Email: 701173 Autolearn: 0 AvgScore: 11.01 AvgScanTime: 4.17 sec Spam: 260798 Autolearn: 0 AvgScore: 30.15 AvgScanTime: 4.61 sec Ham: 440375 Autolearn: 0 AvgScore: -0.33 AvgScanTime: 3.90 sec Time Spent Running SA: 811.67 hours Time Spent Processing Spam: 334.12 hours Time Spent Processing Ham: 477.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 248870 90.63 95.43 87.79 2 DCC_CHECK 208253 50.37 79.85 32.91 3 DKIM_SIGNED 182056 71.83 69.81 73.03 4 XM_DK_Pass 176153 70.12 67.54 71.65 5 DKIM_VALID 167018 66.04 64.04 67.22 6 XM_H_QuotedFrom 163829 45.01 62.82 34.46 7 XMListUnsubscribeExists 154355 52.08 59.19 47.87 8 DKIM_VALID_AU 133186 47.69 51.07 45.69 9 XM_DK_Undo_02 102307 23.62 39.23 14.37 10 T_TM2_M_HEADER_IN_MSG 91590 32.47 35.12 30.90 11 BAYES_99 90473 21.57 34.69 13.81 12 BAYES_50 90401 48.83 34.66 57.22 13 HTML_FONT_LOW_CONTRAST 83107 28.79 31.87 26.97 14 BAYES_999 76277 18.42 29.25 12.00 15 LOC_TINY_FONT_1 74809 23.91 28.68 21.08 16 FSL_BULK_SIG 69767 13.21 26.75 5.19 17 TR_DCC_Bayes_99 69549 13.90 26.67 6.34 18 MIME_HTML_ONLY 67528 21.66 25.89 19.16 19 FVGT_m_MULTI_ODD 59531 22.87 22.83 22.90 20 XMSubLong 56730 21.00 21.75 20.55 21 ALL_TRUSTED 53591 18.78 20.55 17.73 22 DKIM_VALID_EF 51327 24.48 19.68 27.33 23 XMPhish14 50013 7.41 19.18 0.45 24 DCC_CHECK_NEGATIVE 49416 47.74 18.95 64.79 25 TR_MetaPhish_Combo_01 48519 7.34 18.60 0.66 26 TR_Phish_OUT 47357 6.75 18.16 0.00 27 URI_WPADMIN 47329 6.75 18.15 0.00 28 TO_IN_SUBJ 46807 6.69 17.95 0.02 29 T_KAM_HTML_FONT_INVALID 42239 16.64 16.20 16.90 30 XM_Body_Dirty_Words 40697 12.94 15.60 11.36 31 BAYES_60 38405 10.11 14.73 7.37 32 XM_Multi_Part_URI 35390 11.73 13.57 10.64 33 HTML_IMAGE_RATIO_02 35387 9.87 13.57 7.68 34 MultiRelay 34484 16.78 13.22 18.88 35 RELAYCOUNTRY_META 32414 7.96 12.43 5.32 36 XM_Evil_Numbers_Gen 32086 9.48 12.30 7.81 37 BOTNET 30093 5.05 11.54 1.21 38 BOTNET_IPINHOSTNAME 30042 8.20 11.52 6.24 39 LOTS_OF_MONEY 26135 9.89 10.02 9.81 40 XMSexyCombo_05 22645 5.34 8.68 3.35 41 T_XMDrugObfuBody_14 22192 8.02 8.51 7.73 42 BAYES_80 21068 5.95 8.08 4.70 43 HTML_IMAGE_RATIO_04 20528 5.69 7.87 4.40 44 XM_B_Phish_Phrases 19849 6.01 7.61 5.06 45 UNTRUSTED_Relay 19474 3.55 7.47 1.24 46 XM_H_Long_From01 18262 6.18 7.00 5.70 47 MPART_ALT_DIFF 17320 4.23 6.64 2.81 48 FROM_EXCESS_BASE64 16845 4.61 6.46 3.52 49 TR_XM_DocInvoice 16124 