Email: 715869 Autolearn: 0 AvgScore: 2.15 AvgScanTime: 3.95 sec Spam: 179930 Autolearn: 0 AvgScore: 12.09 AvgScanTime: 4.58 sec Ham: 535939 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 3.74 sec Time Spent Running SA: 785.80 hours Time Spent Processing Spam: 229.06 hours Time Spent Processing Ham: 556.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129184 84.55 71.80 88.83 2 DCC_CHECK 112496 46.83 62.52 41.57 3 DKIM_SIGNED 108352 70.38 60.22 73.80 4 BAYES_50 105240 58.42 58.49 58.40 5 XM_DK_Pass 104494 68.54 58.07 72.06 6 DKIM_VALID 97308 64.26 54.08 67.68 7 XMListUnsubscribeExists 92181 51.53 51.23 51.63 8 DKIM_VALID_AU 78599 46.64 43.68 47.63 9 XM_H_QuotedFrom 72854 41.00 40.49 41.18 10 DCC_CHECK_NEGATIVE 65007 51.32 36.13 56.41 11 BOTNET 61417 9.83 34.13 1.67 12 LOTS_OF_MONEY 57163 15.35 31.77 9.84 13 HTML_FONT_LOW_CONTRAST 50483 28.02 28.06 28.00 14 XM_DK_Undo_02 48029 11.37 26.69 6.23 15 MIME_HTML_ONLY 46820 20.78 26.02 19.02 16 LOC_TINY_FONT_1 46131 23.15 25.64 22.31 17 XM_OfRef6 44942 7.69 24.98 1.89 18 RCVD_IN_RP_RNBL 44442 6.23 24.70 0.03 19 FVGT_m_MULTI_ODD 43359 21.59 24.10 20.75 20 T_FILL_THIS_FORM_SHORT 41989 6.65 23.34 1.05 21 HK_SCAM_N2 41196 5.85 22.90 0.12 22 XM_OfRef7 41056 6.01 22.82 0.37 23 ANY_BOUNCE_MESSAGE 40927 7.49 22.75 2.36 24 BOUNCE_MESSAGE 40922 7.49 22.74 2.36 25 BAYES_99 40350 9.13 22.43 4.66 26 MONEY_FORM_SHORT 40345 5.68 22.42 0.06 27 XMSubLong 39834 21.51 22.14 21.30 28 XM_Multi_Part_URI 37878 14.29 21.05 12.02 29 TR_DCC_Bayes_99 33437 6.42 18.58 2.34 30 BAYES_999 32703 7.41 18.18 3.80 31 RELAYCOUNTRY_META 30526 8.47 16.97 5.62 32 DKIM_VALID_EF 28988 23.08 16.11 25.41 33 XM_Body_Dirty_Words 27855 13.13 15.48 12.34 34 T_KAM_HTML_FONT_INVALID 27382 16.47 15.22 16.90 35 T_TM2_M_HEADER_IN_MSG 26775 25.06 14.88 28.47 36 BOTNET_IPINHOSTNAME 25480 6.90 14.16 4.46 37 FSL_BULK_SIG 23641 7.90 13.14 6.15 38 MultiRelay 23151 16.64 12.87 17.91 39 XM_OfRef8 20736 2.96 11.52 0.09 40 UNTRUSTED_Relay 19705 3.89 10.95 1.52 41 XM_UncommonTLD01 18761 4.90 10.43 3.05 42 XM_Evil_Numbers_Gen 17581 9.03 9.77 8.79 43 HTML_IMAGE_RATIO_02 17018 8.34 9.46 7.96 44 DATE_IN_PAST_06_12 16560 2.35 9.20 0.06 45 XMSexyCombo_05 16279 5.26 9.05 3.99 46 XMSubMetaSx_00 14293 5.00 7.94 4.01 47 XM_H_Long_From01 13172 6.42 7.32 6.12 48 DATE_IN_PAST_03_06 12867 1.86 7.15 0.09 49 T_XMDrugObfuBody_14 