Email: 596414 Autolearn: 0 AvgScore: 2.53 AvgScanTime: 2.23 sec Spam: 133066 Autolearn: 0 AvgScore: 12.05 AvgScanTime: 2.84 sec Ham: 463348 Autolearn: 0 AvgScore: -0.20 AvgScanTime: 2.05 sec Time Spent Running SA: 368.96 hours Time Spent Processing Spam: 104.79 hours Time Spent Processing Ham: 264.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125551 85.90 94.35 83.48 2 DKIM_SIGNED 109293 74.15 82.13 71.86 3 XM_DK_Pass 106716 72.79 80.20 70.67 4 XM_B_Unicode 104698 68.28 78.68 65.29 5 DCC_CHECK 103588 47.30 77.85 38.52 6 DKIM_VALID 103323 70.05 77.65 67.87 7 XMListUnsubscribeExists 97412 52.58 73.21 46.65 8 DKIM_VALID_AU 78309 52.15 58.85 50.22 9 XM_DK_Undo_02 64088 20.23 48.16 12.20 10 BAYES_99 55598 17.38 41.78 10.37 11 HTML_FONT_LOW_CONTRAST 51619 28.91 38.79 26.07 12 BAYES_50 47565 50.95 35.75 55.32 13 LOC_TINY_FONT_1 46469 24.79 34.92 21.88 14 BAYES_999 45908 14.75 34.50 9.08 15 TR_DCC_Bayes_99 44214 11.10 33.23 4.75 16 MIME_HTML_ONLY 42970 22.10 32.29 19.18 17 FVGT_m_MULTI_ODD 37201 21.89 27.96 20.14 18 XMSubLong 35050 23.16 26.34 22.25 19 XM_Body_Dirty_Words 30980 14.60 23.28 12.11 20 DKIM_VALID_EF 28773 25.91 21.62 27.14 21 T_KAM_HTML_FONT_INVALID 28347 17.00 21.30 15.77 22 DCC_CHECK_NEGATIVE 27191 50.75 20.43 59.46 23 RELAYCOUNTRY_META 26024 8.38 19.56 5.17 24 T_TM2_M_HEADER_IN_MSG 25625 28.14 19.26 30.69 25 XM_Multi_Part_URI 24936 12.98 18.74 11.32 26 MultiRelay 23429 19.31 17.61 19.80 27 BOTNET 20316 4.92 15.27 1.94 28 XM_Evil_Numbers_Gen 19722 10.27 14.82 8.96 29 HTML_IMAGE_RATIO_02 19128 9.16 14.37 7.67 30 BOTNET_IPINHOSTNAME 18120 6.40 13.62 4.33 31 XMSexyCombo_05 16026 5.45 12.04 3.56 32 UNTRUSTED_Relay 15403 3.65 11.58 1.37 33 FSL_BULK_SIG 14087 8.38 10.59 7.75 34 LOTS_OF_MONEY 13290 8.25 9.99 7.76 35 T_XMDrugObfuBody_14 12779 8.20 9.60 7.79 36 LotsOfNums_01 12527 8.13 9.41 7.76 37 RCVD_IN_MSPIKE_H2 11836 9.80 8.89 10.06 38 MPART_ALT_DIFF 10943 4.38 8.22 3.28 39 XM_H_Long_From01 10766 6.39 8.09 5.90 40 HTML_IMAGE_RATIO_04 10717 5.85 8.05 5.22 41 TooManyTo_001 10569 8.53 7.94 8.70 42 XMSubMetaSx_00 10320 4.38 7.76 3.41 43 XM_B_Phish_Phrases 10106 6.12 7.59 5.69 44 BAYES_80 9768 4.35 7.34 3.49 45 XM_UncommonTLD01 9096 4.73 6.84 4.13 46 XM_DIRTYINTL 8949 3.74 6.73 2.88 47 MIME_QP_LONG_LINE 8644 5.80 6.50 5.59 48 XM_UB50 8358 2.04 6.28 0.83 49 BAYES_60 7783 5.94 5.85 5.96 50 