Email: 670194 Autolearn: 0 AvgScore: 0.97 AvgScanTime: 3.82 sec Spam: 171127 Autolearn: 0 AvgScore: 12.90 AvgScanTime: 4.63 sec Ham: 499067 Autolearn: 0 AvgScore: -3.12 AvgScanTime: 3.54 sec Time Spent Running SA: 711.14 hours Time Spent Processing Spam: 220.25 hours Time Spent Processing Ham: 490.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161119 88.26 94.15 86.24 2 DKIM_SIGNED 143322 58.71 83.75 50.12 3 XM_DK_Pass 139121 57.30 81.30 49.07 4 DCC_CHECK 134278 37.33 78.47 23.22 5 DKIM_VALID 131690 53.44 76.95 45.37 6 XMListUnsubscribeExists 123634 41.24 72.25 30.60 7 DKIM_VALID_AU 100719 38.58 58.86 31.62 8 XM_H_QuotedFrom 96656 50.02 56.48 47.81 9 XM_DK_Undo_02 84778 19.55 49.54 9.26 10 BAYES_99 77776 18.25 45.45 8.93 11 BAYES_999 66818 15.89 39.05 7.95 12 HTML_FONT_LOW_CONTRAST 61401 23.31 35.88 18.99 13 TR_DCC_Bayes_99 60545 12.15 35.38 4.18 14 LOC_TINY_FONT_1 56808 17.61 33.20 12.27 15 BAYES_50 55151 42.97 32.23 46.65 16 MIME_HTML_ONLY 52585 17.63 30.73 13.14 17 XMSubLong 45411 19.47 26.54 17.04 18 FVGT_m_MULTI_ODD 45217 17.46 26.42 14.39 19 DKIM_VALID_EF 40558 19.45 23.70 17.99 20 T_TM2_M_HEADER_IN_MSG 36877 26.88 21.55 28.71 21 T_KAM_HTML_FONT_INVALID 36740 13.36 21.47 10.57 22 DCC_CHECK_NEGATIVE 32902 60.70 19.23 74.92 23 XM_Body_Dirty_Words 32215 10.60 18.83 7.78 24 RELAYCOUNTRY_META 30796 7.58 18.00 4.01 25 MultiRelay 30647 15.76 17.91 15.03 26 XM_Multi_Part_URI 28374 9.34 16.58 6.85 27 HTML_IMAGE_RATIO_02 26055 7.52 15.23 4.88 28 BOTNET 24718 4.47 14.44 1.05 29 XM_Evil_Numbers_Gen 23950 10.41 14.00 9.18 30 BOTNET_IPINHOSTNAME 22838 5.39 13.35 2.66 31 FSL_BULK_SIG 22817 7.40 13.33 5.36 32 UNTRUSTED_Relay 19498 3.64 11.39 0.99 33 LOTS_OF_MONEY 19215 7.59 11.23 6.34 34 XMSexyCombo_05 17978 4.51 10.51 2.46 35 T_XMDrugObfuBody_14 17179 6.97 10.04 5.92 36 HTML_IMAGE_RATIO_04 16548 20.54 9.67 24.27 37 XM_B_Phish_Phrases 15468 5.07 9.04 3.71 38 LotsOfNums_01 15412 6.39 9.01 5.49 39 TR_XM_DocInvoice 14620 4.20 8.54 2.71 40 XMSubMetaSx_00 13927 4.40 8.14 3.11 41 BAYES_80 12933 4.00 7.56 2.78 42 XM_H_Long_From01 12844 7.56 7.51 7.58 43 XM_UncommonTLD01 12187 3.84 7.12 2.71 44 DKIM_INVALID 11632 5.28 6.80 4.75 45 MPART_ALT_DIFF 11487 3.28 6.71 2.10 46 FROM_EXCESS_BASE64 11344 3.58 6.63 2.53 47 TooManyTo_001 11064 6.96 6.47 7.13 48 BAYES_60 10704 5.25 6.26 4.91 49 HTML_IMAGE_RATIO_06 9864 5.07 5.76 