Email: 771384 Autolearn: 0 AvgScore: 3.81 AvgScanTime: 4.21 sec Spam: 244780 Autolearn: 0 AvgScore: 13.58 AvgScanTime: 4.84 sec Ham: 526604 Autolearn: 0 AvgScore: -0.73 AvgScanTime: 3.91 sec Time Spent Running SA: 901.06 hours Time Spent Processing Spam: 328.84 hours Time Spent Processing Ham: 572.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 236601 91.58 96.66 89.22 2 DKIM_SIGNED 176663 63.68 72.17 59.73 3 XM_DK_Pass 172340 62.32 70.41 58.57 4 DCC_CHECK 166189 41.70 67.89 29.52 5 DKIM_VALID 163034 58.36 66.60 54.53 6 XMListUnsubscribeExists 150318 46.26 61.41 39.22 7 DKIM_VALID_AU 123545 42.18 50.47 38.33 8 XM_H_QuotedFrom 112793 41.14 46.08 38.84 9 MIME_HTML_ONLY 105406 24.64 43.06 16.07 10 XM_DK_Undo_02 101258 20.70 41.37 11.10 11 BAYES_99 91630 18.96 37.43 10.38 12 BAYES_999 76805 16.01 31.38 8.87 13 HTML_FONT_LOW_CONTRAST 75804 25.90 30.97 23.54 14 DCC_CHECK_NEGATIVE 75203 56.72 30.72 68.81 15 LOC_TINY_FONT_1 73632 21.54 30.08 17.58 16 TR_DCC_Bayes_99 71631 12.51 29.26 4.73 17 BAYES_50 70700 46.67 28.88 54.94 18 XMSubLong 60873 20.16 24.87 17.98 19 FVGT_m_MULTI_ODD 54432 19.62 22.24 18.40 20 DKIM_VALID_EF 49671 21.67 20.29 22.31 21 HTML_MIME_NO_HTML_TAG 47636 7.61 19.46 2.10 22 FROM_EXCESS_BASE64 47329 8.05 19.34 2.80 23 T_KAM_HTML_FONT_INVALID 46013 14.82 18.80 12.98 24 T_REMOTE_IMAGE 45243 8.68 18.48 4.13 25 T_TM2_M_HEADER_IN_MSG 45199 25.13 18.47 28.23 26 HTML_SHORT_LINK_IMG_1 44146 8.18 18.03 3.59 27 BODY_URI_ONLY 43600 5.69 17.81 0.06 28 XM_Body_Dirty_Words 42814 11.92 17.49 9.33 29 RCVD_IN_RP_RNBL 42287 5.51 17.28 0.04 30 SHORTENED_URL_SRC 40863 7.73 16.69 3.57 31 SHORTENER_SHORT_IMG 40862 7.73 16.69 3.56 32 URI_BUFFLY 39090 7.50 15.97 3.56 33 MISSING_HEADERS 38841 5.47 15.87 0.63 34 MIME_HEADER_CTYPE_ONLY 38675 5.10 15.80 0.12 35 XM_Multi_Part_URI 36912 10.82 15.08 8.84 36 RELAYCOUNTRY_META 35539 8.70 14.52 5.99 37 HTML_IMAGE_RATIO_02 34461 8.41 14.08 5.78 38 MultiRelay 34272 15.26 14.00 15.84 39 BAYES_80 31788 6.70 12.99 3.78 40 HTML_IMAGE_ONLY_08 30800 5.76 12.58 2.59 41 FSL_BULK_SIG 29868 8.35 12.20 6.55 42 XM_Evil_Numbers_Gen 28695 9.26 11.72 8.11 43 XMSexyCombo_05 27658 5.47 11.30 2.76 44 BOTNET_IPINHOSTNAME 27539 6.73 11.25 4.62 45 LOTS_OF_MONEY 26606 8.61 10.87 7.57 46 BAYES_60 25757 7.46 10.52 6.04 47 BOTNET 25003 4.07 10.21 1.21 48 XM_UncommonTLD01 23891 4.91 9.76 2.65 49 UNTRUSTED_Relay 