Email: 673719 Autolearn: 0 AvgScore: 3.73 AvgScanTime: 4.03 sec Spam: 207491 Autolearn: 0 AvgScore: 13.23 AvgScanTime: 4.56 sec Ham: 466228 Autolearn: 0 AvgScore: -0.50 AvgScanTime: 3.79 sec Time Spent Running SA: 754.47 hours Time Spent Processing Spam: 263.06 hours Time Spent Processing Ham: 491.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 198709 89.28 95.77 86.39 2 DKIM_SIGNED 152758 72.50 73.62 72.00 3 DCC_CHECK 151724 47.59 73.12 36.23 4 XM_DK_Pass 146841 70.73 70.77 70.71 5 DKIM_VALID 139280 66.44 67.13 66.14 6 XMListUnsubscribeExists 130936 53.08 63.10 48.62 7 DKIM_VALID_AU 110167 48.44 53.09 46.36 8 XM_H_QuotedFrom 97144 38.64 46.82 34.99 9 MIME_HTML_ONLY 85721 25.45 41.31 18.39 10 BAYES_50 83714 53.34 40.35 59.13 11 XM_DK_Undo_02 68765 16.50 33.14 9.09 12 HTML_FONT_LOW_CONTRAST 68006 27.93 32.78 25.77 13 LOC_TINY_FONT_1 65004 23.63 31.33 20.20 14 BAYES_99 61153 14.59 29.47 7.97 15 XMSubLong 54197 22.24 26.12 20.52 16 DCC_CHECK_NEGATIVE 52455 50.43 25.28 61.62 17 BAYES_999 50178 12.06 24.18 6.66 18 TR_DCC_Bayes_99 49399 9.83 23.81 3.61 19 FVGT_m_MULTI_ODD 48535 21.84 23.39 21.14 20 DKIM_VALID_EF 45094 24.21 21.73 25.31 21 T_TM2_M_HEADER_IN_MSG 41040 27.77 19.78 31.33 22 BOTNET 40734 7.11 19.63 1.53 23 FROM_EXCESS_BASE64 40591 8.36 19.56 3.38 24 XM_Body_Dirty_Words 39763 13.79 19.16 11.40 25 T_KAM_HTML_FONT_INVALID 39278 16.90 18.93 16.00 26 RELAYCOUNTRY_META 37266 9.06 17.96 5.10 27 XM_UncommonTLD01 36734 7.88 17.70 3.51 28 HTML_MIME_NO_HTML_TAG 32303 6.47 15.57 2.42 29 T_REMOTE_IMAGE 32162 7.75 15.50 4.30 30 RCVD_IN_RP_RNBL 30924 4.61 14.90 0.03 31 MISSING_HEADERS 30515 5.54 14.71 1.46 32 SpammyFromTLD_02 30476 4.74 14.69 0.31 33 MultiRelay 30124 17.33 14.52 18.58 34 FSL_BULK_SIG 29643 8.48 14.29 5.90 35 HTML_IMAGE_RATIO_02 29228 9.24 14.09 7.08 36 LOTS_OF_MONEY 28401 9.98 13.69 8.33 37 XM_Evil_Numbers_Gen 28296 9.20 13.64 7.22 38 BODY_URI_ONLY 28071 4.28 13.53 0.16 39 XM_Multi_Part_URI 27147 11.47 13.08 10.76 40 HTML_SHORT_LINK_IMG_1 26962 4.03 12.99 0.03 41 MIME_HEADER_CTYPE_ONLY 26362 4.04 12.71 0.19 42 XMSexyCombo_05 25887 6.18 12.48 3.38 43 HTML_IMAGE_ONLY_04 25494 3.83 12.29 0.06 44 UNTRUSTED_Relay 24753 4.66 11.93 1.43 45 BOTNET_IPINHOSTNAME 22834 6.87 11.00 5.03 46 BAYES_60 22468 7.53 10.83 6.06 47 HTML_SHORT_CENTER 21588 3.21 10.40 0.01 48 BAYES_80 20330 5.44 9.80 3.49 49 