Email: 597662 Autolearn: 0 AvgScore: 2.65 AvgScanTime: 2.00 sec Spam: 143471 Autolearn: 0 AvgScore: 11.92 AvgScanTime: 2.55 sec Ham: 454191 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.82 sec Time Spent Running SA: 331.30 hours Time Spent Processing Spam: 101.60 hours Time Spent Processing Ham: 229.70 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135219 88.31 94.25 86.44 2 DKIM_SIGNED 121985 76.89 85.02 74.33 3 XM_DK_Pass 119113 75.35 83.02 72.93 4 DKIM_VALID 115352 72.47 80.40 69.96 5 DCC_CHECK 113988 49.03 79.45 39.42 6 XM_B_Unicode 112719 69.97 78.57 67.26 7 XMListUnsubscribeExists 109921 55.32 76.62 48.60 8 DKIM_VALID_AU 89137 54.04 62.13 51.49 9 XM_DK_Undo_02 73679 21.69 51.35 12.32 10 BAYES_99 65762 19.14 45.84 10.71 11 HTML_FONT_LOW_CONTRAST 57363 30.34 39.98 27.30 12 BAYES_999 55176 16.41 38.46 9.45 13 TR_DCC_Bayes_99 53258 12.40 37.12 4.59 14 LOC_TINY_FONT_1 49307 24.98 34.37 22.02 15 BAYES_50 46504 48.88 32.41 54.08 16 RCVD_IN_MSPIKE_H2 44211 31.01 30.82 31.07 17 MIME_HTML_ONLY 42942 21.32 29.93 18.60 18 FVGT_m_MULTI_ODD 40583 23.18 28.29 21.56 19 XMSubLong 36208 22.62 25.24 21.79 20 DKIM_VALID_EF 34031 27.28 23.72 28.40 21 T_KAM_HTML_FONT_INVALID 31393 17.96 21.88 16.72 22 XM_Body_Dirty_Words 31357 14.27 21.86 11.87 23 T_TM2_M_HEADER_IN_MSG 31036 29.37 21.63 31.82 24 DCC_CHECK_NEGATIVE 26778 48.91 18.66 58.46 25 XM_Multi_Part_URI 26620 12.48 18.55 10.56 26 RELAYCOUNTRY_META 24421 7.97 17.02 5.12 27 MultiRelay 22702 19.26 15.82 20.35 28 BOTNET 20659 4.98 14.40 2.00 29 HTML_IMAGE_RATIO_02 19456 8.74 13.56 7.22 30 BOTNET_IPINHOSTNAME 19176 6.53 13.37 4.37 31 XM_Evil_Numbers_Gen 18904 9.78 13.18 8.70 32 LOTS_OF_MONEY 17840 9.39 12.43 8.43 33 XMSexyCombo_05 15934 5.16 11.11 3.28 34 UNTRUSTED_Relay 15864 3.68 11.06 1.35 35 FSL_BULK_SIG 14446 8.63 10.07 8.18 36 LotsOfNums_01 13343 8.03 9.30 7.62 37 T_XMDrugObfuBody_14 12287 8.27 8.56 8.18 38 TooManyTo_001 11701 8.88 8.16 9.10 39 XMSubMetaSx_00 10960 4.39 7.64 3.36 40 XM_UncommonTLD01 10633 5.00 7.41 4.23 41 XM_B_Phish_Phrases 10565 5.71 7.36 5.18 42 BAYES_80 10560 4.73 7.36 3.90 43 HTML_IMAGE_RATIO_04 10333 6.01 7.20 5.63 44 XM_H_Long_From01 10172 6.31 7.09 6.06 45 MPART_ALT_DIFF 10155 3.71 7.08 2.64 46 BAYES_60 8222 6.24 5.73 6.40 47 MIME_QP_LONG_LINE 7925 5.45 5.52 5.43 48 XM_DIRTYINTL 7389 3.34 5.15 2.76 49 XM_UB50 7164 1.90 