Email: 598567 Autolearn: 0 AvgScore: 2.37 AvgScanTime: 4.41 sec Spam: 170363 Autolearn: 0 AvgScore: 12.51 AvgScanTime: 5.48 sec Ham: 428204 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 3.99 sec Time Spent Running SA: 733.13 hours Time Spent Processing Spam: 259.10 hours Time Spent Processing Ham: 474.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161866 87.18 95.01 84.07 2 DKIM_SIGNED 145353 65.38 85.32 57.45 3 XM_DK_Pass 141176 63.86 82.87 56.30 4 DCC_CHECK 135622 42.95 79.61 28.37 5 DKIM_VALID 131661 58.95 77.28 51.65 6 XMListUnsubscribeExists 123880 45.91 72.72 35.25 7 DKIM_VALID_AU 100017 42.22 58.71 35.66 8 XM_H_QuotedFrom 93085 45.73 54.64 42.19 9 XM_DK_Undo_02 86378 22.52 50.70 11.30 10 BAYES_99 79087 20.59 46.42 10.31 11 BAYES_999 67328 17.80 39.52 9.17 12 HTML_FONT_LOW_CONTRAST 63740 25.22 37.41 20.37 13 TR_DCC_Bayes_99 62484 13.95 36.68 4.91 14 LOC_TINY_FONT_1 60504 20.06 35.51 13.91 15 MIME_HTML_ONLY 51974 18.93 30.51 14.33 16 BAYES_50 51006 46.17 29.94 52.63 17 XMSubLong 45207 20.40 26.54 17.96 18 FVGT_m_MULTI_ODD 45159 19.37 26.51 16.53 19 DKIM_VALID_EF 40161 21.35 23.57 20.46 20 T_KAM_HTML_FONT_INVALID 36799 14.79 21.60 12.09 21 T_TM2_M_HEADER_IN_MSG 35531 29.25 20.86 32.58 22 XM_Body_Dirty_Words 33347 11.55 19.57 8.35 23 DCC_CHECK_NEGATIVE 30301 54.91 17.79 69.68 24 MultiRelay 27757 16.84 16.29 17.06 25 XM_Multi_Part_URI 27725 10.60 16.27 8.34 26 RELAYCOUNTRY_META 26301 7.66 15.44 4.56 27 HTML_IMAGE_RATIO_02 25629 7.74 15.04 4.84 28 XM_Evil_Numbers_Gen 24499 10.36 14.38 8.76 29 FSL_BULK_SIG 23402 9.37 13.74 7.64 30 BOTNET 21754 4.86 12.77 1.72 31 BOTNET_IPINHOSTNAME 21447 5.82 12.59 3.13 32 LOTS_OF_MONEY 21132 9.13 12.40 7.83 33 XMSexyCombo_05 18469 4.97 10.84 2.63 34 XMSubMetaSx_00 17258 5.40 10.13 3.52 35 T_XMDrugObfuBody_14 16318 7.26 9.58 6.34 36 UNTRUSTED_Relay 15231 3.34 8.94 1.11 37 LotsOfNums_01 15025 6.89 8.82 6.12 38 HTML_IMAGE_RATIO_04 14787 12.87 8.68 14.53 39 DKIM_INVALID 13692 6.43 8.04 5.79 40 XM_B_Phish_Phrases 13430 5.17 7.88 4.09 41 BAYES_80 13197 4.44 7.75 3.13 42 XM_H_Long_From01 12837 8.25 7.54 8.53 43 MPART_ALT_DIFF 11659 3.63 6.84 2.35 44 TR_XM_DocInvoice 11644 4.75 6.83 3.92 45 BAYES_60 11432 6.03 6.71 5.77 46 RCVD_IN_MSPIKE_H2 11325 5.62 6.65 5.21 47 TooManyTo_001 11179 7.52 6.56 7.90 48 XM_UncommonTLD01 11068 4.05 6.50 3.08 49 FROM_EXCESS_BASE64 