Email: 636077 Autolearn: 0 AvgScore: 2.50 AvgScanTime: 3.48 sec Spam: 158229 Autolearn: 0 AvgScore: 12.03 AvgScanTime: 3.99 sec Ham: 477848 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 3.31 sec Time Spent Running SA: 615.00 hours Time Spent Processing Spam: 175.24 hours Time Spent Processing Ham: 439.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136430 86.68 86.22 86.83 2 DCC_CHECK 112896 45.59 71.35 37.05 3 DKIM_SIGNED 111800 70.30 70.66 70.19 4 XM_DK_Pass 108556 68.93 68.61 69.03 5 DKIM_VALID 101796 64.65 64.33 64.76 6 XMListUnsubscribeExists 97361 50.10 61.53 46.32 7 DKIM_VALID_AU 82913 47.91 52.40 46.43 8 BAYES_50 82777 57.03 52.31 58.60 9 XM_H_QuotedFrom 73771 41.20 46.62 39.40 10 MIME_HTML_ONLY 54601 22.78 34.51 18.89 11 HTML_FONT_LOW_CONTRAST 53144 26.77 33.59 24.51 12 LOC_TINY_FONT_1 49955 23.01 31.57 20.17 13 STYLE_GIBBERISH 49487 27.93 31.28 26.83 14 XM_DK_Undo_02 46200 12.29 29.20 6.69 15 DCC_CHECK_NEGATIVE 43034 52.54 27.20 60.93 16 XMSubLong 39716 21.64 25.10 20.50 17 RELAYCOUNTRY_META 36325 9.48 22.96 5.01 18 BAYES_99 36259 9.63 22.92 5.24 19 XM_Multi_Part_URI 36194 14.48 22.87 11.70 20 XM_Evil_Numbers_Gen 36105 12.24 22.82 8.73 21 FVGT_m_MULTI_ODD 35349 20.23 22.34 19.53 22 BOTNET 34282 6.71 21.67 1.75 23 TR_DCC_Bayes_99 29939 6.83 18.92 2.83 24 BAYES_999 29710 8.03 18.78 4.47 25 LOTS_OF_MONEY 29021 10.34 18.34 7.70 26 DKIM_VALID_EF 28662 23.82 18.11 25.71 27 T_TM2_M_HEADER_IN_MSG 28143 28.87 17.79 32.54 28 XM_Body_Dirty_Words 26460 13.23 16.72 12.08 29 UNTRUSTED_Relay 26167 5.02 16.54 1.21 30 T_KAM_HTML_FONT_INVALID 25432 15.63 16.07 15.48 31 HTML_IMAGE_RATIO_02 21799 9.57 13.78 8.17 32 MultiRelay 21697 16.90 13.71 17.96 33 BOTNET_IPINHOSTNAME 21562 6.79 13.63 4.53 34 FSL_BULK_SIG 20852 8.02 13.18 6.32 35 FROM_EXCESS_BASE64 19553 5.79 12.36 3.62 36 RCVD_IN_RP_RNBL 19002 3.10 12.01 0.15 37 XMSexyCombo_05 16231 5.38 10.26 3.76 38 ANY_BOUNCE_MESSAGE 15695 5.00 9.92 3.37 39 BOUNCE_MESSAGE 15695 5.00 9.92 3.37 40 TR_LOTS_OF_MONEY3 15185 2.70 9.60 0.42 41 T_XMDrugObfuBody_14 13794 8.09 8.72 7.88 42 T_REMOTE_IMAGE 13549 5.26 8.56 4.16 43 HTML_IMAGE_RATIO_04 13410 5.56 8.48 4.59 44 HTML_MIME_NO_HTML_TAG 12307 3.65 7.78 2.28 45 TooManyTo_001 12205 8.47 7.71 8.72 46 XM_UB50 12093 2.42 7.64 0.69 47 BAYES_80 11792 3.72 7.45 2.49 48 XM_UncommonTLD01 11664 4.17 7.37 3.11 49 XM_H_Long_From01 