Email: 746098 Autolearn: 0 AvgScore: 3.89 AvgScanTime: 3.97 sec Spam: 212300 Autolearn: 0 AvgScore: 13.42 AvgScanTime: 4.38 sec Ham: 533798 Autolearn: 0 AvgScore: 0.10 AvgScanTime: 3.81 sec Time Spent Running SA: 823.07 hours Time Spent Processing Spam: 258.39 hours Time Spent Processing Ham: 564.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 200245 90.17 94.32 88.52 2 DCC_CHECK 163315 46.35 76.93 34.19 3 DKIM_SIGNED 150788 67.90 71.03 66.66 4 XM_DK_Pass 146238 66.53 68.88 65.60 5 DKIM_VALID 138419 62.49 65.20 61.41 6 XMListUnsubscribeExists 127390 49.72 60.00 45.63 7 XM_H_QuotedFrom 111060 37.44 52.31 31.53 8 DKIM_VALID_AU 110119 45.33 51.87 42.73 9 BAYES_50 85141 51.88 40.10 56.56 10 MIME_HTML_ONLY 75542 22.07 35.58 16.70 11 XM_DK_Undo_02 70098 15.82 33.02 8.98 12 BAYES_99 68779 14.70 32.40 7.67 13 HTML_FONT_LOW_CONTRAST 67388 26.40 31.74 24.28 14 LOC_TINY_FONT_1 65802 22.11 30.99 18.57 15 BAYES_999 53022 11.71 24.98 6.43 16 TR_DCC_Bayes_99 52969 9.93 24.95 3.96 17 FVGT_m_MULTI_ODD 49252 21.23 23.20 20.45 18 XMSubLong 47607 20.20 22.42 19.32 19 DCC_CHECK_NEGATIVE 45563 51.92 21.46 64.03 20 FSL_BULK_SIG 43939 9.89 20.70 5.59 21 DKIM_VALID_EF 43364 22.47 20.43 23.28 22 BOTNET 42007 6.70 19.79 1.49 23 T_TM2_M_HEADER_IN_MSG 39947 24.86 18.82 27.27 24 T_KAM_HTML_FONT_INVALID 38062 16.19 17.93 15.50 25 XM_Body_Dirty_Words 33388 12.19 15.73 10.78 26 MultiRelay 31447 15.88 14.81 16.30 27 XM_Multi_Part_URI 31047 11.97 14.62 10.91 28 RELAYCOUNTRY_META 30279 7.15 14.26 4.32 29 FROM_EXCESS_BASE64 29444 5.98 13.87 2.84 30 HTML_IMAGE_RATIO_02 27091 8.89 12.76 7.36 31 XM_Evil_Numbers_Gen 26472 8.23 12.47 6.54 32 RCVD_IN_RP_RNBL 25857 3.48 12.18 0.02 33 XM_UncommonTLD01 25175 5.82 11.86 3.42 34 BOTNET_IPINHOSTNAME 24215 6.65 11.41 4.75 35 HTML_MIME_NO_HTML_TAG 24036 4.80 11.32 2.21 36 LOTS_OF_MONEY 22767 9.39 10.72 8.86 37 BODY_URI_ONLY 20881 2.87 9.84 0.10 38 XM_BadFromFormat 20424 2.85 9.62 0.15 39 HTML_SHORT_LINK_IMG_1 20259 2.74 9.54 0.04 40 MISSING_HEADERS 20220 3.02 9.52 0.43 41 BAYES_80 20039 6.89 9.44 5.88 42 HTML_IMAGE_ONLY_08 19835 2.73 9.34 0.10 43 HTML_FONT_SIZE_HUGE 19833 2.73 9.34 0.10 44 MIME_HEADER_CTYPE_ONLY 19197 2.66 9.04 0.12 45 XMSexyCombo_05 18345 4.93 8.64 3.45 46 UNTRUSTED_Relay 18250 3.27 8.60 1.16 47 HTML_IMAGE_RATIO_04 17961 5.73 8.46 4.65 48 SpammyFromTLD_02 17896 2.64 8.43 0.34 49 