Email: 691285 Autolearn: 0 AvgScore: 5.56 AvgScanTime: 4.57 sec Spam: 268081 Autolearn: 0 AvgScore: 15.44 AvgScanTime: 5.14 sec Ham: 423204 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 4.21 sec Time Spent Running SA: 877.23 hours Time Spent Processing Spam: 382.41 hours Time Spent Processing Ham: 494.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 256805 90.46 95.79 87.08 2 DKIM_SIGNED 149407 66.33 55.73 73.05 3 XM_DK_Pass 146370 65.02 54.60 71.62 4 DCC_CHECK 145210 41.65 54.17 33.72 5 DKIM_VALID 137647 60.91 51.35 66.97 6 BAYES_50 134913 56.31 50.33 60.10 7 XMListUnsubscribeExists 128671 47.88 48.00 47.81 8 DCC_CHECK_NEGATIVE 120065 56.80 44.79 64.41 9 DKIM_VALID_AU 110505 43.63 41.22 45.15 10 XM_H_QuotedFrom 96697 35.11 36.07 34.50 11 BOTNET 90831 13.97 33.88 1.36 12 MIME_HTML_ONLY 83146 23.86 31.02 19.33 13 XM_DK_Undo_02 79837 18.90 29.78 12.00 14 URI_HEX 71683 11.80 26.74 2.34 15 RCVD_IN_RP_RNBL 68611 9.96 25.59 0.06 16 ANY_BOUNCE_MESSAGE 67178 11.78 25.06 3.36 17 BOUNCE_MESSAGE 67178 11.78 25.06 3.36 18 BAYES_99 67120 16.45 25.04 11.00 19 LOC_TINY_FONT_1 66623 21.93 24.85 20.08 20 HTML_FONT_LOW_CONTRAST 66610 25.59 24.85 26.07 21 XMCapTrack 66473 10.37 24.80 1.22 22 NUMERIC_HTTP_ADDR 66157 9.72 24.68 0.24 23 BAYES_999 56310 13.84 21.00 9.30 24 FVGT_m_MULTI_ODD 54750 20.90 20.42 21.21 25 XM_URI_RBL 53782 7.85 20.06 0.12 26 TR_DCC_Bayes_99 53468 11.24 19.94 5.73 27 XMSubLong 52285 20.89 19.50 21.77 28 URIBL_BLACK 51224 7.44 19.11 0.05 29 RELAYCOUNTRY_META 49655 10.24 18.52 4.99 30 T_TM2_M_HEADER_IN_MSG 41244 24.67 15.38 30.55 31 DKIM_VALID_EF 40843 21.90 15.24 26.12 32 FROM_EXCESS_BASE64 40019 7.83 14.93 3.33 33 XM_Body_Dirty_Words 38373 12.87 14.31 11.95 34 UNTRUSTED_Relay 38256 6.35 14.27 1.34 35 T_KAM_HTML_FONT_INVALID 36033 14.70 13.44 15.50 36 XM_Multi_Part_URI 35413 12.36 13.21 11.81 37 HTML_IMAGE_RATIO_02 31114 9.78 11.61 8.62 38 T_REMOTE_IMAGE 31098 8.62 11.60 6.74 39 HTML_MIME_NO_HTML_TAG 30156 5.82 11.25 2.38 40 MISSING_HEADERS 27962 4.71 10.43 1.09 41 BODY_URI_ONLY 27759 4.06 10.35 0.07 42 MultiRelay 27601 15.58 10.30 18.92 43 FSL_BULK_SIG 27538 7.68 10.27 6.04 44 HTML_SHORT_LINK_IMG_1 26945 4.41 10.05 0.83 45 XM_Evil_Numbers_Gen 26728 8.42 9.97 7.43 46 MIME_HEADER_CTYPE_ONLY 26316 3.91 9.82 0.17 47 BOTNET_IPINHOSTNAME 26127 6.56 9.75 4.54 48 SHORTENER_SHORT_IMG 25780 3.73 9.62 0.00 