Email: 648821 Autolearn: 0 AvgScore: 1.80 AvgScanTime: 3.78 sec Spam: 134005 Autolearn: 0 AvgScore: 11.88 AvgScanTime: 4.44 sec Ham: 514816 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 3.61 sec Time Spent Running SA: 681.64 hours Time Spent Processing Spam: 165.16 hours Time Spent Processing Ham: 516.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 126994 89.30 94.77 87.87 2 DKIM_SIGNED 112532 77.34 83.98 75.61 3 DCC_CHECK 110741 49.16 82.64 40.45 4 XM_DK_Pass 109090 75.77 81.41 74.31 5 DKIM_VALID 103154 71.10 76.98 69.57 6 XMListUnsubscribeExists 100938 56.22 75.32 51.25 7 DKIM_VALID_AU 81752 51.50 61.01 49.02 8 XM_H_QuotedFrom 69539 41.76 51.89 39.13 9 BAYES_50 65148 56.37 48.62 58.39 10 HTML_FONT_LOW_CONTRAST 50706 30.09 37.84 28.07 11 LOC_TINY_FONT_1 50185 24.81 37.45 21.52 12 XM_DK_Undo_02 48842 13.10 36.45 7.02 13 MIME_HTML_ONLY 45131 22.44 33.68 19.51 14 FVGT_m_MULTI_ODD 38609 23.03 28.81 21.53 15 XMSubLong 38260 22.97 28.55 21.52 16 BAYES_99 37840 9.91 28.24 5.14 17 STYLE_GIBBERISH 34075 20.24 25.43 18.88 18 TR_DCC_Bayes_99 31538 7.28 23.53 3.05 19 BAYES_999 31124 8.26 23.23 4.37 20 XM_Body_Dirty_Words 29878 14.61 22.30 12.61 21 DKIM_VALID_EF 29234 26.12 21.82 27.24 22 T_KAM_HTML_FONT_INVALID 28193 18.14 21.04 17.39 23 T_TM2_M_HEADER_IN_MSG 25643 27.76 19.14 30.01 24 RELAYCOUNTRY_META 24832 7.86 18.53 5.08 25 HTML_IMAGE_RATIO_02 24357 10.07 18.18 7.97 26 MultiRelay 22389 17.71 16.71 17.97 27 XM_Multi_Part_URI 21720 12.52 16.21 11.56 28 BOTNET_IPINHOSTNAME 21224 7.23 15.84 4.98 29 DCC_CHECK_NEGATIVE 21088 48.98 15.74 57.63 30 BOTNET 20580 4.82 15.36 2.08 31 XM_Evil_Numbers_Gen 19983 9.40 14.91 7.97 32 FSL_BULK_SIG 16527 7.62 12.33 6.39 33 LOTS_OF_MONEY 16222 9.91 12.11 9.33 34 UNTRUSTED_Relay 15751 3.41 11.75 1.24 35 XMSexyCombo_05 15324 5.38 11.44 3.80 36 FROM_EXCESS_BASE64 13321 4.93 9.94 3.62 37 XMSubMetaSx_00 12460 5.11 9.30 4.02 38 HTML_IMAGE_RATIO_04 12142 6.62 9.06 5.98 39 T_XMDrugObfuBody_14 11684 7.92 8.72 7.72 40 XM_B_Phish_Phrases 11469 6.28 8.56 5.69 41 TooManyTo_001 10836 7.94 8.09 7.90 42 MPART_ALT_DIFF 10789 3.98 8.05 2.92 43 XM_H_Long_From01 10449 6.42 7.80 6.06 44 LotsOfNums_01 9468 8.23 7.07 8.54 45 DKIM_INVALID 9378 6.24 7.00 6.04 46 XM_UB50 9151 1.94 6.83 0.66 47 HTML_IMAGE_RATIO_06 8594 3.94 6.41 3.29 48 XM_UncommonTLD01 8565 3.75 6.39 3.06 49 BAYES_80 