RELAYCOUNTRY_FR 2196 0.79 2.40 0.20 92 XM_UB99 2191 0.67 2.39 0.04 93 XMSubMetaI_00 2167 1.12 2.37 0.66 94 RCVD_IN_IADB_LISTED 2076 3.16 2.27 3.48 95 TR_XM_PHPDW 2057 1.07 2.25 0.64 96 TR_XM_PHPForged 1947 1.02 2.13 0.62 97 TR_XM_FormFill2 1924 1.00 2.10 0.60 98 XM_H_PHPOS 1911 1.00 2.09 0.60 99 HTML_MIME_NO_HTML_TAG 1842 1.71 2.01 1.60 100 XM_B_REG_HTML 1814 0.91 1.98 0.52 101 T_XMHurry_00 1807 1.35 1.97 1.13 102 XM_UB999 1769 0.54 1.93 0.03 103 TR_XM_DK_SendGrid 1733 3.67 1.89 4.32 104 ALL_TRUSTED 1716 11.14 1.87 14.51 105 MIME_HEADER_CTYPE_ONLY 1714 0.62 1.87 0.17 106 SUBJ_ALL_CAPS 1691 1.60 1.85 1.51 107 RCVD_IN_IADB_SPF 1679 2.75 1.83 3.08 108 XM_URI_RBL 1620 0.77 1.77 0.41 109 TM2_M_VERY_LONG_WORD 1611 1.40 1.76 1.27 110 TR_Symld_Words 1603 1.56 1.75 1.50 111 XMGenDplmaNmb 1586 0.96 1.73 0.68 112 RCVD_IN_IADB_SENDERID 1564 2.46 1.71 2.73 113 RCVD_IN_IADB_DK 1540 2.40 1.68 2.66 114 TR_LOTS_OF_MONEY3 1533 0.97 1.67 0.71 115 XMBrknScrpt_02 1523 0.97 1.66 0.71 116 TR_Mismatch_TLD_02 1507 0.48 1.65 0.05 117 HTML_FONT_SIZE_LARGE 1486 0.51 1.62 0.11 118 XMSlimDrugH 1483 0.68 1.62 0.33 119 XM_UB60 1445 0.47 1.58 0.06 120 XM_H_PHPMailer 1380 0.90 1.51 0.68 121 RELAYCOUNTRY_AT 1323 0.54 1.44 0.21 122 BAYES_40 1300 3.25 1.42 3.91 123 HDRS_LCASE_IMGONLY 1287 0.39 1.40 0.02 124 BODY_ENHANCEMENT 1260 0.41 1.38 0.06 125 SpammyFromTLD_01 1255 0.69 1.37 0.44 126 HTML_FONT_FACE_BAD 1255 1.26 1.37 1.22 127 URIBL_BLACK 1247 0.42 1.36 0.07 128 TooManyTo_002 1208 1.26 1.32 1.24 129 FROM_SUSPICIOUS_NTLD 1182 0.36 1.29 0.03 130 NORDNS_LOW_CONTRAST 1180 0.35 1.29 0.01 131 TR_XM_RelayPhish 1157 0.95 1.26 0.83 132 FROM_SUSPICIOUS_NTLD_FP 1156 0.36 1.26 0.03 133 BOTNET_NORDNS 1141 0.34 1.25 0.02 134 URIBL_DBL_SPAM 1105 0.35 1.21 0.04 135 UNPARSEABLE_RELAY 1085 3.33 1.18 4.11 136 T_HTML_TAG_BALANCE_CENTER 1084 0.37 1.18 0.08 137 XMPhish30 1083 0.71 1.18 0.54 138 XM_H_PHPOS_M 1083 0.46 1.18 0.20 139 RCVD_IN_IADB_VOUCHED 1074 1.96 1.17 2.24 140 XMStockSpam_06 1071 2.27 1.17 2.67 141 DKIM_ADSP_CUSTOM_MED 1062 0.94 1.16 0.86 142 XMSexyCombo_04 1061 0.36 1.16 0.07 143 TooManyTo_003 1056 0.96 1.15 0.88 144 SUBJ_DOLLARS 1046 0.88 1.14 0.78 145 XMHTML_After_End 1045 0.52 1.14 0.29 146 LOW_PRICE 1042 1.35 1.14 1.43 147 XMHTMLBadTable_001 1021 0.96 1.11 0.90 148 DATE_IN_PAST_03_06 1006 0.34 1.10 0.06 149 HTML_TAG_BALANCE_BODY 992 0.82 1.08 0.72 150 NML_ADSP_CUSTOM_MED 983 0.73 1.07 0.60 151 MAILING_LIST_MULTI 962 1.77 1.05 2.03 152 BAYES_20 958 2.47 1.05 2.99 