Email: 673554 Autolearn: 0 AvgScore: 2.92 AvgScanTime: 3.67 sec Spam: 181481 Autolearn: 0 AvgScore: 12.31 AvgScanTime: 4.10 sec Ham: 492073 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 3.51 sec Time Spent Running SA: 687.00 hours Time Spent Processing Spam: 206.68 hours Time Spent Processing Ham: 480.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154562 86.85 85.17 87.46 2 DCC_CHECK 126943 47.57 69.95 39.32 3 DKIM_SIGNED 122365 70.64 67.43 71.83 4 XM_DK_Pass 116195 68.78 64.03 70.54 5 XMListUnsubscribeExists 113180 52.01 62.36 48.19 6 DKIM_VALID 109203 64.71 60.17 66.39 7 BAYES_50 88594 55.35 48.82 57.76 8 DKIM_VALID_AU 86852 47.73 47.86 47.68 9 XM_H_QuotedFrom 75960 40.86 41.86 40.49 10 MIME_HTML_ONLY 63643 23.37 35.07 19.06 11 HTML_FONT_LOW_CONTRAST 57937 27.61 31.92 26.02 12 LOC_TINY_FONT_1 53927 22.67 29.71 20.07 13 STYLE_GIBBERISH 53161 27.70 29.29 27.11 14 XM_DK_Undo_02 52393 12.95 28.87 7.08 15 DCC_CHECK_NEGATIVE 51190 50.34 28.21 58.50 16 BOTNET 46333 8.88 25.53 2.74 17 XMSubLong 44996 22.20 24.79 21.24 18 FVGT_m_MULTI_ODD 42201 21.22 23.25 20.47 19 BAYES_99 41622 9.98 22.93 5.20 20 XM_Evil_Numbers_Gen 39776 11.90 21.92 8.21 21 LOTS_OF_MONEY 39601 12.24 21.82 8.70 22 RELAYCOUNTRY_META 38338 9.43 21.13 5.11 23 TR_DCC_Bayes_99 34048 7.26 18.76 3.02 24 BAYES_999 34002 8.27 18.74 4.41 25 BOTNET_IPINHOSTNAME 32443 8.34 17.88 4.82 26 XM_Multi_Part_URI 31853 13.42 17.55 11.90 27 T_KAM_HTML_FONT_INVALID 31059 16.12 17.11 15.75 28 DKIM_VALID_EF 30920 23.61 17.04 26.03 29 XM_Body_Dirty_Words 29771 13.33 16.40 12.19 30 T_TM2_M_HEADER_IN_MSG 27343 26.92 15.07 31.30 31 UNTRUSTED_Relay 26907 5.03 14.83 1.42 32 RCVD_IN_RP_RNBL 26506 4.51 14.61 0.79 33 MultiRelay 25555 16.59 14.08 17.51 34 XM_UncommonTLD01 22697 5.64 12.51 3.10 35 ANY_BOUNCE_MESSAGE 21552 5.77 11.88 3.51 36 BOUNCE_MESSAGE 21547 5.76 11.87 3.51 37 HTML_IMAGE_RATIO_02 21050 8.41 11.60 7.24 38 TR_LOTS_OF_MONEY3 20880 3.61 11.51 0.70 39 FSL_BULK_SIG 19484 7.67 10.74 6.53 40 FROM_EXCESS_BASE64 19306 5.35 10.64 3.40 41 XMSexyCombo_05 17413 5.48 9.59 3.97 42 XM_H_Long_From01 17162 6.71 9.46 5.69 43 HTML_IMAGE_RATIO_04 16605 6.97 9.15 6.16 44 BAYES_60 15432 5.93 8.50 4.97 45 BAYES_80 15181 4.40 8.37 2.94 46 T_XMDrugObfuBody_14 14604 8.39 8.05 8.51 47 XMSubMetaSx_00 13198 5.07 7.27 4.26 48 DKIM_INVALID 13162 5.93 7.25 5.44 49 SpammyFromTLD_02 