4.80 6.18 3.99 50 XM_UncommonTLD01 15126 3.75 5.80 2.54 51 XMSubMetaSx_00 15065 4.52 5.78 3.78 52 DKIM_INVALID 15038 5.79 5.77 5.80 53 TooManyTo_001 14854 7.19 5.70 8.07 54 LotsOfNums_01 12936 7.56 4.96 9.10 55 RCVD_IN_RP_SAFE 11162 6.95 4.28 8.53 56 HTML_IMAGE_RATIO_06 11056 3.83 4.24 3.58 57 MIME_HTML_MOSTLY 10534 2.84 4.04 2.12 58 BAYES_95 10499 3.43 4.03 3.08 59 XM_SendGrid 9691 4.42 3.72 4.84 60 XMNumbers 9609 3.33 3.68 3.11 61 XM_UB50 9520 1.79 3.65 0.69 62 T_REMOTE_IMAGE 9435 4.18 3.62 4.51 63 HTML_IMAGE_RATIO_08 9246 2.64 3.55 2.11 64 RCVD_IN_RP_CERTIFIED 9073 6.44 3.48 8.19 65 XM_DIRTYINTL 8711 2.34 3.34 1.75 66 XMStrtUSub 8584 3.43 3.29 3.51 67 TM2_M_URI_OPT_OUT 8402 3.19 3.22 3.17 68 MIME_HTML_ONLY_MULTI 8015 1.98 3.07 1.33 69 XM_SPF_SoftFail 7868 2.24 3.02 1.79 70 RCVD_IN_MSPIKE_H2 7638 4.25 2.93 5.03 71 XM_CamelCaseFrm001 7071 2.00 2.71 1.58 72 URI_HEX 7068 2.03 2.71 1.63 73 SpammyFromTLD_02 6681 1.16 2.56 0.33 74 HTML_MIME_NO_HTML_TAG 6619 2.69 2.54 2.78 75 RELAYCOUNTRY_CA 6436 1.82 2.47 1.44 76 XM_OfRef6 6186 1.76 2.37 1.39 77 MIME_QP_LONG_LINE 6141 4.53 2.35 5.81 78 XM_URI_RBL 5672 0.91 2.17 0.15 79 XMDiploma_00 5607 1.92 2.15 1.78 80 T_XMDrugObfuBody_08 5578 2.13 2.14 2.13 81 RCVD_IN_BL_SPAMCOP_NET 5568 0.98 2.13 0.30 82 T_TooManySym_01 5435 3.51 2.08 4.36 83 RCVD_IN_RP_RNBL 5313 0.79 2.04 0.05 84 MultiRelay_Combo 5202 0.87 1.99 0.20 85 MultiRelay_CC 5202 0.87 1.99 0.20 86 XM_H_Long_From02 4783 1.28 1.83 0.95 87 XMBdyGiftCard01 4754 1.08 1.82 0.64 88 XMSubMetaI_00 4654 0.97 1.78 0.49 89 SUBJ_ALL_CAPS 4496 1.75 1.72 1.77 90 INVALID_MSGID 3874 1.08 1.49 0.83 91 NO_DNS_FOR_FROM 3676 1.32 1.41 1.27 92 BODY_URI_ONLY 3663 0.59 1.40 0.10 93 SpammyFromTLD_01 3612 1.01 1.38 0.79 94 XMClaimOffer 3578 0.69 1.37 0.28 95 T_Symld_Words_02 3576 0.84 1.37 0.53 96 RELAYCOUNTRY_CN 3573 0.54 1.37 0.06 97 BOTNET_NORDNS 3556 0.52 1.36 0.02 98 XMGenDplmaNmb 3555 1.12 1.36 0.97 99 XMSexyCombo_01 3519 0.72 1.35 0.35 100 TR_XM_RelayPhish 3487 0.77 1.34 0.44 101 TO_MALFORMED 3411 0.97 1.31 0.77 102 HTML_SHORT_LINK_IMG_1 3376 0.60 1.29 0.19 103 TM2_M_VERY_LONG_WORD 3358 1.04 1.29 0.89 104 XMBody_17 3243 0.72 1.24 0.41 105 MAILING_LIST_MULTI 3226 2.37 1.24 3.04 106 T_XMHurry_00 3223 0.83 1.24 0.59 107 RCVD_IN_IADB_LISTED 3217 4.40 1.23 6.27 108 UNPARSEABLE_RELAY 3215 3.14 1.23 4.27 109 URIBL_BLACK 3144 