XMSubMetaSx_00 18943 5.54 9.13 3.94 50 XMNumbers 18942 5.35 9.13 3.67 51 T_XMDrugObfuBody_14 17843 7.92 8.60 7.62 52 XM_H_Long_From01 17415 6.60 8.39 5.81 53 HTML_IMAGE_RATIO_04 16278 5.84 7.85 4.95 54 XM_B_Phish_Phrases 16118 5.82 7.77 4.95 55 MPART_ALT_DIFF 15357 3.98 7.40 2.46 56 DKIM_INVALID 13478 6.06 6.50 5.87 57 TR_XM_DocInvoice 13453 4.61 6.48 3.77 58 TooManyTo_001 12689 7.48 6.12 8.09 59 XM_UB50 11289 2.23 5.44 0.80 60 BAYES_95 10843 3.20 5.23 2.30 61 LotsOfNums_01 10790 7.67 5.20 8.77 62 XM_DIRTYINTL 9917 2.82 4.78 1.95 63 RELAYCOUNTRY_FR 9845 1.61 4.74 0.22 64 TM2_M_URI_OPT_OUT 9217 2.56 4.44 1.72 65 XMStrtUSub 8967 3.96 4.32 3.79 66 HTML_IMAGE_RATIO_06 8393 3.46 4.04 3.20 67 MIME_HTML_MOSTLY 7924 2.63 3.82 2.10 68 MIME_HTML_ONLY_MULTI 7683 2.00 3.70 1.25 69 XM_SPF_SoftFail 7210 2.63 3.47 2.26 70 RCVD_IN_MSPIKE_H2 6634 4.30 3.20 4.79 71 MultiRelay_Combo 6578 1.09 3.17 0.17 72 MultiRelay_CC 6578 1.09 3.17 0.17 73 XMDiploma_00 6537 2.21 3.15 1.79 74 URI_HEX 6477 2.04 3.12 1.56 75 MIME_QP_LONG_LINE 6422 5.45 3.10 6.50 76 XM_SendGrid 6410 4.34 3.09 4.90 77 HTML_IMAGE_RATIO_08 6302 2.42 3.04 2.15 78 TR_LOTS_OF_MONEY1 6235 0.96 3.00 0.05 79 XM_OfRef6 6179 1.83 2.98 1.32 80 ALL_TRUSTED 6084 13.52 2.93 18.24 81 DIET_1 5737 1.12 2.76 0.38 82 XM_CamelCaseFrm001 5699 2.16 2.75 1.90 83 RELAYCOUNTRY_CA 5667 1.86 2.73 1.47 84 XM_UB60 5590 0.90 2.69 0.09 85 TR_LOTS_OF_MONEY3 5027 0.95 2.42 0.30 86 T_TooManySym_01 4758 4.45 2.29 5.42 87 XMBody_17 4470 1.11 2.15 0.64 88 XMSubMetaI_00 4470 1.10 2.15 0.64 89 XMMoneyMeta_00 4462 1.06 2.15 0.57 90 REPLYTO_WITHOUT_TO_CC 4353 1.09 2.10 0.64 91 XM_URI_RBL 4300 0.85 2.07 0.31 92 XMSexyCombo_01 4268 1.05 2.06 0.60 93 XM_S_JOY_D 4177 0.88 2.01 0.37 94 T_XMDrugObfuBody_08 4174 1.65 2.01 1.49 95 RCVD_IN_BL_SPAMCOP_NET 3990 0.84 1.92 0.35 96 XMSlimDrugH 3763 0.79 1.81 0.33 97 RELAYCOUNTRY_GB 3635 1.25 1.75 1.02 98 XM_H_Long_From02 3606 1.28 1.74 1.07 99 XMGenDplmaNmb 3547 1.29 1.71 1.10 100 URI_TRY_3LD 3512 1.25 1.69 1.05 101 T_Symld_Words_02 3420 0.91 1.65 0.59 102 T_XMDrugObfuBody_00 3379 1.10 1.63 0.86 103 RELAYCOUNTRY_DE 3321 0.81 1.60 0.45 104 XMHTML_After_End 3265 0.80 1.57 0.45 105 SUBJ_ALL_CAPS 3238 1.69 1.56 1.74 106 DKIM_ADSP_NXDOMAIN 3184 0.82 1.53 0.51 107 TM2_M_VERY_LONG_WORD 3182 1.11 1.53 0.92 108 RCVD_IN_RP_SAFE 3159 6.50 1.52 8.72 109 TR_XM_RelayPhish 3049 0.79 