Email: 376974 Autolearn: 0 AvgScore: 1.45 AvgScanTime: 1.93 sec Spam: 77408 Autolearn: 0 AvgScore: 12.59 AvgScanTime: 3.34 sec Ham: 299566 Autolearn: 0 AvgScore: -1.42 AvgScanTime: 1.56 sec Time Spent Running SA: 201.92 hours Time Spent Processing Spam: 71.74 hours Time Spent Processing Ham: 130.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 70999 88.02 91.72 87.06 2 DCC_CHECK 62375 54.92 80.58 48.29 3 DKIM_SIGNED 61798 80.13 79.83 80.20 4 XM_DK_Pass 59577 78.72 76.96 79.17 5 RELAYCOUNTRY_US 57589 80.78 74.40 82.43 6 XM_B_Unicode 53931 71.08 69.67 71.44 7 XMListUnsubscribeExists 52632 58.84 67.99 56.47 8 DKIM_VALID 50200 73.29 64.85 75.47 9 DKIM_VALID_AU 38269 57.11 49.44 59.09 10 BAYES_50 36608 52.02 47.29 53.24 11 XM_DK_Undo_02 32811 15.85 42.39 8.99 12 XM_B_Unicode3 32641 42.30 42.17 42.33 13 MIME_HTML_ONLY 26255 24.48 33.92 22.05 14 LOC_TINY_FONT_1 26031 29.25 33.63 28.12 15 HTML_FONT_LOW_CONTRAST 23566 31.23 30.44 31.43 16 FVGT_m_MULTI_ODD 22514 23.77 29.08 22.40 17 RELAYCOUNTRY_META 21280 10.08 27.49 5.58 18 DKIM_VALID_EF 20174 27.38 26.06 27.72 19 BAYES_99 20099 8.90 25.97 4.50 20 BOTNET 18547 7.31 23.96 3.01 21 T_KAM_HTML_FONT_INVALID 17398 19.44 22.48 18.65 22 XM_UncommonTLD01 17286 7.83 22.33 4.08 23 XMSubLong 17176 20.54 22.19 20.11 24 XM_Body_Dirty_Words 15960 14.31 20.62 12.68 25 BAYES_999 15698 7.02 20.28 3.59 26 TR_DCC_Bayes_99 15242 6.00 19.69 2.47 27 T_TM2_M_HEADER_IN_MSG 15209 22.31 19.65 22.99 28 DCC_CHECK_NEGATIVE 14246 43.83 18.40 50.40 29 UNTRUSTED_Relay 13948 5.01 18.02 1.65 30 BOTNET_IPINHOSTNAME 13939 8.47 18.01 6.01 31 XM_Multi_Part_URI 12560 14.05 16.23 13.49 32 FSL_BULK_SIG 11599 10.02 14.98 8.74 33 DKIM_INVALID 11598 6.83 14.98 4.73 34 HTML_IMAGE_RATIO_02 11354 9.88 14.67 8.64 35 LOTS_OF_MONEY 9212 9.04 11.90 8.30 36 XMSexyCombo_05 8900 5.38 11.50 3.80 37 XM_UB50 8846 3.16 11.43 1.02 38 XM_B_Unsub 8612 10.40 11.13 10.21 39 FROM_SUSPICIOUS_NTLD 8434 2.39 10.90 0.19 40 FROM_SUSPICIOUS_NTLD_FP 8409 2.38 10.86 0.18 41 LotsOfNums_01 7872 8.65 10.17 8.25 42 XM_B_SpammyTLD 7167 3.61 9.26 2.15 43 NO_DNS_FOR_FROM 7109 3.83 9.18 2.45 44 PDS_OTHER_BAD_TLD 6887 2.06 8.90 0.30 45 RCVD_IN_MSPIKE_H2 6788 13.12 8.77 14.24 46 XM_B_Phish_Phrases 6719 8.10 8.68 7.95 47 XM_Evil_Numbers_Gen 6537 9.46 8.44 9.72 48 TooManyTo_001 6459 8.16 8.34 8.11 49 SpammyFromTLD_02 5786 1.93 