Email: 668353 Autolearn: 0 AvgScore: 3.52 AvgScanTime: 4.33 sec Spam: 196640 Autolearn: 0 AvgScore: 12.19 AvgScanTime: 5.08 sec Ham: 471713 Autolearn: 0 AvgScore: -0.10 AvgScanTime: 4.02 sec Time Spent Running SA: 804.10 hours Time Spent Processing Spam: 277.70 hours Time Spent Processing Ham: 526.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 187711 82.52 95.46 77.13 2 DKIM_SIGNED 167695 70.41 85.28 64.22 3 XM_DK_Pass 164357 69.02 83.58 62.95 4 DKIM_VALID 157439 65.57 80.06 59.53 5 DCC_CHECK 154426 44.51 78.53 30.33 6 XMListUnsubscribeExists 141434 50.49 71.93 41.56 7 DKIM_VALID_AU 123333 48.01 62.72 41.88 8 XM_H_QuotedFrom 107711 37.33 54.78 30.05 9 XM_DK_Undo_02 97389 22.98 49.53 11.91 10 BAYES_99 85936 20.89 43.70 11.37 11 HTML_FONT_LOW_CONTRAST 74852 28.87 38.07 25.03 12 BAYES_999 73120 17.82 37.18 9.75 13 LOC_TINY_FONT_1 71190 24.11 36.20 19.06 14 TR_DCC_Bayes_99 67313 13.96 34.23 5.51 15 BAYES_50 66526 53.27 33.83 61.37 16 MIME_HTML_ONLY 60877 21.15 30.96 17.06 17 FVGT_m_MULTI_ODD 53847 21.46 27.38 18.99 18 XMSubLong 48507 20.19 24.67 18.32 19 DKIM_VALID_EF 46584 24.18 23.69 24.39 20 T_KAM_HTML_FONT_INVALID 41120 15.56 20.91 13.33 21 XM_Body_Dirty_Words 39659 14.66 20.17 12.36 22 DCC_CHECK_NEGATIVE 39382 53.84 20.03 67.93 23 T_TM2_M_HEADER_IN_MSG 38487 24.31 19.57 26.29 24 XM_Multi_Part_URI 34454 12.40 17.52 10.26 25 HTML_IMAGE_RATIO_02 32818 10.08 16.69 7.32 26 MultiRelay 31908 16.44 16.23 16.53 27 XM_Evil_Numbers_Gen 28795 9.10 14.64 6.78 28 RELAYCOUNTRY_META 28391 7.49 14.44 4.60 29 BOTNET_IPINHOSTNAME 25889 7.29 13.17 4.83 30 FSL_BULK_SIG 25515 8.17 12.98 6.17 31 LOTS_OF_MONEY 23558 9.78 11.98 8.86 32 BOTNET 23361 4.16 11.88 0.95 33 XMSexyCombo_05 21900 5.56 11.14 3.24 34 XM_B_Phish_Phrases 19424 6.41 9.88 4.97 35 T_XMDrugObfuBody_14 18510 7.61 9.41 6.86 36 HTML_IMAGE_RATIO_04 18247 5.96 9.28 4.58 37 UNTRUSTED_Relay 16997 3.48 8.64 1.33 38 MPART_ALT_DIFF 16221 4.74 8.25 3.27 39 XM_H_Long_From01 16168 5.84 8.22 4.85 40 FROM_EXCESS_BASE64 16045 4.61 8.16 3.13 41 TooManyTo_001 15361 13.69 7.81 16.13 42 TR_XM_DocInvoice 14921 4.32 7.59 2.96 43 XM_UncommonTLD01 14789 4.19 7.52 2.80 44 BAYES_80 14349 4.81 7.30 3.77 45 XMSubMetaSx_00 13595 4.90 6.91 4.06 46 LotsOfNums_01 13344 7.24 6.79 7.43 47 RCVD_IN_RP_SAFE 12264 7.36 6.24 7.83 48 BAYES_60 11433 6.57 5.81 6.88 49 XMStrtUSub 10288 3.95 