8411 3.20 6.28 2.41 50 BAYES_60 7523 4.80 5.61 4.58 51 XM_DIRTYINTL 7228 2.71 5.39 2.01 52 XMNumbers 7193 3.82 5.37 3.41 53 MIME_HTML_ONLY_MULTI 6586 2.25 4.91 1.56 54 TM2_M_URI_OPT_OUT 6397 2.62 4.77 2.06 55 URI_HEX 6200 2.31 4.63 1.71 56 XMStrtUSub 5923 5.11 4.42 5.29 57 XM_SPF_SoftFail 5124 2.34 3.82 1.95 58 RELAYCOUNTRY_CA 5097 2.06 3.80 1.60 59 MIME_HTML_MOSTLY 5059 2.60 3.78 2.30 60 MultiRelay_CC 4913 0.87 3.67 0.15 61 MultiRelay_Combo 4913 0.87 3.67 0.15 62 BAYES_95 4724 1.90 3.53 1.47 63 T_REMOTE_IMAGE 4708 4.21 3.51 4.39 64 RCVD_IN_RP_RNBL 4665 0.92 3.48 0.25 65 XM_CamelCaseFrm001 4581 2.30 3.42 2.01 66 HTML_IMAGE_RATIO_08 4465 2.40 3.33 2.16 67 XM_URI_RBL 4269 0.92 3.19 0.33 68 XMDiploma_00 4241 2.20 3.16 1.95 69 T_XMDrugObfuBody_08 4204 2.00 3.14 1.71 70 T_TooManySym_01 4153 4.69 3.10 5.11 71 MIME_QP_LONG_LINE 4106 5.43 3.06 6.05 72 XMSexyCombo_01 4075 1.35 3.04 0.90 73 HTML_MIME_NO_HTML_TAG 4021 2.29 3.00 2.10 74 RCVD_IN_MSPIKE_H2 3952 4.18 2.95 4.50 75 XM_SendGrid 3865 5.15 2.88 5.73 76 BAYES_40 3503 4.46 2.61 4.94 77 SpammyFromTLD_02 3426 0.80 2.56 0.34 78 RCVD_IN_RP_SAFE 3308 7.17 2.47 8.39 79 TM2_M_VERY_LONG_WORD 3176 1.22 2.37 0.92 80 BOTNET_NORDNS 3059 0.48 2.28 0.01 81 XM_OfRef6 3037 1.66 2.27 1.50 82 TR_XM_RelayPhish 3036 0.91 2.27 0.55 83 RCVD_IN_BL_SPAMCOP_NET 3019 0.89 2.25 0.53 84 XMGenDplmaNmb 2990 1.45 2.23 1.24 85 SUBJ_ALL_CAPS 2949 2.10 2.20 2.08 86 BAYES_20 2763 3.38 2.06 3.72 87 UNPARSEABLE_RELAY 2715 2.52 2.03 2.65 88 XM_H_Long_From02 2680 1.13 2.00 0.90 89 XMSubMetaI_00 2610 0.91 1.95 0.64 90 RCVD_IN_RP_CERTIFIED 2596 6.32 1.94 7.46 91 XM_S_JOY_D 2542 0.67 1.90 0.35 92 BAYES_00 2460 13.88 1.84 17.01 93 T_XMHurry_00 2420 0.90 1.81 0.67 94 MAILING_LIST_MULTI 2359 2.26 1.76 2.39 95 RELAYCOUNTRY_FR 2322 0.54 1.73 0.23 96 SpammyFromTLD_01 2315 0.96 1.73 0.77 97 T_FILL_THIS_FORM_SHORT 2310 1.02 1.72 0.84 98 XMPhish30 2306 0.68 1.72 0.41 99 URIBL_BLACK 2232 0.39 1.67 0.06 100 RELAYCOUNTRY_CN 2189 0.37 1.63 0.04 101 XMBdyGiftCard01 2188 1.07 1.63 0.92 102 DIET_1 2177 0.60 1.62 0.33 103 XMSubMetaSSx_00 2136 0.56 1.59 0.29 104 RCVD_IN_IADB_LISTED 2082 4.98 1.55 5.87 105 XM_UB60 2079 0.36 1.55 0.05 106 T_XMDrugObfuBody_00 2032 1.60 1.52 1.62 107 XMStockSpam_06 1963 1.21 1.46 1.15 108 XMHTML_After_End 1920 0.65 1.43 0.45 109 TR_Mismatch_TLD_02 1905 0.34 1.42 0.06 110 XMBody_17 