Email: 656752 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 4.42 sec Spam: 213439 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 5.08 sec Ham: 443313 Autolearn: 0 AvgScore: 0.26 AvgScanTime: 4.10 sec Time Spent Running SA: 805.75 hours Time Spent Processing Spam: 301.46 hours Time Spent Processing Ham: 504.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 203852 89.79 95.51 87.04 2 DKIM_SIGNED 184221 76.64 86.31 71.99 3 XM_DK_Pass 180092 75.04 84.38 70.54 4 DKIM_VALID 172482 71.50 80.81 67.01 5 DCC_CHECK 167880 48.71 78.65 34.29 6 XMListUnsubscribeExists 158755 56.19 74.38 47.43 7 DKIM_VALID_AU 133490 52.85 62.54 48.18 8 XM_H_QuotedFrom 118663 41.03 55.60 34.01 9 XM_DK_Undo_02 108728 26.80 50.94 15.18 10 BAYES_99 98755 24.93 46.27 14.65 11 BAYES_999 83630 21.33 39.18 12.73 12 HTML_FONT_LOW_CONTRAST 79302 30.64 37.15 27.50 13 LOC_TINY_FONT_1 76970 26.46 36.06 21.83 14 TR_DCC_Bayes_99 75808 16.48 35.52 7.31 15 BAYES_50 66078 48.77 30.96 57.35 16 MIME_HTML_ONLY 64251 22.49 30.10 18.82 17 FVGT_m_MULTI_ODD 61135 24.36 28.64 22.30 18 XMSubLong 56601 22.01 26.52 19.84 19 DKIM_VALID_EF 51656 26.25 24.20 27.24 20 T_KAM_HTML_FONT_INVALID 48172 17.85 22.57 15.58 21 T_TM2_M_HEADER_IN_MSG 45896 27.22 21.50 29.97 22 XM_Body_Dirty_Words 43022 14.10 20.16 11.18 23 DCC_CHECK_NEGATIVE 42189 49.38 19.77 63.63 24 XM_Multi_Part_URI 37233 12.97 17.44 10.82 25 HTML_IMAGE_RATIO_02 35310 10.58 16.54 7.71 26 MultiRelay 34872 17.45 16.34 17.99 27 RELAYCOUNTRY_META 33576 8.55 15.73 5.10 28 XM_Evil_Numbers_Gen 31689 10.20 14.85 7.96 29 BOTNET_IPINHOSTNAME 28593 8.08 13.40 5.53 30 BOTNET 27736 5.00 12.99 1.16 31 LOTS_OF_MONEY 24613 9.77 11.53 8.92 32 FSL_BULK_SIG 23340 7.96 10.94 6.53 33 T_XMDrugObfuBody_14 22577 8.52 10.58 7.53 34 XMSexyCombo_05 21477 5.26 10.06 2.95 35 HTML_IMAGE_RATIO_04 20889 7.10 9.79 5.80 36 UNTRUSTED_Relay 20496 3.91 9.60 1.17 37 XM_B_Phish_Phrases 20173 6.52 9.45 5.11 38 XM_H_Long_From01 17964 6.50 8.42 5.58 39 LotsOfNums_01 17328 8.40 8.12 8.54 40 BAYES_80 16840 5.80 7.89 4.80 41 TR_XM_DocInvoice 16286 4.74 7.63 3.34 42 MPART_ALT_DIFF 15583 4.58 7.30 3.27 43 TooManyTo_001 15373 8.06 7.20 8.47 44 FROM_EXCESS_BASE64 15225 4.84 7.13 3.74 45 XMSubMetaSx_00 15047 4.72 7.05 3.60 46 BAYES_60 12773 7.49 5.98 8.21 47 RCVD_IN_RP_SAFE 11988 8.25 5.62 9.52 48 DKIM_INVALID 11739 5.15 5.50 4.98 49 