Email: 657368 Autolearn: 0 AvgScore: 2.95 AvgScanTime: 3.84 sec Spam: 168253 Autolearn: 0 AvgScore: 12.31 AvgScanTime: 4.48 sec Ham: 489115 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 3.62 sec Time Spent Running SA: 701.90 hours Time Spent Processing Spam: 209.39 hours Time Spent Processing Ham: 492.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153088 81.05 90.99 77.63 2 DKIM_SIGNED 137971 69.89 82.00 65.73 3 XM_DK_Pass 132164 68.05 78.55 64.44 4 DCC_CHECK 131402 45.14 78.10 33.81 5 DKIM_VALID 125253 64.00 74.44 60.41 6 XMListUnsubscribeExists 117091 50.45 69.59 43.86 7 DKIM_VALID_AU 101060 46.48 60.06 41.80 8 XM_H_QuotedFrom 88438 37.60 52.56 32.45 9 BAYES_50 75273 57.43 44.74 61.80 10 HTML_FONT_LOW_CONTRAST 62882 27.72 37.37 24.39 11 XM_DK_Undo_02 60138 15.59 35.74 8.66 12 LOC_TINY_FONT_1 59440 23.12 35.33 18.92 13 MIME_HTML_ONLY 56113 22.11 33.35 18.24 14 BAYES_99 53377 13.66 31.72 7.44 15 FVGT_m_MULTI_ODD 46114 20.87 27.41 18.63 16 XMSubLong 44249 21.70 26.30 20.11 17 BAYES_999 42921 11.16 25.51 6.22 18 TR_DCC_Bayes_99 41883 9.23 24.89 3.84 19 DKIM_VALID_EF 39516 23.54 23.49 23.56 20 T_TM2_M_HEADER_IN_MSG 35754 25.89 21.25 27.48 21 XM_Body_Dirty_Words 35002 14.25 20.80 11.99 22 DCC_CHECK_NEGATIVE 34119 53.26 20.28 64.60 23 T_KAM_HTML_FONT_INVALID 33253 15.22 19.76 13.66 24 HTML_IMAGE_RATIO_02 30482 9.84 18.12 6.99 25 MultiRelay 28222 16.51 16.77 16.42 26 XM_Multi_Part_URI 27617 12.39 16.41 11.00 27 RELAYCOUNTRY_META 26458 7.15 15.73 4.20 28 XM_Evil_Numbers_Gen 25164 9.03 14.96 7.00 29 BOTNET 23161 4.61 13.77 1.46 30 BOTNET_IPINHOSTNAME 20985 6.55 12.47 4.51 31 LOTS_OF_MONEY 20758 10.88 12.34 10.37 32 FSL_BULK_SIG 20131 7.46 11.96 5.91 33 TooManyTo_001 18912 16.04 11.24 17.69 34 XMSexyCombo_05 18555 5.39 11.03 3.45 35 UNTRUSTED_Relay 16511 3.32 9.81 1.09 36 FROM_EXCESS_BASE64 15984 5.08 9.50 3.56 37 TR_XM_DocInvoice 15872 5.36 9.43 3.95 38 MPART_ALT_DIFF 15220 4.11 9.05 2.42 39 T_XMDrugObfuBody_14 14676 7.33 8.72 6.85 40 XM_B_Phish_Phrases 13802 5.82 8.20 5.00 41 XM_UncommonTLD01 13703 5.87 8.14 5.08 42 HTML_IMAGE_RATIO_04 13684 5.83 8.13 5.03 43 XMSubMetaSx_00 13537 4.78 8.05 3.66 44 DKIM_INVALID 12718 5.89 7.56 5.31 45 BAYES_80 12621 4.34 7.50 3.25 46 XM_H_Long_From01 12275 5.72 7.30 5.17 47 TM2_M_URI_OPT_OUT 11139 9.17 6.62 10.05 48 BAYES_60 10850 6.13 6.45 6.02 49 HTML_IMAGE_RATIO_06 