Email: 591779 Autolearn: 0 AvgScore: 4.13 AvgScanTime: 4.14 sec Spam: 194112 Autolearn: 0 AvgScore: 12.40 AvgScanTime: 4.88 sec Ham: 397667 Autolearn: 0 AvgScore: 0.09 AvgScanTime: 3.77 sec Time Spent Running SA: 680.31 hours Time Spent Processing Spam: 263.31 hours Time Spent Processing Ham: 416.99 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 185536 89.98 95.58 87.24 2 DKIM_SIGNED 169770 76.22 87.46 70.73 3 XM_DK_Pass 166035 74.73 85.54 69.46 4 DKIM_VALID 159413 71.44 82.12 66.22 5 DCC_CHECK 151115 50.09 77.85 36.53 6 XMListUnsubscribeExists 138535 55.25 71.37 47.39 7 DKIM_VALID_AU 124321 52.61 64.05 47.03 8 XM_H_QuotedFrom 105192 39.85 54.19 32.85 9 XM_DK_Undo_02 100875 27.37 51.97 15.37 10 BAYES_99 89504 25.14 46.11 14.90 11 BAYES_999 74890 21.38 38.58 12.98 12 HTML_FONT_LOW_CONTRAST 73002 31.05 37.61 27.85 13 LOC_TINY_FONT_1 70554 26.97 36.35 22.40 14 TR_DCC_Bayes_99 69505 16.59 35.81 7.20 15 BAYES_50 60212 48.04 31.02 56.34 16 MIME_HTML_ONLY 60058 22.54 30.94 18.44 17 FVGT_m_MULTI_ODD 55052 24.36 28.36 22.41 18 XMSubLong 51967 21.56 26.77 19.02 19 DKIM_VALID_EF 48562 26.04 25.02 26.54 20 T_TM2_M_HEADER_IN_MSG 41108 25.31 21.18 27.32 21 T_KAM_HTML_FONT_INVALID 40833 17.14 21.04 15.24 22 DCC_CHECK_NEGATIVE 40441 48.13 20.83 61.45 23 XM_Body_Dirty_Words 36920 13.33 19.02 10.56 24 HTML_IMAGE_RATIO_02 33954 10.98 17.49 7.80 25 XM_Multi_Part_URI 33886 13.56 17.46 11.66 26 RELAYCOUNTRY_META 30929 8.25 15.93 4.50 27 MultiRelay 29522 16.00 15.21 16.38 28 XM_Evil_Numbers_Gen 28347 9.72 14.60 7.33 29 BOTNET 26637 5.22 13.72 1.08 30 BOTNET_IPINHOSTNAME 25238 8.08 13.00 5.68 31 LOTS_OF_MONEY 24712 9.81 12.73 8.38 32 FSL_BULK_SIG 24559 8.90 12.65 7.07 33 XMSexyCombo_05 20779 5.55 10.70 3.03 34 UNTRUSTED_Relay 19058 3.98 9.82 1.13 35 XM_B_Phish_Phrases 18950 7.03 9.76 5.69 36 T_XMDrugObfuBody_14 18448 7.91 9.50 7.14 37 HTML_IMAGE_RATIO_04 18282 6.50 9.42 5.08 38 XM_H_Long_From01 16152 6.51 8.32 5.62 39 BAYES_80 15514 5.90 7.99 4.88 40 TR_XM_DocInvoice 15447 4.72 7.96 3.14 41 MPART_ALT_DIFF 15365 4.41 7.92 2.70 42 TooManyTo_001 14977 7.30 7.72 7.09 43 XMSubMetaSx_00 14916 5.17 7.68 3.94 44 LotsOfNums_01 14159 8.77 7.29 9.48 45 BAYES_60 12511 8.48 6.45 9.47 46 XM_UncommonTLD01 11694 4.29 6.02 3.45 47 FROM_EXCESS_BASE64 11691 4.37 6.02 3.57 48 RCVD_IN_RP_SAFE 11459 8.62 5.90 9.95 49 MIME_HTML_MOSTLY 10418 