Email: 597605 Autolearn: 0 AvgScore: 2.67 AvgScanTime: 2.10 sec Spam: 137754 Autolearn: 0 AvgScore: 12.06 AvgScanTime: 2.63 sec Ham: 459851 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 1.94 sec Time Spent Running SA: 348.36 hours Time Spent Processing Spam: 100.72 hours Time Spent Processing Ham: 247.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131018 88.94 95.11 87.09 2 DKIM_SIGNED 116396 77.38 84.50 75.25 3 XM_DK_Pass 111688 75.62 81.08 73.99 4 DCC_CHECK 110291 49.62 80.06 40.50 5 DKIM_VALID 108158 72.81 78.52 71.10 6 XM_B_Unicode 107948 70.35 78.36 67.95 7 XMListUnsubscribeExists 102841 55.58 74.66 49.87 8 DKIM_VALID_AU 81164 54.45 58.92 53.11 9 XM_DK_Undo_02 66634 21.55 48.37 13.51 10 BAYES_99 56748 18.34 41.20 11.50 11 HTML_FONT_LOW_CONTRAST 50577 30.39 36.72 28.49 12 BAYES_50 49044 49.29 35.60 53.39 13 BAYES_999 46401 15.50 33.68 10.06 14 TR_DCC_Bayes_99 45877 11.97 33.30 5.58 15 MIME_HTML_ONLY 43828 22.97 31.82 20.32 16 RCVD_IN_MSPIKE_H2 43723 31.11 31.74 30.92 17 LOC_TINY_FONT_1 43102 24.98 31.29 23.10 18 FVGT_m_MULTI_ODD 38586 22.37 28.01 20.68 19 XMSubLong 36649 24.00 26.60 23.22 20 DKIM_VALID_EF 32713 26.59 23.75 27.44 21 XM_Body_Dirty_Words 32676 16.09 23.72 13.81 22 T_KAM_HTML_FONT_INVALID 28232 17.92 20.49 17.15 23 T_TM2_M_HEADER_IN_MSG 28228 28.59 20.49 31.02 24 RELAYCOUNTRY_META 25491 8.18 18.50 5.09 25 DCC_CHECK_NEGATIVE 25175 48.31 18.28 57.31 26 XM_Multi_Part_URI 24534 12.55 17.81 10.97 27 BOTNET 23817 5.48 17.29 1.94 28 MultiRelay 23260 19.16 16.89 19.84 29 BOTNET_IPINHOSTNAME 19883 6.82 14.43 4.54 30 XM_Evil_Numbers_Gen 18826 10.61 13.67 9.69 31 HTML_IMAGE_RATIO_02 18604 9.07 13.51 7.75 32 XMSexyCombo_05 16331 5.88 11.86 4.09 33 UNTRUSTED_Relay 16285 3.77 11.82 1.36 34 LOTS_OF_MONEY 15812 9.33 11.48 8.69 35 FSL_BULK_SIG 15513 9.14 11.26 8.50 36 T_XMDrugObfuBody_14 12885 8.30 9.35 7.99 37 LotsOfNums_01 12690 8.46 9.21 8.23 38 MPART_ALT_DIFF 12490 4.67 9.07 3.35 39 HTML_IMAGE_RATIO_04 12188 6.53 8.85 5.83 40 XMSubMetaSx_00 11327 5.05 8.22 4.09 41 XM_H_Long_From01 11296 6.64 8.20 6.17 42 XM_B_Phish_Phrases 10857 6.50 7.88 6.08 43 BAYES_80 10640 4.78 7.72 3.89 44 TooManyTo_001 9919 8.35 7.20 8.69 45 XM_UncommonTLD01 9011 4.70 6.54 4.15 46 BAYES_60 8405 6.15 6.10 6.16 47 XM_DIRTYINTL 8373 3.79 6.08 3.10 48 DKIM_INVALID 8238 4.57 5.98 4.15 49 MIME_QP_LONG_LINE 7764 5.63 