Email: 620205 Autolearn: 0 AvgScore: 3.54 AvgScanTime: 4.40 sec Spam: 175615 Autolearn: 0 AvgScore: 12.86 AvgScanTime: 5.14 sec Ham: 444590 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 4.10 sec Time Spent Running SA: 757.49 hours Time Spent Processing Spam: 250.76 hours Time Spent Processing Ham: 506.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 168281 84.78 95.82 80.41 2 DKIM_SIGNED 146782 72.12 83.58 67.59 3 XM_DK_Pass 142942 70.25 81.40 65.84 4 DCC_CHECK 138605 45.99 78.93 32.99 5 DKIM_VALID 136160 66.69 77.53 62.40 6 XMListUnsubscribeExists 124942 51.63 71.15 43.92 7 DKIM_VALID_AU 106635 49.54 60.72 45.13 8 XM_H_QuotedFrom 98750 39.12 56.23 32.36 9 XM_DK_Undo_02 82413 21.63 46.93 11.64 10 BAYES_99 73452 19.51 41.83 10.69 11 BAYES_999 62716 16.94 35.71 9.53 12 LOC_TINY_FONT_1 62112 22.27 35.37 17.09 13 HTML_FONT_LOW_CONTRAST 61826 25.21 35.21 21.26 14 BAYES_50 59140 52.71 33.68 60.23 15 TR_DCC_Bayes_99 58422 13.39 33.27 5.54 16 XMSubLong 49345 21.35 28.10 18.69 17 MIME_HTML_ONLY 49175 20.89 28.00 18.08 18 FVGT_m_MULTI_ODD 47844 20.44 27.24 17.76 19 T_TM2_M_HEADER_IN_MSG 37513 29.66 21.36 32.94 20 DCC_CHECK_NEGATIVE 33290 51.77 18.96 64.73 21 XM_Body_Dirty_Words 32659 11.83 18.60 9.15 22 T_KAM_HTML_FONT_INVALID 32539 13.98 18.53 12.18 23 DKIM_VALID_EF 30762 18.49 17.52 18.87 24 HTML_IMAGE_RATIO_02 30045 9.05 17.11 5.87 25 RELAYCOUNTRY_META 29432 8.56 16.76 5.32 26 MultiRelay 29190 19.87 16.62 21.15 27 XM_Multi_Part_URI 28180 11.59 16.05 9.83 28 XM_Evil_Numbers_Gen 24735 9.28 14.08 7.39 29 LOTS_OF_MONEY 23263 8.78 13.25 7.02 30 BOTNET_IPINHOSTNAME 22810 6.62 12.99 4.11 31 FSL_BULK_SIG 21619 8.30 12.31 6.71 32 BOTNET 20527 4.17 11.69 1.20 33 TR_XM_DocInvoice 19138 5.89 10.90 3.92 34 XM_H_Long_From01 19043 6.93 10.84 5.39 35 T_XMDrugObfuBody_14 18050 8.04 10.28 7.15 36 XM_B_Phish_Phrases 17242 6.52 9.82 5.22 37 HTML_IMAGE_RATIO_04 17103 5.63 9.74 4.01 38 UNTRUSTED_Relay 17000 3.63 9.68 1.23 39 XMSexyCombo_05 16634 4.58 9.47 2.64 40 LotsOfNums_01 15022 7.89 8.55 7.63 41 BAYES_80 14601 4.75 8.31 3.35 42 TooManyTo_001 13855 8.30 7.89 8.46 43 XMSubMetaSx_00 12919 4.32 7.36 3.12 44 MPART_ALT_DIFF 12653 3.78 7.20 2.43 45 XM_SPF_SoftFail 12144 4.24 6.92 3.18 46 BAYES_60 12069 5.86 6.87 5.47 47 FROM_EXCESS_BASE64 11370 4.12 6.47 3.20 48 XM_UncommonTLD01 10632 5.61 6.05 5.43 49 DKIM_INVALID 