23649 4.85 9.66 2.62 50 MPART_ALT_DIFF 21052 4.54 8.60 2.66 51 HTML_IMAGE_RATIO_04 19413 11.42 7.93 13.05 52 T_XMDrugObfuBody_14 19134 7.07 7.82 6.72 53 XMSubMetaSx_00 18604 4.69 7.60 3.33 54 XM_H_Long_From01 17914 5.32 7.32 4.39 55 XM_B_Phish_Phrases 17666 5.07 7.22 4.08 56 BAYES_95 16563 3.81 6.77 2.44 57 XMNumbers 16496 3.94 6.74 2.64 58 LotsOfNums_01 16303 7.37 6.66 7.70 59 SpammyFromTLD_02 15669 2.19 6.40 0.23 60 TooManyTo_001 14786 8.17 6.04 9.16 61 TR_XM_DocInvoice 14458 3.89 5.91 2.95 62 HTML_IMAGE_ONLY_04 13917 2.57 5.69 1.12 63 DKIM_INVALID 13629 5.32 5.57 5.20 64 MIME_HTML_ONLY_MULTI 12714 2.41 5.19 1.12 65 XMStrtUSub 11218 7.19 4.58 8.40 66 MIME_HTML_MOSTLY 10967 2.76 4.48 1.95 67 RCVD_IN_RP_SAFE 10965 6.08 4.48 6.82 68 XM_DIRTYINTL 10779 2.37 4.40 1.42 69 HTML_IMAGE_RATIO_06 10728 3.91 4.38 3.69 70 XM_SendGrid 9624 4.12 3.93 4.21 71 TM2_M_URI_OPT_OUT 9446 2.61 3.86 2.04 72 XM_UB50 8606 2.65 3.52 2.24 73 MIME_QP_LONG_LINE 8365 4.59 3.42 5.13 74 XM_CamelCaseFrm001 7921 1.94 3.24 1.34 75 RELAYCOUNTRY_FR 7830 1.19 3.20 0.26 76 RCVD_IN_RP_CERTIFIED 7560 5.02 3.09 5.91 77 RCVD_IN_MSPIKE_H2 7545 3.78 3.08 4.11 78 XM_SPF_SoftFail 7515 2.23 3.07 1.84 79 HTML_IMAGE_RATIO_08 7042 2.23 2.88 1.94 80 URI_HEX 6959 1.98 2.84 1.58 81 PLING_QUERY 6743 1.09 2.75 0.32 82 RELAYCOUNTRY_CA 6591 1.69 2.69 1.22 83 DIET_1 6488 1.01 2.65 0.24 84 MultiRelay_CC 6396 0.95 2.61 0.17 85 MultiRelay_Combo 6396 0.95 2.61 0.17 86 RDNS_DYNAMIC 6187 1.08 2.53 0.41 87 KHOP_DYNAMIC 6131 1.20 2.50 0.60 88 XMSubMetaI_00 5845 1.19 2.39 0.64 89 XM_URI_RBL 5819 0.82 2.38 0.10 90 T_TooManySym_01 5749 2.96 2.35 3.24 91 XMDiploma_00 5686 1.74 2.32 1.47 92 XM_OfRef6 5652 1.64 2.31 1.33 93 XMSlimDrugH 5472 0.93 2.24 0.32 94 T_XMDrugObfuBody_08 5428 1.66 2.22 1.40 95 XMBdyGiftCard01 4884 0.96 2.00 0.47 96 XMSexyCombo_01 4858 0.93 1.98 0.44 97 NORMAL_HTTP_TO_IP 4734 0.64 1.93 0.04 98 RCVD_IN_IADB_LISTED 4669 4.00 1.91 4.97 99 SUBJ_ALL_CAPS 4532 1.67 1.85 1.59 100 RCVD_IN_BL_SPAMCOP_NET 4390 0.77 1.79 0.30 101 XM_UB99 4214 0.57 1.72 0.04 102 XM_Combo_Sbj 4129 0.66 1.69 0.19 103 RCVD_IN_IADB_SPF 4128 3.51 1.69 4.36 104 HTML_FONT_SIZE_LARGE 4095 0.89 1.67 0.53 105 T_Symld_Words_02 3998 0.78 1.63 0.38 106 XM_UB60 3928 0.56 1.60 0.08 107 RCVD_IN_IADB_SENDERID 3879 3.10 1.58 3.80 108 LOW_PRICE 3861 0.59 1.58 0.13 109 RCVD_IN_IADB_DK 3847 3.07 1.57 3.77 