1838 0.82 1.37 0.67 111 XMPhish11 1800 1.09 1.34 1.02 112 TR_XM_DK_Bayes 1790 10.92 1.34 13.42 113 TR_Symld_Words 1773 1.55 1.32 1.61 114 RELAYCOUNTRY_IN 1762 0.37 1.31 0.12 115 XM_ProductURIs 1761 0.96 1.31 0.87 116 RCVD_IN_IADB_SPF 1755 4.33 1.31 5.11 117 URIBL_DBL_SPAM 1741 0.31 1.30 0.05 118 DKIM_ADSP_CUSTOM_MED 1738 1.00 1.30 0.92 119 ALL_TRUSTED 1737 12.79 1.30 15.78 120 XM_H_PHPOS 1724 1.07 1.29 1.01 121 RCVD_IN_IADB_SENDERID 1667 3.80 1.24 4.46 122 NML_ADSP_CUSTOM_MED 1662 0.74 1.24 0.61 123 T_TooManySym_02 1662 1.44 1.24 1.49 124 RDNS_DYNAMIC 1657 0.57 1.24 0.40 125 RCVD_IN_IADB_DK 1638 3.75 1.22 4.41 126 BAYES_05 1633 2.10 1.22 2.34 127 XM_DK_Undo_01 1630 1.63 1.22 1.74 128 TR_LOTS_OF_MONEY2 1538 0.44 1.15 0.25 129 T_MONEY_PERCENT 1538 0.44 1.15 0.25 130 BODY_ENHANCEMENT 1535 0.24 1.15 0.01 131 XM_Body_Obfu01 1524 0.47 1.14 0.30 132 XMBody_78 1517 0.57 1.13 0.42 133 TooManyTo_002 1509 1.86 1.13 2.05 134 TR_XM_DK_Bayes1 1507 10.16 1.12 12.51 135 ANY_BOUNCE_MESSAGE 1488 2.32 1.11 2.63 136 BOUNCE_MESSAGE 1488 2.32 1.11 2.63 137 XMGppyBdWords 1459 0.37 1.09 0.18 138 T_Symld_Words_02 1457 0.79 1.09 0.71 139 RELAYCOUNTRY_GB 1422 1.01 1.06 1.00 140 RELAYCOUNTRY_NL 1418 0.34 1.06 0.15 141 MPART_ALT_DIFF_COUNT 1418 0.40 1.06 0.23 142 LOW_PRICE 1416 0.37 1.06 0.20 143 URI_TRY_3LD 1408 1.20 1.05 1.24 144 XMWhlSbjSex 1389 0.28 1.04 0.08 145 TM2_M_A_HREF_HREF 1386 0.72 1.03 0.64 146 TR_LOTS_OF_MONEY3 1357 0.65 1.01 0.56 147 HTML_FONT_FACE_BAD 1326 0.67 0.99 0.59 148 XM_UB99 1323 0.22 0.99 0.01 149 RELAYCOUNTRY_AT 1315 0.37 0.98 0.21 150 TooManyTo_003 1301 1.32 0.97 1.41 151 LongTLD 1291 0.32 0.96 0.15 152 TR_MetaPhish_Combo_01 1277 1.28 0.95 1.36 153 HELO_NODOT 1269 1.66 0.95 1.85 154 FROM_SUSPICIOUS_NTLD 1266 0.24 0.94 0.06 155 XMSubMetaSxObfu_03 1264 0.70 0.94 0.63 156 HTTPS_HTTP_MISMATCH 1237 0.64 0.92 0.56 157 RCVD_IN_IADB_VOUCHED 1192 3.16 0.89 3.75 158 HTML_TAG_BALANCE_BODY 1179 0.53 0.88 0.43 159 XMPhish14 1166 0.47 0.87 0.37 160 URI_NOVOWEL 1136 0.54 0.85 0.47 161 FORGED_GMAIL_RCVD 1125 0.59 0.84 0.52 162 LONG_HEX_URI 1117 0.32 0.83 0.18 163 TooManyTo_004 1110 1.00 0.83 1.05 164 RELAYCOUNTRY_AU 1102 0.56 0.82 0.49 165 XM_UB80 1093 0.18 0.82 0.01 166 XMSexyCombo_04 1081 0.29 0.81 0.15 167 XM_B_REG_HTML 1077 0.60 0.80 0.55 168 RCVD_IN_MSPIKE_WL 1069 1.57 0.80 1.77 169 SUBJ_DOLLARS 1065 