Email: 327712 Autolearn: 7244 AvgScore: 2.99 AvgScanTime: 2.85 sec Spam: 113383 Autolearn: 535 AvgScore: 12.24 AvgScanTime: 2.99 sec Ham: 214329 Autolearn: 6709 AvgScore: -1.90 AvgScanTime: 2.78 sec Time Spent Running SA: 259.45 hours Time Spent Processing Spam: 94.04 hours Time Spent Processing Ham: 165.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109242 90.52 96.35 87.43 2 DKIM_SIGNED 101211 82.75 89.26 79.30 3 XM_DK_Pass 99190 81.58 87.48 78.46 4 DKIM_VALID 96848 79.28 85.42 76.04 5 DCC_CHECK 93933 59.91 82.85 47.78 6 XMListUnsubscribeExists 89409 61.21 78.86 51.88 7 DKIM_VALID_AU 79306 63.48 69.95 60.07 8 XM_DK_Undo_02 60628 31.06 53.47 19.20 9 XM_H_QuotedFrom 60139 44.10 53.04 39.38 10 BAYES_99 52880 27.43 46.64 17.27 11 BAYES_999 46807 24.53 41.28 15.67 12 LOC_TINY_FONT_1 44750 31.43 39.47 27.17 13 TR_DCC_Bayes_99 42806 19.14 37.75 9.29 14 HTML_FONT_LOW_CONTRAST 41996 34.29 37.04 32.84 15 BAYES_50 33780 40.09 29.79 45.54 16 MIME_HTML_ONLY 33061 27.44 29.16 26.53 17 FVGT_m_MULTI_ODD 30481 23.17 26.88 21.21 18 XMSubLong 30114 24.16 26.56 22.89 19 HTML_IMAGE_RATIO_02 25474 14.15 22.47 9.75 20 XM_Body_Dirty_Words 24330 16.12 21.46 13.29 21 T_KAM_HTML_FONT_INVALID 21413 15.51 18.89 13.73 22 T_TM2_M_HEADER_IN_MSG 19295 20.25 17.02 21.96 23 DKIM_VALID_EF 18609 22.70 16.41 26.02 24 DCC_CHECK_NEGATIVE 17764 38.53 15.67 50.63 25 XM_Evil_Numbers_Gen 17597 11.62 15.52 9.55 26 BOTNET_IPINHOSTNAME 17341 10.00 15.29 7.21 27 XM_Multi_Part_URI 17297 14.75 15.26 14.48 28 RELAYCOUNTRY_META 16879 7.90 14.89 4.20 29 MultiRelay 16747 15.65 14.77 16.12 30 BOTNET 14214 5.82 12.54 2.26 31 LOTS_OF_MONEY 13677 10.67 12.06 9.93 32 LotsOfNums_01 12118 9.12 10.69 8.29 33 HTML_IMAGE_RATIO_04 11676 9.05 10.30 8.39 34 FSL_BULK_SIG 11620 10.47 10.25 10.59 35 XMSexyCombo_05 11568 7.22 10.20 5.64 36 RCVD_IN_RP_SAFE 11101 13.50 9.79 15.46 37 MPART_ALT_DIFF 11023 7.43 9.72 6.22 38 XM_B_Phish_Phrases 10708 8.23 9.44 7.59 39 T_XMDrugObfuBody_14 10291 7.59 9.08 6.80 40 UNTRUSTED_Relay 9878 3.81 8.71 1.21 41 FROM_EXCESS_BASE64 9157 6.05 8.08 4.98 42 XM_UncommonTLD01 8624 5.46 7.61 4.32 43 RCVD_IN_MSPIKE_H2 8556 8.35 7.55 8.77 44 XMSubMetaSx_00 8546 5.32 7.54 4.15 45 XM_H_Long_From01 8408 6.53 7.42 6.06 46 TR_XM_DocInvoice 8287 5.88 7.31 5.12 47 RCVD_IN_RP_CERTIFIED 7939 11.23 7.00 13.47 48 MIME_HTML_MOSTLY 7929 