13044 2.18 7.19 0.34 50 HTML_MIME_NO_HTML_TAG 12750 3.70 7.03 2.47 51 TooManyTo_001 12498 7.77 6.89 8.10 52 MPART_ALT_DIFF 12010 4.00 6.62 3.04 53 XM_B_Phish_Phrases 11741 6.07 6.47 5.92 54 T_REMOTE_IMAGE 11721 4.83 6.46 4.23 55 XMNumbers 10828 4.40 5.97 3.83 56 XM_UB50 10254 2.14 5.65 0.84 57 MISSING_HEADERS 9074 1.65 5.00 0.42 58 XM_SPF_SoftFail 8835 2.76 4.87 1.98 59 BODY_URI_ONLY 8594 1.34 4.74 0.08 60 LotsOfNums_01 8544 7.52 4.71 8.56 61 RELAYCOUNTRY_DE 8483 1.57 4.67 0.42 62 HTML_SHORT_LINK_IMG_1 8186 1.24 4.51 0.03 63 MIME_HEADER_CTYPE_ONLY 7820 1.24 4.31 0.11 64 HTML_IMAGE_ONLY_04 7688 1.18 4.24 0.05 65 HTML_SHORT_CENTER 7348 1.09 4.05 0.00 66 MIME_HTML_ONLY_MULTI 7085 2.15 3.90 1.50 67 BAYES_95 6934 2.19 3.82 1.59 68 XM_UB60 6661 1.06 3.67 0.10 69 URI_HEX 6505 2.28 3.58 1.80 70 TM2_M_URI_OPT_OUT 6470 2.37 3.57 1.92 71 MIME_HTML_MOSTLY 6420 2.60 3.54 2.25 72 XM_DIRTYINTL 6320 2.29 3.48 1.86 73 HTML_IMAGE_RATIO_06 6084 3.31 3.35 3.29 74 MultiRelay_CC 5814 0.99 3.20 0.17 75 MultiRelay_Combo 5814 0.99 3.20 0.17 76 XM_SendGrid 5754 4.95 3.17 5.61 77 RCVD_IN_BL_SPAMCOP_NET 5593 1.13 3.08 0.41 78 RELAYCOUNTRY_CA 5366 1.95 2.96 1.57 79 BOTNET_NORDNS 5302 0.81 2.92 0.04 80 XMStrtUSub 5263 4.73 2.90 5.40 81 XM_CamelCaseFrm001 5144 1.93 2.83 1.59 82 XM_OfRef6 5055 1.67 2.79 1.26 83 MIME_QP_LONG_LINE 4945 5.02 2.72 5.86 84 RCVD_IN_RP_SAFE 4770 6.80 2.63 8.34 85 HTML_IMAGE_ONLY_28 4692 0.98 2.59 0.39 86 RELAYCOUNTRY_CN 4610 0.72 2.54 0.05 87 XM_UB80 4607 0.70 2.54 0.02 88 BAYES_40 4552 4.22 2.51 4.85 89 DIET_1 4443 0.98 2.45 0.43 90 T_TooManySym_01 4395 4.52 2.42 5.29 91 XM_URI_RBL 4371 0.90 2.41 0.34 92 HTML_IMAGE_RATIO_08 4160 2.02 2.29 1.93 93 XMBody_78 4144 0.90 2.28 0.40 94 UNPARSEABLE_RELAY 4101 2.48 2.26 2.56 95 URIBL_CSS_A 4027 1.08 2.22 0.66 96 URIBL_CSS 4027 1.08 2.22 0.66 97 SUBJ_ALL_CAPS 4022 1.93 2.22 1.82 98 XMDiploma_00 4017 1.88 2.21 1.76 99 RCVD_IN_MSPIKE_H2 3922 3.81 2.16 4.42 100 T_XMDrugObfuBody_08 3894 1.66 2.15 1.48 101 RCVD_IN_RP_CERTIFIED 3822 5.99 2.11 7.42 102 URIBL_DBL_SPAM 3714 0.59 2.05 0.06 103 BAYES_20 3634 3.03 2.00 3.41 104 LongTLD 3515 0.66 1.94 0.19 105 DKIM_ADSP_NXDOMAIN 3504 1.04 1.93 0.72 106 RELAYCOUNTRY_GB 3453 1.21 1.90 0.96 107 RELAYCOUNTRY_FR 3377 0.66 1.86 0.21 108 T_XMDrugObfuBody_00 3276 1.47 1.81 1.35 109 BAYES_00 3232 12.91 1.78 17.02 110 XMSexyCombo_01 