5.23 3.42 50 DKIM_INVALID 10256 4.84 5.22 4.68 51 MIME_HTML_MOSTLY 10119 3.41 5.15 2.68 52 RCVD_IN_RP_CERTIFIED 9953 6.80 5.06 7.53 53 TM2_M_URI_OPT_OUT 9716 9.72 4.94 11.71 54 HTML_IMAGE_RATIO_06 9518 3.40 4.84 2.79 55 XM_SendGrid 9462 4.63 4.81 4.55 56 MIME_QP_LONG_LINE 9395 11.98 4.78 14.98 57 XMNumbers 8903 3.67 4.53 3.32 58 BAYES_95 8872 3.21 4.51 2.67 59 ALL_TRUSTED 7756 20.70 3.94 27.69 60 XM_UB50 7623 1.70 3.88 0.79 61 XM_DIRTYINTL 7540 2.43 3.83 1.84 62 RCVD_IN_BL_SPAMCOP_NET 7060 1.27 3.59 0.30 63 RCVD_IN_MSPIKE_H2 6940 4.30 3.53 4.62 64 MIME_HTML_ONLY_MULTI 6889 1.92 3.50 1.26 65 XM_SPF_SoftFail 6410 2.07 3.26 1.58 66 URI_HEX 6394 2.09 3.25 1.60 67 XM_CamelCaseFrm001 6298 1.87 3.20 1.32 68 T_XMDrugObfuBody_08 6270 1.93 3.19 1.40 69 RELAYCOUNTRY_CA 6181 1.81 3.14 1.26 70 T_REMOTE_IMAGE 5979 3.90 3.04 4.25 71 XMPhish14 5965 1.07 3.03 0.26 72 HTML_IMAGE_RATIO_08 5696 2.10 2.90 1.77 73 MultiRelay_CC 5656 0.94 2.88 0.14 74 MultiRelay_Combo 5656 0.94 2.88 0.14 75 XMDiploma_00 5259 1.80 2.67 1.44 76 XM_OfRef6 5197 1.69 2.64 1.29 77 SUBJ_ALL_CAPS 5177 1.96 2.63 1.68 78 HTML_MIME_NO_HTML_TAG 5034 2.28 2.56 2.16 79 XM_URI_RBL 4774 0.79 2.43 0.11 80 T_TooManySym_01 4630 3.39 2.35 3.82 81 XMBdyGiftCard01 4599 1.19 2.34 0.72 82 RCVD_IN_RP_RNBL 4474 0.71 2.28 0.06 83 RCVD_IN_IADB_LISTED 4384 4.45 2.23 5.38 84 URI_WP_HACKED_2 4157 0.66 2.11 0.06 85 URI_TRY_3LD 4122 1.55 2.10 1.32 86 RCVD_IN_IADB_SPF 3940 3.87 2.00 4.65 87 RCVD_IN_IADB_SENDERID 3717 3.43 1.89 4.07 88 XMGenDplmaNmb 3660 1.15 1.86 0.86 89 RCVD_IN_IADB_DK 3641 3.35 1.85 3.97 90 TR_XM_RelayPhish 3599 1.07 1.83 0.76 91 UNPARSEABLE_RELAY 3450 3.23 1.75 3.84 92 URIBL_BLACK 3432 0.55 1.75 0.05 93 BAYES_00 3413 4.96 1.74 6.30 94 TooManyTo_002 3397 7.29 1.73 9.60 95 XM_Combo_Sbj 3382 0.81 1.72 0.43 96 XMBody_17 3376 0.74 1.72 0.34 97 SpammyFromTLD_02 3375 0.75 1.72 0.35 98 T_XMHurry_00 3318 0.89 1.69 0.55 99 XMSubMetaI_00 3317 0.78 1.69 0.40 100 XM_H_Long_From02 3263 0.99 1.66 0.71 101 XMSexyCombo_01 3174 0.98 1.61 0.71 102 XM_ProductURIs 3124 1.33 1.59 1.23 103 TooManyTo_003 3106 5.70 1.58 7.41 104 XM_DK_Undo_01 3080 1.67 1.57 1.71 105 XM_RXBody 3069 0.88 1.56 0.59 106 XMPhish11 2935 1.44 1.49 1.41 107 SpammyFromTLD_01 2870 0.85 1.46 0.60 108 XMStockSpam_06 2823 1.22 1.44 1.14 109 TM2_M_VERY_LONG_WORD 2791 0.94 1.42 0.74 110 TR_MetaPhish_Sub_02 2736 