1.47 0.49 110 XMBdyGiftCard01 3049 1.11 1.47 0.94 111 T_HTML_TAG_BALANCE_CENTER 2947 0.53 1.42 0.14 112 UNPARSEABLE_RELAY 2945 2.67 1.42 3.23 113 XM_UB80 2938 0.47 1.42 0.05 114 BAYES_40 2819 3.22 1.36 4.05 115 HTTPS_HTTP_MISMATCH 2736 0.77 1.32 0.53 116 RCVD_IN_IADB_LISTED 2683 4.58 1.29 6.04 117 SpammyFromTLD_01 2679 1.15 1.29 1.08 118 BOTNET_NORDNS 2667 0.41 1.29 0.02 119 XMStockSpam_06 2657 0.87 1.28 0.69 120 TR_Symld_Words 2649 1.47 1.28 1.55 121 HTML_FONT_SIZE_LARGE 2639 0.53 1.27 0.20 122 MAILING_LIST_MULTI 2606 2.09 1.26 2.46 123 XMWghtMeta_00 2556 0.39 1.23 0.02 124 BAYES_20 2523 2.45 1.22 3.01 125 RELAYCOUNTRY_IN 2511 0.46 1.21 0.13 126 XMPhish11 2502 1.16 1.21 1.14 127 RCVD_IN_RP_CERTIFIED 2411 5.89 1.16 8.00 128 XM_BadFromFormat 2407 0.46 1.16 0.15 129 T_XMHurry_00 2394 0.76 1.15 0.59 130 PLING_QUERY 2340 0.62 1.13 0.40 131 URIBL_DBL_SPAM 2336 0.38 1.13 0.04 132 BAYES_00 2315 8.61 1.12 11.94 133 XM_OfRef7 2282 0.46 1.10 0.17 134 XM_UB99 2271 0.37 1.09 0.05 135 RCVD_IN_IADB_SPF 2267 3.99 1.09 5.29 136 XM_GoogleGroups 2250 1.25 1.08 1.33 137 XM_DK_Undo_01 2192 1.71 1.06 2.01 138 T_MONEY_PERCENT 2187 0.49 1.05 0.24 139 TR_LOTS_OF_MONEY2 2187 0.49 1.05 0.24 140 RELAYCOUNTRY_CN 2174 0.36 1.05 0.05 141 TR_Mismatch_TLD_01 2161 0.39 1.04 0.10 142 XMWarranty1 2161 0.32 1.04 0.00 143 RCVD_IN_IADB_SENDERID 2148 3.53 1.04 4.63 144 HTML_IMAGE_ONLY_08 2141 0.39 1.03 0.10 145 RCVD_IN_IADB_DK 2108 3.48 1.02 4.58 146 XMPhish14 2030 0.61 0.98 0.44 147 DKIM_ADSP_CUSTOM_MED 2006 0.95 0.97 0.95 148 XMBody_78 1994 0.53 0.96 0.33 149 RELAYCOUNTRY_AU 1993 0.63 0.96 0.48 150 XM_H_PHPOS 1953 1.65 0.94 1.97 151 URIBL_BLACK 1952 0.33 0.94 0.06 152 HTML_FONT_FACE_BAD 1933 0.65 0.93 0.53 153 XMPhish30 1919 0.52 0.92 0.34 154 NML_ADSP_CUSTOM_MED 1917 0.76 0.92 0.69 155 HTML_TAG_BALANCE_BODY 1903 0.61 0.92 0.48 156 RELAYCOUNTRY_AT 1881 0.42 0.91 0.21 157 FILL_THIS_FORM 1858 0.55 0.90 0.40 158 T_FILL_THIS_FORM_SHORT 1832 0.86 0.88 0.86 159 FORGED_GMAIL_RCVD 1804 0.60 0.87 0.48 160 XM_ProductURIs 1794 0.82 0.86 0.80 161 LongTLD 1761 0.40 0.85 0.19 162 TR_Mismatch_TLD_02 1750 0.30 0.84 0.06 163 XM_PDF 1749 3.52 0.84 4.71 164 URI_NOVOWEL 1740 0.58 0.84 0.46 165 T_FILL_THIS_FORM_LONG 1722 0.47 0.83 0.31 166 XMSexyCombo_04 1716 0.30 0.83 0.07 167 RELAYCOUNTRY_NL 1706 0.45 0.82 0.29 168 RCVD_IN_IADB_VOUCHED 1693 2.96 0.82 3.92 