Email: 844231 Autolearn: 0 AvgScore: 3.73 AvgScanTime: 4.26 sec Spam: 262953 Autolearn: 0 AvgScore: 15.04 AvgScanTime: 5.31 sec Ham: 581278 Autolearn: 0 AvgScore: -1.38 AvgScanTime: 3.79 sec Time Spent Running SA: 999.39 hours Time Spent Processing Spam: 387.92 hours Time Spent Processing Ham: 611.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 254500 89.57 96.79 86.30 2 DCC_CHECK 192888 40.36 73.35 25.44 3 DKIM_SIGNED 192607 59.44 73.25 53.19 4 XM_DK_Pass 187629 58.19 71.35 52.24 5 DKIM_VALID 177213 54.59 67.39 48.79 6 XMListUnsubscribeExists 164543 43.72 62.58 35.18 7 DKIM_VALID_AU 137547 40.05 52.31 34.51 8 XM_H_QuotedFrom 114586 42.88 43.58 42.57 9 BAYES_99 111414 20.06 42.37 9.96 10 MIME_HTML_ONLY 110785 22.87 42.13 14.15 11 XM_DK_Undo_02 110387 20.16 41.98 10.29 12 BAYES_999 87664 16.36 33.34 8.69 13 TR_DCC_Bayes_99 85537 13.29 32.53 4.58 14 HTML_FONT_LOW_CONTRAST 81084 23.95 30.84 20.83 15 LOC_TINY_FONT_1 79486 19.69 30.23 14.92 16 T_TM2_M_HEADER_IN_MSG 78344 26.62 29.79 25.19 17 BAYES_50 74871 46.10 28.47 54.07 18 XMSubLong 67833 19.31 25.80 16.37 19 DCC_CHECK_NEGATIVE 66588 58.22 25.32 73.11 20 RELAYCOUNTRY_META 65119 10.36 24.76 3.85 21 BOTNET_IPINHOSTNAME 63507 10.00 24.15 3.59 22 BOTNET 61445 8.00 23.37 1.05 23 FVGT_m_MULTI_ODD 60927 18.70 23.17 16.67 24 FROM_EXCESS_BASE64 55548 8.23 21.12 2.40 25 UNTRUSTED_Relay 52995 6.93 20.15 0.95 26 DKIM_VALID_EF 52423 19.87 19.94 19.84 27 T_KAM_HTML_FONT_INVALID 46415 13.36 17.65 11.42 28 HTML_MIME_NO_HTML_TAG 43428 6.41 16.52 1.84 29 FSL_BULK_SIG 43112 8.47 16.40 4.89 30 XM_Body_Dirty_Words 42521 10.87 16.17 8.47 31 MISSING_HEADERS 40988 5.16 15.59 0.45 32 XM_BadFromFormat 40644 4.90 15.46 0.13 33 XM_Multi_Part_URI 39853 10.23 15.16 8.01 34 HTML_IMAGE_ONLY_08 39689 7.13 15.09 3.52 35 HTML_SHORT_LINK_IMG_1 39600 7.07 15.06 3.45 36 HTML_FONT_SIZE_HUGE 39562 7.11 15.05 3.51 37 MultiRelay 38638 14.51 14.69 14.43 38 SHORTENER_SHORT_IMG 38549 6.93 14.66 3.43 39 MIME_HEADER_CTYPE_ONLY 38541 4.64 14.66 0.11 40 URI_BUFFLY 38273 6.89 14.56 3.43 41 BODY_URI_ONLY 37894 4.53 14.41 0.05 42 HTML_IMAGE_RATIO_02 37379 8.21 14.22 5.49 43 RELAYCOUNTRY_TH 35111 4.17 13.35 0.02 44 XM_Evil_Numbers_Gen 32379 9.58 12.31 8.35 45 BAYES_80 30006 6.11 11.41 3.71 46 XM_UncommonTLD01 28385 5.04 10.79 2.43 47 LOTS_OF_MONEY 27632 7.86 10.51 6.66 48 XMSexyCombo_05 24975 4.29 9.50 1.94 