Email: 668261 Autolearn: 0 AvgScore: 3.82 AvgScanTime: 3.88 sec Spam: 204700 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 4.32 sec Ham: 463561 Autolearn: 0 AvgScore: -0.52 AvgScanTime: 3.68 sec Time Spent Running SA: 719.90 hours Time Spent Processing Spam: 245.43 hours Time Spent Processing Ham: 474.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 190645 88.37 93.13 86.27 2 DCC_CHECK 152552 48.50 74.52 37.01 3 DKIM_SIGNED 151167 74.07 73.85 74.17 4 XM_DK_Pass 144286 72.06 70.49 72.75 5 DKIM_VALID 137162 67.86 67.01 68.24 6 XMListUnsubscribeExists 128309 53.35 62.68 49.24 7 DKIM_VALID_AU 108798 49.44 53.15 47.80 8 XM_H_QuotedFrom 101306 39.80 49.49 35.52 9 MIME_HTML_ONLY 82209 25.53 40.16 19.08 10 BAYES_50 79446 53.17 38.81 59.52 11 XM_DK_Undo_02 67662 16.46 33.05 9.14 12 HTML_FONT_LOW_CONTRAST 64943 27.92 31.73 26.24 13 LOC_TINY_FONT_1 63836 23.73 31.19 20.44 14 BAYES_99 59493 14.39 29.06 7.91 15 XMSubLong 52021 22.66 25.41 21.44 16 BAYES_999 48843 11.96 23.86 6.71 17 DCC_CHECK_NEGATIVE 48606 49.51 23.74 60.88 18 TR_DCC_Bayes_99 48116 9.80 23.51 3.75 19 FVGT_m_MULTI_ODD 46833 21.98 22.88 21.58 20 DKIM_VALID_EF 43392 24.81 21.20 26.41 21 T_TM2_M_HEADER_IN_MSG 41765 27.78 20.40 31.04 22 BOTNET 41317 7.34 20.18 1.67 23 XM_UncommonTLD01 39587 8.49 19.34 3.70 24 RELAYCOUNTRY_META 38940 9.50 19.02 5.30 25 FROM_EXCESS_BASE64 38465 8.36 18.79 3.76 26 XM_Body_Dirty_Words 38361 13.82 18.74 11.65 27 T_KAM_HTML_FONT_INVALID 37684 16.94 18.41 16.30 28 RCVD_IN_RP_RNBL 34742 5.23 16.97 0.04 29 MultiRelay 33903 18.42 16.56 19.24 30 FSL_BULK_SIG 31824 9.05 15.55 6.18 31 SpammyFromTLD_02 31823 4.96 15.55 0.29 32 T_REMOTE_IMAGE 31221 7.80 15.25 4.51 33 HTML_MIME_NO_HTML_TAG 29841 6.25 14.58 2.58 34 XM_Multi_Part_URI 28557 12.04 13.95 11.20 35 XM_Evil_Numbers_Gen 27877 9.58 13.62 7.80 36 HTML_IMAGE_RATIO_02 27609 9.12 13.49 7.19 37 BODY_URI_ONLY 26940 4.11 13.16 0.12 38 MISSING_HEADERS 26902 4.48 13.14 0.66 39 UNTRUSTED_Relay 26476 4.93 12.93 1.40 40 HTML_SHORT_LINK_IMG_1 26076 3.94 12.74 0.05 41 MIME_HEADER_CTYPE_ONLY 25237 3.86 12.33 0.12 42 HTML_IMAGE_ONLY_04 24303 3.69 11.87 0.07 43 BAYES_60 24014 7.91 11.73 6.22 44 BOTNET_IPINHOSTNAME 23389 6.98 11.43 5.02 45 LOTS_OF_MONEY 22091 9.50 10.79 8.93 46 XMSexyCombo_05 21550 5.51 10.53 3.29 47 BAYES_80 21271 5.72 10.39 3.65 48 HTML_SHORT_CENTER 20510 3.08 10.02 0.01 