12732 7.90 7.08 8.18 50 DKIM_INVALID 11044 6.12 6.14 6.11 51 HTML_IMAGE_RATIO_04 10671 5.64 5.93 5.54 52 MPART_ALT_DIFF 10384 3.73 5.77 3.05 53 XM_B_Phish_Phrases 10185 5.49 5.66 5.43 54 TooManyTo_001 10176 7.37 5.66 7.94 55 XM_UB50 9454 2.04 5.25 0.96 56 XMNumbers 9146 3.60 5.08 3.10 57 BAYES_80 9116 3.33 5.07 2.75 58 BAYES_60 9093 4.79 5.05 4.70 59 XM_SPF_SoftFail 9005 3.18 5.00 2.57 60 LotsOfNums_01 8534 7.66 4.74 8.64 61 HTML_MIME_NO_HTML_TAG 7311 2.63 4.06 2.15 62 XM_DIRTYINTL 7073 2.48 3.93 1.99 63 FROM_EXCESS_BASE64 6913 3.58 3.84 3.49 64 T_REMOTE_IMAGE 6672 4.86 3.71 5.24 65 URI_HEX 6659 2.16 3.70 1.65 66 HTML_IMAGE_RATIO_08 6466 2.38 3.59 1.97 67 XMStrtUSub 6452 5.43 3.59 6.05 68 HTML_IMAGE_RATIO_06 6419 3.69 3.57 3.73 69 TM2_M_URI_OPT_OUT 6181 2.63 3.44 2.36 70 XM_URI_RBL 5838 1.12 3.24 0.41 71 MIME_HTML_ONLY_MULTI 5724 1.90 3.18 1.47 72 MultiRelay_CC 5705 0.94 3.17 0.19 73 MultiRelay_Combo 5705 0.94 3.17 0.19 74 RELAYCOUNTRY_CA 5376 2.04 2.99 1.72 75 SpammyFromTLD_02 5262 0.98 2.92 0.32 76 XMDiploma_00 5175 2.33 2.88 2.15 77 MIME_HTML_MOSTLY 5111 2.54 2.84 2.44 78 FROM_SUSPICIOUS_NTLD 4992 0.79 2.77 0.12 79 BAYES_40 4707 4.28 2.62 4.84 80 MIME_QP_LONG_LINE 4624 5.14 2.57 6.00 81 BAYES_95 4484 1.92 2.49 1.73 82 XM_SendGrid 4453 5.09 2.47 5.97 83 XM_CamelCaseFrm001 4350 2.12 2.42 2.01 84 XM_H_PHPOS 4232 1.63 2.35 1.38 85 T_TooManySym_01 4053 3.84 2.25 4.37 86 BODY_URI_ONLY 3933 0.63 2.19 0.10 87 XM_H_PHPMailer 3904 1.24 2.17 0.93 88 T_XMDrugObfuBody_01 3808 0.56 2.12 0.03 89 RCVD_IN_MSPIKE_H2 3794 3.61 2.11 4.11 90 T_XMDrugObfuBody_08 3767 1.60 2.09 1.43 91 RELAYCOUNTRY_FR 3685 0.76 2.05 0.33 92 XM_H_Long_From02 3678 1.31 2.04 1.06 93 XMSexyCombo_01 3619 1.06 2.01 0.75 94 ALL_TRUSTED 3566 13.83 1.98 17.81 95 SpammyFromTLD_01 3564 1.00 1.98 0.68 96 RCVD_IN_BL_SPAMCOP_NET 3544 0.81 1.97 0.42 97 XM_UB60 3440 0.57 1.91 0.12 98 HTML_SHORT_LINK_IMG_1 3378 0.50 1.88 0.03 99 BOTNET_NORDNS 3327 0.48 1.85 0.02 100 BAYES_20 3274 3.06 1.82 3.47 101 XMBdyGiftCard01 3213 0.88 1.79 0.57 102 XMPhish11 3053 1.28 1.70 1.14 103 UNPARSEABLE_RELAY 3046 2.25 1.69 2.43 104 XMSubMetaI_00 3014 1.02 1.68 0.81 105 RELAYCOUNTRY_GB 2965 1.20 1.65 1.05 106 DIET_1 2893 0.71 1.61 0.41 107 RCVD_IN_RP_SAFE 2875 6.59 1.60 8.27 108 TR_LOTS_OF_MONEY2 2845 0.76 1.58 0.48 109 T_MONEY_PERCENT 2845 0.76 1.58 0.48 110 