Email: 549301 Autolearn: 0 AvgScore: 2.17 AvgScanTime: 1.91 sec Spam: 140161 Autolearn: 0 AvgScore: 12.35 AvgScanTime: 2.38 sec Ham: 409140 Autolearn: 0 AvgScore: -1.32 AvgScanTime: 1.75 sec Time Spent Running SA: 291.42 hours Time Spent Processing Spam: 92.79 hours Time Spent Processing Ham: 198.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131263 88.45 93.65 86.67 2 DKIM_SIGNED 116786 77.93 83.32 76.09 3 XM_DK_Pass 114415 76.39 81.63 74.60 4 DCC_CHECK 112478 49.50 80.25 38.96 5 DKIM_VALID 108859 72.59 77.67 70.85 6 XMListUnsubscribeExists 105248 56.01 75.09 49.48 7 DKIM_VALID_AU 89455 53.85 63.82 50.43 8 XM_DK_Undo_02 71662 25.10 51.13 16.18 9 XM_H_QuotedFrom 70932 40.71 50.61 37.32 10 BAYES_99 64053 22.78 45.70 14.93 11 HTML_FONT_LOW_CONTRAST 55534 30.74 39.62 27.70 12 BAYES_999 54695 19.88 39.02 13.33 13 TR_DCC_Bayes_99 52815 15.02 37.68 7.26 14 LOC_TINY_FONT_1 48786 25.57 34.81 22.40 15 BAYES_50 44527 46.05 31.77 50.95 16 MIME_HTML_ONLY 44337 23.71 31.63 20.99 17 FVGT_m_MULTI_ODD 41856 22.54 29.86 20.03 18 XMSubLong 36202 23.03 25.83 22.07 19 XM_Body_Dirty_Words 30923 15.05 22.06 12.65 20 DKIM_VALID_EF 29548 26.99 21.08 29.02 21 T_KAM_HTML_FONT_INVALID 28312 16.95 20.20 15.84 22 T_TM2_M_HEADER_IN_MSG 26060 27.62 18.59 30.71 23 RELAYCOUNTRY_META 25877 8.58 18.46 5.19 24 DCC_CHECK_NEGATIVE 25635 48.60 18.29 58.98 25 XM_Multi_Part_URI 24936 14.76 17.79 13.72 26 BOTNET 22178 5.45 15.82 1.90 27 MultiRelay 21708 18.47 15.49 19.49 28 HTML_IMAGE_RATIO_02 21494 10.06 15.34 8.26 29 BOTNET_IPINHOSTNAME 21289 8.01 15.19 5.55 30 XM_Evil_Numbers_Gen 17066 9.53 12.18 8.62 31 UNTRUSTED_Relay 16780 3.98 11.97 1.24 32 XMSexyCombo_05 15879 5.90 11.33 4.04 33 FSL_BULK_SIG 15453 8.34 11.03 7.42 34 LOTS_OF_MONEY 15301 10.16 10.92 9.90 35 T_XMDrugObfuBody_14 14712 8.70 10.50 8.08 36 MPART_ALT_DIFF 12806 4.89 9.14 3.44 37 HTML_IMAGE_RATIO_04 11560 6.36 8.25 5.72 38 XM_B_Phish_Phrases 10971 5.84 7.83 5.16 39 XMSubMetaSx_00 10970 5.08 7.83 4.14 40 XM_salutation2 10917 3.64 7.79 2.21 41 BAYES_80 10700 5.02 7.63 4.12 42 XM_UncommonTLD01 10577 4.52 7.55 3.48 43 XM_H_Long_From01 10506 6.55 7.50 6.22 44 TooManyTo_001 10332 7.98 7.37 8.19 45 FROM_EXCESS_BASE64 10017 4.84 7.15 4.05 46 BAYES_60 8426 6.27 6.01 6.36 47 XM_UB50 8328 2.09 5.94 0.78 48 LotsOfNums_01 8291 8.33 5.92 9.16 49 HTML_IMAGE_RATIO_06 8215 