Email: 624868 Autolearn: 9369 AvgScore: 3.31 AvgScanTime: 3.02 sec Spam: 182193 Autolearn: 710 AvgScore: 12.18 AvgScanTime: 3.51 sec Ham: 442675 Autolearn: 8659 AvgScore: -0.35 AvgScanTime: 2.82 sec Time Spent Running SA: 524.77 hours Time Spent Processing Spam: 177.54 hours Time Spent Processing Ham: 347.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174452 84.71 95.75 80.17 2 DKIM_SIGNED 158428 71.23 86.96 64.76 3 XM_DK_Pass 152162 69.11 83.52 63.17 4 DKIM_VALID 147851 66.34 81.15 60.24 5 DCC_CHECK 143082 45.65 78.53 32.12 6 XMListUnsubscribeExists 137493 52.35 75.47 42.84 7 DKIM_VALID_AU 113085 48.06 62.07 42.29 8 XM_H_QuotedFrom 95356 37.83 52.34 31.86 9 XM_DK_Undo_02 93344 22.70 51.23 10.95 10 BAYES_99 82730 20.40 45.41 10.11 11 BAYES_999 70905 17.66 38.92 8.92 12 TR_DCC_Bayes_99 65421 13.91 35.91 4.85 13 LOC_TINY_FONT_1 64642 22.58 35.48 17.27 14 HTML_FONT_LOW_CONTRAST 63484 25.34 34.84 21.43 15 BAYES_50 53553 48.01 29.39 55.67 16 MIME_HTML_ONLY 51503 21.31 28.27 18.44 17 FVGT_m_MULTI_ODD 49412 20.55 27.12 17.84 18 XMSubLong 48836 20.86 26.80 18.41 19 T_KAM_HTML_FONT_INVALID 36660 15.08 20.12 13.00 20 XM_Body_Dirty_Words 36659 13.16 20.12 10.29 21 DCC_CHECK_NEGATIVE 35622 52.20 19.55 65.63 22 T_TM2_M_HEADER_IN_MSG 34486 27.24 18.93 30.66 23 DKIM_VALID_EF 34453 19.64 18.91 19.95 24 HTML_IMAGE_RATIO_02 32455 9.55 17.81 6.14 25 RELAYCOUNTRY_META 31862 8.90 17.49 5.36 26 MultiRelay 31081 18.72 17.06 19.40 27 XM_Multi_Part_URI 28531 11.32 15.66 9.54 28 BOTNET_IPINHOSTNAME 26639 6.87 14.62 3.68 29 XM_Evil_Numbers_Gen 26542 9.67 14.57 7.65 30 BOTNET 25235 4.81 13.85 1.09 31 LOTS_OF_MONEY 22271 8.69 12.22 7.23 32 T_XMDrugObfuBody_14 19684 8.97 10.80 8.22 33 UNTRUSTED_Relay 18533 3.81 10.17 1.19 34 XMSexyCombo_05 17339 4.94 9.52 3.06 35 LotsOfNums_01 16821 8.24 9.23 7.83 36 FSL_BULK_SIG 16691 7.17 9.16 6.35 37 HTML_IMAGE_RATIO_04 16526 5.95 9.07 4.66 38 XM_UncommonTLD01 16250 4.95 8.92 3.32 39 XM_B_Phish_Phrases 16150 5.83 8.86 4.58 40 RCVD_IN_MSPIKE_H2 14387 8.32 7.90 8.49 41 XM_H_Long_From01 14351 6.32 7.88 5.68 42 FROM_EXCESS_BASE64 13577 4.43 7.45 3.19 43 TooManyTo_001 13346 7.86 7.33 8.08 44 TR_XM_DocInvoice 13005 4.91 7.14 4.00 45 BAYES_80 12237 4.46 6.72 3.52 46 MPART_ALT_DIFF 11741 3.67 6.44 2.53 47 XMSubMetaSx_00 11297 4.55 6.20 3.87 48 RCVD_IN_RP_SAFE 11170 7.73 6.13 8.39 49 DKIM_INVALID 