XM_UncommonTLD01 11626 3.91 5.45 3.17 50 HTML_IMAGE_RATIO_06 11353 3.91 5.32 3.23 51 XMStrtUSub 10979 4.46 5.14 4.13 52 XMNumbers 10177 3.64 4.77 3.10 53 BAYES_95 9863 3.70 4.62 3.25 54 MIME_QP_LONG_LINE 9447 5.01 4.43 5.29 55 XM_SendGrid 9423 4.63 4.41 4.74 56 TM2_M_URI_OPT_OUT 9262 2.77 4.34 2.01 57 HTML_IMAGE_RATIO_08 9166 2.80 4.29 2.09 58 RCVD_IN_RP_CERTIFIED 9028 7.52 4.23 9.11 59 XM_DIRTYINTL 8937 2.58 4.19 1.81 60 XM_UB50 8624 1.84 4.04 0.78 61 T_REMOTE_IMAGE 8550 4.46 4.01 4.67 62 MIME_HTML_MOSTLY 8514 2.88 3.99 2.34 63 MIME_HTML_ONLY_MULTI 8293 2.23 3.89 1.44 64 XM_SPF_SoftFail 8076 2.49 3.78 1.87 65 RCVD_IN_MSPIKE_H2 7819 4.73 3.66 5.24 66 URI_HEX 6883 2.14 3.22 1.62 67 RELAYCOUNTRY_CA 6648 2.03 3.11 1.51 68 XM_CamelCaseFrm001 6486 2.09 3.04 1.63 69 XMDiploma_00 6051 2.21 2.84 1.92 70 XM_URI_RBL 5913 1.02 2.77 0.18 71 T_TooManySym_01 5886 3.60 2.76 4.00 72 XM_OfRef6 5661 2.07 2.65 1.79 73 HTML_MIME_NO_HTML_TAG 5516 2.61 2.58 2.62 74 RCVD_IN_BL_SPAMCOP_NET 5455 1.09 2.56 0.39 75 RCVD_IN_RP_RNBL 5448 0.86 2.55 0.05 76 MultiRelay_CC 5358 0.93 2.51 0.16 77 MultiRelay_Combo 5358 0.93 2.51 0.16 78 RCVD_IN_IADB_LISTED 5348 4.86 2.51 5.99 79 XMBdyGiftCard01 5314 1.32 2.49 0.76 80 BOTNET_NORDNS 5183 0.80 2.43 0.02 81 XM_UB99 4857 0.76 2.28 0.03 82 RCVD_IN_IADB_SPF 4814 4.24 2.26 5.19 83 SUBJ_ALL_CAPS 4740 1.85 2.22 1.68 84 T_XMDrugObfuBody_08 4712 1.67 2.21 1.41 85 RCVD_IN_IADB_SENDERID 4533 3.72 2.12 4.49 86 XM_H_Long_From02 4515 1.32 2.12 0.93 87 RCVD_IN_IADB_DK 4457 3.66 2.09 4.41 88 XMSexyCombo_01 4363 0.93 2.04 0.39 89 XMGenDplmaNmb 4301 1.28 2.02 0.93 90 URI_TRY_3LD 4270 1.37 2.00 1.07 91 XMBody_17 4131 0.93 1.94 0.44 92 XM_DK_Undo_01 4076 1.97 1.91 2.00 93 SUBJ_DOLLARS 3932 0.80 1.84 0.29 94 UNPARSEABLE_RELAY 3926 3.42 1.84 4.18 95 SpammyFromTLD_02 3872 0.78 1.81 0.28 96 MAILING_LIST_MULTI 3844 2.21 1.80 2.41 97 XM_UB999 3729 0.58 1.75 0.02 98 SpammyFromTLD_01 3700 1.05 1.73 0.71 99 TM2_M_VERY_LONG_WORD 3444 1.13 1.61 0.89 100 ALL_TRUSTED 3361 13.10 1.57 18.64 101 XMPhish11 3307 1.32 1.55 1.21 102 T_Symld_Words_02 3288 0.83 1.54 0.49 103 TR_XM_RelayPhish 3262 0.89 1.53 0.59 104 URIBL_BLACK 3240 0.52 1.52 0.04 105 XMSubMetaI_00 3131 0.73 1.47 0.38 106 T_FILL_THIS_FORM_SHORT 3099 1.20 1.45 1.08 107 T_XMHurry_00 3018 0.77 1.41 0.46 108 BAYES_00 2968 4.18 1.39 5.52 109 XMStockSpam_06 2944 1.29 1.38 1.24 