Email: 645192 Autolearn: 0 AvgScore: 2.81 AvgScanTime: 2.06 sec Spam: 151754 Autolearn: 0 AvgScore: 12.26 AvgScanTime: 2.53 sec Ham: 493438 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 1.91 sec Time Spent Running SA: 369.23 hours Time Spent Processing Spam: 106.85 hours Time Spent Processing Ham: 262.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140853 87.08 92.82 85.31 2 DKIM_SIGNED 124311 76.04 81.92 74.24 3 DCC_CHECK 121713 50.27 80.20 41.07 4 XM_DK_Pass 120088 74.29 79.13 72.80 5 XM_B_Unicode 115151 68.99 75.88 66.87 6 XMListUnsubscribeExists 114378 57.02 75.37 51.38 7 DKIM_VALID 113885 70.69 75.05 69.36 8 DKIM_VALID_AU 86155 51.69 56.77 50.12 9 XM_B_Unicode3 73737 40.91 48.59 38.55 10 XM_DK_Undo_02 71283 20.56 46.97 12.43 11 BAYES_99 61693 17.71 40.65 10.66 12 HTML_FONT_LOW_CONTRAST 55996 30.17 36.90 28.10 13 BAYES_50 55196 49.97 36.37 54.15 14 BAYES_999 50872 15.11 33.52 9.44 15 TR_DCC_Bayes_99 49638 11.73 32.71 5.27 16 LOC_TINY_FONT_1 49449 24.81 32.58 22.43 17 MIME_HTML_ONLY 48169 22.43 31.74 19.57 18 FVGT_m_MULTI_ODD 41538 22.94 27.37 21.58 19 XMSubLong 40521 23.44 26.70 22.44 20 XM_Body_Dirty_Words 35168 15.25 23.17 12.81 21 T_TM2_M_HEADER_IN_MSG 34723 29.04 22.88 30.94 22 RELAYCOUNTRY_META 34326 9.60 22.62 5.59 23 DKIM_VALID_EF 33365 25.81 21.99 26.98 24 T_KAM_HTML_FONT_INVALID 32419 18.47 21.36 17.58 25 DCC_CHECK_NEGATIVE 27416 47.70 18.07 56.82 26 XM_Multi_Part_URI 26805 12.74 17.66 11.22 27 MultiRelay 26721 18.20 17.61 18.38 28 UNTRUSTED_Relay 23148 4.79 15.25 1.57 29 HTML_IMAGE_RATIO_02 22345 9.82 14.72 8.31 30 BOTNET_IPINHOSTNAME 22258 6.78 14.67 4.35 31 BOTNET 21555 4.70 14.20 1.78 32 XM_Evil_Numbers_Gen 20128 9.33 13.26 8.11 33 LOTS_OF_MONEY 18102 10.19 11.93 9.66 34 XMSexyCombo_05 17812 5.12 11.74 3.09 35 FSL_BULK_SIG 17803 8.37 11.73 7.34 36 T_XMDrugObfuBody_14 14558 8.44 9.59 8.09 37 HTML_IMAGE_RATIO_04 14457 6.49 9.53 5.56 38 XM_UncommonTLD01 14210 5.16 9.36 3.87 39 LotsOfNums_01 13282 7.83 8.75 7.55 40 XM_UB50 12889 2.73 8.49 0.96 41 MPART_ALT_DIFF 12384 4.64 8.16 3.56 42 XMSubMetaSx_00 11913 4.29 7.85 3.20 43 BAYES_80 11388 4.47 7.50 3.54 44 TooManyTo_001 11209 8.36 7.39 8.65 45 DKIM_INVALID 10426 5.35 6.87 4.88 46 RCVD_IN_MSPIKE_H2 9790 7.16 6.45 7.38 47 XM_B_Phish_Phrases 9701 5.57 6.39 5.31 48 XM_DIRTYINTL 9354 3.25 6.16 2.36 49 XM_H_Long_From01 9204 6.07 6.07 