Email: 423688 Autolearn: 0 AvgScore: 2.23 AvgScanTime: 1.92 sec Spam: 110779 Autolearn: 0 AvgScore: 13.08 AvgScanTime: 2.19 sec Ham: 312909 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.82 sec Time Spent Running SA: 225.57 hours Time Spent Processing Spam: 67.31 hours Time Spent Processing Ham: 158.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 104888 89.36 94.68 87.48 2 DCC_CHECK 72866 55.39 65.78 51.72 3 DKIM_SIGNED 67104 75.74 60.57 81.11 4 XM_DK_Pass 65546 74.66 59.17 80.14 5 DKIM_VALID 61570 71.20 55.58 76.73 6 XMListUnsubscribeExists 61248 59.78 55.29 61.37 7 DKIM_VALID_AU 51002 55.74 46.04 59.17 8 MIME_HTML_ONLY 49856 28.93 45.00 23.24 9 BAYES_50 48307 52.75 43.61 55.99 10 XM_H_QuotedFrom 45908 40.70 41.44 40.44 11 RELAYCOUNTRY_META 45170 14.84 40.77 5.66 12 DCC_CHECK_NEGATIVE 36324 43.29 32.79 47.01 13 UNTRUSTED_Relay 35743 9.75 32.27 1.78 14 HTML_FONT_LOW_CONTRAST 34426 31.69 31.08 31.91 15 BAYES_99 32509 13.13 29.35 7.39 16 BOTNET_IPINHOSTNAME 30995 12.15 27.98 6.54 17 XM_UncommonTLD01 30414 10.12 27.45 3.99 18 XM_DK_Undo_02 30208 14.47 27.27 9.94 19 LOC_TINY_FONT_1 29637 28.74 26.75 29.45 20 FROM_EXCESS_BASE64 29589 11.46 26.71 6.06 21 XMSubLong 27686 22.57 24.99 21.72 22 BAYES_999 27235 11.07 24.58 6.28 23 T_REMOTE_IMAGE 26802 8.40 24.19 2.81 24 HTML_MIME_NO_HTML_TAG 25478 6.87 23.00 1.16 25 HTML_SHORT_LINK_IMG_1 25198 5.97 22.75 0.03 26 BODY_URI_ONLY 24900 5.91 22.48 0.05 27 MIME_HEADER_CTYPE_ONLY 24578 5.89 22.19 0.11 28 FVGT_m_MULTI_ODD 24047 22.22 21.71 22.40 29 TR_DCC_Bayes_99 21353 8.32 19.28 4.45 30 DKIM_VALID_EF 18788 24.94 16.96 27.76 31 XM_Body_Dirty_Words 18576 15.12 16.77 14.53 32 XM_UB50 17033 4.72 15.38 0.95 33 T_TM2_M_HEADER_IN_MSG 15703 20.26 14.18 22.42 34 HTML_IMAGE_RATIO_02 15542 13.15 14.03 12.83 35 MultiRelay 14997 14.12 13.54 14.33 36 HTML_IMAGE_ONLY_08 14860 3.56 13.41 0.07 37 HDRS_LCASE_IMGONLY 14742 3.52 13.31 0.06 38 T_KAM_HTML_FONT_INVALID 14682 16.42 13.25 17.55 39 FSL_BULK_SIG 14559 9.26 13.14 7.88 40 XM_Multi_Part_URI 14009 14.87 12.65 15.66 41 FROM_SUSPICIOUS_NTLD 13979 3.41 12.62 0.14 42 BOTNET 13461 4.91 12.15 2.35 43 XMSexyCombo_05 12876 7.66 11.62 6.26 44 RELAYCOUNTRY_CZ 12246 2.91 11.05 0.02 45 RELAYCOUNTRY_FR 10438 2.76 9.42 0.41 46 MISSING_HEADERS 10258 2.59 9.26 0.23 47 XM_Evil_Numbers_Gen 10061 11.25 9.08 12.02 48 HTML_SHORT_CENTER 