XM_H_Long_From01 17778 6.07 8.37 5.15 50 XMPhish11 17227 11.35 8.11 12.64 51 BAYES_60 16741 8.76 7.89 9.10 52 T_XMDrugObfuBody_14 16603 7.27 7.82 7.05 53 ALL_TRUSTED 16463 20.79 7.75 25.97 54 MPART_ALT_DIFF 15804 3.59 7.44 2.06 55 XM_B_Phish_Phrases 14537 5.27 6.85 4.64 56 TR_XM_DocInvoice 14241 4.35 6.71 3.41 57 URI_WPADMIN 14127 10.19 6.65 11.60 58 XMNumbers 13945 4.44 6.57 3.60 59 XMSubMetaSx_00 13282 4.31 6.26 3.53 60 TooManyTo_001 13188 6.73 6.21 6.94 61 DKIM_INVALID 12369 5.41 5.83 5.25 62 BAYES_95 11536 3.52 5.43 2.76 63 LotsOfNums_01 11339 7.19 5.34 7.93 64 DATE_IN_PAST_12_24 10252 1.43 4.83 0.07 65 XMSubPhish11 10086 1.47 4.75 0.17 66 HTML_IMAGE_RATIO_06 9342 3.70 4.40 3.42 67 XM_SPF_SoftFail 8581 2.55 4.04 1.95 68 XM_UB50 8499 1.59 4.00 0.63 69 MIME_HTML_ONLY_MULTI 8419 1.96 3.97 1.16 70 MIME_HTML_MOSTLY 8032 2.34 3.78 1.76 71 XM_DIRTYINTL 7923 2.38 3.73 1.84 72 SUBJ_ALL_CAPS 7590 2.56 3.58 2.16 73 TM2_M_URI_OPT_OUT 7580 2.16 3.57 1.60 74 XMStrtUSub 7451 3.75 3.51 3.84 75 HTML_IMAGE_RATIO_08 7065 2.46 3.33 2.12 76 XM_OfRef6 6942 1.85 3.27 1.29 77 URI_HEX 6704 2.27 3.16 1.92 78 DIET_1 6631 1.09 3.12 0.28 79 T_REMOTE_IMAGE 6357 3.94 2.99 4.31 80 XMDiploma_00 6121 1.87 2.88 1.46 81 XM_SendGrid 5995 4.11 2.82 4.62 82 RELAYCOUNTRY_CA 5995 1.68 2.82 1.23 83 MultiRelay_CC 5892 0.89 2.78 0.13 84 MultiRelay_Combo 5892 0.89 2.78 0.13 85 T_TooManySym_01 5464 3.91 2.57 4.45 86 XMSlimDrugH 5424 0.95 2.55 0.30 87 RCVD_IN_MSPIKE_H2 5411 3.85 2.55 4.37 88 BOUNCE_MESSAGE 5410 10.65 2.55 13.87 89 ANY_BOUNCE_MESSAGE 5410 10.65 2.55 13.87 90 XM_CamelCaseFrm001 5404 1.97 2.55 1.74 91 XM_JunkDunk 4935 0.66 2.32 0.00 92 MIME_QP_LONG_LINE 4855 4.73 2.29 5.70 93 BOTNET_NORDNS 4849 0.66 2.28 0.01 94 XM_URI_RBL 4849 0.90 2.28 0.34 95 T_XMDrugObfuBody_08 4845 1.65 2.28 1.39 96 URI_TRY_3LD 4088 1.33 1.93 1.09 97 XM_H_Long_From02 3824 1.19 1.80 0.95 98 XMGenDplmaNmb 3706 1.18 1.75 0.95 99 RCVD_IN_RP_SAFE 3682 6.08 1.73 7.81 100 RCVD_IN_BL_SPAMCOP_NET 3678 0.71 1.73 0.30 101 BAYES_40 3482 3.00 1.64 3.54 102 TM2_M_VERY_LONG_WORD 3435 1.11 1.62 0.91 103 SpammyFromTLD_01 3381 1.35 1.59 1.25 104 TR_Symld_Words 3354 1.45 1.58 1.40 105 XMWghtMeta_00 3289 0.45 1.55 0.02 106 XMBody_17 3286 0.89 1.55 0.63 107 SUBJ_DOLLARS 3282 0.65 1.55 0.29 108 XMSexyCombo_01 3280 0.72 1.54 0.39 109 XMHTML_After_End 3239 0.66 1.53 0.32 110 T_XMHurry_00 