10622 5.44 6.05 5.19 50 MIME_HTML_MOSTLY 10350 3.19 5.89 2.13 51 XM_OfRef6 10276 3.70 5.85 2.85 52 T_XMDrugObfuBody_08 9392 2.76 5.35 1.74 53 RCVD_IN_RP_SAFE 8744 7.81 4.98 8.93 54 HTML_IMAGE_RATIO_06 8298 3.73 4.73 3.34 55 MIME_QP_LONG_LINE 8065 4.74 4.59 4.79 56 XMStrtUSub 7938 3.94 4.52 3.71 57 XM_UB50 7725 1.81 4.40 0.79 58 TM2_M_URI_OPT_OUT 7718 2.38 4.39 1.59 59 BAYES_95 7515 3.26 4.28 2.85 60 FILL_THIS_FORM 7510 1.43 4.28 0.30 61 FILL_THIS_FORM_LONG 7439 1.25 4.24 0.08 62 ALL_TRUSTED 7268 16.66 4.14 21.61 63 XM_DIRTYINTL 7116 2.39 4.05 1.73 64 XMNumbers 7003 3.27 3.99 2.98 65 FILL_THIS_FORM_LOAN 6997 1.16 3.98 0.04 66 RCVD_IN_RP_CERTIFIED 6809 6.57 3.88 7.63 67 XM_SendGrid 6750 4.54 3.84 4.81 68 RCVD_IN_BL_SPAMCOP_NET 6675 1.52 3.80 0.62 69 XM_OfRef7 6177 2.46 3.52 2.04 70 T_REMOTE_IMAGE 6166 4.08 3.51 4.30 71 THIS_AD 6156 1.05 3.51 0.08 72 XM_CamelCaseFrm001 6140 2.29 3.50 1.81 73 URI_HEX 6119 1.84 3.48 1.20 74 T_TooManySym_01 6087 4.09 3.47 4.34 75 MultiRelay_Combo 5976 1.15 3.40 0.26 76 MultiRelay_CC 5976 1.15 3.40 0.26 77 XM_Lotto 5785 1.07 3.29 0.19 78 XMSubject_48 5776 0.95 3.29 0.03 79 DATE_IN_FUTURE_06_12 5761 1.95 3.28 1.43 80 RELAYCOUNTRY_CA 5754 1.90 3.28 1.35 81 XM_URI_RBL 5750 1.02 3.27 0.13 82 TR_Mismatch_TLD_01 5683 1.00 3.24 0.12 83 MONEY_FRAUD_5 5579 0.90 3.18 0.00 84 HTML_IMAGE_RATIO_08 5569 2.42 3.17 2.12 85 XM_OfRef8 5478 1.14 3.12 0.36 86 HK_LOTTO 5477 0.88 3.12 0.00 87 TO_IN_SUBJ 5440 0.89 3.10 0.02 88 T_FILL_THIS_FORM_FRAUD_PHISH 5422 0.93 3.09 0.08 89 T_LOTTO_AGENT 5407 0.87 3.08 0.00 90 XM_OfRef9 5396 1.11 3.07 0.33 91 MIME_HTML_ONLY_MULTI 5062 1.69 2.88 1.22 92 RELAYCOUNTRY_FR 3935 0.83 2.24 0.27 93 XM_DK_Undo_01 3827 1.91 2.18 1.80 94 XMDiploma_00 3804 1.53 2.17 1.28 95 SpammyFromTLD_02 3765 0.83 2.14 0.31 96 RCVD_IN_IADB_LISTED 3675 4.05 2.09 4.82 97 RCVD_IN_RP_RNBL 3591 0.60 2.04 0.03 98 TM2_M_VERY_LONG_WORD 3504 1.13 2.00 0.79 99 XM_UB99 3464 0.56 1.97 0.01 100 URI_TRY_3LD 3424 1.30 1.95 1.05 101 HTML_MIME_NO_HTML_TAG 3390 2.07 1.93 2.12 102 SUBJ_ALL_CAPS 3382 2.55 1.93 2.79 103 RCVD_IN_MSPIKE_H2 3279 3.33 1.87 3.91 104 XMSexyCombo_01 3240 0.72 1.84 0.27 105 XMSubMetaI_00 3189 1.01 1.82 0.69 106 RELAYCOUNTRY_GB 3157 1.45 1.80 1.32 107 TR_XM_RelayPhish 3147 0.89 1.79 0.53 108 URIBL_BLACK 3115 0.54 1.77 0.05 109 RCVD_IN_IADB_SPF 3103 3.53 1.77 4.22 110 