5.64 5.63 50 HTML_IMAGE_RATIO_06 7524 3.75 5.46 3.24 51 XM_UB50 7380 1.88 5.36 0.84 52 MIME_HTML_ONLY_MULTI 6844 2.49 4.97 1.75 53 XM_SPF_SoftFail 6408 2.65 4.65 2.05 54 SpammyFromTLD_02 6166 1.29 4.48 0.33 55 FROM_EXCESS_BASE64 6133 4.34 4.45 4.31 56 BAYES_95 6036 3.02 4.38 2.62 57 XM_B_SpammyTLD 5671 3.56 4.12 3.40 58 MIME_HTML_MOSTLY 5621 2.52 4.08 2.05 59 RELAYCOUNTRY_CA 5501 2.04 3.99 1.45 60 XM_SendGrid 5396 5.75 3.92 6.30 61 NO_DNS_FOR_FROM 5294 1.64 3.84 0.98 62 XMNumbers 5239 3.19 3.80 3.00 63 TM2_M_URI_OPT_OUT 5101 2.64 3.70 2.32 64 XMStrtUSub 5028 4.10 3.65 4.23 65 URI_HEX 5010 2.39 3.64 2.01 66 RCVD_IN_BL_SPAMCOP_NET 4956 1.59 3.60 0.99 67 XMSexyCombo_01 4916 1.58 3.57 0.99 68 XMDiploma_00 4885 2.15 3.55 1.73 69 XM_URI_RBL 4761 1.01 3.46 0.28 70 T_XMDrugObfuBody_08 4467 2.29 3.24 2.01 71 RCVD_IN_IADB_LISTED 4375 4.71 3.18 5.17 72 T_REMOTE_IMAGE 4370 3.96 3.17 4.20 73 RELAYCOUNTRY_FR 4363 0.96 3.17 0.30 74 XM_CamelCaseFrm001 4263 2.25 3.09 1.99 75 HTML_IMAGE_RATIO_08 4051 2.22 2.94 2.01 76 RCVD_IN_IADB_SPF 3936 4.10 2.86 4.47 77 ALL_TRUSTED 3931 12.76 2.85 15.73 78 HTML_MIME_NO_HTML_TAG 3851 2.43 2.80 2.33 79 DKIM_ADSP_NXDOMAIN 3801 1.16 2.76 0.68 80 RCVD_IN_IADB_SENDERID 3742 3.63 2.72 3.90 81 T_TooManySym_01 3740 4.61 2.71 5.18 82 XMHTML_After_End 3722 0.92 2.70 0.39 83 RCVD_IN_IADB_DK 3692 3.55 2.68 3.82 84 RCVD_IN_RP_SAFE 3457 9.22 2.51 11.24 85 TR_XM_PHPDW 3410 1.24 2.48 0.86 86 XMGenDplmaNmb 3393 1.38 2.46 1.06 87 TR_XM_PHPForged 3324 1.20 2.41 0.83 88 RCVD_IN_RP_RNBL 3309 0.59 2.40 0.04 89 TR_XM_FormFill2 3278 1.17 2.38 0.81 90 XM_H_PHPOS 3261 1.16 2.37 0.80 91 XM_OfRef6 3223 1.59 2.34 1.37 92 US_DOLLARS_3 3156 1.34 2.29 1.06 93 XMBdyGiftCard01 3014 1.30 2.19 1.03 94 SUBJ_DOLLARS 3013 0.88 2.19 0.48 95 KHOP_HELO_FCRDNS 2995 2.13 2.17 2.12 96 TR_Symld_Words 2986 1.88 2.17 1.79 97 XM_UB99 2858 0.48 2.07 0.01 98 TM2_M_VERY_LONG_WORD 2835 1.39 2.06 1.19 99 SpammyFromTLD_01 2824 1.08 2.05 0.79 100 BOTNET_NORDNS 2800 0.53 2.03 0.08 101 SUBJ_ALL_CAPS 2753 1.73 2.00 1.65 102 MultiRelay_CC 2664 0.63 1.93 0.24 103 RCVD_IN_PSBL 2664 0.47 1.93 0.03 104 MultiRelay_Combo 2664 0.63 1.93 0.24 105 XMStockSpam_06 2636 1.49 1.91 1.36 106 THIS_AD 2531 0.53 1.84 0.14 107 XMSubMetaI_00 2459 0.86 1.79 0.58 108 XM_H_Long_From02 2436 1.22 1.77 1.06 109 TR_XM_RelayPhish 2434 1.38 1.77 1.27 110 TR_XM_DK_SendGrid 