Email: 356591 Autolearn: 0 AvgScore: 3.32 AvgScanTime: 2.07 sec Spam: 109285 Autolearn: 0 AvgScore: 12.76 AvgScanTime: 2.38 sec Ham: 247306 Autolearn: 0 AvgScore: -0.85 AvgScanTime: 1.94 sec Time Spent Running SA: 205.20 hours Time Spent Processing Spam: 72.14 hours Time Spent Processing Ham: 133.07 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 105708 78.53 96.73 70.48 2 DKIM_SIGNED 93141 70.97 85.23 64.67 3 XM_DK_Pass 90709 69.65 83.00 63.74 4 DKIM_VALID 89930 68.50 82.29 62.40 5 DCC_CHECK 89592 51.32 81.98 37.77 6 XMListUnsubscribeExists 85636 54.75 78.36 44.32 7 DKIM_VALID_AU 72549 54.07 66.39 48.63 8 XM_DK_Undo_02 60019 28.82 54.92 17.29 9 BAYES_99 55065 27.09 50.39 16.80 10 XM_H_QuotedFrom 52282 35.61 47.84 30.21 11 BAYES_999 48578 23.99 44.45 14.95 12 TR_DCC_Bayes_99 44798 18.28 40.99 8.25 13 HTML_FONT_LOW_CONTRAST 41835 28.89 38.28 24.74 14 LOC_TINY_FONT_1 38016 25.47 34.79 21.35 15 BAYES_50 32401 50.16 29.65 59.22 16 FVGT_m_MULTI_ODD 30464 21.41 27.88 18.56 17 MIME_HTML_ONLY 30353 20.67 27.77 17.52 18 XMSubLong 29172 20.43 26.69 17.66 19 XM_Body_Dirty_Words 22266 12.88 20.37 9.57 20 HTML_IMAGE_RATIO_02 20848 11.45 19.08 8.08 21 BOTNET_IPINHOSTNAME 19676 9.35 18.00 5.52 22 DKIM_VALID_EF 19606 20.64 17.94 21.84 23 T_TM2_M_HEADER_IN_MSG 18450 22.02 16.88 24.28 24 RELAYCOUNTRY_META 18266 7.89 16.71 3.98 25 XM_Multi_Part_URI 18098 12.55 16.56 10.77 26 DCC_CHECK_NEGATIVE 17872 47.12 16.35 60.71 27 BOTNET 17075 5.50 15.62 1.02 28 T_KAM_HTML_FONT_INVALID 16534 11.49 15.13 9.88 29 XM_Evil_Numbers_Gen 14589 9.13 13.35 7.26 30 MultiRelay 14219 12.99 13.01 12.98 31 HTML_IMAGE_RATIO_04 13813 6.68 12.64 4.05 32 XM_UncommonTLD01 12377 6.22 11.33 3.96 33 UNTRUSTED_Relay 11968 4.19 10.95 1.21 34 LotsOfNums_01 10734 8.52 9.82 7.94 35 RCVD_IN_RP_SAFE 10371 11.42 9.49 12.27 36 XMSexyCombo_05 10273 5.29 9.40 3.47 37 XM_B_Phish_Phrases 9686 6.13 8.86 4.92 38 T_XMDrugObfuBody_14 9236 6.58 8.45 5.75 39 TooManyTo_001 8136 6.23 7.44 5.70 40 FROM_EXCESS_BASE64 7949 4.83 7.27 3.74 41 XM_H_Long_From01 7882 5.57 7.21 4.84 42 FSL_BULK_SIG 7790 6.84 7.13 6.72 43 RCVD_IN_RP_CERTIFIED 7770 9.64 7.11 10.75 44 LOTS_OF_MONEY 7685 5.12 7.03 4.27 45 MPART_ALT_DIFF 7437 3.99 6.81 2.74 46 BAYES_80 7054 4.93 6.45 4.26 47 URIBL_RHS_DOB 6687 2.95 6.12 1.55 48 TR_XM_DocInvoice 6558 4.18 6.00 3.38 49 