Email: 628943 Autolearn: 0 AvgScore: 2.84 AvgScanTime: 2.02 sec Spam: 167141 Autolearn: 0 AvgScore: 12.30 AvgScanTime: 2.40 sec Ham: 461802 Autolearn: 0 AvgScore: -0.58 AvgScanTime: 1.88 sec Time Spent Running SA: 352.57 hours Time Spent Processing Spam: 111.63 hours Time Spent Processing Ham: 240.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158112 87.26 94.60 84.61 2 DCC_CHECK 129460 46.64 77.46 35.49 3 DKIM_SIGNED 117405 68.94 70.24 68.47 4 XM_DK_Pass 112575 67.11 67.35 67.02 5 XMListUnsubscribeExists 112448 50.92 67.28 45.00 6 DKIM_VALID 106719 63.69 63.85 63.63 7 DKIM_VALID_AU 86680 47.50 51.86 45.92 8 XM_H_QuotedFrom 73857 35.80 44.19 32.76 9 XM_DK_Undo_02 67046 20.40 40.11 13.26 10 BAYES_50 58980 47.73 35.29 52.23 11 BAYES_99 58199 17.98 34.82 11.89 12 HTML_FONT_LOW_CONTRAST 55694 29.09 33.32 27.56 13 LOC_TINY_FONT_1 51719 22.84 30.94 19.91 14 BAYES_999 48304 15.45 28.90 10.59 15 MIME_HTML_ONLY 48241 24.31 28.86 22.66 16 TR_DCC_Bayes_99 45855 11.89 27.43 6.26 17 FVGT_m_MULTI_ODD 42942 20.84 25.69 19.08 18 XMSubLong 39710 21.74 23.76 21.00 19 RELAYCOUNTRY_META 36789 9.46 22.01 4.91 20 DCC_CHECK_NEGATIVE 34773 51.57 20.80 62.70 21 FSL_BULK_SIG 32471 9.83 19.43 6.35 22 XM_Body_Dirty_Words 31286 15.00 18.72 13.66 23 DKIM_VALID_EF 31223 23.82 18.68 25.68 24 BOTNET 30591 6.16 18.30 1.76 25 UNTRUSTED_Relay 28919 5.75 17.30 1.57 26 T_TM2_M_HEADER_IN_MSG 28618 24.25 17.12 26.82 27 T_KAM_HTML_FONT_INVALID 28580 15.35 17.10 14.71 28 BOTNET_IPINHOSTNAME 27558 7.74 16.49 4.58 29 MultiRelay 26596 17.14 15.91 17.58 30 LOTS_OF_MONEY 23019 10.98 13.77 9.97 31 XM_Multi_Part_URI 22611 12.07 13.53 11.54 32 HTML_IMAGE_RATIO_02 21148 9.05 12.65 7.74 33 BAYES_60 20168 9.10 12.07 8.02 34 XM_Evil_Numbers_Gen 20165 8.99 12.06 7.87 35 XM_UncommonTLD01 18705 5.61 11.19 3.59 36 XMSexyCombo_05 17250 5.41 10.32 3.63 37 MISSING_HEADERS 15699 3.12 9.39 0.85 38 HELO_NODOT 15697 3.91 9.39 1.92 39 HELO_NO_DOMAIN 15691 3.91 9.39 1.92 40 T_XMDrugObfuBody_14 13516 7.60 8.09 7.43 41 TooManyTo_001 13394 10.32 8.01 11.16 42 BAYES_80 10942 4.63 6.55 3.94 43 XMSubMetaSx_00 10890 4.43 6.52 3.68 44 DKIM_INVALID 10686 5.25 6.39 4.84 45 XM_B_Phish_Phrases 10573 5.84 6.33 5.66 46 LotsOfNums_01 10568 7.80 6.32 8.34 47 HTML_IMAGE_RATIO_04 10417 4.98 6.23 4.52 48 XM_UB50 10306 2.36 6.17 0.98 49 DKIM_ADSP_NXDOMAIN 10296 2.06 6.16 0.57 