3167 1.16 1.49 1.03 111 RELAYCOUNTRY_FR 3100 0.59 1.46 0.25 112 T_XMDrugObfuBody_00 3015 0.97 1.42 0.80 113 XMMoneyMeta_00 2957 0.73 1.39 0.46 114 XM_UB99 2938 0.42 1.38 0.04 115 RCVD_IN_RP_CERTIFIED 2926 5.53 1.38 7.18 116 BAYES_20 2906 2.37 1.37 2.77 117 XM_UB60 2808 0.43 1.32 0.07 118 T_FILL_THIS_FORM_LOAN 2798 0.62 1.32 0.34 119 UNPARSEABLE_RELAY 2766 2.48 1.30 2.95 120 FILL_THIS_FORM 2755 0.68 1.30 0.44 121 DKIM_ADSP_CUSTOM_MED 2722 0.97 1.28 0.85 122 XMStockSpam_06 2718 1.04 1.28 0.95 123 RCVD_IN_IADB_LISTED 2672 4.59 1.26 5.92 124 XM_OfRef7 2671 0.47 1.26 0.15 125 T_FILL_THIS_FORM_LONG 2667 0.61 1.26 0.36 126 TR_Mismatch_TLD_02 2653 0.40 1.25 0.06 127 HTML_TAG_BALANCE_BODY 2641 0.69 1.24 0.46 128 NML_ADSP_CUSTOM_MED 2592 0.79 1.22 0.61 129 XMBdyGiftCard01 2572 0.99 1.21 0.90 130 T_Symld_Words_02 2568 0.68 1.21 0.46 131 TR_XM_RelayPhish 2506 0.66 1.18 0.46 132 RELAYCOUNTRY_IN 2480 0.41 1.17 0.11 133 MAILING_LIST_MULTI 2468 1.86 1.16 2.14 134 TR_Caps_n_Bayes_99 2430 0.40 1.14 0.10 135 XMSubMetaI_00 2391 0.76 1.13 0.61 136 RCVD_IN_IADB_SPF 2291 3.99 1.08 5.14 137 RELAYCOUNTRY_GB 2267 0.95 1.07 0.90 138 XMPhish30 2267 0.50 1.07 0.28 139 BAYES_00 2260 7.31 1.06 9.80 140 XM_DK_Undo_01 2259 1.48 1.06 1.65 141 TR_LOTS_OF_MONEY3 2206 0.49 1.04 0.27 142 RELAYCOUNTRY_CN 2200 0.32 1.04 0.04 143 RELAYCOUNTRY_DE 2175 0.53 1.02 0.34 144 RCVD_IN_IADB_SENDERID 2163 3.53 1.02 4.52 145 RCVD_IN_IADB_DK 2136 3.45 1.01 4.42 146 XM_H_PHPOS 2086 1.34 0.98 1.49 147 XMBody_78 2078 0.59 0.98 0.44 148 XMSubMetaSSx_00 2057 0.44 0.97 0.24 149 SUBJECT_DIET 2054 0.28 0.97 0.01 150 URIBL_DBL_SPAM 2050 0.31 0.97 0.05 151 DEAR_FRIEND 2036 0.31 0.96 0.05 152 XM_UB999 2008 0.28 0.95 0.02 153 FORGED_GMAIL_RCVD 1946 0.58 0.92 0.45 154 T_LOTTO_AGENT 1916 0.26 0.90 0.00 155 HTTPS_HTTP_MISMATCH 1915 0.57 0.90 0.44 156 XM_UB80 1860 0.28 0.88 0.04 157 TR_MetaPhish_Combo_01 1859 1.17 0.88 1.29 158 URIBL_BLACK 1857 0.29 0.87 0.06 159 XMSubMetaSxObfu_03 1843 0.55 0.87 0.42 160 XM_PDF 1805 3.32 0.85 4.30 161 XM_ProductURIs 1775 0.72 0.84 0.67 162 MONEY_FRAUD_3 1721 0.23 0.81 0.00 163 T_FROM_SUSPICIOUS_NTLD 1685 0.26 0.79 0.05 164 XMGappySubj_01 1653 0.62 0.78 0.56 165 T_TooManySym_02 1652 1.31 0.78 1.52 166 TR_XM_DK_Bayes 1613 5.41 0.76 7.26 167 XMSubject_63 1611 0.22 0.76 0.00 168 RCVD_IN_IADB_VOUCHED 1610 2.98 0.76 3.87 169 T_FILL_THIS_FORM_SHORT 