4.59 6.99 3.32 49 TooManyTo_001 7715 6.64 6.80 6.56 50 BAYES_80 6990 4.98 6.16 4.35 51 BAYES_00 5971 13.71 5.27 18.18 52 BAYES_60 5738 5.94 5.06 6.40 53 RCVD_IN_BL_SPAMCOP_NET 5521 2.07 4.87 0.59 54 XM_SendGrid 5261 5.52 4.64 5.99 55 XM_CamelCaseFrm001 5193 2.78 4.58 1.82 56 T_TooManySym_01 5114 5.06 4.51 5.35 57 HTML_IMAGE_RATIO_06 5079 3.42 4.48 2.86 58 TR_XM_DK_Bayes 4843 10.59 4.27 13.94 59 XM_DIRTYINTL 4749 2.79 4.19 2.05 60 XMStrtUSub 4705 4.84 4.15 5.20 61 MIME_QP_LONG_LINE 4687 4.29 4.13 4.38 62 BAYES_95 4646 3.19 4.10 2.70 63 DKIM_INVALID 4363 3.46 3.85 3.26 64 T_REMOTE_IMAGE 4350 4.50 3.84 4.86 65 MIME_HTML_ONLY_MULTI 4047 3.90 3.57 4.07 66 TM2_M_URI_OPT_OUT 3955 4.20 3.49 4.58 67 RELAYCOUNTRY_CA 3842 2.09 3.39 1.40 68 TR_XM_DK_Bayes1 3758 9.29 3.31 12.45 69 URI_HEX 3750 2.11 3.31 1.47 70 XM_UB50 3665 1.57 3.23 0.68 71 XMNumbers 3627 2.89 3.20 2.73 72 XMBdyGiftCard01 3585 2.15 3.16 1.62 73 HTML_IMAGE_RATIO_08 3319 2.59 2.93 2.42 74 XMSubMetaI_00 3136 1.65 2.77 1.05 75 TR_XM_DK_Bayes2 3113 7.58 2.75 10.13 76 XM_OfRef6 2991 1.52 2.64 0.94 77 XM_SPF_SoftFail 2941 1.70 2.59 1.23 78 T_MIXED_ES 2914 2.13 2.57 1.90 79 SUBJ_ALL_CAPS 2861 1.93 2.52 1.61 80 XMDiploma_00 2752 1.61 2.43 1.18 81 XM_URI_RBL 2617 0.91 2.31 0.18 82 RCVD_IN_RP_RNBL 2583 0.81 2.28 0.03 83 MultiRelay_CC 2475 0.86 2.18 0.16 84 MultiRelay_Combo 2475 0.86 2.18 0.16 85 T_XMHurry_00 2463 1.20 2.17 0.69 86 URI_TRY_3LD 2452 2.25 2.16 2.30 87 RELAYCOUNTRY_FR 2448 0.93 2.16 0.28 88 XMBody_17 2435 1.05 2.15 0.47 89 NO_DNS_FOR_FROM 2419 2.11 2.13 2.10 90 XM_XX_Yahoo 2311 0.80 2.04 0.14 91 SUBJ_DOLLARS 2262 1.00 2.00 0.47 92 RCVD_IN_DNSWL_NONE 2261 3.61 1.99 4.46 93 RCVD_IN_IADB_LISTED 2245 3.82 1.98 4.79 94 BODY_ENHANCEMENT 2245 0.76 1.98 0.11 95 XM_UB99 2159 0.66 1.90 0.00 96 XMSexyCombo_01 2111 0.98 1.86 0.52 97 XM_H_Long_From02 2003 1.22 1.77 0.93 98 RCVD_IN_IADB_SPF 1999 3.37 1.76 4.22 99 TM2_M_VERY_LONG_WORD 1983 1.20 1.75 0.91 100 XM_BadFromFormat 1941 0.78 1.71 0.29 101 RCVD_IN_PSBL 1920 0.66 1.69 0.11 102 XMPhish30 1913 0.96 1.69 0.58 103 URIBL_BLACK 1894 0.60 1.67 0.03 104 RCVD_IN_IADB_SENDERID 1890 3.04 1.67 3.77 105 INVALID_MSGID 1874 3.39 1.65 4.31 106 XMPhish14 1869 0.76 1.65 0.28 107 FSL_THIS_IS_ADV 1861 0.66 1.64 0.14 108 RCVD_IN_IADB_DK 1855 2.97 1.64 3.67 109 T_MONEY_PERCENT 1825 0.98 1.61 0.65 110 