49 XM_B_Phish_Phrases 18372 6.56 8.98 5.49 50 TR_XM_DocInvoice 18153 5.41 8.87 3.89 51 XMNumbers 17899 5.60 8.74 4.21 52 T_XMDrugObfuBody_14 17114 7.97 8.36 7.80 53 XM_H_Long_From01 16294 6.41 7.96 5.73 54 MPART_ALT_DIFF 15026 4.14 7.34 2.72 55 HTML_IMAGE_RATIO_04 14854 6.18 7.26 5.70 56 DKIM_INVALID 14005 6.21 6.84 5.93 57 XMSubMetaSx_00 12287 4.68 6.00 4.10 58 XM_UB50 12098 2.36 5.91 0.80 59 TooManyTo_001 12097 7.29 5.91 7.89 60 LotsOfNums_01 10994 7.74 5.37 8.79 61 BAYES_95 10798 3.19 5.28 2.27 62 XMStrtUSub 10617 4.19 5.19 3.75 63 XM_DIRTYINTL 10351 2.86 5.06 1.90 64 MIME_HTML_MOSTLY 9146 2.90 4.47 2.20 65 RELAYCOUNTRY_FR 9010 1.53 4.40 0.27 66 HTML_IMAGE_RATIO_06 7943 3.62 3.88 3.50 67 MIME_HTML_ONLY_MULTI 7750 2.02 3.79 1.25 68 TM2_M_URI_OPT_OUT 7087 2.52 3.46 2.10 69 XM_SPF_SoftFail 7068 2.72 3.45 2.39 70 XM_SendGrid 6948 4.66 3.39 5.22 71 XM_OfRef6 6896 2.00 3.37 1.40 72 MultiRelay_CC 6877 1.15 3.36 0.17 73 MultiRelay_Combo 6877 1.15 3.36 0.17 74 T_XMDrugObfuBody_08 6592 2.01 3.22 1.48 75 T_TooManySym_01 5686 4.75 2.78 5.61 76 XMDiploma_00 5672 2.04 2.77 1.72 77 DIET_1 5616 1.08 2.74 0.35 78 XM_CamelCaseFrm001 5600 2.04 2.74 1.74 79 RELAYCOUNTRY_CA 5519 1.87 2.70 1.50 80 XM_UB60 5382 0.86 2.63 0.09 81 XMSubMetaI_00 5289 1.12 2.58 0.47 82 TR_Mismatch_TLD_02 5257 0.87 2.57 0.12 83 MIME_QP_LONG_LINE 5245 5.30 2.56 6.51 84 RCVD_IN_MSPIKE_H2 5192 4.09 2.54 4.78 85 URI_HEX 4998 1.90 2.44 1.65 86 XM_URI_RBL 4993 0.95 2.44 0.30 87 HTML_IMAGE_RATIO_08 4615 2.04 2.25 1.94 88 XMSlimDrugH 4487 0.85 2.19 0.26 89 BOTNET_NORDNS 3996 0.62 1.95 0.03 90 XM_UB80 3888 0.64 1.90 0.09 91 T_XMDrugObfuBody_00 3713 1.00 1.81 0.65 92 XMMoneyMeta_00 3605 0.96 1.76 0.61 93 BAYES_40 3588 3.30 1.75 3.99 94 XMSexyCombo_01 3587 1.20 1.75 0.96 95 RCVD_IN_RP_SAFE 3467 6.99 1.69 9.33 96 HTML_FONT_SIZE_LARGE 3348 0.61 1.64 0.16 97 DKIM_ADSP_NXDOMAIN 3319 0.88 1.62 0.56 98 RELAYCOUNTRY_DE 3251 0.80 1.59 0.45 99 URI_TRY_3LD 3209 1.12 1.57 0.92 100 XMHTML_After_End 3199 0.78 1.56 0.44 101 PLING_QUERY 3104 0.65 1.52 0.27 102 XMGenDplmaNmb 3046 1.24 1.49 1.13 103 XMBody_17 3036 0.87 1.48 0.60 104 RCVD_IN_BL_SPAMCOP_NET 3004 0.68 1.47 0.33 105 XMBdyGiftCard01 2985 1.35 1.46 1.30 106 MAILING_LIST_MULTI 2985 2.36 1.46 2.75 107 SpammyFromTLD_01 2981 1.35 1.46 1.31 108 SUBJ_ALL_CAPS 2974 1.95 1.45 2.17 109 T_FILL_THIS_FORM_LOAN 2906 0.58 1.42 