Email: 547580 Autolearn: 0 AvgScore: 3.06 AvgScanTime: 4.35 sec Spam: 161868 Autolearn: 0 AvgScore: 12.26 AvgScanTime: 4.98 sec Ham: 385712 Autolearn: 0 AvgScore: -0.79 AvgScanTime: 4.08 sec Time Spent Running SA: 661.33 hours Time Spent Processing Spam: 223.75 hours Time Spent Processing Ham: 437.58 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154755 87.31 95.61 83.83 2 DKIM_SIGNED 135990 74.19 84.01 70.07 3 XM_DK_Pass 132772 72.63 82.02 68.68 4 DKIM_VALID 128296 69.54 79.26 65.46 5 DCC_CHECK 126299 48.36 78.03 35.91 6 XMListUnsubscribeExists 116430 52.69 71.93 44.62 7 DKIM_VALID_AU 101476 50.94 62.69 46.01 8 XM_H_QuotedFrom 90429 41.26 55.87 35.13 9 XM_DK_Undo_02 75950 22.87 46.92 12.77 10 BAYES_99 66738 20.48 41.23 11.78 11 HTML_FONT_LOW_CONTRAST 64874 29.08 40.08 24.47 12 BAYES_50 60020 51.81 37.08 57.99 13 BAYES_999 57599 17.89 35.58 10.47 14 LOC_TINY_FONT_1 57591 24.02 35.58 19.16 15 MIME_HTML_ONLY 54597 22.83 33.73 18.26 16 TR_DCC_Bayes_99 53634 14.13 33.13 6.15 17 XMSubLong 49024 24.09 30.29 21.49 18 FVGT_m_MULTI_ODD 41602 21.40 25.70 19.60 19 XM_Body_Dirty_Words 32440 14.01 20.04 11.48 20 DCC_CHECK_NEGATIVE 32227 49.38 19.91 61.75 21 HTML_IMAGE_RATIO_02 30260 11.07 18.69 7.88 22 T_TM2_M_HEADER_IN_MSG 29089 26.48 17.97 30.06 23 T_KAM_HTML_FONT_INVALID 28474 14.93 17.59 13.81 24 DKIM_VALID_EF 27865 20.36 17.21 21.67 25 MultiRelay 26171 18.30 16.17 19.19 26 RELAYCOUNTRY_META 26053 8.44 16.10 5.22 27 XM_Multi_Part_URI 25608 12.62 15.82 11.28 28 XM_Evil_Numbers_Gen 22835 9.94 14.11 8.19 29 BOTNET_IPINHOSTNAME 20745 6.80 12.82 4.28 30 TooManyTo_001 20570 9.87 12.71 8.68 31 FSL_BULK_SIG 18367 8.41 11.35 7.18 32 BOTNET 17608 4.05 10.88 1.18 33 T_XMDrugObfuBody_14 17340 8.52 10.71 7.60 34 LOTS_OF_MONEY 17159 10.40 10.60 10.32 35 XM_UncommonTLD01 16673 5.49 10.30 3.47 36 XMSexyCombo_05 16574 5.62 10.24 3.68 37 UNTRUSTED_Relay 14807 3.59 9.15 1.25 38 HTML_IMAGE_RATIO_04 14792 6.35 9.14 5.19 39 LotsOfNums_01 14751 8.33 9.11 8.00 40 HTML_IMAGE_RATIO_06 14046 5.00 8.68 3.46 41 XMSubMetaSx_00 13720 5.30 8.48 3.97 42 TR_XM_DocInvoice 13577 5.22 8.39 3.89 43 XM_B_Phish_Phrases 13549 6.33 8.37 5.48 44 XM_H_Long_From01 13160 6.52 8.13 5.84 45 FROM_EXCESS_BASE64 11626 4.72 7.18 3.69 46 MPART_ALT_DIFF 11466 3.76 7.08 2.37 47 BAYES_80 11287 4.67 6.97 3.71 48 RCVD_IN_RP_SAFE 10986 8.75 6.79 9.58 49 