2414 3.03 1.75 3.41 111 RELAYCOUNTRY_IN 2404 0.47 1.75 0.09 112 BAYES_40 2335 3.81 1.70 4.45 113 T_XMDrugObfuBody_00 2307 0.84 1.67 0.59 114 RCVD_IN_RP_CERTIFIED 2283 8.21 1.66 10.17 115 XMPhish30 2246 0.77 1.63 0.51 116 XM_UB60 2218 0.44 1.61 0.09 117 URI_TRY_3LD 2200 1.13 1.60 0.99 118 NUMERIC_HTTP_ADDR 2194 0.63 1.59 0.34 119 XMBody_17 2135 0.72 1.55 0.47 120 XM_UB999 2110 0.36 1.53 0.01 121 XM_H_PHPMailer 2077 0.85 1.51 0.65 122 MAILING_LIST_MULTI 2050 2.30 1.49 2.54 123 DIET_1 2027 0.58 1.47 0.31 124 XMPhish11 1961 1.34 1.42 1.31 125 HTML_IMAGE_ONLY_24 1948 0.63 1.41 0.39 126 MISSING_HEADERS 1933 0.70 1.40 0.49 127 BAYES_20 1879 2.86 1.36 3.30 128 XM_ProductURIs 1866 0.93 1.35 0.80 129 RCVD_IN_IADB_VOUCHED 1837 3.05 1.33 3.56 130 XM_DK_Undo_01 1825 1.71 1.32 1.82 131 NORMAL_HTTP_TO_IP 1781 0.33 1.29 0.04 132 T_XMHurry_00 1779 0.83 1.29 0.70 133 UNPARSEABLE_RELAY 1773 2.30 1.29 2.61 134 XM_UB80 1763 0.32 1.28 0.03 135 DATE_IN_PAST_03_06 1756 0.37 1.27 0.10 136 TM2_M_A_HREF_HREF 1655 0.55 1.20 0.35 137 REPLYTO_WITHOUT_TO_CC 1646 0.36 1.19 0.11 138 XM_H_PHPOS_M 1574 0.43 1.14 0.22 139 HDRS_LCASE_IMGONLY 1564 0.30 1.14 0.06 140 HK_RANDOM_ENVFROM 1540 0.34 1.12 0.10 141 TR_LOTS_OF_MONEY2 1525 0.68 1.11 0.56 142 T_MONEY_PERCENT 1525 0.68 1.11 0.56 143 DKIM_ADSP_CUSTOM_MED 1524 1.06 1.11 1.04 144 URIBL_BLACK 1516 0.31 1.10 0.07 145 MIME_HEADER_CTYPE_ONLY 1507 0.36 1.09 0.14 146 XMSexyCombo_04 1504 0.43 1.09 0.24 147 XMSlimDrugH 1495 0.53 1.09 0.37 148 DATE_IN_PAST_12_24 1474 0.28 1.07 0.05 149 BAYES_00 1472 9.69 1.07 12.27 150 DATE_IN_PAST_06_12 1468 0.29 1.07 0.06 151 RELAYCOUNTRY_RO 1466 0.25 1.06 0.01 152 T_FILL_THIS_FORM_SHORT 1464 1.09 1.06 1.10 153 XM_HighProb1 1428 0.25 1.04 0.01 154 PLING_QUERY 1423 0.61 1.03 0.49 155 BASE64_LENGTH_79_INF 1407 0.49 1.02 0.33 156 XMBrknScrpt_02 1364 0.71 0.99 0.62 157 HTML_TAG_BALANCE_BODY 1364 0.61 0.99 0.50 158 T_TooManySym_02 1361 1.55 0.99 1.71 159 RELAYCOUNTRY_GB 1359 1.11 0.99 1.15 160 XMBody_78 1345 0.63 0.98 0.53 161 TR_Mismatch_TLD_02 1342 0.27 0.97 0.06 162 XM_PDF 1338 4.02 0.97 4.94 163 XMMoneyMeta_00 1338 0.59 0.97 0.48 164 FORGED_GMAIL_RCVD 1311 0.56 0.95 0.45 165 XMSolicitRefs_0 1304 0.44 0.95 0.29 166 SHORT_URI_3 1300 0.27 0.94 0.07 167 XMSubMetaSxObfu_02 1240 0.68 0.90 0.62 168 TR_LOTS_OF_MONEY3 1226 0.39 0.89 0.24 169 TooManyTo_002 1225 1.96 