10577 4.89 5.81 4.52 50 BAYES_00 9806 12.26 5.38 15.10 51 BAYES_60 9676 5.53 5.31 5.63 52 MIME_QP_LONG_LINE 9295 5.12 5.10 5.13 53 MIME_HTML_MOSTLY 9261 3.08 5.08 2.26 54 XMStrtUSub 9064 4.27 4.97 3.97 55 RCVD_IN_RP_CERTIFIED 8842 6.50 4.85 7.17 56 RCVD_IN_BL_SPAMCOP_NET 8468 1.84 4.65 0.68 57 T_REMOTE_IMAGE 8237 4.46 4.52 4.43 58 BAYES_95 7998 2.91 4.39 2.29 59 TR_XM_DK_Bayes 7986 9.15 4.38 11.11 60 HTML_IMAGE_RATIO_06 7892 2.98 4.33 2.43 61 XM_SPF_SoftFail 7824 2.62 4.29 1.94 62 XMNumbers 7753 3.76 4.26 3.55 63 XM_DIRTYINTL 7655 2.44 4.20 1.71 64 TM2_M_URI_OPT_OUT 7397 2.36 4.06 1.66 65 XM_UB50 7343 1.69 4.03 0.72 66 XM_SendGrid 7266 4.49 3.99 4.69 67 URI_HEX 6377 1.75 3.50 1.02 68 RELAYCOUNTRY_CA 6328 2.00 3.47 1.40 69 XM_CamelCaseFrm001 6201 2.42 3.40 2.01 70 TR_XM_DK_Bayes1 6049 7.70 3.32 9.50 71 HTML_IMAGE_RATIO_08 5985 2.34 3.28 1.95 72 MultiRelay_CC 5604 1.07 3.08 0.24 73 MultiRelay_Combo 5604 1.07 3.08 0.24 74 T_TooManySym_01 5589 3.88 3.07 4.22 75 MIME_HTML_ONLY_MULTI 5425 1.81 2.98 1.33 76 TR_XM_DK_Bayes2 5073 5.92 2.78 7.21 77 XM_UB99 4973 0.80 2.73 0.01 78 XMDiploma_00 4907 1.66 2.69 1.24 79 T_MIXED_ES 4798 1.71 2.63 1.33 80 RCVD_IN_IADB_LISTED 4787 4.74 2.63 5.61 81 XM_URI_RBL 4726 0.84 2.59 0.12 82 T_XMHurry_00 4667 1.34 2.56 0.84 83 XMSubMetaI_00 4435 1.10 2.43 0.56 84 XM_OfRef6 4371 1.50 2.40 1.13 85 RCVD_IN_IADB_SPF 4282 4.19 2.35 4.95 86 RCVD_IN_DNSWL_NONE 4215 3.36 2.31 3.79 87 RCVD_IN_RP_RNBL 4105 0.67 2.25 0.02 88 RCVD_IN_IADB_SENDERID 4087 3.79 2.24 4.42 89 XM_UB999 4084 0.66 2.24 0.01 90 RCVD_IN_IADB_DK 4057 3.68 2.23 4.28 91 MAILING_LIST_MULTI 3956 2.56 2.17 2.72 92 TM2_M_VERY_LONG_WORD 3905 1.18 2.14 0.78 93 XMSexyCombo_01 3798 1.22 2.08 0.86 94 T_XMDrugObfuBody_08 3505 1.36 1.92 1.13 95 XMBdyGiftCard01 3500 1.26 1.92 0.99 96 BOTNET_NORDNS 3499 0.60 1.92 0.05 97 SUBJ_ALL_CAPS 3469 1.70 1.90 1.61 98 HTML_MIME_NO_HTML_TAG 3462 2.69 1.90 3.01 99 RELAYCOUNTRY_GB 3346 1.42 1.84 1.25 100 RELAYCOUNTRY_FR 3320 0.67 1.82 0.20 101 SpammyFromTLD_01 3285 1.13 1.80 0.85 102 T_XMDrugObfuBody_00 3232 0.95 1.77 0.61 103 XM_DK_Undo_01 3022 1.68 1.66 1.69 104 XMPhish30 2785 0.72 1.53 0.39 105 URIBL_BLACK 2760 0.47 1.51 0.04 106 XMPhish14 2687 0.66 1.47 0.33 107 XM_H_Long_From02 2686 1.00 1.47 0.80 108 RELAYCOUNTRY_CN 2683 0.48 1.47 0.07 109 XMBody_78 2673 0.84 1.47 0.58 110 XM_XX_Yahoo 2664 