BAYES_60 9435 6.04 5.83 6.12 50 TooManyTo_002 9021 3.59 5.57 2.76 51 MIME_QP_LONG_LINE 8895 5.21 5.50 5.09 52 TooManyTo_003 8801 2.90 5.44 1.83 53 RCVD_IN_RP_CERTIFIED 8521 7.32 5.26 8.18 54 TooManyTo_004 8493 2.48 5.25 1.32 55 SpammyFromTLD_01 8358 2.14 5.16 0.87 56 MIME_HTML_MOSTLY 8300 3.05 5.13 2.18 57 TooManyTo_005 8158 2.21 5.04 1.02 58 ALL_TRUSTED 8079 15.05 4.99 19.27 59 XMNumbers 7751 3.85 4.79 3.46 60 XM_UB50 7725 1.98 4.77 0.81 61 DKIM_INVALID 7694 4.65 4.75 4.61 62 XM_H_PHPOS 7653 2.19 4.73 1.13 63 XM_DIRTYINTL 7032 2.53 4.34 1.77 64 T_TooManySym_01 7030 4.31 4.34 4.29 65 XMStrtUSub 6830 4.13 4.22 4.09 66 T_REMOTE_IMAGE 6788 4.62 4.19 4.80 67 RCVD_IN_BL_SPAMCOP_NET 6612 1.66 4.08 0.65 68 URI_HEX 6515 1.98 4.02 1.13 69 BAYES_95 6461 2.73 3.99 2.21 70 XM_OfRef6 6064 1.91 3.75 1.14 71 XM_SendGrid 6047 4.80 3.74 5.25 72 TM2_M_URI_OPT_OUT 6035 2.43 3.73 1.89 73 MultiRelay_CC 5803 1.24 3.59 0.26 74 MultiRelay_Combo 5803 1.24 3.59 0.26 75 TVD_SPACE_RATIO_MINFP 5431 1.00 3.36 0.01 76 XM_URI_RBL 5409 1.09 3.34 0.14 77 RELAYCOUNTRY_CA 5309 1.89 3.28 1.31 78 XM_SPF_SoftFail 5140 2.22 3.18 1.81 79 MIME_HTML_ONLY_MULTI 4953 1.71 3.06 1.14 80 XM_CamelCaseFrm001 4799 2.07 2.96 1.69 81 T_XMHurry_00 4128 1.12 2.55 0.53 82 XMSubMetaI_00 3971 1.12 2.45 0.57 83 T_XMDrugObfuBody_08 3929 2.40 2.43 2.39 84 XMDiploma_00 3928 1.88 2.43 1.64 85 XMSexyCombo_01 3791 1.29 2.34 0.85 86 HTML_IMAGE_RATIO_08 3787 1.85 2.34 1.64 87 HTML_MIME_NO_HTML_TAG 3523 2.13 2.18 2.11 88 XM_ProductURIs 3406 1.25 2.10 0.89 89 TM2_M_VERY_LONG_WORD 3340 1.16 2.06 0.78 90 SUBJ_ALL_CAPS 3327 2.02 2.06 2.01 91 RELAYCOUNTRY_GB 3326 1.47 2.05 1.23 92 URI_WP_HACKED_2 3264 0.68 2.02 0.12 93 RCVD_IN_IADB_LISTED 3220 4.76 1.99 5.93 94 SpammyFromTLD_02 3104 0.81 1.92 0.35 95 XMBdyGiftCard01 3036 1.09 1.88 0.75 96 RCVD_IN_MSPIKE_H2 3025 3.68 1.87 4.43 97 RCVD_IN_RP_RNBL 3004 0.57 1.86 0.03 98 BAYES_00 2938 7.23 1.82 9.50 99 FILL_THIS_FORM 2876 0.67 1.78 0.21 100 RCVD_IN_IADB_SPF 2843 4.09 1.76 5.08 101 RCVD_IN_MSPIKE_WL 2761 3.73 1.71 4.59 102 RCVD_IN_MSPIKE_H3 2751 3.72 1.70 4.57 103 URI_TRY_3LD 2741 1.13 1.69 0.89 104 FILL_THIS_FORM_LONG 2681 0.53 1.66 0.06 105 XM_B_REG_HTML 2677 0.82 1.65 0.47 106 RCVD_IN_IADB_SENDERID 2662 3.62 1.64 4.45 107 RCVD_IN_IADB_DK 2632 3.49 1.63 4.28 108 XM_UB99 2600 0.48 1.61 0.01 109 XMBody_17 2559 0.85 1.58 0.55 110 