0.21 110 XMStockSpam_06 2883 1.32 1.41 1.28 111 UNPARSEABLE_RELAY 2881 2.61 1.41 3.14 112 TR_Mismatch_TLD_01 2868 0.53 1.40 0.15 113 TR_XM_RelayPhish 2819 0.79 1.38 0.53 114 RELAYCOUNTRY_IR 2787 0.42 1.36 0.00 115 XMBody_78 2760 0.68 1.35 0.38 116 XMEmptySub 2753 0.49 1.34 0.11 117 TM2_M_VERY_LONG_WORD 2731 1.12 1.33 1.02 118 XMWghtMeta_00 2685 0.42 1.31 0.02 119 T_FILL_THIS_FORM_SHORT 2683 1.00 1.31 0.87 120 T_Symld_Words_02 2674 0.79 1.31 0.57 121 BAYES_20 2642 2.57 1.29 3.14 122 LongTLD 2626 0.52 1.28 0.19 123 RCVD_IN_IADB_LISTED 2622 4.51 1.28 5.93 124 XM_H_Long_From02 2606 1.12 1.27 1.05 125 XMPhish11 2591 1.21 1.27 1.18 126 T_XMHurry_00 2575 0.83 1.26 0.63 127 FILL_THIS_FORM 2537 0.60 1.24 0.31 128 ALL_TRUSTED 2482 12.05 1.21 16.84 129 T_FROM_SUSPICIOUS_NTLD 2440 0.41 1.19 0.07 130 XMSlimDrugs 2432 0.37 1.19 0.01 131 RCVD_IN_RP_CERTIFIED 2421 6.47 1.18 8.80 132 T_FILL_THIS_FORM_LONG 2415 0.51 1.18 0.21 133 TR_Symld_Words 2414 1.50 1.18 1.64 134 T_MONEY_PERCENT 2374 0.53 1.16 0.26 135 TR_LOTS_OF_MONEY2 2374 0.53 1.16 0.26 136 XM_DK_Undo_01 2354 1.77 1.15 2.04 137 TR_LOTS_OF_MONEY1 2334 0.36 1.14 0.02 138 URIBL_DBL_SPAM 2284 0.37 1.12 0.04 139 XM_UB99 2244 0.36 1.10 0.04 140 HTML_IMAGE_ONLY_08 2230 0.41 1.09 0.11 141 DKIM_ADSP_CUSTOM_MED 2214 0.99 1.08 0.95 142 RCVD_IN_IADB_SPF 2194 3.93 1.07 5.19 143 XMWarranty1 2162 0.32 1.06 0.00 144 BAYES_00 2137 8.15 1.04 11.29 145 NML_ADSP_CUSTOM_MED 2116 0.75 1.03 0.62 146 HTTPS_HTTP_MISMATCH 2111 0.69 1.03 0.54 147 URIBL_BLACK 2082 0.36 1.02 0.06 148 RCVD_IN_IADB_SENDERID 2081 3.44 1.02 4.51 149 XMPhish30 2057 0.56 1.00 0.37 150 RCVD_IN_IADB_DK 2055 3.41 1.00 4.48 151 RELAYCOUNTRY_GB 2049 0.93 1.00 0.90 152 FORGED_GMAIL_RCVD 2041 0.66 1.00 0.51 153 RELAYCOUNTRY_CN 1984 0.33 0.97 0.05 154 RELAYCOUNTRY_IN 1924 0.38 0.94 0.13 155 XMSubNoVowel 1920 0.55 0.94 0.37 156 HTML_FONT_FACE_BAD 1915 0.69 0.94 0.58 157 NO_PRESCRIPTION 1894 0.28 0.93 0.00 158 XM_HighProb1 1888 0.31 0.92 0.03 159 RELAYCOUNTRY_AT 1884 0.47 0.92 0.27 160 REPLYTO_WITHOUT_TO_CC 1842 0.40 0.90 0.18 161 GAPPY_SUBJECT 1836 0.35 0.90 0.12 162 T_TooManySym_02 1795 1.60 0.88 1.92 163 XM_ProductURIs 1782 0.84 0.87 0.83 164 SUBJ_DOLLARS 1767 0.37 0.86 0.15 165 XMClaimOffer 1739 0.34 0.85 0.11 166 URI_NOVOWEL 1714 0.58 0.84 0.47 167 T_HTML_TAG_BALANCE_CENTER 1702 0.35 0.83 0.13 168 XM_H_PHPOS 1691 1.41 0.83 