Email: 640496 Autolearn: 0 AvgScore: 3.11 AvgScanTime: 2.29 sec Spam: 157537 Autolearn: 0 AvgScore: 12.05 AvgScanTime: 2.82 sec Ham: 482959 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 2.12 sec Time Spent Running SA: 407.54 hours Time Spent Processing Spam: 123.49 hours Time Spent Processing Ham: 284.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148066 85.94 93.99 83.32 2 DCC_CHECK 124267 47.92 78.88 37.82 3 DKIM_SIGNED 123320 73.01 78.28 71.29 4 XM_DK_Pass 119974 71.50 76.16 69.99 5 DKIM_VALID 116482 69.01 73.94 67.40 6 XMListUnsubscribeExists 113641 54.15 72.14 48.29 7 XM_B_Unicode 112065 66.37 71.14 64.82 8 DKIM_VALID_AU 89316 51.19 56.70 49.40 9 XM_DK_Undo_02 73202 20.52 46.47 12.05 10 BAYES_99 63216 17.66 40.13 10.33 11 HTML_FONT_LOW_CONTRAST 55044 28.60 34.94 26.53 12 MIME_HTML_ONLY 53371 22.67 33.88 19.01 13 LOC_TINY_FONT_1 52742 24.33 33.48 21.35 14 BAYES_50 52717 49.25 33.46 54.40 15 TR_DCC_Bayes_99 51307 11.74 32.57 4.95 16 BAYES_999 51230 14.79 32.52 9.00 17 FVGT_m_MULTI_ODD 42781 21.85 27.16 20.12 18 XMSubLong 40740 23.24 25.86 22.38 19 DKIM_VALID_EF 36043 25.54 22.88 26.41 20 XM_Body_Dirty_Words 33646 14.89 21.36 12.78 21 T_KAM_HTML_FONT_INVALID 32082 17.62 20.36 16.73 22 RELAYCOUNTRY_META 31783 8.91 20.17 5.23 23 DCC_CHECK_NEGATIVE 30945 50.05 19.64 59.97 24 T_TM2_M_HEADER_IN_MSG 27845 26.57 17.68 29.47 25 XM_Multi_Part_URI 25542 12.06 16.21 10.71 26 BOTNET 23628 5.12 15.00 1.90 27 MultiRelay 23416 17.51 14.86 18.37 28 FSL_BULK_SIG 22664 8.78 14.39 6.95 29 BOTNET_IPINHOSTNAME 22298 6.75 14.15 4.33 30 HTML_IMAGE_RATIO_02 20853 9.22 13.24 7.91 31 LOTS_OF_MONEY 20444 9.15 12.98 7.90 32 XM_Evil_Numbers_Gen 19627 9.63 12.46 8.71 33 UNTRUSTED_Relay 18539 3.95 11.77 1.40 34 XMSexyCombo_05 15008 4.83 9.53 3.30 35 TooManyTo_001 14238 8.63 9.04 8.49 36 T_XMDrugObfuBody_14 14208 8.52 9.02 8.36 37 XM_UncommonTLD01 14022 5.19 8.90 3.98 38 T_REMOTE_IMAGE 13959 5.21 8.86 4.02 39 LotsOfNums_01 13951 7.83 8.86 7.50 40 XMSubMetaSx_00 13499 5.21 8.57 4.12 41 BAYES_80 12783 5.15 8.11 4.18 42 BAYES_60 11907 7.02 7.56 6.84 43 RCVD_IN_MSPIKE_H2 11903 8.27 7.56 8.50 44 MPART_ALT_DIFF 11406 4.23 7.24 3.25 45 BODY_URI_ONLY 11294 1.88 7.17 0.15 46 HTML_SHORT_LINK_IMG_1 10729 1.74 6.81 0.08 47 XMNumbers 10143 3.90 6.44 3.07 48 XM_H_Long_From01 10073 6.37 6.39 6.36 49 SpammyFromTLD_02 9776 1.79 6.21 