Email: 638756 Autolearn: 0 AvgScore: 2.37 AvgScanTime: 2.02 sec Spam: 159615 Autolearn: 0 AvgScore: 12.39 AvgScanTime: 2.43 sec Ham: 479141 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.88 sec Time Spent Running SA: 358.11 hours Time Spent Processing Spam: 107.85 hours Time Spent Processing Ham: 250.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152737 89.11 95.69 86.91 2 DKIM_SIGNED 136756 77.71 85.68 75.06 3 XM_DK_Pass 133235 76.02 83.47 73.54 4 DCC_CHECK 129365 49.55 81.05 39.06 5 DKIM_VALID 126628 72.24 79.33 69.87 6 XMListUnsubscribeExists 121951 56.72 76.40 50.16 7 DKIM_VALID_AU 102118 52.44 63.98 48.60 8 XM_DK_Undo_02 81469 23.89 51.04 14.84 9 XM_H_QuotedFrom 80537 40.64 50.46 37.36 10 BAYES_99 71851 21.21 45.02 13.28 11 HTML_FONT_LOW_CONTRAST 61400 30.12 38.47 27.34 12 BAYES_999 61306 18.46 38.41 11.81 13 LOC_TINY_FONT_1 58940 25.81 36.93 22.11 14 TR_DCC_Bayes_99 58732 13.85 36.80 6.21 15 BAYES_50 52004 47.24 32.58 52.13 16 FVGT_m_MULTI_ODD 47764 23.66 29.92 21.58 17 MIME_HTML_ONLY 47312 22.05 29.64 19.52 18 XMSubLong 42154 22.83 26.41 21.64 19 DKIM_VALID_EF 38867 26.81 24.35 27.63 20 T_KAM_HTML_FONT_INVALID 35067 18.51 21.97 17.36 21 XM_Body_Dirty_Words 33354 13.70 20.90 11.30 22 T_TM2_M_HEADER_IN_MSG 29851 27.91 18.70 30.97 23 DCC_CHECK_NEGATIVE 27981 48.59 17.53 58.94 24 XM_Multi_Part_URI 26378 13.70 16.53 12.76 25 MultiRelay 25420 18.75 15.93 19.69 26 HTML_IMAGE_RATIO_02 25109 10.09 15.73 8.21 27 RELAYCOUNTRY_META 24738 7.42 15.50 4.73 28 BOTNET_IPINHOSTNAME 24275 7.85 15.21 5.40 29 BOTNET 22460 4.95 14.07 1.91 30 XM_Evil_Numbers_Gen 22082 10.24 13.83 9.05 31 FSL_BULK_SIG 17577 8.45 11.01 7.60 32 XMSexyCombo_05 16959 5.08 10.62 3.23 33 LOTS_OF_MONEY 16324 9.83 10.23 9.69 34 TooManyTo_001 15385 8.61 9.64 8.27 35 XM_UncommonTLD01 14593 4.61 9.14 3.09 36 T_XMDrugObfuBody_14 14494 8.57 9.08 8.40 37 HTML_IMAGE_RATIO_04 14287 6.52 8.95 5.70 38 UNTRUSTED_Relay 14057 3.03 8.81 1.11 39 XMSubMetaSx_00 13789 5.63 8.64 4.63 40 MPART_ALT_DIFF 13635 4.46 8.54 3.10 41 XM_salutation2 13423 3.71 8.41 2.14 42 XM_H_Long_From01 12718 6.47 7.97 5.97 43 XM_B_Phish_Phrases 12140 5.68 7.61 5.04 44 BAYES_80 11462 4.86 7.18 4.09 45 LotsOfNums_01 10971 8.58 6.87 9.15 46 DKIM_INVALID 10128 5.48 6.35 5.19 47 SpammyFromTLD_02 9500 1.74 5.95 0.34 48 BAYES_60 9242 6.11 5.79 6.22 49 MIME_HTML_MOSTLY 9029 