Email: 503843 Autolearn: 0 AvgScore: 3.32 AvgScanTime: 2.51 sec Spam: 145019 Autolearn: 0 AvgScore: 12.56 AvgScanTime: 2.89 sec Ham: 358824 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 2.36 sec Time Spent Running SA: 351.19 hours Time Spent Processing Spam: 116.37 hours Time Spent Processing Ham: 234.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139044 88.98 95.88 86.20 2 DKIM_SIGNED 123416 74.06 85.10 69.60 3 XM_DK_Pass 119902 72.35 82.68 68.17 4 DKIM_VALID 117501 70.02 81.02 65.57 5 DCC_CHECK 115424 46.51 79.59 33.13 6 XMListUnsubscribeExists 105423 51.69 72.70 43.20 7 DKIM_VALID_AU 88954 51.50 61.34 47.52 8 XM_H_QuotedFrom 80074 40.55 55.22 34.63 9 XM_DK_Undo_02 73598 24.13 50.75 13.37 10 BAYES_99 68171 22.28 47.01 12.29 11 BAYES_999 58226 19.30 40.15 10.87 12 TR_DCC_Bayes_99 53935 14.60 37.19 5.47 13 HTML_FONT_LOW_CONTRAST 52633 27.56 36.29 24.03 14 LOC_TINY_FONT_1 49144 23.23 33.89 18.93 15 MIME_HTML_ONLY 46636 23.24 32.16 19.63 16 BAYES_50 45048 50.00 31.06 57.65 17 XMSubLong 40899 23.76 28.20 21.97 18 FVGT_m_MULTI_ODD 40641 21.90 28.02 19.42 19 DKIM_VALID_EF 33521 24.22 23.11 24.67 20 T_TM2_M_HEADER_IN_MSG 30453 30.73 21.00 34.66 21 T_KAM_HTML_FONT_INVALID 29975 15.16 20.67 12.93 22 XM_Body_Dirty_Words 28412 12.61 19.59 9.79 23 DCC_CHECK_NEGATIVE 26255 51.14 18.10 64.49 24 MultiRelay 25173 19.72 17.36 20.67 25 XM_Multi_Part_URI 24043 11.74 16.58 9.79 26 RELAYCOUNTRY_META 23047 8.49 15.89 5.49 27 XM_Evil_Numbers_Gen 21515 9.73 14.84 7.66 28 HTML_IMAGE_RATIO_02 21414 8.69 14.77 6.24 29 BOTNET 19233 4.73 13.26 1.28 30 BOTNET_IPINHOSTNAME 19150 7.04 13.21 4.55 31 LOTS_OF_MONEY 18089 10.06 12.47 9.08 32 FSL_BULK_SIG 17920 9.14 12.36 7.84 33 T_XMDrugObfuBody_14 16236 8.68 11.20 7.66 34 XMSexyCombo_05 15629 5.49 10.78 3.36 35 XM_B_Phish_Phrases 15075 6.82 10.40 5.38 36 HTML_IMAGE_RATIO_04 14739 6.31 10.16 4.75 37 UNTRUSTED_Relay 14145 3.76 9.75 1.34 38 LotsOfNums_01 12775 7.72 8.81 7.28 39 XM_UncommonTLD01 11642 4.98 8.03 3.75 40 MPART_ALT_DIFF 11092 4.13 7.65 2.71 41 TooManyTo_001 11083 9.05 7.64 9.61 42 BAYES_80 11006 5.03 7.59 4.00 43 TR_XM_DocInvoice 10957 5.45 7.56 4.61 44 XM_H_Long_From01 10656 6.33 7.35 5.92 45 XMSubMetaSx_00 10381 5.04 7.16 4.18 46 FROM_EXCESS_BASE64 9023 4.54 6.22 3.86 47 MIME_QP_LONG_LINE 8834 5.43 6.09 5.17 48 RCVD_IN_RP_SAFE 8706 8.14 6.00 9.01 49 BAYES_60 