Email: 773045 Autolearn: 0 AvgScore: 5.28 AvgScanTime: 4.17 sec Spam: 283142 Autolearn: 0 AvgScore: 14.79 AvgScanTime: 4.82 sec Ham: 489903 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 3.79 sec Time Spent Running SA: 894.86 hours Time Spent Processing Spam: 379.06 hours Time Spent Processing Ham: 515.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 268352 90.53 94.78 88.08 2 DCC_CHECK 171365 42.88 60.52 32.68 3 DKIM_SIGNED 167760 66.41 59.25 70.54 4 XM_DK_Pass 163306 64.98 57.68 69.19 5 DKIM_VALID 153074 60.67 54.06 64.49 6 BAYES_50 152466 58.32 53.85 60.90 7 XMListUnsubscribeExists 138996 47.17 49.09 46.07 8 DKIM_VALID_AU 120594 43.28 42.59 43.68 9 XM_H_QuotedFrom 115634 37.86 40.84 36.13 10 DCC_CHECK_NEGATIVE 109069 55.61 38.52 65.48 11 BOTNET 97371 13.39 34.39 1.25 12 XM_DK_Undo_02 88186 18.14 31.15 10.62 13 BAYES_99 75062 15.94 26.51 9.83 14 URI_HEX 74465 10.86 26.30 1.94 15 LOC_TINY_FONT_1 71660 21.53 25.31 19.35 16 MIME_HTML_ONLY 70755 21.32 24.99 19.21 17 HTML_FONT_LOW_CONTRAST 70632 25.38 24.95 25.64 18 RCVD_IN_RP_RNBL 68214 8.86 24.09 0.06 19 ANY_BOUNCE_MESSAGE 67670 10.53 23.90 2.81 20 BOUNCE_MESSAGE 67670 10.53 23.90 2.81 21 XMCapTrack 67155 9.60 23.72 1.44 22 NUMERIC_HTTP_ADDR 66787 8.82 23.59 0.28 23 BAYES_999 62330 13.33 22.01 8.31 24 TR_DCC_Bayes_99 58679 10.64 20.72 4.81 25 FVGT_m_MULTI_ODD 56282 19.70 19.88 19.59 26 XM_URI_RBL 55034 7.19 19.44 0.12 27 XMSubLong 54084 20.35 19.10 21.08 28 URIBL_BLACK 52359 6.79 18.49 0.03 29 DKIM_VALID_EF 44739 21.44 15.80 24.69 30 FSL_BULK_SIG 42716 8.74 15.09 5.07 31 T_KAM_HTML_FONT_INVALID 41855 15.72 14.78 16.26 32 XM_Body_Dirty_Words 41423 12.00 14.63 10.49 33 T_TM2_M_HEADER_IN_MSG 41217 24.50 14.56 30.25 34 XM_Multi_Part_URI 36693 11.45 12.96 10.58 35 HTML_IMAGE_RATIO_02 36220 9.03 12.79 6.85 36 MultiRelay 33054 16.27 11.67 18.93 37 DATE_IN_PAST_24_48 32452 4.20 11.46 0.01 38 RELAYCOUNTRY_META 32282 7.24 11.40 4.84 39 LOTS_OF_MONEY 31461 9.09 11.11 7.92 40 XM_Evil_Numbers_Gen 31440 9.06 11.10 7.88 41 BOTNET_IPINHOSTNAME 29265 6.47 10.34 4.23 42 DATE_IN_PAST_12_24 24536 3.19 8.67 0.02 43 XMSexyCombo_05 23146 4.86 8.17 2.95 44 FROM_EXCESS_BASE64 20195 4.41 7.13 2.83 45 HTML_IMAGE_RATIO_04 20010 5.57 7.07 4.71 46 T_XMDrugObfuBody_14 19378 6.99 6.84 7.08 47 XM_B_Phish_Phrases 19345 5.65 6.83 4.97 48 UNTRUSTED_Relay 19318 3.35 6.82 1.35 49 ALL_TRUSTED 