49 T_XMDrugObfuBody_14 23046 6.92 8.76 6.09 50 XM_B_Phish_Phrases 22031 5.33 8.38 3.95 51 XMNumbers 21463 4.31 8.16 2.57 52 BAYES_95 20354 4.09 7.74 2.44 53 HTML_IMAGE_RATIO_04 19717 14.47 7.50 17.62 54 XMSubMetaSx_00 19649 4.37 7.47 2.97 55 LotsOfNums_01 19622 7.12 7.46 6.97 56 SpammyFromTLD_02 19169 2.42 7.29 0.22 57 BAYES_60 17776 6.50 6.76 6.38 58 XM_H_Long_From01 17331 4.73 6.59 3.90 59 MPART_ALT_DIFF 16834 3.68 6.40 2.45 60 TR_XM_DocInvoice 16525 3.78 6.28 2.65 61 TooManyTo_001 15494 7.94 5.89 8.87 62 DKIM_INVALID 15394 4.85 5.85 4.40 63 XM_UB80 13749 1.68 5.23 0.08 64 XM_UB99 13179 1.59 5.01 0.05 65 HTML_IMAGE_RATIO_06 12668 4.38 4.82 4.18 66 XM_SPF_SoftFail 12454 2.49 4.74 1.48 67 MIME_QP_LONG_LINE 11576 4.67 4.40 4.79 68 DIET_1 11457 2.04 4.36 0.99 69 RCVD_IN_RP_SAFE 11455 5.72 4.36 6.33 70 XM_JunkDunk 10747 1.27 4.09 0.00 71 XMNoVowels 10720 2.57 4.08 1.89 72 MIME_HTML_MOSTLY 10647 2.50 4.05 1.79 73 XM_UB95 10132 1.22 3.85 0.03 74 TM2_M_URI_OPT_OUT 9203 2.43 3.50 1.95 75 XM_SendGrid 9044 3.69 3.44 3.81 76 URI_HEX 8792 1.96 3.34 1.33 77 RCVD_IN_RP_CERTIFIED 8772 4.88 3.34 5.58 78 XMSlimDrugH 8742 1.21 3.32 0.25 79 MIME_HTML_ONLY_MULTI 8581 1.65 3.26 0.92 80 XM_DIRTYINTL 8550 1.91 3.25 1.31 81 XMStrtUSub 8502 9.09 3.23 11.74 82 RCVD_IN_MSPIKE_H2 8272 3.42 3.15 3.54 83 XM_CamelCaseFrm001 8046 1.85 3.06 1.31 84 T_REMOTE_IMAGE 7590 3.30 2.89 3.48 85 XM_UB50 7526 1.27 2.86 0.56 86 XMDiploma_00 7161 1.95 2.72 1.60 87 XM_OfRef6 7083 1.88 2.69 1.52 88 RCVD_IN_RP_RNBL 6765 0.82 2.57 0.02 89 RELAYCOUNTRY_CA 6561 1.49 2.50 1.04 90 XM_UB60 6550 0.82 2.49 0.06 91 HTML_IMAGE_RATIO_08 6138 1.94 2.33 1.76 92 T_TooManySym_01 6113 2.94 2.32 3.22 93 XM_URI_RBL 5853 0.77 2.23 0.11 94 RCVD_IN_IADB_LISTED 5754 3.85 2.19 4.61 95 MultiRelay_CC 5711 0.80 2.17 0.17 96 MultiRelay_Combo 5711 0.80 2.17 0.17 97 SUBJ_ALL_CAPS 5568 1.58 2.12 1.34 98 RCVD_IN_IADB_SPF 5239 3.40 1.99 4.04 99 ALL_TRUSTED 5076 16.55 1.93 23.16 100 SpammyFromTLD_01 5071 0.99 1.93 0.57 101 XMSlimDrugs 5045 0.61 1.92 0.01 102 RCVD_IN_IADB_SENDERID 5035 3.04 1.91 3.55 103 RCVD_IN_IADB_DK 5001 2.99 1.90 3.48 104 T_XMDrugObfuBody_08 4950 1.34 1.88 1.10 105 XMWghtMeta_00 4933 0.59 1.88 0.02 106 T_XMHurry_00 4831 0.92 1.84 0.51 107 SUBJECT_DIET 4577 0.54 1.74 0.00 108 URI_TRY_3LD 4417 1.02 1.68 0.71 109 TR_XM_RelayPhish 4407 0.78 1.68 0.38 110 XM_UB999 4363 0.54 