MAILING_LIST_MULTI 3080 2.59 1.75 2.92 111 BAYES_00 3038 6.18 1.73 7.94 112 RCVD_IN_IADB_SENDERID 2921 3.16 1.66 3.75 113 RCVD_IN_IADB_DK 2898 3.08 1.65 3.64 114 XM_HighProb1 2837 0.47 1.62 0.02 115 SpammyFromTLD_01 2832 2.61 1.61 3.01 116 XM_UB999 2796 0.46 1.59 0.01 117 XMPhish30 2733 0.77 1.56 0.46 118 XMHTML_After_End 2644 0.65 1.51 0.32 119 TR_LOTS_OF_MONEY2 2562 0.75 1.46 0.47 120 T_MONEY_PERCENT 2562 0.75 1.46 0.47 121 BAYES_40 2540 3.98 1.45 4.97 122 XMBdyGiftCard01 2528 1.04 1.44 0.88 123 TR_XM_DK_Bayes 2489 4.30 1.42 5.44 124 TR_XM_DK_Bayes1 2390 4.09 1.36 5.17 125 LONG_JUNK_URI 2358 0.53 1.34 0.21 126 XMBody_17 2310 0.63 1.32 0.35 127 XM_ProductURIs 2306 1.05 1.31 0.95 128 BODY_ENHANCEMENT 2296 0.39 1.31 0.02 129 T_XMHurry_00 2293 0.66 1.31 0.40 130 T_FILL_THIS_FORM_SHORT 2285 2.33 1.30 2.74 131 RCVD_IN_MSPIKE_WL 2216 2.83 1.26 3.45 132 XMStockSpam_06 2208 1.16 1.26 1.12 133 TR_XM_DK_Bayes2 2203 3.44 1.25 4.30 134 TooManyTo_002 2202 2.12 1.25 2.46 135 XM_H_Long_From02 2190 0.89 1.25 0.75 136 RCVD_IN_MSPIKE_H3 2189 2.81 1.25 3.42 137 BOTNET_NORDNS 2182 0.37 1.24 0.02 138 SUBJ_DOLLARS 2173 0.46 1.24 0.15 139 HTML_FONT_FACE_BAD 2171 0.70 1.24 0.49 140 BAYES_20 2087 2.41 1.19 2.89 141 T_TooManySym_02 2023 1.57 1.15 1.74 142 XMMoneyMeta_00 2007 0.71 1.14 0.54 143 XMBody_78 2001 0.79 1.14 0.65 144 T_HTML_TAG_BALANCE_CENTER 1971 0.45 1.12 0.18 145 XMGenDplmaNmb 1962 0.90 1.12 0.82 146 UNPARSEABLE_RELAY 1951 2.51 1.11 3.06 147 XM_PDF 1919 3.90 1.09 5.01 148 XMPhish11 1917 1.19 1.09 1.22 149 TooManyTo_003 1911 1.48 1.09 1.64 150 RELAYCOUNTRY_AT 1869 0.38 1.06 0.11 151 REMOVE_BEFORE_LINK 1867 0.57 1.06 0.37 152 MPART_ALT_DIFF_COUNT 1841 0.46 1.05 0.23 153 TR_Symld_Words 1823 2.04 1.04 2.44 154 XMPhish14 1760 0.46 1.00 0.25 155 RCVD_IN_PSBL 1756 0.32 1.00 0.06 156 XMHTMLBadTable_001 1754 0.60 1.00 0.44 157 XMSubMetaSSx_00 1736 0.36 0.99 0.11 158 XM_UB60 1730 0.33 0.99 0.07 159 TR_Mismatch_TLD_02 1724 0.32 0.98 0.06 160 RDNS_DYNAMIC 1709 0.54 0.97 0.36 161 XM_B_COPY_HTML 1695 0.47 0.97 0.28 162 RCVD_IN_IADB_VOUCHED 1665 2.62 0.95 3.28 163 XM_H_PHPOS 1662 3.26 0.95 4.17 164 TooManyTo_004 1642 1.11 0.93 1.18 165 XMSubNoVowel 1623 0.60 0.92 0.47 166 T_XMDrugObfuBody_00 1609 0.60 0.92 0.48 167 XM_BadFromFormat 1591 0.41 0.91 0.22 168 URIBL_DBL_SPAM 1556 0.26 0.89 0.01 169 HTML_TAG_BALANCE_BODY 1553 0.55 0.88 