10832 4.03 6.44 3.20 50 LotsOfNums_01 9196 7.18 5.47 7.77 51 MIME_QP_LONG_LINE 8592 11.45 5.11 13.63 52 ALL_TRUSTED 8071 21.27 4.80 26.93 53 MIME_HTML_ONLY_MULTI 7939 2.06 4.72 1.15 54 RCVD_IN_RP_RNBL 7812 1.21 4.64 0.03 55 XMNumbers 7720 3.70 4.59 3.40 56 BAYES_95 7606 2.69 4.52 2.06 57 MIME_HTML_MOSTLY 7585 2.73 4.51 2.12 58 TooManyTo_002 7495 10.66 4.45 12.79 59 TooManyTo_003 7243 10.11 4.30 12.10 60 XM_DIRTYINTL 7126 2.33 4.24 1.67 61 XMStrtUSub 6954 4.00 4.13 3.96 62 XM_UB50 6481 1.47 3.85 0.65 63 XM_SPF_SoftFail 6465 2.28 3.84 1.74 64 T_REMOTE_IMAGE 6352 4.01 3.78 4.09 65 HTML_MIME_NO_HTML_TAG 6274 2.63 3.73 2.25 66 XM_OfRef6 6238 2.02 3.71 1.44 67 XM_SendGrid 6077 4.72 3.61 5.10 68 XMSexyCombo_01 5953 1.43 3.54 0.71 69 SHORT_URI 5615 0.99 3.34 0.18 70 XM_salutation 5561 0.97 3.31 0.17 71 URI_HEX 5431 2.16 3.23 1.80 72 RELAYCOUNTRY_CA 5420 1.75 3.22 1.24 73 RCVD_IN_MSPIKE_H2 5367 4.06 3.19 4.36 74 T_TooManySym_01 5251 4.48 3.12 4.95 75 MultiRelay_CC 5194 0.88 3.09 0.12 76 MultiRelay_Combo 5194 0.88 3.09 0.12 77 XM_CamelCaseFrm001 4955 1.99 2.94 1.66 78 T_XMDrugObfuBody_08 4874 1.82 2.90 1.45 79 XM_BadFromFormat 4689 0.84 2.79 0.17 80 XMDiploma_00 4628 1.86 2.75 1.56 81 SpammyFromTLD_02 4592 0.97 2.73 0.37 82 SpammyFromTLD_01 3963 2.77 2.36 2.91 83 HTML_IMAGE_RATIO_08 3952 2.02 2.35 1.91 84 RELAYCOUNTRY_NL 3812 0.72 2.27 0.18 85 RCVD_IN_BL_SPAMCOP_NET 3690 0.81 2.19 0.33 86 BODY_URI_ONLY 3600 0.59 2.14 0.06 87 XMBdyGiftCard01 3500 1.24 2.08 0.95 88 XM_UB99 3364 0.52 2.00 0.01 89 XM_URI_RBL 3346 0.75 1.99 0.33 90 HTML_SHORT_LINK_IMG_1 3342 0.54 1.99 0.04 91 XMGenDplmaNmb 3171 1.18 1.88 0.94 92 URI_TRY_3LD 3151 1.20 1.87 0.97 93 BAYES_40 3075 3.71 1.83 4.36 94 TR_Symld_Words 3064 1.78 1.82 1.77 95 XMLngstWrd_00 2948 0.94 1.75 0.66 96 XMLngstWrd_01 2929 0.91 1.74 0.63 97 RCVD_IN_RP_SAFE 2918 6.79 1.73 8.53 98 DKIM_ADSP_CUSTOM_MED 2889 1.17 1.72 0.98 99 BOTNET_NORDNS 2870 0.45 1.71 0.01 100 HTML_IMAGE_ONLY_08 2826 0.51 1.68 0.11 101 HTML_FONT_SIZE_HUGE 2821 0.53 1.68 0.13 102 SUBJ_ALL_CAPS 2816 1.95 1.67 2.05 103 SUBJ_DOLLARS 2788 0.75 1.66 0.44 104 NML_ADSP_CUSTOM_MED 2786 0.95 1.66 0.71 105 FILL_THIS_FORM 2761 0.70 1.64 0.38 106 MISSING_HEADERS 2740 0.75 1.63 0.45 107 UNPARSEABLE_RELAY 2737 2.53 1.63 2.84 108 TR_XM_RelayPhish 2696 0.78 1.60 0.49 109 XMHTML_After_End 2648 0.65 1.57 0.33 110 