9931 2.45 8.96 0.14 49 HTML_IMAGE_ONLY_04 9802 2.35 8.85 0.05 50 XM_H_Long_From01 9451 6.80 8.53 6.19 51 XMSubMetaSx_00 9123 5.82 8.24 4.96 52 LongTLD 8515 2.15 7.69 0.18 53 BAYES_80 8411 4.73 7.59 3.71 54 XMNumbers 8183 4.97 7.39 4.12 55 T_XMDrugObfuBody_14 8137 6.96 7.35 6.82 56 SpammyFromTLD_02 8088 2.27 7.30 0.49 57 MPART_ALT_DIFF 7774 4.73 7.02 3.92 58 TooManyTo_001 7715 6.44 6.96 6.26 59 SHORT_IMG_SUSP_NTLD 7293 1.72 6.58 0.00 60 FROM_NTLD_LINKBAIT 7288 1.72 6.58 0.00 61 HTML_IMAGE_RATIO_04 7140 6.73 6.45 6.83 62 XM_UB99 6989 1.66 6.31 0.01 63 XM_DIRTYINTL 6801 2.84 6.14 1.67 64 BAYES_60 6735 5.95 6.08 5.91 65 LOTS_OF_MONEY 6687 7.33 6.04 7.78 66 XM_JunkDunk 6310 1.49 5.70 0.00 67 XM_UB999 5701 1.35 5.15 0.01 68 DKIM_INVALID 5534 4.54 5.00 4.37 69 XM_B_Phish_Phrases 5434 6.33 4.91 6.84 70 BAYES_95 5414 2.87 4.89 2.16 71 MIME_HTML_MOSTLY 4834 3.57 4.36 3.29 72 MultiRelay_Combo 4673 1.27 4.22 0.23 73 MultiRelay_CC 4673 1.27 4.22 0.23 74 XM_BadFromFormat 4666 1.18 4.21 0.10 75 LotsOfNums_01 4475 8.31 4.04 9.82 76 RELAYCOUNTRY_GB 4381 1.58 3.95 0.74 77 MIME_HTML_ONLY_MULTI 4331 2.26 3.91 1.68 78 HTML_IMAGE_RATIO_08 4183 2.60 3.78 2.18 79 HTML_IMAGE_RATIO_06 4053 3.40 3.66 3.30 80 BAYES_40 4041 3.81 3.65 3.86 81 RELAYCOUNTRY_IT 3991 0.98 3.60 0.06 82 XMStrtUSub 3931 4.18 3.55 4.40 83 RCVD_IN_BL_SPAMCOP_NET 3684 1.38 3.33 0.69 84 RELAYCOUNTRY_CA 3594 2.24 3.24 1.88 85 XM_SPF_SoftFail 3583 2.01 3.23 1.57 86 XMSubMetaI_00 3385 1.59 3.06 1.08 87 HK_RANDOM_FROM 3364 0.94 3.04 0.19 88 URI_HEX 3290 2.61 2.97 2.48 89 T_TooManySym_01 3191 5.00 2.88 5.75 90 TM2_M_URI_OPT_OUT 3164 2.12 2.86 1.86 91 RCVD_IN_RP_RNBL 3060 0.76 2.76 0.05 92 XMBody_17 2962 1.27 2.67 0.78 93 NORDNS_LOW_CONTRAST 2892 0.72 2.61 0.05 94 XM_H_Long_From02 2791 1.37 2.52 0.96 95 BAYES_20 2728 2.81 2.46 2.93 96 XM_URI_RBL 2678 1.11 2.42 0.65 97 XM_CamelCaseFrm001 2668 2.13 2.41 2.04 98 RCVD_IN_RP_SAFE 2598 11.86 2.35 15.23 99 DATE_IN_PAST_06_12 2528 0.64 2.28 0.06 100 SUBJ_ALL_CAPS 2439 1.69 2.20 1.51 101 XM_UB60 2437 0.64 2.20 0.08 102 T_XMDrugObfuBody_08 2419 1.45 2.18 1.19 103 DIET_1 2361 0.91 2.13 0.48 104 NO_DNS_FOR_FROM 2349 1.49 2.12 1.27 105 XMSexyCombo_01 2222 1.49 2.01 1.31 106 XM_OfRef6 2217 1.35 2.00 1.12 107 MIME_QP_LONG_LINE 2167 4.64 1.96 5.60 108 XM_UB80 2157 0.54 1.95 0.05 109 XM_UB95 2096 0.50 1.89 0.01 110 