Email: 645218 Autolearn: 0 AvgScore: 2.29 AvgScanTime: 4.80 sec Spam: 147365 Autolearn: 0 AvgScore: 13.35 AvgScanTime: 5.51 sec Ham: 497853 Autolearn: 0 AvgScore: -0.99 AvgScanTime: 4.60 sec Time Spent Running SA: 861.07 hours Time Spent Processing Spam: 225.48 hours Time Spent Processing Ham: 635.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140787 87.49 95.54 85.11 2 DCC_CHECK 105073 47.94 71.30 41.02 3 DKIM_SIGNED 102468 71.51 69.53 72.09 4 XM_DK_Pass 98845 69.88 67.07 70.71 5 DKIM_VALID 91374 64.58 62.01 65.34 6 XMListUnsubscribeExists 87898 51.78 59.65 49.45 7 DKIM_VALID_AU 73486 46.03 49.87 44.89 8 BAYES_50 68217 53.57 46.29 55.73 9 XM_H_QuotedFrom 62229 39.06 42.23 38.12 10 MIME_HTML_ONLY 58491 24.48 39.69 19.97 11 HTML_FONT_LOW_CONTRAST 50983 28.47 34.60 26.66 12 LOC_TINY_FONT_1 45459 22.94 30.85 20.60 13 XM_DK_Undo_02 43450 12.02 29.48 6.85 14 DCC_CHECK_NEGATIVE 40648 50.34 27.58 57.07 15 XMSubLong 36722 21.25 24.92 20.16 16 BAYES_99 35649 9.86 24.19 5.62 17 BOTNET 35106 6.79 23.82 1.75 18 FVGT_m_MULTI_ODD 34585 20.84 23.47 20.06 19 RELAYCOUNTRY_META 29740 8.40 20.18 4.91 20 TR_DCC_Bayes_99 29489 7.08 20.01 3.26 21 BAYES_999 29237 8.02 19.84 4.52 22 XM_Body_Dirty_Words 29139 13.42 19.77 11.53 23 XM_Multi_Part_URI 28507 13.71 19.34 12.04 24 LOTS_OF_MONEY 27510 11.19 18.67 8.97 25 T_TM2_M_HEADER_IN_MSG 26202 26.28 17.78 28.79 26 RCVD_IN_RP_RNBL 25598 3.99 17.37 0.03 27 FROM_EXCESS_BASE64 24954 6.54 16.93 3.46 28 HTML_IMAGE_RATIO_02 24472 9.87 16.61 7.88 29 XM_UncommonTLD01 24214 6.13 16.43 3.08 30 DKIM_VALID_EF 24086 23.87 16.34 26.10 31 T_KAM_HTML_FONT_INVALID 23198 15.96 15.74 16.02 32 UNTRUSTED_Relay 21062 4.29 14.29 1.33 33 FSL_BULK_SIG 21019 8.03 14.26 6.19 34 T_REMOTE_IMAGE 20158 6.39 13.68 4.23 35 XM_Evil_Numbers_Gen 19748 8.86 13.40 7.52 36 MultiRelay 19299 16.44 13.10 17.44 37 SpammyFromTLD_02 19299 3.30 13.10 0.40 38 BOTNET_IPINHOSTNAME 19096 6.86 12.96 5.05 39 HTML_MIME_NO_HTML_TAG 19034 4.68 12.92 2.25 40 BODY_URI_ONLY 17228 2.76 11.69 0.11 41 XMSexyCombo_05 17226 5.24 11.69 3.33 42 HTML_SHORT_LINK_IMG_1 17142 2.68 11.63 0.03 43 SHORTENER_SHORT_IMG 16953 2.63 11.50 0.00 44 URI_BUFFLY 16948 2.63 11.50 0.00 45 MISSING_HEADERS 16480 2.98 11.18 0.56 46 MIME_HEADER_CTYPE_ONLY 15222 3.15 10.33 1.02 47 HTML_IMAGE_ONLY_04 14646 2.31 9.94 0.05 48 BAYES_80 13408 4.53 9.10 3.18 49 T_XMDrugObfuBody_14 