Email: 331023 Autolearn: 0 AvgScore: 3.10 AvgScanTime: 1.85 sec Spam: 100601 Autolearn: 0 AvgScore: 12.42 AvgScanTime: 2.27 sec Ham: 230422 Autolearn: 0 AvgScore: -0.97 AvgScanTime: 1.67 sec Time Spent Running SA: 170.32 hours Time Spent Processing Spam: 63.33 hours Time Spent Processing Ham: 106.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95626 78.56 95.05 71.36 2 DKIM_SIGNED 89805 72.80 89.27 65.62 3 XM_DK_Pass 87826 71.73 87.30 64.93 4 DKIM_VALID 86365 70.44 85.85 63.71 5 DCC_CHECK 81799 51.64 81.31 38.68 6 XMListUnsubscribeExists 79266 55.11 78.79 44.77 7 DKIM_VALID_AU 71540 56.79 71.11 50.54 8 XM_DK_Undo_02 56025 29.80 55.69 18.50 9 XM_H_QuotedFrom 53238 38.42 52.92 32.08 10 BAYES_99 50799 27.85 50.50 17.97 11 BAYES_999 44264 24.73 44.00 16.32 12 TR_DCC_Bayes_99 40726 18.97 40.48 9.57 13 LOC_TINY_FONT_1 40309 27.86 40.07 22.52 14 HTML_FONT_LOW_CONTRAST 38643 30.29 38.41 26.74 15 MIME_HTML_ONLY 29119 22.06 28.95 19.06 16 BAYES_50 28529 50.52 28.36 60.20 17 FVGT_m_MULTI_ODD 25756 20.70 25.60 18.56 18 XMSubLong 24284 19.85 24.14 17.98 19 XM_Body_Dirty_Words 22535 14.54 22.40 11.11 20 HTML_IMAGE_RATIO_02 20837 12.08 20.71 8.31 21 T_TM2_M_HEADER_IN_MSG 17828 20.79 17.72 22.13 22 DKIM_VALID_EF 17351 20.82 17.25 22.38 23 DCC_CHECK_NEGATIVE 17237 47.02 17.13 60.06 24 XM_Multi_Part_URI 16152 13.70 16.06 12.67 25 XM_Evil_Numbers_Gen 16004 10.30 15.91 7.86 26 T_KAM_HTML_FONT_INVALID 15226 11.06 15.14 9.29 27 RELAYCOUNTRY_META 14567 6.79 14.48 3.43 28 MultiRelay 14180 12.88 14.10 12.35 29 BOTNET_IPINHOSTNAME 13197 7.91 13.12 5.63 30 BOTNET 12438 4.34 12.36 0.84 31 HTML_IMAGE_RATIO_04 11352 7.05 11.28 5.20 32 XMSexyCombo_05 11318 6.40 11.25 4.28 33 RCVD_IN_RP_SAFE 9780 12.15 9.72 13.21 34 T_XMDrugObfuBody_14 9697 7.46 9.64 6.51 35 UNTRUSTED_Relay 9540 3.60 9.48 1.03 36 LotsOfNums_01 9385 7.82 9.33 7.16 37 XM_B_Phish_Phrases 9066 6.95 9.01 6.04 38 XM_UncommonTLD01 8659 5.39 8.61 3.98 39 LOTS_OF_MONEY 8297 6.31 8.25 5.46 40 TR_XM_DocInvoice 7849 5.56 7.80 4.58 41 FROM_EXCESS_BASE64 7603 5.23 7.56 4.21 42 XM_H_Long_From01 7585 6.10 7.54 5.47 43 RCVD_IN_RP_CERTIFIED 7561 9.98 7.52 11.05 44 TooManyTo_001 7277 6.22 7.23 5.77 45 BAYES_80 7132 4.81 7.09 3.81 46 RCVD_IN_MSPIKE_H2 6896 6.69 6.85 6.62 47 FSL_BULK_SIG 6857 6.25 6.82 6.00 48 XMStrtUSub 6549 5.12 6.51 4.52 49 XMSubMetaSx_00 