TR_LOTS_OF_MONEY2 1825 0.98 1.61 0.65 111 XM_UB999 1812 0.56 1.60 0.00 112 SpammyFromTLD_01 1797 0.88 1.58 0.50 113 XM_DK_Undo_01 1780 1.70 1.57 1.77 114 SpammyFromTLD_02 1755 0.66 1.55 0.20 115 RELAYCOUNTRY_AT 1730 0.63 1.53 0.15 116 T_XMDrugObfuBody_08 1730 1.22 1.53 1.06 117 TR_XM_RelayPhish 1718 0.83 1.52 0.46 118 URIBL_DBL_SPAM 1717 0.53 1.51 0.01 119 HTML_MIME_NO_HTML_TAG 1652 1.53 1.46 1.57 120 DATE_IN_PAST_06_12 1590 0.52 1.40 0.06 121 XM_S_JOY_D 1566 0.88 1.38 0.61 122 MAILING_LIST_MULTI 1551 1.80 1.37 2.03 123 XM_ProductURIs 1550 1.54 1.37 1.63 124 XM_HighProb1 1539 0.48 1.36 0.02 125 DIET_1 1500 0.71 1.32 0.39 126 TR_Caps_n_Bayes_99 1460 0.49 1.29 0.07 127 T_HTML_TAG_BALANCE_CENTER 1440 0.62 1.27 0.27 128 HTML_FONT_FACE_BAD 1423 0.70 1.26 0.41 129 XMStockSpam_06 1420 1.92 1.25 2.28 130 XM_B_COPY_HTML 1414 1.06 1.25 0.96 131 XMSubMetaD_03 1404 0.49 1.24 0.09 132 XMHTML_After_End 1386 0.64 1.22 0.33 133 UNPARSEABLE_RELAY 1374 3.88 1.21 5.29 134 XMBody_78 1370 1.07 1.21 1.00 135 XM_B_REG_HTML 1366 1.19 1.20 1.19 136 FILL_THIS_FORM 1344 0.63 1.19 0.34 137 BAYES_40 1343 2.09 1.18 2.57 138 RDNS_DYNAMIC 1296 0.76 1.14 0.55 139 BOTNET_NORDNS 1275 0.41 1.12 0.03 140 T_XMDrugObfuBody_00 1214 0.88 1.07 0.77 141 XMGenDplmaNmb 1211 0.78 1.07 0.62 142 BAYES_20 1198 1.55 1.06 1.81 143 HTML_FONT_SIZE_HUGE 1139 0.49 1.00 0.22 144 DKIM_ADSP_NXDOMAIN 1123 0.62 0.99 0.43 145 HTML_SHORT_LINK_IMG_1 1117 0.36 0.99 0.03 146 BODY_URI_ONLY 1115 0.37 0.98 0.05 147 HTML_TAG_BALANCE_BODY 1111 0.66 0.98 0.49 148 RCVD_IN_MSPIKE_WL 1111 1.69 0.98 2.07 149 RCVD_IN_MSPIKE_H3 1107 1.69 0.98 2.06 150 XM_RXBody 1098 1.03 0.97 1.06 151 LongTLD 1056 0.41 0.93 0.14 152 MPART_ALT_DIFF_COUNT 1050 0.52 0.93 0.31 153 FILL_THIS_FORM_LONG 1049 0.49 0.93 0.25 154 TR_Mismatch_TLD_02 1037 0.35 0.91 0.06 155 RELAYCOUNTRY_GB 1024 0.71 0.90 0.61 156 LONG_JUNK_URI 1003 0.37 0.88 0.10 157 LONG_JUNK_URI3 986 0.40 0.87 0.15 158 BASE64_LENGTH_79_INF 959 0.43 0.85 0.21 159 RCVD_IN_IADB_VOUCHED 946 2.33 0.83 3.12 160 XMPhish11 944 0.89 0.83 0.93 161 TR_LOTS_OF_MONEY3 939 0.58 0.83 0.44 162 XMBrknScrpt_02 937 0.94 0.83 0.99 163 URIBL_CSS 926 0.29 0.82 0.02 164 URIBL_CSS_A 926 0.29 0.82 0.02 165 XMMoneyMeta_00 923 0.46 0.81 0.28 166 RELAYCOUNTRY_DE 923 0.58 0.81 0.45 167 URI_NOVOWEL 916 0.47 0.81 0.30 168 XM_UB60 915 0.31 0.81 0.05 169 