13084 7.27 8.88 6.80 50 HTML_IMAGE_RATIO_04 12950 5.86 8.79 4.99 51 XMSubMetaSx_00 12950 5.10 8.79 4.01 52 XM_OfRef6 12844 3.33 8.72 1.74 53 TR_LOTS_OF_MONEY2 12362 2.14 8.39 0.29 54 T_MONEY_PERCENT 12362 2.14 8.39 0.29 55 HTML_SHORT_CENTER 11516 1.79 7.81 0.00 56 DKIM_INVALID 11094 6.93 7.53 6.75 57 BAYES_60 11081 5.77 7.52 5.26 58 XMNumbers 10486 4.12 7.12 3.23 59 XM_OfRef7 10224 1.75 6.94 0.22 60 ANY_BOUNCE_MESSAGE 10194 3.92 6.92 3.03 61 BOUNCE_MESSAGE 10193 3.92 6.92 3.03 62 BAYES_95 9976 3.06 6.77 1.96 63 TooManyTo_001 9770 9.35 6.63 10.15 64 XM_B_Phish_Phrases 9505 5.77 6.45 5.57 65 FILL_THIS_FORM 9495 1.93 6.44 0.60 66 XM_H_Long_From01 9358 6.09 6.35 6.01 67 MONEY_FRAUD_8 9326 1.45 6.33 0.00 68 MPART_ALT_DIFF 8931 3.70 6.06 3.00 69 LotsOfNums_01 7766 7.70 5.27 8.43 70 XM_OfRef8 7503 1.19 5.09 0.03 71 XM_UB50 7064 1.69 4.79 0.77 72 XM_DIRTYINTL 6698 2.53 4.55 1.93 73 XMStrtUSub 6076 4.47 4.12 4.58 74 RELAYCOUNTRY_KR 5996 0.95 4.07 0.03 75 T_XMDrugObfuBody_08 5931 2.05 4.02 1.47 76 XMSexyCombo_01 5778 1.40 3.92 0.66 77 T_FILL_THIS_FORM_LOAN 5635 1.18 3.82 0.40 78 HTML_IMAGE_RATIO_06 5632 3.47 3.82 3.37 79 SHARE_50_50 5546 0.86 3.76 0.00 80 MIME_HTML_ONLY_MULTI 5505 1.92 3.74 1.38 81 XM_SPF_SoftFail 5453 2.28 3.70 1.85 82 TM2_M_URI_OPT_OUT 5286 2.76 3.59 2.52 83 URI_HEX 4763 2.07 3.23 1.73 84 T_TooManySym_01 4618 4.93 3.13 5.46 85 MIME_HTML_MOSTLY 4597 2.55 3.12 2.38 86 XM_UB80 4418 0.70 3.00 0.02 87 RELAYCOUNTRY_CA 4252 1.75 2.89 1.41 88 STYLE_GIBBERISH 4102 3.06 2.78 3.14 89 XMDiploma_00 4089 2.07 2.77 1.86 90 XMStockSpam_06 4003 1.21 2.72 0.76 91 BOTNET_NORDNS 3999 0.63 2.71 0.02 92 XM_CamelCaseFrm001 3922 1.92 2.66 1.71 93 XMSubMetaSxObfu_03 3863 1.16 2.62 0.72 94 MultiRelay_Combo 3700 0.67 2.51 0.13 95 MultiRelay_CC 3700 0.67 2.51 0.13 96 FILL_THIS_FORM_LOAN 3606 0.63 2.45 0.10 97 XM_SendGrid 3596 4.80 2.44 5.50 98 HK_SCAM_N2 3594 0.56 2.44 0.00 99 ADVANCE_FEE_5_NEW_FRM_MNY 3581 0.56 2.43 0.00 100 T_SHARE_50_50 3576 0.55 2.43 0.00 101 RCVD_IN_MSPIKE_H2 3563 3.95 2.42 4.41 102 HTML_IMAGE_RATIO_08 3556 2.04 2.41 1.93 103 SUBJ_ALL_CAPS 3531 2.11 2.40 2.03 104 XM_UB60 3403 0.58 2.31 0.07 105 XM_URI_RBL 3315 0.81 2.25 0.38 106 XM_UB95 3309 0.52 2.25 0.01 107 XMhairloss01 3184 0.52 2.16 0.04 108 XMSexyCombo_04 3149 0.57 2.14 0.11 109 MIME_QP_LONG_LINE 3148 4.77 2.14 5.54 110 DATE_IN_PAST_03_06 3060 1.59 