0.49 0.79 0.41 170 XMSlimDrugH 1063 0.42 0.79 0.32 171 REMOVE_BEFORE_LINK 1061 0.47 0.79 0.38 172 RCVD_IN_MSPIKE_H3 1053 1.57 0.79 1.77 173 TooManyTo_005 1038 0.86 0.77 0.88 174 T_HTML_TAG_BALANCE_CENTER 1034 0.32 0.77 0.20 175 DATE_IN_PAST_03_06 1026 0.23 0.77 0.09 176 NUMERIC_HTTP_ADDR 1009 0.30 0.75 0.18 177 XM_PDF 1001 3.67 0.75 4.43 178 PLING_QUERY 996 0.59 0.74 0.55 179 XMHTMLBadTable_001 994 0.58 0.74 0.53 180 TR_XM_DK_Bayes2 992 8.09 0.74 10.01 181 TR_Mismatch_TLD_01 979 0.26 0.73 0.14 182 TR_Caps_n_Bayes_99 954 0.23 0.71 0.11 183 XM_B_COPY_HTML 944 0.52 0.70 0.47 184 MISSING_HEADERS 928 0.54 0.69 0.50 185 HTML_IMAGE_ONLY_28 928 0.43 0.69 0.36 186 RCVD_IN_IADB_OPTIN 914 2.07 0.68 2.43 187 XMMoneyMeta_00 905 0.73 0.68 0.74 188 XM_H_PHPMailer 902 0.68 0.67 0.68 189 NO_DNS_FOR_FROM 901 0.37 0.67 0.29 190 XM_UB999 897 0.15 0.67 0.01 191 RELAYCOUNTRY_KR 896 0.15 0.67 0.02 192 XM_RXBody 887 0.32 0.66 0.23 193 RELAYCOUNTRY_DE 864 0.40 0.64 0.33 194 XM_OfRef7 853 0.29 0.64 0.20 195 RCVD_IN_PSBL 824 0.15 0.61 0.03 196 BODY_URI_ONLY 821 0.20 0.61 0.10 197 XMNoVowels 817 0.61 0.61 0.61 198 XMBSHREFv2 777 0.27 0.58 0.19 199 XM_XX_Yahoo 766 0.19 0.57 0.09 200 XM_Attn_01 764 0.17 0.57 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 452372 89.30 94.77 87.87 2 DKIM_SIGNED 389250 77.34 83.98 75.61 3 XM_DK_Pass 382550 75.77 81.41 74.31 4 DKIM_VALID 358155 71.10 76.98 69.57 5 BAYES_50 300608 56.37 48.62 58.39 6 DCC_CHECK_NEGATIVE 296679 48.98 15.74 57.63 7 XMListUnsubscribeExists 263853 56.22 75.32 51.25 8 DKIM_VALID_AU 252382 51.50 61.01 49.02 9 DCC_CHECK 208232 49.16 82.64 40.45 10 XM_H_QuotedFrom 201424 41.76 51.89 39.13 11 T_TM2_M_HEADER_IN_MSG 154483 27.76 19.14 30.01 12 HTML_FONT_LOW_CONTRAST 144513 30.09 37.84 28.07 13 DKIM_VALID_EF 140215 26.12 21.82 27.24 14 FVGT_m_MULTI_ODD 110825 23.03 28.81 21.53 15 LOC_TINY_FONT_1 110787 24.81 37.45 21.52 16 XMSubLong 110764 22.97 28.55 21.52 17 MIME_HTML_ONLY 100453 22.44 33.68 19.51 18 STYLE_GIBBERISH 97217 20.24 25.43 18.88 19 MultiRelay 92523 17.71 16.71 17.97 20 T_KAM_HTML_FONT_INVALID 89520 18.14 21.04 17.39 21 BAYES_00 87572 13.88 1.84 17.01 22 ALL_TRUSTED 81241 12.79 1.30 15.78 23 TR_XM_DK_Bayes 69064 10.92 1.34 13.42 24 XM_Body_Dirty_Words 64898 14.61 22.30 12.61 25 TR_XM_DK_Bayes1 64409 10.16 1.12 12.51 26 XM_DKIMWhitelistDomains 62800 9.68 