6.07 50 MIME_QP_LONG_LINE 8812 5.80 5.81 5.80 51 BAYES_60 8399 5.96 5.53 6.09 52 SpammyFromTLD_02 7526 1.40 4.96 0.31 53 T_REMOTE_IMAGE 7198 4.26 4.74 4.11 54 MultiRelay_Combo 7133 1.26 4.70 0.20 55 MultiRelay_CC 7133 1.26 4.70 0.20 56 RELAYCOUNTRY_CA 7102 2.26 4.68 1.51 57 MIME_HTML_ONLY_MULTI 7016 2.62 4.62 2.01 58 HTML_IMAGE_RATIO_06 6991 3.45 4.61 3.09 59 SUBJ_ALL_CAPS 6949 2.62 4.58 2.02 60 XM_B_SpammyTLD 6884 3.52 4.54 3.21 61 RCVD_IN_BL_SPAMCOP_NET 6856 1.70 4.52 0.84 62 XMNumbers 6551 3.76 4.32 3.59 63 BAYES_95 6524 2.78 4.30 2.31 64 SpammyFromTLD_01 6453 1.57 4.25 0.75 65 FROM_EXCESS_BASE64 6224 3.35 4.10 3.11 66 XMStrtUSub 6199 4.20 4.08 4.23 67 RELAYCOUNTRY_FR 6148 1.13 4.05 0.23 68 URI_HEX 5903 2.32 3.89 1.84 69 TM2_M_URI_OPT_OUT 5822 2.30 3.84 1.83 70 XM_SPF_SoftFail 5776 2.27 3.81 1.80 71 MIME_HTML_MOSTLY 5774 2.43 3.80 2.01 72 HTML_IMAGE_RATIO_08 5507 2.74 3.63 2.47 73 TR_Mismatch_TLD_02 5250 0.87 3.46 0.08 74 XM_SendGrid 5239 5.53 3.45 6.16 75 XM_URI_RBL 4870 0.94 3.21 0.24 76 T_TooManySym_01 4841 5.53 3.19 6.25 77 US_DOLLARS_3 4624 2.15 3.05 1.88 78 RELAYCOUNTRY_RU 4576 0.72 3.02 0.02 79 XM_CamelCaseFrm001 4437 2.35 2.92 2.17 80 RCVD_IN_IADB_LISTED 4418 5.18 2.91 5.87 81 HTML_MIME_NO_HTML_TAG 4412 2.35 2.91 2.18 82 T_XMDrugObfuBody_08 4255 1.84 2.80 1.54 83 HK_SCAM 4222 0.67 2.78 0.02 84 XM_ShortIntro_01 4164 1.10 2.74 0.60 85 XMSexyCombo_01 4117 1.05 2.71 0.54 86 XM_OfRef6 4002 1.93 2.64 1.71 87 KHOP_HELO_FCRDNS 3938 2.18 2.59 2.05 88 RCVD_IN_IADB_SPF 3919 4.47 2.58 5.06 89 XMDiploma_00 3906 1.87 2.57 1.66 90 TR_XM_PHPDW 3795 1.03 2.50 0.58 91 RCVD_IN_IADB_DK 3769 3.85 2.48 4.27 92 ADVANCE_FEE_3_NEW 3747 0.58 2.47 0.00 93 RCVD_IN_IADB_SENDERID 3741 3.93 2.47 4.37 94 TR_XM_PHPForged 3728 1.01 2.46 0.57 95 TR_XM_FormFill2 3711 1.00 2.45 0.56 96 RELAYCOUNTRY_KH 3685 0.57 2.43 0.00 97 XM_H_PHPOS 3677 0.99 2.42 0.56 98 RCVD_IN_RP_SAFE 3510 8.04 2.31 9.81 99 T_XMDrugObfuBody_00 3476 1.21 2.29 0.88 100 NO_DNS_FOR_FROM 3473 1.26 2.29 0.94 101 XMBdyGiftCard01 3470 1.15 2.29 0.80 102 DKIM_ADSP_NXDOMAIN 3438 0.86 2.27 0.43 103 XM_UB99 3438 0.54 2.27 0.01 104 RCVD_IN_RP_RNBL 3427 0.55 2.26 0.03 105 BAYES_40 3305 4.03 2.18 4.60 106 XMSubMetaI_00 3266 0.93 2.15 0.55 107 BODY_URI_ONLY 3217 0.56 2.12 0.08 108 RCVD_IN_PSBL 3163 0.51 2.08 0.03 109 HTML_SHORT_LINK_IMG_1 2986 0.50 1.97 0.05 110 XMGenDplmaNmb 