153 XMPhish11 957 0.94 1.04 0.91 154 XM_UB80 953 0.30 1.04 0.03 155 TooManyTo_004 914 0.81 1.00 0.74 156 LongTLD 908 0.36 0.99 0.13 157 RELAYCOUNTRY_IN 892 0.29 0.97 0.04 158 THIS_AD 891 0.36 0.97 0.14 159 RDNS_DYNAMIC 879 0.63 0.96 0.51 160 T_MONEY_PERCENT 876 0.51 0.96 0.35 161 TR_LOTS_OF_MONEY2 876 0.51 0.96 0.35 162 T_TooManySym_02 867 1.88 0.95 2.23 163 XMSubMetaSxObfu_03 865 0.56 0.94 0.41 164 T_Symld_Words_02 862 0.43 0.94 0.24 165 T_XMDrugObfuBody_00 845 0.69 0.92 0.61 166 XMMoneyMeta_00 842 0.45 0.92 0.27 167 XM_OfRef7 841 0.36 0.92 0.16 168 PLING_QUERY 831 0.70 0.91 0.62 169 TooManyTo_005 801 0.71 0.87 0.64 170 HTML_TAG_BALANCE_HEAD 772 0.26 0.84 0.05 171 TR_XM_SEO3 762 0.43 0.83 0.28 172 XM_DK_Undo_01 756 1.26 0.83 1.42 173 XM_H_Undi_Recip 754 0.43 0.82 0.28 174 XMPhish14 753 0.65 0.82 0.59 175 HTML_IMAGE_ONLY_16 751 0.34 0.82 0.16 176 XM_B_COPY_HTML 750 0.74 0.82 0.71 177 XMSlimDrugs 735 0.24 0.80 0.04 178 PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 734 0.22 0.80 0.01 179 XMBody_78 727 0.65 0.79 0.60 180 XMSubNoVowel 724 0.38 0.79 0.23 181 FORGED_GMAIL_RCVD 721 0.52 0.79 0.42 182 BAYES_00 719 8.35 0.78 11.11 183 XMGppyBdWords 707 0.26 0.77 0.07 184 HTML_IMAGE_ONLY_12 691 0.30 0.75 0.14 185 XM_RXBody 691 0.34 0.75 0.19 186 HK_RANDOM_FROM 690 0.28 0.75 0.10 187 BODY_QUOTE_MALF_MSGID 684 0.74 0.75 0.74 188 HDRS_LCASE 662 0.19 0.72 0.00 189 URI_NOVOWEL 644 0.46 0.70 0.37 190 TR_Caps_n_Bayes_99 634 0.31 0.69 0.17 191 RELAYCOUNTRY_GB 632 0.58 0.69 0.54 192 DEAR_FRIEND 626 0.22 0.68 0.05 193 XMSubMetaSSx_00 624 0.31 0.68 0.17 194 XMNoVowels 617 0.49 0.67 0.42 195 RCVD_IN_IADB_OPTIN 615 1.27 0.67 1.48 196 BAYES_05 606 1.59 0.66 1.93 197 URI_WP_HACKED 602 0.18 0.66 0.00 198 RELAYCOUNTRY_PL 584 0.20 0.64 0.04 199 RELAYCOUNTRY_LT 570 0.20 0.62 0.04 200 XM_XX_Yahoo 555 0.29 0.61 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 212892 86.98 93.58 84.58 2 DKIM_SIGNED 204497 82.20 84.83 81.24 3 XM_DK_Pass 201263 80.44 81.75 79.96 4 DKIM_VALID 196197 78.55 80.20 77.95 5 XM_B_Unicode 181278 74.12 79.90 72.02 6 DKIM_VALID_AU 159168 63.56 64.46 63.23 7 XMListUnsubscribeExists 142645 61.78 75.81 56.67 8 DCC_CHECK 132134 60.29 81.72 52.49 9 BAYES_50 127213 45.25 30.73 50.54 10 DCC_CHECK_NEGATIVE 116434 38.44 16.98 46.26 11 HTML_FONT_LOW_CONTRAST 84326 35.38 40.56 33.50 12 RCVD_IN_MSPIKE_H2 80490 31.66 30.77 31.98 13 DKIM_VALID_EF 79036 28.20 19.41 31.40 14 LOC_TINY_FONT_1 75381 32.48 39.45 29.95 15 T_TM2_M_HEADER_IN_MSG 