10835 3.69 6.36 2.62 50 XMNumbers 8868 3.58 5.21 2.94 51 BAYES_95 8507 2.92 4.99 2.09 52 TM2_M_URI_OPT_OUT 8264 2.49 4.85 1.56 53 HTML_IMAGE_RATIO_06 8161 4.05 4.79 3.76 54 XM_SendGrid 8062 4.41 4.73 4.28 55 MIME_QP_LONG_LINE 7977 4.56 4.68 4.51 56 RCVD_IN_RP_SAFE 7651 5.96 4.49 6.55 57 XM_DIRTYINTL 7356 2.31 4.32 1.52 58 XMStrtUSub 7340 8.29 4.31 9.87 59 MIME_HTML_MOSTLY 7087 2.46 4.16 1.78 60 T_REMOTE_IMAGE 7046 4.16 4.14 4.17 61 ALL_TRUSTED 6715 16.55 3.94 21.56 62 RCVD_IN_RP_CERTIFIED 6649 5.38 3.90 5.96 63 T_XMDrugObfuBody_08 6105 1.87 3.58 1.19 64 XM_UB50 6060 1.52 3.56 0.72 65 RELAYCOUNTRY_CA 5895 1.82 3.46 1.16 66 XM_SPF_SoftFail 5846 2.28 3.43 1.82 67 MIME_HTML_ONLY_MULTI 5806 1.75 3.41 1.09 68 XM_OfRef6 5673 1.75 3.33 1.12 69 T_TooManySym_01 5664 3.44 3.32 3.48 70 NO_DNS_FOR_FROM 5285 2.35 3.10 2.05 71 XM_CamelCaseFrm001 5251 1.83 3.08 1.34 72 HTML_IMAGE_RATIO_08 5190 2.00 3.05 1.59 73 URI_HEX 4991 1.74 2.93 1.27 74 RCVD_IN_BL_SPAMCOP_NET 4895 1.24 2.87 0.59 75 SUBJ_ALL_CAPS 4892 4.52 2.87 5.18 76 XMSubNoVowel 4658 5.00 2.73 5.90 77 XMSexyCombo_01 4575 1.10 2.69 0.46 78 RCVD_IN_IADB_LISTED 4289 4.34 2.52 5.06 79 XMDiploma_00 4066 1.54 2.39 1.20 80 SpammyFromTLD_01 3961 1.14 2.33 0.67 81 XM_URI_RBL 3938 0.73 2.31 0.10 82 RCVD_IN_IADB_SPF 3872 3.76 2.27 4.35 83 HTML_MIME_NO_HTML_TAG 3853 2.03 2.26 1.94 84 TM2_M_VERY_LONG_WORD 3813 1.14 2.24 0.71 85 RCVD_IN_RP_RNBL 3738 0.65 2.19 0.03 86 XM_BadFromFormat 3686 0.75 2.16 0.19 87 RCVD_IN_IADB_SENDERID 3677 3.32 2.16 3.79 88 RCVD_IN_IADB_DK 3635 3.25 2.13 3.69 89 TR_Mismatch_TLD_01 3484 0.91 2.05 0.46 90 SpammyFromTLD_02 3435 0.78 2.02 0.29 91 MultiRelay_Combo 3353 0.70 1.97 0.19 92 MultiRelay_CC 3353 0.70 1.97 0.19 93 XM_H_Long_From02 3326 1.07 1.95 0.72 94 XMSubEmpty 3296 2.06 1.93 2.11 95 MAILING_LIST_MULTI 3136 2.34 1.84 2.54 96 XM_UB99 3123 0.55 1.83 0.05 97 XM_DK_Undo_01 2879 1.71 1.69 1.72 98 XMBdyGiftCard01 2832 0.79 1.66 0.44 99 T_XMDrugObfuBody_00 2812 0.95 1.65 0.68 100 XMBody_17 2741 0.81 1.61 0.49 101 XMGenDplmaNmb 2731 1.04 1.60 0.82 102 FSL_THIS_IS_ADV 2691 0.48 1.58 0.04 103 T_XMHurry_00 2678 0.87 1.57 0.59 104 SHORT_URI_2 2632 0.88 1.54 0.61 105 URIBL_BLACK 2594 0.45 1.52 0.03 106 XMSexyCombo_04 2583 0.54 1.52 0.16 107 FILL_THIS_FORM 2570 0.72 1.51 0.41 108 UNPARSEABLE_RELAY 2556 2.07 1.50 2.30 109 XMHTML_After_End 2505 