Email: 665203 Autolearn: 0 AvgScore: 2.06 AvgScanTime: 3.69 sec Spam: 146546 Autolearn: 0 AvgScore: 11.94 AvgScanTime: 4.17 sec Ham: 518657 Autolearn: 0 AvgScore: -0.74 AvgScanTime: 3.56 sec Time Spent Running SA: 682.72 hours Time Spent Processing Spam: 169.71 hours Time Spent Processing Ham: 513.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133641 86.18 91.19 84.76 2 DCC_CHECK 119455 48.17 81.51 38.75 3 DKIM_SIGNED 110532 72.05 75.42 71.10 4 XM_DK_Pass 105786 70.30 72.19 69.77 5 DKIM_VALID 99923 66.10 68.19 65.51 6 XMListUnsubscribeExists 99024 52.22 67.57 47.88 7 DKIM_VALID_AU 81058 48.81 55.31 46.97 8 XM_H_QuotedFrom 80316 43.27 54.81 40.02 9 BAYES_50 74647 56.90 50.94 58.59 10 HTML_FONT_LOW_CONTRAST 52438 28.02 35.78 25.82 11 MIME_HTML_ONLY 48238 22.15 32.92 19.10 12 XM_DK_Undo_02 46088 11.89 31.45 6.36 13 LOC_TINY_FONT_1 44852 22.99 30.61 20.83 14 XMSubLong 39891 23.12 27.22 21.97 15 BAYES_99 39204 9.76 26.75 4.96 16 FVGT_m_MULTI_ODD 33669 21.30 22.98 20.82 17 STYLE_GIBBERISH 31736 19.34 21.66 18.69 18 TR_DCC_Bayes_99 29565 6.72 20.17 2.91 19 BAYES_999 29510 7.74 20.14 4.23 20 DKIM_VALID_EF 28625 24.25 19.53 25.58 21 RELAYCOUNTRY_META 28583 8.17 19.50 4.97 22 XM_Body_Dirty_Words 27512 13.48 18.77 11.98 23 LOTS_OF_MONEY 27357 10.64 18.67 8.37 24 FSL_BULK_SIG 26261 9.38 17.92 6.97 25 T_TM2_M_HEADER_IN_MSG 25967 27.27 17.72 29.97 26 DCC_CHECK_NEGATIVE 24845 50.03 16.95 59.37 27 T_KAM_HTML_FONT_INVALID 24160 16.09 16.49 15.98 28 BOTNET_IPINHOSTNAME 24044 7.35 16.41 4.80 29 HTML_IMAGE_RATIO_02 22697 9.42 15.49 7.71 30 BOTNET 22491 4.59 15.35 1.55 31 XM_Multi_Part_URI 21445 11.52 14.63 10.63 32 XM_Evil_Numbers_Gen 21286 10.03 14.53 8.76 33 MultiRelay 19979 16.37 13.63 17.14 34 UNTRUSTED_Relay 19503 3.95 13.31 1.31 35 XMSexyCombo_05 17214 5.74 11.75 4.04 36 XM_H_Long_From01 13885 6.37 9.47 5.49 37 T_XMDrugObfuBody_14 12902 7.61 8.80 7.27 38 FROM_EXCESS_BASE64 12210 4.48 8.33 3.39 39 MPART_ALT_DIFF 12175 4.25 8.31 3.11 40 XM_UncommonTLD01 11682 4.15 7.97 3.08 41 XMSubMetaSx_00 11351 4.96 7.75 4.17 42 HTML_IMAGE_RATIO_04 11271 6.00 7.69 5.53 43 XM_UB50 11147 2.35 7.61 0.86 44 XM_S_JOY_D 10637 2.19 7.26 0.76 45 DKIM_INVALID 10609 5.95 7.24 5.59 46 XM_B_Phish_Phrases 10434 5.89 7.12 5.54 47 TR_LOTS_OF_MONEY3 10416 1.91 7.11 0.44 48 HELO_NODOT 9852 2.98 6.72 1.92 49 TooManyTo_001 9792 7.99 6.68 