3119 0.95 1.72 0.66 111 RELAYCOUNTRY_IN 2943 0.53 1.62 0.13 112 FROM_SUSPICIOUS_NTLD 2905 0.48 1.60 0.07 113 TVD_SPACE_RATIO_MINFP 2830 0.42 1.56 0.00 114 MAILING_LIST_MULTI 2762 2.03 1.52 2.21 115 XMBody_17 2684 0.85 1.48 0.62 116 SpammyFromTLD_01 2597 0.93 1.43 0.75 117 XMPhish11 2585 1.25 1.42 1.19 118 TR_XM_RelayPhish 2574 0.86 1.42 0.66 119 TR_XM_DK_Bayes 2546 10.03 1.40 13.21 120 T_FILL_THIS_FORM_SHORT 2472 0.99 1.36 0.85 121 XMSubMetaI_00 2399 0.76 1.32 0.56 122 XMSubNoVowel 2396 0.58 1.32 0.30 123 TM2_M_VERY_LONG_WORD 2385 0.95 1.31 0.81 124 XMBdyGiftCard01 2384 1.06 1.31 0.97 125 BAYES_05 2300 1.99 1.27 2.26 126 XMStockSpam_06 2291 1.30 1.26 1.32 127 XM_UB99 2285 0.34 1.26 0.01 128 LONG_JUNK_URI 2247 0.37 1.24 0.05 129 LONG_JUNK_URI3 2216 0.35 1.22 0.03 130 TR_LOTS_OF_MONEY2 2205 0.54 1.22 0.29 131 T_MONEY_PERCENT 2205 0.54 1.22 0.29 132 ALL_TRUSTED 2191 14.27 1.21 19.09 133 PLING_QUERY 2186 0.62 1.20 0.40 134 RCVD_IN_IADB_LISTED 2177 4.32 1.20 5.47 135 XMHTML_After_End 2176 0.62 1.20 0.41 136 T_XMHurry_00 2170 0.82 1.20 0.69 137 LOW_PRICE 2159 0.53 1.19 0.29 138 BODY_ENHANCEMENT 2156 0.34 1.19 0.03 139 HTML_IMAGE_ONLY_32 2152 0.58 1.19 0.36 140 XM_ProductURIs 2141 0.89 1.18 0.79 141 DKIM_ADSP_CUSTOM_MED 2120 0.98 1.17 0.91 142 XM_H_Long_From02 2111 1.03 1.16 0.98 143 URI_TRY_3LD 2094 1.27 1.15 1.31 144 XMPhish30 2082 0.62 1.15 0.42 145 TR_Symld_Words 2030 1.44 1.12 1.55 146 NORMAL_HTTP_TO_IP 2015 0.36 1.11 0.08 147 NML_ADSP_CUSTOM_MED 2004 0.75 1.10 0.62 148 XMSubMetaSSx_00 2004 0.57 1.10 0.37 149 XM_H_PHPOS 1993 1.09 1.10 1.09 150 TR_XM_DK_Bayes1 1984 9.39 1.09 12.45 151 HTML_TITLE_SUBJ_DIFF 1982 0.36 1.09 0.09 152 XMGenDplmaNmb 1957 1.12 1.08 1.14 153 FORGED_GMAIL_RCVD 1924 0.64 1.06 0.48 154 T_XMDrugObfuBody_01 1919 0.30 1.06 0.02 155 URIBL_BLACK 1897 0.32 1.05 0.05 156 TooManyTo_002 1874 1.81 1.03 2.10 157 XM_RXBody 1798 0.45 0.99 0.25 158 NORDNS_LOW_CONTRAST 1794 0.27 0.99 0.01 159 RELAYCOUNTRY_AU 1783 0.61 0.98 0.48 160 RCVD_IN_IADB_SPF 1767 3.77 0.97 4.80 161 URIBL_SBL_A 1760 0.81 0.97 0.75 162 TooManyTo_003 1732 1.26 0.95 1.38 163 RDNS_DYNAMIC 1728 0.56 0.95 0.42 164 XM_B_REG_HTML 1671 0.53 0.92 0.39 165 TR_XM_DK_Bayes2 1657 7.91 0.91 10.49 166 TR_Caps_n_Bayes_99 1652 0.27 0.91 0.04 167 RCVD_IN_IADB_SENDERID 1643 3.34 0.91 4.24 168 XM_ShortIntro_01 1635 0.56 0.90 0.44 169 RCVD_IN_IADB_DK 