8234 6.12 5.68 6.30 50 XMNumbers 7651 3.81 5.28 3.22 51 XMStrtUSub 7556 4.18 5.21 3.76 52 RCVD_IN_RP_CERTIFIED 7458 7.43 5.14 8.35 53 HTML_IMAGE_RATIO_06 7259 3.48 5.01 2.86 54 RCVD_IN_MSPIKE_H2 7148 4.87 4.93 4.84 55 TM2_M_URI_OPT_OUT 6971 2.62 4.81 1.73 56 BAYES_95 6930 3.25 4.78 2.63 57 MIME_HTML_MOSTLY 6808 2.96 4.69 2.27 58 XM_UB50 6685 1.95 4.61 0.87 59 T_REMOTE_IMAGE 6194 4.67 4.27 4.83 60 XM_SendGrid 5973 4.90 4.12 5.22 61 XM_DIRTYINTL 5949 2.46 4.10 1.80 62 DKIM_INVALID 5915 4.04 4.08 4.02 63 XM_SPF_SoftFail 5681 2.82 3.92 2.37 64 MIME_HTML_ONLY_MULTI 5631 1.88 3.88 1.07 65 RCVD_IN_BL_SPAMCOP_NET 5468 1.64 3.77 0.78 66 XM_CamelCaseFrm001 5404 2.30 3.73 1.73 67 T_TooManySym_01 4781 4.16 3.30 4.50 68 RELAYCOUNTRY_CA 4685 1.90 3.23 1.37 69 HTML_IMAGE_RATIO_08 4631 2.30 3.19 1.93 70 URI_HEX 4579 1.86 3.16 1.33 71 XM_URI_RBL 4075 0.90 2.81 0.13 72 HTML_MIME_NO_HTML_TAG 3879 2.81 2.67 2.87 73 XM_OfRef6 3821 1.89 2.63 1.59 74 MultiRelay_CC 3780 0.94 2.61 0.27 75 MultiRelay_Combo 3780 0.94 2.61 0.27 76 T_XMDrugObfuBody_08 3689 1.71 2.54 1.38 77 XM_H_Long_From02 3674 1.39 2.53 0.93 78 XMDiploma_00 3673 1.79 2.53 1.50 79 RCVD_IN_IADB_LISTED 3553 4.39 2.45 5.18 80 XMHTML_After_End 3232 0.91 2.23 0.37 81 RCVD_IN_IADB_SPF 3194 3.86 2.20 4.54 82 BOTNET_NORDNS 3141 0.93 2.17 0.44 83 RCVD_IN_IADB_SENDERID 3031 3.44 2.09 3.99 84 RCVD_IN_IADB_DK 3019 3.36 2.08 3.88 85 XM_ProductURIs 2884 1.43 1.99 1.21 86 T_XMHurry_00 2841 0.89 1.96 0.46 87 URIBL_BLACK 2711 0.57 1.87 0.05 88 MAILING_LIST_MULTI 2695 2.71 1.86 3.06 89 SUBJ_ALL_CAPS 2691 1.71 1.86 1.65 90 XM_UB99 2661 0.54 1.83 0.02 91 TM2_M_VERY_LONG_WORD 2572 1.15 1.77 0.89 92 RELAYCOUNTRY_CN 2571 0.57 1.77 0.08 93 TR_Mismatch_TLD_02 2565 0.57 1.77 0.08 94 RCVD_IN_PSBL 2525 0.56 1.74 0.08 95 UNPARSEABLE_RELAY 2494 3.09 1.72 3.64 96 SpammyFromTLD_02 2475 0.78 1.71 0.40 97 XMBody_17 2442 0.87 1.68 0.54 98 RCVD_IN_RP_RNBL 2425 0.49 1.67 0.01 99 XMSexyCombo_01 2386 1.17 1.65 0.98 100 XMGenDplmaNmb 2336 1.14 1.61 0.95 101 TR_XM_RelayPhish 2316 0.84 1.60 0.53 102 SpammyFromTLD_01 2303 1.07 1.59 0.86 103 XM_DK_Undo_01 2298 1.92 1.58 2.05 104 XM_HighProb1 2142 0.44 1.48 0.02 105 DIET_1 2127 0.63 1.47 0.30 106 RELAYCOUNTRY_FR 2126 0.59 1.47 0.23 107 XMSubMetaI_00 2087 0.81 1.44 0.55 108 XMStockSpam_06 2080 1.37 1.43 1.35 109 XMPhish30 2070 0.70 1.43 0.41 110 XM_UB999 