8.36 50 MISSING_HEADERS 9545 1.82 6.51 0.50 51 REPLYTO_WITHOUT_TO_CC 9426 1.47 6.43 0.07 52 TR_LOTS_OF_MONEY1 9318 1.44 6.36 0.05 53 BAYES_60 9043 4.90 6.17 4.55 54 BAYES_80 8982 3.61 6.13 2.89 55 XMNumbers 8247 3.67 5.63 3.11 56 LotsOfNums_01 7871 7.63 5.37 8.27 57 HTML_IMAGE_RATIO_08 7471 2.69 5.10 2.00 58 TM2_M_URI_OPT_OUT 6815 2.71 4.65 2.17 59 XM_DIRTYINTL 6811 2.41 4.65 1.78 60 RCVD_IN_RP_RNBL 6787 1.11 4.63 0.11 61 SpammyFromTLD_02 6392 1.19 4.36 0.29 62 HTML_IMAGE_RATIO_06 6266 3.35 4.28 3.09 63 URI_HEX 6217 2.23 4.24 1.66 64 MIME_HTML_ONLY_MULTI 6177 1.94 4.22 1.30 65 ALL_TRUSTED 5964 16.49 4.07 20.00 66 XM_SPF_SoftFail 5288 2.29 3.61 1.91 67 MIME_HTML_MOSTLY 4905 2.62 3.35 2.41 68 RCVD_IN_BL_SPAMCOP_NET 4872 1.10 3.32 0.47 69 HTML_MIME_NO_HTML_TAG 4870 2.51 3.32 2.28 70 BAYES_95 4826 1.83 3.29 1.42 71 RELAYCOUNTRY_CA 4816 1.93 3.29 1.55 72 XMStrtUSub 4742 4.35 3.24 4.67 73 XM_CamelCaseFrm001 4401 1.93 3.00 1.62 74 XM_URI_RBL 4350 0.91 2.97 0.33 75 T_REMOTE_IMAGE 4288 4.07 2.93 4.39 76 RCVD_IN_MSPIKE_H2 4141 4.23 2.83 4.63 77 XM_SendGrid 4072 4.60 2.78 5.11 78 MultiRelay_CC 4052 0.74 2.77 0.16 79 MultiRelay_Combo 4052 0.74 2.77 0.16 80 RELAYCOUNTRY_IN 3724 0.64 2.54 0.10 81 BOTNET_NORDNS 3671 0.59 2.51 0.04 82 XMDiploma_00 3636 1.75 2.48 1.54 83 T_TooManySym_01 3602 4.39 2.46 4.94 84 T_XMDrugObfuBody_08 3550 1.63 2.42 1.40 85 MIME_QP_LONG_LINE 3513 5.03 2.40 5.78 86 BAYES_40 3428 4.38 2.34 4.96 87 TM2_M_BODY_EMPTY 3426 1.13 2.34 0.78 88 XM_H_Long_From02 3384 1.32 2.31 1.04 89 TR_LOTS_OF_MONEY2 3380 0.84 2.31 0.43 90 T_MONEY_PERCENT 3380 0.84 2.31 0.43 91 XMEmptyBody_01 3312 0.87 2.26 0.48 92 XMSexyCombo_01 3157 0.87 2.15 0.51 93 TR_XM_RelayPhish 3052 0.86 2.08 0.52 94 RDNS_DYNAMIC 3017 0.76 2.06 0.39 95 BAYES_00 2954 13.30 2.02 16.49 96 XMSubMetaI_00 2913 1.10 1.99 0.84 97 UNPARSEABLE_RELAY 2894 2.76 1.97 2.98 98 XMBdyGiftCard01 2870 1.00 1.96 0.73 99 XM_OfRef6 2858 1.66 1.95 1.57 100 RCVD_IN_RP_SAFE 2845 6.82 1.94 8.20 101 SpammyFromTLD_01 2645 1.05 1.80 0.84 102 RELAYCOUNTRY_GB 2557 1.13 1.74 0.95 103 XM_H_PHPOS 2511 1.21 1.71 1.07 104 XM_UB60 2440 0.40 1.67 0.05 105 RELAYCOUNTRY_FR 2431 0.52 1.66 0.20 106 T_XMDrugObfuBody_00 2364 0.87 1.61 0.67 107 XMGenDplmaNmb 2322 1.12 1.58 0.99 108 MAILING_LIST_MULTI 2315 2.07 1.58 2.21 109 TM2_M_VERY_LONG_WORD 2307 1.16 1.57 1.05 110 TR_Mismatch_TLD_02 