3.88 5.86 3.21 50 DKIM_INVALID 7927 5.34 5.66 5.23 51 XM_DIRTYINTL 7615 3.06 5.43 2.25 52 MIME_HTML_MOSTLY 7561 3.12 5.39 2.34 53 XMStrtUSub 7473 4.74 5.33 4.54 54 XM_SendGrid 7163 6.11 5.11 6.45 55 RCVD_IN_RP_SAFE 6584 9.37 4.70 10.97 56 XM_SPF_SoftFail 6122 2.63 4.37 2.04 57 SpammyFromTLD_02 5765 1.42 4.11 0.50 58 MIME_HTML_ONLY_MULTI 5590 2.17 3.99 1.55 59 BAYES_95 5566 3.11 3.97 2.82 60 TM2_M_URI_OPT_OUT 5548 2.54 3.96 2.05 61 XM_CamelCaseFrm001 5454 2.32 3.89 1.78 62 RELAYCOUNTRY_CA 5387 2.11 3.84 1.52 63 RCVD_IN_RP_CERTIFIED 5382 8.33 3.84 9.86 64 T_XMDrugObfuBody_08 5104 2.23 3.64 1.74 65 HTML_MIME_NO_HTML_TAG 5062 2.73 3.61 2.43 66 XMNumbers 4988 3.10 3.56 2.94 67 URI_HEX 4938 2.21 3.52 1.77 68 RCVD_IN_RP_RNBL 4701 0.87 3.35 0.02 69 XM_H_Long_From02 4643 1.54 3.31 0.93 70 XM_OfRef6 4535 1.97 3.24 1.53 71 MIME_QP_LONG_LINE 4329 5.40 3.09 6.19 72 RELAYCOUNTRY_FR 4264 0.92 3.04 0.19 73 SUBJ_ALL_CAPS 4211 2.46 3.00 2.28 74 T_TooManySym_01 4104 5.06 2.93 5.78 75 HTML_IMAGE_RATIO_08 4087 2.40 2.92 2.23 76 XMDiploma_00 4066 2.07 2.90 1.78 77 T_REMOTE_IMAGE 4043 3.99 2.88 4.37 78 RCVD_IN_MSPIKE_H2 3966 4.22 2.83 4.70 79 XM_URI_RBL 3917 1.12 2.79 0.54 80 XMBody_17 3884 1.11 2.77 0.53 81 BOTNET_NORDNS 3759 0.70 2.68 0.03 82 XM_UB60 3327 0.65 2.37 0.06 83 XMBdyGiftCard01 3246 1.43 2.32 1.12 84 RCVD_IN_BL_SPAMCOP_NET 3122 0.84 2.23 0.37 85 XMGenDplmaNmb 3058 1.36 2.18 1.08 86 TM2_M_VERY_LONG_WORD 3013 1.18 2.15 0.84 87 NO_DNS_FOR_FROM 2836 1.44 2.02 1.24 88 DKIM_ADSP_NXDOMAIN 2801 0.82 2.00 0.42 89 T_FILL_THIS_FORM_SHORT 2793 1.22 1.99 0.95 90 XMStockSpam_06 2785 1.39 1.99 1.18 91 XMSexyCombo_01 2724 0.91 1.94 0.56 92 XMSubMetaI_00 2710 1.06 1.93 0.77 93 TR_XM_RelayPhish 2533 0.93 1.81 0.63 94 MultiRelay_CC 2487 0.57 1.77 0.15 95 MultiRelay_Combo 2487 0.57 1.77 0.15 96 RCVD_IN_IADB_LISTED 2470 5.07 1.76 6.20 97 NORDNS_LOW_CONTRAST 2313 0.43 1.65 0.01 98 BAYES_40 2286 3.29 1.63 3.86 99 UNPARSEABLE_RELAY 2276 3.09 1.62 3.59 100 BAYES_20 2266 2.67 1.62 3.03 101 INVALID_MSGID 2176 1.71 1.55 1.77 102 MAILING_LIST_MULTI 2138 2.37 1.53 2.66 103 XM_UB99 2122 0.40 1.51 0.02 104 XMPhish11 2075 1.22 1.48 1.14 105 XMGetyour 2070 0.39 1.48 0.02 106 RCVD_IN_IADB_SPF 2020 4.41 1.44 5.43 107 XM_ProductURIs 2010 0.99 1.43 0.84 108 ALL_TRUSTED 2003 11.46 1.43 14.90 109 RELAYCOUNTRY_ES 1966 0.37 1.40 0.02 110 