49 URI_BUFFLY 25723 3.72 9.60 0.00 50 HTML_IMAGE_ONLY_04 24640 3.60 9.19 0.05 51 LOTS_OF_MONEY 24441 11.14 9.12 12.42 52 XMSexyCombo_05 23852 5.60 8.90 3.50 53 BAYES_80 23190 5.71 8.65 3.85 54 HTML_SHORT_CENTER 21290 3.08 7.94 0.00 55 T_XMDrugObfuBody_14 19745 7.74 7.37 7.97 56 RELAYCOUNTRY_UA 19638 2.84 7.33 0.00 57 BAYES_60 19173 6.90 7.15 6.74 58 XM_UncommonTLD01 17759 4.13 6.62 2.55 59 XM_B_Phish_Phrases 17132 5.63 6.39 5.15 60 TR_XM_DocInvoice 16602 4.56 6.19 3.52 61 HTML_IMAGE_RATIO_04 16388 5.44 6.11 5.01 62 DATE_IN_PAST_24_48 15489 2.25 5.78 0.02 63 XMSubMetaSx_00 15132 4.76 5.64 4.20 64 SHORTENED_URL_SRC 15088 2.18 5.63 0.00 65 XMNumbers 14963 4.49 5.58 3.80 66 XM_H_Long_From01 14922 5.55 5.57 5.53 67 MPART_ALT_DIFF 13244 3.60 4.94 2.76 68 TooManyTo_001 13105 6.82 4.89 8.05 69 BAYES_95 12993 3.53 4.85 2.69 70 DKIM_INVALID 11760 5.42 4.39 6.08 71 LotsOfNums_01 10644 7.13 3.97 9.13 72 XM_UB80 10185 1.51 3.80 0.06 73 RCVD_IN_RP_SAFE 9987 6.64 3.73 8.49 74 XM_UB50 9973 1.97 3.72 0.86 75 XM_DIRTYINTL 9088 2.53 3.39 1.99 76 XM_UB60 8585 1.32 3.20 0.12 77 HTML_IMAGE_RATIO_06 8301 3.35 3.10 3.51 78 XMStrtUSub 8255 3.56 3.08 3.86 79 MIME_HTML_MOSTLY 8228 2.68 3.07 2.44 80 RCVD_IN_RP_CERTIFIED 8072 6.12 3.01 8.10 81 SpammyFromTLD_02 7511 1.28 2.80 0.32 82 MIME_HTML_ONLY_MULTI 6948 1.90 2.59 1.46 83 TM2_M_URI_OPT_OUT 6708 2.02 2.50 1.71 84 XM_SendGrid 6344 4.31 2.37 5.55 85 ALL_TRUSTED 6273 12.03 2.34 18.17 86 XM_SPF_SoftFail 6257 2.39 2.33 2.43 87 DATE_IN_PAST_12_24 6250 0.92 2.33 0.03 88 XM_OfRef6 6203 1.69 2.31 1.29 89 RCVD_IN_MSPIKE_H2 6141 3.91 2.29 4.93 90 XM_CamelCaseFrm001 5961 1.94 2.22 1.75 91 MultiRelay_Combo 5912 0.97 2.21 0.18 92 MultiRelay_CC 5912 0.97 2.21 0.18 93 RELAYCOUNTRY_CA 5849 1.69 2.18 1.37 94 T_TooManySym_01 5564 4.08 2.08 5.35 95 T_XMDrugObfuBody_08 5462 1.76 2.04 1.58 96 MIME_QP_LONG_LINE 5426 4.58 2.02 6.20 97 XM_UB95 5331 0.80 1.99 0.04 98 DIET_1 5221 1.25 1.95 0.81 99 XMDiploma_00 4914 1.80 1.83 1.77 100 HTML_IMAGE_RATIO_08 4439 1.87 1.66 2.01 101 XMSubMetaI_00 4360 0.96 1.63 0.53 102 RELAYCOUNTRY_DE 4093 0.88 1.53 0.47 103 XMBdyGiftCard01 4064 1.18 1.52 0.97 104 XMBody_17 3981 0.91 1.48 0.55 105 SUBJ_ALL_CAPS 3843 1.88 1.43 2.17 106 BOTNET_NORDNS 3793 0.56 1.41 0.02 107 T_XMDrugObfuBody_00 3783 1.09 1.41 0.89 108 T_XMHurry_00 3750 0.88 1.40 0.55 109 RCVD_IN_BL_SPAMCOP_NET 3479 0.76 