1.67 169 GUARANTEED_100_PERCENT 1688 0.26 0.82 0.01 170 XM_PDF 1683 3.65 0.82 4.90 171 XM_Body_Obfu01 1663 0.43 0.81 0.26 172 RELAYCOUNTRY_CH 1656 0.27 0.81 0.03 173 XMSubMetaI_01 1638 0.28 0.80 0.05 174 XMSubEmpty 1613 0.46 0.79 0.31 175 XM_S_JOY_D 1607 0.44 0.79 0.28 176 HTML_TEXT_INVISIBLE_STYLE 1605 0.25 0.78 0.02 177 XM_UB95 1591 0.25 0.78 0.02 178 XM_UB999 1547 0.25 0.76 0.03 179 BODY_ENHANCEMENT 1546 0.24 0.76 0.02 180 TR_XM_DK_Bayes 1544 5.84 0.75 8.08 181 RCVD_IN_IADB_VOUCHED 1543 2.88 0.75 3.82 182 MPART_ALT_DIFF_COUNT 1540 0.37 0.75 0.20 183 NO_DNS_FOR_FROM 1527 0.44 0.75 0.31 184 TR_MetaPhish_Combo_01 1510 1.32 0.74 1.57 185 XMSexyCombo_04 1498 0.63 0.73 0.59 186 XM_B_COPY_HTML 1491 0.55 0.73 0.48 187 XM_BadFromFormat 1464 0.32 0.72 0.14 188 FORM_FRAUD 1426 0.22 0.70 0.00 189 HTML_IMAGE_ONLY_28 1403 0.47 0.69 0.38 190 TR_XM_DK_Bayes1 1401 5.40 0.68 7.49 191 XMPhish14 1391 0.44 0.68 0.33 192 XMSubject_09 1387 0.22 0.68 0.02 193 RDNS_DYNAMIC 1353 0.48 0.66 0.40 194 T_FROM_NTLD_LINKBAIT 1351 0.22 0.66 0.03 195 HTML_TAG_BALANCE_BODY 1339 0.46 0.65 0.38 196 XMDateMe_00 1326 0.54 0.65 0.49 197 BAYES_05 1311 1.59 0.64 2.01 198 RELAYCOUNTRY_NL 1307 0.54 0.64 0.49 199 RCVD_IN_PSBL 1291 0.25 0.63 0.08 200 FVGT_m_MULTI_ODD_EMAIL 1290 0.23 0.63 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 399908 88.37 93.13 86.27 2 DKIM_SIGNED 343818 74.07 73.85 74.17 3 XM_DK_Pass 337258 72.06 70.49 72.75 4 DKIM_VALID 316324 67.86 67.01 68.24 5 DCC_CHECK_NEGATIVE 282218 49.51 23.74 60.88 6 BAYES_50 275889 53.17 38.81 59.52 7 XMListUnsubscribeExists 228239 53.35 62.68 49.24 8 DKIM_VALID_AU 221564 49.44 53.15 47.80 9 DCC_CHECK 171585 48.50 74.52 37.01 10 XM_H_QuotedFrom 164661 39.80 49.49 35.52 11 T_TM2_M_HEADER_IN_MSG 143891 27.78 20.40 31.04 12 DKIM_VALID_EF 122404 24.81 21.20 26.41 13 HTML_FONT_LOW_CONTRAST 121638 27.92 31.73 26.24 14 FVGT_m_MULTI_ODD 100045 21.98 22.88 21.58 15 XMSubLong 99396 22.66 25.41 21.44 16 LOC_TINY_FONT_1 94775 23.73 31.19 20.44 17 MultiRelay 89171 18.42 16.56 19.24 18 MIME_HTML_ONLY 88431 25.53 40.16 19.08 19 ALL_TRUSTED 78043 12.05 1.21 16.84 20 T_KAM_HTML_FONT_INVALID 75542 16.94 18.41 16.30 21 XM_DKIMWhitelistDomains 59649 9.01 0.28 12.87 22 XM_Body_Dirty_Words 54018 13.82 18.74 11.65 23 BAYES_00 52319 8.15 1.04 11.29 24 XM_Multi_Part_URI 51915 12.04 13.95 11.20 25 RCVD_IN_RP_SAFE 