0.89 2.28 170 XMNoVowels 1213 0.59 0.88 0.51 171 NML_ADSP_CUSTOM_MED 1211 0.80 0.88 0.78 172 XMHTMLBadTable_001 1198 0.54 0.87 0.44 173 RDNS_DYNAMIC 1198 0.51 0.87 0.40 174 RELAYCOUNTRY_DE 1197 0.48 0.87 0.37 175 LOW_PRICE 1182 0.83 0.86 0.82 176 XM_B_COPY_HTML 1181 0.62 0.86 0.55 177 RELAYCOUNTRY_AT 1170 0.32 0.85 0.17 178 HTML_IMAGE_ONLY_28 1162 0.52 0.84 0.43 179 HTTPS_HTTP_MISMATCH 1144 0.72 0.83 0.68 180 SHORT_URI_4 1141 0.22 0.83 0.03 181 XMPhish14 1137 0.49 0.83 0.39 182 LongTLD 1106 0.32 0.80 0.18 183 TR_Mismatch_TLD_01 1096 0.30 0.80 0.15 184 RCVD_IN_IADB_OPTIN 1087 1.90 0.79 2.24 185 XM_B_REG_HTML 1081 0.66 0.78 0.62 186 HTML_FONT_FACE_BAD 1070 0.66 0.78 0.62 187 XMSubMetaSxObfu_03 1061 0.49 0.77 0.40 188 T_Symld_Words_02 1048 0.70 0.76 0.69 189 XM_UB95 1042 0.18 0.76 0.01 190 URI_NOVOWEL 1029 0.46 0.75 0.38 191 FROM_SUSPICIOUS_NTLD 1016 0.20 0.74 0.04 192 HELO_NODOT 1015 1.63 0.74 1.90 193 HELO_NO_DOMAIN 1015 1.63 0.74 1.90 194 BODY_QUOTE_MALF_MSGID 1008 0.57 0.73 0.52 195 TooManyTo_003 999 1.31 0.73 1.48 196 FROM_SUSPICIOUS_NTLD_FP 991 0.19 0.72 0.04 197 NORDNS_LOW_CONTRAST 983 0.17 0.71 0.01 198 XM_OfRef7 940 0.28 0.68 0.16 199 XM_BadFromFormat 932 0.25 0.68 0.12 200 BAYES_05 909 1.78 0.66 2.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 400479 88.94 95.11 87.09 2 DKIM_SIGNED 346023 77.38 84.50 75.25 3 XM_DK_Pass 340230 75.62 81.08 73.99 4 DKIM_VALID 326951 72.81 78.52 71.10 5 XM_B_Unicode 312483 70.35 78.36 67.95 6 DCC_CHECK_NEGATIVE 263540 48.31 18.28 57.31 7 BAYES_50 245501 49.29 35.60 53.39 8 DKIM_VALID_AU 244235 54.45 58.92 53.11 9 XMListUnsubscribeExists 229335 55.58 74.66 49.87 10 DCC_CHECK 186251 49.62 80.06 40.50 11 T_TM2_M_HEADER_IN_MSG 142644 28.59 20.49 31.02 12 RCVD_IN_MSPIKE_H2 142203 31.11 31.74 30.92 13 HTML_FONT_LOW_CONTRAST 131025 30.39 36.72 28.49 14 DKIM_VALID_EF 126180 26.59 23.75 27.44 15 XMSubLong 106789 24.00 26.60 23.22 16 LOC_TINY_FONT_1 106203 24.98 31.29 23.10 17 FVGT_m_MULTI_ODD 95093 22.37 28.01 20.68 18 MIME_HTML_ONLY 93453 22.97 31.82 20.32 19 MultiRelay 91247 19.16 16.89 19.84 20 T_KAM_HTML_FONT_INVALID 78875 17.92 20.49 17.15 21 ALL_TRUSTED 72336 12.76 2.85 15.73 22 XM_Body_Dirty_Words 63497 16.09 23.72 13.81 23 XM_DK_Undo_02 62141 21.55 48.37 13.51 24 BAYES_00 56439 9.69 1.07 12.27 25 BAYES_99 52880 18.34 41.20 11.50 26 RCVD_IN_RP_SAFE 51672 9.22 