Email: 654635 Autolearn: 0 AvgScore: 1.35 AvgScanTime: 2.15 sec Spam: 101856 Autolearn: 0 AvgScore: 12.47 AvgScanTime: 2.77 sec Ham: 552779 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 2.04 sec Time Spent Running SA: 391.43 hours Time Spent Processing Spam: 78.35 hours Time Spent Processing Ham: 313.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96019 88.67 94.27 87.64 2 DCC_CHECK 80608 50.18 79.14 44.85 3 DKIM_SIGNED 77475 77.16 76.06 77.36 4 XM_DK_Pass 74406 75.72 73.05 76.22 5 XM_B_Unicode 71771 71.20 70.46 71.33 6 XMListUnsubscribeExists 71257 56.43 69.96 53.93 7 DKIM_VALID 69697 72.07 68.43 72.74 8 DKIM_VALID_AU 53108 53.79 52.14 54.10 9 BAYES_50 51774 53.20 50.83 53.64 10 XM_B_Unicode3 46930 42.70 46.07 42.08 11 MIME_HTML_ONLY 36582 24.17 35.92 22.00 12 LOC_TINY_FONT_1 34244 26.18 33.62 24.81 13 XM_DK_Undo_02 32938 9.88 32.34 5.75 14 HTML_FONT_LOW_CONTRAST 32472 29.43 31.88 28.98 15 XMSubLong 26940 23.64 26.45 23.12 16 FVGT_m_MULTI_ODD 26679 22.89 26.19 22.29 17 BOTNET 24508 5.54 24.06 2.12 18 RELAYCOUNTRY_META 23956 8.29 23.52 5.48 19 DKIM_VALID_EF 23164 25.91 22.74 26.49 20 XM_Body_Dirty_Words 21804 15.64 21.41 14.58 21 T_TM2_M_HEADER_IN_MSG 21739 28.13 21.34 29.38 22 MultiRelay 21701 19.10 21.31 18.69 23 BAYES_99 21217 5.49 20.83 2.66 24 DCC_CHECK_NEGATIVE 19535 47.72 19.18 52.98 25 BOTNET_IPINHOSTNAME 19261 6.75 18.91 4.51 26 T_KAM_HTML_FONT_INVALID 18786 18.87 18.44 18.95 27 XM_Multi_Part_URI 17763 12.78 17.44 11.93 28 TR_DCC_Bayes_99 16800 3.65 16.49 1.28 29 HTML_IMAGE_RATIO_02 16764 10.18 16.46 9.03 30 BAYES_999 16188 4.27 15.89 2.13 31 XM_Evil_Numbers_Gen 15535 10.77 15.25 9.95 32 FSL_BULK_SIG 15349 8.84 15.07 7.69 33 UNTRUSTED_Relay 14168 3.54 13.91 1.63 34 LOTS_OF_MONEY 13803 10.26 13.55 9.66 35 XM_UncommonTLD01 11833 4.41 11.62 3.08 36 XMSexyCombo_05 11238 5.87 11.03 4.92 37 MPART_ALT_DIFF 9384 4.67 9.21 3.83 38 XM_H_Long_From01 9051 6.77 8.89 6.38 39 T_XMDrugObfuBody_14 8890 8.15 8.73 8.04 40 XM_UB50 8786 2.08 8.63 0.87 41 LotsOfNums_01 8315 8.35 8.16 8.38 42 XMSubMetaSx_00 8060 4.52 7.91 3.90 43 DKIM_INVALID 7778 5.09 7.64 4.62 44 HTML_MIME_NO_HTML_TAG 7201 2.94 7.07 2.18 45 TooManyTo_001 6999 7.62 6.87 7.76 46 HTML_IMAGE_RATIO_04 6651 7.12 6.53 7.23 47 T_REMOTE_IMAGE 6575 4.39 6.46 4.00 48 XM_SPF_SoftFail 6408 2.78 6.29 2.13 49 XM_B_Phish_Phrases 6108 5.63 6.00 5.57 50 