7.47 0.50 50 XM_H_Long_From01 5769 6.38 7.45 6.11 51 BAYES_60 5730 6.41 7.40 6.15 52 KHOP_HELO_FCRDNS 5722 2.54 7.39 1.29 53 HTML_IMAGE_RATIO_04 5433 6.06 7.02 5.81 54 MPART_ALT_DIFF 5382 5.83 6.95 5.54 55 RCVD_IN_MSPIKE_BL 5334 2.57 6.89 1.45 56 RCVD_IN_MSPIKE_L3 5212 2.47 6.73 1.37 57 RELAYCOUNTRY_CA 4943 3.14 6.39 2.30 58 BAYES_80 4898 3.89 6.33 3.26 59 XM_SPF_SoftFail 4852 2.34 6.27 1.32 60 XMSubMetaSx_00 4609 3.89 5.95 3.35 61 UNPARSEABLE_RELAY 4500 9.31 5.81 10.21 62 MIME_HTML_MOSTLY 4441 3.33 5.74 2.71 63 XMNumbers 4324 3.95 5.59 3.53 64 RELAYCOUNTRY_FR 3987 1.28 5.15 0.28 65 LongTLD 3909 1.36 5.05 0.41 66 DATE_IN_PAST_03_06 3909 1.12 5.05 0.11 67 XM_CamelCaseFrm001 3814 2.85 4.93 2.31 68 XM_SPF_Unknown 3716 1.23 4.80 0.30 69 RCVD_IN_BL_SPAMCOP_NET 3675 2.38 4.75 1.77 70 SUBJ_ALL_CAPS 3521 2.11 4.55 1.49 71 T_REMOTE_IMAGE 3491 4.00 4.51 3.87 72 XM_SendGrid 3328 6.36 4.30 6.90 73 HTML_MIME_NO_HTML_TAG 3279 2.46 4.24 2.00 74 MIME_QP_LONG_LINE 2943 5.03 3.80 5.35 75 FROM_EXCESS_BASE64 2791 3.85 3.61 3.91 76 BAYES_95 2634 2.25 3.40 1.96 77 XM_DIRTYINTL 2615 1.23 3.38 0.68 78 RDNS_DYNAMIC 2598 1.05 3.36 0.45 79 XMLngstWrd_00 2572 1.18 3.32 0.63 80 XMLngstWrd_01 2554 1.13 3.30 0.57 81 BAYES_40 2539 4.80 3.28 5.20 82 RCVD_IN_RP_RNBL 2524 0.73 3.26 0.08 83 XMLngstWrd_02 2440 1.03 3.15 0.48 84 RELAYCOUNTRY_IN 2433 0.69 3.14 0.06 85 DKIM_ADSP_NXDOMAIN 2425 0.87 3.13 0.28 86 XMLngstWrd_03 2411 0.95 3.11 0.39 87 XMStrtUSub 2365 4.66 3.06 5.07 88 XMLngstWrd_04 2355 0.89 3.04 0.33 89 MIME_HTML_ONLY_MULTI 2343 2.83 3.03 2.78 90 XM_H_TOP 2329 0.62 3.01 0.00 91 XM_B_Crypto 2309 0.72 2.98 0.13 92 MONERO_EXTORT_01 2283 0.69 2.95 0.11 93 T_XMDrugObfuBody_08 2230 1.55 2.88 1.21 94 FROM_MISSP_REPLYTO 2188 0.64 2.83 0.07 95 TR_XM_Crypto2 2187 0.64 2.83 0.08 96 TM2_M_URI_OPT_OUT 2179 2.64 2.81 2.59 97 HTML_IMAGE_RATIO_06 2177 3.08 2.81 3.15 98 HEXHASH_WORD 2161 0.57 2.79 0.00 99 FROM_MISSP_DYNIP 2159 0.57 2.79 0.00 100 HTML_SHORT_LINK_IMG_1 2151 0.59 2.78 0.03 101 XM_OfRef6 2141 1.53 2.77 1.22 102 RELAYCOUNTRY_DE 2079 0.98 2.69 0.54 103 RCVD_IN_MSPIKE_WL 2076 8.01 2.68 9.38 104 RCVD_IN_MSPIKE_H3 2076 8.01 2.68 9.38 105 BAYES_20 2064 3.76 2.67 4.05 106 XM_UB60 2042 0.59 2.64 0.06 107 RCVD_IN_RP_SAFE 2022 9.16 2.61 10.86 108 HDRS_MISSP 1962 0.53 2.53 0.01 109 SHORT_IMG_SUSP_NTLD 1948 0.52 2.52 0.00 110 