18714 15.28 6.61 20.29 50 MISSING_HEADERS 18401 2.93 6.50 0.86 51 TR_XM_DocInvoice 17695 4.99 6.25 4.26 52 BAYES_80 17293 4.62 6.11 3.76 53 BAYES_60 16959 6.11 5.99 6.17 54 XM_UncommonTLD01 16271 3.80 5.75 2.67 55 XM_H_Long_From01 15647 5.36 5.53 5.26 56 XMSubMetaSx_00 15255 4.61 5.39 4.16 57 DKIM_INVALID 14686 5.74 5.19 6.06 58 TooManyTo_001 14153 6.71 5.00 7.70 59 T_REMOTE_IMAGE 13627 6.65 4.81 7.71 60 MPART_ALT_DIFF 13067 3.40 4.61 2.69 61 XM_S_JOY_D 12417 1.84 4.39 0.38 62 HTML_MIME_NO_HTML_TAG 12338 3.15 4.36 2.45 63 LotsOfNums_01 11605 7.27 4.10 9.11 64 TR_LOTS_OF_MONEY3 11191 1.67 3.95 0.35 65 BAYES_95 10634 2.98 3.76 2.53 66 XMNumbers 10563 3.56 3.73 3.47 67 REPLYTO_WITHOUT_TO_CC 10463 1.54 3.70 0.29 68 TR_LOTS_OF_MONEY1 10407 1.37 3.68 0.05 69 RCVD_IN_RP_SAFE 9607 6.58 3.39 8.43 70 TM2_M_URI_OPT_OUT 9214 2.45 3.25 1.98 71 DATE_IN_PAST_06_12 9201 1.22 3.25 0.05 72 XM_DIRTYINTL 9130 2.36 3.22 1.86 73 BODY_URI_ONLY 8343 1.17 2.95 0.14 74 HTML_IMAGE_RATIO_06 8277 3.04 2.92 3.10 75 HTML_SHORT_LINK_IMG_1 8104 1.07 2.86 0.03 76 XMStrtUSub 7971 3.73 2.82 4.26 77 XM_SendGrid 7901 4.46 2.79 5.43 78 MIME_HTML_MOSTLY 7897 2.58 2.79 2.46 79 SHORTENED_URL_SRC 7602 0.99 2.68 0.01 80 SHORTENER_SHORT_IMG 7567 0.98 2.67 0.00 81 URI_BUFFLY 7540 0.98 2.66 0.00 82 RCVD_IN_RP_CERTIFIED 7493 6.04 2.65 8.00 83 XM_SPF_SoftFail 7384 2.16 2.61 1.91 84 HTML_IMAGE_ONLY_04 7308 0.99 2.58 0.06 85 MIME_HEADER_CTYPE_ONLY 7297 1.03 2.58 0.14 86 MIME_HTML_ONLY_MULTI 7132 1.79 2.52 1.37 87 XM_UB50 6872 1.33 2.43 0.70 88 XM_CamelCaseFrm001 6839 1.87 2.42 1.55 89 RCVD_IN_MSPIKE_H2 6672 3.91 2.36 4.81 90 HTML_SHORT_CENTER 6573 0.85 2.32 0.00 91 RELAYCOUNTRY_CA 6562 1.70 2.32 1.34 92 XMDiploma_00 6005 1.82 2.12 1.64 93 INVALID_MSGID 5983 1.02 2.11 0.39 94 MIME_QP_LONG_LINE 5884 4.83 2.08 6.43 95 XM_OfRef6 5787 1.61 2.04 1.35 96 T_TooManySym_01 5639 3.93 1.99 5.05 97 TO_MALFORMED 5581 1.62 1.97 1.42 98 HTML_IMAGE_RATIO_08 5408 2.21 1.91 2.38 99 T_XMDrugObfuBody_08 5286 1.66 1.87 1.54 100 MultiRelay_Combo 5093 0.76 1.80 0.17 101 MultiRelay_CC 5093 0.76 1.80 0.17 102 RCVD_IN_BL_SPAMCOP_NET 4797 0.86 1.69 0.39 103 XMBdyGiftCard01 4782 1.07 1.69 0.71 104 BOTNET_NORDNS 4714 0.63 1.66 0.03 105 XMSexyCombo_01 4559 0.96 1.61 0.59 106 XMStockSpam_06 4509 1.18 1.59 0.95 107 XMGenDplmaNmb 4471 1.24 1.58 1.05 108 T_XMDrugObfuBody_00 4444 1.18 1.57 0.95 109 