2292 0.39 1.56 0.06 111 RELAYCOUNTRY_CN 2266 0.39 1.55 0.06 112 NO_DNS_FOR_FROM 2245 0.59 1.53 0.32 113 TR_XM_DK_Bayes 2220 10.17 1.51 12.62 114 XMBody_17 2213 0.72 1.51 0.49 115 RCVD_IN_RP_CERTIFIED 2208 5.89 1.51 7.13 116 BAYES_20 2201 3.26 1.50 3.76 117 SUBJ_ALL_CAPS 2172 2.01 1.48 2.16 118 DKIM_ADSP_NXDOMAIN 2169 0.72 1.48 0.50 119 XM_UB99 2151 0.34 1.47 0.02 120 URIBL_BLACK 2140 0.38 1.46 0.08 121 XM_ProductURIs 2130 0.97 1.45 0.83 122 TR_XM_DK_Bayes1 2027 9.48 1.38 11.76 123 LongTLD 2027 0.41 1.38 0.13 124 TR_Symld_Words 1978 2.02 1.35 2.21 125 DATE_IN_PAST_03_06 1974 0.38 1.35 0.11 126 URIBL_DBL_SPAM 1907 0.32 1.30 0.04 127 DKIM_ADSP_CUSTOM_MED 1906 0.98 1.30 0.89 128 XMPhish30 1898 0.54 1.30 0.33 129 DIET_1 1882 0.61 1.28 0.42 130 T_XMHurry_00 1875 0.72 1.28 0.57 131 RELAYCOUNTRY_AT 1864 0.41 1.27 0.16 132 TVD_RCVD_IP 1833 2.29 1.25 2.58 133 DATE_IN_PAST_06_12 1832 0.29 1.25 0.02 134 XMStockSpam_06 1828 1.25 1.25 1.25 135 NML_ADSP_CUSTOM_MED 1818 0.73 1.24 0.58 136 HTML_IMAGE_ONLY_24 1806 0.57 1.23 0.38 137 HTML_FONT_FACE_BAD 1785 0.66 1.22 0.50 138 XMPhish14 1776 0.65 1.21 0.49 139 TR_XM_DK_Bayes2 1749 7.66 1.19 9.48 140 RCVD_IN_IADB_LISTED 1744 4.53 1.19 5.47 141 XMHTML_After_End 1731 0.59 1.18 0.43 142 HTML_IMAGE_ONLY_28 1728 0.53 1.18 0.34 143 MONEY_FRAUD_8 1698 0.26 1.16 0.00 144 XMBody_78 1670 0.55 1.14 0.38 145 XMPhish11 1634 1.13 1.12 1.14 146 T_FILL_THIS_FORM_SHORT 1574 0.94 1.07 0.90 147 T_Symld_Words_02 1569 0.65 1.07 0.53 148 PLING_QUERY 1559 0.52 1.06 0.36 149 XMClaimOffer 1555 0.34 1.06 0.13 150 NO_FM_NAME_IP_HOSTN 1519 0.23 1.04 0.00 151 XMSubMetaSSx_00 1519 0.43 1.04 0.26 152 XMSubMetaSxObfu_03 1496 0.55 1.02 0.41 153 XM_DK_Undo_01 1484 1.59 1.01 1.76 154 XM_HighProb1 1479 0.24 1.01 0.02 155 SUBJ_DOLLARS 1475 0.49 1.01 0.34 156 ANY_BOUNCE_MESSAGE 1447 2.94 0.99 3.49 157 BOUNCE_MESSAGE 1447 2.94 0.99 3.49 158 XM_RXBody 1432 0.45 0.98 0.30 159 XMSexyCombo_04 1431 0.35 0.98 0.17 160 XMGppyBdWords 1425 0.31 0.97 0.13 161 RCVD_IN_IADB_SPF 1377 3.96 0.94 4.81 162 FORGED_GMAIL_RCVD 1377 0.59 0.94 0.50 163 XM_UB80 1372 0.22 0.94 0.02 164 BODY_URI_ONLY 1372 0.29 0.94 0.10 165 RCVD_IN_IADB_SENDERID 1311 3.47 0.89 4.19 166 RCVD_IN_IADB_DK 1303 3.45 0.89 4.17 167 XMSlimDrugH 1279 0.53 0.87 0.44 168 BAYES_05 1261 2.05 0.86 2.38 169 XMMoneyMeta_00 1259 0.63 0.86 0.57 170 RELAYCOUNTRY_HK 