6492 4.32 6.45 3.39 50 MPART_ALT_DIFF 6405 3.92 6.37 2.85 51 BAYES_60 5555 5.88 5.52 6.03 52 MIME_HTML_MOSTLY 4851 4.19 4.82 3.91 53 BAYES_95 4597 3.18 4.57 2.57 54 XMNumbers 4511 4.52 4.48 4.54 55 HTML_IMAGE_RATIO_06 4383 3.02 4.36 2.43 56 RCVD_IN_BL_SPAMCOP_NET 4305 1.59 4.28 0.42 57 XM_SendGrid 4209 4.28 4.18 4.32 58 XM_CamelCaseFrm001 4139 2.58 4.11 1.92 59 T_TooManySym_01 4114 5.06 4.09 5.48 60 MIME_QP_LONG_LINE 4030 3.60 4.01 3.43 61 XM_UB50 3895 1.59 3.87 0.60 62 XM_DIRTYINTL 3672 1.94 3.65 1.19 63 DKIM_INVALID 3440 2.37 3.42 1.91 64 TM2_M_URI_OPT_OUT 3294 1.88 3.27 1.27 65 MIME_HTML_ONLY_MULTI 3070 1.63 3.05 1.00 66 XM_SPF_SoftFail 3056 1.63 3.04 1.02 67 URI_HEX 3054 1.76 3.04 1.20 68 RCVD_IN_RP_RNBL 2906 0.89 2.89 0.02 69 XMBdyGiftCard01 2893 2.02 2.88 1.65 70 BOTNET_NORDNS 2641 0.81 2.63 0.01 71 HTML_IMAGE_RATIO_08 2630 2.01 2.61 1.75 72 RELAYCOUNTRY_CA 2548 1.60 2.53 1.19 73 SUBJ_ALL_CAPS 2431 1.61 2.42 1.26 74 XM_ProductURIs 2394 1.58 2.38 1.23 75 BODY_ENHANCEMENT 2387 0.75 2.37 0.04 76 XM_OfRef6 2351 1.37 2.34 0.95 77 T_REMOTE_IMAGE 2308 2.73 2.29 2.92 78 XM_URI_RBL 2291 0.79 2.28 0.14 79 RELAYCOUNTRY_CN 2284 0.71 2.27 0.03 80 XM_S_JOY_D 2247 1.22 2.23 0.78 81 T_MIXED_ES 2224 1.51 2.21 1.21 82 MultiRelay_CC 2198 0.76 2.18 0.13 83 MultiRelay_Combo 2198 0.76 2.18 0.13 84 SpammyFromTLD_01 2191 0.96 2.18 0.43 85 XMDiploma_00 2155 1.44 2.14 1.13 86 XM_UB99 2099 0.64 2.09 0.01 87 HTML_MIME_NO_HTML_TAG 1992 1.65 1.98 1.51 88 XM_B_REG_HTML 1953 1.28 1.94 0.99 89 XM_XX_Yahoo 1925 0.69 1.91 0.15 90 XMBody_78 1906 1.27 1.89 0.99 91 T_XMDrugObfuBody_08 1887 1.15 1.88 0.83 92 XMPhish30 1873 0.96 1.86 0.56 93 URIBL_BLACK 1871 0.60 1.86 0.04 94 PLING_QUERY 1863 1.08 1.85 0.74 95 XMSubMetaI_00 1849 0.84 1.84 0.40 96 RCVD_IN_IADB_LISTED 1834 2.88 1.82 3.34 97 XM_DK_Undo_01 1727 1.55 1.72 1.48 98 XM_H_Long_From02 1674 1.08 1.66 0.82 99 RCVD_IN_IADB_SPF 1621 2.52 1.61 2.91 100 RELAYCOUNTRY_FR 1617 0.67 1.61 0.25 101 TM2_M_VERY_LONG_WORD 1615 1.05 1.61 0.81 102 T_TooManySym_02 1608 1.93 1.60 2.07 103 URIBL_DBL_SPAM 1562 0.49 1.55 0.02 104 RCVD_IN_IADB_SENDERID 1553 2.28 1.54 2.60 105 T_XMDrugObfuBody_00 1551 0.83 1.54 0.52 106 RCVD_IN_IADB_DK 1540 2.22 1.53 2.52 107 RDNS_DYNAMIC 1502 0.80 1.49 0.50 108 T_XMHurry_00 1485 1.01 1.48 0.81 109 XM_UB999 1477 0.45 1.47 0.01 110 