1625 3.29 0.90 4.18 170 T_Symld_Words_02 1624 0.79 0.89 0.75 171 XM_UB95 1594 0.24 0.88 0.01 172 SUBJ_DOLLARS 1559 0.44 0.86 0.29 173 DATE_IN_PAST_03_06 1558 0.30 0.86 0.09 174 TooManyTo_004 1512 0.98 0.83 1.04 175 XM_DK_Undo_01 1499 1.56 0.83 1.84 176 NO_DNS_FOR_FROM 1494 0.43 0.82 0.29 177 RCVD_IN_IADB_VOUCHED 1479 2.77 0.81 3.49 178 RELAYCOUNTRY_AT 1465 0.49 0.81 0.37 179 XM_GoogleGroups 1453 1.11 0.80 1.22 180 TR_MetaPhish_Combo_01 1435 1.30 0.79 1.48 181 RELAYCOUNTRY_KR 1425 0.22 0.79 0.02 182 XM_UB999 1422 0.22 0.78 0.01 183 TooManyTo_005 1411 0.84 0.78 0.86 184 T_HTML_TAG_BALANCE_CENTER 1388 0.31 0.76 0.14 185 FSL_THIS_IS_ADV 1376 0.24 0.76 0.06 186 HTTPS_HTTP_MISMATCH 1374 0.58 0.76 0.51 187 MIME_CHARSET_FARAWAY 1332 0.25 0.73 0.08 188 XMPhish14 1320 0.43 0.73 0.32 189 XM_XX_Yahoo 1310 0.23 0.72 0.04 190 XMMoneyMeta_00 1299 0.57 0.72 0.52 191 REMOVE_BEFORE_LINK 1298 0.36 0.72 0.23 192 XMSexyCombo_04 1297 0.26 0.71 0.09 193 CHARSET_FARAWAY_HEADER 1278 0.22 0.70 0.04 194 FILL_THIS_FORM 1276 0.55 0.70 0.49 195 XM_Lotto 1273 0.44 0.70 0.35 196 REPLYTO_WITHOUT_TO_CC 1266 0.22 0.70 0.04 197 HTML_FONT_FACE_BAD 1260 0.57 0.69 0.52 198 MPART_ALT_DIFF_COUNT 1247 0.35 0.69 0.22 199 XM_OfRef7 1222 0.31 0.67 0.18 200 FILL_THIS_FORM_LONG 1194 0.43 0.66 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 430388 86.85 85.17 87.46 2 DKIM_SIGNED 353443 70.64 67.43 71.83 3 XM_DK_Pass 347100 68.78 64.03 70.54 4 DKIM_VALID 326684 64.71 60.17 66.39 5 DCC_CHECK_NEGATIVE 287874 50.34 28.21 58.50 6 BAYES_50 284212 55.35 48.82 57.76 7 XMListUnsubscribeExists 237118 52.01 62.36 48.19 8 DKIM_VALID_AU 234628 47.73 47.86 47.68 9 XM_H_QuotedFrom 199227 40.86 41.86 40.49 10 DCC_CHECK 193497 47.57 69.95 39.32 11 T_TM2_M_HEADER_IN_MSG 154004 26.92 15.07 31.30 12 STYLE_GIBBERISH 133399 27.70 29.29 27.11 13 DKIM_VALID_EF 128089 23.61 17.04 26.03 14 HTML_FONT_LOW_CONTRAST 128018 27.61 31.92 26.02 15 XMSubLong 104521 22.20 24.79 21.24 16 FVGT_m_MULTI_ODD 100709 21.22 23.25 20.47 17 LOC_TINY_FONT_1 98774 22.67 29.71 20.07 18 ALL_TRUSTED 93955 14.27 1.21 19.09 19 MIME_HTML_ONLY 93767 23.37 35.07 19.06 20 MultiRelay 86181 16.59 14.08 17.51 21 BAYES_00 83748 12.91 1.78 17.02 22 T_KAM_HTML_FONT_INVALID 77493 16.12 17.11 15.75 23 TR_XM_DK_Bayes 64995 10.03 1.40 13.21 24 TR_XM_DK_Bayes1 61239 9.39 1.09 12.45 25 XM_Body_Dirty_Words 60007 