RCVD_IN_BL_SPAMCOP_NET 6542 2.08 5.99 0.35 50 RCVD_IN_RP_RNBL 5941 1.71 5.44 0.06 51 RCVD_IN_MSPIKE_H2 5929 6.15 5.43 6.48 52 BAYES_60 5887 6.23 5.39 6.60 53 XMSubMetaSx_00 5830 3.68 5.33 2.94 54 MIME_HTML_MOSTLY 5409 3.58 4.95 2.97 55 XM_UB50 5023 1.92 4.60 0.73 56 MIME_QP_LONG_LINE 4441 4.03 4.06 4.02 57 BAYES_95 4371 3.08 4.00 2.68 58 T_TooManySym_01 4275 4.44 3.91 4.68 59 XMNumbers 4260 3.98 3.90 4.02 60 XM_DIRTYINTL 4117 2.02 3.77 1.24 61 TM2_M_URI_OPT_OUT 3951 2.09 3.62 1.41 62 XMStrtUSub 3883 3.66 3.55 3.71 63 HTML_IMAGE_RATIO_08 3779 2.25 3.46 1.71 64 XM_SendGrid 3703 4.04 3.39 4.33 65 HTML_IMAGE_RATIO_06 3664 2.64 3.35 2.33 66 XM_CamelCaseFrm001 3612 2.03 3.31 1.47 67 RELAYCOUNTRY_CA 3481 1.83 3.19 1.23 68 XMBdyGiftCard01 3385 1.77 3.10 1.18 69 XMSubMetaI_00 3371 1.31 3.08 0.52 70 T_REMOTE_IMAGE 3341 2.74 3.06 2.60 71 HTML_MIME_NO_HTML_TAG 3304 2.33 3.02 2.02 72 PLING_QUERY 3285 1.40 3.01 0.69 73 MIME_HTML_ONLY_MULTI 3264 1.63 2.99 1.04 74 URI_HEX 3231 1.68 2.96 1.11 75 DKIM_INVALID 3211 2.47 2.94 2.26 76 RELAYCOUNTRY_FR 3189 1.10 2.92 0.30 77 XM_H_Long_From02 3026 1.45 2.77 0.87 78 SpammyFromTLD_01 2951 1.15 2.70 0.46 79 XM_SPF_SoftFail 2937 1.75 2.69 1.34 80 XM_UB99 2913 0.82 2.67 0.01 81 URIBL_BLACK 2733 0.80 2.50 0.04 82 MultiRelay_Combo 2453 0.85 2.24 0.24 83 MultiRelay_CC 2453 0.85 2.24 0.24 84 XM_URI_RBL 2408 0.77 2.20 0.13 85 BODY_ENHANCEMENT 2375 0.69 2.17 0.03 86 SUBJ_ALL_CAPS 2357 1.33 2.16 0.96 87 XM_UB999 2316 0.66 2.12 0.01 88 XM_XX_Yahoo 2299 0.69 2.10 0.06 89 TM2_M_VERY_LONG_WORD 2258 1.13 2.07 0.71 90 MAILING_LIST_MULTI 2252 1.67 2.06 1.50 91 URIBL_DBL_SPAM 2228 0.63 2.04 0.01 92 T_MIXED_ES 2210 1.43 2.02 1.17 93 TR_XM_RelayPhish 2088 0.88 1.91 0.43 94 XMBody_78 1896 0.94 1.73 0.59 95 XM_H_PHPOS 1887 1.24 1.73 1.02 96 RCVD_IN_IADB_LISTED 1872 2.91 1.71 3.44 97 XMPhish30 1865 0.84 1.71 0.46 98 T_XMDrugObfuBody_08 1827 1.27 1.67 1.09 99 BOTNET_NORDNS 1822 0.52 1.67 0.01 100 XM_ProductURIs 1803 1.28 1.65 1.11 101 XMStockSpam_06 1756 1.44 1.61 1.37 102 XM_OfRef6 1725 1.06 1.58 0.83 103 T_TooManySym_02 1717 1.72 1.57 1.79 104 XM_BadFromFormat 1690 0.67 1.55 0.28 105 RCVD_IN_IADB_SPF 1658 2.60 1.52 3.08 106 XM_B_REG_HTML 1641 1.09 1.50 0.91 107 XMBody_17 1615 0.74 1.48 0.41 108 RCVD_IN_IADB_SENDERID 1590 2.39 1.45 2.80 109 BAYES_00 1577 4.31 1.44 5.57 110 