Email: 591410 Autolearn: 5 AvgScore: 3.29 AvgScanTime: 4.03 sec Spam: 170835 Autolearn: 0 AvgScore: 12.36 AvgScanTime: 4.68 sec Ham: 420575 Autolearn: 5 AvgScore: -0.40 AvgScanTime: 3.77 sec Time Spent Running SA: 662.53 hours Time Spent Processing Spam: 222.23 hours Time Spent Processing Ham: 440.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164311 88.67 96.18 85.62 2 DKIM_SIGNED 149821 75.14 87.70 70.03 3 XM_DK_Pass 145997 73.55 85.46 68.71 4 DKIM_VALID 144150 71.87 84.38 66.79 5 DCC_CHECK 137288 48.71 80.36 35.86 6 XMListUnsubscribeExists 131049 54.26 76.71 45.14 7 DKIM_VALID_AU 112599 53.02 65.91 47.79 8 XM_H_QuotedFrom 96248 41.85 56.34 35.96 9 XM_DK_Undo_02 84551 23.49 49.49 12.93 10 BAYES_99 74488 20.93 43.60 11.72 11 HTML_FONT_LOW_CONTRAST 65016 28.20 38.06 24.20 12 LOC_TINY_FONT_1 63579 24.43 37.22 19.24 13 BAYES_999 63516 18.12 37.18 10.37 14 TR_DCC_Bayes_99 59701 14.46 34.95 6.14 15 BAYES_50 57319 50.83 33.55 57.84 16 MIME_HTML_ONLY 49126 21.48 28.76 18.53 17 FVGT_m_MULTI_ODD 47424 21.62 27.76 19.12 18 XMSubLong 43170 21.41 25.27 19.84 19 DKIM_VALID_EF 36177 22.08 21.18 22.44 20 T_KAM_HTML_FONT_INVALID 34860 15.67 20.41 13.74 21 XM_Body_Dirty_Words 33537 12.88 19.63 10.14 22 T_TM2_M_HEADER_IN_MSG 32622 28.58 19.10 32.43 23 HTML_IMAGE_RATIO_02 32376 10.84 18.95 7.55 24 DCC_CHECK_NEGATIVE 30089 48.98 17.61 61.72 25 MultiRelay 28796 18.52 16.86 19.20 26 RELAYCOUNTRY_META 28599 8.76 16.74 5.52 27 XM_Multi_Part_URI 28589 12.63 16.73 10.96 28 XM_Evil_Numbers_Gen 25203 9.66 14.75 7.58 29 BOTNET_IPINHOSTNAME 23160 7.07 13.56 4.43 30 BOTNET 20219 4.32 11.84 1.27 31 LOTS_OF_MONEY 20034 9.20 11.73 8.17 32 T_XMDrugObfuBody_14 17875 8.83 10.46 8.17 33 FSL_BULK_SIG 16952 7.61 9.92 6.67 34 LotsOfNums_01 16826 8.64 9.85 8.15 35 HTML_IMAGE_RATIO_04 16816 6.11 9.84 4.59 36 UNTRUSTED_Relay 16681 3.75 9.76 1.31 37 XMSexyCombo_05 16247 4.79 9.51 2.88 38 XM_B_Phish_Phrases 15767 6.49 9.23 5.38 39 XM_H_Long_From01 14645 6.74 8.57 6.00 40 TR_XM_DocInvoice 14129 5.69 8.27 4.64 41 TooManyTo_001 13849 8.38 8.11 8.49 42 BAYES_80 13039 4.93 7.63 3.83 43 MPART_ALT_DIFF 12072 3.92 7.07 2.64 44 XMSubMetaSx_00 11124 4.32 6.51 3.43 45 FROM_EXCESS_BASE64 10399 4.43 6.09 3.75 46 XM_UncommonTLD01 10274 4.13 6.01 3.36 47 BAYES_60 10274 5.93 6.01 5.90 48 RCVD_IN_RP_SAFE 10151 9.10 5.94 10.39 49 MIME_QP_LONG_LINE 