1.66 0.03 111 RCVD_IN_BL_SPAMCOP_NET 4358 0.71 1.66 0.28 112 XMBody_17 4186 0.78 1.59 0.41 113 XMGenDplmaNmb 4049 1.15 1.54 0.98 114 XMSexyCombo_01 3831 0.70 1.46 0.35 115 MAILING_LIST_MULTI 3770 1.78 1.43 1.93 116 TM2_M_VERY_LONG_WORD 3649 0.87 1.39 0.63 117 BOTNET_NORDNS 3545 0.43 1.35 0.01 118 XMBdyGiftCard01 3542 0.64 1.35 0.32 119 XMSubMetaI_00 3468 0.71 1.32 0.44 120 UNPARSEABLE_RELAY 3466 2.38 1.32 2.85 121 XMStockSpam_06 3383 0.81 1.29 0.60 122 XM_ProductURIs 3340 0.97 1.27 0.84 123 XM_DK_Undo_01 3294 1.56 1.25 1.70 124 URIBL_DBL_SPAM 3172 0.41 1.21 0.05 125 XM_H_Long_From02 3167 0.87 1.20 0.71 126 DRUGS_ERECTILE 3069 0.37 1.17 0.01 127 XMHTML_After_End 3044 0.60 1.16 0.35 128 URIBL_SBL_A 3011 1.22 1.15 1.25 129 PLING_QUERY 3010 0.54 1.14 0.26 130 XM_HighProb1 2996 0.36 1.14 0.01 131 RELAYCOUNTRY_FR 2967 0.48 1.13 0.18 132 URIBL_BLACK 2942 0.37 1.12 0.03 133 ONLINE_PHARMACY 2902 0.35 1.10 0.00 134 T_XMDrugObfuBody_00 2898 0.77 1.10 0.62 135 TooManyTo_002 2889 3.21 1.10 4.17 136 XMPhish11 2871 1.03 1.09 1.00 137 TVD_VISIT_PHARMA 2864 0.34 1.09 0.00 138 TR_LOTS_OF_MONEY3 2850 0.50 1.08 0.23 139 NO_DNS_FOR_FROM 2798 0.81 1.06 0.69 140 TooManyTo_003 2630 2.50 1.00 3.17 141 BAYES_00 2547 8.56 0.97 11.99 142 BAYES_40 2543 2.54 0.97 3.24 143 DRUG_ED_CAPS 2531 0.30 0.96 0.00 144 XMPhish30 2498 0.43 0.95 0.20 145 SUBJ_DOLLARS 2457 0.41 0.93 0.17 146 DKIM_ADSP_NXDOMAIN 2445 0.46 0.93 0.24 147 XM_Body_Obfu01 2427 0.46 0.92 0.24 148 REPLYTO_WITHOUT_TO_CC 2390 0.32 0.91 0.05 149 XMSubject_48 2387 0.30 0.91 0.03 150 RCVD_IN_IADB_VOUCHED 2357 2.38 0.90 3.06 151 T_FILL_THIS_FORM_SHORT 2353 0.81 0.89 0.77 152 RELAYCOUNTRY_AT 2343 0.38 0.89 0.14 153 RCVD_IN_MSPIKE_WL 2335 1.37 0.89 1.59 154 RELAYCOUNTRY_CN 2332 0.31 0.89 0.05 155 RCVD_IN_MSPIKE_H3 2322 1.37 0.88 1.59 156 RELAYCOUNTRY_GB 2281 0.81 0.87 0.79 157 FILL_THIS_FORM 2271 0.50 0.86 0.33 158 HTML_TAG_BALANCE_BODY 2250 0.48 0.86 0.31 159 TR_MetaPhish_Combo_01 2237 0.73 0.85 0.67 160 TR_Symld_Words 2199 1.26 0.84 1.45 161 T_MONEY_PERCENT 2193 0.54 0.83 0.40 162 TR_LOTS_OF_MONEY2 2193 0.54 0.83 0.40 163 XM_XX_Yahoo 2184 0.30 0.83 0.06 164 HTML_FONT_FACE_BAD 2122 11.51 0.81 16.35 165 TR_LOTS_OF_MONEY1 2108 0.27 0.80 0.04 166 TR_XM_DK_Bayes 2090 1.93 0.79 2.45 167 ANY_BOUNCE_MESSAGE 2090 6.22 0.79 8.67 168 BOUNCE_MESSAGE 2090 6.22 0.79 8.67 169 RELAYCOUNTRY_NL 2061 