Email: 593724 Autolearn: 12160 AvgScore: 3.06 AvgScanTime: 2.79 sec Spam: 168509 Autolearn: 817 AvgScore: 12.18 AvgScanTime: 3.00 sec Ham: 425215 Autolearn: 11343 AvgScore: -0.55 AvgScanTime: 2.71 sec Time Spent Running SA: 460.24 hours Time Spent Processing Spam: 140.27 hours Time Spent Processing Ham: 319.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159569 83.70 94.69 79.34 2 DKIM_SIGNED 143334 71.36 85.06 65.93 3 XM_DK_Pass 138375 69.41 82.12 64.38 4 DKIM_VALID 136207 67.81 80.83 62.64 5 DCC_CHECK 132907 46.68 78.87 33.92 6 XMListUnsubscribeExists 124280 51.48 73.75 42.65 7 DKIM_VALID_AU 108201 50.99 64.21 45.75 8 XM_H_QuotedFrom 92006 38.92 54.60 32.70 9 XM_DK_Undo_02 81892 22.27 48.60 11.83 10 BAYES_99 73038 20.04 43.34 10.81 11 BAYES_999 63091 17.43 37.44 9.50 12 HTML_FONT_LOW_CONTRAST 60183 25.96 35.72 22.10 13 LOC_TINY_FONT_1 60026 23.14 35.62 18.19 14 TR_DCC_Bayes_99 58240 13.69 34.56 5.42 15 BAYES_50 53116 48.55 31.52 55.29 16 MIME_HTML_ONLY 49452 20.83 29.35 17.46 17 FVGT_m_MULTI_ODD 45522 21.01 27.01 18.64 18 XMSubLong 44979 21.29 26.69 19.15 19 MultiRelay 32162 19.47 19.09 19.62 20 XM_Body_Dirty_Words 31925 12.59 18.95 10.08 21 DCC_CHECK_NEGATIVE 31816 51.09 18.88 63.85 22 DKIM_VALID_EF 31508 20.42 18.70 21.10 23 T_TM2_M_HEADER_IN_MSG 30731 26.91 18.24 30.35 24 RELAYCOUNTRY_META 30373 8.89 18.02 5.28 25 T_KAM_HTML_FONT_INVALID 29660 14.03 17.60 12.61 26 HTML_IMAGE_RATIO_02 29465 9.73 17.49 6.66 27 XM_Multi_Part_URI 27543 11.84 16.35 10.05 28 XM_Evil_Numbers_Gen 24180 10.05 14.35 8.35 29 BOTNET_IPINHOSTNAME 22548 6.64 13.38 3.97 30 BOTNET 20466 4.21 12.15 1.07 31 FSL_BULK_SIG 19545 8.06 11.60 6.66 32 LOTS_OF_MONEY 19409 8.84 11.52 7.78 33 T_XMDrugObfuBody_14 19369 8.90 11.49 7.87 34 HTML_IMAGE_RATIO_04 17674 7.00 10.49 5.61 35 UNTRUSTED_Relay 16733 3.73 9.93 1.27 36 XM_B_Phish_Phrases 15447 6.12 9.17 4.91 37 LotsOfNums_01 14842 7.95 8.81 7.61 38 XMSexyCombo_05 14428 4.60 8.56 3.04 39 TR_XM_DocInvoice 13828 5.30 8.21 4.14 40 XM_UncommonTLD01 13723 4.80 8.14 3.47 41 TooManyTo_001 13135 8.10 7.79 8.22 42 XM_H_Long_From01 13091 5.91 7.77 5.17 43 MPART_ALT_DIFF 11859 3.76 7.04 2.46 44 RCVD_IN_MSPIKE_H2 11855 7.59 7.04 7.82 45 BAYES_80 11462 4.44 6.80 3.50 46 XMSubMetaSx_00 11022 4.06 6.54 3.07 47 FROM_EXCESS_BASE64 10535 4.25 6.25 3.46 48 RCVD_IN_RP_SAFE 9574 8.36 5.68 9.42 49 XMNumbers 