Email: 565030 Autolearn: 0 AvgScore: 3.56 AvgScanTime: 2.75 sec Spam: 177430 Autolearn: 0 AvgScore: 12.47 AvgScanTime: 3.31 sec Ham: 387600 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 2.50 sec Time Spent Running SA: 431.83 hours Time Spent Processing Spam: 163.11 hours Time Spent Processing Ham: 268.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 169971 89.86 95.80 87.14 2 DKIM_SIGNED 155331 76.80 87.54 71.88 3 XM_DK_Pass 151099 75.01 85.16 70.36 4 DKIM_VALID 148382 73.02 83.63 68.17 5 DCC_CHECK 142409 49.57 80.26 35.52 6 XMListUnsubscribeExists 132577 54.54 74.72 45.30 7 DKIM_VALID_AU 116330 54.30 65.56 49.14 8 XM_H_QuotedFrom 95772 41.69 53.98 36.07 9 XM_DK_Undo_02 93989 26.84 52.97 14.88 10 BAYES_99 84013 24.20 47.35 13.61 11 BAYES_999 72671 21.20 40.96 12.15 12 TR_DCC_Bayes_99 68221 16.54 38.45 6.51 13 HTML_FONT_LOW_CONTRAST 66121 27.99 37.27 23.74 14 LOC_TINY_FONT_1 60945 24.12 34.35 19.44 15 BAYES_50 57042 49.22 32.15 57.04 16 MIME_HTML_ONLY 53835 22.47 30.34 18.87 17 FVGT_m_MULTI_ODD 50226 22.90 28.31 20.43 18 RCVD_IN_DNSWL_NONE 47636 23.17 26.85 21.48 19 XMSubLong 46293 22.59 26.09 20.99 20 XM_Body_Dirty_Words 36091 13.62 20.34 10.54 21 T_TM2_M_HEADER_IN_MSG 35611 29.29 20.07 33.51 22 T_KAM_HTML_FONT_INVALID 35275 15.60 19.88 13.64 23 DKIM_VALID_EF 34721 22.39 19.57 23.68 24 HTML_IMAGE_RATIO_02 34557 11.07 19.48 7.22 25 DCC_CHECK_NEGATIVE 30951 48.10 17.44 62.14 26 XM_Multi_Part_URI 29688 13.06 16.73 11.38 27 MultiRelay 29511 19.14 16.63 20.29 28 T_MIXED_ES 28860 14.45 16.27 13.62 29 RELAYCOUNTRY_META 28237 8.83 15.91 5.58 30 XM_Evil_Numbers_Gen 26851 10.17 15.13 7.90 31 BOTNET_IPINHOSTNAME 25509 7.86 14.38 4.88 32 BOTNET 21818 4.83 12.30 1.42 33 LOTS_OF_MONEY 19074 9.30 10.75 8.64 34 XMSexyCombo_05 18411 5.44 10.38 3.18 35 T_XMDrugObfuBody_14 17865 8.57 10.07 7.88 36 LotsOfNums_01 17569 8.72 9.90 8.19 37 HTML_IMAGE_RATIO_04 16570 6.36 9.34 4.99 38 UNTRUSTED_Relay 16246 3.87 9.16 1.45 39 XM_B_Phish_Phrases 16067 6.44 9.06 5.25 40 TR_XM_DocInvoice 15865 5.57 8.94 4.02 41 FSL_BULK_SIG 15804 6.47 8.91 5.35 42 XM_H_Long_From01 14626 6.61 8.24 5.86 43 TooManyTo_001 13712 8.52 7.73 8.88 44 MPART_ALT_DIFF 12901 3.96 7.27 2.44 45 BAYES_80 12564 5.03 7.08 4.08 46 FROM_EXCESS_BASE64 11871 4.26 6.69 3.15 47 RCVD_IN_RP_SAFE 11784 9.09 6.64 10.22 48 XMSubMetaSx_00 11503 4.50 6.48 3.59 