0.47 1.21 0.03 110 XMHTML_After_End 3132 0.73 1.20 0.45 111 RELAYCOUNTRY_FR 3130 0.75 1.20 0.49 112 BAYES_00 3096 4.39 1.19 6.28 113 XMStockSpam_06 3024 1.35 1.16 1.46 114 XM_UB99 2988 0.44 1.15 0.03 115 URI_TRY_3LD 2975 1.05 1.14 1.00 116 T_XMDrugObfuBody_00 2940 0.78 1.13 0.57 117 XM_DK_Undo_01 2932 1.68 1.12 2.01 118 HTML_FONT_FACE_BAD 2909 0.73 1.12 0.49 119 SUBJ_DOLLARS 2893 0.61 1.11 0.31 120 SHORTENED_URL_SRC 2879 0.50 1.10 0.14 121 URI_BUFFLY 2835 0.49 1.09 0.14 122 SHORTENER_SHORT_IMG 2815 0.49 1.08 0.14 123 TR_LOTS_OF_MONEY2 2788 0.63 1.07 0.36 124 T_MONEY_PERCENT 2788 0.63 1.07 0.36 125 XM_HighProb1 2767 0.41 1.06 0.03 126 XMPhish11 2757 1.18 1.06 1.25 127 RCVD_IN_IADB_SPF 2750 3.84 1.05 5.50 128 BAYES_40 2687 2.48 1.03 3.34 129 RCVD_IN_PSBL 2681 0.42 1.03 0.06 130 XMGppyBdWords 2663 0.55 1.02 0.27 131 RCVD_IN_IADB_SENDERID 2581 3.36 0.99 4.76 132 TR_XM_DK_Bayes 2578 2.87 0.99 3.98 133 RCVD_IN_IADB_DK 2570 3.34 0.99 4.74 134 XMPhish30 2515 0.53 0.96 0.28 135 RELAYCOUNTRY_IN 2483 0.42 0.95 0.11 136 HTML_IMAGE_ONLY_04 2437 0.45 0.93 0.16 137 MISSING_HEADERS 2391 0.68 0.92 0.54 138 XM_ProductURIs 2373 0.82 0.91 0.77 139 TR_XM_DK_Bayes1 2347 2.60 0.90 3.61 140 BAYES_20 2347 1.84 0.90 2.40 141 RELAYCOUNTRY_AT 2345 0.40 0.90 0.10 142 T_FILL_THIS_FORM_SHORT 2295 0.96 0.88 1.00 143 RELAYCOUNTRY_GB 2274 1.04 0.87 1.14 144 TR_XM_DK_Bayes2 2253 2.14 0.86 2.89 145 XM_Body_Obfu01 2252 0.55 0.86 0.36 146 URIBL_DBL_SPAM 2248 0.34 0.86 0.03 147 HTML_FONT_SIZE_LARGE 2244 0.47 0.86 0.24 148 TR_Symld_Words 2238 1.40 0.86 1.72 149 MPART_ALT_DIFF_COUNT 2218 0.59 0.85 0.44 150 XM_UB60 2196 0.42 0.84 0.16 151 DIET_1 2195 0.49 0.84 0.28 152 FILL_THIS_FORM 2156 0.54 0.83 0.37 153 TVD_SPACE_RATIO_MINFP 2140 0.31 0.82 0.01 154 URI_NOVOWEL 2121 0.61 0.81 0.48 155 PLING_QUERY 2080 0.53 0.80 0.37 156 XMSubNoVowel 2076 0.52 0.80 0.36 157 RCVD_IN_IADB_VOUCHED 2029 2.88 0.78 4.12 158 XM_OfRef7 2024 0.44 0.78 0.24 159 XM_UB999 1990 0.29 0.76 0.01 160 XMSubMetaSSx_00 1949 0.42 0.75 0.22 161 TooManyTo_002 1917 1.75 0.74 2.35 162 XMBrknScrpt_02 1891 0.60 0.73 0.53 163 XM_PDF 1883 3.60 0.72 5.30 164 XM_RXBody 1882 0.62 0.72 0.55 165 XMHTMLBadTable_001 1877 0.48 0.72 0.34 166 HTTPS_HTTP_MISMATCH 1873 0.62 0.72 0.55 167 HTML_IMAGE_ONLY_08 1836 0.36 0.70 0.16 168 T_FILL_THIS_FORM_LONG 1830 0.44 0.70 0.29 169 XM_H_PHPOS 1816 