ALL_TRUSTED 1451 21.01 1.44 29.55 111 SpammyFromTLD_02 1437 0.54 1.43 0.15 112 XMSexyCombo_01 1434 0.71 1.43 0.40 113 XM_H_PHPOS 1395 1.09 1.39 0.96 114 DIET_1 1333 0.66 1.33 0.37 115 TR_XM_RelayPhish 1330 0.63 1.32 0.33 116 RELAYCOUNTRY_AT 1325 0.49 1.32 0.13 117 XM_HighProb1 1306 0.42 1.30 0.03 118 XMBody_17 1300 0.65 1.29 0.37 119 MISSING_HEADERS 1274 0.57 1.27 0.26 120 MAILING_LIST_MULTI 1262 1.57 1.25 1.71 121 BAYES_40 1255 1.87 1.25 2.14 122 UNPARSEABLE_RELAY 1236 3.90 1.23 5.06 123 XMStockSpam_06 1207 1.48 1.20 1.61 124 NORMAL_HTTP_TO_IP 1197 0.40 1.19 0.05 125 XM_RXBody 1164 0.48 1.16 0.18 126 XM_B_COPY_HTML 1141 0.94 1.13 0.85 127 BAYES_20 1106 1.34 1.10 1.44 128 T_Symld_Words_02 1103 0.46 1.10 0.18 129 XMGenDplmaNmb 1068 0.85 1.06 0.75 130 TR_Mismatch_TLD_02 1063 0.35 1.06 0.05 131 BAYES_00 1061 3.76 1.05 4.94 132 TR_LOTS_OF_MONEY2 1050 0.51 1.04 0.27 133 T_MONEY_PERCENT 1050 0.51 1.04 0.27 134 TR_Symld_Words 1049 3.11 1.04 4.01 135 XM_H_PHPMailer 1037 1.51 1.03 1.71 136 XMPhish14 1036 0.43 1.03 0.17 137 XMClaimOffer 1021 0.37 1.01 0.08 138 RELAYCOUNTRY_GB 1019 0.65 1.01 0.49 139 XM_UB60 1011 0.35 1.00 0.06 140 FSL_THIS_IS_ADV 1008 0.34 1.00 0.05 141 WEIRD_PORT 989 0.38 0.98 0.11 142 SUBJ_DOLLARS 986 0.42 0.98 0.18 143 HTML_TAG_BALANCE_BODY 945 0.96 0.94 0.97 144 HTML_FONT_SIZE_HUGE 925 0.39 0.92 0.17 145 XMHTMLBadTable_001 903 0.63 0.90 0.52 146 XM_UB80 891 0.28 0.89 0.02 147 TooManyTo_002 887 1.11 0.88 1.20 148 TR_LOTS_OF_MONEY1 881 0.27 0.88 0.00 149 URI_TRY_3LD 880 1.13 0.87 1.24 150 RCVD_IN_IADB_VOUCHED 880 2.36 0.87 3.01 151 TR_XM_DK_Bayes 873 3.19 0.87 4.21 152 TR_XM_DK_Bayes1 868 3.12 0.86 4.10 153 REMOVE_BEFORE_LINK 855 0.47 0.85 0.30 154 TR_XM_DK_Bayes2 842 2.80 0.84 3.66 155 LONG_JUNK_URI 833 0.31 0.83 0.08 156 TooManyTo_003 800 0.80 0.80 0.80 157 REPLYTO_WITHOUT_TO_CC 799 0.26 0.79 0.02 158 XM_Body_Obfu01 790 0.31 0.79 0.10 159 MPART_ALT_DIFF_COUNT 774 0.40 0.77 0.24 160 DKIM_ADSP_CUSTOM_MED 772 0.80 0.77 0.82 161 URI_NOVOWEL 764 0.44 0.76 0.30 162 HTML_FONT_FACE_BAD 751 0.57 0.75 0.49 163 RCVD_IN_MSPIKE_WL 742 1.28 0.74 1.51 164 RCVD_IN_MSPIKE_H3 742 1.28 0.74 1.51 165 XMSexyCombo_04 739 0.28 0.73 0.08 166 XMHTML_After_End 736 0.35 0.73 0.19 167 XMSubMetaSSx_00 733 0.34 0.73 0.17 168 RELAYCOUNTRY_DE 731 0.41 0.73 0.27 169 XM_H_PHPOS_M 722 0.52 0.72 