XM_RXBody 2536 0.61 1.57 0.20 111 XM_DK_Undo_01 2505 1.86 1.55 1.99 112 TR_XM_DK_Bayes 2452 5.22 1.51 6.78 113 XMGenDplmaNmb 2404 1.22 1.49 1.10 114 BODY_ENHANCEMENT 2399 0.45 1.48 0.02 115 XM_H_Long_From02 2392 1.10 1.48 0.94 116 TR_XM_DK_Bayes1 2378 4.87 1.47 6.29 117 XMBody_78 2340 0.91 1.45 0.69 118 MAILING_LIST_MULTI 2293 2.23 1.42 2.57 119 XMPhish30 2282 0.76 1.41 0.49 120 TR_XM_DK_Bayes2 2272 3.58 1.40 4.49 121 HTML_SHORT_LINK_IMG_1 2234 0.44 1.38 0.04 122 XM_HighProb1 2232 0.42 1.38 0.01 123 BODY_URI_ONLY 2178 0.44 1.35 0.05 124 RELAYCOUNTRY_FR 2174 0.60 1.34 0.29 125 BAYES_40 2172 3.15 1.34 3.91 126 FILL_THIS_FORM_LOAN 2152 0.42 1.33 0.04 127 T_FILL_THIS_FORM_SHORT 2117 1.04 1.31 0.93 128 TR_XM_RelayPhish 2096 0.70 1.29 0.46 129 XM_BadFromFormat 2082 0.50 1.29 0.17 130 XMHTML_After_End 2081 0.63 1.29 0.36 131 T_MONEY_PERCENT 2037 0.88 1.26 0.73 132 TR_LOTS_OF_MONEY2 2037 0.88 1.26 0.73 133 URIBL_BLACK 2035 0.40 1.26 0.03 134 T_MIXED_ES 2027 0.83 1.25 0.65 135 XM_B_COPY_HTML 2010 0.72 1.24 0.50 136 XMSubNoVowel 1950 0.63 1.20 0.38 137 XM_UB999 1941 0.36 1.20 0.01 138 PLING_QUERY 1939 0.55 1.20 0.28 139 XMStockSpam_06 1834 1.49 1.13 1.64 140 BAYES_20 1796 2.38 1.11 2.91 141 UNPARSEABLE_RELAY 1785 2.61 1.10 3.24 142 T_TooManySym_02 1729 1.43 1.07 1.58 143 RELAYCOUNTRY_AT 1724 0.41 1.07 0.13 144 SUBJ_DOLLARS 1704 0.45 1.05 0.20 145 XMSexyCombo_04 1650 0.33 1.02 0.05 146 TR_Symld_Words 1642 2.19 1.01 2.68 147 RELAYCOUNTRY_DE 1620 0.59 1.00 0.42 148 T_XMDrugObfuBody_00 1613 0.77 1.00 0.67 149 XMPhish11 1590 1.14 0.98 1.21 150 XMSubEmpty 1589 0.51 0.98 0.31 151 HTML_TAG_BALANCE_BODY 1583 0.62 0.98 0.47 152 BOTNET_NORDNS 1571 0.30 0.97 0.02 153 RELAYCOUNTRY_JP 1567 0.31 0.97 0.03 154 HTML_FONT_FACE_BAD 1531 0.51 0.95 0.33 155 THIS_AD 1506 0.40 0.93 0.17 156 XM_S_JOY_D 1444 0.78 0.89 0.74 157 DIET_1 1444 0.39 0.89 0.19 158 XMBrknScrpt_02 1428 0.85 0.88 0.84 159 XMSubMetaSSx_00 1416 0.36 0.87 0.15 160 XMPhish14 1410 0.65 0.87 0.56 161 RDNS_DYNAMIC 1410 0.54 0.87 0.40 162 LONG_JUNK_URI 1398 0.33 0.86 0.10 163 RCVD_IN_IADB_VOUCHED 1373 3.23 0.85 4.23 164 XM_UB60 1371 0.29 0.85 0.06 165 T_Symld_Words_02 1366 0.49 0.84 0.35 166 HTTPS_HTTP_MISMATCH 1353 0.56 0.84 0.45 167 HTML_IMAGE_ONLY_08 1328 0.35 0.82 0.15 168 TR_LOTS_OF_MONEY3 1319 0.49 0.81 0.36 169 XM_Body_Obfu01 1319 0.48 0.81 0.34 170 