Email: 263983 Autolearn: 0 AvgScore: 3.04 AvgScanTime: 1.81 sec Spam: 84408 Autolearn: 0 AvgScore: 13.01 AvgScanTime: 2.18 sec Ham: 179575 Autolearn: 0 AvgScore: -1.65 AvgScanTime: 1.63 sec Time Spent Running SA: 132.50 hours Time Spent Processing Spam: 51.19 hours Time Spent Processing Ham: 81.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 78839 84.43 93.40 80.22 2 DKIM_SIGNED 73788 79.45 87.42 75.70 3 XM_DK_Pass 71295 77.89 84.46 74.80 4 DKIM_VALID 70623 76.63 83.67 73.32 5 DCC_CHECK 67746 54.26 80.26 42.04 6 XMListUnsubscribeExists 63221 56.85 74.90 48.36 7 DKIM_VALID_AU 60240 62.88 71.37 58.89 8 XM_H_QuotedFrom 47826 42.92 56.66 36.46 9 XM_DK_Undo_02 44078 30.57 52.22 20.39 10 BAYES_99 39971 28.80 47.35 20.07 11 BAYES_999 35149 25.73 41.64 18.25 12 LOC_TINY_FONT_1 32236 29.24 38.19 25.03 13 TR_DCC_Bayes_99 32006 19.16 37.92 10.35 14 HTML_FONT_LOW_CONTRAST 31504 31.79 37.32 29.19 15 MIME_HTML_ONLY 25258 23.79 29.92 20.91 16 BAYES_50 25239 45.41 29.90 52.71 17 FVGT_m_MULTI_ODD 23683 22.69 28.06 20.16 18 XMSubLong 21021 23.53 24.90 22.89 19 XM_Body_Dirty_Words 20076 15.54 23.78 11.67 20 HTML_IMAGE_RATIO_02 18967 13.40 22.47 9.13 21 T_TM2_M_HEADER_IN_MSG 15767 22.15 18.68 23.79 22 RELAYCOUNTRY_META 15563 9.26 18.44 4.95 23 DCC_CHECK_NEGATIVE 15166 44.19 17.97 56.51 24 DKIM_VALID_EF 14681 24.27 17.39 27.50 25 XM_Multi_Part_URI 14447 14.34 17.12 13.04 26 T_KAM_HTML_FONT_INVALID 13939 13.87 16.51 12.62 27 MultiRelay 13270 15.69 15.72 15.67 28 XM_Evil_Numbers_Gen 13174 10.92 15.61 8.71 29 BOTNET_IPINHOSTNAME 12418 9.52 14.71 7.08 30 BOTNET 12030 5.19 14.25 0.93 31 XMSexyCombo_05 10850 7.14 12.85 4.45 32 UNTRUSTED_Relay 9930 4.92 11.76 1.70 33 FSL_BULK_SIG 9924 10.62 11.76 10.09 34 T_XMDrugObfuBody_14 9462 8.40 11.21 7.08 35 HTML_IMAGE_RATIO_04 8863 6.75 10.50 4.98 36 RCVD_IN_RP_SAFE 8744 13.49 10.36 14.96 37 XM_B_Phish_Phrases 8656 6.53 10.25 4.78 38 LOTS_OF_MONEY 8600 8.51 10.19 7.72 39 XMSubMetaSx_00 7566 6.50 8.96 5.34 40 RCVD_IN_RP_CERTIFIED 7489 12.39 8.87 14.04 41 LotsOfNums_01 7239 7.45 8.58 6.92 42 TooManyTo_001 7195 7.73 8.52 7.36 43 FROM_EXCESS_BASE64 7178 6.00 8.50 4.82 44 TR_XM_DocInvoice 6993 5.95 8.28 4.85 45 XM_UncommonTLD01 6712 6.02 7.95 5.12 46 BAYES_80 6344 5.03 7.52 3.86 47 MPART_ALT_DIFF 6313 4.76 7.48 3.48 48 XM_H_Long_From01 6195 5.92 7.34 5.25 49 BAYES_60 