0.62 1.47 0.28 110 RELAYCOUNTRY_FR 2452 0.57 1.44 0.23 111 XM_B_REG_HTML 2432 0.68 1.43 0.38 112 XMPhish30 2359 0.59 1.38 0.27 113 FILL_THIS_FORM_LONG 2356 0.63 1.38 0.33 114 XMSubMetaI_00 2310 0.74 1.36 0.49 115 XM_UB999 2304 0.41 1.35 0.03 116 XM_UB60 2302 0.45 1.35 0.09 117 RCVD_IN_PSBL 2289 0.44 1.34 0.08 118 TR_XM_RelayPhish 2226 0.67 1.31 0.42 119 DKIM_ADSP_CUSTOM_MED 2210 1.01 1.30 0.90 120 TR_Caps_n_Bayes_99 2209 0.42 1.30 0.07 121 XMStockSpam_06 2154 1.17 1.26 1.14 122 RELAYCOUNTRY_IT 2145 0.38 1.26 0.04 123 URI_TRY_3LD 2132 1.05 1.25 0.97 124 XMPhish11 2081 1.12 1.22 1.08 125 BAYES_40 2066 4.14 1.21 5.30 126 XM_HighProb1 2056 0.35 1.21 0.01 127 BAYES_00 2035 9.74 1.19 13.13 128 BODY_URI_ONLY 2023 0.37 1.19 0.05 129 URIBL_DBL_SPAM 1985 0.34 1.17 0.01 130 T_TooManySym_02 1968 1.35 1.16 1.42 131 RCVD_IN_MSPIKE_H3 1944 1.57 1.14 1.74 132 RCVD_IN_MSPIKE_WL 1944 1.57 1.14 1.74 133 FROM_MISSP_EH_MATCH 1942 0.33 1.14 0.01 134 RCVD_IN_IADB_VOUCHED 1894 2.85 1.11 3.54 135 XMPhish14 1886 0.54 1.11 0.31 136 XM_ProductURIs 1876 0.81 1.10 0.69 137 SUBJ_DOLLARS 1861 0.54 1.09 0.33 138 BOTNET_NORDNS 1859 0.33 1.09 0.03 139 TR_Symld_Words 1828 1.54 1.07 1.72 140 FORGED_GMAIL_RCVD 1823 0.62 1.07 0.45 141 XM_OfRef7 1793 0.40 1.05 0.14 142 XM_Lotto 1789 0.52 1.05 0.31 143 BAYES_20 1761 2.79 1.03 3.48 144 NML_ADSP_CUSTOM_MED 1740 0.75 1.02 0.65 145 MPART_ALT_DIFF_COUNT 1707 0.46 1.00 0.25 146 HTTPS_HTTP_MISMATCH 1704 0.61 1.00 0.46 147 DIET_1 1702 0.38 1.00 0.14 148 T_FILL_THIS_FORM_SHORT 1683 0.85 0.99 0.80 149 TR_XM_DK_Bayes 1653 3.27 0.97 4.18 150 TooManyTo_002 1642 1.97 0.96 2.38 151 RELAYCOUNTRY_GB 1628 0.95 0.96 0.94 152 REMOVE_BEFORE_LINK 1621 0.41 0.95 0.19 153 MONEY_FRAUD_8 1593 0.27 0.94 0.00 154 BODY_ENHANCEMENT 1586 0.28 0.93 0.03 155 XM_Body_Obfu01 1583 0.42 0.93 0.22 156 HTML_SHORT_LINK_IMG_1 1582 0.28 0.93 0.03 157 XMBody_78 1565 0.52 0.92 0.36 158 XMEmptySub 1552 0.58 0.91 0.46 159 XM_B_COPY_HTML 1538 0.52 0.90 0.36 160 PLING_QUERY 1536 0.39 0.90 0.18 161 HTML_IMAGE_ONLY_08 1536 0.35 0.90 0.13 162 HTML_TAG_BALANCE_BODY 1535 0.51 0.90 0.35 163 RELAYCOUNTRY_AT 1534 0.36 0.90 0.15 164 XMSlimDrugH 1531 0.42 0.90 0.23 165 T_Symld_Words_02 1524 0.57 0.89 0.44 166 XM_H_PHPOS 1523 0.99 0.89 1.03 167 TR_LOTS_OF_MONEY2 1484 0.48 0.87 0.33 168 T_MONEY_PERCENT 1484 0.48 0.87 0.33 169 RDNS_DYNAMIC 1481 