0.41 1.39 0.01 111 XM_UB99 2689 0.42 1.37 0.03 112 XM_UB60 2682 0.50 1.36 0.15 113 TR_XM_DK_Bayes 2634 3.00 1.34 3.70 114 BAYES_40 2621 2.93 1.33 3.60 115 BOTNET_NORDNS 2561 0.39 1.30 0.01 116 MAILING_LIST_MULTI 2495 1.84 1.27 2.07 117 URIBL_DBL_SPAM 2474 0.40 1.26 0.04 118 TR_XM_DK_Bayes1 2465 2.77 1.25 3.41 119 RELAYCOUNTRY_AT 2462 0.55 1.25 0.26 120 TooManyTo_004 2449 4.12 1.25 5.32 121 T_XMDrugObfuBody_00 2416 0.94 1.23 0.82 122 XM_HighProb1 2371 0.36 1.21 0.01 123 RELAYCOUNTRY_CN 2312 0.37 1.18 0.04 124 ANY_BOUNCE_MESSAGE 2252 4.83 1.15 6.37 125 BOUNCE_MESSAGE 2249 4.83 1.14 6.37 126 TR_XM_DK_Bayes2 2248 2.30 1.14 2.78 127 RELAYCOUNTRY_FR 2207 0.48 1.12 0.21 128 HTML_FONT_FACE_BAD 2186 0.59 1.11 0.38 129 BAYES_20 2167 2.05 1.10 2.45 130 TR_Symld_Words 2152 1.59 1.09 1.79 131 XMHTML_After_End 2148 0.56 1.09 0.34 132 T_FILL_THIS_FORM_SHORT 2117 0.93 1.08 0.86 133 XMBody_78 2099 0.62 1.07 0.43 134 TR_Caps_n_Bayes_99 2084 0.35 1.06 0.06 135 DIET_1 2077 0.50 1.06 0.27 136 RCVD_IN_IADB_VOUCHED 2026 2.87 1.03 3.64 137 XM_UB999 2014 0.31 1.02 0.02 138 TooManyTo_005 2005 2.91 1.02 3.69 139 XMPhish30 1993 0.58 1.01 0.40 140 XM_B_REG_HTML 1988 0.54 1.01 0.34 141 SUBJ_DOLLARS 1947 0.43 0.99 0.20 142 RELAYCOUNTRY_DE 1923 0.63 0.98 0.48 143 REMOVE_BEFORE_LINK 1921 0.46 0.98 0.25 144 T_Symld_Words_02 1919 0.63 0.98 0.49 145 XMHTMLBadTable_001 1915 0.71 0.97 0.60 146 XMClaimOffer 1879 0.36 0.96 0.12 147 XM_H_PHPOS 1874 1.02 0.95 1.05 148 RDNS_DYNAMIC 1845 0.56 0.94 0.40 149 TR_Mismatch_TLD_02 1830 0.31 0.93 0.05 150 RELAYCOUNTRY_GB 1828 0.91 0.93 0.90 151 TM2_M_A_HREF_HREF 1824 0.62 0.93 0.49 152 HTML_TAG_BALANCE_BODY 1785 0.62 0.91 0.50 153 DKIM_ADSP_CUSTOM_MED 1778 1.00 0.90 1.03 154 TR_LOTS_OF_MONEY2 1777 0.44 0.90 0.24 155 T_MONEY_PERCENT 1777 0.44 0.90 0.24 156 XMOemUri 1739 0.34 0.88 0.11 157 XM_B_COPY_HTML 1737 0.54 0.88 0.39 158 FILL_THIS_FORM 1717 0.58 0.87 0.45 159 XMMoneyMeta_00 1703 0.56 0.87 0.44 160 MPART_ALT_DIFF_COUNT 1677 0.54 0.85 0.41 161 XMGppyBdWords 1664 0.33 0.85 0.11 162 XMSlimDrugH 1648 0.43 0.84 0.26 163 TR_LOTS_OF_MONEY3 1630 0.43 0.83 0.27 164 XMLongAddy 1612 0.29 0.82 0.07 165 HTTPS_HTTP_MISMATCH 1583 0.52 0.81 0.40 166 T_FILL_THIS_FORM_LONG 1570 0.50 0.80 0.37 167 XMBrknScrpt_02 1562 0.56 0.79 0.46 168 BODY_ENHANCEMENT 1549 0.24 0.79 0.02 169 XM_PDF 1542 3.38 0.78 4.46 170 