TM2_M_VERY_LONG_WORD 2630 1.01 1.56 0.83 111 T_XMDrugObfuBody_00 2620 1.19 1.56 1.06 112 T_FILL_THIS_FORM_LONG 2619 0.63 1.56 0.32 113 XM_UB999 2589 0.40 1.54 0.01 114 XMLngstWrd_02 2570 0.59 1.53 0.27 115 XMSubMetaI_00 2566 0.76 1.53 0.50 116 XMStockSpam_06 2501 1.57 1.49 1.59 117 T_MONEY_PERCENT 2488 0.59 1.48 0.28 118 TR_LOTS_OF_MONEY2 2488 0.59 1.48 0.28 119 XMLngstWrd_03 2400 0.48 1.43 0.16 120 XMPhish11 2380 1.12 1.41 1.02 121 XMClaimOffer 2286 0.50 1.36 0.21 122 XM_H_Long_From02 2268 1.02 1.35 0.91 123 T_XMHurry_00 2264 0.76 1.35 0.56 124 URIBL_DBL_SPAM 2258 0.40 1.34 0.07 125 BAYES_20 2177 2.49 1.29 2.90 126 RCVD_IN_IADB_LISTED 2166 4.47 1.29 5.56 127 MIME_HEADER_CTYPE_ONLY 2158 0.41 1.28 0.11 128 XMBody_17 2147 0.60 1.28 0.36 129 XM_UB80 2131 0.35 1.27 0.04 130 MAILING_LIST_MULTI 2124 1.73 1.26 1.90 131 T_TVD_MIME_EPI 2095 0.33 1.25 0.02 132 XMPhish30 2056 0.54 1.22 0.30 133 XMBody_78 2046 0.67 1.22 0.48 134 URIBL_BLACK 2037 0.35 1.21 0.06 135 XM_UB60 2001 0.36 1.19 0.07 136 RCVD_IN_RP_CERTIFIED 1968 6.27 1.17 8.02 137 BAYES_00 1898 8.11 1.13 10.51 138 XMSexyCombo_04 1870 0.37 1.11 0.11 139 RCVD_IN_IADB_SPF 1857 3.84 1.10 4.78 140 RELAYCOUNTRY_CN 1830 0.30 1.09 0.04 141 HTML_TAG_BALANCE_BODY 1830 0.55 1.09 0.37 142 RELAYCOUNTRY_FR 1816 0.40 1.08 0.16 143 RELAYCOUNTRY_JP 1808 0.29 1.07 0.03 144 URI_NOVOWEL 1766 0.56 1.05 0.39 145 DATE_IN_FUTURE_06_12 1765 0.27 1.05 0.00 146 T_Symld_Words_02 1739 0.69 1.03 0.57 147 RCVD_IN_IADB_DK 1737 3.29 1.03 4.07 148 RCVD_IN_IADB_SENDERID 1725 3.36 1.03 4.17 149 XMMoneyMeta_00 1722 0.56 1.02 0.40 150 T_TooManySym_02 1688 1.53 1.00 1.71 151 HTML_IMAGE_ONLY_12 1685 0.42 1.00 0.22 152 T_FILL_THIS_FORM_SHORT 1670 0.81 0.99 0.74 153 XM_B_COPY_HTML 1660 0.56 0.99 0.42 154 TR_MetaPhish_Combo_01 1656 1.24 0.98 1.32 155 TR_Mismatch_TLD_02 1620 0.28 0.96 0.05 156 XMSubMetaSxObfu_03 1609 0.61 0.96 0.49 157 HTML_IMAGE_ONLY_28 1608 0.49 0.96 0.32 158 XM_H_PHPOS 1599 1.02 0.95 1.05 159 XM_DK_Undo_01 1590 1.58 0.95 1.80 160 RELAYCOUNTRY_IN 1589 0.31 0.94 0.09 161 PLING_QUERY 1573 0.44 0.93 0.27 162 USB_DRIVES 1572 0.24 0.93 0.00 163 DIET_1 1551 0.76 0.92 0.71 164 XMSlimDrugH 1544 0.51 0.92 0.37 165 XM_ShortIntro_01 1526 1.37 0.91 1.53 166 RELAYCOUNTRY_GB 1520 0.85 0.90 0.84 167 HTML_FONT_FACE_BAD 1509 0.64 0.90 0.55 168 MONEY_FRAUD_5 1488 0.23 0.88 0.00 169 XMWhlSbjSex 1448 0.33 