XM_DIRTYINTL 5996 3.84 5.89 3.47 51 MIME_HTML_MOSTLY 5963 2.81 5.85 2.24 52 BAYES_40 5926 6.48 5.82 6.60 53 XMNumbers 5891 4.18 5.78 3.88 54 BAYES_80 5772 2.67 5.67 2.12 55 MIME_HTML_ONLY_MULTI 5546 2.73 5.44 2.23 56 RCVD_IN_MSPIKE_H2 5499 6.72 5.40 6.97 57 SpammyFromTLD_02 5073 1.15 4.98 0.44 58 HTML_IMAGE_RATIO_06 5032 3.71 4.94 3.48 59 RCVD_IN_BL_SPAMCOP_NET 4746 1.53 4.66 0.95 60 XM_URI_RBL 4687 1.01 4.60 0.35 61 MultiRelay_Combo 4652 0.89 4.57 0.21 62 MultiRelay_CC 4652 0.89 4.57 0.21 63 RELAYCOUNTRY_CA 4643 1.99 4.56 1.52 64 BAYES_60 4599 4.05 4.52 3.97 65 TR_Mismatch_TLD_02 4593 0.78 4.51 0.09 66 BAYES_20 4474 5.02 4.39 5.14 67 BOTNET_NORDNS 4395 0.71 4.31 0.05 68 MIME_QP_LONG_LINE 4263 5.82 4.19 6.12 69 TM2_M_URI_OPT_OUT 4240 2.21 4.16 1.85 70 RCVD_IN_PSBL 4197 0.65 4.12 0.01 71 RCVD_IN_RP_RNBL 3962 0.64 3.89 0.04 72 RELAYCOUNTRY_FR 3906 0.88 3.83 0.34 73 KHOP_HELO_FCRDNS 3837 2.24 3.77 1.96 74 HTML_SHORT_LINK_IMG_1 3782 0.60 3.71 0.03 75 XM_B_SpammyTLD 3684 3.60 3.62 3.60 76 HTML_IMAGE_RATIO_08 3684 2.54 3.62 2.34 77 BODY_URI_ONLY 3637 0.63 3.57 0.09 78 RELAYCOUNTRY_GB 3621 1.56 3.56 1.19 79 T_HTML_TAG_BALANCE_CENTER 3565 0.65 3.50 0.13 80 URI_HEX 3516 2.19 3.45 1.96 81 FROM_MISSP_REPLYTO 3463 0.53 3.40 0.00 82 XMStrtUSub 3458 3.59 3.39 3.63 83 DOS_RCVD_IP_TWICE_B 3290 0.56 3.23 0.07 84 HTML_IMAGE_ONLY_20 3218 0.72 3.16 0.27 85 XM_SendGrid 3208 6.22 3.15 6.78 86 SUBJ_ALL_CAPS 3174 2.30 3.12 2.15 87 HTML_IMAGE_ONLY_08 3101 0.57 3.04 0.11 88 NO_DNS_FOR_FROM 3036 1.38 2.98 1.09 89 XMDiploma_00 2935 1.89 2.88 1.71 90 T_TooManySym_01 2886 5.25 2.83 5.70 91 DKIM_ADSP_NXDOMAIN 2874 1.03 2.82 0.70 92 TR_XM_PHPDW 2863 0.92 2.81 0.58 93 TR_XM_PHPForged 2854 0.99 2.80 0.66 94 TR_XM_FormFill2 2851 0.90 2.80 0.55 95 BAYES_95 2846 1.47 2.79 1.22 96 XM_H_PHPOS 2837 0.90 2.79 0.55 97 XMBdyGiftCard01 2805 1.26 2.75 0.98 98 ALIBABA_IMG_NOT_RCVD_ALI 2722 0.42 2.67 0.00 99 DATE_IN_PAST_24_48 2667 0.41 2.62 0.01 100 XM_BadFromFormat 2657 0.50 2.61 0.11 101 BAYES_00 2651 18.26 2.60 21.14 102 XM_CamelCaseFrm001 2622 2.10 2.57 2.01 103 FROM_EXCESS_BASE64 2598 3.55 2.55 3.74 104 SpammyFromTLD_01 2575 1.08 2.53 0.81 105 XM_OfRef6 2495 1.48 2.45 1.30 106 RCVD_IN_MSPIKE_WL 2426 4.87 2.38 5.33 107 HOSTED_IMG_DIRECT_MX 2379 0.36 2.34 0.00 108 ALL_TRUSTED 2322 12.81 2.28 14.75 109 T_XMDrugObfuBody_08 2322 1.68 2.28 1.57 110 BAYES_05 