2964 1.27 1.95 1.06 111 ALL_TRUSTED 2934 13.59 1.93 17.18 112 TM2_M_VERY_LONG_WORD 2716 1.17 1.79 0.98 113 TR_Symld_Words 2602 1.97 1.71 2.05 114 XM_BadFromFormat 2574 0.52 1.70 0.16 115 XMBody_17 2569 1.14 1.69 0.96 116 MAILING_LIST_MULTI 2519 2.27 1.66 2.46 117 XM_UB999 2499 0.39 1.65 0.01 118 BOTNET_NORDNS 2451 0.41 1.62 0.04 119 DATE_IN_PAST_03_06 2440 0.48 1.61 0.13 120 BAYES_20 2435 2.88 1.60 3.27 121 XM_H_Long_From02 2429 1.40 1.60 1.33 122 XMStockSpam_06 2424 1.77 1.60 1.83 123 TR_XM_DK_SendGrid 2423 2.74 1.60 3.10 124 RELAYCOUNTRY_NL 2354 0.60 1.55 0.30 125 URI_TRY_3LD 2323 1.39 1.53 1.35 126 RCVD_IN_RP_CERTIFIED 2264 7.03 1.49 8.73 127 XMPhish11 2262 1.18 1.49 1.08 128 XMHTML_After_End 2237 0.66 1.47 0.41 129 DIET_1 2230 0.65 1.47 0.40 130 T_XMHurry_00 2183 0.77 1.44 0.57 131 XM_UB60 2172 0.39 1.43 0.07 132 XMMoneyMeta_00 2138 1.63 1.41 1.70 133 TR_XM_RelayPhish 2067 0.84 1.36 0.69 134 XM_H_PHPMailer 2060 0.69 1.36 0.49 135 HDRS_LCASE_IMGONLY 2001 0.36 1.32 0.06 136 HTML_IMAGE_ONLY_08 1962 0.42 1.29 0.15 137 TR_LOTS_OF_MONEY2 1957 0.81 1.29 0.66 138 T_MONEY_PERCENT 1957 0.81 1.29 0.66 139 HTML_FONT_FACE_BAD 1928 0.71 1.27 0.53 140 XMBrknScrpt_02 1906 0.74 1.26 0.57 141 TM2_M_A_HREF_HREF 1886 0.76 1.24 0.62 142 RCVD_IN_MSPIKE_WL 1848 4.36 1.22 5.32 143 XMSlimDrugH 1827 0.60 1.20 0.41 144 XMSexyCombo_04 1792 0.34 1.18 0.08 145 NUMERIC_HTTP_ADDR 1790 0.54 1.18 0.34 146 XMPhish30 1789 0.59 1.18 0.41 147 XMBody_78 1781 0.73 1.17 0.59 148 RCVD_IN_IADB_VOUCHED 1673 3.34 1.10 4.03 149 UNPARSEABLE_RELAY 1673 2.03 1.10 2.31 150 RCVD_IN_MSPIKE_H3 1662 4.22 1.10 5.18 151 XM_ProductURIs 1653 0.74 1.09 0.63 152 XM_H_PHPOS_M 1652 0.39 1.09 0.18 153 XM_UB80 1641 0.27 1.08 0.02 154 RELAYCOUNTRY_IN 1634 0.35 1.08 0.13 155 RELAYCOUNTRY_GB 1622 1.09 1.07 1.10 156 DKIM_ADSP_CUSTOM_MED 1612 1.05 1.06 1.04 157 XM_DK_Undo_01 1599 1.51 1.05 1.64 158 MPART_ALT_DIFF_COUNT 1551 0.51 1.02 0.35 159 TR_LOTS_OF_MONEY3 1530 0.67 1.01 0.57 160 SUBJ_DOLLARS 1512 0.62 1.00 0.51 161 TooManyTo_002 1512 2.27 1.00 2.66 162 HTML_IMAGE_ONLY_12 1493 0.38 0.98 0.20 163 XMHTMLBadTable_001 1452 0.56 0.96 0.44 164 PLING_QUERY 1427 0.52 0.94 0.39 165 BAYES_00 1422 10.09 0.94 12.90 166 TR_Caps_n_Bayes_99 1420 0.39 0.94 0.22 167 FORGED_GMAIL_RCVD 1395 0.61 0.92 0.52 168 URIBL_DBL_ABUSE_REDIR 1386 0.22 0.91 0.01 169 T_FILL_THIS_FORM_SHORT 1384 