HTML_IMAGE_ONLY_08 905 0.35 0.80 0.11 170 XMSubMetaSxObfu_01 904 0.35 0.80 0.11 171 PLING_QUERY 900 0.52 0.79 0.37 172 HDRS_LCASE_IMGONLY 894 0.29 0.79 0.03 173 XM_H_PHPOS 888 1.10 0.78 1.26 174 FILL_THIS_FORM_LOAN 885 0.43 0.78 0.25 175 T_Symld_Words_02 872 0.41 0.77 0.23 176 TR_Symld_Words 859 1.90 0.76 2.50 177 RCVD_IN_MSPIKE_BL 858 0.32 0.76 0.10 178 REMOVE_BEFORE_LINK 856 0.48 0.75 0.34 179 BAYES_05 837 1.02 0.74 1.17 180 T_TooManySym_02 834 1.66 0.74 2.16 181 DKIM_ADSP_CUSTOM_MED 809 0.80 0.71 0.85 182 FROM_LOCAL_HEX 803 0.29 0.71 0.07 183 XMLongAddy 802 0.28 0.71 0.06 184 XM_H_Long_From03 796 0.27 0.70 0.04 185 RCVD_IN_MSPIKE_L5 796 0.27 0.70 0.04 186 LOW_PRICE 795 0.38 0.70 0.20 187 XMSlimDrugH 786 0.39 0.69 0.23 188 DATE_IN_PAST_03_06 783 0.30 0.69 0.09 189 T_FILL_THIS_FORM_SHORT 779 0.54 0.69 0.47 190 XMSubMetaI_01 771 0.26 0.68 0.03 191 RELAYCOUNTRY_AU 770 0.46 0.68 0.34 192 XM_Body_Obfu01 761 0.36 0.67 0.20 193 FROM_LOCAL_DIGITS 761 0.24 0.67 0.02 194 XM_B_TRADE_HTML 756 0.51 0.67 0.42 195 XM_UB80 737 0.24 0.65 0.02 196 XMSubMetaSSx_00 724 0.32 0.64 0.15 197 ALL_TRUSTED 705 7.72 0.62 11.48 198 DATE_IN_PAST_12_24 705 0.26 0.62 0.07 199 XMClaimOffer 695 0.39 0.61 0.27 200 RCVD_IN_DNSWL_BLOCKED 685 1.02 0.60 1.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 187392 90.52 96.35 87.43 2 DKIM_SIGNED 169958 82.75 89.26 79.30 3 XM_DK_Pass 168167 81.58 87.48 78.46 4 DKIM_VALID 162978 79.28 85.42 76.04 5 DKIM_VALID_AU 128741 63.48 69.95 60.07 6 XMListUnsubscribeExists 111186 61.21 78.86 51.88 7 DCC_CHECK_NEGATIVE 108516 38.53 15.67 50.63 8 DCC_CHECK 102402 59.91 82.85 47.78 9 BAYES_50 97610 40.09 29.79 45.54 10 XM_H_QuotedFrom 84398 44.10 53.04 39.38 11 HTML_FONT_LOW_CONTRAST 70389 34.29 37.04 32.84 12 LOC_TINY_FONT_1 58240 31.43 39.47 27.17 13 MIME_HTML_ONLY 56871 27.44 29.16 26.53 14 DKIM_VALID_EF 55778 22.70 16.41 26.02 15 XMSubLong 49062 24.16 26.56 22.89 16 T_TM2_M_HEADER_IN_MSG 47077 20.25 17.02 21.96 17 FVGT_m_MULTI_ODD 45454 23.17 26.88 21.21 18 XM_DK_Undo_02 41157 31.06 53.47 19.20 19 XM_DKIMWhitelistDomains 40496 12.36 0.02 18.89 20 BAYES_00 38966 13.71 5.27 18.18 21 BAYES_99 37020 27.43 46.64 17.27 22 MultiRelay 34553 15.65 14.77 16.12 23 BAYES_999 33579 24.53 41.28 15.67 24 RCVD_IN_RP_SAFE 33144 13.50 9.79 15.46 25 XM_Multi_Part_URI 31042 14.75 15.26 14.48 26 TR_XM_DK_Bayes 