0.34 0.78 0.13 170 XMHTMLBadTable_001 2041 0.41 0.78 0.24 171 T_FILL_THIS_FORM_LONG 2025 0.42 0.77 0.26 172 TR_Caps_n_Bayes_99 2002 0.26 0.76 0.03 173 XM_OfRef7 1980 0.39 0.75 0.22 174 REMOVE_BEFORE_LINK 1967 0.36 0.75 0.18 175 T_TooManySym_02 1963 1.11 0.75 1.27 176 DKIM_ADSP_CUSTOM_MED 1954 0.74 0.74 0.74 177 XMClaimOffer 1950 0.29 0.74 0.08 178 XM_H_PHPOS 1947 0.99 0.74 1.10 179 XMSubMetaSSx_00 1942 0.36 0.74 0.19 180 TR_XM_DK_Bayes1 1939 1.77 0.74 2.24 181 URI_NOVOWEL 1935 0.49 0.74 0.38 182 BAYES_20 1930 3.06 0.73 4.12 183 XMPhish14 1900 0.46 0.72 0.34 184 TooManyTo_004 1893 1.57 0.72 1.96 185 DATE_IN_PAST_06_12 1882 2.23 0.72 2.91 186 T_Symld_Words_02 1866 0.50 0.71 0.40 187 TR_Mismatch_TLD_01 1866 0.46 0.71 0.35 188 FVGT_m_MULTI_ODD_EMAIL 1832 0.25 0.70 0.04 189 XM_PDF 1829 2.55 0.70 3.39 190 RDNS_DYNAMIC 1827 0.47 0.69 0.37 191 TR_XM_DK_Bayes2 1818 1.56 0.69 1.95 192 XMBody_78 1805 0.44 0.69 0.33 193 HTTPS_HTTP_MISMATCH 1785 0.48 0.68 0.40 194 XM_B_REG_HTML 1768 0.44 0.67 0.34 195 XMMoneyMeta_00 1732 0.49 0.66 0.41 196 TVD_SPACE_RATIO_MINFP 1728 0.21 0.66 0.00 197 MPART_ALT_DIFF_COUNT 1716 0.66 0.65 0.67 198 XMLongAddy 1712 0.24 0.65 0.06 199 XM_RXBody 1707 0.25 0.65 0.07 200 BODY_ENHANCEMENT 1646 0.21 0.63 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 501667 89.57 96.79 86.30 2 DCC_CHECK_NEGATIVE 424962 58.22 25.32 73.11 3 BAYES_50 314288 46.10 28.47 54.07 4 DKIM_SIGNED 309174 59.44 73.25 53.19 5 XM_DK_Pass 303661 58.19 71.35 52.24 6 DKIM_VALID 283620 54.59 67.39 48.79 7 XM_H_QuotedFrom 247436 42.88 43.58 42.57 8 XMListUnsubscribeExists 204514 43.72 62.58 35.18 9 DKIM_VALID_AU 200581 40.05 52.31 34.51 10 DCC_CHECK 147856 40.36 73.35 25.44 11 T_TM2_M_HEADER_IN_MSG 146427 26.62 29.79 25.19 12 ALL_TRUSTED 134635 16.55 1.93 23.16 13 HTML_FONT_LOW_CONTRAST 121071 23.95 30.84 20.83 14 DKIM_VALID_EF 115327 19.87 19.94 19.84 15 IN_ZIMBRA_NJ_WHITELIST 114777 13.60 0.03 19.75 16 HTML_IMAGE_RATIO_04 102446 14.47 7.50 17.62 17 FVGT_m_MULTI_ODD 96905 18.70 23.17 16.67 18 XMSubLong 95146 19.31 25.80 16.37 19 HTML_FONT_FACE_BAD 95011 11.51 0.81 16.35 20 LOC_TINY_FONT_1 86714 19.69 30.23 14.92 21 MultiRelay 83864 14.51 14.69 14.43 22 MIME_HTML_ONLY 82255 22.87 42.13 14.15 23 BAYES_00 69711 8.56 0.97 11.99 24 XMStrtUSub 68234 9.09 3.23 11.74 25 T_KAM_HTML_FONT_INVALID 66407 13.36 17.65 11.42 26 XM_DK_Undo_02 59807 