0.43 170 XM_BadFromFormat 711 0.39 0.71 0.25 171 LONG_JUNK_URI3 711 0.31 0.71 0.13 172 TR_MetaPhish_Combo_01 706 0.54 0.70 0.46 173 T_HTML_TAG_BALANCE_CENTER 693 0.32 0.69 0.15 174 XMSlimDrugH 692 0.46 0.69 0.36 175 TooManyTo_004 688 0.60 0.68 0.56 176 TR_Sbj_FN_Bdy 676 0.29 0.67 0.13 177 DKIM_ADSP_NXDOMAIN 661 0.46 0.66 0.37 178 RCVD_IN_PSBL 655 0.25 0.65 0.08 179 XMBrknScrpt_02 650 0.83 0.65 0.90 180 XMPhish11 645 0.72 0.64 0.76 181 HTML_SHORT_LINK_IMG_1 642 0.21 0.64 0.03 182 FORGED_GMAIL_RCVD 631 0.45 0.63 0.37 183 DATE_IN_PAST_03_06 628 0.25 0.62 0.09 184 XMMoneyMeta_00 627 0.32 0.62 0.19 185 XM_UB95 624 0.20 0.62 0.02 186 FILL_THIS_FORM 616 0.31 0.61 0.18 187 TR_LOTS_OF_MONEY3 610 0.36 0.61 0.25 188 SUBJ_ILLEGAL_CHARS 607 0.20 0.60 0.03 189 MONEY_ATM_CARD 597 0.18 0.59 0.00 190 NML_ADSP_CUSTOM_MED 593 0.56 0.59 0.55 191 XM_GoogleGroups 575 0.97 0.57 1.14 192 XM_PDF 570 1.31 0.57 1.64 193 BAYES_05 566 0.80 0.56 0.91 194 RELAYCOUNTRY_BR 564 0.19 0.56 0.03 195 MONEY_BACK 564 0.20 0.56 0.04 196 ADVANCE_FEE_5_NEW_MONEY 558 0.17 0.55 0.00 197 BOUNCE_MESSAGE 555 11.59 0.55 16.40 198 ANY_BOUNCE_MESSAGE 555 11.59 0.55 16.40 199 BASE64_LENGTH_79_INF 553 0.26 0.55 0.13 200 TM2_M_BODY_EMPTY 545 0.37 0.54 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164419 78.56 95.05 71.36 2 DKIM_SIGNED 151193 72.80 89.27 65.62 3 XM_DK_Pass 149618 71.73 87.30 64.93 4 DKIM_VALID 146801 70.44 85.85 63.71 5 BAYES_50 138711 50.52 28.36 60.20 6 DCC_CHECK_NEGATIVE 138396 47.02 17.13 60.06 7 DKIM_VALID_AU 116447 56.79 71.11 50.54 8 XMListUnsubscribeExists 103154 55.11 78.79 44.77 9 DCC_CHECK 89137 51.64 81.31 38.68 10 XM_H_QuotedFrom 73925 38.42 52.92 32.08 11 ALL_TRUSTED 68097 21.01 1.44 29.55 12 HTML_FONT_LOW_CONTRAST 61610 30.29 38.41 26.74 13 LOC_TINY_FONT_1 51899 27.86 40.07 22.52 14 DKIM_VALID_EF 51558 20.82 17.25 22.38 15 T_TM2_M_HEADER_IN_MSG 50981 20.79 17.72 22.13 16 MIME_HTML_ONLY 43921 22.06 28.95 19.06 17 FVGT_m_MULTI_ODD 42758 20.70 25.60 18.56 18 XM_DK_Undo_02 42618 29.80 55.69 18.50 19 XMSubLong 41431 19.85 24.14 17.98 20 BAYES_99 41401 27.85 50.50 17.97 21 ANY_BOUNCE_MESSAGE 37800 11.59 0.55 16.40 22 BOUNCE_MESSAGE 37799 11.59 0.55 16.40 23 BAYES_999 37614 24.73 44.00 16.32 24 XM_DKIMWhitelistDomains 33826 10.27 0.17 14.68 25 RCVD_IN_RP_SAFE 30440 12.15 9.72 13.21 26 