8802 5.35 5.15 5.43 50 MIME_HTML_MOSTLY 8609 3.06 5.04 2.25 51 RCVD_IN_DNSWL_NONE 8126 4.53 4.76 4.43 52 XM_DIRTYINTL 8070 2.54 4.72 1.65 53 XM_UB50 7989 1.96 4.68 0.86 54 RCVD_IN_RP_CERTIFIED 7750 7.75 4.54 9.05 55 XM_SendGrid 7723 4.73 4.52 4.82 56 BAYES_95 7677 3.07 4.49 2.49 57 HTML_IMAGE_RATIO_06 7667 3.11 4.49 2.56 58 TM2_M_URI_OPT_OUT 7630 2.74 4.47 2.04 59 T_MIXED_ES 7449 2.77 4.36 2.13 60 XMNumbers 7242 3.48 4.24 3.17 61 XMStrtUSub 7208 4.42 4.22 4.50 62 RCVD_IN_BL_SPAMCOP_NET 7151 1.76 4.19 0.78 63 T_REMOTE_IMAGE 6617 4.54 3.87 4.81 64 T_TooManySym_01 6525 4.60 3.82 4.92 65 RELAYCOUNTRY_CA 6133 2.04 3.59 1.42 66 URI_HEX 5972 2.03 3.50 1.44 67 XM_SPF_SoftFail 5756 2.42 3.37 2.04 68 DKIM_INVALID 5671 3.26 3.32 3.24 69 XM_URI_RBL 5633 1.08 3.30 0.18 70 MultiRelay_CC 5618 1.14 3.29 0.27 71 MultiRelay_Combo 5618 1.14 3.29 0.27 72 MIME_HTML_ONLY_MULTI 5554 1.78 3.25 1.18 73 XM_OfRef6 5301 1.75 3.10 1.20 74 HTML_IMAGE_RATIO_08 5137 2.41 3.01 2.16 75 XMDiploma_00 4976 1.76 2.91 1.29 76 XM_CamelCaseFrm001 4633 2.03 2.71 1.75 77 RCVD_IN_RP_RNBL 4428 0.78 2.59 0.04 78 RCVD_IN_MSPIKE_H2 4156 4.07 2.43 4.73 79 RCVD_IN_IADB_LISTED 4074 4.73 2.38 5.69 80 XMBdyGiftCard01 4025 1.23 2.36 0.77 81 XMSubMetaI_00 3983 1.35 2.33 0.95 82 SpammyFromTLD_02 3892 0.89 2.28 0.33 83 RCVD_IN_MSPIKE_WL 3762 3.23 2.20 3.64 84 RCVD_IN_MSPIKE_H3 3753 3.20 2.20 3.61 85 T_XMHurry_00 3707 1.12 2.17 0.69 86 RCVD_IN_IADB_SPF 3579 4.13 2.10 4.96 87 XM_UB99 3447 0.59 2.02 0.01 88 RELAYCOUNTRY_FR 3433 0.78 2.01 0.28 89 RCVD_IN_IADB_SENDERID 3375 3.70 1.98 4.40 90 RCVD_IN_IADB_DK 3344 3.61 1.96 4.28 91 T_XMDrugObfuBody_08 3314 1.81 1.94 1.76 92 TR_XM_RelayPhish 3276 0.94 1.92 0.54 93 TR_LOTS_OF_MONEY2 3272 1.04 1.92 0.68 94 T_MONEY_PERCENT 3272 1.04 1.92 0.68 95 XMGenDplmaNmb 3254 1.08 1.90 0.74 96 MAILING_LIST_MULTI 3218 2.63 1.88 2.94 97 HTML_MIME_NO_HTML_TAG 3130 2.09 1.83 2.19 98 TM2_M_VERY_LONG_WORD 3117 1.21 1.82 0.96 99 BAYES_00 2904 7.02 1.70 9.18 100 SUBJ_ALL_CAPS 2889 1.68 1.69 1.67 101 XMPhish30 2886 0.74 1.69 0.36 102 XM_DK_Undo_01 2874 1.78 1.68 1.82 103 XM_HighProb1 2859 0.50 1.67 0.02 104 XMHTML_After_End 2774 0.69 1.62 0.31 105 SpammyFromTLD_01 2736 1.06 1.60 0.85 106 XM_UB999 2680 0.46 1.57 0.01 107 XMSexyCombo_01 2648 1.06 1.55 0.87 108 XM_H_Long_From02 2646 1.07 1.55 0.87 109 XMPhish11 2559 1.29 1.50 1.21 110 