Email: 564613 Autolearn: 0 AvgScore: 3.09 AvgScanTime: 4.19 sec Spam: 161292 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 4.78 sec Ham: 403321 Autolearn: 0 AvgScore: -0.61 AvgScanTime: 3.95 sec Time Spent Running SA: 656.56 hours Time Spent Processing Spam: 214.11 hours Time Spent Processing Ham: 442.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153525 86.20 95.18 82.61 2 DKIM_SIGNED 140101 74.07 86.86 68.96 3 XM_DK_Pass 136165 72.28 84.42 67.42 4 DKIM_VALID 134176 70.47 83.19 65.38 5 DCC_CHECK 129265 47.07 80.14 33.85 6 XMListUnsubscribeExists 117054 51.81 72.57 43.51 7 DKIM_VALID_AU 105812 52.27 65.60 46.93 8 XM_H_QuotedFrom 89459 40.34 55.46 34.29 9 XM_DK_Undo_02 78389 22.73 48.60 12.38 10 BAYES_99 69515 20.55 43.10 11.53 11 BAYES_999 59589 17.79 36.94 10.13 12 LOC_TINY_FONT_1 59250 23.59 36.73 18.33 13 HTML_FONT_LOW_CONTRAST 58830 26.84 36.47 22.99 14 BAYES_50 56491 53.24 35.02 60.53 15 TR_DCC_Bayes_99 55685 13.90 34.52 5.65 16 MIME_HTML_ONLY 48286 21.17 29.94 17.66 17 FVGT_m_MULTI_ODD 46480 22.26 28.82 19.64 18 XMSubLong 44559 22.89 27.63 20.99 19 XM_Body_Dirty_Words 35112 13.70 21.77 10.47 20 DKIM_VALID_EF 30774 20.23 19.08 20.69 21 T_KAM_HTML_FONT_INVALID 29861 14.79 18.51 13.30 22 MultiRelay 29405 19.48 18.23 19.98 23 T_TM2_M_HEADER_IN_MSG 29369 28.81 18.21 33.05 24 DCC_CHECK_NEGATIVE 28711 50.63 17.80 63.76 25 HTML_IMAGE_RATIO_02 28118 9.52 17.43 6.36 26 XM_Multi_Part_URI 27248 12.56 16.89 10.82 27 RELAYCOUNTRY_META 26851 8.76 16.65 5.61 28 BOTNET_IPINHOSTNAME 22199 6.78 13.76 3.99 29 XM_Evil_Numbers_Gen 21814 9.70 13.52 8.17 30 FSL_BULK_SIG 20172 8.73 12.51 7.22 31 BOTNET 18578 4.04 11.52 1.05 32 LOTS_OF_MONEY 17702 9.60 10.98 9.05 33 XMSexyCombo_05 17177 5.38 10.65 3.27 34 HTML_IMAGE_RATIO_04 16808 6.93 10.42 5.53 35 T_XMDrugObfuBody_14 16059 8.32 9.96 7.66 36 UNTRUSTED_Relay 15546 3.74 9.64 1.38 37 TooManyTo_001 15406 9.22 9.55 9.09 38 XM_B_Phish_Phrases 15308 6.69 9.49 5.57 39 LotsOfNums_01 14001 7.96 8.68 7.67 40 XM_H_Long_From01 13847 6.47 8.59 5.62 41 XMSubMetaSx_00 13364 4.64 8.29 3.18 42 TR_XM_DocInvoice 12419 5.51 7.70 4.63 43 BAYES_80 11589 4.54 7.19 3.49 44 XM_UncommonTLD01 10869 4.38 6.74 3.44 45 MPART_ALT_DIFF 10802 3.77 6.70 2.60 46 RCVD_IN_RP_SAFE 9694 8.71 6.01 9.79 47 FROM_EXCESS_BASE64 9166 4.01 5.68 3.33 48 BAYES_60 8727 5.58 5.41 5.64 49 