2.08 1.45 111 HTML_FONT_SIZE_LARGE 2973 0.62 2.02 0.21 112 UNPARSEABLE_RELAY 2936 2.71 1.99 2.92 113 DIET_1 2927 0.68 1.99 0.29 114 BAYES_40 2903 4.22 1.97 4.89 115 XMGenDplmaNmb 2850 1.32 1.93 1.14 116 RCVD_IN_BL_SPAMCOP_NET 2829 0.74 1.92 0.39 117 RCVD_IN_RP_SAFE 2795 6.33 1.90 7.64 118 XM_RXBody 2745 0.54 1.86 0.15 119 HTML_IMAGE_ONLY_08 2577 0.48 1.75 0.10 120 XMBody_17 2576 0.78 1.75 0.49 121 RELAYCOUNTRY_CN 2533 0.42 1.72 0.04 122 BAYES_20 2525 3.16 1.71 3.58 123 XMSubMetaI_00 2475 0.79 1.68 0.52 124 XM_DKIMWhitelistDomains 2417 9.95 1.64 12.41 125 XMBdyGiftCard01 2405 1.15 1.63 1.00 126 HK_RANDOM_FROM 2298 0.50 1.56 0.19 127 T_XMHurry_00 2275 0.86 1.54 0.66 128 XMSlimDrugH 2229 0.65 1.51 0.39 129 ALL_TRUSTED 2206 15.65 1.50 19.84 130 BAYES_00 2138 13.78 1.45 17.42 131 RCVD_IN_RP_CERTIFIED 2113 5.50 1.43 6.71 132 RELAYCOUNTRY_FR 2096 0.55 1.42 0.29 133 TR_Mismatch_TLD_02 2041 0.36 1.38 0.06 134 MPART_ALT_DIFF_COUNT 2032 0.47 1.38 0.20 135 SpammyFromTLD_01 1986 0.86 1.35 0.72 136 T_MANY_PILL_PRICE 1969 0.33 1.34 0.03 137 URIBL_BLACK 1958 0.37 1.33 0.09 138 MAILING_LIST_MULTI 1913 1.95 1.30 2.15 139 XMPhish30 1886 0.61 1.28 0.41 140 RELAYCOUNTRY_RU 1886 0.31 1.28 0.02 141 T_HTML_TAG_BALANCE_CENTER 1846 0.34 1.25 0.07 142 XM_DK_Undo_01 1838 1.60 1.25 1.71 143 TM2_M_VERY_LONG_WORD 1834 0.85 1.24 0.74 144 TR_XM_RelayPhish 1815 0.73 1.23 0.58 145 URIBL_DBL_SPAM 1775 0.38 1.20 0.13 146 XM_Combo_Sbj 1770 0.49 1.20 0.28 147 XM_UB99 1724 0.27 1.17 0.01 148 RCVD_IN_IADB_LISTED 1704 4.59 1.16 5.60 149 XMHTML_After_End 1683 0.61 1.14 0.46 150 HTTPS_HTTP_MISMATCH 1635 0.69 1.11 0.57 151 RELAYCOUNTRY_GB 1615 0.99 1.10 0.95 152 XMHTMLBadTable_001 1597 0.71 1.08 0.59 153 XM_H_Long_From02 1582 0.96 1.07 0.92 154 BODY_ENHANCEMENT 1579 0.26 1.07 0.02 155 XMPhish11 1548 1.13 1.05 1.15 156 TR_LOTS_OF_MONEY3 1516 0.59 1.03 0.46 157 XMSubMetaSSx_00 1496 0.34 1.02 0.15 158 BAYES_05 1465 2.05 0.99 2.36 159 DKIM_ADSP_CUSTOM_MED 1464 1.01 0.99 1.01 160 XMBody_78 1447 1.22 0.98 1.30 161 TR_XM_DK_Bayes 1446 11.05 0.98 14.04 162 RCVD_IN_IADB_SPF 1437 4.00 0.98 4.90 163 DKIM_ADSP_NXDOMAIN 1416 0.62 0.96 0.52 164 RELAYCOUNTRY_IN 1415 0.29 0.96 0.09 165 T_XMDrugObfuBody_00 1410 0.85 0.96 0.81 166 LongTLD 1399 0.33 0.95 0.15 167 XM_B_COPY_HTML 1370 0.49 0.93 0.36 168 FROM_SUSPICIOUS_NTLD 1361 0.25 0.92 0.05 169 TR_Symld_Words 1358 1.49 0.92 