58730 22.21 19.14 23.33 16 MIME_HTML_ONLY 58339 24.69 28.86 23.18 17 FVGT_m_MULTI_ODD 54973 23.32 27.39 21.84 18 XMSubLong 53040 21.23 21.66 21.07 19 XM_DK_Undo_02 46075 27.50 52.78 18.30 20 MultiRelay 44360 17.33 16.54 17.62 21 BAYES_99 40968 24.48 47.04 16.28 22 XM_Body_Dirty_Words 39310 18.03 24.68 15.62 23 RCVD_IN_RP_SAFE 38064 12.61 5.71 15.12 24 BAYES_999 36902 21.43 40.02 14.66 25 T_KAM_HTML_FONT_INVALID 36591 16.21 20.81 14.54 26 ALL_TRUSTED 36533 11.14 1.87 14.51 27 XM_Multi_Part_URI 34048 14.51 17.19 13.53 28 XM_DKIMWhitelistDomains 33905 9.89 0.04 13.47 29 RCVD_IN_RP_CERTIFIED 33863 11.13 4.74 13.45 30 FSL_BULK_SIG 28668 11.51 11.85 11.39 31 BAYES_00 27957 8.35 0.78 11.11 32 HTML_IMAGE_RATIO_02 27544 12.97 18.55 10.94 33 XM_Evil_Numbers_Gen 27021 11.40 13.24 10.73 34 TR_XM_DK_Bayes 25831 7.68 0.58 10.26 35 LOTS_OF_MONEY 25562 10.76 12.44 10.16 36 TR_XM_DK_Bayes1 25300 7.52 0.56 10.05 37 TO_MALFORMED 24198 7.08 0.12 9.61 38 T_XMDrugObfuBody_14 23198 9.09 8.76 9.22 39 TR_XM_DK_Bayes2 22703 6.72 0.42 9.02 40 T_TooManySym_01 22540 7.34 2.92 8.95 41 TR_DCC_Bayes_99 21792 16.61 38.46 8.66 42 HTML_IMAGE_RATIO_04 21601 8.42 7.96 8.58 43 XM_B_Phish_Phrases 20304 7.98 7.73 8.07 44 XM_SendGrid 18783 6.59 4.19 7.46 45 LotsOfNums_01 17650 7.07 7.23 7.01 46 TooManyTo_001 16376 6.87 7.88 6.51 47 XM_H_Long_From01 16312 7.00 8.41 6.48 48 BOTNET_IPINHOSTNAME 15809 8.19 13.42 6.28 49 XMSexyCombo_05 15293 7.67 12.06 6.08 50 BAYES_60 15163 6.07 6.19 6.02 51 XM_UncommonTLD01 14127 6.34 8.32 5.61 52 XMStrtUSub 13499 5.17 4.64 5.36 53 FROM_EXCESS_BASE64 12624 5.15 5.53 5.02 54 XM_DIRTYINTL 11674 5.04 6.16 4.64 55 XM_B_SpammyTLD 11489 4.46 4.16 4.56 56 RELAYCOUNTRY_META 11066 8.25 18.85 4.40 57 TR_XM_DK_SendGrid 10863 3.67 1.89 4.32 58 INVALID_MSGID 10778 3.19 0.20 4.28 59 UNPARSEABLE_RELAY 10343 3.33 1.18 4.11 60 BAYES_80 10068 4.86 7.22 4.00 61 XMSubMetaSx_00 10017 5.03 7.93 3.98 62 BAYES_40 9853 3.25 1.42 3.91 63 MIME_QP_LONG_LINE 9581 3.81 3.84 3.81 64 MPART_ALT_DIFF 9104 4.94 8.56 3.62 65 IN_ZIMBRA_NJ_WHITELIST 8907 2.60 0.01 3.54 66 TVD_RCVD_IP 8839 2.71 0.53 3.51 67 XMNumbers 8796 3.32 2.83 3.49 68 RCVD_IN_IADB_LISTED 8761 3.16 2.27 3.48 69 DKIM_INVALID 8300 3.65 4.62 3.30 70 MIME_HTML_MOSTLY 7869 3.74 5.44 3.13 71 RCVD_IN_IADB_SPF 7764 2.75 1.83 3.08 72 BAYES_20 7526 2.47 1.05 2.99 73 T_REMOTE_IMAGE 7334 3.13 3.71 2.91 74 BAYES_95 7300 3.38 4.71 2.90 75 HTML_IMAGE_RATIO_06 7132 3.09 3.80 2.83 76 RCVD_IN_IADB_SENDERID 6884 2.46 