11616 6.18 7.34 5.80 50 XMSubMetaSx_00 11550 4.93 7.30 4.15 51 BAYES_60 11500 5.35 7.27 4.71 52 MPART_ALT_DIFF 11362 4.00 7.18 2.94 53 XMNumbers 11109 4.39 7.02 3.52 54 XM_B_Phish_Phrases 10364 5.67 6.55 5.37 55 DKIM_INVALID 10004 5.65 6.32 5.43 56 LotsOfNums_01 8989 7.36 5.68 7.91 57 MISSING_HEADERS 8723 1.79 5.51 0.56 58 HTML_IMAGE_RATIO_06 7671 3.57 4.85 3.15 59 BODY_URI_ONLY 7481 1.24 4.73 0.09 60 HTML_SHORT_LINK_IMG_1 7403 1.19 4.68 0.04 61 MIME_HEADER_CTYPE_ONLY 7024 1.21 4.44 0.14 62 SpammyFromTLD_02 6732 1.21 4.25 0.20 63 XMStrtUSub 6674 5.39 4.22 5.77 64 HTML_IMAGE_ONLY_04 6395 1.04 4.04 0.05 65 MIME_HTML_ONLY_MULTI 6152 1.90 3.89 1.24 66 URI_HEX 6141 2.01 3.88 1.40 67 RELAYCOUNTRY_DE 6108 1.22 3.86 0.34 68 HTML_SHORT_CENTER 6074 0.96 3.84 0.00 69 XM_DIRTYINTL 5999 2.32 3.79 1.83 70 TM2_M_URI_OPT_OUT 5899 2.41 3.73 1.98 71 MIME_HTML_MOSTLY 5844 2.92 3.69 2.67 72 XM_UB60 5594 0.91 3.54 0.05 73 BAYES_95 5529 1.98 3.49 1.47 74 XM_SPF_SoftFail 5083 2.64 3.21 2.46 75 XM_CamelCaseFrm001 4896 2.03 3.09 1.68 76 RCVD_IN_RP_SAFE 4847 7.21 3.06 8.58 77 RELAYCOUNTRY_CA 4768 1.87 3.01 1.49 78 MultiRelay_CC 4690 0.85 2.96 0.15 79 MultiRelay_Combo 4690 0.85 2.96 0.15 80 XMSubMetaI_00 4336 1.35 2.74 0.89 81 XM_SendGrid 4225 4.77 2.67 5.46 82 BOTNET_NORDNS 4128 0.67 2.61 0.02 83 UNPARSEABLE_RELAY 4031 2.57 2.55 2.58 84 RCVD_IN_MSPIKE_H2 3988 4.01 2.52 4.50 85 XM_UB80 3918 0.63 2.48 0.02 86 BAYES_40 3824 4.92 2.42 5.74 87 XMDiploma_00 3822 2.05 2.42 1.93 88 RELAYCOUNTRY_IN 3764 0.69 2.38 0.14 89 RELAYCOUNTRY_CN 3753 0.63 2.37 0.05 90 XM_URI_RBL 3736 0.87 2.36 0.38 91 SUBJ_ALL_CAPS 3638 1.83 2.30 1.68 92 RCVD_IN_RP_CERTIFIED 3522 6.32 2.23 7.67 93 RELAYCOUNTRY_GB 3440 1.34 2.17 1.06 94 XM_OfRef6 3421 1.92 2.16 1.83 95 RCVD_IN_BL_SPAMCOP_NET 3404 0.84 2.15 0.41 96 T_TooManySym_01 3376 4.79 2.13 5.67 97 MIME_QP_LONG_LINE 3349 4.68 2.12 5.53 98 DIET_1 3236 0.79 2.05 0.38 99 HTML_IMAGE_RATIO_08 3199 1.98 2.02 1.97 100 XMSexyCombo_01 3044 1.21 1.92 0.97 101 XMBdyGiftCard01 3038 1.43 1.92 1.27 102 BAYES_20 2873 3.10 1.82 3.52 103 T_XMDrugObfuBody_08 2862 1.34 1.81 1.19 104 MAILING_LIST_MULTI 2776 2.09 1.75 2.20 105 XM_ShortIntro_01 2693 0.96 1.70 0.71 106 HTML_IMAGE_ONLY_16 2639 0.63 1.67 0.28 107 TVD_SPACE_RATIO_MINFP 2596 0.41 1.64 0.01 108 FSL_THIS_IS_ADV 2553 0.42 1.61 0.02 109 XMGenDplmaNmb 2497 1.34 1.58 1.26 110 