NML_ADSP_CUSTOM_MED 1541 0.77 0.78 0.76 171 XMSubMetaSSx_00 1537 0.38 0.78 0.21 172 URI_NOVOWEL 1493 0.55 0.76 0.47 173 HTML_FONT_SIZE_HUGE 1492 0.36 0.76 0.19 174 HTML_SHORT_LINK_IMG_1 1482 0.25 0.75 0.04 175 XM_UB80 1475 0.27 0.75 0.07 176 KHOP_DYNAMIC 1470 0.61 0.75 0.55 177 XM_H_PHPMailer 1463 0.63 0.74 0.59 178 FORGED_GMAIL_RCVD 1431 0.53 0.73 0.45 179 T_TooManySym_02 1395 1.41 0.71 1.70 180 TR_MetaPhish_Combo_01 1381 0.62 0.70 0.58 181 RCVD_IN_MSPIKE_WL 1341 1.64 0.68 2.04 182 RCVD_IN_MSPIKE_H3 1328 1.64 0.68 2.04 183 FILL_THIS_FORM_LOAN 1322 0.45 0.67 0.35 184 TRACKER_ID 1320 0.32 0.67 0.17 185 RELAYCOUNTRY_NL 1312 0.30 0.67 0.14 186 RCVD_IN_IADB_OPTIN 1305 1.84 0.66 2.33 187 BAYES_05 1271 1.27 0.65 1.53 188 RELAYCOUNTRY_AU 1267 0.48 0.64 0.41 189 BODY_URI_ONLY 1255 0.22 0.64 0.05 190 XMBounce_01 1241 0.32 0.63 0.20 191 FROM_LOCAL_HEX 1222 0.24 0.62 0.08 192 RELAYCOUNTRY_JP 1206 0.21 0.61 0.04 193 NO_DNS_FOR_FROM 1201 0.57 0.61 0.56 194 LONG_HEX_URI 1184 0.25 0.60 0.11 195 XMSexyCombo_04 1166 0.28 0.59 0.15 196 PLING_QUERY 1164 0.51 0.59 0.48 197 XMCapTrack 1161 1.05 0.59 1.24 198 T_HTML_TAG_BALANCE_CENTER 1161 0.25 0.59 0.10 199 HTML_IMAGE_ONLY_04 1146 0.22 0.58 0.07 200 XMSubMetaSxObfu_03 1145 0.47 0.58 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 363838 82.52 95.46 77.13 2 DCC_CHECK_NEGATIVE 320456 53.84 20.03 67.93 3 DKIM_SIGNED 302911 70.41 85.28 64.22 4 XM_DK_Pass 296923 69.02 83.58 62.95 5 BAYES_50 289499 53.27 33.83 61.37 6 DKIM_VALID 280813 65.57 80.06 59.53 7 DKIM_VALID_AU 197540 48.01 62.72 41.88 8 XMListUnsubscribeExists 196045 50.49 71.93 41.56 9 DCC_CHECK 143085 44.51 78.53 30.33 10 XM_H_QuotedFrom 141762 37.33 54.78 30.05 11 ALL_TRUSTED 130611 20.70 3.94 27.69 12 T_TM2_M_HEADER_IN_MSG 124004 24.31 19.57 26.29 13 HTML_FONT_LOW_CONTRAST 118071 28.87 38.07 25.03 14 DKIM_VALID_EF 115036 24.18 23.69 24.39 15 LOC_TINY_FONT_1 89922 24.11 36.20 19.06 16 FVGT_m_MULTI_ODD 89594 21.46 27.38 18.99 17 XMSubLong 86427 20.19 24.67 18.32 18 MIME_HTML_ONLY 80468 21.15 30.96 17.06 19 MultiRelay 77995 16.44 16.23 16.53 20 TooManyTo_001 76106 13.69 7.81 16.13 21 MIME_QP_LONG_LINE 70655 11.98 4.78 14.98 22 T_KAM_HTML_FONT_INVALID 62893 15.56 20.91 13.33 23 XM_Body_Dirty_Words 58315 14.66 20.17 12.36 24 XM_DK_Undo_02 56191 22.98 49.53 11.91 25 TM2_M_URI_OPT_OUT 55243 9.72 4.94 11.71 26 BAYES_99 53657 