RELAYCOUNTRY_UA 4211 0.54 1.49 0.00 110 SpammyFromTLD_01 3930 1.10 1.39 0.93 111 XMSubMetaI_00 3921 0.84 1.38 0.53 112 SUBJ_ALL_CAPS 3896 1.61 1.38 1.75 113 XM_UB80 3493 0.57 1.23 0.18 114 DIET_1 3481 0.66 1.23 0.32 115 XMBody_17 3471 0.77 1.23 0.51 116 MAILING_LIST_MULTI 3440 1.92 1.21 2.34 117 SpammyFromTLD_02 3431 0.71 1.21 0.42 118 DKIM_ADSP_NXDOMAIN 3396 0.82 1.20 0.60 119 TM2_M_VERY_LONG_WORD 3371 1.01 1.19 0.90 120 BAYES_00 3306 5.83 1.17 8.52 121 NO_DNS_FOR_FROM 3206 1.18 1.13 1.21 122 TR_XM_RelayPhish 3132 0.76 1.11 0.55 123 T_XMHurry_00 3116 0.72 1.10 0.50 124 XMSubMetaSxObfu_03 3095 1.00 1.09 0.95 125 URI_TRY_3LD 3069 1.11 1.08 1.12 126 XM_ProductURIs 3049 0.80 1.08 0.65 127 XM_RXBody 3039 0.56 1.07 0.26 128 UNPARSEABLE_RELAY 3037 2.34 1.07 3.08 129 XM_H_Long_From02 3030 1.08 1.07 1.09 130 TR_Symld_Words 3005 1.43 1.06 1.64 131 PLING_QUERY 2935 0.61 1.04 0.37 132 BAYES_40 2913 2.72 1.03 3.70 133 RCVD_IN_IADB_LISTED 2897 4.47 1.02 6.46 134 XMPhish11 2828 1.09 1.00 1.15 135 XM_PDF 2784 3.94 0.98 5.65 136 XMPhish30 2681 0.57 0.95 0.35 137 XMSexyCombo_04 2644 0.51 0.93 0.26 138 RELAYCOUNTRY_AT 2604 0.66 0.92 0.50 139 TR_XM_DK_Bayes 2579 4.31 0.91 6.27 140 XM_HighProb1 2569 0.34 0.91 0.01 141 XM_UB60 2565 0.41 0.91 0.12 142 XMHTML_After_End 2561 0.58 0.90 0.39 143 XM_DK_Undo_01 2553 1.67 0.90 2.12 144 BAYES_20 2539 2.06 0.90 2.73 145 RCVD_IN_IADB_SPF 2503 3.94 0.88 5.70 146 T_FILL_THIS_FORM_SHORT 2474 0.88 0.87 0.88 147 XM_UB99 2465 0.36 0.87 0.07 148 XMSolicitRefs_0 2427 0.61 0.86 0.47 149 HTML_FONT_FACE_BAD 2411 0.63 0.85 0.51 150 URI_NOVOWEL 2383 0.58 0.84 0.43 151 TR_XM_DK_Bayes1 2368 3.94 0.84 5.73 152 XM_UB95 2364 0.36 0.83 0.09 153 RCVD_IN_IADB_SENDERID 2347 3.50 0.83 5.05 154 RCVD_IN_IADB_DK 2342 3.46 0.83 4.99 155 TR_Mismatch_TLD_02 2303 0.35 0.81 0.09 156 RELAYCOUNTRY_GB 2268 0.93 0.80 1.00 157 REMOVE_BEFORE_LINK 2255 0.48 0.80 0.29 158 SUBJ_DOLLARS 2207 0.54 0.78 0.40 159 KHOP_DYNAMIC 2182 0.69 0.77 0.64 160 TR_MetaPhish_Combo_01 2181 1.32 0.77 1.64 161 T_TooManySym_02 2169 1.46 0.77 1.86 162 XMMoneyMeta_00 2153 0.56 0.76 0.44 163 TR_XM_DK_Bayes2 2136 3.17 0.75 4.57 164 XMSlimDrugH 2124 0.46 0.75 0.29 165 HTML_IMAGE_ONLY_12 2104 2.46 0.74 3.45 166 XM_H_PHPOS 2085 1.04 0.74 1.22 167 HTML_TAG_BALANCE_BODY 2071 0.56 0.73 0.45 168 RELAYCOUNTRY_FR 1985 0.38 0.70 0.20 169 TR_LOTS_OF_MONEY2 1922 0.38 