Email: 657458 Autolearn: 0 AvgScore: 2.85 AvgScanTime: 2.13 sec Spam: 152148 Autolearn: 0 AvgScore: 12.22 AvgScanTime: 2.65 sec Ham: 505310 Autolearn: 0 AvgScore: 0.03 AvgScanTime: 1.97 sec Time Spent Running SA: 389.08 hours Time Spent Processing Spam: 111.96 hours Time Spent Processing Ham: 277.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144506 88.63 94.98 86.72 2 DKIM_SIGNED 126283 75.60 83.00 73.37 3 XM_DK_Pass 123021 74.15 80.86 72.13 4 DKIM_VALID 119698 71.63 78.67 69.51 5 DCC_CHECK 119418 48.80 78.49 39.86 6 XM_B_Unicode 117068 68.22 76.94 65.59 7 XMListUnsubscribeExists 113160 54.74 74.37 48.83 8 DKIM_VALID_AU 89881 52.60 59.07 50.65 9 XM_DK_Undo_02 72914 20.33 47.92 12.02 10 BAYES_99 62559 17.09 41.12 9.86 11 BAYES_50 53814 50.87 35.37 55.53 12 LOC_TINY_FONT_1 53619 25.21 35.24 22.20 13 HTML_FONT_LOW_CONTRAST 52783 28.46 34.69 26.58 14 BAYES_999 50592 14.27 33.25 8.56 15 TR_DCC_Bayes_99 49895 11.19 32.79 4.69 16 MIME_HTML_ONLY 48993 23.01 32.20 20.24 17 RCVD_IN_MSPIKE_H2 48293 30.68 31.74 30.36 18 FVGT_m_MULTI_ODD 43588 22.61 28.65 20.80 19 XMSubLong 38692 21.82 25.43 20.73 20 DKIM_VALID_EF 34417 25.65 22.62 26.57 21 T_KAM_HTML_FONT_INVALID 34412 18.78 22.62 17.63 22 XM_Body_Dirty_Words 32922 14.26 21.64 12.04 23 T_TM2_M_HEADER_IN_MSG 32017 28.09 21.04 30.22 24 DCC_CHECK_NEGATIVE 30075 49.18 19.77 58.03 25 XM_Multi_Part_URI 29670 12.93 19.50 10.96 26 RELAYCOUNTRY_META 29371 8.63 19.30 5.41 27 BOTNET 25625 5.56 16.84 2.16 28 MultiRelay 25438 18.80 16.72 19.43 29 BOTNET_IPINHOSTNAME 22796 7.16 14.98 4.81 30 XM_Evil_Numbers_Gen 21748 10.53 14.29 9.40 31 HTML_IMAGE_RATIO_02 20895 9.15 13.73 7.78 32 LOTS_OF_MONEY 19142 8.80 12.58 7.67 33 UNTRUSTED_Relay 18489 3.91 12.15 1.43 34 FSL_BULK_SIG 15925 8.72 10.47 8.19 35 XMSexyCombo_05 15643 4.76 10.28 3.09 36 LotsOfNums_01 14547 8.33 9.56 7.96 37 T_XMDrugObfuBody_14 13645 8.37 8.97 8.18 38 HTML_IMAGE_RATIO_04 13341 5.52 8.77 4.54 39 TooManyTo_001 12632 8.49 8.30 8.54 40 MPART_ALT_DIFF 11643 4.32 7.65 3.32 41 XMSubMetaSx_00 11518 4.56 7.57 3.65 42 BAYES_80 11510 4.72 7.57 3.86 43 XM_H_Long_From01 10974 6.47 7.21 6.24 44 XM_B_Phish_Phrases 10864 5.76 7.14 5.34 45 MIME_QP_LONG_LINE 9714 6.34 6.38 6.33 46 BAYES_60 9434 6.03 6.20 5.98 47 XM_UncommonTLD01 9230 4.68 6.07 4.26 48 XM_DIRTYINTL 8815 3.18 5.79 2.40 49 XM_UB50 7737 1.91 5.09 0.96 50 