XM_DIRTYINTL 8395 2.84 5.20 1.89 50 MIME_QP_LONG_LINE 8299 5.16 5.15 5.16 51 MIME_HTML_MOSTLY 7952 3.13 4.93 2.41 52 RCVD_IN_RP_CERTIFIED 7826 7.45 4.85 8.49 53 HTML_IMAGE_RATIO_06 7776 3.54 4.82 3.02 54 XM_SendGrid 7554 5.12 4.68 5.29 55 TM2_M_URI_OPT_OUT 7405 2.65 4.59 1.87 56 XMNumbers 7238 3.51 4.49 3.12 57 XMStrtUSub 7040 3.84 4.36 3.64 58 XM_UB50 6977 1.83 4.33 0.83 59 BAYES_95 6662 2.85 4.13 2.33 60 T_REMOTE_IMAGE 6436 4.41 3.99 4.57 61 MultiRelay_CC 6434 1.37 3.99 0.32 62 MultiRelay_Combo 6434 1.37 3.99 0.32 63 RCVD_IN_BL_SPAMCOP_NET 6330 1.58 3.92 0.64 64 XM_SPF_SoftFail 6084 2.57 3.77 2.09 65 HTML_IMAGE_RATIO_08 6036 2.42 3.74 1.90 66 XM_CamelCaseFrm001 5983 2.24 3.71 1.65 67 DKIM_INVALID 5925 3.61 3.67 3.58 68 URI_HEX 5782 1.97 3.58 1.33 69 T_TooManySym_01 5775 4.08 3.58 4.28 70 RELAYCOUNTRY_CA 5614 2.01 3.48 1.42 71 MIME_HTML_ONLY_MULTI 5318 1.72 3.30 1.09 72 XM_URI_RBL 5284 1.05 3.28 0.16 73 RCVD_IN_RP_RNBL 5160 0.94 3.20 0.03 74 XMSexyCombo_01 4618 1.02 2.86 0.28 75 XM_OfRef6 4465 1.80 2.77 1.41 76 RCVD_IN_MSPIKE_WL 4194 3.52 2.60 3.88 77 RCVD_IN_MSPIKE_H3 4168 3.49 2.58 3.86 78 SUBJ_ALL_CAPS 4068 1.89 2.52 1.63 79 RCVD_IN_MSPIKE_H2 3839 4.12 2.38 4.81 80 T_XMDrugObfuBody_08 3408 2.10 2.11 2.09 81 XMDiploma_00 3312 1.53 2.05 1.32 82 RCVD_IN_IADB_LISTED 3303 4.39 2.05 5.33 83 MAILING_LIST_MULTI 3273 2.76 2.03 3.05 84 XMSubMetaI_00 3118 1.10 1.93 0.77 85 HTML_MIME_NO_HTML_TAG 3004 2.09 1.86 2.19 86 SpammyFromTLD_02 2996 0.78 1.86 0.35 87 RCVD_IN_IADB_SPF 2934 3.84 1.82 4.64 88 URIBL_BLACK 2897 0.55 1.80 0.05 89 XM_DK_Undo_01 2842 1.91 1.76 1.98 90 RELAYCOUNTRY_FR 2809 0.68 1.74 0.25 91 XM_HighProb1 2788 0.51 1.73 0.02 92 TM2_M_VERY_LONG_WORD 2765 1.09 1.71 0.85 93 RCVD_IN_IADB_SENDERID 2762 3.44 1.71 4.13 94 RCVD_IN_IADB_DK 2739 3.35 1.70 4.01 95 TooManyTo_002 2710 2.40 1.68 2.69 96 XMBdyGiftCard01 2702 1.08 1.68 0.84 97 XMHTML_After_End 2648 0.73 1.64 0.36 98 SUBJ_DOLLARS 2585 0.65 1.60 0.27 99 BAYES_40 2561 3.20 1.59 3.85 100 SpammyFromTLD_01 2529 1.08 1.57 0.89 101 XM_UB99 2521 0.46 1.56 0.03 102 XMPhish14 2505 0.72 1.55 0.39 103 BAYES_00 2498 6.39 1.55 8.32 104 XM_H_Long_From02 2497 1.02 1.55 0.80 105 TooManyTo_003 2447 1.69 1.52 1.75 106 TR_Mismatch_TLD_02 2444 0.47 1.52 0.06 107 XMBody_17 2406 0.68 1.49 0.35 108 XM_ProductURIs 2391 1.34 1.48 1.28 109 TR_XM_RelayPhish 2356 0.78 