13.33 16.40 12.19 26 XM_Multi_Part_URI 58548 13.42 17.55 11.90 27 XM_DKIMWhitelistDomains 57818 8.59 0.01 11.75 28 TR_XM_DK_Bayes2 51638 7.91 0.91 10.49 29 LOTS_OF_MONEY 42832 12.24 21.82 8.70 30 LotsOfNums_01 42112 7.52 4.71 8.56 31 T_XMDrugObfuBody_14 41897 8.39 8.05 8.51 32 RCVD_IN_RP_SAFE 41029 6.80 2.63 8.34 33 XM_Evil_Numbers_Gen 40400 11.90 21.92 8.21 34 TooManyTo_001 39870 7.77 6.89 8.10 35 RCVD_IN_RP_CERTIFIED 36528 5.99 2.11 7.42 36 HTML_IMAGE_RATIO_02 35616 8.41 11.60 7.24 37 XM_DK_Undo_02 34844 12.95 28.87 7.08 38 FSL_BULK_SIG 32152 7.67 10.74 6.53 39 HTML_IMAGE_RATIO_04 30311 6.97 9.15 6.16 40 XM_B_Phish_Phrases 29114 6.07 6.47 5.92 41 MIME_QP_LONG_LINE 28835 5.02 2.72 5.86 42 XM_H_Long_From01 28021 6.71 9.46 5.69 43 XM_SendGrid 27608 4.95 3.17 5.61 44 RCVD_IN_IADB_LISTED 26926 4.32 1.20 5.47 45 DKIM_INVALID 26759 5.93 7.25 5.44 46 XMStrtUSub 26573 4.73 2.90 5.40 47 T_TooManySym_01 26041 4.52 2.42 5.29 48 BAYES_99 25608 9.98 22.93 5.20 49 RELAYCOUNTRY_META 25146 9.43 21.13 5.11 50 BAYES_60 24479 5.93 8.50 4.97 51 BAYES_40 23862 4.22 2.51 4.85 52 BOTNET_IPINHOSTNAME 23713 8.34 17.88 4.82 53 RCVD_IN_IADB_SPF 23643 3.77 0.97 4.80 54 XM_PDF 22062 3.44 0.62 4.48 55 RCVD_IN_MSPIKE_H2 21745 3.81 2.16 4.42 56 BAYES_999 21721 8.27 18.74 4.41 57 XMSubMetaSx_00 20971 5.07 7.27 4.26 58 RCVD_IN_IADB_SENDERID 20879 3.34 0.91 4.24 59 T_REMOTE_IMAGE 20834 4.83 6.46 4.23 60 RCVD_IN_IADB_DK 20567 3.29 0.90 4.18 61 XMSexyCombo_05 19523 5.48 9.59 3.97 62 XMNumbers 18833 4.40 5.97 3.83 63 IN_ZIMBRA_NJ_WHITELIST 18576 2.76 0.02 3.78 64 ANY_BOUNCE_MESSAGE 17289 5.77 11.88 3.51 65 BOUNCE_MESSAGE 17282 5.76 11.87 3.51 66 RCVD_IN_IADB_VOUCHED 17162 2.77 0.81 3.49 67 BAYES_20 16769 3.03 2.00 3.41 68 FROM_EXCESS_BASE64 16728 5.35 10.64 3.40 69 HTML_IMAGE_RATIO_06 16204 3.31 3.35 3.29 70 XM_UncommonTLD01 15267 5.64 12.51 3.10 71 MPART_ALT_DIFF 14958 4.00 6.62 3.04 72 TR_DCC_Bayes_99 14844 7.26 18.76 3.02 73 BAYES_80 14485 4.40 8.37 2.94 74 TO_MALFORMED 13656 2.14 0.41 2.78 75 BOTNET 13500 8.88 25.53 2.74 76 UNPARSEABLE_RELAY 12597 2.48 2.26 2.56 77 HTML_MIME_NO_HTML_TAG 12171 3.70 7.03 2.47 78 BAYES_05 11106 1.99 1.27 2.26 79 MIME_HTML_MOSTLY 11065 2.60 3.54 2.25 80 MAILING_LIST_MULTI 10892 2.03 1.52 2.21 81 RCVD_IN_IADB_OPTIN 10619 1.73 0.58 2.16 82 TVD_RCVD_IP 10473 1.62 0.24 2.13 83 TooManyTo_002 10319 1.81 1.03 2.10 