4.99 0.92 50 FROM_EXCESS_BASE64 6882 3.85 4.80 3.55 51 DKIM_INVALID 6633 4.43 4.62 4.37 52 HTML_IMAGE_RATIO_06 6583 3.43 4.59 3.07 53 XM_B_SpammyTLD 6475 3.47 4.51 3.15 54 XMStrtUSub 6141 4.28 4.28 4.27 55 BAYES_95 6043 3.00 4.21 2.62 56 XM_SPF_SoftFail 5929 2.65 4.13 2.19 57 SpammyFromTLD_02 5891 1.14 4.11 0.21 58 RCVD_IN_RP_SAFE 5738 8.04 4.00 9.31 59 T_REMOTE_IMAGE 5634 4.02 3.93 4.05 60 URI_HEX 5463 2.16 3.81 1.64 61 RELAYCOUNTRY_CA 5430 2.04 3.78 1.49 62 XMNumbers 5248 2.97 3.66 2.75 63 TM2_M_URI_OPT_OUT 5171 2.22 3.60 1.78 64 MIME_HTML_ONLY_MULTI 5076 1.84 3.54 1.30 65 XM_SendGrid 5004 5.89 3.49 6.65 66 MIME_HTML_MOSTLY 4808 2.50 3.35 2.24 67 RCVD_IN_RP_CERTIFIED 4624 6.99 3.22 8.17 68 XMDiploma_00 4529 2.24 3.16 1.94 69 XM_CamelCaseFrm001 4525 2.26 3.15 1.98 70 XM_URI_RBL 4490 0.98 3.13 0.30 71 RELAYCOUNTRY_FR 4453 0.92 3.10 0.22 72 XMBdyGiftCard01 4280 1.34 2.98 0.81 73 RCVD_IN_IADB_LISTED 4235 4.39 2.95 4.84 74 T_TooManySym_01 4065 4.96 2.83 5.63 75 URI_TRY_3LD 3992 2.22 2.78 2.05 76 NO_DNS_FOR_FROM 3788 1.46 2.64 1.09 77 MultiRelay_CC 3775 0.79 2.63 0.21 78 MultiRelay_Combo 3775 0.79 2.63 0.21 79 RCVD_IN_IADB_SPF 3723 3.82 2.59 4.21 80 HTML_IMAGE_RATIO_08 3682 2.32 2.57 2.24 81 TR_XM_PHPDW 3599 1.33 2.51 0.96 82 T_XMDrugObfuBody_08 3595 1.74 2.51 1.50 83 RCVD_IN_IADB_SENDERID 3516 3.37 2.45 3.66 84 XMSexyCombo_01 3503 0.92 2.44 0.44 85 TR_XM_PHPForged 3494 1.30 2.44 0.94 86 XM_OfRef6 3490 1.99 2.43 1.85 87 HTML_MIME_NO_HTML_TAG 3441 2.60 2.40 2.67 88 RCVD_IN_IADB_DK 3438 3.32 2.40 3.62 89 TR_XM_FormFill2 3426 1.27 2.39 0.92 90 XM_UB99 3426 0.58 2.39 0.01 91 RCVD_IN_RP_RNBL 3418 0.60 2.38 0.03 92 XM_H_PHPOS 3407 1.27 2.37 0.92 93 XMBody_17 3370 1.16 2.35 0.79 94 RCVD_IN_BL_SPAMCOP_NET 3285 0.89 2.29 0.45 95 KHOP_HELO_FCRDNS 3135 2.24 2.19 2.26 96 ALL_TRUSTED 3014 13.24 2.10 16.76 97 XMGenDplmaNmb 2895 1.33 2.02 1.12 98 XM_UB999 2802 0.47 1.95 0.01 99 DKIM_ADSP_NXDOMAIN 2769 0.93 1.93 0.62 100 SpammyFromTLD_01 2735 1.06 1.91 0.79 101 T_XMHurry_00 2727 1.06 1.90 0.79 102 XMSubMetaI_00 2700 1.04 1.88 0.77 103 DIET_1 2671 0.71 1.86 0.35 104 BOTNET_NORDNS 2671 0.47 1.86 0.04 105 US_DOLLARS_3 2611 0.99 1.82 0.73 106 SUBJ_ALL_CAPS 2555 1.72 1.78 1.70 107 TR_XM_DK_SendGrid 2504 3.08 1.75 3.50 108 TR_Symld_Words 2491 1.70 1.74 1.69 109 XM_ProductURIs 2484 1.23 1.73 1.08 110 TooManyTo_002 2479 