1.30 0.43 110 BAYES_00 3396 5.22 1.27 7.72 111 NO_DNS_FOR_FROM 3381 1.25 1.26 1.25 112 XM_S_JOY_D 3188 1.34 1.19 1.43 113 INVALID_MSGID 3182 1.04 1.19 0.95 114 XMSlimDrugH 3180 0.64 1.19 0.29 115 PLING_QUERY 3142 0.69 1.17 0.39 116 TO_MALFORMED 3062 1.80 1.14 2.22 117 T_MONEY_PERCENT 3023 0.59 1.13 0.25 118 TR_LOTS_OF_MONEY2 3023 0.59 1.13 0.25 119 T_FILL_THIS_FORM_SHORT 3001 0.88 1.12 0.73 120 BAYES_40 2980 2.66 1.11 3.64 121 XMGenDplmaNmb 2968 1.16 1.11 1.19 122 UNPARSEABLE_RELAY 2943 2.57 1.10 3.50 123 XMSexyCombo_01 2936 0.83 1.10 0.66 124 TR_XM_DK_Bayes 2902 3.80 1.08 5.53 125 DATE_IN_PAST_06_12 2828 0.44 1.05 0.05 126 XMHTML_After_End 2803 0.71 1.05 0.49 127 REPLYTO_WITHOUT_TO_CC 2803 0.64 1.05 0.39 128 HTML_IMAGE_ONLY_08 2736 0.47 1.02 0.13 129 SUBJ_DOLLARS 2731 0.66 1.02 0.43 130 XMStockSpam_06 2691 1.17 1.00 1.28 131 TR_XM_DK_Bayes1 2681 3.45 1.00 4.99 132 URI_TRY_3LD 2679 1.10 1.00 1.17 133 XM_H_Long_From02 2668 0.99 1.00 0.99 134 XMPhish14 2628 0.66 0.98 0.45 135 XM_OfRef7 2613 0.53 0.97 0.25 136 TR_LOTS_OF_MONEY1 2600 0.40 0.97 0.03 137 BAYES_20 2585 1.92 0.96 2.52 138 TR_XM_RelayPhish 2548 0.73 0.95 0.59 139 TR_Mismatch_TLD_02 2536 0.41 0.95 0.06 140 TM2_M_VERY_LONG_WORD 2501 0.90 0.93 0.87 141 XMPhish30 2486 0.59 0.93 0.38 142 XMHTMLBadTable_001 2464 0.68 0.92 0.54 143 TR_XM_DK_Bayes2 2459 2.79 0.92 3.97 144 XM_HighProb1 2452 0.36 0.91 0.01 145 SpammyFromTLD_01 2380 0.78 0.89 0.72 146 TR_Symld_Words 2288 1.58 0.85 2.04 147 XM_BadFromFormat 2288 0.45 0.85 0.19 148 XM_UB99 2271 0.35 0.85 0.04 149 FILL_THIS_FORM 2256 0.61 0.84 0.47 150 RCVD_IN_IADB_LISTED 2246 4.65 0.84 7.07 151 RELAYCOUNTRY_AT 2148 0.48 0.80 0.27 152 XM_DK_Undo_01 2136 1.55 0.80 2.02 153 MAILING_LIST_MULTI 2136 1.65 0.80 2.19 154 RELAYCOUNTRY_GB 2106 0.90 0.79 0.97 155 T_FILL_THIS_FORM_LONG 2099 0.53 0.78 0.37 156 XMPhish11 2048 1.15 0.76 1.39 157 XMMoneyMeta_00 2046 0.54 0.76 0.39 158 TR_LOTS_OF_MONEY3 1995 1.50 0.74 1.98 159 XM_ProductURIs 1989 0.61 0.74 0.53 160 DKIM_ADSP_CUSTOM_MED 1980 1.17 0.74 1.45 161 HTML_FONT_SIZE_LARGE 1930 0.41 0.72 0.21 162 RCVD_IN_IADB_SPF 1890 4.04 0.71 6.16 163 NML_ADSP_CUSTOM_MED 1877 0.93 0.70 1.07 164 HTML_FONT_FACE_BAD 1861 0.57 0.69 0.49 165 XM_H_PHPOS 1855 1.04 0.69 1.26 166 XM_PDF 1842 3.13 0.69 4.68 167 XM_B_REG_HTML 1809 0.54 0.67 0.45 168 XM_B_COPY_HTML 1803 0.49 0.67 0.38 169 RELAYCOUNTRY_FR 