4929 6.23 5.84 6.41 50 RCVD_IN_MSPIKE_H2 4731 5.39 5.60 5.29 51 MIME_HTML_MOSTLY 4438 4.04 5.26 3.47 52 XMStrtUSub 4260 5.21 5.05 5.29 53 XM_DIRTYINTL 4176 2.77 4.95 1.75 54 XM_UB50 3902 2.28 4.62 1.17 55 HTML_IMAGE_RATIO_06 3748 4.21 4.44 4.11 56 TM2_M_URI_OPT_OUT 3713 2.58 4.40 1.72 57 BAYES_95 3671 3.35 4.35 2.88 58 MIME_QP_LONG_LINE 3632 4.00 4.30 3.85 59 T_TooManySym_01 3531 5.89 4.18 6.69 60 XMNumbers 3476 4.93 4.12 5.31 61 XM_SendGrid 3460 4.78 4.10 5.10 62 XM_SPF_SoftFail 3278 2.07 3.88 1.22 63 DKIM_INVALID 3165 2.82 3.75 2.38 64 XM_CamelCaseFrm001 3071 2.33 3.64 1.72 65 URI_HEX 2994 2.07 3.55 1.37 66 MIME_HTML_ONLY_MULTI 2938 1.86 3.48 1.10 67 T_REMOTE_IMAGE 2894 3.95 3.43 4.19 68 MultiRelay_CC 2872 1.24 3.40 0.23 69 MultiRelay_Combo 2872 1.24 3.40 0.23 70 RELAYCOUNTRY_CA 2841 2.01 3.37 1.38 71 XMSexyCombo_01 2692 1.99 3.19 1.43 72 XM_OfRef6 2603 2.18 3.08 1.76 73 XMBdyGiftCard01 2500 1.73 2.96 1.15 74 XMSubMetaI_00 2434 1.44 2.88 0.76 75 HTML_IMAGE_RATIO_08 2359 2.15 2.79 1.85 76 XMDiploma_00 2137 1.71 2.53 1.32 77 SUBJ_ALL_CAPS 2124 1.65 2.52 1.24 78 TR_Symld_Words 2114 2.75 2.50 2.87 79 T_XMDrugObfuBody_08 2072 1.49 2.45 1.04 80 RCVD_IN_RP_RNBL 2066 0.81 2.45 0.04 81 TM2_M_VERY_LONG_WORD 2030 1.39 2.40 0.91 82 XM_URI_RBL 1992 0.86 2.36 0.16 83 XM_B_REG_HTML 1980 1.44 2.35 1.01 84 SpammyFromTLD_01 1958 1.03 2.32 0.42 85 SUBJ_DOLLARS 1917 0.97 2.27 0.35 86 RCVD_IN_BL_SPAMCOP_NET 1879 0.92 2.23 0.31 87 XMBody_17 1843 0.98 2.18 0.42 88 XMPhish30 1833 0.99 2.17 0.44 89 ALL_TRUSTED 1827 12.90 2.16 17.95 90 BAYES_00 1769 5.61 2.10 7.26 91 DIET_1 1757 1.06 2.08 0.57 92 XM_UB99 1644 0.63 1.95 0.02 93 SpammyFromTLD_02 1620 0.74 1.92 0.18 94 BOTNET_NORDNS 1618 0.63 1.92 0.02 95 TR_XM_DK_Bayes 1571 4.31 1.86 5.46 96 TR_XM_DK_Bayes1 1563 4.23 1.85 5.35 97 T_XMHurry_00 1557 0.99 1.84 0.60 98 T_FILL_THIS_FORM_SHORT 1546 1.03 1.83 0.66 99 HTML_MIME_NO_HTML_TAG 1543 1.75 1.83 1.71 100 XMSubMetaSxObfu_03 1543 1.02 1.83 0.63 101 RELAYCOUNTRY_FR 1526 0.77 1.81 0.29 102 MAILING_LIST_MULTI 1525 2.00 1.81 2.09 103 RCVD_IN_PSBL 1491 0.77 1.77 0.30 104 URIBL_BLACK 1486 0.60 1.76 0.05 105 XM_H_Long_From02 1449 0.99 1.72 0.64 106 XMSexyCombo_04 1431 0.63 1.70 0.13 107 TR_XM_DK_Bayes2 1430 3.80 1.69 4.80 108 XM_OfRef7 1411 0.65 1.67 0.17 109 RCVD_IN_IADB_LISTED 1401 3.33 1.66 4.12 110 