110 XMHTML_After_End 2933 0.70 1.37 0.37 111 XM_HighProb1 2925 0.47 1.37 0.04 112 RCVD_IN_PSBL 2907 0.46 1.36 0.02 113 BAYES_40 2845 2.40 1.33 2.91 114 RELAYCOUNTRY_IN 2778 0.51 1.30 0.13 115 MPART_ALT_DIFF_COUNT 2765 0.66 1.30 0.36 116 DIET_1 2754 0.67 1.29 0.37 117 XMPhish14 2740 0.61 1.28 0.28 118 XMClaimOffer 2630 0.53 1.23 0.19 119 TR_Symld_Words 2606 1.68 1.22 1.90 120 RCVD_IN_IADB_VOUCHED 2597 3.16 1.22 4.09 121 REMOVE_BEFORE_LINK 2597 0.56 1.22 0.24 122 RELAYCOUNTRY_CN 2593 0.43 1.21 0.05 123 T_XMDrugObfuBody_00 2583 0.88 1.21 0.72 124 HTML_TAG_BALANCE_BODY 2544 0.74 1.19 0.53 125 XMPhish30 2519 0.64 1.18 0.38 126 XM_ProductURIs 2517 1.01 1.18 0.93 127 TR_Caps_n_Bayes_99 2473 0.40 1.16 0.03 128 T_HTML_TAG_BALANCE_CENTER 2470 0.54 1.16 0.25 129 TooManyTo_002 2441 2.27 1.14 2.82 130 TR_XM_DK_Bayes 2432 2.71 1.14 3.47 131 URIBL_DBL_SPAM 2294 0.37 1.07 0.02 132 RELAYCOUNTRY_NL 2263 0.47 1.06 0.19 133 XMSexyCombo_04 2261 0.41 1.06 0.09 134 XM_UB80 2253 0.37 1.06 0.04 135 BAYES_20 2238 1.69 1.05 2.00 136 XM_UB60 2223 0.41 1.04 0.10 137 RELAYCOUNTRY_FR 2202 0.50 1.03 0.24 138 TooManyTo_003 2193 1.62 1.03 1.90 139 TR_XM_DK_Bayes1 2180 2.54 1.02 3.28 140 XMSlimDrugH 2168 0.55 1.02 0.33 141 TR_XM_DK_Bayes2 2144 2.26 1.00 2.87 142 RELAYCOUNTRY_AT 2074 0.40 0.97 0.12 143 XM_RXBody 2072 0.39 0.97 0.11 144 URI_NOVOWEL 2071 0.60 0.97 0.43 145 XMSubMetaSxObfu_03 2045 0.60 0.96 0.43 146 HTML_FONT_FACE_BAD 2012 0.65 0.94 0.51 147 XM_H_PHPOS 1970 1.11 0.92 1.20 148 TR_Mismatch_TLD_02 1952 0.33 0.91 0.05 149 XM_PDF 1934 3.64 0.91 4.95 150 TR_LOTS_OF_MONEY3 1924 0.46 0.90 0.25 151 XMHTMLBadTable_001 1910 0.57 0.89 0.41 152 XM_H_PHPMailer 1909 0.70 0.89 0.60 153 HTTPS_HTTP_MISMATCH 1860 0.72 0.87 0.64 154 DKIM_ADSP_CUSTOM_MED 1858 0.98 0.87 1.03 155 TooManyTo_004 1783 1.24 0.84 1.43 156 RCVD_IN_MSPIKE_WL 1782 1.86 0.83 2.36 157 RCVD_IN_MSPIKE_H3 1775 1.86 0.83 2.36 158 T_TooManySym_02 1752 1.30 0.82 1.53 159 KHOP_DYNAMIC 1733 0.71 0.81 0.66 160 T_MONEY_PERCENT 1728 0.44 0.81 0.26 161 TR_LOTS_OF_MONEY2 1728 0.44 0.81 0.26 162 XM_Body_Obfu01 1702 0.46 0.80 0.30 163 RELAYCOUNTRY_GB 1692 0.96 0.79 1.04 164 URIBL_RHS_DOB 1638 0.51 0.77 0.38 165 RDNS_DYNAMIC 1637 0.53 0.77 0.42 166 RCVD_IN_IADB_OPTIN 1634 2.00 0.77 2.60 167 XM_Lotto 1634 0.30 0.77 0.07 168 FORGED_GMAIL_RCVD 1630 0.58 0.76 0.50 169 BODY_URI_ONLY 1626 0.34 