43266 6.99 1.69 9.33 26 XM_DK_Undo_02 42356 16.46 33.05 9.14 27 LOTS_OF_MONEY 41396 9.50 10.79 8.93 28 RCVD_IN_RP_CERTIFIED 40799 6.47 1.18 8.80 29 LotsOfNums_01 40756 7.74 5.37 8.79 30 TR_XM_DK_Bayes 37461 5.84 0.75 8.08 31 BAYES_99 36686 14.39 29.06 7.91 32 TooManyTo_001 36592 7.29 5.91 7.89 33 T_XMDrugObfuBody_14 36168 7.97 8.36 7.80 34 XM_Evil_Numbers_Gen 36138 9.58 13.62 7.80 35 TR_XM_DK_Bayes1 34712 5.40 0.68 7.49 36 HTML_IMAGE_RATIO_02 33353 9.12 13.49 7.19 37 BAYES_999 31087 11.96 23.86 6.71 38 TR_XM_DK_Bayes2 30410 4.73 0.59 6.56 39 MIME_QP_LONG_LINE 30191 5.30 2.56 6.51 40 BAYES_60 28816 7.91 11.73 6.22 41 FSL_BULK_SIG 28666 9.05 15.55 6.18 42 RCVD_IN_IADB_LISTED 27500 4.51 1.28 5.93 43 DKIM_INVALID 27494 6.21 6.84 5.93 44 XM_H_Long_From01 26573 6.41 7.96 5.73 45 HTML_IMAGE_RATIO_04 26441 6.18 7.26 5.70 46 T_TooManySym_01 26025 4.75 2.78 5.61 47 XM_B_Phish_Phrases 25458 6.56 8.98 5.49 48 RELAYCOUNTRY_META 24548 9.50 19.02 5.30 49 XM_SendGrid 24185 4.66 3.39 5.22 50 RCVD_IN_IADB_SPF 24038 3.93 1.07 5.19 51 BOTNET_IPINHOSTNAME 23284 6.98 11.43 5.02 52 XM_PDF 22721 3.65 0.82 4.90 53 RCVD_IN_MSPIKE_H2 22172 4.09 2.54 4.78 54 RCVD_IN_IADB_SENDERID 20928 3.44 1.02 4.51 55 T_REMOTE_IMAGE 20905 7.80 15.25 4.51 56 RCVD_IN_IADB_DK 20755 3.41 1.00 4.48 57 XMNumbers 19512 5.60 8.74 4.21 58 XMSubMetaSx_00 19003 4.68 6.00 4.10 59 IN_ZIMBRA_NJ_WHITELIST 18808 2.82 0.03 4.06 60 BAYES_40 18489 3.30 1.75 3.99 61 TR_XM_DocInvoice 18022 5.41 8.87 3.89 62 RCVD_IN_IADB_VOUCHED 17720 2.88 0.75 3.82 63 FROM_EXCESS_BASE64 17414 8.36 18.79 3.76 64 TR_DCC_Bayes_99 17387 9.80 23.51 3.75 65 XMStrtUSub 17384 4.19 5.19 3.75 66 XM_UncommonTLD01 17155 8.49 19.34 3.70 67 BAYES_80 16927 5.72 10.39 3.65 68 HTML_IMAGE_RATIO_06 16247 3.62 3.88 3.50 69 XMSexyCombo_05 15267 5.51 10.53 3.29 70 UNPARSEABLE_RELAY 14573 2.61 1.41 3.14 71 BAYES_20 14565 2.57 1.29 3.14 72 TVD_RCVD_IP 13392 2.12 0.37 2.89 73 ANY_BOUNCE_MESSAGE 13128 2.12 0.51 2.83 74 BOUNCE_MESSAGE 13127 2.12 0.51 2.83 75 TO_MALFORMED 13062 1.99 0.10 2.82 76 MAILING_LIST_MULTI 12756 2.36 1.46 2.75 77 MPART_ALT_DIFF 12614 4.14 7.34 2.72 78 HTML_MIME_NO_HTML_TAG 11957 6.25 14.58 2.58 79 RCVD_IN_IADB_OPTIN 11216 1.83 0.50 2.42 80 XM_SPF_SoftFail 11092 2.72 3.45 2.39 81 BAYES_95 10526 3.19 5.28 2.27 82 MIME_HTML_MOSTLY 10218 2.90 4.47 2.20 83 TooManyTo_002 10115 1.67 0.53 2.18 84 