XM_Multi_Part_URI 29190 13.70 16.06 12.67 27 MultiRelay 28448 12.88 14.10 12.35 28 XM_Body_Dirty_Words 25611 14.54 22.40 11.11 29 RCVD_IN_RP_CERTIFIED 25466 9.98 7.52 11.05 30 TR_DCC_Bayes_99 22057 18.97 40.48 9.57 31 T_KAM_HTML_FONT_INVALID 21399 11.06 15.14 9.29 32 HTML_IMAGE_RATIO_02 19138 12.08 20.71 8.31 33 XM_Evil_Numbers_Gen 18102 10.30 15.91 7.86 34 LotsOfNums_01 16492 7.82 9.33 7.16 35 RCVD_IN_MSPIKE_H2 15253 6.69 6.85 6.62 36 T_XMDrugObfuBody_14 14991 7.46 9.64 6.51 37 XM_B_Phish_Phrases 13925 6.95 9.01 6.04 38 BAYES_60 13903 5.88 5.52 6.03 39 FSL_BULK_SIG 13834 6.25 6.82 6.00 40 TooManyTo_001 13298 6.22 7.23 5.77 41 BOTNET_IPINHOSTNAME 12982 7.91 13.12 5.63 42 T_TooManySym_01 12620 5.06 4.09 5.48 43 XM_H_Long_From01 12614 6.10 7.54 5.47 44 LOTS_OF_MONEY 12592 6.31 8.25 5.46 45 HTML_IMAGE_RATIO_04 11991 7.05 11.28 5.20 46 UNPARSEABLE_RELAY 11660 3.90 1.23 5.06 47 BAYES_00 11373 3.76 1.05 4.94 48 IN_ZIMBRA_NJ_WHITELIST 11012 3.33 0.02 4.78 49 TR_XM_DocInvoice 10559 5.56 7.80 4.58 50 XMNumbers 10467 4.52 4.48 4.54 51 XMStrtUSub 10414 5.12 6.51 4.52 52 XM_SendGrid 9961 4.28 4.18 4.32 53 XMSexyCombo_05 9865 6.40 11.25 4.28 54 FROM_EXCESS_BASE64 9700 5.23 7.56 4.21 55 TR_XM_DK_Bayes 9695 3.19 0.87 4.21 56 TR_XM_DK_Bayes1 9455 3.12 0.86 4.10 57 TR_Symld_Words 9234 3.11 1.04 4.01 58 XM_UncommonTLD01 9182 5.39 8.61 3.98 59 MIME_HTML_MOSTLY 9008 4.19 4.82 3.91 60 BAYES_80 8777 4.81 7.09 3.81 61 TR_XM_DK_Bayes2 8438 2.80 0.84 3.66 62 RELAYCOUNTRY_META 7898 6.79 14.48 3.43 63 MIME_QP_LONG_LINE 7893 3.60 4.01 3.43 64 XMSubMetaSx_00 7819 4.32 6.45 3.39 65 RCVD_IN_IADB_LISTED 7692 2.88 1.82 3.34 66 TVD_RCVD_IP 7257 2.30 0.35 3.15 67 RCVD_IN_IADB_VOUCHED 6928 2.36 0.87 3.01 68 T_REMOTE_IMAGE 6734 2.73 2.29 2.92 69 RCVD_IN_IADB_SPF 6712 2.52 1.61 2.91 70 INVALID_MSGID 6635 2.07 0.23 2.88 71 MPART_ALT_DIFF 6557 3.92 6.37 2.85 72 TO_MALFORMED 6355 1.93 0.02 2.76 73 RCVD_IN_IADB_SENDERID 5991 2.28 1.54 2.60 74 BAYES_95 5923 3.18 4.57 2.57 75 RCVD_IN_IADB_DK 5811 2.22 1.53 2.52 76 HTML_IMAGE_RATIO_06 5607 3.02 4.36 2.43 77 IN_HORDE_ADDRESS_BOOK 5292 1.62 0.07 2.30 78 BAYES_40 4922 1.87 1.25 2.14 79 T_TooManySym_02 4768 1.93 1.60 2.07 80 XM_CamelCaseFrm001 4416 2.58 4.11 1.92 81 DKIM_INVALID 4392 2.37 3.42 1.91 82 USER_IN_DEF_DKIM_WL 4203 1.34 0.22 1.82 83 HTML_IMAGE_RATIO_08 4021 2.01 2.61 