XM_B_Unsub2 1934 1.77 2.50 1.58 111 HTML_IMAGE_RATIO_08 1918 2.23 2.48 2.17 112 URIBL_SBL_A 1883 0.62 2.43 0.15 113 T_TooManySym_01 1849 4.60 2.39 5.17 114 XM_URI_RBL 1802 0.63 2.33 0.19 115 T_Symld_Words_02 1796 0.93 2.32 0.57 116 XMBody_17 1794 1.06 2.32 0.73 117 SpammyFromTLD_01 1712 0.88 2.21 0.54 118 TR_XM_INV_DKIM 1702 0.54 2.20 0.11 119 NO_FM_NAME_IP_HOSTN 1693 0.45 2.19 0.00 120 DATE_IN_PAST_06_12 1691 0.68 2.18 0.29 121 BAYES_00 1618 15.52 2.09 18.99 122 URI_HEX 1598 1.42 2.06 1.25 123 XMSexyCombo_01 1593 0.93 2.06 0.64 124 RCVD_IN_RP_CERTIFIED 1534 8.18 1.98 9.79 125 XMSubMetaI_00 1530 0.90 1.98 0.62 126 HTML_IMAGE_ONLY_04 1510 0.45 1.95 0.06 127 BOTNET_NORDNS 1508 0.43 1.95 0.04 128 XMNoVowels 1499 1.48 1.94 1.37 129 XMDiploma_00 1499 1.66 1.94 1.59 130 RCVD_IN_PSBL 1485 0.45 1.92 0.07 131 DKIM_ADSP_CUSTOM_MED 1485 1.33 1.92 1.18 132 SUBJECT_NEEDS_ENCODING 1452 0.48 1.88 0.12 133 TR_XM_MaxBayes 1450 0.39 1.87 0.01 134 SUBJ_ILLEGAL_CHARS 1446 0.48 1.87 0.12 135 T_XMHurry_00 1445 0.73 1.87 0.44 136 TR_XM_PHPDW 1427 0.70 1.84 0.41 137 TR_XM_DK_Bayes 1398 12.39 1.81 15.13 138 TR_Mismatch_TLD_02 1380 0.43 1.78 0.08 139 TR_Mismatch_TLD_01 1379 0.60 1.78 0.30 140 TR_XM_PHPForged 1377 0.67 1.78 0.39 141 TR_XM_FormFill2 1359 0.67 1.76 0.39 142 FORGED_GMAIL_RCVD 1358 0.84 1.75 0.60 143 XM_H_PHPOS 1350 0.66 1.74 0.38 144 TR_Symld_Words 1347 1.18 1.74 1.03 145 XMHTML_After_End 1340 0.73 1.73 0.47 146 TR_XM_RelayPhish 1328 0.58 1.72 0.29 147 TR_LOTS_OF_MONEY3 1279 0.85 1.65 0.65 148 TM2_M_VERY_LONG_WORD 1274 1.60 1.65 1.59 149 NML_ADSP_CUSTOM_MED 1257 0.93 1.62 0.75 150 DIET_1 1249 0.94 1.61 0.77 151 ALL_TRUSTED 1234 11.05 1.59 13.49 152 T_XMDrugObfuBody_14 1225 1.49 1.58 1.46 153 BAYES_05 1213 2.44 1.57 2.67 154 URI_TRY_3LD 1185 1.87 1.53 1.95 155 T_XMDrugObfuBody_00 1179 0.89 1.52 0.73 156 TR_MetaPhish_Combo_01 1139 1.73 1.47 1.80 157 XM_H_Long_From02 1129 1.20 1.46 1.13 158 RCVD_IN_IADB_LISTED 1129 3.69 1.46 4.27 159 XMStockSpam_06 1113 1.02 1.44 0.91 160 DATE_IN_PAST_12_24 1097 0.39 1.42 0.12 161 XM_DK_Undo_01 1086 1.57 1.40 1.62 162 XM_ProductURIs 1064 1.20 1.37 1.15 163 MPART_ALT_DIFF_COUNT 1062 0.79 1.37 0.64 164 RCVD_IN_IADB_SPF 1052 3.20 1.36 3.68 165 RCVD_IN_IADB_SENDERID 1038 2.87 1.34 3.26 166 RCVD_IN_IADB_DK 1035 2.80 1.34 3.18 167 TR_XM_DK_SendGrid 1019 3.08 1.32 3.54 168 