Email: 510479 Autolearn: 0 AvgScore: 4.00 AvgScanTime: 3.71 sec Spam: 169920 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 4.49 sec Ham: 340559 Autolearn: 0 AvgScore: -0.36 AvgScanTime: 3.33 sec Time Spent Running SA: 526.65 hours Time Spent Processing Spam: 212.06 hours Time Spent Processing Ham: 314.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163229 88.52 96.06 84.75 2 DKIM_SIGNED 145932 75.67 85.88 70.58 3 XM_DK_Pass 141843 73.81 83.48 68.98 4 DKIM_VALID 134335 69.09 79.06 64.11 5 DCC_CHECK 133258 47.17 78.42 31.58 6 XMListUnsubscribeExists 122123 52.52 71.87 42.87 7 DKIM_VALID_AU 101483 48.40 59.72 42.75 8 XM_H_QuotedFrom 91803 39.41 54.03 32.11 9 XM_DK_Undo_02 84130 25.28 49.51 13.18 10 BAYES_99 76496 23.35 45.02 12.53 11 LOC_TINY_FONT_1 64392 24.48 37.90 17.78 12 BAYES_999 63828 19.85 37.56 11.01 13 HTML_FONT_LOW_CONTRAST 63308 28.39 37.26 23.96 14 TR_DCC_Bayes_99 59558 15.59 35.05 5.89 15 MIME_HTML_ONLY 55823 23.25 32.85 18.46 16 BAYES_50 52657 48.41 30.99 57.10 17 XMSubLong 44997 22.20 26.48 20.07 18 FVGT_m_MULTI_ODD 44884 21.59 26.41 19.18 19 DKIM_VALID_EF 40587 25.06 23.89 25.64 20 T_KAM_HTML_FONT_INVALID 37387 17.18 22.00 14.77 21 XM_Body_Dirty_Words 35806 13.99 21.07 10.45 22 DCC_CHECK_NEGATIVE 33209 50.58 19.54 66.07 23 T_TM2_M_HEADER_IN_MSG 33113 28.35 19.49 32.78 24 MultiRelay 28888 19.75 17.00 21.11 25 XM_Multi_Part_URI 28723 12.71 16.90 10.62 26 HTML_IMAGE_RATIO_02 26516 9.38 15.60 6.28 27 RELAYCOUNTRY_META 26283 8.90 15.47 5.62 28 XMSubMetaSx_00 24206 8.66 14.25 5.87 29 LOTS_OF_MONEY 23793 11.63 14.00 10.44 30 XM_Evil_Numbers_Gen 23429 9.53 13.79 7.41 31 XMSexyCombo_05 22555 6.60 13.27 3.27 32 FSL_BULK_SIG 22434 8.81 13.20 6.62 33 BOTNET 21961 5.02 12.92 1.07 34 BOTNET_IPINHOSTNAME 21761 6.78 12.81 3.78 35 T_XMDrugObfuBody_14 18454 9.05 10.86 8.14 36 HTML_IMAGE_RATIO_04 18358 6.58 10.80 4.47 37 XM_B_Phish_Phrases 16480 6.09 9.70 4.29 38 UNTRUSTED_Relay 15281 4.06 8.99 1.60 39 LotsOfNums_01 14609 8.06 8.60 7.78 40 XM_H_Long_From01 13633 6.45 8.02 5.67 41 MPART_ALT_DIFF 13250 4.15 7.80 2.33 42 TR_XM_DocInvoice 12916 5.00 7.60 3.70 43 BAYES_80 12790 5.23 7.53 4.08 44 XM_UncommonTLD01 12599 4.99 7.41 3.78 45 BAYES_60 12314 6.94 7.25 6.79 46 TooManyTo_001 12136 9.13 7.14 10.12 47 FROM_EXCESS_BASE64 12025 4.56 7.08 3.31 48 DKIM_INVALID 11597 6.58 6.82 6.46 49 HTML_IMAGE_RATIO_06 