MIME_HTML_ONLY_MULTI 6913 2.45 4.54 1.82 51 DKIM_INVALID 6585 3.97 4.33 3.86 52 MIME_HTML_MOSTLY 6562 2.62 4.31 2.11 53 XM_SPF_SoftFail 6545 2.48 4.30 1.93 54 HTML_MIME_NO_HTML_TAG 6440 3.35 4.23 3.08 55 BAYES_95 6420 3.26 4.22 2.97 56 HTML_IMAGE_RATIO_06 6361 3.46 4.18 3.24 57 XM_SendGrid 6265 5.78 4.12 6.28 58 XMNumbers 6250 3.03 4.11 2.70 59 FROM_EXCESS_BASE64 6151 3.83 4.04 3.76 60 T_REMOTE_IMAGE 6072 4.78 3.99 5.01 61 RELAYCOUNTRY_CA 5971 2.05 3.92 1.49 62 XM_B_SpammyTLD 5874 3.46 3.86 3.34 63 SpammyFromTLD_02 5830 1.12 3.83 0.30 64 URI_HEX 5655 2.18 3.72 1.71 65 TM2_M_URI_OPT_OUT 5639 2.29 3.71 1.86 66 XMStrtUSub 5415 5.14 3.56 5.61 67 T_XMDrugObfuBody_08 5347 2.11 3.51 1.68 68 RELAYCOUNTRY_FR 5345 1.04 3.51 0.30 69 XM_URI_RBL 5065 1.00 3.33 0.29 70 RCVD_IN_IADB_LISTED 4997 5.09 3.28 5.63 71 XMDiploma_00 4969 2.25 3.27 1.94 72 XM_CamelCaseFrm001 4708 2.31 3.09 2.07 73 XMSexyCombo_01 4703 1.29 3.09 0.74 74 US_DOLLARS_3 4671 1.44 3.07 0.95 75 RCVD_IN_BL_SPAMCOP_NET 4489 1.26 2.95 0.75 76 HTML_IMAGE_RATIO_08 4408 2.23 2.90 2.03 77 RCVD_IN_IADB_SPF 4335 4.43 2.85 4.91 78 DKIM_ADSP_NXDOMAIN 4272 1.21 2.81 0.73 79 TR_XM_PHPDW 4239 1.68 2.79 1.35 80 XMBdyGiftCard01 4192 1.43 2.76 1.03 81 TR_XM_PHPForged 4131 1.64 2.72 1.32 82 RCVD_IN_RP_SAFE 4127 8.00 2.71 9.59 83 RCVD_IN_IADB_SENDERID 4122 3.92 2.71 4.28 84 TR_XM_FormFill2 4079 1.62 2.68 1.31 85 XM_H_PHPOS 4058 1.62 2.67 1.30 86 RCVD_IN_IADB_DK 4058 3.85 2.67 4.20 87 MultiRelay_Combo 3987 0.81 2.62 0.26 88 MultiRelay_CC 3987 0.81 2.62 0.26 89 ALL_TRUSTED 3983 14.10 2.62 17.56 90 XM_OfRef6 3979 1.77 2.62 1.52 91 T_TooManySym_01 3876 4.39 2.55 4.95 92 NO_DNS_FOR_FROM 3827 1.32 2.52 0.96 93 SUBJ_ALL_CAPS 3711 1.87 2.44 1.70 94 HTML_IMAGE_ONLY_24 3670 1.37 2.41 1.05 95 RCVD_IN_PSBL 3593 0.57 2.36 0.03 96 XMHTML_After_End 3587 0.86 2.36 0.40 97 XMGenDplmaNmb 3437 1.46 2.26 1.22 98 KHOP_HELO_FCRDNS 3302 2.12 2.17 2.11 99 RCVD_IN_RP_CERTIFIED 3232 6.96 2.12 8.41 100 MAILING_LIST_MULTI 3176 2.50 2.09 2.63 101 BAYES_40 3169 4.01 2.08 4.60 102 XMSubMetaI_00 3117 0.96 2.05 0.63 103 BOTNET_NORDNS 2999 0.48 1.97 0.04 104 XM_UB99 2993 0.48 1.97 0.03 105 XM_H_Long_From02 2835 1.32 1.86 1.15 106 TR_XM_DK_SendGrid 2808 3.06 1.85 3.42 107 RCVD_IN_RP_RNBL 2738 0.44 1.80 0.02 108 TM2_M_VERY_LONG_WORD 2728 1.23 1.79 1.06 109 T_XMDrugObfuBody_00 2690 1.02 1.77 0.80 110 XM_UB60 