50 XM_H_Long_From01 9683 5.90 5.79 5.95 51 MPART_ALT_DIFF 9491 3.69 5.68 2.97 52 XM_DIRTYINTL 9400 3.39 5.62 2.58 53 XM_B_Illumintati 9039 1.66 5.41 0.31 54 XMSubNoVowel 8945 1.84 5.35 0.57 55 REPLYTO_WITHOUT_TO_CC 8847 1.61 5.29 0.27 56 SpammyFromTLD_02 8833 1.76 5.28 0.48 57 XM_UB60 7961 1.35 4.76 0.12 58 RELAYCOUNTRY_DE 7882 1.56 4.72 0.42 59 HTML_MIME_NO_HTML_TAG 7513 3.24 4.50 2.79 60 RELAYCOUNTRY_FR 7506 1.41 4.49 0.29 61 FROM_SUSPICIOUS_NTLD 7426 1.25 4.44 0.09 62 HTML_IMAGE_RATIO_06 7064 3.14 4.23 2.74 63 RELAYCOUNTRY_NG_I 7029 1.12 4.21 0.00 64 XMSubEmpty 6842 1.27 4.09 0.24 65 MIME_HTML_MOSTLY 6447 2.65 3.86 2.21 66 XMEmptySub 6385 1.35 3.82 0.46 67 FROM_EXCESS_BASE64 6383 4.81 3.82 5.17 68 BAYES_40 6267 3.83 3.75 3.86 69 BAYES_95 6145 2.64 3.68 2.26 70 NUMERIC_HTTP_ADDR 5805 1.11 3.47 0.25 71 RCVD_IN_RP_SAFE 5724 7.92 3.42 9.54 72 URI_HEX 5656 2.10 3.38 1.63 73 XMMoneyMeta_00 5553 1.28 3.32 0.54 74 XMBdyGiftCard01 5533 1.55 3.31 0.91 75 RELAYCOUNTRY_CA 5530 1.85 3.31 1.32 76 XMNumbers 5494 5.11 3.29 5.77 77 XM_SPF_SoftFail 5465 2.26 3.27 1.90 78 XMDiploma_00 5428 2.16 3.25 1.76 79 XM_URI_RBL 5344 1.18 3.20 0.45 80 NORMAL_HTTP_TO_IP 5342 0.88 3.20 0.05 81 T_TooManySym_01 5321 4.80 3.18 5.38 82 XMStrtUSub 5304 3.92 3.17 4.19 83 XM_CamelCaseFrm001 5256 2.01 3.14 1.60 84 TM2_M_URI_OPT_OUT 5237 1.85 3.13 1.39 85 XM_SendGrid 5096 5.12 3.05 5.87 86 RCVD_IN_BL_SPAMCOP_NET 4937 1.13 2.95 0.47 87 RELAYCOUNTRY_JP 4933 0.80 2.95 0.02 88 T_REMOTE_IMAGE 4894 3.60 2.93 3.85 89 TR_LOTS_OF_MONEY1 4893 0.96 2.93 0.24 90 MIME_QP_LONG_LINE 4835 5.01 2.89 5.78 91 MIME_HTML_ONLY_MULTI 4738 1.82 2.83 1.46 92 LUCRATIVE 4730 0.91 2.83 0.22 93 XMSubGiftCard1 4693 0.79 2.81 0.06 94 MIME_HEADER_CTYPE_ONLY 4680 0.84 2.80 0.13 95 PDS_TO_EQ_FROM_NAME 4629 0.78 2.77 0.06 96 BOTNET_NORDNS 4624 0.75 2.77 0.03 97 ALL_TRUSTED 4623 17.81 2.77 23.26 98 URIBL_DBL_ABUSE_REDIR 4607 0.78 2.76 0.07 99 BAD_ENC_HEADER 4573 0.74 2.74 0.02 100 XM_OfRef6 4569 1.74 2.73 1.38 101 RCVD_IN_RP_CERTIFIED 4517 7.12 2.70 8.72 102 HTML_IMAGE_RATIO_08 4277 2.00 2.56 1.79 103 RCVD_IN_RP_RNBL 4272 0.72 2.56 0.06 104 BODY_URI_ONLY 3957 0.71 2.37 0.11 105 MultiRelay_Combo 3804 0.71 2.28 0.14 106 MultiRelay_CC 3804 0.71 2.28 0.14 107 RCVD_IN_MSPIKE_H2 3773 3.67 2.26 4.19 108 XMBody_17 3752 0.93 2.24 0.45 109 XMSubMetaI_00 3628 1.02 2.17 0.60 