9287 4.31 5.51 3.83 50 BAYES_60 9207 5.57 5.46 5.61 51 XMStrtUSub 8494 4.36 5.04 4.09 52 HTML_IMAGE_RATIO_06 8232 3.20 4.89 2.53 53 MIME_HTML_MOSTLY 8189 2.89 4.86 2.11 54 BAYES_00 8189 12.22 4.86 15.13 55 T_REMOTE_IMAGE 8109 4.57 4.81 4.48 56 MIME_QP_LONG_LINE 8039 4.83 4.77 4.86 57 XM_SPF_SoftFail 7810 2.62 4.63 1.83 58 TM2_M_URI_OPT_OUT 7565 2.43 4.49 1.62 59 RCVD_IN_BL_SPAMCOP_NET 7507 1.84 4.45 0.81 60 BAYES_95 7444 2.96 4.42 2.38 61 RCVD_IN_RP_CERTIFIED 7178 7.03 4.26 8.13 62 DKIM_INVALID 7127 3.55 4.23 3.28 63 XM_DIRTYINTL 6974 2.38 4.14 1.68 64 XM_SendGrid 6969 4.31 4.14 4.38 65 XM_UB50 6933 1.67 4.11 0.70 66 XM_CamelCaseFrm001 6593 2.14 3.91 1.44 67 RELAYCOUNTRY_CA 6365 2.02 3.78 1.32 68 TR_XM_DK_Bayes 6345 9.09 3.77 11.20 69 MultiRelay_Combo 6291 1.23 3.73 0.24 70 MultiRelay_CC 6291 1.23 3.73 0.24 71 URI_HEX 6269 1.80 3.72 1.04 72 TR_XM_DK_Bayes1 5957 8.67 3.54 10.70 73 HTML_IMAGE_RATIO_08 5943 2.43 3.53 1.99 74 T_TooManySym_01 5718 3.71 3.39 3.84 75 MIME_HTML_ONLY_MULTI 5111 1.77 3.03 1.27 76 TR_XM_DK_Bayes2 5070 6.85 3.01 8.37 77 SpammyFromTLD_01 4594 1.54 2.73 1.07 78 T_MIXED_ES 4475 1.80 2.66 1.46 79 XM_URI_RBL 4363 0.85 2.59 0.16 80 HTML_MIME_NO_HTML_TAG 4262 2.48 2.53 2.46 81 XM_OfRef6 4236 1.60 2.51 1.23 82 RELAYCOUNTRY_FR 4110 0.88 2.44 0.26 83 XMDiploma_00 3999 1.59 2.37 1.27 84 RCVD_IN_RP_RNBL 3886 0.68 2.31 0.04 85 RCVD_IN_IADB_LISTED 3733 4.34 2.22 5.19 86 XM_UB99 3656 0.62 2.17 0.01 87 XMBdyGiftCard01 3656 1.27 2.17 0.92 88 XM_H_PHPOS 3420 1.59 2.03 1.42 89 T_XMDrugObfuBody_08 3399 1.40 2.02 1.15 90 RCVD_IN_IADB_SPF 3311 3.80 1.96 4.52 91 MAILING_LIST_MULTI 3282 2.49 1.95 2.71 92 RELAYCOUNTRY_GB 3276 1.49 1.94 1.31 93 SpammyFromTLD_02 3249 0.80 1.93 0.35 94 RCVD_IN_DNSWL_NONE 3193 3.25 1.89 3.79 95 TM2_M_VERY_LONG_WORD 3149 1.09 1.87 0.78 96 RCVD_IN_IADB_SENDERID 3094 3.40 1.84 4.02 97 RCVD_IN_IADB_DK 3065 3.33 1.82 3.92 98 XMSubMetaI_00 2989 1.00 1.77 0.69 99 T_XMHurry_00 2929 1.09 1.74 0.84 100 URIBL_BLACK 2912 0.52 1.73 0.04 101 XM_UB999 2910 0.49 1.73 0.01 102 XM_H_Long_From02 2893 1.13 1.72 0.90 103 XMBody_17 2855 0.73 1.69 0.35 104 XMSexyCombo_01 2833 0.97 1.68 0.69 105 TR_XM_RelayPhish 2757 0.81 1.64 0.49 106 XMBody_78 2727 0.86 1.62 0.56 107 ALL_TRUSTED 2670 16.45 1.58 22.34 108 XM_DK_Undo_01 2619 1.68 1.55 1.72 109 XM_ProductURIs 2522 0.93 1.50 0.70 110 BAYES_40 