MPART_ALT_DIFF_COUNT 1313 0.39 0.81 0.21 171 TR_Mismatch_TLD_02 1309 0.28 0.81 0.05 172 ANY_BOUNCE_MESSAGE 1304 4.08 0.81 5.45 173 BOUNCE_MESSAGE 1304 4.08 0.81 5.45 174 RELAYCOUNTRY_AU 1292 0.61 0.80 0.53 175 XMClaimOffer 1292 0.31 0.80 0.11 176 URIBL_DBL_SPAM 1272 0.23 0.79 0.00 177 RCVD_IN_MSPIKE_BL 1248 0.61 0.77 0.54 178 XMSubMetaSxObfu_04 1246 0.29 0.77 0.09 179 DKIM_ADSP_CUSTOM_MED 1239 1.02 0.77 1.12 180 XMHTMLBadTable_001 1229 0.62 0.76 0.57 181 XMSlimDrugH 1194 0.38 0.74 0.22 182 RCVD_IN_PSBL 1184 0.26 0.73 0.06 183 XM_OfRef7 1175 0.34 0.73 0.18 184 DKIM_ADSP_NXDOMAIN 1162 0.44 0.72 0.33 185 CHARSET_FARAWAY_HEADER 1152 0.26 0.71 0.07 186 XMMoneyMeta_00 1144 0.53 0.71 0.45 187 RELAYCOUNTRY_CN 1122 0.25 0.69 0.07 188 XM_UB80 1108 0.21 0.68 0.02 189 HTML_IMAGE_ONLY_04 1105 0.26 0.68 0.08 190 LongTLD 1090 0.30 0.67 0.14 191 XM_PDF 1084 3.66 0.67 4.92 192 REMOVE_BEFORE_LINK 1083 0.44 0.67 0.34 193 INVALID_MSGID 1075 1.45 0.66 1.78 194 HTML_SHORT_CENTER 1045 0.19 0.65 0.00 195 T_HTML_TAG_BALANCE_CENTER 1044 0.29 0.64 0.14 196 TR_Caps_n_Bayes_99 1025 0.27 0.63 0.12 197 BAYES_05 1018 1.52 0.63 1.89 198 XM_XX_Yahoo 1000 0.27 0.62 0.12 199 XM_H_Undi_Recip 961 0.32 0.59 0.21 200 XMSubMetaSxObfu_03 956 0.47 0.59 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 323344 87.31 95.61 83.83 2 DKIM_SIGNED 270276 74.19 84.01 70.07 3 XM_DK_Pass 264908 72.63 82.02 68.68 4 DKIM_VALID 252496 69.54 79.26 65.46 5 DCC_CHECK_NEGATIVE 238174 49.38 19.91 61.75 6 BAYES_50 223656 51.81 37.08 57.99 7 DKIM_VALID_AU 177449 50.94 62.69 46.01 8 XMListUnsubscribeExists 172103 52.69 71.93 44.62 9 DCC_CHECK 138496 48.36 78.03 35.91 10 XM_H_QuotedFrom 135510 41.26 55.87 35.13 11 T_TM2_M_HEADER_IN_MSG 115932 26.48 17.97 30.06 12 HTML_FONT_LOW_CONTRAST 94379 29.08 40.08 24.47 13 DKIM_VALID_EF 83599 20.36 17.21 21.67 14 XMSubLong 82897 24.09 30.29 21.49 15 FVGT_m_MULTI_ODD 75600 21.40 25.70 19.60 16 ALL_TRUSTED 74314 15.05 4.99 19.27 17 MultiRelay 74019 18.30 16.17 19.19 18 LOC_TINY_FONT_1 73911 24.02 35.58 19.16 19 MIME_HTML_ONLY 70422 22.83 33.73 18.26 20 T_KAM_HTML_FONT_INVALID 53268 14.93 17.59 13.81 21 XM_DK_Undo_02 49256 22.87 46.92 12.77 22 BAYES_99 45419 20.48 41.23 11.78 23 XM_Body_Dirty_Words 44288 14.01 20.04 11.48 24 XM_DKIMWhitelistDomains 44157 8.07 0.02 11.45 25 XM_Multi_Part_URI 43494 12.62 15.82 11.28 26 BAYES_999 