0.34 50 HTML_IMAGE_RATIO_04 9719 5.12 6.17 4.78 51 MIME_QP_LONG_LINE 9602 5.80 6.10 5.71 52 XM_B_Phish_Phrases 9346 5.19 5.93 4.95 53 XM_UB50 8640 1.98 5.48 0.84 54 XM_DIRTYINTL 8370 3.09 5.31 2.37 55 HTML_IMAGE_ONLY_12 8336 1.47 5.29 0.23 56 NUMERIC_HTTP_ADDR 8219 1.61 5.22 0.43 57 NORMAL_HTTP_TO_IP 7873 1.29 5.00 0.08 58 HTML_IMAGE_RATIO_06 7730 3.58 4.91 3.15 59 BAYES_95 7537 3.24 4.78 2.74 60 URI_HEX_IP 7484 1.18 4.75 0.02 61 XM_B_SpammyTLD 7372 3.76 4.68 3.46 62 DKIM_INVALID 6838 4.00 4.34 3.88 63 XMStrtUSub 6664 4.05 4.23 3.99 64 MIME_HTML_MOSTLY 6624 2.66 4.20 2.16 65 XM_SendGrid 6333 5.57 4.02 6.08 66 RELAYCOUNTRY_CA 6261 2.08 3.97 1.46 67 XMSexyCombo_01 5965 1.65 3.79 0.96 68 MIME_HTML_ONLY_MULTI 5827 2.24 3.70 1.77 69 TM2_M_URI_OPT_OUT 5584 2.33 3.54 1.93 70 XM_SPF_SoftFail 5460 2.23 3.47 1.82 71 ALL_TRUSTED 5275 15.94 3.35 20.05 72 RELAYCOUNTRY_FR 5271 1.01 3.35 0.24 73 HTML_MIME_NO_HTML_TAG 5172 2.45 3.28 2.18 74 XM_URI_RBL 5066 0.98 3.22 0.24 75 RCVD_IN_BL_SPAMCOP_NET 5020 1.30 3.19 0.69 76 FROM_EXCESS_BASE64 4974 3.10 3.16 3.08 77 URI_HEX 4875 1.97 3.09 1.60 78 SUBJ_DOLLARS 4637 0.95 2.94 0.30 79 T_Symld_Words_02 4597 1.27 2.92 0.73 80 RELAYCOUNTRY_GB 4571 1.58 2.90 1.15 81 KHOP_HELO_FCRDNS 4511 2.21 2.86 2.00 82 XM_CamelCaseFrm001 4490 2.22 2.85 2.01 83 RCVD_IN_IADB_LISTED 4484 4.66 2.85 5.25 84 DKIM_ADSP_NXDOMAIN 4293 0.96 2.73 0.38 85 NO_DNS_FOR_FROM 4256 1.38 2.70 0.95 86 HTML_IMAGE_RATIO_08 4251 2.25 2.70 2.11 87 RCVD_IN_IADB_SPF 4043 4.06 2.57 4.55 88 RCVD_IN_RP_SAFE 3914 7.87 2.48 9.63 89 T_TooManySym_01 3910 4.54 2.48 5.21 90 FROM_SUSPICIOUS_NTLD 3894 0.63 2.47 0.03 91 RCVD_IN_IADB_SENDERID 3881 3.58 2.46 3.94 92 RCVD_IN_IADB_DK 3873 3.54 2.46 3.89 93 XMDiploma_00 3800 1.78 2.41 1.57 94 FROM_SUSPICIOUS_NTLD_FP 3784 0.61 2.40 0.02 95 T_XMDrugObfuBody_08 3696 1.80 2.35 1.62 96 XMBdyGiftCard01 3683 1.16 2.34 0.77 97 BAYES_40 3608 3.85 2.29 4.36 98 DATE_IN_PAST_06_12 3511 0.66 2.23 0.14 99 TR_XM_DK_SendGrid 3463 2.90 2.20 3.13 100 LOADSA_MONEY_COMBO 3463 0.58 2.20 0.05 101 TR_XM_PHPDW 3401 1.41 2.16 1.17 102 TR_XM_PHPForged 3368 1.39 2.14 1.14 103 TR_XM_FormFill2 3348 1.38 2.13 1.13 104 XM_H_PHPOS 3330 1.37 2.11 1.13 105 SUBJ_ALL_CAPS 3255 1.87 2.07 1.81 106 XM_OfRef6 3225 1.56 2.05 1.40 107 MultiRelay_Combo 3155 0.66 2.00 0.22 108 MultiRelay_CC 3155 0.66 2.00 0.22 109 MAILING_LIST_MULTI 