1.01 0.70 1.20 170 MIME_HEADER_CTYPE_ONLY 1796 0.34 0.69 0.14 171 T_TooManySym_02 1796 1.48 0.69 1.96 172 LOW_PRICE 1793 0.61 0.69 0.56 173 XM_S_JOY_D 1782 0.56 0.68 0.49 174 XMNoVowels 1769 0.94 0.68 1.09 175 BOUNCE_MESSAGE 1767 3.84 0.68 5.71 176 ANY_BOUNCE_MESSAGE 1767 3.84 0.68 5.71 177 XM_UB80 1759 0.31 0.67 0.09 178 XMMoneyMeta_00 1750 0.57 0.67 0.50 179 RCVD_IN_MSPIKE_WL 1749 1.66 0.67 2.25 180 HTML_TAG_BALANCE_BODY 1742 0.55 0.67 0.47 181 XMBody_78 1729 0.46 0.66 0.34 182 RCVD_IN_MSPIKE_H3 1718 1.66 0.66 2.25 183 TM2_M_A_HREF_HREF 1704 0.64 0.65 0.63 184 REMOVE_BEFORE_LINK 1673 0.42 0.64 0.29 185 CHARSET_FARAWAY_HEADER 1654 0.26 0.63 0.04 186 TR_LOTS_OF_MONEY3 1654 0.39 0.63 0.25 187 TooManyTo_003 1651 1.21 0.63 1.56 188 XMSubMetaSxObfu_03 1637 0.55 0.63 0.50 189 RELAYCOUNTRY_NL 1625 0.33 0.62 0.15 190 TR_Mismatch_TLD_02 1611 0.27 0.62 0.06 191 MIME_CHARSET_FARAWAY 1608 0.28 0.62 0.08 192 DKIM_ADSP_NXDOMAIN 1589 0.46 0.61 0.38 193 DKIM_ADSP_CUSTOM_MED 1546 0.91 0.59 1.09 194 XM_B_REG_HTML 1543 0.58 0.59 0.58 195 XMCapTrack 1514 1.13 0.58 1.46 196 XMSlimDrugH 1503 0.38 0.58 0.27 197 XM_H_PHPMailer 1479 0.58 0.57 0.59 198 XM_B_COPY_HTML 1470 0.46 0.56 0.40 199 XMSubMetaI_01 1425 0.25 0.55 0.07 200 BAYES_05 1422 1.18 0.55 1.55 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 386608 90.63 95.43 87.79 2 DKIM_SIGNED 321587 71.83 69.81 73.03 3 XM_DK_Pass 315520 70.12 67.54 71.65 4 DKIM_VALID 296035 66.04 64.04 67.22 5 DCC_CHECK_NEGATIVE 285312 47.74 18.95 64.79 6 BAYES_50 251976 48.83 34.66 57.22 7 XMListUnsubscribeExists 210796 52.08 59.19 47.87 8 DKIM_VALID_AU 201205 47.69 51.07 45.69 9 XM_H_QuotedFrom 151757 45.01 62.82 34.46 10 DCC_CHECK 144941 50.37 79.85 32.91 11 T_TM2_M_HEADER_IN_MSG 136065 32.47 35.12 30.90 12 DKIM_VALID_EF 120336 24.48 19.68 27.33 13 HTML_FONT_LOW_CONTRAST 118761 28.79 31.87 26.97 14 FVGT_m_MULTI_ODD 100840 22.87 22.83 22.90 15 LOC_TINY_FONT_1 92833 23.91 28.68 21.08 16 XMSubLong 90499 21.00 21.75 20.55 17 MIME_HTML_ONLY 84364 21.66 25.89 19.16 18 MultiRelay 83148 16.78 13.22 18.88 19 ALL_TRUSTED 78064 18.78 20.55 17.73 20 T_KAM_HTML_FONT_INVALID 74404 16.64 16.20 16.90 21 XM_DKIMWhitelistDomains 63741 9.13 0.12 14.47 22 XM_DK_Undo_02 63280 23.62 39.23 14.37 23 BAYES_99 60797 21.57 34.69 13.81 24 BAYES_999 52866 18.42 29.25 12.00 25 XM_Body_Dirty_Words 50012 12.94 