0.51 1.46 0.12 111 TR_XM_RelayPhish 2653 0.79 1.46 0.52 112 XMStockSpam_06 2633 1.12 1.45 0.99 113 XM_HighProb1 2632 0.43 1.44 0.02 114 SpammyFromTLD_02 2586 0.64 1.42 0.32 115 BAYES_40 2559 2.90 1.40 3.52 116 SUBJ_DOLLARS 2557 0.51 1.40 0.14 117 XMGenDplmaNmb 2552 0.96 1.40 0.77 118 XMBody_17 2489 0.65 1.37 0.36 119 TR_LOTS_OF_MONEY2 2353 0.65 1.29 0.39 120 T_MONEY_PERCENT 2353 0.65 1.29 0.39 121 RELAYCOUNTRY_RU 2342 0.42 1.29 0.06 122 XM_H_PHPOS 2315 2.36 1.27 2.80 123 BAYES_20 2298 2.22 1.26 2.61 124 URI_TRY_3LD 2273 1.07 1.25 1.00 125 NO_DNS_FOR_FROM 2262 1.16 1.24 1.13 126 REMOVE_BEFORE_LINK 2214 0.60 1.22 0.35 127 FSL_THIS_IS_ADV 2214 0.44 1.22 0.12 128 BODY_ENHANCEMENT 2199 0.39 1.21 0.06 129 TooManyTo_002 2189 2.03 1.20 2.38 130 RELAYCOUNTRY_AT 2182 0.44 1.20 0.13 131 T_FILL_THIS_FORM_SHORT 2157 0.91 1.18 0.79 132 ANY_BOUNCE_MESSAGE 2089 6.72 1.15 9.02 133 BOUNCE_MESSAGE 2089 6.72 1.15 9.02 134 XMHTMLBadTable_001 2034 0.68 1.12 0.51 135 XM_ProductURIs 2032 0.88 1.12 0.79 136 TR_LOTS_OF_MONEY3 2023 0.60 1.11 0.39 137 XM_S_JOY_D 1997 0.80 1.10 0.68 138 DIET_1 1993 0.50 1.09 0.26 139 RELAYCOUNTRY_DE 1983 0.67 1.09 0.50 140 HTML_IMAGE_ONLY_24 1977 0.56 1.09 0.34 141 XMBrknScrpt_02 1976 0.68 1.08 0.51 142 TooManyTo_003 1959 1.40 1.08 1.53 143 UNPARSEABLE_RELAY 1952 2.35 1.07 2.88 144 LONG_JUNK_URI 1938 0.39 1.06 0.12 145 URIBL_DBL_SPAM 1899 0.31 1.04 0.01 146 XMHTML_After_End 1884 0.55 1.03 0.34 147 RCVD_IN_IADB_VOUCHED 1857 2.91 1.02 3.68 148 XMPhish11 1851 1.12 1.02 1.16 149 RDNS_DYNAMIC 1850 0.57 1.02 0.39 150 TR_Symld_Words 1836 2.37 1.01 2.92 151 T_Symld_Words_02 1792 0.61 0.98 0.45 152 XM_UB60 1791 0.33 0.98 0.06 153 NORMAL_HTTP_TO_IP 1785 0.32 0.98 0.05 154 LongTLD 1765 0.38 0.97 0.13 155 XM_B_REG_HTML 1751 0.70 0.96 0.59 156 HTML_FONT_FACE_BAD 1726 0.53 0.95 0.36 157 URIBL_SBL_A 1712 0.35 0.94 0.11 158 TooManyTo_004 1685 1.03 0.92 1.07 159 HTML_IMAGE_ONLY_28 1596 0.56 0.88 0.43 160 RCVD_IN_PSBL 1573 0.34 0.86 0.13 161 ALL_TRUSTED 1573 16.92 0.86 23.52 162 T_TooManySym_02 1521 1.40 0.83 1.63 163 BODY_URI_ONLY 1503 0.27 0.82 0.04 164 PLING_QUERY 1497 0.48 0.82 0.34 165 XMMoneyMeta_00 1488 0.60 0.82 0.52 166 RCVD_IN_DNSWL_BLOCKED 1479 1.02 0.81 1.11 167 HTTPS_HTTP_MISMATCH 1477 0.59 0.81 0.50 168 HTML_TAG_BALANCE_BODY 1449 0.46 0.80 0.32 169 XM_PDF 1431 3.26 0.79 4.28 170 XM_B_COPY_HTML 1431 