2490 2.81 1.48 3.34 111 TR_LOTS_OF_MONEY2 2433 0.78 1.44 0.52 112 T_MONEY_PERCENT 2433 0.78 1.44 0.52 113 BOTNET_NORDNS 2401 0.42 1.42 0.02 114 T_FILL_THIS_FORM_SHORT 2349 1.07 1.39 0.95 115 BODY_URI_ONLY 2294 0.41 1.36 0.04 116 XM_HighProb1 2290 0.40 1.36 0.02 117 SUBJ_ALL_CAPS 2272 1.34 1.35 1.33 118 TM2_M_BODY_EMPTY 2230 0.82 1.32 0.62 119 SUBJ_DOLLARS 2225 0.46 1.32 0.12 120 XM_BadFromFormat 2218 0.57 1.32 0.27 121 RCVD_IN_DNSWL_BLOCKED 2182 1.79 1.29 1.98 122 HTML_SHORT_LINK_IMG_1 2129 0.38 1.26 0.03 123 XMStockSpam_06 2121 1.49 1.26 1.58 124 BAYES_20 2118 2.11 1.26 2.44 125 XMEmptyBody_01 2094 0.60 1.24 0.35 126 XMPhish30 2094 0.65 1.24 0.42 127 URIBL_DBL_SPAM 2089 0.36 1.24 0.01 128 BODY_ENHANCEMENT 2076 0.41 1.23 0.09 129 XMGenDplmaNmb 2069 0.90 1.23 0.76 130 RCVD_IN_PSBL 2056 0.40 1.22 0.07 131 T_XMDrugObfuBody_00 2052 0.83 1.22 0.67 132 HTTPS_HTTP_MISMATCH 2042 0.67 1.21 0.46 133 XMPhish14 1969 0.57 1.17 0.33 134 RELAYCOUNTRY_DE 1960 0.78 1.16 0.63 135 T_Symld_Words_02 1891 0.59 1.12 0.38 136 XMBrknScrpt_02 1881 0.77 1.12 0.63 137 FSL_THIS_IS_ADV 1868 0.37 1.11 0.08 138 RELAYCOUNTRY_AT 1864 0.41 1.11 0.13 139 URI_TRY_3LD 1858 0.86 1.10 0.76 140 UNPARSEABLE_RELAY 1817 2.46 1.08 3.01 141 TR_Symld_Words 1806 2.58 1.07 3.18 142 DIET_1 1796 0.56 1.07 0.35 143 TooManyTo_002 1786 2.03 1.06 2.41 144 XMPhish11 1758 1.11 1.04 1.14 145 LONG_JUNK_URI 1739 0.41 1.03 0.16 146 T_HTML_TAG_BALANCE_CENTER 1727 0.41 1.02 0.17 147 XMHTML_After_End 1722 0.51 1.02 0.30 148 RCVD_IN_IADB_VOUCHED 1662 2.70 0.99 3.37 149 XM_UB60 1661 0.32 0.99 0.06 150 MPART_ALT_DIFF_COUNT 1639 0.43 0.97 0.21 151 RELAYCOUNTRY_CN 1631 0.33 0.97 0.08 152 T_TooManySym_02 1629 1.46 0.97 1.66 153 XM_B_COPY_HTML 1579 0.58 0.94 0.43 154 TooManyTo_003 1574 1.37 0.93 1.55 155 TR_LOTS_OF_MONEY3 1566 0.55 0.93 0.39 156 HTML_FONT_FACE_BAD 1503 0.53 0.89 0.39 157 RDNS_DYNAMIC 1499 0.51 0.89 0.35 158 XM_Body_Obfu01 1499 0.46 0.89 0.29 159 HTML_FONT_SIZE_HUGE 1491 0.35 0.88 0.14 160 XM_B_REG_HTML 1480 0.81 0.88 0.78 161 HTML_TAG_BALANCE_BODY 1475 0.50 0.88 0.36 162 BAYES_05 1445 1.31 0.86 1.48 163 RELAYCOUNTRY_AU 1443 0.58 0.86 0.47 164 HTML_IMAGE_ONLY_28 1419 0.54 0.84 0.42 165 XM_UB80 1385 0.25 0.82 0.02 166 DKIM_ADSP_NXDOMAIN 1360 0.46 0.81 0.32 167 TooManyTo_004 1354 0.98 0.80 1.05 168 HTML_IMAGE_ONLY_08 1348 0.32 0.80 0.12 169 URIBL_SBL_A 