NORDNS_LOW_CONTRAST 1012 0.29 1.31 0.03 169 MAILING_LIST_MULTI 976 2.20 1.26 2.45 170 HTML_TITLE_SUBJ_DIFF 964 0.31 1.25 0.07 171 XM_H_PHPMailer 947 0.65 1.22 0.50 172 XMGenDplmaNmb 939 0.92 1.21 0.85 173 FVGT_m_MULTI_ODD_EMAIL 938 0.27 1.21 0.03 174 XMSexyCombo_04 926 0.42 1.20 0.22 175 PLING_QUERY 915 0.74 1.18 0.62 176 TR_XM_DK_Bayes1 914 11.70 1.18 14.42 177 TR_XM_MaxSPIKE 910 0.28 1.18 0.05 178 XMHTMLBadTable_001 888 0.59 1.15 0.44 179 XMPhish30 871 0.55 1.13 0.40 180 RELAYCOUNTRY_GB 855 0.83 1.10 0.76 181 URIBL_BLACK 839 0.23 1.08 0.01 182 HTML_IMAGE_ONLY_08 832 0.32 1.07 0.13 183 XMBdyGiftCard01 820 1.52 1.06 1.64 184 XMPhish08 813 0.98 1.05 0.96 185 XM_OfRef7 813 0.27 1.05 0.07 186 DEAR_FRIEND 804 0.27 1.04 0.08 187 T_TooManySym_02 798 2.43 1.03 2.80 188 RELAYCOUNTRY_CN 795 0.25 1.03 0.05 189 URIBL_DBL_SPAM 782 0.23 1.01 0.03 190 TVD_SPACE_RATIO 769 0.49 0.99 0.35 191 XMBrknScrpt_02 768 0.81 0.99 0.76 192 HDRS_LCASE_IMGONLY 765 0.21 0.99 0.01 193 TR_XM_DK_Bayes2 742 10.84 0.96 13.39 194 HELO_MISC_IP 737 0.22 0.95 0.03 195 RELAYCOUNTRY_AT 736 0.34 0.95 0.18 196 XMPhish14 732 0.54 0.95 0.43 197 XM_H_PHPOS_M 730 0.35 0.94 0.19 198 XM_UB99 728 0.20 0.94 0.01 199 RELAYCOUNTRY_RU 704 0.21 0.91 0.03 200 HK_RANDOM_REPLYTO 679 0.39 0.88 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 260803 88.02 91.72 87.06 2 RELAYCOUNTRY_US 246929 80.78 74.40 82.43 3 DKIM_SIGNED 240256 80.13 79.83 80.20 4 XM_DK_Pass 237174 78.72 76.96 79.17 5 DKIM_VALID 226095 73.29 64.85 75.47 6 XM_B_Unicode 214012 71.08 69.67 71.44 7 DKIM_VALID_AU 177010 57.11 49.44 59.09 8 XMListUnsubscribeExists 169168 58.84 67.99 56.47 9 BAYES_50 159490 52.02 47.29 53.24 10 DCC_CHECK_NEGATIVE 150986 43.83 18.40 50.40 11 DCC_CHECK 144661 54.92 80.58 48.29 12 XM_B_Unicode3 126819 42.30 42.17 42.33 13 HTML_FONT_LOW_CONTRAST 94165 31.23 30.44 31.43 14 LOC_TINY_FONT_1 84224 29.25 33.63 28.12 15 DKIM_VALID_EF 83032 27.38 26.06 27.72 16 T_TM2_M_HEADER_IN_MSG 68884 22.31 19.65 22.99 17 FVGT_m_MULTI_ODD 67100 23.77 29.08 22.40 18 MIME_HTML_ONLY 66046 24.48 33.92 22.05 19 XMSubLong 60240 20.54 22.19 20.11 20 BAYES_00 56881 15.52 2.09 18.99 21 T_KAM_HTML_FONT_INVALID 55878 19.44 22.48 18.65 22 TR_XM_DK_Bayes 45322 12.39 1.81 15.13 23 TR_XM_DK_Bayes1 43203 11.70 1.18 14.42 24 RCVD_IN_MSPIKE_H2 42662 13.12 8.77 14.24 25 ALL_TRUSTED 40419 11.05 1.59 