20.16 41.98 10.29 27 BAYES_99 57913 20.06 42.37 9.96 28 TooManyTo_001 51574 7.94 5.89 8.87 29 BAYES_999 50494 16.36 33.34 8.69 30 ANY_BOUNCE_MESSAGE 50423 6.22 0.79 8.67 31 BOUNCE_MESSAGE 50420 6.22 0.79 8.67 32 XM_Body_Dirty_Words 49239 10.87 16.17 8.47 33 XM_Evil_Numbers_Gen 48535 9.58 12.31 8.35 34 XM_Multi_Part_URI 46533 10.23 15.16 8.01 35 XM_DKIMWhitelistDomains 41097 4.92 0.16 7.07 36 LotsOfNums_01 40522 7.12 7.46 6.97 37 LOTS_OF_MONEY 38739 7.86 10.51 6.66 38 BAYES_60 37087 6.50 6.76 6.38 39 RCVD_IN_RP_SAFE 36798 5.72 4.36 6.33 40 T_XMDrugObfuBody_14 35405 6.92 8.76 6.09 41 RCVD_IN_RP_CERTIFIED 32458 4.88 3.34 5.58 42 HTML_IMAGE_RATIO_02 31901 8.21 14.22 5.49 43 XMSubNoVowel 29050 3.53 0.27 5.00 44 FSL_BULK_SIG 28407 8.47 16.40 4.89 45 MIME_QP_LONG_LINE 27822 4.67 4.40 4.79 46 RCVD_IN_IADB_LISTED 26784 3.85 2.19 4.61 47 TR_DCC_Bayes_99 26637 13.29 32.53 4.58 48 DKIM_INVALID 25554 4.85 5.85 4.40 49 HTML_IMAGE_RATIO_06 24316 4.38 4.82 4.18 50 TooManyTo_002 24249 3.21 1.10 4.17 51 BAYES_20 23933 3.06 0.73 4.12 52 RCVD_IN_IADB_SPF 23463 3.40 1.99 4.04 53 BAYES_05 23102 2.89 0.51 3.97 54 XM_B_Phish_Phrases 22958 5.33 8.38 3.95 55 XM_H_Long_From01 22642 4.73 6.59 3.90 56 RELAYCOUNTRY_META 22352 10.36 24.76 3.85 57 XM_SendGrid 22125 3.69 3.44 3.81 58 BAYES_80 21552 6.11 11.41 3.71 59 BOTNET_IPINHOSTNAME 20895 10.00 24.15 3.59 60 RCVD_IN_IADB_SENDERID 20641 3.04 1.91 3.55 61 RCVD_IN_MSPIKE_H2 20566 3.42 3.15 3.54 62 HTML_IMAGE_ONLY_08 20478 7.13 15.09 3.52 63 HTML_FONT_SIZE_HUGE 20429 7.11 15.05 3.51 64 T_REMOTE_IMAGE 20247 3.30 2.89 3.48 65 RCVD_IN_IADB_DK 20243 2.99 1.90 3.48 66 HTML_SHORT_LINK_IMG_1 20073 7.07 15.06 3.45 67 URI_BUFFLY 19932 6.89 14.56 3.43 68 SHORTENER_SHORT_IMG 19931 6.93 14.66 3.43 69 XM_PDF 19712 2.55 0.70 3.39 70 BAYES_40 18860 2.54 0.97 3.24 71 T_TooManySym_01 18710 2.94 2.32 3.22 72 TooManyTo_003 18448 2.50 1.00 3.17 73 RCVD_IN_IADB_VOUCHED 17775 2.38 0.90 3.06 74 XMSubMetaSx_00 17260 4.37 7.47 2.97 75 DATE_IN_PAST_06_12 16908 2.23 0.72 2.91 76 UNPARSEABLE_RELAY 16595 2.38 1.32 2.85 77 TR_XM_DocInvoice 15376 3.78 6.28 2.65 78 TVD_RCVD_IP 15150 1.91 0.38 2.61 79 XMNumbers 14954 4.31 8.16 2.57 80 MPART_ALT_DIFF 14243 3.68 6.40 2.45 81 TR_XM_DK_Bayes 14225 1.93 0.79 2.45 82 BAYES_95 14212 4.09 7.74 2.44 83 XM_UncommonTLD01 14153 5.04 10.79 2.43 84 FROM_EXCESS_BASE64 13944 8.23 21.12 