XM_DK_Undo_01 1400 1.75 1.66 1.80 111 XM_UB80 1398 0.54 1.66 0.02 112 XMStockSpam_06 1378 1.57 1.63 1.55 113 RELAYCOUNTRY_DE 1355 0.97 1.61 0.68 114 RDNS_DYNAMIC 1352 0.91 1.60 0.59 115 TR_XM_RelayPhish 1344 0.82 1.59 0.46 116 RELAYCOUNTRY_CN 1342 0.57 1.59 0.09 117 XM_UB999 1330 0.51 1.58 0.01 118 XM_B_COPY_HTML 1309 1.00 1.55 0.75 119 RELAYCOUNTRY_AT 1294 0.59 1.53 0.15 120 XM_UB60 1269 0.53 1.50 0.07 121 LONG_JUNK_URI 1264 0.53 1.50 0.08 122 XM_ProductURIs 1256 1.40 1.49 1.36 123 XMPhish14 1255 0.71 1.49 0.34 124 XM_HighProb1 1213 0.48 1.44 0.04 125 UNPARSEABLE_RELAY 1206 4.86 1.43 6.47 126 RCVD_IN_IADB_SPF 1173 2.86 1.39 3.55 127 MISSING_HEADERS 1168 0.73 1.38 0.42 128 REPLYTO_WITHOUT_TO_CC 1117 0.45 1.32 0.04 129 URIBL_DBL_SPAM 1114 0.43 1.32 0.02 130 RCVD_IN_IADB_SENDERID 1097 2.57 1.30 3.17 131 XMHTMLBadTable_001 1081 0.97 1.28 0.82 132 RCVD_IN_IADB_DK 1077 2.50 1.28 3.08 133 XMGenDplmaNmb 1077 0.91 1.28 0.74 134 BAYES_40 1076 2.45 1.27 3.00 135 TR_LOTS_OF_MONEY1 1064 0.41 1.26 0.01 136 LONG_JUNK_URI3 1046 0.46 1.24 0.09 137 MPART_ALT_DIFF_COUNT 1039 0.59 1.23 0.28 138 URI_TRY_3LD 1036 0.94 1.23 0.80 139 MONEY_FORM_SHORT 1017 0.39 1.20 0.01 140 RELAYCOUNTRY_IT 1009 0.40 1.20 0.03 141 XM_RXBody 968 0.57 1.15 0.30 142 FSL_THIS_IS_ADV 965 0.40 1.14 0.06 143 DATE_IN_FUTURE_06_12 957 0.37 1.13 0.01 144 FORM_FRAUD_5 950 0.36 1.13 0.00 145 RELAYCOUNTRY_NG 943 0.36 1.12 0.00 146 T_XMDrugObfuBody_00 925 0.85 1.10 0.73 147 FORGED_MUA_OUTLOOK 924 0.38 1.09 0.04 148 T_TooManySym_02 922 2.62 1.09 3.34 149 T_DEAR_BENEFICIARY 915 0.35 1.08 0.00 150 T_FILL_THIS_FORM_FRAUD_PHISH 911 0.42 1.08 0.11 151 TooManyTo_002 907 1.72 1.07 2.03 152 XMMoneyMeta_00 904 0.46 1.07 0.17 153 BAYES_20 893 1.86 1.06 2.24 154 FAKE_REPLY_C 869 0.33 1.03 0.00 155 FSL_NEW_HELO_USER 866 0.33 1.03 0.00 156 FSL_CTYPE_WIN1251 863 0.33 1.02 0.00 157 BODY_ENHANCEMENT 852 0.34 1.01 0.02 158 LONG_JUNK_URI2 845 0.33 1.00 0.01 159 NO_DNS_FOR_FROM 835 0.76 0.99 0.65 160 XM_H_PHPOS 807 1.30 0.96 1.47 161 XMBody_78 806 0.89 0.95 0.86 162 PLING_QUERY 799 0.52 0.95 0.31 163 XMSubNoVowel 791 0.54 0.94 0.35 164 XMBrknScrpt_02 779 0.65 0.92 0.52 165 TR_MetaPhish_Combo_01 779 0.79 0.92 0.73 166 XMHTML_After_End 777 0.50 0.92 0.30 167 TooManyTo_003 767 1.28 0.91 1.46 168 CK_HELO_DYNAMIC_SPLIT_IP 760 0.29 0.90 0.00 169 XMClaimOffer 746 