9356 4.07 5.51 3.36 50 XMNumbers 8734 4.23 5.14 3.78 51 XM_SendGrid 8722 5.39 5.13 5.53 52 TM2_M_URI_OPT_OUT 8445 3.26 4.97 2.41 53 BAYES_95 8071 3.42 4.75 2.75 54 RCVD_IN_RP_SAFE 7997 6.48 4.71 7.37 55 MIME_HTML_MOSTLY 7965 3.08 4.69 2.28 56 T_REMOTE_IMAGE 7476 4.66 4.40 4.79 57 MIME_QP_LONG_LINE 7385 5.61 4.35 6.24 58 XMSexyCombo_01 7367 1.92 4.34 0.72 59 XMStrtUSub 6833 3.75 4.02 3.62 60 XM_DIRTYINTL 6615 2.77 3.89 2.21 61 MIME_HTML_ONLY_MULTI 6612 1.98 3.89 1.02 62 XM_UB50 6331 1.90 3.73 0.98 63 RCVD_IN_BL_SPAMCOP_NET 6171 1.64 3.63 0.64 64 XM_CamelCaseFrm001 6076 2.16 3.58 1.45 65 RCVD_IN_MSPIKE_H2 6025 4.22 3.55 4.56 66 XM_SPF_SoftFail 5874 2.64 3.46 2.23 67 RELAYCOUNTRY_CA 5862 2.06 3.45 1.36 68 XM_OfRef6 5789 2.30 3.41 1.74 69 RCVD_IN_RP_CERTIFIED 5778 5.53 3.40 6.60 70 HTML_IMAGE_RATIO_08 5575 2.44 3.28 2.03 71 SpammyFromTLD_02 5371 1.35 3.16 0.44 72 SUBJ_ALL_CAPS 5250 2.59 3.09 2.34 73 URI_HEX 5172 1.92 3.04 1.36 74 T_TooManySym_01 5012 3.60 2.95 3.92 75 MultiRelay_CC 4903 1.11 2.89 0.23 76 MultiRelay_Combo 4903 1.11 2.89 0.23 77 XMNoVowels 4644 2.69 2.73 2.67 78 RCVD_IN_IADB_LISTED 4272 5.14 2.51 6.45 79 HTML_MIME_NO_HTML_TAG 4230 2.48 2.49 2.48 80 XMDiploma_00 4198 1.87 2.47 1.58 81 T_XMDrugObfuBody_00 4150 1.55 2.44 1.10 82 XMStockSpam_06 3986 1.36 2.35 0.86 83 BOTNET_NORDNS 3797 0.76 2.23 0.02 84 DIET_1 3791 0.93 2.23 0.28 85 RCVD_IN_IADB_SPF 3777 4.44 2.22 5.55 86 RCVD_IN_RP_RNBL 3700 0.75 2.18 0.03 87 XMSubMetaI_00 3635 1.04 2.14 0.48 88 T_XMDrugObfuBody_08 3597 1.65 2.12 1.41 89 RCVD_IN_IADB_SENDERID 3595 3.92 2.12 4.82 90 XMSexyCombo_04 3586 0.80 2.11 0.14 91 RCVD_IN_IADB_DK 3553 3.83 2.09 4.70 92 UNPARSEABLE_RELAY 3371 2.63 1.98 2.95 93 TM2_M_VERY_LONG_WORD 3346 1.16 1.97 0.75 94 XM_URI_RBL 3192 0.70 1.88 0.11 95 T_XMHurry_00 3089 0.88 1.82 0.42 96 URIBL_BLACK 3063 0.62 1.80 0.04 97 XM_RXBody 2952 0.66 1.74 0.12 98 RELAYCOUNTRY_FR 2873 0.75 1.69 0.28 99 XMHTML_After_End 2860 0.83 1.68 0.41 100 XMGenDplmaNmb 2763 1.20 1.63 0.99 101 SpammyFromTLD_01 2763 1.18 1.63 0.96 102 MAILING_LIST_MULTI 2751 2.20 1.62 2.50 103 XM_UB99 2675 0.55 1.57 0.03 104 T_MONEY_PERCENT 2617 0.77 1.54 0.38 105 TR_LOTS_OF_MONEY2 2617 0.77 1.54 0.38 106 NO_DNS_FOR_FROM 2591 1.16 1.52 0.98 107 XMSolicitRefs_0 2512 0.78 1.48 0.43 108 LOW_PRICE 2508 0.58 1.48 0.14 109 URIBL_DBL_SPAM 2505 0.53 1.47 0.05 110 XMLongAddy 