29868 10.59 4.27 13.94 27 T_KAM_HTML_FONT_INVALID 29428 15.51 18.89 13.73 28 RCVD_IN_RP_CERTIFIED 28865 11.23 7.00 13.47 29 XM_Body_Dirty_Words 28489 16.12 21.46 13.29 30 TR_XM_DK_Bayes1 26674 9.29 3.31 12.45 31 ALL_TRUSTED 24602 7.72 0.62 11.48 32 FSL_BULK_SIG 22698 10.47 10.25 10.59 33 TR_XM_DK_Bayes2 21714 7.58 2.75 10.13 34 LOTS_OF_MONEY 21276 10.67 12.06 9.93 35 HTML_IMAGE_RATIO_02 20907 14.15 22.47 9.75 36 XM_Evil_Numbers_Gen 20477 11.62 15.52 9.55 37 TR_DCC_Bayes_99 19913 19.14 37.75 9.29 38 RCVD_IN_MSPIKE_H2 18799 8.35 7.55 8.77 39 HTML_IMAGE_RATIO_04 17990 9.05 10.30 8.39 40 LotsOfNums_01 17758 9.12 10.69 8.29 41 IN_ZIMBRA_NJ_WHITELIST 16416 5.02 0.02 7.66 42 XM_B_Phish_Phrases 16273 8.23 9.44 7.59 43 BOTNET_IPINHOSTNAME 15443 10.00 15.29 7.21 44 T_XMDrugObfuBody_14 14574 7.59 9.08 6.80 45 TooManyTo_001 14056 6.64 6.80 6.56 46 BAYES_60 13721 5.94 5.06 6.40 47 MPART_ALT_DIFF 13334 7.43 9.72 6.22 48 XM_H_Long_From01 12988 6.53 7.42 6.06 49 XM_SendGrid 12836 5.52 4.64 5.99 50 XMSexyCombo_05 12079 7.22 10.20 5.64 51 T_TooManySym_01 11458 5.06 4.51 5.35 52 UNPARSEABLE_RELAY 11345 3.88 1.21 5.29 53 XMStrtUSub 11141 4.84 4.15 5.20 54 TR_XM_DocInvoice 10977 5.88 7.31 5.12 55 FROM_EXCESS_BASE64 10677 6.05 8.08 4.98 56 T_REMOTE_IMAGE 10409 4.50 3.84 4.86 57 RCVD_IN_IADB_LISTED 10266 3.82 1.98 4.79 58 TM2_M_URI_OPT_OUT 9824 4.20 3.49 4.58 59 RCVD_IN_DNSWL_NONE 9568 3.61 1.99 4.46 60 MIME_QP_LONG_LINE 9386 4.29 4.13 4.38 61 BAYES_80 9332 4.98 6.16 4.35 62 TVD_RCVD_IP 9307 3.00 0.46 4.34 63 XM_UncommonTLD01 9260 5.46 7.61 4.32 64 INVALID_MSGID 9231 3.39 1.65 4.31 65 RCVD_IN_IADB_SPF 9038 3.37 1.76 4.22 66 RELAYCOUNTRY_META 8994 7.90 14.89 4.20 67 XMSubMetaSx_00 8891 5.32 7.54 4.15 68 MIME_HTML_ONLY_MULTI 8730 3.90 3.57 4.07 69 RCVD_IN_IADB_SENDERID 8079 3.04 1.67 3.77 70 RCVD_IN_IADB_DK 7873 2.97 1.64 3.67 71 MIME_HTML_MOSTLY 7119 4.59 6.99 3.32 72 DKIM_INVALID 6980 3.46 3.85 3.26 73 RCVD_IN_IADB_VOUCHED 6678 2.33 0.83 3.12 74 HTML_IMAGE_RATIO_06 6127 3.42 4.48 2.86 75 TO_MALFORMED 6004 1.91 0.23 2.80 76 XMNumbers 5859 2.89 3.20 2.73 77 BAYES_95 5795 3.19 4.10 2.70 78 USER_IN_DEF_DKIM_WL 5595 1.72 0.05 2.61 79 BAYES_40 5506 2.09 1.18 2.57 80 TR_Symld_Words 5358 1.90 0.76 2.50 81 IN_HORDE_ADDRESS_BOOK 5335 1.66 0.08 2.49 82 HTML_IMAGE_RATIO_08 5177 2.59 2.93 2.42 83 URI_TRY_3LD 4919 2.25 2.16 