Email: 638860 Autolearn: 0 AvgScore: 1.14 AvgScanTime: 2.17 sec Spam: 112855 Autolearn: 0 AvgScore: 11.93 AvgScanTime: 4.18 sec Ham: 526005 Autolearn: 0 AvgScore: -1.17 AvgScanTime: 1.74 sec Time Spent Running SA: 384.65 hours Time Spent Processing Spam: 131.08 hours Time Spent Processing Ham: 253.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 106245 90.45 94.14 89.65 2 DKIM_SIGNED 92590 78.32 82.04 77.52 3 XM_DK_Pass 89981 76.81 79.73 76.19 4 RELAYCOUNTRY_US 89438 83.12 79.25 83.96 5 DCC_CHECK 89085 46.79 78.94 39.90 6 XM_B_Unicode 86866 72.96 76.97 72.10 7 XMListUnsubscribeExists 79571 54.62 70.51 51.21 8 DKIM_VALID 74778 70.46 66.26 71.36 9 DKIM_VALID_AU 55532 50.32 49.21 50.55 10 BAYES_50 54506 52.00 48.30 52.79 11 XM_DK_Undo_02 49799 14.00 44.13 7.53 12 XM_B_Unicode3 48782 40.04 43.23 39.36 13 LOC_TINY_FONT_1 39244 24.76 34.77 22.61 14 MIME_HTML_ONLY 38006 22.16 33.68 19.69 15 HTML_FONT_LOW_CONTRAST 35205 27.09 31.19 26.21 16 DKIM_VALID_EF 32046 25.84 28.40 25.29 17 FVGT_m_MULTI_ODD 31647 22.96 28.04 21.87 18 XMSubLong 30725 21.85 27.23 20.69 19 BAYES_99 28813 7.21 25.53 3.28 20 T_KAM_HTML_FONT_INVALID 28091 19.43 24.89 18.26 21 BOTNET 27106 7.22 24.02 3.61 22 RELAYCOUNTRY_META 24447 8.52 21.66 5.70 23 T_TM2_M_HEADER_IN_MSG 22904 26.95 20.30 28.38 24 TR_DCC_Bayes_99 22423 4.87 19.87 1.65 25 XM_Body_Dirty_Words 22353 12.75 19.81 11.24 26 BAYES_999 22153 5.60 19.63 2.59 27 DCC_CHECK_NEGATIVE 21831 51.09 19.34 57.90 28 XM_Multi_Part_URI 19286 12.12 17.09 11.05 29 DKIM_INVALID 17812 7.85 15.78 6.15 30 BOTNET_IPINHOSTNAME 17783 6.79 15.76 4.86 31 XM_UncommonTLD01 17624 5.42 15.62 3.24 32 FSL_BULK_SIG 16020 8.05 14.20 6.73 33 LOTS_OF_MONEY 14595 8.82 12.93 7.94 34 UNTRUSTED_Relay 14537 3.65 12.88 1.67 35 NO_DNS_FOR_FROM 13695 4.76 12.14 3.18 36 XM_B_Unsub 13398 10.33 11.87 10.00 37 XM_B_Phish_Phrases 12975 8.55 11.50 7.91 38 XM_Evil_Numbers_Gen 12840 8.83 11.38 8.29 39 XMSexyCombo_05 12464 4.35 11.04 2.91 40 HTML_IMAGE_RATIO_02 12368 7.56 10.96 6.83 41 LotsOfNums_01 11915 9.17 10.56 8.87 42 RCVD_IN_MSPIKE_H2 10755 14.54 9.53 15.61 43 XM_UB50 9394 2.22 8.32 0.91 44 MPART_ALT_DIFF 8416 5.60 7.46 5.20 45 TooManyTo_001 8187 8.73 7.25 9.04 46 RCVD_IN_MSPIKE_BL 7645 3.05 6.77 2.25 47 XMSubMetaSx_00 7478 3.55 6.63 2.89 48 XM_H_Long_From01 7443 5.75 6.60 5.57 49 XM_SPF_SoftFail 7344 2.67 6.51 1.84 50 