HTML_IMAGE_RATIO_06 7004 3.93 5.26 3.55 51 T_REMOTE_IMAGE 6841 4.34 5.14 4.11 52 XMNumbers 6361 3.76 4.78 3.47 53 FROM_EXCESS_BASE64 6323 3.38 4.75 2.99 54 MIME_HTML_ONLY_MULTI 6147 2.30 4.62 1.63 55 MIME_HTML_MOSTLY 6121 2.87 4.60 2.37 56 DKIM_INVALID 5970 4.11 4.49 4.00 57 XMStrtUSub 5802 4.33 4.36 4.33 58 RELAYCOUNTRY_CA 5539 2.02 4.16 1.40 59 BAYES_95 5491 2.69 4.13 2.28 60 TM2_M_URI_OPT_OUT 5454 2.39 4.10 1.90 61 T_TooManySym_01 5271 5.19 3.96 5.54 62 URI_HEX 5240 1.96 3.94 1.40 63 XM_SPF_SoftFail 5064 2.38 3.81 1.97 64 XM_SendGrid 4947 5.63 3.72 6.18 65 XM_B_SpammyTLD 4916 3.34 3.69 3.24 66 XM_CamelCaseFrm001 4490 2.26 3.37 1.94 67 XM_URI_RBL 4390 0.92 3.30 0.24 68 XMDiploma_00 4366 2.01 3.28 1.65 69 NO_DNS_FOR_FROM 4341 1.48 3.26 0.97 70 HTML_MIME_NO_HTML_TAG 4333 2.69 3.26 2.53 71 RCVD_IN_RP_RNBL 4330 0.74 3.25 0.02 72 HTML_IMAGE_RATIO_08 4298 2.61 3.23 2.43 73 DKIM_ADSP_NXDOMAIN 4268 1.01 3.21 0.38 74 RCVD_IN_RP_SAFE 4248 8.73 3.19 10.32 75 RCVD_IN_BL_SPAMCOP_NET 4189 1.16 3.15 0.58 76 XMSexyCombo_01 4085 1.14 3.07 0.59 77 XM_BadFromFormat 3986 0.78 3.00 0.14 78 SpammyFromTLD_02 3972 0.82 2.98 0.20 79 ALL_TRUSTED 3961 15.80 2.98 19.49 80 RELAYCOUNTRY_FR 3905 0.84 2.93 0.24 81 XMBdyGiftCard01 3834 1.43 2.88 1.01 82 T_XMDrugObfuBody_08 3821 2.12 2.87 1.90 83 TR_XM_PHPDW 3725 1.15 2.80 0.68 84 TR_XM_PHPForged 3705 1.14 2.78 0.67 85 TR_XM_FormFill2 3673 1.13 2.76 0.66 86 XM_H_PHPOS 3657 1.12 2.75 0.65 87 RCVD_IN_IADB_LISTED 3606 4.27 2.71 4.72 88 SUBJ_ALL_CAPS 3542 2.00 2.66 1.81 89 MultiRelay_CC 3521 0.75 2.65 0.20 90 MultiRelay_Combo 3521 0.75 2.65 0.20 91 KHOP_HELO_FCRDNS 3484 2.20 2.62 2.08 92 XMSubMetaI_00 3464 1.30 2.60 0.92 93 RCVD_IN_IADB_SPF 3306 3.73 2.48 4.09 94 XMGenDplmaNmb 3222 1.33 2.42 1.01 95 XM_OfRef6 3211 1.76 2.41 1.58 96 RCVD_IN_IADB_SENDERID 3199 3.31 2.40 3.56 97 RCVD_IN_IADB_DK 3196 3.24 2.40 3.49 98 HDRS_LCASE_IMGONLY 3195 0.60 2.40 0.08 99 BODY_URI_ONLY 2992 0.63 2.25 0.17 100 RCVD_IN_RP_CERTIFIED 2926 7.87 2.20 9.49 101 RCVD_IN_PSBL 2670 0.46 2.01 0.02 102 BAYES_40 2628 3.75 1.97 4.26 103 TM2_M_VERY_LONG_WORD 2587 1.24 1.94 1.04 104 TR_XM_RelayPhish 2577 1.44 1.94 1.30 105 NUMERIC_HTTP_ADDR 2495 0.67 1.88 0.32 106 TR_XM_DK_SendGrid 2490 2.90 1.87 3.20 107 HTML_SHORT_LINK_IMG_1 2451 0.47 1.84 0.07 108 XMPhish11 2425 1.30 1.82 1.15 109 US_DOLLARS_3 2424 1.10 1.82 0.89 110 RCVD_IN_MSPIKE_WL 