0.42 170 LongTLD 1529 0.34 0.87 0.13 171 INVALID_MSGID 1518 1.39 0.86 1.60 172 TR_MetaPhish_Combo_01 1517 0.72 0.86 0.66 173 XM_S_JOY_D 1472 0.70 0.84 0.64 174 XM_UB80 1469 0.25 0.84 0.02 175 HTML_IMAGE_ONLY_28 1457 0.52 0.83 0.40 176 TooManyTo_005 1450 0.92 0.83 0.95 177 DKIM_ADSP_CUSTOM_MED 1445 0.96 0.82 1.01 178 URI_NOVOWEL 1443 0.53 0.82 0.42 179 RELAYCOUNTRY_CN 1438 0.27 0.82 0.05 180 XMSlimDrugH 1429 0.42 0.81 0.26 181 RELAYCOUNTRY_IT 1419 0.26 0.81 0.04 182 BODY_URI_ONLY 1411 0.26 0.80 0.04 183 HTML_FONT_SIZE_HUGE 1399 0.30 0.80 0.11 184 XM_B_REG_HTML 1384 0.56 0.79 0.48 185 T_Symld_Words_02 1383 0.48 0.79 0.36 186 XMSubMetaSxObfu_03 1358 0.57 0.77 0.49 187 RCVD_IN_MSPIKE_BL 1356 0.50 0.77 0.40 188 RELAYCOUNTRY_DE 1352 0.54 0.77 0.45 189 RELAYCOUNTRY_AU 1335 0.54 0.76 0.45 190 ANY_BOUNCE_MESSAGE 1328 4.21 0.76 5.57 191 BOUNCE_MESSAGE 1328 4.21 0.76 5.57 192 URIBL_SBL_A 1306 0.27 0.74 0.08 193 HTTPS_HTTP_MISMATCH 1294 0.56 0.74 0.49 194 XMBrknScrpt_02 1250 0.71 0.71 0.70 195 XM_Body_Obfu01 1233 0.40 0.70 0.28 196 NML_ADSP_CUSTOM_MED 1229 0.74 0.70 0.75 197 XM_RXBody 1222 0.29 0.70 0.13 198 XMBSHREFv2 1213 0.28 0.69 0.11 199 XMSubEmpty 1203 0.47 0.69 0.39 200 PLING_QUERY 1196 0.38 0.68 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 357503 84.78 95.82 80.41 2 DKIM_SIGNED 300520 72.12 83.58 67.59 3 XM_DK_Pass 292726 70.25 81.40 65.84 4 DCC_CHECK_NEGATIVE 287782 51.77 18.96 64.73 5 DKIM_VALID 277429 66.69 77.53 62.40 6 BAYES_50 267771 52.71 33.68 60.23 7 DKIM_VALID_AU 200623 49.54 60.72 45.13 8 XMListUnsubscribeExists 195247 51.63 71.15 43.92 9 DCC_CHECK 146656 45.99 78.93 32.99 10 T_TM2_M_HEADER_IN_MSG 146453 29.66 21.36 32.94 11 XM_H_QuotedFrom 143854 39.12 56.23 32.36 12 ALL_TRUSTED 96078 16.66 4.14 21.61 13 HTML_FONT_LOW_CONTRAST 94516 25.21 35.21 21.26 14 MultiRelay 94036 19.87 16.62 21.15 15 DKIM_VALID_EF 83889 18.49 17.52 18.87 16 XMSubLong 83082 21.35 28.10 18.69 17 MIME_HTML_ONLY 80371 20.89 28.00 18.08 18 FVGT_m_MULTI_ODD 78950 20.44 27.24 17.76 19 LOC_TINY_FONT_1 75987 22.27 35.37 17.09 20 T_KAM_HTML_FONT_INVALID 54150 13.98 18.53 12.18 21 XM_DK_Undo_02 51732 21.63 46.93 11.64 22 BAYES_99 47535 19.51 41.83 10.69 23 XM_Multi_Part_URI 43711 11.59 16.05 9.83 24 BAYES_999 42353 16.94 35.71 9.53 25 XM_Body_Dirty_Words 40695 11.83 18.60 9.15 26 RCVD_IN_RP_SAFE 39722 7.81 4.98 8.93 