1221 0.20 0.83 0.02 171 URI_TRY_3LD 1202 1.13 0.82 1.22 172 XM_PDF 1200 3.74 0.82 4.57 173 FROM_SUSPICIOUS_NTLD 1184 0.22 0.81 0.05 174 XM_Combo_Sbj 1153 0.35 0.79 0.22 175 T_TooManySym_02 1151 1.40 0.79 1.58 176 NUMERIC_HTTP_ADDR 1146 0.28 0.78 0.14 177 XMBrknScrpt_02 1145 0.61 0.78 0.56 178 HTTPS_HTTP_MISMATCH 1140 0.64 0.78 0.60 179 ADVANCE_FEE_5_NEW_MONEY 1139 0.17 0.78 0.00 180 XM_UB999 1116 0.18 0.76 0.01 181 URI_NOVOWEL 1101 0.53 0.75 0.46 182 URI_WP_HACKED_2 1101 0.95 0.75 1.01 183 XM_B_COPY_HTML 1092 0.47 0.75 0.39 184 RELAYCOUNTRY_DE 1076 0.58 0.73 0.54 185 TO_NO_BRKTS_HTML_ONLY 1069 0.31 0.73 0.19 186 LOW_PRICE 1069 0.69 0.73 0.68 187 TR_MetaPhish_Combo_01 1067 1.26 0.73 1.42 188 RCVD_IN_IADB_VOUCHED 1065 2.86 0.73 3.46 189 MIME_HEADER_CTYPE_ONLY 1054 0.26 0.72 0.13 190 MPART_ALT_DIFF_COUNT 1037 0.36 0.71 0.26 191 XM_B_REG_HTML 1015 0.62 0.69 0.60 192 XM_XX_Yahoo 1014 0.25 0.69 0.12 193 HTML_TAG_BALANCE_BODY 1013 0.52 0.69 0.47 194 LONG_HEX_URI 997 0.30 0.68 0.19 195 XMHTMLBadTable_001 996 0.46 0.68 0.39 196 RELAYCOUNTRY_ZA 996 0.15 0.68 0.00 197 XM_Body_Obfu01 996 0.34 0.68 0.24 198 XM_H_PHPMailer 973 0.65 0.66 0.65 199 TooManyTo_002 957 1.80 0.65 2.12 200 RCVD_IN_MSPIKE_WL 917 1.56 0.63 1.82 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 439621 86.18 91.19 84.76 2 DKIM_SIGNED 368766 72.05 75.42 71.10 3 XM_DK_Pass 361858 70.30 72.19 69.77 4 DKIM_VALID 339788 66.10 68.19 65.51 5 DCC_CHECK_NEGATIVE 307923 50.03 16.95 59.37 6 BAYES_50 303867 56.90 50.94 58.59 7 XMListUnsubscribeExists 248312 52.22 67.57 47.88 8 DKIM_VALID_AU 243624 48.81 55.31 46.97 9 XM_H_QuotedFrom 207550 43.27 54.81 40.02 10 DCC_CHECK 200961 48.17 81.51 38.75 11 T_TM2_M_HEADER_IN_MSG 155423 27.27 17.72 29.97 12 HTML_FONT_LOW_CONTRAST 133923 28.02 35.78 25.82 13 DKIM_VALID_EF 132681 24.25 19.53 25.58 14 XMSubLong 113931 23.12 27.22 21.97 15 LOC_TINY_FONT_1 108049 22.99 30.61 20.83 16 FVGT_m_MULTI_ODD 108009 21.30 22.98 20.82 17 ALL_TRUSTED 103723 16.49 4.07 20.00 18 MIME_HTML_ONLY 99083 22.15 32.92 19.10 19 STYLE_GIBBERISH 96941 19.34 21.66 18.69 20 MultiRelay 88889 16.37 13.63 17.14 21 BAYES_00 85541 13.30 2.02 16.49 22 T_KAM_HTML_FONT_INVALID 82895 16.09 16.49 15.98 23 TR_XM_DK_Bayes 65438 10.17 1.51 12.62 24 XM_Body_Dirty_Words 62153 13.48 18.77 11.98 25 XM_DKIMWhitelistDomains 61975 9.39 0.34 11.95 26 