0.89 0.91 0.88 170 NORMAL_HTTP_TO_IP 1365 0.26 0.90 0.06 171 URIBL_BLACK 1361 0.26 0.90 0.07 172 BODY_ENHANCEMENT 1360 0.23 0.90 0.03 173 RELAYCOUNTRY_DE 1359 0.60 0.90 0.51 174 URIBL_DBL_SPAM 1348 0.21 0.89 0.01 175 RELAYCOUNTRY_AT 1347 0.36 0.89 0.20 176 XMSubMetaSxObfu_03 1317 0.50 0.87 0.39 177 RDNS_DYNAMIC 1309 0.52 0.86 0.41 178 FROM_SUSPICIOUS_NTLD 1308 0.23 0.86 0.03 179 TooManyTo_003 1291 1.58 0.85 1.80 180 NML_ADSP_CUSTOM_MED 1287 0.81 0.85 0.80 181 XM_HighProb1 1255 0.20 0.83 0.01 182 FROM_SUSPICIOUS_NTLD_FP 1251 0.22 0.82 0.03 183 HTML_TAG_BALANCE_BODY 1237 0.70 0.82 0.67 184 T_Symld_Words_02 1233 0.63 0.81 0.57 185 XMSubMetaSSx_00 1229 0.33 0.81 0.18 186 URI_NOVOWEL 1195 0.49 0.79 0.39 187 HTTPS_HTTP_MISMATCH 1184 0.63 0.78 0.59 188 TooManyTo_004 1140 1.21 0.75 1.35 189 LONG_HEX_URI 1140 0.30 0.75 0.16 190 XM_XX_Yahoo 1138 0.34 0.75 0.22 191 DATE_IN_PAST_12_24 1128 0.21 0.74 0.04 192 BAYES_05 1086 1.80 0.72 2.13 193 URI_HEX_IP 1064 0.17 0.70 0.00 194 TR_MetaPhish_Combo_01 1043 1.49 0.69 1.74 195 XM_OfRef7 1040 0.37 0.69 0.28 196 XMSubMetaSxObfu_02 1040 0.45 0.69 0.38 197 XMDiploma_06 1032 0.18 0.68 0.03 198 T_TooManySym_02 1024 1.95 0.67 2.35 199 XM_UB95 1010 0.17 0.67 0.01 200 FSL_THIS_IS_ADV 996 0.44 0.66 0.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 420974 87.08 92.82 85.31 2 DKIM_SIGNED 366322 76.04 81.92 74.24 3 XM_DK_Pass 359200 74.29 79.13 72.80 4 DKIM_VALID 342224 70.69 75.05 69.36 5 XM_B_Unicode 329949 68.99 75.88 66.87 6 DCC_CHECK_NEGATIVE 280361 47.70 18.07 56.82 7 BAYES_50 267211 49.97 36.37 54.15 8 XMListUnsubscribeExists 253535 57.02 75.37 51.38 9 DKIM_VALID_AU 247334 51.69 56.77 50.12 10 DCC_CHECK 202648 50.27 80.20 41.07 11 XM_B_Unicode3 190235 40.91 48.59 38.55 12 T_TM2_M_HEADER_IN_MSG 152671 29.04 22.88 30.94 13 HTML_FONT_LOW_CONTRAST 138652 30.17 36.90 28.10 14 DKIM_VALID_EF 133132 25.81 21.99 26.98 15 XMSubLong 110743 23.44 26.70 22.44 16 LOC_TINY_FONT_1 110654 24.81 32.58 22.43 17 FVGT_m_MULTI_ODD 106464 22.94 27.37 21.58 18 MIME_HTML_ONLY 96549 22.43 31.74 19.57 19 MultiRelay 90688 18.20 17.61 18.38 20 T_KAM_HTML_FONT_INVALID 86755 18.47 21.36 17.58 21 ALL_TRUSTED 84748 13.59 1.93 17.18 22 BAYES_00 63678 10.09 0.94 12.90 23 XM_Body_Dirty_Words 63234 15.25 23.17 12.81 24 XM_DK_Undo_02 61337 20.56 46.97 12.43 25 XM_Multi_Part_URI 55374 12.74 17.66 11.22 26 BAYES_99 