RCVD_IN_IADB_DK 1573 2.34 1.44 2.73 111 RELAYCOUNTRY_AT 1556 0.51 1.42 0.11 112 XM_S_JOY_D 1533 0.81 1.40 0.55 113 UNPARSEABLE_RELAY 1500 3.81 1.37 4.89 114 T_XMHurry_00 1491 0.71 1.36 0.42 115 XM_DK_Undo_01 1477 1.46 1.35 1.51 116 XMDiploma_00 1465 1.07 1.34 0.95 117 XMSexyCombo_01 1443 0.61 1.32 0.29 118 XMPhish14 1436 0.59 1.31 0.27 119 DIET_1 1398 0.55 1.28 0.23 120 REMOVE_BEFORE_LINK 1397 0.68 1.28 0.41 121 RELAYCOUNTRY_CN 1375 0.44 1.26 0.08 122 XM_HighProb1 1369 0.40 1.25 0.03 123 ALL_TRUSTED 1363 20.58 1.25 29.13 124 LONG_JUNK_URI 1345 0.44 1.23 0.10 125 MPART_ALT_DIFF_COUNT 1336 0.55 1.22 0.25 126 T_XMDrugObfuBody_00 1331 0.56 1.22 0.27 127 XM_B_COPY_HTML 1324 0.91 1.21 0.78 128 TR_XM_DK_Bayes 1322 3.36 1.21 4.31 129 TR_XM_DK_Bayes1 1313 3.26 1.20 4.17 130 HTML_SHORT_LINK_IMG_1 1292 0.38 1.18 0.03 131 TR_XM_DK_Bayes2 1290 2.94 1.18 3.72 132 XM_UB60 1285 0.40 1.18 0.06 133 TR_Caps_n_Bayes_99 1246 0.42 1.14 0.11 134 SpammyFromTLD_02 1231 0.46 1.13 0.16 135 BAYES_40 1186 1.95 1.09 2.33 136 XMSubMetaI_01 1149 0.34 1.05 0.02 137 RDNS_DYNAMIC 1139 0.61 1.04 0.42 138 HTML_FONT_SIZE_HUGE 1121 0.47 1.03 0.22 139 RCVD_IN_IADB_VOUCHED 1110 2.19 1.02 2.71 140 BODY_URI_ONLY 1102 0.33 1.01 0.02 141 XMSubMetaSSx_00 1076 0.45 0.98 0.22 142 BAYES_20 1072 1.40 0.98 1.58 143 MIME_HEADER_CTYPE_ONLY 1033 0.41 0.95 0.17 144 TR_Mismatch_TLD_02 992 0.30 0.91 0.03 145 ANY_BOUNCE_MESSAGE 987 11.11 0.90 15.63 146 BOUNCE_MESSAGE 987 11.11 0.90 15.63 147 T_Symld_Words_02 987 0.42 0.90 0.20 148 RELAYCOUNTRY_GB 958 0.73 0.88 0.66 149 XM_H_PHPMailer 951 0.77 0.87 0.72 150 XMSubMetaD_03 950 0.31 0.87 0.06 151 HTML_FONT_FACE_BAD 942 0.52 0.86 0.37 152 LONG_JUNK_URI3 932 0.36 0.85 0.14 153 XM_RXBody 932 0.39 0.85 0.19 154 TooManyTo_002 927 1.44 0.85 1.70 155 XMHTMLBadTable_001 918 0.50 0.84 0.35 156 XMBrknScrpt_02 891 0.69 0.82 0.63 157 XM_UB80 883 0.26 0.81 0.02 158 TR_LOTS_OF_MONEY2 876 0.46 0.80 0.31 159 T_MONEY_PERCENT 876 0.46 0.80 0.31 160 TR_Symld_Words 862 2.87 0.79 3.78 161 XMHTML_After_End 861 0.41 0.79 0.24 162 XMGenDplmaNmb 850 0.59 0.78 0.51 163 FILL_THIS_FORM 848 0.39 0.78 0.21 164 TooManyTo_003 844 1.03 0.77 1.15 165 HTML_IMAGE_ONLY_04 837 0.27 0.77 0.06 166 XM_Body_Obfu01 813 0.39 0.74 0.24 167 RELAYCOUNTRY_IT 799 0.24 0.73 0.03 168 XMMoneyMeta_00 792 0.40 0.72 0.25 169 DATE_IN_PAST_03_06 