0.54 0.79 0.44 171 FILL_THIS_FORM 1406 0.46 0.77 0.33 172 HTML_SHORT_LINK_IMG_1 1370 0.23 0.75 0.02 173 NORDNS_LOW_CONTRAST 1368 0.22 0.75 0.01 174 XM_UB80 1365 0.23 0.75 0.02 175 HTML_TITLE_SUBJ_DIFF 1356 0.26 0.74 0.06 176 TR_Caps_n_Bayes_99 1342 0.24 0.74 0.03 177 MPART_ALT_DIFF_COUNT 1342 0.35 0.74 0.19 178 T_HTML_TAG_BALANCE_CENTER 1339 0.31 0.73 0.14 179 BAYES_05 1335 1.31 0.73 1.55 180 RELAYCOUNTRY_AU 1318 0.58 0.72 0.52 181 RCVD_IN_MSPIKE_WL 1313 1.32 0.72 1.56 182 RCVD_IN_MSPIKE_H3 1300 1.31 0.71 1.55 183 XMGppyBdWords 1286 0.29 0.71 0.12 184 XM_Body_Obfu01 1282 0.43 0.70 0.32 185 XM_BadFromFormat 1275 0.34 0.70 0.19 186 XMSubMetaSSx_00 1255 0.30 0.69 0.14 187 URI_NOVOWEL 1237 0.52 0.68 0.45 188 XMSubMetaSxObfu_03 1222 0.38 0.67 0.26 189 XMNoVowels 1185 0.58 0.65 0.55 190 XMClaimOffer 1171 0.32 0.64 0.18 191 HTML_FONT_SIZE_HUGE 1153 0.24 0.63 0.07 192 TR_MetaPhish_Combo_01 1135 0.69 0.62 0.72 193 TR_Mismatch_TLD_02 1107 0.22 0.61 0.06 194 RDNS_NONE 1078 0.20 0.59 0.04 195 XMBSHREFv2 1070 0.25 0.59 0.11 196 DKIM_ADSP_CUSTOM_MED 1070 0.78 0.59 0.85 197 XMSlimDrugH 1067 0.32 0.59 0.20 198 HTML_IMAGE_ONLY_20 1051 0.39 0.58 0.31 199 XM_H_PHPMailer 1043 0.62 0.57 0.64 200 XM_RXBody 1029 0.25 0.56 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354895 84.71 95.75 80.17 2 DCC_CHECK_NEGATIVE 290545 52.20 19.55 65.63 3 DKIM_SIGNED 286664 71.23 86.96 64.76 4 XM_DK_Pass 279656 69.11 83.52 63.17 5 DKIM_VALID 266670 66.34 81.15 60.24 6 BAYES_50 246421 48.01 29.39 55.67 7 XMListUnsubscribeExists 189648 52.35 75.47 42.84 8 DKIM_VALID_AU 187209 48.06 62.07 42.29 9 DCC_CHECK 142193 45.65 78.53 32.12 10 XM_H_QuotedFrom 141041 37.83 52.34 31.86 11 T_TM2_M_HEADER_IN_MSG 135722 27.24 18.93 30.66 12 ALL_TRUSTED 104136 16.92 0.86 23.52 13 HTML_FONT_LOW_CONTRAST 94872 25.34 34.84 21.43 14 DKIM_VALID_EF 88292 19.64 18.91 19.95 15 MultiRelay 85871 18.72 17.06 19.40 16 MIME_HTML_ONLY 81641 21.31 28.27 18.44 17 XMSubLong 81493 20.86 26.80 18.41 18 FVGT_m_MULTI_ODD 78992 20.55 27.12 17.84 19 LOC_TINY_FONT_1 76468 22.58 35.48 17.27 20 BAYES_00 66825 12.26 5.38 15.10 21 T_KAM_HTML_FONT_INVALID 57557 15.08 20.12 13.00 22 TR_XM_DK_Bayes 49175 9.15 4.38 11.11 23 XM_DK_Undo_02 48480 22.70 51.23 10.95 24 XM_Body_Dirty_Words 45573 13.16 20.12 10.29 25 BAYES_99 44768 20.40 45.41 10.11 26 XM_Multi_Part_URI 42214 11.32 15.66 