52601 17.71 40.65 10.66 27 TR_XM_DK_Bayes 50684 7.96 0.46 10.27 28 RCVD_IN_RP_SAFE 48393 8.04 2.31 9.81 29 TR_XM_DK_Bayes1 47879 7.51 0.39 9.70 30 LOTS_OF_MONEY 47668 10.19 11.93 9.66 31 BAYES_999 46604 15.11 33.52 9.44 32 RCVD_IN_RP_CERTIFIED 43068 7.03 1.49 8.73 33 TooManyTo_001 42700 8.36 7.39 8.65 34 HTML_IMAGE_RATIO_02 40998 9.82 14.72 8.31 35 TR_XM_DK_Bayes2 40311 6.31 0.26 8.17 36 XM_Evil_Numbers_Gen 40041 9.33 13.26 8.11 37 T_XMDrugObfuBody_14 39910 8.44 9.59 8.09 38 XM_DKIMWhitelistDomains 37707 5.87 0.11 7.64 39 LotsOfNums_01 37264 7.83 8.75 7.55 40 RCVD_IN_MSPIKE_H2 36403 7.16 6.45 7.38 41 FSL_BULK_SIG 36213 8.37 11.73 7.34 42 T_TooManySym_01 30846 5.53 3.19 6.25 43 XM_SendGrid 30410 5.53 3.45 6.16 44 BAYES_60 30039 5.96 5.53 6.09 45 XM_H_Long_From01 29937 6.07 6.07 6.07 46 RCVD_IN_IADB_LISTED 28985 5.18 2.91 5.87 47 MIME_QP_LONG_LINE 28605 5.80 5.81 5.80 48 RELAYCOUNTRY_META 27586 9.60 22.62 5.59 49 HTML_IMAGE_RATIO_04 27427 6.49 9.53 5.56 50 RCVD_IN_MSPIKE_WL 26258 4.36 1.22 5.32 51 XM_B_Phish_Phrases 26219 5.57 6.39 5.31 52 TR_DCC_Bayes_99 26023 11.73 32.71 5.27 53 RCVD_IN_MSPIKE_H3 25547 4.22 1.10 5.18 54 RCVD_IN_IADB_SPF 24946 4.47 2.58 5.06 55 DKIM_INVALID 24098 5.35 6.87 4.88 56 BAYES_40 22702 4.03 2.18 4.60 57 RCVD_IN_IADB_SENDERID 21583 3.93 2.47 4.37 58 BOTNET_IPINHOSTNAME 21475 6.78 14.67 4.35 59 RCVD_IN_IADB_DK 21084 3.85 2.48 4.27 60 XM_PDF 20992 3.40 0.61 4.25 61 XMStrtUSub 20894 4.20 4.08 4.23 62 T_REMOTE_IMAGE 20274 4.26 4.74 4.11 63 RCVD_IN_IADB_VOUCHED 19898 3.34 1.10 4.03 64 IN_ZIMBRA_NJ_WHITELIST 19597 3.04 0.02 3.97 65 XM_UncommonTLD01 19081 5.16 9.36 3.87 66 XMNumbers 17701 3.76 4.32 3.59 67 MPART_ALT_DIFF 17583 4.64 8.16 3.56 68 BAYES_80 17446 4.47 7.50 3.54 69 TO_MALFORMED 17145 2.66 0.01 3.47 70 BAYES_20 16160 2.88 1.60 3.27 71 XM_B_SpammyTLD 15849 3.52 4.54 3.21 72 XMSubMetaSx_00 15770 4.29 7.85 3.20 73 FROM_EXCESS_BASE64 15362 3.35 4.10 3.11 74 TR_XM_DK_SendGrid 15285 2.74 1.60 3.10 75 HTML_IMAGE_RATIO_06 15253 3.45 4.61 3.09 76 XMSexyCombo_05 15246 5.12 11.74 3.09 77 ANY_BOUNCE_MESSAGE 15071 2.41 0.32 3.05 78 BOUNCE_MESSAGE 15064 2.41 0.32 3.05 79 TooManyTo_002 13138 2.27 1.00 2.66 80 RCVD_IN_IADB_OPTIN 12822 2.13 0.60 2.60 81 HTML_IMAGE_RATIO_08 12181 2.74 3.63 2.47 82 MAILING_LIST_MULTI 12144 2.27 1.66 2.46 83 XM_DIRTYINTL 11626 3.25 6.16 2.36 84 T_TooManySym_02 