HOSTED_IMG_DIRECT_MX 2356 0.37 1.49 0.00 111 FROM_SUSPICIOUS_NTLD 2329 0.42 1.47 0.08 112 LOW_PRICE 2315 0.50 1.46 0.18 113 SUBJ_DOLLARS 2243 0.78 1.42 0.56 114 T_XMHurry_00 2167 0.77 1.37 0.57 115 XMStockSpam_06 2156 1.34 1.36 1.33 116 T_XMDrugObfuBody_00 2150 1.37 1.36 1.38 117 XMPhish30 2117 0.62 1.34 0.38 118 URIBL_BLACK 2109 0.37 1.33 0.05 119 BAYES_00 2094 12.24 1.32 15.85 120 HELO_NODOT 2087 1.94 1.32 2.15 121 XM_ProductURIs 2078 1.33 1.31 1.34 122 RELAYCOUNTRY_FR 2077 0.47 1.31 0.19 123 TooManyTo_002 2069 2.24 1.31 2.55 124 ALL_TRUSTED 2024 16.08 1.28 20.98 125 URIBL_DBL_SPAM 1993 0.34 1.26 0.04 126 TR_XM_RelayPhish 1987 0.73 1.26 0.55 127 RELAYCOUNTRY_AT 1979 0.50 1.25 0.25 128 SpammyFromTLD_01 1956 0.80 1.24 0.65 129 RELAYCOUNTRY_KR 1939 0.32 1.23 0.02 130 XMSubMetaSxObfu_03 1936 0.63 1.22 0.43 131 TM2_M_VERY_LONG_WORD 1916 0.89 1.21 0.79 132 RCVD_IN_IADB_LISTED 1895 4.18 1.20 5.17 133 TooManyTo_003 1891 1.63 1.20 1.78 134 XMPhish11 1852 1.10 1.17 1.07 135 XMHTML_After_End 1822 0.64 1.15 0.47 136 SHORTENER_SHORT_IMG 1782 0.28 1.13 0.00 137 URI_BUFFLY 1780 0.28 1.12 0.00 138 TooManyTo_004 1757 1.28 1.11 1.33 139 XM_H_PHPOS 1752 1.13 1.11 1.14 140 XMBody_78 1742 0.60 1.10 0.43 141 T_FILL_THIS_FORM_SHORT 1730 0.98 1.09 0.94 142 REPLYTO_WITHOUT_TO_CC 1691 0.35 1.07 0.11 143 HTML_FONT_FACE_BAD 1691 0.58 1.07 0.42 144 TooManyTo_005 1683 1.10 1.06 1.11 145 XM_UB99 1663 0.27 1.05 0.01 146 DATE_IN_PAST_06_12 1659 0.28 1.05 0.03 147 XM_B_REG_HTML 1657 0.59 1.05 0.44 148 XMSexyCombo_04 1623 0.73 1.03 0.63 149 DATE_IN_PAST_03_06 1600 0.32 1.01 0.09 150 XMBody_17 1595 0.68 1.01 0.58 151 BAYES_05 1580 2.03 1.00 2.37 152 TR_Symld_Words 1571 1.69 0.99 1.93 153 RCVD_IN_IADB_SPF 1563 3.67 0.99 4.55 154 TR_XM_DK_Bayes 1555 9.11 0.98 11.80 155 PLING_QUERY 1554 0.49 0.98 0.33 156 XMPhish14 1544 0.61 0.98 0.49 157 AMAZON_IMG_NOT_RCVD_AMZN 1535 0.27 0.97 0.04 158 RDNS_DYNAMIC 1523 0.54 0.96 0.40 159 TR_Mismatch_TLD_02 1490 0.27 0.94 0.05 160 BODY_ENHANCEMENT 1473 0.25 0.93 0.03 161 XM_DK_Undo_01 1464 1.64 0.93 1.87 162 RCVD_IN_IADB_SENDERID 1459 3.23 0.92 4.00 163 RCVD_IN_IADB_DK 1427 3.19 0.90 3.95 164 T_Symld_Words_02 1377 0.66 0.87 0.59 165 XMSubMetaI_01 1366 0.28 0.86 0.09 166 XM_UB95 1366 0.22 0.86 0.01 167 T_MONEY_PERCENT 1363 0.39 0.86 0.23 168 TR_LOTS_OF_MONEY2 1363 0.39 0.86 0.23 169 T_HTML_TAG_BALANCE_CENTER 1350 