SUBJ_ALL_CAPS 10075 1.95 1.45 2.17 85 TM2_M_URI_OPT_OUT 9744 2.52 3.46 2.10 86 HELO_NODOT 9515 1.54 0.37 2.05 87 XM_DK_Undo_01 9449 1.77 1.15 2.04 88 BAYES_05 9324 1.59 0.64 2.01 89 HTML_IMAGE_RATIO_08 8992 2.04 2.25 1.94 90 T_TooManySym_02 8897 1.60 0.88 1.92 91 XM_DIRTYINTL 8785 2.86 5.06 1.90 92 RCVD_IN_MSPIKE_WL 8510 1.46 0.62 1.84 93 RCVD_IN_MSPIKE_H3 8503 1.46 0.62 1.83 94 XM_CamelCaseFrm001 8056 2.04 2.74 1.74 95 IN_HORDE_ADDRESS_BOOK 8005 1.21 0.05 1.73 96 XMDiploma_00 7988 2.04 2.77 1.72 97 XM_H_PHPOS 7753 1.41 0.83 1.67 98 BOTNET 7743 7.34 20.18 1.67 99 URI_HEX 7670 1.90 2.44 1.65 100 TR_Symld_Words 7612 1.50 1.18 1.64 101 TR_MetaPhish_Combo_01 7298 1.32 0.74 1.57 102 INVALID_MSGID 7120 1.26 0.62 1.54 103 XMCapTrack 7034 1.12 0.24 1.52 104 RELAYCOUNTRY_CA 6954 1.87 2.70 1.50 105 T_XMDrugObfuBody_08 6841 2.01 3.22 1.48 106 TooManyTo_003 6527 1.11 0.42 1.41 107 XM_OfRef6 6484 2.00 3.37 1.40 108 UNTRUSTED_Relay 6469 4.93 12.93 1.40 109 SpammyFromTLD_01 6063 1.35 1.46 1.31 110 XMBdyGiftCard01 6020 1.35 1.46 1.30 111 USER_IN_DEF_DKIM_WL 5988 0.92 0.09 1.29 112 XMStockSpam_06 5946 1.32 1.41 1.28 113 MIME_HTML_ONLY_MULTI 5773 2.02 3.79 1.25 114 XM_GoogleGroups 5683 0.96 0.36 1.23 115 XMPhish11 5470 1.21 1.27 1.18 116 XMGenDplmaNmb 5216 1.24 1.49 1.13 117 TooManyTo_004 4853 0.83 0.32 1.05 118 XM_H_Long_From02 4853 1.12 1.27 1.05 119 TM2_M_VERY_LONG_WORD 4740 1.12 1.33 1.02 120 XMSexyCombo_01 4452 1.20 1.75 0.96 121 DKIM_ADSP_CUSTOM_MED 4386 0.99 1.08 0.95 122 URI_TRY_3LD 4284 1.12 1.57 0.92 123 RELAYCOUNTRY_GB 4193 0.93 1.00 0.90 124 XMNoVowels 4111 0.75 0.44 0.89 125 TooManyTo_005 4078 0.69 0.27 0.88 126 T_FILL_THIS_FORM_SHORT 4019 1.00 1.31 0.87 127 XM_ProductURIs 3849 0.84 0.87 0.83 128 XM_UB50 3701 2.36 5.91 0.80 129 XM_B_REG_HTML 3567 0.64 0.35 0.77 130 XM_RXBody 3307 0.67 0.57 0.71 131 XMLngstWrd_00 3273 0.62 0.42 0.71 132 MISSING_HEADERS 3066 4.48 13.14 0.66 133 XMLngstWrd_01 3045 0.58 0.40 0.66 134 TR_LOTS_OF_MONEY3 3016 0.60 0.49 0.65 135 T_XMDrugObfuBody_00 3003 1.00 1.81 0.65 136 T_XMHurry_00 2942 0.83 1.26 0.63 137 TM2_M_A_HREF_HREF 2868 0.59 0.53 0.62 138 NML_ADSP_CUSTOM_MED 2866 0.75 1.03 0.62 139 XMBrknScrpt_02 2835 0.58 0.52 0.61 140 XMMoneyMeta_00 2827 0.96 1.76 0.61 141 XM_H_PHPMailer 2814 0.60 0.60 0.61 142 XMBody_17 2788 0.87 1.48 0.60 143 T_TooManySym_03 2758 0.44 0.10 0.59 144 T_OBFU_PDF_ATTACH 