13.49 26 XM_Multi_Part_URI 40410 14.05 16.23 13.49 27 TR_XM_DK_Bayes2 40115 10.84 0.96 13.39 28 XM_Body_Dirty_Words 37997 14.31 20.62 12.68 29 RCVD_IN_RP_SAFE 32527 9.16 2.61 10.86 30 UNPARSEABLE_RELAY 30595 9.31 5.81 10.21 31 XM_B_Unsub 30578 10.40 11.13 10.21 32 XM_DKIMWhitelistDomains 30490 8.09 0.03 10.18 33 RCVD_IN_RP_CERTIFIED 29316 8.18 1.98 9.79 34 XM_Evil_Numbers_Gen 29118 9.46 8.44 9.72 35 RCVD_IN_MSPIKE_WL 28101 8.01 2.68 9.38 36 RCVD_IN_MSPIKE_H3 28101 8.01 2.68 9.38 37 XM_DK_Undo_02 26930 15.85 42.39 8.99 38 FSL_BULK_SIG 26191 10.02 14.98 8.74 39 HTML_IMAGE_RATIO_02 25878 9.88 14.67 8.64 40 LOTS_OF_MONEY 24878 9.04 11.90 8.30 41 LotsOfNums_01 24728 8.65 10.17 8.25 42 TooManyTo_001 24292 8.16 8.34 8.11 43 XM_B_Phish_Phrases 23810 8.10 8.68 7.95 44 XM_SendGrid 20659 6.36 4.30 6.90 45 BAYES_60 18423 6.41 7.40 6.15 46 XM_H_Long_From01 18290 6.38 7.45 6.11 47 BOTNET_IPINHOSTNAME 18001 8.47 18.01 6.01 48 HTML_IMAGE_RATIO_04 17403 6.06 7.02 5.81 49 RELAYCOUNTRY_META 16715 10.08 27.49 5.58 50 MPART_ALT_DIFF 16605 5.83 6.95 5.54 51 MIME_QP_LONG_LINE 16026 5.03 3.80 5.35 52 BAYES_40 15567 4.80 3.28 5.20 53 T_TooManySym_01 15481 4.60 2.39 5.17 54 XMStrtUSub 15190 4.66 3.06 5.07 55 DKIM_INVALID 14161 6.83 14.98 4.73 56 BAYES_99 13466 8.90 25.97 4.50 57 RCVD_IN_IADB_LISTED 12784 3.69 1.46 4.27 58 XM_UncommonTLD01 12228 7.83 22.33 4.08 59 BAYES_20 12120 3.76 2.67 4.05 60 FROM_EXCESS_BASE64 11725 3.85 3.61 3.91 61 T_REMOTE_IMAGE 11605 4.00 4.51 3.87 62 XMSexyCombo_05 11397 5.38 11.50 3.80 63 RCVD_IN_IADB_SPF 11023 3.20 1.36 3.68 64 BAYES_999 10754 7.02 20.28 3.59 65 TR_XM_DK_SendGrid 10591 3.08 1.32 3.54 66 XMNumbers 10584 3.95 5.59 3.53 67 XMSubMetaSx_00 10038 3.89 5.95 3.35 68 RCVD_IN_IADB_SENDERID 9772 2.87 1.34 3.26 69 BAYES_80 9755 3.89 6.33 3.26 70 IN_ZIMBRA_NJ_WHITELIST 9529 2.53 0.02 3.18 71 RCVD_IN_IADB_DK 9518 2.80 1.34 3.18 72 HTML_IMAGE_RATIO_06 9451 3.08 2.81 3.15 73 BOTNET 9017 7.31 23.96 3.01 74 TVD_RCVD_IP 8758 2.40 0.38 2.92 75 T_TooManySym_02 8375 2.43 1.03 2.80 76 MIME_HTML_ONLY_MULTI 8335 2.83 3.03 2.78 77 INVALID_MSGID 8319 2.28 0.34 2.78 78 RCVD_IN_IADB_VOUCHED 8259 2.28 0.42 2.76 79 MIME_HTML_MOSTLY 8106 3.33 5.74 2.71 80 BAYES_05 8003 2.44 1.57 2.67 81 TM2_M_URI_OPT_OUT 7757 2.64 2.81 2.59 82 XM_PDF 7590 2.14 0.63 2.53 83 ANY_BOUNCE_MESSAGE 7411 2.06 0.46 2.47 84 