0.86 0.14 170 RCVD_IN_IADB_VOUCHED 1443 2.98 0.86 3.71 171 HTML_FONT_SIZE_LARGE 1439 0.40 0.86 0.24 172 XM_ProductURIs 1437 0.77 0.85 0.75 173 TM2_M_A_HREF_HREF 1426 0.69 0.85 0.64 174 RELAYCOUNTRY_DE 1400 0.50 0.83 0.38 175 XM_PDF 1384 3.47 0.82 4.38 176 BAYES_05 1375 1.45 0.82 1.67 177 DATE_IN_PAST_03_06 1375 0.28 0.82 0.10 178 HTTPS_HTTP_MISMATCH 1373 0.50 0.82 0.39 179 XM_UB95 1364 0.22 0.81 0.02 180 RELAYCOUNTRY_AT 1351 0.33 0.80 0.17 181 TR_XM_DK_Bayes 1333 5.74 0.79 7.44 182 XMHTMLBadTable_001 1323 0.75 0.79 0.73 183 XM_H_PHPMailer 1311 0.60 0.78 0.54 184 T_HTML_TAG_BALANCE_CENTER 1299 0.28 0.77 0.11 185 RCVD_IN_MSPIKE_WL 1298 1.54 0.77 1.81 186 XMPhish14 1296 0.55 0.77 0.48 187 XM_Body_Obfu01 1281 0.32 0.76 0.17 188 RCVD_IN_MSPIKE_H3 1265 1.53 0.75 1.80 189 TR_LOTS_OF_MONEY3 1254 0.38 0.75 0.25 190 REMOVE_BEFORE_LINK 1254 0.36 0.75 0.22 191 DKIM_ADSP_NXDOMAIN 1228 0.45 0.73 0.36 192 XMBrknScrpt_02 1213 0.54 0.72 0.48 193 US_DOLLARS_3 1174 1.04 0.70 1.16 194 TR_XM_DK_Bayes1 1161 5.26 0.69 6.84 195 RDNS_DYNAMIC 1160 0.45 0.69 0.36 196 HTML_TAG_BALANCE_HEAD 1137 0.24 0.68 0.09 197 RELAYCOUNTRY_AU 1090 0.45 0.65 0.38 198 LongTLD 1070 0.25 0.64 0.12 199 ANY_BOUNCE_MESSAGE 1059 2.06 0.63 2.56 200 BOUNCE_MESSAGE 1056 2.06 0.63 2.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 379711 81.05 90.99 77.63 2 DKIM_SIGNED 321473 69.89 82.00 65.73 3 DCC_CHECK_NEGATIVE 315985 53.26 20.28 64.60 4 XM_DK_Pass 315189 68.05 78.55 64.44 5 BAYES_50 302259 57.43 44.74 61.80 6 DKIM_VALID 295484 64.00 74.44 60.41 7 XMListUnsubscribeExists 214544 50.45 69.59 43.86 8 DKIM_VALID_AU 204461 46.48 60.06 41.80 9 DCC_CHECK 165352 45.14 78.10 33.81 10 XM_H_QuotedFrom 158721 37.60 52.56 32.45 11 T_TM2_M_HEADER_IN_MSG 134413 25.89 21.25 27.48 12 ALL_TRUSTED 131723 21.27 4.80 26.93 13 HTML_FONT_LOW_CONTRAST 119317 27.72 37.37 24.39 14 DKIM_VALID_EF 115257 23.54 23.49 23.56 15 XMSubLong 98375 21.70 26.30 20.11 16 LOC_TINY_FONT_1 92547 23.12 35.33 18.92 17 FVGT_m_MULTI_ODD 91102 20.87 27.41 18.63 18 MIME_HTML_ONLY 89203 22.11 33.35 18.24 19 TooManyTo_001 86528 16.04 11.24 17.69 20 MultiRelay 80306 16.51 16.77 16.42 21 T_KAM_HTML_FONT_INVALID 66789 15.22 19.76 13.66 22 MIME_QP_LONG_LINE 66655 11.45 5.11 13.63 23 TooManyTo_002 62558 10.66 4.45 12.79 24 XM_DKIMWhitelistDomains 61198 9.32 0.02 12.51 25 TooManyTo_003 59193 10.11 4.30 