0.49 0.87 0.33 170 TR_XM_DK_Bayes1 1473 2.85 0.86 3.64 171 XM_UB80 1459 0.26 0.86 0.03 172 XMSubMetaSxObfu_03 1436 0.43 0.84 0.26 173 TooManyTo_003 1433 1.31 0.84 1.50 174 XMBrknScrpt_02 1430 0.62 0.84 0.53 175 XMNoVowels 1420 0.85 0.83 0.86 176 TR_XM_DK_Bayes2 1410 2.28 0.83 2.85 177 XMClaimOffer 1385 0.39 0.81 0.22 178 XM_PDF 1371 3.37 0.80 4.39 179 TVD_SPACE_RATIO 1358 0.62 0.80 0.55 180 TR_LOTS_OF_MONEY3 1335 0.31 0.78 0.12 181 T_FILL_THIS_FORM_LOAN 1297 0.42 0.76 0.29 182 RCVD_IN_IADB_OPTIN 1270 1.80 0.75 2.22 183 URI_NOVOWEL 1256 0.45 0.74 0.34 184 XM_H_PHPMailer 1253 0.69 0.74 0.67 185 XMLngstWrd_00 1247 0.45 0.73 0.34 186 XMLongAddy 1238 0.26 0.73 0.08 187 XMLngstWrd_01 1213 0.42 0.71 0.31 188 RELAYCOUNTRY_ES 1203 0.22 0.71 0.03 189 ADMITS_SPAM 1198 0.21 0.70 0.02 190 RELAYCOUNTRY_CN 1186 0.24 0.70 0.05 191 RELAYCOUNTRY_AU 1184 0.51 0.69 0.43 192 XM_S_JOY_D 1168 0.35 0.69 0.21 193 XMLngstWrd_02 1147 0.37 0.67 0.25 194 XMMoneyMeta_00 1145 0.55 0.67 0.51 195 HTML_IMAGE_ONLY_28 1140 0.48 0.67 0.41 196 TooManyTo_004 1115 0.96 0.65 1.07 197 T_HTML_TAG_BALANCE_CENTER 1107 0.28 0.65 0.13 198 XMHTMLBadTable_001 1104 0.35 0.65 0.23 199 HTML_FONT_FACE_BAD 1090 9.02 0.64 12.35 200 XMSubMetaSSx_00 1084 0.26 0.64 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 359976 87.18 95.01 84.07 2 DCC_CHECK_NEGATIVE 298391 54.91 17.79 69.68 3 DKIM_SIGNED 245989 65.38 85.32 57.45 4 XM_DK_Pass 241096 63.86 82.87 56.30 5 BAYES_50 225349 46.17 29.94 52.63 6 DKIM_VALID 221176 58.95 77.28 51.65 7 XM_H_QuotedFrom 180643 45.73 54.64 42.19 8 DKIM_VALID_AU 152714 42.22 58.71 35.66 9 XMListUnsubscribeExists 150934 45.91 72.72 35.25 10 T_TM2_M_HEADER_IN_MSG 139530 29.25 20.86 32.58 11 DCC_CHECK 121470 42.95 79.61 28.37 12 ALL_TRUSTED 92322 16.55 3.94 21.56 13 DKIM_VALID_EF 87628 21.35 23.57 20.46 14 HTML_FONT_LOW_CONTRAST 87221 25.22 37.41 20.37 15 XMSubLong 76898 20.40 26.54 17.96 16 IN_ZIMBRA_NJ_WHITELIST 73336 12.26 0.04 17.13 17 MultiRelay 73055 16.84 16.29 17.06 18 FVGT_m_MULTI_ODD 70784 19.37 26.51 16.53 19 HTML_IMAGE_RATIO_04 62230 12.87 8.68 14.53 20 MIME_HTML_ONLY 61354 18.93 30.51 14.33 21 LOC_TINY_FONT_1 59542 20.06 35.51 13.91 22 BAYES_00 56237 9.74 1.19 13.13 23 HTML_FONT_FACE_BAD 52872 9.02 0.64 12.35 24 T_KAM_HTML_FONT_INVALID 51749 14.79 21.60 12.09 25 XM_DK_Undo_02 48407 22.52 50.70 11.30 26 BAYES_99 