FROM_SUSPICIOUS_NTLD 1938 0.39 1.38 0.05 111 XMSubMetaSxObfu_03 1936 0.82 1.38 0.63 112 XMPhish30 1848 0.67 1.32 0.44 113 DIET_1 1831 0.61 1.31 0.37 114 RCVD_IN_IADB_SENDERID 1822 3.94 1.30 4.84 115 FILL_THIS_FORM 1819 0.67 1.30 0.45 116 RELAYCOUNTRY_DE 1813 0.63 1.29 0.40 117 URI_TRY_3LD 1791 1.42 1.28 1.47 118 RCVD_IN_IADB_DK 1779 3.85 1.27 4.73 119 RCVD_IN_PSBL 1763 0.34 1.26 0.02 120 NUMERIC_HTTP_ADDR 1753 0.58 1.25 0.35 121 T_XMHurry_00 1724 0.69 1.23 0.50 122 SpammyFromTLD_01 1682 0.87 1.20 0.76 123 XM_UB999 1656 0.31 1.18 0.02 124 FSL_THIS_IS_ADV 1638 0.44 1.17 0.19 125 XM_UB80 1612 0.31 1.15 0.02 126 TR_Symld_Words 1593 1.65 1.14 1.83 127 PLING_QUERY 1591 0.59 1.14 0.41 128 XM_H_PHPOS 1566 1.06 1.12 1.04 129 T_XMDrugObfuBody_00 1556 0.83 1.11 0.74 130 RCVD_IN_IADB_VOUCHED 1550 3.12 1.11 3.80 131 XMPhish14 1519 0.49 1.08 0.29 132 LONG_JUNK_URI 1517 0.33 1.08 0.07 133 XM_B_REG_HTML 1459 0.60 1.04 0.45 134 MPART_ALT_DIFF_COUNT 1452 0.47 1.04 0.27 135 BODY_ENHANCEMENT 1447 0.29 1.03 0.04 136 URIBL_BLACK 1434 0.30 1.02 0.06 137 FILL_THIS_FORM_LONG 1432 0.52 1.02 0.34 138 XMLngstWrd_00 1403 0.65 1.00 0.53 139 MISSING_HEADERS 1402 0.70 1.00 0.60 140 XMLngstWrd_01 1392 0.62 0.99 0.50 141 RELAYCOUNTRY_GB 1386 0.96 0.99 0.95 142 XMBody_78 1382 0.61 0.99 0.48 143 XMHTML_After_End 1382 0.55 0.99 0.40 144 SUBJ_DOLLARS 1361 0.52 0.97 0.37 145 XMUrgent 1354 0.27 0.97 0.04 146 RELAYCOUNTRY_AT 1352 0.37 0.96 0.17 147 TR_MetaPhish_Combo_01 1345 1.54 0.96 1.74 148 XMLngstWrd_02 1342 0.46 0.96 0.29 149 XM_HighProb1 1336 0.29 0.95 0.06 150 XMMoneyMeta_00 1336 0.60 0.95 0.48 151 FILL_THIS_FORM_LOAN 1253 0.47 0.89 0.32 152 RELAYCOUNTRY_IN 1248 0.31 0.89 0.11 153 XM_DK_Undo_01 1197 1.57 0.85 1.81 154 T_Symld_Words_02 1194 0.63 0.85 0.55 155 RELAYCOUNTRY_CN 1192 0.26 0.85 0.06 156 BAYES_05 1183 1.64 0.84 1.92 157 XMSexyCombo_04 1167 0.26 0.83 0.06 158 XM_H_PHPMailer 1160 0.72 0.83 0.68 159 TR_LOTS_OF_MONEY2 1159 0.44 0.83 0.31 160 T_MONEY_PERCENT 1159 0.44 0.83 0.31 161 TM2_M_A_HREF_HREF 1125 0.84 0.80 0.85 162 XMHTMLBadTable_001 1123 0.52 0.80 0.43 163 NORMAL_HTTP_TO_IP 1094 0.24 0.78 0.06 164 TR_Mismatch_TLD_02 1089 0.25 0.78 0.07 165 SHORT_URI_3 1084 0.28 0.77 0.11 166 XMSubMetaSSx_00 1073 0.33 0.77 0.18 167 DKIM_ADSP_CUSTOM_MED 1064 1.02 0.76 1.11 168 XMSubEmpty 1058 0.39 0.75 0.27 169 XM_B_COPY_HTML 