2621 0.46 1.72 0.08 111 SpammyFromTLD_01 2552 0.96 1.68 0.74 112 THIS_AD 2465 0.43 1.62 0.07 113 RELAYCOUNTRY_IN 2445 0.45 1.61 0.11 114 SUBJ_DOLLARS 2430 0.62 1.60 0.32 115 XM_UB999 2335 0.37 1.53 0.02 116 XM_DK_Undo_01 2333 1.66 1.53 1.69 117 HDRS_LCASE_IMGONLY 2327 0.40 1.53 0.06 118 RCVD_IN_IADB_VOUCHED 2301 3.23 1.51 3.75 119 BAYES_20 2295 2.84 1.51 3.24 120 XMStockSpam_06 2275 0.92 1.50 0.75 121 TR_XM_RelayPhish 2274 0.95 1.49 0.79 122 XM_UB80 2220 0.36 1.46 0.02 123 MIME_HEADER_CTYPE_ONLY 2208 0.44 1.45 0.14 124 URI_TRY_3LD 2203 1.06 1.45 0.94 125 TR_Symld_Words 2187 1.46 1.44 1.46 126 T_XMHurry_00 2143 0.76 1.41 0.57 127 RELAYCOUNTRY_GB 2069 1.23 1.36 1.19 128 DKIM_ADSP_CUSTOM_MED 1999 1.09 1.31 1.02 129 XM_H_PHPMailer 1987 0.76 1.31 0.59 130 HTML_IMAGE_ONLY_28 1973 0.67 1.30 0.49 131 XM_ProductURIs 1970 0.79 1.29 0.64 132 XMSlimDrugH 1961 0.65 1.29 0.46 133 TooManyTo_002 1941 1.93 1.28 2.13 134 XMPhish30 1921 0.59 1.26 0.39 135 DIET_1 1918 0.49 1.26 0.26 136 XMBody_17 1916 0.62 1.26 0.43 137 XM_OfRef7 1885 0.44 1.24 0.20 138 RDNS_DYNAMIC 1859 0.59 1.22 0.40 139 TR_LOTS_OF_MONEY3 1845 0.56 1.21 0.37 140 XMBrknScrpt_02 1841 0.66 1.21 0.49 141 T_MONEY_PERCENT 1826 0.52 1.20 0.31 142 TR_LOTS_OF_MONEY2 1826 0.52 1.20 0.31 143 XMPhish11 1826 1.24 1.20 1.26 144 HTML_FONT_FACE_BAD 1789 0.70 1.18 0.56 145 FORGED_GMAIL_RCVD 1765 0.67 1.16 0.52 146 XM_H_PHPOS_M 1736 0.40 1.14 0.18 147 MISSING_HEADERS 1727 0.63 1.14 0.47 148 TooManyTo_003 1690 1.35 1.11 1.42 149 RELAYCOUNTRY_DE 1645 0.55 1.08 0.39 150 URIBL_BLACK 1645 0.28 1.08 0.04 151 T_FILL_THIS_FORM_SHORT 1626 1.39 1.07 1.49 152 XM_HighProb1 1617 0.25 1.06 0.01 153 XMHTMLBadTable_001 1610 0.64 1.06 0.52 154 XM_B_REG_HTML 1599 0.58 1.05 0.43 155 FILL_THIS_FORM 1575 0.87 1.04 0.81 156 NML_ADSP_CUSTOM_MED 1566 0.81 1.03 0.74 157 TM2_M_A_HREF_HREF 1566 0.63 1.03 0.51 158 URIBL_DBL_ABUSE_REDIR 1559 0.25 1.02 0.01 159 XMSexyCombo_04 1540 0.33 1.01 0.13 160 XMBody_78 1523 0.63 1.00 0.52 161 TooManyTo_004 1511 1.05 0.99 1.07 162 XMMoneyMeta_00 1494 0.61 0.98 0.50 163 DATE_IN_PAST_03_06 1493 0.30 0.98 0.09 164 UNPARSEABLE_RELAY 1475 2.11 0.97 2.45 165 XM_RXBody 1452 0.32 0.95 0.13 166 XM_PDF 1426 4.75 0.94 5.90 167 T_TooManySym_02 1405 1.44 0.92 1.60 168 T_Symld_Words_02 1403 0.69 0.92 0.62 169 REPLYTO_WITHOUT_TO_CC 1395 0.26 0.92 0.07 170 BAYES_00 1389 9.18 