20.89 43.70 11.37 27 XM_Multi_Part_URI 48397 12.40 17.52 10.26 28 XM_DKIMWhitelistDomains 47077 7.06 0.04 9.98 29 BAYES_999 46000 17.82 37.18 9.75 30 TooManyTo_002 45293 7.29 1.73 9.60 31 LOTS_OF_MONEY 41784 9.78 11.98 8.86 32 RCVD_IN_RP_SAFE 36954 7.36 6.24 7.83 33 RCVD_IN_RP_CERTIFIED 35523 6.80 5.06 7.53 34 LotsOfNums_01 35041 7.24 6.79 7.43 35 TooManyTo_003 34977 5.70 1.58 7.41 36 HTML_IMAGE_RATIO_02 34528 10.08 16.69 7.32 37 BAYES_60 32469 6.57 5.81 6.88 38 T_XMDrugObfuBody_14 32367 7.61 9.41 6.86 39 XM_Evil_Numbers_Gen 31994 9.10 14.64 6.78 40 ANY_BOUNCE_MESSAGE 30058 4.83 1.15 6.37 41 BOUNCE_MESSAGE 30053 4.83 1.14 6.37 42 BAYES_00 29735 4.96 1.74 6.30 43 FSL_BULK_SIG 29102 8.17 12.98 6.17 44 TR_DCC_Bayes_99 26014 13.96 34.23 5.51 45 RCVD_IN_IADB_LISTED 25356 4.45 2.23 5.38 46 TooManyTo_004 25078 4.12 1.25 5.32 47 XM_B_Phish_Phrases 23439 6.41 9.88 4.97 48 XM_H_Long_From01 22855 5.84 8.22 4.85 49 BOTNET_IPINHOSTNAME 22801 7.29 13.17 4.83 50 DKIM_INVALID 22098 4.84 5.22 4.68 51 RCVD_IN_IADB_SPF 21954 3.87 2.00 4.65 52 RCVD_IN_MSPIKE_H2 21797 4.30 3.53 4.62 53 RELAYCOUNTRY_META 21689 7.49 14.44 4.60 54 HTML_IMAGE_RATIO_04 21619 5.96 9.28 4.58 55 XM_SendGrid 21466 4.63 4.81 4.55 56 XM_PDF 21034 3.38 0.78 4.46 57 IN_ZIMBRA_NJ_WHITELIST 20971 3.15 0.03 4.45 58 T_REMOTE_IMAGE 20057 3.90 3.04 4.25 59 RCVD_IN_IADB_SENDERID 19209 3.43 1.89 4.07 60 XMSubMetaSx_00 19155 4.90 6.91 4.06 61 RCVD_IN_IADB_DK 18721 3.35 1.85 3.97 62 UNPARSEABLE_RELAY 18130 3.23 1.75 3.84 63 T_TooManySym_01 18025 3.39 2.35 3.82 64 BAYES_80 17788 4.81 7.30 3.77 65 TR_XM_DK_Bayes 17448 3.00 1.34 3.70 66 TooManyTo_005 17429 2.91 1.02 3.69 67 RCVD_IN_IADB_VOUCHED 17154 2.87 1.03 3.64 68 BAYES_40 16973 2.93 1.33 3.60 69 TVD_RCVD_IP 16760 2.60 0.31 3.55 70 XMStrtUSub 16145 3.95 5.23 3.42 71 TR_XM_DK_Bayes1 16074 2.77 1.25 3.41 72 XMNumbers 15649 3.67 4.53 3.32 73 MPART_ALT_DIFF 15431 4.74 8.25 3.27 74 XMSexyCombo_05 15269 5.56 11.14 3.24 75 FROM_EXCESS_BASE64 14771 4.61 8.16 3.13 76 TR_XM_DocInvoice 13976 4.32 7.59 2.96 77 XM_UncommonTLD01 13188 4.19 7.52 2.80 78 HTML_IMAGE_RATIO_06 13179 3.40 4.84 2.79 79 TR_XM_DK_Bayes2 13109 2.30 1.14 2.78 80 MIME_HTML_MOSTLY 12664 3.41 5.15 2.68 81 BAYES_95 12584 3.21 4.51 2.67 82 BAYES_20 11548 2.05 1.10 2.45 83 RCVD_IN_IADB_OPTIN 10972 1.84 0.66 2.33 84 HTML_MIME_NO_HTML_TAG 10179 2.28 2.56 