2.51 11.24 27 XM_Multi_Part_URI 50466 12.55 17.81 10.97 28 RCVD_IN_RP_CERTIFIED 46765 8.21 1.66 10.17 29 BAYES_999 46254 15.50 33.68 10.06 30 XM_Evil_Numbers_Gen 44571 10.61 13.67 9.69 31 TR_XM_DK_Bayes 43976 7.49 0.58 9.56 32 TR_XM_DK_Bayes1 42538 7.25 0.56 9.25 33 TooManyTo_001 39961 8.35 7.20 8.69 34 LOTS_OF_MONEY 39940 9.33 11.48 8.69 35 FSL_BULK_SIG 39101 9.14 11.26 8.50 36 LotsOfNums_01 37858 8.46 9.21 8.23 37 T_XMDrugObfuBody_14 36740 8.30 9.35 7.99 38 XM_DKIMWhitelistDomains 36612 6.15 0.12 7.96 39 TR_XM_DK_Bayes2 36558 6.23 0.49 7.95 40 HTML_IMAGE_RATIO_02 35624 9.07 13.51 7.75 41 XM_SendGrid 28961 5.75 3.92 6.30 42 XM_H_Long_From01 28367 6.64 8.20 6.17 43 BAYES_60 28348 6.15 6.10 6.16 44 XM_B_Phish_Phrases 27961 6.50 7.88 6.08 45 HTML_IMAGE_RATIO_04 26827 6.53 8.85 5.83 46 MIME_QP_LONG_LINE 25894 5.63 5.64 5.63 47 TR_DCC_Bayes_99 25669 11.97 33.30 5.58 48 TO_MALFORMED 24358 4.09 0.08 5.30 49 T_TooManySym_01 23837 4.61 2.71 5.18 50 RCVD_IN_IADB_LISTED 23782 4.71 3.18 5.17 51 RELAYCOUNTRY_META 23418 8.18 18.50 5.09 52 XM_PDF 22714 4.02 0.97 4.94 53 BOTNET_IPINHOSTNAME 20899 6.82 14.43 4.54 54 RCVD_IN_IADB_SPF 20564 4.10 2.86 4.47 55 BAYES_40 20446 3.81 1.70 4.45 56 FROM_EXCESS_BASE64 19826 4.34 4.45 4.31 57 XMStrtUSub 19447 4.10 3.65 4.23 58 T_REMOTE_IMAGE 19320 3.96 3.17 4.20 59 IN_ZIMBRA_NJ_WHITELIST 19177 3.21 0.03 4.17 60 XM_UncommonTLD01 19097 4.70 6.54 4.15 61 DKIM_INVALID 19072 4.57 5.98 4.15 62 XMSubMetaSx_00 18826 5.05 8.22 4.09 63 XMSexyCombo_05 18798 5.88 11.86 4.09 64 RCVD_IN_IADB_SENDERID 17940 3.63 2.72 3.90 65 BAYES_80 17910 4.78 7.72 3.89 66 RCVD_IN_IADB_DK 17550 3.55 2.68 3.82 67 RCVD_IN_IADB_VOUCHED 16384 3.05 1.33 3.56 68 TR_XM_DK_SendGrid 15686 3.03 1.75 3.41 69 XM_B_SpammyTLD 15621 3.56 4.12 3.40 70 MPART_ALT_DIFF 15421 4.67 9.07 3.35 71 BAYES_20 15186 2.86 1.36 3.30 72 HTML_IMAGE_RATIO_06 14906 3.75 5.46 3.24 73 XM_DIRTYINTL 14249 3.79 6.08 3.10 74 XMNumbers 13808 3.19 3.80 3.00 75 BAYES_95 12037 3.02 4.38 2.62 76 UNPARSEABLE_RELAY 11996 2.30 1.29 2.61 77 MAILING_LIST_MULTI 11699 2.30 1.49 2.54 78 INVALID_MSGID 10987 1.86 0.11 2.39 79 HTML_MIME_NO_HTML_TAG 10699 2.43 2.80 2.33 80 TM2_M_URI_OPT_OUT 10653 2.64 3.70 2.32 81 TooManyTo_002 10488 1.96 0.89 2.28 82 TVD_RCVD_IP 10447 1.83 0.36 2.27 83 RCVD_IN_IADB_OPTIN 10290 1.90 0.79 2.24 84 BAYES_05 9753 1.78 0.66 2.12 85 