Email: 526300 Autolearn: 0 AvgScore: 3.27 AvgScanTime: 3.66 sec Spam: 156139 Autolearn: 0 AvgScore: 12.28 AvgScanTime: 4.58 sec Ham: 370161 Autolearn: 0 AvgScore: -0.53 AvgScanTime: 3.27 sec Time Spent Running SA: 534.83 hours Time Spent Processing Spam: 198.60 hours Time Spent Processing Ham: 336.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146396 85.01 93.76 81.32 2 DKIM_SIGNED 128211 68.73 82.11 63.09 3 XM_DK_Pass 124654 67.16 79.84 61.81 4 DCC_CHECK 122613 46.97 78.53 33.66 5 DKIM_VALID 117540 62.78 75.28 57.50 6 XMListUnsubscribeExists 109391 47.91 70.06 38.56 7 DKIM_VALID_AU 89584 44.51 57.37 39.09 8 XM_H_QuotedFrom 89543 41.70 57.35 35.10 9 XM_DK_Undo_02 73235 22.92 46.90 12.80 10 BAYES_99 66431 20.68 42.55 11.46 11 BAYES_999 56697 17.96 36.31 10.22 12 LOC_TINY_FONT_1 53732 21.48 34.41 16.02 13 HTML_FONT_LOW_CONTRAST 53343 25.44 34.16 21.77 14 BAYES_50 52807 51.17 33.82 58.49 15 TR_DCC_Bayes_99 51570 13.65 33.03 5.47 16 MIME_HTML_ONLY 44864 20.87 28.73 17.56 17 FVGT_m_MULTI_ODD 43227 21.05 27.68 18.25 18 XMSubLong 39021 20.15 24.99 18.11 19 DKIM_VALID_EF 35698 22.71 22.86 22.64 20 T_TM2_M_HEADER_IN_MSG 32581 31.20 20.87 35.56 21 XM_Body_Dirty_Words 31660 12.59 20.28 9.34 22 T_KAM_HTML_FONT_INVALID 30643 15.20 19.63 13.33 23 DCC_CHECK_NEGATIVE 30504 50.99 19.54 64.25 24 MultiRelay 25832 18.23 16.54 18.95 25 HTML_IMAGE_RATIO_02 25550 9.04 16.36 5.95 26 XM_Multi_Part_URI 25255 11.50 16.17 9.53 27 FSL_BULK_SIG 23825 12.15 15.26 10.83 28 RELAYCOUNTRY_META 23742 7.75 15.21 4.60 29 XM_Evil_Numbers_Gen 22474 9.02 14.39 6.76 30 BOTNET_IPINHOSTNAME 19301 6.25 12.36 3.68 31 LOTS_OF_MONEY 19005 10.19 12.17 9.35 32 BOTNET 18461 4.54 11.82 1.47 33 XMSexyCombo_05 17679 5.58 11.32 3.15 34 T_XMDrugObfuBody_14 15389 7.81 9.86 6.95 35 UNTRUSTED_Relay 14700 3.61 9.41 1.16 36 XMSubMetaSx_00 14508 5.53 9.29 3.95 37 XM_B_Phish_Phrases 13333 5.16 8.54 3.74 38 LotsOfNums_01 13189 7.39 8.45 6.94 39 HTML_IMAGE_RATIO_04 12770 5.23 8.18 3.98 40 XM_H_Long_From01 12636 9.93 8.09 10.70 41 TooManyTo_001 11903 8.03 7.62 8.20 42 BAYES_80 11564 4.65 7.41 3.48 43 TR_XM_DocInvoice 11562 4.71 7.40 3.58 44 BAYES_60 11018 6.70 7.06 6.55 45 DKIM_INVALID 10671 5.96 6.83 5.58 46 ALL_TRUSTED 10390 21.01 6.65 27.07 47 MPART_ALT_DIFF 10024 3.47 6.42 2.22 48 FROM_EXCESS_BASE64 9770 4.01 6.26 3.06 49 XM_UncommonTLD01 9455 4.24 