2279 3.05 2.24 3.20 111 XMSexyCombo_01 2278 1.07 2.24 0.86 112 RCVD_IN_MSPIKE_H3 2245 4.17 2.20 4.53 113 DIET_1 2238 0.63 2.20 0.34 114 T_XMDrugObfuBody_00 2148 1.19 2.11 1.02 115 XMSubMetaI_00 2137 0.89 2.10 0.67 116 TM2_M_A_HREF_HREF 2040 0.87 2.00 0.66 117 TM2_M_VERY_LONG_WORD 2027 1.63 1.99 1.56 118 TR_XM_INV_DKIM 1951 0.39 1.92 0.11 119 RCVD_IN_IADB_LISTED 1902 4.77 1.87 5.30 120 RELAYCOUNTRY_IN 1889 0.40 1.85 0.13 121 XMGenDplmaNmb 1885 1.32 1.85 1.22 122 XMPhish11 1877 1.62 1.84 1.57 123 RDNS_DYNAMIC 1872 0.55 1.84 0.31 124 MAILING_LIST_MULTI 1870 2.20 1.84 2.27 125 RCVD_IN_IADB_SPF 1754 4.13 1.72 4.58 126 MISSING_HEADERS 1749 0.61 1.72 0.40 127 XM_DK_Undo_01 1723 1.81 1.69 1.84 128 RCVD_IN_IADB_DK 1691 3.58 1.66 3.93 129 T_Symld_Words_02 1689 0.70 1.66 0.53 130 RCVD_IN_IADB_SENDERID 1682 3.63 1.65 4.00 131 TR_XM_RelayPhish 1679 1.08 1.65 0.97 132 FROM_SUSPICIOUS_NTLD 1662 0.28 1.63 0.04 133 TR_XM_DK_Bayes 1653 15.02 1.62 17.49 134 XM_Combo_Sbj 1647 0.48 1.62 0.27 135 T_FILL_THIS_FORM_SHORT 1627 0.96 1.60 0.84 136 DATE_IN_PAST_03_06 1584 0.32 1.56 0.10 137 URIBL_DBL_ABUSE_REDIR 1582 0.25 1.55 0.01 138 XMSubMetaSxObfu_03 1582 0.95 1.55 0.84 139 TR_Symld_Words 1572 1.77 1.54 1.81 140 FROM_SUSPICIOUS_NTLD_FP 1554 0.26 1.53 0.03 141 TR_Mismatch_TLD_01 1511 0.42 1.48 0.22 142 XMStockSpam_06 1510 1.54 1.48 1.55 143 REPLYTO_WITHOUT_TO_CC 1505 0.26 1.48 0.03 144 XMBrknScrpt_02 1477 0.74 1.45 0.61 145 XMPhish30 1477 0.70 1.45 0.57 146 HK_RANDOM_FROM 1472 0.33 1.45 0.12 147 TR_XM_DK_Bayes1 1470 14.35 1.44 16.72 148 TR_XM_DK_SendGrid 1462 3.27 1.44 3.60 149 HK_RANDOM_ENVFROM 1427 0.29 1.40 0.09 150 TR_LOTS_OF_MONEY2 1420 0.76 1.39 0.64 151 T_MONEY_PERCENT 1420 0.76 1.39 0.64 152 XM_H_PHPMailer 1399 0.78 1.37 0.66 153 T_XMHurry_00 1397 0.81 1.37 0.71 154 TVD_PH_BODY_ACCOUNTS_PRE 1393 0.32 1.37 0.13 155 RCVD_IN_RP_SAFE 1381 8.89 1.36 10.28 156 SHORT_URI_2 1332 0.22 1.31 0.02 157 HDRS_LCASE_IMGONLY 1329 0.23 1.30 0.03 158 XMMoneyMeta_00 1310 0.84 1.29 0.75 159 URI_PHISH 1249 0.20 1.23 0.01 160 XMEmptySub 1233 0.26 1.21 0.08 161 SHORT_URI_4 1229 0.19 1.21 0.00 162 XMHTML_After_End 1178 1.12 1.16 1.11 163 LONG_HEX_URI 1174 0.37 1.15 0.22 164 XMHTMLBadTable_001 1167 0.71 1.15 0.63 165 HELO_NODOT 1166 1.39 1.14 1.43 166 HELO_NO_DOMAIN 1162 1.39 1.14 1.43 167 XMBody_17 1153 0.86 1.13 0.82 168 XM_H_PHPOS_M 1145 0.33 1.12 