KHOP_HELO_FCRDNS 9750 2.13 2.17 2.12 86 XM_SPF_SoftFail 9412 2.65 4.65 2.05 87 MIME_HTML_MOSTLY 9410 2.52 4.08 2.05 88 URI_HEX 9260 2.39 3.64 2.01 89 T_XMDrugObfuBody_08 9236 2.29 3.24 2.01 90 HTML_IMAGE_RATIO_08 9232 2.22 2.94 2.01 91 XM_CamelCaseFrm001 9165 2.25 3.09 1.99 92 BOTNET 8933 5.48 17.29 1.94 93 HELO_NODOT 8745 1.63 0.74 1.90 94 HELO_NO_DOMAIN 8744 1.63 0.74 1.90 95 IN_HORDE_ADDRESS_BOOK 8406 1.41 0.04 1.83 96 XM_DK_Undo_01 8381 1.71 1.32 1.82 97 ANY_BOUNCE_MESSAGE 8301 1.51 0.51 1.81 98 BOUNCE_MESSAGE 8301 1.51 0.51 1.81 99 TR_MetaPhish_Combo_01 8288 1.52 0.56 1.80 100 TR_Symld_Words 8244 1.88 2.17 1.79 101 MIME_HTML_ONLY_MULTI 8059 2.49 4.97 1.75 102 XMDiploma_00 7952 2.15 3.55 1.73 103 T_TooManySym_02 7886 1.55 0.99 1.71 104 SUBJ_ALL_CAPS 7594 1.73 2.00 1.65 105 XMCapTrack 7130 1.28 0.36 1.55 106 TooManyTo_003 6824 1.31 0.73 1.48 107 RELAYCOUNTRY_CA 6679 2.04 3.99 1.45 108 USER_IN_DEF_DKIM_WL 6489 1.09 0.04 1.41 109 XM_OfRef6 6280 1.59 2.34 1.37 110 XMStockSpam_06 6242 1.49 1.91 1.36 111 UNTRUSTED_Relay 6231 3.77 11.82 1.36 112 XMPhish11 6022 1.34 1.42 1.31 113 TR_XM_RelayPhish 5823 1.38 1.77 1.27 114 XM_GoogleGroups 5644 1.07 0.52 1.23 115 TM2_M_VERY_LONG_WORD 5482 1.39 2.06 1.19 116 RELAYCOUNTRY_GB 5284 1.11 0.99 1.15 117 TooManyTo_004 5096 1.00 0.63 1.11 118 T_FILL_THIS_FORM_SHORT 5065 1.09 1.06 1.10 119 XM_H_Long_From02 4881 1.22 1.77 1.06 120 XMGenDplmaNmb 4866 1.38 2.46 1.06 121 US_DOLLARS_3 4852 1.34 2.29 1.06 122 DKIM_ADSP_CUSTOM_MED 4796 1.06 1.11 1.04 123 XMBdyGiftCard01 4743 1.30 2.19 1.03 124 RCVD_IN_BL_SPAMCOP_NET 4552 1.59 3.60 0.99 125 URI_TRY_3LD 4540 1.13 1.60 0.99 126 XMSexyCombo_01 4538 1.58 3.57 0.99 127 NO_DNS_FOR_FROM 4506 1.64 3.84 0.98 128 TooManyTo_005 4274 0.84 0.56 0.93 129 TR_XM_PHPDW 3972 1.24 2.48 0.86 130 XM_UB50 3873 1.88 5.36 0.84 131 TR_XM_PHPForged 3822 1.20 2.41 0.83 132 LOW_PRICE 3771 0.83 0.86 0.82 133 TR_XM_FormFill2 3703 1.17 2.38 0.81 134 XM_H_PHPOS 3687 1.16 2.37 0.80 135 XM_ProductURIs 3686 0.93 1.35 0.80 136 SpammyFromTLD_01 3635 1.08 2.05 0.79 137 T_OBFU_PDF_ATTACH 3633 0.69 0.34 0.79 138 NML_ADSP_CUSTOM_MED 3568 0.80 0.88 0.78 139 T_XMHurry_00 3198 0.83 1.29 0.70 140 T_Symld_Words_02 3161 0.70 0.76 0.69 141 HTTPS_HTTP_MISMATCH 3147 0.72 0.83 0.68 142 DKIM_ADSP_NXDOMAIN 3135 1.16 2.76 0.68 143 XM_H_PHPMailer 3001 0.85 1.51 0.65 144 XM_ShortIntro_01 