2500 0.56 1.47 0.10 111 TR_XM_RelayPhish 2457 0.83 1.45 0.52 112 XM_UB60 2442 0.60 1.44 0.19 113 URI_TRY_3LD 2406 1.16 1.42 1.03 114 XM_ProductURIs 2394 1.08 1.41 0.91 115 RELAYCOUNTRY_CN 2331 0.49 1.37 0.05 116 XM_BadFromFormat 2329 0.60 1.37 0.21 117 XMBdyGiftCard01 2324 0.80 1.37 0.52 118 BAYES_40 2314 3.16 1.36 4.06 119 ALL_TRUSTED 2292 13.01 1.35 18.82 120 XMPhish30 2289 0.75 1.35 0.46 121 DKIM_ADSP_CUSTOM_MED 2249 1.24 1.32 1.19 122 XM_H_Long_From02 2244 0.98 1.32 0.81 123 XM_DK_Undo_01 2188 1.82 1.29 2.09 124 RELAYCOUNTRY_GB 2153 1.14 1.27 1.07 125 MPART_ALT_DIFF_COUNT 2067 0.95 1.22 0.81 126 XM_UB999 2040 0.41 1.20 0.02 127 RCVD_IN_IADB_VOUCHED 2029 3.37 1.19 4.46 128 BAYES_00 2027 5.63 1.19 7.85 129 BODY_URI_ONLY 2008 0.44 1.18 0.07 130 KHOP_DYNAMIC 2004 0.91 1.18 0.78 131 NML_ADSP_CUSTOM_MED 2000 0.99 1.18 0.90 132 TooManyTo_002 1977 2.99 1.16 3.90 133 HTML_IMAGE_ONLY_28 1963 0.67 1.16 0.43 134 HTML_TAG_BALANCE_BODY 1954 0.73 1.15 0.52 135 TVD_SPACE_RATIO_MINFP 1941 0.39 1.14 0.01 136 T_FILL_THIS_FORM_SHORT 1929 1.08 1.14 1.05 137 XMPhish11 1926 1.22 1.13 1.26 138 XMBody_17 1920 0.58 1.13 0.30 139 BAYES_20 1897 2.28 1.12 2.86 140 XM_B_COPY_HTML 1891 0.81 1.11 0.66 141 XM_B_REG_HTML 1873 0.74 1.10 0.55 142 HTML_IMAGE_ONLY_08 1860 0.46 1.09 0.14 143 XM_DKIMWhitelistDomains 1815 6.30 1.07 8.92 144 T_MANY_PILL_PRICE 1805 0.38 1.06 0.04 145 ANY_BOUNCE_MESSAGE 1776 2.79 1.05 3.66 146 BOUNCE_MESSAGE 1775 2.79 1.04 3.66 147 HTML_FONT_SIZE_LARGE 1764 0.50 1.04 0.23 148 TooManyTo_003 1753 2.21 1.03 2.79 149 XMHTMLBadTable_001 1736 0.68 1.02 0.51 150 HTML_SHORT_LINK_IMG_1 1724 0.36 1.01 0.03 151 TR_Symld_Words 1684 1.93 0.99 2.40 152 REMOVE_BEFORE_LINK 1658 0.47 0.98 0.22 153 FILL_THIS_FORM 1644 0.71 0.97 0.58 154 SUBJ_DOLLARS 1641 0.42 0.97 0.14 155 RELAYCOUNTRY_AT 1615 0.43 0.95 0.17 156 BODY_ENHANCEMENT 1611 0.33 0.95 0.02 157 ADVANCE_FEE_5_NEW_MONEY 1603 0.32 0.94 0.00 158 XM_HighProb1 1567 0.32 0.92 0.01 159 T_Symld_Words_02 1552 0.81 0.91 0.77 160 RELAYCOUNTRY_IN 1546 0.41 0.91 0.16 161 HTML_FONT_FACE_BAD 1507 0.58 0.89 0.42 162 XMSubMetaSx_01 1490 0.47 0.88 0.27 163 XM_XX_Yahoo 1464 0.33 0.86 0.07 164 T_HTML_TAG_BALANCE_CENTER 1458 0.35 0.86 0.10 165 RELAYCOUNTRY_BR 1450 0.30 0.85 0.02 166 TR_Sbj_FN_Bdy 1435 0.45 0.84 0.26 167 T_FILL_THIS_FORM_LONG 1432 0.58 0.84 0.45 168 XMMoneyMeta_00 1429 0.60 0.84 