0.43 0.88 0.21 170 XMPhish11 741 0.99 0.88 1.05 171 HELO_MISC_IP 741 0.31 0.88 0.04 172 TR_Caps_n_Bayes_80 738 0.30 0.87 0.03 173 TR_LOTS_OF_MONEY2 724 0.37 0.86 0.15 174 T_MONEY_PERCENT 724 0.37 0.86 0.15 175 HTML_FONT_FACE_BAD 724 0.65 0.86 0.56 176 RELAYCOUNTRY_GB 715 0.74 0.85 0.70 177 DKIM_ADSP_CUSTOM_MED 710 0.99 0.84 1.06 178 XM_BadFromFormat 707 0.42 0.84 0.23 179 NORDNS_LOW_CONTRAST 702 0.27 0.83 0.01 180 XMSlimDrugH 700 0.71 0.83 0.65 181 RELAYCOUNTRY_AL 696 0.26 0.82 0.00 182 TooManyTo_004 694 1.09 0.82 1.22 183 T_HTML_TAG_BALANCE_CENTER 694 0.37 0.82 0.16 184 XM_Body_Obfu01 685 0.37 0.81 0.16 185 PHOTO_EDITING_DIRECT 671 0.26 0.79 0.00 186 XMSubMetaSx_01 667 0.46 0.79 0.30 187 MIME_CHARSET_FARAWAY 645 0.35 0.76 0.16 188 XMSubMetaI_01 643 0.32 0.76 0.11 189 XMSubMetaSSx_00 641 0.37 0.76 0.19 190 XM_H_PHPMailer 623 0.86 0.74 0.91 191 NML_ADSP_CUSTOM_MED 614 0.76 0.73 0.78 192 LOW_PRICE 612 0.33 0.73 0.14 193 RCVD_IN_IADB_VOUCHED 607 2.03 0.72 2.65 194 CHARSET_FARAWAY_HEADER 603 0.31 0.71 0.12 195 XMSubMetaD_03 600 0.39 0.71 0.24 196 XM_UB95 594 0.24 0.70 0.02 197 HTML_SHORT_LINK_IMG_3 583 0.26 0.69 0.05 198 XM_B_TRADE_HTML 576 0.52 0.68 0.44 199 XM_H_Long_From03 548 0.29 0.65 0.12 200 TM2_M_A_HREF_HREF 546 0.68 0.65 0.69 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144049 84.43 93.40 80.22 2 DKIM_SIGNED 135939 79.45 87.42 75.70 3 XM_DK_Pass 134324 77.89 84.46 74.80 4 DKIM_VALID 131668 76.63 83.67 73.32 5 DKIM_VALID_AU 105747 62.88 71.37 58.89 6 DCC_CHECK_NEGATIVE 101479 44.19 17.97 56.51 7 BAYES_50 94647 45.41 29.90 52.71 8 XMListUnsubscribeExists 86847 56.85 74.90 48.36 9 DCC_CHECK 75492 54.26 80.26 42.04 10 XM_H_QuotedFrom 65478 42.92 56.66 36.46 11 HTML_FONT_LOW_CONTRAST 52419 31.79 37.32 29.19 12 DKIM_VALID_EF 49392 24.27 17.39 27.50 13 LOC_TINY_FONT_1 44948 29.24 38.19 25.03 14 T_TM2_M_HEADER_IN_MSG 42713 22.15 18.68 23.79 15 XMSubLong 41104 23.53 24.90 22.89 16 MIME_HTML_ONLY 37546 23.79 29.92 20.91 17 XM_DK_Undo_02 36618 30.57 52.22 20.39 18 FVGT_m_MULTI_ODD 36203 22.69 28.06 20.16 19 BAYES_99 36047 28.80 47.35 20.07 20 BAYES_999 32766 25.73 41.64 18.25 21 ALL_TRUSTED 32230 12.90 2.16 17.95 22 XM_DKIMWhitelistDomains 29471 11.17 0.02 16.41 23 MultiRelay 28143 15.69 15.72 15.67 24 RCVD_IN_RP_SAFE 26858 13.49 10.36 14.96 25 RCVD_IN_RP_CERTIFIED 25218 12.39 