169 THIS_AD 1683 0.36 0.81 0.16 170 T_TooManySym_02 1677 1.59 0.81 1.93 171 XM_Body_Obfu01 1670 0.51 0.80 0.38 172 XMGppyBdWords 1646 0.77 0.79 0.75 173 REMOVE_BEFORE_LINK 1641 0.50 0.79 0.38 174 XM_HighProb1 1617 0.25 0.78 0.01 175 XM_UB999 1611 0.27 0.78 0.04 176 XMSubMetaSxObfu_03 1605 0.57 0.77 0.48 177 NO_PRESCRIPTION 1565 0.23 0.75 0.00 178 TR_XM_DK_Bayes 1556 5.83 0.75 8.09 179 HTML_FONT_SIZE_HUGE 1542 0.29 0.74 0.09 180 FVGT_m_MULTI_ODD_EMAIL 1528 0.26 0.74 0.05 181 XM_H_PHPMailer 1502 0.68 0.72 0.66 182 XM_UB95 1452 0.24 0.70 0.04 183 HTML_IMAGE_ONLY_28 1424 0.49 0.69 0.40 184 XMSlimDrugs 1395 0.22 0.67 0.02 185 XMSubMetaI_01 1373 0.27 0.66 0.10 186 TR_XM_DK_Bayes1 1373 5.38 0.66 7.49 187 RDNS_DYNAMIC 1367 0.51 0.66 0.44 188 XMClaimOffer 1362 0.37 0.66 0.24 189 XMHTMLBadTable_001 1354 0.72 0.65 0.75 190 MPART_ALT_DIFF_COUNT 1329 0.36 0.64 0.23 191 BAYES_05 1326 1.62 0.64 2.06 192 HTML_COMMENT_SAVED_URL 1291 0.21 0.62 0.03 193 TR_XM_DK_Bayes2 1290 4.76 0.62 6.60 194 NO_MEDICAL 1284 0.19 0.62 0.00 195 BANG_GUAR 1281 0.21 0.62 0.02 196 TooManyTo_002 1247 1.80 0.60 2.33 197 XMSubject_09 1237 0.19 0.60 0.01 198 HTML_TEXT_INVISIBLE_STYLE 1225 0.20 0.59 0.03 199 XMLngstWrd_00 1223 0.71 0.59 0.76 200 LOW_PRICE 1186 0.30 0.57 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 402760 89.28 95.77 86.39 2 DKIM_SIGNED 335692 72.50 73.62 72.00 3 XM_DK_Pass 329668 70.73 70.77 70.71 4 DKIM_VALID 308343 66.44 67.13 66.14 5 DCC_CHECK_NEGATIVE 287283 50.43 25.28 61.62 6 BAYES_50 275658 53.34 40.35 59.13 7 XMListUnsubscribeExists 226681 53.08 63.10 48.62 8 DKIM_VALID_AU 216152 48.44 53.09 46.36 9 DCC_CHECK 168915 47.59 73.12 36.23 10 XM_H_QuotedFrom 163151 38.64 46.82 34.99 11 T_TM2_M_HEADER_IN_MSG 146073 27.77 19.78 31.33 12 HTML_FONT_LOW_CONTRAST 120170 27.93 32.78 25.77 13 DKIM_VALID_EF 117993 24.21 21.73 25.31 14 FVGT_m_MULTI_ODD 98578 21.84 23.39 21.14 15 XMSubLong 95658 22.24 26.12 20.52 16 LOC_TINY_FONT_1 94170 23.63 31.33 20.20 17 MultiRelay 86643 17.33 14.52 18.58 18 MIME_HTML_ONLY 85736 25.45 41.31 18.39 19 ALL_TRUSTED 85028 13.52 2.93 18.24 20 T_KAM_HTML_FONT_INVALID 74603 16.90 18.93 16.00 21 XM_DKIMWhitelistDomains 56263 8.38 0.11 12.07 22 BAYES_00 55674 8.61 1.12 11.94 23 XM_Body_Dirty_Words 53132 13.79 19.16 11.40 24 XM_Multi_Part_URI 50143 11.47 13.08 10.76 25 XM_DK_Undo_02 42377 16.50 33.14 9.09 