NORDNS_LOW_CONTRAST 2769 0.39 1.54 0.01 111 RELAYCOUNTRY_CN 2711 0.44 1.51 0.08 112 URIBL_DBL_SPAM 2587 0.39 1.44 0.04 113 XMGenDplmaNmb 2580 1.19 1.43 1.11 114 XMReplyNow 2568 0.48 1.43 0.16 115 XM_salutation2 2492 0.90 1.38 0.73 116 MAILING_LIST_MULTI 2488 2.49 1.38 2.86 117 MIME_HEADER_CTYPE_ONLY 2455 0.45 1.36 0.15 118 SUBJ_ALL_CAPS 2350 1.51 1.31 1.58 119 HTML_IMAGE_ONLY_04 2259 0.35 1.26 0.05 120 TM2_M_VERY_LONG_WORD 2252 1.02 1.25 0.94 121 XM_H_PHPOS_M 2252 0.72 1.25 0.54 122 RELAYCOUNTRY_DE 2221 0.65 1.23 0.46 123 T_XMHurry_00 2215 0.91 1.23 0.80 124 SHORTENER_SHORT_IMG 2214 0.31 1.23 0.00 125 TVD_SPACE_RATIO_MINFP 2204 0.32 1.22 0.01 126 XMBody_17 2166 0.77 1.20 0.62 127 HTML_OFF_PAGE 2120 0.30 1.18 0.00 128 URIBL_BLACK 2109 0.34 1.17 0.06 129 TR_XM_RelayPhish 2096 0.74 1.16 0.59 130 TR_Symld_Words 2073 1.42 1.15 1.50 131 XM_UB99 2071 0.29 1.15 0.01 132 RCVD_IN_RP_CERTIFIED 2065 5.65 1.15 7.17 133 URI_WPADMIN 2017 0.64 1.12 0.47 134 T_XMDrugObfuBody_00 1984 0.94 1.10 0.88 135 FILL_THIS_FORM 1981 0.66 1.10 0.51 136 BODY_ENHANCEMENT 1965 0.29 1.09 0.02 137 BAYES_00 1960 13.06 1.09 17.08 138 RELAYCOUNTRY_IN 1955 0.36 1.09 0.11 139 RELAYCOUNTRY_AT 1945 0.42 1.08 0.20 140 RCVD_IN_IADB_LISTED 1926 4.42 1.07 5.54 141 XM_UB80 1924 0.30 1.07 0.04 142 URI_TRY_3LD 1911 1.45 1.06 1.58 143 XMHTML_After_End 1908 0.61 1.06 0.46 144 LongTLD 1849 0.40 1.03 0.19 145 TR_Mismatch_TLD_02 1802 0.30 1.00 0.07 146 XMStockSpam_06 1797 1.02 1.00 1.02 147 FILL_THIS_FORM_LONG 1786 0.58 0.99 0.44 148 LONG_HEX_URI 1779 0.35 0.99 0.14 149 XMPhish30 1770 0.61 0.98 0.48 150 XM_ProductURIs 1755 0.95 0.98 0.94 151 HTML_SHORT_CENTER 1739 0.25 0.97 0.00 152 XMBrknScrpt_02 1731 0.65 0.96 0.54 153 XMPhish14 1727 0.56 0.96 0.42 154 FILL_THIS_FORM_LOAN 1722 0.57 0.96 0.44 155 XM_Hitman 1716 0.28 0.95 0.06 156 BAYES_05 1706 2.02 0.95 2.37 157 XMSlimDrugH 1682 0.49 0.93 0.34 158 XMSubMetaSxObfu_03 1680 0.60 0.93 0.48 159 RCVD_IN_IADB_SPF 1675 3.90 0.93 4.89 160 XMBody_78 1607 0.53 0.89 0.41 161 RCVD_IN_IADB_SENDERID 1606 3.46 0.89 4.33 162 RCVD_IN_IADB_DK 1593 3.43 0.89 4.29 163 MONEY_FORM 1561 0.22 0.87 0.01 164 TR_LOTS_OF_MONEY3 1558 0.62 0.87 0.53 165 XMSexyCombo_04 1523 0.46 0.85 0.33 166 ADVANCE_FEE_5_NEW_FRM_MNY 1479 0.21 0.82 0.00 167 HTML_IMAGE_ONLY_12 1440 0.37 0.80 0.23 168 DKIM_ADSP_CUSTOM_MED 1397 0.85 0.78 0.87 169 LONG_JUNK_URI 