3.30 5.37 2.28 50 DKIM_INVALID 10357 4.78 5.34 4.51 51 HTML_IMAGE_RATIO_06 10042 4.44 5.17 4.09 52 XMNumbers 9892 4.09 5.10 3.60 53 RCVD_IN_RP_CERTIFIED 9444 8.00 4.87 9.53 54 XM_SendGrid 9259 4.70 4.77 4.67 55 XM_UB50 9157 2.06 4.72 0.76 56 BAYES_95 8824 3.81 4.55 3.46 57 T_TooManySym_01 7470 4.28 3.85 4.49 58 MIME_QP_LONG_LINE 7411 5.02 3.82 5.61 59 RCVD_IN_MSPIKE_H2 7359 4.66 3.79 5.08 60 T_REMOTE_IMAGE 7177 4.10 3.70 4.29 61 TM2_M_URI_OPT_OUT 7157 2.33 3.69 1.67 62 XM_DIRTYINTL 7146 2.39 3.68 1.76 63 XMStrtUSub 6966 3.77 3.59 3.86 64 RELAYCOUNTRY_CA 6907 2.10 3.56 1.39 65 XM_SPF_SoftFail 6578 2.18 3.39 1.59 66 MIME_HTML_ONLY_MULTI 6385 1.89 3.29 1.20 67 XM_CamelCaseFrm001 6057 2.07 3.12 1.56 68 URI_HEX 5988 2.16 3.08 1.71 69 BOTNET_NORDNS 5784 0.99 2.98 0.02 70 XM_OfRef6 5461 1.80 2.81 1.31 71 RCVD_IN_BL_SPAMCOP_NET 5197 1.16 2.68 0.42 72 T_XMDrugObfuBody_08 5195 1.92 2.68 1.56 73 HTML_MIME_NO_HTML_TAG 4958 2.61 2.55 2.64 74 HTML_IMAGE_RATIO_08 4922 2.13 2.54 1.94 75 XMStockSpam_06 4920 1.44 2.53 0.91 76 SpammyFromTLD_02 4914 1.09 2.53 0.39 77 RCVD_IN_IADB_LISTED 4672 5.00 2.41 6.27 78 RCVD_IN_RP_RNBL 4589 0.81 2.36 0.05 79 XM_URI_RBL 4534 0.87 2.34 0.16 80 XM_DK_Undo_01 4456 2.11 2.30 2.01 81 XMDiploma_00 4441 1.72 2.29 1.44 82 MultiRelay_CC 4291 0.82 2.21 0.14 83 MultiRelay_Combo 4291 0.82 2.21 0.14 84 XMSubNoVowel 4144 1.93 2.13 1.82 85 XMBdyGiftCard01 4136 1.26 2.13 0.83 86 RCVD_IN_IADB_SPF 4120 4.38 2.12 5.48 87 UNPARSEABLE_RELAY 3985 3.87 2.05 4.76 88 URI_TRY_3LD 3959 1.72 2.04 1.56 89 TR_LOTS_OF_MONEY2 3888 0.92 2.00 0.39 90 T_MONEY_PERCENT 3888 0.92 2.00 0.39 91 XM_ProductURIs 3850 1.26 1.98 0.91 92 RCVD_IN_IADB_SENDERID 3844 3.91 1.98 4.86 93 SUBJ_ALL_CAPS 3806 1.58 1.96 1.40 94 RCVD_IN_IADB_DK 3775 3.83 1.94 4.76 95 XM_RXBody 3763 0.74 1.94 0.15 96 ALL_TRUSTED 3715 14.77 1.91 21.05 97 LongTLD 3691 0.72 1.90 0.15 98 RELAYCOUNTRY_IN 3599 0.68 1.85 0.11 99 XMSubMetaI_00 3549 0.87 1.83 0.41 100 XM_UB60 3282 0.62 1.69 0.10 101 LOW_PRICE 3269 0.74 1.68 0.28 102 XMSexyCombo_01 3087 0.77 1.59 0.37 103 URIBL_BLACK 3072 0.54 1.58 0.04 104 TM2_M_VERY_LONG_WORD 3042 1.06 1.57 0.81 105 XM_H_Long_From02 2932 1.02 1.51 0.78 106 MAILING_LIST_MULTI 2888 1.89 1.49 2.08 107 FORGED_MUA_MOZILLA 2848 0.50 1.47 0.03 108 SUBJ_DOLLARS 2818 0.78 1.45 0.45 109 T_TooManySym_02 2761 1.65 1.42 1.76 110 XMGenDplmaNmb 