0.76 0.13 170 XMMoneyMeta_00 1622 0.58 0.76 0.50 171 RELAYCOUNTRY_DE 1601 0.54 0.75 0.44 172 PLING_QUERY 1590 0.48 0.74 0.36 173 RELAYCOUNTRY_IE 1571 0.34 0.74 0.14 174 TooManyTo_005 1569 1.01 0.74 1.15 175 XMBrknScrpt_02 1566 0.60 0.73 0.53 176 BODY_ENHANCEMENT 1535 0.24 0.72 0.01 177 XMBody_78 1520 0.47 0.71 0.36 178 XM_B_REG_HTML 1517 0.61 0.71 0.55 179 XM_XX_Yahoo 1513 0.27 0.71 0.05 180 ANY_BOUNCE_MESSAGE 1495 4.04 0.70 5.65 181 BOUNCE_MESSAGE 1495 4.04 0.70 5.65 182 XM_B_COPY_HTML 1461 0.48 0.68 0.39 183 DKIM_ADSP_NXDOMAIN 1387 0.60 0.65 0.57 184 RELAYCOUNTRY_AU 1380 0.60 0.65 0.58 185 NML_ADSP_CUSTOM_MED 1376 0.72 0.64 0.76 186 HTML_TEXT_INVISIBLE_STYLE 1354 0.21 0.63 0.01 187 TR_MetaPhish_Combo_01 1352 0.67 0.63 0.69 188 PP_MIME_FAKE_ASCII_TEXT 1348 0.32 0.63 0.17 189 FILL_THIS_FORM 1348 0.44 0.63 0.35 190 LongTLD 1331 0.30 0.62 0.14 191 XMCapTrack 1331 1.18 0.62 1.45 192 HTML_IMAGE_ONLY_12 1304 0.40 0.61 0.31 193 ADVANCE_FEE_5_NEW_MONEY 1302 0.20 0.61 0.00 194 HTML_IMAGE_ONLY_20 1299 0.42 0.61 0.33 195 XMSubMetaSSx_00 1287 0.39 0.60 0.28 196 XMSubGiftCard1 1284 0.25 0.60 0.08 197 XMSubMetaSxObfu_02 1282 0.62 0.60 0.63 198 XM_UB95 1273 0.21 0.60 0.03 199 XM_OverStock_LProb 1239 0.23 0.58 0.06 200 DATE_IN_PAST_03_06 1238 0.25 0.58 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 385873 89.79 95.51 87.04 2 DKIM_SIGNED 319120 76.64 86.31 71.99 3 XM_DK_Pass 312726 75.04 84.38 70.54 4 DKIM_VALID 297063 71.50 80.81 67.01 5 DCC_CHECK_NEGATIVE 282092 49.38 19.77 63.63 6 BAYES_50 254218 48.77 30.96 57.35 7 DKIM_VALID_AU 213587 52.85 62.54 48.18 8 XMListUnsubscribeExists 210246 56.19 74.38 47.43 9 DCC_CHECK 152002 48.71 78.65 34.29 10 XM_H_QuotedFrom 150781 41.03 55.60 34.01 11 T_TM2_M_HEADER_IN_MSG 132878 27.22 21.50 29.97 12 HTML_FONT_LOW_CONTRAST 121918 30.64 37.15 27.50 13 DKIM_VALID_EF 120750 26.25 24.20 27.24 14 FVGT_m_MULTI_ODD 98871 24.36 28.64 22.30 15 LOC_TINY_FONT_1 96791 26.46 36.06 21.83 16 XMSubLong 87972 22.01 26.52 19.84 17 MIME_HTML_ONLY 83445 22.49 30.10 18.82 18 ALL_TRUSTED 82641 13.10 1.57 18.64 19 MultiRelay 79764 17.45 16.34 17.99 20 T_KAM_HTML_FONT_INVALID 69084 17.85 22.57 15.58 21 XM_DK_Undo_02 67296 26.80 50.94 15.18 22 BAYES_99 64952 24.93 46.27 14.65 23 BAYES_999 56455 21.33 39.18 12.73 24 XM_Body_Dirty_Words 49552 14.10 20.16 11.18 25 XM_Multi_Part_URI 47976 12.97 17.44 10.82 