RELAYCOUNTRY_GB 2551 1.25 1.49 1.15 111 XMBody_78 2532 0.92 1.48 0.70 112 XMBody_17 2504 0.71 1.47 0.40 113 T_XMDrugObfuBody_00 2489 0.92 1.46 0.70 114 XMPhish14 2473 0.66 1.45 0.34 115 SUBJ_DOLLARS 2469 0.52 1.45 0.14 116 TR_XM_DK_Bayes 2467 4.99 1.44 6.43 117 TR_XM_DK_Bayes1 2445 4.79 1.43 6.16 118 URIBL_BLACK 2445 0.44 1.43 0.04 119 RCVD_IN_PSBL 2412 0.45 1.41 0.06 120 BOTNET_NORDNS 2404 0.42 1.41 0.02 121 TR_XM_DK_Bayes2 2384 3.83 1.40 4.82 122 BODY_ENHANCEMENT 2308 0.41 1.35 0.03 123 XM_S_JOY_D 2289 0.91 1.34 0.74 124 XM_ProductURIs 2249 1.61 1.32 1.74 125 HTML_FONT_FACE_BAD 2188 0.71 1.28 0.49 126 TR_LOTS_OF_MONEY3 2136 0.61 1.25 0.35 127 XMStockSpam_06 2129 1.12 1.25 1.07 128 T_Symld_Words_02 2111 0.72 1.24 0.52 129 BAYES_40 2077 3.25 1.22 4.07 130 XMGppyBdWords 2065 0.55 1.21 0.29 131 RELAYCOUNTRY_AT 2063 0.44 1.21 0.12 132 UNPARSEABLE_RELAY 1958 2.64 1.15 3.24 133 BODY_URI_ONLY 1956 0.35 1.14 0.03 134 XM_Hitman 1923 0.36 1.13 0.05 135 XMMoneyMeta_00 1910 0.77 1.12 0.63 136 XMBrknScrpt_02 1858 0.90 1.09 0.82 137 BAYES_20 1852 2.48 1.08 3.05 138 T_FILL_THIS_FORM_SHORT 1812 1.03 1.06 1.02 139 URI_TRY_3LD 1757 0.93 1.03 0.89 140 T_TooManySym_02 1748 1.98 1.02 2.37 141 HTML_SHORT_LINK_IMG_1 1736 0.32 1.02 0.03 142 RCVD_IN_IADB_VOUCHED 1728 3.04 1.01 3.87 143 LONG_JUNK_URI 1725 0.39 1.01 0.13 144 RELAYCOUNTRY_DE 1719 0.72 1.01 0.61 145 FILL_THIS_FORM 1714 0.47 1.00 0.26 146 ALL_TRUSTED 1698 13.70 0.99 18.86 147 XM_BadFromFormat 1690 0.48 0.99 0.28 148 TooManyTo_002 1687 2.12 0.99 2.58 149 HTML_TAG_BALANCE_BODY 1664 0.57 0.97 0.41 150 ANY_BOUNCE_MESSAGE 1655 3.35 0.97 4.31 151 BOUNCE_MESSAGE 1655 3.35 0.97 4.31 152 URIBL_SBL_A 1597 0.32 0.93 0.07 153 FILL_THIS_FORM_LONG 1581 0.32 0.93 0.07 154 XMHTMLBadTable_001 1580 0.58 0.92 0.44 155 XM_B_COPY_HTML 1576 0.63 0.92 0.51 156 LOW_PRICE 1572 0.38 0.92 0.17 157 RCVD_IN_MSPIKE_BL 1555 0.62 0.91 0.51 158 XM_UB60 1555 0.30 0.91 0.05 159 XMClaimOffer 1554 0.44 0.91 0.25 160 RDNS_DYNAMIC 1551 0.53 0.91 0.38 161 XM_UB80 1504 0.27 0.88 0.02 162 TooManyTo_003 1484 1.44 0.87 1.68 163 TR_Symld_Words 1474 1.87 0.86 2.28 164 FILL_THIS_FORM_LOAN 1439 0.28 0.84 0.05 165 T_HTML_TAG_BALANCE_CENTER 1436 0.39 0.84 0.21 166 XM_RXBody 1424 0.48 0.83 0.33 167 MPART_ALT_DIFF_COUNT 1414 0.40 0.83 0.22 168 URI_NOVOWEL 1414 0.56 0.83 0.45 169 REMOVE_BEFORE_LINK 1352 