2.30 84 XMStockSpam_06 4880 1.92 1.25 2.28 85 BOTNET 4852 5.82 12.54 2.26 86 T_TooManySym_02 4619 1.66 0.74 2.16 87 NO_DNS_FOR_FROM 4511 2.11 2.13 2.10 88 RCVD_IN_MSPIKE_WL 4440 1.69 0.98 2.07 89 RCVD_IN_MSPIKE_H3 4418 1.69 0.98 2.06 90 XM_DIRTYINTL 4386 2.79 4.19 2.05 91 MAILING_LIST_MULTI 4341 1.80 1.37 2.03 92 T_MIXED_ES 4069 2.13 2.57 1.90 93 XM_PDF 3921 1.33 0.37 1.83 94 XM_CamelCaseFrm001 3905 2.78 4.58 1.82 95 BAYES_20 3880 1.55 1.06 1.81 96 XM_DK_Undo_01 3793 1.70 1.57 1.77 97 XM_ProductURIs 3497 1.54 1.37 1.63 98 XMBdyGiftCard01 3466 2.15 3.16 1.62 99 SUBJ_ALL_CAPS 3453 1.93 2.52 1.61 100 ANY_BOUNCE_MESSAGE 3397 1.17 0.40 1.58 101 BOUNCE_MESSAGE 3396 1.17 0.40 1.58 102 HTML_MIME_NO_HTML_TAG 3364 1.53 1.46 1.57 103 URI_HEX 3151 2.11 3.31 1.47 104 RCVD_IN_IADB_OPTIN 3151 1.12 0.47 1.47 105 TooManyTo_002 3103 1.12 0.51 1.45 106 RELAYCOUNTRY_CA 3008 2.09 3.39 1.40 107 XM_GoogleGroups 2940 1.08 0.54 1.37 108 XM_H_PHPOS 2711 1.10 0.78 1.26 109 USER_IN_WHITELIST 2690 0.82 0.00 1.26 110 RCVD_IN_DNSWL_BLOCKED 2669 1.02 0.60 1.25 111 XM_SPF_SoftFail 2626 1.70 2.59 1.23 112 UNTRUSTED_Relay 2598 3.81 8.71 1.21 113 XM_B_REG_HTML 2550 1.19 1.20 1.19 114 XMDiploma_00 2532 1.61 2.43 1.18 115 XMSubNoVowel 2528 0.91 0.40 1.18 116 BAYES_05 2499 1.02 0.74 1.17 117 XM_RXBody 2282 1.03 0.97 1.06 118 T_XMDrugObfuBody_08 2270 1.22 1.53 1.06 119 XMSubMetaI_00 2259 1.65 2.77 1.05 120 XMSubMetaSxObfu_02 2258 0.84 0.43 1.05 121 XMBody_78 2140 1.07 1.21 1.00 122 XMBrknScrpt_02 2129 0.94 0.83 0.99 123 XMBody_95 2087 0.68 0.12 0.97 124 XM_B_COPY_HTML 2058 1.06 1.25 0.96 125 XM_OfRef6 2004 1.52 2.64 0.94 126 XM_H_Long_From02 1986 1.22 1.77 0.93 127 XMPhish11 1984 0.89 0.83 0.93 128 T_TooManySym_03 1981 0.71 0.30 0.92 129 TooManyTo_003 1965 0.75 0.44 0.92 130 TM2_M_VERY_LONG_WORD 1948 1.20 1.75 0.91 131 DKIM_ADSP_CUSTOM_MED 1823 0.80 0.71 0.85 132 TM2_M_A_HREF_HREF 1676 0.67 0.45 0.78 133 T_XMDrugObfuBody_00 1655 0.88 1.07 0.77 134 HELO_NODOT 1574 0.53 0.14 0.73 135 TooManyTo_004 1488 0.56 0.31 0.69 136 T_XMHurry_00 1480 1.20 2.17 0.69 137 XM_H_PHPMailer 1471 0.63 0.52 0.69 138 XM_UB50 1466 1.57 3.23 0.68 139 TR_LOTS_OF_MONEY2 1384 0.98 1.61 0.65 140 T_MONEY_PERCENT 1384 0.98 1.61 0.65 141 XMGenDplmaNmb 1334 0.78 1.07 0.62 142 NML_ADSP_CUSTOM_MED 1311 0.61 0.60 0.61 143 XM_S_JOY_D 1305 0.88 1.38 0.61 144 