0.68 0.21 170 T_MONEY_PERCENT 1922 0.38 0.68 0.21 171 XMPhish14 1921 0.56 0.68 0.50 172 FILL_THIS_FORM 1900 0.55 0.67 0.48 173 RCVD_IN_IADB_VOUCHED 1897 2.81 0.67 4.05 174 XMHTMLBadTable_001 1808 0.45 0.64 0.34 175 URIBL_DBL_SPAM 1791 0.25 0.63 0.03 176 BAYES_05 1765 1.33 0.62 1.74 177 XM_UB999 1698 0.23 0.60 0.01 178 T_HTML_TAG_BALANCE_CENTER 1677 0.26 0.59 0.07 179 XMSubMetaSSx_00 1652 0.38 0.58 0.27 180 RELAYCOUNTRY_CN 1652 0.23 0.58 0.03 181 XM_Body_Obfu01 1638 0.39 0.58 0.28 182 XMBody_78 1631 0.41 0.58 0.31 183 TVD_PH_BODY_ACCOUNTS_PRE 1631 0.29 0.58 0.13 184 FILL_THIS_FORM_LOAN 1631 0.45 0.58 0.37 185 XM_Combo_Sbj 1617 0.34 0.57 0.21 186 T_FILL_THIS_FORM_LONG 1609 0.46 0.57 0.39 187 TM2_M_A_HREF_HREF 1607 0.57 0.57 0.58 188 BODY_ENHANCEMENT 1588 0.22 0.56 0.02 189 XMBounce_01 1546 0.24 0.55 0.06 190 RCVD_IN_MSPIKE_WL 1543 1.45 0.54 1.97 191 RCVD_IN_MSPIKE_H3 1529 1.45 0.54 1.97 192 DKIM_ADSP_CUSTOM_MED 1522 2.82 0.54 4.14 193 T_Symld_Words_02 1520 0.54 0.54 0.54 194 RDNS_DYNAMIC 1511 0.43 0.53 0.37 195 TR_Caps_n_Bayes_99 1511 0.24 0.53 0.08 196 HTTPS_HTTP_MISMATCH 1480 0.57 0.52 0.59 197 XM_B_REG_HTML 1452 0.50 0.51 0.50 198 NML_ADSP_CUSTOM_MED 1422 2.61 0.50 3.83 199 RELAYCOUNTRY_AU 1398 0.50 0.49 0.50 200 RCVD_IN_IADB_OPTIN 1389 1.78 0.49 2.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 431524 90.53 94.78 88.08 2 DKIM_SIGNED 345595 66.41 59.25 70.54 3 XM_DK_Pass 338986 64.98 57.68 69.19 4 DCC_CHECK_NEGATIVE 320808 55.61 38.52 65.48 5 DKIM_VALID 315929 60.67 54.06 64.49 6 BAYES_50 298375 58.32 53.85 60.90 7 XMListUnsubscribeExists 225682 47.17 49.09 46.07 8 DKIM_VALID_AU 214009 43.28 42.59 43.68 9 XM_H_QuotedFrom 177003 37.86 40.84 36.13 10 DCC_CHECK 160105 42.88 60.52 32.68 11 T_TM2_M_HEADER_IN_MSG 148182 24.50 14.56 30.25 12 HTML_FONT_LOW_CONTRAST 125601 25.38 24.95 25.64 13 DKIM_VALID_EF 120966 21.44 15.80 24.69 14 XMSubLong 103257 20.35 19.10 21.08 15 ALL_TRUSTED 99409 15.28 6.61 20.29 16 FVGT_m_MULTI_ODD 95995 19.70 19.88 19.59 17 LOC_TINY_FONT_1 94805 21.53 25.31 19.35 18 MIME_HTML_ONLY 94096 21.32 24.99 19.21 19 MultiRelay 92744 16.27 11.67 18.93 20 T_KAM_HTML_FONT_INVALID 79651 15.72 14.78 16.26 21 XM_DKIMWhitelistDomains 64692 8.55 0.48 13.21 22 XM_DK_Undo_02 52049 18.14 31.15 10.62 23 XM_Multi_Part_URI 51824 11.45 12.96 10.58 24 XM_Body_Dirty_Words 51377 12.00 14.63 10.49 25 BAYES_99 48170 