1048 0.65 0.75 0.62 170 RCVD_IN_IADB_OPTIN 1044 1.99 0.74 2.42 171 T_TooManySym_02 1015 1.67 0.72 1.99 172 HTML_FONT_FACE_BAD 1008 0.75 0.72 0.77 173 NML_ADSP_CUSTOM_MED 993 0.80 0.71 0.83 174 XM_Body_Obfu01 980 0.46 0.70 0.38 175 XM_RXBody 980 0.30 0.70 0.17 176 TR_Caps_n_Bayes_99 975 0.32 0.70 0.20 177 TR_XM_FormFill 974 0.23 0.69 0.07 178 MISSING_SUBJECT 959 0.22 0.68 0.07 179 XMNoSubject 959 0.22 0.68 0.07 180 DATE_IN_PAST_03_06 953 0.24 0.68 0.09 181 BAYES_00 940 8.94 0.67 11.77 182 TVD_SPACE_RATIO_MINFP 939 0.19 0.67 0.02 183 XMSubMetaI_01 910 0.21 0.65 0.06 184 URIBL_DBL_SPAM 899 0.17 0.64 0.01 185 XM_PDF 891 3.62 0.64 4.64 186 RELAYCOUNTRY_AU 886 0.53 0.63 0.50 187 LongTLD 879 0.30 0.63 0.19 188 HTML_IMAGE_ONLY_28 864 0.45 0.62 0.40 189 THIS_AD 854 0.51 0.61 0.48 190 HTML_OFF_PAGE 850 0.16 0.61 0.00 191 MISSING_FROM 845 0.15 0.60 0.00 192 TooManyTo_002 838 1.72 0.60 2.11 193 FORGED_GMAIL_RCVD 826 0.47 0.59 0.43 194 RELAYCOUNTRY_IE 824 0.26 0.59 0.15 195 HTTPS_HTTP_MISMATCH 816 0.61 0.58 0.63 196 LOW_PRICE 815 0.31 0.58 0.22 197 XMSubMetaD_03 808 0.22 0.58 0.09 198 XM_OfRef7 807 0.28 0.58 0.18 199 TR_Caps_n_Bayes_80 804 0.22 0.57 0.10 200 XMBrknScrpt_02 800 0.65 0.57 0.68 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354616 88.45 93.65 86.67 2 DKIM_SIGNED 311309 77.93 83.32 76.09 3 XM_DK_Pass 305217 76.39 81.63 74.60 4 DKIM_VALID 289894 72.59 77.67 70.85 5 DCC_CHECK_NEGATIVE 241318 48.60 18.29 58.98 6 BAYES_50 208449 46.05 31.77 50.95 7 DKIM_VALID_AU 206326 53.85 63.82 50.43 8 XMListUnsubscribeExists 202424 56.01 75.09 49.48 9 DCC_CHECK 159408 49.50 80.25 38.96 10 XM_H_QuotedFrom 152696 40.71 50.61 37.32 11 T_TM2_M_HEADER_IN_MSG 125630 27.62 18.59 30.71 12 DKIM_VALID_EF 118715 26.99 21.08 29.02 13 HTML_FONT_LOW_CONTRAST 113338 30.74 39.62 27.70 14 LOC_TINY_FONT_1 91652 25.57 34.81 22.40 15 XMSubLong 90312 23.03 25.83 22.07 16 MIME_HTML_ONLY 85892 23.71 31.63 20.99 17 FVGT_m_MULTI_ODD 81960 22.54 29.86 20.03 18 MultiRelay 79749 18.47 15.49 19.49 19 XM_DK_Undo_02 66193 25.10 51.13 16.18 20 T_KAM_HTML_FONT_INVALID 64792 16.95 20.20 15.84 21 BAYES_99 61098 22.78 45.70 14.93 22 ALL_TRUSTED 60949 11.46 1.43 14.90 23 XM_DKIMWhitelistDomains 58655 10.69 0.03 14.34 24 XM_Multi_Part_URI 56150 14.76 17.79 13.72 25 BAYES_999 54526 19.88 39.02 13.33 26 XM_Body_Dirty_Words 51760 15.05 