4.84 50 XM_UB50 9711 1.95 5.67 0.67 51 XM_SPF_SoftFail 9272 2.61 5.42 1.64 52 XMNumbers 8440 3.23 4.93 2.65 53 RCVD_IN_RP_SAFE 8073 5.38 4.72 5.60 54 MIME_QP_LONG_LINE 7818 4.47 4.57 4.44 55 BAYES_95 7685 2.54 4.49 1.87 56 MIME_HTML_MOSTLY 7623 2.28 4.45 1.53 57 TM2_M_URI_OPT_OUT 7562 2.48 4.42 1.81 58 XM_SendGrid 7485 3.86 4.37 3.68 59 MultiRelay_CC 6927 1.18 4.05 0.19 60 MultiRelay_Combo 6927 1.18 4.05 0.19 61 XMStrtUSub 6915 12.55 4.04 15.47 62 XM_DIRTYINTL 6683 2.10 3.91 1.48 63 T_REMOTE_IMAGE 6658 3.64 3.89 3.55 64 RCVD_IN_RP_CERTIFIED 6513 4.83 3.81 5.18 65 RCVD_IN_BL_SPAMCOP_NET 6167 1.18 3.60 0.35 66 BOTNET_NORDNS 6124 0.92 3.58 0.02 67 RCVD_IN_MSPIKE_H2 5915 3.42 3.46 3.40 68 URI_HEX 5847 1.62 3.42 1.00 69 XM_CamelCaseFrm001 5829 1.70 3.41 1.11 70 RELAYCOUNTRY_CA 5327 1.62 3.11 1.11 71 MIME_HTML_ONLY_MULTI 5265 1.39 3.08 0.81 72 XM_OfRef6 5221 1.69 3.05 1.22 73 HTML_MIME_NO_HTML_TAG 5075 2.10 2.97 1.81 74 SpammyFromTLD_02 4917 0.94 2.87 0.28 75 HTML_IMAGE_RATIO_08 4633 1.83 2.71 1.53 76 T_TooManySym_01 4227 2.76 2.47 2.86 77 XMNoVowels 4083 2.01 2.39 1.88 78 XM_URI_RBL 4027 0.66 2.35 0.08 79 RCVD_IN_IADB_LISTED 3989 3.59 2.33 4.02 80 XMDiploma_00 3831 1.44 2.24 1.17 81 T_XMDrugObfuBody_08 3821 1.43 2.23 1.16 82 SUBJ_ALL_CAPS 3787 3.89 2.21 4.47 83 UNPARSEABLE_RELAY 3623 2.04 2.12 2.01 84 RCVD_IN_IADB_SPF 3558 3.14 2.08 3.50 85 XMHTML_After_End 3439 0.74 2.01 0.30 86 RELAYCOUNTRY_FR 3436 0.67 2.01 0.21 87 FILL_THIS_FORM 3411 0.78 1.99 0.37 88 RCVD_IN_IADB_DK 3367 2.73 1.97 2.99 89 RCVD_IN_IADB_SENDERID 3344 2.78 1.95 3.06 90 T_FILL_THIS_FORM_LONG 3244 0.69 1.90 0.28 91 TM2_M_VERY_LONG_WORD 3232 0.95 1.89 0.63 92 URIBL_BLACK 3071 0.48 1.79 0.03 93 RCVD_IN_RP_RNBL 3051 0.47 1.78 0.02 94 TVD_SPACE_RATIO_MINFP 3028 0.46 1.77 0.01 95 MAILING_LIST_MULTI 2984 1.82 1.74 1.84 96 RELAYCOUNTRY_CN 2947 0.48 1.72 0.05 97 XM_UB99 2911 0.44 1.70 0.01 98 XMPhish30 2893 0.63 1.69 0.27 99 SpammyFromTLD_01 2840 0.87 1.66 0.60 100 XM_H_Long_From02 2815 0.87 1.64 0.60 101 HELO_NODOT 2808 1.80 1.64 1.85 102 XMSexyCombo_01 2798 0.94 1.64 0.70 103 XM_BadFromFormat 2754 0.54 1.61 0.17 104 XMSubMetaI_00 2744 0.73 1.60 0.44 105 XM_UB60 2699 0.47 1.58 0.09 106 XM_ProductURIs 2689 0.98 1.57 0.78 107 XMBrknScrpt_02 2652 0.66 1.55 0.35 108 T_XMDrugObfuBody_00 2577 0.90 1.51 0.70 109 RELAYCOUNTRY_GB 2569 0.99 1.50 0.81 110 