84 XM_SPF_SoftFail 9744 2.76 4.87 1.98 85 HTML_IMAGE_RATIO_08 9479 2.02 2.29 1.93 86 TM2_M_URI_OPT_OUT 9468 2.37 3.57 1.92 87 XM_DIRTYINTL 9128 2.29 3.48 1.86 88 HELO_NODOT 9062 1.47 0.45 1.84 89 XM_DK_Undo_01 9030 1.56 0.83 1.84 90 SUBJ_ALL_CAPS 8950 1.93 2.22 1.82 91 URI_HEX 8874 2.28 3.58 1.80 92 XMDiploma_00 8650 1.88 2.21 1.76 93 T_TooManySym_02 8425 1.43 0.65 1.71 94 RCVD_IN_MSPIKE_WL 8208 1.34 0.45 1.67 95 RCVD_IN_MSPIKE_H3 8181 1.33 0.41 1.66 96 IN_HORDE_ADDRESS_BOOK 8021 1.20 0.05 1.63 97 XM_CamelCaseFrm001 7842 1.93 2.83 1.59 98 BAYES_95 7804 2.19 3.82 1.59 99 RELAYCOUNTRY_CA 7739 1.95 2.96 1.57 100 TR_Symld_Words 7636 1.44 1.12 1.55 101 USER_IN_DEF_DKIM_WL 7516 1.15 0.11 1.53 102 MIME_HTML_ONLY_MULTI 7403 2.15 3.90 1.50 103 T_XMDrugObfuBody_08 7306 1.66 2.15 1.48 104 TR_MetaPhish_Combo_01 7297 1.30 0.79 1.48 105 UNTRUSTED_Relay 6998 5.03 14.83 1.42 106 INVALID_MSGID 6933 1.08 0.19 1.41 107 TooManyTo_003 6779 1.26 0.95 1.38 108 T_XMDrugObfuBody_00 6638 1.47 1.81 1.35 109 XMCapTrack 6629 1.15 0.61 1.35 110 XMStockSpam_06 6487 1.30 1.26 1.32 111 URI_TRY_3LD 6451 1.27 1.15 1.31 112 XM_OfRef6 6208 1.67 2.79 1.26 113 XM_GoogleGroups 6004 1.11 0.80 1.22 114 XMPhish11 5852 1.25 1.42 1.19 115 XMGenDplmaNmb 5599 1.12 1.08 1.14 116 XM_H_PHPOS 5362 1.09 1.10 1.09 117 TooManyTo_004 5121 0.98 0.83 1.04 118 XM_H_Long_From02 4806 1.03 1.16 0.98 119 XMBdyGiftCard01 4757 1.06 1.31 0.97 120 RELAYCOUNTRY_GB 4716 1.21 1.90 0.96 121 DKIM_ADSP_CUSTOM_MED 4460 0.98 1.17 0.91 122 XMBody_95 4300 0.67 0.12 0.87 123 TooManyTo_005 4253 0.84 0.78 0.86 124 T_FILL_THIS_FORM_SHORT 4198 0.99 1.36 0.85 125 XM_UB50 4137 2.14 5.65 0.84 126 TM2_M_VERY_LONG_WORD 3999 0.95 1.31 0.81 127 XM_ProductURIs 3882 0.89 1.18 0.79 128 RCVD_IN_RP_RNBL 3870 4.51 14.61 0.79 129 T_Symld_Words_02 3692 0.79 0.89 0.75 130 SpammyFromTLD_01 3680 0.93 1.43 0.75 131 URIBL_SBL_A 3670 0.81 0.97 0.75 132 XM_S_JOY_D 3648 0.71 0.63 0.74 133 DKIM_ADSP_NXDOMAIN 3523 1.04 1.93 0.72 134 TR_LOTS_OF_MONEY3 3466 3.61 11.51 0.70 135 T_XMHurry_00 3385 0.82 1.20 0.69 136 T_OBFU_PDF_ATTACH 3376 0.54 0.15 0.69 137 XM_H_PHPMailer 3261 0.60 0.44 0.66 138 XMSexyCombo_01 3254 0.95 1.72 0.66 139 URIBL_CSS_A 3250 1.08 2.22 0.66 140 URIBL_CSS 3250 1.08 2.22 0.66 141 TR_XM_RelayPhish 3229 0.86 1.42 0.66 142 T_TooManySym_03 3172 0.53 0.20 0.64 143 XMBody_17 3074 0.85 1.48 0.62 