1.66 170 RCVD_IN_IADB_SENDERID 1357 3.53 0.92 4.30 171 NML_ADSP_CUSTOM_MED 1350 0.73 0.92 0.67 172 RCVD_IN_IADB_DK 1337 3.45 0.91 4.20 173 RELAYCOUNTRY_AT 1333 0.39 0.90 0.24 174 T_TooManySym_02 1332 1.55 0.90 1.75 175 TooManyTo_002 1320 3.02 0.90 3.65 176 URI_TRY_3LD 1316 1.34 0.89 1.47 177 FORGED_GMAIL_RCVD 1313 0.64 0.89 0.56 178 XMWghtMeta_00 1309 0.22 0.89 0.02 179 XM_H_PHPOS 1300 1.59 0.88 1.80 180 RDNS_DYNAMIC 1288 0.48 0.87 0.36 181 HTML_FONT_FACE_BAD 1284 0.61 0.87 0.53 182 XMMoneyMeta_00 1269 0.58 0.86 0.50 183 ADMITS_SPAM 1227 0.26 0.83 0.09 184 TR_XM_DK_Bayes1 1227 10.16 0.83 12.91 185 FVGT_m_MULTI_ODD_EMAIL 1222 0.22 0.83 0.04 186 SUBJ_DOLLARS 1222 0.37 0.83 0.23 187 XMLongAddy 1201 0.23 0.81 0.05 188 PLING_QUERY 1199 0.47 0.81 0.36 189 T_FILL_THIS_FORM_SHORT 1195 0.82 0.81 0.83 190 DATE_IN_PAST_06_12 1192 0.23 0.81 0.06 191 RELAYCOUNTRY_NL 1179 0.35 0.80 0.22 192 REPLYTO_WITHOUT_TO_CC 1171 0.21 0.79 0.04 193 URI_NOVOWEL 1162 0.51 0.79 0.43 194 XMSubject_48 1155 0.20 0.78 0.03 195 TooManyTo_003 1109 2.25 0.75 2.69 196 T_Symld_Words_02 1107 0.84 0.75 0.87 197 XMBrknScrpt_02 1095 0.72 0.74 0.71 198 HK_RANDOM_ENVFROM 1067 0.23 0.72 0.09 199 XM_HighProb1 1065 0.19 0.72 0.03 200 XM_H_PHPMailer 1024 0.61 0.69 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 423735 87.49 95.54 85.11 2 DKIM_SIGNED 358908 71.51 69.53 72.09 3 XM_DK_Pass 352056 69.88 67.07 70.71 4 DKIM_VALID 325310 64.58 62.01 65.34 5 DCC_CHECK_NEGATIVE 284137 50.34 27.58 57.07 6 BAYES_50 277430 53.57 46.29 55.73 7 XMListUnsubscribeExists 246206 51.78 59.65 49.45 8 DKIM_VALID_AU 223490 46.03 49.87 44.89 9 DCC_CHECK 204228 47.94 71.30 41.02 10 XM_H_QuotedFrom 189803 39.06 42.23 38.12 11 T_TM2_M_HEADER_IN_MSG 143343 26.28 17.78 28.79 12 HTML_FONT_LOW_CONTRAST 132742 28.47 34.60 26.66 13 DKIM_VALID_EF 129924 23.87 16.34 26.10 14 LOC_TINY_FONT_1 102548 22.94 30.85 20.60 15 XMSubLong 100383 21.25 24.92 20.16 16 FVGT_m_MULTI_ODD 99858 20.84 23.47 20.06 17 MIME_HTML_ONLY 99433 24.48 39.69 19.97 18 ALL_TRUSTED 98754 15.65 1.50 19.84 19 MultiRelay 86806 16.44 13.10 17.44 20 BAYES_00 86744 13.78 1.45 17.42 21 T_KAM_HTML_FONT_INVALID 79778 15.96 15.74 16.02 22 TR_XM_DK_Bayes 69874 11.05 0.98 14.04 23 TR_XM_DK_Bayes1 64295 10.16 0.83 12.91 24 XM_DKIMWhitelistDomains 61769 9.95 1.64 12.41 25 XM_Multi_Part_URI 59951 13.71 19.34 12.04 26 XM_Body_Dirty_Words 