3146 2.32 2.00 2.42 110 RCVD_IN_RP_RNBL 3100 0.50 1.97 0.02 111 XM_BadFromFormat 3016 0.59 1.91 0.16 112 US_DOLLARS_3 2988 1.24 1.90 1.02 113 HTML_IMAGE_ONLY_08 2975 0.58 1.89 0.15 114 TM2_M_VERY_LONG_WORD 2893 1.19 1.84 0.98 115 RCVD_IN_RP_CERTIFIED 2893 6.97 1.84 8.65 116 BAYES_20 2823 2.86 1.79 3.20 117 TR_XM_RelayPhish 2745 0.97 1.74 0.71 118 XM_H_TOP 2698 0.42 1.71 0.00 119 DATE_IN_PAST_03_06 2595 0.53 1.65 0.16 120 XMGenDplmaNmb 2586 1.14 1.64 0.98 121 RCVD_IN_MSPIKE_WL 2568 3.42 1.63 4.01 122 RCVD_IN_MSPIKE_H3 2556 3.42 1.62 4.01 123 XM_UB99 2539 0.42 1.61 0.03 124 RELAYCOUNTRY_DE 2488 0.65 1.58 0.35 125 URIBL_DBL_ABUSE_REDIR 2446 0.39 1.55 0.01 126 XMSlimDrugH 2390 0.67 1.52 0.39 127 XM_UB60 2338 0.42 1.48 0.08 128 T_XMDrugObfuBody_00 2247 0.89 1.43 0.71 129 HDRS_LCASE_IMGONLY 2233 0.41 1.42 0.08 130 TR_M_TOP_BAYES 2165 0.34 1.37 0.00 131 XMStockSpam_06 2119 0.97 1.35 0.85 132 BOTNET_NORDNS 2106 0.36 1.34 0.04 133 DIET_1 2105 0.50 1.34 0.23 134 XMBody_17 2084 0.78 1.32 0.61 135 XMHTML_After_End 2062 0.67 1.31 0.46 136 TR_Symld_Words 2053 1.78 1.30 1.94 137 URI_TRY_3LD 2040 1.13 1.29 1.07 138 T_XMHurry_00 2040 0.81 1.29 0.65 139 XM_H_Long_From02 2028 1.02 1.29 0.93 140 URI_WP_HACKED_2 2019 0.93 1.28 0.81 141 SpammyFromTLD_01 2010 0.81 1.28 0.66 142 T_FILL_THIS_FORM_SHORT 1980 0.99 1.26 0.90 143 XMMoneyMeta_00 1966 0.75 1.25 0.59 144 RELAYCOUNTRY_NL 1956 0.48 1.24 0.24 145 XMPhish11 1930 1.16 1.23 1.14 146 RCVD_IN_IADB_VOUCHED 1897 2.94 1.20 3.50 147 XM_UB999 1890 0.32 1.20 0.03 148 XM_DK_Undo_01 1872 1.54 1.19 1.66 149 XMBrknScrpt_02 1870 0.72 1.19 0.57 150 XMSubMetaI_00 1863 0.86 1.18 0.75 151 XMPhish30 1830 0.66 1.16 0.50 152 XMSexyCombo_04 1815 0.38 1.15 0.12 153 XM_ProductURIs 1804 0.86 1.15 0.77 154 TR_Mismatch_TLD_02 1664 0.33 1.06 0.09 155 TooManyTo_002 1647 2.04 1.05 2.37 156 XM_H_PHPMailer 1646 0.66 1.04 0.53 157 URIBL_BLACK 1635 0.30 1.04 0.06 158 NO_MEDICAL 1601 0.27 1.02 0.03 159 XMSubMetaSSx_00 1599 0.45 1.01 0.26 160 TR_LOTS_OF_MONEY3 1566 0.66 0.99 0.55 161 IMPOTENCE 1538 0.68 0.98 0.58 162 XMBody_78 1525 0.57 0.97 0.44 163 XM_HighProb1 1514 0.24 0.96 0.01 164 RDNS_DYNAMIC 1507 0.54 0.96 0.40 165 RELAYCOUNTRY_IN 1500 0.31 0.95 0.10 166 UNPARSEABLE_RELAY 1496 2.04 0.95 2.39 167 XM_B_REG_HTML 1493 0.56 0.95 0.43 168 XM_UB80 1478 0.25 0.94 0.03 169 FSL_THIS_IS_ADV 1423 0.31 0.90 0.12 