BOUNCE_MESSAGE 7409 2.06 0.45 2.47 85 TR_DCC_Bayes_99 7385 6.00 19.69 2.47 86 NO_DNS_FOR_FROM 7346 3.83 9.18 2.45 87 CK_HELO_DYNAMIC_SPLIT_IP 7342 2.01 0.31 2.45 88 HELO_DYNAMIC_IPADDR2 7339 1.96 0.05 2.45 89 MAILING_LIST_MULTI 7331 2.20 1.26 2.45 90 TO_MALFORMED 7086 1.89 0.05 2.37 91 XM_CamelCaseFrm001 6913 2.85 4.93 2.31 92 RELAYCOUNTRY_CA 6882 3.14 6.39 2.30 93 HTML_IMAGE_RATIO_08 6496 2.23 2.48 2.17 94 XM_B_SpammyTLD 6432 3.61 9.26 2.15 95 HTML_MIME_NO_HTML_TAG 5989 2.46 4.24 2.00 96 BAYES_95 5858 2.25 3.40 1.96 97 URI_TRY_3LD 5855 1.87 1.53 1.95 98 IN_HORDE_ADDRESS_BOOK 5789 1.59 0.26 1.93 99 XM_H_Trusted_IP 5656 1.50 0.00 1.89 100 TooManyTo_002 5506 1.59 0.62 1.84 101 TR_MetaPhish_Combo_01 5396 1.73 1.47 1.80 102 RCVD_IN_BL_SPAMCOP_NET 5309 2.38 4.75 1.77 103 RCVD_IN_IADB_OPTIN 5240 1.46 0.32 1.75 104 XM_GoogleGroups 4946 1.40 0.45 1.65 105 UNTRUSTED_Relay 4939 5.01 18.02 1.65 106 XMBdyGiftCard01 4916 1.52 1.06 1.64 107 XM_DK_Undo_01 4843 1.57 1.40 1.62 108 XMDiploma_00 4768 1.66 1.94 1.59 109 TM2_M_VERY_LONG_WORD 4757 1.60 1.65 1.59 110 XM_B_Unsub2 4736 1.77 2.50 1.58 111 XMGappySubj_01 4475 1.21 0.13 1.49 112 USER_IN_DEF_DKIM_WL 4465 1.19 0.00 1.49 113 SUBJ_ALL_CAPS 4449 2.11 4.55 1.49 114 T_XMDrugObfuBody_14 4375 1.49 1.58 1.46 115 RCVD_IN_MSPIKE_BL 4353 2.57 6.89 1.45 116 TooManyTo_003 4260 1.24 0.53 1.42 117 RCVD_IN_MSPIKE_L3 4111 2.47 6.73 1.37 118 XMNoVowels 4097 1.48 1.94 1.37 119 XM_SPF_SoftFail 3951 2.34 6.27 1.32 120 KHOP_HELO_FCRDNS 3865 2.54 7.39 1.29 121 URI_HEX 3747 1.42 2.06 1.25 122 XM_OfRef6 3642 1.53 2.77 1.22 123 T_XMDrugObfuBody_08 3627 1.55 2.88 1.21 124 TooManyTo_004 3624 1.06 0.47 1.21 125 HTML_IMAGE_ONLY_20 3562 1.09 0.72 1.19 126 DKIM_ADSP_CUSTOM_MED 3546 1.33 1.92 1.18 127 XM_ProductURIs 3458 1.20 1.37 1.15 128 XM_H_Long_From02 3380 1.20 1.46 1.13 129 TooManyTo_005 3118 0.91 0.41 1.04 130 TR_Symld_Words 3093 1.18 1.74 1.03 131 XM_UB50 3063 3.16 11.43 1.02 132 XMPhish08 2870 0.98 1.05 0.96 133 XM_B_REG_HTML 2838 0.92 0.82 0.95 134 XMStockSpam_06 2731 1.02 1.44 0.91 135 HTML_FONT_FACE_BAD 2623 0.81 0.54 0.88 136 XMSubNoVowel 2605 0.78 0.46 0.87 137 XMGenDplmaNmb 2548 0.92 1.21 0.85 138 T_TooManySym_03 2395 0.74 0.51 0.80 139 DIET_1 2301 0.94 1.61 0.77 140 HELO_NODOT 2297 0.70 0.46 0.77 141 HELO_NO_DOMAIN 2295 0.70 0.46 0.77 142 RELAYCOUNTRY_GB 2273 0.83 1.10 0.76 