8.87 14.04 26 XM_Multi_Part_URI 23418 14.34 17.12 13.04 27 T_KAM_HTML_FONT_INVALID 22669 13.87 16.51 12.62 28 XM_Body_Dirty_Words 20948 15.54 23.78 11.67 29 TR_DCC_Bayes_99 18582 19.16 37.92 10.35 30 FSL_BULK_SIG 18124 10.62 11.76 10.09 31 HTML_IMAGE_RATIO_02 16396 13.40 22.47 9.13 32 XM_Evil_Numbers_Gen 15649 10.92 15.61 8.71 33 LOTS_OF_MONEY 13863 8.51 10.19 7.72 34 TooManyTo_001 13222 7.73 8.52 7.36 35 BAYES_00 13033 5.61 2.10 7.26 36 T_XMDrugObfuBody_14 12714 8.40 11.21 7.08 37 BOTNET_IPINHOSTNAME 12706 9.52 14.71 7.08 38 LotsOfNums_01 12432 7.45 8.58 6.92 39 T_TooManySym_01 12016 5.89 4.18 6.69 40 UNPARSEABLE_RELAY 11621 4.86 1.43 6.47 41 BAYES_60 11507 6.23 5.84 6.41 42 TR_XM_DK_Bayes 9805 4.31 1.86 5.46 43 TVD_RCVD_IP 9715 3.84 0.51 5.41 44 IN_ZIMBRA_NJ_WHITELIST 9660 3.67 0.03 5.38 45 TR_XM_DK_Bayes1 9607 4.23 1.85 5.35 46 XMSubMetaSx_00 9589 6.50 8.96 5.34 47 XMNumbers 9528 4.93 4.12 5.31 48 RCVD_IN_MSPIKE_H2 9501 5.39 5.60 5.29 49 XMStrtUSub 9492 5.21 5.05 5.29 50 XM_H_Long_From01 9424 5.92 7.34 5.25 51 XM_UncommonTLD01 9192 6.02 7.95 5.12 52 XM_SendGrid 9158 4.78 4.10 5.10 53 TO_MALFORMED 8965 3.40 0.01 4.99 54 HTML_IMAGE_RATIO_04 8945 6.75 10.50 4.98 55 RELAYCOUNTRY_META 8885 9.26 18.44 4.95 56 TR_XM_DocInvoice 8717 5.95 8.28 4.85 57 FROM_EXCESS_BASE64 8663 6.00 8.50 4.82 58 TR_XM_DK_Bayes2 8614 3.80 1.69 4.80 59 XM_B_Phish_Phrases 8590 6.53 10.25 4.78 60 XMSexyCombo_05 7992 7.14 12.85 4.45 61 T_REMOTE_IMAGE 7530 3.95 3.43 4.19 62 RCVD_IN_IADB_LISTED 7393 3.33 1.66 4.12 63 HTML_IMAGE_RATIO_06 7376 4.21 4.44 4.11 64 BAYES_80 6940 5.03 7.52 3.86 65 MIME_QP_LONG_LINE 6922 4.00 4.30 3.85 66 INVALID_MSGID 6853 2.69 0.30 3.82 67 RCVD_IN_IADB_SPF 6378 2.86 1.39 3.55 68 MPART_ALT_DIFF 6254 4.76 7.48 3.48 69 MIME_HTML_MOSTLY 6238 4.04 5.26 3.47 70 T_TooManySym_02 5994 2.62 1.09 3.34 71 ANY_BOUNCE_MESSAGE 5878 2.36 0.41 3.27 72 BOUNCE_MESSAGE 5874 2.35 0.40 3.27 73 RCVD_IN_IADB_SENDERID 5690 2.57 1.30 3.17 74 RCVD_IN_IADB_DK 5533 2.50 1.28 3.08 75 BAYES_40 5390 2.45 1.27 3.00 76 BAYES_95 5167 3.35 4.35 2.88 77 TR_Symld_Words 5155 2.75 2.50 2.87 78 IN_HORDE_ADDRESS_BOOK 5047 1.93 0.07 2.81 79 RCVD_IN_IADB_VOUCHED 4750 2.03 0.72 2.65 80 DKIM_INVALID 4271 2.82 3.75 2.38 81 USER_IN_DEF_DKIM_WL 4068 1.55 0.03 2.27 82 BAYES_20 4027 1.86 1.06 2.24 83 MAILING_LIST_MULTI 3759 2.00 1.81 