0.48 169 XM_H_PHPOS 1420 1.33 0.84 1.57 170 TR_XM_DK_Bayes 1412 3.66 0.83 5.07 171 XMSubMetaSSx_00 1394 0.50 0.82 0.34 172 DEAR_FRIEND 1378 0.31 0.81 0.05 173 XMBody_78 1367 0.55 0.80 0.42 174 XMBrknScrpt_02 1340 0.60 0.79 0.51 175 XM_OfRef7 1336 0.41 0.79 0.21 176 XM_UB80 1335 0.32 0.79 0.09 177 XMPhish14 1325 0.44 0.78 0.27 178 HTTPS_HTTP_MISMATCH 1311 0.55 0.77 0.43 179 XM_PDF 1300 3.73 0.77 5.20 180 INVALID_DATE 1294 0.31 0.76 0.08 181 TR_XM_DK_Bayes1 1291 3.25 0.76 4.49 182 DKIM_ADSP_NXDOMAIN 1277 0.58 0.75 0.49 183 TM2_M_BODY_EMPTY 1265 0.62 0.74 0.56 184 XMClaimOffer 1257 0.41 0.74 0.25 185 BAYES_05 1252 1.50 0.74 1.87 186 FILL_THIS_FORM_LOAN 1250 0.52 0.74 0.42 187 XM_H_Long_From03 1245 0.31 0.73 0.10 188 TR_Mismatch_TLD_02 1243 0.28 0.73 0.06 189 HTML_FONT_SIZE_HUGE 1232 0.33 0.73 0.14 190 RCVD_IN_IADB_OPTIN 1215 2.14 0.72 2.85 191 TR_Caps_n_Bayes_99 1201 0.28 0.71 0.06 192 LONG_JUNK_URI3 1194 0.28 0.70 0.07 193 XMSlimDrugH 1187 0.45 0.70 0.33 194 HK_SCAM_N2 1183 0.23 0.70 0.00 195 FORGED_GMAIL_RCVD 1181 0.58 0.70 0.53 196 XMEmptyBody_01 1180 0.37 0.69 0.20 197 LongTLD 1175 0.32 0.69 0.13 198 XMSexyCombo_02 1162 0.27 0.68 0.07 199 T_TooManySym_02 1149 1.27 0.68 1.56 200 RDNS_DYNAMIC 1148 0.45 0.68 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 288633 88.52 96.06 84.75 2 DKIM_SIGNED 240350 75.67 85.88 70.58 3 XM_DK_Pass 234930 73.81 83.48 68.98 4 DCC_CHECK_NEGATIVE 225011 50.58 19.54 66.07 5 DKIM_VALID 218339 69.09 79.06 64.11 6 BAYES_50 194448 48.41 30.99 57.10 7 XMListUnsubscribeExists 145993 52.52 71.87 42.87 8 DKIM_VALID_AU 145589 48.40 59.72 42.75 9 T_TM2_M_HEADER_IN_MSG 111623 28.35 19.49 32.78 10 XM_H_QuotedFrom 109352 39.41 54.03 32.11 11 DCC_CHECK 107549 47.17 78.42 31.58 12 DKIM_VALID_EF 87321 25.06 23.89 25.64 13 HTML_FONT_LOW_CONTRAST 81597 28.39 37.26 23.96 14 MultiRelay 71907 19.75 17.00 21.11 15 XMSubLong 68341 22.20 26.48 20.07 16 FVGT_m_MULTI_ODD 65310 21.59 26.41 19.18 17 ALL_TRUSTED 64096 13.01 1.35 18.82 18 MIME_HTML_ONLY 62858 23.25 32.85 18.46 19 LOC_TINY_FONT_1 60564 24.48 37.90 17.78 20 T_KAM_HTML_FONT_INVALID 50291 17.18 22.00 14.77 21 XM_DK_Undo_02 44899 25.28 49.51 13.18 22 BAYES_99 42683 23.35 45.02 12.53 23 BAYES_999 37507 19.85 37.56 11.01 24 XM_Multi_Part_URI 36160 12.71 16.90 10.62 25 XM_Body_Dirty_Words 35588 13.99 21.07 10.45 26 LOTS_OF_MONEY 35563 11.63 