2.92 5.66 2.01 50 FROM_EXCESS_BASE64 8848 4.10 5.54 3.62 51 HTML_IMAGE_RATIO_06 7922 3.87 4.96 3.51 52 HTML_IMAGE_RATIO_08 7770 3.38 4.87 2.89 53 XM_SendGrid 7737 6.05 4.85 6.46 54 XM_DIRTYINTL 7385 2.48 4.63 1.77 55 BAYES_95 7241 3.24 4.54 2.81 56 RCVD_IN_RP_SAFE 6985 8.33 4.38 9.65 57 XM_UB50 6828 1.61 4.28 0.72 58 T_REMOTE_IMAGE 6459 4.65 4.05 4.85 59 RELAYCOUNTRY_CA 6446 2.04 4.04 1.38 60 XMStrtUSub 6302 4.36 3.95 4.50 61 TM2_M_URI_OPT_OUT 6243 2.22 3.91 1.66 62 XM_SPF_SoftFail 5980 2.57 3.75 2.17 63 MIME_HTML_ONLY_MULTI 5758 2.18 3.61 1.70 64 RCVD_IN_RP_CERTIFIED 5629 7.39 3.53 8.67 65 FROM_SUSPICIOUS_NTLD 5542 0.91 3.47 0.06 66 XMNumbers 5285 2.85 3.31 2.69 67 URI_HEX 5151 2.06 3.23 1.67 68 XMDiploma_00 5129 2.68 3.21 2.50 69 XM_URI_RBL 4947 1.14 3.10 0.49 70 MIME_QP_LONG_LINE 4825 5.83 3.02 6.76 71 XMBdyGiftCard01 4761 1.85 2.98 1.47 72 XM_CamelCaseFrm001 4738 2.12 2.97 1.84 73 T_TooManySym_01 4426 4.54 2.77 5.13 74 RCVD_IN_MSPIKE_H2 4370 4.41 2.74 4.97 75 XM_OfRef6 4204 1.64 2.63 1.30 76 XMGenDplmaNmb 3884 1.92 2.43 1.75 77 XMSexyCombo_01 3880 1.20 2.43 0.79 78 RCVD_IN_RP_RNBL 3782 0.61 2.37 0.03 79 RCVD_IN_IADB_LISTED 3712 5.72 2.33 6.85 80 TM2_M_VERY_LONG_WORD 3703 1.29 2.32 0.94 81 T_XMDrugObfuBody_08 3687 1.74 2.31 1.55 82 HTML_MIME_NO_HTML_TAG 3590 2.31 2.25 2.33 83 XMSubMetaSxObfu_03 3580 1.43 2.24 1.16 84 T_XMDrugObfuBody_00 3522 1.40 2.21 1.14 85 XM_H_TOP 3322 0.53 2.08 0.01 86 RCVD_IN_BL_SPAMCOP_NET 3316 0.94 2.08 0.56 87 XMPhish11 3301 1.45 2.07 1.25 88 TR_M_TOP_BAYES 3224 0.51 2.02 0.00 89 RELAYCOUNTRY_FR 3222 0.66 2.02 0.21 90 MultiRelay_Combo 3154 0.60 1.98 0.14 91 MultiRelay_CC 3154 0.60 1.98 0.14 92 NUMERIC_HTTP_ADDR 3146 0.75 1.97 0.35 93 XMStockSpam_06 3100 1.48 1.94 1.32 94 NO_DNS_FOR_FROM 3073 1.35 1.93 1.15 95 RCVD_IN_IADB_SPF 3031 4.93 1.90 5.94 96 MAILING_LIST_MULTI 3018 2.30 1.89 2.44 97 TR_XM_RelayPhish 3016 0.96 1.89 0.65 98 DATE_IN_PAST_24_48 2766 0.44 1.73 0.01 99 RCVD_IN_IADB_SENDERID 2735 4.35 1.71 5.22 100 FILL_THIS_FORM 2732 0.76 1.71 0.44 101 SUBJ_ALL_CAPS 2701 1.72 1.69 1.73 102 HTML_FONT_SIZE_LARGE 2670 0.87 1.67 0.61 103 RCVD_IN_IADB_DK 2668 4.24 1.67 5.10 104 XMHTML_After_End 2647 0.69 1.66 0.37 105 DIET_1 2639 0.63 1.65 0.29 106 BAYES_40 2594 3.66 1.63 4.34 107 XMSubMetaI_00 2549 0.87 1.60 0.63 108 ALL_TRUSTED 2498 12.11 1.57 15.63 109 HTML_IMAGE_ONLY_12 2478 