170 TooManyTo_003 1418 1.43 0.90 1.61 171 XMHTMLBadTable_001 1416 0.56 0.90 0.45 172 XMSubMetaSxObfu_03 1405 0.59 0.89 0.49 173 RELAYCOUNTRY_AT 1401 0.34 0.89 0.16 174 TR_LOTS_OF_MONEY2 1370 0.49 0.87 0.37 175 T_MONEY_PERCENT 1370 0.49 0.87 0.37 176 DKIM_ADSP_CUSTOM_MED 1345 0.99 0.85 1.03 177 T_TooManySym_02 1336 1.53 0.85 1.75 178 RCVD_IN_PSBL 1331 0.22 0.84 0.02 179 XM_RXBody 1301 0.39 0.83 0.25 180 XM_H_PHPOS_M 1299 0.34 0.82 0.19 181 BAYES_05 1256 1.73 0.80 2.03 182 HTML_TAG_BALANCE_BODY 1247 0.64 0.79 0.60 183 BAYES_00 1247 8.85 0.79 11.48 184 XMPhish14 1241 0.54 0.79 0.46 185 HTML_FONT_FACE_BAD 1184 0.55 0.75 0.49 186 HTTPS_HTTP_MISMATCH 1174 0.65 0.75 0.62 187 FORGED_GMAIL_RCVD 1149 0.58 0.73 0.53 188 TooManyTo_004 1147 1.09 0.73 1.21 189 MPART_ALT_DIFF_COUNT 1119 0.37 0.71 0.26 190 LongTLD 1106 0.29 0.70 0.16 191 NML_ADSP_CUSTOM_MED 1103 0.74 0.70 0.75 192 RELAYCOUNTRY_AU 1096 0.61 0.70 0.58 193 HK_RANDOM_REPLYTO 1080 0.35 0.69 0.24 194 HTML_FONT_SIZE_HUGE 1065 0.22 0.68 0.07 195 PLING_QUERY 1044 0.49 0.66 0.44 196 RCVD_IN_IADB_OPTIN 1043 1.81 0.66 2.19 197 XM_XX_Yahoo 1031 0.25 0.65 0.12 198 URI_NOVOWEL 1027 0.45 0.65 0.39 199 TooManyTo_005 1011 0.92 0.64 1.01 200 XM_PDF 1005 3.72 0.64 4.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 402390 85.94 93.99 83.32 2 DKIM_SIGNED 344297 73.01 78.28 71.29 3 XM_DK_Pass 338009 71.50 76.16 69.99 4 DKIM_VALID 325535 69.01 73.94 67.40 5 XM_B_Unicode 313056 66.37 71.14 64.82 6 DCC_CHECK_NEGATIVE 289616 50.05 19.64 59.97 7 BAYES_50 262706 49.25 33.46 54.40 8 DKIM_VALID_AU 238574 51.19 56.70 49.40 9 XMListUnsubscribeExists 233211 54.15 72.14 48.29 10 DCC_CHECK 182661 47.92 78.88 37.82 11 T_TM2_M_HEADER_IN_MSG 142340 26.57 17.68 29.47 12 HTML_FONT_LOW_CONTRAST 128152 28.60 34.94 26.53 13 DKIM_VALID_EF 127565 25.54 22.88 26.41 14 XMSubLong 108097 23.24 25.86 22.38 15 LOC_TINY_FONT_1 103118 24.33 33.48 21.35 16 FVGT_m_MULTI_ODD 97174 21.85 27.16 20.12 17 ALL_TRUSTED 96820 15.94 3.35 20.05 18 MIME_HTML_ONLY 91798 22.67 33.88 19.01 19 MultiRelay 88703 17.51 14.86 18.37 20 T_KAM_HTML_FONT_INVALID 80778 17.62 20.36 16.73 21 XM_Body_Dirty_Words 61745 14.89 21.36 12.78 22 XM_DK_Undo_02 58214 20.52 46.47 12.05 23 BAYES_00 55430 8.85 0.79 11.48 24 XM_Multi_Part_URI 51701 12.06 16.21 10.71 25 BAYES_99 49892 17.66 40.13 10.33 26 RCVD_IN_RP_SAFE 46516 7.87 2.48 9.63 