2753 1.09 1.42 0.93 111 XM_UB99 2720 0.47 1.40 0.02 112 TR_XM_RelayPhish 2593 0.74 1.34 0.44 113 SpammyFromTLD_01 2578 0.96 1.33 0.78 114 XMBody_17 2572 0.69 1.33 0.37 115 ANY_BOUNCE_MESSAGE 2524 5.56 1.30 7.64 116 XMHTML_After_End 2519 0.69 1.30 0.39 117 BOUNCE_MESSAGE 2519 5.56 1.30 7.64 118 XMPhish11 2474 1.21 1.27 1.17 119 BAYES_00 2428 3.87 1.25 5.15 120 BAYES_40 2427 2.18 1.25 2.63 121 XMEmptySub 2408 0.48 1.24 0.11 122 URI_NOVOWEL 2365 0.78 1.22 0.56 123 RELAYCOUNTRY_CN 2361 0.43 1.22 0.04 124 URIBL_DBL_SPAM 2339 0.42 1.20 0.03 125 KHOP_DYNAMIC 2266 0.76 1.17 0.56 126 RCVD_IN_IADB_VOUCHED 2266 3.07 1.17 4.01 127 T_XMHurry_00 2259 0.79 1.16 0.61 128 XMHTMLBadTable_001 2249 0.67 1.16 0.43 129 TooManyTo_002 2226 1.89 1.15 2.26 130 XM_H_PHPOS 2196 1.61 1.13 1.84 131 T_XMDrugObfuBody_00 2171 0.94 1.12 0.85 132 XMSubMetaSxObfu_03 2151 0.66 1.11 0.45 133 HTML_TAG_BALANCE_BODY 2145 0.74 1.11 0.56 134 XM_HighProb1 2131 0.37 1.10 0.02 135 TR_Symld_Words 2121 1.50 1.09 1.70 136 XMPhish30 2068 0.56 1.07 0.31 137 DIET_1 2068 0.54 1.07 0.28 138 XM_B_REG_HTML 2026 0.60 1.04 0.38 139 XMSubMetaSSx_00 2016 0.47 1.04 0.19 140 T_HTML_TAG_BALANCE_CENTER 2014 0.46 1.04 0.17 141 T_Symld_Words_02 2010 0.59 1.04 0.38 142 TR_XM_DK_Bayes 2010 2.59 1.04 3.35 143 XM_DKIMWhitelistDomains 2008 8.87 1.03 12.69 144 TR_LOTS_OF_MONEY3 2005 0.54 1.03 0.31 145 TooManyTo_003 2002 1.39 1.03 1.57 146 XMAntiAgingB 1995 0.40 1.03 0.09 147 T_MANY_PILL_PRICE 1974 0.38 1.02 0.07 148 T_FILL_THIS_FORM_SHORT 1971 0.83 1.02 0.73 149 RELAYCOUNTRY_FR 1950 0.47 1.00 0.21 150 XM_UB999 1934 0.33 1.00 0.01 151 REMOVE_BEFORE_LINK 1934 0.53 1.00 0.31 152 NO_DNS_FOR_FROM 1886 0.76 0.97 0.66 153 MPART_ALT_DIFF_COUNT 1875 0.51 0.97 0.28 154 TR_XM_DK_Bayes1 1835 2.43 0.95 3.16 155 XMBody_78 1820 0.53 0.94 0.32 156 RELAYCOUNTRY_GB 1783 0.91 0.92 0.90 157 TR_XM_DK_Bayes2 1761 2.11 0.91 2.70 158 RCVD_IN_PSBL 1749 0.34 0.90 0.06 159 XMSlimDrugH 1742 0.49 0.90 0.29 160 TooManyTo_004 1726 1.07 0.89 1.15 161 HTML_FONT_FACE_BAD 1702 0.63 0.88 0.50 162 XM_B_COPY_HTML 1677 0.61 0.86 0.48 163 BODY_URI_ONLY 1670 0.37 0.86 0.12 164 BAYES_20 1644 1.50 0.85 1.82 165 RELAYCOUNTRY_AT 1621 0.34 0.84 0.10 166 MISSING_HEADERS 1596 1.57 0.82 1.94 167 TooManyTo_005 1579 0.88 0.81 0.91 168 XMPhish14 1572 0.56 0.81 0.44 169 XM_UB80 1539 0.29 0.79 0.05 170 HTTPS_HTTP_MISMATCH 1526 