9.54 27 TR_XM_DK_Bayes1 42069 7.70 3.32 9.50 28 ANY_BOUNCE_MESSAGE 39927 6.72 1.15 9.02 29 BOUNCE_MESSAGE 39925 6.72 1.15 9.02 30 BAYES_999 39471 17.66 38.92 8.92 31 XM_DKIMWhitelistDomains 37913 6.11 0.14 8.56 32 RCVD_IN_MSPIKE_H2 37573 8.32 7.90 8.49 33 RCVD_IN_RP_SAFE 37134 7.73 6.13 8.39 34 T_XMDrugObfuBody_14 36394 8.97 10.80 8.22 35 TooManyTo_001 35769 7.86 7.33 8.08 36 LotsOfNums_01 34641 8.24 9.23 7.83 37 XM_Evil_Numbers_Gen 33868 9.67 14.57 7.65 38 LOTS_OF_MONEY 32011 8.69 12.22 7.23 39 TR_XM_DK_Bayes2 31908 5.92 2.78 7.21 40 RCVD_IN_RP_CERTIFIED 31744 6.50 4.85 7.17 41 FSL_BULK_SIG 28121 7.17 9.16 6.35 42 HTML_IMAGE_RATIO_02 27192 9.55 17.81 6.14 43 XM_H_Long_From01 25132 6.32 7.88 5.68 44 BAYES_60 24902 5.53 5.31 5.63 45 RCVD_IN_IADB_LISTED 24838 4.74 2.63 5.61 46 RELAYCOUNTRY_META 23745 8.90 17.49 5.36 47 IN_ZIMBRA_NJ_WHITELIST 22904 3.67 0.03 5.17 48 MIME_QP_LONG_LINE 22716 5.12 5.10 5.13 49 RCVD_IN_IADB_SPF 21911 4.19 2.35 4.95 50 TR_DCC_Bayes_99 21472 13.91 35.91 4.85 51 XM_SendGrid 20762 4.49 3.99 4.69 52 HTML_IMAGE_RATIO_04 20648 5.95 9.07 4.66 53 XM_B_Phish_Phrases 20289 5.83 8.86 4.58 54 DKIM_INVALID 19994 4.89 5.81 4.52 55 T_REMOTE_IMAGE 19616 4.46 4.52 4.43 56 RCVD_IN_IADB_SENDERID 19588 3.79 2.24 4.42 57 XM_PDF 18961 3.26 0.79 4.28 58 RCVD_IN_IADB_DK 18951 3.68 2.23 4.28 59 T_TooManySym_01 18661 3.88 3.07 4.22 60 TR_XM_DocInvoice 17704 4.91 7.14 4.00 61 XMStrtUSub 17590 4.27 4.97 3.97 62 XMSubMetaSx_00 17132 4.55 6.20 3.87 63 RCVD_IN_DNSWL_NONE 16795 3.36 2.31 3.79 64 RCVD_IN_IADB_VOUCHED 16306 2.91 1.02 3.68 65 BOTNET_IPINHOSTNAME 16273 6.87 14.62 3.68 66 XMNumbers 15737 3.76 4.26 3.55 67 BAYES_80 15601 4.46 6.72 3.52 68 BAYES_40 15567 2.90 1.40 3.52 69 XM_UncommonTLD01 14681 4.95 8.92 3.32 70 FROM_EXCESS_BASE64 14112 4.43 7.45 3.19 71 XMSexyCombo_05 13528 4.94 9.52 3.06 72 HTML_MIME_NO_HTML_TAG 13327 2.69 1.90 3.01 73 TR_Symld_Words 12945 2.37 1.01 2.92 74 UNPARSEABLE_RELAY 12759 2.35 1.07 2.88 75 XM_H_PHPOS 12403 2.36 1.27 2.80 76 MAILING_LIST_MULTI 12053 2.56 2.17 2.72 77 BAYES_20 11574 2.22 1.26 2.61 78 MPART_ALT_DIFF 11210 3.67 6.44 2.53 79 HTML_IMAGE_RATIO_06 10758 2.98 4.33 2.43 80 TVD_RCVD_IP 10594 1.76 0.23 2.39 81 TooManyTo_002 10525 2.03 1.20 2.38 82 BAYES_95 10156 2.91 4.39 2.29 83 MIME_HTML_MOSTLY 10007 3.08 5.08 2.26 84 HELO_NODOT 9333 1.58 0.29 2.11 85 XM_CamelCaseFrm001 