0.41 0.79 0.26 170 HTTPS_HTTP_MISMATCH 1349 0.55 0.79 0.46 171 XM_B_REG_HTML 1337 0.55 0.78 0.46 172 PLING_QUERY 1320 0.43 0.77 0.29 173 DIET_1 1302 0.38 0.76 0.23 174 TR_MetaPhish_Combo_01 1300 0.74 0.76 0.73 175 XMBSHREFv2 1269 0.43 0.74 0.30 176 XM_H_PHPOS 1257 1.48 0.74 1.79 177 TooManyTo_004 1242 1.07 0.73 1.20 178 DKIM_ADSP_CUSTOM_MED 1240 1.07 0.73 1.21 179 RELAYCOUNTRY_CN 1239 0.25 0.73 0.06 180 RELAYCOUNTRY_AU 1234 0.52 0.72 0.44 181 HTML_IMAGE_ONLY_28 1226 0.50 0.72 0.41 182 XMSubMetaI_01 1222 0.24 0.72 0.05 183 XMSlimDrugH 1217 0.38 0.71 0.25 184 TR_Mismatch_TLD_02 1213 0.26 0.71 0.07 185 BAYES_05 1199 1.56 0.70 1.91 186 XMSubNoVowel 1184 0.46 0.69 0.36 187 URIBL_DBL_SPAM 1183 0.20 0.69 0.00 188 HTML_IMAGE_ONLY_24 1152 0.47 0.67 0.39 189 THIS_AD 1135 0.32 0.66 0.18 190 RCVD_IN_MSPIKE_L5 1119 0.22 0.66 0.05 191 XMSubMetaSSx_00 1112 0.30 0.65 0.16 192 TooManyTo_005 1081 0.90 0.63 1.01 193 DATE_IN_PAST_12_24 1076 0.21 0.63 0.04 194 XM_Body_Obfu01 1061 0.38 0.62 0.29 195 RELAYCOUNTRY_IT 1053 0.21 0.62 0.04 196 XMBounce_01 1042 0.20 0.61 0.03 197 XM_PDF 1035 3.51 0.61 4.68 198 RELAYCOUNTRY_IN 1028 0.29 0.60 0.16 199 XMSexyCombo_04 984 0.20 0.58 0.05 200 XMNoVowels 979 0.72 0.57 0.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 360079 88.67 96.18 85.62 2 DKIM_SIGNED 294537 75.14 87.70 70.03 3 XM_DK_Pass 288993 73.55 85.46 68.71 4 DKIM_VALID 280900 71.87 84.38 66.79 5 DCC_CHECK_NEGATIVE 259574 48.98 17.61 61.72 6 BAYES_50 243281 50.83 33.55 57.84 7 DKIM_VALID_AU 200975 53.02 65.91 47.79 8 XMListUnsubscribeExists 189868 54.26 76.71 45.14 9 XM_H_QuotedFrom 151234 41.85 56.34 35.96 10 DCC_CHECK 150807 48.71 80.36 35.86 11 T_TM2_M_HEADER_IN_MSG 136395 28.58 19.10 32.43 12 HTML_FONT_LOW_CONTRAST 101773 28.20 38.06 24.20 13 DKIM_VALID_EF 94392 22.08 21.18 22.44 14 XMSubLong 83426 21.41 25.27 19.84 15 LOC_TINY_FONT_1 80932 24.43 37.22 19.24 16 MultiRelay 80740 18.52 16.86 19.20 17 FVGT_m_MULTI_ODD 80418 21.62 27.76 19.12 18 ALL_TRUSTED 79339 13.70 0.99 18.86 19 MIME_HTML_ONLY 77935 21.48 28.76 18.53 20 T_KAM_HTML_FONT_INVALID 57807 15.67 20.41 13.74 21 XM_DK_Undo_02 54380 23.49 49.49 12.93 22 BAYES_99 49304 20.93 43.60 11.72 23 XM_Multi_Part_URI 46107 12.63 16.73 10.96 24 RCVD_IN_RP_SAFE 43685 9.10 5.94 10.39 25 BAYES_999 43625 18.12 37.18 10.37 26 XM_Body_Dirty_Words 42631 12.88 19.63 10.14 