1357 0.24 0.75 0.06 170 XM_UB999 1326 0.19 0.74 0.00 171 NORMAL_HTTP_TO_IP 1319 0.23 0.73 0.06 172 XM_DK_Undo_01 1312 1.42 0.73 1.66 173 T_Symld_Words_02 1299 0.56 0.72 0.50 174 XM_PDF 1286 3.43 0.71 4.34 175 XMLongAddy 1278 0.21 0.71 0.04 176 TR_XM_DK_Bayes 1272 10.33 0.71 13.57 177 HTML_IMAGE_ONLY_28 1264 0.45 0.70 0.37 178 NML_ADSP_CUSTOM_MED 1252 0.62 0.70 0.59 179 TooManyTo_002 1251 1.80 0.70 2.17 180 XMLngstWrd_00 1224 0.53 0.68 0.48 181 TR_MetaPhish_Combo_01 1213 1.15 0.67 1.31 182 XMSubNoVowel 1211 0.39 0.67 0.30 183 MISSING_HEADERS 1211 0.46 0.67 0.38 184 SUBJ_DOLLARS 1208 0.39 0.67 0.29 185 FORGED_GMAIL_RCVD 1197 0.51 0.67 0.46 186 T_TooManySym_02 1191 1.26 0.66 1.46 187 XMLngstWrd_01 1185 0.49 0.66 0.44 188 RELAYCOUNTRY_AU 1181 0.57 0.66 0.54 189 XM_H_Undi_Recip 1174 0.35 0.65 0.25 190 RDNS_DYNAMIC 1164 0.49 0.65 0.43 191 XM_XX_Yahoo 1161 0.24 0.65 0.10 192 RELAYCOUNTRY_NL 1158 0.30 0.64 0.19 193 XM_Nigeria_01 1137 0.20 0.63 0.05 194 URI_NOVOWEL 1131 0.55 0.63 0.53 195 XMMoneyMeta_00 1130 0.62 0.63 0.62 196 DEAR_FRIEND 1124 0.26 0.62 0.14 197 HTML_FONT_SIZE_LARGE 1124 0.28 0.62 0.16 198 HTTPS_HTTP_MISMATCH 1119 0.66 0.62 0.67 199 T_HTML_TAG_BALANCE_CENTER 1091 0.23 0.61 0.10 200 TooManyTo_003 1090 1.24 0.61 1.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 476087 84.55 71.80 88.83 2 DKIM_SIGNED 395510 70.38 60.22 73.80 3 XM_DK_Pass 386175 68.54 58.07 72.06 4 DKIM_VALID 362739 64.26 54.08 67.68 5 BAYES_50 312978 58.42 58.49 58.40 6 DCC_CHECK_NEGATIVE 302346 51.32 36.13 56.41 7 XMListUnsubscribeExists 276685 51.53 51.23 51.63 8 DKIM_VALID_AU 255276 46.64 43.68 47.63 9 DCC_CHECK 222771 46.83 62.52 41.57 10 XM_H_QuotedFrom 220685 41.00 40.49 41.18 11 T_TM2_M_HEADER_IN_MSG 152590 25.06 14.88 28.47 12 HTML_FONT_LOW_CONTRAST 150089 28.02 28.06 28.00 13 DKIM_VALID_EF 136199 23.08 16.11 25.41 14 LOC_TINY_FONT_1 119585 23.15 25.64 22.31 15 XMSubLong 114160 21.51 22.14 21.30 16 FVGT_m_MULTI_ODD 111185 21.59 24.10 20.75 17 MIME_HTML_ONLY 101952 20.78 26.02 19.02 18 MultiRelay 95963 16.64 12.87 17.91 19 ALL_TRUSTED 95472 13.83 1.98 17.81 20 BAYES_00 91534 13.06 1.09 17.08 21 T_KAM_HTML_FONT_INVALID 90557 16.47 15.22 16.90 22 TR_XM_DK_Bayes 72706 10.33 0.71 13.57 23 TR_XM_DK_Bayes1 68141 9.67 0.59 12.71 24 XM_Body_Dirty_Words 66142 13.13 15.48 12.34 25 XM_Multi_Part_URI 64417 14.29 21.05 12.02 26 