27 XM_DKIMWhitelistDomains 39455 6.38 0.06 8.87 28 TooManyTo_001 37634 8.30 7.89 8.46 29 BAYES_00 35304 6.18 1.73 7.94 30 RCVD_IN_RP_CERTIFIED 33942 6.57 3.88 7.63 31 LotsOfNums_01 33912 7.89 8.55 7.63 32 XM_Evil_Numbers_Gen 32837 9.28 14.08 7.39 33 T_XMDrugObfuBody_14 31784 8.04 10.28 7.15 34 LOTS_OF_MONEY 31213 8.78 13.25 7.02 35 FSL_BULK_SIG 29840 8.30 12.31 6.71 36 HTML_IMAGE_RATIO_02 26100 9.05 17.11 5.87 37 ANY_BOUNCE_MESSAGE 24757 4.21 0.76 5.57 38 BOUNCE_MESSAGE 24753 4.21 0.76 5.57 39 TR_DCC_Bayes_99 24642 13.39 33.27 5.54 40 IN_ZIMBRA_NJ_WHITELIST 24315 3.93 0.04 5.47 41 BAYES_60 24300 5.86 6.87 5.47 42 TR_XM_DK_Bayes 24179 4.30 1.42 5.44 43 XM_UncommonTLD01 24145 5.61 6.05 5.43 44 XM_H_Long_From01 23946 6.93 10.84 5.39 45 RELAYCOUNTRY_META 23637 8.56 16.76 5.32 46 XM_B_Phish_Phrases 23210 6.52 9.82 5.22 47 DKIM_INVALID 23091 5.44 6.05 5.19 48 TR_XM_DK_Bayes1 23007 4.09 1.36 5.17 49 XM_PDF 22258 3.90 1.09 5.01 50 BAYES_40 22118 3.98 1.45 4.97 51 RCVD_IN_IADB_LISTED 21449 4.05 2.09 4.82 52 XM_SendGrid 21388 4.54 3.84 4.81 53 MIME_QP_LONG_LINE 21302 4.74 4.59 4.79 54 T_TooManySym_01 19307 4.09 3.47 4.34 55 TR_XM_DK_Bayes2 19132 3.44 1.25 4.30 56 T_REMOTE_IMAGE 19122 4.08 3.51 4.30 57 RCVD_IN_IADB_SPF 18782 3.53 1.77 4.22 58 XM_H_PHPOS 18545 3.26 0.95 4.17 59 BOTNET_IPINHOSTNAME 18261 6.62 12.99 4.11 60 HTML_IMAGE_RATIO_04 17839 5.63 9.74 4.01 61 TR_XM_DocInvoice 17420 5.89 10.90 3.92 62 RCVD_IN_MSPIKE_H2 17364 3.33 1.87 3.91 63 RCVD_IN_IADB_SENDERID 16658 3.16 1.66 3.75 64 XMStrtUSub 16500 3.94 4.52 3.71 65 RCVD_IN_IADB_DK 16204 3.08 1.65 3.64 66 RCVD_IN_MSPIKE_WL 15329 2.83 1.26 3.45 67 RCVD_IN_MSPIKE_H3 15227 2.81 1.25 3.42 68 BAYES_80 14883 4.75 8.31 3.35 69 HTML_IMAGE_RATIO_06 14841 3.73 4.73 3.34 70 RCVD_IN_IADB_VOUCHED 14602 2.62 0.95 3.28 71 FROM_EXCESS_BASE64 14210 4.12 6.47 3.20 72 XM_SPF_SoftFail 14158 4.24 6.92 3.18 73 XMSubMetaSx_00 13883 4.32 7.36 3.12 74 UNPARSEABLE_RELAY 13591 2.51 1.11 3.06 75 SpammyFromTLD_01 13374 2.61 1.61 3.01 76 XMNumbers 13261 3.27 3.99 2.98 77 MAILING_LIST_MULTI 12967 2.59 1.75 2.92 78 BAYES_20 12836 2.41 1.19 2.89 79 XM_OfRef6 12685 3.70 5.85 2.85 80 BAYES_95 12682 3.26 4.28 2.85 81 SUBJ_ALL_CAPS 12418 2.55 1.93 2.79 82 T_FILL_THIS_FORM_SHORT 12162 2.33 1.30 2.74 83 TVD_RCVD_IP 11773 1.98 0.28 2.65 84 XMSexyCombo_05 11759 4.58 9.47 2.64 85 