2.37 1.73 2.58 111 MAILING_LIST_MULTI 2475 2.08 1.73 2.19 112 T_XMDrugObfuBody_00 2453 0.92 1.71 0.67 113 RCVD_IN_PSBL 2403 0.43 1.67 0.03 114 TM2_M_VERY_LONG_WORD 2317 1.18 1.61 1.04 115 BAYES_40 2297 3.81 1.60 4.50 116 XMStockSpam_06 2257 1.49 1.57 1.47 117 TooManyTo_003 2164 1.70 1.51 1.76 118 TR_XM_RelayPhish 2109 0.87 1.47 0.68 119 XM_B_REG_HTML 2082 0.53 1.45 0.24 120 XMHTML_After_End 2075 0.71 1.45 0.48 121 TR_LOTS_OF_MONEY3 2070 0.92 1.44 0.75 122 XM_UB60 1973 0.39 1.38 0.08 123 TooManyTo_004 1972 1.37 1.37 1.37 124 BAYES_20 1948 2.90 1.36 3.39 125 XMPhish30 1943 0.61 1.35 0.38 126 XM_H_PHPMailer 1882 0.87 1.31 0.73 127 XM_H_Long_From02 1860 1.27 1.30 1.26 128 RCVD_IN_IADB_VOUCHED 1859 2.78 1.30 3.25 129 HTML_FONT_FACE_BAD 1805 0.77 1.26 0.62 130 NORDNS_LOW_CONTRAST 1769 0.30 1.23 0.01 131 TooManyTo_005 1756 1.17 1.22 1.15 132 XM_H_PHPOS_M 1744 0.46 1.22 0.22 133 RELAYCOUNTRY_AT 1727 0.38 1.20 0.12 134 XMPhish11 1726 1.24 1.20 1.25 135 XMBrknScrpt_02 1701 0.73 1.19 0.58 136 XMHTMLBadTable_001 1693 0.74 1.18 0.60 137 XMSlimDrugH 1645 0.61 1.15 0.44 138 PLING_QUERY 1617 0.69 1.13 0.55 139 XMBody_78 1607 0.65 1.12 0.50 140 URIBL_BLACK 1568 0.31 1.09 0.06 141 XM_DK_Undo_01 1536 1.66 1.07 1.85 142 HTML_TAG_BALANCE_BODY 1536 1.07 1.07 1.07 143 XMSexyCombo_04 1521 0.29 1.06 0.05 144 T_FILL_THIS_FORM_SHORT 1482 1.08 1.03 1.09 145 DKIM_ADSP_CUSTOM_MED 1465 1.06 1.02 1.07 146 T_MONEY_PERCENT 1434 0.54 1.00 0.40 147 TR_LOTS_OF_MONEY2 1434 0.54 1.00 0.40 148 DATE_IN_PAST_03_06 1431 0.35 1.00 0.14 149 XM_UB80 1425 0.26 0.99 0.03 150 XM_B_COPY_HTML 1418 0.61 0.99 0.49 151 T_Symld_Words_02 1390 0.58 0.97 0.45 152 TR_Mismatch_TLD_02 1368 0.28 0.95 0.06 153 UNPARSEABLE_RELAY 1346 2.20 0.94 2.59 154 RDNS_DYNAMIC 1345 0.54 0.94 0.41 155 XMPhish14 1336 0.54 0.93 0.41 156 XMSubMetaSSx_00 1329 0.36 0.93 0.19 157 T_TooManySym_02 1326 1.63 0.92 1.85 158 DATE_IN_PAST_06_12 1318 0.26 0.92 0.05 159 XM_HighProb1 1290 0.22 0.90 0.01 160 NML_ADSP_CUSTOM_MED 1261 0.81 0.88 0.79 161 HTTPS_HTTP_MISMATCH 1254 0.82 0.87 0.80 162 XMSubMetaSxObfu_03 1219 0.56 0.85 0.47 163 RELAYCOUNTRY_DE 1219 0.61 0.85 0.53 164 RELAYCOUNTRY_GB 1214 1.10 0.85 1.18 165 XM_PDF 1198 4.79 0.84 6.03 166 RCVD_IN_IADB_OPTIN 1192 1.75 0.83 2.04 167 FORGED_GMAIL_RCVD 1183 0.58 0.82 0.51 168 FROM_SUSPICIOUS_NTLD 1171 0.22 0.82 0.04 169 FROM_SUSPICIOUS_NTLD_FP 