110 XMGenDplmaNmb 3385 1.29 2.03 1.02 111 XMSexyCombo_01 3347 0.98 2.00 0.61 112 TR_XM_PHPDW 3265 1.10 1.95 0.78 113 TR_XM_PHPForged 3250 1.09 1.94 0.78 114 TR_XM_FormFill2 3209 1.07 1.92 0.77 115 BAYES_20 3187 2.66 1.91 2.93 116 XM_H_PHPOS 3187 1.07 1.91 0.77 117 DATE_IN_PAST_06_12 2918 0.49 1.75 0.04 118 DATE_IN_PAST_03_06 2878 0.53 1.72 0.09 119 T_XMDrugObfuBody_08 2822 1.40 1.69 1.30 120 XM_UB99 2817 0.46 1.69 0.01 121 NO_DNS_FOR_FROM 2772 1.20 1.66 1.03 122 SpammyFromTLD_01 2758 1.11 1.65 0.91 123 T_XMHurry_00 2677 0.82 1.60 0.54 124 TM2_M_VERY_LONG_WORD 2638 1.27 1.58 1.16 125 SUBJ_ALL_CAPS 2578 1.80 1.54 1.90 126 HK_SCAM 2510 0.62 1.50 0.29 127 XMBody_78 2484 0.66 1.49 0.37 128 HTML_IMAGE_ONLY_28 2465 0.65 1.47 0.35 129 NORDNS_LOW_CONTRAST 2437 0.43 1.46 0.06 130 XM_H_TOP 2419 0.39 1.45 0.00 131 RCVD_IN_IADB_LISTED 2361 4.25 1.41 5.28 132 T_XMDrugObfuBody_00 2351 1.07 1.41 0.95 133 TR_M_TOP_BAYES 2344 0.37 1.40 0.00 134 TR_XM_DK_SendGrid 2213 2.53 1.32 2.96 135 FSL_THIS_IS_ADV 2194 0.49 1.31 0.19 136 MAILING_LIST_MULTI 2185 1.88 1.31 2.08 137 XM_UB999 2134 0.35 1.28 0.01 138 TR_XM_RelayPhish 2127 0.94 1.27 0.83 139 RCVD_IN_IADB_SPF 2074 3.75 1.24 4.66 140 TR_Symld_Words 2055 1.50 1.23 1.59 141 XMStockSpam_06 2004 1.25 1.20 1.26 142 UNPARSEABLE_RELAY 1949 2.21 1.17 2.58 143 SUBJ_DOLLARS 1946 0.72 1.16 0.56 144 RCVD_IN_IADB_SENDERID 1940 3.34 1.16 4.13 145 XM_H_Long_From02 1939 0.92 1.16 0.83 146 XMPhish30 1937 0.64 1.16 0.45 147 RCVD_IN_IADB_DK 1909 3.30 1.14 4.08 148 T_TooManySym_02 1888 1.52 1.13 1.66 149 XM_ProductURIs 1878 0.86 1.12 0.76 150 ANY_BOUNCE_MESSAGE 1858 2.68 1.11 3.25 151 BOUNCE_MESSAGE 1853 2.68 1.11 3.25 152 RELAYCOUNTRY_IN 1815 0.37 1.09 0.11 153 URIBL_BLACK 1814 0.33 1.09 0.05 154 URI_TRY_3LD 1781 1.29 1.07 1.37 155 RELAYCOUNTRY_TR 1780 0.40 1.06 0.17 156 XMPhish11 1766 1.06 1.06 1.07 157 T_FILL_THIS_FORM_SHORT 1765 1.05 1.06 1.05 158 XMSubGiftCard2 1761 0.30 1.05 0.03 159 XM_H_PHPMailer 1736 0.61 1.04 0.45 160 XM_B_REG_HTML 1684 0.53 1.01 0.36 161 RELAYCOUNTRY_GB 1653 1.00 0.99 1.00 162 XM_UB80 1643 0.29 0.98 0.04 163 TR_Mismatch_TLD_02 1611 0.30 0.96 0.06 164 FILL_THIS_FORM 1610 0.58 0.96 0.44 165 XMSubMetaSxObfu_03 1600 0.71 0.96 0.63 166 BAYES_05 1565 1.64 0.94 1.89 167 TR_LOTS_OF_MONEY2 1484 0.49 0.89 0.35 168 T_MONEY_PERCENT 1484 0.49 0.89 0.35 169 T_Symld_Words_02 