URIBL_DBL_SPAM 2545 0.40 1.49 0.02 111 XMGenDplmaNmb 2533 0.92 1.48 0.72 112 NO_DNS_FOR_FROM 2506 1.07 1.46 0.94 113 URI_TRY_3LD 2486 0.92 1.45 0.73 114 RELAYCOUNTRY_PL 2434 0.37 1.42 0.01 115 XM_DK_Undo_01 2415 1.53 1.41 1.57 116 FSL_HELO_NON_FQDN_1 2358 0.39 1.38 0.05 117 ALL_TRUSTED 2329 13.40 1.36 17.53 118 TR_XM_RelayPhish 2308 0.61 1.35 0.36 119 XMStockSpam_06 2285 1.01 1.34 0.90 120 MPART_ALT_DIFF_COUNT 2260 0.74 1.32 0.54 121 XM_UB999 2208 0.33 1.29 0.01 122 MONEY_FORM 2177 0.33 1.27 0.01 123 MILLION_USD 2174 0.33 1.27 0.00 124 XM_HighProb1 2144 0.33 1.25 0.01 125 RELAYCOUNTRY_KR 2096 0.33 1.22 0.02 126 BAYES_40 2072 4.68 1.21 5.88 127 XMLongAddy 2064 0.36 1.21 0.07 128 BAYES_00 2007 12.80 1.17 16.79 129 FORM_FRAUD 1999 0.30 1.17 0.00 130 XMBdyGiftCard01 1996 0.58 1.17 0.37 131 T_XMHurry_00 1971 0.52 1.15 0.30 132 XMBody_17 1950 0.48 1.14 0.26 133 XM_H_PHPOS 1947 1.17 1.14 1.19 134 DIET_1 1910 0.49 1.12 0.27 135 XM_Body_Obfu01 1907 0.41 1.11 0.17 136 XM_UB80 1884 0.29 1.10 0.02 137 XMMoneyMeta_00 1869 0.64 1.09 0.48 138 BODY_URI_ONLY 1851 0.31 1.08 0.05 139 T_FILL_THIS_FORM_SHORT 1818 0.86 1.06 0.79 140 TR_Symld_Words 1807 1.56 1.06 1.73 141 XMPhish14 1796 0.45 1.05 0.24 142 T_TooManySym_02 1783 1.21 1.04 1.26 143 HTML_IMAGE_ONLY_28 1751 0.53 1.02 0.37 144 SUBJ_DOLLARS 1743 0.37 1.02 0.15 145 XM_B_REG_HTML 1725 0.60 1.01 0.45 146 DKIM_ADSP_CUSTOM_MED 1720 0.80 1.01 0.74 147 RELAYCOUNTRY_IN 1715 0.34 1.00 0.11 148 BAYES_20 1669 4.97 0.98 6.34 149 XMPhish11 1667 0.88 0.97 0.84 150 RELAYCOUNTRY_AT 1657 0.31 0.97 0.08 151 BODY_ENHANCEMENT 1631 0.27 0.95 0.04 152 RCVD_IN_IADB_VOUCHED 1627 2.25 0.95 2.69 153 DKIM_ADSP_NXDOMAIN 1613 0.47 0.94 0.31 154 T_MONEY_PERCENT 1604 0.45 0.94 0.28 155 TR_LOTS_OF_MONEY2 1604 0.45 0.94 0.28 156 TR_Mismatch_TLD_02 1602 0.27 0.94 0.04 157 TooManyTo_002 1586 2.07 0.93 2.47 158 HTML_FONT_SIZE_LARGE 1572 0.34 0.92 0.14 159 XMClaimOffer 1555 0.31 0.91 0.10 160 T_Symld_Words_02 1546 0.57 0.90 0.46 161 HTTPS_HTTP_MISMATCH 1541 0.55 0.90 0.43 162 XM_PDF 1518 3.14 0.89 3.91 163 TR_MetaPhish_Combo_01 1500 0.90 0.88 0.90 164 FORGED_GMAIL_RCVD 1489 0.45 0.87 0.30 165 XMBody_78 1474 0.41 0.86 0.25 166 LongTLD 1470 0.31 0.86 0.12 167 XMHTMLBadTable_001 1465 0.38 0.86 0.22 168 REMOVE_BEFORE_LINK 1447 0.34 0.85 0.16 169 HTML_FONT_SIZE_HUGE 1447 0.27 0.85 0.08 170 NML_ADSP_CUSTOM_MED 