XM_DKIMWhitelistDomains 59289 8.30 0.09 11.06 27 TR_XM_DK_Bayes2 56242 7.98 0.48 10.49 28 LOTS_OF_MONEY 52718 15.35 31.77 9.84 29 XM_Evil_Numbers_Gen 47090 9.03 9.77 8.79 30 LotsOfNums_01 46319 7.66 4.74 8.64 31 RCVD_IN_RP_SAFE 44303 6.59 1.60 8.27 32 T_XMDrugObfuBody_14 43814 7.90 7.08 8.18 33 HTML_IMAGE_RATIO_02 42663 8.34 9.46 7.96 34 TooManyTo_001 42559 7.37 5.66 7.94 35 RCVD_IN_RP_CERTIFIED 38410 5.65 1.15 7.17 36 XM_DK_Undo_02 33374 11.37 26.69 6.23 37 FSL_BULK_SIG 32943 7.90 13.14 6.15 38 XM_H_Long_From01 32799 6.42 7.32 6.12 39 DKIM_INVALID 32771 6.12 6.14 6.11 40 XMStrtUSub 32437 5.43 3.59 6.05 41 MIME_QP_LONG_LINE 32144 5.14 2.57 6.00 42 XM_SendGrid 31983 5.09 2.47 5.97 43 RELAYCOUNTRY_META 30117 8.47 16.97 5.62 44 RCVD_IN_IADB_LISTED 29694 4.42 1.07 5.54 45 HTML_IMAGE_RATIO_04 29672 5.64 5.93 5.54 46 XM_B_Phish_Phrases 29127 5.49 5.66 5.43 47 T_REMOTE_IMAGE 28098 4.86 3.71 5.24 48 RCVD_IN_IADB_SPF 26226 3.90 0.93 4.89 49 BAYES_40 25958 4.28 2.62 4.84 50 BAYES_60 25170 4.79 5.05 4.70 51 BAYES_99 24987 9.13 22.43 4.66 52 BOTNET_IPINHOSTNAME 23896 6.90 14.16 4.46 53 T_TooManySym_01 23437 3.84 2.25 4.37 54 XM_PDF 23276 3.43 0.71 4.34 55 RCVD_IN_IADB_SENDERID 23183 3.46 0.89 4.33 56 RCVD_IN_IADB_DK 22968 3.43 0.89 4.29 57 RCVD_IN_MSPIKE_H2 22052 3.61 2.11 4.11 58 XMSubMetaSx_00 21466 5.00 7.94 4.01 59 XMSexyCombo_05 21373 5.26 9.05 3.99 60 BAYES_999 20345 7.41 18.18 3.80 61 HTML_IMAGE_RATIO_06 19972 3.69 3.57 3.73 62 IN_ZIMBRA_NJ_WHITELIST 19580 2.74 0.02 3.65 63 FROM_EXCESS_BASE64 18693 3.58 3.84 3.49 64 BAYES_20 18604 3.06 1.82 3.47 65 RCVD_IN_IADB_VOUCHED 18360 2.70 0.52 3.43 66 XMNumbers 16630 3.60 5.08 3.10 67 MPART_ALT_DIFF 16335 3.73 5.77 3.05 68 XM_UncommonTLD01 16331 4.90 10.43 3.05 69 MAILING_LIST_MULTI 15317 2.49 1.38 2.86 70 BAYES_80 14726 3.33 5.07 2.75 71 XM_SPF_SoftFail 13776 3.18 5.00 2.57 72 MIME_HTML_MOSTLY 13071 2.54 2.84 2.44 73 UNPARSEABLE_RELAY 13032 2.25 1.69 2.43 74 BAYES_05 12720 2.02 0.95 2.37 75 ANY_BOUNCE_MESSAGE 12674 7.49 22.75 2.36 76 BOUNCE_MESSAGE 12672 7.49 22.74 2.36 77 TM2_M_URI_OPT_OUT 12664 2.63 3.44 2.36 78 TR_DCC_Bayes_99 12548 6.42 18.58 2.34 79 TooManyTo_002 11618 1.80 0.70 2.17 80 HTML_MIME_NO_HTML_TAG 11512 2.63 4.06 2.15 81 XMDiploma_00 11500 2.33 2.88 2.15 82 RCVD_IN_IADB_OPTIN 11293 1.68 0.40 2.11 83 TO_MALFORMED 11252 1.58 0.03 2.10 84 TVD_RCVD_IP 