RCVD_IN_RP_CERTIFIED 1990 10.30 1.80 13.31 111 BOTNET_NORDNS 1972 0.47 1.78 0.01 112 RCVD_IN_MSPIKE_H2 1938 3.65 1.75 4.32 113 XM_SendGrid 1915 5.54 1.73 6.89 114 HTML_OFF_PAGE 1801 0.43 1.63 0.00 115 T_Symld_Words_02 1767 0.63 1.60 0.29 116 SpammyFromTLD_01 1569 0.73 1.42 0.48 117 XMSubject_48 1563 0.39 1.41 0.02 118 FROM_MISSP_REPLYTO 1531 0.38 1.38 0.03 119 HTML_IMAGE_ONLY_24 1517 0.54 1.37 0.25 120 TR_Mismatch_TLD_02 1504 0.41 1.36 0.07 121 XMBody_78 1485 0.78 1.34 0.58 122 XM_H_TOP 1482 0.35 1.34 0.01 123 XMPhish11 1482 0.94 1.34 0.81 124 XMSexyCombo_04 1451 0.97 1.31 0.85 125 SUBJ_DOLLARS 1407 0.78 1.27 0.61 126 XMBdyGiftCard01 1406 1.16 1.27 1.12 127 FVGT_m_MULTI_ODD_EMAIL 1389 0.36 1.25 0.04 128 BODY_ENHANCEMENT 1385 0.51 1.25 0.25 129 XMPhish30 1384 0.74 1.25 0.57 130 MAILING_LIST_MULTI 1378 1.93 1.24 2.17 131 URIBL_BLACK 1370 0.38 1.24 0.07 132 HTML_IMAGE_ONLY_28 1346 0.55 1.22 0.31 133 DATE_IN_PAST_03_06 1298 0.37 1.17 0.09 134 T_HTML_TAG_BALANCE_CENTER 1282 0.58 1.16 0.38 135 XMDiploma_00 1272 1.20 1.15 1.22 136 UNPARSEABLE_RELAY 1255 3.22 1.13 3.96 137 XMGppyBdWords 1252 0.53 1.13 0.31 138 TR_XM_RelayPhish 1249 0.59 1.13 0.40 139 BAYES_05 1237 1.66 1.12 1.86 140 XMMoneyMeta_00 1232 0.52 1.11 0.30 141 RELAYCOUNTRY_IN 1202 0.37 1.09 0.12 142 LONG_JUNK_URI 1195 0.35 1.08 0.10 143 LONG_HEX_URI 1194 0.41 1.08 0.17 144 RELAYCOUNTRY_SE 1187 0.29 1.07 0.02 145 T_XMDrugObfuBody_00 1179 0.64 1.06 0.48 146 RELAYCOUNTRY_NL 1178 0.43 1.06 0.21 147 RCVD_IN_IADB_LISTED 1168 4.10 1.05 5.18 148 XMSlimDrugH 1160 0.45 1.05 0.24 149 TM2_M_VERY_LONG_WORD 1148 1.03 1.04 1.03 150 RELAYCOUNTRY_CN 1146 0.33 1.03 0.07 151 BAYES_00 1120 12.01 1.01 15.90 152 SHORTENER_SHORT_IMG 1091 0.26 0.98 0.00 153 XM_H_PHPOS 1073 0.80 0.97 0.74 154 XMStockSpam_06 1059 2.12 0.96 2.54 155 XM_salutation2 1056 0.92 0.95 0.91 156 RCVD_IN_IADB_SPF 1052 3.67 0.95 4.63 157 T_XMHurry_00 1040 0.68 0.94 0.58 158 RCVD_IN_IADB_SENDERID 1032 3.37 0.93 4.23 159 TR_Caps_n_Bayes_99 1032 0.29 0.93 0.07 160 DKIM_ADSP_CUSTOM_MED 1028 0.98 0.93 1.00 161 RCVD_IN_IADB_DK 1024 3.30 0.92 4.14 162 XMGenDplmaNmb 980 0.76 0.88 0.71 163 NML_ADSP_CUSTOM_MED 980 0.76 0.88 0.72 164 RELAYCOUNTRY_DE 968 0.53 0.87 0.40 165 FILL_THIS_FORM 963 0.45 0.87 0.30 166 RELAYCOUNTRY_AT 917 0.49 0.83 0.38 167 URI_TRY_3LD 915 1.35 0.83 1.54 168 URI_NOVOWEL 912 