0.19 169 XMBody_78 1144 0.69 1.12 0.61 170 HTML_IMAGE_ONLY_12 1094 0.32 1.07 0.18 171 ADMITS_SPAM 1078 0.21 1.06 0.05 172 XM_OfRef7 1074 0.30 1.05 0.16 173 SUBJECT_DIET 1070 0.17 1.05 0.01 174 RELAYCOUNTRY_AT 1069 0.30 1.05 0.16 175 XM_UB99 1065 0.17 1.05 0.00 176 XMSubject_09 1064 0.18 1.04 0.02 177 URI_TRY_3LD 1063 1.62 1.04 1.72 178 TR_XM_DK_Bayes2 1037 12.31 1.02 14.39 179 TR_LOTS_OF_MONEY3 1028 0.53 1.01 0.44 180 URIBL_BLACK 1019 0.17 1.00 0.02 181 DKIM_ADSP_CUSTOM_MED 1013 1.14 0.99 1.16 182 REMOVE_BEFORE_LINK 991 0.48 0.97 0.39 183 XM_ProductURIs 991 0.97 0.97 0.96 184 URIBL_SBL_A 979 0.52 0.96 0.43 185 MONEY_FORM_SHORT 978 0.16 0.96 0.01 186 XMSexyCombo_04 966 0.56 0.95 0.49 187 T_TooManySym_02 959 1.97 0.94 2.16 188 XM_H_Long_From02 947 1.31 0.93 1.39 189 UNPARSEABLE_RELAY 946 1.99 0.93 2.18 190 RELAYCOUNTRY_HK 939 0.16 0.92 0.01 191 MIME_HEADER_CTYPE_ONLY 939 0.21 0.92 0.08 192 XM_UB60 933 0.19 0.92 0.06 193 XMSlimDrugH 917 0.44 0.90 0.35 194 RELAYCOUNTRY_DE 915 0.50 0.90 0.43 195 TR_XM_SEO3 894 0.31 0.88 0.20 196 FORGED_GMAIL_RCVD 877 0.66 0.86 0.62 197 RELAYCOUNTRY_NG 870 0.13 0.85 0.00 198 TooManyTo_002 867 1.91 0.85 2.11 199 NML_ADSP_CUSTOM_MED 864 0.88 0.85 0.88 200 XM_H_Undi_Recip 845 0.30 0.83 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 484453 88.67 94.27 87.64 2 DKIM_SIGNED 427621 77.16 76.06 77.36 3 XM_DK_Pass 421313 75.72 73.05 76.22 4 DKIM_VALID 402096 72.07 68.43 72.74 5 XM_B_Unicode 394314 71.20 70.46 71.33 6 DKIM_VALID_AU 299029 53.79 52.14 54.10 7 XMListUnsubscribeExists 298121 56.43 69.96 53.93 8 BAYES_50 296497 53.20 50.83 53.64 9 DCC_CHECK_NEGATIVE 292886 47.72 19.18 52.98 10 DCC_CHECK 247896 50.18 79.14 44.85 11 XM_B_Unicode3 232617 42.70 46.07 42.08 12 T_TM2_M_HEADER_IN_MSG 162403 28.13 21.34 29.38 13 HTML_FONT_LOW_CONTRAST 160202 29.43 31.88 28.98 14 DKIM_VALID_EF 146432 25.91 22.74 26.49 15 LOC_TINY_FONT_1 137163 26.18 33.62 24.81 16 XMSubLong 127797 23.64 26.45 23.12 17 FVGT_m_MULTI_ODD 123197 22.89 26.19 22.29 18 MIME_HTML_ONLY 121614 24.17 35.92 22.00 19 BAYES_00 116872 18.26 2.60 21.14 20 T_KAM_HTML_FONT_INVALID 104730 18.87 18.44 18.95 21 MultiRelay 103327 19.10 21.31 18.69 22 TR_XM_DK_Bayes 96673 15.02 1.62 17.49 23 TR_XM_DK_Bayes1 92446 14.35 1.44 16.72 24 ALL_TRUSTED 81518 12.81 2.28 14.75 25 XM_Body_Dirty_Words 80577 15.64 21.41 14.58 26 TR_XM_DK_Bayes2 79534 