26 XM_DKIMWhitelistDomains 45572 7.04 0.32 10.28 27 RCVD_IN_RP_SAFE 42185 8.25 5.62 9.52 28 RCVD_IN_RP_CERTIFIED 40371 7.52 4.23 9.11 29 LOTS_OF_MONEY 39559 9.77 11.53 8.92 30 LotsOfNums_01 37854 8.40 8.12 8.54 31 TooManyTo_001 37551 8.06 7.20 8.47 32 BAYES_60 36389 7.49 5.98 8.21 33 XM_Evil_Numbers_Gen 35268 10.20 14.85 7.96 34 HTML_IMAGE_RATIO_02 34179 10.58 16.54 7.71 35 T_XMDrugObfuBody_14 33388 8.52 10.58 7.53 36 TR_DCC_Bayes_99 32400 16.48 35.52 7.31 37 FSL_BULK_SIG 28929 7.96 10.94 6.53 38 RCVD_IN_IADB_LISTED 26573 4.86 2.51 5.99 39 HTML_IMAGE_RATIO_04 25715 7.10 9.79 5.80 40 ANY_BOUNCE_MESSAGE 25058 4.04 0.70 5.65 41 BOUNCE_MESSAGE 25054 4.04 0.70 5.65 42 XM_H_Long_From01 24729 6.50 8.42 5.58 43 BOTNET_IPINHOSTNAME 24501 8.08 13.40 5.53 44 BAYES_00 24487 4.18 1.39 5.52 45 MIME_QP_LONG_LINE 23440 5.01 4.43 5.29 46 RCVD_IN_MSPIKE_H2 23243 4.73 3.66 5.24 47 RCVD_IN_IADB_SPF 23006 4.24 2.26 5.19 48 IN_ZIMBRA_NJ_WHITELIST 22785 3.48 0.02 5.14 49 XM_B_Phish_Phrases 22648 6.52 9.45 5.11 50 RELAYCOUNTRY_META 22603 8.55 15.73 5.10 51 DKIM_INVALID 22057 5.15 5.50 4.98 52 XM_PDF 21940 3.64 0.91 4.95 53 BAYES_80 21282 5.80 7.89 4.80 54 XM_SendGrid 21010 4.63 4.41 4.74 55 T_REMOTE_IMAGE 20714 4.46 4.01 4.67 56 RCVD_IN_IADB_SENDERID 19887 3.72 2.12 4.49 57 RCVD_IN_IADB_DK 19569 3.66 2.09 4.41 58 UNPARSEABLE_RELAY 18541 3.42 1.84 4.18 59 XMStrtUSub 18312 4.46 5.14 4.13 60 RCVD_IN_IADB_VOUCHED 18144 3.16 1.22 4.09 61 T_TooManySym_01 17725 3.60 2.76 4.00 62 TVD_RCVD_IP 16962 2.66 0.23 3.83 63 FROM_EXCESS_BASE64 16577 4.84 7.13 3.74 64 XMSubMetaSx_00 15970 4.72 7.05 3.60 65 TR_XM_DK_Bayes 15388 2.71 1.14 3.47 66 TR_XM_DocInvoice 14817 4.74 7.63 3.34 67 TR_XM_DK_Bayes1 14525 2.54 1.02 3.28 68 MPART_ALT_DIFF 14477 4.58 7.30 3.27 69 BAYES_95 14417 3.70 4.62 3.25 70 HTML_IMAGE_RATIO_06 14307 3.91 5.32 3.23 71 XM_UncommonTLD01 14059 3.91 5.45 3.17 72 XMNumbers 13749 3.64 4.77 3.10 73 XMSexyCombo_05 13098 5.26 10.06 2.95 74 BAYES_40 12904 2.40 1.33 2.91 75 TR_XM_DK_Bayes2 12718 2.26 1.00 2.87 76 TooManyTo_002 12481 2.27 1.14 2.82 77 HTML_MIME_NO_HTML_TAG 11620 2.61 2.58 2.62 78 RCVD_IN_IADB_OPTIN 11504 2.00 0.77 2.60 79 MAILING_LIST_MULTI 10684 2.21 1.80 2.41 80 RCVD_IN_MSPIKE_WL 10454 1.86 0.83 2.36 81 RCVD_IN_MSPIKE_H3 10449 1.86 0.83 2.36 82 MIME_HTML_MOSTLY 10383 2.88 3.99 2.34 83 HTML_IMAGE_RATIO_08 9252 2.80 