2412 3.52 1.81 4.01 111 HTML_IMAGE_ONLY_08 2369 0.52 1.78 0.16 112 XMStockSpam_06 2344 1.38 1.76 1.27 113 SpammyFromTLD_01 2313 0.98 1.74 0.76 114 BOTNET_NORDNS 2204 0.40 1.66 0.04 115 XMBody_17 2190 0.98 1.65 0.78 116 TooManyTo_002 2181 2.28 1.64 2.47 117 XM_UB99 2167 0.37 1.63 0.01 118 UNPARSEABLE_RELAY 2130 2.24 1.60 2.43 119 MAILING_LIST_MULTI 2124 2.17 1.60 2.33 120 HTML_TAG_BALANCE_BODY 2114 0.71 1.59 0.46 121 XM_H_PHPMailer 2101 0.80 1.58 0.58 122 DIET_1 2089 0.53 1.57 0.23 123 T_XMHurry_00 2031 0.97 1.53 0.81 124 TR_Mismatch_TLD_02 1963 0.41 1.48 0.10 125 XM_H_Long_From02 1950 1.35 1.47 1.32 126 TooManyTo_003 1937 1.64 1.46 1.69 127 SUBJ_ILLEGAL_CHARS 1933 0.33 1.45 0.01 128 SUBJECT_NEEDS_ENCODING 1933 0.33 1.45 0.01 129 BAYES_20 1903 2.86 1.43 3.27 130 XMHTML_After_End 1893 0.60 1.42 0.36 131 XMPhish30 1883 0.96 1.42 0.82 132 TR_Caps_n_Bayes_99 1873 0.54 1.41 0.29 133 T_XMDrugObfuBody_00 1871 0.91 1.41 0.77 134 NORMAL_HTTP_TO_IP 1849 0.36 1.39 0.07 135 TR_Symld_Words 1844 1.92 1.39 2.07 136 RELAYCOUNTRY_NL 1828 0.46 1.37 0.19 137 XM_H_PHPOS_M 1779 0.44 1.34 0.19 138 XMFunnyHTTP 1711 0.30 1.29 0.02 139 XMSexyCombo_04 1699 0.36 1.28 0.09 140 TooManyTo_004 1672 1.29 1.26 1.30 141 XMBody_78 1641 0.59 1.23 0.41 142 XMBrknScrpt_02 1622 0.73 1.22 0.59 143 MISSING_HEADERS 1619 0.71 1.22 0.57 144 RELAYCOUNTRY_GB 1618 1.25 1.22 1.26 145 RELAYCOUNTRY_RO 1607 0.28 1.21 0.01 146 LongTLD 1603 0.37 1.20 0.13 147 XM_UB999 1587 0.27 1.19 0.01 148 XMSlimDrugH 1576 0.51 1.18 0.31 149 XM_ProductURIs 1555 0.93 1.17 0.86 150 XM_UB60 1525 0.33 1.15 0.09 151 URI_TRY_3LD 1515 1.23 1.14 1.25 152 TooManyTo_005 1511 1.11 1.14 1.10 153 ACT_NOW_CAPS 1478 0.28 1.11 0.05 154 RCVD_IN_IADB_VOUCHED 1478 2.70 1.11 3.16 155 T_TooManySym_02 1471 1.67 1.11 1.83 156 T_FILL_THIS_FORM_SHORT 1466 1.12 1.10 1.13 157 TR_LOTS_OF_MONEY2 1459 0.51 1.10 0.34 158 T_MONEY_PERCENT 1459 0.51 1.10 0.34 159 TR_LOTS_OF_MONEY3 1431 0.48 1.08 0.31 160 FROM_SUSPICIOUS_NTLD 1423 0.26 1.07 0.02 161 XM_DK_Undo_01 1399 1.66 1.05 1.83 162 PLING_QUERY 1373 0.63 1.03 0.52 163 FROM_SUSPICIOUS_NTLD_FP 1366 0.24 1.03 0.02 164 T_HTML_TAG_BALANCE_CENTER 1358 0.36 1.02 0.18 165 RCVD_IN_MSPIKE_H3 1331 3.31 1.00 3.97 166 XM_HighProb1 1317 0.23 0.99 0.01 167 XMSubMetaSxObfu_03 1310 0.56 0.98 0.43 168 URIBL_BLACK 1309 0.27 0.98 0.06 169 REPLYTO_WITHOUT_TO_CC 