1.46 0.51 110 RELAYCOUNTRY_GB 2351 1.30 1.46 1.23 111 BODY_ENHANCEMENT 2315 0.43 1.44 0.02 112 T_MONEY_PERCENT 2280 0.98 1.41 0.81 113 TR_LOTS_OF_MONEY2 2280 0.98 1.41 0.81 114 T_XMDrugObfuBody_00 2261 0.88 1.40 0.67 115 XM_B_REG_HTML 2242 0.75 1.39 0.49 116 XMPhish30 2236 0.72 1.39 0.46 117 XMGenDplmaNmb 2212 0.97 1.37 0.80 118 FILL_THIS_FORM 2146 0.60 1.33 0.31 119 TooManyTo_004 2145 1.28 1.33 1.26 120 T_XMHurry_00 2135 0.76 1.32 0.54 121 URI_TRY_3LD 2131 0.85 1.32 0.67 122 T_FILL_THIS_FORM_SHORT 2088 1.04 1.29 0.94 123 XMBrknScrpt_02 2086 0.86 1.29 0.69 124 XMSubNoVowel 2073 0.63 1.29 0.37 125 BAYES_20 2071 2.30 1.28 2.71 126 TR_XM_DK_Bayes 2011 4.46 1.25 5.74 127 BOTNET_NORDNS 2007 0.37 1.24 0.02 128 TR_XM_DK_Bayes1 1990 4.32 1.23 5.56 129 XM_UB999 1984 0.36 1.23 0.01 130 LONG_JUNK_URI 1978 0.50 1.23 0.20 131 TR_Symld_Words 1977 2.35 1.23 2.79 132 DKIM_ADSP_CUSTOM_MED 1976 1.16 1.23 1.13 133 XMStockSpam_06 1952 1.57 1.21 1.71 134 TooManyTo_005 1941 1.03 1.20 0.96 135 FILL_THIS_FORM_LONG 1940 0.39 1.20 0.06 136 UNPARSEABLE_RELAY 1918 2.73 1.19 3.34 137 FILL_THIS_FORM_LOAN 1899 0.36 1.18 0.03 138 XM_B_COPY_HTML 1873 0.69 1.16 0.51 139 RCVD_IN_MSPIKE_BL 1858 0.66 1.15 0.46 140 XM_BadFromFormat 1829 0.48 1.13 0.22 141 DKIM_ADSP_NXDOMAIN 1809 0.52 1.12 0.28 142 TR_XM_DK_Bayes2 1795 3.45 1.11 4.39 143 ALL_TRUSTED 1754 14.40 1.09 19.73 144 TR_Sbj_FN_Bdy 1743 0.47 1.08 0.23 145 RDNS_DYNAMIC 1742 0.59 1.08 0.39 146 LongTLD 1736 0.41 1.08 0.14 147 XMSubEmpty 1730 0.53 1.07 0.31 148 XM_UB80 1696 0.32 1.05 0.03 149 URG_BIZ 1684 0.33 1.04 0.04 150 XMMoneyMeta_00 1678 0.64 1.04 0.49 151 RELAYCOUNTRY_AT 1675 0.43 1.04 0.19 152 DIET_1 1665 0.46 1.03 0.23 153 RELAYCOUNTRY_IT 1654 0.33 1.03 0.05 154 NML_ADSP_CUSTOM_MED 1583 0.86 0.98 0.81 155 RCVD_IN_IADB_VOUCHED 1575 2.91 0.98 3.68 156 XMBody_78 1560 0.65 0.97 0.53 157 XMNoVowels 1551 0.77 0.96 0.69 158 HTML_FONT_FACE_BAD 1546 0.59 0.96 0.45 159 RCVD_IN_PSBL 1545 0.32 0.96 0.06 160 XM_UB60 1518 0.32 0.94 0.07 161 T_Symld_Words_02 1494 0.55 0.93 0.40 162 HTTPS_HTTP_MISMATCH 1446 0.55 0.90 0.40 163 RELAYCOUNTRY_CN 1413 0.29 0.88 0.06 164 T_HTML_TAG_BALANCE_CENTER 1412 0.37 0.88 0.16 165 URIBL_SBL_A 1410 0.32 0.87 0.10 166 MPART_ALT_DIFF_COUNT 1409 0.41 0.87 0.23 167 XMPhish11 1407 1.03 0.87 1.10 168 XM_RXBody 1395 0.87 0.86 0.87 169 T_TooManySym_02 1385 