0.58 1.55 0.25 110 UNPARSEABLE_RELAY 2463 2.85 1.54 3.29 111 XM_UB99 2461 0.39 1.54 0.01 112 BOTNET_NORDNS 2428 0.39 1.52 0.01 113 XM_H_Long_From02 2412 1.49 1.51 1.49 114 BAYES_20 2383 2.65 1.49 3.04 115 RCVD_IN_IADB_VOUCHED 2376 3.74 1.49 4.49 116 XMBody_17 2306 0.68 1.44 0.42 117 XM_UB60 2303 0.40 1.44 0.06 118 XMSexyCombo_04 2299 0.75 1.44 0.52 119 NORMAL_HTTP_TO_IP 2282 0.41 1.43 0.07 120 SpammyFromTLD_01 2233 0.84 1.40 0.66 121 XM_XX_Yahoo 2201 0.41 1.38 0.09 122 T_XMHurry_00 2123 0.83 1.33 0.66 123 TR_Symld_Words 2098 1.68 1.31 1.80 124 RCVD_IN_PSBL 2068 0.33 1.30 0.01 125 XMBrknScrpt_02 2064 0.78 1.29 0.60 126 XM_DK_Undo_01 2059 1.78 1.29 1.94 127 XM_ProductURIs 2021 1.23 1.27 1.22 128 XMPhish30 2013 0.64 1.26 0.44 129 XMBody_78 2005 0.65 1.26 0.44 130 XM_UB999 1999 0.32 1.25 0.01 131 FILL_THIS_FORM_LONG 1989 0.58 1.25 0.36 132 BODY_URI_ONLY 1979 0.40 1.24 0.12 133 XM_H_PHPOS 1954 1.09 1.22 1.05 134 URI_TRY_3LD 1910 1.62 1.20 1.77 135 RELAYCOUNTRY_GB 1889 1.03 1.18 0.98 136 FSL_THIS_IS_ADV 1887 0.34 1.18 0.05 137 XMSubMetaSx_01 1870 0.38 1.17 0.12 138 HTML_FONT_FACE_BAD 1838 0.63 1.15 0.45 139 RELAYCOUNTRY_DE 1834 0.52 1.15 0.30 140 T_FILL_THIS_FORM_SHORT 1823 1.04 1.14 1.00 141 XMHTMLBadTable_001 1807 0.64 1.13 0.48 142 FILL_THIS_FORM_LOAN 1779 0.53 1.11 0.33 143 XM_B_REG_HTML 1761 0.55 1.10 0.37 144 XMMoneyMeta_00 1745 0.67 1.09 0.53 145 HTML_SHORT_LINK_IMG_1 1700 0.29 1.07 0.03 146 TR_LOTS_OF_MONEY2 1672 0.61 1.05 0.47 147 T_MONEY_PERCENT 1672 0.61 1.05 0.47 148 TR_LOTS_OF_MONEY3 1649 0.52 1.03 0.34 149 URI_NOVOWEL 1638 0.59 1.03 0.45 150 RCVD_IN_IADB_OPTIN 1624 2.43 1.02 2.91 151 NORDNS_LOW_CONTRAST 1573 0.26 0.99 0.01 152 XMSlimDrugH 1537 0.52 0.96 0.37 153 DKIM_ADSP_NXDOMAIN 1530 0.66 0.96 0.55 154 TVD_IP_HEX 1526 0.24 0.96 0.00 155 TVD_IP_SING_HEX 1526 0.24 0.96 0.00 156 URI_HEX_IP 1526 0.24 0.96 0.00 157 URIBL_BLACK 1524 0.27 0.95 0.04 158 XM_PDF 1480 4.26 0.93 5.37 159 XMSexyCombo_02 1451 0.25 0.91 0.03 160 XMGppyBdWords 1451 0.33 0.91 0.13 161 BODY_ENHANCEMENT 1430 0.25 0.90 0.03 162 DKIM_ADSP_CUSTOM_MED 1422 1.04 0.89 1.09 163 T_HTML_TAG_BALANCE_CENTER 1410 0.29 0.88 0.10 164 XM_HighProb1 1384 0.23 0.87 0.01 165 XMPhish14 1384 0.47 0.87 0.33 166 TR_Mismatch_TLD_02 1372 0.27 0.86 0.07 167 SUBJ_DOLLARS 1366 0.43 0.86 0.29 168 LONG_HEX_URI 1340 0.32 0.84 0.14 169 REMOVE_BEFORE_LINK 