49 XM_UncommonTLD01 10595 4.41 5.97 3.70 50 RCVD_IN_RP_CERTIFIED 9586 7.88 5.40 9.02 51 MIME_HTML_MOSTLY 9027 3.13 5.09 2.23 52 MIME_QP_LONG_LINE 8811 5.33 4.97 5.50 53 BAYES_60 8765 5.99 4.94 6.47 54 RCVD_IN_MSPIKE_H2 8377 5.92 4.72 6.47 55 XM_DIRTYINTL 8261 2.76 4.66 1.89 56 TM2_M_URI_OPT_OUT 8083 2.69 4.56 1.84 57 XMStrtUSub 7836 4.41 4.42 4.40 58 XM_SendGrid 7831 4.90 4.41 5.12 59 T_REMOTE_IMAGE 7788 4.83 4.39 5.03 60 BAYES_95 7762 3.13 4.37 2.56 61 HTML_IMAGE_RATIO_06 7718 3.09 4.35 2.51 62 XMNumbers 7435 3.33 4.19 2.93 63 RCVD_IN_BL_SPAMCOP_NET 7092 1.79 4.00 0.77 64 DKIM_INVALID 6949 3.78 3.92 3.71 65 XM_UB50 6744 1.81 3.80 0.90 66 XM_SPF_SoftFail 6399 2.58 3.61 2.11 67 XM_CamelCaseFrm001 6304 2.20 3.55 1.58 68 RELAYCOUNTRY_CA 6016 2.08 3.39 1.47 69 MIME_HTML_ONLY_MULTI 6000 1.85 3.38 1.15 70 URI_HEX 5964 2.01 3.36 1.39 71 HTML_IMAGE_RATIO_08 5876 2.64 3.31 2.34 72 T_TooManySym_01 5442 4.09 3.07 4.55 73 MultiRelay_Combo 5054 1.10 2.85 0.29 74 MultiRelay_CC 5054 1.10 2.85 0.29 75 XM_OfRef6 5014 1.78 2.83 1.30 76 XM_URI_RBL 4917 0.98 2.77 0.16 77 XMSubMetaI_00 4511 1.43 2.54 0.93 78 SUBJ_ALL_CAPS 4395 2.00 2.48 1.78 79 RCVD_IN_IADB_LISTED 4364 4.59 2.46 5.57 80 RCVD_IN_IADB_SPF 3956 4.03 2.23 4.85 81 XMDiploma_00 3949 1.63 2.23 1.36 82 RCVD_IN_IADB_SENDERID 3785 3.62 2.13 4.30 83 RCVD_IN_IADB_DK 3736 3.52 2.11 4.17 84 RELAYCOUNTRY_FR 3589 0.87 2.02 0.34 85 MAILING_LIST_MULTI 3539 2.77 1.99 3.12 86 XM_UB99 3525 0.65 1.99 0.03 87 RCVD_IN_RP_RNBL 3507 0.64 1.98 0.03 88 XMSexyCombo_01 3488 1.16 1.97 0.79 89 TM2_M_VERY_LONG_WORD 3463 1.17 1.95 0.81 90 T_XMDrugObfuBody_08 3440 1.64 1.94 1.50 91 SpammyFromTLD_02 3378 0.84 1.90 0.35 92 HTML_MIME_NO_HTML_TAG 3378 2.86 1.90 3.30 93 XMBdyGiftCard01 3006 1.00 1.69 0.69 94 RELAYCOUNTRY_GB 2901 1.33 1.64 1.20 95 XM_S_JOY_D 2802 1.06 1.58 0.82 96 TR_XM_RelayPhish 2795 0.87 1.58 0.55 97 RCVD_IN_MSPIKE_WL 2771 2.83 1.56 3.42 98 RCVD_IN_MSPIKE_H3 2752 2.81 1.55 3.39 99 SpammyFromTLD_01 2752 1.18 1.55 1.00 100 URIBL_BLACK 2676 0.50 1.51 0.04 101 BAYES_00 2673 5.82 1.51 7.79 102 XM_UB999 2656 0.49 1.50 0.03 103 XMBody_17 2611 0.73 1.47 0.39 104 XM_ProductURIs 2605 1.25 1.47 1.15 105 XMBody_78 2589 1.01 1.46 0.80 106 XMStockSpam_06 2530 1.38 1.43 1.36 107 XM_DK_Undo_01 2418 1.79 1.36 1.98 108 XM_HighProb1 2412 0.44 1.36 0.02 109 BODY_ENHANCEMENT 2365 0.43 1.33 