1442 0.61 0.84 0.54 171 TR_XM_DK_Bayes 1441 2.79 0.84 3.45 172 HTML_IMAGE_ONLY_08 1423 0.30 0.83 0.11 173 RELAYCOUNTRY_RU 1421 0.23 0.83 0.02 174 XMBody_29 1408 0.38 0.82 0.23 175 TooManyTo_003 1400 1.50 0.82 1.73 176 XM_B_COPY_HTML 1387 0.51 0.81 0.40 177 HTML_SHORT_LINK_IMG_1 1375 0.23 0.80 0.03 178 HTML_TAG_BALANCE_BODY 1374 0.42 0.80 0.29 179 TR_XM_DK_Bayes1 1347 2.43 0.79 2.99 180 BOUNCE_MESSAGE 1346 2.23 0.79 2.72 181 ANY_BOUNCE_MESSAGE 1346 2.23 0.79 2.72 182 HTML_FONT_FACE_BAD 1338 18.67 0.78 24.81 183 TVD_SPACE_RATIO 1330 0.42 0.78 0.29 184 TM2_M_BODY_EMPTY 1330 0.48 0.78 0.37 185 RCVD_IN_MSPIKE_WL 1324 1.18 0.77 1.32 186 KHOP_DYNAMIC 1315 0.63 0.77 0.58 187 RCVD_IN_MSPIKE_H3 1291 1.18 0.75 1.32 188 XMCapTrack 1269 1.24 0.74 1.41 189 XMSubMetaSSx_00 1263 0.30 0.74 0.15 190 XM_H_PHPMailer 1243 0.65 0.73 0.62 191 T_HTML_TAG_BALANCE_CENTER 1239 0.24 0.72 0.08 192 XMEmptyBody_01 1212 0.26 0.71 0.11 193 XMSolicitRefs_0 1208 0.43 0.71 0.34 194 URI_NOVOWEL 1196 0.38 0.70 0.28 195 RDNS_DYNAMIC 1192 0.39 0.70 0.28 196 LONG_JUNK_URI3 1191 0.21 0.70 0.04 197 XMSubMetaSxObfu_02 1189 0.40 0.69 0.29 198 HTML_IMAGE_ONLY_04 1186 0.22 0.69 0.05 199 XM_RXBody 1171 0.24 0.68 0.09 200 TR_XM_DK_Bayes2 1158 1.89 0.68 2.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 430371 88.26 94.15 86.24 2 DCC_CHECK_NEGATIVE 373905 60.70 19.23 74.92 3 DKIM_SIGNED 250157 58.71 83.75 50.12 4 XM_DK_Pass 244872 57.30 81.30 49.07 5 XM_H_QuotedFrom 238601 50.02 56.48 47.81 6 BAYES_50 232806 42.97 32.23 46.65 7 DKIM_VALID 226431 53.44 76.95 45.37 8 DKIM_VALID_AU 157826 38.58 58.86 31.62 9 XMListUnsubscribeExists 152728 41.24 72.25 30.60 10 IN_ZIMBRA_NJ_WHITELIST 143868 21.48 0.05 28.83 11 T_TM2_M_HEADER_IN_MSG 143260 26.88 21.55 28.71 12 HTML_FONT_FACE_BAD 123812 18.67 0.78 24.81 13 HTML_IMAGE_RATIO_04 121126 20.54 9.67 24.27 14 DCC_CHECK 115884 37.33 78.47 23.22 15 HTML_FONT_LOW_CONTRAST 94788 23.31 35.88 18.99 16 DKIM_VALID_EF 89801 19.45 23.70 17.99 17 ALL_TRUSTED 87498 13.40 1.36 17.53 18 XMSubLong 85045 19.47 26.54 17.04 19 BAYES_00 83791 12.80 1.17 16.79 20 XMStrtUSub 77186 12.55 4.04 15.47 21 MultiRelay 74991 15.76 17.91 15.03 22 FVGT_m_MULTI_ODD 71799 17.46 26.42 14.39 23 MIME_HTML_ONLY 65593 17.63 30.73 13.14 24 LOC_TINY_FONT_1 61245 17.61 33.20 12.27 25 T_KAM_HTML_FONT_INVALID 52772 13.36 21.47 10.57 26 XM_DK_Undo_02 