22.06 12.65 27 BAYES_00 48157 8.94 0.67 11.77 28 RCVD_IN_RP_SAFE 44873 9.37 4.70 10.97 29 LOTS_OF_MONEY 40519 10.16 10.92 9.90 30 RCVD_IN_RP_CERTIFIED 40350 8.33 3.84 9.86 31 TR_XM_DK_Bayes 37971 7.01 0.40 9.28 32 LotsOfNums_01 37463 8.33 5.92 9.16 33 TR_XM_DK_Bayes1 35951 6.63 0.32 8.79 34 XM_Evil_Numbers_Gen 35274 9.53 12.18 8.62 35 HTML_IMAGE_RATIO_02 33785 10.06 15.34 8.26 36 TooManyTo_001 33503 7.98 7.37 8.19 37 T_XMDrugObfuBody_14 33052 8.70 10.50 8.08 38 FSL_BULK_SIG 30339 8.34 11.03 7.42 39 TR_XM_DK_Bayes2 30047 5.54 0.28 7.34 40 TR_DCC_Bayes_99 29688 15.02 37.68 7.26 41 XM_SendGrid 26373 6.11 5.11 6.45 42 BAYES_60 26025 6.27 6.01 6.36 43 XM_H_Long_From01 25461 6.55 7.50 6.22 44 RCVD_IN_IADB_LISTED 25361 5.07 1.76 6.20 45 MIME_QP_LONG_LINE 25309 5.40 3.09 6.19 46 T_TooManySym_01 23664 5.06 2.93 5.78 47 HTML_IMAGE_RATIO_04 23383 6.36 8.25 5.72 48 BOTNET_IPINHOSTNAME 22695 8.01 15.19 5.55 49 RCVD_IN_IADB_SPF 22216 4.41 1.44 5.43 50 DKIM_INVALID 21415 5.34 5.66 5.23 51 RELAYCOUNTRY_META 21237 8.58 18.46 5.19 52 XM_B_Phish_Phrases 21130 5.84 7.83 5.16 53 RCVD_IN_IADB_SENDERID 19803 3.94 1.30 4.84 54 RCVD_IN_IADB_DK 19370 3.85 1.27 4.73 55 RCVD_IN_MSPIKE_H2 19238 4.22 2.83 4.70 56 XM_PDF 19000 3.62 0.64 4.64 57 XMStrtUSub 18563 4.74 5.33 4.54 58 T_REMOTE_IMAGE 17875 3.99 2.88 4.37 59 IN_ZIMBRA_NJ_WHITELIST 17370 3.17 0.02 4.25 60 XMSubMetaSx_00 16937 5.08 7.83 4.14 61 BAYES_80 16866 5.02 7.63 4.12 62 FROM_EXCESS_BASE64 16557 4.84 7.15 4.05 63 XMSexyCombo_05 16512 5.90 11.33 4.04 64 BAYES_40 15806 3.29 1.63 3.86 65 RCVD_IN_IADB_VOUCHED 15564 3.12 1.11 3.80 66 UNPARSEABLE_RELAY 14684 3.09 1.62 3.59 67 XM_UncommonTLD01 14232 4.52 7.55 3.48 68 MPART_ALT_DIFF 14073 4.89 9.14 3.44 69 TVD_RCVD_IP 13947 2.66 0.46 3.41 70 HTML_IMAGE_RATIO_06 13114 3.88 5.86 3.21 71 TO_MALFORMED 12694 2.31 0.00 3.10 72 BAYES_20 12396 2.67 1.62 3.03 73 XMNumbers 12043 3.10 3.56 2.94 74 BAYES_95 11526 3.11 3.97 2.82 75 MAILING_LIST_MULTI 10888 2.37 1.53 2.66 76 RCVD_IN_MSPIKE_H3 10457 2.03 0.51 2.56 77 RCVD_IN_MSPIKE_WL 10457 2.03 0.51 2.56 78 HTML_MIME_NO_HTML_TAG 9947 2.73 3.61 2.43 79 RCVD_IN_IADB_OPTIN 9889 1.99 0.74 2.42 80 MIME_HTML_MOSTLY 9575 3.12 5.39 2.34 81 SUBJ_ALL_CAPS 9324 2.46 3.00 2.28 82 XM_DIRTYINTL 9207 3.06 5.43 2.25 83 HTML_IMAGE_RATIO_08 9105 2.40 2.92 2.23 84 XM_salutation2 9062 3.64 7.79 