26 LotsOfNums_01 40904 7.67 5.20 8.77 27 RCVD_IN_RP_SAFE 40636 6.50 1.52 8.72 28 LOTS_OF_MONEY 38817 9.98 13.69 8.33 29 TooManyTo_001 37738 7.48 6.12 8.09 30 TR_XM_DK_Bayes 37730 5.83 0.75 8.09 31 RCVD_IN_RP_CERTIFIED 37301 5.89 1.16 8.00 32 BAYES_99 37139 14.59 29.47 7.97 33 T_XMDrugObfuBody_14 35521 7.92 8.60 7.62 34 TR_XM_DK_Bayes1 34903 5.38 0.66 7.49 35 XM_Evil_Numbers_Gen 33657 9.20 13.64 7.22 36 HTML_IMAGE_RATIO_02 32996 9.24 14.09 7.08 37 BAYES_999 31073 12.06 24.18 6.66 38 TR_XM_DK_Bayes2 30790 4.76 0.62 6.60 39 MIME_QP_LONG_LINE 30295 5.45 3.10 6.50 40 BAYES_60 28266 7.53 10.83 6.06 41 RCVD_IN_IADB_LISTED 28181 4.58 1.29 6.04 42 FSL_BULK_SIG 27505 8.48 14.29 5.90 43 DKIM_INVALID 27349 6.06 6.50 5.87 44 XM_H_Long_From01 27078 6.60 8.39 5.81 45 T_TooManySym_01 25251 4.45 2.29 5.42 46 RCVD_IN_IADB_SPF 24642 3.99 1.09 5.29 47 RELAYCOUNTRY_META 23790 9.06 17.96 5.10 48 BOTNET_IPINHOSTNAME 23472 6.87 11.00 5.03 49 XM_B_Phish_Phrases 23082 5.82 7.77 4.95 50 HTML_IMAGE_RATIO_04 23062 5.84 7.85 4.95 51 XM_SendGrid 22842 4.34 3.09 4.90 52 RCVD_IN_MSPIKE_H2 22317 4.30 3.20 4.79 53 XM_PDF 21940 3.52 0.84 4.71 54 RCVD_IN_IADB_SENDERID 21609 3.53 1.04 4.63 55 RCVD_IN_IADB_DK 21339 3.48 1.02 4.58 56 T_REMOTE_IMAGE 20030 7.75 15.50 4.30 57 IN_ZIMBRA_NJ_WHITELIST 19215 2.86 0.02 4.12 58 BAYES_40 18882 3.22 1.36 4.05 59 XMSubMetaSx_00 18365 5.54 9.13 3.94 60 RCVD_IN_IADB_VOUCHED 18274 2.96 0.82 3.92 61 XMStrtUSub 17692 3.96 4.32 3.79 62 TR_XM_DocInvoice 17589 4.61 6.48 3.77 63 XMNumbers 17095 5.35 9.13 3.67 64 TR_DCC_Bayes_99 16853 9.83 23.81 3.61 65 XM_UncommonTLD01 16345 7.88 17.70 3.51 66 BAYES_80 16287 5.44 9.80 3.49 67 ANY_BOUNCE_MESSAGE 16179 2.57 0.56 3.47 68 BOUNCE_MESSAGE 16171 2.57 0.56 3.47 69 FROM_EXCESS_BASE64 15751 8.36 19.56 3.38 70 XMSexyCombo_05 15743 6.18 12.48 3.38 71 UNPARSEABLE_RELAY 15072 2.67 1.42 3.23 72 HTML_IMAGE_RATIO_06 14938 3.46 4.04 3.20 73 BAYES_20 14013 2.45 1.22 3.01 74 TVD_RCVD_IP 13967 2.12 0.14 3.00 75 TO_MALFORMED 13023 2.11 0.56 2.79 76 MPART_ALT_DIFF 11484 3.98 7.40 2.46 77 MAILING_LIST_MULTI 11458 2.09 1.26 2.46 78 RCVD_IN_IADB_OPTIN 11438 1.87 0.56 2.45 79 HTML_MIME_NO_HTML_TAG 11270 6.47 15.57 2.42 80 TooManyTo_002 10865 1.80 0.60 2.33 81 BAYES_95 10722 3.20 5.23 2.30 82 XM_SPF_SoftFail 10540 2.63 3.47 2.26 83 HELO_NODOT 10271 1.63 0.33 2.20 84 HTML_IMAGE_RATIO_08 10016 