1606 0.73 0.76 0.72 170 T_MONEY_PERCENT 1604 0.35 0.76 0.18 171 TR_LOTS_OF_MONEY2 1604 0.35 0.76 0.18 172 XM_OfRef8 1558 0.22 0.73 0.02 173 HTML_FONT_SIZE_LARGE 1553 0.32 0.73 0.16 174 URI_NOVOWEL 1547 0.53 0.73 0.45 175 XMPhish14 1543 0.41 0.73 0.29 176 LongTLD 1534 0.33 0.72 0.17 177 T_HTML_TAG_BALANCE_CENTER 1513 0.30 0.71 0.13 178 XMBrknScrpt_02 1502 0.57 0.71 0.52 179 RELAYCOUNTRY_NL 1474 0.29 0.69 0.13 180 XM_Body_Obfu01 1463 0.38 0.69 0.26 181 RDNS_DYNAMIC 1453 0.47 0.68 0.39 182 DATE_IN_PAST_03_06 1445 0.25 0.68 0.07 183 XMClaimOffer 1440 0.26 0.68 0.10 184 TR_XM_DK_Bayes1 1432 4.96 0.67 6.66 185 REMOVE_BEFORE_LINK 1424 0.41 0.67 0.31 186 RELAYCOUNTRY_AT 1423 0.34 0.67 0.20 187 LOW_PRICE 1416 0.29 0.67 0.14 188 BAYES_05 1415 1.57 0.67 1.92 189 BODY_ENHANCEMENT 1413 0.21 0.67 0.03 190 XMLngstWrd_00 1411 0.55 0.66 0.51 191 XMSexyCombo_04 1401 0.25 0.66 0.08 192 XM_B_COPY_HTML 1396 0.46 0.66 0.38 193 MONEY_FRAUD_8 1396 0.19 0.66 0.00 194 RCVD_IN_MSPIKE_WL 1387 1.50 0.65 1.83 195 RCVD_IN_MSPIKE_H3 1381 1.49 0.65 1.83 196 XM_H_PHPMailer 1379 0.61 0.65 0.59 197 HTML_IMAGE_ONLY_12 1375 0.32 0.65 0.19 198 INVALID_DATE 1373 0.23 0.65 0.06 199 XMLngstWrd_01 1324 0.50 0.62 0.45 200 MPART_ALT_DIFF_COUNT 1300 0.39 0.61 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 472513 90.17 94.32 88.52 2 DKIM_SIGNED 355822 67.90 71.03 66.66 3 XM_DK_Pass 350151 66.53 68.88 65.60 4 DCC_CHECK_NEGATIVE 341803 51.92 21.46 64.03 5 DKIM_VALID 327803 62.49 65.20 61.41 6 BAYES_50 301922 51.88 40.10 56.56 7 XMListUnsubscribeExists 243558 49.72 60.00 45.63 8 DKIM_VALID_AU 228103 45.33 51.87 42.73 9 DCC_CHECK 182528 46.35 76.93 34.19 10 XM_H_QuotedFrom 168309 37.44 52.31 31.53 11 T_TM2_M_HEADER_IN_MSG 145543 24.86 18.82 27.27 12 ALL_TRUSTED 138633 20.79 7.75 25.97 13 HTML_FONT_LOW_CONTRAST 129588 26.40 31.74 24.28 14 DKIM_VALID_EF 124275 22.47 20.43 23.28 15 FVGT_m_MULTI_ODD 109156 21.23 23.20 20.45 16 XMSubLong 103121 20.20 22.42 19.32 17 LOC_TINY_FONT_1 99124 22.11 30.99 18.57 18 MIME_HTML_ONLY 89131 22.07 35.58 16.70 19 MultiRelay 87019 15.88 14.81 16.30 20 T_KAM_HTML_FONT_INVALID 82743 16.19 17.93 15.50 21 BOUNCE_MESSAGE 74049 10.65 2.55 13.87 22 ANY_BOUNCE_MESSAGE 74049 10.65 2.55 13.87 23 XM_DKIMWhitelistDomains 67553 9.06 0.02 12.66 24 XMPhish11 67464 11.35 8.11 12.64 25 URI_WPADMIN 61921 10.19 6.65 11.60 26 