2.16 85 MAILING_LIST_MULTI 9785 1.84 1.27 2.07 86 RCVD_IN_MSPIKE_WL 9625 1.64 0.68 2.04 87 RCVD_IN_MSPIKE_H3 9621 1.64 0.68 2.04 88 XM_DIRTYINTL 8682 2.43 3.83 1.84 89 TR_Symld_Words 8455 1.59 1.09 1.79 90 HTML_IMAGE_RATIO_08 8339 2.10 2.90 1.77 91 XM_DK_Undo_01 8088 1.67 1.57 1.71 92 T_TooManySym_02 8002 1.41 0.71 1.70 93 SUBJ_ALL_CAPS 7909 1.96 2.63 1.68 94 IN_HORDE_ADDRESS_BOOK 7674 1.17 0.07 1.63 95 URI_HEX 7559 2.09 3.25 1.60 96 HELO_NODOT 7475 1.20 0.26 1.58 97 XM_SPF_SoftFail 7430 2.07 3.26 1.58 98 BAYES_05 7220 1.27 0.65 1.53 99 USER_IN_DEF_DKIM_WL 7112 1.08 0.06 1.51 100 INVALID_MSGID 7088 1.22 0.54 1.50 101 TO_MALFORMED 6912 1.04 0.02 1.47 102 XMDiploma_00 6797 1.80 2.67 1.44 103 XMPhish11 6673 1.44 1.49 1.41 104 T_XMDrugObfuBody_08 6605 1.93 3.19 1.40 105 UNTRUSTED_Relay 6289 3.48 8.64 1.33 106 URI_TRY_3LD 6246 1.55 2.10 1.32 107 XM_CamelCaseFrm001 6210 1.87 3.20 1.32 108 XM_OfRef6 6074 1.69 2.64 1.29 109 RELAYCOUNTRY_CA 5938 1.81 3.14 1.26 110 MIME_HTML_ONLY_MULTI 5932 1.92 3.50 1.26 111 XMCapTrack 5850 1.05 0.59 1.24 112 XM_ProductURIs 5798 1.33 1.59 1.23 113 XM_GoogleGroups 5470 0.95 0.43 1.16 114 XMStockSpam_06 5358 1.22 1.44 1.14 115 XM_ShortIntro_01 4973 0.87 0.43 1.05 116 XM_H_PHPOS 4954 1.02 0.95 1.05 117 DKIM_ADSP_CUSTOM_MED 4875 1.00 0.90 1.03 118 XMLngstWrd_00 4725 0.85 0.50 1.00 119 BOTNET 4461 4.16 11.88 0.95 120 RELAYCOUNTRY_GB 4266 0.91 0.93 0.90 121 XMLngstWrd_01 4116 0.75 0.46 0.87 122 T_FILL_THIS_FORM_SHORT 4068 0.93 1.08 0.86 123 XMGappySubj_01 4052 0.74 0.46 0.86 124 XMGenDplmaNmb 4045 1.15 1.86 0.86 125 T_XMDrugObfuBody_00 3868 0.94 1.23 0.82 126 XM_UB50 3718 1.70 3.88 0.79 127 NML_ADSP_CUSTOM_MED 3587 0.77 0.78 0.76 128 TR_XM_RelayPhish 3585 1.07 1.83 0.76 129 TM2_M_VERY_LONG_WORD 3491 0.94 1.42 0.74 130 USER_IN_WHITELIST 3461 0.52 0.00 0.73 131 XMBdyGiftCard01 3387 1.19 2.34 0.72 132 XMSexyCombo_01 3350 0.98 1.61 0.71 133 XM_H_Long_From02 3329 0.99 1.66 0.71 134 T_TooManySym_03 3211 0.51 0.10 0.68 135 URIBL_DBL_ABUSE_SPAM 3075 0.50 0.13 0.65 136 XMNoVowels 3012 0.58 0.46 0.64 137 XMHTMLBadTable_001 2845 0.71 0.97 0.60 138 SpammyFromTLD_01 2834 0.85 1.46 0.60 139 XM_RXBody 2786 0.88 1.56 0.59 140 XM_H_PHPMailer 2762 0.63 0.74 0.59 141 LOW_PRICE 2761 0.58 0.55 0.59 142 TR_MetaPhish_Combo_01 2751 0.62 0.70 0.58 143 XMSubMetaSxObfu_02 2726 0.51 0.34 0.58 144 MISSING_HEADERS 