TR_XM_DK_Bayes1 61010 9.48 1.38 11.76 27 XM_Multi_Part_URI 55156 11.52 14.63 10.63 28 TR_XM_DK_Bayes2 49183 7.66 1.19 9.48 29 XM_Evil_Numbers_Gen 45415 10.03 14.53 8.76 30 LOTS_OF_MONEY 43419 10.64 18.67 8.37 31 TooManyTo_001 43372 7.99 6.68 8.36 32 LotsOfNums_01 42882 7.63 5.37 8.27 33 RCVD_IN_RP_SAFE 42520 6.82 1.94 8.20 34 HTML_IMAGE_RATIO_02 39980 9.42 15.49 7.71 35 T_XMDrugObfuBody_14 37697 7.61 8.80 7.27 36 RCVD_IN_RP_CERTIFIED 36988 5.89 1.51 7.13 37 FSL_BULK_SIG 36146 9.38 17.92 6.97 38 XM_DK_Undo_02 32980 11.89 31.45 6.36 39 MIME_QP_LONG_LINE 29962 5.03 2.40 5.78 40 DKIM_INVALID 28978 5.95 7.24 5.59 41 XM_B_Phish_Phrases 28733 5.89 7.12 5.54 42 HTML_IMAGE_RATIO_04 28669 6.00 7.69 5.53 43 XM_H_Long_From01 28486 6.37 9.47 5.49 44 RCVD_IN_IADB_LISTED 28381 4.53 1.19 5.47 45 XM_SendGrid 26528 4.60 2.78 5.11 46 RELAYCOUNTRY_META 25789 8.17 19.50 4.97 47 BAYES_40 25730 4.38 2.34 4.96 48 BAYES_99 25711 9.76 26.75 4.96 49 T_TooManySym_01 25614 4.39 2.46 4.94 50 RCVD_IN_IADB_SPF 24947 3.96 0.94 4.81 51 BOTNET_IPINHOSTNAME 24875 7.35 16.41 4.80 52 XMStrtUSub 24211 4.35 3.24 4.67 53 RCVD_IN_MSPIKE_H2 24006 4.23 2.83 4.63 54 XM_PDF 23686 3.74 0.82 4.57 55 BAYES_60 23578 4.90 6.17 4.55 56 T_REMOTE_IMAGE 22761 4.07 2.93 4.39 57 BAYES_999 21945 7.74 20.14 4.23 58 RCVD_IN_IADB_SENDERID 21755 3.47 0.89 4.19 59 XMSubMetaSx_00 21640 4.96 7.75 4.17 60 RCVD_IN_IADB_DK 21626 3.45 0.89 4.17 61 XMSexyCombo_05 20977 5.74 11.75 4.04 62 BAYES_20 19497 3.26 1.50 3.76 63 IN_ZIMBRA_NJ_WHITELIST 18919 2.85 0.02 3.65 64 ANY_BOUNCE_MESSAGE 18079 2.94 0.99 3.49 65 BOUNCE_MESSAGE 18078 2.94 0.99 3.49 66 RCVD_IN_IADB_VOUCHED 17951 2.86 0.73 3.46 67 FROM_EXCESS_BASE64 17588 4.48 8.33 3.39 68 XMNumbers 16135 3.67 5.63 3.11 69 MPART_ALT_DIFF 16122 4.25 8.31 3.11 70 HTML_IMAGE_RATIO_06 16016 3.35 4.28 3.09 71 XM_UncommonTLD01 15955 4.15 7.97 3.08 72 UNPARSEABLE_RELAY 15450 2.76 1.97 2.98 73 TR_DCC_Bayes_99 15112 6.72 20.17 2.91 74 BAYES_80 15007 3.61 6.13 2.89 75 TO_MALFORMED 14223 2.15 0.07 2.74 76 TVD_RCVD_IP 13397 2.29 1.25 2.58 77 MIME_HTML_MOSTLY 12497 2.62 3.35 2.41 78 BAYES_05 12362 2.05 0.86 2.38 79 HTML_MIME_NO_HTML_TAG 11827 2.51 3.32 2.28 80 RCVD_IN_IADB_OPTIN 11779 1.88 0.50 2.27 81 MAILING_LIST_MULTI 11479 2.07 1.58 2.21 82 TR_Symld_Words 11475 2.02 1.35 2.21 83 TM2_M_URI_OPT_OUT 11237 2.71 4.65 2.17 84 SUBJ_ALL_CAPS 