0.28 0.85 0.09 170 TR_XM_DK_Bayes1 1332 8.62 0.84 11.19 171 XM_H_Long_From02 1310 1.10 0.83 1.19 172 FILL_THIS_FORM 1308 0.55 0.83 0.46 173 RCVD_IN_IADB_VOUCHED 1301 2.74 0.82 3.37 174 HTML_OFF_PAGE 1289 0.21 0.81 0.01 175 ADMITS_SPAM 1275 0.24 0.81 0.05 176 DKIM_ADSP_NXDOMAIN 1262 0.55 0.80 0.47 177 XMMoneyMeta_00 1226 0.60 0.77 0.54 178 DKIM_ADSP_CUSTOM_MED 1222 0.97 0.77 1.04 179 XM_PDF 1218 3.83 0.77 4.84 180 URI_TRY_3LD 1207 1.09 0.76 1.20 181 FILL_THIS_FORM_LONG 1205 0.46 0.76 0.36 182 HTTPS_HTTP_MISMATCH 1205 0.52 0.76 0.43 183 NO_DNS_FOR_FROM 1179 0.42 0.75 0.32 184 LongTLD 1151 0.32 0.73 0.19 185 NML_ADSP_CUSTOM_MED 1149 0.78 0.73 0.79 186 T_TooManySym_02 1146 1.92 0.72 2.31 187 TR_XM_DK_Bayes2 1141 7.33 0.72 9.51 188 REMOVE_BEFORE_LINK 1141 0.32 0.72 0.19 189 XMHTMLBadTable_001 1099 0.60 0.69 0.56 190 XM_B_COPY_HTML 1062 0.53 0.67 0.49 191 XMSubMetaSSx_00 1049 0.68 0.66 0.68 192 XM_RXBody 1039 0.31 0.66 0.20 193 XMGppyBdWords 1036 0.26 0.65 0.13 194 HTML_TAG_BALANCE_BODY 1003 0.45 0.63 0.39 195 FORGED_GMAIL_RCVD 1002 0.60 0.63 0.58 196 RCVD_IN_IADB_OPTIN 990 1.72 0.63 2.08 197 HTML_FONT_SIZE_LARGE 988 0.29 0.62 0.17 198 XM_HighProb1 981 0.16 0.62 0.00 199 XM_H_PHPMailer 980 0.88 0.62 0.96 200 FILL_THIS_FORM_LOAN 979 0.40 0.62 0.33 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 414936 86.68 86.22 86.83 2 DKIM_SIGNED 335381 70.30 70.66 70.19 3 XM_DK_Pass 329873 68.93 68.61 69.03 4 DKIM_VALID 309456 64.65 64.33 64.76 5 DCC_CHECK_NEGATIVE 291158 52.54 27.20 60.93 6 BAYES_50 279997 57.03 52.31 58.60 7 DKIM_VALID_AU 221858 47.91 52.40 46.43 8 XMListUnsubscribeExists 221342 50.10 61.53 46.32 9 XM_H_QuotedFrom 188283 41.20 46.62 39.40 10 DCC_CHECK 177060 45.59 71.35 37.05 11 T_TM2_M_HEADER_IN_MSG 155513 28.87 17.79 32.54 12 STYLE_GIBBERISH 128185 27.93 31.28 26.83 13 DKIM_VALID_EF 122848 23.82 18.11 25.71 14 HTML_FONT_LOW_CONTRAST 117126 26.77 33.59 24.51 15 ALL_TRUSTED 100239 16.08 1.28 20.98 16 XMSubLong 97953 21.64 25.10 20.50 17 LOC_TINY_FONT_1 96398 23.01 31.57 20.17 18 FVGT_m_MULTI_ODD 93305 20.23 22.34 19.53 19 MIME_HTML_ONLY 90269 22.78 34.51 18.89 20 MultiRelay 85814 16.90 13.71 17.96 21 BAYES_00 75754 12.24 1.32 15.85 22 T_KAM_HTML_FONT_INVALID 73979 15.63 16.07 15.48 23 XM_Body_Dirty_Words 57718 13.23 16.72 12.08 24 TR_XM_DK_Bayes 56385 9.11 0.98 11.80 25 XM_Multi_Part_URI 55891 14.48 22.87 