1.51 0.86 1.77 170 XM_S_JOY_D 1378 0.57 0.85 0.46 171 XM_H_PHPOS 1368 1.12 0.85 1.22 172 RCVD_IN_MSPIKE_L5 1366 0.27 0.85 0.04 173 ANY_BOUNCE_MESSAGE 1333 4.58 0.83 6.09 174 BOUNCE_MESSAGE 1333 4.58 0.83 6.08 175 XM_PDF 1331 3.99 0.83 5.26 176 LOW_PRICE 1329 0.31 0.82 0.10 177 NO_DNS_FOR_FROM 1306 0.40 0.81 0.24 178 HTML_FONT_SIZE_HUGE 1283 0.30 0.80 0.10 179 XM_Hitman 1230 0.25 0.76 0.04 180 RELAYCOUNTRY_DE 1217 0.64 0.75 0.59 181 BAYES_05 1178 1.35 0.73 1.60 182 MISSING_HEADERS 1151 0.56 0.71 0.49 183 URI_NOVOWEL 1144 0.46 0.71 0.37 184 URIBL_DBL_SPAM 1134 0.21 0.70 0.01 185 TR_MetaPhish_Combo_01 1126 0.74 0.70 0.75 186 XMHTMLBadTable_001 1123 0.44 0.70 0.34 187 XM_H_Undi_Recip 1107 0.35 0.69 0.21 188 BODY_URI_ONLY 1091 0.22 0.68 0.04 189 XMSexyCombo_04 1089 0.23 0.68 0.05 190 XM_H_PHPMailer 1067 0.81 0.66 0.87 191 RELAYCOUNTRY_JP 1037 0.21 0.64 0.04 192 XMReplyNow 1033 0.30 0.64 0.16 193 PLING_QUERY 1031 0.34 0.64 0.22 194 HTML_IMAGE_ONLY_28 1031 0.50 0.64 0.44 195 HTML_TAG_BALANCE_BODY 1031 0.46 0.64 0.39 196 XM_GoogleGroups 1029 1.19 0.64 1.41 197 XMClaimOffer 1002 0.35 0.62 0.24 198 LONG_JUNK_URI3 998 0.23 0.62 0.07 199 RELAYCOUNTRY_AU 987 0.53 0.61 0.50 200 MONEY_FRAUD_5 948 0.17 0.59 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333183 86.20 95.18 82.61 2 DKIM_SIGNED 278123 74.07 86.86 68.96 3 XM_DK_Pass 271925 72.28 84.42 67.42 4 DKIM_VALID 263682 70.47 83.19 65.38 5 DCC_CHECK_NEGATIVE 257173 50.63 17.80 63.76 6 BAYES_50 244130 53.24 35.02 60.53 7 DKIM_VALID_AU 189292 52.27 65.60 46.93 8 XMListUnsubscribeExists 175492 51.81 72.57 43.51 9 XM_H_QuotedFrom 138289 40.34 55.46 34.29 10 DCC_CHECK 136521 47.07 80.14 33.85 11 T_TM2_M_HEADER_IN_MSG 133287 28.81 18.21 33.05 12 HTML_FONT_LOW_CONTRAST 92704 26.84 36.47 22.99 13 XMSubLong 84656 22.89 27.63 20.99 14 DKIM_VALID_EF 83445 20.23 19.08 20.69 15 MultiRelay 80582 19.48 18.23 19.98 16 ALL_TRUSTED 79559 14.40 1.09 19.73 17 FVGT_m_MULTI_ODD 79220 22.26 28.82 19.64 18 LOC_TINY_FONT_1 73930 23.59 36.73 18.33 19 MIME_HTML_ONLY 71217 21.17 29.94 17.66 20 T_KAM_HTML_FONT_INVALID 53639 14.79 18.51 13.30 21 XM_DK_Undo_02 49935 22.73 48.60 12.38 22 BAYES_99 46499 20.55 43.10 11.53 23 XM_Multi_Part_URI 43648 12.56 16.89 10.82 24 XM_Body_Dirty_Words 42225 13.70 21.77 10.47 25 BAYES_999 40843 17.79 36.94 10.13 26 RCVD_IN_RP_SAFE 39499 8.71 