110 MAILING_LIST_MULTI 3825 2.01 1.56 2.22 111 XMBody_17 3810 0.76 1.56 0.39 112 ALL_TRUSTED 3669 14.63 1.50 20.73 113 XMSubMetaSx_01 3596 0.59 1.47 0.19 114 BOTNET_NORDNS 3574 0.47 1.46 0.01 115 XM_H_Long_From02 3385 2.05 1.38 2.36 116 UNPARSEABLE_RELAY 3315 2.86 1.35 3.56 117 XM_UB80 3221 0.45 1.32 0.05 118 XMSexyCombo_04 3205 0.49 1.31 0.10 119 URIBL_BLACK 3185 0.43 1.30 0.03 120 TM2_M_VERY_LONG_WORD 3164 0.87 1.29 0.67 121 SpammyFromTLD_01 3141 0.81 1.28 0.59 122 T_XMDrugObfuBody_00 3039 0.84 1.24 0.66 123 XMStockSpam_06 2969 1.14 1.21 1.11 124 XMPhish11 2954 1.09 1.21 1.04 125 XMGenDplmaNmb 2947 1.03 1.20 0.95 126 URIBL_DBL_SPAM 2917 0.40 1.19 0.03 127 XMHTML_After_End 2852 0.62 1.17 0.36 128 DKIM_ADSP_NXDOMAIN 2843 0.61 1.16 0.35 129 XMSubMetaI_01 2838 0.38 1.16 0.02 130 TR_XM_RelayPhish 2789 0.66 1.14 0.44 131 XM_HighProb1 2769 0.37 1.13 0.01 132 NO_DNS_FOR_FROM 2722 0.83 1.11 0.69 133 XM_DK_Undo_01 2720 1.44 1.11 1.60 134 BAYES_40 2712 2.92 1.11 3.77 135 ANY_BOUNCE_MESSAGE 2697 6.35 1.10 8.78 136 BOUNCE_MESSAGE 2697 6.35 1.10 8.78 137 XM_PDF 2577 3.31 1.05 4.37 138 RELAYCOUNTRY_CN 2576 0.37 1.05 0.06 139 TR_Symld_Words 2573 1.41 1.05 1.58 140 XMPhish30 2554 0.54 1.04 0.31 141 BAYES_00 2538 8.20 1.04 11.53 142 T_MONEY_PERCENT 2533 0.57 1.03 0.35 143 TR_LOTS_OF_MONEY2 2533 0.57 1.03 0.35 144 XM_ProductURIs 2529 1.01 1.03 1.00 145 XMSubMetaSSx_00 2501 0.45 1.02 0.18 146 RELAYCOUNTRY_GB 2499 1.00 1.02 0.99 147 DATE_IN_PAST_03_06 2494 3.33 1.02 4.40 148 MORE_SEX 2417 0.32 0.99 0.02 149 XM_UB999 2371 0.32 0.97 0.02 150 HTML_TAG_BALANCE_BODY 2369 0.60 0.97 0.42 151 URI_TRY_3LD 2311 0.98 0.94 1.00 152 TR_MetaPhish_Combo_01 2301 0.94 0.94 0.94 153 T_XMHurry_00 2296 0.70 0.94 0.59 154 SUBJ_DOLLARS 2217 0.36 0.91 0.11 155 TR_XM_DK_Bayes 2193 3.21 0.90 4.28 156 TooManyTo_002 2161 1.91 0.88 2.38 157 RELAYCOUNTRY_AT 2128 0.35 0.87 0.11 158 DKIM_ADSP_CUSTOM_MED 2112 0.90 0.86 0.92 159 HTML_FONT_FACE_BAD 2111 7.21 0.86 10.16 160 XM_UB95 2074 0.29 0.85 0.03 161 TR_LOTS_OF_MONEY3 2070 0.42 0.85 0.23 162 RCVD_IN_IADB_VOUCHED 2027 2.47 0.83 3.23 163 URI_NOVOWEL 2023 0.54 0.83 0.41 164 TR_XM_DK_Bayes1 2015 2.85 0.82 3.80 165 BAYES_20 1928 2.82 0.79 3.76 166 TooManyTo_003 1918 1.40 0.78 1.68 167 FORGED_GMAIL_RCVD 1913 0.57 0.78 0.47 168 REMOVE_BEFORE_LINK 1867 0.44 0.76 0.29 169 T_FILL_THIS_FORM_SHORT 1850 0.79 0.76 0.81 170 