15.60 11.36 26 XM_Multi_Part_URI 46845 11.73 13.57 10.64 27 LOTS_OF_MONEY 43185 9.89 10.02 9.81 28 LotsOfNums_01 40056 7.56 4.96 9.10 29 RCVD_IN_RP_SAFE 37583 6.95 4.28 8.53 30 RCVD_IN_RP_CERTIFIED 36069 6.44 3.48 8.19 31 TooManyTo_001 35548 7.19 5.70 8.07 32 XM_Evil_Numbers_Gen 34376 9.48 12.30 7.81 33 T_XMDrugObfuBody_14 34048 8.02 8.51 7.73 34 HTML_IMAGE_RATIO_02 33839 9.87 13.57 7.68 35 BAYES_60 32456 10.11 14.73 7.37 36 TR_DCC_Bayes_99 27929 13.90 26.67 6.34 37 BAYES_00 27651 4.39 1.19 6.28 38 RCVD_IN_IADB_LISTED 27632 4.40 1.23 6.27 39 BOTNET_IPINHOSTNAME 27480 8.20 11.52 6.24 40 MIME_QP_LONG_LINE 25592 4.53 2.35 5.81 41 DKIM_INVALID 25552 5.79 5.77 5.80 42 ANY_BOUNCE_MESSAGE 25132 3.84 0.68 5.71 43 BOUNCE_MESSAGE 25132 3.84 0.68 5.71 44 XM_H_Long_From01 25092 6.18 7.00 5.70 45 RCVD_IN_IADB_SPF 24202 3.84 1.05 5.50 46 RELAYCOUNTRY_META 23415 7.96 12.43 5.32 47 XM_PDF 23326 3.60 0.72 5.30 48 FSL_BULK_SIG 22859 13.21 26.75 5.19 49 XM_B_Phish_Phrases 22272 6.01 7.61 5.06 50 RCVD_IN_MSPIKE_H2 22140 4.25 2.93 5.03 51 XM_SendGrid 21330 4.42 3.72 4.84 52 RCVD_IN_IADB_SENDERID 20963 3.36 0.99 4.76 53 RCVD_IN_IADB_DK 20876 3.34 0.99 4.74 54 BAYES_80 20683 5.95 8.08 4.70 55 T_REMOTE_IMAGE 19841 4.18 3.62 4.51 56 HTML_IMAGE_RATIO_04 19391 5.69 7.87 4.40 57 T_TooManySym_01 19202 3.51 2.08 4.36 58 UNPARSEABLE_RELAY 18787 3.14 1.23 4.27 59 RCVD_IN_IADB_VOUCHED 18132 2.88 0.78 4.12 60 TR_XM_DocInvoice 17563 4.80 6.18 3.99 61 TR_XM_DK_Bayes 17545 2.87 0.99 3.98 62 IN_ZIMBRA_NJ_WHITELIST 17135 2.45 0.02 3.89 63 TVD_RCVD_IP 17026 2.48 0.14 3.87 64 XMSubMetaSx_00 16655 4.52 5.78 3.78 65 TR_XM_DK_Bayes1 15908 2.60 0.90 3.61 66 HTML_IMAGE_RATIO_06 15769 3.83 4.24 3.58 67 FROM_EXCESS_BASE64 15514 4.61 6.46 3.52 68 XMStrtUSub 15459 3.43 3.29 3.51 69 XMSexyCombo_05 14771 5.34 8.68 3.35 70 BAYES_40 14706 2.48 1.03 3.34 71 TM2_M_URI_OPT_OUT 13953 3.19 3.22 3.17 72 XMNumbers 13716 3.33 3.68 3.11 73 BAYES_95 13554 3.43 4.03 3.08 74 MAILING_LIST_MULTI 13366 2.37 1.24 3.04 75 TR_XM_DK_Bayes2 12727 2.14 0.86 2.89 76 MPART_ALT_DIFF 12364 4.23 6.64 2.81 77 HTML_MIME_NO_HTML_TAG 12229 2.69 2.54 2.78 78 RCVD_IN_IADB_OPTIN 11182 1.79 0.54 2.54 79 XM_UncommonTLD01 11165 3.75 5.80 2.54 80 BAYES_20 10589 1.84 0.90 2.40 81 TooManyTo_002 10338 1.75 0.74 2.35 82 RCVD_IN_MSPIKE_WL 9920 1.66 0.67 2.25 83 RCVD_IN_MSPIKE_H3 9913 1.66 