0.01 12.20 27 XM_Multi_Part_URI 59517 12.52 16.21 11.56 28 TR_XM_DK_Bayes2 51521 8.09 0.74 10.01 29 LOTS_OF_MONEY 48053 9.91 12.11 9.33 30 LotsOfNums_01 43949 8.23 7.07 8.54 31 RCVD_IN_RP_SAFE 43210 7.17 2.47 8.39 32 XM_Evil_Numbers_Gen 41024 9.40 14.91 7.97 33 HTML_IMAGE_RATIO_02 41007 10.07 18.18 7.97 34 TooManyTo_001 40676 7.94 8.09 7.90 35 T_XMDrugObfuBody_14 39734 7.92 8.72 7.72 36 RCVD_IN_RP_CERTIFIED 38380 6.32 1.94 7.46 37 XM_DK_Undo_02 36163 13.10 36.45 7.02 38 FSL_BULK_SIG 32881 7.62 12.33 6.39 39 XM_H_Long_From01 31177 6.42 7.80 6.06 40 MIME_QP_LONG_LINE 31154 5.43 3.06 6.05 41 DKIM_INVALID 31095 6.24 7.00 6.04 42 HTML_IMAGE_RATIO_04 30787 6.62 9.06 5.98 43 RCVD_IN_IADB_LISTED 30208 4.98 1.55 5.87 44 XM_SendGrid 29524 5.15 2.88 5.73 45 XM_B_Phish_Phrases 29277 6.28 8.56 5.69 46 XMStrtUSub 27210 5.11 4.42 5.29 47 BAYES_99 26467 9.91 28.24 5.14 48 RCVD_IN_IADB_SPF 26318 4.33 1.31 5.11 49 T_TooManySym_01 26298 4.69 3.10 5.11 50 RELAYCOUNTRY_META 26160 7.86 18.53 5.08 51 BOTNET_IPINHOSTNAME 25656 7.23 15.84 4.98 52 BAYES_40 25421 4.46 2.61 4.94 53 BAYES_60 23602 4.80 5.61 4.58 54 RCVD_IN_MSPIKE_H2 23148 4.18 2.95 4.50 55 RCVD_IN_IADB_SENDERID 22980 3.80 1.24 4.46 56 XM_PDF 22794 3.67 0.75 4.43 57 RCVD_IN_IADB_DK 22694 3.75 1.22 4.41 58 T_REMOTE_IMAGE 22576 4.21 3.51 4.39 59 BAYES_999 22497 8.26 23.23 4.37 60 XMSubMetaSx_00 20710 5.11 9.30 4.02 61 XMSexyCombo_05 19553 5.38 11.44 3.80 62 RCVD_IN_IADB_VOUCHED 19327 3.16 0.89 3.75 63 BAYES_20 19163 3.38 2.06 3.72 64 IN_ZIMBRA_NJ_WHITELIST 18872 2.92 0.03 3.67 65 FROM_EXCESS_BASE64 18661 4.93 9.94 3.62 66 XMNumbers 17577 3.82 5.37 3.41 67 HTML_IMAGE_RATIO_06 16963 3.94 6.41 3.29 68 XM_UncommonTLD01 15748 3.75 6.39 3.06 69 TR_DCC_Bayes_99 15713 7.28 23.53 3.05 70 MPART_ALT_DIFF 15013 3.98 8.05 2.92 71 TO_MALFORMED 14255 2.21 0.08 2.77 72 UNPARSEABLE_RELAY 13640 2.52 2.03 2.65 73 ANY_BOUNCE_MESSAGE 13565 2.32 1.11 2.63 74 BOUNCE_MESSAGE 13562 2.32 1.11 2.63 75 RCVD_IN_IADB_OPTIN 12503 2.07 0.68 2.43 76 BAYES_80 12382 3.20 6.28 2.41 77 MAILING_LIST_MULTI 12328 2.26 1.76 2.39 78 TVD_RCVD_IP 12130 1.96 0.44 2.36 79 BAYES_05 12023 2.10 1.22 2.34 80 MIME_HTML_MOSTLY 11835 2.60 3.78 2.30 81 HTML_IMAGE_RATIO_08 11128 2.40 3.33 2.16 82 HTML_MIME_NO_HTML_TAG 10814 2.29 3.00 2.10 83 BOTNET 10717 4.82 15.36 2.08 84 SUBJ_ALL_CAPS 10703 2.10 2.20 2.08 85 