2060 0.42 1.42 0.01 111 T_XMDrugObfuBody_00 2010 0.87 1.39 0.66 112 XM_PDF 2005 4.22 1.38 5.36 113 URI_TRY_3LD 1983 0.82 1.37 0.60 114 TR_Symld_Words 1921 1.83 1.32 2.03 115 LONG_JUNK_URI 1907 0.45 1.32 0.10 116 T_MONEY_PERCENT 1896 0.64 1.31 0.36 117 TR_LOTS_OF_MONEY2 1896 0.64 1.31 0.36 118 ALL_TRUSTED 1853 13.65 1.28 18.65 119 BAYES_00 1818 6.44 1.25 8.54 120 XM_B_REG_HTML 1809 0.88 1.25 0.73 121 XMMoneyMeta_00 1797 0.78 1.24 0.59 122 T_FILL_THIS_FORM_SHORT 1776 1.02 1.22 0.94 123 FSL_THIS_IS_ADV 1748 0.51 1.21 0.23 124 XMBrknScrpt_02 1694 0.65 1.17 0.44 125 LONG_JUNK_URI3 1672 0.37 1.15 0.06 126 RELAYCOUNTRY_GB 1655 1.23 1.14 1.26 127 BAYES_40 1647 3.08 1.14 3.87 128 DATE_IN_PAST_06_12 1618 0.38 1.12 0.09 129 PHOTO_EDITING_DIRECT 1617 0.33 1.12 0.01 130 TooManyTo_002 1593 2.41 1.10 2.94 131 XMPhish11 1522 1.19 1.05 1.24 132 SUBJ_DOLLARS 1499 0.49 1.03 0.27 133 HTML_FONT_FACE_BAD 1490 0.70 1.03 0.57 134 RCVD_IN_IADB_VOUCHED 1487 2.86 1.03 3.60 135 URIBL_DBL_SPAM 1477 0.30 1.02 0.01 136 BODY_URI_ONLY 1475 0.32 1.02 0.03 137 TR_XM_DK_Bayes 1470 4.16 1.01 5.43 138 XMBdyGiftCard01 1469 0.68 1.01 0.55 139 XM_UB60 1464 0.34 1.01 0.07 140 HTML_FONT_SIZE_LARGE 1451 0.40 1.00 0.15 141 URI_NOVOWEL 1449 0.49 1.00 0.29 142 RELAYCOUNTRY_AT 1440 0.39 0.99 0.15 143 TR_XM_DK_Bayes1 1430 3.98 0.99 5.19 144 XMPhish14 1422 0.63 0.98 0.49 145 HTTPS_HTTP_MISMATCH 1418 0.61 0.98 0.46 146 XM_H_PHPOS 1418 1.34 0.98 1.49 147 RELAYCOUNTRY_AU 1412 0.68 0.97 0.57 148 RDNS_DYNAMIC 1386 0.55 0.96 0.39 149 XMBody_78 1383 0.57 0.95 0.42 150 TR_XM_DK_Bayes2 1369 3.15 0.94 4.04 151 HTML_IMAGE_ONLY_08 1368 0.37 0.94 0.14 152 TooManyTo_003 1367 1.63 0.94 1.90 153 XMSlimDrugH 1359 0.49 0.94 0.31 154 XM_RXBody 1357 0.54 0.94 0.37 155 XM_BadFromFormat 1351 0.42 0.93 0.21 156 TR_MetaPhish_Combo_01 1319 0.85 0.91 0.82 157 DKIM_ADSP_CUSTOM_MED 1317 1.06 0.91 1.12 158 HTML_SHORT_LINK_IMG_1 1308 0.28 0.90 0.02 159 BAYES_20 1304 2.28 0.90 2.83 160 XMHTMLBadTable_001 1297 0.52 0.89 0.37 161 XMSubMetaSxObfu_03 1294 0.47 0.89 0.30 162 XMSubNoVowel 1290 0.55 0.89 0.41 163 PLING_QUERY 1282 0.43 0.88 0.24 164 MPART_ALT_DIFF_COUNT 1254 0.43 0.86 0.26 165 XM_UB80 1240 0.27 0.86 0.03 166 T_TooManySym_02 1217 1.59 0.84 1.89 167 LONG_JUNK_URI2 1215 0.25 0.84 0.01 168 RCVD_IN_MSPIKE_WL 1210 1.38 0.83 1.60 169 RCVD_IN_MSPIKE_H3 1210 1.38 0.83 1.60 170 