27 BAYES_999 43477 14.79 32.52 9.00 28 TR_XM_DK_Bayes 43271 6.86 0.40 8.96 29 XM_Evil_Numbers_Gen 42042 9.63 12.46 8.71 30 RCVD_IN_RP_CERTIFIED 41775 6.97 1.84 8.65 31 TR_XM_DK_Bayes1 41560 6.59 0.39 8.61 32 RCVD_IN_MSPIKE_H2 41043 8.27 7.56 8.50 33 TooManyTo_001 41023 8.63 9.04 8.49 34 T_XMDrugObfuBody_14 40355 8.52 9.02 8.36 35 HTML_IMAGE_RATIO_02 38180 9.22 13.24 7.91 36 LOTS_OF_MONEY 38171 9.15 12.98 7.90 37 LotsOfNums_01 36220 7.83 8.86 7.50 38 TR_XM_DK_Bayes2 35244 5.57 0.28 7.30 39 FSL_BULK_SIG 33563 8.78 14.39 6.95 40 BAYES_60 33046 7.02 7.56 6.84 41 XM_DKIMWhitelistDomains 32728 5.14 0.12 6.78 42 XM_H_Long_From01 30700 6.37 6.39 6.36 43 XM_SendGrid 29343 5.57 4.02 6.08 44 MIME_QP_LONG_LINE 27566 5.80 6.10 5.71 45 RCVD_IN_IADB_LISTED 25362 4.66 2.85 5.25 46 RELAYCOUNTRY_META 25280 8.91 20.17 5.23 47 T_TooManySym_01 25157 4.54 2.48 5.21 48 XM_B_Phish_Phrases 23923 5.19 5.93 4.95 49 TR_DCC_Bayes_99 23885 11.74 32.57 4.95 50 HTML_IMAGE_RATIO_04 23070 5.12 6.17 4.78 51 XM_PDF 22851 3.72 0.64 4.73 52 RCVD_IN_IADB_SPF 21961 4.06 2.57 4.55 53 BAYES_40 21047 3.85 2.29 4.36 54 BOTNET_IPINHOSTNAME 20911 6.75 14.15 4.33 55 ANY_BOUNCE_MESSAGE 20867 3.36 0.43 4.32 56 BOUNCE_MESSAGE 20865 3.36 0.43 4.32 57 BAYES_80 20185 5.15 8.11 4.18 58 XMSubMetaSx_00 19881 5.21 8.57 4.12 59 T_REMOTE_IMAGE 19438 5.21 8.86 4.02 60 RCVD_IN_MSPIKE_WL 19360 3.42 1.63 4.01 61 RCVD_IN_MSPIKE_H3 19352 3.42 1.62 4.01 62 XMStrtUSub 19267 4.05 4.23 3.99 63 XM_UncommonTLD01 19240 5.19 8.90 3.98 64 RCVD_IN_IADB_SENDERID 19040 3.58 2.46 3.94 65 RCVD_IN_IADB_DK 18784 3.54 2.46 3.89 66 DKIM_INVALID 18762 4.00 4.34 3.88 67 IN_ZIMBRA_NJ_WHITELIST 18506 2.89 0.02 3.83 68 TO_MALFORMED 17229 2.70 0.04 3.57 69 RCVD_IN_IADB_VOUCHED 16912 2.94 1.20 3.50 70 XM_B_SpammyTLD 16726 3.76 4.68 3.46 71 XMSexyCombo_05 15949 4.83 9.53 3.30 72 MPART_ALT_DIFF 15703 4.23 7.24 3.25 73 BAYES_20 15467 2.86 1.79 3.20 74 HTML_IMAGE_RATIO_06 15221 3.58 4.91 3.15 75 TR_XM_DK_SendGrid 15108 2.90 2.20 3.13 76 FROM_EXCESS_BASE64 14854 3.10 3.16 3.08 77 XMNumbers 14813 3.90 6.44 3.07 78 BAYES_95 13247 3.24 4.78 2.74 79 MAILING_LIST_MULTI 11705 2.32 2.00 2.42 80 UNPARSEABLE_RELAY 11546 2.04 0.95 2.39 81 TooManyTo_002 11440 2.04 1.05 2.37 82 XM_DIRTYINTL 11432 3.09 5.31 2.37 83 INVALID_MSGID 10978 1.74 0.11 2.27 84 RCVD_IN_IADB_OPTIN 10563 1.81 0.66 2.19 85 HTML_MIME_NO_HTML_TAG 