14.00 10.44 27 TooManyTo_001 34450 9.13 7.14 10.12 28 XM_DKIMWhitelistDomains 30363 6.30 1.07 8.92 29 T_XMDrugObfuBody_14 27736 9.05 10.86 8.14 30 BAYES_00 26734 5.63 1.19 7.85 31 LotsOfNums_01 26512 8.06 8.60 7.78 32 XM_Evil_Numbers_Gen 25238 9.53 13.79 7.41 33 RCVD_IN_RP_SAFE 25097 6.48 4.71 7.37 34 BAYES_60 23113 6.94 7.25 6.79 35 FSL_BULK_SIG 22535 8.81 13.20 6.62 36 RCVD_IN_RP_CERTIFIED 22468 5.53 3.40 6.60 37 DKIM_INVALID 22011 6.58 6.82 6.46 38 RCVD_IN_IADB_LISTED 21970 5.14 2.51 6.45 39 HTML_IMAGE_RATIO_02 21390 9.38 15.60 6.28 40 MIME_QP_LONG_LINE 21234 5.61 4.35 6.24 41 IN_ZIMBRA_NJ_WHITELIST 21126 4.15 0.04 6.20 42 TR_DCC_Bayes_99 20044 15.59 35.05 5.89 43 XMSubMetaSx_00 20003 8.66 14.25 5.87 44 XM_H_Long_From01 19307 6.45 8.02 5.67 45 RELAYCOUNTRY_META 19131 8.90 15.47 5.62 46 RCVD_IN_IADB_SPF 18906 4.44 2.22 5.55 47 XM_SendGrid 18818 5.39 5.13 5.53 48 XM_PDF 17723 3.73 0.77 5.20 49 TR_XM_DK_Bayes 17282 3.66 0.83 5.07 50 RCVD_IN_IADB_SENDERID 16411 3.92 2.12 4.82 51 T_REMOTE_IMAGE 16319 4.66 4.40 4.79 52 RCVD_IN_IADB_DK 16022 3.83 2.09 4.70 53 RCVD_IN_MSPIKE_H2 15522 4.22 3.55 4.56 54 TR_XM_DK_Bayes1 15290 3.25 0.76 4.49 55 HTML_IMAGE_RATIO_04 15215 6.58 10.80 4.47 56 RCVD_IN_IADB_VOUCHED 15178 3.37 1.19 4.46 57 XM_B_Phish_Phrases 14621 6.09 9.70 4.29 58 BAYES_80 13890 5.23 7.53 4.08 59 BAYES_40 13838 3.16 1.36 4.06 60 T_TooManySym_01 13360 3.60 2.95 3.92 61 TooManyTo_002 13266 2.99 1.16 3.90 62 XMNumbers 12872 4.23 5.14 3.78 63 BOTNET_IPINHOSTNAME 12857 6.78 12.81 3.78 64 XM_UncommonTLD01 12857 4.99 7.41 3.78 65 TR_XM_DocInvoice 12587 5.00 7.60 3.70 66 ANY_BOUNCE_MESSAGE 12476 2.79 1.05 3.66 67 BOUNCE_MESSAGE 12476 2.79 1.04 3.66 68 XMStrtUSub 12332 3.75 4.02 3.62 69 HTML_IMAGE_RATIO_06 11432 4.07 5.51 3.36 70 FROM_EXCESS_BASE64 11257 4.56 7.08 3.31 71 TR_XM_DK_Bayes2 11174 2.40 0.62 3.28 72 XMSexyCombo_05 11125 6.60 13.27 3.27 73 UNPARSEABLE_RELAY 10050 2.63 1.98 2.95 74 BAYES_20 9742 2.28 1.12 2.86 75 RCVD_IN_IADB_OPTIN 9693 2.14 0.72 2.85 76 TooManyTo_003 9517 2.21 1.03 2.79 77 BAYES_95 9364 3.42 4.75 2.75 78 XMNoVowels 9093 2.69 2.73 2.67 79 TVD_RCVD_IP 8952 1.84 0.25 2.63 80 MAILING_LIST_MULTI 8505 2.20 1.62 2.50 81 HTML_MIME_NO_HTML_TAG 8441 2.48 2.49 2.48 82 TM2_M_URI_OPT_OUT 8194 3.26 4.97 2.41 83 TR_Symld_Words 8176 1.93 0.99 2.40 84 HELO_NODOT 8045 1.69 0.35 2.36 85 SUBJ_ALL_CAPS 7982 