15.94 26.51 9.83 26 LotsOfNums_01 44612 7.27 4.10 9.11 27 BAYES_00 41763 5.83 1.17 8.52 28 RCVD_IN_RP_SAFE 41281 6.58 3.39 8.43 29 BAYES_999 40713 13.33 22.01 8.31 30 RCVD_IN_RP_CERTIFIED 39214 6.04 2.65 8.00 31 LOTS_OF_MONEY 38800 9.09 11.11 7.92 32 XM_Evil_Numbers_Gen 38628 9.06 11.10 7.88 33 T_REMOTE_IMAGE 37750 6.65 4.81 7.71 34 TooManyTo_001 37723 6.71 5.00 7.70 35 T_XMDrugObfuBody_14 34678 6.99 6.84 7.08 36 HTML_IMAGE_RATIO_02 33564 9.03 12.79 6.85 37 RCVD_IN_IADB_LISTED 31629 4.47 1.02 6.46 38 MIME_QP_LONG_LINE 31490 4.83 2.08 6.43 39 TR_XM_DK_Bayes 30737 4.31 0.91 6.27 40 BAYES_60 30243 6.11 5.99 6.17 41 DKIM_INVALID 29666 5.74 5.19 6.06 42 TR_XM_DK_Bayes1 28053 3.94 0.84 5.73 43 RCVD_IN_IADB_SPF 27930 3.94 0.88 5.70 44 XM_PDF 27656 3.94 0.98 5.65 45 XM_SendGrid 26598 4.46 2.79 5.43 46 XM_H_Long_From01 25755 5.36 5.53 5.26 47 FSL_BULK_SIG 24838 8.74 15.09 5.07 48 T_TooManySym_01 24744 3.93 1.99 5.05 49 RCVD_IN_IADB_SENDERID 24731 3.50 0.83 5.05 50 RCVD_IN_IADB_DK 24430 3.46 0.83 4.99 51 XM_B_Phish_Phrases 24365 5.65 6.83 4.97 52 RELAYCOUNTRY_META 23688 7.24 11.40 4.84 53 TR_DCC_Bayes_99 23571 10.64 20.72 4.81 54 RCVD_IN_MSPIKE_H2 23547 3.91 2.36 4.81 55 HTML_IMAGE_RATIO_04 23053 5.57 7.07 4.71 56 TR_XM_DK_Bayes2 22405 3.17 0.75 4.57 57 TR_XM_DocInvoice 20887 4.99 6.25 4.26 58 XMStrtUSub 20854 3.73 2.82 4.26 59 BOTNET_IPINHOSTNAME 20723 6.47 10.34 4.23 60 XMSubMetaSx_00 20402 4.61 5.39 4.16 61 DKIM_ADSP_CUSTOM_MED 20279 2.82 0.54 4.14 62 RCVD_IN_IADB_VOUCHED 19862 2.81 0.67 4.05 63 IN_ZIMBRA_NJ_WHITELIST 19253 2.50 0.02 3.93 64 NML_ADSP_CUSTOM_MED 18779 2.61 0.50 3.83 65 BAYES_80 18427 4.62 6.11 3.76 66 BAYES_40 18113 2.72 1.03 3.70 67 XMNumbers 16985 3.56 3.73 3.47 68 HTML_IMAGE_ONLY_12 16913 2.46 0.74 3.45 69 HTML_SHORT_LINK_IMG_2 15534 2.03 0.05 3.17 70 FORGED_YAHOO_RCVD 15419 2.00 0.03 3.15 71 HTML_IMAGE_RATIO_06 15211 3.04 2.92 3.10 72 UNPARSEABLE_RELAY 15074 2.34 1.07 3.08 73 XMSexyCombo_05 14447 4.86 8.17 2.95 74 FROM_EXCESS_BASE64 13883 4.41 7.13 2.83 75 ANY_BOUNCE_MESSAGE 13764 10.53 23.90 2.81 76 BOUNCE_MESSAGE 13764 10.53 23.90 2.81 77 TVD_RCVD_IP 13545 1.80 0.14 2.76 78 BAYES_20 13355 2.06 0.90 2.73 79 MPART_ALT_DIFF 13181 3.40 4.61 2.69 80 XM_UncommonTLD01 13099 3.80 5.75 2.67 81 BAYES_95 12393 2.98 3.76 2.53 82 RCVD_IN_IADB_OPTIN 12377 1.78 0.49 2.53 83 MIME_HTML_MOSTLY 12074 2.58 2.79 2.46 84 