11214 2.01 1.48 2.16 85 TooManyTo_002 11008 1.80 0.65 2.12 86 HTML_IMAGE_RATIO_08 10395 2.69 5.10 2.00 87 HELO_NODOT 9950 2.98 6.72 1.92 88 XM_SPF_SoftFail 9927 2.29 3.61 1.91 89 RCVD_IN_MSPIKE_WL 9428 1.56 0.63 1.82 90 RCVD_IN_MSPIKE_H3 9404 1.55 0.60 1.81 91 XM_DIRTYINTL 9221 2.41 4.65 1.78 92 XM_DK_Undo_01 9110 1.59 1.01 1.76 93 URI_HEX 8609 2.23 4.24 1.66 94 XM_CamelCaseFrm001 8411 1.93 3.00 1.62 95 T_TooManySym_02 8190 1.40 0.79 1.58 96 XM_OfRef6 8167 1.66 1.95 1.57 97 IN_HORDE_ADDRESS_BOOK 8079 1.22 0.02 1.56 98 BOTNET 8057 4.59 15.35 1.55 99 RELAYCOUNTRY_CA 8027 1.93 3.29 1.55 100 XMDiploma_00 7975 1.75 2.48 1.54 101 INVALID_MSGID 7620 1.17 0.10 1.47 102 BAYES_95 7363 1.83 3.29 1.42 103 TR_MetaPhish_Combo_01 7345 1.26 0.73 1.42 104 TooManyTo_003 7336 1.22 0.55 1.41 105 T_XMDrugObfuBody_08 7283 1.63 2.42 1.40 106 XMCapTrack 7105 1.13 0.30 1.37 107 UNTRUSTED_Relay 6778 3.95 13.31 1.31 108 MIME_HTML_ONLY_MULTI 6735 1.94 4.22 1.30 109 USER_IN_DEF_DKIM_WL 6546 1.01 0.10 1.26 110 XMStockSpam_06 6483 1.25 1.25 1.25 111 URI_TRY_3LD 6344 1.13 0.82 1.22 112 XMPhish11 5916 1.13 1.12 1.14 113 XM_GoogleGroups 5737 0.95 0.40 1.11 114 XM_H_PHPOS 5530 1.21 1.71 1.07 115 TM2_M_VERY_LONG_WORD 5421 1.16 1.57 1.05 116 TooManyTo_004 5400 0.90 0.40 1.04 117 XM_H_Long_From02 5390 1.32 2.31 1.04 118 URI_WP_HACKED_2 5234 0.95 0.75 1.01 119 XMGenDplmaNmb 5135 1.12 1.58 0.99 120 RELAYCOUNTRY_GB 4933 1.13 1.74 0.95 121 T_FILL_THIS_FORM_SHORT 4673 0.94 1.07 0.90 122 DKIM_ADSP_CUSTOM_MED 4603 0.98 1.30 0.89 123 XM_UB50 4480 2.35 7.61 0.86 124 T_OBFU_PDF_ATTACH 4476 0.73 0.24 0.86 125 TooManyTo_005 4432 0.75 0.36 0.85 126 XMSubMetaI_00 4375 1.10 1.99 0.84 127 SpammyFromTLD_01 4369 1.05 1.80 0.84 128 XM_ProductURIs 4327 0.97 1.45 0.83 129 URI_OPTOUT_3LD 4260 0.66 0.10 0.82 130 TM2_M_BODY_EMPTY 4065 1.13 2.34 0.78 131 XM_S_JOY_D 3960 2.19 7.26 0.76 132 XMBdyGiftCard01 3786 1.00 1.96 0.73 133 IMPOTENCE 3719 0.68 0.53 0.72 134 LOW_PRICE 3503 0.69 0.73 0.68 135 T_XMDrugObfuBody_00 3451 0.87 1.61 0.67 136 XM_H_PHPMailer 3368 0.65 0.66 0.65 137 XMLngstWrd_00 3253 0.58 0.40 0.63 138 USER_IN_WHITELIST 3185 0.48 0.00 0.61 139 FROM_GOV_SPOOF 3142 0.51 0.19 0.61 140 HTTPS_HTTP_MISMATCH 3099 0.64 0.78 0.60 141 XM_B_REG_HTML 3092 0.62 0.69 0.60 142 NML_ADSP_CUSTOM_MED 3019 0.73 1.24 0.58 143 XMNoVowels 2979 0.54 0.42 0.57 144 