1128 0.21 0.79 0.03 170 URI_NOVOWEL 1095 0.52 0.76 0.44 171 LongTLD 1080 0.30 0.75 0.16 172 HDRS_LCASE_IMGONLY 1080 0.21 0.75 0.04 173 RELAYCOUNTRY_JP 1077 0.21 0.75 0.04 174 BODY_QUOTE_MALF_MSGID 1071 0.69 0.75 0.67 175 HELO_NODOT 1028 1.72 0.72 2.03 176 URIBL_ABUSE_SURBL 1028 0.31 0.72 0.18 177 HELO_NO_DOMAIN 1028 1.72 0.72 2.03 178 HTML_IMAGE_ONLY_32 1017 0.52 0.71 0.46 179 XM_OfRef7 996 0.34 0.69 0.23 180 XMUrgent 995 0.26 0.69 0.13 181 BAYES_05 993 1.76 0.69 2.10 182 XMClaimOffer 979 0.26 0.68 0.12 183 XM_RXBody 967 0.64 0.67 0.63 184 XM_Combo_Sbj 965 0.29 0.67 0.17 185 RELAYCOUNTRY_IN 961 0.24 0.67 0.10 186 XM_BadFromFormat 933 0.26 0.65 0.13 187 XMSubNoVowel 932 0.43 0.65 0.36 188 BODY_URI_ONLY 931 0.23 0.65 0.09 189 MISSING_HEADERS 921 0.57 0.64 0.54 190 BAYES_00 916 9.30 0.64 12.04 191 TR_MetaPhish_Combo_01 904 1.32 0.63 1.53 192 XM_Body_Obfu01 892 0.50 0.62 0.47 193 XMGppyBdWords 888 0.26 0.62 0.15 194 XMGappySubj_01 882 0.53 0.61 0.51 195 HTML_FONT_SIZE_LARGE 882 0.27 0.61 0.16 196 MIME_HEADER_CTYPE_ONLY 860 0.26 0.60 0.16 197 TM2_M_A_HREF_HREF 858 0.39 0.60 0.33 198 HK_RANDOM_REPLYTO 858 0.33 0.60 0.25 199 XMMoneyMeta_00 849 0.59 0.59 0.59 200 DATE_IN_FUTURE_12_24 848 0.15 0.59 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 392603 88.31 94.25 86.44 2 DKIM_SIGNED 337578 76.89 85.02 74.33 3 XM_DK_Pass 331226 75.35 83.02 72.93 4 DKIM_VALID 317751 72.47 80.40 69.96 5 XM_B_Unicode 305468 69.97 78.57 67.26 6 DCC_CHECK_NEGATIVE 265532 48.91 18.66 58.46 7 BAYES_50 245621 48.88 32.41 54.08 8 DKIM_VALID_AU 233855 54.04 62.13 51.49 9 XMListUnsubscribeExists 220721 55.32 76.62 48.60 10 DCC_CHECK 179045 49.03 79.45 39.42 11 T_TM2_M_HEADER_IN_MSG 144521 29.37 21.63 31.82 12 RCVD_IN_MSPIKE_H2 141109 31.01 30.82 31.07 13 DKIM_VALID_EF 129006 27.28 23.72 28.40 14 HTML_FONT_LOW_CONTRAST 123981 30.34 39.98 27.30 15 LOC_TINY_FONT_1 100003 24.98 34.37 22.02 16 XMSubLong 98978 22.62 25.24 21.79 17 FVGT_m_MULTI_ODD 97944 23.18 28.29 21.56 18 MultiRelay 92426 19.26 15.82 20.35 19 MIME_HTML_ONLY 84476 21.32 29.93 18.60 20 ALL_TRUSTED 76121 13.24 2.10 16.76 21 T_KAM_HTML_FONT_INVALID 75948 17.96 21.88 16.72 22 XM_DK_Undo_02 55944 21.69 51.35 12.32 23 BAYES_00 54664 9.30 0.64 12.04 24 XM_Body_Dirty_Words 53918 14.27 21.86 11.87 25 BAYES_99 48651 19.14 45.84 10.71 26 XM_Multi_Part_URI 47968 12.48 