12.10 26 XM_Body_Dirty_Words 58655 14.25 20.80 11.99 27 XM_Multi_Part_URI 53824 12.39 16.41 11.00 28 BAYES_00 51407 8.11 1.13 10.51 29 LOTS_OF_MONEY 50733 10.88 12.34 10.37 30 TM2_M_URI_OPT_OUT 49142 9.17 6.62 10.05 31 XM_DK_Undo_02 42362 15.59 35.74 8.66 32 RCVD_IN_RP_SAFE 41710 6.79 1.73 8.53 33 RCVD_IN_RP_CERTIFIED 39239 6.27 1.17 8.02 34 LotsOfNums_01 38000 7.18 5.47 7.77 35 TR_XM_DK_Bayes 36404 5.74 0.79 7.44 36 BAYES_99 36396 13.66 31.72 7.44 37 XM_Evil_Numbers_Gen 34228 9.03 14.96 7.00 38 HTML_IMAGE_RATIO_02 34191 9.84 18.12 6.99 39 T_XMDrugObfuBody_14 33484 7.33 8.72 6.85 40 TR_XM_DK_Bayes1 33447 5.26 0.69 6.84 41 BAYES_999 30439 11.16 25.51 6.22 42 BAYES_60 29432 6.13 6.45 6.02 43 FSL_BULK_SIG 28903 7.46 11.96 5.91 44 TR_XM_DK_Bayes2 28153 4.43 0.57 5.76 45 RCVD_IN_IADB_LISTED 27192 4.47 1.29 5.56 46 DKIM_INVALID 25989 5.89 7.56 5.31 47 XM_H_Long_From01 25309 5.72 7.30 5.17 48 XM_SendGrid 24930 4.72 3.61 5.10 49 XM_UncommonTLD01 24869 5.87 8.14 5.08 50 HTML_IMAGE_RATIO_04 24614 5.83 8.13 5.03 51 XM_B_Phish_Phrases 24454 5.82 8.20 5.00 52 T_TooManySym_01 24193 4.48 3.12 4.95 53 RCVD_IN_IADB_SPF 23384 3.84 1.10 4.78 54 BOTNET_IPINHOSTNAME 22083 6.55 12.47 4.51 55 XM_PDF 21413 3.47 0.82 4.38 56 RCVD_IN_MSPIKE_H2 21308 4.06 3.19 4.36 57 BAYES_40 21307 3.71 1.83 4.36 58 RELAYCOUNTRY_META 20563 7.15 15.73 4.20 59 RCVD_IN_IADB_SENDERID 20375 3.36 1.03 4.17 60 T_REMOTE_IMAGE 19984 4.01 3.78 4.09 61 RCVD_IN_IADB_DK 19901 3.29 1.03 4.07 62 XMStrtUSub 19348 4.00 4.13 3.96 63 TR_XM_DocInvoice 19338 5.36 9.43 3.95 64 TR_DCC_Bayes_99 18806 9.23 24.89 3.84 65 RCVD_IN_IADB_VOUCHED 18170 2.98 0.86 3.71 66 XMSubMetaSx_00 17915 4.78 8.05 3.66 67 IN_ZIMBRA_NJ_WHITELIST 17754 2.71 0.03 3.63 68 FROM_EXCESS_BASE64 17427 5.08 9.50 3.56 69 XMSexyCombo_05 16885 5.39 11.03 3.45 70 XMNumbers 16613 3.70 4.59 3.40 71 BAYES_80 15902 4.34 7.50 3.25 72 HTML_IMAGE_RATIO_06 15648 4.03 6.44 3.20 73 SpammyFromTLD_01 14245 2.77 2.36 2.91 74 BAYES_20 14178 2.49 1.29 2.90 75 UNPARSEABLE_RELAY 13894 2.53 1.63 2.84 76 TO_MALFORMED 13689 2.09 0.03 2.80 77 ANY_BOUNCE_MESSAGE 12502 2.06 0.63 2.56 78 BOUNCE_MESSAGE 12501 2.06 0.63 2.56 79 TVD_RCVD_IP 12310 1.93 0.24 2.52 80 MPART_ALT_DIFF 11823 4.11 9.05 2.42 81 RCVD_IN_IADB_OPTIN 11795 1.95 0.61 2.41 82 HTML_MIME_NO_HTML_TAG 10982 2.63 3.73 2.25 83 MIME_HTML_MOSTLY 10384 2.73 4.51 2.12 84 