2.21 85 TooManyTo_002 8616 1.72 0.60 2.11 86 ANY_BOUNCE_MESSAGE 8440 1.65 0.44 2.06 87 BOUNCE_MESSAGE 8439 1.65 0.44 2.06 88 TM2_M_URI_OPT_OUT 8400 2.54 3.96 2.05 89 XM_SPF_SoftFail 8338 2.63 4.37 2.04 90 T_TooManySym_02 8158 1.67 0.72 1.99 91 BAYES_05 7839 1.64 0.84 1.92 92 BOTNET 7781 5.45 15.82 1.90 93 IN_HORDE_ADDRESS_BOOK 7674 1.41 0.04 1.88 94 TR_Symld_Words 7484 1.65 1.14 1.83 95 XM_DK_Undo_01 7417 1.57 0.85 1.81 96 XMDiploma_00 7295 2.07 2.90 1.78 97 XM_CamelCaseFrm001 7266 2.32 3.89 1.78 98 INVALID_MSGID 7232 1.71 1.55 1.77 99 URI_HEX 7228 2.21 3.52 1.77 100 T_XMDrugObfuBody_08 7137 2.23 3.64 1.74 101 TR_MetaPhish_Combo_01 7124 1.54 0.96 1.74 102 HELO_NODOT 6515 1.29 0.40 1.59 103 HELO_NO_DOMAIN 6514 1.28 0.39 1.59 104 MIME_HTML_ONLY_MULTI 6323 2.17 3.99 1.55 105 XM_OfRef6 6268 1.97 3.24 1.53 106 RELAYCOUNTRY_CA 6201 2.11 3.84 1.52 107 URI_TRY_3LD 6018 1.42 1.28 1.47 108 TooManyTo_003 5881 1.18 0.45 1.44 109 USER_IN_DEF_DKIM_WL 5237 0.96 0.01 1.28 110 XMCapTrack 5099 0.99 0.24 1.25 111 NO_DNS_FOR_FROM 5077 1.44 2.02 1.24 112 UNTRUSTED_Relay 5077 3.98 11.97 1.24 113 XM_GoogleGroups 5057 1.04 0.46 1.24 114 XMStockSpam_06 4826 1.39 1.99 1.18 115 XMPhish11 4644 1.22 1.48 1.14 116 XMBdyGiftCard01 4589 1.43 2.32 1.12 117 DKIM_ADSP_CUSTOM_MED 4527 1.02 0.76 1.11 118 XMGenDplmaNmb 4405 1.36 2.18 1.08 119 TooManyTo_004 4311 0.88 0.37 1.05 120 XM_H_PHPOS 4246 1.06 1.12 1.04 121 T_FILL_THIS_FORM_SHORT 3906 1.22 1.99 0.95 122 RELAYCOUNTRY_GB 3883 0.96 0.99 0.95 123 XM_H_Long_From02 3790 1.54 3.31 0.93 124 TooManyTo_005 3561 0.73 0.32 0.87 125 TM2_M_A_HREF_HREF 3489 0.84 0.80 0.85 126 TM2_M_VERY_LONG_WORD 3443 1.18 2.15 0.84 127 XM_ProductURIs 3438 0.99 1.43 0.84 128 NML_ADSP_CUSTOM_MED 3410 0.80 0.71 0.83 129 XMNoVowels 3235 0.67 0.30 0.79 130 XM_UB50 3173 2.09 5.94 0.78 131 XMSubMetaI_00 3135 1.06 1.93 0.77 132 HTML_FONT_FACE_BAD 3132 0.75 0.72 0.77 133 SpammyFromTLD_01 3122 0.87 1.20 0.76 134 T_XMDrugObfuBody_00 3011 0.83 1.11 0.74 135 USER_IN_WHITELIST 2893 0.53 0.00 0.71 136 T_OBFU_PDF_ATTACH 2819 0.56 0.18 0.69 137 XM_H_PHPMailer 2773 0.72 0.83 0.68 138 XMBrknScrpt_02 2764 0.65 0.57 0.68 139 XMGappySubj_01 2686 0.58 0.37 0.66 140 FROM_GOV_SPOOF 2673 0.55 0.25 0.65 141 XMBody_95 2629 0.51 0.13 0.64 142 XMSubMetaSxObfu_03 2595 0.82 1.38 0.63 143 TR_XM_RelayPhish 2562 0.93 1.81 0.63 144 