6.01 9.79 27 XM_DKIMWhitelistDomains 39456 6.99 0.02 9.78 28 TooManyTo_001 36657 9.22 9.55 9.09 29 LOTS_OF_MONEY 36501 9.60 10.98 9.05 30 RCVD_IN_RP_CERTIFIED 34254 7.45 4.85 8.49 31 BAYES_00 33564 6.39 1.55 8.32 32 XM_Evil_Numbers_Gen 32937 9.70 13.52 8.17 33 LotsOfNums_01 30930 7.96 8.68 7.67 34 T_XMDrugObfuBody_14 30909 8.32 9.96 7.66 35 FSL_BULK_SIG 29119 8.73 12.51 7.22 36 HTML_IMAGE_RATIO_02 25635 9.52 17.43 6.36 37 ANY_BOUNCE_MESSAGE 24543 4.58 0.83 6.09 38 BOUNCE_MESSAGE 24540 4.58 0.83 6.08 39 TR_XM_DK_Bayes 23150 4.46 1.25 5.74 40 IN_ZIMBRA_NJ_WHITELIST 22842 4.06 0.04 5.66 41 TR_DCC_Bayes_99 22777 13.90 34.52 5.65 42 BAYES_60 22762 5.58 5.41 5.64 43 XM_H_Long_From01 22659 6.47 8.59 5.62 44 RELAYCOUNTRY_META 22624 8.76 16.65 5.61 45 XM_B_Phish_Phrases 22474 6.69 9.49 5.57 46 TR_XM_DK_Bayes1 22412 4.32 1.23 5.56 47 HTML_IMAGE_RATIO_04 22307 6.93 10.42 5.53 48 RCVD_IN_IADB_LISTED 21495 4.39 2.05 5.33 49 XM_SendGrid 21340 5.12 4.68 5.29 50 XM_PDF 21210 3.99 0.83 5.26 51 MIME_QP_LONG_LINE 20826 5.16 5.15 5.16 52 RCVD_IN_MSPIKE_H2 19401 4.12 2.38 4.81 53 RCVD_IN_IADB_SPF 18724 3.84 1.82 4.64 54 TR_XM_DocInvoice 18665 5.51 7.70 4.63 55 T_REMOTE_IMAGE 18448 4.41 3.99 4.57 56 TR_XM_DK_Bayes2 17701 3.45 1.11 4.39 57 T_TooManySym_01 17244 4.08 3.58 4.28 58 RCVD_IN_IADB_SENDERID 16675 3.44 1.71 4.13 59 RCVD_IN_IADB_DK 16165 3.35 1.70 4.01 60 BOTNET_IPINHOSTNAME 16093 6.78 13.76 3.99 61 RCVD_IN_MSPIKE_WL 15656 3.52 2.60 3.88 62 RCVD_IN_MSPIKE_H3 15558 3.49 2.58 3.86 63 BAYES_40 15508 3.20 1.59 3.85 64 RCVD_IN_IADB_VOUCHED 14854 2.91 0.98 3.68 65 XMStrtUSub 14667 3.84 4.36 3.64 66 DKIM_INVALID 14441 3.61 3.67 3.58 67 BAYES_80 14070 4.54 7.19 3.49 68 XM_UncommonTLD01 13875 4.38 6.74 3.44 69 UNPARSEABLE_RELAY 13488 2.73 1.19 3.34 70 FROM_EXCESS_BASE64 13449 4.01 5.68 3.33 71 XMSexyCombo_05 13177 5.38 10.65 3.27 72 XMSubMetaSx_00 12841 4.64 8.29 3.18 73 XMNumbers 12583 3.51 4.49 3.12 74 MAILING_LIST_MULTI 12300 2.76 2.03 3.05 75 HTML_IMAGE_RATIO_06 12195 3.54 4.82 3.02 76 TR_Symld_Words 11266 2.35 1.23 2.79 77 BAYES_20 10918 2.30 1.28 2.71 78 TooManyTo_002 10867 2.40 1.68 2.69 79 TVD_RCVD_IP 10589 1.96 0.31 2.63 80 MPART_ALT_DIFF 10489 3.77 6.70 2.60 81 HELO_NODOT 10085 1.88 0.34 2.50 82 MIME_HTML_MOSTLY 9717 3.13 4.93 2.41 83 BAYES_95 9403 2.85 4.13 2.33 84 HTML_MIME_NO_HTML_TAG 8823 2.09 1.86 