12.31 1.02 14.39 27 XM_Multi_Part_URI 65920 12.78 17.44 11.93 28 RCVD_IN_RP_SAFE 56848 8.89 1.36 10.28 29 XM_Evil_Numbers_Gen 54997 10.77 15.25 9.95 30 LOTS_OF_MONEY 53388 10.26 13.55 9.66 31 HTML_IMAGE_RATIO_02 49908 10.18 16.46 9.03 32 RCVD_IN_RP_CERTIFIED 48317 7.48 0.62 8.74 33 LotsOfNums_01 46322 8.35 8.16 8.38 34 T_XMDrugObfuBody_14 44438 8.15 8.73 8.04 35 TooManyTo_001 42915 7.62 6.87 7.76 36 FSL_BULK_SIG 42491 8.84 15.07 7.69 37 XM_DKIMWhitelistDomains 41292 6.31 0.03 7.47 38 HTML_IMAGE_RATIO_04 39973 7.12 6.53 7.23 39 RCVD_IN_MSPIKE_H2 38508 6.72 5.40 6.97 40 XM_SendGrid 37499 6.22 3.15 6.78 41 BAYES_40 36482 6.48 5.82 6.60 42 XM_H_Long_From01 35293 6.77 8.89 6.38 43 MIME_QP_LONG_LINE 33839 5.82 4.19 6.12 44 XM_DK_Undo_02 31761 9.88 32.34 5.75 45 T_TooManySym_01 31484 5.25 2.83 5.70 46 XM_B_Phish_Phrases 30771 5.63 6.00 5.57 47 RELAYCOUNTRY_META 30293 8.29 23.52 5.48 48 RCVD_IN_MSPIKE_WL 29463 4.87 2.38 5.33 49 RCVD_IN_IADB_LISTED 29318 4.77 1.87 5.30 50 BAYES_20 28387 5.02 4.39 5.14 51 XMSexyCombo_05 27194 5.87 11.03 4.92 52 DKIM_INVALID 25525 5.09 7.64 4.62 53 RCVD_IN_IADB_SPF 25310 4.13 1.72 4.58 54 RCVD_IN_MSPIKE_H3 25047 4.17 2.20 4.53 55 BOTNET_IPINHOSTNAME 24933 6.75 18.91 4.51 56 T_REMOTE_IMAGE 22134 4.39 6.46 4.00 57 RCVD_IN_IADB_SENDERID 22104 3.63 1.65 4.00 58 BAYES_60 21940 4.05 4.52 3.97 59 RCVD_IN_IADB_DK 21723 3.58 1.66 3.93 60 XM_PDF 21695 3.44 0.82 3.92 61 XMSubMetaSx_00 21559 4.52 7.91 3.90 62 XMNumbers 21445 4.18 5.78 3.88 63 MPART_ALT_DIFF 21189 4.67 9.21 3.83 64 FROM_EXCESS_BASE64 20648 3.55 2.55 3.74 65 XMStrtUSub 20061 3.59 3.39 3.63 66 TR_XM_DK_SendGrid 19921 3.27 1.44 3.60 67 XM_B_SpammyTLD 19878 3.60 3.62 3.60 68 RCVD_IN_IADB_VOUCHED 19246 3.04 0.67 3.48 69 HTML_IMAGE_RATIO_06 19243 3.71 4.94 3.48 70 IN_ZIMBRA_NJ_WHITELIST 19240 2.94 0.02 3.48 71 XM_DIRTYINTL 19168 3.84 5.89 3.47 72 BAYES_05 17692 3.05 2.24 3.20 73 XM_UncommonTLD01 17039 4.41 11.62 3.08 74 BAYES_99 14695 5.49 20.83 2.66 75 ANY_BOUNCE_MESSAGE 14147 2.25 0.58 2.56 76 BOUNCE_MESSAGE 14139 2.25 0.58 2.56 77 TO_MALFORMED 13910 2.13 0.00 2.52 78 HTML_IMAGE_RATIO_08 12962 2.54 3.62 2.34 79 MAILING_LIST_MULTI 12540 2.20 1.84 2.27 80 MIME_HTML_MOSTLY 12402 2.81 5.85 2.24 81 MIME_HTML_ONLY_MULTI 12327 2.73 5.44 2.23 82 RCVD_IN_IADB_OPTIN 12124 1.93 0.49 2.19 83 UNPARSEABLE_RELAY 12057 1.99 0.93 2.18 84 HTML_MIME_NO_HTML_TAG 