1291 0.26 0.97 0.06 170 MIME_HEADER_CTYPE_ONLY 1274 0.37 0.96 0.20 171 XMGppyBdWords 1263 0.30 0.95 0.12 172 XMHTMLBadTable_001 1248 0.50 0.94 0.37 173 T_Symld_Words_02 1247 0.68 0.94 0.60 174 RDNS_DYNAMIC 1235 0.50 0.93 0.37 175 HELO_NODOT 1219 1.79 0.92 2.05 176 HELO_NO_DOMAIN 1217 1.79 0.91 2.05 177 BASE64_LENGTH_79_INF 1212 0.43 0.91 0.29 178 RELAYCOUNTRY_DE 1202 0.48 0.90 0.36 179 DKIM_ADSP_CUSTOM_MED 1196 1.01 0.90 1.04 180 HTML_IMAGE_ONLY_12 1180 0.38 0.89 0.23 181 XMPhish14 1176 0.55 0.88 0.45 182 XM_B_REG_HTML 1165 0.58 0.88 0.50 183 RELAYCOUNTRY_AT 1151 0.35 0.86 0.20 184 XM_UB80 1144 0.21 0.86 0.02 185 BAYES_05 1100 1.88 0.83 2.18 186 XM_OfRef7 1092 0.36 0.82 0.23 187 RCVD_IN_MSPIKE_H4 1081 0.21 0.81 0.04 188 DATE_IN_PAST_03_06 1074 0.29 0.81 0.14 189 THIS_AD 1068 0.25 0.80 0.09 190 LOW_PRICE 1048 0.31 0.79 0.17 191 XMSubNoVowel 1034 0.47 0.78 0.38 192 HTML_FONT_FACE_BAD 1021 0.55 0.77 0.49 193 XMSubMetaSSx_00 1011 0.32 0.76 0.20 194 RCVD_IN_IADB_OPTIN 1009 1.74 0.76 2.03 195 XM_PDF 997 4.20 0.75 5.19 196 XMSubMetaSx_01 974 0.24 0.73 0.10 197 TR_Mismatch_TLD_01 966 0.29 0.73 0.16 198 NML_ADSP_CUSTOM_MED 965 0.73 0.73 0.73 199 FORGED_GMAIL_RCVD 962 0.53 0.72 0.48 200 FSL_THIS_IS_ADV 956 0.28 0.72 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 386787 85.90 94.35 83.48 2 DKIM_SIGNED 332976 74.15 82.13 71.86 3 XM_DK_Pass 327435 72.79 80.20 70.67 4 DKIM_VALID 314457 70.05 77.65 67.87 5 XM_B_Unicode 302509 68.28 78.68 65.29 6 DCC_CHECK_NEGATIVE 275517 50.75 20.43 59.46 7 BAYES_50 256314 50.95 35.75 55.32 8 DKIM_VALID_AU 232713 52.15 58.85 50.22 9 XMListUnsubscribeExists 216153 52.58 73.21 46.65 10 DCC_CHECK 178500 47.30 77.85 38.52 11 T_TM2_M_HEADER_IN_MSG 142208 28.14 19.26 30.69 12 DKIM_VALID_EF 125765 25.91 21.62 27.14 13 HTML_FONT_LOW_CONTRAST 120788 28.91 38.79 26.07 14 XMSubLong 103076 23.16 26.34 22.25 15 LOC_TINY_FONT_1 101387 24.79 34.92 21.88 16 FVGT_m_MULTI_ODD 93333 21.89 27.96 20.14 17 MultiRelay 91748 19.31 17.61 19.80 18 ALL_TRUSTED 90300 15.80 2.98 19.49 19 MIME_HTML_ONLY 88866 22.10 32.29 19.18 20 T_KAM_HTML_FONT_INVALID 73063 17.00 21.30 15.77 21 BAYES_00 57921 9.86 0.67 12.50 22 XM_DK_Undo_02 56548 20.23 48.16 12.20 23 XM_Body_Dirty_Words 56126 14.60 23.28 12.11 24 XM_Multi_Part_URI 52453 12.98 18.74 11.32 25 BAYES_99 48065 17.38 41.78 10.37 26 RCVD_IN_RP_SAFE 47832 8.73 