2745 0.48 0.22 0.59 145 XMSexyCombo_04 2745 0.63 0.73 0.59 146 T_FROM_GOV_SPOOF 2730 0.50 0.29 0.59 147 USER_IN_WHITELIST 2682 0.40 0.00 0.58 148 HTML_FONT_FACE_BAD 2673 0.69 0.94 0.58 149 T_Symld_Words_02 2625 0.79 1.31 0.57 150 DKIM_ADSP_NXDOMAIN 2577 0.88 1.62 0.56 151 XM_USANA_RCVD 2538 0.38 0.00 0.55 152 HTTPS_HTTP_MISMATCH 2526 0.69 1.03 0.54 153 SHORT_HELO_AND_INLINE_IMAGE 2489 0.39 0.06 0.54 154 TR_XM_RelayPhish 2436 0.79 1.38 0.53 155 XMGappySubj_01 2436 0.45 0.28 0.53 156 AC_DIV_BONANZA 2395 0.40 0.15 0.52 157 FORGED_GMAIL_RCVD 2359 0.66 1.00 0.51 158 XMBody_95 2332 0.40 0.16 0.50 159 RELAYCOUNTRY_NL 2286 0.54 0.64 0.49 160 XMDateMe_00 2250 0.54 0.65 0.49 161 XMSubMetaSxObfu_02 2229 0.44 0.36 0.48 162 HTML_IMAGE_ONLY_32 2226 0.40 0.20 0.48 163 XMHTMLBadTable_001 2220 0.52 0.60 0.48 164 XM_B_COPY_HTML 2206 0.55 0.73 0.48 165 XMSubMetaI_00 2200 1.12 2.58 0.47 166 URI_NOVOWEL 2156 0.58 0.84 0.47 167 T_MANY_PILL_PRICE 2103 0.33 0.04 0.45 168 RCVD_IN_SORBS_DUL 2090 0.37 0.19 0.45 169 RELAYCOUNTRY_DE 2079 0.80 1.59 0.45 170 XMHTML_After_End 2026 0.78 1.56 0.44 171 XM_ShortIntro_01 2022 0.39 0.30 0.44 172 TM2_M_BODY_EMPTY 2011 0.34 0.12 0.43 173 RELAYCOUNTRY_AU 1996 0.46 0.54 0.43 174 XMSubMetaSxObfu_03 1916 0.46 0.56 0.41 175 RDNS_DYNAMIC 1834 0.48 0.66 0.40 176 XMBody_78 1771 0.68 1.35 0.38 177 HTML_IMAGE_ONLY_28 1764 0.47 0.69 0.38 178 HTML_TAG_BALANCE_BODY 1753 0.46 0.65 0.38 179 XMSolicitRefs_0 1748 0.39 0.41 0.38 180 XMSubNoVowel 1730 0.55 0.94 0.37 181 XMPhish30 1706 0.56 1.00 0.37 182 XMLKML 1694 0.25 0.00 0.37 183 XMLngstWrd_02 1680 0.37 0.38 0.36 184 T_FROM_GOV_DKIM_AU 1678 0.30 0.16 0.36 185 REMOVE_BEFORE_LINK 1631 0.40 0.50 0.35 186 DIET_1 1626 1.08 2.74 0.35 187 RCVD_IN_BL_SPAMCOP_NET 1549 0.68 1.47 0.33 188 XM_B_TRADE_HTML 1544 0.33 0.32 0.33 189 XMPhish14 1518 0.44 0.68 0.33 190 HTML_IMAGE_ONLY_24 1505 0.31 0.26 0.32 191 FILL_THIS_FORM 1457 0.60 1.24 0.31 192 NO_DNS_FOR_FROM 1438 0.44 0.75 0.31 193 XMSubEmpty 1429 0.46 0.79 0.31 194 XM_D_tchamptons_WL 1415 0.21 0.00 0.31 195 XM_URI_RBL 1381 0.95 2.44 0.30 196 T_TooManySym_04 1358 0.21 0.02 0.29 197 HTML_IMAGE_ONLY_20 1350 0.27 0.24 0.29 198 TR_MetaPhish_Combo_01b 1337 0.28 0.27 0.29 199 SpammyFromTLD_02 1336 4.96 15.55 0.29 200 TVD_SPACE_RATIO 1328 0.29 0.31 0.29 ----------------------------------------------------------------------