2.40 85 TR_XM_DK_Bayes1 13020 1.77 0.74 2.24 86 DATE_IN_PAST_12_24 12019 1.50 0.24 2.07 87 RCVD_IN_IADB_OPTIN 11419 1.52 0.53 1.96 88 TooManyTo_004 11399 1.57 0.72 1.96 89 TM2_M_URI_OPT_OUT 11340 2.43 3.50 1.95 90 TR_XM_DK_Bayes2 11336 1.56 0.69 1.95 91 XMSexyCombo_05 11257 4.29 9.50 1.94 92 MAILING_LIST_MULTI 11231 1.78 1.43 1.93 93 XMNoVowels 10985 2.57 4.08 1.89 94 HTML_MIME_NO_HTML_TAG 10711 6.41 16.52 1.84 95 MIME_HTML_MOSTLY 10425 2.50 4.05 1.79 96 HTML_IMAGE_RATIO_08 10219 1.94 2.33 1.76 97 XM_DK_Undo_01 9887 1.56 1.25 1.70 98 XMSubLongNoVowel 9725 1.17 0.06 1.67 99 XMDiploma_00 9295 1.95 2.72 1.60 100 RCVD_IN_MSPIKE_WL 9230 1.37 0.89 1.59 101 RCVD_IN_MSPIKE_H3 9224 1.37 0.88 1.59 102 HELO_NODOT 9181 1.17 0.27 1.58 103 XMSubGarbage 9126 1.09 0.02 1.57 104 XM_OfRef6 8811 1.88 2.69 1.52 105 XM_E_Blogspot 8641 1.05 0.08 1.49 106 XM_SPF_SoftFail 8592 2.49 4.74 1.48 107 TooManyTo_005 8454 1.19 0.60 1.45 108 TR_Symld_Words 8429 1.26 0.84 1.45 109 IN_HORDE_ADDRESS_BOOK 8377 1.00 0.04 1.44 110 DATE_IN_PAST_03_06 7801 1.09 0.54 1.34 111 SUBJ_ALL_CAPS 7785 1.58 2.12 1.34 112 URI_HEX 7740 1.96 3.34 1.33 113 XM_DIRTYINTL 7614 1.91 3.25 1.31 114 USER_IN_DEF_DKIM_WL 7603 0.95 0.15 1.31 115 XM_CamelCaseFrm001 7590 1.85 3.06 1.31 116 T_TooManySym_02 7372 1.11 0.75 1.27 117 URIBL_SBL_A 7293 1.22 1.15 1.25 118 INVALID_MSGID 7017 0.89 0.18 1.21 119 XMLngstWrd_00 6797 0.91 0.33 1.17 120 XMCapTrack 6711 0.98 0.59 1.15 121 TO_MALFORMED 6504 0.78 0.01 1.12 122 T_XMDrugObfuBody_08 6393 1.34 1.88 1.10 123 XM_H_PHPOS 6384 0.99 0.74 1.10 124 BOTNET 6128 8.00 23.37 1.05 125 RELAYCOUNTRY_CA 6053 1.49 2.50 1.04 126 XM_GoogleGroups 6049 0.85 0.43 1.04 127 XMLngstWrd_01 5918 0.80 0.31 1.02 128 XMPhish11 5786 1.03 1.09 1.00 129 DIET_1 5745 2.04 4.36 0.99 130 XMGenDplmaNmb 5685 1.15 1.54 0.98 131 UNTRUSTED_Relay 5538 6.93 20.15 0.95 132 MIME_HTML_ONLY_MULTI 5349 1.65 3.26 0.92 133 XM_ProductURIs 4888 0.97 1.27 0.84 134 RELAYCOUNTRY_GB 4583 0.81 0.87 0.79 135 T_FILL_THIS_FORM_SHORT 4487 0.81 0.89 0.77 136 DKIM_ADSP_CUSTOM_MED 4275 0.74 0.74 0.74 137 URI_TRY_3LD 4153 1.02 1.68 0.71 138 XM_H_Long_From02 4137 0.87 1.20 0.71 139 NO_DNS_FOR_FROM 3999 0.81 1.06 0.69 140 TR_MetaPhish_Combo_01 3904 0.73 0.85 0.67 141 MPART_ALT_DIFF_COUNT 3867 0.66 0.65 0.67 142 TM2_M_VERY_LONG_WORD 3674 0.87 1.39 0.63 143 T_XMDrugObfuBody_00 3607 0.77 1.10 0.62 144 