144 NML_ADSP_CUSTOM_MED 3043 0.75 1.10 0.62 145 XMBrknScrpt_02 2890 0.59 0.60 0.59 146 XMLngstWrd_00 2814 0.51 0.35 0.57 147 TM2_M_A_HREF_HREF 2786 0.53 0.43 0.57 148 XMSubMetaI_00 2734 0.76 1.32 0.56 149 USER_IN_WHITELIST 2723 0.40 0.00 0.55 150 T_FROM_GOV_DKIM_AU 2713 0.44 0.15 0.55 151 FROM_GOV_SPOOF 2644 0.47 0.28 0.54 152 XMNoVowels 2599 0.49 0.37 0.53 153 XMLngstWrd_01 2576 0.47 0.33 0.52 154 XMGappySubj_01 2558 0.47 0.35 0.52 155 HTML_FONT_FACE_BAD 2553 0.57 0.69 0.52 156 XMMoneyMeta_00 2538 0.57 0.72 0.52 157 HTTPS_HTTP_MISMATCH 2512 0.58 0.76 0.51 158 FILL_THIS_FORM 2426 0.55 0.70 0.49 159 AC_DIV_BONANZA 2388 0.40 0.18 0.49 160 FORGED_GMAIL_RCVD 2373 0.64 1.06 0.48 161 XM_B_COPY_HTML 2366 0.50 0.54 0.48 162 RELAYCOUNTRY_AU 2340 0.61 0.98 0.48 163 URI_NOVOWEL 2314 0.52 0.64 0.47 164 SHORT_HELO_AND_INLINE_IMAGE 2283 0.35 0.05 0.46 165 T_MANY_PILL_PRICE 2184 0.32 0.00 0.44 166 XM_ShortIntro_01 2160 0.56 0.90 0.44 167 DIET_1 2132 0.98 2.45 0.43 168 XMPhish30 2087 0.62 1.15 0.42 169 RDNS_DYNAMIC 2074 0.56 0.95 0.42 170 RELAYCOUNTRY_DE 2072 1.57 4.67 0.42 171 MISSING_HEADERS 2070 1.65 5.00 0.42 172 XMHTML_After_End 1996 0.62 1.20 0.41 173 RCVD_IN_BL_SPAMCOP_NET 1994 1.13 3.08 0.41 174 XMSubMetaSxObfu_03 1981 0.45 0.56 0.40 175 PLING_QUERY 1965 0.62 1.20 0.40 176 XMSubMetaSxObfu_02 1959 0.44 0.54 0.40 177 XMDateMe_00 1955 0.36 0.25 0.40 178 HTML_TAG_BALANCE_BODY 1948 0.46 0.64 0.40 179 XMBody_78 1947 0.90 2.28 0.40 180 RCVD_IN_SORBS_DUL 1938 0.32 0.13 0.39 181 HTML_IMAGE_ONLY_28 1923 0.98 2.59 0.39 182 XM_B_REG_HTML 1906 0.53 0.92 0.39 183 TM2_M_BODY_EMPTY 1888 0.32 0.15 0.38 184 XM_H_PHPOS_M 1887 0.37 0.33 0.38 185 URI_WP_HACKED_2 1844 0.34 0.26 0.37 186 RELAYCOUNTRY_AT 1826 0.49 0.81 0.37 187 XMSubMetaSSx_00 1803 0.57 1.10 0.37 188 XMHTMLBadTable_001 1796 0.43 0.61 0.36 189 HTML_IMAGE_ONLY_32 1786 0.58 1.19 0.36 190 FILL_THIS_FORM_LONG 1730 0.43 0.66 0.35 191 XM_Lotto 1708 0.44 0.70 0.35 192 XM_URI_RBL 1677 0.90 2.41 0.34 193 HTML_IMAGE_ONLY_24 1656 0.42 0.63 0.34 194 SpammyFromTLD_02 1649 2.18 7.19 0.34 195 XMPhish14 1595 0.43 0.73 0.32 196 XMSlimDrugH 1567 0.39 0.59 0.32 197 FILL_THIS_FORM_LOAN 1557 0.35 0.46 0.32 198 TVD_SPACE_RATIO 1516 0.29 0.25 0.31 199 XMSolicitRefs_0 1480 0.32 0.38 0.30 200 XMSubNoVowel 1479 0.58 1.32 0.30 ----------------------------------------------------------------------