1799 0.38 0.67 0.20 170 RCVD_IN_IADB_SENDERID 1799 3.58 0.67 5.42 171 RCVD_IN_IADB_DK 1768 3.49 0.66 5.29 172 XMBody_78 1750 0.46 0.65 0.34 173 T_TooManySym_02 1712 1.43 0.64 1.92 174 XMSubMetaI_01 1701 0.26 0.63 0.03 175 XM_RXBody 1650 0.30 0.62 0.10 176 FORGED_GMAIL_RCVD 1649 0.62 0.62 0.62 177 URIBL_DBL_SPAM 1637 0.27 0.61 0.05 178 REMOVE_BEFORE_LINK 1600 0.37 0.60 0.23 179 XMSubMetaSxObfu_03 1593 0.60 0.59 0.60 180 BAYES_05 1587 1.24 0.59 1.66 181 FVGT_m_MULTI_ODD_EMAIL 1578 0.26 0.59 0.05 182 RELAYCOUNTRY_AU 1557 0.51 0.58 0.46 183 RELAYCOUNTRY_CN 1546 0.24 0.58 0.03 184 LOW_PRICE 1501 0.34 0.56 0.20 185 XMWghtMeta_00 1501 0.23 0.56 0.02 186 XMSubMetaD_00 1482 0.27 0.55 0.09 187 XM_UB999 1452 0.22 0.54 0.01 188 HTML_TAG_BALANCE_BODY 1437 0.51 0.54 0.49 189 DKIM_ADSP_NXDOMAIN 1436 0.44 0.54 0.38 190 DRUGS_ERECTILE 1432 0.23 0.53 0.03 191 LONG_HEX_URI 1423 0.32 0.53 0.18 192 XMLongAddy 1404 0.27 0.52 0.10 193 RCVD_IN_IADB_VOUCHED 1387 3.00 0.52 4.58 194 TR_MetaPhish_Combo_01 1386 1.17 0.52 1.58 195 T_HTML_TAG_BALANCE_CENTER 1382 0.27 0.52 0.11 196 FILL_THIS_FORM_LOAN 1376 0.39 0.51 0.31 197 RDNS_DYNAMIC 1374 0.43 0.51 0.38 198 XMClaimOffer 1363 0.28 0.51 0.13 199 XMLngstWrd_00 1352 0.58 0.50 0.62 200 RELAYCOUNTRY_IN 1338 0.26 0.50 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 368507 90.46 95.79 87.08 2 DKIM_SIGNED 309154 66.33 55.73 73.05 3 XM_DK_Pass 303090 65.02 54.60 71.62 4 DKIM_VALID 283440 60.91 51.35 66.97 5 DCC_CHECK_NEGATIVE 272574 56.80 44.79 64.41 6 BAYES_50 254327 56.31 50.33 60.10 7 XMListUnsubscribeExists 202325 47.88 48.00 47.81 8 DKIM_VALID_AU 191082 43.63 41.22 45.15 9 XM_H_QuotedFrom 146011 35.11 36.07 34.50 10 DCC_CHECK 142685 41.65 54.17 33.72 11 T_TM2_M_HEADER_IN_MSG 129290 24.67 15.38 30.55 12 DKIM_VALID_EF 110561 21.90 15.24 26.12 13 HTML_FONT_LOW_CONTRAST 110318 25.59 24.85 26.07 14 XMSubLong 92119 20.89 19.50 21.77 15 FVGT_m_MULTI_ODD 89752 20.90 20.42 21.21 16 LOC_TINY_FONT_1 84991 21.93 24.85 20.08 17 MIME_HTML_ONLY 81803 23.86 31.02 19.33 18 MultiRelay 80077 15.58 10.30 18.92 19 ALL_TRUSTED 76903 12.03 2.34 18.17 20 T_KAM_HTML_FONT_INVALID 65584 14.70 13.44 15.50 21 XM_DKIMWhitelistDomains 63003 9.13 0.05 14.89 22 LOTS_OF_MONEY 52578 11.14 9.12 12.42 23 XM_DK_Undo_02 50794 18.90 29.78 12.00 24 XM_Body_Dirty_Words 50588 12.87 14.31 11.95 25 XM_Multi_Part_URI 50001 12.36 