BAYES_80 7266 3.44 6.44 2.80 51 RCVD_IN_MSPIKE_L3 7227 2.92 6.40 2.17 52 BAYES_60 6837 5.38 6.06 5.24 53 MIME_QP_LONG_LINE 6652 6.26 5.89 6.34 54 UNPARSEABLE_RELAY 6578 10.09 5.83 11.01 55 HTML_IMAGE_RATIO_04 6569 5.45 5.82 5.37 56 XM_CamelCaseFrm001 6154 2.77 5.45 2.20 57 RCVD_IN_BL_SPAMCOP_NET 5977 2.09 5.30 1.40 58 KHOP_HELO_FCRDNS 5943 2.52 5.27 1.93 59 RELAYCOUNTRY_CA 5706 2.29 5.06 1.70 60 XM_SendGrid 5604 8.15 4.97 8.83 61 MIME_HTML_MOSTLY 5596 2.71 4.96 2.23 62 SpammyFromTLD_02 5365 1.07 4.75 0.28 63 RCVD_IN_RP_RNBL 4868 0.83 4.31 0.08 64 PDS_OTHER_BAD_TLD 4757 0.91 4.22 0.20 65 TM2_M_URI_OPT_OUT 4700 3.22 4.16 3.02 66 T_XMDrugObfuBody_08 4598 2.12 4.07 1.70 67 XMStrtUSub 4537 4.00 4.02 3.99 68 XM_B_SpammyTLD 4495 2.05 3.98 1.64 69 XM_URI_RBL 4265 0.86 3.78 0.23 70 FROM_SUSPICIOUS_NTLD 4028 0.72 3.57 0.11 71 XMNumbers 4006 3.11 3.55 3.01 72 RDNS_DYNAMIC 3991 0.91 3.54 0.34 73 HTML_IMAGE_RATIO_06 3965 3.29 3.51 3.24 74 XM_DIRTYINTL 3919 1.06 3.47 0.54 75 FROM_SUSPICIOUS_NTLD_FP 3913 0.70 3.47 0.10 76 RCVD_IN_MSPIKE_H3 3817 8.37 3.38 9.44 77 RCVD_IN_MSPIKE_WL 3817 8.37 3.38 9.44 78 BAYES_40 3738 5.96 3.31 6.53 79 BAYES_95 3639 1.85 3.22 1.56 80 XMHTML_After_End 3592 1.20 3.18 0.78 81 XM_OfRef6 3585 1.58 3.18 1.23 82 MIME_HTML_ONLY_MULTI 3558 3.19 3.15 3.19 83 DATE_IN_PAST_03_06 3289 0.59 2.91 0.09 84 SpammyFromTLD_01 3274 1.21 2.90 0.84 85 BAYES_00 3263 16.54 2.89 19.47 86 FROM_EXCESS_BASE64 3240 2.84 2.87 2.83 87 XM_B_Unsub2 3196 2.02 2.83 1.84 88 XMNoVowels 3147 2.14 2.79 2.00 89 URIBL_SBL_A 3131 0.58 2.77 0.11 90 T_TooManySym_01 3089 4.04 2.74 4.32 91 BAYES_20 3047 4.72 2.70 5.15 92 RELAYCOUNTRY_FR 2913 0.74 2.58 0.35 93 TR_LOTS_OF_MONEY3 2850 0.91 2.53 0.56 94 XMBody_17 2812 0.93 2.49 0.59 95 LongTLD 2799 0.66 2.48 0.27 96 XMDiploma_00 2756 1.60 2.44 1.42 97 BOTNET_NORDNS 2754 0.89 2.44 0.55 98 HTML_IMAGE_RATIO_08 2690 2.14 2.38 2.09 99 T_REMOTE_IMAGE 2667 5.78 2.36 6.51 100 T_XMHurry_00 2658 0.89 2.36 0.57 101 TR_Mismatch_TLD_02 2580 0.45 2.29 0.06 102 TR_XM_PHPDW 2572 0.77 2.28 0.45 103 URI_HEX 2568 1.62 2.28 1.48 104 DKIM_ADSP_CUSTOM_MED 2561 1.50 2.27 1.33 105 TR_XM_PHPForged 2543 0.76 2.25 0.44 106 TR_XM_FormFill2 2515 0.76 2.23 0.44 107 XM_H_PHPOS 2510 0.75 2.22 0.44 108 TR_XM_DK_Bayes 2503 11.73 2.22 13.77 109 RELAYCOUNTRY_DE 2457 0.95 2.18 0.68 110 FORGED_GMAIL_RCVD 2422 0.85 2.15 0.57 111 