2.42 3.04 2.15 85 MIME_HTML_MOSTLY 9772 2.63 3.82 2.10 86 RCVD_IN_MSPIKE_WL 9657 1.59 0.52 2.07 87 RCVD_IN_MSPIKE_H3 9638 1.59 0.50 2.07 88 BAYES_05 9586 1.62 0.64 2.06 89 XM_DK_Undo_01 9348 1.71 1.06 2.01 90 XM_H_PHPOS 9185 1.65 0.94 1.97 91 XM_DIRTYINTL 9091 2.82 4.78 1.95 92 T_TooManySym_02 9007 1.59 0.81 1.93 93 XM_CamelCaseFrm001 8861 2.16 2.75 1.90 94 XMDiploma_00 8333 2.21 3.15 1.79 95 SUBJ_ALL_CAPS 8132 1.69 1.56 1.74 96 TM2_M_URI_OPT_OUT 8003 2.56 4.44 1.72 97 IN_HORDE_ADDRESS_BOOK 7913 1.19 0.05 1.70 98 XMCapTrack 7580 1.23 0.33 1.63 99 TR_MetaPhish_Combo_01 7427 1.25 0.49 1.59 100 URI_HEX 7264 2.04 3.12 1.56 101 TR_Symld_Words 7248 1.47 1.28 1.55 102 TooManyTo_003 7192 1.22 0.50 1.54 103 INVALID_MSGID 7154 1.11 0.17 1.53 104 BOTNET 7146 7.11 19.63 1.53 105 T_XMDrugObfuBody_08 6944 1.65 2.01 1.49 106 RELAYCOUNTRY_CA 6842 1.86 2.73 1.47 107 MISSING_HEADERS 6793 5.54 14.71 1.46 108 UNTRUSTED_Relay 6666 4.66 11.93 1.43 109 XM_GoogleGroups 6186 1.25 1.08 1.33 110 XM_OfRef6 6134 1.83 2.98 1.32 111 USER_IN_DEF_DKIM_WL 5903 0.89 0.03 1.27 112 MIME_HTML_ONLY_MULTI 5814 2.00 3.70 1.25 113 XMPhish11 5336 1.16 1.21 1.14 114 TooManyTo_004 5336 0.89 0.33 1.14 115 XMGenDplmaNmb 5114 1.29 1.71 1.10 116 SpammyFromTLD_01 5054 1.15 1.29 1.08 117 XM_H_Long_From02 4991 1.28 1.74 1.07 118 URI_TRY_3LD 4900 1.25 1.69 1.05 119 RELAYCOUNTRY_GB 4761 1.25 1.75 1.02 120 XMSubNoVowel 4485 0.78 0.36 0.96 121 TooManyTo_005 4480 0.75 0.28 0.96 122 XMSubEmpty 4413 0.70 0.13 0.95 123 DKIM_ADSP_CUSTOM_MED 4408 0.95 0.97 0.95 124 XMBdyGiftCard01 4396 1.11 1.47 0.94 125 TM2_M_VERY_LONG_WORD 4271 1.11 1.53 0.92 126 T_XMDrugObfuBody_00 4028 1.10 1.63 0.86 127 T_FILL_THIS_FORM_SHORT 3988 0.86 0.88 0.86 128 XM_UB50 3734 2.23 5.44 0.80 129 XM_ProductURIs 3716 0.82 0.86 0.80 130 TO_NO_BRKTS_HTML_ONLY 3656 0.66 0.39 0.78 131 XMLngstWrd_00 3548 0.71 0.59 0.76 132 XMGppyBdWords 3516 0.77 0.79 0.75 133 XMHTMLBadTable_001 3506 0.72 0.65 0.75 134 T_FROM_GOV_SPOOF 3281 0.55 0.21 0.70 135 NML_ADSP_CUSTOM_MED 3206 0.76 0.92 0.69 136 XMStockSpam_06 3194 0.87 1.28 0.69 137 XMLngstWrd_01 3182 0.63 0.51 0.68 138 XM_H_PHPMailer 3080 0.68 0.72 0.66 139 REPLYTO_WITHOUT_TO_CC 2977 1.09 2.10 0.64 140 XMBody_17 2975 1.11 2.15 0.64 141 XMSubMetaI_00 2970 1.10 2.15 0.64 142 XMSexyCombo_01 2775 1.05 2.06 0.60 143 T_XMHurry_00 2756 0.76 1.15 0.59 144 XM_B_REG_HTML 