0.02 110 XMPhish30 2359 0.71 1.33 0.42 111 SUBJ_DOLLARS 2331 0.57 1.31 0.23 112 T_XMHurry_00 2322 0.88 1.31 0.68 113 T_FILL_THIS_FORM_SHORT 2197 1.06 1.24 0.98 114 UNPARSEABLE_RELAY 2171 2.82 1.22 3.56 115 XM_B_REG_HTML 2132 0.73 1.20 0.51 116 LONG_JUNK_URI 2128 0.50 1.20 0.17 117 TR_XM_DK_Bayes 2124 3.93 1.20 5.18 118 BOTNET_NORDNS 2115 0.39 1.19 0.03 119 FILL_THIS_FORM 2110 0.57 1.19 0.28 120 URI_TRY_3LD 2101 0.95 1.18 0.85 121 TR_XM_DK_Bayes1 2093 3.75 1.18 4.92 122 REMOVE_BEFORE_LINK 2086 0.69 1.18 0.47 123 RDNS_DYNAMIC 2034 0.63 1.15 0.40 124 T_MONEY_PERCENT 1984 0.84 1.12 0.72 125 TR_LOTS_OF_MONEY2 1984 0.84 1.12 0.72 126 TR_XM_DK_Bayes2 1956 3.06 1.10 3.95 127 BAYES_40 1943 3.04 1.10 3.93 128 XMPhish11 1943 1.15 1.10 1.18 129 XMGenDplmaNmb 1942 0.93 1.09 0.86 130 TR_Symld_Words 1935 1.73 1.09 2.02 131 XMHTML_After_End 1930 0.59 1.09 0.36 132 FSL_THIS_IS_ADV 1929 0.36 1.09 0.03 133 FILL_THIS_FORM_LONG 1928 0.45 1.09 0.16 134 XMPhish14 1912 0.63 1.08 0.43 135 RELAYCOUNTRY_AT 1909 0.46 1.08 0.18 136 XM_RXBody 1907 0.44 1.07 0.15 137 T_XMDrugObfuBody_00 1898 0.74 1.07 0.59 138 URIBL_SBL_A 1895 0.37 1.07 0.05 139 XM_Body_Obfu01 1883 0.56 1.06 0.33 140 HTTPS_HTTP_MISMATCH 1875 0.65 1.06 0.47 141 XMBrknScrpt_02 1865 0.80 1.05 0.69 142 TooManyTo_002 1842 2.08 1.04 2.55 143 XMClaimOffer 1797 0.42 1.01 0.14 144 XMSexyCombo_04 1768 0.69 1.00 0.55 145 FILL_THIS_FORM_LOAN 1766 0.39 1.00 0.11 146 T_HTML_TAG_BALANCE_CENTER 1760 0.43 0.99 0.17 147 RCVD_IN_IADB_VOUCHED 1753 2.87 0.99 3.73 148 XM_H_Long_From02 1751 0.90 0.99 0.86 149 ALL_TRUSTED 1749 11.69 0.99 16.58 150 HTML_FONT_FACE_BAD 1716 0.62 0.97 0.47 151 RELAYCOUNTRY_CN 1703 0.35 0.96 0.07 152 T_Symld_Words_02 1698 0.60 0.96 0.44 153 RCVD_IN_PSBL 1689 0.35 0.95 0.08 154 XMSubNoVowel 1669 0.56 0.94 0.38 155 BAYES_20 1654 2.20 0.93 2.78 156 XMMoneyMeta_00 1646 0.62 0.93 0.48 157 TooManyTo_003 1644 1.40 0.93 1.61 158 LONG_JUNK_URI3 1644 0.35 0.93 0.08 159 RELAYCOUNTRY_DE 1538 0.72 0.87 0.66 160 XM_UB60 1529 0.34 0.86 0.11 161 XM_BadFromFormat 1518 0.43 0.86 0.24 162 T_TooManySym_02 1517 1.65 0.85 2.02 163 URIBL_DBL_SPAM 1516 0.27 0.85 0.01 164 XM_B_COPY_HTML 1511 0.62 0.85 0.51 165 XMSlimDrugH 1496 0.59 0.84 0.47 166 URI_NOVOWEL 1495 0.51 0.84 0.36 167 XMSubMetaSSx_00 1478 0.42 0.83 0.24 168 XM_UB80 1463 0.28 0.82 0.02 169 HTML_FONT_SIZE_HUGE 1433 