XM_Multi_Part_URI 58260 11.97 14.62 10.91 27 XM_Body_Dirty_Words 57537 12.19 15.73 10.78 28 BAYES_00 52311 7.31 1.06 9.80 29 BAYES_60 48586 8.76 7.89 9.10 30 XM_DK_Undo_02 47935 15.82 33.02 8.98 31 LOTS_OF_MONEY 47291 9.39 10.72 8.86 32 LotsOfNums_01 42316 7.19 5.34 7.93 33 RCVD_IN_RP_SAFE 41665 6.08 1.73 7.81 34 BAYES_99 40924 14.70 32.40 7.67 35 HTML_IMAGE_RATIO_02 39273 8.89 12.76 7.36 36 TR_XM_DK_Bayes 38765 5.41 0.76 7.26 37 RCVD_IN_RP_CERTIFIED 38319 5.53 1.38 7.18 38 T_XMDrugObfuBody_14 37615 7.27 7.82 7.05 39 TooManyTo_001 37029 6.73 6.21 6.94 40 TR_XM_DK_Bayes1 35565 4.96 0.67 6.66 41 XM_Evil_Numbers_Gen 34934 8.23 12.47 6.54 42 BAYES_999 34310 11.71 24.98 6.43 43 RCVD_IN_IADB_LISTED 31581 4.59 1.26 5.92 44 BAYES_80 31399 6.89 9.44 5.88 45 TR_XM_DK_Bayes2 31149 4.35 0.61 5.84 46 MIME_QP_LONG_LINE 30442 4.73 2.29 5.70 47 FSL_BULK_SIG 29854 9.89 20.70 5.59 48 DKIM_INVALID 28019 5.41 5.83 5.25 49 XM_H_Long_From01 27473 6.07 8.37 5.15 50 RCVD_IN_IADB_SPF 27449 3.99 1.08 5.14 51 BOTNET_IPINHOSTNAME 25371 6.65 11.41 4.75 52 HTML_IMAGE_RATIO_04 24818 5.73 8.46 4.65 53 XM_B_Phish_Phrases 24790 5.27 6.85 4.64 54 XM_SendGrid 24658 4.11 2.82 4.62 55 RCVD_IN_IADB_SENDERID 24143 3.53 1.02 4.52 56 T_TooManySym_01 23728 3.91 2.57 4.45 57 RCVD_IN_IADB_DK 23584 3.45 1.01 4.42 58 RCVD_IN_MSPIKE_H2 23311 3.85 2.55 4.37 59 RELAYCOUNTRY_META 23041 7.15 14.26 4.32 60 T_REMOTE_IMAGE 23006 3.94 2.99 4.31 61 XM_PDF 22940 3.32 0.85 4.30 62 TR_DCC_Bayes_99 21153 9.93 24.95 3.96 63 RCVD_IN_IADB_VOUCHED 20653 2.98 0.76 3.87 64 XMStrtUSub 20509 3.75 3.51 3.84 65 XMNumbers 19197 4.44 6.57 3.60 66 IN_ZIMBRA_NJ_WHITELIST 19052 2.56 0.03 3.57 67 BAYES_40 18874 3.00 1.64 3.54 68 XMSubMetaSx_00 18865 4.31 6.26 3.53 69 XMSexyCombo_05 18406 4.93 8.64 3.45 70 XM_UncommonTLD01 18276 5.82 11.86 3.42 71 HTML_IMAGE_RATIO_06 18264 3.70 4.40 3.42 72 TR_XM_DocInvoice 18200 4.35 6.71 3.41 73 UNPARSEABLE_RELAY 15749 2.48 1.30 2.95 74 FROM_EXCESS_BASE64 15147 5.98 13.87 2.84 75 BAYES_20 14791 2.37 1.37 2.77 76 BAYES_95 14723 3.52 5.43 2.76 77 TVD_RCVD_IP 13982 1.93 0.19 2.62 78 TO_MALFORMED 13457 1.81 0.03 2.52 79 RCVD_IN_IADB_OPTIN 13257 1.93 0.54 2.48 80 HTML_MIME_NO_HTML_TAG 11794 4.80 11.32 2.21 81 SUBJ_ALL_CAPS 11541 2.56 3.58 2.16 82 MAILING_LIST_MULTI 11423 1.86 1.16 2.14 83 HTML_IMAGE_RATIO_08 11307 2.46 3.33 2.12 84 MPART_ALT_DIFF 10995 