57420 13.42 19.77 11.53 27 TooManyTo_001 50546 9.35 6.63 10.15 28 TR_XM_DK_Bayes2 50253 7.93 0.63 10.09 29 LOTS_OF_MONEY 44664 11.19 18.67 8.97 30 LotsOfNums_01 41948 7.70 5.27 8.43 31 HTML_IMAGE_RATIO_02 39226 9.87 16.61 7.88 32 RCVD_IN_RP_SAFE 38025 6.33 1.90 7.64 33 XM_Evil_Numbers_Gen 37415 8.86 13.40 7.52 34 XM_DK_Undo_02 34088 12.02 29.48 6.85 35 T_XMDrugObfuBody_14 33851 7.27 8.88 6.80 36 DKIM_INVALID 33598 6.93 7.53 6.75 37 RCVD_IN_RP_CERTIFIED 33385 5.50 1.43 6.71 38 FSL_BULK_SIG 30815 8.03 14.26 6.19 39 XM_H_Long_From01 29910 6.09 6.35 6.01 40 BAYES_99 27972 9.86 24.19 5.62 41 RCVD_IN_IADB_LISTED 27884 4.59 1.16 5.60 42 XM_B_Phish_Phrases 27746 5.77 6.45 5.57 43 MIME_QP_LONG_LINE 27602 4.77 2.14 5.54 44 XM_SendGrid 27372 4.80 2.44 5.50 45 T_TooManySym_01 27195 4.93 3.13 5.46 46 BAYES_60 26167 5.77 7.52 5.26 47 BOTNET_IPINHOSTNAME 25150 6.86 12.96 5.05 48 HTML_IMAGE_RATIO_04 24844 5.86 8.79 4.99 49 RELAYCOUNTRY_META 24455 8.40 20.18 4.91 50 RCVD_IN_IADB_SPF 24376 4.00 0.98 4.90 51 BAYES_40 24326 4.22 1.97 4.89 52 XMStrtUSub 22786 4.47 4.12 4.58 53 XM_PDF 22567 3.64 0.62 4.53 54 BAYES_999 22496 8.02 19.84 4.52 55 RCVD_IN_MSPIKE_H2 21933 3.95 2.42 4.41 56 RCVD_IN_IADB_SENDERID 21423 3.53 0.92 4.30 57 T_REMOTE_IMAGE 21084 6.39 13.68 4.23 58 RCVD_IN_IADB_DK 20927 3.45 0.91 4.20 59 XMSubMetaSx_00 19964 5.10 8.79 4.01 60 TooManyTo_002 18187 3.02 0.90 3.65 61 RCVD_IN_IADB_VOUCHED 18054 2.95 0.68 3.63 62 BAYES_20 17846 3.16 1.71 3.58 63 FROM_EXCESS_BASE64 17227 6.54 16.93 3.46 64 HTML_IMAGE_RATIO_06 16784 3.47 3.82 3.37 65 XMSexyCombo_05 16578 5.24 11.69 3.33 66 IN_ZIMBRA_NJ_WHITELIST 16551 2.57 0.01 3.32 67 TR_DCC_Bayes_99 16209 7.08 20.01 3.26 68 XMNumbers 16066 4.12 7.12 3.23 69 BAYES_80 15812 4.53 9.10 3.18 70 STYLE_GIBBERISH 15633 3.06 2.78 3.14 71 XM_UncommonTLD01 15345 6.13 16.43 3.08 72 ANY_BOUNCE_MESSAGE 15074 3.92 6.92 3.03 73 BOUNCE_MESSAGE 15073 3.92 6.92 3.03 74 MPART_ALT_DIFF 14935 3.70 6.06 3.00 75 UNPARSEABLE_RELAY 14530 2.71 1.99 2.92 76 TooManyTo_003 13385 2.25 0.75 2.69 77 TVD_RCVD_IP 13263 2.13 0.33 2.66 78 TO_MALFORMED 13213 2.06 0.05 2.65 79 TM2_M_URI_OPT_OUT 12526 2.76 3.59 2.52 80 MIME_HTML_MOSTLY 11829 2.55 3.12 2.38 81 BAYES_05 11769 2.05 0.99 2.36 82 RCVD_IN_IADB_OPTIN 11703 1.93 0.49 2.35 83 HTML_MIME_NO_HTML_TAG 11192 4.68 12.92 2.25 84 MAILING_LIST_MULTI 10686 1.95 1.30 2.15 