1.75 84 MAILING_LIST_MULTI 3948 1.57 1.25 1.71 85 XM_H_PHPMailer 3948 1.51 1.03 1.71 86 XMBdyGiftCard01 3796 2.02 2.88 1.65 87 XM_PDF 3772 1.31 0.57 1.64 88 XMStockSpam_06 3704 1.48 1.20 1.61 89 RCVD_IN_MSPIKE_WL 3489 1.28 0.74 1.51 90 RCVD_IN_MSPIKE_H3 3483 1.28 0.74 1.51 91 HTML_MIME_NO_HTML_TAG 3473 1.65 1.98 1.51 92 XM_DK_Undo_01 3419 1.55 1.72 1.48 93 BAYES_20 3314 1.34 1.10 1.44 94 TM2_M_URI_OPT_OUT 2933 1.88 3.27 1.27 95 SUBJ_ALL_CAPS 2911 1.61 2.42 1.26 96 URI_TRY_3LD 2868 1.13 0.87 1.24 97 XM_ProductURIs 2845 1.58 2.38 1.23 98 T_MIXED_ES 2788 1.51 2.21 1.21 99 URI_HEX 2776 1.76 3.04 1.20 100 TooManyTo_002 2771 1.11 0.88 1.20 101 XM_DIRTYINTL 2753 1.94 3.65 1.19 102 RELAYCOUNTRY_CA 2733 1.60 2.53 1.19 103 T_TooManySym_03 2678 0.86 0.17 1.16 104 XM_GoogleGroups 2625 0.97 0.57 1.14 105 XMDiploma_00 2612 1.44 2.14 1.13 106 USER_IN_WHITELIST 2573 0.78 0.00 1.12 107 UNTRUSTED_Relay 2368 3.60 9.48 1.03 108 XMBody_95 2357 0.75 0.13 1.02 109 XM_SPF_SoftFail 2352 1.63 3.04 1.02 110 RCVD_IN_IADB_OPTIN 2329 0.81 0.37 1.01 111 MIME_HTML_ONLY_MULTI 2314 1.63 3.05 1.00 112 XMBody_78 2289 1.27 1.89 0.99 113 XM_B_REG_HTML 2286 1.28 1.94 0.99 114 HTML_TAG_BALANCE_BODY 2243 0.96 0.94 0.97 115 XMSubMetaSxObfu_02 2214 0.76 0.29 0.96 116 XM_H_PHPOS 2205 1.09 1.39 0.96 117 XM_OfRef6 2190 1.37 2.34 0.95 118 BAYES_05 2098 0.80 0.56 0.91 119 XMBrknScrpt_02 2085 0.83 0.65 0.90 120 XM_B_COPY_HTML 1970 0.94 1.13 0.85 121 BOTNET 1925 4.34 12.36 0.84 122 T_XMDrugObfuBody_08 1917 1.15 1.88 0.83 123 XM_H_Long_From02 1890 1.08 1.66 0.82 124 DKIM_ADSP_CUSTOM_MED 1879 0.80 0.77 0.82 125 T_XMHurry_00 1870 1.01 1.48 0.81 126 TM2_M_VERY_LONG_WORD 1860 1.05 1.61 0.81 127 SUBJ_BUY 1851 0.61 0.15 0.80 128 TooManyTo_003 1832 0.80 0.80 0.80 129 XMSubMetaD_03 1808 0.60 0.17 0.78 130 XM_S_JOY_D 1801 1.22 2.23 0.78 131 XMPhish11 1748 0.72 0.64 0.76 132 XMGenDplmaNmb 1732 0.85 1.06 0.75 133 PLING_QUERY 1711 1.08 1.85 0.74 134 T_TooManySym_04 1465 0.45 0.01 0.64 135 THIS_AD 1392 0.50 0.26 0.60 136 XM_UB50 1379 1.59 3.87 0.60 137 TooManyTo_004 1299 0.60 0.68 0.56 138 XMPhish30 1293 0.96 1.86 0.56 139 NML_ADSP_CUSTOM_MED 1270 0.56 0.59 0.55 140 T_XMDrugObfuBody_00 1209 0.83 1.54 0.52 141 HELO_NODOT 1205 0.40 0.13 0.52 142 XMHTMLBadTable_001 1195 0.63 0.90 0.52 143 RDNS_DYNAMIC 1161 0.80 1.49 0.50 144 RELAYCOUNTRY_GB 