13.21 11.81 26 BAYES_99 46568 16.45 25.04 11.00 27 BAYES_999 39362 13.84 21.00 9.30 28 LotsOfNums_01 38649 7.13 3.97 9.13 29 HTML_IMAGE_RATIO_02 36479 9.78 11.61 8.62 30 RCVD_IN_RP_SAFE 35929 6.64 3.73 8.49 31 RCVD_IN_RP_CERTIFIED 34266 6.12 3.01 8.10 32 TooManyTo_001 34051 6.82 4.89 8.05 33 T_XMDrugObfuBody_14 33743 7.74 7.37 7.97 34 BAYES_00 32662 5.22 1.27 7.72 35 XM_Evil_Numbers_Gen 31463 8.42 9.97 7.43 36 RCVD_IN_IADB_LISTED 29920 4.65 0.84 7.07 37 BAYES_60 28545 6.90 7.15 6.74 38 T_REMOTE_IMAGE 28524 8.62 11.60 6.74 39 MIME_QP_LONG_LINE 26220 4.58 2.02 6.20 40 RCVD_IN_IADB_SPF 26066 4.04 0.71 6.16 41 DKIM_INVALID 25714 5.42 4.39 6.08 42 FSL_BULK_SIG 25568 7.68 10.27 6.04 43 TR_DCC_Bayes_99 24259 11.24 19.94 5.73 44 XM_SendGrid 23476 4.31 2.37 5.55 45 XM_H_Long_From01 23411 5.55 5.57 5.53 46 TR_XM_DK_Bayes 23397 3.80 1.08 5.53 47 RCVD_IN_IADB_SENDERID 22940 3.58 0.67 5.42 48 T_TooManySym_01 22653 4.08 2.08 5.35 49 RCVD_IN_IADB_DK 22382 3.49 0.66 5.29 50 XM_B_Phish_Phrases 21806 5.63 6.39 5.15 51 HTML_IMAGE_RATIO_04 21209 5.44 6.11 5.01 52 TR_XM_DK_Bayes1 21139 3.45 1.00 4.99 53 RELAYCOUNTRY_META 21138 10.24 18.52 4.99 54 RCVD_IN_MSPIKE_H2 20862 3.91 2.29 4.93 55 XM_PDF 19786 3.13 0.69 4.68 56 RCVD_IN_IADB_VOUCHED 19374 3.00 0.52 4.58 57 BOTNET_IPINHOSTNAME 19193 6.56 9.75 4.54 58 XMSubMetaSx_00 17778 4.76 5.64 4.20 59 IN_ZIMBRA_NJ_WHITELIST 17357 2.52 0.02 4.10 60 TR_XM_DK_Bayes2 16797 2.79 0.92 3.97 61 XMStrtUSub 16353 3.56 3.08 3.86 62 BAYES_80 16293 5.71 8.65 3.85 63 XMNumbers 16100 4.49 5.58 3.80 64 BAYES_40 15413 2.66 1.11 3.64 65 TR_XM_DocInvoice 14906 4.56 6.19 3.52 66 HTML_IMAGE_RATIO_06 14859 3.35 3.10 3.51 67 XMSexyCombo_05 14831 5.60 8.90 3.50 68 UNPARSEABLE_RELAY 14802 2.57 1.10 3.50 69 ANY_BOUNCE_MESSAGE 14238 11.78 25.06 3.36 70 BOUNCE_MESSAGE 14236 11.78 25.06 3.36 71 FROM_EXCESS_BASE64 14087 7.83 14.93 3.33 72 TVD_RCVD_IP 13061 1.94 0.14 3.09 73 RCVD_IN_IADB_OPTIN 12148 1.90 0.36 2.87 74 MPART_ALT_DIFF 11668 3.60 4.94 2.76 75 BAYES_95 11388 3.53 4.85 2.69 76 TooManyTo_002 11134 1.76 0.38 2.63 77 XM_UncommonTLD01 10810 4.13 6.62 2.55 78 BAYES_20 10661 1.92 0.96 2.52 79 MIME_HTML_MOSTLY 10315 2.68 3.07 2.44 80 XM_SPF_SoftFail 10275 2.39 2.33 2.43 81 HTML_MIME_NO_HTML_TAG 10082 5.82 11.25 2.38 82 URI_HEX 9900 11.80 26.74 2.34 83 RCVD_IN_MSPIKE_WL 9583 1.53 0.38 2.26 84 RCVD_IN_MSPIKE_H3 9582 