40382 17.89 35.58 10.47 27 LOTS_OF_MONEY 39816 10.40 10.60 10.32 28 RCVD_IN_RP_SAFE 36954 8.75 6.79 9.58 29 BAYES_00 36642 7.23 1.82 9.50 30 TooManyTo_001 33491 9.87 12.71 8.68 31 XM_Evil_Numbers_Gen 31594 9.94 14.11 8.19 32 RCVD_IN_RP_CERTIFIED 31570 7.32 5.26 8.18 33 LotsOfNums_01 30850 8.33 9.11 8.00 34 HTML_IMAGE_RATIO_02 30377 11.07 18.69 7.88 35 T_XMDrugObfuBody_14 29295 8.52 10.71 7.60 36 FSL_BULK_SIG 27700 8.41 11.35 7.18 37 TR_XM_DK_Bayes 26150 5.22 1.51 6.78 38 TR_XM_DK_Bayes1 24280 4.87 1.47 6.29 39 TR_DCC_Bayes_99 23733 14.13 33.13 6.15 40 BAYES_60 23618 6.04 5.83 6.12 41 RCVD_IN_IADB_LISTED 22860 4.76 1.99 5.93 42 XM_H_Long_From01 22543 6.52 8.13 5.84 43 IN_ZIMBRA_NJ_WHITELIST 21989 4.02 0.03 5.70 44 XM_B_Phish_Phrases 21130 6.33 8.37 5.48 45 ANY_BOUNCE_MESSAGE 21025 4.08 0.81 5.45 46 BOUNCE_MESSAGE 21024 4.08 0.81 5.45 47 XM_SendGrid 20240 4.80 3.74 5.25 48 RELAYCOUNTRY_META 20141 8.44 16.10 5.22 49 HTML_IMAGE_RATIO_04 20006 6.35 9.14 5.19 50 MIME_QP_LONG_LINE 19634 5.21 5.50 5.09 51 RCVD_IN_IADB_SPF 19577 4.09 1.76 5.08 52 XM_PDF 18962 3.66 0.67 4.92 53 T_REMOTE_IMAGE 18508 4.62 4.19 4.80 54 DKIM_INVALID 17780 4.65 4.75 4.61 55 RCVD_IN_MSPIKE_WL 17691 3.73 1.71 4.59 56 RCVD_IN_MSPIKE_H3 17612 3.72 1.70 4.57 57 TR_XM_DK_Bayes2 17305 3.58 1.40 4.49 58 RCVD_IN_IADB_SENDERID 17165 3.62 1.64 4.45 59 RCVD_IN_MSPIKE_H2 17100 3.68 1.87 4.43 60 T_TooManySym_01 16559 4.31 4.34 4.29 61 BOTNET_IPINHOSTNAME 16517 6.80 12.82 4.28 62 RCVD_IN_IADB_DK 16492 3.49 1.63 4.28 63 RCVD_IN_IADB_VOUCHED 16312 3.23 0.85 4.23 64 XMStrtUSub 15767 4.13 4.22 4.09 65 XMSubMetaSx_00 15317 5.30 8.48 3.97 66 BAYES_40 15077 3.15 1.34 3.91 67 TR_XM_DocInvoice 15010 5.22 8.39 3.89 68 BAYES_80 14295 4.67 6.97 3.71 69 FROM_EXCESS_BASE64 14216 4.72 7.18 3.69 70 XMSexyCombo_05 14206 5.62 10.24 3.68 71 XM_UncommonTLD01 13367 5.49 10.30 3.47 72 XMNumbers 13354 3.85 4.79 3.46 73 HTML_IMAGE_RATIO_06 13337 5.00 8.68 3.46 74 UNPARSEABLE_RELAY 12504 2.61 1.10 3.24 75 BAYES_20 11219 2.38 1.11 2.91 76 TooManyTo_002 10643 3.59 5.57 2.76 77 TR_Symld_Words 10344 2.19 1.01 2.68 78 TVD_RCVD_IP 10161 1.92 0.23 2.63 79 MAILING_LIST_MULTI 9922 2.23 1.42 2.57 80 T_XMDrugObfuBody_08 9227 2.40 2.43 2.39 81 MPART_ALT_DIFF 9150 3.76 7.08 2.37 82 HELO_NODOT 8636 1.66 0.29 2.24 83 BAYES_95 8505 2.73 3.99 2.21 84 IN_HORDE_ADDRESS_BOOK 8455 1.56 0.05 