6.06 3.48 50 XMSubNoVowel 7797 5.65 4.99 5.93 51 XMNumbers 7729 3.59 4.95 3.01 52 RCVD_IN_RP_SAFE 7646 6.46 4.90 7.12 53 HTML_IMAGE_RATIO_06 7481 3.32 4.79 2.70 54 MIME_QP_LONG_LINE 7433 5.04 4.76 5.15 55 TM2_M_URI_OPT_OUT 7382 2.63 4.73 1.75 56 XM_SendGrid 7100 4.80 4.55 4.91 57 XM_DIRTYINTL 6986 2.55 4.47 1.73 58 TR_Mismatch_TLD_01 6980 2.53 4.47 1.72 59 RCVD_IN_MSPIKE_H2 6819 4.43 4.37 4.46 60 BAYES_95 6760 2.90 4.33 2.30 61 RCVD_IN_RP_CERTIFIED 6630 5.85 4.25 6.53 62 T_REMOTE_IMAGE 6627 4.55 4.24 4.68 63 XM_UB50 6464 1.82 4.14 0.85 64 T_XMDrugObfuBody_08 6184 2.08 3.96 1.29 65 MIME_HTML_MOSTLY 6113 2.51 3.92 1.92 66 XMSubEmpty 5951 4.75 3.81 5.15 67 URI_HEX 5303 2.02 3.40 1.44 68 XMStrtUSub 5195 3.64 3.33 3.77 69 HTML_IMAGE_RATIO_08 5172 2.35 3.31 1.95 70 XM_CamelCaseFrm001 5071 1.93 3.25 1.38 71 XM_OfRef6 5052 1.91 3.24 1.35 72 XM_SPF_SoftFail 4958 2.28 3.18 1.90 73 T_TooManySym_01 4804 3.65 3.08 3.90 74 MIME_HTML_ONLY_MULTI 4749 1.58 3.04 0.97 75 RCVD_IN_BL_SPAMCOP_NET 4647 1.43 2.98 0.78 76 RELAYCOUNTRY_CA 4431 1.71 2.84 1.23 77 XMSexyCombo_01 4403 1.14 2.82 0.44 78 RCVD_IN_RP_RNBL 4342 0.85 2.78 0.03 79 TM2_M_VERY_LONG_WORD 4260 1.33 2.73 0.74 80 MultiRelay_Combo 4150 0.91 2.66 0.17 81 MultiRelay_CC 4150 0.91 2.66 0.17 82 SHORT_URI_2 4095 1.73 2.62 1.36 83 XMDiploma_00 4065 1.84 2.60 1.52 84 SpammyFromTLD_02 3783 1.01 2.42 0.41 85 HTML_MIME_NO_HTML_TAG 3742 2.43 2.40 2.45 86 RCVD_IN_IADB_LISTED 3561 4.64 2.28 5.63 87 NO_DNS_FOR_FROM 3409 1.77 2.18 1.60 88 SUBJ_ALL_CAPS 3282 5.15 2.10 6.43 89 RCVD_IN_IADB_SPF 3208 4.01 2.05 4.83 90 RCVD_IN_IADB_SENDERID 3076 3.57 1.97 4.25 91 RELAYCOUNTRY_FR 3054 0.73 1.96 0.21 92 RCVD_IN_IADB_DK 3046 3.46 1.95 4.09 93 XM_URI_RBL 2958 0.63 1.89 0.09 94 TooManyTo_002 2941 2.39 1.88 2.61 95 XMSubMetaI_00 2908 1.02 1.86 0.66 96 XM_BadFromFormat 2858 0.68 1.83 0.19 97 DKIM_ADSP_CUSTOM_MED 2840 1.31 1.82 1.09 98 XMGenDplmaNmb 2819 1.20 1.81 0.94 99 TVD_SPACE_RATIO 2699 1.33 1.73 1.16 100 TooManyTo_003 2695 1.72 1.73 1.71 101 SpammyFromTLD_01 2604 1.05 1.67 0.79 102 NML_ADSP_CUSTOM_MED 2534 0.98 1.62 0.71 103 MAILING_LIST_MULTI 2514 2.23 1.61 2.48 104 XMEmptySub 2496 1.35 1.60 1.25 105 BAYES_00 2434 5.77 1.56 7.55 106 XMStockSpam_06 2414 1.23 1.55 1.10 107 URIBL_BLACK 2413 0.48 1.55 0.03 108 TooManyTo_004 2389 1.34 1.53 1.26 109 FILL_THIS_FORM 2354 0.77 1.51 0.46 