TM2_M_URI_OPT_OUT 10627 2.62 4.77 2.06 86 TooManyTo_002 10573 1.86 1.13 2.05 87 XM_DIRTYINTL 10343 2.71 5.39 2.01 88 XM_CamelCaseFrm001 10328 2.30 3.42 2.01 89 XM_SPF_SoftFail 10033 2.34 3.82 1.95 90 XMDiploma_00 10018 2.20 3.16 1.95 91 HELO_NODOT 9513 1.66 0.95 1.85 92 RCVD_IN_MSPIKE_WL 9120 1.57 0.80 1.77 93 RCVD_IN_MSPIKE_H3 9104 1.57 0.79 1.77 94 XM_DK_Undo_01 8977 1.63 1.22 1.74 95 T_XMDrugObfuBody_08 8797 2.00 3.14 1.71 96 URI_HEX 8786 2.31 4.63 1.71 97 IN_HORDE_ADDRESS_BOOK 8394 1.30 0.03 1.63 98 T_XMDrugObfuBody_00 8365 1.60 1.52 1.62 99 TR_Symld_Words 8293 1.55 1.32 1.61 100 RELAYCOUNTRY_CA 8251 2.06 3.80 1.60 101 MIME_HTML_ONLY_MULTI 8018 2.25 4.91 1.56 102 XM_OfRef6 7742 1.66 2.27 1.50 103 T_TooManySym_02 7662 1.44 1.24 1.49 104 BAYES_95 7578 1.90 3.53 1.47 105 INVALID_MSGID 7274 1.14 0.10 1.41 106 TooManyTo_003 7239 1.32 0.97 1.41 107 TR_MetaPhish_Combo_01 7025 1.28 0.95 1.36 108 XMCapTrack 6869 1.12 0.29 1.33 109 XMGenDplmaNmb 6391 1.45 2.23 1.24 110 UNTRUSTED_Relay 6390 3.41 11.75 1.24 111 USER_IN_DEF_DKIM_WL 6370 0.99 0.03 1.24 112 URI_TRY_3LD 6369 1.20 1.05 1.24 113 XM_GoogleGroups 5925 1.01 0.49 1.15 114 XMStockSpam_06 5908 1.21 1.46 1.15 115 TooManyTo_004 5397 1.00 0.83 1.05 116 XMPhish11 5257 1.09 1.34 1.02 117 XM_H_PHPOS 5208 1.07 1.29 1.01 118 RELAYCOUNTRY_GB 5143 1.01 1.06 1.00 119 DKIM_ADSP_CUSTOM_MED 4751 1.00 1.30 0.92 120 XMBdyGiftCard01 4731 1.07 1.63 0.92 121 TM2_M_VERY_LONG_WORD 4719 1.22 2.37 0.92 122 XMSexyCombo_01 4659 1.35 3.04 0.90 123 XM_H_Long_From02 4640 1.13 2.00 0.90 124 TooManyTo_005 4526 0.86 0.77 0.88 125 XM_ProductURIs 4477 0.96 1.31 0.87 126 T_FILL_THIS_FORM_SHORT 4300 1.02 1.72 0.84 127 SpammyFromTLD_01 3939 0.96 1.73 0.77 128 XMMoneyMeta_00 3821 0.73 0.68 0.74 129 T_Symld_Words_02 3655 0.79 1.09 0.71 130 XM_H_PHPMailer 3516 0.68 0.67 0.68 131 XMBody_17 3470 0.82 1.37 0.67 132 T_XMHurry_00 3451 0.90 1.81 0.67 133 T_OBFU_PDF_ATTACH 3444 0.57 0.20 0.67 134 XM_UB50 3411 1.94 6.83 0.66 135 TM2_M_A_HREF_HREF 3316 0.72 1.03 0.64 136 XMSubMetaI_00 3307 0.91 1.95 0.64 137 XMSubMetaSxObfu_03 3254 0.70 0.94 0.63 138 XMBody_95 3215 0.52 0.14 0.62 139 NML_ADSP_CUSTOM_MED 3136 0.74 1.24 0.61 140 XMNoVowels 3131 0.61 0.61 0.61 141 FILL_THIS_FORM 3115 0.54 0.31 0.61 142 HTML_FONT_FACE_BAD 3052 0.67 0.99 0.59 143 XMLngstWrd_00 3025 0.53 0.30 0.59 144 USER_IN_WHITELIST 