85 SUBJ_ALL_CAPS 10082 2.11 2.40 2.03 86 BAYES_95 9753 3.06 6.77 1.96 87 TooManyTo_004 9746 1.65 0.61 1.96 88 XM_DIRTYINTL 9610 2.53 4.55 1.93 89 HTML_IMAGE_RATIO_08 9610 2.04 2.41 1.93 90 XMDiploma_00 9268 2.07 2.77 1.86 91 XM_SPF_SoftFail 9230 2.28 3.70 1.85 92 XM_H_PHPOS 8937 1.59 0.88 1.80 93 BOTNET 8713 6.79 23.82 1.75 94 T_TooManySym_02 8699 1.55 0.90 1.75 95 XM_OfRef6 8657 3.33 8.72 1.74 96 URI_HEX 8615 2.07 3.23 1.73 97 XM_DK_Undo_01 8509 1.60 1.25 1.71 98 XM_CamelCaseFrm001 8491 1.92 2.66 1.71 99 RCVD_IN_MSPIKE_WL 8470 1.40 0.37 1.70 100 RCVD_IN_MSPIKE_H3 8460 1.39 0.36 1.70 101 TR_Symld_Words 8259 1.49 0.92 1.66 102 HELO_NODOT 7674 1.27 0.35 1.54 103 IN_HORDE_ADDRESS_BOOK 7389 1.15 0.04 1.48 104 URI_TRY_3LD 7321 1.34 0.89 1.47 105 T_XMDrugObfuBody_08 7315 2.05 4.02 1.47 106 TooManyTo_005 7304 1.25 0.50 1.47 107 INVALID_MSGID 7303 1.15 0.10 1.47 108 DATE_IN_PAST_03_06 7221 1.59 2.08 1.45 109 RELAYCOUNTRY_CA 7023 1.75 2.89 1.41 110 MIME_HTML_ONLY_MULTI 6874 1.92 3.74 1.38 111 UNTRUSTED_Relay 6613 4.29 14.29 1.33 112 TR_MetaPhish_Combo_01 6544 1.12 0.46 1.31 113 XMBody_78 6455 1.22 0.98 1.30 114 XMCapTrack 5848 0.95 0.20 1.17 115 XMPhish11 5743 1.13 1.05 1.15 116 XMGenDplmaNmb 5687 1.32 1.93 1.14 117 XM_GoogleGroups 5508 0.94 0.39 1.11 118 USER_IN_DEF_DKIM_WL 5460 0.86 0.07 1.10 119 MIME_HEADER_CTYPE_ONLY 5077 3.15 10.33 1.02 120 DKIM_ADSP_CUSTOM_MED 5037 1.01 0.99 1.01 121 XMBdyGiftCard01 4984 1.15 1.63 1.00 122 RELAYCOUNTRY_GB 4752 0.99 1.10 0.95 123 XM_H_Long_From02 4584 0.96 1.07 0.92 124 T_Symld_Words_02 4343 0.84 0.75 0.87 125 T_FILL_THIS_FORM_SHORT 4120 0.82 0.81 0.83 126 T_XMDrugObfuBody_00 4057 0.85 0.96 0.81 127 XM_UB50 3809 1.69 4.79 0.77 128 XMStockSpam_06 3791 1.21 2.72 0.76 129 TM2_M_VERY_LONG_WORD 3662 0.85 1.24 0.74 130 XMSubMetaSxObfu_03 3601 1.16 2.62 0.72 131 SpammyFromTLD_01 3575 0.86 1.35 0.72 132 XMBrknScrpt_02 3534 0.72 0.74 0.71 133 NML_ADSP_CUSTOM_MED 3359 0.73 0.92 0.67 134 T_XMHurry_00 3306 0.86 1.54 0.66 135 XMSexyCombo_01 3282 1.40 3.92 0.66 136 FROM_GOV_SPOOF 3241 0.56 0.24 0.65 137 T_TooManySym_03 3241 0.54 0.16 0.65 138 XM_ProductURIs 3156 0.63 0.64 0.63 139 T_OBFU_PDF_ATTACH 3096 0.52 0.16 0.62 140 FILL_THIS_FORM 2989 1.93 6.44 0.60 141 XM_ShortIntro_01 2964 0.58 0.52 0.60 142 XMHTMLBadTable_001 2955 0.71 1.08 0.59 143 TM2_M_A_HREF_HREF 2883 0.56 0.48 0.58 144 XM_H_PHPMailer 