0.34 0.81 0.13 170 LongTLD 1423 0.36 0.80 0.15 171 PLING_QUERY 1416 0.40 0.80 0.22 172 INVALID_DATE 1413 0.32 0.80 0.11 173 RCVD_IN_MSPIKE_BL 1408 0.56 0.79 0.46 174 TR_Caps_n_Bayes_99 1398 0.28 0.79 0.05 175 HTML_SHORT_LINK_IMG_1 1395 0.26 0.79 0.02 176 LOW_PRICE 1363 0.48 0.77 0.35 177 TooManyTo_004 1356 1.05 0.76 1.18 178 MPART_ALT_DIFF_COUNT 1349 0.46 0.76 0.32 179 HTML_IMAGE_ONLY_28 1345 0.53 0.76 0.42 180 TR_Mismatch_TLD_02 1344 0.30 0.76 0.09 181 BOUNCE_MESSAGE 1332 1.74 0.75 2.20 182 ANY_BOUNCE_MESSAGE 1332 1.74 0.75 2.20 183 InconsistentFrom_001 1331 0.24 0.75 0.01 184 XM_H_PHPOS 1307 1.85 0.74 2.36 185 XMHTMLBadTable_001 1294 0.48 0.73 0.36 186 FROM_ADDR_WS 1280 0.23 0.72 0.00 187 XMCapTrack 1271 1.26 0.72 1.51 188 DIET_1 1260 0.44 0.71 0.32 189 RELAYCOUNTRY_AU 1247 0.53 0.70 0.45 190 HTML_TAG_BALANCE_BODY 1240 0.50 0.70 0.41 191 BODY_URI_ONLY 1219 0.24 0.69 0.04 192 XM_PDF 1216 3.64 0.69 4.99 193 THIS_AD 1213 0.31 0.68 0.14 194 TR_LOTS_OF_MONEY3 1212 0.46 0.68 0.36 195 XM_Lotto 1190 0.35 0.67 0.20 196 DKIM_ADSP_NXDOMAIN 1161 0.41 0.65 0.30 197 XMGppyBdWords 1141 0.34 0.64 0.21 198 RCVD_IN_DNSWL_MED 1093 2.00 0.62 2.63 199 TooManyTo_005 1084 0.86 0.61 0.98 200 XM_UB95 1079 0.20 0.61 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 337760 89.86 95.80 87.14 2 DKIM_SIGNED 278608 76.80 87.54 71.88 3 XM_DK_Pass 272712 75.01 85.16 70.36 4 DKIM_VALID 264214 73.02 83.63 68.17 5 DCC_CHECK_NEGATIVE 240840 48.10 17.44 62.14 6 BAYES_50 221074 49.22 32.15 57.04 7 DKIM_VALID_AU 190475 54.30 65.56 49.14 8 XMListUnsubscribeExists 175577 54.54 74.72 45.30 9 XM_H_QuotedFrom 139797 41.69 53.98 36.07 10 DCC_CHECK 137657 49.57 80.26 35.52 11 T_TM2_M_HEADER_IN_MSG 129898 29.29 20.07 33.51 12 HTML_FONT_LOW_CONTRAST 92022 27.99 37.27 23.74 13 DKIM_VALID_EF 91784 22.39 19.57 23.68 14 RCVD_IN_DNSWL_NONE 83262 23.17 26.85 21.48 15 XMSubLong 81356 22.59 26.09 20.99 16 FVGT_m_MULTI_ODD 79185 22.90 28.31 20.43 17 MultiRelay 78631 19.14 16.63 20.29 18 LOC_TINY_FONT_1 75334 24.12 34.35 19.44 19 MIME_HTML_ONLY 73139 22.47 30.34 18.87 20 ALL_TRUSTED 64277 11.69 0.99 16.58 21 XM_DK_Undo_02 57681 26.84 52.97 14.88 22 T_KAM_HTML_FONT_INVALID 52854 15.60 19.88 13.64 23 T_MIXED_ES 52785 14.45 16.27 13.62 24 BAYES_99 52744 24.20 47.35 13.61 25 BAYES_999 47108 21.20 40.96 12.15 26 XM_Multi_Part_URI 44091 13.06 16.73 11.38 