110 XMSexyCombo_04 2353 0.50 1.51 0.07 111 FILL_THIS_FORM_LONG 2267 0.68 1.45 0.36 112 FSL_THIS_IS_ADV 2225 0.51 1.43 0.12 113 XM_H_Long_From02 2206 0.92 1.41 0.72 114 TooManyTo_005 2202 1.15 1.41 1.04 115 XM_DK_Undo_01 2191 1.79 1.40 1.96 116 BAYES_40 2186 4.44 1.40 5.72 117 T_XMHurry_00 2185 0.70 1.40 0.40 118 XM_UB99 2175 0.42 1.39 0.01 119 XMPhish30 2171 0.67 1.39 0.37 120 XMPhish11 2160 1.15 1.38 1.05 121 URIBL_DBL_SPAM 2157 0.42 1.38 0.02 122 XMHTML_After_End 2154 0.62 1.38 0.29 123 TR_XM_RelayPhish 2063 0.70 1.32 0.44 124 XMBdyGiftCard01 2014 0.78 1.29 0.56 125 SUBJ_DOLLARS 2006 0.48 1.28 0.15 126 XMLngstWrd_00 2003 0.63 1.28 0.36 127 TO_IN_SUBJ 1998 0.74 1.28 0.52 128 UNPARSEABLE_RELAY 1995 2.20 1.28 2.59 129 XMLngstWrd_01 1969 0.61 1.26 0.33 130 XMBody_17 1943 0.57 1.24 0.28 131 T_FILL_THIS_FORM_SHORT 1939 0.99 1.24 0.89 132 XM_UB60 1935 0.40 1.24 0.05 133 T_XMDrugObfuBody_00 1907 0.97 1.22 0.86 134 RELAYCOUNTRY_IT 1826 0.37 1.17 0.04 135 XMLngstWrd_02 1823 0.51 1.17 0.24 136 XMLongAddy 1808 0.39 1.16 0.06 137 SHORT_URI 1774 0.70 1.14 0.51 138 TR_XM_DK_Bayes 1770 3.82 1.13 4.95 139 BAYES_20 1764 2.11 1.13 2.53 140 RCVD_IN_MSPIKE_WL 1763 2.02 1.13 2.39 141 RCVD_IN_MSPIKE_H3 1763 2.02 1.13 2.39 142 BOTNET_NORDNS 1761 0.35 1.13 0.02 143 XMLngstWrd_03 1761 0.43 1.13 0.13 144 T_HTML_TAG_BALANCE_CENTER 1756 0.40 1.12 0.10 145 URI_TRY_3LD 1756 1.25 1.12 1.30 146 RCVD_IN_PSBL 1749 0.40 1.12 0.10 147 XMPhish14 1713 0.50 1.10 0.25 148 XM_B_REG_HTML 1696 0.63 1.09 0.44 149 XMHTMLBadTable_001 1676 0.63 1.07 0.44 150 TR_Symld_Words 1670 1.88 1.07 2.23 151 XMLngstWrd_04 1665 0.39 1.07 0.11 152 RELAYCOUNTRY_IN 1662 0.40 1.06 0.12 153 XMBrknScrpt_02 1649 0.64 1.06 0.46 154 MPART_ALT_DIFF_COUNT 1649 0.44 1.06 0.18 155 TR_XM_DK_Bayes1 1615 3.47 1.03 4.49 156 XM_UB999 1604 0.31 1.03 0.01 157 XM_UB80 1597 0.32 1.02 0.02 158 RDNS_DYNAMIC 1592 0.56 1.02 0.37 159 HTML_FONT_SIZE_HUGE 1577 0.37 1.01 0.09 160 LONG_JUNK_URI3 1551 0.33 0.99 0.05 161 XM_OfRef7 1537 0.43 0.98 0.20 162 REMOVE_BEFORE_LINK 1525 0.42 0.98 0.19 163 XM_B_COPY_HTML 1497 0.73 0.96 0.64 164 RELAYCOUNTRY_GB 1488 0.93 0.95 0.93 165 URI_NOVOWEL 1471 0.56 0.94 0.40 166 RCVD_IN_IADB_VOUCHED 1465 3.00 0.94 3.87 167 XMBody_78 1462 0.54 0.94 0.37 168 XMSubMetaSSx_00 1447 0.41 0.93 0.19 169 HTML_TAG_BALANCE_BODY 1441 0.58 0.92 0.44 170 XM_HighProb1 