1.53 0.37 2.26 85 TO_MALFORMED 9395 1.80 1.14 2.22 86 MAILING_LIST_MULTI 9289 1.65 0.80 2.19 87 SUBJ_ALL_CAPS 9172 1.88 1.43 2.17 88 TR_Symld_Words 8638 1.58 0.85 2.04 89 XM_DK_Undo_01 8564 1.55 0.80 2.02 90 HTML_IMAGE_RATIO_08 8489 1.87 1.66 2.01 91 XM_DIRTYINTL 8428 2.53 3.39 1.99 92 TR_LOTS_OF_MONEY3 8375 1.50 0.74 1.98 93 T_TooManySym_02 8144 1.43 0.64 1.92 94 IN_HORDE_ADDRESS_BOOK 7569 1.12 0.05 1.79 95 XMDiploma_00 7509 1.80 1.83 1.77 96 TooManyTo_003 7467 1.20 0.31 1.76 97 XM_CamelCaseFrm001 7423 1.94 2.22 1.75 98 HELO_NODOT 7417 1.15 0.19 1.75 99 TM2_M_URI_OPT_OUT 7225 2.02 2.50 1.71 100 BAYES_05 7013 1.24 0.59 1.66 101 TR_MetaPhish_Combo_01 6707 1.17 0.52 1.58 102 USER_IN_DEF_DKIM_WL 6687 1.00 0.08 1.58 103 T_XMDrugObfuBody_08 6671 1.76 2.04 1.58 104 MIME_HTML_ONLY_MULTI 6162 1.90 2.59 1.46 105 DKIM_ADSP_CUSTOM_MED 6140 1.17 0.74 1.45 106 XM_S_JOY_D 6062 1.34 1.19 1.43 107 XMPhish11 5892 1.15 0.76 1.39 108 RELAYCOUNTRY_CA 5805 1.69 2.18 1.37 109 BOTNET 5753 13.97 33.88 1.36 110 UNTRUSTED_Relay 5652 6.35 14.27 1.34 111 TooManyTo_004 5501 0.89 0.25 1.30 112 XM_OfRef6 5456 1.69 2.31 1.29 113 XMStockSpam_06 5401 1.17 1.00 1.28 114 XM_H_PHPOS 5341 1.04 0.69 1.26 115 NO_DNS_FOR_FROM 5271 1.25 1.26 1.25 116 XMCapTrack 5181 10.37 24.80 1.22 117 HTML_IMAGE_ONLY_12 5078 0.79 0.14 1.20 118 XMGenDplmaNmb 5025 1.16 1.11 1.19 119 URI_TRY_3LD 4933 1.10 1.00 1.17 120 XM_GoogleGroups 4852 0.82 0.29 1.15 121 MISSING_HEADERS 4610 4.71 10.43 1.09 122 NML_ADSP_CUSTOM_MED 4527 0.93 0.70 1.07 123 XMGappySubj_01 4447 0.75 0.28 1.05 124 TooManyTo_005 4340 0.71 0.22 1.03 125 XM_H_Long_From02 4193 0.99 1.00 0.99 126 XMBdyGiftCard01 4104 1.18 1.52 0.97 127 RELAYCOUNTRY_GB 4103 0.90 0.79 0.97 128 TM2_M_A_HREF_HREF 4084 0.74 0.38 0.97 129 INVALID_MSGID 4037 1.04 1.19 0.95 130 HTML_SHORT_LINK_IMG_3 3895 0.64 0.21 0.92 131 HTML_IMAGE_ONLY_16 3775 0.61 0.18 0.89 132 T_XMDrugObfuBody_00 3751 1.09 1.41 0.89 133 TM2_M_VERY_LONG_WORD 3694 0.90 0.93 0.87 134 XM_UB50 3640 1.97 3.72 0.86 135 HTML_SHORT_LINK_IMG_1 3508 4.41 10.05 0.83 136 XMSolicitRefs_0 3440 0.63 0.34 0.81 137 USER_IN_WHITELIST 3433 0.50 0.00 0.81 138 HTML_EXTRA_CLOSE 3407 0.50 0.03 0.81 139 DIET_1 3407 1.25 1.95 0.81 140 XM_H_PHPMailer 3183 0.61 0.38 0.75 141 T_FILL_THIS_FORM_SHORT 3104 0.88 1.12 0.73 142 SpammyFromTLD_01 3044 0.78 0.89 0.72 143 XMSubNoVowel 2981 0.51 0.20 