27 XM_DKIMWhitelistDomains 42107 7.46 0.01 10.86 28 XM_Body_Dirty_Words 40856 13.62 20.34 10.54 29 RCVD_IN_RP_SAFE 39597 9.09 6.64 10.22 30 RCVD_IN_RP_CERTIFIED 34965 7.88 5.40 9.02 31 TooManyTo_001 34418 8.52 7.73 8.88 32 LOTS_OF_MONEY 33485 9.30 10.75 8.64 33 LotsOfNums_01 31726 8.72 9.90 8.19 34 XM_Evil_Numbers_Gen 30625 10.17 15.13 7.90 35 T_XMDrugObfuBody_14 30539 8.57 10.07 7.88 36 BAYES_00 30210 5.82 1.51 7.79 37 HTML_IMAGE_RATIO_02 27975 11.07 19.48 7.22 38 TR_DCC_Bayes_99 25246 16.54 38.45 6.51 39 RCVD_IN_MSPIKE_H2 25084 5.92 4.72 6.47 40 BAYES_60 25062 5.99 4.94 6.47 41 IN_ZIMBRA_NJ_WHITELIST 23605 4.19 0.05 6.09 42 XM_H_Long_From01 22697 6.61 8.24 5.86 43 RELAYCOUNTRY_META 21630 8.83 15.91 5.58 44 RCVD_IN_IADB_LISTED 21594 4.59 2.46 5.57 45 MIME_QP_LONG_LINE 21321 5.33 4.97 5.50 46 FSL_BULK_SIG 20730 6.47 8.91 5.35 47 XM_B_Phish_Phrases 20332 6.44 9.06 5.25 48 TR_XM_DK_Bayes 20061 3.93 1.20 5.18 49 XM_SendGrid 19852 4.90 4.41 5.12 50 T_REMOTE_IMAGE 19513 4.83 4.39 5.03 51 HTML_IMAGE_RATIO_04 19342 6.36 9.34 4.99 52 XM_PDF 19330 3.64 0.69 4.99 53 TR_XM_DK_Bayes1 19089 3.75 1.18 4.92 54 BOTNET_IPINHOSTNAME 18922 7.86 14.38 4.88 55 RCVD_IN_IADB_SPF 18794 4.03 2.23 4.85 56 T_TooManySym_01 17646 4.09 3.07 4.55 57 XMStrtUSub 17056 4.41 4.42 4.40 58 RCVD_IN_IADB_SENDERID 16669 3.62 2.13 4.30 59 RCVD_IN_IADB_DK 16162 3.52 2.11 4.17 60 BAYES_80 15830 5.03 7.08 4.08 61 TR_XM_DocInvoice 15599 5.57 8.94 4.02 62 TR_XM_DK_Bayes2 15323 3.06 1.10 3.95 63 BAYES_40 15247 3.04 1.10 3.93 64 RCVD_IN_IADB_VOUCHED 14440 2.87 0.99 3.73 65 DKIM_INVALID 14394 3.78 3.92 3.71 66 XM_UncommonTLD01 14325 4.41 5.97 3.70 67 XMSubMetaSx_00 13900 4.50 6.48 3.59 68 UNPARSEABLE_RELAY 13791 2.82 1.22 3.56 69 RCVD_IN_MSPIKE_WL 13237 2.83 1.56 3.42 70 RCVD_IN_MSPIKE_H3 13136 2.81 1.55 3.39 71 HTML_MIME_NO_HTML_TAG 12791 2.86 1.90 3.30 72 XMSexyCombo_05 12335 5.44 10.38 3.18 73 FROM_EXCESS_BASE64 12194 4.26 6.69 3.15 74 MAILING_LIST_MULTI 12102 2.77 1.99 3.12 75 TVD_RCVD_IP 11650 2.15 0.29 3.01 76 XMNumbers 11357 3.33 4.19 2.93 77 BAYES_20 10762 2.20 0.93 2.78 78 HELO_NODOT 10225 1.91 0.32 2.64 79 RCVD_IN_DNSWL_MED 10208 2.00 0.62 2.63 80 BAYES_95 9918 3.13 4.37 2.56 81 TooManyTo_002 9886 2.08 1.04 2.55 82 HTML_IMAGE_RATIO_06 9741 3.09 4.35 2.51 83 IN_HORDE_ADDRESS_BOOK 9619 1.73 0.10 2.48 84 MPART_ALT_DIFF 9451 3.96 7.27 