1438 0.28 0.92 0.01 171 DIET_1 1436 0.41 0.92 0.20 172 FORGED_YAHOO_RCVD 1419 0.29 0.91 0.03 173 XM_ProductURIs 1416 0.92 0.91 0.93 174 TR_LOTS_OF_MONEY2 1412 0.62 0.90 0.49 175 T_MONEY_PERCENT 1412 0.62 0.90 0.49 176 BODY_URI_ONLY 1411 0.30 0.90 0.04 177 TR_XM_DK_Bayes2 1407 2.69 0.90 3.44 178 TR_Mismatch_TLD_02 1394 0.31 0.89 0.06 179 RELAYCOUNTRY_AT 1387 0.33 0.89 0.10 180 HTTPS_HTTP_MISMATCH 1373 0.60 0.88 0.49 181 T_Symld_Words_02 1364 0.55 0.87 0.42 182 BOUNCE_MESSAGE 1326 2.27 0.85 2.87 183 ANY_BOUNCE_MESSAGE 1326 2.27 0.85 2.87 184 XM_PDF 1305 3.57 0.84 4.72 185 XMSubMetaSxObfu_03 1305 0.55 0.84 0.43 186 PLING_QUERY 1287 0.38 0.82 0.19 187 FORGED_GMAIL_RCVD 1285 0.59 0.82 0.49 188 XM_H_PHPOS 1264 0.96 0.81 1.02 189 T_FILL_THIS_FORM_LOAN 1238 0.47 0.79 0.33 190 HTML_IMAGE_ONLY_08 1236 0.32 0.79 0.13 191 HTML_SHORT_LINK_IMG_1 1224 0.25 0.78 0.02 192 XM_H_Long_From03 1223 0.28 0.78 0.06 193 XM_RXBody 1220 0.31 0.78 0.11 194 RELAYCOUNTRY_CN 1174 0.24 0.75 0.02 195 T_TooManySym_02 1165 1.39 0.75 1.66 196 XM_Lotto 1163 0.27 0.74 0.07 197 RELAYCOUNTRY_DE 1139 0.64 0.73 0.61 198 TR_Caps_n_Bayes_99 1121 0.26 0.72 0.06 199 HTML_FONT_SIZE_LARGE 1108 0.31 0.71 0.14 200 BASE64_LENGTH_79_INF 1081 0.26 0.69 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301019 85.01 93.76 81.32 2 DCC_CHECK_NEGATIVE 237841 50.99 19.54 64.25 3 DKIM_SIGNED 233533 68.73 82.11 63.09 4 XM_DK_Pass 228814 67.16 79.84 61.81 5 BAYES_50 216495 51.17 33.82 58.49 6 DKIM_VALID 212861 62.78 75.28 57.50 7 DKIM_VALID_AU 144695 44.51 57.37 39.09 8 XMListUnsubscribeExists 142738 47.91 70.06 38.56 9 T_TM2_M_HEADER_IN_MSG 131635 31.20 20.87 35.56 10 XM_H_QuotedFrom 129942 41.70 57.35 35.10 11 DCC_CHECK 124606 46.97 78.53 33.66 12 ALL_TRUSTED 100199 21.01 6.65 27.07 13 DKIM_VALID_EF 83815 22.71 22.86 22.64 14 HTML_FONT_LOW_CONTRAST 80571 25.44 34.16 21.77 15 MultiRelay 70138 18.23 16.54 18.95 16 FVGT_m_MULTI_ODD 67556 21.05 27.68 18.25 17 XMSubLong 67028 20.15 24.99 18.11 18 MIME_HTML_ONLY 64983 20.87 28.73 17.56 19 LOC_TINY_FONT_1 59308 21.48 34.41 16.02 20 T_KAM_HTML_FONT_INVALID 49347 15.20 19.63 13.33 21 XM_DK_Undo_02 47391 22.92 46.90 12.80 22 BAYES_99 42402 20.68 42.55 11.46 23 FSL_BULK_SIG 40106 12.15 15.26 10.83 24 XM_H_Long_From01 39613 9.93 8.09 10.70 25 BAYES_999 37842 17.96 36.31 10.22 26 XM_Multi_Part_URI 35268 11.50 16.17 