TR_XM_DK_Bayes2 1833 2.34 0.75 3.08 171 XMClaimOffer 1826 0.31 0.75 0.11 172 XM_Body_Obfu01 1793 0.37 0.73 0.21 173 XMHTMLBadTable_001 1791 0.50 0.73 0.39 174 XM_RXBody 1789 0.29 0.73 0.09 175 XM_B_REG_HTML 1785 0.47 0.73 0.34 176 TR_LOTS_OF_MONEY1 1774 0.24 0.72 0.02 177 SHORT_URI_3 1770 0.24 0.72 0.02 178 MPART_ALT_DIFF_COUNT 1763 0.43 0.72 0.29 179 BODY_SINGLE_WORD 1751 0.24 0.72 0.02 180 FVGT_m_MULTI_ODD_EMAIL 1733 0.27 0.71 0.07 181 NML_ADSP_CUSTOM_MED 1726 0.64 0.71 0.61 182 XM_H_PHPOS 1722 0.93 0.70 1.04 183 XMSubMetaSxObfu_03 1712 0.39 0.70 0.25 184 XMBody_78 1674 0.52 0.68 0.44 185 HTTPS_HTTP_MISMATCH 1674 0.46 0.68 0.35 186 RCVD_IN_MSPIKE_WL 1670 1.44 0.68 1.79 187 LongTLD 1660 0.30 0.68 0.12 188 RCVD_IN_MSPIKE_H3 1657 1.44 0.68 1.79 189 XM_Nigeria_01 1650 0.24 0.67 0.04 190 TR_Caps_n_Bayes_99 1636 0.34 0.67 0.18 191 XM_B_COPY_HTML 1610 0.43 0.66 0.32 192 XMBrknScrpt_02 1603 0.49 0.65 0.41 193 RELAYCOUNTRY_DE 1584 0.44 0.65 0.35 194 BODY_ENHANCEMENT 1571 0.21 0.64 0.01 195 T_TooManySym_02 1547 1.14 0.63 1.37 196 FROM_LOCAL_NOVOWEL 1540 0.26 0.63 0.09 197 TR_Mismatch_TLD_02 1537 0.23 0.63 0.04 198 XMMoneyMeta_00 1523 0.63 0.62 0.63 199 HTML_SHORT_CENTER 1515 0.29 0.62 0.14 200 XMSexyCombo_02 1510 0.22 0.62 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 469832 91.58 96.66 89.22 2 DCC_CHECK_NEGATIVE 362348 56.72 30.72 68.81 3 DKIM_SIGNED 314527 63.68 72.17 59.73 4 XM_DK_Pass 308406 62.32 70.41 58.57 5 BAYES_50 289322 46.67 28.88 54.94 6 DKIM_VALID 287147 58.36 66.60 54.53 7 XMListUnsubscribeExists 206544 46.26 61.41 39.22 8 XM_H_QuotedFrom 204551 41.14 46.08 38.84 9 DKIM_VALID_AU 201847 42.18 50.47 38.33 10 DCC_CHECK 155444 41.70 67.89 29.52 11 T_TM2_M_HEADER_IN_MSG 148673 25.13 18.47 28.23 12 HTML_FONT_LOW_CONTRAST 123987 25.90 30.97 23.54 13 DKIM_VALID_EF 117463 21.67 20.29 22.31 14 ALL_TRUSTED 109184 14.63 1.50 20.73 15 FVGT_m_MULTI_ODD 96914 19.62 22.24 18.40 16 XMSubLong 94665 20.16 24.87 17.98 17 LOC_TINY_FONT_1 92560 21.54 30.08 17.58 18 MIME_HTML_ONLY 84632 24.64 43.06 16.07 19 MultiRelay 83422 15.26 14.00 15.84 20 IN_ZIMBRA_NJ_WHITELIST 73043 9.48 0.02 13.87 21 HTML_IMAGE_RATIO_04 68705 11.42 7.93 13.05 22 T_KAM_HTML_FONT_INVALID 68335 14.82 18.80 12.98 23 BAYES_00 60696 8.20 1.04 11.53 24 XM_DK_Undo_02 58431 20.70 41.37 11.10 25 BAYES_99 54657 18.96 37.43 10.38 26 HTML_FONT_FACE_BAD 53477 