11.70 26 TR_XM_DK_Bayes1 53495 8.62 0.84 11.19 27 XM_DKIMWhitelistDomains 53047 8.36 0.06 11.10 28 TR_XM_DK_Bayes2 45465 7.33 0.72 9.51 29 XM_Evil_Numbers_Gen 41722 12.24 22.82 8.73 30 TooManyTo_001 41687 8.47 7.71 8.72 31 RCVD_IN_RP_SAFE 41011 7.21 3.06 8.58 32 HTML_IMAGE_RATIO_02 39061 9.57 13.78 8.17 33 LotsOfNums_01 37808 7.36 5.68 7.91 34 T_XMDrugObfuBody_14 37668 8.09 8.72 7.88 35 LOTS_OF_MONEY 36771 10.34 18.34 7.70 36 RCVD_IN_RP_CERTIFIED 36652 6.32 2.23 7.67 37 XM_DK_Undo_02 31946 12.29 29.20 6.69 38 FSL_BULK_SIG 30182 8.02 13.18 6.32 39 XM_H_Long_From01 27703 6.18 7.34 5.80 40 XMStrtUSub 27585 5.39 4.22 5.77 41 BAYES_40 27449 4.92 2.42 5.74 42 T_TooManySym_01 27105 4.79 2.13 5.67 43 MIME_QP_LONG_LINE 26446 4.68 2.12 5.53 44 XM_SendGrid 26110 4.77 2.67 5.46 45 DKIM_INVALID 25925 5.65 6.32 5.43 46 XM_B_Phish_Phrases 25676 5.67 6.55 5.37 47 BAYES_99 25023 9.63 22.92 5.24 48 RCVD_IN_IADB_LISTED 24698 4.18 1.20 5.17 49 RELAYCOUNTRY_META 23957 9.48 22.96 5.01 50 XM_PDF 23112 3.83 0.77 4.84 51 BAYES_60 22519 5.35 7.27 4.71 52 HTML_IMAGE_RATIO_04 21954 5.56 8.48 4.59 53 RCVD_IN_IADB_SPF 21753 3.67 0.99 4.55 54 BOTNET_IPINHOSTNAME 21637 6.79 13.63 4.53 55 RCVD_IN_MSPIKE_H2 21508 4.01 2.52 4.50 56 BAYES_999 21338 8.03 18.78 4.47 57 T_REMOTE_IMAGE 19897 5.26 8.56 4.16 58 XMSubMetaSx_00 19821 4.93 7.30 4.15 59 RCVD_IN_IADB_SENDERID 19107 3.23 0.92 4.00 60 RCVD_IN_IADB_DK 18867 3.19 0.90 3.95 61 XMSexyCombo_05 17972 5.38 10.26 3.76 62 IN_ZIMBRA_NJ_WHITELIST 17968 2.83 0.02 3.76 63 FROM_EXCESS_BASE64 17295 5.79 12.36 3.62 64 BAYES_20 16837 3.10 1.82 3.52 65 XMNumbers 16832 4.39 7.02 3.52 66 RCVD_IN_IADB_VOUCHED 16122 2.74 0.82 3.37 67 ANY_BOUNCE_MESSAGE 16094 5.00 9.92 3.37 68 BOUNCE_MESSAGE 16081 5.00 9.92 3.37 69 HTML_IMAGE_RATIO_06 15029 3.57 4.85 3.15 70 XM_UncommonTLD01 14859 4.17 7.37 3.11 71 MPART_ALT_DIFF 14057 4.00 7.18 2.94 72 TO_MALFORMED 13886 2.19 0.05 2.91 73 TR_DCC_Bayes_99 13532 6.83 18.92 2.83 74 MIME_HTML_MOSTLY 12754 2.92 3.69 2.67 75 UNPARSEABLE_RELAY 12321 2.57 2.55 2.58 76 TooManyTo_002 12209 2.24 1.31 2.55 77 BAYES_80 11880 3.72 7.45 2.49 78 XM_SPF_SoftFail 11735 2.64 3.21 2.46 79 BAYES_05 11347 2.03 1.00 2.37 80 T_TooManySym_02 11045 1.92 0.72 2.31 81 HTML_MIME_NO_HTML_TAG 10890 3.65 7.78 2.28 82 TVD_RCVD_IP 10669 1.76 0.32 2.23 83 MAILING_LIST_MULTI 10534 2.09 1.75 2.20 84 HELO_NODOT 