1448 0.92 0.87 0.94 170 XMHTML_After_End 1431 0.52 0.86 0.39 171 TM2_M_A_HREF_HREF 1423 0.81 0.85 0.80 172 REMOVE_BEFORE_LINK 1412 0.45 0.84 0.31 173 RDNS_DYNAMIC 1409 0.52 0.84 0.41 174 RELAYCOUNTRY_AT 1404 0.34 0.84 0.17 175 ADMITS_SPAM 1385 0.24 0.83 0.02 176 XMUrgent 1353 0.31 0.81 0.13 177 XM_H_PHPOS_M 1347 0.35 0.81 0.19 178 XM_Attn_01 1342 0.26 0.80 0.07 179 TooManyTo_002 1336 3.78 0.80 4.86 180 XMGppyBdWords 1302 0.33 0.78 0.17 181 RCVD_IN_IADB_VOUCHED 1299 2.54 0.78 3.18 182 BAYES_00 1294 9.49 0.77 12.65 183 LONG_JUNK_URI 1285 0.25 0.77 0.07 184 FILL_THIS_FORM_LONG 1284 0.45 0.77 0.34 185 DKIM_ADSP_CUSTOM_MED 1272 0.99 0.76 1.08 186 XMSexyCombo_04 1262 0.28 0.76 0.10 187 LongTLD 1218 0.30 0.73 0.14 188 HTML_TAG_BALANCE_BODY 1208 0.53 0.72 0.46 189 NML_ADSP_CUSTOM_MED 1202 0.74 0.72 0.75 190 XM_HighProb1 1201 0.20 0.72 0.02 191 XMLngstWrd_00 1157 0.81 0.69 0.85 192 XM_DK_Undo_01 1149 1.39 0.69 1.65 193 XMHTMLBadTable_001 1147 0.51 0.69 0.44 194 URI_NOVOWEL 1132 0.44 0.68 0.35 195 HK_RANDOM_FROM 1132 0.28 0.68 0.13 196 PLING_QUERY 1121 0.59 0.67 0.56 197 FROM_DOMAIN_NOVOWEL 1120 0.21 0.67 0.04 198 SHORT_URI_3 1115 0.29 0.67 0.15 199 XM_B_COPY_HTML 1098 0.52 0.66 0.46 200 URIBL_DBL_SPAM 1096 0.18 0.66 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 390713 87.26 94.60 84.61 2 DKIM_SIGNED 316201 68.94 70.24 68.47 3 XM_DK_Pass 309497 67.11 67.35 67.02 4 DKIM_VALID 293843 63.69 63.85 63.63 5 DCC_CHECK_NEGATIVE 289570 51.57 20.80 62.70 6 BAYES_50 241215 47.73 35.29 52.23 7 DKIM_VALID_AU 212053 47.50 51.86 45.92 8 XMListUnsubscribeExists 207830 50.92 67.28 45.00 9 DCC_CHECK 163896 46.64 77.46 35.49 10 XM_H_QuotedFrom 151286 35.80 44.19 32.76 11 HTML_FONT_LOW_CONTRAST 127295 29.09 33.32 27.56 12 T_TM2_M_HEADER_IN_MSG 123873 24.25 17.12 26.82 13 DKIM_VALID_EF 118575 23.82 18.68 25.68 14 ALL_TRUSTED 107395 17.81 2.77 23.26 15 MIME_HTML_ONLY 104660 24.31 28.86 22.66 16 XMSubLong 96997 21.74 23.76 21.00 17 LOC_TINY_FONT_1 91927 22.84 30.94 19.91 18 FVGT_m_MULTI_ODD 88103 20.84 25.69 19.08 19 MultiRelay 81192 17.14 15.91 17.58 20 T_KAM_HTML_FONT_INVALID 67952 15.35 17.10 14.71 21 XM_Body_Dirty_Words 63075 15.00 18.72 13.66 22 XM_DK_Undo_02 61232 20.40 40.11 13.26 23 BAYES_00 58422 9.49 0.77 12.65 24 BAYES_99 54905 17.98 34.82 11.89 25 XM_DKIMWhitelistDomains 54040 8.61 0.07 11.70 26 XM_Multi_Part_URI 