27 XM_DKIMWhitelistDomains 40706 6.92 0.12 9.68 28 BAYES_00 38591 7.02 1.70 9.18 29 RCVD_IN_RP_CERTIFIED 38081 7.75 4.54 9.05 30 TooManyTo_001 35696 8.38 8.11 8.49 31 LOTS_OF_MONEY 34369 9.20 11.73 8.17 32 T_XMDrugObfuBody_14 34349 8.83 10.46 8.17 33 LotsOfNums_01 34291 8.64 9.85 8.15 34 XM_Evil_Numbers_Gen 31899 9.66 14.75 7.58 35 HTML_IMAGE_RATIO_02 31755 10.84 18.95 7.55 36 FSL_BULK_SIG 28044 7.61 9.92 6.67 37 TR_XM_DK_Bayes 27047 4.99 1.44 6.43 38 TR_XM_DK_Bayes1 25895 4.79 1.43 6.16 39 TR_DCC_Bayes_99 25828 14.46 34.95 6.14 40 XM_H_Long_From01 25221 6.74 8.57 6.00 41 BAYES_60 24820 5.93 6.01 5.90 42 RCVD_IN_IADB_LISTED 23920 4.73 2.38 5.69 43 IN_ZIMBRA_NJ_WHITELIST 23535 3.99 0.04 5.60 44 RELAYCOUNTRY_META 23209 8.76 16.74 5.52 45 MIME_QP_LONG_LINE 22823 5.35 5.15 5.43 46 XM_B_Phish_Phrases 22636 6.49 9.23 5.38 47 RCVD_IN_IADB_SPF 20862 4.13 2.10 4.96 48 T_TooManySym_01 20708 4.60 3.82 4.92 49 TR_XM_DK_Bayes2 20282 3.83 1.40 4.82 50 XM_SendGrid 20255 4.73 4.52 4.82 51 T_REMOTE_IMAGE 20243 4.54 3.87 4.81 52 RCVD_IN_MSPIKE_H2 19899 4.07 2.43 4.73 53 XM_PDF 19701 3.51 0.61 4.68 54 TR_XM_DocInvoice 19523 5.69 8.27 4.64 55 HTML_IMAGE_RATIO_04 19293 6.11 9.84 4.59 56 XMStrtUSub 18919 4.42 4.22 4.50 57 BOTNET_IPINHOSTNAME 18646 7.07 13.56 4.43 58 RCVD_IN_DNSWL_NONE 18637 4.53 4.76 4.43 59 RCVD_IN_IADB_SENDERID 18524 3.70 1.98 4.40 60 ANY_BOUNCE_MESSAGE 18137 3.35 0.97 4.31 61 BOUNCE_MESSAGE 18135 3.35 0.97 4.31 62 RCVD_IN_IADB_DK 17996 3.61 1.96 4.28 63 BAYES_40 17121 3.25 1.22 4.07 64 RCVD_IN_IADB_VOUCHED 16278 3.04 1.01 3.87 65 BAYES_80 16098 4.93 7.63 3.83 66 FROM_EXCESS_BASE64 15776 4.43 6.09 3.75 67 RCVD_IN_MSPIKE_WL 15321 3.23 2.20 3.64 68 RCVD_IN_MSPIKE_H3 15175 3.20 2.20 3.61 69 XMSubMetaSx_00 14428 4.32 6.51 3.43 70 XM_UncommonTLD01 14134 4.13 6.01 3.36 71 DKIM_INVALID 13637 3.26 3.32 3.24 72 UNPARSEABLE_RELAY 13629 2.64 1.15 3.24 73 XMNumbers 13321 3.48 4.24 3.17 74 BAYES_20 12833 2.48 1.08 3.05 75 MAILING_LIST_MULTI 12348 2.63 1.88 2.94 76 XMSexyCombo_05 12098 4.79 9.51 2.88 77 MPART_ALT_DIFF 11118 3.92 7.07 2.64 78 TVD_RCVD_IP 10977 1.93 0.24 2.61 79 TooManyTo_002 10853 2.12 0.99 2.58 80 HTML_IMAGE_RATIO_06 10747 3.11 4.49 2.56 81 BAYES_95 10493 3.07 4.49 2.49 82 HELO_NODOT 10297 1.83 0.32 2.45 83 T_TooManySym_02 9954 1.98 1.02 2.37 84 TR_Symld_Words 9601 1.87 0.86 2.28 85 