1327 0.47 0.83 0.34 170 NML_ADSP_CUSTOM_MED 1323 0.79 0.83 0.78 171 TooManyTo_002 1303 2.01 0.82 2.41 172 BAYES_05 1293 1.62 0.81 1.89 173 RDNS_DYNAMIC 1287 0.53 0.81 0.44 174 XM_OfRef7 1278 0.33 0.80 0.18 175 T_Symld_Words_02 1261 0.76 0.79 0.75 176 LONG_JUNK_URI 1234 0.23 0.77 0.05 177 XMSubMetaSSx_00 1223 0.36 0.77 0.22 178 XMSolicitRefs_0 1210 0.43 0.76 0.33 179 BAYES_00 1203 9.08 0.75 11.85 180 FORGED_GMAIL_RCVD 1188 0.59 0.74 0.54 181 LongTLD 1185 0.32 0.74 0.17 182 XM_H_PHPMailer 1173 0.67 0.73 0.64 183 RELAYCOUNTRY_AT 1169 0.30 0.73 0.16 184 TR_MetaPhish_Combo_01 1156 1.53 0.72 1.80 185 XM_RXBody 1148 0.66 0.72 0.64 186 TR_Caps_n_Bayes_99 1148 0.31 0.72 0.18 187 DATE_IN_PAST_03_06 1139 0.27 0.71 0.13 188 RELAYCOUNTRY_IN 1132 0.28 0.71 0.14 189 XM_BadFromFormat 1120 0.26 0.70 0.11 190 XM_Combo_Sbj 1108 0.33 0.69 0.21 191 URIBL_DBL_SPAM 1092 0.18 0.68 0.01 192 RELAYCOUNTRY_AU 1085 0.60 0.68 0.58 193 TooManyTo_003 1075 1.36 0.67 1.59 194 PLING_QUERY 1072 0.64 0.67 0.63 195 T_TooManySym_02 1067 1.39 0.67 1.63 196 XM_UB80 1066 0.18 0.67 0.02 197 RELAYCOUNTRY_CN 1051 0.20 0.66 0.05 198 XM_Body_Obfu01 1036 0.37 0.65 0.27 199 DATE_IN_PAST_06_12 1008 0.19 0.63 0.04 200 TM2_M_A_HREF_HREF 981 0.73 0.61 0.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 416428 89.11 95.69 86.91 2 DKIM_SIGNED 359651 77.71 85.68 75.06 3 XM_DK_Pass 352366 76.02 83.47 73.54 4 DKIM_VALID 334793 72.24 79.33 69.87 5 DCC_CHECK_NEGATIVE 282394 48.59 17.53 58.94 6 BAYES_50 249758 47.24 32.58 52.13 7 XMListUnsubscribeExists 240322 56.72 76.40 50.16 8 DKIM_VALID_AU 232871 52.44 63.98 48.60 9 DCC_CHECK 187133 49.55 81.05 39.06 10 XM_H_QuotedFrom 179029 40.64 50.46 37.36 11 T_TM2_M_HEADER_IN_MSG 148410 27.91 18.70 30.97 12 DKIM_VALID_EF 132387 26.81 24.35 27.63 13 HTML_FONT_LOW_CONTRAST 130995 30.12 38.47 27.34 14 LOC_TINY_FONT_1 105920 25.81 36.93 22.11 15 XMSubLong 103672 22.83 26.41 21.64 16 FVGT_m_MULTI_ODD 103385 23.66 29.92 21.58 17 MultiRelay 94357 18.75 15.93 19.69 18 MIME_HTML_ONLY 93521 22.05 29.64 19.52 19 T_KAM_HTML_FONT_INVALID 83166 18.51 21.97 17.36 20 ALL_TRUSTED 74875 12.11 1.57 15.63 21 XM_DK_Undo_02 71103 23.89 51.04 14.84 22 XM_DKIMWhitelistDomains 66990 10.52 0.15 13.98 23 BAYES_99 63647 21.21 45.02 13.28 24 XM_Multi_Part_URI 61148 13.70 16.53 12.76 25 BAYES_00 56778 9.08 0.75 11.85 26 BAYES_999 56594 18.46 