7.21 0.86 10.16 27 XM_Body_Dirty_Words 49122 11.92 17.49 9.33 28 TooManyTo_001 48225 8.17 6.04 9.16 29 BAYES_999 46708 16.01 31.38 8.87 30 XM_Multi_Part_URI 46558 10.82 15.08 8.84 31 ANY_BOUNCE_MESSAGE 46259 6.35 1.10 8.78 32 BOUNCE_MESSAGE 46253 6.35 1.10 8.78 33 XM_DKIMWhitelistDomains 45152 5.86 0.03 8.57 34 XMStrtUSub 44228 7.19 4.58 8.40 35 XM_Evil_Numbers_Gen 42731 9.26 11.72 8.11 36 LotsOfNums_01 40554 7.37 6.66 7.70 37 LOTS_OF_MONEY 39841 8.61 10.87 7.57 38 RCVD_IN_RP_SAFE 35909 6.08 4.48 6.82 39 T_XMDrugObfuBody_14 35391 7.07 7.82 6.72 40 FSL_BULK_SIG 34508 8.35 12.20 6.55 41 BAYES_60 31826 7.46 10.52 6.04 42 RELAYCOUNTRY_META 31554 8.70 14.52 5.99 43 RCVD_IN_RP_CERTIFIED 31132 5.02 3.09 5.91 44 HTML_IMAGE_RATIO_02 30447 8.41 14.08 5.78 45 DKIM_INVALID 27380 5.32 5.57 5.20 46 MIME_QP_LONG_LINE 27008 4.59 3.42 5.13 47 RCVD_IN_IADB_LISTED 26173 4.00 1.91 4.97 48 TR_DCC_Bayes_99 24893 12.51 29.26 4.73 49 BOTNET_IPINHOSTNAME 24355 6.73 11.25 4.62 50 DATE_IN_PAST_03_06 23188 3.33 1.02 4.40 51 XM_H_Long_From01 23111 5.32 7.32 4.39 52 XM_PDF 22990 3.31 1.05 4.37 53 RCVD_IN_IADB_SPF 22936 3.51 1.69 4.36 54 TR_XM_DK_Bayes 22531 3.21 0.90 4.28 55 XM_SendGrid 22146 4.12 3.93 4.21 56 T_REMOTE_IMAGE 21725 8.68 18.48 4.13 57 RCVD_IN_MSPIKE_H2 21641 3.78 3.08 4.11 58 XM_B_Phish_Phrases 21461 5.07 7.22 4.08 59 RCVD_IN_IADB_SENDERID 20034 3.10 1.58 3.80 60 TR_XM_DK_Bayes1 19991 2.85 0.82 3.80 61 BAYES_80 19926 6.70 12.99 3.78 62 RCVD_IN_IADB_DK 19860 3.07 1.57 3.77 63 BAYES_40 19839 2.92 1.11 3.77 64 BAYES_20 19793 2.82 0.79 3.76 65 XMSubNoVowel 19481 2.60 0.24 3.70 66 HTML_IMAGE_RATIO_06 19439 3.91 4.38 3.69 67 HTML_SHORT_LINK_IMG_1 18923 8.18 18.03 3.59 68 SHORTENED_URL_SRC 18778 7.73 16.69 3.57 69 SHORTENER_SHORT_IMG 18750 7.73 16.69 3.56 70 URI_BUFFLY 18749 7.50 15.97 3.56 71 UNPARSEABLE_RELAY 18730 2.86 1.35 3.56 72 XMSubMetaSx_00 17547 4.69 7.60 3.33 73 TVD_RCVD_IP 17369 2.33 0.25 3.30 74 BAYES_05 17273 2.38 0.43 3.28 75 T_TooManySym_01 17083 2.96 2.35 3.24 76 RCVD_IN_IADB_VOUCHED 17017 2.47 0.83 3.23 77 TR_XM_DK_Bayes2 16215 2.34 0.75 3.08 78 TR_XM_DocInvoice 15556 3.89 5.91 2.95 79 FROM_EXCESS_BASE64 14754 8.05 19.34 2.80 80 XMSexyCombo_05 14525 5.47 11.30 2.76 81 MPART_ALT_DIFF 14007 4.54 8.60 2.66 82 XM_UncommonTLD01 13969 4.91 9.76 2.65 83 XMNumbers 13915 3.94 6.74 2.64 84 UNTRUSTED_Relay 13796 4.85 9.66 2.62 