0.91 11.67 171 MONEY_FORM 1374 0.21 0.90 0.01 172 HTML_TAG_BALANCE_BODY 1362 0.67 0.90 0.61 173 TooManyTo_005 1343 0.89 0.88 0.90 174 RELAYCOUNTRY_AU 1336 0.69 0.88 0.64 175 FROM_SUSPICIOUS_NTLD 1334 0.23 0.88 0.04 176 BAYES_05 1309 1.75 0.86 2.01 177 RELAYCOUNTRY_AT 1294 0.30 0.85 0.13 178 FROM_SUSPICIOUS_NTLD_FP 1293 0.22 0.85 0.03 179 RELAYCOUNTRY_RO 1288 0.20 0.85 0.01 180 DATE_IN_PAST_06_12 1277 0.29 0.84 0.12 181 RCVD_IN_IADB_OPTIN 1249 2.02 0.82 2.38 182 XMPhish14 1241 0.46 0.82 0.36 183 TR_LOTS_OF_MONEY1 1225 0.21 0.81 0.03 184 URI_NOVOWEL 1179 0.47 0.77 0.38 185 DATE_IN_PAST_12_24 1174 0.25 0.77 0.10 186 XMSubMetaSxObfu_03 1152 0.61 0.76 0.57 187 FROM_MISSP_REPLYTO 1152 0.18 0.76 0.01 188 TR_Caps_n_Bayes_99 1143 0.23 0.75 0.07 189 TR_MetaPhish_Combo_01 1119 1.75 0.74 2.05 190 XMGppyBdWords 1116 0.44 0.73 0.35 191 NUMERIC_HTTP_ADDR 1109 0.38 0.73 0.28 192 LONG_HEX_URI 1108 0.31 0.73 0.19 193 TR_Mismatch_TLD_02 1077 0.23 0.71 0.08 194 MPART_ALT_DIFF_COUNT 1062 0.37 0.70 0.27 195 HK_RANDOM_REPLYTO 1055 0.34 0.69 0.24 196 XM_UB95 1049 0.17 0.69 0.01 197 LOW_PRICE 1047 0.36 0.69 0.26 198 BODY_QUOTE_MALF_MSGID 1039 0.60 0.68 0.58 199 XMSubMetaSSx_00 1035 0.29 0.68 0.17 200 XM_B_COPY_HTML 1028 0.50 0.68 0.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 438191 88.63 94.98 86.72 2 DKIM_SIGNED 370758 75.60 83.00 73.37 3 XM_DK_Pass 364504 74.15 80.86 72.13 4 DKIM_VALID 351256 71.63 78.67 69.51 5 XM_B_Unicode 331443 68.22 76.94 65.59 6 DCC_CHECK_NEGATIVE 293256 49.18 19.77 58.03 7 BAYES_50 280613 50.87 35.37 55.53 8 DKIM_VALID_AU 255924 52.60 59.07 50.65 9 XMListUnsubscribeExists 246726 54.74 74.37 48.83 10 DCC_CHECK 201437 48.80 78.49 39.86 11 RCVD_IN_MSPIKE_H2 153396 30.68 31.74 30.36 12 T_TM2_M_HEADER_IN_MSG 152681 28.09 21.04 30.22 13 HTML_FONT_LOW_CONTRAST 134335 28.46 34.69 26.58 14 DKIM_VALID_EF 134238 25.65 22.62 26.57 15 LOC_TINY_FONT_1 112155 25.21 35.24 22.20 16 FVGT_m_MULTI_ODD 105088 22.61 28.65 20.80 17 XMSubLong 104745 21.82 25.43 20.73 18 MIME_HTML_ONLY 102262 23.01 32.20 20.24 19 MultiRelay 98175 18.80 16.72 19.43 20 T_KAM_HTML_FONT_INVALID 89065 18.78 22.62 17.63 21 ALL_TRUSTED 88739 14.10 2.62 17.56 22 XM_Body_Dirty_Words 60826 14.26 21.64 12.04 23 XM_DK_Undo_02 60732 20.33 47.92 12.02 24 BAYES_00 58965 9.18 0.91 11.67 25 XM_Multi_Part_URI 55371 12.93 19.50 10.96 26 BAYES_99 49816 