10505 2.45 3.28 2.18 86 MIME_HTML_MOSTLY 10435 2.66 4.20 2.16 87 TVD_RCVD_IP 10384 1.76 0.56 2.15 88 HTML_IMAGE_RATIO_08 10173 2.25 2.70 2.11 89 BAYES_05 9793 1.73 0.80 2.03 90 XM_CamelCaseFrm001 9730 2.22 2.85 2.01 91 KHOP_HELO_FCRDNS 9644 2.21 2.86 2.00 92 TR_Symld_Words 9366 1.78 1.30 1.94 93 TM2_M_URI_OPT_OUT 9331 2.33 3.54 1.93 94 BOTNET 9157 5.12 15.00 1.90 95 XM_SPF_SoftFail 8796 2.23 3.47 1.82 96 SUBJ_ALL_CAPS 8737 1.87 2.07 1.81 97 HELO_NODOT 8606 1.46 0.46 1.78 98 HELO_NO_DOMAIN 8599 1.45 0.45 1.78 99 MIME_HTML_ONLY_MULTI 8547 2.24 3.70 1.77 100 T_TooManySym_02 8447 1.53 0.85 1.75 101 CK_HELO_DYNAMIC_SPLIT_IP 8195 1.36 0.35 1.70 102 HELO_DYNAMIC_IPADDR2 8190 1.32 0.18 1.70 103 XM_DK_Undo_01 8005 1.54 1.19 1.66 104 TR_MetaPhish_Combo_01 7932 1.36 0.51 1.64 105 IN_HORDE_ADDRESS_BOOK 7892 1.24 0.04 1.63 106 T_XMDrugObfuBody_08 7844 1.80 2.35 1.62 107 TooManyTo_003 7770 1.43 0.90 1.61 108 URI_HEX 7715 1.97 3.09 1.60 109 XMDiploma_00 7577 1.78 2.41 1.57 110 RELAYCOUNTRY_CA 7055 2.08 3.97 1.46 111 XMCapTrack 6776 1.12 0.27 1.40 112 XM_OfRef6 6750 1.56 2.05 1.40 113 UNTRUSTED_Relay 6740 3.95 11.77 1.40 114 TooManyTo_004 5829 1.09 0.73 1.21 115 TR_XM_PHPDW 5632 1.41 2.16 1.17 116 RELAYCOUNTRY_GB 5574 1.58 2.90 1.15 117 XM_GoogleGroups 5542 0.98 0.46 1.15 118 TR_XM_PHPForged 5525 1.39 2.14 1.14 119 XMPhish11 5489 1.16 1.23 1.14 120 TR_XM_FormFill2 5475 1.38 2.13 1.13 121 XM_H_PHPOS 5457 1.37 2.11 1.13 122 USER_IN_DEF_DKIM_WL 5405 0.85 0.01 1.12 123 URI_TRY_3LD 5190 1.13 1.29 1.07 124 DKIM_ADSP_CUSTOM_MED 4989 0.99 0.85 1.03 125 US_DOLLARS_3 4940 1.24 1.90 1.02 126 TooManyTo_005 4871 0.92 0.64 1.01 127 TM2_M_VERY_LONG_WORD 4757 1.19 1.84 0.98 128 XMGenDplmaNmb 4712 1.14 1.64 0.98 129 XMSexyCombo_01 4634 1.65 3.79 0.96 130 NO_DNS_FOR_FROM 4600 1.38 2.70 0.95 131 XM_H_Long_From02 4497 1.02 1.29 0.93 132 T_FILL_THIS_FORM_SHORT 4343 0.99 1.26 0.90 133 XMStockSpam_06 4091 0.97 1.35 0.85 134 XM_UB50 4040 1.98 5.48 0.84 135 URI_WP_HACKED_2 3927 0.93 1.28 0.81 136 XMBdyGiftCard01 3727 1.16 2.34 0.77 137 XM_ProductURIs 3720 0.86 1.15 0.77 138 XMSubMetaI_00 3621 0.86 1.18 0.75 139 NML_ADSP_CUSTOM_MED 3618 0.74 0.70 0.75 140 TO_NO_BRKTS_HTML_ONLY 3570 0.63 0.29 0.74 141 T_Symld_Words_02 3533 1.27 2.92 0.73 142 TR_XM_RelayPhish 3442 0.97 1.74 0.71 143 T_XMDrugObfuBody_00 3432 0.89 1.43 0.71 144 