85 HTML_IMAGE_ONLY_08 13630 5.76 12.58 2.59 86 BAYES_95 12853 3.81 6.77 2.44 87 TooManyTo_002 12555 1.91 0.88 2.38 88 XM_H_Long_From02 12406 2.05 1.38 2.36 89 XM_UB50 11819 2.65 3.52 2.24 90 MAILING_LIST_MULTI 11709 2.01 1.56 2.22 91 HTML_MIME_NO_HTML_TAG 11068 7.61 19.46 2.10 92 TM2_M_URI_OPT_OUT 10720 2.61 3.86 2.04 93 RCVD_IN_IADB_OPTIN 10581 1.53 0.50 2.01 94 MIME_HTML_MOSTLY 10294 2.76 4.48 1.95 95 HTML_IMAGE_RATIO_08 10190 2.23 2.88 1.94 96 XM_SPF_SoftFail 9698 2.23 3.07 1.84 97 RCVD_IN_MSPIKE_WL 9427 1.44 0.68 1.79 98 RCVD_IN_MSPIKE_H3 9427 1.44 0.68 1.79 99 TooManyTo_003 8846 1.40 0.78 1.68 100 HELO_NODOT 8568 1.17 0.20 1.63 101 XM_DK_Undo_01 8419 1.44 1.11 1.60 102 RELAYCOUNTRY_PH 8379 1.10 0.05 1.59 103 SUBJ_ALL_CAPS 8366 1.67 1.85 1.59 104 TR_Symld_Words 8341 1.41 1.05 1.58 105 URI_HEX 8340 1.98 2.84 1.58 106 IN_HORDE_ADDRESS_BOOK 8165 1.08 0.06 1.55 107 XMDiploma_00 7764 1.74 2.32 1.47 108 XM_DIRTYINTL 7500 2.37 4.40 1.42 109 T_XMDrugObfuBody_08 7370 1.66 2.22 1.40 110 T_TooManySym_02 7213 1.14 0.63 1.37 111 INVALID_MSGID 7200 1.02 0.28 1.37 112 XM_CamelCaseFrm001 7077 1.94 3.24 1.34 113 XM_OfRef6 7020 1.64 2.31 1.33 114 USER_IN_DEF_DKIM_WL 6766 0.91 0.10 1.28 115 XMCapTrack 6610 1.01 0.47 1.26 116 DATE_IN_PAST_06_12 6494 0.88 0.13 1.23 117 RELAYCOUNTRY_CA 6416 1.69 2.69 1.22 118 BOTNET 6364 4.07 10.21 1.21 119 TO_MALFORMED 6352 0.83 0.01 1.21 120 XMSubLongNoVowel 6100 0.81 0.06 1.16 121 HTML_IMAGE_ONLY_04 5905 2.57 5.69 1.12 122 MIME_HTML_ONLY_MULTI 5884 2.41 5.19 1.12 123 XMStockSpam_06 5826 1.14 1.21 1.11 124 XMSubGarbage 5808 0.76 0.02 1.10 125 XM_GoogleGroups 5785 0.86 0.36 1.10 126 XM_H_PHPOS 5490 0.93 0.70 1.04 127 XMPhish11 5474 1.09 1.21 1.04 128 XM_E_Blogspot 5366 0.73 0.10 1.02 129 URI_TRY_3LD 5284 0.98 0.94 1.00 130 XM_ProductURIs 5248 1.01 1.03 1.00 131 TooManyTo_004 5232 0.86 0.58 0.99 132 RELAYCOUNTRY_GB 5206 1.00 1.02 0.99 133 XMLngstWrd_00 5039 0.76 0.34 0.96 134 XMGenDplmaNmb 5008 1.03 1.20 0.95 135 TR_MetaPhish_Combo_01 4941 0.94 0.94 0.94 136 DKIM_ADSP_CUSTOM_MED 4860 0.90 0.86 0.92 137 TooManyTo_005 4451 0.74 0.51 0.85 138 XMLngstWrd_01 4326 0.66 0.31 0.82 139 T_FILL_THIS_FORM_SHORT 4240 0.79 0.76 0.81 140 NO_DNS_FOR_FROM 3647 0.83 1.11 0.69 141 TM2_M_VERY_LONG_WORD 3531 0.87 1.29 0.67 142 T_XMDrugObfuBody_00 3470 0.84 1.24 0.66 143 XMSubMetaI_00 3345 1.19 2.39 0.64 144 MISSING_HEADERS 