10268 1.94 1.32 2.15 85 RCVD_IN_IADB_OPTIN 9962 1.72 0.63 2.08 86 TM2_M_URI_OPT_OUT 9453 2.41 3.73 1.98 87 HTML_IMAGE_RATIO_08 9404 1.98 2.02 1.97 88 XMDiploma_00 9246 2.05 2.42 1.93 89 TR_Symld_Words 9204 1.69 0.99 1.93 90 XM_DK_Undo_01 8943 1.64 0.93 1.87 91 XM_OfRef6 8767 1.92 2.16 1.83 92 XM_DIRTYINTL 8738 2.32 3.79 1.83 93 TooManyTo_003 8499 1.63 1.20 1.78 94 BOTNET 8386 6.71 21.67 1.75 95 RCVD_IN_MSPIKE_WL 8322 1.41 0.43 1.74 96 RCVD_IN_MSPIKE_H3 8305 1.40 0.39 1.74 97 SUBJ_ALL_CAPS 8033 1.83 2.30 1.68 98 XM_CamelCaseFrm001 8004 2.03 3.09 1.68 99 IN_HORDE_ADDRESS_BOOK 7877 1.25 0.06 1.65 100 INVALID_MSGID 7141 1.25 0.50 1.49 101 RELAYCOUNTRY_CA 7100 1.87 3.01 1.49 102 BAYES_95 7039 1.98 3.49 1.47 103 XMCapTrack 7035 1.17 0.26 1.47 104 URI_HEX 6667 2.01 3.88 1.40 105 TR_MetaPhish_Combo_01 6602 1.16 0.48 1.38 106 T_XMDrugObfuBody_00 6593 1.37 1.36 1.38 107 XM_ProductURIs 6389 1.33 1.31 1.34 108 TooManyTo_004 6357 1.28 1.11 1.33 109 XMStockSpam_06 6356 1.34 1.36 1.33 110 XMBdyGiftCard01 6053 1.43 1.92 1.27 111 XMGenDplmaNmb 6018 1.34 1.58 1.26 112 MIME_HTML_ONLY_MULTI 5934 1.90 3.89 1.24 113 USER_IN_DEF_DKIM_WL 5840 0.94 0.08 1.22 114 XM_GoogleGroups 5793 1.01 0.42 1.21 115 UNTRUSTED_Relay 5780 5.02 16.54 1.21 116 URI_TRY_3LD 5751 1.09 0.76 1.20 117 T_XMDrugObfuBody_08 5673 1.34 1.81 1.19 118 XM_H_Long_From02 5669 1.10 0.83 1.19 119 XM_H_PHPOS 5438 1.13 1.11 1.14 120 TooManyTo_005 5314 1.10 1.06 1.11 121 XMPhish11 5118 1.10 1.17 1.07 122 RELAYCOUNTRY_GB 5077 1.34 2.17 1.06 123 DKIM_ADSP_CUSTOM_MED 4979 0.97 0.77 1.04 124 XMSexyCombo_01 4652 1.21 1.92 0.97 125 XM_H_PHPMailer 4608 0.88 0.62 0.96 126 T_FILL_THIS_FORM_SHORT 4504 0.98 1.09 0.94 127 XMSubMetaI_00 4233 1.35 2.74 0.89 128 NML_ADSP_CUSTOM_MED 3781 0.78 0.73 0.79 129 TM2_M_VERY_LONG_WORD 3771 0.89 1.21 0.79 130 XM_ShortIntro_01 3391 0.96 1.70 0.71 131 XM_UB50 3319 2.42 7.64 0.69 132 XMBrknScrpt_02 3286 0.64 0.48 0.69 133 XMSubMetaSSx_00 3272 0.68 0.66 0.68 134 XMBody_95 3197 0.54 0.13 0.67 135 T_OBFU_PDF_ATTACH 3176 0.55 0.21 0.66 136 SpammyFromTLD_01 3128 0.80 1.24 0.65 137 XMSexyCombo_04 3001 0.73 1.03 0.63 138 XMNoVowels 2972 0.59 0.51 0.62 139 XMLngstWrd_00 2851 0.55 0.43 0.60 140 T_Symld_Words_02 2804 0.66 0.87 0.59 141 FORGED_GMAIL_RCVD 2793 0.60 0.63 0.58 142 XMBody_17 2761 0.68 1.01 0.58 143 T_XMHurry_00 2715 0.77 1.37 0.57 144 XMHTMLBadTable_001 