2.44 85 XM_H_PHPOS 9154 1.85 0.74 2.36 86 HTML_IMAGE_RATIO_08 9063 2.64 3.31 2.34 87 MIME_HTML_MOSTLY 8660 3.13 5.09 2.23 88 ANY_BOUNCE_MESSAGE 8510 1.74 0.75 2.20 89 BOUNCE_MESSAGE 8508 1.74 0.75 2.20 90 XM_SPF_SoftFail 8162 2.58 3.61 2.11 91 USER_IN_DEF_DKIM_WL 7941 1.42 0.06 2.05 92 TR_Symld_Words 7835 1.73 1.09 2.02 93 T_TooManySym_02 7822 1.65 0.85 2.02 94 XM_DK_Undo_01 7680 1.79 1.36 1.98 95 XM_DIRTYINTL 7309 2.76 4.66 1.89 96 TM2_M_URI_OPT_OUT 7140 2.69 4.56 1.84 97 SUBJ_ALL_CAPS 6908 2.00 2.48 1.78 98 INVALID_MSGID 6880 1.28 0.21 1.78 99 BAYES_05 6752 1.37 0.57 1.74 100 RCVD_IN_IADB_OPTIN 6631 1.35 0.55 1.71 101 TooManyTo_003 6241 1.40 0.93 1.61 102 XM_CamelCaseFrm001 6142 2.20 3.55 1.58 103 TO_MALFORMED 6116 1.14 0.18 1.58 104 XMCapTrack 5837 1.26 0.72 1.51 105 T_XMDrugObfuBody_08 5832 1.64 1.94 1.50 106 RELAYCOUNTRY_CA 5709 2.08 3.39 1.47 107 UNTRUSTED_Relay 5617 3.87 9.16 1.45 108 BOTNET 5499 4.83 12.30 1.42 109 URI_HEX 5376 2.01 3.36 1.39 110 XM_GoogleGroups 5324 1.13 0.59 1.37 111 XMDiploma_00 5279 1.63 2.23 1.36 112 XMStockSpam_06 5264 1.38 1.43 1.36 113 XM_OfRef6 5038 1.78 2.83 1.30 114 RELAYCOUNTRY_GB 4640 1.33 1.64 1.20 115 XMPhish11 4579 1.15 1.10 1.18 116 TooManyTo_004 4566 1.05 0.76 1.18 117 MIME_HTML_ONLY_MULTI 4464 1.85 3.38 1.15 118 XM_ProductURIs 4456 1.25 1.47 1.15 119 RCVD_IN_DNSWL_LOW 4428 0.97 0.59 1.14 120 DKIM_ADSP_CUSTOM_MED 4094 0.91 0.58 1.06 121 SpammyFromTLD_01 3889 1.18 1.55 1.00 122 T_FILL_THIS_FORM_SHORT 3800 1.06 1.24 0.98 123 TooManyTo_005 3785 0.86 0.61 0.98 124 XMSubMetaI_00 3588 1.43 2.54 0.93 125 T_TooManySym_03 3554 0.72 0.28 0.92 126 XM_UB50 3487 1.81 3.80 0.90 127 XM_H_Long_From02 3352 0.90 0.99 0.86 128 XMGenDplmaNmb 3316 0.93 1.09 0.86 129 URI_TRY_3LD 3286 0.95 1.18 0.85 130 XM_S_JOY_D 3179 1.06 1.58 0.82 131 TM2_M_VERY_LONG_WORD 3128 1.17 1.95 0.81 132 XMBody_78 3117 1.01 1.46 0.80 133 XMSexyCombo_01 3054 1.16 1.97 0.79 134 NML_ADSP_CUSTOM_MED 3032 0.67 0.42 0.78 135 RCVD_IN_BL_SPAMCOP_NET 2994 1.79 4.00 0.77 136 XM_ShortIntro_01 2955 0.63 0.34 0.76 137 XMBody_95 2947 0.57 0.15 0.76 138 TR_MetaPhish_Combo_01 2926 0.69 0.55 0.75 139 XMSubMetaSxObfu_03 2879 0.68 0.53 0.74 140 USER_IN_WHITELIST 2845 0.50 0.00 0.73 141 T_MONEY_PERCENT 2790 0.84 1.12 0.72 142 TR_LOTS_OF_MONEY2 2790 0.84 1.12 0.72 143 XM_H_PHPMailer 2668 0.65 0.57 0.69 144 XMBdyGiftCard01 