TooManyTo_002 10933 2.12 1.25 2.46 86 TR_Symld_Words 10850 2.04 1.04 2.44 87 MPART_ALT_DIFF 10800 3.78 7.20 2.43 88 HELO_NODOT 10442 1.76 0.27 2.35 89 MIME_HTML_MOSTLY 9450 3.19 5.89 2.13 90 HTML_IMAGE_RATIO_08 9423 2.42 3.17 2.12 91 HTML_MIME_NO_HTML_TAG 9421 2.07 1.93 2.12 92 IN_HORDE_ADDRESS_BOOK 9135 1.49 0.06 2.05 93 XM_OfRef7 9091 2.46 3.52 2.04 94 XM_CamelCaseFrm001 8040 2.29 3.50 1.81 95 XM_DK_Undo_01 8009 1.91 2.18 1.80 96 T_XMDrugObfuBody_08 7748 2.76 5.35 1.74 97 T_TooManySym_02 7720 1.57 1.15 1.74 98 XM_DIRTYINTL 7706 2.39 4.05 1.73 99 TooManyTo_003 7287 1.48 1.09 1.64 100 BAYES_05 7161 1.34 0.67 1.61 101 USER_IN_DEF_DKIM_WL 7155 1.17 0.05 1.61 102 INVALID_MSGID 7102 1.39 0.86 1.60 103 TM2_M_URI_OPT_OUT 7056 2.38 4.39 1.59 104 RCVD_IN_IADB_OPTIN 6818 1.25 0.52 1.53 105 TO_MALFORMED 6365 1.03 0.01 1.43 106 DATE_IN_FUTURE_06_12 6355 1.95 3.28 1.43 107 RELAYCOUNTRY_CA 6017 1.90 3.28 1.35 108 XM_GoogleGroups 5871 1.12 0.63 1.32 109 RELAYCOUNTRY_GB 5849 1.45 1.80 1.32 110 XMCapTrack 5756 1.07 0.48 1.29 111 XMDiploma_00 5709 1.53 2.17 1.28 112 UNTRUSTED_Relay 5487 3.63 9.68 1.23 113 XMPhish11 5443 1.19 1.09 1.22 114 MIME_HTML_ONLY_MULTI 5436 1.69 2.88 1.22 115 BOTNET 5324 4.17 11.69 1.20 116 URI_HEX 5315 1.84 3.48 1.20 117 TooManyTo_004 5258 1.11 0.93 1.18 118 XMStockSpam_06 4965 1.16 1.26 1.12 119 URI_TRY_3LD 4649 1.30 1.95 1.05 120 DKIM_ADSP_CUSTOM_MED 4480 0.96 0.82 1.01 121 TooManyTo_005 4225 0.92 0.83 0.95 122 XM_ProductURIs 4208 1.05 1.31 0.95 123 XMBdyGiftCard01 3898 1.04 1.44 0.88 124 XM_ShortIntro_01 3662 0.73 0.51 0.82 125 XMGenDplmaNmb 3637 0.90 1.12 0.82 126 TM2_M_VERY_LONG_WORD 3519 1.13 2.00 0.79 127 XM_UB50 3516 1.81 4.40 0.79 128 EXCLAMACION_ES 3481 0.58 0.07 0.78 129 T_TooManySym_03 3423 0.59 0.12 0.77 130 TO_NO_BRKTS_HTML_ONLY 3358 0.58 0.15 0.76 131 XM_H_Long_From02 3353 0.89 1.25 0.75 132 NML_ADSP_CUSTOM_MED 3336 0.74 0.70 0.75 133 XMNoVowels 3299 0.65 0.41 0.74 134 TR_Caps_n_Bayes_95 3198 0.53 0.07 0.72 135 XMBrknScrpt_02 3128 0.71 0.71 0.70 136 T_OBFU_PDF_ATTACH 3119 0.56 0.22 0.70 137 XMSubMetaI_00 3050 1.01 1.82 0.69 138 TR_MetaPhish_Combo_01 2954 0.72 0.86 0.66 139 XM_H_PHPMailer 2952 0.64 0.58 0.66 140 XMBody_78 2908 0.79 1.14 0.65 141 XM_S_JOY_D 2852 0.70 0.84 0.64 142 USER_IN_WHITELIST 2832 0.46 0.00 0.64 143 RCVD_IN_BL_SPAMCOP_NET 2754 1.52 3.80 0.62 144 XMGappySubj_01 