46236 19.55 49.54 9.26 27 XM_Evil_Numbers_Gen 45815 10.41 14.00 9.18 28 BAYES_99 44549 18.25 45.45 8.93 29 XMSubNoVowel 43539 6.61 0.43 8.72 30 BAYES_999 39658 15.89 39.05 7.95 31 XM_Body_Dirty_Words 38804 10.60 18.83 7.78 32 XM_H_Long_From01 37849 7.56 7.51 7.58 33 DATE_IN_PAST_06_12 37588 5.69 0.31 7.53 34 TooManyTo_001 35575 6.96 6.47 7.13 35 XM_Multi_Part_URI 34194 9.34 16.58 6.85 36 LOTS_OF_MONEY 31622 7.59 11.23 6.34 37 BAYES_20 31619 4.97 0.98 6.34 38 XM_DKIMWhitelistDomains 30036 4.49 0.02 6.02 39 T_XMDrugObfuBody_14 29548 6.97 10.04 5.92 40 BAYES_40 29322 4.68 1.21 5.88 41 BAYES_05 28641 4.42 0.56 5.74 42 RCVD_IN_RP_SAFE 27950 5.38 4.72 5.60 43 LotsOfNums_01 27391 6.39 9.01 5.49 44 FSL_BULK_SIG 26749 7.40 13.33 5.36 45 RCVD_IN_RP_CERTIFIED 25866 4.83 3.81 5.18 46 BAYES_60 24484 5.25 6.26 4.91 47 HTML_IMAGE_RATIO_02 24347 7.52 15.23 4.88 48 HTML_IMAGE_RATIO_06 24132 5.07 5.76 4.84 49 DKIM_INVALID 23726 5.28 6.80 4.75 50 SUBJ_ALL_CAPS 22311 3.89 2.21 4.47 51 MIME_QP_LONG_LINE 22165 4.47 4.57 4.44 52 TR_DCC_Bayes_99 20882 12.15 35.38 4.18 53 RCVD_IN_IADB_LISTED 20057 3.59 2.33 4.02 54 RELAYCOUNTRY_META 19990 7.58 18.00 4.01 55 XM_PDF 19501 3.14 0.89 3.91 56 XM_B_Phish_Phrases 18512 5.07 9.04 3.71 57 XM_SendGrid 18390 3.86 4.37 3.68 58 T_REMOTE_IMAGE 17738 3.64 3.89 3.55 59 RCVD_IN_IADB_SPF 17463 3.14 2.08 3.50 60 TR_XM_DK_Bayes 17236 2.79 0.84 3.45 61 RCVD_IN_MSPIKE_H2 16979 3.42 3.46 3.40 62 XMSubMetaSx_00 15538 4.40 8.14 3.11 63 XMSubLongNoVowel 15505 2.33 0.05 3.11 64 RCVD_IN_IADB_SENDERID 15259 2.78 1.95 3.06 65 DATE_IN_PAST_12_24 14959 2.26 0.13 3.00 66 XMSubGarbage 14944 2.24 0.03 2.99 67 RCVD_IN_IADB_DK 14928 2.73 1.97 2.99 68 TR_XM_DK_Bayes1 14906 2.43 0.79 2.99 69 T_TooManySym_01 14266 2.76 2.47 2.86 70 BAYES_80 13877 4.00 7.56 2.78 71 ANY_BOUNCE_MESSAGE 13572 2.23 0.79 2.72 72 BOUNCE_MESSAGE 13570 2.23 0.79 2.72 73 XM_UncommonTLD01 13533 3.84 7.12 2.71 74 TR_XM_DocInvoice 13520 4.20 8.54 2.71 75 RCVD_IN_IADB_VOUCHED 13445 2.25 0.95 2.69 76 BOTNET_IPINHOSTNAME 13290 5.39 13.35 2.66 77 XMNumbers 13240 3.23 4.93 2.65 78 FROM_EXCESS_BASE64 12644 3.58 6.63 2.53 79 TooManyTo_002 12312 2.07 0.93 2.47 80 XMSexyCombo_05 12262 4.51 10.51 2.46 81 TR_XM_DK_Bayes2 11486 1.89 0.68 2.30 82 XM_E_Blogspot 10786 1.63 0.08 2.16 83 MPART_ALT_DIFF 10482 3.28 6.71 2.10 84 UNPARSEABLE_RELAY 10044 2.04 2.12 