0.54 0.79 0.42 171 TR_Caps_n_Bayes_99 1521 0.30 0.78 0.06 172 RDNS_DYNAMIC 1505 0.54 0.78 0.43 173 LONG_JUNK_URI 1480 0.28 0.76 0.04 174 DKIM_ADSP_CUSTOM_MED 1452 0.95 0.75 1.05 175 TR_Mismatch_TLD_02 1446 0.31 0.74 0.10 176 DKIM_ADSP_NXDOMAIN 1440 0.51 0.74 0.40 177 INVALID_DATE 1429 0.29 0.74 0.07 178 HTML_FONT_SIZE_HUGE 1418 0.35 0.73 0.16 179 RCVD_IN_IADB_OPTIN 1386 1.91 0.71 2.49 180 XM_PDF 1383 3.38 0.71 4.68 181 XM_BadFromFormat 1374 0.35 0.71 0.18 182 XMCapTrack 1368 1.02 0.70 1.17 183 HTML_IMAGE_ONLY_20 1363 0.41 0.70 0.26 184 REPLYTO_WITHOUT_TO_CC 1345 1.21 0.69 1.46 185 XM_Body_Obfu01 1335 0.37 0.69 0.21 186 RCVD_IN_MSPIKE_WL 1318 1.77 0.68 2.31 187 FILL_THIS_FORM 1314 0.48 0.68 0.39 188 TVD_SPACE_RATIO_MINFP 1308 0.23 0.67 0.01 189 DATE_IN_PAST_03_06 1304 0.29 0.67 0.10 190 RCVD_IN_MSPIKE_H3 1302 1.77 0.67 2.31 191 TR_MetaPhish_Combo_01 1298 0.65 0.67 0.63 192 PLING_QUERY 1295 0.51 0.67 0.43 193 XM_H_PHPMailer 1282 1.04 0.66 1.23 194 HTML_SHORT_LINK_IMG_1 1276 0.24 0.66 0.03 195 HTML_IMAGE_ONLY_08 1265 0.30 0.65 0.13 196 LONG_JUNK_URI3 1260 0.23 0.65 0.02 197 XMSexyCombo_04 1256 0.25 0.65 0.05 198 HTML_FONT_SIZE_LARGE 1241 0.35 0.64 0.20 199 XMBounce_01 1237 0.32 0.64 0.16 200 NML_ADSP_CUSTOM_MED 1229 0.69 0.63 0.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 346939 89.98 95.58 87.24 2 DKIM_SIGNED 281274 76.22 87.46 70.73 3 XM_DK_Pass 276228 74.73 85.54 69.46 4 DKIM_VALID 263341 71.44 82.12 66.22 5 DCC_CHECK_NEGATIVE 244356 48.13 20.83 61.45 6 BAYES_50 224065 48.04 31.02 56.34 7 XMListUnsubscribeExists 188444 55.25 71.37 47.39 8 DKIM_VALID_AU 187020 52.61 64.05 47.03 9 DCC_CHECK 145282 50.09 77.85 36.53 10 XM_H_QuotedFrom 130653 39.85 54.19 32.85 11 HTML_FONT_LOW_CONTRAST 110756 31.05 37.61 27.85 12 T_TM2_M_HEADER_IN_MSG 108654 25.31 21.18 27.32 13 DKIM_VALID_EF 105528 26.04 25.02 26.54 14 FVGT_m_MULTI_ODD 89117 24.36 28.36 22.41 15 LOC_TINY_FONT_1 89058 26.97 36.35 22.40 16 ALL_TRUSTED 83712 14.77 1.91 21.05 17 XMSubLong 75634 21.56 26.77 19.02 18 MIME_HTML_ONLY 73314 22.54 30.94 18.44 19 MultiRelay 65141 16.00 15.21 16.38 20 XM_DK_Undo_02 61105 27.37 51.97 15.37 21 T_KAM_HTML_FONT_INVALID 60606 17.14 21.04 15.24 22 BAYES_99 59257 25.14 46.11 14.90 23 BAYES_999 51620 21.38 38.58 12.98 24 XM_DKIMWhitelistDomains 50482 8.87 1.03 12.69 25 XM_Multi_Part_URI 46387 13.56 17.46 11.66 26 