12055 2.94 7.07 2.18 85 T_TooManySym_02 11913 1.97 0.94 2.16 86 SUBJ_ALL_CAPS 11911 2.30 3.12 2.15 87 BAYES_999 11787 4.27 15.89 2.13 88 XM_SPF_SoftFail 11783 2.78 6.29 2.13 89 BOTNET 11739 5.54 24.06 2.12 90 BAYES_80 11705 2.67 5.67 2.12 91 TooManyTo_002 11650 1.91 0.85 2.11 92 XM_CamelCaseFrm001 11099 2.10 2.57 2.01 93 TVD_RCVD_IP 10900 1.73 0.39 1.97 94 KHOP_HELO_FCRDNS 10844 2.24 3.77 1.96 95 URI_HEX 10831 2.19 3.45 1.96 96 TM2_M_URI_OPT_OUT 10253 2.21 4.16 1.85 97 XM_DK_Undo_01 10147 1.81 1.69 1.84 98 TR_Symld_Words 10032 1.77 1.54 1.81 99 URI_TRY_3LD 9535 1.62 1.04 1.72 100 XMDiploma_00 9434 1.89 2.88 1.71 101 UNTRUSTED_Relay 9030 3.54 13.91 1.63 102 XMPhish11 8704 1.62 1.84 1.57 103 T_XMDrugObfuBody_08 8693 1.68 2.28 1.57 104 TM2_M_VERY_LONG_WORD 8634 1.63 1.99 1.56 105 XMStockSpam_06 8542 1.54 1.48 1.55 106 CK_HELO_DYNAMIC_SPLIT_IP 8451 1.38 0.59 1.53 107 HELO_DYNAMIC_IPADDR2 8413 1.30 0.08 1.52 108 RELAYCOUNTRY_CA 8385 1.99 4.56 1.52 109 IN_HORDE_ADDRESS_BOOK 8078 1.24 0.03 1.46 110 TR_MetaPhish_Combo_01 7996 1.32 0.62 1.45 111 HELO_NODOT 7919 1.39 1.14 1.43 112 HELO_NO_DOMAIN 7918 1.39 1.14 1.43 113 TooManyTo_003 7907 1.32 0.71 1.43 114 XM_H_Long_From02 7660 1.31 0.93 1.39 115 XMGappySubj_01 7572 1.24 0.53 1.37 116 INVALID_MSGID 7533 1.19 0.23 1.36 117 XM_OfRef6 7166 1.48 2.45 1.30 118 TR_DCC_Bayes_99 7098 3.65 16.49 1.28 119 XMCapTrack 6940 1.12 0.36 1.26 120 BAYES_95 6768 1.47 2.79 1.22 121 XMGenDplmaNmb 6732 1.32 1.85 1.22 122 USER_IN_DEF_DKIM_WL 6660 1.02 0.02 1.20 123 RELAYCOUNTRY_GB 6568 1.56 3.56 1.19 124 DKIM_ADSP_CUSTOM_MED 6420 1.14 0.99 1.16 125 XMHTML_After_End 6125 1.12 1.16 1.11 126 NO_DNS_FOR_FROM 6003 1.38 2.98 1.09 127 XM_GoogleGroups 5932 0.99 0.54 1.07 128 TooManyTo_004 5922 1.00 0.59 1.07 129 T_XMDrugObfuBody_00 5662 1.19 2.11 1.02 130 LOW_PRICE 5541 0.95 0.66 1.00 131 XMBdyGiftCard01 5415 1.26 2.75 0.98 132 TR_XM_RelayPhish 5386 1.08 1.65 0.97 133 XM_ProductURIs 5329 0.97 0.97 0.96 134 RCVD_IN_BL_SPAMCOP_NET 5246 1.53 4.66 0.95 135 NML_ADSP_CUSTOM_MED 4877 0.88 0.85 0.88 136 XM_UB50 4823 2.08 8.63 0.87 137 XMSexyCombo_01 4759 1.07 2.24 0.86 138 TooManyTo_005 4736 0.80 0.52 0.86 139 T_FILL_THIS_FORM_SHORT 4666 0.96 1.60 0.84 140 XMSubMetaSxObfu_03 4665 0.95 1.55 0.84 141 XMBody_17 4506 0.86 1.13 0.82 142 SpammyFromTLD_01 4491 1.08 2.53 0.81 143 XMMoneyMeta_00 4157 0.84 