9.53 27 LOTS_OF_MONEY 34602 10.19 12.17 9.35 28 XM_Body_Dirty_Words 34591 12.59 20.28 9.34 29 XM_DKIMWhitelistDomains 32937 6.26 0.02 8.90 30 TooManyTo_001 30348 8.03 7.62 8.20 31 BAYES_00 27929 5.77 1.56 7.55 32 RCVD_IN_RP_SAFE 26373 6.46 4.90 7.12 33 T_XMDrugObfuBody_14 25717 7.81 9.86 6.95 34 LotsOfNums_01 25681 7.39 8.45 6.94 35 XM_Evil_Numbers_Gen 25022 9.02 14.39 6.76 36 BAYES_60 24259 6.70 7.06 6.55 37 RCVD_IN_RP_CERTIFIED 24181 5.85 4.25 6.53 38 SUBJ_ALL_CAPS 23814 5.15 2.10 6.43 39 HTML_IMAGE_RATIO_02 22028 9.04 16.36 5.95 40 XMSubNoVowel 21944 5.65 4.99 5.93 41 BAYES_40 21164 4.44 1.40 5.72 42 RCVD_IN_IADB_LISTED 20850 4.64 2.28 5.63 43 DKIM_INVALID 20672 5.96 6.83 5.58 44 IN_ZIMBRA_NJ_WHITELIST 20554 3.92 0.03 5.55 45 TR_DCC_Bayes_99 20256 13.65 33.03 5.47 46 MIME_QP_LONG_LINE 19072 5.04 4.76 5.15 47 XMSubEmpty 19062 4.75 3.81 5.15 48 TR_XM_DK_Bayes 18340 3.82 1.13 4.95 49 XM_SendGrid 18173 4.80 4.55 4.91 50 RCVD_IN_IADB_SPF 17887 4.01 2.05 4.83 51 XM_PDF 17480 3.57 0.84 4.72 52 T_REMOTE_IMAGE 17327 4.55 4.24 4.68 53 RELAYCOUNTRY_META 17021 7.75 15.21 4.60 54 TR_XM_DK_Bayes1 16636 3.47 1.03 4.49 55 RCVD_IN_MSPIKE_H2 16516 4.43 4.37 4.46 56 RCVD_IN_IADB_SENDERID 15721 3.57 1.97 4.25 57 RCVD_IN_IADB_DK 15154 3.46 1.95 4.09 58 HTML_IMAGE_RATIO_04 14731 5.23 8.18 3.98 59 XMSubMetaSx_00 14609 5.53 9.29 3.95 60 T_TooManySym_01 14420 3.65 3.08 3.90 61 RCVD_IN_IADB_VOUCHED 14339 3.00 0.94 3.87 62 XMStrtUSub 13940 3.64 3.33 3.77 63 XM_B_Phish_Phrases 13826 5.16 8.54 3.74 64 BOTNET_IPINHOSTNAME 13613 6.25 12.36 3.68 65 TR_XM_DocInvoice 13243 4.71 7.40 3.58 66 BAYES_80 12883 4.65 7.41 3.48 67 XM_UncommonTLD01 12882 4.24 6.06 3.48 68 TR_XM_DK_Bayes2 12745 2.69 0.90 3.44 69 XMSexyCombo_05 11666 5.58 11.32 3.15 70 FROM_EXCESS_BASE64 11309 4.01 6.26 3.06 71 XMNumbers 11146 3.59 4.95 3.01 72 ANY_BOUNCE_MESSAGE 10631 2.27 0.85 2.87 73 BOUNCE_MESSAGE 10630 2.27 0.85 2.87 74 HTML_IMAGE_RATIO_06 9988 3.32 4.79 2.70 75 TooManyTo_002 9651 2.39 1.88 2.61 76 UNPARSEABLE_RELAY 9604 2.20 1.28 2.59 77 BAYES_20 9347 2.11 1.13 2.53 78 RCVD_IN_IADB_OPTIN 9214 1.92 0.59 2.49 79 MAILING_LIST_MULTI 9198 2.23 1.61 2.48 80 HTML_MIME_NO_HTML_TAG 9071 2.43 2.40 2.45 81 RCVD_IN_MSPIKE_WL 8852 2.02 1.13 2.39 82 RCVD_IN_MSPIKE_H3 8849 2.02 1.13 2.39 83 BAYES_95 8497 2.90 4.33 2.30 84 TVD_RCVD_IP 8456 1.73 0.41 2.28 85 HELO_NODOT 