XM_Body_Dirty_Words 41990 13.33 19.02 10.56 27 RCVD_IN_RP_SAFE 39548 8.62 5.90 9.95 28 RCVD_IN_RP_CERTIFIED 37905 8.00 4.87 9.53 29 LotsOfNums_01 37714 8.77 7.29 9.48 30 BAYES_60 37643 8.48 6.45 9.47 31 LOTS_OF_MONEY 33325 9.81 12.73 8.38 32 HTML_IMAGE_RATIO_02 31012 10.98 17.49 7.80 33 BOUNCE_MESSAGE 30365 5.56 1.30 7.64 34 ANY_BOUNCE_MESSAGE 30365 5.56 1.30 7.64 35 XM_Evil_Numbers_Gen 29150 9.72 14.60 7.33 36 TR_DCC_Bayes_99 28644 16.59 35.81 7.20 37 T_XMDrugObfuBody_14 28388 7.91 9.50 7.14 38 TooManyTo_001 28194 7.30 7.72 7.09 39 FSL_BULK_SIG 28109 8.90 12.65 7.07 40 RCVD_IN_IADB_LISTED 24924 5.00 2.41 6.27 41 XM_B_Phish_Phrases 22637 7.03 9.76 5.69 42 BOTNET_IPINHOSTNAME 22607 8.08 13.00 5.68 43 XM_H_Long_From01 22361 6.51 8.32 5.62 44 MIME_QP_LONG_LINE 22300 5.02 3.82 5.61 45 RCVD_IN_IADB_SPF 21794 4.38 2.12 5.48 46 BAYES_00 20492 3.87 1.25 5.15 47 RCVD_IN_MSPIKE_H2 20204 4.66 3.79 5.08 48 HTML_IMAGE_RATIO_04 20183 6.50 9.42 5.08 49 BAYES_80 19421 5.90 7.99 4.88 50 RCVD_IN_IADB_SENDERID 19316 3.91 1.98 4.86 51 RCVD_IN_IADB_DK 18918 3.83 1.94 4.76 52 UNPARSEABLE_RELAY 18917 3.87 2.05 4.76 53 XM_PDF 18615 3.38 0.71 4.68 54 XM_SendGrid 18576 4.70 4.77 4.67 55 DKIM_INVALID 17933 4.78 5.34 4.51 56 RELAYCOUNTRY_META 17890 8.25 15.93 4.50 57 T_TooManySym_01 17837 4.28 3.85 4.49 58 T_REMOTE_IMAGE 17065 4.10 3.70 4.29 59 TVD_RCVD_IP 16649 2.90 0.25 4.19 60 HTML_IMAGE_RATIO_06 16253 4.44 5.17 4.09 61 RCVD_IN_IADB_VOUCHED 15929 3.07 1.17 4.01 62 XMSubMetaSx_00 15672 5.17 7.68 3.94 63 XMStrtUSub 15348 3.77 3.59 3.86 64 IN_ZIMBRA_NJ_WHITELIST 14964 2.54 0.02 3.76 65 XMNumbers 14330 4.09 5.10 3.60 66 FROM_EXCESS_BASE64 14185 4.37 6.02 3.57 67 BAYES_95 13745 3.81 4.55 3.46 68 XM_UncommonTLD01 13721 4.29 6.02 3.45 69 TR_XM_DK_Bayes 13309 2.59 1.04 3.35 70 TR_XM_DK_Bayes1 12560 2.43 0.95 3.16 71 TR_XM_DocInvoice 12490 4.72 7.96 3.14 72 XMSexyCombo_05 12052 5.55 10.70 3.03 73 MPART_ALT_DIFF 10751 4.41 7.92 2.70 74 TR_XM_DK_Bayes2 10735 2.11 0.91 2.70 75 HTML_MIME_NO_HTML_TAG 10496 2.61 2.55 2.64 76 BAYES_40 10445 2.18 1.25 2.63 77 RCVD_IN_IADB_OPTIN 9911 1.91 0.71 2.49 78 RCVD_IN_MSPIKE_WL 9180 1.77 0.68 2.31 79 RCVD_IN_MSPIKE_H3 9175 1.77 0.67 2.31 80 MIME_HTML_MOSTLY 9083 3.30 5.37 2.28 81 TooManyTo_002 8975 1.89 1.15 2.26 82 MAILING_LIST_MULTI 8278 1.89 1.49 2.08 83 XM_DK_Undo_01 8004 2.11 2.30 2.01 84 