0.66 2.25 84 T_XMDrugObfuBody_08 9382 2.13 2.14 2.13 85 MIME_HTML_MOSTLY 9349 2.84 4.04 2.12 86 HTML_IMAGE_RATIO_08 9294 2.64 3.55 2.11 87 HELO_NODOT 8996 1.35 0.19 2.04 88 XM_DK_Undo_01 8841 1.68 1.12 2.01 89 T_TooManySym_02 8616 1.48 0.69 1.96 90 IN_HORDE_ADDRESS_BOOK 7943 1.16 0.08 1.80 91 XM_SPF_SoftFail 7866 2.24 3.02 1.79 92 XMDiploma_00 7832 1.92 2.15 1.78 93 SUBJ_ALL_CAPS 7777 1.75 1.72 1.77 94 XM_DIRTYINTL 7700 2.34 3.34 1.75 95 TR_Symld_Words 7556 1.40 0.86 1.72 96 URI_HEX 7187 2.03 2.71 1.63 97 XM_CamelCaseFrm001 6940 2.00 2.71 1.58 98 TooManyTo_003 6865 1.21 0.63 1.56 99 BAYES_05 6833 1.18 0.55 1.55 100 XMCapTrack 6440 1.13 0.58 1.46 101 XMStockSpam_06 6435 1.35 1.16 1.46 102 RELAYCOUNTRY_CA 6325 1.82 2.47 1.44 103 XM_OfRef6 6125 1.76 2.37 1.39 104 MIME_HTML_ONLY_MULTI 5838 1.98 3.07 1.33 105 USER_IN_DEF_DKIM_WL 5814 0.85 0.07 1.32 106 XM_GoogleGroups 5664 0.94 0.35 1.29 107 NO_DNS_FOR_FROM 5602 1.32 1.41 1.27 108 XMPhish11 5490 1.18 1.06 1.25 109 UNTRUSTED_Relay 5445 3.55 7.47 1.24 110 BOTNET 5312 5.05 11.54 1.21 111 XM_H_PHPOS 5291 1.01 0.70 1.20 112 TooManyTo_004 5113 0.91 0.48 1.16 113 RELAYCOUNTRY_GB 5040 1.04 0.87 1.14 114 DKIM_ADSP_CUSTOM_MED 4805 0.91 0.59 1.09 115 XMNoVowels 4802 0.94 0.68 1.09 116 XM_GRM 4584 0.65 0.00 1.04 117 XMLngstWrd_00 4545 0.74 0.24 1.03 118 T_FILL_THIS_FORM_SHORT 4415 0.96 0.88 1.00 119 URI_TRY_3LD 4407 1.05 1.14 1.00 120 XMGenDplmaNmb 4281 1.12 1.36 0.97 121 TooManyTo_005 4272 0.77 0.42 0.97 122 XM_H_Long_From02 4183 1.28 1.83 0.95 123 XMLngstWrd_01 4003 0.65 0.22 0.91 124 TM2_M_VERY_LONG_WORD 3931 1.04 1.29 0.89 125 INVALID_MSGID 3665 1.08 1.49 0.83 126 SpammyFromTLD_01 3489 1.01 1.38 0.79 127 XM_ProductURIs 3377 0.82 0.91 0.77 128 TO_MALFORMED 3372 0.97 1.31 0.77 129 NML_ADSP_CUSTOM_MED 3158 0.65 0.53 0.72 130 T_TooManySym_03 3066 0.52 0.23 0.70 131 XM_UB50 3046 1.79 3.65 0.69 132 T_OBFU_PDF_ATTACH 2925 0.48 0.17 0.66 133 TR_MetaPhish_Combo_01 2916 7.34 18.60 0.66 134 KHOP_DYNAMIC 2869 0.61 0.54 0.65 135 XMBdyGiftCard01 2813 1.08 1.82 0.64 136 RELAYCOUNTRY_DE 2792 0.59 0.53 0.63 137 TM2_M_A_HREF_HREF 2763 0.64 0.65 0.63 138 FORGED_GMAIL_RCVD 2659 0.57 0.50 0.60 139 USER_IN_WHITELIST 2657 0.38 0.00 0.60 140 XMBody_95 2646 0.41 0.10 0.60 141 XM_H_PHPMailer 2618 0.58 0.57 0.59 142 T_XMHurry_00 2612 0.83 1.24 0.59 143 XM_B_REG_HTML 2537 0.58 0.59 0.58 