2.19 85 IN_HORDE_ADDRESS_BOOK 8710 1.57 0.08 2.16 86 T_XMDrugObfuBody_08 8447 2.10 2.11 2.09 87 XM_SPF_SoftFail 8427 2.57 3.77 2.09 88 XM_DK_Undo_01 7970 1.91 1.76 1.98 89 HTML_IMAGE_RATIO_08 7646 2.42 3.74 1.90 90 XM_DIRTYINTL 7634 2.84 5.20 1.89 91 TM2_M_URI_OPT_OUT 7540 2.65 4.59 1.87 92 T_TooManySym_02 7125 1.51 0.86 1.77 93 TooManyTo_003 7068 1.69 1.52 1.75 94 USER_IN_DEF_DKIM_WL 7051 1.28 0.10 1.75 95 INVALID_MSGID 6943 1.29 0.22 1.72 96 XMStockSpam_06 6911 1.57 1.21 1.71 97 RCVD_IN_IADB_OPTIN 6796 1.35 0.51 1.69 98 XM_CamelCaseFrm001 6673 2.24 3.71 1.65 99 SUBJ_ALL_CAPS 6589 1.89 2.52 1.63 100 BAYES_05 6467 1.35 0.73 1.60 101 TO_MALFORMED 6317 1.12 0.01 1.57 102 RELAYCOUNTRY_CA 5710 2.01 3.48 1.42 103 XM_GoogleGroups 5705 1.19 0.64 1.41 104 XM_OfRef6 5691 1.80 2.77 1.41 105 XMCapTrack 5684 1.15 0.49 1.41 106 UNTRUSTED_Relay 5568 3.74 9.64 1.38 107 URI_HEX 5349 1.97 3.58 1.33 108 XMDiploma_00 5308 1.53 2.05 1.32 109 XM_ProductURIs 5150 1.34 1.48 1.28 110 TooManyTo_004 5065 1.28 1.33 1.26 111 RELAYCOUNTRY_GB 4974 1.30 1.46 1.23 112 XM_H_PHPOS 4934 1.12 0.85 1.22 113 DKIM_ADSP_CUSTOM_MED 4564 1.16 1.23 1.13 114 XMPhish11 4419 1.03 0.87 1.10 115 MIME_HTML_ONLY_MULTI 4412 1.72 3.30 1.09 116 BOTNET 4244 4.04 11.52 1.05 117 TooManyTo_005 3874 1.03 1.20 0.96 118 T_FILL_THIS_FORM_SHORT 3782 1.04 1.29 0.94 119 SpammyFromTLD_01 3595 1.08 1.57 0.89 120 XM_H_PHPMailer 3518 0.81 0.66 0.87 121 XM_RXBody 3490 0.87 0.86 0.87 122 TM2_M_VERY_LONG_WORD 3416 1.09 1.71 0.85 123 XMBdyGiftCard01 3382 1.08 1.68 0.84 124 XM_UB50 3353 1.83 4.33 0.83 125 XM_ShortIntro_01 3280 0.71 0.44 0.81 126 NML_ADSP_CUSTOM_MED 3263 0.86 0.98 0.81 127 TR_LOTS_OF_MONEY2 3257 0.98 1.41 0.81 128 T_MONEY_PERCENT 3257 0.98 1.41 0.81 129 XMGenDplmaNmb 3243 0.97 1.37 0.80 130 XM_H_Long_From02 3234 1.02 1.55 0.80 131 XMSubMetaI_00 3099 1.10 1.93 0.77 132 T_TooManySym_03 3061 0.61 0.25 0.76 133 TR_MetaPhish_Combo_01 3037 0.74 0.70 0.75 134 USER_IN_WHITELIST 2999 0.53 0.00 0.74 135 T_OBFU_PDF_ATTACH 2848 0.57 0.23 0.71 136 XMNoVowels 2787 0.77 0.96 0.69 137 XMBrknScrpt_02 2786 0.86 1.29 0.69 138 T_XMDrugObfuBody_00 2694 0.88 1.40 0.67 139 URI_TRY_3LD 2686 0.85 1.32 0.67 140 XMBody_95 2632 0.52 0.19 0.65 141 RCVD_IN_BL_SPAMCOP_NET 2573 1.58 3.92 0.64 142 XMGappySubj_01 2565 0.59 0.47 0.64 143 RCVD_IN_IADB_DOPTIN 2562 0.48 0.09 0.64 