0.60 0.82 0.52 169 TR_Symld_Words 911 1.49 0.82 1.72 170 ALL_TRUSTED 902 10.19 0.81 13.51 171 XM_ProductURIs 900 1.62 0.81 1.91 172 XMWghtMeta_00 897 0.23 0.81 0.03 173 TR_Mismatch_TLD_01 883 0.33 0.80 0.16 174 TR_LOTS_OF_MONEY2 882 0.64 0.80 0.59 175 T_MONEY_PERCENT 882 0.64 0.80 0.59 176 FORGED_GMAIL_RCVD 882 0.53 0.80 0.44 177 PLING_QUERY 879 0.50 0.79 0.39 178 XMSubMetaSx_01 859 0.30 0.78 0.13 179 XM_ShortIntro_01 859 0.44 0.78 0.32 180 NUMERIC_HTTP_ADDR 847 0.38 0.76 0.25 181 URIBL_DBL_SPAM 830 0.23 0.75 0.05 182 FILL_THIS_FORM_LONG 827 0.38 0.75 0.25 183 XMSubGiftCard1 815 0.26 0.74 0.09 184 THIS_AD 809 0.72 0.73 0.71 185 XM_NotFromAmazon 800 0.19 0.72 0.01 186 T_TooManySym_02 794 1.55 0.72 1.85 187 XM_RXBody 787 1.12 0.71 1.26 188 HTML_IMAGE_ONLY_12 786 0.29 0.71 0.15 189 XM_Doc_Oz_Body 778 0.27 0.70 0.11 190 XMSubMetaSSx_00 775 0.37 0.70 0.26 191 TR_MetaPhish_Combo_01 766 1.59 0.69 1.91 192 XMSubGiftCard2 759 0.19 0.69 0.01 193 XM_H_PHPMailer 754 0.63 0.68 0.61 194 TooManyTo_002 744 1.30 0.67 1.52 195 XM_OverStock_LProb 740 0.26 0.67 0.12 196 XMPhish14 738 0.38 0.67 0.27 197 CANT_SEE_AD 737 0.17 0.67 0.00 198 HTML_FONT_SIZE_LARGE 725 0.26 0.65 0.12 199 RELAYCOUNTRY_BR 722 0.20 0.65 0.04 200 XMSubMetaI_01 715 0.21 0.65 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 273722 89.36 94.68 87.48 2 DKIM_SIGNED 253787 75.74 60.57 81.11 3 XM_DK_Pass 250762 74.66 59.17 80.14 4 DKIM_VALID 240106 71.20 55.58 76.73 5 XMListUnsubscribeExists 192023 59.78 55.29 61.37 6 DKIM_VALID_AU 185151 55.74 46.04 59.17 7 BAYES_50 175194 52.75 43.61 55.99 8 DCC_CHECK 161834 55.39 65.78 51.72 9 DCC_CHECK_NEGATIVE 147107 43.29 32.79 47.01 10 XM_H_QuotedFrom 126549 40.70 41.44 40.44 11 HTML_FONT_LOW_CONTRAST 99848 31.69 31.08 31.91 12 LOC_TINY_FONT_1 92139 28.74 26.75 29.45 13 DKIM_VALID_EF 86867 24.94 16.96 27.76 14 MIME_HTML_ONLY 72725 28.93 45.00 23.24 15 T_TM2_M_HEADER_IN_MSG 70157 20.26 14.18 22.42 16 FVGT_m_MULTI_ODD 70094 22.22 21.71 22.40 17 XMSubLong 67949 22.57 24.99 21.72 18 T_KAM_HTML_FONT_INVALID 54903 16.42 13.25 17.55 19 XM_DKIMWhitelistDomains 50068 11.82 0.02 16.00 20 BAYES_00 49755 12.01 1.01 15.90 21 XM_Multi_Part_URI 48992 14.87 12.65 15.66 22 RCVD_IN_RP_SAFE 47644 11.86 2.35 15.23 23 XM_Body_Dirty_Words 45476 15.12 16.77 14.53 24 MultiRelay 44847 14.12 13.54 14.33 25 TR_XM_DK_Bayes 44117 