143 XMBrknScrpt_02 2272 0.81 0.99 0.76 144 NML_ADSP_CUSTOM_MED 2257 0.93 1.62 0.75 145 XMBody_17 2200 1.06 2.32 0.73 146 T_XMDrugObfuBody_00 2194 0.89 1.52 0.73 147 USER_IN_WHITELIST 2165 0.57 0.00 0.72 148 THIS_AD 2153 0.68 0.54 0.72 149 XM_DIRTYINTL 2029 1.23 3.38 0.68 150 HTTPS_HTTP_MISMATCH 1993 0.69 0.79 0.67 151 TR_LOTS_OF_MONEY3 1938 0.85 1.65 0.65 152 XMCapTrack 1934 0.62 0.53 0.65 153 MPART_ALT_DIFF_COUNT 1917 0.79 1.37 0.64 154 XMSexyCombo_01 1910 0.93 2.06 0.64 155 XMLngstWrd_00 1890 1.18 3.32 0.63 156 PLING_QUERY 1868 0.74 1.18 0.62 157 HTML_TAG_BALANCE_BODY 1856 0.60 0.54 0.62 158 XMSubMetaI_00 1848 0.90 1.98 0.62 159 T_FILL_THIS_FORM_SHORT 1818 0.66 0.86 0.61 160 TR_MSPIKEBAYES00 1807 0.48 0.00 0.60 161 FORGED_GMAIL_RCVD 1797 0.84 1.75 0.60 162 FROM_GOV_DKIM_AU 1760 0.49 0.10 0.59 163 T_Symld_Words_02 1714 0.93 2.32 0.57 164 XMLngstWrd_01 1703 1.13 3.30 0.57 165 SpammyFromTLD_01 1624 0.88 2.21 0.54 166 RELAYCOUNTRY_DE 1607 0.98 2.69 0.54 167 SpammyFromTLD_02 1500 1.93 7.47 0.50 168 XM_H_PHPMailer 1498 0.65 1.22 0.50 169 LOW_PRICE 1462 0.50 0.55 0.49 170 XMLngstWrd_02 1429 1.03 3.15 0.48 171 XMHTML_After_End 1407 0.73 1.73 0.47 172 RDNS_DYNAMIC 1361 1.05 3.36 0.45 173 XMHTMLBadTable_001 1319 0.59 1.15 0.44 174 T_XMHurry_00 1306 0.73 1.87 0.44 175 XMPhish14 1300 0.54 0.95 0.43 176 XM_RXBody 1238 0.46 0.65 0.41 177 XMSubMetaSxObfu_02 1237 0.40 0.33 0.41 178 TR_XM_PHPDW 1229 0.70 1.84 0.41 179 LongTLD 1226 1.36 5.05 0.41 180 XMPhish30 1206 0.55 1.13 0.40 181 XMBSHREFv2 1202 0.38 0.27 0.40 182 MISSING_HEADERS 1188 0.42 0.50 0.40 183 XM_ShortIntro_01 1182 0.39 0.38 0.39 184 XMLngstWrd_03 1167 0.95 3.11 0.39 185 TR_XM_FormFill2 1164 0.67 1.76 0.39 186 TR_XM_PHPForged 1157 0.67 1.78 0.39 187 URI_NOVOWEL 1150 0.42 0.54 0.38 188 XMBody_95 1140 0.31 0.05 0.38 189 XM_H_PHPOS 1136 0.66 1.74 0.38 190 FILL_THIS_FORM 1136 0.46 0.76 0.38 191 BODY_ENHANCEMENT 1088 0.30 0.07 0.36 192 XM_H_SpoofStaff4 1071 0.32 0.17 0.36 193 BASE64_LENGTH_79_INF 1069 0.31 0.15 0.36 194 XMMoneyMeta_00 1066 0.41 0.63 0.36 195 XM_B_COPY_HTML 1064 0.42 0.67 0.36 196 TVD_SPACE_RATIO 1060 0.49 0.99 0.35 197 XMUrgent 1053 0.35 0.37 0.35 198 RELAYCOUNTRY_AU 1025 0.34 0.35 0.34 199 XMRcvdHeader_15 1011 0.27 0.00 0.34 200 SUBJ_DOLLARS 999 0.34 0.35 0.33 ----------------------------------------------------------------------