1333 0.55 0.79 0.46 170 XMClaimOffer 1328 0.41 0.79 0.26 171 RCVD_IN_MSPIKE_WL 1323 1.39 0.79 1.63 172 RCVD_IN_MSPIKE_H3 1323 1.39 0.79 1.62 173 XMMoneyMeta_00 1321 0.57 0.78 0.49 174 XM_XX_Yahoo 1314 0.29 0.78 0.10 175 ANY_BOUNCE_MESSAGE 1309 7.06 0.78 9.55 176 BOUNCE_MESSAGE 1309 7.06 0.78 9.55 177 NO_DNS_FOR_FROM 1308 0.42 0.78 0.27 178 XM_S_JOY_D 1306 0.54 0.78 0.45 179 XMNoVowels 1304 0.65 0.77 0.60 180 XMSubMetaSxObfu_03 1296 0.40 0.77 0.26 181 URI_NOVOWEL 1295 0.46 0.77 0.33 182 REMOVE_BEFORE_LINK 1293 0.53 0.77 0.43 183 FILL_THIS_FORM 1285 0.48 0.76 0.36 184 XM_PDF 1281 3.40 0.76 4.44 185 RDNS_NONE 1249 0.25 0.74 0.05 186 XMSexyCombo_04 1225 0.25 0.73 0.06 187 FROM_ADDR_WS 1208 0.20 0.72 0.00 188 LONG_JUNK_URI3 1188 0.27 0.71 0.09 189 LongTLD 1186 0.29 0.70 0.13 190 XMSubject_09 1184 0.27 0.70 0.10 191 RELAYCOUNTRY_RU 1180 0.22 0.70 0.03 192 FILL_THIS_FORM_LONG 1175 0.35 0.70 0.21 193 TR_MetaPhish_Combo_01 1150 0.73 0.68 0.75 194 HTML_IMAGE_ONLY_24 1140 0.45 0.68 0.36 195 XM_RXBody 1129 0.41 0.67 0.31 196 RELAYCOUNTRY_ES 1127 0.21 0.67 0.03 197 XMUrgent 1125 0.36 0.67 0.23 198 RCVD_IN_IADB_OPTIN 1124 1.33 0.67 1.59 199 FILL_THIS_FORM_LOAN 1115 0.31 0.66 0.18 200 BASE64_LENGTH_79_INF 1112 0.28 0.66 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 337383 83.70 94.69 79.34 2 DKIM_SIGNED 280332 71.36 85.06 65.93 3 XM_DK_Pass 273744 69.41 82.12 64.38 4 DCC_CHECK_NEGATIVE 271498 51.09 18.88 63.85 5 DKIM_VALID 266373 67.81 80.83 62.64 6 BAYES_50 235108 48.55 31.52 55.29 7 DKIM_VALID_AU 194521 50.99 64.21 45.75 8 XMListUnsubscribeExists 181347 51.48 73.75 42.65 9 DCC_CHECK 144237 46.68 78.87 33.92 10 XM_H_QuotedFrom 139056 38.92 54.60 32.70 11 T_TM2_M_HEADER_IN_MSG 129055 26.91 18.24 30.35 12 ALL_TRUSTED 94995 16.45 1.58 22.34 13 HTML_FONT_LOW_CONTRAST 93962 25.96 35.72 22.10 14 DKIM_VALID_EF 89736 20.42 18.70 21.10 15 MultiRelay 83407 19.47 19.09 19.62 16 XMSubLong 81419 21.29 26.69 19.15 17 FVGT_m_MULTI_ODD 79247 21.01 27.01 18.64 18 LOC_TINY_FONT_1 77355 23.14 35.62 18.19 19 MIME_HTML_ONLY 74222 20.83 29.35 17.46 20 BAYES_00 64337 12.22 4.86 15.13 21 T_KAM_HTML_FONT_INVALID 53622 14.03 17.60 12.61 22 XM_DK_Undo_02 50305 22.27 48.60 11.83 23 TR_XM_DK_Bayes 47610 9.09 3.77 11.20 24 BAYES_99 45972 20.04 43.34 10.81 25 TR_XM_DK_Bayes1 45501 8.67 3.54 10.70 26 XM_Body_Dirty_Words 42853 12.59 