11587 1.95 0.67 2.35 85 UNPARSEABLE_RELAY 11408 2.03 1.10 2.31 86 BAYES_95 11400 2.78 4.30 2.31 87 INVALID_MSGID 10988 1.73 0.14 2.23 88 HTML_MIME_NO_HTML_TAG 10767 2.35 2.91 2.18 89 XM_CamelCaseFrm001 10720 2.35 2.92 2.17 90 BAYES_05 10501 1.80 0.72 2.13 91 KHOP_HELO_FCRDNS 10133 2.18 2.59 2.05 92 TR_Symld_Words 10101 1.97 1.71 2.05 93 SUBJ_ALL_CAPS 9958 2.62 4.58 2.02 94 MIME_HTML_MOSTLY 9930 2.43 3.80 2.01 95 MIME_HTML_ONLY_MULTI 9916 2.62 4.62 2.01 96 TVD_RCVD_IP 9697 1.63 0.52 1.97 97 US_DOLLARS_3 9260 2.15 3.05 1.88 98 URI_HEX 9079 2.32 3.89 1.84 99 XMStockSpam_06 9017 1.77 1.60 1.83 100 TM2_M_URI_OPT_OUT 9014 2.30 3.84 1.83 101 TooManyTo_003 8892 1.58 0.85 1.80 102 XM_SPF_SoftFail 8884 2.27 3.81 1.80 103 BOTNET 8798 4.70 14.20 1.78 104 TR_MetaPhish_Combo_01 8582 1.49 0.69 1.74 105 XM_OfRef6 8427 1.93 2.64 1.71 106 XMMoneyMeta_00 8383 1.63 1.41 1.70 107 HELO_NODOT 8209 1.41 0.61 1.66 108 HELO_NO_DOMAIN 8208 1.41 0.60 1.66 109 XMDiploma_00 8189 1.87 2.57 1.66 110 XMGappySubj_01 8184 1.37 0.44 1.66 111 IN_HORDE_ADDRESS_BOOK 8145 1.27 0.05 1.65 112 XM_DK_Undo_01 8117 1.51 1.05 1.64 113 CK_HELO_DYNAMIC_SPLIT_IP 8113 1.33 0.31 1.64 114 HELO_DYNAMIC_IPADDR2 8109 1.30 0.19 1.64 115 UNTRUSTED_Relay 7732 4.79 15.25 1.57 116 T_XMDrugObfuBody_08 7585 1.84 2.80 1.54 117 RELAYCOUNTRY_CA 7466 2.26 4.68 1.51 118 XMCapTrack 7087 1.15 0.24 1.44 119 URI_TRY_3LD 6670 1.39 1.53 1.35 120 TooManyTo_004 6652 1.21 0.75 1.35 121 XM_H_Long_From02 6581 1.40 1.60 1.33 122 USER_IN_DEF_DKIM_WL 6416 1.00 0.01 1.30 123 XM_GoogleGroups 5934 1.02 0.41 1.20 124 TooManyTo_005 5436 0.99 0.63 1.10 125 RELAYCOUNTRY_GB 5435 1.09 1.07 1.10 126 XMPhish11 5351 1.18 1.49 1.08 127 XMGenDplmaNmb 5255 1.27 1.95 1.06 128 DKIM_ADSP_CUSTOM_MED 5144 1.05 1.06 1.04 129 TM2_M_VERY_LONG_WORD 4819 1.17 1.79 0.98 130 XMBody_17 4754 1.14 1.69 0.96 131 XM_UB50 4724 2.73 8.49 0.96 132 NO_DNS_FOR_FROM 4662 1.26 2.29 0.94 133 T_XMDrugObfuBody_00 4353 1.21 2.29 0.88 134 T_FILL_THIS_FORM_SHORT 4326 0.89 0.91 0.88 135 RCVD_IN_BL_SPAMCOP_NET 4137 1.70 4.52 0.84 136 NML_ADSP_CUSTOM_MED 3931 0.81 0.85 0.80 137 XMBdyGiftCard01 3928 1.15 2.29 0.80 138 SpammyFromTLD_01 3682 1.57 4.25 0.75 139 XMGappySubj_02 3591 0.59 0.14 0.73 140 XMNoVowels 3409 0.68 0.63 0.69 141 TR_XM_RelayPhish 3384 0.84 1.36 0.69 142 HTML_TAG_BALANCE_BODY 3291 0.70 0.82 0.67 143 T_TooManySym_03 