10.57 0.60 14.10 26 TR_XM_DK_Bayes1 42495 10.16 0.51 13.58 27 ALL_TRUSTED 42284 10.19 0.81 13.51 28 RCVD_IN_RP_CERTIFIED 41659 10.30 1.80 13.31 29 HTML_IMAGE_RATIO_02 40159 13.15 14.03 12.83 30 TR_XM_DK_Bayes2 37950 9.06 0.40 12.13 31 XM_Evil_Numbers_Gen 37607 11.25 9.08 12.02 32 XM_DK_Undo_02 31102 14.47 27.27 9.94 33 LotsOfNums_01 30735 8.31 4.04 9.82 34 FSL_BULK_SIG 24654 9.26 13.14 7.88 35 LOTS_OF_MONEY 24354 7.33 6.04 7.78 36 BAYES_99 23116 13.13 29.35 7.39 37 XM_SendGrid 21565 5.54 1.73 6.89 38 XM_B_Phish_Phrases 21405 6.33 4.91 6.84 39 HTML_IMAGE_RATIO_04 21362 6.73 6.45 6.83 40 T_XMDrugObfuBody_14 21345 6.96 7.35 6.82 41 BOTNET_IPINHOSTNAME 20466 12.15 27.98 6.54 42 BAYES_999 19666 11.07 24.58 6.28 43 TooManyTo_001 19589 6.44 6.96 6.26 44 XMSexyCombo_05 19575 7.66 11.62 6.26 45 XM_H_Long_From01 19372 6.80 8.53 6.19 46 FROM_EXCESS_BASE64 18949 11.46 26.71 6.06 47 BAYES_60 18489 5.95 6.08 5.91 48 T_TooManySym_01 17985 5.00 2.88 5.75 49 RELAYCOUNTRY_META 17718 14.84 40.77 5.66 50 MIME_QP_LONG_LINE 17509 4.64 1.96 5.60 51 RCVD_IN_IADB_LISTED 16205 4.10 1.05 5.18 52 XMSubMetaSx_00 15521 5.82 8.24 4.96 53 RCVD_IN_IADB_SPF 14483 3.67 0.95 4.63 54 TR_DCC_Bayes_99 13911 8.32 19.28 4.45 55 XMStrtUSub 13764 4.18 3.55 4.40 56 DKIM_INVALID 13681 4.54 5.00 4.37 57 RCVD_IN_MSPIKE_H2 13512 3.65 1.75 4.32 58 RCVD_IN_IADB_SENDERID 13226 3.37 0.93 4.23 59 RCVD_IN_IADB_DK 12957 3.30 0.92 4.14 60 XMNumbers 12882 4.97 7.39 4.12 61 XM_UncommonTLD01 12471 10.12 27.45 3.99 62 UNPARSEABLE_RELAY 12400 3.22 1.13 3.96 63 MPART_ALT_DIFF 12281 4.73 7.02 3.92 64 BAYES_40 12093 3.81 3.65 3.86 65 TO_MALFORMED 11648 2.84 0.34 3.72 66 BAYES_80 11617 4.73 7.59 3.71 67 TVD_RCVD_IP 11380 2.73 0.18 3.64 68 IN_ZIMBRA_NJ_WHITELIST 10456 2.47 0.01 3.34 69 HTML_IMAGE_RATIO_06 10340 3.40 3.66 3.30 70 MIME_HTML_MOSTLY 10308 3.57 4.36 3.29 71 BAYES_20 9179 2.81 2.46 2.93 72 RCVD_IN_IADB_VOUCHED 9084 2.29 0.55 2.90 73 T_REMOTE_IMAGE 8787 8.40 24.19 2.81 74 XMStockSpam_06 7939 2.12 0.96 2.54 75 URI_HEX 7768 2.61 2.97 2.48 76 BOTNET 7338 4.91 12.15 2.35 77 HTML_IMAGE_RATIO_08 6828 2.60 3.78 2.18 78 INVALID_MSGID 6819 1.64 0.12 2.18 79 MAILING_LIST_MULTI 6788 1.93 1.24 2.17 80 BAYES_95 6749 2.87 4.89 2.16 81 RCVD_IN_MSPIKE_WL 6729 1.67 0.33 2.15 82 RCVD_IN_MSPIKE_H3 6694 1.67 0.33 2.14 83 XM_CamelCaseFrm001 6370 2.13 2.41 2.04 84 