18.95 10.08 27 XM_Multi_Part_URI 42732 11.84 16.35 10.05 28 XM_DKIMWhitelistDomains 40642 6.85 0.03 9.56 29 ANY_BOUNCE_MESSAGE 40604 7.06 0.78 9.55 30 BOUNCE_MESSAGE 40602 7.06 0.78 9.55 31 BAYES_999 40398 17.43 37.44 9.50 32 RCVD_IN_RP_SAFE 40041 8.36 5.68 9.42 33 TR_XM_DK_Bayes2 35601 6.85 3.01 8.37 34 XM_Evil_Numbers_Gen 35510 10.05 14.35 8.35 35 TooManyTo_001 34940 8.10 7.79 8.22 36 RCVD_IN_RP_CERTIFIED 34579 7.03 4.26 8.13 37 T_XMDrugObfuBody_14 33465 8.90 11.49 7.87 38 RCVD_IN_MSPIKE_H2 33236 7.59 7.04 7.82 39 LOTS_OF_MONEY 33067 8.84 11.52 7.78 40 LotsOfNums_01 32347 7.95 8.81 7.61 41 FSL_BULK_SIG 28323 8.06 11.60 6.66 42 HTML_IMAGE_RATIO_02 28304 9.73 17.49 6.66 43 BAYES_60 23874 5.57 5.46 5.61 44 HTML_IMAGE_RATIO_04 23859 7.00 10.49 5.61 45 TR_DCC_Bayes_99 23056 13.69 34.56 5.42 46 IN_ZIMBRA_NJ_WHITELIST 23033 3.89 0.05 5.42 47 RELAYCOUNTRY_META 22434 8.89 18.02 5.28 48 RCVD_IN_IADB_LISTED 22063 4.34 2.22 5.19 49 XM_H_Long_From01 21982 5.91 7.77 5.17 50 XM_B_Phish_Phrases 20891 6.12 9.17 4.91 51 MIME_QP_LONG_LINE 20655 4.83 4.77 4.86 52 RCVD_IN_IADB_SPF 19239 3.80 1.96 4.52 53 T_REMOTE_IMAGE 19051 4.57 4.81 4.48 54 XM_PDF 18888 3.40 0.76 4.44 55 XM_SendGrid 18607 4.31 4.14 4.38 56 TR_XM_DocInvoice 17622 5.30 8.21 4.14 57 XMStrtUSub 17371 4.36 5.04 4.09 58 RCVD_IN_IADB_SENDERID 17103 3.40 1.84 4.02 59 BOTNET_IPINHOSTNAME 16876 6.64 13.38 3.97 60 RCVD_IN_IADB_DK 16682 3.33 1.82 3.92 61 T_TooManySym_01 16333 3.71 3.39 3.84 62 XMNumbers 16290 4.31 5.51 3.83 63 RCVD_IN_DNSWL_NONE 16131 3.25 1.89 3.79 64 BAYES_80 14876 4.44 6.80 3.50 65 XM_UncommonTLD01 14776 4.80 8.14 3.47 66 FROM_EXCESS_BASE64 14724 4.25 6.25 3.46 67 RCVD_IN_IADB_VOUCHED 14349 2.70 0.99 3.37 68 BAYES_40 14211 2.81 1.48 3.34 69 DKIM_INVALID 13959 3.55 4.23 3.28 70 TR_Symld_Words 13512 2.58 1.07 3.18 71 XMSubMetaSx_00 13067 4.06 6.54 3.07 72 XMSexyCombo_05 12907 4.60 8.56 3.04 73 UNPARSEABLE_RELAY 12778 2.46 1.08 3.01 74 MAILING_LIST_MULTI 11512 2.49 1.95 2.71 75 TVD_RCVD_IP 11143 1.94 0.22 2.62 76 HTML_IMAGE_RATIO_06 10745 3.20 4.89 2.53 77 HTML_MIME_NO_HTML_TAG 10476 2.48 2.53 2.46 78 MPART_ALT_DIFF 10455 3.76 7.04 2.46 79 BAYES_20 10396 2.11 1.26 2.44 80 TooManyTo_002 10253 2.03 1.06 2.41 81 BAYES_95 10133 2.96 4.42 2.38 82 MIME_HTML_MOSTLY 8960 2.89 4.86 2.11 83 HELO_NODOT 8935 1.58 0.27 2.10 84 IN_HORDE_ADDRESS_BOOK 8677 1.49 