RELAYCOUNTRY_GB 1300 0.71 0.90 0.61 145 TooManyTo_005 1294 0.49 0.27 0.60 146 XMGppyBdWords 1287 0.59 0.56 0.60 147 RCVD_IN_BL_SPAMCOP_NET 1274 2.07 4.87 0.59 148 XMPhish30 1238 0.96 1.69 0.58 149 XM_H_PHPOS_M 1203 0.50 0.37 0.56 150 XMHTMLBadTable_001 1202 0.57 0.60 0.56 151 RDNS_DYNAMIC 1184 0.76 1.14 0.55 152 RCVD_IN_IADB_DOPTIN 1176 0.39 0.08 0.55 153 XM_Sams_Club_Forge 1151 0.39 0.11 0.54 154 T_TooManySym_04 1121 0.35 0.04 0.52 155 XMNoVowels 1113 0.44 0.30 0.52 156 XMSexyCombo_01 1104 0.98 1.86 0.52 157 SpammyFromTLD_01 1076 0.88 1.58 0.50 158 TR_MetaPhish_Combo_01 1070 0.47 0.41 0.50 159 HTML_TAG_BALANCE_BODY 1060 0.66 0.98 0.49 160 XM_ShortIntro_01 1057 0.45 0.36 0.49 161 SUBJ_DOLLARS 1018 1.00 2.00 0.47 162 T_FILL_THIS_FORM_SHORT 1003 0.54 0.69 0.47 163 XMBody_17 1001 1.05 2.15 0.47 164 RCVD_IN_DNSWL_MED 998 0.32 0.04 0.47 165 XMRcvdHeader_S01 991 0.30 0.01 0.46 166 TR_XM_RelayPhish 987 0.83 1.52 0.46 167 RELAYCOUNTRY_DE 968 0.58 0.81 0.45 168 TR_LOTS_OF_MONEY3 953 0.58 0.83 0.44 169 XMCapTrack 928 0.38 0.28 0.43 170 DKIM_ADSP_NXDOMAIN 917 0.62 0.99 0.43 171 XM_B_TRADE_HTML 909 0.51 0.67 0.42 172 XM_E_Blogspot 899 0.30 0.08 0.42 173 HTML_FONT_FACE_BAD 887 0.70 1.26 0.41 174 XM_D_tchamptons_WL 878 0.27 0.00 0.41 175 DIET_1 838 0.71 1.32 0.39 176 HTML_IMAGE_ONLY_32 816 0.41 0.46 0.38 177 PLING_QUERY 803 0.52 0.79 0.37 178 FORGED_GMAIL_RCVD 799 0.43 0.55 0.37 179 XMRcvdHeader_15 739 0.23 0.00 0.34 180 TVD_SPACE_RATIO 737 0.29 0.18 0.34 181 RCVD_IN_IADB_RDNS 732 0.23 0.03 0.34 182 FILL_THIS_FORM 729 0.63 1.19 0.34 183 REMOVE_BEFORE_LINK 725 0.48 0.75 0.34 184 RELAYCOUNTRY_AU 724 0.46 0.68 0.34 185 XMHTML_After_End 715 0.64 1.22 0.33 186 MISSING_HEADERS 702 0.32 0.31 0.33 187 HTTPS_HTTP_MISMATCH 689 0.32 0.32 0.32 188 XMLngstWrd_00 677 0.31 0.30 0.32 189 FORGED_OUTLOOK_TAGS 674 0.22 0.03 0.31 190 HTML_IMAGE_ONLY_20 669 0.30 0.28 0.31 191 MPART_ALT_DIFF_COUNT 657 0.52 0.93 0.31 192 TR_MetaPhish_Combo_01b 645 0.24 0.12 0.30 193 XM_H_SpoofStaff4 637 0.20 0.03 0.30 194 URI_NOVOWEL 636 0.47 0.81 0.30 195 XMBody_29 635 0.22 0.08 0.30 196 XMSUPPORT 633 0.19 0.00 0.30 197 XM_BadFromFormat 626 0.78 1.71 0.29 198 HTML_IMAGE_ONLY_28 621 0.31 0.36 0.29 199 URI_TRUNCATED 616 0.20 0.03 0.29 200 RELAYCOUNTRY_FR 610 0.93 2.16 0.28 ----------------------------------------------------------------------