44139 20.59 46.42 10.31 27 XMStrtUSub 42267 8.29 4.31 9.87 28 BAYES_999 39245 17.80 39.52 9.17 29 XM_Evil_Numbers_Gen 37506 10.36 14.38 8.76 30 XM_H_Long_From01 36524 8.25 7.54 8.53 31 XM_Body_Dirty_Words 35764 11.55 19.57 8.35 32 XM_Multi_Part_URI 35732 10.60 16.27 8.34 33 TooManyTo_001 33816 7.52 6.56 7.90 34 LOTS_OF_MONEY 33511 9.13 12.40 7.83 35 FSL_BULK_SIG 32698 9.37 13.74 7.64 36 XM_DKIMWhitelistDomains 31676 5.32 0.11 7.40 37 RCVD_IN_RP_SAFE 28029 5.96 4.49 6.55 38 T_XMDrugObfuBody_14 27157 7.26 9.58 6.34 39 LotsOfNums_01 26227 6.89 8.82 6.12 40 RCVD_IN_RP_CERTIFIED 25524 5.38 3.90 5.96 41 XMSubNoVowel 25280 5.00 2.73 5.90 42 DKIM_INVALID 24813 6.43 8.04 5.79 43 BAYES_60 24691 6.03 6.71 5.77 44 BAYES_40 22691 4.14 1.21 5.30 45 RCVD_IN_MSPIKE_H2 22304 5.62 6.65 5.21 46 SUBJ_ALL_CAPS 22171 4.52 2.87 5.18 47 RCVD_IN_IADB_LISTED 21671 4.34 2.52 5.06 48 TR_DCC_Bayes_99 21007 13.95 36.68 4.91 49 HTML_IMAGE_RATIO_02 20717 7.74 15.04 4.84 50 DATE_IN_PAST_03_06 20254 3.50 0.40 4.73 51 RELAYCOUNTRY_META 19525 7.66 15.44 4.56 52 MIME_QP_LONG_LINE 19309 4.56 4.68 4.51 53 XM_PDF 18819 3.37 0.80 4.39 54 RCVD_IN_IADB_SPF 18614 3.76 2.27 4.35 55 XM_SendGrid 18330 4.41 4.73 4.28 56 TR_XM_DK_Bayes 17898 3.27 0.97 4.18 57 T_REMOTE_IMAGE 17874 4.16 4.14 4.17 58 XM_B_Phish_Phrases 17533 5.17 7.88 4.09 59 TR_XM_DocInvoice 16787 4.75 6.83 3.92 60 RCVD_IN_IADB_SENDERID 16223 3.32 2.16 3.79 61 HTML_IMAGE_RATIO_06 16081 4.05 4.79 3.76 62 BAYES_05 15972 2.82 0.55 3.73 63 RCVD_IN_IADB_DK 15789 3.25 2.13 3.69 64 TR_XM_DK_Bayes1 15596 2.85 0.86 3.64 65 RCVD_IN_IADB_VOUCHED 15138 2.85 1.11 3.54 66 XMSubMetaSx_00 15058 5.40 10.13 3.52 67 T_TooManySym_01 14921 3.44 3.32 3.48 68 BAYES_20 14911 2.79 1.03 3.48 69 BAYES_80 13393 4.44 7.75 3.13 70 BOTNET_IPINHOSTNAME 13391 5.82 12.59 3.13 71 XM_UncommonTLD01 13197 4.05 6.50 3.08 72 XMNumbers 12569 3.58 5.21 2.94 73 TR_XM_DK_Bayes2 12218 2.28 0.83 2.85 74 DATE_IN_PAST_06_12 11518 2.05 0.44 2.69 75 ANY_BOUNCE_MESSAGE 11450 2.09 0.62 2.67 76 BOUNCE_MESSAGE 11446 2.09 0.62 2.67 77 XMSexyCombo_05 11269 4.97 10.84 2.63 78 FROM_EXCESS_BASE64 11226 3.69 6.36 2.62 79 MAILING_LIST_MULTI 10865 2.34 1.84 2.54 80 TooManyTo_002 10170 1.97 0.96 2.38 81 MPART_ALT_DIFF 10048 3.63 6.84 2.35 82 UNPARSEABLE_RELAY 9864 2.07 1.50 2.30 83 RCVD_IN_IADB_OPTIN 9519 1.80 0.75 2.22 84 HELO_NODOT 9212 1.61 