2734 0.52 0.38 0.59 145 T_Symld_Words_02 2733 0.91 1.65 0.59 146 XMNoVowels 2699 0.56 0.52 0.58 147 XMBrknScrpt_02 2683 0.57 0.55 0.58 148 XMMoneyMeta_00 2654 1.06 2.15 0.57 149 USER_IN_WHITELIST 2650 0.39 0.00 0.57 150 T_OBFU_PDF_ATTACH 2633 0.45 0.19 0.56 151 SHORT_HELO_AND_INLINE_IMAGE 2524 0.39 0.06 0.54 152 HTML_FONT_FACE_BAD 2469 0.65 0.93 0.53 153 T_TooManySym_03 2452 0.42 0.19 0.53 154 HTTPS_HTTP_MISMATCH 2449 0.77 1.32 0.53 155 XM_ShortIntro_01 2439 0.51 0.47 0.52 156 DKIM_ADSP_NXDOMAIN 2373 0.82 1.53 0.51 157 XMBody_95 2334 0.38 0.12 0.50 158 TR_XM_RelayPhish 2305 0.79 1.47 0.49 159 FORGED_GMAIL_RCVD 2253 0.60 0.87 0.48 160 RELAYCOUNTRY_AU 2243 0.63 0.96 0.48 161 XMSubMetaSxObfu_02 2238 0.43 0.31 0.48 162 XMSubMetaSxObfu_03 2231 0.57 0.77 0.48 163 HTML_TAG_BALANCE_BODY 2226 0.61 0.92 0.48 164 XM_B_COPY_HTML 2220 0.49 0.52 0.48 165 URI_NOVOWEL 2159 0.58 0.84 0.46 166 RCVD_IN_SORBS_DUL 2137 0.40 0.27 0.46 167 RELAYCOUNTRY_DE 2110 0.81 1.60 0.45 168 XMDateMe_00 2105 0.43 0.37 0.45 169 XMHTML_After_End 2100 0.80 1.57 0.45 170 XMPhish14 2048 0.61 0.98 0.44 171 RDNS_DYNAMIC 2043 0.51 0.66 0.44 172 XMGappySubj_01 2023 0.41 0.35 0.43 173 HTML_IMAGE_ONLY_32 2019 0.40 0.34 0.43 174 AC_DIV_BONANZA 1963 0.32 0.09 0.42 175 TM2_M_BODY_EMPTY 1961 0.33 0.13 0.42 176 FILL_THIS_FORM 1869 0.55 0.90 0.40 177 HTML_IMAGE_ONLY_28 1850 0.49 0.69 0.40 178 PLING_QUERY 1848 0.62 1.13 0.40 179 DIET_1 1788 1.12 2.76 0.38 180 XM_Body_Obfu01 1780 0.51 0.80 0.38 181 REMOVE_BEFORE_LINK 1758 0.50 0.79 0.38 182 XM_S_JOY_D 1730 0.88 2.01 0.37 183 TM2_M_A_HREF_HREF 1723 0.42 0.53 0.37 184 XMLngstWrd_02 1714 0.38 0.41 0.37 185 RCVD_IN_BL_SPAMCOP_NET 1654 0.84 1.92 0.35 186 HTML_IMAGE_ONLY_24 1638 0.36 0.39 0.35 187 T_FROM_GOV_DKIM_AU 1590 0.29 0.19 0.34 188 XMPhish30 1577 0.52 0.92 0.34 189 NO_DNS_FOR_FROM 1560 0.39 0.51 0.33 190 XMBody_78 1555 0.53 0.96 0.33 191 XMSlimDrugH 1549 0.79 1.81 0.33 192 HTML_IMAGE_ONLY_20 1496 0.27 0.16 0.32 193 SpammyFromTLD_02 1459 4.74 14.69 0.31 194 T_FILL_THIS_FORM_LONG 1456 0.47 0.83 0.31 195 SUBJ_DOLLARS 1454 0.39 0.57 0.31 196 XM_URI_RBL 1428 0.85 2.07 0.31 197 XM_H_PHPOS_M 1415 0.34 0.43 0.30 198 XM_B_TRADE_HTML 1402 0.29 0.28 0.30 199 T_FILL_THIS_FORM_LOAN 1384 0.33 0.42 0.30 200 TR_LOTS_OF_MONEY3 1376 0.95 2.42 0.30 ----------------------------------------------------------------------