3.19 10.32 27 RCVD_IN_MSPIKE_H2 46590 9.80 8.89 10.06 28 TR_XM_DK_Bayes 45212 7.64 0.26 9.76 29 RCVD_IN_RP_CERTIFIED 43988 7.87 2.20 9.49 30 TR_XM_DK_Bayes1 43453 7.34 0.24 9.38 31 BAYES_999 42064 14.75 34.50 9.08 32 XM_Evil_Numbers_Gen 41523 10.27 14.82 8.96 33 TooManyTo_001 40293 8.53 7.94 8.70 34 TR_XM_DK_Bayes2 36973 6.24 0.19 7.98 35 T_XMDrugObfuBody_14 36099 8.20 9.60 7.79 36 LotsOfNums_01 35969 8.13 9.41 7.76 37 XM_DKIMWhitelistDomains 35955 6.08 0.21 7.76 38 LOTS_OF_MONEY 35939 8.25 9.99 7.76 39 FSL_BULK_SIG 35898 8.38 10.59 7.75 40 HTML_IMAGE_RATIO_02 35522 9.16 14.37 7.67 41 XM_SendGrid 28641 5.63 3.72 6.18 42 BAYES_60 27622 5.94 5.85 5.96 43 XM_H_Long_From01 27340 6.39 8.09 5.90 44 XM_B_Phish_Phrases 26385 6.12 7.59 5.69 45 MIME_QP_LONG_LINE 25919 5.80 6.50 5.59 46 T_TooManySym_01 25688 5.19 3.96 5.54 47 HTML_IMAGE_RATIO_04 24186 5.85 8.05 5.22 48 XM_PDF 24061 4.20 0.75 5.19 49 RELAYCOUNTRY_META 23951 8.38 19.56 5.17 50 ANY_BOUNCE_MESSAGE 22118 3.81 0.46 4.77 51 BOUNCE_MESSAGE 22111 3.81 0.46 4.77 52 TR_DCC_Bayes_99 22017 11.10 33.23 4.75 53 RCVD_IN_IADB_LISTED 21858 4.27 2.71 4.72 54 XMStrtUSub 20050 4.33 4.36 4.33 55 BOTNET_IPINHOSTNAME 20048 6.40 13.62 4.33 56 BAYES_40 19746 3.75 1.97 4.26 57 XM_UncommonTLD01 19137 4.73 6.84 4.13 58 T_REMOTE_IMAGE 19033 4.34 5.14 4.11 59 RCVD_IN_IADB_SPF 18947 3.73 2.48 4.09 60 RCVD_IN_MSPIKE_WL 18577 3.52 1.81 4.01 61 DKIM_INVALID 18519 4.11 4.49 4.00 62 RCVD_IN_MSPIKE_H3 18389 3.31 1.00 3.97 63 IN_ZIMBRA_NJ_WHITELIST 18267 3.07 0.03 3.94 64 TO_MALFORMED 17239 2.90 0.04 3.72 65 RCVD_IN_IADB_SENDERID 16518 3.31 2.40 3.56 66 XMSexyCombo_05 16476 5.45 12.04 3.56 67 HTML_IMAGE_RATIO_06 16443 3.93 5.26 3.55 68 BAYES_80 16185 4.35 7.34 3.49 69 RCVD_IN_IADB_DK 16149 3.24 2.40 3.49 70 XMNumbers 16093 3.76 4.78 3.47 71 XMSubMetaSx_00 15783 4.38 7.76 3.41 72 MPART_ALT_DIFF 15197 4.38 8.22 3.28 73 BAYES_20 15147 2.86 1.43 3.27 74 XM_B_SpammyTLD 15008 3.34 3.69 3.24 75 TR_XM_DK_SendGrid 14805 2.90 1.87 3.20 76 RCVD_IN_IADB_VOUCHED 14631 2.70 1.11 3.16 77 FROM_EXCESS_BASE64 13856 3.38 4.75 2.99 78 XM_DIRTYINTL 13356 3.74 6.73 2.88 79 HTML_MIME_NO_HTML_TAG 11739 2.69 3.26 2.53 80 TooManyTo_002 11446 2.28 1.64 2.47 81 HTML_IMAGE_RATIO_08 11243 2.61 3.23 2.43 82 UNPARSEABLE_RELAY 11238 2.24 1.60 2.43 83 MIME_HTML_MOSTLY 10984 2.87 4.60 2.37 84 INVALID_MSGID 10959 1.86 