TR_XM_INV_DKIM 2416 0.44 2.14 0.07 112 SUBJ_ALL_CAPS 2357 1.60 2.09 1.50 113 NORDNS_LOW_CONTRAST 2338 0.37 2.07 0.00 114 TR_XM_DK_SendGrid 2328 3.19 2.06 3.43 115 T_XMDrugObfuBody_14 2323 1.65 2.06 1.56 116 TR_XM_MaxBayes 2307 0.37 2.04 0.01 117 RCVD_IN_IADB_LISTED 2249 5.11 1.99 5.78 118 TR_XM_RelayPhish 2219 0.58 1.97 0.29 119 NML_ADSP_CUSTOM_MED 2210 1.13 1.96 0.95 120 FROM_MISSP_REPLYTO 2183 0.35 1.93 0.01 121 TM2_M_VERY_LONG_WORD 2161 1.21 1.91 1.05 122 HTML_MIME_NO_HTML_TAG 2153 2.33 1.91 2.42 123 XMSexyCombo_01 2123 0.71 1.88 0.46 124 FROM_MISSP_DYNIP 2085 0.33 1.85 0.00 125 DATE_IN_PAST_06_12 2083 0.41 1.85 0.10 126 RCVD_IN_IADB_SPF 2080 4.46 1.84 5.02 127 XMGenDplmaNmb 2062 1.05 1.83 0.88 128 RCVD_IN_IADB_DK 2025 3.92 1.79 4.38 129 RCVD_IN_IADB_SENDERID 2016 3.96 1.79 4.43 130 NO_FM_NAME_IP_HOSTN 2005 0.31 1.78 0.00 131 RELAYCOUNTRY_GB 1938 1.20 1.72 1.09 132 XMStockSpam_06 1919 0.83 1.70 0.64 133 RCVD_IN_RP_SAFE 1899 6.81 1.68 7.91 134 SUBJECT_NEEDS_ENCODING 1894 0.30 1.68 0.01 135 SUBJ_ILLEGAL_CHARS 1893 0.30 1.68 0.01 136 HEXHASH_WORD 1858 0.29 1.65 0.00 137 BODY_URI_ONLY 1854 0.38 1.64 0.11 138 TR_Symld_Words 1810 1.33 1.60 1.27 139 ALL_TRUSTED 1801 10.39 1.60 12.28 140 TR_XM_DK_Bayes1 1772 10.75 1.57 12.72 141 TR_Mismatch_TLD_01 1770 0.48 1.57 0.24 142 BAYES_05 1726 2.89 1.53 3.18 143 XMSubMetaI_00 1696 0.77 1.50 0.62 144 MAILING_LIST_MULTI 1654 2.59 1.47 2.83 145 T_MONEY_PERCENT 1597 0.54 1.42 0.35 146 TR_LOTS_OF_MONEY2 1597 0.54 1.42 0.35 147 TR_XM_MaxSPIKE 1596 0.33 1.41 0.10 148 RCVD_IN_PSBL 1591 0.29 1.41 0.05 149 XM_ProductURIs 1578 1.13 1.40 1.07 150 TR_XM_DK_Bayes2 1572 9.36 1.39 11.08 151 RELAYCOUNTRY_IN 1550 0.29 1.37 0.06 152 URI_TRY_3LD 1485 1.30 1.32 1.30 153 T_FILL_THIS_FORM_SHORT 1447 0.87 1.28 0.78 154 XMPhish30 1436 0.81 1.27 0.71 155 XMMoneyMeta_00 1399 0.70 1.24 0.58 156 XM_DK_Undo_01 1379 1.76 1.22 1.88 157 FROM_ADDR_WS 1363 0.23 1.21 0.02 158 XM_H_MailChimp 1347 0.45 1.19 0.29 159 RCVD_IN_RP_CERTIFIED 1344 6.22 1.19 7.30 160 ANY_BOUNCE_MESSAGE 1317 2.03 1.17 2.21 161 BOUNCE_MESSAGE 1312 2.02 1.16 2.21 162 XM_H_PHPMailer 1287 0.61 1.14 0.50 163 FROM_NO_USER 1271 0.20 1.13 0.00 164 XM_UB60 1268 0.25 1.12 0.06 165 T_XMDrugObfuBody_00 1223 0.86 1.08 0.81 166 RELAYCOUNTRY_AU 1209 0.62 1.07 0.52 167 HTTPS_HTTP_MISMATCH 1209 1.01 1.07 1.00 168 MPART_ALT_DIFF_COUNT 1191 2.38 