HTML_IMAGE_RATIO_08 7703 2.13 2.54 1.94 85 MISSING_HEADERS 7703 1.57 0.82 1.94 86 IN_HORDE_ADDRESS_BOOK 7342 1.27 0.09 1.85 87 XM_H_PHPOS 7335 1.61 1.13 1.84 88 XMSubNoVowel 7254 1.93 2.13 1.82 89 BAYES_20 7238 1.50 0.85 1.82 90 T_TooManySym_02 7014 1.65 1.42 1.76 91 XM_DIRTYINTL 6991 2.39 3.68 1.76 92 XMSubEmpty 6969 1.37 0.57 1.75 93 INVALID_MSGID 6937 1.26 0.25 1.74 94 URI_HEX 6798 2.16 3.08 1.71 95 TR_Symld_Words 6762 1.50 1.09 1.70 96 TM2_M_URI_OPT_OUT 6624 2.33 3.69 1.67 97 USER_IN_DEF_DKIM_WL 6489 1.12 0.08 1.63 98 TO_MALFORMED 6363 1.08 0.01 1.60 99 XM_SPF_SoftFail 6327 2.18 3.39 1.59 100 TooManyTo_003 6235 1.39 1.03 1.57 101 XM_CamelCaseFrm001 6213 2.07 3.12 1.56 102 URI_TRY_3LD 6194 1.72 2.04 1.56 103 T_XMDrugObfuBody_08 6184 1.92 2.68 1.56 104 REPLYTO_WITHOUT_TO_CC 5821 1.21 0.69 1.46 105 XMLngstWrd_00 5808 1.19 0.62 1.46 106 XMDiploma_00 5745 1.72 2.29 1.44 107 HELO_NODOT 5696 1.04 0.23 1.43 108 SUBJ_ALL_CAPS 5553 1.58 1.96 1.40 109 RELAYCOUNTRY_CA 5536 2.10 3.56 1.39 110 XM_OfRef6 5196 1.80 2.81 1.31 111 XMLngstWrd_01 5029 1.03 0.56 1.26 112 BAYES_05 5006 1.01 0.50 1.26 113 XM_GoogleGroups 4892 1.00 0.54 1.23 114 XM_H_PHPMailer 4878 1.04 0.66 1.23 115 MIME_HTML_ONLY_MULTI 4783 1.89 3.29 1.20 116 XMCapTrack 4661 1.02 0.70 1.17 117 XMPhish11 4657 1.21 1.27 1.17 118 TooManyTo_004 4581 1.07 0.89 1.15 119 UNTRUSTED_Relay 4504 3.98 9.82 1.13 120 BOTNET 4275 5.22 13.72 1.08 121 DKIM_ADSP_CUSTOM_MED 4183 0.95 0.75 1.05 122 XMGappySubj_01 3940 0.83 0.49 0.99 123 XM_H_PHPOS_M 3751 0.78 0.44 0.94 124 XMGenDplmaNmb 3705 1.09 1.42 0.93 125 XMStockSpam_06 3626 1.44 2.53 0.91 126 TooManyTo_005 3605 0.88 0.81 0.91 127 XM_ProductURIs 3605 1.26 1.98 0.91 128 RELAYCOUNTRY_GB 3598 0.91 0.92 0.90 129 T_XMDrugObfuBody_00 3377 0.94 1.12 0.85 130 XMBdyGiftCard01 3291 1.26 2.13 0.83 131 TM2_M_VERY_LONG_WORD 3235 1.06 1.57 0.81 132 XM_H_Long_From02 3090 1.02 1.51 0.78 133 SpammyFromTLD_01 3087 0.96 1.33 0.78 134 XM_UB50 3041 2.06 4.72 0.76 135 XMBody_95 3009 0.57 0.19 0.76 136 XMLngstWrd_02 2919 0.63 0.42 0.73 137 T_FILL_THIS_FORM_SHORT 2913 0.83 1.02 0.73 138 XMNoVowels 2907 0.63 0.42 0.73 139 USER_IN_WHITELIST 2884 0.49 0.00 0.73 140 NML_ADSP_CUSTOM_MED 2851 0.69 0.63 0.72 141 XMSubMetaSxObfu_02 2624 0.55 0.34 0.66 142 NO_DNS_FOR_FROM 2619 0.76 0.97 0.66 143 XMMoneyMeta_00 2602 0.64 0.60 0.65 144 T_TooManySym_03 2560 0.64 