RCVD_IN_BL_SPAMCOP_NET 3328 1.30 3.19 0.69 145 T_OBFU_PDF_ATTACH 3310 0.56 0.16 0.69 146 SpammyFromTLD_01 3195 0.81 1.28 0.66 147 T_TooManySym_03 3176 0.54 0.18 0.66 148 T_XMHurry_00 3130 0.81 1.29 0.65 149 XMBody_95 3114 0.51 0.08 0.64 150 XMGappySubj_01 3052 0.56 0.34 0.63 151 HTTPS_HTTP_MISMATCH 2984 0.65 0.75 0.62 152 XMBody_17 2923 0.78 1.32 0.61 153 HTML_TAG_BALANCE_BODY 2877 0.64 0.79 0.60 154 XM_ShortIntro_01 2862 0.53 0.36 0.59 155 XMMoneyMeta_00 2834 0.75 1.25 0.59 156 RELAYCOUNTRY_AU 2806 0.61 0.70 0.58 157 IMPOTENCE 2798 0.68 0.98 0.58 158 XMBrknScrpt_02 2736 0.72 1.19 0.57 159 TR_LOTS_OF_MONEY3 2671 0.66 0.99 0.55 160 XM_H_PHPMailer 2550 0.66 1.04 0.53 161 FORGED_GMAIL_RCVD 2544 0.58 0.73 0.53 162 FROM_GOV_SPOOF 2533 0.46 0.26 0.52 163 USER_IN_WHITELIST 2498 0.39 0.00 0.52 164 XMPhish30 2395 0.66 1.16 0.50 165 SHORT_HELO_AND_INLINE_IMAGE 2389 0.38 0.04 0.49 166 XMSubMetaSxObfu_03 2379 0.59 0.89 0.49 167 HTML_FONT_FACE_BAD 2361 0.55 0.75 0.49 168 FILL_THIS_FORM 2309 0.48 0.47 0.48 169 TM2_M_BODY_EMPTY 2280 0.37 0.07 0.47 170 XMNoVowels 2276 0.48 0.49 0.47 171 XMHTML_After_End 2236 0.67 1.31 0.46 172 RCVD_IN_SORBS_DUL 2220 0.38 0.13 0.46 173 XMPhish14 2200 0.54 0.79 0.46 174 MISSING_HEADERS 2190 0.48 0.56 0.45 175 XMHTMLBadTable_001 2175 0.56 0.90 0.45 176 PLING_QUERY 2118 0.49 0.66 0.44 177 XMBody_78 2116 0.57 0.97 0.44 178 NUMERIC_HTTP_ADDR 2085 1.61 5.22 0.43 179 XM_B_REG_HTML 2080 0.56 0.95 0.43 180 XMSubMetaSxObfu_02 2060 0.40 0.32 0.43 181 XMDateMe_00 2055 0.39 0.26 0.43 182 TM2_M_A_HREF_HREF 2053 0.42 0.42 0.43 183 RDNS_DYNAMIC 1952 0.54 0.96 0.40 184 HTML_IMAGE_ONLY_32 1943 0.38 0.31 0.40 185 FILL_THIS_FORM_LONG 1927 0.39 0.36 0.40 186 XM_B_COPY_HTML 1927 0.44 0.58 0.40 187 FILL_THIS_FORM_LOAN 1891 0.33 0.14 0.39 188 HTML_IMAGE_ONLY_28 1886 0.40 0.41 0.39 189 XMLngstWrd_00 1883 0.37 0.32 0.39 190 URI_NOVOWEL 1880 0.45 0.65 0.39 191 XMSlimDrugH 1875 0.67 1.52 0.39 192 HTML_IMAGE_ONLY_24 1869 0.36 0.27 0.39 193 DKIM_ADSP_NXDOMAIN 1846 0.96 2.73 0.38 194 FROM_GOV_DKIM_AU 1844 0.31 0.07 0.38 195 ONLINE_PHARMACY 1836 0.43 0.56 0.38 196 TR_LOTS_OF_MONEY2 1786 0.49 0.87 0.37 197 T_MONEY_PERCENT 1786 0.49 0.87 0.37 198 XMLngstWrd_01 1731 0.34 0.29 0.36 199 RELAYCOUNTRY_DE 1698 0.65 1.58 0.35 200 SpammyFromTLD_02 1666 1.79 6.21 0.34 ----------------------------------------------------------------------