0.26 2.15 85 TVD_RCVD_IP 9130 1.61 0.29 2.13 86 XMSubEmpty 9028 2.06 1.93 2.11 87 BAYES_95 8947 2.92 4.99 2.09 88 NO_DNS_FOR_FROM 8769 2.35 3.10 2.05 89 HTML_MIME_NO_HTML_TAG 8324 2.03 2.26 1.94 90 IN_HORDE_ADDRESS_BOOK 8285 1.40 0.07 1.93 91 XM_SPF_SoftFail 7781 2.28 3.43 1.82 92 MIME_HTML_MOSTLY 7614 2.46 4.16 1.78 93 RCVD_IN_MSPIKE_WL 7455 1.57 1.14 1.74 94 RCVD_IN_MSPIKE_H3 7455 1.57 1.14 1.74 95 TR_Symld_Words 7374 1.54 1.07 1.72 96 BOTNET 7364 4.86 12.77 1.72 97 XM_DK_Undo_01 7356 1.71 1.69 1.72 98 INVALID_MSGID 6943 1.21 0.16 1.62 99 HTML_IMAGE_RATIO_08 6798 2.00 3.05 1.59 100 TO_MALFORMED 6697 1.13 0.03 1.56 101 XMCapTrack 6675 1.29 0.60 1.56 102 TM2_M_URI_OPT_OUT 6665 2.49 4.85 1.56 103 MSGID_NOFQDN1 6578 1.10 0.01 1.54 104 XM_DIRTYINTL 6495 2.31 4.32 1.52 105 TooManyTo_003 6416 1.31 0.84 1.50 106 T_TooManySym_02 6092 1.35 1.16 1.42 107 XM_CamelCaseFrm001 5720 1.83 3.08 1.34 108 URI_HEX 5431 1.74 2.93 1.27 109 XMDiploma_00 5157 1.54 2.39 1.20 110 XM_GoogleGroups 5137 1.03 0.59 1.20 111 T_XMDrugObfuBody_08 5106 1.87 3.58 1.19 112 RELAYCOUNTRY_CA 4987 1.82 3.46 1.16 113 XM_E_Blogspot 4960 0.85 0.08 1.16 114 XMSubLongNoVowel 4956 0.85 0.08 1.16 115 XMStockSpam_06 4868 1.17 1.26 1.14 116 XM_OfRef6 4803 1.75 3.33 1.12 117 UNTRUSTED_Relay 4735 3.34 8.94 1.11 118 MIME_HTML_ONLY_MULTI 4652 1.75 3.41 1.09 119 XMSubGarbage 4642 0.79 0.04 1.08 120 XMPhish11 4617 1.12 1.22 1.08 121 TooManyTo_004 4603 0.96 0.65 1.07 122 USER_IN_DEF_DKIM_WL 4586 0.80 0.12 1.07 123 XM_H_PHPOS 4413 0.99 0.89 1.03 124 URI_TRY_3LD 4134 1.05 1.25 0.97 125 RELAYCOUNTRY_GB 4031 0.95 0.96 0.94 126 DKIM_ADSP_CUSTOM_MED 3845 1.01 1.30 0.90 127 TooManyTo_005 3835 0.80 0.57 0.90 128 XMNoVowels 3667 0.85 0.83 0.86 129 XMGenDplmaNmb 3492 1.04 1.60 0.82 130 T_FILL_THIS_FORM_SHORT 3417 0.85 0.99 0.80 131 XM_H_Long_From02 3075 1.07 1.95 0.72 132 XM_UB50 3064 1.52 3.56 0.72 133 TM2_M_VERY_LONG_WORD 3031 1.14 2.24 0.71 134 TR_MetaPhish_Combo_01 3003 0.67 0.61 0.70 135 XM_ProductURIs 2962 0.81 1.10 0.69 136 T_XMDrugObfuBody_00 2902 0.95 1.65 0.68 137 SpammyFromTLD_01 2889 1.14 2.33 0.67 138 XM_H_PHPMailer 2878 0.69 0.74 0.67 139 NML_ADSP_CUSTOM_MED 2770 0.75 1.02 0.65 140 T_OBFU_PDF_ATTACH 2770 0.52 0.22 0.65 141 T_TooManySym_03 2742 0.52 0.23 0.64 142 SHORT_URI_2 2614 0.88 1.54 0.61 143 USER_IN_WHITELIST 2577 0.43 0.00 0.60 144 