2712 0.58 0.49 0.61 145 RCVD_IN_SORBS_DUL 2694 0.49 0.20 0.61 146 RCVD_IN_IADB_DOPTIN 2549 0.43 0.08 0.57 147 SHORT_HELO_AND_INLINE_IMAGE 2494 0.42 0.05 0.56 148 XMMoneyMeta_00 2407 0.71 1.14 0.54 149 TR_XM_RelayPhish 2365 0.89 1.79 0.53 150 XMLngstWrd_00 2207 0.48 0.43 0.50 151 MISSING_HEADERS 2193 0.55 0.68 0.49 152 HTTPS_HTTP_MISMATCH 2187 0.56 0.74 0.49 153 XMSubMetaSxObfu_03 2184 0.57 0.77 0.49 154 XM_B_TRADE_HTML 2182 0.48 0.45 0.49 155 HTML_FONT_FACE_BAD 2167 0.70 1.24 0.49 156 HTML_IMAGE_ONLY_32 2155 0.45 0.37 0.48 157 AC_DIV_BONANZA 2142 0.38 0.12 0.48 158 XMBody_95 2138 0.39 0.15 0.48 159 T_XMDrugObfuBody_00 2116 0.60 0.92 0.48 160 XM_B_REG_HTML 2115 0.56 0.79 0.48 161 TR_LOTS_OF_MONEY2 2087 0.75 1.46 0.47 162 T_MONEY_PERCENT 2087 0.75 1.46 0.47 163 XMSubNoVowel 2071 0.60 0.92 0.47 164 XMPhish30 2040 0.77 1.56 0.46 165 XM_H_PHPOS_M 1992 0.42 0.34 0.45 166 RELAYCOUNTRY_DE 1991 0.54 0.77 0.45 167 RELAYCOUNTRY_AU 1988 0.54 0.76 0.45 168 XMHTMLBadTable_001 1941 0.60 1.00 0.44 169 HTML_TAG_BALANCE_BODY 1863 0.55 0.88 0.42 170 XMDateMe_00 1851 0.40 0.36 0.42 171 URI_NOVOWEL 1849 0.53 0.82 0.42 172 TM2_M_BODY_EMPTY 1830 0.39 0.32 0.41 173 HTML_IMAGE_ONLY_24 1799 0.43 0.49 0.40 174 RELAYCOUNTRY_NL 1787 0.43 0.50 0.40 175 HTML_IMAGE_ONLY_28 1783 0.52 0.83 0.40 176 XMSubMetaSxObfu_02 1783 0.35 0.23 0.40 177 T_XMHurry_00 1781 0.66 1.31 0.40 178 RCVD_IN_MSPIKE_BL 1766 0.50 0.77 0.40 179 XMSubEmpty 1727 0.47 0.69 0.39 180 DOS_OUTLOOK_TO_MX 1713 0.31 0.13 0.39 181 XM_USANA_RCVD 1705 0.27 0.00 0.38 182 REMOVE_BEFORE_LINK 1639 0.57 1.06 0.37 183 RCVD_IN_MSPIKE_L3 1631 0.32 0.20 0.37 184 TM2_M_A_HREF_HREF 1620 0.38 0.43 0.36 185 RDNS_DYNAMIC 1614 0.54 0.97 0.36 186 FORGED_GMAIL_RCVD 1602 0.38 0.43 0.36 187 XM_OfRef8 1600 1.14 3.12 0.36 188 T_Symld_Words_02 1582 0.48 0.79 0.36 189 XMBody_17 1577 0.63 1.32 0.35 190 HTML_IMAGE_ONLY_20 1561 0.35 0.36 0.35 191 DKIM_ADSP_NXDOMAIN 1543 0.43 0.65 0.35 192 XMLKML 1493 0.24 0.00 0.34 193 XM_OfRef9 1487 1.11 3.07 0.33 194 XM_H_Undi_Recip 1437 0.29 0.20 0.32 195 XMHTML_After_End 1406 0.65 1.51 0.32 196 XM_B_FormFill 1403 0.24 0.04 0.32 197 T_TooManySym_04 1391 0.23 0.03 0.31 198 SpammyFromTLD_02 1373 0.83 2.14 0.31 199 BAD_ENC_HEADER 1372 0.24 0.07 0.31 200 TVD_SPACE_RATIO 1357 0.29 0.25 0.31 ----------------------------------------------------------------------