53294 12.07 13.53 11.54 27 TooManyTo_001 51525 10.32 8.01 11.16 28 BAYES_999 48894 15.45 28.90 10.59 29 TR_XM_DK_Bayes 47251 7.65 0.53 10.23 30 LOTS_OF_MONEY 46034 10.98 13.77 9.97 31 TR_XM_DK_Bayes1 44845 7.25 0.45 9.71 32 RCVD_IN_RP_SAFE 44062 7.92 3.42 9.54 33 RCVD_IN_RP_CERTIFIED 40258 7.12 2.70 8.72 34 LotsOfNums_01 38496 7.80 6.32 8.34 35 BAYES_60 37052 9.10 12.07 8.02 36 TR_XM_DK_Bayes2 36988 5.97 0.34 8.01 37 XM_Evil_Numbers_Gen 36360 8.99 12.06 7.87 38 HTML_IMAGE_RATIO_02 35765 9.05 12.65 7.74 39 T_XMDrugObfuBody_14 34293 7.60 8.09 7.43 40 FSL_BULK_SIG 29335 9.83 19.43 6.35 41 TR_DCC_Bayes_99 28915 11.89 27.43 6.26 42 XM_H_Long_From01 27455 5.90 5.79 5.95 43 XM_SendGrid 27088 5.12 3.05 5.87 44 MIME_QP_LONG_LINE 26683 5.01 2.89 5.78 45 XMNumbers 26668 5.11 3.29 5.77 46 XM_B_Phish_Phrases 26147 5.84 6.33 5.66 47 T_TooManySym_01 24843 4.80 3.18 5.38 48 RCVD_IN_IADB_LISTED 24379 4.25 1.41 5.28 49 FROM_EXCESS_BASE64 23860 4.81 3.82 5.17 50 RELAYCOUNTRY_META 22689 9.46 22.01 4.91 51 TooManyTo_002 22444 3.78 0.80 4.86 52 DKIM_INVALID 22358 5.25 6.39 4.84 53 XM_PDF 21597 3.56 0.49 4.68 54 RCVD_IN_IADB_SPF 21504 3.75 1.24 4.66 55 BOTNET_IPINHOSTNAME 21138 7.74 16.49 4.58 56 HTML_IMAGE_RATIO_04 20874 4.98 6.23 4.52 57 RCVD_IN_MSPIKE_H2 19338 3.67 2.26 4.19 58 XMStrtUSub 19336 3.92 3.17 4.19 59 RCVD_IN_IADB_SENDERID 19064 3.34 1.16 4.13 60 RCVD_IN_IADB_DK 18821 3.30 1.14 4.08 61 BAYES_80 18184 4.63 6.55 3.94 62 BAYES_40 17847 3.83 3.75 3.86 63 T_REMOTE_IMAGE 17768 3.60 2.93 3.85 64 TO_MALFORMED 17502 2.88 0.37 3.79 65 IN_ZIMBRA_NJ_WHITELIST 17442 2.78 0.02 3.78 66 XMSubMetaSx_00 16995 4.43 6.52 3.68 67 XMSexyCombo_05 16757 5.41 10.32 3.63 68 XM_UncommonTLD01 16591 5.61 11.19 3.59 69 TooManyTo_003 16541 2.80 0.65 3.58 70 ANY_BOUNCE_MESSAGE 15003 2.68 1.11 3.25 71 BOUNCE_MESSAGE 14998 2.68 1.11 3.25 72 RCVD_IN_IADB_VOUCHED 14678 2.54 0.78 3.18 73 MPART_ALT_DIFF 13699 3.69 5.68 2.97 74 TR_XM_DK_SendGrid 13691 2.53 1.32 2.96 75 BAYES_20 13540 2.66 1.91 2.93 76 HTML_MIME_NO_HTML_TAG 12880 3.24 4.50 2.79 77 HTML_IMAGE_RATIO_06 12667 3.14 4.23 2.74 78 TooManyTo_004 11993 2.05 0.55 2.60 79 UNPARSEABLE_RELAY 11934 2.21 1.17 2.58 80 XM_DIRTYINTL 11906 3.39 5.62 2.58 81 BAYES_95 10430 2.64 3.68 2.26 82 MIME_HTML_MOSTLY 10200 2.65 3.86 2.21 83 TVD_RCVD_IP 9942 1.65 0.27 2.15 84 MAILING_LIST_MULTI 9623 