1.29 0.75 144 HTML_TAG_BALANCE_BODY 4126 0.73 0.61 0.75 145 XM_SPF_Unknown 3999 0.71 0.65 0.72 146 T_XMHurry_00 3905 0.81 1.37 0.71 147 DKIM_ADSP_NXDOMAIN 3892 1.03 2.82 0.70 148 XMSubMetaI_00 3680 0.89 2.10 0.67 149 XM_H_PHPMailer 3675 0.78 1.37 0.66 150 TR_XM_PHPForged 3633 0.99 2.80 0.66 151 TM2_M_A_HREF_HREF 3626 0.87 2.00 0.66 152 HTML_FONT_FACE_BAD 3541 0.64 0.67 0.64 153 T_MONEY_PERCENT 3532 0.76 1.39 0.64 154 TR_LOTS_OF_MONEY2 3532 0.76 1.39 0.64 155 XMHTMLBadTable_001 3496 0.71 1.15 0.63 156 RELAYCOUNTRY_AU 3464 0.60 0.45 0.63 157 FORGED_GMAIL_RCVD 3415 0.66 0.86 0.62 158 FROM_GOV_DKIM_AU 3401 0.54 0.13 0.62 159 XMBrknScrpt_02 3399 0.74 1.45 0.61 160 XMBody_95 3372 0.53 0.09 0.61 161 XMBody_78 3360 0.69 1.12 0.61 162 XMGappySubj_02 3191 0.52 0.19 0.58 163 TR_XM_PHPDW 3179 0.92 2.81 0.58 164 XMPhish30 3134 0.70 1.45 0.57 165 HTTPS_HTTP_MISMATCH 3065 0.57 0.66 0.55 166 RCVD_IN_MSPIKE_H5 3058 0.49 0.12 0.55 167 TR_XM_FormFill2 3049 0.90 2.80 0.55 168 XM_H_PHPOS 3029 0.90 2.79 0.55 169 XMNoVowels 3022 0.55 0.54 0.55 170 T_OBFU_PDF_ATTACH 3002 0.49 0.23 0.54 171 T_Symld_Words_02 2924 0.70 1.66 0.53 172 FILL_THIS_FORM 2919 0.53 0.53 0.53 173 XM_ShortIntro_01 2857 0.50 0.38 0.52 174 URI_NOVOWEL 2752 0.55 0.81 0.50 175 XM_B_REG_HTML 2743 0.46 0.25 0.50 176 XMSexyCombo_04 2698 0.56 0.95 0.49 177 PLING_QUERY 2668 0.49 0.55 0.48 178 XMLngstWrd_00 2644 0.46 0.35 0.48 179 FILL_THIS_FORM_LONG 2532 0.45 0.43 0.46 180 TM2_M_BODY_EMPTY 2476 0.40 0.13 0.45 181 XMLngstWrd_01 2448 0.42 0.32 0.44 182 TR_LOTS_OF_MONEY3 2445 0.53 1.01 0.44 183 SpammyFromTLD_02 2428 1.15 4.98 0.44 184 T_TooManySym_03 2416 0.41 0.27 0.44 185 USER_IN_WHITELIST 2415 0.37 0.00 0.44 186 AC_DIV_BONANZA 2413 0.39 0.15 0.44 187 URIBL_SBL_A 2401 0.52 0.96 0.43 188 RELAYCOUNTRY_DE 2352 0.50 0.90 0.43 189 FILL_THIS_FORM_LOAN 2332 0.39 0.20 0.42 190 FROM_GOV_SPOOF 2321 0.40 0.29 0.42 191 XM_Body_Obfu01 2298 0.45 0.63 0.42 192 XM_B_COPY_HTML 2287 0.43 0.51 0.41 193 XM_RXBody 2254 0.40 0.37 0.41 194 MISSING_HEADERS 2230 0.61 1.72 0.40 195 HTML_IMAGE_ONLY_32 2228 0.39 0.35 0.40 196 GAPPY_SUBJECT 2216 0.36 0.16 0.40 197 REMOVE_BEFORE_LINK 2129 0.48 0.97 0.39 198 SHORT_HELO_AND_INLINE_IMAGE 2089 0.34 0.15 0.38 199 XMSubMetaSxObfu_02 2047 0.41 0.65 0.37 200 XMDateMe_00 2032 0.36 0.32 0.37 ----------------------------------------------------------------------