782 0.29 0.72 0.10 170 RCVD_IN_MSPIKE_WL 778 1.26 0.71 1.50 171 RCVD_IN_MSPIKE_H3 778 1.26 0.71 1.50 172 RELAYCOUNTRY_DE 777 0.43 0.71 0.30 173 DKIM_ADSP_CUSTOM_MED 776 0.79 0.71 0.82 174 TR_MetaPhish_Combo_01 771 0.58 0.71 0.52 175 T_HTML_TAG_BALANCE_CENTER 747 0.34 0.68 0.19 176 RCVD_IN_PSBL 744 0.34 0.68 0.19 177 SUBJ_DOLLARS 736 0.27 0.67 0.09 178 URI_TRY_3LD 732 0.64 0.67 0.62 179 TooManyTo_004 715 0.84 0.65 0.92 180 XM_H_PHPOS_M 713 0.55 0.65 0.50 181 XMPhish11 700 0.81 0.64 0.88 182 XMClaimOffer 699 0.48 0.64 0.41 183 T_TooManySym_03 674 0.78 0.62 0.85 184 BAYES_05 672 0.86 0.61 0.96 185 RELAYCOUNTRY_RU 671 0.20 0.61 0.02 186 XMSubNoVowel 667 0.39 0.61 0.30 187 BASE64_LENGTH_79_INF 667 0.28 0.61 0.13 188 FSL_THIS_IS_ADV 651 0.24 0.60 0.08 189 NO_DNS_FOR_FROM 648 0.43 0.59 0.36 190 MONEY_BACK 636 0.20 0.58 0.03 191 LOW_PRICE 635 0.84 0.58 0.95 192 TooManyTo_005 632 0.73 0.58 0.79 193 INVALID_DATE 622 0.25 0.57 0.10 194 HTML_IMAGE_ONLY_32 621 0.38 0.57 0.30 195 HTML_IMAGE_ONLY_08 616 0.27 0.56 0.13 196 XMSlimDrugH 607 0.32 0.56 0.21 197 FORGED_GMAIL_RCVD 596 0.38 0.55 0.31 198 XMSexyCombo_04 592 0.22 0.54 0.08 199 HTML_TAG_BALANCE_BODY 588 0.40 0.54 0.34 200 RELAYCOUNTRY_AU 578 0.42 0.53 0.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174312 78.53 96.73 70.48 2 DKIM_SIGNED 159921 70.97 85.23 64.67 3 XM_DK_Pass 157639 69.65 83.00 63.74 4 DKIM_VALID 154328 68.50 82.29 62.40 5 DCC_CHECK_NEGATIVE 150143 47.12 16.35 60.71 6 BAYES_50 146460 50.16 29.65 59.22 7 DKIM_VALID_AU 120264 54.07 66.39 48.63 8 XMListUnsubscribeExists 109602 54.75 78.36 44.32 9 DCC_CHECK 93407 51.32 81.98 37.77 10 XM_H_QuotedFrom 74707 35.61 47.84 30.21 11 ALL_TRUSTED 72035 20.58 1.25 29.13 12 HTML_FONT_LOW_CONTRAST 61184 28.89 38.28 24.74 13 T_TM2_M_HEADER_IN_MSG 60057 22.02 16.88 24.28 14 DKIM_VALID_EF 54007 20.64 17.94 21.84 15 LOC_TINY_FONT_1 52808 25.47 34.79 21.35 16 FVGT_m_MULTI_ODD 45899 21.41 27.88 18.56 17 XMSubLong 43672 20.43 26.69 17.66 18 MIME_HTML_ONLY 43338 20.67 27.77 17.52 19 XM_DK_Undo_02 42754 28.82 54.92 17.29 20 BAYES_99 41544 27.09 50.39 16.80 21 BOUNCE_MESSAGE 38642 11.11 0.90 15.63 22 ANY_BOUNCE_MESSAGE 38642 11.11 0.90 15.63 23 BAYES_999 36977 23.99 44.45 14.95 24 MultiRelay 32103 12.99 13.01 12.98 25 XM_DKIMWhitelistDomains 31733 8.91 0.04 12.83 26 RCVD_IN_RP_SAFE 