3320 5.47 15.87 0.63 145 XMMoneyMeta_00 3299 0.63 0.62 0.63 146 USER_IN_WHITELIST 3245 0.42 0.00 0.62 147 XMNoVowels 3226 0.54 0.38 0.61 148 NML_ADSP_CUSTOM_MED 3198 0.64 0.71 0.61 149 KHOP_DYNAMIC 3140 1.20 2.50 0.60 150 T_XMHurry_00 3124 0.70 0.94 0.59 151 SpammyFromTLD_01 3081 0.81 1.28 0.59 152 T_OBFU_PDF_ATTACH 2990 0.46 0.23 0.57 153 XM_H_PHPMailer 2849 0.55 0.58 0.54 154 HTML_FONT_SIZE_LARGE 2776 0.89 1.67 0.53 155 AC_DIV_BONANZA 2774 0.40 0.12 0.53 156 T_TooManySym_03 2698 0.38 0.10 0.51 157 XMSubMetaSxObfu_02 2655 0.40 0.17 0.50 158 XMLngstWrd_02 2629 0.42 0.26 0.50 159 TM2_M_A_HREF_HREF 2536 0.47 0.46 0.48 160 XMBdyGiftCard01 2489 0.96 2.00 0.47 161 RELAYCOUNTRY_AU 2461 0.48 0.52 0.47 162 FORGED_GMAIL_RCVD 2453 0.57 0.78 0.47 163 XM_ShortIntro_01 2410 0.45 0.43 0.46 164 XMBody_95 2354 0.35 0.14 0.45 165 XMBody_78 2330 0.52 0.68 0.44 166 XMSexyCombo_01 2305 0.93 1.98 0.44 167 TR_XM_RelayPhish 2304 0.66 1.14 0.44 168 HTML_TAG_BALANCE_BODY 2235 0.60 0.97 0.42 169 SHORT_HELO_AND_INLINE_IMAGE 2209 0.30 0.05 0.42 170 T_MANY_PILL_PRICE 2191 0.29 0.02 0.42 171 XMBrknScrpt_02 2166 0.49 0.65 0.41 172 RDNS_DYNAMIC 2153 1.08 2.53 0.41 173 XMGappySubj_01 2139 0.42 0.44 0.41 174 URI_NOVOWEL 2134 0.54 0.83 0.41 175 HTML_IMAGE_ONLY_32 2113 0.34 0.21 0.40 176 HTML_IMAGE_ONLY_28 2081 0.40 0.41 0.40 177 XMBody_17 2070 0.76 1.56 0.39 178 TM2_M_BODY_EMPTY 2042 0.31 0.15 0.39 179 XMHTMLBadTable_001 2037 0.50 0.73 0.39 180 XM_D_tchamptons_WL 2022 0.26 0.00 0.38 181 XMDateMe_00 2019 0.44 0.57 0.38 182 T_Symld_Words_02 1998 0.78 1.63 0.38 183 FILL_THIS_FORM 1983 0.43 0.54 0.38 184 RCVD_IN_SORBS_DUL 1919 0.32 0.22 0.36 185 XMHTML_After_End 1906 0.62 1.17 0.36 186 HTTPS_HTTP_MISMATCH 1861 0.46 0.68 0.35 187 DKIM_ADSP_NXDOMAIN 1854 0.61 1.16 0.35 188 RELAYCOUNTRY_DE 1843 0.44 0.65 0.35 189 TR_LOTS_OF_MONEY2 1829 0.57 1.03 0.35 190 T_MONEY_PERCENT 1829 0.57 1.03 0.35 191 XM_B_REG_HTML 1815 0.47 0.73 0.34 192 XM_B_COPY_HTML 1708 0.43 0.66 0.32 193 HTML_IMAGE_ONLY_24 1691 0.33 0.35 0.32 194 XMSlimDrugH 1689 0.93 2.24 0.32 195 PLING_QUERY 1675 1.09 2.75 0.32 196 XMLngstWrd_03 1670 0.27 0.18 0.32 197 XMSolicitRefs_0 1620 0.35 0.44 0.31 198 XMPhish30 1619 0.54 1.04 0.31 199 T_FILL_THIS_FORM_LONG 1585 0.36 0.48 0.30 200 RCVD_IN_BL_SPAMCOP_NET 1568 0.77 1.79 0.30 ----------------------------------------------------------------------