3.59 7.44 2.06 85 TooManyTo_002 10699 1.58 0.51 2.00 86 XM_SPF_SoftFail 10433 2.55 4.04 1.95 87 BAYES_05 10267 1.57 0.67 1.92 88 URI_HEX 10249 2.27 3.16 1.92 89 XM_DIRTYINTL 9840 2.38 3.73 1.84 90 RCVD_IN_MSPIKE_WL 9769 1.50 0.65 1.83 91 RCVD_IN_MSPIKE_H3 9763 1.49 0.65 1.83 92 MIME_HTML_MOSTLY 9391 2.34 3.78 1.76 93 XM_CamelCaseFrm001 9289 1.97 2.55 1.74 94 HELO_NODOT 9091 1.31 0.33 1.70 95 XM_DK_Undo_01 8819 1.48 1.06 1.65 96 TM2_M_URI_OPT_OUT 8531 2.16 3.57 1.60 97 T_TooManySym_02 8100 1.31 0.78 1.52 98 BOTNET 7965 6.70 19.79 1.49 99 XM_H_PHPOS 7927 1.34 0.98 1.49 100 IN_HORDE_ADDRESS_BOOK 7862 1.07 0.05 1.47 101 XMDiploma_00 7804 1.87 2.88 1.46 102 TR_Symld_Words 7467 1.45 1.58 1.40 103 T_XMDrugObfuBody_08 7431 1.65 2.28 1.39 104 TooManyTo_003 7253 1.09 0.42 1.36 105 INVALID_MSGID 7114 1.00 0.18 1.33 106 TR_MetaPhish_Combo_01 6895 1.17 0.88 1.29 107 XM_OfRef6 6866 1.85 3.27 1.29 108 USER_IN_DEF_DKIM_WL 6807 0.92 0.03 1.28 109 SpammyFromTLD_01 6675 1.35 1.59 1.25 110 XMCapTrack 6623 0.96 0.24 1.24 111 RELAYCOUNTRY_CA 6547 1.68 2.82 1.23 112 MIME_HTML_ONLY_MULTI 6212 1.96 3.97 1.16 113 UNTRUSTED_Relay 6173 3.27 8.60 1.16 114 URI_TRY_3LD 5819 1.33 1.93 1.09 115 T_XMHurry_00 5516 1.16 1.49 1.03 116 XM_GoogleGroups 5411 0.83 0.37 1.01 117 TooManyTo_004 5387 0.80 0.29 1.01 118 XMGenDplmaNmb 5097 1.18 1.75 0.95 119 XM_H_Long_From02 5085 1.19 1.80 0.95 120 XMStockSpam_06 5075 1.04 1.28 0.95 121 TM2_M_VERY_LONG_WORD 4883 1.11 1.62 0.91 122 RELAYCOUNTRY_GB 4819 0.95 1.07 0.90 123 XMBdyGiftCard01 4782 0.99 1.21 0.90 124 DKIM_ADSP_CUSTOM_MED 4513 0.97 1.28 0.85 125 TooManyTo_005 4388 0.66 0.24 0.82 126 T_XMDrugObfuBody_00 4254 0.97 1.42 0.80 127 T_FILL_THIS_FORM_SHORT 3826 0.73 0.76 0.72 128 XM_ProductURIs 3560 0.72 0.84 0.67 129 XM_UB50 3377 1.59 4.00 0.63 130 XMBody_17 3366 0.89 1.55 0.63 131 XMBody_95 3277 0.46 0.09 0.61 132 NML_ADSP_CUSTOM_MED 3268 0.79 1.22 0.61 133 XMSubMetaI_00 3249 0.76 1.13 0.61 134 XM_H_PHPMailer 3145 0.61 0.65 0.59 135 USER_IN_WHITELIST 3102 0.42 0.00 0.58 136 XM_B_REG_HTML 3041 0.51 0.34 0.57 137 T_OBFU_PDF_ATTACH 2975 0.46 0.22 0.56 138 XMGappySubj_01 2970 0.62 0.78 0.56 139 T_FROM_GOV_SPOOF 2856 0.44 0.19 0.54 140 XMHTMLBadTable_001 2853 0.55 0.60 0.53 141 XMBrknScrpt_02 2783 0.57 0.71 0.52 142 XMLngstWrd_00 2712 0.55 0.66 0.51 143 XMNoVowels 2649 0.48 0.42 0.50 144 T_TooManySym_03 