2669 0.50 0.34 0.57 145 NO_DNS_FOR_FROM 2623 0.57 0.61 0.56 146 T_XMHurry_00 2613 0.89 1.69 0.55 147 T_OBFU_PDF_ATTACH 2606 0.45 0.21 0.55 148 KHOP_DYNAMIC 2594 0.61 0.75 0.55 149 XMLngstWrd_02 2584 0.50 0.37 0.55 150 XM_D_tchamptons_WL 2455 0.37 0.00 0.52 151 HTML_TAG_BALANCE_BODY 2371 0.62 0.91 0.50 152 TM2_M_A_HREF_HREF 2321 0.62 0.93 0.49 153 DKIM_ADSP_NXDOMAIN 2304 0.49 0.48 0.49 154 T_Symld_Words_02 2298 0.63 0.98 0.49 155 XMBody_95 2267 0.39 0.19 0.48 156 RELAYCOUNTRY_DE 2260 0.63 0.98 0.48 157 PLING_QUERY 2255 0.51 0.59 0.48 158 T_MANY_PILL_PRICE 2208 0.34 0.03 0.47 159 URI_NOVOWEL 2198 0.55 0.76 0.47 160 XMGappySubj_02 2186 0.35 0.07 0.46 161 XMBrknScrpt_02 2156 0.56 0.79 0.46 162 FILL_THIS_FORM 2145 0.58 0.87 0.45 163 FORGED_GMAIL_RCVD 2112 0.53 0.73 0.45 164 XMMoneyMeta_00 2062 0.56 0.87 0.44 165 XMDateMe_00 2061 0.39 0.29 0.44 166 XM_Combo_Sbj 2042 0.81 1.72 0.43 167 XMBody_78 2028 0.62 1.07 0.43 168 XMSubMetaSxObfu_03 1984 0.47 0.58 0.42 169 RELAYCOUNTRY_AU 1948 0.48 0.64 0.41 170 TM2_M_BODY_EMPTY 1943 0.32 0.11 0.41 171 MPART_ALT_DIFF_COUNT 1936 0.54 0.85 0.41 172 HTML_IMAGE_ONLY_32 1935 0.41 0.40 0.41 173 SHORT_HELO_AND_INLINE_IMAGE 1930 0.30 0.05 0.41 174 RDNS_DYNAMIC 1897 0.56 0.94 0.40 175 HTTPS_HTTP_MISMATCH 1872 0.52 0.81 0.40 176 XMPhish30 1866 0.58 1.01 0.40 177 XMSubMetaI_00 1866 0.78 1.69 0.40 178 XM_B_COPY_HTML 1849 0.54 0.88 0.39 179 XMRcvdHeader_15 1825 0.27 0.00 0.39 180 RCVD_IN_SORBS_DUL 1793 0.32 0.17 0.38 181 HTML_FONT_FACE_BAD 1775 0.59 1.11 0.38 182 HTML_IMAGE_ONLY_16 1773 0.40 0.47 0.38 183 T_FILL_THIS_FORM_LONG 1752 0.50 0.80 0.37 184 HTML_IMAGE_ONLY_20 1706 0.33 0.25 0.36 185 HTML_IMAGE_ONLY_28 1698 0.36 0.38 0.36 186 FILL_THIS_FORM_LOAN 1671 0.45 0.67 0.35 187 XMSubNoVowel 1641 0.35 0.35 0.35 188 SpammyFromTLD_02 1632 0.75 1.72 0.35 189 XM_B_REG_HTML 1619 0.54 1.01 0.34 190 XMHTML_After_End 1616 0.56 1.09 0.34 191 XMLngstWrd_03 1605 0.32 0.28 0.34 192 XMBody_17 1598 0.74 1.72 0.34 193 AC_DIV_BONANZA 1579 0.27 0.12 0.33 194 TR_Orig_Subnet 1539 0.27 0.12 0.33 195 HTML_IMAGE_ONLY_24 1519 0.33 0.34 0.32 196 XM_H_PHPOS_M 1452 0.33 0.40 0.31 197 XM_B_TRADE_HTML 1434 0.31 0.33 0.30 198 RCVD_IN_BL_SPAMCOP_NET 1413 1.27 3.59 0.30 199 TVD_SPACE_RATIO 1372 0.37 0.55 0.29 200 THIS_AD 1351 0.31 0.37 0.29 ----------------------------------------------------------------------