17.09 41.12 9.86 27 RCVD_IN_RP_SAFE 48476 8.00 2.71 9.59 28 XM_Evil_Numbers_Gen 47490 10.53 14.29 9.40 29 TR_XM_DK_Bayes 46263 7.16 0.54 9.16 30 TR_XM_DK_Bayes1 44991 6.96 0.51 8.90 31 BAYES_999 43259 14.27 33.25 8.56 32 TooManyTo_001 43160 8.49 8.30 8.54 33 RCVD_IN_RP_CERTIFIED 42517 6.96 2.12 8.41 34 FSL_BULK_SIG 41382 8.72 10.47 8.19 35 T_XMDrugObfuBody_14 41357 8.37 8.97 8.18 36 LotsOfNums_01 40207 8.33 9.56 7.96 37 TR_XM_DK_Bayes2 39384 6.09 0.44 7.79 38 HTML_IMAGE_RATIO_02 39293 9.15 13.73 7.78 39 LOTS_OF_MONEY 38735 8.80 12.58 7.67 40 XM_DKIMWhitelistDomains 37731 5.74 0.02 7.47 41 MIME_QP_LONG_LINE 32001 6.34 6.38 6.33 42 XM_SendGrid 31710 5.78 4.12 6.28 43 XM_H_Long_From01 31553 6.47 7.21 6.24 44 BAYES_60 30218 6.03 6.20 5.98 45 XM_PDF 29807 4.75 0.94 5.90 46 RCVD_IN_IADB_LISTED 28465 5.09 3.28 5.63 47 XMStrtUSub 28347 5.14 3.56 5.61 48 RELAYCOUNTRY_META 27338 8.63 19.30 5.41 49 XM_B_Phish_Phrases 26976 5.76 7.14 5.34 50 T_REMOTE_IMAGE 25323 4.78 3.99 5.01 51 T_TooManySym_01 24995 4.39 2.55 4.95 52 RCVD_IN_IADB_SPF 24820 4.43 2.85 4.91 53 TO_MALFORMED 24345 3.72 0.06 4.82 54 BOTNET_IPINHOSTNAME 24289 7.16 14.98 4.81 55 TR_DCC_Bayes_99 23679 11.19 32.79 4.69 56 BAYES_40 23220 4.01 2.08 4.60 57 HTML_IMAGE_RATIO_04 22945 5.52 8.77 4.54 58 RCVD_IN_IADB_SENDERID 21627 3.92 2.71 4.28 59 XM_UncommonTLD01 21525 4.68 6.07 4.26 60 RCVD_IN_IADB_DK 21222 3.85 2.67 4.20 61 IN_ZIMBRA_NJ_WHITELIST 19899 3.03 0.02 3.94 62 BAYES_80 19522 4.72 7.57 3.86 63 DKIM_INVALID 19502 3.97 4.33 3.86 64 FROM_EXCESS_BASE64 19017 3.83 4.04 3.76 65 RCVD_IN_IADB_VOUCHED 18935 3.23 1.51 3.75 66 XMSubMetaSx_00 18463 4.56 7.57 3.65 67 TR_XM_DK_SendGrid 17286 3.06 1.85 3.42 68 XM_B_SpammyTLD 16881 3.46 3.86 3.34 69 MPART_ALT_DIFF 16777 4.32 7.65 3.32 70 BAYES_20 16388 2.84 1.51 3.24 71 HTML_IMAGE_RATIO_06 16374 3.46 4.18 3.24 72 XMSexyCombo_05 15634 4.76 10.28 3.09 73 HTML_MIME_NO_HTML_TAG 15569 3.35 4.23 3.08 74 BAYES_95 15000 3.26 4.22 2.97 75 XMNumbers 13656 3.03 4.11 2.70 76 MAILING_LIST_MULTI 13280 2.50 2.09 2.63 77 UNPARSEABLE_RELAY 12372 2.11 0.97 2.45 78 XM_DIRTYINTL 12116 3.18 5.79 2.40 79 RCVD_IN_IADB_OPTIN 12019 2.02 0.82 2.38 80 INVALID_MSGID 10950 1.71 0.19 2.17 81 BOTNET 10919 5.56 16.84 2.16 82 TooManyTo_002 10748 1.93 1.28 2.13 83 MIME_HTML_MOSTLY 10655 2.62 4.31 2.11 84 KHOP_HELO_FCRDNS 10640 2.12 2.17 2.11 85 