1.06 2.67 169 XM_H_TOP 1158 0.18 1.03 0.00 170 XM_H_Long_From02 1152 1.05 1.02 1.06 171 URIBL_BLACK 1109 0.19 0.98 0.01 172 XM_H_PHPOS_M 1106 0.30 0.98 0.16 173 XM_SPF_Unknown 1098 0.67 0.97 0.61 174 XMPhish08 1081 0.52 0.96 0.42 175 RELAYCOUNTRY_AT 1073 0.28 0.95 0.13 176 TR_MetaPhish_Combo_01 1053 0.84 0.93 0.82 177 XMBrknScrpt_02 1048 0.87 0.93 0.86 178 DATE_IN_PAST_12_24 1046 0.22 0.93 0.06 179 HK_RANDOM_REPLYTO 1018 0.38 0.90 0.27 180 XMLongAddy 1014 0.20 0.90 0.05 181 XMBounce_01 1012 0.19 0.90 0.03 182 XM_PDF 1009 3.78 0.89 4.39 183 XM_H_Long_From03 1008 0.19 0.89 0.04 184 MISSING_HEADERS 997 0.67 0.88 0.62 185 T_Symld_Words_02 994 0.57 0.88 0.50 186 T_TooManySym_02 979 1.88 0.87 2.10 187 DIET_1 977 0.34 0.87 0.23 188 TM2_M_A_HREF_HREF 960 0.46 0.85 0.37 189 XM_Body_Obfu01 940 0.42 0.83 0.33 190 REMOVE_BEFORE_LINK 919 0.38 0.81 0.29 191 XMBSHREFv2 917 0.33 0.81 0.22 192 LONG_HEX_URI 914 0.29 0.81 0.18 193 XMSexyCombo_04 892 0.22 0.79 0.10 194 XM_OfRef7 876 0.24 0.78 0.13 195 XMClaimOffer 872 0.34 0.77 0.25 196 XM_UB99 869 0.14 0.77 0.00 197 REPLYTO_WITHOUT_TO_CC 863 0.21 0.76 0.09 198 XMSubMetaSxObfu_03 855 0.40 0.76 0.33 199 SUBJ_DOLLARS 851 0.35 0.75 0.27 200 XM_UB80 850 0.15 0.75 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 471574 90.45 94.14 89.65 2 RELAYCOUNTRY_US 441613 83.12 79.25 83.96 3 DKIM_SIGNED 407739 78.32 82.04 77.52 4 XM_DK_Pass 400749 76.81 79.73 76.19 5 XM_B_Unicode 379270 72.96 76.97 72.10 6 DKIM_VALID 375379 70.46 66.26 71.36 7 DCC_CHECK_NEGATIVE 304543 51.09 19.34 57.90 8 BAYES_50 277692 52.00 48.30 52.79 9 XMListUnsubscribeExists 269388 54.62 70.51 51.21 10 DKIM_VALID_AU 265916 50.32 49.21 50.55 11 DCC_CHECK 209855 46.79 78.94 39.90 12 XM_B_Unicode3 207035 40.04 43.23 39.36 13 T_TM2_M_HEADER_IN_MSG 149285 26.95 20.30 28.38 14 HTML_FONT_LOW_CONTRAST 137865 27.09 31.19 26.21 15 DKIM_VALID_EF 133022 25.84 28.40 25.29 16 LOC_TINY_FONT_1 118924 24.76 34.77 22.61 17 FVGT_m_MULTI_ODD 115011 22.96 28.04 21.87 18 XMSubLong 108846 21.85 27.23 20.69 19 MIME_HTML_ONLY 103566 22.16 33.68 19.69 20 BAYES_00 102399 16.54 2.89 19.47 21 T_KAM_HTML_FONT_INVALID 96046 19.43 24.89 18.26 22 RCVD_IN_MSPIKE_H2 82105 14.54 9.53 15.61 23 TR_XM_DK_Bayes 72407 11.73 2.22 13.77 24 TR_XM_DK_Bayes1 66903 10.75 1.57 12.72 25 ALL_TRUSTED 64598 10.39 1.60 12.28 26 XM_Body_Dirty_Words 59101 12.75 19.81 