2.19 85 MIME_HTML_MOSTLY 8398 3.05 5.13 2.18 86 HTML_MIME_NO_HTML_TAG 8124 2.13 2.18 2.11 87 SUBJ_ALL_CAPS 7745 2.02 2.06 2.01 88 XM_DK_Undo_01 7688 1.86 1.55 1.99 89 RCVD_IN_IADB_OPTIN 7636 1.54 0.48 1.98 90 BAYES_05 7280 1.52 0.63 1.89 91 TM2_M_URI_OPT_OUT 7277 2.43 3.73 1.89 92 TooManyTo_003 7072 2.90 5.44 1.83 93 XM_SPF_SoftFail 6991 2.22 3.18 1.81 94 INVALID_MSGID 6862 1.45 0.66 1.78 95 XM_DIRTYINTL 6823 2.53 4.34 1.77 96 XM_CamelCaseFrm001 6533 2.07 2.96 1.69 97 HTML_IMAGE_RATIO_08 6344 1.85 2.34 1.64 98 XMDiploma_00 6342 1.88 2.43 1.64 99 XMStockSpam_06 6319 1.49 1.13 1.64 100 TO_MALFORMED 6113 1.12 0.01 1.58 101 T_TooManySym_02 6078 1.43 1.07 1.58 102 USER_IN_DEF_DKIM_WL 5837 1.10 0.10 1.51 103 XMCapTrack 5184 1.07 0.40 1.34 104 TooManyTo_004 5097 2.48 5.25 1.32 105 RELAYCOUNTRY_CA 5040 1.89 3.28 1.31 106 UNTRUSTED_Relay 4831 3.59 9.15 1.25 107 RELAYCOUNTRY_GB 4741 1.47 2.05 1.23 108 XMPhish11 4665 1.14 0.98 1.21 109 BOTNET 4558 4.05 10.88 1.18 110 MIME_HTML_ONLY_MULTI 4416 1.71 3.06 1.14 111 XM_OfRef6 4380 1.91 3.75 1.14 112 XM_H_PHPOS 4354 2.19 4.73 1.13 113 URI_HEX 4340 1.98 4.02 1.13 114 DKIM_ADSP_CUSTOM_MED 4330 1.02 0.77 1.12 115 XMGappySubj_01 4302 0.93 0.47 1.12 116 XM_GoogleGroups 4302 0.92 0.46 1.12 117 XMGenDplmaNmb 4250 1.22 1.49 1.10 118 TooManyTo_005 3950 2.21 5.04 1.02 119 XMBody_95 3708 0.73 0.18 0.96 120 XM_H_Long_From02 3615 1.10 1.48 0.94 121 T_FILL_THIS_FORM_SHORT 3594 1.04 1.31 0.93 122 URI_TRY_3LD 3429 1.13 1.69 0.89 123 XM_ProductURIs 3415 1.25 2.10 0.89 124 SpammyFromTLD_01 3352 2.14 5.16 0.87 125 XMSexyCombo_01 3277 1.29 2.34 0.85 126 XMBrknScrpt_02 3249 0.85 0.88 0.84 127 USER_IN_WHITELIST 3183 0.58 0.00 0.83 128 NML_ADSP_CUSTOM_MED 3180 0.75 0.57 0.82 129 XM_UB50 3121 1.98 4.77 0.81 130 RCVD_IN_IADB_DOPTIN 3054 0.59 0.10 0.79 131 TM2_M_VERY_LONG_WORD 3008 1.16 2.06 0.78 132 XMBdyGiftCard01 2911 1.09 1.88 0.75 133 XM_S_JOY_D 2849 0.78 0.89 0.74 134 T_MONEY_PERCENT 2798 0.88 1.26 0.73 135 TR_LOTS_OF_MONEY2 2798 0.88 1.26 0.73 136 XM_H_PHPMailer 2771 0.63 0.40 0.72 137 XM_ShortIntro_01 2723 0.60 0.33 0.71 138 T_TooManySym_03 2698 0.56 0.23 0.70 139 XMBody_78 2656 0.91 1.45 0.69 140 T_XMDrugObfuBody_00 2597 0.77 1.00 0.67 141 T_MIXED_ES 2517 0.83 1.25 0.65 142 XMGappySubj_02 2490 0.51 0.18 0.65 143 RCVD_IN_BL_SPAMCOP_NET 2488 1.66 4.08 0.65 144 XMNoVowels 2474 0.56 