XM_CamelCaseFrm001 10451 2.31 3.09 2.07 86 TVD_RCVD_IP 10398 1.68 0.43 2.06 87 TR_MetaPhish_Combo_01 10366 1.75 0.74 2.05 88 HTML_IMAGE_RATIO_08 10247 2.23 2.90 2.03 89 BAYES_05 10173 1.75 0.86 2.01 90 XMDiploma_00 9826 2.25 3.27 1.94 91 XM_SPF_SoftFail 9747 2.48 4.30 1.93 92 TM2_M_URI_OPT_OUT 9398 2.29 3.71 1.86 93 MIME_HTML_ONLY_MULTI 9189 2.45 4.54 1.82 94 ANY_BOUNCE_MESSAGE 8949 1.48 0.51 1.77 95 BOUNCE_MESSAGE 8947 1.48 0.51 1.77 96 HELO_NODOT 8892 1.50 0.62 1.76 97 HELO_NO_DOMAIN 8889 1.50 0.62 1.76 98 IN_HORDE_ADDRESS_BOOK 8839 1.35 0.03 1.75 99 URI_HEX 8652 2.18 3.72 1.71 100 SUBJ_ALL_CAPS 8589 1.87 2.44 1.70 101 XM_DK_Undo_01 8558 1.66 1.53 1.69 102 T_XMDrugObfuBody_08 8508 2.11 3.51 1.68 103 T_TooManySym_02 8061 1.44 0.92 1.60 104 XMCapTrack 7889 1.30 0.45 1.56 105 XM_OfRef6 7689 1.77 2.62 1.52 106 T_FILL_THIS_FORM_SHORT 7523 1.39 1.07 1.49 107 RELAYCOUNTRY_CA 7513 2.05 3.92 1.49 108 TR_Symld_Words 7381 1.46 1.44 1.46 109 UNTRUSTED_Relay 7237 3.91 12.15 1.43 110 TooManyTo_003 7160 1.35 1.11 1.42 111 TR_XM_PHPDW 6819 1.68 2.79 1.35 112 TR_XM_PHPForged 6671 1.64 2.72 1.32 113 TR_XM_FormFill2 6595 1.62 2.68 1.31 114 XM_H_PHPOS 6572 1.62 2.67 1.30 115 XMPhish11 6342 1.24 1.20 1.26 116 USER_IN_DEF_DKIM_WL 6205 0.95 0.01 1.23 117 XMGenDplmaNmb 6175 1.46 2.26 1.22 118 RELAYCOUNTRY_GB 6029 1.23 1.36 1.19 119 XM_GoogleGroups 5890 1.02 0.55 1.17 120 XM_H_Long_From02 5827 1.32 1.86 1.15 121 TooManyTo_004 5415 1.05 0.99 1.07 122 TM2_M_VERY_LONG_WORD 5357 1.23 1.79 1.06 123 HTML_IMAGE_ONLY_24 5326 1.37 2.41 1.05 124 T_OBFU_PDF_ATTACH 5297 0.88 0.32 1.05 125 XMBdyGiftCard01 5200 1.43 2.76 1.03 126 DKIM_ADSP_CUSTOM_MED 5140 1.09 1.31 1.02 127 XM_UB50 4847 1.91 5.09 0.96 128 NO_DNS_FOR_FROM 4831 1.32 2.52 0.96 129 US_DOLLARS_3 4796 1.44 3.07 0.95 130 URI_TRY_3LD 4775 1.06 1.45 0.94 131 TooManyTo_005 4527 0.89 0.88 0.90 132 FILL_THIS_FORM 4116 0.87 1.04 0.81 133 T_XMDrugObfuBody_00 4030 1.02 1.77 0.80 134 TR_XM_RelayPhish 3996 0.95 1.49 0.79 135 XMStockSpam_06 3785 0.92 1.50 0.75 136 RCVD_IN_BL_SPAMCOP_NET 3768 1.26 2.95 0.75 137 SpammyFromTLD_01 3763 0.96 1.68 0.74 138 XMSexyCombo_01 3756 1.29 3.09 0.74 139 NML_ADSP_CUSTOM_MED 3747 0.81 1.03 0.74 140 DKIM_ADSP_NXDOMAIN 3675 1.21 2.81 0.73 141 TO_NO_BRKTS_HTML_ONLY 3516 0.60 0.29 0.70 142 XM_ProductURIs 3243 0.79 1.29 0.64 143 RELAYCOUNTRY_AU 3222 0.69 0.88 0.64 