8897 2.42 3.40 2.01 86 HTML_IMAGE_RATIO_08 8653 2.34 3.28 1.95 87 XM_SPF_SoftFail 8566 2.62 4.29 1.94 88 IN_HORDE_ADDRESS_BOOK 8212 1.33 0.06 1.86 89 RCVD_IN_IADB_OPTIN 7657 1.38 0.55 1.73 90 XM_DIRTYINTL 7569 2.44 4.20 1.71 91 XM_DK_Undo_01 7502 1.68 1.66 1.69 92 TM2_M_URI_OPT_OUT 7350 2.36 4.06 1.66 93 T_TooManySym_02 7237 1.40 0.83 1.63 94 SUBJ_ALL_CAPS 7132 1.70 1.90 1.61 95 RCVD_IN_MSPIKE_WL 6905 1.32 0.72 1.56 96 RCVD_IN_MSPIKE_H3 6875 1.31 0.71 1.55 97 BAYES_05 6860 1.31 0.73 1.55 98 INVALID_MSGID 6821 1.20 0.37 1.54 99 TooManyTo_003 6783 1.40 1.08 1.53 100 RELAYCOUNTRY_CA 6185 2.00 3.47 1.40 101 TO_MALFORMED 6031 1.01 0.16 1.36 102 XMCapTrack 5879 1.06 0.41 1.33 103 MIME_HTML_ONLY_MULTI 5871 1.81 2.98 1.33 104 T_MIXED_ES 5867 1.71 2.63 1.33 105 XM_GoogleGroups 5757 1.07 0.52 1.30 106 RELAYCOUNTRY_GB 5525 1.42 1.84 1.25 107 XMDiploma_00 5489 1.66 2.69 1.24 108 USER_IN_DEF_DKIM_WL 5428 0.89 0.06 1.23 109 UNTRUSTED_Relay 5246 3.81 10.17 1.19 110 XMPhish11 5157 1.12 1.02 1.16 111 XM_OfRef6 5023 1.50 2.40 1.13 112 NO_DNS_FOR_FROM 5014 1.16 1.24 1.13 113 T_XMDrugObfuBody_08 5010 1.36 1.92 1.13 114 RCVD_IN_DNSWL_BLOCKED 4923 1.02 0.81 1.11 115 BOTNET 4820 4.81 13.85 1.09 116 TooManyTo_004 4737 1.03 0.92 1.07 117 URI_HEX 4536 1.75 3.50 1.02 118 URI_TRY_3LD 4433 1.07 1.25 1.00 119 XMBdyGiftCard01 4396 1.26 1.92 0.99 120 XMStockSpam_06 4383 1.12 1.45 0.99 121 XMSexyCombo_01 3817 1.22 2.08 0.86 122 DKIM_ADSP_CUSTOM_MED 3776 0.78 0.59 0.85 123 TooManyTo_005 3775 0.75 0.48 0.85 124 SpammyFromTLD_01 3751 1.13 1.80 0.85 125 T_XMHurry_00 3712 1.34 2.56 0.84 126 XM_H_Long_From02 3543 1.00 1.47 0.80 127 T_FILL_THIS_FORM_SHORT 3500 0.91 1.18 0.79 128 XM_ProductURIs 3496 0.88 1.12 0.79 129 TM2_M_VERY_LONG_WORD 3469 1.18 2.14 0.78 130 XMGenDplmaNmb 3422 0.96 1.40 0.77 131 XMSubMetaSxObfu_02 3362 0.60 0.22 0.76 132 XM_UB50 3203 1.69 4.03 0.72 133 TO_NO_BRKTS_HTML_ONLY 3180 0.55 0.13 0.72 134 TR_MetaPhish_Combo_01 3168 0.69 0.62 0.72 135 T_TooManySym_03 3071 0.55 0.22 0.69 136 XM_S_JOY_D 3027 0.80 1.10 0.68 137 RCVD_IN_BL_SPAMCOP_NET 3022 1.84 4.65 0.68 138 XM_ShortIntro_01 2900 0.59 0.42 0.66 139 USER_IN_WHITELIST 2839 0.45 0.00 0.64 140 RCVD_IN_IADB_DOPTIN 2821 0.47 0.07 0.64 141 XM_H_PHPMailer 2813 0.62 0.57 0.64 142 NML_ADSP_CUSTOM_MED 2770 0.58 0.48 0.63 143 T_XMDrugObfuBody_00 2707 0.95 1.77 0.61 144 