144 RCVD_IN_SORBS_DUL 2528 0.50 0.18 0.63 145 SHORT_HELO_AND_INLINE_IMAGE 2424 0.45 0.06 0.60 146 RELAYCOUNTRY_DE 2396 0.64 0.75 0.59 147 AC_DIV_BONANZA 2372 0.45 0.11 0.59 148 XMSubMetaSxObfu_02 2203 0.45 0.22 0.55 149 T_XMHurry_00 2179 0.76 1.32 0.54 150 XMBody_78 2135 0.65 0.97 0.53 151 XMSlimDrugH 2082 0.49 0.42 0.52 152 TR_XM_RelayPhish 2074 0.78 1.46 0.51 153 XM_B_COPY_HTML 2041 0.69 1.16 0.51 154 RELAYCOUNTRY_AU 2004 0.53 0.61 0.50 155 XM_B_REG_HTML 1996 0.75 1.39 0.49 156 MISSING_HEADERS 1987 0.56 0.71 0.49 157 XMMoneyMeta_00 1962 0.64 1.04 0.49 158 HTML_IMAGE_ONLY_32 1932 0.42 0.27 0.48 159 TM2_M_A_HREF_HREF 1921 0.47 0.44 0.48 160 TM2_M_BODY_EMPTY 1889 0.39 0.19 0.47 161 RCVD_IN_MSPIKE_BL 1845 0.66 1.15 0.46 162 XM_S_JOY_D 1841 0.57 0.85 0.46 163 XMPhish30 1836 0.72 1.39 0.46 164 XMhairloss01 1807 0.33 0.02 0.45 165 HTML_FONT_FACE_BAD 1802 0.59 0.96 0.45 166 HTML_IMAGE_ONLY_28 1782 0.50 0.64 0.44 167 DOS_OUTLOOK_TO_MX 1722 0.35 0.15 0.43 168 XMLKML 1668 0.30 0.00 0.41 169 RCVD_IN_MSPIKE_L3 1646 0.35 0.21 0.41 170 T_Symld_Words_02 1633 0.55 0.93 0.40 171 HTTPS_HTTP_MISMATCH 1632 0.55 0.90 0.40 172 XM_B_TRADE_HTML 1631 0.41 0.43 0.40 173 XMDateMe_00 1617 0.38 0.32 0.40 174 XM_H_PHPOS_M 1610 0.40 0.39 0.40 175 XM_USANA_RCVD 1607 0.28 0.00 0.40 176 HTML_IMAGE_ONLY_24 1604 0.41 0.45 0.40 177 HTML_IMAGE_ONLY_20 1601 0.37 0.31 0.40 178 XMPhish14 1587 0.72 1.55 0.39 179 RDNS_DYNAMIC 1563 0.59 1.08 0.39 180 HTML_TAG_BALANCE_BODY 1556 0.46 0.64 0.39 181 FORGED_GMAIL_RCVD 1535 0.44 0.58 0.38 182 XMSubNoVowel 1494 0.63 1.29 0.37 183 URI_NOVOWEL 1474 0.46 0.71 0.37 184 XMHTML_After_End 1469 0.73 1.64 0.36 185 XMBSHREFv2 1457 0.35 0.32 0.36 186 XMBody_17 1428 0.68 1.49 0.35 187 SpammyFromTLD_02 1417 0.78 1.86 0.35 188 XMSolicitRefs_0 1382 0.36 0.40 0.34 189 XMHTMLBadTable_001 1372 0.44 0.70 0.34 190 XM_Lotto 1310 0.32 0.32 0.32 191 T_TooManySym_04 1300 0.25 0.06 0.32 192 MultiRelay_Combo 1297 1.37 3.99 0.32 193 MultiRelay_CC 1297 1.37 3.99 0.32 194 FILL_THIS_FORM 1267 0.60 1.33 0.31 195 GMD_PDF_EMPTY_BODY 1253 0.24 0.08 0.31 196 MSGID_FROM_MTA_HEADER 1251 0.28 0.20 0.31 197 XMSubEmpty 1244 0.53 1.07 0.31 198 TVD_SPACE_RATIO 1185 0.33 0.43 0.29 199 HTML_IMAGE_ONLY_16 1156 0.35 0.51 0.29 200 XMLngstWrd_00 1128 0.36 0.57 0.28 ----------------------------------------------------------------------