BAYES_95 10078 2.69 4.52 2.06 85 SUBJ_ALL_CAPS 10030 1.95 1.67 2.05 86 HTML_IMAGE_RATIO_08 9346 2.02 2.35 1.91 87 MAILING_LIST_MULTI 9280 1.73 1.26 1.90 88 RCVD_IN_MSPIKE_WL 8840 1.54 0.77 1.81 89 XM_DK_Undo_01 8802 1.58 0.95 1.80 90 URI_HEX 8794 2.16 3.23 1.80 91 RCVD_IN_MSPIKE_H3 8790 1.53 0.75 1.80 92 TR_Symld_Words 8652 1.78 1.82 1.77 93 XM_SPF_SoftFail 8514 2.28 3.84 1.74 94 T_TooManySym_02 8359 1.53 1.00 1.71 95 XM_DIRTYINTL 8163 2.33 4.24 1.67 96 BAYES_05 8155 1.45 0.82 1.67 97 XM_CamelCaseFrm001 8098 1.99 2.94 1.66 98 HELO_NODOT 7940 1.34 0.50 1.62 99 XMStockSpam_06 7792 1.57 1.49 1.59 100 XMDiploma_00 7631 1.86 2.75 1.56 101 XM_ShortIntro_01 7468 1.37 0.91 1.53 102 IN_HORDE_ADDRESS_BOOK 7401 1.14 0.05 1.51 103 BOTNET 7137 4.61 13.77 1.46 104 T_XMDrugObfuBody_08 7104 1.82 2.90 1.45 105 XM_OfRef6 7023 2.02 3.71 1.44 106 INVALID_MSGID 6863 1.10 0.20 1.40 107 TR_MetaPhish_Combo_01 6478 1.24 0.98 1.32 108 RELAYCOUNTRY_CA 6055 1.75 3.22 1.24 109 XMCapTrack 5693 0.94 0.28 1.16 110 US_DOLLARS_3 5689 1.04 0.70 1.16 111 MIME_HTML_ONLY_MULTI 5616 2.06 4.72 1.15 112 USER_IN_DEF_DKIM_WL 5512 0.87 0.13 1.13 113 UNTRUSTED_Relay 5313 3.32 9.81 1.09 114 XM_GoogleGroups 5270 0.91 0.43 1.08 115 T_XMDrugObfuBody_00 5185 1.19 1.56 1.06 116 XM_H_PHPOS 5123 1.02 0.95 1.05 117 XMPhish11 4991 1.12 1.41 1.02 118 DKIM_ADSP_CUSTOM_MED 4790 1.17 1.72 0.98 119 TooManyTo_004 4760 0.85 0.49 0.97 120 URI_TRY_3LD 4740 1.20 1.87 0.97 121 XMBdyGiftCard01 4671 1.24 2.08 0.95 122 XMGenDplmaNmb 4605 1.18 1.88 0.94 123 XM_H_Long_From02 4440 1.02 1.35 0.91 124 XMGappySubj_01 4103 0.73 0.43 0.84 125 RELAYCOUNTRY_GB 4094 0.85 0.90 0.84 126 TM2_M_VERY_LONG_WORD 4036 1.01 1.56 0.83 127 TooManyTo_005 3878 0.70 0.42 0.79 128 XM_ProductURIs 3655 0.77 0.85 0.75 129 T_FILL_THIS_FORM_SHORT 3641 0.81 0.99 0.74 130 XMHTMLBadTable_001 3584 0.75 0.79 0.73 131 NML_ADSP_CUSTOM_MED 3477 0.95 1.66 0.71 132 XMSexyCombo_01 3476 1.43 3.54 0.71 133 DIET_1 3475 0.76 0.92 0.71 134 XMSolicitRefs_0 3425 0.59 0.28 0.70 135 XMLngstWrd_00 3230 0.94 1.75 0.66 136 XM_UB50 3157 1.47 3.85 0.65 137 TM2_M_A_HREF_HREF 3124 0.69 0.85 0.64 138 XMLngstWrd_01 3071 0.91 1.74 0.63 139 T_OBFU_PDF_ATTACH 3060 0.51 0.17 0.63 140 XM_D_tchamptons_WL 2922 0.45 0.00 0.60 141 USER_IN_WHITELIST 2912 0.44 0.00 0.60 142 XM_B_REG_HTML 2858 0.50 0.26 0.58 143 T_Symld_Words_02 2797 0.69 1.03 