3274 0.54 0.15 0.66 144 TR_LOTS_OF_MONEY2 3258 0.81 1.29 0.66 145 T_MONEY_PERCENT 3258 0.81 1.29 0.66 146 XM_ProductURIs 3097 0.74 1.09 0.63 147 TM2_M_A_HREF_HREF 3046 0.76 1.24 0.62 148 T_OBFU_PDF_ATTACH 3011 0.50 0.16 0.61 149 XMBody_95 2954 0.48 0.10 0.60 150 XM_ShortIntro_01 2938 1.10 2.74 0.60 151 HTTPS_HTTP_MISMATCH 2911 0.63 0.78 0.59 152 XMBody_78 2899 0.73 1.17 0.59 153 USER_IN_WHITELIST 2884 0.45 0.00 0.58 154 TR_XM_PHPDW 2862 1.03 2.50 0.58 155 XMBrknScrpt_02 2837 0.74 1.26 0.57 156 T_Symld_Words_02 2825 0.63 0.81 0.57 157 T_XMHurry_00 2796 0.77 1.44 0.57 158 TR_LOTS_OF_MONEY3 2794 0.67 1.01 0.57 159 TR_XM_PHPForged 2792 1.01 2.46 0.57 160 FILL_THIS_FORM 2764 0.56 0.56 0.56 161 TR_XM_FormFill2 2759 1.00 2.45 0.56 162 RELAYCOUNTRY_AU 2759 0.54 0.49 0.56 163 XM_H_PHPOS 2741 0.99 2.42 0.56 164 XMSubMetaI_00 2707 0.93 2.15 0.55 165 XMSexyCombo_01 2677 1.05 2.71 0.54 166 HTML_FONT_FACE_BAD 2632 0.71 1.27 0.53 167 FORGED_GMAIL_RCVD 2568 0.61 0.92 0.52 168 RELAYCOUNTRY_DE 2539 0.60 0.90 0.51 169 SUBJ_DOLLARS 2508 0.62 1.00 0.51 170 XMLngstWrd_00 2417 0.49 0.48 0.49 171 AC_DIV_BONANZA 2414 0.39 0.08 0.49 172 XM_H_PHPMailer 2412 0.69 1.36 0.49 173 FROM_GOV_SPOOF 2408 0.43 0.24 0.49 174 XM_B_REG_HTML 2389 0.51 0.61 0.48 175 FILL_THIS_FORM_LONG 2363 0.48 0.49 0.48 176 FILL_THIS_FORM_LOAN 2344 0.41 0.18 0.48 177 MISSING_HEADERS 2283 0.47 0.51 0.46 178 TM2_M_BODY_EMPTY 2280 0.37 0.09 0.46 179 XMPhish14 2212 0.50 0.65 0.45 180 XMSolicitRefs_0 2183 0.42 0.37 0.44 181 XMLngstWrd_01 2176 0.44 0.45 0.44 182 SHORT_HELO_AND_INLINE_IMAGE 2175 0.34 0.03 0.44 183 XMHTMLBadTable_001 2163 0.56 0.96 0.44 184 XM_B_COPY_HTML 2121 0.48 0.66 0.43 185 DKIM_ADSP_NXDOMAIN 2119 0.86 2.27 0.43 186 XM_D_tchamptons_WL 2110 0.33 0.00 0.43 187 FROM_GOV_DKIM_AU 2100 0.35 0.10 0.43 188 XMDateMe_00 2088 0.41 0.37 0.42 189 RDNS_DYNAMIC 2037 0.52 0.86 0.41 190 XMSlimDrugH 2023 0.60 1.20 0.41 191 XMPhish30 2021 0.59 1.18 0.41 192 XMHTML_After_End 2019 0.66 1.47 0.41 193 DIET_1 1993 0.65 1.47 0.40 194 URI_NOVOWEL 1939 0.49 0.79 0.39 195 PLING_QUERY 1936 0.52 0.94 0.39 196 XMSubMetaSxObfu_03 1917 0.50 0.87 0.39 197 XM_Body_Obfu01 1903 0.42 0.51 0.39 198 RCVD_IN_SORBS_DUL 1875 0.34 0.19 0.38 199 TVD_SPACE_RATIO 1871 0.33 0.16 0.38 200 XMSubMetaSxObfu_02 1852 0.45 0.69 0.38 ----------------------------------------------------------------------