2.09 84 TooManyTo_002 3642 1.72 1.07 2.03 85 XM_PDF 3595 1.56 0.61 2.00 86 HTML_IMAGE_RATIO_08 3321 2.15 2.79 1.85 87 XM_DK_Undo_01 3229 1.75 1.66 1.80 88 XM_OfRef6 3156 2.18 3.08 1.76 89 XM_DIRTYINTL 3142 2.77 4.95 1.75 90 TM2_M_URI_OPT_OUT 3087 2.58 4.40 1.72 91 XM_CamelCaseFrm001 3084 2.33 3.64 1.72 92 HTML_MIME_NO_HTML_TAG 3078 1.75 1.83 1.71 93 UNTRUSTED_Relay 3051 4.92 11.76 1.70 94 BAYES_05 2817 1.26 0.61 1.57 95 XMStockSpam_06 2775 1.57 1.63 1.55 96 XM_GoogleGroups 2675 1.19 0.56 1.49 97 XM_H_PHPOS 2634 1.30 0.96 1.47 98 TooManyTo_003 2616 1.28 0.91 1.46 99 T_TooManySym_03 2580 1.03 0.18 1.44 100 XMSexyCombo_01 2572 1.99 3.19 1.43 101 USER_IN_WHITELIST 2520 0.95 0.00 1.40 102 RCVD_IN_MSPIKE_WL 2474 1.00 0.19 1.38 103 RCVD_IN_MSPIKE_H3 2474 1.00 0.19 1.38 104 RELAYCOUNTRY_CA 2472 2.01 3.37 1.38 105 URI_HEX 2458 2.07 3.55 1.37 106 XM_ProductURIs 2451 1.40 1.49 1.36 107 XM_H_SpoofStaff4 2446 1.01 0.26 1.36 108 XMDiploma_00 2364 1.71 2.53 1.32 109 RCVD_IN_IADB_OPTIN 2230 0.99 0.45 1.24 110 SUBJ_ALL_CAPS 2220 1.65 2.52 1.24 111 TooManyTo_004 2190 1.09 0.82 1.22 112 XM_SPF_SoftFail 2183 2.07 3.88 1.22 113 XM_UB50 2109 2.28 4.62 1.17 114 XMBdyGiftCard01 2058 1.73 2.96 1.15 115 MIME_HTML_ONLY_MULTI 1973 1.86 3.48 1.10 116 DKIM_ADSP_CUSTOM_MED 1906 0.99 0.84 1.06 117 XMPhish11 1882 0.99 0.88 1.05 118 FILL_THIS_FORM 1876 0.74 0.10 1.04 119 TooManyTo_005 1869 0.82 0.36 1.04 120 T_XMDrugObfuBody_08 1866 1.49 2.45 1.04 121 XMSubject_78 1813 0.76 0.23 1.01 122 XM_B_REG_HTML 1812 1.44 2.35 1.01 123 T_FILL_THIS_FORM_LOAN 1728 0.67 0.04 0.96 124 HELO_NODOT 1723 0.72 0.20 0.96 125 T_FILL_THIS_FORM_LONG 1715 0.67 0.05 0.96 126 BOTNET 1670 5.19 14.25 0.93 127 XM_H_PHPMailer 1637 0.86 0.74 0.91 128 TM2_M_VERY_LONG_WORD 1637 1.39 2.40 0.91 129 XMBody_78 1543 0.89 0.95 0.86 130 XMBody_95 1532 0.64 0.19 0.85 131 XMHTMLBadTable_001 1473 0.97 1.28 0.82 132 URI_TRY_3LD 1444 0.94 1.23 0.80 133 NML_ADSP_CUSTOM_MED 1395 0.76 0.73 0.78 134 XMSubMetaI_00 1373 1.44 2.88 0.76 135 XM_B_COPY_HTML 1339 1.00 1.55 0.75 136 XMGenDplmaNmb 1331 0.91 1.28 0.74 137 T_XMDrugObfuBody_00 1313 0.85 1.10 0.73 138 TR_MetaPhish_Combo_01 1311 0.79 0.92 0.73 139 RELAYCOUNTRY_GB 1249 0.74 0.85 0.70 140 TM2_M_A_HREF_HREF 1244 0.68 0.65 0.69 141 T_TooManySym_04 1218 0.47 0.02 0.68 142 RELAYCOUNTRY_DE 1218 0.97 1.61 0.68 143 