XMStockSpam_06 3469 0.81 1.29 0.60 145 SpammyFromTLD_01 3329 0.99 1.93 0.57 146 XMLngstWrd_02 3324 0.47 0.24 0.57 147 KHOP_DYNAMIC 3241 0.56 0.56 0.56 148 XM_ShortIntro_01 3232 0.48 0.30 0.56 149 XM_UB50 3230 1.27 2.86 0.56 150 USER_IN_WHITELIST 3210 0.38 0.00 0.55 151 T_XMHurry_00 2964 0.92 1.84 0.51 152 NML_ADSP_CUSTOM_MED 2943 0.53 0.59 0.51 153 T_OBFU_PDF_ATTACH 2890 0.41 0.20 0.50 154 T_TooManySym_03 2757 0.38 0.16 0.47 155 XM_H_PHPMailer 2701 0.50 0.58 0.46 156 MISSING_HEADERS 2607 5.16 15.59 0.45 157 AC_DIV_BONANZA 2545 0.35 0.16 0.44 158 XMSubMetaI_00 2533 0.71 1.32 0.44 159 XMBrknScrpt_02 2464 0.48 0.61 0.42 160 XMGappySubj_01 2433 0.38 0.31 0.42 161 RELAYCOUNTRY_DE 2432 0.44 0.50 0.42 162 XMBody_95 2407 0.33 0.14 0.41 163 XMMoneyMeta_00 2399 0.49 0.66 0.41 164 XMBody_17 2374 0.78 1.59 0.41 165 SHORT_HELO_AND_INLINE_IMAGE 2369 0.30 0.06 0.41 166 T_Symld_Words_02 2329 0.50 0.71 0.40 167 TR_LOTS_OF_MONEY2 2326 0.54 0.83 0.40 168 T_MONEY_PERCENT 2326 0.54 0.83 0.40 169 HTTPS_HTTP_MISMATCH 2298 0.48 0.68 0.40 170 XMSubMetaSxObfu_02 2261 0.38 0.34 0.39 171 URI_NOVOWEL 2206 0.49 0.74 0.38 172 HTML_IMAGE_ONLY_32 2197 0.35 0.29 0.38 173 URIBL_DBL_ABUSE_SPAM 2186 0.30 0.12 0.38 174 TR_XM_RelayPhish 2184 0.78 1.68 0.38 175 RDNS_DYNAMIC 2174 0.47 0.69 0.37 176 XMDateMe_00 2117 0.37 0.39 0.36 177 TM2_M_BODY_EMPTY 2116 0.33 0.27 0.36 178 XMLngstWrd_03 2098 0.30 0.17 0.36 179 RELAYCOUNTRY_AU 2057 0.42 0.57 0.35 180 XMHTML_After_End 2054 0.60 1.16 0.35 181 TR_Mismatch_TLD_01 2047 0.46 0.71 0.35 182 XMSexyCombo_01 2040 0.70 1.46 0.35 183 FORGED_GMAIL_RCVD 1996 0.42 0.60 0.34 184 RCVD_IN_SORBS_DUL 1963 0.31 0.24 0.34 185 XMPhish14 1954 0.46 0.72 0.34 186 XM_B_REG_HTML 1948 0.44 0.67 0.34 187 FILL_THIS_FORM 1947 0.50 0.86 0.33 188 XMBody_78 1905 0.44 0.69 0.33 189 XMBdyGiftCard01 1889 0.64 1.35 0.32 190 TM2_M_A_HREF_HREF 1815 0.36 0.48 0.31 191 HTML_TAG_BALANCE_BODY 1786 0.48 0.86 0.31 192 HTML_IMAGE_ONLY_28 1763 0.38 0.56 0.30 193 XM_H_PHPOS_M 1677 0.31 0.35 0.29 194 XM_B_COPY_HTML 1627 0.33 0.45 0.28 195 RCVD_IN_BL_SPAMCOP_NET 1600 0.71 1.66 0.28 196 HTML_IMAGE_ONLY_24 1565 0.29 0.33 0.27 197 HTML_IMAGE_ONLY_16 1534 0.25 0.23 0.26 198 PLING_QUERY 1530 0.54 1.14 0.26 199 T_FILL_THIS_FORM_LONG 1499 0.42 0.77 0.26 200 XMSlimDrugH 1468 1.21 3.32 0.25 ----------------------------------------------------------------------