2883 0.61 0.69 0.58 145 TR_XM_RelayPhish 2867 0.73 1.23 0.58 146 XMGappySubj_01 2851 0.53 0.38 0.57 147 HTTPS_HTTP_MISMATCH 2831 0.69 1.11 0.57 148 FORGED_GMAIL_RCVD 2796 0.64 0.89 0.56 149 MISSING_HEADERS 2766 2.98 11.18 0.56 150 USER_IN_WHITELIST 2766 0.43 0.00 0.56 151 HTML_FONT_FACE_BAD 2636 0.61 0.87 0.53 152 XMBody_95 2630 0.43 0.09 0.53 153 XMSubMetaI_00 2610 0.79 1.68 0.52 154 T_FILL_THIS_FORM_LONG 2608 0.44 0.14 0.52 155 DKIM_ADSP_NXDOMAIN 2605 0.62 0.96 0.52 156 XMNoVowels 2549 0.47 0.35 0.51 157 XMMoneyMeta_00 2480 0.58 0.86 0.50 158 RELAYCOUNTRY_AU 2436 0.51 0.59 0.49 159 TM2_M_BODY_EMPTY 2434 0.41 0.13 0.49 160 XMBody_17 2430 0.78 1.75 0.49 161 XM_B_REG_HTML 2305 0.49 0.59 0.46 162 TR_LOTS_OF_MONEY3 2302 0.59 1.03 0.46 163 XMHTML_After_End 2269 0.61 1.14 0.46 164 REMOVE_BEFORE_LINK 2250 0.49 0.60 0.45 165 XMLngstWrd_00 2225 0.41 0.29 0.45 166 RELAYCOUNTRY_DE 2213 0.50 0.69 0.44 167 XMSubMetaSxObfu_02 2178 0.44 0.43 0.44 168 XMBody_29 2171 0.37 0.16 0.44 169 URI_NOVOWEL 2136 0.51 0.79 0.43 170 XMPhish30 2049 0.61 1.28 0.41 171 XMLngstWrd_01 2049 0.37 0.23 0.41 172 T_FILL_THIS_FORM_LOAN 1997 1.18 3.82 0.40 173 SpammyFromTLD_02 1981 3.30 13.10 0.40 174 HTML_TAG_BALANCE_BODY 1971 0.46 0.69 0.40 175 XMSlimDrugH 1966 0.65 1.51 0.39 176 NO_DNS_FOR_FROM 1946 0.45 0.63 0.39 177 RCVD_IN_BL_SPAMCOP_NET 1927 0.74 1.92 0.39 178 XM_URI_RBL 1906 0.81 2.25 0.38 179 SHORT_HELO_AND_INLINE_IMAGE 1886 0.31 0.07 0.38 180 UPPERCASE_50_75 1858 0.30 0.07 0.37 181 PLING_QUERY 1814 0.47 0.81 0.36 182 XM_B_COPY_HTML 1810 0.49 0.93 0.36 183 RDNS_DYNAMIC 1802 0.48 0.87 0.36 184 TVD_SPACE_RATIO 1781 0.32 0.17 0.36 185 HTML_IMAGE_ONLY_32 1758 0.31 0.17 0.35 186 XMRcvdHeader_15 1745 0.27 0.00 0.35 187 XM_D_tchamptons_WL 1737 0.27 0.00 0.35 188 XMDateMe_00 1712 0.35 0.36 0.34 189 HTML_IMAGE_ONLY_28 1691 0.41 0.65 0.34 190 XMSolicitRefs_0 1691 0.34 0.35 0.34 191 AC_DIV_BONANZA 1683 0.30 0.15 0.34 192 RCVD_IN_SORBS_DUL 1616 0.35 0.43 0.32 193 HTML_IMAGE_ONLY_12 1600 0.30 0.25 0.32 194 HTML_IMAGE_ONLY_20 1597 0.31 0.27 0.32 195 XM_H_PHPOS_M 1538 0.34 0.46 0.31 196 GMD_PDF_EMPTY_BODY 1537 0.26 0.09 0.31 197 T_FROM_GOV_DKIM_AU 1523 0.26 0.11 0.31 198 XMSubEmpty 1501 0.28 0.19 0.30 199 RELAYCOUNTRY_FR 1466 0.55 1.42 0.29 200 TR_LOTS_OF_MONEY2 1457 2.14 8.39 0.29 ----------------------------------------------------------------------