HTTPS_HTTP_MISMATCH 2560 0.61 0.58 0.63 145 XM_B_COPY_HTML 2520 0.65 0.75 0.62 146 MISSING_HEADERS 2443 0.70 1.00 0.60 147 XM_ShortIntro_01 2393 0.51 0.31 0.58 148 T_TooManySym_03 2363 0.47 0.15 0.58 149 XMSexyCombo_01 2275 0.91 1.94 0.56 150 T_MANY_PILL_PRICE 2263 0.41 0.01 0.55 151 T_Symld_Words_02 2240 0.63 0.85 0.55 152 XM_URI_RBL 2213 1.12 2.79 0.54 153 XMDateMe_00 2205 0.49 0.36 0.54 154 XMBody_17 2187 1.11 2.77 0.53 155 XMSubMetaSxObfu_02 2158 0.49 0.39 0.53 156 XMLngstWrd_00 2157 0.65 1.00 0.53 157 XM_D_tchamptons_WL 2061 0.38 0.00 0.50 158 T_XMHurry_00 2044 0.69 1.23 0.50 159 RELAYCOUNTRY_AU 2040 0.53 0.63 0.50 160 SpammyFromTLD_02 2032 1.42 4.11 0.50 161 XMLngstWrd_01 2026 0.62 0.99 0.50 162 THIS_AD 1962 0.51 0.61 0.48 163 XMBody_78 1946 0.61 0.99 0.48 164 XMMoneyMeta_00 1945 0.60 0.95 0.48 165 FILL_THIS_FORM 1857 0.67 1.30 0.45 166 XM_B_REG_HTML 1848 0.60 1.04 0.45 167 XMPhish30 1808 0.67 1.32 0.44 168 SHORT_HELO_AND_INLINE_IMAGE 1806 0.34 0.03 0.44 169 FORGED_GMAIL_RCVD 1773 0.47 0.59 0.43 170 URI_NOVOWEL 1765 0.46 0.55 0.43 171 XMHTMLBadTable_001 1759 0.52 0.80 0.43 172 RELAYCOUNTRY_NL 1747 0.44 0.46 0.43 173 HTML_IMAGE_ONLY_32 1740 0.39 0.31 0.43 174 RDNS_DYNAMIC 1736 0.45 0.51 0.42 175 DKIM_ADSP_NXDOMAIN 1711 0.82 2.00 0.42 176 TM2_M_BODY_EMPTY 1682 0.34 0.15 0.41 177 PLING_QUERY 1672 0.59 1.14 0.41 178 HTML_TAG_BALANCE_BODY 1650 0.43 0.51 0.40 179 XMRcvdHeader_15 1631 0.30 0.00 0.40 180 RELAYCOUNTRY_DE 1624 0.63 1.29 0.40 181 HTML_IMAGE_ONLY_28 1623 0.45 0.62 0.40 182 XMHTML_After_End 1622 0.55 0.99 0.40 183 BASE64_LENGTH_79_INF 1620 0.34 0.17 0.40 184 RCVD_IN_SORBS_DUL 1577 0.33 0.17 0.39 185 XMLKML 1575 0.29 0.00 0.38 186 FROM_GOV_DKIM_AU 1565 0.32 0.13 0.38 187 XM_Body_Obfu01 1558 0.46 0.70 0.38 188 XM_H_PHPOS_M 1551 0.41 0.49 0.38 189 DIET_1 1521 0.61 1.31 0.37 190 SUBJ_DOLLARS 1520 0.52 0.97 0.37 191 RCVD_IN_BL_SPAMCOP_NET 1518 0.84 2.23 0.37 192 XMSlimDrugH 1494 0.40 0.49 0.37 193 HTML_IMAGE_ONLY_24 1483 0.35 0.32 0.36 194 NUMERIC_HTTP_ADDR 1443 0.58 1.25 0.35 195 FILL_THIS_FORM_LONG 1401 0.52 1.02 0.34 196 XMSubNoVowel 1318 0.31 0.28 0.32 197 FILL_THIS_FORM_LOAN 1304 0.47 0.89 0.32 198 T_HTML_ATTACH 1296 0.26 0.09 0.32 199 AC_DIV_BONANZA 1289 0.26 0.10 0.32 200 T_MONEY_PERCENT 1276 0.44 0.83 0.31 ----------------------------------------------------------------------