IN_HORDE_ADDRESS_BOOK 9546 1.64 0.07 2.27 86 MIME_HTML_MOSTLY 9459 3.06 5.04 2.25 87 HTML_MIME_NO_HTML_TAG 9217 2.09 1.83 2.19 88 HTML_IMAGE_RATIO_08 9103 2.41 3.01 2.16 89 T_MIXED_ES 8946 2.77 4.36 2.13 90 XM_SPF_SoftFail 8568 2.42 3.37 2.04 91 TM2_M_URI_OPT_OUT 8565 2.74 4.47 2.04 92 BAYES_05 8012 1.56 0.70 1.91 93 XM_DK_Undo_01 7654 1.78 1.68 1.82 94 RCVD_IN_IADB_OPTIN 7600 1.45 0.56 1.81 95 XM_H_PHPOS 7523 1.48 0.74 1.79 96 T_XMDrugObfuBody_08 7385 1.81 1.94 1.76 97 XM_CamelCaseFrm001 7359 2.03 2.71 1.75 98 XM_ProductURIs 7298 1.61 1.32 1.74 99 TooManyTo_003 7053 1.44 0.87 1.68 100 SUBJ_ALL_CAPS 7025 1.68 1.69 1.67 101 XM_DIRTYINTL 6926 2.54 4.72 1.65 102 INVALID_MSGID 6795 1.21 0.22 1.62 103 XMCapTrack 6126 1.16 0.43 1.46 104 USER_IN_DEF_DKIM_WL 6124 1.05 0.04 1.46 105 TO_MALFORMED 6101 1.03 0.00 1.45 106 URI_HEX 6039 2.03 3.50 1.44 107 RELAYCOUNTRY_CA 5957 2.04 3.59 1.42 108 UNTRUSTED_Relay 5506 3.75 9.76 1.31 109 XM_GoogleGroups 5475 1.06 0.48 1.30 110 XMDiploma_00 5409 1.76 2.91 1.29 111 BOTNET 5333 4.32 11.84 1.27 112 XMPhish11 5099 1.29 1.50 1.21 113 DKIM_ADSP_CUSTOM_MED 5092 1.07 0.73 1.21 114 TooManyTo_004 5066 1.07 0.73 1.20 115 T_TooManySym_03 5055 0.90 0.15 1.20 116 XM_OfRef6 5032 1.75 3.10 1.20 117 MIME_HTML_ONLY_MULTI 4964 1.78 3.25 1.18 118 RELAYCOUNTRY_GB 4830 1.25 1.49 1.15 119 XMStockSpam_06 4500 1.12 1.25 1.07 120 T_FILL_THIS_FORM_SHORT 4279 1.03 1.06 1.02 121 TooManyTo_005 4259 0.90 0.63 1.01 122 TM2_M_VERY_LONG_WORD 4029 1.21 1.82 0.96 123 XMSubMetaI_00 4004 1.35 2.33 0.95 124 URI_TRY_3LD 3744 0.93 1.03 0.89 125 XM_H_Long_From02 3654 1.07 1.55 0.87 126 XMSexyCombo_01 3643 1.06 1.55 0.87 127 NML_ADSP_CUSTOM_MED 3626 0.78 0.57 0.86 128 TO_NO_BRKTS_HTML_ONLY 3605 0.67 0.21 0.86 129 XM_UB50 3596 1.96 4.68 0.86 130 SpammyFromTLD_01 3556 1.06 1.60 0.85 131 XMBrknScrpt_02 3447 0.90 1.09 0.82 132 XMNoVowels 3280 0.72 0.57 0.78 133 RCVD_IN_BL_SPAMCOP_NET 3278 1.76 4.19 0.78 134 XMBdyGiftCard01 3257 1.23 2.36 0.77 135 XMGenDplmaNmb 3113 1.08 1.90 0.74 136 XM_S_JOY_D 3110 0.91 1.34 0.74 137 TR_MetaPhish_Combo_01 3070 0.74 0.76 0.73 138 XM_ShortIntro_01 2985 0.61 0.38 0.71 139 RCVD_IN_IADB_DOPTIN 2984 0.53 0.10 0.71 140 USER_IN_WHITELIST 2940 0.50 0.00 0.70 141 T_XMDrugObfuBody_00 2933 0.92 1.46 0.70 142 XMBody_78 2931 0.92 1.48 0.70 143 T_XMHurry_00 2916 1.12 2.17 0.69 144 TR_LOTS_OF_MONEY2 