10996 1.59 0.21 2.05 85 XM_CamelCaseFrm001 10791 2.12 2.42 2.01 86 XM_DIRTYINTL 10656 2.48 3.93 1.99 87 HTML_IMAGE_RATIO_08 10542 2.38 3.59 1.97 88 XM_OfRef6 10109 7.69 24.98 1.89 89 RCVD_IN_MSPIKE_WL 9628 1.44 0.39 1.80 90 RCVD_IN_MSPIKE_H3 9610 1.44 0.39 1.79 91 BAYES_95 9261 1.92 2.49 1.73 92 RELAYCOUNTRY_CA 9205 2.04 2.99 1.72 93 BOTNET 8943 9.83 34.13 1.67 94 XM_DK_Undo_01 8882 1.42 0.73 1.66 95 URI_HEX 8837 2.16 3.70 1.65 96 HELO_NODOT 8570 1.27 0.30 1.60 97 URI_TRY_3LD 8484 1.45 1.06 1.58 98 IN_HORDE_ADDRESS_BOOK 8475 1.19 0.04 1.58 99 SUBJ_ALL_CAPS 8452 1.51 1.31 1.58 100 UNTRUSTED_Relay 8142 3.89 10.95 1.52 101 TR_Symld_Words 8061 1.42 1.15 1.50 102 URI_WP_HACKED_2 7924 1.14 0.12 1.48 103 MIME_HTML_ONLY_MULTI 7858 1.90 3.18 1.47 104 T_TooManySym_02 7848 1.26 0.66 1.46 105 TooManyTo_003 7773 1.24 0.61 1.45 106 T_XMDrugObfuBody_08 7666 1.60 2.09 1.43 107 XM_H_PHPOS 7404 1.63 2.35 1.38 108 INVALID_MSGID 7306 1.05 0.10 1.36 109 TR_MetaPhish_Combo_01 7026 1.15 0.67 1.31 110 XMCapTrack 6659 1.01 0.33 1.24 111 XMPhish11 6129 1.28 1.70 1.14 112 XM_GoogleGroups 6049 0.95 0.40 1.13 113 XMGenDplmaNmb 5972 1.19 1.43 1.11 114 XM_H_Long_From02 5684 1.31 2.04 1.06 115 RELAYCOUNTRY_GB 5645 1.20 1.65 1.05 116 TooManyTo_004 5621 0.92 0.53 1.05 117 T_FILL_THIS_FORM_SHORT 5612 6.65 23.34 1.05 118 XMStockSpam_06 5485 1.02 1.00 1.02 119 XM_UB50 5122 2.04 5.25 0.96 120 HTML_FONT_FACE_BAD 5101 0.86 0.57 0.95 121 TM2_M_VERY_LONG_WORD 5056 1.02 1.25 0.94 122 XM_ProductURIs 5018 0.95 0.98 0.94 123 XM_H_PHPMailer 4970 1.24 2.17 0.93 124 USER_IN_DEF_DKIM_WL 4958 0.70 0.01 0.93 125 T_XMDrugObfuBody_00 4740 0.94 1.10 0.88 126 DKIM_ADSP_CUSTOM_MED 4654 0.85 0.78 0.87 127 TooManyTo_005 4426 0.74 0.47 0.83 128 XMSubMetaI_00 4317 1.02 1.68 0.81 129 T_XMHurry_00 4294 0.91 1.23 0.80 130 XMSexyCombo_01 4004 1.06 2.01 0.75 131 XM_salutation2 3929 0.90 1.38 0.73 132 XMGappySubj_01 3896 0.61 0.26 0.73 133 SpammyFromTLD_01 3621 1.00 1.98 0.68 134 HTTPS_HTTP_MISMATCH 3573 0.66 0.62 0.67 135 XMNoVowels 3478 0.57 0.33 0.65 136 XMMoneyMeta_00 3334 0.62 0.63 0.62 137 XMBody_17 3319 0.77 1.20 0.62 138 REMOVE_BEFORE_LINK 3264 0.56 0.40 0.61 139 NML_ADSP_CUSTOM_MED 3187 0.62 0.70 0.59 140 TR_XM_RelayPhish 3170 0.74 1.16 0.59 141 HTML_TAG_BALANCE_BODY 3082 0.52 0.37 0.58 142 XMHTMLBadTable_001 3080 0.58 0.59 0.57 143 XMBdyGiftCard01 3063 