38.41 11.81 27 XM_Body_Dirty_Words 54128 13.70 20.90 11.30 28 LOTS_OF_MONEY 46437 9.83 10.23 9.69 29 RCVD_IN_RP_SAFE 46245 8.33 4.38 9.65 30 TR_XM_DK_Bayes 44697 7.13 0.51 9.33 31 LotsOfNums_01 43831 8.58 6.87 9.15 32 XM_Evil_Numbers_Gen 43351 10.24 13.83 9.05 33 TR_XM_DK_Bayes1 42281 6.73 0.43 8.82 34 RCVD_IN_RP_CERTIFIED 41564 7.39 3.53 8.67 35 T_XMDrugObfuBody_14 40247 8.57 9.08 8.40 36 TooManyTo_001 39629 8.61 9.64 8.27 37 HTML_IMAGE_RATIO_02 39333 10.09 15.73 8.21 38 FSL_BULK_SIG 36419 8.45 11.01 7.60 39 TR_XM_DK_Bayes2 36352 5.79 0.38 7.59 40 RCVD_IN_IADB_LISTED 32815 5.72 2.33 6.85 41 MIME_QP_LONG_LINE 32405 5.83 3.02 6.76 42 XM_SendGrid 30933 6.05 4.85 6.46 43 BAYES_60 29795 6.11 5.79 6.22 44 TR_DCC_Bayes_99 29740 13.85 36.80 6.21 45 XM_H_Long_From01 28581 6.47 7.97 5.97 46 RCVD_IN_IADB_SPF 28446 4.93 1.90 5.94 47 HTML_IMAGE_RATIO_04 27329 6.52 8.95 5.70 48 BOTNET_IPINHOSTNAME 25894 7.85 15.21 5.40 49 XM_PDF 25722 4.26 0.93 5.37 50 RCVD_IN_IADB_SENDERID 25033 4.35 1.71 5.22 51 DKIM_INVALID 24858 5.48 6.35 5.19 52 T_TooManySym_01 24582 4.54 2.77 5.13 53 RCVD_IN_IADB_DK 24436 4.24 1.67 5.10 54 XM_B_Phish_Phrases 24138 5.68 7.61 5.04 55 RCVD_IN_MSPIKE_H2 23814 4.41 2.74 4.97 56 T_REMOTE_IMAGE 23250 4.65 4.05 4.85 57 RELAYCOUNTRY_META 22676 7.42 15.50 4.73 58 XMSubMetaSx_00 22172 5.63 8.64 4.63 59 XMStrtUSub 21540 4.36 3.95 4.50 60 RCVD_IN_IADB_VOUCHED 21528 3.74 1.49 4.49 61 BAYES_40 20797 3.66 1.63 4.34 62 IN_ZIMBRA_NJ_WHITELIST 20101 3.15 0.03 4.20 63 BAYES_80 19582 4.86 7.18 4.09 64 FROM_EXCESS_BASE64 17346 4.10 5.54 3.62 65 HTML_IMAGE_RATIO_06 16805 3.87 4.96 3.51 66 UNPARSEABLE_RELAY 15752 2.85 1.54 3.29 67 XMSexyCombo_05 15462 5.08 10.62 3.23 68 MPART_ALT_DIFF 14866 4.46 8.54 3.10 69 TVD_RCVD_IP 14844 2.44 0.48 3.10 70 XM_UncommonTLD01 14823 4.61 9.14 3.09 71 BAYES_20 14573 2.65 1.49 3.04 72 RCVD_IN_IADB_OPTIN 13927 2.43 1.02 2.91 73 HTML_IMAGE_RATIO_08 13848 3.38 4.87 2.89 74 BAYES_95 13461 3.24 4.54 2.81 75 XMNumbers 12902 2.85 3.31 2.69 76 TO_MALFORMED 12551 2.02 0.21 2.62 77 XMDiploma_00 11978 2.68 3.21 2.50 78 MAILING_LIST_MULTI 11678 2.30 1.89 2.44 79 RCVD_IN_MSPIKE_WL 11630 1.95 0.53 2.43 80 RCVD_IN_MSPIKE_H3 11623 1.95 0.53 2.43 81 TooManyTo_002 11531 2.01 0.82 2.41 82 HTML_MIME_NO_HTML_TAG 11179 2.31 2.25 2.33 83 XM_SPF_SoftFail 10417 2.57 3.75 2.17 84 XM_salutation2 10267 3.71 