11.24 27 TR_XM_DK_Bayes2 58257 9.36 1.39 11.08 28 XM_Multi_Part_URI 58137 12.12 17.09 11.05 29 UNPARSEABLE_RELAY 57887 10.09 5.83 11.01 30 XM_B_Unsub 52588 10.33 11.87 10.00 31 RCVD_IN_MSPIKE_H3 49635 8.37 3.38 9.44 32 RCVD_IN_MSPIKE_WL 49635 8.37 3.38 9.44 33 TooManyTo_001 47569 8.73 7.25 9.04 34 LotsOfNums_01 46638 9.17 10.56 8.87 35 XM_SendGrid 46462 8.15 4.97 8.83 36 XM_Evil_Numbers_Gen 43600 8.83 11.38 8.29 37 LOTS_OF_MONEY 41745 8.82 12.93 7.94 38 XM_B_Phish_Phrases 41625 8.55 11.50 7.91 39 RCVD_IN_RP_SAFE 41606 6.81 1.68 7.91 40 XM_DK_Undo_02 39633 14.00 44.13 7.53 41 RCVD_IN_RP_CERTIFIED 38405 6.22 1.19 7.30 42 HTML_IMAGE_RATIO_02 35938 7.56 10.96 6.83 43 FSL_BULK_SIG 35405 8.05 14.20 6.73 44 BAYES_40 34361 5.96 3.31 6.53 45 T_REMOTE_IMAGE 34232 5.78 2.36 6.51 46 XM_DKIMWhitelistDomains 33458 5.24 0.03 6.36 47 MIME_QP_LONG_LINE 33331 6.26 5.89 6.34 48 DKIM_INVALID 32360 7.85 15.78 6.15 49 RCVD_IN_IADB_LISTED 30413 5.11 1.99 5.78 50 RELAYCOUNTRY_META 30004 8.52 21.66 5.70 51 XM_H_Long_From01 29296 5.75 6.60 5.57 52 IN_ZIMBRA_NJ_WHITELIST 29099 4.56 0.01 5.53 53 HTML_IMAGE_RATIO_04 28268 5.45 5.82 5.37 54 BAYES_60 27565 5.38 6.06 5.24 55 MPART_ALT_DIFF 27339 5.60 7.46 5.20 56 BAYES_20 27106 4.72 2.70 5.15 57 RCVD_IN_IADB_SPF 26430 4.46 1.84 5.02 58 BOTNET_IPINHOSTNAME 25569 6.79 15.76 4.86 59 RCVD_IN_IADB_SENDERID 23312 3.96 1.79 4.43 60 XM_PDF 23110 3.78 0.89 4.39 61 RCVD_IN_IADB_DK 23042 3.92 1.79 4.38 62 T_TooManySym_01 22709 4.04 2.74 4.32 63 XMStrtUSub 20996 4.00 4.02 3.99 64 BOTNET 18997 7.22 24.02 3.61 65 RCVD_IN_IADB_VOUCHED 18911 3.09 0.71 3.60 66 TR_XM_DK_SendGrid 18023 3.19 2.06 3.43 67 BAYES_99 17238 7.21 25.53 3.28 68 HTML_IMAGE_RATIO_06 17022 3.29 3.51 3.24 69 XM_UncommonTLD01 17020 5.42 15.62 3.24 70 MIME_HTML_ONLY_MULTI 16801 3.19 3.15 3.19 71 BAYES_05 16739 2.89 1.53 3.18 72 NO_DNS_FOR_FROM 16737 4.76 12.14 3.18 73 TM2_M_URI_OPT_OUT 15893 3.22 4.16 3.02 74 XMNumbers 15852 3.11 3.55 3.01 75 XMSexyCombo_05 15332 4.35 11.04 2.91 76 XMSubMetaSx_00 15205 3.55 6.63 2.89 77 MAILING_LIST_MULTI 14894 2.59 1.47 2.83 78 FROM_EXCESS_BASE64 14884 2.84 2.87 2.83 79 BAYES_80 14708 3.44 6.44 2.80 80 XM_H_Trusted_IP 14522 2.27 0.00 2.76 81 MPART_ALT_DIFF_COUNT 14033 2.38 1.06 2.67 82 BAYES_999 13632 5.60 19.63 2.59 83 HTML_MIME_NO_HTML_TAG 12721 2.33 1.91 2.42 84 TooManyTo_002 12627 2.09 0.66 2.40 