HTML_MIME_NO_HTML_TAG 12010 3.15 4.36 2.45 85 HTML_IMAGE_RATIO_08 11671 2.21 1.91 2.38 86 MAILING_LIST_MULTI 11441 1.92 1.21 2.34 87 TooManyTo_002 10626 1.54 0.45 2.17 88 XM_DK_Undo_01 10369 1.67 0.90 2.12 89 TM2_M_URI_OPT_OUT 9718 2.45 3.25 1.98 90 RCVD_IN_MSPIKE_WL 9655 1.45 0.54 1.97 91 RCVD_IN_MSPIKE_H3 9650 1.45 0.54 1.97 92 URI_HEX 9489 10.86 26.30 1.94 93 XM_SPF_SoftFail 9336 2.16 2.61 1.91 94 HELO_NODOT 9206 1.30 0.30 1.88 95 XM_DIRTYINTL 9124 2.36 3.22 1.86 96 T_TooManySym_02 9121 1.46 0.77 1.86 97 SUBJ_ALL_CAPS 8582 1.61 1.38 1.75 98 BAYES_05 8546 1.33 0.62 1.74 99 USER_IN_DEF_DKIM_WL 8479 1.12 0.06 1.73 100 IN_HORDE_ADDRESS_BOOK 8420 1.11 0.05 1.72 101 XMDiploma_00 8058 1.82 2.12 1.64 102 TR_MetaPhish_Combo_01 8047 1.32 0.77 1.64 103 TR_Symld_Words 8044 1.43 1.06 1.64 104 XM_CamelCaseFrm001 7594 1.87 2.42 1.55 105 T_XMDrugObfuBody_08 7539 1.66 1.87 1.54 106 TooManyTo_003 7133 1.06 0.37 1.46 107 XMCapTrack 7051 9.60 23.72 1.44 108 TO_MALFORMED 6980 1.62 1.97 1.42 109 MIME_HTML_ONLY_MULTI 6713 1.79 2.52 1.37 110 XM_OfRef6 6631 1.61 2.04 1.35 111 UNTRUSTED_Relay 6603 3.35 6.82 1.35 112 RELAYCOUNTRY_CA 6579 1.70 2.32 1.34 113 BOTNET 6105 13.39 34.39 1.25 114 XM_GoogleGroups 6013 0.90 0.32 1.23 115 XM_H_PHPOS 5989 1.04 0.74 1.22 116 NO_DNS_FOR_FROM 5922 1.18 1.13 1.21 117 XMPhish11 5611 1.09 1.00 1.15 118 URI_TRY_3LD 5487 1.11 1.08 1.12 119 XM_H_Long_From02 5354 1.08 1.07 1.09 120 TooManyTo_004 5240 0.78 0.29 1.07 121 XMGenDplmaNmb 5135 1.24 1.58 1.05 122 RELAYCOUNTRY_GB 4918 0.93 0.80 1.00 123 T_XMDrugObfuBody_00 4669 1.18 1.57 0.95 124 XMSubMetaSxObfu_03 4651 1.00 1.09 0.95 125 XMStockSpam_06 4636 1.18 1.59 0.95 126 SpammyFromTLD_01 4543 1.10 1.39 0.93 127 TM2_M_VERY_LONG_WORD 4426 1.01 1.19 0.90 128 TooManyTo_005 4309 0.65 0.24 0.88 129 T_FILL_THIS_FORM_SHORT 4292 0.88 0.87 0.88 130 MISSING_HEADERS 4216 2.93 6.50 0.86 131 T_OBFU_PDF_ATTACH 4073 0.60 0.21 0.83 132 XMBdyGiftCard01 3489 1.07 1.69 0.71 133 XM_UB50 3430 1.33 2.43 0.70 134 XM_H_PHPMailer 3370 0.58 0.41 0.69 135 TO_NO_BRKTS_HTML_ONLY 3260 0.47 0.13 0.67 136 XMLngstWrd_00 3224 0.54 0.34 0.66 137 XM_ProductURIs 3170 0.80 1.08 0.65 138 KHOP_DYNAMIC 3130 0.69 0.77 0.64 139 HTML_FONT_SIZE_LARGE 3116 0.58 0.49 0.64 140 T_TooManySym_03 3077 0.45 0.13 0.63 141 DKIM_ADSP_NXDOMAIN 2960 0.82 1.20 0.60 142 XMLngstWrd_01 2956 0.50 0.32 0.60 143 HTTPS_HTTP_MISMATCH 