RELAYCOUNTRY_DE 1209 0.69 0.83 0.63 171 XM_Body_Obfu01 1203 0.52 0.83 0.40 172 REMOVE_BEFORE_LINK 1199 0.42 0.83 0.26 173 T_Symld_Words_02 1169 0.56 0.81 0.47 174 ANY_BOUNCE_MESSAGE 1117 2.27 0.77 2.88 175 BOUNCE_MESSAGE 1117 2.27 0.77 2.88 176 XMNoVowels 1109 0.82 0.76 0.84 177 XM_H_PHPMailer 1087 0.76 0.75 0.76 178 RELAYCOUNTRY_IN 1058 0.30 0.73 0.13 179 T_HTML_TAG_BALANCE_CENTER 1055 0.29 0.73 0.12 180 DATE_IN_PAST_03_06 1054 0.26 0.73 0.07 181 HTML_IMAGE_ONLY_28 1053 0.53 0.73 0.45 182 HTML_FONT_SIZE_HUGE 1042 0.60 0.72 0.55 183 NML_ADSP_CUSTOM_MED 1041 0.80 0.72 0.84 184 XM_B_COPY_HTML 1033 0.57 0.71 0.52 185 HTML_TAG_BALANCE_BODY 998 0.46 0.69 0.37 186 MIME_CHARSET_FARAWAY 993 0.31 0.68 0.16 187 XMClaimOffer 946 0.34 0.65 0.21 188 CHARSET_FARAWAY_HEADER 933 0.25 0.64 0.09 189 TooManyTo_004 931 1.13 0.64 1.33 190 RELAYCOUNTRY_NL 930 0.31 0.64 0.18 191 FORGED_GMAIL_RCVD 918 0.47 0.63 0.41 192 TR_Caps_n_Bayes_99 908 0.28 0.63 0.15 193 RELAYCOUNTRY_IT 884 0.22 0.61 0.06 194 XMSexyCombo_04 875 0.61 0.60 0.61 195 XM_GoogleGroups 869 1.32 0.60 1.61 196 LOW_PRICE 868 0.23 0.60 0.08 197 FROM_ADDR_WS 864 0.17 0.60 0.00 198 XMLongAddy 861 0.24 0.59 0.10 199 BAYES_05 861 1.52 0.59 1.90 200 RCVD_IN_IADB_OPTIN 861 1.42 0.59 1.76 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309297 88.98 95.88 86.20 2 DKIM_SIGNED 249736 74.06 85.10 69.60 3 XM_DK_Pass 244604 72.35 82.68 68.17 4 DKIM_VALID 235297 70.02 81.02 65.57 5 DCC_CHECK_NEGATIVE 231414 51.14 18.10 64.49 6 BAYES_50 206872 50.00 31.06 57.65 7 DKIM_VALID_AU 170526 51.50 61.34 47.52 8 XMListUnsubscribeExists 154997 51.69 72.70 43.20 9 T_TM2_M_HEADER_IN_MSG 124373 30.73 21.00 34.66 10 XM_H_QuotedFrom 124256 40.55 55.22 34.63 11 DCC_CHECK 118892 46.51 79.59 33.13 12 DKIM_VALID_EF 88532 24.22 23.11 24.67 13 HTML_FONT_LOW_CONTRAST 86213 27.56 36.29 24.03 14 XMSubLong 78824 23.76 28.20 21.97 15 MultiRelay 74170 19.72 17.36 20.67 16 MIME_HTML_ONLY 70443 23.24 32.16 19.63 17 FVGT_m_MULTI_ODD 69679 21.90 28.02 19.42 18 LOC_TINY_FONT_1 67919 23.23 33.89 18.93 19 ALL_TRUSTED 66928 13.65 1.28 18.65 20 XM_DK_Undo_02 47990 24.13 50.75 13.37 21 T_KAM_HTML_FONT_INVALID 46388 15.16 20.67 12.93 22 BAYES_99 44083 22.28 47.01 12.29 23 BAYES_999 39019 19.30 40.15 10.87 24 XM_Multi_Part_URI 35130 11.74 16.58 9.79 25 XM_Body_Dirty_Words 35112 12.61 19.59 9.79 26 XM_DKIMWhitelistDomains 