0.62 0.64 145 TR_MetaPhish_Combo_01 2523 0.65 0.67 0.63 146 T_XMHurry_00 2419 0.79 1.16 0.61 147 XMGappySubj_02 2350 0.45 0.15 0.59 148 KHOP_DYNAMIC 2244 0.76 1.17 0.56 149 URI_NOVOWEL 2223 0.78 1.22 0.56 150 HTML_TAG_BALANCE_BODY 2209 0.74 1.11 0.56 151 TM2_M_A_HREF_HREF 2110 0.52 0.48 0.53 152 FORGED_GMAIL_RCVD 2108 0.55 0.59 0.53 153 HTML_FONT_FACE_BAD 2004 0.63 0.88 0.50 154 T_OBFU_PDF_ATTACH 1957 0.38 0.14 0.49 155 XM_B_COPY_HTML 1926 0.61 0.86 0.48 156 AC_DIV_BONANZA 1872 0.35 0.12 0.47 157 T_HTML_ATTACH 1859 0.34 0.09 0.47 158 XMBrknScrpt_02 1803 0.48 0.54 0.45 159 SUBJ_DOLLARS 1802 0.78 1.45 0.45 160 XMSubMetaSxObfu_03 1775 0.66 1.11 0.45 161 XM_ShortIntro_01 1767 0.42 0.38 0.44 162 TR_XM_RelayPhish 1760 0.74 1.34 0.44 163 XMPhish14 1732 0.56 0.81 0.44 164 XMHTMLBadTable_001 1722 0.67 1.16 0.43 165 RDNS_DYNAMIC 1707 0.54 0.78 0.43 166 PLING_QUERY 1698 0.51 0.67 0.43 167 RELAYCOUNTRY_DE 1687 0.47 0.57 0.42 168 HTTPS_HTTP_MISMATCH 1679 0.54 0.79 0.42 169 XMDateMe_00 1668 0.37 0.26 0.42 170 RCVD_IN_BL_SPAMCOP_NET 1665 1.16 2.68 0.42 171 XMLngstWrd_03 1662 0.35 0.22 0.42 172 TM2_M_BODY_EMPTY 1649 0.33 0.15 0.41 173 XM_D_tchamptons_WL 1635 0.28 0.01 0.41 174 XMSubMetaI_00 1615 0.87 1.83 0.41 175 DKIM_ADSP_NXDOMAIN 1597 0.51 0.74 0.40 176 HTML_IMAGE_ONLY_32 1585 0.35 0.24 0.40 177 SpammyFromTLD_02 1558 1.09 2.53 0.39 178 XMHTML_After_End 1546 0.69 1.30 0.39 179 FILL_THIS_FORM 1540 0.48 0.68 0.39 180 T_MONEY_PERCENT 1532 0.92 2.00 0.39 181 TR_LOTS_OF_MONEY2 1532 0.92 2.00 0.39 182 XM_B_REG_HTML 1514 0.60 1.04 0.38 183 T_Symld_Words_02 1509 0.59 1.04 0.38 184 HTML_IMAGE_ONLY_28 1502 0.42 0.51 0.38 185 XMBody_17 1485 0.69 1.33 0.37 186 XMSexyCombo_01 1483 0.77 1.59 0.37 187 RELAYCOUNTRY_AU 1456 0.45 0.63 0.37 188 RCVD_IN_SORBS_DUL 1408 0.32 0.25 0.35 189 SHORT_HELO_AND_INLINE_IMAGE 1391 0.25 0.05 0.35 190 XMRcvdHeader_15 1360 0.23 0.00 0.34 191 XMSolicitRefs_0 1355 0.36 0.39 0.34 192 HTML_IMAGE_ONLY_16 1307 0.29 0.20 0.33 193 XMBody_78 1288 0.53 0.94 0.32 194 TVD_SPACE_RATIO 1264 0.38 0.50 0.32 195 XMPhish30 1246 0.56 1.07 0.31 196 REMOVE_BEFORE_LINK 1228 0.53 1.00 0.31 197 TR_LOTS_OF_MONEY3 1217 0.54 1.03 0.31 198 T_FILL_THIS_FORM_LONG 1191 0.41 0.62 0.30 199 HTML_IMAGE_ONLY_24 1180 0.28 0.23 0.30 200 URIBL_SBL_A 1148 0.29 0.29 0.29 ----------------------------------------------------------------------