TR_MetaPhish_Combo_01 5987 1.59 0.69 1.91 85 XM_ProductURIs 5964 1.62 0.81 1.91 86 RELAYCOUNTRY_CA 5898 2.24 3.24 1.88 87 TM2_M_URI_OPT_OUT 5816 2.12 2.86 1.86 88 BAYES_05 5812 1.66 1.12 1.86 89 T_TooManySym_02 5784 1.55 0.72 1.85 90 RCVD_IN_IADB_OPTIN 5633 1.46 0.51 1.80 91 IN_HORDE_ADDRESS_BOOK 5602 1.33 0.04 1.79 92 UNTRUSTED_Relay 5579 9.75 32.27 1.78 93 ANY_BOUNCE_MESSAGE 5508 1.45 0.58 1.76 94 BOUNCE_MESSAGE 5507 1.45 0.58 1.76 95 TR_Symld_Words 5389 1.49 0.82 1.72 96 MIME_HTML_ONLY_MULTI 5264 2.26 3.91 1.68 97 XM_DIRTYINTL 5225 2.84 6.14 1.67 98 USER_IN_DEF_DKIM_WL 5198 1.23 0.02 1.66 99 XM_SPF_SoftFail 4912 2.01 3.23 1.57 100 XM_DK_Undo_01 4834 1.29 0.55 1.54 101 URI_TRY_3LD 4824 1.35 0.83 1.54 102 TooManyTo_002 4758 1.30 0.67 1.52 103 SUBJ_ALL_CAPS 4730 1.69 2.20 1.51 104 XM_PDF 4546 1.16 0.33 1.45 105 XMSexyCombo_01 4106 1.49 2.01 1.31 106 NO_DNS_FOR_FROM 3985 1.49 2.12 1.27 107 XM_RXBody 3942 1.12 0.71 1.26 108 XMDiploma_00 3820 1.20 1.15 1.22 109 T_XMDrugObfuBody_08 3728 1.45 2.18 1.19 110 XM_GoogleGroups 3659 0.98 0.43 1.17 111 HTML_MIME_NO_HTML_TAG 3622 6.87 23.00 1.16 112 XMSubMetaSxObfu_03 3516 0.98 0.58 1.12 113 XM_OfRef6 3509 1.35 2.00 1.12 114 XMBdyGiftCard01 3506 1.16 1.27 1.12 115 XMSubMetaI_00 3372 1.59 3.06 1.08 116 TooManyTo_003 3324 0.93 0.57 1.06 117 TM2_M_VERY_LONG_WORD 3221 1.03 1.04 1.03 118 DKIM_ADSP_CUSTOM_MED 3115 0.98 0.93 1.00 119 XM_H_Long_From02 3002 1.37 2.52 0.96 120 XM_UB50 2957 4.72 15.38 0.95 121 XM_B_REG_HTML 2888 0.82 0.52 0.92 122 XM_salutation2 2839 0.92 0.95 0.91 123 XMGappySubj_01 2794 0.74 0.33 0.89 124 XMSexyCombo_04 2662 0.97 1.31 0.85 125 TooManyTo_004 2526 0.72 0.49 0.81 126 XMPhish11 2519 0.94 1.34 0.81 127 XMBody_95 2477 0.63 0.16 0.79 128 XMBody_17 2426 1.27 2.67 0.78 129 RELAYCOUNTRY_GB 2331 1.58 3.95 0.74 130 XM_H_PHPOS 2316 0.80 0.97 0.74 131 USER_IN_WHITELIST 2286 0.54 0.00 0.73 132 NML_ADSP_CUSTOM_MED 2259 0.76 0.88 0.72 133 XMGenDplmaNmb 2223 0.76 0.88 0.71 134 THIS_AD 2222 0.72 0.73 0.71 135 HTML_FONT_FACE_BAD 2178 0.66 0.56 0.70 136 RCVD_IN_BL_SPAMCOP_NET 2168 1.38 3.33 0.69 137 XMSubMetaSxObfu_02 2143 0.61 0.42 0.68 138 XM_B_COPY_HTML 2124 0.66 0.60 0.68 139 XMHTMLBadTable_001 2109 0.65 0.58 0.67 140 TM2_M_A_HREF_HREF 2108 0.57 0.29 0.67 141 XMNoVowels 2054 0.57 0.33 0.66 142 XM_URI_RBL 2041 1.11 2.42 0.65 143 HTML_TAG_BALANCE_BODY 