0.57 144 T_XMHurry_00 2741 0.76 1.35 0.56 145 HTML_FONT_FACE_BAD 2688 0.64 0.90 0.55 146 XM_H_PHPMailer 2628 0.60 0.78 0.54 147 XMDateMe_00 2533 0.49 0.40 0.52 148 URIBL_DBL_ABUSE_SPAM 2509 0.45 0.25 0.51 149 XMNoVowels 2460 0.52 0.55 0.50 150 XMSubMetaI_00 2452 0.76 1.53 0.50 151 XMBody_95 2444 0.42 0.19 0.50 152 T_TooManySym_03 2412 0.47 0.41 0.49 153 TR_XM_RelayPhish 2410 0.78 1.60 0.49 154 FORGED_GMAIL_RCVD 2391 0.52 0.61 0.49 155 XMSubMetaSxObfu_03 2381 0.61 0.96 0.49 156 XMBrknScrpt_02 2359 0.54 0.72 0.48 157 XMBody_78 2354 0.67 1.22 0.48 158 XMPhish14 2341 0.55 0.77 0.48 159 AC_DIV_BONANZA 2337 0.40 0.18 0.48 160 MISSING_HEADERS 2201 0.75 1.63 0.45 161 XMSubject_40 2181 0.34 0.02 0.45 162 T_MANY_PILL_PRICE 2180 0.33 0.00 0.45 163 SUBJ_DOLLARS 2167 0.75 1.66 0.44 164 XM_B_COPY_HTML 2047 0.56 0.99 0.42 165 HTML_IMAGE_ONLY_32 2018 0.38 0.28 0.41 166 XMMoneyMeta_00 1971 0.56 1.02 0.40 167 URI_NOVOWEL 1905 0.56 1.05 0.39 168 XMSubMetaSxObfu_02 1902 0.36 0.27 0.39 169 SHORT_HELO_AND_INLINE_IMAGE 1900 0.31 0.08 0.39 170 HTTPS_HTTP_MISMATCH 1899 0.50 0.82 0.39 171 RELAYCOUNTRY_DE 1880 0.50 0.83 0.38 172 RELAYCOUNTRY_AU 1875 0.45 0.65 0.38 173 FILL_THIS_FORM 1851 0.70 1.64 0.38 174 RCVD_IN_SORBS_DUL 1847 0.39 0.44 0.38 175 XMSlimDrugH 1834 0.51 0.92 0.37 176 HTML_TAG_BALANCE_BODY 1803 0.55 1.09 0.37 177 SpammyFromTLD_02 1786 0.97 2.73 0.37 178 XMBody_17 1778 0.60 1.28 0.36 179 RDNS_DYNAMIC 1768 0.45 0.69 0.36 180 NO_DNS_FOR_FROM 1759 0.42 0.61 0.36 181 TM2_M_BODY_EMPTY 1751 0.30 0.12 0.36 182 DKIM_ADSP_NXDOMAIN 1737 0.45 0.73 0.36 183 T_FROM_GOV_SPOOF 1712 0.29 0.12 0.35 184 TR_Orig_Subnet 1669 0.30 0.17 0.34 185 XM_S_JOY_D 1667 0.38 0.48 0.34 186 RCVD_IN_BL_SPAMCOP_NET 1622 0.81 2.19 0.33 187 XMHTML_After_End 1608 0.65 1.57 0.33 188 XM_URI_RBL 1590 0.75 1.99 0.33 189 HTML_IMAGE_ONLY_28 1581 0.49 0.96 0.32 190 T_FILL_THIS_FORM_LONG 1552 0.63 1.56 0.32 191 XMPhish30 1483 0.54 1.22 0.30 192 XMSubNoVowel 1472 0.28 0.24 0.30 193 XMGappySubj_02 1440 0.24 0.10 0.29 194 TVD_SPACE_RATIO 1436 0.31 0.36 0.29 195 XM_H_PHPOS_M 1424 0.33 0.46 0.29 196 FROM_GOV_SPOOF 1386 0.24 0.10 0.28 197 XM_Combo_Sbj 1382 0.32 0.42 0.28 198 TR_LOTS_OF_MONEY2 1376 0.59 1.48 0.28 199 T_MONEY_PERCENT 1376 0.59 1.48 0.28 200 MPART_ALT_DIFF_COUNT 1373 0.37 0.61 0.28 ----------------------------------------------------------------------