0.10 2.37 85 MAILING_LIST_MULTI 10796 2.17 1.60 2.33 86 BAYES_95 10581 2.69 4.13 2.28 87 BAYES_05 10112 1.88 0.83 2.18 88 TVD_RCVD_IP 9667 1.75 0.57 2.09 89 KHOP_HELO_FCRDNS 9643 2.20 2.62 2.08 90 TR_Symld_Words 9584 1.92 1.39 2.07 91 HELO_NODOT 9484 1.79 0.92 2.05 92 HELO_NO_DOMAIN 9482 1.79 0.91 2.05 93 RCVD_IN_IADB_OPTIN 9390 1.74 0.76 2.03 94 XM_SPF_SoftFail 9111 2.38 3.81 1.97 95 BOTNET 9009 4.92 15.27 1.94 96 XM_CamelCaseFrm001 8996 2.26 3.37 1.94 97 T_XMDrugObfuBody_08 8822 2.12 2.87 1.90 98 TM2_M_URI_OPT_OUT 8796 2.39 4.10 1.90 99 T_TooManySym_02 8487 1.67 1.11 1.83 100 XM_DK_Undo_01 8478 1.66 1.05 1.83 101 SUBJ_ALL_CAPS 8397 2.00 2.66 1.81 102 IN_HORDE_ADDRESS_BOOK 8180 1.38 0.05 1.77 103 CK_HELO_DYNAMIC_SPLIT_IP 8035 1.43 0.37 1.73 104 HELO_DYNAMIC_IPADDR2 8030 1.39 0.22 1.73 105 TooManyTo_003 7829 1.64 1.46 1.69 106 TR_MetaPhish_Combo_01 7657 1.43 0.67 1.65 107 XMDiploma_00 7634 2.01 3.28 1.65 108 MIME_HTML_ONLY_MULTI 7546 2.30 4.62 1.63 109 XMCapTrack 7396 1.32 0.37 1.60 110 XM_OfRef6 7307 1.76 2.41 1.58 111 USER_IN_DEF_DKIM_WL 7157 1.21 0.03 1.54 112 RELAYCOUNTRY_CA 6490 2.02 4.16 1.40 113 URI_HEX 6465 1.96 3.94 1.40 114 UNTRUSTED_Relay 6366 3.65 11.58 1.37 115 XM_H_Long_From02 6117 1.35 1.47 1.32 116 TR_XM_RelayPhish 6025 1.44 1.94 1.30 117 TooManyTo_004 6002 1.29 1.26 1.30 118 XMStockSpam_06 5879 1.38 1.76 1.27 119 RELAYCOUNTRY_GB 5842 1.25 1.22 1.26 120 URI_TRY_3LD 5804 1.23 1.14 1.25 121 XM_GoogleGroups 5614 1.06 0.55 1.21 122 XMPhish11 5312 1.30 1.82 1.15 123 T_FILL_THIS_FORM_SHORT 5227 1.12 1.10 1.13 124 TooManyTo_005 5087 1.11 1.14 1.10 125 DKIM_ADSP_CUSTOM_MED 4824 1.01 0.90 1.04 126 TM2_M_VERY_LONG_WORD 4799 1.24 1.94 1.04 127 XMGenDplmaNmb 4695 1.33 2.42 1.01 128 XMBdyGiftCard01 4669 1.43 2.88 1.01 129 NO_DNS_FOR_FROM 4506 1.48 3.26 0.97 130 XMSubMetaI_00 4283 1.30 2.60 0.92 131 US_DOLLARS_3 4127 1.10 1.82 0.89 132 XM_ProductURIs 3985 0.93 1.17 0.86 133 XM_UB50 3838 2.04 6.28 0.83 134 XMPhish30 3817 0.96 1.42 0.82 135 T_XMHurry_00 3730 0.97 1.53 0.81 136 XM_RXBody 3692 0.78 0.71 0.80 137 XMBody_17 3632 0.98 1.65 0.78 138 T_XMDrugObfuBody_00 3573 0.91 1.41 0.77 139 SpammyFromTLD_01 3535 0.98 1.74 0.76 140 NML_ADSP_CUSTOM_MED 3387 0.73 0.73 0.73 141 T_OBFU_PDF_ATTACH 3371 0.61 0.18 0.73 142 TR_XM_PHPDW 3147 1.15 2.80 0.68 143 TR_XM_PHPForged 3085 1.14 2.78 0.67 144 TR_XM_FormFill2 3038 