XMLngstWrd_01 2964 0.53 0.36 0.57 145 XMMoneyMeta_00 2963 0.63 0.86 0.57 146 T_XMHurry_00 2941 0.72 1.28 0.57 147 XMBrknScrpt_02 2890 0.61 0.78 0.56 148 FILL_THIS_FORM 2804 0.49 0.32 0.54 149 RELAYCOUNTRY_DE 2799 0.58 0.73 0.54 150 T_Symld_Words_02 2734 0.65 1.07 0.53 151 TR_XM_RelayPhish 2697 0.86 2.08 0.52 152 RELAYCOUNTRY_AU 2666 0.54 0.62 0.51 153 XMSexyCombo_01 2648 0.87 2.15 0.51 154 HTML_FONT_FACE_BAD 2610 0.66 1.22 0.50 155 DKIM_ADSP_NXDOMAIN 2594 0.72 1.48 0.50 156 MISSING_HEADERS 2581 1.82 6.51 0.50 157 FORGED_GMAIL_RCVD 2570 0.59 0.94 0.50 158 XMPhish14 2567 0.65 1.21 0.49 159 XMBody_17 2558 0.72 1.51 0.49 160 XMEmptyBody_01 2508 0.87 2.26 0.48 161 HTML_IMAGE_ONLY_32 2491 0.45 0.32 0.48 162 RCVD_IN_BL_SPAMCOP_NET 2440 1.10 3.32 0.47 163 HTML_TAG_BALANCE_BODY 2434 0.52 0.69 0.47 164 XMBody_95 2425 0.40 0.16 0.47 165 T_TooManySym_03 2403 0.40 0.16 0.46 166 URI_NOVOWEL 2400 0.53 0.75 0.46 167 SHORT_HELO_AND_INLINE_IMAGE 2392 0.37 0.06 0.46 168 T_FILL_THIS_FORM_LONG 2376 0.41 0.23 0.46 169 AC_DIV_BONANZA 2357 0.39 0.15 0.45 170 ONLINE_PHARMACY 2314 0.40 0.23 0.45 171 TR_LOTS_OF_MONEY3 2287 1.91 7.11 0.44 172 TM2_M_A_HREF_HREF 2284 0.48 0.60 0.44 173 XM_ShortIntro_01 2269 0.40 0.28 0.44 174 XMSlimDrugH 2258 0.53 0.87 0.44 175 XMGappySubj_01 2248 0.43 0.40 0.43 176 XMHTML_After_End 2220 0.59 1.18 0.43 177 TR_LOTS_OF_MONEY2 2211 0.84 2.31 0.43 178 T_MONEY_PERCENT 2211 0.84 2.31 0.43 179 T_MANY_PILL_PRICE 2194 0.33 0.00 0.42 180 DIET_1 2175 0.61 1.28 0.42 181 XMSubMetaSxObfu_03 2145 0.55 1.02 0.41 182 XMDateMe_00 2105 0.38 0.27 0.41 183 XMSubMetaSxObfu_02 2103 0.40 0.38 0.41 184 REMOVE_BEFORE_LINK 2074 0.43 0.52 0.40 185 XM_B_COPY_HTML 2039 0.47 0.75 0.39 186 XMHTMLBadTable_001 2038 0.46 0.68 0.39 187 RDNS_DYNAMIC 2009 0.76 2.06 0.39 188 XMBody_78 1990 0.55 1.14 0.38 189 RCVD_IN_SORBS_DUL 1983 0.36 0.30 0.38 190 XMSolicitRefs_0 1977 0.41 0.53 0.38 191 HTML_IMAGE_ONLY_24 1970 0.57 1.23 0.38 192 XM_H_PHPOS_M 1906 0.39 0.49 0.37 193 PLING_QUERY 1885 0.52 1.06 0.36 194 TVD_VISIT_PHARMA 1849 0.32 0.21 0.36 195 HTML_IMAGE_ONLY_28 1776 0.53 1.18 0.34 196 SUBJ_DOLLARS 1773 0.49 1.01 0.34 197 XMPhish30 1720 0.54 1.30 0.33 198 T_FROM_GOV_DKIM_AU 1696 0.28 0.11 0.33 199 XM_URI_RBL 1690 0.91 2.97 0.33 200 HTML_IMAGE_ONLY_16 1682 0.29 0.17 0.32 ----------------------------------------------------------------------