30345 11.42 9.49 12.27 27 XM_Multi_Part_URI 26637 12.55 16.56 10.77 28 RCVD_IN_RP_CERTIFIED 26589 9.64 7.11 10.75 29 T_KAM_HTML_FONT_INVALID 24425 11.49 15.13 9.88 30 XM_Body_Dirty_Words 23661 12.88 20.37 9.57 31 TR_DCC_Bayes_99 20391 18.28 40.99 8.25 32 HTML_IMAGE_RATIO_02 19980 11.45 19.08 8.08 33 LotsOfNums_01 19643 8.52 9.82 7.94 34 XM_Evil_Numbers_Gen 17962 9.13 13.35 7.26 35 FSL_BULK_SIG 16616 6.84 7.13 6.72 36 BAYES_60 16325 6.23 5.39 6.60 37 RCVD_IN_MSPIKE_H2 16016 6.15 5.43 6.48 38 T_XMDrugObfuBody_14 14227 6.58 8.45 5.75 39 TooManyTo_001 14087 6.23 7.44 5.70 40 BAYES_00 13782 4.31 1.44 5.57 41 BOTNET_IPINHOSTNAME 13662 9.35 18.00 5.52 42 IN_ZIMBRA_NJ_WHITELIST 12313 3.47 0.06 4.98 43 XM_B_Phish_Phrases 12176 6.13 8.86 4.92 44 UNPARSEABLE_RELAY 12085 3.81 1.37 4.89 45 XM_H_Long_From01 11978 5.57 7.21 4.84 46 T_TooManySym_01 11563 4.44 3.91 4.68 47 XM_SendGrid 10708 4.04 3.39 4.33 48 TR_XM_DK_Bayes 10653 3.36 1.21 4.31 49 LOTS_OF_MONEY 10559 5.12 7.03 4.27 50 BAYES_80 10532 4.93 6.45 4.26 51 TR_XM_DK_Bayes1 10322 3.26 1.20 4.17 52 HTML_IMAGE_RATIO_04 10025 6.68 12.64 4.05 53 MIME_QP_LONG_LINE 9945 4.03 4.06 4.02 54 XMNumbers 9941 3.98 3.90 4.02 55 RELAYCOUNTRY_META 9855 7.89 16.71 3.98 56 XM_UncommonTLD01 9803 6.22 11.33 3.96 57 TR_Symld_Words 9360 2.87 0.79 3.78 58 FROM_EXCESS_BASE64 9261 4.83 7.27 3.74 59 TR_XM_DK_Bayes2 9206 2.94 1.18 3.72 60 XMStrtUSub 9164 3.66 3.55 3.71 61 XMSexyCombo_05 8579 5.29 9.40 3.47 62 RCVD_IN_IADB_LISTED 8505 2.91 1.71 3.44 63 TR_XM_DocInvoice 8361 4.18 6.00 3.38 64 RCVD_IN_IADB_SPF 7629 2.60 1.52 3.08 65 TVD_RCVD_IP 7558 2.21 0.29 3.06 66 MIME_HTML_MOSTLY 7350 3.58 4.95 2.97 67 XMSubMetaSx_00 7277 3.68 5.33 2.94 68 RCVD_IN_IADB_SENDERID 6931 2.39 1.45 2.80 69 MPART_ALT_DIFF 6774 3.99 6.81 2.74 70 RCVD_IN_IADB_DK 6754 2.34 1.44 2.73 71 RCVD_IN_IADB_VOUCHED 6710 2.19 1.02 2.71 72 INVALID_MSGID 6633 1.93 0.22 2.68 73 BAYES_95 6616 3.08 4.00 2.68 74 T_REMOTE_IMAGE 6424 2.74 3.06 2.60 75 TO_MALFORMED 6367 1.79 0.02 2.57 76 IN_HORDE_ADDRESS_BOOK 5911 1.68 0.09 2.39 77 XM_PDF 5882 1.80 0.48 2.38 78 BAYES_40 5760 1.95 1.09 2.33 79 HTML_IMAGE_RATIO_06 5758 2.64 3.35 2.33 80 DKIM_INVALID 5593 2.47 2.94 2.26 81 USER_IN_DEF_DKIM_WL 5112 1.49 0.17 2.07 82 HTML_MIME_NO_HTML_TAG 5001 2.33 3.02 2.02 83 T_TooManySym_02 4422 1.72 1.57 1.79 84 