2.59 3.09 2.34 86 MPART_ALT_DIFF 7934 4.15 7.80 2.33 87 IN_HORDE_ADDRESS_BOOK 7845 1.56 0.08 2.30 88 MIME_HTML_MOSTLY 7759 3.08 4.69 2.28 89 XM_SPF_SoftFail 7580 2.64 3.46 2.23 90 XM_DIRTYINTL 7537 2.77 3.89 2.21 91 XM_DK_Undo_01 7118 1.82 1.29 2.09 92 HTML_IMAGE_RATIO_08 6905 2.44 3.28 2.03 93 RCVD_IN_MSPIKE_WL 6579 1.49 0.62 1.93 94 RCVD_IN_MSPIKE_H3 6566 1.48 0.58 1.93 95 BAYES_05 6383 1.50 0.74 1.87 96 INVALID_MSGID 6367 1.32 0.22 1.87 97 XM_OfRef6 5937 2.30 3.41 1.74 98 TO_MALFORMED 5857 1.16 0.03 1.72 99 UNTRUSTED_Relay 5448 4.06 8.99 1.60 100 XMCapTrack 5401 1.27 0.64 1.59 101 XMDiploma_00 5370 1.87 2.47 1.58 102 XM_H_PHPOS 5354 1.33 0.84 1.57 103 T_TooManySym_02 5321 1.27 0.68 1.56 104 TooManyTo_004 5104 1.22 0.66 1.50 105 XM_CamelCaseFrm001 4937 2.16 3.58 1.45 106 T_XMDrugObfuBody_08 4818 1.65 2.12 1.41 107 XM_GoogleGroups 4743 1.10 0.50 1.39 108 URI_HEX 4642 1.92 3.04 1.36 109 RELAYCOUNTRY_CA 4640 2.06 3.45 1.36 110 XMPhish11 4304 1.22 1.13 1.26 111 USER_IN_DEF_DKIM_WL 4229 0.86 0.11 1.24 112 XMGappySubj_01 4110 0.97 0.50 1.21 113 TooManyTo_005 4077 0.98 0.55 1.20 114 DKIM_ADSP_CUSTOM_MED 4056 1.24 1.32 1.19 115 T_XMDrugObfuBody_00 3762 1.55 2.44 1.10 116 RELAYCOUNTRY_GB 3661 1.14 1.27 1.07 117 BOTNET 3644 5.02 12.92 1.07 118 T_FILL_THIS_FORM_SHORT 3587 1.08 1.14 1.05 119 URI_TRY_3LD 3499 1.16 1.42 1.03 120 MIME_HTML_ONLY_MULTI 3480 1.98 3.89 1.02 121 XMGenDplmaNmb 3386 1.20 1.63 0.99 122 XM_UB50 3351 1.90 3.73 0.98 123 NO_DNS_FOR_FROM 3338 1.16 1.52 0.98 124 TR_MetaPhish_Combo_01 3325 0.85 0.59 0.98 125 SpammyFromTLD_01 3262 1.18 1.63 0.96 126 XM_ProductURIs 3103 1.08 1.41 0.91 127 NML_ADSP_CUSTOM_MED 3065 0.99 1.18 0.90 128 XMStockSpam_06 2936 1.36 2.35 0.86 129 TM2_M_A_HREF_HREF 2771 0.76 0.67 0.81 130 XM_H_Long_From02 2763 0.98 1.32 0.81 131 MPART_ALT_DIFF_COUNT 2763 0.95 1.22 0.81 132 MISSING_HEADERS 2718 0.73 0.58 0.80 133 KHOP_DYNAMIC 2647 0.91 1.18 0.78 134 USER_IN_WHITELIST 2634 0.52 0.00 0.77 135 T_Symld_Words_02 2608 0.81 0.91 0.77 136 TM2_M_VERY_LONG_WORD 2564 1.16 1.97 0.75 137 XMSexyCombo_01 2449 1.92 4.34 0.72 138 T_OBFU_PDF_ATTACH 2430 0.53 0.17 0.71 139 XM_H_PHPMailer 2425 0.69 0.64 0.71 140 XM_D_tchamptons_WL 2400 0.47 0.00 0.70 141 XMGappySubj_02 2333 0.48 0.08 0.69 142 T_TooManySym_03 2260 0.49 0.15 0.66 143 RELAYCOUNTRY_DE 2258 0.66 0.66 0.66 144 XM_B_COPY_HTML 2244 0.81 1.11 