34501 6.88 0.10 9.62 27 TooManyTo_001 34495 9.05 7.64 9.61 28 LOTS_OF_MONEY 32580 10.06 12.47 9.08 29 RCVD_IN_RP_SAFE 32330 8.14 6.00 9.01 30 BAYES_00 30643 6.44 1.25 8.54 31 RCVD_IN_RP_CERTIFIED 29961 7.43 5.14 8.35 32 FSL_BULK_SIG 28129 9.14 12.36 7.84 33 T_XMDrugObfuBody_14 27503 8.68 11.20 7.66 34 XM_Evil_Numbers_Gen 27493 9.73 14.84 7.66 35 LotsOfNums_01 26132 7.72 8.81 7.28 36 BAYES_60 22606 6.12 5.68 6.30 37 HTML_IMAGE_RATIO_02 22389 8.69 14.77 6.24 38 IN_ZIMBRA_NJ_WHITELIST 22056 4.39 0.04 6.15 39 XM_H_Long_From01 21238 6.33 7.35 5.92 40 RELAYCOUNTRY_META 19709 8.49 15.89 5.49 41 TR_DCC_Bayes_99 19635 14.60 37.19 5.47 42 TR_XM_DK_Bayes 19468 4.16 1.01 5.43 43 XM_B_Phish_Phrases 19303 6.82 10.40 5.38 44 XM_PDF 19241 4.22 1.38 5.36 45 XM_SendGrid 18734 4.90 4.12 5.22 46 TR_XM_DK_Bayes1 18635 3.98 0.99 5.19 47 RCVD_IN_IADB_LISTED 18585 4.39 2.45 5.18 48 MIME_QP_LONG_LINE 18540 5.43 6.09 5.17 49 RCVD_IN_MSPIKE_H2 17370 4.87 4.93 4.84 50 T_REMOTE_IMAGE 17323 4.67 4.27 4.83 51 HTML_IMAGE_RATIO_04 17029 6.31 10.16 4.75 52 TR_XM_DocInvoice 16525 5.45 7.56 4.61 53 BOTNET_IPINHOSTNAME 16338 7.04 13.21 4.55 54 RCVD_IN_IADB_SPF 16276 3.86 2.20 4.54 55 T_TooManySym_01 16158 4.16 3.30 4.50 56 XMSubMetaSx_00 15007 5.04 7.16 4.18 57 TR_XM_DK_Bayes2 14487 3.15 0.94 4.04 58 DKIM_INVALID 14439 4.04 4.08 4.02 59 BAYES_80 14349 5.03 7.59 4.00 60 RCVD_IN_IADB_SENDERID 14304 3.44 2.09 3.99 61 RCVD_IN_IADB_DK 13925 3.36 2.08 3.88 62 BAYES_40 13871 3.08 1.14 3.87 63 FROM_EXCESS_BASE64 13840 4.54 6.22 3.86 64 XMStrtUSub 13488 4.18 5.21 3.76 65 XM_UncommonTLD01 13449 4.98 8.03 3.75 66 UNPARSEABLE_RELAY 13052 3.09 1.72 3.64 67 RCVD_IN_IADB_VOUCHED 12913 2.86 1.03 3.60 68 XMSexyCombo_05 12045 5.49 10.78 3.36 69 TVD_RCVD_IP 12031 2.47 0.29 3.35 70 XMNumbers 11537 3.81 5.28 3.22 71 MAILING_LIST_MULTI 10963 2.71 1.86 3.06 72 TooManyTo_002 10553 2.41 1.10 2.94 73 ANY_BOUNCE_MESSAGE 10335 2.27 0.77 2.88 74 BOUNCE_MESSAGE 10331 2.27 0.77 2.88 75 HTML_MIME_NO_HTML_TAG 10285 2.81 2.67 2.87 76 HTML_IMAGE_RATIO_06 10250 3.48 5.01 2.86 77 BAYES_20 10164 2.28 0.90 2.83 78 HELO_NODOT 9952 2.09 0.42 2.77 79 MPART_ALT_DIFF 9714 4.13 7.65 2.71 80 BAYES_95 9426 3.25 4.78 2.63 81 XM_SPF_SoftFail 8522 2.82 3.92 2.37 82 IN_HORDE_ADDRESS_BOOK 8179 1.65 0.08 2.28 83 MIME_HTML_MOSTLY 8129 2.96 4.69 2.27 84 XM_DK_Undo_01 7354 1.92 1.58 