T_XMHurry_00 2537 0.87 1.57 0.59 145 RCVD_IN_BL_SPAMCOP_NET 2533 1.24 2.87 0.59 146 SHORT_HELO_AND_INLINE_IMAGE 2446 0.43 0.07 0.57 147 RELAYCOUNTRY_DE 2351 0.57 0.61 0.55 148 TVD_SPACE_RATIO 2346 0.62 0.80 0.55 149 XMBody_95 2288 0.43 0.16 0.53 150 XMBrknScrpt_02 2257 0.62 0.84 0.53 151 MISSING_HEADERS 2187 0.46 0.35 0.51 152 XMMoneyMeta_00 2168 0.55 0.67 0.51 153 AC_DIV_BONANZA 2133 0.41 0.17 0.50 154 XMSubMetaI_00 2111 0.74 1.36 0.49 155 XMGappySubj_01 2082 0.49 0.51 0.49 156 XMBody_17 2079 0.81 1.61 0.49 157 TR_Mismatch_TLD_01 1990 0.91 2.05 0.46 158 XMSexyCombo_01 1989 1.10 2.69 0.46 159 HTTPS_HTTP_MISMATCH 1977 0.61 1.00 0.46 160 RCVD_IN_SORBS_DUL 1975 0.38 0.17 0.46 161 XMEmptySub 1949 0.58 0.91 0.46 162 FORGED_GMAIL_RCVD 1906 0.62 1.07 0.45 163 XM_ShortIntro_01 1905 0.39 0.24 0.44 164 T_Symld_Words_02 1887 0.57 0.89 0.44 165 XMBdyGiftCard01 1872 0.79 1.66 0.44 166 RELAYCOUNTRY_AU 1854 0.51 0.69 0.43 167 HTML_IMAGE_ONLY_32 1813 0.39 0.32 0.42 168 TR_XM_RelayPhish 1791 0.67 1.31 0.42 169 XMDateMe_00 1779 0.43 0.45 0.42 170 HTML_IMAGE_ONLY_28 1757 0.48 0.67 0.41 171 FILL_THIS_FORM 1753 0.72 1.51 0.41 172 UPPERCASE_50_75 1701 0.32 0.13 0.40 173 XM_USANA_RCVD 1665 0.28 0.00 0.39 174 XM_B_REG_HTML 1637 0.68 1.43 0.38 175 TM2_M_BODY_EMPTY 1588 0.30 0.14 0.37 176 HTML_IMAGE_ONLY_24 1584 0.39 0.43 0.37 177 XM_B_TRADE_HTML 1575 0.43 0.60 0.37 178 XMLKML 1571 0.26 0.00 0.37 179 XM_B_COPY_HTML 1550 0.52 0.90 0.36 180 XMBody_78 1543 0.52 0.92 0.36 181 XMSubMetaSxObfu_02 1542 0.34 0.28 0.36 182 HTML_TAG_BALANCE_BODY 1501 0.51 0.90 0.35 183 PP_MIME_FAKE_ASCII_TEXT 1500 0.39 0.50 0.35 184 XMLngstWrd_00 1463 0.45 0.73 0.34 185 URI_NOVOWEL 1453 0.45 0.74 0.34 186 RDNS_DYNAMIC 1434 0.49 0.87 0.33 187 T_MONEY_PERCENT 1418 0.48 0.87 0.33 188 TR_LOTS_OF_MONEY2 1418 0.48 0.87 0.33 189 FILL_THIS_FORM_LONG 1404 0.63 1.38 0.33 190 SUBJ_DOLLARS 1392 0.54 1.09 0.33 191 TM2_M_A_HREF_HREF 1372 0.40 0.61 0.32 192 SHORT_URI 1336 0.38 0.55 0.31 193 XMPhish14 1332 0.54 1.11 0.31 194 XMLngstWrd_01 1327 0.42 0.71 0.31 195 XM_Lotto 1320 0.52 1.05 0.31 196 HTML_IMAGE_ONLY_20 1317 0.29 0.26 0.31 197 T_TooManySym_04 1304 0.24 0.06 0.30 198 SpammyFromTLD_02 1255 0.78 2.02 0.29 199 T_FILL_THIS_FORM_LOAN 1239 0.42 0.76 0.29 200 DKIM_ADSP_NXDOMAIN 1224 0.38 0.63 0.29 ----------------------------------------------------------------------