0.36 0.64 145 TR_MetaPhish_Combo_01 2430 0.55 0.35 0.63 146 RCVD_IN_SORBS_DUL 2258 0.47 0.18 0.59 147 XMHTMLBadTable_001 2189 0.62 0.76 0.57 148 XMSubMetaI_00 2180 1.12 2.45 0.57 149 T_OBFU_PDF_ATTACH 2175 0.45 0.17 0.56 150 XMPhish14 2161 0.65 0.87 0.56 151 T_HTML_ATTACH 2156 0.41 0.06 0.56 152 SHORT_HELO_AND_INLINE_IMAGE 2122 0.40 0.05 0.55 153 XMBody_17 2118 0.85 1.58 0.55 154 XM_B_TRADE_HTML 2088 0.55 0.56 0.54 155 RCVD_IN_MSPIKE_BL 2069 0.61 0.77 0.54 156 T_XMHurry_00 2030 1.12 2.55 0.53 157 RELAYCOUNTRY_AU 2029 0.61 0.80 0.53 158 RCVD_IN_MSPIKE_L3 1968 0.43 0.23 0.51 159 MISSING_HEADERS 1958 0.50 0.49 0.51 160 AC_DIV_BONANZA 1948 0.39 0.13 0.51 161 XM_B_COPY_HTML 1944 0.72 1.24 0.50 162 TM2_M_A_HREF_HREF 1944 0.52 0.56 0.50 163 XMPhish30 1894 0.76 1.41 0.49 164 HTML_IMAGE_ONLY_32 1880 0.44 0.31 0.49 165 XM_B_REG_HTML 1830 0.82 1.65 0.47 166 HTML_TAG_BALANCE_BODY 1808 0.62 0.98 0.47 167 XMSubMetaSxObfu_02 1796 0.39 0.23 0.47 168 TR_XM_RelayPhish 1758 0.70 1.29 0.46 169 XMMoneyMeta_00 1751 0.53 0.71 0.45 170 HTTPS_HTTP_MISMATCH 1719 0.56 0.84 0.45 171 XM_D_tchamptons_WL 1629 0.30 0.00 0.42 172 RELAYCOUNTRY_DE 1623 0.59 1.00 0.42 173 XMSubMetaSxObfu_03 1610 0.47 0.59 0.42 174 HTML_IMAGE_ONLY_28 1601 0.42 0.42 0.42 175 RDNS_DYNAMIC 1540 0.54 0.87 0.40 176 HTML_IMAGE_ONLY_24 1539 0.41 0.42 0.40 177 T_MANY_PILL_PRICE 1501 0.27 0.00 0.39 178 XMSubNoVowel 1482 0.63 1.20 0.38 179 TM2_M_BODY_EMPTY 1476 0.34 0.23 0.38 180 XM_Lotto 1467 0.31 0.14 0.38 181 XM_H_PHPOS_M 1460 0.35 0.28 0.38 182 URI_NOVOWEL 1432 0.42 0.53 0.37 183 XMHTML_After_End 1388 0.63 1.29 0.36 184 TR_LOTS_OF_MONEY3 1388 0.49 0.81 0.36 185 FORGED_GMAIL_RCVD 1383 0.42 0.58 0.36 186 XMLngstWrd_00 1358 0.37 0.42 0.35 187 UPPERCASE_50_75 1346 0.30 0.19 0.35 188 SpammyFromTLD_02 1338 0.81 1.92 0.35 189 T_Symld_Words_02 1338 0.49 0.84 0.35 190 XMRcvdHeader_15 1331 0.24 0.00 0.35 191 REMOVE_BEFORE_LINK 1308 0.44 0.67 0.34 192 XM_Body_Obfu01 1307 0.48 0.81 0.34 193 XMDateMe_00 1283 0.33 0.31 0.33 194 TVD_SPACE_RATIO 1276 0.33 0.33 0.33 195 DKIM_ADSP_NXDOMAIN 1270 0.44 0.72 0.33 196 HTML_IMAGE_ONLY_20 1265 0.32 0.29 0.33 197 NO_DNS_FOR_FROM 1262 0.36 0.43 0.33 198 HTML_FONT_FACE_BAD 1256 0.51 0.95 0.33 199 XMLngstWrd_01 1249 0.35 0.40 0.32 200 XMSubEmpty 1211 0.51 0.98 0.31 ----------------------------------------------------------------------