8.41 2.14 85 MIME_HTML_MOSTLY 9632 2.92 5.66 2.01 86 XM_DK_Undo_01 9301 1.78 1.29 1.94 87 BOTNET 9128 4.95 14.07 1.91 88 BAYES_05 9065 1.62 0.81 1.89 89 XM_CamelCaseFrm001 8800 2.12 2.97 1.84 90 ANY_BOUNCE_MESSAGE 8703 1.49 0.49 1.82 91 BOUNCE_MESSAGE 8703 1.49 0.49 1.82 92 TR_MetaPhish_Combo_01 8636 1.53 0.72 1.80 93 TR_Symld_Words 8625 1.68 1.31 1.80 94 XM_DIRTYINTL 8477 2.48 4.63 1.77 95 URI_TRY_3LD 8461 1.62 1.20 1.77 96 IN_HORDE_ADDRESS_BOOK 8406 1.32 0.03 1.75 97 XMGenDplmaNmb 8368 1.92 2.43 1.75 98 SUBJ_ALL_CAPS 8267 1.72 1.69 1.73 99 MIME_HTML_ONLY_MULTI 8141 2.18 3.61 1.70 100 URI_HEX 7995 2.06 3.23 1.67 101 TM2_M_URI_OPT_OUT 7963 2.22 3.91 1.66 102 HELO_NODOT 7883 1.36 0.50 1.65 103 HELO_NO_DOMAIN 7882 1.36 0.49 1.65 104 T_TooManySym_02 7802 1.39 0.67 1.63 105 INVALID_MSGID 7693 1.23 0.10 1.61 106 TooManyTo_003 7609 1.36 0.67 1.59 107 T_XMDrugObfuBody_08 7425 1.74 2.31 1.55 108 USER_IN_DEF_DKIM_WL 7340 1.15 0.02 1.53 109 XM_H_Long_From02 7126 1.49 1.51 1.49 110 XMBdyGiftCard01 7062 1.85 2.98 1.47 111 RELAYCOUNTRY_CA 6605 2.04 4.04 1.38 112 XMCapTrack 6395 1.07 0.28 1.33 113 XMStockSpam_06 6327 1.48 1.94 1.32 114 XM_OfRef6 6246 1.64 2.63 1.30 115 XM_GoogleGroups 6229 1.09 0.47 1.30 116 XMPhish11 5972 1.45 2.07 1.25 117 XM_ProductURIs 5826 1.23 1.27 1.22 118 TooManyTo_004 5555 1.02 0.59 1.16 119 XMSubMetaSxObfu_03 5547 1.43 2.24 1.16 120 NO_DNS_FOR_FROM 5532 1.35 1.93 1.15 121 T_XMDrugObfuBody_00 5447 1.40 2.21 1.14 122 UNTRUSTED_Relay 5307 3.03 8.81 1.11 123 DKIM_ADSP_CUSTOM_MED 5204 1.04 0.89 1.09 124 XM_H_PHPOS 5036 1.09 1.22 1.05 125 T_OBFU_PDF_ATTACH 4936 0.84 0.26 1.03 126 T_FILL_THIS_FORM_SHORT 4807 1.04 1.14 1.00 127 RELAYCOUNTRY_GB 4707 1.03 1.18 0.98 128 TM2_M_VERY_LONG_WORD 4510 1.29 2.32 0.94 129 TooManyTo_005 4428 0.82 0.53 0.92 130 XMGappySubj_01 4412 0.83 0.57 0.92 131 XMSexyCombo_01 3766 1.20 2.43 0.79 132 NML_ADSP_CUSTOM_MED 3724 0.79 0.83 0.78 133 TM2_M_A_HREF_HREF 3706 0.73 0.61 0.77 134 T_Symld_Words_02 3602 0.76 0.79 0.75 135 XM_UB50 3451 1.61 4.28 0.72 136 T_XMHurry_00 3169 0.83 1.33 0.66 137 SpammyFromTLD_01 3148 0.84 1.40 0.66 138 TR_XM_RelayPhish 3133 0.96 1.89 0.65 139 XM_H_PHPMailer 3085 0.67 0.73 0.64 140 XM_RXBody 3073 0.66 0.72 0.64 141 XMBody_95 3023 0.50 0.09 0.63 142 PLING_QUERY 3021 0.64 0.67 0.63 143 XMSubMetaI_00 3012 0.87 1.60 0.63 144 HTML_FONT_SIZE_LARGE 