2666 1.00 1.69 0.69 145 XMBrknScrpt_02 2661 0.80 1.05 0.69 146 XMNoVowels 2633 0.64 0.54 0.68 147 RCVD_IN_IADB_DOPTIN 2628 0.49 0.08 0.68 148 T_XMHurry_00 2626 0.88 1.31 0.68 149 XM_B_TRADE_HTML 2618 0.59 0.39 0.68 150 SHORT_HELO_AND_INLINE_IMAGE 2559 0.48 0.08 0.66 151 RELAYCOUNTRY_DE 2550 0.72 0.87 0.66 152 RCVD_IN_SORBS_DUL 2518 0.50 0.16 0.65 153 T_OBFU_PDF_ATTACH 2483 0.50 0.18 0.64 154 XMGappySubj_01 2441 0.58 0.48 0.63 155 AC_DIV_BONANZA 2353 0.45 0.11 0.61 156 T_XMDrugObfuBody_00 2294 0.74 1.07 0.59 157 MISSING_HEADERS 2277 0.58 0.55 0.59 158 XMSubMetaSx_01 2218 0.48 0.27 0.57 159 HTML_IMAGE_ONLY_32 2168 0.50 0.38 0.56 160 TR_XM_RelayPhish 2134 0.87 1.58 0.55 161 XMSexyCombo_04 2128 0.69 1.00 0.55 162 RCVD_IN_DNSWL_HI 2069 0.38 0.03 0.53 163 XM_B_COPY_HTML 1984 0.62 0.85 0.51 164 XM_B_REG_HTML 1982 0.73 1.20 0.51 165 XMSolicitRefs_0 1883 0.46 0.41 0.49 166 XMSubMetaSxObfu_02 1876 0.45 0.37 0.48 167 XMMoneyMeta_00 1860 0.62 0.93 0.48 168 T_TooManySym_04 1833 0.35 0.09 0.47 169 XMSlimDrugH 1822 0.59 0.84 0.47 170 HTML_FONT_FACE_BAD 1815 0.62 0.97 0.47 171 HTTPS_HTTP_MISMATCH 1811 0.65 1.06 0.47 172 REMOVE_BEFORE_LINK 1808 0.69 1.18 0.47 173 XMSexyCombo_02 1803 0.36 0.13 0.47 174 RCVD_IN_MSPIKE_BL 1778 0.56 0.79 0.46 175 RELAYCOUNTRY_AU 1748 0.53 0.70 0.45 176 XMDateMe_00 1728 0.39 0.27 0.45 177 T_Symld_Words_02 1701 0.60 0.96 0.44 178 TVD_SPACE_RATIO 1680 0.43 0.43 0.43 179 XMPhish14 1670 0.63 1.08 0.43 180 HTML_IMAGE_ONLY_28 1640 0.53 0.76 0.42 181 XMPhish30 1636 0.71 1.33 0.42 182 TM2_M_BODY_EMPTY 1628 0.33 0.13 0.42 183 RCVD_IN_MSPIKE_L3 1603 0.32 0.12 0.41 184 TM2_M_A_HREF_HREF 1600 0.45 0.54 0.41 185 HTML_TAG_BALANCE_BODY 1579 0.50 0.70 0.41 186 HTML_IMAGE_ONLY_24 1573 0.40 0.40 0.41 187 RDNS_DYNAMIC 1542 0.63 1.15 0.40 188 XM_USANA_RCVD 1538 0.27 0.00 0.40 189 XMBSHREFv2 1529 0.44 0.55 0.39 190 XMBody_17 1506 0.73 1.47 0.39 191 XMSubNoVowel 1492 0.56 0.94 0.38 192 XM_H_PHPOS_M 1453 0.35 0.30 0.37 193 URI_NOVOWEL 1412 0.51 0.84 0.36 194 TR_LOTS_OF_MONEY3 1409 0.46 0.68 0.36 195 XMHTMLBadTable_001 1390 0.48 0.73 0.36 196 XMHTML_After_End 1382 0.59 1.09 0.36 197 FORGED_GMAIL_RCVD 1376 0.38 0.42 0.36 198 LOW_PRICE 1372 0.48 0.77 0.35 199 DOS_OUTLOOK_TO_MX 1369 0.27 0.10 0.35 200 SpammyFromTLD_02 1341 0.84 1.90 0.35 ----------------------------------------------------------------------