18.55 10.56 27 BAYES_999 42904 16.41 38.46 9.45 28 TR_XM_DK_Bayes 42425 7.16 0.27 9.34 29 RCVD_IN_RP_SAFE 42305 8.04 4.00 9.31 30 TooManyTo_001 41353 8.88 8.16 9.10 31 TR_XM_DK_Bayes1 40856 6.89 0.24 9.00 32 XM_Evil_Numbers_Gen 39528 9.78 13.18 8.70 33 LOTS_OF_MONEY 38306 9.39 12.43 8.43 34 XM_DKIMWhitelistDomains 37894 6.35 0.02 8.34 35 FSL_BULK_SIG 37158 8.63 10.07 8.18 36 T_XMDrugObfuBody_14 37134 8.27 8.56 8.18 37 RCVD_IN_RP_CERTIFIED 37125 6.99 3.22 8.17 38 TR_XM_DK_Bayes2 35219 5.94 0.19 7.75 39 LotsOfNums_01 34632 8.03 9.30 7.62 40 HTML_IMAGE_RATIO_02 32784 8.74 13.56 7.22 41 XM_SendGrid 30213 5.89 3.49 6.65 42 BAYES_60 29053 6.24 5.73 6.40 43 XM_H_Long_From01 27542 6.31 7.09 6.06 44 XM_PDF 27407 4.79 0.84 6.03 45 HTML_IMAGE_RATIO_04 25579 6.01 7.20 5.63 46 T_TooManySym_01 25561 4.96 2.83 5.63 47 MIME_QP_LONG_LINE 24659 5.45 5.52 5.43 48 TO_MALFORMED 24189 4.07 0.09 5.33 49 XM_B_Phish_Phrases 23545 5.71 7.36 5.18 50 RELAYCOUNTRY_META 23241 7.97 17.02 5.12 51 RCVD_IN_IADB_LISTED 22005 4.39 2.95 4.84 52 TR_DCC_Bayes_99 20865 12.40 37.12 4.59 53 BAYES_40 20452 3.81 1.60 4.50 54 BOTNET_IPINHOSTNAME 19843 6.53 13.37 4.37 55 DKIM_INVALID 19827 4.43 4.62 4.37 56 XMStrtUSub 19414 4.28 4.28 4.27 57 XM_UncommonTLD01 19224 5.00 7.41 4.23 58 RCVD_IN_IADB_SPF 19119 3.82 2.59 4.21 59 IN_ZIMBRA_NJ_WHITELIST 18439 3.09 0.02 4.06 60 T_REMOTE_IMAGE 18389 4.02 3.93 4.05 61 BAYES_80 17735 4.73 7.36 3.90 62 RCVD_IN_IADB_SENDERID 16629 3.37 2.45 3.66 63 RCVD_IN_IADB_DK 16428 3.32 2.40 3.62 64 FROM_EXCESS_BASE64 16142 3.85 4.80 3.55 65 TR_XM_DK_SendGrid 15917 3.08 1.75 3.50 66 BAYES_20 15385 2.90 1.36 3.39 67 XMSubMetaSx_00 15250 4.39 7.64 3.36 68 XMSexyCombo_05 14888 5.16 11.11 3.28 69 RCVD_IN_IADB_VOUCHED 14764 2.78 1.30 3.25 70 XM_B_SpammyTLD 14292 3.47 4.51 3.15 71 HTML_IMAGE_RATIO_06 13925 3.43 4.59 3.07 72 XM_DIRTYINTL 12546 3.34 5.15 2.76 73 XMNumbers 12505 2.97 3.66 2.75 74 HTML_MIME_NO_HTML_TAG 12128 2.60 2.40 2.67 75 MPART_ALT_DIFF 11990 3.71 7.08 2.64 76 BAYES_95 11915 3.00 4.21 2.62 77 UNPARSEABLE_RELAY 11782 2.20 0.94 2.59 78 TooManyTo_002 11703 2.37 1.73 2.58 79 INVALID_MSGID 10697 1.81 0.10 2.36 80 KHOP_HELO_FCRDNS 10280 2.24 2.19 2.26 81 HTML_IMAGE_RATIO_08 10183 2.32 2.57 2.24 82 TVD_RCVD_IP 10175 1.84 0.58 2.24 83 MIME_HTML_MOSTLY 10158 2.50 3.35 2.24 84 MAILING_LIST_MULTI 9956 2.08 1.73 2.19 85 