1.88 1.31 2.08 85 XMBody_95 9303 1.54 0.24 2.01 86 RCVD_IN_IADB_OPTIN 9087 1.59 0.54 1.97 87 HELO_NODOT 8878 3.91 9.39 1.92 88 HELO_NO_DOMAIN 8872 3.91 9.39 1.92 89 RCVD_IN_MSPIKE_WL 8801 1.51 0.41 1.91 90 RCVD_IN_MSPIKE_H3 8801 1.51 0.41 1.91 91 XM_SPF_SoftFail 8773 2.26 3.27 1.90 92 SUBJ_ALL_CAPS 8764 1.80 1.54 1.90 93 BAYES_05 8742 1.64 0.94 1.89 94 TooManyTo_005 8657 1.50 0.45 1.87 95 HTML_IMAGE_RATIO_08 8279 2.00 2.56 1.79 96 XMDiploma_00 8143 2.16 3.25 1.76 97 BOTNET 8122 6.16 18.30 1.76 98 TR_MetaPhish_Combo_01 7774 1.38 0.56 1.68 99 T_TooManySym_02 7674 1.52 1.13 1.66 100 XM_DK_Undo_01 7619 1.39 0.69 1.65 101 URI_HEX 7541 2.10 3.38 1.63 102 IN_HORDE_ADDRESS_BOOK 7447 1.19 0.03 1.61 103 INVALID_MSGID 7414 1.21 0.12 1.61 104 XM_CamelCaseFrm001 7388 2.01 3.14 1.60 105 TR_Symld_Words 7353 1.50 1.23 1.59 106 UNTRUSTED_Relay 7271 5.75 17.30 1.57 107 MIME_HTML_ONLY_MULTI 6733 1.82 2.83 1.46 108 TM2_M_URI_OPT_OUT 6398 1.85 3.13 1.39 109 XM_OfRef6 6366 1.74 2.73 1.38 110 URI_TRY_3LD 6344 1.29 1.07 1.37 111 XMCapTrack 6125 1.03 0.22 1.33 112 RELAYCOUNTRY_CA 6078 1.85 3.31 1.32 113 T_XMDrugObfuBody_08 6002 1.40 1.69 1.30 114 XMStockSpam_06 5841 1.25 1.20 1.26 115 XM_GoogleGroups 5358 0.95 0.37 1.16 116 TM2_M_VERY_LONG_WORD 5351 1.27 1.58 1.16 117 USER_IN_DEF_DKIM_WL 5111 0.81 0.01 1.11 118 DKIM_ADSP_CUSTOM_MED 4970 0.99 0.76 1.08 119 XMPhish11 4922 1.06 1.06 1.07 120 T_FILL_THIS_FORM_SHORT 4828 1.05 1.06 1.05 121 NO_DNS_FOR_FROM 4764 1.20 1.66 1.03 122 XMGenDplmaNmb 4723 1.29 2.03 1.02 123 RELAYCOUNTRY_GB 4635 1.00 0.99 1.00 124 XM_UB50 4539 2.36 6.17 0.98 125 T_XMDrugObfuBody_00 4381 1.07 1.41 0.95 126 T_Symld_Words_02 4333 0.92 0.87 0.94 127 XMBdyGiftCard01 4204 1.55 3.31 0.91 128 SpammyFromTLD_01 4198 1.11 1.65 0.91 129 XMLngstWrd_00 3934 0.81 0.69 0.85 130 MISSING_HEADERS 3910 3.12 9.39 0.85 131 XM_H_Long_From02 3849 0.92 1.16 0.83 132 TR_XM_RelayPhish 3811 0.94 1.27 0.83 133 XM_ShortIntro_01 3742 0.67 0.29 0.81 134 TM2_M_A_HREF_HREF 3695 0.81 0.85 0.80 135 TR_XM_PHPDW 3622 1.10 1.95 0.78 136 TR_XM_PHPForged 3584 1.09 1.94 0.78 137 TR_XM_FormFill2 3552 1.07 1.92 0.77 138 XM_H_PHPOS 3533 1.07 1.91 0.77 139 XM_ProductURIs 3514 0.86 1.12 0.76 140 NML_ADSP_CUSTOM_MED 3462 0.74 0.72 0.75 141 XMLngstWrd_01 3423 0.71 0.64 0.74 142 USER_IN_WHITELIST 2960 0.47 0.00 0.64 143 XMSubMetaSxObfu_03 2894 0.71 