1.71 2.73 77 XM_ProductURIs 6853 2.68 2.54 2.72 78 XMStockSpam_06 6720 2.27 1.17 2.67 79 RCVD_IN_IADB_DK 6693 2.40 1.68 2.66 80 XM_OfRef6 6246 2.64 3.06 2.48 81 BOTNET 6135 5.73 14.76 2.44 82 TR_MetaPhish_Combo_01 5878 1.87 0.59 2.34 83 RCVD_IN_IADB_VOUCHED 5645 1.96 1.17 2.24 84 T_TooManySym_02 5603 1.88 0.95 2.23 85 TM2_M_URI_OPT_OUT 5183 2.27 2.87 2.06 86 MAILING_LIST_MULTI 5101 1.77 1.05 2.03 87 XMBdyGiftCard01 5083 2.80 4.94 2.02 88 IN_HORDE_ADDRESS_BOOK 4943 1.45 0.02 1.96 89 XM_PDF 4903 1.50 0.28 1.95 90 BAYES_05 4846 1.59 0.66 1.93 91 HTML_IMAGE_RATIO_08 4753 2.39 3.77 1.89 92 XM_CamelCaseFrm001 4735 2.10 2.70 1.88 93 USER_IN_DEF_DKIM_WL 4505 1.32 0.01 1.79 94 URI_HEX 4311 2.20 3.53 1.71 95 US_DOLLARS_3 4293 2.03 2.93 1.71 96 URI_TRY_3LD 4200 1.97 2.81 1.67 97 MIME_HTML_ONLY_MULTI 4129 2.25 3.94 1.64 98 HTML_MIME_NO_HTML_TAG 4019 1.71 2.01 1.60 99 UNTRUSTED_Relay 3811 4.46 12.54 1.51 100 SUBJ_ALL_CAPS 3798 1.60 1.85 1.51 101 TR_Symld_Words 3765 1.56 1.75 1.50 102 RCVD_IN_IADB_OPTIN 3731 1.27 0.67 1.48 103 RELAYCOUNTRY_CA 3627 2.18 4.23 1.44 104 LOW_PRICE 3591 1.35 1.14 1.43 105 XM_DK_Undo_01 3568 1.26 0.83 1.42 106 ANY_BOUNCE_MESSAGE 3561 1.13 0.34 1.41 107 BOUNCE_MESSAGE 3561 1.13 0.34 1.41 108 NO_DNS_FOR_FROM 3229 2.05 4.16 1.28 109 TM2_M_VERY_LONG_WORD 3196 1.40 1.76 1.27 110 TooManyTo_002 3123 1.26 1.32 1.24 111 XMDiploma_00 3104 1.64 2.74 1.23 112 HTML_FONT_FACE_BAD 3083 1.26 1.37 1.22 113 XM_GoogleGroups 3035 1.02 0.51 1.21 114 KHOP_HELO_FCRDNS 2937 1.55 2.62 1.17 115 T_XMHurry_00 2841 1.35 1.97 1.13 116 FILL_THIS_FORM 2782 0.94 0.48 1.11 117 T_XMDrugObfuBody_08 2690 1.54 2.85 1.07 118 XM_H_Long_From02 2646 1.51 2.79 1.05 119 T_FILL_THIS_FORM_SHORT 2636 0.92 0.56 1.05 120 T_FILL_THIS_FORM_LONG 2595 0.85 0.36 1.03 121 T_FILL_THIS_FORM_LOAN 2543 0.76 0.06 1.01 122 XM_UB50 2336 2.35 6.27 0.93 123 XMBody_95 2293 0.69 0.08 0.91 124 XMPhish11 2286 0.94 1.04 0.91 125 XM_SPF_SoftFail 2281 1.57 3.39 0.91 126 XMHTMLBadTable_001 2260 0.96 1.11 0.90 127 TooManyTo_003 2227 0.96 1.15 0.88 128 TM2_M_A_HREF_HREF 2203 0.79 0.56 0.88 129 T_TooManySym_03 2176 0.69 0.23 0.86 130 DKIM_ADSP_CUSTOM_MED 2172 0.94 1.16 0.86 131 TR_XM_RelayPhish 2090 0.95 1.26 0.83 132 USER_IN_WHITELIST 2020 0.59 0.00 0.80 133 XMOemUri 2015 0.64 0.20 0.80 134 SUBJ_DOLLARS 1964 0.88 1.14 0.78 135 XMSubMetaSxObfu_02 1951 0.65 0.31 0.78 136 TooManyTo_004 1869 0.81 1.00 0.74 137 BODY_QUOTE_MALF_MSGID 1869 0.74 0.75 0.74 138 XMBody_17 1848 1.30 2.84 0.73 139 