XM_SPF_SoftFail 9926 2.65 4.13 2.19 86 BAYES_05 9526 1.76 0.69 2.10 87 URI_TRY_3LD 9305 2.22 2.78 2.05 88 RCVD_IN_IADB_OPTIN 9252 1.75 0.83 2.04 89 HELO_NODOT 9240 1.72 0.72 2.03 90 HELO_NO_DOMAIN 9238 1.72 0.72 2.03 91 BOTNET 9082 4.98 14.40 2.00 92 XM_CamelCaseFrm001 8972 2.26 3.15 1.98 93 XMDiploma_00 8834 2.24 3.16 1.94 94 T_TooManySym_02 8422 1.63 0.92 1.85 95 XM_OfRef6 8412 1.99 2.43 1.85 96 XM_DK_Undo_01 8402 1.66 1.07 1.85 97 ANY_BOUNCE_MESSAGE 8228 1.49 0.47 1.81 98 BOUNCE_MESSAGE 8219 1.49 0.47 1.81 99 TM2_M_URI_OPT_OUT 8089 2.22 3.60 1.78 100 TooManyTo_003 8013 1.70 1.51 1.76 101 IN_HORDE_ADDRESS_BOOK 7965 1.34 0.04 1.75 102 SUBJ_ALL_CAPS 7731 1.72 1.78 1.70 103 TR_Symld_Words 7658 1.70 1.74 1.69 104 URI_HEX 7444 2.16 3.81 1.64 105 XMCapTrack 7294 1.32 0.41 1.61 106 TR_MetaPhish_Combo_01 6961 1.32 0.63 1.53 107 T_XMDrugObfuBody_08 6802 1.74 2.51 1.50 108 RELAYCOUNTRY_CA 6752 2.04 3.78 1.49 109 XMStockSpam_06 6678 1.49 1.57 1.47 110 USER_IN_DEF_DKIM_WL 6596 1.11 0.03 1.45 111 TooManyTo_004 6204 1.37 1.37 1.37 112 UNTRUSTED_Relay 6142 3.68 11.06 1.35 113 MIME_HTML_ONLY_MULTI 5903 1.84 3.54 1.30 114 XM_H_Long_From02 5703 1.27 1.30 1.26 115 XMPhish11 5689 1.24 1.20 1.25 116 RELAYCOUNTRY_GB 5380 1.10 0.85 1.18 117 XM_GoogleGroups 5327 1.02 0.55 1.17 118 TooManyTo_005 5230 1.17 1.22 1.15 119 XMGenDplmaNmb 5080 1.33 2.02 1.12 120 T_FILL_THIS_FORM_SHORT 4945 1.08 1.03 1.09 121 NO_DNS_FOR_FROM 4930 1.46 2.64 1.09 122 XM_ProductURIs 4896 1.23 1.73 1.08 123 DKIM_ADSP_CUSTOM_MED 4846 1.06 1.02 1.07 124 HTML_TAG_BALANCE_BODY 4838 1.07 1.07 1.07 125 TM2_M_VERY_LONG_WORD 4711 1.18 1.61 1.04 126 TR_XM_PHPDW 4363 1.33 2.51 0.96 127 TR_XM_PHPForged 4250 1.30 2.44 0.94 128 TR_XM_FormFill2 4186 1.27 2.39 0.92 129 XM_UB50 4178 1.90 4.99 0.92 130 XM_H_PHPOS 4176 1.27 2.37 0.92 131 XMBdyGiftCard01 3699 1.34 2.98 0.81 132 HTTPS_HTTP_MISMATCH 3618 0.82 0.87 0.80 133 NML_ADSP_CUSTOM_MED 3605 0.81 0.88 0.79 134 XMBody_17 3589 1.16 2.35 0.79 135 T_XMHurry_00 3582 1.06 1.90 0.79 136 T_OBFU_PDF_ATTACH 3576 0.65 0.20 0.79 137 SpammyFromTLD_01 3574 1.06 1.91 0.79 138 XMSubMetaI_00 3500 1.04 1.88 0.77 139 TR_LOTS_OF_MONEY3 3404 0.92 1.44 0.75 140 XM_H_PHPMailer 3317 0.87 1.31 0.73 141 US_DOLLARS_3 3310 0.99 1.82 0.73 142 FILL_THIS_FORM 3235 0.68 0.58 0.71 143 TR_XM_RelayPhish 3109 0.87 1.47 0.68 144 T_TooManySym_03 3105 