1.13 2.76 0.66 145 XM_H_PHPOS 3031 1.12 2.75 0.65 146 XM_ShortIntro_01 2952 0.61 0.51 0.64 147 XMBody_95 2925 0.51 0.08 0.63 148 XMGappySubj_01 2922 0.58 0.42 0.63 149 T_Symld_Words_02 2799 0.68 0.94 0.60 150 SHORT_HELO_AND_INLINE_IMAGE 2778 0.48 0.06 0.60 151 XMBrknScrpt_02 2745 0.73 1.22 0.59 152 FILL_THIS_FORM 2733 0.58 0.54 0.59 153 XMSexyCombo_01 2719 1.14 3.07 0.59 154 RCVD_IN_BL_SPAMCOP_NET 2707 1.16 3.15 0.58 155 XM_H_PHPMailer 2669 0.80 1.58 0.58 156 MISSING_HEADERS 2628 0.71 1.22 0.57 157 XMMoneyMeta_00 2616 0.60 0.71 0.56 158 AC_DIV_BONANZA 2597 0.46 0.13 0.56 159 TM2_M_BODY_EMPTY 2594 0.46 0.12 0.56 160 HTTPS_HTTP_MISMATCH 2570 0.56 0.57 0.55 161 USER_IN_WHITELIST 2502 0.42 0.00 0.54 162 T_TooManySym_03 2483 0.45 0.17 0.54 163 PLING_QUERY 2388 0.63 1.03 0.52 164 FILL_THIS_FORM_LONG 2368 0.50 0.45 0.51 165 XMNoVowels 2349 0.52 0.57 0.51 166 FILL_THIS_FORM_LOAN 2336 0.44 0.22 0.50 167 XM_B_COPY_HTML 2327 0.53 0.64 0.50 168 XM_B_REG_HTML 2322 0.58 0.88 0.50 169 HTML_FONT_FACE_BAD 2255 0.55 0.77 0.49 170 XMhairloss01 2215 0.41 0.16 0.48 171 FORGED_GMAIL_RCVD 2213 0.53 0.72 0.48 172 HTML_TAG_BALANCE_BODY 2128 0.71 1.59 0.46 173 XMPhish14 2101 0.55 0.88 0.45 174 RCVD_IN_SORBS_DUL 2075 0.38 0.15 0.45 175 XMSubMetaSxObfu_03 2010 0.56 0.98 0.43 176 FROM_GOV_SPOOF 2000 0.39 0.23 0.43 177 XMLngstWrd_00 1996 0.45 0.53 0.43 178 RELAYCOUNTRY_AU 1952 0.47 0.64 0.42 179 HTML_IMAGE_ONLY_32 1946 0.44 0.51 0.42 180 HTML_IMAGE_ONLY_28 1942 0.43 0.48 0.42 181 TM2_M_A_HREF_HREF 1915 0.47 0.65 0.41 182 XMBody_78 1906 0.59 1.23 0.41 183 XMDateMe_00 1895 0.40 0.35 0.41 184 XMLngstWrd_01 1835 0.42 0.50 0.40 185 FROM_GOV_DKIM_AU 1809 0.32 0.07 0.39 186 URI_NOVOWEL 1808 0.46 0.70 0.39 187 HTML_IMAGE_ONLY_20 1798 0.37 0.32 0.39 188 DKIM_ADSP_NXDOMAIN 1776 1.01 3.21 0.38 189 XMSubNoVowel 1763 0.47 0.78 0.38 190 HTML_IMAGE_ONLY_24 1761 0.37 0.34 0.38 191 XMSubMetaSxObfu_02 1758 0.37 0.32 0.38 192 XMHTMLBadTable_001 1736 0.50 0.94 0.37 193 RDNS_DYNAMIC 1731 0.50 0.93 0.37 194 XM_Body_Obfu01 1723 0.42 0.58 0.37 195 RELAYCOUNTRY_DE 1676 0.48 0.90 0.36 196 XMHTML_After_End 1667 0.60 1.42 0.36 197 XMGappySubj_02 1626 0.30 0.11 0.35 198 T_MONEY_PERCENT 1561 0.51 1.10 0.34 199 TR_LOTS_OF_MONEY2 1561 0.51 1.10 0.34 200 HTML_IMAGE_ONLY_16 1523 0.29 0.15 0.33 ----------------------------------------------------------------------