4.29 2.09 84 TM2_M_URI_OPT_OUT 8905 2.77 4.34 2.01 85 XM_DK_Undo_01 8870 1.97 1.91 2.00 86 BAYES_20 8848 1.69 1.05 2.00 87 HELO_NODOT 8819 1.44 0.31 1.99 88 XMDiploma_00 8490 2.21 2.84 1.92 89 TooManyTo_003 8430 1.62 1.03 1.90 90 TR_Symld_Words 8417 1.68 1.22 1.90 91 XM_SPF_SoftFail 8283 2.49 3.78 1.87 92 IN_HORDE_ADDRESS_BOOK 8110 1.25 0.05 1.83 93 XM_DIRTYINTL 8023 2.58 4.19 1.81 94 XM_OfRef6 7948 2.07 2.65 1.79 95 SUBJ_ALL_CAPS 7431 1.85 2.22 1.68 96 XM_CamelCaseFrm001 7211 2.09 3.04 1.63 97 URI_HEX 7168 2.14 3.22 1.62 98 INVALID_MSGID 7088 1.16 0.24 1.60 99 USER_IN_DEF_DKIM_WL 7086 1.10 0.07 1.60 100 T_TooManySym_02 6765 1.30 0.82 1.53 101 RELAYCOUNTRY_CA 6712 2.03 3.11 1.51 102 TO_MALFORMED 6550 1.00 0.02 1.48 103 XMCapTrack 6407 1.18 0.62 1.45 104 MIME_HTML_ONLY_MULTI 6372 2.23 3.89 1.44 105 TooManyTo_004 6331 1.24 0.84 1.43 106 T_XMDrugObfuBody_08 6267 1.67 2.21 1.41 107 BAYES_05 5814 1.05 0.51 1.31 108 XM_GoogleGroups 5591 1.02 0.52 1.26 109 XMStockSpam_06 5511 1.29 1.38 1.24 110 XMPhish11 5365 1.32 1.55 1.21 111 XM_H_PHPOS 5341 1.11 0.92 1.20 112 UNTRUSTED_Relay 5186 3.91 9.60 1.17 113 BOTNET 5126 5.00 12.99 1.16 114 TooManyTo_005 5081 1.01 0.74 1.15 115 T_FILL_THIS_FORM_SHORT 4779 1.20 1.45 1.08 116 URI_TRY_3LD 4722 1.37 2.00 1.07 117 XMLngstWrd_00 4670 0.84 0.40 1.05 118 RELAYCOUNTRY_GB 4601 0.96 0.79 1.04 119 DKIM_ADSP_CUSTOM_MED 4588 0.98 0.87 1.03 120 XM_H_Long_From02 4129 1.32 2.12 0.93 121 XMGenDplmaNmb 4117 1.28 2.02 0.93 122 XM_ProductURIs 4101 1.01 1.18 0.93 123 XMLngstWrd_01 4064 0.74 0.37 0.92 124 TM2_M_VERY_LONG_WORD 3955 1.13 1.61 0.89 125 XMSolicitRefs_0 3479 0.68 0.46 0.78 126 XM_UB50 3436 1.84 4.04 0.78 127 XMBdyGiftCard01 3383 1.32 2.49 0.76 128 NML_ADSP_CUSTOM_MED 3383 0.72 0.64 0.76 129 T_XMDrugObfuBody_00 3175 0.88 1.21 0.72 130 SpammyFromTLD_01 3167 1.05 1.73 0.71 131 TR_MetaPhish_Combo_01 3048 0.67 0.63 0.69 132 KHOP_DYNAMIC 2925 0.71 0.81 0.66 133 T_OBFU_PDF_ATTACH 2887 0.54 0.32 0.65 134 USER_IN_WHITELIST 2863 0.44 0.00 0.65 135 HTTPS_HTTP_MISMATCH 2839 0.72 0.87 0.64 136 XMBody_95 2814 0.48 0.15 0.63 137 XMSubMetaSxObfu_02 2796 0.62 0.60 0.63 138 XMNoVowels 2736 0.56 0.43 0.62 139 XM_H_PHPMailer 2658 0.70 0.89 0.60 140 MISSING_HEADERS 2656 0.56 0.47 0.60 141 TR_XM_RelayPhish 2603 0.89 1.53 0.59 142 T_TooManySym_03 2595 0.43 0.11 0.59 143 RELAYCOUNTRY_AU 2561 0.60 0.65 0.58 