2.05 85 TR_Symld_Words 7288 1.83 1.32 2.03 86 HTML_IMAGE_RATIO_08 6936 2.30 3.19 1.93 87 INVALID_MSGID 6907 1.44 0.23 1.92 88 TooManyTo_003 6831 1.63 0.94 1.90 89 BAYES_05 6810 1.52 0.59 1.90 90 T_TooManySym_02 6773 1.59 0.84 1.89 91 XM_DIRTYINTL 6461 2.46 4.10 1.80 92 TO_MALFORMED 6425 1.28 0.01 1.79 93 RCVD_IN_IADB_OPTIN 6306 1.42 0.59 1.76 94 TM2_M_URI_OPT_OUT 6215 2.62 4.81 1.73 95 XM_CamelCaseFrm001 6202 2.30 3.73 1.73 96 XMCapTrack 6044 1.37 0.59 1.68 97 SUBJ_ALL_CAPS 5925 1.71 1.86 1.65 98 XM_GoogleGroups 5768 1.32 0.60 1.61 99 RCVD_IN_MSPIKE_H3 5732 1.38 0.83 1.60 100 RCVD_IN_MSPIKE_WL 5732 1.38 0.83 1.60 101 XM_OfRef6 5707 1.89 2.63 1.59 102 XMDiploma_00 5370 1.79 2.53 1.50 103 XM_H_PHPOS 5332 1.34 0.98 1.49 104 T_XMDrugObfuBody_08 4934 1.71 2.54 1.38 105 RELAYCOUNTRY_CA 4901 1.90 3.23 1.37 106 XMStockSpam_06 4837 1.37 1.43 1.35 107 UNTRUSTED_Relay 4811 3.76 9.75 1.34 108 TooManyTo_004 4780 1.13 0.64 1.33 109 URI_HEX 4780 1.86 3.16 1.33 110 BOTNET 4607 4.73 13.26 1.28 111 RELAYCOUNTRY_GB 4538 1.23 1.14 1.26 112 USER_IN_DEF_DKIM_WL 4490 0.94 0.17 1.25 113 XMPhish11 4455 1.19 1.05 1.24 114 XM_ProductURIs 4331 1.43 1.99 1.21 115 DKIM_ADSP_CUSTOM_MED 4036 1.06 0.91 1.12 116 TooManyTo_005 3887 0.93 0.54 1.08 117 MIME_HTML_ONLY_MULTI 3844 1.88 3.88 1.07 118 XMSexyCombo_01 3519 1.17 1.65 0.98 119 XMGenDplmaNmb 3396 1.14 1.61 0.95 120 T_FILL_THIS_FORM_SHORT 3360 1.02 1.22 0.94 121 XM_H_Long_From02 3331 1.39 2.53 0.93 122 TM2_M_VERY_LONG_WORD 3204 1.15 1.77 0.89 123 XM_UB50 3116 1.95 4.61 0.87 124 SpammyFromTLD_01 3101 1.07 1.59 0.86 125 XMNoVowels 3009 0.82 0.76 0.84 126 NML_ADSP_CUSTOM_MED 3004 0.80 0.72 0.84 127 T_TooManySym_03 2968 0.69 0.36 0.83 128 TR_MetaPhish_Combo_01 2945 0.85 0.91 0.82 129 T_OBFU_PDF_ATTACH 2834 0.64 0.28 0.79 130 RCVD_IN_BL_SPAMCOP_NET 2790 1.64 3.77 0.78 131 USER_IN_WHITELIST 2775 0.55 0.00 0.77 132 XM_H_PHPMailer 2745 0.76 0.75 0.76 133 XMGappySubj_01 2712 0.70 0.54 0.76 134 XM_B_REG_HTML 2614 0.88 1.25 0.73 135 XM_ShortIntro_01 2491 0.59 0.34 0.69 136 FILL_THIS_FORM 2482 0.59 0.34 0.69 137 SHORT_HELO_AND_INLINE_IMAGE 2390 0.50 0.10 0.67 138 RCVD_IN_IADB_DOPTIN 2354 0.49 0.09 0.66 139 T_XMDrugObfuBody_00 2354 0.87 1.39 0.66 140 RCVD_IN_SORBS_DUL 2271 0.54 0.31 0.63 141 RELAYCOUNTRY_DE 2265 0.69 0.83 0.63 142 XMSexyCombo_04 2193 0.61 0.60 0.61 143 URI_TRY_3LD 2156 0.82 