2895 0.57 0.52 0.59 144 XMSexyCombo_01 2875 0.96 1.61 0.59 145 TM2_M_A_HREF_HREF 2836 0.57 0.57 0.58 146 USER_IN_WHITELIST 2772 0.36 0.00 0.57 147 FORGED_GMAIL_RCVD 2743 0.52 0.46 0.56 148 TR_XM_RelayPhish 2710 0.76 1.11 0.55 149 XMSubNoVowel 2707 0.41 0.17 0.55 150 XMBrknScrpt_02 2704 0.49 0.39 0.55 151 T_Symld_Words_02 2664 0.54 0.54 0.54 152 XMSubMetaI_00 2599 0.84 1.38 0.53 153 XMBody_17 2499 0.77 1.23 0.51 154 HTML_FONT_FACE_BAD 2497 0.63 0.85 0.51 155 RELAYCOUNTRY_AT 2467 0.66 0.92 0.50 156 RELAYCOUNTRY_AU 2452 0.50 0.49 0.50 157 XMPhish14 2445 0.56 0.68 0.50 158 XM_B_REG_HTML 2443 0.50 0.51 0.50 159 T_XMHurry_00 2439 0.72 1.10 0.50 160 AC_DIV_BONANZA 2428 0.35 0.10 0.50 161 XMNoVowels 2392 0.46 0.42 0.49 162 FILL_THIS_FORM 2372 0.55 0.67 0.48 163 SHORT_HELO_AND_INLINE_IMAGE 2344 0.32 0.05 0.48 164 XM_ShortIntro_01 2341 0.44 0.36 0.48 165 XMGappySubj_01 2335 0.44 0.38 0.48 166 XMSolicitRefs_0 2285 0.61 0.86 0.47 167 XMBody_95 2253 0.33 0.11 0.46 168 RCVD_IN_SORBS_DUL 2249 0.34 0.14 0.46 169 HTML_TAG_BALANCE_BODY 2224 0.56 0.73 0.45 170 XMMoneyMeta_00 2159 0.56 0.76 0.44 171 TM2_M_BODY_EMPTY 2142 0.32 0.13 0.44 172 HTML_IMAGE_ONLY_32 2120 0.35 0.22 0.43 173 URI_NOVOWEL 2099 0.58 0.84 0.43 174 XMDateMe_00 2097 0.34 0.19 0.43 175 XM_B_COPY_HTML 2095 0.42 0.41 0.43 176 XMSubMetaSxObfu_02 2088 0.38 0.30 0.43 177 SpammyFromTLD_02 2036 0.71 1.21 0.42 178 XM_B_TRADE_HTML 2015 0.35 0.26 0.41 179 SUBJ_DOLLARS 1943 0.54 0.78 0.40 180 XMRcvdHeader_15 1929 0.25 0.00 0.39 181 XMHTML_After_End 1914 0.58 0.90 0.39 182 T_FILL_THIS_FORM_LONG 1912 0.46 0.57 0.39 183 INVALID_MSGID 1912 1.02 2.11 0.39 184 RCVD_IN_BL_SPAMCOP_NET 1889 0.86 1.69 0.39 185 XM_H_PHPOS_M 1872 0.32 0.22 0.38 186 HTML_IMAGE_ONLY_20 1856 0.35 0.30 0.38 187 XM_S_JOY_D 1843 1.84 4.39 0.38 188 HTML_IMAGE_ONLY_28 1837 0.36 0.35 0.37 189 FILL_THIS_FORM_LOAN 1829 0.45 0.58 0.37 190 PLING_QUERY 1816 0.61 1.04 0.37 191 RDNS_DYNAMIC 1795 0.43 0.53 0.37 192 TR_LOTS_OF_MONEY3 1714 1.67 3.95 0.35 193 XMPhish30 1713 0.57 0.95 0.35 194 XMHTMLBadTable_001 1642 0.45 0.64 0.34 195 HTML_IMAGE_ONLY_24 1614 0.29 0.22 0.33 196 DIET_1 1592 0.66 1.23 0.32 197 XMBody_78 1542 0.41 0.58 0.31 198 XMClaimOffer 1540 0.32 0.33 0.31 199 TVD_SPACE_RATIO 1509 0.28 0.23 0.31 200 XMLngstWrd_02 1484 0.28 0.25 0.30 ----------------------------------------------------------------------