85 RCVD_IN_IADB_OPTIN 11867 1.95 0.54 2.26 86 RCVD_IN_MSPIKE_BL 11847 3.05 6.77 2.25 87 MIME_HTML_MOSTLY 11704 2.71 4.96 2.23 88 ANY_BOUNCE_MESSAGE 11621 2.03 1.17 2.21 89 BOUNCE_MESSAGE 11599 2.02 1.16 2.21 90 XM_CamelCaseFrm001 11574 2.77 5.45 2.20 91 RCVD_IN_MSPIKE_L3 11432 2.92 6.40 2.17 92 T_TooManySym_02 11028 1.88 0.87 2.10 93 HTML_IMAGE_RATIO_08 10984 2.14 2.38 2.09 94 XMNoVowels 10503 2.14 2.79 2.00 95 TVD_RCVD_IP 10441 1.72 0.47 1.98 96 KHOP_HELO_FCRDNS 10144 2.52 5.27 1.93 97 XM_DK_Undo_01 9876 1.76 1.22 1.88 98 XM_B_Unsub2 9704 2.02 2.83 1.84 99 XM_SPF_SoftFail 9698 2.67 6.51 1.84 100 HELO_NODOT 9181 1.55 0.62 1.75 101 HELO_NO_DOMAIN 9180 1.55 0.62 1.75 102 RELAYCOUNTRY_CA 8952 2.29 5.06 1.70 103 T_XMDrugObfuBody_08 8945 2.12 4.07 1.70 104 TooManyTo_003 8848 1.48 0.55 1.68 105 UNTRUSTED_Relay 8762 3.65 12.88 1.67 106 TR_DCC_Bayes_99 8673 4.87 19.87 1.65 107 XM_B_SpammyTLD 8618 2.05 3.98 1.64 108 IN_HORDE_ADDRESS_BOOK 8392 1.32 0.03 1.60 109 CK_HELO_DYNAMIC_SPLIT_IP 8354 1.37 0.35 1.59 110 HELO_DYNAMIC_IPADDR2 8347 1.32 0.06 1.59 111 T_XMDrugObfuBody_14 8197 1.65 2.06 1.56 112 BAYES_95 8182 1.85 3.22 1.56 113 INVALID_MSGID 7964 1.29 0.22 1.51 114 XM_GoogleGroups 7930 1.34 0.55 1.51 115 SUBJ_ALL_CAPS 7885 1.60 2.09 1.50 116 URI_HEX 7798 1.62 2.28 1.48 117 XMDiploma_00 7495 1.60 2.44 1.42 118 XMCapTrack 7488 1.27 0.54 1.42 119 RCVD_IN_BL_SPAMCOP_NET 7361 2.09 5.30 1.40 120 DKIM_ADSP_CUSTOM_MED 7020 1.50 2.27 1.33 121 TO_MALFORMED 6905 1.09 0.04 1.31 122 TooManyTo_004 6879 1.16 0.47 1.31 123 URI_TRY_3LD 6826 1.30 1.32 1.30 124 TR_Symld_Words 6681 1.33 1.60 1.27 125 XM_OfRef6 6490 1.58 3.18 1.23 126 TooManyTo_005 5810 0.97 0.37 1.10 127 RELAYCOUNTRY_GB 5719 1.20 1.72 1.09 128 XM_ProductURIs 5612 1.13 1.40 1.07 129 XM_H_Long_From02 5571 1.05 1.02 1.06 130 TM2_M_VERY_LONG_WORD 5546 1.21 1.91 1.05 131 HTTPS_HTTP_MISMATCH 5240 1.01 1.07 1.00 132 HTML_FONT_FACE_BAD 5091 0.91 0.62 0.97 133 XMSubNoVowel 5069 0.92 0.70 0.96 134 NML_ADSP_CUSTOM_MED 5009 1.13 1.96 0.95 135 XMGappySubj_01 4872 0.79 0.14 0.93 136 XM_UB50 4761 2.22 8.32 0.91 137 USER_IN_DEF_DKIM_WL 4749 0.75 0.05 0.90 138 XMGenDplmaNmb 4635 1.05 1.83 0.88 139 XMBrknScrpt_02 4512 0.87 0.93 0.86 140 SpammyFromTLD_01 4436 1.21 2.90 0.84 141 TR_MetaPhish_Combo_01 4295 0.84 0.93 0.82 142 XMBdyGiftCard01 4277 0.78 0.64 0.81 143 T_XMDrugObfuBody_00 