2.01 85 XMNoVowels 9368 2.01 2.39 1.88 86 BAYES_95 9331 2.54 4.49 1.87 87 TVD_RCVD_IP 9282 1.45 0.27 1.86 88 HELO_NODOT 9239 1.80 1.64 1.85 89 MAILING_LIST_MULTI 9189 1.82 1.74 1.84 90 TM2_M_URI_OPT_OUT 9053 2.48 4.42 1.81 91 HTML_MIME_NO_HTML_TAG 9023 2.10 2.97 1.81 92 TooManyTo_003 8651 1.50 0.82 1.73 93 TR_Symld_Words 8651 1.56 1.06 1.73 94 IN_HORDE_ADDRESS_BOOK 8539 1.29 0.07 1.71 95 RCVD_IN_IADB_OPTIN 8503 1.42 0.58 1.70 96 XM_SPF_SoftFail 8209 2.61 5.42 1.64 97 XM_DK_Undo_01 7823 1.53 1.41 1.57 98 MIME_HTML_MOSTLY 7645 2.28 4.45 1.53 99 HTML_IMAGE_RATIO_08 7643 1.83 2.71 1.53 100 XM_DIRTYINTL 7396 2.10 3.91 1.48 101 XMCapTrack 7052 1.24 0.74 1.41 102 INVALID_MSGID 6983 1.09 0.19 1.40 103 RCVD_IN_MSPIKE_WL 6604 1.18 0.77 1.32 104 RCVD_IN_MSPIKE_H3 6599 1.18 0.75 1.32 105 TO_MALFORMED 6497 0.98 0.03 1.30 106 T_TooManySym_02 6298 1.21 1.04 1.26 107 XM_OfRef6 6081 1.69 3.05 1.22 108 XM_H_PHPOS 5918 1.17 1.14 1.19 109 XMDiploma_00 5844 1.44 2.24 1.17 110 T_XMDrugObfuBody_08 5770 1.43 2.23 1.16 111 XM_CamelCaseFrm001 5564 1.70 3.41 1.11 112 RELAYCOUNTRY_CA 5551 1.62 3.11 1.11 113 XM_GoogleGroups 5252 0.92 0.55 1.05 114 BOTNET 5226 4.47 14.44 1.05 115 URI_HEX 4988 1.62 3.42 1.00 116 UNTRUSTED_Relay 4922 3.64 11.39 0.99 117 TooManyTo_004 4817 0.85 0.51 0.97 118 NO_DNS_FOR_FROM 4693 1.07 1.46 0.94 119 USER_IN_DEF_DKIM_WL 4548 0.72 0.17 0.91 120 TR_MetaPhish_Combo_01 4513 0.90 0.88 0.90 121 XMStockSpam_06 4481 1.01 1.34 0.90 122 XMPhish11 4209 0.88 0.97 0.84 123 RELAYCOUNTRY_GB 4057 0.99 1.50 0.81 124 MIME_HTML_ONLY_MULTI 4045 1.39 3.08 0.81 125 TooManyTo_005 4009 0.71 0.43 0.80 126 T_FILL_THIS_FORM_SHORT 3920 0.86 1.06 0.79 127 XM_ProductURIs 3898 0.98 1.57 0.78 128 DKIM_ADSP_CUSTOM_MED 3675 0.80 1.01 0.74 129 URI_TRY_3LD 3653 0.92 1.45 0.73 130 XMGenDplmaNmb 3615 0.92 1.48 0.72 131 XMSexyCombo_01 3507 0.94 1.64 0.70 132 T_XMDrugObfuBody_00 3485 0.90 1.51 0.70 133 USER_IN_WHITELIST 3442 0.51 0.00 0.69 134 XM_UB50 3327 1.95 5.67 0.67 135 TM2_M_VERY_LONG_WORD 3157 0.95 1.89 0.63 136 XMSubMetaSxObfu_03 3155 0.58 0.41 0.63 137 XM_H_PHPMailer 3095 0.65 0.73 0.62 138 XM_H_Long_From02 3014 0.87 1.64 0.60 139 SpammyFromTLD_01 3005 0.87 1.66 0.60 140 KHOP_DYNAMIC 2895 0.63 0.77 0.58 141 T_TooManySym_03 2766 0.49 0.30 0.55 142 MPART_ALT_DIFF_COUNT 2691 0.74 1.32 0.54 143 NML_ADSP_CUSTOM_MED 2678 0.61 0.84 0.54 144 