1132 0.65 1.01 0.49 145 HTML_FONT_FACE_BAD 1125 0.57 0.75 0.49 146 XMNoVowels 1102 0.40 0.21 0.48 147 TooManyTo_005 1101 0.45 0.37 0.48 148 TR_MetaPhish_Combo_01 1071 0.54 0.70 0.46 149 TM2_M_A_HREF_HREF 1061 0.47 0.50 0.46 150 XM_ShortIntro_01 1058 0.46 0.45 0.46 151 XM_H_PHPOS_M 985 0.52 0.72 0.43 152 SpammyFromTLD_01 982 0.96 2.18 0.43 153 RCVD_IN_BL_SPAMCOP_NET 970 1.59 4.28 0.42 154 RCVD_IN_IADB_DOPTIN 941 0.30 0.07 0.41 155 XMSubMetaI_00 922 0.84 1.84 0.40 156 XMLngstWrd_00 917 0.39 0.36 0.40 157 XMSexyCombo_01 916 0.71 1.43 0.40 158 XM_D_tchamptons_WL 894 0.27 0.00 0.39 159 NO_DNS_FOR_FROM 870 0.39 0.42 0.38 160 DKIM_ADSP_NXDOMAIN 863 0.46 0.66 0.37 161 FORGED_GMAIL_RCVD 861 0.45 0.63 0.37 162 DIET_1 860 0.66 1.33 0.37 163 XMBody_17 854 0.65 1.29 0.37 164 XMLngstWrd_01 836 0.36 0.34 0.36 165 XMSlimDrugH 829 0.46 0.69 0.36 166 XM_B_TRADE_HTML 793 0.37 0.44 0.34 167 HTML_IMAGE_ONLY_32 792 0.30 0.18 0.34 168 XMRcvdHeader_15 766 0.23 0.00 0.33 169 TR_XM_RelayPhish 751 0.63 1.32 0.33 170 HTML_IMAGE_ONLY_20 722 0.30 0.26 0.31 171 XMCapTrack 701 0.34 0.43 0.30 172 REMOVE_BEFORE_LINK 700 0.47 0.85 0.30 173 URI_NOVOWEL 698 0.44 0.76 0.30 174 XMLngstWrd_02 690 0.29 0.26 0.30 175 RELAYCOUNTRY_AU 685 0.31 0.35 0.30 176 TM2_M_BODY_EMPTY 673 0.37 0.54 0.29 177 XMSUPPORT 665 0.20 0.00 0.29 178 XM_H_SpoofStaff4 651 0.20 0.02 0.28 179 TR_MetaPhish_Combo_01b 635 0.26 0.24 0.28 180 RELAYCOUNTRY_DE 623 0.41 0.73 0.27 181 TR_LOTS_OF_MONEY2 623 0.51 1.04 0.27 182 T_MONEY_PERCENT 623 0.51 1.04 0.27 183 XMLngstWrd_03 615 0.25 0.21 0.27 184 MISSING_HEADERS 601 0.57 1.27 0.26 185 MSGID_FROM_MTA_HEADER 600 0.24 0.19 0.26 186 XMGappySubj_01 592 0.26 0.27 0.26 187 T_FILL_THIS_FORM_SHORT 591 0.33 0.51 0.26 188 MY_SERVERS_FOUND 591 0.24 0.19 0.26 189 TVD_SPACE_RATIO 588 0.26 0.27 0.26 190 RELAYCOUNTRY_FR 587 0.67 1.61 0.25 191 TR_LOTS_OF_MONEY3 582 0.36 0.61 0.25 192 XM_BadFromFormat 581 0.39 0.71 0.25 193 XMSubGiftCard1 579 0.24 0.20 0.25 194 XM_Walgreens_Forge 562 0.21 0.14 0.24 195 XMLngstWrd_04 561 0.21 0.14 0.24 196 XMSolicitRefs_0 551 0.24 0.24 0.24 197 MPART_ALT_DIFF_COUNT 550 0.40 0.77 0.24 198 HTML_FONT_SIZE_LARGE 549 0.20 0.13 0.24 199 URI_TRUNCATED 546 0.17 0.03 0.24 200 HTML_IMAGE_ONLY_28 535 0.31 0.50 0.23 ----------------------------------------------------------------------