0.61 0.36 0.68 145 BODY_QUOTE_MALF_MSGID 3042 0.69 0.75 0.67 146 T_XMDrugObfuBody_00 3036 0.92 1.71 0.67 147 XM_RXBody 2862 0.64 0.67 0.63 148 XM_ShortIntro_01 2823 0.57 0.42 0.62 149 HTML_FONT_FACE_BAD 2815 0.77 1.26 0.62 150 DKIM_ADSP_NXDOMAIN 2814 0.93 1.93 0.62 151 T_FILL_THIS_FORM_LONG 2786 0.57 0.41 0.61 152 XMLngstWrd_00 2739 0.58 0.52 0.60 153 XMHTMLBadTable_001 2706 0.74 1.18 0.60 154 SHORT_HELO_AND_INLINE_IMAGE 2696 0.46 0.06 0.59 155 T_FILL_THIS_FORM_LOAN 2693 0.51 0.23 0.59 156 XMMoneyMeta_00 2680 0.59 0.59 0.59 157 XMBrknScrpt_02 2652 0.73 1.19 0.58 158 XMLngstWrd_01 2596 0.55 0.48 0.57 159 PLING_QUERY 2510 0.69 1.13 0.55 160 MISSING_HEADERS 2475 0.57 0.64 0.54 161 XMBody_95 2447 0.46 0.21 0.54 162 TM2_M_BODY_EMPTY 2439 0.45 0.16 0.54 163 USER_IN_WHITELIST 2431 0.41 0.00 0.54 164 RELAYCOUNTRY_DE 2397 0.61 0.85 0.53 165 AC_DIV_BONANZA 2364 0.44 0.17 0.52 166 FORGED_GMAIL_RCVD 2305 0.58 0.82 0.51 167 XMGappySubj_01 2303 0.53 0.61 0.51 168 XMBody_78 2293 0.65 1.12 0.50 169 T_MANY_PILL_PRICE 2259 0.38 0.01 0.50 170 XM_B_COPY_HTML 2214 0.61 0.99 0.49 171 XMNoVowels 2196 0.48 0.47 0.48 172 XMHTML_After_End 2191 0.71 1.45 0.48 173 RCVD_IN_SORBS_DUL 2163 0.43 0.27 0.48 174 XMSubMetaSxObfu_03 2155 0.56 0.85 0.47 175 XM_Body_Obfu01 2117 0.50 0.62 0.47 176 HTML_IMAGE_ONLY_32 2076 0.52 0.71 0.46 177 T_Symld_Words_02 2051 0.58 0.97 0.45 178 XMDateMe_00 2044 0.41 0.26 0.45 179 RCVD_IN_BL_SPAMCOP_NET 2040 0.89 2.29 0.45 180 RELAYCOUNTRY_AU 2036 0.48 0.58 0.45 181 HTML_IMAGE_ONLY_28 2010 0.45 0.46 0.44 182 XMSexyCombo_01 2003 0.92 2.44 0.44 183 URI_NOVOWEL 2000 0.52 0.76 0.44 184 XMSlimDrugH 1993 0.61 1.15 0.44 185 FROM_GOV_DKIM_AU 1964 0.39 0.26 0.43 186 FROM_GOV_SPOOF 1888 0.39 0.31 0.42 187 XMPhish14 1876 0.54 0.93 0.41 188 RDNS_DYNAMIC 1864 0.54 0.94 0.41 189 XMSubMetaSxObfu_02 1852 0.42 0.45 0.41 190 TR_LOTS_OF_MONEY2 1798 0.54 1.00 0.40 191 T_MONEY_PERCENT 1798 0.54 1.00 0.40 192 HTML_IMAGE_ONLY_24 1788 0.40 0.42 0.39 193 XMPhish30 1714 0.61 1.35 0.38 194 NUMERIC_HTTP_ADDR 1651 0.38 0.45 0.36 195 XMSubNoVowel 1633 0.43 0.65 0.36 196 DIET_1 1595 0.71 1.86 0.35 197 HTML_IMAGE_ONLY_20 1592 0.32 0.24 0.35 198 XMRcvdHeader_15 1589 0.27 0.00 0.35 199 REMOVE_BEFORE_LINK 1543 0.38 0.51 0.34 200 TM2_M_A_HREF_HREF 1499 0.39 0.60 0.33 ----------------------------------------------------------------------