8450 1.70 0.32 2.28 86 TR_Symld_Words 8245 1.88 1.07 2.23 87 MPART_ALT_DIFF 8220 3.47 6.42 2.22 88 IN_HORDE_ADDRESS_BOOK 7615 1.47 0.08 2.06 89 XM_DK_Undo_01 7240 1.79 1.40 1.96 90 HTML_IMAGE_RATIO_08 7210 2.35 3.31 1.95 91 MIME_HTML_MOSTLY 7100 2.51 3.92 1.92 92 XM_SPF_SoftFail 7021 2.28 3.18 1.90 93 INVALID_MSGID 6929 1.38 0.21 1.87 94 TO_MALFORMED 6694 1.29 0.06 1.81 95 MSGID_NOFQDN1 6621 1.26 0.02 1.79 96 TM2_M_URI_OPT_OUT 6484 2.63 4.73 1.75 97 XM_DIRTYINTL 6421 2.55 4.47 1.73 98 BAYES_05 6367 1.39 0.61 1.72 99 TR_Mismatch_TLD_01 6359 2.53 4.47 1.72 100 TooManyTo_003 6337 1.72 1.73 1.71 101 T_TooManySym_02 6148 1.39 0.75 1.66 102 NO_DNS_FOR_FROM 5926 1.77 2.18 1.60 103 XMCapTrack 5717 1.27 0.62 1.54 104 XMDiploma_00 5620 1.84 2.60 1.52 105 BOTNET 5452 4.54 11.82 1.47 106 URI_HEX 5312 2.02 3.40 1.44 107 XM_CamelCaseFrm001 5098 1.93 3.25 1.38 108 SHORT_URI_2 5033 1.73 2.62 1.36 109 XM_GoogleGroups 5019 1.11 0.53 1.36 110 XM_OfRef6 4982 1.91 3.24 1.35 111 URI_TRY_3LD 4810 1.25 1.12 1.30 112 T_XMDrugObfuBody_08 4768 2.08 3.96 1.29 113 TooManyTo_004 4666 1.34 1.53 1.26 114 XMEmptySub 4610 1.35 1.60 1.25 115 RELAYCOUNTRY_CA 4569 1.71 2.84 1.23 116 UNTRUSTED_Relay 4305 3.61 9.41 1.16 117 TVD_SPACE_RATIO 4289 1.33 1.73 1.16 118 XMStockSpam_06 4064 1.23 1.55 1.10 119 DKIM_ADSP_CUSTOM_MED 4050 1.31 1.82 1.09 120 XMPhish11 3898 1.15 1.38 1.05 121 TooManyTo_005 3864 1.15 1.41 1.04 122 XM_H_PHPOS 3779 0.96 0.81 1.02 123 USER_IN_DEF_DKIM_WL 3777 0.74 0.08 1.02 124 MIME_HTML_ONLY_MULTI 3575 1.58 3.04 0.97 125 XMGenDplmaNmb 3493 1.20 1.81 0.94 126 XM_ProductURIs 3442 0.92 0.91 0.93 127 RELAYCOUNTRY_GB 3426 0.93 0.95 0.93 128 T_FILL_THIS_FORM_SHORT 3284 0.99 1.24 0.89 129 T_XMDrugObfuBody_00 3189 0.97 1.22 0.86 130 XM_UB50 3131 1.82 4.14 0.85 131 T_TooManySym_03 2994 0.65 0.28 0.81 132 SpammyFromTLD_01 2940 1.05 1.67 0.79 133 PP_MIME_FAKE_ASCII_TEXT 2929 0.70 0.49 0.79 134 RCVD_IN_BL_SPAMCOP_NET 2891 1.43 2.98 0.78 135 USER_IN_WHITELIST 2794 0.53 0.00 0.75 136 TR_MetaPhish_Combo_01 2768 0.71 0.62 0.75 137 TM2_M_VERY_LONG_WORD 2747 1.33 2.73 0.74 138 XM_H_Long_From02 2655 0.92 1.41 0.72 139 XMNoVowels 2648 0.69 0.63 0.72 140 NML_ADSP_CUSTOM_MED 2639 0.98 1.62 0.71 141 UPPERCASE_50_75 2524 0.54 0.20 0.68 142 XMGappySubj_01 2520 0.68 0.67 0.68 143 TM2_M_A_HREF_HREF 2508 0.67 0.64 0.68 144 XMSubMetaI_00 2436 