0.70 144 XM_D_tchamptons_WL 2813 0.41 0.00 0.66 145 XMBrknScrpt_02 2775 0.54 0.36 0.66 146 XMSexyCombo_01 2775 0.83 1.10 0.66 147 T_TooManySym_03 2769 0.44 0.11 0.65 148 XMGappySubj_02 2726 0.41 0.05 0.64 149 FORGED_GMAIL_RCVD 2642 0.62 0.62 0.62 150 XMLngstWrd_00 2642 0.58 0.50 0.62 151 HTML_IMAGE_ONLY_20 2604 0.48 0.28 0.62 152 XMSubMetaSxObfu_03 2542 0.60 0.59 0.60 153 XMBody_95 2523 0.42 0.15 0.60 154 TR_XM_RelayPhish 2493 0.73 0.95 0.59 155 T_OBFU_PDF_ATTACH 2468 0.41 0.13 0.58 156 XMLngstWrd_01 2394 0.51 0.41 0.57 157 XMNoVowels 2387 0.44 0.24 0.56 158 XMSubMetaSxObfu_02 2320 0.44 0.28 0.55 159 T_XMHurry_00 2316 0.88 1.40 0.55 160 XMBody_17 2311 0.91 1.48 0.55 161 XMHTMLBadTable_001 2269 0.68 0.92 0.54 162 XMSubMetaI_00 2256 0.96 1.63 0.53 163 XM_ProductURIs 2242 0.61 0.74 0.53 164 XMHTML_After_End 2089 0.71 1.05 0.49 165 T_MANY_PILL_PRICE 2082 0.32 0.05 0.49 166 HTML_TAG_BALANCE_BODY 2079 0.51 0.54 0.49 167 HTML_FONT_FACE_BAD 2059 0.57 0.69 0.49 168 RELAYCOUNTRY_DE 2006 0.88 1.53 0.47 169 FILL_THIS_FORM 1978 0.61 0.84 0.47 170 RELAYCOUNTRY_AU 1957 0.51 0.58 0.46 171 SHORT_HELO_AND_INLINE_IMAGE 1935 0.30 0.04 0.46 172 XMPhish14 1923 0.66 0.98 0.45 173 XM_B_REG_HTML 1912 0.54 0.67 0.45 174 T_Symld_Words_02 1853 0.43 0.42 0.44 175 TM2_M_BODY_EMPTY 1826 0.30 0.09 0.43 176 XM_ShortIntro_01 1819 0.41 0.37 0.43 177 SUBJ_DOLLARS 1813 0.66 1.02 0.43 178 RCVD_IN_BL_SPAMCOP_NET 1801 0.76 1.30 0.43 179 AC_DIV_BONANZA 1757 0.28 0.06 0.42 180 HTML_IMAGE_ONLY_32 1745 0.37 0.29 0.41 181 URI_NOVOWEL 1717 0.44 0.48 0.41 182 XM_H_PHPOS_M 1688 0.33 0.23 0.40 183 XMMoneyMeta_00 1655 0.54 0.76 0.39 184 HTTPS_HTTP_MISMATCH 1652 0.43 0.49 0.39 185 REPLYTO_WITHOUT_TO_CC 1651 0.64 1.05 0.39 186 PLING_QUERY 1636 0.69 1.17 0.39 187 RDNS_DYNAMIC 1626 0.43 0.51 0.38 188 XMRcvdHeader_15 1623 0.23 0.00 0.38 189 XM_B_COPY_HTML 1602 0.49 0.67 0.38 190 DKIM_ADSP_NXDOMAIN 1596 0.44 0.54 0.38 191 XMPhish30 1589 0.59 0.93 0.38 192 HTML_IMAGE_ONLY_28 1589 0.38 0.38 0.38 193 T_FILL_THIS_FORM_LONG 1583 0.53 0.78 0.37 194 RCVD_IN_SORBS_DUL 1540 0.25 0.08 0.36 195 THIS_AD 1508 0.34 0.31 0.36 196 XMDateMe_00 1492 0.29 0.20 0.35 197 KHOP_DYNAMIC 1422 0.30 0.23 0.34 198 XMBody_78 1419 0.46 0.65 0.34 199 T_FROM_GOV_SPOOF 1391 0.26 0.16 0.33 200 SpammyFromTLD_02 1340 1.28 2.80 0.32 ----------------------------------------------------------------------