3002 0.46 0.00 0.58 145 HTTPS_HTTP_MISMATCH 2896 0.64 0.92 0.56 146 TR_LOTS_OF_MONEY3 2888 0.65 1.01 0.56 147 XMBrknScrpt_02 2863 0.54 0.49 0.56 148 TR_XM_RelayPhish 2841 0.91 2.27 0.55 149 PLING_QUERY 2838 0.59 0.74 0.55 150 XM_B_REG_HTML 2838 0.60 0.80 0.55 151 XMLngstWrd_01 2790 0.49 0.28 0.54 152 XMHTMLBadTable_001 2753 0.58 0.74 0.53 153 RCVD_IN_BL_SPAMCOP_NET 2749 0.89 2.25 0.53 154 FORGED_GMAIL_RCVD 2687 0.59 0.84 0.52 155 FROM_GOV_SPOOF 2687 0.48 0.34 0.52 156 MISSING_HEADERS 2567 0.54 0.69 0.50 157 T_FILL_THIS_FORM_LONG 2560 0.44 0.22 0.50 158 RELAYCOUNTRY_AU 2535 0.56 0.82 0.49 159 T_TooManySym_03 2525 0.44 0.24 0.49 160 XM_B_COPY_HTML 2417 0.52 0.70 0.47 161 URI_NOVOWEL 2399 0.54 0.85 0.47 162 XMGappySubj_01 2380 0.48 0.53 0.46 163 DKIM_ADSP_NXDOMAIN 2321 0.47 0.52 0.45 164 XMHTML_After_End 2320 0.65 1.43 0.45 165 HTML_TAG_BALANCE_BODY 2231 0.53 0.88 0.43 166 HTML_IMAGE_ONLY_24 2221 0.44 0.48 0.43 167 SHORT_HELO_AND_INLINE_IMAGE 2207 0.35 0.05 0.43 168 XMBody_78 2163 0.57 1.13 0.42 169 XM_D_tchamptons_WL 2127 0.33 0.00 0.41 170 SUBJ_DOLLARS 2097 0.49 0.79 0.41 171 XM_ShortIntro_01 2089 0.42 0.48 0.41 172 XMPhish30 2086 0.68 1.72 0.41 173 TM2_M_BODY_EMPTY 2081 0.36 0.20 0.40 174 HTML_IMAGE_ONLY_32 2056 0.36 0.21 0.40 175 RDNS_DYNAMIC 2048 0.57 1.24 0.40 176 XMDateMe_00 2021 0.38 0.35 0.39 177 AC_DIV_BONANZA 1995 0.33 0.11 0.39 178 REMOVE_BEFORE_LINK 1979 0.47 0.79 0.38 179 XMSubMetaSxObfu_02 1970 0.35 0.24 0.38 180 XMPhish14 1895 0.47 0.87 0.37 181 RCVD_IN_SORBS_DUL 1868 0.35 0.30 0.36 182 UPPERCASE_50_75 1850 0.31 0.10 0.36 183 HTML_IMAGE_ONLY_28 1840 0.43 0.69 0.36 184 XM_S_JOY_D 1785 0.67 1.90 0.35 185 T_FROM_GOV_DKIM_AU 1753 0.30 0.16 0.34 186 SpammyFromTLD_02 1739 0.80 2.56 0.34 187 RELAYCOUNTRY_DE 1719 0.40 0.64 0.33 188 TVD_SPACE_RATIO 1719 0.32 0.28 0.33 189 XM_URI_RBL 1707 0.92 3.19 0.33 190 XMSolicitRefs_0 1705 0.33 0.32 0.33 191 DIET_1 1688 0.60 1.62 0.33 192 XMSlimDrugH 1646 0.42 0.79 0.32 193 XM_H_PHPOS_M 1598 0.32 0.37 0.31 194 FILL_THIS_FORM_LOAN 1591 0.27 0.10 0.31 195 XM_Body_Obfu01 1525 0.47 1.14 0.30 196 XMLngstWrd_02 1519 0.28 0.24 0.30 197 XMSubMetaSSx_00 1514 0.56 1.59 0.29 198 NO_DNS_FOR_FROM 1507 0.37 0.67 0.29 199 XMSubNoVowel 1473 0.32 0.44 0.29 200 HTML_IMAGE_ONLY_16 1443 0.33 0.54 0.28 ----------------------------------------------------------------------