HTML_TAG_BALANCE_BODY 1823 0.82 1.08 0.72 140 DKIM_ADSP_NXDOMAIN 1813 1.53 3.76 0.72 141 TR_LOTS_OF_MONEY3 1795 0.97 1.67 0.71 142 XMBrknScrpt_02 1791 0.97 1.66 0.71 143 XM_B_COPY_HTML 1777 0.74 0.82 0.71 144 XM_H_PHPMailer 1722 0.90 1.51 0.68 145 XMGenDplmaNmb 1704 0.96 1.73 0.68 146 XMSubMetaI_00 1667 1.12 2.37 0.66 147 TooManyTo_005 1623 0.71 0.87 0.64 148 TR_XM_PHPDW 1611 1.07 2.25 0.64 149 TR_XM_PHPForged 1561 1.02 2.13 0.62 150 PLING_QUERY 1558 0.70 0.91 0.62 151 T_XMDrugObfuBody_00 1539 0.69 0.92 0.61 152 NML_ADSP_CUSTOM_MED 1510 0.73 1.07 0.60 153 TR_XM_FormFill2 1510 1.00 2.10 0.60 154 XM_H_PHPOS 1506 1.00 2.09 0.60 155 XMBody_78 1498 0.65 0.79 0.60 156 XMPhish14 1492 0.65 0.82 0.59 157 HELO_NODOT 1483 0.54 0.41 0.59 158 HELO_NO_DOMAIN 1390 0.51 0.41 0.55 159 HTTPS_HTTP_MISMATCH 1369 0.53 0.47 0.54 160 RELAYCOUNTRY_GB 1358 0.58 0.69 0.54 161 XMPhish30 1352 0.71 1.18 0.54 162 DIET_1 1331 1.03 2.42 0.53 163 XMLngstWrd_00 1319 0.52 0.49 0.52 164 XM_B_REG_HTML 1312 0.91 1.98 0.52 165 XMBSHREFv2 1294 0.48 0.37 0.51 166 RDNS_DYNAMIC 1281 0.63 0.96 0.51 167 XMGappySubj_01 1251 0.50 0.52 0.50 168 XMLngstWrd_01 1239 0.49 0.47 0.49 169 XMSexyCombo_01 1181 1.00 2.46 0.47 170 SpammyFromTLD_01 1108 0.69 1.37 0.44 171 RCVD_IN_BL_SPAMCOP_NET 1082 1.07 2.84 0.43 172 XMCapTrack 1082 0.38 0.23 0.43 173 XMNoVowels 1067 0.49 0.67 0.42 174 FORGED_GMAIL_RCVD 1049 0.52 0.79 0.42 175 XMSubMetaSxObfu_03 1044 0.56 0.94 0.41 176 NUMERIC_HTTP_ADDR 1033 0.40 0.38 0.41 177 XM_URI_RBL 1028 0.77 1.77 0.41 178 T_TooManySym_04 1020 0.30 0.03 0.41 179 XM_D_tchamptons_WL 970 0.28 0.00 0.39 180 URI_NOVOWEL 942 0.46 0.70 0.37 181 RELAYCOUNTRY_DE 938 0.96 2.57 0.37 182 XM_Akamai 937 0.28 0.01 0.37 183 T_MONEY_PERCENT 877 0.51 0.96 0.35 184 TR_LOTS_OF_MONEY2 877 0.51 0.96 0.35 185 MPART_ALT_DIFF_COUNT 857 0.38 0.49 0.34 186 TM2_M_BODY_EMPTY 849 0.26 0.05 0.34 187 XMSlimDrugH 841 0.68 1.62 0.33 188 BAD_CREDIT 839 0.26 0.05 0.33 189 HTML_IMAGE_ONLY_32 814 0.31 0.27 0.32 190 MISSING_HEADERS 809 0.32 0.32 0.32 191 RELAYCOUNTRY_AU 798 0.34 0.41 0.32 192 RELAYCOUNTRY_NL 791 0.37 0.52 0.31 193 XM_ShortIntro_01 787 0.33 0.37 0.31 194 XMDateMe_00 785 0.28 0.21 0.31 195 XM_Body_Obfu01 784 0.31 0.30 0.31 196 XM_Walgreens_Forge 745 0.32 0.39 0.30 197 XMHTML_After_End 728 0.52 1.14 0.29 198 TR_XM_SEO3 712 0.43 0.83 0.28 199 XM_H_Undi_Recip 710 0.43 0.82 0.28 200 T_OBFU_PDF_ATTACH 690 0.22 0.06 0.27 ----------------------------------------------------------------------