T_FILL_THIS_FORM_SHORT 1180 1.03 1.83 0.66 144 XMSlimDrugH 1174 0.71 0.83 0.65 145 XMSubMetaSxObfu_02 1168 0.52 0.24 0.65 146 NO_DNS_FOR_FROM 1159 0.76 0.99 0.65 147 XM_H_Long_From02 1153 0.99 1.72 0.64 148 XMSubMetaSxObfu_03 1140 1.02 1.83 0.63 149 XM_D_tchamptons_WL 1097 0.42 0.01 0.61 150 T_XMHurry_00 1069 0.99 1.84 0.60 151 XM_H_PHPOS_M 1059 0.57 0.52 0.59 152 RDNS_DYNAMIC 1057 0.91 1.60 0.59 153 XM_ShortIntro_01 1044 0.59 0.62 0.58 154 DIET_1 1032 1.06 2.08 0.57 155 HTML_FONT_FACE_BAD 1003 0.65 0.86 0.56 156 XMBrknScrpt_02 934 0.65 0.92 0.52 157 XMRcvdHeader_15 865 0.33 0.00 0.48 158 RCVD_IN_IADB_DOPTIN 862 0.35 0.06 0.48 159 DKIM_ADSP_NXDOMAIN 844 0.43 0.34 0.47 160 TR_XM_RelayPhish 823 0.82 1.59 0.46 161 XMPhish30 793 0.99 2.17 0.44 162 XMCapTrack 788 0.39 0.29 0.44 163 XM_B_TRADE_HTML 784 0.52 0.68 0.44 164 XMNoVowels 781 0.36 0.21 0.43 165 MISSING_HEADERS 754 0.73 1.38 0.42 166 SpammyFromTLD_01 754 1.03 2.32 0.42 167 XMBody_17 749 0.98 2.18 0.42 168 XMBounce_01 730 0.32 0.14 0.41 169 FROM_EGROUPS 724 0.28 0.01 0.40 170 XM_H_Trusted_IP 711 0.27 0.00 0.40 171 XM_D_omniadmin_Whitelist 703 0.27 0.00 0.39 172 HTML_TAG_BALANCE_BODY 697 0.46 0.61 0.39 173 XMDateMe_00 670 0.32 0.19 0.37 174 XMSUPPORT 668 0.25 0.00 0.37 175 FORGED_GMAIL_RCVD 659 0.43 0.58 0.37 176 URI_WP_HACKED_2 658 0.42 0.52 0.37 177 XMBody_29 638 0.30 0.18 0.36 178 SUBJ_DOLLARS 635 0.97 2.27 0.35 179 XMSubNoVowel 631 0.54 0.94 0.35 180 RELAYCOUNTRY_NL 627 0.40 0.52 0.35 181 XMPhish14 613 0.71 1.49 0.34 182 TR_MetaPhish_Combo_01b 596 0.27 0.15 0.33 183 RCVD_IN_SORBS_DUL 595 0.31 0.27 0.33 184 HTML_IMAGE_ONLY_32 593 0.31 0.27 0.33 185 XM_Walgreens_Forge 589 0.33 0.34 0.33 186 T_TooManySym_05 585 0.22 0.00 0.33 187 EXCLAMACION_ES 575 0.24 0.07 0.32 188 T_OBFU_PDF_ATTACH 573 0.26 0.12 0.32 189 XMSubEmpty 566 0.27 0.16 0.32 190 PLING_QUERY 563 0.52 0.95 0.31 191 RCVD_IN_BL_SPAMCOP_NET 556 0.92 2.23 0.31 192 TVD_SPACE_RATIO 551 0.36 0.47 0.31 193 XMLngstWrd_00 540 0.33 0.39 0.30 194 XMSubMetaSx_01 537 0.46 0.79 0.30 195 XM_RXBody 535 0.57 1.15 0.30 196 XM_H_Undi_Recip 534 0.39 0.57 0.30 197 MSGID_FROM_MTA_HEADER 534 0.25 0.14 0.30 198 XMHTML_After_End 534 0.50 0.92 0.30 199 RCVD_IN_PSBL 533 0.77 1.77 0.30 200 HTML_IMAGE_ONLY_28 530 0.33 0.41 0.30 ----------------------------------------------------------------------