HTML_IMAGE_RATIO_08 4239 2.25 3.46 1.71 85 TooManyTo_002 4210 1.44 0.85 1.70 86 BAYES_20 3903 1.40 0.98 1.58 87 URIBL_RHS_DOB 3836 2.95 6.12 1.55 88 XM_DK_Undo_01 3725 1.46 1.35 1.51 89 RCVD_IN_MSPIKE_H3 3720 1.26 0.71 1.50 90 RCVD_IN_MSPIKE_WL 3720 1.26 0.71 1.50 91 MAILING_LIST_MULTI 3715 1.67 2.06 1.50 92 XM_CamelCaseFrm001 3641 2.03 3.31 1.47 93 TM2_M_URI_OPT_OUT 3490 2.09 3.62 1.41 94 XMStockSpam_06 3390 1.44 1.61 1.37 95 XM_SPF_SoftFail 3310 1.75 2.69 1.34 96 XM_DIRTYINTL 3069 2.02 3.77 1.24 97 RELAYCOUNTRY_CA 3031 1.83 3.19 1.23 98 UNTRUSTED_Relay 2981 4.19 10.95 1.21 99 XMBdyGiftCard01 2925 1.77 3.10 1.18 100 T_MIXED_ES 2884 1.43 2.02 1.17 101 TooManyTo_003 2844 1.03 0.77 1.15 102 URI_HEX 2753 1.68 2.96 1.11 103 XM_ProductURIs 2744 1.28 1.65 1.11 104 T_XMDrugObfuBody_08 2708 1.27 1.67 1.09 105 USER_IN_WHITELIST 2653 0.74 0.00 1.07 106 XM_GoogleGroups 2642 0.90 0.52 1.07 107 MIME_HTML_ONLY_MULTI 2566 1.63 2.99 1.04 108 BOTNET 2527 5.50 15.62 1.02 109 XM_H_PHPOS 2520 1.24 1.73 1.02 110 BAYES_05 2383 0.86 0.61 0.96 111 SUBJ_ALL_CAPS 2374 1.33 2.16 0.96 112 RCVD_IN_IADB_OPTIN 2373 0.77 0.34 0.96 113 XMDiploma_00 2352 1.07 1.34 0.95 114 LOW_PRICE 2348 0.84 0.58 0.95 115 TooManyTo_004 2287 0.84 0.65 0.92 116 XM_B_REG_HTML 2247 1.09 1.50 0.91 117 XMPhish11 2183 0.81 0.64 0.88 118 XMSubMetaSxObfu_02 2153 0.68 0.25 0.87 119 XM_H_Long_From02 2140 1.45 2.77 0.87 120 T_TooManySym_03 2096 0.78 0.62 0.85 121 XMBody_95 2051 0.61 0.12 0.83 122 XM_OfRef6 2044 1.06 1.58 0.83 123 DKIM_ADSP_CUSTOM_MED 2040 0.79 0.71 0.82 124 HELO_NODOT 1996 0.65 0.31 0.81 125 TooManyTo_005 1966 0.73 0.58 0.79 126 XM_B_COPY_HTML 1920 0.91 1.21 0.78 127 XM_UB50 1816 1.92 4.60 0.73 128 XM_H_PHPMailer 1785 0.77 0.87 0.72 129 TM2_M_VERY_LONG_WORD 1758 1.13 2.07 0.71 130 PLING_QUERY 1696 1.40 3.01 0.69 131 RELAYCOUNTRY_GB 1630 0.73 0.88 0.66 132 XMBrknScrpt_02 1565 0.69 0.82 0.63 133 URI_TRY_3LD 1535 0.64 0.67 0.62 134 NML_ADSP_CUSTOM_MED 1517 0.59 0.52 0.61 135 XMBody_78 1471 0.94 1.73 0.59 136 XM_S_JOY_D 1365 0.81 1.40 0.55 137 XM_Walgreens_Forge 1319 0.37 0.00 0.53 138 T_FILL_THIS_FORM_SHORT 1301 0.48 0.37 0.53 139 TR_MetaPhish_Combo_01 1295 0.58 0.71 0.52 140 XM_ShortIntro_01 1287 0.45 0.30 0.52 141 XMSubMetaI_00 1284 1.31 3.08 0.52 142 XMGenDplmaNmb 1265 0.59 0.78 0.51 143 XM_H_PHPOS_M 1237 0.55 0.65 0.50 