144 AC_DIV_BONANZA 2515 0.41 0.14 0.57 145 XMSubMetaSxObfu_02 2505 0.44 0.22 0.57 146 T_XMDrugObfuBody_00 2503 0.78 1.13 0.57 147 LOW_PRICE 2475 0.61 0.69 0.56 148 XMGappySubj_01 2471 0.49 0.36 0.56 149 XM_RXBody 2443 0.62 0.72 0.55 150 HTTPS_HTTP_MISMATCH 2440 0.62 0.72 0.55 151 MISSING_HEADERS 2360 0.68 0.92 0.54 152 XMLngstWrd_02 2357 0.40 0.18 0.54 153 XM_ShortIntro_01 2351 0.45 0.31 0.53 154 T_Symld_Words_02 2333 0.84 1.37 0.53 155 XMBrknScrpt_02 2322 0.60 0.73 0.53 156 SHORT_HELO_AND_INLINE_IMAGE 2222 0.34 0.05 0.50 157 XMMoneyMeta_00 2218 0.57 0.67 0.50 158 XMSubMetaSxObfu_03 2211 0.55 0.63 0.50 159 XMhairloss01 2199 0.35 0.11 0.50 160 HTML_FONT_FACE_BAD 2179 0.73 1.12 0.49 161 XM_S_JOY_D 2163 0.56 0.68 0.49 162 RELAYCOUNTRY_FR 2158 0.75 1.20 0.49 163 XMDateMe_00 2150 0.42 0.30 0.49 164 XMSubMetaI_00 2150 0.97 1.78 0.49 165 XMLKML 2130 0.30 0.00 0.48 166 URI_NOVOWEL 2126 0.61 0.81 0.48 167 T_MANY_PILL_PRICE 2115 0.31 0.03 0.48 168 HTML_IMAGE_ONLY_32 2114 0.41 0.30 0.48 169 HTML_TAG_BALANCE_BODY 2084 0.55 0.67 0.47 170 RCVD_IN_SORBS_DUL 2027 0.33 0.10 0.46 171 XMHTML_After_End 1968 0.73 1.20 0.45 172 XMPhish14 1963 7.41 19.18 0.45 173 MPART_ALT_DIFF_COUNT 1948 0.59 0.85 0.44 174 RELAYCOUNTRY_AU 1941 0.47 0.51 0.44 175 TM2_M_BODY_EMPTY 1924 0.32 0.13 0.44 176 TR_XM_RelayPhish 1916 0.77 1.34 0.44 177 XMBody_17 1827 0.72 1.24 0.41 178 RDNS_DYNAMIC 1825 0.46 0.53 0.41 179 XM_B_COPY_HTML 1783 0.46 0.56 0.40 180 HTML_IMAGE_ONLY_28 1688 0.39 0.41 0.38 181 DKIM_ADSP_NXDOMAIN 1664 0.46 0.61 0.38 182 FILL_THIS_FORM 1647 0.54 0.83 0.37 183 PLING_QUERY 1643 0.53 0.80 0.37 184 XM_H_Trusted_IP 1615 0.23 0.00 0.37 185 TR_LOTS_OF_MONEY2 1603 0.63 1.07 0.36 186 T_MONEY_PERCENT 1603 0.63 1.07 0.36 187 XMSubNoVowel 1577 0.52 0.80 0.36 188 XM_D_tchamptons_WL 1576 0.23 0.00 0.36 189 XM_Body_Obfu01 1572 0.55 0.86 0.36 190 XMSexyCombo_01 1553 0.72 1.35 0.35 191 XMRcvdHeader_15 1545 0.22 0.00 0.35 192 XMSolicitRefs_0 1541 0.33 0.31 0.35 193 XMHTMLBadTable_001 1509 0.48 0.72 0.34 194 XMBody_78 1503 0.46 0.66 0.34 195 XM_USANA_RCVD 1493 0.21 0.00 0.34 196 XM_H_PHPOS_M 1482 0.32 0.30 0.34 197 HTML_IMAGE_ONLY_24 1457 0.30 0.24 0.33 198 SpammyFromTLD_02 1441 1.16 2.56 0.33 199 XMLngstWrd_03 1428 0.25 0.11 0.32 200 TVD_SPACE_RATIO 1425 0.35 0.39 0.32 ----------------------------------------------------------------------