144 AC_DIV_BONANZA 2544 0.42 0.10 0.57 145 DKIM_ADSP_NXDOMAIN 2540 0.60 0.65 0.57 146 XM_B_REG_HTML 2460 0.61 0.71 0.55 147 XMBrknScrpt_02 2358 0.60 0.73 0.53 148 XM_ShortIntro_01 2334 0.49 0.43 0.53 149 HTML_TAG_BALANCE_BODY 2334 0.74 1.19 0.53 150 HTML_FONT_FACE_BAD 2266 0.65 0.94 0.51 151 XMLngstWrd_02 2256 0.44 0.30 0.51 152 SHORT_HELO_AND_INLINE_IMAGE 2215 0.36 0.08 0.50 153 FORGED_GMAIL_RCVD 2209 0.58 0.76 0.50 154 XMMoneyMeta_00 2208 0.58 0.76 0.50 155 T_Symld_Words_02 2162 0.83 1.54 0.49 156 HTML_IMAGE_ONLY_32 2134 0.45 0.38 0.48 157 RCVD_IN_SORBS_DUL 2115 0.41 0.27 0.48 158 XMDateMe_00 2107 0.43 0.35 0.48 159 XMGappySubj_01 2099 0.40 0.24 0.47 160 T_XMHurry_00 2044 0.77 1.41 0.46 161 RELAYCOUNTRY_DE 1962 0.54 0.75 0.44 162 XMBody_17 1947 0.93 1.94 0.44 163 BODY_ENHANCEMENT2 1909 0.31 0.05 0.43 164 XMSubMetaSxObfu_03 1898 0.60 0.96 0.43 165 URI_NOVOWEL 1897 0.60 0.97 0.43 166 TM2_M_BODY_EMPTY 1896 0.32 0.11 0.43 167 RDNS_DYNAMIC 1850 0.53 0.77 0.42 168 HTML_IMAGE_ONLY_28 1837 0.42 0.43 0.41 169 XMHTMLBadTable_001 1837 0.57 0.89 0.41 170 TM2_M_A_HREF_HREF 1817 0.46 0.57 0.41 171 RCVD_IN_BL_SPAMCOP_NET 1731 1.09 2.56 0.39 172 XM_Combo_Sbj 1724 0.40 0.41 0.39 173 XM_D_tchamptons_WL 1722 0.26 0.01 0.39 174 XMSexyCombo_01 1722 0.93 2.04 0.39 175 XM_B_COPY_HTML 1719 0.48 0.68 0.39 176 URIBL_RHS_DOB 1685 0.51 0.77 0.38 177 HTML_IMAGE_ONLY_24 1677 0.38 0.39 0.38 178 XMSubMetaI_00 1672 0.73 1.47 0.38 179 XMPhish30 1670 0.64 1.18 0.38 180 XMHTML_After_End 1653 0.70 1.37 0.37 181 DIET_1 1619 0.67 1.29 0.37 182 XMBody_29 1602 0.30 0.18 0.36 183 XMBody_78 1586 0.47 0.71 0.36 184 PLING_QUERY 1582 0.48 0.74 0.36 185 MPART_ALT_DIFF_COUNT 1580 0.66 1.30 0.36 186 FILL_THIS_FORM 1559 0.44 0.63 0.35 187 XMSubNoVowel 1488 0.38 0.48 0.34 188 HTML_IMAGE_ONLY_20 1469 0.42 0.61 0.33 189 HTML_IMAGE_ONLY_16 1463 0.33 0.32 0.33 190 XMSlimDrugH 1460 0.55 1.02 0.33 191 TVD_SPACE_RATIO 1434 0.32 0.33 0.32 192 XM_Superlative01 1413 0.23 0.03 0.32 193 XMLngstWrd_03 1382 0.28 0.21 0.31 194 HTML_IMAGE_ONLY_12 1355 0.40 0.61 0.31 195 XM_Body_Obfu01 1334 0.46 0.80 0.30 196 XMRcvdHeader_15 1332 0.20 0.00 0.30 197 XM_B_TRADE_HTML 1300 0.32 0.38 0.29 198 SUBJ_DOLLARS 1295 0.80 1.84 0.29 199 XM_USANA_RCVD 1292 0.20 0.00 0.29 200 SpammyFromTLD_02 1254 0.78 1.81 0.28 ----------------------------------------------------------------------