144 T_TooManySym_04 1223 0.35 0.01 0.49 145 MISSING_HEADERS 1219 0.48 0.46 0.49 146 XMSubject_48 1207 0.36 0.06 0.49 147 XM_B_TRADE_HTML 1161 0.46 0.45 0.47 148 SpammyFromTLD_01 1137 1.15 2.70 0.46 149 XMPhish30 1132 0.84 1.71 0.46 150 XMCapTrack 1077 0.41 0.34 0.44 151 XMGappySubj_01 1074 0.38 0.27 0.43 152 TR_XM_RelayPhish 1062 0.88 1.91 0.43 153 T_XMHurry_00 1049 0.71 1.36 0.42 154 RDNS_DYNAMIC 1036 0.61 1.04 0.42 155 XMBody_17 1012 0.74 1.48 0.41 156 REMOVE_BEFORE_LINK 1011 0.68 1.28 0.41 157 RCVD_IN_IADB_DOPTIN 1003 0.30 0.05 0.41 158 XMClaimOffer 1002 0.48 0.64 0.41 159 RELAYCOUNTRY_AU 932 0.42 0.53 0.38 160 HTML_FONT_FACE_BAD 924 0.52 0.86 0.37 161 T_OBFU_PDF_ATTACH 922 0.29 0.09 0.37 162 URI_NOVOWEL 914 0.39 0.42 0.37 163 DKIM_ADSP_NXDOMAIN 902 0.40 0.49 0.36 164 NO_DNS_FOR_FROM 891 0.43 0.59 0.36 165 XMHTMLBadTable_001 871 0.50 0.84 0.35 166 RCVD_IN_BL_SPAMCOP_NET 864 2.08 5.99 0.35 167 HTML_TAG_BALANCE_BODY 840 0.40 0.54 0.34 168 XMLngstWrd_00 791 0.33 0.36 0.32 169 XMNoVowels 791 0.30 0.25 0.32 170 TR_LOTS_OF_MONEY2 771 0.46 0.80 0.31 171 T_MONEY_PERCENT 771 0.46 0.80 0.31 172 FORGED_GMAIL_RCVD 765 0.38 0.55 0.31 173 RELAYCOUNTRY_DE 750 0.43 0.71 0.30 174 RELAYCOUNTRY_FR 744 1.10 2.92 0.30 175 XMSubNoVowel 736 0.39 0.61 0.30 176 HTML_IMAGE_ONLY_32 732 0.38 0.57 0.30 177 TM2_M_A_HREF_HREF 722 0.34 0.46 0.29 178 MSGID_FROM_MTA_HEADER 719 0.26 0.19 0.29 179 XMSexyCombo_01 718 0.61 1.32 0.29 180 XM_BadFromFormat 704 0.67 1.55 0.28 181 HTML_IMAGE_ONLY_28 698 0.31 0.37 0.28 182 XMGappySubj_02 680 0.21 0.06 0.27 183 XMLngstWrd_01 679 0.29 0.31 0.27 184 XMPhish14 667 0.59 1.31 0.27 185 TVD_SPACE_RATIO 666 0.24 0.17 0.27 186 XMManySubDom_06 665 0.25 0.22 0.27 187 XMSolicitRefs_0 664 0.27 0.27 0.27 188 T_XMDrugObfuBody_00 663 0.56 1.22 0.27 189 XMRcvdHeader_15 651 0.18 0.00 0.26 190 XM_USANA_RCVD 645 0.18 0.00 0.26 191 XMMoneyMeta_00 630 0.40 0.72 0.25 192 HTML_IMAGE_ONLY_24 627 0.33 0.50 0.25 193 TM2_M_BODY_EMPTY 623 0.23 0.19 0.25 194 MPART_ALT_DIFF_COUNT 620 0.55 1.22 0.25 195 XMDateMe_00 619 0.25 0.25 0.25 196 TR_MetaPhish_Combo_01b 602 0.20 0.11 0.24 197 XMHTML_After_End 592 0.41 0.79 0.24 198 XMSubEmpty 592 0.29 0.40 0.24 199 MultiRelay_Combo 587 0.85 2.24 0.24 200 XM_Body_Obfu01 587 0.39 0.74 0.24 ----------------------------------------------------------------------