0.66 145 XMLngstWrd_00 2239 0.58 0.43 0.66 146 SHORT_HELO_AND_INLINE_IMAGE 2193 0.46 0.10 0.64 147 RCVD_IN_BL_SPAMCOP_NET 2183 1.64 3.63 0.64 148 XM_ShortIntro_01 2045 0.46 0.17 0.60 149 XMLngstWrd_01 2038 0.54 0.41 0.60 150 FILL_THIS_FORM 1966 0.71 0.97 0.58 151 TM2_M_BODY_EMPTY 1922 0.62 0.74 0.56 152 RELAYCOUNTRY_AU 1915 0.58 0.61 0.56 153 XM_B_REG_HTML 1885 0.74 1.10 0.55 154 XMBody_95 1882 0.41 0.14 0.55 155 FORGED_GMAIL_RCVD 1801 0.58 0.70 0.53 156 RCVD_IN_SORBS_DUL 1780 0.43 0.25 0.52 157 XMBdyGiftCard01 1778 0.80 1.37 0.52 158 TR_XM_RelayPhish 1771 0.83 1.45 0.52 159 HTML_TAG_BALANCE_BODY 1756 0.73 1.15 0.52 160 XMHTMLBadTable_001 1742 0.68 1.02 0.51 161 XMBrknScrpt_02 1734 0.60 0.79 0.51 162 DKIM_ADSP_NXDOMAIN 1679 0.58 0.75 0.49 163 XMSubMetaI_00 1651 1.04 2.14 0.48 164 AC_DIV_BONANZA 1650 0.38 0.16 0.48 165 XMMoneyMeta_00 1621 0.60 0.84 0.48 166 XMSubMetaSxObfu_02 1612 0.42 0.30 0.47 167 HTML_IMAGE_ONLY_32 1561 0.40 0.27 0.46 168 XMPhish30 1552 0.75 1.35 0.46 169 T_FILL_THIS_FORM_LONG 1546 0.58 0.84 0.45 170 URI_NOVOWEL 1517 0.51 0.65 0.45 171 SpammyFromTLD_02 1506 1.35 3.16 0.44 172 HTTPS_HTTP_MISMATCH 1476 0.55 0.77 0.43 173 HTML_IMAGE_ONLY_28 1465 0.67 1.16 0.43 174 XMDateMe_00 1461 0.40 0.33 0.43 175 XMSolicitRefs_0 1455 0.78 1.48 0.43 176 XMRcvdHeader_15 1448 0.28 0.00 0.43 177 HTML_FONT_FACE_BAD 1446 0.58 0.89 0.42 178 XMBody_78 1429 0.55 0.80 0.42 179 T_XMHurry_00 1423 0.88 1.82 0.42 180 FILL_THIS_FORM_LOAN 1416 0.52 0.74 0.42 181 TO_NO_BRKTS_HTML_ONLY 1405 0.33 0.17 0.41 182 XMHTML_After_End 1400 0.83 1.68 0.41 183 XMSubNoVowel 1366 0.36 0.27 0.40 184 TR_LOTS_OF_MONEY2 1306 0.77 1.54 0.38 185 T_MONEY_PERCENT 1306 0.77 1.54 0.38 186 TVD_SPACE_RATIO 1283 0.35 0.28 0.38 187 XM_B_TRADE_HTML 1262 0.38 0.41 0.37 188 XM_H_Trusted_IP 1243 0.24 0.00 0.36 189 HTML_IMAGE_ONLY_24 1230 0.35 0.32 0.36 190 RDNS_DYNAMIC 1170 0.45 0.68 0.34 191 XMSubMetaSSx_00 1142 0.50 0.82 0.34 192 XMSlimDrugH 1121 0.45 0.70 0.33 193 T_TooManySym_04 1116 0.23 0.03 0.33 194 TR_MetaPhish_Combo_01b 1113 0.24 0.08 0.33 195 XMSubPhish11 1113 0.26 0.12 0.33 196 HTML_IMAGE_ONLY_20 1101 0.34 0.37 0.32 197 XM_H_PHPOS_M 1097 0.33 0.34 0.32 198 T_HTML_ATTACH 1096 0.24 0.06 0.32 199 XMSubMetaSxObfu_03 1091 0.35 0.42 0.32 200 UPPERCASE_50_75 1083 0.24 0.09 0.32 ----------------------------------------------------------------------