2645 0.39 0.12 0.50 145 XMMoneyMeta_00 2476 0.73 1.39 0.46 146 HTML_TAG_BALANCE_BODY 2475 0.69 1.24 0.46 147 T_Symld_Words_02 2474 0.68 1.21 0.46 148 TR_XM_RelayPhish 2447 0.66 1.18 0.46 149 FORGED_GMAIL_RCVD 2417 0.58 0.92 0.45 150 XMLngstWrd_01 2406 0.50 0.62 0.45 151 PLING_QUERY 2402 0.44 0.43 0.45 152 URI_NOVOWEL 2388 0.53 0.73 0.45 153 XMBody_78 2348 0.59 0.98 0.44 154 HTTPS_HTTP_MISMATCH 2342 0.57 0.90 0.44 155 FILL_THIS_FORM 2335 0.68 1.30 0.44 156 MISSING_HEADERS 2304 3.02 9.52 0.43 157 SHORT_HELO_AND_INLINE_IMAGE 2299 0.33 0.07 0.43 158 XMSubMetaSxObfu_03 2254 0.55 0.87 0.42 159 RELAYCOUNTRY_AU 2202 0.45 0.56 0.41 160 XMSubMetaSxObfu_02 2197 0.35 0.20 0.41 161 HTML_FONT_FACE_BAD 2155 0.46 0.61 0.40 162 TM2_M_A_HREF_HREF 2145 0.45 0.57 0.40 163 T_FROM_GOV_DKIM_AU 2084 0.31 0.10 0.39 164 XMSexyCombo_01 2080 0.72 1.54 0.39 165 RDNS_DYNAMIC 2071 0.47 0.68 0.39 166 XM_B_COPY_HTML 2043 0.46 0.66 0.38 167 RCVD_IN_SORBS_DUL 2036 0.35 0.28 0.38 168 TM2_M_BODY_EMPTY 1962 0.30 0.12 0.37 169 T_FILL_THIS_FORM_LONG 1919 0.61 1.26 0.36 170 XM_ShortIntro_01 1896 0.35 0.33 0.36 171 HTML_IMAGE_ONLY_32 1877 0.30 0.17 0.35 172 DKIM_ADSP_NXDOMAIN 1867 0.41 0.55 0.35 173 XM_URI_RBL 1841 0.90 2.28 0.34 174 SpammyFromTLD_02 1833 2.64 8.43 0.34 175 RELAYCOUNTRY_DE 1815 0.53 1.02 0.34 176 HTML_IMAGE_ONLY_28 1806 0.40 0.57 0.34 177 T_FILL_THIS_FORM_LOAN 1802 0.62 1.32 0.34 178 XMDateMe_00 1791 0.35 0.38 0.34 179 XMHTML_After_End 1700 0.66 1.53 0.32 180 AC_DIV_BONANZA 1653 0.26 0.13 0.31 181 REMOVE_BEFORE_LINK 1645 0.41 0.67 0.31 182 MPART_ALT_DIFF_COUNT 1642 0.39 0.61 0.31 183 XMSlimDrugH 1628 0.95 2.55 0.30 184 RCVD_IN_BL_SPAMCOP_NET 1622 0.71 1.73 0.30 185 XM_D_tchamptons_WL 1616 0.22 0.01 0.30 186 SUBJ_DOLLARS 1559 0.65 1.55 0.29 187 NO_DNS_FOR_FROM 1553 0.34 0.45 0.29 188 XMPhish14 1540 0.41 0.73 0.29 189 XM_B_TRADE_HTML 1506 0.29 0.30 0.28 190 HTML_IMAGE_ONLY_24 1503 0.27 0.25 0.28 191 XMPhish30 1490 0.50 1.07 0.28 192 DIET_1 1482 1.09 3.12 0.28 193 XMSubNoVowel 1448 0.30 0.38 0.27 194 TR_LOTS_OF_MONEY3 1438 0.49 1.04 0.27 195 HTML_IMAGE_ONLY_16 1437 0.27 0.29 0.27 196 XMLngstWrd_02 1400 0.35 0.58 0.26 197 XM_H_PHPOS_M 1385 0.29 0.37 0.26 198 XM_Body_Obfu01 1382 0.38 0.69 0.26 199 XMBody_29 1368 0.24 0.20 0.26 200 XMSolicitRefs_0 1351 0.26 0.26 0.25 ----------------------------------------------------------------------