4271 0.86 1.08 0.81 144 T_FILL_THIS_FORM_SHORT 4122 0.87 1.28 0.78 145 XMHTML_After_End 4096 1.20 3.18 0.78 146 XMPhish30 3758 0.81 1.27 0.71 147 RELAYCOUNTRY_DE 3603 0.95 2.18 0.68 148 RCVD_IN_SORBS_DUL 3506 0.57 0.11 0.67 149 TR_MSPIKEBAYES00 3476 0.54 0.00 0.66 150 XMStockSpam_06 3375 0.83 1.70 0.64 151 T_TooManySym_03 3322 0.59 0.41 0.63 152 MISSING_HEADERS 3273 0.67 0.88 0.62 153 XMSubMetaI_00 3255 0.77 1.50 0.62 154 FROM_GOV_DKIM_AU 3233 0.53 0.16 0.61 155 XM_SPF_Unknown 3210 0.67 0.97 0.61 156 PLING_QUERY 3119 0.59 0.60 0.59 157 XMBody_17 3118 0.93 2.49 0.59 158 XMMoneyMeta_00 3048 0.70 1.24 0.58 159 T_XMHurry_00 3005 0.89 2.36 0.57 160 FORGED_GMAIL_RCVD 3001 0.85 2.15 0.57 161 TR_LOTS_OF_MONEY3 2951 0.91 2.53 0.56 162 LOW_PRICE 2940 0.56 0.56 0.56 163 XMPhish14 2933 0.58 0.67 0.56 164 BOTNET_NORDNS 2906 0.89 2.44 0.55 165 XM_DIRTYINTL 2822 1.06 3.47 0.54 166 RELAYCOUNTRY_AU 2761 0.62 1.07 0.52 167 XM_ShortIntro_01 2642 0.46 0.25 0.50 168 T_Symld_Words_02 2629 0.57 0.88 0.50 169 XM_H_PHPMailer 2626 0.61 1.14 0.50 170 T_OBFU_PDF_ATTACH 2594 0.44 0.18 0.49 171 FROM_GOV_SPOOF 2503 0.43 0.24 0.48 172 XMSlimDrugH 2441 0.45 0.39 0.46 173 XMSexyCombo_01 2438 0.71 1.88 0.46 174 XMHTMLBadTable_001 2418 0.51 0.75 0.46 175 TR_XM_PHPDW 2374 0.77 2.28 0.45 176 HTML_IMAGE_ONLY_20 2361 0.43 0.34 0.45 177 TR_XM_PHPForged 2331 0.76 2.25 0.44 178 TR_XM_FormFill2 2325 0.76 2.23 0.44 179 XMBody_95 2320 0.38 0.11 0.44 180 XM_H_PHPOS 2294 0.75 2.22 0.44 181 XMPhish08 2229 0.52 0.96 0.42 182 SHORT_HELO_AND_INLINE_IMAGE 2222 0.35 0.02 0.42 183 XMBody_78 2211 0.47 0.70 0.42 184 AC_DIV_BONANZA 2175 0.36 0.13 0.41 185 XM_B_REG_HTML 2168 0.39 0.31 0.41 186 HTML_IMAGE_ONLY_28 2160 0.43 0.52 0.41 187 HTML_TAG_BALANCE_BODY 2135 0.47 0.75 0.41 188 MSGID_FROM_MTA_HEADER 2112 0.38 0.30 0.40 189 TM2_M_BODY_EMPTY 2048 0.34 0.13 0.39 190 USER_IN_WHITELIST 2001 0.31 0.00 0.38 191 URI_NOVOWEL 1993 0.41 0.55 0.38 192 HTML_IMAGE_ONLY_32 1977 0.37 0.33 0.38 193 TM2_M_A_HREF_HREF 1964 0.46 0.85 0.37 194 TVD_SPACE_RATIO 1873 0.35 0.31 0.36 195 T_MONEY_PERCENT 1860 0.54 1.42 0.35 196 TR_LOTS_OF_MONEY2 1860 0.54 1.42 0.35 197 RELAYCOUNTRY_FR 1823 0.74 2.58 0.35 198 XM_B_COPY_HTML 1822 0.41 0.71 0.35 199 XMDateMe_00 1810 0.35 0.35 0.34 200 RDNS_DYNAMIC 1801 0.91 3.54 0.34 ----------------------------------------------------------------------