0.08 2.04 85 HTML_IMAGE_RATIO_08 8477 2.43 3.53 1.99 86 RCVD_IN_DNSWL_BLOCKED 8439 1.79 1.29 1.98 87 XM_SPF_SoftFail 7765 2.62 4.63 1.83 88 XM_DK_Undo_01 7331 1.68 1.55 1.72 89 XM_DIRTYINTL 7141 2.38 4.14 1.68 90 T_TooManySym_02 7050 1.46 0.97 1.66 91 RCVD_IN_MSPIKE_WL 6910 1.39 0.79 1.63 92 RCVD_IN_MSPIKE_H3 6901 1.39 0.79 1.62 93 TM2_M_URI_OPT_OUT 6883 2.43 4.49 1.62 94 RCVD_IN_IADB_OPTIN 6748 1.33 0.67 1.59 95 XMStockSpam_06 6735 1.49 1.26 1.58 96 INVALID_MSGID 6618 1.22 0.37 1.56 97 TooManyTo_003 6577 1.37 0.93 1.55 98 TO_MALFORMED 6340 1.12 0.19 1.49 99 BAYES_05 6308 1.31 0.86 1.48 100 T_MIXED_ES 6206 1.80 2.66 1.46 101 XM_CamelCaseFrm001 6134 2.14 3.91 1.44 102 XM_H_PHPOS 6027 1.59 2.03 1.42 103 SUBJ_ALL_CAPS 5661 1.34 1.35 1.33 104 RELAYCOUNTRY_CA 5613 2.02 3.78 1.32 105 USER_IN_DEF_DKIM_WL 5613 0.98 0.11 1.32 106 XM_GoogleGroups 5590 1.09 0.53 1.31 107 RELAYCOUNTRY_GB 5572 1.49 1.94 1.31 108 XMCapTrack 5516 1.09 0.57 1.30 109 XMDiploma_00 5415 1.59 2.37 1.27 110 UNTRUSTED_Relay 5411 3.73 9.93 1.27 111 MIME_HTML_ONLY_MULTI 5400 1.77 3.03 1.27 112 XM_OfRef6 5236 1.60 2.51 1.23 113 T_XMDrugObfuBody_08 4890 1.40 2.02 1.15 114 XMPhish11 4856 1.11 1.04 1.14 115 SpammyFromTLD_01 4530 1.54 2.73 1.07 116 BOTNET 4530 4.21 12.15 1.07 117 TooManyTo_004 4461 0.98 0.80 1.05 118 URI_HEX 4407 1.80 3.72 1.04 119 DKIM_ADSP_CUSTOM_MED 4037 0.84 0.55 0.95 120 T_FILL_THIS_FORM_SHORT 4027 1.07 1.39 0.95 121 XMBdyGiftCard01 3904 1.27 2.17 0.92 122 XM_H_Long_From02 3831 1.13 1.72 0.90 123 T_XMHurry_00 3560 1.09 1.74 0.84 124 TooManyTo_005 3555 0.71 0.40 0.84 125 RCVD_IN_BL_SPAMCOP_NET 3437 1.84 4.45 0.81 126 TM2_M_VERY_LONG_WORD 3329 1.09 1.87 0.78 127 XM_B_REG_HTML 3301 0.81 0.88 0.78 128 XMGenDplmaNmb 3252 0.90 1.23 0.76 129 URI_TRY_3LD 3231 0.86 1.10 0.76 130 TR_MetaPhish_Combo_01 3175 0.73 0.68 0.75 131 XM_UB50 2982 1.67 4.11 0.70 132 XM_ProductURIs 2973 0.93 1.50 0.70 133 XMGappySubj_01 2969 0.65 0.52 0.70 134 XMSubMetaI_00 2949 1.00 1.77 0.69 135 XMSexyCombo_01 2942 0.97 1.68 0.69 136 T_TooManySym_03 2941 0.58 0.31 0.69 137 T_XMDrugObfuBody_00 2851 0.83 1.22 0.67 138 USER_IN_WHITELIST 2832 0.48 0.00 0.67 139 NML_ADSP_CUSTOM_MED 2819 0.60 0.42 0.66 140 RELAYCOUNTRY_DE 2692 0.78 1.16 0.63 141 XMBrknScrpt_02 2670 0.77 1.12 0.63 142 XM_ShortIntro_01 2635 0.53 0.32 0.62 143 TM2_M_BODY_EMPTY 2630 0.82 1.32 0.62 