0.88 1.79 0.57 144 XMBody_95 2969 0.46 0.20 0.55 145 T_OBFU_PDF_ATTACH 2930 0.45 0.16 0.55 146 RELAYCOUNTRY_AU 2904 0.57 0.66 0.54 147 XM_H_PHPOS_M 2903 0.72 1.25 0.54 148 XMBrknScrpt_02 2900 0.65 0.96 0.54 149 XM_B_REG_HTML 2886 0.54 0.55 0.54 150 TR_LOTS_OF_MONEY3 2860 0.62 0.87 0.53 151 FROM_GOV_SPOOF 2833 0.49 0.36 0.53 152 URI_NOVOWEL 2827 0.55 0.63 0.53 153 DKIM_ADSP_NXDOMAIN 2826 0.53 0.52 0.53 154 USER_IN_WHITELIST 2790 0.39 0.00 0.52 155 FILL_THIS_FORM 2731 0.66 1.10 0.51 156 T_Symld_Words_02 2682 0.56 0.72 0.50 157 T_MONEY_PERCENT 2582 0.76 1.58 0.48 158 TR_LOTS_OF_MONEY2 2582 0.76 1.58 0.48 159 XMSubMetaSxObfu_03 2580 0.60 0.93 0.48 160 XMLngstWrd_00 2575 0.53 0.68 0.48 161 XMPhish30 2574 0.61 0.98 0.48 162 URI_WPADMIN 2535 0.64 1.12 0.47 163 XMHTML_After_End 2486 0.61 1.06 0.46 164 RELAYCOUNTRY_DE 2453 0.65 1.23 0.46 165 FORGED_GMAIL_RCVD 2448 0.51 0.67 0.46 166 HTML_IMAGE_ONLY_32 2435 0.42 0.32 0.45 167 SHORT_HELO_AND_INLINE_IMAGE 2407 0.34 0.03 0.45 168 XMGappySubj_02 2402 0.34 0.04 0.45 169 FILL_THIS_FORM_LONG 2373 0.58 0.99 0.44 170 XMLngstWrd_01 2353 0.49 0.66 0.44 171 FILL_THIS_FORM_LOAN 2342 0.57 0.96 0.44 172 T_TooManySym_03 2318 0.35 0.11 0.43 173 RDNS_DYNAMIC 2312 0.49 0.65 0.43 174 TM2_M_A_HREF_HREF 2303 0.42 0.38 0.43 175 XM_B_COPY_HTML 2284 0.44 0.49 0.43 176 XMPhish14 2267 0.56 0.96 0.42 177 RCVD_IN_BL_SPAMCOP_NET 2266 0.81 1.97 0.42 178 XMBody_78 2210 0.53 0.89 0.41 179 XM_URI_RBL 2204 1.12 3.24 0.41 180 XMRcvdHeader_15 2193 0.31 0.00 0.41 181 DIET_1 2184 0.71 1.61 0.41 182 FROM_GOV_DKIM_AU 2096 0.34 0.18 0.39 183 MISSING_HEADERS 2050 0.46 0.67 0.38 184 XM_ShortIntro_01 2007 0.39 0.43 0.37 185 XM_OfRef7 1970 6.01 22.82 0.37 186 HTML_IMAGE_ONLY_28 1969 0.45 0.70 0.37 187 RCVD_IN_SORBS_DUL 1955 0.34 0.27 0.36 188 PLING_QUERY 1951 0.38 0.43 0.36 189 XM_Combo_Sbj 1945 0.41 0.54 0.36 190 XMSlimDrugH 1839 0.49 0.93 0.34 191 TM2_M_BODY_EMPTY 1831 0.29 0.12 0.34 192 XMSubMetaSxObfu_02 1829 0.35 0.36 0.34 193 XMSUPPORT 1802 0.25 0.00 0.34 194 RELAYCOUNTRY_FR 1784 0.76 2.05 0.33 195 AC_DIV_BONANZA 1783 0.26 0.06 0.33 196 HTML_IMAGE_ONLY_24 1751 0.38 0.55 0.33 197 XMSexyCombo_04 1748 0.46 0.85 0.33 198 SpammyFromTLD_02 1731 0.98 2.92 0.32 199 XM_H_SpoofStaff4 1724 0.25 0.03 0.32 200 XMDateMe_00 1677 0.31 0.31 0.31 ----------------------------------------------------------------------