2880 1.04 1.92 0.68 145 T_MONEY_PERCENT 2880 1.04 1.92 0.68 146 XMBody_95 2837 0.51 0.11 0.67 147 XMGappySubj_01 2826 0.58 0.35 0.67 148 XM_H_PHPMailer 2751 0.60 0.48 0.65 149 XMMoneyMeta_00 2646 0.77 1.12 0.63 150 RELAYCOUNTRY_DE 2549 0.72 1.01 0.61 151 SHORT_HELO_AND_INLINE_IMAGE 2532 0.45 0.07 0.60 152 RCVD_IN_SORBS_DUL 2511 0.50 0.27 0.60 153 T_OBFU_PDF_ATTACH 2330 0.44 0.15 0.55 154 TR_XM_RelayPhish 2289 0.94 1.92 0.54 155 RCVD_IN_DNSWL_MED 2219 0.42 0.15 0.53 156 T_Symld_Words_02 2166 0.72 1.24 0.52 157 FORGED_GMAIL_RCVD 2148 0.52 0.56 0.51 158 XM_B_COPY_HTML 2142 0.63 0.92 0.51 159 HTML_IMAGE_ONLY_32 2132 0.45 0.33 0.51 160 RCVD_IN_MSPIKE_BL 2130 0.62 0.91 0.51 161 MISSING_HEADERS 2064 0.48 0.47 0.49 162 HTML_FONT_FACE_BAD 2040 0.71 1.28 0.49 163 XM_B_TRADE_HTML 1993 0.49 0.55 0.47 164 TVD_SPACE_RATIO 1936 0.44 0.40 0.46 165 XM_B_REG_HTML 1930 0.55 0.78 0.46 166 HTTPS_HTTP_MISMATCH 1924 0.55 0.79 0.46 167 URI_NOVOWEL 1906 0.56 0.83 0.45 168 RCVD_IN_MSPIKE_L3 1899 0.37 0.16 0.45 169 XMDateMe_00 1875 0.46 0.50 0.45 170 XMHTMLBadTable_001 1866 0.58 0.92 0.44 171 AC_DIV_BONANZA 1845 0.34 0.10 0.44 172 RELAYCOUNTRY_AU 1838 0.52 0.72 0.44 173 XMSubMetaSxObfu_02 1799 0.42 0.40 0.43 174 XM_USANA_RCVD 1756 0.30 0.00 0.42 175 HTML_TAG_BALANCE_BODY 1708 0.57 0.97 0.41 176 HTML_IMAGE_ONLY_28 1706 0.50 0.72 0.41 177 RELAYCOUNTRY_NL 1699 0.45 0.57 0.40 178 XMBody_17 1666 0.71 1.47 0.40 179 XMLKML 1662 0.28 0.00 0.40 180 HTML_IMAGE_ONLY_24 1622 0.47 0.67 0.39 181 T_TooManySym_04 1622 0.28 0.02 0.39 182 TM2_M_BODY_EMPTY 1620 0.33 0.18 0.39 183 RDNS_DYNAMIC 1578 0.53 0.91 0.38 184 DOS_OUTLOOK_TO_MX 1559 0.30 0.13 0.37 185 XM_H_PHPOS_M 1557 0.35 0.30 0.37 186 XMSubNoVowel 1532 0.46 0.69 0.36 187 XMPhish30 1495 0.74 1.69 0.36 188 TR_LOTS_OF_MONEY3 1464 0.61 1.25 0.35 189 TM2_M_A_HREF_HREF 1448 0.39 0.49 0.34 190 XMPhish14 1444 0.66 1.45 0.34 191 DKIM_ADSP_NXDOMAIN 1404 0.35 0.41 0.33 192 SpammyFromTLD_02 1400 0.89 2.28 0.33 193 XM_RXBody 1397 0.48 0.83 0.33 194 HTML_IMAGE_ONLY_20 1360 0.31 0.28 0.32 195 MSGID_FROM_MTA_HEADER 1349 0.28 0.17 0.32 196 XMLngstWrd_00 1321 0.32 0.35 0.31 197 XMSolicitRefs_0 1300 0.32 0.35 0.31 198 XMSubEmpty 1298 0.37 0.52 0.31 199 XMHTML_After_End 1294 0.69 1.62 0.31 200 NO_DNS_FOR_FROM 1268 0.28 0.23 0.30 ----------------------------------------------------------------------