144 XMSolicitRefs_0 2623 0.56 0.43 0.62 145 RCVD_IN_IADB_DOPTIN 2607 0.46 0.06 0.61 146 XMNoVowels 2572 0.65 0.77 0.60 147 T_OBFU_PDF_ATTACH 2513 0.47 0.15 0.59 148 XMBody_78 2388 0.86 1.62 0.56 149 SHORT_HELO_AND_INLINE_IMAGE 2385 0.42 0.05 0.56 150 RCVD_IN_SORBS_DUL 2322 0.44 0.16 0.55 151 XM_H_PHPMailer 2255 0.55 0.58 0.53 152 T_MONEY_PERCENT 2227 0.78 1.44 0.52 153 TR_LOTS_OF_MONEY2 2227 0.78 1.44 0.52 154 XMBody_95 2107 0.39 0.12 0.50 155 XMMoneyMeta_00 2084 0.57 0.78 0.49 156 TR_XM_RelayPhish 2069 0.81 1.64 0.49 157 AC_DIV_BONANZA 2038 0.39 0.17 0.48 158 RCVD_IN_DNSWL_MED 2029 0.36 0.05 0.48 159 RELAYCOUNTRY_AU 2011 0.58 0.86 0.47 160 MISSING_HEADERS 1994 0.41 0.27 0.47 161 HTTPS_HTTP_MISMATCH 1954 0.67 1.21 0.46 162 URIBL_SBL_A 1950 0.55 0.79 0.46 163 XM_B_TRADE_HTML 1939 0.47 0.51 0.46 164 XM_S_JOY_D 1927 0.54 0.78 0.45 165 HTML_IMAGE_ONLY_32 1849 0.46 0.52 0.43 166 XM_B_COPY_HTML 1835 0.58 0.94 0.43 167 REMOVE_BEFORE_LINK 1826 0.53 0.77 0.43 168 HTML_IMAGE_ONLY_28 1791 0.54 0.84 0.42 169 XMPhish30 1788 0.65 1.24 0.42 170 XMSubMetaSxObfu_02 1765 0.37 0.27 0.42 171 XM_USANA_RCVD 1684 0.28 0.00 0.40 172 TO_NO_BRKTS_HTML_ONLY 1683 0.47 0.65 0.40 173 TR_LOTS_OF_MONEY3 1675 0.55 0.93 0.39 174 HTML_FONT_FACE_BAD 1670 0.53 0.89 0.39 175 XM_Combo_Sbj 1668 0.41 0.46 0.39 176 T_TooManySym_04 1649 0.29 0.04 0.39 177 T_Symld_Words_02 1624 0.59 1.12 0.38 178 TVD_SPACE_RATIO 1607 0.36 0.30 0.38 179 BAD_ENC_HEADER 1602 0.28 0.02 0.38 180 HTML_IMAGE_ONLY_20 1595 0.38 0.40 0.38 181 XMLngstWrd_00 1595 0.43 0.57 0.38 182 FORGED_GMAIL_RCVD 1594 0.38 0.39 0.37 183 XMSubNoVowel 1569 0.36 0.34 0.37 184 TM2_M_A_HREF_HREF 1567 0.38 0.41 0.37 185 HTML_IMAGE_ONLY_24 1543 0.45 0.68 0.36 186 FILL_THIS_FORM 1537 0.48 0.76 0.36 187 RCVD_IN_IADB_RDNS 1519 0.27 0.04 0.36 188 XMDateMe_00 1518 0.33 0.27 0.36 189 HTML_TAG_BALANCE_BODY 1514 0.50 0.88 0.36 190 RDNS_DYNAMIC 1507 0.51 0.89 0.35 191 DIET_1 1506 0.56 1.07 0.35 192 SpammyFromTLD_02 1485 0.80 1.93 0.35 193 XMEmptyBody_01 1471 0.60 1.24 0.35 194 XMBody_17 1470 0.73 1.69 0.35 195 XMPhish14 1422 0.57 1.17 0.33 196 URI_NOVOWEL 1419 0.46 0.77 0.33 197 XM_H_Trusted_IP 1415 0.24 0.00 0.33 198 XMLngstWrd_01 1397 0.39 0.55 0.33 199 XM_H_PHPOS_M 1386 0.34 0.38 0.33 200 XMHTMLBadTable_001 1383 0.41 0.62 0.33 ----------------------------------------------------------------------