2902 0.87 1.67 0.61 145 XMBrknScrpt_02 2894 0.78 1.29 0.60 146 USER_IN_WHITELIST 2892 0.45 0.00 0.60 147 XMNoVowels 2849 0.58 0.55 0.59 148 XMLngstWrd_00 2821 0.52 0.33 0.59 149 RELAYCOUNTRY_AU 2760 0.60 0.68 0.58 150 XMGappySubj_02 2748 0.46 0.12 0.57 151 XM_ShortIntro_01 2724 0.50 0.29 0.57 152 HTTPS_HTTP_MISMATCH 2714 0.57 0.59 0.57 153 T_TooManySym_03 2680 0.45 0.14 0.56 154 RCVD_IN_BL_SPAMCOP_NET 2667 0.94 2.08 0.56 155 DKIM_ADSP_NXDOMAIN 2659 0.66 0.96 0.55 156 XMLngstWrd_01 2649 0.49 0.31 0.55 157 FORGED_GMAIL_RCVD 2594 0.59 0.74 0.54 158 XMMoneyMeta_00 2559 0.67 1.09 0.53 159 XMSexyCombo_04 2470 0.75 1.44 0.52 160 FROM_GOV_SPOOF 2463 0.42 0.13 0.51 161 XMSubMetaSxObfu_02 2417 0.49 0.44 0.50 162 AC_DIV_BONANZA 2390 0.40 0.11 0.50 163 XM_URI_RBL 2333 1.14 3.10 0.49 164 XMHTMLBadTable_001 2306 0.64 1.13 0.48 165 XM_B_COPY_HTML 2302 0.51 0.61 0.48 166 HTML_TAG_BALANCE_BODY 2295 0.51 0.60 0.48 167 T_MONEY_PERCENT 2242 0.61 1.05 0.47 168 TR_LOTS_OF_MONEY2 2242 0.61 1.05 0.47 169 TM2_M_BODY_EMPTY 2229 0.38 0.14 0.47 170 XM_B_TRADE_HTML 2199 0.47 0.50 0.46 171 HTML_FONT_FACE_BAD 2157 0.63 1.15 0.45 172 HTML_IMAGE_ONLY_32 2155 0.45 0.45 0.45 173 URI_NOVOWEL 2154 0.59 1.03 0.45 174 SHORT_HELO_AND_INLINE_IMAGE 2127 0.34 0.02 0.44 175 FILL_THIS_FORM 2127 0.76 1.71 0.44 176 RDNS_DYNAMIC 2126 0.53 0.81 0.44 177 XMBody_78 2115 0.65 1.26 0.44 178 MISSING_HEADERS 2108 0.42 0.35 0.44 179 XMAntiAgingB 2092 0.36 0.14 0.44 180 XMPhish30 2086 0.64 1.26 0.44 181 XMDateMe_00 2050 0.39 0.28 0.43 182 XMBody_17 2032 0.68 1.44 0.42 183 HTML_IMAGE_ONLY_24 1935 0.37 0.29 0.40 184 HTML_IMAGE_ONLY_28 1921 0.45 0.59 0.40 185 FROM_GOV_DKIM_AU 1906 0.32 0.10 0.40 186 XM_B_REG_HTML 1776 0.55 1.10 0.37 187 XMSlimDrugH 1764 0.52 0.96 0.37 188 XMHTML_After_End 1763 0.69 1.66 0.37 189 XM_H_Undi_Recip 1737 0.33 0.23 0.36 190 RCVD_IN_SORBS_DUL 1735 0.32 0.20 0.36 191 FILL_THIS_FORM_LONG 1720 0.58 1.25 0.36 192 TVD_SPACE_RATIO 1671 0.34 0.32 0.35 193 NUMERIC_HTTP_ADDR 1659 0.75 1.97 0.35 194 REMOVE_BEFORE_LINK 1646 0.47 0.83 0.34 195 XM_H_PHPOS_M 1646 0.38 0.47 0.34 196 TR_LOTS_OF_MONEY3 1641 0.52 1.03 0.34 197 XM_D_tchamptons_WL 1639 0.26 0.00 0.34 198 SpammyFromTLD_02 1626 1.74 5.95 0.34 199 XMPhish14 1603 0.47 0.87 0.33 200 FILL_THIS_FORM_LOAN 1584 0.53 1.11 0.33 ----------------------------------------------------------------------