1992 0.61 0.53 0.64 144 TooManyTo_005 1988 0.58 0.44 0.64 145 SUBJ_DOLLARS 1916 0.78 1.27 0.61 146 XMGappySubj_02 1910 0.48 0.12 0.61 147 XM_H_PHPMailer 1906 0.63 0.68 0.61 148 T_TooManySym_03 1864 0.50 0.22 0.60 149 TR_LOTS_OF_MONEY2 1843 0.64 0.80 0.59 150 T_MONEY_PERCENT 1843 0.64 0.80 0.59 151 T_XMHurry_00 1824 0.68 0.94 0.58 152 XMBody_78 1822 0.78 1.34 0.58 153 XMPhish30 1771 0.74 1.25 0.57 154 HELO_NODOT 1716 0.49 0.33 0.55 155 REMOVE_BEFORE_LINK 1669 0.46 0.25 0.53 156 URI_NOVOWEL 1640 0.60 0.82 0.52 157 XM_Body_Obfu01 1578 0.42 0.18 0.50 158 RDNS_DYNAMIC 1556 0.51 0.55 0.50 159 SpammyFromTLD_02 1539 2.27 7.30 0.49 160 SpammyFromTLD_01 1515 0.73 1.42 0.48 161 T_XMDrugObfuBody_00 1514 0.64 1.06 0.48 162 XM_shorewaves_Whitelist 1508 0.36 0.00 0.48 163 DIET_1 1502 0.91 2.13 0.48 164 XMLngstWrd_00 1438 0.40 0.24 0.46 165 XMBrknScrpt_02 1401 0.44 0.43 0.45 166 FORGED_GMAIL_RCVD 1365 0.53 0.80 0.44 167 HTTPS_HTTP_MISMATCH 1331 0.39 0.31 0.43 168 XMLngstWrd_01 1304 0.36 0.21 0.42 169 T_FILL_THIS_FORM_SHORT 1292 0.46 0.59 0.41 170 RELAYCOUNTRY_AU 1277 0.42 0.44 0.41 171 RELAYCOUNTRY_FR 1276 2.76 9.42 0.41 172 XMCapTrack 1273 0.39 0.35 0.41 173 TR_XM_RelayPhish 1265 0.59 1.13 0.40 174 RELAYCOUNTRY_DE 1257 0.53 0.87 0.40 175 PLING_QUERY 1230 0.50 0.79 0.39 176 T_HTML_TAG_BALANCE_CENTER 1188 0.58 1.16 0.38 177 AC_DIV_BONANZA 1186 0.30 0.06 0.38 178 RELAYCOUNTRY_AT 1176 0.49 0.83 0.38 179 FSL_THIS_IS_ADV 1143 0.36 0.33 0.37 180 DKIM_ADSP_NXDOMAIN 1118 0.41 0.56 0.36 181 XM_H_PHPOS_M 1103 0.35 0.36 0.35 182 XMHTML_After_End 1095 0.41 0.57 0.35 183 TO_NO_BRKTS_HTML_ONLY 1069 0.29 0.15 0.34 184 T_TooManySym_04 1029 0.26 0.06 0.33 185 XMSubNoVowel 1014 0.35 0.43 0.32 186 XM_ShortIntro_01 988 0.44 0.78 0.32 187 XMGppyBdWords 984 0.53 1.13 0.31 188 XM_Akamai 972 0.23 0.01 0.31 189 HTML_IMAGE_ONLY_28 969 0.55 1.22 0.31 190 XMMoneyMeta_00 953 0.52 1.11 0.30 191 BASE64_LENGTH_79_INF 951 0.29 0.26 0.30 192 FILL_THIS_FORM 949 0.45 0.87 0.30 193 XMSolicitRefs_0 947 0.32 0.38 0.30 194 XMManySubDom_06 938 0.24 0.08 0.30 195 T_Symld_Words_02 916 0.63 1.60 0.29 196 XMManySubDom_07 882 0.22 0.06 0.28 197 LOW_PRICE 871 0.33 0.47 0.28 198 T_OBFU_PDF_ATTACH 863 0.22 0.06 0.28 199 XMPhish14 853 0.38 0.67 0.27 200 XM_B_TRADE_HTML 840 0.24 0.17 0.27 ----------------------------------------------------------------------