0.96 0.63 144 XMSexyCombo_01 2837 0.98 2.00 0.61 145 XMSubMetaI_00 2775 1.02 2.17 0.60 146 FROM_GOV_SPOOF 2695 0.48 0.20 0.58 147 XMSubNoVowel 2647 1.84 5.35 0.57 148 T_OBFU_PDF_ATTACH 2632 0.46 0.14 0.57 149 DKIM_ADSP_NXDOMAIN 2632 2.06 6.16 0.57 150 PLING_QUERY 2599 0.59 0.67 0.56 151 XMBrknScrpt_02 2572 0.56 0.56 0.56 152 SUBJ_DOLLARS 2568 0.72 1.16 0.56 153 XMMoneyMeta_00 2488 1.28 3.32 0.54 154 T_XMHurry_00 2474 0.82 1.60 0.54 155 XMGappySubj_01 2430 0.46 0.27 0.53 156 XM_Combo_Sbj 2399 0.52 0.53 0.52 157 XMNoVowels 2369 0.45 0.26 0.51 158 HTML_FONT_FACE_BAD 2314 0.51 0.55 0.50 159 HTTPS_HTTP_MISMATCH 2304 0.50 0.51 0.50 160 SpammyFromTLD_02 2222 1.76 5.28 0.48 161 T_TooManySym_03 2207 0.41 0.23 0.48 162 T_MANY_PILL_PRICE 2195 0.36 0.05 0.48 163 RCVD_IN_BL_SPAMCOP_NET 2175 1.13 2.95 0.47 164 FORGED_GMAIL_RCVD 2165 0.51 0.63 0.47 165 XM_B_COPY_HTML 2142 0.52 0.66 0.46 166 HTML_TAG_BALANCE_BODY 2128 0.53 0.72 0.46 167 XMEmptySub 2121 1.35 3.82 0.46 168 XMBody_17 2099 0.93 2.24 0.45 169 XM_H_PHPMailer 2096 0.61 1.04 0.45 170 SHORT_HELO_AND_INLINE_IMAGE 2083 0.34 0.03 0.45 171 XMPhish30 2072 0.64 1.16 0.45 172 XM_URI_RBL 2066 1.18 3.20 0.45 173 TVD_SPACE_RATIO 2056 0.37 0.16 0.45 174 T_HTML_ATTACH 2035 0.34 0.04 0.44 175 XMHTMLBadTable_001 2030 0.51 0.69 0.44 176 FILL_THIS_FORM 2026 0.58 0.96 0.44 177 RELAYCOUNTRY_AU 1974 0.46 0.53 0.43 178 TM2_M_BODY_EMPTY 1962 0.34 0.11 0.42 179 HTML_IMAGE_ONLY_32 1953 0.48 0.64 0.42 180 RELAYCOUNTRY_DE 1930 1.56 4.72 0.42 181 XMSubMetaSxObfu_02 1907 0.36 0.20 0.41 182 RDNS_DYNAMIC 1879 0.52 0.84 0.41 183 THIS_AD 1835 0.43 0.52 0.40 184 XMHTML_After_End 1823 0.52 0.86 0.39 185 XM_D_tchamptons_WL 1781 0.28 0.00 0.39 186 XMDateMe_00 1779 0.35 0.24 0.39 187 XMLngstWrd_02 1777 0.41 0.48 0.38 188 AC_DIV_BONANZA 1758 0.31 0.12 0.38 189 FROM_GOV_DKIM_AU 1729 0.31 0.12 0.37 190 XMBody_78 1690 0.66 1.49 0.37 191 XM_B_REG_HTML 1673 0.53 1.01 0.36 192 URI_NOVOWEL 1635 0.44 0.68 0.35 193 HTML_IMAGE_ONLY_28 1612 0.65 1.47 0.35 194 T_MONEY_PERCENT 1610 0.49 0.89 0.35 195 TR_LOTS_OF_MONEY2 1610 0.49 0.89 0.35 196 RCVD_IN_SORBS_DUL 1604 0.29 0.14 0.35 197 XMRcvdHeader_15 1573 0.25 0.00 0.34 198 FILL_THIS_FORM_LONG 1551 0.45 0.77 0.34 199 DIET_1 1500 0.40 0.62 0.32 200 XMSolicitRefs_0 1485 0.31 0.29 0.32 ----------------------------------------------------------------------