2971 0.61 0.50 0.65 145 FILL_THIS_FORM 2900 0.58 0.39 0.63 146 HTML_FONT_FACE_BAD 2872 0.66 0.78 0.62 147 XMBrknScrpt_02 2864 0.71 0.99 0.62 148 XM_B_REG_HTML 2857 0.66 0.78 0.62 149 XMSubMetaSxObfu_02 2845 0.68 0.90 0.62 150 XMLngstWrd_00 2835 0.58 0.45 0.62 151 T_XMDrugObfuBody_00 2716 0.84 1.67 0.59 152 XMSubMetaI_00 2679 0.86 1.79 0.58 153 T_TooManySym_03 2676 0.52 0.32 0.58 154 XMLngstWrd_01 2655 0.54 0.42 0.58 155 TR_LOTS_OF_MONEY2 2554 0.68 1.11 0.56 156 T_MONEY_PERCENT 2554 0.68 1.11 0.56 157 XM_B_COPY_HTML 2543 0.62 0.86 0.55 158 USER_IN_WHITELIST 2458 0.41 0.00 0.53 159 XMBody_78 2442 0.63 0.98 0.53 160 AC_DIV_BONANZA 2405 0.43 0.14 0.52 161 XMBody_95 2385 0.43 0.14 0.52 162 BODY_QUOTE_MALF_MSGID 2381 0.57 0.73 0.52 163 FROM_GOV_SPOOF 2362 0.45 0.23 0.51 164 XMNoVowels 2337 0.59 0.88 0.51 165 TM2_M_BODY_EMPTY 2336 0.41 0.09 0.51 166 XMPhish30 2329 0.77 1.63 0.51 167 HTML_TAG_BALANCE_BODY 2300 0.61 0.99 0.50 168 SHORT_HELO_AND_INLINE_IMAGE 2278 0.39 0.04 0.50 169 XMGappySubj_01 2266 0.46 0.36 0.49 170 MISSING_HEADERS 2261 0.70 1.40 0.49 171 PLING_QUERY 2241 0.61 1.03 0.49 172 SUBJ_DOLLARS 2220 0.88 2.19 0.48 173 XMMoneyMeta_00 2202 0.59 0.97 0.48 174 XMBody_17 2140 0.72 1.55 0.47 175 RELAYCOUNTRY_AU 2121 0.49 0.58 0.46 176 FORGED_GMAIL_RCVD 2048 0.56 0.95 0.45 177 XMHTMLBadTable_001 2040 0.54 0.87 0.44 178 T_FILL_THIS_FORM_LONG 2019 0.39 0.22 0.44 179 HTML_IMAGE_ONLY_28 1963 0.52 0.84 0.43 180 HTML_IMAGE_ONLY_32 1956 0.42 0.40 0.43 181 T_FILL_THIS_FORM_LOAN 1920 0.34 0.07 0.42 182 FROM_GOV_DKIM_AU 1918 0.35 0.14 0.42 183 XMDateMe_00 1897 0.40 0.34 0.41 184 RDNS_DYNAMIC 1840 0.51 0.87 0.40 185 XMSubMetaSxObfu_03 1838 0.49 0.77 0.40 186 HTML_IMAGE_ONLY_24 1810 0.63 1.41 0.39 187 XMHTML_After_End 1802 0.92 2.70 0.39 188 XMPhish14 1782 0.49 0.83 0.39 189 URI_NOVOWEL 1726 0.46 0.75 0.38 190 RCVD_IN_SORBS_DUL 1691 0.35 0.28 0.37 191 RELAYCOUNTRY_DE 1684 0.48 0.87 0.37 192 XMSlimDrugH 1682 0.53 1.09 0.37 193 TM2_M_A_HREF_HREF 1630 0.55 1.20 0.35 194 NUMERIC_HTTP_ADDR 1542 0.63 1.59 0.34 195 REMOVE_BEFORE_LINK 1540 0.36 0.47 0.33 196 SpammyFromTLD_02 1515 1.29 4.48 0.33 197 XM_USANA_RCVD 1506 0.25 0.00 0.33 198 XMSubNoVowel 1500 0.38 0.57 0.33 199 BASE64_LENGTH_79_INF 1498 0.49 1.02 0.33 200 HTML_IMAGE_ONLY_20 1456 0.32 0.32 0.32 ----------------------------------------------------------------------