1.37 0.60 144 MISSING_HEADERS 2139 0.54 0.42 0.60 145 XMMoneyMeta_00 2113 0.78 1.24 0.59 146 AC_DIV_BONANZA 2069 0.46 0.17 0.58 147 XMBody_95 2042 0.47 0.24 0.57 148 HTML_FONT_FACE_BAD 2034 0.70 1.03 0.57 149 RELAYCOUNTRY_AU 2034 0.68 0.97 0.57 150 XMSubMetaI_00 1976 0.81 1.44 0.55 151 XMBdyGiftCard01 1975 0.68 1.01 0.55 152 HTML_FONT_SIZE_HUGE 1958 0.60 0.72 0.55 153 XMSolicitRefs_0 1944 0.49 0.36 0.54 154 XMBody_17 1940 0.87 1.68 0.54 155 T_FILL_THIS_FORM_LOAN 1937 0.42 0.11 0.54 156 TR_XM_RelayPhish 1914 0.84 1.60 0.53 157 XMDateMe_00 1881 0.48 0.36 0.52 158 XMSubMetaSxObfu_02 1871 0.44 0.26 0.52 159 XM_B_COPY_HTML 1855 0.57 0.71 0.52 160 T_FILL_THIS_FORM_LONG 1838 0.42 0.19 0.51 161 HTTP_ESCAPED_HOST 1787 0.38 0.10 0.50 162 XM_H_PHPOS_M 1764 0.47 0.42 0.49 163 TM2_M_A_HREF_HREF 1761 0.47 0.42 0.49 164 XMPhish14 1760 0.63 0.98 0.49 165 HTML_IMAGE_ONLY_32 1756 0.46 0.40 0.49 166 T_Symld_Words_02 1669 0.56 0.81 0.47 167 T_XMHurry_00 1642 0.89 1.96 0.46 168 HTTPS_HTTP_MISMATCH 1638 0.61 0.98 0.46 169 HTML_IMAGE_ONLY_28 1609 0.53 0.73 0.45 170 XM_B_TRADE_HTML 1605 0.44 0.43 0.45 171 XMBrknScrpt_02 1590 0.65 1.17 0.44 172 BOTNET_NORDNS 1567 0.93 2.17 0.44 173 XMBody_78 1507 0.57 0.95 0.42 174 XMPhish30 1481 0.70 1.43 0.41 175 XMSubNoVowel 1481 0.55 0.89 0.41 176 HTML_IMAGE_ONLY_24 1473 0.42 0.44 0.41 177 FORGED_GMAIL_RCVD 1471 0.47 0.63 0.41 178 TM2_M_BODY_EMPTY 1470 0.34 0.15 0.41 179 SpammyFromTLD_02 1447 0.78 1.71 0.40 180 XM_Body_Obfu01 1441 0.52 0.83 0.40 181 RDNS_DYNAMIC 1397 0.55 0.96 0.39 182 T_TooManySym_04 1346 0.29 0.07 0.38 183 DKIM_ADSP_NXDOMAIN 1341 0.39 0.43 0.37 184 XM_RXBody 1339 0.54 0.94 0.37 185 XMHTML_After_End 1334 0.91 2.23 0.37 186 HTML_TAG_BALANCE_BODY 1331 0.46 0.69 0.37 187 XMHTMLBadTable_001 1331 0.52 0.89 0.37 188 TVD_SPACE_RATIO 1325 0.39 0.46 0.37 189 XMLngstWrd_00 1314 0.42 0.56 0.37 190 T_MONEY_PERCENT 1306 0.64 1.31 0.36 191 TR_LOTS_OF_MONEY2 1306 0.64 1.31 0.36 192 FROM_EGROUPS 1264 0.25 0.00 0.35 193 XMBody_29 1239 0.33 0.28 0.35 194 MSGID_FROM_MTA_HEADER 1230 0.31 0.25 0.34 195 XMSubEmpty 1208 0.28 0.13 0.34 196 HTML_IMAGE_ONLY_20 1200 0.32 0.29 0.33 197 XMLKML 1177 0.23 0.00 0.33 198 UPPERCASE_50_75 1156 0.28 0.17 0.32 199 DOS_OUTLOOK_TO_MX 1148 0.27 0.14 0.32 200 XMLngstWrd_01 1146 0.36 0.45 0.32 ----------------------------------------------------------------------