T_OBFU_PDF_ATTACH 2617 0.46 0.28 0.52 145 MISSING_HEADERS 2580 0.50 0.45 0.52 146 XMLngstWrd_00 2564 0.53 0.56 0.51 147 SHORT_HELO_AND_INLINE_IMAGE 2541 0.41 0.10 0.51 148 XMMoneyMeta_00 2417 0.64 1.09 0.48 149 XMSexyCombo_04 2341 0.52 0.66 0.47 150 XMLngstWrd_01 2291 0.47 0.52 0.46 151 T_Symld_Words_02 2285 0.57 0.90 0.46 152 XM_B_REG_HTML 2263 0.60 1.01 0.45 153 AC_DIV_BONANZA 2260 0.43 0.35 0.45 154 XMGappySubj_01 2216 0.45 0.45 0.44 155 RCVD_IN_SORBS_DUL 2198 0.49 0.63 0.44 156 XMSubMetaI_00 2177 0.73 1.60 0.44 157 HTTPS_HTTP_MISMATCH 2157 0.55 0.90 0.43 158 RELAYCOUNTRY_DE 2067 0.45 0.56 0.41 159 TM2_M_A_HREF_HREF 2067 0.44 0.50 0.41 160 XM_B_COPY_HTML 2006 0.51 0.81 0.40 161 XMSubPhish11 2003 0.45 0.58 0.40 162 XM_ShortIntro_01 1989 0.38 0.34 0.40 163 HTML_IMAGE_ONLY_32 1921 0.37 0.33 0.38 164 TM2_M_BODY_EMPTY 1867 0.48 0.78 0.37 165 XMBdyGiftCard01 1866 0.58 1.17 0.37 166 RELAYCOUNTRY_AU 1842 0.45 0.67 0.37 167 XM_USANA_RCVD 1837 0.27 0.00 0.37 168 FILL_THIS_FORM 1831 0.78 1.99 0.37 169 HTML_IMAGE_ONLY_28 1824 0.53 1.02 0.37 170 XMDateMe_00 1811 0.36 0.35 0.36 171 TR_XM_RelayPhish 1776 0.61 1.35 0.36 172 XMBrknScrpt_02 1760 0.66 1.55 0.35 173 RCVD_IN_BL_SPAMCOP_NET 1731 1.18 3.60 0.35 174 XMSolicitRefs_0 1683 0.43 0.71 0.34 175 XMBody_95 1675 0.29 0.14 0.34 176 XM_H_PHPOS_M 1536 0.33 0.39 0.31 177 DKIM_ADSP_NXDOMAIN 1532 0.47 0.94 0.31 178 HTML_IMAGE_ONLY_24 1521 0.34 0.46 0.30 179 T_XMHurry_00 1519 0.52 1.15 0.30 180 FORGED_GMAIL_RCVD 1496 0.45 0.87 0.30 181 XMHTML_After_End 1491 0.74 2.01 0.30 182 XMSubMetaSxObfu_02 1468 0.40 0.69 0.29 183 HTML_TAG_BALANCE_BODY 1461 0.42 0.80 0.29 184 TVD_SPACE_RATIO 1454 0.42 0.78 0.29 185 RDNS_DYNAMIC 1390 0.39 0.70 0.28 186 T_FILL_THIS_FORM_LONG 1389 0.69 1.90 0.28 187 T_MONEY_PERCENT 1382 0.45 0.94 0.28 188 TR_LOTS_OF_MONEY2 1382 0.45 0.94 0.28 189 URI_NOVOWEL 1381 0.38 0.70 0.28 190 SpammyFromTLD_02 1374 0.94 2.87 0.28 191 XMPhish30 1361 0.63 1.69 0.27 192 DIET_1 1348 0.49 1.12 0.27 193 HTML_IMAGE_ONLY_20 1335 0.36 0.63 0.27 194 XMBody_17 1290 0.48 1.14 0.26 195 T_TooManySym_04 1281 0.21 0.06 0.26 196 XMLngstWrd_02 1279 0.31 0.47 0.26 197 XMBody_78 1246 0.41 0.86 0.25 198 FILL_THIS_FORM_LOAN 1236 0.35 0.65 0.25 199 XMRcvdHeader_15 1234 0.18 0.00 0.25 200 XMSlimDrugH 1232 0.30 0.46 0.25 ----------------------------------------------------------------------