144 XMSubMetaI_00 3187 0.96 2.05 0.63 145 T_Symld_Words_02 3123 0.69 0.92 0.62 146 HTML_TAG_BALANCE_BODY 3071 0.67 0.90 0.61 147 HTTPS_HTTP_MISMATCH 3015 0.61 0.67 0.60 148 XM_H_PHPMailer 2996 0.76 1.31 0.59 149 BODY_QUOTE_MALF_MSGID 2916 0.60 0.68 0.58 150 T_FILL_THIS_FORM_LONG 2913 0.54 0.43 0.58 151 XMLngstWrd_00 2897 0.55 0.46 0.57 152 XMSubMetaSxObfu_03 2874 0.61 0.76 0.57 153 T_XMHurry_00 2870 0.76 1.41 0.57 154 XM_ShortIntro_01 2858 0.52 0.37 0.57 155 XMNoVowels 2854 0.53 0.40 0.56 156 HTML_FONT_SIZE_LARGE 2849 0.48 0.19 0.56 157 FROM_GOV_DKIM_AU 2837 0.49 0.25 0.56 158 HTML_FONT_FACE_BAD 2805 0.70 1.18 0.56 159 T_TooManySym_03 2804 0.48 0.21 0.55 160 XMLngstWrd_01 2716 0.51 0.43 0.54 161 T_FILL_THIS_FORM_LOAN 2709 0.49 0.36 0.54 162 XMGappySubj_01 2705 0.52 0.45 0.54 163 XMBody_78 2632 0.63 1.00 0.52 164 XMHTMLBadTable_001 2627 0.64 1.06 0.52 165 USER_IN_WHITELIST 2615 0.40 0.00 0.52 166 FORGED_GMAIL_RCVD 2613 0.67 1.16 0.52 167 TM2_M_A_HREF_HREF 2555 0.63 1.03 0.51 168 XMBody_95 2550 0.41 0.09 0.50 169 FROM_GOV_SPOOF 2544 0.47 0.34 0.50 170 XMMoneyMeta_00 2533 0.61 0.98 0.50 171 SHORT_HELO_AND_INLINE_IMAGE 2507 0.39 0.04 0.50 172 XMBrknScrpt_02 2469 0.66 1.21 0.49 173 HTML_IMAGE_ONLY_28 2461 0.67 1.30 0.49 174 PLING_QUERY 2418 0.48 0.49 0.48 175 MISSING_HEADERS 2386 0.63 1.14 0.47 176 TM2_M_BODY_EMPTY 2350 0.38 0.10 0.47 177 XMSlimDrugH 2303 0.65 1.29 0.46 178 XM_B_COPY_HTML 2271 0.50 0.68 0.45 179 XM_B_REG_HTML 2182 0.58 1.05 0.43 180 XMBody_17 2167 0.62 1.26 0.43 181 XMOemUri 2112 0.39 0.32 0.42 182 RDNS_DYNAMIC 2045 0.59 1.22 0.40 183 XMHTML_After_End 2040 0.86 2.36 0.40 184 HTML_IMAGE_ONLY_32 2013 0.42 0.47 0.40 185 XMPhish30 1982 0.59 1.26 0.39 186 RELAYCOUNTRY_DE 1980 0.55 1.08 0.39 187 XMSubMetaSxObfu_02 1974 0.40 0.44 0.39 188 XM_USANA_RCVD 1953 0.30 0.00 0.39 189 URI_NOVOWEL 1942 0.47 0.77 0.38 190 RCVD_IN_SORBS_DUL 1908 0.34 0.22 0.38 191 TR_LOTS_OF_MONEY3 1866 0.56 1.21 0.37 192 XMDateMe_00 1820 0.36 0.35 0.36 193 XMPhish14 1815 0.46 0.82 0.36 194 XMGppyBdWords 1782 0.44 0.73 0.35 195 XM_Body_Obfu01 1772 0.34 0.30 0.35 196 XM_B_TRADE_HTML 1757 0.34 0.31 0.35 197 HTML_IMAGE_ONLY_20 1674 0.35 0.43 0.33 198 AC_DIV_BONANZA 1673 0.27 0.07 0.33 199 XMSubNoVowel 1672 0.37 0.51 0.33 200 SUBJ_DOLLARS 1618 0.62 1.60 0.32 ----------------------------------------------------------------------