XM_B_REG_HTML 2608 0.70 0.96 0.59 145 XMBody_78 2565 0.84 1.47 0.58 146 SHORT_HELO_AND_INLINE_IMAGE 2478 0.41 0.06 0.56 147 XMSubMetaI_00 2466 1.10 2.43 0.56 148 RCVD_IN_SORBS_DUL 2463 0.45 0.18 0.56 149 XMNoVowels 2416 0.58 0.65 0.55 150 XMGappySubj_01 2394 0.49 0.36 0.54 151 T_OBFU_PDF_ATTACH 2387 0.43 0.18 0.54 152 RELAYCOUNTRY_AU 2301 0.58 0.72 0.52 153 XMMoneyMeta_00 2289 0.60 0.82 0.52 154 TR_XM_RelayPhish 2281 0.79 1.46 0.52 155 XMBrknScrpt_02 2277 0.68 1.08 0.51 156 XMHTMLBadTable_001 2237 0.68 1.12 0.51 157 RELAYCOUNTRY_DE 2222 0.67 1.09 0.50 158 HTTPS_HTTP_MISMATCH 2219 0.59 0.81 0.50 159 T_Symld_Words_02 2008 0.61 0.98 0.45 160 AC_DIV_BONANZA 2003 0.36 0.14 0.45 161 HTML_IMAGE_ONLY_32 1985 0.44 0.43 0.45 162 URI_NOVOWEL 1984 0.52 0.68 0.45 163 XM_B_TRADE_HTML 1963 0.44 0.42 0.44 164 XM_B_COPY_HTML 1943 0.54 0.79 0.44 165 HTML_IMAGE_ONLY_28 1906 0.56 0.88 0.43 166 MISSING_HEADERS 1877 0.37 0.25 0.42 167 RCVD_IN_IADB_RDNS 1783 0.29 0.03 0.40 168 XMPhish30 1742 0.72 1.53 0.39 169 T_TooManySym_04 1738 0.29 0.04 0.39 170 TR_LOTS_OF_MONEY3 1733 0.60 1.11 0.39 171 TM2_M_BODY_EMPTY 1721 0.42 0.49 0.39 172 TR_LOTS_OF_MONEY2 1719 0.65 1.29 0.39 173 T_MONEY_PERCENT 1719 0.65 1.29 0.39 174 RDNS_DYNAMIC 1715 0.57 1.02 0.39 175 RCVD_IN_DNSWL_MED 1699 0.29 0.05 0.38 176 DKIM_ADSP_NXDOMAIN 1660 0.39 0.42 0.37 177 XMBody_95 1649 0.32 0.18 0.37 178 XMDateMe_00 1634 0.36 0.33 0.37 179 XMSubNoVowel 1610 0.39 0.47 0.36 180 XMBody_17 1573 0.65 1.37 0.36 181 HTML_FONT_FACE_BAD 1573 0.53 0.95 0.36 182 REMOVE_BEFORE_LINK 1550 0.60 1.22 0.35 183 BAD_ENC_HEADER 1542 0.26 0.05 0.35 184 HTML_IMAGE_ONLY_24 1527 0.56 1.09 0.34 185 XMHTML_After_End 1526 0.55 1.03 0.34 186 PLING_QUERY 1498 0.48 0.82 0.34 187 XM_H_PHPOS_M 1497 0.34 0.34 0.34 188 XMPhish14 1461 0.66 1.47 0.33 189 FILL_THIS_FORM 1446 0.46 0.77 0.33 190 HTML_TAG_BALANCE_BODY 1436 0.46 0.80 0.32 191 XMLngstWrd_00 1429 0.34 0.38 0.32 192 DOS_OUTLOOK_TO_MX 1416 0.26 0.11 0.32 193 TVD_SPACE_RATIO 1413 0.32 0.31 0.32 194 SpammyFromTLD_02 1405 0.64 1.42 0.32 195 XM_Body_Obfu01 1402 0.43 0.70 0.32 196 HTML_IMAGE_ONLY_20 1392 0.39 0.58 0.31 197 FORGED_GMAIL_RCVD 1309 0.33 0.40 0.30 198 XMSolicitRefs_0 1291 0.31 0.36 0.29 199 TM2_M_A_HREF_HREF 1285 0.35 0.51 0.29 200 XMLngstWrd_01 1285 0.31 0.35 0.29 ----------------------------------------------------------------------