2696 0.60 0.69 0.56 145 SUBJ_DOLLARS 2689 0.78 1.42 0.56 146 MISSING_HEADERS 2668 1.79 5.51 0.56 147 USER_IN_WHITELIST 2668 0.42 0.00 0.56 148 TR_XM_RelayPhish 2650 0.73 1.26 0.55 149 XMLngstWrd_01 2589 0.50 0.39 0.54 150 XMMoneyMeta_00 2573 0.60 0.77 0.54 151 AC_DIV_BONANZA 2503 0.44 0.18 0.52 152 T_TooManySym_03 2479 0.43 0.15 0.52 153 FROM_GOV_SPOOF 2461 0.44 0.20 0.52 154 XMGappySubj_01 2364 0.46 0.35 0.49 155 SHORT_HELO_AND_INLINE_IMAGE 2353 0.39 0.07 0.49 156 XMPhish14 2342 0.61 0.98 0.49 157 XM_B_COPY_HTML 2330 0.53 0.67 0.49 158 RCVD_IN_SORBS_DUL 2325 0.43 0.27 0.49 159 URI_NOVOWEL 2276 0.51 0.61 0.48 160 DKIM_ADSP_NXDOMAIN 2256 0.55 0.80 0.47 161 XM_S_JOY_D 2245 0.50 0.58 0.47 162 XMHTML_After_End 2239 0.64 1.15 0.47 163 FILL_THIS_FORM 2206 0.55 0.83 0.46 164 XMSexyCombo_02 2169 0.40 0.22 0.45 165 XM_Body_Dirty_Words_01 2146 0.39 0.23 0.45 166 XM_B_REG_HTML 2104 0.59 1.05 0.44 167 T_MANY_PILL_PRICE 2099 0.34 0.05 0.44 168 XMDateMe_00 2083 0.41 0.31 0.44 169 HTTPS_HTTP_MISMATCH 2077 0.52 0.76 0.43 170 XMSubMetaSxObfu_03 2074 0.63 1.22 0.43 171 XM_H_PHPOS_M 2064 0.43 0.41 0.43 172 XMBody_78 2063 0.60 1.10 0.43 173 TM2_M_BODY_EMPTY 2058 0.36 0.13 0.43 174 FORGED_MUA_OUTLOOK 2052 0.34 0.07 0.43 175 TR_LOTS_OF_MONEY3 1989 2.70 9.60 0.42 176 HTML_FONT_FACE_BAD 1988 0.58 1.07 0.42 177 MSOE_MID_WRONG_CASE 1977 0.32 0.04 0.41 178 RCVD_IN_BL_SPAMCOP_NET 1968 0.84 2.15 0.41 179 RELAYCOUNTRY_AU 1947 0.42 0.47 0.41 180 FORGED_OUTLOOK_HTML 1945 0.32 0.05 0.41 181 HTML_IMAGE_ONLY_32 1919 0.36 0.23 0.40 182 RDNS_DYNAMIC 1916 0.54 0.96 0.40 183 HTML_TAG_BALANCE_BODY 1880 0.45 0.63 0.39 184 XMSubMetaSxObfu_02 1872 0.39 0.40 0.39 185 HTML_IMAGE_ONLY_28 1846 0.43 0.57 0.39 186 XMPhish30 1829 0.62 1.34 0.38 187 XM_URI_RBL 1808 0.87 2.36 0.38 188 DIET_1 1795 0.79 2.05 0.38 189 TVD_SPACE_RATIO 1745 0.35 0.30 0.37 190 FILL_THIS_FORM_LONG 1718 0.46 0.76 0.36 191 HTML_IMAGE_ONLY_24 1654 0.36 0.40 0.35 192 RELAYCOUNTRY_DE 1638 1.22 3.86 0.34 193 FILL_THIS_FORM_LOAN 1586 0.40 0.62 0.33 194 XM_Combo_Sbj 1570 0.32 0.28 0.33 195 PLING_QUERY 1562 0.49 0.98 0.33 196 XMSubNoVowel 1539 0.38 0.54 0.32 197 NO_DNS_FOR_FROM 1516 0.42 0.75 0.32 198 HTML_IMAGE_ONLY_20 1480 0.30 0.26 0.31 199 XMLngstWrd_02 1468 0.30 0.29 0.31 200 XM_B_TRADE_HTML 1468 0.31 0.32 0.31 ----------------------------------------------------------------------