1.02 1.86 0.66 145 XM_H_PHPMailer 2391 0.64 0.63 0.65 146 T_OBFU_PDF_ATTACH 2385 0.52 0.22 0.64 147 XM_B_COPY_HTML 2359 0.73 0.96 0.64 148 RELAYCOUNTRY_DE 2243 0.64 0.73 0.61 149 SHORT_HELO_AND_INLINE_IMAGE 2167 0.43 0.08 0.59 150 XMBdyGiftCard01 2065 0.78 1.29 0.56 151 XM_ShortIntro_01 2056 0.47 0.28 0.56 152 MISSING_HEADERS 2028 0.52 0.45 0.55 153 XM_D_tchamptons_WL 2020 0.38 0.00 0.55 154 LOW_PRICE 2017 0.58 0.68 0.54 155 TO_NO_BRKTS_HTML_ONLY 2009 0.46 0.28 0.54 156 RCVD_IN_SORBS_DUL 1937 0.41 0.15 0.52 157 TO_IN_SUBJ 1920 0.74 1.28 0.52 158 SHORT_URI 1901 0.70 1.14 0.51 159 T_MONEY_PERCENT 1828 0.62 0.90 0.49 160 TR_LOTS_OF_MONEY2 1828 0.62 0.90 0.49 161 FORGED_GMAIL_RCVD 1827 0.59 0.82 0.49 162 HTTPS_HTTP_MISMATCH 1806 0.60 0.88 0.49 163 T_MANY_PILL_PRICE 1724 0.33 0.00 0.47 164 FILL_THIS_FORM 1721 0.77 1.51 0.46 165 HTML_IMAGE_ONLY_32 1717 0.41 0.27 0.46 166 XMBrknScrpt_02 1695 0.64 1.06 0.46 167 HTML_IMAGE_ONLY_28 1693 0.47 0.51 0.46 168 TR_XM_RelayPhish 1634 0.70 1.32 0.44 169 HTML_TAG_BALANCE_BODY 1632 0.58 0.92 0.44 170 XMMoneyMeta_00 1631 0.48 0.59 0.44 171 XM_B_REG_HTML 1629 0.63 1.09 0.44 172 XMHTMLBadTable_001 1622 0.63 1.07 0.44 173 XMSexyCombo_01 1619 1.14 2.82 0.44 174 XMBody_95 1588 0.35 0.18 0.43 175 XMSubMetaSxObfu_03 1580 0.55 0.84 0.43 176 MIME_BASE64_TEXT 1561 0.46 0.55 0.42 177 AC_DIV_BONANZA 1559 0.33 0.12 0.42 178 T_Symld_Words_02 1546 0.55 0.87 0.42 179 RELAYCOUNTRY_AU 1533 0.50 0.69 0.41 180 XMSubMetaSxObfu_02 1527 0.38 0.31 0.41 181 SpammyFromTLD_02 1526 1.01 2.42 0.41 182 T_XMHurry_00 1483 0.70 1.40 0.40 183 URI_NOVOWEL 1475 0.56 0.94 0.40 184 XMRcvdHeader_15 1453 0.28 0.00 0.39 185 TM2_M_BODY_EMPTY 1431 0.35 0.25 0.39 186 XMBody_78 1379 0.54 0.94 0.37 187 RDNS_DYNAMIC 1375 0.56 1.02 0.37 188 XMDateMe_00 1374 0.37 0.36 0.37 189 XMPhish30 1373 0.67 1.39 0.37 190 HTML_IMAGE_ONLY_24 1343 0.43 0.60 0.36 191 FILL_THIS_FORM_LONG 1336 0.68 1.45 0.36 192 XMLngstWrd_00 1317 0.63 1.28 0.36 193 T_HTML_ATTACH 1296 0.27 0.08 0.35 194 HTML_FONT_FACE_BAD 1267 0.44 0.67 0.34 195 T_FILL_THIS_FORM_LOAN 1239 0.47 0.79 0.33 196 XMLngstWrd_01 1218 0.61 1.26 0.33 197 DKIM_ADSP_NXDOMAIN 1216 0.37 0.46 0.33 198 XM_B_TRADE_HTML 1214 0.36 0.44 0.33 199 T_TooManySym_04 1195 0.24 0.03 0.32 200 XM_S_JOY_D 1172 0.41 0.63 0.32 ----------------------------------------------------------------------